From d64c4b9e71e39474b6d0ef0562125e570e19435a Mon Sep 17 00:00:00 2001
From: Nguyen Quang Duc <nguyenquangduc2000@gmail.com>
Date: Sat, 4 Sep 2021 23:06:27 +0700
Subject: [PATCH 0001/2658] Fix bugs for GCC 7

---
 drivers/crypto/msm/qce50.c               |   2 +-
 drivers/platform/msm/ipa/ipa_common      | Bin 0 -> 878352 bytes
 drivers/power/supply/qcom/qpnp-fg-gen3.c |   2 +-
 3 files changed, 2 insertions(+), 2 deletions(-)
 create mode 100644 drivers/platform/msm/ipa/ipa_common

diff --git a/drivers/crypto/msm/qce50.c b/drivers/crypto/msm/qce50.c
index b44f926a6ba0..18593506cfb4 100644
--- a/drivers/crypto/msm/qce50.c
+++ b/drivers/crypto/msm/qce50.c
@@ -4675,7 +4675,7 @@ static int select_mode(struct qce_device *pce_dev,
 			pce_dev->intr_cadence = 0;
 			atomic_set(&pce_dev->bunch_cmd_seq, 0);
 			atomic_set(&pce_dev->last_intr_seq, 0);
-			pce_dev->cadence_flag = ~pce_dev->cadence_flag;
+			pce_dev->cadence_flag = !pce_dev->cadence_flag;
 		}
 	}
 
diff --git a/drivers/platform/msm/ipa/ipa_common b/drivers/platform/msm/ipa/ipa_common
new file mode 100644
index 0000000000000000000000000000000000000000..6f66e0ed6e36cf09c9720be70d26f0bec8708aa2
GIT binary patch
literal 878352
zcmeFa3w%`7wLgB&Oy<mlM+gMMBajS%Xo9@L%b=opfP#uV1VwF|HzWc{NP<Gq62V8*
z+CsJU(FcgOC3t(Ut=fuDgxccmZLfXUdcEy6fc9c-@3qzk)GEL4ckO*<_Dp6tiO&7~
zZ-0O0LuU5cd+oi}UVH7e*Is*{!{&JxpYOA6%l+8a53DHU=33UaUkr!<rIISOmiiX?
zKHT(d*N1*<`~8;nX!u6!ShwHa^WmoFcJK37{u*f8@V6a*cOCNQ?Kytp#PAsWxz^)-
z!XIyK=o9`>tHc}snXY#h+0uu<_^mzd{jAn1+gcW~JC^$Fp{pT`W!?U)J>Y)=`_b7t
zW?Cp<6}LIo_5&wQNZC7!%DO(>v|sxC;ikCu9MxW@m889Eay{Bp@(n?jA-nYWLCBfE
z4Yu{DWuNzJQ`Q(ak@r~0y!`ZzrQ|o=vWBv*&o12yc$<mCa?2X~E6eH_;<n?CPYk_)
zH$C5k6w({$O|N`n3hAYL)7vsRh4cn{)7w8ah4hAb)7v#Yh4e;x)AP+rA-yr)^lC~{
zNN=n+y~AgvkY0f|z4AFJq*vrkZ`XM#q&LZ%UVeEB=@om^+cGzW^k(*g-UTV7H`|+@
z@4^()o8wJy*TpHMSLRJ`%c2z0o99h$*OC;{Ti{L4w=9M97JAdGxh#eBmUz?KvLc1_
zmV49Ne`N~kUExiy=F=&p_i1l>yDC#iuiBelc})uG)qB(1RhL3~jo$R~SEZ2NT5oz=
z8dFGboj1M1t5ZmCy*It`rWDfK=uK}|OA6^-?@ceiErs-M@TOO@K85sd@}{@z+7!~e
z)tlbojVYvehc~_a>rzN>yEna>&!v#wm%Zuj>PR8Id%fxTwx*EY*S+c0+>}Ck_j}XZ
ze@hDKebbws@3s`u>++^o{`nNr`;IrgEni3>z3+O{+rK@9^d9r3x8<%B(%b7z&v$nU
z={?;GdiSM}-gDmcYQCOAde3{)JG>)>^j`3$=i8M+dO!81xBtP^&^yZb_0LO>cQSr$
zSwl`1!#@12)X<ce`Agn?-1Sfj>HV8Gy_$bYA-&&enV#fKpypvk&yDqaoeQ{l3C{!$
z^`d`|q_BUl_k!MIsi7x2`i7F{jUGCh|AW-f6dnCjFZ%d+3hDjXo8IBQDWvzVH@%vt
zQb_N(H@#iYq>$c+-t-RdOCdeG%<~*D|3C`q1-$9iJfA{(>E85q{Wyj6271%;{c{TG
z4fdvY_$R%m*L`Bg(v#ZkVczu0f7W|?p6A9Rz3J_LF@^NTc+)HYWeVwy?FGG;Qb@1B
zn_kV!DWq5AP0#mA3h7PqrdRXZ)X<YPzPRl8Zup_)UTge+D4Oov`b2)yOz%D(el<0H
z+)ZD5cG>ay`mV@e+y#lh19JFK?`ef`hlM`7D~E)B;T-S&?Ru^EG(BxhnK!+|zfU2(
zdEWGPy^%tC3wlBCk13?L(3@WVTPdWs#GBsXw^K-Od70XKo@Af2<sC)O)$>m@-y6OA
zx8>aw_HV5>z5T~hNN=4ty~7`*hMw57^(VJy`5*S4R=2v-cXE67UGM&tf7E-LC$neL
zznf0pznT-hr`4<eUGLq$UDge$yGwY3H@(Al3h8~?o1V{~LVDHS^zzeENbgo}dgXx>
z(!0Z(UX7DNdfUD2b$L+H`=s{zDE*~+<r8|wCR0T7AZdQtTc(FYDU|7B-t>I^Qb=#F
zH@))ysi7w}^a>9fI-vKoyliL)zIEtcr8Bs9J;ZA-;mhbf?USt)qBr;VLau{SNbl?3
z^lCCwNbj58^mYwSA-yhdTeD?|qW4K{jf~%Sy!%&^mBRi#-3xldQb_MPZ+cs@Q$z14
z?dbDr{JiGiu92ysDP#D8cOQ4<q>$cEz3J^AlR|nw_ns3qd5T_2=EO_h{mUPln*Qyk
z&iotb;g{!-KEy}7?7fWn@4RKQWqb-{a>$$B;ewAxFT`ht@N5vD*NTtlh<slE81i|;
zdkl9?NX;0^c>Kwmo^MiW=!s1J{4r$mt~ZZcrly8Rkx8K3^K7VQTJPy$UPPYji`NsO
zm+nn(%Z%RB^YncNdef_!)q8rL{Tu8}&o{gG^gR1F%$we>vr|ZKWcl$<Z3kUD?kN-7
zo5%9=J|2&uG;2v-v9%8KZ5f_n+*V{;+r$6XaLjzJG?C2`T^!@hSIv@-$5%q#9}C&(
z7`rRG_&EEnOBFr0Jmm3Ari+)5UO_MDEl(l6B5!%-uSlUhCwbG`a%BqX6?@a$^{Eun
zo9Ru@SD8Y3v%Tr<s!k!jIo|ZjYkN=6(+-t+(>q-E$>?!D<4>MtSI<maLle%;dEUI#
zH1wVq&vjyfw=KxOTG4ZD$|tft3%&bycy$W<x5S&?uC*zox7?fFmge5mi`CtyyWZ_@
z9e-z$Pu@2$3_7*jS9+Z99XQH35?~v?cwr&dzQNYI2hyx%g#(ZtXss)BtY!BD7kiX#
z*xzpFI|-nVcOm8^&-cTJKW>lMw$z@#v(@(%bw;q$XB`ixS&vrDDm#vYUwQWbE}yj>
zb+(VgS?*!~P-&yevS!}kE8Sc6w-Yl>J>Lm>r131;xzyJ&1Z@mW!~^)BkT*0`+<|u`
zwAt1SvyC9?wAmd)0{Auav+&LV^kKp~i^?IB(&Ha)I-uX5kl=j>$Gv^$!<Y1aOg!h*
zhu-vji$5N{6Mp;WA8xX{-p!&O_`5!=u(osD`A!Gw!_lC1oI25&V?Fu~^rDo01;(H%
zpnf|sPI>dJbuaj>Wof|2{lx9LTDCS|;L7+O?x%Esb@2`hX@lj|pRvH94jnOZK##b|
za300@zX&?6FE)N-!?AeWivCfWVP7o2x5AHe`NeOq+S%%q?%g~9^8kGXZ!zz#IBe3=
z{kswP@jM+d@Vc`UPbb4;KfeP0I0jakviD5i0J(FX9>%*)I9A>Mkj$NKzcu3!^1Ah0
z+UZy`Fm8NTNDROG2S#O+Y&;GaI8~v<<Kg0*ooLJlc+)u22b`gh#aJziLw?8u{icqv
ze^uyrd>?Bvyy@5W0jHZZL67o3M0=;lgL&a3Iz4Vs$I{pQLn;5e_*Vt{$KQCpF!4qu
zkY%|!H<Hk*=q1iny!VEB#kq4dSbDq&ay-uty?F?80(t`*SOI%L8(7u_`><W_aqh~S
zYpvtF0sk_unIA$LXAaw~E2?BK<l2+>F8AR*HnH|3Tj*KG4?=#SVb-JXD!shR(sT3K
z^HuxiymZ@7yJCHh`CU827~fCW26=MFlWBKu9r6#GV9u{ZdgjYA_((D~egkJ;5*=`H
zI5u;j1FpVxK(`alVWZ8YbJ)buHalMT4ge<%dZe3&U-qB<Hs@D3!Tj1X)VtqX`+%e9
z_Htegi=9_V=bwQWukT~w&$#;j-sR<ZXHty5$JoomgT4EDqz^ch^=~l`X$xGx{V?u-
z_ytz)tNL)$Q(f=FKa0#I*mYFcc9ipH0M}#RgunRh3GO`V)^i{P9L^=q%QuX5ZZq-@
z0uEf!cFe&zb51euR=hU~{?N8>VhxVhjjh9@{e}*R?PA-Ae?-<#wlSaYs6rd0$@Y;J
zKaj9XC%qSRjvDij>G!b4ZS`40+<AByKAOAMv7El%A%AwSZ1L6+)S0Y^El#F0CZ6&M
zE4rv3?~7mf!^peDC@YMg@^7-Ea!NKAkMsfO5$MMu<Naj$@Q<%MapG=w&y-AOPE;s=
z?tS=k?_KVP4Ni;k=|q3v(@}Pv`Lw}GhqQgU%N^q#eIDa>(WR4)ab8qL|2OC)(xnGP
zmxhW>kJly6BU6{2{h3{S!ys!J+o7L@H9uk#IdA_b`%p3V|BkF&I!EE#-0&o5-miSj
zZmeUFhwD?yyr)jQ5I66S#?AYInD?{?FQi+`V9U1EVt!l_V+)j?G=7xa=J>~TEd9NI
zn9!!2OSRqkpU_E@*1P(hddciUE%<tk>mqoP@lUeWn|M9eoPJz$hQY_03!75W^}g$8
zRVY6zq;04lHWV~s)}ZqIs7|;(6J<@GEV0kj*28D2NMRd~1v`dN4m;mF@z_&pEsNpz
zaIV2`5?LMT1I}ZxiT@C{X3{Pm_{iHX{%=@I$DI+Chif~Y?X#U#Yxc?PtV<`6{Y%wa
zI&Na`)>0F%w`=K^2~jyETT8e00mo}Cb@wb@F_8J`5(Al#S7@!<1>e!#FYH!+i0s7=
zVgF?A7r6h9pU3-Wc=zu>A8>{uc9k&ZGTocb5d)_*$^O8_q0gERTi&hr!Sor}cXKbC
zaPMl+NH(4oy~Ozs%zyF`Z&$tct|uE~?)4bw3RRWv4HY52Io4XYALHxBL(Ornt|{G%
ze)ovGR3#ec5^wn*FmRIX3tgN<W4!;&UeGXb+&EagpMOB(K&~>r)hkQ)*6b>qP5Z9K
z7_r$h?HlM=Z~PcMhjl1f?BHbbPe*+DJjk45uq6<cyZEG<=E>$*IM{QJ)#&$6lK*5n
zSK9|1&arr1zW}m|pW8L(c#lV|fdl&>zE%8qxH#1HNqS5eBj<a6xld%j^8UpxuA<B_
z54!`_%n<h@h~?O6h`W~|?yh579f;l0zw3|kH#TkhUca!!4EL_a-i*4Ox6_`DG3e?y
z(e4UeH=xMsz&<c-C*tvWdye3bwAeQHa-F~McQK7~0mR=rmToPG#_it$Uq47PKkqm8
z+6iJyF@8h&xgAT77%{VO65pW$cxG&^`|T46WohDl0sOTi{(pz|BTlB5X8b!<wtts?
zk0)iCOfMhk15PsAzrVs;4-XhP$!x!i^Kor|zCj~df5-I_=abt0NF1dC`Y-y-_<_BL
z^M|%a#ze<ZxYtPTSGV`@tGCWK<oyZT*fGIccNp`9@zR4>UtPP)H1}j`FWL(~V}Zd_
zk~wss4>&v{3n#F7ht0kxp>w1UIP}-J)^)>X<%`WzXN!#WPzHzvMb;vYSu*?Jzo>UU
zs)-lBrX7NPHT~AO7~x&6{rI2Mts@JKar~IN<+hP3-OAVRvpty|8`lRM>K0?qXfJjx
zxWwpt65Xok0}gd-jMgpjTcJOF)vJodz0)fbFO_;_o}<hkYCTFD#@LmNh1L)5E0f!=
zo@XfsE;Z!*3EOx?*LUY-9nLD_{Tu(XD81g`#oIypEy@nYp3m$|;0x|IXjw^g=s+KE
zsH@5jMSbFv*`cj?S8=c6&IVq*zLbTM+o5jQNmG}@ADoyGKaX}Tr%&Y_`+fj;Ca?RB
zCHARIyr-2f6+3TDeM%zpiay|Q-ae^)HuL|q2<dga6Xzj33*lNWW1)4>jgPtK8;Fxd
z&LwzG5wDj=u3-P8=e6#B>65h6FhT7p%MmLrRqGji_@NWvTMMs$(Z4(W)??!n*uZ@K
zE@+wGNn|;$4>*+N$@I1Ms#qOx=V!dEOgyzlM*rWDc>ODfT!sIW_`MZ<z+oSbKp#Hb
z^fcnAHqJTJ9VS;F-hnP~AM_WTZ_qZ%e#q%q%Cn>Q{C<&p6?BAqqJuaSaQ8*r6AfFO
zR+Lp}?Tze-9=2w??ZW2l;l9TXz%OH8@Qhu;m`8Ij`r8MbD(qQ!H|f30DPwgv$@M)F
z#jV_!26^nzbD`lhbyp{TU7)SueP-UFsn0LnyK+M5-c{c#ogF{k4}4nnsR1~7>DD^z
z8J0C<STm*FB5Pd@V*UwZCZOxuYcn?1(ZA=u-B;-?H@|_?jhGz!7|*MV!##RmcuEw<
z$*=b2X`F!rxg_Mt#bFE$Jjd9}{Ll1)hJmwFk7<0r$7vj%!*E@w##mB5yzl11H5gmw
z?G|4;x`ts6?_qxY+Vk8=;yRpv<{d(Jo}6s{kp}H*Kgi%H;t}bHM_g#kyU=*6E4>i0
z2$WM_dOPQQt==;9_W`F$&$)Mv`+&WjbL=1cDRTw)<8FlvvG#1c5$9p}J?VWjzkauR
z73NupcP|ketHE4jdkJ+Jc!}m$cY>H?&DGvAs_g?#ybg^|pxZUNKjhy^vVPSXI8{k>
z+r@#+R=Nzk!u=uJjpyUz>hk}_wd8QS_m~~&1CFcLF>A>I-W%|Dy+4lk1_D@5ovsfL
zm~j$o&+e^xJd>2U%ioWq+qHG7FRYu6SUcmsyMk)ncno)ecYn6w822{|>N|dc2OzgE
zu=c&(J<i(x-syIi8>4aWz_@Xdqp)MudJgQWuzqf?G2IFF1BdH-A<sVGkUq|RA~A{i
zD?5HMAAG+z&hBz$^akQNA+cxH_JRa+WWSaR<(h1c958U)^TT-i@8a;?T08xf$Et6e
zTT};o&)6~Bj^~x@0%cAayYe;X&hD+1$ISbI?<_hWKFB=i3GWA1be%X5y&o9wmrE?#
zy#ucAzF^_o)`9!m`_vk_jedC<{3-CZ{hRnJvv;;~PBZTOnvOkpLcUhOI$jmD9(C{j
zbo8@kaNmx4G3#i}2Jf-0?E{XYt$e*13C8X4HQw}&^Z|!=)2Ah%<NkjJ9K&S#@xZm-
zytp`|(?PkSJ<PYE>?iK{i?5KZ{Ug1Qn~TFeP5hqV#8!1T={W8t9jo+1kJ4ag0x|cK
ze&g#{N<BQ`w~lwnd8<94EdAJ-BRF^9&oKV!&U^Z}$3f>k{85jO`$qQvwPOu_74g%3
zyq5xe6(h)w-rG5GVrDn;@83WB_AS1V7qS2ELyy8AotQNdZLp3Hw05Gr9Qv4Eba7Gt
z;w423?DYP(+x`3ZD_$t+fkjJ;ZbjZh$h#1K114P}@WA3riyD!?$L`nvHvIK3UL^3q
zNz0_1`2)u;E~>+C7x4V}>jWS6^`&=`7t+tRM)p@c%(~tG>C(MvU8Q?Fec6ITo`^Tx
z%I;5G^XxSpe4F=q$3h0({^7W5G7qwz+jXq6qU*SO-(+ia-nw_jj#c`A*YnO8=b398
zEWI|n`(e|k32}_z$E79MS6AGobkp@;)VM_NQ|(OaxfeLB>#)B`b+S)5V}BJdBYPar
zEY)3{W0m?2sJ@G{8*^gwY1X=IjKOe@0erah1=DYzaf7{`_a`ZX&~R&6Blh>{3yN-^
zG1j;J4UEaSVWoQ;@x17H*drZ59o&JM!RH2^8(}Sb1G>7yXYGX@#6R3^(*Dp<)H7{)
z+Lz0UIMxr`q2$K$^!v+-a8G-6VR7fEPP8F;>7{$gX9#?y4^#8E%4qXOUo`d>0Pa|{
z$##!?QMJpu{l8mYL_Hrkdr8p_yZ>tHdcQdfi+*Yk?0@?Ww~xvwUMf2O2J-(Ic?0)W
z6j8UI1@1#AA29QhqF0gr3DUO$XAtH9b^8z0^{3|w?ts~gid=l+40vo_(FxRf6Lnqy
zyaQ>{8u0Y_5xhv=V;4klBY98HPk^_e2i~(TkB?ng)c@1gUbjB;36p>R_Mf@9Xu#NI
zGFRERN5Ioi{F-BAjt^xx?n^38^16-}iN5%Tu5O!l*QgQDnXE1~9-Do`SKolSnCH)4
zUB)^2X5yII0klVYmm{v>jv?DL>87FG0CbV`x84~YL+W)HdnLv^h6-(rJI{av3TG$I
zfaCXD?mlbi#c4&P6Ti=znINvW>+`C;lg-Ho44jVF68F``8J&Pexz<fn_C4kY<``vA
z@v(5n{_3NT<nDEh@8Hw_N6N|i<~MM5{w{IfT%6Yx4cza3rt2@b$Ibtj_+)L5`?9xe
zU7Re8cLT<ZJ{H@Qw2nztF&}xG;b)zU-hp1wb8-G6d*H<Xr!Z-Rwaux^o{LaY>~meU
zH>!SBIdhAMyD!P}48EIsckb^8o*AP}wqG>yp!;HPtt9);t!R_HxxR1w|Do)TUr5$C
z%rp44^grbJ#vv-M$ok;rcop7TfafeHB#H~>>-k9BWW0>)0}l6c@nhriYT<4Pd9*C0
z4^@u-?Wcb;^zRV;o2`FG>EB%ao3DRQ)4vn+?_~WuP5;i)zh~*+bM<ez{yks)ZvI@T
zYxC!V_;c_Vz+W2v{P^?X&&HqCHByaN%>3LE^qwDE`+yTKH~0VD-U%NEabw;K*mK@^
zYh5SSaQwgB+-pc2?L0gO)hWJ}$~y}GC@;+_-ierWH*h;&X*iZ=TYt8!9itkc4?gsT
zW$`-Y(jy&~FB7`<9vi<^Shw>)y8-QyE@MV~{wf5zgk72)!du>iJ6|b0mWa+y=pu0U
zP#^QI7%R_ck(PQ_MbGC;cH*uzV|VQLd_3nkAMq!~(B)2?&sxUkG5E~PyE=x>euoj8
z`pqj<$KJ<tP4xN6AM-85gP%kGb69(JA;u106uPL+Tls4Zv>t0tFwQl@yvMoLz^Uq&
zINs{wz{wv<o=Niv_{VRIUe)NmDa&_i`@nhQ)^Y9GYsedmHHYg?E$X<og7r%EJ+9u?
zD-fQPtP=7xJSqd1C+dkS--JA&4tN$Bn|<j^J+HH&iV?j#8#3|8Gw%h)KSPt~PIfBw
zFN`x&>fa&64HD^JX@Bdn>IC|?KPM{tWH$PMfkWSl@^;6>)e#p*J<At8Q*_7EOIMDJ
zj@7X$eXh{kdg>01(y_kigFpA<>5*B_OOO0`7RWqj4kuZcO}ylK^bFz%w!Fi@U7vX;
zg1#_xU!DCSuHeRwxJGw_9u9){Ho#YM?@NZ#JN8<Cy6%^h74tFn$N3wAkJSmgNE<pc
zfxh@c-umJ<aH^6$|EY0u641y`_ogwf4>(oqANooE!CaTBAQ#hLrLMXDgKO{1b#o_l
zGX4x`82k;cA*_2I?#k!OTB-Cublr7#K6`cHvGt(u+E+McLw8(=J8vc)&poh)ga+@p
zGIV{<I&v<;H3sEe8=v*%Nt+h$>HZ>oJJze&4H>0-d3F;DSW9qDxtHgs?%8Slxv_<Q
zfag8WVQk2E2iD(fz~ge9@0#l{_F1wHAJprz$p_b8(q|ukg+8*4cC^vg`kml^nC2h6
z4|aJs<MlhSu7?J|M+jK!y1%_+6xZ`G;->uVFw2IkvP8C)aWf0H5zmqC*)P6g+MXNn
z`!2=~F|j?H;RAGvf1%FH`=NiE;e#AC@)Gs`DEgcZ8KgHh9&3a?rC(QiXJ~Nx?V+)y
zvuA-v_(ZdxMO;O-qn@YYc_sN_ej}a}eHO75vpf-<PJ_-1=yM`E-Tv%^YY%*)349ky
z$Ub&vQK)n;<0=oKUq#T}qyEr@5bQv>QN7<w<4!0vaDSq43zrm1zu@n!>kcYeTWF8t
zz~@A)sXMM@TKLCVhYQE+-+S<}+&N=mUc&YyTvPn|{SgiH!SRkr_uf}H2|nL};Xbp*
z=NaGie|Z#tcj7$aCA??lvNUVfSd57~w-esM!#f&|^y0a<3gEf4*oUM%8F=m4)?SIF
z;kRm++8<Y8-mt!UPA>M&!-t!m==uPA>A$Y>A)aZ(kg>Pkr{^y070yGIZ!WUbG0O(D
z%lI+YfeFm7&yL2%Vtl*Jl*h0=zt=uv1Mv9Hn{LRA^X&$_`(}rO`w#dfuk)$X;Gb<0
zmS5eM(P9%~{mosU^S0#=7&zS-iFLunp%48I-gC2=GSquI*v@rl3{-cBd0xi&IiGLj
zncDmKy9zvyfXu?E>+(##aVJCcj<QmI<H==JfxW%!b1p<%VL#^5a3u?+S0iyxPu+7O
zZ;v59Pda#q&*};A&#IBfab})%;>4rJF+LnWfsxm(^|}!4{?!<}g5jlmPoG}8m*ch-
z=PTX*QF{*gM}XGw$hZ{(N5&27ii{ifFYP{SW+CdquC7CneOcjjYwvR?C*NmlzPtS+
z(N^AsUm!NcaefYSz3@y`XSJlQy|@=AbzDBf$5kvS5ufC-_BxlxY~hjh_{^jkoB!*o
za_BbC)qbSkJ@gcG+=kz*-=%@^de@%@+w8}ghi}3$y~YX;N#_67K}y#exOa!Wpg%<X
zWOMTX@ZH$T4%!LG=vS~4Kd`M?v=NjG>kq<MHw=MH?CgsgYJ5fOQQnX*GFsA*Z|x0g
zy-GAUxbD0Afn$}t&!nEISLZ`<^LlIS8T2vqo$ozRXVIL`(RuFb3UycQQ%|nDeD4L;
z2k0C8z0V*9ZV&5!A_MEs5NmHI=5|P8J=XRv%gXH6cx_2hdcWH*%jg&qw)1`sKVVzG
zVI99H#605NsS9!5yLkfqNzB1F9<sWsv>jl3-8{>J-r!f_f29FyhFebB`}Ekw^X={@
zOxv^-`(Br4wxOQq9FF^hY7UXVW&X%m4CYwye6In0%7$-(xZ%*pEo;_|*pHWKyN|v^
zYyj8b86O4DWFB$Un5*{P`-+h5grOe>&oujB%Dy*t!#|4si0)OB>Ek%yy@oZMa-z)5
z^JrWAMXvAB^Q{jzm3KjpBJZq;UuU&H3;p1|z{I-KEB<9~ruc7IT3&RkV=W2U!!F{P
z4`p2o-ezE&cVPVQ#~iu_>uiIXAM5&K9pShvqb_l5ke?2FbUSq98jQ_RfBJ+*lo!IL
z@8}2ngZi$l`HU6Ea45zShID8H#*j9Ode?#aE?$+^F+Pv#>IUi2SLQE$Rkr2gTad3g
zhP_!Q$BpF}MxWD9Himr1fNN9K+>c$;m5z~5Wm{;YUV&{q*;>yr;yR)3cSgrCjJ5t6
z=q>xxiTOc4)?M!t&8KnW*@xkKUdR0Tz1Fk8LNBixR1Wtd=S|2_p2Kn1P<Q?0+L;BL
z$8+aRIGZD`g>h}e_%&>;ENM7#Vnzq(lMnvw)N`CXagB3%;@tKZkO!_gYW*TFtW)*C
z=eqdb6F!GW+b!+<O|3IqQHSrU;CjdWS3TE~*n6@T{QMB)$2||nI<EllwnblQ^DKRi
zB<Dvuo*IT<5bChD-=A-7=Qz>6hQhus((cGiau=h}+s~=(1CDF=7D48WFFcQ5zI!f&
zIAssMwVxawY(2UgK1LDdi97x{_d32CG4HWDmIvSbcn4wv>1ozp`0RVFecDdrUdm$7
zKp$h`h2=B6`&D7!l<N1qx%6GSE)Jh3_)-Eo`KNo+8P^9K-uZ~{%dTnOG#)T<1}5=E
zHBJ@#0l9qz@_g07I*L7-U9IE^+dH8n!F#02XL|Ec(FdFk&_qA)V%%*v=G(1+VN3V!
zc62&j@s)@3@)-%_UOuT8{PYbcMt}BC_iq0{A8<IXwCB_#*ix*AvGz574P>lZt%FfN
zunuyH*Utm9qkOuy{bYCzkT3o04){*H`&%>V?}zpMZ0<*X0)L;jo%;~3L);7O@C{pS
z#q9%1u@B(BK>2XW7NURb8*HTV*ZvH97q83t2ESGke|VgMgJ*>vrJlt1+r`-l8#5Jr
zN<Vb$Rr&!tpRgauH}^Bi`;m=)sJqte2m3`n-obBYMmf%ohQ5jQV%e~8$1fgx>4Uek
z3rf4JYU}5Fd}-TXaIE9A5SJWQWQpy4)i?CbqmaoVyidp7`?>8gUKy_o?9&IJ>E2_G
z>@6yyem3v=@a`33sAX~o%fcGrn_vx4@13l{*wjK_UdvMR8f(L>qgkc1yRh!&+3Bmt
z;+;tyC}*Ge*KMqQreASWlKuAqJbz;P6`!PjBVvHJ<(KpR%0=7@-U{DrcV_e*?ht(D
z8I27k7vg#secw{}_MOv|KgPWteX(1oS$iA7D`QvZLBH)G$RBLYq#n;l-i--t$d(n+
zxsyy6x0*OfV#371-o3{fw5u1-$~@2q9ImJ7Sm%x!?}Mz);+`dXb`$^XEBw%HU~F3(
z;t70@Z<QWr>Vi3^7#q9McjtZOSZ|LQ&nfi<AMt|Lwjp=jM|}z>o7?KSC7DaT#p6B2
z{g@At^NMuqF|PR?T7Nm_=;P4NS#dfsOX<XU(5XW>=cMk;x2>5ofzP^~@W;u+4M=ky
z(g%0<Pj1^R@9yK=@Yj5@xnb7tz&x(j{iN+6ujJ|bxUY5t<_+)Ry0*l9MlG4_YisG_
z8)r>_N_;oQ#H)kcDL4J@DBP2YeU=0<O0hxJ_#F!0ld<@t@XbT;PiZ5=xHq0|S020C
z;rmPby;+91G5C*JYis6u&%;^+r!>htBu=7v=<CJ13;YI7X%gLy;&cotmigW>WD0(J
z__g|O2=%5Behp&Nd-}n@qK>6wU1)?XhLu^f`*qn}*i#;-?}N*+$J2jqcije`EYY2m
zE%Ur(w6za7RdS}3_&wU)*q>oP`)K-r@?+=Omh7)4U<}VlV_(wu@UD5K-T%$87|VXR
z&(t4l;6qpgx&E!O)3&oO3((L0#cKUyzuk8t#*h8}1>XJY%li+wcDl6O^)u14cU(WK
z;A3%bHCFpt?)u63wgq!-D}LSevoxgE&v<)EyXp36E9@uI+sEQ>*P>{@s<b|x%;rAu
zG4Y3@zpw>8)}ESPJa1oX;FRi^vW>Y3KQ8jVZx@H}7Wo?J&<5cd5WMSiDE76=@1u>P
zujIm2+D1VZ5!=~-JkzhJPv%$Px&1_b#mA}N3H#W1S$R>R9qQkO*pD0c87IDB-h}0N
z_Uc*0ek}OH?ijk`SF<cSepV8DP}>I_#)7gTKg#h!{5HUUfgie;dtTabo*^>U#`UKW
z>rw;!8Oo17EZ-s24L^r<svyVpC<p!$7l(Po<sWShe|syhamzoMyyNSKlgO$9blmt7
z`Rff{ysvWzGH~P43EoeHwW;S_sjQ*ujAS#$xk1NHLWl)-NxZmC;>Gk4884<D7h){v
z7wpjTmopmZ3)jH+@yD3?<%rD@m(MY<FR${P1n~{5$2ccZaZsL<&_{LGXpSq#xYKPH
zW4iCd6U&H$dBL(JEGzx+#Ec@);CmDqJ6sN0jN_BG!W}-L0X|Fz#+-hw>BI2(A?3%Y
z7#;i7iFvl!7g~+jNsPa5>GQTuv}4BMZ%#5VA6Ub-vk`++{sYg0-17nRoxAb-SXcfH
zn16g8nRo5qMH|0F?2}_sjWJ;#C!mj%X@e{OSxWz9F9+V)7oI^9$2_0<1NLA_?#dR4
z+~Ehhau=EFw&)*<oB{tA{2IcDIfyKGV9Ys|H$WbokFG44N7~%G55pWzl{}BMCz5B+
zn1K1*ZYjo$>lN=Fa@^8!w}3GM?&t1@j*{1XdN1F@j^Co}**x?EcrpIh{+qpR-GM&f
za1G{jIt@D3un%J%O2aeg&@IZJ@rO>#mnw`UdFB}R2kee9^UX1a@MHGu9An-aNiP)J
zeo-jXV*F@tCG?B7p70^eEeo+zw*N<rHE9!vI@pMNCe`4n3NXt#XSfIFJ(TF(lP9|V
z)@*krI>Y8V#y&oWJB^HOZ|QgJ%$;b9WAmP#AH1hed+x?U9ss|XXA>Imj1bq?j{V`=
z`8*N#TjXJPc88pUhUhP&oaa^fc-B7~&k(Ur$NpJ@Pu%+<pV7!K#2p68@*&J2#=dbU
zX`9$7?DIAu_RaZ1T-qt(z6v{VA@szxQDMmO82F@|8hoQKx_AFMw~x}#I4S-a?;a(4
zHUFT}y(6vB;AJFunJv7yaqZA>#XIKGvYJf|$421Us0QB%;FUyp9&L^2|2vF>g*g<W
zZh)SW!#Oc>ut38+E8=<U-<o;;=$^O6?msAV#w;n9QoZ)DUFtt&I~ITAGPw5mBDQNY
z?lC<8eIpL)iLZm-?Yn??1nsdc{<&*Ze0vY*_FTMuI_`8bJl-YcxE_UmaBOFe3EjTi
zS30{B&s4?pQG@ec@?q}PlJ%`t&Vr+TBTv1>r4GmIJ=fPqKC+6~4xjt~3(k(ncSDAa
zXG{@4n1%axIA5sR68rwa&HJs5n{TscH=Ks&X%YWoeT?%q&MmID^m7`1=I=uMX?CJ_
zg1E6xm-qVe%E#m7S%JHA97nd@fbwBzU!F(K4c%^yRr84XJa^iSy!7YGX20Q+XV#LA
z<&n5H+1Ihy-!MMTHu9cFpU@`L{yBK=uuRbzgYnFMPQ82c8k_;{)9YzG&kyvA^33~F
zC+puhxd){BR|T4GKZTDM6d&}v3A_D`j~$xN_j=8X3Y@L?W?t+EUT@|F&+6UrA@8L+
zb{j7f6R$XKUd+I}z}hx@H)PsTu4GLe+JWZ{cHp^#9eDm=2cARNf#(r+;JJhycs^kV
zo>K^;o%ngQWoYl`5&sViQx?L15_=MltL71Hl>6*Wtc~&-hg!L>9i79pPqhi`(_!HC
zW*m;__SgsMN0PhG#G4Jd(I!#v`yJZ&OV05LjaQdkh%+GCs7Eo^xsI`&Lzq{E;$uPw
z_uHt-wNv?n+@}b=WVTT52&g`~ceXf(dW_k~-t}=S@Jw9`C)szHc-(ub{X_g(pXd(H
z$=8%4V_bbve&@4E#;gYSw0kpVwZJp`Q<Y@Qh*tu+y$AoBYyQE*8-K~WVn?rTC@I94
z9m~zWJ!>4tOr2L8#d&r5qzg)D6Y~z`mAnDJTXZ6cZu`Tr{W^;FXuH#42T`%dc=>Qg
zyf^(*cf^%#BmJr*<7MJ;Uh$qae@Eh1_^_?nc|TUV=Z<;2eeug(21Sc&&>QH34Vyj=
z_B)^U8@65RF8mv%+sX%2&p(*=o!tM!1Nih6@c&DwckQ|{Cgh#^{Jlxw^eNUo)(tmV
z1v691`B}CNGpas|jdYEXZa3058|kkb>4%N<0VDkzBmD;>{h^T_?2Ga+-bkNgq!%0M
zdLw<Ek-o!7?=;en80jAx>0cY^H;wd%MtTTdq~OY@z(~(F(ia=)N+aEBq;E3P_ZsPk
zjP%n+`d^LoAtQ~m(+EF-v}k&Skv_vnpKGKS8|fM&-EO46V5A>3(vKVI7mf6rM*4)2
z&J09(JIzR+X{0}Gq&FGqtw#E*M*1Nmz1K(|Fw*~Oq>mWsca3z=iSjnmNS|S(=NRe5
zM!M2Sw;Ji2jr4s+dXJGlV5DC((npN+pN;ehBRwb><+;E}pJ}8Q8tHl?eS?v{+eklX
zr2oN4|Hw$cYNX#V(r+8-4~%pm6y<Y}kse{B#~NvDv?BUE-AJEhq|Y<b7Z~ZqM*2!4
zU2CLUjPz%X^j0H%hmpR^NPpExKV+mIHPSyd(!Vp(|7D~<Fw*Ji(f*D%(o>A|awFYf
zq;E9RcN*yjjr1c%`k;~ioss^lk-oiOl%KB~>F*fn=Zy5PjP&b9`k0X(*gx9lC?kEk
zk)Gb)wW^j?VdO6{(v?Pft&zUYNMCEv?J&|S3|q7b>AKd&YwBCurnIc7ZeQ8lx^~Li
zwzX3lTdMh2S>4h&xz;*`a!M|zl;PAQIb|76nZr}d#HqFMltXaJQ99)vp7NScZ52-K
zk526yPi>Y@MF>tsPELi3{@)3swXXFF`U%E@#buQh7cZE1$+F7%moBI%u3Wry(Ok>O
zz5L>`OM2!KcUlkJ<(HQC%p~gcM5sM8i8><@YR^of&P;^bBd=^`CHqiWws7&><vmNM
zRnA*jK5y>ad2<t$Et|J&{=B7$$`&uaw35xn%d3n9mnSQzSlE-yq6BO$oWGz)%S&b@
zB#7)p<dB_+*ur@WD;8f-Id@@M<)v3#QqhBmQC^l10qxG6SFvc};vQ8aB|UXuc||33
zqeqQp^DbSMFtew^5w&N#%<ZX0%uTE@#g!F{F1fU)ddKG~^^VUK^^VV^ZcXdatWx@T
zTr@Df2PzxrnX9Hkf(B+JY@lbZnji@p=uw{|Gk5XDJ@U(psS)1}$|6&vN7+o#Qz~VT
zB6rp#EJ##?lLHg9M@!5n2R#ZnbK+ZvW^$?~$WBC(dc3?RwlOngV#K#*l&hH&j}Vz3
zi5O9Hs;456^=0!aFJEx}g37WBE?C;5uFRo$Qq1hB>&)#*fw?{PkGWc@?CFdXT-(~%
zUSBzD##!M@mS22vxVo;cwZ5%wY(L8^o<8lQ#l^EuT3nK#w4m**g1Ru)qwxI8!;Nj>
zrsno=+xnK4=GON5x_%Zpt8H#-s;_MaBL%9wac#?*`nB~<zz8GABek*74;SbPb&YLq
z9jU*jzPh!tzNxOIxv{CevaWtj^+stJ9jtGU6i61TR@bblkIk%IxvH|hMe!oZ%BJde
z6Ktq!jRPy|H^gA9ZLX^~QL0z1im6gpAD`3OyuLlAN<;IS8nX#-WrAz#+pFuU+p8<r
zR=2G-3s|qRW@BaTnnsAsEU9g8T_Z3CyVC6g#1l!^Hm_aV*d76uyj;Xpke!=uSszW;
zHn(hy6zG;KTUwiID{I>~2suq6Hj|jG?Uk+T*Qj0-$%Hj8t*Qr#6%CLRptjej-jEps
zT(`cybt5wxo9gNn18eJ6N=}3riLYD}M?EG(s>I}IhL9(nQXCPgUbCjTwi=TOS^{mm
zrm<G_h+tzA<XOA6PO3=xS}3>)quVar2A!>3+op!OwSHA&TYG(LWy|_CYa+RI^@;N%
zxzPBPnm=8iIT7_V>PIj+DX5K=5v66$y4t4NwUwAem2HiRBj&a>Hm$;RVRj36TU*n(
zR;aaasH{^nMpBh)*Q>Ev*;-#;*|u6KG8$Nq<~FufwluaV8MR}o)-_+-6q`#FL6)`&
zxp<L`^(|2T`pQ*pjnKU{ZIZ8zK;^Y{jZq3w;}Dx)-y{=19=B&E273M4`q;{C>)Tp5
zSTVJ!mdt2tuWnZiF{f>9{n|>j(cX$l*<P;-YFeAC>uRgpRE2fxn=y}D>#J)UsI=0T
z^|jI#Td1pPsdn=)&Xuio8!O7)3>i?J)n4D;P+8O3ShuQP6wfj<qH>7IHVr2S*svO;
zoe->C-?FB$Ng16w=rfgE_#vR=8UeL|jlgXin`$c|lG+w!lUb!YQ6>ZshgL@+HmhoD
z8yeNzs&87=*re^IS~n_L7E!Qhw`22()YjhIA{tcNP>m%=X)NiYOigdIKx(wKRqDLT
z`n4_XikWq58+ErUu{_n*Luy=sXq{WCF(jPVA^;+4fp}o9s&A@qrGmFtuM)e7wOPqf
zFIa8hB+|(q3_~_B9Zl7$ORBHcFo`bjF~uC`$YMhsFlbiR)T2w7XVvYP`N9EPQ#MxA
zb!D^UYO%Q!!xWrbL}}MwgEa~IBa_!eYN&3jY{r~YmS|;b^;$Kkx@(+)8oe#Hb8hRL
zj&*A)*RO#ofr>RYX~x)q)*QD5li`T&>UKDEP3x5@(^)O85SKBlk<BSihU#n8EKttW
zy0z6Um5pksxx$E)Ti3Thywy#0YwDE;&|1H?`5I18j8K9?C?(|W%F(P?Q%ys%s<LkV
zTE!m+uD%5hKue1|I9PW#aOq!Nc}=r+C!$&Fn<AOfxgArT*{x!(n%7g2SGG2<bzLEr
zwYOF`wb56rY~QFYIJ4W<u3cYQ*Sxm6u_;DL!B|`6wbe~@>Dn*~5ub;ZIP<YuN`=;X
zh`mi2S+hH}Fp3Z~t*V*bW8xN1o@y0OF1DuOcbfdpoHA|lETm^$Y)wbzbYxDSJd=M&
zEoi!?dQD?pn5RXJ&5Gyf3JMn#Wa}VCwQMy)os=DPXF24nXJdV&$eq`bvc%OYo0=<Y
z;4dh>afcb!MhQHoRIfa4p-8Gn4Qjh8;n>x$Ti@7PU&qCHCGEz_M(tiv;*Bk}m1~+;
z)vQ+@LTnaFu7%4D&-|?L`li<US}18NSHm#W6izoLXt=qyc6}?FpBS!gYpZXiNl-3(
z>xRmf<~7RNpz21<A{qDCl^+wQsl7?emJ%OVb?6P2e-t&ZT)76TqESo+TeOPcd7b99
z6XD)ZYPfb1I8)n{v%<g$y8;TYtVVa$9wCb9ZfV%9$WFr@df7wBj_0f}_YS;CQCZh|
z4P{qTuNzc-#N5`x7jXkr<D)lBt!u;4z0J~v;cFo;Zf<B`8li2Ub+<Q|Us|nQzNNih
z)mMA72x_C&<LcH`ZF(SFE>2QZ0Nf-EUDLb<#=kzYv+6;~M2Ks{?M=9PjZB|#{RTL&
z@q8u4iffI7VOk<3vcjU6A&Ii*g`K$dI#|zDt<^0Jl`z*HZTAXy-iigw!q+yoHy9Fx
zky}#_Bj)xzUiNN&xURWgsf-9NZakA>CGMGvu8Di}Ejf1L)}yjei<w9Bp6Ft?;N2ya
zQEhco7}K#9TP@7*=B6;CwD?`KF-}Y;LyYT-+vzyDCso+k;psVtdXQ!iNAn03sNM*(
z99id@TUS@ET(2#6M2%0@L}Wt1_cA0^No}iaZ(Qq|M9dm(h`8v&Z)$~olsforU*FmU
z0V<2`hEG05g-AzSA!-wbe6{Oz;pl$T&7p(YV|9wKP=5JYQIj0)N~H68nT&75wfsH0
z)c1;5pxYY}F2Hhws8f5yJ#eKe9xQmI7ACNyP0e9!TU@QIymp;<|B)?zq@zjj+~wU3
z3BUxpO+eJ*1?%7eN}@}PRiGABL60{u%5;XWh0Z|_*2k`D5r&dt#Z4QHhdB+8yS}M*
zV^}O`V!PZY<V%-VRLr~d(tcLinl)jpzjfgnxXsr#*0ncKDJF)QPo<8{?`K_x5o=m?
zRyeviO^l+5IxV>5va*X8%ndJ{cj=<#ODpEN%4jO0><(7d$4k%k6<tk7lxJ<dJHGCc
zuh-#|;jFFRP+4<rc#ia>slL7r=0L+emgDtJtDE2zg=L!|9Z-6#$$1pJTtsC+@ww7b
z^DCx3Sk(mb#yXx@+%a|AAPqEaxPtCPX{x_g7nmaxWy<Im!c#he5K%`QV9r|_CuXj$
z{Vce#;u>&=71csLqFO=)ZQ)7hBApCd_J}>ITwC4P-X;;|3zn8$vMk)Z5=~6*F*?f@
zES$G!Io5fgL+_*l2&y__9wx^&-RBBujg7-nGu$0%yI{@wFfBb;a)qFMiym^I)iC#t
z5xJr<*p@la2jP?nZSY*v4ZY;Tijp2Zk7$+-+;bI<8>5q<h$+*NvxLlP>nElP8xGks
zLtoqC=VUw)uCyL}m?-1}P0*SqWJ8tp<l>}{+(b^_moBVy%}gaudm`t_W`4}!X?y|C
z?&dCExbTX^b$Jk&xa87hb1UanEKFRu^pd#?E=^o?IZw@|CMk<K6E|7qiCx*;vc<-U
zuUQ;(;%yc{CXwSUGoLa^S`c%dY1R^HB&;Tv1QM3Wk$%FGXrB@mN6sR(35r=h^fYR3
z=G;uUz{Frway^c<6LfEBP}-a2h)b#4WY=)hhDR1eF`jWNGnt}elrRWzQV*%`wRnK1
z_*3Sik-OVCe&Sr5=q^Bc1+jg1k>lEMx3MkNhzP=*Yr#j`QU)-#Eze4EOGg|{n8;XP
z-z5u6#KTLk@+6x;cdOacWXI8WMG;XlM5!v*U@xuX2C<!u!*)%hgxu);M_l#f`lbi6
zqCBpnk^Jb+A+ooP<2eCpl1)Z0Fln4sILzI`h)#3cV{{@pR;++9T;fM5$48M*@?@nE
zaKL3NC4W8Waz?>O6J)AZ2DLQDi44T(_ZS3YT1luHiFzyHP|ZQKqjZYb*J4cFJ&GLh
zx~_jzJ!NSZr!Vo^p1=pZM0P#2KIlTEeq8Trs%uw=850hxcxad^6Q>DUYa^YC@T~U&
zDn{ov9PL{oqtM&7;#m-PyuOaZC3@si(-KnlA*MXO1?6J4)W=P|#Je2LW^(NK*7bHF
z&ZxQE>X=Qe{w20)ZinK+U&_RU#fMhmD7S6X>2~uN>r`sxx`6Rx>PGb3avJ*>y-tJ>
z*XdY0r5TUSj4DHfqn`1D2-hb!;!%${E*^>4bshFz;hK%$p`W!LaqPC1Y8=_G#(|kW
z1B`gfy=^6~ukK)p8Hf{A!m?=3Jy!>VrIW5w9|Mme>loq0jB(?tCY(%RPN`rLoD{8Q
z1|==jr1Mr+j#VDlK!<t2w+cg3P&et^Xe1{pn}}BEFj^1$7+EfqTkjs=M26F)B&M;4
zk&6<F4==^?D_dUh!n2ir)>Vv5SWDFbR^6w$?*yb|v;cw1*5*}E*)~;h0nX2`t#h%&
z%7=SkMH-Wadp3n^x1lKMm}Zdes$H~K5%FnL8?Ur+MkIpn&U%k1Z)9S6SB&x$88OY%
zX&WY;%dKyZp^Y@!r=blqNQFfW1VxPI!iVr#b!~g&HI3~XRs2-qX|Y2MhcB{-Byzb~
zzQDBR2=uqQlGipa2~M2!<0wUp7Gr!p%x&+Gdv?&gK_T(OI00xWMTRGS9Uxse3W?6N
zjLv#vxT*q?Qof8zi{}wpR(i7TM$X-;J;!MoW8e|FVG2*g)+F49L;AXK^{VPdgli-1
z8{7g>qBt;S4AF~k=Z;`cHhRYFDH935<GibdXRi{oaoGe-oIl3cQC5IkCWjg9weDF0
zEO$Q`-*<+dV+pu#Cm|tBDY-t$boBO%@SyIcU`m|28F}hvq-eyco00Ct-KeLDS+DO<
z(hoRwGg2FpQ#T_c_o;a?<^S26k^gJ%vNg8B5y3qyF;wvXdVR62;o9i+G&G{`ZfVC+
zZhlFV(NT=KT*ho85Y*!i9B)bE3J)I)SX(2vm3Wmr(&GP;D{|}wFGu5sOXMnKk85+B
z*+kU$;Bc)GR~_T7pA+Z*uh-$E?;cm%C_nd-8udnPWTGy#w6V6wB_N$07sN=IYaUj*
z?L_z7qIjaOvcu^?INo`T;(yGW8j;{*`~``g-g4w}ZKBOapEn~~I6by)J$mSR!>4{v
zN#K+OPD$XD1Wrldlmt#m;FJVTN#K+OPD$XD1Wrldlmt>C0r#Q2RJ8T~WgBikCh<wu
zN!2Zr@aX5?<0rNs*RH8<`uprjY(Li5{(bhsQV*@Rt!<gsvZ|%Ac@myso`fjYq~b|<
zQ2OubBjb^%A9!ia-%~$M@%jlRP}Wq}+KeaX3ujHAHDg-wRNP2!!<7eKNSJ=+nP-+v
zt1H6YP+a4RJYZcsb@J57v%-Z9?d>gXXHA)cr#jfe<W<ehc$18}pE(&1+f8Y2ZeD{M
zV2w>v)~vZ^?IaxdT#dItg{Rim6j!gTtC>1$YTc|^#j~qtmrOsix@K0%tXZ`yXH?g%
zoHiY-6wfNMtW(ULk{sXX5I&`IG9hlgz_!w4!sGu3#z(#q8UXzNjwt@ZIr#Qh;494v
zFei}a%*Rh~A=AtV+4$ccEz9?1e>H!dmH0~U$E5!{TWW7*`pK{0Yu!soI-U5E|2!$v
zpO!rUfF<n@w<OIfX(K|C&IEgDBL_%2pXpJV1Bt&m8|j>Gp8$XOGJw%X6;J~*X}NDH
z;9)SBmUm16Ut>wW<(E3&B2W<WTNyc80)epf#%B*Affs#FKYu1ull|Zr|4+IA(+Ldp
z<G(t`XAXfu{!9Vb11HnJSb(lA00#S42(Sj+J6ZlJ0si$S0K@&A0xY=&zzF{~0iFl~
z80Ehw3XJye6yT~`QIhN5J(xs4xC20*|DY|<r@jCv-~Xb5RuU@kzpS9w$zGwqTR}f$
z*<}A)3c8X!P4OR7P&!G^@LN7<^95qg@`n^8t(5pP74$aC&hm#9^fy9t{Dlf~z6hw)
zKUG1Qgv$LT3i{EP0L}HUP|#2B1T@cIrJ!f00lL87pdgN{GvB{PL6<;PoeTXf3KCu}
z@^4Vk4E!&<&O(2uf~pB!;@_>H{#yYp@;|Jg_8S2$@jtGhZm5g1)W6R+gz}_@Im`UE
z9Xx1cEJucO&<EMFxCD~SBJxmvl?KlfedLG-OO?)&vtXIh+5X@;SUy5<GMTOjOZp|~
zS8#5jq(6YfgY%|J`YtF-@cfctY<mauFHE!Z&WVB-rP;X#cyXFN#sC+l*`p2ck~BN#
z9K~m5;3;X}0S|$v6`v{{vK$emDDW^8OTVguPYS;D<tc?v`3IlQlzd_bpHcn#7v?{^
z!pgV;34Z!rEN!IqE6r|1R=+Z9cv`<Qske!6IdC+_&=IV#ow=l)@ilz$lRj=_T6#{J
z)OiAV>0!l#q{sTKjOR6CC<~GVeV_Al<OF|>FKK#2@NTK>r=agqmB%oBuNs&$nZ7U6
z3Wkty2I6a!m?sXBpQC04^I38_OE|iIqvRZxl=ZCRzYKYna}~bDq=owhzbIThh@9Xy
z#l=%hZyzC+ha`hv8lh~`K^ELOS^-jW*XVv$4(-<H$MEHch65k}Wi#w-Fq&U#<uE^&
zI2MNU75s_}3WK)@^*jd+cPi><Fny~ws8q1q)PN3S`gS#-Z!-P)u;q*ga-NcgGnEx*
z;!B#&9Pk@y`Z8n;cv&_50@MEn2ChP4R13bOs{bCQ*b6IT6O#M{&ds=4C;QLO*zP7X
zh-3vq&exHn>5LIN9DxD3iq11A9FP}^>Of$a^E2edlax_A%C<B9!f$*6vok)@$^I8)
z(A4qMe~{1(h8(i$j6(LP0(|M7PoOxa;7d4~I#A8p4rB~0QXGAY=?O}x4>Ns+66%vo
zPgFvEiRnpU>CLN5PcF2=oZ|eX4a^xU3Hi3=+ox94V4Cv~u=2$=J;oFlhjGq6e2=O|
zCI3&5vYZ$3Eq2Ly1*v?NIIkg<=O@19yoGOtFWT)uQ&fjGWLzyw{R9~qt5t_2y+%zx
znx~9wROcwtjB7Jx(*7s$H-=R2NG@ZOvSI90#&spx^+dS7ba*)9dLb|h|1)OB=M;fL
z*tv|&Dm{nk4vZ<<u*hu2)+$MJj%VD|AZZSI#?6XTA#e+qQp>uHl{;Ikj9-HqKY>Tb
zrv<(zWt>BSM=Yy=`6C96SAF294=Pa9hJmF)r>T5NpPp$s?3fJoh>Q!R9oERWNY%K2
zomi-9e2VEyGZk`Z&>4a(%}j*At5GV=v}Al;N<@%5R5Q|rovNAdv6%<-G=$yAc(7FP
zX?ruiJzvs;@gI(7bgfVgPR+beGJlDRnO{{69)XjU`L#lYP?$ME5T-Ko422-+iHafx
zlQ~IIl=S4Gf=>&dIYo`A<WC(PZKpVFIWy6qShlI5%v>oFv^+&Z(qW}Fca!wkP{hh*
z=7&P3ZD8iO%+T;~<~XVSATtUq(Wi%*K8>T8Ltd3Rv#lITU+iC+8pzDRVbzOY04s1r
zk^T+Sufg`P73a73%JZ|_a*pC#hM^<#%R-aZCi5$*S~@zDd3VSlG6?e@nNp)L<4aPb
zl7n)ms_{9d?@|oBb_3F1QDXdv>3fvuGN_aHLR@t~R?7-i#lI1tGK3CA<!p@<-^mi<
zSk6623iZyxgM>OQ=ip35oz`sdU`1WhLlkvMXDRBE9vYUqbMQTQSYb4sJyp_l`34U!
zku>Mg;1Q*gz8k$5JhDO3WO4AQ7D>Ot{G1Jv<_sM?y2HwtFCgSTHRDp9?0>no;2HHg
zCp1#qRwdCP(<GnvWylQGCo0{LnM!M@@<V2+{(TpiLrPSi{`~@^&xS<5k4*8&I|gPg
za>OIP0^U*9<&N^n$z0Y7NBQKWl68fnd~(jXtSg<NQb&NRoDl+ih7Eki2@AkpXH`0d
zQM6iTq5#yxtU70^0Awz!-YJRJS>=>QfktO;6j<%dH-U>yKy49(oi)xfDcL}F);emx
za0`JZr%IghjUxdxJKD(|IttJ_=SAhn(pAp71}?W?a(uI{h3g!JHaLq7Xrr@2LH-<I
ze%7f{5apk>$!Rb!uX8piXdp2+I~@udPUr@wQ$f;!&pT7ogr3Oo4rhjfK9dW~FE}Me
z*><N?LASB&OU_&c3H3Xj`3gG9vb&rW3VNH+H=HU1^M0p8K~wWk_JFf3?Q{&DMf08Y
zpc8sr6@Hq9-*#S%fnHXSh^fozR?z!b19OjaR6+jLfd0V=1)^R0Cuf8KJ?xB*fx-s#
zU1z+4L}|X~6e>u>^q4a>AiE8L9(Um2&oDCfA|uz#cmf$?%#3GPrNpT6EUTCqKVg*;
zgM*(rr3#wPUcKndSJ2&S0R6(*U_ifgt~2WW#_3Ry==*;-od)!(vrR!VY)71X4Cpmy
zw}JV(^SDv=M`xb_{mFSzLEj-SZ#msY*`J+4N2D(l-gZh9^yZnse8-uuAR5)Icb&xs
z^q#XqL9ejQV@_2J)DQ!;#6TMi=(y9Npx4>TU!6_`$*6tcY*Wx5SoSygjl!plwiA3f
z26|jUqHDq6J_8B`4;q;Lf-lBEFDoc#Ehr2Kb}Q&&LIZ=x6l7Ha$_y3;g}Ok4gHsJC
zD_EkS6|6TbSgN2pLZgC<71TtiAh<$78wi~qtWwYxLPfy_1$~~-8Nn6>J=zLrVsL|k
z-fsakIoJ^cbsEr=;5G&QnwV3A_b5nYHZAzDg1C5PO%Fb<Ag<t9GlTmSbWa<gGlK^e
zw2RO=!50-I=I^{<w*i#~UsDhln5>H6Q3V~s{weGH;2#zAQ?@cc_?Cj`++|%HJf<Le
za#;(5R!F4#1~C@}Lkg00rZt$UpuezeeQ<<=J|wg;7*<fQ9nkf`LIu?=0JJ$cRY8MU
zc0;g4K_ZE*!BPd~u<XX*d<C6Y2k55YVg-pV-4fhpK%K#R6eK!-YjCH6uDu5JJ|Enz
zpg*$jcLX0+keKN&1Rph^F9si1(4DMzXK<f_Wd40Qcu+xEn^AU8@MQ&!A#`7`+ra!<
z@Th`LXW7?-#}rgdXlKw$7kSd{$htq6sUV@SD_D{)CY(-O)+@o#d{vl#CBRpMD-?7A
zn>iG$Qjm1wzk)3W^xwgD1&Ki43T{x42<@-I4g>li*lA!64sA1_tk69Q5(>qkoeC0T
zFfFv(fTo8YR!}=Rn;F`dZWYqW6ptq~R0TfTu#gWehkr+J!?_+`!7W_dxnhY!Q|Qb3
zQ9vAktGJZ^IA9gAOjfglfsk@yL`*LP4DaNh1Ih=H-u+8J`5*%PG@#rL0e%)xo`wMb
z8c@!K06z~@3Dw(3^;dxg864^J%K;rO974b2-vUQffN(gWe-G&3p+LV2=-}a4mK_dQ
zK5GJ*&&-;mx+EiUZom>sYOV&bfu}9yCzLHB*kET}uJDDk6&hcFD<A@*3UFmWi9>*^
z0wba&p9+Mdz^ApK1g$bKHCj@or4}T=)uz;HO{vwHQmZ$mwo*$?nr;X*M4N65v_yfc
z0~?~i>Oe;nSQF@s0!@K!QJ^_+PZVeg?2H2I0=uI?YvAE1&=z<+3bY6IMS=B!gHhm`
zz>85}W8mc|@Yz6j6xb9v8U?NkycGqm4;&NykZyl2U_}GSSvLei2DBxRX+T>8BMj)q
zK-hq83KSa9&4H-~bW5PbfNl$v8qn>5`3Cg)z+wZsBe24Nz7VJ~pf3d)4Cu~4i;X=z
zY!N@95e^-0XEfD<8KT97S&I#=Tw-eF60Mb@(o3~gYC!EYMDs7zDyo67YIlCt?^U}p
ztN&BCD>z4WQv$r9Ym4Xc2d&_YjbyzU7%yWZz#jvr2@v4E;J>u$3-Fd!{eCQYTdTeR
z?*vLMhuaEg5X&N6Zpr$p(d8%2iTjk<<);DzgyyeU`)SQ|H-Tp~0~(krXd;<sH3J$r
zM@mGY_L&oLpE(it>50hjZ`N~qB1!}M1D}!xUMJB5fhsG9*%B`ZSPs)Ue@2mH^s_Sl
zhBQB+Oxc!(Y$wEx46~deZc0Xdch<2$)B+!exr#E1gPJH{JK-qc(>q7$k6&*V1xVAI
zMKL-3^=45@1~~Jj0U6(c&SC+?0*}>OLJh1iOH{XYNtKkm%nqFHG^mxQba=I>b<t?c
z8eXIJ+7~fht6~GInXXf@fqR**SFr(#YxqhP8<6y>*{Z?tu#g05xFiir4@FxX)^CKB
zaT%K6C%fnj{)Dm%ggU#MeHx_Og7Q(D@a4aYn9<PZ@QGtt!IE#=a@Y&!8^9@GZt3uw
zOQoT=kTd)iMf4mL4DVE7f)Usl4!?DP;7n#(2eg+leY@(abo=v#mh&zenJCTL!@sB6
zr9U|Q5!EjJqv4OLPz1Rg{+Ob{ks1Dd6>5?64^+HN(vPbU1>>{B_o{fAq@NfAQ=(3B
zhCh{N4;mc>pH8zg4DgvWd!VW)j6SQF76$gI@exALsqvBY{u$C?Ngq&SCFviYBl!rG
zTf=`;ijXWO3_tzC8SkTW{EV0(j!D{xDUl{dOvN;z$aS18V;t)96Bv_0S@YBXDyfz^
zY@k%5t2``2iER<EhYdpTjjHBc0Vtmx$!OHAj2xs~p^++}^*LmZ#DX7<?Ag{Nl1R&%
zph7x3fsus+hskMKXQ&)1V%9_*<Pl(!V~f%YFxl}%fhmqYpcMmA3{TAY6B{H6ncCs3
zC)9DSnAfK?HX~M9PwV4c0ru(RTmhc*k5JQ~aMW^<00lGZG9>|8@KKj5Ws&rX5tdVv
zr(L_L{+zoMv!n9S?JwKPlu(2@U$H~NIW0lX-FBt`|9l02du?T8$YjpfZDnKx_=a65
zXael8m2DMZr(Gf?Z#SaO{dTDU41?wDvXzk$-~n3&p&q^%B@f!l;t239J8EQdcH7FX
za08XI$F7sszH$M8hwKIc*w>uz*xLjU4j!?0MuA7|-BIBC_QO%&2lnGp;Bk9j6xeGY
zi~>*CFGhhU?U$p#Q+9V0c-lT{0&kgsa#)17r)}-92=t7t9Tp8~hebo$VG-zATRSWo
z(hiG;w8Nqy?XV2I8iIMw)(*=^LO-^5s!-iIgkG@q3H14deq!%aWuGDRGy9-|q|F!Y
zmlbp~%YI>ZD@X?ASN2f_z0R_i?6(wjQ#GL1>|+XgViBPKv@I2?qixCw_(BT$Z`SMY
zOIOf^3jt;OGI7$F2Th&88S`+?WTm^pOtIEo0j6o)6|J77byou;B5P+(i5&_@N2FA%
zDC2TDbG3@j9S2~ZR#9pDe0%YfZ*#URwpUCI<6BzT%baDlH94HK#Ew!}id!d93YXd=
z6jTBBbC#pOQYO0k8GC~OSCU|r-6=pFfm&0GSK9YTiHNR2t2FogIgMJS-{1^eXFqIZ
zEJAI5Mqir2Ni4~cP9<`cThWMAunAux&J|+@sICOZ<0yBa7N-CiTAW!d8KlKIjzFe1
z1<OHn%wTN_zDOWTn*u=_u1$deqqLlN5-m^5`G*7ww48rMpu%2kIRii>&(D#AXM?ml
zvruqh4D2rfh<hIR7Mor&=3VJC7oRcjDPy=Bg=5}Vt0>2E%rRvcDZeqt)hhZ3aXwHh
zr=<TDRgp11-KlwGFwLGC-6#fjI*+5K@(gnH36|)~6f65Bl;jkLhKF*Bg{Mt$J94He
zo@DH1!xi}}k>+HM&&-*V?Vz2Ub1hUjS1L$D=NT1BQQ-_CRj}2HDAEO1b_Mg7SmQ%E
zOR^U+eJO4^<fxs57}+{2dlmCnTI17lRz?>8oK<O=nN}2RNE>7uU}GBeRk6SYCI|6a
zAuCO;O;Z4+ozsls>=#Jkv*F>HIiD3YQSwbz_95nXSm<Vl<Wt5uHyG`1RbwJFZX6Ij
zfy=o)WM$`3a$jU^b$vkuqpvRr?fX=1Nq-dtvX`*NKTd^|{!!>jjek<~#8N$>(r05x
zbDjq0P6uifBVpZ>yH_iI+37g;dqPi%{CWUS>Jm1Q`;?vq6h-dS_Gp=*Ttsu9(NltJ
zQ|`0I>X`eSUfjq}?tZ<v32;C!ZpTRHhk8AelIQIfX<CT>NE-|aHuuMNhcXLn?V!EQ
za?S_K61xcdaxYgt2v4eWSNN3C;m$1g3ZE(&2n&#Vr7um|IFG<pzK{SEWbUVYYBRNt
zC6zvC2|fZ;`9=t^i6yl@HC6s=3V=Fap(=qibL)Lm1)#F$Huy>ekS?w9l}>pVtmd}+
z=1)z-w-mithn)4AQ(@s6pEj1fhn2g*r`!adBIa)NEtX36Vl~PAtZzjW*yL-70@wLA
z2q40{-lq(#Na1t7&r69A+U(mVz;zd(wGQ7s0tl<O_;w1w_+W0QZ+EohHs6a;;CA23
z0_>dwv^#v=0>~hJ!S|NLC<M6Mr<Z(z?(t>X(>^LhjeC7z7)$&}y&Y`iKA(!XG5DDK
zRUecr66(nPx=*k2qI=))=~Z5!9lmo^KtZ6LKE382S&U{L^ywhQOBD4teT!`jf@M+n
zbHC*a=_rNp_HEx=_O$zoP_Wx)`KE^OBfK&AncJlYY2<tWdo(bDn){FjcuJi64;VgS
z`XvtEKlwt+0TAeWz5xo7&OYMH)Xo8Q<@>%7xKcF&+Qm;^_V~0swZSPuRvv6s#tdB+
z$d3f=`cKWc(5;b!8Y5-mU&R`5)-zVRHO5726g$@-S1pSjNCj`g*K{Fj=YC7?i9f{t
zG56cr)xQ%SN$zfap8FjFUHUwCKY=}ZBmP?g59y8gp9y?NZ^Zjw0^lF@Mtn4ZhxJDM
zYy#iaM3)ozp5BOGP2dr|5x<eZqmI&dL3_-pl9BlaOTO<Y<$s#M51bY$`7MFHj+zM;
zC(M&hhm>4W1K=q~O^XHsPdjQROsoa)jH714Vgk=PY9=%j*ypI3a4Ui5oQD+$1ok_R
z3xNMZ5{As#C%_#9o_7ukAYC}<sM+&<mb~D+Y&pJ(Sm}r3%TL4WmlP)_;$O&=<$Yh6
z(@<?<!%fPBbCVoyR?EA864EVdF<|}hI<=%vW`1i}>ay{0o7%hH&iwUizj`;*8&(L;
zADG@)C288V@Mjw&O^XoT)FNqGweWQtB+VHU{#-{iy?I+S-LX^BuT2EbEe{XR3}b!6
zhn6CIQ*@;Z-;61)x|un)Kv2emjj^X$k}i@oHnr@d!xFXs4NuHI7eIIt{D$zP><gKm
z3^yP=S*mf*8J?n=P-(qp(>Dxb!4s?-SZg{OzZr=jgHk#ClI?d`5ekhPk^OCyjvEO=
z<3>v4<yFEtSfKYYF$Pq}jgj_fZLw#UG?(;odC0ILmoV~ko&P4Gckoq!0;?nZl~O_e
z)?_epx2h=Vd(>b)$^3hjul6d__o;y$$iewqSn7^p`s;<!^f%NX7cqZ_8sxK>-l=FU
zWBUI2f`1p&yB15ji|GfHB0R(NgH@9MOQyfsU^x$g0p*e!I=U~C`65#OSMX&yFX1~#
z?RBVu&TFwaf=CUQE9`zh+P9n#zJr221Sv&^h`8<xI8UYpnv0}mvRKY}M5fVI^F~sX
zJmMcLsl%7Q3161eh;L=`+K^I8G(IRjB-VHxNMqN=BdX@yi%g@p+^<>AKQc3ZnjT=L
zh(x|vjPMyU^Zc*jTho67$skEPf5F!v;8>*&t_z51kfmpKz!E?f{j+owm-?7{b|4zX
z&OJxRp~W4T69`M4Zmu-v1_}juhwJEhfvEyCRsbl~!QQ2F0h9$wrR0_i0F(#j3m}Vr
zg^uqEFjvQS1(>G~TG+$f^YuZC_<0xTgBD6XcYZ(_PFaH&1imIsiyw4RV5b0Yk?6vJ
zvZ85RM;8T@6%`pQ4k#-sE9{bhGMqfE&0QK$hO>#lrGb~FHE}zZ1-b<gk7l_(C)q%>
z%k(+Pn2P|c2&_<R?cj?6T^T4;7fi+wx+<V=y9lqJ4(Qu1(&A?V`nF3EF)IUgsvfOM
zZf&4JLE<Li%t=Aw1>gY5fYt|gDu^~V_nN?N1&P!)1s+z=3{tp0ps&m@5|rB!IA&mO
z4Or@8#&1}5b0DN3@g;5vWCo~u)*+VN5hyJ+z%K+!I}|8>)fWRHeTRgxhTLrdeQQLz
z@uh&iCnC(<9q3jS#g)7-P->}54>DX|#U)`Y<Da2?`~-$%(8rPFpoqJXKgxL>x#EY+
z&;4mo#tKSl<^C*a2_SU-H5d}$SvVrOzX@gv@E-*JEjU5|Ug^#K_h486-wXi14HgQJ
zLEv{mrSLKp{v%i-B_f$ugQWtz%6V}pI6n#;Hi07=I7+nF%#z=mz<-*+(cpZ``60Me
z27t8v?2a;R)F#V05-ApQln^I~9_0DC=Hj^&q)`PQf5DkLVsJGs+Z2@OJsCw`aJJr)
zZDYx~dQbK>0%dx$HKznXxvgdw1zu30!+iqGwfBi2cn`T?o~@?ZN31hnhx>}KQ!iMc
z!+o3!1sCdYAN8c*68orlxzmY;$dGcs1#gM119t)~vq!5kX??jH#*^kRvvnAc2DV_O
ztsQ)U8tr1E-WprG`%-VM8`KjDO}2LM1zKlctm^&vEVS8bFILc>2(7nQ*r!vr9Gim8
zc4>zy6mW~(sUT_QCVN{9be92j+V{jjUsKTgB(crjX+YcUmkrD>+uGq53SYK|DwA~1
z*{FAqJwk5{$l85&p#govo~R%hdjy*mbQ*N6V5eQGpgKa|wC5|Rk<hp7#R?h>r7q~Q
z8x)j7=pXDB1<_m;eAnKfAd$plc87w5&+prv2K0pec?A`)l_%|O3Ytym8T%ds^I136
zDy{6dA5>-65c7b&TS1!${m6dUsP|(xDtjBt4!TiUY2^hsDl3xswf&;1C(z4oRQ6uh
z`*$}E%hjmhcZkDUGuQ+_X$9l#v67N+mG(*6ub$%&C$L003RML~P<ZupS-}M5rqSjU
zoS|GQnL-nlOLd4-aFTMVctx&Y@(RoOJrY@L!Fda*p-hEOQ#&<sblND@Ca;&D2FEgE
zG!p!reum(VIQ?{?PZNB4p~7W{PcMR_QVv|fDk)F_H$JsdpaX7qaz0O24&?Wko~azj
zpEG@CSXw>Ibcu2x-)4IDRNQ|?LOsbrGvfaazo;jcLmT7#AVD#$ik~;fEa%rK&ht}5
zVhC}WpZH=JnQ1xiM-brI!+r!q_>x{^7LF3G=ynv2R()m5g=5gy$wXy|Q{v(m7R?oW
z;uOtO_@q&Een|440AkSvN&>~0o<;MO1ZFY4K+)piRndhx+1rSFQFwT$=pt1Yl(6bc
zdOq<Ns&pIEm#`ntlA#~Eyo8IU3NFXANRPmWY;%U<Wi;!}QoOuMoD!T*`H-nZBLW-(
z5RW6`JIFpdV<W}l+)8nf2k;qX#Kb40o||!OXCZ4X#g~#~kvbt0ZuAKm+bFsmlH5Sl
z>s{1v(N$5#Kdm|`)jp#(nEQcPRA~sbN_B#^qNp03AhPo>ZgZgtv!yu>_=K}nb1I!?
zId20iUm!AHQZP{k;$=Qf(komJ?crn`CrC%8o^hHqHx;>OoQ_QzkG^Go`gBhxskzh$
zgh_fXk;0@L#j>PvwCgkhK^&3Ni6x5cUy(C$wk9jUS+<G{22g9FyUJz~I7c4_;AuW<
z;vBu?3fj50@=BzE^K|4>fKq#+tg?buhF}*vEkL<lVnzI=i9<8EtK?_muxN5nG&#gM
z17t-W111lNh<9>!RJ@Z%tI=YdZ*s2cx}?MXu>V1A>H3I*V%7EgkW(;Ccbx-RFkSl;
zvLMU=ma_vm8GG<0oc&11kC^zZkeB}LQ{=f#nfRO{FX{aO!TA7HCmwJlEi(L}VoN0O
ze5RG*z*0-wnUQA+^M^ax$W`_-97#<;DmVpS&WuRjxkxFVrkpJ_RwHA|If^Gq&r$Rw
zeJ<#6|Ig2q*$$_h)4>LBiZu8|f_Fv0Zy+^O2!sOrq~@c@2|NcRZat(VGw{P`$@7Zz
zE5v#p(~Rh|gy7U~+BtMUMQ?GkcO2>9NBELKc`Nr7b;ACI^Wc2`yJLx-e1pJmb=YkW
zf&b89w<ig_s>5!t5a`xnH>q<-huy?WKCHuTe<0cs9d<iG;58j~6X10nb`#+DI_xIE
zf9kN?pi<O1s>5!R3B2Jn2&3}}{6UA^RuOnphuy9v@JAhX6L$Wj!)~1{`7a%IyO+RQ
zI_&n31pchUZc_5L4!a5P7aevJ;2j-yJIFfk>9E@$3B0evZkc5Oj_I)5+vNcM>Zsl0
z0BAt&2Tr$iL4XgPqn2|gM58wO${&9KaGs7g{8J<?ZocL0BQocQir&2l5b+OuEA@Rf
zrr2`+I|8$9-9{SNRc$DOLnE*R6vhL@r4D?nHm665r48e8riGCb*=fWVuVFDwwtg1z
zI>73=M4fSmWEh-%BhsKe8bx+2=aERJP%%n=$`X0vG}4AR4dNB}8L+UNKPSMEg^!+t
z#u<ho8x_WvmU;n_&IEj^xl%kv88A-4;#_UO=noa=X$vhtSQ}*l#%j~col9}P-c`{t
zEFPy1o#=cOkGESy8_0igf!!&<i=bS5nm(9jFN#ms2h(&#iVN+Xg7zusR&kNNTbYGW
z@!afgR-A_e$>MqJJ04C2e7-UfJa{U;K&7);6R{9MnnU2iG%I5)68uaXK0a;QFe#gc
ztZ4{5L=FO`Wkqjr70((g`0}kiTE)x!;sa9s=WP0iij1V6SJqL|KT=D&q<^fvMB*O|
zN9(>&7)}4P@^yYooS&3PzNG)9G<uV>xIE)OQO-|be)L)670&y}jjFt#=c0ZdSR=Rq
zWf;YK+p-(>kEL!nr{P<SZFqWrp+wy215{5q2-CAvPdF2&XRDr6qSACkY@IqJ)YNH0
zD%gfEQKb3B+6j0YImNCM;F}BJEWHvACvdjbDnUC(uloYb(JCguxq98Foh?33>)SXs
zfTdnEq=Z0)T?+pf6jlGJ+m;hV$tWgOuh|X6|B;#JR|thfn2s+!B{)pZ9A-w1&q9Ef
zLuGO<M>6;+d`U+a7eA<G%u(bNe^bvG;qzO%qrrJ7`L^z;0K0WZ1+7bWbTrZS=#GAe
zz(cyD0{nyS=(o;C$#?WDlh*#xo{#%qAa9Jia4ug>m~OcLfcA`Hx+L&_V>1PP7V<3T
zY<x@i!o|3;g&d28#rNp$v3l{n+L;sJKHXOVzGkaqUID(YJ1)RCY!z)4V275106Xo`
zmh-(>hG-o8KNg1m#bszi@dAUP3pGP@J&G^VJP2^HCM&=~O-X=Dw7dmaq~$HZVl8jp
z=qz5M<t@OaTHYdsWwr`)39wvWG?NA{)8QcjF1J^R<OEn@R|z1kU7^jQG;pQeg7`lM
z)fk>90b0&Je9Is_TztFgvq<Xmy3ems5$=Q|pYs+{+V>IslH%(P{Lh(#w%HuC8_Yr5
zVh-9?bI@)y2kj;;%6dxtW-UsdaTnjBMJYh1jXN#09{dDubv_S_;C6h8u@HMxI3q{w
z4Gq!^y&L6vGGmOgH@vnwBUf2VJ{>zFtZtC<LA@CTVP&+^W@bnuTyAEfZRcHJI)5d#
z6EW06W5)`j9DwBmCl`x?Nb9ZKpDSs};lMAnv^X}oztqy=xkK)+w6wT><-Vi^BvIX8
zYnhPy+}~(bp)>G*$a@p;sH&uI{4U)$orMrcAb~(=5Htu%kR@RcK_qB|pezZChD8L#
zBuH4?BW@rnC@wf|=(ykt3My^`ZX@ov&ESr&`-+S+D&shQRlhpj=XCd_=f!ru=lTBs
ze&D96PMxYcb?Pkl+;h(@+NlBp$XhBPAo^_;5WE^!^p4tj2m$Y@=)gMt2WoQ$*L=|~
zyBR@r1TVmUs76qve56KDi2m5V0&LaH_K6x!Co}S?8cw0-Gqul)YpLj4wR{Nyd(`qJ
z3irLe-SUp2+|tcYh(gClp}A3LVFYT)^<HQ9-fINnKb31SPxx7R6Ue_*!+VXg_x?q>
z>3v52Z8u^ev=u#O=>01#MOuYi87kTfza$<7Bc>{Qzkyml{zzhfQ^qhZQt!V=OmV?`
z@02kN6O6ZH1V+PpTSj2O@AQNmjM(qWXbkv08I8F<d%s^!;~yzP6oq@=Cq;$2`&ChI
zW;-^iqVjEc@69T3VBrI_kI%cEc+&2U$SLc6h{(a%aHx_4q?eKdq(sR9(pv=}#>&IY
zfwPZllt}4Ijk1tUQZ7R!?XZgulP6`U`#$PP8Bf{hCEXArX)HhF=@$%Jg;NMJ9lp9$
zCJpO|UaBSyyrNOsq8tw7=UAocJ$e>d+OiRJ)>WFbTpDqCf2jo~(nKrD(7%h^^>W7k
z2k2Qy|8C&|Vzu~rOaB8yQf+@D3;GwA8QbprckIkuYTG?v$5?=*((vLGN<(+AT<!b|
z-h@ah?;|UImsQbBN3AyjR_je{YoAhyB<{ibsQ36WV;Ugk;b`kKSj@YN<qR#eysHRk
z&s^?p1gS|FKb`XUp;Y#xbm3oFe)gXg7<{;EDELqoQ(04R3-P{7X}T*74LA(RKM-|5
zA4>k2fNq?je87QH5xl-RK&@}mTAMXM9p=Ik2lP_CX~6*LlG*S9s!Ik#kvak-Ja85i
zv8e-3keXuVfwQG{mXPFuC(^qT%Lw4#z+CS_0z0{vGQs0VV%}Q1$bmz+2V0L6Zc*O-
zoWh=!J3fXi@7X93_e9+M)y>_9oWk43O!gn5?2wL?JrR^Mh7Cb})<*LmA{gqx&wJZk
zc_LjNO-2ebGGuv^qbUZlA(5z7Xjk~8upZ0%<33Vc9*ZpRNuOjx<A=$TT?Dij92+Sk
z3ekp8I{$;N<TlHyE^>7TT|^r*(cH1WFQ~>oZ0Yk<*Mlv6X=<i`r{p2k4`I_>y6T63
zWT>tONT!-iJwlp`TGNCTjVxzSI>L!>WCmqOIB~oU%B1z3t;9;POh3D*$(4n}zjF4a
zu0<Q$7Rd_^{IY4$V%ON%w#22m0LsBz0*X#`bAYhlicWLGKt8G_<aD<f2%f&4<I4IW
zM|RONS8giUg+=GO<zS=LYOClx_i!K>8qarSA_zxZ;L7c7`SHYdp}Q1pRvjVB-L*h|
zm`=zFcO4L(6&9^@w*kTQ;1YMcMpnB!fN<j~y29P5kt^NLf$-knqO0AX==_&z8bH3G
z3#xQy(Rs4m#lua}`D(dq;xU9=pq9HD8M#m`cU{5Aa<$yGiIEj*xeLfeYPsv+@szSs
zEqC3_$i-^8>j_3KQOjLGE>+82?{La0wcPa`BdgVNS8xI$m#O70q+IUJL9q_xlr?I(
zYa}CAsO7H7j9jUfyP6oe%3F>+H`NkywOa1tH%p4vs^zY48M($2mm|*~)N<FqIptcl
z+_n8ULatNGU0*YDy(cx3!?k&XCpFWHk#*h<I{%CO)Sj!|<$%W0it3XVaSGOHkb>?9
z%P*@afo>})k9SQh&j?D8WgOwz5>4JtkbCH{obe?BQNP7S>P-POrE#jsA_VCr0r;bU
zaugk_8YW_EylR--5f)9b!<N^Pc<5Y3R=_O|7t8BI)I8#`iU-SNn==gVC@qtVF<7mA
z1MZa5_C(4sI9!k)8XTsQS=RN8t08<l!(Alr_Y5DPmSK4G8%#5J?`EQ=-A)(i%o!rX
zDO)_GwaQ02hvZUk@Dj7W7G)jW3hJ13uwsQt%=#0v{t{&!nh#c92N_x*Qn_6ZZ6`w(
z;P&(YqZb9Jj0UK=VT95lj&z0FbBd-*vzkMcq8X}L!R<4>kd<~akxNhIJoGC%&hyS9
zSj4d;*|fmklwjfJuX^a)nUSrKSbB(Mc#qLFmqmGh=44b6%mO1j(DHV13Pd7BUS{}5
zl!$?XQ!FooT8qg^s8!0o<6qH>uGb@$0g;Uhi>F~bnv8%E;_*?Uwn0)(ji$gbBwtE2
zTK}ah+_|GDAU!(Mi-G|Qfs5YG3rH065@b<Ypg^aD0>wbubDs1-84z|zQAVH~2)1-(
z2BeQhN>-o}DQrYhi-2tR{&pfE*@0@LV5ZwLPy>VwF3Jf=SB~0k6<CTCAgu$<K$cG;
zw!FY{AY2<oZ3C+{k{?(L<WpvA7gz_RcMT!!1M7jTV+*<jHkO2o3dIpeafj4FIbs<j
z9ToB-^L7qchZYnS2`~Ia8z3PHB?}|L`<__yxXP-B$wM2yFCI2TNByv&GNm3smJKVH
zw_SM}J#2U=jAk;D6DsIFfw%XlnSS9oA_BHWdU#l0Fth4m{YCm&oUv5e6j$9asvhrL
zB1#xvLJ(@cr0Abg2n@SFn}zt7iV2kH7ZnC@^}ho-C@ZSx*MPiwh3!^!mSWiQz9Q*q
z-$hj96z!17K_0vORagAfjgi-Aa^STih-Rb|MYz!Vca%U!!4jM{h%T_Uvgl0_^$1al
z{-Q*^!pL9U5N!H@k)3Lmv73>%+ybOP<J)S=@iV8qqoy1=T)*$CDMy%*_tcbQAS3U)
z<uw1H4AN)~OW$B32b{9}W5&5XxO}m^zY|XHIRUmvlp%n<YI$v#$n#qzpj#r7>(RXe
z?f;|{<t0qf5m(`InX&N}y>c~UTS|=OnNsr{ndP+l=bcGJ)I73<%B5?+npx?F-n%Z6
z?A=C?F<@f3noZRsq8eFWVMY`ky$Yb%i{*XKJjgAjbtgxJ^GgQO!SWz0!nuQ>^G_)S
zMy?(%?+f$XZg`1AHFplfdlw_xnSJ<S<pzAX0at3cPnCxIR%^K5cn$Zj(QxTh4VTpc
zW;YBUFb6QVfZ+ohH9Tl3;P1%r;e(q2KRSirA<Jp~D^i-`;dw}bq&89-l%TEDl)zcw
zIf8TNOBI1$Aj@v--r?=SwEja3Y1MRrql$-*MK<>F@ChRNN)~aPh`y8ISt1VfdJzZu
zLK61}VvuS=wQxZ!ZvzoKxdvey5zq+d<X$9=kbAS-m8uZ}xmev80J%i9NFb|RS%e0%
zS~X9e-REAVnkSbo_d3-)fn2YeC)jRK&9iwbvE8JaCy<-f9RYW9xwomC0KQMkz1^)r
z%ZGqF-8y>yO}XK;Z55ZoX>3o$DskGLX#}qhw7rLzDlQA<7gSsZ9&SYyms<to795XL
zv4%1sh1XLmt_%ZiO%v6Mt0eAtFt50}y6ulFX>Cn@sA4U6__0yNHIf(bACw><*VTcE
zO|Q6Kf{pL+DsJE=KwUm7xKRR+H#=0UYXTkcO^X2^#yq!5K(Y@j?rCm&1{Z7Vaw?AO
zW*ERc+pM-%F#QRuYfi-z$UB?qPl|CoQLcE3irMxN=6YdWez@WVa5Xa5i&op$nEsO0
zHC*u$=y1|2lKXn**}<;Q{ui<FucA|S8d3QdoEv?|ze_tWpQz}WvJX<}6<wm6MS=}v
z2jy^3X9X1#wV{(l70=cyY9!Ek%2`oMz1>L>nLRjnxI!8<Dn)Jixr{g}=zk#-F_s1-
zE^<cD<dc4XqQnt}qJtedq63XoPetT<FA-#Pljy|IR@eqLlib5RgGrWjbeJ?|(mjhS
zODsH$cx?zbrjy`~PWNd42PJoM@!XkvS!sXaq6yOe*76O|MAiN<iJGLE+?$+Iqgol3
z3~F6@)T0m?5m{Z)WVZvI21^<EcQ`$PJzUlhHxr3_)a<P)Exmi!K)P(t+d-uCV!AKk
z?nytF9p+(KFJ_4k6c<<85*4hYo-2bcsL=Hzm%!QF2uCgzXS0DLn`K(W(LeGWsa(*P
zNe2n~xzeM7ex7u$pr0?j8|W9vZ4>AhhM|is9=W_L;M(Z~uPD~=MI{<uS*GEO%QbvS
zC19T0j$Bm@n7g5om(^(a@;VK#nWNz=r1f&pjl5b~DGwDRuW1GkzeYdu56c0sV))wC
zZ3pt->(}PzjJzInuCtLhNN2=Tu8}vA^Q`Py#KylP+QGA-Bjh&gR3aZi9akZ5S4W)F
zvGNxYQKo@c5Cs0!BgH$Y31iK7q+0WZR<-8)7G)aQRchiBhP$n{3faYw&+E8E1WW<W
zboxh8QdB2V%dM$sx{6w^jiMPUYJtpD0|k)TDujWYs6rT1|2cFzhIj0YNDISSq_L!S
zvQNq~qFLUBbVZTpjFO!OeD60(?JeVVzESxhIGUH;MiodgS^ubZI^agN*8w-GPy!Bl
zJ4nE>iK9A-OL@U<R8cWx0`4S%1vp#@I{Rc)X9*yFlsBpija9v8MoNc*aZl%xXVq+p
zYsB&<Fb~!@G!I7?W>l8f6q_7f{;<4D6NS_IXOxJ$)yD~Sacj&MTK^;*by-j}Snj@2
zFGJMbH;|#8+)e-)rdGJDSyapAl*J1Y1n-wsiZ^*LU}Y-{UI47NHvn!UJQFEXWn1ww
z$8lx8cyk8R3wm0G%&dZ22RiLMTSyGj1EW04301RKcD{FcY%)BE$t)Z1V(FQ;99iC@
zv5Z*bhX2!;(|ene;g_<aZpO{jf$C-ow}%I*`zIj9=52KMKryZVoS>Q{oRc&9Bshen
zkDf2i;e8;ZPnLdhEOC#nrvYg^0c@dF?u?$Kv(!iyWUmdhJ(Jldhw^hqPj0({;VCre
zkDda4h*E<h2hQl@L%MGnJ%jodu(8>rPmn5jn?=knZozs#W%$HmdXN(xNXw0Lc3jj7
zow4)_@ufMlm7mrZsVCwcPo%(zJP|*Pk+apJ*(gSqsYSD?j6@!F&u8R9JB*p#N=7bH
zOWS{9<P!Dp@@qyeSL@taa|l^umm^OXMy{}BA)=I#EA48ej9}y{^}ur)BiGt>NV%4g
z>+Lx}kmm-w5eRI%(OwGVF=kt*o(unlk(=%1NZG^4AJubVZ!RIXsYk)R7+G(xqxb*F
zWC>T?cF7LA(kKz3$tjjs6(#bzvn!m_qeNj^5XF%boO~~-rYEa?k}>t*umO+zFtMoF
z3XAlf`p;QlImd$K?O|@4%I!imL&hcqI^C8Con%8)R3+X25!G;lY?T@uWwpFYW<Zx0
zU5{0p>1IT;LLp4S<qS$NrYT2ebS6CRNu;-qbK_PVc{XyMQZ|f#M>)3lL{vN&xX*U^
zVtMaSiYm$11iE~&JeKAC5X}^|i9YB<RW4-=6C~5ag9)PV=g?J#W_Fj?mr&Zb$WuSB
zJeqVQLHZP!VculIMI0|W!X~$gXsV)5W%l#v!oLoOM>hs{XzyJ?R5^!5owIT)5#mL0
zZKB&$edlw`GlFEP16<x>94?8fS37|VyV>54l$!0#gL13GSgpN-K8~xW8deHd$>XmQ
zVlP}x?knUwH}oOYn-3={d{cUi64&l-r;yM5QoT&}Tt%-c?3z<0ofSX8t!gKo7#F0f
zJ$0KaiSJ;xsI2f*(a7_j!qe31{bQ6|c)IF{_%)WoGiYZ3GUOCCNe15bQn*NE*u@zZ
z)7~GCvwC0B1%}dU1^td*TgZ-qk%5Sq6(WX5k;03Vn1fCtWThRjc-wuX*ccE>#>jMT
z@O;Y}Q((0nOPpich4PEXv?Dt#>v+bySY3<9$P?pTG&voko*47m&=|Fe2XK+hX#jVU
z5thgIF=6o-@^%i3%eJuK9(0#CMrO=>_}!RplE%a781*fSaco$zA?#qaw!fDJ^kD&q
zz|u>Y@lX-Kr5w{sW?O(u#4>JFV|t4)z=!dzw>O-!%Dqw*LG*NlM0*nngo{FB56>d1
zwS)*`)!Q-47(RkFm@>e>v0bCLo}o70<wQk2W#6pQg9Xv_%)-KliK>DRDhh^;%3>*4
zPaQ2~;M=ZYN79A`^aPYx9q>5j5G@6{r^uNaZ<D0lCda~10A!IP%ay#XDt9q)sSFnz
z87?t1T&gng^e}f7aTW5ItjxprcmUHJYwpRaSl+@YbY>K~FbZ8pP)jb)E;siBQOnIB
zcb8HN<U>bhG+aNq|D$YR&AA^rvIxv;a=D*4G9GiY$o<?YLqT!w_E(OKx)AWKBMUM>
z{_e<;lF0K9M+RD?{N%_$%e`;zUT6LQwh~CdrK9K@H6A3qNCsl$47p8E4GYuNV_zIo
zndQnr%oUc~LOtB&Qv-9e)x+J~1%$M5cVdUrG)4;Dki5}|GtrA&^#W%VyD;pQOBw`r
zaT^7L72VvWf^B6f2f59HJ;&I=u6pzGb;b^J)ti?HiaxG-*HU5YB%i|8$6y-`tgpMp
z!1}q{1pAVsu7BifZ5*JvrI9bPDeQCMRM>Yh*iQyl7WqCKILjj6XH!^?yqTyl^=>Dy
z0g<n@DXiGw91!_hn@TG)(gwQfO;4l^bSotdr;-nHs|7<-7~!rKY|bfEzA>(PEAvXm
z#=C3foH@kKBzK*G)ws7Pj5%xF^@82O*i?6;V7#1`JI&o}V8^)+3O1iZeY(5FmHww-
zTzeu|7DwJVwQ%%fBf)fRRJKEP&A(%&bPXL-3qC%S@)%laE$l>TXu9eQ>w?@FMjtTK
z>;q=0_Qzd!?g^^>0hvuJWavS{xvxm>OF6uDsN6gi$$iz4RUaU)Iqf1{&drkH(JJEk
zqsjo}7Nrizt;FR$%|f{#-pdiF^aFzUS8#=WXsF;a8Q1vi&w|U<xW<o`3f9oLhF-M%
zSXp1<G3QuypeNuQ83_QZ&&&YMlW_@f+c2C5Slv?t?pmVhhm=``O;nAlKZMep@$!M9
zf74C<c=drIz&&Zu{sY%J7s0zF0_pu{H+v5g5&dLwDEC<L6}rap%2)s7OcNYAbDqnZ
zJJAUVhQ5)G>7rf1-a=(jxvHpfoyAohDPdd}svxPqak)aC!sIr}gWL+nwN*2cGdZP$
zx-~+G718u0dp42zH=(t65`o!^BY3M$GI7gZ9-*}HE@2LS=L<RVyz2?iWmvp5u|3?$
zo!LYc%TE!<L|z2l9$|&Oq1-MqKzz*P1E};Kf8xOVHp1oo6os57rNqmMLT#f^n4s()
zbm8Bm1$q3Zd6LvC8#1Z4o;6H5Om2ih?;~+Dld?`~%*k(@)DOmYTuiun8hSRT4W^?{
zCJjIukN1-Xiab7PYSJKeXwG_O9BFkem^2KG-C0Pvp?J6`?#uKFQC!aO2tAFNba;+r
z_y-HCqI>O0m0GKsH$dx=A`AkKQpd6!yofSQpb66?d8z|bs|{1f8AU%vw9aP>j+F@$
z;PGnqwS<MuU|}_|fM>vyYDF0LZIh;nfE$@_Ivr9t={U`Iyzn7U9Zd|7@*H!{;WBaW
zD_bBZ&6YIO#)+yNe`Cf5W|XxIh*4`9U_4o=W|Qh!mY(&}f;6-6FLSb<+faNQMJ46m
zq>LW?Cp1aUwShpT7>d$~H~PW9+U#X2Tg~xZLp8_4aPEI=Xc^mEOKF)bENs_agCuU<
zwbx3Sc&=A_lbFg~d+nXl8v(wn82o_mD+64+gm^Yr0{;0df*-BcJWnju@RQ3m{|jpY
z^EWVRUt9+`?QDYIT(9|e{?vkv<j%YHosd0{5nlhTeLqAr?>N$nQhaXLeu!MOpl;Qw
zua$BCQTxdj(AihDySHih$EN}F*WzmTZU_7+TmH`-8vc1Frd2$S)&}ie8u9FpfuOAE
z>YR){rx9Cb<eUt+r&Z*f3>2(=<SY!Ng>5xm;vu!RbL40W?mTO|+G?W1dsS->vbU=}
z4_j(y!#enTj?~o$T;h{LpfBPQ)Jv0C%H}Mn1RV;Sj5=9V2Rgi>4*o(Z&y<I2Ji64L
zFZG7FSlL_<b^WEG<;V=%R;{J;pU46X6_#DQUi$Glto#nukDtlNovI(dgps>cKMv$>
zwJ!|FJ!**y$h~Tb3&;kw#B~h|xKAx{ZDQnpwZsKvlUm}shC_I>TH@NuY!9d<t~VHY
z(3Y7ukcVuUd4IwwThtO4kcZV07c6*0EpfqXkEtatgy!@1#fS$WFW8p=0o%)J@oNOf
z-z#eI3&?BsI<O&Z-n7>P;cpGr?zA@oL9M-SOAy|CI;DJUe~uI&pV;34LB)M*(<aQ5
z$^Q0S?=D~Hd%sjM-ZCb#EsA(K;hhwGLp1FUWVn~Exm?lS7H|pm=_nW9w5X-Ax4-}b
z_dRs~A0^QG55b6t=GL{nBqI2;d$lDhB4BdlZFKmlzuM2sExLAqozse~K<Ev&)s!6W
z7-m~C@r8(r$Z;$1+sMcPD=XMnm62mpu43#cyS%me0av<{q^2darE+@zfp{>oZ>yak
z_9E95V<u8NRfQQp?5v%k!VG4dpu!Bu$@X|u3)<yE6?4)6Rm@#_1_@ZC!YrSg?CC1Z
zdNOjh3bW9egwT;Skk*kAI<W@GVT@d$f~ks;3so=;X91V0V4A|n8Wl{_nC&`y3+;a+
z^?B^x%IwF{kXcdobJClzp6nN-H(@o|FG_F1TC!g%06&Y$ekBZ;oss=kF<_4V>|G_A
z=fg6<4%w0YF?qQKWt32qhr5WIE==SQk|(~h{j@Zeh-66_M=6nq!^l5_S+O#D20;n$
zBcDS=ly+(M-LMAV2fbHH%WI6;8>F<XBYUHimb>KaO;TD8&+N_R$jjB3{XivPeyo)J
zU=3h+VM`rgc;VqWfM*>*JdZTe`=8_jDLIVfl`(q%lZo8bqBXkQsOk9^6Zs82lXyfl
zJ6bn$;t`eQ)%m1wZYguw<YQq6FDOnPFJ<OYadNGc`FYAcd9sul@RWi!lo#Xe<f-(5
z?r^l*pFAy8Y<aIxhU~ZL!oSI-o!k!@_ITWZlS8#!9{OZDDXE=Gvm3S-w<JMh>4rWT
zQa~fU^fX<fP|pZdID{Z|cj#3_s8Eno_%#&p%4^{_QX+mjR=8VA1o*ownH6kvr;G>p
zn<Qh3+9br~pE6PE2XIXzcus33`s8NJH$b1VPQDQhWa@fB2AxA((>AJuN#;yB9C^W_
zmfrxY!)XAk!)XAk!)XAI4(q%}7HjyZ5)D^L3j+Vq<(fXGQp01bHC!$62>x+(YKG?=
z*QxDFD&28mYfz4JoT&YP37xIBxA5OC)?iBL0y!P1gvT9V!4G_weOy;diVmb(z_BEa
zJG<k$=QyGy$C*|Y%|7jDVd2V{Hb!L!GBzNx_zC^A>JU9aD<*ZQ>abPXmtg))U7t>k
zi=Lh3U~-pZPmvoKZi-U|Nu>iGqVEc(43z*lhh$7qJN*C;r|0ySM3m6o{N)5o<XuNl
z+D&vpWQALGLIJo3Y^4^0xz}seSp;)$*s4noc(})GbpSn!|A0mCOCsJE1W60$*q5!=
z{4kZyKU!v{(D`pMxEp0xEhu{;RG^!h6tPV`Kv+y!v!{pyni-xdw(%3J>}g^fG9E{^
zolXpC+}V5Q6C_1m6@gIX!12<>@i==tbsFBioMjVTFcy}0^pOIt2cEBZ`Rc|$^ISp-
z)FMg$^9X6D)?|)iq`g{iX=0><S|Dv^q{yKTB!_dip-WnOy1<I!Ea{|1kd`dfNgYp#
zSrepir!qWA3YSB^&8iivdy~+t$zgi`kr>+J!8IS$B_BfP@UXnIVpG--svhU8B@o)n
zvTlOE`Bbf}o5i)<ooA^}Mf0$bb&F{Hf-+^@D(wgG?ZwF3nk~7bgzo=YpMLQI=0GX-
zAmBM8%O+=14v7{#rPPcvGH@PmP?YCTm+Y30-d8gb(m<R?sN297-hN_v>;;cE0ePnq
zv6IV8RR090T|^gD>z2BMWQw!(e0n{$SWR)bzUsQGNjg#vR+DrfJ=7!}NKZ9M2Xcs-
zqysrrP11q%Qj>HbC2IBrq_>(q0XZx(NoRBVs0kBN`l<;NkbY{C4y3=DJpn0IvnL>B
zYW4(VfSNr48K`DYKnAJV6Oh4b_5@^znmqv-YHy_VKQc@zOWgSe;fS5J-dxoG2zK&3
zi5<Y|c8uA*`4YJ=T|n^35=Ur4^%6&b8zhbZH<m!=;0uZWlrq3*WedvzvsqqKrG^((
z14esWT%+kr>ok1o9Kh}h%ByboAV;0^jOMA%d9Gld=H=iY$MCY%fIk>Q@VRR(?=>n2
z;wbEOk?w(;j(33S9$dD&tLhOtGIF3pol%G&X&H!H_J%rdu8U6!J5g=s8P3Vvni0$H
zI6~?97hPe)Qct}*2)9Sx9ejm-6jZUyub_EpDwe?(QnAc4H7`TOa>;T+GVQMD@WwLI
zLIw5>jAR>uP0zT?zy=?-Qh|*MptlN<0#D}}f$im~z(yUnQGpG|=c~XjV{f;!8;xi7
z-n*Ttxbe^I$CE*6wRAxcZlC@IDyUVJWljH5f)Mam5@44T<Mgj3c({+4{>?Vy-lv)N
zKe4#=5pm(^a#QdjXZw?g`-$PL630A@Pv0hS4ETu-G!Y{P4C3kf+izX+qE82>x9~z#
zIHMX12(_{g;4A&=%2AR)oqQmKYrAe3Ib#T=%eXa)ptPzeIxzy_CNpf;9V(H?V(WT2
zR`gL>U5P`F&H@_mO?Z*uT>W*2Ikp`%@IHhG47@Mlu7UR>+%fR}gxdyQO1Nd<WrU~6
ztL?l<UN=AuoO~xyH%K)Te%f9)SdEpziwPOxl*4A&IFw~nYJ3>so`IJW9+bHInKO@c
zsu6@d3#>cBX$HcpHFcvLxtrugrn*XJJyP~?p3%-WAUqYQJJQ*%k)xa!wfm}^fZK70
z#*Zd<b};ZUgcln4Si;*Ics1ee4165n1qOZ$;rRxBEa7bpd_3W8415CNc?Ld_@Z23R
zzUC4t$t33uAm=es<H%A9;;Ytq7b!p{JG+3uV^f^ZH8RzaMHZw?bM$Af>W+(i^WsjH
zUFU@4!Qn2(rqdTNu!6CNu^CPQtyN}_n-S()X7tbEsOP?DMya$g4u=_KA<#KaW(<%P
z#&t7epfqHz+Zlt3!Ncav7%aU#KhB*oqz-hzL#4L|JgiaE%a>|+c(ayMA-z3hj*#9S
z@ZoDU&&YKeK4N|JCUM3n3eAlgt)$4L5%Y(ORl`MrOJ-&vGp{PoRJ$Ho!A$kMtBRa7
zGgk@>dY%-RZ#ZVQkpgoy&1~D#^2QN!C)t6dPkXJ)m$O~>y$9RiwfD(O?|+bV3@in8
z2S}HKR@+q#ZhX&E*G+8>KodU5p@&1Cz$OfA%jT1z-Va2Oj?21K3EWw?Pz3TktS+)E
z;wVb4TjXp(z+uL*ST#h<$Cjvu2xO_V!}6*rgG}qx0RhvAAgWFx2>vdfC3i9#i7+c{
z!S|0atnOq0t2-IMUB&l+yM-<9fvC)_QHbyBy_X4vdvd%-q%`aiZ>w?-SDv?xJ@R8T
zpS>z#UuFb?k>R<yFl;nY=jJIRDgRvcY7qB)a|>k5dF*n6+tVy!3^Au2OBaY(J-anT
z^j&RPvvWnnGKQ6in;BO7mtSDGgOs!JGJ-ovjQxq>10=@YXZYX}$aF~M>_f@`cVW19
zxrX~z0v^Kj(rOJ4tN~oZbk!hFW>_^yz^XwmW4daPw=rDNjJzD@vqvqrya8meEQ=wo
z__o2VAsUWRbLS9bdDG|`-C7pB);pPScqVj0S4iW>JtuS{&I>6;g$*QOL5;I3Nw*Vd
z4A0oorg@M>RPKmn{5y;AW!y_CuqEe2Io<U@^6rTTNiA{IoLC%!jext;yU#s{K|<ri
z45V;4ov5CbgR7;HBS-oaF2jkfBuv1QOJTBzB(+EB;5%L`lKp`w$TgHI#n$g|%t=d}
zXn{gI@SY-m<vYlX6XJcu+PL0ihRWrXje}Z|mqt~rWca2Zq|;+{(D~0gDK;zBKP4HO
zIVasS#1gR{=UvD|)Dt}7TVr==MM&pzTHX^xmHy=gf>1x}=k-SY@BlVX9ZLgPJ(F%+
zL-f8<C!niCsZVFRI%elJhRdX_0UjW2?a!oS-au(<fCoui13Xx@H5x4E4Ux9SF*0xH
zTG+!@&l|SR%I1NCfAhi;fhQFp{W{WllG+vd62r7BQis4vE%y}ypa*cJl}j##_gA_=
z_MCYKKsMi!&+97D&9N}Ao5U(?I#7IpavmhM!0zHO@^akH>s}0)*Cpm1T%sDne0lMR
zh0HG&;XLZh?=Hfxpp}~WwCB*9eTC|mo4sbaw`ae5=cs#o+yX6A_e14ZQp$Pieh7CX
zkv-<T3gKO#?uT&Cxm?`>ZQwjB)Gg4{jI30*K)CC<Slt5QuIEzY-rief-U6*ww?N&f
zINs&z7H9`cTcd7)a6fdVy0^#O=hgO7dX7ar7<R(mQ&K$Kaz3q!x0ppdqe`@zk!Sf#
ztJ4XRTh8g^9+%6lZaJ^?NnwYnTh7g#9J|J1dCw8ClgpCm{8wg}&KbBh(fChzE&+7@
zD?x~hvXf<Os=CUuPF7<R;5?~1R(G;`(}QE-Wc8-Umn7iie2EKzB`yS}^Xw*(K>h{q
z)II;L-ibs_n@<;U({%Nr-ql2zo~A};+{K0HW?Vn{%Co$ihy}L8?9kjIgdz7Db30Li
zwox(`VK)X`dHd(o8>rmsUEV+6N^pUc2ylCebiit~1zaR0`U~@ir9}T=xQp}vdAAYV
ztqiLBFkD;?_!x$JR03YW@S)NJtY)}(4d@#f?pp`=Wrj=V0B&_V!2=rsmoPkJDd4dT
zmp22R#qfybfNy8`h}D3%ttYs0EnxnvgnQ&V4OguP-2V=ukJ$(qWvt!;xPj@%Yy<oS
z!{fIDzUxkcC++~;`7VNMb^<=?UV<m@0{k+=Q$N@6ao+)cpXqh77XrFwSau7Jg034V
zVOB_xd5p}?5#*nY%qb9L?<PX#g#|fdGa>Vf1%bx;5(8;06Qtz>#CA%#ASW@>R4K^c
z7+G8`$f5@cSz05=y^NezCrJ1qLe88c$P`AJ8wELuk!4E-IcEzY7c>hp|6xK_E*Ins
zMlM+`$gPa5S}Vu{j9j)(kY^ZKvtAH;8zEP16r`4sYqkh-DI?cz69i7YVY?s)JwYk!
zb{HwQ>=dM$Q*PTO$UH{w_}pN-`#S@<_a_6{s2+Mi&;22J=mBJNjv(JZMbaKD5Tx+W
zglq{5(v6WviUk?T$m1n~oW;o2GC>fRPm~L?gHxWW6y$(s33;YkkUoq&TO-JAj67c_
z$h(ZZG)IuH8F{5q5Qu(tse!!SY#?tg7vx`@=dY^;X}g_}x7G?Wkdb%S3Bo%u-1pZD
zGM-a*Z4?B0{%4CIu=?X|g3MyJPqz!w$jIkA1bO;7LcZK72t4}DE<qrA_vc2+p6>+t
z@FmLg{ZE4QeVLFSEEnwudG>|`fdxP37|1ULg4A)IU&FEmb}=KiT`br;j0Nlx!61Up
z853;L4oYibmkV}2V>x!EVDJj95DNAOPHSV=2*xKyx%qaTfwi;e7+9g*C>T80(OxRp
z2A0yvZWiow#%N!WU=O@X7#(tL<SVw-Mq$`;u)R*wP==oNdckf>qkM<j8wCSriM_?Z
z4zsrj_6%$2Yi}3qO~(4$I|TcLu`+w7V30Y`-X+*MuTk1y`*XqgCfFTne`jFj_D_PL
zx+`dXtrc~B)-9axa62T}7RHXSa|C;dvC(#cV1H%oC_8LmW9(wVdc96*<LnZ_Rxx(0
zT_)Hqj7_x54XoC#6s+AFls46_7OXpC$J;dqHp8wnuvzvT!3HqrY`ak~{^pfC*IsI1
zC)v${oyMFe+sg&3*h*M~y;`tUoVLJTE7;UG30q{Z6AWcvYOkjk&(ET<T5b^5@Th$*
z54rrN3+?|SJneeAv}9N2*!8(`KY#3vmQ|mpW(>_Y5z@xFB8Pc+mQvr=Sqp?`*!B6&
zIv_kftuKhICf-6wJ7=S2Yp<3!kf+dj3@LnjU*AEkb(E1^^&Qn(2aqC1zC8uDPLZ`W
zU|}cSmTArv^>m;$o3@vYUaw|@hpZ#y4m*I9DU3w6p6y`dF1sgE26EZ%Ruk9We<b7{
zHF5ovk$de~VC%}o*<d#T8N|p&^|a|mM((rEL&}4U+^?QCy~M~S`(l|12I|km7@p1A
z&!P>NJl*GCpuTHo0Jz$?s(l54`iqdKVjbmK8I$J_GmmKKTK_1x;o!$C4L>fA$3g#7
zNYl5<y))?Bay0!3nc;!{WPzqXCGU5G{&ZNB=GDKg8Qw9JzAH*mSMQ0^&Nopp-WR2y
ze;`T$?`mbb<dnqXh3dbCrYS5%ZTUcCej6}z4m5KDmUTYYU~1T6Fzs`(5IjL#<!A?4
z90-Auj;p*&nF%-x*A}>D8&|oX%mJkpuB~y+#WfGtHn_IMH6PakT-)K=9@j!#JK!p(
z$rb_bWL(35JLB2~*8^~s2<ry;KwJ;PwHVj#xE_pa4_tfVDlv8_;9j_v;MyD4!*K0`
zYhPUZ;VPdeC<R=G>i}G(Vg>=GWBKSe1lOUs4#Tw^*WtKUNbBxUUm&gfDsGSMRO^0#
zk@l)}BOnXaeJzj<Y8xRC`iuk`Cy*j_fH-2V6Wt#g?QkUY#>9h}JSH(26c^V3uAUg3
zQ%^$>7ZEx~DWjpY(lmOsY4nkHmgEl9(=+#I?jE+foy)2}MaYn|PzgPidzmIBln)WE
zU!;TrS!|~ppF^v!mi{HCj8ce*YPE0x!_SGR4%DkxHbJIWHibJ>zs9iW3S|+md(>Y^
zZ@iTLLbma*{#n~|sB>3eA<5<OhsP1qyC=YmeHs>S{6bXmDAV|*QpI<{jbEwqvc$%(
zjmmEPMm^zWs~f-NQ~j5dYTO%F*Y}W-4&zx*HPWGYhp1<B7=h@CBB}yNFNZdFyg(vk
zFlBDbdnX2Wzao^r|3=p|9z?x=#wKUn#>p+|n#RMG*Nz}9&FzllLphnpEUzp!xf01o
zb25)&-lW*%6OlZhlX+b87RM%EfaH~&%p;w5Wo+`TNWPPkdF=Bx$0k3G<mWh<M?>%R
z*yN9p{5dCoLl-zXRNqfkT7ZI}zp6Aixs>9=YkPZ4;SVH~)_>`m#zU;vFE)83l8@wM
z9(29&(PSP5Trps7l*nq_Q<3K^&T}qZV3kw<CnIXNDyz__w%PQA?(V3FhmiZRNX9_J
z3>U%h4N)3qx|T*}sr?5(amooUy>-ja!uc0GxiGL^Jr-96ENvJga`^dt!&oKfT;gh|
zcEeieIJXYSDo#1Zm6-^1AM4IR3ZEL)Fy5UHgxg)i1h-KOn5bR|eSif_au?GRda@5s
z=*x{>p&?7UFu%qZ{c=~Z-g}0`NUZK4h}OU83XcXFo-iEqr0JNalw&+v0%>@f98=hu
zAeaydl7<H)GYa#d%8bH1MEu?$;uoz)5Jcy{(G^;|Hr#HwalOh2DR;PG+8q<kcs4Sg
z7s)uk;VL8J)u#W~n*P7W^#31B|6i;8kIJ~toeP)4%h$W}X#ZDK^ImBFcSLib;T*$J
z%S=a|s~pwqPIA<F?5IHmnU2b7I7Kp_$}9`b@<z_2M&TE^Asr8k-7K@F3-?*m=ze7o
zqt)$=q(YqjC_$FDjjjh1U<Df9HA?WFS%UXf3HA_g!v|b~UkEZw5NdcuGQ-XtDl@A3
zRj%p-X+2D|_9lqVzoaX)_H6jo&}s#w<()&x4YW-IrA1qE0#bC;iyJ6L%1z7`2=p}l
zaDvY`XcgW=oTk0EG<+j!zhV*JnuXo%${i3&@|}B~_V^xmofy5gp`YaD?x~@_Szo2<
zs6gbV7mAU)`fg$ypiY272?n}y&jn<VdnMR_40f*)CCeL*kZ}y6MyYWOp;)ONPy-q5
z$e~3*j#MKYkfWRoEw{?a(#X+H3yq9%vNbZ+X$b^MtJM$*Y2%zcqyRa_X{*_eRXakF
zXS~w^DShsxGEZ=%(*rWmIZ&rea^x-zDK*YvT6C>b24vbjBw)TXxTLCKvN)oFDKi}F
z(7c8zLV?GoD%Sv+=Ew*DTaHtH0&=`^4UjtJ4Is3cL&9zcD>#W1R5i>r6wFczz<h#|
z32n2L%wb&E6O~LLbCer^%vFU2GSA^=q5EskDrCWkPHHLDBuZM!6oP2~KV8vMvKmg8
z_5jUim@VZ@)l!ghmTD<CuuW&vy;|X&1ew7fYB*dZp+F;*BsA6|0%XGL#4jdrJG8uy
zqWHH2(fOxzg-OK?IkNK!?X^`<yomPNI%ufK4R)pP-_d%tNbO4yJ^!YwlCna0A>|@v
z4y3G91%sg%2S`doRLW_Pa&|;YRzp9-J^fAhl$!1-Q|@`3GBylg_dG|C>7I2B2Z<!~
z4aG_lOz0kvz5%{EIB=ci{YsgoR2dt&R4wU>Qsp$<W7u=AY0m~_4|<P{X2*74z-XlR
z2c(gnNFp0Hk+8yr1Sv~fk}_+S-S7ud@&NN(8?dl$hA_A;P$N5(VEFZcse-}s8v=E<
ztP9oH4L=x>{-fEHeo{@T@jjBh*KA7vRAG;P?PnGCS25eaoGV}gl>XwV&v?V2e>>G;
z0<d45aRx@uQv^fjV!PvwG=~=Gbg^7_l5KYPXZdvZ81P)FhAj=(OZg!AMzef3IY!C<
z=orJ$t!5j)-H{lF*>|eWcIW+6*n5>5kg`#Ak3Hx~Ov5JCBO>JirzD4K3&=xGZ;d>x
z`aO8-QKzp?`IG7d=diSG&On{=ltW)ZrQgMz@{CiiQ?@&mKw!ZOPL)o1*_j1oBj<V5
zIYFnq;oJ_SlvDnqR`_7(PG_@K_%Rg|0jCae@EWcXpS5BBtCct5+O^7?K(29Uo*X6~
z{sm8ne(AVNZXs(jMP@bdsW0?{$kk?7dzl$?m(#8zG^{|w8AgUPO&iW~l%1i5Wd_f=
zrqJ`qw8F>YjOg63+~8lK_`l&oUZh$9kd;m=qvy`CynhpmH2?I?R0c1buCOwz!7{?e
zR$U`{I7fAjaI+hfDMA%xYzPFYJE|eb?2bYW-%A@ul>A+FBxuL~;NJQi;ujMxCdl$G
zqpLFEBgqIwADcbUCuWcMsp^4Vp^OcmagX>8L1sTwXE(fQ^fP}^{R|BHYowonMLVgV
zvAjHbekdk&B8Ya2(-kI_G+ZoRLGONv@(S-mX}B~fQ-uk{+psEFY-QJRUit;|^*iqq
zy+)#n?9(~jYo;q?cWAi7@c5ldHf+4h9E|Q(9!JW(LFsUTYzWGV07Ce_pfTOKKWI#M
zHU(+#!H-choCn#AG`hl!K*MgsjPH~gJt(<hPmn^dlpwQuvl>1$`2R=oqsl%C8grRX
zR2g90r$O3+cN$3&Pn=H>oqtMKm=J1s(GdBP>4}%g1aDI`<932%ch|om;-!d)K*OOj
ztAruF)KQo~N<6U&hV=Fvt2Be2_VTa(631&vuv!elZ8~4*{5PVCsnFPuGn5XGWV_b!
zj)*ewDv)brt&65`R?BOQ;v)!k&nMK)p(o5#ege~0(FIP(sV|i#&9dstRFmFB$@R2F
zo8EtpFm7q+E8arm?5Dhip{>92IR@&|;Kk^tfRqJS13?@Q2+Cw0ck=^-o9X>0GAOM*
zU6d)q4O1$VDMKl_egvB`BEon@!zqR-3r$m+Oj8yqQ=o8ha5Zh}Ara!>Sg*M2D8ce>
zrEA)q5j6$%M~gjJ85yJO;d0f}c5ajlPODbq+vk+AejH`-zKMv~*>J33>3C%+rT`O^
zrI<EM49e3Ww696QZ4izystG;~1Sz$_?K)+0@I{?6CAdSUObxzac?)PafG#Tae^LBm
zg3N`-$(RVJwGYd?Gs?(Ye=P5jD9(Pcyyv4hyTbi|Q1`yAoboY&sL5Rm4sd$?K-dD>
zFkDhV*It1~2<t}o3<Y$Bshn}aLCUK@ik(oep3HZ!lT#AnD@nC@`}Tq!itoKY5kiZV
zmV9ICvk;-ZC^)QMCve8YoC3;tm}Go`n#h7aDkFEh3;I$<$m~h>E+}=v-C03@Mus_|
zVkGf$=z`%+4G@0VxS+zR12Tq@!<{)mY8V;iGy>r#SqrM1r5ZWfIRglP_I<$^_38nT
zvCcA`GQl}-0Gq&TWeX<K>kDZYXnYdko`Kgm^u~pO*HXG`;FAe=415aVwt-J2+`0hD
zPhsn4s+S<nVx-<#t~EC}wi`6?M#>p5@CB4^8~7<K*}$8~Qg4Npw}{e%2ELf(8Tb;y
zT?1cAxMSd_5^fv#X@pw_ekS2*7ioQG5$+lI*@OoTyqWNTfuBS6ItIRs(rp7jkIS=C
z%fEo-8TfLRXW%OccUS6azQmC}5dpBuxwKd7$I0buoYf@(x`OW_u7oQbtJfi%bR{*E
z0A00+t5h6A#MLx`lR)M-j~4tvJ()&~U#p%>Bjq|r)@80_>DQ~r)DUrlb91k?tZJQe
z3t6#FR3VUWQmTO5OqzN<!Hl;$>xq#M0;3<K-_B|8aoWAk-IR8(k+wkz0pmty^tkD6
zayFJYbcGODwOKKu2|N%f7i`?(+^-$*u(Mesk2nu%36H7g>d5oB^N42qlX}RGl&#L6
zkb>BM(vd!P9XsaFCi1K!9q!$nvfYsm7szvt^s(^E^XeTMeott@3(mW0O0nQJyVq_m
z=<T*eJ&}4Y&$|d0&~y1-87%Y;+d4EvS6IU%$bvhK2LlW4q6Y)inf4~uTz0kIrAW_S
zMiI3W`dm8yJi_5kBPfq~0}F1!BVt%Z&t3F+*u0cNos61NML)4{N^x|3`;^Yn^KKVh
zXM23Yz4ssqMvq=lf11=8o~fO#>I?(p8EWPa<V<yY!&|WH&r$;;QqHFQp0_PBC}Heq
zOQ_`)(iKXI>pRHZCGYL6@2J)bv8$rU&4IgsbaD#>;fE?=H%#Xrk%&(22@p3gA}*)C
zyNKh#rT$<g4wm(BX+E)r7-fX~BSC6E$ofd`E%kGy#MlWkPn8&>|4FL7Vf3G`+8Zo8
zSv9de^mwMeUfn06_zh|&2#`kSJ`@1R0u|*zPH{F_Ue70D3_FTYSSJ_evpgQAya`c8
zHbu7fa{{gZ=oHTV{8LOkk3cMl6xj7;GJ)aZ)(=qkJnJdFepp~jNp<}|N&b~7bUGTW
zUGO9!gB9`|BSRE2h{V?qrP{y(1PW3fQ15}Q;k1eX5mCqG^<PS*@RQ5>uT-VLlV7W4
zV5HExGn4}PR#iBV-EJ5u$n%{mqc(5mso&$4AO*<Z+_FeiwU)vlcdjxSx%1R59a7o^
z42^Bo8SP-p4;UH?Xn74KsjmN*l!V{#sQ<+*$-hnGe^thV%~GPE(GG~cP~rs2wDE4B
zTqA)%rD!ax?<OUIsK^2H$W2Re$bgi{0rOBo2h1Y{YzLbfdj$H@5!W0U^sE2L_HH4#
zle>|wxY;q*kLq8GSwFJ8SBME-$f+M^c=s67yT=Bok^MxB(#YJWNsSkxD>B|v{}*vz
zPomWSRk?53GlcAPYlNq!{wCpp@i&_;{-b(;fRtNQ<b2JdZdDHuN?FuxX0Y7u%F+??
ztaruVK<;n{YbV|5it~|jmwUKQx!bMO$USbAM(%a1HL}4SFZSovpKsWIfocDRrv1y6
z{m{5V*$;%jwFGzN)h{qaonnewXo_kwMJ+N#Eslt)s(;cD^^_@!o=@sxJY#zG&!$(O
zHNCps^y+h_SD!b%`hw}z7fr9e<W^c<_|KNr<&gkI$iW0j#PB_jJCIN-o4@hEzu+m}
zk<s)Coa9ZWs|v-bVm&(PX(|-a2#(`WJU5#0Qe<2c$yiW7M>3-4nyWIRL!YO5h^L9S
z{v_fm{eb&d`qiHp@ZO9{+y#lBXo+;U&0H7=Y~^A|bd*<Nq^mj#D5e(+EU)<4Na>k@
z_CG}N5d>LYC0$i%vyED8Y1U$ns>KV4x4xCBuXW7B(E2?-Z-83fU6f4@4Rs$QP~NZ9
z?~OKGFPp)nM~Lh#^FAcj_TcAfsO9ZpoXe#S8lf-Ot7_%hkbGD~I1BfY;<BryC-R0x
zdAL4ZTqJibr$CQ5Y%bxQ)H|VzqPdz0qVqrK3g?wHSu*{)gD6dOGl9z5@EjqIT`Y5{
z;-<f0F6A-xd%dx*>F;_6VbeeK4#K7%^bW$NAN3Bxrk`X7;o&T2Z<r2OAON$qoP}~K
zI=A$NhiVNAd(rA5{Xj3#+7{C5X5MJZ-GfsDO*_CfkLCVF=WhCIWHQ+FYMY3drq=@W
zeMybJ&T*~LHv*xMfxb!2B`V}!QCpgRAs;?R>ZEzTMUa{`y-y$<+uRfu$MTe_sk3q{
zPa2!Ls9j1epC{x1;zEYTrb5ZkhshmOhU*yVNJr{}C)CtNcxExVttm9$*!R^`K<meP
zH(S%=ow@WDt}($1N&r{c-T14ToXlxbONmhADMbi?G-dtR7s!OjceXi_n<C%Yeu`5v
zY?&$`B~!gMHugnI$x?5PJ;_K5_0|~o2u<0xj5i#_O)YI1V!FLVNRBO|3eNzWTG=&-
zQeGBnYHioi{vXnaK<e4_nXb#vc`BgMFSu*dRrsY2t){Oev|#Jk63BqRk>CaVt!#M(
zyqg{@Zr3{BhE&w;JE9QqyL7K?LqE{>Y|o;7ee~nrz3F{N+wy^7%Pzx~4-H%X$FSui
z!<LW9mhmrgQ=dXtdj3mS1WV4MbO{#r?V=1-hnG?EqD)nXyd=9Qi;U92vgjv-!+!`C
z%X=0oUxv!p=_>7bQF9gw$QsWPXIoT%i<U{Dpzqumbqn^Tj>bRAsY<e2O2R|nqVH@u
z&4UNUMSE;I%_D>b3E+PtyvV@6w*$d;2L5+SFEH?b5T0+~KM;Rw1OL$u(6QB8{!iS@
z416!)IaxaWpPWve)2C#+bPjt6qWAwJWyxCni;Pxm?&8S)6(DKGLzcxkYP{tjU)(y7
zPS3wzj)***AnO0<3ikvScjwTyEJ*3eQ->2MO^sX&z|0%*yweF3qj-dHS0ZIKT_L7;
zQIp)~!OM%(eIAg-#{KJ}C2ErgQkJR*mq1Q+!j`uyRtW|qTz;hlms^5$2pgNTsHdn~
z@(R`CAxa(B`JzJ=@-nB;;VmfKU`G1Ua!}5q63K`P@2!%79A-QKT+~Myjg-FJ+Eg$-
zY6R0`W-vX@m1$J&pW-TeYg}b-lgd_N3mqK>9mtRzBTPFw0czqpy~qiq1r5BD69}q>
zESMWsC&~cnOnaHknC-%Qn+!7#;8GiSS5|JsB#x(`m^^Jqr22UTrsp3~953<k#qw^9
z67jyPOf5D?iCYP>yr=1kQimGW%3~i6sD^9I$3B0cZ!CG=L^GznO0~a+F9-(ilg!(y
zzW=M;Xy_|s(zU-k@b|U%UhTlA`#-XcfA!N{?-qhPxiFaxRa37=h$_v8Q)vC4ag>JV
zCzkg%<7ippwJ#a}2VG?1XG|QwF>fOOLs$F1D0A|64}3~a&wuCzs4gq%qI>>&d7(g=
zV|jNl%e{2*HqiwuaNgqti3>O~UB1xyU(CqwJ$vs)li4Hg*M!pim#zqwaQzbLr*J2-
zRNY<hGEM!ds<-1OyY;7W+o2zOvHtV`Jv{CEI;kB-7d3@GoIr@otG`f0f_J$R31o%p
zO@Umb<O5l$Hq8LJnDTp9uzW_%nf4t-q(uO_THXV6#Ryl>bQVUq5kze|TSho;C{4{W
z!m*I1b7cPeEoEw2mS?!QX)$VZpEXWLBEAu^L=+zy#W|2HZ)g-BLlB;On$2jPc^~7W
z#`4aN3P2UHy;S}vaT81Bdo{#7x@))po6NI?Qu3I)Zb<`N@D>r4G>QuVFHnaRlq?w!
z25t&V)ETQ><x3`tk67^%b$lb}>i9;`Cx?+2@RY8A!85Ix_WzP0Fd=8j={n^MF#%j>
z(%tQJ;*!cljY<jmaI_4z-o4NU`CNt{C9B*8Ts)*XGi@~YL34@Bi`(*Qf}~w6X&kPS
z#tf2gUKf%16-knFKA#*I$?Sbc#56uBgS%HN<1dyqb#^*67Wox&AYm=K!Wzn?Lurth
zI@H!2!<g#EQ#J2+UtW`{d1w3bnpDlZ)R)(!YTk={c}=S3y~&r?q-x&HzPu(?^FHg#
zYf?4uJHEUoRr7x9%WG0KukHBNn@QEYZG3r6s^%^B<u$3Ax7?T4q-x&rzPu(?^Un3<
zHL04n*_YR(YTnCyc}=S3y~UT;q-x%We0fc(=H2egYf?4u+rGReRrBul<u$3A*LHnl
z$DnH7wgy%A4<=RfcK78qshW3)FRw|}yw$$ECROv!^yM|Fns>1;uSwOsD|~rPs^-1k
zm)E3f-VMIICROu3;md1MHSg=bye3uie&Wk(QZ?_7zPu(?^QH&<;>@IK-VVOJCROwH
z^5r$DnzzE2*Q9FR@xHt!RrAjF<u$3Acd0M0N!7fU`|_Gp&AZ;0*Q9FR$9#EBs^)#e
zm)E3f-rc^uCROvgLBDt~shT&>m)E3f-h+L4O{(S{<jZSPHScs^UX!YM&-UdtshanE
zUtW`{d2jUPHL03+gD<a1)x3}U@|sl5`>ZdoN!7fs`|_Gp&HI@zuSwOsdwqFLs^-n~
z{Nl`{YTk~%ye3ui_VVR5shW4VFRw|}yyJa&O{(Ud>C0<UHSc0yUX!YMFY@Izshal&
zUtW`{dGGb*HL05SSzlh0s(Ih=<u$3A_cLE!ld5^Y_vJOIn%7P9i!+m|d2@YvO{(VY
z?#pXZHSZu_UX!YM$NBP_RLwirm)E3f-t&EVO{(U-)|c0$YTny?c}=S3-RR3}QZ?`M
zzPu(?^M2&ZYf?4umXKdOm{iUCsxPle)x012@|sl5`!`=+ld5@t@#QtCnzu!|U)fBm
z<}LK)HL05SKwn;ys(E|+@|sl5JJ^@kq-x&LzPu(?^Va(EnpDj@-<Q{<YTi?Qc}=S3
zUGB?kQZ?_@zPu(?^RD;hHL05SAzxmTs(D}Z<u$3A_d{P^ld5@l`|_Gp&HHa(UX!YM
zOEUao-K1*XRld9?RrB8H%WG0K?*?C9ld5^2@#QtCns=u!uSwOsU-<HxRL%P@UtW`{
zd0S=r`PZas-XdRKld5@p`0|=m%{$7M*Q9FRV|{r|s^)F><u$3`UH=uWy{<KQv-vbV
z{w+PXod0ZRhMC$=#v`4!=E{5WO%}4%LLOu7^U;k3g}gvLb(U5*oUN$-8cW2+x@2J`
zk+F)LWr1ZOvy8WWSy~FqRm?KmpQW9!Jj^Uh{aJE_<y~gE$e*Q+u>8s_H~F(<3Jc8L
zY_jN5Jexp<S??r}PyB}Td~1@mTXIAXSZv2|3-sK?Iop_IowK#%e41H`{aIQW!plt-
zU5N1sWVnBB0=eh6q=(+h&{eKYX>aJc%w&NcM8z%s<cAW-@c8xw@?EU{ZIi6kXN!91
z*=@3D_4G1~HXP)CvB0(_Sqp3-0ue&pO%~(?c}M~oRaos$o|!;Kc@`&-VbzKRGMsX~
zKY2p}8DaQD0vVC=x<C07fAWtBWJF|oAl{oWutNeFrR<eJUiuyRzQQDH-{*<%VeEL5
z1-^%qXZw?vCXnIH%M-{yvikKVS*vd=>f7%jmdE^A3WNooc*A6Yg%G|wfs7)%!Fazx
zNL~UNLJm$KZ)B?mnPhEv2eImPW|{8Kk|8Xpl(S71-5}0SAS0M=Od!L;4GCn(emsGU
z+I%*F3@^W)Kt==mEP)K}y$NJ^Hq(puEQEASAcMPC0vX)H6UeBZ@d;#fkuwv>W4|Zg
zFE+`#db)`3q5dM11-^%WZb%@*_xC1{#hVG_ms$NACRwY`H`IS-vOqmr@Av*>H!a??
zsQTOlG8$X=1Ttg~N+6>lk4qrKKXVhvsGjo^$f%xc6UdN#TLKxfHztrF`}qViqV1yu
zGE{B}#rp)K<Eshe>HnZA`OqZmD(NUyf;Rm(lSN0wF9~EsM2qxz_3(XR0vX%~CXi9$
z-U(#5ZEym)+YeNR(I#1!p-{?z$g4G3PzDrjegb(h3p~{%Yk{2%fy+%62t*BDoj`t;
z1+F*AT3}}ph_XFovOpjz`Nae>%JX3Y8R~Z@km1gMCy*heBqP465Gkt?$nf%w31ql%
zLjw8XAF0I8m}Fhzu2SN6nPsOxOOddkJYSeBa0)E^R{|LVTV=+V2QgNZKt}0%B#<#j
z8<jwYCC4U^5!THn8Fxbu{zOH)(6}4I)|-ui4Ox5>(rGVkyx%BWZvfvXn|pdO{eIa1
zHHcyL(QNQ+md!o<vBtmy#gH?D?r;JRt^>?_=>iX}r}IB3qio^fZ9267i||gaz~wP%
zF1{NGduLO^)WeKB-a_8=gS(<M*;{k|dBm~IC{YFP;R&27C-_D-zVVJ6{7UF*pUmLY
z2QM6DTZe-Rly`v}D5s9ZhO`KapO9B#g}lOhoU{<6{%0W{#|rtF_mXQNNd3=3evB3J
zBk#)9LXa9O<cLVQstHg&3E3=VR3v4p;Cv^F-_#6jiqd!{aLZ3r`#4d8>#QB(M0Jc4
z)kqqZRsE2pt?Fm<LFXpUXP#@kzs)a6YE@;(KUx)n_Gg=k14ZwVc1<Kb#!WGZE~sH$
zRh)HIHV1*$J|>y=>QuEK7pMKWIPG=Gw9iOYdt;pT#yIV#B-7rMs`h1Z+Ly&?KQEc~
z3sTj7O`P^?pj}7dH8vj>tmEL?WY%1tsx^1VS#x)sHFw*5HnFzm-elHnOx2pLan@{&
zvu3N!M<Hu#o=9fRQ>j|>TAVen#aZ*Z%_lEwYu-#|&0kZs=F>Q9K8>^HQ=1QZ*4BKU
z%$hG#wPtUeHGAW%*=zH;(%PDzlUegis@7!TTuj}DvK;P9HQvJEW306`Ey2H!p1l<k
zt>50WhvTdX$5|70_|$A|O_yZWbWPQovN&tX;;boi_>63A&A?>V3{KUWsyJ(^;;gB1
z_`Gjz&6s4?RHtgq@p0B1A7@RS!^ewjYi1;~W>%`!EQzybiNo9Gbrdg+tEtnHS#w6J
z)~txLW<{KDRycf&y7tY=WY%1gsx{ZeS#zDk$FOVdHzd=(E>-Ot;<RsY_^flS{k~+{
zH>Ik58w6-=PbSm$bgJ53i_`W-GHriJRoiC}pkw?qhtG4@W&I+V_ODXazBf+$Uc|W8
z{&O<zzoe=?8?P|wvS+(|B)!(2gY<ojQmy6vr{6wGb&k{C+2v#Dwe|y&Y44V*_I`2N
z`?-9iyw+ZtO#6UTwO7VzuXOond9D4(WZJ7z)jlOo`xKXt>(<(*CDVR<s@m)0wAZ_Q
zc%|0fm`wXAscJtbPWw4=+Rsg<{rpt5Um2(UO846s&tIKP`!%U*zdcU-?RaNTd!7#5
zp|ym4wD-GG)&6jt_J>_QOI>S!G@16tQ`P=Loc0%7K7(Cre<_*vS5npfUYz##Tt0DK
zYyTjb_779lzB^9)ZkG>y*4p<Z)Bb&`+U)>Gl^$j60H5`&wYx~)N7Mz8n8LkKUYz#4
zKx}W*HktN<RJ9)zr~RNf?cI}U?~$tZfpOXg2KY#8?fJpUv=2>HdsUqFssJB)t+kIy
zroB2<?Z?GwKQ6#$U2E-i$+XW%ReNKc_Qn7obFH<Xl1zJ3s@hk?X<rfG<EM2CToK?`
zi#2{xfKSlY)?J*;x=T~FZe5&p>*B0i7vLkdwKX><v*wmmt=SxB&1P7mwLh3l`<7I-
zzYwSWg#bUS(KYizfX@im_=^EPE?ispax&|7q-xzKan^kjXWb`p)_n@=w6&iF_ylil
z?H9?c{VG*!e~z>EXIQJX|B_7muc>O!3dW9dS;31RHp`xk^nHwSIY>-ll<N|wy-Sb}
zg3x8}noRqFze#%&1*&?^)hAASpCCUy)!O?d(_Z?Uv>VT{YT~rl1Y=jNYJz;!td7ds
zARmmbt(%g}x@oCew>Zwa#c|dx3AWv4T61bLYfj%EYmTA{!q4#4IYI4*bAl&qi<|9N
zQMJ(%=5zN)%@NQ+7emd}afQA*_{VK#6<i&Reb9MLvO-^*sx`OAS#x_Z_Ce<z$+X|~
zo3tB^<GwiU_r>|*{vaPDr>kWXe3J~1ZCno~vwq8Ovfil4t#Q_Gjq}|T$+SO}s`lsN
zv_A*!+BeSy`3Mw^KM!0t?H7|-_j0P%y&q@Y`@yqgYVw01pYW`$`7oI^AEj!|o;Yjv
z#MRXI$+Z6?Rqd`9JN&s`Y#R$AeILVL8WK|&{@TQ8Zxg3IKbiJ+scJtcPWwS|+Pf#y
z-Xm4*1LCv~h|@kOnf4*6YOjjZUghzL(mLkHB-37<s`e=!Z#g=eN1&<Gl4&|VRZa6D
zK=(BBJw9(t<0pH3>Yy%nLo#a?q-xDMan>yJ_|#>s{k&w_FGyAUm2ujy^7!axt$l4W
z?SDvB`)v@QwXIL4?aoxSZG`|`&s#k{R9b6)BANE5Qq}%qoc0$zp4w{dFDKK!BUSAm
z#A*M)<I}FS_79V3|7d@-N2jXBylJ<my}monlHJ~8WQm#1bE25hMNMV*?2j2oa7V&F
zV*>PZoT{H8P&?rl;4!Lo;;*S{&rIWj>4Ija@h~eLUJJnc(A*M<DGaHdAwU=9fMnXb
zrK+t@oVI?+w3Vi+ZFHQrqmpSmI#q4cAwbvR^fcbFn+)eV)}Ei4%(@d&weIvd>rRie
zE)kEN=$(<q2g2*poRP+Bi`x3Ll3CxJs`YE)tY4GHM=xq?67g8yUYX3gtM|vcXcuPm
z9XF@Nv`*C}-LgMo{ko*}afM!=#s}$Zm*1JJP<N-Q{fRj3Po(jY^V;Q4rp4adKb_2)
zKc{NVJ8{;$lNNj5@m@0RAEc`Nleq5rleF0J`7@-)1c9!mFH+V1ZCu#}*9yK%R`$Q8
zs{O~fvi}%Y_Pxo<{&T9@tx#+?WQX`{b6s{9>HF|}5Q!-aju~;<Gedj~y4Kzznf8{c
zYR`iJt*vb`Z3U@n>j(k5eRmAS#(1Y>+B>JJ{lGZw2gYeHPNx0fRJHet)7~pid+%i0
z`|OW)zu}`Sq`h7iXGvLz&(e>HZ#BFO{7q_&iT4mg?U2yECf39DM~&YoRuNaC3iwu+
zctnW53815VB=}=WtP@A2YE4y~HG*peW0GmFPF4GaIPHRK?URyeuT53^@u+0&`QziF
ze0pLKXwzo?ChbdUhN~VP&50}foVYlc8)u#1V@QBCbzX=+<e)8|7vi_av~ly3`K|sp
zS#C`47R6b<D8%0~(At+I(|&5I+Ru*Des)}~os&%axv6Sj9;bbIh(Fn&Yhnd(?TeMk
zthr==tnuq9FAv4^3#uo)Vt>T?bx~Kx74qs3KULL*lyqIlYmyc6+ElH%9RjqrJCbR;
zD^+b9AwZXPV~9Vup|#(iO#9~Fq}>>Uo{7``Oo%^op{@CIh(F(<@n_>YiS41-yU^#8
zS^MH|vexJb-iovKEm*64^-ePF@1?5!O9;@~zD}m?+x^kz*VOj<HnpGkN335{3#P};
z=Y#37v&=N4$Fy=?;&deL?|i<m9)sGX^EAiU%5M1;y-RwGe$~r#-5=$CVh`~Z+iQQs
zj^)vifBfpY-N4Y)vUENnEb42cv?EYj-FQZ%^F6a!`e-gA$j6~ZbgpqQP*=jSz+*h5
z6DRCXY5cU$O6PBmXzjD&w9ihaea>&vZg^~ALVWny*qqKEvC)NImdvK}ev?f`eXL67
z@8M`|mjU00|JS6d?M4XD{=YFj_W76K+M1h^mHm&YTC*XYKk=ir-3NRhW#5#lwx{FD
z{xsT)_Qlib{Ba>|&7YH%eS50bycK87TXELB6=%&m$*g(rH(6t}j4#spQ%KquUqIl0
z>PvozE5i>cgZAK0$!z}TZ?d^q_l#af>?TVugL_J?J%n`KbsCNC{EXOP>imq@)$a>3
zV&@&p!M~5dya<VA#~X8KLk!|OAYGfG9e-^Gf21i!lNz9|PgTubhMK$fspg*jQRCNr
zJ_Z50M2|z2u9mGxk13%}d?HotJL0tO$lw7-D|juL_BT@1{$ZT<5973dluY|4scQdw
zoc6!RY5yUa_McMKo|YNgrqVL`b7DFULYc8k`WfKgM;v4!@qgK-{GzaJW^4;C0KN}x
z?NiluK%BO2$+R7`KiZ-*%?{l0$;m+_nX!F}U-^eYiT3_5c;CdiwsgA~4*q@kXT)!^
z*ywM^W@^o2GkG6xj3(8?joTkJeub`yD|AgJe|t`=uFd4n(3v;~iHY;Nlg1}!@^|XA
zlcpwf(s8L;e`1{V@%S91Yis5uvu1v()-278otvEoJf_;TDQE1DwrUDI{K9lqA$=JH
zjAOF117F3nu{1~sf4?yTukUJE$6(upqs~FGB+opDYf|Nz=jc519L^(L^QPk+IN>6M
zzpV$!^Jd@^djijt&u$;fw(zej-BKzm2gh}=gEP)02JMESNFV>x;gm)F3h3|D%8b?%
z7!QuLEdZ?u82@w}n={`@N9wDT0N_0Wq8?{S6Isfal5czw35oo;cbIx~Mi#R5h^Q%z
z03(=n<cSe(`aAOSH#Ii$c@r@Y9UD1bb6F!7?~~2UV?|wO^Z*OvT(>YIHoO)gJz7}W
z4rusw2@?O8qk*6HGvc(L5vTpEWZIkeN4tlw5qGMhGvMI45b8)*l;KXRYbixL6YNX5
zGe!&sELxhRNC|ixR%smTAcW|9?eudFr*D&6Rywk|XCWICR9@j32_CQnR`DF!y^=0g
zMrUP4Aoz`)$rQ`D3dI4%#WjFy5LXY^G+aZtrsJAnTr&Y@;o1V%Y+PI7nuBXATw6<-
z(gLv2>oR~0bIaK}lr=5nalG;(h!sfBYr%h~5Fxz{`80br^U*JKK+8a=P(Iaq9??Q!
z`KUAC&W@G6N-?J8ic|;MG78|d`zR4^aXZm1sO3FKI25kV$jf2zFAyQ4jb*j^D*>$w
zh^e*Zy&K^QXATAzJ2rEOC>}uaGlz;n$1prB1fH`PF3-~N@EpJ^m|h{;?qzsHft4Gr
zqs-25l~j>!R9@CPsib{Yo|PRDlGfIcmv71gtSXy6#!K2!_?#9+Fl`qRT69t$$)+N<
z2uo4ebuBv6cb`AeIa(tJd#OdP<nYK@E%HKEb}M!*{j$TT0msf`ER^OkH%Xu}&qZwv
zBt}&c!w4j|TUK$_TMn&fSr+>^>utvZ!j8>)#|Z$rh<LN!bwWVCWaK@kKqK!vVG)&+
z^`wZZV^L2jQTK9&r=5_M{|G_+%evq3wh~<6))D6JAkgL5G`)Y1>3!Ssb`w)OE(FSx
z(OE|q7gCk-WKcCBqpN1);wd(1&lTKrc%$fwIw{MX0S|NRWzG~2H&bHftT5;-Df5I9
z4bSeYDl_{r5O3mE^SERbn7(Ms5@@btSuL-0HxW!9<E3k%RLX_0?hPWi97-<g(R+(<
zSX7gFthQ*p2!<6C#G)dq?aYbA;Ne=yoK&gdnraae&S?iCE68atLWWVsoI(nmBM~pu
z_<BHLL92tndlHdb6$>vHpjCI`U95Q1tH2vbFYj;xk<y1-9RumZk&k<m^a?7Z6mOYN
z@uZCKNbB+L8zexAK7w+&(`gD~d2bOBDoR>QV?LP3ty_sX944(>OT(VP^xOid20c&w
z!W}{DHsTjHp>^Ayk(zoM%tuki>}Nz^HDIbK*5YxBH<>O45|G|(f{RE7eMS3LTZ+|;
zVj+5j&=4iK*Aly`Ms75czA!djQCEV>vFg4^xh(Hhx}rq}vObe$#0AOvoGy?PI1@QS
zGy#(y73~Hwqr0ELxWw*9vS)Ne_A<(DdE6~`;!@?^Zo5Z;R87|~lf>w&w0VuJkx|Rz
zak4W*ZRD6k7ikz*xCR3f>lvL~Rv?IX2!<T-CuC<F1lf9M;HD{FLwe5f5cnCZWr#kl
zO(7v!d+swU%xXE)u47@vG(t;YiGV{04^x5|-|}MNf*Q0uzDQc$eKxxk<%MV529_ma
zng~Q_*5xfgB;7-Vyi+8SIBxS6N(iz`^A=Zwhb_)qQlpw<-YgK`=8PvuMs8wxv!&+`
zr4xK&ftCFUG4QW#e)e|?%zn5_DElE~w}~x#iyFs+q3m43`IndL6%bh9c4C6Z=Ao@+
zUgmPZN>_`J5%Q%jdLND?Rs0R{#fKy~*BOp;|74bf>d3qa)d3ki%t|F9u$)1*dkc)X
zgRauOIA_6ljuhu?DLcoH(=26YS<X4qw*QARIrIT`9of#}#K;Ck&7vfpoxw`2*mrH5
zeW+~IFPtF7s*qywkcXJD4j@CU`5Bg#f2RH>MjD4eS5CPgK4m2lP{N#o_9!8<7Icsj
za%l@Xh76(iXrWr3LDcGZ`f(b>Zfp(=?Pr`ieIQd|q)FAhi+p)as^-1lm)E3f-rmM1
zleG;dRr5~u<u$3A_X1yDld5^Q`0|=m&HI5buSrEsETXE-FV!{Sokj#y_s0C*sBZ4b
z@(+{h=9Zt|M*^D1(fqy=(3@CFzdXsfHorSE{=~$CB_oGleveAf12h-U?^y*nhv7q-
z0P}#5f9MrfD`r-c<yIK(c;cL4X*gsZ#8Ge<XFk)Y!&a3<Mb3PK;~s+p`Q~xHod#9s
zYikv=<V%>NpZUoi%~B{V8<}O1KTA7dd7WAA_h%_ESbCcut%3d)*_3mtN!I#vBxeb;
zT;R{r+7Q0QWPxy4{((tGB%I9x^K>M%8WC}3YpXkVErE7&yB4{d=+6CgD6fOuw&QB!
z>fq|)8ZfSAs?bA7wQy}|T!k)IQ$h}SL{1R!AY41)`YZj?1QM3!vw-d51fiHF6j(h_
zth_enZL8d{%I&G#Zidkjm*d(jtj*2B*4!+N&CSB3$STpXyzMPjYibM}fgtBWHZV#W
z1<woum37hJ4~&-KlW%<jN6yi=VA<=uR>Xy7SrV9u3_SV;W{Du4H3d!xgASpyy8`Bs
zFK}WpU<jSl)AFVesw7FfgQP`<NsC1ik9mP5B8i(}V5uSLRFZUSL{f470O(*z`2$4~
zTKpi9gqA(HtJRa+R(@`PBg;NSA#AX9C|}xlw!K!76hhh(VtJW#&F0BB|I))A_dC59
zZa>EsAp|fh1QN{SQ%P@d%mZS=)N61G|9aA#LDuB*kK&QE52$p>KZ<W9`$o~Dc^<3L
zF|0tNV>xd>X3k#{$<qHd_=8B39a^8UtPdD3i%^*orvI_2U#mQvN~T%)GbQg{<SnEU
zMt)p<`Aa3WE775%gc$~mkMJZQXbLJd3EOm2z|wspF>Eo&|1!^i(VSvin?2wv6X{Cz
z8u<<QFIw<l6#e)AOGU`w5LCYb{5guq?{|)!-_=#tz=)MR_p}?h!RhuFZTWr4hpOc-
zk8SzOxi`{ndu41>zbLjNxLCLR+ar1t+xVKKJwQxqLJx37(jH*_e)a&rrJ3%#E&Z+)
zHz3BgnArP$^%R<6{rifJDZ>9NEhfhCdTcD<=5sO!b^hzIE#!4>A$q8MgV6z7m_PCx
z6ajc;UJ2O{D`Z2gkd3kEeLPpujc`+JBiziQ^Z@&)(Y#WpmL)X7$CEa}r~Yp@!TZdf
z`2RaW_E~Ivd=?uJpC<+x^W$ekYA-Bx(5naX%kO1#K8=?EA8<lpgoFM@gY|Rj7*w!+
z6Kl*jvBrEGi|&pM*1yLF>mC-RL-}v91IYKxtb_Jv-%$Ro)WlH!#R%o03G+$U_KW3V
zkvVIA$aeKm`a6@`*a1J;zYDpQDSK$7I2;0D`k%i)$-nc|CuVHjcf*dE!R~v0A2a;?
zFDK!zn!U;IEBg19_Fo*SV+{T8>9PEJti$7atdVg&))78EmY*E?gq7~;8sp?F5IM(l
z#7BPR5x^Lx<uhPfPF0+oqvP-~HurwRBa-r~alftcaVVeeENWCAgWKWXg*-H2z@Dsh
z;I=ujo2&Ef=Kh;4`)jk2{l7V6`^B7mm`umYd2z9EzE8|W<$P>MN82@VZD0-Z=@_~y
zE~c)uc@Wj<S0jG~$6)?Flp?>xxVU+ralz{=`S<$AMNA(Z(-Z&qx{Cki%0zGT{wF3F
zf7kL@BO(>iOjV-hRhw-cEt_qA^rmZZi~STWm1_K<xLSS?Q6RPaa*|qpa-X$~MYC7_
z|53{i@3WR~Gg4&LwdD@Gjw(x*QVF?=o^D|&m0+8ihAgGFjBJ(6z6npiXiauN_T38X
zFe;m8vi$4N5=*%)=Q(wRDWUTmEp(p4LglNTh3)K-1Y3pecuR?xlUL>Nm?Aj|;Rn<(
zC+}znN+3V)Q;a-{>r<N_ObOR#w$AZ6f<}+LYxNE3J8`|vJ8`|vdvU$a`*HEO3;A`t
zet`Iu_;g8){1SVi&-NLg=!F7~-z0qKL(0+rhrM@!kL#+=#m~%{Ga5ZC$+BeGj%APh
zPGU=b#fcL;wv#xCox~1~113%HFdEHBV?Aa(4_gi)2_Zb%LP;Sn3Z#KT+uH^x^xgs~
zuTolQxut1)FC~TEUuY?X7FxJ{-P_Xg|Gu^MK9AAJc48}`{by{Qv)_B|wbxpEt+n?#
zhpp1!>Hp{0LQ$AMhYSfkjlk6-4aK@}7*ujgw%Dts#MOTmDoD)t|ImQ-m&~~O`=M;<
z&M{#9J2Irfw)H61kBj{g`rgB)yEVv=Vw-JXmlWOkqDa&ElX4N~$<D{HF=2l@J3zMf
zxASA+oI~N93o3LY-~?13T5EgcD^Y<I?upZw4XC(RSS*P5;e>QJf3eh8D&KepDjziT
zGFt}|D&N$U%3mDnn7<j=SxQ<8fQxMYs4$r6J253@t=-)))4OG+gPFfN&eL4MOz&%$
z`D+?xes5^zUmnc-EOYugGqs}O&$hOs*|T)_gLBf2tlqC^PB#$?E)vNG6X5JTN1OOX
zkx}zVh4;-#g%MOmBF_VF0Tmt#sBpZ23db9$u-HI_lMPfj)j)+4Au7D@3{+S;GZjX&
zXHjAO%vAW=m#8pct8?Y5CtheOTuvoYcQD@8K!tB>pu)Guc}6vmg^x5);iC;y_;82{
zKXL{teEiH*7|otVh3`Ex75>@_L4^^a5Q#hw3Gw2r?~!#kGK5Iv`Hbh+!!$jQ5`6xe
z4up0`Ahh+Pt%0iWxj4@e1@Yf*P#QlUVh227VScmM{x6-G9U|Em*dJHiVZmxVA~S!u
zy}(15KR^Q__yMqFWM)y$hzFBiba}`uh#!}O(m{MePG1M{NjK^l)(?FKGPdM)z!ZoW
zwmcoyUvk%q<v6!t%VOtl*j8NKwGzX2&$py)baTq>kl;V!DuLJ)Xf|rK-2w-d{mr9G
z&bU3k5_V{OCFIa}Mm%M~8z>$KIQ8rC0O4Pc)1f9u-TMDBPUHs2{zk(B_7}3iUBkik
zF9vVxZ#Kt%JHoNER;Yi7D{j@wo0aVu)Jyic>IpB3_Wh!CI)4nk^QtiAt_epXt6{_!
z=)2~>2Wl`v;JyYSa9;z{zt-g$(SQc;cX`q?pt}d8eh`1X`|?Jn-+<owU+-=gCY+n;
zS?t`I{!Pu9{w+U3On<%doa69`JcI5%Zh*=?@{o(N^R<Gu0FBqUQLoHCd4Oj&``%#C
zptkrd{ygl?bshkd<n$jkwW9}2XK$$em}w?j?p*o37^cn_g%2YvF^^37>hMS-oi^vg
z&|>^Z10O!pz=w}E@Zn>^hXFCYqhT?AX9HipYc^lXV*IYN^5t_|jDM~<U%u~0kuR?c
zmf2+?zFZdK%M}fLIncnD%Y`p>ndOOc{mtgnRbf88!ImRxZ;ZcHyv6+&yL`|rQnds5
zNLL;f7I$WEH(WX=kN2|r=B7M;fFSr?Z;`Hp&H622Xq|{W5V^7QyyU?nVJ`VkEe|eg
zBbxOW^$srx=QI}%>3}*v+`!DgCUK>@-}9+X<Nw2tA7sb<UveWFxa{@(cem@NUyX4o
zzUecsy{~7^jU^P~wh{{6-=o_~QT2H}>;?OqNA-E<?iZ+^d0ZO8b9`aV#=y3FEYLH)
z*07v>O&)X(mJ7`f^o>7nQ0u<l5P!Bo?&$~YgZgKS|L>5TZ1wl2XA85xnp2pGENn|O
z+dDmj*Xi~!<<#elgx6|)@~D4HLU*1K;B!v0^W48RLG4#nw(W^0C=9Q)4Dc%K02(dt
z#zcVW8xzs}w_Bx&0CR^M;<qHCn%_a`J}7^4L;0H$12=~ia{bJDWEn{V#Qq}&b+U}y
zV1edT1Z^MFuOj=o9AA(--O#hfgV$hj84F6kx}mLT?%NvL(zvtdVL2=Sa343|K8^%2
z9DW%A4AgOc9f3V|x4eHxLbtyocEujMOMdS5#4gicgA-woNsc-Z&UvHhg*r`ij{9CO
zez7cP(EOrn$qVF)na^cv{+5qG$~+C^87cFNi3_`s?0j2TK1SBud0f4GEBSlD$Sw-W
z&x;b#Q)B}ob^|$+7CEE3&nACmIak|sZ&(kTzxg{?aKd<Yl3Z(?_u-js9abtv#*qsH
zk>3-TI+mWFSA+?Y5)ZpS!yb~4;L<LgdHU9{Ut)5{b^}==`Q6w8rZ}Oiro<)1l`CHn
zfcJmMH7VB?xu)dWD%ZBqwOzs;a$O+TPPul;l`k2<dw%2^eQQ|DNxHq<mjgPzJV?-!
zd`}oKizftHcHvZ_<8TlyyB!IC44ExgCnWrb4DU%v_}>`b+YyBKbxSyfCR?uQmGCBp
z@rJH$A0I7)0+ym97D80&2}Q`9h;kO%Mp_q#+UpOuCt-tFC%F~9%dooJRtPv5B($y6
zVG$8+X&s7$`G&61phl0>Ag0<DX^q#jHr~*+P>_b|?e+~_$iO)7YKGe$W+lvvY`%no
zE=S>hg;kP&jO!v6@OWuSX<_p|8y3;RGHzCIysM-Sp)pO^6(sohX@7#ou9Gka9s5k=
zP8dTrJb>`xe#x*09T$!nW2t@T!iotlxM86{ih>Kev{7@=Q5!lQ4;nolXQOglkL@~7
z;!lNh$7%w(l!^RxtbQ+MMP6AW(Y4H#XOucNF@eA3uQ3oXlEz=h`mO<n`64C>Jc7WA
z4GpCdH~=WQm)T<b5Rg~cuyWe`Ift~~V6dBwH|B&T-e7pMG#bgWCG#5$D-qF1xR|rb
zR=6VOBjxe{A(yv7Aq)_*lL#4nz}ERsADKtQuO<>Z780ScH5w-Ktd-y*COfd{^;gC%
zHuY&N9zsH2w1F?%z}FE-vn-!*kib79upTeN^MA{?B>k|wl%(U1Mbg@Cq)U|>Szz#A
zg?qK=V24tp#^{rf-#D&@f64?jAeS=9C5WD&kP4_rUQiZ9Ypko>bss|Vi$Ix1Qpa7-
z7s}<RtsmX!kawU3VEq)K+z@*id+d1gFY$J<gbxuSGaH9lNGIl27SZ6#E=Q`)(NPxG
z;B5>Ft#ss_WEYBvaDT8<*P1m<fLOYe=-9X!u^u&4@#;h-`H1B~DudXcW0L{MKNm&p
z6TcM6eNQy{UakiLp5Gsxh4)3Hzrc=k7Jd^U`7I}@+23*mIzE(~O?hdSI7fn`TcA0?
zIg!qYijI$-XJ<h0T%FBL-h)?RChRXNSLaU(3_fam#Qj{we56h`+`!y2KT;<WImf|8
z>O7xLBXut98s_uQjRF7sQIvoFD9S&79A%jQ8IAt0DF1vV$}oQtjXo3b&p+F_h>*1K
z&tIG;Nk1q4`ObNE_Wbzg(eT0%nc#CIu?U6CP0EpC5weVQ8i_=TMH-m9pGciZB+_&w
z5-Ik4`iazuG#!aVip@QQa4{!I7H}r8tCJ8qJ(HdK7>dYr&daN;+t`29P9=T&#>lTB
z?0%A$&oMdqF<iucQez~cx0Kc~HVI2=9adD}jZN}@nSeLu>W_A>7*J|D=~YwWlJ3e?
ztx8YANx8PjRn4+i3Acr=?Gjd-bAg0A<=Q1zwLce1xW@pe_K^VB?E}{`C}j*(A*f-5
zhH{!f?SvZX4;76J%~{Bv60Hiq?WM<d-}Z#qeAYbcCB_iB4WwYhy$JWoJDK4Cr|5$+
z^Ir_-x9#jHnqbEbJu-L5?&#7+jd`XG9ghc%9*?t8r=M-{$InNo7St~G#u812Rof7~
zaumeu>qzZ_P*Ho@Z?#oKv1vcDyk_8H`WpPTU)?>x@N1DSfwv&AVr4@q-)Q3#Hd5>g
zDY4Qv*M9xd+0CSFGjmmcUaNkXm!tOF3<qL<gOOtMD0m;RJ@UTFMm8g0rtZ#Q+V1SY
zJk4!2>MKjzmyw!O`EI|6Y$3XJySz>~=;32Q4--KTlk6dgPO<vRhZ4Br*IwzBNqPct
zF{yrq89{cfS@z&xNnO1}BYY#h{SAgA0hFIXzQMzN0a&k%LV5qsK_CaYuX_uk%Pr9C
zU?cw8-_#7c*~NacS+O&~9T{F^5I!GLaZv-R{ZYaefchv05-{F7n5&HU1nTI|Z-xwS
znt3wX%m<>)d?;w<*KI3-RN$u|4N89}+RW#pX#D~wKY;ajqq)Bq&HW-zJq08AeYPA#
zzeJLZ;Ced}+W%Nh(kMMeitS~wKW$d*{HBByVQ~4KDD`}YpsrV&w*9+N#Qq(N>iqm8
zO6hNd4G7Pc7;BHkIR1-m4&rR}64Pot#%3?|a}!dUAUW-A0Z;f1qbUn)pEMLS+$T*r
zJ&&;rer?uYnS38o#McIg?+~*%UoE@!Xzs)41rA?H{~*JAQWECtPvP(l!uz@<{HH8)
zO|OIrI~~6MVz*#%av{>Bv+m9nQs`<VbgtCSIP}i6b|7K8VXqBp^hgb&wsVozAo4ol
zhE1}sBxBBJAc9p4ok`vL)j_Ln?T_(%yen1W_Z&jlV}f@(E=fnMaxam(1F_Z&E|QRn
zNpbh5rMQ-qWh!=^w5ICTPkWEBp%2lclX@pE@)p%&iQ7btdKL+Zqxv>dHj}tLE$ROa
z4JBT_LBj7x)x;}q48nN#zchlq9ZB2`bYn|M!cQ}Nbwa}5W_XY4Ykh2RZ-=Bycwe`K
z(@ejnSHk-l##Al%T~y?cUpVQMQ0S^DaY=FInvkm}*Q8uq<eHLet6bYc*LDea$d&K;
z#q7zoORn8=T`1Qc#dJ%e%LgejC^_osiG^TIKA|vaj>(s@23DurHqx><)LwtMy-4}g
zK_Emh-JMz?7&?W7)XHGGQfbBRA&emfI!)aj)aa2K?`DlfTI0P8gHBV=qImZQ5aX{k
zEz}g(_v)tGmP$Q>+O|yV{V$Yk!}lDzpEXq$Tq;m4S+HKp#y}toHfY&<8OHY<x~&Vb
z<7O$F=-9iE4}^8>b9xdT`=lN}9n^6RKrkhGMPa;-sr*Dt_hE$iYhT@)Xun8lY6@xX
zY3)nGgK?*O#uRK>BtvP@Z+mpNenPr=0=cc9)G8VV3J7QFmvQMM?gENSejq%H_+SeG
zXq)i9%q~)73rXqx8IM%2A2W&Vm2XjLituFTTgi^$BD=N70JBr8a8(S(?hz1KI(Dyu
z_+!Y7-51Pj?6t}%uVOl0S)ZZ+2<RtvaxVIj^n{9`&igq`0mviEd7NKQNMJECoY<aO
zLwIA88roQDjbzE?Z)HHjxojsfC8?x3Q}zl;U;&e`ota)^>JGxvn3}lDZ_Sfh0<cU#
zYMm!-N~G&yPd*=#dNoYMenRA=hNMB3(NPDX_t1_^F<V=@L|O`UAPscBM*99U6xIeP
zK^0>G@;hJF$<89oZdzThtp-%m{Z2(O=hwRwKKHP2Z_$t6;QJCH_75>zricZd)NQzm
zY9o_{?@LH2X+%o#;w+V={-;p1?dISm;_Bmd7QR2WoTU;yDi00FPU?dwFSNKJu}Nt0
zt4P37D`85E#IVvIIVQ1riP}Tm$<M~+yCno9iBIuJ<cFx5<fnL6whJR7_K|q18{xDr
zXM#f=(mJF{zgHwiq_1buQX;4QN?)UCN#`^q@|%M&K8)i_($*(ZB{bB1m+5a&uLSU!
ztv4Vr$h_2pxcDMsQGe<Q<}fk!%ghnnp^rt&<SX@qOiX=_Ie&l)e~VT~pe2?1DguMd
zTctUWR0ybM*1L?5uC^Jy%Q*FGVq%i^E@xg)s~Zth>#At2tHQN*M{5OJb-gc();jVC
z8VtI=jVvBSk8&Etsv;1*FK69#5-jt|-}+1R-XwB)C}%_Ln2nudjrDJaPGo=U3pRxN
z`k6T+;V#d$pWg*}+TZ%Gh9ZGp`yHS`O^M#W)pz5w0>Z?ekAU94b4jL`+Qxdn?-F4_
z{QtO=MH`vlyHaEYgPZ<As2OQX5~`{G8xn??)e0gR?h^uL6u<TV5(4lHBa9S_U?n`l
z_1_A&7D2>3B3#{Z^D>@wAzZDG^wUS#ZGIORi4k1;)PTOC^Ajl+o)U)!mDBsA8<PX5
zy&rG~At*HbK_Mx5`*rWLuHL`l29z1NzIyv(e&4-IVr(LaFO88hgZQ!-IXj@t<+1+?
z34H!|iHy<j?%YxF+{Hv78o!5b43pNPLar7Sa`mW?J4vfzHK%~T-c!U(5S@vNK+!9r
z^BNgucwV3TV4^Z_PEOT#IJdn#M(2Xl_Ht1%S24`rQNVBT@U|!(-X6unL(zdh93A*0
zjIN2lRod+RS!$laO7IvP4x;ZMMs;EMeJPL2WotWa5X&%vz3+F2n6ioK7ns!AeQA0j
zn*OP9Ymr&lBD)G4#f9i6LOGF0n2Z7n{{-{`GqYdj1O!z2C()VxN_1wQiPG>_SvQ!x
zuW|BpQA$!9l;8Q!PXuq`K($SOGK}8yl^Ey9i|cQubH)C4Fo1XD@vcG_k#{UKLKoo-
zr03;VNU1*&<r_-f`;gCH>(1^Enc(6Zx<w~N>f$bK^mshf=<#^a=<zrkb);19W@*&O
z`^~W{aavC0{g&7sKfE<|ogdy7dkA5HsP{6dyp^!@-W1dOEiorW<swD7pE`iD;=$gK
zd`7ixDu+qD;X$<RZ!>~#Xi9`ydlKK!ln6aGNqj>yi0~VlDH6;!_Sd&mWlrBx+QVir
z+3;Ypp}~yAeh5HxV7bs>Mni)sga%W`ARe(@wH+|x?SP24o$Q{!AE0By1h194KI8P>
zFMR~@*9k1aD)%NSAH?4%aYgFuW9(VOZ-^0#$`T*(SwiFg&5v(-)=)w3gE93aeisQt
zgweyWuVi2Vf#HjBvA^Lhp~zKFnHHG41b@Ak$2z5f&)b&%7=f$u4aNBMgA}XSV)sai
ztKJc6Ttx2GvA7g`k7R86fXVNDhk^JhBuIfjLO>w?YXpY>$&@2pvw<8xFCaH1#94#E
zRt<0+lCXX&2+{u5|8~C(LeLh1@P$_Xi($1e0>M0X`X96DuY|?+JPu)vcq4Sm=X2`k
zZwQVrtb#WL^mfG$VN8K=>WW8I^zQh3k-3HA?p+w?iX8~5MN&72_r)oGgLrS8>bnZ4
z9jK|l*_?Yxe1UNLg%U5@<00{KReqK28ACv@_cD_`g$(I;27${S2o<9{qi>Hk@@8A=
zQ5$%#l)S(+Fn`k?m0<JNPe5M1aepoRw5(+Td3`!Yb%5JYn266wW<W2$)e!&fhWKwv
z<)HlUG?<H@mHewdzg(J^%Z=>kn=w`KpGL;+ui+v~%C~Ib9}u|OR-rVJ>=-qbtMpie
zW|As;?=)=<BKxvUqRnV76}i5NxDeE3NSDA~1ZFpVGwc3Ts4hG0yF=?fg!Da6;35q?
zX-i#T@6y~(h)csu&!=to0Pq46eAt#agHL2`a1IYD;(1*kSupPm4<VdmTpBNn85Q@4
zXjH0Q-5#UxnjJnWJ_yyidtVvTXCzWQrO-;RuIisfqkk4f|J1Zsn6y_gO-$lG30}UJ
z5cl12hv0T;Ppa>Z4yLeJ-yP~No<SbMc)*pLBiB5DXiOi<OSOnwrax)MfWXI*D*_r}
z>hU&w2w^AnDdb+~OMV{9Fly?@8zle7<7CZ%RiA2z|3-uK|ILQ@ryJs*YKVWbVYT>7
zoX#Iz9hM=azx8*ACof`#&Db)yN7*4#EJ9fRa9Af2nY+$~6_FRVwaDP+Mo6SsWZ02N
zq}V*R7BRXbkx#zpv;BiG1d+%h3Vid6(pv;o5hO;?8;OLA1xsbfQF_89!}@i4Pl&%Y
zSnW=^^oRuUnv@UX)rNRo-1=8=0KF$APkHUV0k1_?fk-6cmyRIf9H-A82f9B;#xt^X
zw~?E>1Gy<dlfBMluM4u*2f+;t2Izen5hL!dZxDCaHz>L{h@u;y^FV{Rx~W0AZHylj
zWp^t&bb9|we3MlidXL3*_v8gu7@{lU{0X4|*WUx?4X%$j;QDyOQZmsHpKMqv$_?@9
zhPfz7T*>(t!4&%Q6|I{Q4<_=#IQhnjE-dqhkoi=TejzNYB9X{y77<U8NTgU;B1Ks=
z!n||WnMWk<>@<_gnTv>=2sn|!MIw=6=RML$(~-zIHXSY&unf<u8kSktApO@hNdJuu
z(*NQHX}_T%eu+r`fD0}StpKm`R{&+9f*+46;&ZPEb5GCQ3wng8B9S@gD!|m;0j7o%
z(RFe-5!G8aCw>vF2P5Aq<%9S(DSrln56{(na&rW|kw|3qjZl9$5@08I6H{-#0Xu~T
z?2ILNUdKm&?|1`tCL7`t4e{d*@hQb-WC}ZzA?BSs5*g+5X&~IRlj4p+>Pd_Y1`oFO
zl7FRJ4BT@{ev2!>J0VkOX``5U%jF{R@TCkxUY3;D{GDMv>OFxjy*+?H4o!L26PDEb
zacRe&vpJy$OaBSs#6mR*2T>%^qequEFuZ6<2g^!&uO2PpYYY;78zh}fl32V^8|?Nz
zCyD(i;Qh8XxLm?GI>=s9%;825-jR^ngzy574LhBLk-y|(%}u0kLW(|@)AD}#@RF1I
zY^;DpZ;EB5SUi@hAR>c#RqBNF{VPaFRkUx8G*wlg`LJW^<gGr?sZ+<aVmdV{iC<yG
zyjD!Ia6u0f@?n<L*b=AnFW4`Bt^J*UYl7a#7pA<AO7$Ni$@`cA%u5MO-JTw$T#qI^
zbCgoUzz6&2yc`$)Qj1c%5M1D0%Y>8+;uZvDD?+HLZ51))<s^R`SLq?qp{GCjQWZJ<
z*~u5%@)th+N#&*8oc@&XVBG1nuS`hV)1P98ESS;LgkNMceRf(Bo!^ZumS#g&O^Hj2
zE7ycvJ-H_3+9FpyrPnIqw$Qa*!X0v5AlFX0cFDC{t_$Vb<0y1@g`jIAKy8}@B}zt8
zCiP(@6H=zfSr>xQ0{yJ=VXQ-4Zw`+7wGy#QnDfQP9KJtZXR>>l%rc91FIOVr>C^6k
zls<DIjeaO-G-xlB7<B(kvy!1id8k6#?2ZLRWp6-$45vz~Zvc^WZ4HWE^fn|c-v&*t
zM@Mj9m!3NQR~9s<jycI)7wZY(B#L%jq9jkI>bg{gfRx`@meEUilk%B_hblf+x`t<*
zPVy&zUb=H3+T$-c$UHEJBphU3VGlBsisc})yw@Yul4ki^3CEj5gT9CkDjCUuBPA*<
z@u8+A(pusnmUyOViHn^<_97*^W1%9eNb8A(N~DeuUCdcUu1=+vuVx)RaS)SmT&}KM
z6QOH3SJP9Ht9831tXECfYq*7ODWmOp623~VE9Lq_{8}`mMee&tV$U)|Q^FuDaZ;oM
zIs3eZL+HuINW!tTCh`%kp{*SHI;JdI8e6Y-iYa;T1*6UvSZ9i%u4(es#SHS-HBA}{
zq9wL|$zyDlxv$-HDev!ReB(z=DpLTI)Afe9<bImzn|xhiRwS$_Z7Lw!{x*eG<Y**P
z=f!XO0ShwkG7-Ilv8$j0=tLlL6CL}hy|{LgE%@t5r^u92JoU{O8BU8MLb)b$nEI<2
z*Fz0|OD5MDV(s4Xm}z`m8kZ7C<OB_GmJ-J$5)K=$E_06sQ@$^l-+f%4#QVT9UDy3I
z<}Qfdz{WQYawz6UiQIK_eA^JyF1gj@biK@#ng4ObB~Y}1I!kQ4-;`q`(!!6&xBZkY
z@+dRUm0b9eOZz+5I<IzZjdSlOLShl(dqudlVki=DS74uY$<eX^-H(yG&K2%?WR0Vk
zSNoes77S4Gs{!?WGAeLBMU(_2_nRcSAo>{=j!+<}rR!-+ftIqm{^<Eq)P==zgg(R6
zvFYQ_gK{q{Y+*7EW@b6yGE2c<M`z}5qBHZ|S;9c3;s<6bwp(F9x{{pMn63wNNQD=N
z4I&d1;qpi%jH`KMkaNXBM1+OO3UjwGwzhMT=XQ4YU(~rUc6&eU(4m;yd1d=m?dz8w
zShQ>D9w?u#=N!Pnqy*JiZ;j)2Uftf_4)d%_l3UivEfv($TCM9)yv?L~L2K=c&_TP$
zF0iaEKywEcF>(c>c<Z4b#cBrw;J_k<27K$+Lk?bsXbO6)hqog7QRMan(f0NQ?H%n`
zAaT(ml-Y&h^h!hR3P7J<6l0R2Xm0TW^lM@2?~k>c!b^g}Z;ExX<E4vCCgONbxG#2K
z(Ry@oQ49ens)K0faugdN*4o>zMsS6s0iKn8F&0fHP?VVp&)^1>T#mL@^`R~ctft|+
z#`c5NJpf-iUFQRfM%VigdV~-u8!kgT(8{720OS(C9hADXpOa!>*yv-rU3%E$XQJeg
zfds)})3Z#$W`icAZwXqK`dj^S$lT^PP6)9}9U4EfFY9wS=pCFafd^@q`(%K~6@CuJ
zurnA{Fnd?}i3FcGxC*ctg4+e~O>p;i^l@O(o~6Wm9K?OKCLroDx+jz`348r~DZbB-
zawM#A4aZ`!c<m6lt0%d4$)ndS4LFMYbe-qK`!$JEv;QaVj{#>3v36bGSV#DVb#CzM
zc&u~dcH4wR541~Pj&qQ0z5SXcZ0x2cjj^elw>!%hNcU3r77l}BX1j;HP~`BC6CHsM
z&8<yy9Oq?Wc28r1j<f@i+nNBv&W;YmIP9L}vG!MbuR!VBImj)@c{zv2K%<1}NuG~{
zGGhy5k-W>LElPpymIFI{G6rZN$wZ<;N~3Vnc^8@vq?1Usg(?kttTb2@>JSa}2Ew7w
z?-EoCDdY<^6zdOj!4ef7ORbPt)+l{1qV!$viw4vm2;|rbpNG)R%3#h^aHp-H91L>o
zQm`tJL#uuA7j9Ui(SV!Q`uV~<>q7aGu-?xno05Gt_$ij5E)Fx)B{DI1?BG&A72t0S
z1G#4@iEdMvh=;=Y%pDFA7~M<?-NK$N4{U8DS6K?lIq;x_8F#zSgzY5f%i6S&b~4`%
z()R8BpzL;1_T`qcuL#k+<m?Q%|H@FuB>t;HaTOP&TpVR<O!xV6w-2Cj^VOlwgu(Xs
zP)T%e(}r*Y$RC(AbB!68$AQffYv^2rnn5d&MYQfWb0C;$Ce|R*tk9w`TN2<O!i<W@
zLE9@NnddC;B1Ry(UO>4Jj7S-yojlbMVqTCRp4r#+y3=P}j2>@nHmoZGpgU9tx$t5J
zYE4f-j+V&+O(mR1tYZ5jz|&$<Zhx3^mo(0&Pq|Bd!jK7B=1;Ih@evoLFHZ3C5YY&Q
z4p`b<5y}zzS!ri5ZRce$pypLgfFYr*4$yjF5eKy<Oe!KZxFD0z*M*wk^sjF->*NN2
zq!c6NE)F-TGT;(BB!~+YzZ<Ri-4w{%7i4(}fD4mRcxp9$ft9<RA#wqU!9lAe)<{Oa
z7z7e~!Zfug+&EF(8>X8+(#_&9-Smg>90(dt){-dQERE95GK*x=jZZ|+jf8xOB(#?H
zqe5U8n4Bz?u8)$>hQ{Ih^7LYV_#y}|@#{(SQXd-<-Dm|Cv9T#E4u+!QpgGkU&JL6l
zd6`}!pdKq8JT=FXSTUWJz#PNd^~f_YyLhvP7bJk8x-dYEW>=KpIxWF<h0;Mq*n<h=
z7EG?dM(PQ4i$%d$jiLm5E2JCsS(RmRm`D}IehSznmJOB;0gsSWR+3UhxG1c-EDtll
zfImL4%nBa}u}xO`fFm!hs?(s_Ma`rXZ34(Cf9^%bK)(r#9LTA#DzGlh3F`wPxFMvE
zLrTq3r`ZvyO3i_@Q&p5bhFFt=ao7sR%>h!$_glhzztz$w6q$gkSZsS(0$&!A^1_ol
zf;LrPUrqsXMOc9BY%(;(;+2-?t_n3PyuB-GhQJ!*NUpX^${tVRVsqK`V4q6zYpf){
zHjw1kT?W$m(PJ#7wFXlG6m3o0?l5kZ2^Ly*fl#-sa8{-YF)B!Wv1MS<4wOyFJxi3C
z0v#Rl+?p87H_RsaqNC69V}zN0MZokcgNcADU>Vk^^@DzjRqI!U8F#e+3$=bt7#AeV
zwPEUoE?}1?=0SvOl)`S70QdEtK!6JqU*hwRP&N+wEB|Z^5vSyA3RpN~K(OOs68~ln
z$=VBB8i^mh!wnr35HKA`-rGYR2^Tn*)92>=Dx98)*uUa?A2Iw$$@o7!UYg1epQvZ2
z$42Y9;fZ`@IzPE-DqG8%@NjWDH(4Le4^I}S>od;T%a2xyC-ar+aCtIYE0iiz!&B9%
z;bJ*^4pnVe+3M7$vHWztQp}x0t)by;B{z=C)Q;^wv}od-s@g8=*>Z9Cx%GRYs-7!i
zhy1|_u;*T_33}{s&jCkvn9|>H8PQs0(s9a_;&g3dXq;43oy?AC2=kl)CJ}+x-cmqj
zG=H*~%WH|+>2kiR!Eo|KY2<i5S2L|l*EUT~?%0kP_OGhwbF!41$k?jbmz<RbD9WX3
zamFtM5mh~1EtsxM^O<QI2c6rz%1Et}H_#PFD+)q2e<D*TPMYMYdM!U=GIHbjQ4LN`
z7OMv0T5&30IZ@BoO@#?2XsPjvWctl=C>qI?>r>gPiIjuJrl$N+a9Crt?8sz(Q)u*4
zQ`&$XLA^LSRy073=CXiL^Vwu(WKtuTE{jw+xClihU(l>_wl=PzsnTfO4mwwwDo^HX
z#nQCqoyr!?X!A4WQpJR|Mmbx_8ldXgTrOWFo-t2~+YCfO&h(I<WT!Yy<#&Z*BlR&P
zVy=(Zr^+Zjk|)r}Aef{1G9tjliF&D))nK_&I&Mc?9S12waA{8ER5foPDOFEo0&G`u
z^-T5jbj~!8uK@j<LZ!2{(o`|GX|gnJU=i$1R_a>eRH-r%nqV`(7)QNW(h?d#%E)9u
ztDHa!C@3z2|KtuyF6TqhiTr6z&sM9YTqawoWKBZl6bBI|iCo2!U@lwEjua=0HB+`)
z%bIy96!TMAA`Vi&k{vD1YznA+syJ53*76xlfhF*%yGql3m_r8g>%j7eW!BnwC7&J5
z6sHSjxFiqh3?+d|A|!LXSU|s=d-82@Y&vU*&kuw2YM}W{v6KOwl<L#9qTm|{spPAr
zdPU>}kf=2_jpl{O$<29`pE9I?TmuOjoW?K$M#_y<O7*g>NJN{d&KIOV#WIFQDlL&}
zFaRsJaw4~Cm8^i#>NtgRwKzrALZJ}D7zzUdjc^klHBC=tPGu+ZbpvXM`zi1ge{GI4
zI+fj&t<@?<A~A{ygRCR@0qklHx%o;U7Fc4mSb>!ES<;uFfUabixp0d3&^9K5+Qm}9
zvly-BV`<K41XO~^rfS)MQ=J&87fg#*@?chor>Sv6!Hi%^rb^R7(~$UVZ>$>1J~36y
zRPz;z|IEqFThJ>yV!e7UQz{fDOIahfiqlrORBNM{bcN4J-08IX`_k^O$6{WxZP;sb
z@d2&aYR`46yP%`>AJf$Jns$n5i%i;DO*_rBg(hu{rrpJ~u47(X+f80_wYPZKbCYSW
zBRS}~S9uE&Y-Mnz7l)PRwjDgTa=iz=c-xlbP&%DXuG*Na)smap^H8(Y1?QdG)3k-o
z=aAa<9LhFt_qnvNsA+G_TL`DFzLc1xrP+MM9ZlP94sY|+<}Eazq3))=J(sf0VF-^n
zpq=Jr&p)+!Z_P*X!ls`8*v=o`zNT~BoR6DhvN^3UZrX117Mjy!a~Q&9H~VsDuxW2g
zo271pgc=sP<;5WP;+wqK7_P~hL>;%cStYl<S?Z2J*ln?l%jO%!;`SgdVDRRsIR6QK
zE-f@Cz_w;%b;IqRZ4}MN))a@$@g2hK*#v~N>QCtK><Mi?oDeWWcJbO3%u~>7c-%p1
zbK*QZD+HKp-hu$@k7hP`Zfyo)a~^I=$N_npQSWWiV9<#vw695_prv5_4=P@`v@;-M
z3&8TTXV3iefX1Jmpsqo|H316tUcyCstLFrTl1(ZGD3}XXKJ2sSnL}$7Bh7_S2#A0@
z!-VLIrsnnCutW`7I2$3lbFx(n6xZJ5khd=FiEg>di(xC>Z6$Y|VZ?4L#m-p@w6-ns
z;%M7Ry7*MX96hx)<>NVJ-5jk5ytAfY&Qbf*<x|2O7;3ImHBW_*Y69J05(<4%@ihxT
zk!yYKni^34j1$5{0GCMTGa*_~b*2K%p>2-g=H%79Y<S)9;cd1S%#}908zcwZEJ)AE
zKW7@3kf1?nv;O_GIp+4$ui=EzhDu_N+LCS$-~hR<PfozzN+;sps-*kx)5pB_<WS;H
zuRG~}r~9DSGU#nulQ{0Rx{p=TOm_czK@GJMP*2)+<Ccb%Ht20|7wuvz-h$+-Ja>22
ziyiTtA8Rts*%Bchhbug4V*X5j%xi5!(d0qN{a6oO=k0K3{Ajz*pQm%!I(MI&=X-uU
z?h%*rY~Mn$oP#%S41OQuAYqXT{1<Q)7}o<*5DB}C;fu~xt<xyv0foP0mJ69arbbsY
z{4k~)cp>xCqxtFF=?t7_WqLEwtH}(xt~62I7bdry$9_o0xMGlR{V8<v_@48*y{#b!
zQp6qF;E~j=8|^si%QXJ2%G8j!x5D1ru(QPuUYiI!M^V2z{B2I6KkSwHqC>CD>Ex~?
z7W6gAblO{zbbq5|2=1BB&Kye?(&-w~T9fW?wmj&?k+zFzwoofrm1$nzIHW@wKA6qS
zz8@vx$)8Uw1KWQlmQM7e)MxHVdus;0ey9a2JaGPI6i=pyAT`!|$*Vng*z}cjPv38X
zUK%UngWlyRxiRg*Ym`jF%`<3omnG}s^jVf%gP!8<|6xz=TkqM0Q4j(*>AvzoTR4_<
zFZlwNkH=bS-V!Xhu|r<#N?pXiH-nam0>Hctbvd~ETQF!2?q7oehttMnY;QGV`@W7X
zzETG^<Z)nba<%PzRq`Q>lkmeQWe4i5PQG1Iht1eFN5(cIWBRO&>C^t0V#zOJW^x7F
zGM0tkaUO@zgQln|#GUB9?M{T_$-^8BrtZ(s^^yUvbv3RSWor_v0R}mM;r+ttgKUaJ
z{?lYSc~CMBBDzyE$7P(~#36Lf;m_U+{bUs<uzk>5H0-sn^p@@O@YNWi|49M$PeY)-
z9-x-Ppl*FI4C&{cp>Xt5_Y(3q$utP$fazyv!Su}l;HH@h@H&O}jx&J!9T^k4xObN~
zsNTa(n6xxzP4V%ThQ3|*?}NUZW_s(6du=N{Z<W`!!fRRUB`h`FXPfet+(5EgveQer
z_uX|cN#4RR{d`OSQ7@TZ{7ry_gv?2Ab^pbyA>;p@_8IU2Oe-3jGYxanRzn%^!JR`P
zf_XYhFqcGTp$YkX#+#FTehXtT<nu{zYm|JDsk3oFXXA1(fF+)u2IA==>z=Zl8%v&r
zbYQ<K$F?N535CA?-XWpTA37ps=Hf&M7hfW*PP!cr3JGr&`u)Vc1k-gl%aAxTkQx1u
z88c9S9`oXdrK7LkqaFQROgdW7D9!?|Pr5U{AcKaq;C>I}0R2g7EL$smzEk>)x!=N+
zz)f91Pj}g#K5@@38Peypr@4mYElavf@0ZrTd5@0Z|2h5;*s%<<=jP<DL>E=H35XkL
zYW<K#?(&0PdW{Dk`6b}@)n0m&7avSq<SlUDeK(t0;Xdm^lCMtmdduCXo%=zB?-WGG
z+<~Wns)+(Am?R20H274*oV>xH>fg^ifbg8GYnYQynh|{{=8wosirZC#miY6ASN{-T
zinxCAZl68EX<o~?7w0s0yU)BvC-4{J&x2A(19A85gv$Nf*skQz{X@c?*op{)^9vT7
zKMBAIr-i`zpaJKPo)0*C1)OichTuFFZve+GY5NS0{uw<8j^6MZA4lOdFFD2q$gbWG
z2)16!wlU-%o*6t6;Q}SXj|w!u2WSG}wb88>%mTQZeJIf+-D#g0K|dQG2mS1kh0B8c
zc?<Hd17ssB!)ad2NiV){5|nsShQuOq=nVJ!eN&E1`m}>yem?df*`Uq+ySonpq+R4O
zFv7#`F#@&==F70xwaRk`gbjZAG>4z&+6c`BY|!d{<8D@2?Y_%Rn>dSfFz&fqteA~M
zf;sMA-op*0N6iF08Hc2$PVtAY+2!>=3`o;n3aU?w$Y`a`58X}bbX^kf+Ci@u`T~}c
zL2nDnv_Ppy1WE<Ox}dz<ecV*~^Rre;y5qh~T9b4K?)Q46hc#|_2tkCY6kK%7i`4=C
z-#7)u)iV)X{fc`KxbpgM_7(wA%LP#n38MPl@53M@mcC@L^bv!lFNr+qa1oz{r4QVT
z_IxaTDJEEQ-4ETf%WElm@k4_`iU0G}%C}D@gl`wkEqJ|)l67H>N2F8N{krQ@0E9jS
z@j{isD)-;YQtscoyL8aI%$PqL8S`f?ee{DqIBcblf1BatFLmDtb<xnrN6pB8*Npt5
zX5@&^8u|A@A8y<G4SoE*9r;h{$XngNkAZ&NpSfq3GUNX>D0tJkqu?ong3kl~CGI!S
zgNycjy&mZ3COUwR0dJY&<HJ&=)%~Cc;M{jWwS^vGkn>MYO)27+@7`rrkp)Tj84v`}
zvTQ9#`f+cG>bdP}nHFffy~(?wA)ql)NG7d9l6=InOiEw@Q(!?D!j+<k3=M(bdOxUf
z!9j0X+lRdNH6kKb3sHRHF0)2LMM=3G$GnYhogyIZdDyz`Sm`Ys=Cx&wms;g5Mlv^u
z7eIaG*6~urVN~=aFIw$&4XpNh2D~mL^<X<$qL-dAio&Z0ytUh8P-w=b9kbkPU&VHl
zs|LNb12!uOzv?ozQJ%ev1QT<A-s6yV!K7+)TOT(BaIF#0SMKuG(4HFdHbc(=3IeW&
z$rE#b&naMue(K%=cfJ7xrVonMg2CP1qRrldm0sIr@KqAilyGjxE==PoV3balw;=`2
z85HLpxtqiWx!Z+>Bl#XG_B|U`do9FZ*9M>gH?%MD9`4z94Qw&FjA{A~++jX-?eKaO
zYg(NJfKHpoyELc8u~BtU{uPD}qMsd76B7_$1wh^g9VP88$MmIFcw1o;-QmUGfRr`K
z_mcG7Pu*qpmn)O*XEE=~29e(Geo`=-bibN_9k*75(zB<IfwSL}O0N=`^e$narS3Np
zDx==@YR-l0{-oy<quVFq@j>kW|BU;|du=+^o9{WCEV$x?C~14HBO#`N>Oo7`DJpk>
zbph`I{Zf{G7d#zryOp!B4QoRRrIMHh@P{sjsP_;ulPA5{aNLDwD+R+p?(junFZr(g
z<E#yivasXpxjLW%=Z$gnG;>9r#X}Sv%JaQ6nKSr{Olz~8QF?Bv@c`sprNwpS;5AI4
zvo)(@i3F9Jk6{&~a^C?Gbia5v1O%4!-B!ZJlWzniLY70%@>(wg`$OPB3e5jCPB`4t
zk6TD$SPXDLnvm>uKMf1K7xv(8UX$)`!NK3T7m}L(m}^lC0&IbJG`1$!ARji96vu`P
zi~j|@2pjf#@vF6D626`FS9`J5U`}vtH<+>Q#}V#Lx_^654ds8E&2RO3-H+4XfZm1}
zZFiqVAbtxl0==qe89(_GNyvhyz?Yvj0l@S$_!Krz@&WYN14(S#|BW-Y{|MGz+kU}s
z|0lU=&-UHcr%Vt%xUFBXeZ-TH1#3hW{5xEZ|0!j`8MylFC)S%e!CwSf5cb7}T*QWn
zLqeemvr~8kq6D7o*|iMQw}+YjO2hQ;5vJdjX!kmk?w>2uU$o9!H3*pigB^NkySLf>
z%e#lXE1{hu4Ll@?E)t=)QVL)x;$6vKU7lE%sCikIO@U>(w#DQm7d8^fX??Gx5CL<?
zZYKMo0VH<*82IV~!qn~`gR2Hms}p5<-6z4i!sbvURv`X#B=>{&rX_s<>EKaR7#3Y%
zDcc`I``7^MX}bx`+?m`8SF8IdIGBQik^qXz3a`)orgP9+f&La?K%Fe}a7bE6nO-<s
z4hHRV7q=biYg->R7*^$~4!sB6K|Tb@5GG4@d5hbQCx?)pbpHSgIy<M-60jG$ABMWV
zQCmm=OFdVi|KElFOgVMHYu{{3E^$AGlF-Q5mnj+Jvn(AD*xVt91+xWmJne0vGRrfF
z7<!OHV=$g1#-V2Q0ppmLcnor4H{P!ocmDqQ=?oX((T{U~s=;#Yb9xxURthisXBQCX
zvEOAov=3Z7r{`MctSsyuI(jSHRN?J0%%A^&2Es-fgtn<rBRKqv9W#_LJ6eGlnL{H%
zRV$v*bY$NOal4D;pI2|Tt%h>uX@USab86TqRY><Yv=9z9z7X*RB`XKuVrQyxoH-t(
z4mRGRJ6Sl+OyKd52M>XxEho_%7LLneP`CSdc2}5(;VzsoSdY|GRKk}-fv1TRPYyGh
zgle>Ov)6Ksm!PJiu6a5(mnUE64eaoi!Eue!n;}+k$JKFvnB<A%8Tb{GyHIc-`E4oE
z0><33#aq6KK9Wn&7^+=F^#|456L#T;3Fh|P?=4>is~m?u7Qzl&>2^Iy6#(|5`;mLU
z;jI|JP6G2k19=5$xNrr^cuTfXuC;82-S!UHCoDgZ{F>kM!d2o<8i47Y8uXT~v8}Z5
zsLDbN5YU*+xVtDV^<iLt*5TgRmuKk2d{0yKyv}REu01RrxAh<g2WxTZptsdMeb5`&
z#EeS^WmBKZ3*5oeXz0^|mzBw{dhuazB}ND&yfM*+1K=ON_ZTd)<?fdps9V?y#P;6`
zZ}TcP(}Koe24YxSlD{V{Le{Q;^8#J(he26`G6;9rVZkf1aCW5w`Whr{KY)kUhgItt
zi~yCLp8ybd5{R_7GWn<MU!l<J8v412kEK9Xzgs-$Exg)W3fvBQoo-j!+d3@WZ%Mk9
zf;X_z+cHQhNTKqwHJ(SqdCC1jcMrfKKYk2ITw6e|ua{oa$rOC(uk+$pc`JrxWq_NA
z8w4EQ<;hP7P3$4MW65#i-+_YKcI#T}ssDW}kJRRSx!!yYzM}LxuWuE$EE0X_?Q8HH
z_d;=fA8b&pSAnO6Q&2;J|KS`Hi}`cmX5Ip4+m>~hg}D1?(m>k%dH5x_3`)}1;Jod{
z9KR1qT!5L{2A4Vbgx*ir{c_y8(zyKk?%M?5b9_|+YRE_KeUQ$}7O2%}ZxN8(4p#$K
zvS9ZXR1PS~RBMy&UED6kLYc;@s4O!;ObvQ{NQFZF8-Xc~uC~{#Qi7rObLXU;ta!wW
zbHj~X+YRNM`_T)NyJd>I(NtoU*L{bVSm7<)=5?>|TCqUGoY=Spqnhv?VhfXQ`oVCO
zg;J%*R#~W3;_kEe92@pJ>xn-1A*}EV+)4TpR=U52P0&8j&$HMfAilnjy^r`s-dgt;
zV>D+(RidTxRIK22xBUc``t8YmM0GcuI4uJJdI%m$N(@XYrPB@)%a<{vwaI71g9U-*
zEf!|#0s(q0E4}m{58lwr(H1auqup;MdM%p3;eQAYcioTOTS&t5@;Lb82{uez0f)ck
zJc-UWB;A8L4_$yM)NpziJV9haY;ML6TYxS}eg#ldCT)bSB>~9AuGQT9L@8|?TGKzj
z<|zyn)zH(rB!maNVSpFyCpKFE0eIa)OPWo(*F71K{vSX94zKf;Z}A2%^@c$dgTesc
zg8!!18+0FqKc^3SRd0bZyMWtU9q{qd<>R_PbbWz~VYbufw(uaJ!C8lG-txTy$5p7@
z>pl$ixbx<@CNklE7gll%CbK*3w+O64go~co-S$R|Z(A^x$pM*;waG7}1>5ear|ekQ
zC*4lCl7R4wu~d*IuC^$R%rW=kbWWFHb7QDB1TT|&;z?q-Z=;u92{d?%F7?u@7--q*
zL3zFyEDNtA1SyUKKshw+Cck24gB!_?`!5hP18o^f<t1*<gOI}~hN!z^?cf44-ej@C
z%b1toA)6JH^?1}Kg>{8$D$aVfK1iB{uwG@ByngI{uk==Bg#TQut`v50ERNt($kDc!
zp<hq|cD;L!q3i09tbf||&1dX-CA%J2<8>dBwx!FJvJ;_Q-qobbH^q)&x(@-uuH;&8
zC%K9w&NV;z8apFkdJN-YWKv%6-h-J0li~TH9_(@qa^whiZR2)vYO^=EN*t`6*u23i
z+q;5k>jvR-rsUb?t$?V*+{kr<iZivEa4xPL8y!R5AUqk^Y{lBwzRBCO$7_ctd9`T#
zOVb|k1--r(CIE?KIktBn2XBIX5Wyxg7!?SmQy9zn7H{=tZ~aP<7pv&?2I+6|y7qdh
z72f(mn+$=n7+jY?a}c)6o{ILwQ#G;G@fH{mpAts{zl#1m91Sm^0bzCP7t9i9a8anC
zBO2>-P~`1dFrYW2gNKx0sPYkAIebVAm7)j3nxB+Iu~|wyCUsUC%K279U`qtPhvIY=
zk1C$Tv#A*cTeNZi^clOckNP1TJUWU<pt9Rut%lwe*3kdXp^82RPJ}Rco9Aw}p78ZJ
zEycxqJ(v}H7uX2GG6gprcY+o^p6G!_@@KJwSSGf(k71c*{99OdyCCu&zh}t1bU*z6
zsJ<h4y|*25WmRGk#5(){QsQr%G#b4WoQp*m{)2d1hO*%8ST4HVKQYbxSLj+$&2i4@
z(p3P35`*4+Xo|1%77r#;aI3t-9YT8>+;3vhxdOdi1Oa#n?iYgtFIg!?9)pvm3o7zo
zV`*7n8%e$$g;sLBxGzf{LcekM&2g5Dx&Qc@g8=JFZW`Y-8!sDx7wW5Ee+*%Fa-A$5
z(5ZN+B|uR-6{3aEHlX{?!fi`(2C@VV9OQtL?pJUMiirCFj&=09KPzb6;r^9qFR(BK
zA1U|S+yvy-2cULmp0pE%`M?PpJY94QofXgC*+%W_l{h;L`(>lI1N&AGkAm7YK*@GN
z68Eaip2&7Am0$3-LAQ`HeL(+4EdMJxEgKcd&kBe!_x<-2;vOUz3_<?*p#gcxy_1+(
z(XrCO*Hj}vd5t+zuIU))ejHzDo$vfLk>2s$0u#TsV<7$Z*hBHh-FJga&FkAkW#=l_
z2yfZcnQJ^R<tu_-!cTL0e~CU`q7P!=CH{DcKbozFXOj;#WuO1B^z$Db{<F=`OZoFF
z-(RAi`Ni)`^!wuC_eY(+Xa0k)Kj%x|KkD<d{Q}QVuW8TTXz%maXcu4TeqZSJ&zCOF
zxBhd*U*o)N&}o@9FXs!_|KICdI{c4nucZxLSoj<LV{42f@4AkG&Ge5woOs-OH_nLI
zahvMSbEShuzhGm(8^sHUuTwPi+ep{8p1oUmw!<sWpI_g7L?Ca38}Cw<pB?{36Subn
z{OJ6loxL)CwDV~4@s@Yv4Sf8at-Z75H}>}}Gw$nOp#IKxe2sYjhM^Z9?}lC)%iVX5
z<sJ+0AECd-_Rh86I~&_GbkW$}v2!f9d=5HmY_G$#cQ!xs50tDNpWo(y?}0}6=D_p!
z8rz$r+}F-=KIVe2k&dr3@XbZXjrd8=fuF{9`7wL`Zs-`e)#pd=vE(~akGH-X?*nZt
z|0?XH@fU#u<t+y{!tt~gcVwRY-GJHq0T!=~^Vxy=;r))r_Mbe*_OCGGJR2NV?l!{F
z*zb6_-_Slsqdc|psu7R(1@zWb4mOtOmu~r+OKzSGPdA6hAA+}WT${BU@=N;dXPB>#
znQ~{7OP>kaQ+Z?fZ!SDFrrUTUKDq<`YKlKw&vft8abvn2Z)3Vyj%Mw*HI^gZ`D;w?
z)@1!`u?h2L>9A2AZ4Z@U@H=L{!I!U!@MX)-rrz21c>B9e$BlUTo@pmSCn5f9EYBkm
z{GBU5f5PDXZ17upI~)9s^!EcJ{~OzHEZ1w`K3lnm5;{JgPUn#SR$lw<8M$uxS6gwM
zr%k}>H;r(8uW|h{?KI;3fwRzWW4jigK74bG<L<`!G5t5vS4i&9rmxm_`4mPnJCpq7
zC(-%y;hJMTJl0rl4)`rz&L)5PW#nf4HsYDz>E&-Oe%LoXS}7Gr(;Ied+p&G?md)vr
zY&AccE={K^+b+NS@+-EEUYyQN;yV;+em(-PxK3}`JhXXeM|#6}tyZpHIXs-z7KX-3
zrLjr-vTz)p8LpK|lezJ1ae8=i^5oPez8oHJ$xd(1jcmylMn^X9*gU#p$CjPhomXtT
zJUg=EiXA(0h3(nV!q#m7Wy_9>ow?2(@w*lBJ%e-j4uv^z&lBkmfT=hW1$<UO4*2jx
z2$|8!$&9>E-I>l#A$=78Gue8r<YcY^{LTn3c%iq0cj@QRMwyW!-kXhs{3r3Yc8A|E
zaFA0u?M&xqP@sasJSmeI$D7%miE6$kQBC71Ag7|&>?wH<zEe7dZ)!O8X}((>sIQLW
zE&fh@%MOQMh{)KZHkle;7=Ox-`Uijf01DLeCjm*ORIWPsN&;R}Zc@<F*hwdo*>~i~
zzE@^$J8;MT%+Xigx<8Wv;3vy+$rMLt@WTHB|0eU(GOUbg4~1kLHqQ1Zc+d$iho8)Y
zUi6y|(l4Mtg|kke7h*h<(Z>Za(CIM%=*O$o;$3+p*gM~O@6>rkBHzDW9KpvOa1^Oj
z$!l{yej@GGXEkiv)f-+}o~=*TGV(@u%ztrm6d#+AhalvnR)BT3deh-+4rUJBrnotD
z_|X1_l>J8|3AZVdY<szSg%pyR%AUq6{P7BX2X7=B$=KxSD(Itz^JNo&z`@4^CP0(L
zS}{AxIGC`^JE_S+2z=)8K>+X^s)9JH<!nyrO$SgN#gh{3N3NJ`Jw`?Z@`M*=X9NhZ
zjAWE_@lyE7QU!^bN^xu))HITr%opU&SJOM_WjtFQcknWMr&=Gut*RKqsH9e@gu=W`
zOgn|i>{t~8D1mOWV3~?DP7H$h3&j~{GJBfffF(wXHM~CG$z>-eN3!@_g78G4KAmG7
zd{TntYNfK)K!5d$9F!vyl20=^G-|?*B$x)LE18jc^)&Lb8Iwdn@NE%xC6rjn%Piny
z4i1SDX^Kix9@;8Rfu%<?{M5lD1~Qrl*d*I#v|A_usgrm!K5p{81w69i7<m|~6(Q03
zj_vX^jq*63tC4rjfut!la0LO>tJ$%<Q<e`KpzuUKqk=>}VUm$q!CU<C83)P4cPS=|
zU_BPpFurn-1GUwvz#jyTWN16AgQ}Gilz%1Zw3wsJD&e~fl_?ONgex_<S8y5-UpBxe
zR5FnDRUnK^2kCVxFQihOKAADW`nIi-W#g6lv;r#MchF#dCZEe-gb-uZ`cy`uD97W5
z&Pf}foXpJ1#=PohFof!fD@f8}j)MjQwM_|5WoI-^SwOSvQ%<oYK}|Ig^nzFV<@03=
zl!Vy=`_~)`Ru$7WLiudUYM5nZ7*c7H@}HpywB)Z*CKa-Hcxf~=j!YKc-<Sr6HOoWC
z(|CDe^UQH@8*7#D0giBsOyq3WK@LGsKBN+kn=gullQ6XGWH^Cr0)h;+5<qLZFz{1~
z=BLV_wou_R$c3^dlvEs@jKr(OYSXGrZ&p@5l@r35g@Wa)`20l%pH~U@XWJ1*3Bkd1
zrGs!{J~z@F8fNfIG?Av6NEkCCG7&x~l0MxO8fHN*PFKb<)$GYxt<9A_3(~@ftXs1%
z&UCa-4iAmXq+(5INTf)fg=UtX)nP8%e4d!Dg;hj^xDszXsEs>0d_D(~X6kh2gp)lv
zroyOR9_7bugy|_u$m<TiM>8n_tZYSmr6pH_;#3?_iNdN<fC23)2thDXNI|54VN{Z`
z=~BH0F@Vn)jh2A!T6U`JFd0k@9;F1NCgyPIK~(~&?ILU&WEWG}isg4g$?w)okBV>@
zNA(icF|Oj7Q&=XjkP!1Cy+ZL&emGC-jnpdu0v%z^vLTf^f*oD0P3u)w=jUq#1g>$Y
zl$*$d>-^<K^w|0pqCa4H0dC7VtWS0c@YjRtsUk3w0gn76z>Y7!OhOMwCuno5Ql=7z
znL<>*B_x8J8HzjB$eqqXvp2Yt4+UwVP;eAl@?^$JQ3OY!{X*NxGg)Vwp^;O(;)ShM
znN71Ogv$boQmqC7%7W8*DGw#Q3J95Ux|p9F)gX~qk<Sc4Hka`Uo~lzj3Gppo`O+)a
zYbhn4h|<L=Q!N$n*)T0nO@vy3bK{Yt2X5JaBy;HSk^Q$F-FM`upJL<YgJBtTBP$#2
zBz|EjBZ07Lj!yBNGXB-^Vp^>A`4fhHOn_R1k@}=1GyiM{8j!3#r@(SB9PkIWlFvc`
zNRTW)IR*|djo*duG>MK^oX!w3P&Q@{{Hv+sFxY_Qn#{As4zLOPgcm*ePe~yLg9!9W
z9-IgOkjUCqFvX07l!X;88LP#FKX}Q5<>YJkCIRCNLZbPFCPU(57^Cn2bSoN4e$#>l
z=?y|01Zr~(4T2C1|CUSObeLWhvL(hpIaxXd6h$IX5P?|zted@a4)EzQ(dMMHY0N9v
zVL!F5pSP=)^EoK#&WNf7M1LO4a-vGK0;L*;D(O_Et}V}YsKFVPj#1GiP+k-}n{P(M
zFHkvUr4vfHQ849c<!O9$45sF!Mud__<!fCK74_;kNg_i=q~yT&yF}ng#}bkc*lCY`
zX<$z)OiejcRL@UB3lgG60IySKTxbP%3OdGNOTb`&UBK^^WyZ7;>az%xSd@dRQm*9z
zC{SA-V;liwtEm7$A=kofP+mFNY0$M;-V!=Fg>P5UWuO^|vIW|ku!W{cO<=kys4VDT
zEIVhcP=+d2osa-K1|>Nsi<Md(fMiEU!4#N#NNqw1nwC#_IpdHgPEo$JhFhs@%$W>6
z+2;_|J|!bz+g6MNcU&j*R?OhLenA;TqzvvXqqm|NcM&W(X+DC;P!Th0Y*LBQ_9>Mn
z>hLR=8dxd8^`qcD7-MC@|G4-QMj#Jqs6pJTF9MWAp9Rfz7KS-D?VPCADkuTVOiJQu
zACwpsBLs>7`hsSwRF=umL}3CmMu7!fFx%NlSW?gkN1@_pC!#5QG9P^-5A+G~A~n<n
z0H{E>Oex~Cb1Y%HrZYwD;gf}`2Bu)uVGW?qgdaIXVXStXAC8@ilMg@m6AKG8KF~=K
znk$CR@=_NN`}Q#^jyU=@Z`|mw!SG<J_!EgFOpacw%8BBF5ZMq)Ky3)Vk<&G<cWP(z
z`+#EZ8sKSjZ*?eXav6*y18ilTi6YESz;Mgq>u$e!e+FyF(fyg554?PTH09dEw;VWh
zLp1G%!?TiZKXm=!Be(3o&U}uM+zDh)iLVJx66+bu&{l`agCu+(l4OycGQJLRByhU)
zTanHvJ|rjxlYZz=WJ3lv1gt7u97P^C#DTF;6Q&ooj45KL6k4V~dRVa1)j-HVT}_O2
z3s=aWQ^{Ggc^uXfU%)QzhSO89r?ZoFxHsfew@}2VM&NkMRbcu}(@0|p9Um#ynJ7ad
z&`yPy1%IZN7GMS_V+xFM5-W#stBKN7y@IYVn8QF@c82_dAf^6<Ry8q5T;@BV#VK(Y
z00fEHa`GL>NUs7VpdzqiWsm{^js#>Z047tKaI!QsC^JX$U@%O8s5dNLsMqQh=&!cA
ziTj9XEW`d_nNp1g#bRyedH~I^3Li~z2D6c$$w5h{`XE_mIil;yPER<TqrZ&_85uXD
z8j>{VP2r3nI#q+4LR@v!#WS)-hy((WgkvZsy-918Qm7Lfq0bYasD%nOuF`G)WMRkl
z%qvP2EU;*qUPs)OAvNz9o~D#cihD=X_A!WZMz7Gs!&n-SCL_b0zBtBZ>BXJZA^gTb
z6yrpbl*>!^)p0Zjs4{|XgKWmBBw6Hhtj1*vm7##IB-gN#(OkwH;ajRzeo)mIBnaqC
zF^L_652{$x;5pEcsLsq3QRhrR+z3tJf{Gwp#SZQYKD@rQaj3&csE$v=mkap^7qSlg
z#_S|UUdt$pu?T%&W@x9UOsU%tBB*{B752nY`MnE0_%VF@)4EnsiV`T4G7YbS*pqN0
zn%r;_*ig6>YMJ>Ir~*X*#2;2J3GPDS3>;-p@%a@{$<)u%TI}bz-~}J5h3JAtqq5<2
zP!gIVI*?+vqTgd?1PT<so}4L6p)$J(rx*=M(~a63ieQPFgkQx%Zxw4(0_g^F%qPlF
ze+iY9Z2iot(uabs;rt9(6-zW-p^8WcD^j%%5l1&a4NBDygyA$O!W_#XS9^TI)-3yU
z?MbwnfvX*>n2BIrh7{s*Z4yqwAxPQGs>PrcC`|m~vPsr3#J9wSa^Zf3hsZD~6$)J>
zjWPluS1FygOFL9F8<y@&x`f45EWQD5zR)$UO>pPM>IP6U6bW$pLYBhIOaCx76$CRj
zg5=sbw@rvHSkR^neZp8$ahovrz+1ePYUVT?e0FKimCEqw+nB-JNFJX&;f@8-NS!(C
zW8SJUXd9vfNtP%s5@L^4{cJMO4#Ppdpq!DBb2ZD1G68!6CsYT-9Upmz;)?*`=N)K=
zHv|D$4RKeU4gp!h>nsm7;RIC@T%oQ~wWZpMMF-z#HaF_4nt;&lw;g%e?T3%<b8a|t
zs|Id8a!>;bp$OlJ6R3?Qsb}M+f*66(6YOauGXg~)hW`|Z_5{TY8kS_5-I~lO{3W`b
z!APZgGKds|`phfNswbpC?4U2P9eo{-G4j3Mq_z~80!<<|Ie|*RtTQ5NU<HozlI}8y
zZ9o%}AL)iBEDDa8!YF|qg=uFRgGMts_=?b&e#{t?%uiga6AOeY`x6aK2;D^#RbZ~{
zD8(x@$|D*cH9TT+awqC=YbZU~y*3jQmz7e1Wgi%jq#js2__QyEp*UrdnR9713`{ix
z&qUeKAG{zs&74^csl&lUut14!p;_W7rHewAA6Pr|%ZMR{Py67TKt#Mwcah8+iNpKW
zScLIY*~)adN;qz+1W6}y+OzVD%xwq;4n7C&v6QIs5Ge^v;e5gv&Nl=p<qU86<Dh|M
z2VjgX0Ukst>4cJD19Z3>lN9brlDM<yS0L`#ZfMYu7db=2M7mNl$F7zE9O=_sn@8c6
zz}g_zf`!naG%^RK<zSK;@Q=a)szYG-ZK*Q^8qMSc)+I0<{RLQ21y0Hd0|cN}Xz)p>
z8KE4drd&-o>8em(`2}n;g&*>*I%{}gcq(UToQ*-T!g|GxNV|?X_@+FStw|UK7?W%n
zVJ6@k6WhkAU;&`d06Xi@9*wN@on>^jK_1B-SY}2H8M)H?1=l}xstnCfv&zB>H><12
ze&U<*1VTm3PTc6K;M$C!E?Wrb`h$S1ntqlP!j>Cgh7p2nwTgm}6i^0l%%YwMrw=M|
zrG%y_VY7Ed{SG;>YM>pU`&y+Alg*?U1R#cuJ!9^VGLtPrhD^&Haf3ZIP)rQTVm#sw
zbxDpuAXuoHl~s8qoMJ{Sx(E<OzdTV^6t6snO|$_JNH5H84Pv%NxFm`()v|D*63Hrd
zNLq{;ad`p`FKvJHL}?m=%fzUSaC;i9jGlmS;+7}YqXJbsE`|uvN`$nBf}}08if-<T
zDkF6j@j+Z9d=M4qp|T>(WUP3GFU_e46En>V2+}J%mm?nth?^}^LKay8T0vz{<h-I?
za>N_K&<KtgP;wwhFR=;IC?P{Dw=$C{lyE@`=T6o#WD`vagTcFuo7!cibQf%7qf(fd
zGLut*Uu{fwRN<LGKqnpnmUg(8CQ=9i_4JliEj)7V?U~zNdFWb40@vQS|GFT0&5atS
zYgCjv!G(?K<Y+evprlYw6{5FhM3mV_RIkEdxY>wHor(|y3q_{V9B@NZkR_mB<7@!0
z5NUA#P?G>&VG(9RO0rTMb?^~^u!?ClXA3goN5gIj$d<}Pri}AL(xEB~dRD{NFsNGu
zk$j%~ObeR+Z1@TDI8iccj&;BY=E<1S6!!7Wp%-mZ1QgZRlQ=FR=Rv5=XW{UfJdJ=l
zt>|YdW#|OToI2t7uOG64p_+lP6uuI3Gc#GKJNyF}umoVchyxNS8M=}Dh*%sp1{{gF
zlggMhINMa=XK#);$ryr%1L`_<?HD$438<tFFS@KOU*JmJTJ+n5Ot<;c3xK6cZ>Anj
z222%}%tBQ<f{X(6kc>R>gS$P?g7Y4TLF8p+eFl()5_b%Q0K{oj#CA4hJ^e=-+$u^H
zUAIK4_zY-zNFawKP``w+T_FC1(^GPvngG)}l__4QCV(hZ7h^zgun_X#5BQ;qS(@b_
z5d?(%a3_i4Ms*!GG1hU%SqO}=hEo%HxE4<0m=Nzs<CcR|mjWn>O(2v+K!jQWgD%uF
za;Ss>%#E;QL7l1C9hP~dNOa(302RtmRY{c~i2x_(sO3$TdFS~T+>CP&M_BA(IP3PF
zD3)>~IE-=9dSDQgsP5??oz6ET0`du7M)U%Z;07MiY}_Ey>Ejy#@v;Euv6|<>BQzi|
zsf3mwFPsf*f#H}FAe{v6L1=`PA+C~8QV@rs&Wmw~85-2>9;nTLyavxBJ>6I<BvP2f
zMhnh7soX}J1yO&qfJ#FJap<vx2z1<Kjg&i_Ot`CvLO?}70;<s<ATk8^GNv0hl8@{$
zBRmZy1{+TGsSzp^)9^uIkAY;Q>M3KoT~cQ`{-KfxVBB@`;fj>49VF09Wx4@2s|=+Y
zRRP3;+^iXZB^`XrlT4!iN`omhF#^J$P@Y2!o8r@uk`$VxJEU-N#Z4?{;c7(es%UA2
z;0XjM?Q47}H#x=Hld!UMv%z2t34%KDHXuUfS8<65Ins~7%~UMF=YcX1-Pjn1_l@vM
zo7~$3$HL1czG~4*bn~Io00*R>c>bMflx8{YfQeE|mJh_XV<uU2yC&<h7sRDlmhK5V
zUa<c3sL(mbP@m?e6zC57Dp{kESkj=UyNVq=c%p>R9bI{*D>$SH?WN8;4{Tzgz~&>w
z6YqBMCK*t@vT<?%oE2bX9APk_+EiIN&djiF!$fUW=}sW#dIjSIC<Hsf`GkX2HEz+A
zi%|JdEQ~{&2Iz3o4VR4eOWy-@I_`GE9nSB!Qu&1t;<SN!vHpqjrg3P8@M{ad+AN}<
z_U$+hluQ??+2CLtk2KmIaaIDH0q>Rg_R%#ra5I@IHiY2dlg&D0f&`cWb_SiC%%6s}
zsAAoui&TW&06+ifj10iH6Xg5=PNU>cmIw)SOF4Z(rwb$Xa4%d+(1$2k6nb2sWamN7
z`O3*dp=tJ_%3r>ks}x0};2Mf`5w*-<FjkyYl=9{5X*r`u{fKRD7C3FHc=Kc>Ld_~R
z9B|?kBv!$3LAX&VNTH*ggol<J19U2dN`OFR74$I(Y{~|suJ?-llR!QYWtVV4y{`YN
zS1H+&pt#iO9$`Uz9Td{y2rI}2k}^hE1_&cLIOiqW43u`!ccI&hcE-iWmY{66+O)Xd
zE2o4v;V`uU%1A-$tp~1?L(jN7e)xt^<hD@wmVL)SFt*rH7R!s`i0uLF1r;C*?8pHp
zwX~{abIFEh5Rz2lg(|~BHhDdTkfkpZj{2gy|9O<nY+fN~n+&Bul}5U#BRGABgAIt~
z!SH&{gRv1VkPKv}Mv741@XkhY><aB0R`X}lobfT#1Ok@5CuZ}|`?yXiG(nl#V4=~&
zohtDpjKxS+G_WuZliKBtoB3QX1R;e?1qX6v?J>&-jnYb11P=BDAog%Z5>|wqrIMMX
zghT-qp#`k?^27mV*k?Smc<7#MA%i2Gq;V2KP35bQJV?cC^vfDpw40N>i#{g_s<2gP
zysK(8CCis8PjGCA-X;EFQm{G(Ah9*T^<6`%dTSV7F!T(HwlrIWe?$Bt0ukm9SwYH7
zIBJ$@u8DAQKwuSMJ&d2O+AyTR7-k5m*29PGd&CTP1j%TWP?&zAG0Mu46F!?~ObR+J
z94rTdFbr3YEhs;SSQEZIXmvhz5w)HZ@$w-{k($ZaP%$G2MoG>-PD7|_3QJ#9RI92g
zL&Knzjd$E9Cxl-Zg1mvoXQ;yLK~STs6(Ma;jZ>tW2;0<@qPorjl{pcEZ46ihgkM!N
zp2Ls>2mlZiTl9&IS}m4Iq|jorVOa@nqyR;kGn}ho0w;~#!a#wrN)pH!=int%9+2=C
zf3&D-DB9<_0m4C_2uDa6ikrBT00s$DE`Xh;1&*E2u>=glKtcaivtk;rYbah3gjq#P
z)q5`AD(T1dP<KV7xn(HPSF4lUcc}4bKh!y_tieWZC@!uy$&uk=Mo4YMknTN88~{pk
z<rG)Y=?c5228(k*P#2AsBKtgg_C6~*qo7$74K5rK@RJ~FK$bEL&No+IEn*tW=$4F>
z7gcwJtOx>yIe_&yaCMpXWl54S-8vFLyWG+|aM&EW)6`oI+;D`aIrfR)!p0cE0goGQ
zJnDp#Y)xa!RZBcusX7+6G9+T$3(#3*{L=GewvL6pVhiF9@`hlA;!&=ZKq(*$IV*up
zGZ~>AX@!3PV>7nDv{OCBg@B8Ltg?)e<L$yC**I-!3vlNdYdyS0-0ci8x=$7)=twDg
zNid_tnb3?d1@%r!1;Zh-TV;1qprV1O3?~stNPL?|6(8INzbEwsKQ>AW&W~YtAIf7H
zMj5|CqMJ0%gzUr6#Uck4_1qWEpYaSDW}D~E_~egMo`O@rhG1wTk4e}{1!@d5<cz5a
zL90_PK*2TPY>sLw1SkMB$NF@F<V>2iSuAdmXilG@Z#om1pmwpcI^tYb1)2g3H%Jd8
zQSG-)OvyProO)B=5zc{8*$_SwyIDe$`LS#cr-FI@R1V;ZWF3bB41Y@oEz-;@kIA1I
z@R$r(yXVSlCId<!uqFFkzzI)$S~ngMW6WdWap{<hJO%FtH=K*m#X+ug0@^SX!deNc
zEkJ-GK8;7&7}9fp49W8oOyQ$1On`&SEMBto0Vp`%0K5h?O=Kj~B%o;{a3}FkW4Mw;
zdD>oe4TOjRJhWy~7-9-e<5NAa&zz+5l9`|aVBCgBz$w`Ihpes7;GrUk;CKQ+1!-3S
zGM*kZr$`wF4Ov-!a<p1fw2Ew(93Gqz4=Av#S{K|9^(km_GHa-d5}KhS!C4)88{mv2
z&uLI4DxE1v*9g$4<W-v-0s7#WfOe=RR2|yh2vmCQSCuYW#^Qj(NR9ojXM`c1L4HbU
zjy=!7Vfy&s!2{El1a*ES5n3>fK1h-p&(lckcxi-=6AZ9gLT>O#5!Dr#=hJk<W7fd3
zoMIlL;WK{lvSNwm!$z88o>_tC3kRO@AQ7G|K}etE!O3T{_ZmE1V|}8k2B9xffpxdw
z5EM@=ICY9JK8yxP#AT)_Tk%}obV-il!&O(qb871Kkua@A6BoUL(=9$B#>C}TFMw%i
znZk22%`l84ae?ru1b<gr3=sNeKo&JI2ZRA&N%H|Ya6b<<!Yc@eb8!U3HwJUGREJ^<
zktlMHetmGWJxU^{CX4JDO^RY*lzMX}Ur+JN;(n4C7q73Zo%;M^4HgL<)bIz$^N@_=
zu?skEK-^}eI0}up#P~oR%^MlDhQ}mViehS%+GNi`=v~x#)08uPGFLr?-E+C=)JSC+
zb|{YhFAy`O@^QIaP{h!Nh!R0(8^vAFj73MWf}zOaV&YOlm?<b7@RRW<YZk_s9GTHg
zFv@1~i0p{L!B#2F;Ndr=VcdAkW|B`d8LZ06Bs(CvahzD>VH|nb17rqcz{)qvf@pwk
zk>Kf8;5-JrWArs$Btw}ToGFZ_O{@&&(@Qcza9#sl6da_l#x&716&>8*2t~yugar>%
ziKi-sn#9Klt`_uT%NXuwYDTz=Dj~s)28m=ikXYB?-48&C=Qc!SQfwNyJ2yeMlU5Cr
zCY_ol6<Q3Ae`3AF<0ppBYtZQMXD5cIhLxa6U&i3af=J;=`D!Ru2{oq_nNw=Z8FI^6
zqRLsSDyq@yl<Mk^&DjJ@iKc*zxu&6p+>51b4yXFDgYTTu1EhGs6dS_0o{}pl3%DFL
zc8ltsYQuoPbNNX=2pCQkI)+^V)q++Axm}(?6rpIJo~dA)4iAYJu}<T8SP1|g31GSe
zAA)-gW$UAuQKHWe(S(Fhsa8+nNde$gGw3WVmF$6hKLl(tT$KeWJ9<1CgP_H^dvI4~
ztWF1++4~Z9v2z82=T^Bq$O6-(3bQ}!Z=S>LCWWC_Q7D?S*j7gr#Z+t~K*^0IkzPU*
z3~HDJts&+Pn&C2r-mr<}hY^y+6L+jY(6LUP7$-XtIt#3jzDzcyny3UQA&vS>%%^Yg
zAJ&5j(RP)o<5CK5nxNdS{xC7PGSJlEovSmwtSZ!H4U?Tm9Jll%dge!9E$ab0Y_j6<
zUu@0E%{;JC6kk4-Ym}l4LJ;dhp*F?m7m#MgfyI@Nx5?a?a?bHmy#get!O#5@QQXRt
zb(}MpoXAK3)(+1e05xJ@(A+h9B)ZsOos%b&#kmPAiSwXJTYhXB+x2i|RA5CiAi4q4
z<romOeLfG9;hA^@A(doD%ZLQrLJv=fKp<scE2shnaM(E1Ry0cG6^>LBqSw;TVhL6P
zBU&BX!EqU>OfiiBhExY2DkuEKSe{3cn(SE0t92lUa2-90I|(O;hDJcuV5U<f%R0RD
zxB&*)L4pF#Of3CO0w6GP=m`@|gMcxHW_X?%1q|xsj{d>_kisA`m@!*4Mm5uq5W1PN
zoH+{~YT}wMnkd#uY|7e)o#2EyK^e_OhgK1mG>RlVfI}-v)5UU%W{7m9_$ugvBqv9m
zDIQGbxe}alv(B|qZskx^<Kc_~Gq9}T%?(Zt@CzkN2>Z=^+>eRawe!Pf+Xp%aGH5kQ
z031!PC6cgdjVpvJ_GReaoW@E51qn};>Ix~)h=-H%)MlD8SncElvXn<v(J)o=YFHAW
z%flYXR$xub>GP2ay!Lo*t_Twj({mb3SE0EwE8Un{R3z};5Oe0JK0>M!f#J761{VxL
z+2<W-#rY&<IWrEvBf)Ng!MehsDLD~pa>b`YM6g({z|)^ZdV!v68fG(Q72#HZ_>#=V
zD4^nQ87KhTA$aqK1jG(vNH!xi2`(!dqpIoC<*FixYl86r>N3R+XzgJ~N*vSJ?V@W?
zO%7Wv$T7<wpCl5Z<Ky$%ki7qZ=ZG^*(~)4U7u(g2OFx*-JqSD7&~?a4;4}~}qzX^h
zlJiXhh}E7SfT-gBQ$`<hg-0Hb$Xg{OC=G<j9uKxol|JQ-5(eqonUQ|wQn{|r!BPXH
z-yGyhGu{-Iu-ZwQj@se`6H|uIs#s;sCl52292t{}I`*+Z?0l3LGLhog513`u@QsM@
z6Ajd&MjV!P5D_2w6$KyMYVXxbPMH*Gqu>g5Wct%Gs(Nq<f#pqa3#d()&^(g>+p*3=
z7PRj};lMS6?eI{#wT41TS`^EYtS4r{u`zLJs5you!6F^*5IrhScL+!{6t_!Jkfgdt
zsEojBHb}*JDq}2EvSV0%;lYp)Skm~1x$9+J#pNvIr8thUA;z$ACF^<waS1h(hd9l{
zdJW04Jep?&u!!O?vm6>hpR$^u7da~nB$uXXEs))f*)8i%C>e_h9$=NV(U=^R+5SpA
zvt_3<vvo86w%~6o{<h(7JN_=i-wym;j=w9M0wgl<2c^7h9`mS`x0+C)TrI-qrK>z$
zP#I0Z%Q$$L!hfzDUi<0V7Bq%uM>K?$3Po|6q71E96f-$mtlLA8W_8@gQ>f2os!}kT
z$5Sj&a$zyU!$~OeWoM*JXQsi?sc>X`1Up&~B@-c9aF{5YznBj`6C;bMF)fTCCo^xt
zkae`9L>PvBnmqF%94tA)(A;T*h%?Kz%2Iu@BJh$Lb~HsrQkyWJ4<kiEH>5F`!HaRi
zIe3sp>~oVQa#YyW7=j|6!xdy($|T696;9bGfKp8!)KuQ$ItKqR^irDU(B6O(jso_G
zMlloibxk;KpjHF7h~$`<d9RaX*f7)^EXw)@A~?Ze3c{+8mCq;&ut!f8>7o!<G}cr<
z$}mCKcQ!GEV{9f3%CgPDaSSRB*w&EIl;I|<z{8Fsxm26waZ*Dj5Ph(U_?8|%(IHQ8
zz_5iD1_8-D8VZ)A@Dd?-eYHYH7I{-mGvw(HO|~ugHQ0=)VmgMT<fHVaHH|0`CP$jn
zbiX;jj<jcDH14n&<qycj&A^PMht(d~1VS=peacz)f^@$c(pa)&4p>Ggj{(K7DeI#b
z2SKWeVy$PUjW0MeL7ahwUWM%k^X!<Ja{4-XY=P4z9z?TWe&p~q`!m<=zkc8CHy_0V
zt=t2-;g!y<l6>ot{nz7l39=<}<B`LM4&Q#8$-#rG*W&qC?2g#<61QXJu|U}$;$&kF
zi*$q>GYaTW*&LRIa6w3+E6kIw>i#7!Kn1k#{K`#21)YQ{2JeYf4%(7oU>Zs7aM9Fj
zJfZ~0KlEd@Xo4U_oW5tyHzZ6mnrhSrfT}8O5uPQSf~3x+ilA}v>myd!N0({Pa~#mO
zXa|Bop`Acb&=n<AqgNx4sq*T3Wz1utmS(_khC$#Ag^aQylo6q_Xp-zLg$lt$19^*9
zg7t?>9rw0;Rx@4lMv@o1lL1-jxYGhBw61!x%4*Pe$BCn#X`-7-K#W8QK?1=V1?=)R
zI!UsT&}&aLS8WfoHfjV44)k3OYlkMHAe#ssMB18tEr!X~=jdcW@V@C|SFpw?GT=VO
z#M3b2_8F&8RwZMYiiRbgK0Ws?Z|5?-sdA?<nT5-oP?fg>i9p9jy?7+-p$h9xum^eR
z*Pv7b^UH)YK;-D_2I<=N0mDS#<v|6wV5^#KX@cb|Qo*FaIDkzk&!U4SN}zc;(cv7q
z^_I+${V&4{P4F5!8#!>@%|Yb0+i$yd|Do&r%zd{XJ=~avm!I5z%YLT<tl5Sw&|GF9
zq1g1kYmf3lckKlg_&7TwrZqgq9*QxO?V0+vIdwY9q?$<yy#a%-!2yf&g(n&FMN&I=
z&?sz5;8T+cMF(`sD3=QFsqru5OaMYTqM>6QnWiRIf^&+_JLd#Xj;e4D1x5Kl{n64C
zUsQp&tkC)t=(rNe$xx7p9BnbRO;J2cZfkLZO{$!{#wAy)@J*AdND({O%hXgOC}c&}
z3?+OG3ju0Sy2HXNAhI_ZD;~>Ib2V4O!6T}oehLHJ@if+?M6(r~_ol^(leSYVE&Gc$
zGQ#azY+PuIR#dVXzI*_$grIrBD9*iW2=pl_e(y|xgVh{(#4A2jPQ$l|3>$`KN|l=S
zxy&8gq|_Bsm-eV@Qh2i^S-Yr#RmXIftU89BD4GDGfSIE+QdD=mrJ6~Grv^u>;AVy4
zGmQb`Wg~b)B8+DStM)-{yI<^Fcgw!aH3zOcaAZHo{_vrFH%rRV!&oX`e&E{u61)D$
z;akFS;X-!Lu~1`#DCY3w@F!4*^OS7AiWgx0f9$;tj8<8C9{ABPGt3M#t{LMoo)Eh{
zCgZY=yQ}G%p7Jblil(Zk@KnS1RTa}Uv&2<UA9OKO4K+~RT{A*4ao7lXiBrm=EQ;6^
zYoQ25$U+gakcFaJ3uQ|Yico~IY!*exLJ^xq5gV}<ijcGKd(QKm_uPB#;a<j$BTHRU
zedoQ;dEe*!-gD1Ae^-}-s^C_{pOgV&Sra9X54R$?jQQ+`>U$+Me+?CVqt{V+f17Dc
zWcj>qywd)o<eMUHNJH{pR!w|x%)9ysk|jtkw=`Z_0`3Xu5SFOB@DE0W<8GT!cJi3_
zJw6?WmB;>(52PdRx-~~WavpELyLaF4$n>7Q-`+JQEA4Q(?`=xEcDMJ$^7Qa7*`^A$
zc6_mCyt8|BPrK!beMd&dWskc$OBB(NPJ+Bk$|@omy7R-(vQ$A@PaVvGpKP&}S7p7B
zu7=-B;7@;b(U!b*M~X<h?k8;pP}xlx>6(9e{OX?T*0JgD``YF6K^Do$i7O8BfY)-r
zsLLk%PPH&kyVE~Z@LhK4`v|vC$pnhN%8CbN9!cuU#CN+nwh&&s#6b6A$qECp^AAlO
z&B5bSi`|cb>gIFoP1lw{ZaJMym$^r|KlA{X(7o|FBbkT(lpE1KDs%ep>uLv?3(*N<
z>AmunE?MHE+p=&#-#+AoUs>EYdqfUKlxceTm*84^+H&iCr@d=pVtVhcNq0FhzB|an
z6O&F>V{hRrfRQPz@8r7XRXaE)mgx7izy0QJAHvAqU2ly^<@AVh9bNeFP3cO>sF>^L
zMfAoeyY6JZPFg4(P*eB#5gA;O2J)b50%ZJJGAh9xA`P3o-02*;bUtJUT#;ho`@Tii
zcl(%vxTpA<j3_NR(Ko1Clpu9zh={baV2YB#xa)QajiVlvDzo$w;CsjPk>EhT*h7*x
zEv=Jk;347-+}dP~xjc;Iq!SHZ=DO6cZ0Cw`ba;Hay=yqgld=zeY<g^DZ>5RP_bRd|
zS7Zf(EIXD`>K>I1T*cJMM9iYEO}i%c>~<20`R(yt+JBiI9Ud#-@*Y(7kq3dJ_3OFx
zU=kU3b6mT}_KfVEoR(K5pCVk3N?5Na=(}UP_NJ)n?nrd^PrQ|as`^HiY6`0AK$U6=
zs_NIOR1<91*QPZM)4Sej5ARQXcTA7G^VZ1lu<Z0JXUMJ{(~~2Uqa)*0e(m<ew9+O<
z>hW&QLoKqNyWdIUAm=qDLA*1%C&4;zR>nr)s^A2!3hbSccXqeGGp$_+w|=mkw#eVT
zT35wlctj47YUh2@3bKFqv{anLVp2{ztOV2AsH!QiqG=sdG_6j%_wAjC?+vY9uTPgz
ze=n3#)!mWkx_hClssyR361-7Gkb+8(qDnAOMUa9@kfKWPwJL&2Y`8s^;Bv2o`>34i
z_&!SfzUJz!R?@_aw^*e|m4)6c5{raMalMlh551Gh?6{LE;Hn@+dw72u_vlV>cT$-x
z^7nUASwVUIos{)SE0RWCRsz4f=j}byyT19&@g!~To+=Y6nAUYg(-0I*>z|@&rP56*
z`dpix*L@#JXT)unIr!dtauU1zlsY&X`}nz6z8)TNh|<H_^J^FEowxS9GcAWpsT`h@
zlVfcMjPD)Z<L~ruj_e&7$J4d5`<-2F7g@*V`b|#K#WM1erpLv29~}^huC-eeUFumH
zZn2FAHBrv&<VVwo<u${P5yTIB_0>+iIn&y2&|aCWd6si^(QQG;p@_)>4L_u#ufy<C
z%cwH}Y8lzqQD`XyJs(02!;MtDpLS(+K1#!L6L`WSQ;gA-W~bzx>uv6ynBMpH+hhCC
zB|_)K(CPhSap^@K!`?%X@riE_yLebI8e-`BX+EIOCiBtLKY0I;z5>ddu)O&f5};8J
zR_-k^N?p-IuUbFQS4HWYR%rQ`%^%9kpPu3&Q`F@iv|#dL<MuJ3S|5@#4K+t`DQ^Y(
zsR}=Z;%nT<?hze-()@dOe2?6p!#e1tm*{x86Md)K`^JzrzI)~#qkDJBtEEP?D=YOr
zjBX+>){|3>bPwK<qq>UzM{f6CxNw`^WYj{(I<Z+_m0RxRi94MS%9a3`o6#jiCuOEf
z)n(RQH$|TO{!t0kzval0{*o}g+jJPy7n{7N=#Z@&S&{c{@nl{gXEh^KRNhESUh(ur
zgzr)E`X<#}`oaFxG&S(+KMBc5rXDt{9vs`GmygI1890#D$!h3C_Zk&lN==G=wPI-p
zJJN7%QFQI@$LJcjQH1!rCIaOAlSA_ADVvl|=*{Zbedg(@DY7leqNf!$x-3@F$V2U<
zH9-R!o4CO^)szr8_KHi(EQB6(<t0ZO7oE=1_Dttc2jz8H->?Nf>1w3D=#1^~!?M2p
zbl0vIymw@Bde5F%ZLojG^cyk2CSS97eh2OzSNJ*|=w6oeUeVz|8Jv~jo5PE9JLE2x
zw@ClK7_MFPUVl^Kr|D8YiN2F%wYkbJDe5N)cCt^0jOwv{QzP*VMpRTIp9g`%*FiCG
z$~sa<SwoAjb-_CQ-2QQ1sA2&?9OdRyAK6Wz5#)uN%JML?SvuP?R=}pgy>TicS-)q`
zw2a?5A!N4G4t~XgaDEQT*ag1|ySNBlY+Vz`cuU%ShDx$SVycQJc)A=#))&D7MMXgs
zwKY5C0d_*paTH3I4}03v9}Wb`Kkx-(3Z(UNamQoNjp(`IB%zR@r10yiWg&rn(h^g{
ze&A8pueg(-=4C-4<+-E!P95+d3of%iTBYU4Se4vUNe)X0roqlVx%}LlwgY|y)~ib>
zvH?OfSK8v}!n0{$!8^Y2-f|<!lhURCgO=oy#6m|67mv$lKpb13Rlz77taJu{_-1Qy
zRyGUjIV1-U$ql6o1Hw(9`RGOk<vR(kAEF;|k(J=?<Zl_9)1#kE83m|ob!67tee^)>
zS*uXMNrke4_xF2zO`CEJigj?i%Mwhz`TgCF3%$8TRXRq_kN0~7=`9~!$`Gu~F9_gw
z2J#_SG*nOj@O!^2rv`{NDz1d?<!SW@K_*&~{kqe@o5|BnRt_JM7F340KA3e?-VHNK
zvoOAI|D;Y@X){7B9(5$f(Z^VCWNP<FTW1MeJTy4%p~}F&^n7p+xZ;&d*_@&y?^>DV
zN;(v7b%wtT6)W~)WfRP`d`IWx+zoeJitM45#gy7Zufk*vwthOoJ(|3tR6N=5sV2IM
z%x9S#iM}ZNyBsR<5iY&6!T-J>vOA`D6*`7Ty{%qrd_{3_HjcQvlIk8~?kbM13o~Rx
zlnx&mtz`%YfTiArnK9K9APS}eXu_fZkhl~nWq>Y}igG|NBWk8zVe5Y!{(&4m!LlvF
zV*H^TC8BQ#k^t%$qwG`G8(9k5-zu&bESkO=p&?cc>3C~@kL)t&E@QB`S3-rS5E_O6
z$bI3{fnEST9H@_(0>F!;A3zUh=5D@#xOA{VB3f~`(#uhxff3AI`W8m7+=QS^mbwvt
z%xQ$>-cml&!STN?D<x4nGvFu8b-qziMcm}-?EA7`LSEp|@MwW(WZheu<f)!eD04S4
z;xzdd<u9C)uNbl}Oux>c6D9t1ZZR)H@(6Vg1V&CmWNbpzbZ$;#MjE*Wv5%*|XcSqL
zLap?$E;18SCMH^oQ?D0f_lq1WmWd48eLc2D7Td_XpiYYFc()wfDofPmiZ8_~YsGUR
z=!Gtxnm*#+m~~3my<W;f+j&Q%@lY)XKuh+#Rq6#)nyw@4>dCa6G=s9HOgjm>d;Xv_
zvEf4dKdw`vLg+2)?Jw0pHdHE;+-YL35dq+P5N;<vG*6T@0XVBdwA@>d9JnsaPV_t+
z^tgE~r}qex9s!~IL;Rh0a(YST&-_D3dh7ny;Io}Yr@et<T#2|SL^<a2M$NPZa04Um
z#Y-PaZqO!-@^p6Z-7O0@bP!0@O_jz!m_0TtUjdP~V%falbd(bF(F)7d>9ia;;_o2I
zyRJOD<h4VWTzp>!61=FN<8hMge1^c)8Yd39IaFD@CDl%rJz!`=Z!`H$q9AT|QVtQD
zRz7*ZmSWXcakp<zHa5ttuDtWgff&b*$b6wL<~^n-#vGG-O=tGpESpwK?ZT<+*7Qg>
z%zpsH9r5hGq$7R5BkoEToF10Ld|Ent>sJmh>5-1_>%yUhBhps*r3dP*+i)aVy5VG6
z2dMOBU?afmmhO>}1z26FtP(@FBtv58R}M>(Whv16658?O$K`_n`l*)ze`JM>WNGKF
z^^xqQk=}wHFXZcy0lJRqh<q49ma80GIH{}FU6(?yv?C}>zh&3B{=m|S(tx@(ma<^p
z`}waUIKM-(99$3ml*Umet=+9HPa|D^=4QyH7bT+!?sdd<Z*lX>amX5mG<9zKt~}O#
zdnAIad(#Ex5)JvrM2L;gG8$<~%i=j%Yav_Lw2Y4)l`pr*r)D)+{r;*P=pfw=hb+z>
zl{sKpALt%#?xX}+B&~Ho&q0<lmLGj2xO0#7AXr%|DK)bYYg`_cb*@V9J*7Bg3#cAI
z>&q3e)IePgRs^*sK`SvU8APhAFVc8QD&5eJe+QA>z$fIx4>~TSYqI73@V+grLGE#+
z4Vm;zOV=pWGOF{uG6bp3zCKZ8og)<Wj+Xl~G|TQ@mFZ!bj{l+T!NgdUli7@`id(3n
zgIQ|tnsF&3EvFEK^O3etRoOzwiaXu@;M!tWU|gIhD_-;?V)881N1}fOsU`-h;^8Yf
zQ0#=R*EA;AD2cLE8QmqX?VDUtF90~!<~>>XB;5-?Vn+Utx;S4&EL)QH6J2>}&=oQ6
z>A4__kO;UE30JZS3Z8lcr6z`cRH2!0edq%!SP7;{(inc=_JSXj1z4uR2pZy8Ww%Qq
z{&L+tE;I4+{-`7^`a5Oqx=Nw?vi2FH!O4f9Fl;CRpOl5IAs3twLQLc5wZ-09nIb|B
z1|bBmsM?_lXbhrZ+;7V0*So`erYCl_-RE=sB*KKEI^E(AqGv`)ZI%Y9Fkq{69`>s-
z#b1x0M9#`PGLtF?X%{kTUgl2N9aR$jUS8#Bsw*N_wUyP^<RZr5Q>6)taxcoV&!Qq%
zo)#4KO<4hHCuQZC+*$hhXD91>zeGze+({4m(2-R|Qm86ud+E;8lQTw_e5H_D>&Hf1
zS4GBkw5Eer#J8mb)>3RlKIbWC5Qwy2H+qih>tDDUlh?v=^^%V^?$(`Htvw3|M?X?%
zLSrR8YaNgFv?9GNL*$MbvM0xd@yCD$A=jl4-a7a`1JE>zf_8tfqu3pXIo&<vk}n^e
zT9U(0_3MQ|T!u(tOG(JliqVouWzs(GvF}ZPsLPQ2jzj<Q=iwtCNv}hmfsv2SiNrzk
z8S{F0+U)R|;^Hf{cYJA&9Je#9ji<ElQ3<+{OF6+ywn)0_=WbJ9MjErOoaG^_0_F8X
zS3a|$@mU+^fuzhGvL>Go)UU?6%=c@!O1UJ*VCiXUAL$34boroo7h^gZ$J7-p(-5UV
z>$%p-lR9f5iI*V(oX{m6vR(3ES3VBvE3H33S_Yk@(n>$T4KKShi<RR8Io)3>wo-Ku
zN#mrL0+Q_LP7^KZPRoH|KivJ6j$MDSTdogw{UDC>l#BSL4p@=Ib%;T;DC2Yz)1zG(
z-O$<~&szOFt2=5^nuoGCqZ8xWF~W383=?zd6H?dZ*LFlhP%r>$CEF0CxLj}CO_cj}
zFS^o5z8E$#J^qdi{<o@pwBKIsA+x_OJ|+5iHn<|bOrge5yY!fBlUD?JA;5f@EUnPt
zE(3H?LlMCku)HI1UQVj1D_1RKkZKrqDLbg$YFtINo8pRt7rr%h1nP%|G+eutuTlwT
z7cfty-JB{=szgc6y)zv5X412kHLNn(>0Wr`okN!6`$)Qj)%46G-C^mPQy;e9q~>SX
z_)@6Z7AeXjSMD(VD55*hLHXXF)AR7;*7J9K>x13$ntaq9q@~-*y&!|w)YY}xe$n>(
zdN_m*Nb4sGWme+^c9gqI*C}(p?z=zwe9(~{e<9C14)fq6B=Ydp=ei!P?Z|nToE)Ct
zKR+Sx2s&f?=XcG{zW;3*{`_G6os&mLbl=9Leos`tIUrwMO|d=tBzR};D4BM@-)-vx
zaD6Dqw@}~MamcqeMHRG*Ots4)DKKP`^xHy)I4|wU!B0)tmD9|14_9rdbwiN66zCi7
z=)2Qyxyk6Ry?aN-@CiOlsOJ^@)Oy~3e7~#t)$H6akqv%ga-UxoQ5m_B@$r3r6-K2u
z*F$UK=RR_kib>WdgUqprBd;!!g}`Ndx6Xvggs8kM%Y#eW8|lD1S4OYo&^#F;k-DZw
zX`gWO(<ijcFFX4`^4)69T2J9Oiff*`ue`ZRC)F*G&(66h$U$5uH57S8mfe*)?>al@
zLech4PRj`e>TSi>7g?EC)}?F1uHNpDH2+ee{W~e#Z%)V}A}Lia5TBkLADNcCGY^^7
zo8C1xwr{uWQ5&8f`SzsjN!dLj%Y+MBGLSE;DyHAs|F-O1tM-!(FZ=e(2DXy#{=F0X
z+wFbh%D!js<jDB+$jJ1*c9DMc-F?%qJ4h?8ONt~*Pu6k$idKxW<13ksr0YANPqijj
zlaPsS<dw!&J?kQ?I{H7ZPoI%@+LPZ2k=6{?IJ-N~%Zw>&n5;RMiloyO1N|+jFZ%E5
z+qAp@xoV=Lg0H*!ppQH$=_5zq`vAvQx({Hx#~}L8dSa2BOwVWI@#8Xfq~8n-t&g-q
zA9i=RnXkA9EL-oj5B6dA4LQxnI>u(FNzkaV#>u%oZu=wJMyAj`mi4K9_(NIX?>5s)
z>R43Ly5Js*sH{%=UICt{(#Fa=iLBao{?=)5u?Q~%%Hs}sii6M_{0Hw#cL+}#d7Q|L
zlv||X$kY$78<Cf*Ejk1y&v6}GkON=D%Jn+jWReW6aVwf6OmfD3S6jYv<n;WYQVDgT
zy(lChbR)JO_P-utRuSt`)HHoB)GE`uT#`jCEWE?+Jw<8MN6KCM7;OFHZ1>r#jbf#@
zc1FTt5!Ll`jjqco=i+Mh_xYldw2A6S>&UY5kI^U^`d){C^h*^e|Mz4b+SSe1ouyn-
zNlsbvwQ#8`BU*mPq<mJ{-8M_Qg6QO|KEvgnk%zy3TlXu6<fIH4sMo%OSH`uZz}ad9
zl`;uOMzQ2x)ZZQM_YL<u5K^R%PsWMqLWhZ5uAH@7r8QTl0LtA8wS#}?(&1XG@G%V8
z0Fog;d6(0NhaZOkTqx5*kk}50Y%X}|VQGFFDTaPZO70OQ>5wDIoSi?JBwn7TGXaLm
zZK8>hEcJzXLJnUI2U+Pe{;gf|xthJQXatWJ*>2=|4kP;}WhtoaSRk-}w~EvK&KDQ2
z#~1S6D17koOMLWV@3d~&l=j&*%Msi7lv_~lec#?cRtReHg`WF#k+(+qTOco(J3pD`
zme5V37`%in&(V-JzcjP}Nd#hziOCUJCE~VpA%pyCnutU!(0K~H0*&q)duw`lT%N2<
z`dho+nbvKq1wfyW1yJ)ktV)rsl^DX7cMQ3Zc0xbnB|TFuT<nK&H*2AMy{9`{fJ?q;
z>J0S-TVGH05KjkaV<JnyIHjQWI)xM7SmixpN!OOi$)P$jtNsRka4djggm)+((`ei_
zdU=Y2QCK#V%RS@Ua``fo9Q*3m?2PNaU*Czb#r-iTYnY`p{Kk|RFKiJgd+3Vv;r;Kt
z^POs2UEW^pGchUsF?o@!4AQL?uJ(FY*Mj$F{N!!4+DF%+?;76Kj`lUgDJkshh&?oR
zt^(;z8GA@(h1J|Ku9=nfC@kNPtz0%$n&}I6HQ_E@q+e-ciLLZ5EWM9o!5by6L2jB<
zYp7N&?a#}5y)N~X@h{h*;Jmwf+vJD4%{0s8aEQGV+CQFlpIDe^`@!21EVr$@3rYkU
ztnPXB4ZYKlOR3ztSzbLW`%4-VH=K-Z)PAocFT{!+4w>;gDdS-Jfoj<o87(wb1~=9q
z=d5cm*gfe6rg*pM*uO*ss}6L?3QuMCLakPEHlnURP%j!OtmOJsmIflIiW~+>_=Z5>
zs7wvc`*?_WP!^NPNokJAllX2l;)!{5AL(dJOt;#F;TX5{Kw2Mp%(}x5rH|bjX}2c!
zywlcG0MJIX<Pd<}dt?)H{IZFy_Mp<kBtwImc*%$+4&>43bY)f+X3T#d1@WtnoxES*
zv|hF6xOiyV3ckKhgm%wY4)hO#g^qW4A1MOu0PDD_PFK6Res}7RR@raw8=Ktq%@KWD
z(j0huj~r7F;}hTZb(ng4_sPCM&8NtAa{u^S`w9r}tq+gS%LtL|WRUKOe<9Ecaa2Fb
zcl<r6LcVAVkQ*3sMJjs@<edm*?WfJO{_5PD%Ojly(;n9``JB4moibOTg}{j-g&p9g
zezd;2-T3COW9s;5kQ-5QDt?|wP30NqsbsVlW3@`@Cf}?wD<qXt_jhtgQ3jhNR&GpJ
z28~SCNC)-O?21m}$$+@b_K7K`l94Di(_GVC!!F@E0W3kvSES`!RkxD(4LQeB*Sg3V
zH}YsbB&YQ0K(#+T-LLVHwnjENe;-F=xTEAT2QS-2#71|3>u2(0&i?~ho8`Wc;{x-w
zSm*gQFJ+7P^!H~^%*yH=H@2%O*Y)*+`p>18(MVTrglhGoM`TgCJiio_^sIGHk6+X;
z_nofbFUC>s2+2LFl%kq?M&a|;&Dd6XN7jCiKq))}6HQ(5RH;pm)IwG{R9nEK(!#CI
zDdnQy&Y+7Xbi+b1|9q7Fn0=+08~3WTaoZazZRnH65KpE`EAvb3{6>jNv*49lxwqg-
zBl@H^k|EW(4v*AA7ah1J#w`x53@%YgSu{q`HjPS}R43(e8#OAe=@Z%LOJG{fA~e#~
zb#$q2ghskDyQj;FQuU%oWZ`es)S!Sz`r2lu+7TM*a<@e>S0Xgh4Vy2D$}t>iBd6SK
zirbx0w5sxstdVy)>niWaTFGSyNLSO9Ds0IovQf%vo03mtgCcY5z>3cSSH>QX^nHmX
z>M<N?Yl%sWbm4q4?}{FgMYNE<Xi@ZtEJ|zbi&m*;WLa2HU$iTGMOK>sVO?+0s_Ye6
zX$fSk%3hIGan*4#u*5I2L#gU3PtmC85n1>GObrS+^fT*~(Tm9VMq%kXUN<|Y3wMk0
zD|?l!^j)XgDDo-WNX}<$%qOx5YlMq2i{VH+ES?Q3f{SLA{*isO@-@Sd(TF%g7&0Ps
zq?DnFU(Sxbho~=Du%&-wAH}R9<O<)&R{M3fWVe`SiC@XCxUe_1P5evtRZD<VmW)=!
zC9{;WWVmP<u(F<8u2`W<Jkk$K6^rUI9BKQPny_TCXp?$ImRx;ks}zgImHv^vhUo$*
z<v{^2>65d<B=#y<m6t^p<Ei0QXha-%d2vG=ZXT;hP~{z2+e=Q4Afpj+U`9&ESSlh=
z;TzfVWhG-=<sDf|3tm{eS4?_^Z)D4{j7-Q?-jTIF<kiy8loZ2F{7QDoa;?<7N+n`>
z@!GB;U9E1!D=+z)C{2J{2v%gO@GaU(ql$H1iDAL3XyqEyoL$Kimhr+VH>qXeRe4od
zS*?!l*4VbFP{EK68pP(2Z<JbX{r$*A6e<RdB9F*Ii=xt^=uv6G6<wA&9J9d~AXa>d
ze`K${jZ&VfSqzu7{T*IPk?NaA$pW`^g-PU7vWb_I6;q@^m3&LKg|%p@aoM|ME%hFY
z)>6}gU&)S3+fu8@C$iBgT-SHRs;Z)0g>PibW?r=_8sRGM$l5BqEr%$Ep3#UnY@SvZ
z1r@CmzsOEsEYj(|qJ35;;>pe&7O7sOR$!~1YAlmwwIZ&<)MSyM>=jw*4Ia&37VT2c
z$TCcG7HwiU(zZ!YH|1HhNj)nqF<qLoHSfq;lOW6H+|)(Uu;dfjWaeUv=6R)vNy9)Z
z$a$e6OSM9YA)ce-EN@Da(JFCeru9;~ykd#5G?AAwr3xj6cm^*uFZo8cXvJmTuwrtr
zNK~g9v1*ZMTdxxiMUs+FWK%V3ShUS(L>v`!h((HOg@{4p7f&}9%`1E(+hlsRXk6tT
zSt~a_)Q-85imXc&A_jX?mR^8cKA}rNi;>9cL_F2=izTAGQpA*-#Vp3@1zHhTb$~YO
zS>$Y>9dYv&Lf%9CLXa?9T4a5pUc`s@8Pb)quEIC6O~P>Vur=|ZPRt|qse0D7#PuS*
zh)?ThH1Ap@Nj<ZcZhH1b)>McXWcQVu$t{{iXsnA3lAP%+*`&UattP|Gk`|33SbKf$
z^K{zNmiFBp6d~AvtPY2dUmm4%tbAzdRJSZl->b(6K>qM`tZ5TmWWS_M<sA{eqkw-c
z*zTCdnSoCKO+S~e#&1N%Z$!p#Oq;RDk<WlwXi^wemEH8P9-^<guy~?ss@72JZkE+E
z6RQ!U+z684g~`zZF%Esed26NE__NfiKu&i?Az=!VvpE)ud2nbkwc_+->cdIM)W;?o
zQ@=2qn0j%}F!kY_VG{LZ-Y>OH=k!t?&fG;l+LuprOeYFbv^eP&k@zxB4fLK$(P+Xf
z;)rL)A{g;2&TU!#Afh>MwT|bhiiXub#d#{T@QK8Hl);+DXyVB{iql9@lG2%?$g?~h
z6nSZ43KKgPR(WD4vPvdzBERAsP2}Oz$~hVzPG+_xvMNuhl)SXF$mtP_x*BQpQ=fPq
zB%%tvo5C!H5k|8C8I8aY<`T@h;8)RHMC=vT+SC>28jM-}lKFxtUFx5i35c}9sDByb
z=zfI9!}t*_0mUZ|6kAsgjTcAiqf`_|;)^(KOAm?6pm`J{j)xQme~sH7KgCgT)2JBL
zj_CPPlcAT&o(x+XHM?pVW4-;=%SN8fRQ;-kj-#m64hKiN6$8FSU#Yv%z^%nY3`+yI
zu#1OC!yu!#i@hxWqmqpkqT$sjMp~hx!BUHl=1Yx7JXmUm+Jcng$-z(?+>B!2UQhit
zp(y4wDGgGV?8>8%CGWyWW63WXPmFvjMhqig-U5XY!zkrpSzK{Q&@_@ky@*_&9Myw*
zX8)p*xQI$_7Wd^o-WJ#|P|Du&Kw3ngg<l#-vq;2)Vv$Wc?p5h&16z@|hR2R?v8l_C
zOqI+lMy4#v%AXlhD$(Reib{&<Ku}4cG}IIMvZ>1s^%Nr>kKdS2W(+0@rh14aQqWu}
z53yJPRih*&<8%-tQm}_~c@V_Hs2&_B)zcS@N<_g`Qx!)gEMVRla;H>`GngJ8J5(#h
zEMei>e-tlmVDoSP7Lpc5>8(EJ$@lUol;{mSM$>of$X7!QE0MYCSeMqj1O4PAE58vf
zeC$tda9NLR-#GFggVcta#<E{PzsKny|M|}&2j}G+Gd&iHE0$Z||B>sY${B|GLQq_-
z+&ZQo^*+AfHgD*<YJZ-H68ff7PG7SN9DV71^lZ?e<`1sKM}A;~D;R0w+2W|3UYDw~
z!hUbCV~)lc+_juAFI&Rp$hP8o?T_4%ZmqeGT1Q*old%XrB3*V|=*lbkm2Dd*<nuyu
zT&nDxkVV4c=)0G9Tu)Y;UEO^yu6wB!7q74)`4?6Z-0P{h?qyLJ+!5A##*&;SAsHxJ
z78aM>hZH3?^YQ^t`N}N6#V7}|$f-JV@}qwCN?+{td_aG?oIDfd414K3O0+fg`h<{^
zR<w=aaY8y#=JtHZkrUdTl2h>1TlSl(hHFhebfT1=9OK~6w(%#dxWgJGN7RQ;QXJrb
zSye}_+eO{haTzjouD8QR$Wi~nHMyfShg8>P1^2s-wI}ubGxuSr@x$M92kC?z{g_;p
zbKGQuF*i@knzJxMi|=jf?J7@D9kcBolC1-pdoB_#Uvy8bZnKjUi`_0f$zgv|zP$Iz
zXS$`({03JQ{O2{LUb*ZH;mGlFlC9WLA;$$B>wa{!E4!ZGm#;`mVadrZGIS-kg5;Fn
znCFu!XJ0rTTuFYr&yOv%b{*@UIDWL-+xO-hZw~Buy}ws?J9K-GAL~8w#@E08^}!w8
zU+R@_s~vl<7gfCX_5N4;UwyN;Z*FmM;p8`7drhLC46nX-{J4Cc&$o%M%A4nFi}KY&
z$@-(mUYno)@cmzvx}}-g+dq5g^@B&chx*^_@4orw>%VsJ*9PDC`oTkQ4!-&3?2&<k
z-6K2Rkf^-=<}cyXX(wM}yYbrlC*OZfDwqDtGx^oo)@yUe-#`4?4?d9ibw8MW&3_a3
zSEVUA2w4x+JGLkrUgf|hiHpxny<wyF5+VoemAt57n^B@|hSD0^$HJ9f2L<DuWtE%!
zKHhJb?zQ}QzoDMIBgadBBq!_01|s>;%J+4z?#YAlz2^Dja_fbU(rZ0aJymJRJ|Srx
zf}fmEBZF5T=;74bK<k$U9iOA~W=ii&{S72fhXwf@_Q8cYSK&iXg#w=D?ui<9H%b-P
z0^7fP#2?lo*Sh0UzKrWnPmTM^&ZyX8#XH9SB6geUVR45(YRPsc$(F-i+59F~ZY#Xq
zuwx^;Ca~en-N2pw@`WMYel7|9rtA&$d*8(Co3gW0PCY4E7BrEwAq#y_a+<1~lIlOU
ztD^3sbe%`{m^vw6(~*PFWY6;STheB>4(U&sNGbf0_m03b`iBHmqd-c=(t+4DKECTa
z(-V8XJK}exPBVZ|2M91~*vu(Wl~bVHaYp``s#{p_#Tk9fm7BdJkFfoEd<5ByxVau8
z!?ZKVLd<zQvJaWhRYp!?<-YVO9V28U4DsfI2m=gh)YA+YCM_l7=j8xJ!lvurn285<
zd5+1mMz+u+PB<J$3s<{!dI+=3nCqqg_9?!69n|gGrJ$0(^?e=NOT47(qeEF5w7300
z4=O}gfmsxkbT8tG<L^nt<(suSZKdbmxlgmVPPkSeGzS#)m_9wI-c?jNtX9v<lm3i+
z1y&Dkb@tJ<Xv<?>&(YNrcSFJ9tw^I$2_gZmpCr#^3BrHJTR#`Cr+P~-)aBru%R+Z9
zvj6b;N%>Z;d>C2-b9K;vrZ)LFyKC?K=U|nx9IvSO^7)VQ^>r{$VS~kqj=sAUw%KY!
z6h1R7-Qz;X4UsGu0Q*QjelD|XZu}hg+Pm)Hi#=}_&mS-}-T^NtcQ;S#L4vO5G%ch$
z9*--l^8W7eCrcmy;j|w6>&jmbO7W8Rl0LvUY2&6oWUC!%(mFYN%w72nzM^db;hwXH
z-Usf%q>nwRuQ~#iMove$gh4VxKTYmyqn_qymC)5BeMd+V=EIB4vzueNXO?fB@){%M
zjD52HZV<MEKa@v_=8C?NsVnz_oC+#!w0mOfgZkj&arv;9JND6w^4ON0$?|R^)!5lg
zt0aKqLB_h9q4kk`_)E@ojss$%(uRnwr~6Xa3vN1`s3DEEPX?o}xm7(LfqV=>hPH*x
zuS>aVRga-WyY1axb2;1U@PFHV_i>$#QsY`9SDr4LUpVp-tu+ufJaCvrZkXqX?{mJr
zLcxzq_*WH~g?aywJnUuQvdD`1nrE$0C^D4p79AQbL@V`wk-b~-o2IQu5|oNeh-!4}
zCXuOBDYEeKmd}zZjWS26(~v}j^*Rov%z>vug{}D%ZKCHyVpa4j+9eN>#JWnO$ic?J
zp416Rs)GAozatjfY_>nrG{M_-BBbFz;?MNaL5bGv2XexnlMa2P-H)z}N_?aT703va
zdP(ma)@rDy^6ENRJ5ob$7#y=0)~ecIX2tEKsVOK_+!;lMVx@JJx<F9$50$z|Qdwh*
zDpmEdtWi-P3vuB{cpA%My(#im)rz7<TI8(pGPWq^xXG8F#Gn<8!M?k1{9AI2==lEK
za-PtLeAiUYOMGk3WGlvpN5*!2XJk0R+tLdu>yGW&`>hJq-TTJ&jZaUE?s>aN?QtQQ
zD1?ZZ6fnf1fJqDr*FN+DB;UoHln=DJ^z7A-*-AtZ*xr5q(tGZ1@0Wv8-rBc+?{I<O
z?Xg`hOJF3QEbUBtOkOXg03EYKckkM}dqkq}O>dvYsu<h*_Q`RsmOsvTY=qh6E}f3$
zm0@x;=tvspcXmyDtAI*z4ey$i&!m(+BqNmDE5EgWLVBRSDny8!5xbX3le0mGM<#Z=
zZ`TWH$Ti8B@sW}5>epRcg3I@brI)&UY?qwwESIBuzB$?+-=m`DwVpA$cS1jED!{~d
zCf=3|?npe|)ssixetXYu{l2{Buf%$M*B%$RyV^HCtY1_2UbvVZnQD)TiPSE4N}8PW
zHVJAuu7)v`WJwKZ?^mVax5ubdxJRUAoR#BQ?F9_&nzRhAbI3=D>t(sN?7buMjX>$z
zxxTl5|HXaC+g$pT$B)g2mljbqYketl<L1&emR@5;$oi^a2LQP>586R>VOPI!Ab5?r
z1r*)}{aJw=mvZk_i!vu6@0Dq9eOix#dtXmoaqbTGo?GrH9ciTHG*DRu^Z~lS0Z?zr
z6gd8vTu$>yQBF>e?UAvV(GmIfuX`&!DUosuHkr+?2io<&?%bEOiyn1%!^0;!0SSk?
zYMUn+VPoplE%)%OoMqS`8GtB0Jz7es^T#E)5|uBD$kBCj3gcoJ{wbQ_SyXN8CJ^&p
z733AqFxaO)Igbk3<hjS9D%=t7B?zo#i|LP!%9MtG6ACJ&M`gf^FX_=^5gN(E5P13s
zgooTloS!koy@T`air$^0doE)njfUQeMH_%66CDkaFW2f<a2R=+C!-vX4!HA3-wSGo
zmt<rICIvMl(pPQ&ep4JF(}+m7?T~yXNV|ISaxI6#%XbxYNLr`RWD1gllYCujX~DEk
zxLYnRQk^|?Z+Xl$eJgfr)SRlGoaRn{^CQk~CU^RXhKm?UR=P`>G;2wgNmtSL8zF0F
zvNbF3)kmd~iRVM*Sa#pzR6+We+VPaW%d~uH`gQj!L%;qT2Z-{?zs$2<(HMpwyZ?)w
z2CE*J)V^Yvi1>IiY`2_;{_)|PVchY@JA6|fnxVf{d<@Fh&!hoz-5QLDemo<^$!9mo
z@|R#n3eSj8!fB7Aet<Te8?8FpkdH-qe8}^MpJDLh47yxJ5#KY1^~-fx{VYVW<BA~N
z(21@!aAAa`y4oAA3Q-D!EyW30_rwfyhM1OZG^Z!QgvWavD>v!upS$cgSlGTSQe5uB
z6fDk?8A<7uO#)8~JlG~35%J-uKgGqr)X#96s{L>A^sc|N3eWN%_cklf3~M8uOc#H=
zASTTd&8UwL;6{s~Zyjhsf2@bS8u8fTzla4Vq1OM`UsV!~&i>bVfLSwDcpkmP11(}G
zK5Zh8;^QXrz?KC?_}qzn^#POdl9m7dBPr>6nutKZf9AeAl3{VfU(xGUMI3aUAfMz>
zue7-2=><!WEH?VV<@~xJ+zSlKr(1cwm8WUC7zkt*wkur!vd?$@Y8^M0hc1O%oe{mn
zyAgy!1ZCBU4Ji1CMu6)D{Uu&~8p^%V6I}DNa#5)}13fG~mC+5iN|mct6D!uikkK5J
z!H|`%$fBRGkcCHiXq-O&CPrm%<l}E*$mia|$7A9*@Q+`)*>z18IR4nL+{Gq0eOB>C
z{<Agr@k9{^+C!^RyGHQOW3@3Sl-%4Arjcx&VQIPKOD;QPikMf~g`rgNW6I@*Fe%g*
zu3E*4v%}N!{9}t;7<ShkCmfyk!~YDP>b!Q-?D}-5UO;7=(CoV<e}OBhqy^9k4qbmJ
z5ss%ZI297o5l-7d*MW9ajOIV0o=34$7|60+LVbq1UPyHZg#^syC?vHk-f*Cxjr8<%
z9q@}ge27?K6g&!~L6@=IZDl@b{-9RMq_ceX?9Xp~XB5G>OKr<DtKRUr3{va3YzmV-
ztM1bwggL)kSRJXex<7O)jAj3~?0<8Y(OXK*QgRdsC+7SIUfe^-&+%~?x-18tKRT;x
znU5ax-?9@WXLWQ|K07SaS8krk??KdlD%NF7HP%nVpvjOPH?Q*xfiW@|I#I57Ha-2p
zpv*z(Rtx!+odquc(o7UjY#@xEq&kn~)))K9Kkcy*@=M8OCdD<9vP4+c3CsK#y4G&3
zv@LdREwK##+y*Set-uIz4*+K9imU32pxEk2BUdu`sl2Kg{PJxVo<(R2c<tAQN9ipa
zhDhS3{DFKuRd-fknsItszLP1-adjcSXkcymv|HTn04W|RKUt0`zq9h6Zjq2@(TStd
zBpg2``!ig#v!K0e&#9xK#}0qga!cbus~DoGvBQfp5KUMS3Hi-5OWpL-+-|0_oZv{S
zv|cr?Uu7*uC>vO!5Hgl`Vs2rv>`Jta6M;XNvo7QVNN4K<i?)*-?3LBt<-CXjae46~
zh3eZow=N*WAOsODX%C*RKO8N|VOH5P%dXqx?4Fx)U-&lI5B4kZwCzTUHmOU~rC%Hl
zQ|0A_KDx`4M{AUqAL({6tPetDnEzZ=<l_*%v%7o4)oXh(*UzzQ#_Km`!t*lps#v-F
z7AmYl=<26obziRb5Oi~jYY8NkuBY<S8y_^9y6@Oc_8;>bfRFyA9_~MS%zY{DsC-<@
zEo%7-9x|xfW8?M+W;fcT&$6nmH{q$MGyeJ<tlNt-dr%tEd2M`c`-DID!0mf;jb8I@
z6r~r3X1gjh48KB5)-32omSmfS?MZP@VQ$2%e-Uc3<1%?&DZhwR4oiGIN%HX|N%DYm
zPoVHvEUk{SN}Mj$OczM%9wzC#7dH-+8!hR&NS9mGiu*{a)%+$G7sZ;LE{T17x>8}s
z%8N8>qMqD#^~tC*sSTxE3bmQV{vP`kEM@&Dn)LtWJO$ScK6<$8cLh_=FVNEl>IHi_
zgEG=0Bm!{(t!r)dM+(+9ihl3tkt0VnRKILh;vv1C54D?D-9avGzDUX_RGPxJhD0qc
z^cQPZl}mANLqeWpa`Z|XZ(sO$TSHi&A8q!i+Jx}&wuZ2+;r)|`XHV+dao#!a%h!V|
z)~(~{1?e&$)|(cGJ-9B$A{MB}{i0U9q`m2yd)~CA?xt_KbDr@+?Bv$reVH>(?#8@g
zscm%m*3yN<a$?PY!C$NN*MsYIt@c)ky#_%FPCZM9EPa8c6U-r$S^9ww!Iij-L2MfY
zDLC~k9kNUXmfE<?Ky@LQv`;}iZ4jj3l;bi3A7kl|<t)6`wQA$C4Ao1)q<t0QHG?1p
zryQ4*r9+k*fu%Mst5CfYOxhG51Zegt#Et8`u&y-=Bsk^h-AzooK^H>V<Q{N_w!Za+
z)=HgG52Dl?qSmI^AE4P`h*JjD5pPROY7@{06Nc6(0W&Z<9irAg3-O#mmmyv=s4f91
zafigqfu%#@>ju3%@i>Vu29|LWUp1(Xm{~wJX)xAceJ8NA>sVHydJC?U!n)dOME)lh
z&NGP54ch#Q54;zyM6fP4BqW=d48nS-IZHoO2jDhJ6ZvN>oH>Z|2AzSpY*1aANJutG
z(-l}>YtC{Bs+Zw5N)!3-SUC3}-Z$te#MXMBlm_KQLb8d;7FhQ-XX%0JX1I;gME)TQ
zXB6U?L0yOo2Gx}l3CSjDIt%ON<}9b7dIoNzG?D+Bg>wVqO@r=2d|*&rno{BpiB|(l
zhr|yJsv~Ah$tIcg4A!j;jjPcUm^_8sD6`1lYvJ@k+-}e?#I`|oX-bJZB<>F^9THC(
zR7cF1l1(ye4%Q2SrM7LHfod0Sqs$`zvW0U2;zfh5LtHheE=?(Mhs2ixONYd_45}k$
zOvxshbr04L0!wXX-GS;|xQ#N4{H;&;NJ`KfA#O5g8^nHt>e7@FcSzh5SUMygFsP20
zF(sSCcof#{z*3u8Lr@)t+bFZhzhL1kK|E#9d5D(`s!LN!+#&Jlz|tY{WrOO78B?-J
zX5E1GYGA3&tZPuc4!2Qek^g~(^9bT&gEoB9C!q(fM6fPRDRGCyPXcj=#G3<g?W+!B
zN;Zj0AFTTWOKtRep}Gxjqs$_I+rpWGc)*}Vh^Gyz%dC{RL*kjh(joB~gX)MGQ?f~B
zU4Zqaz*3u8%TPTJw^3%1f7QZSgLvDZhY+6_RF|fdxI^MQfu%#@rv}v#Gp1yd%-Z-V
zZ`1>~LB(%DbpzZ+nMMA73uh4GPJ<>P&KOjerj)ot;-SFOA#vBBI%39@Y?3oeus$7F
zYHQX4R2Shk$}I9<vT&|IylT)bh<6OCOH)eRA@Q}q(joC(gX)MGQ?f~BJ%aU<z*3u8
z51{%GZlla1f6qoANeOxj#H|JmKpZltE=?(Mhs3>sr9<LjgX)MGQ?f~nr(iu3SZXt?
z4b@4wjWUb;r!Abb5YHKO8R9jA>e7@FcSyV(SUM!WZcrUDV@fv3tTkBQ2`sglwF=c+
za2sV7`JY%g&mcZGX!ECi5_;iE1nbh25_d@43M?HGZ!@Tlm@y@r#AOiHLxH6>di_ux
zfZHgu$UkG@%t4$t=nTYVgX+>mLb6GkuE6?QbCyd`y$rWen#h00!np_WzClkRwm##N
z(xd{wgluB61=hXIS$d$l8E&IA4MBO-!Z{0Z*`T^YISth_a2o}E4azqxoM#YQpKY9X
zPhj#CZlj>d-)rIYLELW8FvPY&bs0fIvPntK!Fr)N%M4Vza2utG{L2>31&9|7x(;#G
zpt>}XkZh8sd$4}coaGKw@4{`ACi1s7h5E1&;wFQ(LF_lEE=?pPo1|$J*6rpjLr@)t
z+bB)sU$AhNAf7VlJj6=|)uoAqWRo=Afc0u~mTOSG4!2R7$p65?c?9vXK^s2jlh6ZK
zB3PFu5|T|!`e5DPoTV44+u$}z6ZzW~&J@H01}#E7ZBSjBNJutG(*;;xYR<9@)$?#0
zrHTBj7S0;P+Xg*^_{5;PG?9>OlBSKHM`^=tP}(i1Zh+e;O+8TVw{Qj_?lfo;;*3Fc
zX(A!nBmqmXKHZ#U0ji5|8>NZ-mn@ts5U(0^3*sGv>e56)vPqgA!TL#amIqLM2)9w1
z$lvo5K9Umj7KmF78h|)tP+gixNH!s!g7r*umNrx;;WkPW`A=IoXCa<5=rY7>2GymB
zgk+O6t-<<EbCy-8-h$gGP2_)K;XH%*+@Q@pJ_)^WC4zNnA|cttWDwRv%~|@PIsms(
zn#ez6;mkptH|Pw+WrOO{L_)Gjny$e5T6305P`wPdQJTnq$HKV>@xDP%A<CK*_t&7D
zNJus@*#hg{<}5u>-3+%;n#ez7;fz8YGpGx3!JxWwA|cr%O=n@f+??e!RL{U|lqT|D
zvv6)eylK!~hz|^^OA`snCTV&G>(&<=m-Z8wJcZjRP2}&jaQYx_H)t4Q+n~BMk&tYX
zra4$IG-sKCY8P&!G?9PV!npwPqCwXot{POACK8fO(sU2j51O;wf$CkjjnYK^)=!4|
zuo2=WgSJ8JH>fU6BqW=pX%yD&<}5={9fsQ|P2^v&aF!sRGUz<SO9s`YiG*a6G~Iyp
zYIBxrP`wVfQJTpAz`}V1@v%W0Hv1&>z?BHrrHO=O6O%qz_cv$hh3YoAjnYK^wuLhV
z@qj^#5KkLamnIUDP11A$)|Z;IEJO7?+(v04|Eh(v2JyB*4<SA=s4h(@afifr0!xR)
zPYrr`;&Bq+4=m#(er!-3F|&YdQVJV?${Y2-ZBRd3P~8BxQ7MqW-@+M$xYM9Xh%*M&
zr70!uka#GtbV%GasE(L1C7a~T60A=LmfD+n0ji5|8)X*xFIhNOAYL`-7Q{OS)uoAq
zWRo;Kg7uT;EDxai5N@M1k-z6lK9Umj7KmF78h|)tP+gi*;tq*>151a*!v?)P@i>XM
z2bOUX?=+~6m{~wJ$%-jh&jgm*n$?EtB-}=&K>pJf&RK}(47v>Qnn87GN{KrpUJfiB
z5??py<%!2hd@-<$llZDZFHbx{;!A;Lg2bx^)e$pq$tK0S2J1V4rM7q(;4PRmDqiwG
zv2dP2d~VR@pY}=Ug)0%POA`snCMJWh9%|0g57hy<jnYK^84G6);=Dm;ATAqJmnIUD
zP11A)*4LV|T!QLlxQ)_8{yP@VJ&5-WdJ3_%#V4gfIgyZTVzLF+z0FyApt>1uqco9!
z$if+e*fwYm;-W!y<unXcvPqiG0XpBD<qTBM!fli$@?W=bZbDo&=pMv}2Gyl0CGL>;
zR$%Fn_>n;`PdrZIJAq}K#19OrBW4zmO-kW8tT+6OH*QcrpTguB+(xB9{%sb{c8L83
zjY6C>s4h(@afieMfu%#@DTC^W8B?-J&dkGlF|gD&x?QNw!EKaT<UeoWT!eVZpqmia
z45~}hL#S@}awzRh5PJ;jgE(N&%M*7<yg9IRNIYmz9Wi4{HYtTMSWgC)+EN&X>L}bs
zr9l2g3+EKX(*|9Dc-f%3G?9>OlBS!mzSW%NI#h4KZImYRKeBM1KzwS@roZBoumx^|
zMj<8ckoZ|3?vQwEAnw#<R!Tfh;thdioWz?AdU@gr5^oGF6D004s44NoknYKpcrqoP
ztRrTjkxh!FAJG~N(W|`|n3C-<X;g2>KV{*}K<pZH3gTIV>e56)vPqgQ!TL&bmJ3k5
z2)9w1$iHUc+<|!4pvMrO8B~|1l(<9Udx51x;^zjvJn=Y*9|o3j5<fMlj+j|MHYtT3
z?BL%5w?P}Q5vrTuHYx@34_Y`w5Qhyq0CCQsx-_N49TJZQmJW&M4XPt%OvxrWa~jrX
z1552~xCGTxa2sV7`L9?w*C1Xu=r+WA2GymBgk+O6J%RPJ<}8n(`WSAbG?9PHU-glc
zpnD;1GiWEoQG@EzL_)F&@eHiznzKwn^#I&PX(Inw3uhVPd4sM(ykSsXnn*}CNz)xz
z-)qjY2G!ee8>NZ-&!TXC*2i}PT#3zAh<ygtrHO<sGZ}(7YET`^AXIn4ZImYR&sjJN
z5El(P2l0YIb+I8K*(7JK!TLsXmMc)b3b#?3$bZkmc>wXDLC+y>{5hW#iC|rtNJus@
z>4kM)bCxYo-3qr+n$AM`+{+kUfbtEv65mybw+y-u@sUAw8IclqNW2zUIwXE<P#rO2
zN;WN&UT?G!Zi8}qh5(<#ZIr|0@3V0FAr2Tc264)uR_U*NN(%|eCJ9)8^-^<|IjGLV
zZImYRU$Ag4LA-3xO^9m-wMu{GG?9>OlBNf+e$<@h9#rqcZIq^sKi_hHJ#Z!HHpD4|
zypH{r6EF(ZF}RI_CjXL!a~k3qgDyh6VvxndOXb**kZh8sRambzXSo5@n{XSYiTsZ&
zoF@>U8no#vKH^*8N(AfDL_)HONk6Oyo3r#mbvxWfX(IoWg);-OYtSi(XAP=L6A8&C
zX}SdKE6rIhK=mTrMrk7dZ42iv#Crxkh1mK9pOgmWloEGHd_NF(NW38s*N$6|crCDu
zllYNABz|sCT`6ou9Cn7dw1**%8Z-lO-k>^S5|T}F?+mQZHD@^m)zfer6)*X(S~%Ar
zUN`7A#CrzSrRfn=AH!`Fo2}bC?KZfQ5nYJ$2Gs?90ID-^8wGt1%I7VdyAbaiR2TGZ
zsNR9wDCp-<-tgBvy`*{=;+R2oLGOg>5Zp#VlYidAS%kP`&@#k}2GzwTCGL>;RAA|l
z_>w^{PdrZIvw>xt#1{;zBW4zmO-kW9tZxRE+NaM|s9uBHs1(S5-@<ta@sUBTulgix
zf-4cMOH)eRA@Sot+#zvKAg*m=Q{r(FKMTa;B;FW^$6r3i6C{2fh$l$AH4sm{Jn>{o
zJed;Ljt#TW$R@?I4bj>jqE}l|Oi3?H8r2)}k6AdA5T^`UfOyKFy39(6J0w03SUMy=
zZP3dTkCS*Vu#A&<$)Gx7W&zox6wbr?VqmE)g>z6{hTEtVHvOWH+;+GU^Z>*`gW3=e
z7*v-g5|T}b7h!#>Im<j$7vMHZ6ZtP%IF}(_F=!RyZG-C4loEGHd^NCiNPNejI%39@
zY?4_IVf{F;)K-A|P<;TmQD%{UQ=gBd1icyJ7K8dB?lh<_O(Z0n5KqGTKy#KcsJ7uY
zN)!1{SvaR5o-ybm#485XrRf4xY5Gd5f8{2yRk(`P@!WteZ5yTPHjEy_l?;6f@tHwA
zzvKho3Rkr1Vnaf*iOB%0cQ$9)4%L3RjnYK^0~XE<#I8Z7Af7d-E=@~NrKy(6MPQfU
zHYuqK(4}poR9%J9ZMc%5cOl+0=n2H<2GymCgk%%q&A*KDhTEXLH$k-rZlg49h4M}d
zXBgtBK{F8N4XR5M3CSi2I0Nf*%~?)C^)%c@X}SvK>lV&ah|dkGOTc5OK7rdPX!39U
z6;Cgz-UhMHpdpB32Gzxegk%%qF0AL9vmAix4BSR(BL6uH=RCv<23>=A)1bOEk&tYX
zrn|7d-<;((RPVrTlqT{&w{SLW_wn5bS7Or(al1ivX(A!ngk>1kW6fE1LUjmkqco9!
z-ojagxMa|Ih?fkiOH)eRA@Qle(joC>gX)NHLiK(yX+MJa*r1KS>UlQ9l`O3z?uTmI
zOr{_nFlZ6tX@g##xI^NZz|tY{8H4JG8B?-JA}_%DQede~_cBz^!);V=$iHggtU<hO
z&_jq%45~{L3CSjD+W4wB>Vey!EL%|B0Jl+^$lq__3_{##&?LkegX+>mLb6E$mSBCl
zIm-f67vVNa6ZtP$IF}(_F=!RyZG-C4bQ7vH)eh7HU=QIo=~Uf^E^Qm7>Isatyyl}R
z8QKeRn?XAvjv7>#DiZeulMadd3?lKEK~0G_2a|CU4;Vz^VS}0yTUP8R@nB%tPvR+q
z>WE25Hp$}|SkDEP+Qx+e9)L-s;wArC3uhVPd4sM(ykSsXnn*}CNz)xz-)qjY2G!ee
z8>NZ-&!TYpeS9~-mDp^B*k@2(nn>6(lOc$s2Gy|)LUkwHMrk7doQ1OhanYc25HA>1
z7n_v0L*k{t(joChgX)MGQ?f~xUxW3Hz|yW`xdPRza2sV--|L=s6s`o_hB#@^Jj5k~
z>SB`;cSt-HSUMy=Wl$Y4V@fuO@iMG01eV&&It$fva2sXT4JfZh;q377-3V7=Q<s2e
zuzvnBL6g7F!s&-NV9*%EDTC@_Lqf7i0v2Gs)SP7ws`GFgWhePBS~!;>UNLAD;%$TK
z(v%W+NPIQ0bVz*1pr*tZg2_0EZx}@4HG`TGTUJbv_-0_4An|>J>WE25HYwhRuznm^
zYO5>*d;pV1#Y_H8Z}><`(3>G{F{mHnPJ`;wL_)F&@g%GdG-nxuY8!5&G@XL-84KqY
z#M=hdCEzAhSK&4adgp+rJpfly-Gw-3&}oS0462I_3CSkJmtlRiIm<<;UV_^wO}D@1
zBlj4t1pNf!Q-kUf(0bEr^uiUEK8V{58iv?5sE(L~WE0{!ST8hZnSp8-Zljzb|FVU1
z0pdl2u0vcks4h(;B%7q^9;_cUXSoB_yKoz&Y2fQVay#Kl(5E1tF{my9i%?yH+bHPE
zP`+y6+=93US6>SsL4F)zl%E2VSl31IAyi4%D2n9YJm~2qoUIUh4H|?vY*1ZnQsNGY
zw*{6CiAN2pBW6s=CNVw$>uzAF&8$hNPQh)IS!bYp&ceA2@d{im&o#)mBaHH0U=7Oi
z7F0>sD2n8NYT-PG*!s0l#9JV4GpH`xQ{oPZHw2ariTezyBW6s=CONYc*296Nwmb)*
zItaH>W|6;Z;mku^Fz77A^9I$WDJAZZcrmbaNPNMdI%39@Y?4`5VSPQY)MnOYs9u5F
zD6`0a*TT6E@qs~g33vq6jo<K^l7JqFn+@6yanPVTViJ-~h}*E9YR)nW)iJn@a)$g1
z7S1BXC4=e`a0;rYo10Mel9^nAc-5d=5bqdN7nhW{L*i?Jr9<Mo2GtQWreu>+dIaky
zfu*+oK7i^&xQ$AQ{5}7jkE8^>1>#nN1|bd`RF|e1sGc^Hvk=c2bOqvdgX)OyK=p~4
zJcIb$pv^lyPcK|aR~<14$tEU)upVm8(ht=ExQ$AI{4*BL9K?Bp&Olr?s4h(;B%7q^
z3aqa+XSoE`%WxZ|iTrmgoO=-O8}t-n>#zHyG$<z$l1)suz`D0NOAk~x!)=r%@()=!
zqY%do>Ox#FsIHtyNH$5+Sy(SOXE_bkGjJQFiTu|roEs2t8gv)p1B2?)loEGHyc$?K
zBz|a69Wi4{Hp#4Kux|Z&<7)H-CQsou%B)`S_gOeY5QpJvU$+Z+F2X1;0BcawXP`>D
zMp0ab(FF_V8pP{xHHvp3--|HH4}dj@;vJ}xu2B@9!)WW@2&J_RVxK`n5XTIvs~IVA
zhs4_hONYd5gX)MGQ?g0UbYVRoSZbdz2cS9ww^3%1|D1($9^wUqu0vcks4h+Sq59lR
zHVk>Ajc_HIy%4t><aO+~ywxrx?vQv>VCj&!-yoy(Qa$lFiMIrnaT50#^zy_LB;FcW
zCP=)~pqD3}Oo=B`;>kK<78=>4q=pf#u@Jr53dxiV!K6`zB>%jHvj}m?pk;^`4QiGC
z%Eg-!cSw9Huyja#$)FN%t4z$8l1(z}I;?L7mfFm^3e{_H8)epgC_l7to<nTyYPmmc
zje8+)i!jRDfk~{rf&G>fx)rLVYZOKDk6Jhs9|vgm3B-+W`QX>JX177?GiW=+od#KK
zy;P3#84zEFyP?%{?b9pdCZR`Pmg|$Pp4Gp7`ilu0@t5WMbC26^XW}OK%f?O0`m;$w
z9azV71v!5UZi9+;9ja@=q+1utjU<##oe3j!H-yq=^<({zYFNk8MqOM8b+Ww#@svU5
zAzm`5j+lgGlYF}Y>(%Bg*PwbGZlima{0}UgM-U$yv|+bTLJ!;q1xrG*iAf)<`<t`$
zLUkM5$}};1`yohB6t4%Uy9)90Ixnnib+15tWYE|v-uD_@(Yg+C&7ceGz1Bsz75OoY
z;HKcNYfY^}yloJq;5>!2ImC$eLFFpEuESm5TIxye@tg3xi8#N~`ui=)w?aBP{fPfS
zJ{_xIVv;NF6RO;WYK01OnAt1Y%Iq}a<jx;Nw1(kUCUyG;pEZMUr7VUZju{lP4?-JW
zr%i?8<4<~>b*;l&KIO%&a4X7r83b1Y(cyAfcj5IUud?YA-e@!2%9L(}r$unK928Xs
zpjuHBeek*jSE~l)%fYO@3AwNtuBw&)u0ox<QmXvuyv4Cww&HiwFM_!;t!I$q=kqzA
zswB^Wi?CiZ7K*)}_VJQZ=GSg_1}Nztk%(WpUe^jAyyn+|C96p^6o|4hS`9H8r)V+i
zl4vXtjhAzg-`VD8uO%JN!MSl`NLtzIF;u9k^#j^H!78a$gYeoJR1P12xL{B@tYLUj
zRl=GBv=pq8u+GElBHYT_!B0Y4mK`aF&W|_qv&oe_RJs@9lkl*3EvO{QmrzRl@^3{e
zk*Xv$;|5sPLYXJEFjYxd_|@S}pJ5$nQ=Iu6p)NlQIrjMgQEUe&37*^=19yj_anGjQ
zv*hOI73J<J7Z<rV1nzN)J)dPH50hvnL^8QAwt~PuiQMJaizfqj(kAu6i>gvr#{eA&
zR!PD0L&p3TvUVw;eKS}kVeyN}RF$x<L;F^+O2T>ouSakz>oY%dY{hXTEsms$Z$bud
zg<DBYrEQ@!5*`-RmQA6+DE6T4N&l_2!V8P#Va9R@1?%*9!BUqdu3T*f5F38yx9TZ1
z3Z1bK^X@#v(*~89C*eg^DWxSqXM<HzO4s1U4=78G;HQiq1*@b++=LfZB`ki^_(`xz
z!s<mfPg-`*L1YeB<XAsc27*<WR`y}xB!)YoZDGwW0y-0jk{D8(0Z6)7&=*5vlvtI&
zEv$KnFzf@rNepj7g{qo|fS%-Icni^ZkdF?(P`fR(IZ2Ffz-uk2ByDG^k~V>`=66#o
z9wYpQtEnU`{7~!WpWsc{rf46rJj{<+p6v-*<r{!RJ%Ol0u_su~lIUE3vN75eh{h>e
zjJhPc5Qvhdy%z-if#~okM1GI8qQVbCg{o39#sD1%L`jjJftP(+_3#xyH-lBu94*6(
zsuI?9K(~Tb64nEFJ%U@={yu@HWm(exZbH^=g<Hu(rEMXf6CM_?1(ihkF|3~lmUg-R
zq$)|x*zg5!Gyqp>JjJyDb#FtouRV4LzUU2y;7SuQ32`bwNsP9Gs2^@+{_qQ;3{{Gd
zp)m-7%88{FKRQ~WGKEk{tdA-(4<gc4k1wXtLQmSh@+UMa6ZQyUM4xn|IJw!UM`GQD
zIA>5ftv{X>KOedMCp}+f90%aZ&m(GnY(`ABz^%%o!IGWS2bv9pge2KUt1(!MRXMGF
zuqI1oteIE*JfBo!ihV!Dob3)l91c*MA4OXWP!fTQh`<%Nl@YiGPX;07NNRqoOQ17f
z@^P{6G9}fRL~9_dsKz(p#gu7rFfe{9PO-;G)ANwFWF%`lye!&X=EUt_)g42$nG)AE
zWLloWv!dwwLBWsxRpuPSc?9M4t)7Jyk}{(lSgsjmOPL9{box?HVobcw{?8cl?`1+3
zyd3fd<XJnPcbnkV7gWAmW*LANi$!KMuD+6lMXeWvwX+cswOAV}ULmRSg0NaY?UT_D
zSMF4bw*u5%gSc&r*OtoF4{@hK{KV8`fRYDJABeWYt*nBh@MNfR&oMLxQE?m6ik}p#
zP?;<d>s?9a0Ytj0F=ZMp^rThd7q|F<tjdJ(<5U}ehS}Jr$gg=w&hGpx-ggLY#hpwd
zemqIao?`!($vry&k)ODc9JvVSnrV4;``wDj4TeZ2iJgJhsl3W%cwL2CnIG5T$%sl{
zl@aU-iBGzew7MNaPgGV*#9F9izJ#P#6*RNOLQftD{A|xEXetxNqKm$*Lh;OBW%+dZ
zDS-<HSuuEtL^B~fIuy@sCDH6M#HR-Fs|*_hcaoANaGnp`NkQL)mwommQE4H}jc_aT
zqX(Xhs1!6KI2R(Alp?MALb4K-ttDbDR5Cw@UsXXfTP*Y>dp03rTi{kEj77&UF-Y@C
zk*CZ{T6tXkXfKQGFvYO|C2b|S*Fp|;C=UJ{iDt=t*C2AY19!)(+wXmFJ`3DQ*7p9a
zSLX*ADqbY{U4!dTt<0jE@U;BsGR}->MGHr(yRfcMS%VidL(7@WJjY)#%6CEzC0R`h
zi{mWw)8d%akewhLg<F~Y>nMb~aHWP&9Q}&VVM!a0<~|UhB#tDy6Now#&;C4#X3s->
zW)QjU*zcq|JOpRUtUROrZim-sUWKQ~Gdiwc$_qwJ9zu+pr9a8qRpf&mwcVy@2TCVZ
zmR8Zp-xPTqbwxc&t;T8fFce2NhE!eGnxObBSRL8;3qA+8!<9L2%Tg~fT|D&Mb&o4L
zsbxLs9`~;_B9lINo!$${c%ZnH=i&-4qO-~=^7L<~$BUaG<w=e1h1XC}`EEI$1BuFb
zS%t@*8%t8XQ<a2;(Yznx(x%8`Y^CPz{HhOq2yR6m^9cxgwt3Zx5}$&Xoh)9lUSSSO
z58-M{#v{IYsJ3D}IQYR|^WiDRQ<<McSUKBx5<2<y#(+BM1tR;Vkl=2a=rJPr6mDfJ
z$PBaNdD|5GevuiK+|RU%P79{EEm$QHO0C9e)eXs*EhmG~IR%y6ZCKW;ymQJ*xmVt@
z-V4cYAZG6N;>FF7qBg}|WR26~MSsYz<TktjitB;uJLSx|lBgs%(6vM*xeZg5goV*;
zTXZSf(W<i>f5}I16Wog1unU4SfhcKsZ@`Pk1XotvH7N1KT)n-@hsG*a{^McBw3B;@
zW)J$ja>b*FRy;VknMwoVVT5U?_f|AHJlFOflq)lYdCr4rr9VTl^~+3HawpTOFO*n^
zqMf>$+{vlcIIVcNZAH<iRui-u4#6Lpgvj%0E81zMYYeKnCZViXc^8+Ja!o>6?}cQ`
zh?%?9d2v1@vQ6<>tjCLup}3MJVIKPD0#)*4KAor}H}ly<C20~;m4t=S+-}jOIIx`+
zZgvzRPrj_E7egT6(YO^Q&ckcZhp>`X<0iar!L7VWZo_lwS9}CtY5lzg9$@+)!g%KB
zX2f3gyoLSVDRJpj85CPX`jcCSRu5ra(UMfCkeKnRuo^|!lW;53&x39kpd?vMN;|AI
z$=avTZXsEf)T{99|J6|T&mr=t%8Ig|f7NSWhbyfXMIIzq@qSAy9@;3wY!uBZ$@=pM
zqwh5zrfx!@JPK@G>%XUXDnQ?*cqTxT6nRXYl3CsG5(DJvi>gDJ_Ul^Tp=jstO_Z4~
zAnH7dQkfnDdj?mZc9b`Sh$c-)nM#_dFRhUG4!G8}-s7Q<q?D4`2-cp!{vP9eDM0NT
z5N{ep(F*6ix)e&ZS|M5&0@YE9q+HiJQl`3wMDQ@q>goz5ro0fICGZGEmYdV##dgF?
zz;!FU7&P#e6<!P(xPFBfZ38!~@M6lqPpt4_&cIKu@M6KhPp$Ccw1FE}c)=Pb@%;1(
zFPMWaMddu?0j5@BNyj{>ggTR|ATngBED7F0ef>TXQqd?r3DE4;*S+u7H>fq+JK)9V
za4VXZ?I0kL-Zy0G+2PF<qiko{{Y{D%;CCtZA`WUv`Cf=uw;V53^Fi6~iz2ouiWudM
zf&M!bdHk5tQ)UdMRiQW)ERzhYiWrZ&oU*L9SbOPAlBs{c#Z2X)joKJdK7gW=Nb$JC
zD*>9i3h|mjJl}B5pa&3J$QyZZF`Lhz_%%o#7`7Iw#MC{APYo(3=y54Q?shIK^&ti`
zU-Lc{4bS#OC28gcp|TUMJji*FBx{mDOp?{?<YC6_x)q3$mqV)X*vN{0)dplItC?#H
zc(DbZE<1R!-N08?c+qd*`W0Rb8@OSG7i|OAukd2hzzr+BIAGu>R(P>!;3rpjv1H&U
zR(Ns7z)!94;;ez6T;avCfg4wN!E*~G?VnoV#pPI&7uO8@^a?L-82FhLUfeS9vn#x~
zZQ!OAUfeVAb1S@v4nO?-3NN0R=1;8fqJ>*tA}=G1xL~s(;1^bS!FEHyR%k?cI--D|
zUf~6s69GT9!V6YeXU+@WmjZ5FVGZV8<G}K*MY=v~s>&)PH<jd$xDV^caC2{kWj%S3
z>r2|_vQqA?u&nn&GUkjtsLJ_L@$4eCS#?vZBo|s}=C+3BE@>Bf5|#0Cc5g{kI`t|E
z3!7X<TMB<&lG6ikdS;%FD35=NTfgqTDl%v2$Fe#FtH*FFUZa>y%u%)^IutL%uOd2B
z*$I{EY7S2-Nu65#+ZDTB%Ve@%WjW2avX*0$eZNcq-Ll?`*)G9M63|-V#Z`ck7m$KO
zuT@i_xU|k=l3f%}1t=k+)f$Lg1bA`Bz;!FUxM$!iE4+AM;QAF_JTh>@3NM}*_=y!>
zJTvf<E4+|8;Qk~^pIYI?Mgupl@S?}SPp|M|i-Dh6;YF{3pIzZapMjfJc+qd*=T>+z
zXyE5pcrj$)Ppt4_)WDt<UbGGT!U`{z3`}d$LwG)iD^-Ew@GCxhDsCoPZ3-%#9*DgL
zkzmvy6hm-G^ehBFPLb9XcO_%^;^0Fd5NNdx(UD^RtrcGMhd54^?Wi)4S78b#gG#&1
zLa(l=P~`63ij1b!La^#kycVG3^=uAaRB`tlFSrM{;-+7M-37QVhj?)*gqP$H?al<1
z_F0JM4JzjdiLVBggqU%?6;#?3?*wRy;@toxxqlB{J?nieB=Hny0(698H$d%M5Fc-#
zVKOX1?x!L64n-15$&%<?AW9zbB-#*yAE!7Opji?<GiVB&j{^5>IkU;VC0I>Rv`8MN
zxMW%k&N3jGYj})=55Y=bKPk5ZQ-|b?ZPi;Usrn)+%Cwg;EQ*YrQjyj&A$dt-k?#zV
zIzomg29>iewF-r4R!L#fYFi-As%(XdyWMzUc1dNXN`IgZ)pX6Eax%8Vi-~uQLOJ;k
z%vmzm<qesceJ0en<hEdVQPoYYW^-XNmKCi(iFsmx%Qjw^U6O578M8cMgbsvcBv!-F
zX5w8A(T>Tl%r+*RmXZ{1zaRaCPj^M?rr@<4RN53D1n3CGhXHC2f6{Xfe2Uyjk&t^a
zSam3pP+BSy-34LAV~Ip(0?|0dy8)Ud(SblTdlO=Rh-6X&$bBIYO;EH*9;W!rv>2Ra
zz~OT3nuqo(Tx~Zf-w8||k~6kdEfuM*L{yY%FD(^CMoy_nYnhO=R4nqFAyP-kFd1_5
zNI7|_RVYleN}3^BT@GPoRW3rs-EzDzyX5Af%C$fps_AG*Mq<S?9hi7`ca@W0dCSp~
zxh^dgGy8T3FUdAqMO8PoO6n=C7|V)#nJU-gY~zL5B^f}K+m>yN&}v9VVs#7JOuWk>
z+A;Z+*~Wy^Qj#)=8+18;qq6q(LXbWc#o^GMPpT5FwgjsVMYBpWo5X{#%8db)^<HTW
zB`?lpo!k&mS+9y~4Dn%Me4@3~8rZhN%Sm`w^tFF{OOh{uJeL=hdKF6(2T)i$;Yt-*
zOfqc@o-?6j+Y}cAloZ=3cwG!CZHn7NZ#ipqAy{=NnpIM<&O@7r6G<|DYlRm#16BJL
zL>?97^my^a^pLy3AwQ#1@mRb8>s7dpnimXL>cV6AKaKTx(Fz&E0t`_gzfpBbwINs~
z88ZN{$)M7v_%J|8A<$|psB|dWn_xDqnP8O+9v*<#JY1JayjTc!ZHlL2JzntjQZn-#
z{Fh_BkYy0cfr?$3zk*7jG7-~$H4cpz*8qwg#hbAnFV;-&HpDxzUR|IS`~sD!Dq{Z>
zp=?<1gAkRC5H}fA4xUz2eWmq!(mwEYr#DYiR;lV$@vUddXee&oz&IzpC0en^Ez3qI
zn$_WQvS>9N!WyS&R!I$~)m*Ten1^`EpmPwH4ax;?uOpKbE%@2872j_zgIF_>^7Vkd
zzQPy5+X3re*@PS<eN{O!xBtw^D-*ffoUHSRmDE3q%si*Zi?gP84kB~Z>6LSbo~vfZ
zjCf$sQ;5umiW`MlNo!fF#GHH<h>{vbt6NZUapZ+jwMq3b*5k#Kz~5#>8DwRe2T-az
z!~M~wI2oX1WQ{5ZprZAN@=P#Gnm>BYnF>XoT~{$1O%;xPRo(eK#O}N?mrIw|8zEGb
z+a`FiOIe}9c@uUeMTH`V(JQ+0w8H#ZOPUypX4Pd3>C&n{#CV+I7@qwV%MIqBZ7NAk
zn}qdJU};m_7#=RO6gLH^Jr8kP$mUr_mM*zZ2ks6<5=!5PVo%`ikefraqQyst1()Q}
zA_%U)l}g@PN$rv>ph{1;U%G=3Ul3Yqbu_g)%B-OK<5>+Mk6Hbtrcvzugr}~kX|(Ew
z66#RoxrysqtRjqHi&itiYMkP>5LWW$ODo>_vZsoog_S&RX~j{nb*)K?7FJST7Z5W`
zdN;%#LO)_U6Jp$^IB)Nvry=t2#fm&6(Oe+vP+SN^hf|^?(j+<%h{h>C4{zexbZ{t3
zvX$au2!1XNJ}FhEehFc@dxIC}LIjRbJRj@v;(~#{wZe-V2DVmsVS@`tDBh3tcwu>X
zBu&JTa;b9g$CCbDYV}^(>OOM3Cq&@yq^mht1uleKZByL(Y0oINqYvVcLFLd$bU6@p
zDDr?t=>nugNrfR1qp_|vPVrLUKJo~no#=QZ<xVn^L^F5*y4t{tu7SU`!V8{c=`?w9
z0h$|HU-)}cA#la>ES)MZEEBtoA5SQCdc3flP3{FA_qh$>$U~tI;*>!=pp&T)t#TR!
zVqAGJr$CoV(N}sDGb1NZxwskMnNTCz6c<0kdXu%94^|zDOTj9s5ouWC3~MeB&8|UQ
z2t>(qc@-*;;I41|k8>-JalvyS9av88Ignlr<ZX%vKFj1Drq~Too8sc<gI12)j*{$9
zB%u@lMG{K)iK1~Q8GaG*-HfC0T%F^^6@YSsQzVts<He~E_asMo<|Sh%5#`y0*U^&{
z=o!QfA;2V}DbeAS=x|DuR2CBP6it^BURX3|$$lPjb9!Zd2bRl=A>2XU%EGq6<ZZsJ
zlp7)~>oq5<*l&FoG2-!}6)zGz33Dw}(JsrrFBEf9I;qv+)G8^8vX#rtvR!2s(~^gD
zO0G;LSzK1iWpP=rIax&(pFzIeguA}AkUmsd&+P=y<TdatGW$}<^ftwrpI}olOR*cE
z_8LSUwOG-2<H3wPYSCpeFGwj5<GY};BMardffs!}j73teTVQ8Y-3NfoDyc)miB<A=
z=8=we5M+BZqQT=3D_%!=7@~!p5YuZRBr0ji2H`apRHi7-2j~bzBTB{vXw?l?KaNTp
z*2dB<w?mVOO0u4nDvY+gDpPzx3a09bsX`X1VjGhilu8V;S?CuL`fa#U;uIf$fpxM=
z@kxN%V_)>XSK!Kn=RQOpn<&uLpY&Qhw@#pP#xe%CLJT?-8LZrOX>hX)?qP_*EQ8}=
zh+=pXF}SmtshQpOQ{_k{^^=jh6CyQEaZAX9!;D`m#9%y)=V8W^k*nB8coV@qfh$``
zHc;k?pYnKNc=r&Vs*(Lch{M!#h+C0#vD^-EEP{{=JoHb=%4NfN-9VakAdE62qocBv
zuZ4*9uP|b32vTh+-wxR8E0muFOg1N$N~mf8j&Z9Ba{~%n?S33C*M>6ztV|B%1*=s>
z4Rd;|ZVX-YDDqx#dgUBvF7W8iips(QTS6wuEqfQ@J%fh7<f-lSzjiq+5{(9{4n-15
zv`NIH9R(^A@ia=RxRmi?6VBADc$OSMz~@2)rWo2NqF>ReYD0S}SS4*r1C==ha3LQM
z<1zyk>B^+NkFrv(UsTp>PFB$`I+a8|*?xbfUgd0}l04E<l_VgRZ?Bc}0>njw%2kF|
z-JsH;)sjJFtIhDDl~lCvt?+{OuJ-ZbJ}jJOnQpK|CmRFHDg%j1(!Xe+(jcIA5>Rr#
zP9`czVN5kwVGc>oRCFf5a{#X73`J&l#huB_-n7MMqulZod3vU_9&7NuZCd?5;|&(R
zOvBkFh!?}*gGsZ);5G!J4#mL$b;<o4VMrH*+?PXeNee>mo<KBCk@1(Nnc{uZVsLgk
zX40d7j!fmrqWa{eJQJ9v79cJgbP3|BL5#vJ<dc%ELB1Vf<%-Qn+(I6>yM`B*=}E>s
zL^eJP*?E}RN$ZMd7IWHE5@JU7Q7G^>#i4KrVPf?V+NP3J6S53ocFU!d7Z(7^(npFH
zV?AD6GVpsVytr&&YlRnA0Q%udUR{k<d2t<}1WxgOfDTi95S#L1IAlpuy|zN1NzA18
zNM+Q@)np1}OCerKvvd|-%)g4_ZzHyLnr55ga{m0rF04!?DO<9fg{n&{FU|q<CBdtH
z1n5+GaX!Q%$<B*lxfTb(i{}6<(tHPAkAq5*a~Bcntq^*f;?n@lQhXMm_JN=C<+QQa
zyA^#ha$gTt9f~BBmM|qs?yyq`>pWbSZ@hQ}up<4};q@S>B<bIR=nsZuv?*Tvd8RBW
z5L&f^RfnRTA(<qDR>Q$+oT6DJ^=l`z7vQ?Y^WtWpIzq8OM0=j%RDh0BTnNzI5=4u`
ze5>@w;Fc{oidO^F?gP<a;BJpWoH2+YFB-HA(PEI46I1s9!MR-E1t}{Q25bN|(_JwS
z%(UWxChHX16uBQzD)-DfueS)dqP~*|Z+=45p~wXSQr}6m7KoCHG6%00s9c81)xa{v
z;OWx(eo$#s+`Qf^RV3mbw5clNoeL|xpxye`-&t5;ICT548i7g`11(e;2rD3xw4Z_3
z*`PAc0O+PF6ZE2+s&wc@m&@+@LteBgUfkf7DzfJ?ylw=QHbq;WpWMTzKj8_N;Y!V5
zH0YkISGfq4JAoz1J?>eU#}u&CWr~~}tY{~9Vs4dl%u;gv)F5XWD++TM^N3?%PBJN}
zR3#~?R3*t8X3>x94#RK^?ke2daLdkJWXC<Y_u)Q(%lTR6Q41NsFF2O@ay$>gSLP|(
z4}gCsT$TyH%UITDmX`JS)yJ~_7R(~?<9qy^9>1km*6)LUS#J_}S^qTfvv4`t$*Hii
z{&Gf-U*{|94`XU(3@+z?_~o~<e)%JD)Z=&M%KBHq%g@8{gKzxWTUnn|MP)sHORlWH
z9W#;xaQWf2MO>Hl%b#_l9=`-v*1rm#>u~SF<(JmV`sI(ZQIFqoE9*~!?*QEL*W$|h
zoSE9jIV8B-;g-MsRh}g(^W}K>#j#QFlBaBc8vbYDUV+PxfR**j-wUH2KQUI;=K;}!
zzu<k!M?IJId6MnbuX>;InY3kn9&>r-m%LB;z{;{dPd=Rg74K6%_OPsf0D5J8o(Ngi
zUwgwNcj1;#Z{ZmzJP4<${Uh-GS@n77%jN;k#1me4x=fjW2*4;@c1|bDintzv+f@Hz
zsV~R9Di45{gDLN6DQ{>g>z9{emRE0<_1P|S@dQ^+EaU!u4wtjuWqY>2Tynq_02?v&
zUDjVl`+5QHCAe4MvfU+L*?tIvSz~ZHj>)g=l=ayI?;?NM-CoG#_Z+&ST&&B^<vHMG
z{xj&GorPQO+LiU|uh+}FMAhH=7CNsb&-E<?o#5zlBskVYC3y8CeSHf>ljvi?Pl8t$
zz05$AH2vjzPG^>U*SGjWRrFZj!aPC|mfYc+T+w5F3qy`YSoATFl;9Y`Nbueg;xE^?
zzLLSWWpFh0CExX}z7pau*Yg<blJ9yROPk=YmJssvXYd^v98G4)cYW*465=n{w+1u#
zH!}Fn4F2mGd?<szmBINgQ1o8kdb<eVYJH1sc+q=(>o<x(&>zd-dowtnB}MP`t>jh8
zDXec*KXcZ%zFj21)%x^P9^m<IM*lzt|IG|Olfe&V@Z^ov>8(#st_41q;rU($pU>dO
zGWbFUKas%~Gx&!Yd?|zfD1)EM;D0NFpU&XFox#s!@V}eE&t~x7$>8TQ`0r-$<qZB0
zGWhun{tq+wg$(|WGWf*|{*N>Gr40Ui8T@hv|0fyzN(TR@8T@Jn|NRVpErb8F41PU>
z|3L=7k-`5kgWt^H|2%`QX7E4C;I}gPzsTTg8T?;n@Y@;uUuEz+8T?;o@VgoO-(>K6
z8T{X7@cSA3-(~Oz8T^kk_`?kT?=$$L4E`T7_~Q)zA2axq4E~=o_|pvjCmH-%2LI0)
z{CNid(+pnyVz9pTO63c~`qqXF{>co!F@t|5gKx^<pU>bu8T^YGd~*i>QU>3W!M~ir
zw`TC4&EUNm{3{uJTL%AX2Jg$@znsChXYf}ucz*`pk--Nt_?sDgFoS<1gYV4Xzn;N|
zGWc5=d^m%@oxw*l_-|zJu?)U9gL8(lcza9#Kcmly#IpXkGx}2*{JR<aKnDNK3_g>=
z4`pzUxs>C7B%{x<nX>-(GWzow{8$FB9`jk>I+4*|%-|np@TCm?qYQp3ga54zemaBy
zb_PF_!T)XsKbygSCxf5M;J=%}moxZ3$l&KQ_&?0x7c%%i%HS6>_&?6zmooV8W$?=x
z{GVj-D;fNsX7H;S{P#2XwG95xGWhij{s$TSMh5@G41P0%|MLvKn!*1lgWt;F|0090
zW$=HQ!Ea~qf0e=SWbl8T!S819f0M!QW$=HS!S84Af0w}@Wbi-E;14tSzt7;0GWdVU
z;Eyx-f6U-dGWdVW;7>F7pJec78T>zI@aGx)Pct}=J}W;TUwNg7_$%rEXYfyE@QoS#
zGZ}nS2LF5p=UFJl*vj~SMt^e#|566ulEJ^6!MA4cpUvRC8T>05d|L+pY6j<usdE1O
zaz=l927fh!_h;}O8JsJ(%JF$Kqd%CzzmdUrX7FFn;6oXFR|bD8gYVAZBN_bd3_hB{
ze<Oo`D}%q2;MxFeX#KzcrI_<A%*3V5!{<eDUCZ)kBMf!5y5hXv0Q^^+o6ZmVnZ9(M
z@m0}(C7OTi1<$XGyRNnKm9wDY2;;Y${<_xoU0!h;qI?AUYzdYyb@@Z+x8L&m3*Kp+
z1-@Fsef-n<<8jLe(6n^KcwID)$^7v8pQT!Gb!2s2%jP#X!N==sZWsUlNG{h!^P5Hf
zo}#i`{a;T1b1m{>5lYMRe=*V5k*Iaid}xt>bE5y#lHVGC>{e*~3^Y9dmlFMNIQ=aF
zFY+5sg?GU}0N^L#dj2m{Ex3zLe`~ld@*7Tt{|Wrx1c0q~$e*93T5z=oyROw6u8aJJ
zQ{jIH{{aA>h3n)06{-bSdrIqC+ro8`-*77Yf8c))K(TzkO10qX6LVcO|6Anm3wjiO
z(dmD#^&x;F|1VQ5xOzv(-59Qm{DxEEZ-W1S08lJnZ4HWlKXUs00W9(xPKEQ}zW{)D
zh|m8WR15C!JAKx+78hZnJ{V4eHSk}l<bRWD!Tn>WKNzly@i&|be+vE^0C>mx_<w_H
z!Tqu{snSk{>mtA5RQQ_H|6GeR4_|<X=hs%Z_}6y&Ljf%E8%~AqfnVDp{VV4GTON#l
z&p7?zfE4)+r^5dN{{II+v3|Zywc!4N(;p4jMSjDn@PC4zBkRTX?Kh|v+~-bzEL<1)
z4W~ly1}(48wSH3WWBp@`=JS8A2czF%r{4}pk>7AC{3iH+75v5gAE#Pymz@4&xGwS=
zPKDnE|6d3HCV2Sxf17H-)s^n?2FoJ<RM4aFhv45+$^Tud1^15AXKP!&e+{R>{|)~A
z;4jvn-=tb_Uy**qy4Fm%F2>(*Dty`Lf3DR9KcDD6e-2SCxI3JFH(VF_4X45=_)k>k
zkM@F!f4}MU=K@&dH=GKK;Qw2d{NJNmaDT_?&xh+Gzu{E)U%}6jKlX%t{v4xPaBn#M
zg>YTuH=GLp2l)SI#J~7_KS8zN{)y9H4A(_|!>RC7pY-=HN63o&d}>m=)f#a6O93eI
z8%~A2;Q!wc|Kk1oBdP^=&gq{D*G2ySpRw}~sOzrJ|7}NWtfUe}Wfm({T2V1VN?WSv
zutQ}Xx=dr`>te|dNTDSO1=7-rU8>kcWr`IYD)yUIR90CRYxK($6+7%$Ma?vG=&;MW
z=ocN+)MYMHX1|{w&vVZEJon!8d;Z{ZU*|c`=Y5{@IiK_69xf@T;2rS)`-1*=P?o$-
z2K~Y0ebzta6dZ;Bzra7+|KCAb^12lCBgy-$f66KNSNQ)N{@MO>7iG!ouY&$i@;>XI
zatfaAt~dPn%sVLA@!>s`C9kzXKbpMH`lp<NSHu4)?l|wKtpEEWG(WEo`muy${ZmfC
z+u+YT6WQ~tyD3Xv{Z|{FlN(RoXZ=%7!RO%r64akPfA}zE$?La*ej<6F^-nnkKY>55
z)U*B{r7U?ZafavQCX@GB|CCek+@Rl>`-6h@-$PmQ`m&%uoV?Har<{W8;J*X@+4Hx1
zDNA1agMKP`pY=~U1@DD_Km4=(=Tnp=uTw!koxIQbr<{Vhpx>Cg6aLx#_dd#!*W*Dy
zlf2LRr<{Uc!2kX5FUO2H{@+ho@>=E|DLyB6Bzd3pPdNoI4*HF`PryIhe;%MLd3{aL
zA5Gq8{ZmeX{{~4vJ{*OA8D_-#zd%{?dVA2%ChxQUDW_l@{tE^Dzeri~dVkQ*CGWHT
zDW~A;@IMa!?D+W=%97WWpr23PXZ=%7!8-i^1^&;(jF``ZlqIi~7x+9ElJ{BvlvD7^
zpx>DLFZfqrM)ZG(vgCC~&@U$Mv;HZkU>N>Sb?5bd%I?1pM`(Ud1pQJ%vi>QjU>5$D
zz(1SMw<t?qmxKOT@;>XIateM4|Eu7i-M_v=S@K%`6rca`<bBpZ<rLHf{l?ty7tH5-
zlqIkJuj$UoEhq1@{wb%x|J8@zzusCfpC3?`yp9I_O7cGIpK=Nwfd2seD>386;q?*9
zlGo*+Kasr8`lp<NHTb_D{%&)GDf&N3S^8S)*Y{-dKI@-y3MztrW9}pH&yLSOrYw2&
ze|2+CZZ&zI^-nnkuZ91o;h!BJeo9&LdVSEZCGWHTDW~9V@IMOw?D@&hC`(=^g8o$U
zKI@-y3TEN|xA4#IU%#L%d0h_r)5-g+f66I11^*uw%>S2^C9fM?fam1Sr0?-t><=lY
z;Q2wnG52rq&mO;iMOpIt%Aj9Q-e>DiIR!i5@9$gqsUp7Me%EjCE`51N(7RQ@l=V+J
z=l?nU%S$53ULT#C_)tF|^d$+;`lp=wN8$fM_-E@sKk=cy#O)yG<TfNc>z{J!pBMBS
zbFYGbIcCJ|bwT1oeRI&4COqq(a_T$a|E7ZZT$uP!e@D=lB|Ph&a_T4He`CS=pO*Mg
z|HYs$Pk7cp<<x&4{&y6t|Cxyo^=E><BH>y8lv7{sPH6r3|3Ua?kH61Oe5m(-oqJBM
zGT~YOlvDpk_<s`q+53AJCqC5Q67*FG&-$mF`g`I375G07Gh+XFUgAUjw}PIZV(I;>
zlvBS3{}b@f_Rq`m{4Xf;`P3vlTYt*we`(Nf%$<gRcKmr!;zNCN(AOqB>z{J!-wOZp
z+<g~6Wyk-`iBFuH%iSLIbqUY<r=0o^!M_6j+4{F6KGYux`i6vO{Zmf;-^2ff@W&sE
zV*I=^@uB_~LEo70tbfX>FLMR^{@)D$?DqAare&wiLEn_{tbfY6)NA3t4gRh>g(>#W
zS0+Bx?+E(lglGLzPW^50-(ArEn#70tyMw+Z;aUHbQ~v<``{AEGzP~2%q5eBT-<t5O
zf6A%<3H<q2x9)HgrkKyQi4XPu0^yuoTf(#cDX0FogMMS~Lk07Bed0s?mZ0C7@T`Bz
zsrO&o>-*0X{9X48Q>_0Di4XOAf__`Vv;HZkegyvfPpR4dd0pZ|{k=iop75-H%BlYv
z{1;Jw_Wa>3i4XPu+k(%@ZBKaCKjqZ>uN3zA{1E=`ZJ1&{*C#&ISGWPn-TzN`)<5Oc
zZwdO1xt|xze^=r|z5gC#_pLYy&-$mF`WxZ@IQ+Bu?@4^9KNR%c3D5ecocd40|LN|&
zsh_g>-<bHsxw+g!LEoG3tbfX>Uxj}S{Iln8`w}1OFK{b(POdNES^tz%e_7DG@e}^p
z?aNP1sLtiC3Hrez{we1Yd*J^D_&*ynV*j}%@uB`bK|hr6Z2c*x{<HAs_bojq<9~bN
zL;Z5l4<|h9pK|Jd1OIoU{_OQHKlPzHm-FBCd`|9Q5&x8PiQftOjk!<4-wmf>iut@F
z@uB`LK|hl4Z2c*x{#N*Z0sgK#g(>>qmH1FU9`uJ2p7l>T^`C+N-@!jS{=X;jq5i?3
zA5D1HKjqZ_GyK0-u>SWYKGd%V{aC`Y{wb&aB6mRa<J(W*?-mbJ%;)aJhx(TV{dmH&
z{wb$^8~lF*|LpPQ!-)^|`+|NV;aUHbQ~yEuU+6vu@DraiiuHdq@riSDx!ItfOnBBm
z<<x&4{x5`o_WbRh#E1G{1^wZKXZ=%7z5nv)aQ+7W?EZCc;zRvwf_^IDS^tz%zaReF
z;g9d6#QEo^5+CX(f_^&TS^tz%|JU&MpCkFny$w^$|GvZrIQN5~pGkPuKjqY)f&bm`
zcf(PbqW}Gg5B1M<2MBlnKjB&blvDqzpx>DL6#Os2jOhPB;zNCJ&>u~B)<5Oc-v$4_
zg@3mHe<AUq-ha{YIl0+{XZ=%7{e$rTNBFz9VT$#CG4Y}PWYEtgJnNrw>d$i*yuN?_
z9RAtu`<29p`pbfTKH*valvCdV|MMZtZr=wJAL@4n{X)XC{wb&aPWV3?!tD6=P~t=V
z;h<kkc-BAV)PD{BFNH9h&%=oi^^XSqQo^(TDX0E?cf#QFe+`7$^M`LGKGeS`=#M2l
z>z{J!{{a5{e{R|F^E-(T^@BlwJmFdYlvDpv_`eOp?D+P*#E1I%pkGdS)<5Oc{|x?r
z24OX3#Qy(-#E1Gyw}R*7RuZ1|PdW81LBBEgB?vFh_&<{PP~RK$Cla3ZPdWAPf&cd*
z%=Z6B6CdiQgZ^Z~v;HZk-ha8c??3+zp^Ga_F`pkNKGdHI`qhMI{ZmeTh1;Os|4Ht1
zJU?ag`Dx-4=jL+FLBE#ptbfX>e=Gbig@5+^?PrM(^|uH8sf1_!Q%?QI;NJ-U?Ed?U
z#E1I1pg*1PtbfX>{|@~B0RHadfH1}Uf0_7DzZ&#s5}x%>IrZne6MmonAHhG{e}0wt
zP+uMN>j}^Lr=0qi!+$^gv*)+JNqne(L(ubS481>@a_aX5JuXfioW+coPs*u}y!Bij
zN6Bw<KDiu<By_KT4E}t>{IBl<e~s|>g7*mj0QjizKLh_O;U5S8j_^-_|EKW30I!fl
z{|fx&!oL81z3?xC-zj_nd`kE?!2NURcKQyu?!n&&--yrCxy%W0{mY*J3;ssY{|x*V
z;r|K#5#jOs=AWFK6aHIaz<F}+pM_rlel9+@Vx617FBM(^-YWdL;5P}s4E%k<UjqJF
z;SJ!&g})s9zl2`{{%qV=XZ^ni{tDq+!FLFMGx$4&Ul0B%;a%W=C%hMYP51!#Q)O4Z
z9o#>!YNtEF-z5AHIR6fZ%e)`_W1{~s_*aB~9Q<E|Pl1=<I+XsO0e^w;2f(it{@37p
zh0lYJ3IAL0&k6q)IIrtj&p&|wx9C^ED{&r9{l9|$j_{v??-KqP_`8J1|FQ7o+_dn=
zq5p>P^TUPYlXE{4z7c#A4=gCO9Gu@O&H66_f3xVH2Y$Qo7lMCWcpdn>@T<W8Rro8x
z&zD2StHEC=ybZif_#44_eB^q)1^jN&?*#w6@NV#B;rqdVE&LYni}}C^8h$(YtAvk$
zcM5+m_@4;B8~i@u9|8ZS@WbHz7r4yf)8J2k3Q2suAN)$;p9lY6!soz;h5rrs{}%o*
z_=Cd#9{fkbm%%si1P$f>Gx&>z{}}xB!v7uoX5pv7$A$kI{Qn3)x5^jr<lGO0KN<Xg
zgqML=@dV8;?xtr|`JYeD{jTtf!S@Ki6#U)7UjjZO{0i`I3x5UpFND7u{2A_ZemlJm
zyixd@!2d}2TfzPF4tDAS|8wDc!54%d0RO+j-wu8OKk&@O>0RJ25&oy(TZMlJd_efe
z!9Ohgli+_X{4c>*gnu6Vap7MEf1aEue;xeQ!oLaLE&LzA-z)rw;P(sv5xD={+fM%u
zep>i{f<KEl{;|;ifWJ)md6#&>lXGtsz7hPO@MnO3LilsQ9}<2kxc^+&PA>s3<p)HV
zc?I}Og}(y)4Z>dyen9x^z$b*i3H(dK-wOVS@GkIkc%h6s_kvdoKLGw(;co}`pC8)k
zUEqHz{7=F8Z$i1uhrqup`j0z)w!bT{`&~N3*H1aU|NC)vA0Ey>8~Ay-s&k@l42ymB
zdH(Oj&&e%a8v(z8;&JfY>mpw*iLbx+{HU*ZLstKg^Y=b$dm<mfb;dIIjvFIiLHoY|
zZ`>Ps3-m7zZ=aM~mh-x&pq|d#qW)BT!TtGkeSvdZoZdABSG~SYIrVQ0`i;3^oIhmm
zZ=9R>P(K*-OiTS!PW^}A|G|R(`QPvHg`iKr--FvR=96;ze-Hlm!QXwn5~irn|2~jk
z27UT{AX)#E)Bhs3-TnQOdHB2AU&cTG`$L+8p5Gdv`J|lwyW#&&@OQU=jsMfmrH-$6
z1$}wKv-PK(`f2!|hJW_{fByHAJRJ1t_mgD(Q%?Ui_?O~*FYC|08lpOvyRh2lnSP&1
z)<5N3q9*7!=BnY({X1^oi<2Cvzb5Fb5}x%>IrZ1WzXARnE~EeR5+CYs5BlnaXZ=%7
z{UrQfQ!t<W?^pRs(AO04PdWYn1^(B=KihxuzmFxZS2`Zjr{q$<T`tJ+|K2?hGorrr
z+?sMK<16o{{Zhtl-cRGdY35QFI{&kc=i6?lGQP6i<O?A%yXFaePTyJBr-nDSF}vvr
zd`9oe`n*2m(|j)bH-__EXW$p)s@$ueV%>Z_FE>YFoQ?Ud=N{xhlHsX8aBlAt)Y&vm
zWqkb;)LBK0{r)44`{Pu}eQ`!R>WcL?pPT5h+!umR`n^5bex7nR^TVLun7bAIFx;kd
zGoye0_xzMx=KEWEH!$m;a{6x$`i;49_*Y>@^xu-~FVwdOeM7>t{wb&az3}IM8F^vG
zKmU7#z7q85_XuVEQ%?WK;QvF^pY_lG-l4c&uAhYaD|B(s&%D5Y2f|~IKmF1B;S}dR
z+imBkxkR^Of9%5|uX1|NPrNdMO7J%LbiZuvI8b=;|8>agC&G1SE=QkTPQNLaj)xqF
z?|{#f-uI2SS)WPp?|yy%1C~D!e14T6`ZT!#$G6M#y4sQ``DW1HlBZt_d`})fw<hNE
zwfT+bCo|nI&vAT{`~Dv?9*OIrKl%7YO`PXnUmf)KCWv(|y6x!e9J@cx;t^|S(5Ii*
zQ~x%{y?*A8qrMdt+ymZyPvob5E53f&ald`LKX%t!B8fl$G5Dv)Q~KY5+z!4r>Kfql
z-|%_=OMm^4^~t$Zd_D7}k@jKcQ(cGj?cVo^=e)`4YaHK{OP>Q_yMGw?mPAT^Q{dMn
zqaOLY9rx|FHOEER?(CBzKaArG`6C-5KY;@>`Ly$)XVSR)Wg+m#9>4JD_u0k6>_^b<
z)Tg3)0+o%q^A=xE!?wszf-kz`spltmN6s_Cb6*ts^j(oRLSN&!&+V!^ULI%Q=Y^L=
z{r1m9FamvR&}XFK%^x|wDVIJ^!gahW@boz@@?W^M^mX?BPV{0vpKyB5E8Z1(8QOga
ze983-KT*Ht`lHv^xqe~!KSLjBE?0+N)<QiG5hvT?LN{P}pT2j-S^S)?7JPa*@@_2o
zD#thF9?kQ4ljA<mdtd*h&Sa+h<;K7*iN6m)|G9VGuw>`Hr-**i@lCn&kxJT^z5<`#
zyM`{eKK~r_>G;q5pH>^|{N*R#i8YH$)jGZ@_rAn}`d0^@j`QS0f&Vy9KL-B`7e9V1
zndyF+cHHOOjGXH*v(N1(p0~N<u%G(kORnE-SI-aQJ{$Sh;Ijid`g|+YlYZ`8hWRI<
zulZyI!$|PFm&6>tx#za?APp}UIqut?yg5?tcQ1hcAL@TQqko0tn{rp?ZI|=ialrfV
z`4iTEebC>Mr@zIWS9$%Brr0j^?+E()k`lRI^B6ymUK?le{O+Tn&P1O4G8On^kN-o<
zmw2fe<}JCOzTIP}i0ytQwEOJ5I)C7}*Ke2o@ju}I;EOI8N*Z;)lx~jtn!6%(n<Gq@
zVSSrreP0ayitE3AVm;S7?)R_nzJB4eaZdcX8~h`89(=3icRRi*d1@owUp@=}l6OTl
zFAx46K8-(L{jT--QSf;rLCpUtFOBs)cH}uPOJ=%XHaqU~IqdTA6YKvy$2aA0&~%(W
zhu!a9zeDox4EkMp`QHKm8Fzf}6a7E!xX)+er>73YIq~OLg3tF7#CCrW^a)OWIT7^f
z^L5mpTNmpbb>pa?*zQG+`*sh%<?Fl!6Xut@1^s#rRfV^S{%ZI%^+vuPUvh7R&qsdr
z{5JrFmlhmP$8g`W4>NCte(YHze`59T1Alwnt12!3E6063W$%lW*Eh!;-<11VA}zyj
z{|@~eI_x0$Q|sgUR&0I{TOiKpcB6v#?|Vvo-v@mY#<vxBeD)Lhbx!B?N01u%i{byh
zv9*@CMEv<$$GzT_6(+uJ1Fw|r^02#Z^!j5sywm><=x1R-{sG4~ng4@UhIa0QzT&zF
z4x&dcfb+jt(&t};&oz1dc0KU)xjXu|xY5YhIe$g;FGahTY>9kzBm!>CCdYk$t9{A8
zeG<~}@&?B@CEp_EHF5eW@~^!tzGt1s-1UZU*PoC3iF|+Xxg$dNlRobb{F*#|*#*((
z;4|VZ`kZvz)%%ZJmF1rZKCjQqXU=iIUSGcSbze>zalb4-HTrC*%KH2u=&dsT{uq4j
z`qC|LwsW84&JMhP+4jwu^Ms4R@4Dy2MytQzX|dg2>9@^6Z<X=)H#@#5he6&U=C&{J
z^m#n;y90LzF-+v24m=%F$^CzQ_IdihQ}k0`e98Td)BE-6_~e)O1BDm=-%Y)~+l^;_
zqJBd|<lAxGfz``Zg16RX_4B_K^`~6>exgsU({IY9Pbrnf*|}Y=pZRuA%tUYmTe{Qr
z56_$2a(<#uYw$^*H=|Dn>Z$lZ)bsDuZ*d2D@6*{BIel&kJ`YFee$wY|$9+D3__p@U
zad|4}_vH1%2hnc%hoTkl%zi)U(@Q)0|2*&y=e2u*+n;@%bMK9_ww)VaU+lQA=ll=c
zmmXBztWTXE^<@`E9oMS_+x?XAJ21ZOkn!zR!9RM~pKo$}Q|_Y)V*P!A|00i%q0amM
zViQKbD0#>YM1H;2Um4%C&d)&qvuFJ>J(xJj-+_PTpWgNUq!IT^d3p5N;PzKP(Wh}!
z<kQ$S2IK79{WuQ#^JPC#Uxof~TE>~j!g^hsw|zHU8S}sJ>n-<1r}(oP{Hw1!(P8=3
zj=Sr-1TnX5j{6*V-?9xYos02m_Tsn*>)ads6Px6hJK!^p-gyjj-cv+>*zrx~|GBW9
zUUvi8*Ry(cw%sqne;A_!@1!pUpZ6qn(C1$Cw`PDoC?3W3+U~{`Kau|^_<T4o=f@rQ
z{d}_L)=T0N@#oXscJlnOYt9|FyaxQn7rrTT+<!UvZ{Khk)+{ddM~=JxoY(F_$9)bf
za(#Ws?LVF`;|3?||Fhup%sihjpxx)b>76&&I=4PK`piE)Qu-VZKJUo$`FY^!^ZaEn
zyAbu9!GWDVPj};*&*$I&>ha^Y-OY|~GXIyBK7SbazC=pi4WA3w9{F%G)BW;;l30J0
zJ8t`l?Y_<FeLfR!j(h^+)ji<H+9I!rFS)Ne?yfKL*7s4zef^ccX!<^+@#Xo^e^q?W
z1fQ=YQr7=ex3xFr`t$haz|;HE)Hh%}JoU1;2-oXPL4S9ik3awQ>pSL-Z+@b_Kj_ov
z^XWep_;;e%{UmR7XAR!RKfmuM`rIG%ZYRJ*{i5SOpYoe8c@gLNSHItSKK+FU(}f)W
zHTV_x|HngCf6p^wyE6@u;wAS?xBlMe;m^I?^{{k$HTXAf`M^R-bGf&I|LFhx@O_pK
zI_}r2POjtL1N|F%pZ#5{|8wZK;S{J2GoOZh8YQ2vL%;fmQOJHZ;!a3>yNf#_uf+EG
zH>cl}dl0T^{!ekoKfk_H|1o-fGSmI?BJg)!atS}u2(#P3fAiz@ORavV<G$S*cb@Ji
zZpU|Ee`$96z2)<6X|Lz!IQ$EuA?LHn{6AlA_m8372dmz3COXBR{y9<aa}ZmL?H&m}
z7v$|<--6GXFFclp;jA75fA(if{?huFG{t<b@9W9*x0ksK4d3qIZ$~xT9WRf3ZA+F{
zz~{Uz-(9x;n;rK)r@A6t$IMqbzA1;31jm@e_Q2E6-^n+lKQGDg<xZ#f+xJAzD_>yS
zy$8H{?5{G{L62g+7M>l|gIMTGq22WFO4#ml;OXbN<fZ4u^%|3L@_zJ(Bhnv!<$Qb&
zOE}Bn`M~pD5$pf+Uw+6b(&<6?Z*}$hsV~0deh>Ns+kXH50)>~iIKIjJ9~0L3MfZzu
zckz;_rq3|Wm)y)Sk-r`Ox!?WN<~S$*{7~@!N?w2aLeN`f{CzR#zm?2jJ*)8l=|63}
zJ(=l#DREt4Q|>i+{`X>gZNv6roz+pFSkV6!j{EiP>xr{YLDBBG?<d_K_`82j7IMGz
zf&b{5Pk!F=b!X^(8gZV<c3+R}d(7qMC-V1(dVUk3`{@=B(_cF7eahY*-&caqxZFLT
zyEFp&T#Wl3&Ckkme}(Av?!)#lQUCSO?)UO?`!}|WIa}jmx&IFO7v<^8-T9FBZ@)JR
z`MJgwj&I7PU4iTM2FHD#58OF~Go85H%|ZV~w3g=ZUg*F4*<C+OX1ZTK>$q=sLdMmF
z;PX&ko&Oqm`uq~>DQWg~z9&zAk>kG3vA_NFJ8ip-L4RYO{>{+Oyl3v4RzCoK_?>Mp
zw){r7|NHt+x$((Q+%A9G9NT@-Q_p=@n1LUkcHG@ZI+u*~kGNk#{+Gl#^m*9nJzsul
zmOl!<j!~QX|8m@ot9k1+isP*RyFEWqU-qhW8^t;C=d&F5?ecjE3`4mW2K{4?-|^!Q
zqNhZCOA((P&_Au^4PUkXL-22UVWh0*Zs_lN+mEid`WeSJ<sLqVtPH<=6F!yOBH($#
zV?qC`JpHxqIO^A{`#Dk1cJFfwdVahy%SYTe?s=U%?)i!Or(Wahxg*d23dg;EKB#lK
zt$6)i$9+GX`uevQfWnJ+@cJq_&wLB?7v6Tkn$`D)c7Ko{<}eC<?m6GCNoKlVKJB>o
z&%G^De!ltDpts8S`$NG$eg2C6Cjx(3-unI~_&oOb(8xy`tXswJ`h0HB)Bld+K8HV>
zdiPJQz8(C^KP>x#<<E1Yi?4t3vPhZ#?a;se>&KR?{!#3Y$DWzhf7t20&&XYoWBAT}
z7CvuZf65<QpT7ZrP4C4wTK-SqpZ)obyDk48$Gv~UK%_g|@!L-oEs;;4UFP{B$9)bD
z{p}cfZq&cZ@l83`Nik9X=Ab7{U-!ai`5EUON@*_lPVmeB=$X4Lp8#)My!;W%A1LB~
zpF98a>(&0UsAlK-Dt!L%*oQxDeZK9uyAC~<jP*YT{ri7*1<v52;=)%)|F+urp4;~#
z$GI%M{Oe}N-SaAW{pu}6^w&N=`sdydT{u3hVZ9Dwz1VI~@OkX<#~+*;v+dpq{@Lf;
zxX1DjJMQzLxDGShsw3~iDAtZd?uCBk6H&<Xz`t>Pllec|W$=06qUclQ&YS$y7hiIZ
zhI;VEyxi-~8+<+G?!JPbsQ;hfe_38`7riFx8;7&{s~z|K^MS8@5+h}t-ws~i`?a)_
zx>+|lzA2aPDy;v`z!ARFkza@Xx)f*ath3FHv%dbJEwR19_>%h=+WlXZ8{Y>MUXD2K
z^#?acN}omO+yD3bSFL_4@;QO4XbxJlZu@wj`SY?q71)mD+auqO?f4V;fAjAq?z8?E
zxC5p4DUs`@C%rc2d20QNk6L}b<C}8(^0vzx1OI6vWo|bH{z#twZutN9`cWLg;-a4h
zzxeRpcP3`;mlo&X>pX(>VQzmN^i~;vf93g6U+2yv{6zhCoZkEJInS9mJNHwxd)3L0
z{3lR&`K{Kp4_N**$GuO@pG7)e5?>pF{;|iO{lRa1-s-P)d{gcn31U9Gp#S3^zWlCa
zru*g2puaaSw`;N8PoO=n*Qepr(>MHg*5^U+-j9B6ujM}s{{4CW{|)`OntQN^#id5v
zd6-{cfBoSnwtKBx5zkkv0#5idf6uS)t_a;vuJ2~Y{eC+6vx$!<Gu<yA#&v|h|LrI4
zN7n>>WcFtX_KQC37p!MxQ><s*jiY`df7w&9y`G!pZ$&*Ho!|GfI4AzR6Z~B-_}q^y
z-|R*gzrJ(Lk<$OL(|ca~_Q(&SpUyk(p7X)GG>3l){?<AE{$D|lLD(VYR(7rTxj$Ke
ze6!;|&+qU4Smr$Bwcv+Jesw%q$o(?z#tUEP375B@SpVG^--ch1<^J!+z5d{nvi$m3
zPhS6d(4EJ4eNMK^aL}iJ2f_Lu#(DlB*T4M4dM1PZx(MA*>K_RF!n}6>KJZWF>F>QD
z*0aOa<tO@Ii~h`8I^;id{m<9ma&=aJ;fBboT>tVD^%dA3`(%IosjJ6tmur8tHQDxl
zxsu<H{15)@18?>3IsL}{;@fS8n*NtS|D+3_{$gtV>s5|#%H5rp!*xM#mGSo*v0qfm
ze$kEb|D=rn-NFB!JpXqG{>!9+GW_=Ej{Evg;kY&g{$Qx*vByWh{kp$R7IMEFhrUdX
zgZ~Xa_pzv6K?N7J`So=-AuzGshQMEzSLYiX_xa!c55K`0#|8U?{s(#bC3ijS>py`5
zEc5Sn{oeCqZv5~Q`C<6qf6?z}#>vltKm7WcxBz|*x&G&Umad3^$MHv>68SjBJ^KGW
ze0mP9{G&DcdEl1B-_LtpT;DHV^A2|gmQK$G|L%jo*`89Dze~l}Q}>og`P}K1Sl=D8
zzI8bNJc|8-^<M@5v6po1u>M;e-<11BUd}fMepeoUU*Hes@e%A_Tje}w2JJ5V+v`4P
z+g%7guTK#B$!g#~&GRpF(y-nCBrf8gL-o_;j=Sr@_{ROD&+DLHdQY5n3W@>8eSiDT
z_kQsg$wKazQSiI|=YrJC@lSz2^4v}&9hdsD<C}8#<<<EXjKgJa`}m3d<dLA?oTvYF
z;9rPh_mlOXkAAon{g6J-_=8ygeJ}g~cipgTHQGJw&ZqoDeGT+a+y9gQiF4x5S2(^Y
zw<WKhU*Wo7>=jW*pLX~hX{t$2x}C)T{j=XLtrutY{n0-eQ@LJ~j(a`NDvrg)a`V9-
zZ_LZXMfmsOQ!^69^H}Dz<C}7C$y=|dZ%wl`_PHh;XZbI5xxPPsa;&q=jW>QGe@^gu
z?D6?`z2c2=PW;*E_@>-t2`a;HlNirOF}l$w*VDJNV`pE_=H0pKA-?I@J=ouyyy?ER
zWAL`Vu3U9zKzsLh9_a1r=-JmZ7~c2w?i}ps?7t<vxuI)cSAWm$4#JMU{{6eUGP;hv
zI|p}n2eh-VW8lC*U)R3q?B4cw4IJ3pmFwuZX?Oqb!JWH0e0jU~@7ve4d(hK?!Tti&
zXghlb3d^%I%o4kMyLR?>xElKQ_v~|P($%~3Hf^ei#JIS^y9N^%Sw4TJS<)4@bC(O0
z709xMW}BsV@42C)t523mVV<&M-_E=sg9T^gFVWrEU(mk;GYT%z(KS@09k&!`<}c|w
zSJ?V?JIC@kCx4lpH{4L9K+efurn8Il@>@#h<uBL2|G;380+U(!OLgz>-Blz)%*kKI
zZNtKgU`GBDd%FgAcJ3V9>2|Pzn+h+RC&_p5wRY^ftz&m@PuIR;n=nt4?-Pa)*<<6D
z<Q%ii&dyHuCbK;ZHCnfW7SI}Mw7d83-P<!*K%SjpmWaD*ewWX1qrbuJ_4#T;jkfPV
zA+4cCyL*4%Z3T=iHfkj0N88<Q@E($_Uud>j8rc<Fy3lO1v^Vb`?C5s~g#yi*Ic6De
zY37)1E_2K>*kt{AeKKz2$c;X3u{^oOM(wwlt7vdnudGCNhFQXIw}MM#XP6~!KG4;F
zn_s49UuTzYqx_j>$-SL>!h!`t)>&pLzh(CH7Tq*<mRZVg0Xs`Jj-6$e3T4=NX0g0^
zW;twCx1{8rone-U8!&%?42OPaZ}0xyI|sY`!Ob1nZ|T`>`)HB5rY*miKhf#fy|+{9
z(^;}q=U#W-Qg9(NN0)KQ7g;8qW0o0krwko?2lO~$u~GMT-Ow{I*wx?Bcc8boz+wgG
zo8>#Z3M$NYE}}3ViGw@S+9QGH%`3JX&mK(6nPoZOEN?0+&~kyfW?6q;=T8<ocm`tH
z&6_97-Mo9>?!6uE)UsosCx0^ycI3^M<p+B9-QZ3Qy+NPba(j36?3L7f1w~ZGYjCKe
zQ%@2Trn-*32Xqh&T5_Y`)8EzAF>sTf+*oYXuGRxCiQ5J``g+{;ME2w$f2LV-(4C@p
z?!R?kv4soHH_Q7rLj&5V<)Wu&fko^rS?WNaI|b|NxM85j9ld)83M^beVLWj0(s65N
zPob0w%{EJ?7dgcYiYSan*S>H$Qlx+abIr26SShk_q1k3>H-fv1zhadam}{2Bb!4%H
z3(Yo5`-8l%d0=qopl-9gd9vKV-mbm=x^=MMoi-146<WNI#JKG0-@mhS_s)S>!_5cw
zyL0&duARHP{fUC~peNKC-vhhDO8FJ&+|{>JoC?g%F6#!>j{eTu+>;&IJ=HCknU!5C
z45r1FlbKj@uxqfpV^@Dq=MA{6khWK7R)M9`UTtc%%Vq@y9P)1(*u~9Uv$lThEqIxf
zone;no1)+n*%<|w=s3{V+p|wE?9v6ze6zei+X%O6(oFp=6^lh3_i&RV_2~>*0=spA
zMa&#oX5hAcyF1*Tv%61kw)oOyt}MG#W}5@DUsz|$(ysd!Z8tMdmh1Gp`2IrGnmJ~f
zz1=<W+_7ul4L$qxa93ciS(d}RR~0x`7Mg9APCI)?5rZNM<8f<$k2{Rryw}~6>(MbN
zZ=PAsUvs!qtgin41AXplcjvy&-Y&g6Q&eMo`n&e-zr_y+XSX_=EaNsXxWC_>s>HjE
zMe6c{coCKH+O^XU_cwHO9@wj=R65Hn<@eLBK6h)Tug{&+$*z(=(=6FD;134wd-Sq<
zu*F90?f?w=n>ROg+_FFKPF4QQf=eFQch+Uo*=A|K3cOLAEmY>1W!x&n!4TV{<CdMh
zd7Z7e$T;~nU{yTfe1SOhhvWGE1O2<ZI`;JM-<yA9)wfebC0_nwVQ)vc5xaL+*oXZ^
zwQNIgS6nELgZ(@A4fO5zw;cT4`23Lb1>!KUckh9Y&i#9L_UtRLxXd-nVib2D6Z8#q
z+`4n0zac;1E~g9JLVY5sarG<jhii9PUZ5H?$1Ky|<?h4}#8bq=8@h<Xc<gq2lN;Ln
z>0V)r!UE&qEB7b(Zh!9Cw`YHW>SeB3){QWIVd33wY~0tS7g~j8o27lrw{-On^z3(+
zLWBK<N0NMjaY(O}-B~~wS2}j<<y%pW@#%4gZ|qRGByeMnp8FOT8K=&!#EHG9fYn)4
z#;b6H9sBlo>~c4P^xWzHLv6fy>~KekI7Ae2J*&?6;d+L4(u)erHOuC;;m?S~p{U0C
zxc=1Nb@PFq{;p1chhdMu2fU{z?@q2ip)IO2e!hS9^zH8G-G9Tb1A2oee`e7oox!cL
zI@zTuFb@4g9ew+Ib%!$4YP)vd=05iegIWIVi~jt%W?5fIU*SOu*q?9jb~hKphnH@A
z=f|ZD@pI6<9sBzRa+}+>oLe7$ZV5jx4?i2i&nv>uE5pyL!q3L=^Xl-kzAnDRrR(G3
z^>O+7Xiy&=>Z3({^r(*}_0eTZblHL$qRW=(vL(7~i7s2B%a-V}CAw^hE|*7_%cINX
zSe58<d33ovx?CPzE{`skN0-Z^OG9*Nh%OD$r2&aVmxk!l5M3IgOG9*Nh%Q$|mn)*n
z716~#jqQ`ZBD!1=U9N~OS45X9qRSQ0<;v)CWpueRx?CAuu8b~MMwct2%azgP%II=s
zbh#?JToqleiY`}0m#d=7Rng_D=yFwbxhlF`6<r#mOJj6tj4qAQr7^lRMwiCu(imMD
zqf29SabLOPBe*)cTpeAmjxJY6m#d?T`(yv0j4oG4m#d>oeO<JvuZuqQb<wE4E;`lM
zMXUO{=v7}A&Fbr-TYX)$tFMD!(v9KAj?A9SuFSs7&dlD-?u`Cij}Bdr9$mi$^`TGK
zqf^(TSJ$Ik*P~z8qhr^jXV;@^*Q0OOqjT3^j`c<Nu1Ei_M+dJ*53ffTuSXxRM<=gG
zFRw>8uSY+xZ$N(N>GiIw`z!DMz3$PB_)GX?kH-u5k%qfhHn`uP2XOwaHz!v%Si%t=
z2Y4-(&cQK8X4u1kJ8};8xR0J(Gk&pK_xFcms2L62*)YzRSeT64g#}p$_mNYVJ0&ab
zP(YA%@RyXGUH(auu6?`pQpuH&KmTmYhx-rt>yb4{L|G@4dbVN;O0q8gVC$|%&k{)?
zg?hx3<>ImOWZ5dzBYtR<9|lhn{haJF>BlMgOJ(O}m-8nXw)5pLT}YAjK!0@~9`?B|
z<xZ3HP4Xq1+cvwMXtNtiv2Uasuj7XPoqgTu9@y9A&b~W(-3MtYV|t#1&kB>qH@j@Q
zZgXR5^rwB#zMZ=Vdv56&bURkh-md=C%0H_RZkY@e({}7RurHkHW!GCR!=0!6buTJ=
z0ylGq%O%Apu-tx?XK0j9;8~~xKY@9nMV_#gC)x?}R-wRN;Tj18V1biR-(_|V40MGD
z4XBF`V5OfJ-nQ3dme~im1RKp>mU1rq_~gt$>gPY%vL8p8S#Fr|Pmp9E>qwXM>k^+_
zVJqqFA>88e>lQEa+{b6(a?@YoQSSPEVsVpcH}B(qGtW25OZ#+Zi+h<Hz{6o6-TSx`
za1YBL#(gbCZq%DrT}NfUv@+{qYtpsLJd~HsuK0}`({k~S;8U>ov3(kTL%JI@?sHCe
zBYOXyJ-zO8p>XeLAb0CdH#Y3q-|z0daA*sIhkG7PR>j_XK*U^W-xWF!?Do$9xO)fg
zgJbt`S6;^c=8pRqu0M$kM}2N~tWw@{VtWU=cDuf~zvIT9J$riaIanGQukDN8L`tP;
zKMeOFu@dRf+p)X5Yxhm|c<&|t-o3kB9(yJ4uJ{@8cC|Zq_qWW_R?^)teIg>iDcoT8
zjWa3NKha^`34xgML-i!A^Z_(?KtJHFINd2!M>s4|g5A^^xy|8LYj^ie9XA|spLdJ3
z3y}By&Bv>BDSn&Ota70NyTF)APwk@F{IZWZJz*;ahT(Ku*yjt_I!`eCX8?Pcz3BvT
zv<Nfe7Iqg1*$R2>kFA>Q1qDtc*r-3nb9Y$7b5>X^>?CGf2zUR(lQgC|I|ij2$_Tuf
zH!u8wMw&$IzW!G6!0vrvFZH)kSe~2fKOyIuh`%4m(oeB{i++bFa7&SPegX5L1XkE&
z>;*|<so_o+5%#dSLi=|5`!3cta~Fs+3irRW_6!ai$v~W6WcN;YM&>^~4?AgE2A&|p
z6M$*Ne)AW8WG1Pz*oRNPaf~y(tl~(M?RtKvb{jE$Dl%<89{$|n)P0ud{chgt?j*-&
zF5LL;K6;1`r28j%`*yky#{J`5CS3iD$?SN3#nLC0Zt_pzNDtvr(4J-Z8p31y{;v4o
z&Ktt{Lf3#j(x*K-{Xh}h!Czpy0(~#>Ju^PO#vFY?etao(dyyJ>j*i%Ml|q+WXqA03
zd=g;~R<gdX0Q<y|U)tAX*0N()mrLC}u(NY8-c4r#UZ;;|ab7YsC6Cg1=Qs+v+XViN
z->U4p#W$;0qCfeqzVAT%L^16wJlMKN@LiYMd7HaUn`}dWBnejo-X-tQXLn3{*z>z|
zJg1Ya3f~PcFz~uVP1oMOL4TFaK*Hmd?u3R<FQzNtwv=ly*?aT%5{|anIb3f(IG-B&
z-6wexf$fJAJiTJ>-+61tfcv!7-79v7)t>&F2X@}#cL*+Icf^#UWj@WHh>Ltmag%@g
zXSaJ+r>i48PTJu<g~LOpY0WW&{DBCcMkl>Fxr?7J8q1MQg&LDj;8>*Jwna`$O-~E^
zYiDoAf!=rm8a~7F^FxaGaKnvHVbh~`CXbM$mHGJm-1Hfabe=CH+zeOSc&|uSC)u6C
zkv`oN=E-<7%K4riuCwu6g*Jinf^2{C<1ru8Ps_|aJFPzEJUH|$({n<1$0NCJvCH+(
zow9BFajeL(fLCsALnIGHa%1{@<xv*S3L7f#u*tbk_=uPZ(>H=`%f&NW1JBZOo|h*(
zpB+^)qd1Z@=Ml+fPfv08?CgnuV&+z+YsmdASv)`HD3_im+h%<G7*#ni`RaSza|5^Q
zu`Zmuq)+sxTiwq{A64M0#eFn>Mo)(Q%&nZ+_-^>)^BC0eT;Oawa*-2spH)0cxqWHh
z;67aLWqT0)3!L|xL$jG{Gds%(L%ON`-tQkWi5~_h>s9E(>NLore>rC)>7TJArv7xn
zKee9haM^*o<JKN`))Q`wQ6gso;n|Fy{ksR_hka>le#;hk){-q}H@wZrJ~D6i4&Uxs
z?x47yn|Jf5z(DC%Pyg&AE!lOMvz*bJYgCMlwrX@wJchxw^hFoC%HaG0yL^H5q`J^L
zp5>BJ@BPpwZ>063cnl^y<{F-&pxEsRu4m#I()_{1Z^i@ehTA}&JJR~Q07be<xVuuc
zuOxjxIfqLRJZ`1qQN-S3NN4*3oFv)X(`SXa2Ikt>*N=l}debF7D3SI8Y)Sp|Jldr@
zxg0rh-C*{7E>dW_$v|)ZmW)dkx(@e;PM)M;WALOu|8x&4!m}saTU|x6ALDd~jr&;h
zo?+rlw{)S;nbHXT(wU1+Y1^NMW<Fg=h98{qB=^Sn0YUf!NVyCOkH#0dg~d{12C}7G
z{b%b^$Spaev&Cb*?KK<jvWL4#;kc=-@o#<ns3FI29~7S4F;5g{gFM@Ol<Ho%-?2OJ
zFqORs^zHfD{e6^7n(>sZ*zIY5Mx=i#flZd)fQxtMWaW!JD&&{$b2n7oElPKhmOa82
z8gi2TJLwr1_+(iG;tv$@kDl2P+%{)lN^aW9vi3|e9bnvoc?TALu;SOkRqNAqm)rhE
zs8|-b-(!2z6YfZIe)IozXNxx`{iu%Tl}!lQ-QJbUdBuk>w}!sY_`Z|;=|b8?3kK_h
z@$GZp;Efs2c_lvJ9$-wKr%wI+*nn%|Fh<|Rp6$21+Z6GyHCZ*y(or|L(mb$_*P5>L
z_-BdD%KGE3KM=(0C06Sz;;l4$RbAw76V1tq&qf~g^QJDFyn!Y@&06S;slcO7rU|S>
z!AA(NCxzSUNiuGiHdi{tIK9w*>gq3cgM|?%_YIOY<E{6&jyad6+j!#aBH+<o=j8o`
z5o>g->d(W{ZJPP4;4F`s(;)9Gk28venC=GoSAkeva|PwM_CUPIp)qzk)5Uy0PHzCF
z4R~JYj%U(L`ru#aj5ow@?C?W{f6`ZXfU|t&nAYS^Hr(@dJ%i!+)Y0v(E=;8yGvoc8
zWR36z0pY6;2=yEoAAp7XEyj_byvSI0mUC4fDGqde5ZDLearnXp|3<#YBzw>}`-L`6
zM%+k^=XAM3`sWkm%*5U6^G!!tBZnf_jpAdc=4cdd0Z13;P;7d#UkP^)(hUs#J#NG(
zwsYv1i{6nQZGAE<!z5qiGLWlf{}|MaEroCHAOn2RO^eWQyp;Dv`5XTG-LpQiukY!1
z4?>x8irmLc_Xg9U3Y_~FUOf8<aeCxP&&<<1<JnG9Wc7Kj#5`>STy1=Sk-aAox~J<R
zyLax}?S@-74u-qJ;eJUtq0ZZE$<3F<H|}OUVF`O`xZVy=t6=%0u)L#*$=cqJ$*#8j
z@P+OA(hFRk+dVdH>9by1F*wt|>0hAhTkm4~U3$diI?FEQupbk`*Wj=%KL$GLZrJY+
z4^6vE3->sWzlYLs;PNdUJNx^?w+JP2z13?T9;XI<KYJ0Fw>9%lrtB&fSd~l%iCcM3
zd@3sK#n@PJ4e3|-41~qH!6NKO$zOW<8TMSUz>Sc&{j-0Ak{01=KkK>`K8xU)g6R%i
z0Uuq_T`2q4E?g^Lp`25t;|8`*@>efu>265IA6?<W8P_`o-RA-a_U+n#z}@Y-^=9c&
zz8yLAWOtvmd-=8Sr?svVh7Z`{pN;r~vir-p?B}lb^KO5p>6Qu?16{YcZ}Q>AlszqW
zk+aLEkA@UEbxKD%vo3anr-y!~NvH7Wl)1fVH_#Igx2c=o3p0;d`IPh;G2LEn?fep%
zi~bILO5=yicw*uo&`X!`3*bs1g#|9a)0trqu=nrn+WGCA-jv`UEtsRA7no1rvz@@t
zv`_P-jfVZ4@tW-sx;#eryzgi-&4wfkelUyiCg~P#tNMP|&p*+_9}A^@-|v=kdnkWl
zo`w0?P1@;xgFiS-x3&I#2Iu(Z%q50~op=Ap3i8G*J2PB~yGykEn-}=24pxxvyC!(M
zBgkzwzZ-@_tob|OG(NW_&w8m}a2HL_V0;OC!$_UOYy2=Wd4AMfLip(Lh=g5ne+<uj
z&V<1$3|d@i9$Nj%6u5xK(C9xX!Gy2p%{|?H1ET*b$miqxAgeI{8N#c<FLL}Qe0Qfu
z?(0j#M4xNm<G$uFO!Oh&2ChE*(pCEGgwH|f=|hgMbIhp^zonHv2jO!>e8`U$sb|gb
zgJyl3@QsnaUCX<{eY@#@2gv1m!7mnm$mo5E_n^*E;a>$G17{A@j|-=M5?u3{GXB0!
z_ch32ng)N4d$oMV=zS^QKt24wsmz(}9)+HDQa>x4djEg!{G@d*n|5uU{Qh9g^Ni8^
z5}D7s@KdNihi@EZoz#~Ir@j<i>*W7m<#uPD{(GeTq<L0?GdJc_C7kV6gR@TRYlKr@
z3$Asx8h@K-8@T4#ZS*$JUg3`;&pvS0$vg*zQ$Gx@b^7lI_LJs$2wd|VHF{qP^BEJ)
zcE`b4C-oD;sh<SbI{p7^@DuBd?{c|0aLses=xv@W!YlB7z$d_2C-Xchocc9zt@E_;
zxBK-OaLsew=xv@k_r1Y>V!vg(CE%=+d2SF+eJQxsS!4Wd|EvYqJX?+4=Gi9v#mI9j
zIO}Ad+k{iU9bD_|H2yZvZg9=B*XV7YeZtx9AUNw}o<qW^9|qStCyc+%a}r$hoHcrz
z=bZ3n<mvzKwx3uh^IQ;4{Svs=dEEHhJeR>W&lRJ$d7co?c29z{PUg8Pocc9zt#bqZ
zAAs)frQn)pjnUgYYlZ(l@~i`Aoy@aAIQ327T4#&#w|TaLYo2XJZ}Z$Lob7G{XPwNm
zT{!jI!L`mI<8S-tFu3M9Ve~f7N#Sono`=C%C-a;VPW=qH)_K(U+dOB%HP1Ptw|UMB
zXS)mFtdn^z3a5SvT<csl{x;7waLscA&S^QGGavtdMg2tHgFMT?Sts@7!l|zW*E*|>
zzs<7-T=T3odYfmRaJJh3&N`WAqj2i|_qzK@>ufjvHqY(gn&*(w+x|H$d>DE1+JSX4
z&k^X!sUHQ`I{p8D@e{`-o_|h&Yo3!vZ}U7Xob675vmWL-Eu8upaIJIE_}e^}z%|cR
zqqljk2_HqCr@&b!^E@q_`gL%vv&1)6AkPipnrEre`(K$)nQ*pS4$eBMuMkdsCAikv
zX#8!SP2iemyV3h!na_6NlgM)iIP0XoQ#kd#;9BRP@wfZ?5V+<!Z1nzD=ELiCj!SHJ
z1bWs<{UPDhkAiER)8O2XT+?Bi0oObijo$yte3pdYk35fovrg)d3#WbsT<bh({B54A
z;F{-}(fePS53d)QC)+&@J?o_YjBx7L!L?4F?`xiw$V2mN1ZO?Wr%Cu%@t)^vtdsf{
z%qOS54P5KoX8diQ?ckc{cB8j>?hwv)JHc5G^Ys6R$WP?d_kwGkhm617-#Jcbp3_F}
z>tsGN!oQ98NASves6Q&4`Z;i|a{-*&oyVg^aLsec=xv_IgtOh_;H;B*E(@oA1zhVq
zWBhHN>)@Ja1y)4+XQl8*uzVFb>tvqQ!l|zX*E$=FzwMum;F@QX(c3(mg|pojaMsB@
zTZL2K2Cj8>8-JT;FSzD;$mnhV92Ndw$a4&wbu!O!;nYupYn@ZZ-{v_Du6fQFz0LE8
zaJG9CoOLqKS>e>rfoq-1#^2_-0<L+UF?yTly6{bSpL74W$WN@3d6o#Lz7$;REC<*9
zy#ieGtTcL?XO(caTMf=SnP-h~>TAKZ&Q{}Z^K1jxJiCqF=GiO!66Dzj&N`Xrpm6Gk
z!L?5R|GxdCc^(4SJV%Y*<~b&u?T&-9PUblwocc*{t#j7++dSvMHP2<Ew|TAze+lwD
z0nR#^=SktzuYqfwr;Wee-_L++p6f<$^US&bJIU?hIomA(XPwM*gK+9g!L`mB<8Sk<
z1=l=Vjo#+jCj4sTxfPssGS6+osoxH+b#@wmn`bw;=GklXHqSocY<Ccxbu!N(;nWX<
zYn>Cu-{v_9u6fQHz0Gq@IFF0-;H;B*E(oW730&(uZv1VY%ix;liqYFVPY7qbC&5`K
z^IR29{TjH|xxxKkOZI=8XDPVmS!47z&syQvp?}tavrgvOAe{OpaILe&_}e^N!8Ok|
zqqli(70!0IfwNBL*)E*=?ciGHkny*94ufl+6Gm_IoD{wbc^(F5oy>DeIQ28&TIW&Y
zZ}Xf5*F5Kp-sU+kob4`vvrgu@D4hBwaIJII_}e_!z%|berD=b*d6o*_hdj%`Sts)>
z7fyX8xYk*1{B52!;F@Qx(c3)hgtOfSaMsB@8--Kf1g>?q8-JVUc5uye$mngJ!@}Q&
zJP(4iPUblxocd94t#jP?+dL=0HP1<-w|O2G&UUB3Sts+H7Eb*PxYoI7{B52~;F{;E
z(c3)Ng!8)S6gcZ-o~MOVzYeZ-mTXM-3!CQ#aLu#S=xv^5!r5*)IO}Ad6~d{n1lKwn
zjla#a30(7RH+q}rcHy5y|J(u2I+<suaO!)(wa!7~Z}S`i*F1-f-sX8wINKcoXPwOR
zkZ|fp!L`n5<8Skv0oObijo#+DB>eNp^B6emWS+-`Q@;YPb)Gc-HqTXX&2!D@ZJwuu
zv)$9+tdn`35l;O&xYk+W{@<~mcpVqt<#LtanrEZY+dP|ue;s)?gR@TN*&>|!HgK(T
zoAI}Kwu5V)+l}7lxkEVH?F46?%(GiK^}XO)=ON>7`{yXQ<~eQjHqRO1-$kBBz*#5r
zJSv>}IdHAh|DS6=al6Alw+OCzE*ZVe^O$h9dmNl~GS6k<)USYRoo9@{&2t@G^Q?Gk
zx?VQVO5rE4!d2j`lX+GPr@j_k>ufOowtqH)Yo1L;Z}V&x&URbCSts*s6;6E{xYpTi
z{B54S;F{+lqqljE3jaCs90O;a%yV2g^^@RQ=alicc}|0Co-;;o^E@J)?H&bZoy>Dq
zIQ4VjTIaIyw|TCBYo2F}-sZV3{5RYo@sHP8C-W>3PJJo3)>#g&`+Ehr=2>a<HqR>I
zY_}Smbu!Ny;ndfHYn`pe-{#o{u6cGFz0I>%_$J&h>jP(<%yUpU^~2y==ZNvQ{qqpG
z<~eHgHqSBPY<C=-bu!Nh;nYupYn`*k-{v_7u6ZsSz0Gq)`16qG32@fQJWmRzehpmf
zJZ=1Ko@c-{&vm1>dFD1{$A7k40?s;_=LX@_mx61ZHOAlOSqrXtwi><7vrYKr$a5<=
z>tvqWgj2sAT<h#K{x;8UaLu#V=xv^T!rAU1IO}AdL&B*a2G=?#jK9ru5?u3~HF}%p
zobVRpIS<Y{ndgFV>X*Q^&f~`4=D7^6d9E0}&GUqCwtEtsbu!OY;nc5zYn>aOmiB*}
zXDPVmS!47z&syQvA<sH+*2z2@gj3%Hu64E;f1773xaQer^fu3}!rAUNaMsB@+l5oV
z9bD@iGX6HtVQ|fJ!su<Dlft`@=V5Tx$vmfoQ$GW)bsjbTHqTjb&2!G^ZJzVO+3o^3
z>tvpb!l_>Z*E&~?zs++ET=U%U^t3<QJWGWSAkQ*z*2z4}g;QS%u60%$f176wxaL`F
z^fu2r;cT}7oOLqKM&Z;qfoq-Z#^2_-9bEGqGJ2cmu<$=Yo(I8MC-WQ;PW>pj);Vtc
zZJrb0n&+g^+dK~oXS-A2tdn_83#WbtT<csk{x;7gaLseo=xv^B!uh%NDR9=wJWmU!
zejQxvEGbX-3!CQ#aLu#S=xv^5!r5*)IO}Ad6~d{n1lKwnjla#a30(7RH+q}rcHz_L
zpF6-=C-dwSPJJ)9);VbWZJtBmn&+_5+dK~nXS*Zdtdn^j5>EXnxYjvs{B52y;F{;6
z(c3(igwG<+W8kclc^(%|{R+6&dD8gXJXgUr&o!gBd7cu^c29$|PUd+=IQ8q`T4%*G
zvinhd=k9-kYo3ipZ}V&t{&nQp49+^4XNz#^+rYKXZN}f`*$%FGZZ~?H=MLd)w-cOo
zGS6<|)c1mGorjFS?VqFIn&-69+dOB4{}b{&0?s;_=TYI*&w*>53&!8(xd^U#E*ZVe
z^O$h9dmNl~GS6k<)USYRoo9@{&2t@G^Q?Gg+MjKnmBRl6c~*h5PUcxHocdaDt+T=S
z+dLb=HP0raw|O=TXS*%ntdn`R3a7peT<h#M{x;8EaLx0O(c3&ng`bD#QO3YoC-WQ^
zPW>df);VSTZJyKMn&*ts+dPj5XS+wiSts+H6;AyexYoIB{B52q;F{+dqqljk3%>|?
z=AIS%GwWoYCBmsM1=l*u!Sn8af@_|YMsM@163%w3!C5EstPxIqEx6X%YW!`UZQz<`
zx6#`?dxgIgdG>*`PUbl%ocdvKt#icq+x~e7T=N_?dYk8%aJD-R&N`XrgmCI7!L`m=
z<8Skv1J^v4jo#+DBK%dz^8`5SWS%F5Q@;kTb)Gi<HqSHQn&-OF+dOj>+3}z4mVmQP
z=D9&Q^`+oiXN~c<dDen!o^3{N^V}-@&B${bIO}Ad?ZT<w0j_m+8-JT;FSzE}XY@AD
zLE&t72%L2?&tc)z9|YGrCyl?&^DwyPIcM}X&w1ek$a4Xlbu!OI;nW`k*E*Mtzs++6
zT=P6(^fu3v!rAUBIO}AdYr?5N1+I0L{&w2`ZJuS|nrE%i+dS)pza4otfU{2K*(jX)
zW^k>u)%e>y+rTx?twwM2+$Nmuwu7@y=DA%s^*g||&SB$k^E?Qyc}^O=&GWGE_ae_J
zaMsB@r-f601YGN!GyXQud2r2h!RT$Ci^AFN5;*H*p2vh!e;i!vTr>VQ&r{%<XX&%k
z{%rFs6VB(z%fVSE^Q;g~eHFOYS!4Wdp0(hbXPwd8JR5|w-9~WM$vm5cQ{N1(b#6EQ
zHqRa4n&+_5+dK~n{|x%)2srCxo`-}}KL)OKP8ffi=Ono1dD!S}o>Riv?ld^-WS%p^
zsXqd)buJlyo98ib&GVGe+dNMT{~Gc<1I{{`=els}OD>B2U+XLd*Yo)@aLu#a=xv@A
z!r5*mIO}AdRl=#S2G=^9jla#a1zhvoVe~f7PT}81p55TAlX><Er+yGz>l`-zwtpT3
z*E~mz-sX8oINKcsXPwM*OgQ!9;9BPq<8Sjk3a)t`GkTlnapC;Clx1+%$vjttQ-2a%
z>s&MbHqTSwn&)Yww|Sls&UV+qSts+%;R_SVsV@Q7I;+6BAH}^bm#YTXJe!T)=Gh|r
z4Ekp)IO}1aZNjPF2Cj8(H~u!y9pIX0r_tLyyM?peUU1gQJo|)GKM1aMjv0U3KgYo}
z&m%@}^E@hiBmO>Q7Myi5&pF}LFMw;EOUB>kc??|hJZ|(h&t>6kcLkhvGS3sjsXqy>
zb>^Ovp8wc9OTabHDx<e~RtvurdDeilPUcxFocacEt+UDa+dP}WHP05Kw|TY-XS;3S
ztdn_e6;Ay&aILe?_}e@O!8Ok@qqljE3%?q9PJpvc<~b>x`YCX&bH@1FJdc2Do=1(|
z<~b{z?aqO-PUbl;ocaZDt@DKOw|Slf*F19<r~TRHSt9)P$a4cY>tvp#!l^F@*E%bW
zzs<7>T=T3pdYfmBaJE|u&N`WAop9<Kz_re;#^2_-4P5i=GkTlnpzvMDa|oPuGS6Y*
z)Q^B`oukIz<~atgd5#;s&2vIH+noewoy_yFaO$VPwa$6tZ}VIL*E~-cz0LEa@LQ4R
zDmd$8o@>IXKMk&Rt{Z=wXYRRif6+Wk!2NlP&2xirwp$9$I+<sgaO%s!waz-@Z}V&b
z*F3ixz0Gr*@OLB6c5v3oJhuy{z7t&Q>^1&2&pvR?bI|B*o<qXf?l3s(WS$3wQ$GT(
zbsjeUHqR+=&2!%9ZJrCl??s-A;H;B*E(xdpIJnliV*G8MC%`q&lSXgzToulC*T7jP
z^E@S-`qSWAXIWKxe6e|!gKM63MsM?M5YE4UZUkqY%(F>2^)299XPfc2d2R*QJhvIW
z&9hxN+uaV%I+^DV;na76Yn=y;zs++5T=P6^^fu2a;mhcs)8MR=dCmx@{wTQCIcNNB
zp7Y?E=YrAOJQszt-6e3=$vlq<r~Wv&)_KbK+dNN$Yo2A7<if;pp81pu{|WM}0B4=l
zR|==T8eHqFHU2iwI&jUi!RT$Cjl$V(6FBQ+p3TCkZvodjcNl-0XD7JkdC=%>{~Qs%
zjyw;6vrgtYDxCUpaIJIF_}e@WgKM5sMsM?+7S48Oz*#5rJR+R>qu^TSG2?IZJPxjT
zo-%ry=V{>^@ptTJz*#5rTo+D#$@60W*E&nVdEX}ab1`tuv)t%yo)yB`ZY4PDWS&*R
zsjmjtI-8BZ&9enu^W0(dHqTDs{C<jVaMsB@dxcX!2(EPw8-LqB4}xo+BSvrYJS3d$
zj)JpJ<~b&u`f+fr^N8`cc^(DVJdYc_&2w2ezjtE=oOLqK6T+!q1=l)H8-JVU8F0;W
z-RNzex#wrcf3{l!&N`Xr2I16~f@_`C#^2^y1Fm_t7`@H2RrqVMzqf(2PUg8)IQ8w|
zTIUYqZ}aQ~*F3w8-sagWobC33vrgtYD4hBsaIJIP_}e@uz%|b!MsM>xD*QU+ISbA@
zndh8v>KDMZ&L!h-^E?Kwc^)@<o9D7{wz~q(I+^DQ;nbf5*E&n8)BbPs+yJh5RvW#|
zvqpF?@~j1Coy@aNIQ5O-T4%HIw|TaJYo4t}Z}V&u&UUwgvrgu@O*r-K;9BRP@wa&n
zfoq=QMsM?+5Plo-oCIf`%=55t>ZifA&LhU(=6Muc^PDw$o9CQxwmT2bI+^E!aOxMq
zwa$~q-{!dru6dSRn)YX#=LX@2kY_14>tvo~!l|zS*E*|=zs<86T=T3kdYfmhaJE|q
z&N`WAgK+8_!L`n9#^2`I4z76)8okYPNcaTu90q5d%=4gd>JNcyonyw|<~a_oc}^I;
z&2v&X+dT}<I+^E`aO$VQwax|OZ}VIP*E~-ez0Gq~_zdz~181Gg^OSJv&wy*4xy#c1
z!sb~5u6b@SdS55=DHYCk%fMMD_2t5;uK?FN8;rlrvk_eL+-CIWyE>UqyYR0e&+Xu>
zllmRPsqY5YI{S>j&2tc3^Bgkz^G%+^!rAUYaMsB@M}$*<2wdx&GX6HtX>iSR!RXI7
zc`ge7F7jLgXPwORm~iTs!L`nl#^2_-3a)vs8U6Vt&r`zL?rCt=$vn>pr+yt=>nwkP
zYs^i&E{^YVxe9R2v%%=kcVgz#DEwcMXA?N<q`p}=^{wDq=T_ry^V|lmdA1w9uao&~
z7tVHffU{2OJB3r<4X$;L7=PP84}oi*Q$}y|oEH9H$a4mqbu!N*!l|DH*E;8ozs++2
zT=QHsdYk8xaJG94oOLqK<HD(52G=@I8-JVU8F0<Bye9Twz5iJuycFN>Rte5JnP-)7
z>TAHY&N}07^K1auJR6PP=Gi2i?KXq6PUhJnocdO9t+Uhk+dR9$HP3@aZ~Nzn@M`3F
z2%L2?&r#vjkArKSlg8iXc^F*toHBZw=d^IPI|I%-ndcGV)E@=cI*%KFo98mP=6Txa
zZJuX@zXEx#gR@TNnR{XE=j7CH0M|Opz&Xxuh>PdS!8Okcqqlih3TL}j;H-yvRtu-T
z23+fGG5$8sR&dR8htb<SJB43|JiEbJC-dwTPW>Rb);VnaZT~z7u6d3az0LEGaJD-N
z&N`Xrm~iUH!L`n##^2^S3$A${H+q}rvhY6SxdP5Qndb@N)USeTou`by&GR(4=6S~G
zZJz7G*>3Jd+5LrimI$YQ1Gv^%4bJ@tyHTzNT=Q%(dYfmf@Q)zRHgL^zt8nVu!L`mE
z#^2`I39fl|8@<i5S2)}4181Ggb5J<-L*QEHxbe6Ba{^rRJZkhd&spJrgFNTJSttAF
zym0Cl!L`m~#^2_799;8UHhP=qig31j0-SX+&y&KbUj^4XOI{p%r1sAZ;F@Q((c3(0
zg!6lQYr$D3^Q;q2eIvNm*=+o6o-N>-XRFcMJllk`-L2rPlX-3vPJKJL);VbWZT}ns
z*F49K-sU+W{4w;;NpRN5JP!+}ei~fsJYxK9o=3qo&sn3ldCm!EyYt|zlX)%(r+yJ!
z>pW@vZJw*(nrBIE+MjKn8-$nP`)y0XSts)>6Ha{vxYk)^{B54q;F@QR(c3(0g|po{
zaMsB@8-!Ee2(EQ*GyXQuc5uye(CBTRL&9H*Jcq$qC-XcgoccrHTIaa&w|P#0Yo3!v
zZ}U7Xob675vrgtYEu8upaIJH}_}e@e!8OlSqqljk32#E4r@&b!^E@q_`gL%vbHhv0
z{ley13a)vU8NJQ3TsYgU0B4=dvr;(qRp44@qw%+SHi2uN?M83&+%Eij<hcW!bu!OR
z;neqnYn_9}-{v_4u6Yg{z0LEWaJD-F&N`XrA>q`If@_`A#^2^S1Fm^48okYPN%$c0
zJO<7>ndfog)USYRohOaI&2tr8^IS7}o98LvZ1*%c>tvp1gj2r`u60&y&hAI?o%=p3
zaLu#P=xv@&!ry;kbZQ1?oy@aEIQ4DdTIV)!p4ajEy&YWh+-~$X&mF?qZYMbFWS-r^
zsqY2XIu99t+doIaHP0!dw|PzrKYC%za|WDsGS4Hzsh<VcI_JSP&joPJbJ6H+o=d{n
z?lExI$vlq>r+yh+>pWxpZJz7knrGEZ)BbGptQOAyPf!ESI+<s!aOxYtwazBvZ}<0R
zaLu#D=xv^@!r5*cIO}AdTZL1<4P5K&GyXQuL2%7;%;;^N<HG;_!kGI6IO}AdlftQ=
z0@pfcjK9tE2)O2X)aY%Vv%=Z#960M_p7X+~UjWxSPZ)oj=SgtQGgnu*f0hW}_|&M|
z0M0s@XQ^=N%fYqIO5<<ytOD0OtBu~~StFe7)`GK6=2<74`UY^VbF1;Ud2R#OJo}8^
z_Rm4#mm<$0aMsB@hlNu=0<LwA8h@MT7`Wy+ZuB<K3E^ya5}b81&%?s0p90r9=Z(M3
za{*lQJYn=U&y&KhK%T4Mtdn`J38(%vxYn7gPxlL(X9>9Gxxwgdo~6RsZW%c1WS-^1
zsjmRnI_r$T&9ebq^W19mHqULs`F~m3!C5Es+%BB@PH?TW*ZA8!`@l8NL8G^M4hd(w
z!{Drwc^(u_{Rp_$dD!^dJg2}l&v~P_c`gX=K>u6>XPwM*NjUY#!L`m6<8Sjk0j_zT
zG<uuos&KZu2F^N}=PBXTp9a@D%eG|qqxdeDD+kv+>x|y!*&w_hc{YNxPUhJpocb1U
zt+UPe+dQ{|Yo6PT-sagZob7H0XPwM*hj8jU!L`nV#^3hO5pd0O%IIyL)51rP=L|UO
zWS&QaQ$Gu?b<P`qo96<!=DBF}HqRyDZ1)&A>tvqCg;T!_u63R^{x;7u;F@Ro<!OJm
zc~&S#o|WLNlX+GthrR|}>#Q^WHqQod&9l+yZJtfS??JoG;H;B*wg{)b6<q7=H2yZv
zZg9<W#OQ6FhlGC#b&i6wPUbl#ocalHt@E()w|P#1Yo60aZ}XfH&UTN0vrguDR5<ms
z;9BQ#<8Sj^2G=}K8@<i*jPQR%p6lSOlX>PEVm~LRegnAHSq`q(?-k&hXQk2GJgbDW
z-D+^w!#rz*Q(p_Nb+#CPn`bMy=GkfVHqUP1tH`q#oOLqKKH=04foq)yjlb=mBjB3n
zA)~i>jtXbHW8kcld5#OGega(UJZk)Hp0nVZ=V}rCS`qz*D+-UdrNV!W{L8?(Ud+E-
zIQ5m_x?VNL-{xNnuKCv)z0JQtINNOmXPwNyNjUY*;96(9@wfSJ2iN?EjNbO=Vc{2+
z#oP~qvrgtYBAohBaIJH~_}e@u!8OmrMsM?+63%v~!C5EsoDoj_5pb<@-uT-(7r?d7
z<D!qL<#Nm5n*W9?)BbF?S1GvaYmDA*uUg^H$M&iNXAaz64Z^8!0@oZ`jK9sH6<l*@
zGkUwdwhCvv+rU{Tw^zGx>bHYyokPao<~a<mc}^I;&2v)t%aG?`aMsB@r-V~K1Fm%*
zHU2iwS#ZsB&ggBP^TOHg0yyhro{Pe%Ujo-USB<~Ta}8Ycth}mlf35;oeUs7K{F{Ye
zhx}W>xn9h_RXFuq!F9dbjla!*JGkb*!{}}Pox<5}H#qBL{=LGf?*rF5M~%PDe+*pn
zoH2Tv=Mmw1k>^ox*2z3)g;PHdu5~UNf1BqLxaN7x=xv_Ig|ppdaMsB@SA<i40$l4{
zH~u!yTx0CFnr9`rKaaI}Rtdioc~*n7PUcx7occO&t+Ubi+dP}VHP2?Fw|TY*XS=Q7
ztdn`R38#K5xYpTg{B53n;F{;C(c3)7gx`xi$H7@A^PCV){b6vebK3aZJZHc)&m%@}
z^E@h??aqR;PUbl$oceiit#ifr+dNNzYo6;yZ}ZGuosPqvKY%<-z*#5r+#sC#GH|W4
z!uZ=fE5S9-Dx<e~RtsmlHQ=n1dDaT2z7AaLY%~5g&#mB^XRp!QJo|({j64UySts)x
z5>EX=aIN!@@wa)7f@_{*MsM>R7tVGkz*#5roD@#|VQ{T;&iLCr=fO44Q$_Tri|ET<
zmhHF9vt0PUApZ(*t{3%{!l|zY*Y&D3{x<(QaLvEL=xzRu!r5*UIO}Bo&BCc~0oOV^
zjsI`CsAgkaxo+cQ`JmDJIxpQ67Z@^n%MTg7-M*vXx_zgO-up2B8R1u;-6P=4f%>Du
zsh<Pa92Shf-Cm2}y1kZ+-fpjB!rAU|aMsD~wJe<a6>zQdjPbX5u7hiy6)%t5N6$AZ
zh5rHatO949%(GfJ^|jzyXQT1Ac{YJ-p3O#Y^K22$c3Z(&C-ZC*PW@JJt+U(s+dO;0
zHP1svZ~Nz{@Eeim7&z->p5wx)p9I%Br;WeOa|T@VJYw`V&!fWG?kqU#WS(=vsh<be
zI+u;V&2t4@^E_kpHqUk8cOlPQQ|!;IlX;d1r@j<i>nsP)yPpiMc~%;|&9h24+pPv?
zoy@aFIQ6yQT4$^Aw|TaKYo6UkZ}aRGejoDe181Ggb5J<-!{A!yi1D}m^ANb^IcoGa
z&oSX_cO0B`GS3O&)K7wIowLT@<~awhc`h5h&2vTgBJw-|&N`XrN#WG5foq+ojla$F
z47ldGZuB<K+$*x<Kie$<XPwM*gK+9g!L`mB<8Sk<1=l=Vjo#+jCVT~XZUtwZ%yXM?
z>bHYyot?(t=GhIddG;E;&9hH9+Z_aFoy>DcIQ7HeTIYoEw|P#2Yo4=4Z}XfJ{!8RJ
z56(K7=YnwRm%z2o<Hq0SxeTs(t{A<|^Mr7=dlH;=GS5}v)USbSof}@6_J5maDY)iY
zWArx9TH)nSi@tT>tdn^*2&cXYT<dHx{x;86aLu#L=xv@`g|ppl;H;B*whO0zJGj<4
zWc+QO!{D0dgwfkPCxyQNc^(F5oy>DeIQ28&TIW&YZ}Xf5*F5Kp-sU+kob4`vvrgu@
zD4hBwaIJGy{9lP2*2IVWR1u$&-znVBH-PJQsWy7MU225)qn=uDt}nMsop9<K!F7F`
zjlbP4E#SIcT8-Xrmp0*ScPlvS<aXI6oceZft#i=$+kQR-u6d3dz0Gq%_#Mb|5}b81
z&%?s0p9a@Dj~aiQ=PbD9IcM}X&w1f&cLAJrGS5Zf)GvW+ohOaI&2tr8^DJpj`?Jk+
zgYdhNXDK-AWS(WhsjmRnI;)Jo&9fR@^Q<v?n`f<Xwp$0zI+<sKaOxYuwa#tE-{#p4
zu6Yg`z0Gq-_+KE;VQ|*TJP!(|{t&p<IcEHAp5x$}=Y-MQJST;--NWFllX*@Fr+yk-
z>s&DYHqS+H&GV$u`#PD=s_;eRxdzTUsXry0`ZM5KXYN(GFzIz`3ApCD!RURR%%@a1
z+bsiUoz#~Lr@jJQ>ufUqHqT~o&9hDP{Cl^p;JRMDMSS{<Pt`fOT-muXuR(CXUX~Ao
z`}!x(i(3D41l;Gm*#*~*S%<)V{gzLFd!N59Nqr`b-sUh3uG?|OaKF92kN$H6+}H1Y
zn9otet$rTd*Ygi%y^ewVcD?>5@IMaD?M}W7uG@D7+~;7|>x9vdnjB6R(Vr^9PlNk9
z?e;nYuG=wpP0T#3uW7d&oa@{0^r))<=lYUY8lRg?Znfg`4EWTE4|ziopLXM8bK4HC
zc@7!9-(DOyhJ{~;dJckfy{I1%PW>pjZr^d^@9SiLn*i7Sank60og6m~3un7i;H;DS
zY2nn*fNPzL#^2_-1g?3m8okYPO?VgbJO$1=ndfQY)UShUoh82;`<?FZ8^ATsQlqzd
zmI-IO<>0K7c~%Igz7kyPY%%_CHTzL3xX;t_Hlz3X<72ekHlw$^6Wq7^GqZp77U9Fj
z-{<hmi(-xk!MVQVheZDfw&SSqd%(xUhx&2h)K7wIZifxG>or}3&wz7W`Zek~BAo3W
z1?T!wKP#O2d2nCnJtpS`!;cxhRD>S`*E)|2XS>VbTIY&z>Q91eou`cdZ@EqGj{$x<
zZG0?WH~P>|%A-El5?@(A+bscSozH}RgK+B0z_reD!)>0GMR+YZ>tVmG15fHfKW{X8
zyS`0EZ+VN++Z<YjbG_P(kJWD#PJKJL=FlzvFF>BX!s*i|{?rc&r+ygRw`-5f2MxFT
z-Jv3U44nC2i#o@Jv)u`BZWrn&g;PHTuK7$GZu`lRB77EH>zotLcIUyh&IRGrFM(^F
z%iuh2ay&m_^hZmuZ@HI~MfB@N{~0sRl)gGH>)Ty4J{90x-@nFosT9uotH8Ow)K?3q
zz7|~jPo3em|1=iiP2jBaC#bVoINNOjXPwly3a5T6xNetihTHzLy$Ig{u61?_XS?0t
zT4%3t>IcEK&SCMt3HclpPM;C+r~Z&|>c_x!JB}M}x8r0Hei)qjd=Pa`31_?0;LL~m
z8R66)1=oCL4Y%8Iz6f6c*E$!4v)v_dt@D_0>X*T_&XeFe4xBRjcC-JkgR{<OJp*IJ
zYvL<8+bscSoz!m-PJJ1;ZufG-?RKv$!mGep&#O^qwQ#mu1I{|BuN6*x1GwhdXt>?(
z%|&<%xYpS!ob9%OYn@w#Q{N7*b?z|yn`ZlVf@^>1Gx~k!VVk>`LBs8K87{&Pf^&Uu
z#&#JI&iW65bA72F6;AyGxUTP{;dZ-B72(t1TIY;#wtECz>pUu)`gw4zb5Z;UaJ{f3
zoIc0IpZep%sb2y2?b`FJ6NcOExLSm-fis`aqs~*p+3sm@=0p7%;ne3|8~d2%Q)0N?
zj-^F-8MxM2E}ZRFfNPzV!l|z{KK6RK0bH-6+rj;M{n+kz#^-#u>bzd)24_9weMWDu
z3kHqe@^PcLbxwe5os&jyuj{9b-tr^he!Xn}nJvN>jK5vqMQ~l;V@7Y+>$uTdzGC#j
zAIJR@!bdUwoHRaGzbc&iQ{dV^PaAIg=Xw#op*8k%_D^o#QgF?o-01E4Rv5kIRYq^u
zt6DhMtH$_PeXVfn8^AS(MsPijG#kCWzGx|;-){8w`l1t@xqSlLv0FIn>;-3@)b|Oe
zehA#JmmMdE4Y&P#qzFF*&N{z=I!A@G-7#?1N&UF+|Hs!Iz*Sb2T?4-w8Y&hhDJmK!
zDk>@&DH<voDJmKo85t=R85vFFi;77`iiwJbhK5E;hDnKuN=ZdYNlJx9MT$v9g@#Fn
zg+@mDvFEJiEY`<{-}^elpEb{Z&ffc;bMC!B%=f^3{(HrBANEIl0PcMbnseMCxc511
z&ip9c`<xWl`;Zwp`*|MoHfzrMb8z;<{Jc5yi*R4xC2?Kfm58TKTKo9jdza+%G;@xd
z4riatXP7ge1^0Q&7T5L7jd&iM^T~1Z%{guX-1{svXTA*XkM~M==>J`E-&g}@Kkvf4
z)ta+@9i06zUvJKQBiz@wNnF>rCE~4c_SuR)+srv`JDhzo-(k*t7u?skTU^(-H{yM8
z@3Y^W;|{>R&p~tMhvDAm2;A3wT=JV_-6zC#{-+{74d-$3{(r`tea^ypT+GjzGrtJ;
z<608e`Co~6>g2WO0gjty&T-S>-e-n6^Vx9kGe_#{eO(^h@9WAXAFl6wzEEM#aVz2M
zlldxh=4;@gPrYu|itD=9N4x>fb?5ViMstqa1ZSVjH=8rx3itVJ6W4X`h<GR5`|L93
zxZQB?v&WqIKDhTeD6Y>VX5pb9y+5CW`{Q(3>gc+pPD%E27*{<F9_s6TW(GVQmwJ}u
zH{Va<{f=zOs~1P|C6Roo<^PkD^j&8DXLz~QVZOqg`6{^2f3>*oliG+kz`0L&pWg`Q
zexSEVUgxt_^6DLtd}k!zD|wy&KFO>1Tb}baV9t3Pv^vZWnKM5E_jw+L`@S8QygrYZ
zh~(!bKO@(pg-Cuy@|z@|s#yPVksk33IM<!mg-mnKLl&I-f%$B6=JVh_Z~5Z7KMNyX
z1ou9R%{guf-1{swXTAdNeb!rjUSAr_S*OwJGv8#+d<#5`tJkAeaXr7aN4x{h`Qi1Y
z)12dW!8t$7cbhZc3-|fy6W4Vdi1;Af`y4XoxWjPobHtqaF}U}ceQNT!2;=H~NDkcZ
zLvkgr*QtETtCzsTxVm0t5wDc`dLFBS^LTl_t(Cl<SL-CN-WbU@Me=Qu*M8b1uijyK
zo<BRyGxtp9z02w_-)+u(FWlF$PkhaOi})~{`;GHC0{3|ym%PsBgyhwyBl(#~enIj&
zpNo=LU$Q*sZP}djwqkXdPo0*m1CN*abhyuR2HdY}S(4Z5T6QE~Bze8A6-V;rlGp26
zRU}_0d42t@UR)oKjS+8w`#x!fbKbarIwY_Ap;PkeJ&}BGBtIy5-48>OS0A=~0UmcF
z=3MtttHb=5Ir9^6-zSse`goj<_#E8lc^>Zbyd-&@&t=K0r@d>-d0sso9_p)SOJ3(Q
zNAl{qmgl_XnRDLqtq$`A=FAtteV)t2PmuRzD#dl5S4X@K?(<&{_xW#<yv|#*<kdSQ
zuk+R^dG&6|Yn>j+s}D$C>kLX>eaP~|cw7vdbN)xH4)det%um35y(Y!iJT4+W2lsWE
zhx@uLNnYn?S@P;>m668<{QrAgNM7eNNAl{qmgl_XnRDLqtq$`A=FAtveV$9jb^n(~
zyaLX7=JS_IbB<dD=lnBYZO(ih-21E-*Zt5K@g}(U*=){nTj1Vjt2y%>aPPBI>g#=S
zH{9=&M<uWOZ4B=FYC`g1|5V}eIBCv4r=*VNr_Gt4g@@zP=Tmdyx=$7&z6|I5^SZwR
z=RDKXPLDjk;64wTk`KpqCFUW^oX3?dbu^!2&U_x+*Ee5W_hDhgOW-~arEs5za>?s{
zsF1vRmE`rfs?B*^HBv|OwdTy%!+jna#dSZlz<IoU{@!ZN`fYH|1M}_X%y+_le|Cv$
zKRpreg|kmSfA2HrxczYU$^3vh^Fwf-w_$PJKcf*JgL|Lj<{Wnd?tM<0Gd~UYKIg>s
z_2+^!wmeSt`FkPUpYN2xLw#MBiilTAeck8P@Nit}wUQ6}ndg%_$*Z?T^6im)hvoTv
zu+#jnIRA869p<~uneT=B{P&6LJ{gGkFr52@^DqMEexQ#_UgvW{^6Jx({7fXjAbFkt
zMaio#S)TK@Y|eRGu{zAB-kt1E9xwChaG&Q4xbNF6$**~y9?2I;zF3}L6i4#qlHVk+
zKUawB<E1L%)o`vm@2_giIS;jP&JXi-=FB(3ecqbHb$_-*ycO<!wwZI>cDVQ1Va|Lv
z-1{7|`n<jjo3qY{)n|UxocVEh7+3F?Cd73ery@QL=lt;cGGoqhXW^V5=I6|rUx54k
zEQ;$oE=PO??tP}Jwp<s&<C^29!M)FPbLKPQ-e<Yg*Zb-UxZhV-N?xy1)sk0lgoknU
z@!k~4cSv4eH|v6Pe)iZknU`+!d+>cGJ#fws^S$QG_rra^4T$T08;bZaoPCy|&k=Ku
zI|^r?%#WEfKLPi3oD|pnHXZR9xc510&T;49-sikI^NVorbH(aEg7r$hXYD>`oisSd
zWj@`U`AoR4W0ttCV@||#;hdj;qR%{Yj++l>pUfASGhYPv`6(9Hbu5i|8Ql9UH|Mw&
zaPPCyocU_F_gOD~rd($m;eOq3k^Cmfx53#zuM6$w?56|H{+aJIXTBTm`=Li%_d{RA
z`{C@9*M$LdjynivpUe-LGd}|Nc^(zl{V*Q!3Apz;Y0hz{;NIu7IrH;UN3R!)aKBz;
zotZqY!*Q*7z5@?^YMny3*Qt=aUSBFDuU-ug<LY&%CX#QGyk2)&;G9ohM_SEq!g;<8
z&iQ1%-JJPOxbM#{aowLi5$}bwPhLm*%sFm9oP9DsV9xvy-1q0OxbDx<h>yX&&vA2(
zI|27TC(W6khI^m0R{!HzuQ_wpnYa4PFPJmG1ow4Z7T0x5y?4vwLOl)6`58o?>E;|a
z1J3zjKGU4}Y`D))j<~L4Uc~d^-e-Y1$1Q|=pGD@(m%zQxO7WZI`Ct{?uRFDp-z3+a
zdU5?dJPq)0TzXz=lKSdhQb*5k1Ccs|kve0N*Ynu8<khF(VSe=dHXX??N?y-z%W$qE
z&sQtvPwblPSN@_Wt|Rkl_ytgO<}={_xX2XO{huB2960;r`6}0(<L1HH5A*rv%ooCa
zzZHq=<Dw+urEu@F%$(zv!@bW6bLOky-e(Qm_kX?Qb^kZQ*(c9$P39c88O}bLZ!u@S
z4esmSF0Sj|8SySS`{enp+nnR}z}YABz2?mK!+kyn#C6?=B0dcFK1a+s?kL>*95ZKr
z0`7gzi%-h=a0MRvIb`*PgJL{<Q}0Xu684FDCOp*F-_Mo<4|TpK^$XykfAuP<^AkDW
zR!f~fh}TFR^*YJFCA{!~k9v6MU%eR~`k$9R+og`4w>zbd`jF(quq!z44V!aaM&MjW
z=10w$pMZxx^>wXDaeZ7&M|=j({dQ<}GC{NE9Cr@RKAE34XMPFp`)yfV9~Y^!lJP@c
zJq_-Crkiuz47m51Y0i8O-1{sL*Xwc_JoKaMUJeiYO1(nzdi|}Eym|vX^rP41#z?+h
z@_JqFgmd0_o$WHO#kzOHId9DOm^0r84}I!B>=)O4I2iFEIQ!&vcG#Tbj=<R`^P}d>
zkHdX^C&YEXO+|bf?tRXfbKF_D_c>?I`~uwjT(<gr{c6RWbyDw79!DIP`80FpGvL0C
znc}*R*%8lybAJB0OVUTKImgX|vrp#p&6zKR`}`D%>pGT1ycF(zmYH+ha=7<dVa|LN
z-21E(zeBEH4RF8jYL@&a$+yDUKVQFUGiN{TaQ4r9hdJ|IaNiHz;<_JtBi;vRpM3qQ
z-<;zPz}YABgXYW+!+oAd#C1Q6MSL9YeNLEj+)23iIc3iLoYc|l!UEi{7nwC%u7i5r
z$%ltNwN3%t>y$_xU9Yl;S4#bG-?GadNgq{k9xuH{^7?*st>o3~CBM0TR#LygycyS{
zMyaFuCUfRn;JzPP#dSZlN4yKp{lMexhWkA9N?wn*Px9&mlGo!JH0N;*Ngd4(n=?NO
z_j#C*`g*@H3HS5QwA9i2keNt+N%DFhvI6IP^1dSVfn@#Z>^}|8d1gM{ocT<+pRcmS
zb^qr?JQvP>cwdoc&T;eM?34KdbLNZSzAnY$x<5-JUIzC*%gs4%1>F0rG-tjV?tRu-
zeco5po3l=X)n~rZocU(BuVah2u47xo+u@ua-dA*(bKFii=ZE<&bLM;CK0m$Ux{m!3
zAAozGgXSD}2=09jn=?NO_dch^Uy=KYS-77E79_t(@{8iSF3S;Lf%ACz{Vl1pBj*7)
zkC*v$a~^LN+>bX~T-PNx;(2iIGvA!!7QnsFLUZOz;NEAc)Yt2KIoz-B4N^z%6WStm
z+9P$krH-y+Z^Q?r{^siu?h^*#oCjVvhb6Dq!4b);k4avycjM;mxKEgnI+~v}XMP&)
z^FJf5`(!TSi*W7}9`6#|=V3+idc3J~lKmg@>gn)T>*IbY!<@&JDRp!nvdo#!f%`n<
zOMSghD1iI<p-AfJeL`_0UnzOLPpF3TczNBgF=zj^aLzOHb>_@Bz{BzC>lKaSy8oLa
z-U4TzyzaM}bKEvK`((b|ocT_;uS=J>?$4fx_rkr;K68%S5BEL?%$Xm8d!M6LpV$2{
zbJiKR`pi$5Gd~6Qb(|L0b)1d(9GvsR>;Aks$6bJPewbf0XMP#(^RptZ>zG!XoCiW)
zJss|SW|(u_Ot|-%WzKvK-1{sPF9;_Td=%FvfARA`89db4B=-sB;<_%C5wC*tczNBg
zHfR4ea2_x7wdTw>!2Ng|#dZFhBi;h{K3mN>ZX4YDY&U1V3+{b(OMSgh=!N@z!kE<2
z`-GWDo!Lm8ImzpFVL|fhEAY_2u6x=CQ=32BGvS<1UQe^&oHu%o<X^K|k^lPzxsq4U
zm%Lsd3(Rl9eMO<v(R`6P^CfU!uTpW{SLG3}g8MvF!+joVC9lU@CwcV-$?I`7n)A4t
zq>kpB&6#h7`#iLZ>wf5rcsHE$a39vC$DHH#!Z|<8_n9+40QWuz#dW=gBR&fEKF7>C
z?l|20oG@p83hsSQ!~HxwD|x*in~UUEB(L{lX&*`+r#vp+U!|L~&kQ(^i}_4*=Ck49
zxb%K3M_l(wUc~d^?34Fb1?C*L5Y9fCFEVGo1n%=+Dz5vaJmM8_@3YdJ<5t1F&uVk#
zYvJB!J>2(6ljJwa^}1PH=f5@LZEzkJufOf)?6U*T<6^$kocSKOA6Kuq&VPTz2jJf4
zpgG4Kf_tCC=FE@5z0Yx}uh;8IxL>bVq|V3X`w-GUy!P?<2+oHY=IkdE&i<LtGG{&)
z9{ShEW1hI~hk}R~!a2`d@0RpkWX^Gm;p~(75_9Iu;Xcn5;<_KIB3=#mK5NW5ZY|vV
ztTSi65$=69TYbJC*J92(tyZ7;Hgo1X;J%KX;<}FA5$}O>e)xV|uQ|u<gL8hE?>A?D
z5bpCcB(Cc?67f;E_c><HamV4_=Y%=)Q*iHdR$T9^7vZ5Fy&qnJ`*}F6E_r-}`noO|
z5zmJ6cwfCAhV!`Sd6Iw4>QKB-&X>G;q2$B;UKJm|=5L1=OC8OZm@{7v_xY?4*LAOo
zcrD!Lp$_iz&>(p|-bTr*H%nfRtHqqh)hcx~-)7EyC*0>@Q2bE2E)R?AJ{f~^9{7Eg
z<K`T90?zqie$t%zX?W;UuM0Ec+Rt3X=i%&=-&eU{&T$vv?34K=bLLmzKA)+NY<Ya?
zzDkdH2HgA1H0QWkaPKqQocUb1_n9xQ^H~`2A~^fxeN?eI$1Q=gPv%R_nXiC*pOxY|
zpVbksfqS2|<{Y;U?tRvqGv5UFKHIH6ubUm_tkY@rneQ@Zz6T!0{rEP?9t;2N71wp_
zkN5zb^TX@rpgG4Kf^&YDA2w%x6z=mgCa&u^5%Ed5_c>+Gai`(l=Zrb?b8zo7b#5}Z
zVO;%w<1~1<o~q}=LmmA-<U*;l`lZwYJ}<?ep-=T{$?J8z2JYAK26!0v{b@<h;lIsN
zXWP}!KZWaNi+MY|70!8MzRjHZ4tN+>_hF~F?!)eg_rSTnUq(N@<{Y;V&OVv%H)nnj
z?&~`wuKRE#;-hfybIhFMj>Emr33KMB;NEBIqsf|varJpz8r+}9Wx_)pJ+ADC=S%%<
zSBK*LTLGN?(~Bgp_btVeSFezKsK4`G$?;U0Zw0TCI-0LGXTBEh^VTZ$^>Ne&_s3C(
z)X~?kIwSdh$=|h2a!ldBgK+K>z8*DX&i;qtoM+}o%$Xm9hvU`9-MF|u?j|EX1!tdp
zJ!;yV<Icd@C-bxB%+JGpT^7W3e=bFQ8SZ_qm~-4zeX<tbXPP<l8F2423m(SR{gVy%
z{gW$obpPZ<@+Fej{Zj_#@p3<uo3sB4IFFb4N^|C`;l6)r#C8AFMZ6x)KDi$n%sFl&
zoP9FiWX^mG+}EX5T=!3V#5>^LXQw&G?Sgxs-R8{q!oAOatA85KZv*D6GiddhA2Mft
z1n%oNDz57|9`Ok{=jZ>>=cGBuoq}_In4dOheirWYGbgU=xDfG0xc9ka&T*IF-sg%r
z^JyPT&KurmmiTVrf`pHJ@uTGYUjX;>L$TyHNxoEEf1bAt9*$S9`xR1Oy+P{e>q4zk
zNAFkLq>g%@)Y1Fc0jaavQmXd6WFm&)VV>0|B(LYsNx09?EIiD=-p4LToiP2pFI_Yr
z#C_uuoa@f~vN`i99EU%S(!}*~lo9bvIQJ*-OS8;5ZZ@2KGM{74d>-8QXTG>TjtV1Q
z1ou9R%{guf-1{swXTBWneKtvb-M7u~upiXhq>dg}N5p%ie%L3xU+smne|o><^?r3g
z^6Ep95A_Feo*Xv62|glqG(T$2{5ag_ZASb~Id9Cu!#e8YYYy&@uLY^2_a}>yeEP?e
z$9L#Q?@uz}+&{eE$TH_~Wy3lD%;%Uhp9c@)>iuoLxIP{WBVGh&pS<5FHs`n{aQ4Z3
zsX6oIa9^(qaox975wC`OpEc$jw-)Yw)|oTk0QWu{;l58=B(K-0HaPoy4Ewy@oa1)D
z*(dXz=FE4)ecgM+b=~_S-VbM=|3#kz<{Wnr&OVtRGG~4S?(;b+uIoM?@d>#1Icd&u
zr{Lb_v^n#$aPM<T{1kb;Xc_MNA+2G{c|i9=hPd9hWWvL7>G?bx?&tYpsiXHT6;em<
zPb#I3dXv=A`<51|v)WRs_!G(Tbil)Ws`p7=&#V1#pPylPm}k9j8IwAC-!g9gbKJK~
zz`4G>Z<#b_ej4tNml<(=yv#*>9?pHp`;Y~5j=KnFpUf|rGrt1&eVD>J1lPw)dc-r}
z-e;yc$IXI!pV{Wj=fb_uN~y2=xeD(4xmN1van(n>S?cS3OADO+^S-4`@_K*LE_wA%
z$%pz!yeZlLUFLhiyQPlid(4^dgZsP<OMUHUMCz!IN&c19FW_O3nvlHuEIf?6z1$bg
zNgaLs&cprjyC`+^zGx|u&)AgAUl>>Ki?ZO{pS;h>Hs`$Mz`4H6=bAI04-ez&eNln9
zKHiHWUJPfSyw52y=eVVC_Q`yiIr9~8-w&1I`naf$cn#e9tTpGjb#U*q-kkYHxcAuv
z_kGeTdA$zyz}Y7sr@e6YL+`izW4u2xXP<*shxs9M=11VZPe#RcpNvO*0?y;&ebJ;j
z$DM-nc$uFzXMPs$^FJr9`(z>Fi*WCA$(-XZ!@bWHbLP`Nx#jVGtDI+Y#P<j%N_^zP
zeg70lUiVL__>|m_m5b~BRRug8@0#lo+^<K?Qb+Hv+NDmok19p~9a2ZVN9ySPRj<_1
z^KGBhQ6G?en6`i8L_cW$5_}lW^<sX+ocT$3*jGEqx=g`+UFIbJkgV?_ocrpG-IEDg
zGJgtvF2mU;^DE}er!^+^{BfEtu8-5qh-bms=jYI8wmHYmfwNEMbIqC0hx_BSKwKZE
zMG-HCd!Hrd9JdtieU_OsUjg?%E8)KG)slaQta~k-eeyoM&Ya`c!`UbE4d%=@!F}DE
z#dY0VBi;sQpS%xmH|Mw=aQ4Z3r#bW8aG%c}ab5Smi1)+2&jE9eI|%nahs>EDfqS3h
zRzD4oiwSeqnY8-MPnk161NU{D71wo~kN5(d^HYF67tJ~D5}fnH{IWUosZVV=&*=3l
zO<dP8BjTBG?=#Ds<7UIX&m42+^WeUY1#o}-7D`^PkHwLEspNHC$|GI@=kb0E>r!dX
z{;S|TUgoRKnXiTW@z#m!x->+*5$=69nRDD`xcAv&&U_o(`y7_~dLJ?Z_xq4($?N^V
zjO5kl;bB~TUY2owvY&lF<iJB-pO+Pim&^TCX{1gWobx$`b+3SP-smGz{{pE$8mT{S
z^_Nh8*6P#eBJ~#{^_L~TNv>-v@NitZUTOcgWj@sl;bA`YzOe%Cbt)ruYNU?t=emeD
zO8s#A#^+5<aLzxyMe_Q3LaXG}+a<rbK7PMJhxz_{B=gcKbu`~)&U_EtA1}R9U-x+*
z-1qa4)Y1JsB6UJPeBEHwoc)Z!Id9C5n=?NN5B=-w3{&EI{+x;UES!%czHTsQ&T;4A
z?34KgbLN-eKF`bIy5CYw$$EyodK%pOOgHDa8F242)13Kixc8YW_4RR=5BKwDg}CmY
z0jaOYH5Bm?IFGjj`+U@#{g1(Uyv$FSGd~6Q<6VOLK2Ke+{<@?`JPXeLUqt`e=IkdI
z&i<LtGiSa4?)?|Sz5mJ!*YCeN;x%ygzkg2h?`z$0Ty=2v&wRZ*^38DXzXk67cS>IO
zPk+P*;Ozgy=zq|h^Em`(|I81YGd~LV{wKt>&q=r+*A$$6eg=I`n{(V5IQwLN-kkYG
zxc9jP_kNb)p&xzUYDMzuSr={DSNeKO4m{LZ{l8S*#Yrw79{N`=hI>EdQeWS<s+9WS
z`f@z>Rh2pCp&HJ4W4^|m`8s%*H@&{pi|h5JG2%^du5Uf}zd6TkfwNEMTg{nohx__=
zi0eM=ig-8N`|L62xV>=iv(KFQ0l4=$Wc9y;`5886oe`_g{HQte<8WWc32|M=sff?O
zIX{o1&slShI|t|dFu!2V{1V*fXIWg=G1a`~ai^XR_dYYsIc_H0`^+|HJ{RtN7Fd10
zzEo&_?%qk?MOL5rVsqw8;l7S#;<}C%5wC=Ee)#%Ql{v?)hI4+HuQ6x74({_)FRts=
z81W{!_t|XDaa-WtXRA5$?Qrk2Q(T`<^@{5}_eXpH&i=p8>#zAe@F6(+XMWh6`BAv{
zKPIm8JQ49pxc50_&T*&V-sg-t^K)?Tb6)D}eewd_uY*fc=d<#Bc{!3#;d&d!)z^*F
z;9fsn^7=YeMkJppdEF1$5zm2ho_~pT&o$?~<-s}6%;%dkUkLYkE)v)MP!jP{xc6CR
z&T-4(-e-k5^Hp%~vq@b0Y>9XqoPFMd^J=?!JG=wVKAG<{XTBTmefEmyhZ`?^48YmX
z0>&LQXZ;~K`(b|AocS?$=tu9z#>I6XPDXqR&OY<roE*TkImexWvrpz{&6!_-`@AiR
z>-sK7d<E`(raqnYOXs+0aPKqSocS!c_n9NEeda|xAI^Tx!h9B(bKF8W`((bzocR*C
z_gN;c=c`(H=ttidu7ij3o_dSa(dRFnQYUQl793ZX`4{2ca2^-)J?6~!!F@mXi|c+K
zjQ9|o^M4om88+v*BXIV~{HQte<8Yt<331&gQxTtrd!IAr9CsG(ea@LPzX10>voA>=
zFTr)6<VHL{;)M|}j(BOr%OhSH@#=`zM!Y`ajS+8-cx%MlBi<SD?uhqBd;-pWGK&2?
zY5qs}6rB5n`Dt_JXW{<1n-kZ^-9p3{;q3F@=x52C<1WM5C-W=j%%`<%*|++BXu7yQ
z?lL2u1@}I)%{guk-22QmXFeb9kGmT22Dx8t6#s(wl(^>S#5LdWnJx39`8ILQ_lh4W
z?|=1+>$(rYId9xo!{%B0Bz=s)Id9C5nlnER_kB1auKi3!d>YO^xvyr-Iqoc+eKJ31
z&in%0*LP7|_u+EHSK!`f>e6KX=o~i<?tP}4GoK0fK6Au>B<r3B=eR{!$9!|vFMzWj
z<_pc4FNXX2mWb>6mPNc$T>Gzrv;Q;Ef3-RLsfDwD=IhLvZ-o1NHi_%Hw?w>MT>I~U
zd;gv0?57*<{r8wNKL`)~>$t;Kzle`tbJiKP`pl1+Gd}_Mb)OX1b)Sy-oVfNs5BGUn
zFlRqYaG$qjbLP`NyXCyP=DH)U>z*0$9C7VG7w-M%nX{h)xc6UZ&U^{n_idTD&VNP3
zE8*<(LhO?&bB<dLXP?a1m@{7w_dXlMb)K6d-VFCXTg*9bE8P2RGiSaN?tLzZ>-9IS
zb<6(I>u;|3!*bov7uR(ug7dg|JuNoB9_vy9=W#J#YR-H)+#jbE;@VGD#H-=#lh@N4
zbB<dJXP?a1nKR!2_xW!W*L~6)@fNuE*=o*l+u+`3yE*fnaPPB6T+ai&;yTa$5g!uQ
zI>T@t7q4q0=InC}&f{W!+?@F-xF6TFxX%A<#23W1|3$d>zhusSR^Z-$>T{{hA9Uuk
z;GusVH(OliKR4n9;##K=?)?{;v!4<;`{ewWnloPk_xZ0B*ZHrGc%8WRUk~^G8_d~H
z6Wsf6HfO#K?)`U&>-={`yc^Cwd41_I=eWIa_Q`yoIrD>X?{i38=XoUJqj2wY%$(zn
z!@bW5bLOYv-e>BvWdDb8_4^aj;C$V$IEkfl;h~Pc?pG#$u)MxqC-nml;kr|A{&RQ(
zoX5p{qdD`<@X(LGzTG0O`=l-6?QqWj9Qx@n=eV74_Q`ygIrBYmpZ{KQ-6#DKAAozG
zgXSD}2=09jn=?NO_ddt1KG$W!oOLFxKJ!!N%+J7m9cRUL9p@vy0QdP>H0QWWaG#%L
zbLLZ*Cl3UlpEPk@$Bc+)!oANdbB>!0_davXna_iJp9SLjx^8vEYa`wxuJ^Hn5g!xR
z``fvQ*R*Y!XRY5Lu626EH9sJ(`RXeo^~E(mB(C+R#5F(m`7QNzKTJe?63+ebro80e
zPnrK`pTwu(+z-spm@_{I_x-RWu6?dVJauI<KKncteWsan+;lkmWIn^3`E0oNSt72#
zr>hLke(KRrxjE}sz}XM;mFCRXz(YTJeW?}K^HP1p8{q7-3w<`4bKE94`((b^ocT7m
z&s)2=u5V|=yWrkuw>ih{fqS35=FAVkz0Xnco3=^zSorU__;unL?MWuo(fiU&aXsGb
zi06xIokBS0A@iVQydv|zADDOvob$kZsX6nNaG!@3aXsEP@$=J?F~fg5#C6`f;Ozg#
z{gZ#wZO(pr;Ow9IUUTOA;h}$hTnvco<6<b{!*KTbbM!f4&T&WK?34L1bLJ=DKF^cl
zx=*GfJ_GkYXU#e89NhbyH)nnk?tP|Rm8@Ivt7ZRZ!r9OH`zE<8^YMbjv(2A{=fc@1
z>*SfUPJub=6vIQG`Zy{P*Lg0Bc$K);se$|P)|zuZ>*0P}4d%=@!+rkS#r5&nEv~;G
zvQJ#sYgqgedHjxx>+w#A>%2`xd`?{Jq+h*d|LE(|rQ&*AjpACTNnHDBiFk*&*6A15
zewM_w{z}AC*CfZq{lNR5H1i+gI-3sXeqcVsocS!c?}t2b?Xw`_g>d%C`=26nj#~_8
zpUjt-GhYt(KI_EweyLkr*S%L<uP;;Z(7*m1(=<H1KA^rNb#&dA#dY3N9b5LNdZxJ6
z$%b=2x50TY$9xX!o(JcAGM{hGd=cE|vqI{>X0_$P)#DByl~PB&Uh)~MkN4e@c&bVA
z>K*Vft{!i%c(0r{2E;W#D6aE49Px2+tuq1VJfDJjo;2sYO~X0Q%+HuJKM(hLUJ<`u
zj<@96WCBB8_ie4X{+^abaXqdkah;!*h<Au<oh~@%hu6(+a~^Lmob$tcpE>h`aG#$c
zaqWL3;-hf(c|F!~%$(zn!`UbE6XwiM!@bWLsjugUIk=xUGOpXQzWV+1h2lE@MdCUS
zB@wR>*E&^j&JWKI)#d}3w^}&ohxs~l<{RPv-~5Q{eop(smU(EA{huv<(l$7mto~6X
zuE$j@uJcnG@k(*6Qw`_*aNpLL^LXpvoFC@v&6#h4`}{PEYyYhgZ-cW>?%Q^Aj@toe
zpUiifGv5REK1apZ{Ju?bozE3<J+Ac5E$gnHEv|KP;5^<Jus?InABE?`dA!UQm@{7r
z_v5Xy`jz`7eOH^aPL26N$k)Qz59`#KvrfG^>vY0HpE^HX;yRx_5g!oOI^*Jczd9qX
z_2(kKB(8NzuTSPLtfRjFQU>?;U#j5Yc=i34M)6nV{Lmuxw_P3Tpn_z)R`VU;ZE&s&
z^X=x$cfvzI`Z_?D_;b=vPsDrS+|TEtpFVSr+Ye`-%nz6|KLq#vJS?v3I2!RWxc513
z&T%K;-shw_^V4web5>kmw_k?){#k+h{>iu@S%2R@IdC4=gP8wZ@$mCj*~vdo6~K91
z%omDlz8oILy+QUvmDCUW^97zy%)bGzk@}jiHD|sa9>&%E*&wd_vnk@uaL&)Jc%7=n
zoa45_IX}#|nKR!3_jT_S*ZtWY@gBJM*=x>m`{3SZzd7@RaPM=(>R+9oY?M)R?(;FL
z&-}PK^OJC2$0>1L$C-%F!Z|-*MW1u#9Cseh`C)#+ocSfV&(E^Bu4C$pTON<<X>ji|
z-JIiQz`f5*bLO+*-e<1WKOc{~Jag`ce5=oVfjRR<a9_t_ab3sKh?l`RKcncg+??Z9
zz&St6SDG_l4fpw}5!dyqi+DZU`)n}hxQ%e{v&o$K7P$A>Ej}mDBl_U%=Lnp~`psE?
z0M34xA2erv81CykBChK@7V&X7`}`>SoG|COlW_LQ{FFKKGjN}`S#e$8`G_yTz0XB+
zj=Kc+K9|jzPjziMKj?j9y7;5AzD02M!}Dsf`E9tqm%!N%^QGp@m&1L1E5vnut0G<v
zXP-Q;)|hkLS~&Y;zRsNa2Dq<pqqwebbHrQV-e;>h$8CdqpY7(%cf!5TF00S;YPUJ}
zNsrZMzSo@jez>pWfVi&XP{fDfoFAT7N6b0yD4g@d{FpiO6L6oONpW4r>4?w3z0X;5
zjynhUKIhGuUxa&~1vhSa{OWubMZ5&gKId`XD>Wa2m%-U5^X2BuSHiu|Dsi39nuyoI
zz0Z1cj@tnDJ{!%MZ-#rHUE=!w+Nij`zcwYlyFBlh6W8ynUx4$t_&)feIs06K^SGE_
zHfKI{)0X|9&qvb4b)RHJJQL17`964-ImgY0vrp!8%$d)F`~2sN>pm%rcoE$DEH>x3
zC2;Sv)SUTpxc6BjuKT22T=z+jxbBkyaos1w;&;ftS`gRg>8USmS@(10dYvw=`4V`T
zH+}uQ6z;E|H%gr|q<)9EzOL0NuKTS!;{D=UXAsWy<?G=?=7R?$$3Ft+`Z7Oi&in-2
z*LPA}_u+KJ=f$=EMY#9BWX^t8;NE|#J2^f&^BHjOKOY{(4euKct^OH43Z#yDv*g3;
z9z4&qm~-4#siXNebLKnXp-(+8b&9XqClT*~b3S>V={4uLeQ?ej^Zn+`55j#uhs1S1
zj6{4C?tPA#bKG&b_c>wC{Iu2iHTM6EIrFnthxs{k<`>|;UW?+oUds_*fpZ>K&}ZuA
z&D$|W=eTKb&I9x5=FDfpeZ8{8b-i*To(pF`95>IL<L1M?&jNGii{Rd8iPYEga2eds
z!}U@}=f6SfgvVnc=DE@QD0mZ`{WITe&U`C8^snQ#Tm8HPlXdMd=R9;;edc@2neT)9
zy!DIg`VK~X7|!+OxFhBqcNEU~VSd7#`6;;fIV-O7HXrc?IQu*m^SNlwahKrillf(H
z=F@IT*2nuy7uWgBjCdB@`^+}yxH)j|GuNE?0=V~CBChjUA%30QFLgw`SNu@P_lxUw
zd_Y{s9g6svxYn6~bKdy=^`trHVH(bPV}8b*`FXg{+k&{R?^49mzPx3hX#W{-??2O=
z{ba+v{~UAX^Wolqk@$P%{<AdVRpK{EzD8Wvu`c5Ea31gV`zG_!V9x#<;XGdEo6MPS
zh5PZgiR*fGM7$I3eRi31+-|t{*<;RpKivBq7T52qN%bW2#C}e|`ygrNdGK^N`(ZxA
zocSzx=tu7-v&D6Nb0eMyXP+NKKl$byw*byQnJ+YFz8LQFRwAzJTNd$hxc6CM&T%W@
z-e;9L^R-ro_y2X~%-35T<{QkJZ-V=JHH+(dwMM)R&UxVde7iZv?SOM0nC~=az8miA
z)g!L!)fe%8xc50=&T$9f-sg}x^CNKYb5iQ-_j^pi{r&nmsiWWTk@uCgk6*rSpKs27
z3gGOY`9gE%i{ZW>O2l<PltsK8&UxnR_7&zFw-U}inXfWuz6S2|Tq~~op+4dbaPPCx
zoZ~jZz0YQI=3C+3=YqJt{<8vSKYaYAZe6?X-{E;1&VHCrH)lQ*?(3T+uIrl<@mx6j
z<l{Hboa5%h*(dV_=FAttecp=2b$v@CUIzC*%gs4%1>F0rG-tjV?tQjMeSQAe3is!a
zgHlId#~YD4`uuU!oX-cx;OxH;&nw5xnV+;e|G~bRGXEWX#_BLXYtH;U-1pmpxbC;5
zh_Ar8j>qx!irdycE;w!)ob$kZraAN3a9_t9aoulu5ifvypM~Zew+QZimYOqP4);E*
ztUk{J)#j{IWA&M@HD|sa?(5hfuItzo@n$&Zhv$J7bB@~z=ln3=X3l&E+~=oLT-UKX
z;yrNhv)7#C_QAc+esksr;oj$j_@UtekB^y%&xz~v!Fh3Am&J&udXs@dKUyap&UxVL
z_8I0pt}Hm`f%$B6=JVh_5BcJ{UWE}a71#dD;og6RIs2)Cd;itu%-6xa|1PV4A<kFb
z=B(3W^_lNAXTBdE#?|Lp1LC^wLlGZ_bAGze=ZHDS9ffm#m>)A|egf|EGbyg?J00;E
zxc510&T;49-sikI^NVorGykip%^$%h<@JgR@$0rpGU2~f;<^v3#dTe3Bi<;kb(-Ov
z2fpsqV$S1ggL593Z#QSY3-0sKEw1a;8}UJL?SB~V{g0TlpE0=iKW@(a6x{ot7T5Wo
zjrbg#eO|wBvc~h~9CrcEKAB%MXMP3leWq?t#@W2zWM8F6JOl21W}0){EV%cXZO(ii
z-22Rz`g(s`2>1KjDygHdN3}?u@V@8pR>|?V!b6|x{ZdEY-=B#1thm1KpZc22vplXV
z#r1JrC$6tcw}|ULZxz?aOMAq-#kEc^oa_5_yzkIweg%90&h=$}(46^E`2V-QeOu;7
z=eaE6)#5tOP2&1`Z@0M4^MJU{^Mtt0&!o7{^K``L#kI~N+~;}8d;;^l0{3}N-I2^2
zo%u|-&vUi7_Fo(EIyn10^PptBdh@rz8{q7R`9^c*o8jJPtJUZ8g*J26X}9{!cbGHZ
z1rOuu{Y<yGp0|4=-UsLW@cBZ&ImaD<bAFf~G-rMo?(;JuuIo4!@o~8KIbqImC*j`b
zlsWS=aPKqY>+3(R^CMm&u8->maee%DM0{3!&Ern|g0!T!&HueK`8((5Q`pZLaLxlg
z6CRFN>*PwE*Q}Nt#q}jm>Zq4Q>QqUcZCC4X+-mVqXBPEqrM~9t#5Lar5B=*r_loPh
z4T|gWPDFe$;_3Zs=XpDPe|Q$0^Gwf%`#e{P>;A8acrBdkn|E;1N1gd`@On7=VZOnf
z`4+hE|8}d-IvwWcVBAit&wQ6T^S$seuAayG#PvKj5b;5{&(Dzg73gyq?(;KZ&ipvs
z=VwA(*KsQ1({S%|#+>8M!oANqbLJP}-siH^4?l01n{1y{>Kn;lLVfj2xc8Z5{te7$
zw$uraU#@$OIr9Z@U-v?BUH9UMm%zQxQuAr_SqAs{EH`Jq8t(I1Bd+US7x8+y_t{|1
zaU0>@XOlVeZE)|iPy95wUJSxRKdb+jO8aKA4~C__`kd7H$u>zg{C8gJ{6TzC>ZoU9
zoY1GvTW-Yj;heV<4^74{Ft39b!Z~lu7nw6(3io*{m-_m+sE|79)lz3j=DAT^kGDDE
zEpR{HR`XmOZyVf?x80oiF1R0WkJSIStYa@cJU>+*l{)isyc6Pjywee%f&1~!n%{`y
zorC-F&YLs81oz`j-IeSk--qdN?<d3j`{*YV?)_w$GoK6he)7d%7fzt~C>P%(>(U^u
z^V}5iW;l;)n?sTTTFiMr&<f{qG2dp+d>7o0tJmtYPM<mN2l}l(^8@D055vQ_djBvY
zuGf*Vh>yd4ekRO$ot=dH{7jiMKMVKynG@G_T!{E0-1}TI=eWyo?{meR`SgKgUwEIH
z@G!2P_p;%kzIuVw`H}3~YN->pIoG$woc9T}QeX3R=FB(2eLpmd>wajBcpKd3x!s)C
z-wwFXbEi4;y>OrBK5^X-0}&sDd!Iw*9CsM*eU6wjKLPhXm&CQtm58VAPWBc1+!yDc
zG;^L$(&6lr`3!UBbKu@*zSU=)0&|{E3avi#Mdr+x!hOG$iR*r=h<GL3=cme?kJD<n
z&rgjx^Yw6_p9XPV$EJuk!`Ub6x0rL@TH)-I`8IRryQGeuPkJP;J_HZPrT1Oq;(Fbj
z6hBGsTc*Wz9%dsx2j@Jn|9SH+?DGXU=Yjb}bLP{&wf=cH1McHynxBSov*12%wmI{8
zaNp1Q;<}#;BVGjeK8wxIKO{NM61ewSYR-HG-1l>(xUOS$#B1Q}ll5!Oxn6Z}_Q`y`
zIrB|$@3UWA`y7n;5S)FE9+J%4usP3%BXIV~{HQtelW^~I#_F@qtU1qzb5@`Ed2{BM
z;J)9M#dW`>?%DFVP)~#V{G^-n{F4Fq`N=eAJ_qjelPj+4m>=;1IQwM%LUYbr5uAN8
zUu@2Nxzy3~WToWQ>*3+J^!(W>uE*6L@eVkTi~V$(KXXX3eqC@L7xUfb%=g26{zt4n
z>x`Q7{5EFwnIAW2ehTjUb6Q;Y;cUd`;66X|<~*M)z<que&6!_;`~0K^w>(~S9n&M8
z0cW4ApJ~o{%Yw5{=CjS2&x3oPW#ZarMZ_!N?34AY%=x-UHJp7iUt`XEJ>2_jkox+1
zNE6&&Cux&9`Z`Ic_$GONl%6ct=AS3cU42Zpzczskc<5g}3m*FHmpYB`tyX>Y|5BC5
zC(vv@3Lh2^&$C|4OkmXfCHT1c%kW9_t#?Xb+I(C1toiHU^XB`)7bCtL@y!Rn`n50*
z;kb52o%Ap%s~_}T;hE-pz_ZQY1P^PWbuN8V@_D}bP4GhVd*H?9zlN8ZFTl&qx64h&
ztu)VrSDTl@Yt7Gs*PCAqZ#2IF-faF&c&qtC@OJZAc&GVG@NV<0y;GY%dd&}k_nV&z
zA2q+|prp>Y`4#X<^IPH5=6Ato&Bx&L=9BP6^S{EE&Ho8cx?O$UWcBMI!sFpnnc#0-
zeWR40^Sr@);nqn7JX|-|DUy6P24KDy`5f`LNj^_J^phFhq+R{UPyX0k|8U6{iidnF
z@<rlDNWMfo<QI`I6)%>2xp>IeVj?QUkCc3sc*yg67OTaNl6<Xr$d}@rTPOZ@$v23H
z{2=m;;w6%A77zK{aMD`+Xi5IqJfBBPzD+#jJCSb}KSuJM;vt{H^##9{X><K!C66Dg
z+Uz0Uh<tDOx2qpvpOi|zKjByNv&avKA1C=C@ld}qJ%M5I<0U^T9`d8ekBPrS@)P1A
zU$|WYlj3EPpB4}KUgT%Q-zoVy@sQ8lK7o1h6C}SV9`dcoFNvQh`4#byUqpWMgMan&
zF#qL}PY)q@_-pMBn?Fruh@T|+Eb;KyN#wJ|PnLYHc=&5+Mp8dd{1nL-h=;!pB3~$8
zA^BqQ@YmcOllmp%r%Jv|Jp8p2`Ev2oBws1M`LC}_>Q{-sOY$}1;jfLz*NRt4zFs{1
zbr$&s@zW*WBp&`+`TC@vX7Mv5-zpydI*NRo_`4<FAs+r(n3>e?6t9wew|Mw#FY-O&
z?~#0;c=&53?u+`x&y@V2c=&58^8CF%VL!iD@*|dCM1EAfTJq!K;jguCSpCoH$AtL%
zBtIn{{yK^LwD?()pA`>(E!{a(Po?I>-!J(E@$lC{<QK(jB)=>k{+gQ=s;5#b;vbNF
z8m`a0UUwp&E`GM;GsQQTd}C5SOZ*(k=ZJ@VBl5Z8wUW;l5BXW-3&cMt`6BU<uiPc+
zr&#<$k}nkx`BCJ{#6K+g3h|IH+%>6RDPAY}YVnZoMZQM-Ba*KZ5BbdOq<+2lxsq=b
z5BWCao5VjV`4;hzUqZfByk7F{;vrwRThdR5_{SvQB_8tA$ajmMC;49SkT2Uksoy95
zamf#ehx`!ogW?U69~KY!{5_KTBjTTs{Fr#icOyS8zDe?v;vt`&lhmIQ|D@z+#6!Lr
z`C0Ks$<K?2{5<jt;-8ZIl6c5h@0s+oEPlS^Q>%XuAAG!zBcCSzf0EA-5A}=p+WgO7
zy-yEynk1iX`F`Yc#4nJ1o_MIAjpwKN;ulK3P(0+@kq^&7!bj-mBFTq)V|vIh^Lep&
zv*g3Qkml=ilh4CFM)(NzFP40`_R&NA>D<kqrouHPe1!a`B_Gap^pG##JNZ1EL&8VM
zUn2Rix9K52jC|NL^cKm7W1)w9{+pA}LneHL`k#?}n|R1~Bi}B5spLDwLq2n#P&Jk6
z6925^d&EP&1^Hg_R>}8^hx|P91LB{P{E&Fa*W|7KXZ2%P{4&Xpiii9J@?+wcOMXH;
z<V*Gq)mN|c;$aTc5>8Evhx`EYGvZfBeoj2(bM{LL&5M6t@{8gj-+}y+_?41h5fAy)
z{z-i{9QH$4YxbXxzXT8Y2IMouuabP0c*xHnpDlj1<a5PCz9K*ACr|tu$rp%+{4nx`
z;vJGN77zJ?1CshB;@3*POg!YfkuMj&PV$xFA)j$zQol<43zDx95BV14YsJH33ZJIx
z#Y27p`3CXpCEp|-@-=v!r&;_4$+wD!`~>oC;$M_Je^&<gLrKBvKU)3hlze#X<I_~P
zc&I;!e2@5zlJ64_`MiTe_0`v+#cz`Qpm@l4BG31pLZ4rf{D|dKc>icryj$|);-P*c
z@)P1WOMXf`<Y$nd7QaREv*ICNedy|cRzK#%zbyF$@sJ-!eo;J}WASNfSv=&63q$qQ
z`+xDTNIng(CvkoIkxv)DRq~nQp?=O=HkVIjiQgvq9PyBEM?P0PTnpHLzIezlBVQo?
zRmm5LhkX5ENk7Hnw@bcMJmhDPFBAWo<SWEOzT&M({YvpZ$ybYq{0Q<j;&({CPCVob
zi<0{F;$N41qj<>oAm1c@r{r72L%!^7N&QywaLwiXw~L4T5b_=3-;jKlc*xftp49Ia
z|EA=7#Y27)`9ATxBtIY?@=Zr1_4ztz*tg-{fc+0!eh&E&@w+8ICLZcn6({w_#lI!_
zN%4>$Lw-v99?8#$hkVhIN&Q*zLCMdHhkPIM3*z@men~v!%a2OxFN@zN`4nE?<>P%8
z`84tSC7&T4>Q}uzsh=qx?!h?!+2SEThJ23rw<Vt^9`c1HN&S5B??}E-Jmh<kFA{%1
z@+IOSpLujrzf?TjE3*G`@sMvtzC!%FlCKgE`9<Wb#lI){TJeytJtpa=PW=0lZx9dp
zN#q;FM<m}Y9`Z}bw}}5h@@?WFUvq5IPrLXJCC~Q<xPK;*?~?q3lJ5}@^-D^V`n}@e
zo}BaFFCOv($PbABNb*DCA)j+xQh!+d$C4iv5Bb64ll++YLz15m5Bc18B>744@Z5p@
zPm6Evrzy$LsIP{ZpHp9r<~1kzdGW0!pL{iW-}xFm#%bZt@P71_EWY|V-rm^k{JZD(
zi`2PjgF1K_{?$@pT%N06#nrzA=Q%1kdk7x>j+a})mo|R{KUT(7AC*464laX?Zyxtj
z$@2@L{w3mG=R^kaXUHEdd44%~hPc<MVNmKkA33fwHmLK_b?V$Md44(c^SrqCb0LG$
z53hatrBLVR8`QZ%!>fM}`2!-y^+xRB@K3y-?se+CAmj4Oq5gNoy-q)a_%q~>lRUp1
zoX^pMd7WVf@#p4oBgeJx2FLZYb?SUE(ogONb)H<O4)3+}OQFxFq`n{5vl?Fgd&vJz
z^89k}hvay@&Pxp9&ycT>Jii>gQQYf<@3+#AkUv=R{95o+rBAPO@H%yPuge<Y&roNd
z4eA`dP8~jH_c}*zQ0Js|>YNohuB|qx^PY9;6h-P3Z&0UhojMOnp2rsE=dca-;rZ*-
z`FW(DTf}|6E?uY2fsuaxBJOprUZ>8^lGo!Z5%)S@TBpt_lGi%NY;ary>(ptGyw>@#
z)c1aVv`(EvB(HV&8c{H>^Q(30To&o)*WzC1PwUj#R`!YZv%mD|b^ftVo%<xOb$+u!
zKYagE^Lt0?yk7eBes;k7B3kE)NS$pqsI&Vzb#{%^`TGXPb?`cM_L6b6&mV43=a_Zs
zd^*z4qPWk`yVj|*i{!PRFK*CJ?K*XS7^zb#?){v<P947X#a_an;XL+-4f^@qI(0rJ
z<FZz$^Ue+Gd|{nBU6R*2`-}T=eQljO-;li4`H#5Q8Cs{#uOzQ^E|TN*I(#2g^C`)z
z^ELBeUWf04YW^#ce%>nk-0S>lo#WzbJFFf44C{4|)b~37UZ>7SB+pu*&WGiAz0T`b
zpX2FA$p0x)=kFWT*?XNjH%gvkg!)&Bdp}34Q>R1nTIY0euM@u4N<YH5H%E?(ui=Nh
z*ZIIYb*`0hIYy|@*UHwb6W)8)kC5+<)Y)!>{S)4U(T`B)ph%tXiu-Ye*ZTD%)VW*o
z{95n=ajz3zlhu!q-%0xC*Mk3NgF1Y_Q}cYymKOdDbxz!%&Live^Bc*tR;cqfaX+r#
zuT!T}@>*vPaj*02I(1$fnV;8hP>1h#>bQ?eUj00A?<dP117RNc-U@4kKZ8HBK^=c?
z9P%HMJZlB#do;nkpX1i)=M#}S7l?bE_pDRra>;8yFG|+yoF`uk|0eW55vg;atfSYt
zbe%dUN9sH!S+Aq_BJAg<kvh}jUgr)OgLR%XqaP^lb@X11dA`>ZKIcc6xBEA!Gb>*U
z|0d*jlm4|%r)0gKCHWfb{3%lBSK?l08~GaR{Mn3tuDI99maj2?jv4(}aj$cLe2w{|
z>{#g)lJz=z56XOo?Au`BBh3HrrM}mxk};UyFH&b&vR+5;MOf#Zk`ER>LO+K~eXn!A
z{hN?~gBj~QF79>w8WZaLS>|DLGw5en-0S$gPN?&UjH`9Nyg?nlU#R&HN?!e=;@;1Y
zjUD>od-tpn{tR9zS+B$Q3;AzC{*#hdziWejesBLK)cLmLwa%52^?v>#Ukm>x)Hy)*
ziPjmEtk-!(zQ#IyuZ=b6bCUHsJKNZypD#p?Ye3xV<gZibt1>Qo3iW3;s8hO5ot+|e
z?iKfb&RC}ozn6x+aDEQnpbp>X<G%_0e_rzH&uwsASFO{})sojbhe>@ut~=JL^XW*P
zhsC|lch;%%PswXPSsV28({<|Pn1xzl-qOUqpU32D%pVr%XCKLWooD20tmD^4`khkW
z>%6>9opU4~YJ`t)T<MbaI<I?elH-3v{uY@}^}mXHodedXlPh_x^O(5TDP5<|gOTI<
z_6Buo)~WMW$!kB~5chsAS*OlFC9ib`rBAPO!#Z`|9;x%k4eES-ojONLUi<l}xcBqO
zI&}&puXQezKE2N4>(tp%_M6txYm3+U$2xURjP#Q!^}Wuv1PmPZ^Zz1s{wB_Uw)ye0
z`fqn9NS%MlJm_(KNu2+Tbq*y+ovo#Rt<$?fofFon<M$w;Rv35t4eHdcQ|AGh2kmD{
zod1l+bqN9gAo%xWT&>f)L7gwHQ|F0Dot6#ie1Dxf7fN3HIbWRrjK}o^L5}NRlGi$S
zN}v2^tn+t*)VU#2NAFGe&sgWR_&HD=*Pr`_uZ6t+J`k_7?>cq%i}W+O!EqI@Q|Et@
z*FK++`rgmG)~T~+<Z*HO26f)QPMy3+ohPMF@8^^2)G3m@9@n88^wY9VonJ=klx$Gv
zi|f?+V5Cmd26eu<PMsSiugA5m)c5%rU8l~QB(HUD6Zbk#u2bi}NIxfud!40q>ikaf
z+K>KTQ?HY;J(J0w;c>JnQs;pUjw^4SI=e*np*{!oeu~zqvwft_o*VRY!a8-TCC{S{
z$9u9IulIBII(7WDlTa(v$&>nC=c0A$oF#ef=hO}Q=~}1G8zXgovO%4pb?SUp^4ibg
z;(lDeU#E^Pm*#`x$3|25@#f9*792nBkjlouVLpQ&kI!?>-;2-l%|C(9@$LAp*1rs1
zY<Ye^RjK*i_`KZwA$(qG{y09bHh%%1*P8FNdVJxdKKbL-KKcDQjpipH-)w#kyw#jP
z$KGzvpG)sF??oNX2j~9*c(3Ju0q-||3O;DQ4c<>2Hs23EYF-K-H-A5T(wy&iPn%zf
z{H*y`;PdA9!xzne3STz=BYg7@eXV|t^Y#Kf9rHoo0q@sjn)Ch5Z1cmB&o!@r=bL{B
zUT7YEwljPbn}?t23LmBB;b%F*N4YtFKCsgK7sywe^XK$x&6km{H_ybmrqP_w&A6{Q
zpXJE6TK>cEc5~iCcbfB_pxgXz)af<nYd8Joyao@N^Lto_&C_x29yRB^#kl#g$WNNr
z!l%voy)3ild_8&IoZmCLXwL6#T{eI9y%6kouFJpCPr5mu8}s+8g?uPkaNOqYmKwzK
zVAlC9e=mf1?&?3tMBVK4<llunwp0T6Z*W963$IOEuljzg|IZJ8Uv}^V#4&t|-h+R@
z>savpC66Doe>MLg^84Y>kUvQB_%Xs)^M67PKMwJ#^E`E$)Cqkq;PdyGKabDr&Hs(h
zuQI=+I)NL^w@0tHn!g_YP4hRvzhk~H{Kw{7VccJuzaBngUJQT6ybAuJc^&*U7@zBS
zTU8Pazt=B((8JyeA35f`<MVyYU&4(DuiLD{J#>`i3-S4h=Evc4{yrSm*{ve!=Yy7i
z37dM8`M0p4E-}C5)T9p2hphkpcO`zK<v#?!-MkkY@E-F<<oSDJSpSH3C-r}3`35-8
zSIl1qf7<fDgD;u?1->=rgLM|*JWtSHhVNzh9kCw@%&Xu>nV$_WH@^serg<Bjzqf?_
za3Avig<f}NGH<O`=Ti7}<|WvNJ?5`IPR)-)p1=2l<DLqC*z)g#^ZV48zXJYe%kP7I
zyJ*huw|v?B_o$PBlQ`=?1K-m;AN%b{^TV(|jxpZ}{e<5M7Cu;?=eO{?p4552eYQCt
z*Wq`wXucNXhTplNUX0_s%sl+8TKEV*BOgB4&%i0k=iz6c!w3Cdc=#Do^@rfRFJu1K
zaDKlMeIEXp)!7R3^R)SyIIic+E8s7gpAO#z_e~s^^Rt)vN08_DgfM>|oX<V!JWn2P
zbsk0j-R3`rpJo1CIA7~v{U$i?6Y2bZb-qVQ|1|P9S^XaP?dF%mzh%z(<a<4=-;F%)
zH|bZwAGbRB*l&Cfg?XN5pS3*q|G&-ui260Sk7J!|)c=S%&)1(ae+6|uW1faOSDWt$
z=X(kqcPBXSPwCI1K406UhoAKgAN-jJI?q3RFNS^s>i^gJ`2(EaQ^!1iuMpp#r}O(2
z`Mo7{);|U}p!7=AKiT|N_yy*lg}0h-f?s2PHv9(j_rPy8?}C5bocrWHb3VU*$h-q}
z{%-y_eA)aF_-k;V&-wWde0%dgc%eDJf3?`0_e*8wCu5&fn%BVjJ}UcZfY)2T1>R(S
zCHxBWqv6+@^ZNHi^SzM2+5Av=ulXyOpI@2tb%3q#yotxvi|fL6=HX|U!^a!Ve+%E+
zoY%*L&AES$G@n5ozQ4zQw#WJC49o8bKhOLP@C(f=_fPu2%)C4+@h_M^`_9C_Y<>jl
z-)YYMf4_NAZc^t#^SQ#rC(S1?4^NthpOFq9^X6NlpXbg0i2VP|pNDUU_YFADyngRt
zemM5SKIXixA8O9)`rFO<UQxL@f5xNIoX7Pc^8?Y(dFDl2cXO`SW#;@|f$PkFfjYOC
zzX9WZ-F!Fr{pLSIo$s5!6aI)fzo%`=ocS4Zz9%$qemUy%eIc&zmGBf^r>9>B=lef&
zzDJvF`7a^Q_j#EA8vJm}UkpFi{51F}=KTKZ_nN;S`45}(y!09KbCAEv{9O3G5&xb!
z@5dfC=X;IMnDf5vdGiM_?*Gi$=N>yGk8jTBD<>zP?_<u_6%RFk3iaP^UXAnKiRNd+
z-)(*#{ATkP(a%@Sd7pN-`9IOmcg_C||A{%*@mJ<6$p7A)@6kSE{ubP~y<mP6e5;JL
z^UQs|qxlq$cQ^BA;rp8Z5$E%_n4gfJjCZ{Gf#~N{^WEW9<{9vF%-;t;*Zg?+C(QY}
z&;{n4|Ie9!0Clc4|0w)sb3U)R!~EggWF8(cAIE(D$ehm~eqnwQ#(mP9&nxE5dH#RF
zoIkU%^^R-z1D}Vy-kjf)lw;2CeL2AVe)M^``6KXmnEx7HY0l>}A28?Z?dO?4jXD>Z
z^LzE$%wI<SdUL+leycg(%fHL~p6!!){H}QlkHbgIN8rCT{~7!*=8walH~$;_74ui%
zJHBr1`etJv>|wq)`~dR;_z~vi@OPSz;`4W#KZ4IcX#O}p|D^eU@%d-WcY1wtJlB}N
z4}P<GJ^W7d%i!NOe*pfF`48Z~GJh7%-?Pr^*Z<(pS^i)6eOxQ%Upyi?uI=&fUaf<C
zw)u<2Nq#@`J@EUuip=+eA8%d==kI;zxFztjEq^k+!Tfair_DbAzsCGi@E-GP;CGwf
z0{@|TAN-f*--6GY{}}$9`7hxs<`V~CT{4qDIX|25d&#oR{|~;Oc`LlgoX-=FH|O(+
zO7jlXIorGo-eCS!_@~Xk0dF_|4*Vu_{vNhI^Isu<pZV|MqvrGQUzooLpE2JSzn|@I
z=DWa`&2!-V-*@7A<-@afTDy)#@Hd+u1urx&haY2p2E4-j9Qax0AA#4KH^476zX;xD
zekJ?{^Dn@A&A$ZymiZ8T#QZ_{&&(&_)8_9fOy>7#^T&{1GJg`jHQr$6dOZctG=J>P
zN&UUdUqQaW{Iz%k`6%<U(xgtg`9XO6pK1O)@^$7f!_PO*I4-H*YMuqZ&U`O;kNJV{
zZ<@aiK5YID_`~LB!KchW2LH49h44l5&%s|dzY3nQb8_5V#~%3Z=6AyL&A$&n-24f6
znfcT3GtB=1uQmT4e3SVl*jFv)I~<=J&(-F;z`M=&g@4_AFZ`avA@hsgk<|aO`4#X<
z^BdrQFux7HVEzF7CG&B3I$r<ddd<RjG5-%d&wT6hr2oUrw}+RS?+-uC{0w-Fc`f`r
z^Go5)=3j+>-uymzm-&15OZxws`Hzvm*Zddo2hINsf7JZ%@F&e*hCgGTc~a8Pzs=tS
z-{y_U*STJY!*@0>f$wcz0YB9I9Qe`Z7s5|5zZQOuIlrIkqvm`a>2h;E&uTZn9nYt3
zFy9UDm)vH~pU1r0{3PVRXU^x9kC^lKu}+zvgF1gQ=kHN{&irEJ|7-pQc=|4D*YPXx
zH<}-VdDzFC_l<8cFGK!VbH2`as(B^yHRk*o-H({_cT1gb&fjU+W?qQny2kuqjC-Sb
zKk~Pm-w(gXd;~sX{s{c1=KQ^@kD31-`M;RY!xzn$;Quq{&tq=C>)Q3rdTsLguI9P$
zJo5wLZ!v!>{2242;is7M{k&@P2IN0teii(D^V{K{HGcr!Vg6(I&E~&`f8G2k`2FTD
z!bi>1)06pp)SN%B_dD~qA^%tNa`=*YHGHe=wd>djf1P<7d=K+pc)s~C{B7oZKkOam
zPa%K0`OENg%y-@{>H8Dr2f;5fKLLJ~`3K=&GQSvphxr%a_nY4d|B?9*;J-BgHT?JH
z&%&QI=leSUG3Wa?8N01r$4u<2J<WOke6x8s&Q}MSSHX+TKLUTJ`6l=o=KQ&sbId=F
ze1rKH;GZ_<|32g8=Jz4rY5slqSIi%Rf7ATe@CVF!JsmUW&&B-8{3+D=gE_Bj&zk=Y
z`DJrn*D`lsyS~i7(VVZx?q$9WUN1e!JQH4Qo&|rWIp4=R!+d|_&oMs&-eAu6t1dR@
z`&FMeKL>TbXnr2N*SraSxB2Dp@0s5Kf5iM&_>1Oz-|K(ocOk#s9&6X@HF!OFXY-@s
z+2(_I{d8}0zHff0`6;MVVtyw4B=Zl!&opm<f7twdc%%7e;GZ$S0)DkQ->><S`E|(m
znSU96uleopADZ6{|GD`v{0Z}Z%=4ej`F_>k&7Vh||CqlF-zI16x*v)6Ep{^J`(JyS
ze--^4X#OYEKg^tc9&7$E@|EUKz~5{B8~8cqe1ERhobQLVo4*#vd!6}i@Y~F<!}0c;
zAA|gmIo}r^H7`S*33Gn`(zN-d$j_Ny34hW2t?<;IYuA_WFK3vaiT<<A`MzDA`Dc+Y
zG`}2PV*cv?4zKy`$XA&U!E4P&;h!}B8T?Z7$KcnR&%tjt=lgkgn6Dszulcr^=O38w
z1ple|?(pB5=fj^iKM~_TZ{7f3Hvcd@wb$BpKMTI6`8gOj-@F2TsQD)N5#}F*zr&ob
zGkn<mdF0PCe+GWO`5gQj^HcHqaF_W3@UNTm_2m1_--`UG`P<=-nx6=N()<+obLJPr
z|7FhiJy*=HMSi<CtzE}1_%7zR!uK)13;q^!z7Kb#Ip4>Br}+fxoNoRY{KMwY9GUd}
z33L8{^{36RJtE0pY0mdyyUagxP?G<u`PWeATjqDezi<9S__+Bv{I}+h!~bmlH~2ry
z{{>$$Ux9Czn;ZvUKTIo5KHtSW1HO;>F7QJ0{oqHN9|}L&{BZbt&5wuInV$;(l=)$Y
zq&9zCYJMj2*O=GByUovo-(h|}{66zb;18N#0iQ7Mgg;?^GyG}uKKPRP-SDmVPHq0+
zIz9l;H2*$)FY`y>1?InkA7%aoyxjaR@H5Syh1Z$C2tVI^2RwdT&EEvS&irV2k2&w3
zziIwn<oUmU%XzyN{;=h{;Zx?X$NQUqHoq77Mf2~$UpAkBXS{jsI{prxYknynzXzCa
zgZIA=H-8=c9p-O@SDNn$|A6_v@Q<4x1aCG!3VwxoDf|ZWbKrNI*TWw)=l97!YW_*&
zpEUn0{2BAB;4hkY!(X${+I9IVJk$JStjnI}?}i^}{(kro<{yWjWPT>btuj9qUTe<&
zKWY9p)NeNLN1ZFo?}p!Cen0#+^Y6h2%x4cz=JC7c|A9Yj{u=c88}m%~ta%Rn@8<kD
zi<ivzLH?M$wd?yh`Z>Xz=aVzc`F$;CoBtB?aGv>Z;TM`e1;5Pvz=EW|>&zcQpI<hA
z6n?k)Pf`E7=B)o?a~|*S%%4M@r_B$;xI65-c0Tz$bXW6Y<O|J@gIAfK3~w;6f?r~O
z7W``SJ<<0q<{v`-PV;*BkU5_(|H6Ft{gUH<+MLfv{%QV6)PLFh0{9N7$LkcoZ$Hoc
zQsfKGJK!bex4_Rd=l5xU$ow0~Z!*6d{yFnJ_%-G)V*hlTKl9dP-tI6jE=v49^W)(U
znx6rmFn=HX3G;K|Pn&Oo|I54?&j0;$u1h<7$Nkste?E?OH{TWWv%h%?b&AaIDNO2~
zX#N+>+v(>2#XR%p8`$U8_`a);TRsEcY+eMv!n_)OgLy6dHuFaKfcd5H@0uTSSaQ4%
zo4*zQ8}p;#v*zXS|C*l$PtRYwUT4C0F|UR1WByTiq4_5G(dHMzPd2|4{$BIX!|Tki
zg@4NYM);-Xx52M5?}vAr55n&-ABNv&{uB6v=8wZC%>Mv?!h9b7SM%rKX$P!buVwg7
z=3C)$k!${1_#x&y!As0{gP&}^FTC3PF!;IV#qcKci{Y1>x59hPuZG`kem(qq=H2i|
z%=_TKHNOk~7xQ8G^XB95SInP)zu~~O>vb?5?|YiR0e*=2{_rEscY&9gpALVQIqTP&
zpMw0y&5wd#WPUFE^X7YEA6{>MIr6uf^ZId@c?Ql?!{)ofe`3B5{MY6O!T)H^>&k-p
z(a8VDybQiAUiad4<Rtjc=KT5MTyy^X-NEL(J{@IVhx#X)^XKxa%s++v2hA^rZ!-TI
zuBVrn{|nx3zTaDteSD+&q43+yi{bZ}9}gcfKMnp<^B3TcnQw*t_80RV;fv;Pgzt&x
z6I{oO-;f;FzUEi&l=xfB`TgZbn|C9BlKK7c_n7nh%RgxTTjW1s{(Jbv=1;+|Fi*#E
zU2pyf{43@U<38^j=8wX^ZT=YiN9Hr|N6qKpPnbUkf5!Zu@E6Qqf~Ot4_Plxr<{`tJ
z&pWcsZ$ti2^GW!-%=vo;-f#X8^7ZDAz%MZ8^YL!;6xL<H{2!?E6LY?w_$zb%{N|kb
zOQ`dL`L{9d%jP@6x5w+se7x)q-^HB!|IOz7IfO&Z4@aG&%#VeiV15$(4D-|BXPZ~U
z&oi%uUub>>{4#U?e8P3+UqSvB^FEGy=-U0+0B<tq&qcJDUx0kOInP&1=HJ8P;$`y*
z)Y$>&b*|%Y;MwL&@O{m<**Q6$!_0SrA8VciuP}cfz7OVo=8bqi^<4A+!T-<vv$;t>
zt>#~WUu%8`{1)?X!S6Kx4t&V`2k;-6{}cWT^OxXHn!g6GgU_444*r699$z<qOKS56
z*YQaB>&=gc=a^rB*Le>x?|>g}{$=<(%<qI(ntvPq0rQ>ly3@za{|3L<{2%Zu&0mDy
zXr99BM_)6~fZuDr2mC?v{o#+A9|eEXybS(~`DyTfo4*IX&0%ZT@uTpa&3^*l+k6Us
zsQF*vd_92sWLumcPO<!s@UzTMfq%@LKPS>`{(j{7e4XQ70q?T>_3+!xZ-d`!elL8?
z{JA$I^Y}~iKf-@!{sjDK^KzV*{$bAR^@{mEIKOT8*0t+c0N=&@F!(;^N5cOfS9bv)
z)zz+TJh(%OI~14V?(XgscXx;4?owQfySo=DQYh|LoW4+sON$;h`+g2<uKd35^v$0u
z&#YN{XOc`ZGnwI~<ptnFLim?g7H;3?)Piq`=l9Lv*W{hyujT#WA+<ka;4$R(bG9A#
z@8wI-{~+H8x4$cmsr&zI&RVS}3EciJ?gzL%e_$TC9mkUJ)iM12sRqv*)AvU7Fuu2k
zcTnF4-djEbK1@CZK2N>?ZjZ}a3tz2%7kr!icX$~+4(AfQviv^0zWgP;g*-$Ke?RPa
zb(BYg_mC%okCmr~&ynYWua=jB?~~VnpOiO+zm<1}e~=G^+vAkR!(+zwum2o)V);sV
z8u@m3F8N`2N%?trd-)xB5BW3r5cwzgM0w<#fyc3a9RL0J@MiKf@b>bY@E-Ew@MZF<
z@QiW&%WVYDFYf^VQQjBcOFkOjPd)=aRK65GQN9^IUw#0-TYeh;T>d9Kq;B6H!{f@|
z!86Ol=L$St73Hzv_Be_ZaC^K&R`_VmDGZ+`uLxf#uLoZy?+E`zx3|6EmF4#L9d>)t
zL_QRK5BX^LDEVA?`k4NHErHwf$8Lac)SNx=t@7XD_PFH>@XPA|f*+DUhbPrK|AYTe
zeVE*V$Ne9<{XLrPTU5<Sg#Ls2lyJL0Aq)J4`eN|<nqLlX&!boiZqIAl6mHLJ+7Vts
z^X>1;?0Qv`k3e5r9wATQ{!EmA2Olj@1h?-K^1$=Q^5+(TTVDZg=g*Juox0rS@JsT}
z@ayt^aQnULRQPlC3*fKiYv8eTy$-<-t3Ls^%e?~MtNuRxfc!b!j#s|Cfye8K`l9eV
z@@nvKT7O;mf9hMpgVgtj+vC88!{e#{8J<W!51vZC5^l$RD?FY06L5Qc^#%Av^|#^I
z<p07O#`gC&M83d%w(~P8+#V;A5MD`hQoyY*0Jq2AmVn#ioU6do$MM%!AD&O%5uQ}u
z3qDip90p%4{~5kn{tMh5FTEOmUHuNYJudn%{9pCw;6YmdEqHkOKk!)c&+rABA2EO6
z@!cbj1wSKC3V$H~0X|okYtIj4x5ESFh0%|fmxs@g*M{5eNgMe0asBJl6~10`2EwDM
z9|w;wUknc;Uj=`!`J3R|<n}y3whzC`kE1^#zXU%mzYBjPe+qvo4=NCNd~eDl!LP{U
zz)R`+eh+Uh&jH^cF9d%eF9rWyUJZUt-VlCA-U)tEJ{(>ko`3zP!rRK{!%xeX!+(|U
zgddV0fZP2lC*k({qg(I?n)4anFp<Ch@C5^pV}tnq`?26{<jLT@<eA_@<@w<Y<z?XZ
zc-NZn9qOCH56U~ikIVbPFUv>6@5raa|B)|-|0mx7x97jz3lE>b-_PUlnDWc;<nsIQ
zEb<rdg7VLBd*0p1g#wSSJ)Slmyq4yqf;W?AgLjY@hWD0NfDe_|flrjTguhDYue%#O
zqR!hv@N)8t@QFHJ=?Vw#Ly#^veUU(aqRY(=pRK+Ke385&e6_qTe6ze2e2=_4{E&Pw
z{G@yW{D$0~-^;!(+?B6DpHtU&E4+aGAiSjf3_OecKK!9B_c`1ipKQ<jW$S#dK4Q_p
z<6^ImkN_S+mzxT1e_xaf{;%d2g{RV-vhYaq%J7)-ns9qubbYuzUbi{Cg64FFH<R~+
zca@KV+vA+4!pEs!0G}gY179WI0pB4%1ivc32(Kr<4L>J;3_mDOT`cgp+vA5b!R_z-
z^T8A9cAykIwY(ZUy}UU*i@Y2BvAiF=hkP`AuzWgvynHcyj(h`rrF<`ZyZku(p!_oY
zr2Ibow!D7v!2R!%)PKJPJal5;yTYT$2g2jX$H7y`XTh_|m%$6jH^c4my8Gc9llbdA
z3EwTh25+V7o4<tradx}3U6)$|UQ%8aZhw#65MEV%J9ra$Z@4}Fc{qHS`pNLA^7-&3
z@)PhC+J}qqW9sk1FUp_6AILw#-^e4D4BXGKy4*N$dpvUrcw+Tg;OXQA;W_2y;6>%N
z;T7f0;dSI);P!at0q}w9$HK?RXToR6_rn|NJUj+Jto{=Gto%8=isrn7+t0b-N(CO5
ztC|xN{y+Km@Hg^|@Nl}^eDGNE((vT+8u0A$Ch*+yj_}g*LGVKIpW$QV)8Y5!zrgM9
z*;c_@h6(!mwheBtQ*aP|So2T8?f2=|;iuH!gCCOzmHvA1|NnY?vA_4<4+Bpxj{>)!
zLzBQ;CG+Q`ftS&o9PrBWqVT%%N^pA|ay@u^^{wGO<UQc__~aq*vFaznr^)BS7syw_
zH^{fa_sf5SpOBw{Uz7g{|405e{Js2NctjnSFl7Rddwh9xcow-mU#Wdv%On2*eQ|jn
zcul!IU#ZQxt98~yA6<PTcyf6gxIN!*H@H1Mxi>s~3jg{Kf!podMED+E?p*j$`AYaj
z`8N1<`EPK$U;S_R$K?JxU&3!|&S&^E^^wX39^VD>IPmrI<nW#HOz=bUeDKrqQt&(S
zYVcR`=J28N4)DjizCXe3@!lihT{UMaysvx>yor1({G%@SAUvx2({Ov-_zidl^^f5B
z<!|Ao<e|$29!GoJcw+cXozH3D_Bh!b@D%Ec!n4Zj!H>(E!Sl#F!B@%q!fpOY_*V5(
z;Cti?;0xs|;05Gc;PyE1{qRcaPrz%*ufQA0AHZA5-@>QJKf^o8!;}v^zP;s<;3MT3
z;W1MBAD;uhTV4R(NnQrtUtR+~M&1}cN!}iAx1YV?_V;YV;L|l{3w*77AAFJgINV-O
z@CN*~`aAHVsr-F=1h?M<et>6JAErX!@v^@+_zrH5A5R2NtU2l6spVPWwr>UDHm4lC
zx8_uXw~{x6+v`EMh1=`F^@X?BoCK8u_rYHOF$H{3YQM_@A1yBkx5puugU?i78$Ms&
z9KKxM1^&By0Q{_cEc}{$7JQ$4A$)^;EquFtAKYGN?Ku3d`Wx`S<d5Lb<p06#@zP-{
z2Oh7GY5ezNz$40&!YAwTAsOKIxRJc@h3ZSeSIVoyH^>{qcgs7#56FLl7tQ2fuaWRN
znSGxMx5rT|gfCXV4sMU%-wofb{&)Bh`9=5z`4jjMU9Y$F5dQi@SMmRA-#<sw@%j#K
zk9$uHPoO?M{CjzBxIGTM1pJu#s_+-`hVTe!{dKp4$CdYn2L=26aJW6c&185=&6y7`
z7}B4!2A)&>PPjd8{0O|H`txwR{l5+GmfpYICvbb-x%co1>cdy{KhBQtY<VpB0(mlc
zZJj@v;LYUu;qB#R;63Fh;r6@+m*DAj-0#7&$)CgX%0I#Fc}pTy3*3i_>a)YQ%JakR
z_dccJ_0?C0+x;``;H}j6f)9}og^!d^g0Gb?hxe1OhqsgOhIf~rgWGzp!EMf8aGUc9
zzEtzWRuA0&aq{T!sq)0|Ir0+l2l9&Wv+}y|JMu2@%kn+&xAG)40@t5jpTAS!ZS;9G
z7hXaAN_Y+VHh6vcZ}8^wGw=@bKjA&)f5QjL|Ami~hp8EOeJ9AH!)MErz)#D6fM1s9
zf!~ssgg=y5gFlluf@e$Tue&|Gh`bNHntTL&f_w@*j*jnActZImcp>>dcnkSixIM4J
zO}IU-=M~&ufA9m`Zhykp3OtVXce63!_PUly;r6(;4DiL;|Eh3%K9M@`)#_Wo?e*)s
z!1t&h3STE54^OG%H68v={bG1X^&8;f<$K{#<;UT%<(J`!<<H@L<nQ2h<l$-u9<P@2
z{P55667U)Fs_+%^hVZTOcJPDp-tg1%;qa^S$?&`K`EYxlku~r)>dXHaxDQ$M`BEKj
zpBIhb_WO%=aQpeUKRmhS4}sT`kAd6#xo~@4k~DP!*I!!S|73>S>rLl}+v68X!#CSL
zz<0?T!4JsW!H>y%!OzNv!tMU&iSVoH=fEGym&0GlH^V>4_rb&c;P2xf@YwRpaC^Rz
zd+?U(-@xn2Kf&$!4<ptMJdXDK_Oapid>6^!c0YVZxZSUn7jECLR)Lq&I)8*`k~fFv
zk#~mM&oBMpMbwXi+v61W!}IHWJ_c{6IhWww<oDqH<<H@x<e%U(<&o+I9+#!^xbV&L
zl<;5WS>g8lEQR2g)R%|H(mwnMPbqH!x4%Q{3b*H}9uBv^2ObZ%*K?l*zpHg_gonxC
z@7G><O!*)1r1Hyf`#ib_&!GMTJf}Q-{lMc@KpqQTTK+xU_ALY4{(dhH+#WYn0^VBl
ztH8U+>%;BqOKZ4&{tki<)SQ`c`}uJRe6spq;XCD*;Fslh;dkV3;Q#7;2+<&L|DVYt
z!yn1x!c%De_wWYtAK*3Q+2DQTdEv|DMd7w@72&pTb>P2fPCNK$d1v?^^4{<R@?mhh
z-+LZBf<E7u!ZU^T_kAP$t>*s*|4Uw^Vc_w~srw<z!tMT|T5$Whpc(wO*4Y_upI`mq
z>2$ec;F;ue;g>akIlPbVZ`=Vtrv5j$U9YQfTmK#SBhC3A{EhqxJe1b|3LZ`V4xT_B
zsZro@vDdSX0k_-dByij3^l-Z!%LOl^%Pj`4D6a&!<5d@4O?^vvZFyIC1Ni`WGx->J
zNBMO4Lir;2digr|UimKg5&04LIr%xbeO<l@zp4Ij_*3~?xIJ%FsK!BG-|T)=`+64*
zZeJf0z@ugMKRz`)mAnwVg1j8uejaZCpQ`mYhYyjrhYygCfydG1PKDb#=fdqgUjfge
zIa}a)<on@8<R{>{lluGi7Cu&eP!s>(?YK0QM}fc4?Qnc}bM>j=o#ff!z2!yVL*ygj
zNwfItn+VUY>oo_SGKAkRhmQ#9`)2riUG6@(-Ol_0x7(S^@DN((J-F@LGk93_AK;PY
z;hXyFwc`?99upo{o)m7!{UH2~`aj?`<X7Mg<PYGT<S*d^<YAiyuK&C|Dtw|mK76)3
z6?~aIE8L!kt03H-hpR07sODUQx6J0R`yRZo{5iag{1d#IJW}((eW))_4F5%*9G)h-
z|MBVJFV*LQ+v6#U!QZK`0gtQs4dC|tfo<S+zvy_ly{_mixcz>18Qh+4e+%56r+q&>
ziq?4o9z!0gMc_W$^U*|xk5?ZLK0}@gZqJvL4Zd1^VfZe21^6L(9rzh}OZYW;H~2&O
zAo#!X@$k?&{C$}Xk0M_Vk0aj#Zy-Ma?;}42A0fXEpCW$<x92l@1K*=QRLj8QdrBS*
ze<BatDzLw0`v$L~eiS^pd;&a+d@8)Sd<(p-JXPz!_1usbfp5?0ca`90<o)3<<)h$_
z<d5L?IyfKT_j37{8?H^@I<Lv&!$0TtyX0`YeJBc#p2zRY!86I5!pq7#z@zEwdmnfS
z^<&}ox>Qr)P1G-hx0kPj50meK_m&@qcaxukm)H9LhA&qC3~sMu6}oNUafy=Ge?JO5
ztUNy4j!Sm<DfRi`H{{jfx8%*>59FQT_V~@daJ&C!B>b`FOo6|Y&xhOdlB|J$R=)>s
zuhaTFJVHKyKQF-Tc}#A@4@dU<Cvf|Fn@{lknjf)U;BhQ1j}5ONPX@QYXUhn;zh|oj
z|3Pya!fj4lxXtMcPpmm3;PK^?;YH+g;H~7#;6KWD!gt9J!0qosPr~hfo15^+`Tc$W
z8(vlZ3LaJ-qJ7};iY<={xBFWX!k4K}3Ag!K;WobzykS^>9c|#(G`}1CfAaqD7xIzt
z&+?z)ISc!jI|m-MfbT2dvE*Cfc6)me9$)=wcq;h~cy{?CcwzZlcs+UO4*q)W=c#t`
z@8G@ViQ%K<>EU)emK#1xeQEd_d2RT9d2{$_c^CK%`2hI;<YVD4<ul<y1^s<l3Qr;5
z44<y^<N$oL{4~6~=KKjCEPo6iC4UE>ArId%@Hj4%$A;VIR|>d&er1Jk)11O^dmfOA
zaC_dOdhkP<(*|z0GriyqwQs}W&E-?ze`x+f_&ND{_z2C}3!fnW1Aa|&uEOuh{|Em^
z{s#V99=cQD@%ku_4i8(%?~=l!$uq)Z%k#q%%ge$C%WK1@$XmcS%Dcf2$Ops!kWYl)
zmd}Gfm9K_}DeUjVPIwIYQFu!ECAj@w_$J)`e&cU=INd&cfZOvfh3o9E%Wgj_sZR=z
zr{kLzZr?BEgojdJ3~tY7R2d#seFJzyc}sW(c{g~^DE{>s1h1@q0^FYeXa?MFXO_V2
zc4i~ozK$P)kJIIzg4^xhW%wHP_u=+>@h{-^{Yg-lz~k6a=V5qwa(PU6T6t1<CixHW
z9P-@oeDdP(qVmdcdmf^C@E_H8hp&?NgU^(Yf-jWMhHsZIf!pWxTKIqJcf#)!_V@ia
zxcyvq23}tMpYRj%$M6gCa9#b&vCq@}@?dy1d1ClBd1`n~d3Ja|c@g+<c}4g-c_VlS
zc_(;d`C#~b`Oom5<@4Y<iUfUqTLdpAUj?_{7i@!H*3a+1!^>&TN%%zhCAi%W@D%>L
z`v2e$<e|Fx*TatQD|r;SJs(pXc%-8K$ESq1FXsCXaC<(T?C`9bQy894ULIatUK?Is
z-U@Ed$J7m8SN%|UWBEjQ3;A4lTlpGz7x@nONckbSt@8|glKLC)J@QBJWAb-!yIx_t
z2Of93UeV!pxk=zBH9r&F=I4Xk{8I2sno|vaQ{E8%R^AT&N!}M8UgzORcvSfmcwG5n
zcry8Vcv|^hcxL%Ycpmvxcp>>;@M7|}@N)7{JpzwoO?fnULwQDcPwiU?_-1)|xIHge
zb@)v6jo^#qo#7AUec`LM&Jpl?QT^*V6aKE0?+f7}iu=A69#Os%Zhvoo7#^(tEIgk4
zPk0LXBX~Wn^9_8hJY>(n<G5EI6@FMAAAVMz3jU`&EBukXApEtw9Nd1t))1am*S8fs
zgS;Eu?%x;)xBKD8!Xs!sGvL`n`}?&R9!LFpxIGWiZg^hxzr)MQFT(9O-i6!Wl|6?y
z)tt}p4)Q3y0*`wSc>?$Vd0O~5c`o>Dc}e)|lK$mYgxhhf1J9%5*aB{^o6rSrzqjoV
zAFKOaN5d2AI8KAx`LGaf=g(UBEnTmj@JI5)a66yR!R_^-?!!lF&Qo}P?av2zNqL0c
zfycLsJT}~(UoSbljrz=Rdw#tF@P6vc!Y9aU!B@ze!MDjf!}rSj!;i_wz|YBNz;DWz
z!0mN9Hp1<B_<x1p)0{ux59L?jujCKlVM_SN=_TCG!=OHa$I)I-AqqT^=ER5F?L%t#
zSoPWAQ{+Y9GvyWG9dv%yh4+)MgWK~ezJ(9e{186{Uf;CxsPHWE1n>g#H1M+W9Pmo=
zV({AXDsa0UXb5kjzCFCX{3o~_$K~*r+P4jG>-WO#aU#dzOLV!H;kN$!@J;Gp!0mSU
zGu(b}6}fNV@%mMB;=zmPdZmJwm1lz=)||rdQ}PP%EAl$<JMxzBYP#HR@cQyWaC?4(
zDe#=?=fG|K%i*^E&2U@)KDe#_54b%K!)16Vt>+#*gZvrXuGa^+Jx{{meu2j~q2`Q+
z+xJD&;PyNu3*mq3xU7ZS<KT9}?fE?q!|i_Hv+y^X|0mq`=Mg-nuGbs*f?)sp_vjzE
z4;R$;hui&Nqv6xkPlMazuol91s9y^|D&GUQzXv`KU#9*qcrtyT_7rZ%G2Vc{>l?eY
z|9*0KUU>$1M|m;$czJ2~WqD<|J^rp9+#Y||3jQLrzs~OPon?LR51&%T_tEe(@@ep^
z@`dnw^0n~Ny4+pxn)0LY#`24BTj!tf`MTUk@Wt{s@a6K51O4l5_rI-{M}@DK$A@p0
zr-E;nXNB*U7liMVmxbH&7}kUzRo?`DT;2hGQvMU%j@KmkbM-6XALU!&-|KiCgr}09
zg%8m0Yi_}Fs(%Q#%Y6;E%MCdw=<AyuN4wl;@bsFW0Uk@910G7AAHGgr0^U+y1>Qqm
zA3j9h8a`3p9lk_989qzC5Pn_05^j$R*b2X-{s7$W-#!Vq*K12VIB@?fm-FAx0xu~q
z2p=Rb3Ae`!SB2a26g7a`?Oq#rcg-ITx93}&2>)6ARQPK7T)5rewHZFXg1--Y;P!p&
zF?jOwet!vmGlcK=;9b-|huhcFPw+nK6Aba^+2>0Wd2+a|GZQ?W`h4&l@>1}s@@nwf
z@|p1B@&#~v-M}?)JMKH+_H)4@xP9Mv25#R6-hkWpfn$aS?%NO@-zo5Zwtl!hKjT{X
zc=fyB)8t3tbLAJ{i{*FVE96h%8|5G1JLM6E1zz7H^4Re6^5pPa^33qR<ptpX$;-mS
zX`gGsW67JrlgT^7Gs*kI^UBA-%gATIYsr_uTgo@Wd&n=qt5)*&_XgZP?;gVEY0hi-
zGI@yMfyZmTJPQ1{JRba_JSF_LJPZ7>ya3#8ugbtLR`l0b1AblJ7=BmY9{#=dtv5W4
zd>Gt5zb3)$^J^~LZYNj3Gi&}9x^AEM!^@~Y2j8iEyAHS8w}){1I{OAbFQmVpwMGOU
z_ZYg|MsPc?+QVmQJ$>Nzye=c)FVs(gzn3q7N7Hd!3vVjl1s^Rx3b*s;0^H7@J8(OH
zp2F>X_yD)_A;QSO{j{&kvEg=}B!_3#`H%x{`%nNLU)Q%7Jd3;xyqvrayq~-Y+>Uz(
zxILdhA9xqd84kC{`>%i>QNICh_uuY;&sYCDe3$$J{8#x4_-y${_-c8gQGv(ttvm(%
zvHS<P-QQ9W9$KGY72tOJPz#<{eLZ;kYX16Kz<a3g3Lh*V0v{)z44*Au1YaiK1m7$_
z2tOh}2fre}3%C3KU((fw8Xb6Ceh%%w9}F+4&!a?ed;RNlaC?5<T<|NE{rRQf_vN+V
z|HxayKgzqo)5r(GBUSM)cRV~;J{umSIm_V*)Ng^OmLGs;lb?kbk>7z=lfQsBm4_S?
zc)YsGqr>~klfg&Hv%;szi^6}ASB0;WH-R6JcY&Xl4}fQ>>R+F+@PYD~@bU7c@cHsh
z@Rjm?@E!6K@Z<7p@LTeS@UXhwcneP`k2E&$cpcYy6$5Tx7m~p3^DaHyK2LMO?Yu1p
z|4x@%32vV+b>TVHw}cmwcZHXg4}jbAUyp&eR6iZwN4^L?T)qxIS-uPYi~I<Dwfr3X
zLMZ<@-GT2={}vuz{sEpy9(r8hakt|b47b1EP6+=L+5h-7aQnKS9d5rzD-4gL_0)%_
z)cM>3ep#QV?cn$A^BVp_-U}X5^ZUbN%SXYx%YTL!md}8flh1?KmM@04kgtcomG6Mt
z=htDl-M@4W{#bL~!jtNDAjJ5<^Pzz}BHZq0ivusBJ_X#K_c;r^iu!`^n(`*_p7M6^
z6Y_3w`@VW0e1iJ1@Ky2|@U8O2@B{L#@DcKT@VW9+@PgI-eZLHkBfk$%BmWoPLLPEL
z;Bg!%j|`tE{|;WOrvLHr;LFvgglAQs1)f`80RAM{pI;rGN_{=}dR=ZSxc!|;H@MyZ
zHV}SXbH>8c*6`Oe1KwZ07(PnA9zIdN8$MHh6uw4&9&XQDeG7hG{bTrF@_*s4<)J4A
zo)4k4&%y9uc|v$>c^Y_Pc@y|n?Q;kCet8eLeO-75Ppb8YoD{hJOPUiE9!-6Gcr5u3
z@KEyX@N1f17;e8mEf2r1zBc@^yczso`8;@At!F7bt9&)QxO^kLs(d@ViTuFNf%{oP
z$MFw%=30Jt9&X<U-h$ix1CQbDH2+_CH+ksEf$Qln4~D;&CxqMcZl{6U-#2E5r_=Q+
z47a~~EDtZDpDSy_!)i`5xPAZA9d7&37ygf~*HF0a=S28j^$Xya<SXFA<m=$}{Onuc
z^VIKxuaxhH?~)&ZAC+H*$I-ssg4=oZ7;c|m|H4Pd^v|2nQv%N)`~71u+>Td5coeNC
z4czWu%>nPDz5u+rybQd(yav3Ryd`{?yc68^rytzzcO4BMqdC*zcE9~%_%ihy;Opgk
z;r9E)<M3VTFT;PA--p}%t1sYo|LSMB-A@~NYT$9dp!xCO%k*<oD!APrn+<N?H<pCk
z^W#^7+j&wCZui5thTHw{58yYn{%7!Lwf*b)FWi1FA9`BgK4e!P47c+qA>6+Hrh)(e
z?I+xBCkw;vcC`vTh1OFK9#`HTUPRslZtEWcxBG_|!kcN%GI)FWI{4jc{yy%9FW32Z
z3_eD4F2YYY_vhS!-;_UrzmUI!M{42E2|GRT_$HM{ho_e(hUb;1gO`!#gx8Z7g}0Me
zg!h%#f!p(uwSfPkz6<=Ayg&Skd^G%pd>TA*OMkx>!b{87!jrV}`<?LW^26|^^0V;H
z@;~9@<d5Jp<!|8I<RNDS9`}Q-{r987!?y7~K0I1G-&4Vh$+N<%$P2<7$jib9%4@+V
z$eY3U$~(hf%lpIAb@JCg2Hsdc1HM?k1ineW5x!skD?F&Pf4P6aXUng^U&|lBQ+M&_
zyo9%u2hH^V-Ttm-oIDEL9)BJmp1-UA@u}gz%Cp1I$&0{)yZLh}!c)oX!i&mV!JqW>
z=X8fB>*f1kcxm|r_yqYJ_!9XF_$K*Q_;2!q@ayu^@WlFi{TuL{@<;Hp^0#n%oI~hY
z{`I!w+g1H{@R9Pw@WlE%<Mi-c^4#zy@)Gco@~ZF?@`mtR@^<hz`n%ZP@Qm`|@c-nK
z;S~q^`!XM1U%m$3RlXBGP<{kHL4F?oi~Kfxll%$%sQf+rsyzJcps#Osd>_eU!9x!6
zyJYYL@=Wl|^8E0s@-pyc`n$cF@ap<|g{JU!@=ow!@_ump`;5`>d?WqqH68x5d@+2r
zd;|Qrd@uZw{5brr{0cmqet-NIJd%D-`5K;F9%_z%J?uCZlYa-VCQkxyA<qEsC(j3;
zCNBfuAg=|#C~ppbDDMgn*6;ZS!T%ZSU(X5fi28lNTzD$^DtIpW4tQDl5qK^61$Z0z
zUHAa`bNDRzXZQwrl(~V&G4e$J{RHsz^0e?F@?7wr<t5<r<<;O@<c;AM<sIQ~<^AB{
zbpPELcmerLcy;+Q_&WI(`0w(A@N&AJ?hL%8{3d*i{2%xV`Fr>td4zd^$Lo?j4!rqf
zze@@4CC>(*ATI)+Ew2Q(`^D<R`|9Vuw(!~VdGP7_Ic_<<w!i)@@F~rFKLDRCKLuYY
zzYe#@g*}9CSN{f{T<Z+=OW^)zmIuQN$P>XU%hSQ_{?A<SzUoWBN6M?ir)%Hp!xzfi
zz+cLH!hihHzn(+k@#^?K32x8-GY@{NvEQ$P-*4jkc6h0#z8`|OmY;>E(eb(ouOxpA
zuNlRk{|<gn`w()z|L^v7ZK*s4{JcB?++JVsd-!hkso_WE8R5mW|2g5G)R%&1R$mDo
zSzZI4SY8hvQOCC#yuSKQ@aFQq@P6`<@CouM@a6LP@O|>t@U!ym@Eh{q;4kH8;Q!P0
zy#oJUejlDw{v2La{t@0m9$`Vy*Ec(_cFAMGFUnKF7sxZhhsd+TC&=@`PdE10Q4DUM
zzm?z>>iT^ncp-T!_<LP$2Y49u-QbDjec-v|!{GZG`|BA8x7RP63~#JCGvPhuzre@I
zm%tavSHZW-H^5KIx54kq_rU*?AB0D(=U?C7;VI;&;JM`&;5Fsf;9cam;r9A}f5Dfj
z{|CNL{t|ve{vZ5}{4+daegFD~S?K@QK3@{cBf)dXzk`>T$ALGMCxQ==Cx<VVr-kp8
zXM$gm=YT(x=Yxl7;9t)o@C5Qw@GSBQ@KW+>@cQx};qB!O;X~xj;WOoJ;p^m`;r2Rn
zJ>gf?_k%x^4}phi=<m-ccmnwZcoz9ocuDzecs=<7co+FH_;C3e_&oV0_)hr__(l1z
z@aOVF@Q984eK-zJE<Xd$C%*)*F24b9CBF+FAb$v-CVvWFBYzD)A%72lA`h`B=<Az(
zzK3t@zaI{sTpk5pTpk1dqdXqGqdW<Gm^>wXwmdz2gFGwzLKA=e`QZ1}mxkN-$u;0V
zX-*UP7<otdY<XY!O8F@G0r_lr68R$dKU)6^_(%CVcofaq32!ey0M9Hx3ePV;2`?c(
z53eA<3a=%<1#c?<3!bB?e;l8|AFKZee=m=?*#9^?pQC9`9C#{uN_cH~MtB8zet5iQ
z{^gZ`w^v^k-cQ~T{#4!$Zm&<)AAU>y2>2NJIQT;OWcV)mO!#^Ee0a`g{`Fk}x1R^M
z!Rx8t2d^$a2_GiE1n(rj2k$F?1COPj)8j4)JRicylfr-1oK*1R@*m(=<yqm+<ayxj
zoBQi13eTgTiz~rvsILcaC~pma5!#>M1Kv#iD7d|D+0XEm>VJW6m9K`|{VF@)cE8G#
zrGfjuQ@;m)3tuM>y)3ZbC?5*X-O}&I!4t}7!PCq4z@xSD=NyJtSAP!PRDKI?_uIUH
z*Hs^8dEoU5rOS;9x4#=n0Jr&R;CBB&4!He2UQzf#t)~+Fq`V&dqP#WyhP(&-nS2U-
zlYB0`oqQ3zuY3i3vV0wUv3w`|o%|xacq{*S+=Sb4e+*Br{y%tjd5jf-$2Ye;A>8`3
zaNFnd@P3+818(O@6S&PE24AW<<KZ@EHr&p)<#0RSw!rOtI{>%y?G)V3pX+cte?G%k
zw)Xco{K~+6w&N8G{)et_GWb<_e)v?)F9EmfRTXZZFAd=%HK!fij&FZ>5A`G9ceT!O
z@YnLm@b5HdCOm`u7kC-@5_og@e)vD~V{qI5OK|&qxd*rN^Ar5C=7(Dqczmso3Ag>s
z1%Kbx|M<diTW1A$>^6R12VPv>5?)!}4PHk+9G+V~0Ul326>hInI2)cp{aX0nZT<Cc
zgEvzD8~l>`Gw_@8KjF5|kKxDFzlPiWmLXRM9!L9pi3V@3btZ)Okf(*O)#c`dZ<7~;
z?~_-7&y&}I_tWLJgpZPUgWKyh4uUUGKOVkDJ{xYgGt1$>$MyGd3w(#>9DpB`pMw7(
zzYaewe+a)Ke*?cG549%n_&$~g!{5sj!NY6+)4}caAalV}t1k}EW5*X>T;3F3Qr;b2
zMm`u`K|TRqQ$7dYP`(1*UcMFHL;f3lsQe;)g#0diwEP)-s{A9|)*o?g;BmC|$AR1W
zQ^0Ngjp3Qv`E%RA?RK~)+-`@5!tLwGB)ENDSOrg_%iRpOem~r9-(JDnYtBcwtux}f
zz<smtqvF8ra`VEMYJM@e&94l%`SsxoHD@6FmV6Z4_J11OE_V^!zTT~e+t<5e@Kd_n
zb8!25bPH}@cm9FfaS2`@xX-aV`R~Vr+x1EXx9gP+9=5$dr!YK%yaL?zp$^>kp&Q&@
zPp&`Q_F)X%zAn#%zwPL+a~a(BXDj@X`h9TwI(Pyetm}IfUcRt@xqrd!ey~^Y9=e?m
zvBCd1yZ^1H=0}BZ(mE5u?e+iC!R_mQZn%BjF9|=P`PJbU<W1mr<lW(|wEq6^*z%$9
zbn?;gg7S&*s`BaZU$mb2@ImU=z$eOg!hew;fiIPxhwqf%h98zcf&VFg4^P*@KM%rh
z3_Kt5%VWXq^+c1wyQ<Fw?=8;{A0aOTA1AK~x7QPG3O}m86a2QkA3T(f*JyY=`E+=C
z`C@oM`3871`Cj->^5gK)^84@@TK^NcJzn@d{F9Dv_)USwF}&u)hrd;y68=J-8(v9s
ziok6>72##o*M-~TD_g_2sqX@}`2*lKXB_;6=1hazoJDY(vj<*5$K^2G=A47u^}PkR
z`O!899+&c+{P*L+?dxMoxP5)h3b*gO3c>CBnIGZ#bh%C7)^~*4*RP-9<27eC+}6Jw
zZtLFyx3AX+;P&<UI=rtg_W|6#UcZEQRUcwY;Qrh7N(q0YJ|o<o_c9;c?$0j`xAUY9
z{GR4FhhLBnf{*CzuX{B7JNa~Y0{LQi2KfefA^Bc-dHHd;y-w<7csup?;REF1w+8P2
zZTWZbRr18}P4e9E6Y?VPZSsongYvp?J6^5e_WO}BaC;roDR8^o1@JIk{Of-bURHhy
zo?U(qUO@gFUQ`}xTi`y|lIMln>zGc2hwbWr{7m>Z%~=ZHFW&)wE<XUb+ksPX`@Zx#
z{IKRcgrAbXfnS%0+8($M_vH!TnRR_r!0q~Gf!p;h4o{#t72tM#>%i^$wuDF5oNjPi
z|0?)K^_$^U<@@1H<R{^FeXqgo`aXfr(VVw%yS|}!1n$56eDNK;d||&!47Z;<(!<;7
za&yDG%1gle%d5ie=Z=Q(G3qD5Lw57mITL<g{V(vB^84^HJ^eWmcl!UepTF$+CE~!V
zgz&qpaC<$}Lhx!@XGM5#d0Y5Ec`x`7`EYnjt!Fa)7xfF^3*~F!YvsG(_WBV=;Rn=T
zfFJzM-=911%j%!PZ_7Wx?e}F7b_E`nhw5X)-^x?LKgn~#LwEP*mV`%=*M!^au(p6F
zRNn)hN<JK(MLro`NIoB4MZO+hN4^i<Onw^PUVaPSL;egtP#&~9aQ{cigW;3pN#Qf)
znc*wth2dM|mEpVPjo`=Ro#0pG1L61N6XCDr^Wi}~{Oi9S9znhj9#?)Eo=ScTo>%@1
zURM4QUQHf%PvCK>E6)aRDK8A~BCiDRFRuq5A#V+jVt+papP+sSe1Uu(e5HI9e53pb
ze2@Gt{E++^{FprQ-oSmkE{_NQTb>&JpFBG}SYJnqz*EXA!tM7Xb>TVHw}O|FcZb)M
z4~93EPk<jw>R<mkaC<(P74X(k{eCOlz7IbL@2kr_4Id`|6K-E0U&9;dc02gjz~j|K
zo(SGno)tbtULC$e-T;1F-U5C^J^^m8uRIGrOXtZFczf-`HuxR+KKNw$3HT!URrn71
zUvPV#x>xYi>J#n@+~@Cl`R}KM7f<bbR=7Pru@L-&=9h<u*Zj8d{PJ$_O!7hSZ1NTG
zUh<7_d%WSVaC@BQA8>md<rTPH-v@AeJmyQdJuWh6f6&)A`##ei7a0X!SL=@tZzUfF
zztzW|I|2S&{T#Uco_8($wfbG~(vki7N8#agxfkFC<agm6<j>(h$%76A?$7Yv{`(Q&
z|7xAF;r9Bz$>DJ{Co?>iyZ}7Eyez!3ycWEvycxWUybJub{3rMf`AGOm`BeB0`9k>b
z@^x@~{oUPgd;Q&G@Kic3=it%gx8Sz_|G;hk-@)T*PPl`C$KCcnCfxS_d${d?M!4;N
zet0ciZV7k^c~!XWe?xdB_3hxc|GnY1|HI+7|1;o+HGd1-UO#v*e7O4G;B(}s;gNpw
z_x%d|h585Zkm@7+7I?hE_V?e94xgny3A|oEzs~?KD$faDsyW5ryX2MOC*}3wH|1^M
z1^fEz=?VWuJ`}!5J_){4J`ZlMQ@aZOQ2lmzkoMsaJih!aJfr+3Jh%KGcm`eW8~AhW
zPpCtI$M>B)7#>=462YU()4`L-bHgXdi@;0EE5fVG>%tq$Tfw`?yTb>|hrl0e-^Rl2
ze47bxrG6=Vh<p=#qI@6R&chRMJKwIt?R@(SZs+YQ_#$0yh{J)$*Uqb`@I&eg!GF}}
zdtJD_9&j_beSg&%Znra2;9E3*E_|kZCEUIr+XlDq$9{(|(VPeH&+@16=kgEmb(#Hr
zjBq4yKkfR)hTHdnW#IPuwN>Fo2l#Uv!mG*K!JEl@!_Ugc!1v0hz`M$4!N<wx!<WkU
z!}AaH*MAHiUVa)LPks@eUOxP&KhM5@w&%;50B<qK@8-bA4EB8`yqkO@++K%uFMNXL
zAA`@7UxY80-+^zFKY{-ye+NG!kNkV!KJ=HzgtwO`h4+yE0Jop(bHnZT>1E+{v~N}6
zk2Svmyqfy9@Lck)@Ryo17#>FbBzQFWe0XyCdiVtScDNmvoAB%-{C)o)+<wk_4d1Q#
zA&&(fFMD3!V0bdkj|aE&IThT_=j`ykL;TAt0Ph^e_p<P?@>+0vy|&iy#hTw4eni)|
zC;Wf%e(>;`GX$PeJ_=q^J^|iLJ{3MhJ{KOWeO?N;{n-S!+kt)XQ<{GQ9&f0>&sX6;
z$p3<Ol)r)xm4`SUc>W9+=D!~mo_4tJ3E=iRooV0&)#rdemluUc(7x4xN7Op&!>?(7
z+QIM2e}exl9|3<MpA7#`{tNuGd=)&j*0~KHPX0T*k^BrixBLdYu>3K+jQl;^{(d0b
zAA!fWiuxGv+VUiD+lTaU+lO3m+lOLs+lR*RwmRS1z{hJnJ>hfZL*Y#{XBxbQd>(wU
z<}8Nqk*|c`m9K|?mT!e8(&g@k7nPrf$JXb?b@(Xt|AX5;yn@?4ggFs-+#_m!6!>J#
zj{#pRj|V?4PXd1`PY=JM%gqiiDlY=BCa(gw+nL7jAJun;ca#r;50+1YPmnKwFOYA5
zFPHC!@0Oo|AC$j^M;qxMr=XL8$LpAG52L{Ul*flZl&6M&mY0P$*X34&+x$uJl%xFh
z&4SzK^)k5K4s3=;(VYG8IP#P5#PXn1f&24T9syom9vg07kCMZCs?Q9!?^lb$Z>p~Z
zzb~%`|6AS~{#@P*-cUXWURypMZs+GbxSgMC;dXxRh1>ag3Vv9Zdl}wW{y(^_^I!OA
z_2Ewk9>=NjxbS82l<;lx9B|u*5^&px8gSc(=5X7GL-6;b{dJ#&+t1_I;MJS?edIHN
z*Z1UD|NU6-bYpx^0JqmG{T^OTeQJ0kc?NiUc{X?-c^>!(c_H`$c?tMlc{#Yf&S(|*
zNA<PfNwq)q;hE%3;YH=G;Z@`v;Z5b;;oamv!AHmk!RN?Fz}Lvf!4Jr1z^}>Q!QW2s
z&xcTF1J9om<NWs{!0*VT!QaVa!DEcq`3BD^{~lgho*Ld>o&i2mo(*oVgO~@tSA8M)
z4S5Op8+kc+H0@gzcxrhqcwu>cczt<Ocu#q2_#}Bp_$qmK_%ZoU@VoMf@J<u`<23_b
zR6Y;>qkJ>`clir=+DZQW_wXe0@aO!0xBJKJd2eFD?eFB1!INoD3HV%jMR+TDU3gb{
zEBH`(clZSPVE8QgR`?G;``2?X{GR$_@SB<a{vv!v9N+K2?Q!KV;os?U-@~8iazmUC
z-2dnDaPWWSQQ#poKL$L4yc)dPWdHK&!C$Ly0*|7;6+Dr=13Zho8@!l&2i#sqZ9m-p
zuHXdR{;uFEJlPZ-7r1>Le*!<O^}K_hlZU+!cwBDFqr+dy6T?5t)4`)^o%!L-<i+9T
z<(1*J<vroM<dfm2<m=!M<j3Lf<Zs}yrfOd<`u`0PA}A<ZX#anE|2K}@ZcoyxPvP|8
zzU4s~&=*pl*XbvP`St<D(AQ93+36#G%Y%MI-$8u~rw<DI?E^ZZAECal(?|Z62Mt5N
zQvJ_P|H;{(+2~KGU+(l#o%tKkKT^Nf=~p`QkDw1X%^!B&>4Tm5H_)e2|H$bFI`dzm
zFQGo@l0VctAEG<+BgpN1sG~l%)9-fXCqds){SQtb)0v+G{Ydpioj!+ie9NI<puV=#
z$9Cp7M!!>i2d7`?tiLDvbLxjWeOzb$IP}ld&vN=&&iTIxeU$0`u=P$K-<iJyeQNcG
zoxX^({!{3SsK4&?37z@((brY~!s&yZ^}k2oU48h={!s7yN$kx3PHyMVB=w1%evh;M
z)aci!&+ha|o%sdOA5~x0=`%a)uZI4v`bJKl%$eUB{YUjZoPMpd{sHLY%<zYeb@~*}
z{Hf?Ot6%8!rJeP!LSIJxcBfC}%-@f`o%)kbpVFCs3H=21_nbbBGyfm-o7BH^`Z&(#
zZ>TH&2iy5@Nqw-~JAcwS^W&j^u0EC1uXEO)34NrQ{;>Q`|ARBX1p4pQS9SVF&iuOQ
zbE$9T^ckJ`ozYiN-{0v^I_J*_^i9=Iae94g`}I=hqVKDIrPJSZ*1rk;RQ3CuKC83-
z-_fs8f6?jBI`eO$KcxP#(`R?)zeayeeaNeR<ed*$oc)O;xAW(@`nXP?)0zK0`f#)S
zf6VCgYn}DyLZ3)|ai`Di%&&kxyZSm#|Jhl8Q}pH3cXIl?&ivl!+o&Jz^x>WLPe4CP
z{T!#y@62C<e!2RMPM_IX|1R`L)E{;Fg3kOi=x?k4)9K?ow-0}zx7TTV<@AM}`5)2S
z>$F9@=11Q7v&LC}47r^@_Bw4zoxZ3uKP~!Fv;BX}>GVgP{V#;Rq5ASpU)-5r1APzm
zO`LwGv;MZ|$Eok-^d+77gU~NkKi=sdJM*Wb|5g2Br!VcyUxWU#`khYS#F>8({d4uF
zoxZFy{|fr3bNqjN;PjE4{eOx+z4{MMU*4G?=DPomoew3|N0)o&&naj93D7rIpT_Ac
zI`gxj@2kF`(_eJvmqI^XeRZd=?98u^exv#}PCwk4-xd7{^#h&0sxyBS`iJVLIeiXi
z{x9gm%=L$@cKYhh{4MAct3TlMkDcRt9KF4++hwP(>CC^4zLMrYar&;#`ro2&sXp`#
zf2emp)OO}ak=yw*OnrQ(zvZkyIr>HFGdq19XMP^^d)1e8`n%5hE1|!lzMj+9bLKZk
z|5AMyr%&eGKL3P1$~=GANT+Y$%%6llwfcEZ|D&@%%h22Fy=`{-M$Y^_=xb~KF{cmb
z%s+>|qxxG;-^7{!5d8%8Z=61{GygOCb?PJk=@0eJpJvYdSaLgm&Ztl3^fjI1n;!j3
z^|_tCg)_eh`e?uS|5(xKk2&*ep-->AnbWs&=C?;*PJJJzFYfHm5cF-;Pjvb=&it9^
zN2y=x^iiGp>(DP#zuW2CIr9&pKdAn!(~oiX=Nfu@UAO-^eFta$bM&7z|C7`AbJid3
zrvJfqJ|vm%zaLZXoj;wN`H9e%P@m4}hdArchQ6)(!cO1CnO_F|0QEJU{zqqiL-do?
zw{!Y#&iwA^SE(QD^v#_4W6&Q|Kf~#JIP({vzp8$%)9-fne;fMe>VI?kUe5dz=%X(1
z|M9BRPj}XT7kzs5&z!!GGygyI<<y70<wxH6aLJh;O>XB;TlEQ@zOVnGU;l4P^h4BV
zb^7<t{^UbHTYYJ#?;rH-tqS_B>KizHMrZvk(VtP@&FKdQeS7OCx9e-K?=@QP?N3E#
z{gcthTIkQ3@AQLx`ucxY$ZdXh^;?~OsWbmq^!9pJe>nZnpl@#%(0AATJ5Jxg*`L4B
zPgno1(+>~&_7>u{|G#bhThvFDd;62dS$`b#=hUZg`jOwp2W3G2LVaGR|J#{g4E=YD
z{9%=yezY_HNA#K0w{ZHw&isz(E2!`5^kbd*!_c==|FhG-b@qQY`Z4O4JN<ZP{s#2R
z)bDlrUe5d@=ntwt@AMO$`8Uu%Q2)s3Lp%HP5`Bcl8g|G3uXjHD?97iKxAP~5`q)lC
z*O{LLePi`MIQ<l7eh%~l)E9O7mCpQf=;x}h?ex=}`Hj(USKq<uYdG_JqCcm8sMF7I
z=8r@FO#LjU|K9ojc@g?3OZ;K$oqm=xe+T+B>JK}8YG?i_^u^R)cltTb{QKyesej@0
z9YcTnfcNN!sSkhGZ@lwo-nTsHJGq@di_|A}`Vh|gQ={LnKD*P;cjgyBe^q^1r*9qR
z+Xqxb|5AM;r(gIj4{D7*@>2gFdpP|PXMYBuPpN*a)9V!ZI%q2T66zN^eMx8itI#)B
zzuoCYU+3>f-&g;5(&=wG>%WA4vif^YzueiMf6%X1|IX<*IP*i@^FP?mhePUv<=*+T
z(wQF*{Y~|$oc>|xZy%5e{eSB7JN@c!c~A-TahCc2Sk>u^hW_>eb<yWg-^%INe#?V8
zqpz;Mztd+9`|Sfppzo@Fiqo(EmIuv6KSBLUr~fVVw-4BaewF%tPQUS69`rl<L+UR&
z{m9VYKHw($o9Z7s{pN3Z&};M`)rY+AN8b7HhciEt+|D0+{inE2ztx%lJ^H*lc{4hF
zqcGn-AQ$={)fadA?cegC3g~}QU&rZph57aYP0`!yJauyVo!|1H-spE|{&1&18Rpvu
zOhA7@{T!#?{Vfk#g5F-YX`|D3cJ_Z4`a~=IVMm>QuQUG)`r_*Ubo!xTzJ0)7=-aA)
z<@Ec$<v}0OPf{Q8fggG2PcLVF47r^@+tep@`UB4VwCK;O&*}8<oc$?;{vY+_o&Gmx
zehu^yb>r8>>0^Zb_5p3tr&iy~=?{O)g9f25sD8ZDH*of6I{F&w7d!n?XZ{-WUDWS%
z`pVA!97I1s{b{E^=FGo>ey#ckPXESP|5NlQ)PHdLKb-kt{_@|k^WiV`(dFLx^VC^?
z0`wtP`5&Lg=}$WIv!G9<zM#{;a^{ypUrv2>r$6n?uaCZ+`ZiAg&e@-?=*Oua==5iu
z`J>QpQa{b<k2&*yL4QU4YNtQ%%-@3EUJvPj(-(I3=Q#TG`eJ_B=`T9-Z=)}-{)y8k
z3H$8>-lA`>KJ@?m#ycM_f6IfS$nE?YqdvaVKXCRZIr<gqGdulNXMP^^=hc^V`by6J
zR6_q*eLbhY?#yqFKHeJtAG<hxE@%Ev=(DLG>GZm5^Xs5V=xeB-=k(*8`ODDvRKMBj
zZ#nDVgMNnkV@_Yx+5dCscc{PR^!gF!>!mzIe@Xotr;q8JKcCURRv-DHzi99Lx#z4u
zmfX&tnEK{1nbX&E)}J1IHubrkUN?1LFQo|j>gp>xeHUkbE%e>hH*<Pj#jo?*qo1k1
zkJG<*j_(lkd(=;K`bW<G%tU`j{Zgl2>daq<KHNHg*lwqP?94xeK7;zRPG8O0pKIu=
zssEqTKXK+iM?XmYC#MhPoIl}o<?Vb}r#`0KJAa-z^An-Jq&}U~?{U_j4gF{Jg`NI|
zGrtV_MEc>Qrqf4p<~Ky2PklS5f91^Yj=rJ#!A`%+Ilg1i4^cnE>EAf>7ocCIey!8T
zb@qQ7`g7`kbNYXs`6tjnQ-9Uzb2|HT7k!is{;+3G|IV5JANq{y!~X3@-uV#SS${OS
zoj;Y-Cv^G`&is_<o2$?2^lhB|&xige^`)KulQX{x`kCq*IDI!~e_Ep7roNlg2YtED
z_SO&mN%f<h{)n^w$>{H^pYQbFJM-6|51}89H^U>#_c?QteVG$p3q65;m->tFg!1d~
zH1a#}?DGG?3(KFt%gbNEYs=rko5_Q8qiN@rz1~k)xV_#_WcVn}i4LDCj|*QQPYhot
zPYFLF&m#9eFTDM?x4h`jt1s>JcC5UQsgM4V`nKpJ>jDO%54Fkvhw<nWs9%IWmHG|n
zv#URhzL@&+=u4@8h`x#Xx9IDskNl7SKkWGSR3BgN?WeatE!8JSKT&-a^gYz)MZZFQ
zY4pR?S3z&D1Jn?`-51{ty}b_5VD!s1e+>F}TF*@Mc3;n0^s#j()^7C2H2)0xEb4Ef
z*Po>Y{SSRP^>5JY(=+HZ`ey2*=$j8aUiP&lw%m^I2=yt@$I$0Y9`vi!mqMRGeP#5A
z)Hgt1Kz&Q}*VK1MUq*d@^v~6gMPEbxRP+(I_y=YY`ey34qfe&(F#0a)PodAP{s#K~
z>K~x5sQwlD(dr{S_1A01%U-W2j@*v#boEKm57qpP=vS-Hg?^Fx66p7<uZVt+`g-Wk
zsBez`lKQUbZ>#T%{;B%W=%1>ej6SUH^j(1dgZh=|lc?X0K2k`3-}j@p*F8FgKEC?P
z=xb>H1N0fxKSke3{YUf#)rWl+cs|(cA;py2`A|uHBJ@i&KRx<J>a(LipuQ;jF6zsn
zzo!02^n=tlLH|;HC-f844@3XmHvjrhM!!h?9P~e^Ux|LR`c3Fds^5?PH}%KRH&TBY
z{dx7b(f3sU6#Z@Wp`QmH-|6b3%kB8SRi7HYz5Y`U^wC23a|@!sp!wy|f3Lm<`q%24
zqR*wi9r_sh!r2FXIrT%(XHq{2eSP(_&{tBw9DP^yd(d}Re;oY;^|#QEQvU?~O!aTk
zFHj%mg}>i+yq2ktD!1G7?dlVv->g0*`U~o_p+BNNKl<0|%c8%bz8d-{JN$JwM*p|^
zHt5r+?}h$@`a$T+s-J*9rhYb?fxfl+rRdYDUx$8-`aS6Fv5|+-uTXy;eGSdOf&Qra
zztP*z#;?#nP#^MT;Q7#B^CQXad<dgo`o%*(S$#6}->c7z-u@OL5BlQjOQGMZ`Ss9u
zQr`x>{jES(^yAeJLT|s@7>#~~`WfiM=)Qmj=nt!3hd!?Q?dWf-Ka4)D`fKPz?(&b*
zL-d8!zd)Z<ebB4G<6B*Q1i2mGJnG}1Z>l~i`l{+PqPP2MbD{5|z6AP_nqLw9DE0Nw
zPgUO>{X+F!(Jxlt7yWMaqtS0xKN<a1^$XA+RlgGbf9kiRzoC9V`dIp<_bK#G)n7)R
zN&N%#pVdD_UqSsx^!B^ku&@2|#LkCy>SN07>qQ#fmzN0rc=hSg7gnDg{Yv#k(N|Sp
z4*f~>Kca7^z61K#>ieP}rG6Ot1bh7JKN<ZJ^>fhYRKF7aR`r|ES5v<q{qO3Jp>L!9
zGWv_^Z=)Zf{wey0>i<Q*RDIYtfwvEz)JK!s`LIuYBJ@$i`5&JZ{eAU?(Wg~k27Orl
zQAREFh1EAg|AYDt=<BH;g1(0ON$7u4KMQ>i^~=%!tbPOfDe8Ykzf}Es^uMaVgZ_y6
zztLY&{~!8G>O;N_{QP~dK3Hy_zfaZ2L!a<h|Kn4m534&JGo#O|z99Pe>Pw;jQGE^c
znbbEx-$#8r^d;4IM?X*f5cG}Ik41k_{Veo9sb7Ttq52Kzr>j4VKF&UWKhLAzrT!uM
zLh9e5zoI_qUw@u`KGs(sRc^=kAN6t24^p2JeYgnz+>Gc~sLzi+rTP-+538?+KDYXM
z=>JmR27M*<UD1D3KL~wY^`p@z*dO%uZ3g;|>KCBTs(!80C;f8Y%t(E{Y(w8r{jczg
z75&RS4!<tH1ivf43m;$JpYs$xP5vHUx02t7`_KQcohOB~&KU60@+$C-@&<D6yz=%T
zSU=ZyML$^mK&RJ_SYH=13H><r)8Uil^PD+fF82T5R--?sew*XzoDbOLc-k*M;DA5s
zu;X4|QkQVdajzew{)*h&hcEvxD2@8N@XYe(m~(5t{|_G=_bzv=`k;6I|FGj_>x|^M
z*Pm4%&2e{~iRHG=+UnE58_9EG&Ocgb5y!pDjr-;Qdv7Hi_bzw1_NTJrUf)1{b;sRx
zHkI2tNBZM~+QTQxf5M!1`~80y?znfki*>o99rrFbZ8X21>bTcGQa{sicb&`Sw$ANZ
z&qnw@`991EtNr=Iaqn_7hx9+-wBzpOUU%H<N2$N%xYv);{Kt-a{ciQo9QXP$>Oacu
zdIf*^H}5Udd;h<79>!E3$8m4|bIniSxV!$;j(dGs-58{I++BYz$GyIv`h1SN>n|<0
z^*7S`YqHlTKoiHk`5QIAh2!4*ak{=;9QXQ2y8oev<6b{e{b0wv-X04&+;OkB*D3qi
zaj&=MmYU|c*H6*>g>t*T`@Z~}_qNXIy*Z)ubKfS%y*V>9=K$sm)SOfB`SR;<yW9ux
z)9PQz?fg02++SzV2mimGd+W@tb%u7_-Jf8`z22UiFQ((}{v?&#{@CYN2B-JtT+-!c
zaopXX!kF{y%g1<c72x)DunycVw;8-}NPkWjx$Vyj?N5Kly>&*`&tHQbclT$!<6hrf
z{m+iO`!i2&`!iqbS>^QJoK>2$&T)5t_F_&W%{dMqD8CH1%e@0%ul||b_UESd=Y!+k
zI&W#6K_C5nwcb9zB0KK&dG!5Tu;cFjB$V6!1nc%8t<!sR253$O$KCzOk2$Axy~@C!
z$!o&xavQ;uYCRp~c6}qY@UMR#$GvrK);jw;?yb}IXSCy9A4NYejCb7KpILI-pMhG>
zGN<?ERMVVQj=TG_6LSh{&JlPc`FXfq?w|09>L1H(f0Al{{&n12=SZ#dgX8Z0g#YyI
zyz=_n>LWYu_4c~GaUJ*iy!!bfq2um;rjgrzKGXVhIK4M#pyuRp+}+R8n6qAUYQRs+
zo51aI+rfkM^{$WH_A|ZqbGYN)I=9%*Uyi%`In8mej~db6-&u}({n7)zFLm7OTdH5_
zxVxWQ<+h)VwElxm@6B1GIY%6K_wyp=B-Na|@WS$EaJ$@h@J{N(fBtq}d6%14`x(=5
zZ=H9v&bW?yy?y?saNO(jMe^sSaop?IXg{+%?)6jD=XTud?fZ@5a@)_-T7MO%_vT#H
zoEnaMbL{(#W|%Wkb2`J<%lpIaa!0~%sh=jd^RtZhbD`tjI-^C_dF8mfpBo+b`c~?<
zI_~wGwVwwZ_xk<n4?FJe=UKV!r~SU>rqg?K!bS1ddDn4wKVM)@kiMV!3{NVL9Q0-A
zmp5K+Y<Ok$Dde`F^|YUv9rxCmU+c{7xVxW)9ryaF>We$>^}lLAD?9G>Pt;d;+}+Pc
za=TvZwf^=_@6E{`)!)y~j=TFg5OX?d&N%o)`7F3y?qc{p^&923pY61tdmZ=I*;?y7
z;JCY=Cmr|t1M1H@?)68spMN^;^$GOz?;Xe8{d^*~{Y)Cx-?#Tp@6BnfIiDSO_cN+D
z;LDrMxutzb01wjqG;q7ztZ;kmabdabXJ74SdB?qVPSZLoJMQjhJ;%NNsrp8ad;KZx
zXFJEezI3p^Kb;(R_p`6u`_GsE7c^1Vca+n6bH;1VILF=noP#-)HD?99lYA@OE_WY%
zzWS4L+t2YW{Ofhqac`Xmwaz~sclYy=<6fWeJAcj-$G!fF_Vb<NUf*5)C&%6WjOZ=!
z%bWMlU;mfBzl|gJ{^QNrr8x;4clR?L=Iqlx<bvOl7l#Mwax21v<@My=f4s~6Mf=&x
zac`Z^w9a;pd%b;q@8!7Hmx=E0XJ5y?{*Lx@q~l({Q2kiPz23gQ&yd@GcGCKnIK4OL
zf10zxac_=&ecz5bnKkDSyt4c(+%ESze4zSAa_>Lh<sQ?1zH!`JXQCMX{=9SC>uo>7
zhWhf(mpAX9y}pO~h>m-G>!$vk*p7SsDfRIk_j=pURC3$TTUviMr}yT>is{eK<+wM;
z_Om4B%-5W1@O|<|aJ$?#@Mr3K$!$NcXg`NK?ya+|);ZE~cR!~%?)8h*&v4x9(=_w1
z?_$Tj{)77Ej=TH0S#JATSwDa6cY1G5(OCZcLyo)qc^-3uHRm=wv-}C%F85!!{XQ{l
z=r4=-@@D(_Li-urac`YHwa(a%f4#oipJa}E{b}{79QS(re9!8**Qbr`??X<<-Tf>o
zxBc9w>s!g`y*V8<r<&vLem23Jftu41K40D!ZkIb8ep>w$x$S4<mj3mc@3^<l#aicL
z$Gvsh=lgocz5b*6&5nEhBi(-PbKL7|#_=!rH^<%mJT15V%&eb(Z#ca-XO8CFcHG_1
zXPEO$`|uGStoaecd>Q)Xjh7n}URZrHx$S3Z?Po^Ey>*_^I<q?Nt@DNUr=a6rpDwPy
zKSdpP_ot%V);VA6sq6IKoKBk4&~bNvI$%yC&G`v#_mhl-+vWZYU#~gy<+eXbTKU&&
zwd3A8muQ{q9rxDxR{OKtaj*ZRexKv+{`?`g{R!63`&XRan^QcVzn&Y8yZiGPb584e
z{Re+04;%K&&@XSi++cW8ttYYE_NTh`C!OQoI(uuK869`8Z(htFsQIOw-kbBQ=9F{X
zy}orYr?BR<gg26RgWKiyhfh>LR&Lj~sjlw~$GvsF(mLlj?q1*JnEy=kw>Z5wCvSZJ
z`0jAry}m~=XT9cJfS;D%f!pOih6m|>n|E@%zMXY_!-o5^xG!&>d+Y3|bw+gDTjvmc
z9~;|ouRp3jzT@uxq>|ft*huTi=Jej2s0sZ2$>q4aKP53IspeFJ7nV1I+vT=_cT(R=
zZu>J%`!m#WZ=J=o&XJCL>pZF3+bNEF{T%f(9C!C;vE26OwAQo1>Ag93G-r$B?*9CS
zITJPK41B%(Pq<y~|KPXOzmePi%+&sb4F6?u&iNB3p?@61I_|CWgKj^gJMLYtPU>Sj
z?(R=Ax$RG3-T#)!>Ag8yH7A?n?*0_ToFL7q1Wzij2e->@0k5pSo80zioAzg*<K8;|
z);fne?yWP#L4V&SI_~ww6Zt;Had&^_%WZ$wYdve6-kUR8b2d2c?$18V>7+R);1lIn
z;dZ(A;QQ3SklX$oZ0%pKPmX)*{8j4=8R5%2U*4>@ufI_p_xiYr{W;Mc_pX=yyp~vQ
z`;%1nH>P)bZ%zZv$>g{<$9`Tbh&i`(y~@FZG`}|7F1HChv-(bQyS`!D_}8ni<K8+a
zYn=lfPy5B|s2}UN*FRQ2(Q&W0{h1@T{h6rstZ;g7PSzy;de%7Z&9VL2jX9My=XZD~
z`9-*0?k)Iy^-tusKhfIx>v`w6x6YPY=O@S0esMd0B1Zi3&X+fDj@R!~AJuWMxBZDP
zxBUsy{jsT?-kTFP>DRGA=^gjx*#6|joPD}prQo;Z)!}xz4dB6APdmBoPciLJFUQk;
zSx-K#v#;acI%Dhn8R@v!Pf<VCad&@a$ZdZ*X+2Av-kWn(b5=O+?$372$*eht;FaZP
z;dZ&#;RDq_lH2}N(f+(~Jl&UdM*H4Bj_(|I_a|(mFVUAbJAYcKkLb9&Ke6SuKex1=
z<WBEh?pn=B?YO%?IWcFx<`jePlUIh@<<@~eQ{PH%`_n-C)6H>jop-g)UXFX~wC@jx
zI_~xPlll8O(s6fxrpRr7D(n9F1y1kH8LT-=9C!C;Gv)+q&VG1i`AN84?qzr*^$+B>
zKLfQtFC6#QxlQYQ<G8oZ3c9~BWaKaJIOk7ra({oqI_~aIbh+)%KCLH-(|ea&Q*)9#
z?(R=k%o(UTh2Zn$<>7X@HQ}e#H<R1`Owj&xa@<?z7_GCL<K8;$@9_pY?)CT74|Uw#
zpNVqYpUnFG#ayTN=A=vE@ACr3-ThgQInQ*x_P~QR{}|jZ_dL9?`a5#lpS{|jCysmT
zY^Zg<aNJv`ef|36xYuu2A2Q09cfP#YeEa$pRc`w;U+YQW^xm9Lnv=wFcYiWsP9x39
z2OlUe4Y$j!3SY0jk=)k*TKm(^ac`a3Qu@cSljGhx?faj;j(h!B^#dLEdfT6|a@(I^
z{hT|~>Ag8;HD|8l?*6RCoYT5qJK)dchv9a)r{PJpo<HTbKj}L8`|!wdZ=K;%`ToRl
zZ=H7jymQ>^8>#=~xVt|Qqkf6LyxIN?)OzB`z4dr={*SJEf$zC|`v5*dbErnhxj7Fb
zX);Vr&YJTaVlkORtjwV-7Q>1hG7-wk)XHSeVxde{#AJmUMyn7)D`INu`CjhN_581W
zUa!8ddj9r)KCb(^ukYda+syh9b*dY;^Jz?VLQ$s`c_h3exvtxjJQ4W_xXx!d<}=2)
z^mz(>MjN;Di8U_ypoVUqamMX@=E8M8`saObn!MDRiaKu@xARG*I-9VskIA#)pOfpl
zS>*a3Pd*9P`J`Yz=Z#CB8`0+_<I<<TKfGaF^1cCXK7Sdv^C@+o7xE6BPbB`F@qV~o
zKRr?B0poT)4XBPk>O4Xo3J)dMb-R<tAU_DM^Vy2|L>ZU;&PJbOjNAE4HZJ*G<YSH7
z`6R$~KH2DJvB^uFI*r_%-!yLLlR|Y8QD-yxCirLMy6yq;JmkNF>wNZNK0g_kJ_n-D
z^Twsmvin^Be;AkiCgg7zxAQ5Ezp$Y53B{k!-Urv~=LYKBZ`{tO4%P8NorlQ%;UVO@
zZfEk|$cMvqK0XuNej|;`ew#FQ9%Wqmyoo;tj4>|x1mq_hxATdI>wGq$pM@qbbq=D=
zV&ir`$y6r>b=H$7!grGEx|!q|$bSph`K-iz&KQ?I|3#la8J9k{B7fDm<Oemub!FVn
z=O4Jv#~*(lUADaUo4rG?pLbE`KI3*iwcuJO5Bq9D?t}Wl<ht$?<js-q4cGbniTy?x
zm;D|^pOMC;&--wHMH`oVV4#~%jBz`kIJoXB5&gVo@=|9a>MS&F=aWQrdZW%-@)-Db
za$PrrJQ?|~;X0p&6WzW}8kauTpwBbLrO#ebE`Q0m<b9etziM3a_hX)a8JGN1$p2$p
z@>P&8Q$dRU@4DK8{Jq8{ukSyr!FB#Vcn&l)d0Dprb($ELI{*LmC90Ewxpg7WgNKvr
zx<kqR&`&g6=RX?rk2NlRHf`qS8E0Jj)cMafF8NoHUtrwMbA@rq|A2gwaXZgcxXv>M
z{eNuoQm6hyuFp@5+j$<KI?Yk%IC*dQPvpApW%79B|AOm07h;~J@B<IUrO(0Wvy5>&
z&&tLnzZLmv#_fC>z;!-(=;slWmpZplr<HL#pUzY#8Fl)RXTT%Lb=|S#`N+q@bv_?p
zJ_*L9&t}ctd7Nup`Yhx9E5}mflAnY83geQmjr%vnxa9MYPc<(2ddP1xF8S6EyLHoz
zOJ48yOt{X!H@;ux8<UqhGf?NaajB#C`&p{vhdRHLH;4a2uIu_%^on|i_7jPGWw_2i
zWRlxg9plpHHuTxRxb#`ZmGx<1T=Ms{aCIIvE_t2*6UHS!3i-~)C9m`EYh3bskRM=N
z@(ppmo-r=@Dv!8+Mj4m9p09~;olgelGsEPi&QR2uZCvW;`Fexu#G}qC@?>}#xvsmN
zJRA8;xSp>)IA7VurOzek^O$kzvyAtz9C^kie;N6+#_fFa;X0q@`2M2XCNFhb1iAXf
zD!GNUPo0k+T<hdxUp2}7P`@#`t{X%iiu@CBUH2&F)6=;0IU0TTH7@&|Q{44G)VSm`
zkblOwozL@d-B&XDnP&1*r&LQ<e}-|Xqw{&4>O`W>O7eJkD!Hz^g?tn88E~DC-(=TM
zmT~E`E&9whE`9cD=kmG6CBGE;JmYpgm*F}eKYTycEt8izCsF6NaXX)KmA#O6Xq{~A
zt15XuyaBnc+nn4V{X7QO`82?Mx*L~1?|anEp{H@_vk9I*gN;jm4Dv&b+xd)z>%J1u
z&lHoFIvY@DnsGayc~qw(>MSRZf~Sz{x*N!sBEK81^LYaEIbdA+{26^_8J9kL3~_VI
zF)sO#R?c&cOa7r)=NF7i{!QdB8<)Jk|12;r`K!nm8kf92|9v0uKJX5m|8?xQ5?uBx
zb%KIjKUIxO9ld`8sLnRjX-R$z{sg(M8%ACN-=8)ZuJgY-#q~4Fxb*of`W$Oq`fP#g
z^F`y5{~Y<L#wGtK@~;|~eD&6D-Fe3CJeR?Bo>A!keUq0u!%=6AaXZiLRHq*5>?7Cj
ztIQ_Xbx)E{Mx6_AooAg`x37HT(&sYtdEL15IR;;6)*q;%`^`c9d+~!-w7y;^HQ}0H
zihN`8ZSYp)TE9K{S>$`cb=|Jm*AU~fuisj`{SGrO`wGQ*A7@<hUE8?)c;k}S@6(=U
zT=J`tpJ80`df&~5>l`}b`wUl@ywv#xb&`xr9i8Vos#5}W(#h+=zaZCjkC2BWe;Tgy
zT!eXEG%kJCXzS*4#kif%E#s1Z0r}g;?R-jC^+MjE^Vx=eD#N88sj~}psu{QQX+(7<
zqt2t`OW_^Jb=@B1naB@;>wG@Id`26WKJ(G%IOEc%UT;&3OTJr(o98s+lJA1+bB=Mz
zzlZ#M<B}hY{Bq-x{~P(0#wD-U^BUul56AnTb;cz>8ufP=m;8F<cNv$wUjO^ydVT|{
zyZs(Bd8u;^b#jbL9lid4p*k0EUaph-qJFVz-f#8}UbifHF!EL5dVaU!{MI)veFi+{
z`fp_1&a<U)$<IW-wQ)P2PH^pW1^Vf0@=|9%>I^V$=QEP(3__iW<gxG><ht%_<f+In
zhwFSYF`xI1OP_`4bB%F3pRL9v-~Vwp&mG1kKLOX<KI4+#fc$>rl8;0FsBy{P9qQ_T
zZ(Q<vef|vB`TOGgTJud_>hwUJ>&B&yUY~bW_df6rt#bf#^CQ0iuSu@!HYBftep<qH
z{<)Zcd*jmQtWfE~`?+VvrBD67ls?8Ke=77&+^4^B$<M(&hZ~oCP<xjjY240p0$k@1
zi~gsZywsVBI<t)1c`l|p!Km{t`5^c@a$Wah^0~<GgX=tNO>_G?VqE&%h(3=Rmp=9R
z`GaxE`#$07{A}FL=Qp^{=K}gEG<m7h6LoxQcprF&_Nmv~eQ>RliaIsO55OCd>$;DS
z7a-pruIoOE`SdU@ea=RoeT>`rJZ)U^xyTPUZs+qHT=zAorkm$flb1SmIyj$hT<Yk2
z7E+xmsPi^?FnkTUuDh9h4Dx&6I-l;C&mrT|=Rov%#JHW$DdUpgg!~W2?R<WP>wFHN
zp8}JYIyX?K(72sX*_vL+JG9PR)Tu(A3a?MD>pn!DgM2%<&Sx0r)6KZ_*`%X8k3Edr
z`8;J@@(IX4ZQRc1S-9>ixR$H`qRC60gQzprxSh{yRHp#@T1KwlxBou5uDhPREBe_5
z*ZEAseD)icKL16Zhm70#d~aOxgF3nWo-%Id^9x+(lZt+>o4nL{7j+7Z+xgsG%L{pj
z))|9370KtqYm@7`O~})cZw=S^%*A{<8J9kfqR(!|rOz#RpU~g9<O4gq`8;LZ&SxZC
z_f-YoS3l9@rOrgudC|C?&nr|X2m5-1ya2w6T-RMo9)Ny!z;!;grn`OZBiHviN2tzR
z)X6n@+1DEEE6=#y*Kbs(E9w-IkAatd&@1X4I!|5qe)1K_*M{r9T47&JjZ2@o=<{LY
z(&zkrZVv5?OTJ|n=k1M4ei8CLj7$D?<og(xyw3A!xbCX}{f{+ysdEf<o;Pmi`7+f>
zN1b`(Iq>D=y6$RnUw^mXjc}dkGnnTt<I-p8t}egFxb*oJ=5xrn<ex$Qh;cigQ*fQn
z81!?&<fTq3>RdK%=kqt!2|yiRfA2SYht}^3uSBlvK1d#md{em2XD;T`+PL(28hy4i
zE`6@Te7YHz{G;8ZJMZ%b<90qz!L|P!|2uJ?Q6?{S;!tO-aXX)vsLl%1d6hgJzJy%Y
zeTV!4^6TI_pTn5X4&&12X7stsxZUr5s^7J?+wU=xmpV65C&#$m?=Mux7j>?a2f&Nf
z_KJFk&RN$jOFjtss&L(J9`;+`xbzv=-Sywdxb%5>rt_A@CI1TYt&K}wpC_H*#XR%=
z@ky`k>hv{vsdET*1{jw*`o4E0)rm!&iR3HbGstz_*T@ebzZ|afd0>X?^L^ver_Ynl
z*BHOE-zeu>jZ6M1<aZdi^VtV4=4GXPKpj^n+vKIrD%3e<+|K7`s&k>XtCLUei~6_8
zb=|w`NEiRRu7Z)T1lRdA!+dHRmp+f7&-%ut&kyiCdDyt*n})eQTN=0XX%8>vWxaoV
zR-m7rCNFg+p-x}pc0R+Y&LGrzo;(&lja=7#g*+AcCGg^2FS70}%x9%>=`$65t}-t9
zQYGCS))|+4u^!Gh8ox6iTyMLKOMWo&dyGqdo4($`b)Ne7n@&((@4E|>&%%EHB)<$V
zUe{a9JGg#1@)~vBzN*2Cd%sQk>>2O8fpOW_R_v>>amnw(z8*C$`Eos7oi@hr%<XgM
zo#EPN9Qx^J@=~WS>I^h4b#y+Xs7?s#Od^kf$CK;2^T-z<zXGoFc^dOcF)n@1L7%C{
z?R>V8>+?ASu5-A6bq|}o)XzixZ;abH<WZe8)VV@_0R9)bu3Ms>x0rWmKZVFwfa@G4
zVGgy7OP`f`-TCc4b&T8d-i+!;)N}c^CNFjLzu)n=al7B1RHp{&3?UDJk0IA}Cz3}a
z9}n04#$&$=j7y)1*l(h7yWb?LpN0BsO<wAJhdS$x+x_mQItx(eEAlk>cjUTm9(gYE
zSK+$fMcD6O#--1)z1{ix$GF{ZnfhMHJM{VqsqgX+z@@&_>4Q4ejobY;raFb_vlV#_
z)bB{H>-HoMLp}no`&||9`W$0i`g|3AMjMwt^}mM_Yh3a_ARlL3^7{P)bB#+rxQ|<R
zfpN+2EAM=Tamg=6KFPS`^?8yC*ZHSmzaN{t)cGEDJ~1wJ^tpO~>O`Z?adQ3pgFlh$
zx|hj!qt0J&o&Q$Mzf=RS3GdMBq+H)SANrIrE`93!D;t-6jYPhhamnla8yJ`TXUI1;
zE_t2*qsArwKtI<{8{?AC+~>TrammLZ-`%+6vydNPT=HKbKiIhB_56;4>-nwGz^yyU
z<fYDi;m)TRmpXcWU!^*^I4?`c3*pJ+y6#8hf#@e4uIKkayz3{^xb)c(eI76_ed_r=
zW?b^`AfIDg@_K&H8khVH<S!VPyq@3d#wFjYzw5KWxa4*IB^r7kc!$n^0rp!SuGj6G
zs8h+f)Y19ZqdH-z^Ducd{4sJ}w<~!P@&n*H|C8}|+V&Yrc^~|J#%RiGpVKJ68};Xs
z=fdA4*ZQl-%VFL1aP712OxNcp#^t;m#5_MWF7wpSi@!21`MLvKox{fMc{~Bv^B9eO
z&YQf{c@}jp8Mo*07S#zvol*hbZ}twY9|pglT-U8h9*2ArxXx$IEVr*##--19(PvxZ
z(x?9UY!~B_zlr>l#wD+R{y5OM<a-Zv>kct)=Q$d#`^`oFlTBXgEJK}G<942Ns7?~<
zEG6F!Urny-t|PyU{3mdoXZRequP=;CpNG)rSH|spjvJSJy+N+d3FCG?=ioY@umG3;
z!{nvTSk$>;+|H+@eBd2gryS~3AP<B;NUrNPB9B166<p^NjrnviE`6>-pIwa0FPBES
zef2Xg`2yqz8o!gr=Yu2Qy03Kf6JzpHC-f;-f3k7;r9Q7_Q=K@}NhDtZe}`PxT|=IQ
z{Ks&e&&%^%KYNW!pD&=#FO17CzsKwTH^wFZHS))e%P;kH=SR5CC$N!Q_o~TDor;5<
z|6yEysq-l&A@9&Sm$9#V$;+XBb#h&|K6wc8kHB?4Z_IW5JZ@Zm*$sVmFfM)S_0!9^
z{PI2I`x(EJ$MrJ|uKQYnexglYet8LXVvO7Q%%D0EsI!1P7XB8wuKPZD8uFXrI-k|J
zzdkiCzkG0ro7-OF(&sr`KZlLWFJqDa#<-o&X}Hd(Tw_=NlF7?2KSQ0X#_fD=Q=KgA
zt4tH`H+zTHzYKqXT-U8lUIYC+1lRer#r4zHxU_H$eLim7&gV(vk`Ie;`|V}i&SwZ*
z`;S9EV@zJ^yn#B=#_fEjQJoOfnM)o4f0JC-T}8eC`Soy}Pw|;<U!NG4KKG-~PmSCC
zens^!qyBd$FLmyD+SNa4-0t@x)k#C08{}E=y8^wU-l22Wb?+fBM7}y)_gfwNZD?Hj
zd;)zoF@9&ics*)mT=FZCZ)@Dnrwd&BjA-KK5N`5P=SS2TWZceYG}WnrI+Mvm;4{f}
z-TCCv$iD^G`J~}~`M|jJS$U}If30ylpO1}8emwG@7`OBJ0<QDPLO<V{ywv#^b-puh
z=W~wgEI^$<$kX8elIyyqn|h0RhxU_;`~z^E&mqjGu5sz}68dat+|K6_<C5<%%+0fv
zaXX(5aP21~(B*rZywrIOb;6C?`HY}Ch1gdNc@5NmnOxVMLmr0wn{b`aCCuj?<I?A6
z=ySDk>GL99kJcNP`~#70znhIqJ|Fo{;X0p9=;sjS^?l1p%10yr3;6>0b#kr$5BYB7
z%Qf?w^A4Ru^O>&yipFJMF_F%z7?*ujz}M^Q!F6Bt@N)@TP+s@dp7MF<rzg4o9EKs}
zT7M*YbF4cFuKT))^E<=1?CUG+YqoLOm%blcWL)xfhPyc|F)sN(aeh}Bm;5y3-#31z
zKHk4=gzMZA(f@9fmpXe<C&ReZ(Rm)BI=xXRmplf3kzCikMxKm(v4_0HyhG=?Y@VCL
zJ;tTa8|bsVap_av|JO7w`CiYsI<<}4`80*=e0-X@d>fOOI&Y%RW5(@#dQhDV>}xQ2
z9(**pt~-I;5B<!5>wGq2KJ$%Bp9j(BBI9;GD~(IO?g+QvRmSan*1>f?G3Y1V<fV@O
zcWrhXxAQqfb(*724ta0*IdWb1H}ZJoZ^Lyym*U;NN;mhK^A2(8^Ih!s9^-fRi}y2C
zjZ6L}@->ay`80y-d~(sxqb4tP9!LE)#_fE%QJrMe89=@pK7w4=eU3aI`Dt*S&m*t7
z`OGmceNIN7^Nrj2EH^Is!^p2RF8SMdUac`M`3581y6cQfzCxz+9prW4`;1GS8K|@0
zxYW__H#lls@;S(VZ~V@_@SOY^uIF*kL$05Elb1TRMmfK3T<Yj^@~(%y54=O`R6!j-
z@?dyPa$UC}`55F|!u34X#dDy&ap|)k`s`#}`fP@I_AxH`H01jmxAPee*L@v8KhK-I
z)Y1Pw(M02RJ~OG#T-14;JQco@T-W`8JO}x$aGg(C%x8~r>9gTzcOLf{zq4Ol&qs_)
zJ|6j_#_fE5fa`pMo4fj#O<wAJi8}el?R@^FItAEQxfb4U_71II1@)_v>$-KxyCVNE
zT<6mP^J!;X`urPxwl^+)w!rn%!?@)2zuVHsxa8X+|Fm(*uOH*)Gu*hH=W}q~Zz}qq
zYVuO&8tP0pZs)m>>Wo31x5?+i*O2SFo5|CW-vifq_QO2)Q@+N-ZokJVug{IMl+Qu^
z-^mN$|B!2a-$%Tmc!$m{0P9wUYoDXgXC31*&wyuLpAC%5JbU0gwlFUFnaDqCT=IXE
zaCM$AF8PzlcQ$U%dtbQrKNtNEGkK}wKi1VBVceegiBzX6>dYV?17AR{>n<Z-fqV*F
z=lLDxxyiWn*&lswGj8{rLG=qz|FFqRot3Ebjd8o*JgSq9I#<YZ;D3?px+Q|V#k@o3
z?~9*nQ~|F0y@>tRGA?~)qt80VrOyGlewrDVe4}yhJhm`y=kpj``x%3No-}!>Gahw%
z8MpHpN_7HIXB>G~cr3ZDJBvIP`9!$R$8WydSCVn*GX;Gn8<#$ZVLoZbC4U?FO~xhv
zEb_aJOMXDKTQ|eF<R>7XWnA(bk<T_R`Hgta<QkW}?{ltxo^i?RpQl`g>-oyXd~TV%
z)ai*jw~b33eIAx;>3!fGS|<s0s*>-9Hz3z_o0DHg{xP_ouPY1OzPcNiK4+uPp2nq5
zJzs;3OFkF*p~mfe#=>=9VUM_Vr<lCdsq?(^X~yk*=24w;sI#0r5S~J=>uw;AKz=t|
z=Tl~(>*s)R>2o0Z%rb8Gn?v<?qy9OQmpbpD&PC&PzXen$4s}XC>iuT#(0L}oE0F8D
zHORA&Zw%M{Ho$&cP`-JPn?oq&^}6jv`OByuL0%4Zo+a1%lgLAmp9$AKTcOW|#$}%0
zVxEhQ-#IT)uK#z8OTNi?=c|p|^SB=V|8qt^J565dOhBE_jN9{gnCe8J&Pnn(_%Gy1
z@ZZVP;QzvPKHV{&ds-E}PO^}HfIJUgAFg!<qE1uFcf`*JYfE{(9=cQB2l;{I{_rSr
zt^YiEZ{*|P+UHpGnLzn%$iG2(?Q=EdW02oKo(SJXuJykl&p`etT>Gqp&%1x1d=~Oo
zC_e-Hx@BChw-0f>-8L@Qn|{Ad+2Eq*{W9uTBKLXJUH^6A+UMI?_aWo5?q#g|h;dnW
z7ryTCxN*sMigEQj7`OLVFSy=ck?1GF<fYDh)QL21@2~Mx#~*d#$V1_;k?Xok$YYRS
z4cGZ>#(dTrmp(Jl=Vs$}KA#$weANkVK6{PZ`5cDpe6rEcNt2g4!%*jpaXX(YR3{O2
z{vzK5zq_?p)H`_H^5l8QKM2?PluLB`YD#&ZR?b_ISA=(>I!#cgk8#=WQtY?CaXYu+
zRDUw+KX39<=OpS(G;ZfMlj;Pa&g<mi@Rj7c?g!)v$Zv(~+&;#B_ZXKx@0;l6w$HfT
z?-8nh7WH#YUh2GzI(f$Jet)AnDX3FOo(V7A#w+R_dY$OH_mf{ozBXL<`<-4V#--0K
z=<{LY(&r4kpKoVe@?|Hv`Ls7K`MJpVFfREh<og)6^L!ev`w9<s^~ajL)cFW?o;Pmi
z`7+h1h&uDg_2(HbC)agXlSiS>M!3%NCg!=zxb*o0`rKpO?)MPY&qVzklb1R@Cc8Q0
z8n^rXmFgs*P62reykuLisCVd`b=~{Ok0D<ZuKT@vvFoRiap`jw`fO@k`n<Np<y#w<
z{3+zy8JB!+9hdKBT=GFLIPYQH&hsg_?klLZ%a1a7sWTOI#u~Tte2MB@#~fZIuZa3f
z$aUR!$U7px4zBZThk5QWE`4r9pSz6PdG0qZdEXb^eh(S9^Zeep<cA}F%DA29FL0e_
z3i`ip@=|9F>J%8a^SnF63wejui9(%<<O%TF<hpJX@@>eshU+}TG0#rMrO#aS+0D50
zxgCFAGmz>ZL;d087vSTmPBNYY(~Qfyb*8xUGQ+s6tM41<8<+ev<QEyY=Vc{a=czxJ
zGS%dz&R*0>Gj7kzE~?|(#`SrCJOF;2T-W`9d=T<i;CfzK;C=Wl<I?91^m*I3^!Wx}
zM@qNzKJX5yBl(b6*XKRPCI4qd=hfgkpLp~WK>3ZhPJ)a}{qd+DY+ULuLq8pjOa1`z
zU5!irwO3p};l?Fj`z7atj7wg>t`!B>{`1iP1e2FKqfzGt<5EXI&q|;=$*8lKJOlnN
zxvrZ^o{#)?xSrpyFwf77OP@*T^K;|U=Y8J4a(qqo!`nK~rM&LzSIYY#UqId*Uh*-w
zkj_)<-$x#ad`-CS>&Z7<KlP2vzW&6%8X33yYDx7oQNIJ_bzglcACLSn@?>~4xz>M?
zJRA80xbAB-_LXQ{_SJK$+wW52c3;WHCBFvw6yuWD>v<Dg=ifZU)&JDwrOp-9*=t<t
z=zOxNPCoW^n%ocdFOloI*U3YXFaEf<n0M%W=3_qh8kaunOmqELFn(t~gPhkgF8OK5
z*D-GA(+sZjNk%_yO<wBkMV-fu+xhgQI+3U|gghQThFsU3NWKaAc(~4IE#|Ypxb%4g
zeI^>W^GPx;`Cf5uZpp^&eA3`LAHQ}k|B1;<oi|bEQ{#3%SyU$*`#M3M4?j<?>*kaD
zqo04^I-gH5pE99dbKW5?eI7)g_ZqkJsb*aAbzgS-t!3QKr!idT6OVpcnY`3_7IoSh
zxAW;vbwW{RAbBJ_id@%yo;(rxIJnN|d(3C9aq072^tr&e^!Ywse^(fn{7vMOj7xqq
z@~Orp-+Q{7XPR+4&vdxXGavnbVe(RE8R~px+|DzH>TE)tbL83ZKgf06LUNzST>oX-
zdrf$U&T}L_&#G)(`aFa_s~NZZZ2&LkWu;;y>OW%gQl~Y39!o3ZcE6pejz8-3BM*f~
zlIyx-$zza@h3kG}vEKya(&zK&bFOi_-=$PP8}(P4ywu4>oezxL{cfW=iKw%ed=va@
za$PrvJP-NvaNTb=ynp_K^4F0sB-fv}T;>TmtN*)B7U^|jT=rW&{!YxNnsM20aXil(
z7?=E5<Qp58d<O2jM~zE<AM$OC+w;;HUd+pS|M)~a?)vFx@=~YtOy>iQ+w(Gt>eN7;
zN#r5$cye8L9(gqKE8xYwUS!>sm}jza>GLu4nPOb>`rq}~1lRp$qyA@<*Y`h%DZc>u
zljLdeU&yuo@8r42{|hhf^(cLA#J<XQ@ILSkaoN}MnQs2~8JGNiocHR+C7+M{gT^JF
z9_8vZF)sOTvz$L<T=Ktma^BXs<ljU7apRJI`YD%x(zxXRM!uJE$sa=hLySv4e737I
z%(&$B{p~oop2v_-myb1hsq;4K#2J@5dVc3qokE<K734Kg{{wPecO!Wi@}I)>{KhSH
zeST$J`aFU@4;z<0voW6&#w8z+;Od+<F8MRaUo<ZHnaE!;Zs&OmuJcSo|D`&5zu7zV
zI^2&sWsKW-R)uSwXw+#yz5xCRxvtxed^hq>!gZc2G0%a<Wxs{!bBJ-f-_caRMtg6Q
z-Z9zarOsG<Jt5Y(-R~T#lN)-cjL%Z?LilQOU3Z=F;;zJ<|N9AC_Z$AX`+t5xzGAQQ
zZ^`xh^v;mCD&g|KlI!<Z-y%;&{ZgI0p?HV(qxCD0YyAhwQ&A_7{8M-^c?P^A`B(5h
zaJ}9F+q-=YqkI(RHqN-5-&Huj<BiMty`1UlOfxR|*82B=j7z=_z7DepuKgsmcXg6Y
zUh33()%jZTvGDExQD;BpcOsunUTTi3f8sytoTvN%<Zn<u75(4c*=yQ6^f{1>ydQZf
z%%>{(QRExKbw2T^A4Hx6Z%>{H?@68uA3}Z>K8C!+6K*~)ko&`Dkq5&UkoSha4cGf(
zHoh+Xp>a9yGccczjLY>?-}_gN?ZzdagZxh8lGoS4FX1}RP3Y&S$=|u&@b^K!H!gMb
zb?`jZi9wxf<cV;fF0Nr-w+wj(@>SqEpEod{dd8*Ce&{p6xSdasamlA4A8g#trz2eZ
z^zY#2+{fgl&L61L-?*Jm6xGSYz9x|Sp#F4nU3ZD8-@se<Jv@isGA`?0!}Dhq`Jyje
z|L+@b=;hl!;Czj7sk0gRb#R?SbM%=``J>1mBtHp1MSceU6Zy~Z-^g#kOLg^{^A5cp
zN`C43uRvY{-jICs0he!1-VXUk$@{`X$j8E;AfFBIO8z0dCwT@uocuI=FnIwylDy)6
zx35v;&EV1GJ>V0`N5NysXTYbEFNY_PZ-UPwKMYSK{{_B`yco_`5_xs_d*p54spS3O
z8_Anvp4-Xekl#<f1b&n}7k-NT1Nas4Ech+*4e*lPieBgY;g!kv!E2IlgV!U!2=7RK
z<)FKM!pQIb%K2FGuaKWeUK#o6<kjKx$os>WkspP>M}7vrf&2n|C;3z8^ALF`@<+-2
z;U~zO!_SiMg<l~b0l!8*4StJ!KKx(uRq&GCi(U_#;eO;N;nm4IU=DT3uOi=w{2%y3
z<W*6pC3yh6J^2oJH}WWWfAZDv;pFS!lgJmqr;(3^&mo@#UqL<xzKVP%{6q2+@Ga#3
zzz>t}KIHDB@5uFj`I%hri+u7*sB@eAZFrd{i(V(|;8n<H!)ufK!<&&ehKG_*gg-+*
z5<ZSR2tI*43_gqe8~6(H^YFFgx8ZxpD`mO)A18kSewtjbpNr&=BL63Oe|WL5qVpdK
zznA<;cx7^Z&etLDjC>IJJa`xKMEGd(ki%{c<H>cu)5tfY&K&Yj;Y-N%I$TAr*I^p@
z!{}!l`AO8zApZgW4f%tplS6(FJdgY=>Rcwj3;EmR1<04^QS|)&2CqVX5#E5j59)U&
zp9mjKz7sy4d?tJv`3m?P@?`iD^0n|)<Qw4Y$hX1M$rr*i$n|>8BA<i&b@DIZx5<ye
z@9kN1{(r)okw5UYyUsh3w}lTQe+fQ@JOchA`9k>H<UhgRBTt5>l5dA^AkTt-Or8%v
zMDBaU?e`3MHTciuP2hL+Dmu?zaDVcr;7!RVz#k`H2p>ki9zK=)EBM>wm*Km}@5*-j
z%^<%Qo=aW_Uc7hF{Vs-=ArFRECQpFZA)g0tM!pc<mOK{Tfn4v$UgUbe4<R3oI??1$
z!KaY-gwG;x2VX?q3H~;DG<*yByYR2bzl5J6zX-oceiL50Pto&L{u_7R>yfvDw<1r0
zKTh5k{v>$>d?5L7_y}_Syk;`_YsklukAlx4e-=KMJO=(c`AhJn<TK$b$@jt6lK%kz
zn!Mz<ZqDb(>%xDB%h!eEYcYEKOZkq-m+k99l7G6SroF%41J|$Tj6=RQ`AB$Ea((~Y
zhWsVuJHut&5~j~ylz$ufAtry?^ch9@UC76nd?{1^CCZ;d{uPtIVCuh4`M;50Y4X0N
zehTINkGh#|Hu;B5{hgHWg#3P!FJtOwQ+^Ecr%nDbQ~x~W=Ocg3<ja}*g_K{9eCd8J
zB<JfbQ@;XSuahIlKWOszn)(5h{~h_3Cf^ocLzT%rM)~`Xxp_Wm@_wd%IOUrnKiuSJ
zn*PU9z6<hGOumAtA5Zxa$S*YcCZ_*ol%Ik8`zBw})K8=QYUDpL`BtX?&ndqT`6DJ@
z+0@UW{CVWhnfypo|0?B6A9wTr%jD~L_5B?C_=da1^m>?qydQZ*cn$Je@Bs1vco2CI
zygm6ScsKIL;Qh%vz=xCffImk*0R9sBQ20mWOW-@;av%A6Gm9(j2A4(oZOEUX{1W7U
zqWp2>f1~_I$d~9}^t}9ud<D4nlYx9g%2)f&_1Tj0r;zVX`F6+;qWpE_pQHRR<fl=-
zTp71+0_A5S{|4pjA-{(5E0O=0@<GTSr2G!#b12^#`5!5N0{P!4KNR@_$`>MEVt_j@
zGXJ~0t@^tUeQLw?J}Upcn?pnL2jGvA*MNtR2f?2p4}*6lkA(Lmp8^jjUj!da{vkY)
zd?$Pq`PcAh@-y&><iEpX$xGz8xlJd(AD%#78$OS`1w4_wD|{Jw1U!j+BK$q_SK+DT
zZ^Ji`Z-j3n{|vs9{9AY?`FZ#u@<RBx<dsgid7dV31pk@5E&L*R5BM$er{VvSkAasQ
zSoAse0=z7F0=zu=BKQO3$?%%wYvJ|Ccf$k855j}UzlVpAUx9ZZ{~O+oyuwL0{{iHW
z!H1IT=gVWs{gHo>T>l(r7I`z|myi#GuOfd9zJ^@;*-AbV`90*?=OOZF<i97M2){_4
z4*#88`?*c7>y{o=^m=;-bt;kT+-j4jBL4{aC3stM?WYU5zHjMAehPIW$@S0KpCi|O
zO(idN%3W7;$o1>7?~qqQel2-D_!e@l^BK8*J@XKGTh#fUyaW6kTwXWj4C(hjT%-Jb
zxo%(o7;o(ThKBQ;7k{eg`8{{W`8~!Z-)6q^^2Qr^u3w+8VO;VF$om_YyzaM&amgP<
z{vqR%zlMI=kpBe_h3g!mI=eo5n0ynjPN-v_{>Ek9-I&7&s#C9{`wf#Q{|E9jDW8k{
zV#-&-zE)9w4Eo$id7lMt-E{IbsPiS)!S}r!C69sUktf5ikf*@^B2R<gJ=hzTcj%lm
z;T6dbz-yCd!<&&`fVU;Dh<SD;uLAE+?hk*4JOVzRJRTlLo&bN1d;xqJc`E#U@-+A+
z@@?=>$+O`H$<M;SC->>(u9LIme(>MPo5TMh4}zB+QuO?Wz^jml!|Rg|g0~=#gg;Im
z3lAe-3V(`x1$-2FGJFzwIy|0yH+&&^Cj4#kT=*LD>+o&l6>(qhC9eYin%p0LiaZ#8
zfjk8MCwWJB@ra`5F#>)cxjrXrkWWUw5qT{9QSx|r2l6C%Z}MdL)8wh}vE-TXDdc(Z
z1oE@+#pIXa?~<43;_jn$<i7B9azFUz<Pq@WaQVDdUSI0tdHw_C<B`8&^74Au0I$~t
z#-+{>)G0JBd3`@~_tV}7-l6N>x6tjYta1DLTiLkO?~i;n<C53c_xi>qpNxDX<C53c
z>mYJ{y>0{7*OA@bT%TRoF`t2^j;x!4IgF&dPghsx1<LP7em3PpkY7UiOUSRLd<Od5
zO!@CHhn?gt;0LJAHoZ>Bcf)@ozYhP6yZ~NEu5&0o)Eky}=$wPG-^%12;dRL);myh8
z;O)rc;oZsS!UvKk!=uPk;1kHx;M2)7;q%Fl!B>!9hkrm`0N+CHgY&+Jyb3&vyaxOP
zc|G`f@^JVy^2u<YVMWhlEc_nwcz8AP74U}SN$?=@6nJ}by-$0RXCXg?JR3fSJO};)
z`E~d#@&foGa-Z(*eorE=0bffV3Exg01>Z*=4bLV|fS)Fx3%^932){|53NIE}^!#pv
z-v`&Pf40NxLN(*^Jp3EanOer}>p~;rlCSl;n_E-klK&T<Pldqsxsi!}I+JI?!>LX`
z^f}D9tlJ*zjxcWfeBQX^=OI7Qxb5?0<B~s${7mDL*YB%bU|jN56WtsVjZ0oXKV4~D
z@(IYVGA?<2z1v`1KHrRS<$bmrmpXkHx&KF|ami;OpJiO~HIP4PT=G8huXp@pT=H{~
z&o?gl=ExTqm;7hQmm2N@|9{?}boDF4^?k*4<m*xXI`To355e5pkq?JINp%WwT@4~H
zf%+rK2f-(jN5E&0N5L16XTaYg&w_tQei^=%+$YS<ErYxS{4jYr_(}2r_%Gyv@ayD3
z@M6ytJ&(QN_maoMtCJ_d1IQP^Tau^1pCC_#_aff}k03t)A4Q%GpA0YVZBOpIv3SnR
zFfP~g8eCVijZ0qNC%<l7@&}QB!?@)2dAJ&0%royFpFH%lj{E}r6RI;GeSTqF*1dvt
zzcOz7JZ@a_ev938b;7vq^CDdPEI>ck$bEXaI>koFZvOZ8l|DqD<&4X^k6>Lt<F?Q0
z#wEW9`3H^LJ{udC{IAG2GcNi2esF!ZHZJ*xmpE@{T=M$d?rL1}`tt|Ej7wgh+XIbD
zzRprte~59(*Fry|j7z@On=U`rxa1om|B`We4&(9bGt;=#33|iTS!7)DiQd0*EH^Is
zvB-a5T=E&nuQx9FWaM`lmwZ0*`;1HeJLJEC>viSV)AjQs<;&r`{6_gu<b9&tLdCuR
zk@};NFHODx{(y1m)4#Y|*Wb9*>5TK$%(&!xBj3un<n`wjbTTgac;tH;m;4sgk1#Iz
zO~{WlF8K?{Pckm~JmlkyOFkUe&phLj_q)sOcZqSy&qIE-amj}w|B-RY-#|Xyxa4Dy
z-)mg*fy>;wM~q888TlOJlFvZ>^KiXR@_V~FH!1%N>X#hp{bujbd{7^kuMF4g<Q3%W
zQ9cyUv4_dK!XG0~fj>!}3Liwi2|kj%9Ioey<W=A^$b;bv$iv`ok&l6YNFEK}N<JB$
zL7ojiOnwZ0k~|mw3wdxacV4cOcZC-lRrEZD!|x@JfLABah6j)zgSRBlg+D<ag6pjp
zc}I8zc^Ldz@-gri$)n-3$tS}T$rIu4ke`KrM1BFjgIw>UO!5HSFW-;{!q1TF{q-w(
zH1Y-Hli?*t7d^jA;T6bNz#k+}h6j?T!&{T@hIb~<g!d!Qg+EPx0X_~c&l7oF{v7Xf
zrWlv!SSp?~(~L`A-#5-NF8M>q&o?f4ec!keuFtmu^z#9^PhWR`ZKXOF(B~fGvhG!^
zyU)1o^N4ZDmtXGcA2n|K{28u&`k|jI<W=B*Q=MX`UH!Yqc#C<5KDUFgZdv2D&j*Z4
zpD!a{-MH<up>fH7iF^~|lGo4oTN#&pxwl-OZH-G_-#2zKF8L|QKWSX@`o3|9ad~~r
z#_MC0ajDa3g<E%`amo9aa6Zkr<nKfNHRF<xME(uqlAnfrvT?~LBEQzS<ToR~1OET#
zy`Ssn0Ofx{{yWNtBL55JAHv-7$;09QP@S&0uF5{^HRm1LPj7e?@)US|@>F;W@=fr^
z$;+YtF!Cz!r^tihqsYVHlgN9+<H-lX7m`ngzfB$sUqc=b-$tGU-%Fka|C&4-eu_K?
zet|q6{wMi$c=54C&toC{KJtp;?s}_AUIX3`uFvi2c+Naxys@{`+qkY;8E@pdKDRp<
zm;9&5cQGz`eQpng>vb52euk3=!N*gb$I<6B<Bh%gd02Obaogv7<C35Jwwuo)<C53s
z)k@=%KaBh;<C51uzguTq@+DWg`WuZ)UY~Ef$o0?fK8NdkV*0x}N64cwpFC5iu~)wr
z`n*c{$*A)$<pa>C?>O%_dxyThe1tlc;o8q+tXr2n5#F3U4c?A?6TCZlI(#5`Hav>_
z7<>YGE_^!qb@+VpikQy|@+$BT$o=74$b;c~$V1>+<Q?HB$RptA$)n-d$m8KY(e6Cz
z`AUM{L!Jz;MxF|9NS*-?BF}`kC(nXENnT}uyPltd>+@$I?(5;k<$CUc>vN=WxsUYw
z7$+E){4(TUFfRE(e7$I<amoLV{42)oeZAPY<QpZq{@*k%d3|oICfEBq6|Uzce4wlI
zF+1k-rKuz9W}(kxlplmT=O{l5eO@IW1}~&K5m>kMbKYX!p?$`}E0ZsU*Ck&8Z%&>J
zZ%3XE?@qoOK9D>U9z~uDpFmy!pH5x~pHE%_^ISn*1O5TIKYR;$0DKR5C_IZ?uZI)l
zQOKVskA~;N^*#za<*uvS<l*qr&%5)hdA)8clg~sxfP5<a5%RI{$H<?8cOsty?@O+I
z4kgz<$B{2Wok`^H!e@}b4_`q3348_l9{303U%<DJ>)!|ej9lv<B-i@i!}Y#ff%AKg
z@)Pi!{N1=bAJ*W${?oWTm-KyFvGM;q?~)IA$6Y5Sjoar~dE=5_ihL#G_BmPGxa5C8
zzP@qE>-(RFjZ1#OD%Vd-<C1TI=XQH?eXe$e>)av+xjOyHvoX(6rjD$87y6t``AF1x
zh4Ss*b@g8-pMW|^RHqPi)>Hl&)Y(p+1mE``b&gR!7x~lVl`+rDR43#q*Z*zGzl40*
z7;h-vq4SJFz6M<1AAXK}eexuD3#t>1IvprqHu=tSK4Ij|;Qh(Zp?(zA&%ybfKz<!Q
zo!k%SWj=XD_zLnG@DIp?;9JOp;d{tK;aTK^;3vqV;pfTc!mp7pfcs1+dLEa;?;%fv
zS0mp9Z%CdF4<gTow<o_0?@3+}*TWF<LGUr;aqt(&v*EMIkHHs_=fac73*c+X3*p<z
zOAL0`?LKmU_+j$q@KbPo{at$6)%nG^JeT_5`v29qJP-AGe$%+*&msS}amnlJ=G_y$
z54=O~-^W(p`Ov4VamnlFvkw@T`Y$41-MHlSdESs*pU=(U`aFpq;?`|TJ_hp%Gj(L$
zjAWM|O!*kp8AtiI(C1|G>hM`y2kR~(UjR=cPlc}~PlInK-v-}Do(0b)&xW5S&w*be
z&xhY6_rrWjO!9{49XkJt@bcs};I+tu;7!Pb;lbpg@J{4|;C;!*z=x5?!K2Anz+WOy
zg1<_h0$)PD8=g#_0bfsk0KS8~VuZUszkus~ore4R8{=|4e}?PuxN&=5|7cwDcfaTA
zpEE9b{ds`D8<+go$p2|v^7<SoHre~YJM=lw@O@Xmq;bjXbD+F&sXq+)O2#Fx&w<+H
z`Wy&=>vfp-v|G0&c~{J{v#BHNj=;XcDZc>uk(7TG`AL*NhI|6$*CPK0<<Fwe_bERM
zb4VjE0pCe=Lb2|Ca^3GS@_6KbBu{`}CD%FpO`eIo?+e}#y+h}p3$H|80Ix${5p#Hm
zyb3&o+#lYJJQzNJJOn<1ydyk@JOchQc^rHmc|3eM`CNDkc`|%6c?$e9@-+A%@=SOR
zc`p1Mc|QCP^6T(_$qV7-UMzZks|<DbS5@*F@CM}d;E#}p!rPI@z@LQcb8q))x9&jW
za{sQueKEwiJU8_H%xL41&qscoamnj*Z;Elr??`d$PBSifeeTUME_uHXTz<ZB$?J1(
zxpB#NMSi7m$?J1(4Y@w|Ho*113yyT_?jldYJhMz4SvL&(I!XBp$p1?D@yOqzeDh&$
z-7-_WqTZp;|2L4Y0@pr6BJad}8c}{6=Fo!t3hIPXoh0<xgIxDJm^>Hx(d2pX$>chR
zndJW1@9X5j@Rj7@@Ko{`_{Zdv;h&So!H<wHh3As5fL|m}hTkAhhu;<J&ZC~M9Jn8O
zF1#lBS$JdeLU=23A6yR|$$jB{$o=6%$%EkI$h*R0$;05UkcY$HAdi8sBA*OTBaefB
zLcRjNkNg1q8@N9AzQ%L!v~jtA6LG)%Xk4Bf`rNx>T=JKZ|J}IcAOFGU&T-qg<hOq4
zyx2?L2i~Fm=yUHL<B~78#^uW!x6i$r#w9-x`P#<qbFV46KKFv)dVP+0#;x0)+;_P1
zzNU_>+ZFqYq<k3i6DU6p`5BbYMLv=8uOt61<)hK(M#?Y59MZ`zqRy98#|P^kCD;At
zk%uCGg}fvDFLIs3-BXL*8KBNN0r`sL3*fcMm%^KoZ-Tca-v;kWz8l`3JO};^`C0gQ
zav#h;j=To^HFAIWGV%cU`{beUP2?TnpOS~c50Xd0zbB7{pCylj|4yC&|A#yoUUpis
zBIh>+UWGgjUZ4B`yal<>2zTE-PF@clMjilvio7{|6nPkY5_xZUJozB_Lh{M*x5*RX
zYsi<vw~;5o_mXdee@&haKSiDazd)V?|AYK2+$YYRM}0n@$LmEo<MQ0wg6E8%ae3bA
z&m*c~T=IV-?{8f4`uY-RT=MUvy7S)LxP6|7kn8ij16-do0V7?V-sFB!&WD>ivhF~v
zJD&1`kdLSQRODZ$yf5-A$#vaS@-XB-ChraZoLu`kLcSFFT=H%3i{!iEH^_70cfITl
z#XEGKd2m1S3-FrcKA3-F@)Gb?<mKQU$?L)UkO#ttk_W-Zk@tqjl83`zA&-E+K^_ZV
zMV<^#BTs>ULY@Zyk~|ZBl>7iZk31WGh5Q2iCV4)*<aBp_^?ui%8(-eI+!q&comVn0
z_oM#2vf9QaUu&(qzv>&e_xr=fB_ED_OXHH)=Sh3xlAnisC*zXWpL^EFxa6Pv$o13T
zxa9To;^D?6pO5@V<C53!=Xn9H_l3_WSN~O$mpWZhXA!wSJn28`tf&0n*zb1oqwp`N
zPH*({9pw*W-LuA<cztG+aQ$B~F8$xX&iM`UN8u%Acp>l5IRs+e^5ik_TI7lFCge-u
z!Q@HsPUPF*eaX||!^kt>(d0Ss7vXwe<eYMIm`$$VN3n=puahLIe;M^ZqWr&jo!w$w
z=KmDtyxq9H4nHUFg3rIcHZFB8q0YC)rH+0b>5Os7cTaQs{mHoG_4Bo><o&SjpK!e%
zLY{SXipP7u**nzzM?1eCE_0T3-$S3ZDL)ta7L@-2`B2K&7~|^qq5Kl;YZ&D#qJA`a
z4fspsQSevE6X8q9)8NVE2jJ_;v*0_)kHPnoUxpte&xij=UI4#J?uWVkO<oV~JG1C{
z424%BkAT-9kAy!&J_a5_9uMzEo&X;}z5qUgJOv&@o&kTEJQF^TJPW>@{46|$`~rM4
zc|QCza$npphsdkIbI1eX=g9TG`-8kA@`dCv@G`U9`PJuM`7`c5s%%{D({$WN)r`yY
zLEq0eFfRG4$Tv1FdHp$}j~bVJz4dP0HpV5dKVP)7amimtzPoYB>+Aaf<C34U!POsZ
zT=M$d9t$t#nfH%RJmxda<fYCLteZf-2EO<|>byt!S;(&=9}M3~bq=7PLzEB4zD^jI
z*Y|w9zW-!g`hOewU&%j(--7ELQn7BS*)o;?J<rd=?<X%Y_D;;lpWGMTl-v*AhCBe?
zg**@*P96jwP96pyM;-}(30~aWo?H)sxc+Avm$~I(KCc+J*Uw^deO-RXxYU`j(amSI
zajB!P%j=Cxel7BwjZ0o%m-oW;d@aSkzBPHN(+G9)D1QO@-zgu4{J)f+JkIs+m*5rk
z4w;+O58mXwD)|qn(-5wG7NSlt<)22K_T<Iky{OJy^dCW<2!ED53;rT`9(*==K0J}U
z9QuEUJOKU?c_4fTc@R94JPiH~d2jd`@<H%l$z$LJ<ni#5uekH5=OqbVfjk-hAbBc0
zkURt4nmiNUnLG>LkNhk=lDq)^9Jz0_yAG$4`@s{)L*Q?~^*PWP&w+Q1%XK~r*Wr7{
z<$l!H!41YGpN{+%<C53c!Ox6K{wngH8<)Jk4t{N1^7S^m{eEj)@~J1CpD`}^ySF(1
z$++b8b@Qrm$<IUn595;8*UjRudLMX)UO!=&=lyVfKKz6}Ymo1RH~Nn{Z7BaH@*T*Z
zgZHI6N$6(;<ws**6O7C2rhiE{pQ*-W4(pMhO`Z*34A(itV%>Micf;3_=fcy;^Wa~Q
zUx0s0?(>}M{|E9C@XO@o;J3)@!S9+=^!x_H%ft14iNyU<)ws;<8s<~exV?TFk?ZSb
zOXE^!%~rRs*2bldzHW9herH|eyBU|fzHas>*RLl>!1X+K9PieBmOKV?m}=_Cx*=FM
zf%56dFEx4T=V^Q%o$?>~k4;|c4@3P-%3ntP<CLF;{Lhq+ectWsI_I}JzfIl<e)n9j
z3Ga~eF8513?w9+F+kHJ~T=Kn<4={e`{Gxs<xX!;G=HHd_r;+bN9tIyqb)qnzX!2<I
zOXR8WSIN)9mylnFCzJbO&g;no;XBEj!}pU1!;g{ohW|(&4!=qs0sotPGTiqycYbyL
z3Ghnf8Spyfned0mv*01*XW`w*FTe+o=fg*k`{Fu@A@_&BOx_$mk6iEf<>X<=uO^R!
zZ-ndf@FhGCcNv%Ky!glN{@P=_k>~pQdx(4#o)6!`^}O_sadl2nehTtGQ9f{j%l}Gw
zeeT_){9Np-#=N4}gL((@WaN93Uw}VN?u-7%l9z)|A+HEeAP<BuCT|XZmpmB0j$G%N
zP9A~$7v!<<Z^`4}KaeNDFOw(1Z;>a%OU*Aj|5W(><QZ^(@;rD`^0V+Z<d@-H$V=e*
z2`Bf34=4A7KTjS2pGF=8pG)2m{w8@C{5|q0_(t+E@ZIDw@UO_{!jF<C!GDD7{XQS}
z`xWDjy;B#A`~7$0jXZx9_vvlpl7AlgVhh}P*ZTVRPwz1<`4r^K8<+a?P`{>e$yeI$
zo&&XwOMV&hO^r)_81fGrm%P63YG+*XA0gk~xa9Tu*2B2u+wXAw^f4~^_t4MN#wEWQ
z`QgST{~_|v8JB!^x~o6Ixa9SH;LGItJWPP=^Y-#YS7$N#SzHhAnL4uW0`$3w^7*K<
zm-3ZAarF<9Uqk;nROd3*JxA`3`hSoI!T%-CfR|h7HSHa`-wW`n<c09MaJ@c%#-Eo3
zlIwrJDVV%uuG?=%a{aur4_x~Rn&k4sD8C%{-Du-7|F)RtIOB5O_4D*8#wEWT`Dw-_
zulLa$<C1T_)Acjoxa9RdT5eqOmyus-T=IG!tuZe7pLV(W>x@f&JFfE`#wA~Jx6AJ`
zF8Mvk?>8>_0OSuDm;9H=e{Wp!JCHwRT=II~{R-FfH3sLa(B!4gSC~Vo*S!zCL-REz
zyZ-No%XKCBPcerFjLW*I=(8Tx$w8fmO<w9uK>sa`OP#~0)84q`mm=TExa5x_-xsd^
z*Nb)i4>NhGQ)#dB5yox*F;pl1MVEis<fTr#J<ewuxBV|PF8N607aO<zzh}IOm*0fX
z%hnl}I{h--y4%QW!apTXgC8_5_485xsBx)ZfIf4{v*8zwOCA4GuAe`QOPzJd|4lv{
zUS^RO@(w*;&8N6J)!}-*y_Vs;k#SkKH`Z-oT-H5;d|UEA;N9W6ZY1uDf#iC>M3E;W
zKY=_QKArp+d_H*&d<A(P`~&g=_!ja)_#W~SxbL#a^}aqqz6tsB<mvEh<a%H04@TB`
zmUzLPuX_@Up5JotYUIt~4aviC-vyCJz}u6@!F!S~g%2T5gO4H4gug(Z4WC7R9lnUX
z3a;lQ@-X;X@-gu3<k9eb<dfmq<O|@Z$rIt1$XCE`l5c{SSX}fxX2HvoXTxie=fIng
z7r=wb3*nu}OW=9lm;C>q^W+_ok0$R5e~G*|{8jQX@FnEY@MQAI@b%;i;5*2d!oPs)
z`?oE4AN398Q;<JHo(BJwJQH3(egIzbjiTo_8(x9@0{lVp0(c;KiI?1Spf!0pcxUp8
z@P6bq;F07(@aM>b;Zw;&;d96b!55Q9!B@fcynKf9vc|Z)?zGwK_PfrwyuR!E=N-l+
zAA|fZ<B~t|gR8UOxa2=X{*ZCWpF{q8a{avN3|ybjp;KM`U&&*!-vaV@c*!N+V&0*3
zlHe7{Q{WGhAAkpvXTe*OAA@%$&xiLTzYdQiFN8lwUIlZQO70JzLmmKMO0M%<P2Lsx
z?Qpq%8hHQi^mX&!ZCuXdMV!aa$zREH`7ez(^zt_wIX`Gz>ZBw8HC)eEIQlt7`IE?B
zA^#En5BWKG$)(<6-l6x!C3pq$+wex@<$jdk?c>vuye_;ec_aAK<dc7Pbw-hQM?RW-
z7<?l66nHFoB78deR(JyWVfZ}qOYlVUl0Uirmyy?oCy}>>zehe8o=QFmzJYuJd>eTR
zd?)#*@C@>k@Gr@)!?Vcm#rgV{JOG|U-UWV!JQ9A6ydCCznfx{6%e`6b&cOA$9dgdi
zzan`m^8V!O;eq78z=O$0o^|y*lE=V%lTU?5kpBvQj{IA!`vUnE_%!m*;jfbSL;XeM
ze<J@T`8~+5B(DiyP5v-^4S5In7V>ELr{u@sUy#Sc50NLrzad`-|DJp&{AcoRxK4g0
zzk&Qs@<))rYgy6jtsT4)c`bNN@<P;aL|zj4Hsn>|?aA+lcO@SOA3?qlo<N=ge~o-2
zJdu1aJdOM~{8RE@;NOzpf}bG&7k-}n?(^=x`-40P{x5kOc=_c;&sS4;4f2}shUDeo
z&B#OHZOOIIF67#0IGkU{pP~F2)PK&nyl?z!ubaaJ<MKXX`Y+Doj7vV_bLa8KCI2nz
z&nG_tUkukiujBp3yX2AZ4W^E)`!?3yK|T?l`5$$TQ$7s&GvxK)zx+p?>y-a@ubV@O
z6<%}Rq5FzQ|K-V3;kC%q;7!Q4!Gp=O;GM{`;eE+-;KRuC;m?x$Omq910@v5U8#s^C
zjmvo{z}#jTm+N5#@(YbizWqK|f3b1Nk3&8guJf#ce%6!MgYP5{gzqO0f*&Iff&WO}
z5q_0C4E{HHINbLwZ!_MZ{YStnkw?MnkVnHGBA*NoA&-N1BTs-2AYT9<LB13oL!JbG
znLGtPkNhlrIr#;63VA+!Gr4b^yG}kMF9$zFUJ;%{9ti&luGe!{TyIy&pN8Ke*Xy(7
z+eOcBFzQ!<OMSV{^D<rkwaF`g;k+^VF!&?ncYW#dA><9<-Qaq?C83`I<h|jesLq>M
zcRcwa_{&r$5_RU0PlhigPldl{>dXCpFJ52P8<)9t!@f2fx6hN^#w9-k`3&Qd*Y`z-
zj7$Dw<c}DayuN;&G%ooe``!G{7?-?W4;RVx_3k&go|h6YyE=vBS(s0`m0nTr(Ceo@
z)~!T-1^w5BYyBM5X-<9t-iF){{d6_;WnXo1UiulAIZQ`C1C2{wpYu`VdLPA*Pd)GE
z5J#?c=8$WhH^}w;zC*6(C6!#y?^bd>Um4_k(dPm3ci}&huZLfO>v;*pod2eLTg<ss
zQql9iA9F5a+|Id@aXBw_54d?&H7<FbTRr2Fk48Sgxa8-epGS;K{s8i=j7wfWzj(s9
z<m-Lq`sr-^PXDOi$GGIjBj4Y+<ljd=(zxW?X1V%N#wD-kcRabC-xuI|UOLWjb!L%A
z;e5Se>d3l>(dSC?yAHZKDdbDx>&Xwocfz%wD$`w^{p8xu_f)4f>g16}z<;AU@z~eD
zlrM3}t?T=aw@L5N=T94WdGbT>YUIUmUK+x6UuoD^5V`i#k?O>teh=~`@Cd3CgMB?q
zJ{SHXc?x_sc^W*CJPZB~c{cnb@*MaM@_cwE`E~d=<c07v<P|Z`U&;O91>_;{lJC0n
ztLG&YUV*$T{6X??cp&*?cx&=lcxUo>ct7$5@JRA)@aM?0;Zw<v!RL_Y!k3a?fUhR^
z#q(hUc{%tl@`~^S<o@vE<e~7N$h*RSBkv6_B#(xdURCt`#=t9+$HME9FNHTHPlLCG
z>-*;+cs_SFF3-sccn)+oe&_j**T??G?>twLf6BPz_4O;txa2DzcF(IZ#wD+>Uz3bW
zej@Tyj7wf$zh)Vi{MX38YWz<B*zaQFlCS!;>*r15lGoR-WaE-Qm+kT?#wD+>UmMBw
z_3LA}-oFcGx;meepT+t5*3^-8r=ZVM<m=&Q$sar7>R%zB4F3zR{j7+0`MZ<7#k@mZ
z`*{GauP;AiU4QaYsQ(bv@rl1v*5`4`Z$Q2)`B``$@)t1w!Q|`Uqv6`WALcxnT>D9&
zI@M5TA$dD^64lAa`C3cvi~VjVuLs{p9th7S4}+g3?+w31J_vr3JO*B3b<y)X8D5?|
z4ql6VDZB}JGCY_(1>T7~4c?bL9X^aa2OdqH3xA3HEc{jSeE1UbD!5LP$!oyZlh=dq
zBySGiPu?4Tj659vBY6b;D)|`r-{f=QzV8+Dk)xRRKk}<YcqQ@`@H*t%;17|f!$Zh3
z;N8e`;X~oYi@84^FIM(Wdp=Rd<@vcD&*!n^-7dKN^Ty@R$M0(9e4=rw^CI#u!gUVU
zXS)1s%CA8FP4ZRn56Rz$uP0B1?<C&^|Azb^{51KG@O<)L;N{=<Ht8M3z5kK@{sXT}
zUizZjZ%y*b@OtC{@KEv)cz^QPUtRs7<UNs(A|C-COFj)AL%tOLBKZz@9Qil!S>#vY
zbID6za{a$fULU@c{Bii(<U`@f<Wt}uk|)B`$W!54$oIn2$<M$)BQJnwl2^d_I!GP}
z&nABo{vCM~{51JO_#fnZ;D3>?g8QTty`DG1%aXUa?9Nw3@?*$XBfkvyCohCIAooN4
zK=L~9R^)HNA1Ch!??fIBf0BGWybt+wcqI8o_$cy^;S<Pr!ehxZ;IEJ$fG;Nh6aFsw
z-|$W3SK+(J&%nPVKMX%iUhIlH?<dK%&-3Kk=QTJ#|BHQ4^m=;|^~)KT_uJLKaqIdS
zm*?$<tIn$%mwX@OA2crc3CK4#F8QCob#<B<mwf%-oVO+qgg*|~eFe;R`L2`?LB1d5
zeP+4*2$Pq7{zm`N<VWEz{YRa7l;4Q_67o6l_l(Q;`Nx-X{d{Cx`gscT*-E|(o?%?-
zY(kx{j7yydk^h!_3H(R6&a)oobCo;}{x^9%-1kFoG4IeibK#Z9li_v9Q{WGgr@=$W
zGvVFH^WX!>&%#HLUxvq!m%w%PGPy5&9=RWUIk{e+Ddf$O-#{J;-woIIIZ?Pz_ZgS-
z>wDB)Kl_c_`|dlcAA$NmlSjd?P@U3P_ZE3Gc!@RcylbB!a6h<S4>71;i}EicU*EXw
z>oM%Bk#W1PAmfssjC`<h$!niojLZF!hx?_Maj8@0n49My@{dq|lyRx!cel$wZ(Qmu
zM4c(*P2sP=bw0_M&l}|1;H$_Fz|+Vtz_*hJB)C2^;d;JSV*ZDWOaJ@O=Mm#}{wIw~
z{uc6Qj7xqNp8pq(Oa7tbuAeK$B|jheLb%Q+9Q~I|^+Mhu{Y#zws8fl&FT5^X>nuf`
zM=1ZwcdnlhazA)?suPJi1Ic6HQRK<+3FMpL)5tHtUxVxU+K%(J)VR#yYxKFoxIJI*
z8<%{E@7;da7?-@h{%#@H*VA;k&a)7GeokKE6<0r->g1yTQ^uvA0QB>NaohhT<C1?8
z`K!il|F_7s|9|1ye?|0JdaYN~JJhSdAAsxp3(<ca<I>M~^wYq2BhTC8eaOScCI12P
zEsaZFpI4#AC4UO}j>aY58})k`mwfpgH~)UdB|jYbp~fXY82M+6OJ48C=Zs4}5%~$m
zC9l^{oN>u-IN|z<H!gX7y;ua-`G;Ztt4v<%<YV1b^46%oo$92b&X<(GiTn}rrYBvW
zr>RZ^>Rcj^f!`!ghnM)sYuY<>Uper5$pc<>>(+ql_4Xj1hYgK4_Da5oKARYCWab%6
zuGe7)<5DLFb-EarI(i=alIwjm2(J6;jsBk@4~NH4o%7gNobkrqy7!%ObBH%?_w_ot
z?(1#iQl}H@yldR<>mzdA*JilxD<1vtB2R#SMRm&H{yJ{FvDeSD=;wrS=|?|5x<vjx
zo-@Cbe*?cw{vGC7a-CPyJM{W_3|^kR1H2}AS9l}x0q~aO!{P18$H9A$>wbrlKaKoY
z@=W+d@;LZ(a{c^t9(g+QN#t+AQ^@sw%O-Mt9v(K{z#I9Ld)#$<)cBqAi|gS8`91kA
zf7*CMuTGN|&VMv6b%K#U2iNO!0j|S8C_fnaf5|7nE2kB`PU7JW$rIqs$X|npk|)B$
z$lr&LAV2=6+wVB?FOi=@e*C)2&nEv7zKDD)>aQfvgr|~!fjXPWkD#C3<o?%OKL^MM
z!;g{Y!1Ks|hF>PX0xuvRiatxPFM1x!B42_0NAzEX{06)h`Mtlpebpmx2yaZ@9p0Qg
z3jQehOn3-+68s7Bba+?tZ{a=3e}{*Ym-)l(YcP3TcqDmS_$cylcr^J0_(byg@L2K>
z;M2+Xz!S*Nz~_<QgfAvPhVz?5-U-)93VD6_N8~NxACrFx|BQSLJd->gevmv7o=u(t
z|Bie+{73R1;Frm};(obKehvA*$nQelXG78Zs}{Tzc~f`=@~!Y{<j=wzkiP?OLB0mw
zk$f&Zj9j0egUH7t|2+9@_zUDO!{f+P@%&66{|EU*^1F~<O}<Q@!{iC@P2|4t-Q?ro
zhsh)1$H)i5FOc5@zd_y|{tx;6aKDX3uah?L8ss(L0pu;=t;rvThmzNUcOjn&??tZl
zhmgO3{510FH{5eFf&3Ek^T>-MznDA#{yuq2_$Kn+@XyJk;77@0;g`s-!v7#og8xJQ
zA-v3{qUUiPyfV4I?gx?|MLvjp6TA)iR(L4+PIzbXeef{yL-2m&_uO>naT0k$_$%a{
z;K}5X@Ll9D!L!H{;it*h!LN}YgqPl2bpBW2^~n7S+`b+rZv^j1{t*0m^1kp_$e)9+
zCI1}0nLHl8gM1nMQ}Q%;CV4jeJMydWYvcv+zsSqna`UOarRY3s!~Mwv;qAyn;oac!
zc}E@Z-zu)WPe00cMm~zXKYT3t5crGaAH%1UN5bckuYoTk-voc3JQ1EoJ`Vl~`3vwv
z<TKz`$^U`hAlKLB;#-TJm#>k(m;4O88u?Xt6Y~52awn!Oc|-UU<W=GS*V_5VcRlX^
z|4mbiPA16?VVJySWf6uQMmrh8q8MjvYg=vX$GdISq8QCFNyeG%P#I@3Bs)Yq8fS-b
z#tAENcAPLZ%+ZG(!Z?%fb?tgwy7qiOpX>VL`@Y>+@B8a<Js;QOdR^D+*ZbW{Cp->(
zKH(>WR}+3I`2B<@fH#2C`_|`){<nRm|9^A%cr{eZ@ciUehwJ;|V|E+;7Qz$%XZVNU
z*0&b-%R7nwO89>7aP9jveE;Wg*Ee$g!2M`_M}u462KXLB^!f0e;Bf7`1-_FUu6=Jq
zu0)4xedIQiH_72zACK|5$l+RlHuRS|T<gz*{%VJ7eHrxEI$Y~7hCZM0`?24P!R<I~
zy50115#enZpF0R|2VX&WH~7PZ_kgb>ycc{U;Q{ogjqtJH?-HH_zMb$)@UIBZ0q-Nc
z0DSm!Y7o`Sj!zZ%7{Zr<A4_-*cs${a;J+cf75qZN?S7d-cqjC;!0mHI`#k45hwFKA
zKjul1!`*p%gTuA{8|ZIxxYpl-`LopFT0iRpGk=ylT<d>_dH8_CwZ0wt)ehJCa@2o<
za651R3~u+!<U5S-OOF0TRVQhf;eU6y_8t16;q8P!fc|_y>K80E`Y#BNsxrKn@X_G=
zJ+I8v%l30D_$b2Tz>gw)26!Cd72szOUIjjt@M`eO3117INq8f8A>mEnHxS+qemmh?
z!D|TL2L3SNyTI2G9*O<Ck?=(DHo}v@-z7W+d^_Q3;9n8G2)vK*W#Gd%4BWpf!N(BZ
z0Ddgt&EWBbZvy`f;qBlT65auRCE?xRIfReEe4a~qGWbn|mx13&csY12;T7PI5?&4d
z4B>0Ro5AgIY$lEauM%#L51R?M$E6Plza4cxA>1BMz67`Hbkp5tUH1|F_kD&(G@1Rb
z`>Bs7@9i)=(&6rLY_!9*engkiM?2g-uEsiC>(7He=y0uX!*O-8!?pfS=o1{S^{u!*
zNddQc`;d1g;el$?&sl_z052wdEchbAlfmyGyas#);kDp@BD@Z~k?=<F7YW}4-bVN~
z@OKIC1m8}0H~3eC_k#aG_$JKfVSiDBu3mON-;Mb*%Heu{CE|QE#^HK@+3U%p9j^5y
z&>!b;t+&^c@ebGe2Iwa{T<hmx{+#1*t^W}EDGt|qd;NKd!?k|&M`oT}=5Vc_kNVd*
zT<b4{KFi@+Z?9KF;C6oYVmucU9=Ox^E+sq~{64~Cz#kzz2>vwT@!-vbPXm9Q@I3JM
z2ww@lgYbIr{{y%4WF?MQ-x9tKe4iK8V5yfKpJvoK5Zu;z4)g6WhwJe##P}cSa6SHZ
zzMbH3t+&5teuBfb-p-!{him=MsGsO?t-lBJ;e3Z{{i&V(aRL`PT<af({wl(&z;hg~
z>)eDoc@Ecg?0sLU!?k|O$HsSo!?oV7qgx5L=Zh+EJN^ZCnL76ozG#`@k2-a<??U)K
zOZ2_ik1d4vfxk(31nR#}_-OFY2u}dtMR+y%J{wi%)XV0o2OmjzBlzKjuLlnj-VA;!
z;hVtEBYY?LrGy7C&gq0Ff#(yR13sVdGVmpYmxEUmUID&}@M`cU2wxArf$%2qR>E7r
zHxs@M{NIE}EjRP(b8x%f-@|&}<#0XUR%5>PI$Y0lyWWR1oBgiqX#Hm&oBG2XuJv}k
zk8-%y$8R_KF%H-Ir?5_scDUBt-~V}>!?oV7(|Ct#{kgcln(T0`e-ZW1A>6Lhso-`#
z$KyKZa>6HLJTnPT052pw3H%1aQ^9X1ybQdC@J{fD36DfS*AYGzd?Vor;BAB_g1<|6
zGWd4FXMlf2csY0<;fuhBzo>SGdf9QV1Rq0q9r&??w}MXqxAVCX=esirZvvl6_$T0(
z6aEEwF5w@7hX{WQ{6@lG1izK=|AOC5xb5eIgxh{L5dH(|JV&^FF8w#c?S0Ujg#Q}X
z`Tru^et!K4;db5qm+&d5^8?{_eI4|Y+3$9L9S{9sgxl}u98b9Y9?oRK?dJ&R5^ldQ
zbP3`1`$AcSPe*_93C{$dM|dvyt%Te0Urx9^em+3B9sf0i+wp&fa6A4l5pKtM6XDCz
z&#i>p>%&fPyB?$OF~{dGiT<dc4FA#L`gr>)?jLtMTpw?3uKoYIXTNLx(Vv()BOR{w
zcH9ngxYjR*{z!+r$N%vT*ZOa|P5p@u*LpjiXA*Ar%T&Vcdby17kL-0OxE;5M8sj^Q
z=<R;VC;GsBMnB)t>*tUmJcqp5;X2m`7>6pt$9-z*+(URV_-b(5&u!ShPZD1J2UDks
z@FeJ8C-pa@{uaXR@8|qTsMACAM}B5}e;|Accw~zTuU@wQ1?bPO!R>X(_0R_$uE(<x
z<2lLUdOVjye<tCr;8O_y5j+*#_NNB>{Tjl1(a$1MXENsJ0>ZBXuN3OsNA$Nqznbth
z;7>VRk3%QM;dzJaad->*SHW$rH1vN9;bq_-5ncnnlki&b9|*4lANn`d31|N{fgenG
zGk6T)t>6;~xAXi=!n>e9pYW)A`@0dCL3jap7U3cABErkTZzQ}Lyo&G|@cRf~3H}J-
z>%pHUd@Fb};T_<w6W$5_9^t*<I|%Os?;$(_$Bmx|9}B+!%LDgs0{EeXCxXWko(w*T
z@O1FA3C{$-i10k{G{P&ua|vGwUP5>?_|1g3fG;Dw4g8OUcY?1WybJtU!gqqV5N^*q
zZxTKN$EEiPp9cOJ;i=%e2u}mw=aqr`F$6x6@G|hj310*rB-|c9PbGXU^yd-Y2!1Ky
zP2lN-w}a;sz7>2v;oHEM5WWliF2b81G{=nx!S_|eq^~zl!}Zc*4%f%q9bXy!lMdH<
zd%dy2;aVTpWAqyxuJ!i1_wR(;@6WvBa9w8}>ipB;x{ke`+~IJoe+v4~9Io{(xSssR
z;aY#fe@#EXcevKu&k=^SsyFIo$H!h5?GL_>+N>2-tNLYuLkVwRX?W17qkX5rcM{=q
z!Os@zTuStRgg%Y%m%!(cI+5sSInjR#{qKoB3i|tre)!iWR~_LyF#b=GI-^nNMWVkH
zbzUQUDEjj@;c?J^Na{ypoWCG^EO;;BvEci?YWA<)kBQ);2u}h(itrThIKs=p&mepe
z_*B9x!7nF#C3q&`b>M}BH-O(jcnkRLgm;725T1zr^)TT{;Ohua0pCb?CU_g+IpFUS
zUI4zG@JjHVgpbDk$dBN5o!ak(4t>q+U(NNpv%i07e~0V!Ztvp`CEOloj&-=MQ}Vf)
z|HnIA*RkINImO{xzXkf!9j^5~xG$UHaIKI0kEwsY!?oVt_g(IAtv?a^D;=)&_WSnP
z4%hlD=;t_G>+SJ;0k~Zk>sOfmR5^NGrxJBm5dIkWLxi99g{jj(>UW_2b3}hI^sf;8
zHt4q!eGhy;Ci+h3|4Z~&q5hAAF9IL(cNJ2->^O9xP87JES3g33grJ{5^v^(l7UA!L
zUrg%6W1e44cmntw!e@Y&5uOHq3*njI%L!iu{vhGC;0=Vgf<H%i2l&f`cZ0u8cm&3I
z8{v`QpA#Mh{vF{#@F8sj_hTG*6ycM>k05*+_;|uI!A~cA8F(_`b>PzpZv?-V@MiGq
z3GV?fCp_YQv%YR4d<6L2;PyDV8rMa&gxljlJ>f4w-$=N<zG^1iUPrx7_?xKnG2vUm
zKPUVH@NWs<0sa%=_V1NMzHaur&1?T2%4ovBM4fSje+_;z;l1F~2=4>GobaeVvtQB)
zKL$LH@L2FN!kh5?{C04ATnb|U-beKI?=L*;aDCj4-)Z{usKZZC+@1&j>~O7r2Kwh5
zuJu3S{Pj17YyJ8EXX?M|aILrJqs<Q2di#4t-gUUv@AtE*^RdIV{*o^Z|HR>1e;D-t
zb-3352l{UvuJtEEzt0=$je6PR`DwV{+0WrxZ?6Xqa=5PF0{tNl*ZMP1|7gPPeMAu4
z?#J{8O|DZ3FT?&lkML^nO9`(5PbYjOcs}84!RHg+4!(r&t>D#!Zv$UN_)hRA2#=~Y
zc{dPV4c<z44ftllSAu^?_<Ha!2yX)KCA<ZEzkitdVE0Q8_$b16fgeS9A9x($qyK2~
zo<Vpt_*BAUz%M5}0X&oN0`Nk@E5UCdyaD`n!q<Y=5WXJ#VZuAW*Ad<YzLD^q;BACQ
zK48Y@UBX9zZzp^-_*aC-gZB}h1U`Jz!2O#FK8EmW@M8(D2ahLwE%<K;Zv?-P@Fwsp
z32y_>A$%wJT*7<6Zz8-G{7%9nah$0oJP!O(!V|!sAv_uUuY{+8Zz4Ps{9lCUfqzPP
zCHOalSAhrK9Jn8=!GA^gTJS>&-}Wan-;M*f*9px(89vG3<CT^D`*f!|Tp#D{_0qWx
z*ZNJprp|92uJ!i!Dol5{)_(>4OozMYoh*lI{bfIx`ne9*dV3!_*Wp^f6#97%*Lr(j
zc?;pc!TIYh!tMF12HYMeo9j(~9ws~vd>!E_;2Q}~2X7<19Q<9vSAuURyb=5>!rQ_7
z2;T}m{4F&o>Sc3n10O^9PVi$1AN{BqhY8?zUIlSocPinNz>^3+6?_`uXM)cl+}6n;
z++Gh~N4UKno)2#G*5Y|fCDEs0T~s?<&#MwVm#cBOo>z8V)Hz)18=$XuxYpa}!;KEt
zdi#4P);nD5?e$oT!?k|GH)i}>9j^8E{-xdFTAvF2R)=f7y|3wXxYqv#`YwlSy}jS*
zA>6K)K8K&E^f8g9pZmS7-l&(o{wziPQQ&sJbYj08L-gCAKaubi;FC$6F4Q@f=+EC}
z`g4h(zn18KM*RZ9k3pTqq)rcfml8gDweh{5@M!RQ!ehYyOn3tLON1wa|AX*k@D9S$
z!M78h2i^m2*YzT-i#~_zd18NmMWB7p{?+ru-e-+)xYqB)xJ5Z!>+OBkSchwU%C~0R
zVjQmZ_C71l;aXo0eZ0f9-ri>=I$Y~d_|DW%a=6ypbvMo7T7N(EsSekAdmc$A+^&mk
za68XaA2z-Pghzlcbn0l|Ech;Vxc0T*b6!sBtjB(Qkno-04TSfAKSy{k_{)TkeaQ6x
zZNg)~w-Fu$|D5n?;NKBm06t{13aMUp+(O_{gqMRKL3lOzc*1MIPbYjOcrxMZ!KV}6
z4t_1+o#59K-VI((_)hTK2;T*MFX0h&{lgM?i0~lzTEgSN|3dg=@Ye`W27ia}Jn&A!
z*Mk2a;f>%w65a$pY|Fs?+YUaO@U7rS6TS_6BH_Eh&muhT;XwZ@g>btbXA+(U{Vc-M
z!HWsc0bfLT8TcK9*MhGgd?omw2(JfkBz!&ii-dQ8zd`sm@P88C1>Qw?;1M%!|0O&E
zd^h1Ezz=w5pZ<n+{RY7gAv_KISa5sZc@XEFlN_#(hxYfkoZ@hOJhazi=Qv#JdvN@m
z;&83E_bHb;T<Z`1-sHX9;aYFc3mFdA`XRWl$#%Hb+xwJahiiQ*^ra5hdV8O8v%|H%
z6#69&*Lr*2xtnnN_a#?=+wm{J{oq4HZ_iU}h`ts2X9-`6{nbKvJNTP~cY(i8cm(Qy
zM)(ZyU4-X>@3U2fS1+5Z0(>OlmEeaHz6?A__)73o3Af{L4&g!E2VD$q=j{iWw^un_
z@5iTbe|n9>^?tP1OZg7h`r$vCd06Oht-ttZ!xuVS>o0?TvBS0A&ciz#uJucyzsuoT
z|9jM51#ZVV9eJN1JO_LO;fugq39kj;O!!Lh4+*aa|AO#l@Ls}O!1sGsg;6it|2FVZ
zgm;1;MR?R2GtO~@$AO<gcoO(j!b9Mf6J8B|4dM0R*Mr-6wHxzlfy4Xf753we4tM9(
z?GD%a9njzDaIL=+`~7~0YrXy6_=67Ddi#0JV-DB)OaEua?Ma7g{oSa)!Qoo}4)hxx
zuJwO_{_hUg`k8n>@DGP;{R7bd)8Sfw7xe#jxYpa_?HAy7o^)aSdkNnKzTbPQv3gnk
z=*LXnQG_RfA4PZ-cpTyN;AarN9(*d{?ckRaz6(5)@Uac1pJm{7UX@_n785=b{2qso
zQ_<U_Or853uE%pF^s5L@=>Ha(`um^`KVInz&Ng)(b-1o`J@k)*+i^}r|DPxNyP$uC
z@Otp~34a#+3&J;me@%EZc*H+d=hVxN+biHvgue$qiSVg9h<cqt_$Sc+mhgR`pHBGU
z;MWiy3!YE-3E=YxPXfP{@bA!{rG$S0zJl-`@TUkLj{2>HCxZWj@RPv*N%(Z|PQo+6
zzb1Sk_-?{`!H0GX+>bYdk0Shi@FNND1RqcMF7VR{e+&E^!tMULh;Ta}t|a_L)X5{f
z4!o4``@nA^yb}CQ!k2;HOZc<k4-jtW!y3ZZLElXH%i#Yad<Xc4gzu*pntJUb{1Wg!
z!pDM-{MW$!dp7uCgdYb!j&Pgnbi&Vs{%pce1ph7JzXSgr;j1D{|8fW~h5kCitH48q
z*MZL`{4d~(2;T;NE8*XPR}p^j5Yx})gii#oA^bw{2MEsruOoa3_!`1jg0Cg~Iq+u)
ze-pfk@K3>CB76wOzm@PKz~3PJbnte<r-Q#ocnEwO;dg-VAp9BdZwY?`eAxQ~=kurF
zLBjjMCxh!{6>XaKucPyb{@DG@#!DRi@csIw{r^iR`kBz@5Pl(ei11YK#e`>r-vO@s
zd6?7Bdx`!o=vO=X6Nm2U=VL^_0s3bh{aB}dGtvJC`Zh<O8L_ASW}-i0s44cLqd(HA
z{~6JzLchz=XFK(OBKjrJ5C69*s>kOT^<NCSbR@W5w)%SMfMM!?>NSq=`%vd(!XE)Y
zoA5^P3kkR9$14bb8~Ry<ZwD_T{A=(V2p@v}-%0o?=vNTl3ciZ)jo^PK{5kNy5`F}H
zUn6`H_&eZw{Pjm!3-<3H=0G>mr$PTM(bqt~|2DIK?EbnH`a{8O{q@kt5&d(}pGou|
zKz|X@cSAp&@GrqL3I7IsHsJ?Entm4$ek^zi;irR_6MhN!O@z+|uOxgi_)@~}0k0<f
zQScRnKL@^&@HX&A2>&;D1L6MxUq^T^_<F*J4>#lX0^vu2w-9~`_-lk;0KSRvYrwY<
zJ{P=$@ZW=fNcer=U4%al{w3irf`3c+JK%kU?*t$A!NB<+*x$VW72%`64<<YoJeKgu
z;FAddE%+3|&j-JV@GHQt1lQ|P_t4&N<`R7i^dX0jR}C8RoT1F&Cn#=@w>LXn>wkcL
ziNm$N-~jbM^}5&L`t$Tue4hS*!*!kW@LZ??-1fio@%}P_CZf-U{xzac!~OL;glB?x
z5?%rRe}vbA|44WP_^=O6KHJYm@X>^C0zaDYcJPUWcYvQo_%84i!s9VMGYOvzK8x@~
z@M6N#!50yp34RCRdEhGuuLA!Q;oaa*f!p)Q?=TNvAl#nE+X=r8`fY?S1pl0Hd!PF)
z;me@k=OeQpZGY|sA4zyE_@RW`ejZD>eO?hy_|vG9NcaZu3&HKYig?1z|1_fi0QwAv
zk5^Huur9J4uGgcz{wZ>}*1rUOiNm$N1nYOP!?nH_`db{X^)_!cxb1%m`u~KZ*T;d1
zNR#UshwJ*4yA9t+_}SpCglB<o0k^)1PntTP5&hxNe@paZ(a(K5RVUQT)`<l_knm*i
zv4p3CpFnsS_-TYM0-r*7EqE&7t>D)X-VS~p;oHC$5Z()3Nq7Xt?H<Bo!B-O=2mU1C
z)4-o2JRSTMaJ%k)+~17*TMpOr;W4{^9j@n_Js*8c>W5JOOTx>+|3`Q&c;v?e_j@z=
zA%wSpA47N>_(_C!fhQ8)4SoUPJ>XXmK4Ptz&)I~>gNFz&2VYG1BJibzSAyS9cs+PM
z;SJz_CcF{+CBoam+X(Lje-GTwhr@9E`PkulK74@r@QK6S`OxEVtv?vg^LIJiJzo9n
zaIL=z`XSrRe6anQhyIKL-$!lMiiW4meu;DR`uNs}<J%by*Y!_B{qsqkUW~&G!UL$E
zMR*K&5#h<;Hxix#UPX8+_<e*IfImWb2>fZn%fXuoZvuav@J-<F5xy0C2jSbmdkF6W
z|B3L(b!NZpzeDe(J;(DP_@RWyfyWX)8GI7qso-Z5J_GzB!qdUi2rmbpMR+xM2z*}^
zL(khOn1?qyT+gdTm{&JD++7z-9j^7yK)>AK?z&h7Zs&RW(`Gz35MI$}c$-s4*PqzG
zIs$>sgm=UDeZmibzMIrvi*fjt@b%#Pb}2LUvi;l&ejwq!;A08z13!WA2;@DD@EGtZ
zgvWxX5*`PB4dDgg*AZR`zJTy$;FW~01;2;z4)E24Zv%gl@GkHs!UNd9uM!>szJ>4+
z;2#kl1m8(`3iuC%r-BdtWZ?cS06&=UD)1P>Yry}C<FTD5X4a}_l82f<X}+(8>gUYE
z_Hf;U_$lW7;c)}`j2q1RsQ7_=*DdD#gi{A{`|q*7oivc!`}ENU_kTVcG|~G>G&t@5
zWI>-m^ypq-hM-R)`b@kp6ZGXoUyb)Qg1(mMTkyVF(A(`cZxqI&OVD?NTYV<<5%{T(
zpYC|#vDYuh4San!5G&|yTU$Q~lO<Wur+{01BlJ0fK9A^QhL}K=g1(CAtD&zK^bJHG
zz_a^SLElF7A?UjVeK*l}LLY(LVdD>O$0rq^*~AL^Aknu#pDgH8h&~>lwd4r;Jfg3I
zzEaRv5q;D!v%l&EeFM=~K;J6p+lamg`Yu7=P4t;K-bG+ugpEJA9shRdV+DPX=#z$<
zyvc$-h3Ffh&k^)_L?5$1=D(n?BKm6R>jixS(FYDN^;-pf8_|cL?-KOgMBfR01lB>=
z_=DT=PaR?U6D#P0MBf5^vY<~P`uJa&`Z<C=kLc^5uN3rEL?1QM)UOxx4Mbl7eXF2v
zBl;fby99kV(PtiL`V)cUMA-O)+wpIQK332Ni9RXH)K3=lDMa50eU6~dBl?(wO#Mnh
zUq$rQ(ANw42BHs)GWA;peH+n-pzjj&-9+CBeFTo9VdD>O$3OL8)1O#DA0+w~=#vF~
z3em@pHuZA^eIC)*L0>88tB5}85L3Ti&^Hi$1@x_gzK!U6pzjj&-9(=`#`Grw=Z&!O
z2e;$j4t=bk4-$P6uA7queG1VxLZ2h(^N2ns+VsCt&{q+C4fOSbzJcf?er@Wv3i>vp
zFN3~I(03Dk7xWQ0uZE33xE=o)xZj8s^g*I;g+5u(rx1O@;U;g6pwA=v2IwmVeHGD1
zk2Uq{1$_h2S3%z@=-Y_C7y2$i-%a#+N0|OZ;JPDh{K4(`cR(L2=z~O`a-^xBEa+2+
zz6tsqL7zwT!J|z5N<m*m^tI5}3;G74kBl+(TLpa^(U(KtCFr|}z8m@oT$hE7Ke!$L
zw4+UbVg-GW=-Z%A7W64ZpKy$+pCjn=h`s^(N<m*m^ka`T_3H(F1JN&ozE#k-5q%%@
zU4p)w=nG;^e<E-l8aDpmcKo+NA1mmCL_h5~Q$JbIrx1NJ^f`h)kLcsZnfjH2zKZBq
zLSHZF8;E|y@uq&Opl>7kMbLK%`fj4%34H{v)5FFe+>U>G(DWx(&<BZr6ZFY~K85HL
zPcZd!1brUSuZ6x+&{q-t*zu-*y`XO(`eo3!3i>vp?}NTe(03Dk!HK3n5x9>D8-H*+
z{@b9B74$)(pB888Cky%%qHl&iN6_aHef$Jdzf#aw5q%x>^@6^E=%Xf@`mKV#jp!?&
z?-KOgMBf8_1n%3y#vj~{f8I%^Ke2*7Nc0`hCky%%qEEpC&>TUZNAyk5R|@(nq7P0o
z{jV4F4MblHeXF2vBl^gbP5mxG-%a%8&`03DHf;RC?fCD6K332Ni9Y=l)1PEPpF;GT
zpwAKXc|@N$+0?HT^i@Q^7W#TY-$3-8(6<WuHlk0(bNntr-%a!_(Dw=Y0G<cf@!tgf
zSa7<(Vu(I)ni-!&L2sW=*!m&p(*=Ddsox3xB0*n4^rKHV{aGpK>xjM*`es4jLiD?!
z-zMlgi9RR6^ruhI2k^Yaj?Y%;$AX8AKhY<jf$<mgNkqRM`gB2`N%Y;&FB0?>M4xu1
z=}(QIuO<2l=+_JSCZg|weygDGAo|R+On-I>`d*@Mhki7k8`1HP2DkewDbduQEa(%6
zz7hHvf<BGtV}4`mmkIiEqOXR&M$p$1ec)_Uf4!h@BKi>YTLpaw(RV_>OVIZceIN9r
z@mwuz{K4(`7o3Cf7xW24zYY2sf<BGtrzK(h1${ZuH$z_|=xZH4J}T)qSTE?C9KHT%
zEACv=pKXG^lju{=Gx|P3AHefPJDx4j$AR1NkH&lZ{L<>}=g~6+eHy8se!l5XfuIi&
zeFgM2g1(mM*I#JruNU-9M8668E<xW-^zGA3{Rlh<rQ;I`ZpWt^`dC39B>KR`rv3~;
zpGNfE(~Z7N(3cZ^;4-7H5%jf09}Ru0pl>7ku`^8lE<xW-^pl|<f#<$-Jfpzvct&4g
z>Q5H*2}ECerO~Ggdi#9Z){np1=qm+%6{$Zu-RRc}`bMG;U2F7P1$_t6w`CfApP&yM
zYPQ?{cV(ORvEXz(gGAqxYxL6ueJauKoNe@Fg1(&SL-|I(Qqb2CedcvW-zw<ah(58v
z=ywYG9->buH2Sf4PEW_jKJT~Vxv1FalLdVWxYe(mYxHG;zMSYMml}P&pl=}hnsTGx
zB<S0TK4+oP+s_$n-X7>8e{Htg{@d>n#eq|OJkbYkH0@^y`ZS_XSY-5z1bqe3H$Y!6
z=o^SWYO$%`Ea+Q^J`Vbwg1(37*WPUE#~o&V+VP3T`*{4c<7vNtWj|M;`ZS_XT7vNr
z>Q@kb2>N<K-$3-iN>hK6pl>JoZs@xNeK*lZ+-B<c3Hks&&#~hZ4SgIq9iMoj5B}cN
zPZsnkL_Y)ibU~j<^p((85`75otB8IX^eY8@9nsf9zh2Nc5q$&n+XQ_l(Rbc%#%J_c
z^V5!}?Z5qe%#Q!2r5H~^p8{_6&377onV>Hxdi(FQuN3rkM8D~7Q-7<V?;!f<dyKwM
z&<Bn%+im~tzXKHuPRA!m^!DG&m?r2`iQfKud1ZpWoapWEPp%R4wM1`!uWYlRZy|d7
z`v7+e`W~XUzvq1Pk!IZJ_(X%-@wC6UEm6=X5xxC=T$NOh_f<r1zmK|B&^Hpj{d;O#
z1$_t6+rJ0YC+GwCJk#d2e@`S9{Fm`Td;58*)!XmS<744pzUOI1SN;1W_=DA3UL)}L
z1s<bs4%Lg+nJw_O0{>dz3AkCM_3sh5{XQYp{~+iu8^ZVhHi5q&@Pi}xIt2oMRp1Bg
z$Ja>`_#XxSk-$d}<?9y;{8@q1@7tKFfxx-L`1-dCyjkFfknc0t`o9x+wZK0Y_<6(m
ze$ww1Sl<@~{h0mvI>iEiPT>C$_>=?q`YQ##UEqg~;Om40{<^>qB%gEH@kti=DuI6|
z@I>-Cj;%je;BN^0Sn_#<t&=bC)dK%s;Hl(!yRE-M;QtVKEO`!W>ns-dD*~s_lWm>p
z<T<D1PYAq6;Kz~Yd$!I^0{^GLk08&rY@N#l{-nU|b1-_GzmPoVvGs2jc!$6zk>??{
z&H{nk=P<NC`;q4Ww$8NzuNU~g1b#BP@3!^n{l4W-3HqVre$(ow3H%m;|6SmH0zZ%3
z$64P60;l(hRzHT^k63<@!0QG6AAui5uK#U)df#FBOM?Czf!phRI)CmZ*U7g2-vu5+
zt~0HEw!j}0_%4B;Nv=z6{bGT)34COXX-V@=5%@}hZx{HXNAvYV0)JlMUkE(;7{2~e
zf&W$D(Z}+2t`+zn1in+?C&%*j=Loz-;6sn&>zpO<8iBtr@B_#3_45S2PT)HPo_IW8
z|5kx-5O`FOuXBaK?-Y2Kz{lfzXLMa;2)s$)y9IvAc)tJk`)Jg6i=ZENB3~y{;A;f_
zZ-Gya<Llob@TUbHIf1W}CGZynuKq%I|BH^#sRCav@XrK3;UvEPEP-zn_&)J`oznz<
zx4^pve(of`{_O&97Wg42^L2^@{&#`LoWj?cE${~gzDwX|PUh<u3%pI>BTwb)OcD4>
zfo~W1p{Mcn?f0JOynSBKe<ASX)A{<V1pb}C6BGD4a|Ql}z>htHuahtE)dK%s;HhWw
z^&c1bR|1bci?6d-;I9b0SK!kV`T9=?e8_KjeY(J(6ZroG9)C7p{|<q_E%1nQ_&V1J
z{CR;Nn8eqaDe$EN-y!hCbNTwW3VegWqt4^&Tp{o~1>Pm_@l*Kv83Jz-_-=uplFZj%
zCh#o+ANE_mPNu-u2>jmypFEYXe}llE7I>Gye{()xe}%xe3H+cGzRq<5Zxr|^0zdl#
zzJ8^^|03|81wQ#gzW!YTe@Ebv7x8tn1pb)7w+Z~zX?*<~1>Pv|;TQ9DW(j<wz(-%g
z*ST8YcMH5*;744_*UuJst-wDN_`#`s{i_7NT;QJxJZU;#|BnLyNZ_L{<LeX({563e
zbva+BT;Q7pe&`Io&NP8PD)8L`zj7vDf0e+u2>iq=_&Re1zDD3b3q0*gzW!=~za#Lt
zG`>!Wz#kKM;3~dOioh2O{5^q>y_&B-UEog${A+<9|2w{Zg}`4E`2PexBb~4RfWY4t
z_#xNubuJY6p9KE7z>mC^ufIUxFADr?fnSut*S|;LuL=C9OukOJz&8tgd=_74iNIeM
z_-=t;Ig78qO5j@requIXXRg542>fS(pP$3mUnKB%1wJvCuXDS=I|V*&Hecs=0$(ri
z9|eBW9KL>)z~2)1kUYLly1<_k`2PeRpU>C7L*Uy59=wjPbB)0NB=8P_Pr9D3zd+z?
z1-@SaU*}qZZxDD?Az$YTf!`_cE`g6P;_GJ!{853wFYr@}`T7e5zE0q~1b%Udum1;u
zw+Z~{xqO{D0=M74rq9{73;IJ#`1-dA`~`s@T*}ue5co3!|4iUB%lP_B1-?VziSzh6
zw+eiNz@z5#b@B!Nw7|OrK7IjTe~G|f7x-?0Cztc}7YMvv;3q8P>l6#TUf@3o{E8d+
z`cDh|TY-<ik*~8v;I9jOx4^Gl#MfUX@GSyAaWP+KuE5s_{AYou-Ne^lE%0{)e(ueD
zo%sUq68Ntx_&Oy5|A)X2x`nSZRp1W^yjS4UZ{_PhA@CtfczwFS9})OJ1s-3?*S|yH
zZwuW1eFb{HD7lTV|CqqX{hrsC2>fM%kG!3)bFIJ|1paS<kF4VBpDXa&1>Py}ad+_b
ze<$$u0{>Cqrh54IoFlQp?nnFgWTONgO}PDgtT7JX7k}12f`rH5ePCkg!osqwS?Xt5
ziTRml|5TD&kTtO^x4bMcvHy?xMfqj!`;y|Etg<Y#F(YHvyg3=FKtZko{Tp;e_s^3i
zPO{pJ>$6L;mH5Q`P*z5EaZyojc3B`J<9gGV4An5dXin)Kwc!KQ{awmXZJbIu`K7kl
zFPojF+-9eBc0q1dNk(o_PN+D)s4OE#rC-Q*VNjt{u_U)Nx9pdSY%NLRR8ig5!#a2!
zS>#m8o;@ccH^laXZVGFaQIv&wpa<O<Rnv0d=J3{eIeIRrA>~^S*vz)h_+=i76$VPe
zs}vUJ=*cN|V&L}h_E~f03>sqK_VD&OxdRp9gGd$OHA;%-l?@t#2*NAm6&I-0E|0>%
z?cwd!{vNFPfX(5p3v<h|^id<DFst<X!RiRY@QS*>8M78<WEbS;77aQ@C1rTc?6Q)A
z!8$i^yVE`^CnsaTTz2+x*fyt~I@pNq!nQf>vWp7~^UK7h+-9e>IrvEZWwttP=cpr_
z)G}<F(=IemZWp%AX_s9bS|}QZZ**E>+%rNY#n~CzW##OSl|@b^?1{lE$s(tcwks*i
zD4ExPx(q)evD=;Y+GMcy>~^O;CPs;{Ud*g=w>oXjyl^)<lRSK*(^Ah1)$6iZ{Nmy^
zJFWHX7^F3~*=ap@UT(=k-9Eo4CzqcClEkS}m@~V-h`8f;fm1>6+1Ukq+4bQ9r-I(M
z;R0tL@B*hoe<uemAt;<0m_e!vyPmksPHQtwq{hrvw9P6gD9+9*%hi_~>I!Xses=iD
za8QlY2VFv6(q?2A=CB!f0jZEvsIFiKDG;`uwpV*|(Drn@)4o()tY#FJ^5^65jZVvw
z+&THBWw|98p?L)bVu?XiPOY5WL39JA<sdqz-Y+V36+WBYF@i#>G4Q(3>Cu2X1658f
zC!g3OQRCFn_X7F?Fk|3#rqdrmL2As+F3K*<P`4==rTNmXFUt^Aq*kfA&r-J*x>!if
zhQe9-h3tsyo(-yX>Xwyf<nT8cWD9MRQ8<r3G4!_^xYcPpyCgR^qx5?IqBeY^(^93H
zr$%vMX+|hN6n-GlH>Z-ssZyqH8*_>m6b)Wz5S3F)_od&G-wWYeNn7h8HV+q&3iCqh
z@;o<VPHDcn+EP#dxjO~jOHt?4!_9ccf}DJLgk_OaY0s_u;Kc^jIrVaj`fsTR?U<->
z>e$=vK?}(ur;<A7%`40uJe{a<>Xgna4e8UupgodBP9=RgrmK{eWtH*sKv0kxrG>eL
z8LI1LCF(Y<ELSci3!RFyN{X{`va?D}-{#IMR`-%6xmnqH`ofN#t)49$k9pbs!F9Zx
zS)pH^a1D6uA!-KJQKy)UlAMK8&SSf#iZFtK75YytgV$gss8W_&mX|TBBtK_PZvWLz
zSU+R|Q(@2g8ng~4W2#9H>)bAdX`Io~XQe@I`?<|dYrT61Y0YhBTdPB1L4FbcFk?@V
zFqKnFUnA-((XcVqXQ1$nq@_7diEZg-(i#URv3b~b(!O+IQFew};n^YnVX5vut08r=
zSdnvaqzmyPQb{eUz4V7skQzDqaHT#2<<5S(BVpT}_Jw)*=Ds4gXik0+e_0`FoI3Wz
zsI}tti7av|?OBc)gBBZ9=hRzJlCLfi<`!m!GV=LjuAp#g==)%GIh|WlGB2c_2xS%J
z6y)+xSNEcHYL?^{7SGp*IiIq77Z0dhT2@@5E;Dg<9jw3lR5z&BsXHr6pBm?6<jgDN
zFPV9PQ$ZhLazpBIYAB?x<=F`<Nt`PArTQeQe%T&3;lnpNE!9)Ca{ci2`i%L-!jox9
z!d97A<WYx;oJu-u-hzy>g~A0ryWMH8!kUu;=48hFtO8+@?@j7d)vhSJw>>4vNVSsw
zYpUXTCE2+dvrCE#r4M$r^PpN%SKpi#X7qokQ#h;txT7C7vGYQg-kY3MFDuC^Dh(Cu
z$9RM7AW255l@=Dx%g8A%%*rnkJIHFBIyk>&sP$8tu^_8Re;iq=j_=|}HGT~o2R%&Y
zoH1YQW!QG7z51voH>=d#8Vojh2Gu$Bveimghi`ppKUlfJWKK1mPTwr5V^Dt4>|!w?
zt8wb6V`iwoP_{a@7Ul8}0%Va>N%v@eZb@l=vAQMi|0G%Llq7Si?RiF|uEqL~kr~<i
zqlUdGotpXTk_pQkH<{}A$=?_4P3lz5$^E6Oougvey=tAhd>1l`iZf=Zhq3&1uXh{A
z$DUi&`O_TM26gaIJGF7=Y)i8fLew~Q!d&%LD_d<ZO1Gw(uO+#2=jE5==IEzzv-Rgo
zv-5>dhV)I%Uer!)y%zFA*%<}Jb7sxsAErtYv5G3TfQ>w`(m<J0t)x67R9wI>@UU%e
zyWH%B>N^_!2WjbXUx}n~>gaBU)Mp1`hJhQMmg+o;qvGHbX%N}KYU-1kTy-ekTQyNO
zu$sP5&dJqJe{zem`Aa#KKvE4>tN#v;9j~y0L^`l4g6zGMg9ry!)Js8KZ|`*oWgV?&
zPPTj7CH7<+uA}wL2QAXz*^|be?E~BI`Cws>!nr9{!_O%O*3gHHy&hLoC0RGHUQuyb
zzWNwceZ&`1(^s8lrLGMk99S{GC@Z@xe|~=1!i=)~LiIs}_%uXyb1&k(R1UjyA2^y}
z#l!S_sV`5oy%@<2_v+|3Wy7NJb9myOFZE5-yCGYBo;tbzPl1WEO4U`0{%E)Vn>K3q
z=1x5Sl9?0K6JmQEFfk`re-Y4J3YtG>&6-tWkG9yXo|oad2*B);tU^Uh19j16W|UPI
z;}nbc>K<Z_dW`)4<)yy|xsUp9D5;i&_iGymZipE8HgLFluUQh|4GT=g9{fVuRP|*{
z?PI^^X}`aDqGFu?PWZ-<y3~K1+RpjcUT2(A&|dowQGcfXXDO!r-S3L(CQ*OZ|5q=v
z!L~OW1O5Me7U$my{|;@cUfO>@_0zVu`E~zT|7UfpK%j^07@B{I(s2GwMaHQ`?;!Qk
z{=?Ky>aYKrv-Uq({WswCf_Zo5=mE4}tBG!-UzzGZuKk&B>8*jlcPE*j_W!n>{i*+&
zi~chi=0N;z)57-Gwx{p)Uti+#moGI+JI*@)0ZMDzTYjfvoPPrRhw4Vo%l6x%N7Ns<
z_DREy(tdy0>aD+hze@dq>wh)+9}l7K|48*`+urv7CB-=ZRQOvx%KXyazW<B*1Lxnu
zjGxY8>skK~6yyBUJo9%5{vAyIQH+0|;GgH2|9ind@=lY~=G5b_mjcayoC?q74|(Q~
zQH{CrkAc6t|Hm-?mk9n9p7}2j{8O3ydMs%Exq^R{XZ`}gKaa_O7~@|f_}6;ozgzIH
zW%7?@{Qn~O*Lmh&FZeey`Hy7$KNS2MJ@fxd@b6^u$1wgs2>wl;`F9Eay-faN82`~~
zU8)jc=Z`ke{0FM`-1-YH3t#`SjQ=Tuf4gV?iGqI;{N44huXX79yG-!!^vr*;;2&c0
z2O0mlf`7MX{sO_jipf8o@vj#Adp+~tDfl-r`QsS>X9fSj{(4rb>&X89@A;qIf0nEh
z{M(uQ6ICPI-kz7<6a1s#Z}rxXzTYhP2ktUT>!Z(qdM?`bmVYPsM|<Y~uizgIe|P@t
zYgFn#MqOWX>p$q3{~*<#TmLCc{>hC0X@Y;eXZ}foe<qXvG{*l5!9U3}|8&8>n#rHQ
z_?HX*DW3UD1^)&n|Cx;c1A>2=Xa4&H{|+X9BICbN@Xz$j|GePe!{k4k@!ux+hdlHD
zQ}B;j9=`sQ82>)OzuYtb_kw={{N43`9^*e&EnaT@S9#_?RJG^Ue;$)RnejhM@UQmF
zf12Q5!Q`LH_+Ksf*LmijDfl-s`BNDGC4zs0Xa1W6|28K7g^d4N!N18f|6_uGFOz>7
z<Nu!E-{P5nv)~_fw^@Jg{J(_p*AJDr`QPrD|9^si68!CXUZ4L{8UGl;zr!>C;i|pr
zLLf=~=f2XI{Ff;KJ^v>O{@tGW&l3ErnEW#s|8&8>$20$xf`1*8{|d&xT<{MZV6H#y
zc-gU~?@I;$b|!xs<6k5AN5VhK8sjJRzgzI{X7XRn_%{mv(VqFA6#S#{4`I3UKb`S^
zTkwzZ%>Rbq9}j<b{a?%Ye<}FKd*=UK@XuuOXEOdH)bnZX_><t7f0$~|t^aZ+|18FT
zyx^bWng2M!zk$i0!}w1X{8K&ipDXycF!^UQ{<8%COwat+2>v}x{yfJ2Cc!_?Gyg)t
zKk^=Pq;TiI{?&5!_+i)O1A>3KXa4&H{{;A3AASDQze<k!ZxH+|Jo7&z_@^@Yix~f{
zf`7GV{<j7H3MPMu@&7^aul3BoOYpB{@|Q6FN2(9CxZ_WQXZ~NS_T2HOjmfV+tD^gV
zis0Yqng49Tzmv&7pYhKV{98QpXAAyO_nM^c{4Zzxs|5cx&-_aS{~-L`^?w87-yryR
zc;^3;;Gf3iU&Q#g3I3g)`Ck$ILrngg82@g;zsEEG4#B^U$zQ?v4^`8ITYtTt`S(%n
zx%Jn?<iC~ij}`nQNBCX;9wqp9Gx;kS|8oWZDELRIHttKw2fPvm|G*!N(w+amS1oOO
zyDqO)fE)i9&-_;j{_*g)KKlGu#rQ84{DYqP%LV@wCjU~#f2H7`;F<q^!M~izzl`zU
zDEKFN=6_!BuV(TuXZ+t6{8K&izbp8+F!`$)|DOc^G|&9Kf`12-|6ayFW;j3p^E~q(
zuG(|QpU4{3G4*oie+}b*uHYZ?%%3Ru$H3oR|0@{(S%QCsXZ~vh|5PS_E#tpL@UQaB
zf0N*!$K-#2@vj&BYd!NnB>2}d`ByUjuL}Nkp7~n@|3)VNYR3Ol!N1Wn|Hp!VCzHR9
z@sHe}Uw=)W`G=_X-1_Tf@;}1(j~D#gJo6tX_y_L`U;p)t{{@17yJ!An!9NN9?)qQD
z_~!}!ou2u#1^*C}zk%`pz2M*Nng15SzlzEK1mj;X`1g9|e@O6eV)CzL{M!Woz^}~p
zXOwE=zRaxJLtYX5+nN09R5RP&o|kqC{!#F^dh1Bve<t_`Rv4xA(bs>CjQ_9H_anLM
z&uGv5k*Ynn{-fdV&i`i^|A~Ts&@=xDf`1B=e?8-WiQpgang0U8Ka<J-JmX&^_$PVh
z&lmiwnfy(R|8l`U#WVjMf`0>({{_Z>o#3D5ng4OYzk|u&%=rI9@Xz$j|C-?6!{mR7
z@$VM=L!S9}2>vnp#z?)~_1~i2+vA7jBS-M-zuYtbaMhk${|WGS*Z<3m|75|x$}|5-
zf`1;9zm@S%7yPR|^Is|WS1|csWBe-x|2oh7Hw*raO#U{;e~sYZ;F<qn!M}~k{|4jV
zCipjb=6^--?`86DV*I}p{98Qpe=hh()tZ&&&i}U<|IxqV*I&D5{sUEeZv7>}->!3g
z{%>de69oSb&-|wd{%K79EsTG<;NR_;|4PBXipjr~@xMv%@A1sPQ1Gu~^1sLU*9rcC
zk$%rV9~AuCnfx7$|7(JOB>baP8~0_;AC~=1@b6~wzponE_I6(G6#Sz-^M5AzNB_|{
zSsy+Bw=w?FBl-0g<C*_p)t*~_@$h%o|A&l!vfv-@ng1NYKa<Jd$@pI@_$PSgze?~g
zXYy}n{L2OZ6wmynf`0>(zl-r-A^4|y=D$bqZ(;I(%J{Dr{4+iCKP~w8F!{R~|ILDb
zo@f3|f`8-#X8pPI|38fXmx6z}Xa3Ix{{;BE>whQXf6#&a`mgZJKSH(V)_*FK|4YVy
zvfy9sng1lgzk<o%!}wn<_}6;opDFm)GWow|{3`_i2G9IA3jS?O{#}g!YQewJGyfk2
z|4t_VcZ`3t;NRkze}mv3^<en<ub1)vK=5z#%-<pS2jTCo{~sCu-GYCIXZ{}q|1>6l
zALBnRieLYop81bf?YZ?IV)E~1{4Wvwdpz@BAo$lY`SpW7Gb{Ey7bq3{dp+|P3I0t?
z{(Tw$TERc^K)>tXKM4NaO#TSQzeVtmg1_24;AO|p!i|D|K!32UUhxp>>(8N#f4ATt
z<C%Yl;2#fv_xu;h_>VY<pZ`J6{KHgxZvLk*`Sn+-?fBV##S8ukp7~D{{L7jA`XdGE
zKU45e^30zq_*XOe^^&6gHwgZzp84kq{w+-YD8_%a;GgE1|Br%y2a|sk<NvbYpXZtX
zMZrIEl^JO}&-D5m&G>&N_=i06Zx{Sy;P0;gF^vC+QT+O=@XS9<wddAfDw98&@t-L8
zS9#_?LGaIG@*l?drwabHp7}2l{A-!~V;TR2f`6T7{xZS8k;#7~<Nt`@-{_ftmEhmW
z<d0$ew+jAEp84Mv{Ck=F$1wgw59a58n`i!gRC{jz2Umx$|5(O<yx`yNng2M!KMDTs
z`X9&mUn2N-dgi}C@DDNhgN%Q%;NR_;|2o0Hipf8o@vj#Adp+~tDfl-r`QsS>X9fR&
zK3S@ly1W|jvgdCL*9rdZO#X?C|9gUe6#S_leZN`o4?Gk;|Kl0|?*;#8&-`Bt{?YJv
z=l{u!fAna6{RchsAFSGQ>pz9bKbi4ANAQpL%&&jH7U!SI<Uft^pDp+&dFIa&{HvM#
z35@?z!9T?_|80VQ1C#$u#($mQpXQnWalyZX$)CvhzbW`<dggBv{Ck-EXEXjg1^<v|
z{?7#en7Z)wpTzhda0tKt%02TBRqeU?p8$V%{h!D9j~D!_Jo6tX_~$YClNtY1!N1xw
z|3!j-1(Sa&<3C^Uuk*}5SMYCS@~1HVe-Qi|Jo7IX{M(rP7c%~hf`5}|{wD?hUMBxE
z#{X@>zr{2E8-jn-!)E=t^ZydY|4YHY-828^f`1bH-TU8E#((4(e*JfN<{z%wbL&5i
z$$uH+KT+`S_RN2R;9te$pTYQFCiwSw=D%3*uVeCG!T8S?`~wFmv3k+#J^FsG;NQ;V
zPh<Qa6#OIMzqjk(6@q^^lmBYQzeVtm_RPOg@Q;2Z{QQ^B_-_~dV?6VJAo$0_-(COL
zGX4>V^6M|&Gyl(me<qVZlktxg{1ZI$AEnxJ>%W}IKa25C7W`8@^PeO5H!%5g82>!M
zKh-mTw&35w<e$y>FBAMTJ@el#`1dgR^BDg>3;ubY`PT~mk$(z5|6RxUzbE*Yd*<IP
z_$R>MJ^vLj{<{VL3eWsM2>z)|{vyVIoa&&$VZZ;f+B5&rsy(;<DwzBs#y>^yul3A7
zMewg>@|Q6F*9ra&p80bH|28In8RK6g_&0jyzgzI{Wb)5v{9h9MTRijsMevWR4?q8v
zGyY!){%xN5KNb9g@ORIDH!%LuzvkzEhiCqSReNs!r!n~#G5*Pdf2U{ua|Hholm8~h
zKP33~c;>%e@ULU?S1|tf2>!jE`Iia)O-%k<8UJSl|498|p~v;_Q-XgtlfRPje^>C2
zg8$yGf7=EBz@y>kzuz<dy@G#?XZ~*l|9JST<=OwzpMO>{{)ZgKufL#Y{wUR+TYo7`
z{-uon$%21^XZ{I-e>szX8RI`w@K5s0pDOrQGx?V@{^f#ys%QRE!M}ycU(NWh68zIV
z^VbUg9Zddv8UL3B|2)t9FADyVYr@ZeHH`mu!9V1g{{z842LA5(Zw2GOuln~r6b`%o
ztMJVKli;7q<gaD?CkXykp812SJ-7bznEVeg{%L}Lt!Mtr1^-$m|4PRHX2HMCGye^O
ze<PEBHRHcV@Ne|Y|FGcS$>gtN{I>}HO`iGR6#RRc{EsmHy9NI?&-_0K{=vt>*MB|Z
zKVdAt{@OkB2UUA+{wKlTUH@ws|8&8>(=-2-f`5p~-@y1U5&XM7^WP-+S26jYVEmsD
z{Chp~KPvb)G5Oar{%;BXfrFJ;z4mtf_qyQU&g5Um_<t?<N5S9B;{LAm|Bt@^KfyoH
z5I+AK8UJIC;OBp|XZ|Bqdv5+m!{43%&oKTo1plCC{!0b_6ej<A#=lJPkN3=9Ecj<K
z`JZR}YXtu!&-`}_{?$zWCdR*6@K5o~zd`VCVDi7f_;(5ZX`cB%68t-u{LPI20Y~!l
zKhrb+P}QEB|2<6pml*$(1^<v|{t1GA%;VwfzlHI?Lhvv5%s*Z5Pk_I>{$FPNZxH;e
zJoC>J{PURnt&IOef`7GV{s#pA3MT(+jDM@(U+0<suY!LglfRAe|3dI@@XY_I;NQmN
ze}nNKbriq;nmqIWO10<KUoVq?6XTyK__uiGKV9&Tdcv$fcmBV{_|F#n+dcDV3I0j&
zcc1^XGyeAo{vDqAmkIu9O#Us5f3x7<?U{dr;9te$-^%!R3;sQx`F9BZbxi*E82`~R
z{QU3#%L?j>k6!Q5_Xn!>-2886@^>))DT06GXeCy!y<PuKQSCYZZYKZxjQ=9lUOTDB
zlLKDS@TYm{`voz)fAo_^>CXRcjQ<m=J?9_eng3D2KOX+>`u~ve?-2asJ@daK_-8Wt
zI~o5z!9T$>|M!A_Ig@`o;~#T0KmIA6`43m^x%t<?<nLnqFBJS!J@fxo@NZ%Af6Dlm
z3I3U$`HKbr9wvV`<Nt`@pXZr>mEa$_)~r8w{{M&ZZx{T_J@fxV@K1ohyZ(1F{@)1x
z6`uLO6#P?}{9iKuV~*kHf3;`+gH(HN{#P*hdl>)U2>!L6`4a^HS|<P3jDL>c-{6@)
zL-227^6z5&D+K>W&-^zE{+&$z?->7;f`5x={`&?0sHeiuf4z)<i{RhpnSZ0;AB4ZV
z{(ofry9ECZ&-@<={%K79KE{8aWBK*h>6yPz@DDNhcQgJ+3jRHw`G2k2bL+p3$*(W6
z?Ddm9F8)^V@Ab@|B=|Qm`S)e~3k3hjL)2iYm+f!=8|M8S!M~fyAHn$lLGX`)|K6^D
zmka)Zb>Zi~p^X0vf`5!>{^tb$c=+4>tUv#cWc)h?|Db37e+&L8O#b~D|Dmz``b+T4
zzmICq&Hr*H{|Lr^lHi}@nLkeOuV(U(Wc<?w|5VTXR|@_uO#Udw|2Dxt%`<<6;NQXI
zAI12u6a4c$^FJ>5M?M{X{?q@~xILcOb@86yAM(t<S@4g6zkB{0!}#wO{3|^3{~-9M
zGWnw!|8d9h>#xc)|Iw;_ggP!K*#k6w<}vvXWBe}>{A)e)Um*C`GWo|c{zZa+ooD`h
z!M~Boe<b6-T<~x7%zuaA-^t{UVf-5f|0d7;PYV9MO#WjS|1E-ln`izv1^-}U`1+4!
z{C^bu+dcDtEBGhD-(COX82@9&@$0YCGyf5)J-7ZsO#UF_f05wd?U{e7;9te$AJ6!g
z3I4sF`HKbrCMJIz<NvVW9~fh<KlgV1w^HzLXYx;E{NED%qu_7PSN8Bq-@h*S2mTyB
z|Kl0|-GYC#XZ{}q|7iHT^Z#VVf8z1{{11BOKS8zU=6?#4e=_4gNAQpL%s)%;&t&qS
z#`xC>{z;zs9~AtnnfwWi|GxzP6wmxy1^)&n|Cx;csG!;ZL+k{{&ouZakO@!T27aa5
zbNjyo{?$WGL4E&|$oL;2_*Wn4cmEkJ_~$j5p4#h7?SD4oKS8zEN}9hG{`%j?a$lzE
z9&)m3uX}3OncZUBuOo#`D$_=5&q90K&i<Twj8$4<eo~scm-gd78Q5aryFlO~)t=jb
z6&SyY`%M5nep8t7OBeh@!%Vv+>i3hlFX~?`wEyNX(|+O<xAmTJv-CQl|AAEXi{aI)
z0YcsXsZ9SX1pnZ*$gMtKbYGF~8};WK1^)*4r=DmUX#W((|1S8``BT2w_%Fo218HsT
z_}QPUg#Q1xO7GP`V0!=Tw5`L(uU6=P?~P{sQYM(Ty8jn3{eMdEKkttH`Wtpe?(x=t
zvi-KSLGVv{-1t{RsQoWy{ME023tPLoNjutaRQ25#_1EuJ*|1meUeo{JeP+{iB^sxO
b)W)&L6@7Rxdum{b)Z@*8Z+hxLPW}HM1pl56

literal 0
HcmV?d00001

diff --git a/drivers/power/supply/qcom/qpnp-fg-gen3.c b/drivers/power/supply/qcom/qpnp-fg-gen3.c
index c77433b73663..948ddf61f3a1 100644
--- a/drivers/power/supply/qcom/qpnp-fg-gen3.c
+++ b/drivers/power/supply/qcom/qpnp-fg-gen3.c
@@ -2376,7 +2376,7 @@ static void clear_cycle_counter(struct fg_chip *chip)
 	}
 	rc = fg_sram_write(chip, CYCLE_COUNT_WORD, CYCLE_COUNT_OFFSET,
 			(u8 *)&chip->cyc_ctr.count,
-			sizeof(chip->cyc_ctr.count) / sizeof(u8 *),
+			sizeof(chip->cyc_ctr.count) / (sizeof(u8 *)),
 			FG_IMA_DEFAULT);
 	if (rc < 0)
 		pr_err("failed to clear cycle counter rc=%d\n", rc);

From c01860b34c392e1673d4ddc86ecf356f61883e05 Mon Sep 17 00:00:00 2001
From: "Dmitry V. Levin" <ldv@altlinux.org>
Date: Tue, 2 Jun 2020 21:00:51 +0300
Subject: [PATCH 0002/2658] s390: fix syscall_get_error for compat processes

commit b3583fca5fb654af2cfc1c08259abb9728272538 upstream.

If both the tracer and the tracee are compat processes, and gprs[2]
is assigned a value by __poke_user_compat, then the higher 32 bits
of gprs[2] are cleared, IS_ERR_VALUE() always returns false, and
syscall_get_error() always returns 0.

Fix the implementation by sign-extending the value for compat processes
the same way as x86 implementation does.

The bug was exposed to user space by commit 201766a20e30f ("ptrace: add
PTRACE_GET_SYSCALL_INFO request") and detected by strace test suite.

This change fixes strace syscall tampering on s390.

Link: https://lkml.kernel.org/r/20200602180051.GA2427@altlinux.org
Fixes: 753c4dd6a2fa2 ("[S390] ptrace changes")
Cc: Elvira Khabirova <lineprinter@altlinux.org>
Cc: stable@vger.kernel.org # v2.6.28+
Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/include/asm/syscall.h | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/arch/s390/include/asm/syscall.h b/arch/s390/include/asm/syscall.h
index 6bc941be6921..166fbd74e316 100644
--- a/arch/s390/include/asm/syscall.h
+++ b/arch/s390/include/asm/syscall.h
@@ -41,7 +41,17 @@ static inline void syscall_rollback(struct task_struct *task,
 static inline long syscall_get_error(struct task_struct *task,
 				     struct pt_regs *regs)
 {
-	return IS_ERR_VALUE(regs->gprs[2]) ? regs->gprs[2] : 0;
+	unsigned long error = regs->gprs[2];
+#ifdef CONFIG_COMPAT
+	if (test_tsk_thread_flag(task, TIF_31BIT)) {
+		/*
+		 * Sign-extend the value so (int)-EFOO becomes (long)-EFOO
+		 * and will match correctly in comparisons.
+		 */
+		error = (long)(int)error;
+	}
+#endif
+	return IS_ERR_VALUE(error) ? error : 0;
 }
 
 static inline long syscall_get_return_value(struct task_struct *task,

From 230c7c238dc95d7b5b31b7131a685c0cbdc70773 Mon Sep 17 00:00:00 2001
From: Adam Honse <calcprogrammer1@gmail.com>
Date: Fri, 10 Apr 2020 15:48:44 -0500
Subject: [PATCH 0003/2658] i2c: piix4: Detect secondary SMBus controller on
 AMD AM4 chipsets

[ Upstream commit f27237c174fd9653033330e4e532cd9d153ce824 ]

The AMD X370 and other AM4 chipsets (A/B/X 3/4/5 parts) and Threadripper
equivalents have a secondary SMBus controller at I/O port address
0x0B20.  This bus is used by several manufacturers to control
motherboard RGB lighting via embedded controllers.  I have been using
this bus in my OpenRGB project to control the Aura RGB on many
motherboards and ASRock also uses this bus for their Polychrome RGB
controller.

I am not aware of any CZ-compatible platforms which do not have the
second SMBus channel.  All of AMD's AM4- and Threadripper- series
chipsets that OpenRGB users have tested appear to have this secondary
bus.  I also noticed this secondary bus is present on older AMD
platforms including my FM1 home server.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=202587
Signed-off-by: Adam Honse <calcprogrammer1@gmail.com>
Reviewed-by: Jean Delvare <jdelvare@suse.de>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Tested-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-piix4.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index b61db9db3ca5..c85ac178c483 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -647,7 +647,8 @@ static int piix4_probe(struct pci_dev *dev, const struct pci_device_id *id)
 	}
 
 	if (dev->vendor == PCI_VENDOR_ID_AMD &&
-	    dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS) {
+	    (dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS ||
+	     dev->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS)) {
 		retval = piix4_setup_sb800(dev, id, 1);
 	}
 

From 2713844b7cea8eae7062b88e848ea261ebeca534 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 1 May 2020 12:40:11 +0300
Subject: [PATCH 0004/2658] ALSA: isa/wavefront: prevent out of bounds write in
 ioctl

[ Upstream commit 7f0d5053c5a9d23fe5c2d337495a9d79038d267b ]

The "header->number" comes from the ioctl and it needs to be clamped to
prevent out of bounds writes.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20200501094011.GA960082@mwanda
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/isa/wavefront/wavefront_synth.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c
index 718d5e3b7806..6c06d0645779 100644
--- a/sound/isa/wavefront/wavefront_synth.c
+++ b/sound/isa/wavefront/wavefront_synth.c
@@ -1174,7 +1174,10 @@ wavefront_send_alias (snd_wavefront_t *dev, wavefront_patch_info *header)
 				      "alias for %d\n",
 				      header->number,
 				      header->hdr.a.OriginalSample);
-    
+
+	if (header->number >= WF_MAX_SAMPLE)
+		return -EINVAL;
+
 	munge_int32 (header->number, &alias_hdr[0], 2);
 	munge_int32 (header->hdr.a.OriginalSample, &alias_hdr[2], 2);
 	munge_int32 (*((unsigned int *)&header->hdr.a.sampleStartOffset),
@@ -1205,6 +1208,9 @@ wavefront_send_multisample (snd_wavefront_t *dev, wavefront_patch_info *header)
 	int num_samples;
 	unsigned char *msample_hdr;
 
+	if (header->number >= WF_MAX_SAMPLE)
+		return -EINVAL;
+
 	msample_hdr = kmalloc(WF_MSAMPLE_BYTES, GFP_KERNEL);
 	if (! msample_hdr)
 		return -ENOMEM;

From 2d538de11751bfc4089af6c7cb7b6a4800296ab0 Mon Sep 17 00:00:00 2001
From: Russell King <rmk+kernel@armlinux.org.uk>
Date: Wed, 6 May 2020 10:36:38 +0100
Subject: [PATCH 0005/2658] i2c: pxa: clear all master action bits in
 i2c_pxa_stop_message()

[ Upstream commit e81c979f4e071d516aa27cf5a0c3939da00dc1ca ]

If we timeout during a message transfer, the control register may
contain bits that cause an action to be set. Read-modify-writing the
register leaving these bits set may trigger the hardware to attempt
one of these actions unintentionally.

Always clear these bits when cleaning up after a message or after
a timeout.

Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-pxa.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
index 0d351954db02..3264b50311ff 100644
--- a/drivers/i2c/busses/i2c-pxa.c
+++ b/drivers/i2c/busses/i2c-pxa.c
@@ -691,11 +691,9 @@ static inline void i2c_pxa_stop_message(struct pxa_i2c *i2c)
 {
 	u32 icr;
 
-	/*
-	 * Clear the STOP and ACK flags
-	 */
+	/* Clear the START, STOP, ACK, TB and MA flags */
 	icr = readl(_ICR(i2c));
-	icr &= ~(ICR_STOP | ICR_ACKNAK);
+	icr &= ~(ICR_START | ICR_STOP | ICR_ACKNAK | ICR_TB | ICR_MA);
 	writel(icr, _ICR(i2c));
 }
 

From b117e81105eeb9951c2a54f368b35ab04be1f1b0 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Thu, 7 May 2020 10:58:06 +0200
Subject: [PATCH 0006/2658] usblp: poison URBs upon disconnect

[ Upstream commit 296a193b06120aa6ae7cf5c0d7b5e5b55968026e ]

syzkaller reported an URB that should have been killed to be active.
We do not understand it, but this should fix the issue if it is real.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+be5b5f86a162a6c281e6@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20200507085806.5793-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/class/usblp.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
index 07c3c3449147..c578d64edc15 100644
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -481,7 +481,8 @@ static int usblp_release(struct inode *inode, struct file *file)
 	usb_autopm_put_interface(usblp->intf);
 
 	if (!usblp->present)		/* finish cleanup from disconnect */
-		usblp_cleanup(usblp);
+		usblp_cleanup(usblp);	/* any URBs must be dead */
+
 	mutex_unlock(&usblp_mutex);
 	return 0;
 }
@@ -1397,9 +1398,11 @@ static void usblp_disconnect(struct usb_interface *intf)
 
 	usblp_unlink_urbs(usblp);
 	mutex_unlock(&usblp->mut);
+	usb_poison_anchored_urbs(&usblp->urbs);
 
 	if (!usblp->used)
 		usblp_cleanup(usblp);
+
 	mutex_unlock(&usblp_mutex);
 }
 

From ecdabc1680e6bf064bff403df5fddb1af222037b Mon Sep 17 00:00:00 2001
From: Emmanuel Nicolet <emmanuel.nicolet@gmail.com>
Date: Sat, 9 May 2020 18:58:32 +0000
Subject: [PATCH 0007/2658] ps3disk: use the default segment boundary

[ Upstream commit 720bc316690bd27dea9d71510b50f0cd698ffc32 ]

Since commit dcebd755926b ("block: use bio_for_each_bvec() to compute
multi-page bvec count"), the kernel will bug_on on the PS3 because
bio_split() is called with sectors == 0:

  kernel BUG at block/bio.c:1853!
  Oops: Exception in kernel mode, sig: 5 [#1]
  BE PAGE_SIZE=4K MMU=Hash PREEMPT SMP NR_CPUS=8 NUMA PS3
  Modules linked in: firewire_sbp2 rtc_ps3(+) soundcore ps3_gelic(+) \
  ps3rom(+) firewire_core ps3vram(+) usb_common crc_itu_t
  CPU: 0 PID: 97 Comm: blkid Not tainted 5.3.0-rc4 #1
  NIP:  c00000000027d0d0 LR: c00000000027d0b0 CTR: 0000000000000000
  REGS: c00000000135ae90 TRAP: 0700   Not tainted  (5.3.0-rc4)
  MSR:  8000000000028032 <SF,EE,IR,DR,RI>  CR: 44008240  XER: 20000000
  IRQMASK: 0
  GPR00: c000000000289368 c00000000135b120 c00000000084a500 c000000004ff8300
  GPR04: 0000000000000c00 c000000004c905e0 c000000004c905e0 000000000000ffff
  GPR08: 0000000000000000 0000000000000001 0000000000000000 000000000000ffff
  GPR12: 0000000000000000 c0000000008ef000 000000000000003e 0000000000080001
  GPR16: 0000000000000100 000000000000ffff 0000000000000000 0000000000000004
  GPR20: c00000000062fd7e 0000000000000001 000000000000ffff 0000000000000080
  GPR24: c000000000781788 c00000000135b350 0000000000000080 c000000004c905e0
  GPR28: c00000000135b348 c000000004ff8300 0000000000000000 c000000004c90000
  NIP [c00000000027d0d0] .bio_split+0x28/0xac
  LR [c00000000027d0b0] .bio_split+0x8/0xac
  Call Trace:
  [c00000000135b120] [c00000000027d130] .bio_split+0x88/0xac (unreliable)
  [c00000000135b1b0] [c000000000289368] .__blk_queue_split+0x11c/0x53c
  [c00000000135b2d0] [c00000000028f614] .blk_mq_make_request+0x80/0x7d4
  [c00000000135b3d0] [c000000000283a8c] .generic_make_request+0x118/0x294
  [c00000000135b4b0] [c000000000283d34] .submit_bio+0x12c/0x174
  [c00000000135b580] [c000000000205a44] .mpage_bio_submit+0x3c/0x4c
  [c00000000135b600] [c000000000206184] .mpage_readpages+0xa4/0x184
  [c00000000135b750] [c0000000001ff8fc] .blkdev_readpages+0x24/0x38
  [c00000000135b7c0] [c0000000001589f0] .read_pages+0x6c/0x1a8
  [c00000000135b8b0] [c000000000158c74] .__do_page_cache_readahead+0x118/0x184
  [c00000000135b9b0] [c0000000001591a8] .force_page_cache_readahead+0xe4/0xe8
  [c00000000135ba50] [c00000000014fc24] .generic_file_read_iter+0x1d8/0x830
  [c00000000135bb50] [c0000000001ffadc] .blkdev_read_iter+0x40/0x5c
  [c00000000135bbc0] [c0000000001b9e00] .new_sync_read+0x144/0x1a0
  [c00000000135bcd0] [c0000000001bc454] .vfs_read+0xa0/0x124
  [c00000000135bd70] [c0000000001bc7a4] .ksys_read+0x70/0xd8
  [c00000000135be20] [c00000000000a524] system_call+0x5c/0x70
  Instruction dump:
  7fe3fb78 482e30dc 7c0802a6 482e3085 7c9e2378 f821ff71 7ca42b78 7d3e00d0
  7c7d1b78 79290fe0 7cc53378 69290001 <0b090000> 81230028 7bca0020 7929ba62
  [ end trace 313fec760f30aa1f ]---

The problem originates from setting the segment boundary of the
request queue to -1UL. This makes get_max_segment_size() return zero
when offset is zero, whatever the max segment size. The test with
BLK_SEG_BOUNDARY_MASK fails and 'mask - (mask & offset) + 1' overflows
to zero in the return statement.

Not setting the segment boundary and using the default
value (BLK_SEG_BOUNDARY_MASK) fixes the problem.

Signed-off-by: Emmanuel Nicolet <emmanuel.nicolet@gmail.com>
Signed-off-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/060a416c43138f45105c0540eff1a45539f7e2fc.1589049250.git.geoff@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/ps3disk.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/block/ps3disk.c b/drivers/block/ps3disk.c
index c120d70d3fb3..fc7a20286090 100644
--- a/drivers/block/ps3disk.c
+++ b/drivers/block/ps3disk.c
@@ -464,7 +464,6 @@ static int ps3disk_probe(struct ps3_system_bus_device *_dev)
 	blk_queue_bounce_limit(queue, BLK_BOUNCE_HIGH);
 
 	blk_queue_max_hw_sectors(queue, dev->bounce_size >> 9);
-	blk_queue_segment_boundary(queue, -1UL);
 	blk_queue_dma_alignment(queue, dev->blk_size-1);
 	blk_queue_logical_block_size(queue, dev->blk_size);
 

From 6610b2288c2e57ce972752b8669ffe37f8eb53fa Mon Sep 17 00:00:00 2001
From: Qian Cai <cai@lca.pw>
Date: Sun, 10 May 2020 12:16:56 -0400
Subject: [PATCH 0008/2658] vfio/pci: fix memory leaks in alloc_perm_bits()

[ Upstream commit 3e63b94b6274324ff2e7d8615df31586de827c4e ]

vfio_pci_disable() calls vfio_config_free() but forgets to call
free_perm_bits() resulting in memory leaks,

unreferenced object 0xc000000c4db2dee0 (size 16):
  comm "qemu-kvm", pid 4305, jiffies 4295020272 (age 3463.780s)
  hex dump (first 16 bytes):
    00 00 ff 00 ff ff ff ff ff ff ff ff ff ff 00 00  ................
  backtrace:
    [<00000000a6a4552d>] alloc_perm_bits+0x58/0xe0 [vfio_pci]
    [<00000000ac990549>] vfio_config_init+0xdf0/0x11b0 [vfio_pci]
    init_pci_cap_msi_perm at drivers/vfio/pci/vfio_pci_config.c:1125
    (inlined by) vfio_msi_cap_len at drivers/vfio/pci/vfio_pci_config.c:1180
    (inlined by) vfio_cap_len at drivers/vfio/pci/vfio_pci_config.c:1241
    (inlined by) vfio_cap_init at drivers/vfio/pci/vfio_pci_config.c:1468
    (inlined by) vfio_config_init at drivers/vfio/pci/vfio_pci_config.c:1707
    [<000000006db873a1>] vfio_pci_open+0x234/0x700 [vfio_pci]
    [<00000000630e1906>] vfio_group_fops_unl_ioctl+0x8e0/0xb84 [vfio]
    [<000000009e34c54f>] ksys_ioctl+0xd8/0x130
    [<000000006577923d>] sys_ioctl+0x28/0x40
    [<000000006d7b1cf2>] system_call_exception+0x114/0x1e0
    [<0000000008ea7dd5>] system_call_common+0xf0/0x278
unreferenced object 0xc000000c4db2e330 (size 16):
  comm "qemu-kvm", pid 4305, jiffies 4295020272 (age 3463.780s)
  hex dump (first 16 bytes):
    00 ff ff 00 ff ff ff ff ff ff ff ff ff ff 00 00  ................
  backtrace:
    [<000000004c71914f>] alloc_perm_bits+0x44/0xe0 [vfio_pci]
    [<00000000ac990549>] vfio_config_init+0xdf0/0x11b0 [vfio_pci]
    [<000000006db873a1>] vfio_pci_open+0x234/0x700 [vfio_pci]
    [<00000000630e1906>] vfio_group_fops_unl_ioctl+0x8e0/0xb84 [vfio]
    [<000000009e34c54f>] ksys_ioctl+0xd8/0x130
    [<000000006577923d>] sys_ioctl+0x28/0x40
    [<000000006d7b1cf2>] system_call_exception+0x114/0x1e0
    [<0000000008ea7dd5>] system_call_common+0xf0/0x278

Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver")
Signed-off-by: Qian Cai <cai@lca.pw>
[aw: rolled in follow-up patch]
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/pci/vfio_pci_config.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
index 98a12be76c9c..bf65572f47a8 100644
--- a/drivers/vfio/pci/vfio_pci_config.c
+++ b/drivers/vfio/pci/vfio_pci_config.c
@@ -1644,8 +1644,11 @@ void vfio_config_free(struct vfio_pci_device *vdev)
 	vdev->vconfig = NULL;
 	kfree(vdev->pci_config_map);
 	vdev->pci_config_map = NULL;
-	kfree(vdev->msi_perm);
-	vdev->msi_perm = NULL;
+	if (vdev->msi_perm) {
+		free_perm_bits(vdev->msi_perm);
+		kfree(vdev->msi_perm);
+		vdev->msi_perm = NULL;
+	}
 }
 
 /*

From b61a88ae3ad2d0460cde4ff2758e9216a63815d8 Mon Sep 17 00:00:00 2001
From: Marek Szyprowski <m.szyprowski@samsung.com>
Date: Mon, 27 Apr 2020 09:48:29 +0200
Subject: [PATCH 0009/2658] mfd: wm8994: Fix driver operation if loaded as
 modules

[ Upstream commit d4f9b5428b53dd67f49ee8deed8d4366ed6b1933 ]

WM8994 chip has built-in regulators, which might be used for chip
operation. They are controlled by a separate wm8994-regulator driver,
which should be loaded before this driver calls regulator_get(), because
that driver also provides consumer-supply mapping for the them. If that
driver is not yet loaded, regulator core substitute them with dummy
regulator, what breaks chip operation, because the built-in regulators are
never enabled. Fix this by annotating this driver with MODULE_SOFTDEP()
"pre" dependency to "wm8994_regulator" module.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/wm8994-core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
index 7eec619a6023..3d1457189fa2 100644
--- a/drivers/mfd/wm8994-core.c
+++ b/drivers/mfd/wm8994-core.c
@@ -690,3 +690,4 @@ module_i2c_driver(wm8994_i2c_driver);
 MODULE_DESCRIPTION("Core support for the WM8994 audio CODEC");
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Mark Brown <broonie@opensource.wolfsonmicro.com>");
+MODULE_SOFTDEP("pre: wm8994_regulator");

From cb63c4cb3682705b209791e26d2bf0a2e472d92d Mon Sep 17 00:00:00 2001
From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Date: Mon, 25 May 2020 22:16:24 +0800
Subject: [PATCH 0010/2658] scsi: lpfc: Fix lpfc_nodelist leak when processing
 unsolicited event

[ Upstream commit 7217e6e694da3aae6d17db8a7f7460c8d4817ebf ]

In order to create or activate a new node, lpfc_els_unsol_buffer() invokes
lpfc_nlp_init() or lpfc_enable_node() or lpfc_nlp_get(), all of them will
return a reference of the specified lpfc_nodelist object to "ndlp" with
increased refcnt.

When lpfc_els_unsol_buffer() returns, local variable "ndlp" becomes
invalid, so the refcount should be decreased to keep refcount balanced.

The reference counting issue happens in one exception handling path of
lpfc_els_unsol_buffer(). When "ndlp" in DEV_LOSS, the function forgets to
decrease the refcnt increased by lpfc_nlp_init() or lpfc_enable_node() or
lpfc_nlp_get(), causing a refcnt leak.

Fix this issue by calling lpfc_nlp_put() when "ndlp" in DEV_LOSS.

Link: https://lore.kernel.org/r/1590416184-52592-1-git-send-email-xiyuyang19@fudan.edu.cn
Reviewed-by: Daniel Wagner <dwagner@suse.de>
Reviewed-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/lpfc/lpfc_els.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 530b7df21322..315dd25a0c44 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -7315,6 +7315,8 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 	spin_lock_irq(shost->host_lock);
 	if (ndlp->nlp_flag & NLP_IN_DEV_LOSS) {
 		spin_unlock_irq(shost->host_lock);
+		if (newnode)
+			lpfc_nlp_put(ndlp);
 		goto dropit;
 	}
 	spin_unlock_irq(shost->host_lock);

From e38d40763da4eb5f2e13a2f775ae25d483a10090 Mon Sep 17 00:00:00 2001
From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Date: Mon, 25 May 2020 22:15:41 +0800
Subject: [PATCH 0011/2658] nfsd: Fix svc_xprt refcnt leak when setup callback
 client failed

[ Upstream commit a4abc6b12eb1f7a533c2e7484cfa555454ff0977 ]

nfsd4_process_cb_update() invokes svc_xprt_get(), which increases the
refcount of the "c->cn_xprt".

The reference counting issue happens in one exception handling path of
nfsd4_process_cb_update(). When setup callback client failed, the
function forgets to decrease the refcnt increased by svc_xprt_get(),
causing a refcnt leak.

Fix this issue by calling svc_xprt_put() when setup callback client
failed.

Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfsd/nfs4callback.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index 4fa3f0ba9ab3..0a0b41071ed7 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -1096,6 +1096,8 @@ static void nfsd4_process_cb_update(struct nfsd4_callback *cb)
 	err = setup_callback_client(clp, &conn, ses);
 	if (err) {
 		nfsd4_mark_cb_down(clp, err);
+		if (c)
+			svc_xprt_put(c->cn_xprt);
 		return;
 	}
 }

From eb3336a0a86a6e685ba7c5f8aae83a606225d48a Mon Sep 17 00:00:00 2001
From: Pingfan Liu <kernelfans@gmail.com>
Date: Wed, 1 Apr 2020 22:00:44 +0800
Subject: [PATCH 0012/2658] powerpc/crashkernel: Take "mem=" option into
 account

[ Upstream commit be5470e0c285a68dc3afdea965032f5ddc8269d7 ]

'mem=" option is an easy way to put high pressure on memory during
some test. Hence after applying the memory limit, instead of total
mem, the actual usable memory should be considered when reserving mem
for crashkernel. Otherwise the boot up may experience OOM issue.

E.g. it would reserve 4G prior to the change and 512M afterward, if
passing
crashkernel="2G-4G:384M,4G-16G:512M,16G-64G:1G,64G-128G:2G,128G-:4G",
and mem=5G on a 256G machine.

This issue is powerpc specific because it puts higher priority on
fadump and kdump reservation than on "mem=". Referring the following
code:
    if (fadump_reserve_mem() == 0)
            reserve_crashkernel();
    ...
    /* Ensure that total memory size is page-aligned. */
    limit = ALIGN(memory_limit ?: memblock_phys_mem_size(), PAGE_SIZE);
    memblock_enforce_memory_limit(limit);

While on other arches, the effect of "mem=" takes a higher priority
and pass through memblock_phys_mem_size() before calling
reserve_crashkernel().

Signed-off-by: Pingfan Liu <kernelfans@gmail.com>
Reviewed-by: Hari Bathini <hbathini@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1585749644-4148-1-git-send-email-kernelfans@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/machine_kexec.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c
index 8dff2b371219..a14d9b008f74 100644
--- a/arch/powerpc/kernel/machine_kexec.c
+++ b/arch/powerpc/kernel/machine_kexec.c
@@ -113,11 +113,12 @@ void machine_kexec(struct kimage *image)
 
 void __init reserve_crashkernel(void)
 {
-	unsigned long long crash_size, crash_base;
+	unsigned long long crash_size, crash_base, total_mem_sz;
 	int ret;
 
+	total_mem_sz = memory_limit ? memory_limit : memblock_phys_mem_size();
 	/* use common parsing */
-	ret = parse_crashkernel(boot_command_line, memblock_phys_mem_size(),
+	ret = parse_crashkernel(boot_command_line, total_mem_sz,
 			&crash_size, &crash_base);
 	if (ret == 0 && crash_size > 0) {
 		crashk_res.start = crash_base;
@@ -176,6 +177,7 @@ void __init reserve_crashkernel(void)
 	/* Crash kernel trumps memory limit */
 	if (memory_limit && memory_limit <= crashk_res.end) {
 		memory_limit = crashk_res.end + 1;
+		total_mem_sz = memory_limit;
 		printk("Adjusted memory limit for crashkernel, now 0x%llx\n",
 		       memory_limit);
 	}
@@ -184,7 +186,7 @@ void __init reserve_crashkernel(void)
 			"for crashkernel (System RAM: %ldMB)\n",
 			(unsigned long)(crash_size >> 20),
 			(unsigned long)(crashk_res.start >> 20),
-			(unsigned long)(memblock_phys_mem_size() >> 20));
+			(unsigned long)(total_mem_sz >> 20));
 
 	if (!memblock_is_region_memory(crashk_res.start, crash_size) ||
 	    memblock_reserve(crashk_res.start, crash_size)) {

From 908f028c11b8778093f69bacfab98a440cb0cc98 Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38@huawei.com>
Date: Thu, 4 Jun 2020 20:18:51 +0800
Subject: [PATCH 0013/2658] yam: fix possible memory leak in yam_init_driver

[ Upstream commit 98749b7188affbf2900c2aab704a8853901d1139 ]

If register_netdev(dev) fails, free_netdev(dev) needs
to be called, otherwise a memory leak will occur.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/hamradio/yam.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
index 1a4729c36aa4..623e4225e7c8 100644
--- a/drivers/net/hamradio/yam.c
+++ b/drivers/net/hamradio/yam.c
@@ -1160,6 +1160,7 @@ static int __init yam_init_driver(void)
 		err = register_netdev(dev);
 		if (err) {
 			printk(KERN_WARNING "yam: cannot register net device %s\n", dev->name);
+			free_netdev(dev);
 			goto error;
 		}
 		yam_devs[i] = dev;

From 5f93c775e04bfa6e06d1e40a9616cb86463bb55b Mon Sep 17 00:00:00 2001
From: ashimida <ashimida@linux.alibaba.com>
Date: Tue, 2 Jun 2020 15:45:17 +0800
Subject: [PATCH 0014/2658] mksysmap: Fix the mismatch of '.L' symbols in
 System.map

[ Upstream commit 72d24accf02add25e08733f0ecc93cf10fcbd88c ]

When System.map was generated, the kernel used mksysmap to
filter the kernel symbols, but all the symbols with the
second letter 'L' in the kernel were filtered out, not just
the symbols starting with 'dot + L'.

For example:
ashimida@ubuntu:~/linux$ cat System.map |grep ' .L'
ashimida@ubuntu:~/linux$ nm -n vmlinux |grep ' .L'
ffff0000088028e0 t bLength_show
......
ffff0000092e0408 b PLLP_OUTC_lock
ffff0000092e0410 b PLLP_OUTA_lock

The original intent should be to filter out all local symbols
starting with '.L', so the dot should be escaped.

Fixes: 00902e984732 ("mksysmap: Add h8300 local symbol pattern")
Signed-off-by: ashimida <ashimida@linux.alibaba.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/mksysmap | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/mksysmap b/scripts/mksysmap
index a35acc0d0b82..9aa23d15862a 100755
--- a/scripts/mksysmap
+++ b/scripts/mksysmap
@@ -41,4 +41,4 @@
 # so we just ignore them to let readprofile continue to work.
 # (At least sparc64 has __crc_ in the middle).
 
-$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( .L\)' > $2
+$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( \.L\)' > $2

From c33157ed4e68a607009e6cb301b29a1b74eaa4f3 Mon Sep 17 00:00:00 2001
From: Simon Arlott <simon@octiron.net>
Date: Sat, 30 May 2020 18:59:44 +0100
Subject: [PATCH 0015/2658] scsi: sr: Fix sr_probe() missing deallocate of
 device minor

[ Upstream commit 6555781b3fdec5e94e6914511496144241df7dee ]

If the cdrom fails to be registered then the device minor should be
deallocated.

Link: https://lore.kernel.org/r/072dac4b-8402-4de8-36bd-47e7588969cd@0882a8b5-c6c3-11e9-b005-00805fc181fe
Signed-off-by: Simon Arlott <simon@octiron.net>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/sr.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index 5dc288fecace..7dd4d9ded249 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -746,7 +746,7 @@ static int sr_probe(struct device *dev)
 	cd->cdi.disk = disk;
 
 	if (register_cdrom(&cd->cdi))
-		goto fail_put;
+		goto fail_minor;
 
 	/*
 	 * Initialize block layer runtime PM stuffs before the
@@ -764,6 +764,10 @@ static int sr_probe(struct device *dev)
 
 	return 0;
 
+fail_minor:
+	spin_lock(&sr_index_lock);
+	clear_bit(minor, sr_index_bits);
+	spin_unlock(&sr_index_lock);
 fail_put:
 	put_disk(disk);
 fail_free:

From f17e1dffb2ac8a4b1cb4f15d08e22d4ee94d161a Mon Sep 17 00:00:00 2001
From: Tyrel Datwyler <tyreld@linux.ibm.com>
Date: Wed, 3 Jun 2020 15:36:32 -0500
Subject: [PATCH 0016/2658] scsi: ibmvscsi: Don't send host info in adapter
 info MAD after LPM

[ Upstream commit 4919b33b63c8b69d8dcf2b867431d0e3b6dc6d28 ]

The adapter info MAD is used to send the client info and receive the host
info as a response. A persistent buffer is used and as such the client info
is overwritten after the response. During the course of a normal adapter
reset the client info is refreshed in the buffer in preparation for sending
the adapter info MAD.

However, in the special case of LPM where we reenable the CRQ instead of a
full CRQ teardown and reset we fail to refresh the client info in the
adapter info buffer. As a result, after Live Partition Migration (LPM) we
erroneously report the host's info as our own.

[mkp: typos]

Link: https://lore.kernel.org/r/20200603203632.18426-1-tyreld@linux.ibm.com
Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ibmvscsi/ibmvscsi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index e26747a1b35a..e7075aae15da 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -427,6 +427,8 @@ static int ibmvscsi_reenable_crq_queue(struct crq_queue *queue,
 	int rc = 0;
 	struct vio_dev *vdev = to_vio_dev(hostdata->dev);
 
+	set_adapter_info(hostdata);
+
 	/* Re-enable the CRQ */
 	do {
 		if (rc)

From ffd21fa31eb15008967b284000209424e033707f Mon Sep 17 00:00:00 2001
From: Alexander Tsoy <alexander@tsoy.me>
Date: Fri, 24 Apr 2020 05:24:48 +0300
Subject: [PATCH 0017/2658] ALSA: usb-audio: Improve frames size computation

[ Upstream commit f0bd62b64016508938df9babe47f65c2c727d25c ]

For computation of the the next frame size current value of fs/fps and
accumulated fractional parts of fs/fps are used, where values are stored
in Q16.16 format. This is quite natural for computing frame size for
asynchronous endpoints driven by explicit feedback, since in this case
fs/fps is a value provided by the feedback endpoint and it's already in
the Q format. If an error is accumulated over time, the device can
adjust fs/fps value to prevent buffer overruns/underruns.

But for synchronous endpoints the accuracy provided by these computations
is not enough. Due to accumulated error the driver periodically produces
frames with incorrect size (+/- 1 audio sample).

This patch fixes this issue by implementing a different algorithm for
frame size computation. It is based on accumulating of the remainders
from division fs/fps and it doesn't accumulate errors over time. This
new method is enabled for synchronous and adaptive playback endpoints.

Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
Link: https://lore.kernel.org/r/20200424022449.14972-1-alexander@tsoy.me
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/card.h     |  4 ++++
 sound/usb/endpoint.c | 43 ++++++++++++++++++++++++++++++++++++++-----
 sound/usb/endpoint.h |  1 +
 sound/usb/pcm.c      |  2 ++
 4 files changed, 45 insertions(+), 5 deletions(-)

diff --git a/sound/usb/card.h b/sound/usb/card.h
index 7421ee53c29f..444a43270d66 100644
--- a/sound/usb/card.h
+++ b/sound/usb/card.h
@@ -80,6 +80,10 @@ struct snd_usb_endpoint {
 	dma_addr_t sync_dma;		/* DMA address of syncbuf */
 
 	unsigned int pipe;		/* the data i/o pipe */
+	unsigned int framesize[2];	/* small/large frame sizes in samples */
+	unsigned int sample_rem;	/* remainder from division fs/fps */
+	unsigned int sample_accum;	/* sample accumulator */
+	unsigned int fps;		/* frames per second */
 	unsigned int freqn;		/* nominal sampling rate in fs/fps in Q16.16 format */
 	unsigned int freqm;		/* momentary sampling rate in fs/fps in Q16.16 format */
 	int	   freqshift;		/* how much to shift the feedback value to get Q16.16 */
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index 1f18719e09aa..1bf46565d1df 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -137,12 +137,12 @@ int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep)
 
 /*
  * For streaming based on information derived from sync endpoints,
- * prepare_outbound_urb_sizes() will call next_packet_size() to
+ * prepare_outbound_urb_sizes() will call slave_next_packet_size() to
  * determine the number of samples to be sent in the next packet.
  *
- * For implicit feedback, next_packet_size() is unused.
+ * For implicit feedback, slave_next_packet_size() is unused.
  */
-int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep)
+int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep)
 {
 	unsigned long flags;
 	int ret;
@@ -159,6 +159,29 @@ int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep)
 	return ret;
 }
 
+/*
+ * For adaptive and synchronous endpoints, prepare_outbound_urb_sizes()
+ * will call next_packet_size() to determine the number of samples to be
+ * sent in the next packet.
+ */
+int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep)
+{
+	int ret;
+
+	if (ep->fill_max)
+		return ep->maxframesize;
+
+	ep->sample_accum += ep->sample_rem;
+	if (ep->sample_accum >= ep->fps) {
+		ep->sample_accum -= ep->fps;
+		ret = ep->framesize[1];
+	} else {
+		ret = ep->framesize[0];
+	}
+
+	return ret;
+}
+
 static void retire_outbound_urb(struct snd_usb_endpoint *ep,
 				struct snd_urb_ctx *urb_ctx)
 {
@@ -203,6 +226,8 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep,
 
 		if (ctx->packet_size[i])
 			counts = ctx->packet_size[i];
+		else if (ep->sync_master)
+			counts = snd_usb_endpoint_slave_next_packet_size(ep);
 		else
 			counts = snd_usb_endpoint_next_packet_size(ep);
 
@@ -879,10 +904,17 @@ int snd_usb_endpoint_set_params(struct snd_usb_endpoint *ep,
 	ep->maxpacksize = fmt->maxpacksize;
 	ep->fill_max = !!(fmt->attributes & UAC_EP_CS_ATTR_FILL_MAX);
 
-	if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL)
+	if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL) {
 		ep->freqn = get_usb_full_speed_rate(rate);
-	else
+		ep->fps = 1000;
+	} else {
 		ep->freqn = get_usb_high_speed_rate(rate);
+		ep->fps = 8000;
+	}
+
+	ep->sample_rem = rate % ep->fps;
+	ep->framesize[0] = rate / ep->fps;
+	ep->framesize[1] = (rate + (ep->fps - 1)) / ep->fps;
 
 	/* calculate the frequency in 16.16 format */
 	ep->freqm = ep->freqn;
@@ -941,6 +973,7 @@ int snd_usb_endpoint_start(struct snd_usb_endpoint *ep)
 	ep->active_mask = 0;
 	ep->unlink_mask = 0;
 	ep->phase = 0;
+	ep->sample_accum = 0;
 
 	snd_usb_endpoint_start_quirk(ep);
 
diff --git a/sound/usb/endpoint.h b/sound/usb/endpoint.h
index 584f295d7c77..4aad49cbeb5f 100644
--- a/sound/usb/endpoint.h
+++ b/sound/usb/endpoint.h
@@ -27,6 +27,7 @@ void snd_usb_endpoint_release(struct snd_usb_endpoint *ep);
 void snd_usb_endpoint_free(struct snd_usb_endpoint *ep);
 
 int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep);
+int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep);
 int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep);
 
 void snd_usb_handle_sync_urb(struct snd_usb_endpoint *ep,
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 8eaadc0a4cb2..aa451fc9b253 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1531,6 +1531,8 @@ static void prepare_playback_urb(struct snd_usb_substream *subs,
 	for (i = 0; i < ctx->packets; i++) {
 		if (ctx->packet_size[i])
 			counts = ctx->packet_size[i];
+		else if (ep->sync_master)
+			counts = snd_usb_endpoint_slave_next_packet_size(ep);
 		else
 			counts = snd_usb_endpoint_next_packet_size(ep);
 

From e5670312c0bfa2c6c9e7e71965639ea4f870edfa Mon Sep 17 00:00:00 2001
From: Julian Wiedmann <jwi@linux.ibm.com>
Date: Thu, 9 Apr 2020 09:59:39 +0200
Subject: [PATCH 0018/2658] s390/qdio: put thinint indicator after early error

[ Upstream commit 75e82bec6b2622c6f455b7a543fb5476a5d0eed7 ]

qdio_establish() calls qdio_setup_thinint() via qdio_setup_irq().
If the subsequent qdio_establish_thinint() fails, we miss to put the
DSCI again. Thus the DSCI isn't available for re-use. Given enough of
such errors, we could end up with having only the shared DSCI available.

Merge qdio_setup_thinint() into qdio_establish_thinint(), and deal with
such an error internally.

Fixes: 779e6e1c724d ("[S390] qdio: new qdio driver.")
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/cio/qdio.h         |  1 -
 drivers/s390/cio/qdio_setup.c   |  1 -
 drivers/s390/cio/qdio_thinint.c | 14 ++++++++------
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/s390/cio/qdio.h b/drivers/s390/cio/qdio.h
index 7e70f9298cc1..11f6ebd04545 100644
--- a/drivers/s390/cio/qdio.h
+++ b/drivers/s390/cio/qdio.h
@@ -376,7 +376,6 @@ static inline int multicast_outbound(struct qdio_q *q)
 extern u64 last_ai_time;
 
 /* prototypes for thin interrupt */
-void qdio_setup_thinint(struct qdio_irq *irq_ptr);
 int qdio_establish_thinint(struct qdio_irq *irq_ptr);
 void qdio_shutdown_thinint(struct qdio_irq *irq_ptr);
 void tiqdio_add_input_queues(struct qdio_irq *irq_ptr);
diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c
index d0090c5c88e7..a64615a10352 100644
--- a/drivers/s390/cio/qdio_setup.c
+++ b/drivers/s390/cio/qdio_setup.c
@@ -479,7 +479,6 @@ int qdio_setup_irq(struct qdio_initialize *init_data)
 	setup_queues(irq_ptr, init_data);
 
 	setup_qib(irq_ptr, init_data);
-	qdio_setup_thinint(irq_ptr);
 	set_impl_params(irq_ptr, init_data->qib_param_field_format,
 			init_data->qib_param_field,
 			init_data->input_slib_elements,
diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
index debe69adfc70..aecb6445a567 100644
--- a/drivers/s390/cio/qdio_thinint.c
+++ b/drivers/s390/cio/qdio_thinint.c
@@ -268,17 +268,19 @@ int __init tiqdio_register_thinints(void)
 
 int qdio_establish_thinint(struct qdio_irq *irq_ptr)
 {
+	int rc;
+
 	if (!is_thinint_irq(irq_ptr))
 		return 0;
-	return set_subchannel_ind(irq_ptr, 0);
-}
 
-void qdio_setup_thinint(struct qdio_irq *irq_ptr)
-{
-	if (!is_thinint_irq(irq_ptr))
-		return;
 	irq_ptr->dsci = get_indicator();
 	DBF_HEX(&irq_ptr->dsci, sizeof(void *));
+
+	rc = set_subchannel_ind(irq_ptr, 0);
+	if (rc)
+		put_indicator(irq_ptr->dsci);
+
+	return rc;
 }
 
 void qdio_shutdown_thinint(struct qdio_irq *irq_ptr)

From d04d4bb055edab51dda663ff700eb0071ea01f32 Mon Sep 17 00:00:00 2001
From: Raghavendra Rao Ananta <rananta@codeaurora.org>
Date: Mon, 27 Apr 2020 20:26:01 -0700
Subject: [PATCH 0019/2658] tty: hvc: Fix data abort due to race in hvc_open

[ Upstream commit e2bd1dcbe1aa34ff5570b3427c530e4332ecf0fe ]

Potentially, hvc_open() can be called in parallel when two tasks calls
open() on /dev/hvcX. In such a scenario, if the hp->ops->notifier_add()
callback in the function fails, where it sets the tty->driver_data to
NULL, the parallel hvc_open() can see this NULL and cause a memory abort.
Hence, serialize hvc_open and check if tty->private_data is NULL before
proceeding ahead.

The issue can be easily reproduced by launching two tasks simultaneously
that does nothing but open() and close() on /dev/hvcX.
For example:
$ ./simple_open_close /dev/hvc0 & ./simple_open_close /dev/hvc0 &

Signed-off-by: Raghavendra Rao Ananta <rananta@codeaurora.org>
Link: https://lore.kernel.org/r/20200428032601.22127-1-rananta@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/hvc/hvc_console.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
index acf6d143c753..81f23af8beca 100644
--- a/drivers/tty/hvc/hvc_console.c
+++ b/drivers/tty/hvc/hvc_console.c
@@ -89,6 +89,8 @@ static LIST_HEAD(hvc_structs);
  */
 static DEFINE_SPINLOCK(hvc_structs_lock);
 
+/* Mutex to serialize hvc_open */
+static DEFINE_MUTEX(hvc_open_mutex);
 /*
  * This value is used to assign a tty->index value to a hvc_struct based
  * upon order of exposure via hvc_probe(), when we can not match it to
@@ -333,16 +335,24 @@ static int hvc_install(struct tty_driver *driver, struct tty_struct *tty)
  */
 static int hvc_open(struct tty_struct *tty, struct file * filp)
 {
-	struct hvc_struct *hp = tty->driver_data;
+	struct hvc_struct *hp;
 	unsigned long flags;
 	int rc = 0;
 
+	mutex_lock(&hvc_open_mutex);
+
+	hp = tty->driver_data;
+	if (!hp) {
+		rc = -EIO;
+		goto out;
+	}
+
 	spin_lock_irqsave(&hp->port.lock, flags);
 	/* Check and then increment for fast path open. */
 	if (hp->port.count++ > 0) {
 		spin_unlock_irqrestore(&hp->port.lock, flags);
 		hvc_kick();
-		return 0;
+		goto out;
 	} /* else count == 0 */
 	spin_unlock_irqrestore(&hp->port.lock, flags);
 
@@ -371,6 +381,8 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
 	/* Force wakeup of the polling thread */
 	hvc_kick();
 
+out:
+	mutex_unlock(&hvc_open_mutex);
 	return rc;
 }
 

From 952af2af7cbdc3ac2228990fdc5e41d263db57b9 Mon Sep 17 00:00:00 2001
From: Matej Dujava <mdujava@kocurkovo.cz>
Date: Thu, 30 Apr 2020 22:09:24 +0200
Subject: [PATCH 0020/2658] staging: sm750fb: add missing case while setting
 FB_VISUAL

[ Upstream commit fa90133377f4a7f15a937df6ad55133bb57c5665 ]

Switch statement does not contain all cases: 8, 16, 24, 32.
This patch will add missing one (24)

Fixes: 81dee67e215b ("staging: sm750fb: add sm750 to staging")
Signed-off-by: Matej Dujava <mdujava@kocurkovo.cz>
Link: https://lore.kernel.org/r/1588277366-19354-2-git-send-email-mdujava@kocurkovo.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/sm750fb/sm750.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index 860e1c288ad5..75b47d61318a 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -894,6 +894,7 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
 		fix->visual = FB_VISUAL_PSEUDOCOLOR;
 		break;
 	case 16:
+	case 24:
 	case 32:
 		fix->visual = FB_VISUAL_TRUECOLOR;
 		break;

From 8978f4f04dfd0310c5258eb67f99d3f1acaf3944 Mon Sep 17 00:00:00 2001
From: Russell King <rmk+kernel@armlinux.org.uk>
Date: Mon, 27 Apr 2020 19:49:22 +0100
Subject: [PATCH 0021/2658] i2c: pxa: fix i2c_pxa_scream_blue_murder() debug
 output

[ Upstream commit 88b73ee7ca4c90baf136ed5a8377fc5a9b73ac08 ]

The IRQ log output is supposed to appear on a single line.  However,
commit 3a2dc1677b60 ("i2c: pxa: Update debug function to dump more info
on error") resulted in it being printed one-entry-per-line, which is
excessively long.

Fixing this is not a trivial matter; using pr_cont() doesn't work as
the previous dev_dbg() may not have been compiled in, or may be
dynamic.

Since the rest of this function output is at error level, and is also
debug output, promote this to error level as well to avoid this
problem.

Reduce the number of always zero prefix digits to save screen real-
estate.

Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-pxa.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
index 3264b50311ff..8fca6e3dd750 100644
--- a/drivers/i2c/busses/i2c-pxa.c
+++ b/drivers/i2c/busses/i2c-pxa.c
@@ -297,11 +297,10 @@ static void i2c_pxa_scream_blue_murder(struct pxa_i2c *i2c, const char *why)
 	dev_err(dev, "IBMR: %08x IDBR: %08x ICR: %08x ISR: %08x\n",
 		readl(_IBMR(i2c)), readl(_IDBR(i2c)), readl(_ICR(i2c)),
 		readl(_ISR(i2c)));
-	dev_dbg(dev, "log: ");
+	dev_err(dev, "log:");
 	for (i = 0; i < i2c->irqlogidx; i++)
-		pr_debug("[%08x:%08x] ", i2c->isrlog[i], i2c->icrlog[i]);
-
-	pr_debug("\n");
+		pr_cont(" [%03x:%05x]", i2c->isrlog[i], i2c->icrlog[i]);
+	pr_cont("\n");
 }
 
 #else /* ifdef DEBUG */

From a2fa49f30883701a6fba80d6beb6f20cf1c77d81 Mon Sep 17 00:00:00 2001
From: John Stultz <john.stultz@linaro.org>
Date: Tue, 28 Apr 2020 18:40:50 +0000
Subject: [PATCH 0022/2658] serial: amba-pl011: Make sure we initialize the
 port.lock spinlock

[ Upstream commit 8508f4cba308f785b2fd4b8c38849c117b407297 ]

Valentine reported seeing:

[    3.626638] INFO: trying to register non-static key.
[    3.626639] the code is fine but needs lockdep annotation.
[    3.626640] turning off the locking correctness validator.
[    3.626644] CPU: 7 PID: 51 Comm: kworker/7:1 Not tainted 5.7.0-rc2-00115-g8c2e9790f196 #116
[    3.626646] Hardware name: HiKey960 (DT)
[    3.626656] Workqueue: events deferred_probe_work_func
[    3.632476] sd 0:0:0:0: [sda] Optimal transfer size 8192 bytes not a multiple of physical block size (16384 bytes)
[    3.640220] Call trace:
[    3.640225]  dump_backtrace+0x0/0x1b8
[    3.640227]  show_stack+0x20/0x30
[    3.640230]  dump_stack+0xec/0x158
[    3.640234]  register_lock_class+0x598/0x5c0
[    3.640235]  __lock_acquire+0x80/0x16c0
[    3.640236]  lock_acquire+0xf4/0x4a0
[    3.640241]  _raw_spin_lock_irqsave+0x70/0xa8
[    3.640245]  uart_add_one_port+0x388/0x4b8
[    3.640248]  pl011_register_port+0x70/0xf0
[    3.640250]  pl011_probe+0x184/0x1b8
[    3.640254]  amba_probe+0xdc/0x180
[    3.640256]  really_probe+0xe0/0x338
[    3.640257]  driver_probe_device+0x60/0xf8
[    3.640259]  __device_attach_driver+0x8c/0xd0
[    3.640260]  bus_for_each_drv+0x84/0xd8
[    3.640261]  __device_attach+0xe4/0x140
[    3.640263]  device_initial_probe+0x1c/0x28
[    3.640265]  bus_probe_device+0xa4/0xb0
[    3.640266]  deferred_probe_work_func+0x7c/0xb8
[    3.640269]  process_one_work+0x2c0/0x768
[    3.640271]  worker_thread+0x4c/0x498
[    3.640272]  kthread+0x14c/0x158
[    3.640275]  ret_from_fork+0x10/0x1c

Which seems to be due to the fact that after allocating the uap
structure, nothing initializes the spinlock.

Its a little confusing, as uart_port_spin_lock_init() is one
place where the lock is supposed to be initialized, but it has
an exception for the case where the port is a console.

This makes it seem like a deeper fix is needed to properly
register the console, but I'm not sure what that entails, and
Andy suggested that this approach is less invasive.

Thus, this patch resolves the issue by initializing the spinlock
in the driver, and resolves the resulting warning.

Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Jiri Slaby <jslaby@suse.com>
Cc: linux-serial@vger.kernel.org
Reported-by: Valentin Schneider <valentin.schneider@arm.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Reviewed-and-tested-by: Valentin Schneider <valentin.schneider@arm.com>
Link: https://lore.kernel.org/r/20200428184050.6501-1-john.stultz@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/amba-pl011.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 2a2975c352f4..200d9a019413 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2322,6 +2322,7 @@ static int pl011_setup_port(struct device *dev, struct uart_amba_port *uap,
 	uap->port.fifosize = uap->fifosize;
 	uap->port.flags = UPF_BOOT_AUTOCONF;
 	uap->port.line = index;
+	spin_lock_init(&uap->port.lock);
 
 	amba_ports[index] = uap;
 

From 32c5c18b7d16e5432d762dbe306ce68dc1d41eaf Mon Sep 17 00:00:00 2001
From: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Date: Wed, 8 Apr 2020 14:40:03 -0700
Subject: [PATCH 0023/2658] drivers: base: Fix NULL pointer exception in
 __platform_driver_probe() if a driver developer is foolish

[ Upstream commit 388bcc6ecc609fca1b4920de7dc3806c98ec535e ]

If platform bus driver registration is failed then, accessing
platform bus spin lock (&drv->driver.bus->p->klist_drivers.k_lock)
in __platform_driver_probe() without verifying the return value
__platform_driver_register() can lead to NULL pointer exception.

So check the return value before attempting the spin lock.

One such example is below:

For a custom usecase, I have intentionally failed the platform bus
registration and I expected all the platform device/driver
registrations to fail gracefully. But I came across this panic
issue.

[    1.331067] BUG: kernel NULL pointer dereference, address: 00000000000000c8
[    1.331118] #PF: supervisor write access in kernel mode
[    1.331163] #PF: error_code(0x0002) - not-present page
[    1.331208] PGD 0 P4D 0
[    1.331233] Oops: 0002 [#1] PREEMPT SMP
[    1.331268] CPU: 3 PID: 1 Comm: swapper/0 Tainted: G        W         5.6.0-00049-g670d35fb0144 #165
[    1.331341] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
[    1.331406] RIP: 0010:_raw_spin_lock+0x15/0x30
[    1.331588] RSP: 0000:ffffc9000001be70 EFLAGS: 00010246
[    1.331632] RAX: 0000000000000000 RBX: 00000000000000c8 RCX: 0000000000000001
[    1.331696] RDX: 0000000000000001 RSI: 0000000000000092 RDI: 0000000000000000
[    1.331754] RBP: 00000000ffffffed R08: 0000000000000501 R09: 0000000000000001
[    1.331817] R10: ffff88817abcc520 R11: 0000000000000670 R12: 00000000ffffffed
[    1.331881] R13: ffffffff82dbc268 R14: ffffffff832f070a R15: 0000000000000000
[    1.331945] FS:  0000000000000000(0000) GS:ffff88817bd80000(0000) knlGS:0000000000000000
[    1.332008] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    1.332062] CR2: 00000000000000c8 CR3: 000000000681e001 CR4: 00000000003606e0
[    1.332126] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    1.332189] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[    1.332252] Call Trace:
[    1.332281]  __platform_driver_probe+0x92/0xee
[    1.332323]  ? rtc_dev_init+0x2b/0x2b
[    1.332358]  cmos_init+0x37/0x67
[    1.332396]  do_one_initcall+0x7d/0x168
[    1.332428]  kernel_init_freeable+0x16c/0x1c9
[    1.332473]  ? rest_init+0xc0/0xc0
[    1.332508]  kernel_init+0x5/0x100
[    1.332543]  ret_from_fork+0x1f/0x30
[    1.332579] CR2: 00000000000000c8
[    1.332616] ---[ end trace 3bd87f12e9010b87 ]---
[    1.333549] note: swapper/0[1] exited with preempt_count 1
[    1.333592] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
[    1.333736] Kernel Offset: disabled

Note, this can only be triggered if a driver errors out from this call,
which should never happen.  If it does, the driver needs to be fixed.

Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Link: https://lore.kernel.org/r/20200408214003.3356-1-sathyanarayanan.kuppuswamy@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/platform.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 0ed3d8381840..d757beb36040 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -658,6 +658,8 @@ int __init_or_module __platform_driver_probe(struct platform_driver *drv,
 	/* temporary section violation during probe() */
 	drv->probe = probe;
 	retval = code = __platform_driver_register(drv, module);
+	if (retval)
+		return retval;
 
 	/*
 	 * Fixup that section violation, being paranoid about code scanning

From 009836ca9ab5506dbdae4e305be6f924d31e91c0 Mon Sep 17 00:00:00 2001
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date: Wed, 6 May 2020 01:34:21 +0800
Subject: [PATCH 0024/2658] PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X
 Bridges

[ Upstream commit 66ff14e59e8a30690755b08bc3042359703fb07a ]

7d715a6c1ae5 ("PCI: add PCI Express ASPM support") added the ability for
Linux to enable ASPM, but for some undocumented reason, it didn't enable
ASPM on links where the downstream component is a PCIe-to-PCI/PCI-X Bridge.

Remove this exclusion so we can enable ASPM on these links.

The Dell OptiPlex 7080 mentioned in the bugzilla has a TI XIO2001
PCIe-to-PCI Bridge.  Enabling ASPM on the link leading to it allows the
Intel SoC to enter deeper Package C-states, which is a significant power
savings.

[bhelgaas: commit log]
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=207571
Link: https://lore.kernel.org/r/20200505173423.26968-1-kai.heng.feng@canonical.com
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pcie/aspm.c | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index c6a012b5ba39..966b6947e565 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -388,16 +388,6 @@ static void pcie_aspm_cap_init(struct pcie_link_state *link, int blacklist)
 
 	/* Setup initial capable state. Will be updated later */
 	link->aspm_capable = link->aspm_support;
-	/*
-	 * If the downstream component has pci bridge function, don't
-	 * do ASPM for now.
-	 */
-	list_for_each_entry(child, &linkbus->devices, bus_list) {
-		if (pci_pcie_type(child) == PCI_EXP_TYPE_PCI_BRIDGE) {
-			link->aspm_disable = ASPM_STATE_ALL;
-			break;
-		}
-	}
 
 	/* Get and check endpoint acceptable latencies */
 	list_for_each_entry(child, &linkbus->devices, bus_list) {

From 6d6145d7a89509ac373c2663556556b29856ddb7 Mon Sep 17 00:00:00 2001
From: Dmitry Osipenko <digetx@gmail.com>
Date: Sun, 29 Mar 2020 18:15:44 +0200
Subject: [PATCH 0025/2658] power: supply: smb347-charger: IRQSTAT_D is
 volatile

[ Upstream commit c32ea07a30630ace950e07ffe7a18bdcc25898e1 ]

Fix failure when USB cable is connected:
smb347 2-006a: reading IRQSTAT_D failed

Fixes: 1502cfe19bac ("smb347-charger: Fix battery status reporting logic for charger faults")

Tested-by: David Heidelberg <david@ixit.cz>
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: David Heidelberg <david@ixit.cz>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/smb347-charger.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/power/smb347-charger.c b/drivers/power/smb347-charger.c
index 072c5189bd6d..0655dbdc7000 100644
--- a/drivers/power/smb347-charger.c
+++ b/drivers/power/smb347-charger.c
@@ -1141,6 +1141,7 @@ static bool smb347_volatile_reg(struct device *dev, unsigned int reg)
 	switch (reg) {
 	case IRQSTAT_A:
 	case IRQSTAT_C:
+	case IRQSTAT_D:
 	case IRQSTAT_E:
 	case IRQSTAT_F:
 	case STAT_A:

From cce3ded6118b63ef321e4db9bc275ce819d7ff02 Mon Sep 17 00:00:00 2001
From: Suganath Prabu S <suganath-prabu.subramani@broadcom.com>
Date: Fri, 8 May 2020 07:07:38 -0400
Subject: [PATCH 0026/2658] scsi: mpt3sas: Fix double free warnings

[ Upstream commit cbbfdb2a2416c9f0cde913cf09670097ac281282 ]

Fix following warning from Smatch static analyser:

drivers/scsi/mpt3sas/mpt3sas_base.c:5256 _base_allocate_memory_pools()
warn: 'ioc->hpr_lookup' double freed

drivers/scsi/mpt3sas/mpt3sas_base.c:5256 _base_allocate_memory_pools()
warn: 'ioc->internal_lookup' double freed

Link: https://lore.kernel.org/r/20200508110738.30732-1-suganath-prabu.subramani@broadcom.com
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Suganath Prabu S <suganath-prabu.subramani@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/mpt3sas/mpt3sas_base.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 7af7a0859478..8d52afd1f71d 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -3136,7 +3136,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
 		ioc->scsi_lookup = NULL;
 	}
 	kfree(ioc->hpr_lookup);
+	ioc->hpr_lookup = NULL;
 	kfree(ioc->internal_lookup);
+	ioc->internal_lookup = NULL;
 	if (ioc->chain_lookup) {
 		for (i = 0; i < ioc->chain_depth; i++) {
 			if (ioc->chain_lookup[i].chain_buffer)

From e7d1195fdf4aefda4a3ac062176728bd5cac7f05 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Thu, 7 May 2020 23:34:28 +0200
Subject: [PATCH 0027/2658] dlm: remove BUG() before panic()

[ Upstream commit fe204591cc9480347af7d2d6029b24a62e449486 ]

Building a kernel with clang sometimes fails with an objtool error in dlm:

fs/dlm/lock.o: warning: objtool: revert_lock_pc()+0xbd: can't find jump dest instruction at .text+0xd7fc

The problem is that BUG() never returns and the compiler knows
that anything after it is unreachable, however the panic still
emits some code that does not get fully eliminated.

Having both BUG() and panic() is really pointless as the BUG()
kills the current process and the subsequent panic() never hits.
In most cases, we probably don't really want either and should
replace the DLM_ASSERT() statements with WARN_ON(), as has
been done for some of them.

Remove the BUG() here so the user at least sees the panic message
and we can reliably build randconfig kernels.

Fixes: e7fd41792fc0 ("[DLM] The core of the DLM for GFS2/CLVM")
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: clang-built-linux@googlegroups.com
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/dlm/dlm_internal.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/fs/dlm/dlm_internal.h b/fs/dlm/dlm_internal.h
index 5eff6ea3e27f..63e856d90ed0 100644
--- a/fs/dlm/dlm_internal.h
+++ b/fs/dlm/dlm_internal.h
@@ -92,7 +92,6 @@ do { \
                __LINE__, __FILE__, #x, jiffies); \
     {do} \
     printk("\n"); \
-    BUG(); \
     panic("DLM:  Record message above and reboot.\n"); \
   } \
 }

From 516f1ab582629190dda8c197a64dfaabc8e7a26a Mon Sep 17 00:00:00 2001
From: Tero Kristo <t-kristo@ti.com>
Date: Wed, 29 Apr 2020 16:13:39 +0300
Subject: [PATCH 0028/2658] clk: ti: composite: fix memory leak

[ Upstream commit c7c1cbbc9217ebb5601b88d138d4a5358548de9d ]

The parent_names is never released for a component clock definition,
causing some memory leak. Fix by releasing it once it is no longer
needed.

Reported-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Tero Kristo <t-kristo@ti.com>
Link: https://lkml.kernel.org/r/20200429131341.4697-2-t-kristo@ti.com
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/ti/composite.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/ti/composite.c b/drivers/clk/ti/composite.c
index dbef218fe5ec..14201c52b44b 100644
--- a/drivers/clk/ti/composite.c
+++ b/drivers/clk/ti/composite.c
@@ -228,6 +228,7 @@ static void __init _register_composite(struct clk_hw *hw,
 		if (!cclk->comp_clks[i])
 			continue;
 		list_del(&cclk->comp_clks[i]->link);
+		kfree(cclk->comp_clks[i]->parent_names);
 		kfree(cclk->comp_clks[i]);
 	}
 

From b79f715a89869445b492b8efc41b9c5cf0675698 Mon Sep 17 00:00:00 2001
From: Gregory CLEMENT <gregory.clement@bootlin.com>
Date: Tue, 12 May 2020 13:53:22 +0200
Subject: [PATCH 0029/2658] tty: n_gsm: Fix SOF skipping

[ Upstream commit 84d6f81c1fb58b56eba81ff0a36cf31946064b40 ]

For at least some modems like the TELIT LE910, skipping SOF makes
transfers blocking indefinitely after a short amount of data
transferred.

Given the small improvement provided by skipping the SOF (just one
byte on about 100 bytes), it seems better to completely remove this
"feature" than make it optional.

Fixes: e1eaea46bb40 ("tty: n_gsm line discipline")
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Link: https://lore.kernel.org/r/20200512115323.1447922-3-gregory.clement@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/n_gsm.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 6060c3e8925e..08aaf993221e 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -685,7 +685,6 @@ static void gsm_data_kick(struct gsm_mux *gsm)
 {
 	struct gsm_msg *msg, *nmsg;
 	int len;
-	int skip_sof = 0;
 
 	list_for_each_entry_safe(msg, nmsg, &gsm->tx_list, list) {
 		if (gsm->constipated && msg->addr)
@@ -707,15 +706,10 @@ static void gsm_data_kick(struct gsm_mux *gsm)
 			print_hex_dump_bytes("gsm_data_kick: ",
 					     DUMP_PREFIX_OFFSET,
 					     gsm->txframe, len);
-
-		if (gsm->output(gsm, gsm->txframe + skip_sof,
-						len - skip_sof) < 0)
+		if (gsm->output(gsm, gsm->txframe, len) < 0)
 			break;
 		/* FIXME: Can eliminate one SOF in many more cases */
 		gsm->tx_bytes -= msg->len;
-		/* For a burst of frames skip the extra SOF within the
-		   burst */
-		skip_sof = 1;
 
 		list_del(&msg->list);
 		kfree(msg);

From e89731e6b6ac19c8546d6cc826a1c025b9adfeca Mon Sep 17 00:00:00 2001
From: Gregory CLEMENT <gregory.clement@bootlin.com>
Date: Tue, 12 May 2020 13:53:23 +0200
Subject: [PATCH 0030/2658] tty: n_gsm: Fix waking up upper tty layer when room
 available

[ Upstream commit 01dbb362f0a114fbce19c8abe4cd6f4710e934d5 ]

Warn the upper layer when n_gms is ready to receive data
again. Without this the associated virtual tty remains blocked
indefinitely.

Fixes: e1eaea46bb40 ("tty: n_gsm line discipline")
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Link: https://lore.kernel.org/r/20200512115323.1447922-4-gregory.clement@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/n_gsm.c | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 08aaf993221e..0020de4fe66f 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -681,7 +681,7 @@ static struct gsm_msg *gsm_data_alloc(struct gsm_mux *gsm, u8 addr, int len,
  *	FIXME: lock against link layer control transmissions
  */
 
-static void gsm_data_kick(struct gsm_mux *gsm)
+static void gsm_data_kick(struct gsm_mux *gsm, struct gsm_dlci *dlci)
 {
 	struct gsm_msg *msg, *nmsg;
 	int len;
@@ -713,6 +713,24 @@ static void gsm_data_kick(struct gsm_mux *gsm)
 
 		list_del(&msg->list);
 		kfree(msg);
+
+		if (dlci) {
+			tty_port_tty_wakeup(&dlci->port);
+		} else {
+			int i = 0;
+
+			for (i = 0; i < NUM_DLCI; i++) {
+				struct gsm_dlci *dlci;
+
+				dlci = gsm->dlci[i];
+				if (dlci == NULL) {
+					i++;
+					continue;
+				}
+
+				tty_port_tty_wakeup(&dlci->port);
+			}
+		}
 	}
 }
 
@@ -764,7 +782,7 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg)
 	/* Add to the actual output queue */
 	list_add_tail(&msg->list, &gsm->tx_list);
 	gsm->tx_bytes += msg->len;
-	gsm_data_kick(gsm);
+	gsm_data_kick(gsm, dlci);
 }
 
 /**
@@ -1225,7 +1243,7 @@ static void gsm_control_message(struct gsm_mux *gsm, unsigned int command,
 		gsm_control_reply(gsm, CMD_FCON, NULL, 0);
 		/* Kick the link in case it is idling */
 		spin_lock_irqsave(&gsm->tx_lock, flags);
-		gsm_data_kick(gsm);
+		gsm_data_kick(gsm, NULL);
 		spin_unlock_irqrestore(&gsm->tx_lock, flags);
 		break;
 	case CMD_FCOFF:
@@ -2423,7 +2441,7 @@ static void gsmld_write_wakeup(struct tty_struct *tty)
 	/* Queue poll */
 	clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
 	spin_lock_irqsave(&gsm->tx_lock, flags);
-	gsm_data_kick(gsm);
+	gsm_data_kick(gsm, NULL);
 	if (gsm->tx_bytes < TX_THRESH_LO) {
 		gsm_dlci_data_sweep(gsm);
 	}

From fddb28c7f42e83fc5b1efc494268923ea968bfdf Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Fri, 8 May 2020 14:33:58 +1000
Subject: [PATCH 0031/2658] powerpc/pseries/ras: Fix FWNMI_VALID off by one

[ Upstream commit deb70f7a35a22dffa55b2c3aac71bc6fb0f486ce ]

This was discovered developing qemu fwnmi sreset support. This
off-by-one bug means the last 16 bytes of the rtas area can not
be used for a 16 byte save area.

It's not a serious bug, and QEMU implementation has to retain a
workaround for old kernels, but it's good to tighten it.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Acked-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
Link: https://lore.kernel.org/r/20200508043408.886394-7-npiggin@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/ras.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
index 9795e52bab3d..9e817c1b7808 100644
--- a/arch/powerpc/platforms/pseries/ras.c
+++ b/arch/powerpc/platforms/pseries/ras.c
@@ -265,10 +265,11 @@ static irqreturn_t ras_error_interrupt(int irq, void *dev_id)
 /*
  * Some versions of FWNMI place the buffer inside the 4kB page starting at
  * 0x7000. Other versions place it inside the rtas buffer. We check both.
+ * Minimum size of the buffer is 16 bytes.
  */
 #define VALID_FWNMI_BUFFER(A) \
-	((((A) >= 0x7000) && ((A) < 0x7ff0)) || \
-	(((A) >= rtas.base) && ((A) < (rtas.base + rtas.size - 16))))
+	((((A) >= 0x7000) && ((A) <= 0x8000 - 16)) || \
+	(((A) >= rtas.base) && ((A) <= (rtas.base + rtas.size - 16))))
 
 /*
  * Get the error information for errors coming through the

From 102fb1ba852f08832a97c6f2eb20d645d12d99a5 Mon Sep 17 00:00:00 2001
From: Geoff Levand <geoff@infradead.org>
Date: Sat, 9 May 2020 18:58:32 +0000
Subject: [PATCH 0032/2658] powerpc/ps3: Fix kexec shutdown hang

[ Upstream commit 126554465d93b10662742128918a5fc338cda4aa ]

The ps3_mm_region_destroy() and ps3_mm_vas_destroy() routines
are called very late in the shutdown via kexec's mmu_cleanup_all
routine.  By the time mmu_cleanup_all runs it is too late to use
udbg_printf, and calling it will cause PS3 systems to hang.

Remove all debugging statements from ps3_mm_region_destroy() and
ps3_mm_vas_destroy() and replace any error reporting with calls
to lv1_panic.

With this change builds with 'DEBUG' defined will not cause kexec
reboots to hang, and builds with 'DEBUG' defined or not will end
in lv1_panic if an error is encountered.

Signed-off-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/7325c4af2b4c989c19d6a26b90b1fec9c0615ddf.1589049250.git.geoff@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/ps3/mm.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/arch/powerpc/platforms/ps3/mm.c b/arch/powerpc/platforms/ps3/mm.c
index b0f34663b1ae..19bae78b1f25 100644
--- a/arch/powerpc/platforms/ps3/mm.c
+++ b/arch/powerpc/platforms/ps3/mm.c
@@ -212,13 +212,14 @@ void ps3_mm_vas_destroy(void)
 {
 	int result;
 
-	DBG("%s:%d: map.vas_id    = %llu\n", __func__, __LINE__, map.vas_id);
-
 	if (map.vas_id) {
 		result = lv1_select_virtual_address_space(0);
-		BUG_ON(result);
-		result = lv1_destruct_virtual_address_space(map.vas_id);
-		BUG_ON(result);
+		result += lv1_destruct_virtual_address_space(map.vas_id);
+
+		if (result) {
+			lv1_panic(0);
+		}
+
 		map.vas_id = 0;
 	}
 }
@@ -316,19 +317,20 @@ static void ps3_mm_region_destroy(struct mem_region *r)
 	int result;
 
 	if (!r->destroy) {
-		pr_info("%s:%d: Not destroying high region: %llxh %llxh\n",
-			__func__, __LINE__, r->base, r->size);
 		return;
 	}
 
-	DBG("%s:%d: r->base = %llxh\n", __func__, __LINE__, r->base);
-
 	if (r->base) {
 		result = lv1_release_memory(r->base);
-		BUG_ON(result);
+
+		if (result) {
+			lv1_panic(0);
+		}
+
 		r->size = r->base = r->offset = 0;
 		map.total = map.rm.size;
 	}
+
 	ps3_mm_set_repository_highmem(NULL);
 }
 

From 4448e33e28131d1e33fdd3c964838dd1eaef8a58 Mon Sep 17 00:00:00 2001
From: Alex Williamson <alex.williamson@redhat.com>
Date: Wed, 8 Apr 2020 11:45:28 -0600
Subject: [PATCH 0033/2658] vfio-pci: Mask cap zero

[ Upstream commit bc138db1b96264b9c1779cf18d5a3b186aa90066 ]

The PCI Code and ID Assignment Specification changed capability ID 0
from reserved to a NULL capability in the v1.1 revision.  The NULL
capability is defined to include only the 16-bit capability header,
ie. only the ID and next pointer.  Unfortunately vfio-pci creates a
map of config space, where ID 0 is used to reserve the standard type
0 header.  Finding an actual capability with this ID therefore results
in a bogus range marked in that map and conflicts with subsequent
capabilities.  As this seems to be a dummy capability anyway and we
already support dropping capabilities, let's hide this one rather than
delving into the potentially subtle dependencies within our map.

Seen on an NVIDIA Tesla T4.

Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/pci/vfio_pci_config.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
index bf65572f47a8..666b234acca0 100644
--- a/drivers/vfio/pci/vfio_pci_config.c
+++ b/drivers/vfio/pci/vfio_pci_config.c
@@ -1405,7 +1405,12 @@ static int vfio_cap_init(struct vfio_pci_device *vdev)
 		if (ret)
 			return ret;
 
-		if (cap <= PCI_CAP_ID_MAX) {
+		/*
+		 * ID 0 is a NULL capability, conflicting with our fake
+		 * PCI_CAP_ID_BASIC.  As it has no content, consider it
+		 * hidden for now.
+		 */
+		if (cap && cap <= PCI_CAP_ID_MAX) {
 			len = pci_cap_length[cap];
 			if (len == 0xFF) { /* Variable length */
 				len = vfio_cap_len(vdev, cap, pos);

From 291cc40edfebd50fb058c08f9ad6343ee99983ae Mon Sep 17 00:00:00 2001
From: Qais Yousef <qais.yousef@arm.com>
Date: Mon, 18 May 2020 16:49:29 +0100
Subject: [PATCH 0034/2658] usb/ohci-platform: Fix a warning when hibernating

[ Upstream commit 1cb3b0095c3d0bb96912bfbbce4fc006d41f367c ]

The following warning was observed when attempting to suspend to disk
using a USB flash as a swap device.

[  111.779649] ------------[ cut here ]------------
[  111.788382] URB (____ptrval____) submitted while active
[  111.796646] WARNING: CPU: 3 PID: 365 at drivers/usb/core/urb.c:363 usb_submit_urb+0x3d8/0x590
[  111.805417] Modules linked in:
[  111.808584] CPU: 3 PID: 365 Comm: kworker/3:2 Not tainted 5.6.0-rc6-00002-gdfd1731f9a3e-dirty #545
[  111.817796] Hardware name: ARM Juno development board (r2) (DT)
[  111.823896] Workqueue: usb_hub_wq hub_event
[  111.828217] pstate: 60000005 (nZCv daif -PAN -UAO)
[  111.833156] pc : usb_submit_urb+0x3d8/0x590
[  111.837471] lr : usb_submit_urb+0x3d8/0x590
[  111.841783] sp : ffff800018de38b0
[  111.845205] x29: ffff800018de38b0 x28: 0000000000000003
[  111.850682] x27: ffff000970530b20 x26: ffff8000133fd000
[  111.856159] x25: ffff8000133fd000 x24: ffff800018de3b38
[  111.861635] x23: 0000000000000004 x22: 0000000000000c00
[  111.867112] x21: 0000000000000000 x20: 00000000fffffff0
[  111.872589] x19: ffff0009704e7a00 x18: ffffffffffffffff
[  111.878065] x17: 00000000a7c8f4bc x16: 000000002af33de8
[  111.883542] x15: ffff8000133fda88 x14: 0720072007200720
[  111.889019] x13: 0720072007200720 x12: 0720072007200720
[  111.894496] x11: 0000000000000000 x10: 00000000a5286134
[  111.899973] x9 : 0000000000000002 x8 : ffff000970c837a0
[  111.905449] x7 : 0000000000000000 x6 : ffff800018de3570
[  111.910926] x5 : 0000000000000001 x4 : 0000000000000003
[  111.916401] x3 : 0000000000000000 x2 : ffff800013427118
[  111.921879] x1 : 9d4e965b4b7d7c00 x0 : 0000000000000000
[  111.927356] Call trace:
[  111.929892]  usb_submit_urb+0x3d8/0x590
[  111.933852]  hub_activate+0x108/0x7f0
[  111.937633]  hub_resume+0xac/0x148
[  111.941149]  usb_resume_interface.isra.10+0x60/0x138
[  111.946265]  usb_resume_both+0xe4/0x140
[  111.950225]  usb_runtime_resume+0x24/0x30
[  111.954365]  __rpm_callback+0xdc/0x138
[  111.958236]  rpm_callback+0x34/0x98
[  111.961841]  rpm_resume+0x4a8/0x720
[  111.965445]  rpm_resume+0x50c/0x720
[  111.969049]  __pm_runtime_resume+0x4c/0xb8
[  111.973276]  usb_autopm_get_interface+0x28/0x60
[  111.977948]  hub_event+0x80/0x16d8
[  111.981466]  process_one_work+0x2a4/0x748
[  111.985604]  worker_thread+0x48/0x498
[  111.989387]  kthread+0x13c/0x140
[  111.992725]  ret_from_fork+0x10/0x18
[  111.996415] irq event stamp: 354
[  111.999756] hardirqs last  enabled at (353): [<ffff80001019ea1c>] console_unlock+0x504/0x5b8
[  112.008441] hardirqs last disabled at (354): [<ffff8000100a95d0>] do_debug_exception+0x1a8/0x258
[  112.017479] softirqs last  enabled at (350): [<ffff8000100818a4>] __do_softirq+0x4bc/0x568
[  112.025984] softirqs last disabled at (343): [<ffff8000101145a4>] irq_exit+0x144/0x150
[  112.034129] ---[ end trace dc96030b9cf6c8a3 ]---

The problem was tracked down to a missing call to
pm_runtime_set_active() on resume in ohci-platform.

Link: https://lore.kernel.org/lkml/20200323143857.db5zphxhq4hz3hmd@e107158-lin.cambridge.arm.com/
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Qais Yousef <qais.yousef@arm.com>
CC: Tony Prisk <linux@prisktech.co.nz>
CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CC: Mathias Nyman <mathias.nyman@intel.com>
CC: Oliver Neukum <oneukum@suse.de>
CC: linux-arm-kernel@lists.infradead.org
CC: linux-usb@vger.kernel.org
CC: linux-kernel@vger.kernel.org
Link: https://lore.kernel.org/r/20200518154931.6144-1-qais.yousef@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/ohci-platform.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/host/ohci-platform.c b/drivers/usb/host/ohci-platform.c
index c2669f185f65..0e5580e6f35c 100644
--- a/drivers/usb/host/ohci-platform.c
+++ b/drivers/usb/host/ohci-platform.c
@@ -339,6 +339,11 @@ static int ohci_platform_resume(struct device *dev)
 	}
 
 	ohci_resume(hcd, false);
+
+	pm_runtime_disable(dev);
+	pm_runtime_set_active(dev);
+	pm_runtime_enable(dev);
+
 	return 0;
 }
 #endif /* CONFIG_PM_SLEEP */

From 32842769c960a8b041a0b4d9dd81a0dfc6715abb Mon Sep 17 00:00:00 2001
From: Tang Bin <tangbin@cmss.chinamobile.com>
Date: Wed, 13 May 2020 21:26:47 +0800
Subject: [PATCH 0035/2658] USB: host: ehci-mxc: Add error handling in
 ehci_mxc_drv_probe()

[ Upstream commit d49292025f79693d3348f8e2029a8b4703be0f0a ]

The function ehci_mxc_drv_probe() does not perform sufficient error
checking after executing platform_get_irq(), thus fix it.

Fixes: 7e8d5cd93fac ("USB: Add EHCI support for MX27 and MX31 based boards")
Signed-off-by: Zhang Shengju <zhangshengju@cmss.chinamobile.com>
Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20200513132647.5456-1-tangbin@cmss.chinamobile.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/ehci-mxc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
index c7a9b31eeaef..637079a35003 100644
--- a/drivers/usb/host/ehci-mxc.c
+++ b/drivers/usb/host/ehci-mxc.c
@@ -63,6 +63,8 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev)
 	}
 
 	irq = platform_get_irq(pdev, 0);
+	if (irq < 0)
+		return irq;
 
 	hcd = usb_create_hcd(&ehci_mxc_hc_driver, dev, dev_name(dev));
 	if (!hcd)

From f2f04b7f9d8408d4962dd0f12d61b1026f4d6ee0 Mon Sep 17 00:00:00 2001
From: Gregory CLEMENT <gregory.clement@bootlin.com>
Date: Mon, 18 May 2020 10:45:13 +0200
Subject: [PATCH 0036/2658] tty: n_gsm: Fix bogus i++ in gsm_data_kick

[ Upstream commit 4dd31f1ffec6c370c3c2e0c605628bf5e16d5c46 ]

When submitting the previous fix "tty: n_gsm: Fix waking up upper tty
layer when room available". It was suggested to switch from a while to
a for loop, but when doing it, there was a remaining bogus i++.

This patch removes this i++ and also reorganizes the code making it more
compact.

Fixes: e1eaea46bb40 ("tty: n_gsm line discipline")
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Link: https://lore.kernel.org/r/20200518084517.2173242-3-gregory.clement@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/n_gsm.c | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 0020de4fe66f..9b2beada2ff3 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -719,17 +719,9 @@ static void gsm_data_kick(struct gsm_mux *gsm, struct gsm_dlci *dlci)
 		} else {
 			int i = 0;
 
-			for (i = 0; i < NUM_DLCI; i++) {
-				struct gsm_dlci *dlci;
-
-				dlci = gsm->dlci[i];
-				if (dlci == NULL) {
-					i++;
-					continue;
-				}
-
-				tty_port_tty_wakeup(&dlci->port);
-			}
+			for (i = 0; i < NUM_DLCI; i++)
+				if (gsm->dlci[i])
+					tty_port_tty_wakeup(&gsm->dlci[i]->port);
 		}
 	}
 }

From 7aed6851c957b264c9cf3d93f66e15364125b03a Mon Sep 17 00:00:00 2001
From: Marek Szyprowski <m.szyprowski@samsung.com>
Date: Tue, 19 May 2020 12:26:52 +0200
Subject: [PATCH 0037/2658] clk: samsung: exynos5433: Add IGNORE_UNUSED flag to
 sclk_i2s1

[ Upstream commit 25bdae0f1c6609ceaf55fe6700654f0be2253d8e ]

Mark the SCLK clock for Exynos5433 I2S1 device with IGNORE_UNUSED flag to
match its behaviour with SCLK clock for AUD_I2S (I2S0) device until
a proper fix for Exynos I2S driver is ready.

This fixes the following synchronous abort issue revealed by the probe
order change caused by the commit 93d2e4322aa7 ("of: platform: Batch
fwnode parsing when adding all top level devices")

Internal error: synchronous external abort: 96000210 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 50 Comm: kworker/0:1 Not tainted 5.7.0-rc5+ #701
Hardware name: Samsung TM2E board (DT)
Workqueue: events deferred_probe_work_func
pstate: 60000005 (nZCv daif -PAN -UAO)
pc : samsung_i2s_probe+0x768/0x8f0
lr : samsung_i2s_probe+0x688/0x8f0
...
Call trace:
 samsung_i2s_probe+0x768/0x8f0
 platform_drv_probe+0x50/0xa8
 really_probe+0x108/0x370
 driver_probe_device+0x54/0xb8
 __device_attach_driver+0x90/0xc0
 bus_for_each_drv+0x70/0xc8
 __device_attach+0xdc/0x140
 device_initial_probe+0x10/0x18
 bus_probe_device+0x94/0xa0
 deferred_probe_work_func+0x70/0xa8
 process_one_work+0x2a8/0x718
 worker_thread+0x48/0x470
 kthread+0x134/0x160
 ret_from_fork+0x10/0x1c
Code: 17ffffaf d503201f f94086c0 91003000 (88dffc00)
---[ end trace ccf721c9400ddbd6 ]---

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/samsung/clk-exynos5433.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/samsung/clk-exynos5433.c b/drivers/clk/samsung/clk-exynos5433.c
index 91c89ac193b9..77ae2d21c488 100644
--- a/drivers/clk/samsung/clk-exynos5433.c
+++ b/drivers/clk/samsung/clk-exynos5433.c
@@ -1708,7 +1708,8 @@ static struct samsung_gate_clock peric_gate_clks[] __initdata = {
 	GATE(CLK_SCLK_PCM1, "sclk_pcm1", "sclk_pcm1_peric",
 			ENABLE_SCLK_PERIC, 7, CLK_SET_RATE_PARENT, 0),
 	GATE(CLK_SCLK_I2S1, "sclk_i2s1", "sclk_i2s1_peric",
-			ENABLE_SCLK_PERIC, 6, CLK_SET_RATE_PARENT, 0),
+			ENABLE_SCLK_PERIC, 6,
+			CLK_SET_RATE_PARENT | CLK_IGNORE_UNUSED, 0),
 	GATE(CLK_SCLK_SPI2, "sclk_spi2", "sclk_spi2_peric", ENABLE_SCLK_PERIC,
 			5, CLK_SET_RATE_PARENT, 0),
 	GATE(CLK_SCLK_SPI1, "sclk_spi1", "sclk_spi1_peric", ENABLE_SCLK_PERIC,

From 8d9c29b0562b616ec9aaf87b1e554c851f8ac4e7 Mon Sep 17 00:00:00 2001
From: Stefan Riedmueller <s.riedmueller@phytec.de>
Date: Fri, 3 Apr 2020 15:07:28 +0200
Subject: [PATCH 0038/2658] watchdog: da9062: No need to ping manually before
 setting timeout

[ Upstream commit a0948ddba65f4f6d3cfb5e2b84685485d0452966 ]

There is actually no need to ping the watchdog before disabling it
during timeout change. Disabling the watchdog already takes care of
resetting the counter.

This fixes an issue during boot when the userspace watchdog handler takes
over and the watchdog is already running. Opening the watchdog in this case
leads to the first ping and directly after that without the required
heartbeat delay a second ping issued by the set_timeout call. Due to the
missing delay this resulted in a reset.

Signed-off-by: Stefan Riedmueller <s.riedmueller@phytec.de>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
Link: https://lore.kernel.org/r/20200403130728.39260-3-s.riedmueller@phytec.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/da9062_wdt.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/watchdog/da9062_wdt.c b/drivers/watchdog/da9062_wdt.c
index daeb645fcea8..519419136ce8 100644
--- a/drivers/watchdog/da9062_wdt.c
+++ b/drivers/watchdog/da9062_wdt.c
@@ -94,11 +94,6 @@ static int da9062_wdt_update_timeout_register(struct da9062_watchdog *wdt,
 					      unsigned int regval)
 {
 	struct da9062 *chip = wdt->hw;
-	int ret;
-
-	ret = da9062_reset_watchdog_timer(wdt);
-	if (ret)
-		return ret;
 
 	return regmap_update_bits(chip->regmap,
 				  DA9062AA_CONTROL_D,

From c6b964b4852dccdb4fd7c8bfd1df21ddd36d9f9f Mon Sep 17 00:00:00 2001
From: Fabrice Gasnier <fabrice.gasnier@st.com>
Date: Thu, 23 Apr 2020 13:55:53 +0200
Subject: [PATCH 0039/2658] usb: dwc2: gadget: move gadget resume after the
 core is in L0 state

[ Upstream commit 8c935deacebb8fac8f41378701eb79d12f3c2e2d ]

When the remote wakeup interrupt is triggered, lx_state is resumed from L2
to L0 state. But when the gadget resume is called, lx_state is still L2.
This prevents the resume callback to queue any request. Any attempt
to queue a request from resume callback will result in:
- "submit request only in active state" debug message to be issued
- dwc2_hsotg_ep_queue() returns -EAGAIN

Call the gadget resume routine after the core is in L0 state.

Fixes: f81f46e1f530 ("usb: dwc2: implement hibernation during bus suspend/resume")

Acked-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc2/core_intr.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/dwc2/core_intr.c b/drivers/usb/dwc2/core_intr.c
index 27daa42788b1..796d60d49ac5 100644
--- a/drivers/usb/dwc2/core_intr.c
+++ b/drivers/usb/dwc2/core_intr.c
@@ -363,10 +363,13 @@ static void dwc2_handle_wakeup_detected_intr(struct dwc2_hsotg *hsotg)
 			if (ret && (ret != -ENOTSUPP))
 				dev_err(hsotg->dev, "exit hibernation failed\n");
 
+			/* Change to L0 state */
+			hsotg->lx_state = DWC2_L0;
 			call_gadget(hsotg, resume);
+		} else {
+			/* Change to L0 state */
+			hsotg->lx_state = DWC2_L0;
 		}
-		/* Change to L0 state */
-		hsotg->lx_state = DWC2_L0;
 	} else {
 		if (hsotg->core_params->hibernation) {
 			dwc2_writel(GINTSTS_WKUPINT, hsotg->regs + GINTSTS);

From 2309ce66833c67345318c96026581c3a2db3ea9a Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <natechancellor@gmail.com>
Date: Thu, 23 Apr 2020 09:29:24 -0700
Subject: [PATCH 0040/2658] USB: gadget: udc: s3c2410_udc: Remove pointless
 NULL check in s3c2410_udc_nuke

[ Upstream commit 7a0fbcf7c308920bc6116b3a5fb21c8cc5fec128 ]

Clang warns:

drivers/usb/gadget/udc/s3c2410_udc.c:255:11: warning: comparison of
address of 'ep->queue' equal to a null pointer is always false
[-Wtautological-pointer-compare]
        if (&ep->queue == NULL)
             ~~~~^~~~~    ~~~~
1 warning generated.

It is not wrong, queue is not a pointer so if ep is not NULL, the
address of queue cannot be NULL. No other driver does a check like this
and this check has been around since the driver was first introduced,
presumably with no issues so it does not seem like this check should be
something else. Just remove it.

Commit afe956c577b2d ("kbuild: Enable -Wtautological-compare") exposed
this but it is not the root cause of the warning.

Fixes: 3fc154b6b8134 ("USB Gadget driver for Samsung s3c2410 ARM SoC")
Link: https://github.com/ClangBuiltLinux/linux/issues/1004
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/s3c2410_udc.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/usb/gadget/udc/s3c2410_udc.c b/drivers/usb/gadget/udc/s3c2410_udc.c
index eb3571ee59e3..08153a48704b 100644
--- a/drivers/usb/gadget/udc/s3c2410_udc.c
+++ b/drivers/usb/gadget/udc/s3c2410_udc.c
@@ -269,10 +269,6 @@ static void s3c2410_udc_done(struct s3c2410_ep *ep,
 static void s3c2410_udc_nuke(struct s3c2410_udc *udc,
 		struct s3c2410_ep *ep, int status)
 {
-	/* Sanity check */
-	if (&ep->queue == NULL)
-		return;
-
 	while (!list_empty(&ep->queue)) {
 		struct s3c2410_request *req;
 		req = list_entry(ep->queue.next, struct s3c2410_request,

From 5ba368cf6d5b502f204938e9a50a47639d7a928d Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Thu, 21 May 2020 16:13:00 +0100
Subject: [PATCH 0041/2658] usb: gadget: lpc32xx_udc: don't dereference ep
 pointer before null check

[ Upstream commit eafa80041645cd7604c4357b1a0cd4a3c81f2227 ]

Currently pointer ep is being dereferenced before it is null checked
leading to a null pointer dereference issue.  Fix this by only assigning
pointer udc once ep is known to be not null.  Also remove a debug
message that requires a valid udc which may not be possible at that
point.

Addresses-Coverity: ("Dereference before null check")
Fixes: 24a28e428351 ("USB: gadget driver for LPC32xx")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/lpc32xx_udc.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c
index ea43cb74a6f2..c9590949e4f0 100644
--- a/drivers/usb/gadget/udc/lpc32xx_udc.c
+++ b/drivers/usb/gadget/udc/lpc32xx_udc.c
@@ -1662,17 +1662,17 @@ static int lpc32xx_ep_enable(struct usb_ep *_ep,
 			     const struct usb_endpoint_descriptor *desc)
 {
 	struct lpc32xx_ep *ep = container_of(_ep, struct lpc32xx_ep, ep);
-	struct lpc32xx_udc *udc = ep->udc;
+	struct lpc32xx_udc *udc;
 	u16 maxpacket;
 	u32 tmp;
 	unsigned long flags;
 
 	/* Verify EP data */
 	if ((!_ep) || (!ep) || (!desc) ||
-	    (desc->bDescriptorType != USB_DT_ENDPOINT)) {
-		dev_dbg(udc->dev, "bad ep or descriptor\n");
+	    (desc->bDescriptorType != USB_DT_ENDPOINT))
 		return -EINVAL;
-	}
+
+	udc = ep->udc;
 	maxpacket = usb_endpoint_maxp(desc);
 	if ((maxpacket == 0) || (maxpacket > ep->maxpacket)) {
 		dev_dbg(udc->dev, "bad ep descriptor's packet size\n");
@@ -1920,7 +1920,7 @@ static int lpc32xx_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
 static int lpc32xx_ep_set_halt(struct usb_ep *_ep, int value)
 {
 	struct lpc32xx_ep *ep = container_of(_ep, struct lpc32xx_ep, ep);
-	struct lpc32xx_udc *udc = ep->udc;
+	struct lpc32xx_udc *udc;
 	unsigned long flags;
 
 	if ((!ep) || (ep->hwep_num <= 1))
@@ -1930,6 +1930,7 @@ static int lpc32xx_ep_set_halt(struct usb_ep *_ep, int value)
 	if (ep->is_in)
 		return -EAGAIN;
 
+	udc = ep->udc;
 	spin_lock_irqsave(&udc->lock, flags);
 
 	if (value == 1) {

From 21356408ee0e2b12704e38625f1570e85111e382 Mon Sep 17 00:00:00 2001
From: Qiushi Wu <wu000273@umn.edu>
Date: Fri, 22 May 2020 23:06:25 -0500
Subject: [PATCH 0042/2658] usb: gadget: fix potential double-free in
 m66592_probe.

[ Upstream commit 44734a594196bf1d474212f38fe3a0d37a73278b ]

m66592_free_request() is called under label "err_add_udc"
and "clean_up", and m66592->ep0_req is not set to NULL after
first free, leading to a double-free. Fix this issue by
setting m66592->ep0_req to NULL after the first free.

Fixes: 0f91349b89f3 ("usb: gadget: convert all users to the new udc infrastructure")
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/m66592-udc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/m66592-udc.c b/drivers/usb/gadget/udc/m66592-udc.c
index b1cfa96cc88f..db95eab8b432 100644
--- a/drivers/usb/gadget/udc/m66592-udc.c
+++ b/drivers/usb/gadget/udc/m66592-udc.c
@@ -1684,7 +1684,7 @@ static int m66592_probe(struct platform_device *pdev)
 
 err_add_udc:
 	m66592_free_request(&m66592->ep[0].ep, m66592->ep0_req);
-
+	m66592->ep0_req = NULL;
 clean_up3:
 	if (m66592->pdata->on_chip) {
 		clk_disable(m66592->clk);

From 1f927559c0313dd745940b8d6037f1385006fcb6 Mon Sep 17 00:00:00 2001
From: Fedor Tokarev <ftokarev@gmail.com>
Date: Sat, 28 Mar 2020 14:56:55 +0300
Subject: [PATCH 0043/2658] net: sunrpc: Fix off-by-one issues in 'rpc_ntop6'

[ Upstream commit 118917d696dc59fd3e1741012c2f9db2294bed6f ]

Fix off-by-one issues in 'rpc_ntop6':
 - 'snprintf' returns the number of characters which would have been
   written if enough space had been available, excluding the terminating
   null byte. Thus, a return value of 'sizeof(scopebuf)' means that the
   last character was dropped.
 - 'strcat' adds a terminating null byte to the string, thus if len ==
   buflen, the null byte is written past the end of the buffer.

Signed-off-by: Fedor Tokarev <ftokarev@gmail.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/addr.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c
index 2e0a6f92e563..8391c2785550 100644
--- a/net/sunrpc/addr.c
+++ b/net/sunrpc/addr.c
@@ -81,11 +81,11 @@ static size_t rpc_ntop6(const struct sockaddr *sap,
 
 	rc = snprintf(scopebuf, sizeof(scopebuf), "%c%u",
 			IPV6_SCOPE_DELIMITER, sin6->sin6_scope_id);
-	if (unlikely((size_t)rc > sizeof(scopebuf)))
+	if (unlikely((size_t)rc >= sizeof(scopebuf)))
 		return 0;
 
 	len += rc;
-	if (unlikely(len > buflen))
+	if (unlikely(len >= buflen))
 		return 0;
 
 	strcat(buf, scopebuf);

From a7817132f3bd8d2ef36f3be6046b8ce94f0c04ac Mon Sep 17 00:00:00 2001
From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Date: Mon, 25 May 2020 22:12:46 +0800
Subject: [PATCH 0044/2658] ASoC: fsl_asrc_dma: Fix dma_chan leak when config
 DMA channel failed

[ Upstream commit 36124fb19f1ae68a500cd76a76d40c6e81bee346 ]

fsl_asrc_dma_hw_params() invokes dma_request_channel() or
fsl_asrc_get_dma_channel(), which returns a reference of the specified
dma_chan object to "pair->dma_chan[dir]" with increased refcnt.

The reference counting issue happens in one exception handling path of
fsl_asrc_dma_hw_params(). When config DMA channel failed for Back-End,
the function forgets to decrease the refcnt increased by
dma_request_channel() or fsl_asrc_get_dma_channel(), causing a refcnt
leak.

Fix this issue by calling dma_release_channel() when config DMA channel
failed.

Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Link: https://lore.kernel.org/r/1590415966-52416-1-git-send-email-xiyuyang19@fudan.edu.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/fsl/fsl_asrc_dma.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/fsl/fsl_asrc_dma.c b/sound/soc/fsl/fsl_asrc_dma.c
index ffc000bc1f15..56a873ba08e4 100644
--- a/sound/soc/fsl/fsl_asrc_dma.c
+++ b/sound/soc/fsl/fsl_asrc_dma.c
@@ -243,6 +243,7 @@ static int fsl_asrc_dma_hw_params(struct snd_pcm_substream *substream,
 	ret = dmaengine_slave_config(pair->dma_chan[dir], &config_be);
 	if (ret) {
 		dev_err(dev, "failed to config DMA channel for Back-End\n");
+		dma_release_channel(pair->dma_chan[dir]);
 		return ret;
 	}
 

From bcd45e0a4d4d977328fc8e65f48503796269505c Mon Sep 17 00:00:00 2001
From: Stafford Horne <shorne@gmail.com>
Date: Wed, 22 Apr 2020 20:24:11 +0900
Subject: [PATCH 0045/2658] openrisc: Fix issue with argument clobbering for
 clone/fork

[ Upstream commit 6bd140e14d9aaa734ec37985b8b20a96c0ece948 ]

Working on the OpenRISC glibc port I found that sometimes clone was
working strange.  That the tls data argument sent in r7 was always
wrong.  Further investigation revealed that the arguments were getting
clobbered in the entry code.  This patch removes the code that writes to
the argument registers.  This was likely due to some old code hanging
around.

This patch fixes this up for clone and fork.  This fork clobber is
harmless but also useless so remove.

Signed-off-by: Stafford Horne <shorne@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/openrisc/kernel/entry.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
index c17e8451d997..3fbe420f49c4 100644
--- a/arch/openrisc/kernel/entry.S
+++ b/arch/openrisc/kernel/entry.S
@@ -1092,13 +1092,13 @@ ENTRY(__sys_clone)
 	l.movhi	r29,hi(sys_clone)
 	l.ori	r29,r29,lo(sys_clone)
 	l.j	_fork_save_extra_regs_and_call
-	 l.addi	r7,r1,0
+	 l.nop
 
 ENTRY(__sys_fork)
 	l.movhi	r29,hi(sys_fork)
 	l.ori	r29,r29,lo(sys_fork)
 	l.j	_fork_save_extra_regs_and_call
-	 l.addi	r3,r1,0
+	 l.nop
 
 ENTRY(sys_rt_sigreturn)
 	l.j	_sys_rt_sigreturn

From e4f6b85e429f10373354f4a31fd5af8aa6177925 Mon Sep 17 00:00:00 2001
From: Bob Peterson <rpeterso@redhat.com>
Date: Wed, 29 Apr 2020 08:45:54 -0500
Subject: [PATCH 0046/2658] gfs2: Allow lock_nolock mount to specify jid=X

[ Upstream commit ea22eee4e6027d8927099de344f7fff43c507ef9 ]

Before this patch, a simple typo accidentally added \n to the jid=
string for lock_nolock mounts. This made it impossible to mount a
gfs2 file system with a journal other than journal0. Thus:

mount -tgfs2 -o hostdata="jid=1" <device> <mount pt>

Resulted in:
mount: wrong fs type, bad option, bad superblock on <device>

In most cases this is not a problem. However, for debugging and
testing purposes we sometimes want to test the integrity of other
journals. This patch removes the unnecessary \n and thus allows
lock_nolock users to specify an alternate journal.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/ops_fstype.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index de7143e2b361..b7b43d00cc6d 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -916,7 +916,7 @@ static int init_per_node(struct gfs2_sbd *sdp, int undo)
 }
 
 static const match_table_t nolock_tokens = {
-	{ Opt_jid, "jid=%d\n", },
+	{ Opt_jid, "jid=%d", },
 	{ Opt_err, NULL },
 };
 

From d46d6596df716d023532a3884cf24b554a0e5107 Mon Sep 17 00:00:00 2001
From: Qiushi Wu <wu000273@umn.edu>
Date: Thu, 28 May 2020 15:13:53 -0500
Subject: [PATCH 0047/2658] scsi: iscsi: Fix reference count leak in
 iscsi_boot_create_kobj

[ Upstream commit 0267ffce562c8bbf9b57ebe0e38445ad04972890 ]

kobject_init_and_add() takes reference even when it fails. If this
function returns an error, kobject_put() must be called to properly
clean up the memory associated with the object.

Link: https://lore.kernel.org/r/20200528201353.14849-1-wu000273@umn.edu
Reviewed-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/iscsi_boot_sysfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/iscsi_boot_sysfs.c b/drivers/scsi/iscsi_boot_sysfs.c
index 680bf6f0ce76..476f46aad54c 100644
--- a/drivers/scsi/iscsi_boot_sysfs.c
+++ b/drivers/scsi/iscsi_boot_sysfs.c
@@ -319,7 +319,7 @@ iscsi_boot_create_kobj(struct iscsi_boot_kset *boot_kset,
 	boot_kobj->kobj.kset = boot_kset->kset;
 	if (kobject_init_and_add(&boot_kobj->kobj, &iscsi_boot_ktype,
 				 NULL, name, index)) {
-		kfree(boot_kobj);
+		kobject_put(&boot_kobj->kobj);
 		return NULL;
 	}
 	boot_kobj->data = data;

From 6534691b2b2f9543cae65bcee4ed209532d4b2a3 Mon Sep 17 00:00:00 2001
From: Jann Horn <jannh@google.com>
Date: Thu, 4 Jun 2020 16:50:17 -0700
Subject: [PATCH 0048/2658] lib/zlib: remove outdated and incorrect
 pre-increment optimization

[ Upstream commit acaab7335bd6f0c0b54ce3a00bd7f18222ce0f5f ]

The zlib inflate code has an old micro-optimization based on the
assumption that for pre-increment memory accesses, the compiler will
generate code that fits better into the processor's pipeline than what
would be generated for post-increment memory accesses.

This optimization was already removed in upstream zlib in 2016:
https://github.com/madler/zlib/commit/9aaec95e8211

This optimization causes UB according to C99, which says in section 6.5.6
"Additive operators": "If both the pointer operand and the result point to
elements of the same array object, or one past the last element of the
array object, the evaluation shall not produce an overflow; otherwise, the
behavior is undefined".

This UB is not only a theoretical concern, but can also cause trouble for
future work on compiler-based sanitizers.

According to the zlib commit, this optimization also is not optimal
anymore with modern compilers.

Replace uses of OFF, PUP and UP_UNALIGNED with their definitions in the
POSTINC case, and remove the macro definitions, just like in the upstream
patch.

Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Link: http://lkml.kernel.org/r/20200507123112.252723-1-jannh@google.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/zlib_inflate/inffast.c | 91 +++++++++++++++-----------------------
 1 file changed, 35 insertions(+), 56 deletions(-)

diff --git a/lib/zlib_inflate/inffast.c b/lib/zlib_inflate/inffast.c
index 2c13ecc5bb2c..ed1f3df27260 100644
--- a/lib/zlib_inflate/inffast.c
+++ b/lib/zlib_inflate/inffast.c
@@ -10,17 +10,6 @@
 
 #ifndef ASMINF
 
-/* Allow machine dependent optimization for post-increment or pre-increment.
-   Based on testing to date,
-   Pre-increment preferred for:
-   - PowerPC G3 (Adler)
-   - MIPS R5000 (Randers-Pehrson)
-   Post-increment preferred for:
-   - none
-   No measurable difference:
-   - Pentium III (Anderson)
-   - M68060 (Nikl)
- */
 union uu {
 	unsigned short us;
 	unsigned char b[2];
@@ -38,16 +27,6 @@ get_unaligned16(const unsigned short *p)
 	return mm.us;
 }
 
-#ifdef POSTINC
-#  define OFF 0
-#  define PUP(a) *(a)++
-#  define UP_UNALIGNED(a) get_unaligned16((a)++)
-#else
-#  define OFF 1
-#  define PUP(a) *++(a)
-#  define UP_UNALIGNED(a) get_unaligned16(++(a))
-#endif
-
 /*
    Decode literal, length, and distance codes and write out the resulting
    literal and match bytes until either not enough input or output is
@@ -115,9 +94,9 @@ void inflate_fast(z_streamp strm, unsigned start)
 
     /* copy state to local variables */
     state = (struct inflate_state *)strm->state;
-    in = strm->next_in - OFF;
+    in = strm->next_in;
     last = in + (strm->avail_in - 5);
-    out = strm->next_out - OFF;
+    out = strm->next_out;
     beg = out - (start - strm->avail_out);
     end = out + (strm->avail_out - 257);
 #ifdef INFLATE_STRICT
@@ -138,9 +117,9 @@ void inflate_fast(z_streamp strm, unsigned start)
        input data or output space */
     do {
         if (bits < 15) {
-            hold += (unsigned long)(PUP(in)) << bits;
+            hold += (unsigned long)(*in++) << bits;
             bits += 8;
-            hold += (unsigned long)(PUP(in)) << bits;
+            hold += (unsigned long)(*in++) << bits;
             bits += 8;
         }
         this = lcode[hold & lmask];
@@ -150,14 +129,14 @@ void inflate_fast(z_streamp strm, unsigned start)
         bits -= op;
         op = (unsigned)(this.op);
         if (op == 0) {                          /* literal */
-            PUP(out) = (unsigned char)(this.val);
+            *out++ = (unsigned char)(this.val);
         }
         else if (op & 16) {                     /* length base */
             len = (unsigned)(this.val);
             op &= 15;                           /* number of extra bits */
             if (op) {
                 if (bits < op) {
-                    hold += (unsigned long)(PUP(in)) << bits;
+                    hold += (unsigned long)(*in++) << bits;
                     bits += 8;
                 }
                 len += (unsigned)hold & ((1U << op) - 1);
@@ -165,9 +144,9 @@ void inflate_fast(z_streamp strm, unsigned start)
                 bits -= op;
             }
             if (bits < 15) {
-                hold += (unsigned long)(PUP(in)) << bits;
+                hold += (unsigned long)(*in++) << bits;
                 bits += 8;
-                hold += (unsigned long)(PUP(in)) << bits;
+                hold += (unsigned long)(*in++) << bits;
                 bits += 8;
             }
             this = dcode[hold & dmask];
@@ -180,10 +159,10 @@ void inflate_fast(z_streamp strm, unsigned start)
                 dist = (unsigned)(this.val);
                 op &= 15;                       /* number of extra bits */
                 if (bits < op) {
-                    hold += (unsigned long)(PUP(in)) << bits;
+                    hold += (unsigned long)(*in++) << bits;
                     bits += 8;
                     if (bits < op) {
-                        hold += (unsigned long)(PUP(in)) << bits;
+                        hold += (unsigned long)(*in++) << bits;
                         bits += 8;
                     }
                 }
@@ -205,13 +184,13 @@ void inflate_fast(z_streamp strm, unsigned start)
                         state->mode = BAD;
                         break;
                     }
-                    from = window - OFF;
+                    from = window;
                     if (write == 0) {           /* very common case */
                         from += wsize - op;
                         if (op < len) {         /* some from window */
                             len -= op;
                             do {
-                                PUP(out) = PUP(from);
+                                *out++ = *from++;
                             } while (--op);
                             from = out - dist;  /* rest from output */
                         }
@@ -222,14 +201,14 @@ void inflate_fast(z_streamp strm, unsigned start)
                         if (op < len) {         /* some from end of window */
                             len -= op;
                             do {
-                                PUP(out) = PUP(from);
+                                *out++ = *from++;
                             } while (--op);
-                            from = window - OFF;
+                            from = window;
                             if (write < len) {  /* some from start of window */
                                 op = write;
                                 len -= op;
                                 do {
-                                    PUP(out) = PUP(from);
+                                    *out++ = *from++;
                                 } while (--op);
                                 from = out - dist;      /* rest from output */
                             }
@@ -240,21 +219,21 @@ void inflate_fast(z_streamp strm, unsigned start)
                         if (op < len) {         /* some from window */
                             len -= op;
                             do {
-                                PUP(out) = PUP(from);
+                                *out++ = *from++;
                             } while (--op);
                             from = out - dist;  /* rest from output */
                         }
                     }
                     while (len > 2) {
-                        PUP(out) = PUP(from);
-                        PUP(out) = PUP(from);
-                        PUP(out) = PUP(from);
+                        *out++ = *from++;
+                        *out++ = *from++;
+                        *out++ = *from++;
                         len -= 3;
                     }
                     if (len) {
-                        PUP(out) = PUP(from);
+                        *out++ = *from++;
                         if (len > 1)
-                            PUP(out) = PUP(from);
+                            *out++ = *from++;
                     }
                 }
                 else {
@@ -264,29 +243,29 @@ void inflate_fast(z_streamp strm, unsigned start)
                     from = out - dist;          /* copy direct from output */
 		    /* minimum length is three */
 		    /* Align out addr */
-		    if (!((long)(out - 1 + OFF) & 1)) {
-			PUP(out) = PUP(from);
+		    if (!((long)(out - 1) & 1)) {
+			*out++ = *from++;
 			len--;
 		    }
-		    sout = (unsigned short *)(out - OFF);
+		    sout = (unsigned short *)(out);
 		    if (dist > 2) {
 			unsigned short *sfrom;
 
-			sfrom = (unsigned short *)(from - OFF);
+			sfrom = (unsigned short *)(from);
 			loops = len >> 1;
 			do
 #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
-			    PUP(sout) = PUP(sfrom);
+			    *sout++ = *sfrom++;
 #else
-			    PUP(sout) = UP_UNALIGNED(sfrom);
+			    *sout++ = get_unaligned16(sfrom++);
 #endif
 			while (--loops);
-			out = (unsigned char *)sout + OFF;
-			from = (unsigned char *)sfrom + OFF;
+			out = (unsigned char *)sout;
+			from = (unsigned char *)sfrom;
 		    } else { /* dist == 1 or dist == 2 */
 			unsigned short pat16;
 
-			pat16 = *(sout-1+OFF);
+			pat16 = *(sout-1);
 			if (dist == 1) {
 				union uu mm;
 				/* copy one char pattern to both bytes */
@@ -296,12 +275,12 @@ void inflate_fast(z_streamp strm, unsigned start)
 			}
 			loops = len >> 1;
 			do
-			    PUP(sout) = pat16;
+			    *sout++ = pat16;
 			while (--loops);
-			out = (unsigned char *)sout + OFF;
+			out = (unsigned char *)sout;
 		    }
 		    if (len & 1)
-			PUP(out) = PUP(from);
+			*out++ = *from++;
                 }
             }
             else if ((op & 64) == 0) {          /* 2nd level distance code */
@@ -336,8 +315,8 @@ void inflate_fast(z_streamp strm, unsigned start)
     hold &= (1U << bits) - 1;
 
     /* update state and return */
-    strm->next_in = in + OFF;
-    strm->next_out = out + OFF;
+    strm->next_in = in;
+    strm->next_out = out;
     strm->avail_in = (unsigned)(in < last ? 5 + (last - in) : 5 - (in - last));
     strm->avail_out = (unsigned)(out < end ?
                                  257 + (end - out) : 257 - (out - end));

From 5234552ef21563fc235df518a9bb9657a58592e1 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Thu, 4 Jun 2020 16:50:30 -0700
Subject: [PATCH 0049/2658] include/linux/bitops.h: avoid clang
 shift-count-overflow warnings

[ Upstream commit bd93f003b7462ae39a43c531abca37fe7073b866 ]

Clang normally does not warn about certain issues in inline functions when
it only happens in an eliminated code path. However if something else
goes wrong, it does tend to complain about the definition of hweight_long()
on 32-bit targets:

  include/linux/bitops.h:75:41: error: shift count >= width of type [-Werror,-Wshift-count-overflow]
          return sizeof(w) == 4 ? hweight32(w) : hweight64(w);
                                                 ^~~~~~~~~~~~
  include/asm-generic/bitops/const_hweight.h:29:49: note: expanded from macro 'hweight64'
   define hweight64(w) (__builtin_constant_p(w) ? __const_hweight64(w) : __arch_hweight64(w))
                                                  ^~~~~~~~~~~~~~~~~~~~
  include/asm-generic/bitops/const_hweight.h:21:76: note: expanded from macro '__const_hweight64'
   define __const_hweight64(w) (__const_hweight32(w) + __const_hweight32((w) >> 32))
                                                                             ^  ~~
  include/asm-generic/bitops/const_hweight.h:20:49: note: expanded from macro '__const_hweight32'
   define __const_hweight32(w) (__const_hweight16(w) + __const_hweight16((w) >> 16))
                                                  ^
  include/asm-generic/bitops/const_hweight.h:19:72: note: expanded from macro '__const_hweight16'
   define __const_hweight16(w) (__const_hweight8(w)  + __const_hweight8((w)  >> 8 ))
                                                                         ^
  include/asm-generic/bitops/const_hweight.h:12:9: note: expanded from macro '__const_hweight8'
            (!!((w) & (1ULL << 2))) +     \

Adding an explicit cast to __u64 avoids that warning and makes it easier
to read other output.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Link: http://lkml.kernel.org/r/20200505135513.65265-1-arnd@arndb.de
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/bitops.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/bitops.h b/include/linux/bitops.h
index ce2bb045b3fd..9b9711ea267a 100644
--- a/include/linux/bitops.h
+++ b/include/linux/bitops.h
@@ -59,7 +59,7 @@ static inline int get_count_order(unsigned int count)
 
 static __always_inline unsigned long hweight_long(unsigned long w)
 {
-	return sizeof(w) == 4 ? hweight32(w) : hweight64(w);
+	return sizeof(w) == 4 ? hweight32(w) : hweight64((__u64)w);
 }
 
 /**

From f1ad8372fbd700b2bd8c08b871149eeaf2c9ccee Mon Sep 17 00:00:00 2001
From: Nick Desaulniers <ndesaulniers@google.com>
Date: Thu, 4 Jun 2020 16:50:49 -0700
Subject: [PATCH 0050/2658] elfnote: mark all .note sections SHF_ALLOC

[ Upstream commit 51da9dfb7f20911ae4e79e9b412a9c2d4c373d4b ]

ELFNOTE_START allows callers to specify flags for .pushsection assembler
directives.  All callsites but ELF_NOTE use "a" for SHF_ALLOC.  For vdso's
that explicitly use ELF_NOTE_START and BUILD_SALT, the same section is
specified twice after preprocessing, once with "a" flag, once without.
Example:

.pushsection .note.Linux, "a", @note ;
.pushsection .note.Linux, "", @note ;

While GNU as allows this ordering, it warns for the opposite ordering,
making these directives position dependent.  We'd prefer not to precisely
match this behavior in Clang's integrated assembler.  Instead, the non
__ASSEMBLY__ definition of ELF_NOTE uses
__attribute__((section(".note.Linux"))) which is created with SHF_ALLOC,
so let's make the __ASSEMBLY__ definition of ELF_NOTE consistent with C
and just always use "a" flag.

This allows Clang to assemble a working mainline (5.6) kernel via:
$ make CC=clang AS=clang

Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Fangrui Song <maskray@google.com>
Cc: Jeremy Fitzhardinge <jeremy@goop.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Link: https://github.com/ClangBuiltLinux/linux/issues/913
Link: http://lkml.kernel.org/r/20200325231250.99205-1-ndesaulniers@google.com
Debugged-by: Ilie Halip <ilie.halip@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/elfnote.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/elfnote.h b/include/linux/elfnote.h
index 278e3ef05336..56c6d9031663 100644
--- a/include/linux/elfnote.h
+++ b/include/linux/elfnote.h
@@ -53,7 +53,7 @@
 .popsection				;
 
 #define ELFNOTE(name, type, desc)		\
-	ELFNOTE_START(name, type, "")		\
+	ELFNOTE_START(name, type, "a")		\
 		desc			;	\
 	ELFNOTE_END
 

From 26d53c1cab735ec602db8136e4876b1ed1048341 Mon Sep 17 00:00:00 2001
From: tannerlove <tannerlove@google.com>
Date: Mon, 8 Jun 2020 15:37:15 -0400
Subject: [PATCH 0051/2658] selftests/net: in timestamping, strncpy needs to
 preserve null byte
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 8027bc0307ce59759b90679fa5d8b22949586d20 ]

If user passed an interface option longer than 15 characters, then
device.ifr_name and hwtstamp.ifr_name became non-null-terminated
strings. The compiler warned about this:

timestamping.c:353:2: warning: ‘strncpy’ specified bound 16 equals \
destination size [-Wstringop-truncation]
  353 |  strncpy(device.ifr_name, interface, sizeof(device.ifr_name));

Fixes: cb9eff097831 ("net: new user space API for time stamping of incoming and outgoing packets")
Signed-off-by: Tanner Love <tannerlove@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../selftests/networking/timestamping/timestamping.c   | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/networking/timestamping/timestamping.c b/tools/testing/selftests/networking/timestamping/timestamping.c
index 5cdfd743447b..900ed4b47899 100644
--- a/tools/testing/selftests/networking/timestamping/timestamping.c
+++ b/tools/testing/selftests/networking/timestamping/timestamping.c
@@ -332,10 +332,16 @@ int main(int argc, char **argv)
 	int val;
 	socklen_t len;
 	struct timeval next;
+	size_t if_len;
 
 	if (argc < 2)
 		usage(0);
 	interface = argv[1];
+	if_len = strlen(interface);
+	if (if_len >= IFNAMSIZ) {
+		printf("interface name exceeds IFNAMSIZ\n");
+		exit(1);
+	}
 
 	for (i = 2; i < argc; i++) {
 		if (!strcasecmp(argv[i], "SO_TIMESTAMP"))
@@ -369,12 +375,12 @@ int main(int argc, char **argv)
 		bail("socket");
 
 	memset(&device, 0, sizeof(device));
-	strncpy(device.ifr_name, interface, sizeof(device.ifr_name));
+	memcpy(device.ifr_name, interface, if_len + 1);
 	if (ioctl(sock, SIOCGIFADDR, &device) < 0)
 		bail("getting interface IP address");
 
 	memset(&hwtstamp, 0, sizeof(hwtstamp));
-	strncpy(hwtstamp.ifr_name, interface, sizeof(hwtstamp.ifr_name));
+	memcpy(hwtstamp.ifr_name, interface, if_len + 1);
 	hwtstamp.ifr_data = (void *)&hwconfig;
 	memset(&hwconfig, 0, sizeof(hwconfig));
 	hwconfig.tx_type =

From aeed184991a37d3dc0204e8a550378e01fab97d5 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 30 May 2020 10:16:22 +0200
Subject: [PATCH 0052/2658] scsi: acornscsi: Fix an error handling path in
 acornscsi_probe()

[ Upstream commit 42c76c9848e13dbe0538d7ae0147a269dfa859cb ]

'ret' is known to be 0 at this point.  Explicitly return -ENOMEM if one of
the 'ecardm_iomap()' calls fail.

Link: https://lore.kernel.org/r/20200530081622.577888-1-christophe.jaillet@wanadoo.fr
Fixes: e95a1b656a98 ("[ARM] rpc: acornscsi: update to new style ecard driver")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/arm/acornscsi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/arm/acornscsi.c b/drivers/scsi/arm/acornscsi.c
index deaaf84989cd..be595add8026 100644
--- a/drivers/scsi/arm/acornscsi.c
+++ b/drivers/scsi/arm/acornscsi.c
@@ -2912,8 +2912,10 @@ static int acornscsi_probe(struct expansion_card *ec, const struct ecard_id *id)
 
 	ashost->base = ecardm_iomap(ec, ECARD_RES_MEMC, 0, 0);
 	ashost->fast = ecardm_iomap(ec, ECARD_RES_IOCFAST, 0, 0);
-	if (!ashost->base || !ashost->fast)
+	if (!ashost->base || !ashost->fast) {
+		ret = -ENOMEM;
 		goto out_put;
+	}
 
 	host->irq = ec->irq;
 	ashost->host = host;

From ccd6e71744abd0e187ad637672309e04e9001143 Mon Sep 17 00:00:00 2001
From: Qais Yousef <qais.yousef@arm.com>
Date: Mon, 18 May 2020 16:49:30 +0100
Subject: [PATCH 0053/2658] usb/xhci-plat: Set PM runtime as active on resume

[ Upstream commit 79112cc3c29f4a8c73a21428fbcbcb0afb005e3e ]

Follow suit of ohci-platform.c and perform pm_runtime_set_active() on
resume.

ohci-platform.c had a warning reported due to the missing
pm_runtime_set_active() [1].

[1] https://lore.kernel.org/lkml/20200323143857.db5zphxhq4hz3hmd@e107158-lin.cambridge.arm.com/

Signed-off-by: Qais Yousef <qais.yousef@arm.com>
CC: Tony Prisk <linux@prisktech.co.nz>
CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CC: Mathias Nyman <mathias.nyman@intel.com>
CC: Oliver Neukum <oneukum@suse.de>
CC: linux-arm-kernel@lists.infradead.org
CC: linux-usb@vger.kernel.org
CC: linux-kernel@vger.kernel.org
Link: https://lore.kernel.org/r/20200518154931.6144-2-qais.yousef@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom | 1 -
 1 file changed, 1 deletion(-)
 delete mode 120000 arch/arm64/boot/dts/qcom

diff --git a/arch/arm64/boot/dts/qcom b/arch/arm64/boot/dts/qcom
deleted file mode 120000
index d1df72391997..000000000000
--- a/arch/arm64/boot/dts/qcom
+++ /dev/null
@@ -1 +0,0 @@
-../../../../arch/arm/boot/dts/qcom
\ No newline at end of file

From db68e7aba1b824964c6015e2e8bf247477f5b795 Mon Sep 17 00:00:00 2001
From: Qais Yousef <qais.yousef@arm.com>
Date: Mon, 18 May 2020 16:49:31 +0100
Subject: [PATCH 0054/2658] usb/ehci-platform: Set PM runtime as active on
 resume

[ Upstream commit 16bdc04cc98ab0c74392ceef2475ecc5e73fcf49 ]

Follow suit of ohci-platform.c and perform pm_runtime_set_active() on
resume.

ohci-platform.c had a warning reported due to the missing
pm_runtime_set_active() [1].

[1] https://lore.kernel.org/lkml/20200323143857.db5zphxhq4hz3hmd@e107158-lin.cambridge.arm.com/

Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Qais Yousef <qais.yousef@arm.com>
CC: Tony Prisk <linux@prisktech.co.nz>
CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CC: Mathias Nyman <mathias.nyman@intel.com>
CC: Oliver Neukum <oneukum@suse.de>
CC: linux-arm-kernel@lists.infradead.org
CC: linux-usb@vger.kernel.org
CC: linux-kernel@vger.kernel.org
Link: https://lore.kernel.org/r/20200518154931.6144-3-qais.yousef@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/ehci-platform.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c
index bd7082f297bb..56200650b46b 100644
--- a/drivers/usb/host/ehci-platform.c
+++ b/drivers/usb/host/ehci-platform.c
@@ -375,6 +375,11 @@ static int ehci_platform_resume(struct device *dev)
 	}
 
 	ehci_resume(hcd, priv->reset_on_resume);
+
+	pm_runtime_disable(dev);
+	pm_runtime_set_active(dev);
+	pm_runtime_enable(dev);
+
 	return 0;
 }
 #endif /* CONFIG_PM_SLEEP */

From ce2d09a0aa02d1b871e1651ca730023145a82fb9 Mon Sep 17 00:00:00 2001
From: Gaurav Singh <gaurav1086@gmail.com>
Date: Mon, 8 Jun 2020 13:18:17 -0300
Subject: [PATCH 0055/2658] perf report: Fix NULL pointer dereference in
 hists__fprintf_nr_sample_events()

[ Upstream commit 11b6e5482e178055ec1f2444b55f2518713809d1 ]

The 'evname' variable can be NULL, as it is checked a few lines back,
check it before using.

Fixes: 9e207ddfa207 ("perf report: Show call graph from reference events")
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Kan Liang <kan.liang@intel.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lore.kernel.org/lkml/
Signed-off-by: Gaurav Singh <gaurav1086@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/builtin-report.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index f256fac1e722..74dd196acdac 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -334,8 +334,7 @@ static size_t hists__fprintf_nr_sample_events(struct hists *hists, struct report
 	if (evname != NULL)
 		ret += fprintf(fp, " of event '%s'", evname);
 
-	if (symbol_conf.show_ref_callgraph &&
-	    strstr(evname, "call-graph=no")) {
+	if (symbol_conf.show_ref_callgraph && evname && strstr(evname, "call-graph=no")) {
 		ret += fprintf(fp, ", show reference callgraph");
 	}
 

From 178ba2b436b1de8eae576e68d9afca38f1783db8 Mon Sep 17 00:00:00 2001
From: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Date: Mon, 15 Jun 2020 00:53:30 +0800
Subject: [PATCH 0056/2658] bcache: fix potential deadlock problem in
 btree_gc_coalesce

[ Upstream commit be23e837333a914df3f24bf0b32e87b0331ab8d1 ]

coccicheck reports:
  drivers/md//bcache/btree.c:1538:1-7: preceding lock on line 1417

In btree_gc_coalesce func, if the coalescing process fails, we will goto
to out_nocoalesce tag directly without releasing new_nodes[i]->write_lock.
Then, it will cause a deadlock when trying to acquire new_nodes[i]->
write_lock for freeing new_nodes[i] before return.

btree_gc_coalesce func details as follows:
	if alloc new_nodes[i] fails:
		goto out_nocoalesce;
	// obtain new_nodes[i]->write_lock
	mutex_lock(&new_nodes[i]->write_lock)
	// main coalescing process
	for (i = nodes - 1; i > 0; --i)
		[snipped]
		if coalescing process fails:
			// Here, directly goto out_nocoalesce
			 // tag will cause a deadlock
			goto out_nocoalesce;
		[snipped]
	// release new_nodes[i]->write_lock
	mutex_unlock(&new_nodes[i]->write_lock)
	// coalesing succ, return
	return;
out_nocoalesce:
	btree_node_free(new_nodes[i])	// free new_nodes[i]
	// obtain new_nodes[i]->write_lock
	mutex_lock(&new_nodes[i]->write_lock);
	// set flag for reuse
	clear_bit(BTREE_NODE_dirty, &ew_nodes[i]->flags);
	// release new_nodes[i]->write_lock
	mutex_unlock(&new_nodes[i]->write_lock);

To fix the problem, we add a new tag 'out_unlock_nocoalesce' for
releasing new_nodes[i]->write_lock before out_nocoalesce tag. If
coalescing process fails, we will go to out_unlock_nocoalesce tag
for releasing new_nodes[i]->write_lock before free new_nodes[i] in
out_nocoalesce tag.

(Coly Li helps to clean up commit log format.)

Fixes: 2a285686c109816 ("bcache: btree locking rework")
Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/bcache/btree.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 5c93582c71cc..634e9284b7be 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -1375,7 +1375,7 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op,
 			if (__set_blocks(n1, n1->keys + n2->keys,
 					 block_bytes(b->c)) >
 			    btree_blocks(new_nodes[i]))
-				goto out_nocoalesce;
+				goto out_unlock_nocoalesce;
 
 			keys = n2->keys;
 			/* Take the key of the node we're getting rid of */
@@ -1404,7 +1404,7 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op,
 
 		if (__bch_keylist_realloc(&keylist,
 					  bkey_u64s(&new_nodes[i]->key)))
-			goto out_nocoalesce;
+			goto out_unlock_nocoalesce;
 
 		bch_btree_node_write(new_nodes[i], &cl);
 		bch_keylist_add(&keylist, &new_nodes[i]->key);
@@ -1450,6 +1450,10 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op,
 	/* Invalidated our iterator */
 	return -EINTR;
 
+out_unlock_nocoalesce:
+	for (i = 0; i < nodes; i++)
+		mutex_unlock(&new_nodes[i]->write_lock);
+
 out_nocoalesce:
 	closure_sync(&cl);
 	bch_keylist_free(&keylist);

From dbd64f89c2fe0d848c7f33a6f39cfceae30a7a75 Mon Sep 17 00:00:00 2001
From: Jason Yan <yanaijie@huawei.com>
Date: Tue, 16 Jun 2020 20:16:55 +0800
Subject: [PATCH 0057/2658] block: Fix use-after-free in blkdev_get()

[ Upstream commit 2d3a8e2deddea6c89961c422ec0c5b851e648c14 ]

In blkdev_get() we call __blkdev_get() to do some internal jobs and if
there is some errors in __blkdev_get(), the bdput() is called which
means we have released the refcount of the bdev (actually the refcount of
the bdev inode). This means we cannot access bdev after that point. But
acctually bdev is still accessed in blkdev_get() after calling
__blkdev_get(). This results in use-after-free if the refcount is the
last one we released in __blkdev_get(). Let's take a look at the
following scenerio:

  CPU0            CPU1                    CPU2
blkdev_open     blkdev_open           Remove disk
                  bd_acquire
		  blkdev_get
		    __blkdev_get      del_gendisk
					bdev_unhash_inode
  bd_acquire          bdev_get_gendisk
    bd_forget           failed because of unhashed
	  bdput
	              bdput (the last one)
		        bdev_evict_inode

	  	    access bdev => use after free

[  459.350216] BUG: KASAN: use-after-free in __lock_acquire+0x24c1/0x31b0
[  459.351190] Read of size 8 at addr ffff88806c815a80 by task syz-executor.0/20132
[  459.352347]
[  459.352594] CPU: 0 PID: 20132 Comm: syz-executor.0 Not tainted 4.19.90 #2
[  459.353628] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
[  459.354947] Call Trace:
[  459.355337]  dump_stack+0x111/0x19e
[  459.355879]  ? __lock_acquire+0x24c1/0x31b0
[  459.356523]  print_address_description+0x60/0x223
[  459.357248]  ? __lock_acquire+0x24c1/0x31b0
[  459.357887]  kasan_report.cold+0xae/0x2d8
[  459.358503]  __lock_acquire+0x24c1/0x31b0
[  459.359120]  ? _raw_spin_unlock_irq+0x24/0x40
[  459.359784]  ? lockdep_hardirqs_on+0x37b/0x580
[  459.360465]  ? _raw_spin_unlock_irq+0x24/0x40
[  459.361123]  ? finish_task_switch+0x125/0x600
[  459.361812]  ? finish_task_switch+0xee/0x600
[  459.362471]  ? mark_held_locks+0xf0/0xf0
[  459.363108]  ? __schedule+0x96f/0x21d0
[  459.363716]  lock_acquire+0x111/0x320
[  459.364285]  ? blkdev_get+0xce/0xbe0
[  459.364846]  ? blkdev_get+0xce/0xbe0
[  459.365390]  __mutex_lock+0xf9/0x12a0
[  459.365948]  ? blkdev_get+0xce/0xbe0
[  459.366493]  ? bdev_evict_inode+0x1f0/0x1f0
[  459.367130]  ? blkdev_get+0xce/0xbe0
[  459.367678]  ? destroy_inode+0xbc/0x110
[  459.368261]  ? mutex_trylock+0x1a0/0x1a0
[  459.368867]  ? __blkdev_get+0x3e6/0x1280
[  459.369463]  ? bdev_disk_changed+0x1d0/0x1d0
[  459.370114]  ? blkdev_get+0xce/0xbe0
[  459.370656]  blkdev_get+0xce/0xbe0
[  459.371178]  ? find_held_lock+0x2c/0x110
[  459.371774]  ? __blkdev_get+0x1280/0x1280
[  459.372383]  ? lock_downgrade+0x680/0x680
[  459.373002]  ? lock_acquire+0x111/0x320
[  459.373587]  ? bd_acquire+0x21/0x2c0
[  459.374134]  ? do_raw_spin_unlock+0x4f/0x250
[  459.374780]  blkdev_open+0x202/0x290
[  459.375325]  do_dentry_open+0x49e/0x1050
[  459.375924]  ? blkdev_get_by_dev+0x70/0x70
[  459.376543]  ? __x64_sys_fchdir+0x1f0/0x1f0
[  459.377192]  ? inode_permission+0xbe/0x3a0
[  459.377818]  path_openat+0x148c/0x3f50
[  459.378392]  ? kmem_cache_alloc+0xd5/0x280
[  459.379016]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  459.379802]  ? path_lookupat.isra.0+0x900/0x900
[  459.380489]  ? __lock_is_held+0xad/0x140
[  459.381093]  do_filp_open+0x1a1/0x280
[  459.381654]  ? may_open_dev+0xf0/0xf0
[  459.382214]  ? find_held_lock+0x2c/0x110
[  459.382816]  ? lock_downgrade+0x680/0x680
[  459.383425]  ? __lock_is_held+0xad/0x140
[  459.384024]  ? do_raw_spin_unlock+0x4f/0x250
[  459.384668]  ? _raw_spin_unlock+0x1f/0x30
[  459.385280]  ? __alloc_fd+0x448/0x560
[  459.385841]  do_sys_open+0x3c3/0x500
[  459.386386]  ? filp_open+0x70/0x70
[  459.386911]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  459.387610]  ? trace_hardirqs_off_caller+0x55/0x1c0
[  459.388342]  ? do_syscall_64+0x1a/0x520
[  459.388930]  do_syscall_64+0xc3/0x520
[  459.389490]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  459.390248] RIP: 0033:0x416211
[  459.390720] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83
04 19 00 00 c3 48 83 ec 08 e8 0a fa ff ff 48 89 04 24 b8 02 00 00 00 0f
   05 <48> 8b 3c 24 48 89 c2 e8 53 fa ff ff 48 89 d0 48 83 c4 08 48 3d
      01
[  459.393483] RSP: 002b:00007fe45dfe9a60 EFLAGS: 00000293 ORIG_RAX: 0000000000000002
[  459.394610] RAX: ffffffffffffffda RBX: 00007fe45dfea6d4 RCX: 0000000000416211
[  459.395678] RDX: 00007fe45dfe9b0a RSI: 0000000000000002 RDI: 00007fe45dfe9b00
[  459.396758] RBP: 000000000076bf20 R08: 0000000000000000 R09: 000000000000000a
[  459.397930] R10: 0000000000000075 R11: 0000000000000293 R12: 00000000ffffffff
[  459.399022] R13: 0000000000000bd9 R14: 00000000004cdb80 R15: 000000000076bf2c
[  459.400168]
[  459.400430] Allocated by task 20132:
[  459.401038]  kasan_kmalloc+0xbf/0xe0
[  459.401652]  kmem_cache_alloc+0xd5/0x280
[  459.402330]  bdev_alloc_inode+0x18/0x40
[  459.402970]  alloc_inode+0x5f/0x180
[  459.403510]  iget5_locked+0x57/0xd0
[  459.404095]  bdget+0x94/0x4e0
[  459.404607]  bd_acquire+0xfa/0x2c0
[  459.405113]  blkdev_open+0x110/0x290
[  459.405702]  do_dentry_open+0x49e/0x1050
[  459.406340]  path_openat+0x148c/0x3f50
[  459.406926]  do_filp_open+0x1a1/0x280
[  459.407471]  do_sys_open+0x3c3/0x500
[  459.408010]  do_syscall_64+0xc3/0x520
[  459.408572]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  459.409415]
[  459.409679] Freed by task 1262:
[  459.410212]  __kasan_slab_free+0x129/0x170
[  459.410919]  kmem_cache_free+0xb2/0x2a0
[  459.411564]  rcu_process_callbacks+0xbb2/0x2320
[  459.412318]  __do_softirq+0x225/0x8ac

Fix this by delaying bdput() to the end of blkdev_get() which means we
have finished accessing bdev.

Fixes: 77ea887e433a ("implement in-kernel gendisk events handling")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Jason Yan <yanaijie@huawei.com>
Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Ming Lei <ming.lei@redhat.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/block_dev.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/fs/block_dev.c b/fs/block_dev.c
index 26bbaaefdff4..b2ebfd96785b 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1181,10 +1181,8 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
 	 */
 	if (!for_part) {
 		ret = devcgroup_inode_permission(bdev->bd_inode, perm);
-		if (ret != 0) {
-			bdput(bdev);
+		if (ret != 0)
 			return ret;
-		}
 	}
 
  restart:
@@ -1253,8 +1251,10 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
 				goto out_clear;
 			BUG_ON(for_part);
 			ret = __blkdev_get(whole, mode, 1);
-			if (ret)
+			if (ret) {
+				bdput(whole);
 				goto out_clear;
+			}
 			bdev->bd_contains = whole;
 			bdev->bd_part = disk_get_part(disk, partno);
 			if (!(disk->flags & GENHD_FL_UP) ||
@@ -1311,7 +1311,6 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
 	put_disk(disk);
 	module_put(owner);
  out:
-	bdput(bdev);
 
 	return ret;
 }
@@ -1397,6 +1396,9 @@ int blkdev_get(struct block_device *bdev, fmode_t mode, void *holder)
 		bdput(whole);
 	}
 
+	if (res)
+		bdput(bdev);
+
 	return res;
 }
 EXPORT_SYMBOL(blkdev_get);

From f65871cabdc910200dd880225458c4fcd376c633 Mon Sep 17 00:00:00 2001
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date: Wed, 3 Jun 2020 15:48:19 +0800
Subject: [PATCH 0058/2658] libata: Use per port sync for detach

[ Upstream commit b5292111de9bb70cba3489075970889765302136 ]

Commit 130f4caf145c ("libata: Ensure ata_port probe has completed before
detach") may cause system freeze during suspend.

Using async_synchronize_full() in PM callbacks is wrong, since async
callbacks that are already scheduled may wait for not-yet-scheduled
callbacks, causes a circular dependency.

Instead of using big hammer like async_synchronize_full(), use async
cookie to make sure port probe are synced, without affecting other
scheduled PM callbacks.

Fixes: 130f4caf145c ("libata: Ensure ata_port probe has completed before detach")
Suggested-by: John Garry <john.garry@huawei.com>
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Tested-by: John Garry <john.garry@huawei.com>
BugLink: https://bugs.launchpad.net/bugs/1867983
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/libata-core.c | 11 +++++------
 include/linux/libata.h    |  3 +++
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index fc4bf8ff40ea..17cebfe5acc8 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -56,7 +56,6 @@
 #include <linux/workqueue.h>
 #include <linux/scatterlist.h>
 #include <linux/io.h>
-#include <linux/async.h>
 #include <linux/log2.h>
 #include <linux/slab.h>
 #include <linux/glob.h>
@@ -6222,7 +6221,7 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht)
 	/* perform each probe asynchronously */
 	for (i = 0; i < host->n_ports; i++) {
 		struct ata_port *ap = host->ports[i];
-		async_schedule(async_port_probe, ap);
+		ap->cookie = async_schedule(async_port_probe, ap);
 	}
 
 	return 0;
@@ -6355,11 +6354,11 @@ void ata_host_detach(struct ata_host *host)
 {
 	int i;
 
-	/* Ensure ata_port probe has completed */
-	async_synchronize_full();
-
-	for (i = 0; i < host->n_ports; i++)
+	for (i = 0; i < host->n_ports; i++) {
+		/* Ensure ata_port probe has completed */
+		async_synchronize_cookie(host->ports[i]->cookie + 1);
 		ata_port_detach(host->ports[i]);
+	}
 
 	/* the host is dead now, dissociate ACPI */
 	ata_acpi_dissociate(host);
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 6428ac4746de..af561d33221d 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -38,6 +38,7 @@
 #include <linux/acpi.h>
 #include <linux/cdrom.h>
 #include <linux/sched.h>
+#include <linux/async.h>
 
 /*
  * Define if arch has non-standard setup.  This is a _PCI_ standard
@@ -872,6 +873,8 @@ struct ata_port {
 	struct timer_list	fastdrain_timer;
 	unsigned long		fastdrain_cnt;
 
+	async_cookie_t		cookie;
+
 	int			em_message_type;
 	void			*private_data;
 

From 1f71fdb9796f1c6da409bc0c486dfb678b038f52 Mon Sep 17 00:00:00 2001
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
Date: Mon, 15 Jun 2020 09:58:10 +0200
Subject: [PATCH 0059/2658] drm: encoder_slave: fix refcouting error for
 modules

[ Upstream commit f78d4032de60f50fd4afaa0fb68ea03b985f820a ]

module_put() balances try_module_get(), not request_module(). Fix the
error path to match that.

Fixes: 2066facca4c7 ("drm/kms: slave encoder interface.")
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_encoder_slave.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_encoder_slave.c b/drivers/gpu/drm/drm_encoder_slave.c
index d18b88b755c3..5c595d9f7e8f 100644
--- a/drivers/gpu/drm/drm_encoder_slave.c
+++ b/drivers/gpu/drm/drm_encoder_slave.c
@@ -84,7 +84,7 @@ int drm_i2c_encoder_init(struct drm_device *dev,
 
 	err = encoder_drv->encoder_init(client, dev, encoder);
 	if (err)
-		goto fail_unregister;
+		goto fail_module_put;
 
 	if (info->platform_data)
 		encoder->slave_funcs->set_config(&encoder->base,
@@ -92,9 +92,10 @@ int drm_i2c_encoder_init(struct drm_device *dev,
 
 	return 0;
 
+fail_module_put:
+	module_put(module);
 fail_unregister:
 	i2c_unregister_device(client);
-	module_put(module);
 fail:
 	return err;
 }

From 093a628f5e5ae71d3abf6cb352e30a8adebf3cd6 Mon Sep 17 00:00:00 2001
From: Lyude Paul <lyude@redhat.com>
Date: Fri, 3 Apr 2020 14:08:32 -0400
Subject: [PATCH 0060/2658] drm/dp_mst: Reformat drm_dp_check_act_status() a
 bit

commit a5cb5fa6c3a5c2cf492db667b8670ee7b044b79f upstream.

Just add a bit more line wrapping, get rid of some extraneous
whitespace, remove an unneeded goto label, and move around some variable
declarations. No functional changes here.

Signed-off-by: Lyude Paul <lyude@redhat.com>
[this isn't a fix, but it's needed for the fix that comes after this]
Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)")
Cc: Sean Paul <sean@poorly.run>
Cc: <stable@vger.kernel.org> # v3.17+
Reviewed-by: Sean Paul <sean@poorly.run>
Link: https://patchwork.freedesktop.org/patch/msgid/20200406221253.1307209-3-lyude@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/drm_dp_mst_topology.c | 22 ++++++++++------------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index bb25abba7ad0..5e88988b6c46 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -2656,33 +2656,31 @@ static int drm_dp_dpcd_write_payload(struct drm_dp_mst_topology_mgr *mgr,
  */
 int drm_dp_check_act_status(struct drm_dp_mst_topology_mgr *mgr)
 {
+	int count = 0, ret;
 	u8 status;
-	int ret;
-	int count = 0;
 
 	do {
-		ret = drm_dp_dpcd_readb(mgr->aux, DP_PAYLOAD_TABLE_UPDATE_STATUS, &status);
-
+		ret = drm_dp_dpcd_readb(mgr->aux,
+					DP_PAYLOAD_TABLE_UPDATE_STATUS,
+					&status);
 		if (ret < 0) {
-			DRM_DEBUG_KMS("failed to read payload table status %d\n", ret);
-			goto fail;
+			DRM_DEBUG_KMS("failed to read payload table status %d\n",
+				      ret);
+			return ret;
 		}
 
 		if (status & DP_PAYLOAD_ACT_HANDLED)
 			break;
 		count++;
 		udelay(100);
-
 	} while (count < 30);
 
 	if (!(status & DP_PAYLOAD_ACT_HANDLED)) {
-		DRM_DEBUG_KMS("failed to get ACT bit %d after %d retries\n", status, count);
-		ret = -EINVAL;
-		goto fail;
+		DRM_DEBUG_KMS("failed to get ACT bit %d after %d retries\n",
+			      status, count);
+		return -EINVAL;
 	}
 	return 0;
-fail:
-	return ret;
 }
 EXPORT_SYMBOL(drm_dp_check_act_status);
 

From 31d063db333e78e5c32bc6616f7505fc4db5d9f0 Mon Sep 17 00:00:00 2001
From: Huacai Chen <chenhc@lemote.com>
Date: Tue, 31 Mar 2020 14:18:08 +0800
Subject: [PATCH 0061/2658] drm/qxl: Use correct notify port address when
 creating cursor ring

commit 80e5f89da3ab949fbbf1cae01dfaea29f5483a75 upstream.

The command ring and cursor ring use different notify port addresses
definition: QXL_IO_NOTIFY_CMD and QXL_IO_NOTIFY_CURSOR. However, in
qxl_device_init() we use QXL_IO_NOTIFY_CMD to create both command ring
and cursor ring. This doesn't cause any problems now, because QEMU's
behaviors on QXL_IO_NOTIFY_CMD and QXL_IO_NOTIFY_CURSOR are the same.
However, QEMU's behavior may be change in future, so let's fix it.

P.S.: In the X.org QXL driver, the notify port address of cursor ring
      is correct.

Signed-off-by: Huacai Chen <chenhc@lemote.com>
Cc: <stable@vger.kernel.org>
Link: http://patchwork.freedesktop.org/patch/msgid/1585635488-17507-1-git-send-email-chenhc@lemote.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/qxl/qxl_kms.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/qxl/qxl_kms.c b/drivers/gpu/drm/qxl/qxl_kms.c
index b2977a181935..e8664a9f1e77 100644
--- a/drivers/gpu/drm/qxl/qxl_kms.c
+++ b/drivers/gpu/drm/qxl/qxl_kms.c
@@ -199,7 +199,7 @@ static int qxl_device_init(struct qxl_device *qdev,
 				&(qdev->ram_header->cursor_ring_hdr),
 				sizeof(struct qxl_command),
 				QXL_CURSOR_RING_SIZE,
-				qdev->io_base + QXL_IO_NOTIFY_CMD,
+				qdev->io_base + QXL_IO_NOTIFY_CURSOR,
 				false,
 				&qdev->cursor_event);
 

From ae70c712e97697e0f36efc28e998ffe25266c3a1 Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Wed, 10 Jun 2020 14:57:13 -0700
Subject: [PATCH 0062/2658] selinux: fix double free

commit 65de50969a77509452ae590e9449b70a22b923bb upstream.

Clang's static analysis tool reports these double free memory errors.

security/selinux/ss/services.c:2987:4: warning: Attempt to free released memory [unix.Malloc]
                        kfree(bnames[i]);
                        ^~~~~~~~~~~~~~~~
security/selinux/ss/services.c:2990:2: warning: Attempt to free released memory [unix.Malloc]
        kfree(bvalues);
        ^~~~~~~~~~~~~~

So improve the security_get_bools error handling by freeing these variables
and setting their return pointers to NULL and the return len to 0

Cc: stable@vger.kernel.org
Signed-off-by: Tom Rix <trix@redhat.com>
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 security/selinux/ss/services.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 0a258c0602d1..55c869e0a3a0 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -2622,8 +2622,12 @@ int security_get_bools(int *len, char ***names, int **values)
 	if (*names) {
 		for (i = 0; i < *len; i++)
 			kfree((*names)[i]);
+		kfree(*names);
 	}
 	kfree(*values);
+	*len = 0;
+	*names = NULL;
+	*values = NULL;
 	goto out;
 }
 

From f0acfe3b230c7ce73a23a23ef5917fa7feec452e Mon Sep 17 00:00:00 2001
From: Jeffle Xu <jefflexu@linux.alibaba.com>
Date: Fri, 22 May 2020 12:18:44 +0800
Subject: [PATCH 0063/2658] ext4: fix partial cluster initialization when
 splitting extent

[ Upstream commit cfb3c85a600c6aa25a2581b3c1c4db3460f14e46 ]

Fix the bug when calculating the physical block number of the first
block in the split extent.

This bug will cause xfstests shared/298 failure on ext4 with bigalloc
enabled occasionally. Ext4 error messages indicate that previously freed
blocks are being freed again, and the following fsck will fail due to
the inconsistency of block bitmap and bg descriptor.

The following is an example case:

1. First, Initialize a ext4 filesystem with cluster size '16K', block size
'4K', in which case, one cluster contains four blocks.

2. Create one file (e.g., xxx.img) on this ext4 filesystem. Now the extent
tree of this file is like:

...
36864:[0]4:220160
36868:[0]14332:145408
51200:[0]2:231424
...

3. Then execute PUNCH_HOLE fallocate on this file. The hole range is
like:

..
ext4_ext_remove_space: dev 254,16 ino 12 since 49506 end 49506 depth 1
ext4_ext_remove_space: dev 254,16 ino 12 since 49544 end 49546 depth 1
ext4_ext_remove_space: dev 254,16 ino 12 since 49605 end 49607 depth 1
...

4. Then the extent tree of this file after punching is like

...
49507:[0]37:158047
49547:[0]58:158087
...

5. Detailed procedure of punching hole [49544, 49546]

5.1. The block address space:
```
lblk        ~49505  49506   49507~49543     49544~49546    49547~
	  ---------+------+-------------+----------------+--------
	    extent | hole |   extent	|	hole	 | extent
	  ---------+------+-------------+----------------+--------
pblk       ~158045  158046  158047~158083  158084~158086   158087~
```

5.2. The detailed layout of cluster 39521:
```
		cluster 39521
	<------------------------------->

		hole		  extent
	<----------------------><--------

lblk      49544   49545   49546   49547
	+-------+-------+-------+-------+
	|	|	|	|	|
	+-------+-------+-------+-------+
pblk     158084  1580845  158086  158087
```

5.3. The ftrace output when punching hole [49544, 49546]:
- ext4_ext_remove_space (start 49544, end 49546)
  - ext4_ext_rm_leaf (start 49544, end 49546, last_extent [49507(158047), 40], partial [pclu 39522 lblk 0 state 2])
    - ext4_remove_blocks (extent [49507(158047), 40], from 49544 to 49546, partial [pclu 39522 lblk 0 state 2]
      - ext4_free_blocks: (block 158084 count 4)
        - ext4_mballoc_free (extent 1/6753/1)

5.4. Ext4 error message in dmesg:
EXT4-fs error (device vdb): mb_free_blocks:1457: group 1, block 158084:freeing already freed block (bit 6753); block bitmap corrupt.
EXT4-fs error (device vdb): ext4_mb_generate_buddy:747: group 1, block bitmap and bg descriptor inconsistent: 19550 vs 19551 free clusters

In this case, the whole cluster 39521 is freed mistakenly when freeing
pblock 158084~158086 (i.e., the first three blocks of this cluster),
although pblock 158087 (the last remaining block of this cluster) has
not been freed yet.

The root cause of this isuue is that, the pclu of the partial cluster is
calculated mistakenly in ext4_ext_remove_space(). The correct
partial_cluster.pclu (i.e., the cluster number of the first block in the
next extent, that is, lblock 49597 (pblock 158086)) should be 39521 rather
than 39522.

Fixes: f4226d9ea400 ("ext4: fix partial cluster initialization")
Signed-off-by: Jeffle Xu <jefflexu@linux.alibaba.com>
Reviewed-by: Eric Whitney <enwlinux@gmail.com>
Cc: stable@kernel.org # v3.19+
Link: https://lore.kernel.org/r/1590121124-37096-1-git-send-email-jefflexu@linux.alibaba.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/extents.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 96336830f035..fc2746e14c42 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -2902,7 +2902,7 @@ int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start,
 			 * in use to avoid freeing it when removing blocks.
 			 */
 			if (sbi->s_cluster_ratio > 1) {
-				pblk = ext4_ext_pblock(ex) + end - ee_block + 2;
+				pblk = ext4_ext_pblock(ex) + end - ee_block + 1;
 				partial_cluster =
 					-(long long) EXT4_B2C(sbi, pblk);
 			}

From ae9824953a4149db0ff2212103bdb0e24b548711 Mon Sep 17 00:00:00 2001
From: Lyude Paul <lyude@redhat.com>
Date: Fri, 3 Apr 2020 15:47:15 -0400
Subject: [PATCH 0064/2658] drm/dp_mst: Increase ACT retry timeout to 3s
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 873a95e0d59ac06901ae261dda0b7165ffd002b8 ]

Currently we only poll for an ACT up to 30 times, with a busy-wait delay
of 100µs between each attempt - giving us a timeout of 2900µs. While
this might seem sensible, it would appear that in certain scenarios it
can take dramatically longer then that for us to receive an ACT. On one
of the EVGA MST hubs that I have available, I observed said hub
sometimes taking longer then a second before signalling the ACT. These
delays mostly seem to occur when previous sideband messages we've sent
are NAKd by the hub, however it wouldn't be particularly surprising if
it's possible to reproduce times like this simply by introducing branch
devices with large LCTs since payload allocations have to take effect on
every downstream device up to the payload's target.

So, instead of just retrying 30 times we poll for the ACT for up to 3ms,
and additionally use usleep_range() to avoid a very long and rude
busy-wait. Note that the previous retry count of 30 appears to have been
arbitrarily chosen, as I can't find any mention of a recommended timeout
or retry count for ACTs in the DisplayPort 2.0 specification. This also
goes for the range we were previously using for udelay(), although I
suspect that was just copied from the recommended delay for link
training on SST devices.

Changes since v1:
* Use readx_poll_timeout() instead of open-coding timeout loop - Sean
  Paul
Changes since v2:
* Increase poll interval to 200us - Sean Paul
* Print status in hex when we timeout waiting for ACT - Sean Paul

Signed-off-by: Lyude Paul <lyude@redhat.com>
Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)")
Cc: Sean Paul <sean@poorly.run>
Cc: <stable@vger.kernel.org> # v3.17+
Reviewed-by: Sean Paul <sean@poorly.run>
Link: https://patchwork.freedesktop.org/patch/msgid/20200406221253.1307209-4-lyude@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_dp_mst_topology.c | 54 ++++++++++++++++-----------
 1 file changed, 32 insertions(+), 22 deletions(-)

diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 5e88988b6c46..51cdff2af8b2 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -29,6 +29,7 @@
 #include <linux/i2c.h>
 #include <drm/drm_dp_mst_helper.h>
 #include <drm/drmP.h>
+#include <linux/iopoll.h>
 
 #include <drm/drm_fixed.h>
 
@@ -2647,6 +2648,17 @@ static int drm_dp_dpcd_write_payload(struct drm_dp_mst_topology_mgr *mgr,
 	return ret;
 }
 
+static int do_get_act_status(struct drm_dp_aux *aux)
+{
+	int ret;
+	u8 status;
+
+	ret = drm_dp_dpcd_readb(aux, DP_PAYLOAD_TABLE_UPDATE_STATUS, &status);
+	if (ret < 0)
+		return ret;
+
+	return status;
+}
 
 /**
  * drm_dp_check_act_status() - Check ACT handled status.
@@ -2656,30 +2668,28 @@ static int drm_dp_dpcd_write_payload(struct drm_dp_mst_topology_mgr *mgr,
  */
 int drm_dp_check_act_status(struct drm_dp_mst_topology_mgr *mgr)
 {
-	int count = 0, ret;
-	u8 status;
-
-	do {
-		ret = drm_dp_dpcd_readb(mgr->aux,
-					DP_PAYLOAD_TABLE_UPDATE_STATUS,
-					&status);
-		if (ret < 0) {
-			DRM_DEBUG_KMS("failed to read payload table status %d\n",
-				      ret);
-			return ret;
-		}
-
-		if (status & DP_PAYLOAD_ACT_HANDLED)
-			break;
-		count++;
-		udelay(100);
-	} while (count < 30);
-
-	if (!(status & DP_PAYLOAD_ACT_HANDLED)) {
-		DRM_DEBUG_KMS("failed to get ACT bit %d after %d retries\n",
-			      status, count);
+	/*
+	 * There doesn't seem to be any recommended retry count or timeout in
+	 * the MST specification. Since some hubs have been observed to take
+	 * over 1 second to update their payload allocations under certain
+	 * conditions, we use a rather large timeout value.
+	 */
+	const int timeout_ms = 3000;
+	int ret, status;
+
+	ret = readx_poll_timeout(do_get_act_status, mgr->aux, status,
+				 status & DP_PAYLOAD_ACT_HANDLED || status < 0,
+				 200, timeout_ms * USEC_PER_MSEC);
+	if (ret < 0 && status >= 0) {
+		DRM_DEBUG_KMS("Failed to get ACT after %dms, last status: %02x\n",
+			      timeout_ms, status);
 		return -EINVAL;
+	} else if (status < 0) {
+		DRM_DEBUG_KMS("Failed to read payload table status: %d\n",
+			      status);
+		return status;
 	}
+
 	return 0;
 }
 EXPORT_SYMBOL(drm_dp_check_act_status);

From e39c3a7dd4e4568eba8d901171d9bcefc61ce2a2 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Sun, 17 May 2020 15:37:50 -0400
Subject: [PATCH 0065/2658] sparc64: fix misuses of access_process_vm() in
 genregs32_[sg]et()

[ Upstream commit 142cd25293f6a7ecbdff4fb0af17de6438d46433 ]

We do need access_process_vm() to access the target's reg_window.
However, access to caller's memory (storing the result in
genregs32_get(), fetching the new values in case of genregs32_set())
should be done by normal uaccess primitives.

Fixes: ad4f95764040 ([SPARC64]: Fix user accesses in regset code.)
Cc: stable@kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/sparc/kernel/ptrace_64.c | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index c1566170964f..829592d5efe0 100644
--- a/arch/sparc/kernel/ptrace_64.c
+++ b/arch/sparc/kernel/ptrace_64.c
@@ -534,13 +534,8 @@ static int genregs32_get(struct task_struct *target,
 						      &reg, sizeof(reg), 0)
 				    != sizeof(reg))
 					return -EFAULT;
-				if (access_process_vm(target,
-						      (unsigned long) u,
-						      &reg, sizeof(reg), 1)
-				    != sizeof(reg))
+				if (put_user(reg, u++))
 					return -EFAULT;
-				pos++;
-				u++;
 			}
 		}
 	}
@@ -639,11 +634,7 @@ static int genregs32_set(struct task_struct *target,
 			}
 		} else {
 			for (; count > 0 && pos < 32; count--) {
-				if (access_process_vm(target,
-						      (unsigned long)
-						      u,
-						      &reg, sizeof(reg), 0)
-				    != sizeof(reg))
+				if (get_user(reg, u++))
 					return -EFAULT;
 				if (access_process_vm(target,
 						      (unsigned long)

From 51e89dd32d39cea65f69f2c0d61d9b753ec2223f Mon Sep 17 00:00:00 2001
From: "Ahmed S. Darwish" <a.darwish@linutronix.de>
Date: Wed, 3 Jun 2020 16:49:48 +0200
Subject: [PATCH 0066/2658] block: nr_sects_write(): Disable preemption on
 seqcount write

[ Upstream commit 15b81ce5abdc4b502aa31dff2d415b79d2349d2f ]

For optimized block readers not holding a mutex, the "number of sectors"
64-bit value is protected from tearing on 32-bit architectures by a
sequence counter.

Disable preemption before entering that sequence counter's write side
critical section. Otherwise, the read side can preempt the write side
section and spin for the entire scheduler tick. If the reader belongs to
a real-time scheduling class, it can spin forever and the kernel will
livelock.

Fixes: c83f6bf98dc1 ("block: add partition resize function to blkpg ioctl")
Cc: <stable@vger.kernel.org>
Signed-off-by: Ahmed S. Darwish <a.darwish@linutronix.de>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/genhd.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index 5012fcdb4c9e..a27d0aef07f6 100644
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -727,9 +727,11 @@ static inline sector_t part_nr_sects_read(struct hd_struct *part)
 static inline void part_nr_sects_write(struct hd_struct *part, sector_t size)
 {
 #if BITS_PER_LONG==32 && defined(CONFIG_LBDAF) && defined(CONFIG_SMP)
+	preempt_disable();
 	write_seqcount_begin(&part->nr_sects_seq);
 	part->nr_sects = size;
 	write_seqcount_end(&part->nr_sects_seq);
+	preempt_enable();
 #elif BITS_PER_LONG==32 && defined(CONFIG_LBDAF) && defined(CONFIG_PREEMPT)
 	preempt_disable();
 	part->nr_sects = size;

From d37e43e83401adb715149be553f65eaf15cf0f84 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Thu, 4 Jun 2020 11:52:53 -0700
Subject: [PATCH 0067/2658] crypto: algboss - don't wait during notifier
 callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 77251e41f89a813b4090f5199442f217bbf11297 upstream.

When a crypto template needs to be instantiated, CRYPTO_MSG_ALG_REQUEST
is sent to crypto_chain.  cryptomgr_schedule_probe() handles this by
starting a thread to instantiate the template, then waiting for this
thread to complete via crypto_larval::completion.

This can deadlock because instantiating the template may require loading
modules, and this (apparently depending on userspace) may need to wait
for the crc-t10dif module (lib/crc-t10dif.c) to be loaded.  But
crc-t10dif's module_init function uses crypto_register_notifier() and
therefore takes crypto_chain.rwsem for write.  That can't proceed until
the notifier callback has finished, as it holds this semaphore for read.

Fix this by removing the wait on crypto_larval::completion from within
cryptomgr_schedule_probe().  It's actually unnecessary because
crypto_alg_mod_lookup() calls crypto_larval_wait() itself after sending
CRYPTO_MSG_ALG_REQUEST.

This only actually became a problem in v4.20 due to commit b76377543b73
("crc-t10dif: Pick better transform if one becomes available"), but the
unnecessary wait was much older.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207159
Reported-by: Mike Gerow <gerow@google.com>
Fixes: 398710379f51 ("crypto: algapi - Move larval completion into algboss")
Cc: <stable@vger.kernel.org> # v3.6+
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reported-by: Kai Lüke <kai@kinvolk.io>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 crypto/algboss.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/crypto/algboss.c b/crypto/algboss.c
index 6e39d9c05b98..5cbc588555ca 100644
--- a/crypto/algboss.c
+++ b/crypto/algboss.c
@@ -194,8 +194,6 @@ static int cryptomgr_schedule_probe(struct crypto_larval *larval)
 	if (IS_ERR(thread))
 		goto err_put_larval;
 
-	wait_for_completion_interruptible(&larval->completion);
-
 	return NOTIFY_STOP;
 
 err_put_larval:

From 08229388fdd3dd1f77c7a02062d178970603534f Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: Tue, 12 May 2020 17:02:56 +0900
Subject: [PATCH 0068/2658] kprobes: Fix to protect kick_kprobe_optimizer() by
 kprobe_mutex

[ Upstream commit 1a0aa991a6274161c95a844c58cfb801d681eb59 ]

In kprobe_optimizer() kick_kprobe_optimizer() is called
without kprobe_mutex, but this can race with other caller
which is protected by kprobe_mutex.

To fix that, expand kprobe_mutex protected area to protect
kick_kprobe_optimizer() call.

Link: http://lkml.kernel.org/r/158927057586.27680.5036330063955940456.stgit@devnote2

Fixes: cd7ebe2298ff ("kprobes: Use text_poke_smp_batch for optimizing")
Cc: Ingo Molnar <mingo@kernel.org>
Cc: "Gustavo A . R . Silva" <gustavoars@kernel.org>
Cc: Anders Roxell <anders.roxell@linaro.org>
Cc: "Naveen N . Rao" <naveen.n.rao@linux.ibm.com>
Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
Cc: David Miller <davem@davemloft.net>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ziqian SUN <zsun@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/kprobes.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index f59f49bc2a5d..430baa19e48c 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -561,11 +561,12 @@ static void kprobe_optimizer(struct work_struct *work)
 	do_free_cleaned_kprobes();
 
 	mutex_unlock(&module_mutex);
-	mutex_unlock(&kprobe_mutex);
 
 	/* Step 5: Kick optimizer again if needed */
 	if (!list_empty(&optimizing_list) || !list_empty(&unoptimizing_list))
 		kick_kprobe_optimizer();
+
+	mutex_unlock(&kprobe_mutex);
 }
 
 /* Wait for completing optimization and unoptimization */

From 932fc2bc4ad0f0b828857b67f258153baab4e944 Mon Sep 17 00:00:00 2001
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
Date: Wed, 8 Feb 2017 14:27:31 +0530
Subject: [PATCH 0069/2658] powerpc/kprobes: Fixes for kprobe_lookup_name() on
 BE

[ Upstream commit 30176466e36aadba01e1a630cf42397a3438efa4 ]

Fix two issues with kprobes.h on BE which were exposed with the
optprobes work:
  - one, having to do with a missing include for linux/module.h for
    MODULE_NAME_LEN -- this didn't show up previously since the only
    users of kprobe_lookup_name were in kprobes.c, which included
    linux/module.h through other headers, and
  - two, with a missing const qualifier for a local variable which ends
    up referring a string literal. Again, this is unique to how
    kprobe_lookup_name is being invoked in optprobes.c

Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/kprobes.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/include/asm/kprobes.h b/arch/powerpc/include/asm/kprobes.h
index 039b583db029..f0717eedf781 100644
--- a/arch/powerpc/include/asm/kprobes.h
+++ b/arch/powerpc/include/asm/kprobes.h
@@ -29,6 +29,7 @@
 #include <linux/types.h>
 #include <linux/ptrace.h>
 #include <linux/percpu.h>
+#include <linux/module.h>
 #include <asm/probes.h>
 #include <asm/code-patching.h>
 
@@ -61,7 +62,7 @@ typedef ppc_opcode_t kprobe_opcode_t;
 #define kprobe_lookup_name(name, addr)					\
 {									\
 	char dot_name[MODULE_NAME_LEN + 1 + KSYM_NAME_LEN];		\
-	char *modsym;							\
+	const char *modsym;							\
 	bool dot_appended = false;					\
 	if ((modsym = strchr(name, ':')) != NULL) {			\
 		modsym++;						\

From 2f2e5f2d848a3bf713f26ea0cc40b1666e118d2e Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: Sun, 24 Feb 2019 01:50:49 +0900
Subject: [PATCH 0070/2658] x86/kprobes: Avoid kretprobe recursion bug

[ Upstream commit b191fa96ea6dc00d331dcc28c1f7db5e075693a0 ]

Avoid kretprobe recursion loop bg by setting a dummy
kprobes to current_kprobe per-CPU variable.

This bug has been introduced with the asm-coded trampoline
code, since previously it used another kprobe for hooking
the function return placeholder (which only has a nop) and
trampoline handler was called from that kprobe.

This revives the old lost kprobe again.

With this fix, we don't see deadlock anymore.

And you can see that all inner-called kretprobe are skipped.

  event_1                                  235               0
  event_2                                19375           19612

The 1st column is recorded count and the 2nd is missed count.
Above shows (event_1 rec) + (event_2 rec) ~= (event_2 missed)
(some difference are here because the counter is racy)

Reported-by: Andrea Righi <righi.andrea@gmail.com>
Tested-by: Andrea Righi <righi.andrea@gmail.com>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Acked-by: Steven Rostedt <rostedt@goodmis.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Fixes: c9becf58d935 ("[PATCH] kretprobe: kretprobe-booster")
Link: http://lkml.kernel.org/r/155094064889.6137.972160690963039.stgit@devbox
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/kprobes/core.c | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index d13ed4de30fd..8853ebdaaee1 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -736,11 +736,16 @@ static void __used kretprobe_trampoline_holder(void)
 NOKPROBE_SYMBOL(kretprobe_trampoline_holder);
 NOKPROBE_SYMBOL(kretprobe_trampoline);
 
+static struct kprobe kretprobe_kprobe = {
+	.addr = (void *)kretprobe_trampoline,
+};
+
 /*
  * Called from kretprobe_trampoline
  */
 __visible __used void *trampoline_handler(struct pt_regs *regs)
 {
+	struct kprobe_ctlblk *kcb;
 	struct kretprobe_instance *ri = NULL;
 	struct hlist_head *head, empty_rp;
 	struct hlist_node *tmp;
@@ -750,6 +755,17 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
 	void *frame_pointer;
 	bool skipped = false;
 
+	preempt_disable();
+
+	/*
+	 * Set a dummy kprobe for avoiding kretprobe recursion.
+	 * Since kretprobe never run in kprobe handler, kprobe must not
+	 * be running at this point.
+	 */
+	kcb = get_kprobe_ctlblk();
+	__this_cpu_write(current_kprobe, &kretprobe_kprobe);
+	kcb->kprobe_status = KPROBE_HIT_ACTIVE;
+
 	INIT_HLIST_HEAD(&empty_rp);
 	kretprobe_hash_lock(current, &head, &flags);
 	/* fixup registers */
@@ -825,10 +841,9 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
 		orig_ret_address = (unsigned long)ri->ret_addr;
 		if (ri->rp && ri->rp->handler) {
 			__this_cpu_write(current_kprobe, &ri->rp->kp);
-			get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE;
 			ri->ret_addr = correct_ret_addr;
 			ri->rp->handler(ri, regs);
-			__this_cpu_write(current_kprobe, NULL);
+			__this_cpu_write(current_kprobe, &kretprobe_kprobe);
 		}
 
 		recycle_rp_inst(ri, &empty_rp);
@@ -844,6 +859,9 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
 
 	kretprobe_hash_unlock(current, &flags);
 
+	__this_cpu_write(current_kprobe, NULL);
+	preempt_enable();
+
 	hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
 		hlist_del(&ri->hlist);
 		kfree(ri);

From 4acdb381da95af7863b1f886c91ee13eeb6bc172 Mon Sep 17 00:00:00 2001
From: Jiri Olsa <jolsa@redhat.com>
Date: Tue, 12 May 2020 17:03:18 +0900
Subject: [PATCH 0071/2658] kretprobe: Prevent triggering kretprobe from within
 kprobe_flush_task

[ Upstream commit 9b38cc704e844e41d9cf74e647bff1d249512cb3 ]

Ziqian reported lockup when adding retprobe on _raw_spin_lock_irqsave.
My test was also able to trigger lockdep output:

 ============================================
 WARNING: possible recursive locking detected
 5.6.0-rc6+ #6 Not tainted
 --------------------------------------------
 sched-messaging/2767 is trying to acquire lock:
 ffffffff9a492798 (&(kretprobe_table_locks[i].lock)){-.-.}, at: kretprobe_hash_lock+0x52/0xa0

 but task is already holding lock:
 ffffffff9a491a18 (&(kretprobe_table_locks[i].lock)){-.-.}, at: kretprobe_trampoline+0x0/0x50

 other info that might help us debug this:
  Possible unsafe locking scenario:

        CPU0
        ----
   lock(&(kretprobe_table_locks[i].lock));
   lock(&(kretprobe_table_locks[i].lock));

  *** DEADLOCK ***

  May be due to missing lock nesting notation

 1 lock held by sched-messaging/2767:
  #0: ffffffff9a491a18 (&(kretprobe_table_locks[i].lock)){-.-.}, at: kretprobe_trampoline+0x0/0x50

 stack backtrace:
 CPU: 3 PID: 2767 Comm: sched-messaging Not tainted 5.6.0-rc6+ #6
 Call Trace:
  dump_stack+0x96/0xe0
  __lock_acquire.cold.57+0x173/0x2b7
  ? native_queued_spin_lock_slowpath+0x42b/0x9e0
  ? lockdep_hardirqs_on+0x590/0x590
  ? __lock_acquire+0xf63/0x4030
  lock_acquire+0x15a/0x3d0
  ? kretprobe_hash_lock+0x52/0xa0
  _raw_spin_lock_irqsave+0x36/0x70
  ? kretprobe_hash_lock+0x52/0xa0
  kretprobe_hash_lock+0x52/0xa0
  trampoline_handler+0xf8/0x940
  ? kprobe_fault_handler+0x380/0x380
  ? find_held_lock+0x3a/0x1c0
  kretprobe_trampoline+0x25/0x50
  ? lock_acquired+0x392/0xbc0
  ? _raw_spin_lock_irqsave+0x50/0x70
  ? __get_valid_kprobe+0x1f0/0x1f0
  ? _raw_spin_unlock_irqrestore+0x3b/0x40
  ? finish_task_switch+0x4b9/0x6d0
  ? __switch_to_asm+0x34/0x70
  ? __switch_to_asm+0x40/0x70

The code within the kretprobe handler checks for probe reentrancy,
so we won't trigger any _raw_spin_lock_irqsave probe in there.

The problem is in outside kprobe_flush_task, where we call:

  kprobe_flush_task
    kretprobe_table_lock
      raw_spin_lock_irqsave
        _raw_spin_lock_irqsave

where _raw_spin_lock_irqsave triggers the kretprobe and installs
kretprobe_trampoline handler on _raw_spin_lock_irqsave return.

The kretprobe_trampoline handler is then executed with already
locked kretprobe_table_locks, and first thing it does is to
lock kretprobe_table_locks ;-) the whole lockup path like:

  kprobe_flush_task
    kretprobe_table_lock
      raw_spin_lock_irqsave
        _raw_spin_lock_irqsave ---> probe triggered, kretprobe_trampoline installed

        ---> kretprobe_table_locks locked

        kretprobe_trampoline
          trampoline_handler
            kretprobe_hash_lock(current, &head, &flags);  <--- deadlock

Adding kprobe_busy_begin/end helpers that mark code with fake
probe installed to prevent triggering of another kprobe within
this code.

Using these helpers in kprobe_flush_task, so the probe recursion
protection check is hit and the probe is never set to prevent
above lockup.

Link: http://lkml.kernel.org/r/158927059835.27680.7011202830041561604.stgit@devnote2

Fixes: ef53d9c5e4da ("kprobes: improve kretprobe scalability with hashed locking")
Cc: Ingo Molnar <mingo@kernel.org>
Cc: "Gustavo A . R . Silva" <gustavoars@kernel.org>
Cc: Anders Roxell <anders.roxell@linaro.org>
Cc: "Naveen N . Rao" <naveen.n.rao@linux.ibm.com>
Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
Cc: David Miller <davem@davemloft.net>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: stable@vger.kernel.org
Reported-by: "Ziqian SUN (Zamir)" <zsun@redhat.com>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/kprobes/core.c | 16 +++-------------
 include/linux/kprobes.h        |  4 ++++
 kernel/kprobes.c               | 24 ++++++++++++++++++++++++
 3 files changed, 31 insertions(+), 13 deletions(-)

diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 8853ebdaaee1..d10de095182e 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -736,16 +736,11 @@ static void __used kretprobe_trampoline_holder(void)
 NOKPROBE_SYMBOL(kretprobe_trampoline_holder);
 NOKPROBE_SYMBOL(kretprobe_trampoline);
 
-static struct kprobe kretprobe_kprobe = {
-	.addr = (void *)kretprobe_trampoline,
-};
-
 /*
  * Called from kretprobe_trampoline
  */
 __visible __used void *trampoline_handler(struct pt_regs *regs)
 {
-	struct kprobe_ctlblk *kcb;
 	struct kretprobe_instance *ri = NULL;
 	struct hlist_head *head, empty_rp;
 	struct hlist_node *tmp;
@@ -755,16 +750,12 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
 	void *frame_pointer;
 	bool skipped = false;
 
-	preempt_disable();
-
 	/*
 	 * Set a dummy kprobe for avoiding kretprobe recursion.
 	 * Since kretprobe never run in kprobe handler, kprobe must not
 	 * be running at this point.
 	 */
-	kcb = get_kprobe_ctlblk();
-	__this_cpu_write(current_kprobe, &kretprobe_kprobe);
-	kcb->kprobe_status = KPROBE_HIT_ACTIVE;
+	kprobe_busy_begin();
 
 	INIT_HLIST_HEAD(&empty_rp);
 	kretprobe_hash_lock(current, &head, &flags);
@@ -843,7 +834,7 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
 			__this_cpu_write(current_kprobe, &ri->rp->kp);
 			ri->ret_addr = correct_ret_addr;
 			ri->rp->handler(ri, regs);
-			__this_cpu_write(current_kprobe, &kretprobe_kprobe);
+			__this_cpu_write(current_kprobe, &kprobe_busy);
 		}
 
 		recycle_rp_inst(ri, &empty_rp);
@@ -859,8 +850,7 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
 
 	kretprobe_hash_unlock(current, &flags);
 
-	__this_cpu_write(current_kprobe, NULL);
-	preempt_enable();
+	kprobe_busy_end();
 
 	hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
 		hlist_del(&ri->hlist);
diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h
index cb527c78de9f..4db62045f01a 100644
--- a/include/linux/kprobes.h
+++ b/include/linux/kprobes.h
@@ -366,6 +366,10 @@ static inline struct kprobe_ctlblk *get_kprobe_ctlblk(void)
 	return this_cpu_ptr(&kprobe_ctlblk);
 }
 
+extern struct kprobe kprobe_busy;
+void kprobe_busy_begin(void);
+void kprobe_busy_end(void);
+
 int register_kprobe(struct kprobe *p);
 void unregister_kprobe(struct kprobe *p);
 int register_kprobes(struct kprobe **kps, int num);
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 430baa19e48c..5bda113a3116 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1150,6 +1150,26 @@ __releases(hlist_lock)
 }
 NOKPROBE_SYMBOL(kretprobe_table_unlock);
 
+struct kprobe kprobe_busy = {
+	.addr = (void *) get_kprobe,
+};
+
+void kprobe_busy_begin(void)
+{
+	struct kprobe_ctlblk *kcb;
+
+	preempt_disable();
+	__this_cpu_write(current_kprobe, &kprobe_busy);
+	kcb = get_kprobe_ctlblk();
+	kcb->kprobe_status = KPROBE_HIT_ACTIVE;
+}
+
+void kprobe_busy_end(void)
+{
+	__this_cpu_write(current_kprobe, NULL);
+	preempt_enable();
+}
+
 /*
  * This function is called from finish_task_switch when task tk becomes dead,
  * so that we can recycle any function-return probe instances associated
@@ -1167,6 +1187,8 @@ void kprobe_flush_task(struct task_struct *tk)
 		/* Early boot.  kretprobe_table_locks not yet initialized. */
 		return;
 
+	kprobe_busy_begin();
+
 	INIT_HLIST_HEAD(&empty_rp);
 	hash = hash_ptr(tk, KPROBE_HASH_BITS);
 	head = &kretprobe_inst_table[hash];
@@ -1180,6 +1202,8 @@ void kprobe_flush_task(struct task_struct *tk)
 		hlist_del(&ri->hlist);
 		kfree(ri);
 	}
+
+	kprobe_busy_end();
 }
 NOKPROBE_SYMBOL(kprobe_flush_task);
 

From 4b1e764281a16ec2fdd1b63ac866e04fc3c7d923 Mon Sep 17 00:00:00 2001
From: Chen Yu <yu.c.chen@intel.com>
Date: Fri, 22 May 2020 01:59:00 +0800
Subject: [PATCH 0072/2658] e1000e: Do not wake up the system via WOL if device
 wakeup is disabled

[ Upstream commit 6bf6be1127f7e6d4bf39f84d56854e944d045d74 ]

Currently the system will be woken up via WOL(Wake On LAN) even if the
device wakeup ability has been disabled via sysfs:
 cat /sys/devices/pci0000:00/0000:00:1f.6/power/wakeup
 disabled

The system should not be woken up if the user has explicitly
disabled the wake up ability for this device.

This patch clears the WOL ability of this network device if the
user has disabled the wake up ability in sysfs.

Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver")
Reported-by: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Chen Yu <yu.c.chen@intel.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/e1000e/netdev.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 203f96faf6fb..3bd0bdbdfa0e 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -6270,11 +6270,17 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime)
 	struct net_device *netdev = pci_get_drvdata(pdev);
 	struct e1000_adapter *adapter = netdev_priv(netdev);
 	struct e1000_hw *hw = &adapter->hw;
-	u32 ctrl, ctrl_ext, rctl, status;
-	/* Runtime suspend should only enable wakeup for link changes */
-	u32 wufc = runtime ? E1000_WUFC_LNKC : adapter->wol;
+	u32 ctrl, ctrl_ext, rctl, status, wufc;
 	int retval = 0;
 
+	/* Runtime suspend should only enable wakeup for link changes */
+	if (runtime)
+		wufc = E1000_WUFC_LNKC;
+	else if (device_may_wakeup(&pdev->dev))
+		wufc = adapter->wol;
+	else
+		wufc = 0;
+
 	status = er32(STATUS);
 	if (status & E1000_STATUS_LU)
 		wufc &= ~E1000_WUFC_LNKC;
@@ -6332,7 +6338,7 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime)
 		e1000e_igp3_phy_powerdown_workaround_ich8lan(&adapter->hw);
 	} else if ((hw->mac.type == e1000_pch_lpt) ||
 		   (hw->mac.type == e1000_pch_spt)) {
-		if (!(wufc & (E1000_WUFC_EX | E1000_WUFC_MC | E1000_WUFC_BC)))
+		if (wufc && !(wufc & (E1000_WUFC_EX | E1000_WUFC_MC | E1000_WUFC_BC)))
 			/* ULP does not support wake from unicast, multicast
 			 * or broadcast.
 			 */

From 8a87cd8886e39ba7c87606054e091206e7b88b19 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Tue, 15 Oct 2019 21:18:08 +0200
Subject: [PATCH 0073/2658] sched/rt, net: Use CONFIG_PREEMPTION.patch

[ Upstream commit 2da2b32fd9346009e9acdb68c570ca8d3966aba7 ]

CONFIG_PREEMPTION is selected by CONFIG_PREEMPT and by CONFIG_PREEMPT_RT.
Both PREEMPT and PREEMPT_RT require the same functionality which today
depends on CONFIG_PREEMPT.

Update the comment to use CONFIG_PREEMPTION.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: David S. Miller <davem@davemloft.net>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: netdev@vger.kernel.org
Link: https://lore.kernel.org/r/20191015191821.11479-22-bigeasy@linutronix.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index f9d44c85f064..1a1b0008b6c1 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -867,7 +867,7 @@ EXPORT_SYMBOL(dev_get_by_index);
  *
  *	The use of raw_seqcount_begin() and cond_resched() before
  *	retrying is required as we want to give the writers a chance
- *	to complete when CONFIG_PREEMPT is not set.
+ *	to complete when CONFIG_PREEMPTION is not set.
  */
 int netdev_get_name(struct net *net, char *name, int ifindex)
 {

From d67b3c74305950b06620a799915abcf8513876f0 Mon Sep 17 00:00:00 2001
From: "Ahmed S. Darwish" <a.darwish@linutronix.de>
Date: Wed, 3 Jun 2020 16:49:44 +0200
Subject: [PATCH 0074/2658] net: core: device_rename: Use rwsem instead of a
 seqcount

[ Upstream commit 11d6011c2cf29f7c8181ebde6c8bc0c4d83adcd7 ]

Sequence counters write paths are critical sections that must never be
preempted, and blocking, even for CONFIG_PREEMPTION=n, is not allowed.

Commit 5dbe7c178d3f ("net: fix kernel deadlock with interface rename and
netdev name retrieval.") handled a deadlock, observed with
CONFIG_PREEMPTION=n, where the devnet_rename seqcount read side was
infinitely spinning: it got scheduled after the seqcount write side
blocked inside its own critical section.

To fix that deadlock, among other issues, the commit added a
cond_resched() inside the read side section. While this will get the
non-preemptible kernel eventually unstuck, the seqcount reader is fully
exhausting its slice just spinning -- until TIF_NEED_RESCHED is set.

The fix is also still broken: if the seqcount reader belongs to a
real-time scheduling policy, it can spin forever and the kernel will
livelock.

Disabling preemption over the seqcount write side critical section will
not work: inside it are a number of GFP_KERNEL allocations and mutex
locking through the drivers/base/ :: device_rename() call chain.

>From all the above, replace the seqcount with a rwsem.

Fixes: 5dbe7c178d3f (net: fix kernel deadlock with interface rename and netdev name retrieval.)
Fixes: 30e6c9fa93cf (net: devnet_rename_seq should be a seqcount)
Fixes: c91f6df2db49 (sockopt: Change getsockopt() of SO_BINDTODEVICE to return an interface name)
Cc: <stable@vger.kernel.org>
Reported-by: kbuild test robot <lkp@intel.com> [ v1 missing up_read() on error exit ]
Reported-by: Dan Carpenter <dan.carpenter@oracle.com> [ v1 missing up_read() on error exit ]
Signed-off-by: Ahmed S. Darwish <a.darwish@linutronix.de>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/dev.c | 40 ++++++++++++++++++----------------------
 1 file changed, 18 insertions(+), 22 deletions(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index 1a1b0008b6c1..0cfb71e1b38a 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -82,6 +82,7 @@
 #include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/mutex.h>
+#include <linux/rwsem.h>
 #include <linux/string.h>
 #include <linux/mm.h>
 #include <linux/socket.h>
@@ -187,7 +188,7 @@ static DEFINE_SPINLOCK(napi_hash_lock);
 static unsigned int napi_gen_id = NR_CPUS;
 static DEFINE_HASHTABLE(napi_hash, 8);
 
-static seqcount_t devnet_rename_seq;
+static DECLARE_RWSEM(devnet_rename_sem);
 
 static inline void dev_base_seq_inc(struct net *net)
 {
@@ -864,33 +865,28 @@ EXPORT_SYMBOL(dev_get_by_index);
  *	@net: network namespace
  *	@name: a pointer to the buffer where the name will be stored.
  *	@ifindex: the ifindex of the interface to get the name from.
- *
- *	The use of raw_seqcount_begin() and cond_resched() before
- *	retrying is required as we want to give the writers a chance
- *	to complete when CONFIG_PREEMPTION is not set.
  */
 int netdev_get_name(struct net *net, char *name, int ifindex)
 {
 	struct net_device *dev;
-	unsigned int seq;
+	int ret;
 
-retry:
-	seq = raw_seqcount_begin(&devnet_rename_seq);
+	down_read(&devnet_rename_sem);
 	rcu_read_lock();
+
 	dev = dev_get_by_index_rcu(net, ifindex);
 	if (!dev) {
-		rcu_read_unlock();
-		return -ENODEV;
+		ret = -ENODEV;
+		goto out;
 	}
 
 	strcpy(name, dev->name);
-	rcu_read_unlock();
-	if (read_seqcount_retry(&devnet_rename_seq, seq)) {
-		cond_resched();
-		goto retry;
-	}
 
-	return 0;
+	ret = 0;
+out:
+	rcu_read_unlock();
+	up_read(&devnet_rename_sem);
+	return ret;
 }
 
 /**
@@ -1155,10 +1151,10 @@ int dev_change_name(struct net_device *dev, const char *newname)
 	if (dev->flags & IFF_UP)
 		return -EBUSY;
 
-	write_seqcount_begin(&devnet_rename_seq);
+	down_write(&devnet_rename_sem);
 
 	if (strncmp(newname, dev->name, IFNAMSIZ) == 0) {
-		write_seqcount_end(&devnet_rename_seq);
+		up_write(&devnet_rename_sem);
 		return 0;
 	}
 
@@ -1166,7 +1162,7 @@ int dev_change_name(struct net_device *dev, const char *newname)
 
 	err = dev_get_valid_name(net, dev, newname);
 	if (err < 0) {
-		write_seqcount_end(&devnet_rename_seq);
+		up_write(&devnet_rename_sem);
 		return err;
 	}
 
@@ -1181,11 +1177,11 @@ int dev_change_name(struct net_device *dev, const char *newname)
 	if (ret) {
 		memcpy(dev->name, oldname, IFNAMSIZ);
 		dev->name_assign_type = old_assign_type;
-		write_seqcount_end(&devnet_rename_seq);
+		up_write(&devnet_rename_sem);
 		return ret;
 	}
 
-	write_seqcount_end(&devnet_rename_seq);
+	up_write(&devnet_rename_sem);
 
 	netdev_adjacent_rename_links(dev, oldname);
 
@@ -1206,7 +1202,7 @@ int dev_change_name(struct net_device *dev, const char *newname)
 		/* err >= 0 after dev_alloc_name() or stores the first errno */
 		if (err >= 0) {
 			err = ret;
-			write_seqcount_begin(&devnet_rename_seq);
+			down_write(&devnet_rename_sem);
 			memcpy(dev->name, oldname, IFNAMSIZ);
 			memcpy(oldname, newname, IFNAMSIZ);
 			dev->name_assign_type = old_assign_type;

From 0824f06e085da6d0d5629923120f073cb021135f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@redhat.com>
Date: Tue, 23 Jun 2020 17:00:53 +0200
Subject: [PATCH 0075/2658] net: Revert "pkt_sched: fq: use proper locking in
 fq_dump_stats()"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit 191cf872190de28a92e1bd2b56d8860e37e07443 which is
commit 695b4ec0f0a9cf29deabd3ac075911d58b31f42b upstream.

That commit should never have been backported since it relies on a change in
locking semantics that was introduced in v4.8 and not backported. Because of
this, the backported commit to sch_fq leads to lockups because of the double
locking.

Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/sch_fq.c | 32 ++++++++++++++------------------
 1 file changed, 14 insertions(+), 18 deletions(-)

diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index f4aa2ab4713a..eb814ffc0902 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -830,24 +830,20 @@ static int fq_dump(struct Qdisc *sch, struct sk_buff *skb)
 static int fq_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
 {
 	struct fq_sched_data *q = qdisc_priv(sch);
-	struct tc_fq_qd_stats st;
-
-	sch_tree_lock(sch);
-
-	st.gc_flows		  = q->stat_gc_flows;
-	st.highprio_packets	  = q->stat_internal_packets;
-	st.tcp_retrans		  = q->stat_tcp_retrans;
-	st.throttled		  = q->stat_throttled;
-	st.flows_plimit		  = q->stat_flows_plimit;
-	st.pkts_too_long	  = q->stat_pkts_too_long;
-	st.allocation_errors	  = q->stat_allocation_errors;
-	st.time_next_delayed_flow = q->time_next_delayed_flow - ktime_get_ns();
-	st.flows		  = q->flows;
-	st.inactive_flows	  = q->inactive_flows;
-	st.throttled_flows	  = q->throttled_flows;
-	st.pad			  = 0;
-
-	sch_tree_unlock(sch);
+	u64 now = ktime_get_ns();
+	struct tc_fq_qd_stats st = {
+		.gc_flows		= q->stat_gc_flows,
+		.highprio_packets	= q->stat_internal_packets,
+		.tcp_retrans		= q->stat_tcp_retrans,
+		.throttled		= q->stat_throttled,
+		.flows_plimit		= q->stat_flows_plimit,
+		.pkts_too_long		= q->stat_pkts_too_long,
+		.allocation_errors	= q->stat_allocation_errors,
+		.flows			= q->flows,
+		.inactive_flows		= q->inactive_flows,
+		.throttled_flows	= q->throttled_flows,
+		.time_next_delayed_flow	= q->time_next_delayed_flow - now,
+	};
 
 	return gnet_stats_copy_app(d, &st, sizeof(st));
 }

From 325bd3d3641d856cba00c43cb2aac855178b5983 Mon Sep 17 00:00:00 2001
From: Martin Wilck <mwilck@suse.com>
Date: Mon, 27 Nov 2017 23:47:34 +0100
Subject: [PATCH 0076/2658] scsi: scsi_devinfo: handle non-terminated strings

commit ba69ead9e9e9bb3cec5faf03526c36764ac8942a upstream.

devinfo->vendor and devinfo->model aren't necessarily
zero-terminated.

Fixes: b8018b973c7c "scsi_devinfo: fixup string compare"
Signed-off-by: Martin Wilck <mwilck@suse.com>
Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/scsi_devinfo.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index 4055cb7c212b..3a9b6b61607e 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -443,7 +443,8 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
 			/*
 			 * vendor strings must be an exact match
 			 */
-			if (vmax != strlen(devinfo->vendor) ||
+			if (vmax != strnlen(devinfo->vendor,
+					    sizeof(devinfo->vendor)) ||
 			    memcmp(devinfo->vendor, vskip, vmax))
 				continue;
 
@@ -451,7 +452,7 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
 			 * @model specifies the full string, and
 			 * must be larger or equal to devinfo->model
 			 */
-			mlen = strlen(devinfo->model);
+			mlen = strnlen(devinfo->model, sizeof(devinfo->model));
 			if (mmax < mlen || memcmp(devinfo->model, mskip, mlen))
 				continue;
 			return devinfo;

From 814f57a77b5b142bd36e379424667c84e1f4f26c Mon Sep 17 00:00:00 2001
From: Ridge Kennedy <ridge.kennedy@alliedtelesis.co.nz>
Date: Tue, 4 Feb 2020 12:24:00 +1300
Subject: [PATCH 0077/2658] l2tp: Allow duplicate session creation with UDP

commit 0d0d9a388a858e271bb70e71e99e7fe2a6fd6f64 upstream.

In the past it was possible to create multiple L2TPv3 sessions with the
same session id as long as the sessions belonged to different tunnels.
The resulting sessions had issues when used with IP encapsulated tunnels,
but worked fine with UDP encapsulated ones. Some applications began to
rely on this behaviour to avoid having to negotiate unique session ids.

Some time ago a change was made to require session ids to be unique across
all tunnels, breaking the applications making use of this "feature".

This change relaxes the duplicate session id check to allow duplicates
if both of the colliding sessions belong to UDP encapsulated tunnels.

Fixes: dbdbc73b4478 ("l2tp: fix duplicate session creation")
Signed-off-by: Ridge Kennedy <ridge.kennedy@alliedtelesis.co.nz>
Acked-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/l2tp/l2tp_core.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 239464045697..53c53b1c881c 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -351,8 +351,13 @@ int l2tp_session_register(struct l2tp_session *session,
 
 		spin_lock_bh(&pn->l2tp_session_hlist_lock);
 
+		/* IP encap expects session IDs to be globally unique, while
+		 * UDP encap doesn't.
+		 */
 		hlist_for_each_entry(session_walk, g_head, global_hlist)
-			if (session_walk->session_id == session->session_id) {
+			if (session_walk->session_id == session->session_id &&
+			    (session_walk->tunnel->encap == L2TP_ENCAPTYPE_IP ||
+			     tunnel->encap == L2TP_ENCAPTYPE_IP)) {
 				err = -EEXIST;
 				goto err_tlock_pnlock;
 			}

From e2aa5bbc720e10df2948867f362ef768249639cc Mon Sep 17 00:00:00 2001
From: Valentin Longchamp <valentin@longchamp.me>
Date: Tue, 9 Jun 2020 22:11:54 +0200
Subject: [PATCH 0078/2658] net: sched: export __netdev_watchdog_up()

[ Upstream commit 1a3db27ad9a72d033235b9673653962c02e3486e ]

Since the quiesce/activate rework, __netdev_watchdog_up() is directly
called in the ucc_geth driver.

Unfortunately, this function is not available for modules and thus
ucc_geth cannot be built as a module anymore. Fix it by exporting
__netdev_watchdog_up().

Since the commit introducing the regression was backported to stable
branches, this one should ideally be as well.

Fixes: 79dde73cf9bc ("net/ethernet/freescale: rework quiesce/activate for ucc_geth")
Signed-off-by: Valentin Longchamp <valentin@longchamp.me>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/sch_generic.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 09cd65434748..10c05fa0e6b3 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -329,6 +329,7 @@ void __netdev_watchdog_up(struct net_device *dev)
 			dev_hold(dev);
 	}
 }
+EXPORT_SYMBOL_GPL(__netdev_watchdog_up);
 
 static void dev_watchdog_up(struct net_device *dev)
 {

From 969f67a6610d9c80a85030418aff16af33f3e959 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Sat, 6 Jun 2020 23:44:24 -0400
Subject: [PATCH 0079/2658] fix a braino in "sparc32: fix register window
 handling in genregs32_[gs]et()"

[ Upstream commit 9d964e1b82d8182184153b70174f445ea616f053 ]

lost npc in PTRACE_SETREGSET, breaking PTRACE_SETREGS as well

Fixes: cf51e129b968 "sparc32: fix register window handling in genregs32_[gs]et()"
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/sparc/kernel/ptrace_32.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/sparc/kernel/ptrace_32.c b/arch/sparc/kernel/ptrace_32.c
index 396dbdea0cfa..2f4316c14266 100644
--- a/arch/sparc/kernel/ptrace_32.c
+++ b/arch/sparc/kernel/ptrace_32.c
@@ -167,12 +167,17 @@ static int genregs32_set(struct task_struct *target,
 	if (ret || !count)
 		return ret;
 	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-				 &regs->y,
+				 &regs->npc,
 				 34 * sizeof(u32), 35 * sizeof(u32));
 	if (ret || !count)
 		return ret;
+	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
+				 &regs->y,
+				 35 * sizeof(u32), 36 * sizeof(u32));
+	if (ret || !count)
+		return ret;
 	return user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf,
-					 35 * sizeof(u32), 38 * sizeof(u32));
+					 36 * sizeof(u32), 38 * sizeof(u32));
 }
 
 static int fpregs32_get(struct task_struct *target,

From 78749f2b70d3b173cd41af3e6ad739d0ec1a152a Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Tue, 16 Jun 2020 09:39:21 +0000
Subject: [PATCH 0080/2658] net: fix memleak in register_netdevice()

[ Upstream commit 814152a89ed52c722ab92e9fbabcac3cb8a39245 ]

I got a memleak report when doing some fuzz test:

unreferenced object 0xffff888112584000 (size 13599):
  comm "ip", pid 3048, jiffies 4294911734 (age 343.491s)
  hex dump (first 32 bytes):
    74 61 70 30 00 00 00 00 00 00 00 00 00 00 00 00  tap0............
    00 ee d9 19 81 88 ff ff 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<000000002f60ba65>] __kmalloc_node+0x309/0x3a0
    [<0000000075b211ec>] kvmalloc_node+0x7f/0xc0
    [<00000000d3a97396>] alloc_netdev_mqs+0x76/0xfc0
    [<00000000609c3655>] __tun_chr_ioctl+0x1456/0x3d70
    [<000000001127ca24>] ksys_ioctl+0xe5/0x130
    [<00000000b7d5e66a>] __x64_sys_ioctl+0x6f/0xb0
    [<00000000e1023498>] do_syscall_64+0x56/0xa0
    [<000000009ec0eb12>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
unreferenced object 0xffff888111845cc0 (size 8):
  comm "ip", pid 3048, jiffies 4294911734 (age 343.491s)
  hex dump (first 8 bytes):
    74 61 70 30 00 88 ff ff                          tap0....
  backtrace:
    [<000000004c159777>] kstrdup+0x35/0x70
    [<00000000d8b496ad>] kstrdup_const+0x3d/0x50
    [<00000000494e884a>] kvasprintf_const+0xf1/0x180
    [<0000000097880a2b>] kobject_set_name_vargs+0x56/0x140
    [<000000008fbdfc7b>] dev_set_name+0xab/0xe0
    [<000000005b99e3b4>] netdev_register_kobject+0xc0/0x390
    [<00000000602704fe>] register_netdevice+0xb61/0x1250
    [<000000002b7ca244>] __tun_chr_ioctl+0x1cd1/0x3d70
    [<000000001127ca24>] ksys_ioctl+0xe5/0x130
    [<00000000b7d5e66a>] __x64_sys_ioctl+0x6f/0xb0
    [<00000000e1023498>] do_syscall_64+0x56/0xa0
    [<000000009ec0eb12>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
unreferenced object 0xffff88811886d800 (size 512):
  comm "ip", pid 3048, jiffies 4294911734 (age 343.491s)
  hex dump (first 32 bytes):
    00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........
    ff ff ff ff ff ff ff ff c0 66 3d a3 ff ff ff ff  .........f=.....
  backtrace:
    [<0000000050315800>] device_add+0x61e/0x1950
    [<0000000021008dfb>] netdev_register_kobject+0x17e/0x390
    [<00000000602704fe>] register_netdevice+0xb61/0x1250
    [<000000002b7ca244>] __tun_chr_ioctl+0x1cd1/0x3d70
    [<000000001127ca24>] ksys_ioctl+0xe5/0x130
    [<00000000b7d5e66a>] __x64_sys_ioctl+0x6f/0xb0
    [<00000000e1023498>] do_syscall_64+0x56/0xa0
    [<000000009ec0eb12>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

If call_netdevice_notifiers() failed, then rollback_registered()
calls netdev_unregister_kobject() which holds the kobject. The
reference cannot be put because the netdev won't be add to todo
list, so it will leads a memleak, we need put the reference to
avoid memleak.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/dev.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/core/dev.c b/net/core/dev.c
index 0cfb71e1b38a..7fbf4f77917c 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6876,6 +6876,13 @@ int register_netdevice(struct net_device *dev)
 		rcu_barrier();
 
 		dev->reg_state = NETREG_UNREGISTERED;
+		/* We should put the kobject that hold in
+		 * netdev_unregister_kobject(), otherwise
+		 * the net device cannot be freed when
+		 * driver calls free_netdev(), because the
+		 * kobject is being hold.
+		 */
+		kobject_put(&dev->dev.kobj);
 	}
 	/*
 	 *	Prevent userspace races by waiting until the network

From c01907a617c27a1ee776ee038eb45cc850c6b5c7 Mon Sep 17 00:00:00 2001
From: Jeremy Kerr <jk@ozlabs.org>
Date: Mon, 15 Jun 2020 10:54:56 +0800
Subject: [PATCH 0081/2658] net: usb: ax88179_178a: fix packet alignment
 padding

[ Upstream commit e869e7a17798d85829fa7d4f9bbe1eebd4b2d3f6 ]

Using a AX88179 device (0b95:1790), I see two bytes of appended data on
every RX packet. For example, this 48-byte ping, using 0xff as a
payload byte:

  04:20:22.528472 IP 192.168.1.1 > 192.168.1.2: ICMP echo request, id 2447, seq 1, length 64
	0x0000:  000a cd35 ea50 000a cd35 ea4f 0800 4500
	0x0010:  0054 c116 4000 4001 f63e c0a8 0101 c0a8
	0x0020:  0102 0800 b633 098f 0001 87ea cd5e 0000
	0x0030:  0000 dcf2 0600 0000 0000 ffff ffff ffff
	0x0040:  ffff ffff ffff ffff ffff ffff ffff ffff
	0x0050:  ffff ffff ffff ffff ffff ffff ffff ffff
	0x0060:  ffff 961f

Those last two bytes - 96 1f - aren't part of the original packet.

In the ax88179 RX path, the usbnet rx_fixup function trims a 2-byte
'alignment pseudo header' from the start of the packet, and sets the
length from a per-packet field populated by hardware. It looks like that
length field *includes* the 2-byte header; the current driver assumes
that it's excluded.

This change trims the 2-byte alignment header after we've set the packet
length, so the resulting packet length is correct. While we're moving
the comment around, this also fixes the spelling of 'pseudo'.

Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/ax88179_178a.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index e3f2e6098db4..2dcc8a039d42 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1396,10 +1396,10 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 		}
 
 		if (pkt_cnt == 0) {
-			/* Skip IP alignment psudo header */
-			skb_pull(skb, 2);
 			skb->len = pkt_len;
-			skb_set_tail_pointer(skb, pkt_len);
+			/* Skip IP alignment pseudo header */
+			skb_pull(skb, 2);
+			skb_set_tail_pointer(skb, skb->len);
 			skb->truesize = pkt_len + sizeof(struct sk_buff);
 			ax88179_rx_checksum(skb, pkt_hdr);
 			return 1;
@@ -1408,8 +1408,9 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 		ax_skb = skb_clone(skb, GFP_ATOMIC);
 		if (ax_skb) {
 			ax_skb->len = pkt_len;
-			ax_skb->data = skb->data + 2;
-			skb_set_tail_pointer(ax_skb, pkt_len);
+			/* Skip IP alignment pseudo header */
+			skb_pull(ax_skb, 2);
+			skb_set_tail_pointer(ax_skb, ax_skb->len);
 			ax_skb->truesize = pkt_len + sizeof(struct sk_buff);
 			ax88179_rx_checksum(ax_skb, pkt_hdr);
 			usbnet_skb_return(dev, ax_skb);

From 80ce51489eacc55764ab0573684a00c721cab80d Mon Sep 17 00:00:00 2001
From: David Christensen <drc@linux.vnet.ibm.com>
Date: Wed, 17 Jun 2020 11:51:17 -0700
Subject: [PATCH 0082/2658] tg3: driver sleeps indefinitely when EEH errors
 exceed eeh_max_freezes

[ Upstream commit 3a2656a211caf35e56afc9425e6e518fa52f7fbc ]

The driver function tg3_io_error_detected() calls napi_disable twice,
without an intervening napi_enable, when the number of EEH errors exceeds
eeh_max_freezes, resulting in an indefinite sleep while holding rtnl_lock.

Add check for pcierr_recovery which skips code already executed for the
"Frozen" state.

Signed-off-by: David Christensen <drc@linux.vnet.ibm.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/tg3.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 58102e96ac5c..e198427d0f29 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -18182,8 +18182,8 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev,
 
 	rtnl_lock();
 
-	/* We probably don't have netdev yet */
-	if (!netdev || !netif_running(netdev))
+	/* Could be second call or maybe we don't have netdev yet */
+	if (!netdev || tp->pcierr_recovery || !netif_running(netdev))
 		goto done;
 
 	/* We needn't recover from permanent error */

From 8599899fd447684276d9e61354bf0f8c85aa5111 Mon Sep 17 00:00:00 2001
From: Taehee Yoo <ap420073@gmail.com>
Date: Tue, 16 Jun 2020 16:51:51 +0000
Subject: [PATCH 0083/2658] ip_tunnel: fix use-after-free in ip_tunnel_lookup()

[ Upstream commit ba61539c6ae57f4146284a5cb4f7b7ed8d42bf45 ]

In the datapath, the ip_tunnel_lookup() is used and it internally uses
fallback tunnel device pointer, which is fb_tunnel_dev.
This pointer variable should be set to NULL when a fb interface is deleted.
But there is no routine to set fb_tunnel_dev pointer to NULL.
So, this pointer will be still used after interface is deleted and
it eventually results in the use-after-free problem.

Test commands:
    ip netns add A
    ip netns add B
    ip link add eth0 type veth peer name eth1
    ip link set eth0 netns A
    ip link set eth1 netns B

    ip netns exec A ip link set lo up
    ip netns exec A ip link set eth0 up
    ip netns exec A ip link add gre1 type gre local 10.0.0.1 \
	    remote 10.0.0.2
    ip netns exec A ip link set gre1 up
    ip netns exec A ip a a 10.0.100.1/24 dev gre1
    ip netns exec A ip a a 10.0.0.1/24 dev eth0

    ip netns exec B ip link set lo up
    ip netns exec B ip link set eth1 up
    ip netns exec B ip link add gre1 type gre local 10.0.0.2 \
	    remote 10.0.0.1
    ip netns exec B ip link set gre1 up
    ip netns exec B ip a a 10.0.100.2/24 dev gre1
    ip netns exec B ip a a 10.0.0.2/24 dev eth1
    ip netns exec A hping3 10.0.100.2 -2 --flood -d 60000 &
    ip netns del B

Splat looks like:
[   77.793450][    C3] ==================================================================
[   77.794702][    C3] BUG: KASAN: use-after-free in ip_tunnel_lookup+0xcc4/0xf30
[   77.795573][    C3] Read of size 4 at addr ffff888060bd9c84 by task hping3/2905
[   77.796398][    C3]
[   77.796664][    C3] CPU: 3 PID: 2905 Comm: hping3 Not tainted 5.8.0-rc1+ #616
[   77.797474][    C3] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[   77.798453][    C3] Call Trace:
[   77.798815][    C3]  <IRQ>
[   77.799142][    C3]  dump_stack+0x9d/0xdb
[   77.799605][    C3]  print_address_description.constprop.7+0x2cc/0x450
[   77.800365][    C3]  ? ip_tunnel_lookup+0xcc4/0xf30
[   77.800908][    C3]  ? ip_tunnel_lookup+0xcc4/0xf30
[   77.801517][    C3]  ? ip_tunnel_lookup+0xcc4/0xf30
[   77.802145][    C3]  kasan_report+0x154/0x190
[   77.802821][    C3]  ? ip_tunnel_lookup+0xcc4/0xf30
[   77.803503][    C3]  ip_tunnel_lookup+0xcc4/0xf30
[   77.804165][    C3]  __ipgre_rcv+0x1ab/0xaa0 [ip_gre]
[   77.804862][    C3]  ? rcu_read_lock_sched_held+0xc0/0xc0
[   77.805621][    C3]  gre_rcv+0x304/0x1910 [ip_gre]
[   77.806293][    C3]  ? lock_acquire+0x1a9/0x870
[   77.806925][    C3]  ? gre_rcv+0xfe/0x354 [gre]
[   77.807559][    C3]  ? erspan_xmit+0x2e60/0x2e60 [ip_gre]
[   77.808305][    C3]  ? rcu_read_lock_sched_held+0xc0/0xc0
[   77.809032][    C3]  ? rcu_read_lock_held+0x90/0xa0
[   77.809713][    C3]  gre_rcv+0x1b8/0x354 [gre]
[ ... ]

Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/ip_tunnel.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 20b21f8578e1..3d9761516683 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -98,9 +98,10 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn,
 				   __be32 remote, __be32 local,
 				   __be32 key)
 {
-	unsigned int hash;
 	struct ip_tunnel *t, *cand = NULL;
 	struct hlist_head *head;
+	struct net_device *ndev;
+	unsigned int hash;
 
 	hash = ip_tunnel_hash(key, remote);
 	head = &itn->tunnels[hash];
@@ -175,8 +176,9 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn,
 	if (t)
 		return t;
 
-	if (itn->fb_tunnel_dev && itn->fb_tunnel_dev->flags & IFF_UP)
-		return netdev_priv(itn->fb_tunnel_dev);
+	ndev = READ_ONCE(itn->fb_tunnel_dev);
+	if (ndev && ndev->flags & IFF_UP)
+		return netdev_priv(ndev);
 
 	return NULL;
 }
@@ -1160,9 +1162,9 @@ void ip_tunnel_uninit(struct net_device *dev)
 	struct ip_tunnel_net *itn;
 
 	itn = net_generic(net, tunnel->ip_tnl_net_id);
-	/* fb_tunnel_dev will be unregisted in net-exit call. */
-	if (itn->fb_tunnel_dev != dev)
-		ip_tunnel_del(itn, netdev_priv(dev));
+	ip_tunnel_del(itn, netdev_priv(dev));
+	if (itn->fb_tunnel_dev == dev)
+		WRITE_ONCE(itn->fb_tunnel_dev, NULL);
 
 	dst_cache_reset(&tunnel->dst_cache);
 }

From b69620303a54c734e81f96cf252a41e0060461ac Mon Sep 17 00:00:00 2001
From: Neal Cardwell <ncardwell@google.com>
Date: Wed, 24 Jun 2020 12:42:02 -0400
Subject: [PATCH 0084/2658] tcp_cubic: fix spurious HYSTART_DELAY exit upon
 drop in min RTT

[ Upstream commit b344579ca8478598937215f7005d6c7b84d28aee ]

Mirja Kuehlewind reported a bug in Linux TCP CUBIC Hystart, where
Hystart HYSTART_DELAY mechanism can exit Slow Start spuriously on an
ACK when the minimum rtt of a connection goes down. From inspection it
is clear from the existing code that this could happen in an example
like the following:

o The first 8 RTT samples in a round trip are 150ms, resulting in a
  curr_rtt of 150ms and a delay_min of 150ms.

o The 9th RTT sample is 100ms. The curr_rtt does not change after the
  first 8 samples, so curr_rtt remains 150ms. But delay_min can be
  lowered at any time, so delay_min falls to 100ms. The code executes
  the HYSTART_DELAY comparison between curr_rtt of 150ms and delay_min
  of 100ms, and the curr_rtt is declared far enough above delay_min to
  force a (spurious) exit of Slow start.

The fix here is simple: allow every RTT sample in a round trip to
lower the curr_rtt.

Fixes: ae27e98a5152 ("[TCP] CUBIC v2.3")
Reported-by: Mirja Kuehlewind <mirja.kuehlewind@ericsson.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_cubic.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index 448c2615fece..9fb3a5e83a7c 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -414,6 +414,8 @@ static void hystart_update(struct sock *sk, u32 delay)
 
 	if (hystart_detect & HYSTART_DELAY) {
 		/* obtain the minimum delay of more than sampling packets */
+		if (ca->curr_rtt > delay)
+			ca->curr_rtt = delay;
 		if (ca->sample_cnt < HYSTART_MIN_SAMPLES) {
 			if (ca->curr_rtt == 0 || ca->curr_rtt > delay)
 				ca->curr_rtt = delay;

From d8c33b0d511567ace92cd32ae6b50cfc5284f87c Mon Sep 17 00:00:00 2001
From: Taehee Yoo <ap420073@gmail.com>
Date: Tue, 16 Jun 2020 16:04:00 +0000
Subject: [PATCH 0085/2658] ip6_gre: fix use-after-free in
 ip6gre_tunnel_lookup()

[ Upstream commit dafabb6590cb15f300b77c095d50312e2c7c8e0f ]

In the datapath, the ip6gre_tunnel_lookup() is used and it internally uses
fallback tunnel device pointer, which is fb_tunnel_dev.
This pointer variable should be set to NULL when a fb interface is deleted.
But there is no routine to set fb_tunnel_dev pointer to NULL.
So, this pointer will be still used after interface is deleted and
it eventually results in the use-after-free problem.

Test commands:
    ip netns add A
    ip netns add B
    ip link add eth0 type veth peer name eth1
    ip link set eth0 netns A
    ip link set eth1 netns B

    ip netns exec A ip link set lo up
    ip netns exec A ip link set eth0 up
    ip netns exec A ip link add ip6gre1 type ip6gre local fc:0::1 \
	    remote fc:0::2
    ip netns exec A ip -6 a a fc:100::1/64 dev ip6gre1
    ip netns exec A ip link set ip6gre1 up
    ip netns exec A ip -6 a a fc:0::1/64 dev eth0
    ip netns exec A ip link set ip6gre0 up

    ip netns exec B ip link set lo up
    ip netns exec B ip link set eth1 up
    ip netns exec B ip link add ip6gre1 type ip6gre local fc:0::2 \
	    remote fc:0::1
    ip netns exec B ip -6 a a fc:100::2/64 dev ip6gre1
    ip netns exec B ip link set ip6gre1 up
    ip netns exec B ip -6 a a fc:0::2/64 dev eth1
    ip netns exec B ip link set ip6gre0 up
    ip netns exec A ping fc:100::2 -s 60000 &
    ip netns del B

Splat looks like:
[   73.087285][    C1] BUG: KASAN: use-after-free in ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.088361][    C1] Read of size 4 at addr ffff888040559218 by task ping/1429
[   73.089317][    C1]
[   73.089638][    C1] CPU: 1 PID: 1429 Comm: ping Not tainted 5.7.0+ #602
[   73.090531][    C1] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[   73.091725][    C1] Call Trace:
[   73.092160][    C1]  <IRQ>
[   73.092556][    C1]  dump_stack+0x96/0xdb
[   73.093122][    C1]  print_address_description.constprop.6+0x2cc/0x450
[   73.094016][    C1]  ? ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.094894][    C1]  ? ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.095767][    C1]  ? ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.096619][    C1]  kasan_report+0x154/0x190
[   73.097209][    C1]  ? ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.097989][    C1]  ip6gre_tunnel_lookup+0x1064/0x13f0 [ip6_gre]
[   73.098750][    C1]  ? gre_del_protocol+0x60/0x60 [gre]
[   73.099500][    C1]  gre_rcv+0x1c5/0x1450 [ip6_gre]
[   73.100199][    C1]  ? ip6gre_header+0xf00/0xf00 [ip6_gre]
[   73.100985][    C1]  ? rcu_read_lock_sched_held+0xc0/0xc0
[   73.101830][    C1]  ? ip6_input_finish+0x5/0xf0
[   73.102483][    C1]  ip6_protocol_deliver_rcu+0xcbb/0x1510
[   73.103296][    C1]  ip6_input_finish+0x5b/0xf0
[   73.103920][    C1]  ip6_input+0xcd/0x2c0
[   73.104473][    C1]  ? ip6_input_finish+0xf0/0xf0
[   73.105115][    C1]  ? rcu_read_lock_held+0x90/0xa0
[   73.105783][    C1]  ? rcu_read_lock_sched_held+0xc0/0xc0
[   73.106548][    C1]  ipv6_rcv+0x1f1/0x300
[ ... ]

Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/ip6_gre.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 6e496c3dd8ef..954267a2bd64 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -125,6 +125,7 @@ static struct ip6_tnl *ip6gre_tunnel_lookup(struct net_device *dev,
 	int dev_type = (gre_proto == htons(ETH_P_TEB)) ?
 		       ARPHRD_ETHER : ARPHRD_IP6GRE;
 	int score, cand_score = 4;
+	struct net_device *ndev;
 
 	for_each_ip_tunnel_rcu(t, ign->tunnels_r_l[h0 ^ h1]) {
 		if (!ipv6_addr_equal(local, &t->parms.laddr) ||
@@ -227,9 +228,9 @@ static struct ip6_tnl *ip6gre_tunnel_lookup(struct net_device *dev,
 	if (cand)
 		return cand;
 
-	dev = ign->fb_tunnel_dev;
-	if (dev->flags & IFF_UP)
-		return netdev_priv(dev);
+	ndev = READ_ONCE(ign->fb_tunnel_dev);
+	if (ndev && ndev->flags & IFF_UP)
+		return netdev_priv(ndev);
 
 	return NULL;
 }
@@ -364,6 +365,8 @@ static void ip6gre_tunnel_uninit(struct net_device *dev)
 	struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
 
 	ip6gre_tunnel_unlink(ign, t);
+	if (ign->fb_tunnel_dev == dev)
+		WRITE_ONCE(ign->fb_tunnel_dev, NULL);
 	dst_cache_reset(&t->dst_cache);
 	dev_put(dev);
 }

From 682ab889ae65d4ea0bf428111a8568effcdc7d6d Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Mon, 15 Jun 2020 20:37:07 -0700
Subject: [PATCH 0086/2658] tcp: grow window for OOO packets only for SACK
 flows

[ Upstream commit 662051215c758ae8545451628816204ed6cd372d ]

Back in 2013, we made a change that broke fast retransmit
for non SACK flows.

Indeed, for these flows, a sender needs to receive three duplicate
ACK before starting fast retransmit. Sending ACK with different
receive window do not count.

Even if enabling SACK is strongly recommended these days,
there still are some cases where it has to be disabled.

Not increasing the window seems better than having to
rely on RTO.

After the fix, following packetdrill test gives :

// Initialize connection
    0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
   +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
   +0 bind(3, ..., ...) = 0
   +0 listen(3, 1) = 0

   +0 < S 0:0(0) win 32792 <mss 1000,nop,wscale 7>
   +0 > S. 0:0(0) ack 1 <mss 1460,nop,wscale 8>
   +0 < . 1:1(0) ack 1 win 514

   +0 accept(3, ..., ...) = 4

   +0 < . 1:1001(1000) ack 1 win 514
// Quick ack
   +0 > . 1:1(0) ack 1001 win 264

   +0 < . 2001:3001(1000) ack 1 win 514
// DUPACK : Normally we should not change the window
   +0 > . 1:1(0) ack 1001 win 264

   +0 < . 3001:4001(1000) ack 1 win 514
// DUPACK : Normally we should not change the window
   +0 > . 1:1(0) ack 1001 win 264

   +0 < . 4001:5001(1000) ack 1 win 514
// DUPACK : Normally we should not change the window
    +0 > . 1:1(0) ack 1001 win 264

   +0 < . 1001:2001(1000) ack 1 win 514
// Hole is repaired.
   +0 > . 1:1(0) ack 5001 win 272

Fixes: 4e4f1fc22681 ("tcp: properly increase rcv_ssthresh for ofo packets")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_input.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 4436d60b38b4..e9d4e2161130 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4466,7 +4466,11 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
 	if (tcp_ooo_try_coalesce(sk, tp->ooo_last_skb,
 				 skb, &fragstolen)) {
 coalesce_done:
-		tcp_grow_window(sk, skb);
+		/* For non sack flows, do not grow window to force DUPACK
+		 * and trigger fast retransmit.
+		 */
+		if (tcp_is_sack(tp))
+			tcp_grow_window(sk, skb);
 		kfree_skb_partial(skb, fragstolen);
 		skb = NULL;
 		goto add_sack;
@@ -4546,7 +4550,11 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
 		tcp_sack_new_ofo_skb(sk, seq, end_seq);
 end:
 	if (skb) {
-		tcp_grow_window(sk, skb);
+		/* For non sack flows, do not grow window to force DUPACK
+		 * and trigger fast retransmit.
+		 */
+		if (tcp_is_sack(tp))
+			tcp_grow_window(sk, skb);
 		skb_set_owner_r(skb, sk);
 	}
 }

From c578f8144c822aeababa70589fa06bb46f14534d Mon Sep 17 00:00:00 2001
From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Date: Wed, 24 Jun 2020 17:34:18 -0300
Subject: [PATCH 0087/2658] sctp: Don't advertise IPv4 addresses if ipv6only is
 set on the socket

[ Upstream commit 471e39df96b9a4c4ba88a2da9e25a126624d7a9c ]

If a socket is set ipv6only, it will still send IPv4 addresses in the
INIT and INIT_ACK packets. This potentially misleads the peer into using
them, which then would cause association termination.

The fix is to not add IPv4 addresses to ipv6only sockets.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Tested-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/sctp/constants.h | 8 +++++---
 net/sctp/associola.c         | 5 ++++-
 net/sctp/bind_addr.c         | 1 +
 net/sctp/protocol.c          | 1 +
 4 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
index 8c337cd0e1e4..bf03bab93d9e 100644
--- a/include/net/sctp/constants.h
+++ b/include/net/sctp/constants.h
@@ -357,11 +357,13 @@ typedef enum {
 	 ipv4_is_anycast_6to4(a))
 
 /* Flags used for the bind address copy functions.  */
-#define SCTP_ADDR6_ALLOWED	0x00000001	/* IPv6 address is allowed by
+#define SCTP_ADDR4_ALLOWED	0x00000001	/* IPv4 address is allowed by
 						   local sock family */
-#define SCTP_ADDR4_PEERSUPP	0x00000002	/* IPv4 address is supported by
+#define SCTP_ADDR6_ALLOWED	0x00000002	/* IPv6 address is allowed by
+						   local sock family */
+#define SCTP_ADDR4_PEERSUPP	0x00000004	/* IPv4 address is supported by
 						   peer */
-#define SCTP_ADDR6_PEERSUPP	0x00000004	/* IPv6 address is supported by
+#define SCTP_ADDR6_PEERSUPP	0x00000008	/* IPv6 address is supported by
 						   peer */
 
 /* Reasons to retransmit. */
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index f24d31f12cb4..aa38578fdfcd 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1575,12 +1575,15 @@ void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned int len)
 int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *asoc,
 				     sctp_scope_t scope, gfp_t gfp)
 {
+	struct sock *sk = asoc->base.sk;
 	int flags;
 
 	/* Use scoping rules to determine the subset of addresses from
 	 * the endpoint.
 	 */
-	flags = (PF_INET6 == asoc->base.sk->sk_family) ? SCTP_ADDR6_ALLOWED : 0;
+	flags = (PF_INET6 == sk->sk_family) ? SCTP_ADDR6_ALLOWED : 0;
+	if (!inet_v6_ipv6only(sk))
+		flags |= SCTP_ADDR4_ALLOWED;
 	if (asoc->peer.ipv4_address)
 		flags |= SCTP_ADDR4_PEERSUPP;
 	if (asoc->peer.ipv6_address)
diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
index 871cdf9567e6..664215448d09 100644
--- a/net/sctp/bind_addr.c
+++ b/net/sctp/bind_addr.c
@@ -449,6 +449,7 @@ static int sctp_copy_one_addr(struct net *net, struct sctp_bind_addr *dest,
 		 * well as the remote peer.
 		 */
 		if ((((AF_INET == addr->sa.sa_family) &&
+		      (flags & SCTP_ADDR4_ALLOWED) &&
 		      (flags & SCTP_ADDR4_PEERSUPP))) ||
 		    (((AF_INET6 == addr->sa.sa_family) &&
 		      (flags & SCTP_ADDR6_ALLOWED) &&
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 9c6c42fd9f8a..b0e401dfe160 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -210,6 +210,7 @@ int sctp_copy_local_addr_list(struct net *net, struct sctp_bind_addr *bp,
 			 * sock as well as the remote peer.
 			 */
 			if ((((AF_INET == addr->a.sa.sa_family) &&
+			      (copy_flags & SCTP_ADDR4_ALLOWED) &&
 			      (copy_flags & SCTP_ADDR4_PEERSUPP))) ||
 			    (((AF_INET6 == addr->a.sa.sa_family) &&
 			      (copy_flags & SCTP_ADDR6_ALLOWED) &&

From 9966aad4cd038566d68a3d8d7d925c6d8aa526b9 Mon Sep 17 00:00:00 2001
From: guodeqing <geffrey.guo@huawei.com>
Date: Wed, 17 Jun 2020 10:07:16 +0800
Subject: [PATCH 0088/2658] net: Fix the arp error in some cases

[ Upstream commit 5eea3a63ff4aba6a26002e657a6d21934b7e2b96 ]

ie.,
$ ifconfig eth0 6.6.6.6 netmask 255.255.255.0

$ ip rule add from 6.6.6.6 table 6666

$ ip route add 9.9.9.9 via 6.6.6.6

$ ping -I 6.6.6.6 9.9.9.9
PING 9.9.9.9 (9.9.9.9) from 6.6.6.6 : 56(84) bytes of data.

3 packets transmitted, 0 received, 100% packet loss, time 2079ms

$ arp
Address     HWtype  HWaddress           Flags Mask            Iface
6.6.6.6             (incomplete)                              eth0

The arp request address is error, this is because fib_table_lookup in
fib_check_nh lookup the destnation 9.9.9.9 nexthop, the scope of
the fib result is RT_SCOPE_LINK,the correct scope is RT_SCOPE_HOST.
Here I add a check of whether this is RT_TABLE_MAIN to solve this problem.

Fixes: 3bfd847203c6 ("net: Use passed in table for nexthop lookups")
Signed-off-by: guodeqing <geffrey.guo@huawei.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/fib_semantics.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 498d5a929d6f..3c1e42d49520 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -776,7 +776,7 @@ static int fib_check_nh(struct fib_config *cfg, struct fib_info *fi,
 			if (fl4.flowi4_scope < RT_SCOPE_LINK)
 				fl4.flowi4_scope = RT_SCOPE_LINK;
 
-			if (cfg->fc_table)
+			if (cfg->fc_table && cfg->fc_table != RT_TABLE_MAIN)
 				tbl = fib_get_table(net, cfg->fc_table);
 
 			if (tbl)

From 40c123022b863d42401563d9d7c74cd32203298e Mon Sep 17 00:00:00 2001
From: Tariq Toukan <tariqt@mellanox.com>
Date: Mon, 22 Jun 2020 23:26:04 +0300
Subject: [PATCH 0089/2658] net: Do not clear the sock TX queue in
 sk_set_socket()

[ Upstream commit 41b14fb8724d5a4b382a63cb4a1a61880347ccb8 ]

Clearing the sock TX queue in sk_set_socket() might cause unexpected
out-of-order transmit when called from sock_orphan(), as outstanding
packets can pick a different TX queue and bypass the ones already queued.

This is undesired in general. More specifically, it breaks the in-order
scheduling property guarantee for device-offloaded TLS sockets.

Remove the call to sk_tx_queue_clear() in sk_set_socket(), and add it
explicitly only where needed.

Fixes: e022f0b4a03f ("net: Introduce sk_tx_queue_mapping")
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Reviewed-by: Boris Pismenny <borisp@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/sock.h | 1 -
 net/core/sock.c    | 2 ++
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/net/sock.h b/include/net/sock.h
index e6c3505c7f02..0ccce8c98cfa 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1682,7 +1682,6 @@ static inline int sk_tx_queue_get(const struct sock *sk)
 
 static inline void sk_set_socket(struct sock *sk, struct socket *sock)
 {
-	sk_tx_queue_clear(sk);
 	sk->sk_socket = sock;
 }
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 0ec9b43c4d34..66a192395398 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1435,6 +1435,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
 
 		sock_update_classid(sk);
 		sock_update_netprioidx(sk);
+		sk_tx_queue_clear(sk);
 	}
 
 	return sk;
@@ -1613,6 +1614,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
 		 */
 		sk_refcnt_debug_inc(newsk);
 		sk_set_socket(newsk, NULL);
+		sk_tx_queue_clear(newsk);
 		newsk->sk_wq = NULL;
 
 		sk_update_clone(sk, newsk);

From c4f845fbc8070fe4f3cb5766927d2df392a5ef05 Mon Sep 17 00:00:00 2001
From: Taehee Yoo <ap420073@gmail.com>
Date: Tue, 16 Jun 2020 15:52:05 +0000
Subject: [PATCH 0090/2658] net: core: reduce recursion limit value

[ Upstream commit fb7861d14c8d7edac65b2fcb6e8031cb138457b2 ]

In the current code, ->ndo_start_xmit() can be executed recursively only
10 times because of stack memory.
But, in the case of the vxlan, 10 recursion limit value results in
a stack overflow.
In the current code, the nested interface is limited by 8 depth.
There is no critical reason that the recursion limitation value should
be 10.
So, it would be good to be the same value with the limitation value of
nesting interface depth.

Test commands:
    ip link add vxlan10 type vxlan vni 10 dstport 4789 srcport 4789 4789
    ip link set vxlan10 up
    ip a a 192.168.10.1/24 dev vxlan10
    ip n a 192.168.10.2 dev vxlan10 lladdr fc:22:33:44:55:66 nud permanent

    for i in {9..0}
    do
        let A=$i+1
	ip link add vxlan$i type vxlan vni $i dstport 4789 srcport 4789 4789
	ip link set vxlan$i up
	ip a a 192.168.$i.1/24 dev vxlan$i
	ip n a 192.168.$i.2 dev vxlan$i lladdr fc:22:33:44:55:66 nud permanent
	bridge fdb add fc:22:33:44:55:66 dev vxlan$A dst 192.168.$i.2 self
    done
    hping3 192.168.10.2 -2 -d 60000

Splat looks like:
[  103.814237][ T1127] =============================================================================
[  103.871955][ T1127] BUG kmalloc-2k (Tainted: G    B            ): Padding overwritten. 0x00000000897a2e4f-0x000
[  103.873187][ T1127] -----------------------------------------------------------------------------
[  103.873187][ T1127]
[  103.874252][ T1127] INFO: Slab 0x000000005cccc724 objects=5 used=5 fp=0x0000000000000000 flags=0x10000000001020
[  103.881323][ T1127] CPU: 3 PID: 1127 Comm: hping3 Tainted: G    B             5.7.0+ #575
[  103.882131][ T1127] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[  103.883006][ T1127] Call Trace:
[  103.883324][ T1127]  dump_stack+0x96/0xdb
[  103.883716][ T1127]  slab_err+0xad/0xd0
[  103.884106][ T1127]  ? _raw_spin_unlock+0x1f/0x30
[  103.884620][ T1127]  ? get_partial_node.isra.78+0x140/0x360
[  103.885214][ T1127]  slab_pad_check.part.53+0xf7/0x160
[  103.885769][ T1127]  ? pskb_expand_head+0x110/0xe10
[  103.886316][ T1127]  check_slab+0x97/0xb0
[  103.886763][ T1127]  alloc_debug_processing+0x84/0x1a0
[  103.887308][ T1127]  ___slab_alloc+0x5a5/0x630
[  103.887765][ T1127]  ? pskb_expand_head+0x110/0xe10
[  103.888265][ T1127]  ? lock_downgrade+0x730/0x730
[  103.888762][ T1127]  ? pskb_expand_head+0x110/0xe10
[  103.889244][ T1127]  ? __slab_alloc+0x3e/0x80
[  103.889675][ T1127]  __slab_alloc+0x3e/0x80
[  103.890108][ T1127]  __kmalloc_node_track_caller+0xc7/0x420
[ ... ]

Fixes: 11a766ce915f ("net: Increase xmit RECURSION_LIMIT to 10.")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index 7fbf4f77917c..067bca407602 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3023,7 +3023,7 @@ static void skb_update_prio(struct sk_buff *skb)
 DEFINE_PER_CPU(int, xmit_recursion);
 EXPORT_SYMBOL(xmit_recursion);
 
-#define RECURSION_LIMIT 10
+#define RECURSION_LIMIT 8
 
 /**
  *	dev_loopback_xmit - loop back @skb

From dc38fa3683945a72766a55f4ef55950eca50cd48 Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38@huawei.com>
Date: Thu, 11 Jun 2020 15:57:50 +0800
Subject: [PATCH 0091/2658] mld: fix memory leak in ipv6_mc_destroy_dev()

[ Upstream commit ea2fce88d2fd678ed9d45354ff49b73f1d5615dd ]

Commit a84d01647989 ("mld: fix memory leak in mld_del_delrec()") fixed
the memory leak of MLD, but missing the ipv6_mc_destroy_dev() path, in
which mca_sources are leaked after ma_put().

Using ip6_mc_clear_src() to take care of the missing free.

BUG: memory leak
unreferenced object 0xffff8881113d3180 (size 64):
  comm "syz-executor071", pid 389, jiffies 4294887985 (age 17.943s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 ff 02 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<000000002cbc483c>] kmalloc include/linux/slab.h:555 [inline]
    [<000000002cbc483c>] kzalloc include/linux/slab.h:669 [inline]
    [<000000002cbc483c>] ip6_mc_add1_src net/ipv6/mcast.c:2237 [inline]
    [<000000002cbc483c>] ip6_mc_add_src+0x7f5/0xbb0 net/ipv6/mcast.c:2357
    [<0000000058b8b1ff>] ip6_mc_source+0xe0c/0x1530 net/ipv6/mcast.c:449
    [<000000000bfc4fb5>] do_ipv6_setsockopt.isra.12+0x1b2c/0x3b30 net/ipv6/ipv6_sockglue.c:754
    [<00000000e4e7a722>] ipv6_setsockopt+0xda/0x150 net/ipv6/ipv6_sockglue.c:950
    [<0000000029260d9a>] rawv6_setsockopt+0x45/0x100 net/ipv6/raw.c:1081
    [<000000005c1b46f9>] __sys_setsockopt+0x131/0x210 net/socket.c:2132
    [<000000008491f7db>] __do_sys_setsockopt net/socket.c:2148 [inline]
    [<000000008491f7db>] __se_sys_setsockopt net/socket.c:2145 [inline]
    [<000000008491f7db>] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2145
    [<00000000c7bc11c5>] do_syscall_64+0xa1/0x530 arch/x86/entry/common.c:295
    [<000000005fb7a3f3>] entry_SYSCALL_64_after_hwframe+0x49/0xb3

Fixes: 1666d49e1d41 ("mld: do not remove mld souce list info when set link down")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Acked-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/mcast.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 976c8133a281..2d28f0b54494 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2580,6 +2580,7 @@ void ipv6_mc_destroy_dev(struct inet6_dev *idev)
 		write_unlock_bh(&idev->lock);
 
 		igmp6_group_dropped(i);
+		ip6_mc_clear_src(i);
 		ma_put(i);
 
 		write_lock_bh(&idev->lock);

From 9ebe075c1da47cab629eceeb616421ce87ed224c Mon Sep 17 00:00:00 2001
From: Chuhong Yuan <hslester96@gmail.com>
Date: Wed, 10 Jun 2020 10:48:44 +0800
Subject: [PATCH 0092/2658] USB: ohci-sm501: Add missed iounmap() in remove

commit 07c112fb09c86c0231f6ff0061a000ffe91c8eb9 upstream.

This driver misses calling iounmap() in remove to undo the ioremap()
called in probe.
Add the missed call to fix it.

Fixes: f54aab6ebcec ("usb: ohci-sm501 driver")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20200610024844.3628408-1-hslester96@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/ohci-sm501.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/host/ohci-sm501.c b/drivers/usb/host/ohci-sm501.c
index a8b8d8b8d9f3..a960d2bb8dd1 100644
--- a/drivers/usb/host/ohci-sm501.c
+++ b/drivers/usb/host/ohci-sm501.c
@@ -196,6 +196,7 @@ static int ohci_hcd_sm501_drv_remove(struct platform_device *pdev)
 	struct resource	*mem;
 
 	usb_remove_hcd(hcd);
+	iounmap(hcd->regs);
 	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
 	usb_put_hcd(hcd);
 	dma_release_declared_memory(&pdev->dev);

From fa0c444eea1a1fb0cc186a16ec0af520461aa64f Mon Sep 17 00:00:00 2001
From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
Date: Tue, 9 Jun 2020 12:28:11 +0400
Subject: [PATCH 0093/2658] usb: dwc2: Postponed gadget registration to the udc
 class driver

commit 207324a321a866401b098cadf19e4a2dd6584622 upstream.

During dwc2 driver probe, after gadget registration to the udc class
driver, if exist any builtin function driver it immediately bound to
dwc2 and after init host side (dwc2_hcd_init()) stucked in host mode.
Patch postpone gadget registration after host side initialization done.

Fixes: 117777b2c3bb9 ("usb: dwc2: Move gadget probe function into platform code")
Reported-by: kbuild test robot <lkp@intel.com>
Tested-by: Marek Vasut <marex@denx.de>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
Link: https://lore.kernel.org/r/f21cb38fecc72a230b86155d94c7e60c9cb66f58.1591690938.git.hminas@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc2/gadget.c   |  6 ------
 drivers/usb/dwc2/platform.c | 11 +++++++++++
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 842c1ae7a291..e5ad717cba22 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -3656,12 +3656,6 @@ int dwc2_gadget_init(struct dwc2_hsotg *hsotg, int irq)
 								epnum, 0);
 	}
 
-	ret = usb_add_gadget_udc(dev, &hsotg->gadget);
-	if (ret) {
-		dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep,
-					   hsotg->ctrl_req);
-		return ret;
-	}
 	dwc2_hsotg_dump(hsotg);
 
 	return 0;
diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
index 39c1cbf0e75d..5e554b1d5a8f 100644
--- a/drivers/usb/dwc2/platform.c
+++ b/drivers/usb/dwc2/platform.c
@@ -452,6 +452,17 @@ static int dwc2_driver_probe(struct platform_device *dev)
 	if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL)
 		dwc2_lowlevel_hw_disable(hsotg);
 
+#if IS_ENABLED(CONFIG_USB_DWC2_PERIPHERAL) || \
+	IS_ENABLED(CONFIG_USB_DWC2_DUAL_ROLE)
+	/* Postponed adding a new gadget to the udc class driver list */
+	if (hsotg->gadget_enabled) {
+		retval = usb_add_gadget_udc(hsotg->dev, &hsotg->gadget);
+		if (retval) {
+			dwc2_hsotg_remove(hsotg);
+			goto error;
+		}
+	}
+#endif /* CONFIG_USB_DWC2_PERIPHERAL || CONFIG_USB_DWC2_DUAL_ROLE */
 	return 0;
 
 error:

From 63469a3284839f45abd5d4c08d07b81537ccf457 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tomasz=20Meresi=C5=84ski?= <tomasz@meresinski.eu>
Date: Wed, 3 Jun 2020 22:33:46 +0200
Subject: [PATCH 0094/2658] usb: add USB_QUIRK_DELAY_INIT for Logitech C922
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 5d8021923e8a8cc37a421a64e27c7221f0fee33c upstream.

The Logitech C922, just like other Logitech webcams,
needs the USB_QUIRK_DELAY_INIT or it will randomly
not respond after device connection

Signed-off-by: Tomasz Meresiński <tomasz@meresinski.eu>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200603203347.7792-1-tomasz@meresinski.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/quirks.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 27d05f0134de..e6e0f786547b 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -73,11 +73,12 @@ static const struct usb_device_id usb_quirk_list[] = {
 	/* Logitech HD Webcam C270 */
 	{ USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME },
 
-	/* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */
+	/* Logitech HD Pro Webcams C920, C920-C, C922, C925e and C930e */
 	{ USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
 	{ USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
 	{ USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
 	{ USB_DEVICE(0x046d, 0x085b), .driver_info = USB_QUIRK_DELAY_INIT },
+	{ USB_DEVICE(0x046d, 0x085c), .driver_info = USB_QUIRK_DELAY_INIT },
 
 	/* Logitech ConferenceCam CC3000e */
 	{ USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT },

From a46f8726e8d5225b844068cdf2867754e43e043a Mon Sep 17 00:00:00 2001
From: Dongdong Liu <liudongdong3@huawei.com>
Date: Fri, 3 Feb 2017 15:02:07 -0600
Subject: [PATCH 0095/2658] PCI: Disable MSI for HiSilicon Hip06/Hip07 Root
 Ports

commit 72f2ff0deb870145a5a2d24cd75b4f9936159a62 upstream.

The PCIe Root Port in Hip06/Hip07 SoCs advertises an MSI capability, but it
cannot generate MSIs.  It can transfer MSI/MSI-X from downstream devices,
but does not support MSI/MSI-X itself.

Add a quirk to prevent use of MSI/MSI-X by the Root Port.

[bhelgaas: changelog, sort vendor ID #define, drop device ID #define]
Signed-off-by: Dongdong Liu <liudongdong3@huawei.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Gabriele Paoloni <gabriele.paoloni@huawei.com>
Reviewed-by: Zhou Wang <wangzhou1@hisilicon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/quirks.c    | 1 +
 include/linux/pci_ids.h | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 83ad32b07cc3..eeb771ecda15 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -1623,6 +1623,7 @@ static void quirk_pcie_mch(struct pci_dev *pdev)
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_E7520_MCH,	quirk_pcie_mch);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_E7320_MCH,	quirk_pcie_mch);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_E7525_MCH,	quirk_pcie_mch);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_HUAWEI,	0x1610,	quirk_pcie_mch);
 
 
 /*
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 1af616138d1d..5547f1a0f83b 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2496,6 +2496,8 @@
 #define PCI_DEVICE_ID_KORENIX_JETCARDF2	0x1700
 #define PCI_DEVICE_ID_KORENIX_JETCARDF3	0x17ff
 
+#define PCI_VENDOR_ID_HUAWEI         	0x19e5
+
 #define PCI_VENDOR_ID_NETRONOME		0x19ee
 #define PCI_DEVICE_ID_NETRONOME_NFP3200	0x3200
 #define PCI_DEVICE_ID_NETRONOME_NFP3240	0x3240

From 436c3cf7e1df1e8d49e53250f80996de20c0c92e Mon Sep 17 00:00:00 2001
From: Longfang Liu <liulongfang@huawei.com>
Date: Mon, 8 Jun 2020 11:46:59 +0800
Subject: [PATCH 0096/2658] USB: ehci: reopen solution for Synopsys HC bug
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 1ddcb71a3edf0e1682b6e056158e4c4b00325f66 upstream.

A Synopsys USB2.0 core used in Huawei Kunpeng920 SoC has a bug which
might cause the host controller not issuing ping.

Bug description:
After indicating an Interrupt on Async Advance, the software uses the
doorbell mechanism to delete the Next Link queue head of the last
executed queue head. At this time, the host controller still references
the removed queue head(the queue head is NULL). NULL reference causes
the host controller to lose the USB device.

Solution:
After deleting the Next Link queue head, when has_synopsys_hc_bug set
to 1，the software can write one of the valid queue head addresses to
the ASYNCLISTADDR register to allow the host controller to get
the valid queue head. in order to solve that problem, this patch set
the flag for Huawei Kunpeng920

There are detailed instructions and solutions in this patch:
commit 2f7ac6c19997 ("USB: ehci: add workaround for Synopsys HC bug")

Signed-off-by: Longfang Liu <liulongfang@huawei.com>
Cc: stable <stable@vger.kernel.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/1591588019-44284-1-git-send-email-liulongfang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/ehci-pci.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index 2a5d2fd76040..33e9ed7fe026 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -229,6 +229,13 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
 		ehci_info(ehci, "applying MosChip frame-index workaround\n");
 		ehci->frame_index_bug = 1;
 		break;
+	case PCI_VENDOR_ID_HUAWEI:
+		/* Synopsys HC bug */
+		if (pdev->device == 0xa239) {
+			ehci_info(ehci, "applying Synopsys HC workaround\n");
+			ehci->has_synopsys_hc_bug = 1;
+		}
+		break;
 	}
 
 	/* optional debug port, normally in the first BAR */

From 3bdd37751bb91fd0b5c1f6a40a647a36856cf003 Mon Sep 17 00:00:00 2001
From: Tang Bin <tangbin@cmss.chinamobile.com>
Date: Tue, 2 Jun 2020 19:47:08 +0800
Subject: [PATCH 0097/2658] usb: host: ehci-exynos: Fix error check in
 exynos_ehci_probe()

commit 44ed240d62736ad29943ec01e41e194b96f7c5e9 upstream.

If the function platform_get_irq() failed, the negative value
returned will not be detected here. So fix error handling in
exynos_ehci_probe(). And when get irq failed, the function
platform_get_irq() logs an error message, so remove redundant
message here.

Fixes: 1bcc5aa87f04 ("USB: Add initial S5P EHCI driver")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Zhang Shengju <zhangshengju@cmss.chinamobile.com>
Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
Link: https://lore.kernel.org/r/20200602114708.28620-1-tangbin@cmss.chinamobile.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/ehci-exynos.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/host/ehci-exynos.c b/drivers/usb/host/ehci-exynos.c
index 46f5354c534d..3b5a28f43ef9 100644
--- a/drivers/usb/host/ehci-exynos.c
+++ b/drivers/usb/host/ehci-exynos.c
@@ -199,9 +199,8 @@ static int exynos_ehci_probe(struct platform_device *pdev)
 	hcd->rsrc_len = resource_size(res);
 
 	irq = platform_get_irq(pdev, 0);
-	if (!irq) {
-		dev_err(&pdev->dev, "Failed to get IRQ\n");
-		err = -ENODEV;
+	if (irq < 0) {
+		err = irq;
 		goto fail_io;
 	}
 

From 957538e92fe73140f4b1c74d7f1de777c75998c9 Mon Sep 17 00:00:00 2001
From: "Yick W. Tse" <y_w_tse@yahoo.com.hk>
Date: Sat, 13 Jun 2020 11:40:06 +0000
Subject: [PATCH 0098/2658] ALSA: usb-audio: add quirk for Denon DCD-1500RE

commit c9808bbfed3cfc911ecb60fe8e80c0c27876c657 upstream.

fix error "clock source 41 is not valid, cannot use"

[] New USB device found, idVendor=154e, idProduct=1002, bcdDevice= 1.00
[] New USB device strings: Mfr=1, Product=2, SerialNumber=0
[] Product: DCD-1500RE
[] Manufacturer: D & M Holdings Inc.
[]
[] clock source 41 is not valid, cannot use
[] usbcore: registered new interface driver snd-usb-audio

Signed-off-by: Yick W. Tse <y_w_tse@yahoo.com.hk>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1373857985.210365.1592048406997@mail.yahoo.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/quirks.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index b7a7bf0e566c..47979c9c3e29 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1162,6 +1162,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
 static bool is_marantz_denon_dac(unsigned int id)
 {
 	switch (id) {
+	case USB_ID(0x154e, 0x1002): /* Denon DCD-1500RE */
 	case USB_ID(0x154e, 0x1003): /* Denon DA-300USB */
 	case USB_ID(0x154e, 0x3005): /* Marantz HD-DAC1 */
 	case USB_ID(0x154e, 0x3006): /* Marantz SA-14S1 */

From 42fb448d04f2d7512abd2244b46c51a175cab524 Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Wed, 24 Jun 2020 16:59:45 +0300
Subject: [PATCH 0099/2658] xhci: Fix incorrect EP_STATE_MASK

commit dceea67058fe22075db3aed62d5cb62092be5053 upstream.

EP_STATE_MASK should be 0x7 instead of 0xf

xhci spec 6.2.3 shows that the EP state field in the endpoint context data
structure consist of bits [2:0].
The old value included a bit from the next field which fortunately is a
 RsvdZ region. So hopefully this hasn't caused too much harm

Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200624135949.22611-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 13698b637cd6..a599f80d30f3 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -706,7 +706,7 @@ struct xhci_ep_ctx {
  * 4 - TRB error
  * 5-7 - reserved
  */
-#define EP_STATE_MASK		(0xf)
+#define EP_STATE_MASK		(0x7)
 #define EP_STATE_DISABLED	0
 #define EP_STATE_RUNNING	1
 #define EP_STATE_HALTED		2

From 5860b3a4289e9a1f34c7a272af7c48e5f7dd1a5a Mon Sep 17 00:00:00 2001
From: Al Cooper <alcooperx@gmail.com>
Date: Wed, 24 Jun 2020 16:59:46 +0300
Subject: [PATCH 0100/2658] xhci: Fix enumeration issue when setting max packet
 size for FS devices.

commit a73d9d9cfc3cfceabd91fb0b0c13e4062b6dbcd7 upstream.

Unable to complete the enumeration of a USB TV Tuner device.

Per XHCI spec (4.6.5), the EP state field of the input context shall
be cleared for a set address command. In the special case of an FS
device that has "MaxPacketSize0 = 8", the Linux XHCI driver does
not do this before evaluating the context. With an XHCI controller
that checks the EP state field for parameter context error this
causes a problem in cases such as the device getting reset again
after enumeration.

When that field is cleared, the problem does not occur.

This was found and fixed by Sasi Kumar.

Cc: stable@vger.kernel.org
Signed-off-by: Al Cooper <alcooperx@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200624135949.22611-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 0c4436d1cfdb..a8df32be5f68 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1358,6 +1358,7 @@ static int xhci_check_maxpacket(struct xhci_hcd *xhci, unsigned int slot_id,
 				xhci->devs[slot_id]->out_ctx, ep_index);
 
 		ep_ctx = xhci_get_ep_ctx(xhci, command->in_ctx, ep_index);
+		ep_ctx->ep_info &= cpu_to_le32(~EP_STATE_MASK);/* must clear */
 		ep_ctx->ep_info2 &= cpu_to_le32(~MAX_PACKET_MASK);
 		ep_ctx->ep_info2 |= cpu_to_le32(MAX_PACKET(max_packet_size));
 

From ffaf6dc4f0f96dd1536ddbd2054903002e4e296a Mon Sep 17 00:00:00 2001
From: Joakim Tjernlund <joakim.tjernlund@infinera.com>
Date: Fri, 5 Jun 2020 12:54:18 +0200
Subject: [PATCH 0101/2658] cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC
 chip

commit 03894573f2913181ee5aae0089f333b2131f2d4b upstream.

USB_DEVICE(0x0424, 0x274e) can send data before cdc_acm is ready,
causing garbage chars on the TTY causing stray input to the shell
and/or login prompt.

Signed-off-by: Joakim Tjernlund <joakim.tjernlund@infinera.com>
Cc: stable@vger.kernel.org
Acked-by: Oliver Neukum <oneukum@suse.com>
Link: https://lore.kernel.org/r/20200605105418.22263-1-joakim.tjernlund@infinera.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/cdc-acm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 04fd6c8e3090..515839034dfb 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1684,6 +1684,8 @@ static int acm_reset_resume(struct usb_interface *intf)
 
 static const struct usb_device_id acm_ids[] = {
 	/* quirky and broken devices */
+	{ USB_DEVICE(0x0424, 0x274e), /* Microchip Technology, Inc. (formerly SMSC) */
+	  .driver_info = DISABLE_ECHO, }, /* DISABLE ECHO in termios flag */
 	{ USB_DEVICE(0x076d, 0x0006), /* Denso Cradle CU-321 */
 	.driver_info = NO_UNION_NORMAL, },/* has no union descriptor */
 	{ USB_DEVICE(0x17ef, 0x7000), /* Lenovo USB modem */

From b508f9c63d9e403d6b4f3fe4a2c9016ba7baef8a Mon Sep 17 00:00:00 2001
From: Julian Scheel <julian@jusst.de>
Date: Thu, 16 Nov 2017 17:35:17 +0100
Subject: [PATCH 0102/2658] ALSA: usb-audio: uac1: Invalidate ctl on interrupt

[ Upstream commit b2500b584cfd228d67e1e43daf27c8af865b499e ]

When an interrupt occurs, the value of at least one of the belonging
controls should have changed. To make sure they get re-read from device
on the next read, invalidate the cache. This was correctly implemented
for uac2 already, but missing for uac1.

Signed-off-by: Julian Scheel <julian@jusst.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/mixer.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 915e9c24f0ea..e9d35a1074f9 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2678,9 +2678,14 @@ void snd_usb_mixer_notify_id(struct usb_mixer_interface *mixer, int unitid)
 {
 	struct usb_mixer_elem_list *list;
 
-	for (list = mixer->id_elems[unitid]; list; list = list->next_id_elem)
+	for (list = mixer->id_elems[unitid]; list; list = list->next_id_elem) {
+		struct usb_mixer_elem_info *info =
+			(struct usb_mixer_elem_info *)list;
+		/* invalidate cache, so the value is read from the device */
+		info->cached = 0;
 		snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
 			       &list->kctl->id);
+	}
 }
 
 static void snd_usb_mixer_dump_cval(struct snd_info_buffer *buffer,

From 53b994cd6f109e738033052c71e406b4e1129ef0 Mon Sep 17 00:00:00 2001
From: Daniel Mack <daniel@zonque.org>
Date: Fri, 8 Apr 2016 19:52:02 +0200
Subject: [PATCH 0103/2658] ALSA: usb-audio: allow clock source validity
 interrupts

[ Upstream commit 191227d99a281333b50aaf82ab4152fbfa249c19 ]

miniDSP USBStreamer UAC2 devices send clock validity changes with the
control field set to zero. The current interrupt handler ignores all
packets if the control field does not match the mixer element's, but
it really should only do that in case that field is needed to
distinguish multiple elements with the same ID.

This patch implements a logic that lets notifications packets pass
if the element ID is unique for a given device.

Signed-off-by: Daniel Mack <daniel@zonque.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/mixer.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index e9d35a1074f9..6d0014685eff 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2739,6 +2739,7 @@ static void snd_usb_mixer_interrupt_v2(struct usb_mixer_interface *mixer,
 	__u8 unitid = (index >> 8) & 0xff;
 	__u8 control = (value >> 8) & 0xff;
 	__u8 channel = value & 0xff;
+	unsigned int count = 0;
 
 	if (channel >= MAX_CHANNELS) {
 		usb_audio_dbg(mixer->chip,
@@ -2747,6 +2748,12 @@ static void snd_usb_mixer_interrupt_v2(struct usb_mixer_interface *mixer,
 		return;
 	}
 
+	for (list = mixer->id_elems[unitid]; list; list = list->next_id_elem)
+		count++;
+
+	if (count == 0)
+		return;
+
 	for (list = mixer->id_elems[unitid]; list; list = list->next_id_elem) {
 		struct usb_mixer_elem_info *info;
 
@@ -2754,7 +2761,7 @@ static void snd_usb_mixer_interrupt_v2(struct usb_mixer_interface *mixer,
 			continue;
 
 		info = (struct usb_mixer_elem_info *)list;
-		if (info->control != control)
+		if (count > 1 && info->control != control)
 			continue;
 
 		switch (attribute) {

From b7ff585b6d6d91bac7c61cb40b954355fe13e445 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Thu, 3 May 2018 12:33:32 +0200
Subject: [PATCH 0104/2658] ALSA: usb-audio: Clean up mixer element list
 traverse

[ Upstream commit 8c558076c740e8009a96c6fdc3d4245dde62be77 ]

Introduce a new macro for iterating over mixer element list for
avoiding the open codes in many places.  Also the open-coded
container_of() and the forced cast to struct usb_mixer_elem_info are
replaced with another simple macro, too.

No functional changes but just readability improvement.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/mixer.c          | 20 +++++++++-----------
 sound/usb/mixer.h          |  6 ++++++
 sound/usb/mixer_quirks.c   |  2 +-
 sound/usb/mixer_scarlett.c |  6 ++----
 4 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 6d0014685eff..30387da6b5c6 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2678,9 +2678,9 @@ void snd_usb_mixer_notify_id(struct usb_mixer_interface *mixer, int unitid)
 {
 	struct usb_mixer_elem_list *list;
 
-	for (list = mixer->id_elems[unitid]; list; list = list->next_id_elem) {
+	for_each_mixer_elem(list, mixer, unitid) {
 		struct usb_mixer_elem_info *info =
-			(struct usb_mixer_elem_info *)list;
+			mixer_elem_list_to_info(list);
 		/* invalidate cache, so the value is read from the device */
 		info->cached = 0;
 		snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
@@ -2691,7 +2691,7 @@ void snd_usb_mixer_notify_id(struct usb_mixer_interface *mixer, int unitid)
 static void snd_usb_mixer_dump_cval(struct snd_info_buffer *buffer,
 				    struct usb_mixer_elem_list *list)
 {
-	struct usb_mixer_elem_info *cval = (struct usb_mixer_elem_info *)list;
+	struct usb_mixer_elem_info *cval = mixer_elem_list_to_info(list);
 	static char *val_types[] = {"BOOLEAN", "INV_BOOLEAN",
 				    "S8", "U8", "S16", "U16"};
 	snd_iprintf(buffer, "    Info: id=%i, control=%i, cmask=0x%x, "
@@ -2717,8 +2717,7 @@ static void snd_usb_mixer_proc_read(struct snd_info_entry *entry,
 				mixer->ignore_ctl_error);
 		snd_iprintf(buffer, "Card: %s\n", chip->card->longname);
 		for (unitid = 0; unitid < MAX_ID_ELEMS; unitid++) {
-			for (list = mixer->id_elems[unitid]; list;
-			     list = list->next_id_elem) {
+			for_each_mixer_elem(list, mixer, unitid) {
 				snd_iprintf(buffer, "  Unit: %i\n", list->id);
 				if (list->kctl)
 					snd_iprintf(buffer,
@@ -2748,19 +2747,19 @@ static void snd_usb_mixer_interrupt_v2(struct usb_mixer_interface *mixer,
 		return;
 	}
 
-	for (list = mixer->id_elems[unitid]; list; list = list->next_id_elem)
+	for_each_mixer_elem(list, mixer, unitid)
 		count++;
 
 	if (count == 0)
 		return;
 
-	for (list = mixer->id_elems[unitid]; list; list = list->next_id_elem) {
+	for_each_mixer_elem(list, mixer, unitid) {
 		struct usb_mixer_elem_info *info;
 
 		if (!list->kctl)
 			continue;
 
-		info = (struct usb_mixer_elem_info *)list;
+		info = mixer_elem_list_to_info(list);
 		if (count > 1 && info->control != control)
 			continue;
 
@@ -2983,7 +2982,7 @@ int snd_usb_mixer_suspend(struct usb_mixer_interface *mixer)
 
 static int restore_mixer_value(struct usb_mixer_elem_list *list)
 {
-	struct usb_mixer_elem_info *cval = (struct usb_mixer_elem_info *)list;
+	struct usb_mixer_elem_info *cval = mixer_elem_list_to_info(list);
 	int c, err, idx;
 
 	if (cval->cmask) {
@@ -3019,8 +3018,7 @@ int snd_usb_mixer_resume(struct usb_mixer_interface *mixer, bool reset_resume)
 	if (reset_resume) {
 		/* restore cached mixer values */
 		for (id = 0; id < MAX_ID_ELEMS; id++) {
-			for (list = mixer->id_elems[id]; list;
-			     list = list->next_id_elem) {
+			for_each_mixer_elem(list, mixer, id) {
 				if (list->resume) {
 					err = list->resume(list);
 					if (err < 0)
diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h
index 545d99b09706..004d99037210 100644
--- a/sound/usb/mixer.h
+++ b/sound/usb/mixer.h
@@ -52,6 +52,12 @@ struct usb_mixer_elem_list {
 	usb_mixer_elem_resume_func_t resume;
 };
 
+/* iterate over mixer element list of the given unit id */
+#define for_each_mixer_elem(list, mixer, id)	\
+	for ((list) = (mixer)->id_elems[id]; (list); (list) = (list)->next_id_elem)
+#define mixer_elem_list_to_info(list) \
+	container_of(list, struct usb_mixer_elem_info, head)
+
 struct usb_mixer_elem_info {
 	struct usb_mixer_elem_list head;
 	unsigned int control;	/* CS or ICN (high byte) */
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 723b535ca2ec..5d6af9c861ad 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -1170,7 +1170,7 @@ void snd_emuusb_set_samplerate(struct snd_usb_audio *chip,
 	int unitid = 12; /* SamleRate ExtensionUnit ID */
 
 	list_for_each_entry(mixer, &chip->mixer_list, list) {
-		cval = (struct usb_mixer_elem_info *)mixer->id_elems[unitid];
+		cval = mixer_elem_list_to_info(mixer->id_elems[unitid]);
 		if (cval) {
 			snd_usb_mixer_set_ctl_value(cval, UAC_SET_CUR,
 						    cval->control << 8,
diff --git a/sound/usb/mixer_scarlett.c b/sound/usb/mixer_scarlett.c
index 7438e7c4a842..2876cd9b35b3 100644
--- a/sound/usb/mixer_scarlett.c
+++ b/sound/usb/mixer_scarlett.c
@@ -287,8 +287,7 @@ static int scarlett_ctl_switch_put(struct snd_kcontrol *kctl,
 
 static int scarlett_ctl_resume(struct usb_mixer_elem_list *list)
 {
-	struct usb_mixer_elem_info *elem =
-		container_of(list, struct usb_mixer_elem_info, head);
+	struct usb_mixer_elem_info *elem = mixer_elem_list_to_info(list);
 	int i;
 
 	for (i = 0; i < elem->channels; i++)
@@ -447,8 +446,7 @@ static int scarlett_ctl_enum_put(struct snd_kcontrol *kctl,
 
 static int scarlett_ctl_enum_resume(struct usb_mixer_elem_list *list)
 {
-	struct usb_mixer_elem_info *elem =
-		container_of(list, struct usb_mixer_elem_info, head);
+	struct usb_mixer_elem_info *elem = mixer_elem_list_to_info(list);
 
 	if (elem->cached)
 		snd_usb_set_cur_mix_value(elem, 0, 0, *elem->cache_val);

From 442d6b6bd4e8d5c383fbadd2dd70f628fdb82b09 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 24 Jun 2020 14:23:40 +0200
Subject: [PATCH 0105/2658] ALSA: usb-audio: Fix OOB access of mixer element
 list

[ Upstream commit 220345e98f1cdc768eeb6e3364a0fa7ab9647fe7 ]

The USB-audio mixer code holds a linked list of usb_mixer_elem_list,
and several operations are performed for each mixer element.  A few of
them (snd_usb_mixer_notify_id() and snd_usb_mixer_interrupt_v2())
assume each mixer element being a usb_mixer_elem_info object that is a
subclass of usb_mixer_elem_list, cast via container_of() and access it
members.  This may result in an out-of-bound access when a
non-standard list element has been added, as spotted by syzkaller
recently.

This patch adds a new field, is_std_info, in usb_mixer_elem_list to
indicate that the element is the usb_mixer_elem_info type or not, and
skip the access to such an element if needed.

Reported-by: syzbot+fb14314433463ad51625@syzkaller.appspotmail.com
Reported-by: syzbot+2405ca3401e943c538b5@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200624122340.9615-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/mixer.c        | 15 +++++++++++----
 sound/usb/mixer.h        |  9 +++++++--
 sound/usb/mixer_quirks.c |  3 ++-
 3 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 30387da6b5c6..31d0bcfd657f 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -596,8 +596,9 @@ static int check_matrix_bitmap(unsigned char *bmap,
  * if failed, give up and free the control instance.
  */
 
-int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list,
-			      struct snd_kcontrol *kctl)
+int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list,
+			   struct snd_kcontrol *kctl,
+			   bool is_std_info)
 {
 	struct usb_mixer_interface *mixer = list->mixer;
 	int err;
@@ -610,6 +611,7 @@ int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list,
 		return err;
 	}
 	list->kctl = kctl;
+	list->is_std_info = is_std_info;
 	list->next_id_elem = mixer->id_elems[list->id];
 	mixer->id_elems[list->id] = list;
 	return 0;
@@ -2679,8 +2681,11 @@ void snd_usb_mixer_notify_id(struct usb_mixer_interface *mixer, int unitid)
 	struct usb_mixer_elem_list *list;
 
 	for_each_mixer_elem(list, mixer, unitid) {
-		struct usb_mixer_elem_info *info =
-			mixer_elem_list_to_info(list);
+		struct usb_mixer_elem_info *info;
+
+		if (!list->is_std_info)
+			continue;
+		info = mixer_elem_list_to_info(list);
 		/* invalidate cache, so the value is read from the device */
 		info->cached = 0;
 		snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
@@ -2758,6 +2763,8 @@ static void snd_usb_mixer_interrupt_v2(struct usb_mixer_interface *mixer,
 
 		if (!list->kctl)
 			continue;
+		if (!list->is_std_info)
+			continue;
 
 		info = mixer_elem_list_to_info(list);
 		if (count > 1 && info->control != control)
diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h
index 004d99037210..7d16a9221070 100644
--- a/sound/usb/mixer.h
+++ b/sound/usb/mixer.h
@@ -48,6 +48,7 @@ struct usb_mixer_elem_list {
 	struct usb_mixer_elem_list *next_id_elem; /* list of controls with same id */
 	struct snd_kcontrol *kctl;
 	unsigned int id;
+	bool is_std_info;
 	usb_mixer_elem_dump_func_t dump;
 	usb_mixer_elem_resume_func_t resume;
 };
@@ -85,8 +86,12 @@ void snd_usb_mixer_notify_id(struct usb_mixer_interface *mixer, int unitid);
 int snd_usb_mixer_set_ctl_value(struct usb_mixer_elem_info *cval,
 				int request, int validx, int value_set);
 
-int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list,
-			      struct snd_kcontrol *kctl);
+int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list,
+			   struct snd_kcontrol *kctl,
+			   bool is_std_info);
+
+#define snd_usb_mixer_add_control(list, kctl) \
+	snd_usb_mixer_add_list(list, kctl, true)
 
 void snd_usb_mixer_elem_init_std(struct usb_mixer_elem_list *list,
 				 struct usb_mixer_interface *mixer,
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 5d6af9c861ad..198515f86fcc 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -168,7 +168,8 @@ static int add_single_ctl_with_resume(struct usb_mixer_interface *mixer,
 		return -ENOMEM;
 	}
 	kctl->private_free = snd_usb_mixer_elem_free;
-	return snd_usb_mixer_add_control(list, kctl);
+	/* don't use snd_usb_mixer_add_control() here, this is a special list element */
+	return snd_usb_mixer_add_list(list, kctl, false);
 }
 
 /*

From 0e1f5756d75f132cebd129c9c18d9d15c7fef59d Mon Sep 17 00:00:00 2001
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date: Wed, 24 Jun 2020 16:59:49 +0300
Subject: [PATCH 0106/2658] xhci: Poll for U0 after disabling USB2 LPM

[ Upstream commit b3d71abd135e6919ca0b6cab463738472653ddfb ]

USB2 devices with LPM enabled may interrupt the system suspend:
[  932.510475] usb 1-7: usb suspend, wakeup 0
[  932.510549] hub 1-0:1.0: hub_suspend
[  932.510581] usb usb1: bus suspend, wakeup 0
[  932.510590] xhci_hcd 0000:00:14.0: port 9 not suspended
[  932.510593] xhci_hcd 0000:00:14.0: port 8 not suspended
..
[  932.520323] xhci_hcd 0000:00:14.0: Port change event, 1-7, id 7, portsc: 0x400e03
..
[  932.591405] PM: pci_pm_suspend(): hcd_pci_suspend+0x0/0x30 returns -16
[  932.591414] PM: dpm_run_callback(): pci_pm_suspend+0x0/0x160 returns -16
[  932.591418] PM: Device 0000:00:14.0 failed to suspend async: error -16

During system suspend, USB core will let HC suspends the device if it
doesn't have remote wakeup enabled and doesn't have any children.
However, from the log above we can see that the usb 1-7 doesn't get bus
suspended due to not in U0. After a while the port finished U2 -> U0
transition, interrupts the suspend process.

The observation is that after disabling LPM, port doesn't transit to U0
immediately and can linger in U2. xHCI spec 4.23.5.2 states that the
maximum exit latency for USB2 LPM should be BESL + 10us. The BESL for
the affected device is advertised as 400us, which is still not enough
based on my testing result.

So let's use the maximum permitted latency, 10000, to poll for U0
status to solve the issue.

Cc: stable@vger.kernel.org
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200624135949.22611-6-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/xhci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index a8df32be5f68..56d67ef8f38d 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4282,6 +4282,9 @@ int xhci_set_usb2_hardware_lpm(struct usb_hcd *hcd,
 			mutex_lock(hcd->bandwidth_mutex);
 			xhci_change_max_exit_latency(xhci, udev, 0);
 			mutex_unlock(hcd->bandwidth_mutex);
+			readl_poll_timeout(port_array[port_num], pm_val,
+					   (pm_val & PORT_PLS_MASK) == XDEV_U0,
+					   100, 10000);
 			return 0;
 		}
 	}

From 8d084033763de61de7b99c097687e717f3ba0a43 Mon Sep 17 00:00:00 2001
From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Date: Tue, 23 Jun 2020 07:31:53 -0400
Subject: [PATCH 0107/2658] cifs/smb3: Fix data inconsistent when punch hole

[ Upstream commit acc91c2d8de4ef46ed751c5f9df99ed9a109b100 ]

When punch hole success, we also can read old data from file:
  # strace -e trace=pread64,fallocate xfs_io -f -c "pread 20 40" \
           -c "fpunch 20 40" -c"pread 20 40" file
  pread64(3, " version 5.8.0-rc1+"..., 40, 20) = 40
  fallocate(3, FALLOC_FL_KEEP_SIZE|FALLOC_FL_PUNCH_HOLE, 20, 40) = 0
  pread64(3, " version 5.8.0-rc1+"..., 40, 20) = 40

CIFS implements the fallocate(FALLOCATE_FL_PUNCH_HOLE) with send SMB
ioctl(FSCTL_SET_ZERO_DATA) to server. It just set the range of the
remote file to zero, but local page caches not updated, then the
local page caches inconsistent with server.

Also can be found by xfstests generic/316.

So, we need to remove the page caches before send the SMB
ioctl(FSCTL_SET_ZERO_DATA) to server.

Fixes: 31742c5a33176 ("enable fallocate punch hole ("fallocate -p") for SMB3")
Suggested-by: Pavel Shilovsky <pshilov@microsoft.com>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Cc: stable@vger.kernel.org # v3.17
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/smb2ops.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 0fcf42401a5d..870b7e763bab 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -1201,6 +1201,12 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon,
 	if (!smb2_set_sparse(xid, tcon, cfile, inode, set_sparse))
 		return -EOPNOTSUPP;
 
+	/*
+	 * We implement the punch hole through ioctl, so we need remove the page
+	 * caches first, otherwise the data may be inconsistent with the server.
+	 */
+	truncate_pagecache_range(inode, offset, offset + len - 1);
+
 	cifs_dbg(FYI, "offset %lld len %lld", offset, len);
 
 	fsctl_buf.FileOffset = cpu_to_le64(offset);

From 3e646944531168790dce860e674388dbcab61740 Mon Sep 17 00:00:00 2001
From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Date: Tue, 23 Jun 2020 07:31:54 -0400
Subject: [PATCH 0108/2658] cifs/smb3: Fix data inconsistent when zero file
 range

[ Upstream commit 6b69040247e14b43419a520f841f2b3052833df9 ]

CIFS implements the fallocate(FALLOC_FL_ZERO_RANGE) with send SMB
ioctl(FSCTL_SET_ZERO_DATA) to server. It just set the range of the
remote file to zero, but local page cache not update, then the data
inconsistent with server, which leads the xfstest generic/008 failed.

So we need to remove the local page caches before send SMB
ioctl(FSCTL_SET_ZERO_DATA) to server. After next read, it will
re-cache it.

Fixes: 30175628bf7f5 ("[SMB3] Enable fallocate -z support for SMB3 mounts")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
Cc: stable@vger.kernel.org # v3.17
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/smb2ops.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 870b7e763bab..087261ca6d46 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -1145,6 +1145,12 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon,
 	inode = d_inode(cfile->dentry);
 	cifsi = CIFS_I(inode);
 
+	/*
+	 * We zero the range through ioctl, so we need remove the page caches
+	 * first, otherwise the data may be inconsistent with the server.
+	 */
+	truncate_pagecache_range(inode, offset, offset + len - 1);
+
 	/* if file not oplocked can't be sure whether asking to extend size */
 	if (!CIFS_CACHE_READ(cifsi))
 		if (keep_size == false)

From ebe117fe5e462cf806e5500303c5b90cf215b183 Mon Sep 17 00:00:00 2001
From: Qiushi Wu <wu000273@umn.edu>
Date: Thu, 28 May 2020 13:38:04 -0500
Subject: [PATCH 0109/2658] efi/esrt: Fix reference count leak in
 esre_create_sysfs_entry.

[ Upstream commit 4ddf4739be6e375116c375f0a68bf3893ffcee21 ]

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object. Previous
commit "b8eb718348b8" fixed a similar problem.

Fixes: 0bb549052d33 ("efi: Add esrt support")
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Link: https://lore.kernel.org/r/20200528183804.4497-1-wu000273@umn.edu
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/efi/esrt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c
index 341b8c686ec7..4aaaccf95b36 100644
--- a/drivers/firmware/efi/esrt.c
+++ b/drivers/firmware/efi/esrt.c
@@ -182,7 +182,7 @@ static int esre_create_sysfs_entry(void *esre, int entry_num)
 		rc = kobject_init_and_add(&entry->kobj, &esre1_ktype, NULL,
 					  "%s", name);
 		if (rc) {
-			kfree(entry);
+			kobject_put(&entry->kobj);
 			return rc;
 		}
 	}

From f064fbe2c9387aaeb076ac2a4b0eea3706b7b227 Mon Sep 17 00:00:00 2001
From: Fan Guo <guofan5@huawei.com>
Date: Fri, 12 Jun 2020 14:38:24 +0800
Subject: [PATCH 0110/2658] RDMA/mad: Fix possible memory leak in
 ib_mad_post_receive_mads()

[ Upstream commit a17f4bed811c60712d8131883cdba11a105d0161 ]

If ib_dma_mapping_error() returns non-zero value,
ib_mad_post_receive_mads() will jump out of loops and return -ENOMEM
without freeing mad_priv. Fix this memory-leak problem by freeing mad_priv
in this case.

Fixes: 2c34e68f4261 ("IB/mad: Check and handle potential DMA mapping errors")
Link: https://lore.kernel.org/r/20200612063824.180611-1-guofan5@huawei.com
Signed-off-by: Fan Guo <guofan5@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/mad.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 616173b7a5e8..c26fdcb7dddf 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -2912,6 +2912,7 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
 						 DMA_FROM_DEVICE);
 		if (unlikely(ib_dma_mapping_error(qp_info->port_priv->device,
 						  sg_list.addr))) {
+			kfree(mad_priv);
 			ret = -ENOMEM;
 			break;
 		}

From 73f25f5f2929375e3fe3752dc0374868e6039cf5 Mon Sep 17 00:00:00 2001
From: yu kuai <yukuai3@huawei.com>
Date: Thu, 4 Jun 2020 20:42:06 +0800
Subject: [PATCH 0111/2658] ARM: imx5: add missing put_device() call in
 imx_suspend_alloc_ocram()

[ Upstream commit 586745f1598ccf71b0a5a6df2222dee0a865954e ]

if of_find_device_by_node() succeed, imx_suspend_alloc_ocram() doesn't
have a corresponding put_device(). Thus add a jump target to fix the
exception handling for this function implementation.

Fixes: 1579c7b9fe01 ("ARM: imx53: Set DDR pins to high impedance when in suspend to RAM.")
Signed-off-by: yu kuai <yukuai3@huawei.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-imx/pm-imx5.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-imx/pm-imx5.c b/arch/arm/mach-imx/pm-imx5.c
index 532d4b08276d..fd996187fc5f 100644
--- a/arch/arm/mach-imx/pm-imx5.c
+++ b/arch/arm/mach-imx/pm-imx5.c
@@ -301,14 +301,14 @@ static int __init imx_suspend_alloc_ocram(
 	if (!ocram_pool) {
 		pr_warn("%s: ocram pool unavailable!\n", __func__);
 		ret = -ENODEV;
-		goto put_node;
+		goto put_device;
 	}
 
 	ocram_base = gen_pool_alloc(ocram_pool, size);
 	if (!ocram_base) {
 		pr_warn("%s: unable to alloc ocram!\n", __func__);
 		ret = -ENOMEM;
-		goto put_node;
+		goto put_device;
 	}
 
 	phys = gen_pool_virt_to_phys(ocram_pool, ocram_base);
@@ -318,6 +318,8 @@ static int __init imx_suspend_alloc_ocram(
 	if (virt_out)
 		*virt_out = virt;
 
+put_device:
+	put_device(&pdev->dev);
 put_node:
 	of_node_put(node);
 

From 80e97830a3080ec13e02918f5010be8b65e7d96a Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Mon, 15 Jun 2020 14:27:19 +0300
Subject: [PATCH 0112/2658] usb: gadget: udc: Potential Oops in error handling
 code

[ Upstream commit e55f3c37cb8d31c7e301f46396b2ac6a19eb3a7c ]

If this is in "transceiver" mode the the ->qwork isn't required and is
a NULL pointer.  This can lead to a NULL dereference when we call
destroy_workqueue(udc->qwork).

Fixes: 3517c31a8ece ("usb: gadget: mv_udc: use devm_xxx for probe")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/mv_udc_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c
index 81b6229c7805..4f480059f851 100644
--- a/drivers/usb/gadget/udc/mv_udc_core.c
+++ b/drivers/usb/gadget/udc/mv_udc_core.c
@@ -2322,7 +2322,8 @@ static int mv_udc_probe(struct platform_device *pdev)
 	return 0;
 
 err_create_workqueue:
-	destroy_workqueue(udc->qwork);
+	if (udc->qwork)
+		destroy_workqueue(udc->qwork);
 err_destroy_dma:
 	dma_pool_destroy(udc->dtd_pool);
 err_free_dma:

From 5848d59d40e7f480f0236a79ed4d4a30df53fbe8 Mon Sep 17 00:00:00 2001
From: Russell King <rmk+kernel@armlinux.org.uk>
Date: Wed, 10 Jun 2020 21:51:11 +0100
Subject: [PATCH 0113/2658] netfilter: ipset: fix unaligned atomic access

[ Upstream commit 715028460082d07a7ec6fcd87b14b46784346a72 ]

When using ip_set with counters and comment, traffic causes the kernel
to panic on 32-bit ARM:

Alignment trap: not handling instruction e1b82f9f at [<bf01b0dc>]
Unhandled fault: alignment exception (0x221) at 0xea08133c
PC is at ip_set_match_extensions+0xe0/0x224 [ip_set]

The problem occurs when we try to update the 64-bit counters - the
faulting address above is not 64-bit aligned.  The problem occurs
due to the way elements are allocated, for example:

	set->dsize = ip_set_elem_len(set, tb, 0, 0);
	map = ip_set_alloc(sizeof(*map) + elements * set->dsize);

If the element has a requirement for a member to be 64-bit aligned,
and set->dsize is not a multiple of 8, but is a multiple of four,
then every odd numbered elements will be misaligned - and hitting
an atomic64_add() on that element will cause the kernel to panic.

ip_set_elem_len() must return a size that is rounded to the maximum
alignment of any extension field stored in the element.  This change
ensures that is the case.

Fixes: 95ad1f4a9358 ("netfilter: ipset: Fix extension alignment")
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/ipset/ip_set_core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 0583e2491770..3231030a73ed 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -379,6 +379,8 @@ ip_set_elem_len(struct ip_set *set, struct nlattr *tb[], size_t len,
 	for (id = 0; id < IPSET_EXT_ID_MAX; id++) {
 		if (!add_extension(id, cadt_flags, tb))
 			continue;
+		if (align < ip_set_extensions[id].align)
+			align = ip_set_extensions[id].align;
 		len = ALIGN(len, ip_set_extensions[id].align);
 		set->offset[id] = len;
 		set->extensions |= ip_set_extensions[id].type;

From ed8011239bcd86c00d6aea5d469d2adb0107c0ad Mon Sep 17 00:00:00 2001
From: Juri Lelli <juri.lelli@redhat.com>
Date: Mon, 19 Nov 2018 16:32:01 +0100
Subject: [PATCH 0114/2658] sched/core: Fix PI boosting between RT and DEADLINE
 tasks

[ Upstream commit 740797ce3a124b7dd22b7fb832d87bc8fba1cf6f ]

syzbot reported the following warning:

 WARNING: CPU: 1 PID: 6351 at kernel/sched/deadline.c:628
 enqueue_task_dl+0x22da/0x38a0 kernel/sched/deadline.c:1504

At deadline.c:628 we have:

 623 static inline void setup_new_dl_entity(struct sched_dl_entity *dl_se)
 624 {
 625 	struct dl_rq *dl_rq = dl_rq_of_se(dl_se);
 626 	struct rq *rq = rq_of_dl_rq(dl_rq);
 627
 628 	WARN_ON(dl_se->dl_boosted);
 629 	WARN_ON(dl_time_before(rq_clock(rq), dl_se->deadline));
        [...]
     }

Which means that setup_new_dl_entity() has been called on a task
currently boosted. This shouldn't happen though, as setup_new_dl_entity()
is only called when the 'dynamic' deadline of the new entity
is in the past w.r.t. rq_clock and boosted tasks shouldn't verify this
condition.

Digging through the PI code I noticed that what above might in fact happen
if an RT tasks blocks on an rt_mutex hold by a DEADLINE task. In the
first branch of boosting conditions we check only if a pi_task 'dynamic'
deadline is earlier than mutex holder's and in this case we set mutex
holder to be dl_boosted. However, since RT 'dynamic' deadlines are only
initialized if such tasks get boosted at some point (or if they become
DEADLINE of course), in general RT 'dynamic' deadlines are usually equal
to 0 and this verifies the aforementioned condition.

Fix it by checking that the potential donor task is actually (even if
temporary because in turn boosted) running at DEADLINE priority before
using its 'dynamic' deadline value.

Fixes: 2d3d891d3344 ("sched/deadline: Add SCHED_DEADLINE inheritance logic")
Reported-by: syzbot+119ba87189432ead09b4@syzkaller.appspotmail.com
Signed-off-by: Juri Lelli <juri.lelli@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Daniel Bristot de Oliveira <bristot@redhat.com>
Tested-by: Daniel Wagner <dwagner@suse.de>
Link: https://lkml.kernel.org/r/20181119153201.GB2119@localhost.localdomain
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 30656a46787b..9a4c8618d79f 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3843,7 +3843,8 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
 	if (dl_prio(prio)) {
 		struct task_struct *pi_task = rt_mutex_get_top_task(p);
 		if (!dl_prio(p->normal_prio) ||
-		    (pi_task && dl_entity_preempt(&pi_task->dl, &p->dl))) {
+		    (pi_task && dl_prio(pi_task->prio) &&
+		     dl_entity_preempt(&pi_task->dl, &p->dl))) {
 			p->dl.dl_boosted = 1;
 			queue_flag |= ENQUEUE_REPLENISH;
 		} else

From ecae1b3da0ee5c41738e03c87b713d2adf4ac93e Mon Sep 17 00:00:00 2001
From: Zekun Shen <bruceshenzk@gmail.com>
Date: Mon, 15 Jun 2020 11:50:29 -0400
Subject: [PATCH 0115/2658] net: alx: fix race condition in alx_remove

[ Upstream commit e89df5c4322c1bf495f62d74745895b5fd2a4393 ]

There is a race condition exist during termination. The path is
alx_stop and then alx_remove. An alx_schedule_link_check could be called
before alx_stop by interrupt handler and invoke alx_link_check later.
Alx_stop frees the napis, and alx_remove cancels any pending works.
If any of the work is scheduled before termination and invoked before
alx_remove, a null-ptr-deref occurs because both expect alx->napis[i].

This patch fix the race condition by moving cancel_work_sync functions
before alx_free_napis inside alx_stop. Because interrupt handler can call
alx_schedule_link_check again, alx_free_irq is moved before
cancel_work_sync calls too.

Signed-off-by: Zekun Shen <bruceshenzk@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/atheros/alx/main.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index df54475d163b..43bcc19c9068 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -872,8 +872,12 @@ static int __alx_open(struct alx_priv *alx, bool resume)
 
 static void __alx_stop(struct alx_priv *alx)
 {
-	alx_halt(alx);
 	alx_free_irq(alx);
+
+	cancel_work_sync(&alx->link_check_wk);
+	cancel_work_sync(&alx->reset_wk);
+
+	alx_halt(alx);
 	alx_free_rings(alx);
 }
 
@@ -1406,9 +1410,6 @@ static void alx_remove(struct pci_dev *pdev)
 	struct alx_priv *alx = pci_get_drvdata(pdev);
 	struct alx_hw *hw = &alx->hw;
 
-	cancel_work_sync(&alx->link_check_wk);
-	cancel_work_sync(&alx->reset_wk);
-
 	/* restore permanent mac address */
 	alx_set_macaddr(hw, hw->perm_addr);
 

From 4e68fc7377353164bb2e505e8bb7c308cff2c305 Mon Sep 17 00:00:00 2001
From: Masahiro Yamada <masahiroy@kernel.org>
Date: Sun, 14 Jun 2020 23:43:40 +0900
Subject: [PATCH 0116/2658] kbuild: improve cc-option to clean up all temporary
 files

[ Upstream commit f2f02ebd8f3833626642688b2d2c6a7b3c141fa9 ]

When cc-option and friends evaluate compiler flags, the temporary file
$$TMP is created as an output object, and automatically cleaned up.
The actual file path of $$TMP is .<pid>.tmp, here <pid> is the process
ID of $(shell ...) invoked from cc-option. (Please note $$$$ is the
escape sequence of $$).

Such garbage files are cleaned up in most cases, but some compiler flags
create additional output files.

For example, -gsplit-dwarf creates a .dwo file.

When CONFIG_DEBUG_INFO_SPLIT=y, you will see a bunch of .<pid>.dwo files
left in the top of build directories. You may not notice them unless you
do 'ls -a', but the garbage files will increase every time you run 'make'.

This commit changes the temporary object path to .tmp_<pid>/tmp, and
removes .tmp_<pid> directory when exiting. Separate build artifacts such
as *.dwo will be cleaned up all together because their file paths are
usually determined based on the base name of the object.

Another example is -ftest-coverage, which outputs the coverage data into
<base-name-of-object>.gcno

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/Kbuild.include | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
index 374d5460caa5..1112dd94b440 100644
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -81,20 +81,21 @@ cc-cross-prefix =  \
 		fi)))
 
 # output directory for tests below
-TMPOUT := $(if $(KBUILD_EXTMOD),$(firstword $(KBUILD_EXTMOD))/)
+TMPOUT = $(if $(KBUILD_EXTMOD),$(firstword $(KBUILD_EXTMOD))/).tmp_$$$$
 
 # try-run
 # Usage: option = $(call try-run, $(CC)...-o "$$TMP",option-ok,otherwise)
 # Exit code chooses option. "$$TMP" is can be used as temporary file and
 # is automatically cleaned up.
 try-run = $(shell set -e;		\
-	TMP="$(TMPOUT).$$$$.tmp";	\
-	TMPO="$(TMPOUT).$$$$.o";	\
+	TMP=$(TMPOUT)/tmp;		\
+	TMPO=$(TMPOUT)/tmp.o;		\
+	mkdir -p $(TMPOUT);		\
+	trap "rm -rf $(TMPOUT)" EXIT;	\
 	if ($(1)) >/dev/null 2>&1;	\
 	then echo "$(2)";		\
 	else echo "$(3)";		\
-	fi;				\
-	rm -f "$$TMP" "$$TMPO")
+	fi)
 
 # as-option
 # Usage: cflags-y += $(call as-option,-Wa$(comma)-isa=foo,)

From ce1ea7f86d9e0743283d5f94f4c73afeafefee59 Mon Sep 17 00:00:00 2001
From: Luis Chamberlain <mcgrof@kernel.org>
Date: Fri, 5 Jun 2020 16:58:36 +0200
Subject: [PATCH 0117/2658] blktrace: break out of blktrace setup on concurrent
 calls

[ Upstream commit 1b0b283648163dae2a214ca28ed5a99f62a77319 ]

We use one blktrace per request_queue, that means one per the entire
disk.  So we cannot run one blktrace on say /dev/vda and then /dev/vda1,
or just two calls on /dev/vda.

We check for concurrent setup only at the very end of the blktrace setup though.

If we try to run two concurrent blktraces on the same block device the
second one will fail, and the first one seems to go on. However when
one tries to kill the first one one will see things like this:

The kernel will show these:

```
debugfs: File 'dropped' in directory 'nvme1n1' already present!
debugfs: File 'msg' in directory 'nvme1n1' already present!
debugfs: File 'trace0' in directory 'nvme1n1' already present!
``

And userspace just sees this error message for the second call:

```
blktrace /dev/nvme1n1
BLKTRACESETUP(2) /dev/nvme1n1 failed: 5/Input/output error
```

The first userspace process #1 will also claim that the files
were taken underneath their nose as well. The files are taken
away form the first process given that when the second blktrace
fails, it will follow up with a BLKTRACESTOP and BLKTRACETEARDOWN.
This means that even if go-happy process #1 is waiting for blktrace
data, we *have* been asked to take teardown the blktrace.

This can easily be reproduced with break-blktrace [0] run_0005.sh test.

Just break out early if we know we're already going to fail, this will
prevent trying to create the files all over again, which we know still
exist.

[0] https://github.com/mcgrof/break-blktrace

Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/blktrace.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 105ad9c435c5..99ffe05937e8 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -15,6 +15,9 @@
  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  *
  */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/blkdev.h>
 #include <linux/blktrace_api.h>
@@ -480,6 +483,16 @@ int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
 	 */
 	strreplace(buts->name, '/', '_');
 
+	/*
+	 * bdev can be NULL, as with scsi-generic, this is a helpful as
+	 * we can be.
+	 */
+	if (q->blk_trace) {
+		pr_warn("Concurrent blktraces are not allowed on %s\n",
+			buts->name);
+		return -EBUSY;
+	}
+
 	bt = kzalloc(sizeof(*bt), GFP_KERNEL);
 	if (!bt)
 		return -ENOMEM;

From 6f15253b2cd666c094c4c2820483052a89c2a2fa Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <natechancellor@gmail.com>
Date: Thu, 11 Jun 2020 21:51:50 -0700
Subject: [PATCH 0118/2658] ACPI: sysfs: Fix pm_profile_attr type

commit e6d701dca9893990d999fd145e3e07223c002b06 upstream.

When running a kernel with Clang's Control Flow Integrity implemented,
there is a violation that happens when accessing
/sys/firmware/acpi/pm_profile:

$ cat /sys/firmware/acpi/pm_profile
0

$ dmesg
...
[   17.352564] ------------[ cut here ]------------
[   17.352568] CFI failure (target: acpi_show_profile+0x0/0x8):
[   17.352572] WARNING: CPU: 3 PID: 497 at kernel/cfi.c:29 __cfi_check_fail+0x33/0x40
[   17.352573] Modules linked in:
[   17.352575] CPU: 3 PID: 497 Comm: cat Tainted: G        W         5.7.0-microsoft-standard+ #1
[   17.352576] RIP: 0010:__cfi_check_fail+0x33/0x40
[   17.352577] Code: 48 c7 c7 50 b3 85 84 48 c7 c6 50 0a 4e 84 e8 a4 d8 60 00 85 c0 75 02 5b c3 48 c7 c7 dc 5e 49 84 48 89 de 31 c0 e8 7d 06 eb ff <0f> 0b 5b c3 00 00 cc cc 00 00 cc cc 00 85 f6 74 25 41 b9 ea ff ff
[   17.352577] RSP: 0018:ffffaa6dc3c53d30 EFLAGS: 00010246
[   17.352578] RAX: 331267e0c06cee00 RBX: ffffffff83d85890 RCX: ffffffff8483a6f8
[   17.352579] RDX: ffff9cceabbb37c0 RSI: 0000000000000082 RDI: ffffffff84bb9e1c
[   17.352579] RBP: ffffffff845b2bc8 R08: 0000000000000001 R09: ffff9cceabbba200
[   17.352579] R10: 000000000000019d R11: 0000000000000000 R12: ffff9cc947766f00
[   17.352580] R13: ffffffff83d6bd50 R14: ffff9ccc6fa80000 R15: ffffffff845bd328
[   17.352582] FS:  00007fdbc8d13580(0000) GS:ffff9cce91ac0000(0000) knlGS:0000000000000000
[   17.352582] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   17.352583] CR2: 00007fdbc858e000 CR3: 00000005174d0000 CR4: 0000000000340ea0
[   17.352584] Call Trace:
[   17.352586]  ? rev_id_show+0x8/0x8
[   17.352587]  ? __cfi_check+0x45bac/0x4b640
[   17.352589]  ? kobj_attr_show+0x73/0x80
[   17.352590]  ? sysfs_kf_seq_show+0xc1/0x140
[   17.352592]  ? ext4_seq_options_show.cfi_jt+0x8/0x8
[   17.352593]  ? seq_read+0x180/0x600
[   17.352595]  ? sysfs_create_file_ns.cfi_jt+0x10/0x10
[   17.352596]  ? tlbflush_read_file+0x8/0x8
[   17.352597]  ? __vfs_read+0x6b/0x220
[   17.352598]  ? handle_mm_fault+0xa23/0x11b0
[   17.352599]  ? vfs_read+0xa2/0x130
[   17.352599]  ? ksys_read+0x6a/0xd0
[   17.352601]  ? __do_sys_getpgrp+0x8/0x8
[   17.352602]  ? do_syscall_64+0x72/0x120
[   17.352603]  ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   17.352604] ---[ end trace 7b1fa81dc897e419 ]---

When /sys/firmware/acpi/pm_profile is read, sysfs_kf_seq_show is called,
which in turn calls kobj_attr_show, which gets the ->show callback
member by calling container_of on attr (casting it to struct
kobj_attribute) then calls it.

There is a CFI violation because pm_profile_attr is of type
struct device_attribute but kobj_attr_show calls ->show expecting it
to be from struct kobj_attribute. CFI checking ensures that function
pointer types match when doing indirect calls. Fix pm_profile_attr to
be defined in terms of kobj_attribute so there is no violation or
mismatch.

Fixes: 362b646062b2 ("ACPI: Export FADT pm_profile integer value to userspace")
Link: https://github.com/ClangBuiltLinux/linux/issues/1051
Reported-by: yuu ichii <byahu140@heisei.be>
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Cc: 3.10+ <stable@vger.kernel.org> # 3.10+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/acpi/sysfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index ef3dfc90e817..13c308323e94 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -776,13 +776,13 @@ static void __exit interrupt_stats_exit(void)
 }
 
 static ssize_t
-acpi_show_profile(struct device *dev, struct device_attribute *attr,
+acpi_show_profile(struct kobject *kobj, struct kobj_attribute *attr,
 		  char *buf)
 {
 	return sprintf(buf, "%d\n", acpi_gbl_FADT.preferred_profile);
 }
 
-static const struct device_attribute pm_profile_attr =
+static const struct kobj_attribute pm_profile_attr =
 	__ATTR(pm_profile, S_IRUGO, acpi_show_profile, NULL);
 
 static ssize_t hotplug_enabled_show(struct kobject *kobj,

From afc755ace04804e5e2147c69465b3dc4ec982e70 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Tue, 16 Jun 2020 15:33:07 +0800
Subject: [PATCH 0119/2658] KVM: X86: Fix MSR range of APIC registers in X2APIC
 mode

commit bf10bd0be53282183f374af23577b18b5fbf7801 upstream.

Only MSR address range 0x800 through 0x8ff is architecturally reserved
and dedicated for accessing APIC registers in x2APIC mode.

Fixes: 0105d1a52640 ("KVM: x2apic interface to lapic")
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-Id: <20200616073307.16440-1-xiaoyao.li@intel.com>
Cc: stable@vger.kernel.org
Reviewed-by: Sean Christopherson <sean.j.christopherson@intel.com>
Reviewed-by: Jim Mattson <jmattson@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/x86.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 7f540b691de6..1bca988136fb 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2162,7 +2162,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 		return kvm_mtrr_set_msr(vcpu, msr, data);
 	case MSR_IA32_APICBASE:
 		return kvm_set_apic_base(vcpu, msr_info);
-	case APIC_BASE_MSR ... APIC_BASE_MSR + 0x3ff:
+	case APIC_BASE_MSR ... APIC_BASE_MSR + 0xff:
 		return kvm_x2apic_msr_write(vcpu, msr, data);
 	case MSR_IA32_TSCDEADLINE:
 		kvm_set_lapic_tscdeadline_msr(vcpu, data);
@@ -2432,7 +2432,7 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 	case MSR_IA32_APICBASE:
 		msr_info->data = kvm_get_apic_base(vcpu);
 		break;
-	case APIC_BASE_MSR ... APIC_BASE_MSR + 0x3ff:
+	case APIC_BASE_MSR ... APIC_BASE_MSR + 0xff:
 		return kvm_x2apic_msr_read(vcpu, msr_info->index, &msr_info->data);
 		break;
 	case MSR_IA32_TSCDEADLINE:

From f7d88de7c328bb03faaee380717f9babc2277219 Mon Sep 17 00:00:00 2001
From: Waiman Long <longman@redhat.com>
Date: Thu, 25 Jun 2020 20:29:52 -0700
Subject: [PATCH 0120/2658] mm/slab: use memzero_explicit() in kzfree()

commit 8982ae527fbef170ef298650c15d55a9ccd33973 upstream.

The kzfree() function is normally used to clear some sensitive
information, like encryption keys, in the buffer before freeing it back to
the pool.  Memset() is currently used for buffer clearing.  However
unlikely, there is still a non-zero probability that the compiler may
choose to optimize away the memory clearing especially if LTO is being
used in the future.

To make sure that this optimization will never happen,
memzero_explicit(), which is introduced in v3.18, is now used in
kzfree() to future-proof it.

Link: http://lkml.kernel.org/r/20200616154311.12314-2-longman@redhat.com
Fixes: 3ef0e5ba4673 ("slab: introduce kzfree()")
Signed-off-by: Waiman Long <longman@redhat.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Cc: James Morris <jmorris@namei.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Cc: Joe Perches <joe@perches.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: "Jason A . Donenfeld" <Jason@zx2c4.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/slab_common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/slab_common.c b/mm/slab_common.c
index e49ad39f011f..5104c8c8d051 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -1319,7 +1319,7 @@ void kzfree(const void *p)
 	if (unlikely(ZERO_OR_NULL_PTR(mem)))
 		return;
 	ks = ksize(mem);
-	memset(mem, 0, ks);
+	memzero_explicit(mem, ks);
 	kfree(mem);
 }
 EXPORT_SYMBOL(kzfree);

From 0f4c72c9276cd8898f0d51f5d57b217b941577d9 Mon Sep 17 00:00:00 2001
From: Junxiao Bi <junxiao.bi@oracle.com>
Date: Thu, 25 Jun 2020 20:29:33 -0700
Subject: [PATCH 0121/2658] ocfs2: load global_inode_alloc

commit 7569d3c754e452769a5747eeeba488179e38a5da upstream.

Set global_inode_alloc as OCFS2_FIRST_ONLINE_SYSTEM_INODE, that will
make it load during mount.  It can be used to test whether some
global/system inodes are valid.  One use case is that nfsd will test
whether root inode is valid.

Link: http://lkml.kernel.org/r/20200616183829.87211-3-junxiao.bi@oracle.com
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/ocfs2_fs.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
index 540ab5b75dbb..88c1bd3898fa 100644
--- a/fs/ocfs2/ocfs2_fs.h
+++ b/fs/ocfs2/ocfs2_fs.h
@@ -340,8 +340,8 @@ struct ocfs2_system_inode_info {
 enum {
 	BAD_BLOCK_SYSTEM_INODE = 0,
 	GLOBAL_INODE_ALLOC_SYSTEM_INODE,
+#define OCFS2_FIRST_ONLINE_SYSTEM_INODE GLOBAL_INODE_ALLOC_SYSTEM_INODE
 	SLOT_MAP_SYSTEM_INODE,
-#define OCFS2_FIRST_ONLINE_SYSTEM_INODE SLOT_MAP_SYSTEM_INODE
 	HEARTBEAT_SYSTEM_INODE,
 	GLOBAL_BITMAP_SYSTEM_INODE,
 	USER_QUOTA_SYSTEM_INODE,

From a583046c41cc315e447839ef1c6322129dad9de0 Mon Sep 17 00:00:00 2001
From: Junxiao Bi <junxiao.bi@oracle.com>
Date: Thu, 25 Jun 2020 20:29:40 -0700
Subject: [PATCH 0122/2658] ocfs2: fix value of OCFS2_INVALID_SLOT

commit 9277f8334ffc719fe922d776444d6e4e884dbf30 upstream.

In the ocfs2 disk layout, slot number is 16 bits, but in ocfs2
implementation, slot number is 32 bits.  Usually this will not cause any
issue, because slot number is converted from u16 to u32, but
OCFS2_INVALID_SLOT was defined as -1, when an invalid slot number from
disk was obtained, its value was (u16)-1, and it was converted to u32.
Then the following checking in get_local_system_inode will be always
skipped:

 static struct inode **get_local_system_inode(struct ocfs2_super *osb,
                                               int type,
                                               u32 slot)
 {
 	BUG_ON(slot == OCFS2_INVALID_SLOT);
	...
 }

Link: http://lkml.kernel.org/r/20200616183829.87211-5-junxiao.bi@oracle.com
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/ocfs2_fs.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
index 88c1bd3898fa..5617ec167a9d 100644
--- a/fs/ocfs2/ocfs2_fs.h
+++ b/fs/ocfs2/ocfs2_fs.h
@@ -304,7 +304,7 @@
 #define OCFS2_MAX_SLOTS			255
 
 /* Slot map indicator for an empty slot */
-#define OCFS2_INVALID_SLOT		-1
+#define OCFS2_INVALID_SLOT		((u16)-1)
 
 #define OCFS2_VOL_UUID_LEN		16
 #define OCFS2_MAX_VOL_LABEL_LEN		64

From ea6aef97580bb8f4acb0768f6b5aa91acf92280e Mon Sep 17 00:00:00 2001
From: Junxiao Bi <junxiao.bi@oracle.com>
Date: Thu, 25 Jun 2020 20:29:37 -0700
Subject: [PATCH 0123/2658] ocfs2: fix panic on nfs server over ocfs2

commit e5a15e17a78d58f933d17cafedfcf7486a29f5b4 upstream.

The following kernel panic was captured when running nfs server over
ocfs2, at that time ocfs2_test_inode_bit() was checking whether one
inode locating at "blkno" 5 was valid, that is ocfs2 root inode, its
"suballoc_slot" was OCFS2_INVALID_SLOT(65535) and it was allocted from
//global_inode_alloc, but here it wrongly assumed that it was got from per
slot inode alloctor which would cause array overflow and trigger kernel
panic.

  BUG: unable to handle kernel paging request at 0000000000001088
  IP: [<ffffffff816f6898>] _raw_spin_lock+0x18/0xf0
  PGD 1e06ba067 PUD 1e9e7d067 PMD 0
  Oops: 0002 [#1] SMP
  CPU: 6 PID: 24873 Comm: nfsd Not tainted 4.1.12-124.36.1.el6uek.x86_64 #2
  Hardware name: Huawei CH121 V3/IT11SGCA1, BIOS 3.87 02/02/2018
  RIP: _raw_spin_lock+0x18/0xf0
  RSP: e02b:ffff88005ae97908  EFLAGS: 00010206
  RAX: ffff88005ae98000 RBX: 0000000000001088 RCX: 0000000000000000
  RDX: 0000000000020000 RSI: 0000000000000009 RDI: 0000000000001088
  RBP: ffff88005ae97928 R08: 0000000000000000 R09: ffff880212878e00
  R10: 0000000000007ff0 R11: 0000000000000000 R12: 0000000000001088
  R13: ffff8800063c0aa8 R14: ffff8800650c27d0 R15: 000000000000ffff
  FS:  0000000000000000(0000) GS:ffff880218180000(0000) knlGS:ffff880218180000
  CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000000001088 CR3: 00000002033d0000 CR4: 0000000000042660
  Call Trace:
    igrab+0x1e/0x60
    ocfs2_get_system_file_inode+0x63/0x3a0 [ocfs2]
    ocfs2_test_inode_bit+0x328/0xa00 [ocfs2]
    ocfs2_get_parent+0xba/0x3e0 [ocfs2]
    reconnect_path+0xb5/0x300
    exportfs_decode_fh+0xf6/0x2b0
    fh_verify+0x350/0x660 [nfsd]
    nfsd4_putfh+0x4d/0x60 [nfsd]
    nfsd4_proc_compound+0x3d3/0x6f0 [nfsd]
    nfsd_dispatch+0xe0/0x290 [nfsd]
    svc_process_common+0x412/0x6a0 [sunrpc]
    svc_process+0x123/0x210 [sunrpc]
    nfsd+0xff/0x170 [nfsd]
    kthread+0xcb/0xf0
    ret_from_fork+0x61/0x90
  Code: 83 c2 02 0f b7 f2 e8 18 dc 91 ff 66 90 eb bf 0f 1f 40 00 55 48 89 e5 41 56 41 55 41 54 53 0f 1f 44 00 00 48 89 fb ba 00 00 02 00 <f0> 0f c1 17 89 d0 45 31 e4 45 31 ed c1 e8 10 66 39 d0 41 89 c6
  RIP   _raw_spin_lock+0x18/0xf0
  CR2: 0000000000001088
  ---[ end trace 7264463cd1aac8f9 ]---
  Kernel panic - not syncing: Fatal exception

Link: http://lkml.kernel.org/r/20200616183829.87211-4-junxiao.bi@oracle.com
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/suballoc.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index fc6d25f6d444..28cc343bf6e3 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -2863,9 +2863,12 @@ int ocfs2_test_inode_bit(struct ocfs2_super *osb, u64 blkno, int *res)
 		goto bail;
 	}
 
-	inode_alloc_inode =
-		ocfs2_get_system_file_inode(osb, INODE_ALLOC_SYSTEM_INODE,
-					    suballoc_slot);
+	if (suballoc_slot == (u16)OCFS2_INVALID_SLOT)
+		inode_alloc_inode = ocfs2_get_system_file_inode(osb,
+			GLOBAL_INODE_ALLOC_SYSTEM_INODE, suballoc_slot);
+	else
+		inode_alloc_inode = ocfs2_get_system_file_inode(osb,
+			INODE_ALLOC_SYSTEM_INODE, suballoc_slot);
 	if (!inode_alloc_inode) {
 		/* the error code could be inaccurate, but we are not able to
 		 * get the correct one. */

From d69eb9770d5bd407a07eef0cdd1a3b72884e69b4 Mon Sep 17 00:00:00 2001
From: Jiping Ma <jiping.ma2@windriver.com>
Date: Mon, 11 May 2020 10:52:07 +0800
Subject: [PATCH 0124/2658] arm64: perf: Report the PC value in REGS_ABI_32
 mode

commit 8dfe804a4031ca6ba3a3efb2048534249b64f3a5 upstream.

A 32-bit perf querying the registers of a compat task using REGS_ABI_32
will receive zeroes from w15, when it expects to find the PC.

Return the PC value for register dwarf register 15 when returning register
values for a compat task to perf.

Cc: <stable@vger.kernel.org>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Jiping Ma <jiping.ma2@windriver.com>
Link: https://lore.kernel.org/r/1589165527-188401-1-git-send-email-jiping.ma2@windriver.com
[will: Shuffled code and added a comment]
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kernel/perf_regs.c | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/kernel/perf_regs.c b/arch/arm64/kernel/perf_regs.c
index 3f62b35fb6f1..815c395a1076 100644
--- a/arch/arm64/kernel/perf_regs.c
+++ b/arch/arm64/kernel/perf_regs.c
@@ -13,15 +13,34 @@ u64 perf_reg_value(struct pt_regs *regs, int idx)
 		return 0;
 
 	/*
-	 * Compat (i.e. 32 bit) mode:
-	 * - PC has been set in the pt_regs struct in kernel_entry,
-	 * - Handle SP and LR here.
+	 * Our handling of compat tasks (PERF_SAMPLE_REGS_ABI_32) is weird, but
+	 * we're stuck with it for ABI compatability reasons.
+	 *
+	 * For a 32-bit consumer inspecting a 32-bit task, then it will look at
+	 * the first 16 registers (see arch/arm/include/uapi/asm/perf_regs.h).
+	 * These correspond directly to a prefix of the registers saved in our
+	 * 'struct pt_regs', with the exception of the PC, so we copy that down
+	 * (x15 corresponds to SP_hyp in the architecture).
+	 *
+	 * So far, so good.
+	 *
+	 * The oddity arises when a 64-bit consumer looks at a 32-bit task and
+	 * asks for registers beyond PERF_REG_ARM_MAX. In this case, we return
+	 * SP_usr, LR_usr and PC in the positions where the AArch64 SP, LR and
+	 * PC registers would normally live. The initial idea was to allow a
+	 * 64-bit unwinder to unwind a 32-bit task and, although it's not clear
+	 * how well that works in practice, somebody might be relying on it.
+	 *
+	 * At the time we make a sample, we don't know whether the consumer is
+	 * 32-bit or 64-bit, so we have to cater for both possibilities.
 	 */
 	if (compat_user_mode(regs)) {
 		if ((u32)idx == PERF_REG_ARM64_SP)
 			return regs->compat_sp;
 		if ((u32)idx == PERF_REG_ARM64_LR)
 			return regs->compat_lr;
+		if (idx == 15)
+			return regs->pc;
 	}
 
 	if ((u32)idx == PERF_REG_ARM64_SP)

From 3abdcb00013ff11b0214957cefa184e2b73ce749 Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: Sat, 20 Jun 2020 12:46:03 +0900
Subject: [PATCH 0125/2658] tracing: Fix event trigger to accept redundant
 spaces

commit 6784beada631800f2c5afd567e5628c843362cee upstream.

Fix the event trigger to accept redundant spaces in
the trigger input.

For example, these return -EINVAL

echo " traceon" > events/ftrace/print/trigger
echo "traceon  if common_pid == 0" > events/ftrace/print/trigger
echo "disable_event:kmem:kmalloc " > events/ftrace/print/trigger

But these are hard to find what is wrong.

To fix this issue, use skip_spaces() to remove spaces
in front of actual tokens, and set NULL if there is no
token.

Link: http://lkml.kernel.org/r/159262476352.185015.5261566783045364186.stgit@devnote2

Cc: Tom Zanussi <zanussi@kernel.org>
Cc: stable@vger.kernel.org
Fixes: 85f2b08268c0 ("tracing: Add basic event trigger framework")
Reviewed-by: Tom Zanussi <zanussi@kernel.org>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace_events_trigger.c | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index 78346aba6980..94fca4d687ad 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -204,11 +204,17 @@ static int event_trigger_regex_open(struct inode *inode, struct file *file)
 
 static int trigger_process_regex(struct trace_event_file *file, char *buff)
 {
-	char *command, *next = buff;
+	char *command, *next;
 	struct event_command *p;
 	int ret = -EINVAL;
 
+	next = buff = skip_spaces(buff);
 	command = strsep(&next, ": \t");
+	if (next) {
+		next = skip_spaces(next);
+		if (!*next)
+			next = NULL;
+	}
 	command = (command[0] != '!') ? command : command + 1;
 
 	mutex_lock(&trigger_cmd_mutex);
@@ -615,8 +621,14 @@ event_trigger_callback(struct event_command *cmd_ops,
 	int ret;
 
 	/* separate the trigger from the filter (t:n [if filter]) */
-	if (param && isdigit(param[0]))
+	if (param && isdigit(param[0])) {
 		trigger = strsep(&param, " \t");
+		if (param) {
+			param = skip_spaces(param);
+			if (!*param)
+				param = NULL;
+		}
+	}
 
 	trigger_ops = cmd_ops->get_trigger_ops(cmd, trigger);
 
@@ -1185,6 +1197,11 @@ event_enable_trigger_func(struct event_command *cmd_ops,
 	trigger = strsep(&param, " \t");
 	if (!trigger)
 		return -EINVAL;
+	if (param) {
+		param = skip_spaces(param);
+		if (!*param)
+			param = NULL;
+	}
 
 	system = strsep(&trigger, ":");
 	if (!trigger)

From a6ddd4476be7aed7f16b84a800edb7e9bf901df8 Mon Sep 17 00:00:00 2001
From: Denis Efremov <efremov@linux.com>
Date: Mon, 22 Jun 2020 23:31:22 +0300
Subject: [PATCH 0126/2658] drm/radeon: fix fb_div check in
 ni_init_smc_spll_table()

commit 35f760b44b1b9cb16a306bdcc7220fbbf78c4789 upstream.

clk_s is checked twice in a row in ni_init_smc_spll_table().
fb_div should be checked instead.

Fixes: 69e0b57a91ad ("drm/radeon/kms: add dpm support for cayman (v5)")
Cc: stable@vger.kernel.org
Signed-off-by: Denis Efremov <efremov@linux.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/radeon/ni_dpm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index c3d531a1114b..14ee1d9a56a7 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -2128,7 +2128,7 @@ static int ni_init_smc_spll_table(struct radeon_device *rdev)
 		if (clk_s & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_SHIFT))
 			ret = -EINVAL;
 
-		if (clk_s & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_SHIFT))
+		if (fb_div & ~(SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_SHIFT))
 			ret = -EINVAL;
 
 		if (clk_v & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKV_SHIFT))

From 08a0dbb194a6bc92322b90fb292ab7a7449f79cb Mon Sep 17 00:00:00 2001
From: Vasily Averin <vvs@virtuozzo.com>
Date: Mon, 1 Jun 2020 11:54:57 +0300
Subject: [PATCH 0127/2658] sunrpc: fixed rollback in rpc_gssd_dummy_populate()

commit b7ade38165ca0001c5a3bd5314a314abbbfbb1b7 upstream.

__rpc_depopulate(gssd_dentry) was lost on error path

cc: stable@vger.kernel.org
Fixes: commit 4b9a445e3eeb ("sunrpc: create a new dummy pipe for gssd to hold open")
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/rpc_pipe.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 9103dd15511c..12dd5cc499c1 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -1347,6 +1347,7 @@ rpc_gssd_dummy_populate(struct dentry *root, struct rpc_pipe *pipe_data)
 	q.len = strlen(gssd_dummy_clnt_dir[0].name);
 	clnt_dentry = d_hash_and_lookup(gssd_dentry, &q);
 	if (!clnt_dentry) {
+		__rpc_depopulate(gssd_dentry, gssd_dummy_clnt_dir, 0, 1);
 		pipe_dentry = ERR_PTR(-ENOENT);
 		goto out;
 	}

From 7f15165a34af6432dbd6e846ecb731b610415dc0 Mon Sep 17 00:00:00 2001
From: Chuck Lever <chuck.lever@oracle.com>
Date: Thu, 25 Jun 2020 11:32:34 -0400
Subject: [PATCH 0128/2658] SUNRPC: Properly set the @subbuf parameter of
 xdr_buf_subsegment()

commit 89a3c9f5b9f0bcaa9aea3e8b2a616fcaea9aad78 upstream.

@subbuf is an output parameter of xdr_buf_subsegment(). A survey of
call sites shows that @subbuf is always uninitialized before
xdr_buf_segment() is invoked by callers.

There are some execution paths through xdr_buf_subsegment() that do
not set all of the fields in @subbuf, leaving some pointer fields
containing garbage addresses. Subsequent processing of that buffer
then results in a page fault.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/xdr.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index ed9bbd383f7d..df7ecf9584f6 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -1031,6 +1031,7 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
 		base = 0;
 	} else {
 		base -= buf->head[0].iov_len;
+		subbuf->head[0].iov_base = buf->head[0].iov_base;
 		subbuf->head[0].iov_len = 0;
 	}
 
@@ -1043,6 +1044,8 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
 		base = 0;
 	} else {
 		base -= buf->page_len;
+		subbuf->pages = buf->pages;
+		subbuf->page_base = 0;
 		subbuf->page_len = 0;
 	}
 
@@ -1054,6 +1057,7 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
 		base = 0;
 	} else {
 		base -= buf->tail[0].iov_len;
+		subbuf->tail[0].iov_base = buf->tail[0].iov_base;
 		subbuf->tail[0].iov_len = 0;
 	}
 

From 493834a59b881ff9ec3fc019b1aab45f4fd4eb60 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Mon, 22 Jun 2020 15:04:15 -0400
Subject: [PATCH 0129/2658] pNFS/flexfiles: Fix list corruption if the mirror
 count changes

commit 8b04013737341442ed914b336cde866b902664ae upstream.

If the mirror count changes in the new layout we pick up inside
ff_layout_pg_init_write(), then we can end up adding the
request to the wrong mirror and corrupting the mirror->pg_list.

Fixes: d600ad1f2bdb ("NFS41: pop some layoutget errors to application")
Cc: stable@vger.kernel.org
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/flexfilelayout/flexfilelayout.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index 6506775575aa..17771e157e92 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -855,9 +855,8 @@ ff_layout_pg_init_write(struct nfs_pageio_descriptor *pgio,
 		goto out_mds;
 
 	/* Use a direct mapping of ds_idx to pgio mirror_idx */
-	if (WARN_ON_ONCE(pgio->pg_mirror_count !=
-	    FF_LAYOUT_MIRROR_COUNT(pgio->pg_lseg)))
-		goto out_mds;
+	if (pgio->pg_mirror_count != FF_LAYOUT_MIRROR_COUNT(pgio->pg_lseg))
+		goto out_eagain;
 
 	for (i = 0; i < pgio->pg_mirror_count; i++) {
 		ds = nfs4_ff_layout_prepare_ds(pgio->pg_lseg, i, true);
@@ -869,11 +868,15 @@ ff_layout_pg_init_write(struct nfs_pageio_descriptor *pgio,
 	}
 
 	return;
-
+out_eagain:
+	pnfs_generic_pg_cleanup(pgio);
+	pgio->pg_error = -EAGAIN;
+	return;
 out_mds:
 	pnfs_put_lseg(pgio->pg_lseg);
 	pgio->pg_lseg = NULL;
 	nfs_pageio_reset_write_mds(pgio);
+	pgio->pg_error = -EAGAIN;
 }
 
 static unsigned int

From 416a09ec4ca7efdfcad27eb9ed7846a83f8bd06b Mon Sep 17 00:00:00 2001
From: Olga Kornievskaia <olga.kornievskaia@gmail.com>
Date: Wed, 24 Jun 2020 13:54:08 -0400
Subject: [PATCH 0130/2658] NFSv4 fix CLOSE not waiting for direct IO
 compeletion

commit d03727b248d0dae6199569a8d7b629a681154633 upstream.

Figuring out the root case for the REMOVE/CLOSE race and
suggesting the solution was done by Neil Brown.

Currently what happens is that direct IO calls hold a reference
on the open context which is decremented as an asynchronous task
in the nfs_direct_complete(). Before reference is decremented,
control is returned to the application which is free to close the
file. When close is being processed, it decrements its reference
on the open_context but since directIO still holds one, it doesn't
sent a close on the wire. It returns control to the application
which is free to do other operations. For instance, it can delete a
file. Direct IO is finally releasing its reference and triggering
an asynchronous close. Which races with the REMOVE. On the server,
REMOVE can be processed before the CLOSE, failing the REMOVE with
EACCES as the file is still opened.

Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Suggested-by: Neil Brown <neilb@suse.com>
CC: stable@vger.kernel.org
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/direct.c | 13 +++++++++----
 fs/nfs/file.c   |  1 +
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 7789f0b9b999..4d76e9a97538 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -385,8 +385,6 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq, bool write)
 	if (write)
 		nfs_zap_mapping(inode, inode->i_mapping);
 
-	inode_dio_end(inode);
-
 	if (dreq->iocb) {
 		long res = (long) dreq->error;
 		if (!res)
@@ -396,7 +394,10 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq, bool write)
 
 	complete_all(&dreq->completion);
 
+	igrab(inode);
 	nfs_direct_req_release(dreq);
+	inode_dio_end(inode);
+	iput(inode);
 }
 
 static void nfs_direct_readpage_release(struct nfs_page *req)
@@ -537,8 +538,10 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq,
 	 * generic layer handle the completion.
 	 */
 	if (requested_bytes == 0) {
-		inode_dio_end(inode);
+		igrab(inode);
 		nfs_direct_req_release(dreq);
+		inode_dio_end(inode);
+		iput(inode);
 		return result < 0 ? result : -EIO;
 	}
 
@@ -939,8 +942,10 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,
 	 * generic layer handle the completion.
 	 */
 	if (requested_bytes == 0) {
-		inode_dio_end(inode);
+		igrab(inode);
 		nfs_direct_req_release(dreq);
+		inode_dio_end(inode);
+		iput(inode);
 		return result < 0 ? result : -EIO;
 	}
 
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index dc875cd0e11d..eaa6697d256e 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -82,6 +82,7 @@ nfs_file_release(struct inode *inode, struct file *filp)
 	dprintk("NFS: release(%pD2)\n", filp);
 
 	nfs_inc_stats(inode, NFSIOS_VFSRELEASE);
+	inode_dio_wait(inode);
 	nfs_file_clear_open_context(filp);
 	return 0;
 }

From 5d5817e6c3d9bdbc083736ddb865e58faaa63781 Mon Sep 17 00:00:00 2001
From: Dongdong Liu <liudongdong3@huawei.com>
Date: Thu, 28 Dec 2017 17:53:32 +0800
Subject: [PATCH 0131/2658] PCI: Disable MSI for HiSilicon Hip06/Hip07 only in
 Root Port mode

commit deb86999323661c019ef2740eb9d479d1e526b5c upstream.

HiSilicon Hip06/Hip07 can operate as either a Root Port or an Endpoint.  It
always advertises an MSI capability, but it can only generate MSIs when in
Endpoint mode.

The device has the same Vendor and Device IDs in both modes, so check the
Class Code and disable MSI only when operating as a Root Port.

[bhelgaas: changelog]
Fixes: 72f2ff0deb87 ("PCI: Disable MSI for HiSilicon Hip06/Hip07 Root Ports")
Signed-off-by: Dongdong Liu <liudongdong3@huawei.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Zhou Wang <wangzhou1@hisilicon.com>
Cc: stable@vger.kernel.org	# v4.11+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/quirks.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index eeb771ecda15..ab161bbeb4d4 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -1623,8 +1623,8 @@ static void quirk_pcie_mch(struct pci_dev *pdev)
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_E7520_MCH,	quirk_pcie_mch);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_E7320_MCH,	quirk_pcie_mch);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_E7525_MCH,	quirk_pcie_mch);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_HUAWEI,	0x1610,	quirk_pcie_mch);
 
+DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_HUAWEI, 0x1610, PCI_CLASS_BRIDGE_PCI, 8, quirk_pcie_mch);
 
 /*
  * It's possible for the MSI to get corrupted if shpc and acpi

From e9311981b3144417cbe90cf696c544b6bb3810ec Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Thu, 15 Aug 2019 11:41:06 +0200
Subject: [PATCH 0132/2658] ALSA: usb-audio: Fix invalid NULL check in
 snd_emuusb_set_samplerate()

commit 6de3c9e3f6b3eaf66859e1379b3f35dda781416b upstream.

The quirk function snd_emuusb_set_samplerate() has a NULL check for
the mixer element, but this is useless in the current code.  It used
to be a check against mixer->id_elems[unitid] but it was changed later
to the value after mixer_eleme_list_to_info() which is always non-NULL
due to the container_of() usage.

This patch fixes the check before the conversion.

While we're at it, correct a typo in the comment in the function,
too.

Fixes: 8c558076c740 ("ALSA: usb-audio: Clean up mixer element list traverse")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/mixer_quirks.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 198515f86fcc..9646513f4b4a 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -1168,17 +1168,17 @@ void snd_emuusb_set_samplerate(struct snd_usb_audio *chip,
 {
 	struct usb_mixer_interface *mixer;
 	struct usb_mixer_elem_info *cval;
-	int unitid = 12; /* SamleRate ExtensionUnit ID */
+	int unitid = 12; /* SampleRate ExtensionUnit ID */
 
 	list_for_each_entry(mixer, &chip->mixer_list, list) {
-		cval = mixer_elem_list_to_info(mixer->id_elems[unitid]);
-		if (cval) {
+		if (mixer->id_elems[unitid]) {
+			cval = mixer_elem_list_to_info(mixer->id_elems[unitid]);
 			snd_usb_mixer_set_ctl_value(cval, UAC_SET_CUR,
 						    cval->control << 8,
 						    samplerate_id);
 			snd_usb_mixer_notify_id(mixer, unitid);
+			break;
 		}
-		break;
 	}
 }
 

From 81db84e5e1baeaa1b99b25380336456a33bcd062 Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Tue, 30 Jun 2020 16:26:28 -0400
Subject: [PATCH 0133/2658] Linux 4.4.229

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 8ae4d986fd21..4a2080506d51 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 228
+SUBLEVEL = 229
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From f66813736aebb6a014d38dc6d4b2807bc0da1db2 Mon Sep 17 00:00:00 2001
From: Anand Jain <Anand.Jain@oracle.com>
Date: Thu, 15 Feb 2018 12:29:38 +0800
Subject: [PATCH 0134/2658] btrfs: cow_file_range() num_bytes and
 disk_num_bytes are same

[ Upstream commit 3752d22fcea160cc2493e34f5e0e41cdd7fdd921 ]

This patch deletes local variable disk_num_bytes as its value
is same as num_bytes in the function cow_file_range().

Signed-off-by: Anand Jain <anand.jain@oracle.com>
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/inode.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 972475eeb2dd..ef8ed0cd8075 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -926,7 +926,6 @@ static noinline int cow_file_range(struct inode *inode,
 	u64 alloc_hint = 0;
 	u64 num_bytes;
 	unsigned long ram_size;
-	u64 disk_num_bytes;
 	u64 cur_alloc_size;
 	u64 blocksize = root->sectorsize;
 	struct btrfs_key ins;
@@ -942,7 +941,6 @@ static noinline int cow_file_range(struct inode *inode,
 
 	num_bytes = ALIGN(end - start + 1, blocksize);
 	num_bytes = max(blocksize,  num_bytes);
-	disk_num_bytes = num_bytes;
 
 	/* if this is a small write inside eof, kick off defrag */
 	if (num_bytes < 64 * 1024 &&
@@ -969,16 +967,15 @@ static noinline int cow_file_range(struct inode *inode,
 		}
 	}
 
-	BUG_ON(disk_num_bytes >
-	       btrfs_super_total_bytes(root->fs_info->super_copy));
+	BUG_ON(num_bytes > btrfs_super_total_bytes(root->fs_info->super_copy));
 
 	alloc_hint = get_extent_allocation_hint(inode, start, num_bytes);
 	btrfs_drop_extent_cache(inode, start, start + num_bytes - 1, 0);
 
-	while (disk_num_bytes > 0) {
+	while (num_bytes > 0) {
 		unsigned long op;
 
-		cur_alloc_size = disk_num_bytes;
+		cur_alloc_size = num_bytes;
 		ret = btrfs_reserve_extent(root, cur_alloc_size,
 					   root->sectorsize, 0, alloc_hint,
 					   &ins, 1, 1);
@@ -1033,7 +1030,7 @@ static noinline int cow_file_range(struct inode *inode,
 				goto out_drop_extent_cache;
 		}
 
-		if (disk_num_bytes < cur_alloc_size)
+		if (num_bytes < cur_alloc_size)
 			break;
 
 		/* we're not doing compressed IO, don't unlock the first
@@ -1050,8 +1047,10 @@ static noinline int cow_file_range(struct inode *inode,
 					     start + ram_size - 1, locked_page,
 					     EXTENT_LOCKED | EXTENT_DELALLOC,
 					     op);
-		disk_num_bytes -= cur_alloc_size;
-		num_bytes -= cur_alloc_size;
+		if (num_bytes < cur_alloc_size)
+			num_bytes = 0;
+		else
+			num_bytes -= cur_alloc_size;
 		alloc_hint = ins.objectid + ins.offset;
 		start += cur_alloc_size;
 	}

From 9f6fb9a60a466d389e70d31ae3ed8a7de9077449 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Mon, 8 Jun 2020 13:32:55 +0100
Subject: [PATCH 0135/2658] btrfs: fix data block group relocation failure due
 to concurrent scrub

[ Upstream commit 432cd2a10f1c10cead91fe706ff5dc52f06d642a ]

When running relocation of a data block group while scrub is running in
parallel, it is possible that the relocation will fail and abort the
current transaction with an -EINVAL error:

   [134243.988595] BTRFS info (device sdc): found 14 extents, stage: move data extents
   [134243.999871] ------------[ cut here ]------------
   [134244.000741] BTRFS: Transaction aborted (error -22)
   [134244.001692] WARNING: CPU: 0 PID: 26954 at fs/btrfs/ctree.c:1071 __btrfs_cow_block+0x6a7/0x790 [btrfs]
   [134244.003380] Modules linked in: btrfs blake2b_generic xor raid6_pq (...)
   [134244.012577] CPU: 0 PID: 26954 Comm: btrfs Tainted: G        W         5.6.0-rc7-btrfs-next-58 #5
   [134244.014162] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
   [134244.016184] RIP: 0010:__btrfs_cow_block+0x6a7/0x790 [btrfs]
   [134244.017151] Code: 48 c7 c7 (...)
   [134244.020549] RSP: 0018:ffffa41607863888 EFLAGS: 00010286
   [134244.021515] RAX: 0000000000000000 RBX: ffff9614bdfe09c8 RCX: 0000000000000000
   [134244.022822] RDX: 0000000000000001 RSI: ffffffffb3d63980 RDI: 0000000000000001
   [134244.024124] RBP: ffff961589e8c000 R08: 0000000000000000 R09: 0000000000000001
   [134244.025424] R10: ffffffffc0ae5955 R11: 0000000000000000 R12: ffff9614bd530d08
   [134244.026725] R13: ffff9614ced41b88 R14: ffff9614bdfe2a48 R15: 0000000000000000
   [134244.028024] FS:  00007f29b63c08c0(0000) GS:ffff9615ba600000(0000) knlGS:0000000000000000
   [134244.029491] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
   [134244.030560] CR2: 00007f4eb339b000 CR3: 0000000130d6e006 CR4: 00000000003606f0
   [134244.031997] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
   [134244.033153] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
   [134244.034484] Call Trace:
   [134244.034984]  btrfs_cow_block+0x12b/0x2b0 [btrfs]
   [134244.035859]  do_relocation+0x30b/0x790 [btrfs]
   [134244.036681]  ? do_raw_spin_unlock+0x49/0xc0
   [134244.037460]  ? _raw_spin_unlock+0x29/0x40
   [134244.038235]  relocate_tree_blocks+0x37b/0x730 [btrfs]
   [134244.039245]  relocate_block_group+0x388/0x770 [btrfs]
   [134244.040228]  btrfs_relocate_block_group+0x161/0x2e0 [btrfs]
   [134244.041323]  btrfs_relocate_chunk+0x36/0x110 [btrfs]
   [134244.041345]  btrfs_balance+0xc06/0x1860 [btrfs]
   [134244.043382]  ? btrfs_ioctl_balance+0x27c/0x310 [btrfs]
   [134244.045586]  btrfs_ioctl_balance+0x1ed/0x310 [btrfs]
   [134244.045611]  btrfs_ioctl+0x1880/0x3760 [btrfs]
   [134244.049043]  ? do_raw_spin_unlock+0x49/0xc0
   [134244.049838]  ? _raw_spin_unlock+0x29/0x40
   [134244.050587]  ? __handle_mm_fault+0x11b3/0x14b0
   [134244.051417]  ? ksys_ioctl+0x92/0xb0
   [134244.052070]  ksys_ioctl+0x92/0xb0
   [134244.052701]  ? trace_hardirqs_off_thunk+0x1a/0x1c
   [134244.053511]  __x64_sys_ioctl+0x16/0x20
   [134244.054206]  do_syscall_64+0x5c/0x280
   [134244.054891]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
   [134244.055819] RIP: 0033:0x7f29b51c9dd7
   [134244.056491] Code: 00 00 00 (...)
   [134244.059767] RSP: 002b:00007ffcccc1dd08 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
   [134244.061168] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f29b51c9dd7
   [134244.062474] RDX: 00007ffcccc1dda0 RSI: 00000000c4009420 RDI: 0000000000000003
   [134244.063771] RBP: 0000000000000003 R08: 00005565cea4b000 R09: 0000000000000000
   [134244.065032] R10: 0000000000000541 R11: 0000000000000202 R12: 00007ffcccc2060a
   [134244.066327] R13: 00007ffcccc1dda0 R14: 0000000000000002 R15: 00007ffcccc1dec0
   [134244.067626] irq event stamp: 0
   [134244.068202] hardirqs last  enabled at (0): [<0000000000000000>] 0x0
   [134244.069351] hardirqs last disabled at (0): [<ffffffffb2abdedf>] copy_process+0x74f/0x2020
   [134244.070909] softirqs last  enabled at (0): [<ffffffffb2abdedf>] copy_process+0x74f/0x2020
   [134244.072392] softirqs last disabled at (0): [<0000000000000000>] 0x0
   [134244.073432] ---[ end trace bd7c03622e0b0a99 ]---

The -EINVAL error comes from the following chain of function calls:

  __btrfs_cow_block() <-- aborts the transaction
    btrfs_reloc_cow_block()
      replace_file_extents()
        get_new_location() <-- returns -EINVAL

When relocating a data block group, for each allocated extent of the block
group, we preallocate another extent (at prealloc_file_extent_cluster()),
associated with the data relocation inode, and then dirty all its pages.
These preallocated extents have, and must have, the same size that extents
from the data block group being relocated have.

Later before we start the relocation stage that updates pointers (bytenr
field of file extent items) to point to the the new extents, we trigger
writeback for the data relocation inode. The expectation is that writeback
will write the pages to the previously preallocated extents, that it
follows the NOCOW path. That is generally the case, however, if a scrub
is running it may have turned the block group that contains those extents
into RO mode, in which case writeback falls back to the COW path.

However in the COW path instead of allocating exactly one extent with the
expected size, the allocator may end up allocating several smaller extents
due to free space fragmentation - because we tell it at cow_file_range()
that the minimum allocation size can match the filesystem's sector size.
This later breaks the relocation's expectation that an extent associated
to a file extent item in the data relocation inode has the same size as
the respective extent pointed by a file extent item in another tree - in
this case the extent to which the relocation inode poins to is smaller,
causing relocation.c:get_new_location() to return -EINVAL.

For example, if we are relocating a data block group X that has a logical
address of X and the block group has an extent allocated at the logical
address X + 128KiB with a size of 64KiB:

1) At prealloc_file_extent_cluster() we allocate an extent for the data
   relocation inode with a size of 64KiB and associate it to the file
   offset 128KiB (X + 128KiB - X) of the data relocation inode. This
   preallocated extent was allocated at block group Z;

2) A scrub running in parallel turns block group Z into RO mode and
   starts scrubing its extents;

3) Relocation triggers writeback for the data relocation inode;

4) When running delalloc (btrfs_run_delalloc_range()), we try first the
   NOCOW path because the data relocation inode has BTRFS_INODE_PREALLOC
   set in its flags. However, because block group Z is in RO mode, the
   NOCOW path (run_delalloc_nocow()) falls back into the COW path, by
   calling cow_file_range();

5) At cow_file_range(), in the first iteration of the while loop we call
   btrfs_reserve_extent() to allocate a 64KiB extent and pass it a minimum
   allocation size of 4KiB (fs_info->sectorsize). Due to free space
   fragmentation, btrfs_reserve_extent() ends up allocating two extents
   of 32KiB each, each one on a different iteration of that while loop;

6) Writeback of the data relocation inode completes;

7) Relocation proceeds and ends up at relocation.c:replace_file_extents(),
   with a leaf which has a file extent item that points to the data extent
   from block group X, that has a logical address (bytenr) of X + 128KiB
   and a size of 64KiB. Then it calls get_new_location(), which does a
   lookup in the data relocation tree for a file extent item starting at
   offset 128KiB (X + 128KiB - X) and belonging to the data relocation
   inode. It finds a corresponding file extent item, however that item
   points to an extent that has a size of 32KiB, which doesn't match the
   expected size of 64KiB, resuling in -EINVAL being returned from this
   function and propagated up to __btrfs_cow_block(), which aborts the
   current transaction.

To fix this make sure that at cow_file_range() when we call the allocator
we pass it a minimum allocation size corresponding the desired extent size
if the inode belongs to the data relocation tree, otherwise pass it the
filesystem's sector size as the minimum allocation size.

CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/inode.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index ef8ed0cd8075..b1125778b908 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -926,6 +926,7 @@ static noinline int cow_file_range(struct inode *inode,
 	u64 alloc_hint = 0;
 	u64 num_bytes;
 	unsigned long ram_size;
+	u64 min_alloc_size;
 	u64 cur_alloc_size;
 	u64 blocksize = root->sectorsize;
 	struct btrfs_key ins;
@@ -972,12 +973,28 @@ static noinline int cow_file_range(struct inode *inode,
 	alloc_hint = get_extent_allocation_hint(inode, start, num_bytes);
 	btrfs_drop_extent_cache(inode, start, start + num_bytes - 1, 0);
 
+	/*
+	 * Relocation relies on the relocated extents to have exactly the same
+	 * size as the original extents. Normally writeback for relocation data
+	 * extents follows a NOCOW path because relocation preallocates the
+	 * extents. However, due to an operation such as scrub turning a block
+	 * group to RO mode, it may fallback to COW mode, so we must make sure
+	 * an extent allocated during COW has exactly the requested size and can
+	 * not be split into smaller extents, otherwise relocation breaks and
+	 * fails during the stage where it updates the bytenr of file extent
+	 * items.
+	 */
+	if (root->root_key.objectid == BTRFS_DATA_RELOC_TREE_OBJECTID)
+		min_alloc_size = num_bytes;
+	else
+		min_alloc_size = root->sectorsize;
+
 	while (num_bytes > 0) {
 		unsigned long op;
 
 		cur_alloc_size = num_bytes;
 		ret = btrfs_reserve_extent(root, cur_alloc_size,
-					   root->sectorsize, 0, alloc_hint,
+					   min_alloc_size, 0, alloc_hint,
 					   &ins, 1, 1);
 		if (ret < 0)
 			goto out_unlock;

From e0824b9e6114278f80e101b46feb67628f6bb88c Mon Sep 17 00:00:00 2001
From: Hugh Dickins <hughd@google.com>
Date: Thu, 25 Jun 2020 20:29:59 -0700
Subject: [PATCH 0136/2658] mm: fix swap cache node allocation mask

[ Upstream commit 243bce09c91b0145aeaedd5afba799d81841c030 ]

Chris Murphy reports that a slightly overcommitted load, testing swap
and zram along with i915, splats and keeps on splatting, when it had
better fail less noisily:

  gnome-shell: page allocation failure: order:0,
  mode:0x400d0(__GFP_IO|__GFP_FS|__GFP_COMP|__GFP_RECLAIMABLE),
  nodemask=(null),cpuset=/,mems_allowed=0
  CPU: 2 PID: 1155 Comm: gnome-shell Not tainted 5.7.0-1.fc33.x86_64 #1
  Call Trace:
    dump_stack+0x64/0x88
    warn_alloc.cold+0x75/0xd9
    __alloc_pages_slowpath.constprop.0+0xcfa/0xd30
    __alloc_pages_nodemask+0x2df/0x320
    alloc_slab_page+0x195/0x310
    allocate_slab+0x3c5/0x440
    ___slab_alloc+0x40c/0x5f0
    __slab_alloc+0x1c/0x30
    kmem_cache_alloc+0x20e/0x220
    xas_nomem+0x28/0x70
    add_to_swap_cache+0x321/0x400
    __read_swap_cache_async+0x105/0x240
    swap_cluster_readahead+0x22c/0x2e0
    shmem_swapin+0x8e/0xc0
    shmem_swapin_page+0x196/0x740
    shmem_getpage_gfp+0x3a2/0xa60
    shmem_read_mapping_page_gfp+0x32/0x60
    shmem_get_pages+0x155/0x5e0 [i915]
    __i915_gem_object_get_pages+0x68/0xa0 [i915]
    i915_vma_pin+0x3fe/0x6c0 [i915]
    eb_add_vma+0x10b/0x2c0 [i915]
    i915_gem_do_execbuffer+0x704/0x3430 [i915]
    i915_gem_execbuffer2_ioctl+0x1ea/0x3e0 [i915]
    drm_ioctl_kernel+0x86/0xd0 [drm]
    drm_ioctl+0x206/0x390 [drm]
    ksys_ioctl+0x82/0xc0
    __x64_sys_ioctl+0x16/0x20
    do_syscall_64+0x5b/0xf0
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported on 5.7, but it goes back really to 3.1: when
shmem_read_mapping_page_gfp() was implemented for use by i915, and
allowed for __GFP_NORETRY and __GFP_NOWARN flags in most places, but
missed swapin's "& GFP_KERNEL" mask for page tree node allocation in
__read_swap_cache_async() - that was to mask off HIGHUSER_MOVABLE bits
from what page cache uses, but GFP_RECLAIM_MASK is now what's needed.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=208085
Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2006151330070.11064@eggly.anvils
Fixes: 68da9f055755 ("tmpfs: pass gfp to shmem_getpage_gfp")
Signed-off-by: Hugh Dickins <hughd@google.com>
Reviewed-by: Vlastimil Babka <vbabka@suse.cz>
Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reported-by: Chris Murphy <lists@colorremedies.com>
Analyzed-by: Vlastimil Babka <vbabka@suse.cz>
Analyzed-by: Matthew Wilcox <willy@infradead.org>
Tested-by: Chris Murphy <lists@colorremedies.com>
Cc: <stable@vger.kernel.org>	[3.1+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/swap_state.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/swap_state.c b/mm/swap_state.c
index 61039e39e25f..0652f7737f5c 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -19,6 +19,7 @@
 #include <linux/migrate.h>
 
 #include <asm/pgtable.h>
+#include "internal.h"
 
 /*
  * swapper_space is a fiction, retained to simplify the path through
@@ -321,7 +322,7 @@ struct page *__read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask,
 		/*
 		 * call radix_tree_preload() while we can wait.
 		 */
-		err = radix_tree_maybe_preload(gfp_mask & GFP_KERNEL);
+		err = radix_tree_maybe_preload(gfp_mask & GFP_RECLAIM_MASK);
 		if (err)
 			break;
 

From c85b0a8ecd1c779263f210cd4e70d9b02b48e638 Mon Sep 17 00:00:00 2001
From: Borislav Petkov <bp@suse.de>
Date: Thu, 18 Jun 2020 20:25:25 +0200
Subject: [PATCH 0137/2658] EDAC/amd64: Read back the scrub rate PCI register
 on F15h

[ Upstream commit ee470bb25d0dcdf126f586ec0ae6dca66cb340a4 ]

Commit:

  da92110dfdfa ("EDAC, amd64_edac: Extend scrub rate support to F15hM60h")

added support for F15h, model 0x60 CPUs but in doing so, missed to read
back SCRCTRL PCI config register on F15h CPUs which are *not* model
0x60. Add that read so that doing

  $ cat /sys/devices/system/edac/mc/mc0/sdram_scrub_rate

can show the previously set DRAM scrub rate.

Fixes: da92110dfdfa ("EDAC, amd64_edac: Extend scrub rate support to F15hM60h")
Reported-by: Anders Andersson <pipatron@gmail.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: <stable@vger.kernel.org> #v4.4..
Link: https://lkml.kernel.org/r/CAKkunMbNWppx_i6xSdDHLseA2QQmGJqj_crY=NF-GZML5np4Vw@mail.gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/edac/amd64_edac.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 932ba7676183..5f86075e34da 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -248,6 +248,8 @@ static int get_scrub_rate(struct mem_ctl_info *mci)
 
 		if (pvt->model == 0x60)
 			amd64_read_pci_cfg(pvt->F2, F15H_M60H_SCRCTRL, &scrubval);
+		else
+			amd64_read_pci_cfg(pvt->F3, SCRCTRL, &scrubval);
 	} else
 		amd64_read_pci_cfg(pvt->F3, SCRCTRL, &scrubval);
 

From d922e0f79a25737d39543d2f8e06c810445b8d30 Mon Sep 17 00:00:00 2001
From: Qian Cai <cai@lca.pw>
Date: Mon, 1 Jun 2020 21:45:57 -0700
Subject: [PATCH 0138/2658] mm/slub: fix stack overruns with SLUB_STATS

[ Upstream commit a68ee0573991e90af2f1785db309206408bad3e5 ]

There is no need to copy SLUB_STATS items from root memcg cache to new
memcg cache copies.  Doing so could result in stack overruns because the
store function only accepts 0 to clear the stat and returns an error for
everything else while the show method would print out the whole stat.

Then, the mismatch of the lengths returns from show and store methods
happens in memcg_propagate_slab_attrs():

	else if (root_cache->max_attr_size < ARRAY_SIZE(mbuf))
		buf = mbuf;

max_attr_size is only 2 from slab_attr_store(), then, it uses mbuf[64]
in show_stat() later where a bounch of sprintf() would overrun the stack
variable.  Fix it by always allocating a page of buffer to be used in
show_stat() if SLUB_STATS=y which should only be used for debug purpose.

  # echo 1 > /sys/kernel/slab/fs_cache/shrink
  BUG: KASAN: stack-out-of-bounds in number+0x421/0x6e0
  Write of size 1 at addr ffffc900256cfde0 by task kworker/76:0/53251

  Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 07/10/2019
  Workqueue: memcg_kmem_cache memcg_kmem_cache_create_func
  Call Trace:
    number+0x421/0x6e0
    vsnprintf+0x451/0x8e0
    sprintf+0x9e/0xd0
    show_stat+0x124/0x1d0
    alloc_slowpath_show+0x13/0x20
    __kmem_cache_create+0x47a/0x6b0

  addr ffffc900256cfde0 is located in stack of task kworker/76:0/53251 at offset 0 in frame:
   process_one_work+0x0/0xb90

  this frame has 1 object:
   [32, 72) 'lockdep_map'

  Memory state around the buggy address:
   ffffc900256cfc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   ffffc900256cfd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  >ffffc900256cfd80: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
                                                         ^
   ffffc900256cfe00: 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00 00
   ffffc900256cfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ==================================================================
  Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: __kmem_cache_create+0x6ac/0x6b0
  Workqueue: memcg_kmem_cache memcg_kmem_cache_create_func
  Call Trace:
    __kmem_cache_create+0x6ac/0x6b0

Fixes: 107dab5c92d5 ("slub: slub-specific propagation changes")
Signed-off-by: Qian Cai <cai@lca.pw>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Glauber Costa <glauber@scylladb.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Link: http://lkml.kernel.org/r/20200429222356.4322-1-cai@lca.pw
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/slub.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/slub.c b/mm/slub.c
index 7de235dd989c..b80b74173782 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5496,7 +5496,8 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s)
 		 */
 		if (buffer)
 			buf = buffer;
-		else if (root_cache->max_attr_size < ARRAY_SIZE(mbuf))
+		else if (root_cache->max_attr_size < ARRAY_SIZE(mbuf) &&
+			 !IS_ENABLED(CONFIG_SLUB_STATS))
 			buf = mbuf;
 		else {
 			buffer = (char *) get_zeroed_page(GFP_KERNEL);

From f56b2bb729d25b5f889608b9c2e0158d1ecf785a Mon Sep 17 00:00:00 2001
From: Zqiang <qiang.zhang@windriver.com>
Date: Fri, 12 Jun 2020 11:52:10 +0800
Subject: [PATCH 0139/2658] usb: usbtest: fix missing kfree(dev->buf) in
 usbtest_disconnect

[ Upstream commit 28ebeb8db77035e058a510ce9bd17c2b9a009dba ]

BUG: memory leak
unreferenced object 0xffff888055046e00 (size 256):
  comm "kworker/2:9", pid 2570, jiffies 4294942129 (age 1095.500s)
  hex dump (first 32 bytes):
    00 70 04 55 80 88 ff ff 18 bb 5a 81 ff ff ff ff  .p.U......Z.....
    f5 96 78 81 ff ff ff ff 37 de 8e 81 ff ff ff ff  ..x.....7.......
  backtrace:
    [<00000000d121dccf>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
    [<00000000d121dccf>] slab_post_alloc_hook mm/slab.h:586 [inline]
    [<00000000d121dccf>] slab_alloc_node mm/slub.c:2786 [inline]
    [<00000000d121dccf>] slab_alloc mm/slub.c:2794 [inline]
    [<00000000d121dccf>] kmem_cache_alloc_trace+0x15e/0x2d0 mm/slub.c:2811
    [<000000005c3c3381>] kmalloc include/linux/slab.h:555 [inline]
    [<000000005c3c3381>] usbtest_probe+0x286/0x19d0
drivers/usb/misc/usbtest.c:2790
    [<000000001cec6910>] usb_probe_interface+0x2bd/0x870
drivers/usb/core/driver.c:361
    [<000000007806c118>] really_probe+0x48d/0x8f0 drivers/base/dd.c:551
    [<00000000a3308c3e>] driver_probe_device+0xfc/0x2a0 drivers/base/dd.c:724
    [<000000003ef66004>] __device_attach_driver+0x1b6/0x240
drivers/base/dd.c:831
    [<00000000eee53e97>] bus_for_each_drv+0x14e/0x1e0 drivers/base/bus.c:431
    [<00000000bb0648d0>] __device_attach+0x1f9/0x350 drivers/base/dd.c:897
    [<00000000838b324a>] device_initial_probe+0x1a/0x20 drivers/base/dd.c:944
    [<0000000030d501c1>] bus_probe_device+0x1e1/0x280 drivers/base/bus.c:491
    [<000000005bd7adef>] device_add+0x131d/0x1c40 drivers/base/core.c:2504
    [<00000000a0937814>] usb_set_configuration+0xe84/0x1ab0
drivers/usb/core/message.c:2030
    [<00000000e3934741>] generic_probe+0x6a/0xe0 drivers/usb/core/generic.c:210
    [<0000000098ade0f1>] usb_probe_device+0x90/0xd0
drivers/usb/core/driver.c:266
    [<000000007806c118>] really_probe+0x48d/0x8f0 drivers/base/dd.c:551
    [<00000000a3308c3e>] driver_probe_device+0xfc/0x2a0 drivers/base/dd.c:724

Acked-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Kyungtae Kim <kt0755@gmail.com>
Signed-off-by: Zqiang <qiang.zhang@windriver.com>
Link: https://lore.kernel.org/r/20200612035210.20494-1-qiang.zhang@windriver.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/misc/usbtest.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index bc92a498ec03..9f19aa950bb1 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -2703,6 +2703,7 @@ static void usbtest_disconnect(struct usb_interface *intf)
 
 	usb_set_intfdata(intf, NULL);
 	dev_dbg(&intf->dev, "disconnect\n");
+	kfree(dev->buf);
 	kfree(dev);
 }
 

From 970aa87cc27d1c24762e09786742a8bf30e8a956 Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Tue, 2 Jun 2020 15:47:39 -0700
Subject: [PATCH 0140/2658] kgdb: Avoid suspicious RCU usage warning

[ Upstream commit 440ab9e10e2e6e5fd677473ee6f9e3af0f6904d6 ]

At times when I'm using kgdb I see a splat on my console about
suspicious RCU usage.  I managed to come up with a case that could
reproduce this that looked like this:

  WARNING: suspicious RCU usage
  5.7.0-rc4+ #609 Not tainted
  -----------------------------
  kernel/pid.c:395 find_task_by_pid_ns() needs rcu_read_lock() protection!

  other info that might help us debug this:

    rcu_scheduler_active = 2, debug_locks = 1
  3 locks held by swapper/0/1:
   #0: ffffff81b6b8e988 (&dev->mutex){....}-{3:3}, at: __device_attach+0x40/0x13c
   #1: ffffffd01109e9e8 (dbg_master_lock){....}-{2:2}, at: kgdb_cpu_enter+0x20c/0x7ac
   #2: ffffffd01109ea90 (dbg_slave_lock){....}-{2:2}, at: kgdb_cpu_enter+0x3ec/0x7ac

  stack backtrace:
  CPU: 7 PID: 1 Comm: swapper/0 Not tainted 5.7.0-rc4+ #609
  Hardware name: Google Cheza (rev3+) (DT)
  Call trace:
   dump_backtrace+0x0/0x1b8
   show_stack+0x1c/0x24
   dump_stack+0xd4/0x134
   lockdep_rcu_suspicious+0xf0/0x100
   find_task_by_pid_ns+0x5c/0x80
   getthread+0x8c/0xb0
   gdb_serial_stub+0x9d4/0xd04
   kgdb_cpu_enter+0x284/0x7ac
   kgdb_handle_exception+0x174/0x20c
   kgdb_brk_fn+0x24/0x30
   call_break_hook+0x6c/0x7c
   brk_handler+0x20/0x5c
   do_debug_exception+0x1c8/0x22c
   el1_sync_handler+0x3c/0xe4
   el1_sync+0x7c/0x100
   rpmh_rsc_probe+0x38/0x420
   platform_drv_probe+0x94/0xb4
   really_probe+0x134/0x300
   driver_probe_device+0x68/0x100
   __device_attach_driver+0x90/0xa8
   bus_for_each_drv+0x84/0xcc
   __device_attach+0xb4/0x13c
   device_initial_probe+0x18/0x20
   bus_probe_device+0x38/0x98
   device_add+0x38c/0x420

If I understand properly we should just be able to blanket kgdb under
one big RCU read lock and the problem should go away.  We'll add it to
the beast-of-a-function known as kgdb_cpu_enter().

With this I no longer get any splats and things seem to work fine.

Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20200602154729.v2.1.I70e0d4fd46d5ed2aaf0c98a355e8e1b7a5bb7e4e@changeid
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/debug/debug_core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
index 9c939c6bf21c..321ccdbb7364 100644
--- a/kernel/debug/debug_core.c
+++ b/kernel/debug/debug_core.c
@@ -488,6 +488,7 @@ static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs,
 		arch_kgdb_ops.disable_hw_break(regs);
 
 acquirelock:
+	rcu_read_lock();
 	/*
 	 * Interrupts will be restored by the 'trap return' code, except when
 	 * single stepping.
@@ -542,6 +543,7 @@ static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs,
 			atomic_dec(&slaves_in_kgdb);
 			dbg_touch_watchdogs();
 			local_irq_restore(flags);
+			rcu_read_unlock();
 			return 0;
 		}
 		cpu_relax();
@@ -560,6 +562,7 @@ static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs,
 		raw_spin_unlock(&dbg_master_lock);
 		dbg_touch_watchdogs();
 		local_irq_restore(flags);
+		rcu_read_unlock();
 
 		goto acquirelock;
 	}
@@ -677,6 +680,7 @@ static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs,
 	raw_spin_unlock(&dbg_master_lock);
 	dbg_touch_watchdogs();
 	local_irq_restore(flags);
+	rcu_read_unlock();
 
 	return kgdb_info[cpu].ret_state;
 }

From 12597daf26e2260db6c205a38a30687219fafca8 Mon Sep 17 00:00:00 2001
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Mon, 8 Jun 2020 16:48:43 +1000
Subject: [PATCH 0141/2658] crypto: af_alg - fix use-after-free in
 af_alg_accept() due to bh_lock_sock()

commit 34c86f4c4a7be3b3e35aa48bd18299d4c756064d upstream.

The locking in af_alg_release_parent is broken as the BH socket
lock can only be taken if there is a code-path to handle the case
where the lock is owned by process-context.  Instead of adding
such handling, we can fix this by changing the ref counts to
atomic_t.

This patch also modifies the main refcnt to include both normal
and nokey sockets.  This way we don't have to fudge the nokey
ref count when a socket changes from nokey to normal.

Credits go to Mauricio Faria de Oliveira who diagnosed this bug
and sent a patch for it:

https://lore.kernel.org/linux-crypto/20200605161657.535043-1-mfo@canonical.com/

Reported-by: Brian Moyles <bmoyles@netflix.com>
Reported-by: Mauricio Faria de Oliveira <mfo@canonical.com>
Fixes: 37f96694cf73 ("crypto: af_alg - Use bh_lock_sock in...")
Cc: <stable@vger.kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 crypto/af_alg.c         | 26 +++++++++++---------------
 crypto/algif_aead.c     |  9 +++------
 crypto/algif_hash.c     |  9 +++------
 crypto/algif_skcipher.c |  9 +++------
 include/crypto/if_alg.h |  4 ++--
 5 files changed, 22 insertions(+), 35 deletions(-)

diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index cf3975ee4fd8..c48ddeb6c328 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -130,21 +130,15 @@ EXPORT_SYMBOL_GPL(af_alg_release);
 void af_alg_release_parent(struct sock *sk)
 {
 	struct alg_sock *ask = alg_sk(sk);
-	unsigned int nokey = ask->nokey_refcnt;
-	bool last = nokey && !ask->refcnt;
+	unsigned int nokey = atomic_read(&ask->nokey_refcnt);
 
 	sk = ask->parent;
 	ask = alg_sk(sk);
 
-	local_bh_disable();
-	bh_lock_sock(sk);
-	ask->nokey_refcnt -= nokey;
-	if (!last)
-		last = !--ask->refcnt;
-	bh_unlock_sock(sk);
-	local_bh_enable();
+	if (nokey)
+		atomic_dec(&ask->nokey_refcnt);
 
-	if (last)
+	if (atomic_dec_and_test(&ask->refcnt))
 		sock_put(sk);
 }
 EXPORT_SYMBOL_GPL(af_alg_release_parent);
@@ -189,7 +183,7 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 
 	err = -EBUSY;
 	lock_sock(sk);
-	if (ask->refcnt | ask->nokey_refcnt)
+	if (atomic_read(&ask->refcnt))
 		goto unlock;
 
 	swap(ask->type, type);
@@ -238,7 +232,7 @@ static int alg_setsockopt(struct socket *sock, int level, int optname,
 	int err = -EBUSY;
 
 	lock_sock(sk);
-	if (ask->refcnt)
+	if (atomic_read(&ask->refcnt) != atomic_read(&ask->nokey_refcnt))
 		goto unlock;
 
 	type = ask->type;
@@ -305,12 +299,14 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
 
 	sk2->sk_family = PF_ALG;
 
-	if (nokey || !ask->refcnt++)
+	if (atomic_inc_return_relaxed(&ask->refcnt) == 1)
 		sock_hold(sk);
-	ask->nokey_refcnt += nokey;
+	if (nokey) {
+		atomic_inc(&ask->nokey_refcnt);
+		atomic_set(&alg_sk(sk2)->nokey_refcnt, 1);
+	}
 	alg_sk(sk2)->parent = sk;
 	alg_sk(sk2)->type = type;
-	alg_sk(sk2)->nokey_refcnt = nokey;
 
 	newsock->ops = type->ops;
 	newsock->state = SS_CONNECTED;
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index faea9d728fd2..c50175ad5485 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -528,7 +528,7 @@ static int aead_check_key(struct socket *sock)
 	struct alg_sock *ask = alg_sk(sk);
 
 	lock_sock(sk);
-	if (ask->refcnt)
+	if (!atomic_read(&ask->nokey_refcnt))
 		goto unlock_child;
 
 	psk = ask->parent;
@@ -540,11 +540,8 @@ static int aead_check_key(struct socket *sock)
 	if (!tfm->has_key)
 		goto unlock;
 
-	if (!pask->refcnt++)
-		sock_hold(psk);
-
-	ask->refcnt = 1;
-	sock_put(psk);
+	atomic_dec(&pask->nokey_refcnt);
+	atomic_set(&ask->nokey_refcnt, 0);
 
 	err = 0;
 
diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
index 8d8b3eeba725..fd23261f1d16 100644
--- a/crypto/algif_hash.c
+++ b/crypto/algif_hash.c
@@ -252,7 +252,7 @@ static int hash_check_key(struct socket *sock)
 	struct alg_sock *ask = alg_sk(sk);
 
 	lock_sock(sk);
-	if (ask->refcnt)
+	if (!atomic_read(&ask->nokey_refcnt))
 		goto unlock_child;
 
 	psk = ask->parent;
@@ -264,11 +264,8 @@ static int hash_check_key(struct socket *sock)
 	if (!tfm->has_key)
 		goto unlock;
 
-	if (!pask->refcnt++)
-		sock_hold(psk);
-
-	ask->refcnt = 1;
-	sock_put(psk);
+	atomic_dec(&pask->nokey_refcnt);
+	atomic_set(&ask->nokey_refcnt, 0);
 
 	err = 0;
 
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 9bd4691cc5c5..0e200bf5aa82 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -774,7 +774,7 @@ static int skcipher_check_key(struct socket *sock)
 	struct alg_sock *ask = alg_sk(sk);
 
 	lock_sock(sk);
-	if (ask->refcnt)
+	if (!atomic_read(&ask->nokey_refcnt))
 		goto unlock_child;
 
 	psk = ask->parent;
@@ -786,11 +786,8 @@ static int skcipher_check_key(struct socket *sock)
 	if (!tfm->has_key)
 		goto unlock;
 
-	if (!pask->refcnt++)
-		sock_hold(psk);
-
-	ask->refcnt = 1;
-	sock_put(psk);
+	atomic_dec(&pask->nokey_refcnt);
+	atomic_set(&ask->nokey_refcnt, 0);
 
 	err = 0;
 
diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
index a2bfd7843f18..4bb6b98782e9 100644
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -30,8 +30,8 @@ struct alg_sock {
 
 	struct sock *parent;
 
-	unsigned int refcnt;
-	unsigned int nokey_refcnt;
+	atomic_t refcnt;
+	atomic_t nokey_refcnt;
 
 	const struct af_alg_type *type;
 	void *private;

From cbd606bc1ac40e232fe3d7efaa8c24f814e2507c Mon Sep 17 00:00:00 2001
From: Shile Zhang <shile.zhang@nokia.com>
Date: Sat, 28 Jan 2017 22:00:49 +0800
Subject: [PATCH 0142/2658] sched/rt: Show the 'sched_rr_timeslice' SCHED_RR
 timeslice tuning knob in milliseconds

[ Upstream commit 975e155ed8732cb81f55c021c441ae662dd040b5 ]

We added the 'sched_rr_timeslice_ms' SCHED_RR tuning knob in this commit:

  ce0dbbbb30ae ("sched/rt: Add a tuning knob to allow changing SCHED_RR timeslice")

... which name suggests to users that it's in milliseconds, while in reality
it's being set in milliseconds but the result is shown in jiffies.

This is obviously confusing when HZ is not 1000, it makes it appear like the
value set failed, such as HZ=100:

  root# echo 100 > /proc/sys/kernel/sched_rr_timeslice_ms
  root# cat /proc/sys/kernel/sched_rr_timeslice_ms
  10

Fix this to be milliseconds all around.

Signed-off-by: Shile Zhang <shile.zhang@nokia.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1485612049-20923-1-git-send-email-shile.zhang@nokia.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/sched/sysctl.h | 1 +
 kernel/sched/core.c          | 5 +++--
 kernel/sched/rt.c            | 1 +
 kernel/sysctl.c              | 2 +-
 4 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h
index 786a9c3c75b5..130222b14c5d 100644
--- a/include/linux/sched/sysctl.h
+++ b/include/linux/sched/sysctl.h
@@ -155,6 +155,7 @@ static inline unsigned int get_sysctl_sched_cfs_boost(void)
 extern unsigned int sysctl_sched_autogroup_enabled;
 #endif
 
+extern int sysctl_sched_rr_timeslice;
 extern int sched_rr_timeslice;
 
 extern int sched_rr_handler(struct ctl_table *table, int write,
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 9a4c8618d79f..df5cdcdd99cd 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -9260,8 +9260,9 @@ int sched_rr_handler(struct ctl_table *table, int write,
 	/* make sure that internally we keep jiffies */
 	/* also, writing zero resets timeslice to default */
 	if (!ret && write) {
-		sched_rr_timeslice = sched_rr_timeslice <= 0 ?
-			RR_TIMESLICE : msecs_to_jiffies(sched_rr_timeslice);
+		sched_rr_timeslice =
+			sysctl_sched_rr_timeslice <= 0 ? RR_TIMESLICE :
+			msecs_to_jiffies(sysctl_sched_rr_timeslice);
 	}
 	mutex_unlock(&mutex);
 	return ret;
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index 3a86a83933d2..0e1c53d242f4 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -11,6 +11,7 @@
 #include <trace/events/sched.h>
 
 int sched_rr_timeslice = RR_TIMESLICE;
+int sysctl_sched_rr_timeslice = (MSEC_PER_SEC / HZ) * RR_TIMESLICE;
 
 static int do_sched_rt_period_timer(struct rt_bandwidth *rt_b, int overrun);
 
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 8e55607d378b..24645cb24f57 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -650,7 +650,7 @@ static struct ctl_table kern_table[] = {
 	},
 	{
 		.procname	= "sched_rr_timeslice_ms",
-		.data		= &sched_rr_timeslice,
+		.data		= &sysctl_sched_rr_timeslice,
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
 		.proc_handler	= sched_rr_handler,

From 3d8c180abbba999ad5c6c6e480143431bc12d34d Mon Sep 17 00:00:00 2001
From: Chu Lin <linchuyuan@google.com>
Date: Tue, 23 Jun 2020 22:13:08 +0000
Subject: [PATCH 0143/2658] hwmon: (max6697) Make sure the OVERT mask is set
 correctly

[ Upstream commit 016983d138cbe99a5c0aaae0103ee88f5300beb3 ]

Per the datasheet for max6697, OVERT mask and ALERT mask are different.
For example, the 7th bit of OVERT is the local channel but for alert
mask, the 6th bit is the local channel. Therefore, we can't apply the
same mask for both registers. In addition to that, the max6697 driver
is supposed to be compatibale with different models. I manually went over
all the listed chips and made sure all chip types have the same layout.

Testing;
    mask value of 0x9 should map to 0x44 for ALERT and 0x84 for OVERT.
    I used iotool to read the reg value back to verify. I only tested this
    change on max6581.

Reference:
https://datasheets.maximintegrated.com/en/ds/MAX6581.pdf
https://datasheets.maximintegrated.com/en/ds/MAX6697.pdf
https://datasheets.maximintegrated.com/en/ds/MAX6699.pdf

Signed-off-by: Chu Lin <linchuyuan@google.com>
Fixes: 5372d2d71c46e ("hwmon: Driver for Maxim MAX6697 and compatibles")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/max6697.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/hwmon/max6697.c b/drivers/hwmon/max6697.c
index f03a71722849..d4bb3d6aaf18 100644
--- a/drivers/hwmon/max6697.c
+++ b/drivers/hwmon/max6697.c
@@ -46,8 +46,9 @@ static const u8 MAX6697_REG_CRIT[] = {
  * Map device tree / platform data register bit map to chip bit map.
  * Applies to alert register and over-temperature register.
  */
-#define MAX6697_MAP_BITS(reg)	((((reg) & 0x7e) >> 1) | \
+#define MAX6697_ALERT_MAP_BITS(reg)	((((reg) & 0x7e) >> 1) | \
 				 (((reg) & 0x01) << 6) | ((reg) & 0x80))
+#define MAX6697_OVERT_MAP_BITS(reg) (((reg) >> 1) | (((reg) & 0x01) << 7))
 
 #define MAX6697_REG_STAT(n)		(0x44 + (n))
 
@@ -586,12 +587,12 @@ static int max6697_init_chip(struct max6697_data *data,
 		return ret;
 
 	ret = i2c_smbus_write_byte_data(client, MAX6697_REG_ALERT_MASK,
-					MAX6697_MAP_BITS(pdata->alert_mask));
+				MAX6697_ALERT_MAP_BITS(pdata->alert_mask));
 	if (ret < 0)
 		return ret;
 
 	ret = i2c_smbus_write_byte_data(client, MAX6697_REG_OVERT_MASK,
-				MAX6697_MAP_BITS(pdata->over_temperature_mask));
+			MAX6697_OVERT_MAP_BITS(pdata->over_temperature_mask));
 	if (ret < 0)
 		return ret;
 

From e7fd1093487cbc2056587fcca3091d6f8d06c890 Mon Sep 17 00:00:00 2001
From: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
Date: Thu, 25 Jun 2020 13:32:42 +0900
Subject: [PATCH 0144/2658] hwmon: (acpi_power_meter) Fix potential memory leak
 in acpi_power_meter_add()

[ Upstream commit 8b97f9922211c44a739c5cbd9502ecbb9f17f6d1 ]

Although it rarely happens, we should call free_capabilities()
if error happens after read_capabilities() to free allocated strings.

Fixes: de584afa5e188 ("hwmon driver for ACPI 4.0 power meters")
Signed-off-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
Link: https://lore.kernel.org/r/20200625043242.31175-1-misono.tomohiro@jp.fujitsu.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/acpi_power_meter.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
index e27f7e12c05b..9b4ad6c74041 100644
--- a/drivers/hwmon/acpi_power_meter.c
+++ b/drivers/hwmon/acpi_power_meter.c
@@ -895,7 +895,7 @@ static int acpi_power_meter_add(struct acpi_device *device)
 
 	res = setup_attrs(resource);
 	if (res)
-		goto exit_free;
+		goto exit_free_capability;
 
 	resource->hwmon_dev = hwmon_device_register(&device->dev);
 	if (IS_ERR(resource->hwmon_dev)) {
@@ -908,6 +908,8 @@ static int acpi_power_meter_add(struct acpi_device *device)
 
 exit_remove:
 	remove_attrs(resource);
+exit_free_capability:
+	free_capabilities(resource);
 exit_free:
 	kfree(resource);
 exit:

From 88a6057661529617b234c8fcbbaab280bc28e8da Mon Sep 17 00:00:00 2001
From: Hou Tao <houtao1@huawei.com>
Date: Mon, 15 Jun 2020 12:14:59 +0800
Subject: [PATCH 0145/2658] virtio-blk: free vblk-vqs in error path of
 virtblk_probe()

[ Upstream commit e7eea44eefbdd5f0345a0a8b80a3ca1c21030d06 ]

Else there will be memory leak if alloc_disk() fails.

Fixes: 6a27b656fc02 ("block: virtio-blk: support multi virt queues per virtio-blk device")
Signed-off-by: Hou Tao <houtao1@huawei.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/virtio_blk.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 1e5cd39d0cc2..bdc3efacd0d2 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -757,6 +757,7 @@ static int virtblk_probe(struct virtio_device *vdev)
 	put_disk(vblk->disk);
 out_free_vq:
 	vdev->config->del_vqs(vdev);
+	kfree(vblk->vqs);
 out_free_vblk:
 	kfree(vblk);
 out_free_index:

From 18e8b2711874acfca94e76925a3ed0bcac5a95c8 Mon Sep 17 00:00:00 2001
From: Chris Packham <chris.packham@alliedtelesis.co.nz>
Date: Thu, 2 Jul 2020 10:39:11 +1200
Subject: [PATCH 0146/2658] i2c: algo-pca: Add 0x78 as SCL stuck low status for
 PCA9665

[ Upstream commit cd217f2300793a106b49c7dfcbfb26e348bc7593 ]

The PCA9665 datasheet says that I2CSTA = 78h indicates that SCL is stuck
low, this differs to the PCA9564 which uses 90h for this indication.
Treat either 0x78 or 0x90 as an indication that the SCL line is stuck.

Based on looking through the PCA9564 and PCA9665 datasheets this should
be safe for both chips. The PCA9564 should not return 0x78 for any valid
state and the PCA9665 should not return 0x90.

Fixes: eff9ec95efaa ("i2c-algo-pca: Add PCA9665 support")
Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/algos/i2c-algo-pca.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c
index e370804ec8bc..3a9db4626cb6 100644
--- a/drivers/i2c/algos/i2c-algo-pca.c
+++ b/drivers/i2c/algos/i2c-algo-pca.c
@@ -326,7 +326,8 @@ static int pca_xfer(struct i2c_adapter *i2c_adap,
 			DEB2("BUS ERROR - SDA Stuck low\n");
 			pca_reset(adap);
 			goto out;
-		case 0x90: /* Bus error - SCL stuck low */
+		case 0x78: /* Bus error - SCL stuck low (PCA9665) */
+		case 0x90: /* Bus error - SCL stuck low (PCA9564) */
 			DEB2("BUS ERROR - SCL Stuck low\n");
 			pca_reset(adap);
 			goto out;

From a643aee33226eedcebd8c3b364be304ca8859204 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 7 Jul 2020 14:42:38 +0200
Subject: [PATCH 0147/2658] Revert "ALSA: usb-audio: Improve frames size
 computation"

This reverts commit 02c56650f3c118d3752122996d96173d26bb13aa which is
commit f0bd62b64016508938df9babe47f65c2c727d25c upstream.

It causes a number of reported issues and a fix for it has not hit
Linus's tree yet.  Revert this to resolve those problems.

Cc: Alexander Tsoy <alexander@tsoy.me>
Cc: Takashi Iwai <tiwai@suse.de>
Cc: Sasha Levin <sashal@kernel.org>
Cc: Hans de Goede <jwrdegoede@fedoraproject.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/card.h     |  4 ----
 sound/usb/endpoint.c | 43 +++++--------------------------------------
 sound/usb/endpoint.h |  1 -
 sound/usb/pcm.c      |  2 --
 4 files changed, 5 insertions(+), 45 deletions(-)

diff --git a/sound/usb/card.h b/sound/usb/card.h
index 444a43270d66..7421ee53c29f 100644
--- a/sound/usb/card.h
+++ b/sound/usb/card.h
@@ -80,10 +80,6 @@ struct snd_usb_endpoint {
 	dma_addr_t sync_dma;		/* DMA address of syncbuf */
 
 	unsigned int pipe;		/* the data i/o pipe */
-	unsigned int framesize[2];	/* small/large frame sizes in samples */
-	unsigned int sample_rem;	/* remainder from division fs/fps */
-	unsigned int sample_accum;	/* sample accumulator */
-	unsigned int fps;		/* frames per second */
 	unsigned int freqn;		/* nominal sampling rate in fs/fps in Q16.16 format */
 	unsigned int freqm;		/* momentary sampling rate in fs/fps in Q16.16 format */
 	int	   freqshift;		/* how much to shift the feedback value to get Q16.16 */
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index 1bf46565d1df..1f18719e09aa 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -137,12 +137,12 @@ int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep)
 
 /*
  * For streaming based on information derived from sync endpoints,
- * prepare_outbound_urb_sizes() will call slave_next_packet_size() to
+ * prepare_outbound_urb_sizes() will call next_packet_size() to
  * determine the number of samples to be sent in the next packet.
  *
- * For implicit feedback, slave_next_packet_size() is unused.
+ * For implicit feedback, next_packet_size() is unused.
  */
-int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep)
+int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep)
 {
 	unsigned long flags;
 	int ret;
@@ -159,29 +159,6 @@ int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep)
 	return ret;
 }
 
-/*
- * For adaptive and synchronous endpoints, prepare_outbound_urb_sizes()
- * will call next_packet_size() to determine the number of samples to be
- * sent in the next packet.
- */
-int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep)
-{
-	int ret;
-
-	if (ep->fill_max)
-		return ep->maxframesize;
-
-	ep->sample_accum += ep->sample_rem;
-	if (ep->sample_accum >= ep->fps) {
-		ep->sample_accum -= ep->fps;
-		ret = ep->framesize[1];
-	} else {
-		ret = ep->framesize[0];
-	}
-
-	return ret;
-}
-
 static void retire_outbound_urb(struct snd_usb_endpoint *ep,
 				struct snd_urb_ctx *urb_ctx)
 {
@@ -226,8 +203,6 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep,
 
 		if (ctx->packet_size[i])
 			counts = ctx->packet_size[i];
-		else if (ep->sync_master)
-			counts = snd_usb_endpoint_slave_next_packet_size(ep);
 		else
 			counts = snd_usb_endpoint_next_packet_size(ep);
 
@@ -904,17 +879,10 @@ int snd_usb_endpoint_set_params(struct snd_usb_endpoint *ep,
 	ep->maxpacksize = fmt->maxpacksize;
 	ep->fill_max = !!(fmt->attributes & UAC_EP_CS_ATTR_FILL_MAX);
 
-	if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL) {
+	if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL)
 		ep->freqn = get_usb_full_speed_rate(rate);
-		ep->fps = 1000;
-	} else {
+	else
 		ep->freqn = get_usb_high_speed_rate(rate);
-		ep->fps = 8000;
-	}
-
-	ep->sample_rem = rate % ep->fps;
-	ep->framesize[0] = rate / ep->fps;
-	ep->framesize[1] = (rate + (ep->fps - 1)) / ep->fps;
 
 	/* calculate the frequency in 16.16 format */
 	ep->freqm = ep->freqn;
@@ -973,7 +941,6 @@ int snd_usb_endpoint_start(struct snd_usb_endpoint *ep)
 	ep->active_mask = 0;
 	ep->unlink_mask = 0;
 	ep->phase = 0;
-	ep->sample_accum = 0;
 
 	snd_usb_endpoint_start_quirk(ep);
 
diff --git a/sound/usb/endpoint.h b/sound/usb/endpoint.h
index 4aad49cbeb5f..584f295d7c77 100644
--- a/sound/usb/endpoint.h
+++ b/sound/usb/endpoint.h
@@ -27,7 +27,6 @@ void snd_usb_endpoint_release(struct snd_usb_endpoint *ep);
 void snd_usb_endpoint_free(struct snd_usb_endpoint *ep);
 
 int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep);
-int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep);
 int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep);
 
 void snd_usb_handle_sync_urb(struct snd_usb_endpoint *ep,
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index aa451fc9b253..8eaadc0a4cb2 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1531,8 +1531,6 @@ static void prepare_playback_urb(struct snd_usb_substream *subs,
 	for (i = 0; i < ctx->packets; i++) {
 		if (ctx->packet_size[i])
 			counts = ctx->packet_size[i];
-		else if (ep->sync_master)
-			counts = snd_usb_endpoint_slave_next_packet_size(ep);
 		else
 			counts = snd_usb_endpoint_next_packet_size(ep);
 

From 427fa6d3d85c580188e3447aedb0246954086086 Mon Sep 17 00:00:00 2001
From: Paul Aurich <paul@darkrain42.org>
Date: Fri, 26 Jun 2020 12:58:05 -0700
Subject: [PATCH 0148/2658] SMB3: Honor 'seal' flag for multiuser mounts

commit cc15461c73d7d044d56c47e869a215e49bd429c8 upstream.

Ensure multiuser SMB3 mounts use encryption for all users' tcons if the
mount options are configured to require encryption. Without this, only
the primary tcon and IPC tcons are guaranteed to be encrypted. Per-user
tcons would only be encrypted if the server was configured to require
encryption.

Signed-off-by: Paul Aurich <paul@darkrain42.org>
CC: Stable <stable@vger.kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/connect.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 21ddfd77966e..bcb3e606cf39 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -4206,6 +4206,7 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid)
 	vol_info->no_linux_ext = !master_tcon->unix_ext;
 	vol_info->sectype = master_tcon->ses->sectype;
 	vol_info->sign = master_tcon->ses->sign;
+	vol_info->seal = master_tcon->seal;
 
 	rc = cifs_set_vol_auth(vol_info, master_tcon->ses);
 	if (rc) {

From 6f402b7763d41eddabda44ce1b80cca751450464 Mon Sep 17 00:00:00 2001
From: Paul Aurich <paul@darkrain42.org>
Date: Fri, 26 Jun 2020 12:58:06 -0700
Subject: [PATCH 0149/2658] SMB3: Honor persistent/resilient handle flags for
 multiuser mounts

commit 00dfbc2f9c61185a2e662f27c45a0bb29b2a134f upstream.

Without this:

- persistent handles will only be enabled for per-user tcons if the
  server advertises the 'Continuous Availabity' capability
- resilient handles would never be enabled for per-user tcons

Signed-off-by: Paul Aurich <paul@darkrain42.org>
CC: Stable <stable@vger.kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/connect.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index bcb3e606cf39..f4ef8d6ea8ed 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -4203,6 +4203,8 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid)
 	vol_info->retry = master_tcon->retry;
 	vol_info->nocase = master_tcon->nocase;
 	vol_info->local_lease = master_tcon->local_lease;
+	vol_info->resilient = master_tcon->use_resilient;
+	vol_info->persistent = master_tcon->use_persistent;
 	vol_info->no_linux_ext = !master_tcon->unix_ext;
 	vol_info->sectype = master_tcon->ses->sectype;
 	vol_info->sign = master_tcon->ses->sign;

From 0e93fb75b99ee87dc0a982ec72b0adbb3e58a756 Mon Sep 17 00:00:00 2001
From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Date: Sun, 28 Jun 2020 21:06:38 -0400
Subject: [PATCH 0150/2658] cifs: Fix the target file was deleted when rename
 failed.

commit 9ffad9263b467efd8f8dc7ae1941a0a655a2bab2 upstream.

When xfstest generic/035, we found the target file was deleted
if the rename return -EACESS.

In cifs_rename2, we unlink the positive target dentry if rename
failed with EACESS or EEXIST, even if the target dentry is positived
before rename. Then the existing file was deleted.

We should just delete the target file which created during the
rename.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/inode.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index c18c26a78453..a002e289a544 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1737,6 +1737,7 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,
 	FILE_UNIX_BASIC_INFO *info_buf_target;
 	unsigned int xid;
 	int rc, tmprc;
+	bool new_target = d_really_is_negative(target_dentry);
 
 	if (flags & ~RENAME_NOREPLACE)
 		return -EINVAL;
@@ -1813,8 +1814,13 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,
 	 */
 
 unlink_target:
-	/* Try unlinking the target dentry if it's not negative */
-	if (d_really_is_positive(target_dentry) && (rc == -EACCES || rc == -EEXIST)) {
+	/*
+	 * If the target dentry was created during the rename, try
+	 * unlinking it if it's not negative
+	 */
+	if (new_target &&
+	    d_really_is_positive(target_dentry) &&
+	    (rc == -EACCES || rc == -EEXIST)) {
 		if (d_is_dir(target_dentry))
 			tmprc = cifs_rmdir(target_dir, target_dentry);
 		else

From 09e1f846c44e14d8e881272186b903e182e07ff3 Mon Sep 17 00:00:00 2001
From: Hauke Mehrtens <hauke@hauke-m.de>
Date: Fri, 3 Jul 2020 00:53:34 +0200
Subject: [PATCH 0151/2658] MIPS: Add missing EHB in mtc0 -> mfc0 sequence for
 DSPen

commit fcec538ef8cca0ad0b84432235dccd9059c8e6f8 upstream.

This resolves the hazard between the mtc0 in the change_c0_status() and
the mfc0 in configure_exception_vector(). Without resolving this hazard
configure_exception_vector() could read an old value and would restore
this old value again. This would revert the changes change_c0_status()
did. I checked this by printing out the read_c0_status() at the end of
per_cpu_trap_init() and the ST0_MX is not set without this patch.

The hazard is documented in the MIPS Architecture Reference Manual Vol.
III: MIPS32/microMIPS32 Privileged Resource Architecture (MD00088), rev
6.03 table 8.1 which includes:

   Producer | Consumer | Hazard
  ----------|----------|----------------------------
   mtc0     | mfc0     | any coprocessor 0 register

I saw this hazard on an Atheros AR9344 rev 2 SoC with a MIPS 74Kc CPU.
There the change_c0_status() function would activate the DSPen by
setting ST0_MX in the c0_status register. This was reverted and then the
system got a DSP exception when the DSP registers were saved in
save_dsp() in the first process switch. The crash looks like this:

[    0.089999] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.097796] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.107070] Kernel panic - not syncing: Unexpected DSP exception
[    0.113470] Rebooting in 1 seconds..

We saw this problem in OpenWrt only on the MIPS 74Kc based Atheros SoCs,
not on the 24Kc based SoCs. We only saw it with kernel 5.4 not with
kernel 4.19, in addition we had to use GCC 8.4 or 9.X, with GCC 8.3 it
did not happen.

In the kernel I bisected this problem to commit 9012d011660e ("compiler:
allow all arches to enable CONFIG_OPTIMIZE_INLINING"), but when this was
reverted it also happened after commit 172dcd935c34b ("MIPS: Always
allocate exception vector for MIPSr2+").

Commit 0b24cae4d535 ("MIPS: Add missing EHB in mtc0 -> mfc0 sequence.")
does similar changes to a different file. I am not sure if there are
more places affected by this problem.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/kernel/traps.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 6abd6b41c13d..36472fc266fd 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -2080,6 +2080,7 @@ static void configure_status(void)
 
 	change_c0_status(ST0_CU|ST0_MX|ST0_RE|ST0_FR|ST0_BEV|ST0_TS|ST0_KX|ST0_SX|ST0_UX,
 			 status_set);
+	back_to_back_c0_hazard();
 }
 
 /* configure HWRENA register */

From 55e63bd5d9e4efcc8b432704dfc8966fc6c4f81e Mon Sep 17 00:00:00 2001
From: Vasily Averin <vvs@virtuozzo.com>
Date: Tue, 9 Jun 2020 10:53:22 +0300
Subject: [PATCH 0152/2658] netfilter: nf_conntrack_h323: lost .data_len
 definition for Q.931/ipv6

Could you please push this patch into stable@?
it fixes memory corruption in kernels  v3.5 .. v4.10

Lost .data_len definition leads to write beyond end of
struct nf_ct_h323_master. Usually it corrupts following
struct nf_conn_nat, however if nat is not loaded it corrupts
following slab object.

In mainline this problem went away in v4.11,
after commit 9f0f3ebeda47 ("netfilter: helpers: remove data_len usage
for inkernel helpers") however many stable kernels are still affected.

Fixes: 1afc56794e03 ("netfilter: nf_ct_helper: implement variable length helper private data") # v3.5
cc: stable@vger.kernel.org
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/nf_conntrack_h323_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 9511af04dc81..15495b956855 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -1225,6 +1225,7 @@ static struct nf_conntrack_helper nf_conntrack_helper_q931[] __read_mostly = {
 	{
 		.name			= "Q.931",
 		.me			= THIS_MODULE,
+		.data_len		= sizeof(struct nf_ct_h323_master),
 		.tuple.src.l3num	= AF_INET6,
 		.tuple.src.u.tcp.port	= cpu_to_be16(Q931_PORT),
 		.tuple.dst.protonum	= IPPROTO_TCP,

From 9197bba2d66f14905e5effe6b144eb6c78003a97 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 9 Jul 2020 09:35:09 +0200
Subject: [PATCH 0153/2658] Linux 4.4.230

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 4a2080506d51..6114167621b4 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 229
+SUBLEVEL = 230
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 376ab0be774659553450c560be27435c7d8fcca2 Mon Sep 17 00:00:00 2001
From: Christian Borntraeger <borntraeger@de.ibm.com>
Date: Wed, 17 Jun 2020 10:36:20 +0200
Subject: [PATCH 0154/2658] KVM: s390: reduce number of IO pins to 1

[ Upstream commit 774911290c589e98e3638e73b24b0a4d4530e97c ]

The current number of KVM_IRQCHIP_NUM_PINS results in an order 3
allocation (32kb) for each guest start/restart. This can result in OOM
killer activity even with free swap when the memory is fragmented
enough:

kernel: qemu-system-s39 invoked oom-killer: gfp_mask=0x440dc0(GFP_KERNEL_ACCOUNT|__GFP_COMP|__GFP_ZERO), order=3, oom_score_adj=0
kernel: CPU: 1 PID: 357274 Comm: qemu-system-s39 Kdump: loaded Not tainted 5.4.0-29-generic #33-Ubuntu
kernel: Hardware name: IBM 8562 T02 Z06 (LPAR)
kernel: Call Trace:
kernel: ([<00000001f848fe2a>] show_stack+0x7a/0xc0)
kernel:  [<00000001f8d3437a>] dump_stack+0x8a/0xc0
kernel:  [<00000001f8687032>] dump_header+0x62/0x258
kernel:  [<00000001f8686122>] oom_kill_process+0x172/0x180
kernel:  [<00000001f8686abe>] out_of_memory+0xee/0x580
kernel:  [<00000001f86e66b8>] __alloc_pages_slowpath+0xd18/0xe90
kernel:  [<00000001f86e6ad4>] __alloc_pages_nodemask+0x2a4/0x320
kernel:  [<00000001f86b1ab4>] kmalloc_order+0x34/0xb0
kernel:  [<00000001f86b1b62>] kmalloc_order_trace+0x32/0xe0
kernel:  [<00000001f84bb806>] kvm_set_irq_routing+0xa6/0x2e0
kernel:  [<00000001f84c99a4>] kvm_arch_vm_ioctl+0x544/0x9e0
kernel:  [<00000001f84b8936>] kvm_vm_ioctl+0x396/0x760
kernel:  [<00000001f875df66>] do_vfs_ioctl+0x376/0x690
kernel:  [<00000001f875e304>] ksys_ioctl+0x84/0xb0
kernel:  [<00000001f875e39a>] __s390x_sys_ioctl+0x2a/0x40
kernel:  [<00000001f8d55424>] system_call+0xd8/0x2c8

As far as I can tell s390x does not use the iopins as we bail our for
anything other than KVM_IRQ_ROUTING_S390_ADAPTER and the chip/pin is
only used for KVM_IRQ_ROUTING_IRQCHIP. So let us use a small number to
reduce the memory footprint.

Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Link: https://lore.kernel.org/r/20200617083620.5409-1-borntraeger@de.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/include/asm/kvm_host.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
index 7d9c5917da2b..737bc0a39463 100644
--- a/arch/s390/include/asm/kvm_host.h
+++ b/arch/s390/include/asm/kvm_host.h
@@ -29,12 +29,12 @@
 #define KVM_USER_MEM_SLOTS 32
 
 /*
- * These seem to be used for allocating ->chip in the routing table,
- * which we don't use. 4096 is an out-of-thin-air value. If we need
- * to look at ->chip later on, we'll need to revisit this.
+ * These seem to be used for allocating ->chip in the routing table, which we
+ * don't use. 1 is as small as we can get to reduce the needed memory. If we
+ * need to look at ->chip later on, we'll need to revisit this.
  */
 #define KVM_NR_IRQCHIPS 1
-#define KVM_IRQCHIP_NUM_PINS 4096
+#define KVM_IRQCHIP_NUM_PINS 1
 #define KVM_HALT_POLL_NS_DEFAULT 0
 
 #define SIGP_CTRL_C		0x80

From d174c1a13cc961eaba9aeb40e05840ff23d43ac4 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@gmail.com>
Date: Thu, 18 Jun 2020 11:21:24 +0800
Subject: [PATCH 0155/2658] spi: spidev: fix a race between spidev_release and
 spidev_remove

[ Upstream commit abd42781c3d2155868821f1b947ae45bbc33330d ]

Imagine below scene, spidev is referenced after it's freed.

spidev_release()                spidev_remove()
...
                                spin_lock_irq(&spidev->spi_lock);
                                    spidev->spi = NULL;
                                spin_unlock_irq(&spidev->spi_lock);
mutex_lock(&device_list_lock);
dofree = (spidev->spi == NULL);
if (dofree)
    kfree(spidev);
mutex_unlock(&device_list_lock);
                                mutex_lock(&device_list_lock);
                                list_del(&spidev->device_entry);
                                device_destroy(spidev_class, spidev->devt);
                                clear_bit(MINOR(spidev->devt), minors);
                                if (spidev->users == 0)
                                    kfree(spidev);
                                mutex_unlock(&device_list_lock);

Fix it by resetting spidev->spi in device_list_lock's protection.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@gmail.com>
Link: https://lore.kernel.org/r/20200618032125.4650-1-zhenzhong.duan@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spidev.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index cb44d7f95c81..f3860e0de12c 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -770,13 +770,13 @@ static int spidev_remove(struct spi_device *spi)
 {
 	struct spidev_data	*spidev = spi_get_drvdata(spi);
 
+	/* prevent new opens */
+	mutex_lock(&device_list_lock);
 	/* make sure ops on existing fds can abort cleanly */
 	spin_lock_irq(&spidev->spi_lock);
 	spidev->spi = NULL;
 	spin_unlock_irq(&spidev->spi_lock);
 
-	/* prevent new opens */
-	mutex_lock(&device_list_lock);
 	list_del(&spidev->device_entry);
 	device_destroy(spidev_class, spidev->devt);
 	clear_bit(MINOR(spidev->devt), minors);

From ec2bffdadac99806ab7b13891c078bbe4d622075 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@gmail.com>
Date: Thu, 18 Jun 2020 11:21:25 +0800
Subject: [PATCH 0156/2658] spi: spidev: fix a potential use-after-free in
 spidev_release()

[ Upstream commit 06096cc6c5a84ced929634b0d79376b94c65a4bd ]

If an spi device is unbounded from the driver before the release
process, there will be an NULL pointer reference when it's
referenced in spi_slave_abort().

Fix it by checking it's already freed before reference.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@gmail.com>
Link: https://lore.kernel.org/r/20200618032125.4650-2-zhenzhong.duan@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spidev.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index f3860e0de12c..6066c862be5c 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -635,15 +635,20 @@ static int spidev_open(struct inode *inode, struct file *filp)
 static int spidev_release(struct inode *inode, struct file *filp)
 {
 	struct spidev_data	*spidev;
+	int			dofree;
 
 	mutex_lock(&device_list_lock);
 	spidev = filp->private_data;
 	filp->private_data = NULL;
 
+	spin_lock_irq(&spidev->spi_lock);
+	/* ... after we unbound from the underlying device? */
+	dofree = (spidev->spi == NULL);
+	spin_unlock_irq(&spidev->spi_lock);
+
 	/* last close? */
 	spidev->users--;
 	if (!spidev->users) {
-		int		dofree;
 
 		kfree(spidev->tx_buffer);
 		spidev->tx_buffer = NULL;
@@ -651,19 +656,14 @@ static int spidev_release(struct inode *inode, struct file *filp)
 		kfree(spidev->rx_buffer);
 		spidev->rx_buffer = NULL;
 
-		spin_lock_irq(&spidev->spi_lock);
-		if (spidev->spi)
-			spidev->speed_hz = spidev->spi->max_speed_hz;
-
-		/* ... after we unbound from the underlying device? */
-		dofree = (spidev->spi == NULL);
-		spin_unlock_irq(&spidev->spi_lock);
-
 		if (dofree)
 			kfree(spidev);
+		else
+			spidev->speed_hz = spidev->spi->max_speed_hz;
 	}
 #ifdef CONFIG_SPI_SLAVE
-	spi_slave_abort(spidev->spi);
+	if (!dofree)
+		spi_slave_abort(spidev->spi);
 #endif
 	mutex_unlock(&device_list_lock);
 

From da427e8e65ea99b9e175a292add24c168cb1aa5e Mon Sep 17 00:00:00 2001
From: Tomas Henzl <thenzl@redhat.com>
Date: Tue, 16 Jun 2020 17:04:46 +0200
Subject: [PATCH 0157/2658] scsi: mptscsih: Fix read sense data size

[ Upstream commit afe89f115e84edbc76d316759e206580a06c6973 ]

The sense data buffer in sense_buf_pool is allocated with size of
MPT_SENSE_BUFFER_ALLOC(64) (multiplied by req_depth) while SNS_LEN(sc)(96)
is used when reading the data.  That may lead to a read from unallocated
area, sometimes from another (unallocated) page.  To fix this, limit the
read size to MPT_SENSE_BUFFER_ALLOC.

Link: https://lore.kernel.org/r/20200616150446.4840-1-thenzl@redhat.com
Co-developed-by: Stanislav Saner <ssaner@redhat.com>
Signed-off-by: Stanislav Saner <ssaner@redhat.com>
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/message/fusion/mptscsih.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
index 6c9fc11efb87..e77185e143ab 100644
--- a/drivers/message/fusion/mptscsih.c
+++ b/drivers/message/fusion/mptscsih.c
@@ -118,8 +118,6 @@ int 		mptscsih_suspend(struct pci_dev *pdev, pm_message_t state);
 int 		mptscsih_resume(struct pci_dev *pdev);
 #endif
 
-#define SNS_LEN(scp)	SCSI_SENSE_BUFFERSIZE
-
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /*
@@ -2427,7 +2425,7 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR
 		/* Copy the sense received into the scsi command block. */
 		req_index = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx);
 		sense_data = ((u8 *)ioc->sense_buf_pool + (req_index * MPT_SENSE_BUFFER_ALLOC));
-		memcpy(sc->sense_buffer, sense_data, SNS_LEN(sc));
+		memcpy(sc->sense_buffer, sense_data, MPT_SENSE_BUFFER_ALLOC);
 
 		/* Log SMART data (asc = 0x5D, non-IM case only) if required.
 		 */

From 0efc2604a0cfd1d78ad4562c7ea4a6fbf1fb6bfd Mon Sep 17 00:00:00 2001
From: Li Heng <liheng40@huawei.com>
Date: Mon, 29 Jun 2020 18:49:51 +0800
Subject: [PATCH 0158/2658] net: cxgb4: fix return error value in t4_prep_fw

[ Upstream commit 8a259e6b73ad8181b0b2ef338b35043433db1075 ]

t4_prep_fw goto bye tag with positive return value when something
bad happened and which can not free resource in adap_init0.
so fix it to return negative value.

Fixes: 16e47624e76b ("cxgb4: Add new scheme to update T4/T5 firmware")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Li Heng <liheng40@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index fd6492fd3dc0..9d07fa318ac3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -3093,7 +3093,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
 	drv_fw = &fw_info->fw_hdr;
 
 	/* Read the header of the firmware on the card */
-	ret = -t4_read_flash(adap, FLASH_FW_START,
+	ret = t4_read_flash(adap, FLASH_FW_START,
 			    sizeof(*card_fw) / sizeof(uint32_t),
 			    (uint32_t *)card_fw, 1);
 	if (ret == 0) {
@@ -3122,8 +3122,8 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
 		   should_install_fs_fw(adap, card_fw_usable,
 					be32_to_cpu(fs_fw->fw_ver),
 					be32_to_cpu(card_fw->fw_ver))) {
-		ret = -t4_fw_upgrade(adap, adap->mbox, fw_data,
-				     fw_size, 0);
+		ret = t4_fw_upgrade(adap, adap->mbox, fw_data,
+				    fw_size, 0);
 		if (ret != 0) {
 			dev_err(adap->pdev_dev,
 				"failed to install firmware: %d\n", ret);
@@ -3154,7 +3154,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
 			FW_HDR_FW_VER_MICRO_G(c), FW_HDR_FW_VER_BUILD_G(c),
 			FW_HDR_FW_VER_MAJOR_G(k), FW_HDR_FW_VER_MINOR_G(k),
 			FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k));
-		ret = EINVAL;
+		ret = -EINVAL;
 		goto bye;
 	}
 

From fe73639b4b7cd9e532b26830adb9344d665def7c Mon Sep 17 00:00:00 2001
From: Andre Edich <andre.edich@microchip.com>
Date: Mon, 6 Jul 2020 10:39:34 +0200
Subject: [PATCH 0159/2658] smsc95xx: check return value of smsc95xx_reset

[ Upstream commit 7c8b1e855f94f88a0c569be6309fc8d5c8844cd1 ]

The return value of the function smsc95xx_reset() must be checked
to avoid returning false success from the function smsc95xx_bind().

Fixes: 2f7ca802bdae2 ("net: Add SMSC LAN9500 USB2.0 10/100 ethernet adapter driver")
Signed-off-by: Andre Edich <andre.edich@microchip.com>
Signed-off-by: Parthiban Veerasooran <Parthiban.Veerasooran@microchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/smsc95xx.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index b6b8aec73b28..8037a2e51a78 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1136,6 +1136,8 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
 
 	/* Init all registers */
 	ret = smsc95xx_reset(dev);
+	if (ret)
+		goto free_pdata;
 
 	/* detect device revision as different features may be available */
 	ret = smsc95xx_read_reg(dev, ID_REV, &val);
@@ -1157,6 +1159,10 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
 	dev->net->hard_header_len += SMSC95XX_TX_OVERHEAD_CSUM;
 	dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
 	return 0;
+
+free_pdata:
+	kfree(pdata);
+	return ret;
 }
 
 static void smsc95xx_unbind(struct usbnet *dev, struct usb_interface *intf)

From 96d2265f5fb400c109abdbdd1de881b2aca8c3b4 Mon Sep 17 00:00:00 2001
From: Andre Edich <andre.edich@microchip.com>
Date: Mon, 6 Jul 2020 10:39:35 +0200
Subject: [PATCH 0160/2658] smsc95xx: avoid memory leak in smsc95xx_bind

[ Upstream commit 3ed58f96a70b85ef646d5427258f677f1395b62f ]

In a case where the ID_REV register read is failed, the memory for a
private data structure has to be freed before returning error from the
function smsc95xx_bind.

Fixes: bbd9f9ee69242 ("smsc95xx: add wol support for more frame types")
Signed-off-by: Andre Edich <andre.edich@microchip.com>
Signed-off-by: Parthiban Veerasooran <Parthiban.Veerasooran@microchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/smsc95xx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 8037a2e51a78..e4299852974e 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1142,7 +1142,8 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
 	/* detect device revision as different features may be available */
 	ret = smsc95xx_read_reg(dev, ID_REV, &val);
 	if (ret < 0)
-		return ret;
+		goto free_pdata;
+
 	val >>= 16;
 
 	if ((val == ID_REV_CHIP_ID_9500A_) || (val == ID_REV_CHIP_ID_9530_) ||

From d601142e9d561c52a6dc9ac3af573e2fcea67f65 Mon Sep 17 00:00:00 2001
From: Vinod Koul <vkoul@kernel.org>
Date: Mon, 29 Jun 2020 19:17:37 +0530
Subject: [PATCH 0161/2658] ALSA: compress: fix partial_drain completion state

[ Upstream commit f79a732a8325dfbd570d87f1435019d7e5501c6d ]

On partial_drain completion we should be in SNDRV_PCM_STATE_RUNNING
state, so set that for partially draining streams in
snd_compr_drain_notify() and use a flag for partially draining streams

While at it, add locks for stream state change in
snd_compr_drain_notify() as well.

Fixes: f44f2a5417b2 ("ALSA: compress: fix drain calls blocking other compress functions (v6)")
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Tested-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Link: https://lore.kernel.org/r/20200629134737.105993-4-vkoul@kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/sound/compress_driver.h | 10 +++++++++-
 sound/core/compress_offload.c   |  7 +++++--
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h
index 5bb9261ec103..07555417fac5 100644
--- a/include/sound/compress_driver.h
+++ b/include/sound/compress_driver.h
@@ -71,6 +71,7 @@ struct snd_compr_runtime {
  * @direction: stream direction, playback/recording
  * @metadata_set: metadata set flag, true when set
  * @next_track: has userspace signal next track transition, true when set
+ * @partial_drain: undergoing partial_drain for stream, true when set
  * @private_data: pointer to DSP private data
  */
 struct snd_compr_stream {
@@ -81,6 +82,7 @@ struct snd_compr_stream {
 	enum snd_compr_direction direction;
 	bool metadata_set;
 	bool next_track;
+	bool partial_drain;
 	void *private_data;
 	struct snd_soc_pcm_runtime *be;
 };
@@ -184,7 +186,13 @@ static inline void snd_compr_drain_notify(struct snd_compr_stream *stream)
 	if (snd_BUG_ON(!stream))
 		return;
 
-	stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+	/* for partial_drain case we are back to running state on success */
+	if (stream->partial_drain) {
+		stream->runtime->state = SNDRV_PCM_STATE_RUNNING;
+		stream->partial_drain = false; /* clear this flag as well */
+	} else {
+		stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+	}
 
 	wake_up(&stream->runtime->sleep);
 }
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index e364fd2c17e9..e69160748621 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -703,8 +703,10 @@ static int snd_compr_stop(struct snd_compr_stream *stream)
 
 	retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_STOP);
 	if (!retval) {
-		stream->runtime->state = SNDRV_PCM_STATE_SETUP;
-		wake_up(&stream->runtime->sleep);
+		/* clear flags and stop any drain wait */
+		stream->partial_drain = false;
+		stream->metadata_set = false;
+		snd_compr_drain_notify(stream);
 		stream->runtime->total_bytes_available = 0;
 		stream->runtime->total_bytes_transferred = 0;
 	}
@@ -783,6 +785,7 @@ static int snd_compr_partial_drain(struct snd_compr_stream *stream)
 	if (stream->next_track == false)
 		return -EPERM;
 
+	stream->partial_drain = true;
 	retval = stream->ops->trigger(stream, SND_COMPR_TRIGGER_PARTIAL_DRAIN);
 
 	stream->next_track = false;

From b90ab42808b78b0eb192a4283aaf5a56ad886c22 Mon Sep 17 00:00:00 2001
From: Wei Li <liwei391@huawei.com>
Date: Sun, 10 May 2020 05:41:56 +0800
Subject: [PATCH 0162/2658] arm64: kgdb: Fix single-step exception handling
 oops

[ Upstream commit 8523c006264df65aac7d77284cc69aac46a6f842 ]

After entering kdb due to breakpoint, when we execute 'ss' or 'go' (will
delay installing breakpoints, do single-step first), it won't work
correctly, and it will enter kdb due to oops.

It's because the reason gotten in kdb_stub() is not as expected, and it
seems that the ex_vector for single-step should be 0, like what arch
powerpc/sh/parisc has implemented.

Before the patch:
Entering kdb (current=0xffff8000119e2dc0, pid 0) on processor 0 due to Keyboard Entry
[0]kdb> bp printk
Instruction(i) BP #0 at 0xffff8000101486cc (printk)
    is enabled   addr at ffff8000101486cc, hardtype=0 installed=0

[0]kdb> g

/ # echo h > /proc/sysrq-trigger

Entering kdb (current=0xffff0000fa878040, pid 266) on processor 3 due to Breakpoint @ 0xffff8000101486cc
[3]kdb> ss

Entering kdb (current=0xffff0000fa878040, pid 266) on processor 3 Oops: (null)
due to oops @ 0xffff800010082ab8
CPU: 3 PID: 266 Comm: sh Not tainted 5.7.0-rc4-13839-gf0e5ad491718 #6
Hardware name: linux,dummy-virt (DT)
pstate: 00000085 (nzcv daIf -PAN -UAO)
pc : el1_irq+0x78/0x180
lr : __handle_sysrq+0x80/0x190
sp : ffff800015003bf0
x29: ffff800015003d20 x28: ffff0000fa878040
x27: 0000000000000000 x26: ffff80001126b1f0
x25: ffff800011b6a0d8 x24: 0000000000000000
x23: 0000000080200005 x22: ffff8000101486cc
x21: ffff800015003d30 x20: 0000ffffffffffff
x19: ffff8000119f2000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000
x15: 0000000000000000 x14: 0000000000000000
x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000
x9 : 0000000000000000 x8 : ffff800015003e50
x7 : 0000000000000002 x6 : 00000000380b9990
x5 : ffff8000106e99e8 x4 : ffff0000fadd83c0
x3 : 0000ffffffffffff x2 : ffff800011b6a0d8
x1 : ffff800011b6a000 x0 : ffff80001130c9d8
Call trace:
 el1_irq+0x78/0x180
 printk+0x0/0x84
 write_sysrq_trigger+0xb0/0x118
 proc_reg_write+0xb4/0xe0
 __vfs_write+0x18/0x40
 vfs_write+0xb0/0x1b8
 ksys_write+0x64/0xf0
 __arm64_sys_write+0x14/0x20
 el0_svc_common.constprop.2+0xb0/0x168
 do_el0_svc+0x20/0x98
 el0_sync_handler+0xec/0x1a8
 el0_sync+0x140/0x180

[3]kdb>

After the patch:
Entering kdb (current=0xffff8000119e2dc0, pid 0) on processor 0 due to Keyboard Entry
[0]kdb> bp printk
Instruction(i) BP #0 at 0xffff8000101486cc (printk)
    is enabled   addr at ffff8000101486cc, hardtype=0 installed=0

[0]kdb> g

/ # echo h > /proc/sysrq-trigger

Entering kdb (current=0xffff0000fa852bc0, pid 268) on processor 0 due to Breakpoint @ 0xffff8000101486cc
[0]kdb> g

Entering kdb (current=0xffff0000fa852bc0, pid 268) on processor 0 due to Breakpoint @ 0xffff8000101486cc
[0]kdb> ss

Entering kdb (current=0xffff0000fa852bc0, pid 268) on processor 0 due to SS trap @ 0xffff800010082ab8
[0]kdb>

Fixes: 44679a4f142b ("arm64: KGDB: Add step debugging support")
Signed-off-by: Wei Li <liwei391@huawei.com>
Tested-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20200509214159.19680-2-liwei391@huawei.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/kgdb.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c
index 624a7066d6fb..849c818701f0 100644
--- a/arch/arm64/kernel/kgdb.c
+++ b/arch/arm64/kernel/kgdb.c
@@ -242,8 +242,7 @@ static int kgdb_step_brk_fn(struct pt_regs *regs, unsigned int esr)
 	if (user_mode(regs))
 		return DBG_HOOK_ERROR;
 
-	kgdb_handle_exception(1, SIGTRAP, 0, regs);
-
+	kgdb_handle_exception(0, SIGTRAP, 0, regs);
 	return DBG_HOOK_HANDLED;
 }
 NOKPROBE_SYMBOL(kgdb_step_brk_fn);

From aac5e2c03fcb817d6c0294521405a9fe3fe4e78e Mon Sep 17 00:00:00 2001
From: xidongwang <wangxidong_97@163.com>
Date: Sun, 5 Jul 2020 20:27:38 -0700
Subject: [PATCH 0163/2658] ALSA: opl3: fix infoleak in opl3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit ad155712bb1ea2151944cf06a0e08c315c70c1e3 upstream.

The stack object “info” in snd_opl3_ioctl() has a leaking problem.
It has 2 padding bytes which are not initialized and leaked via
“copy_to_user”.

Signed-off-by: xidongwang <wangxidong_97@163.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1594006058-30362-1-git-send-email-wangxidong_97@163.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/drivers/opl3/opl3_synth.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/drivers/opl3/opl3_synth.c b/sound/drivers/opl3/opl3_synth.c
index 42920a243328..3f94746d587a 100644
--- a/sound/drivers/opl3/opl3_synth.c
+++ b/sound/drivers/opl3/opl3_synth.c
@@ -104,6 +104,8 @@ int snd_opl3_ioctl(struct snd_hwdep * hw, struct file *file,
 		{
 			struct snd_dm_fm_info info;
 
+			memset(&info, 0, sizeof(info));
+
 			info.fm_mode = opl3->fm_mode;
 			info.rhythm = opl3->rhythm;
 			if (copy_to_user(argp, &info, sizeof(struct snd_dm_fm_info)))

From 3fa45414a5aaa2fe978cc4489e40f088bb416123 Mon Sep 17 00:00:00 2001
From: Hui Wang <hui.wang@canonical.com>
Date: Thu, 25 Jun 2020 16:38:33 +0800
Subject: [PATCH 0164/2658] ALSA: hda - let hs_mic be picked ahead of hp_mic

commit 6a6ca7881b1ab1c13fe0d70bae29211a65dd90de upstream.

We have a Dell AIO, there is neither internal speaker nor internal
mic, only a multi-function audio jack on it.

Users reported that after freshly installing the OS and plug
a headset to the audio jack, the headset can't output sound. I
reproduced this bug, at that moment, the Input Source is as below:
Simple mixer control 'Input Source',0
  Capabilities: cenum
  Items: 'Headphone Mic' 'Headset Mic'
  Item0: 'Headphone Mic'

That is because the patch_realtek will set this audio jack as mic_in
mode if Input Source's value is hp_mic.

If it is not fresh installing, this issue will not happen since the
systemd will run alsactl restore -f /var/lib/alsa/asound.state, this
will set the 'Input Source' according to history value.

If there is internal speaker or internal mic, this issue will not
happen since there is valid sink/source in the pulseaudio, the PA will
set the 'Input Source' according to active_port.

To fix this issue, change the parser function to let the hs_mic be
stored ahead of hp_mic.

Cc: stable@vger.kernel.org
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Link: https://lore.kernel.org/r/20200625083833.11264-1-hui.wang@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/hda_auto_parser.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c
index 12d87204e373..7ac92d188f4f 100644
--- a/sound/pci/hda/hda_auto_parser.c
+++ b/sound/pci/hda/hda_auto_parser.c
@@ -76,6 +76,12 @@ static int compare_input_type(const void *ap, const void *bp)
 	if (a->type != b->type)
 		return (int)(a->type - b->type);
 
+	/* If has both hs_mic and hp_mic, pick the hs_mic ahead of hp_mic. */
+	if (a->is_headset_mic && b->is_headphone_mic)
+		return -1; /* don't swap */
+	else if (a->is_headphone_mic && b->is_headset_mic)
+		return 1; /* swap */
+
 	/* In case one has boost and the other one has not,
 	   pick the one with boost first. */
 	return (int)(b->has_boost_on_pin - a->has_boost_on_pin);

From de46b240fafbf96238dc83fe86357e6a4374fda4 Mon Sep 17 00:00:00 2001
From: Hector Martin <marcan@marcan.st>
Date: Thu, 2 Jul 2020 16:14:33 +0900
Subject: [PATCH 0165/2658] ALSA: usb-audio: add quirk for MacroSilicon MS2109

commit e337bf19f6af38d5c3fa6d06cd594e0f890ca1ac upstream.

These devices claim to be 96kHz mono, but actually are 48kHz stereo with
swapped channels and unaligned transfers.

Cc: stable@vger.kernel.org
Signed-off-by: Hector Martin <marcan@marcan.st>
Link: https://lore.kernel.org/r/20200702071433.237843-1-marcan@marcan.st
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/quirks-table.h | 52 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)

diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index c892b4d1e733..ec56ce382061 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -3323,4 +3323,56 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
 	}
 },
 
+/*
+ * MacroSilicon MS2109 based HDMI capture cards
+ *
+ * These claim 96kHz 1ch in the descriptors, but are actually 48kHz 2ch.
+ * They also need QUIRK_AUDIO_ALIGN_TRANSFER, which makes one wonder if
+ * they pretend to be 96kHz mono as a workaround for stereo being broken
+ * by that...
+ *
+ * They also have swapped L-R channels, but that's for userspace to deal
+ * with.
+ */
+{
+	USB_DEVICE(0x534d, 0x2109),
+	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+		.vendor_name = "MacroSilicon",
+		.product_name = "MS2109",
+		.ifnum = QUIRK_ANY_INTERFACE,
+		.type = QUIRK_COMPOSITE,
+		.data = &(const struct snd_usb_audio_quirk[]) {
+			{
+				.ifnum = 2,
+				.type = QUIRK_AUDIO_ALIGN_TRANSFER,
+			},
+			{
+				.ifnum = 2,
+				.type = QUIRK_AUDIO_STANDARD_MIXER,
+			},
+			{
+				.ifnum = 3,
+				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
+				.data = &(const struct audioformat) {
+					.formats = SNDRV_PCM_FMTBIT_S16_LE,
+					.channels = 2,
+					.iface = 3,
+					.altsetting = 1,
+					.altset_idx = 1,
+					.attributes = 0,
+					.endpoint = 0x82,
+					.ep_attr = USB_ENDPOINT_XFER_ISOC |
+						USB_ENDPOINT_SYNC_ASYNC,
+					.rates = SNDRV_PCM_RATE_CONTINUOUS,
+					.rate_min = 48000,
+					.rate_max = 48000,
+				}
+			},
+			{
+				.ifnum = -1
+			}
+		}
+	}
+},
+
 #undef USB_DEVICE_VENDOR_SPEC

From 9767c16e0cca8d701a048a3942e764db5ccac001 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 30 Jun 2020 07:07:20 -0400
Subject: [PATCH 0166/2658] KVM: x86: bit 8 of non-leaf PDPEs is not reserved

commit 5ecad245de2ae23dc4e2dbece92f8ccfbaed2fa7 upstream.

Bit 8 would be the "global" bit, which does not quite make sense for non-leaf
page table entries.  Intel ignores it; AMD ignores it in PDEs and PDPEs, but
reserves it in PML4Es.

Probably, earlier versions of the AMD manual documented it as reserved in PDPEs
as well, and that behavior made it into KVM as well as kvm-unit-tests; fix it.

Cc: stable@vger.kernel.org
Reported-by: Nadav Amit <namit@vmware.com>
Fixes: a0c0feb57992 ("KVM: x86: reserve bit 8 of non-leaf PDPEs and PML4Es in 64-bit mode on AMD", 2014-09-03)
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/mmu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index a5b533aea958..2ff0fe32c015 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3679,7 +3679,7 @@ __reset_rsvds_bits_mask(struct kvm_vcpu *vcpu,
 			nonleaf_bit8_rsvd | rsvd_bits(7, 7) |
 			rsvd_bits(maxphyaddr, 51);
 		rsvd_check->rsvd_bits_mask[0][2] = exb_bit_rsvd |
-			nonleaf_bit8_rsvd | gbpages_bit_rsvd |
+			gbpages_bit_rsvd |
 			rsvd_bits(maxphyaddr, 51);
 		rsvd_check->rsvd_bits_mask[0][1] = exb_bit_rsvd |
 			rsvd_bits(maxphyaddr, 51);

From 4d9bd35d790e32d4cb0614e99788c36a433251c6 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 14 Jul 2020 14:03:44 +0200
Subject: [PATCH 0167/2658] Revert "ath9k: Fix general protection fault in
 ath9k_hif_usb_rx_cb"

This reverts commit 90ecba9f1041f436ed2b35ba7a970c7cc5d0df23 which is
commit 2bbcaaee1fcbd83272e29f31e2bb7e70d8c49e05 upstream.

It is being reverted upstream, just hasn't made it there yet and is
causing lots of problems.

Reported-by: Hans de Goede <hdegoede@redhat.com>
Cc: Qiujun Huang <hqjagain@gmail.com>
Cc: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath9k/hif_usb.c | 48 ++++++------------------
 drivers/net/wireless/ath/ath9k/hif_usb.h |  5 ---
 2 files changed, 11 insertions(+), 42 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index e51f1a577897..e2ed30b03af5 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -639,9 +639,9 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
 
 static void ath9k_hif_usb_rx_cb(struct urb *urb)
 {
-	struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
-	struct hif_device_usb *hif_dev = rx_buf->hif_dev;
-	struct sk_buff *skb = rx_buf->skb;
+	struct sk_buff *skb = (struct sk_buff *) urb->context;
+	struct hif_device_usb *hif_dev =
+		usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
 	int ret;
 
 	if (!skb)
@@ -681,15 +681,14 @@ static void ath9k_hif_usb_rx_cb(struct urb *urb)
 	return;
 free:
 	kfree_skb(skb);
-	kfree(rx_buf);
 }
 
 static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
 {
-	struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
-	struct hif_device_usb *hif_dev = rx_buf->hif_dev;
-	struct sk_buff *skb = rx_buf->skb;
+	struct sk_buff *skb = (struct sk_buff *) urb->context;
 	struct sk_buff *nskb;
+	struct hif_device_usb *hif_dev =
+		usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
 	int ret;
 
 	if (!skb)
@@ -747,7 +746,6 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
 	return;
 free:
 	kfree_skb(skb);
-	kfree(rx_buf);
 	urb->context = NULL;
 }
 
@@ -793,7 +791,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
 	init_usb_anchor(&hif_dev->mgmt_submitted);
 
 	for (i = 0; i < MAX_TX_URB_NUM; i++) {
-		tx_buf = kzalloc(sizeof(*tx_buf), GFP_KERNEL);
+		tx_buf = kzalloc(sizeof(struct tx_buf), GFP_KERNEL);
 		if (!tx_buf)
 			goto err;
 
@@ -830,9 +828,8 @@ static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev)
 
 static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
 {
-	struct rx_buf *rx_buf = NULL;
-	struct sk_buff *skb = NULL;
 	struct urb *urb = NULL;
+	struct sk_buff *skb = NULL;
 	int i, ret;
 
 	init_usb_anchor(&hif_dev->rx_submitted);
@@ -840,12 +837,6 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
 
 	for (i = 0; i < MAX_RX_URB_NUM; i++) {
 
-		rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
-		if (!rx_buf) {
-			ret = -ENOMEM;
-			goto err_rxb;
-		}
-
 		/* Allocate URB */
 		urb = usb_alloc_urb(0, GFP_KERNEL);
 		if (urb == NULL) {
@@ -860,14 +851,11 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
 			goto err_skb;
 		}
 
-		rx_buf->hif_dev = hif_dev;
-		rx_buf->skb = skb;
-
 		usb_fill_bulk_urb(urb, hif_dev->udev,
 				  usb_rcvbulkpipe(hif_dev->udev,
 						  USB_WLAN_RX_PIPE),
 				  skb->data, MAX_RX_BUF_SIZE,
-				  ath9k_hif_usb_rx_cb, rx_buf);
+				  ath9k_hif_usb_rx_cb, skb);
 
 		/* Anchor URB */
 		usb_anchor_urb(urb, &hif_dev->rx_submitted);
@@ -893,8 +881,6 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
 err_skb:
 	usb_free_urb(urb);
 err_urb:
-	kfree(rx_buf);
-err_rxb:
 	ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
 	return ret;
 }
@@ -906,21 +892,14 @@ static void ath9k_hif_usb_dealloc_reg_in_urbs(struct hif_device_usb *hif_dev)
 
 static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
 {
-	struct rx_buf *rx_buf = NULL;
-	struct sk_buff *skb = NULL;
 	struct urb *urb = NULL;
+	struct sk_buff *skb = NULL;
 	int i, ret;
 
 	init_usb_anchor(&hif_dev->reg_in_submitted);
 
 	for (i = 0; i < MAX_REG_IN_URB_NUM; i++) {
 
-		rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
-		if (!rx_buf) {
-			ret = -ENOMEM;
-			goto err_rxb;
-		}
-
 		/* Allocate URB */
 		urb = usb_alloc_urb(0, GFP_KERNEL);
 		if (urb == NULL) {
@@ -935,14 +914,11 @@ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
 			goto err_skb;
 		}
 
-		rx_buf->hif_dev = hif_dev;
-		rx_buf->skb = skb;
-
 		usb_fill_int_urb(urb, hif_dev->udev,
 				  usb_rcvintpipe(hif_dev->udev,
 						  USB_REG_IN_PIPE),
 				  skb->data, MAX_REG_IN_BUF_SIZE,
-				  ath9k_hif_usb_reg_in_cb, rx_buf, 1);
+				  ath9k_hif_usb_reg_in_cb, skb, 1);
 
 		/* Anchor URB */
 		usb_anchor_urb(urb, &hif_dev->reg_in_submitted);
@@ -968,8 +944,6 @@ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
 err_skb:
 	usb_free_urb(urb);
 err_urb:
-	kfree(rx_buf);
-err_rxb:
 	ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev);
 	return ret;
 }
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h
index 835264c36595..a95cdf562611 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.h
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.h
@@ -84,11 +84,6 @@ struct tx_buf {
 	struct list_head list;
 };
 
-struct rx_buf {
-	struct sk_buff *skb;
-	struct hif_device_usb *hif_dev;
-};
-
 #define HIF_USB_TX_STOP  BIT(0)
 #define HIF_USB_TX_FLUSH BIT(1)
 

From d4ade537b40723315ccb56e4f1c18e0581425abf Mon Sep 17 00:00:00 2001
From: Boris Burkov <boris@bur.io>
Date: Wed, 17 Jun 2020 11:35:19 -0700
Subject: [PATCH 0168/2658] btrfs: fix fatal extent_buffer readahead vs
 releasepage race

commit 6bf9cd2eed9aee6d742bb9296c994a91f5316949 upstream.

Under somewhat convoluted conditions, it is possible to attempt to
release an extent_buffer that is under io, which triggers a BUG_ON in
btrfs_release_extent_buffer_pages.

This relies on a few different factors. First, extent_buffer reads done
as readahead for searching use WAIT_NONE, so they free the local extent
buffer reference while the io is outstanding. However, they should still
be protected by TREE_REF. However, if the system is doing signficant
reclaim, and simultaneously heavily accessing the extent_buffers, it is
possible for releasepage to race with two concurrent readahead attempts
in a way that leaves TREE_REF unset when the readahead extent buffer is
released.

Essentially, if two tasks race to allocate a new extent_buffer, but the
winner who attempts the first io is rebuffed by a page being locked
(likely by the reclaim itself) then the loser will still go ahead with
issuing the readahead. The loser's call to find_extent_buffer must also
race with the reclaim task reading the extent_buffer's refcount as 1 in
a way that allows the reclaim to re-clear the TREE_REF checked by
find_extent_buffer.

The following represents an example execution demonstrating the race:

            CPU0                                                         CPU1                                           CPU2
reada_for_search                                            reada_for_search
  readahead_tree_block                                        readahead_tree_block
    find_create_tree_block                                      find_create_tree_block
      alloc_extent_buffer                                         alloc_extent_buffer
                                                                  find_extent_buffer // not found
                                                                  allocates eb
                                                                  lock pages
                                                                  associate pages to eb
                                                                  insert eb into radix tree
                                                                  set TREE_REF, refs == 2
                                                                  unlock pages
                                                              read_extent_buffer_pages // WAIT_NONE
                                                                not uptodate (brand new eb)
                                                                                                            lock_page
                                                                if !trylock_page
                                                                  goto unlock_exit // not an error
                                                              free_extent_buffer
                                                                release_extent_buffer
                                                                  atomic_dec_and_test refs to 1
        find_extent_buffer // found
                                                                                                            try_release_extent_buffer
                                                                                                              take refs_lock
                                                                                                              reads refs == 1; no io
          atomic_inc_not_zero refs to 2
          mark_buffer_accessed
            check_buffer_tree_ref
              // not STALE, won't take refs_lock
              refs == 2; TREE_REF set // no action
    read_extent_buffer_pages // WAIT_NONE
                                                                                                              clear TREE_REF
                                                                                                              release_extent_buffer
                                                                                                                atomic_dec_and_test refs to 1
                                                                                                                unlock_page
      still not uptodate (CPU1 read failed on trylock_page)
      locks pages
      set io_pages > 0
      submit io
      return
    free_extent_buffer
      release_extent_buffer
        dec refs to 0
        delete from radix tree
        btrfs_release_extent_buffer_pages
          BUG_ON(io_pages > 0)!!!

We observe this at a very low rate in production and were also able to
reproduce it in a test environment by introducing some spurious delays
and by introducing probabilistic trylock_page failures.

To fix it, we apply check_tree_ref at a point where it could not
possibly be unset by a competing task: after io_pages has been
incremented. All the codepaths that clear TREE_REF check for io, so they
would not be able to clear it after this point until the io is done.

Stack trace, for reference:
[1417839.424739] ------------[ cut here ]------------
[1417839.435328] kernel BUG at fs/btrfs/extent_io.c:4841!
[1417839.447024] invalid opcode: 0000 [#1] SMP
[1417839.502972] RIP: 0010:btrfs_release_extent_buffer_pages+0x20/0x1f0
[1417839.517008] Code: ed e9 ...
[1417839.558895] RSP: 0018:ffffc90020bcf798 EFLAGS: 00010202
[1417839.570816] RAX: 0000000000000002 RBX: ffff888102d6def0 RCX: 0000000000000028
[1417839.586962] RDX: 0000000000000002 RSI: ffff8887f0296482 RDI: ffff888102d6def0
[1417839.603108] RBP: ffff88885664a000 R08: 0000000000000046 R09: 0000000000000238
[1417839.619255] R10: 0000000000000028 R11: ffff88885664af68 R12: 0000000000000000
[1417839.635402] R13: 0000000000000000 R14: ffff88875f573ad0 R15: ffff888797aafd90
[1417839.651549] FS:  00007f5a844fa700(0000) GS:ffff88885f680000(0000) knlGS:0000000000000000
[1417839.669810] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[1417839.682887] CR2: 00007f7884541fe0 CR3: 000000049f609002 CR4: 00000000003606e0
[1417839.699037] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[1417839.715187] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[1417839.731320] Call Trace:
[1417839.737103]  release_extent_buffer+0x39/0x90
[1417839.746913]  read_block_for_search.isra.38+0x2a3/0x370
[1417839.758645]  btrfs_search_slot+0x260/0x9b0
[1417839.768054]  btrfs_lookup_file_extent+0x4a/0x70
[1417839.778427]  btrfs_get_extent+0x15f/0x830
[1417839.787665]  ? submit_extent_page+0xc4/0x1c0
[1417839.797474]  ? __do_readpage+0x299/0x7a0
[1417839.806515]  __do_readpage+0x33b/0x7a0
[1417839.815171]  ? btrfs_releasepage+0x70/0x70
[1417839.824597]  extent_readpages+0x28f/0x400
[1417839.833836]  read_pages+0x6a/0x1c0
[1417839.841729]  ? startup_64+0x2/0x30
[1417839.849624]  __do_page_cache_readahead+0x13c/0x1a0
[1417839.860590]  filemap_fault+0x6c7/0x990
[1417839.869252]  ? xas_load+0x8/0x80
[1417839.876756]  ? xas_find+0x150/0x190
[1417839.884839]  ? filemap_map_pages+0x295/0x3b0
[1417839.894652]  __do_fault+0x32/0x110
[1417839.902540]  __handle_mm_fault+0xacd/0x1000
[1417839.912156]  handle_mm_fault+0xaa/0x1c0
[1417839.921004]  __do_page_fault+0x242/0x4b0
[1417839.930044]  ? page_fault+0x8/0x30
[1417839.937933]  page_fault+0x1e/0x30
[1417839.945631] RIP: 0033:0x33c4bae
[1417839.952927] Code: Bad RIP value.
[1417839.960411] RSP: 002b:00007f5a844f7350 EFLAGS: 00010206
[1417839.972331] RAX: 000000000000006e RBX: 1614b3ff6a50398a RCX: 0000000000000000
[1417839.988477] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
[1417840.004626] RBP: 00007f5a844f7420 R08: 000000000000006e R09: 00007f5a94aeccb8
[1417840.020784] R10: 00007f5a844f7350 R11: 0000000000000000 R12: 00007f5a94aecc79
[1417840.036932] R13: 00007f5a94aecc78 R14: 00007f5a94aecc90 R15: 00007f5a94aecc40

CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Boris Burkov <boris@bur.io>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/extent_io.c | 40 ++++++++++++++++++++++++----------------
 1 file changed, 24 insertions(+), 16 deletions(-)

diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 2c86c472f670..42b7409d4cc5 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -4861,25 +4861,28 @@ struct extent_buffer *alloc_dummy_extent_buffer(struct btrfs_fs_info *fs_info,
 static void check_buffer_tree_ref(struct extent_buffer *eb)
 {
 	int refs;
-	/* the ref bit is tricky.  We have to make sure it is set
-	 * if we have the buffer dirty.   Otherwise the
-	 * code to free a buffer can end up dropping a dirty
-	 * page
+	/*
+	 * The TREE_REF bit is first set when the extent_buffer is added
+	 * to the radix tree. It is also reset, if unset, when a new reference
+	 * is created by find_extent_buffer.
 	 *
-	 * Once the ref bit is set, it won't go away while the
-	 * buffer is dirty or in writeback, and it also won't
-	 * go away while we have the reference count on the
-	 * eb bumped.
+	 * It is only cleared in two cases: freeing the last non-tree
+	 * reference to the extent_buffer when its STALE bit is set or
+	 * calling releasepage when the tree reference is the only reference.
 	 *
-	 * We can't just set the ref bit without bumping the
-	 * ref on the eb because free_extent_buffer might
-	 * see the ref bit and try to clear it.  If this happens
-	 * free_extent_buffer might end up dropping our original
-	 * ref by mistake and freeing the page before we are able
-	 * to add one more ref.
+	 * In both cases, care is taken to ensure that the extent_buffer's
+	 * pages are not under io. However, releasepage can be concurrently
+	 * called with creating new references, which is prone to race
+	 * conditions between the calls to check_buffer_tree_ref in those
+	 * codepaths and clearing TREE_REF in try_release_extent_buffer.
 	 *
-	 * So bump the ref count first, then set the bit.  If someone
-	 * beat us to it, drop the ref we added.
+	 * The actual lifetime of the extent_buffer in the radix tree is
+	 * adequately protected by the refcount, but the TREE_REF bit and
+	 * its corresponding reference are not. To protect against this
+	 * class of races, we call check_buffer_tree_ref from the codepaths
+	 * which trigger io after they set eb->io_pages. Note that once io is
+	 * initiated, TREE_REF can no longer be cleared, so that is the
+	 * moment at which any such race is best fixed.
 	 */
 	refs = atomic_read(&eb->refs);
 	if (refs >= 2 && test_bit(EXTENT_BUFFER_TREE_REF, &eb->bflags))
@@ -5346,6 +5349,11 @@ int read_extent_buffer_pages(struct extent_io_tree *tree,
 	clear_bit(EXTENT_BUFFER_READ_ERR, &eb->bflags);
 	eb->read_mirror = 0;
 	atomic_set(&eb->io_pages, num_reads);
+	/*
+	 * It is possible for releasepage to clear the TREE_REF bit before we
+	 * set io_pages. See check_buffer_tree_ref for a more detailed comment.
+	 */
+	check_buffer_tree_ref(eb);
 	for (i = start_i; i < num_pages; i++) {
 		page = eb->pages[i];
 		if (!PageUptodate(page)) {

From e471b6345fc955f2a5bf0f830761c5ef5186b87e Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Mon, 6 Jul 2020 05:28:57 -0700
Subject: [PATCH 0169/2658] drm/radeon: fix double free

commit 41855a898650803e24b284173354cc3e44d07725 upstream.

clang static analysis flags this error

drivers/gpu/drm/radeon/ci_dpm.c:5652:9: warning: Use of memory after it is freed [unix.Malloc]
                kfree(rdev->pm.dpm.ps[i].ps_priv);
                      ^~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/radeon/ci_dpm.c:5654:2: warning: Attempt to free released memory [unix.Malloc]
        kfree(rdev->pm.dpm.ps);
        ^~~~~~~~~~~~~~~~~~~~~~

problem is reported in ci_dpm_fini, with these code blocks.

	for (i = 0; i < rdev->pm.dpm.num_ps; i++) {
		kfree(rdev->pm.dpm.ps[i].ps_priv);
	}
	kfree(rdev->pm.dpm.ps);

The first free happens in ci_parse_power_table where it cleans up locally
on a failure.  ci_dpm_fini also does a cleanup.

	ret = ci_parse_power_table(rdev);
	if (ret) {
		ci_dpm_fini(rdev);
		return ret;
	}

So remove the cleanup in ci_parse_power_table and
move the num_ps calculation to inside the loop so ci_dpm_fini
will know how many array elements to free.

Fixes: cc8dbbb4f62a ("drm/radeon: add dpm support for CI dGPUs (v2)")

Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/radeon/ci_dpm.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index 2ccf81168d1e..e7a245d7bdbc 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -5554,6 +5554,7 @@ static int ci_parse_power_table(struct radeon_device *rdev)
 	if (!rdev->pm.dpm.ps)
 		return -ENOMEM;
 	power_state_offset = (u8 *)state_array->states;
+	rdev->pm.dpm.num_ps = 0;
 	for (i = 0; i < state_array->ucNumEntries; i++) {
 		u8 *idx;
 		power_state = (union pplib_power_state *)power_state_offset;
@@ -5563,10 +5564,8 @@ static int ci_parse_power_table(struct radeon_device *rdev)
 		if (!rdev->pm.power_state[i].clock_info)
 			return -EINVAL;
 		ps = kzalloc(sizeof(struct ci_ps), GFP_KERNEL);
-		if (ps == NULL) {
-			kfree(rdev->pm.dpm.ps);
+		if (ps == NULL)
 			return -ENOMEM;
-		}
 		rdev->pm.dpm.ps[i].ps_priv = ps;
 		ci_parse_pplib_non_clock_info(rdev, &rdev->pm.dpm.ps[i],
 					      non_clock_info,
@@ -5588,8 +5587,8 @@ static int ci_parse_power_table(struct radeon_device *rdev)
 			k++;
 		}
 		power_state_offset += 2 + power_state->v2.ucNumDPMLevels;
+		rdev->pm.dpm.num_ps = i + 1;
 	}
-	rdev->pm.dpm.num_ps = state_array->ucNumEntries;
 
 	/* fill in the vce power states */
 	for (i = 0; i < RADEON_MAX_VCE_LEVELS; i++) {

From 6ddfd6fb9466e113ab671a9a4c0b35882018d0ac Mon Sep 17 00:00:00 2001
From: Vineet Gupta <vgupta@synopsys.com>
Date: Tue, 19 May 2020 22:28:32 -0700
Subject: [PATCH 0170/2658] ARC: entry: fix potential EFA clobber when
 TIF_SYSCALL_TRACE

commit 00fdec98d9881bf5173af09aebd353ab3b9ac729 upstream.

Trap handler for syscall tracing reads EFA (Exception Fault Address),
in case strace wants PC of trap instruction (EFA is not part of pt_regs
as of current code).

However this EFA read is racy as it happens after dropping to pure
kernel mode (re-enabling interrupts). A taken interrupt could
context-switch, trigger a different task's trap, clobbering EFA for this
execution context.

Fix this by reading EFA early, before re-enabling interrupts. A slight
side benefit is de-duplication of FAKE_RET_FROM_EXCPN in trap handler.
The trap handler is common to both ARCompact and ARCv2 builds too.

This just came out of code rework/review and no real problem was reported
but is clearly a potential problem specially for strace.

Cc: <stable@vger.kernel.org>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arc/kernel/entry.S | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S
index db1eee5fe502..5e3f1edf5a29 100644
--- a/arch/arc/kernel/entry.S
+++ b/arch/arc/kernel/entry.S
@@ -168,7 +168,6 @@ END(EV_Extension)
 tracesys:
 	; save EFA in case tracer wants the PC of traced task
 	; using ERET won't work since next-PC has already committed
-	lr  r12, [efa]
 	GET_CURR_TASK_FIELD_PTR   TASK_THREAD, r11
 	st  r12, [r11, THREAD_FAULT_ADDR]	; thread.fault_address
 
@@ -211,15 +210,9 @@ tracesys_exit:
 ; Breakpoint TRAP
 ; ---------------------------------------------
 trap_with_param:
-
-	; stop_pc info by gdb needs this info
-	lr  r0, [efa]
+	mov r0, r12	; EFA in case ptracer/gdb wants stop_pc
 	mov r1, sp
 
-	; Now that we have read EFA, it is safe to do "fake" rtie
-	;   and get out of CPU exception mode
-	FAKE_RET_FROM_EXCPN
-
 	; Save callee regs in case gdb wants to have a look
 	; SP will grow up by size of CALLEE Reg-File
 	; NOTE: clobbers r12
@@ -246,6 +239,10 @@ ENTRY(EV_Trap)
 
 	EXCEPTION_PROLOGUE
 
+	lr  r12, [efa]
+
+	FAKE_RET_FROM_EXCPN
+
 	;============ TRAP 1   :breakpoints
 	; Check ECR for trap with arg (PROLOGUE ensures r9 has ECR)
 	bmsk.f 0, r9, 7
@@ -253,9 +250,6 @@ ENTRY(EV_Trap)
 
 	;============ TRAP  (no param): syscall top level
 
-	; First return from Exception to pure K mode (Exception/IRQs renabled)
-	FAKE_RET_FROM_EXCPN
-
 	; If syscall tracing ongoing, invoke pre-post-hooks
 	GET_CURR_THR_INFO_FLAGS   r10
 	btst r10, TIF_SYSCALL_TRACE

From 516914966be0b9c6fb14f23af6e2098989fd790e Mon Sep 17 00:00:00 2001
From: Vineet Gupta <vgupta@synopsys.com>
Date: Wed, 27 May 2020 14:18:45 -0700
Subject: [PATCH 0171/2658] ARC: elf: use right ELF_ARCH

commit b7faf971081a4e56147f082234bfff55135305cb upstream.

Cc: <stable@vger.kernel.org>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arc/include/asm/elf.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arc/include/asm/elf.h b/arch/arc/include/asm/elf.h
index 8ee9113b2f8b..b060eb8ad91b 100644
--- a/arch/arc/include/asm/elf.h
+++ b/arch/arc/include/asm/elf.h
@@ -27,7 +27,7 @@
 #define  R_ARC_S25W_PCREL	0x11
 
 /*to set parameters in the core dumps */
-#define ELF_ARCH		EM_ARCOMPACT
+#define ELF_ARCH		EM_ARC_INUSE
 #define ELF_CLASS		ELFCLASS32
 
 #ifdef CONFIG_CPU_BIG_ENDIAN

From 93cd640c735ee51bf973dc9011f515ac199e59ff Mon Sep 17 00:00:00 2001
From: Davide Caratti <dcaratti@redhat.com>
Date: Fri, 10 Jul 2020 12:55:08 +0200
Subject: [PATCH 0172/2658] bnxt_en: fix NULL dereference in case SR-IOV
 configuration fails

commit c8b1d7436045d3599bae56aef1682813ecccaad7 upstream.

we need to set 'active_vfs' back to 0, if something goes wrong during the
allocation of SR-IOV resources: otherwise, further VF configurations will
wrongly assume that bp->pf.vf[x] are valid memory locations, and commands
like the ones in the following sequence:

 # echo 2 >/sys/bus/pci/devices/${ADDR}/sriov_numvfs
 # ip link set dev ens1f0np0 up
 # ip link set dev ens1f0np0 vf 0 trust on

will cause a kernel crash similar to this:

 bnxt_en 0000:3b:00.0: not enough MMIO resources for SR-IOV
 BUG: kernel NULL pointer dereference, address: 0000000000000014
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: 0000 [#1] SMP PTI
 CPU: 43 PID: 2059 Comm: ip Tainted: G          I       5.8.0-rc2.upstream+ #871
 Hardware name: Dell Inc. PowerEdge R740/08D89F, BIOS 2.2.11 06/13/2019
 RIP: 0010:bnxt_set_vf_trust+0x5b/0x110 [bnxt_en]
 Code: 44 24 58 31 c0 e8 f5 fb ff ff 85 c0 0f 85 b6 00 00 00 48 8d 1c 5b 41 89 c6 b9 0b 00 00 00 48 c1 e3 04 49 03 9c 24 f0 0e 00 00 <8b> 43 14 89 c2 83 c8 10 83 e2 ef 45 84 ed 49 89 e5 0f 44 c2 4c 89
 RSP: 0018:ffffac6246a1f570 EFLAGS: 00010246
 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000b
 RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff98b28f538900
 RBP: ffff98b28f538900 R08: 0000000000000000 R09: 0000000000000008
 R10: ffffffffb9515be0 R11: ffffac6246a1f678 R12: ffff98b28f538000
 R13: 0000000000000001 R14: 0000000000000000 R15: ffffffffc05451e0
 FS:  00007fde0f688800(0000) GS:ffff98baffd40000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000014 CR3: 000000104bb0a003 CR4: 00000000007606e0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 PKRU: 55555554
 Call Trace:
  do_setlink+0x994/0xfe0
  __rtnl_newlink+0x544/0x8d0
  rtnl_newlink+0x47/0x70
  rtnetlink_rcv_msg+0x29f/0x350
  netlink_rcv_skb+0x4a/0x110
  netlink_unicast+0x21d/0x300
  netlink_sendmsg+0x329/0x450
  sock_sendmsg+0x5b/0x60
  ____sys_sendmsg+0x204/0x280
  ___sys_sendmsg+0x88/0xd0
  __sys_sendmsg+0x5e/0xa0
  do_syscall_64+0x47/0x80
  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: c0c050c58d840 ("bnxt_en: New Broadcom ethernet driver.")
Reported-by: Fei Liu <feliu@redhat.com>
CC: Jonathan Toppins <jtoppins@redhat.com>
CC: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Acked-by: Jonathan Toppins <jtoppins@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
index 3eebb57975e3..dd2c64e2db5c 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
@@ -295,6 +295,7 @@ static void bnxt_free_vf_resources(struct bnxt *bp)
 		}
 	}
 
+	bp->pf.active_vfs = 0;
 	kfree(bp->pf.vf);
 	bp->pf.vf = NULL;
 }
@@ -535,7 +536,6 @@ void bnxt_sriov_disable(struct bnxt *bp)
 
 	bnxt_free_vf_resources(bp);
 
-	bp->pf.active_vfs = 0;
 	bp->pf.max_pf_rx_rings = bp->pf.max_rx_rings;
 	bp->pf.max_pf_tx_rings = bp->pf.max_tx_rings;
 }

From 391ae93ed7c42bd126f9f146a562d2df5583e6de Mon Sep 17 00:00:00 2001
From: Sabrina Dubroca <sd@queasysnail.net>
Date: Fri, 3 Jul 2020 17:00:32 +0200
Subject: [PATCH 0173/2658] ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg

[ Upstream commit 5eff06902394425c722f0a44d9545909a8800f79 ]

IPv4 ping sockets don't set fl4.fl4_icmp_{type,code}, which leads to
incomplete IPsec ACQUIRE messages being sent to userspace. Currently,
both raw sockets and IPv6 ping sockets set those fields.

Expected output of "ip xfrm monitor":
    acquire proto esp
      sel src 10.0.2.15/32 dst 8.8.8.8/32 proto icmp type 8 code 0 dev ens4
      policy src 10.0.2.15/32 dst 8.8.8.8/32
        <snip>

Currently with ping sockets:
    acquire proto esp
      sel src 10.0.2.15/32 dst 8.8.8.8/32 proto icmp type 0 code 0 dev ens4
      policy src 10.0.2.15/32 dst 8.8.8.8/32
        <snip>

The Libreswan test suite found this problem after Fedora changed the
value for the sysctl net.ipv4.ping_group_range.

Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
Reported-by: Paul Wouters <pwouters@redhat.com>
Tested-by: Paul Wouters <pwouters@redhat.com>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/ping.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index c0b633ee6c1e..3c698f575eb3 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -803,6 +803,9 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 			   inet_sk_flowi_flags(sk), faddr, saddr, 0, 0,
 			   sk->sk_uid);
 
+	fl4.fl4_icmp_type = user_icmph.type;
+	fl4.fl4_icmp_code = user_icmph.code;
+
 	security_sk_classify_flow(sk, flowi4_to_flowi(&fl4));
 	rt = ip_route_output_flow(net, &fl4, sk);
 	if (IS_ERR(rt)) {

From a3e427c3c8492a536057259790a1ef454ad64da8 Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Tue, 7 Jul 2020 02:02:32 +0800
Subject: [PATCH 0174/2658] l2tp: remove skb_dst_set() from l2tp_xmit_skb()

[ Upstream commit 27d53323664c549b5bb2dfaaf6f7ad6e0376a64e ]

In the tx path of l2tp, l2tp_xmit_skb() calls skb_dst_set() to set
skb's dst. However, it will eventually call inet6_csk_xmit() or
ip_queue_xmit() where skb's dst will be overwritten by:

   skb_dst_set_noref(skb, dst);

without releasing the old dst in skb. Then it causes dst/dev refcnt leak:

  unregister_netdevice: waiting for eth0 to become free. Usage count = 1

This can be reproduced by simply running:

  # modprobe l2tp_eth && modprobe l2tp_ip
  # sh ./tools/testing/selftests/net/l2tp.sh

So before going to inet6_csk_xmit() or ip_queue_xmit(), skb's dst
should be dropped. This patch is to fix it by removing skb_dst_set()
from l2tp_xmit_skb() and moving skb_dst_drop() into l2tp_xmit_core().

Fixes: 3557baabf280 ("[L2TP]: PPP over L2TP driver core")
Reported-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: James Chapman <jchapman@katalix.com>
Tested-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/l2tp/l2tp_core.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 53c53b1c881c..653892ea8f14 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1139,6 +1139,7 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
 
 	/* Queue the packet to IP for output */
 	skb->ignore_df = 1;
+	skb_dst_drop(skb);
 #if IS_ENABLED(CONFIG_IPV6)
 	if (tunnel->sock->sk_family == PF_INET6 && !tunnel->v4mapped)
 		error = inet6_csk_xmit(tunnel->sock, skb, NULL);
@@ -1203,10 +1204,6 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
 		goto out_unlock;
 	}
 
-	/* Get routing info from the tunnel socket */
-	skb_dst_drop(skb);
-	skb_dst_set(skb, sk_dst_check(sk, 0));
-
 	inet = inet_sk(sk);
 	fl = &inet->cork.fl;
 	switch (tunnel->encap) {

From 1c88b510a1c0afbe01d417011e0cbdcdcf7ad569 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Sat, 27 Jun 2020 13:31:50 -0700
Subject: [PATCH 0175/2658] llc: make sure applications use ARPHRD_ETHER

[ Upstream commit a9b1110162357689a34992d5c925852948e5b9fd ]

syzbot was to trigger a bug by tricking AF_LLC with
non sensible addr->sllc_arphrd

It seems clear LLC requires an Ethernet device.

Back in commit abf9d537fea2 ("llc: add support for SO_BINDTODEVICE")
Octavian Purdila added possibility for application to use a zero
value for sllc_arphrd, convert it to ARPHRD_ETHER to not cause
regressions on existing applications.

BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:199 [inline]
BUG: KASAN: use-after-free in list_empty include/linux/list.h:268 [inline]
BUG: KASAN: use-after-free in waitqueue_active include/linux/wait.h:126 [inline]
BUG: KASAN: use-after-free in wq_has_sleeper include/linux/wait.h:160 [inline]
BUG: KASAN: use-after-free in skwq_has_sleeper include/net/sock.h:2092 [inline]
BUG: KASAN: use-after-free in sock_def_write_space+0x642/0x670 net/core/sock.c:2813
Read of size 8 at addr ffff88801e0b4078 by task ksoftirqd/3/27

CPU: 3 PID: 27 Comm: ksoftirqd/3 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
 __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506
 kasan_report+0x12/0x20 mm/kasan/common.c:639
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135
 __read_once_size include/linux/compiler.h:199 [inline]
 list_empty include/linux/list.h:268 [inline]
 waitqueue_active include/linux/wait.h:126 [inline]
 wq_has_sleeper include/linux/wait.h:160 [inline]
 skwq_has_sleeper include/net/sock.h:2092 [inline]
 sock_def_write_space+0x642/0x670 net/core/sock.c:2813
 sock_wfree+0x1e1/0x260 net/core/sock.c:1958
 skb_release_head_state+0xeb/0x260 net/core/skbuff.c:652
 skb_release_all+0x16/0x60 net/core/skbuff.c:663
 __kfree_skb net/core/skbuff.c:679 [inline]
 consume_skb net/core/skbuff.c:838 [inline]
 consume_skb+0xfb/0x410 net/core/skbuff.c:832
 __dev_kfree_skb_any+0xa4/0xd0 net/core/dev.c:2967
 dev_kfree_skb_any include/linux/netdevice.h:3650 [inline]
 e1000_unmap_and_free_tx_resource.isra.0+0x21b/0x3a0 drivers/net/ethernet/intel/e1000/e1000_main.c:1963
 e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3854 [inline]
 e1000_clean+0x4cc/0x1d10 drivers/net/ethernet/intel/e1000/e1000_main.c:3796
 napi_poll net/core/dev.c:6532 [inline]
 net_rx_action+0x508/0x1120 net/core/dev.c:6600
 __do_softirq+0x262/0x98c kernel/softirq.c:292
 run_ksoftirqd kernel/softirq.c:603 [inline]
 run_ksoftirqd+0x8e/0x110 kernel/softirq.c:595
 smpboot_thread_fn+0x6a3/0xa40 kernel/smpboot.c:165
 kthread+0x361/0x430 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Allocated by task 8247:
 save_stack+0x23/0x90 mm/kasan/common.c:72
 set_track mm/kasan/common.c:80 [inline]
 __kasan_kmalloc mm/kasan/common.c:513 [inline]
 __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:486
 kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:521
 slab_post_alloc_hook mm/slab.h:584 [inline]
 slab_alloc mm/slab.c:3320 [inline]
 kmem_cache_alloc+0x121/0x710 mm/slab.c:3484
 sock_alloc_inode+0x1c/0x1d0 net/socket.c:240
 alloc_inode+0x68/0x1e0 fs/inode.c:230
 new_inode_pseudo+0x19/0xf0 fs/inode.c:919
 sock_alloc+0x41/0x270 net/socket.c:560
 __sock_create+0xc2/0x730 net/socket.c:1384
 sock_create net/socket.c:1471 [inline]
 __sys_socket+0x103/0x220 net/socket.c:1513
 __do_sys_socket net/socket.c:1522 [inline]
 __se_sys_socket net/socket.c:1520 [inline]
 __ia32_sys_socket+0x73/0xb0 net/socket.c:1520
 do_syscall_32_irqs_on arch/x86/entry/common.c:337 [inline]
 do_fast_syscall_32+0x27b/0xe16 arch/x86/entry/common.c:408
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139

Freed by task 17:
 save_stack+0x23/0x90 mm/kasan/common.c:72
 set_track mm/kasan/common.c:80 [inline]
 kasan_set_free_info mm/kasan/common.c:335 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/common.c:474
 kasan_slab_free+0xe/0x10 mm/kasan/common.c:483
 __cache_free mm/slab.c:3426 [inline]
 kmem_cache_free+0x86/0x320 mm/slab.c:3694
 sock_free_inode+0x20/0x30 net/socket.c:261
 i_callback+0x44/0x80 fs/inode.c:219
 __rcu_reclaim kernel/rcu/rcu.h:222 [inline]
 rcu_do_batch kernel/rcu/tree.c:2183 [inline]
 rcu_core+0x570/0x1540 kernel/rcu/tree.c:2408
 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2417
 __do_softirq+0x262/0x98c kernel/softirq.c:292

The buggy address belongs to the object at ffff88801e0b4000
 which belongs to the cache sock_inode_cache of size 1152
The buggy address is located 120 bytes inside of
 1152-byte region [ffff88801e0b4000, ffff88801e0b4480)
The buggy address belongs to the page:
page:ffffea0000782d00 refcount:1 mapcount:0 mapping:ffff88807aa59c40 index:0xffff88801e0b4ffd
raw: 00fffe0000000200 ffffea00008e6c88 ffffea0000782d48 ffff88807aa59c40
raw: ffff88801e0b4ffd ffff88801e0b4000 0000000100000003 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88801e0b3f00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
 ffff88801e0b3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88801e0b4000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                                ^
 ffff88801e0b4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88801e0b4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

Fixes: abf9d537fea2 ("llc: add support for SO_BINDTODEVICE")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/llc/af_llc.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 69f1558dfcb7..f613a1007107 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -271,6 +271,10 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr)
 
 	if (!sock_flag(sk, SOCK_ZAPPED))
 		goto out;
+	if (!addr->sllc_arphrd)
+		addr->sllc_arphrd = ARPHRD_ETHER;
+	if (addr->sllc_arphrd != ARPHRD_ETHER)
+		goto out;
 	rc = -ENODEV;
 	if (sk->sk_bound_dev_if) {
 		llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
@@ -328,15 +332,15 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
 	if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr)))
 		goto out;
 	rc = -EAFNOSUPPORT;
-	if (unlikely(addr->sllc_family != AF_LLC))
+	if (!addr->sllc_arphrd)
+		addr->sllc_arphrd = ARPHRD_ETHER;
+	if (unlikely(addr->sllc_family != AF_LLC || addr->sllc_arphrd != ARPHRD_ETHER))
 		goto out;
 	rc = -ENODEV;
 	rcu_read_lock();
 	if (sk->sk_bound_dev_if) {
 		llc->dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if);
 		if (llc->dev) {
-			if (!addr->sllc_arphrd)
-				addr->sllc_arphrd = llc->dev->type;
 			if (is_zero_ether_addr(addr->sllc_mac))
 				memcpy(addr->sllc_mac, llc->dev->dev_addr,
 				       IFHWADDRLEN);

From 3282e310dfc1688a1b7a79b1a1f0de5f2d284067 Mon Sep 17 00:00:00 2001
From: Martin Varghese <martin.varghese@nokia.com>
Date: Sun, 5 Jul 2020 14:23:49 +0530
Subject: [PATCH 0176/2658] net: Added pointer check for dst->ops->neigh_lookup
 in dst_neigh_lookup_skb

[ Upstream commit 394de110a73395de2ca4516b0de435e91b11b604 ]

The packets from tunnel devices (eg bareudp) may have only
metadata in the dst pointer of skb. Hence a pointer check of
neigh_lookup is needed in dst_neigh_lookup_skb

Kernel crashes when packets from bareudp device is processed in
the kernel neighbour subsytem.

[  133.384484] BUG: kernel NULL pointer dereference, address: 0000000000000000
[  133.385240] #PF: supervisor instruction fetch in kernel mode
[  133.385828] #PF: error_code(0x0010) - not-present page
[  133.386603] PGD 0 P4D 0
[  133.386875] Oops: 0010 [#1] SMP PTI
[  133.387275] CPU: 0 PID: 5045 Comm: ping Tainted: G        W         5.8.0-rc2+ #15
[  133.388052] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[  133.391076] RIP: 0010:0x0
[  133.392401] Code: Bad RIP value.
[  133.394029] RSP: 0018:ffffb79980003d50 EFLAGS: 00010246
[  133.396656] RAX: 0000000080000102 RBX: ffff9de2fe0d6600 RCX: ffff9de2fe5e9d00
[  133.399018] RDX: 0000000000000000 RSI: ffff9de2fe5e9d00 RDI: ffff9de2fc21b400
[  133.399685] RBP: ffff9de2fe5e9d00 R08: 0000000000000000 R09: 0000000000000000
[  133.400350] R10: ffff9de2fbc6be22 R11: ffff9de2fe0d6600 R12: ffff9de2fc21b400
[  133.401010] R13: ffff9de2fe0d6628 R14: 0000000000000001 R15: 0000000000000003
[  133.401667] FS:  00007fe014918740(0000) GS:ffff9de2fec00000(0000) knlGS:0000000000000000
[  133.402412] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  133.402948] CR2: ffffffffffffffd6 CR3: 000000003bb72000 CR4: 00000000000006f0
[  133.403611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  133.404270] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  133.404933] Call Trace:
[  133.405169]  <IRQ>
[  133.405367]  __neigh_update+0x5a4/0x8f0
[  133.405734]  arp_process+0x294/0x820
[  133.406076]  ? __netif_receive_skb_core+0x866/0xe70
[  133.406557]  arp_rcv+0x129/0x1c0
[  133.406882]  __netif_receive_skb_one_core+0x95/0xb0
[  133.407340]  process_backlog+0xa7/0x150
[  133.407705]  net_rx_action+0x2af/0x420
[  133.408457]  __do_softirq+0xda/0x2a8
[  133.408813]  asm_call_on_stack+0x12/0x20
[  133.409290]  </IRQ>
[  133.409519]  do_softirq_own_stack+0x39/0x50
[  133.410036]  do_softirq+0x50/0x60
[  133.410401]  __local_bh_enable_ip+0x50/0x60
[  133.410871]  ip_finish_output2+0x195/0x530
[  133.411288]  ip_output+0x72/0xf0
[  133.411673]  ? __ip_finish_output+0x1f0/0x1f0
[  133.412122]  ip_send_skb+0x15/0x40
[  133.412471]  raw_sendmsg+0x853/0xab0
[  133.412855]  ? insert_pfn+0xfe/0x270
[  133.413827]  ? vvar_fault+0xec/0x190
[  133.414772]  sock_sendmsg+0x57/0x80
[  133.415685]  __sys_sendto+0xdc/0x160
[  133.416605]  ? syscall_trace_enter+0x1d4/0x2b0
[  133.417679]  ? __audit_syscall_exit+0x1d9/0x280
[  133.418753]  ? __prepare_exit_to_usermode+0x5d/0x1a0
[  133.419819]  __x64_sys_sendto+0x24/0x30
[  133.420848]  do_syscall_64+0x4d/0x90
[  133.421768]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  133.422833] RIP: 0033:0x7fe013689c03
[  133.423749] Code: Bad RIP value.
[  133.424624] RSP: 002b:00007ffc7288f418 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[  133.425940] RAX: ffffffffffffffda RBX: 000056151fc63720 RCX: 00007fe013689c03
[  133.427225] RDX: 0000000000000040 RSI: 000056151fc63720 RDI: 0000000000000003
[  133.428481] RBP: 00007ffc72890b30 R08: 000056151fc60500 R09: 0000000000000010
[  133.429757] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040
[  133.431041] R13: 000056151fc636e0 R14: 000056151fc616bc R15: 0000000000000080
[  133.432481] Modules linked in: mpls_iptunnel act_mirred act_tunnel_key cls_flower sch_ingress veth mpls_router ip_tunnel bareudp ip6_udp_tunnel udp_tunnel macsec udp_diag inet_diag unix_diag af_packet_diag netlink_diag binfmt_misc xt_MASQUERADE iptable_nat xt_addrtype xt_conntrack nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter bridge stp llc ebtable_filter ebtables overlay ip6table_filter ip6_tables iptable_filter sunrpc ext4 mbcache jbd2 pcspkr i2c_piix4 virtio_balloon joydev ip_tables xfs libcrc32c ata_generic qxl pata_acpi drm_ttm_helper ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm ata_piix libata virtio_net net_failover virtio_console failover virtio_blk i2c_core virtio_pci virtio_ring serio_raw floppy virtio dm_mirror dm_region_hash dm_log dm_mod
[  133.444045] CR2: 0000000000000000
[  133.445082] ---[ end trace f4aeee1958fd1638 ]---
[  133.446236] RIP: 0010:0x0
[  133.447180] Code: Bad RIP value.
[  133.448152] RSP: 0018:ffffb79980003d50 EFLAGS: 00010246
[  133.449363] RAX: 0000000080000102 RBX: ffff9de2fe0d6600 RCX: ffff9de2fe5e9d00
[  133.450835] RDX: 0000000000000000 RSI: ffff9de2fe5e9d00 RDI: ffff9de2fc21b400
[  133.452237] RBP: ffff9de2fe5e9d00 R08: 0000000000000000 R09: 0000000000000000
[  133.453722] R10: ffff9de2fbc6be22 R11: ffff9de2fe0d6600 R12: ffff9de2fc21b400
[  133.455149] R13: ffff9de2fe0d6628 R14: 0000000000000001 R15: 0000000000000003
[  133.456520] FS:  00007fe014918740(0000) GS:ffff9de2fec00000(0000) knlGS:0000000000000000
[  133.458046] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  133.459342] CR2: ffffffffffffffd6 CR3: 000000003bb72000 CR4: 00000000000006f0
[  133.460782] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  133.462240] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  133.463697] Kernel panic - not syncing: Fatal exception in interrupt
[  133.465226] Kernel Offset: 0xfa00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[  133.467025] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---

Fixes: aaa0c23cb901 ("Fix dst_neigh_lookup/dst_neigh_lookup_skb return value handling bug")
Signed-off-by: Martin Varghese <martin.varghese@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/dst.h | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/include/net/dst.h b/include/net/dst.h
index 2e6e3a14a21a..dc1f26da3c61 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -470,7 +470,15 @@ static inline struct neighbour *dst_neigh_lookup(const struct dst_entry *dst, co
 static inline struct neighbour *dst_neigh_lookup_skb(const struct dst_entry *dst,
 						     struct sk_buff *skb)
 {
-	struct neighbour *n =  dst->ops->neigh_lookup(dst, skb, NULL);
+	struct neighbour *n = NULL;
+
+	/* The packets from tunnel devices (eg bareudp) may have only
+	 * metadata in the dst pointer of skb. Hence a pointer check of
+	 * neigh_lookup is needed.
+	 */
+	if (dst->ops->neigh_lookup)
+		n = dst->ops->neigh_lookup(dst, skb, NULL);
+
 	return IS_ERR(n) ? NULL : n;
 }
 

From a1d4b6d242511e72c5656920fdece6c0dfbf24c9 Mon Sep 17 00:00:00 2001
From: Sean Tranchetti <stranche@codeaurora.org>
Date: Tue, 30 Jun 2020 11:50:17 -0600
Subject: [PATCH 0177/2658] genetlink: remove genl_bind

[ Upstream commit 1e82a62fec613844da9e558f3493540a5b7a7b67 ]

A potential deadlock can occur during registering or unregistering a
new generic netlink family between the main nl_table_lock and the
cb_lock where each thread wants the lock held by the other, as
demonstrated below.

1) Thread 1 is performing a netlink_bind() operation on a socket. As part
   of this call, it will call netlink_lock_table(), incrementing the
   nl_table_users count to 1.
2) Thread 2 is registering (or unregistering) a genl_family via the
   genl_(un)register_family() API. The cb_lock semaphore will be taken for
   writing.
3) Thread 1 will call genl_bind() as part of the bind operation to handle
   subscribing to GENL multicast groups at the request of the user. It will
   attempt to take the cb_lock semaphore for reading, but it will fail and
   be scheduled away, waiting for Thread 2 to finish the write.
4) Thread 2 will call netlink_table_grab() during the (un)registration
   call. However, as Thread 1 has incremented nl_table_users, it will not
   be able to proceed, and both threads will be stuck waiting for the
   other.

genl_bind() is a noop, unless a genl_family implements the mcast_bind()
function to handle setting up family-specific multicast operations. Since
no one in-tree uses this functionality as Cong pointed out, simply removing
the genl_bind() function will remove the possibility for deadlock, as there
is no attempt by Thread 1 above to take the cb_lock semaphore.

Fixes: c380d9a7afff ("genetlink: pass multicast bind/unbind to families")
Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Johannes Berg <johannes.berg@intel.com>
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/genetlink.h |  8 -------
 net/netlink/genetlink.c | 52 -----------------------------------------
 2 files changed, 60 deletions(-)

diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index 43c0e771f417..351766331519 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -33,12 +33,6 @@ struct genl_info;
  *	do additional, common, filtering and return an error
  * @post_doit: called after an operation's doit callback, it may
  *	undo operations done by pre_doit, for example release locks
- * @mcast_bind: a socket bound to the given multicast group (which
- *	is given as the offset into the groups array)
- * @mcast_unbind: a socket was unbound from the given multicast group.
- *	Note that unbind() will not be called symmetrically if the
- *	generic netlink family is removed while there are still open
- *	sockets.
  * @attrbuf: buffer to store parsed attributes
  * @family_list: family list
  * @mcgrps: multicast groups used by this family (private)
@@ -61,8 +55,6 @@ struct genl_family {
 	void			(*post_doit)(const struct genl_ops *ops,
 					     struct sk_buff *skb,
 					     struct genl_info *info);
-	int			(*mcast_bind)(struct net *net, int group);
-	void			(*mcast_unbind)(struct net *net, int group);
 	struct nlattr **	attrbuf;	/* private */
 	const struct genl_ops *	ops;		/* private */
 	const struct genl_multicast_group *mcgrps; /* private */
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 8336c9607a70..3fc00c320a9f 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -1007,63 +1007,11 @@ static struct genl_multicast_group genl_ctrl_groups[] = {
 	{ .name = "notify", },
 };
 
-static int genl_bind(struct net *net, int group)
-{
-	int i, err = 0;
-
-	down_read(&cb_lock);
-	for (i = 0; i < GENL_FAM_TAB_SIZE; i++) {
-		struct genl_family *f;
-
-		list_for_each_entry(f, genl_family_chain(i), family_list) {
-			if (group >= f->mcgrp_offset &&
-			    group < f->mcgrp_offset + f->n_mcgrps) {
-				int fam_grp = group - f->mcgrp_offset;
-
-				if (!f->netnsok && net != &init_net)
-					err = -ENOENT;
-				else if (f->mcast_bind)
-					err = f->mcast_bind(net, fam_grp);
-				else
-					err = 0;
-				break;
-			}
-		}
-	}
-	up_read(&cb_lock);
-
-	return err;
-}
-
-static void genl_unbind(struct net *net, int group)
-{
-	int i;
-
-	down_read(&cb_lock);
-	for (i = 0; i < GENL_FAM_TAB_SIZE; i++) {
-		struct genl_family *f;
-
-		list_for_each_entry(f, genl_family_chain(i), family_list) {
-			if (group >= f->mcgrp_offset &&
-			    group < f->mcgrp_offset + f->n_mcgrps) {
-				int fam_grp = group - f->mcgrp_offset;
-
-				if (f->mcast_unbind)
-					f->mcast_unbind(net, fam_grp);
-				break;
-			}
-		}
-	}
-	up_read(&cb_lock);
-}
-
 static int __net_init genl_pernet_init(struct net *net)
 {
 	struct netlink_kernel_cfg cfg = {
 		.input		= genl_rcv,
 		.flags		= NL_CFG_F_NONROOT_RECV,
-		.bind		= genl_bind,
-		.unbind		= genl_unbind,
 	};
 
 	/* we'll bump the group number right afterwards */

From c3fb05baf81b2562a86b8426cb54e3c6c8ae393b Mon Sep 17 00:00:00 2001
From: Christoph Paasch <cpaasch@apple.com>
Date: Wed, 8 Jul 2020 16:18:34 -0700
Subject: [PATCH 0178/2658] tcp: make sure listeners don't initialize
 congestion-control state

[ Upstream commit ce69e563b325f620863830c246a8698ccea52048 ]

syzkaller found its way into setsockopt with TCP_CONGESTION "cdg".
tcp_cdg_init() does a kcalloc to store the gradients. As sk_clone_lock
just copies all the memory, the allocated pointer will be copied as
well, if the app called setsockopt(..., TCP_CONGESTION) on the listener.
If now the socket will be destroyed before the congestion-control
has properly been initialized (through a call to tcp_init_transfer), we
will end up freeing memory that does not belong to that particular
socket, opening the door to a double-free:

[   11.413102] ==================================================================
[   11.414181] BUG: KASAN: double-free or invalid-free in tcp_cleanup_congestion_control+0x58/0xd0
[   11.415329]
[   11.415560] CPU: 3 PID: 4884 Comm: syz-executor.5 Not tainted 5.8.0-rc2 #80
[   11.416544] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
[   11.418148] Call Trace:
[   11.418534]  <IRQ>
[   11.418834]  dump_stack+0x7d/0xb0
[   11.419297]  print_address_description.constprop.0+0x1a/0x210
[   11.422079]  kasan_report_invalid_free+0x51/0x80
[   11.423433]  __kasan_slab_free+0x15e/0x170
[   11.424761]  kfree+0x8c/0x230
[   11.425157]  tcp_cleanup_congestion_control+0x58/0xd0
[   11.425872]  tcp_v4_destroy_sock+0x57/0x5a0
[   11.426493]  inet_csk_destroy_sock+0x153/0x2c0
[   11.427093]  tcp_v4_syn_recv_sock+0xb29/0x1100
[   11.427731]  tcp_get_cookie_sock+0xc3/0x4a0
[   11.429457]  cookie_v4_check+0x13d0/0x2500
[   11.433189]  tcp_v4_do_rcv+0x60e/0x780
[   11.433727]  tcp_v4_rcv+0x2869/0x2e10
[   11.437143]  ip_protocol_deliver_rcu+0x23/0x190
[   11.437810]  ip_local_deliver+0x294/0x350
[   11.439566]  __netif_receive_skb_one_core+0x15d/0x1a0
[   11.441995]  process_backlog+0x1b1/0x6b0
[   11.443148]  net_rx_action+0x37e/0xc40
[   11.445361]  __do_softirq+0x18c/0x61a
[   11.445881]  asm_call_on_stack+0x12/0x20
[   11.446409]  </IRQ>
[   11.446716]  do_softirq_own_stack+0x34/0x40
[   11.447259]  do_softirq.part.0+0x26/0x30
[   11.447827]  __local_bh_enable_ip+0x46/0x50
[   11.448406]  ip_finish_output2+0x60f/0x1bc0
[   11.450109]  __ip_queue_xmit+0x71c/0x1b60
[   11.451861]  __tcp_transmit_skb+0x1727/0x3bb0
[   11.453789]  tcp_rcv_state_process+0x3070/0x4d3a
[   11.456810]  tcp_v4_do_rcv+0x2ad/0x780
[   11.457995]  __release_sock+0x14b/0x2c0
[   11.458529]  release_sock+0x4a/0x170
[   11.459005]  __inet_stream_connect+0x467/0xc80
[   11.461435]  inet_stream_connect+0x4e/0xa0
[   11.462043]  __sys_connect+0x204/0x270
[   11.465515]  __x64_sys_connect+0x6a/0xb0
[   11.466088]  do_syscall_64+0x3e/0x70
[   11.466617]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   11.467341] RIP: 0033:0x7f56046dc469
[   11.467844] Code: Bad RIP value.
[   11.468282] RSP: 002b:00007f5604dccdd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
[   11.469326] RAX: ffffffffffffffda RBX: 000000000068bf00 RCX: 00007f56046dc469
[   11.470379] RDX: 0000000000000010 RSI: 0000000020000000 RDI: 0000000000000004
[   11.471311] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000
[   11.472286] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   11.473341] R13: 000000000041427c R14: 00007f5604dcd5c0 R15: 0000000000000003
[   11.474321]
[   11.474527] Allocated by task 4884:
[   11.475031]  save_stack+0x1b/0x40
[   11.475548]  __kasan_kmalloc.constprop.0+0xc2/0xd0
[   11.476182]  tcp_cdg_init+0xf0/0x150
[   11.476744]  tcp_init_congestion_control+0x9b/0x3a0
[   11.477435]  tcp_set_congestion_control+0x270/0x32f
[   11.478088]  do_tcp_setsockopt.isra.0+0x521/0x1a00
[   11.478744]  __sys_setsockopt+0xff/0x1e0
[   11.479259]  __x64_sys_setsockopt+0xb5/0x150
[   11.479895]  do_syscall_64+0x3e/0x70
[   11.480395]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   11.481097]
[   11.481321] Freed by task 4872:
[   11.481783]  save_stack+0x1b/0x40
[   11.482230]  __kasan_slab_free+0x12c/0x170
[   11.482839]  kfree+0x8c/0x230
[   11.483240]  tcp_cleanup_congestion_control+0x58/0xd0
[   11.483948]  tcp_v4_destroy_sock+0x57/0x5a0
[   11.484502]  inet_csk_destroy_sock+0x153/0x2c0
[   11.485144]  tcp_close+0x932/0xfe0
[   11.485642]  inet_release+0xc1/0x1c0
[   11.486131]  __sock_release+0xc0/0x270
[   11.486697]  sock_close+0xc/0x10
[   11.487145]  __fput+0x277/0x780
[   11.487632]  task_work_run+0xeb/0x180
[   11.488118]  __prepare_exit_to_usermode+0x15a/0x160
[   11.488834]  do_syscall_64+0x4a/0x70
[   11.489326]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Wei Wang fixed a part of these CDG-malloc issues with commit c12014440750
("tcp: memset ca_priv data to 0 properly").

This patch here fixes the listener-scenario: We make sure that listeners
setting the congestion-control through setsockopt won't initialize it
(thus CDG never allocates on listeners). For those who use AF_UNSPEC to
reuse a socket, tcp_disconnect() is changed to cleanup afterwards.

(The issue can be reproduced at least down to v4.4.x.)

Cc: Wei Wang <weiwan@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Fixes: 2b0a8c9eee81 ("tcp: add CDG congestion control")
Signed-off-by: Christoph Paasch <cpaasch@apple.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp.c      | 3 +++
 net/ipv4/tcp_cong.c | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 9b11b91377b7..2d8bbd157500 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2268,6 +2268,9 @@ int tcp_disconnect(struct sock *sk, int flags)
 	tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
 	tp->snd_cwnd_cnt = 0;
 	tp->window_clamp = 0;
+	if (icsk->icsk_ca_ops->release)
+		icsk->icsk_ca_ops->release(sk);
+	memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
 	tcp_set_ca_state(sk, TCP_CA_Open);
 	tcp_clear_retrans(tp);
 	tp->total_retrans = 0;
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index aafe68134763..f6b64efc22e8 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -201,7 +201,7 @@ static void tcp_reinit_congestion_control(struct sock *sk,
 	icsk->icsk_ca_ops = ca;
 	icsk->icsk_ca_setsockopt = 1;
 
-	if (sk->sk_state != TCP_CLOSE)
+	if (!((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
 		tcp_init_congestion_control(sk);
 }
 

From 76eedf2442aafbe685d52a8a0c442ad3bfaa3c98 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Tue, 30 Jun 2020 16:41:01 -0700
Subject: [PATCH 0179/2658] tcp: md5: add missing memory barriers in
 tcp_md5_do_add()/tcp_md5_hash_key()

[ Upstream commit 6a2febec338df7e7699a52d00b2e1207dcf65b28 ]

MD5 keys are read with RCU protection, and tcp_md5_do_add()
might update in-place a prior key.

Normally, typical RCU updates would allocate a new piece
of memory. In this case only key->key and key->keylen might
be updated, and we do not care if an incoming packet could
see the old key, the new one, or some intermediate value,
since changing the key on a live flow is known to be problematic
anyway.

We only want to make sure that in the case key->keylen
is changed, cpus in tcp_md5_hash_key() wont try to use
uninitialized data, or crash because key->keylen was
read twice to feed sg_init_one() and ahash_request_set_crypt()

Fixes: 9ea88a153001 ("tcp: md5: check md5 signature without socket lock")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp.c      | 5 ++++-
 net/ipv4/tcp_ipv4.c | 3 +++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 2d8bbd157500..3c242c98ac99 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3105,9 +3105,12 @@ EXPORT_SYMBOL(tcp_md5_hash_skb_data);
 
 int tcp_md5_hash_key(struct tcp_md5sig_pool *hp, const struct tcp_md5sig_key *key)
 {
+	u8 keylen = key->keylen;
 	struct scatterlist sg;
 
-	sg_init_one(&sg, key->key, key->keylen);
+	smp_rmb(); /* paired with smp_wmb() in tcp_md5_do_add() */
+
+	sg_init_one(&sg, key->key, keylen);
 	return crypto_hash_update(&hp->md5_desc, &sg, key->keylen);
 }
 EXPORT_SYMBOL(tcp_md5_hash_key);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 1763e02103a3..5a0c7f96b0d4 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -937,6 +937,9 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr,
 	if (key) {
 		/* Pre-existing entry - just update that one. */
 		memcpy(key->key, newkey, newkeylen);
+
+		smp_wmb(); /* pairs with smp_rmb() in tcp_md5_hash_key() */
+
 		key->keylen = newkeylen;
 		return 0;
 	}

From 5db7d9d5d41ffec515cc497b81fa4b36bd136ca4 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 1 Jul 2020 11:43:04 -0700
Subject: [PATCH 0180/2658] tcp: md5: refine
 tcp_md5_do_add()/tcp_md5_hash_key() barriers

[ Upstream commit e6ced831ef11a2a06e8d00aad9d4fc05b610bf38 ]

My prior fix went a bit too far, according to Herbert and Mathieu.

Since we accept that concurrent TCP MD5 lookups might see inconsistent
keys, we can use READ_ONCE()/WRITE_ONCE() instead of smp_rmb()/smp_wmb()

Clearing all key->key[] is needed to avoid possible KMSAN reports,
if key->keylen is increased. Since tcp_md5_do_add() is not fast path,
using __GFP_ZERO to clear all struct tcp_md5sig_key is simpler.

data_race() was added in linux-5.8 and will prevent KCSAN reports,
this can safely be removed in stable backports, if data_race() is
not yet backported.

v2: use data_race() both in tcp_md5_hash_key() and tcp_md5_do_add()

Fixes: 6a2febec338d ("tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Marco Elver <elver@google.com>
Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp.c      |  6 +++---
 net/ipv4/tcp_ipv4.c | 14 ++++++++++----
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 3c242c98ac99..227b16b8c223 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3105,12 +3105,12 @@ EXPORT_SYMBOL(tcp_md5_hash_skb_data);
 
 int tcp_md5_hash_key(struct tcp_md5sig_pool *hp, const struct tcp_md5sig_key *key)
 {
-	u8 keylen = key->keylen;
+	u8 keylen = READ_ONCE(key->keylen); /* paired with WRITE_ONCE() in tcp_md5_do_add */
 	struct scatterlist sg;
 
-	smp_rmb(); /* paired with smp_wmb() in tcp_md5_do_add() */
-
 	sg_init_one(&sg, key->key, keylen);
+
+	/* tcp_md5_do_add() might change key->key under us */
 	return crypto_hash_update(&hp->md5_desc, &sg, key->keylen);
 }
 EXPORT_SYMBOL(tcp_md5_hash_key);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 5a0c7f96b0d4..161896d6dabb 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -935,12 +935,18 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr,
 
 	key = tcp_md5_do_lookup(sk, addr, family);
 	if (key) {
-		/* Pre-existing entry - just update that one. */
+		/* Pre-existing entry - just update that one.
+		 * Note that the key might be used concurrently.
+		 */
 		memcpy(key->key, newkey, newkeylen);
 
-		smp_wmb(); /* pairs with smp_rmb() in tcp_md5_hash_key() */
+		/* Pairs with READ_ONCE() in tcp_md5_hash_key().
+		 * Also note that a reader could catch new key->keylen value
+		 * but old key->key[], this is the reason we use __GFP_ZERO
+		 * at sock_kmalloc() time below these lines.
+		 */
+		WRITE_ONCE(key->keylen, newkeylen);
 
-		key->keylen = newkeylen;
 		return 0;
 	}
 
@@ -957,7 +963,7 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr,
 		rcu_assign_pointer(tp->md5sig_info, md5sig);
 	}
 
-	key = sock_kmalloc(sk, sizeof(*key), gfp);
+	key = sock_kmalloc(sk, sizeof(*key), gfp | __GFP_ZERO);
 	if (!key)
 		return -ENOMEM;
 	if (!tcp_alloc_md5sig_pool()) {

From 36e3c35d44fe971e3d6e88a7cd52865aa6699c4e Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 1 Jul 2020 18:39:33 -0700
Subject: [PATCH 0181/2658] tcp: md5: allow changing MD5 keys in all socket
 states

[ Upstream commit 1ca0fafd73c5268e8fc4b997094b8bb2bfe8deea ]

This essentially reverts commit 721230326891 ("tcp: md5: reject TCP_MD5SIG
or TCP_MD5SIG_EXT on established sockets")

Mathieu reported that many vendors BGP implementations can
actually switch TCP MD5 on established flows.

Quoting Mathieu :
   Here is a list of a few network vendors along with their behavior
   with respect to TCP MD5:

   - Cisco: Allows for password to be changed, but within the hold-down
     timer (~180 seconds).
   - Juniper: When password is initially set on active connection it will
     reset, but after that any subsequent password changes no network
     resets.
   - Nokia: No notes on if they flap the tcp connection or not.
   - Ericsson/RedBack: Allows for 2 password (old/new) to co-exist until
     both sides are ok with new passwords.
   - Meta-Switch: Expects the password to be set before a connection is
     attempted, but no further info on whether they reset the TCP
     connection on a change.
   - Avaya: Disable the neighbor, then set password, then re-enable.
   - Zebos: Would normally allow the change when socket connected.

We can revert my prior change because commit 9424e2e7ad93 ("tcp: md5: fix potential
overestimation of TCP option space") removed the leak of 4 kernel bytes to
the wire that was the main reason for my patch.

While doing my investigations, I found a bug when a MD5 key is changed, leading
to these commits that stable teams want to consider before backporting this revert :

 Commit 6a2febec338d ("tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key()")
 Commit e6ced831ef11 ("tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers")

Fixes: 721230326891 "tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets"
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 227b16b8c223..f5cfc467c920 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2605,10 +2605,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
 
 #ifdef CONFIG_TCP_MD5SIG
 	case TCP_MD5SIG:
-		if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))
-			err = tp->af_specific->md5_parse(sk, optval, optlen);
-		else
-			err = -EINVAL;
+		err = tp->af_specific->md5_parse(sk, optval, optlen);
 		break;
 #endif
 	case TCP_USER_TIMEOUT:

From e3c4bb26272d178bb93b9a5bbd65dcacc3d552f1 Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Thu, 2 Jul 2020 13:15:27 +0300
Subject: [PATCH 0182/2658] i2c: eg20t: Load module automatically if ID matches

[ Upstream commit 5f90786b31fb7d1e199a8999d46c4e3aea672e11 ]

The driver can't be loaded automatically because it misses
module alias to be provided. Add corresponding MODULE_DEVICE_TABLE()
call to the driver.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-eg20t.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
index eef3aa6007f1..ffd8f9772096 100644
--- a/drivers/i2c/busses/i2c-eg20t.c
+++ b/drivers/i2c/busses/i2c-eg20t.c
@@ -189,6 +189,7 @@ static const struct pci_device_id pch_pcidev_id[] = {
 	{ PCI_VDEVICE(ROHM, PCI_DEVICE_ID_ML7831_I2C), 1, },
 	{0,}
 };
+MODULE_DEVICE_TABLE(pci, pch_pcidev_id);
 
 static irqreturn_t pch_i2c_handler(int irq, void *pData);
 

From f6a394a33070738bbfbe79b973f66d5f940a8445 Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Fri, 17 Jul 2020 12:36:52 -0400
Subject: [PATCH 0183/2658] Revert "usb/ehci-platform: Set PM runtime as active
 on resume"

This reverts commit 13af14dfadcb95030dc8e2e0cacbffc1990a9772.

Eugeniu Rosca writes:

On Thu, Jul 09, 2020 at 09:00:23AM +0200, Eugeniu Rosca wrote:
>After integrating v4.14.186 commit 5410d158ca2a50 ("usb/ehci-platform:
>Set PM runtime as active on resume") into downstream v4.14.x, we started
>to consistently experience below panic [1] on every second s2ram of
>R-Car H3 Salvator-X Renesas reference board.
>
>After some investigations, we concluded the following:
> - the issue does not exist in vanilla v5.8-rc4+
> - [bisecting shows that] the panic on v4.14.186 is caused by the lack
>   of v5.6-rc1 commit 987351e1ea7772 ("phy: core: Add consumer device
>   link support"). Getting evidence for that is easy. Reverting
>   987351e1ea7772 in vanilla leads to a similar backtrace [2].
>
>Questions:
> - Backporting 987351e1ea7772 ("phy: core: Add consumer device
>   link support") to v4.14.187 looks challenging enough, so probably not
>   worth it. Anybody to contradict this?
> - Assuming no plans to backport the missing mainline commit to v4.14.x,
>   should the following three v4.14.186 commits be reverted on v4.14.x?
>   * baef809ea497a4 ("usb/ohci-platform: Fix a warning when hibernating")
>   * 9f33eff4958885 ("usb/xhci-plat: Set PM runtime as active on resume")
>   * 5410d158ca2a50 ("usb/ehci-platform: Set PM runtime as active on resume")

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/ehci-platform.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c
index 56200650b46b..bd7082f297bb 100644
--- a/drivers/usb/host/ehci-platform.c
+++ b/drivers/usb/host/ehci-platform.c
@@ -375,11 +375,6 @@ static int ehci_platform_resume(struct device *dev)
 	}
 
 	ehci_resume(hcd, priv->reset_on_resume);
-
-	pm_runtime_disable(dev);
-	pm_runtime_set_active(dev);
-	pm_runtime_enable(dev);
-
 	return 0;
 }
 #endif /* CONFIG_PM_SLEEP */

From e8816091b3d3583fd77b6940640b7cdf309655e8 Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Fri, 17 Jul 2020 12:38:19 -0400
Subject: [PATCH 0184/2658] Revert "usb/xhci-plat: Set PM runtime as active on
 resume"

This reverts commit 737c975db35b0117fc5c702072ca2df6f2f7eb63.

Eugeniu Rosca writes:

On Thu, Jul 09, 2020 at 09:00:23AM +0200, Eugeniu Rosca wrote:
>After integrating v4.14.186 commit 5410d158ca2a50 ("usb/ehci-platform:
>Set PM runtime as active on resume") into downstream v4.14.x, we started
>to consistently experience below panic [1] on every second s2ram of
>R-Car H3 Salvator-X Renesas reference board.
>
>After some investigations, we concluded the following:
> - the issue does not exist in vanilla v5.8-rc4+
> - [bisecting shows that] the panic on v4.14.186 is caused by the lack
>   of v5.6-rc1 commit 987351e1ea7772 ("phy: core: Add consumer device
>   link support"). Getting evidence for that is easy. Reverting
>   987351e1ea7772 in vanilla leads to a similar backtrace [2].
>
>Questions:
> - Backporting 987351e1ea7772 ("phy: core: Add consumer device
>   link support") to v4.14.187 looks challenging enough, so probably not
>   worth it. Anybody to contradict this?
> - Assuming no plans to backport the missing mainline commit to v4.14.x,
>   should the following three v4.14.186 commits be reverted on v4.14.x?
>   * baef809ea497a4 ("usb/ohci-platform: Fix a warning when hibernating")
>   * 9f33eff4958885 ("usb/xhci-plat: Set PM runtime as active on resume")
>   * 5410d158ca2a50 ("usb/ehci-platform: Set PM runtime as active on resume")

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/xhci-plat.c | 28 +++-------------------------
 1 file changed, 3 insertions(+), 25 deletions(-)

diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 61ca40088b7e..8abe5b80a6a6 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -347,32 +347,10 @@ static int xhci_plat_runtime_idle(struct device *dev)
 
 static int xhci_plat_runtime_suspend(struct device *dev)
 {
-	struct usb_hcd *hcd = dev_get_drvdata(dev);
-	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
-
-	if (!xhci)
-		return 0;
-
-	dev_dbg(dev, "xhci-plat runtime suspend\n");
-
-	return xhci_suspend(xhci, true);
-}
-
-static int xhci_plat_runtime_resume(struct device *dev)
-{
-	struct usb_hcd *hcd = dev_get_drvdata(dev);
-	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
-	int ret;
-
-	if (!xhci)
-		return 0;
-
-	dev_dbg(dev, "xhci-plat runtime resume\n");
-
-	ret = xhci_resume(xhci, false);
-	pm_runtime_mark_last_busy(dev);
+	struct usb_hcd	*hcd = dev_get_drvdata(dev);
+	struct xhci_hcd	*xhci = hcd_to_xhci(hcd);
 
-	return ret;
+	return xhci_resume(xhci, 0);
 }
 
 static const struct dev_pm_ops xhci_plat_pm_ops = {

From 954d5dd7c323e28a8e2ffebcd4d8710c7ce58b35 Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Fri, 17 Jul 2020 12:39:13 -0400
Subject: [PATCH 0185/2658] Revert "usb/ohci-platform: Fix a warning when
 hibernating"

This reverts commit 652def4c63b99029fe8b898740f97329c26a2fd3.

Eugeniu Rosca writes:

On Thu, Jul 09, 2020 at 09:00:23AM +0200, Eugeniu Rosca wrote:
>After integrating v4.14.186 commit 5410d158ca2a50 ("usb/ehci-platform:
>Set PM runtime as active on resume") into downstream v4.14.x, we started
>to consistently experience below panic [1] on every second s2ram of
>R-Car H3 Salvator-X Renesas reference board.
>
>After some investigations, we concluded the following:
> - the issue does not exist in vanilla v5.8-rc4+
> - [bisecting shows that] the panic on v4.14.186 is caused by the lack
>   of v5.6-rc1 commit 987351e1ea7772 ("phy: core: Add consumer device
>   link support"). Getting evidence for that is easy. Reverting
>   987351e1ea7772 in vanilla leads to a similar backtrace [2].
>
>Questions:
> - Backporting 987351e1ea7772 ("phy: core: Add consumer device
>   link support") to v4.14.187 looks challenging enough, so probably not
>   worth it. Anybody to contradict this?
> - Assuming no plans to backport the missing mainline commit to v4.14.x,
>   should the following three v4.14.186 commits be reverted on v4.14.x?
>   * baef809ea497a4 ("usb/ohci-platform: Fix a warning when hibernating")
>   * 9f33eff4958885 ("usb/xhci-plat: Set PM runtime as active on resume")
>   * 5410d158ca2a50 ("usb/ehci-platform: Set PM runtime as active on resume")

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/ohci-platform.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/usb/host/ohci-platform.c b/drivers/usb/host/ohci-platform.c
index 0e5580e6f35c..c2669f185f65 100644
--- a/drivers/usb/host/ohci-platform.c
+++ b/drivers/usb/host/ohci-platform.c
@@ -339,11 +339,6 @@ static int ohci_platform_resume(struct device *dev)
 	}
 
 	ohci_resume(hcd, false);
-
-	pm_runtime_disable(dev);
-	pm_runtime_set_active(dev);
-	pm_runtime_enable(dev);
-
 	return 0;
 }
 #endif /* CONFIG_PM_SLEEP */

From e5777efa274024ceea6f908654c33a4b585ba10f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
Date: Thu, 28 May 2020 20:35:54 +0200
Subject: [PATCH 0186/2658] usb: gadget: udc: atmel: fix uninitialized read in
 debug printk
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 30517ffeb3bff842e1355cbc32f1959d9dbb5414 ]

Fixed commit moved the assignment of 'req', but did not update a
reference in the DBG() call. Use the argument as it was renamed.

Fixes: 5fb694f96e7c ("usb: gadget: udc: atmel: fix possible oops when unloading module")
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/atmel_usba_udc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index 668ac5e8681b..e6902257d7de 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -843,7 +843,7 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
 	u32 status;
 
 	DBG(DBG_GADGET | DBG_QUEUE, "ep_dequeue: %s, req %p\n",
-			ep->ep.name, req);
+			ep->ep.name, _req);
 
 	spin_lock_irqsave(&udc->lock, flags);
 

From 2917afa56e013254c68106855bca917f3d43a723 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 9 Jul 2020 13:29:36 +0300
Subject: [PATCH 0187/2658] staging: comedi: verify array index is correct
 before using it

[ Upstream commit ef75e14a6c935eec82abac07ab68e388514e39bc ]

This code reads from the array before verifying that "trig" is a valid
index.  If the index is wildly out of bounds then reading from an
invalid address could lead to an Oops.

Fixes: a8c66b684efa ("staging: comedi: addi_apci_1500: rewrite the subdevice support functions")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20200709102936.GA20875@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/comedi/drivers/addi_apci_1500.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c
index 63991c49ff23..79a8799b1262 100644
--- a/drivers/staging/comedi/drivers/addi_apci_1500.c
+++ b/drivers/staging/comedi/drivers/addi_apci_1500.c
@@ -465,9 +465,9 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
 	unsigned int lo_mask = data[5] << shift;
 	unsigned int chan_mask = hi_mask | lo_mask;
 	unsigned int old_mask = (1 << shift) - 1;
-	unsigned int pm = devpriv->pm[trig] & old_mask;
-	unsigned int pt = devpriv->pt[trig] & old_mask;
-	unsigned int pp = devpriv->pp[trig] & old_mask;
+	unsigned int pm;
+	unsigned int pt;
+	unsigned int pp;
 
 	if (trig > 1) {
 		dev_dbg(dev->class_dev,
@@ -480,6 +480,10 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
 		return -EINVAL;
 	}
 
+	pm = devpriv->pm[trig] & old_mask;
+	pt = devpriv->pt[trig] & old_mask;
+	pp = devpriv->pp[trig] & old_mask;
+
 	switch (data[2]) {
 	case COMEDI_DIGITAL_TRIG_DISABLE:
 		/* clear trigger configuration */

From e3499d23a474f4e70ca59d0d9e6195e58faf9e46 Mon Sep 17 00:00:00 2001
From: Jin Yao <yao.jin@linux.intel.com>
Date: Thu, 9 Apr 2020 15:07:55 +0800
Subject: [PATCH 0188/2658] perf stat: Zero all the 'ena' and 'run' array slot
 stats for interval mode

commit 0e0bf1ea1147fcf74eab19c2d3c853cc3740a72f upstream.

As the code comments in perf_stat_process_counter() say, we calculate
counter's data every interval, and the display code shows ps->res_stats
avg value. We need to zero the stats for interval mode.

But the current code only zeros the res_stats[0], it doesn't zero the
res_stats[1] and res_stats[2], which are for ena and run of counter.

This patch zeros the whole res_stats[] for interval mode.

Fixes: 51fd2df1e882 ("perf stat: Fix interval output values")
Signed-off-by: Jin Yao <yao.jin@linux.intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Jin Yao <yao.jin@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lore.kernel.org/lkml/20200409070755.17261-1-yao.jin@linux.intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/util/stat.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tools/perf/util/stat.c b/tools/perf/util/stat.c
index 6ce624cb7001..699c0ec5b9bf 100644
--- a/tools/perf/util/stat.c
+++ b/tools/perf/util/stat.c
@@ -318,8 +318,10 @@ int perf_stat_process_counter(struct perf_stat_config *config,
 	 * interval mode, otherwise overall avg running
 	 * averages will be shown for each interval.
 	 */
-	if (config->interval)
-		init_stats(ps->res_stats);
+	if (config->interval) {
+		for (i = 0; i < 3; i++)
+			init_stats(&ps->res_stats[i]);
+	}
 
 	if (counter->per_pkg)
 		zero_per_pkg(counter);

From a87b0d8dc2b2aa13e763cec8d86a9d2337e3e1b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
Date: Fri, 22 May 2020 14:15:21 +0200
Subject: [PATCH 0189/2658] mtd: rawnand: brcmnand: fix CS0 layout
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 3d3fb3c5be9ce07fa85d8f67fb3922e4613b955b upstream.

Only v3.3-v5.0 have a different CS0 layout.
Controllers before v3.3 use the same layout for every CS.

Fixes: 27c5b17cd1b1 ("mtd: nand: add NAND driver "library" for Broadcom STB NAND controller")
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20200522121524.4161539-3-noltari@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/brcmnand/brcmnand.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
index d125d19a35e4..8278158715c1 100644
--- a/drivers/mtd/nand/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/brcmnand/brcmnand.c
@@ -455,8 +455,9 @@ static int brcmnand_revision_init(struct brcmnand_controller *ctrl)
 	} else {
 		ctrl->cs_offsets = brcmnand_cs_offsets;
 
-		/* v5.0 and earlier has a different CS0 offset layout */
-		if (ctrl->nand_version <= 0x0500)
+		/* v3.3-5.0 have a different CS0 offset layout */
+		if (ctrl->nand_version >= 0x0303 &&
+		    ctrl->nand_version <= 0x0500)
 			ctrl->cs0_offsets = brcmnand_cs_offsets_cs0;
 	}
 

From ba94b37943fbad801064206d896a5dcd3f56f6bc Mon Sep 17 00:00:00 2001
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: Sun, 24 May 2020 16:51:34 -0700
Subject: [PATCH 0190/2658] HID: magicmouse: do not set up autorepeat

commit 6363d2065cd399cf9d6dc9d08c437f8658831100 upstream.

Neither the trackpad, nor the mouse want input core to generate autorepeat
events for their buttons, so let's reset the bit (as hid-input sets it for
these devices based on the usage vendor code).

Cc: stable@vger.kernel.org
Reported-by: Yariv <oigevald+kernel@gmail.com>
Tested-by: Yariv <oigevald+kernel@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-magicmouse.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index d6fa496d0ca2..d15e824e39df 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -451,6 +451,12 @@ static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hd
 		__set_bit(MSC_RAW, input->mscbit);
 	}
 
+	/*
+	 * hid-input may mark device as using autorepeat, but neither
+	 * the trackpad, nor the mouse actually want it.
+	 */
+	__clear_bit(EV_REP, input->evbit);
+
 	return 0;
 }
 

From 280aae111a8a1380ba6db56423833f6ba294aae9 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 4 Oct 2017 16:15:59 +0200
Subject: [PATCH 0191/2658] usb: core: Add a helper function to check the
 validity of EP type in URB

commit e901b9873876ca30a09253731bd3a6b00c44b5b0 upstream.

This patch adds a new helper function to perform a sanity check of the
given URB to see whether it contains a valid endpoint.  It's a light-
weight version of what usb_submit_urb() does, but without the kernel
warning followed by the stack trace, just returns an error code.

Especially for a driver that doesn't parse the descriptor but fills
the URB with the fixed endpoint (e.g. some quirks for non-compliant
devices), this kind of check is preferable at the probe phase before
actually submitting the urb.

Tested-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/urb.c | 30 ++++++++++++++++++++++++++----
 include/linux/usb.h    |  2 ++
 2 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
index d6fcead91b32..c095cde55329 100644
--- a/drivers/usb/core/urb.c
+++ b/drivers/usb/core/urb.c
@@ -185,6 +185,31 @@ EXPORT_SYMBOL_GPL(usb_unanchor_urb);
 
 /*-------------------------------------------------------------------*/
 
+static const int pipetypes[4] = {
+	PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT
+};
+
+/**
+ * usb_urb_ep_type_check - sanity check of endpoint in the given urb
+ * @urb: urb to be checked
+ *
+ * This performs a light-weight sanity check for the endpoint in the
+ * given urb.  It returns 0 if the urb contains a valid endpoint, otherwise
+ * a negative error code.
+ */
+int usb_urb_ep_type_check(const struct urb *urb)
+{
+	const struct usb_host_endpoint *ep;
+
+	ep = usb_pipe_endpoint(urb->dev, urb->pipe);
+	if (!ep)
+		return -EINVAL;
+	if (usb_pipetype(urb->pipe) != pipetypes[usb_endpoint_type(&ep->desc)])
+		return -EINVAL;
+	return 0;
+}
+EXPORT_SYMBOL_GPL(usb_urb_ep_type_check);
+
 /**
  * usb_submit_urb - issue an asynchronous transfer request for an endpoint
  * @urb: pointer to the urb describing the request
@@ -324,9 +349,6 @@ EXPORT_SYMBOL_GPL(usb_unanchor_urb);
  */
 int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
 {
-	static int			pipetypes[4] = {
-		PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT
-	};
 	int				xfertype, max;
 	struct usb_device		*dev;
 	struct usb_host_endpoint	*ep;
@@ -445,7 +467,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
 	 */
 
 	/* Check that the pipe's type matches the endpoint's type */
-	if (usb_pipetype(urb->pipe) != pipetypes[xfertype])
+	if (usb_urb_ep_type_check(urb))
 		dev_WARN(&dev->dev, "BOGUS urb xfer, pipe %x != type %x\n",
 			usb_pipetype(urb->pipe), pipetypes[xfertype]);
 
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 283b35e6514c..898d650bb47d 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1677,6 +1677,8 @@ static inline int usb_urb_dir_out(struct urb *urb)
 	return (urb->transfer_flags & URB_DIR_MASK) == URB_DIR_OUT;
 }
 
+int usb_urb_ep_type_check(const struct urb *urb);
+
 void *usb_alloc_coherent(struct usb_device *dev, size_t size,
 	gfp_t mem_flags, dma_addr_t *dma);
 void usb_free_coherent(struct usb_device *dev, size_t size,

From f1ffe6f0f03b323ef9b47bd960ebf12b15df47bb Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Fri, 10 Jul 2020 15:33:51 +0200
Subject: [PATCH 0192/2658] ALSA: line6: Perform sanity check for each URB
 creation

commit 6e8a914ad619042c5f25a4feb663357c4170fd8d upstream.

LINE6 drivers create stream URBs with a fixed pipe without checking
its validity, and this may lead to a kernel WARNING at the submission
when a malformed USB descriptor is passed.

For avoiding the kernel warning, perform the similar sanity checks for
each pipe type at creating a URB.

Reported-by: syzbot+c190f6858a04ea7fbc52@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/s5hv9iv4hq8.wl-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/line6/capture.c  | 2 ++
 sound/usb/line6/playback.c | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/sound/usb/line6/capture.c b/sound/usb/line6/capture.c
index f518fbbe88de..4250d26166a0 100644
--- a/sound/usb/line6/capture.c
+++ b/sound/usb/line6/capture.c
@@ -269,6 +269,8 @@ int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm)
 		urb->interval = LINE6_ISO_INTERVAL;
 		urb->error_count = 0;
 		urb->complete = audio_in_callback;
+		if (usb_urb_ep_type_check(urb))
+			return -EINVAL;
 	}
 
 	return 0;
diff --git a/sound/usb/line6/playback.c b/sound/usb/line6/playback.c
index 97ed593f6010..500f0b455be9 100644
--- a/sound/usb/line6/playback.c
+++ b/sound/usb/line6/playback.c
@@ -423,6 +423,8 @@ int line6_create_audio_out_urbs(struct snd_line6_pcm *line6pcm)
 		urb->interval = LINE6_ISO_INTERVAL;
 		urb->error_count = 0;
 		urb->complete = audio_out_callback;
+		if (usb_urb_ep_type_check(urb))
+			return -EINVAL;
 	}
 
 	return 0;

From dbac581745da7e089c106093562bb3c921719c2c Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Fri, 10 Jul 2020 18:06:56 +0200
Subject: [PATCH 0193/2658] ALSA: usb-audio: Fix race against the error
 recovery URB submission

commit 9b7e5208a941e2e491a83eb5fa83d889e888fa2f upstream.

USB MIDI driver has an error recovery mechanism to resubmit the URB in
the delayed timer handler, and this may race with the standard start /
stop operations.  Although both start and stop operations themselves
don't race with each other due to the umidi->mutex protection, but
this isn't applied to the timer handler.

For fixing this potential race, the following changes are applied:

- Since the timer handler can't use the mutex, we apply the
  umidi->disc_lock protection at each input stream URB submission;
  this also needs to change the GFP flag to GFP_ATOMIC
- Add a check of the URB refcount and skip if already submitted
- Move the timer cancel call at disconnection to the beginning of the
  procedure; this assures the in-flight timer handler is gone properly
  before killing all pending URBs

Reported-by: syzbot+0f4ecfe6a2c322c81728@syzkaller.appspotmail.com
Reported-by: syzbot+5f1d24c49c1d2c427497@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200710160656.16819-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/midi.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/sound/usb/midi.c b/sound/usb/midi.c
index b21b76690b31..5c4a3d6c4234 100644
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -1475,6 +1475,8 @@ void snd_usbmidi_disconnect(struct list_head *p)
 	spin_unlock_irq(&umidi->disc_lock);
 	up_write(&umidi->disc_rwsem);
 
+	del_timer_sync(&umidi->error_timer);
+
 	for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) {
 		struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i];
 		if (ep->out)
@@ -1501,7 +1503,6 @@ void snd_usbmidi_disconnect(struct list_head *p)
 			ep->in = NULL;
 		}
 	}
-	del_timer_sync(&umidi->error_timer);
 }
 EXPORT_SYMBOL(snd_usbmidi_disconnect);
 
@@ -2258,16 +2259,22 @@ void snd_usbmidi_input_stop(struct list_head *p)
 }
 EXPORT_SYMBOL(snd_usbmidi_input_stop);
 
-static void snd_usbmidi_input_start_ep(struct snd_usb_midi_in_endpoint *ep)
+static void snd_usbmidi_input_start_ep(struct snd_usb_midi *umidi,
+				       struct snd_usb_midi_in_endpoint *ep)
 {
 	unsigned int i;
+	unsigned long flags;
 
 	if (!ep)
 		return;
 	for (i = 0; i < INPUT_URBS; ++i) {
 		struct urb *urb = ep->urbs[i];
-		urb->dev = ep->umidi->dev;
-		snd_usbmidi_submit_urb(urb, GFP_KERNEL);
+		spin_lock_irqsave(&umidi->disc_lock, flags);
+		if (!atomic_read(&urb->use_count)) {
+			urb->dev = ep->umidi->dev;
+			snd_usbmidi_submit_urb(urb, GFP_ATOMIC);
+		}
+		spin_unlock_irqrestore(&umidi->disc_lock, flags);
 	}
 }
 
@@ -2283,7 +2290,7 @@ void snd_usbmidi_input_start(struct list_head *p)
 	if (umidi->input_running || !umidi->opened[1])
 		return;
 	for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i)
-		snd_usbmidi_input_start_ep(umidi->endpoints[i].in);
+		snd_usbmidi_input_start_ep(umidi, umidi->endpoints[i].in);
 	umidi->input_running = 1;
 }
 EXPORT_SYMBOL(snd_usbmidi_input_start);

From 33e2e3c8eb859c358e8248acbb22deeaa1205f80 Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Wed, 8 Jul 2020 06:12:43 -0700
Subject: [PATCH 0194/2658] USB: c67x00: fix use after free in
 c67x00_giveback_urb

commit 211f08347355cba1f769bbf3355816a12b3ddd55 upstream.

clang static analysis flags this error

c67x00-sched.c:489:55: warning: Use of memory after it is freed [unix.Malloc]
        usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
                                                             ^~~~~~~~~~~~
Problem happens in this block of code

	c67x00_release_urb(c67x00, urb);
	usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb);
	spin_unlock(&c67x00->lock);
	usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);

In the call to c67x00_release_urb has this freeing of urbp

	urbp = urb->hcpriv;
	urb->hcpriv = NULL;
	list_del(&urbp->hep_node);
	kfree(urbp);

And so urbp is freed before usb_hcd_giveback_urb uses it as its 3rd
parameter.

Since all is required is the status, pass the status directly as is
done in c64x00_urb_dequeue

Fixes: e9b29ffc519b ("USB: add Cypress c67x00 OTG controller HCD driver")
Signed-off-by: Tom Rix <trix@redhat.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200708131243.24336-1-trix@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/c67x00/c67x00-sched.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/c67x00/c67x00-sched.c b/drivers/usb/c67x00/c67x00-sched.c
index 7311ed61e99a..029c8bc54b7a 100644
--- a/drivers/usb/c67x00/c67x00-sched.c
+++ b/drivers/usb/c67x00/c67x00-sched.c
@@ -500,7 +500,7 @@ c67x00_giveback_urb(struct c67x00_hcd *c67x00, struct urb *urb, int status)
 	c67x00_release_urb(c67x00, urb);
 	usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb);
 	spin_unlock(&c67x00->lock);
-	usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
+	usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, status);
 	spin_lock(&c67x00->lock);
 }
 

From ff5ed9637520b6dd15ba68b06c9953f35d00c6ce Mon Sep 17 00:00:00 2001
From: Peter Chen <peter.chen@nxp.com>
Date: Tue, 7 Jul 2020 14:06:01 +0800
Subject: [PATCH 0195/2658] usb: chipidea: core: add wakeup support for extcon

commit 876d4e1e8298ad1f94d9e9392fc90486755437b4 upstream.

If wakeup event occurred by extcon event, it needs to call
ci_irq again since the first ci_irq calling at extcon notifier
only wakes up controller, but do noop for event handling,
it causes the extcon use case can't work well from low power mode.

Cc: <stable@vger.kernel.org>
Fixes: 3ecb3e09b042 ("usb: chipidea: Use extcon framework for VBUS and ID detect")
Reported-by: Philippe Schenker <philippe.schenker@toradex.com>
Tested-by: Philippe Schenker <philippe.schenker@toradex.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20200707060601.31907-2-peter.chen@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/chipidea/core.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index dee22d8effda..e104c99b3a1f 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -1122,6 +1122,29 @@ static void ci_controller_suspend(struct ci_hdrc *ci)
 	enable_irq(ci->irq);
 }
 
+/*
+ * Handle the wakeup interrupt triggered by extcon connector
+ * We need to call ci_irq again for extcon since the first
+ * interrupt (wakeup int) only let the controller be out of
+ * low power mode, but not handle any interrupts.
+ */
+static void ci_extcon_wakeup_int(struct ci_hdrc *ci)
+{
+	struct ci_hdrc_cable *cable_id, *cable_vbus;
+	u32 otgsc = hw_read_otgsc(ci, ~0);
+
+	cable_id = &ci->platdata->id_extcon;
+	cable_vbus = &ci->platdata->vbus_extcon;
+
+	if (!IS_ERR(cable_id->edev) && ci->is_otg &&
+		(otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS))
+		ci_irq(ci->irq, ci);
+
+	if (!IS_ERR(cable_vbus->edev) && ci->is_otg &&
+		(otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS))
+		ci_irq(ci->irq, ci);
+}
+
 static int ci_controller_resume(struct device *dev)
 {
 	struct ci_hdrc *ci = dev_get_drvdata(dev);
@@ -1148,6 +1171,7 @@ static int ci_controller_resume(struct device *dev)
 		enable_irq(ci->irq);
 		if (ci_otg_is_fsm_mode(ci))
 			ci_otg_fsm_wakeup_by_srp(ci);
+		ci_extcon_wakeup_int(ci);
 	}
 
 	return 0;

From 8aa0003b96c01ec09030cfe04eb0aec3fc4a5d65 Mon Sep 17 00:00:00 2001
From: Zhang Qiang <qiang.zhang@windriver.com>
Date: Mon, 6 Jul 2020 13:14:55 +0800
Subject: [PATCH 0196/2658] usb: gadget: function: fix missing spinlock in
 f_uac1_legacy

commit 8778eb0927ddcd3f431805c37b78fa56481aeed9 upstream.

Add a missing spinlock protection for play_queue, because
the play_queue may be destroyed when the "playback_work"
work func and "f_audio_out_ep_complete" callback func
operate this paly_queue at the same time.

Fixes: c6994e6f067cf ("USB: gadget: add USB Audio Gadget driver")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Zhang Qiang <qiang.zhang@windriver.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/function/f_uac1.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c
index 6a2346b99f55..a7782ce673d6 100644
--- a/drivers/usb/gadget/function/f_uac1.c
+++ b/drivers/usb/gadget/function/f_uac1.c
@@ -336,7 +336,9 @@ static int f_audio_out_ep_complete(struct usb_ep *ep, struct usb_request *req)
 
 	/* Copy buffer is full, add it to the play_queue */
 	if (audio_buf_size - copy_buf->actual < req->actual) {
+		spin_lock_irq(&audio->lock);
 		list_add_tail(&copy_buf->list, &audio->play_queue);
+		spin_unlock_irq(&audio->lock);
 		schedule_work(&audio->playback_work);
 		copy_buf = f_audio_buffer_alloc(audio_buf_size);
 		if (IS_ERR(copy_buf))

From 00aa75ab3c286410245fb1c57c03e857e946953e Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 15 Jul 2020 11:02:45 +0200
Subject: [PATCH 0197/2658] USB: serial: iuu_phoenix: fix memory corruption

commit e7b931bee739e8a77ae216e613d3b99342b6dec0 upstream.

The driver would happily overwrite its write buffer with user data in
256 byte increments due to a removed buffer-space sanity check.

Fixes: 5fcf62b0f1f2 ("tty: iuu_phoenix: fix locking.")
Cc: stable <stable@vger.kernel.org>     # 2.6.31
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/iuu_phoenix.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
index 7ed7d33d6c10..1a966f25b3ef 100644
--- a/drivers/usb/serial/iuu_phoenix.c
+++ b/drivers/usb/serial/iuu_phoenix.c
@@ -717,14 +717,16 @@ static int iuu_uart_write(struct tty_struct *tty, struct usb_serial_port *port,
 	struct iuu_private *priv = usb_get_serial_port_data(port);
 	unsigned long flags;
 
-	if (count > 256)
-		return -ENOMEM;
-
 	spin_lock_irqsave(&priv->lock, flags);
 
+	count = min(count, 256 - priv->writelen);
+	if (count == 0)
+		goto out;
+
 	/* fill the buffer */
 	memcpy(priv->writebuf + priv->writelen, buf, count);
 	priv->writelen += count;
+out:
 	spin_unlock_irqrestore(&priv->lock, flags);
 
 	return count;

From bc1820f237bb076a7a96219a65dd5faad26c0ab1 Mon Sep 17 00:00:00 2001
From: James Hilliard <james.hilliard1@gmail.com>
Date: Tue, 16 Jun 2020 16:04:03 -0600
Subject: [PATCH 0198/2658] USB: serial: cypress_m8: enable Simply Automated
 UPB PIM

commit 5c45d04c5081c1830d674f4d22d4400ea2083afe upstream.

This is a UPB (Universal Powerline Bus) PIM (Powerline Interface Module)
which allows for controlling multiple UPB compatible devices from Linux
using the standard serial interface.

Based on vendor application source code there are two different models
of USB based PIM devices in addition to a number of RS232 based PIM's.

The vendor UPB application source contains the following USB ID's:

	#define USB_PCS_VENDOR_ID 0x04b4
	#define USB_PCS_PIM_PRODUCT_ID 0x5500

	#define USB_SAI_VENDOR_ID 0x17dd
	#define USB_SAI_PIM_PRODUCT_ID 0x5500

The first set of ID's correspond to the PIM variant sold by Powerline
Control Systems while the second corresponds to the Simply Automated
Incorporated PIM. As the product ID for both of these match the default
cypress HID->COM RS232 product ID it assumed that they both use an
internal variant of this HID->COM RS232 converter hardware. However
as the vendor ID for the Simply Automated variant is different we need
to also add it to the cypress_M8 driver so that it is properly
detected.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Link: https://lore.kernel.org/r/20200616220403.1807003-1-james.hilliard1@gmail.com
Cc: stable@vger.kernel.org
[ johan: amend VID define entry ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/cypress_m8.c | 2 ++
 drivers/usb/serial/cypress_m8.h | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
index e92cd1eceefa..2c6587b5c329 100644
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -63,6 +63,7 @@ static const struct usb_device_id id_table_earthmate[] = {
 
 static const struct usb_device_id id_table_cyphidcomrs232[] = {
 	{ USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) },
+	{ USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) },
 	{ USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) },
 	{ USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) },
 	{ }						/* Terminating entry */
@@ -77,6 +78,7 @@ static const struct usb_device_id id_table_combined[] = {
 	{ USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB) },
 	{ USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB_LT20) },
 	{ USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) },
+	{ USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) },
 	{ USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) },
 	{ USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) },
 	{ USB_DEVICE(VENDOR_ID_DAZZLE, PRODUCT_ID_CA42) },
diff --git a/drivers/usb/serial/cypress_m8.h b/drivers/usb/serial/cypress_m8.h
index 119d2e17077b..6d9820bffc20 100644
--- a/drivers/usb/serial/cypress_m8.h
+++ b/drivers/usb/serial/cypress_m8.h
@@ -24,6 +24,9 @@
 #define VENDOR_ID_CYPRESS		0x04b4
 #define PRODUCT_ID_CYPHIDCOM		0x5500
 
+/* Simply Automated HID->COM UPB PIM (using Cypress PID 0x5500) */
+#define VENDOR_ID_SAI			0x17dd
+
 /* FRWD Dongle - a GPS sports watch */
 #define VENDOR_ID_FRWD			0x6737
 #define PRODUCT_ID_CYPHIDCOM_FRWD	0x0001

From c9dbb6b99ff596340ebea1a34fcb13b127f52990 Mon Sep 17 00:00:00 2001
From: Igor Moura <imphilippini@gmail.com>
Date: Tue, 23 Jun 2020 05:11:11 -0300
Subject: [PATCH 0199/2658] USB: serial: ch341: add new Product ID for CH340

commit 5d0136f8e79f8287e6a36780601f0ce797cf11c2 upstream.

Add PID for CH340 that's found on some ESP8266 dev boards made by
LilyGO. The specific device that contains such serial converter can be
seen here: https://github.com/LilyGO/LILYGO-T-OI.

Apparently, it's a regular CH340, but I've confirmed with others that
also bought this board that the PID found on this device (0x7522)
differs from other devices with the "same" converter (0x7523).
Simply adding its PID to the driver and rebuilding it made it work
as expected.

Signed-off-by: Igor Moura <imphilippini@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/ch341.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index e8a8c4fa944f..3ec59c2b4f65 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -71,6 +71,7 @@
 
 static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(0x4348, 0x5523) },
+	{ USB_DEVICE(0x1a86, 0x7522) },
 	{ USB_DEVICE(0x1a86, 0x7523) },
 	{ USB_DEVICE(0x1a86, 0x5523) },
 	{ },

From 1add31b3cad6328bbfce62d4ea72221c94009884 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= <jorgen.storvist@gmail.com>
Date: Tue, 23 Jun 2020 00:13:59 +0200
Subject: [PATCH 0200/2658] USB: serial: option: add GosunCn GM500 series
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 08d4ef5cc9203a113702f24725f6cf4db476c958 upstream.

Add USB IDs for GosunCn GM500 series cellular modules.

RNDIS config:
usb-devices
T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 12 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=305a ProdID=1404 Rev=03.18
S:  Manufacturer=Android
S:  Product=Android
S:  SerialNumber=
C:  #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:  If#=0x0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host
I:  If#=0x1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
I:  If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option

MBIM config:
usb-devices
T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=305a ProdID=1405 Rev=03.18
S:  Manufacturer=Android
S:  Product=Android
S:  SerialNumber=
C:  #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:  If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#=0x3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
I:  If#=0x4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim

ECM config:
usb-devices
T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=305a ProdID=1406 Rev=03.18
S:  Manufacturer=Android
S:  Product=Android
S:  SerialNumber=
C:  #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:  If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#=0x3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
I:  If#=0x4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether

Signed-off-by: Jörgen Storvist <jorgen.storvist@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 326e7109b8f8..a63475949389 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2019,6 +2019,9 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = RSVD(4) | RSVD(5) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff),			/* Fibocom NL678 series */
 	  .driver_info = RSVD(6) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) },			/* GosunCn GM500 RNDIS */
+	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) },			/* GosunCn GM500 MBIM */
+	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) },			/* GosunCn GM500 ECM/NCM */
 	{ } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);

From 868bd7dbe6bf2d4452c001bb0ddcf3877cf8d3a1 Mon Sep 17 00:00:00 2001
From: AceLan Kao <acelan.kao@canonical.com>
Date: Tue, 7 Jul 2020 16:15:53 +0800
Subject: [PATCH 0201/2658] USB: serial: option: add Quectel EG95 LTE modem

commit da6902e5b6dbca9081e3d377f9802d4fd0c5ea59 upstream.

Add support for Quectel Wireless Solutions Co., Ltd. EG95 LTE modem

T:  Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#=  5 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=2c7c ProdID=0195 Rev=03.18
S:  Manufacturer=Android
S:  Product=Android
C:  #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:  If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I:  If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
I:  If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
I:  If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)

Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index a63475949389..52b1092ed57e 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -248,6 +248,7 @@ static void option_instat_callback(struct urb *urb);
 /* These Quectel products use Quectel's vendor ID */
 #define QUECTEL_PRODUCT_EC21			0x0121
 #define QUECTEL_PRODUCT_EC25			0x0125
+#define QUECTEL_PRODUCT_EG95			0x0195
 #define QUECTEL_PRODUCT_BG96			0x0296
 #define QUECTEL_PRODUCT_EP06			0x0306
 
@@ -1095,6 +1096,8 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = RSVD(4) },
 	{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25),
 	  .driver_info = RSVD(4) },
+	{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95),
+	  .driver_info = RSVD(4) },
 	{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
 	  .driver_info = RSVD(4) },
 	{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06),

From 670ffa521923b242213d31af1b847676f18a8f55 Mon Sep 17 00:00:00 2001
From: Alexander Lobakin <alobakin@pm.me>
Date: Tue, 23 Jun 2020 11:09:33 +0000
Subject: [PATCH 0202/2658] virtio: virtio_console: add missing
 MODULE_DEVICE_TABLE() for rproc serial

commit 897c44f0bae574c5fb318c759b060bebf9dd6013 upstream.

rproc_serial_id_table lacks an exposure to module devicetable, so
when remoteproc firmware requests VIRTIO_ID_RPROC_SERIAL, no uevent
is generated and no module autoloading occurs.
Add missing MODULE_DEVICE_TABLE() annotation and move the existing
one for VIRTIO_ID_CONSOLE right to the table itself.

Fixes: 1b6370463e88 ("virtio_console: Add support for remoteproc serial")
Cc: <stable@vger.kernel.org> # v3.8+
Signed-off-by: Alexander Lobakin <alobakin@pm.me>
Reviewed-by: Amit Shah <amit@kernel.org>
Link: https://lore.kernel.org/r/x7C_CbeJtoGMy258nwAXASYz3xgFMFpyzmUvOyZzRnQrgWCREBjaqBOpAUS7ol4NnZYvSVwmTsCG0Ohyfvta-ygw6HMHcoeKK0C3QFiAO_Q=@pm.me
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/char/virtio_console.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 5e0e29ee31d1..226ccb7891d4 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -2155,6 +2155,7 @@ static struct virtio_device_id id_table[] = {
 	{ VIRTIO_ID_CONSOLE, VIRTIO_DEV_ANY_ID },
 	{ 0 },
 };
+MODULE_DEVICE_TABLE(virtio, id_table);
 
 static unsigned int features[] = {
 	VIRTIO_CONSOLE_F_SIZE,
@@ -2167,6 +2168,7 @@ static struct virtio_device_id rproc_serial_id_table[] = {
 #endif
 	{ 0 },
 };
+MODULE_DEVICE_TABLE(virtio, rproc_serial_id_table);
 
 static unsigned int rproc_serial_features[] = {
 };
@@ -2319,6 +2321,5 @@ static void __exit fini(void)
 module_init(init);
 module_exit(fini);
 
-MODULE_DEVICE_TABLE(virtio, id_table);
 MODULE_DESCRIPTION("Virtio console driver");
 MODULE_LICENSE("GPL");

From a67683582b4404e7955114d17f499e97c3d9103f Mon Sep 17 00:00:00 2001
From: Chirantan Ekbote <chirantan@chromium.org>
Date: Tue, 14 Jul 2020 19:26:39 +0900
Subject: [PATCH 0203/2658] fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS

commit 31070f6ccec09f3bd4f1e28cd1e592fa4f3ba0b6 upstream.

The ioctl encoding for this parameter is a long but the documentation says
it should be an int and the kernel drivers expect it to be an int.  If the
fuse driver treats this as a long it might end up scribbling over the stack
of a userspace process that only allocated enough space for an int.

This was previously discussed in [1] and a patch for fuse was proposed in
[2].  From what I can tell the patch in [2] was nacked in favor of adding
new, "fixed" ioctls and using those from userspace.  However there is still
no "fixed" version of these ioctls and the fact is that it's sometimes
infeasible to change all userspace to use the new one.

Handling the ioctls specially in the fuse driver seems like the most
pragmatic way for fuse servers to support them without causing crashes in
userspace applications that call them.

[1]: https://lore.kernel.org/linux-fsdevel/20131126200559.GH20559@hall.aurel32.net/T/
[2]: https://sourceforge.net/p/fuse/mailman/message/31771759/

Signed-off-by: Chirantan Ekbote <chirantan@chromium.org>
Fixes: 59efec7b9039 ("fuse: implement ioctl support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/fuse/file.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 52f1983868a0..9fc6c2597dcc 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -18,6 +18,7 @@
 #include <linux/swap.h>
 #include <linux/falloc.h>
 #include <linux/uio.h>
+#include <linux/fs.h>
 
 static const struct file_operations fuse_direct_io_file_operations;
 
@@ -2592,7 +2593,16 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
 		struct iovec *iov = iov_page;
 
 		iov->iov_base = (void __user *)arg;
-		iov->iov_len = _IOC_SIZE(cmd);
+
+		switch (cmd) {
+		case FS_IOC_GETFLAGS:
+		case FS_IOC_SETFLAGS:
+			iov->iov_len = sizeof(int);
+			break;
+		default:
+			iov->iov_len = _IOC_SIZE(cmd);
+			break;
+		}
 
 		if (_IOC_DIR(cmd) & _IOC_WRITE) {
 			in_iov = iov;

From 2624810180afa012e0eb345ddd04c4382d1d59f0 Mon Sep 17 00:00:00 2001
From: Alexander Usyskin <alexander.usyskin@intel.com>
Date: Mon, 29 Jun 2020 01:53:59 +0300
Subject: [PATCH 0204/2658] mei: bus: don't clean driver pointer

commit e852c2c251ed9c23ae6e3efebc5ec49adb504207 upstream.

It's not needed to set driver to NULL in mei_cl_device_remove()
which is bus_type remove() handler as this is done anyway
in __device_release_driver().

Actually this is causing an endless loop in driver_detach()
on ubuntu patched kernel, while removing (rmmod) the mei_hdcp module.
The reason list_empty(&drv->p->klist_devices.k_list) is always not-empty.
as the check is always true in  __device_release_driver()
	if (dev->driver != drv)
		return;

The non upstream patch is causing this behavior, titled:
'vfio -- release device lock before userspace requests'

Nevertheless the fix is correct also for the upstream.

Link: https://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20180912085046.3401-2-apw@canonical.com/
Cc: <stable@vger.kernel.org>
Cc: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20200628225359.2185929-1-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/mei/bus.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index 864c2dc728a9..4457adb16916 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -626,9 +626,8 @@ static int mei_cl_device_remove(struct device *dev)
 		ret = cldrv->remove(cldev);
 
 	module_put(THIS_MODULE);
-	dev->driver = NULL;
-	return ret;
 
+	return ret;
 }
 
 static ssize_t name_show(struct device *dev, struct device_attribute *a,

From f5afc55abf63d1e359f457468794195bbb10a6c0 Mon Sep 17 00:00:00 2001
From: David Pedersen <limero1337@gmail.com>
Date: Mon, 6 Jul 2020 18:48:51 -0700
Subject: [PATCH 0205/2658] Input: i8042 - add Lenovo XiaoXin Air 12 to i8042
 nomux list

commit 17d51429da722cd8fc77a365a112f008abf4f8b3 upstream.

This fixes two finger trackpad scroll on the Lenovo XiaoXin Air 12.
Without nomux, the trackpad behaves as if only one finger is present and
moves the cursor when trying to scroll.

Signed-off-by: David Pedersen <limero1337@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200625133754.291325-1-limero1337@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/serio/i8042-x86ia64io.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index fd1e79013cf8..bdc42923523e 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -429,6 +429,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "076804U"),
 		},
 	},
+	{
+		/* Lenovo XiaoXin Air 12 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "80UN"),
+		},
+	},
 	{
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),

From f88b1f925b4957837b60234affa2435215fc4687 Mon Sep 17 00:00:00 2001
From: Esben Haabendal <esben@geanix.com>
Date: Wed, 1 Jul 2020 16:56:58 +0200
Subject: [PATCH 0206/2658] uio_pdrv_genirq: fix use without device tree and no
 interrupt

commit bf12fdf0ab728ca8e5933aac46dd972c0dd0421e upstream.

While e3a3c3a20555 ("UIO: fix uio_pdrv_genirq with device tree but no
interrupt") added support for using uio_pdrv_genirq for devices without
interrupt for device tree platforms, the removal of uio_pdrv in
26dac3c49d56 ("uio: Remove uio_pdrv and use uio_pdrv_genirq instead")
broke the support for non device tree platforms.

This change fixes this, so that uio_pdrv_genirq can be used without
interrupt on all platforms.

This still leaves the support that uio_pdrv had for custom interrupt
handler lacking, as uio_pdrv_genirq does not handle it (yet).

Fixes: 26dac3c49d56 ("uio: Remove uio_pdrv and use uio_pdrv_genirq instead")
Signed-off-by: Esben Haabendal <esben@geanix.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200701145659.3978-3-esben@geanix.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/uio/uio_pdrv_genirq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/uio/uio_pdrv_genirq.c b/drivers/uio/uio_pdrv_genirq.c
index f598ecddc8a7..b58a504240c4 100644
--- a/drivers/uio/uio_pdrv_genirq.c
+++ b/drivers/uio/uio_pdrv_genirq.c
@@ -148,7 +148,7 @@ static int uio_pdrv_genirq_probe(struct platform_device *pdev)
 	if (!uioinfo->irq) {
 		ret = platform_get_irq(pdev, 0);
 		uioinfo->irq = ret;
-		if (ret == -ENXIO && pdev->dev.of_node)
+		if (ret == -ENXIO)
 			uioinfo->irq = UIO_IRQ_NONE;
 		else if (ret < 0) {
 			dev_err(&pdev->dev, "failed to get IRQ\n");

From 1f145b457554f24d3310d8a39f374f915a5722db Mon Sep 17 00:00:00 2001
From: Huacai Chen <chenhc@lemote.com>
Date: Thu, 16 Jul 2020 17:39:29 +0800
Subject: [PATCH 0207/2658] MIPS: Fix build for LTS kernel caused by
 backporting lpj adjustment

Commit ed26aacfb5f71eecb20a ("mips: Add udelay lpj numbers adjustment")
has backported to 4.4~5.4, but the "struct cpufreq_freqs" (and also the
cpufreq notifier machanism) of 4.4~4.19 are different from the upstream
kernel. These differences cause build errors, and this patch can fix the
build.

Cc: Serge Semin <Sergey.Semin@baikalelectronics.ru>
Cc: Stable <stable@vger.kernel.org> # 4.4/4.9/4.14/4.19
Signed-off-by: Huacai Chen <chenhc@lemote.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/kernel/time.c | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/arch/mips/kernel/time.c b/arch/mips/kernel/time.c
index 345978cc105b..fbb99c430f13 100644
--- a/arch/mips/kernel/time.c
+++ b/arch/mips/kernel/time.c
@@ -40,10 +40,8 @@ static unsigned long glb_lpj_ref_freq;
 static int cpufreq_callback(struct notifier_block *nb,
 			    unsigned long val, void *data)
 {
-	struct cpufreq_freqs *freq = data;
-	struct cpumask *cpus = freq->policy->cpus;
-	unsigned long lpj;
 	int cpu;
+	struct cpufreq_freqs *freq = data;
 
 	/*
 	 * Skip lpj numbers adjustment if the CPU-freq transition is safe for
@@ -64,6 +62,7 @@ static int cpufreq_callback(struct notifier_block *nb,
 		}
 	}
 
+	cpu = freq->cpu;
 	/*
 	 * Adjust global lpj variable and per-CPU udelay_val number in
 	 * accordance with the new CPU frequency.
@@ -74,12 +73,8 @@ static int cpufreq_callback(struct notifier_block *nb,
 						glb_lpj_ref_freq,
 						freq->new);
 
-		for_each_cpu(cpu, cpus) {
-			lpj = cpufreq_scale(per_cpu(pcp_lpj_ref, cpu),
-					    per_cpu(pcp_lpj_ref_freq, cpu),
-					    freq->new);
-			cpu_data[cpu].udelay_val = (unsigned int)lpj;
-		}
+		cpu_data[cpu].udelay_val = cpufreq_scale(per_cpu(pcp_lpj_ref, cpu),
+					   per_cpu(pcp_lpj_ref_freq, cpu), freq->new);
 	}
 
 	return NOTIFY_OK;

From fffe72a042d9b68e5907346b6180e6a0cd1d0027 Mon Sep 17 00:00:00 2001
From: Vishwas M <vishwas.reddy.vr@gmail.com>
Date: Tue, 7 Jul 2020 19:57:47 +0530
Subject: [PATCH 0208/2658] hwmon: (emc2103) fix unable to change fan
 pwm1_enable attribute

commit 14b0e83dc4f1e52b94acaeb85a18fd7fdd46d2dc upstream.

This patch fixes a bug which does not let FAN mode to be changed from
sysfs(pwm1_enable). i.e pwm1_enable can not be set to 3, it will always
remain at 0.

This is caused because the device driver handles the result of
"read_u8_from_i2c(client, REG_FAN_CONF1, &conf_reg)" incorrectly. The
driver thinks an error has occurred if the (result != 0). This has been
fixed by changing the condition to (result < 0).

Signed-off-by: Vishwas M <vishwas.reddy.vr@gmail.com>
Link: https://lore.kernel.org/r/20200707142747.118414-1-vishwas.reddy.vr@gmail.com
Fixes: 9df7305b5a86 ("hwmon: Add driver for SMSC EMC2103 temperature monitor and fan controller")
Cc: stable@vger.kernel.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hwmon/emc2103.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/emc2103.c b/drivers/hwmon/emc2103.c
index 952fe692d764..0ddb0677e9c8 100644
--- a/drivers/hwmon/emc2103.c
+++ b/drivers/hwmon/emc2103.c
@@ -452,7 +452,7 @@ static ssize_t set_pwm_enable(struct device *dev, struct device_attribute *da,
 	}
 
 	result = read_u8_from_i2c(client, REG_FAN_CONF1, &conf_reg);
-	if (result) {
+	if (result < 0) {
 		count = result;
 		goto err;
 	}

From 4aaa983069dbb8288e6c2dac42ede729c26d3756 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Thu, 11 Jun 2020 14:17:41 +0200
Subject: [PATCH 0209/2658] dmaengine: fsl-edma: Fix NULL pointer exception in
 fsl_edma_tx_handler

commit f5e5677c420346b4e9788051c2e4d750996c428c upstream.

NULL pointer exception happens occasionally on serial output initiated
by login timeout.  This was reproduced only if kernel was built with
significant debugging options and EDMA driver is used with serial
console.

    col-vf50 login: root
    Password:
    Login timed out after 60 seconds.
    Unable to handle kernel NULL pointer dereference at virtual address 00000044
    Internal error: Oops: 5 [#1] ARM
    CPU: 0 PID: 157 Comm: login Not tainted 5.7.0-next-20200610-dirty #4
    Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree)
      (fsl_edma_tx_handler) from [<8016eb10>] (__handle_irq_event_percpu+0x64/0x304)
      (__handle_irq_event_percpu) from [<8016eddc>] (handle_irq_event_percpu+0x2c/0x7c)
      (handle_irq_event_percpu) from [<8016ee64>] (handle_irq_event+0x38/0x5c)
      (handle_irq_event) from [<801729e4>] (handle_fasteoi_irq+0xa4/0x160)
      (handle_fasteoi_irq) from [<8016ddcc>] (generic_handle_irq+0x34/0x44)
      (generic_handle_irq) from [<8016e40c>] (__handle_domain_irq+0x54/0xa8)
      (__handle_domain_irq) from [<80508bc8>] (gic_handle_irq+0x4c/0x80)
      (gic_handle_irq) from [<80100af0>] (__irq_svc+0x70/0x98)
    Exception stack(0x8459fe80 to 0x8459fec8)
    fe80: 72286b00 e3359f64 00000001 0000412d a0070013 85c98840 85c98840 a0070013
    fea0: 8054e0d4 00000000 00000002 00000000 00000002 8459fed0 8081fbe8 8081fbec
    fec0: 60070013 ffffffff
      (__irq_svc) from [<8081fbec>] (_raw_spin_unlock_irqrestore+0x30/0x58)
      (_raw_spin_unlock_irqrestore) from [<8056cb48>] (uart_flush_buffer+0x88/0xf8)
      (uart_flush_buffer) from [<80554e60>] (tty_ldisc_hangup+0x38/0x1ac)
      (tty_ldisc_hangup) from [<8054c7f4>] (__tty_hangup+0x158/0x2bc)
      (__tty_hangup) from [<80557b90>] (disassociate_ctty.part.1+0x30/0x23c)
      (disassociate_ctty.part.1) from [<8011fc18>] (do_exit+0x580/0xba0)
      (do_exit) from [<801214f8>] (do_group_exit+0x3c/0xb4)
      (do_group_exit) from [<80121580>] (__wake_up_parent+0x0/0x14)

Issue looks like race condition between interrupt handler fsl_edma_tx_handler()
(called as result of fsl_edma_xfer_desc()) and terminating the transfer with
fsl_edma_terminate_all().

The fsl_edma_tx_handler() handles interrupt for a transfer with already freed
edesc and idle==true.

Fixes: d6be34fbd39b ("dma: Add Freescale eDMA engine driver support")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1591877861-28156-2-git-send-email-krzk@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/dma/fsl-edma.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/dma/fsl-edma.c b/drivers/dma/fsl-edma.c
index 915eec3cc279..c2bb8486d174 100644
--- a/drivers/dma/fsl-edma.c
+++ b/drivers/dma/fsl-edma.c
@@ -671,6 +671,13 @@ static irqreturn_t fsl_edma_tx_handler(int irq, void *dev_id)
 			fsl_chan = &fsl_edma->chans[ch];
 
 			spin_lock(&fsl_chan->vchan.lock);
+
+			if (!fsl_chan->edesc) {
+				/* terminate_all called before */
+				spin_unlock(&fsl_chan->vchan.lock);
+				continue;
+			}
+
 			if (!fsl_chan->edesc->iscyclic) {
 				list_del(&fsl_chan->edesc->vdesc.node);
 				vchan_cookie_complete(&fsl_chan->edesc->vdesc);

From 2985b15ff45b70e0c75ad64f6faa2723a8422183 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
Date: Wed, 24 Jun 2020 13:35:41 +0200
Subject: [PATCH 0210/2658] misc: atmel-ssc: lock with mutex instead of
 spinlock
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit b037d60a3b1d1227609fd858fa34321f41829911 upstream.

Uninterruptible context is not needed in the driver and causes lockdep
warning because of mutex taken in of_alias_get_id(). Convert the lock to
mutex to avoid the issue.

Cc: stable@vger.kernel.org
Fixes: 099343c64e16 ("ARM: at91: atmel-ssc: add device tree support")
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Link: https://lore.kernel.org/r/50f0d7fa107f318296afb49477c3571e4d6978c5.1592998403.git.mirq-linux@rere.qmqm.pl
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/atmel-ssc.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
index e2474af7386a..ae0f6a1a4be0 100644
--- a/drivers/misc/atmel-ssc.c
+++ b/drivers/misc/atmel-ssc.c
@@ -13,7 +13,7 @@
 #include <linux/clk.h>
 #include <linux/err.h>
 #include <linux/io.h>
-#include <linux/spinlock.h>
+#include <linux/mutex.h>
 #include <linux/atmel-ssc.h>
 #include <linux/slab.h>
 #include <linux/module.h>
@@ -21,7 +21,7 @@
 #include <linux/of.h>
 
 /* Serialize access to ssc_list and user count */
-static DEFINE_SPINLOCK(user_lock);
+static DEFINE_MUTEX(user_lock);
 static LIST_HEAD(ssc_list);
 
 struct ssc_device *ssc_request(unsigned int ssc_num)
@@ -29,7 +29,7 @@ struct ssc_device *ssc_request(unsigned int ssc_num)
 	int ssc_valid = 0;
 	struct ssc_device *ssc;
 
-	spin_lock(&user_lock);
+	mutex_lock(&user_lock);
 	list_for_each_entry(ssc, &ssc_list, list) {
 		if (ssc->pdev->dev.of_node) {
 			if (of_alias_get_id(ssc->pdev->dev.of_node, "ssc")
@@ -44,18 +44,18 @@ struct ssc_device *ssc_request(unsigned int ssc_num)
 	}
 
 	if (!ssc_valid) {
-		spin_unlock(&user_lock);
+		mutex_unlock(&user_lock);
 		pr_err("ssc: ssc%d platform device is missing\n", ssc_num);
 		return ERR_PTR(-ENODEV);
 	}
 
 	if (ssc->user) {
-		spin_unlock(&user_lock);
+		mutex_unlock(&user_lock);
 		dev_dbg(&ssc->pdev->dev, "module busy\n");
 		return ERR_PTR(-EBUSY);
 	}
 	ssc->user++;
-	spin_unlock(&user_lock);
+	mutex_unlock(&user_lock);
 
 	clk_prepare(ssc->clk);
 
@@ -67,14 +67,14 @@ void ssc_free(struct ssc_device *ssc)
 {
 	bool disable_clk = true;
 
-	spin_lock(&user_lock);
+	mutex_lock(&user_lock);
 	if (ssc->user)
 		ssc->user--;
 	else {
 		disable_clk = false;
 		dev_dbg(&ssc->pdev->dev, "device already free\n");
 	}
-	spin_unlock(&user_lock);
+	mutex_unlock(&user_lock);
 
 	if (disable_clk)
 		clk_unprepare(ssc->clk);
@@ -194,9 +194,9 @@ static int ssc_probe(struct platform_device *pdev)
 		return -ENXIO;
 	}
 
-	spin_lock(&user_lock);
+	mutex_lock(&user_lock);
 	list_add_tail(&ssc->list, &ssc_list);
-	spin_unlock(&user_lock);
+	mutex_unlock(&user_lock);
 
 	platform_set_drvdata(pdev, ssc);
 
@@ -210,9 +210,9 @@ static int ssc_remove(struct platform_device *pdev)
 {
 	struct ssc_device *ssc = platform_get_drvdata(pdev);
 
-	spin_lock(&user_lock);
+	mutex_lock(&user_lock);
 	list_del(&ssc->list);
-	spin_unlock(&user_lock);
+	mutex_unlock(&user_lock);
 
 	return 0;
 }

From 336a5a0f31ff6a73b257b145571f4dc6a3c09ab3 Mon Sep 17 00:00:00 2001
From: Vincent Guittot <vincent.guittot@linaro.org>
Date: Fri, 10 Jul 2020 17:24:26 +0200
Subject: [PATCH 0211/2658] sched/fair: handle case of task_h_load() returning
 0

commit 01cfcde9c26d8555f0e6e9aea9d6049f87683998 upstream.

task_h_load() can return 0 in some situations like running stress-ng
mmapfork, which forks thousands of threads, in a sched group on a 224 cores
system. The load balance doesn't handle this correctly because
env->imbalance never decreases and it will stop pulling tasks only after
reaching loop_max, which can be equal to the number of running tasks of
the cfs. Make sure that imbalance will be decreased by at least 1.

misfit task is the other feature that doesn't handle correctly such
situation although it's probably more difficult to face the problem
because of the smaller number of CPUs and running tasks on heterogenous
system.

We can't simply ensure that task_h_load() returns at least one because it
would imply to handle underflow in other places.

Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Tested-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Cc: <stable@vger.kernel.org> # v4.4+
Link: https://lkml.kernel.org/r/20200710152426.16981-1-vincent.guittot@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/sched/fair.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 67a763cd2252..3e4b6a4c1594 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -8629,7 +8629,15 @@ static int detach_tasks(struct lb_env *env)
 		if (!can_migrate_task(p, env))
 			goto next;
 
-		load = task_h_load(p);
+		/*
+		 * Depending of the number of CPUs and tasks and the
+		 * cgroup hierarchy, task_h_load() can return a null
+		 * value. Make sure that env->imbalance decreases
+		 * otherwise detach_tasks() will stop only after
+		 * detaching up to loop_max tasks.
+		 */
+		load = max_t(unsigned long, task_h_load(p), 1);
+
 
 		if (sched_feat(LB_MIN) && load < 16 && !env->sd->nr_balance_failed)
 			goto next;

From 937754da2821a4f0d45242094820cb06cc4d904f Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 22 Jul 2020 09:10:07 +0200
Subject: [PATCH 0212/2658] Linux 4.4.231

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 6114167621b4..fa5871a82605 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 230
+SUBLEVEL = 231
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 017df0c57bee8a5acc5978c2aa0b1d6937733e88 Mon Sep 17 00:00:00 2001
From: Jacky Hu <hengqing.hu@gmail.com>
Date: Tue, 16 Jun 2020 09:50:24 +0800
Subject: [PATCH 0213/2658] pinctrl: amd: fix npins for uart0 in kerncz_groups

[ Upstream commit 69339d083dfb7786b0e0b3fc19eaddcf11fabdfb ]

uart0_pins is defined as:
static const unsigned uart0_pins[] = {135, 136, 137, 138, 139};

which npins is wronly specified as 9 later
	{
		.name = "uart0",
		.pins = uart0_pins,
		.npins = 9,
	},

npins should be 5 instead of 9 according to the definition.

Signed-off-by: Jacky Hu <hengqing.hu@gmail.com>
Link: https://lore.kernel.org/r/20200616015024.287683-1-hengqing.hu@gmail.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/pinctrl-amd.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/pinctrl-amd.h b/drivers/pinctrl/pinctrl-amd.h
index 7bfea47dbb47..f63417197a62 100644
--- a/drivers/pinctrl/pinctrl-amd.h
+++ b/drivers/pinctrl/pinctrl-amd.h
@@ -249,7 +249,7 @@ static const struct amd_pingroup kerncz_groups[] = {
 	{
 		.name = "uart0",
 		.pins = uart0_pins,
-		.npins = 9,
+		.npins = 5,
 	},
 	{
 		.name = "uart1",

From c8d59c4190fbdf5ee05d9debd901c850b0aa8b1b Mon Sep 17 00:00:00 2001
From: Markus Theil <markus.theil@tu-ilmenau.de>
Date: Thu, 25 Jun 2020 12:42:14 +0200
Subject: [PATCH 0214/2658] mac80211: allow rx of mesh eapol frames with
 default rx key

[ Upstream commit 0b467b63870d9c05c81456aa9bfee894ab2db3b6 ]

Without this patch, eapol frames cannot be received in mesh
mode, when 802.1X should be used. Initially only a MGTK is
defined, which is found and set as rx->key, when there are
no other keys set. ieee80211_drop_unencrypted would then
drop these eapol frames, as they are data frames without
encryption and there exists some rx->key.

Fix this by differentiating between mesh eapol frames and
other data frames with existing rx->key. Allow mesh mesh
eapol frames only if they are for our vif address.

With this patch in-place, ieee80211_rx_h_mesh_fwding continues
after the ieee80211_drop_unencrypted check and notices, that
these eapol frames have to be delivered locally, as they should.

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
Link: https://lore.kernel.org/r/20200625104214.50319-1-markus.theil@tu-ilmenau.de
[small code cleanups]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/rx.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index bf2a56b53156..50c3e1d5b981 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1964,6 +1964,7 @@ static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
 
 static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
 {
+	struct ieee80211_hdr *hdr = (void *)rx->skb->data;
 	struct sk_buff *skb = rx->skb;
 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 
@@ -1974,6 +1975,31 @@ static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
 	if (status->flag & RX_FLAG_DECRYPTED)
 		return 0;
 
+	/* check mesh EAPOL frames first */
+	if (unlikely(rx->sta && ieee80211_vif_is_mesh(&rx->sdata->vif) &&
+		     ieee80211_is_data(fc))) {
+		struct ieee80211s_hdr *mesh_hdr;
+		u16 hdr_len = ieee80211_hdrlen(fc);
+		u16 ethertype_offset;
+		__be16 ethertype;
+
+		if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr))
+			goto drop_check;
+
+		/* make sure fixed part of mesh header is there, also checks skb len */
+		if (!pskb_may_pull(rx->skb, hdr_len + 6))
+			goto drop_check;
+
+		mesh_hdr = (struct ieee80211s_hdr *)(skb->data + hdr_len);
+		ethertype_offset = hdr_len + ieee80211_get_mesh_hdrlen(mesh_hdr) +
+				   sizeof(rfc1042_header);
+
+		if (skb_copy_bits(rx->skb, ethertype_offset, &ethertype, 2) == 0 &&
+		    ethertype == rx->sdata->control_port_protocol)
+			return 0;
+	}
+
+drop_check:
 	/* Drop unencrypted frames if key is set. */
 	if (unlikely(!ieee80211_has_protected(fc) &&
 		     !ieee80211_is_any_nullfunc(fc) &&

From 52331414237796f0694f0e72518c95afbe946d45 Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Sat, 27 Jun 2020 06:32:42 -0700
Subject: [PATCH 0215/2658] scsi: scsi_transport_spi: Fix function pointer
 check

[ Upstream commit 5aee52c44d9170591df65fafa1cd408acc1225ce ]

clang static analysis flags several null function pointer problems.

drivers/scsi/scsi_transport_spi.c:374:1: warning: Called function pointer is null (null dereference) [core.CallAndMessage]
spi_transport_max_attr(offset, "%d\n");
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Reviewing the store_spi_store_max macro

	if (i->f->set_##field)
		return -EINVAL;

should be

	if (!i->f->set_##field)
		return -EINVAL;

Link: https://lore.kernel.org/r/20200627133242.21618-1-trix@redhat.com
Reviewed-by: James Bottomley <jejb@linux.ibm.com>
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/scsi_transport_spi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi_transport_spi.c b/drivers/scsi/scsi_transport_spi.c
index 319868f3f674..083cd11ce7d7 100644
--- a/drivers/scsi/scsi_transport_spi.c
+++ b/drivers/scsi/scsi_transport_spi.c
@@ -353,7 +353,7 @@ store_spi_transport_##field(struct device *dev, 			\
 	struct spi_transport_attrs *tp					\
 		= (struct spi_transport_attrs *)&starget->starget_data;	\
 									\
-	if (i->f->set_##field)						\
+	if (!i->f->set_##field)						\
 		return -EINVAL;						\
 	val = simple_strtoul(buf, NULL, 0);				\
 	if (val > tp->max_##field)					\

From 5c04a2eb0bf015bb2e64fc94ca43a5cecb9d2411 Mon Sep 17 00:00:00 2001
From: Max Filippov <jcmvbkbc@gmail.com>
Date: Thu, 4 Jun 2020 13:37:10 -0700
Subject: [PATCH 0216/2658] xtensa: fix __sync_fetch_and_{and,or}_4
 declarations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 73f9941306d5ce030f3ffc7db425c7b2a798cf8e ]

Building xtensa kernel with gcc-10 produces the following warnings:
  arch/xtensa/kernel/xtensa_ksyms.c:90:15: warning: conflicting types
    for built-in function ‘__sync_fetch_and_and_4’;
    expected ‘unsigned int(volatile void *, unsigned int)’
    [-Wbuiltin-declaration-mismatch]
  arch/xtensa/kernel/xtensa_ksyms.c:96:15: warning: conflicting types
    for built-in function ‘__sync_fetch_and_or_4’;
    expected ‘unsigned int(volatile void *, unsigned int)’
    [-Wbuiltin-declaration-mismatch]

Fix declarations of these functions to avoid the warning.

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/xtensa/kernel/xtensa_ksyms.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c
index e2dd9109df63..00f17b5ec9c9 100644
--- a/arch/xtensa/kernel/xtensa_ksyms.c
+++ b/arch/xtensa/kernel/xtensa_ksyms.c
@@ -82,13 +82,13 @@ void __xtensa_libgcc_window_spill(void)
 }
 EXPORT_SYMBOL(__xtensa_libgcc_window_spill);
 
-unsigned long __sync_fetch_and_and_4(unsigned long *p, unsigned long v)
+unsigned int __sync_fetch_and_and_4(volatile void *p, unsigned int v)
 {
 	BUG();
 }
 EXPORT_SYMBOL(__sync_fetch_and_and_4);
 
-unsigned long __sync_fetch_and_or_4(unsigned long *p, unsigned long v)
+unsigned int __sync_fetch_and_or_4(volatile void *p, unsigned int v)
 {
 	BUG();
 }

From 5976a3f8bb54ab2cfa739269af83974bb9d0e0f8 Mon Sep 17 00:00:00 2001
From: Max Filippov <jcmvbkbc@gmail.com>
Date: Thu, 2 Jul 2020 08:32:25 -0700
Subject: [PATCH 0217/2658] xtensa: update *pos in cpuinfo_op.next

[ Upstream commit 0d5ab144429e8bd80889b856a44d56ab4a5cd59b ]

Increment *pos in the cpuinfo_op.next to fix the following warning
triggered by cat /proc/cpuinfo:

  seq_file: buggy .next function c_next did not update position index

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/xtensa/kernel/setup.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index 49ccbd9022f6..92f5a259e251 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -716,7 +716,8 @@ c_start(struct seq_file *f, loff_t *pos)
 static void *
 c_next(struct seq_file *f, void *v, loff_t *pos)
 {
-	return NULL;
+	++*pos;
+	return c_start(f, pos);
 }
 
 static void

From c0104421460842a082f4c800e1b1e4787bfb609b Mon Sep 17 00:00:00 2001
From: Xie He <xie.he.0141@gmail.com>
Date: Sun, 5 Jul 2020 17:45:21 -0700
Subject: [PATCH 0218/2658] drivers/net/wan/lapbether: Fixed the value of
 hard_header_len

[ Upstream commit 9dc829a135fb5927f1519de11286e2bbb79f5b66 ]

When this driver transmits data,
  first this driver will remove a pseudo header of 1 byte,
  then the lapb module will prepend the LAPB header of 2 or 3 bytes,
  then this driver will prepend a length field of 2 bytes,
  then the underlying Ethernet device will prepend its own header.

So, the header length required should be:
  -1 + 3 + 2 + "the header length needed by the underlying device".

This patch fixes kernel panic when this driver is used with AF_PACKET
SOCK_DGRAM sockets.

Signed-off-by: Xie He <xie.he.0141@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wan/lapbether.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index 6676607164d6..f5657783fad4 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -308,7 +308,6 @@ static void lapbeth_setup(struct net_device *dev)
 	dev->netdev_ops	     = &lapbeth_netdev_ops;
 	dev->destructor	     = free_netdev;
 	dev->type            = ARPHRD_X25;
-	dev->hard_header_len = 3;
 	dev->mtu             = 1000;
 	dev->addr_len        = 0;
 }
@@ -329,6 +328,14 @@ static int lapbeth_new_device(struct net_device *dev)
 	if (!ndev)
 		goto out;
 
+	/* When transmitting data:
+	 * first this driver removes a pseudo header of 1 byte,
+	 * then the lapb module prepends an LAPB header of at most 3 bytes,
+	 * then this driver prepends a length field of 2 bytes,
+	 * then the underlying Ethernet device prepends its own header.
+	 */
+	ndev->hard_header_len = -1 + 3 + 2 + dev->hard_header_len;
+
 	lapbeth = netdev_priv(ndev);
 	lapbeth->axdev = ndev;
 

From 95697bc6d667f97463906a911b1941c5a09cf9ff Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Fri, 3 Jul 2020 06:33:59 -0700
Subject: [PATCH 0219/2658] net: sky2: initialize return of gm_phy_read

[ Upstream commit 28b18e4eb515af7c6661c3995c6e3c34412c2874 ]

clang static analysis flags this garbage return

drivers/net/ethernet/marvell/sky2.c:208:2: warning: Undefined or garbage value returned to caller [core.uninitialized.UndefReturn]
        return v;
        ^~~~~~~~

static inline u16 gm_phy_read( ...
{
	u16 v;
	__gm_phy_read(hw, port, reg, &v);
	return v;
}

__gm_phy_read can return without setting v.

So handle similar to skge.c's gm_phy_read, initialize v.

Signed-off-by: Tom Rix <trix@redhat.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/sky2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
index 8ba9eadc2079..3fb9cbdac3bf 100644
--- a/drivers/net/ethernet/marvell/sky2.c
+++ b/drivers/net/ethernet/marvell/sky2.c
@@ -215,7 +215,7 @@ static int __gm_phy_read(struct sky2_hw *hw, unsigned port, u16 reg, u16 *val)
 
 static inline u16 gm_phy_read(struct sky2_hw *hw, unsigned port, u16 reg)
 {
-	u16 v;
+	u16 v = 0;
 	__gm_phy_read(hw, port, reg, &v);
 	return v;
 }

From 9b01a1b96255746502b711bb58fb28b267078db3 Mon Sep 17 00:00:00 2001
From: Ben Skeggs <bskeggs@redhat.com>
Date: Tue, 23 Jun 2020 16:39:13 +1000
Subject: [PATCH 0220/2658] drm/nouveau/i2c/g94-: increase
 NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout

[ Upstream commit 0156e76d388310a490aeb0f2fbb5b284ded3aecc ]

Tegra TRM says worst-case reply time is 1216us, and this should fix some
spurious timeouts that have been popping up.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c   | 4 ++--
 drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm204.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c
index 954f5b76bfcf..d44965f805fe 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c
@@ -118,10 +118,10 @@ g94_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry,
 		if (retries)
 			udelay(400);
 
-		/* transaction request, wait up to 1ms for it to complete */
+		/* transaction request, wait up to 2ms for it to complete */
 		nvkm_wr32(device, 0x00e4e4 + base, 0x00010000 | ctrl);
 
-		timeout = 1000;
+		timeout = 2000;
 		do {
 			ctrl = nvkm_rd32(device, 0x00e4e4 + base);
 			udelay(1);
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm204.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm204.c
index bed231b56dbd..7cac8fe372b6 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm204.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm204.c
@@ -118,10 +118,10 @@ gm204_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry,
 		if (retries)
 			udelay(400);
 
-		/* transaction request, wait up to 1ms for it to complete */
+		/* transaction request, wait up to 2ms for it to complete */
 		nvkm_wr32(device, 0x00d954 + base, 0x00010000 | ctrl);
 
-		timeout = 1000;
+		timeout = 2000;
 		do {
 			ctrl = nvkm_rd32(device, 0x00d954 + base);
 			udelay(1);

From bbb209e6de8f93bb6040496255cb535df04db0e9 Mon Sep 17 00:00:00 2001
From: Olga Kornievskaia <kolga@netapp.com>
Date: Wed, 15 Jul 2020 13:04:15 -0400
Subject: [PATCH 0221/2658] SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not
 waiting for direct IO compeletion")

commit 65caafd0d2145d1dd02072c4ced540624daeab40 upstream.

Reverting commit d03727b248d0 "NFSv4 fix CLOSE not waiting for
direct IO compeletion". This patch made it so that fput() by calling
inode_dio_done() in nfs_file_release() would wait uninterruptably
for any outstanding directIO to the file (but that wait on IO should
be killable).

The problem the patch was also trying to address was REMOVE returning
ERR_ACCESS because the file is still opened, is supposed to be resolved
by server returning ERR_FILE_OPEN and not ERR_ACCESS.

Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/direct.c | 13 ++++---------
 fs/nfs/file.c   |  1 -
 2 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 4d76e9a97538..7789f0b9b999 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -385,6 +385,8 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq, bool write)
 	if (write)
 		nfs_zap_mapping(inode, inode->i_mapping);
 
+	inode_dio_end(inode);
+
 	if (dreq->iocb) {
 		long res = (long) dreq->error;
 		if (!res)
@@ -394,10 +396,7 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq, bool write)
 
 	complete_all(&dreq->completion);
 
-	igrab(inode);
 	nfs_direct_req_release(dreq);
-	inode_dio_end(inode);
-	iput(inode);
 }
 
 static void nfs_direct_readpage_release(struct nfs_page *req)
@@ -538,10 +537,8 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq,
 	 * generic layer handle the completion.
 	 */
 	if (requested_bytes == 0) {
-		igrab(inode);
-		nfs_direct_req_release(dreq);
 		inode_dio_end(inode);
-		iput(inode);
+		nfs_direct_req_release(dreq);
 		return result < 0 ? result : -EIO;
 	}
 
@@ -942,10 +939,8 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,
 	 * generic layer handle the completion.
 	 */
 	if (requested_bytes == 0) {
-		igrab(inode);
-		nfs_direct_req_release(dreq);
 		inode_dio_end(inode);
-		iput(inode);
+		nfs_direct_req_release(dreq);
 		return result < 0 ? result : -EIO;
 	}
 
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index eaa6697d256e..dc875cd0e11d 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -82,7 +82,6 @@ nfs_file_release(struct inode *inode, struct file *filp)
 	dprintk("NFS: release(%pD2)\n", filp);
 
 	nfs_inc_stats(inode, NFSIOS_VFSRELEASE);
-	inode_dio_wait(inode);
 	nfs_file_clear_open_context(filp);
 	return 0;
 }

From 66945395ff279497c8a8e8087809ee920bfc4d06 Mon Sep 17 00:00:00 2001
From: Jiri Olsa <jolsa@kernel.org>
Date: Thu, 20 Jul 2017 16:14:55 +0200
Subject: [PATCH 0222/2658] perf/core: Fix locking for children siblings group
 read

commit 2aeb1883547626d82c597cce2c99f0b9c62e2425 upstream.

We're missing ctx lock when iterating children siblings
within the perf_read path for group reading. Following
race and crash can happen:

User space doing read syscall on event group leader:

T1:
  perf_read
    lock event->ctx->mutex
    perf_read_group
      lock leader->child_mutex
      __perf_read_group_add(child)
        list_for_each_entry(sub, &leader->sibling_list, group_entry)

---->   sub might be invalid at this point, because it could
        get removed via perf_event_exit_task_context in T2

Child exiting and cleaning up its events:

T2:
  perf_event_exit_task_context
    lock ctx->mutex
    list_for_each_entry_safe(child_event, next, &child_ctx->event_list,...
      perf_event_exit_event(child)
        lock ctx->lock
        perf_group_detach(child)
        unlock ctx->lock

---->   child is removed from sibling_list without any sync
        with T1 path above

        ...
        free_event(child)

Before the child is removed from the leader's child_list,
(and thus is omitted from perf_read_group processing), we
need to ensure that perf_read_group touches child's
siblings under its ctx->lock.

Peter further notes:

| One additional note; this bug got exposed by commit:
|
|   ba5213ae6b88 ("perf/core: Correct event creation with PERF_FORMAT_GROUP")
|
| which made it possible to actually trigger this code-path.

Tested-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: ba5213ae6b88 ("perf/core: Correct event creation with PERF_FORMAT_GROUP")
Link: http://lkml.kernel.org/r/20170720141455.2106-1-jolsa@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/events/core.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 21a2b7d60dab..9f9d1590a215 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -4036,7 +4036,9 @@ EXPORT_SYMBOL_GPL(perf_event_read_value);
 static int __perf_read_group_add(struct perf_event *leader,
 					u64 read_format, u64 *values)
 {
+	struct perf_event_context *ctx = leader->ctx;
 	struct perf_event *sub;
+	unsigned long flags;
 	int n = 1; /* skip @nr */
 	int ret;
 
@@ -4066,12 +4068,15 @@ static int __perf_read_group_add(struct perf_event *leader,
 	if (read_format & PERF_FORMAT_ID)
 		values[n++] = primary_event_id(leader);
 
+	raw_spin_lock_irqsave(&ctx->lock, flags);
+
 	list_for_each_entry(sub, &leader->sibling_list, group_entry) {
 		values[n++] += perf_event_count(sub);
 		if (read_format & PERF_FORMAT_ID)
 			values[n++] = primary_event_id(sub);
 	}
 
+	raw_spin_unlock_irqrestore(&ctx->lock, flags);
 	return 0;
 }
 

From 7b4b372a063c5d64b5a62fa421a6d070a1b13c1e Mon Sep 17 00:00:00 2001
From: Oleg Nesterov <oleg@redhat.com>
Date: Thu, 23 Jul 2020 17:44:20 +0200
Subject: [PATCH 0223/2658] uprobes: Change handle_swbp() to send SIGTRAP with
 si_code=SI_KERNEL, to fix GDB regression

commit fe5ed7ab99c656bd2f5b79b49df0e9ebf2cead8a upstream.

If a tracee is uprobed and it hits int3 inserted by debugger, handle_swbp()
does send_sig(SIGTRAP, current, 0) which means si_code == SI_USER. This used
to work when this code was written, but then GDB started to validate si_code
and now it simply can't use breakpoints if the tracee has an active uprobe:

	# cat test.c
	void unused_func(void)
	{
	}
	int main(void)
	{
		return 0;
	}

	# gcc -g test.c -o test
	# perf probe -x ./test -a unused_func
	# perf record -e probe_test:unused_func gdb ./test -ex run
	GNU gdb (GDB) 10.0.50.20200714-git
	...
	Program received signal SIGTRAP, Trace/breakpoint trap.
	0x00007ffff7ddf909 in dl_main () from /lib64/ld-linux-x86-64.so.2
	(gdb)

The tracee hits the internal breakpoint inserted by GDB to monitor shared
library events but GDB misinterprets this SIGTRAP and reports a signal.

Change handle_swbp() to use force_sig(SIGTRAP), this matches do_int3_user()
and fixes the problem.

This is the minimal fix for -stable, arch/x86/kernel/uprobes.c is equally
wrong; it should use send_sigtrap(TRAP_TRACE) instead of send_sig(SIGTRAP),
but this doesn't confuse GDB and needs another x86-specific patch.

Reported-by: Aaron Merey <amerey@redhat.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200723154420.GA32043@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/events/uprobes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index f206a3bc431e..93f70912d380 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -1874,7 +1874,7 @@ static void handle_swbp(struct pt_regs *regs)
 	if (!uprobe) {
 		if (is_swbp > 0) {
 			/* No matching uprobe; signal SIGTRAP. */
-			send_sig(SIGTRAP, current, 0);
+			force_sig(SIGTRAP, current);
 		} else {
 			/*
 			 * Either we raced with uprobe_unregister() or we can't

From 30b394649209a1abfbf9350c24e68cb774d77a97 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Fri, 17 Jul 2020 10:40:23 +0200
Subject: [PATCH 0224/2658] ALSA: info: Drop WARN_ON() from buffer NULL sanity
 check

commit 60379ba08532eca861e933b389526a4dc89e0c42 upstream.

snd_info_get_line() has a sanity check of NULL buffer -- both buffer
itself being NULL and buffer->buffer being NULL.  Basically both
checks are valid and necessary, but the problem is that it's with
snd_BUG_ON() macro that triggers WARN_ON().  The latter condition
(NULL buffer->buffer) can be met arbitrarily by user since the buffer
is allocated at the first write, so it means that user can trigger
WARN_ON() at will.

This patch addresses it by simply moving buffer->buffer NULL check out
of snd_BUG_ON() so that spurious WARNING is no longer triggered.

Reported-by: syzbot+e42d0746c3c3699b6061@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200717084023.5928-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/info.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/core/info.c b/sound/core/info.c
index db81ad5a325d..3ff6604ecab3 100644
--- a/sound/core/info.c
+++ b/sound/core/info.c
@@ -664,7 +664,9 @@ int snd_info_get_line(struct snd_info_buffer *buffer, char *line, int len)
 {
 	int c = -1;
 
-	if (snd_BUG_ON(!buffer || !buffer->buffer))
+	if (snd_BUG_ON(!buffer))
+		return 1;
+	if (!buffer->buffer)
 		return 1;
 	if (len <= 0 || buffer->stop || buffer->error)
 		return 1;

From 73b6b94fbd56cc84921b4bee21e2516e7fa5eb9c Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Sun, 28 Jun 2020 17:52:27 +0200
Subject: [PATCH 0225/2658] ASoC: rt5670: Correct RT5670_LDO_SEL_MASK

commit 5cacc6f5764e94fa753b2c1f5f7f1f3f74286e82 upstream.

The RT5670_PWR_ANLG1 register has 3 bits to select the LDO voltage,
so the correct mask is 0x7 not 0x3.

Because of this wrong mask we were programming the ldo bits
to a setting of binary 001 (0x05 & 0x03) instead of binary 101
when moving to SND_SOC_BIAS_PREPARE.

According to the datasheet 001 is a reserved value, so no idea
what it did, since the driver was working fine before I guess we
got lucky and it does something which is ok.

Fixes: 5e8351de740d ("ASoC: add RT5670 CODEC driver")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200628155231.71089-3-hdegoede@redhat.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/soc/codecs/rt5670.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/codecs/rt5670.h b/sound/soc/codecs/rt5670.h
index 3f1b0f1df809..e4e31e82311d 100644
--- a/sound/soc/codecs/rt5670.h
+++ b/sound/soc/codecs/rt5670.h
@@ -760,7 +760,7 @@
 #define RT5670_PWR_VREF2_BIT			4
 #define RT5670_PWR_FV2				(0x1 << 3)
 #define RT5670_PWR_FV2_BIT			3
-#define RT5670_LDO_SEL_MASK			(0x3)
+#define RT5670_LDO_SEL_MASK			(0x7)
 #define RT5670_LDO_SEL_SFT			0
 
 /* Power Management for Analog 2 (0x64) */

From 2818f9a5d2f59e8ec22783548e7cd19dab6b8103 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Mon, 13 Jul 2020 15:11:56 +0100
Subject: [PATCH 0226/2658] btrfs: fix double free on ulist after backref
 resolution failure

commit 580c079b5766ac706f56eec5c79aee4bf929fef6 upstream.

At btrfs_find_all_roots_safe() we allocate a ulist and set the **roots
argument to point to it. However if later we fail due to an error returned
by find_parent_nodes(), we free that ulist but leave a dangling pointer in
the **roots argument. Upon receiving the error, a caller of this function
can attempt to free the same ulist again, resulting in an invalid memory
access.

One such scenario is during qgroup accounting:

btrfs_qgroup_account_extents()

 --> calls btrfs_find_all_roots() passes &new_roots (a stack allocated
     pointer) to btrfs_find_all_roots()

   --> btrfs_find_all_roots() just calls btrfs_find_all_roots_safe()
       passing &new_roots to it

     --> allocates ulist and assigns its address to **roots (which
         points to new_roots from btrfs_qgroup_account_extents())

     --> find_parent_nodes() returns an error, so we free the ulist
         and leave **roots pointing to it after returning

 --> btrfs_qgroup_account_extents() sees btrfs_find_all_roots() returned
     an error and jumps to the label 'cleanup', which just tries to
     free again the same ulist

Stack trace example:

 ------------[ cut here ]------------
 BTRFS: tree first key check failed
 WARNING: CPU: 1 PID: 1763215 at fs/btrfs/disk-io.c:422 btrfs_verify_level_key+0xe0/0x180 [btrfs]
 Modules linked in: dm_snapshot dm_thin_pool (...)
 CPU: 1 PID: 1763215 Comm: fsstress Tainted: G        W         5.8.0-rc3-btrfs-next-64 #1
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
 RIP: 0010:btrfs_verify_level_key+0xe0/0x180 [btrfs]
 Code: 28 5b 5d (...)
 RSP: 0018:ffffb89b473779a0 EFLAGS: 00010286
 RAX: 0000000000000000 RBX: ffff90397759bf08 RCX: 0000000000000000
 RDX: 0000000000000001 RSI: 0000000000000027 RDI: 00000000ffffffff
 RBP: ffff9039a419c000 R08: 0000000000000000 R09: 0000000000000000
 R10: 0000000000000000 R11: ffffb89b43301000 R12: 000000000000005e
 R13: ffffb89b47377a2e R14: ffffb89b473779af R15: 0000000000000000
 FS:  00007fc47e1e1000(0000) GS:ffff9039ac200000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00007fc47e1df000 CR3: 00000003d9e4e001 CR4: 00000000003606e0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 Call Trace:
  read_block_for_search+0xf6/0x350 [btrfs]
  btrfs_next_old_leaf+0x242/0x650 [btrfs]
  resolve_indirect_refs+0x7cf/0x9e0 [btrfs]
  find_parent_nodes+0x4ea/0x12c0 [btrfs]
  btrfs_find_all_roots_safe+0xbf/0x130 [btrfs]
  btrfs_qgroup_account_extents+0x9d/0x390 [btrfs]
  btrfs_commit_transaction+0x4f7/0xb20 [btrfs]
  btrfs_sync_file+0x3d4/0x4d0 [btrfs]
  do_fsync+0x38/0x70
  __x64_sys_fdatasync+0x13/0x20
  do_syscall_64+0x5c/0xe0
  entry_SYSCALL_64_after_hwframe+0x44/0xa9
 RIP: 0033:0x7fc47e2d72e3
 Code: Bad RIP value.
 RSP: 002b:00007fffa32098c8 EFLAGS: 00000246 ORIG_RAX: 000000000000004b
 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc47e2d72e3
 RDX: 00007fffa3209830 RSI: 00007fffa3209830 RDI: 0000000000000003
 RBP: 000000000000072e R08: 0000000000000001 R09: 0000000000000003
 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000003e8
 R13: 0000000051eb851f R14: 00007fffa3209970 R15: 00005607c4ac8b50
 irq event stamp: 0
 hardirqs last  enabled at (0): [<0000000000000000>] 0x0
 hardirqs last disabled at (0): [<ffffffffb8eb5e85>] copy_process+0x755/0x1eb0
 softirqs last  enabled at (0): [<ffffffffb8eb5e85>] copy_process+0x755/0x1eb0
 softirqs last disabled at (0): [<0000000000000000>] 0x0
 ---[ end trace 8639237550317b48 ]---
 BTRFS error (device sdc): tree first key mismatch detected, bytenr=62324736 parent_transid=94 key expected=(262,108,1351680) has=(259,108,1921024)
 general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI
 CPU: 2 PID: 1763215 Comm: fsstress Tainted: G        W         5.8.0-rc3-btrfs-next-64 #1
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
 RIP: 0010:ulist_release+0x14/0x60 [btrfs]
 Code: c7 07 00 (...)
 RSP: 0018:ffffb89b47377d60 EFLAGS: 00010282
 RAX: 6b6b6b6b6b6b6b6b RBX: ffff903959b56b90 RCX: 0000000000000000
 RDX: 0000000000000001 RSI: 0000000000270024 RDI: ffff9036e2adc840
 RBP: ffff9036e2adc848 R08: 0000000000000000 R09: 0000000000000000
 R10: 0000000000000000 R11: 0000000000000000 R12: ffff9036e2adc840
 R13: 0000000000000015 R14: ffff9039a419ccf8 R15: ffff90395d605840
 FS:  00007fc47e1e1000(0000) GS:ffff9039ac600000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00007f8c1c0a51c8 CR3: 00000003d9e4e004 CR4: 00000000003606e0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 Call Trace:
  ulist_free+0x13/0x20 [btrfs]
  btrfs_qgroup_account_extents+0xf3/0x390 [btrfs]
  btrfs_commit_transaction+0x4f7/0xb20 [btrfs]
  btrfs_sync_file+0x3d4/0x4d0 [btrfs]
  do_fsync+0x38/0x70
  __x64_sys_fdatasync+0x13/0x20
  do_syscall_64+0x5c/0xe0
  entry_SYSCALL_64_after_hwframe+0x44/0xa9
 RIP: 0033:0x7fc47e2d72e3
 Code: Bad RIP value.
 RSP: 002b:00007fffa32098c8 EFLAGS: 00000246 ORIG_RAX: 000000000000004b
 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc47e2d72e3
 RDX: 00007fffa3209830 RSI: 00007fffa3209830 RDI: 0000000000000003
 RBP: 000000000000072e R08: 0000000000000001 R09: 0000000000000003
 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000003e8
 R13: 0000000051eb851f R14: 00007fffa3209970 R15: 00005607c4ac8b50
 Modules linked in: dm_snapshot dm_thin_pool (...)
 ---[ end trace 8639237550317b49 ]---
 RIP: 0010:ulist_release+0x14/0x60 [btrfs]
 Code: c7 07 00 (...)
 RSP: 0018:ffffb89b47377d60 EFLAGS: 00010282
 RAX: 6b6b6b6b6b6b6b6b RBX: ffff903959b56b90 RCX: 0000000000000000
 RDX: 0000000000000001 RSI: 0000000000270024 RDI: ffff9036e2adc840
 RBP: ffff9036e2adc848 R08: 0000000000000000 R09: 0000000000000000
 R10: 0000000000000000 R11: 0000000000000000 R12: ffff9036e2adc840
 R13: 0000000000000015 R14: ffff9039a419ccf8 R15: ffff90395d605840
 FS:  00007fc47e1e1000(0000) GS:ffff9039ad200000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00007f6a776f7d40 CR3: 00000003d9e4e002 CR4: 00000000003606e0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Fix this by making btrfs_find_all_roots_safe() set *roots to NULL after
it frees the ulist.

Fixes: 8da6d5815c592b ("Btrfs: added btrfs_find_all_roots()")
CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/backref.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 81c5d07a2af1..228bfa19b745 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -1221,6 +1221,7 @@ static int __btrfs_find_all_roots(struct btrfs_trans_handle *trans,
 		if (ret < 0 && ret != -ENOENT) {
 			ulist_free(tmp);
 			ulist_free(*roots);
+			*roots = NULL;
 			return ret;
 		}
 		node = ulist_next(tmp, &uiter);

From 9d15df868b8300f77d1244adfd903b0e6f533c0a Mon Sep 17 00:00:00 2001
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date: Tue, 20 Nov 2018 11:26:35 +0100
Subject: [PATCH 0227/2658] x86/fpu: Disable bottom halves while loading FPU
 registers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 68239654acafe6aad5a3c1dc7237e60accfebc03 ]

The sequence

  fpu->initialized = 1;		/* step A */
  preempt_disable();		/* step B */
  fpu__restore(fpu);
  preempt_enable();

in __fpu__restore_sig() is racy in regard to a context switch.

For 32bit frames, __fpu__restore_sig() prepares the FPU state within
fpu->state. To ensure that a context switch (switch_fpu_prepare() in
particular) does not modify fpu->state it uses fpu__drop() which sets
fpu->initialized to 0.

After fpu->initialized is cleared, the CPU's FPU state is not saved
to fpu->state during a context switch. The new state is loaded via
fpu__restore(). It gets loaded into fpu->state from userland and
ensured it is sane. fpu->initialized is then set to 1 in order to avoid
fpu__initialize() doing anything (overwrite the new state) which is part
of fpu__restore().

A context switch between step A and B above would save CPU's current FPU
registers to fpu->state and overwrite the newly prepared state. This
looks like a tiny race window but the Kernel Test Robot reported this
back in 2016 while we had lazy FPU support. Borislav Petkov made the
link between that report and another patch that has been posted. Since
the removal of the lazy FPU support, this race goes unnoticed because
the warning has been removed.

Disable bottom halves around the restore sequence to avoid the race. BH
need to be disabled because BH is allowed to run (even with preemption
disabled) and might invoke kernel_fpu_begin() by doing IPsec.

 [ bp: massage commit message a bit. ]

Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: kvm ML <kvm@vger.kernel.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: stable@vger.kernel.org
Cc: x86-ml <x86@kernel.org>
Link: http://lkml.kernel.org/r/20181120102635.ddv3fvavxajjlfqk@linutronix.de
Link: https://lkml.kernel.org/r/20160226074940.GA28911@pd.tnic
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/fpu/signal.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
index 31fad2cbd734..8fc842dae3b3 100644
--- a/arch/x86/kernel/fpu/signal.c
+++ b/arch/x86/kernel/fpu/signal.c
@@ -317,10 +317,10 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
 			sanitize_restored_xstate(tsk, &env, xfeatures, fx_only);
 		}
 
+		local_bh_disable();
 		fpu->fpstate_active = 1;
-		preempt_disable();
 		fpu__restore(fpu);
-		preempt_enable();
+		local_bh_enable();
 
 		return err;
 	} else {

From 73f83b23dae5eeb981c4612a059ee227cc09c359 Mon Sep 17 00:00:00 2001
From: Boris Burkov <boris@bur.io>
Date: Thu, 16 Jul 2020 13:29:46 -0700
Subject: [PATCH 0228/2658] btrfs: fix mount failure caused by race with umount

[ Upstream commit 48cfa61b58a1fee0bc49eef04f8ccf31493b7cdd ]

It is possible to cause a btrfs mount to fail by racing it with a slow
umount. The crux of the sequence is generic_shutdown_super not yet
calling sop->put_super before btrfs_mount_root calls btrfs_open_devices.
If that occurs, btrfs_open_devices will decide the opened counter is
non-zero, increment it, and skip resetting fs_devices->total_rw_bytes to
0. From here, mount will call sget which will result in grab_super
trying to take the super block umount semaphore. That semaphore will be
held by the slow umount, so mount will block. Before up-ing the
semaphore, umount will delete the super block, resulting in mount's sget
reliably allocating a new one, which causes the mount path to dutifully
fill it out, and increment total_rw_bytes a second time, which causes
the mount to fail, as we see double the expected bytes.

Here is the sequence laid out in greater detail:

CPU0                                                    CPU1
down_write sb->s_umount
btrfs_kill_super
  kill_anon_super(sb)
    generic_shutdown_super(sb);
      shrink_dcache_for_umount(sb);
      sync_filesystem(sb);
      evict_inodes(sb); // SLOW

                                              btrfs_mount_root
                                                btrfs_scan_one_device
                                                fs_devices = device->fs_devices
                                                fs_info->fs_devices = fs_devices
                                                // fs_devices-opened makes this a no-op
                                                btrfs_open_devices(fs_devices, mode, fs_type)
                                                s = sget(fs_type, test, set, flags, fs_info);
                                                  find sb in s_instances
                                                  grab_super(sb);
                                                    down_write(&s->s_umount); // blocks

      sop->put_super(sb)
        // sb->fs_devices->opened == 2; no-op
      spin_lock(&sb_lock);
      hlist_del_init(&sb->s_instances);
      spin_unlock(&sb_lock);
      up_write(&sb->s_umount);
                                                    return 0;
                                                  retry lookup
                                                  don't find sb in s_instances (deleted by CPU0)
                                                  s = alloc_super
                                                  return s;
                                                btrfs_fill_super(s, fs_devices, data)
                                                  open_ctree // fs_devices total_rw_bytes improperly set!
                                                    btrfs_read_chunk_tree
                                                      read_one_dev // increment total_rw_bytes again!!
                                                      super_total_bytes < fs_devices->total_rw_bytes // ERROR!!!

To fix this, we clear total_rw_bytes from within btrfs_read_chunk_tree
before the calls to read_one_dev, while holding the sb umount semaphore
and the uuid mutex.

To reproduce, it is sufficient to dirty a decent number of inodes, then
quickly umount and mount.

  for i in $(seq 0 500)
  do
    dd if=/dev/zero of="/mnt/foo/$i" bs=1M count=1
  done
  umount /mnt/foo&
  mount /mnt/foo

does the trick for me.

CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Boris Burkov <boris@bur.io>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/volumes.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 55ce6543050d..dcae0cf4924b 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -6693,6 +6693,14 @@ int btrfs_read_chunk_tree(struct btrfs_root *root)
 	mutex_lock(&uuid_mutex);
 	lock_chunks(root);
 
+	/*
+	 * It is possible for mount and umount to race in such a way that
+	 * we execute this code path, but open_fs_devices failed to clear
+	 * total_rw_bytes. We certainly want it cleared before reading the
+	 * device items, so clear it here.
+	 */
+	root->fs_info->fs_devices->total_rw_bytes = 0;
+
 	/*
 	 * Read all device items, and then all the chunk items. All
 	 * device items are found before any chunk item (their object id

From f0190f6a1941b2a5f85ba4a91568bc6b721c6160 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Tue, 14 Jul 2020 13:00:27 +0200
Subject: [PATCH 0229/2658] hippi: Fix a size used in a 'pci_free_consistent()'
 in an error handling path

[ Upstream commit 3195c4706b00106aa82c73acd28340fa8fc2bfc1 ]

The size used when calling 'pci_alloc_consistent()' and
'pci_free_consistent()' should match.

Fix it and have it consistent with the corresponding call in 'rr_close()'.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/hippi/rrunner.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c
index 313e006f74fe..6f3519123eb6 100644
--- a/drivers/net/hippi/rrunner.c
+++ b/drivers/net/hippi/rrunner.c
@@ -1250,7 +1250,7 @@ static int rr_open(struct net_device *dev)
 		rrpriv->info = NULL;
 	}
 	if (rrpriv->rx_ctrl) {
-		pci_free_consistent(pdev, sizeof(struct ring_ctrl),
+		pci_free_consistent(pdev, 256 * sizeof(struct ring_ctrl),
 				    rrpriv->rx_ctrl, rrpriv->rx_ctrl_dma);
 		rrpriv->rx_ctrl = NULL;
 	}

From c61d5e48d393267ae78ebefae16065112bdf4162 Mon Sep 17 00:00:00 2001
From: George Kennedy <george.kennedy@oracle.com>
Date: Wed, 15 Jul 2020 09:59:31 -0400
Subject: [PATCH 0230/2658] ax88172a: fix ax88172a_unbind() failures

[ Upstream commit c28d9a285668c799eeae2f7f93e929a6028a4d6d ]

If ax88172a_unbind() fails, make sure that the return code is
less than zero so that cleanup is done properly and avoid UAF.

Fixes: a9a51bd727d1 ("ax88172a: fix information leak on short answers")
Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Reported-by: syzbot+4cd84f527bf4a10fc9c1@syzkaller.appspotmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/ax88172a.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c
index 6b1d03b73eeb..6b734c7ffec3 100644
--- a/drivers/net/usb/ax88172a.c
+++ b/drivers/net/usb/ax88172a.c
@@ -245,6 +245,7 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf)
 	ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf);
 	if (ret < ETH_ALEN) {
 		netdev_err(dev->net, "Failed to read MAC address: %d\n", ret);
+		ret = -EIO;
 		goto free;
 	}
 	memcpy(dev->net->dev_addr, buf, ETH_ALEN);

From 4f8d4b9f4b1f80519e072d0bfa0b36f13f902dfb Mon Sep 17 00:00:00 2001
From: Sergey Organov <sorganov@gmail.com>
Date: Wed, 15 Jul 2020 19:10:00 +0300
Subject: [PATCH 0231/2658] net: dp83640: fix SIOCSHWTSTAMP to update the
 struct with actual configuration

[ Upstream commit 473309fb8372365ad211f425bca760af800e10a7 ]

From Documentation/networking/timestamping.txt:

  A driver which supports hardware time stamping shall update the
  struct with the actual, possibly more permissive configuration.

Do update the struct passed when we upscale the requested time
stamping mode.

Fixes: cb646e2b02b2 ("ptp: Added a clock driver for the National Semiconductor PHYTER.")
Signed-off-by: Sergey Organov <sorganov@gmail.com>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/dp83640.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index 847c9fc10f9a..0da80adc545a 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -1335,6 +1335,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
 		dp83640->hwts_rx_en = 1;
 		dp83640->layer = PTP_CLASS_L4;
 		dp83640->version = PTP_CLASS_V1;
+		cfg.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT;
 		break;
 	case HWTSTAMP_FILTER_PTP_V2_L4_EVENT:
 	case HWTSTAMP_FILTER_PTP_V2_L4_SYNC:
@@ -1342,6 +1343,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
 		dp83640->hwts_rx_en = 1;
 		dp83640->layer = PTP_CLASS_L4;
 		dp83640->version = PTP_CLASS_V2;
+		cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
 		break;
 	case HWTSTAMP_FILTER_PTP_V2_L2_EVENT:
 	case HWTSTAMP_FILTER_PTP_V2_L2_SYNC:
@@ -1349,6 +1351,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
 		dp83640->hwts_rx_en = 1;
 		dp83640->layer = PTP_CLASS_L2;
 		dp83640->version = PTP_CLASS_V2;
+		cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
 		break;
 	case HWTSTAMP_FILTER_PTP_V2_EVENT:
 	case HWTSTAMP_FILTER_PTP_V2_SYNC:
@@ -1356,6 +1359,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
 		dp83640->hwts_rx_en = 1;
 		dp83640->layer = PTP_CLASS_L4 | PTP_CLASS_L2;
 		dp83640->version = PTP_CLASS_V2;
+		cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
 		break;
 	default:
 		return -ERANGE;

From d639c7255ec2c8d5b6bb1b8e2faaecf1d69361d9 Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38@huawei.com>
Date: Thu, 16 Jul 2020 11:50:38 +0800
Subject: [PATCH 0232/2658] net: smc91x: Fix possible memory leak in
 smc_drv_probe()

[ Upstream commit bca9749b1aa23d964d3ab930938af66dbf887f15 ]

If try_toggle_control_gpio() failed in smc_drv_probe(), free_netdev(ndev)
should be called to free the ndev created earlier. Otherwise, a memleak
will occur.

Fixes: 7d2911c43815 ("net: smc91x: Fix gpios for device tree based booting")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/smsc/smc91x.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 7405f537beca..8531a7201968 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -2289,7 +2289,7 @@ static int smc_drv_probe(struct platform_device *pdev)
 		ret = try_toggle_control_gpio(&pdev->dev, &lp->power_gpio,
 					      "power", 0, 0, 100);
 		if (ret)
-			return ret;
+			goto out_free_netdev;
 
 		/*
 		 * Optional reset GPIO configured? Minimum 100 ns reset needed
@@ -2298,7 +2298,7 @@ static int smc_drv_probe(struct platform_device *pdev)
 		ret = try_toggle_control_gpio(&pdev->dev, &lp->reset_gpio,
 					      "reset", 0, 0, 100);
 		if (ret)
-			return ret;
+			goto out_free_netdev;
 
 		/*
 		 * Need to wait for optional EEPROM to load, max 750 us according

From 3289ee50da239681d1a41e4cfe3f72c269b30965 Mon Sep 17 00:00:00 2001
From: Pi-Hsun Shih <pihsun@chromium.org>
Date: Thu, 23 Jul 2020 21:15:43 -0700
Subject: [PATCH 0233/2658] scripts/decode_stacktrace: strip basepath from all
 paths

[ Upstream commit d178770d8d21489abf5bafefcbb6d5243b482e9a ]

Currently the basepath is removed only from the beginning of the string.
When the symbol is inlined and there's multiple line outputs of
addr2line, only the first line would have basepath removed.

Change to remove the basepath prefix from all lines.

Fixes: 31013836a71e ("scripts/decode_stacktrace: match basepath using shell prefix operator, not regex")
Co-developed-by: Shik Chen <shik@chromium.org>
Signed-off-by: Pi-Hsun Shih <pihsun@chromium.org>
Signed-off-by: Shik Chen <shik@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Cc: Sasha Levin <sashal@kernel.org>
Cc: Nicolas Boichat <drinkcat@chromium.org>
Cc: Jiri Slaby <jslaby@suse.cz>
Link: http://lkml.kernel.org/r/20200720082709.252805-1-pihsun@chromium.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/decode_stacktrace.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh
index 4f5e76f76b9d..003968cb04d4 100755
--- a/scripts/decode_stacktrace.sh
+++ b/scripts/decode_stacktrace.sh
@@ -63,8 +63,8 @@ parse_symbol() {
 		return
 	fi
 
-	# Strip out the base of the path
-	code=${code#$basepath/}
+	# Strip out the base of the path on each line
+	code=$(while read -r line; do echo "${line#$basepath/}"; done <<< "$code")
 
 	# In the case of inlines, move everything to same line
 	code=${code//$'\n'/' '}

From 1f455a6756667c7108df7e2013ddd93a61855b2d Mon Sep 17 00:00:00 2001
From: Marc Kleine-Budde <mkl@pengutronix.de>
Date: Fri, 3 Jul 2020 12:33:15 +0200
Subject: [PATCH 0234/2658] regmap: dev_get_regmap_match(): fix string
 comparison

[ Upstream commit e84861fec32dee8a2e62bbaa52cded6b05a2a456 ]

This function is used by dev_get_regmap() to retrieve a regmap for the
specified device. If the device has more than one regmap, the name parameter
can be used to specify one.

The code here uses a pointer comparison to check for equal strings. This
however will probably always fail, as the regmap->name is allocated via
kstrdup_const() from the regmap's config->name.

Fix this by using strcmp() instead.

Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Link: https://lore.kernel.org/r/20200703103315.267996-1-mkl@pengutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/regmap/regmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 6b96ebb9b440..a9ca3cee3990 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1106,7 +1106,7 @@ static int dev_get_regmap_match(struct device *dev, void *res, void *data)
 
 	/* If the user didn't specify a name match any */
 	if (data)
-		return (*r)->name == data;
+		return !strcmp((*r)->name, data);
 	else
 		return 1;
 }

From 1c73d09f8e49009be0bf8ae58a9b48fa2300e3ff Mon Sep 17 00:00:00 2001
From: Evgeny Novikov <novikov@ispras.ru>
Date: Fri, 26 Jun 2020 16:17:47 +0300
Subject: [PATCH 0235/2658] usb: gadget: udc: gr_udc: fix memleak on error
 handling path in gr_ep_init()

[ Upstream commit c8f8529e2c4141afa2ebb487ad48e8a6ec3e8c99 ]

gr_ep_init() does not assign the allocated request anywhere if allocation
of memory for the buffer fails. This is a memory leak fixed by the given
patch.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/gr_udc.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c
index 594639e5cbf8..78168e1827b5 100644
--- a/drivers/usb/gadget/udc/gr_udc.c
+++ b/drivers/usb/gadget/udc/gr_udc.c
@@ -2001,9 +2001,12 @@ static int gr_ep_init(struct gr_udc *dev, int num, int is_in, u32 maxplimit)
 
 	if (num == 0) {
 		_req = gr_alloc_request(&ep->ep, GFP_ATOMIC);
+		if (!_req)
+			return -ENOMEM;
+
 		buf = devm_kzalloc(dev->dev, PAGE_SIZE, GFP_DMA | GFP_ATOMIC);
-		if (!_req || !buf) {
-			/* possible _req freed by gr_probe via gr_remove */
+		if (!buf) {
+			gr_free_request(&ep->ep, _req);
 			return -ENOMEM;
 		}
 

From fff21e93224bb59ddf56686fb104f57403c708ef Mon Sep 17 00:00:00 2001
From: Will Deacon <will@kernel.org>
Date: Thu, 13 Feb 2020 12:12:26 +0000
Subject: [PATCH 0236/2658] arm64: Use test_tsk_thread_flag() for checking
 TIF_SINGLESTEP

[ Upstream commit 5afc78551bf5d53279036e0bf63314e35631d79f ]

Rather than open-code test_tsk_thread_flag() at each callsite, simply
replace the couple of offenders with calls to test_tsk_thread_flag()
directly.

Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/debug-monitors.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
index 858454466142..50392fe170a9 100644
--- a/arch/arm64/kernel/debug-monitors.c
+++ b/arch/arm64/kernel/debug-monitors.c
@@ -410,14 +410,14 @@ void user_rewind_single_step(struct task_struct *task)
 	 * If single step is active for this thread, then set SPSR.SS
 	 * to 1 to avoid returning to the active-pending state.
 	 */
-	if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP))
+	if (test_tsk_thread_flag(task, TIF_SINGLESTEP))
 		set_regs_spsr_ss(task_pt_regs(task));
 }
 NOKPROBE_SYMBOL(user_rewind_single_step);
 
 void user_fastforward_single_step(struct task_struct *task)
 {
-	if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP))
+	if (test_tsk_thread_flag(task, TIF_SINGLESTEP))
 		clear_regs_spsr_ss(task_pt_regs(task));
 }
 

From fbcc540321c72df35ff99ebc129524d47297ea14 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Wed, 27 May 2020 15:53:46 +0200
Subject: [PATCH 0237/2658] x86: math-emu: Fix up 'cmp' insn for clang ias

[ Upstream commit 81e96851ea32deb2c921c870eecabf335f598aeb ]

The clang integrated assembler requires the 'cmp' instruction to
have a length prefix here:

arch/x86/math-emu/wm_sqrt.S:212:2: error: ambiguous instructions require an explicit suffix (could be 'cmpb', 'cmpw', or 'cmpl')
 cmp $0xffffffff,-24(%ebp)
 ^

Make this a 32-bit comparison, which it was clearly meant to be.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Link: https://lkml.kernel.org/r/20200527135352.1198078-1-arnd@arndb.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/math-emu/wm_sqrt.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/math-emu/wm_sqrt.S b/arch/x86/math-emu/wm_sqrt.S
index d258f59564e1..3b40c98bbbd4 100644
--- a/arch/x86/math-emu/wm_sqrt.S
+++ b/arch/x86/math-emu/wm_sqrt.S
@@ -208,7 +208,7 @@ sqrt_stage_2_finish:
 
 #ifdef PARANOID
 /* It should be possible to get here only if the arg is ffff....ffff */
-	cmp	$0xffffffff,FPU_fsqrt_arg_1
+	cmpl	$0xffffffff,FPU_fsqrt_arg_1
 	jnz	sqrt_stage_2_error
 #endif /* PARANOID */
 

From 24f4442e52df5e205cc20863ef8818036b2b9d2b Mon Sep 17 00:00:00 2001
From: Steve French <stfrench@microsoft.com>
Date: Thu, 23 Jul 2020 14:41:29 -0500
Subject: [PATCH 0238/2658] Revert "cifs: Fix the target file was deleted when
 rename failed."

commit 0e6705182d4e1b77248a93470d6d7b3013d59b30 upstream.

This reverts commit 9ffad9263b467efd8f8dc7ae1941a0a655a2bab2.

Upon additional testing with older servers, it was found that
the original commit introduced a regression when using the old SMB1
dialect and rsyncing over an existing file.

The patch will need to be respun to address this, likely including
a larger refactoring of the SMB1 and SMB3 rename code paths to make
it less confusing and also to address some additional rename error
cases that SMB3 may be able to workaround.

Signed-off-by: Steve French <stfrench@microsoft.com>
Reported-by: Patrick Fernie <patrick.fernie@gmail.com>
CC: Stable <stable@vger.kernel.org>
Acked-by: Ronnie Sahlberg <lsahlber@redhat.com>
Acked-by: Pavel Shilovsky <pshilov@microsoft.com>
Acked-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/inode.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index a002e289a544..c18c26a78453 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1737,7 +1737,6 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,
 	FILE_UNIX_BASIC_INFO *info_buf_target;
 	unsigned int xid;
 	int rc, tmprc;
-	bool new_target = d_really_is_negative(target_dentry);
 
 	if (flags & ~RENAME_NOREPLACE)
 		return -EINVAL;
@@ -1814,13 +1813,8 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,
 	 */
 
 unlink_target:
-	/*
-	 * If the target dentry was created during the rename, try
-	 * unlinking it if it's not negative
-	 */
-	if (new_target &&
-	    d_really_is_positive(target_dentry) &&
-	    (rc == -EACCES || rc == -EEXIST)) {
+	/* Try unlinking the target dentry if it's not negative */
+	if (d_really_is_positive(target_dentry) && (rc == -EACCES || rc == -EEXIST)) {
 		if (d_is_dir(target_dentry))
 			tmprc = cifs_rmdir(target_dir, target_dentry);
 		else

From d972a3111cbecd900af2aa135189a31b209a5818 Mon Sep 17 00:00:00 2001
From: Rustam Kovhaev <rkovhaev@gmail.com>
Date: Wed, 22 Jul 2020 09:10:52 -0700
Subject: [PATCH 0239/2658] staging: wlan-ng: properly check endpoint types

commit faaff9765664009c1c7c65551d32e9ed3b1dda8f upstream.

As syzkaller detected, wlan-ng driver does not do sanity check of
endpoints in prism2sta_probe_usb(), add check for xfer direction and type

Reported-and-tested-by: syzbot+c2a1fa67c02faa0de723@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=c2a1fa67c02faa0de723
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200722161052.999754-1-rkovhaev@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/wlan-ng/prism2usb.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/wlan-ng/prism2usb.c b/drivers/staging/wlan-ng/prism2usb.c
index 8abf3f87a2d5..6da5c66bb3d5 100644
--- a/drivers/staging/wlan-ng/prism2usb.c
+++ b/drivers/staging/wlan-ng/prism2usb.c
@@ -60,11 +60,25 @@ static int prism2sta_probe_usb(struct usb_interface *interface,
 			       const struct usb_device_id *id)
 {
 	struct usb_device *dev;
-
+	const struct usb_endpoint_descriptor *epd;
+	const struct usb_host_interface *iface_desc = interface->cur_altsetting;
 	wlandevice_t *wlandev = NULL;
 	hfa384x_t *hw = NULL;
 	int result = 0;
 
+	if (iface_desc->desc.bNumEndpoints != 2) {
+		result = -ENODEV;
+		goto failed;
+	}
+
+	result = -EINVAL;
+	epd = &iface_desc->endpoint[1].desc;
+	if (!usb_endpoint_is_bulk_in(epd))
+		goto failed;
+	epd = &iface_desc->endpoint[2].desc;
+	if (!usb_endpoint_is_bulk_out(epd))
+		goto failed;
+
 	dev = interface_to_usbdev(interface);
 	wlandev = create_wlan();
 	if (wlandev == NULL) {

From 024efcaf612bb8112dc3aa0ceac6b3ea530cb6a3 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Fri, 17 Jul 2020 15:52:55 +0100
Subject: [PATCH 0240/2658] staging: comedi: addi_apci_1032: check
 INSN_CONFIG_DIGITAL_TRIG shift

commit 0bd0db42a030b75c20028c7ba6e327b9cb554116 upstream.

The `INSN_CONFIG` comedi instruction with sub-instruction code
`INSN_CONFIG_DIGITAL_TRIG` includes a base channel in `data[3]`. This is
used as a right shift amount for other bitmask values without being
checked.  Shift amounts greater than or equal to 32 will result in
undefined behavior.  Add code to deal with this.

Fixes: 33cdce6293dcc ("staging: comedi: addi_apci_1032: conform to new INSN_CONFIG_DIGITAL_TRIG")
Cc: <stable@vger.kernel.org> #3.8+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20200717145257.112660-3-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../staging/comedi/drivers/addi_apci_1032.c   | 20 +++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/comedi/drivers/addi_apci_1032.c b/drivers/staging/comedi/drivers/addi_apci_1032.c
index ccd1a91290bf..536a135cd00b 100644
--- a/drivers/staging/comedi/drivers/addi_apci_1032.c
+++ b/drivers/staging/comedi/drivers/addi_apci_1032.c
@@ -115,14 +115,22 @@ static int apci1032_cos_insn_config(struct comedi_device *dev,
 				    unsigned int *data)
 {
 	struct apci1032_private *devpriv = dev->private;
-	unsigned int shift, oldmask;
+	unsigned int shift, oldmask, himask, lomask;
 
 	switch (data[0]) {
 	case INSN_CONFIG_DIGITAL_TRIG:
 		if (data[1] != 0)
 			return -EINVAL;
 		shift = data[3];
-		oldmask = (1U << shift) - 1;
+		if (shift < 32) {
+			oldmask = (1U << shift) - 1;
+			himask = data[4] << shift;
+			lomask = data[5] << shift;
+		} else {
+			oldmask = 0xffffffffu;
+			himask = 0;
+			lomask = 0;
+		}
 		switch (data[2]) {
 		case COMEDI_DIGITAL_TRIG_DISABLE:
 			devpriv->ctrl = 0;
@@ -145,8 +153,8 @@ static int apci1032_cos_insn_config(struct comedi_device *dev,
 				devpriv->mode2 &= oldmask;
 			}
 			/* configure specified channels */
-			devpriv->mode1 |= data[4] << shift;
-			devpriv->mode2 |= data[5] << shift;
+			devpriv->mode1 |= himask;
+			devpriv->mode2 |= lomask;
 			break;
 		case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS:
 			if (devpriv->ctrl != (APCI1032_CTRL_INT_ENA |
@@ -163,8 +171,8 @@ static int apci1032_cos_insn_config(struct comedi_device *dev,
 				devpriv->mode2 &= oldmask;
 			}
 			/* configure specified channels */
-			devpriv->mode1 |= data[4] << shift;
-			devpriv->mode2 |= data[5] << shift;
+			devpriv->mode1 |= himask;
+			devpriv->mode2 |= lomask;
 			break;
 		default:
 			return -EINVAL;

From dffb52df5ad7ff0233c277c50244e9f76b07eda7 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Fri, 17 Jul 2020 15:52:54 +0100
Subject: [PATCH 0241/2658] staging: comedi: ni_6527: fix
 INSN_CONFIG_DIGITAL_TRIG support

commit f07804ec77d77f8a9dcf570a24154e17747bc82f upstream.

`ni6527_intr_insn_config()` processes `INSN_CONFIG` comedi instructions
for the "interrupt" subdevice.  When `data[0]` is
`INSN_CONFIG_DIGITAL_TRIG` it is configuring the digital trigger.  When
`data[2]` is `COMEDI_DIGITAL_TRIG_ENABLE_EDGES` it is configuring rising
and falling edge detection for the digital trigger, using a base channel
number (or shift amount) in `data[3]`, a rising edge bitmask in
`data[4]` and falling edge bitmask in `data[5]`.

If the base channel number (shift amount) is greater than or equal to
the number of channels (24) of the digital input subdevice, there are no
changes to the rising and falling edges, so the mask of channels to be
changed can be set to 0, otherwise the mask of channels to be changed,
and the rising and falling edge bitmasks are shifted by the base channel
number before calling `ni6527_set_edge_detection()` to change the
appropriate registers.  Unfortunately, the code is comparing the base
channel (shift amount) to the interrupt subdevice's number of channels
(1) instead of the digital input subdevice's number of channels (24).
Fix it by comparing to 32 because all shift amounts for an `unsigned
int` must be less than that and everything from bit 24 upwards is
ignored by `ni6527_set_edge_detection()` anyway.

Fixes: 110f9e687c1a8 ("staging: comedi: ni_6527: support INSN_CONFIG_DIGITAL_TRIG")
Cc: <stable@vger.kernel.org> # 3.17+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20200717145257.112660-2-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/ni_6527.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/ni_6527.c b/drivers/staging/comedi/drivers/ni_6527.c
index 62a817e4cd64..5b904cf07bd1 100644
--- a/drivers/staging/comedi/drivers/ni_6527.c
+++ b/drivers/staging/comedi/drivers/ni_6527.c
@@ -341,7 +341,7 @@ static int ni6527_intr_insn_config(struct comedi_device *dev,
 		case COMEDI_DIGITAL_TRIG_ENABLE_EDGES:
 			/* check shift amount */
 			shift = data[3];
-			if (shift >= s->n_chan) {
+			if (shift >= 32) {
 				mask = 0;
 				rising = 0;
 				falling = 0;

From a96d6096528de32deb461f94635df42cd9dd7ace Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Fri, 17 Jul 2020 15:52:57 +0100
Subject: [PATCH 0242/2658] staging: comedi: addi_apci_1500: check
 INSN_CONFIG_DIGITAL_TRIG shift

commit fc846e9db67c7e808d77bf9e2ef3d49e3820ce5d upstream.

The `INSN_CONFIG` comedi instruction with sub-instruction code
`INSN_CONFIG_DIGITAL_TRIG` includes a base channel in `data[3]`. This is
used as a right shift amount for other bitmask values without being
checked.  Shift amounts greater than or equal to 32 will result in
undefined behavior.  Add code to deal with this, adjusting the checks
for invalid channels so that enabled channel bits that would have been
lost by shifting are also checked for validity.  Only channels 0 to 15
are valid.

Fixes: a8c66b684efaf ("staging: comedi: addi_apci_1500: rewrite the subdevice support functions")
Cc: <stable@vger.kernel.org> #4.0+: ef75e14a6c93: staging: comedi: verify array index is correct before using it
Cc: <stable@vger.kernel.org> #4.0+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20200717145257.112660-5-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../staging/comedi/drivers/addi_apci_1500.c   | 24 +++++++++++++++----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c
index 79a8799b1262..c4e36fb6df9d 100644
--- a/drivers/staging/comedi/drivers/addi_apci_1500.c
+++ b/drivers/staging/comedi/drivers/addi_apci_1500.c
@@ -461,13 +461,14 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
 	struct apci1500_private *devpriv = dev->private;
 	unsigned int trig = data[1];
 	unsigned int shift = data[3];
-	unsigned int hi_mask = data[4] << shift;
-	unsigned int lo_mask = data[5] << shift;
-	unsigned int chan_mask = hi_mask | lo_mask;
-	unsigned int old_mask = (1 << shift) - 1;
+	unsigned int hi_mask;
+	unsigned int lo_mask;
+	unsigned int chan_mask;
+	unsigned int old_mask;
 	unsigned int pm;
 	unsigned int pt;
 	unsigned int pp;
+	unsigned int invalid_chan;
 
 	if (trig > 1) {
 		dev_dbg(dev->class_dev,
@@ -475,7 +476,20 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
 		return -EINVAL;
 	}
 
-	if (chan_mask > 0xffff) {
+	if (shift <= 16) {
+		hi_mask = data[4] << shift;
+		lo_mask = data[5] << shift;
+		old_mask = (1U << shift) - 1;
+		invalid_chan = (data[4] | data[5]) >> (16 - shift);
+	} else {
+		hi_mask = 0;
+		lo_mask = 0;
+		old_mask = 0xffff;
+		invalid_chan = data[4] | data[5];
+	}
+	chan_mask = hi_mask | lo_mask;
+
+	if (invalid_chan) {
 		dev_dbg(dev->class_dev, "invalid digital trigger channel\n");
 		return -EINVAL;
 	}

From ce461d3d6346099c0f6399ddf38705435ac9b957 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Fri, 17 Jul 2020 15:52:56 +0100
Subject: [PATCH 0243/2658] staging: comedi: addi_apci_1564: check
 INSN_CONFIG_DIGITAL_TRIG shift

commit 926234f1b8434c4409aa4c53637aa3362ca07cea upstream.

The `INSN_CONFIG` comedi instruction with sub-instruction code
`INSN_CONFIG_DIGITAL_TRIG` includes a base channel in `data[3]`. This is
used as a right shift amount for other bitmask values without being
checked.  Shift amounts greater than or equal to 32 will result in
undefined behavior.  Add code to deal with this.

Fixes: 1e15687ea472 ("staging: comedi: addi_apci_1564: add Change-of-State interrupt subdevice and required functions")
Cc: <stable@vger.kernel.org> #3.17+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20200717145257.112660-4-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../staging/comedi/drivers/addi_apci_1564.c   | 20 +++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/comedi/drivers/addi_apci_1564.c b/drivers/staging/comedi/drivers/addi_apci_1564.c
index f1ccfbd4c578..340e55c69263 100644
--- a/drivers/staging/comedi/drivers/addi_apci_1564.c
+++ b/drivers/staging/comedi/drivers/addi_apci_1564.c
@@ -288,14 +288,22 @@ static int apci1564_cos_insn_config(struct comedi_device *dev,
 				    unsigned int *data)
 {
 	struct apci1564_private *devpriv = dev->private;
-	unsigned int shift, oldmask;
+	unsigned int shift, oldmask, himask, lomask;
 
 	switch (data[0]) {
 	case INSN_CONFIG_DIGITAL_TRIG:
 		if (data[1] != 0)
 			return -EINVAL;
 		shift = data[3];
-		oldmask = (1U << shift) - 1;
+		if (shift < 32) {
+			oldmask = (1U << shift) - 1;
+			himask = data[4] << shift;
+			lomask = data[5] << shift;
+		} else {
+			oldmask = 0xffffffffu;
+			himask = 0;
+			lomask = 0;
+		}
 		switch (data[2]) {
 		case COMEDI_DIGITAL_TRIG_DISABLE:
 			devpriv->ctrl = 0;
@@ -319,8 +327,8 @@ static int apci1564_cos_insn_config(struct comedi_device *dev,
 				devpriv->mode2 &= oldmask;
 			}
 			/* configure specified channels */
-			devpriv->mode1 |= data[4] << shift;
-			devpriv->mode2 |= data[5] << shift;
+			devpriv->mode1 |= himask;
+			devpriv->mode2 |= lomask;
 			break;
 		case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS:
 			if (devpriv->ctrl != (APCI1564_DI_IRQ_ENA |
@@ -337,8 +345,8 @@ static int apci1564_cos_insn_config(struct comedi_device *dev,
 				devpriv->mode2 &= oldmask;
 			}
 			/* configure specified channels */
-			devpriv->mode1 |= data[4] << shift;
-			devpriv->mode2 |= data[5] << shift;
+			devpriv->mode1 |= himask;
+			devpriv->mode2 |= lomask;
 			break;
 		default:
 			return -EINVAL;

From e704d8c663397b4cfac2f5b38616f6a50a2c8156 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Tue, 21 Jul 2020 14:38:52 +0000
Subject: [PATCH 0244/2658] serial: 8250: fix null-ptr-deref in
 serial8250_start_tx()

commit f4c23a140d80ef5e6d3d1f8f57007649014b60fa upstream.

I got null-ptr-deref in serial8250_start_tx():

[   78.114630] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[   78.123778] Mem abort info:
[   78.126560]   ESR = 0x86000007
[   78.129603]   EC = 0x21: IABT (current EL), IL = 32 bits
[   78.134891]   SET = 0, FnV = 0
[   78.137933]   EA = 0, S1PTW = 0
[   78.141064] user pgtable: 64k pages, 48-bit VAs, pgdp=00000027d41a8600
[   78.147562] [0000000000000000] pgd=00000027893f0003, p4d=00000027893f0003, pud=00000027893f0003, pmd=00000027c9a20003, pte=0000000000000000
[   78.160029] Internal error: Oops: 86000007 [#1] SMP
[   78.164886] Modules linked in: sunrpc vfat fat aes_ce_blk crypto_simd cryptd aes_ce_cipher crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce ses enclosure sg sbsa_gwdt ipmi_ssif spi_dw_mmio sch_fq_codel vhost_net tun vhost vhost_iotlb tap ip_tables ext4 mbcache jbd2 ahci hisi_sas_v3_hw libahci hisi_sas_main libsas hns3 scsi_transport_sas hclge libata megaraid_sas ipmi_si hnae3 ipmi_devintf ipmi_msghandler br_netfilter bridge stp llc nvme nvme_core xt_sctp sctp libcrc32c dm_mod nbd
[   78.207383] CPU: 11 PID: 23258 Comm: null-ptr Not tainted 5.8.0-rc6+ #48
[   78.214056] Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V3.B210.01 03/12/2020
[   78.222888] pstate: 80400089 (Nzcv daIf +PAN -UAO BTYPE=--)
[   78.228435] pc : 0x0
[   78.230618] lr : serial8250_start_tx+0x160/0x260
[   78.235215] sp : ffff800062eefb80
[   78.238517] x29: ffff800062eefb80 x28: 0000000000000fff
[   78.243807] x27: ffff800062eefd80 x26: ffff202fd83b3000
[   78.249098] x25: ffff800062eefd80 x24: ffff202fd83b3000
[   78.254388] x23: ffff002fc5e50be8 x22: 0000000000000002
[   78.259679] x21: 0000000000000001 x20: 0000000000000000
[   78.264969] x19: ffffa688827eecc8 x18: 0000000000000000
[   78.270259] x17: 0000000000000000 x16: 0000000000000000
[   78.275550] x15: ffffa68881bc67a8 x14: 00000000000002e6
[   78.280841] x13: ffffa68881bc67a8 x12: 000000000000c539
[   78.286131] x11: d37a6f4de9bd37a7 x10: ffffa68881cccff0
[   78.291421] x9 : ffffa68881bc6000 x8 : ffffa688819daa88
[   78.296711] x7 : ffffa688822a0f20 x6 : ffffa688819e0000
[   78.302002] x5 : ffff800062eef9d0 x4 : ffffa68881e707a8
[   78.307292] x3 : 0000000000000000 x2 : 0000000000000002
[   78.312582] x1 : 0000000000000001 x0 : ffffa688827eecc8
[   78.317873] Call trace:
[   78.320312]  0x0
[   78.322147]  __uart_start.isra.9+0x64/0x78
[   78.326229]  uart_start+0xb8/0x1c8
[   78.329620]  uart_flush_chars+0x24/0x30
[   78.333442]  n_tty_receive_buf_common+0x7b0/0xc30
[   78.338128]  n_tty_receive_buf+0x44/0x2c8
[   78.342122]  tty_ioctl+0x348/0x11f8
[   78.345599]  ksys_ioctl+0xd8/0xf8
[   78.348903]  __arm64_sys_ioctl+0x2c/0xc8
[   78.352812]  el0_svc_common.constprop.2+0x88/0x1b0
[   78.357583]  do_el0_svc+0x44/0xd0
[   78.360887]  el0_sync_handler+0x14c/0x1d0
[   78.364880]  el0_sync+0x140/0x180
[   78.368185] Code: bad PC value

SERIAL_PORT_DFNS is not defined on each arch, if it's not defined,
serial8250_set_defaults() won't be called in serial8250_isa_init_ports(),
so the p->serial_in pointer won't be initialized, and it leads a null-ptr-deref.
Fix this problem by calling serial8250_set_defaults() after init uart port.

Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200721143852.4058352-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index 39126460c1f5..e9ea9005a984 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -530,6 +530,7 @@ static void __init serial8250_isa_init_ports(void)
 		 */
 		up->mcr_mask = ~ALPHA_KLUDGE_MCR;
 		up->mcr_force = ALPHA_KLUDGE_MCR;
+		serial8250_set_defaults(up);
 	}
 
 	/* chain base port ops to support Remote Supervisor Adapter */
@@ -553,7 +554,6 @@ static void __init serial8250_isa_init_ports(void)
 		port->membase  = old_serial_port[i].iomem_base;
 		port->iotype   = old_serial_port[i].io_type;
 		port->regshift = old_serial_port[i].iomem_reg_shift;
-		serial8250_set_defaults(up);
 
 		port->irqflags |= irqflag;
 		if (serial8250_isa_config != NULL)

From fad3d92f3c2c269364bbe40a6454b12fddec47a3 Mon Sep 17 00:00:00 2001
From: Serge Semin <Sergey.Semin@baikalelectronics.ru>
Date: Tue, 14 Jul 2020 15:41:12 +0300
Subject: [PATCH 0245/2658] serial: 8250_mtk: Fix high-speed baud rates
 clamping

commit 551e553f0d4ab623e2a6f424ab5834f9c7b5229c upstream.

Commit 7b668c064ec3 ("serial: 8250: Fix max baud limit in generic 8250
port") fixed limits of a baud rate setting for a generic 8250 port.
In other words since that commit the baud rate has been permitted to be
within [uartclk / 16 / UART_DIV_MAX; uartclk / 16], which is absolutely
normal for a standard 8250 UART port. But there are custom 8250 ports,
which provide extended baud rate limits. In particular the Mediatek 8250
port can work with baud rates up to "uartclk" speed.

Normally that and any other peculiarity is supposed to be handled in a
custom set_termios() callback implemented in the vendor-specific
8250-port glue-driver. Currently that is how it's done for the most of
the vendor-specific 8250 ports, but for some reason for Mediatek a
solution has been spread out to both the glue-driver and to the generic
8250-port code. Due to that a bug has been introduced, which permitted the
extended baud rate limit for all even for standard 8250-ports. The bug
has been fixed by the commit 7b668c064ec3 ("serial: 8250: Fix max baud
limit in generic 8250 port") by narrowing the baud rates limit back down to
the normal bounds. Unfortunately by doing so we also broke the
Mediatek-specific extended bauds feature.

A fix of the problem described above is twofold. First since we can't get
back the extended baud rate limits feature to the generic set_termios()
function and that method supports only a standard baud rates range, the
requested baud rate must be locally stored before calling it and then
restored back to the new termios structure after the generic set_termios()
finished its magic business. By doing so we still use the
serial8250_do_set_termios() method to set the LCR/MCR/FCR/etc. registers,
while the extended baud rate setting procedure will be performed later in
the custom Mediatek-specific set_termios() callback. Second since a true
baud rate is now fully calculated in the custom set_termios() method we
need to locally update the port timeout by calling the
uart_update_timeout() function. After the fixes described above are
implemented in the 8250_mtk.c driver, the Mediatek 8250-port should
get back to normally working with extended baud rates.

Link: https://lore.kernel.org/linux-serial/20200701211337.3027448-1-danielwinkler@google.com

Fixes: 7b668c064ec3 ("serial: 8250: Fix max baud limit in generic 8250 port")
Reported-by: Daniel Winkler <danielwinkler@google.com>
Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
Cc: stable <stable@vger.kernel.org>
Tested-by: Claire Chang <tientzu@chromium.org>
Link: https://lore.kernel.org/r/20200714124113.20918-1-Sergey.Semin@baikalelectronics.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_mtk.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
index 035810bbcd02..470ccf729d59 100644
--- a/drivers/tty/serial/8250/8250_mtk.c
+++ b/drivers/tty/serial/8250/8250_mtk.c
@@ -47,8 +47,21 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios,
 	struct uart_8250_port *up =
 		container_of(port, struct uart_8250_port, port);
 
+	/*
+	 * Store the requested baud rate before calling the generic 8250
+	 * set_termios method. Standard 8250 port expects bauds to be
+	 * no higher than (uartclk / 16) so the baud will be clamped if it
+	 * gets out of that bound. Mediatek 8250 port supports speed
+	 * higher than that, therefore we'll get original baud rate back
+	 * after calling the generic set_termios method and recalculate
+	 * the speed later in this method.
+	 */
+	baud = tty_termios_baud_rate(termios);
+
 	serial8250_do_set_termios(port, termios, old);
 
+	tty_termios_encode_baud_rate(termios, baud, baud);
+
 	/*
 	 * Mediatek UARTs use an extra highspeed register (UART_MTK_HIGHS)
 	 *
@@ -91,6 +104,11 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios,
 	 */
 	spin_lock_irqsave(&port->lock, flags);
 
+	/*
+	 * Update the per-port timeout.
+	 */
+	uart_update_timeout(port, termios->c_cflag, baud);
+
 	/* set DLAB we have cval saved in up->lcr from the call to the core */
 	serial_port_out(port, UART_LCR, up->lcr | UART_LCR_DLAB);
 	serial_dl_write(up, quot);

From c51d951345bc175fcfd58a49dd860742c279ad98 Mon Sep 17 00:00:00 2001
From: Hugh Dickins <hughd@google.com>
Date: Thu, 23 Jul 2020 21:15:24 -0700
Subject: [PATCH 0246/2658] mm/memcg: fix refcount error while moving and
 swapping

commit 8d22a9351035ef2ff12ef163a1091b8b8cf1e49c upstream.

It was hard to keep a test running, moving tasks between memcgs with
move_charge_at_immigrate, while swapping: mem_cgroup_id_get_many()'s
refcount is discovered to be 0 (supposedly impossible), so it is then
forced to REFCOUNT_SATURATED, and after thousands of warnings in quick
succession, the test is at last put out of misery by being OOM killed.

This is because of the way moved_swap accounting was saved up until the
task move gets completed in __mem_cgroup_clear_mc(), deferred from when
mem_cgroup_move_swap_account() actually exchanged old and new ids.
Concurrent activity can free up swap quicker than the task is scanned,
bringing id refcount down 0 (which should only be possible when
offlining).

Just skip that optimization: do that part of the accounting immediately.

Fixes: 615d66c37c75 ("mm: memcontrol: fix memcg id ref counter on swap charge move")
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Alex Shi <alex.shi@linux.alibaba.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Alex Shi <alex.shi@linux.alibaba.com>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2007071431050.4726@eggly.anvils
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/memcontrol.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index cb98a1889c8c..617feca8d094 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4889,7 +4889,6 @@ static void __mem_cgroup_clear_mc(void)
 		if (!mem_cgroup_is_root(mc.to))
 			page_counter_uncharge(&mc.to->memory, mc.moved_swap);
 
-		mem_cgroup_id_get_many(mc.to, mc.moved_swap);
 		css_put_many(&mc.to->css, mc.moved_swap);
 
 		mc.moved_swap = 0;
@@ -5067,7 +5066,8 @@ static int mem_cgroup_move_charge_pte_range(pmd_t *pmd,
 			ent = target.ent;
 			if (!mem_cgroup_move_swap_account(ent, mc.from, mc.to)) {
 				mc.precharge--;
-				/* we fixup refcnts and charges later. */
+				mem_cgroup_id_get_many(mc.to, 1);
+				/* we fixup other refcnts and charges later. */
 				mc.moved_swap++;
 			}
 			break;

From bb3466128be0c73fe83a07bdf332f0a321d47409 Mon Sep 17 00:00:00 2001
From: John David Anglin <dave.anglin@bell.net>
Date: Tue, 21 Jul 2020 07:36:59 -0400
Subject: [PATCH 0247/2658] parisc: Add atomic64_set_release() define to avoid
 CPU soft lockups

commit be6577af0cef934ccb036445314072e8cb9217b9 upstream.

Stalls are quite frequent with recent kernels. I enabled
CONFIG_SOFTLOCKUP_DETECTOR and I caught the following stall:

watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [cc1:22803]
CPU: 0 PID: 22803 Comm: cc1 Not tainted 5.6.17+ #3
Hardware name: 9000/800/rp3440
 IAOQ[0]: d_alloc_parallel+0x384/0x688
 IAOQ[1]: d_alloc_parallel+0x388/0x688
 RP(r2): d_alloc_parallel+0x134/0x688
Backtrace:
 [<000000004036974c>] __lookup_slow+0xa4/0x200
 [<0000000040369fc8>] walk_component+0x288/0x458
 [<000000004036a9a0>] path_lookupat+0x88/0x198
 [<000000004036e748>] filename_lookup+0xa0/0x168
 [<000000004036e95c>] user_path_at_empty+0x64/0x80
 [<000000004035d93c>] vfs_statx+0x104/0x158
 [<000000004035dfcc>] __do_sys_lstat64+0x44/0x80
 [<000000004035e5a0>] sys_lstat64+0x20/0x38
 [<0000000040180054>] syscall_exit+0x0/0x14

The code was stuck in this loop in d_alloc_parallel:

    4037d414:   0e 00 10 dc     ldd 0(r16),ret0
    4037d418:   c7 fc 5f ed     bb,< ret0,1f,4037d414 <d_alloc_parallel+0x384>
    4037d41c:   08 00 02 40     nop

This is the inner loop of bit_spin_lock which is called by hlist_bl_unlock in
d_alloc_parallel:

static inline void bit_spin_lock(int bitnum, unsigned long *addr)
{
        /*
         * Assuming the lock is uncontended, this never enters
         * the body of the outer loop. If it is contended, then
         * within the inner loop a non-atomic test is used to
         * busywait with less bus contention for a good time to
         * attempt to acquire the lock bit.
         */
        preempt_disable();
#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
        while (unlikely(test_and_set_bit_lock(bitnum, addr))) {
                preempt_enable();
                do {
                        cpu_relax();
                } while (test_bit(bitnum, addr));
                preempt_disable();
        }
#endif
        __acquire(bitlock);
}

After consideration, I realized that we must be losing bit unlocks.
Then, I noticed that we missed defining atomic64_set_release().
Adding this define fixes the stalls in bit operations.

Signed-off-by: Dave Anglin <dave.anglin@bell.net>
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/parisc/include/asm/atomic.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
index 1d109990a022..cb2590821707 100644
--- a/arch/parisc/include/asm/atomic.h
+++ b/arch/parisc/include/asm/atomic.h
@@ -208,6 +208,8 @@ atomic64_set(atomic64_t *v, s64 i)
 	_atomic_spin_unlock_irqrestore(v, flags);
 }
 
+#define atomic64_set_release(v, i)	atomic64_set((v), (i))
+
 static __inline__ s64
 atomic64_read(const atomic64_t *v)
 {

From fc5190840113025c6a20e083a09e4f3ddaca715b Mon Sep 17 00:00:00 2001
From: Qiujun Huang <hqjagain@gmail.com>
Date: Sat, 4 Apr 2020 12:18:38 +0800
Subject: [PATCH 0248/2658] ath9k: Fix general protection fault in
 ath9k_hif_usb_rx_cb
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 2bbcaaee1fcbd83272e29f31e2bb7e70d8c49e05 upstream.

In ath9k_hif_usb_rx_cb interface number is assumed to be 0.
usb_ifnum_to_if(urb->dev, 0)
But it isn't always true.

The case reported by syzbot:
https://lore.kernel.org/linux-usb/000000000000666c9c05a1c05d12@google.com
usb 2-1: new high-speed USB device number 2 using dummy_hcd
usb 2-1: config 1 has an invalid interface number: 2 but max is 0
usb 2-1: config 1 has no interface number 0
usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice=
1.08
usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
general protection fault, probably for non-canonical address
0xdffffc0000000015: 0000 [#1] SMP KASAN
KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af]
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.6.0-rc5-syzkaller #0

Call Trace
__usb_hcd_giveback_urb+0x29a/0x550 drivers/usb/core/hcd.c:1650
usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1716
dummy_timer+0x1258/0x32ae drivers/usb/gadget/udc/dummy_hcd.c:1966
call_timer_fn+0x195/0x6f0 kernel/time/timer.c:1404
expire_timers kernel/time/timer.c:1449 [inline]
__run_timers kernel/time/timer.c:1773 [inline]
__run_timers kernel/time/timer.c:1740 [inline]
run_timer_softirq+0x5f9/0x1500 kernel/time/timer.c:1786
__do_softirq+0x21e/0x950 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x178/0x1a0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:546 [inline]
smp_apic_timer_interrupt+0x141/0x540 arch/x86/kernel/apic/apic.c:1146
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829

Reported-and-tested-by: syzbot+40d5d2e8a4680952f042@syzkaller.appspotmail.com
Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200404041838.10426-6-hqjagain@gmail.com
Cc: Viktor Jägersküpper <viktor_jaegerskuepper@freenet.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath9k/hif_usb.c | 48 ++++++++++++++++++------
 drivers/net/wireless/ath/ath9k/hif_usb.h |  5 +++
 2 files changed, 42 insertions(+), 11 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index e2ed30b03af5..e51f1a577897 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -639,9 +639,9 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
 
 static void ath9k_hif_usb_rx_cb(struct urb *urb)
 {
-	struct sk_buff *skb = (struct sk_buff *) urb->context;
-	struct hif_device_usb *hif_dev =
-		usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
+	struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
+	struct hif_device_usb *hif_dev = rx_buf->hif_dev;
+	struct sk_buff *skb = rx_buf->skb;
 	int ret;
 
 	if (!skb)
@@ -681,14 +681,15 @@ static void ath9k_hif_usb_rx_cb(struct urb *urb)
 	return;
 free:
 	kfree_skb(skb);
+	kfree(rx_buf);
 }
 
 static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
 {
-	struct sk_buff *skb = (struct sk_buff *) urb->context;
+	struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
+	struct hif_device_usb *hif_dev = rx_buf->hif_dev;
+	struct sk_buff *skb = rx_buf->skb;
 	struct sk_buff *nskb;
-	struct hif_device_usb *hif_dev =
-		usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
 	int ret;
 
 	if (!skb)
@@ -746,6 +747,7 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
 	return;
 free:
 	kfree_skb(skb);
+	kfree(rx_buf);
 	urb->context = NULL;
 }
 
@@ -791,7 +793,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
 	init_usb_anchor(&hif_dev->mgmt_submitted);
 
 	for (i = 0; i < MAX_TX_URB_NUM; i++) {
-		tx_buf = kzalloc(sizeof(struct tx_buf), GFP_KERNEL);
+		tx_buf = kzalloc(sizeof(*tx_buf), GFP_KERNEL);
 		if (!tx_buf)
 			goto err;
 
@@ -828,8 +830,9 @@ static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev)
 
 static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
 {
-	struct urb *urb = NULL;
+	struct rx_buf *rx_buf = NULL;
 	struct sk_buff *skb = NULL;
+	struct urb *urb = NULL;
 	int i, ret;
 
 	init_usb_anchor(&hif_dev->rx_submitted);
@@ -837,6 +840,12 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
 
 	for (i = 0; i < MAX_RX_URB_NUM; i++) {
 
+		rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
+		if (!rx_buf) {
+			ret = -ENOMEM;
+			goto err_rxb;
+		}
+
 		/* Allocate URB */
 		urb = usb_alloc_urb(0, GFP_KERNEL);
 		if (urb == NULL) {
@@ -851,11 +860,14 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
 			goto err_skb;
 		}
 
+		rx_buf->hif_dev = hif_dev;
+		rx_buf->skb = skb;
+
 		usb_fill_bulk_urb(urb, hif_dev->udev,
 				  usb_rcvbulkpipe(hif_dev->udev,
 						  USB_WLAN_RX_PIPE),
 				  skb->data, MAX_RX_BUF_SIZE,
-				  ath9k_hif_usb_rx_cb, skb);
+				  ath9k_hif_usb_rx_cb, rx_buf);
 
 		/* Anchor URB */
 		usb_anchor_urb(urb, &hif_dev->rx_submitted);
@@ -881,6 +893,8 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
 err_skb:
 	usb_free_urb(urb);
 err_urb:
+	kfree(rx_buf);
+err_rxb:
 	ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
 	return ret;
 }
@@ -892,14 +906,21 @@ static void ath9k_hif_usb_dealloc_reg_in_urbs(struct hif_device_usb *hif_dev)
 
 static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
 {
-	struct urb *urb = NULL;
+	struct rx_buf *rx_buf = NULL;
 	struct sk_buff *skb = NULL;
+	struct urb *urb = NULL;
 	int i, ret;
 
 	init_usb_anchor(&hif_dev->reg_in_submitted);
 
 	for (i = 0; i < MAX_REG_IN_URB_NUM; i++) {
 
+		rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
+		if (!rx_buf) {
+			ret = -ENOMEM;
+			goto err_rxb;
+		}
+
 		/* Allocate URB */
 		urb = usb_alloc_urb(0, GFP_KERNEL);
 		if (urb == NULL) {
@@ -914,11 +935,14 @@ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
 			goto err_skb;
 		}
 
+		rx_buf->hif_dev = hif_dev;
+		rx_buf->skb = skb;
+
 		usb_fill_int_urb(urb, hif_dev->udev,
 				  usb_rcvintpipe(hif_dev->udev,
 						  USB_REG_IN_PIPE),
 				  skb->data, MAX_REG_IN_BUF_SIZE,
-				  ath9k_hif_usb_reg_in_cb, skb, 1);
+				  ath9k_hif_usb_reg_in_cb, rx_buf, 1);
 
 		/* Anchor URB */
 		usb_anchor_urb(urb, &hif_dev->reg_in_submitted);
@@ -944,6 +968,8 @@ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
 err_skb:
 	usb_free_urb(urb);
 err_urb:
+	kfree(rx_buf);
+err_rxb:
 	ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev);
 	return ret;
 }
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h
index a95cdf562611..835264c36595 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.h
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.h
@@ -84,6 +84,11 @@ struct tx_buf {
 	struct list_head list;
 };
 
+struct rx_buf {
+	struct sk_buff *skb;
+	struct hif_device_usb *hif_dev;
+};
+
 #define HIF_USB_TX_STOP  BIT(0)
 #define HIF_USB_TX_FLUSH BIT(1)
 

From ba0d745013e55ec09bbaa2730841e52f5f393b3e Mon Sep 17 00:00:00 2001
From: Mark O'Donovan <shiftee@posteo.net>
Date: Sat, 11 Jul 2020 05:33:24 +0100
Subject: [PATCH 0249/2658] ath9k: Fix regression with Atheros 9271
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 92f53e2fda8bb9a559ad61d57bfb397ce67ed0ab upstream.

This fix allows ath9k_htc modules to connect to WLAN once again.

Fixes: 2bbcaaee1fcb ("ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=208251
Signed-off-by: Mark O'Donovan <shiftee@posteo.net>
Reported-by: Roman Mamedov <rm@romanrm.net>
Tested-by: Viktor Jägersküpper <viktor_jaegerskuepper@freenet.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200711043324.8079-1-shiftee@posteo.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath9k/hif_usb.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index e51f1a577897..76d91859cfde 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -729,11 +729,13 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
 			return;
 		}
 
+		rx_buf->skb = nskb;
+
 		usb_fill_int_urb(urb, hif_dev->udev,
 				 usb_rcvintpipe(hif_dev->udev,
 						 USB_REG_IN_PIPE),
 				 nskb->data, MAX_REG_IN_BUF_SIZE,
-				 ath9k_hif_usb_reg_in_cb, nskb, 1);
+				 ath9k_hif_usb_reg_in_cb, rx_buf, 1);
 	}
 
 resubmit:

From 1175fd403c04dc257fa92cc0b886e605333897a5 Mon Sep 17 00:00:00 2001
From: Peilin Ye <yepeilin.cs@gmail.com>
Date: Wed, 22 Jul 2020 11:19:01 -0400
Subject: [PATCH 0250/2658] AX.25: Fix out-of-bounds read in ax25_connect()

[ Upstream commit 2f2a7ffad5c6cbf3d438e813cfdc88230e185ba6 ]

Checks on `addr_len` and `fsa->fsa_ax25.sax25_ndigis` are insufficient.
ax25_connect() can go out of bounds when `fsa->fsa_ax25.sax25_ndigis`
equals to 7 or 8. Fix it.

This issue has been reported as a KMSAN uninit-value bug, because in such
a case, ax25_connect() reaches into the uninitialized portion of the
`struct sockaddr_storage` statically allocated in __sys_connect().

It is safe to remove `fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS` because
`addr_len` is guaranteed to be less than or equal to
`sizeof(struct full_sockaddr_ax25)`.

Reported-by: syzbot+c82752228ed975b0a623@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=55ef9d629f3b3d7d70b69558015b63b48d01af66
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ax25/af_ax25.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 02be8ee23271..c91df99900ff 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1191,7 +1191,9 @@ static int __must_check ax25_connect(struct socket *sock,
 	if (addr_len > sizeof(struct sockaddr_ax25) &&
 	    fsa->fsa_ax25.sax25_ndigis != 0) {
 		/* Valid number of digipeaters ? */
-		if (fsa->fsa_ax25.sax25_ndigis < 1 || fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS) {
+		if (fsa->fsa_ax25.sax25_ndigis < 1 ||
+		    addr_len < sizeof(struct sockaddr_ax25) +
+		    sizeof(ax25_address) * fsa->fsa_ax25.sax25_ndigis) {
 			err = -EINVAL;
 			goto out_release;
 		}

From 1b5e7f738e9659c00f00310418db802c3245c547 Mon Sep 17 00:00:00 2001
From: Peilin Ye <yepeilin.cs@gmail.com>
Date: Wed, 22 Jul 2020 12:05:12 -0400
Subject: [PATCH 0251/2658] AX.25: Prevent out-of-bounds read in ax25_sendmsg()

[ Upstream commit 8885bb0621f01a6c82be60a91e5fc0f6e2f71186 ]

Checks on `addr_len` and `usax->sax25_ndigis` are insufficient.
ax25_sendmsg() can go out of bounds when `usax->sax25_ndigis` equals to 7
or 8. Fix it.

It is safe to remove `usax->sax25_ndigis > AX25_MAX_DIGIS`, since
`addr_len` is guaranteed to be less than or equal to
`sizeof(struct full_sockaddr_ax25)`

Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ax25/af_ax25.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index c91df99900ff..16d9441f2057 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1512,7 +1512,8 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 			struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax;
 
 			/* Valid number of digipeaters ? */
-			if (usax->sax25_ndigis < 1 || usax->sax25_ndigis > AX25_MAX_DIGIS) {
+			if (usax->sax25_ndigis < 1 || addr_len < sizeof(struct sockaddr_ax25) +
+			    sizeof(ax25_address) * usax->sax25_ndigis) {
 				err = -EINVAL;
 				goto out;
 			}

From 1bcade9e776d77d29e66012c6d707a25c58782a4 Mon Sep 17 00:00:00 2001
From: Xiongfeng Wang <wangxiongfeng2@huawei.com>
Date: Tue, 21 Jul 2020 15:02:57 +0800
Subject: [PATCH 0252/2658] net-sysfs: add a newline when printing 'tx_timeout'
 by sysfs

[ Upstream commit 9bb5fbea59f36a589ef886292549ca4052fe676c ]

When I cat 'tx_timeout' by sysfs, it displays as follows. It's better to
add a newline for easy reading.

root@syzkaller:~# cat /sys/devices/virtual/net/lo/queues/tx-0/tx_timeout
0root@syzkaller:~#

Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/net-sysfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 579d351f6ddd..c976fd132c3b 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -999,7 +999,7 @@ static ssize_t show_trans_timeout(struct netdev_queue *queue,
 	trans_timeout = queue->trans_timeout;
 	spin_unlock_irq(&queue->_xmit_lock);
 
-	return sprintf(buf, "%lu", trans_timeout);
+	return sprintf(buf, fmt_ulong, trans_timeout);
 }
 
 #ifdef CONFIG_XPS

From d5c2c9eb13a7bdc4e9914c14bfd71165b29c35a6 Mon Sep 17 00:00:00 2001
From: Miaohe Lin <linmiaohe@huawei.com>
Date: Tue, 21 Jul 2020 17:11:44 +0800
Subject: [PATCH 0253/2658] net: udp: Fix wrong clean up for IS_UDPLITE macro

[ Upstream commit b0a422772fec29811e293c7c0e6f991c0fd9241d ]

We can't use IS_UDPLITE to replace udp_sk->pcflag when UDPLITE_RECV_CC is
checked.

Fixes: b2bf1e2659b1 ("[UDP]: Clean up for IS_UDPLITE macro")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/udp.c | 2 +-
 net/ipv6/udp.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 241847c611a8..938a7281fd46 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1564,7 +1564,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 	/*
 	 * 	UDP-Lite specific tests, ignored on UDP sockets
 	 */
-	if ((is_udplite & UDPLITE_RECV_CC)  &&  UDP_SKB_CB(skb)->partial_cov) {
+	if ((up->pcflag & UDPLITE_RECV_CC)  &&  UDP_SKB_CB(skb)->partial_cov) {
 
 		/*
 		 * MIB statistics other than incrementing the error count are
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index c89cf8e5eff5..868abfd0011c 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -673,7 +673,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 	/*
 	 * UDP-Lite specific tests, ignored on UDP sockets (see net/ipv4/udp.c).
 	 */
-	if ((is_udplite & UDPLITE_RECV_CC)  &&  UDP_SKB_CB(skb)->partial_cov) {
+	if ((up->pcflag & UDPLITE_RECV_CC)  &&  UDP_SKB_CB(skb)->partial_cov) {
 
 		if (up->pcrlen == 0) {          /* full coverage was set  */
 			net_dbg_ratelimited("UDPLITE6: partial coverage %d while full coverage %d requested\n",

From ca302ea9dc64258c430e56d3edd5d00758b72bc8 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 23 Jul 2020 17:49:57 +0300
Subject: [PATCH 0254/2658] AX.25: Prevent integer overflows in connect and
 sendmsg

[ Upstream commit 17ad73e941b71f3bec7523ea4e9cbc3752461c2d ]

We recently added some bounds checking in ax25_connect() and
ax25_sendmsg() and we so we removed the AX25_MAX_DIGIS checks because
they were no longer required.

Unfortunately, I believe they are required to prevent integer overflows
so I have added them back.

Fixes: 8885bb0621f0 ("AX.25: Prevent out-of-bounds read in ax25_sendmsg()")
Fixes: 2f2a7ffad5c6 ("AX.25: Fix out-of-bounds read in ax25_connect()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ax25/af_ax25.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 16d9441f2057..64fede18aa33 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1192,6 +1192,7 @@ static int __must_check ax25_connect(struct socket *sock,
 	    fsa->fsa_ax25.sax25_ndigis != 0) {
 		/* Valid number of digipeaters ? */
 		if (fsa->fsa_ax25.sax25_ndigis < 1 ||
+		    fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS ||
 		    addr_len < sizeof(struct sockaddr_ax25) +
 		    sizeof(ax25_address) * fsa->fsa_ax25.sax25_ndigis) {
 			err = -EINVAL;
@@ -1512,7 +1513,9 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 			struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax;
 
 			/* Valid number of digipeaters ? */
-			if (usax->sax25_ndigis < 1 || addr_len < sizeof(struct sockaddr_ax25) +
+			if (usax->sax25_ndigis < 1 ||
+			    usax->sax25_ndigis > AX25_MAX_DIGIS ||
+			    addr_len < sizeof(struct sockaddr_ax25) +
 			    sizeof(ax25_address) * usax->sax25_ndigis) {
 				err = -EINVAL;
 				goto out;

From 8f5f9638f3e911b181bf5ba742558effc48debdb Mon Sep 17 00:00:00 2001
From: Yuchung Cheng <ycheng@google.com>
Date: Thu, 23 Jul 2020 12:00:06 -0700
Subject: [PATCH 0255/2658] tcp: allow at most one TLP probe per flight

[ Upstream commit 76be93fc0702322179bb0ea87295d820ee46ad14 ]

Previously TLP may send multiple probes of new data in one
flight. This happens when the sender is cwnd limited. After the
initial TLP containing new data is sent, the sender receives another
ACK that acks partial inflight.  It may re-arm another TLP timer
to send more, if no further ACK returns before the next TLP timeout
(PTO) expires. The sender may send in theory a large amount of TLP
until send queue is depleted. This only happens if the sender sees
such irregular uncommon ACK pattern. But it is generally undesirable
behavior during congestion especially.

The original TLP design restrict only one TLP probe per inflight as
published in "Reducing Web Latency: the Virtue of Gentle Aggression",
SIGCOMM 2013. This patch changes TLP to send at most one probe
per inflight.

Note that if the sender is app-limited, TLP retransmits old data
and did not have this issue.

Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/tcp.h   |  5 +++--
 net/ipv4/tcp_input.c  | 11 ++++++-----
 net/ipv4/tcp_output.c | 13 ++++++++-----
 3 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 085da1707cea..b9e591582be9 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -211,7 +211,8 @@ struct tcp_sock {
 		u8 reord;    /* reordering detected */
 	} rack;
 	u16	advmss;		/* Advertised MSS			*/
-	u8	unused;
+	u8	tlp_retrans:1,	/* TLP is a retransmission */
+		unused_1:7;
 	u8	nonagle     : 4,/* Disable Nagle algorithm?             */
 		thin_lto    : 1,/* Use linear timeouts for thin streams */
 		thin_dupack : 1,/* Fast retransmit on first dupack      */
@@ -225,7 +226,7 @@ struct tcp_sock {
 		syn_data_acked:1,/* data in SYN is acked by SYN-ACK */
 		save_syn:1,	/* Save headers of SYN packet */
 		is_cwnd_limited:1;/* forward progress limited by snd_cwnd? */
-	u32	tlp_high_seq;	/* snd_nxt at the time of TLP retransmit. */
+	u32	tlp_high_seq;	/* snd_nxt at the time of TLP */
 
 /* RTT measurement */
 	u32	srtt_us;	/* smoothed round trip time << 3 in usecs */
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index e9d4e2161130..7510f578c2c1 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3518,10 +3518,8 @@ static void tcp_replace_ts_recent(struct tcp_sock *tp, u32 seq)
 	}
 }
 
-/* This routine deals with acks during a TLP episode.
- * We mark the end of a TLP episode on receiving TLP dupack or when
- * ack is after tlp_high_seq.
- * Ref: loss detection algorithm in draft-dukkipati-tcpm-tcp-loss-probe.
+/* This routine deals with acks during a TLP episode and ends an episode by
+ * resetting tlp_high_seq. Ref: TLP algorithm in draft-ietf-tcpm-rack
  */
 static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag)
 {
@@ -3530,7 +3528,10 @@ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag)
 	if (before(ack, tp->tlp_high_seq))
 		return;
 
-	if (flag & FLAG_DSACKING_ACK) {
+	if (!tp->tlp_retrans) {
+		/* TLP of new data has been acknowledged */
+		tp->tlp_high_seq = 0;
+	} else if (flag & FLAG_DSACKING_ACK) {
 		/* This DSACK means original and TLP probe arrived; no loss */
 		tp->tlp_high_seq = 0;
 	} else if (after(ack, tp->tlp_high_seq)) {
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 6086718958d9..26de4da6341f 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2271,6 +2271,11 @@ void tcp_send_loss_probe(struct sock *sk)
 	int pcount;
 	int mss = tcp_current_mss(sk);
 
+	/* At most one outstanding TLP */
+	if (tp->tlp_high_seq)
+		goto rearm_timer;
+
+	tp->tlp_retrans = 0;
 	skb = tcp_send_head(sk);
 	if (skb) {
 		if (tcp_snd_wnd_test(tp, skb, mss)) {
@@ -2293,10 +2298,6 @@ void tcp_send_loss_probe(struct sock *sk)
 		return;
 	}
 
-	/* At most one outstanding TLP retransmission. */
-	if (tp->tlp_high_seq)
-		goto rearm_timer;
-
 	if (skb_still_in_host_queue(sk, skb))
 		goto rearm_timer;
 
@@ -2317,10 +2318,12 @@ void tcp_send_loss_probe(struct sock *sk)
 	if (__tcp_retransmit_skb(sk, skb))
 		goto rearm_timer;
 
+	tp->tlp_retrans = 1;
+
+probe_sent:
 	/* Record snd_nxt for loss detection. */
 	tp->tlp_high_seq = tp->snd_nxt;
 
-probe_sent:
 	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPLOSSPROBES);
 	/* Reset s.t. tcp_rearm_rto will restart timer from now */
 	inet_csk(sk)->icsk_pending = 0;

From 0322606c28425a0a54cdd444a93baebb62673602 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Mon, 20 Jul 2020 12:41:46 +0100
Subject: [PATCH 0256/2658] rxrpc: Fix sendmsg() returning EPIPE due to
 recvmsg() returning ENODATA

[ Upstream commit 639f181f0ee20d3249dbc55f740f0167267180f0 ]

rxrpc_sendmsg() returns EPIPE if there's an outstanding error, such as if
rxrpc_recvmsg() indicating ENODATA if there's nothing for it to read.

Change rxrpc_recvmsg() to return EAGAIN instead if there's nothing to read
as this particular error doesn't get stored in ->sk_err by the networking
core.

Also change rxrpc_sendmsg() so that it doesn't fail with delayed receive
errors (there's no way for it to report which call, if any, the error was
caused by).

Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/rxrpc/ar-output.c  | 2 +-
 net/rxrpc/ar-recvmsg.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/rxrpc/ar-output.c b/net/rxrpc/ar-output.c
index 14c4e12c47b0..a1997f9a447a 100644
--- a/net/rxrpc/ar-output.c
+++ b/net/rxrpc/ar-output.c
@@ -533,7 +533,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
 	/* this should be in poll */
 	sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
 
-	if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
+	if (sk->sk_shutdown & SEND_SHUTDOWN)
 		return -EPIPE;
 
 	more = msg->msg_flags & MSG_MORE;
diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
index b92beded7459..cb9affdb1e87 100644
--- a/net/rxrpc/ar-recvmsg.c
+++ b/net/rxrpc/ar-recvmsg.c
@@ -78,7 +78,7 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
 				release_sock(&rx->sk);
 				if (continue_call)
 					rxrpc_put_call(continue_call);
-				return -ENODATA;
+				return -EAGAIN;
 			}
 		}
 

From cf72303181da938ef2632c69a1a4fe08920999c8 Mon Sep 17 00:00:00 2001
From: Wei Yongjun <weiyongjun1@huawei.com>
Date: Mon, 13 Jul 2020 23:59:50 +0800
Subject: [PATCH 0257/2658] ip6_gre: fix null-ptr-deref in ip6gre_init_net()

[ Upstream commit 46ef5b89ec0ecf290d74c4aee844f063933c4da4 ]

KASAN report null-ptr-deref error when register_netdev() failed:

KASAN: null-ptr-deref in range [0x00000000000003c0-0x00000000000003c7]
CPU: 2 PID: 422 Comm: ip Not tainted 5.8.0-rc4+ #12
Call Trace:
 ip6gre_init_net+0x4ab/0x580
 ? ip6gre_tunnel_uninit+0x3f0/0x3f0
 ops_init+0xa8/0x3c0
 setup_net+0x2de/0x7e0
 ? rcu_read_lock_bh_held+0xb0/0xb0
 ? ops_init+0x3c0/0x3c0
 ? kasan_unpoison_shadow+0x33/0x40
 ? __kasan_kmalloc.constprop.0+0xc2/0xd0
 copy_net_ns+0x27d/0x530
 create_new_namespaces+0x382/0xa30
 unshare_nsproxy_namespaces+0xa1/0x1d0
 ksys_unshare+0x39c/0x780
 ? walk_process_tree+0x2a0/0x2a0
 ? trace_hardirqs_on+0x4a/0x1b0
 ? _raw_spin_unlock_irq+0x1f/0x30
 ? syscall_trace_enter+0x1a7/0x330
 ? do_syscall_64+0x1c/0xa0
 __x64_sys_unshare+0x2d/0x40
 do_syscall_64+0x56/0xa0
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

ip6gre_tunnel_uninit() has set 'ign->fb_tunnel_dev' to NULL, later
access to ign->fb_tunnel_dev cause null-ptr-deref. Fix it by saving
'ign->fb_tunnel_dev' to local variable ndev.

Fixes: dafabb6590cb ("ip6_gre: fix use-after-free in ip6gre_tunnel_lookup()")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/ip6_gre.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 954267a2bd64..80e03a50d92d 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1359,15 +1359,16 @@ static void ip6gre_destroy_tunnels(struct net *net, struct list_head *head)
 static int __net_init ip6gre_init_net(struct net *net)
 {
 	struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
+	struct net_device *ndev;
 	int err;
 
-	ign->fb_tunnel_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0",
-					  NET_NAME_UNKNOWN,
-					  ip6gre_tunnel_setup);
-	if (!ign->fb_tunnel_dev) {
+	ndev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0",
+			    NET_NAME_UNKNOWN, ip6gre_tunnel_setup);
+	if (!ndev) {
 		err = -ENOMEM;
 		goto err_alloc_dev;
 	}
+	ign->fb_tunnel_dev = ndev;
 	dev_net_set(ign->fb_tunnel_dev, net);
 	/* FB netdevice is special: we have one, and only one per netns.
 	 * Allowing to move it to another netns is clearly unsafe.
@@ -1387,7 +1388,7 @@ static int __net_init ip6gre_init_net(struct net *net)
 	return 0;
 
 err_reg_dev:
-	ip6gre_dev_free(ign->fb_tunnel_dev);
+	ip6gre_dev_free(ndev);
 err_alloc_dev:
 	return err;
 }

From eb638abb6fefbff61dc421d30abe4ba928ddb0da Mon Sep 17 00:00:00 2001
From: Xie He <xie.he.0141@gmail.com>
Date: Thu, 16 Jul 2020 16:44:33 -0700
Subject: [PATCH 0258/2658] drivers/net/wan/x25_asy: Fix to make it work

[ Upstream commit 8fdcabeac39824fe67480fd9508d80161c541854 ]

This driver is not working because of problems of its receiving code.
This patch fixes it to make it work.

When the driver receives an LAPB frame, it should first pass the frame
to the LAPB module to process. After processing, the LAPB module passes
the data (the packet) back to the driver, the driver should then add a
one-byte pseudo header and pass the data to upper layers.

The changes to the "x25_asy_bump" function and the
"x25_asy_data_indication" function are to correctly implement this
procedure.

Also, the "x25_asy_unesc" function ignores any frame that is shorter
than 3 bytes. However the shortest frames are 2-byte long. So we need
to change it to allow 2-byte frames to pass.

Cc: Eric Dumazet <edumazet@google.com>
Cc: Martin Schiller <ms@dev.tdt.de>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Reviewed-by: Martin Schiller <ms@dev.tdt.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wan/x25_asy.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index cd39025d2abf..022487d90aa3 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -186,7 +186,7 @@ static inline void x25_asy_unlock(struct x25_asy *sl)
 	netif_wake_queue(sl->dev);
 }
 
-/* Send one completely decapsulated IP datagram to the IP layer. */
+/* Send an LAPB frame to the LAPB module to process. */
 
 static void x25_asy_bump(struct x25_asy *sl)
 {
@@ -198,13 +198,12 @@ static void x25_asy_bump(struct x25_asy *sl)
 	count = sl->rcount;
 	dev->stats.rx_bytes += count;
 
-	skb = dev_alloc_skb(count+1);
+	skb = dev_alloc_skb(count);
 	if (skb == NULL) {
 		netdev_warn(sl->dev, "memory squeeze, dropping packet\n");
 		dev->stats.rx_dropped++;
 		return;
 	}
-	skb_push(skb, 1);	/* LAPB internal control */
 	memcpy(skb_put(skb, count), sl->rbuff, count);
 	skb->protocol = x25_type_trans(skb, sl->dev);
 	err = lapb_data_received(skb->dev, skb);
@@ -212,7 +211,6 @@ static void x25_asy_bump(struct x25_asy *sl)
 		kfree_skb(skb);
 		printk(KERN_DEBUG "x25_asy: data received err - %d\n", err);
 	} else {
-		netif_rx(skb);
 		dev->stats.rx_packets++;
 	}
 }
@@ -358,12 +356,21 @@ static netdev_tx_t x25_asy_xmit(struct sk_buff *skb,
  */
 
 /*
- *	Called when I frame data arrives. We did the work above - throw it
- *	at the net layer.
+ *	Called when I frame data arrive. We add a pseudo header for upper
+ *	layers and pass it to upper layers.
  */
 
 static int x25_asy_data_indication(struct net_device *dev, struct sk_buff *skb)
 {
+	if (skb_cow(skb, 1)) {
+		kfree_skb(skb);
+		return NET_RX_DROP;
+	}
+	skb_push(skb, 1);
+	skb->data[0] = X25_IFACE_DATA;
+
+	skb->protocol = x25_type_trans(skb, dev);
+
 	return netif_rx(skb);
 }
 
@@ -655,7 +662,7 @@ static void x25_asy_unesc(struct x25_asy *sl, unsigned char s)
 	switch (s) {
 	case X25_END:
 		if (!test_and_clear_bit(SLF_ERROR, &sl->flags) &&
-		    sl->rcount > 2)
+		    sl->rcount >= 2)
 			x25_asy_bump(sl);
 		clear_bit(SLF_ESCAPE, &sl->flags);
 		sl->rcount = 0;

From 536fe5b3abc42cbdb39c5cb21621214cfba1ea59 Mon Sep 17 00:00:00 2001
From: Fangrui Song <maskray@google.com>
Date: Tue, 21 Jul 2020 10:31:23 -0700
Subject: [PATCH 0259/2658] Makefile: Fix GCC_TOOLCHAIN_DIR prefix for Clang
 cross compilation

commit ca9b31f6bb9c6aa9b4e5f0792f39a97bbffb8c51 upstream.

When CROSS_COMPILE is set (e.g. aarch64-linux-gnu-), if
$(CROSS_COMPILE)elfedit is found at /usr/bin/aarch64-linux-gnu-elfedit,
GCC_TOOLCHAIN_DIR will be set to /usr/bin/.  --prefix= will be set to
/usr/bin/ and Clang as of 11 will search for both
$(prefix)aarch64-linux-gnu-$needle and $(prefix)$needle.

GCC searchs for $(prefix)aarch64-linux-gnu/$version/$needle,
$(prefix)aarch64-linux-gnu/$needle and $(prefix)$needle. In practice,
$(prefix)aarch64-linux-gnu/$needle rarely contains executables.

To better model how GCC's -B/--prefix takes in effect in practice, newer
Clang (since
https://github.com/llvm/llvm-project/commit/3452a0d8c17f7166f479706b293caf6ac76ffd90)
only searches for $(prefix)$needle. Currently it will find /usr/bin/as
instead of /usr/bin/aarch64-linux-gnu-as.

Set --prefix= to $(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE))
(/usr/bin/aarch64-linux-gnu-) so that newer Clang can find the
appropriate cross compiling GNU as (when -no-integrated-as is in
effect).

Cc: stable@vger.kernel.org
Reported-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Fangrui Song <maskray@google.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Tested-by: Nathan Chancellor <natechancellor@gmail.com>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Link: https://github.com/ClangBuiltLinux/linux/issues/1099
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
[nc: Adjust context, CLANG_FLAGS does not exist in 4.4]
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

From 89679584422b8f351d8fec1aeeaa260e6454e040 Mon Sep 17 00:00:00 2001
From: Peng Fan <peng.fan@nxp.com>
Date: Fri, 13 Mar 2020 09:58:07 +0800
Subject: [PATCH 0260/2658] regmap: debugfs: check count when read regmap file

commit 74edd08a4fbf51d65fd8f4c7d8289cd0f392bd91 upstream.

When executing the following command, we met kernel dump.
dmesg -c > /dev/null; cd /sys;
for i in `ls /sys/kernel/debug/regmap/* -d`; do
	echo "Checking regmap in $i";
	cat $i/registers;
done && grep -ri "0x02d0" *;

It is because the count value is too big, and kmalloc fails. So add an
upper bound check to allow max size `PAGE_SIZE << (MAX_ORDER - 1)`.

Signed-off-by: Peng Fan <peng.fan@nxp.com>
Link: https://lore.kernel.org/r/1584064687-12964-1-git-send-email-peng.fan@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/regmap/regmap-debugfs.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index 3120bdc84fce..52d6bf710e74 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -194,6 +194,9 @@ static ssize_t regmap_read_debugfs(struct regmap *map, unsigned int from,
 	if (*ppos < 0 || !count)
 		return -EINVAL;
 
+	if (count > (PAGE_SIZE << (MAX_ORDER - 1)))
+		count = PAGE_SIZE << (MAX_ORDER - 1);
+
 	buf = kmalloc(count, GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;
@@ -402,6 +405,9 @@ static ssize_t regmap_reg_ranges_read_file(struct file *file,
 	if (*ppos < 0 || !count)
 		return -EINVAL;
 
+	if (count > (PAGE_SIZE << (MAX_ORDER - 1)))
+		count = PAGE_SIZE << (MAX_ORDER - 1);
+
 	buf = kmalloc(count, GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;

From 0a248bbbbc4c279936de027d9815baefbc818f1b Mon Sep 17 00:00:00 2001
From: Eric Sandeen <sandeen@redhat.com>
Date: Mon, 16 Apr 2018 23:07:27 -0700
Subject: [PATCH 0261/2658] xfs: set format back to extents if
 xfs_bmap_extents_to_btree

commit 2c4306f719b083d17df2963bc761777576b8ad1b upstream.

If xfs_bmap_extents_to_btree fails in a mode where we call
xfs_iroot_realloc(-1) to de-allocate the root, set the
format back to extents.

Otherwise we can assume we can dereference ifp->if_broot
based on the XFS_DINODE_FMT_BTREE format, and crash.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199423
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
[iwamatsu: backported to 4.4.y]
Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/libxfs/xfs_bmap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index d98ba57ef01a..c167bdaafc50 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -793,6 +793,8 @@ xfs_bmap_extents_to_btree(
 	*logflagsp = 0;
 	if ((error = xfs_alloc_vextent(&args))) {
 		xfs_iroot_realloc(ip, -1, whichfork);
+		ASSERT(ifp->if_broot == NULL);
+		XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS);
 		xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
 		return error;
 	}

From 910de8f32395e16a7c906db0565be64125f95784 Mon Sep 17 00:00:00 2001
From: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Date: Thu, 2 Jul 2020 21:42:18 +0900
Subject: [PATCH 0262/2658] tools/lib/subcmd/pager.c: do not alias select()
 params

commit dfbc3c6cb747c074aa2ba0a10bbeea588d6dfda6 upstream.

[ Change applied file from tools/lib/subcmd/pager.c to
  tools/perf/util/pager.c ]

Use a separate fd set for select()-s exception fds param to fix the
following gcc warning:

  pager.c:36:12: error: passing argument 2 to restrict-qualified parameter aliases with argument 4 [-Werror=restrict]
    select(1, &in, NULL, &in, NULL);
              ^~~        ~~~

Link: http://lkml.kernel.org/r/20180101105626.7168-1-sergey.senozhatsky@gmail.com
Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/util/pager.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/perf/util/pager.c b/tools/perf/util/pager.c
index 53ef006a951c..b301d779c4af 100644
--- a/tools/perf/util/pager.c
+++ b/tools/perf/util/pager.c
@@ -16,10 +16,13 @@ static void pager_preexec(void)
 	 * have real input
 	 */
 	fd_set in;
+	fd_set exception;
 
 	FD_ZERO(&in);
+	FD_ZERO(&exception);
 	FD_SET(0, &in);
-	select(1, &in, NULL, &in, NULL);
+	FD_SET(0, &exception);
+	select(1, &in, NULL, &exception, NULL);
 
 	setenv("LESS", "FRSX", 0);
 }

From 477e48f13d7f057c394655f12ea5a15560fa6001 Mon Sep 17 00:00:00 2001
From: Changbin Du <changbin.du@gmail.com>
Date: Thu, 2 Jul 2020 21:42:09 +0900
Subject: [PATCH 0263/2658] perf: Make perf able to build with latest libbfd

commit 0ada120c883d4f1f6aafd01cf0fbb10d8bbba015 upstream.

libbfd has changed the bfd_section_* macros to inline functions
bfd_section_<field> since 2019-09-18. See below two commits:
  o http://www.sourceware.org/ml/gdb-cvs/2019-09/msg00064.html
  o https://www.sourceware.org/ml/gdb-cvs/2019-09/msg00072.html

This fix make perf able to build with both old and new libbfd.

Signed-off-by: Changbin Du <changbin.du@gmail.com>
Acked-by: Jiri Olsa <jolsa@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lore.kernel.org/lkml/20200128152938.31413-1-changbin.du@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/util/srcline.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c
index b4db3f48e3b0..2853d4728ab9 100644
--- a/tools/perf/util/srcline.c
+++ b/tools/perf/util/srcline.c
@@ -86,16 +86,30 @@ static void find_address_in_section(bfd *abfd, asection *section, void *data)
 	bfd_vma pc, vma;
 	bfd_size_type size;
 	struct a2l_data *a2l = data;
+	flagword flags;
 
 	if (a2l->found)
 		return;
 
-	if ((bfd_get_section_flags(abfd, section) & SEC_ALLOC) == 0)
+#ifdef bfd_get_section_flags
+	flags = bfd_get_section_flags(abfd, section);
+#else
+	flags = bfd_section_flags(section);
+#endif
+	if ((flags & SEC_ALLOC) == 0)
 		return;
 
 	pc = a2l->addr;
+#ifdef bfd_get_section_vma
 	vma = bfd_get_section_vma(abfd, section);
+#else
+	vma = bfd_section_vma(section);
+#endif
+#ifdef bfd_get_section_size
 	size = bfd_get_section_size(section);
+#else
+	size = bfd_section_size(section);
+#endif
 
 	if (pc < vma || pc >= vma + size)
 		return;

From 301a7ecebc3dad8b034472c07f37250466f13426 Mon Sep 17 00:00:00 2001
From: Jiri Olsa <jolsa@kernel.org>
Date: Thu, 2 Jul 2020 21:42:00 +0900
Subject: [PATCH 0264/2658] perf tools: Fix snprint warnings for gcc 8
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 77f18153c080855e1c3fb520ca31a4e61530121d upstream.

[Add an additional sprintf replacement in tools/perf/builtin-script.c]

With gcc 8 we get new set of snprintf() warnings that breaks the
compilation, one example:

  tests/mem.c: In function ‘check’:
  tests/mem.c:19:48: error: ‘%s’ directive output may be truncated writing \
        up to 99 bytes into a region of size 89 [-Werror=format-truncation=]
    snprintf(failure, sizeof failure, "unexpected %s", out);

The gcc docs says:

 To avoid the warning either use a bigger buffer or handle the
 function's return value which indicates whether or not its output
 has been truncated.

Given that all these warnings are harmless, because the code either
properly fails due to uncomplete file path or we don't care for
truncated output at all, I'm changing all those snprintf() calls to
scnprintf(), which actually 'checks' for the snprint return value so the
gcc stays silent.

Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
Link: http://lkml.kernel.org/r/20180319082902.4518-1-jolsa@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/builtin-script.c    | 24 ++++++++++++------------
 tools/perf/tests/attr.c        |  4 ++--
 tools/perf/tests/pmu.c         |  2 +-
 tools/perf/util/cgroup.c       |  2 +-
 tools/perf/util/parse-events.c |  4 ++--
 tools/perf/util/pmu.c          |  2 +-
 6 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index 48840556bf2d..81e3f2eba45e 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -1246,7 +1246,7 @@ static int is_directory(const char *base_path, const struct dirent *dent)
 	char path[PATH_MAX];
 	struct stat st;
 
-	sprintf(path, "%s/%s", base_path, dent->d_name);
+	scnprintf(path, PATH_MAX, "%s/%s", base_path, dent->d_name);
 	if (stat(path, &st))
 		return 0;
 
@@ -1427,8 +1427,8 @@ static int list_available_scripts(const struct option *opt __maybe_unused,
 		return -1;
 
 	for_each_lang(scripts_path, scripts_dir, lang_dirent) {
-		snprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path,
-			 lang_dirent->d_name);
+		scnprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path,
+			  lang_dirent->d_name);
 		lang_dir = opendir(lang_path);
 		if (!lang_dir)
 			continue;
@@ -1437,8 +1437,8 @@ static int list_available_scripts(const struct option *opt __maybe_unused,
 			script_root = get_script_root(script_dirent, REPORT_SUFFIX);
 			if (script_root) {
 				desc = script_desc__findnew(script_root);
-				snprintf(script_path, MAXPATHLEN, "%s/%s",
-					 lang_path, script_dirent->d_name);
+				scnprintf(script_path, MAXPATHLEN, "%s/%s",
+					  lang_path, script_dirent->d_name);
 				read_script_info(desc, script_path);
 				free(script_root);
 			}
@@ -1474,7 +1474,7 @@ static int check_ev_match(char *dir_name, char *scriptname,
 	int match, len;
 	FILE *fp;
 
-	sprintf(filename, "%s/bin/%s-record", dir_name, scriptname);
+	scnprintf(filename, MAXPATHLEN, "%s/bin/%s-record", dir_name, scriptname);
 
 	fp = fopen(filename, "r");
 	if (!fp)
@@ -1550,8 +1550,8 @@ int find_scripts(char **scripts_array, char **scripts_path_array)
 	}
 
 	for_each_lang(scripts_path, scripts_dir, lang_dirent) {
-		snprintf(lang_path, MAXPATHLEN, "%s/%s", scripts_path,
-			 lang_dirent->d_name);
+		scnprintf(lang_path, MAXPATHLEN, "%s/%s", scripts_path,
+			  lang_dirent->d_name);
 #ifdef NO_LIBPERL
 		if (strstr(lang_path, "perl"))
 			continue;
@@ -1606,8 +1606,8 @@ static char *get_script_path(const char *script_root, const char *suffix)
 		return NULL;
 
 	for_each_lang(scripts_path, scripts_dir, lang_dirent) {
-		snprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path,
-			 lang_dirent->d_name);
+		scnprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path,
+			  lang_dirent->d_name);
 		lang_dir = opendir(lang_path);
 		if (!lang_dir)
 			continue;
@@ -1618,8 +1618,8 @@ static char *get_script_path(const char *script_root, const char *suffix)
 				free(__script_root);
 				closedir(lang_dir);
 				closedir(scripts_dir);
-				snprintf(script_path, MAXPATHLEN, "%s/%s",
-					 lang_path, script_dirent->d_name);
+				scnprintf(script_path, MAXPATHLEN, "%s/%s",
+					  lang_path, script_dirent->d_name);
 				return strdup(script_path);
 			}
 			free(__script_root);
diff --git a/tools/perf/tests/attr.c b/tools/perf/tests/attr.c
index 79547c225c14..9c81fbfb16d2 100644
--- a/tools/perf/tests/attr.c
+++ b/tools/perf/tests/attr.c
@@ -147,8 +147,8 @@ static int run_dir(const char *d, const char *perf)
 	if (verbose)
 		vcnt++;
 
-	snprintf(cmd, 3*PATH_MAX, PYTHON " %s/attr.py -d %s/attr/ -p %s %.*s",
-		 d, d, perf, vcnt, v);
+	scnprintf(cmd, 3*PATH_MAX, PYTHON " %s/attr.py -d %s/attr/ -p %s %.*s",
+		  d, d, perf, vcnt, v);
 
 	return system(cmd) ? TEST_FAIL : TEST_OK;
 }
diff --git a/tools/perf/tests/pmu.c b/tools/perf/tests/pmu.c
index faa04e9d5d5f..b776831ceeea 100644
--- a/tools/perf/tests/pmu.c
+++ b/tools/perf/tests/pmu.c
@@ -95,7 +95,7 @@ static char *test_format_dir_get(void)
 		struct test_format *format = &test_formats[i];
 		FILE *file;
 
-		snprintf(name, PATH_MAX, "%s/%s", dir, format->name);
+		scnprintf(name, PATH_MAX, "%s/%s", dir, format->name);
 
 		file = fopen(name, "w");
 		if (!file)
diff --git a/tools/perf/util/cgroup.c b/tools/perf/util/cgroup.c
index 32e12ecfe9c5..a32f0b34e3ed 100644
--- a/tools/perf/util/cgroup.c
+++ b/tools/perf/util/cgroup.c
@@ -64,7 +64,7 @@ static int open_cgroup(char *name)
 	if (cgroupfs_find_mountpoint(mnt, PATH_MAX + 1))
 		return -1;
 
-	snprintf(path, PATH_MAX, "%s/%s", mnt, name);
+	scnprintf(path, PATH_MAX, "%s/%s", mnt, name);
 
 	fd = open(path, O_RDONLY);
 	if (fd == -1)
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index 4a7e0132294f..eff2d3c67fae 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -194,8 +194,8 @@ struct tracepoint_path *tracepoint_id_to_path(u64 config)
 
 		for_each_event(sys_dirent, evt_dir, evt_dirent) {
 
-			snprintf(evt_path, MAXPATHLEN, "%s/%s/id", dir_path,
-				 evt_dirent->d_name);
+			scnprintf(evt_path, MAXPATHLEN, "%s/%s/id", dir_path,
+				  evt_dirent->d_name);
 			fd = open(evt_path, O_RDONLY);
 			if (fd < 0)
 				continue;
diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
index 4f650ebd564a..5245fbd09106 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
@@ -302,7 +302,7 @@ static int pmu_aliases_parse(char *dir, struct list_head *head)
 		if (pmu_alias_info_file(name))
 			continue;
 
-		snprintf(path, PATH_MAX, "%s/%s", dir, name);
+		scnprintf(path, PATH_MAX, "%s/%s", dir, name);
 
 		file = fopen(path, "r");
 		if (!file) {

From 91782ef50ee98bf55f7f493bed3e166cbd6aef8e Mon Sep 17 00:00:00 2001
From: Arnaldo Carvalho de Melo <acme@redhat.com>
Date: Thu, 2 Jul 2020 21:41:51 +0900
Subject: [PATCH 0265/2658] perf annotate: Use asprintf when formatting objdump
 command line

commit 6810158d526e483868e519befff407b91e76b3db upstream.

We were using a local buffer with an arbitrary size, that would have to
get increased to avoid truncation as warned by gcc 8:

  util/annotate.c: In function 'symbol__disassemble':
  util/annotate.c:1488:4: error: '%s' directive output may be truncated writing up to 4095 bytes into a region of size between 3966 and 8086 [-Werror=format-truncation=]
      "%s %s%s --start-address=0x%016" PRIx64
      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  util/annotate.c:1498:20:
      symfs_filename, symfs_filename);
                      ~~~~~~~~~~~~~~
  util/annotate.c:1490:50: note: format string is defined here
      " -l -d %s %s -C \"%s\" 2>/dev/null|grep -v \"%s:\"|expand",
                                                  ^~
  In file included from /usr/include/stdio.h:861,
                   from util/color.h:5,
                   from util/sort.h:8,
                   from util/annotate.c:14:
  /usr/include/bits/stdio2.h:67:10: note: '__builtin___snprintf_chk' output 116 or more bytes (assuming 8331) into a destination of size 8192
     return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1,
            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
          __bos (__s), __fmt, __va_arg_pack ());
          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

So switch to asprintf, that will make sure enough space is available.

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Jin Yao <yao.jin@linux.intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Link: https://lkml.kernel.org/n/tip-qagoy2dmbjpc9gdnaj0r3mml@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/util/annotate.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index 1dd1949b0e79..1e1c37a17355 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -1077,7 +1077,7 @@ int symbol__annotate(struct symbol *sym, struct map *map, size_t privsize)
 	struct dso *dso = map->dso;
 	char *filename = dso__build_id_filename(dso, NULL, 0);
 	bool free_filename = true;
-	char command[PATH_MAX * 2];
+	char *command;
 	FILE *file;
 	int err = 0;
 	char symfs_filename[PATH_MAX];
@@ -1192,7 +1192,7 @@ int symbol__annotate(struct symbol *sym, struct map *map, size_t privsize)
 		strcpy(symfs_filename, tmp);
 	}
 
-	snprintf(command, sizeof(command),
+	err = asprintf(&command,
 		 "%s %s%s --start-address=0x%016" PRIx64
 		 " --stop-address=0x%016" PRIx64
 		 " -l -d %s %s -C %s 2>/dev/null|grep -v %s|expand",
@@ -1205,6 +1205,11 @@ int symbol__annotate(struct symbol *sym, struct map *map, size_t privsize)
 		 symbol_conf.annotate_src ? "-S" : "",
 		 symfs_filename, filename);
 
+	if (err < 0) {
+		pr_err("Failure allocating memory for the command to run\n");
+		goto out_remove_tmp;
+	}
+
 	pr_debug("Executing: %s\n", command);
 
 	file = popen(command, "r");
@@ -1214,7 +1219,7 @@ int symbol__annotate(struct symbol *sym, struct map *map, size_t privsize)
 		 * If we were using debug info should retry with
 		 * original binary.
 		 */
-		goto out_remove_tmp;
+		goto out_free_command;
 	}
 
 	nline = 0;
@@ -1237,6 +1242,9 @@ int symbol__annotate(struct symbol *sym, struct map *map, size_t privsize)
 
 	pclose(file);
 
+out_free_command:
+	free(command);
+
 out_remove_tmp:
 	if (dso__needs_decompress(dso))
 		unlink(symfs_filename);

From 769f0abf3cde1e8f5c210c1ac45bc5e27cbd2769 Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: Thu, 2 Jul 2020 21:41:42 +0900
Subject: [PATCH 0266/2658] perf probe: Fix to check blacklist address
 correctly

commit 80526491c2ca6abc028c0f0dbb0707a1f35fb18a upstream.

Fix to check kprobe blacklist address correctly with relocated address
by adjusting debuginfo address.

Since the address in the debuginfo is same as objdump, it is different
from relocated kernel address with KASLR.  Thus, 'perf probe' always
misses to catch the blacklisted addresses.

Without this patch, 'perf probe' can not detect the blacklist addresses
on a KASLR enabled kernel.

  # perf probe kprobe_dispatcher
  Failed to write event: Invalid argument
    Error: Failed to add events.
  #

With this patch, it correctly shows the error message.

  # perf probe kprobe_dispatcher
  kprobe_dispatcher is blacklisted function, skip it.
  Probe point 'kprobe_dispatcher' not found.
    Error: Failed to add events.
  #

Fixes: 9aaf5a5f479b ("perf probe: Check kprobes blacklist when adding new events")
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: stable@vger.kernel.org
Link: http://lore.kernel.org/lkml/158763966411.30755.5882376357738273695.stgit@devnote2
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/util/probe-event.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 0195b7e8c54a..4f05424096b6 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -122,7 +122,7 @@ static struct symbol *__find_kernel_function(u64 addr, struct map **mapp)
 	return machine__find_kernel_function(host_machine, addr, mapp, NULL);
 }
 
-static struct ref_reloc_sym *kernel_get_ref_reloc_sym(void)
+static struct ref_reloc_sym *kernel_get_ref_reloc_sym(struct map **pmap)
 {
 	/* kmap->ref_reloc_sym should be set if host_machine is initialized */
 	struct kmap *kmap;
@@ -134,6 +134,10 @@ static struct ref_reloc_sym *kernel_get_ref_reloc_sym(void)
 	kmap = map__kmap(map);
 	if (!kmap)
 		return NULL;
+
+	if (pmap)
+		*pmap = map;
+
 	return kmap->ref_reloc_sym;
 }
 
@@ -145,7 +149,7 @@ static int kernel_get_symbol_address_by_name(const char *name, u64 *addr,
 	struct map *map;
 
 	/* ref_reloc_sym is just a label. Need a special fix*/
-	reloc_sym = kernel_get_ref_reloc_sym();
+	reloc_sym = kernel_get_ref_reloc_sym(NULL);
 	if (reloc_sym && strcmp(name, reloc_sym->name) == 0)
 		*addr = (reloc) ? reloc_sym->addr : reloc_sym->unrelocated_addr;
 	else {
@@ -618,6 +622,7 @@ static int post_process_probe_trace_events(struct probe_trace_event *tevs,
 					   bool uprobe)
 {
 	struct ref_reloc_sym *reloc_sym;
+	struct map *map;
 	char *tmp;
 	int i, skipped = 0;
 
@@ -628,7 +633,7 @@ static int post_process_probe_trace_events(struct probe_trace_event *tevs,
 	if (module)
 		return add_module_to_probe_trace_events(tevs, ntevs, module);
 
-	reloc_sym = kernel_get_ref_reloc_sym();
+	reloc_sym = kernel_get_ref_reloc_sym(&map);
 	if (!reloc_sym) {
 		pr_warning("Relocated base symbol is not found!\n");
 		return -EINVAL;
@@ -637,9 +642,13 @@ static int post_process_probe_trace_events(struct probe_trace_event *tevs,
 	for (i = 0; i < ntevs; i++) {
 		if (!tevs[i].point.address || tevs[i].point.retprobe)
 			continue;
-		/* If we found a wrong one, mark it by NULL symbol */
+		/*
+		 * If we found a wrong one, mark it by NULL symbol.
+		 * Since addresses in debuginfo is same as objdump, we need
+		 * to convert it to addresses on memory.
+		 */
 		if (kprobe_warn_out_range(tevs[i].point.symbol,
-					  tevs[i].point.address)) {
+			map__objdump_2mem(map, tevs[i].point.address))) {
 			tmp = NULL;
 			skipped++;
 		} else {
@@ -2553,7 +2562,7 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev,
 
 	/* Note that the symbols in the kmodule are not relocated */
 	if (!pev->uprobes && !pp->retprobe && !pev->target) {
-		reloc_sym = kernel_get_ref_reloc_sym();
+		reloc_sym = kernel_get_ref_reloc_sym(NULL);
 		if (!reloc_sym) {
 			pr_warning("Relocated base symbol is not found!\n");
 			ret = -EINVAL;

From ba274a126b0493868408f7475e0bb407f0ebca40 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 31 Jul 2020 16:43:17 +0200
Subject: [PATCH 0267/2658] Linux 4.4.232

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index fa5871a82605..013ebc5bd74c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 231
+SUBLEVEL = 232
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From c8c3e1f3d47067792658fad450d745666bb9b0f2 Mon Sep 17 00:00:00 2001
From: Eric Sandeen <sandeen@sandeen.net>
Date: Fri, 8 Jun 2018 09:53:49 -0700
Subject: [PATCH 0268/2658] xfs: don't call xfs_da_shrink_inode with NULL bp

[ Upstream commit bb3d48dcf86a97dc25fe9fc2c11938e19cb4399a ]

xfs_attr3_leaf_create may have errored out before instantiating a buffer,
for example if the blkno is out of range.  In that case there is no work
to do to remove it, and in fact xfs_da_shrink_inode will lead to an oops
if we try.

This also seems to fix a flaw where the original error from
xfs_attr3_leaf_create gets overwritten in the cleanup case, and it
removes a pointless assignment to bp which isn't used after this.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199969
Reported-by: Xu, Wen <wen.xu@gatech.edu>
Tested-by: Xu, Wen <wen.xu@gatech.edu>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/libxfs/xfs_attr_leaf.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
index 01a5ecfedfcf..445a3f2f871f 100644
--- a/fs/xfs/libxfs/xfs_attr_leaf.c
+++ b/fs/xfs/libxfs/xfs_attr_leaf.c
@@ -779,9 +779,8 @@ xfs_attr_shortform_to_leaf(xfs_da_args_t *args)
 	ASSERT(blkno == 0);
 	error = xfs_attr3_leaf_create(args, blkno, &bp);
 	if (error) {
-		error = xfs_da_shrink_inode(args, 0, bp);
-		bp = NULL;
-		if (error)
+		/* xfs_attr3_leaf_create may not have instantiated a block */
+		if (bp && (xfs_da_shrink_inode(args, 0, bp) != 0))
 			goto out;
 		xfs_idata_realloc(dp, size, XFS_ATTR_FORK);	/* try to put */
 		memcpy(ifp->if_u1.if_data, tmpbuffer, size);	/* it back */

From cb19281f54055edfffe6cb0d1f749a7a7b1ac304 Mon Sep 17 00:00:00 2001
From: Wei Yongjun <weiyongjun1@huawei.com>
Date: Thu, 11 Jan 2018 11:21:51 +0000
Subject: [PATCH 0269/2658] net: phy: mdio-bcm-unimac: fix potential NULL
 dereference in unimac_mdio_probe()

[ Upstream commit 297a6961ffb8ff4dc66c9fbf53b924bd1dda05d5 ]

platform_get_resource() may fail and return NULL, so we should
better check it's return value to avoid a NULL pointer dereference
a bit later in the code.

This is detected by Coccinelle semantic patch.

@@
expression pdev, res, n, t, e, e1, e2;
@@

res = platform_get_resource(pdev, t, n);
+ if (!res)
+   return -EINVAL;
... when != res == NULL
e = devm_ioremap(e1, res->start, e2);

Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/mdio-bcm-unimac.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/phy/mdio-bcm-unimac.c b/drivers/net/phy/mdio-bcm-unimac.c
index 4bde5e728fe0..fd8692b477c9 100644
--- a/drivers/net/phy/mdio-bcm-unimac.c
+++ b/drivers/net/phy/mdio-bcm-unimac.c
@@ -177,6 +177,8 @@ static int unimac_mdio_probe(struct platform_device *pdev)
 		return -ENOMEM;
 
 	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!r)
+		return -EINVAL;
 
 	/* Just ioremap, as this MDIO block is usually integrated into an
 	 * Ethernet MAC controller register range

From 8101601a5623ece36da1b0455a312815c136b978 Mon Sep 17 00:00:00 2001
From: Navid Emamdoost <navid.emamdoost@gmail.com>
Date: Wed, 25 Sep 2019 12:02:41 -0300
Subject: [PATCH 0270/2658] media: rc: prevent memory leak in cx23888_ir_probe

[ Upstream commit a7b2df76b42bdd026e3106cf2ba97db41345a177 ]

In cx23888_ir_probe if kfifo_alloc fails the allocated memory for state
should be released.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/cx23885/cx23888-ir.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/media/pci/cx23885/cx23888-ir.c b/drivers/media/pci/cx23885/cx23888-ir.c
index c1aa888af705..83864a99d3a6 100644
--- a/drivers/media/pci/cx23885/cx23888-ir.c
+++ b/drivers/media/pci/cx23885/cx23888-ir.c
@@ -1179,8 +1179,11 @@ int cx23888_ir_probe(struct cx23885_dev *dev)
 		return -ENOMEM;
 
 	spin_lock_init(&state->rx_kfifo_lock);
-	if (kfifo_alloc(&state->rx_kfifo, CX23888_IR_RX_KFIFO_SIZE, GFP_KERNEL))
+	if (kfifo_alloc(&state->rx_kfifo, CX23888_IR_RX_KFIFO_SIZE,
+			GFP_KERNEL)) {
+		kfree(state);
 		return -ENOMEM;
+	}
 
 	state->dev = dev;
 	sd = &state->sd;

From 83e28d112bd2ef481686805fabaf231482335cc7 Mon Sep 17 00:00:00 2001
From: Navid Emamdoost <navid.emamdoost@gmail.com>
Date: Fri, 6 Sep 2019 13:26:03 -0500
Subject: [PATCH 0271/2658] ath9k_htc: release allocated buffer if timed out

[ Upstream commit 853acf7caf10b828102d92d05b5c101666a6142b ]

In htc_config_pipe_credits, htc_setup_complete, and htc_connect_service
if time out happens, the allocated buffer needs to be released.
Otherwise there will be memory leak.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath9k/htc_hst.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index 257b6ee51e54..1af216aa5ada 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -175,6 +175,7 @@ static int htc_config_pipe_credits(struct htc_target *target)
 	time_left = wait_for_completion_timeout(&target->cmd_wait, HZ);
 	if (!time_left) {
 		dev_err(target->dev, "HTC credit config timeout\n");
+		kfree_skb(skb);
 		return -ETIMEDOUT;
 	}
 
@@ -211,6 +212,7 @@ static int htc_setup_complete(struct htc_target *target)
 	time_left = wait_for_completion_timeout(&target->cmd_wait, HZ);
 	if (!time_left) {
 		dev_err(target->dev, "HTC start timeout\n");
+		kfree_skb(skb);
 		return -ETIMEDOUT;
 	}
 
@@ -284,6 +286,7 @@ int htc_connect_service(struct htc_target *target,
 	if (!time_left) {
 		dev_err(target->dev, "Service connection timeout for: %d\n",
 			service_connreq->service_id);
+		kfree_skb(skb);
 		return -ETIMEDOUT;
 	}
 

From 6073114d4c8ea08e031425e216d9623ced585b34 Mon Sep 17 00:00:00 2001
From: Navid Emamdoost <navid.emamdoost@gmail.com>
Date: Fri, 6 Sep 2019 13:59:30 -0500
Subject: [PATCH 0272/2658] ath9k: release allocated buffer if timed out

[ Upstream commit 728c1e2a05e4b5fc52fab3421dce772a806612a2 ]

In ath9k_wmi_cmd, the allocated network buffer needs to be released
if timeout happens. Otherwise memory will be leaked.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath9k/wmi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index 8f14897ae5a3..f100533eb7ad 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -340,6 +340,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
 		ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n",
 			wmi_cmd_to_name(cmd_id));
 		mutex_unlock(&wmi->op_mutex);
+		kfree_skb(skb);
 		return -ETIMEDOUT;
 	}
 

From 098dd9f6d5c56b683262dc5d68f73a20f718c9e4 Mon Sep 17 00:00:00 2001
From: Andreas Gruenbacher <agruenba@redhat.com>
Date: Wed, 2 Dec 2015 14:44:41 +0100
Subject: [PATCH 0273/2658] nfs: Move call to security_inode_listsecurity into
 nfs_listxattr

[ Upstream commit c4803c497fbdb37e96af614813a7cfb434b6682a ]

Add a nfs_listxattr operation.  Move the call to security_inode_listsecurity
from list operation of the "security.*" xattr handler to nfs_listxattr.

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Cc: Trond Myklebust <trond.myklebust@primarydata.com>
Cc: Anna Schumaker <anna.schumaker@netapp.com>
Cc: linux-nfs@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs4proc.c          | 53 ++++++++++++++++++++++++++------------
 fs/xattr.c                 |  4 +++
 security/smack/smack_lsm.c |  2 --
 3 files changed, 40 insertions(+), 19 deletions(-)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 0308b5689638..566afcc36adb 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -6296,10 +6296,6 @@ static size_t nfs4_xattr_list_nfs4_acl(const struct xattr_handler *handler,
 }
 
 #ifdef CONFIG_NFS_V4_SECURITY_LABEL
-static inline int nfs4_server_supports_labels(struct nfs_server *server)
-{
-	return server->caps & NFS_CAP_SECURITY_LABEL;
-}
 
 static int nfs4_xattr_set_nfs4_label(const struct xattr_handler *handler,
 				     struct dentry *dentry, const char *key,
@@ -6321,29 +6317,34 @@ static int nfs4_xattr_get_nfs4_label(const struct xattr_handler *handler,
 	return -EOPNOTSUPP;
 }
 
-static size_t nfs4_xattr_list_nfs4_label(const struct xattr_handler *handler,
-					 struct dentry *dentry, char *list,
-					 size_t list_len, const char *name,
-					 size_t name_len)
+static ssize_t
+nfs4_listxattr_nfs4_label(struct inode *inode, char *list, size_t list_len)
 {
-	size_t len = 0;
+	int len = 0;
 
-	if (nfs_server_capable(d_inode(dentry), NFS_CAP_SECURITY_LABEL)) {
-		len = security_inode_listsecurity(d_inode(dentry), NULL, 0);
-		if (list && len <= list_len)
-			security_inode_listsecurity(d_inode(dentry), list, len);
+	if (nfs_server_capable(inode, NFS_CAP_SECURITY_LABEL)) {
+		len = security_inode_listsecurity(inode, list, list_len);
+		if (list_len && len > list_len)
+			return -ERANGE;
 	}
 	return len;
 }
 
 static const struct xattr_handler nfs4_xattr_nfs4_label_handler = {
 	.prefix = XATTR_SECURITY_PREFIX,
-	.list	= nfs4_xattr_list_nfs4_label,
 	.get	= nfs4_xattr_get_nfs4_label,
 	.set	= nfs4_xattr_set_nfs4_label,
 };
-#endif
 
+#else
+
+static ssize_t
+nfs4_listxattr_nfs4_label(struct inode *inode, char *list, size_t list_len)
+{
+	return 0;
+}
+
+#endif
 
 /*
  * nfs_fhget will use either the mounted_on_fileid or the fileid
@@ -8773,6 +8774,24 @@ const struct nfs4_minor_version_ops *nfs_v4_minor_ops[] = {
 #endif
 };
 
+ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size)
+{
+	ssize_t error, error2;
+
+	error = generic_listxattr(dentry, list, size);
+	if (error < 0)
+		return error;
+	if (list) {
+		list += error;
+		size -= error;
+	}
+
+	error2 = nfs4_listxattr_nfs4_label(d_inode(dentry), list, size);
+	if (error2 < 0)
+		return error2;
+	return error + error2;
+}
+
 static const struct inode_operations nfs4_dir_inode_operations = {
 	.create		= nfs_create,
 	.lookup		= nfs_lookup,
@@ -8789,7 +8808,7 @@ static const struct inode_operations nfs4_dir_inode_operations = {
 	.setattr	= nfs_setattr,
 	.getxattr	= generic_getxattr,
 	.setxattr	= generic_setxattr,
-	.listxattr	= generic_listxattr,
+	.listxattr	= nfs4_listxattr,
 	.removexattr	= generic_removexattr,
 };
 
@@ -8799,7 +8818,7 @@ static const struct inode_operations nfs4_file_inode_operations = {
 	.setattr	= nfs_setattr,
 	.getxattr	= generic_getxattr,
 	.setxattr	= generic_setxattr,
-	.listxattr	= generic_listxattr,
+	.listxattr	= nfs4_listxattr,
 	.removexattr	= generic_removexattr,
 };
 
diff --git a/fs/xattr.c b/fs/xattr.c
index 7444fb1b3484..828a919eb4b3 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -735,6 +735,8 @@ generic_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size)
 
 	if (!buffer) {
 		for_each_xattr_handler(handlers, handler) {
+			if (!handler->list)
+				continue;
 			size += handler->list(handler, dentry, NULL, 0,
 					      NULL, 0);
 		}
@@ -742,6 +744,8 @@ generic_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size)
 		char *buf = buffer;
 
 		for_each_xattr_handler(handlers, handler) {
+			if (!handler->list)
+				continue;
 			size = handler->list(handler, dentry, buf, buffer_size,
 					     NULL, 0);
 			if (size > buffer_size)
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 716433e63052..d37c1963e8ca 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1513,8 +1513,6 @@ static int smack_inode_getsecurity(const struct inode *inode,
  * @inode: the object
  * @buffer: where they go
  * @buffer_size: size of buffer
- *
- * Returns 0 on success, -EINVAL otherwise
  */
 static int smack_inode_listsecurity(struct inode *inode, char *buffer,
 				    size_t buffer_size)

From 6f9d9f20fda1a2f9c0816d5587477e5510c279bd Mon Sep 17 00:00:00 2001
From: Robert Hancock <hancockrwd@gmail.com>
Date: Tue, 21 Jul 2020 20:18:03 -0600
Subject: [PATCH 0274/2658] PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085
 PCIe-to-PCI bridge

commit b361663c5a40c8bc758b7f7f2239f7a192180e7c upstream.

Recently ASPM handling was changed to allow ASPM on PCIe-to-PCI/PCI-X
bridges.  Unfortunately the ASMedia ASM1083/1085 PCIe to PCI bridge device
doesn't seem to function properly with ASPM enabled.  On an Asus PRIME
H270-PRO motherboard, it causes errors like these:

  pcieport 0000:00:1c.0: AER: PCIe Bus Error: severity=Corrected, type=Data Link Layer, (Transmitter ID)
  pcieport 0000:00:1c.0: AER:   device [8086:a292] error status/mask=00003000/00002000
  pcieport 0000:00:1c.0: AER:    [12] Timeout
  pcieport 0000:00:1c.0: AER: Corrected error received: 0000:00:1c.0
  pcieport 0000:00:1c.0: AER: can't find device of ID00e0

In addition to flooding the kernel log, this also causes the machine to
wake up immediately after suspend is initiated.

The device advertises ASPM L0s and L1 support in the Link Capabilities
register, but the ASMedia web page for ASM1083 [1] claims "No PCIe ASPM
support".

Windows 10 (build 2004) enables L0s, but it also logs correctable PCIe
errors.

Add a quirk to disable ASPM for this device.

[1] https://www.asmedia.com.tw/eng/e_show_products.php?cate_index=169&item=114

[bhelgaas: commit log]
Fixes: 66ff14e59e8a ("PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges")
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=208667
Link: https://lore.kernel.org/r/20200722021803.17958-1-hancockrwd@gmail.com
Signed-off-by: Robert Hancock <hancockrwd@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/quirks.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index ab161bbeb4d4..bdaeccafa261 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2273,6 +2273,19 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x5a3f, quirk_disable_msi);
 
+static void quirk_disable_aspm_l0s_l1(struct pci_dev *dev)
+{
+	dev_info(&dev->dev, "Disabling ASPM L0s/L1\n");
+	pci_disable_link_state(dev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1);
+}
+
+/*
+ * ASM1083/1085 PCIe-PCI bridge devices cause AER timeout errors on the
+ * upstream PCIe root port when ASPM is enabled. At least L0s mode is affected;
+ * disable both L0s and L1 for now to be safe.
+ */
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ASMEDIA, 0x1080, quirk_disable_aspm_l0s_l1);
+
 /*
  * The APC bridge device in AMD 780 family northbridges has some random
  * OEM subsystem ID in its vendor ID register (erratum 18), so instead

From 3ad4037e22956b4a175c22e9d8fd1705a4966980 Mon Sep 17 00:00:00 2001
From: Peilin Ye <yepeilin.cs@gmail.com>
Date: Tue, 28 Jul 2020 15:29:24 -0400
Subject: [PATCH 0275/2658] drm/amdgpu: Prevent kernel-infoleak in
 amdgpu_info_ioctl()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 543e8669ed9bfb30545fd52bc0e047ca4df7fb31 upstream.

Compiler leaves a 4-byte hole near the end of `dev_info`, causing
amdgpu_info_ioctl() to copy uninitialized kernel stack memory to userspace
when `size` is greater than 356.

In 2015 we tried to fix this issue by doing `= {};` on `dev_info`, which
unfortunately does not initialize that 4-byte hole. Fix it by using
memset() instead.

Cc: stable@vger.kernel.org
Fixes: c193fa91b918 ("drm/amdgpu: information leak in amdgpu_info_ioctl()")
Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index e35e603710b4..5bf98f0195fb 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -428,9 +428,10 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
 		return n ? -EFAULT : 0;
 	}
 	case AMDGPU_INFO_DEV_INFO: {
-		struct drm_amdgpu_info_device dev_info = {};
+		struct drm_amdgpu_info_device dev_info;
 		struct amdgpu_cu_info cu_info;
 
+		memset(&dev_info, 0, sizeof(dev_info));
 		dev_info.device_id = dev->pdev->device;
 		dev_info.chip_rev = adev->rev_id;
 		dev_info.external_rev = adev->external_rev_id;

From 04118f163054f9b81b73bbdf050cf6c38bcf493f Mon Sep 17 00:00:00 2001
From: Steve Cohen <cohens@codeaurora.org>
Date: Mon, 20 Jul 2020 18:30:50 -0400
Subject: [PATCH 0276/2658] drm: hold gem reference until object is no longer
 accessed

commit 8490d6a7e0a0a6fab5c2d82d57a3937306660864 upstream.

A use-after-free in drm_gem_open_ioctl can happen if the
GEM object handle is closed between the idr lookup and
retrieving the size from said object since a local reference
is not being held at that point. Hold the local reference
while the object can still be accessed to fix this and
plug the potential security hole.

Signed-off-by: Steve Cohen <cohens@codeaurora.org>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/1595284250-31580-1-git-send-email-cohens@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/drm_gem.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 9147113139be..67d5ead98a36 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -652,9 +652,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
  * @file_priv: drm file-private structure
  *
  * Open an object using the global name, returning a handle and the size.
- *
- * This handle (of course) holds a reference to the object, so the object
- * will not go away until the handle is deleted.
  */
 int
 drm_gem_open_ioctl(struct drm_device *dev, void *data,
@@ -679,14 +676,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
 
 	/* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
 	ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
-	drm_gem_object_unreference_unlocked(obj);
 	if (ret)
-		return ret;
+		goto err;
 
 	args->handle = handle;
 	args->size = obj->size;
 
-	return 0;
+err:
+	drm_gem_object_unreference_unlocked(obj);
+	return ret;
 }
 
 /**

From cb7802ae616952230d4ea45b0e82bf1130f44ace Mon Sep 17 00:00:00 2001
From: Jaegeuk Kim <jaegeuk@kernel.org>
Date: Wed, 14 Nov 2018 12:40:30 -0800
Subject: [PATCH 0277/2658] f2fs: check memory boundary by insane namelen

[ Upstream commit 4e240d1bab1ead280ddf5eb05058dba6bbd57d10 ]

If namelen is corrupted to have very long value, fill_dentries can copy
wrong memory area.

Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/dir.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index 92a240616f52..5411d6667781 100644
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -805,6 +805,16 @@ bool f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
 		de_name.name = d->filename[bit_pos];
 		de_name.len = le16_to_cpu(de->name_len);
 
+		/* check memory boundary before moving forward */
+		bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len));
+		if (unlikely(bit_pos > d->max)) {
+			f2fs_msg(F2FS_I_SB(d->inode)->sb, KERN_WARNING,
+				"%s: corrupted namelen=%d, run fsck to fix.",
+				__func__, le16_to_cpu(de->name_len));
+			set_sbi_flag(F2FS_I_SB(d->inode)->sb->s_fs_info, SBI_NEED_FSCK);
+			return -EINVAL;
+		}
+
 		if (f2fs_encrypted_inode(d->inode)) {
 			int save_len = fstr->len;
 			int ret;
@@ -829,7 +839,6 @@ bool f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
 					le32_to_cpu(de->ino), d_type))
 			return true;
 
-		bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len));
 		ctx->pos = start_pos + bit_pos;
 	}
 	return false;

From 0d6f8a315c9cec50e5ef774ae731586decd7b93c Mon Sep 17 00:00:00 2001
From: Sheng Yong <shengyong1@huawei.com>
Date: Mon, 7 Jan 2019 15:02:34 +0800
Subject: [PATCH 0278/2658] f2fs: check if file namelen exceeds max value

[ Upstream commit 720db068634c91553a8e1d9a0fcd8c7050e06d2b ]

Dentry bitmap is not enough to detect incorrect dentries. So this patch
also checks the namelen value of a dentry.

Signed-off-by: Gong Chen <gongchen4@huawei.com>
Signed-off-by: Sheng Yong <shengyong1@huawei.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/dir.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index 5411d6667781..e2ff0eb16f89 100644
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -807,7 +807,8 @@ bool f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
 
 		/* check memory boundary before moving forward */
 		bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len));
-		if (unlikely(bit_pos > d->max)) {
+		if (unlikely(bit_pos > d->max ||
+				le16_to_cpu(de->name_len) > F2FS_NAME_LEN)) {
 			f2fs_msg(F2FS_I_SB(d->inode)->sb, KERN_WARNING,
 				"%s: corrupted namelen=%d, run fsck to fix.",
 				__func__, le16_to_cpu(de->name_len));

From 90d4632a1b087bdc66b9a21a8cbbbbc2553ca804 Mon Sep 17 00:00:00 2001
From: Will Deacon <will@kernel.org>
Date: Thu, 18 Jun 2020 11:16:45 +0100
Subject: [PATCH 0279/2658] ARM: 8986/1: hw_breakpoint: Don't invoke overflow
 handler on uaccess watchpoints

[ Upstream commit eec13b42d41b0f3339dcf0c4da43734427c68620 ]

Unprivileged memory accesses generated by the so-called "translated"
instructions (e.g. LDRT) in kernel mode can cause user watchpoints to fire
unexpectedly. In such cases, the hw_breakpoint logic will invoke the user
overflow handler which will typically raise a SIGTRAP back to the current
task. This is futile when returning back to the kernel because (a) the
signal won't have been delivered and (b) userspace can't handle the thing
anyway.

Avoid invoking the user overflow handler for watchpoints triggered by
kernel uaccess routines, and instead single-step over the faulting
instruction as we would if no overflow handler had been installed.

Cc: <stable@vger.kernel.org>
Fixes: f81ef4a920c8 ("ARM: 6356/1: hw-breakpoint: add ARM backend for the hw-breakpoint framework")
Reported-by: Luis Machado <luis.machado@linaro.org>
Tested-by: Luis Machado <luis.machado@linaro.org>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/kernel/hw_breakpoint.c | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
index abcbea1ae30b..78c6be1b2714 100644
--- a/arch/arm/kernel/hw_breakpoint.c
+++ b/arch/arm/kernel/hw_breakpoint.c
@@ -688,6 +688,12 @@ static void disable_single_step(struct perf_event *bp)
 	arch_install_hw_breakpoint(bp);
 }
 
+static int watchpoint_fault_on_uaccess(struct pt_regs *regs,
+				       struct arch_hw_breakpoint *info)
+{
+	return !user_mode(regs) && info->ctrl.privilege == ARM_BREAKPOINT_USER;
+}
+
 static void watchpoint_handler(unsigned long addr, unsigned int fsr,
 			       struct pt_regs *regs)
 {
@@ -747,16 +753,27 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr,
 		}
 
 		pr_debug("watchpoint fired: address = 0x%x\n", info->trigger);
+
+		/*
+		 * If we triggered a user watchpoint from a uaccess routine,
+		 * then handle the stepping ourselves since userspace really
+		 * can't help us with this.
+		 */
+		if (watchpoint_fault_on_uaccess(regs, info))
+			goto step;
+
 		perf_bp_event(wp, regs);
 
 		/*
-		 * If no overflow handler is present, insert a temporary
-		 * mismatch breakpoint so we can single-step over the
-		 * watchpoint trigger.
+		 * Defer stepping to the overflow handler if one is installed.
+		 * Otherwise, insert a temporary mismatch breakpoint so that
+		 * we can single-step over the watchpoint trigger.
 		 */
-		if (!wp->overflow_handler)
-			enable_single_step(wp, instruction_pointer(regs));
+		if (wp->overflow_handler)
+			goto unlock;
 
+step:
+		enable_single_step(wp, instruction_pointer(regs));
 unlock:
 		rcu_read_unlock();
 	}

From a65f3052d5ae2ec5d87a10067edf790ce62e4290 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date: Wed, 15 Jul 2020 10:51:02 +0900
Subject: [PATCH 0280/2658] fbdev: Detect integer underflow at "struct
 fbcon_ops"->clear_margins.

[ Upstream commit 033724d6864245a11f8e04c066002e6ad22b3fd0 ]

syzbot is reporting general protection fault in bitfill_aligned() [1]
caused by integer underflow in bit_clear_margins(). The cause of this
problem is when and how do_vc_resize() updates vc->vc_{cols,rows}.

If vc_do_resize() fails (e.g. kzalloc() fails) when var.xres or var.yres
is going to shrink, vc->vc_{cols,rows} will not be updated. This allows
bit_clear_margins() to see info->var.xres < (vc->vc_cols * cw) or
info->var.yres < (vc->vc_rows * ch). Unexpectedly large rw or bh will
try to overrun the __iomem region and causes general protection fault.

Also, vc_resize(vc, 0, 0) does not set vc->vc_{cols,rows} = 0 due to

  new_cols = (cols ? cols : vc->vc_cols);
  new_rows = (lines ? lines : vc->vc_rows);

exception. Since cols and lines are calculated as

  cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
  rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
  cols /= vc->vc_font.width;
  rows /= vc->vc_font.height;
  vc_resize(vc, cols, rows);

in fbcon_modechanged(), var.xres < vc->vc_font.width makes cols = 0
and var.yres < vc->vc_font.height makes rows = 0. This means that

  const int fd = open("/dev/fb0", O_ACCMODE);
  struct fb_var_screeninfo var = { };
  ioctl(fd, FBIOGET_VSCREENINFO, &var);
  var.xres = var.yres = 1;
  ioctl(fd, FBIOPUT_VSCREENINFO, &var);

easily reproduces integer underflow bug explained above.

Of course, callers of vc_resize() are not handling vc_do_resize() failure
is bad. But we can't avoid vc_resize(vc, 0, 0) which returns 0. Therefore,
as a band-aid workaround, this patch checks integer underflow in
"struct fbcon_ops"->clear_margins call, assuming that
vc->vc_cols * vc->vc_font.width and vc->vc_rows * vc->vc_font.heigh do not
cause integer overflow.

[1] https://syzkaller.appspot.com/bug?id=a565882df74fa76f10d3a6fec4be31098dbb37c6

Reported-and-tested-by: syzbot <syzbot+e5fd3e65515b48c02a30@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200715015102.3814-1-penguin-kernel@I-love.SAKURA.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/console/bitblit.c   | 4 ++--
 drivers/video/console/fbcon_ccw.c | 4 ++--
 drivers/video/console/fbcon_cw.c  | 4 ++--
 drivers/video/console/fbcon_ud.c  | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/video/console/bitblit.c b/drivers/video/console/bitblit.c
index dbfe4eecf12e..05d1d36a5665 100644
--- a/drivers/video/console/bitblit.c
+++ b/drivers/video/console/bitblit.c
@@ -216,7 +216,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info,
 	region.color = 0;
 	region.rop = ROP_COPY;
 
-	if (rw && !bottom_only) {
+	if ((int) rw > 0 && !bottom_only) {
 		region.dx = info->var.xoffset + rs;
 		region.dy = 0;
 		region.width = rw;
@@ -224,7 +224,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info,
 		info->fbops->fb_fillrect(info, &region);
 	}
 
-	if (bh) {
+	if ((int) bh > 0) {
 		region.dx = info->var.xoffset;
 		region.dy = info->var.yoffset + bs;
 		region.width = rs;
diff --git a/drivers/video/console/fbcon_ccw.c b/drivers/video/console/fbcon_ccw.c
index 5a3cbf6dff4d..34da8bba9273 100644
--- a/drivers/video/console/fbcon_ccw.c
+++ b/drivers/video/console/fbcon_ccw.c
@@ -201,7 +201,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info,
 	region.color = 0;
 	region.rop = ROP_COPY;
 
-	if (rw && !bottom_only) {
+	if ((int) rw > 0 && !bottom_only) {
 		region.dx = 0;
 		region.dy = info->var.yoffset;
 		region.height = rw;
@@ -209,7 +209,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info,
 		info->fbops->fb_fillrect(info, &region);
 	}
 
-	if (bh) {
+	if ((int) bh > 0) {
 		region.dx = info->var.xoffset + bs;
 		region.dy = 0;
                 region.height = info->var.yres_virtual;
diff --git a/drivers/video/console/fbcon_cw.c b/drivers/video/console/fbcon_cw.c
index e7ee44db4e98..0b552b3fc22a 100644
--- a/drivers/video/console/fbcon_cw.c
+++ b/drivers/video/console/fbcon_cw.c
@@ -184,7 +184,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info,
 	region.color = 0;
 	region.rop = ROP_COPY;
 
-	if (rw && !bottom_only) {
+	if ((int) rw > 0 && !bottom_only) {
 		region.dx = 0;
 		region.dy = info->var.yoffset + rs;
 		region.height = rw;
@@ -192,7 +192,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info,
 		info->fbops->fb_fillrect(info, &region);
 	}
 
-	if (bh) {
+	if ((int) bh > 0) {
 		region.dx = info->var.xoffset;
 		region.dy = info->var.yoffset;
                 region.height = info->var.yres;
diff --git a/drivers/video/console/fbcon_ud.c b/drivers/video/console/fbcon_ud.c
index 19e3714abfe8..7f62efe2da52 100644
--- a/drivers/video/console/fbcon_ud.c
+++ b/drivers/video/console/fbcon_ud.c
@@ -231,7 +231,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info,
 	region.color = 0;
 	region.rop = ROP_COPY;
 
-	if (rw && !bottom_only) {
+	if ((int) rw > 0 && !bottom_only) {
 		region.dy = 0;
 		region.dx = info->var.xoffset;
 		region.width  = rw;
@@ -239,7 +239,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info,
 		info->fbops->fb_fillrect(info, &region);
 	}
 
-	if (bh) {
+	if ((int) bh > 0) {
 		region.dy = info->var.yoffset;
 		region.dx = info->var.xoffset;
                 region.height  = bh;

From c021eae10b97d6c825b66969718f131434a7e8ec Mon Sep 17 00:00:00 2001
From: Peilin Ye <yepeilin.cs@gmail.com>
Date: Thu, 30 Jul 2020 15:20:26 -0400
Subject: [PATCH 0281/2658] rds: Prevent kernel-infoleak in
 rds_notify_queue_get()

commit bbc8a99e952226c585ac17477a85ef1194501762 upstream.

rds_notify_queue_get() is potentially copying uninitialized kernel stack
memory to userspace since the compiler may leave a 4-byte hole at the end
of `cmsg`.

In 2016 we tried to fix this issue by doing `= { 0 };` on `cmsg`, which
unfortunately does not always initialize that 4-byte hole. Fix it by using
memset() instead.

Cc: stable@vger.kernel.org
Fixes: f037590fff30 ("rds: fix a leak of kernel memory")
Fixes: bdbe6fbc6a2f ("RDS: recv.c")
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/rds/recv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/rds/recv.c b/net/rds/recv.c
index 6275de19689c..9bf812509e0e 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -301,12 +301,13 @@ static int rds_still_queued(struct rds_sock *rs, struct rds_incoming *inc,
 int rds_notify_queue_get(struct rds_sock *rs, struct msghdr *msghdr)
 {
 	struct rds_notifier *notifier;
-	struct rds_rdma_notify cmsg = { 0 }; /* fill holes with zero */
+	struct rds_rdma_notify cmsg;
 	unsigned int count = 0, max_messages = ~0U;
 	unsigned long flags;
 	LIST_HEAD(copy);
 	int err = 0;
 
+	memset(&cmsg, 0, sizeof(cmsg));	/* fill holes with zero */
 
 	/* put_cmsg copies to user space and thus may sleep. We can't do this
 	 * with rs_lock held, so first grab as many notifications as we can stuff

From f9007852501e59a80a52292eb43bf2a3a064588a Mon Sep 17 00:00:00 2001
From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Date: Sat, 25 Apr 2020 21:06:25 +0800
Subject: [PATCH 0282/2658] net/x25: Fix x25_neigh refcnt leak when x25
 disconnect

commit 4becb7ee5b3d2829ed7b9261a245a77d5b7de902 upstream.

x25_connect() invokes x25_get_neigh(), which returns a reference of the
specified x25_neigh object to "x25->neighbour" with increased refcnt.

When x25 connect success and returns, the reference still be hold by
"x25->neighbour", so the refcount should be decreased in
x25_disconnect() to keep refcount balanced.

The reference counting issue happens in x25_disconnect(), which forgets
to decrease the refcnt increased by x25_get_neigh() in x25_connect(),
causing a refcnt leak.

Fix this issue by calling x25_neigh_put() before x25_disconnect()
returns.

Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/x25/x25_subr.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/x25/x25_subr.c b/net/x25/x25_subr.c
index 6b5af65f491f..abeca89a3ae8 100644
--- a/net/x25/x25_subr.c
+++ b/net/x25/x25_subr.c
@@ -368,6 +368,10 @@ void x25_disconnect(struct sock *sk, int reason, unsigned char cause,
 		sk->sk_state_change(sk);
 		sock_set_flag(sk, SOCK_DEAD);
 	}
+	read_lock_bh(&x25_list_lock);
+	x25_neigh_put(x25->neighbour);
+	x25->neighbour = NULL;
+	read_unlock_bh(&x25_list_lock);
 }
 
 /*

From d6e9ec08322a502f1cfe7fa65b4c664a1ee84d9a Mon Sep 17 00:00:00 2001
From: YueHaibing <yuehaibing@huawei.com>
Date: Tue, 28 Apr 2020 16:12:08 +0800
Subject: [PATCH 0283/2658] net/x25: Fix null-ptr-deref in x25_disconnect

commit 8999dc89497ab1c80d0718828e838c7cd5f6bffe upstream.

We should check null before do x25_neigh_put in x25_disconnect,
otherwise may cause null-ptr-deref like this:

 #include <sys/socket.h>
 #include <linux/x25.h>

 int main() {
    int sck_x25;
    sck_x25 = socket(AF_X25, SOCK_SEQPACKET, 0);
    close(sck_x25);
    return 0;
 }

BUG: kernel NULL pointer dereference, address: 00000000000000d8
CPU: 0 PID: 4817 Comm: t2 Not tainted 5.7.0-rc3+ #159
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-
RIP: 0010:x25_disconnect+0x91/0xe0
Call Trace:
 x25_release+0x18a/0x1b0
 __sock_release+0x3d/0xc0
 sock_close+0x13/0x20
 __fput+0x107/0x270
 ____fput+0x9/0x10
 task_work_run+0x6d/0xb0
 exit_to_usermode_loop+0x102/0x110
 do_syscall_64+0x23c/0x260
 entry_SYSCALL_64_after_hwframe+0x49/0xb3

Reported-by: syzbot+6db548b615e5aeefdce2@syzkaller.appspotmail.com
Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/x25/x25_subr.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/x25/x25_subr.c b/net/x25/x25_subr.c
index abeca89a3ae8..a3163645b5bd 100644
--- a/net/x25/x25_subr.c
+++ b/net/x25/x25_subr.c
@@ -368,10 +368,12 @@ void x25_disconnect(struct sock *sk, int reason, unsigned char cause,
 		sk->sk_state_change(sk);
 		sock_set_flag(sk, SOCK_DEAD);
 	}
-	read_lock_bh(&x25_list_lock);
-	x25_neigh_put(x25->neighbour);
-	x25->neighbour = NULL;
-	read_unlock_bh(&x25_list_lock);
+	if (x25->neighbour) {
+		read_lock_bh(&x25_list_lock);
+		x25_neigh_put(x25->neighbour);
+		x25->neighbour = NULL;
+		read_unlock_bh(&x25_list_lock);
+	}
 }
 
 /*

From 958f8422845157846c998cb3f7beb1f30ad16202 Mon Sep 17 00:00:00 2001
From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
Date: Thu, 23 Jul 2020 01:13:19 +0200
Subject: [PATCH 0284/2658] sh: Fix validation of system call number

[ Upstream commit 04a8a3d0a73f51c7c2da84f494db7ec1df230e69 ]

The slow path for traced system call entries accessed a wrong memory
location to get the number of the maximum allowed system call number.
Renumber the numbered "local" label for the correct location to avoid
collisions with actual local labels.

Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Fixes: f3a8308864f920d2 ("sh: Add a few missing irqflags tracing markers.")
Signed-off-by: Rich Felker <dalias@libc.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/sh/kernel/entry-common.S | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S
index 5a9017ba26ab..3b0aa0ae43b4 100644
--- a/arch/sh/kernel/entry-common.S
+++ b/arch/sh/kernel/entry-common.S
@@ -203,7 +203,7 @@ syscall_trace_entry:
 	mov.l	@(OFF_R7,r15), r7   ! arg3
 	mov.l	@(OFF_R3,r15), r3   ! syscall_nr
 	!
-	mov.l	2f, r10			! Number of syscalls
+	mov.l	6f, r10			! Number of syscalls
 	cmp/hs	r10, r3
 	bf	syscall_call
 	mov	#-ENOSYS, r0
@@ -348,7 +348,7 @@ ENTRY(system_call)
 	tst	r9, r8
 	bf	syscall_trace_entry
 	!
-	mov.l	2f, r8			! Number of syscalls
+	mov.l	6f, r8			! Number of syscalls
 	cmp/hs	r8, r3
 	bt	syscall_badsys
 	!
@@ -387,7 +387,7 @@ syscall_exit:
 #if !defined(CONFIG_CPU_SH2)
 1:	.long	TRA
 #endif
-2:	.long	NR_syscalls
+6:	.long	NR_syscalls
 3:	.long	sys_call_table
 7:	.long	do_syscall_trace_enter
 8:	.long	do_syscall_trace_leave

From 5f59124d2d2c372e2002354611b9b16ff6890ede Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Tue, 28 Jul 2020 14:10:29 +0200
Subject: [PATCH 0285/2658] net: lan78xx: add missing endpoint sanity check

[ Upstream commit 8d8e95fd6d69d774013f51e5f2ee10c6e6d1fc14 ]

Add the missing endpoint sanity check to prevent a NULL-pointer
dereference should a malicious device lack the expected endpoints.

Note that the driver has a broken endpoint-lookup helper,
lan78xx_get_endpoints(), which can end up accepting interfaces in an
altsetting without endpoints as long as *some* altsetting has a bulk-in
and a bulk-out endpoint.

Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
Cc: Woojung.Huh@microchip.com <Woojung.Huh@microchip.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/lan78xx.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 75a3865a80d2..3f2f524c338d 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -2978,6 +2978,11 @@ static int lan78xx_probe(struct usb_interface *intf,
 		netdev->mtu = dev->hard_mtu - netdev->hard_header_len;
 	netif_set_gso_max_size(netdev, MAX_SINGLE_PACKET_SIZE - MAX_HEADER);
 
+	if (intf->cur_altsetting->desc.bNumEndpoints < 3) {
+		ret = -ENODEV;
+		goto out3;
+	}
+
 	dev->ep_blkin = (intf->cur_altsetting)->endpoint + 0;
 	dev->ep_blkout = (intf->cur_altsetting)->endpoint + 1;
 	dev->ep_intr = (intf->cur_altsetting)->endpoint + 2;

From 736342adcea838c73dc2da82286b37757ee58673 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Tue, 28 Jul 2020 14:10:30 +0200
Subject: [PATCH 0286/2658] net: lan78xx: fix transfer-buffer memory leak

[ Upstream commit 63634aa679ba8b5e306ad0727120309ae6ba8a8e ]

The interrupt URB transfer-buffer was never freed on disconnect or after
probe errors.

Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
Cc: Woojung.Huh@microchip.com <Woojung.Huh@microchip.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/lan78xx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 3f2f524c338d..1fb5d5f3475c 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -3006,6 +3006,7 @@ static int lan78xx_probe(struct usb_interface *intf,
 			usb_fill_int_urb(dev->urb_intr, dev->udev,
 					 dev->pipe_intr, buf, maxp,
 					 intr_complete, dev, period);
+			dev->urb_intr->transfer_flags |= URB_FREE_BUFFER;
 		}
 	}
 

From eac797aac85d3ee6bd166194d62697e024550657 Mon Sep 17 00:00:00 2001
From: Ido Schimmel <idosch@mellanox.com>
Date: Wed, 29 Jul 2020 12:26:45 +0300
Subject: [PATCH 0287/2658] mlxsw: core: Increase scope of RCU read-side
 critical section

[ Upstream commit 7d8e8f3433dc8d1dc87c1aabe73a154978fb4c4d ]

The lifetime of the Rx listener item ('rxl_item') is managed using RCU,
but is dereferenced outside of RCU read-side critical section, which can
lead to a use-after-free.

Fix this by increasing the scope of the RCU read-side critical section.

Fixes: 93c1edb27f9e ("mlxsw: Introduce Mellanox switch driver core")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlxsw/core.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
index 97f0d93caf99..085aaad90293 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -1208,9 +1208,10 @@ void mlxsw_core_skb_receive(struct mlxsw_core *mlxsw_core, struct sk_buff *skb,
 			break;
 		}
 	}
-	rcu_read_unlock();
-	if (!found)
+	if (!found) {
+		rcu_read_unlock();
 		goto drop;
+	}
 
 	pcpu_stats = this_cpu_ptr(mlxsw_core->pcpu_stats);
 	u64_stats_update_begin(&pcpu_stats->syncp);
@@ -1221,6 +1222,7 @@ void mlxsw_core_skb_receive(struct mlxsw_core *mlxsw_core, struct sk_buff *skb,
 	u64_stats_update_end(&pcpu_stats->syncp);
 
 	rxl->func(skb, local_port, rxl_item->priv);
+	rcu_read_unlock();
 	return;
 
 drop:

From 8751addb6f83113d678efd03b7cead845f3f50c2 Mon Sep 17 00:00:00 2001
From: Remi Pommarel <repk@triplefau.lt>
Date: Sat, 4 Jul 2020 15:50:07 +0200
Subject: [PATCH 0288/2658] mac80211: mesh: Free ie data when leaving mesh

[ Upstream commit 6a01afcf8468d3ca2bd8bbb27503f60dcf643b20 ]

At ieee80211_join_mesh() some ie data could have been allocated (see
copy_mesh_setup()) and need to be cleaned up when leaving the mesh.

This fixes the following kmemleak report:

unreferenced object 0xffff0000116bc600 (size 128):
  comm "wpa_supplicant", pid 608, jiffies 4294898983 (age 293.484s)
  hex dump (first 32 bytes):
    30 14 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00  0...............
    00 0f ac 08 00 00 00 00 c4 65 40 00 00 00 00 00  .........e@.....
  backtrace:
    [<00000000bebe439d>] __kmalloc_track_caller+0x1c0/0x330
    [<00000000a349dbe1>] kmemdup+0x28/0x50
    [<0000000075d69baa>] ieee80211_join_mesh+0x6c/0x3b8 [mac80211]
    [<00000000683bb98b>] __cfg80211_join_mesh+0x1e8/0x4f0 [cfg80211]
    [<0000000072cb507f>] nl80211_join_mesh+0x520/0x6b8 [cfg80211]
    [<0000000077e9bcf9>] genl_family_rcv_msg+0x374/0x680
    [<00000000b1bd936d>] genl_rcv_msg+0x78/0x108
    [<0000000022c53788>] netlink_rcv_skb+0xb0/0x1c0
    [<0000000011af8ec9>] genl_rcv+0x34/0x48
    [<0000000069e41f53>] netlink_unicast+0x268/0x2e8
    [<00000000a7517316>] netlink_sendmsg+0x320/0x4c0
    [<0000000069cba205>] ____sys_sendmsg+0x354/0x3a0
    [<00000000e06bab0f>] ___sys_sendmsg+0xd8/0x120
    [<0000000037340728>] __sys_sendmsg+0xa4/0xf8
    [<000000004fed9776>] __arm64_sys_sendmsg+0x44/0x58
    [<000000001c1e5647>] el0_svc_handler+0xd0/0x1a0

Fixes: c80d545da3f7 (mac80211: Let userspace enable and configure vendor specific path selection.)
Signed-off-by: Remi Pommarel <repk@triplefau.lt>
Link: https://lore.kernel.org/r/20200704135007.27292-1-repk@triplefau.lt
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/cfg.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index cf3917c6da0a..8360fda24bca 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1766,6 +1766,7 @@ static int ieee80211_leave_mesh(struct wiphy *wiphy, struct net_device *dev)
 	ieee80211_stop_mesh(sdata);
 	mutex_lock(&sdata->local->mtx);
 	ieee80211_vif_release_channel(sdata);
+	kfree(sdata->u.mesh.ie);
 	mutex_unlock(&sdata->local->mtx);
 
 	return 0;

From 5f2523d98906ef4fa650c8b16b6ba0a4784b98a3 Mon Sep 17 00:00:00 2001
From: Navid Emamdoost <navid.emamdoost@gmail.com>
Date: Sat, 18 Jul 2020 00:31:49 -0500
Subject: [PATCH 0289/2658] nfc: s3fwrn5: add missing release on skb in
 s3fwrn5_recv_frame

[ Upstream commit 1e8fd3a97f2d83a7197876ceb4f37b4c2b00a0f3 ]

The implementation of s3fwrn5_recv_frame() is supposed to consume skb on
all execution paths. Release skb before returning -ENODEV.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nfc/s3fwrn5/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/nfc/s3fwrn5/core.c b/drivers/nfc/s3fwrn5/core.c
index 0d866ca295e3..cafab107ba9b 100644
--- a/drivers/nfc/s3fwrn5/core.c
+++ b/drivers/nfc/s3fwrn5/core.c
@@ -209,6 +209,7 @@ int s3fwrn5_recv_frame(struct nci_dev *ndev, struct sk_buff *skb,
 	case S3FWRN5_MODE_FW:
 		return s3fwrn5_fw_recv_frame(ndev, skb);
 	default:
+		kfree_skb(skb);
 		return -ENODEV;
 	}
 }

From fea92988476c20dd701f68396dbc27e3e8f1889a Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Date: Tue, 21 Jul 2020 15:23:12 +0900
Subject: [PATCH 0290/2658] net: ethernet: ravb: exit if re-initialization
 fails in tx timeout

[ Upstream commit 015c5d5e6aa3523c758a70eb87b291cece2dbbb4 ]

According to the report of [1], this driver is possible to cause
the following error in ravb_tx_timeout_work().

ravb e6800000.ethernet ethernet: failed to switch device to config mode

This error means that the hardware could not change the state
from "Operation" to "Configuration" while some tx and/or rx queue
are operating. After that, ravb_config() in ravb_dmac_init() will fail,
and then any descriptors will be not allocaled anymore so that NULL
pointer dereference happens after that on ravb_start_xmit().

To fix the issue, the ravb_tx_timeout_work() should check
the return values of ravb_stop_dma() and ravb_dmac_init().
If ravb_stop_dma() fails, ravb_tx_timeout_work() re-enables TX and RX
and just exits. If ravb_dmac_init() fails, just exits.

[1]
https://lore.kernel.org/linux-renesas-soc/20200518045452.2390-1-dirk.behme@de.bosch.com/

Reported-by: Dirk Behme <dirk.behme@de.bosch.com>
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/renesas/ravb_main.c | 26 ++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 5b6320f9c935..460b29ac5fd8 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1291,6 +1291,7 @@ static void ravb_tx_timeout_work(struct work_struct *work)
 	struct ravb_private *priv = container_of(work, struct ravb_private,
 						 work);
 	struct net_device *ndev = priv->ndev;
+	int error;
 
 	netif_tx_stop_all_queues(ndev);
 
@@ -1298,15 +1299,36 @@ static void ravb_tx_timeout_work(struct work_struct *work)
 	ravb_ptp_stop(ndev);
 
 	/* Wait for DMA stopping */
-	ravb_stop_dma(ndev);
+	if (ravb_stop_dma(ndev)) {
+		/* If ravb_stop_dma() fails, the hardware is still operating
+		 * for TX and/or RX. So, this should not call the following
+		 * functions because ravb_dmac_init() is possible to fail too.
+		 * Also, this should not retry ravb_stop_dma() again and again
+		 * here because it's possible to wait forever. So, this just
+		 * re-enables the TX and RX and skip the following
+		 * re-initialization procedure.
+		 */
+		ravb_rcv_snd_enable(ndev);
+		goto out;
+	}
 
 	ravb_ring_free(ndev, RAVB_BE);
 	ravb_ring_free(ndev, RAVB_NC);
 
 	/* Device init */
-	ravb_dmac_init(ndev);
+	error = ravb_dmac_init(ndev);
+	if (error) {
+		/* If ravb_dmac_init() fails, descriptors are freed. So, this
+		 * should return here to avoid re-enabling the TX and RX in
+		 * ravb_emac_init().
+		 */
+		netdev_err(ndev, "%s: ravb_dmac_init() failed, error %d\n",
+			   __func__, error);
+		return;
+	}
 	ravb_emac_init(ndev);
 
+out:
 	/* Initialise PTP Clock driver */
 	ravb_ptp_init(ndev, priv->pdev);
 

From af7efd29853bc930f1cdf0cf13a43f460cc790f0 Mon Sep 17 00:00:00 2001
From: Raviteja Narayanam <raviteja.narayanam@xilinx.com>
Date: Fri, 3 Jul 2020 19:25:49 +0530
Subject: [PATCH 0291/2658] Revert "i2c: cadence: Fix the hold bit setting"

[ Upstream commit 0db9254d6b896b587759e2c844c277fb1a6da5b9 ]

This reverts commit d358def706880defa4c9e87381c5bf086a97d5f9.

There are two issues with "i2c: cadence: Fix the hold bit setting" commit.

1. In case of combined message request from user space, when the HOLD
bit is cleared in cdns_i2c_mrecv function, a STOP condition is sent
on the bus even before the last message is started. This is because when
the HOLD bit is cleared, the FIFOS are empty and there is no pending
transfer. The STOP condition should occur only after the last message
is completed.

2. The code added by the commit is redundant. Driver is handling the
setting/clearing of HOLD bit in right way before the commit.

The setting of HOLD bit based on 'bus_hold_flag' is taken care in
cdns_i2c_master_xfer function even before cdns_i2c_msend/cdns_i2c_recv
functions.

The clearing of HOLD bit is taken care at the end of cdns_i2c_msend and
cdns_i2c_recv functions based on bus_hold_flag and byte count.
Since clearing of HOLD bit is done after the slave address is written to
the register (writing to address register triggers the message transfer),
it is ensured that STOP condition occurs at the right time after
completion of the pending transfer (last message).

Signed-off-by: Raviteja Narayanam <raviteja.narayanam@xilinx.com>
Acked-by: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-cadence.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
index 6d32e6da3110..84deed6571bd 100644
--- a/drivers/i2c/busses/i2c-cadence.c
+++ b/drivers/i2c/busses/i2c-cadence.c
@@ -378,10 +378,8 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id)
 	 * Check for the message size against FIFO depth and set the
 	 * 'hold bus' bit if it is greater than FIFO depth.
 	 */
-	if ((id->recv_count > CDNS_I2C_FIFO_DEPTH)  || id->bus_hold_flag)
+	if (id->recv_count > CDNS_I2C_FIFO_DEPTH)
 		ctrl_reg |= CDNS_I2C_CR_HOLD;
-	else
-		ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD;
 
 	cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET);
 
@@ -438,11 +436,8 @@ static void cdns_i2c_msend(struct cdns_i2c *id)
 	 * Check for the message size against FIFO depth and set the
 	 * 'hold bus' bit if it is greater than FIFO depth.
 	 */
-	if ((id->send_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag)
+	if (id->send_count > CDNS_I2C_FIFO_DEPTH)
 		ctrl_reg |= CDNS_I2C_CR_HOLD;
-	else
-		ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD;
-
 	cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET);
 
 	/* Clear the interrupts in interrupt status register. */

From e5681e5c044d5f531137740cb2bef5b2f6d5d86f Mon Sep 17 00:00:00 2001
From: Andrea Righi <andrea.righi@canonical.com>
Date: Fri, 24 Jul 2020 10:59:10 +0200
Subject: [PATCH 0292/2658] xen-netfront: fix potential deadlock in
 xennet_remove()

[ Upstream commit c2c633106453611be07821f53dff9e93a9d1c3f0 ]

There's a potential race in xennet_remove(); this is what the driver is
doing upon unregistering a network device:

  1. state = read bus state
  2. if state is not "Closed":
  3.    request to set state to "Closing"
  4.    wait for state to be set to "Closing"
  5.    request to set state to "Closed"
  6.    wait for state to be set to "Closed"

If the state changes to "Closed" immediately after step 1 we are stuck
forever in step 4, because the state will never go back from "Closed" to
"Closing".

Make sure to check also for state == "Closed" in step 4 to prevent the
deadlock.

Also add a 5 sec timeout any time we wait for the bus state to change,
to avoid getting stuck forever in wait_event().

Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/xen-netfront.c | 64 +++++++++++++++++++++++++-------------
 1 file changed, 42 insertions(+), 22 deletions(-)

diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 02b6a6c10840..7d4c0c46a889 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -62,6 +62,8 @@ module_param_named(max_queues, xennet_max_queues, uint, 0644);
 MODULE_PARM_DESC(max_queues,
 		 "Maximum number of queues per virtual interface");
 
+#define XENNET_TIMEOUT  (5 * HZ)
+
 static const struct ethtool_ops xennet_ethtool_ops;
 
 struct netfront_cb {
@@ -1349,12 +1351,15 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
 
 	netif_carrier_off(netdev);
 
-	xenbus_switch_state(dev, XenbusStateInitialising);
-	wait_event(module_wq,
-		   xenbus_read_driver_state(dev->otherend) !=
-		   XenbusStateClosed &&
-		   xenbus_read_driver_state(dev->otherend) !=
-		   XenbusStateUnknown);
+	do {
+		xenbus_switch_state(dev, XenbusStateInitialising);
+		err = wait_event_timeout(module_wq,
+				 xenbus_read_driver_state(dev->otherend) !=
+				 XenbusStateClosed &&
+				 xenbus_read_driver_state(dev->otherend) !=
+				 XenbusStateUnknown, XENNET_TIMEOUT);
+	} while (!err);
+
 	return netdev;
 
  exit:
@@ -2166,28 +2171,43 @@ static const struct attribute_group xennet_dev_group = {
 };
 #endif /* CONFIG_SYSFS */
 
-static int xennet_remove(struct xenbus_device *dev)
+static void xennet_bus_close(struct xenbus_device *dev)
 {
-	struct netfront_info *info = dev_get_drvdata(&dev->dev);
-
-	dev_dbg(&dev->dev, "%s\n", dev->nodename);
+	int ret;
 
-	if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) {
+	if (xenbus_read_driver_state(dev->otherend) == XenbusStateClosed)
+		return;
+	do {
 		xenbus_switch_state(dev, XenbusStateClosing);
-		wait_event(module_wq,
-			   xenbus_read_driver_state(dev->otherend) ==
-			   XenbusStateClosing ||
-			   xenbus_read_driver_state(dev->otherend) ==
-			   XenbusStateUnknown);
+		ret = wait_event_timeout(module_wq,
+				   xenbus_read_driver_state(dev->otherend) ==
+				   XenbusStateClosing ||
+				   xenbus_read_driver_state(dev->otherend) ==
+				   XenbusStateClosed ||
+				   xenbus_read_driver_state(dev->otherend) ==
+				   XenbusStateUnknown,
+				   XENNET_TIMEOUT);
+	} while (!ret);
+
+	if (xenbus_read_driver_state(dev->otherend) == XenbusStateClosed)
+		return;
 
+	do {
 		xenbus_switch_state(dev, XenbusStateClosed);
-		wait_event(module_wq,
-			   xenbus_read_driver_state(dev->otherend) ==
-			   XenbusStateClosed ||
-			   xenbus_read_driver_state(dev->otherend) ==
-			   XenbusStateUnknown);
-	}
+		ret = wait_event_timeout(module_wq,
+				   xenbus_read_driver_state(dev->otherend) ==
+				   XenbusStateClosed ||
+				   xenbus_read_driver_state(dev->otherend) ==
+				   XenbusStateUnknown,
+				   XENNET_TIMEOUT);
+	} while (!ret);
+}
+
+static int xennet_remove(struct xenbus_device *dev)
+{
+	struct netfront_info *info = dev_get_drvdata(&dev->dev);
 
+	xennet_bus_close(dev);
 	xennet_disconnect_backend(info);
 
 	if (info->netdev->reg_state == NETREG_REGISTERED)

From d87a4d9a162e389ec44e571fd787a71a9239ea2f Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Wed, 29 Jul 2020 10:53:28 +0200
Subject: [PATCH 0293/2658] x86/i8259: Use printk_deferred() to prevent
 deadlock

commit bdd65589593edd79b6a12ce86b3b7a7c6dae5208 upstream.

0day reported a possible circular locking dependency:

Chain exists of:
  &irq_desc_lock_class --> console_owner --> &port_lock_key

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&port_lock_key);
                               lock(console_owner);
                               lock(&port_lock_key);
  lock(&irq_desc_lock_class);

The reason for this is a printk() in the i8259 interrupt chip driver
which is invoked with the irq descriptor lock held, which reverses the
lock operations vs. printk() from arbitrary contexts.

Switch the printk() to printk_deferred() to avoid that.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/87365abt2v.fsf@nanos.tec.linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/i8259.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c
index 4e3b8a587c88..01a1ab8483ac 100644
--- a/arch/x86/kernel/i8259.c
+++ b/arch/x86/kernel/i8259.c
@@ -204,7 +204,7 @@ static void mask_and_ack_8259A(struct irq_data *data)
 		 * lets ACK and report it. [once per IRQ]
 		 */
 		if (!(spurious_irq_mask & irqmask)) {
-			printk(KERN_DEBUG
+			printk_deferred(KERN_DEBUG
 			       "spurious 8259A interrupt: IRQ%d.\n", irq);
 			spurious_irq_mask |= irqmask;
 		}

From 0300a20ded111c2dcf1e070ae453b741acc3c9e5 Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Fri, 10 Jul 2020 15:23:19 +0200
Subject: [PATCH 0294/2658] random32: update the net random state on interrupt
 and activity

commit f227e3ec3b5cad859ad15666874405e8c1bbc1d4 upstream.

This modifies the first 32 bits out of the 128 bits of a random CPU's
net_rand_state on interrupt or CPU activity to complicate remote
observations that could lead to guessing the network RNG's internal
state.

Note that depending on some network devices' interrupt rate moderation
or binding, this re-seeding might happen on every packet or even almost
never.

In addition, with NOHZ some CPUs might not even get timer interrupts,
leaving their local state rarely updated, while they are running
networked processes making use of the random state.  For this reason, we
also perform this update in update_process_times() in order to at least
update the state when there is user or system activity, since it's the
only case we care about.

Reported-by: Amit Klein <aksecurity@gmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Eric Dumazet <edumazet@google.com>
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/char/random.c  | 1 +
 include/linux/random.h | 3 +++
 kernel/time/timer.c    | 8 ++++++++
 lib/random32.c         | 2 +-
 4 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/char/random.c b/drivers/char/random.c
index 661ed5ec546e..7bb1e423eb19 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -923,6 +923,7 @@ void add_interrupt_randomness(int irq, int irq_flags)
 
 	fast_mix(fast_pool);
 	add_interrupt_bench(cycles);
+	this_cpu_add(net_rand_state.s1, fast_pool->pool[cycles & 3]);
 
 	if ((fast_pool->count < 64) &&
 	    !time_after(now, fast_pool->last + HZ))
diff --git a/include/linux/random.h b/include/linux/random.h
index 9c29122037f9..fb9e3798f771 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -8,6 +8,7 @@
 
 #include <linux/list.h>
 #include <linux/once.h>
+#include <linux/percpu.h>
 
 #include <uapi/linux/random.h>
 
@@ -46,6 +47,8 @@ struct rnd_state {
 	__u32 s1, s2, s3, s4;
 };
 
+DECLARE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy;
+
 u32 prandom_u32_state(struct rnd_state *state);
 void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes);
 void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state);
diff --git a/kernel/time/timer.c b/kernel/time/timer.c
index 903705687b52..539070e3ae3a 100644
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -42,6 +42,7 @@
 #include <linux/sched/sysctl.h>
 #include <linux/slab.h>
 #include <linux/compat.h>
+#include <linux/random.h>
 
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -1469,6 +1470,13 @@ void update_process_times(int user_tick)
 #endif
 	scheduler_tick();
 	run_posix_cpu_timers(p);
+
+	/* The current CPU might make use of net randoms without receiving IRQs
+	 * to renew them often enough. Let's update the net_rand_state from a
+	 * non-constant value that's not affine to the number of calls to make
+	 * sure it's updated when there's some activity (we don't care in idle).
+	 */
+	this_cpu_add(net_rand_state.s1, rol32(jiffies, 24) + user_tick);
 }
 
 /*
diff --git a/lib/random32.c b/lib/random32.c
index 12111910ccd0..8072ccd9eed5 100644
--- a/lib/random32.c
+++ b/lib/random32.c
@@ -47,7 +47,7 @@ static inline void prandom_state_selftest(void)
 }
 #endif
 
-static DEFINE_PER_CPU(struct rnd_state, net_rand_state);
+DEFINE_PER_CPU(struct rnd_state, net_rand_state);
 
 /**
  *	prandom_u32_state - seeded pseudo-random number generator.

From 480e12c6c7e7891795bca7fff4e77d899e356b08 Mon Sep 17 00:00:00 2001
From: Grygorii Strashko <grygorii.strashko@ti.com>
Date: Thu, 30 Jul 2020 22:05:01 +0300
Subject: [PATCH 0295/2658] ARM: percpu.h: fix build error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit aa54ea903abb02303bf55855fb51e3fcee135d70 upstream.

Fix build error for the case:
  defined(CONFIG_SMP) && !defined(CONFIG_CPU_V6)

config: keystone_defconfig

  CC      arch/arm/kernel/signal.o
  In file included from ../include/linux/random.h:14,
                    from ../arch/arm/kernel/signal.c:8:
  ../arch/arm/include/asm/percpu.h: In function ‘__my_cpu_offset’:
  ../arch/arm/include/asm/percpu.h:29:34: error: ‘current_stack_pointer’ undeclared (first use in this function); did you mean ‘user_stack_pointer’?
      : "Q" (*(const unsigned long *)current_stack_pointer));
                                     ^~~~~~~~~~~~~~~~~~~~~
                                     user_stack_pointer

Fixes: f227e3ec3b5c ("random32: update the net random state on interrupt and activity")
Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/include/asm/percpu.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm/include/asm/percpu.h b/arch/arm/include/asm/percpu.h
index a89b4076cde4..72821b4721ad 100644
--- a/arch/arm/include/asm/percpu.h
+++ b/arch/arm/include/asm/percpu.h
@@ -16,6 +16,8 @@
 #ifndef _ASM_ARM_PERCPU_H_
 #define _ASM_ARM_PERCPU_H_
 
+#include <asm/thread_info.h>
+
 /*
  * Same as asm-generic/percpu.h, except that we store the per cpu offset
  * in the TPIDRPRW. TPIDRPRW only exists on V6K and V7

From 3842abd4ee0a20e58549c816788ab10dc81b4475 Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Thu, 30 Jul 2020 07:59:24 +0200
Subject: [PATCH 0296/2658] random: fix circular include dependency on arm64
 after addition of percpu.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 1c9df907da83812e4f33b59d3d142c864d9da57f upstream.

Daniel Díaz and Kees Cook independently reported that commit
f227e3ec3b5c ("random32: update the net random state on interrupt and
activity") broke arm64 due to a circular dependency on include files
since the addition of percpu.h in random.h.

The correct fix would definitely be to move all the prandom32 stuff out
of random.h but for backporting, a smaller solution is preferred.

This one replaces linux/percpu.h with asm/percpu.h, and this fixes the
problem on x86_64, arm64, arm, and mips.  Note that moving percpu.h
around didn't change anything and that removing it entirely broke
differently.  When backporting, such options might still be considered
if this patch fails to help.

[ It turns out that an alternate fix seems to be to just remove the
  troublesome <asm/pointer_auth.h> remove from the arm64 <asm/smp.h>
  that causes the circular dependency.

  But we might as well do the whole belt-and-suspenders thing, and
  minimize inclusion in <linux/random.h> too. Either will fix the
  problem, and both are good changes.   - Linus ]

Reported-by: Daniel Díaz <daniel.diaz@linaro.org>
Reported-by: Kees Cook <keescook@chromium.org>
Tested-by: Marc Zyngier <maz@kernel.org>
Fixes: f227e3ec3b5c
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/random.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/random.h b/include/linux/random.h
index fb9e3798f771..161f2309392c 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -8,7 +8,7 @@
 
 #include <linux/list.h>
 #include <linux/once.h>
-#include <linux/percpu.h>
+#include <asm/percpu.h>
 
 #include <uapi/linux/random.h>
 

From 9b9bd0b747aee42ced9381fbc62149fe6c3869af Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Wed, 29 Jul 2020 19:11:00 -0700
Subject: [PATCH 0297/2658] random32: remove net_rand_state from the latent
 entropy gcc plugin

commit 83bdc7275e6206f560d247be856bceba3e1ed8f2 upstream.

It turns out that the plugin right now ends up being really unhappy
about the change from 'static' to 'extern' storage that happened in
commit f227e3ec3b5c ("random32: update the net random state on interrupt
and activity").

This is probably a trivial fix for the latent_entropy plugin, but for
now, just remove net_rand_state from the list of things the plugin
worries about.

Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: Emese Revfy <re.emese@gmail.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/random.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/random.h b/include/linux/random.h
index 161f2309392c..0c314a12d619 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -47,7 +47,7 @@ struct rnd_state {
 	__u32 s1, s2, s3, s4;
 };
 
-DECLARE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy;
+DECLARE_PER_CPU(struct rnd_state, net_rand_state);
 
 u32 prandom_u32_state(struct rnd_state *state);
 void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes);

From 02e6b91e72b346b3c44463adadf08068489112fb Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Fri, 31 Jul 2020 07:51:14 +0200
Subject: [PATCH 0298/2658] random32: move the pseudo-random 32-bit definitions
 to prandom.h

commit c0842fbc1b18c7a044e6ff3e8fa78bfa822c7d1a upstream.

The addition of percpu.h to the list of includes in random.h revealed
some circular dependencies on arm64 and possibly other platforms.  This
include was added solely for the pseudo-random definitions, which have
nothing to do with the rest of the definitions in this file but are
still there for legacy reasons.

This patch moves the pseudo-random parts to linux/prandom.h and the
percpu.h include with it, which is now guarded by _LINUX_PRANDOM_H and
protected against recursive inclusion.

A further cleanup step would be to remove this from <linux/random.h>
entirely, and make people who use the prandom infrastructure include
just the new header file.  That's a bit of a churn patch, but grepping
for "prandom_" and "next_pseudo_random32" "struct rnd_state" should
catch most users.

But it turns out that that nice cleanup step is fairly painful, because
a _lot_ of code currently seems to depend on the implicit include of
<linux/random.h>, which can currently come in a lot of ways, including
such fairly core headfers as <linux/net.h>.

So the "nice cleanup" part may or may never happen.

Fixes: 1c9df907da83 ("random: fix circular include dependency on arm64 after addition of percpu.h")
Tested-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/prandom.h | 78 +++++++++++++++++++++++++++++++++++++++++
 include/linux/random.h  | 66 +++-------------------------------
 2 files changed, 82 insertions(+), 62 deletions(-)
 create mode 100644 include/linux/prandom.h

diff --git a/include/linux/prandom.h b/include/linux/prandom.h
new file mode 100644
index 000000000000..aa16e6468f91
--- /dev/null
+++ b/include/linux/prandom.h
@@ -0,0 +1,78 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * include/linux/prandom.h
+ *
+ * Include file for the fast pseudo-random 32-bit
+ * generation.
+ */
+#ifndef _LINUX_PRANDOM_H
+#define _LINUX_PRANDOM_H
+
+#include <linux/types.h>
+#include <linux/percpu.h>
+
+u32 prandom_u32(void);
+void prandom_bytes(void *buf, size_t nbytes);
+void prandom_seed(u32 seed);
+void prandom_reseed_late(void);
+
+struct rnd_state {
+	__u32 s1, s2, s3, s4;
+};
+
+DECLARE_PER_CPU(struct rnd_state, net_rand_state);
+
+u32 prandom_u32_state(struct rnd_state *state);
+void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes);
+void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state);
+
+#define prandom_init_once(pcpu_state)			\
+	DO_ONCE(prandom_seed_full_state, (pcpu_state))
+
+/**
+ * prandom_u32_max - returns a pseudo-random number in interval [0, ep_ro)
+ * @ep_ro: right open interval endpoint
+ *
+ * Returns a pseudo-random number that is in interval [0, ep_ro). Note
+ * that the result depends on PRNG being well distributed in [0, ~0U]
+ * u32 space. Here we use maximally equidistributed combined Tausworthe
+ * generator, that is, prandom_u32(). This is useful when requesting a
+ * random index of an array containing ep_ro elements, for example.
+ *
+ * Returns: pseudo-random number in interval [0, ep_ro)
+ */
+static inline u32 prandom_u32_max(u32 ep_ro)
+{
+	return (u32)(((u64) prandom_u32() * ep_ro) >> 32);
+}
+
+/*
+ * Handle minimum values for seeds
+ */
+static inline u32 __seed(u32 x, u32 m)
+{
+	return (x < m) ? x + m : x;
+}
+
+/**
+ * prandom_seed_state - set seed for prandom_u32_state().
+ * @state: pointer to state structure to receive the seed.
+ * @seed: arbitrary 64-bit value to use as a seed.
+ */
+static inline void prandom_seed_state(struct rnd_state *state, u64 seed)
+{
+	u32 i = (seed >> 32) ^ (seed << 10) ^ seed;
+
+	state->s1 = __seed(i,   2U);
+	state->s2 = __seed(i,   8U);
+	state->s3 = __seed(i,  16U);
+	state->s4 = __seed(i, 128U);
+}
+
+/* Pseudo random number generator from numerical recipes. */
+static inline u32 next_pseudo_random32(u32 seed)
+{
+	return seed * 1664525 + 1013904223;
+}
+
+#endif
diff --git a/include/linux/random.h b/include/linux/random.h
index 0c314a12d619..2fa4207fd067 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -8,7 +8,6 @@
 
 #include <linux/list.h>
 #include <linux/once.h>
-#include <asm/percpu.h>
 
 #include <uapi/linux/random.h>
 
@@ -38,63 +37,12 @@ unsigned int get_random_int(void);
 unsigned long get_random_long(void);
 unsigned long randomize_range(unsigned long start, unsigned long end, unsigned long len);
 
-u32 prandom_u32(void);
-void prandom_bytes(void *buf, size_t nbytes);
-void prandom_seed(u32 seed);
-void prandom_reseed_late(void);
-
-struct rnd_state {
-	__u32 s1, s2, s3, s4;
-};
-
-DECLARE_PER_CPU(struct rnd_state, net_rand_state);
-
-u32 prandom_u32_state(struct rnd_state *state);
-void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes);
-void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state);
-
-#define prandom_init_once(pcpu_state)			\
-	DO_ONCE(prandom_seed_full_state, (pcpu_state))
-
-/**
- * prandom_u32_max - returns a pseudo-random number in interval [0, ep_ro)
- * @ep_ro: right open interval endpoint
- *
- * Returns a pseudo-random number that is in interval [0, ep_ro). Note
- * that the result depends on PRNG being well distributed in [0, ~0U]
- * u32 space. Here we use maximally equidistributed combined Tausworthe
- * generator, that is, prandom_u32(). This is useful when requesting a
- * random index of an array containing ep_ro elements, for example.
- *
- * Returns: pseudo-random number in interval [0, ep_ro)
- */
-static inline u32 prandom_u32_max(u32 ep_ro)
-{
-	return (u32)(((u64) prandom_u32() * ep_ro) >> 32);
-}
-
 /*
- * Handle minimum values for seeds
- */
-static inline u32 __seed(u32 x, u32 m)
-{
-	return (x < m) ? x + m : x;
-}
-
-/**
- * prandom_seed_state - set seed for prandom_u32_state().
- * @state: pointer to state structure to receive the seed.
- * @seed: arbitrary 64-bit value to use as a seed.
+ * This is designed to be standalone for just prandom
+ * users, but for now we include it from <linux/random.h>
+ * for legacy reasons.
  */
-static inline void prandom_seed_state(struct rnd_state *state, u64 seed)
-{
-	u32 i = (seed >> 32) ^ (seed << 10) ^ seed;
-
-	state->s1 = __seed(i,   2U);
-	state->s2 = __seed(i,   8U);
-	state->s3 = __seed(i,  16U);
-	state->s4 = __seed(i, 128U);
-}
+#include <linux/prandom.h>
 
 #ifdef CONFIG_ARCH_RANDOM
 # include <asm/archrandom.h>
@@ -125,10 +73,4 @@ static inline int arch_has_random_seed(void)
 }
 #endif
 
-/* Pseudo random number generator from numerical recipes. */
-static inline u32 next_pseudo_random32(u32 seed)
-{
-	return seed * 1664525 + 1013904223;
-}
-
 #endif /* _LINUX_RANDOM_H */

From b6a0eadeb56add40af703b86669218248e6b1264 Mon Sep 17 00:00:00 2001
From: Jiang Ying <jiangying8582@126.com>
Date: Thu, 6 Aug 2020 17:38:11 +0800
Subject: [PATCH 0299/2658] ext4: fix direct I/O read error

This patch is used to fix ext4 direct I/O read error when
the read size is not aligned with block size.

Then, I will use a test to explain the error.

(1) Make a file that is not aligned with block size:
	$dd if=/dev/zero of=./test.jar bs=1000 count=3

(2) I wrote a source file named "direct_io_read_file.c" as following:

	#include <stdio.h>
	#include <stdlib.h>
	#include <unistd.h>
	#include <sys/file.h>
	#include <sys/types.h>
	#include <sys/stat.h>
	#include <string.h>
	#define BUF_SIZE 1024

	int main()
	{
		int fd;
		int ret;

		unsigned char *buf;
		ret = posix_memalign((void **)&buf, 512, BUF_SIZE);
		if (ret) {
			perror("posix_memalign failed");
			exit(1);
		}
		fd = open("./test.jar", O_RDONLY | O_DIRECT, 0755);
		if (fd < 0){
			perror("open ./test.jar failed");
			exit(1);
		}

		do {
			ret = read(fd, buf, BUF_SIZE);
			printf("ret=%d\n",ret);
			if (ret < 0) {
				perror("write test.jar failed");
			}
		} while (ret > 0);

		free(buf);
		close(fd);
	}

(3) Compile the source file:
	$gcc direct_io_read_file.c -D_GNU_SOURCE

(4) Run the test program:
	$./a.out

	The result is as following:
	ret=1024
	ret=1024
	ret=952
	ret=-1
	write test.jar failed: Invalid argument.

I have tested this program on XFS filesystem, XFS does not have
this problem, because XFS use iomap_dio_rw() to do direct I/O
read. And the comparing between read offset and file size is done
in iomap_dio_rw(), the code is as following:

	if (pos < size) {
		retval = filemap_write_and_wait_range(mapping, pos,
				pos + iov_length(iov, nr_segs) - 1);

		if (!retval) {
			retval = mapping->a_ops->direct_IO(READ, iocb,
						iov, pos, nr_segs);
		}
		...
	}

...only when "pos < size", direct I/O can be done, or 0 will be return.

I have tested the fix patch on Ext4, it is up to the mustard of
EINVAL in man2(read) as following:
	#include <unistd.h>
	ssize_t read(int fd, void *buf, size_t count);

	EINVAL
		fd is attached to an object which is unsuitable for reading;
		or the file was opened with the O_DIRECT flag, and either the
		address specified in buf, the value specified in count, or the
		current file offset is not suitably aligned.

So I think this patch can be applied to fix ext4 direct I/O error.

However Ext4 introduces direct I/O read using iomap infrastructure
on kernel 5.5, the patch is commit <b1b4705d54ab>
("ext4: introduce direct I/O read using iomap infrastructure"),
then Ext4 will be the same as XFS, they all use iomap_dio_rw() to do direct
I/O read. So this problem does not exist on kernel 5.5 for Ext4.

>From above description, we can see this problem exists on all the kernel
versions between kernel 3.14 and kernel 5.4. It will cause the Applications
to fail to read. For example, when the search service downloads a new full
index file, the search engine is loading the previous index file and is
processing the search request, it can not use buffer io that may squeeze
the previous index file in use from pagecache, so the serch service must
use direct I/O read.

Please apply this patch on these kernel versions, or please use the method
on kernel 5.5 to fix this problem.

Fixes: 9fe55eea7e4b ("Fix race when checking i_size on direct i/o read")
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Wang Long <wanglong19@meituan.com>
Signed-off-by: Jiang Ying <jiangying8582@126.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile        | 18 +++++++++++++++++-
 fs/ext4/inode.c |  9 +++++++--
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/Makefile b/Makefile
index 013ebc5bd74c..b9cc4448e3ab 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 232
+SUBLEVEL = 231
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 
@@ -611,6 +611,22 @@ endif # $(dot-config)
 # Defaults to vmlinux, but the arch makefile usually adds further targets
 all: vmlinux
 
+ifeq ($(cc-name),clang)
+ifneq ($(CROSS_COMPILE),)
+CLANG_TARGET	:= --target=$(notdir $(CROSS_COMPILE:%-=%))
+GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)elfedit))
+CLANG_PREFIX	:= --prefix=$(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE))
+GCC_TOOLCHAIN	:= $(realpath $(GCC_TOOLCHAIN_DIR)/..)
+endif
+ifneq ($(GCC_TOOLCHAIN),)
+CLANG_GCC_TC	:= --gcc-toolchain=$(GCC_TOOLCHAIN)
+endif
+KBUILD_CFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC) $(CLANG_PREFIX)
+KBUILD_AFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC) $(CLANG_PREFIX)
+KBUILD_CFLAGS += $(call cc-option, -no-integrated-as)
+KBUILD_AFLAGS += $(call cc-option, -no-integrated-as)
+endif
+
 # The arch Makefile can set ARCH_{CPP,A,C}FLAGS to override the default
 # values of the respective KBUILD_* variables
 ARCH_CPPFLAGS :=
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 6f45114ac1a3..6c8771820218 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -3381,9 +3381,14 @@ static ssize_t ext4_direct_IO(struct kiocb *iocb, struct iov_iter *iter,
 	size_t count = iov_iter_count(iter);
 	ssize_t ret;
 
-#if defined(CONFIG_EXT4_FS_ENCRYPTION) && \
-!defined(CONFIG_EXT4_FS_ICE_ENCRYPTION)
+	if (iov_iter_rw(iter) == READ) {
+		loff_t size = i_size_read(inode);
+
+		if (offset >= size)
+			return 0;
+	}
 
+#ifdef CONFIG_EXT4_FS_ENCRYPTION
 	if (ext4_encrypted_inode(inode) && S_ISREG(inode->i_mode))
 		return 0;
 #endif

From 4ffafe5cf20738060be8e664c5ab3abe04e54e42 Mon Sep 17 00:00:00 2001
From: Erik Ekman <erik@kryo.se>
Date: Fri, 17 Jul 2020 20:51:18 +0200
Subject: [PATCH 0300/2658] USB: serial: qcserial: add EM7305 QDL product ID

commit d2a4309c1ab6df424b2239fe2920d6f26f808d17 upstream.

When running qmi-firmware-update on the Sierra Wireless EM7305 in a Toshiba
laptop, it changed product ID to 0x9062 when entering QDL mode:

usb 2-4: new high-speed USB device number 78 using xhci_hcd
usb 2-4: New USB device found, idVendor=1199, idProduct=9062, bcdDevice= 0.00
usb 2-4: New USB device strings: Mfr=1, Product=2, SerialNumber=0
usb 2-4: Product: EM7305
usb 2-4: Manufacturer: Sierra Wireless, Incorporated

The upgrade could complete after running
 # echo 1199 9062 > /sys/bus/usb-serial/drivers/qcserial/new_id

qcserial 2-4:1.0: Qualcomm USB modem converter detected
usb 2-4: Qualcomm USB modem converter now attached to ttyUSB0

Signed-off-by: Erik Ekman <erik@kryo.se>
Link: https://lore.kernel.org/r/20200717185118.3640219-1-erik@kryo.se
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/qcserial.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index c59e6d4a8a61..11fb4d78e2db 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -159,6 +159,7 @@ static const struct usb_device_id id_table[] = {
 	{DEVICE_SWI(0x1199, 0x9056)},	/* Sierra Wireless Modem */
 	{DEVICE_SWI(0x1199, 0x9060)},	/* Sierra Wireless Modem */
 	{DEVICE_SWI(0x1199, 0x9061)},	/* Sierra Wireless Modem */
+	{DEVICE_SWI(0x1199, 0x9062)},	/* Sierra Wireless EM7305 QDL */
 	{DEVICE_SWI(0x1199, 0x9063)},	/* Sierra Wireless EM7305 */
 	{DEVICE_SWI(0x1199, 0x9070)},	/* Sierra Wireless MC74xx */
 	{DEVICE_SWI(0x1199, 0x9071)},	/* Sierra Wireless MC74xx */

From 3a272ed01ff74a274ac5123049392678bfa8ea59 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 4 Aug 2020 20:58:15 +0200
Subject: [PATCH 0301/2658] ALSA: seq: oss: Serialize ioctls

commit 80982c7e834e5d4e325b6ce33757012ecafdf0bb upstream.

Some ioctls via OSS sequencer API may race and lead to UAF when the
port create and delete are performed concurrently, as spotted by a
couple of syzkaller cases.  This patch is an attempt to address it by
serializing the ioctls with the existing register_mutex.

Basically OSS sequencer API is an obsoleted interface and was designed
without much consideration of the concurrency.  There are very few
applications with it, and the concurrent performance isn't asked,
hence this "big hammer" approach should be good enough.

Reported-by: syzbot+1a54a94bd32716796edd@syzkaller.appspotmail.com
Reported-by: syzbot+9d2abfef257f3e2d4713@syzkaller.appspotmail.com
Suggested-by: Hillf Danton <hdanton@sina.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200804185815.2453-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/seq/oss/seq_oss.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c
index cb23899100ee..8044775999ed 100644
--- a/sound/core/seq/oss/seq_oss.c
+++ b/sound/core/seq/oss/seq_oss.c
@@ -180,10 +180,16 @@ static long
 odev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
 	struct seq_oss_devinfo *dp;
+	long rc;
+
 	dp = file->private_data;
 	if (snd_BUG_ON(!dp))
 		return -ENXIO;
-	return snd_seq_oss_ioctl(dp, cmd, arg);
+
+	mutex_lock(&register_mutex);
+	rc = snd_seq_oss_ioctl(dp, cmd, arg);
+	mutex_unlock(&register_mutex);
+	return rc;
 }
 
 #ifdef CONFIG_COMPAT

From 62ee2700b7ed9e5aed3737683b5ebe0a28d3cb92 Mon Sep 17 00:00:00 2001
From: Peilin Ye <yepeilin.cs@gmail.com>
Date: Fri, 10 Jul 2020 12:09:15 -0400
Subject: [PATCH 0302/2658] Bluetooth: Fix slab-out-of-bounds read in
 hci_extended_inquiry_result_evt()

commit 51c19bf3d5cfaa66571e4b88ba2a6f6295311101 upstream.

Check upon `num_rsp` is insufficient. A malformed event packet with a
large `num_rsp` number makes hci_extended_inquiry_result_evt() go out
of bounds. Fix it.

This patch fixes the following syzbot bug:

    https://syzkaller.appspot.com/bug?id=4bf11aa05c4ca51ce0df86e500fce486552dc8d2

Reported-by: syzbot+d8489a79b781849b9c46@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_event.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 72a8e9bb1dd6..ca11a59ccd5a 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3812,7 +3812,7 @@ static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
 
 	BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
 
-	if (!num_rsp)
+	if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
 		return;
 
 	if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))

From 61069d8aea4a7a776f1cdf85cf59c9fa6fbfdb07 Mon Sep 17 00:00:00 2001
From: Peilin Ye <yepeilin.cs@gmail.com>
Date: Fri, 10 Jul 2020 17:39:18 -0400
Subject: [PATCH 0303/2658] Bluetooth: Prevent out-of-bounds read in
 hci_inquiry_result_evt()

commit 75bbd2ea50ba1c5d9da878a17e92eac02fe0fd3a upstream.

Check `num_rsp` before using it as for-loop counter.

Cc: stable@vger.kernel.org
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_event.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index ca11a59ccd5a..146ad260c761 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2094,7 +2094,7 @@ static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
 	BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
 
-	if (!num_rsp)
+	if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
 		return;
 
 	if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))

From 709f7dc6e6f7d01a122792b4434fd15527097d29 Mon Sep 17 00:00:00 2001
From: Peilin Ye <yepeilin.cs@gmail.com>
Date: Fri, 10 Jul 2020 17:45:26 -0400
Subject: [PATCH 0304/2658] Bluetooth: Prevent out-of-bounds read in
 hci_inquiry_result_with_rssi_evt()

commit 629b49c848ee71244203934347bd7730b0ddee8d upstream.

Check `num_rsp` before using it as for-loop counter. Add `unlock` label.

Cc: stable@vger.kernel.org
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_event.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 146ad260c761..a85e4e1a8d5a 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3609,6 +3609,9 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
 		struct inquiry_info_with_rssi_and_pscan_mode *info;
 		info = (void *) (skb->data + 1);
 
+		if (skb->len < num_rsp * sizeof(*info) + 1)
+			goto unlock;
+
 		for (; num_rsp; num_rsp--, info++) {
 			u32 flags;
 
@@ -3630,6 +3633,9 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
 	} else {
 		struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
 
+		if (skb->len < num_rsp * sizeof(*info) + 1)
+			goto unlock;
+
 		for (; num_rsp; num_rsp--, info++) {
 			u32 flags;
 
@@ -3650,6 +3656,7 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
 		}
 	}
 
+unlock:
 	hci_dev_unlock(hdev);
 }
 

From 58c0d303309b4c627448edfd6332be6b47ecc75a Mon Sep 17 00:00:00 2001
From: Yunhai Zhang <zhangyunhai@nsfocus.com>
Date: Tue, 28 Jul 2020 09:58:03 +0800
Subject: [PATCH 0305/2658] vgacon: Fix for missing check in scrollback
 handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit ebfdfeeae8c01fcb2b3b74ffaf03876e20835d2d upstream.

vgacon_scrollback_update() always leaves enbough room in the scrollback
buffer for the next call, but if the console size changed that room
might not actually be enough, and so we need to re-check.

The check should be in the loop since vgacon_scrollback_cur->tail is
updated in the loop and count may be more than 1 when triggered by CSI M,
as Jiri's PoC:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/ioctl.h>
#include <fcntl.h>

int main(int argc, char** argv)
{
        int fd = open("/dev/tty1", O_RDWR);
        unsigned short size[3] = {25, 200, 0};
        ioctl(fd, 0x5609, size); // VT_RESIZE

        write(fd, "\e[1;1H", 6);
        for (int i = 0; i < 30; i++)
                write(fd, "\e[10M", 5);
}

It leads to various crashes as vgacon_scrollback_update writes out of
the buffer:
 BUG: unable to handle page fault for address: ffffc900001752a0
 #PF: supervisor write access in kernel mode
 #PF: error_code(0x0002) - not-present page
 RIP: 0010:mutex_unlock+0x13/0x30
...
 Call Trace:
  n_tty_write+0x1a0/0x4d0
  tty_write+0x1a0/0x2e0

Or to KASAN reports:
BUG: KASAN: slab-out-of-bounds in vgacon_scroll+0x57a/0x8ed

This fixes CVE-2020-14331.

Reported-by: 张云海 <zhangyunhai@nsfocus.com>
Reported-by: Yang Yingliang <yangyingliang@huawei.com>
Reported-by: Kyungtae Kim <kt0755@gmail.com>
Fixes: 15bdab959c9b ([PATCH] vgacon: Add support for soft scrollback)
Cc: stable@vger.kernel.org
Cc: linux-fbdev@vger.kernel.org
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Solar Designer <solar@openwall.com>
Cc: "Srivatsa S. Bhat" <srivatsa@csail.mit.edu>
Cc: Anthony Liguori <aliguori@amazon.com>
Cc: Yang Yingliang <yangyingliang@huawei.com>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Cc: Jiri Slaby <jirislaby@kernel.org>
Signed-off-by: Yunhai Zhang <zhangyunhai@nsfocus.com>
Link: https://lore.kernel.org/r/9fb43895-ca91-9b07-ebfd-808cf854ca95@nsfocus.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/console/vgacon.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index e5231dd55e6e..edf0af8dd0a4 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -220,6 +220,10 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
 	p = (void *) (c->vc_origin + t * c->vc_size_row);
 
 	while (count--) {
+		if ((vgacon_scrollback_tail + c->vc_size_row) >
+		    vgacon_scrollback_size)
+			vgacon_scrollback_tail = 0;
+
 		scr_memcpyw(vgacon_scrollback + vgacon_scrollback_tail,
 			    p, c->vc_size_row);
 		vgacon_scrollback_cnt++;

From d5d9dcbba8a6cc8ab1d528450c8449bc16f8f4b1 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 16 Jul 2020 13:53:46 +0200
Subject: [PATCH 0306/2658] mtd: properly check all write ioctls for
 permissions

commit f7e6b19bc76471ba03725fe58e0c218a3d6266c3 upstream.

When doing a "write" ioctl call, properly check that we have permissions
to do so before copying anything from userspace or anything else so we
can "fail fast".  This includes also covering the MEMWRITE ioctl which
previously missed checking for this.

Cc: Miquel Raynal <miquel.raynal@bootlin.com>
Cc: Richard Weinberger <richard@nod.at>
Cc: Vignesh Raghavendra <vigneshr@ti.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[rw: Fixed locking issue]
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/mtdchar.c | 56 ++++++++++++++++++++++++++++++++++++-------
 1 file changed, 47 insertions(+), 9 deletions(-)

diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 0d244dac1ccb..ce87d9506f6a 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -372,9 +372,6 @@ static int mtdchar_writeoob(struct file *file, struct mtd_info *mtd,
 	uint32_t retlen;
 	int ret = 0;
 
-	if (!(file->f_mode & FMODE_WRITE))
-		return -EPERM;
-
 	if (length > 4096)
 		return -EINVAL;
 
@@ -608,6 +605,48 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
 			return -EFAULT;
 	}
 
+	/*
+	 * Check the file mode to require "dangerous" commands to have write
+	 * permissions.
+	 */
+	switch (cmd) {
+	/* "safe" commands */
+	case MEMGETREGIONCOUNT:
+	case MEMGETREGIONINFO:
+	case MEMGETINFO:
+	case MEMREADOOB:
+	case MEMREADOOB64:
+	case MEMLOCK:
+	case MEMUNLOCK:
+	case MEMISLOCKED:
+	case MEMGETOOBSEL:
+	case MEMGETBADBLOCK:
+	case MEMSETBADBLOCK:
+	case OTPSELECT:
+	case OTPGETREGIONCOUNT:
+	case OTPGETREGIONINFO:
+	case OTPLOCK:
+	case ECCGETLAYOUT:
+	case ECCGETSTATS:
+	case MTDFILEMODE:
+	case BLKPG:
+	case BLKRRPART:
+		break;
+
+	/* "dangerous" commands */
+	case MEMERASE:
+	case MEMERASE64:
+	case MEMWRITEOOB:
+	case MEMWRITEOOB64:
+	case MEMWRITE:
+		if (!(file->f_mode & FMODE_WRITE))
+			return -EPERM;
+		break;
+
+	default:
+		return -ENOTTY;
+	}
+
 	switch (cmd) {
 	case MEMGETREGIONCOUNT:
 		if (copy_to_user(argp, &(mtd->numeraseregions), sizeof(int)))
@@ -655,9 +694,6 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
 	{
 		struct erase_info *erase;
 
-		if(!(file->f_mode & FMODE_WRITE))
-			return -EPERM;
-
 		erase=kzalloc(sizeof(struct erase_info),GFP_KERNEL);
 		if (!erase)
 			ret = -ENOMEM;
@@ -982,9 +1018,6 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
 		ret = 0;
 		break;
 	}
-
-	default:
-		ret = -ENOTTY;
 	}
 
 	return ret;
@@ -1028,6 +1061,11 @@ static long mtdchar_compat_ioctl(struct file *file, unsigned int cmd,
 		struct mtd_oob_buf32 buf;
 		struct mtd_oob_buf32 __user *buf_user = argp;
 
+		if (!(file->f_mode & FMODE_WRITE)) {
+			ret = -EPERM;
+			break;
+		}
+
 		if (copy_from_user(&buf, argp, sizeof(buf)))
 			ret = -EFAULT;
 		else

From 2d0f95c5c9fa41281348b793f7e4cb5f994a91f0 Mon Sep 17 00:00:00 2001
From: Christoph Hellwig <hch@lst.de>
Date: Fri, 10 Jul 2020 10:57:22 +0200
Subject: [PATCH 0307/2658] net/9p: validate fds in p9_fd_open

[ Upstream commit a39c46067c845a8a2d7144836e9468b7f072343e ]

p9_fd_open just fgets file descriptors passed in from userspace, but
doesn't verify that they are valid for read or writing.  This gets
cought down in the VFS when actually attempting a read or write, but
a new warning added in linux-next upsets syzcaller.

Fix this by just verifying the fds early on.

Link: http://lkml.kernel.org/r/20200710085722.435850-1-hch@lst.de
Reported-by: syzbot+e6f77e16ff68b2434a2c@syzkaller.appspotmail.com
Signed-off-by: Christoph Hellwig <hch@lst.de>
[Dominique: amend goto as per Doug Nazar's review]
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/9p/trans_fd.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 2f68ffda3715..eab058f93ec9 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -793,20 +793,28 @@ static int p9_fd_open(struct p9_client *client, int rfd, int wfd)
 		return -ENOMEM;
 
 	ts->rd = fget(rfd);
+	if (!ts->rd)
+		goto out_free_ts;
+	if (!(ts->rd->f_mode & FMODE_READ))
+		goto out_put_rd;
 	ts->wr = fget(wfd);
-	if (!ts->rd || !ts->wr) {
-		if (ts->rd)
-			fput(ts->rd);
-		if (ts->wr)
-			fput(ts->wr);
-		kfree(ts);
-		return -EIO;
-	}
+	if (!ts->wr)
+		goto out_put_rd;
+	if (!(ts->wr->f_mode & FMODE_WRITE))
+		goto out_put_wr;
 
 	client->trans = ts;
 	client->status = Connected;
 
 	return 0;
+
+out_put_wr:
+	fput(ts->wr);
+out_put_rd:
+	fput(ts->rd);
+out_free_ts:
+	kfree(ts);
+	return -EIO;
 }
 
 static int p9_socket_open(struct p9_client *client, struct socket *csocket)

From bd7985438dde16f73eba6d6b2ebebfe1f0ee9a73 Mon Sep 17 00:00:00 2001
From: Ben Skeggs <bskeggs@redhat.com>
Date: Fri, 24 Jul 2020 17:01:39 +1000
Subject: [PATCH 0308/2658] drm/nouveau/fbcon: fix module unload when fbcon
 init has failed for some reason

[ Upstream commit 498595abf5bd51f0ae074cec565d888778ea558f ]

Stale pointer was tripping up the unload path.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nouveau_fbcon.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 343476d15726..edb3a23ded5d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -566,6 +566,7 @@ nouveau_fbcon_init(struct drm_device *dev)
 	drm_fb_helper_fini(&fbcon->helper);
 free:
 	kfree(fbcon);
+	drm->fbcon = NULL;
 	return ret;
 }
 

From 7c4ca415399c84929dae8d06a35e01ce8ea30ed2 Mon Sep 17 00:00:00 2001
From: Julian Squires <julian@cipht.net>
Date: Mon, 6 Jul 2020 17:13:53 -0400
Subject: [PATCH 0309/2658] cfg80211: check vendor command doit pointer before
 use

[ Upstream commit 4052d3d2e8f47a15053320bbcbe365d15610437d ]

In the case where a vendor command does not implement doit, and has no
flags set, doit would not be validated and a NULL pointer dereference
would occur, for example when invoking the vendor command via iw.

I encountered this while developing new vendor commands.  Perhaps in
practice it is advisable to always implement doit along with dumpit,
but it seems reasonable to me to always check doit anyway, not just
when NEED_WDEV.

Signed-off-by: Julian Squires <julian@cipht.net>
Link: https://lore.kernel.org/r/20200706211353.2366470-1-julian@cipht.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/wireless/nl80211.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 04019096da59..47873ebfd8c1 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -10662,13 +10662,13 @@ static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
 				if (!wdev->netdev && !wdev->p2p_started)
 					return -ENETDOWN;
 			}
-
-			if (!vcmd->doit)
-				return -EOPNOTSUPP;
 		} else {
 			wdev = NULL;
 		}
 
+		if (!vcmd->doit)
+			return -EOPNOTSUPP;
+
 		if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
 			data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
 			len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);

From 06bc60caf9b56f7b72f5ef5c5da77dc736f027c2 Mon Sep 17 00:00:00 2001
From: Francesco Ruggeri <fruggeri@arista.com>
Date: Thu, 2 Jul 2020 15:39:06 -0700
Subject: [PATCH 0310/2658] igb: reinit_locked() should be called with
 rtnl_lock

[ Upstream commit 024a8168b749db7a4aa40a5fbdfa04bf7e77c1c0 ]

We observed two panics involving races with igb_reset_task.
The first panic is caused by this race condition:

	kworker			reboot -f

	igb_reset_task
	igb_reinit_locked
	igb_down
	napi_synchronize
				__igb_shutdown
				igb_clear_interrupt_scheme
				igb_free_q_vectors
				igb_free_q_vector
				adapter->q_vector[v_idx] = NULL;
	napi_disable
	Panics trying to access
	adapter->q_vector[v_idx].napi_state

The second panic (a divide error) is caused by this race:

kworker		reboot -f	tx packet

igb_reset_task
		__igb_shutdown
		rtnl_lock()
		...
		igb_clear_interrupt_scheme
		igb_free_q_vectors
		adapter->num_tx_queues = 0
		...
		rtnl_unlock()
rtnl_lock()
igb_reinit_locked
igb_down
igb_up
netif_tx_start_all_queues
				dev_hard_start_xmit
				igb_xmit_frame
				igb_tx_queue_mapping
				Panics on
				r_idx % adapter->num_tx_queues

This commit applies to igb_reset_task the same changes that
were applied to ixgbe in commit 2f90b8657ec9 ("ixgbe: this patch
adds support for DCB to the kernel and ixgbe driver"),
commit 8f4c5c9fb87a ("ixgbe: reinit_locked() should be called with
rtnl_lock") and commit 88adce4ea8f9 ("ixgbe: fix possible race in
reset subtask").

Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/igb/igb_main.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 426abfce1c3f..a4aa4d10ca70 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -5137,9 +5137,18 @@ static void igb_reset_task(struct work_struct *work)
 	struct igb_adapter *adapter;
 	adapter = container_of(work, struct igb_adapter, reset_task);
 
+	rtnl_lock();
+	/* If we're already down or resetting, just bail */
+	if (test_bit(__IGB_DOWN, &adapter->state) ||
+	    test_bit(__IGB_RESETTING, &adapter->state)) {
+		rtnl_unlock();
+		return;
+	}
+
 	igb_dump(adapter);
 	netdev_err(adapter->netdev, "Reset adapter\n");
 	igb_reinit_locked(adapter);
+	rtnl_unlock();
 }
 
 /**

From 6748f92a0560a5aafd26a8ade7c61062e36b45a1 Mon Sep 17 00:00:00 2001
From: Xin Xiong <xiongx18@fudan.edu.cn>
Date: Wed, 29 Jul 2020 21:06:59 +0800
Subject: [PATCH 0311/2658] atm: fix atm_dev refcnt leaks in
 atmtcp_remove_persistent

[ Upstream commit 51875dad43b44241b46a569493f1e4bfa0386d86 ]

atmtcp_remove_persistent() invokes atm_dev_lookup(), which returns a
reference of atm_dev with increased refcount or NULL if fails.

The refcount leaks issues occur in two error handling paths. If
dev_data->persist is zero or PRIV(dev)->vcc isn't NULL, the function
returns 0 without decreasing the refcount kept by a local variable,
resulting in refcount leaks.

Fix the issue by adding atm_dev_put() before returning 0 both when
dev_data->persist is zero or PRIV(dev)->vcc isn't NULL.

Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/atm/atmtcp.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c
index 480fa6ffbc09..04fca6db273e 100644
--- a/drivers/atm/atmtcp.c
+++ b/drivers/atm/atmtcp.c
@@ -432,9 +432,15 @@ static int atmtcp_remove_persistent(int itf)
 		return -EMEDIUMTYPE;
 	}
 	dev_data = PRIV(dev);
-	if (!dev_data->persist) return 0;
+	if (!dev_data->persist) {
+		atm_dev_put(dev);
+		return 0;
+	}
 	dev_data->persist = 0;
-	if (PRIV(dev)->vcc) return 0;
+	if (PRIV(dev)->vcc) {
+		atm_dev_put(dev);
+		return 0;
+	}
 	kfree(dev_data);
 	atm_dev_put(dev);
 	atm_dev_deregister(dev);

From 855d06a2ca424ecefc8af7442424de01d6597157 Mon Sep 17 00:00:00 2001
From: Philippe Duplessis-Guindon <pduplessis@efficios.com>
Date: Thu, 30 Jul 2020 11:02:36 -0400
Subject: [PATCH 0312/2658] tools lib traceevent: Fix memory leak in
 process_dynamic_array_len

[ Upstream commit e24c6447ccb7b1a01f9bf0aec94939e6450c0b4d ]

I compiled with AddressSanitizer and I had these memory leaks while I
was using the tep_parse_format function:

    Direct leak of 28 byte(s) in 4 object(s) allocated from:
        #0 0x7fb07db49ffe in __interceptor_realloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dffe)
        #1 0x7fb07a724228 in extend_token /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:985
        #2 0x7fb07a724c21 in __read_token /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1140
        #3 0x7fb07a724f78 in read_token /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1206
        #4 0x7fb07a725191 in __read_expect_type /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1291
        #5 0x7fb07a7251df in read_expect_type /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1299
        #6 0x7fb07a72e6c8 in process_dynamic_array_len /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:2849
        #7 0x7fb07a7304b8 in process_function /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:3161
        #8 0x7fb07a730900 in process_arg_token /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:3207
        #9 0x7fb07a727c0b in process_arg /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1786
        #10 0x7fb07a731080 in event_read_print_args /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:3285
        #11 0x7fb07a731722 in event_read_print /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:3369
        #12 0x7fb07a740054 in __tep_parse_format /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:6335
        #13 0x7fb07a74047a in __parse_event /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:6389
        #14 0x7fb07a740536 in tep_parse_format /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:6431
        #15 0x7fb07a785acf in parse_event ../../../src/fs-src/fs.c:251
        #16 0x7fb07a785ccd in parse_systems ../../../src/fs-src/fs.c:284
        #17 0x7fb07a786fb3 in read_metadata ../../../src/fs-src/fs.c:593
        #18 0x7fb07a78760e in ftrace_fs_source_init ../../../src/fs-src/fs.c:727
        #19 0x7fb07d90c19c in add_component_with_init_method_data ../../../../src/lib/graph/graph.c:1048
        #20 0x7fb07d90c87b in add_source_component_with_initialize_method_data ../../../../src/lib/graph/graph.c:1127
        #21 0x7fb07d90c92a in bt_graph_add_source_component ../../../../src/lib/graph/graph.c:1152
        #22 0x55db11aa632e in cmd_run_ctx_create_components_from_config_components ../../../src/cli/babeltrace2.c:2252
        #23 0x55db11aa6fda in cmd_run_ctx_create_components ../../../src/cli/babeltrace2.c:2347
        #24 0x55db11aa780c in cmd_run ../../../src/cli/babeltrace2.c:2461
        #25 0x55db11aa8a7d in main ../../../src/cli/babeltrace2.c:2673
        #26 0x7fb07d5460b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

The token variable in the process_dynamic_array_len function is
allocated in the read_expect_type function, but is not freed before
calling the read_token function.

Free the token variable before calling read_token in order to plug the
leak.

Signed-off-by: Philippe Duplessis-Guindon <pduplessis@efficios.com>
Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Link: https://lore.kernel.org/linux-trace-devel/20200730150236.5392-1-pduplessis@efficios.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/traceevent/event-parse.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
index 9954b069b3ca..86455408c7e1 100644
--- a/tools/lib/traceevent/event-parse.c
+++ b/tools/lib/traceevent/event-parse.c
@@ -2752,6 +2752,7 @@ process_dynamic_array_len(struct event_format *event, struct print_arg *arg,
 	if (read_expected(EVENT_DELIM, ")") < 0)
 		goto out_err;
 
+	free_token(token);
 	type = read_token(&token);
 	*tok = token;
 

From 813d927b71f85aeb84112957c6faac99d97a15d1 Mon Sep 17 00:00:00 2001
From: Jann Horn <jannh@google.com>
Date: Mon, 27 Jul 2020 14:04:24 +0200
Subject: [PATCH 0313/2658] binder: Prevent context manager from incrementing
 ref 0

commit 4b836a1426cb0f1ef2a6e211d7e553221594f8fc upstream.

Binder is designed such that a binder_proc never has references to
itself. If this rule is violated, memory corruption can occur when a
process sends a transaction to itself; see e.g.
<https://syzkaller.appspot.com/bug?extid=09e05aba06723a94d43d>.

There is a remaining edgecase through which such a transaction-to-self
can still occur from the context of a task with BINDER_SET_CONTEXT_MGR
access:

 - task A opens /dev/binder twice, creating binder_proc instances P1
   and P2
 - P1 becomes context manager
 - P2 calls ACQUIRE on the magic handle 0, allocating index 0 in its
   handle table
 - P1 dies (by closing the /dev/binder fd and waiting a bit)
 - P2 becomes context manager
 - P2 calls ACQUIRE on the magic handle 0, allocating index 1 in its
   handle table
   [this triggers a warning: "binder: 1974:1974 tried to acquire
   reference to desc 0, got 1 instead"]
 - task B opens /dev/binder once, creating binder_proc instance P3
 - P3 calls P2 (via magic handle 0) with (void*)1 as argument (two-way
   transaction)
 - P2 receives the handle and uses it to call P3 (two-way transaction)
 - P3 calls P2 (via magic handle 0) (two-way transaction)
 - P2 calls P2 (via handle 1) (two-way transaction)

And then, if P2 does *NOT* accept the incoming transaction work, but
instead closes the binder fd, we get a crash.

Solve it by preventing the context manager from using ACQUIRE on ref 0.
There shouldn't be any legitimate reason for the context manager to do
that.

Additionally, print a warning if someone manages to find another way to
trigger a transaction-to-self bug in the future.

Cc: stable@vger.kernel.org
Fixes: 457b9a6f09f0 ("Staging: android: add binder driver")
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Martijn Coenen <maco@android.com>
Link: https://lore.kernel.org/r/20200727120424.1627555-1-jannh@google.com
[manual backport: remove fine-grained locking and error reporting that
                  don't exist in <=4.9]
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/android/binder.c | 46 +++++++++++++++++++++++-----------------
 1 file changed, 26 insertions(+), 20 deletions(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index d1be59215a7d..ac4514c92063 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3028,7 +3028,10 @@ static void binder_transaction(struct binder_proc *proc,
 			return_error_line = __LINE__;
 			goto err_dead_binder;
 		}
-		e->to_node = target_node->debug_id;
+		if (WARN_ON(proc == target_proc)) {
+			return_error = BR_FAILED_REPLY;
+			goto err_invalid_target_handle;
+		}
 		if (security_binder_transaction(proc->tsk,
 						target_proc->tsk) < 0) {
 			return_error = BR_FAILED_REPLY;
@@ -3554,25 +3557,28 @@ static int binder_thread_write(struct binder_proc *proc,
 				return -EFAULT;
 
 			ptr += sizeof(uint32_t);
-			ret = -1;
-			if (increment && !target) {
-				struct binder_node *ctx_mgr_node;
-				mutex_lock(&context->context_mgr_node_lock);
-				ctx_mgr_node = context->binder_context_mgr_node;
-				if (ctx_mgr_node)
-					ret = binder_inc_ref_for_node(
-							proc, ctx_mgr_node,
-							strong, NULL, &rdata);
-				mutex_unlock(&context->context_mgr_node_lock);
-			}
-			if (ret)
-				ret = binder_update_ref_for_handle(
-						proc, target, increment, strong,
-						&rdata);
-			if (!ret && rdata.desc != target) {
-				binder_user_error("%d:%d tried to acquire reference to desc %d, got %d instead\n",
-					proc->pid, thread->pid,
-					target, rdata.desc);
+			if (target == 0 && binder_context_mgr_node &&
+			    (cmd == BC_INCREFS || cmd == BC_ACQUIRE)) {
+				if (binder_context_mgr_node->proc == proc) {
+					binder_user_error("%d:%d context manager tried to acquire desc 0\n",
+							  proc->pid, thread->pid);
+					return -EINVAL;
+				}
+				ref = binder_get_ref_for_node(proc,
+					       binder_context_mgr_node);
+				if (ref->desc != target) {
+					binder_user_error("%d:%d tried to acquire reference to desc 0, got %d instead\n",
+						proc->pid, thread->pid,
+						ref->desc);
+				}
+			} else
+				ref = binder_get_ref(proc, target,
+						     cmd == BC_ACQUIRE ||
+						     cmd == BC_RELEASE);
+			if (ref == NULL) {
+				binder_user_error("%d:%d refcount change on invalid ref %d\n",
+					proc->pid, thread->pid, target);
+				break;
 			}
 			switch (cmd) {
 			case BC_INCREFS:

From 80a670fce6bdb12964864d70ff7eed6138d641e0 Mon Sep 17 00:00:00 2001
From: Ido Schimmel <idosch@mellanox.com>
Date: Wed, 29 Jul 2020 11:37:13 +0300
Subject: [PATCH 0314/2658] ipv4: Silence suspicious RCU usage warning

[ Upstream commit 83f3522860f702748143e022f1a546547314c715 ]

fib_trie_unmerge() is called with RTNL held, but not from an RCU
read-side critical section. This leads to the following warning [1] when
the FIB alias list in a leaf is traversed with
hlist_for_each_entry_rcu().

Since the function is always called with RTNL held and since
modification of the list is protected by RTNL, simply use
hlist_for_each_entry() and silence the warning.

[1]
WARNING: suspicious RCU usage
5.8.0-rc4-custom-01520-gc1f937f3f83b #30 Not tainted
-----------------------------
net/ipv4/fib_trie.c:1867 RCU-list traversed in non-reader section!!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
1 lock held by ip/164:
 #0: ffffffff85a27850 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x49a/0xbd0

stack backtrace:
CPU: 0 PID: 164 Comm: ip Not tainted 5.8.0-rc4-custom-01520-gc1f937f3f83b #30
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-2.fc32 04/01/2014
Call Trace:
 dump_stack+0x100/0x184
 lockdep_rcu_suspicious+0x153/0x15d
 fib_trie_unmerge+0x608/0xdb0
 fib_unmerge+0x44/0x360
 fib4_rule_configure+0xc8/0xad0
 fib_nl_newrule+0x37a/0x1dd0
 rtnetlink_rcv_msg+0x4f7/0xbd0
 netlink_rcv_skb+0x17a/0x480
 rtnetlink_rcv+0x22/0x30
 netlink_unicast+0x5ae/0x890
 netlink_sendmsg+0x98a/0xf40
 ____sys_sendmsg+0x879/0xa00
 ___sys_sendmsg+0x122/0x190
 __sys_sendmsg+0x103/0x1d0
 __x64_sys_sendmsg+0x7d/0xb0
 do_syscall_64+0x54/0xa0
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fc80a234e97
Code: Bad RIP value.
RSP: 002b:00007ffef8b66798 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc80a234e97
RDX: 0000000000000000 RSI: 00007ffef8b66800 RDI: 0000000000000003
RBP: 000000005f141b1c R08: 0000000000000001 R09: 0000000000000000
R10: 00007fc80a2a8ac0 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000000 R14: 00007ffef8b67008 R15: 0000556fccb10020

Fixes: 0ddcf43d5d4a ("ipv4: FIB Local/MAIN table collapse")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/fib_trie.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 484577c019ae..e3fdd7ac20bf 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1696,7 +1696,7 @@ struct fib_table *fib_trie_unmerge(struct fib_table *oldtb)
 	while ((l = leaf_walk_rcu(&tp, key)) != NULL) {
 		struct key_vector *local_l = NULL, *local_tp = NULL;
 
-		hlist_for_each_entry_rcu(fa, &l->leaf, fa_list) {
+		hlist_for_each_entry(fa, &l->leaf, fa_list) {
 			struct fib_alias *new_fa;
 
 			if (local_tb->tb_id != fa->tb_id)

From 3d498173d54672e0bf4c66a4a6de30965e522f9b Mon Sep 17 00:00:00 2001
From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Sat, 25 Jul 2020 15:40:53 -0700
Subject: [PATCH 0315/2658] ipv6: fix memory leaks on IPV6_ADDRFORM path

[ Upstream commit 8c0de6e96c9794cb523a516c465991a70245da1c ]

IPV6_ADDRFORM causes resource leaks when converting an IPv6 socket
to IPv4, particularly struct ipv6_ac_socklist. Similar to
struct ipv6_mc_socklist, we should just close it on this path.

This bug can be easily reproduced with the following C program:

  #include <stdio.h>
  #include <string.h>
  #include <sys/types.h>
  #include <sys/socket.h>
  #include <arpa/inet.h>

  int main()
  {
    int s, value;
    struct sockaddr_in6 addr;
    struct ipv6_mreq m6;

    s = socket(AF_INET6, SOCK_DGRAM, 0);
    addr.sin6_family = AF_INET6;
    addr.sin6_port = htons(5000);
    inet_pton(AF_INET6, "::ffff:192.168.122.194", &addr.sin6_addr);
    connect(s, (struct sockaddr *)&addr, sizeof(addr));

    inet_pton(AF_INET6, "fe80::AAAA", &m6.ipv6mr_multiaddr);
    m6.ipv6mr_interface = 5;
    setsockopt(s, SOL_IPV6, IPV6_JOIN_ANYCAST, &m6, sizeof(m6));

    value = AF_INET;
    setsockopt(s, SOL_IPV6, IPV6_ADDRFORM, &value, sizeof(value));

    close(s);
    return 0;
  }

Reported-by: ch3332xr@gmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/addrconf.h   |  1 +
 net/ipv6/anycast.c       | 17 ++++++++++++-----
 net/ipv6/ipv6_sockglue.c |  1 +
 3 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index c796f93aaa70..69d9ce65d2b5 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -240,6 +240,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex,
 		      const struct in6_addr *addr);
 int ipv6_sock_ac_drop(struct sock *sk, int ifindex,
 		      const struct in6_addr *addr);
+void __ipv6_sock_ac_close(struct sock *sk);
 void ipv6_sock_ac_close(struct sock *sk);
 
 int __ipv6_dev_ac_inc(struct inet6_dev *idev, const struct in6_addr *addr);
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 514ac259f543..b831e9b2e906 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -170,7 +170,7 @@ int ipv6_sock_ac_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
 	return 0;
 }
 
-void ipv6_sock_ac_close(struct sock *sk)
+void __ipv6_sock_ac_close(struct sock *sk)
 {
 	struct ipv6_pinfo *np = inet6_sk(sk);
 	struct net_device *dev = NULL;
@@ -178,10 +178,7 @@ void ipv6_sock_ac_close(struct sock *sk)
 	struct net *net = sock_net(sk);
 	int	prev_index;
 
-	if (!np->ipv6_ac_list)
-		return;
-
-	rtnl_lock();
+	ASSERT_RTNL();
 	pac = np->ipv6_ac_list;
 	np->ipv6_ac_list = NULL;
 
@@ -198,6 +195,16 @@ void ipv6_sock_ac_close(struct sock *sk)
 		sock_kfree_s(sk, pac, sizeof(*pac));
 		pac = next;
 	}
+}
+
+void ipv6_sock_ac_close(struct sock *sk)
+{
+	struct ipv6_pinfo *np = inet6_sk(sk);
+
+	if (!np->ipv6_ac_list)
+		return;
+	rtnl_lock();
+	__ipv6_sock_ac_close(sk);
 	rtnl_unlock();
 }
 
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 416b3660f818..4a75013a2ede 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -207,6 +207,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
 
 			fl6_free_socklist(sk);
 			__ipv6_sock_mc_close(sk);
+			__ipv6_sock_ac_close(sk);
 
 			/*
 			 * Sock is moving from IPv6 to IPv4 (sk_prot), so

From 31e7f3b51f9d46495960e7b3e613d241f923a82d Mon Sep 17 00:00:00 2001
From: Hangbin Liu <liuhangbin@gmail.com>
Date: Wed, 5 Aug 2020 10:41:31 +0800
Subject: [PATCH 0316/2658] Revert "vxlan: fix tos value before xmit"

[ Upstream commit a0dced17ad9dc08b1b25e0065b54c97a318e6e8b ]

This reverts commit 71130f29979c7c7956b040673e6b9d5643003176.

In commit 71130f29979c ("vxlan: fix tos value before xmit") we want to
make sure the tos value are filtered by RT_TOS() based on RFC1349.

       0     1     2     3     4     5     6     7
    +-----+-----+-----+-----+-----+-----+-----+-----+
    |   PRECEDENCE    |          TOS          | MBZ |
    +-----+-----+-----+-----+-----+-----+-----+-----+

But RFC1349 has been obsoleted by RFC2474. The new DSCP field defined like

       0     1     2     3     4     5     6     7
    +-----+-----+-----+-----+-----+-----+-----+-----+
    |          DS FIELD, DSCP           | ECN FIELD |
    +-----+-----+-----+-----+-----+-----+-----+-----+

So with

IPTOS_TOS_MASK          0x1E
RT_TOS(tos)		((tos)&IPTOS_TOS_MASK)

the first 3 bits DSCP info will get lost.

To take all the DSCP info in xmit, we should revert the patch and just push
all tos bits to ip_tunnel_ecn_encap(), which will handling ECN field later.

Fixes: 71130f29979c ("vxlan: fix tos value before xmit")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/vxlan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 8e55bab6629a..431d4ad6d28e 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2072,7 +2072,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 			return;
 		}
 
-		tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb);
+		tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
 		ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
 		err = vxlan_xmit_skb(rt, sk, skb, fl4.saddr,
 				     dst->sin.sin_addr.s_addr, tos, ttl, df,

From 1e1b1d6841f9b3f396c92d2fd71e734aa7cf3030 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Tue, 28 Jul 2020 14:10:31 +0200
Subject: [PATCH 0317/2658] net: lan78xx: replace bogus endpoint lookup

[ Upstream commit ea060b352654a8de1e070140d25fe1b7e4d50310 ]

Drop the bogus endpoint-lookup helper which could end up accepting
interfaces based on endpoints belonging to unrelated altsettings.

Note that the returned bulk pipes and interrupt endpoint descriptor
were never actually used. Instead the bulk-endpoint numbers are
hardcoded to 1 and 2 (matching the specification), while the interrupt-
endpoint descriptor was assumed to be the third descriptor created by
USB core.

Try to bring some order to this by dropping the bogus lookup helper and
adding the missing endpoint sanity checks while keeping the interrupt-
descriptor assumption for now.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/lan78xx.c | 116 ++++++++++----------------------------
 1 file changed, 30 insertions(+), 86 deletions(-)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 1fb5d5f3475c..1439863e9061 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -251,10 +251,6 @@ struct lan78xx_net {
 	struct tasklet_struct	bh;
 	struct delayed_work	wq;
 
-	struct usb_host_endpoint *ep_blkin;
-	struct usb_host_endpoint *ep_blkout;
-	struct usb_host_endpoint *ep_intr;
-
 	int			msg_enable;
 
 	struct urb		*urb_intr;
@@ -2180,77 +2176,12 @@ netdev_tx_t lan78xx_start_xmit(struct sk_buff *skb, struct net_device *net)
 	return NETDEV_TX_OK;
 }
 
-int lan78xx_get_endpoints(struct lan78xx_net *dev, struct usb_interface *intf)
-{
-	int tmp;
-	struct usb_host_interface *alt = NULL;
-	struct usb_host_endpoint *in = NULL, *out = NULL;
-	struct usb_host_endpoint *status = NULL;
-
-	for (tmp = 0; tmp < intf->num_altsetting; tmp++) {
-		unsigned ep;
-
-		in = NULL;
-		out = NULL;
-		status = NULL;
-		alt = intf->altsetting + tmp;
-
-		for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) {
-			struct usb_host_endpoint *e;
-			int intr = 0;
-
-			e = alt->endpoint + ep;
-			switch (e->desc.bmAttributes) {
-			case USB_ENDPOINT_XFER_INT:
-				if (!usb_endpoint_dir_in(&e->desc))
-					continue;
-				intr = 1;
-				/* FALLTHROUGH */
-			case USB_ENDPOINT_XFER_BULK:
-				break;
-			default:
-				continue;
-			}
-			if (usb_endpoint_dir_in(&e->desc)) {
-				if (!intr && !in)
-					in = e;
-				else if (intr && !status)
-					status = e;
-			} else {
-				if (!out)
-					out = e;
-			}
-		}
-		if (in && out)
-			break;
-	}
-	if (!alt || !in || !out)
-		return -EINVAL;
-
-	dev->pipe_in = usb_rcvbulkpipe(dev->udev,
-				       in->desc.bEndpointAddress &
-				       USB_ENDPOINT_NUMBER_MASK);
-	dev->pipe_out = usb_sndbulkpipe(dev->udev,
-					out->desc.bEndpointAddress &
-					USB_ENDPOINT_NUMBER_MASK);
-	dev->ep_intr = status;
-
-	return 0;
-}
-
 static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf)
 {
 	struct lan78xx_priv *pdata = NULL;
 	int ret;
 	int i;
 
-	ret = lan78xx_get_endpoints(dev, intf);
-	if (ret) {
-		netdev_warn(dev->net, "lan78xx_get_endpoints failed: %d\n",
-			    ret);
-		return ret;
-	}
-
 	dev->data[0] = (unsigned long)kzalloc(sizeof(*pdata), GFP_KERNEL);
 
 	pdata = (struct lan78xx_priv *)(dev->data[0]);
@@ -2926,6 +2857,7 @@ static const struct net_device_ops lan78xx_netdev_ops = {
 static int lan78xx_probe(struct usb_interface *intf,
 			 const struct usb_device_id *id)
 {
+	struct usb_host_endpoint *ep_blkin, *ep_blkout, *ep_intr;
 	struct lan78xx_net *dev;
 	struct net_device *netdev;
 	struct usb_device *udev;
@@ -2969,32 +2901,44 @@ static int lan78xx_probe(struct usb_interface *intf,
 	netdev->watchdog_timeo = TX_TIMEOUT_JIFFIES;
 	netdev->ethtool_ops = &lan78xx_ethtool_ops;
 
-	ret = lan78xx_bind(dev, intf);
-	if (ret < 0)
-		goto out2;
-	strcpy(netdev->name, "eth%d");
-
-	if (netdev->mtu > (dev->hard_mtu - netdev->hard_header_len))
-		netdev->mtu = dev->hard_mtu - netdev->hard_header_len;
-	netif_set_gso_max_size(netdev, MAX_SINGLE_PACKET_SIZE - MAX_HEADER);
-
 	if (intf->cur_altsetting->desc.bNumEndpoints < 3) {
 		ret = -ENODEV;
-		goto out3;
+		goto out2;
 	}
 
-	dev->ep_blkin = (intf->cur_altsetting)->endpoint + 0;
-	dev->ep_blkout = (intf->cur_altsetting)->endpoint + 1;
-	dev->ep_intr = (intf->cur_altsetting)->endpoint + 2;
-
 	dev->pipe_in = usb_rcvbulkpipe(udev, BULK_IN_PIPE);
+	ep_blkin = usb_pipe_endpoint(udev, dev->pipe_in);
+	if (!ep_blkin || !usb_endpoint_is_bulk_in(&ep_blkin->desc)) {
+		ret = -ENODEV;
+		goto out2;
+	}
+
 	dev->pipe_out = usb_sndbulkpipe(udev, BULK_OUT_PIPE);
+	ep_blkout = usb_pipe_endpoint(udev, dev->pipe_out);
+	if (!ep_blkout || !usb_endpoint_is_bulk_out(&ep_blkout->desc)) {
+		ret = -ENODEV;
+		goto out2;
+	}
+
+	ep_intr = &intf->cur_altsetting->endpoint[2];
+	if (!usb_endpoint_is_int_in(&ep_intr->desc)) {
+		ret = -ENODEV;
+		goto out2;
+	}
 
 	dev->pipe_intr = usb_rcvintpipe(dev->udev,
-					dev->ep_intr->desc.bEndpointAddress &
-					USB_ENDPOINT_NUMBER_MASK);
-	period = dev->ep_intr->desc.bInterval;
+					usb_endpoint_num(&ep_intr->desc));
+
+	ret = lan78xx_bind(dev, intf);
+	if (ret < 0)
+		goto out2;
+	strcpy(netdev->name, "eth%d");
+
+	if (netdev->mtu > (dev->hard_mtu - netdev->hard_header_len))
+		netdev->mtu = dev->hard_mtu - netdev->hard_header_len;
+	netif_set_gso_max_size(netdev, MAX_SINGLE_PACKET_SIZE - MAX_HEADER);
 
+	period = ep_intr->desc.bInterval;
 	maxp = usb_maxpacket(dev->udev, dev->pipe_intr, 0);
 	buf = kmalloc(maxp, GFP_KERNEL);
 	if (buf) {

From 950fc5b5304745dde3da98b2ba18fada42c782a1 Mon Sep 17 00:00:00 2001
From: Rustam Kovhaev <rkovhaev@gmail.com>
Date: Mon, 27 Jul 2020 23:42:17 -0700
Subject: [PATCH 0318/2658] usb: hso: check for return value in
 hso_serial_common_create()

[ Upstream commit e911e99a0770f760377c263bc7bac1b1593c6147 ]

in case of an error tty_register_device_attr() returns ERR_PTR(),
add IS_ERR() check

Reported-and-tested-by: syzbot+67b2bd0e34f952d0321e@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=67b2bd0e34f952d0321e
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/hso.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index cbbff16d438f..efd4bf06f6ad 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2280,12 +2280,14 @@ static int hso_serial_common_create(struct hso_serial *serial, int num_urbs,
 
 	minor = get_free_serial_index();
 	if (minor < 0)
-		goto exit;
+		goto exit2;
 
 	/* register our minor number */
 	serial->parent->dev = tty_port_register_device_attr(&serial->port,
 			tty_drv, minor, &serial->parent->interface->dev,
 			serial->parent, hso_serial_dev_groups);
+	if (IS_ERR(serial->parent->dev))
+		goto exit2;
 	dev = serial->parent->dev;
 
 	/* fill in specific data for later use */
@@ -2335,6 +2337,7 @@ static int hso_serial_common_create(struct hso_serial *serial, int num_urbs,
 	return 0;
 exit:
 	hso_serial_tty_unregister(serial);
+exit2:
 	hso_serial_common_free(serial);
 	return -1;
 }

From e5dab28280e4bad42ad36ea65d76164d006c7ffa Mon Sep 17 00:00:00 2001
From: Ido Schimmel <idosch@mellanox.com>
Date: Wed, 29 Jul 2020 11:34:36 +0300
Subject: [PATCH 0319/2658] vxlan: Ensure FDB dump is performed under RCU

[ Upstream commit b5141915b5aec3b29a63db869229e3741ebce258 ]

The commit cited below removed the RCU read-side critical section from
rtnl_fdb_dump() which means that the ndo_fdb_dump() callback is invoked
without RCU protection.

This results in the following warning [1] in the VXLAN driver, which
relied on the callback being invoked from an RCU read-side critical
section.

Fix this by calling rcu_read_lock() in the VXLAN driver, as already done
in the bridge driver.

[1]
WARNING: suspicious RCU usage
5.8.0-rc4-custom-01521-g481007553ce6 #29 Not tainted
-----------------------------
drivers/net/vxlan.c:1379 RCU-list traversed in non-reader section!!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
1 lock held by bridge/166:
 #0: ffffffff85a27850 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0xea/0x1090

stack backtrace:
CPU: 1 PID: 166 Comm: bridge Not tainted 5.8.0-rc4-custom-01521-g481007553ce6 #29
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-2.fc32 04/01/2014
Call Trace:
 dump_stack+0x100/0x184
 lockdep_rcu_suspicious+0x153/0x15d
 vxlan_fdb_dump+0x51e/0x6d0
 rtnl_fdb_dump+0x4dc/0xad0
 netlink_dump+0x540/0x1090
 __netlink_dump_start+0x695/0x950
 rtnetlink_rcv_msg+0x802/0xbd0
 netlink_rcv_skb+0x17a/0x480
 rtnetlink_rcv+0x22/0x30
 netlink_unicast+0x5ae/0x890
 netlink_sendmsg+0x98a/0xf40
 __sys_sendto+0x279/0x3b0
 __x64_sys_sendto+0xe6/0x1a0
 do_syscall_64+0x54/0xa0
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fe14fa2ade0
Code: Bad RIP value.
RSP: 002b:00007fff75bb5b88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00005614b1ba0020 RCX: 00007fe14fa2ade0
RDX: 000000000000011c RSI: 00007fff75bb5b90 RDI: 0000000000000003
RBP: 00007fff75bb5b90 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00005614b1b89160
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

Fixes: 5e6d24358799 ("bridge: netlink dump interface at par with brctl")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/vxlan.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 431d4ad6d28e..84c4ce77c8f0 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -921,6 +921,7 @@ static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
 		struct vxlan_fdb *f;
 		int err;
 
+		rcu_read_lock();
 		hlist_for_each_entry_rcu(f, &vxlan->fdb_head[h], hlist) {
 			struct vxlan_rdst *rd;
 
@@ -933,12 +934,15 @@ static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
 						     cb->nlh->nlmsg_seq,
 						     RTM_NEWNEIGH,
 						     NLM_F_MULTI, rd);
-				if (err < 0)
+				if (err < 0) {
+					rcu_read_unlock();
 					goto out;
+				}
 skip:
 				++idx;
 			}
 		}
+		rcu_read_unlock();
 	}
 out:
 	return idx;

From 7597d4244b0835c29ee5f551b0402c1388222f04 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Wed, 8 Jul 2020 13:15:20 -0700
Subject: [PATCH 0320/2658] Smack: fix use-after-free in
 smk_write_relabel_self()

commit beb4ee6770a89646659e6a2178538d2b13e2654e upstream.

smk_write_relabel_self() frees memory from the task's credentials with
no locking, which can easily cause a use-after-free because multiple
tasks can share the same credentials structure.

Fix this by using prepare_creds() and commit_creds() to correctly modify
the task's credentials.

Reproducer for "BUG: KASAN: use-after-free in smk_write_relabel_self":

	#include <fcntl.h>
	#include <pthread.h>
	#include <unistd.h>

	static void *thrproc(void *arg)
	{
		int fd = open("/sys/fs/smackfs/relabel-self", O_WRONLY);
		for (;;) write(fd, "foo", 3);
	}

	int main()
	{
		pthread_t t;
		pthread_create(&t, NULL, thrproc, NULL);
		thrproc(NULL);
	}

Reported-by: syzbot+e6416dabb497a650da40@syzkaller.appspotmail.com
Fixes: 38416e53936e ("Smack: limited capability for changing process label")
Cc: <stable@vger.kernel.org> # v4.4+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 security/smack/smackfs.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index d186d24ac649..bd4d0f5a79aa 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -2791,7 +2791,6 @@ static int smk_open_relabel_self(struct inode *inode, struct file *file)
 static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf,
 				size_t count, loff_t *ppos)
 {
-	struct task_smack *tsp = current_security();
 	char *data;
 	int rc;
 	LIST_HEAD(list_tmp);
@@ -2821,11 +2820,21 @@ static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf,
 	kfree(data);
 
 	if (!rc || (rc == -EINVAL && list_empty(&list_tmp))) {
+		struct cred *new;
+		struct task_smack *tsp;
+
+		new = prepare_creds();
+		if (!new) {
+			rc = -ENOMEM;
+			goto out;
+		}
+		tsp = new->security;
 		smk_destroy_label_list(&tsp->smk_relabel);
 		list_splice(&list_tmp, &tsp->smk_relabel);
+		commit_creds(new);
 		return count;
 	}
-
+out:
 	smk_destroy_label_list(&list_tmp);
 	return rc;
 }

From 92078cba9383964faf81d087c4a01596a0aaf95e Mon Sep 17 00:00:00 2001
From: Nick Desaulniers <ndesaulniers@google.com>
Date: Thu, 30 Jul 2020 15:45:54 -0700
Subject: [PATCH 0321/2658] tracepoint: Mark __tracepoint_string's __used

commit f3751ad0116fb6881f2c3c957d66a9327f69cefb upstream.

__tracepoint_string's have their string data stored in .rodata, and an
address to that data stored in the "__tracepoint_str" section. Functions
that refer to those strings refer to the symbol of the address. Compiler
optimization can replace those address references with references
directly to the string data. If the address doesn't appear to have other
uses, then it appears dead to the compiler and is removed. This can
break the /tracing/printk_formats sysfs node which iterates the
addresses stored in the "__tracepoint_str" section.

Like other strings stored in custom sections in this header, mark these
__used to inform the compiler that there are other non-obvious users of
the address, so they should still be emitted.

Link: https://lkml.kernel.org/r/20200730224555.2142154-2-ndesaulniers@google.com

Cc: Ingo Molnar <mingo@redhat.com>
Cc: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Cc: stable@vger.kernel.org
Fixes: 102c9323c35a8 ("tracing: Add __tracepoint_string() to export string pointers")
Reported-by: Tim Murray <timmurray@google.com>
Reported-by: Simon MacMullen <simonmacm@google.com>
Suggested-by: Greg Hackmann <ghackmann@google.com>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/tracepoint.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index 27e32b2b602f..d7875d312f1f 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -328,7 +328,7 @@ extern void syscall_unregfunc(void);
 		static const char *___tp_str __tracepoint_string = str; \
 		___tp_str;						\
 	})
-#define __tracepoint_string	__attribute__((section("__tracepoint_str")))
+#define __tracepoint_string	__attribute__((section("__tracepoint_str"), used))
 #else
 /*
  * tracepoint_string() is used to save the string address for userspace

From 22602cb1ce25c1315dc56c0924be171684d19588 Mon Sep 17 00:00:00 2001
From: Dexuan Cui <decui@microsoft.com>
Date: Mon, 27 Jul 2020 18:55:05 -0700
Subject: [PATCH 0322/2658] udp: drop corrupt packets earlier to avoid data
 corruption

The v4.4 stable kernel lacks this bugfix:
commit 327868212381 ("make skb_copy_datagram_msg() et.al. preserve ->msg_iter on error").
As a result, the v4.4 kernel can deliver corrupt data to the application
when a corrupt UDP packet is closely followed by a valid UDP packet: the
same invocation of the recvmsg() syscall can deliver the corrupt packet's
UDP payload to the application with the UDP payload length and the
"from IP/Port" of the valid packet.

Details:

For a UDP packet longer than 76 bytes (see the v5.8-rc6 kernel's
include/linux/skbuff.h:3951), Linux delays the UDP checksum verification
until the application invokes the syscall recvmsg().

In the recvmsg() syscall handler, while Linux is copying the UDP payload
to the application's memory, it calculates the UDP checksum. If the
calculated checksum doesn't match the received checksum, Linux drops the
corrupt UDP packet, and then starts to process the next packet (if any),
and if the next packet is valid (i.e. the checksum is correct), Linux
will copy the valid UDP packet's payload to the application's receiver
buffer.

The bug is: before Linux starts to copy the valid UDP packet, the data
structure used to track how many more bytes should be copied to the
application memory is not reset to what it was when the application just
entered the kernel by the syscall! Consequently, only a small portion or
none of the valid packet's payload is copied to the application's
receive buffer, and later when the application exits from the kernel,
actually most of the application's receive buffer contains the payload
of the corrupt packet while recvmsg() returns the length of the UDP
payload of the valid packet.

For the mainline kernel, the bug was fixed in commit 327868212381,
but unluckily the bugfix is only backported to v4.9+. It turns out
backporting 327868212381 to v4.4 means that some supporting patches
must be backported first, so the overall changes seem too big, so the
alternative is performs the csum validation earlier and drops the
corrupt packets earlier.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Dexuan Cui <decui@microsoft.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/udp.c | 3 +--
 net/ipv6/udp.c | 6 ++----
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 938a7281fd46..3ff09be87cf2 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1595,8 +1595,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 		}
 	}
 
-	if (rcu_access_pointer(sk->sk_filter) &&
-	    udp_lib_checksum_complete(skb))
+	if (udp_lib_checksum_complete(skb))
 		goto csum_error;
 
 	if (sk_rcvqueues_full(sk, sk->sk_rcvbuf)) {
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 868abfd0011c..9e2b553b76c4 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -687,10 +687,8 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 		}
 	}
 
-	if (rcu_access_pointer(sk->sk_filter)) {
-		if (udp_lib_checksum_complete(skb))
-			goto csum_error;
-	}
+	if (udp_lib_checksum_complete(skb))
+		goto csum_error;
 
 	if (sk_rcvqueues_full(sk, sk->sk_rcvbuf)) {
 		UDP6_INC_STATS_BH(sock_net(sk),

From 89046f13fe2bfee208cff7e421732c8e3bad6dcd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
Date: Fri, 14 Aug 2020 09:47:11 +0200
Subject: [PATCH 0323/2658] gpio: fix oops resulting from calling
 of_get_named_gpio(NULL, ...)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This happens for the spi-imx driver when running a dt-enabled kernel on
a non-dt machine on Linux 4.0. Among the still supported stable versions
only 4.4 and 4.9 are affected. (However the spi-imx driver doesn't call
of_get_named_gpio() since v4.8-rc1 (commit b36581df7e78 ("spi: imx:
Using existing properties for chipselects")) any more, but the problem
might still affect other users of of_get_named_gpio().)

In 4.14-rc1 this problem is gone with
commit 7eb6ce2f2723 ("gpio: Convert to using %pOF instead of
full_name"). This commit however doesn't seem sensible to backport as it
depends on ce4fecf1fe15 ("vsprintf: Add %p extension "%pOF" for device
tree") which doesn't trivially apply to v4.4.

[    1.649453] Unable to handle kernel NULL pointer dereference at virtual address 0000000c
[    1.659270] pgd = c0004000
[    1.662036] [0000000c] *pgd=00000000
[    1.665919] Internal error: Oops - BUG: 5 [#1] PREEMPT ARM
[    1.671438] Modules linked in:
[    1.674552] CPU: 0 PID: 1 Comm: swapper Not tainted 4.0.0 #1
[    1.680235] Hardware name: Eckelmann ECU01
[    1.684361] task: c7840000 ti: c7842000 task.ti: c7842000
[    1.689821] PC is at of_get_named_gpiod_flags+0xac/0xe0
[    1.695104] LR is at of_find_property+0x38/0x7c
[    1.699674] pc : [<c025db2c>]    lr : [<c03c5f54>]    psr: a0000013
[    1.699674] sp : c7843cc8  ip : c7843c38  fp : c7843d3c
[    1.711183] r10: c7884dc0  r9 : c7a8de10  r8 : 00000000
[    1.716434] r7 : 00000000  r6 : 00000000  r5 : c065ef50  r4 : fffffffe
[    1.722986] r3 : 00000000  r2 : 00000000  r1 : c065ef50  r0 : fffffffe
[    1.729541] Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
[    1.736879] Control: 0005317f  Table: 80004000  DAC: 00000017
[    1.742652] Process swapper (pid: 1, stack limit = 0xc7842190)
[    1.748510] Stack: (0xc7843cc8 to 0xc7844000)
[    1.752906] 3cc0:                   c7843cd4 c003ccec 00000000 00000000 00000000 00000000
[    1.761125] 3ce0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    1.769345] 3d00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 fffffdfb
[    1.777566] 3d20: 00000000 c78b4e10 c7a8dc00 000001ff c7843d4c c7843d40 c025db70 c025da90
[    1.785788] 3d40: c7843dcc c7843d50 c02f8938 c025db70 c7843d74 c7843d60 c79bc3c0 c79bc320
[    1.794007] 3d60: c78bb140 c065476c c7a8de10 00000000 c78b4e10 c78b4e00 00000004 00000001
[    1.802227] 3d80: c06d25d4 00000000 c7843dbc c7843d98 c0115a68 c0112538 00000001 c78b4e10
[    1.810448] 3da0: c78b4e18 ffffffed c78b4e10 fffffdfb c070bc80 00000000 c06d25d4 00000000
[    1.818669] 3dc0: c7843dec c7843dd0 c02a0670 c02f8828 c78b4e10 c073fcb0 00000000 c070bc80
[    1.826890] 3de0: c7843e14 c7843df0 c029f064 c02a0630 00000000 c78b4e10 c070bc80 c78b4e44
[    1.835110] 3e00: 00000000 c06c8cac c7843e34 c7843e18 c029f204 c029ef70 c029f170 00000000
[    1.843332] 3e20: c070bc80 c029f170 c7843e5c c7843e38 c029d6f4 c029f180 c785c1cc c7873c30
[    1.851553] 3e40: c0235728 c070bc80 c7ab9720 c0701e20 c7843e6c c7843e60 c029eb74 c029d6a4
[    1.859774] 3e60: c7843e94 c7843e70 c029e7f4 c029eb64 c065f390 c7843e80 c070bc80 c06f0718
[    1.867998] 3e80: c7ab8d60 c06b1528 c7843eac c7843e98 c029f810 c029e728 c06f0718 c06f0718
[    1.876220] 3ea0: c7843ebc c7843eb0 c02a04dc c029f7ac c7843ecc c7843ec0 c06c8cc4 c02a049c
[    1.884443] 3ec0: c7843f4c c7843ed0 c00089dc c06c8cbc c0109ec0 c0109d18 c780ac00 00000001
[    1.892665] 3ee0: c7843f00 c7843ef0 c06b1544 c0238a24 c7ffca48 c054c854 c7843f4c c7843f08
[    1.900886] 3f00: c002e7f4 c06b1538 c003d0e0 00000006 00000006 c06af1a4 00000000 c066ccb4
[    1.909107] 3f20: c7843f4c c06ea994 00000006 c071ff20 c06b1528 c06d25e0 c06d25d4 0000008f
[    1.917327] 3f40: c7843f94 c7843f50 c06b1e6c c0008964 00000006 00000006 c06b1528 dfe48a08
[    1.925547] 3f60: 33f73660 3fd760c5 0b5d4bfd 00000000 c0527ef0 00000000 00000000 00000000
[    1.933768] 3f80: 00000000 00000000 c7843fac c7843f98 c0527f00 c06b1d00 c7842000 00000000
[    1.941988] 3fa0: 00000000 c7843fb0 c0009798 c0527f00 00000000 00000000 00000000 00000000
[    1.950206] 3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    1.958424] 3fe0: 00000000 00000000 00000000 00000000 00000013 00000000 b3cf731f fe6afeef
[    1.966617] Backtrace:
[    1.969150] [<c025da80>] (of_get_named_gpiod_flags) from [<c025db70>] (of_get_named_gpio_flags+0x10/0x24)
[    1.978744]  r7:000001ff r6:c7a8dc00 r5:c78b4e10 r4:00000000
[    1.984548] [<c025db60>] (of_get_named_gpio_flags) from [<c02f8938>] (spi_imx_probe+0x120/0x67c)
[    1.993390] [<c02f8818>] (spi_imx_probe) from [<c02a0670>] (platform_drv_probe+0x50/0xac)
[    2.001589]  r10:00000000 r9:c06d25d4 r8:00000000 r7:c070bc80 r6:fffffdfb r5:c78b4e10
[    2.009549]  r4:ffffffed
[    2.012144] [<c02a0620>] (platform_drv_probe) from [<c029f064>] (driver_probe_device+0x104/0x210)
[    2.021040]  r7:c070bc80 r6:00000000 r5:c073fcb0 r4:c78b4e10
[    2.026822] [<c029ef60>] (driver_probe_device) from [<c029f204>] (__driver_attach+0x94/0x98)
[    2.035282]  r8:c06c8cac r7:00000000 r6:c78b4e44 r5:c070bc80 r4:c78b4e10 r3:00000000
[    2.043191] [<c029f170>] (__driver_attach) from [<c029d6f4>] (bus_for_each_dev+0x60/0x90)
[    2.051394]  r6:c029f170 r5:c070bc80 r4:00000000 r3:c029f170
[    2.057185] [<c029d694>] (bus_for_each_dev) from [<c029eb74>] (driver_attach+0x20/0x28)
[    2.065212]  r6:c0701e20 r5:c7ab9720 r4:c070bc80
[    2.069931] [<c029eb54>] (driver_attach) from [<c029e7f4>] (bus_add_driver+0xdc/0x1dc)
[    2.077894] [<c029e718>] (bus_add_driver) from [<c029f810>] (driver_register+0x74/0xec)
[    2.085919]  r7:c06b1528 r6:c7ab8d60 r5:c06f0718 r4:c070bc80
[    2.091705] [<c029f79c>] (driver_register) from [<c02a04dc>] (__platform_driver_register+0x50/0x64)
[    2.100774]  r5:c06f0718 r4:c06f0718
[    2.104437] [<c02a048c>] (__platform_driver_register) from [<c06c8cc4>] (spi_imx_driver_init+0x18/0x20)
[    2.113884] [<c06c8cac>] (spi_imx_driver_init) from [<c00089dc>] (do_one_initcall+0x88/0x1b0)
[    2.122459] [<c0008954>] (do_one_initcall) from [<c06b1e6c>] (kernel_init_freeable+0x17c/0x248)
[    2.131182]  r10:0000008f r9:c06d25d4 r8:c06d25e0 r7:c06b1528 r6:c071ff20 r5:00000006
[    2.139141]  r4:c06ea994
[    2.141751] [<c06b1cf0>] (kernel_init_freeable) from [<c0527f00>] (kernel_init+0x10/0xec)
[    2.149955]  r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:c0527ef0
[    2.157909]  r4:00000000
[    2.160508] [<c0527ef0>] (kernel_init) from [<c0009798>] (ret_from_fork+0x14/0x3c)
[    2.168099]  r4:00000000 r3:c7842000
[    2.171755] Code: eb0b2dc2 e51b0020 e24bd01c e89da8f0 (e597300c)

Cc: stable@vger.kernel.org # v4.4.x, v4.9.x
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpiolib-of.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index 5fe34a9df3e6..179ad7c35ae3 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -91,7 +91,7 @@ struct gpio_desc *of_get_named_gpiod_flags(struct device_node *np,
 					 &gg_data.gpiospec);
 	if (ret) {
 		pr_debug("%s: can't parse '%s' property of node '%s[%d]'\n",
-			__func__, propname, np->full_name, index);
+			__func__, propname, np ? np->full_name : NULL, index);
 		return ERR_PTR(ret);
 	}
 

From dd5226b12d2009497780a485b87db74f6bc11e6b Mon Sep 17 00:00:00 2001
From: Qiushi Wu <wu000273@umn.edu>
Date: Thu, 28 May 2020 15:22:37 -0500
Subject: [PATCH 0324/2658] EDAC: Fix reference count leaks

[ Upstream commit 17ed808ad243192fb923e4e653c1338d3ba06207 ]

When kobject_init_and_add() returns an error, it should be handled
because kobject_init_and_add() takes a reference even when it fails. If
this function returns an error, kobject_put() must be called to properly
clean up the memory associated with the object.

Therefore, replace calling kfree() and call kobject_put() and add a
missing kobject_put() in the edac_device_register_sysfs_main_kobj()
error path.

 [ bp: Massage and merge into a single patch. ]

Fixes: b2ed215a3338 ("Kobject: change drivers/edac to use kobject_init_and_add")
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20200528202238.18078-1-wu000273@umn.edu
Link: https://lkml.kernel.org/r/20200528203526.20908-1-wu000273@umn.edu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/edac/edac_device_sysfs.c | 1 +
 drivers/edac/edac_pci_sysfs.c    | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c
index b8590a02b73d..de29c1064b74 100644
--- a/drivers/edac/edac_device_sysfs.c
+++ b/drivers/edac/edac_device_sysfs.c
@@ -306,6 +306,7 @@ int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev)
 
 	/* Error exit stack */
 err_kobj_reg:
+	kobject_put(&edac_dev->kobj);
 	module_put(edac_dev->owner);
 
 err_mod_get:
diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
index 24d877f6e577..c56128402bc6 100644
--- a/drivers/edac/edac_pci_sysfs.c
+++ b/drivers/edac/edac_pci_sysfs.c
@@ -394,7 +394,7 @@ static int edac_pci_main_kobj_setup(void)
 
 	/* Error unwind statck */
 kobject_init_and_add_fail:
-	kfree(edac_pci_top_main_kobj);
+	kobject_put(edac_pci_top_main_kobj);
 
 kzalloc_fail:
 	module_put(THIS_MODULE);

From 6ed5a6c06c803bb17fc2fc73d7a3694be9a2165d Mon Sep 17 00:00:00 2001
From: Finn Thain <fthain@telegraphics.com.au>
Date: Sun, 31 May 2020 09:12:13 +1000
Subject: [PATCH 0325/2658] m68k: mac: Don't send IOP message until channel is
 idle

[ Upstream commit aeb445bf2194d83e12e85bf5c65baaf1f093bd8f ]

In the following sequence of calls, iop_do_send() gets called when the
"send" channel is not in the IOP_MSG_IDLE state:

	iop_ism_irq()
		iop_handle_send()
			(msg->handler)()
				iop_send_message()
			iop_do_send()

Avoid this by testing the channel state before calling iop_do_send().

When sending, and iop_send_queue is empty, call iop_do_send() because
the channel is idle. If iop_send_queue is not empty, iop_do_send() will
get called later by iop_handle_send().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Tested-by: Stan Johnson <userm57@yahoo.com>
Cc: Joshua Thompson <funaho@jurai.org>
Link: https://lore.kernel.org/r/6d667c39e53865661fa5a48f16829d18ed8abe54.1590880333.git.fthain@telegraphics.com.au
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/m68k/mac/iop.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/arch/m68k/mac/iop.c b/arch/m68k/mac/iop.c
index 4d2adfb32a2a..c89ed66908f9 100644
--- a/arch/m68k/mac/iop.c
+++ b/arch/m68k/mac/iop.c
@@ -416,7 +416,8 @@ static void iop_handle_send(uint iop_num, uint chan)
 	iop_free_msg(msg2);
 
 	iop_send_queue[iop_num][chan] = msg;
-	if (msg) iop_do_send(msg);
+	if (msg && iop_readb(iop, IOP_ADDR_SEND_STATE + chan) == IOP_MSG_IDLE)
+		iop_do_send(msg);
 }
 
 /*
@@ -497,16 +498,12 @@ int iop_send_message(uint iop_num, uint chan, void *privdata,
 
 	if (!(q = iop_send_queue[iop_num][chan])) {
 		iop_send_queue[iop_num][chan] = msg;
+		iop_do_send(msg);
 	} else {
 		while (q->next) q = q->next;
 		q->next = msg;
 	}
 
-	if (iop_readb(iop_base[iop_num],
-	    IOP_ADDR_SEND_STATE + chan) == IOP_MSG_IDLE) {
-		iop_do_send(msg);
-	}
-
 	return 0;
 }
 

From 076b096c06931683d23b8a12a42c1303a3e96bc4 Mon Sep 17 00:00:00 2001
From: Finn Thain <fthain@telegraphics.com.au>
Date: Sun, 31 May 2020 09:12:13 +1000
Subject: [PATCH 0326/2658] m68k: mac: Fix IOP status/control register writes

[ Upstream commit 931fc82a6aaf4e2e4a5490addaa6a090d78c24a7 ]

When writing values to the IOP status/control register make sure those
values do not have any extraneous bits that will clear interrupt flags.

To place the SCC IOP into bypass mode would be desirable but this is not
achieved by writing IOP_DMAINACTIVE | IOP_RUN | IOP_AUTOINC | IOP_BYPASS
to the control register. Drop this ineffective register write.

Remove the flawed and unused iop_bypass() function. Make use of the
unused iop_stop() function.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Tested-by: Stan Johnson <userm57@yahoo.com>
Cc: Joshua Thompson <funaho@jurai.org>
Link: https://lore.kernel.org/r/09bcb7359a1719a18b551ee515da3c4c3cf709e6.1590880333.git.fthain@telegraphics.com.au
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/m68k/mac/iop.c | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/arch/m68k/mac/iop.c b/arch/m68k/mac/iop.c
index c89ed66908f9..358ca965cf82 100644
--- a/arch/m68k/mac/iop.c
+++ b/arch/m68k/mac/iop.c
@@ -173,7 +173,7 @@ static __inline__ void iop_writeb(volatile struct mac_iop *iop, __u16 addr, __u8
 
 static __inline__ void iop_stop(volatile struct mac_iop *iop)
 {
-	iop->status_ctrl &= ~IOP_RUN;
+	iop->status_ctrl = IOP_AUTOINC;
 }
 
 static __inline__ void iop_start(volatile struct mac_iop *iop)
@@ -181,14 +181,9 @@ static __inline__ void iop_start(volatile struct mac_iop *iop)
 	iop->status_ctrl = IOP_RUN | IOP_AUTOINC;
 }
 
-static __inline__ void iop_bypass(volatile struct mac_iop *iop)
-{
-	iop->status_ctrl |= IOP_BYPASS;
-}
-
 static __inline__ void iop_interrupt(volatile struct mac_iop *iop)
 {
-	iop->status_ctrl |= IOP_IRQ;
+	iop->status_ctrl = IOP_IRQ | IOP_RUN | IOP_AUTOINC;
 }
 
 static int iop_alive(volatile struct mac_iop *iop)
@@ -239,7 +234,6 @@ void __init iop_preinit(void)
 		} else {
 			iop_base[IOP_NUM_SCC] = (struct mac_iop *) SCC_IOP_BASE_QUADRA;
 		}
-		iop_base[IOP_NUM_SCC]->status_ctrl = 0x87;
 		iop_scc_present = 1;
 	} else {
 		iop_base[IOP_NUM_SCC] = NULL;
@@ -251,7 +245,7 @@ void __init iop_preinit(void)
 		} else {
 			iop_base[IOP_NUM_ISM] = (struct mac_iop *) ISM_IOP_BASE_QUADRA;
 		}
-		iop_base[IOP_NUM_ISM]->status_ctrl = 0;
+		iop_stop(iop_base[IOP_NUM_ISM]);
 		iop_ism_present = 1;
 	} else {
 		iop_base[IOP_NUM_ISM] = NULL;

From 8645cc8f164e94064241e65a2a6e7fdfa44fe477 Mon Sep 17 00:00:00 2001
From: yu kuai <yukuai3@huawei.com>
Date: Thu, 4 Jun 2020 20:33:01 +0800
Subject: [PATCH 0327/2658] ARM: at91: pm: add missing put_device() call in
 at91_pm_sram_init()

[ Upstream commit f87a4f022c44e5b87e842a9f3e644fba87e8385f ]

if of_find_device_by_node() succeed, at91_pm_sram_init() doesn't have
a corresponding put_device(). Thus add a jump target to fix the exception
handling for this function implementation.

Fixes: d2e467905596 ("ARM: at91: pm: use the mmio-sram pool to access SRAM")
Signed-off-by: yu kuai <yukuai3@huawei.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20200604123301.3905837-1-yukuai3@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-at91/pm.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 84eefbc2b4f9..5923f2ca510b 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -393,13 +393,13 @@ static void __init at91_pm_sram_init(void)
 	sram_pool = gen_pool_get(&pdev->dev, NULL);
 	if (!sram_pool) {
 		pr_warn("%s: sram pool unavailable!\n", __func__);
-		return;
+		goto out_put_device;
 	}
 
 	sram_base = gen_pool_alloc(sram_pool, at91_pm_suspend_in_sram_sz);
 	if (!sram_base) {
 		pr_warn("%s: unable to alloc sram!\n", __func__);
-		return;
+		goto out_put_device;
 	}
 
 	sram_pbase = gen_pool_virt_to_phys(sram_pool, sram_base);
@@ -407,12 +407,17 @@ static void __init at91_pm_sram_init(void)
 					at91_pm_suspend_in_sram_sz, false);
 	if (!at91_suspend_sram_fn) {
 		pr_warn("SRAM: Could not map\n");
-		return;
+		goto out_put_device;
 	}
 
 	/* Copy the pm suspend handler to SRAM */
 	at91_suspend_sram_fn = fncpy(at91_suspend_sram_fn,
 			&at91_pm_suspend_in_sram, at91_pm_suspend_in_sram_sz);
+	return;
+
+out_put_device:
+	put_device(&pdev->dev);
+	return;
 }
 
 static void __init at91_pm_init(void)

From 87502051b4caaae4bef87b60d40e32c6b7233096 Mon Sep 17 00:00:00 2001
From: Yu Kuai <yukuai3@huawei.com>
Date: Tue, 21 Jul 2020 21:45:51 +0800
Subject: [PATCH 0328/2658] ARM: socfpga: PM: add missing put_device() call in
 socfpga_setup_ocram_self_refresh()

[ Upstream commit 3ad7b4e8f89d6bcc9887ca701cf2745a6aedb1a0 ]

if of_find_device_by_node() succeed, socfpga_setup_ocram_self_refresh
doesn't have a corresponding put_device(). Thus add a jump target to
fix the exception handling for this function implementation.

Fixes: 44fd8c7d4005 ("ARM: socfpga: support suspend to ram")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-socfpga/pm.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/arch/arm/mach-socfpga/pm.c b/arch/arm/mach-socfpga/pm.c
index c378ab0c2431..93f2245c9775 100644
--- a/arch/arm/mach-socfpga/pm.c
+++ b/arch/arm/mach-socfpga/pm.c
@@ -60,14 +60,14 @@ static int socfpga_setup_ocram_self_refresh(void)
 	if (!ocram_pool) {
 		pr_warn("%s: ocram pool unavailable!\n", __func__);
 		ret = -ENODEV;
-		goto put_node;
+		goto put_device;
 	}
 
 	ocram_base = gen_pool_alloc(ocram_pool, socfpga_sdram_self_refresh_sz);
 	if (!ocram_base) {
 		pr_warn("%s: unable to alloc ocram!\n", __func__);
 		ret = -ENOMEM;
-		goto put_node;
+		goto put_device;
 	}
 
 	ocram_pbase = gen_pool_virt_to_phys(ocram_pool, ocram_base);
@@ -78,7 +78,7 @@ static int socfpga_setup_ocram_self_refresh(void)
 	if (!suspend_ocram_base) {
 		pr_warn("%s: __arm_ioremap_exec failed!\n", __func__);
 		ret = -ENOMEM;
-		goto put_node;
+		goto put_device;
 	}
 
 	/* Copy the code that puts DDR in self refresh to ocram */
@@ -92,6 +92,8 @@ static int socfpga_setup_ocram_self_refresh(void)
 	if (!socfpga_sdram_self_refresh_in_ocram)
 		ret = -EFAULT;
 
+put_device:
+	put_device(&pdev->dev);
 put_node:
 	of_node_put(np);
 

From a76464e156c8cc4b9153767d911be3d008357b9a Mon Sep 17 00:00:00 2001
From: Tomi Valkeinen <tomi.valkeinen@ti.com>
Date: Wed, 29 Apr 2020 13:42:32 +0300
Subject: [PATCH 0329/2658] drm/tilcdc: fix leak & null ref in
 panel_connector_get_modes

[ Upstream commit 3f9c1c872cc97875ddc8d63bc9fe6ee13652b933 ]

If videomode_from_timings() returns true, the mode allocated with
drm_mode_create will be leaked.

Also, the return value of drm_mode_create() is never checked, and thus
could cause NULL deref.

Fix these two issues.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200429104234.18910-1-tomi.valkeinen@ti.com
Reviewed-by: Jyri Sarha <jsarha@ti.com>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/tilcdc/tilcdc_panel.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/tilcdc/tilcdc_panel.c b/drivers/gpu/drm/tilcdc/tilcdc_panel.c
index 0af8bed7ce1e..08d8f608be63 100644
--- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c
+++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c
@@ -177,12 +177,16 @@ static int panel_connector_get_modes(struct drm_connector *connector)
 	int i;
 
 	for (i = 0; i < timings->num_timings; i++) {
-		struct drm_display_mode *mode = drm_mode_create(dev);
+		struct drm_display_mode *mode;
 		struct videomode vm;
 
 		if (videomode_from_timings(timings, &vm, i))
 			break;
 
+		mode = drm_mode_create(dev);
+		if (!mode)
+			break;
+
 		drm_display_mode_from_videomode(&vm, mode);
 
 		mode->type = DRM_MODE_TYPE_DRIVER;

From 0a508d0fd4c74749833d2eda402beeaeb3675792 Mon Sep 17 00:00:00 2001
From: Lihong Kou <koulihong@huawei.com>
Date: Tue, 23 Jun 2020 20:28:41 +0800
Subject: [PATCH 0330/2658] Bluetooth: add a mutex lock to avoid UAF in
 do_enale_set

[ Upstream commit f9c70bdc279b191da8d60777c627702c06e4a37d ]

In the case we set or free the global value listen_chan in
different threads, we can encounter the UAF problems because
the method is not protected by any lock, add one to avoid
this bug.

BUG: KASAN: use-after-free in l2cap_chan_close+0x48/0x990
net/bluetooth/l2cap_core.c:730
Read of size 8 at addr ffff888096950000 by task kworker/1:102/2868

CPU: 1 PID: 2868 Comm: kworker/1:102 Not tainted 5.5.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine,
BIOS Google 01/01/2011
Workqueue: events do_enable_set
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fb/0x318 lib/dump_stack.c:118
 print_address_description+0x74/0x5c0 mm/kasan/report.c:374
 __kasan_report+0x149/0x1c0 mm/kasan/report.c:506
 kasan_report+0x26/0x50 mm/kasan/common.c:641
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135
 l2cap_chan_close+0x48/0x990 net/bluetooth/l2cap_core.c:730
 do_enable_set+0x660/0x900 net/bluetooth/6lowpan.c:1074
 process_one_work+0x7f5/0x10f0 kernel/workqueue.c:2264
 worker_thread+0xbbc/0x1630 kernel/workqueue.c:2410
 kthread+0x332/0x350 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Allocated by task 2870:
 save_stack mm/kasan/common.c:72 [inline]
 set_track mm/kasan/common.c:80 [inline]
 __kasan_kmalloc+0x118/0x1c0 mm/kasan/common.c:515
 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:529
 kmem_cache_alloc_trace+0x221/0x2f0 mm/slab.c:3551
 kmalloc include/linux/slab.h:555 [inline]
 kzalloc include/linux/slab.h:669 [inline]
 l2cap_chan_create+0x50/0x320 net/bluetooth/l2cap_core.c:446
 chan_create net/bluetooth/6lowpan.c:640 [inline]
 bt_6lowpan_listen net/bluetooth/6lowpan.c:959 [inline]
 do_enable_set+0x6a4/0x900 net/bluetooth/6lowpan.c:1078
 process_one_work+0x7f5/0x10f0 kernel/workqueue.c:2264
 worker_thread+0xbbc/0x1630 kernel/workqueue.c:2410
 kthread+0x332/0x350 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Freed by task 2870:
 save_stack mm/kasan/common.c:72 [inline]
 set_track mm/kasan/common.c:80 [inline]
 kasan_set_free_info mm/kasan/common.c:337 [inline]
 __kasan_slab_free+0x12e/0x1e0 mm/kasan/common.c:476
 kasan_slab_free+0xe/0x10 mm/kasan/common.c:485
 __cache_free mm/slab.c:3426 [inline]
 kfree+0x10d/0x220 mm/slab.c:3757
 l2cap_chan_destroy net/bluetooth/l2cap_core.c:484 [inline]
 kref_put include/linux/kref.h:65 [inline]
 l2cap_chan_put+0x170/0x190 net/bluetooth/l2cap_core.c:498
 do_enable_set+0x66c/0x900 net/bluetooth/6lowpan.c:1075
 process_one_work+0x7f5/0x10f0 kernel/workqueue.c:2264
 worker_thread+0xbbc/0x1630 kernel/workqueue.c:2410
 kthread+0x332/0x350 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

The buggy address belongs to the object at ffff888096950000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 0 bytes inside of
 2048-byte region [ffff888096950000, ffff888096950800)
The buggy address belongs to the page:
page:ffffea00025a5400 refcount:1 mapcount:0 mapping:ffff8880aa400e00 index:0x0
flags: 0xfffe0000000200(slab)
raw: 00fffe0000000200 ffffea00027d1548 ffffea0002397808 ffff8880aa400e00
raw: 0000000000000000 ffff888096950000 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88809694ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88809694ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888096950000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff888096950080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888096950100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Reported-by: syzbot+96414aa0033c363d8458@syzkaller.appspotmail.com
Signed-off-by: Lihong Kou <koulihong@huawei.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/6lowpan.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 4cd6b8d811ff..11602902884b 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -57,6 +57,7 @@ static bool enable_6lowpan;
 /* We are listening incoming connections via this channel
  */
 static struct l2cap_chan *listen_chan;
+static DEFINE_MUTEX(set_lock);
 
 struct lowpan_peer {
 	struct list_head list;
@@ -1195,12 +1196,14 @@ static void do_enable_set(struct work_struct *work)
 
 	enable_6lowpan = set_enable->flag;
 
+	mutex_lock(&set_lock);
 	if (listen_chan) {
 		l2cap_chan_close(listen_chan, 0);
 		l2cap_chan_put(listen_chan);
 	}
 
 	listen_chan = bt_6lowpan_listen();
+	mutex_unlock(&set_lock);
 
 	kfree(set_enable);
 }
@@ -1252,11 +1255,13 @@ static ssize_t lowpan_control_write(struct file *fp,
 		if (ret == -EINVAL)
 			return ret;
 
+		mutex_lock(&set_lock);
 		if (listen_chan) {
 			l2cap_chan_close(listen_chan, 0);
 			l2cap_chan_put(listen_chan);
 			listen_chan = NULL;
 		}
+		mutex_unlock(&set_lock);
 
 		if (conn) {
 			struct lowpan_peer *peer;

From ec9c1a37ae528651b65e7b81a97b3ef370b1c8b0 Mon Sep 17 00:00:00 2001
From: "Paul E. McKenney" <paulmck@kernel.org>
Date: Fri, 8 May 2020 14:15:37 -0700
Subject: [PATCH 0331/2658] fs/btrfs: Add cond_resched() for
 try_release_extent_mapping() stalls

[ Upstream commit 9f47eb5461aaeb6cb8696f9d11503ae90e4d5cb0 ]

Very large I/Os can cause the following RCU CPU stall warning:

RIP: 0010:rb_prev+0x8/0x50
Code: 49 89 c0 49 89 d1 48 89 c2 48 89 f8 e9 e5 fd ff ff 4c 89 48 10 c3 4c =
89 06 c3 4c 89 40 10 c3 0f 1f 00 48 8b 0f 48 39 cf 74 38 <48> 8b 47 10 48 85 c0 74 22 48 8b 50 08 48 85 d2 74 0c 48 89 d0 48
RSP: 0018:ffffc9002212bab0 EFLAGS: 00000287 ORIG_RAX: ffffffffffffff13
RAX: ffff888821f93630 RBX: ffff888821f93630 RCX: ffff888821f937e0
RDX: 0000000000000000 RSI: 0000000000102000 RDI: ffff888821f93630
RBP: 0000000000103000 R08: 000000000006c000 R09: 0000000000000238
R10: 0000000000102fff R11: ffffc9002212bac8 R12: 0000000000000001
R13: ffffffffffffffff R14: 0000000000102000 R15: ffff888821f937e0
 __lookup_extent_mapping+0xa0/0x110
 try_release_extent_mapping+0xdc/0x220
 btrfs_releasepage+0x45/0x70
 shrink_page_list+0xa39/0xb30
 shrink_inactive_list+0x18f/0x3b0
 shrink_lruvec+0x38e/0x6b0
 shrink_node+0x14d/0x690
 do_try_to_free_pages+0xc6/0x3e0
 try_to_free_mem_cgroup_pages+0xe6/0x1e0
 reclaim_high.constprop.73+0x87/0xc0
 mem_cgroup_handle_over_high+0x66/0x150
 exit_to_usermode_loop+0x82/0xd0
 do_syscall_64+0xd4/0x100
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

On a PREEMPT=n kernel, the try_release_extent_mapping() function's
"while" loop might run for a very long time on a large I/O.  This commit
therefore adds a cond_resched() to this loop, providing RCU any needed
quiescent states.

Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/extent_io.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 42b7409d4cc5..2f9f738ecf84 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -4437,6 +4437,8 @@ int try_release_extent_mapping(struct extent_map_tree *map,
 
 			/* once for us */
 			free_extent_map(em);
+
+			cond_resched(); /* Allow large-extent preemption. */
 		}
 	}
 	return try_release_extent_state(map, tree, page, mask);

From ba7b49c6496d9833363383b9130c1448b2ded728 Mon Sep 17 00:00:00 2001
From: Aditya Pakki <pakki001@umn.edu>
Date: Sat, 13 Jun 2020 21:21:22 -0500
Subject: [PATCH 0332/2658] drm/radeon: Fix reference count leaks caused by
 pm_runtime_get_sync

[ Upstream commit 9fb10671011143d15b6b40d6d5fa9c52c57e9d63 ]

On calling pm_runtime_get_sync() the reference count of the device
is incremented. In case of failure, decrement the
reference count before returning the error.

Acked-by: Evan Quan <evan.quan@amd.com>
Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/radeon/radeon_display.c | 4 +++-
 drivers/gpu/drm/radeon/radeon_drv.c     | 4 +++-
 drivers/gpu/drm/radeon/radeon_kms.c     | 4 +++-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 4572bfba017c..17c73b8c90e7 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -660,8 +660,10 @@ radeon_crtc_set_config(struct drm_mode_set *set)
 	dev = set->crtc->dev;
 
 	ret = pm_runtime_get_sync(dev->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_autosuspend(dev->dev);
 		return ret;
+	}
 
 	ret = drm_crtc_helper_set_config(set);
 
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 5b6a6f5b3619..401403a3ea50 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -527,8 +527,10 @@ long radeon_drm_ioctl(struct file *filp,
 	long ret;
 	dev = file_priv->minor->dev;
 	ret = pm_runtime_get_sync(dev->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_autosuspend(dev->dev);
 		return ret;
+	}
 
 	ret = drm_ioctl(filp, cmd, arg);
 	
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index d290a8a09036..41caf7da9054 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -631,8 +631,10 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
 	file_priv->driver_priv = NULL;
 
 	r = pm_runtime_get_sync(dev->dev);
-	if (r < 0)
+	if (r < 0) {
+		pm_runtime_put_autosuspend(dev->dev);
 		return r;
+	}
 
 	/* new gpu have virtual address space support */
 	if (rdev->family >= CHIP_CAYMAN) {

From abac8d68a2e656a3e89a74c7bdcedbf321a60f83 Mon Sep 17 00:00:00 2001
From: Evgeny Novikov <novikov@ispras.ru>
Date: Tue, 30 Jun 2020 22:54:51 +0300
Subject: [PATCH 0333/2658] video: fbdev: neofb: fix memory leak in
 neo_scan_monitor()

[ Upstream commit edcb3895a751c762a18d25c8d9846ce9759ed7e1 ]

neofb_probe() calls neo_scan_monitor() that can successfully allocate a
memory for info->monspecs.modedb and proceed to case 0x03. There it does
not free the memory and returns -1. neofb_probe() goes to label
err_scan_monitor, thus, it does not free this memory through calling
fb_destroy_modedb() as well. We can not go to label err_init_hw since
neo_scan_monitor() can fail during memory allocation. So, the patch frees
the memory directly for case 0x03.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200630195451.18675-1-novikov@ispras.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/neofb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/video/fbdev/neofb.c b/drivers/video/fbdev/neofb.c
index db023a97d1ea..e243254a5721 100644
--- a/drivers/video/fbdev/neofb.c
+++ b/drivers/video/fbdev/neofb.c
@@ -1820,6 +1820,7 @@ static int neo_scan_monitor(struct fb_info *info)
 #else
 		printk(KERN_ERR
 		       "neofb: Only 640x480, 800x600/480 and 1024x768 panels are currently supported\n");
+		kfree(info->monspecs.modedb);
 		return -1;
 #endif
 	default:

From eca4204432f4a1c3b333f2360b64fb7f912d15f8 Mon Sep 17 00:00:00 2001
From: Aditya Pakki <pakki001@umn.edu>
Date: Sat, 13 Jun 2020 20:41:56 -0500
Subject: [PATCH 0334/2658] drm/nouveau: fix multiple instances of reference
 count leaks

[ Upstream commit 659fb5f154c3434c90a34586f3b7aa1c39cf6062 ]

On calling pm_runtime_get_sync() the reference count of the device
is incremented. In case of failure, decrement the
ref count before returning the error.

Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nouveau_drm.c | 8 ++++++--
 drivers/gpu/drm/nouveau/nouveau_gem.c | 4 +++-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 91a61d2cca88..a90840e39110 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -805,8 +805,10 @@ nouveau_drm_open(struct drm_device *dev, struct drm_file *fpriv)
 
 	/* need to bring up power immediately if opening device */
 	ret = pm_runtime_get_sync(dev->dev);
-	if (ret < 0 && ret != -EACCES)
+	if (ret < 0 && ret != -EACCES) {
+		pm_runtime_put_autosuspend(dev->dev);
 		return ret;
+	}
 
 	get_task_comm(tmpname, current);
 	snprintf(name, sizeof(name), "%s[%d]", tmpname, pid_nr(fpriv->pid));
@@ -894,8 +896,10 @@ nouveau_drm_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	long ret;
 
 	ret = pm_runtime_get_sync(dev->dev);
-	if (ret < 0 && ret != -EACCES)
+	if (ret < 0 && ret != -EACCES) {
+		pm_runtime_put_autosuspend(dev->dev);
 		return ret;
+	}
 
 	switch (_IOC_NR(cmd) - DRM_COMMAND_BASE) {
 	case DRM_NOUVEAU_NVIF:
diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index 777501126540..788c93581256 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -42,8 +42,10 @@ nouveau_gem_object_del(struct drm_gem_object *gem)
 	int ret;
 
 	ret = pm_runtime_get_sync(dev);
-	if (WARN_ON(ret < 0 && ret != -EACCES))
+	if (WARN_ON(ret < 0 && ret != -EACCES)) {
+		pm_runtime_put_autosuspend(dev);
 		return;
+	}
 
 	if (gem->import_attach)
 		drm_prime_gem_destroy(gem, nvbo->bo.sg);

From 8ac8872ce7a0a87850749026afb7dbfbdca18b6f Mon Sep 17 00:00:00 2001
From: Michael Tretter <m.tretter@pengutronix.de>
Date: Thu, 17 Aug 2017 12:43:07 +0200
Subject: [PATCH 0335/2658] drm/debugfs: fix plain echo to connector "force"
 attribute

[ Upstream commit c704b17071c4dc571dca3af4e4151dac51de081a ]

Using plain echo to set the "force" connector attribute fails with
-EINVAL, because echo appends a newline to the output.

Replace strcmp with sysfs_streq to also accept strings that end with a
newline.

v2: use sysfs_streq instead of stripping trailing whitespace

Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20170817104307.17124-1-m.tretter@pengutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_debugfs.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
index 3bcf8e6a85b3..5b0fdcd0b63f 100644
--- a/drivers/gpu/drm/drm_debugfs.c
+++ b/drivers/gpu/drm/drm_debugfs.c
@@ -290,13 +290,13 @@ static ssize_t connector_write(struct file *file, const char __user *ubuf,
 
 	buf[len] = '\0';
 
-	if (!strcmp(buf, "on"))
+	if (sysfs_streq(buf, "on"))
 		connector->force = DRM_FORCE_ON;
-	else if (!strcmp(buf, "digital"))
+	else if (sysfs_streq(buf, "digital"))
 		connector->force = DRM_FORCE_ON_DIGITAL;
-	else if (!strcmp(buf, "off"))
+	else if (sysfs_streq(buf, "off"))
 		connector->force = DRM_FORCE_OFF;
-	else if (!strcmp(buf, "unspecified"))
+	else if (sysfs_streq(buf, "unspecified"))
 		connector->force = DRM_FORCE_UNSPECIFIED;
 	else
 		return -EINVAL;

From afe76b9305470fae36d4d7c31864098c721a7465 Mon Sep 17 00:00:00 2001
From: "Paul E. McKenney" <paulmck@kernel.org>
Date: Thu, 16 Apr 2020 16:46:10 -0700
Subject: [PATCH 0336/2658] mm/mmap.c: Add cond_resched() for exit_mmap() CPU
 stalls

[ Upstream commit 0a3b3c253a1eb2c7fe7f34086d46660c909abeb3 ]

A large process running on a heavily loaded system can encounter the
following RCU CPU stall warning:

  rcu: INFO: rcu_sched self-detected stall on CPU
  rcu: 	3-....: (20998 ticks this GP) idle=4ea/1/0x4000000000000002 softirq=556558/556558 fqs=5190
  	(t=21013 jiffies g=1005461 q=132576)
  NMI backtrace for cpu 3
  CPU: 3 PID: 501900 Comm: aio-free-ring-w Kdump: loaded Not tainted 5.2.9-108_fbk12_rc3_3858_gb83b75af7909 #1
  Hardware name: Wiwynn   HoneyBadger/PantherPlus, BIOS HBM6.71 02/03/2016
  Call Trace:
   <IRQ>
   dump_stack+0x46/0x60
   nmi_cpu_backtrace.cold.3+0x13/0x50
   ? lapic_can_unplug_cpu.cold.27+0x34/0x34
   nmi_trigger_cpumask_backtrace+0xba/0xca
   rcu_dump_cpu_stacks+0x99/0xc7
   rcu_sched_clock_irq.cold.87+0x1aa/0x397
   ? tick_sched_do_timer+0x60/0x60
   update_process_times+0x28/0x60
   tick_sched_timer+0x37/0x70
   __hrtimer_run_queues+0xfe/0x270
   hrtimer_interrupt+0xf4/0x210
   smp_apic_timer_interrupt+0x5e/0x120
   apic_timer_interrupt+0xf/0x20
   </IRQ>
  RIP: 0010:kmem_cache_free+0x223/0x300
  Code: 88 00 00 00 0f 85 ca 00 00 00 41 8b 55 18 31 f6 f7 da 41 f6 45 0a 02 40 0f 94 c6 83 c6 05 9c 41 5e fa e8 a0 a7 01 00 41 56 9d <49> 8b 47 08 a8 03 0f 85 87 00 00 00 65 48 ff 08 e9 3d fe ff ff 65
  RSP: 0018:ffffc9000e8e3da8 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13
  RAX: 0000000000020000 RBX: ffff88861b9de960 RCX: 0000000000000030
  RDX: fffffffffffe41e8 RSI: 000060777fe3a100 RDI: 000000000001be18
  RBP: ffffea00186e7780 R08: ffffffffffffffff R09: ffffffffffffffff
  R10: ffff88861b9dea28 R11: ffff88887ffde000 R12: ffffffff81230a1f
  R13: ffff888854684dc0 R14: 0000000000000206 R15: ffff8888547dbc00
   ? remove_vma+0x4f/0x60
   remove_vma+0x4f/0x60
   exit_mmap+0xd6/0x160
   mmput+0x4a/0x110
   do_exit+0x278/0xae0
   ? syscall_trace_enter+0x1d3/0x2b0
   ? handle_mm_fault+0xaa/0x1c0
   do_group_exit+0x3a/0xa0
   __x64_sys_exit_group+0x14/0x20
   do_syscall_64+0x42/0x100
   entry_SYSCALL_64_after_hwframe+0x44/0xa9

And on a PREEMPT=n kernel, the "while (vma)" loop in exit_mmap() can run
for a very long time given a large process.  This commit therefore adds
a cond_resched() to this loop, providing RCU any needed quiescent states.

Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: <linux-mm@kvack.org>
Reviewed-by: Shakeel Butt <shakeelb@google.com>
Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/mmap.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mm/mmap.c b/mm/mmap.c
index cf335cbddfe1..9704dba5ee30 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2985,6 +2985,7 @@ void exit_mmap(struct mm_struct *mm)
 		if (vma->vm_flags & VM_ACCOUNT)
 			nr_accounted += vma_pages(vma);
 		vma = remove_vma(vma);
+		cond_resched();
 	}
 	vm_unacct_memory(nr_accounted);
 }

From 03b2657d524e813b529754c122b8c7454da7041e Mon Sep 17 00:00:00 2001
From: Prasanna Kerekoppa <prasanna.kerekoppa@cypress.com>
Date: Thu, 4 Jun 2020 02:18:35 -0500
Subject: [PATCH 0337/2658] brcmfmac: To fix Bss Info flag definition Bug

[ Upstream commit fa3266541b13f390eb35bdbc38ff4a03368be004 ]

Bss info flag definition need to be fixed from 0x2 to 0x4
This flag is for rssi info received on channel.
All Firmware branches defined as 0x4 and this is bug in brcmfmac.

Signed-off-by: Prasanna Kerekoppa <prasanna.kerekoppa@cypress.com>
Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: Wright Feng <wright.feng@cypress.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200604071835.3842-6-wright.feng@cypress.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
index 4320c4cae53e..7eb9f31dde1a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
@@ -30,7 +30,7 @@
 #define BRCMF_ARP_OL_PEER_AUTO_REPLY	0x00000008
 
 #define	BRCMF_BSS_INFO_VERSION	109 /* curr ver of brcmf_bss_info_le struct */
-#define BRCMF_BSS_RSSI_ON_CHANNEL	0x0002
+#define BRCMF_BSS_RSSI_ON_CHANNEL	0x0004
 
 #define BRCMF_STA_WME              0x00000002      /* WMM association */
 #define BRCMF_STA_AUTHE            0x00000008      /* Authenticated */

From 39e41e342003cf6875dbd3096e164a4bbb6def28 Mon Sep 17 00:00:00 2001
From: Bolarinwa Olayemi Saheed <refactormyself@gmail.com>
Date: Mon, 13 Jul 2020 19:55:27 +0200
Subject: [PATCH 0338/2658] iwlegacy: Check the return value of
 pcie_capability_read_*()

[ Upstream commit 9018fd7f2a73e9b290f48a56b421558fa31e8b75 ]

On failure pcie_capability_read_dword() sets it's last parameter, val
to 0. However, with Patch 14/14, it is possible that val is set to ~0 on
failure. This would introduce a bug because (x & x) == (~0 & x).

This bug can be avoided without changing the function's behaviour if the
return value of pcie_capability_read_dword is checked to confirm success.

Check the return value of pcie_capability_read_dword() to ensure success.

Suggested-by: Bjorn Helgaas <bjorn@helgaas.com>
Signed-off-by: Bolarinwa Olayemi Saheed <refactormyself@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200713175529.29715-3-refactormyself@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/iwlegacy/common.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index 544ab3750ea6..c56febdae134 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -4294,8 +4294,8 @@ il_apm_init(struct il_priv *il)
 	 *    power savings, even without L1.
 	 */
 	if (il->cfg->set_l0s) {
-		pcie_capability_read_word(il->pci_dev, PCI_EXP_LNKCTL, &lctl);
-		if (lctl & PCI_EXP_LNKCTL_ASPM_L1) {
+		ret = pcie_capability_read_word(il->pci_dev, PCI_EXP_LNKCTL, &lctl);
+		if (!ret && (lctl & PCI_EXP_LNKCTL_ASPM_L1)) {
 			/* L1-ASPM enabled; disable(!) L0S  */
 			il_set_bit(il, CSR_GIO_REG,
 				   CSR_GIO_REG_VAL_L0S_ENABLED);

From 74c2fb2b1f25a99627ae5900806d3bab72a85585 Mon Sep 17 00:00:00 2001
From: Evgeny Novikov <novikov@ispras.ru>
Date: Tue, 21 Jul 2020 23:15:58 +0300
Subject: [PATCH 0339/2658] usb: gadget: net2280: fix memory leak on probe
 error handling paths

[ Upstream commit 2468c877da428ebfd701142c4cdfefcfb7d4c00e ]

Driver does not release memory for device on error handling paths in
net2280_probe() when gadget_release() is not registered yet.

The patch fixes the bug like in other similar drivers.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/net2280.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
index 3a8d056a5d16..48dd0da21e2b 100644
--- a/drivers/usb/gadget/udc/net2280.c
+++ b/drivers/usb/gadget/udc/net2280.c
@@ -3712,8 +3712,10 @@ static int net2280_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	return 0;
 
 done:
-	if (dev)
+	if (dev) {
 		net2280_remove(pdev);
+		kfree(dev);
+	}
 	return retval;
 }
 

From f56caba29f31a316c5771c585f40fc88b12110a6 Mon Sep 17 00:00:00 2001
From: Sasi Kumar <sasi.kumar@broadcom.com>
Date: Wed, 22 Jul 2020 13:07:42 -0400
Subject: [PATCH 0340/2658] bdc: Fix bug causing crash after multiple
 disconnects

[ Upstream commit a95bdfd22076497288868c028619bc5995f5cc7f ]

Multiple connects/disconnects can cause a crash on the second
disconnect. The driver had a problem where it would try to send
endpoint commands after it was disconnected which is not allowed
by the hardware. The fix is to only allow the endpoint commands
when the endpoint is connected. This will also fix issues that
showed up when using configfs to create gadgets.

Signed-off-by: Sasi Kumar <sasi.kumar@broadcom.com>
Signed-off-by: Al Cooper <alcooperx@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/bdc/bdc_core.c |  4 ++++
 drivers/usb/gadget/udc/bdc/bdc_ep.c   | 16 ++++++++++------
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c
index e9bd8d4abca0..f09a74d79c9e 100644
--- a/drivers/usb/gadget/udc/bdc/bdc_core.c
+++ b/drivers/usb/gadget/udc/bdc/bdc_core.c
@@ -286,6 +286,7 @@ static void bdc_mem_init(struct bdc *bdc, bool reinit)
 	 * in that case reinit is passed as 1
 	 */
 	if (reinit) {
+		int i;
 		/* Enable interrupts */
 		temp = bdc_readl(bdc->regs, BDC_BDCSC);
 		temp |= BDC_GIE;
@@ -295,6 +296,9 @@ static void bdc_mem_init(struct bdc *bdc, bool reinit)
 		/* Initialize SRR to 0 */
 		memset(bdc->srr.sr_bds, 0,
 					NUM_SR_ENTRIES * sizeof(struct bdc_bd));
+		/* clear ep flags to avoid post disconnect stops/deconfigs */
+		for (i = 1; i < bdc->num_eps; ++i)
+			bdc->bdc_ep_array[i]->flags = 0;
 	} else {
 		/* One time initiaization only */
 		/* Enable status report function pointers */
diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c
index 3a65272fbed8..9f5f18891ba8 100644
--- a/drivers/usb/gadget/udc/bdc/bdc_ep.c
+++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c
@@ -621,7 +621,6 @@ int bdc_ep_enable(struct bdc_ep *ep)
 	}
 	bdc_dbg_bd_list(bdc, ep);
 	/* only for ep0: config ep is called for ep0 from connect event */
-	ep->flags |= BDC_EP_ENABLED;
 	if (ep->ep_num == 1)
 		return ret;
 
@@ -767,10 +766,13 @@ static int ep_dequeue(struct bdc_ep *ep, struct bdc_req *req)
 					__func__, ep->name, start_bdi, end_bdi);
 	dev_dbg(bdc->dev, "ep_dequeue ep=%p ep->desc=%p\n",
 						ep, (void *)ep->usb_ep.desc);
-	/* Stop the ep to see where the HW is ? */
-	ret = bdc_stop_ep(bdc, ep->ep_num);
-	/* if there is an issue with stopping ep, then no need to go further */
-	if (ret)
+	/* if still connected, stop the ep to see where the HW is ? */
+	if (!(bdc_readl(bdc->regs, BDC_USPC) & BDC_PST_MASK)) {
+		ret = bdc_stop_ep(bdc, ep->ep_num);
+		/* if there is an issue, then no need to go further */
+		if (ret)
+			return 0;
+	} else
 		return 0;
 
 	/*
@@ -1921,7 +1923,9 @@ static int bdc_gadget_ep_disable(struct usb_ep *_ep)
 		__func__, ep->name, ep->flags);
 
 	if (!(ep->flags & BDC_EP_ENABLED)) {
-		dev_warn(bdc->dev, "%s is already disabled\n", ep->name);
+		if (bdc->gadget.speed != USB_SPEED_UNKNOWN)
+			dev_warn(bdc->dev, "%s is already disabled\n",
+				 ep->name);
 		return 0;
 	}
 	spin_lock_irqsave(&bdc->lock, flags);

From 60bf105b22a6605ef064ef694cc56ff7b9c09635 Mon Sep 17 00:00:00 2001
From: Jim Cromie <jim.cromie@gmail.com>
Date: Sun, 19 Jul 2020 17:10:47 -0600
Subject: [PATCH 0341/2658] dyndbg: fix a BUG_ON in ddebug_describe_flags

[ Upstream commit f678ce8cc3cb2ad29df75d8824c74f36398ba871 ]

ddebug_describe_flags() currently fills a caller provided string buffer,
after testing its size (also passed) in a BUG_ON.  Fix this by
replacing them with a known-big-enough string buffer wrapped in a
struct, and passing that instead.

Also simplify ddebug_describe_flags() flags parameter from a struct to
a member in that struct, and hoist the member deref up to the caller.
This makes the function reusable (soon) where flags are unpacked.

Acked-by: <jbaron@akamai.com>
Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
Link: https://lore.kernel.org/r/20200719231058.1586423-8-jim.cromie@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/dynamic_debug.c | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
index c6368ae93fe6..f50d63f67899 100644
--- a/lib/dynamic_debug.c
+++ b/lib/dynamic_debug.c
@@ -85,22 +85,22 @@ static struct { unsigned flag:8; char opt_char; } opt_array[] = {
 	{ _DPRINTK_FLAGS_NONE, '_' },
 };
 
+struct flagsbuf { char buf[ARRAY_SIZE(opt_array)+1]; };
+
 /* format a string into buf[] which describes the _ddebug's flags */
-static char *ddebug_describe_flags(struct _ddebug *dp, char *buf,
-				    size_t maxlen)
+static char *ddebug_describe_flags(unsigned int flags, struct flagsbuf *fb)
 {
-	char *p = buf;
+	char *p = fb->buf;
 	int i;
 
-	BUG_ON(maxlen < 6);
 	for (i = 0; i < ARRAY_SIZE(opt_array); ++i)
-		if (dp->flags & opt_array[i].flag)
+		if (flags & opt_array[i].flag)
 			*p++ = opt_array[i].opt_char;
-	if (p == buf)
+	if (p == fb->buf)
 		*p++ = '_';
 	*p = '\0';
 
-	return buf;
+	return fb->buf;
 }
 
 #define vpr_info(fmt, ...)					\
@@ -142,7 +142,7 @@ static int ddebug_change(const struct ddebug_query *query,
 	struct ddebug_table *dt;
 	unsigned int newflags;
 	unsigned int nfound = 0;
-	char flagbuf[10];
+	struct flagsbuf fbuf;
 
 	/* search for matching ddebugs */
 	mutex_lock(&ddebug_lock);
@@ -192,8 +192,7 @@ static int ddebug_change(const struct ddebug_query *query,
 			vpr_info("changed %s:%d [%s]%s =%s\n",
 				 trim_prefix(dp->filename), dp->lineno,
 				 dt->mod_name, dp->function,
-				 ddebug_describe_flags(dp, flagbuf,
-						       sizeof(flagbuf)));
+				 ddebug_describe_flags(dp->flags, &fbuf));
 		}
 	}
 	mutex_unlock(&ddebug_lock);
@@ -777,7 +776,7 @@ static int ddebug_proc_show(struct seq_file *m, void *p)
 {
 	struct ddebug_iter *iter = m->private;
 	struct _ddebug *dp = p;
-	char flagsbuf[10];
+	struct flagsbuf flags;
 
 	vpr_info("called m=%p p=%p\n", m, p);
 
@@ -790,7 +789,7 @@ static int ddebug_proc_show(struct seq_file *m, void *p)
 	seq_printf(m, "%s:%u [%s]%s =%s \"",
 		   trim_prefix(dp->filename), dp->lineno,
 		   iter->table->mod_name, dp->function,
-		   ddebug_describe_flags(dp, flagsbuf, sizeof(flagsbuf)));
+		   ddebug_describe_flags(dp->flags, &flags));
 	seq_escape(m, dp->format, "\t\r\n\"");
 	seq_puts(m, "\"\n");
 

From 89545c0b9d102fcd8d4f242fdeb311dcaf030ebf Mon Sep 17 00:00:00 2001
From: Coly Li <colyli@suse.de>
Date: Sat, 25 Jul 2020 20:00:26 +0800
Subject: [PATCH 0342/2658] bcache: fix super block seq numbers comparision in
 register_cache_set()

[ Upstream commit 117f636ea695270fe492d0c0c9dfadc7a662af47 ]

In register_cache_set(), c is pointer to struct cache_set, and ca is
pointer to struct cache, if ca->sb.seq > c->sb.seq, it means this
registering cache has up to date version and other members, the in-
memory version and other members should be updated to the newer value.

But current implementation makes a cache set only has a single cache
device, so the above assumption works well except for a special case.
The execption is when a cache device new created and both ca->sb.seq and
c->sb.seq are 0, because the super block is never flushed out yet. In
the location for the following if() check,
2156         if (ca->sb.seq > c->sb.seq) {
2157                 c->sb.version           = ca->sb.version;
2158                 memcpy(c->sb.set_uuid, ca->sb.set_uuid, 16);
2159                 c->sb.flags             = ca->sb.flags;
2160                 c->sb.seq               = ca->sb.seq;
2161                 pr_debug("set version = %llu\n", c->sb.version);
2162         }
c->sb.version is not initialized yet and valued 0. When ca->sb.seq is 0,
the if() check will fail (because both values are 0), and the cache set
version, set_uuid, flags and seq won't be updated.

The above problem is hiden for current code, because the bucket size is
compatible among different super block version. And the next time when
running cache set again, ca->sb.seq will be larger than 0 and cache set
super block version will be updated properly.

But if the large bucket feature is enabled,  sb->bucket_size is the low
16bits of the bucket size. For a power of 2 value, when the actual
bucket size exceeds 16bit width, sb->bucket_size will always be 0. Then
read_super_common() will fail because the if() check to
is_power_of_2(sb->bucket_size) is false. This is how the long time
hidden bug is triggered.

This patch modifies the if() check to the following way,
2156         if (ca->sb.seq > c->sb.seq || c->sb.seq == 0) {
Then cache set's version, set_uuid, flags and seq will always be updated
corectly including for a new created cache device.

Signed-off-by: Coly Li <colyli@suse.de>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/bcache/super.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index df8f1e69077f..23ffd4469dab 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1778,7 +1778,14 @@ static const char *register_cache_set(struct cache *ca)
 	    sysfs_create_link(&c->kobj, &ca->kobj, buf))
 		goto err;
 
-	if (ca->sb.seq > c->sb.seq) {
+	/*
+	 * A special case is both ca->sb.seq and c->sb.seq are 0,
+	 * such condition happens on a new created cache device whose
+	 * super block is never flushed yet. In this case c->sb.version
+	 * and other members should be updated too, otherwise we will
+	 * have a mistaken super block version in cache set.
+	 */
+	if (ca->sb.seq > c->sb.seq || c->sb.seq == 0) {
 		c->sb.version		= ca->sb.version;
 		memcpy(c->sb.set_uuid, ca->sb.set_uuid, 16);
 		c->sb.flags             = ca->sb.flags;

From 0728ada449d2180f8a351fb6db3af697cc389687 Mon Sep 17 00:00:00 2001
From: Erik Kaneda <erik.kaneda@intel.com>
Date: Mon, 20 Jul 2020 10:31:20 -0700
Subject: [PATCH 0343/2658] ACPICA: Do not increment operation_region reference
 counts for field units

[ Upstream commit 6a54ebae6d047c988a31f5ac5a64ab5cf83797a2 ]

ACPICA commit e17b28cfcc31918d0db9547b6b274b09c413eb70

Object reference counts are used as a part of ACPICA's garbage
collection mechanism. This mechanism keeps track of references to
heap-allocated structures such as the ACPI operand objects.

Recent server firmware has revealed that this reference count can
overflow on large servers that declare many field units under the
same operation_region. This occurs because each field unit declaration
will add a reference count to the source operation_region.

This change solves the reference count overflow for operation_regions
objects by preventing fieldunits from incrementing their
operation_region's reference count. Each operation_region's reference
count will not be changed by named objects declared under the Field
operator. During namespace deletion, the operation_region namespace
node will be deleted and each fieldunit will be deleted without
touching the deleted operation_region object.

Link: https://github.com/acpica/acpica/commit/e17b28cf
Signed-off-by: Erik Kaneda <erik.kaneda@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/acpica/exprep.c   | 4 ----
 drivers/acpi/acpica/utdelete.c | 6 +-----
 2 files changed, 1 insertion(+), 9 deletions(-)

diff --git a/drivers/acpi/acpica/exprep.c b/drivers/acpi/acpica/exprep.c
index 4c2836dc825b..47d8a85c90ff 100644
--- a/drivers/acpi/acpica/exprep.c
+++ b/drivers/acpi/acpica/exprep.c
@@ -502,10 +502,6 @@ acpi_status acpi_ex_prep_field_value(struct acpi_create_field_info *info)
 				    (u8)access_byte_width;
 			}
 		}
-		/* An additional reference for the container */
-
-		acpi_ut_add_reference(obj_desc->field.region_obj);
-
 		ACPI_DEBUG_PRINT((ACPI_DB_BFIELD,
 				  "RegionField: BitOff %X, Off %X, Gran %X, Region %p\n",
 				  obj_desc->field.start_field_bit_offset,
diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c
index 1638312e3d8f..9f8b088e21d7 100644
--- a/drivers/acpi/acpica/utdelete.c
+++ b/drivers/acpi/acpica/utdelete.c
@@ -590,11 +590,6 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action)
 			next_object = object->buffer_field.buffer_obj;
 			break;
 
-		case ACPI_TYPE_LOCAL_REGION_FIELD:
-
-			next_object = object->field.region_obj;
-			break;
-
 		case ACPI_TYPE_LOCAL_BANK_FIELD:
 
 			next_object = object->bank_field.bank_obj;
@@ -635,6 +630,7 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action)
 			}
 			break;
 
+		case ACPI_TYPE_LOCAL_REGION_FIELD:
 		case ACPI_TYPE_REGION:
 		default:
 

From 7e3a1ac6ac230d587e9ae25cfea69b4054137174 Mon Sep 17 00:00:00 2001
From: Qiushi Wu <wu000273@umn.edu>
Date: Fri, 22 May 2020 09:34:51 +0100
Subject: [PATCH 0344/2658] agp/intel: Fix a memory leak on module
 initialisation failure

[ Upstream commit b975abbd382fe442713a4c233549abb90e57c22b ]

In intel_gtt_setup_scratch_page(), pointer "page" is not released if
pci_dma_mapping_error() return an error, leading to a memory leak on
module initialisation failure.  Simply fix this issue by freeing "page"
before return.

Fixes: 0e87d2b06cb46 ("intel-gtt: initialize our own scratch page")
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20200522083451.7448-1-chris@chris-wilson.co.uk
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/agp/intel-gtt.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
index 76afc841232c..3d11f5adb355 100644
--- a/drivers/char/agp/intel-gtt.c
+++ b/drivers/char/agp/intel-gtt.c
@@ -303,8 +303,10 @@ static int intel_gtt_setup_scratch_page(void)
 	if (intel_private.needs_dmar) {
 		dma_addr = pci_map_page(intel_private.pcidev, page, 0,
 				    PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
-		if (pci_dma_mapping_error(intel_private.pcidev, dma_addr))
+		if (pci_dma_mapping_error(intel_private.pcidev, dma_addr)) {
+			__free_page(page);
 			return -EINVAL;
+		}
 
 		intel_private.scratch_page_dma = dma_addr;
 	} else

From 59fc49d2221f03c22dddd40e1310bc5f990e64d2 Mon Sep 17 00:00:00 2001
From: Dejin Zheng <zhengdejin5@gmail.com>
Date: Thu, 23 Apr 2020 00:07:19 +0800
Subject: [PATCH 0345/2658] video: fbdev: sm712fb: fix an issue about iounmap
 for a wrong address

[ Upstream commit 98bd4f72988646c35569e1e838c0ab80d06c77f6 ]

the sfb->fb->screen_base is not save the value get by iounmap() when
the chip id is 0x720. so iounmap() for address sfb->fb->screen_base
is not right.

Fixes: 1461d6672864854 ("staging: sm7xxfb: merge sm712fb with fbdev")
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Cc: Teddy Wang <teddy.wang@siliconmotion.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Dejin Zheng <zhengdejin5@gmail.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200422160719.27763-1-zhengdejin5@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/sm712fb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
index 589ac7e75413..c8ee58e0ae3e 100644
--- a/drivers/video/fbdev/sm712fb.c
+++ b/drivers/video/fbdev/sm712fb.c
@@ -1428,6 +1428,8 @@ static int smtc_map_smem(struct smtcfb_info *sfb,
 static void smtc_unmap_smem(struct smtcfb_info *sfb)
 {
 	if (sfb && sfb->fb->screen_base) {
+		if (sfb->chip_id == 0x720)
+			sfb->fb->screen_base -= 0x00200000;
 		iounmap(sfb->fb->screen_base);
 		sfb->fb->screen_base = NULL;
 	}

From 00fa73c7d0390e262060a5e310f34ccd530f6aeb Mon Sep 17 00:00:00 2001
From: Dejin Zheng <zhengdejin5@gmail.com>
Date: Fri, 24 Apr 2020 00:42:51 +0800
Subject: [PATCH 0346/2658] console: newport_con: fix an issue about leak
 related system resources

[ Upstream commit fd4b8243877250c05bb24af7fea5567110c9720b ]

A call of the function do_take_over_console() can fail here.
The corresponding system resources were not released then.
Thus add a call of iounmap() and release_mem_region()
together with the check of a failure predicate. and also
add release_mem_region() on device removal.

Fixes: e86bb8acc0fdc ("[PATCH] VT binding: Make newport_con support binding")
Suggested-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Dejin Zheng <zhengdejin5@gmail.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Andrew Morton <akpm@osdl.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200423164251.3349-1-zhengdejin5@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/console/newport_con.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c
index bb4e96255974..bd0c6e53bec1 100644
--- a/drivers/video/console/newport_con.c
+++ b/drivers/video/console/newport_con.c
@@ -31,6 +31,8 @@
 #include <linux/linux_logo.h>
 #include <linux/font.h>
 
+#define NEWPORT_LEN	0x10000
+
 #define FONT_DATA ((unsigned char *)font_vga_8x16.data)
 
 /* borrowed from fbcon.c */
@@ -42,6 +44,7 @@
 static unsigned char *font_data[MAX_NR_CONSOLES];
 
 static struct newport_regs *npregs;
+static unsigned long newport_addr;
 
 static int logo_active;
 static int topscan;
@@ -743,7 +746,6 @@ const struct consw newport_con = {
 static int newport_probe(struct gio_device *dev,
 			 const struct gio_device_id *id)
 {
-	unsigned long newport_addr;
 	int err;
 
 	if (!dev->resource.start)
@@ -753,7 +755,7 @@ static int newport_probe(struct gio_device *dev,
 		return -EBUSY; /* we only support one Newport as console */
 
 	newport_addr = dev->resource.start + 0xF0000;
-	if (!request_mem_region(newport_addr, 0x10000, "Newport"))
+	if (!request_mem_region(newport_addr, NEWPORT_LEN, "Newport"))
 		return -ENODEV;
 
 	npregs = (struct newport_regs *)/* ioremap cannot fail */
@@ -761,6 +763,11 @@ static int newport_probe(struct gio_device *dev,
 	console_lock();
 	err = do_take_over_console(&newport_con, 0, MAX_NR_CONSOLES - 1, 1);
 	console_unlock();
+
+	if (err) {
+		iounmap((void *)npregs);
+		release_mem_region(newport_addr, NEWPORT_LEN);
+	}
 	return err;
 }
 
@@ -768,6 +775,7 @@ static void newport_remove(struct gio_device *dev)
 {
 	give_up_console(&newport_con);
 	iounmap((void *)npregs);
+	release_mem_region(newport_addr, NEWPORT_LEN);
 }
 
 static struct gio_device_id newport_ids[] = {

From 5c53eb8fecf03644644bf641629a3337835b2a0a Mon Sep 17 00:00:00 2001
From: Tomasz Duszynski <tomasz.duszynski@octakon.com>
Date: Mon, 1 Jun 2020 18:15:52 +0200
Subject: [PATCH 0347/2658] iio: improve IIO_CONCENTRATION channel type
 description

[ Upstream commit df16c33a4028159d1ba8a7061c9fa950b58d1a61 ]

IIO_CONCENTRATION together with INFO_RAW specifier is used for reporting
raw concentrations of pollutants. Raw value should be meaningless
before being properly scaled. Because of that description shouldn't
mention raw value unit whatsoever.

Fix this by rephrasing existing description so it follows conventions
used throughout IIO ABI docs.

Fixes: 8ff6b3bc94930 ("iio: chemical: Add IIO_CONCENTRATION channel type")
Signed-off-by: Tomasz Duszynski <tomasz.duszynski@octakon.com>
Acked-by: Matt Ranostay <matt.ranostay@konsulko.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/ABI/testing/sysfs-bus-iio | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio
index 0439c2aaf741..f20c783cb5c0 100644
--- a/Documentation/ABI/testing/sysfs-bus-iio
+++ b/Documentation/ABI/testing/sysfs-bus-iio
@@ -1470,7 +1470,8 @@ What:		/sys/bus/iio/devices/iio:deviceX/in_concentrationX_voc_raw
 KernelVersion:	4.3
 Contact:	linux-iio@vger.kernel.org
 Description:
-		Raw (unscaled no offset etc.) percentage reading of a substance.
+		Raw (unscaled no offset etc.) reading of a substance. Units
+		after application of scale and offset are percents.
 
 What:		/sys/bus/iio/devices/iio:deviceX/in_resistance_raw
 What:		/sys/bus/iio/devices/iio:deviceX/in_resistanceX_raw

From 4f8023c649645452803812f6f41d5718424a2894 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Tue, 5 May 2020 16:19:17 +0200
Subject: [PATCH 0348/2658] leds: lm355x: avoid enum conversion warning

[ Upstream commit 985b1f596f9ed56f42b8c2280005f943e1434c06 ]

clang points out that doing arithmetic between diffent enums is usually
a mistake:

drivers/leds/leds-lm355x.c:167:28: warning: bitwise operation between different enumeration types ('enum lm355x_tx2' and 'enum lm355x_ntc') [-Wenum-enum-conversion]
                reg_val = pdata->pin_tx2 | pdata->ntc_pin;
                          ~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~
drivers/leds/leds-lm355x.c:178:28: warning: bitwise operation between different enumeration types ('enum lm355x_tx2' and 'enum lm355x_ntc') [-Wenum-enum-conversion]
                reg_val = pdata->pin_tx2 | pdata->ntc_pin | pdata->pass_mode;
                          ~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~

In this driver, it is intentional, so add a cast to hide the false-positive
warning. It appears to be the only instance of this warning at the moment.

Fixes: b98d13c72592 ("leds: Add new LED driver for lm355x chips")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/leds/leds-lm355x.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/leds/leds-lm355x.c b/drivers/leds/leds-lm355x.c
index 48872997d6b4..533b255c27cd 100644
--- a/drivers/leds/leds-lm355x.c
+++ b/drivers/leds/leds-lm355x.c
@@ -177,18 +177,19 @@ static int lm355x_chip_init(struct lm355x_chip_data *chip)
 	/* input and output pins configuration */
 	switch (chip->type) {
 	case CHIP_LM3554:
-		reg_val = pdata->pin_tx2 | pdata->ntc_pin;
+		reg_val = (u32)pdata->pin_tx2 | (u32)pdata->ntc_pin;
 		ret = regmap_update_bits(chip->regmap, 0xE0, 0x28, reg_val);
 		if (ret < 0)
 			goto out;
-		reg_val = pdata->pass_mode;
+		reg_val = (u32)pdata->pass_mode;
 		ret = regmap_update_bits(chip->regmap, 0xA0, 0x04, reg_val);
 		if (ret < 0)
 			goto out;
 		break;
 
 	case CHIP_LM3556:
-		reg_val = pdata->pin_tx2 | pdata->ntc_pin | pdata->pass_mode;
+		reg_val = (u32)pdata->pin_tx2 | (u32)pdata->ntc_pin |
+		          (u32)pdata->pass_mode;
 		ret = regmap_update_bits(chip->regmap, 0x0A, 0xC4, reg_val);
 		if (ret < 0)
 			goto out;

From e9c4818e85b4e8f55151b4c704ed20758590b4a3 Mon Sep 17 00:00:00 2001
From: Chuhong Yuan <hslester96@gmail.com>
Date: Wed, 3 Jun 2020 18:41:22 +0200
Subject: [PATCH 0349/2658] media: omap3isp: Add missed
 v4l2_ctrl_handler_free() for preview_init_entities()

[ Upstream commit dc7690a73017e1236202022e26a6aa133f239c8c ]

preview_init_entities() does not call v4l2_ctrl_handler_free() when
it fails.
Add the missed function to fix it.

Fixes: de1135d44f4f ("[media] omap3isp: CCDC, preview engine and resizer")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/omap3isp/isppreview.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c
index c9e8845de1b1..c3336a2cbe14 100644
--- a/drivers/media/platform/omap3isp/isppreview.c
+++ b/drivers/media/platform/omap3isp/isppreview.c
@@ -2285,7 +2285,7 @@ static int preview_init_entities(struct isp_prev_device *prev)
 	me->ops = &preview_media_ops;
 	ret = media_entity_init(me, PREV_PADS_NUM, pads, 0);
 	if (ret < 0)
-		return ret;
+		goto error_handler_free;
 
 	preview_init_formats(sd, NULL);
 
@@ -2331,6 +2331,8 @@ static int preview_init_entities(struct isp_prev_device *prev)
 	omap3isp_video_cleanup(&prev->video_in);
 error_video_in:
 	media_entity_cleanup(&prev->subdev.entity);
+error_handler_free:
+	v4l2_ctrl_handler_free(&prev->ctrls);
 	return ret;
 }
 

From 0e59449ff94aff9207bc8a5f6c0d7409b1d48dd7 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Thu, 25 Jun 2020 22:47:30 +0200
Subject: [PATCH 0350/2658] scsi: cumana_2: Fix different dev_id between
 request_irq() and free_irq()

[ Upstream commit 040ab9c4fd0070cd5fa71ba3a7b95b8470db9b4d ]

The dev_id used in request_irq() and free_irq() should match.  Use 'info'
in both cases.

Link: https://lore.kernel.org/r/20200625204730.943520-1-christophe.jaillet@wanadoo.fr
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Acked-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/arm/cumana_2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/arm/cumana_2.c b/drivers/scsi/arm/cumana_2.c
index faa1bee07c8a..0c83a155ceeb 100644
--- a/drivers/scsi/arm/cumana_2.c
+++ b/drivers/scsi/arm/cumana_2.c
@@ -454,7 +454,7 @@ static int cumanascsi2_probe(struct expansion_card *ec,
 
 	if (info->info.scsi.dma != NO_DMA)
 		free_dma(info->info.scsi.dma);
-	free_irq(ec->irq, host);
+	free_irq(ec->irq, info);
 
  out_release:
 	fas216_release(host);

From f49ac6ed6eb23780ae844ffe36aeab95629bbaff Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38@huawei.com>
Date: Tue, 2 Jun 2020 20:07:33 +0800
Subject: [PATCH 0351/2658] cxl: Fix kobject memleak

[ Upstream commit 85c5cbeba8f4fb28e6b9bfb3e467718385f78f76 ]

Currently the error return path from kobject_init_and_add() is not
followed by a call to kobject_put() - which means we are leaking
the kobject.

Fix it by adding a call to kobject_put() in the error path of
kobject_init_and_add().

Fixes: b087e6190ddc ("cxl: Export optional AFU configuration record in sysfs")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Acked-by: Andrew Donnellan <ajd@linux.ibm.com>
Acked-by: Frederic Barrat <fbarrat@linux.ibm.com>
Link: https://lore.kernel.org/r/20200602120733.5943-1-wanghai38@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/cxl/sysfs.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c
index 02006f7109a8..ce292d7766db 100644
--- a/drivers/misc/cxl/sysfs.c
+++ b/drivers/misc/cxl/sysfs.c
@@ -539,7 +539,7 @@ static struct afu_config_record *cxl_sysfs_afu_new_cr(struct cxl_afu *afu, int c
 	rc = kobject_init_and_add(&cr->kobj, &afu_config_record_type,
 				  &afu->dev.kobj, "cr%i", cr->cr);
 	if (rc)
-		goto err;
+		goto err1;
 
 	rc = sysfs_create_bin_file(&cr->kobj, &cr->config_attr);
 	if (rc)
@@ -555,9 +555,6 @@ static struct afu_config_record *cxl_sysfs_afu_new_cr(struct cxl_afu *afu, int c
 err1:
 	kobject_put(&cr->kobj);
 	return ERR_PTR(rc);
-err:
-	kfree(cr);
-	return ERR_PTR(rc);
 }
 
 void cxl_sysfs_afu_remove(struct cxl_afu *afu)

From 7b96b559daab486085a5339b8298ffce17ad8253 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Wed, 24 Jun 2020 13:07:10 +0100
Subject: [PATCH 0352/2658] drm/radeon: fix array out-of-bounds read and write
 issues

[ Upstream commit 7ee78aff9de13d5dccba133f4a0de5367194b243 ]

There is an off-by-one bounds check on the index into arrays
table->mc_reg_address and table->mc_reg_table_entry[k].mc_data[j] that
can lead to reads and writes outside of arrays. Fix the bound checking
off-by-one error.

Addresses-Coverity: ("Out-of-bounds read/write")
Fixes: cc8dbbb4f62a ("drm/radeon: add dpm support for CI dGPUs (v2)")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/radeon/ci_dpm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index e7a245d7bdbc..8e1bf9ed8eff 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -4345,7 +4345,7 @@ static int ci_set_mc_special_registers(struct radeon_device *rdev,
 					table->mc_reg_table_entry[k].mc_data[j] |= 0x100;
 			}
 			j++;
-			if (j > SMU7_DISCRETE_MC_REGISTER_ARRAY_SIZE)
+			if (j >= SMU7_DISCRETE_MC_REGISTER_ARRAY_SIZE)
 				return -EINVAL;
 
 			if (!pi->mem_gddr5) {

From 5ad6ea5a8850ea20689c5b5de5cd74ee9f991cdf Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Fri, 26 Jun 2020 05:59:48 +0200
Subject: [PATCH 0353/2658] scsi: powertec: Fix different dev_id between
 request_irq() and free_irq()

[ Upstream commit d179f7c763241c1dc5077fca88ddc3c47d21b763 ]

The dev_id used in request_irq() and free_irq() should match. Use 'info' in
both cases.

Link: https://lore.kernel.org/r/20200626035948.944148-1-christophe.jaillet@wanadoo.fr
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/arm/powertec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/arm/powertec.c b/drivers/scsi/arm/powertec.c
index 5e1b73e1b743..b6724ba9b36e 100644
--- a/drivers/scsi/arm/powertec.c
+++ b/drivers/scsi/arm/powertec.c
@@ -382,7 +382,7 @@ static int powertecscsi_probe(struct expansion_card *ec,
 
 	if (info->info.scsi.dma != NO_DMA)
 		free_dma(info->info.scsi.dma);
-	free_irq(ec->irq, host);
+	free_irq(ec->irq, info);
 
  out_release:
 	fas216_release(host);

From 2ed1751aeffec61035259a982a1590623544cffa Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Fri, 26 Jun 2020 06:05:53 +0200
Subject: [PATCH 0354/2658] scsi: eesox: Fix different dev_id between
 request_irq() and free_irq()

[ Upstream commit 86f2da1112ccf744ad9068b1d5d9843faf8ddee6 ]

The dev_id used in request_irq() and free_irq() should match. Use 'info' in
both cases.

Link: https://lore.kernel.org/r/20200626040553.944352-1-christophe.jaillet@wanadoo.fr
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/arm/eesox.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/arm/eesox.c b/drivers/scsi/arm/eesox.c
index a8ad6880dd91..cf01442d9136 100644
--- a/drivers/scsi/arm/eesox.c
+++ b/drivers/scsi/arm/eesox.c
@@ -575,7 +575,7 @@ static int eesoxscsi_probe(struct expansion_card *ec, const struct ecard_id *id)
 
 	if (info->info.scsi.dma != NO_DMA)
 		free_dma(info->info.scsi.dma);
-	free_irq(ec->irq, host);
+	free_irq(ec->irq, info);
 
  out_remove:
 	fas216_remove(host);

From 7ba12b6dd9faaf0928e1c21746b5a55400efceae Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 8 May 2020 16:40:22 +0200
Subject: [PATCH 0355/2658] media: firewire: Using uninitialized values in
 node_probe()

[ Upstream commit 2505a210fc126599013aec2be741df20aaacc490 ]

If fw_csr_string() returns -ENOENT, then "name" is uninitialized.  So
then the "strlen(model_names[i]) <= name_len" is true because strlen()
is unsigned and -ENOENT is type promoted to a very high positive value.
Then the "strncmp(name, model_names[i], name_len)" uses uninitialized
data because "name" is uninitialized.

Fixes: 92374e886c75 ("[media] firedtv: drop obsolete backend abstraction")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/firewire/firedtv-fw.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/firewire/firedtv-fw.c b/drivers/media/firewire/firedtv-fw.c
index 247f0e7cb5f7..5d634706a7ea 100644
--- a/drivers/media/firewire/firedtv-fw.c
+++ b/drivers/media/firewire/firedtv-fw.c
@@ -271,6 +271,8 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id)
 
 	name_len = fw_csr_string(unit->directory, CSR_MODEL,
 				 name, sizeof(name));
+	if (name_len < 0)
+		return name_len;
 	for (i = ARRAY_SIZE(model_names); --i; )
 		if (strlen(model_names[i]) <= name_len &&
 		    strncmp(name, model_names[i], name_len) == 0)

From 42402bb0444ce9acc46f6d366144001fa4ac056c Mon Sep 17 00:00:00 2001
From: Chuhong Yuan <hslester96@gmail.com>
Date: Thu, 28 May 2020 08:41:47 +0200
Subject: [PATCH 0356/2658] media: exynos4-is: Add missed check for
 pinctrl_lookup_state()

[ Upstream commit 18ffec750578f7447c288647d7282c7d12b1d969 ]

fimc_md_get_pinctrl() misses a check for pinctrl_lookup_state().
Add the missed check to fix it.

Fixes: 4163851f7b99 ("[media] s5p-fimc: Use pinctrl API for camera ports configuration]")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/exynos4-is/media-dev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
index 4f5586a4cbff..31cc7d94064e 100644
--- a/drivers/media/platform/exynos4-is/media-dev.c
+++ b/drivers/media/platform/exynos4-is/media-dev.c
@@ -1172,6 +1172,9 @@ static int fimc_md_get_pinctrl(struct fimc_md *fmd)
 
 	pctl->state_idle = pinctrl_lookup_state(pctl->pinctrl,
 					PINCTRL_STATE_IDLE);
+	if (IS_ERR(pctl->state_idle))
+		return PTR_ERR(pctl->state_idle);
+
 	return 0;
 }
 

From afeedc9dd9ed8558000558d9b902bea3b929093e Mon Sep 17 00:00:00 2001
From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Date: Sun, 12 Jul 2020 01:53:17 +0300
Subject: [PATCH 0357/2658] drm: panel: simple: Fix bpc for LG LB070WV8 panel

[ Upstream commit a6ae2fe5c9f9fd355a48fb7d21c863e5b20d6c9c ]

The LG LB070WV8 panel incorrectly reports a 16 bits per component value,
while the panel uses 8 bits per component. Fix it.

Fixes: dd0150026901 ("drm/panel: simple: Add support for LG LB070WV8 800x480 7" panel")
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20200711225317.28476-1-laurent.pinchart+renesas@ideasonboard.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-simple.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
index ecad4d7c6cd1..64b23bdebd1d 100644
--- a/drivers/gpu/drm/panel/panel-simple.c
+++ b/drivers/gpu/drm/panel/panel-simple.c
@@ -920,7 +920,7 @@ static const struct drm_display_mode lg_lb070wv8_mode = {
 static const struct panel_desc lg_lb070wv8 = {
 	.modes = &lg_lb070wv8_mode,
 	.num_modes = 1,
-	.bpc = 16,
+	.bpc = 8,
 	.size = {
 		.width = 151,
 		.height = 91,

From f49a871c0ba69ecf519379f9b1498a0d0b2cad1b Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 8 Jul 2020 14:58:57 +0300
Subject: [PATCH 0358/2658] mwifiex: Prevent memory corruption handling keys

[ Upstream commit e18696786548244914f36ec3c46ac99c53df99c3 ]

The length of the key comes from the network and it's a 16 bit number.  It
needs to be capped to prevent a buffer overflow.

Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Ganapathi Bhat <ganapathi.bhat@nxp.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200708115857.GA13729@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mwifiex/sta_cmdresp.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index 9ac7aa2431b4..9e3853c8a22d 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -592,6 +592,11 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv,
 {
 	struct host_cmd_ds_802_11_key_material *key =
 						&resp->params.key_material;
+	int len;
+
+	len = le16_to_cpu(key->key_param_set.key_len);
+	if (len > sizeof(key->key_param_set.key))
+		return -EINVAL;
 
 	if (le16_to_cpu(key->action) == HostCmd_ACT_GEN_SET) {
 		if ((le16_to_cpu(key->key_param_set.key_info) & KEY_MCAST)) {
@@ -605,9 +610,8 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv,
 
 	memset(priv->aes_key.key_param_set.key, 0,
 	       sizeof(key->key_param_set.key));
-	priv->aes_key.key_param_set.key_len = key->key_param_set.key_len;
-	memcpy(priv->aes_key.key_param_set.key, key->key_param_set.key,
-	       le16_to_cpu(priv->aes_key.key_param_set.key_len));
+	priv->aes_key.key_param_set.key_len = cpu_to_le16(len);
+	memcpy(priv->aes_key.key_param_set.key, key->key_param_set.key, len);
 
 	return 0;
 }
@@ -622,9 +626,14 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,
 					      struct host_cmd_ds_command *resp)
 {
 	struct host_cmd_ds_802_11_key_material_v2 *key_v2;
-	__le16 len;
+	int len;
 
 	key_v2 = &resp->params.key_material_v2;
+
+	len = le16_to_cpu(key_v2->key_param_set.key_params.aes.key_len);
+	if (len > WLAN_KEY_LEN_CCMP)
+		return -EINVAL;
+
 	if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) {
 		if ((le16_to_cpu(key_v2->key_param_set.key_info) & KEY_MCAST)) {
 			mwifiex_dbg(priv->adapter, INFO, "info: key: GTK is set\n");
@@ -640,10 +649,9 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,
 	memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0,
 	       WLAN_KEY_LEN_CCMP);
 	priv->aes_key_v2.key_param_set.key_params.aes.key_len =
-				key_v2->key_param_set.key_params.aes.key_len;
-	len = priv->aes_key_v2.key_param_set.key_params.aes.key_len;
+				cpu_to_le16(len);
 	memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key,
-	       key_v2->key_param_set.key_params.aes.key, le16_to_cpu(len));
+	       key_v2->key_param_set.key_params.aes.key, len);
 
 	return 0;
 }

From ac9ea317c42f413a0ce604b3e3d7e94c2ae186f2 Mon Sep 17 00:00:00 2001
From: Milton Miller <miltonm@us.ibm.com>
Date: Thu, 16 Jul 2020 09:37:04 +1000
Subject: [PATCH 0359/2658] powerpc/vdso: Fix vdso cpu truncation

[ Upstream commit a9f675f950a07d5c1dbcbb97aabac56f5ed085e3 ]

The code in vdso_cpu_init that exposes the cpu and numa node to
userspace via SPRG_VDSO incorrctly masks the cpu to 12 bits. This means
that any kernel running on a box with more than 4096 threads (NR_CPUS
advertises a limit of of 8192 cpus) would expose userspace to two cpu
contexts running at the same time with the same cpu number.

Note: I'm not aware of any distro shipping a kernel with support for more
than 4096 threads today, nor of any system image that currently exceeds
4096 threads. Found via code browsing.

Fixes: 18ad51dd342a7eb09dbcd059d0b451b616d4dafc ("powerpc: Add VDSO version of getcpu")
Signed-off-by: Milton Miller <miltonm@us.ibm.com>
Signed-off-by: Anton Blanchard <anton@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200715233704.1352257-1-anton@ozlabs.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/vdso.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
index b457bfa28436..05c17429e544 100644
--- a/arch/powerpc/kernel/vdso.c
+++ b/arch/powerpc/kernel/vdso.c
@@ -702,7 +702,7 @@ int vdso_getcpu_init(void)
 	node = cpu_to_node(cpu);
 	WARN_ON_ONCE(node > 0xffff);
 
-	val = (cpu & 0xfff) | ((node & 0xffff) << 16);
+	val = (cpu & 0xffff) | ((node & 0xffff) << 16);
 	mtspr(SPRN_SPRG_VDSO_WRITE, val);
 	get_paca()->sprg_vdso = val;
 

From 9086c33050024b099f80c762e292dbf3612cf475 Mon Sep 17 00:00:00 2001
From: Xiongfeng Wang <wangxiongfeng2@huawei.com>
Date: Fri, 17 Jul 2020 15:59:25 +0800
Subject: [PATCH 0360/2658] PCI/ASPM: Add missing newline in sysfs 'policy'

[ Upstream commit 3167e3d340c092fd47924bc4d23117a3074ef9a9 ]

When I cat ASPM parameter 'policy' by sysfs, it displays as follows.  Add a
newline for easy reading.  Other sysfs attributes already include a
newline.

  [root@localhost ~]# cat /sys/module/pcie_aspm/parameters/policy
  [default] performance powersave powersupersave [root@localhost ~]#

Fixes: 7d715a6c1ae5 ("PCI: add PCI Express ASPM support")
Link: https://lore.kernel.org/r/1594972765-10404-1-git-send-email-wangxiongfeng2@huawei.com
Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pcie/aspm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index 966b6947e565..a098f8324afd 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -807,6 +807,7 @@ static int pcie_aspm_get_policy(char *buffer, struct kernel_param *kp)
 			cnt += sprintf(buffer + cnt, "[%s] ", policy_str[i]);
 		else
 			cnt += sprintf(buffer + cnt, "%s ", policy_str[i]);
+	cnt += sprintf(buffer + cnt, "\n");
 	return cnt;
 }
 

From 9c2f09f0e4cd35e74455f0fd3efb5e69597b9db3 Mon Sep 17 00:00:00 2001
From: Marek Szyprowski <m.szyprowski@samsung.com>
Date: Thu, 16 Jul 2020 14:09:48 +0200
Subject: [PATCH 0361/2658] usb: dwc2: Fix error path in gadget registration

[ Upstream commit 33a06f1300a79cfd461cea0268f05e969d4f34ec ]

When gadget registration fails, one should not call usb_del_gadget_udc().
Ensure this by setting gadget->udc to NULL. Also in case of a failure
there is no need to disable low-level hardware, so return immiedetly
instead of jumping to error_init label.

This fixes the following kernel NULL ptr dereference on gadget failure
(can be easily triggered with g_mass_storage without any module
parameters):

dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter besl=1
dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter g_np_tx_fifo_size=1024
dwc2 12480000.hsotg: EPs: 16, dedicated fifos, 7808 entries in SPRAM
Mass Storage Function, version: 2009/09/11
LUN: removable file: (no medium)
no file given for LUN0
g_mass_storage 12480000.hsotg: failed to start g_mass_storage: -22
8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000104
pgd = (ptrval)
[00000104] *pgd=00000000
Internal error: Oops: 805 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.8.0-rc5 #3133
Hardware name: Samsung Exynos (Flattened Device Tree)
Workqueue: events deferred_probe_work_func
PC is at usb_del_gadget_udc+0x38/0xc4
LR is at __mutex_lock+0x31c/0xb18
...
Process kworker/0:1 (pid: 12, stack limit = 0x(ptrval))
Stack: (0xef121db0 to 0xef122000)
...
[<c076bf3c>] (usb_del_gadget_udc) from [<c0726bec>] (dwc2_hsotg_remove+0x10/0x20)
[<c0726bec>] (dwc2_hsotg_remove) from [<c0711208>] (dwc2_driver_probe+0x57c/0x69c)
[<c0711208>] (dwc2_driver_probe) from [<c06247c0>] (platform_drv_probe+0x6c/0xa4)
[<c06247c0>] (platform_drv_probe) from [<c0621df4>] (really_probe+0x200/0x48c)
[<c0621df4>] (really_probe) from [<c06221e8>] (driver_probe_device+0x78/0x1fc)
[<c06221e8>] (driver_probe_device) from [<c061fcd4>] (bus_for_each_drv+0x74/0xb8)
[<c061fcd4>] (bus_for_each_drv) from [<c0621b54>] (__device_attach+0xd4/0x16c)
[<c0621b54>] (__device_attach) from [<c0620c98>] (bus_probe_device+0x88/0x90)
[<c0620c98>] (bus_probe_device) from [<c06211b0>] (deferred_probe_work_func+0x3c/0xd0)
[<c06211b0>] (deferred_probe_work_func) from [<c0149280>] (process_one_work+0x234/0x7dc)
[<c0149280>] (process_one_work) from [<c014986c>] (worker_thread+0x44/0x51c)
[<c014986c>] (worker_thread) from [<c0150b1c>] (kthread+0x158/0x1a0)
[<c0150b1c>] (kthread) from [<c0100114>] (ret_from_fork+0x14/0x20)
Exception stack(0xef121fb0 to 0xef121ff8)
...
---[ end trace 9724c2fc7cc9c982 ]---

While fixing this also fix the double call to dwc2_lowlevel_hw_disable()
if dr_mode is set to USB_DR_MODE_PERIPHERAL. In such case low-level
hardware is already disabled before calling usb_add_gadget_udc(). That
function correctly preserves low-level hardware state, there is no need
for the second unconditional dwc2_lowlevel_hw_disable() call.

Fixes: 207324a321a8 ("usb: dwc2: Postponed gadget registration to the udc class driver")
Acked-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc2/platform.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
index 5e554b1d5a8f..d9fafd6a7927 100644
--- a/drivers/usb/dwc2/platform.c
+++ b/drivers/usb/dwc2/platform.c
@@ -458,6 +458,7 @@ static int dwc2_driver_probe(struct platform_device *dev)
 	if (hsotg->gadget_enabled) {
 		retval = usb_add_gadget_udc(hsotg->dev, &hsotg->gadget);
 		if (retval) {
+			hsotg->gadget.udc = NULL;
 			dwc2_hsotg_remove(hsotg);
 			goto error;
 		}
@@ -466,7 +467,8 @@ static int dwc2_driver_probe(struct platform_device *dev)
 	return 0;
 
 error:
-	dwc2_lowlevel_hw_disable(hsotg);
+	if (hsotg->dr_mode != USB_DR_MODE_PERIPHERAL)
+		dwc2_lowlevel_hw_disable(hsotg);
 	return retval;
 }
 

From 7a10efc60055f83712d021e1df7939a87d3f495f Mon Sep 17 00:00:00 2001
From: Finn Thain <fthain@telegraphics.com.au>
Date: Thu, 23 Jul 2020 09:25:51 +1000
Subject: [PATCH 0362/2658] scsi: mesh: Fix panic after host or bus reset

[ Upstream commit edd7dd2292ab9c3628b65c4d04514c3068ad54f6 ]

Booting Linux with a Conner CP3200 drive attached to the MESH SCSI bus
results in EH measures and a panic:

[   25.499838] mesh: configured for synchronous 5 MB/s
[   25.787154] mesh: performing initial bus reset...
[   29.867115] scsi host0: MESH
[   29.929527] mesh: target 0 synchronous at 3.6 MB/s
[   29.998763] scsi 0:0:0:0: Direct-Access     CONNER   CP3200-200mb-3.5 4040 PQ: 0 ANSI: 1 CCS
[   31.989975] sd 0:0:0:0: [sda] 415872 512-byte logical blocks: (213 MB/203 MiB)
[   32.070975] sd 0:0:0:0: [sda] Write Protect is off
[   32.137197] sd 0:0:0:0: [sda] Mode Sense: 5b 00 00 08
[   32.209661] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[   32.332708]  sda: [mac] sda1 sda2 sda3
[   32.417733] sd 0:0:0:0: [sda] Attached SCSI disk
... snip ...
[   76.687067] mesh_abort((ptrval))
[   76.743606] mesh: state at (ptrval), regs at (ptrval), dma at (ptrval)
[   76.810798]     ct=6000 seq=86 bs=4017 fc= 0 exc= 0 err= 0 im= 7 int= 0 sp=85
[   76.880720]     dma stat=84e0 cmdptr=1f73d000
[   76.941387]     phase=4 msgphase=0 conn_tgt=0 data_ptr=24576
[   77.005567]     dma_st=1 dma_ct=0 n_msgout=0
[   77.065456]     target 0: req=(ptrval) goes_out=0 saved_ptr=0
[   77.130512] mesh_abort((ptrval))
[   77.187670] mesh: state at (ptrval), regs at (ptrval), dma at (ptrval)
[   77.255594]     ct=6000 seq=86 bs=4017 fc= 0 exc= 0 err= 0 im= 7 int= 0 sp=85
[   77.325778]     dma stat=84e0 cmdptr=1f73d000
[   77.387239]     phase=4 msgphase=0 conn_tgt=0 data_ptr=24576
[   77.453665]     dma_st=1 dma_ct=0 n_msgout=0
[   77.515900]     target 0: req=(ptrval) goes_out=0 saved_ptr=0
[   77.582902] mesh_host_reset
[   88.187083] Kernel panic - not syncing: mesh: double DMA start !
[   88.254510] CPU: 0 PID: 358 Comm: scsi_eh_0 Not tainted 5.6.13-pmac #1
[   88.323302] Call Trace:
[   88.378854] [e16ddc58] [c0027080] panic+0x13c/0x308 (unreliable)
[   88.446221] [e16ddcb8] [c02b2478] mesh_start.part.12+0x130/0x414
[   88.513298] [e16ddcf8] [c02b2fc8] mesh_queue+0x54/0x70
[   88.577097] [e16ddd18] [c02a1848] scsi_send_eh_cmnd+0x374/0x384
[   88.643476] [e16dddc8] [c02a1938] scsi_eh_tur+0x5c/0xb8
[   88.707878] [e16dddf8] [c02a1ab8] scsi_eh_test_devices+0x124/0x178
[   88.775663] [e16dde28] [c02a2094] scsi_eh_ready_devs+0x588/0x8a8
[   88.843124] [e16dde98] [c02a31d8] scsi_error_handler+0x344/0x520
[   88.910697] [e16ddf08] [c00409c8] kthread+0xe4/0xe8
[   88.975166] [e16ddf38] [c000f234] ret_from_kernel_thread+0x14/0x1c
[   89.044112] Rebooting in 180 seconds..

In theory, a panic can happen after a bus or host reset with dma_started
flag set. Fix this by halting the DMA before reinitializing the host.
Don't assume that ms->current_req is set when halt_dma() is invoked as it
may not hold for bus or host reset.

BTW, this particular Conner drive can be made to work by inhibiting
disconnect/reselect with 'mesh.resel_targets=0'.

Link: https://lore.kernel.org/r/3952bc691e150a7128b29120999b6092071b039a.1595460351.git.fthain@telegraphics.com.au
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: Paul Mackerras <paulus@ozlabs.org>
Reported-and-tested-by: Stan Johnson <userm57@yahoo.com>
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/mesh.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/mesh.c b/drivers/scsi/mesh.c
index 555367f00228..18ed4b44bc51 100644
--- a/drivers/scsi/mesh.c
+++ b/drivers/scsi/mesh.c
@@ -1044,6 +1044,8 @@ static void handle_error(struct mesh_state *ms)
 		while ((in_8(&mr->bus_status1) & BS1_RST) != 0)
 			udelay(1);
 		printk("done\n");
+		if (ms->dma_started)
+			halt_dma(ms);
 		handle_reset(ms);
 		/* request_q is empty, no point in mesh_start() */
 		return;
@@ -1356,7 +1358,8 @@ static void halt_dma(struct mesh_state *ms)
 		       ms->conn_tgt, ms->data_ptr, scsi_bufflen(cmd),
 		       ms->tgts[ms->conn_tgt].data_goes_out);
 	}
-	scsi_dma_unmap(cmd);
+	if (cmd)
+		scsi_dma_unmap(cmd);
 	ms->dma_started = 0;
 }
 
@@ -1711,6 +1714,9 @@ static int mesh_host_reset(struct scsi_cmnd *cmd)
 
 	spin_lock_irqsave(ms->host->host_lock, flags);
 
+	if (ms->dma_started)
+		halt_dma(ms);
+
 	/* Reset the controller & dbdma channel */
 	out_le32(&md->control, (RUN|PAUSE|FLUSH|WAKE) << 16);	/* stop dma */
 	out_8(&mr->exception, 0xff);	/* clear all exception bits */

From 95d11cdceb7c9186a34d00e0e73ca43692ab5188 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 23 Jul 2020 18:22:19 +0300
Subject: [PATCH 0363/2658] Smack: fix another vsscanf out of bounds

[ Upstream commit a6bd4f6d9b07452b0b19842044a6c3ea384b0b88 ]

This is similar to commit 84e99e58e8d1 ("Smack: slab-out-of-bounds in
vsscanf") where we added a bounds check on "rule".

Reported-by: syzbot+a22c6092d003d6fe1122@syzkaller.appspotmail.com
Fixes: f7112e6c9abf ("Smack: allow for significantly longer Smack labels v4")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/smack/smackfs.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index bd4d0f5a79aa..2e2ef3a525ec 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -939,6 +939,10 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
 
 	for (i = 0; i < catlen; i++) {
 		rule += SMK_DIGITLEN;
+		if (rule > data + count) {
+			rc = -EOVERFLOW;
+			goto out;
+		}
 		ret = sscanf(rule, "%u", &cat);
 		if (ret != 1 || cat > SMACK_CIPSO_MAXCATNUM)
 			goto out;

From 06d27e139fcc844038fed2865a4701aa0085ac58 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 23 Jul 2020 18:23:05 +0300
Subject: [PATCH 0364/2658] Smack: prevent underflow in smk_set_cipso()

[ Upstream commit 42a2df3e829f3c5562090391b33714b2e2e5ad4a ]

We have an upper bound on "maplevel" but forgot to check for negative
values.

Fixes: e114e473771c ("Smack: Simplified Mandatory Access Control Kernel")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/smack/smackfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 2e2ef3a525ec..df082648eb0a 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -918,7 +918,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
 	}
 
 	ret = sscanf(rule, "%d", &maplevel);
-	if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL)
+	if (ret != 1 || maplevel < 0 || maplevel > SMACK_CIPSO_MAXLEVEL)
 		goto out;
 
 	rule += SMK_DIGITLEN;

From bbf8cec14c2606ee002bd389a6129b709a3476ae Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Sun, 12 Jul 2020 12:23:51 -0700
Subject: [PATCH 0365/2658] power: supply: check if calc_soc succeeded in
 pm860x_init_battery

[ Upstream commit ccf193dee1f0fff55b556928591f7818bac1b3b1 ]

clang static analysis flags this error

88pm860x_battery.c:522:19: warning: Assigned value is
  garbage or undefined [core.uninitialized.Assign]
                info->start_soc = soc;
                                ^ ~~~
soc is set by calling calc_soc.
But calc_soc can return without setting soc.

So check the return status and bail similarly to other
checks in pm860x_init_battery and initialize soc to
silence the warning.

Fixes: a830d28b48bf ("power_supply: Enable battery-charger for 88pm860x")

Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/88pm860x_battery.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/power/88pm860x_battery.c b/drivers/power/88pm860x_battery.c
index 63c57dc82ac1..4eda5065b5bb 100644
--- a/drivers/power/88pm860x_battery.c
+++ b/drivers/power/88pm860x_battery.c
@@ -436,7 +436,7 @@ static void pm860x_init_battery(struct pm860x_battery_info *info)
 	int ret;
 	int data;
 	int bat_remove;
-	int soc;
+	int soc = 0;
 
 	/* measure enable on GPADC1 */
 	data = MEAS1_GP1;
@@ -499,7 +499,9 @@ static void pm860x_init_battery(struct pm860x_battery_info *info)
 	}
 	mutex_unlock(&info->lock);
 
-	calc_soc(info, OCV_MODE_ACTIVE, &soc);
+	ret = calc_soc(info, OCV_MODE_ACTIVE, &soc);
+	if (ret < 0)
+		goto out;
 
 	data = pm860x_reg_read(info->i2c, PM8607_POWER_UP_LOG);
 	bat_remove = data & BAT_WU_LOG;

From 1c38703a00da28dcc8c3029a0e8390ef291b80d0 Mon Sep 17 00:00:00 2001
From: Julian Wiedmann <jwi@linux.ibm.com>
Date: Thu, 30 Jul 2020 17:01:20 +0200
Subject: [PATCH 0366/2658] s390/qeth: don't process empty bridge port events

[ Upstream commit 02472e28b9a45471c6d8729ff2c7422baa9be46a ]

Discard events that don't contain any entries. This shouldn't happen,
but subsequent code relies on being able to use entry 0. So better
be safe than accessing garbage.

Fixes: b4d72c08b358 ("qeth: bridgeport support - basic control")
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/net/qeth_l2_main.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 97211f7f0cf0..ed4b0f6e2d6a 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -1669,6 +1669,10 @@ static void qeth_bridge_state_change(struct qeth_card *card,
 	int extrasize;
 
 	QETH_CARD_TEXT(card, 2, "brstchng");
+	if (qports->num_entries == 0) {
+		QETH_CARD_TEXT(card, 2, "BPempty");
+		return;
+	}
 	if (qports->entry_length != sizeof(struct qeth_sbp_port_entry)) {
 		QETH_CARD_TEXT_(card, 2, "BPsz%04x", qports->entry_length);
 		return;

From a1767f4b49a990fd9ed6a37434307237eadb36b5 Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38@huawei.com>
Date: Thu, 30 Jul 2020 15:39:39 +0800
Subject: [PATCH 0367/2658] wl1251: fix always return 0 error

[ Upstream commit 20e6421344b5bc2f97b8e2db47b6994368417904 ]

wl1251_event_ps_report() should not always return 0 because
wl1251_ps_set_mode() may fail. Change it to return 'ret'.

Fixes: f7ad1eed4d4b ("wl1251: retry power save entry")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200730073939.33704-1-wanghai38@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ti/wl1251/event.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ti/wl1251/event.c b/drivers/net/wireless/ti/wl1251/event.c
index c98630394a1a..26bf3e2b750d 100644
--- a/drivers/net/wireless/ti/wl1251/event.c
+++ b/drivers/net/wireless/ti/wl1251/event.c
@@ -80,7 +80,7 @@ static int wl1251_event_ps_report(struct wl1251 *wl,
 		break;
 	}
 
-	return 0;
+	return ret;
 }
 
 static void wl1251_event_mbox_dump(struct event_mailbox *mbox)

From 3bf395b02c7d9bf1273457b4dedcd20e59e2bcaa Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sun, 2 Aug 2020 15:53:33 +0200
Subject: [PATCH 0368/2658] net: spider_net: Fix the size used in a
 'dma_free_coherent()' call

[ Upstream commit 36f28f7687a9ce665479cce5d64ce7afaa9e77ae ]

Update the size used in 'dma_free_coherent()' in order to match the one
used in the corresponding 'dma_alloc_coherent()', in
'spider_net_init_chain()'.

Fixes: d4ed8f8d1fb7 ("Spidernet DMA coalescing")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/toshiba/spider_net.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c
index 8e53211aedd8..53600e28d93b 100644
--- a/drivers/net/ethernet/toshiba/spider_net.c
+++ b/drivers/net/ethernet/toshiba/spider_net.c
@@ -297,8 +297,8 @@ spider_net_free_chain(struct spider_net_card *card,
 		descr = descr->next;
 	} while (descr != chain->ring);
 
-	dma_free_coherent(&card->pdev->dev, chain->num_desc,
-	    chain->hwring, chain->dma_addr);
+	dma_free_coherent(&card->pdev->dev, chain->num_desc * sizeof(struct spider_net_hw_descr),
+			  chain->hwring, chain->dma_addr);
 }
 
 /**

From 98f856aa38553a71da36300439874b5807fdf723 Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38@huawei.com>
Date: Mon, 15 Jun 2020 11:25:33 +0800
Subject: [PATCH 0369/2658] dlm: Fix kobject memleak

[ Upstream commit 0ffddafc3a3970ef7013696e7f36b3d378bc4c16 ]

Currently the error return path from kobject_init_and_add() is not
followed by a call to kobject_put() - which means we are leaking
the kobject.

Set do_unreg = 1 before kobject_init_and_add() to ensure that
kobject_put() can be called in its error patch.

Fixes: 901195ed7f4b ("Kobject: change GFS2 to use kobject_init_and_add")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/dlm/lockspace.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
index b14bb2c46042..499f54f99891 100644
--- a/fs/dlm/lockspace.c
+++ b/fs/dlm/lockspace.c
@@ -626,6 +626,9 @@ static int new_lockspace(const char *name, const char *cluster,
 	wait_event(ls->ls_recover_lock_wait,
 		   test_bit(LSFL_RECOVER_LOCK, &ls->ls_flags));
 
+	/* let kobject handle freeing of ls if there's an error */
+	do_unreg = 1;
+
 	ls->ls_kobj.kset = dlm_kset;
 	error = kobject_init_and_add(&ls->ls_kobj, &dlm_ktype, NULL,
 				     "%s", ls->ls_name);
@@ -633,9 +636,6 @@ static int new_lockspace(const char *name, const char *cluster,
 		goto out_recoverd;
 	kobject_uevent(&ls->ls_kobj, KOBJ_ADD);
 
-	/* let kobject handle freeing of ls if there's an error */
-	do_unreg = 1;
-
 	/* This uevent triggers dlm_controld in userspace to add us to the
 	   group of nodes that are members of this lockspace (managed by the
 	   cluster infrastructure.)  Once it's done that, it tells us who the

From 3f9a6f2da27c23630e1ca9c18ee29c5ec2bdf9aa Mon Sep 17 00:00:00 2001
From: Drew Fustini <drew@beagleboard.org>
Date: Mon, 8 Jun 2020 14:51:43 +0200
Subject: [PATCH 0370/2658] pinctrl-single: fix pcs_parse_pinconf() return
 value

[ Upstream commit f46fe79ff1b65692a65266a5bec6dbe2bf7fc70f ]

This patch causes pcs_parse_pinconf() to return -ENOTSUPP when no
pinctrl_map is added.  The current behavior is to return 0 when
!PCS_HAS_PINCONF or !nconfs.  Thus pcs_parse_one_pinctrl_entry()
incorrectly assumes that a map was added and sets num_maps = 2.

Analysis:
=========
The function pcs_parse_one_pinctrl_entry() calls pcs_parse_pinconf()
if PCS_HAS_PINCONF is enabled.  The function pcs_parse_pinconf()
returns 0 to indicate there was no error and num_maps is then set to 2:

 980 static int pcs_parse_one_pinctrl_entry(struct pcs_device *pcs,
 981                                                 struct device_node *np,
 982                                                 struct pinctrl_map **map,
 983                                                 unsigned *num_maps,
 984                                                 const char **pgnames)
 985 {
<snip>
1053         (*map)->type = PIN_MAP_TYPE_MUX_GROUP;
1054         (*map)->data.mux.group = np->name;
1055         (*map)->data.mux.function = np->name;
1056
1057         if (PCS_HAS_PINCONF && function) {
1058                 res = pcs_parse_pinconf(pcs, np, function, map);
1059                 if (res)
1060                         goto free_pingroups;
1061                 *num_maps = 2;
1062         } else {
1063                 *num_maps = 1;
1064         }

However, pcs_parse_pinconf() will also return 0 if !PCS_HAS_PINCONF or
!nconfs.  I believe these conditions should indicate that no map was
added by returning -ENOTSUPP. Otherwise pcs_parse_one_pinctrl_entry()
will set num_maps = 2 even though no maps were successfully added, as
it does not reach "m++" on line 940:

 895 static int pcs_parse_pinconf(struct pcs_device *pcs, struct device_node *np,
 896                              struct pcs_function *func,
 897                              struct pinctrl_map **map)
 898
 899 {
 900         struct pinctrl_map *m = *map;
<snip>
 917         /* If pinconf isn't supported, don't parse properties in below. */
 918         if (!PCS_HAS_PINCONF)
 919                 return 0;
 920
 921         /* cacluate how much properties are supported in current node */
 922         for (i = 0; i < ARRAY_SIZE(prop2); i++) {
 923                 if (of_find_property(np, prop2[i].name, NULL))
 924                         nconfs++;
 925         }
 926         for (i = 0; i < ARRAY_SIZE(prop4); i++) {
 927                 if (of_find_property(np, prop4[i].name, NULL))
 928                         nconfs++;
 929         }
 930         if (!nconfs)
 919                 return 0;
 932
 933         func->conf = devm_kcalloc(pcs->dev,
 934                                   nconfs, sizeof(struct pcs_conf_vals),
 935                                   GFP_KERNEL);
 936         if (!func->conf)
 937                 return -ENOMEM;
 938         func->nconfs = nconfs;
 939         conf = &(func->conf[0]);
 940         m++;

This situtation will cause a boot failure [0] on the BeagleBone Black
(AM3358) when am33xx_pinmux node in arch/arm/boot/dts/am33xx-l4.dtsi
has compatible = "pinconf-single" instead of "pinctrl-single".

The patch fixes this issue by returning -ENOSUPP when !PCS_HAS_PINCONF
or !nconfs, so that pcs_parse_one_pinctrl_entry() will know that no
map was added.

Logic is also added to pcs_parse_one_pinctrl_entry() to distinguish
between -ENOSUPP and other errors.  In the case of -ENOSUPP, num_maps
is set to 1 as it is valid for pinconf to be enabled and a given pin
group to not any pinconf properties.

[0] https://lore.kernel.org/linux-omap/20200529175544.GA3766151@x1/

Fixes: 9dddb4df90d1 ("pinctrl: single: support generic pinconf")
Signed-off-by: Drew Fustini <drew@beagleboard.org>
Acked-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20200608125143.GA2789203@x1
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/pinctrl-single.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index 73d8d47ea465..17714793c08e 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -1071,7 +1071,7 @@ static int pcs_parse_pinconf(struct pcs_device *pcs, struct device_node *np,
 
 	/* If pinconf isn't supported, don't parse properties in below. */
 	if (!PCS_HAS_PINCONF)
-		return 0;
+		return -ENOTSUPP;
 
 	/* cacluate how much properties are supported in current node */
 	for (i = 0; i < ARRAY_SIZE(prop2); i++) {
@@ -1083,7 +1083,7 @@ static int pcs_parse_pinconf(struct pcs_device *pcs, struct device_node *np,
 			nconfs++;
 	}
 	if (!nconfs)
-		return 0;
+		return -ENOTSUPP;
 
 	func->conf = devm_kzalloc(pcs->dev,
 				  sizeof(struct pcs_conf_vals) * nconfs,
@@ -1196,9 +1196,12 @@ static int pcs_parse_one_pinctrl_entry(struct pcs_device *pcs,
 
 	if (PCS_HAS_PINCONF) {
 		res = pcs_parse_pinconf(pcs, np, function, map);
-		if (res)
+		if (res == 0)
+			*num_maps = 2;
+		else if (res == -ENOTSUPP)
+			*num_maps = 1;
+		else
 			goto free_pingroups;
-		*num_maps = 2;
 	} else {
 		*num_maps = 1;
 	}

From 06ba221d8f4e601c879d8a6d22ef74413cadc298 Mon Sep 17 00:00:00 2001
From: Xie He <xie.he.0141@gmail.com>
Date: Wed, 5 Aug 2020 18:50:40 -0700
Subject: [PATCH 0371/2658] drivers/net/wan/lapbether: Added needed_headroom
 and a skb->len check

[ Upstream commit c7ca03c216acb14466a713fedf1b9f2c24994ef2 ]

1. Added a skb->len check

This driver expects upper layers to include a pseudo header of 1 byte
when passing down a skb for transmission. This driver will read this
1-byte header. This patch added a skb->len check before reading the
header to make sure the header exists.

2. Changed to use needed_headroom instead of hard_header_len to request
necessary headroom to be allocated

In net/packet/af_packet.c, the function packet_snd first reserves a
headroom of length (dev->hard_header_len + dev->needed_headroom).
Then if the socket is a SOCK_DGRAM socket, it calls dev_hard_header,
which calls dev->header_ops->create, to create the link layer header.
If the socket is a SOCK_RAW socket, it "un-reserves" a headroom of
length (dev->hard_header_len), and assumes the user to provide the
appropriate link layer header.

So according to the logic of af_packet.c, dev->hard_header_len should
be the length of the header that would be created by
dev->header_ops->create.

However, this driver doesn't provide dev->header_ops, so logically
dev->hard_header_len should be 0.

So we should use dev->needed_headroom instead of dev->hard_header_len
to request necessary headroom to be allocated.

This change fixes kernel panic when this driver is used with AF_PACKET
SOCK_RAW sockets.

Call stack when panic:

[  168.399197] skbuff: skb_under_panic: text:ffffffff819d95fb len:20
put:14 head:ffff8882704c0a00 data:ffff8882704c09fd tail:0x11 end:0xc0
dev:veth0
...
[  168.399255] Call Trace:
[  168.399259]  skb_push.cold+0x14/0x24
[  168.399262]  eth_header+0x2b/0xc0
[  168.399267]  lapbeth_data_transmit+0x9a/0xb0 [lapbether]
[  168.399275]  lapb_data_transmit+0x22/0x2c [lapb]
[  168.399277]  lapb_transmit_buffer+0x71/0xb0 [lapb]
[  168.399279]  lapb_kick+0xe3/0x1c0 [lapb]
[  168.399281]  lapb_data_request+0x76/0xc0 [lapb]
[  168.399283]  lapbeth_xmit+0x56/0x90 [lapbether]
[  168.399286]  dev_hard_start_xmit+0x91/0x1f0
[  168.399289]  ? irq_init_percpu_irqstack+0xc0/0x100
[  168.399291]  __dev_queue_xmit+0x721/0x8e0
[  168.399295]  ? packet_parse_headers.isra.0+0xd2/0x110
[  168.399297]  dev_queue_xmit+0x10/0x20
[  168.399298]  packet_sendmsg+0xbf0/0x19b0
......

Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Cc: Martin Schiller <ms@dev.tdt.de>
Cc: Brian Norris <briannorris@chromium.org>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wan/lapbether.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index f5657783fad4..6eb0f7a85e53 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -160,6 +160,12 @@ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb,
 	if (!netif_running(dev))
 		goto drop;
 
+	/* There should be a pseudo header of 1 byte added by upper layers.
+	 * Check to make sure it is there before reading it.
+	 */
+	if (skb->len < 1)
+		goto drop;
+
 	switch (skb->data[0]) {
 	case X25_IFACE_DATA:
 		break;
@@ -308,6 +314,7 @@ static void lapbeth_setup(struct net_device *dev)
 	dev->netdev_ops	     = &lapbeth_netdev_ops;
 	dev->destructor	     = free_netdev;
 	dev->type            = ARPHRD_X25;
+	dev->hard_header_len = 0;
 	dev->mtu             = 1000;
 	dev->addr_len        = 0;
 }
@@ -334,7 +341,8 @@ static int lapbeth_new_device(struct net_device *dev)
 	 * then this driver prepends a length field of 2 bytes,
 	 * then the underlying Ethernet device prepends its own header.
 	 */
-	ndev->hard_header_len = -1 + 3 + 2 + dev->hard_header_len;
+	ndev->needed_headroom = -1 + 3 + 2 + dev->hard_header_len
+					   + dev->needed_headroom;
 
 	lapbeth = netdev_priv(ndev);
 	lapbeth->axdev = ndev;

From d99a09520d8c43c2c1ca4069f4a53b4a8a8d1fb3 Mon Sep 17 00:00:00 2001
From: Qingyu Li <ieatmuttonchuan@gmail.com>
Date: Mon, 10 Aug 2020 09:51:00 +0800
Subject: [PATCH 0372/2658] net/nfc/rawsock.c: add CAP_NET_RAW check.

[ Upstream commit 26896f01467a28651f7a536143fe5ac8449d4041 ]

When creating a raw AF_NFC socket, CAP_NET_RAW needs to be checked first.

Signed-off-by: Qingyu Li <ieatmuttonchuan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/nfc/rawsock.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
index e386e6c90b17..574af981806f 100644
--- a/net/nfc/rawsock.c
+++ b/net/nfc/rawsock.c
@@ -344,10 +344,13 @@ static int rawsock_create(struct net *net, struct socket *sock,
 	if ((sock->type != SOCK_SEQPACKET) && (sock->type != SOCK_RAW))
 		return -ESOCKTNOSUPPORT;
 
-	if (sock->type == SOCK_RAW)
+	if (sock->type == SOCK_RAW) {
+		if (!capable(CAP_NET_RAW))
+			return -EPERM;
 		sock->ops = &rawsock_raw_ops;
-	else
+	} else {
 		sock->ops = &rawsock_ops;
+	}
 
 	sk = sk_alloc(net, PF_NFC, GFP_ATOMIC, nfc_proto->proto, kern);
 	if (!sk)

From 836e6881d8a74a46c3b47d7e7d2ff5aff8195e49 Mon Sep 17 00:00:00 2001
From: Miaohe Lin <linmiaohe@huawei.com>
Date: Thu, 6 Aug 2020 19:53:16 +0800
Subject: [PATCH 0373/2658] net: Set fput_needed iff FDPUT_FPUT is set

[ Upstream commit ce787a5a074a86f76f5d3fd804fa78e01bfb9e89 ]

We should fput() file iff FDPUT_FPUT is set. So we should set fput_needed
accordingly.

Fixes: 00e188ef6a7e ("sockfd_lookup_light(): switch to fdget^W^Waway from fget_light")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/socket.c b/net/socket.c
index f27a7a448c54..6c7b07538205 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -469,7 +469,7 @@ static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
 	if (f.file) {
 		sock = sock_from_file(f.file, err);
 		if (likely(sock)) {
-			*fput_needed = f.flags;
+			*fput_needed = f.flags & FDPUT_FPUT;
 			return sock;
 		}
 		fdput(f);

From 4bb25c44db0782763d0464a3cc6138d2cc253e00 Mon Sep 17 00:00:00 2001
From: Mirko Dietrich <buzz@l4m1.de>
Date: Thu, 6 Aug 2020 14:48:50 +0200
Subject: [PATCH 0374/2658] ALSA: usb-audio: Creative USB X-Fi Pro SB1095
 volume knob support

commit fec9008828cde0076aae595ac031bfcf49d335a4 upstream.

Adds an entry for Creative USB X-Fi to the rc_config array in
mixer_quirks.c to allow use of volume knob on the device.
Adds support for newer X-Fi Pro card, known as "Model No. SB1095"
with USB ID "041e:3263"

Signed-off-by: Mirko Dietrich <buzz@l4m1.de>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200806124850.20334-1-buzz@l4m1.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/mixer_quirks.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 9646513f4b4a..d0cd3ae0804d 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -195,6 +195,7 @@ static const struct rc_config {
 	{ USB_ID(0x041e, 0x3042), 0, 1, 1, 1,  1,  0x000d }, /* Usb X-Fi S51 */
 	{ USB_ID(0x041e, 0x30df), 0, 1, 1, 1,  1,  0x000d }, /* Usb X-Fi S51 Pro */
 	{ USB_ID(0x041e, 0x3237), 0, 1, 1, 1,  1,  0x000d }, /* Usb X-Fi S51 Pro */
+	{ USB_ID(0x041e, 0x3263), 0, 1, 1, 1,  1,  0x000d }, /* Usb X-Fi S51 Pro */
 	{ USB_ID(0x041e, 0x3048), 2, 2, 6, 6,  2,  0x6e91 }, /* Toshiba SB0500 */
 };
 

From 7b643dbf5d10c4562a0fe73f662143b20c6f096c Mon Sep 17 00:00:00 2001
From: Hector Martin <marcan@marcan.st>
Date: Mon, 10 Aug 2020 13:53:19 +0900
Subject: [PATCH 0375/2658] ALSA: usb-audio: fix overeager device match for
 MacroSilicon MS2109

commit 14a720dc1f5332f3bdf30a23a3bc549e81be974c upstream.

Matching by device matches all interfaces, which breaks the video/HID
portions of the device depending on module load order.

Fixes: e337bf19f6af ("ALSA: usb-audio: add quirk for MacroSilicon MS2109")
Cc: stable@vger.kernel.org
Signed-off-by: Hector Martin <marcan@marcan.st>
Link: https://lore.kernel.org/r/20200810045319.128745-1-marcan@marcan.st
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/quirks-table.h | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index ec56ce382061..69df7862dc26 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -3335,7 +3335,13 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
  * with.
  */
 {
-	USB_DEVICE(0x534d, 0x2109),
+	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+		       USB_DEVICE_ID_MATCH_INT_CLASS |
+		       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+	.idVendor = 0x534d,
+	.idProduct = 0x2109,
+	.bInterfaceClass = USB_CLASS_AUDIO,
+	.bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
 	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
 		.vendor_name = "MacroSilicon",
 		.product_name = "MS2109",

From e28870b0038234038dad6aa27fae8453706e890d Mon Sep 17 00:00:00 2001
From: Hector Martin <marcan@marcan.st>
Date: Mon, 10 Aug 2020 17:25:02 +0900
Subject: [PATCH 0376/2658] ALSA: usb-audio: add quirk for Pioneer DDJ-RB

commit 6e8596172ee1cd46ec0bfd5adcf4ff86371478b6 upstream.

This is just another Pioneer device with fixed endpoints. Input is dummy
but used as feedback (it always returns silence).

Cc: stable@vger.kernel.org
Signed-off-by: Hector Martin <marcan@marcan.st>
Link: https://lore.kernel.org/r/20200810082502.225979-1-marcan@marcan.st
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/quirks-table.h | 56 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index 69df7862dc26..689fd3103e5b 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -3380,5 +3380,61 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
 		}
 	}
 },
+{
+	/*
+	 * PIONEER DJ DDJ-RB
+	 * PCM is 4 channels out, 2 dummy channels in @ 44.1 fixed
+	 * The feedback for the output is the dummy input.
+	 */
+	USB_DEVICE_VENDOR_SPEC(0x2b73, 0x000e),
+	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+		.ifnum = QUIRK_ANY_INTERFACE,
+		.type = QUIRK_COMPOSITE,
+		.data = (const struct snd_usb_audio_quirk[]) {
+			{
+				.ifnum = 0,
+				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
+				.data = &(const struct audioformat) {
+					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
+					.channels = 4,
+					.iface = 0,
+					.altsetting = 1,
+					.altset_idx = 1,
+					.endpoint = 0x01,
+					.ep_attr = USB_ENDPOINT_XFER_ISOC|
+						   USB_ENDPOINT_SYNC_ASYNC,
+					.rates = SNDRV_PCM_RATE_44100,
+					.rate_min = 44100,
+					.rate_max = 44100,
+					.nr_rates = 1,
+					.rate_table = (unsigned int[]) { 44100 }
+				}
+			},
+			{
+				.ifnum = 0,
+				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
+				.data = &(const struct audioformat) {
+					.formats = SNDRV_PCM_FMTBIT_S24_3LE,
+					.channels = 2,
+					.iface = 0,
+					.altsetting = 1,
+					.altset_idx = 1,
+					.endpoint = 0x82,
+					.ep_attr = USB_ENDPOINT_XFER_ISOC|
+						 USB_ENDPOINT_SYNC_ASYNC|
+						 USB_ENDPOINT_USAGE_IMPLICIT_FB,
+					.rates = SNDRV_PCM_RATE_44100,
+					.rate_min = 44100,
+					.rate_max = 44100,
+					.nr_rates = 1,
+					.rate_table = (unsigned int[]) { 44100 }
+				}
+			},
+			{
+				.ifnum = -1
+			}
+		}
+	}
+},
 
 #undef USB_DEVICE_VENDOR_SPEC

From 222a3bb80ab514ee30fbc2e5e682c961e3fb1975 Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Mon, 13 Jul 2020 07:06:34 -0700
Subject: [PATCH 0377/2658] crypto: qat - fix double free in
 qat_uclo_create_batch_init_list

commit c06c76602e03bde24ee69a2022a829127e504202 upstream.

clang static analysis flags this error

qat_uclo.c:297:3: warning: Attempt to free released memory
  [unix.Malloc]
                kfree(*init_tab_base);
                ^~~~~~~~~~~~~~~~~~~~~

When input *init_tab_base is null, the function allocates memory for
the head of the list.  When there is problem allocating other list
elements the list is unwound and freed.  Then a check is made if the
list head was allocated and is also freed.

Keeping track of the what may need to be freed is the variable 'tail_old'.
The unwinding/freeing block is

	while (tail_old) {
		mem_init = tail_old->next;
		kfree(tail_old);
		tail_old = mem_init;
	}

The problem is that the first element of tail_old is also what was
allocated for the list head

		init_header = kzalloc(sizeof(*init_header), GFP_KERNEL);
		...
		*init_tab_base = init_header;
		flag = 1;
	}
	tail_old = init_header;

So *init_tab_base/init_header are freed twice.

There is another problem.
When the input *init_tab_base is non null the tail_old is calculated by
traveling down the list to first non null entry.

	tail_old = init_header;
	while (tail_old->next)
		tail_old = tail_old->next;

When the unwinding free happens, the last entry of the input list will
be freed.

So the freeing needs a general changed.
If locally allocated the first element of tail_old is freed, else it
is skipped.  As a bit of cleanup, reset *init_tab_base if it came in
as null.

Fixes: b4b7e67c917f ("crypto: qat - Intel(R) QAT ucode part of fw loader")
Cc: <stable@vger.kernel.org>
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/qat/qat_common/qat_uclo.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/qat/qat_common/qat_uclo.c b/drivers/crypto/qat/qat_common/qat_uclo.c
index c48f181e8941..923bb1988973 100644
--- a/drivers/crypto/qat/qat_common/qat_uclo.c
+++ b/drivers/crypto/qat/qat_common/qat_uclo.c
@@ -307,13 +307,18 @@ static int qat_uclo_create_batch_init_list(struct icp_qat_fw_loader_handle
 	}
 	return 0;
 out_err:
+	/* Do not free the list head unless we allocated it. */
+	tail_old = tail_old->next;
+	if (flag) {
+		kfree(*init_tab_base);
+		*init_tab_base = NULL;
+	}
+
 	while (tail_old) {
 		mem_init = tail_old->next;
 		kfree(tail_old);
 		tail_old = mem_init;
 	}
-	if (flag)
-		kfree(*init_tab_base);
 	return -ENOMEM;
 }
 

From c8a58d5355f2bb74d2c9eb33d819e76eba0d858c Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Tue, 11 Aug 2020 18:35:24 -0700
Subject: [PATCH 0378/2658] fs/minix: check return value of sb_getblk()

commit da27e0a0e5f655f0d58d4e153c3182bb2b290f64 upstream.

Patch series "fs/minix: fix syzbot bugs and set s_maxbytes".

This series fixes all syzbot bugs in the minix filesystem:

	KASAN: null-ptr-deref Write in get_block
	KASAN: use-after-free Write in get_block
	KASAN: use-after-free Read in get_block
	WARNING in inc_nlink
	KMSAN: uninit-value in get_block
	WARNING in drop_nlink

It also fixes the minix filesystem to set s_maxbytes correctly, so that
userspace sees the correct behavior when exceeding the max file size.

This patch (of 6):

sb_getblk() can fail, so check its return value.

This fixes a NULL pointer dereference.

Originally from Qiujun Huang.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+4a88b2b9dc280f47baf4@syzkaller.appspotmail.com
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Qiujun Huang <anenbupt@gmail.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/20200628060846.682158-1-ebiggers@kernel.org
Link: http://lkml.kernel.org/r/20200628060846.682158-2-ebiggers@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/minix/itree_common.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/minix/itree_common.c b/fs/minix/itree_common.c
index a731cabf1540..3816427e8938 100644
--- a/fs/minix/itree_common.c
+++ b/fs/minix/itree_common.c
@@ -74,6 +74,7 @@ static int alloc_branch(struct inode *inode,
 	int n = 0;
 	int i;
 	int parent = minix_new_block(inode);
+	int err = -ENOSPC;
 
 	branch[0].key = cpu_to_block(parent);
 	if (parent) for (n = 1; n < num; n++) {
@@ -84,6 +85,11 @@ static int alloc_branch(struct inode *inode,
 			break;
 		branch[n].key = cpu_to_block(nr);
 		bh = sb_getblk(inode->i_sb, parent);
+		if (!bh) {
+			minix_free_block(inode, nr);
+			err = -ENOMEM;
+			break;
+		}
 		lock_buffer(bh);
 		memset(bh->b_data, 0, bh->b_size);
 		branch[n].bh = bh;
@@ -102,7 +108,7 @@ static int alloc_branch(struct inode *inode,
 		bforget(branch[i].bh);
 	for (i = 0; i < n; i++)
 		minix_free_block(inode, block_to_cpu(branch[i].key));
-	return -ENOSPC;
+	return err;
 }
 
 static inline int splice_branch(struct inode *inode,

From 848cf5777c6708abc21831d792ada82fbeab0066 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Tue, 11 Aug 2020 18:35:27 -0700
Subject: [PATCH 0379/2658] fs/minix: don't allow getting deleted inodes

commit facb03dddec04e4aac1bb2139accdceb04deb1f3 upstream.

If an inode has no links, we need to mark it bad rather than allowing it
to be accessed.  This avoids WARNINGs in inc_nlink() and drop_nlink() when
doing directory operations on a fuzzed filesystem.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+a9ac3de1b5de5fb10efc@syzkaller.appspotmail.com
Reported-by: syzbot+df958cf5688a96ad3287@syzkaller.appspotmail.com
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Qiujun Huang <anenbupt@gmail.com>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/20200628060846.682158-3-ebiggers@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/minix/inode.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index 086cd0a61e80..f4bcbf8d9e53 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -472,6 +472,13 @@ static struct inode *V1_minix_iget(struct inode *inode)
 		iget_failed(inode);
 		return ERR_PTR(-EIO);
 	}
+	if (raw_inode->i_nlinks == 0) {
+		printk("MINIX-fs: deleted inode referenced: %lu\n",
+		       inode->i_ino);
+		brelse(bh);
+		iget_failed(inode);
+		return ERR_PTR(-ESTALE);
+	}
 	inode->i_mode = raw_inode->i_mode;
 	i_uid_write(inode, raw_inode->i_uid);
 	i_gid_write(inode, raw_inode->i_gid);
@@ -505,6 +512,13 @@ static struct inode *V2_minix_iget(struct inode *inode)
 		iget_failed(inode);
 		return ERR_PTR(-EIO);
 	}
+	if (raw_inode->i_nlinks == 0) {
+		printk("MINIX-fs: deleted inode referenced: %lu\n",
+		       inode->i_ino);
+		brelse(bh);
+		iget_failed(inode);
+		return ERR_PTR(-ESTALE);
+	}
 	inode->i_mode = raw_inode->i_mode;
 	i_uid_write(inode, raw_inode->i_uid);
 	i_gid_write(inode, raw_inode->i_gid);

From 4075f7d51005899936f2acf34ad610dbce0e4a26 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Tue, 11 Aug 2020 18:35:30 -0700
Subject: [PATCH 0380/2658] fs/minix: reject too-large maximum file size

commit 270ef41094e9fa95273f288d7d785313ceab2ff3 upstream.

If the minix filesystem tries to map a very large logical block number to
its on-disk location, block_to_path() can return offsets that are too
large, causing out-of-bounds memory accesses when accessing indirect index
blocks.  This should be prevented by the check against the maximum file
size, but this doesn't work because the maximum file size is read directly
from the on-disk superblock and isn't validated itself.

Fix this by validating the maximum file size at mount time.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+c7d9ec7a1a7272dd71b3@syzkaller.appspotmail.com
Reported-by: syzbot+3b7b03a0c28948054fb5@syzkaller.appspotmail.com
Reported-by: syzbot+6e056ee473568865f3e6@syzkaller.appspotmail.com
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Qiujun Huang <anenbupt@gmail.com>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/20200628060846.682158-4-ebiggers@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/minix/inode.c | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index f4bcbf8d9e53..8d9bc0344cf3 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -155,6 +155,23 @@ static int minix_remount (struct super_block * sb, int * flags, char * data)
 	return 0;
 }
 
+static bool minix_check_superblock(struct minix_sb_info *sbi)
+{
+	if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
+		return false;
+
+	/*
+	 * s_max_size must not exceed the block mapping limitation.  This check
+	 * is only needed for V1 filesystems, since V2/V3 support an extra level
+	 * of indirect blocks which places the limit well above U32_MAX.
+	 */
+	if (sbi->s_version == MINIX_V1 &&
+	    sbi->s_max_size > (7 + 512 + 512*512) * BLOCK_SIZE)
+		return false;
+
+	return true;
+}
+
 static int minix_fill_super(struct super_block *s, void *data, int silent)
 {
 	struct buffer_head *bh;
@@ -233,11 +250,12 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
 	} else
 		goto out_no_fs;
 
+	if (!minix_check_superblock(sbi))
+		goto out_illegal_sb;
+
 	/*
 	 * Allocate the buffer map to keep the superblock small.
 	 */
-	if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
-		goto out_illegal_sb;
 	i = (sbi->s_imap_blocks + sbi->s_zmap_blocks) * sizeof(bh);
 	map = kzalloc(i, GFP_KERNEL);
 	if (!map)

From ae5a8dfc460f59f5100444061bccb144b58304f8 Mon Sep 17 00:00:00 2001
From: Hector Martin <marcan@marcan.st>
Date: Mon, 10 Aug 2020 17:24:00 +0900
Subject: [PATCH 0381/2658] ALSA: usb-audio: work around streaming quirk for
 MacroSilicon MS2109

commit 1b7ecc241a67ad6b584e071bd791a54e0cd5f097 upstream.

Further investigation of the L-R swap problem on the MS2109 reveals that
the problem isn't that the channels are swapped, but rather that they
are swapped and also out of phase by one sample. In other words, the
issue is actually that the very first frame that comes from the hardware
is a half-frame containing only the right channel, and after that
everything becomes offset.

So introduce a new quirk field to drop the very first 2 bytes that come
in after the format is configured and a capture stream starts. This puts
the channels in phase and in the correct order.

Cc: stable@vger.kernel.org
Signed-off-by: Hector Martin <marcan@marcan.st>
Link: https://lore.kernel.org/r/20200810082400.225858-1-marcan@marcan.st
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/card.h   | 1 +
 sound/usb/pcm.c    | 6 ++++++
 sound/usb/quirks.c | 3 +++
 sound/usb/stream.c | 1 +
 4 files changed, 11 insertions(+)

diff --git a/sound/usb/card.h b/sound/usb/card.h
index 7421ee53c29f..a4dbbeb309bc 100644
--- a/sound/usb/card.h
+++ b/sound/usb/card.h
@@ -125,6 +125,7 @@ struct snd_usb_substream {
 	unsigned int tx_length_quirk:1;	/* add length specifier to transfers */
 	unsigned int fmt_type;		/* USB audio format type (1-3) */
 	unsigned int pkt_offset_adj;	/* Bytes to drop from beginning of packets (for non-compliant devices) */
+	unsigned int stream_offset_adj;	/* Bytes to drop from beginning of stream (for non-compliant devices) */
 
 	unsigned int running: 1;	/* running status */
 
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 8eaadc0a4cb2..6eabd643c0d3 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1360,6 +1360,12 @@ static void retire_capture_urb(struct snd_usb_substream *subs,
 			// continue;
 		}
 		bytes = urb->iso_frame_desc[i].actual_length;
+		if (subs->stream_offset_adj > 0) {
+			unsigned int adj = min(subs->stream_offset_adj, bytes);
+			cp += adj;
+			bytes -= adj;
+			subs->stream_offset_adj -= adj;
+		}
 		frames = bytes / stride;
 		if (!subs->txfr_quirk)
 			bytes = frames * stride;
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 47979c9c3e29..59529a9cab61 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1122,6 +1122,9 @@ void snd_usb_set_format_quirk(struct snd_usb_substream *subs,
 	case USB_ID(0x041e, 0x3f19): /* E-Mu 0204 USB */
 		set_format_emu_quirk(subs, fmt);
 		break;
+	case USB_ID(0x534d, 0x2109): /* MacroSilicon MS2109 */
+		subs->stream_offset_adj = 2;
+		break;
 	}
 }
 
diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index a7d7c3a0ac3e..0204fe014a5b 100644
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -101,6 +101,7 @@ static void snd_usb_init_substream(struct snd_usb_stream *as,
 	subs->tx_length_quirk = as->chip->tx_length_quirk;
 	subs->speed = snd_usb_get_speed(subs->dev);
 	subs->pkt_offset_adj = 0;
+	subs->stream_offset_adj = 0;
 
 	snd_usb_set_pcm_ops(as->pcm, stream);
 

From 3a59d5ce00acca134211c55f09d462d16452eb4c Mon Sep 17 00:00:00 2001
From: Zheng Bin <zhengbin13@huawei.com>
Date: Mon, 15 Jun 2020 09:21:53 +0800
Subject: [PATCH 0382/2658] 9p: Fix memory leak in v9fs_mount

commit cb0aae0e31c632c407a2cab4307be85a001d4d98 upstream.

v9fs_mount
  v9fs_session_init
    v9fs_cache_session_get_cookie
      v9fs_random_cachetag                     -->alloc cachetag
      v9ses->fscache = fscache_acquire_cookie  -->maybe NULL
  sb = sget                                    -->fail, goto clunk
clunk_fid:
  v9fs_session_close
    if (v9ses->fscache)                        -->NULL
      kfree(v9ses->cachetag)

Thus memleak happens.

Link: http://lkml.kernel.org/r/20200615012153.89538-1-zhengbin13@huawei.com
Fixes: 60e78d2c993e ("9p: Add fscache support to 9p")
Cc: <stable@vger.kernel.org> # v2.6.32+
Signed-off-by: Zheng Bin <zhengbin13@huawei.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/9p/v9fs.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index 1e9bb8db7b48..3a56f4fa59f9 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -457,10 +457,9 @@ void v9fs_session_close(struct v9fs_session_info *v9ses)
 	}
 
 #ifdef CONFIG_9P_FSCACHE
-	if (v9ses->fscache) {
+	if (v9ses->fscache)
 		v9fs_cache_session_put_cookie(v9ses);
-		kfree(v9ses->cachetag);
-	}
+	kfree(v9ses->cachetag);
 #endif
 	kfree(v9ses->uname);
 	kfree(v9ses->aname);

From 46cc47df26efcea9da98eb64bb56fcbf625ed1da Mon Sep 17 00:00:00 2001
From: Sven Schnelle <svens@stackframe.org>
Date: Tue, 11 Aug 2020 18:19:19 +0200
Subject: [PATCH 0383/2658] parisc: mask out enable and reserved bits from sba
 imask

commit 5b24993c21cbf2de11aff077a48c5cb0505a0450 upstream.

When using kexec the SBA IOMMU IBASE might still have the RE
bit set. This triggers a WARN_ON when trying to write back the
IBASE register later, and it also makes some mask calculations fail.

Cc: <stable@vger.kernel.org>
Signed-off-by: Sven Schnelle <svens@stackframe.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/parisc/sba_iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c
index f3b9746157f8..b854de39c7ff 100644
--- a/drivers/parisc/sba_iommu.c
+++ b/drivers/parisc/sba_iommu.c
@@ -1277,7 +1277,7 @@ sba_ioc_init_pluto(struct parisc_device *sba, struct ioc *ioc, int ioc_num)
 	** (one that doesn't overlap memory or LMMIO space) in the
 	** IBASE and IMASK registers.
 	*/
-	ioc->ibase = READ_REG(ioc->ioc_hpa + IOC_IBASE);
+	ioc->ibase = READ_REG(ioc->ioc_hpa + IOC_IBASE) & ~0x1fffffULL;
 	iova_space_size = ~(READ_REG(ioc->ioc_hpa + IOC_IMASK) & 0xFFFFFFFFUL) + 1;
 
 	if ((ioc->ibase < 0xfed00000UL) && ((ioc->ibase + iova_space_size) > 0xfee00000UL)) {

From 77c0c9fac1f27e3f04ef3d4c4746ca51fbb0755b Mon Sep 17 00:00:00 2001
From: Nathan Huckleberry <nhuck@google.com>
Date: Fri, 10 Jul 2020 20:23:37 +0100
Subject: [PATCH 0384/2658] ARM: 8992/1: Fix unwind_frame for clang-built
 kernels

commit b4d5ec9b39f8b31d98f65bc5577b5d15d93795d7 upstream.

Since clang does not push pc and sp in function prologues, the current
implementation of unwind_frame does not work. By using the previous
frame's lr/fp instead of saved pc/sp we get valid unwinds on clang-built
kernels.

The bounds check on next frame pointer must be changed as well since
there are 8 less bytes between frames.

This fixes /proc/<pid>/stack.

Link: https://github.com/ClangBuiltLinux/linux/issues/912

Reported-by: Miles Chen <miles.chen@mediatek.com>
Tested-by: Miles Chen <miles.chen@mediatek.com>
Cc: stable@vger.kernel.org
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Nathan Huckleberry <nhuck@google.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/kernel/stacktrace.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c
index a1898c6092d1..b75332da3bb1 100644
--- a/arch/arm/kernel/stacktrace.c
+++ b/arch/arm/kernel/stacktrace.c
@@ -20,6 +20,19 @@
  * A simple function epilogue looks like this:
  *	ldm	sp, {fp, sp, pc}
  *
+ * When compiled with clang, pc and sp are not pushed. A simple function
+ * prologue looks like this when built with clang:
+ *
+ *	stmdb	{..., fp, lr}
+ *	add	fp, sp, #x
+ *	sub	sp, sp, #y
+ *
+ * A simple function epilogue looks like this when built with clang:
+ *
+ *	sub	sp, fp, #x
+ *	ldm	{..., fp, pc}
+ *
+ *
  * Note that with framepointer enabled, even the leaf functions have the same
  * prologue and epilogue, therefore we can ignore the LR value in this case.
  */
@@ -32,6 +45,16 @@ int notrace unwind_frame(struct stackframe *frame)
 	low = frame->sp;
 	high = ALIGN(low, THREAD_SIZE);
 
+#ifdef CONFIG_CC_IS_CLANG
+	/* check current frame pointer is within bounds */
+	if (fp < low + 4 || fp > high - 4)
+		return -EINVAL;
+
+	frame->sp = frame->fp;
+	frame->fp = *(unsigned long *)(fp);
+	frame->pc = frame->lr;
+	frame->lr = *(unsigned long *)(fp + 4);
+#else
 	/* check current frame pointer is within bounds */
 	if (fp < low + 12 || fp > high - 4)
 		return -EINVAL;
@@ -42,6 +65,7 @@ int notrace unwind_frame(struct stackframe *frame)
 	frame->fp = *(unsigned long *)(fp - 12);
 	frame->sp = *(unsigned long *)(fp - 8);
 	frame->pc = *(unsigned long *)(fp - 4);
+#endif
 
 	kasan_enable_current();
 

From f2a5793947cd4c0fb29fc81dbdc1b001964282e4 Mon Sep 17 00:00:00 2001
From: Roger Pau Monne <roger.pau@citrix.com>
Date: Mon, 27 Jul 2020 11:13:39 +0200
Subject: [PATCH 0385/2658] xen/balloon: fix accounting in
 alloc_xenballooned_pages error path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 1951fa33ec259abdf3497bfee7b63e7ddbb1a394 upstream.

target_unpopulated is incremented with nr_pages at the start of the
function, but the call to free_xenballooned_pages will only subtract
pgno number of pages, and thus the rest need to be subtracted before
returning or else accounting will be skewed.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200727091342.52325-2-roger.pau@citrix.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/balloon.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index d6f5a74df973..41a80581595b 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -683,6 +683,12 @@ int alloc_xenballooned_pages(int nr_pages, struct page **pages)
  out_undo:
 	mutex_unlock(&balloon_mutex);
 	free_xenballooned_pages(pgno, pages);
+	/*
+	 * NB: free_xenballooned_pages will only subtract pgno pages, but since
+	 * target_unpopulated is incremented with nr_pages at the start we need
+	 * to remove the remaining ones also, or accounting will be screwed.
+	 */
+	balloon_stats.target_unpopulated -= nr_pages - pgno;
 	return ret;
 }
 EXPORT_SYMBOL(alloc_xenballooned_pages);

From 503be23f18e8d4868116638170db9496fa0ce50f Mon Sep 17 00:00:00 2001
From: Roger Pau Monne <roger.pau@citrix.com>
Date: Mon, 27 Jul 2020 11:13:40 +0200
Subject: [PATCH 0386/2658] xen/balloon: make the balloon wait interruptible
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 88a479ff6ef8af7f07e11593d58befc644244ff7 upstream.

So it can be killed, or else processes can get hung indefinitely
waiting for balloon pages.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200727091342.52325-3-roger.pau@citrix.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/balloon.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 41a80581595b..dff07318d1fb 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -623,11 +623,13 @@ static int add_ballooned_pages(int nr_pages)
 	if (xen_hotplug_unpopulated) {
 		st = reserve_additional_memory();
 		if (st != BP_ECANCELED) {
+			int rc;
+
 			mutex_unlock(&balloon_mutex);
-			wait_event(balloon_wq,
+			rc = wait_event_interruptible(balloon_wq,
 				   !list_empty(&ballooned_pages));
 			mutex_lock(&balloon_mutex);
-			return 0;
+			return rc ? -ENOMEM : 0;
 		}
 	}
 

From 1e8b83036ab45baa00824a3036c1aabad82b9ac7 Mon Sep 17 00:00:00 2001
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Date: Fri, 26 Jun 2020 19:42:34 +0200
Subject: [PATCH 0387/2658] PCI: hotplug: ACPI: Fix context refcounting in
 acpiphp_grab_context()

commit dae68d7fd4930315389117e9da35b763f12238f9 upstream.

If context is not NULL in acpiphp_grab_context(), but the
is_going_away flag is set for the device's parent, the reference
counter of the context needs to be decremented before returning
NULL or the context will never be freed, so make that happen.

Fixes: edf5bf34d408 ("ACPI / dock: Use callback pointers from devices' ACPI hotplug contexts")
Reported-by: Vasily Averin <vvs@virtuozzo.com>
Cc: 3.15+ <stable@vger.kernel.org> # 3.15+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/hotplug/acpiphp_glue.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index 572ca192cb1f..6727471ea5b4 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -136,13 +136,21 @@ static struct acpiphp_context *acpiphp_grab_context(struct acpi_device *adev)
 	struct acpiphp_context *context;
 
 	acpi_lock_hp_context();
+
 	context = acpiphp_get_context(adev);
-	if (!context || context->func.parent->is_going_away) {
-		acpi_unlock_hp_context();
-		return NULL;
+	if (!context)
+		goto unlock;
+
+	if (context->func.parent->is_going_away) {
+		acpiphp_put_context(context);
+		context = NULL;
+		goto unlock;
 	}
+
 	get_bridge(context->func.parent);
 	acpiphp_put_context(context);
+
+unlock:
 	acpi_unlock_hp_context();
 	return context;
 }

From 093ac006a242dfa65c03b924337b8d22cdab4efb Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Mon, 27 Jul 2020 10:28:05 -0400
Subject: [PATCH 0388/2658] btrfs: only search for left_info if there is no
 right_info in try_merge_free_space

commit bf53d4687b8f3f6b752f091eb85f62369a515dfd upstream.

In try_to_merge_free_space we attempt to find entries to the left and
right of the entry we are adding to see if they can be merged.  We
search for an entry past our current info (saved into right_info), and
then if right_info exists and it has a rb_prev() we save the rb_prev()
into left_info.

However there's a slight problem in the case that we have a right_info,
but no entry previous to that entry.  At that point we will search for
an entry just before the info we're attempting to insert.  This will
simply find right_info again, and assign it to left_info, making them
both the same pointer.

Now if right_info _can_ be merged with the range we're inserting, we'll
add it to the info and free right_info.  However further down we'll
access left_info, which was right_info, and thus get a use-after-free.

Fix this by only searching for the left entry if we don't find a right
entry at all.

The CVE referenced had a specially crafted file system that could
trigger this use-after-free. However with the tree checker improvements
we no longer trigger the conditions for the UAF.  But the original
conditions still apply, hence this fix.

Reference: CVE-2019-19448
Fixes: 963030817060 ("Btrfs: use hybrid extents+bitmap rb tree for free space")
CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/free-space-cache.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index e5351d9a8dfb..05b1b0f99f0b 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -2158,7 +2158,7 @@ static int insert_into_bitmap(struct btrfs_free_space_ctl *ctl,
 static bool try_merge_free_space(struct btrfs_free_space_ctl *ctl,
 			  struct btrfs_free_space *info, bool update_stat)
 {
-	struct btrfs_free_space *left_info;
+	struct btrfs_free_space *left_info = NULL;
 	struct btrfs_free_space *right_info;
 	bool merged = false;
 	u64 offset = info->offset;
@@ -2173,7 +2173,7 @@ static bool try_merge_free_space(struct btrfs_free_space_ctl *ctl,
 	if (right_info && rb_prev(&right_info->offset_index))
 		left_info = rb_entry(rb_prev(&right_info->offset_index),
 				     struct btrfs_free_space, offset_index);
-	else
+	else if (!right_info)
 		left_info = tree_search_offset(ctl, offset - 1, 0, 0);
 
 	if (right_info && !right_info->bitmap) {

From b31183cd452b50587d1469eb58484f8877b35007 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Wed, 29 Jul 2020 10:17:50 +0100
Subject: [PATCH 0389/2658] btrfs: fix memory leaks after failure to lookup
 checksums during inode logging

commit 4f26433e9b3eb7a55ed70d8f882ae9cd48ba448b upstream.

While logging an inode, at copy_items(), if we fail to lookup the checksums
for an extent we release the destination path, free the ins_data array and
then return immediately. However a previous iteration of the for loop may
have added checksums to the ordered_sums list, in which case we leak the
memory used by them.

So fix this by making sure we iterate the ordered_sums list and free all
its checksums before returning.

Fixes: 3650860b90cc2a ("Btrfs: remove almost all of the BUG()'s from tree-log.c")
CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/tree-log.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 3779a660988a..820d3b5bc415 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3733,11 +3733,8 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
 						log->fs_info->csum_root,
 						ds + cs, ds + cs + cl - 1,
 						&ordered_sums, 0);
-				if (ret) {
-					btrfs_release_path(dst_path);
-					kfree(ins_data);
-					return ret;
-				}
+				if (ret)
+					break;
 			}
 		}
 	}
@@ -3750,7 +3747,6 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
 	 * we have to do this after the loop above to avoid changing the
 	 * log tree while trying to change the log tree.
 	 */
-	ret = 0;
 	while (!list_empty(&ordered_sums)) {
 		struct btrfs_ordered_sum *sums = list_entry(ordered_sums.next,
 						   struct btrfs_ordered_sum,

From 6a8b0fc4a94a7e58697ba69b8a691de9d834e2d6 Mon Sep 17 00:00:00 2001
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Tue, 4 Aug 2020 22:44:06 +1000
Subject: [PATCH 0390/2658] powerpc: Fix circular dependency between percpu.h
 and mmu.h

commit 0c83b277ada72b585e6a3e52b067669df15bcedb upstream.

Recently random.h started including percpu.h (see commit
f227e3ec3b5c ("random32: update the net random state on interrupt and
activity")), which broke corenet64_smp_defconfig:

  In file included from /linux/arch/powerpc/include/asm/paca.h:18,
                   from /linux/arch/powerpc/include/asm/percpu.h:13,
                   from /linux/include/linux/random.h:14,
                   from /linux/lib/uuid.c:14:
  /linux/arch/powerpc/include/asm/mmu.h:139:22: error: unknown type name 'next_tlbcam_idx'
    139 | DECLARE_PER_CPU(int, next_tlbcam_idx);

This is due to a circular header dependency:
  asm/mmu.h includes asm/percpu.h, which includes asm/paca.h, which
  includes asm/mmu.h

Which means DECLARE_PER_CPU() isn't defined when mmu.h needs it.

We can fix it by moving the include of paca.h below the include of
asm-generic/percpu.h.

This moves the include of paca.h out of the #ifdef __powerpc64__, but
that is OK because paca.h is almost entirely inside #ifdef
CONFIG_PPC64 anyway.

It also moves the include of paca.h out of the #ifdef CONFIG_SMP,
which could possibly break something, but seems to have no ill
effects.

Fixes: f227e3ec3b5c ("random32: update the net random state on interrupt and activity")
Cc: stable@vger.kernel.org # v5.8
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200804130558.292328-1-mpe@ellerman.id.au
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/include/asm/percpu.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/include/asm/percpu.h b/arch/powerpc/include/asm/percpu.h
index 2cedefddba37..61c78205a1d3 100644
--- a/arch/powerpc/include/asm/percpu.h
+++ b/arch/powerpc/include/asm/percpu.h
@@ -9,8 +9,6 @@
 
 #ifdef CONFIG_SMP
 
-#include <asm/paca.h>
-
 #define __my_cpu_offset local_paca->data_offset
 
 #endif /* CONFIG_SMP */
@@ -18,4 +16,6 @@
 
 #include <asm-generic/percpu.h>
 
+#include <asm/paca.h>
+
 #endif /* _ASM_POWERPC_PERCPU_H_ */

From dd48afb584839ffa586f75ca7a8e103d9d8d7cf6 Mon Sep 17 00:00:00 2001
From: Jonathan McDowell <noodles@earth.li>
Date: Wed, 12 Aug 2020 20:37:23 +0100
Subject: [PATCH 0391/2658] net: ethernet: stmmac: Disable hardware multicast
 filter

commit df43dd526e6609769ae513a81443c7aa727c8ca3 upstream.

The IPQ806x does not appear to have a functional multicast ethernet
address filter. This was observed as a failure to correctly receive IPv6
packets on a LAN to the all stations address. Checking the vendor driver
shows that it does not attempt to enable the multicast filter and
instead falls back to receiving all multicast packets, internally
setting ALLMULTI.

Use the new fallback support in the dwmac1000 driver to correctly
achieve the same with the mainline IPQ806x driver. Confirmed to fix IPv6
functionality on an RB3011 router.

Cc: stable@vger.kernel.org
Signed-off-by: Jonathan McDowell <noodles@earth.li>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
index 15aabffd21a8..ee5a7c05a0e6 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
@@ -360,6 +360,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
 	plat_dat->has_gmac = true;
 	plat_dat->bsp_priv = gmac;
 	plat_dat->fix_mac_speed = ipq806x_gmac_fix_mac_speed;
+	plat_dat->multicast_filter_bins = 0;
 
 	return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
 }

From f5ff9b88f450be7d223390191dc1bc7fc6364a96 Mon Sep 17 00:00:00 2001
From: Jonathan McDowell <noodles@earth.li>
Date: Wed, 12 Aug 2020 20:37:01 +0100
Subject: [PATCH 0392/2658] net: stmmac: dwmac1000: provide multicast filter
 fallback

commit 592d751c1e174df5ff219946908b005eb48934b3 upstream.

If we don't have a hardware multicast filter available then instead of
silently failing to listen for the requested ethernet broadcast
addresses fall back to receiving all multicast packets, in a similar
fashion to other drivers with no multicast filter.

Cc: stable@vger.kernel.org
Signed-off-by: Jonathan McDowell <noodles@earth.li>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
index b535f6c37838..ac08031c481f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
@@ -146,6 +146,9 @@ static void dwmac1000_set_filter(struct mac_device_info *hw,
 		value = GMAC_FRAME_FILTER_PR;
 	} else if (dev->flags & IFF_ALLMULTI) {
 		value = GMAC_FRAME_FILTER_PM;	/* pass all multi */
+	} else if (!netdev_mc_empty(dev) && (mcbitslog2 == 0)) {
+		/* Fall back to all multicast if we've no filter */
+		value = GMAC_FRAME_FILTER_PM;
 	} else if (!netdev_mc_empty(dev)) {
 		struct netdev_hw_addr *ha;
 

From 6f493622ea61d1e3a42d4ca4217ef1293c77b416 Mon Sep 17 00:00:00 2001
From: ChangSyun Peng <allenpeng@synology.com>
Date: Fri, 31 Jul 2020 17:50:17 +0800
Subject: [PATCH 0393/2658] md/raid5: Fix Force reconstruct-write io stuck in
 degraded raid5

commit a1c6ae3d9f3dd6aa5981a332a6f700cf1c25edef upstream.

In degraded raid5, we need to read parity to do reconstruct-write when
data disks fail. However, we can not read parity from
handle_stripe_dirtying() in force reconstruct-write mode.

Reproducible Steps:

1. Create degraded raid5
mdadm -C /dev/md2 --assume-clean -l5 -n3 /dev/sda2 /dev/sdb2 missing
2. Set rmw_level to 0
echo 0 > /sys/block/md2/md/rmw_level
3. IO to raid5

Now some io may be stuck in raid5. We can use handle_stripe_fill() to read
the parity in this situation.

Cc: <stable@vger.kernel.org> # v4.4+
Reviewed-by: Alex Wu <alexwu@synology.com>
Reviewed-by: BingJing Chang <bingjingc@synology.com>
Reviewed-by: Danny Shih <dannyshih@synology.com>
Signed-off-by: ChangSyun Peng <allenpeng@synology.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/raid5.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index f061c81e15e1..99cd843351c2 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3345,6 +3345,7 @@ static int need_this_block(struct stripe_head *sh, struct stripe_head_state *s,
 	 * is missing/faulty, then we need to read everything we can.
 	 */
 	if (sh->raid_conf->level != 6 &&
+	    sh->raid_conf->rmw_level != PARITY_DISABLE_RMW &&
 	    sh->sector < sh->raid_conf->mddev->recovery_cp)
 		/* reconstruct-write isn't being forced */
 		return 0;
@@ -4479,7 +4480,7 @@ static void handle_stripe(struct stripe_head *sh)
 	 * or to load a block that is being partially written.
 	 */
 	if (s.to_read || s.non_overwrite
-	    || (conf->level == 6 && s.to_write && s.failed)
+	    || (s.to_write && s.failed)
 	    || (s.syncing && (s.uptodate + s.compute < disks))
 	    || s.replacing
 	    || s.expanding)

From ccd0e26ed47a468f16299532b2697d1c5659177f Mon Sep 17 00:00:00 2001
From: Coly Li <colyli@suse.de>
Date: Sat, 25 Jul 2020 20:00:16 +0800
Subject: [PATCH 0394/2658] bcache: allocate meta data pages as compound pages

commit 5fe48867856367142d91a82f2cbf7a57a24cbb70 upstream.

There are some meta data of bcache are allocated by multiple pages,
and they are used as bio bv_page for I/Os to the cache device. for
example cache_set->uuids, cache->disk_buckets, journal_write->data,
bset_tree->data.

For such meta data memory, all the allocated pages should be treated
as a single memory block. Then the memory management and underlying I/O
code can treat them more clearly.

This patch adds __GFP_COMP flag to all the location allocating >0 order
pages for the above mentioned meta data. Then their pages are treated
as compound pages now.

Signed-off-by: Coly Li <colyli@suse.de>
Cc: stable@vger.kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/bcache/bset.c    | 2 +-
 drivers/md/bcache/btree.c   | 2 +-
 drivers/md/bcache/journal.c | 4 ++--
 drivers/md/bcache/super.c   | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c
index 158eae17031c..144043621429 100644
--- a/drivers/md/bcache/bset.c
+++ b/drivers/md/bcache/bset.c
@@ -317,7 +317,7 @@ int bch_btree_keys_alloc(struct btree_keys *b, unsigned page_order, gfp_t gfp)
 
 	b->page_order = page_order;
 
-	t->data = (void *) __get_free_pages(gfp, b->page_order);
+	t->data = (void *) __get_free_pages(__GFP_COMP|gfp, b->page_order);
 	if (!t->data)
 		goto err;
 
diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 634e9284b7be..122d97522094 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -795,7 +795,7 @@ int bch_btree_cache_alloc(struct cache_set *c)
 	mutex_init(&c->verify_lock);
 
 	c->verify_ondisk = (void *)
-		__get_free_pages(GFP_KERNEL, ilog2(bucket_pages(c)));
+		__get_free_pages(GFP_KERNEL|__GFP_COMP, ilog2(bucket_pages(c)));
 
 	c->verify_data = mca_bucket_alloc(c, &ZERO_KEY, GFP_KERNEL);
 
diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
index 6f9db98f2dfd..1d798938e9df 100644
--- a/drivers/md/bcache/journal.c
+++ b/drivers/md/bcache/journal.c
@@ -838,8 +838,8 @@ int bch_journal_alloc(struct cache_set *c)
 	j->w[1].c = c;
 
 	if (!(init_fifo(&j->pin, JOURNAL_PIN, GFP_KERNEL)) ||
-	    !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS)) ||
-	    !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS)))
+	    !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP, JSET_BITS)) ||
+	    !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP, JSET_BITS)))
 		return -ENOMEM;
 
 	return 0;
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 23ffd4469dab..f7f8fb079d2a 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1469,7 +1469,7 @@ void bch_cache_set_unregister(struct cache_set *c)
 }
 
 #define alloc_bucket_pages(gfp, c)			\
-	((void *) __get_free_pages(__GFP_ZERO|gfp, ilog2(bucket_pages(c))))
+	((void *) __get_free_pages(__GFP_ZERO|__GFP_COMP|gfp, ilog2(bucket_pages(c))))
 
 struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)
 {

From 1f82f728cc617bf0ebe9a817dbe11faff6048f3f Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 3 Aug 2020 11:02:10 +0200
Subject: [PATCH 0395/2658] mac80211: fix misplaced while instead of if

commit 5981fe5b0529ba25d95f37d7faa434183ad618c5 upstream.

This never was intended to be a 'while' loop, it should've
just been an 'if' instead of 'while'. Fix this.

I noticed this while applying another patch from Ben that
intended to fix a busy loop at this spot.

Cc: stable@vger.kernel.org
Fixes: b16798f5b907 ("mac80211: mark station unauthorized before key removal")
Reported-by: Ben Greear <greearb@candelatech.com>
Link: https://lore.kernel.org/r/20200803110209.253009ae41ff.I3522aad099392b31d5cf2dcca34cbac7e5832dde@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/sta_info.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index eeaa865f3080..91d8e9dd5c80 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -907,7 +907,7 @@ static void __sta_info_destroy_part2(struct sta_info *sta)
 	might_sleep();
 	lockdep_assert_held(&local->sta_mtx);
 
-	while (sta->sta_state == IEEE80211_STA_AUTHORIZED) {
+	if (sta->sta_state == IEEE80211_STA_AUTHORIZED) {
 		ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
 		WARN_ON_ONCE(ret);
 	}

From 25eea8daf65b27762b6cccad3e2d99e8c770008f Mon Sep 17 00:00:00 2001
From: Huacai Chen <chenhc@lemote.com>
Date: Thu, 16 Jul 2020 18:40:23 +0800
Subject: [PATCH 0396/2658] MIPS: CPU#0 is not hotpluggable

commit 9cce844abf07b683cff5f0273977d5f8d0af94c7 upstream.

Now CPU#0 is not hotpluggable on MIPS, so prevent to create /sys/devices
/system/cpu/cpu0/online which confuses some user-space tools.

Cc: stable@vger.kernel.org
Signed-off-by: Huacai Chen <chenhc@lemote.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/kernel/topology.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/kernel/topology.c b/arch/mips/kernel/topology.c
index cf3eb61fad12..68da7613874a 100644
--- a/arch/mips/kernel/topology.c
+++ b/arch/mips/kernel/topology.c
@@ -19,7 +19,7 @@ static int __init topology_init(void)
 	for_each_present_cpu(i) {
 		struct cpu *c = &per_cpu(cpu_devices, i);
 
-		c->hotpluggable = 1;
+		c->hotpluggable = !!i;
 		ret = register_cpu(c, i);
 		if (ret)
 			printk(KERN_WARNING "topology_init: register_cpu %d "

From 5232647cffe9ee9a2ccfadeeed006d582ade4601 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Mon, 20 Apr 2020 16:02:21 -0400
Subject: [PATCH 0397/2658] ext2: fix missing percpu_counter_inc

commit bc2fbaa4d3808aef82dd1064a8e61c16549fe956 upstream.

sbi->s_freeinodes_counter is only decreased by the ext2 code, it is never
increased. This patch fixes it.

Note that sbi->s_freeinodes_counter is only used in the algorithm that
tries to find the group for new allocations, so this bug is not easily
visible (the only visibility is that the group finding algorithm selects
inoptinal result).

Link: https://lore.kernel.org/r/alpine.LRH.2.02.2004201538300.19436@file01.intranet.prod.int.rdu2.redhat.com
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext2/ialloc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/ext2/ialloc.c b/fs/ext2/ialloc.c
index efe5fb21c533..d9ef354b821a 100644
--- a/fs/ext2/ialloc.c
+++ b/fs/ext2/ialloc.c
@@ -79,6 +79,7 @@ static void ext2_release_inode(struct super_block *sb, int group, int dir)
 	if (dir)
 		le16_add_cpu(&desc->bg_used_dirs_count, -1);
 	spin_unlock(sb_bgl_lock(EXT2_SB(sb), group));
+	percpu_counter_inc(&EXT2_SB(sb)->s_freeinodes_counter);
 	if (dir)
 		percpu_counter_dec(&EXT2_SB(sb)->s_dirs_counter);
 	mark_buffer_dirty(bh);
@@ -525,7 +526,7 @@ struct inode *ext2_new_inode(struct inode *dir, umode_t mode,
 		goto fail;
 	}
 
-	percpu_counter_add(&sbi->s_freeinodes_counter, -1);
+	percpu_counter_dec(&sbi->s_freeinodes_counter);
 	if (S_ISDIR(mode))
 		percpu_counter_inc(&sbi->s_dirs_counter);
 

From 7276fc13b267ac5b94140d6f0b02048b6a98afd4 Mon Sep 17 00:00:00 2001
From: Junxiao Bi <junxiao.bi@oracle.com>
Date: Thu, 6 Aug 2020 23:18:02 -0700
Subject: [PATCH 0398/2658] ocfs2: change slot number type s16 to u16

commit 38d51b2dd171ad973afc1f5faab825ed05a2d5e9 upstream.

Dan Carpenter reported the following static checker warning.

	fs/ocfs2/super.c:1269 ocfs2_parse_options() warn: '(-1)' 65535 can't fit into 32767 'mopt->slot'
	fs/ocfs2/suballoc.c:859 ocfs2_init_inode_steal_slot() warn: '(-1)' 65535 can't fit into 32767 'osb->s_inode_steal_slot'
	fs/ocfs2/suballoc.c:867 ocfs2_init_meta_steal_slot() warn: '(-1)' 65535 can't fit into 32767 'osb->s_meta_steal_slot'

That's because OCFS2_INVALID_SLOT is (u16)-1. Slot number in ocfs2 can be
never negative, so change s16 to u16.

Fixes: 9277f8334ffc ("ocfs2: fix value of OCFS2_INVALID_SLOT")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reviewed-by: Gang He <ghe@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/20200627001259.19757-1-junxiao.bi@oracle.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/ocfs2.h    | 4 ++--
 fs/ocfs2/suballoc.c | 4 ++--
 fs/ocfs2/super.c    | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index 2495066a9ca3..9e7f39b17e67 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -337,8 +337,8 @@ struct ocfs2_super
 	spinlock_t osb_lock;
 	u32 s_next_generation;
 	unsigned long osb_flags;
-	s16 s_inode_steal_slot;
-	s16 s_meta_steal_slot;
+	u16 s_inode_steal_slot;
+	u16 s_meta_steal_slot;
 	atomic_t s_num_inodes_stolen;
 	atomic_t s_num_meta_stolen;
 
diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index 28cc343bf6e3..41a67c9b37e0 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -895,9 +895,9 @@ static void __ocfs2_set_steal_slot(struct ocfs2_super *osb, int slot, int type)
 {
 	spin_lock(&osb->osb_lock);
 	if (type == INODE_ALLOC_SYSTEM_INODE)
-		osb->s_inode_steal_slot = slot;
+		osb->s_inode_steal_slot = (u16)slot;
 	else if (type == EXTENT_ALLOC_SYSTEM_INODE)
-		osb->s_meta_steal_slot = slot;
+		osb->s_meta_steal_slot = (u16)slot;
 	spin_unlock(&osb->osb_lock);
 }
 
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 4f5141350af8..d97403bb3622 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -96,7 +96,7 @@ struct mount_options
 	unsigned long	commit_interval;
 	unsigned long	mount_opt;
 	unsigned int	atime_quantum;
-	signed short	slot;
+	unsigned short	slot;
 	int		localalloc_opt;
 	unsigned int	resv_level;
 	int		dir_resv_level;
@@ -1372,7 +1372,7 @@ static int ocfs2_parse_options(struct super_block *sb,
 				goto bail;
 			}
 			if (option)
-				mopt->slot = (s16)option;
+				mopt->slot = (u16)option;
 			break;
 		case Opt_commit:
 			option = 0;

From 4b867ceea243ecac8e07cd69f8a6bf3ad1d2291f Mon Sep 17 00:00:00 2001
From: Muchun Song <songmuchun@bytedance.com>
Date: Tue, 28 Jul 2020 14:45:36 +0800
Subject: [PATCH 0399/2658] kprobes: Fix NULL pointer dereference at
 kprobe_ftrace_handler

commit 0cb2f1372baa60af8456388a574af6133edd7d80 upstream.

We found a case of kernel panic on our server. The stack trace is as
follows(omit some irrelevant information):

  BUG: kernel NULL pointer dereference, address: 0000000000000080
  RIP: 0010:kprobe_ftrace_handler+0x5e/0xe0
  RSP: 0018:ffffb512c6550998 EFLAGS: 00010282
  RAX: 0000000000000000 RBX: ffff8e9d16eea018 RCX: 0000000000000000
  RDX: ffffffffbe1179c0 RSI: ffffffffc0535564 RDI: ffffffffc0534ec0
  RBP: ffffffffc0534ec1 R08: ffff8e9d1bbb0f00 R09: 0000000000000004
  R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
  R13: ffff8e9d1f797060 R14: 000000000000bacc R15: ffff8e9ce13eca00
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000000000080 CR3: 00000008453d0005 CR4: 00000000003606e0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Call Trace:
   <IRQ>
   ftrace_ops_assist_func+0x56/0xe0
   ftrace_call+0x5/0x34
   tcpa_statistic_send+0x5/0x130 [ttcp_engine]

The tcpa_statistic_send is the function being kprobed. After analysis,
the root cause is that the fourth parameter regs of kprobe_ftrace_handler
is NULL. Why regs is NULL? We use the crash tool to analyze the kdump.

  crash> dis tcpa_statistic_send -r
         <tcpa_statistic_send>: callq 0xffffffffbd8018c0 <ftrace_caller>

The tcpa_statistic_send calls ftrace_caller instead of ftrace_regs_caller.
So it is reasonable that the fourth parameter regs of kprobe_ftrace_handler
is NULL. In theory, we should call the ftrace_regs_caller instead of the
ftrace_caller. After in-depth analysis, we found a reproducible path.

  Writing a simple kernel module which starts a periodic timer. The
  timer's handler is named 'kprobe_test_timer_handler'. The module
  name is kprobe_test.ko.

  1) insmod kprobe_test.ko
  2) bpftrace -e 'kretprobe:kprobe_test_timer_handler {}'
  3) echo 0 > /proc/sys/kernel/ftrace_enabled
  4) rmmod kprobe_test
  5) stop step 2) kprobe
  6) insmod kprobe_test.ko
  7) bpftrace -e 'kretprobe:kprobe_test_timer_handler {}'

We mark the kprobe as GONE but not disarm the kprobe in the step 4).
The step 5) also do not disarm the kprobe when unregister kprobe. So
we do not remove the ip from the filter. In this case, when the module
loads again in the step 6), we will replace the code to ftrace_caller
via the ftrace_module_enable(). When we register kprobe again, we will
not replace ftrace_caller to ftrace_regs_caller because the ftrace is
disabled in the step 3). So the step 7) will trigger kernel panic. Fix
this problem by disarming the kprobe when the module is going away.

Link: https://lkml.kernel.org/r/20200728064536.24405-1-songmuchun@bytedance.com

Cc: stable@vger.kernel.org
Fixes: ae6aa16fdc16 ("kprobes: introduce ftrace based optimization")
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Co-developed-by: Chengming Zhou <zhouchengming@bytedance.com>
Signed-off-by: Chengming Zhou <zhouchengming@bytedance.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/kprobes.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 5bda113a3116..9241a29a1f9d 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -2029,6 +2029,13 @@ static void kill_kprobe(struct kprobe *p)
 	 * the original probed function (which will be freed soon) any more.
 	 */
 	arch_remove_kprobe(p);
+
+	/*
+	 * The module is going away. We should disarm the kprobe which
+	 * is using ftrace.
+	 */
+	if (kprobe_ftrace(p))
+		disarm_kprobe_ftrace(p);
 }
 
 /* Disable one kprobe */

From 81a2268774f13311365320f5548db6d4c5d8dad2 Mon Sep 17 00:00:00 2001
From: Anton Blanchard <anton@ozlabs.org>
Date: Wed, 15 Jul 2020 10:08:20 +1000
Subject: [PATCH 0400/2658] pseries: Fix 64 bit logical memory block panic

commit 89c140bbaeee7a55ed0360a88f294ead2b95201b upstream.

Booting with a 4GB LMB size causes us to panic:

  qemu-system-ppc64: OS terminated: OS panic:
      Memory block size not suitable: 0x0

Fix pseries_memory_block_size() to handle 64 bit LMBs.

Cc: stable@vger.kernel.org
Signed-off-by: Anton Blanchard <anton@ozlabs.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200715000820.1255764-1-anton@ozlabs.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/platforms/pseries/hotplug-memory.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index 0e65d52eb56d..2025e772fc9c 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -29,7 +29,7 @@ static bool rtas_hp_event;
 unsigned long pseries_memory_block_size(void)
 {
 	struct device_node *np;
-	unsigned int memblock_size = MIN_MEMORY_BLOCK_SIZE;
+	u64 memblock_size = MIN_MEMORY_BLOCK_SIZE;
 	struct resource r;
 
 	np = of_find_node_by_path("/ibm,dynamic-reconfiguration-memory");

From 455066134680a550c378882c89d0d221dae1aaa5 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 8 Jul 2020 14:49:51 +0200
Subject: [PATCH 0401/2658] USB: serial: ftdi_sio: make process-packet buffer
 unsigned

[ Upstream commit ab4cc4ef6724ea588e835fc1e764c4b4407a70b7 ]

Use an unsigned type for the process-packet buffer argument and give it
a more apt name.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/serial/ftdi_sio.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 8388f88ce635..4b9404f99c01 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -2051,12 +2051,12 @@ static int ftdi_prepare_write_buffer(struct usb_serial_port *port,
 #define FTDI_RS_ERR_MASK (FTDI_RS_BI | FTDI_RS_PE | FTDI_RS_FE | FTDI_RS_OE)
 
 static int ftdi_process_packet(struct usb_serial_port *port,
-		struct ftdi_private *priv, char *packet, int len)
+		struct ftdi_private *priv, unsigned char *buf, int len)
 {
+	unsigned char status;
+	unsigned char *ch;
 	int i;
-	char status;
 	char flag;
-	char *ch;
 
 	if (len < 2) {
 		dev_dbg(&port->dev, "malformed packet\n");
@@ -2066,7 +2066,7 @@ static int ftdi_process_packet(struct usb_serial_port *port,
 	/* Compare new line status to the old one, signal if different/
 	   N.B. packet may be processed more than once, but differences
 	   are only processed once.  */
-	status = packet[0] & FTDI_STATUS_B0_MASK;
+	status = buf[0] & FTDI_STATUS_B0_MASK;
 	if (status != priv->prev_status) {
 		char diff_status = status ^ priv->prev_status;
 
@@ -2092,7 +2092,7 @@ static int ftdi_process_packet(struct usb_serial_port *port,
 	}
 
 	/* save if the transmitter is empty or not */
-	if (packet[1] & FTDI_RS_TEMT)
+	if (buf[1] & FTDI_RS_TEMT)
 		priv->transmit_empty = 1;
 	else
 		priv->transmit_empty = 0;
@@ -2106,29 +2106,29 @@ static int ftdi_process_packet(struct usb_serial_port *port,
 	 * data payload to avoid over-reporting.
 	 */
 	flag = TTY_NORMAL;
-	if (packet[1] & FTDI_RS_ERR_MASK) {
+	if (buf[1] & FTDI_RS_ERR_MASK) {
 		/* Break takes precedence over parity, which takes precedence
 		 * over framing errors */
-		if (packet[1] & FTDI_RS_BI) {
+		if (buf[1] & FTDI_RS_BI) {
 			flag = TTY_BREAK;
 			port->icount.brk++;
 			usb_serial_handle_break(port);
-		} else if (packet[1] & FTDI_RS_PE) {
+		} else if (buf[1] & FTDI_RS_PE) {
 			flag = TTY_PARITY;
 			port->icount.parity++;
-		} else if (packet[1] & FTDI_RS_FE) {
+		} else if (buf[1] & FTDI_RS_FE) {
 			flag = TTY_FRAME;
 			port->icount.frame++;
 		}
 		/* Overrun is special, not associated with a char */
-		if (packet[1] & FTDI_RS_OE) {
+		if (buf[1] & FTDI_RS_OE) {
 			port->icount.overrun++;
 			tty_insert_flip_char(&port->port, 0, TTY_OVERRUN);
 		}
 	}
 
 	port->icount.rx += len;
-	ch = packet + 2;
+	ch = buf + 2;
 
 	if (port->port.console && port->sysrq) {
 		for (i = 0; i < len; i++, ch++) {

From c73ff6437edc3e378fd366dc77c228920be2ba9b Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 8 Jul 2020 14:49:52 +0200
Subject: [PATCH 0402/2658] USB: serial: ftdi_sio: clean up receive processing

[ Upstream commit ce054039ba5e47b75a3be02a00274e52b06a6456 ]

Clean up receive processing by dropping the character pointer and
keeping the length argument unchanged throughout the function.

Also make it more apparent that sysrq processing can consume a
characters by adding an explicit continue.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/serial/ftdi_sio.c | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 4b9404f99c01..0afea511eb37 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -2054,7 +2054,6 @@ static int ftdi_process_packet(struct usb_serial_port *port,
 		struct ftdi_private *priv, unsigned char *buf, int len)
 {
 	unsigned char status;
-	unsigned char *ch;
 	int i;
 	char flag;
 
@@ -2097,8 +2096,7 @@ static int ftdi_process_packet(struct usb_serial_port *port,
 	else
 		priv->transmit_empty = 0;
 
-	len -= 2;
-	if (!len)
+	if (len == 2)
 		return 0;	/* status only */
 
 	/*
@@ -2127,19 +2125,20 @@ static int ftdi_process_packet(struct usb_serial_port *port,
 		}
 	}
 
-	port->icount.rx += len;
-	ch = buf + 2;
+	port->icount.rx += len - 2;
 
 	if (port->port.console && port->sysrq) {
-		for (i = 0; i < len; i++, ch++) {
-			if (!usb_serial_handle_sysrq_char(port, *ch))
-				tty_insert_flip_char(&port->port, *ch, flag);
+		for (i = 2; i < len; i++) {
+			if (usb_serial_handle_sysrq_char(port, buf[i]))
+				continue;
+			tty_insert_flip_char(&port->port, buf[i], flag);
 		}
 	} else {
-		tty_insert_flip_string_fixed_flag(&port->port, ch, flag, len);
+		tty_insert_flip_string_fixed_flag(&port->port, buf + 2, flag,
+				len - 2);
 	}
 
-	return len;
+	return len - 2;
 }
 
 static void ftdi_process_read_urb(struct urb *urb)

From bc03f7fb25ba71addef8e7f2dbdc095ce1e4e2bf Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Tue, 14 Jul 2020 20:22:11 +0100
Subject: [PATCH 0403/2658] iommu/omap: Check for failure of a call to
 omap_iommu_dump_ctx

[ Upstream commit dee9d154f40c58d02f69acdaa5cfd1eae6ebc28b ]

It is possible for the call to omap_iommu_dump_ctx to return
a negative error number, so check for the failure and return
the error number rather than pass the negative value to
simple_read_from_buffer.

Fixes: 14e0e6796a0d ("OMAP: iommu: add initial debugfs support")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20200714192211.744776-1-colin.king@canonical.com
Addresses-Coverity: ("Improper use of negative value")
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/omap-iommu-debug.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c
index 9bc20e2119a3..82bf208295f4 100644
--- a/drivers/iommu/omap-iommu-debug.c
+++ b/drivers/iommu/omap-iommu-debug.c
@@ -101,8 +101,11 @@ static ssize_t debug_read_regs(struct file *file, char __user *userbuf,
 	mutex_lock(&iommu_debug_lock);
 
 	bytes = omap_iommu_dump_ctx(obj, p, count);
+	if (bytes < 0)
+		goto err;
 	bytes = simple_read_from_buffer(userbuf, count, ppos, buf, bytes);
 
+err:
 	mutex_unlock(&iommu_debug_lock);
 	kfree(buf);
 

From 7411c4a822cbf8513088024c4e2ed29623955a0c Mon Sep 17 00:00:00 2001
From: Liu Yi L <yi.l.liu@intel.com>
Date: Fri, 24 Jul 2020 09:49:14 +0800
Subject: [PATCH 0404/2658] iommu/vt-d: Enforce PASID devTLB field mask

[ Upstream commit 5f77d6ca5ca74e4b4a5e2e010f7ff50c45dea326 ]

Set proper masks to avoid invalid input spillover to reserved bits.

Signed-off-by: Liu Yi L <yi.l.liu@intel.com>
Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Link: https://lore.kernel.org/r/20200724014925.15523-2-baolu.lu@linux.intel.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/intel-iommu.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
index 27dbab59f034..d86ac620f0aa 100644
--- a/include/linux/intel-iommu.h
+++ b/include/linux/intel-iommu.h
@@ -317,8 +317,8 @@ enum {
 
 #define QI_DEV_EIOTLB_ADDR(a)	((u64)(a) & VTD_PAGE_MASK)
 #define QI_DEV_EIOTLB_SIZE	(((u64)1) << 11)
-#define QI_DEV_EIOTLB_GLOB(g)	((u64)g)
-#define QI_DEV_EIOTLB_PASID(p)	(((u64)p) << 32)
+#define QI_DEV_EIOTLB_GLOB(g)	((u64)(g) & 0x1)
+#define QI_DEV_EIOTLB_PASID(p)	((u64)((p) & 0xfffff) << 32)
 #define QI_DEV_EIOTLB_SID(sid)	((u64)((sid) & 0xffff) << 16)
 #define QI_DEV_EIOTLB_QDEP(qd)	((u64)((qd) & 0x1f) << 4)
 #define QI_DEV_EIOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | \

From 73669b0827ee5ed3dd74bfa01039c0fc7f626d6e Mon Sep 17 00:00:00 2001
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
Date: Mon, 29 Jun 2020 17:38:07 +0200
Subject: [PATCH 0405/2658] i2c: rcar: slave: only send STOP event when we have
 been addressed

[ Upstream commit 314139f9f0abdba61ed9a8463bbcb0bf900ac5a2 ]

When the SSR interrupt is activated, it will detect every STOP condition
on the bus, not only the ones after we have been addressed. So, enable
this interrupt only after we have been addressed, and disable it
otherwise.

Fixes: de20d1857dd6 ("i2c: rcar: add slave support")
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-rcar.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index dfe1a53ce4ad..ddfb08a3e6c2 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -386,13 +386,14 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
 			rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR);
 		}
 
-		rcar_i2c_write(priv, ICSSR, ~SAR & 0xff);
+		/* Clear SSR, too, because of old STOPs to other clients than us */
+		rcar_i2c_write(priv, ICSSR, ~(SAR | SSR) & 0xff);
 	}
 
 	/* master sent stop */
 	if (ssr_filtered & SSR) {
 		i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value);
-		rcar_i2c_write(priv, ICSIER, SAR | SSR);
+		rcar_i2c_write(priv, ICSIER, SAR);
 		rcar_i2c_write(priv, ICSSR, ~SSR & 0xff);
 	}
 
@@ -541,7 +542,7 @@ static int rcar_reg_slave(struct i2c_client *slave)
 	priv->slave = slave;
 	rcar_i2c_write(priv, ICSAR, slave->addr);
 	rcar_i2c_write(priv, ICSSR, 0);
-	rcar_i2c_write(priv, ICSIER, SAR | SSR);
+	rcar_i2c_write(priv, ICSIER, SAR);
 	rcar_i2c_write(priv, ICSCR, SIE | SDBS);
 
 	return 0;

From 7a59f93c04f4c5d01eadd99bbbacda9e74a7219b Mon Sep 17 00:00:00 2001
From: Xu Wang <vulab@iscas.ac.cn>
Date: Mon, 13 Jul 2020 03:21:43 +0000
Subject: [PATCH 0406/2658] clk: clk-atlas6: fix return value check in
 atlas6_clk_init()

[ Upstream commit 12b90b40854a8461a02ef19f6f4474cc88d64b66 ]

In case of error, the function clk_register() returns ERR_PTR()
and never returns NULL. The NULL test in the return value check
should be replaced with IS_ERR().

Signed-off-by: Xu Wang <vulab@iscas.ac.cn>
Link: https://lore.kernel.org/r/20200713032143.21362-1-vulab@iscas.ac.cn
Acked-by: Barry Song <baohua@kernel.org>
Fixes: 7bf21bc81f28 ("clk: sirf: re-arch to make the codes support both prima2 and atlas6")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/sirf/clk-atlas6.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/sirf/clk-atlas6.c b/drivers/clk/sirf/clk-atlas6.c
index c5eaa9d16247..9af2d0dcd6a0 100644
--- a/drivers/clk/sirf/clk-atlas6.c
+++ b/drivers/clk/sirf/clk-atlas6.c
@@ -137,7 +137,7 @@ static void __init atlas6_clk_init(struct device_node *np)
 
 	for (i = pll1; i < maxclk; i++) {
 		atlas6_clks[i] = clk_register(NULL, atlas6_clk_hw_array[i]);
-		BUG_ON(!atlas6_clks[i]);
+		BUG_ON(IS_ERR(atlas6_clks[i]));
 	}
 	clk_register_clkdev(atlas6_clks[cpu], NULL, "cpu");
 	clk_register_clkdev(atlas6_clks[io],  NULL, "io");

From 664a3f83bc53750eb04b6ff49c68667df2c6522e Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Thu, 6 Aug 2020 15:35:34 -0700
Subject: [PATCH 0407/2658] Input: sentelic - fix error return when
 fsp_reg_write fails

[ Upstream commit ea38f06e0291986eb93beb6d61fd413607a30ca4 ]

Currently when the call to fsp_reg_write fails -EIO is not being returned
because the count is being returned instead of the return value in retval.
Fix this by returning the value in retval instead of count.

Addresses-Coverity: ("Unused value")
Fixes: fc69f4a6af49 ("Input: add new driver for Sentelic Finger Sensing Pad")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20200603141218.131663-1-colin.king@canonical.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/mouse/sentelic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/mouse/sentelic.c b/drivers/input/mouse/sentelic.c
index 11c32ac8234b..779d0b9341c0 100644
--- a/drivers/input/mouse/sentelic.c
+++ b/drivers/input/mouse/sentelic.c
@@ -454,7 +454,7 @@ static ssize_t fsp_attr_set_setreg(struct psmouse *psmouse, void *data,
 
 	fsp_reg_write_enable(psmouse, false);
 
-	return count;
+	return retval;
 }
 
 PSMOUSE_DEFINE_WO_ATTR(setreg, S_IWUSR, NULL, fsp_attr_set_setreg);

From 5627f2b3f5e928b866082a437bca72d012f7ced4 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 26 Jun 2020 13:39:59 +0300
Subject: [PATCH 0408/2658] drm/vmwgfx: Fix two list_for_each loop exit tests

[ Upstream commit 4437c1152ce0e57ab8f401aa696ea6291cc07ab1 ]

These if statements are supposed to be true if we ended the
list_for_each_entry() loops without hitting a break statement but they
don't work.

In the first loop, we increment "i" after the "if (i == unit)" condition
so we don't necessarily know that "i" is not equal to unit at the end of
the loop.

In the second loop we exit when mode is not pointing to a valid
drm_display_mode struct so it doesn't make sense to check "mode->type".

Fixes: a278724aa23c ("drm/vmwgfx: Implement fbdev on kms v2")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Roland Scheidegger <sroland@vmware.com>
Signed-off-by: Roland Scheidegger <sroland@vmware.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 9b97f70fbb3d..0b7427d474fe 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -2086,7 +2086,7 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
 		++i;
 	}
 
-	if (i != unit) {
+	if (&con->head == &dev_priv->dev->mode_config.connector_list) {
 		DRM_ERROR("Could not find initial display unit.\n");
 		return -EINVAL;
 	}
@@ -2108,13 +2108,13 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
 			break;
 	}
 
-	if (mode->type & DRM_MODE_TYPE_PREFERRED)
-		*p_mode = mode;
-	else {
+	if (&mode->head == &con->modes) {
 		WARN_ONCE(true, "Could not find initial preferred mode.\n");
 		*p_mode = list_first_entry(&con->modes,
 					   struct drm_display_mode,
 					   head);
+	} else {
+		*p_mode = mode;
 	}
 
 	return 0;

From d27581b419d59c484b008e427b5d97134e576412 Mon Sep 17 00:00:00 2001
From: Jeffrey Mitchell <jeffrey.mitchell@starlab.io>
Date: Wed, 5 Aug 2020 12:23:19 -0500
Subject: [PATCH 0409/2658] nfs: Fix getxattr kernel panic and memory overflow

[ Upstream commit b4487b93545214a9db8cbf32e86411677b0cca21 ]

Move the buffer size check to decode_attr_security_label() before memcpy()
Only call memcpy() if the buffer is large enough

Fixes: aa9c2669626c ("NFS: Client implementation of Labeled-NFS")
Signed-off-by: Jeffrey Mitchell <jeffrey.mitchell@starlab.io>
[Trond: clean up duplicate test of label->len != 0]
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs4proc.c | 2 --
 fs/nfs/nfs4xdr.c  | 6 +++++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 566afcc36adb..ca1702cefb85 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -4916,8 +4916,6 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf,
 		return ret;
 	if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL))
 		return -ENOENT;
-	if (buflen < label.len)
-		return -ERANGE;
 	return 0;
 }
 
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 15cd9db6d616..28c1b765e444 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -4158,7 +4158,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
 			goto out_overflow;
 		if (len < NFS4_MAXLABELLEN) {
 			if (label) {
-				memcpy(label->label, p, len);
+				if (label->len) {
+					if (label->len < len)
+						return -ERANGE;
+					memcpy(label->label, p, len);
+				}
 				label->len = len;
 				label->pi = pi;
 				label->lfs = lfs;

From 759700243f92f0b55fa75822119990926e33510c Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Tue, 11 Aug 2020 18:35:53 -0700
Subject: [PATCH 0410/2658] fs/ufs: avoid potential u32 multiplication overflow

[ Upstream commit 88b2e9b06381551b707d980627ad0591191f7a2d ]

The 64 bit ino is being compared to the product of two u32 values,
however, the multiplication is being performed using a 32 bit multiply so
there is a potential of an overflow.  To be fully safe, cast uspi->s_ncg
to a u64 to ensure a 64 bit multiplication occurs to avoid any chance of
overflow.

Fixes: f3e2a520f5fb ("ufs: NFS support")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Evgeniy Dushistov <dushistov@mail.ru>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Link: http://lkml.kernel.org/r/20200715170355.1081713-1-colin.king@canonical.com
Addresses-Coverity: ("Unintentional integer overflow")
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ufs/super.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index 10f364490833..be68b48de1cc 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -99,7 +99,7 @@ static struct inode *ufs_nfs_get_inode(struct super_block *sb, u64 ino, u32 gene
 	struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi;
 	struct inode *inode;
 
-	if (ino < UFS_ROOTINO || ino > uspi->s_ncg * uspi->s_ipg)
+	if (ino < UFS_ROOTINO || ino > (u64)uspi->s_ncg * uspi->s_ipg)
 		return ERR_PTR(-ESTALE);
 
 	inode = ufs_iget(sb, ino);

From 8cd2e2fcfd614def4ca28bf04d3fee64f6450db1 Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Thu, 23 Jul 2020 16:02:46 +0300
Subject: [PATCH 0411/2658] mfd: dln2: Run event handler loop under spinlock

[ Upstream commit 3d858942250820b9adc35f963a257481d6d4c81d ]

The event handler loop must be run with interrupts disabled.
Otherwise we will have a warning:

[ 1970.785649] irq 31 handler lineevent_irq_handler+0x0/0x20 enabled interrupts
[ 1970.792739] WARNING: CPU: 0 PID: 0 at kernel/irq/handle.c:159 __handle_irq_event_percpu+0x162/0x170
[ 1970.860732] RIP: 0010:__handle_irq_event_percpu+0x162/0x170
...
[ 1970.946994] Call Trace:
[ 1970.949446]  <IRQ>
[ 1970.951471]  handle_irq_event_percpu+0x2c/0x80
[ 1970.955921]  handle_irq_event+0x23/0x43
[ 1970.959766]  handle_simple_irq+0x57/0x70
[ 1970.963695]  generic_handle_irq+0x42/0x50
[ 1970.967717]  dln2_rx+0xc1/0x210 [dln2]
[ 1970.971479]  ? usb_hcd_unmap_urb_for_dma+0xa6/0x1c0
[ 1970.976362]  __usb_hcd_giveback_urb+0x77/0xe0
[ 1970.980727]  usb_giveback_urb_bh+0x8e/0xe0
[ 1970.984837]  tasklet_action_common.isra.0+0x4a/0xe0
...

Recently xHCI driver switched to tasklets in the commit 36dc01657b49
("usb: host: xhci: Support running urb giveback in tasklet context").

The handle_irq_event_* functions are expected to be called with interrupts
disabled and they rightfully complain here because we run in tasklet context
with interrupts enabled.

Use a event spinlock to protect event handler from being interrupted.

Note, that there are only two users of this GPIO and ADC drivers and both of
them are using generic_handle_irq() which makes above happen.

Fixes: 338a12814297 ("mfd: Add support for Diolan DLN-2 devices")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/dln2.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c
index 672831d5ee32..97a69cd6f127 100644
--- a/drivers/mfd/dln2.c
+++ b/drivers/mfd/dln2.c
@@ -294,7 +294,11 @@ static void dln2_rx(struct urb *urb)
 	len = urb->actual_length - sizeof(struct dln2_header);
 
 	if (handle == DLN2_HANDLE_EVENT) {
+		unsigned long flags;
+
+		spin_lock_irqsave(&dln2->event_cb_lock, flags);
 		dln2_run_event_callbacks(dln2, id, echo, data, len);
+		spin_unlock_irqrestore(&dln2->event_cb_lock, flags);
 	} else {
 		/* URB will be re-submitted in _dln2_transfer (free_rx_slot) */
 		if (dln2_transfer_complete(dln2, urb, handle, echo))

From a02880544d50f7c19c6710629d02682cfcc708a8 Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Thu, 13 Aug 2020 15:46:30 +0800
Subject: [PATCH 0412/2658] ALSA: echoaudio: Fix potential Oops in
 snd_echo_resume()

[ Upstream commit 5a25de6df789cc805a9b8ba7ab5deef5067af47e ]

Freeing chip on error may lead to an Oops at the next time
the system goes to resume. Fix this by removing all
snd_echo_free() calls on error.

Fixes: 47b5d028fdce8 ("ALSA: Echoaudio - Add suspend support #2")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Link: https://lore.kernel.org/r/20200813074632.17022-1-dinghao.liu@zju.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/echoaudio/echoaudio.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c
index d73ee11a32bd..db14ee43e461 100644
--- a/sound/pci/echoaudio/echoaudio.c
+++ b/sound/pci/echoaudio/echoaudio.c
@@ -2215,7 +2215,6 @@ static int snd_echo_resume(struct device *dev)
 	if (err < 0) {
 		kfree(commpage_bak);
 		dev_err(dev, "resume init_hw err=%d\n", err);
-		snd_echo_free(chip);
 		return err;
 	}
 
@@ -2242,7 +2241,6 @@ static int snd_echo_resume(struct device *dev)
 	if (request_irq(pci->irq, snd_echo_interrupt, IRQF_SHARED,
 			KBUILD_MODNAME, chip)) {
 		dev_err(chip->card->dev, "cannot grab irq\n");
-		snd_echo_free(chip);
 		return -EBUSY;
 	}
 	chip->irq = pci->irq;

From 5c1f89ec373e88e6576a43d21debbb381c6ec458 Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Fri, 14 Aug 2020 14:42:45 +0200
Subject: [PATCH 0413/2658] sh: landisk: Add missing initialization of
 sh_io_port_base

[ Upstream commit 0c64a0dce51faa9c706fdf1f957d6f19878f4b81 ]

The Landisk setup code maps the CF IDE area using ioremap_prot(), and
passes the resulting virtual addresses to the pata_platform driver,
disguising them as I/O port addresses.  Hence the pata_platform driver
translates them again using ioport_map().
As CONFIG_GENERIC_IOMAP=n, and CONFIG_HAS_IOPORT_MAP=y, the
SuperH-specific mapping code in arch/sh/kernel/ioport.c translates
I/O port addresses to virtual addresses by adding sh_io_port_base, which
defaults to -1, thus breaking the assumption of an identity mapping.

Fix this by setting sh_io_port_base to zero.

Fixes: 37b7a97884ba64bf ("sh: machvec IO death.")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Rich Felker <dalias@libc.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/sh/boards/mach-landisk/setup.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/sh/boards/mach-landisk/setup.c b/arch/sh/boards/mach-landisk/setup.c
index f1147caebacf..af69fb7fef7c 100644
--- a/arch/sh/boards/mach-landisk/setup.c
+++ b/arch/sh/boards/mach-landisk/setup.c
@@ -85,6 +85,9 @@ device_initcall(landisk_devices_setup);
 
 static void __init landisk_setup(char **cmdline_p)
 {
+	/* I/O port identity mapping */
+	__set_io_port_base(0);
+
 	/* LED ON */
 	__raw_writeb(__raw_readb(PA_LED) | 0x03, PA_LED);
 

From 821f6e72f0737dd567c8958e3a05f84bc635681a Mon Sep 17 00:00:00 2001
From: WANG Cong <xiyou.wangcong@gmail.com>
Date: Tue, 25 Apr 2017 14:37:15 -0700
Subject: [PATCH 0414/2658] ipv6: check skb->protocol before lookup for nexthop

commit 199ab00f3cdb6f154ea93fa76fd80192861a821d upstream.

Andrey reported a out-of-bound access in ip6_tnl_xmit(), this
is because we use an ipv4 dst in ip6_tnl_xmit() and cast an IPv4
neigh key as an IPv6 address:

        neigh = dst_neigh_lookup(skb_dst(skb),
                                 &ipv6_hdr(skb)->daddr);
        if (!neigh)
                goto tx_err_link_failure;

        addr6 = (struct in6_addr *)&neigh->primary_key; // <=== HERE
        addr_type = ipv6_addr_type(addr6);

        if (addr_type == IPV6_ADDR_ANY)
                addr6 = &ipv6_hdr(skb)->daddr;

        memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));

Also the network header of the skb at this point should be still IPv4
for 4in6 tunnels, we shold not just use it as IPv6 header.

This patch fixes it by checking if skb->protocol is ETH_P_IPV6: if it
is, we are safe to do the nexthop lookup using skb_dst() and
ipv6_hdr(skb)->daddr; if not (aka IPv4), we have no clue about which
dest address we can pick here, we have to rely on callers to fill it
from tunnel config, so just fall to ip6_route_output() to make the
decision.

Fixes: ea3dc9601bda ("ip6_tunnel: Add support for wildcard tunnel endpoints.")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Alessio Balsini <balsini@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/ip6_tunnel.c | 32 +++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 40cf35c9a2f3..48a2605bed28 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -972,26 +972,28 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
 
 	/* NBMA tunnel */
 	if (ipv6_addr_any(&t->parms.raddr)) {
-		struct in6_addr *addr6;
-		struct neighbour *neigh;
-		int addr_type;
+		if (skb->protocol == htons(ETH_P_IPV6)) {
+			struct in6_addr *addr6;
+			struct neighbour *neigh;
+			int addr_type;
 
-		if (!skb_dst(skb))
-			goto tx_err_link_failure;
+			if (!skb_dst(skb))
+				goto tx_err_link_failure;
 
-		neigh = dst_neigh_lookup(skb_dst(skb),
-					 &ipv6_hdr(skb)->daddr);
-		if (!neigh)
-			goto tx_err_link_failure;
+			neigh = dst_neigh_lookup(skb_dst(skb),
+						 &ipv6_hdr(skb)->daddr);
+			if (!neigh)
+				goto tx_err_link_failure;
 
-		addr6 = (struct in6_addr *)&neigh->primary_key;
-		addr_type = ipv6_addr_type(addr6);
+			addr6 = (struct in6_addr *)&neigh->primary_key;
+			addr_type = ipv6_addr_type(addr6);
 
-		if (addr_type == IPV6_ADDR_ANY)
-			addr6 = &ipv6_hdr(skb)->daddr;
+			if (addr_type == IPV6_ADDR_ANY)
+				addr6 = &ipv6_hdr(skb)->daddr;
 
-		memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));
-		neigh_release(neigh);
+			memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));
+			neigh_release(neigh);
+		}
 	} else if (!fl6->flowi6_mark)
 		dst = dst_cache_get(&t->dst_cache);
 

From d01d13e922d110f0b7b494477a2ea65fa6e83101 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 21 Aug 2020 10:53:08 +0200
Subject: [PATCH 0415/2658] Linux 4.4.233

Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index b9cc4448e3ab..b045f041cfd6 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 231
+SUBLEVEL = 233
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From dc7fa90fab5d3f55d7d65dbf31dff239ae9fd168 Mon Sep 17 00:00:00 2001
From: Liu Ying <victor.liu@nxp.com>
Date: Thu, 9 Jul 2020 10:28:52 +0800
Subject: [PATCH 0416/2658] drm/imx: imx-ldb: Disable both channels for split
 mode in enc->disable()

[ Upstream commit 3b2a999582c467d1883716b37ffcc00178a13713 ]

Both of the two LVDS channels should be disabled for split mode
in the encoder's ->disable() callback, because they are enabled
in the encoder's ->enable() callback.

Fixes: 6556f7f82b9c ("drm: imx: Move imx-drm driver out of staging")
Cc: Philipp Zabel <p.zabel@pengutronix.de>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
Cc: NXP Linux Team <linux-imx@nxp.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Liu Ying <victor.liu@nxp.com>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/imx/imx-ldb.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
index 31ca56e593f5..b9dc2ef64ed8 100644
--- a/drivers/gpu/drm/imx/imx-ldb.c
+++ b/drivers/gpu/drm/imx/imx-ldb.c
@@ -305,6 +305,7 @@ static void imx_ldb_encoder_disable(struct drm_encoder *encoder)
 {
 	struct imx_ldb_channel *imx_ldb_ch = enc_to_imx_ldb_ch(encoder);
 	struct imx_ldb *ldb = imx_ldb_ch->ldb;
+	int dual = ldb->ldb_ctrl & LDB_SPLIT_MODE_EN;
 	int mux, ret;
 
 	/*
@@ -321,14 +322,14 @@ static void imx_ldb_encoder_disable(struct drm_encoder *encoder)
 
 	drm_panel_disable(imx_ldb_ch->panel);
 
-	if (imx_ldb_ch == &ldb->channel[0])
+	if (imx_ldb_ch == &ldb->channel[0] || dual)
 		ldb->ldb_ctrl &= ~LDB_CH0_MODE_EN_MASK;
-	else if (imx_ldb_ch == &ldb->channel[1])
+	if (imx_ldb_ch == &ldb->channel[1] || dual)
 		ldb->ldb_ctrl &= ~LDB_CH1_MODE_EN_MASK;
 
 	regmap_write(ldb->regmap, IOMUXC_GPR2, ldb->ldb_ctrl);
 
-	if (ldb->ldb_ctrl & LDB_SPLIT_MODE_EN) {
+	if (dual) {
 		clk_disable_unprepare(ldb->clk[0]);
 		clk_disable_unprepare(ldb->clk[1]);
 	}

From 5f5682e9e6142b847146e527b32505c6f1913c5a Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: Fri, 10 Jul 2020 22:11:23 +0900
Subject: [PATCH 0417/2658] perf probe: Fix memory leakage when the probe point
 is not found

[ Upstream commit 12d572e785b15bc764e956caaa8a4c846fd15694 ]

Fix the memory leakage in debuginfo__find_trace_events() when the probe
point is not found in the debuginfo. If there is no probe point found in
the debuginfo, debuginfo__find_probes() will NOT return -ENOENT, but 0.

Thus the caller of debuginfo__find_probes() must check the tf.ntevs and
release the allocated memory for the array of struct probe_trace_event.

The current code releases the memory only if the debuginfo__find_probes()
hits an error but not checks tf.ntevs. In the result, the memory allocated
on *tevs are not released if tf.ntevs == 0.

This fixes the memory leakage by checking tf.ntevs == 0 in addition to
ret < 0.

Fixes: ff741783506c ("perf probe: Introduce debuginfo to encapsulate dwarf information")
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: stable@vger.kernel.org
Link: http://lore.kernel.org/lkml/159438668346.62703.10887420400718492503.stgit@devnote2
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/probe-finder.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index c694f10d004c..1b73537af91d 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -1274,7 +1274,7 @@ int debuginfo__find_trace_events(struct debuginfo *dbg,
 	tf.ntevs = 0;
 
 	ret = debuginfo__find_probes(dbg, &tf.pf);
-	if (ret < 0) {
+	if (ret < 0 || tf.ntevs == 0) {
 		for (i = 0; i < tf.ntevs; i++)
 			clear_probe_trace_event(&tf.tevs[i]);
 		zfree(tevs);

From bc58290117502fb9346242883d00549d8560e0a1 Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Tue, 9 Jun 2020 16:11:29 -0700
Subject: [PATCH 0418/2658] net/compat: Add missing sock updates for SCM_RIGHTS

[ Upstream commit d9539752d23283db4692384a634034f451261e29 ]

Add missed sock updates to compat path via a new helper, which will be
used more in coming patches. (The net/core/scm.c code is left as-is here
to assist with -stable backports for the compat path.)

Cc: Christoph Hellwig <hch@lst.de>
Cc: Sargun Dhillon <sargun@sargun.me>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: stable@vger.kernel.org
Fixes: 48a87cc26c13 ("net: netprio: fd passed in SCM_RIGHTS datagram not set correctly")
Fixes: d84295067fc7 ("net: net_cls: fd passed in SCM_RIGHTS datagram not set correctly")
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/sock.h |  4 ++++
 net/compat.c       |  1 +
 net/core/sock.c    | 21 +++++++++++++++++++++
 3 files changed, 26 insertions(+)

diff --git a/include/net/sock.h b/include/net/sock.h
index 0ccce8c98cfa..c3abc39a2fd6 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -782,6 +782,8 @@ static inline int sk_memalloc_socks(void)
 {
 	return static_key_false(&memalloc_socks);
 }
+
+void __receive_sock(struct file *file);
 #else
 
 static inline int sk_memalloc_socks(void)
@@ -789,6 +791,8 @@ static inline int sk_memalloc_socks(void)
 	return 0;
 }
 
+static inline void __receive_sock(struct file *file)
+{ }
 #endif
 
 static inline gfp_t sk_gfp_atomic(const struct sock *sk, gfp_t gfp_mask)
diff --git a/net/compat.c b/net/compat.c
index d67684010455..20c5e5f215f2 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -284,6 +284,7 @@ void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
 			break;
 		}
 		/* Bump the usage count and install the file. */
+		__receive_sock(fp[i]);
 		fd_install(new_fd, get_file(fp[i]));
 	}
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 66a192395398..cdf2ca201a4f 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2287,6 +2287,27 @@ int sock_no_mmap(struct file *file, struct socket *sock, struct vm_area_struct *
 }
 EXPORT_SYMBOL(sock_no_mmap);
 
+/*
+ * When a file is received (via SCM_RIGHTS, etc), we must bump the
+ * various sock-based usage counts.
+ */
+void __receive_sock(struct file *file)
+{
+	struct socket *sock;
+	int error;
+
+	/*
+	 * The resulting value of "error" is ignored here since we only
+	 * need to take action when the file is a socket and testing
+	 * "sock" for NULL is sufficient.
+	 */
+	sock = sock_from_file(file, &error);
+	if (sock) {
+		sock_update_netprioidx(sock->sk);
+		sock_update_classid(sock->sk);
+	}
+}
+
 ssize_t sock_no_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags)
 {
 	ssize_t res;

From be64739b6a73aee6728d726a7a69d6186bfa2152 Mon Sep 17 00:00:00 2001
From: Ahmad Fatoum <a.fatoum@pengutronix.de>
Date: Thu, 11 Jun 2020 21:17:43 +0200
Subject: [PATCH 0419/2658] watchdog: f71808e_wdt: indicate WDIOF_CARDRESET
 support in watchdog_info.options

[ Upstream commit e871e93fb08a619dfc015974a05768ed6880fd82 ]

The driver supports populating bootstatus with WDIOF_CARDRESET, but so
far userspace couldn't portably determine whether absence of this flag
meant no watchdog reset or no driver support. Or-in the bit to fix this.

Fixes: b97cb21a4634 ("watchdog: f71808e_wdt: Fix WDTMOUT_STS register read")
Cc: stable@vger.kernel.org
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20200611191750.28096-3-a.fatoum@pengutronix.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/f71808e_wdt.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c
index 2048aad91add..3577e356e08c 100644
--- a/drivers/watchdog/f71808e_wdt.c
+++ b/drivers/watchdog/f71808e_wdt.c
@@ -644,7 +644,8 @@ static int __init watchdog_init(int sioaddr)
 	watchdog.sioaddr = sioaddr;
 	watchdog.ident.options = WDIOC_SETTIMEOUT
 				| WDIOF_MAGICCLOSE
-				| WDIOF_KEEPALIVEPING;
+				| WDIOF_KEEPALIVEPING
+				| WDIOF_CARDRESET;
 
 	snprintf(watchdog.ident.identity,
 		sizeof(watchdog.ident.identity), "%s watchdog",

From 83e37c4d41d69c97ffd12dd7996181beb259b80a Mon Sep 17 00:00:00 2001
From: Ahmad Fatoum <a.fatoum@pengutronix.de>
Date: Thu, 11 Jun 2020 21:17:44 +0200
Subject: [PATCH 0420/2658] watchdog: f71808e_wdt: remove use of wrong
 watchdog_info option

[ Upstream commit 802141462d844f2e6a4d63a12260d79b7afc4c34 ]

The flags that should be or-ed into the watchdog_info.options by drivers
all start with WDIOF_, e.g. WDIOF_SETTIMEOUT, which indicates that the
driver's watchdog_ops has a usable set_timeout.

WDIOC_SETTIMEOUT was used instead, which expands to 0xc0045706, which
equals:

   WDIOF_FANFAULT | WDIOF_EXTERN1 | WDIOF_PRETIMEOUT | WDIOF_ALARMONLY |
   WDIOF_MAGICCLOSE | 0xc0045000

These were so far indicated to userspace on WDIOC_GETSUPPORT.
As the driver has not yet been migrated to the new watchdog kernel API,
the constant can just be dropped without substitute.

Fixes: 96cb4eb019ce ("watchdog: f71808e_wdt: new watchdog driver for Fintek F71808E and F71882FG")
Cc: stable@vger.kernel.org
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20200611191750.28096-4-a.fatoum@pengutronix.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/f71808e_wdt.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c
index 3577e356e08c..2b12ef019ae0 100644
--- a/drivers/watchdog/f71808e_wdt.c
+++ b/drivers/watchdog/f71808e_wdt.c
@@ -642,8 +642,7 @@ static int __init watchdog_init(int sioaddr)
 	 * into the module have been registered yet.
 	 */
 	watchdog.sioaddr = sioaddr;
-	watchdog.ident.options = WDIOC_SETTIMEOUT
-				| WDIOF_MAGICCLOSE
+	watchdog.ident.options = WDIOF_MAGICCLOSE
 				| WDIOF_KEEPALIVEPING
 				| WDIOF_CARDRESET;
 

From 6b3c2801875002c2e224c11425118a2360b70c79 Mon Sep 17 00:00:00 2001
From: Andrea Arcangeli <aarcange@redhat.com>
Date: Thu, 13 Jun 2019 15:56:11 -0700
Subject: [PATCH 0421/2658] coredump: fix race condition between
 collapse_huge_page() and core dumping

[ Upstream commit 59ea6d06cfa9247b586a695c21f94afa7183af74 ]

When fixing the race conditions between the coredump and the mmap_sem
holders outside the context of the process, we focused on
mmget_not_zero()/get_task_mm() callers in 04f5866e41fb70 ("coredump: fix
race condition between mmget_not_zero()/get_task_mm() and core
dumping"), but those aren't the only cases where the mmap_sem can be
taken outside of the context of the process as Michal Hocko noticed
while backporting that commit to older -stable kernels.

If mmgrab() is called in the context of the process, but then the
mm_count reference is transferred outside the context of the process,
that can also be a problem if the mmap_sem has to be taken for writing
through that mm_count reference.

khugepaged registration calls mmgrab() in the context of the process,
but the mmap_sem for writing is taken later in the context of the
khugepaged kernel thread.

collapse_huge_page() after taking the mmap_sem for writing doesn't
modify any vma, so it's not obvious that it could cause a problem to the
coredump, but it happens to modify the pmd in a way that breaks an
invariant that pmd_trans_huge_lock() relies upon.  collapse_huge_page()
needs the mmap_sem for writing just to block concurrent page faults that
call pmd_trans_huge_lock().

Specifically the invariant that "!pmd_trans_huge()" cannot become a
"pmd_trans_huge()" doesn't hold while collapse_huge_page() runs.

The coredump will call __get_user_pages() without mmap_sem for reading,
which eventually can invoke a lockless page fault which will need a
functional pmd_trans_huge_lock().

So collapse_huge_page() needs to use mmget_still_valid() to check it's
not running concurrently with the coredump...  as long as the coredump
can invoke page faults without holding the mmap_sem for reading.

This has "Fixes: khugepaged" to facilitate backporting, but in my view
it's more a bug in the coredump code that will eventually have to be
rewritten to stop invoking page faults without the mmap_sem for reading.
So the long term plan is still to drop all mmget_still_valid().

Link: http://lkml.kernel.org/r/20190607161558.32104-1-aarcange@redhat.com
Fixes: ba76149f47d8 ("thp: khugepaged")
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Reported-by: Michal Hocko <mhocko@suse.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Jason Gunthorpe <jgg@mellanox.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/mm.h | 4 ++++
 mm/huge_memory.c   | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/include/linux/mm.h b/include/linux/mm.h
index 54a37d2273be..9fb92474beb6 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1158,6 +1158,10 @@ void unmap_vmas(struct mmu_gather *tlb, struct vm_area_struct *start_vma,
  * followed by taking the mmap_sem for writing before modifying the
  * vmas or anything the coredump pretends not to change from under it.
  *
+ * It also has to be called when mmgrab() is used in the context of
+ * the process, but then the mm_count refcount is transferred outside
+ * the context of the process to run down_write() on that pinned mm.
+ *
  * NOTE: find_extend_vma() called from GUP context is the only place
  * that can modify the "mm" (notably the vm_start/end) under mmap_sem
  * for reading and outside the context of the process, so it is also
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 465786cd6490..c5628ebc0fc2 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2587,6 +2587,9 @@ static void collapse_huge_page(struct mm_struct *mm,
 	 * handled by the anon_vma lock + PG_lock.
 	 */
 	down_write(&mm->mmap_sem);
+	result = SCAN_ANY_PROCESS;
+	if (!mmget_still_valid(mm))
+		goto out;
 	if (unlikely(khugepaged_test_exit(mm)))
 		goto out;
 

From ed3e98fd0d19d1d5f5f688694719c5348b5bdd02 Mon Sep 17 00:00:00 2001
From: Hugh Dickins <hughd@google.com>
Date: Thu, 6 Aug 2020 23:26:25 -0700
Subject: [PATCH 0422/2658] khugepaged: khugepaged_test_exit() check
 mmget_still_valid()

[ Upstream commit bbe98f9cadff58cdd6a4acaeba0efa8565dabe65 ]

Move collapse_huge_page()'s mmget_still_valid() check into
khugepaged_test_exit() itself.  collapse_huge_page() is used for anon THP
only, and earned its mmget_still_valid() check because it inserts a huge
pmd entry in place of the page table's pmd entry; whereas
collapse_file()'s retract_page_tables() or collapse_pte_mapped_thp()
merely clears the page table's pmd entry.  But core dumping without mmap
lock must have been as open to mistaking a racily cleared pmd entry for a
page table at physical page 0, as exit_mmap() was.  And we certainly have
no interest in mapping as a THP once dumping core.

Fixes: 59ea6d06cfa9 ("coredump: fix race condition between collapse_huge_page() and core dumping")
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Song Liu <songliubraving@fb.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: <stable@vger.kernel.org>	[4.8+]
Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2008021217020.27773@eggly.anvils
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/huge_memory.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index c5628ebc0fc2..1c4d7d2f53d2 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2136,7 +2136,7 @@ static void insert_to_mm_slots_hash(struct mm_struct *mm,
 
 static inline int khugepaged_test_exit(struct mm_struct *mm)
 {
-	return atomic_read(&mm->mm_users) == 0;
+	return atomic_read(&mm->mm_users) == 0 || !mmget_still_valid(mm);
 }
 
 int __khugepaged_enter(struct mm_struct *mm)
@@ -2587,9 +2587,6 @@ static void collapse_huge_page(struct mm_struct *mm,
 	 * handled by the anon_vma lock + PG_lock.
 	 */
 	down_write(&mm->mmap_sem);
-	result = SCAN_ANY_PROCESS;
-	if (!mmget_still_valid(mm))
-		goto out;
 	if (unlikely(khugepaged_test_exit(mm)))
 		goto out;
 

From fcfc87a3f6099a023ba5609bc35784aaf81fc5a9 Mon Sep 17 00:00:00 2001
From: Hugh Dickins <hughd@google.com>
Date: Thu, 20 Aug 2020 17:42:02 -0700
Subject: [PATCH 0423/2658] khugepaged: adjust VM_BUG_ON_MM() in
 __khugepaged_enter()

[ Upstream commit f3f99d63a8156c7a4a6b20aac22b53c5579c7dc1 ]

syzbot crashes on the VM_BUG_ON_MM(khugepaged_test_exit(mm), mm) in
__khugepaged_enter(): yes, when one thread is about to dump core, has set
core_state, and is waiting for others, another might do something calling
__khugepaged_enter(), which now crashes because I lumped the core_state
test (known as "mmget_still_valid") into khugepaged_test_exit().  I still
think it's best to lump them together, so just in this exceptional case,
check mm->mm_users directly instead of khugepaged_test_exit().

Fixes: bbe98f9cadff ("khugepaged: khugepaged_test_exit() check mmget_still_valid()")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Yang Shi <shy828301@gmail.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Song Liu <songliubraving@fb.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: <stable@vger.kernel.org>	[4.8+]
Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2008141503370.18085@eggly.anvils
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/huge_memory.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 1c4d7d2f53d2..f38d24bb8a1b 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2149,7 +2149,7 @@ int __khugepaged_enter(struct mm_struct *mm)
 		return -ENOMEM;
 
 	/* __khugepaged_exit() must not run from under us */
-	VM_BUG_ON_MM(khugepaged_test_exit(mm), mm);
+	VM_BUG_ON_MM(atomic_read(&mm->mm_users) == 0, mm);
 	if (unlikely(test_and_set_bit(MMF_VM_HUGEPAGE, &mm->flags))) {
 		free_mm_slot(mm_slot);
 		return 0;

From 1e048126bfbfc1b2f41ee3303fd9fae2ab264703 Mon Sep 17 00:00:00 2001
From: Marcos Paulo de Souza <mpdesouza@suse.com>
Date: Fri, 21 Feb 2020 14:56:12 +0100
Subject: [PATCH 0424/2658] btrfs: export helpers for subvolume name/id
 resolution

[ Upstream commit c0c907a47dccf2cf26251a8fb4a8e7a3bf79ce84 ]

The functions will be used outside of export.c and super.c to allow
resolving subvolume name from a given id, eg. for subvolume deletion by
id ioctl.

Signed-off-by: Marcos Paulo de Souza <mpdesouza@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
[ split from the next patch ]
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/ctree.h  | 2 ++
 fs/btrfs/export.c | 8 ++++----
 fs/btrfs/export.h | 5 +++++
 fs/btrfs/super.c  | 8 ++++----
 4 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 0b06d4942da7..8fb9a1e0048b 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -4096,6 +4096,8 @@ ssize_t btrfs_listxattr(struct dentry *dentry, char *buffer, size_t size);
 /* super.c */
 int btrfs_parse_options(struct btrfs_root *root, char *options);
 int btrfs_sync_fs(struct super_block *sb, int wait);
+char *btrfs_get_subvol_name_from_objectid(struct btrfs_fs_info *fs_info,
+					  u64 subvol_objectid);
 
 #ifdef CONFIG_PRINTK
 __printf(2, 3)
diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c
index 2513a7f53334..92f80ed64219 100644
--- a/fs/btrfs/export.c
+++ b/fs/btrfs/export.c
@@ -55,9 +55,9 @@ static int btrfs_encode_fh(struct inode *inode, u32 *fh, int *max_len,
 	return type;
 }
 
-static struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid,
-				       u64 root_objectid, u32 generation,
-				       int check_generation)
+struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid,
+				u64 root_objectid, u32 generation,
+				int check_generation)
 {
 	struct btrfs_fs_info *fs_info = btrfs_sb(sb);
 	struct btrfs_root *root;
@@ -150,7 +150,7 @@ static struct dentry *btrfs_fh_to_dentry(struct super_block *sb, struct fid *fh,
 	return btrfs_get_dentry(sb, objectid, root_objectid, generation, 1);
 }
 
-static struct dentry *btrfs_get_parent(struct dentry *child)
+struct dentry *btrfs_get_parent(struct dentry *child)
 {
 	struct inode *dir = d_inode(child);
 	struct btrfs_root *root = BTRFS_I(dir)->root;
diff --git a/fs/btrfs/export.h b/fs/btrfs/export.h
index 074348a95841..7a305e554999 100644
--- a/fs/btrfs/export.h
+++ b/fs/btrfs/export.h
@@ -16,4 +16,9 @@ struct btrfs_fid {
 	u64 parent_root_objectid;
 } __attribute__ ((packed));
 
+struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid,
+				u64 root_objectid, u32 generation,
+				int check_generation);
+struct dentry *btrfs_get_parent(struct dentry *child);
+
 #endif
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 404051bf5cba..540e6f141745 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -843,8 +843,8 @@ static int btrfs_parse_early_options(const char *options, fmode_t flags,
 	return error;
 }
 
-static char *get_subvol_name_from_objectid(struct btrfs_fs_info *fs_info,
-					   u64 subvol_objectid)
+char *btrfs_get_subvol_name_from_objectid(struct btrfs_fs_info *fs_info,
+					  u64 subvol_objectid)
 {
 	struct btrfs_root *root = fs_info->tree_root;
 	struct btrfs_root *fs_root;
@@ -1323,8 +1323,8 @@ static struct dentry *mount_subvol(const char *subvol_name, u64 subvol_objectid,
 				goto out;
 			}
 		}
-		subvol_name = get_subvol_name_from_objectid(btrfs_sb(mnt->mnt_sb),
-							    subvol_objectid);
+		subvol_name = btrfs_get_subvol_name_from_objectid(
+					btrfs_sb(mnt->mnt_sb), subvol_objectid);
 		if (IS_ERR(subvol_name)) {
 			root = ERR_CAST(subvol_name);
 			subvol_name = NULL;

From 71515eabfe8db166e85a462839beb32cd32e0899 Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Wed, 22 Jul 2020 11:12:46 -0400
Subject: [PATCH 0425/2658] btrfs: don't show full path of bind mounts in
 subvol=

[ Upstream commit 3ef3959b29c4a5bd65526ab310a1a18ae533172a ]

Chris Murphy reported a problem where rpm ostree will bind mount a bunch
of things for whatever voodoo it's doing.  But when it does this
/proc/mounts shows something like

  /dev/sda /mnt/test btrfs rw,relatime,subvolid=256,subvol=/foo 0 0
  /dev/sda /mnt/test/baz btrfs rw,relatime,subvolid=256,subvol=/foo/bar 0 0

Despite subvolid=256 being subvol=/foo.  This is because we're just
spitting out the dentry of the mount point, which in the case of bind
mounts is the source path for the mountpoint.  Instead we should spit
out the path to the actual subvol.  Fix this by looking up the name for
the subvolid we have mounted.  With this fix the same test looks like
this

  /dev/sda /mnt/test btrfs rw,relatime,subvolid=256,subvol=/foo 0 0
  /dev/sda /mnt/test/baz btrfs rw,relatime,subvolid=256,subvol=/foo 0 0

Reported-by: Chris Murphy <chris@colorremedies.com>
CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/super.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 540e6f141745..77e6ce0e1e35 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -1120,6 +1120,7 @@ static int btrfs_show_options(struct seq_file *seq, struct dentry *dentry)
 	struct btrfs_fs_info *info = btrfs_sb(dentry->d_sb);
 	struct btrfs_root *root = info->tree_root;
 	char *compress_type;
+	const char *subvol_name;
 
 	if (btrfs_test_opt(root, DEGRADED))
 		seq_puts(seq, ",degraded");
@@ -1204,8 +1205,13 @@ static int btrfs_show_options(struct seq_file *seq, struct dentry *dentry)
 #endif
 	seq_printf(seq, ",subvolid=%llu",
 		  BTRFS_I(d_inode(dentry))->root->root_key.objectid);
-	seq_puts(seq, ",subvol=");
-	seq_dentry(seq, dentry, " \t\n\\");
+	subvol_name = btrfs_get_subvol_name_from_objectid(info,
+			BTRFS_I(d_inode(dentry))->root->root_key.objectid);
+	if (!IS_ERR(subvol_name)) {
+		seq_puts(seq, ",subvol=");
+		seq_escape(seq, subvol_name, " \t\n\\");
+		kfree(subvol_name);
+	}
 	return 0;
 }
 

From 7c31e2cd053a05e1ab7b4343324fa409fb50d845 Mon Sep 17 00:00:00 2001
From: Jann Horn <jannh@google.com>
Date: Thu, 20 Aug 2020 17:42:11 -0700
Subject: [PATCH 0426/2658] romfs: fix uninitialized memory leak in
 romfs_dev_read()

commit bcf85fcedfdd17911982a3e3564fcfec7b01eebd upstream.

romfs has a superblock field that limits the size of the filesystem; data
beyond that limit is never accessed.

romfs_dev_read() fetches a caller-supplied number of bytes from the
backing device.  It returns 0 on success or an error code on failure;
therefore, its API can't represent short reads, it's all-or-nothing.

However, when romfs_dev_read() detects that the requested operation would
cross the filesystem size limit, it currently silently truncates the
requested number of bytes.  This e.g.  means that when the content of a
file with size 0x1000 starts one byte before the filesystem size limit,
->readpage() will only fill a single byte of the supplied page while
leaving the rest uninitialized, leaking that uninitialized memory to
userspace.

Fix it by returning an error code instead of truncating the read when the
requested read operation would go beyond the end of the filesystem.

Fixes: da4458bda237 ("NOMMU: Make it possible for RomFS to use MTD devices directly")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: David Howells <dhowells@redhat.com>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/20200818013202.2246365-1-jannh@google.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/romfs/storage.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/fs/romfs/storage.c b/fs/romfs/storage.c
index f86f51f99ace..1dcadd22b440 100644
--- a/fs/romfs/storage.c
+++ b/fs/romfs/storage.c
@@ -221,10 +221,8 @@ int romfs_dev_read(struct super_block *sb, unsigned long pos,
 	size_t limit;
 
 	limit = romfs_maxsize(sb);
-	if (pos >= limit)
+	if (pos >= limit || buflen > limit - pos)
 		return -EIO;
-	if (buflen > limit - pos)
-		buflen = limit - pos;
 
 #ifdef CONFIG_ROMFS_ON_MTD
 	if (sb->s_mtd)

From 5c4f6febca52ce15a158aaa0a4277f3971ef6ffe Mon Sep 17 00:00:00 2001
From: Doug Berger <opendmb@gmail.com>
Date: Thu, 20 Aug 2020 17:42:24 -0700
Subject: [PATCH 0427/2658] mm: include CMA pages in lowmem_reserve at boot

commit e08d3fdfe2dafa0331843f70ce1ff6c1c4900bf4 upstream.

The lowmem_reserve arrays provide a means of applying pressure against
allocations from lower zones that were targeted at higher zones.  Its
values are a function of the number of pages managed by higher zones and
are assigned by a call to the setup_per_zone_lowmem_reserve() function.

The function is initially called at boot time by the function
init_per_zone_wmark_min() and may be called later by accesses of the
/proc/sys/vm/lowmem_reserve_ratio sysctl file.

The function init_per_zone_wmark_min() was moved up from a module_init to
a core_initcall to resolve a sequencing issue with khugepaged.
Unfortunately this created a sequencing issue with CMA page accounting.

The CMA pages are added to the managed page count of a zone when
cma_init_reserved_areas() is called at boot also as a core_initcall.  This
makes it uncertain whether the CMA pages will be added to the managed page
counts of their zones before or after the call to
init_per_zone_wmark_min() as it becomes dependent on link order.  With the
current link order the pages are added to the managed count after the
lowmem_reserve arrays are initialized at boot.

This means the lowmem_reserve values at boot may be lower than the values
used later if /proc/sys/vm/lowmem_reserve_ratio is accessed even if the
ratio values are unchanged.

In many cases the difference is not significant, but for example
an ARM platform with 1GB of memory and the following memory layout

  cma: Reserved 256 MiB at 0x0000000030000000
  Zone ranges:
    DMA      [mem 0x0000000000000000-0x000000002fffffff]
    Normal   empty
    HighMem  [mem 0x0000000030000000-0x000000003fffffff]

would result in 0 lowmem_reserve for the DMA zone.  This would allow
userspace to deplete the DMA zone easily.

Funnily enough

  $ cat /proc/sys/vm/lowmem_reserve_ratio

would fix up the situation because as a side effect it forces
setup_per_zone_lowmem_reserve.

This commit breaks the link order dependency by invoking
init_per_zone_wmark_min() as a postcore_initcall so that the CMA pages
have the chance to be properly accounted in their zone(s) and allowing
the lowmem_reserve arrays to receive consistent values.

Fixes: bc22af74f271 ("mm: update min_free_kbytes from khugepaged after core initialization")
Signed-off-by: Doug Berger <opendmb@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Jason Baron <jbaron@akamai.com>
Cc: David Rientjes <rientjes@google.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/1597423766-27849-1-git-send-email-opendmb@gmail.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/page_alloc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 508ba9e4a83f..fa47a32171c7 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -6371,7 +6371,7 @@ int __meminit init_per_zone_wmark_min(void)
 	setup_per_zone_inactive_ratio();
 	return 0;
 }
-core_initcall(init_per_zone_wmark_min)
+postcore_initcall(init_per_zone_wmark_min)
 
 /*
  * min_free_kbytes_sysctl_handler - just a wrapper around proc_dointvec() so

From ef19defd97233c44eb804d9256bc394a81d35df4 Mon Sep 17 00:00:00 2001
From: Charan Teja Reddy <charante@codeaurora.org>
Date: Thu, 20 Aug 2020 17:42:27 -0700
Subject: [PATCH 0428/2658] mm, page_alloc: fix core hung in
 free_pcppages_bulk()

commit 88e8ac11d2ea3acc003cf01bb5a38c8aa76c3cfd upstream.

The following race is observed with the repeated online, offline and a
delay between two successive online of memory blocks of movable zone.

P1						P2

Online the first memory block in
the movable zone. The pcp struct
values are initialized to default
values,i.e., pcp->high = 0 &
pcp->batch = 1.

					Allocate the pages from the
					movable zone.

Try to Online the second memory
block in the movable zone thus it
entered the online_pages() but yet
to call zone_pcp_update().
					This process is entered into
					the exit path thus it tries
					to release the order-0 pages
					to pcp lists through
					free_unref_page_commit().
					As pcp->high = 0, pcp->count = 1
					proceed to call the function
					free_pcppages_bulk().
Update the pcp values thus the
new pcp values are like, say,
pcp->high = 378, pcp->batch = 63.
					Read the pcp's batch value using
					READ_ONCE() and pass the same to
					free_pcppages_bulk(), pcp values
					passed here are, batch = 63,
					count = 1.

					Since num of pages in the pcp
					lists are less than ->batch,
					then it will stuck in
					while(list_empty(list)) loop
					with interrupts disabled thus
					a core hung.

Avoid this by ensuring free_pcppages_bulk() is called with proper count of
pcp list pages.

The mentioned race is some what easily reproducible without [1] because
pcp's are not updated for the first memory block online and thus there is
a enough race window for P2 between alloc+free and pcp struct values
update through onlining of second memory block.

With [1], the race still exists but it is very narrow as we update the pcp
struct values for the first memory block online itself.

This is not limited to the movable zone, it could also happen in cases
with the normal zone (e.g., hotplug to a node that only has DMA memory, or
no other memory yet).

[1]: https://patchwork.kernel.org/patch/11696389/

Fixes: 5f8dcc21211a ("page-allocator: split per-cpu list into one-list-per-migrate-type")
Signed-off-by: Charan Teja Reddy <charante@codeaurora.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: David Rientjes <rientjes@google.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Vinayak Menon <vinmenon@codeaurora.org>
Cc: <stable@vger.kernel.org> [2.6+]
Link: http://lkml.kernel.org/r/1597150703-19003-1-git-send-email-charante@codeaurora.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/page_alloc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index fa47a32171c7..b18faa167bf8 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -867,6 +867,11 @@ static void free_pcppages_bulk(struct zone *zone, int count,
 	if (nr_scanned)
 		__mod_zone_page_state(zone, NR_PAGES_SCANNED, -nr_scanned);
 
+	/*
+	 * Ensure proper count is passed which otherwise would stuck in the
+	 * below while (list_empty(list)) loop.
+	 */
+	count = min(pcp->count, count);
 	while (to_free) {
 		struct page *page;
 		struct list_head *list;

From 9a873f4c6f9f2b462c64d4212063b59b6eb60998 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Mon, 24 Apr 2017 10:00:13 -0700
Subject: [PATCH 0429/2658] ext4: clean up ext4_match() and callers

[ Upstream commit d9b9f8d5a88cb7881d9f1c2b7e9de9a3fe1dc9e2 ]

When ext4 encryption was originally merged, we were encrypting the
user-specified filename in ext4_match(), introducing a lot of additional
complexity into ext4_match() and its callers.  This has since been
changed to encrypt the filename earlier, so we can remove the gunk
that's no longer needed.  This more or less reverts ext4_search_dir()
and ext4_find_dest_de() to the way they were in the v4.0 kernel.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/namei.c | 81 +++++++++++++++----------------------------------
 1 file changed, 25 insertions(+), 56 deletions(-)

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 32d48f953c04..186d32872410 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1226,19 +1226,18 @@ static void dx_insert_block(struct dx_frame *frame, u32 hash, ext4_lblk_t block)
 }
 
 /*
- * NOTE! unlike strncmp, ext4_match returns 1 for success, 0 for failure.
+ * Test whether a directory entry matches the filename being searched for.
  *
- * `len <= EXT4_NAME_LEN' is guaranteed by caller.
- * `de != NULL' is guaranteed by caller.
+ * Return: %true if the directory entry matches, otherwise %false.
  */
-static inline int ext4_match(struct ext4_filename *fname,
-			     struct ext4_dir_entry_2 *de)
+static inline bool ext4_match(const struct ext4_filename *fname,
+			      const struct ext4_dir_entry_2 *de)
 {
 	const void *name = fname_name(fname);
 	u32 len = fname_len(fname);
 
 	if (!de->inode)
-		return 0;
+		return false;
 
 #ifdef CONFIG_EXT4_FS_ENCRYPTION
 	if (unlikely(!name)) {
@@ -1270,48 +1269,31 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size,
 	struct ext4_dir_entry_2 * de;
 	char * dlimit;
 	int de_len;
-	int res;
 
 	de = (struct ext4_dir_entry_2 *)search_buf;
 	dlimit = search_buf + buf_size;
 	while ((char *) de < dlimit) {
 		/* this code is executed quadratically often */
 		/* do minimal checking `by hand' */
-		if ((char *) de + de->name_len <= dlimit) {
-			res = ext4_match(fname, de);
-			if (res < 0) {
-				res = -1;
-				goto return_result;
-			}
-			if (res > 0) {
-				/* found a match - just to be sure, do
-				 * a full check */
-				if (ext4_check_dir_entry(dir, NULL, de, bh,
-						bh->b_data,
-						 bh->b_size, offset)) {
-					res = -1;
-					goto return_result;
-				}
-				*res_dir = de;
-				res = 1;
-				goto return_result;
-			}
-
+		if ((char *) de + de->name_len <= dlimit &&
+		    ext4_match(fname, de)) {
+			/* found a match - just to be sure, do
+			 * a full check */
+			if (ext4_check_dir_entry(dir, NULL, de, bh, bh->b_data,
+						 bh->b_size, offset))
+				return -1;
+			*res_dir = de;
+			return 1;
 		}
 		/* prevent looping on a bad block */
 		de_len = ext4_rec_len_from_disk(de->rec_len,
 						dir->i_sb->s_blocksize);
-		if (de_len <= 0) {
-			res = -1;
-			goto return_result;
-		}
+		if (de_len <= 0)
+			return -1;
 		offset += de_len;
 		de = (struct ext4_dir_entry_2 *) ((char *) de + de_len);
 	}
-
-	res = 0;
-return_result:
-	return res;
+	return 0;
 }
 
 static int is_dx_internal_node(struct inode *dir, ext4_lblk_t block,
@@ -1824,24 +1806,15 @@ int ext4_find_dest_de(struct inode *dir, struct inode *inode,
 	int nlen, rlen;
 	unsigned int offset = 0;
 	char *top;
-	int res;
 
 	de = (struct ext4_dir_entry_2 *)buf;
 	top = buf + buf_size - reclen;
 	while ((char *) de <= top) {
 		if (ext4_check_dir_entry(dir, NULL, de, bh,
-					 buf, buf_size, offset)) {
-			res = -EFSCORRUPTED;
-			goto return_result;
-		}
-		/* Provide crypto context and crypto buffer to ext4 match */
-		res = ext4_match(fname, de);
-		if (res < 0)
-			goto return_result;
-		if (res > 0) {
-			res = -EEXIST;
-			goto return_result;
-		}
+					 buf, buf_size, offset))
+			return -EFSCORRUPTED;
+		if (ext4_match(fname, de))
+			return -EEXIST;
 		nlen = EXT4_DIR_REC_LEN(de->name_len);
 		rlen = ext4_rec_len_from_disk(de->rec_len, buf_size);
 		if ((de->inode ? rlen - nlen : rlen) >= reclen)
@@ -1849,15 +1822,11 @@ int ext4_find_dest_de(struct inode *dir, struct inode *inode,
 		de = (struct ext4_dir_entry_2 *)((char *)de + rlen);
 		offset += rlen;
 	}
-
 	if ((char *) de > top)
-		res = -ENOSPC;
-	else {
-		*dest_de = de;
-		res = 0;
-	}
-return_result:
-	return res;
+		return -ENOSPC;
+
+	*dest_de = de;
+	return 0;
 }
 
 int ext4_insert_dentry(struct inode *dir,

From 47246202258f0142fbf77c81d4752b48310de766 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Fri, 31 Jul 2020 18:21:35 +0200
Subject: [PATCH 0430/2658] ext4: fix checking of directory entry validity for
 inline directories

[ Upstream commit 7303cb5bfe845f7d43cd9b2dbd37dbb266efda9b ]

ext4_search_dir() and ext4_generic_delete_entry() can be called both for
standard director blocks and for inline directories stored inside inode
or inline xattr space. For the second case we didn't call
ext4_check_dir_entry() with proper constraints that could result in
accepting corrupted directory entry as well as false positive filesystem
errors like:

EXT4-fs error (device dm-0): ext4_search_dir:1395: inode #28320400:
block 113246792: comm dockerd: bad entry in directory: directory entry too
close to block end - offset=0, inode=28320403, rec_len=32, name_len=8,
size=4096

Fix the arguments passed to ext4_check_dir_entry().

Fixes: 109ba779d6cc ("ext4: check for directory entries too close to block end")
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20200731162135.8080-1-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/namei.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 186d32872410..97d4bca9642e 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1279,8 +1279,8 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size,
 		    ext4_match(fname, de)) {
 			/* found a match - just to be sure, do
 			 * a full check */
-			if (ext4_check_dir_entry(dir, NULL, de, bh, bh->b_data,
-						 bh->b_size, offset))
+			if (ext4_check_dir_entry(dir, NULL, de, bh, search_buf,
+						 buf_size, offset))
 				return -1;
 			*res_dir = de;
 			return 1;
@@ -2309,7 +2309,7 @@ int ext4_generic_delete_entry(handle_t *handle,
 	de = (struct ext4_dir_entry_2 *)entry_buf;
 	while (i < buf_size - csum_size) {
 		if (ext4_check_dir_entry(dir, NULL, de, bh,
-					 bh->b_data, bh->b_size, i))
+					 entry_buf, buf_size, i))
 			return -EFSCORRUPTED;
 		if (de == de_del)  {
 			if (pde)

From da466e7c1f3722e03b8fc49197a77d3af9d10251 Mon Sep 17 00:00:00 2001
From: Chuhong Yuan <hslester96@gmail.com>
Date: Fri, 5 Jun 2020 18:17:28 +0200
Subject: [PATCH 0431/2658] media: budget-core: Improve exception handling in
 budget_register()

[ Upstream commit fc0456458df8b3421dba2a5508cd817fbc20ea71 ]

budget_register() has no error handling after its failure.
Add the missed undo functions for error handling to fix it.

Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/ttpci/budget-core.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/media/pci/ttpci/budget-core.c b/drivers/media/pci/ttpci/budget-core.c
index e9674b40007c..6107c469efa0 100644
--- a/drivers/media/pci/ttpci/budget-core.c
+++ b/drivers/media/pci/ttpci/budget-core.c
@@ -386,20 +386,25 @@ static int budget_register(struct budget *budget)
 	ret = dvbdemux->dmx.add_frontend(&dvbdemux->dmx, &budget->hw_frontend);
 
 	if (ret < 0)
-		return ret;
+		goto err_release_dmx;
 
 	budget->mem_frontend.source = DMX_MEMORY_FE;
 	ret = dvbdemux->dmx.add_frontend(&dvbdemux->dmx, &budget->mem_frontend);
 	if (ret < 0)
-		return ret;
+		goto err_release_dmx;
 
 	ret = dvbdemux->dmx.connect_frontend(&dvbdemux->dmx, &budget->hw_frontend);
 	if (ret < 0)
-		return ret;
+		goto err_release_dmx;
 
 	dvb_net_init(&budget->dvb_adapter, &budget->dvb_net, &dvbdemux->dmx);
 
 	return 0;
+
+err_release_dmx:
+	dvb_dmxdev_release(&budget->dmxdev);
+	dvb_dmx_release(&budget->demux);
+	return ret;
 }
 
 static void budget_unregister(struct budget *budget)

From 03c91acb237c8ef1741ae3ba738ad4abe92e4f30 Mon Sep 17 00:00:00 2001
From: Evgeny Novikov <novikov@ispras.ru>
Date: Fri, 10 Jul 2020 11:02:23 +0200
Subject: [PATCH 0432/2658] media: vpss: clean up resources in init

[ Upstream commit 9c487b0b0ea7ff22127fe99a7f67657d8730ff94 ]

If platform_driver_register() fails within vpss_init() resources are not
cleaned up. The patch fixes this issue by introducing the corresponding
error handling.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/davinci/vpss.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/drivers/media/platform/davinci/vpss.c b/drivers/media/platform/davinci/vpss.c
index c2c68988e38a..9884b34d6f40 100644
--- a/drivers/media/platform/davinci/vpss.c
+++ b/drivers/media/platform/davinci/vpss.c
@@ -519,19 +519,31 @@ static void vpss_exit(void)
 
 static int __init vpss_init(void)
 {
+	int ret;
+
 	if (!request_mem_region(VPSS_CLK_CTRL, 4, "vpss_clock_control"))
 		return -EBUSY;
 
 	oper_cfg.vpss_regs_base2 = ioremap(VPSS_CLK_CTRL, 4);
 	if (unlikely(!oper_cfg.vpss_regs_base2)) {
-		release_mem_region(VPSS_CLK_CTRL, 4);
-		return -ENOMEM;
+		ret = -ENOMEM;
+		goto err_ioremap;
 	}
 
 	writel(VPSS_CLK_CTRL_VENCCLKEN |
-		     VPSS_CLK_CTRL_DACCLKEN, oper_cfg.vpss_regs_base2);
+	       VPSS_CLK_CTRL_DACCLKEN, oper_cfg.vpss_regs_base2);
+
+	ret = platform_driver_register(&vpss_driver);
+	if (ret)
+		goto err_pd_register;
+
+	return 0;
 
-	return platform_driver_register(&vpss_driver);
+err_pd_register:
+	iounmap(oper_cfg.vpss_regs_base2);
+err_ioremap:
+	release_mem_region(VPSS_CLK_CTRL, 4);
+	return ret;
 }
 subsys_initcall(vpss_init);
 module_exit(vpss_exit);

From 27ef8fab1f2256c16c57ab36e214298074fb7e75 Mon Sep 17 00:00:00 2001
From: Xiongfeng Wang <wangxiongfeng2@huawei.com>
Date: Tue, 21 Jul 2020 22:24:07 -0700
Subject: [PATCH 0433/2658] Input: psmouse - add a newline when printing
 'proto' by sysfs

[ Upstream commit 4aec14de3a15cf9789a0e19c847f164776f49473 ]

When I cat parameter 'proto' by sysfs, it displays as follows. It's
better to add a newline for easy reading.

root@syzkaller:~# cat /sys/module/psmouse/parameters/proto
autoroot@syzkaller:~#

Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
Link: https://lore.kernel.org/r/20200720073846.120724-1-wangxiongfeng2@huawei.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/mouse/psmouse-base.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index ad18dab0ac47..5bd9633541b0 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -1911,7 +1911,7 @@ static int psmouse_get_maxproto(char *buffer, const struct kernel_param *kp)
 {
 	int type = *((unsigned int *)kp->arg);
 
-	return sprintf(buffer, "%s", psmouse_protocol_by_type(type)->name);
+	return sprintf(buffer, "%s\n", psmouse_protocol_by_type(type)->name);
 }
 
 static int __init psmouse_init(void)

From a4de9d2870fa1ee704d7d390668389321cb5155f Mon Sep 17 00:00:00 2001
From: Greg Ungerer <gerg@linux-m68k.org>
Date: Sat, 13 Jun 2020 17:17:52 +1000
Subject: [PATCH 0434/2658] m68knommu: fix overwriting of bits in ColdFire V3
 cache control

[ Upstream commit bdee0e793cea10c516ff48bf3ebb4ef1820a116b ]

The Cache Control Register (CACR) of the ColdFire V3 has bits that
control high level caching functions, and also enable/disable the use
of the alternate stack pointer register (the EUSP bit) to provide
separate supervisor and user stack pointer registers. The code as
it is today will blindly clear the EUSP bit on cache actions like
invalidation. So it is broken for this case - and that will result
in failed booting (interrupt entry and exit processing will be
completely hosed).

This only affects ColdFire V3 parts that support the alternate stack
register (like the 5329 for example) - generally speaking new parts do,
older parts don't. It has no impact on ColdFire V3 parts with the single
stack pointer, like the 5307 for example.

Fix the cache bit defines used, so they maintain the EUSP bit when
carrying out cache actions through the CACR register.

Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/m68k/include/asm/m53xxacr.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/m68k/include/asm/m53xxacr.h b/arch/m68k/include/asm/m53xxacr.h
index 3177ce8331d6..baee0c77b981 100644
--- a/arch/m68k/include/asm/m53xxacr.h
+++ b/arch/m68k/include/asm/m53xxacr.h
@@ -88,9 +88,9 @@
  * coherency though in all cases. And for copyback caches we will need
  * to push cached data as well.
  */
-#define CACHE_INIT	  CACR_CINVA
-#define CACHE_INVALIDATE  CACR_CINVA
-#define CACHE_INVALIDATED CACR_CINVA
+#define CACHE_INIT        (CACHE_MODE + CACR_CINVA - CACR_EC)
+#define CACHE_INVALIDATE  (CACHE_MODE + CACR_CINVA)
+#define CACHE_INVALIDATED (CACHE_MODE + CACR_CINVA)
 
 #define ACR0_MODE	((CONFIG_RAMBASE & 0xff000000) + \
 			 (0x000f0000) + \

From 46226f6079f619d0603712a716736588ba6ab234 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <darrick.wong@oracle.com>
Date: Tue, 14 Jul 2020 10:36:09 -0700
Subject: [PATCH 0435/2658] xfs: fix inode quota reservation checks

[ Upstream commit f959b5d037e71a4d69b5bf71faffa065d9269b4a ]

xfs_trans_dqresv is the function that we use to make reservations
against resource quotas.  Each resource contains two counters: the
q_core counter, which tracks resources allocated on disk; and the dquot
reservation counter, which tracks how much of that resource has either
been allocated or reserved by threads that are working on metadata
updates.

For disk blocks, we compare the proposed reservation counter against the
hard and soft limits to decide if we're going to fail the operation.
However, for inodes we inexplicably compare against the q_core counter,
not the incore reservation count.

Since the q_core counter is always lower than the reservation count and
we unlock the dquot between reservation and transaction commit, this
means that multiple threads can reserve the last inode count before we
hit the hard limit, and when they commit, we'll be well over the hard
limit.

Fix this by checking against the incore inode reservation counter, since
we would appear to maintain that correctly (and that's what we report in
GETQUOTA).

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Allison Collins <allison.henderson@oracle.com>
Reviewed-by: Chandan Babu R <chandanrlinux@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/xfs_trans_dquot.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/xfs/xfs_trans_dquot.c b/fs/xfs/xfs_trans_dquot.c
index ce78534a047e..bb8de2dddabe 100644
--- a/fs/xfs/xfs_trans_dquot.c
+++ b/fs/xfs/xfs_trans_dquot.c
@@ -662,7 +662,7 @@ xfs_trans_dqresv(
 			}
 		}
 		if (ninos > 0) {
-			total_count = be64_to_cpu(dqp->q_core.d_icount) + ninos;
+			total_count = dqp->q_res_icount + ninos;
 			timer = be32_to_cpu(dqp->q_core.d_itimer);
 			warns = be16_to_cpu(dqp->q_core.d_iwarns);
 			warnlimit = dqp->q_mount->m_quotainfo->qi_iwarnlimit;

From 7b06e0148d648fd9e974f2b980fe28609b5f3e21 Mon Sep 17 00:00:00 2001
From: Zhe Li <lizhe67@huawei.com>
Date: Fri, 19 Jun 2020 17:06:35 +0800
Subject: [PATCH 0436/2658] jffs2: fix UAF problem

[ Upstream commit 798b7347e4f29553db4b996393caf12f5b233daf ]

The log of UAF problem is listed below.
BUG: KASAN: use-after-free in jffs2_rmdir+0xa4/0x1cc [jffs2] at addr c1f165fc
Read of size 4 by task rm/8283
=============================================================================
BUG kmalloc-32 (Tainted: P    B      O   ): kasan: bad access detected
-----------------------------------------------------------------------------

INFO: Allocated in 0xbbbbbbbb age=3054364 cpu=0 pid=0
        0xb0bba6ef
        jffs2_write_dirent+0x11c/0x9c8 [jffs2]
        __slab_alloc.isra.21.constprop.25+0x2c/0x44
        __kmalloc+0x1dc/0x370
        jffs2_write_dirent+0x11c/0x9c8 [jffs2]
        jffs2_do_unlink+0x328/0x5fc [jffs2]
        jffs2_rmdir+0x110/0x1cc [jffs2]
        vfs_rmdir+0x180/0x268
        do_rmdir+0x2cc/0x300
        ret_from_syscall+0x0/0x3c
INFO: Freed in 0x205b age=3054364 cpu=0 pid=0
        0x2e9173
        jffs2_add_fd_to_list+0x138/0x1dc [jffs2]
        jffs2_add_fd_to_list+0x138/0x1dc [jffs2]
        jffs2_garbage_collect_dirent.isra.3+0x21c/0x288 [jffs2]
        jffs2_garbage_collect_live+0x16bc/0x1800 [jffs2]
        jffs2_garbage_collect_pass+0x678/0x11d4 [jffs2]
        jffs2_garbage_collect_thread+0x1e8/0x3b0 [jffs2]
        kthread+0x1a8/0x1b0
        ret_from_kernel_thread+0x5c/0x64
Call Trace:
[c17ddd20] [c02452d4] kasan_report.part.0+0x298/0x72c (unreliable)
[c17ddda0] [d2509680] jffs2_rmdir+0xa4/0x1cc [jffs2]
[c17dddd0] [c026da04] vfs_rmdir+0x180/0x268
[c17dde00] [c026f4e4] do_rmdir+0x2cc/0x300
[c17ddf40] [c001a658] ret_from_syscall+0x0/0x3c

The root cause is that we don't get "jffs2_inode_info.sem" before
we scan list "jffs2_inode_info.dents" in function jffs2_rmdir.
This patch add codes to get "jffs2_inode_info.sem" before we scan
"jffs2_inode_info.dents" to slove the UAF problem.

Signed-off-by: Zhe Li <lizhe67@huawei.com>
Reviewed-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/jffs2/dir.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c
index e27317169697..7a3368929245 100644
--- a/fs/jffs2/dir.c
+++ b/fs/jffs2/dir.c
@@ -588,10 +588,14 @@ static int jffs2_rmdir (struct inode *dir_i, struct dentry *dentry)
 	int ret;
 	uint32_t now = get_seconds();
 
+	mutex_lock(&f->sem);
 	for (fd = f->dents ; fd; fd = fd->next) {
-		if (fd->ino)
+		if (fd->ino) {
+			mutex_unlock(&f->sem);
 			return -ENOTEMPTY;
+		}
 	}
+	mutex_unlock(&f->sem);
 
 	ret = jffs2_do_unlink(c, dir_f, dentry->d_name.name,
 			      dentry->d_name.len, f, now);

From 2da06c092803291ad99c4e402736c7b4118ec0d6 Mon Sep 17 00:00:00 2001
From: Javed Hasan <jhasan@marvell.com>
Date: Wed, 29 Jul 2020 01:18:23 -0700
Subject: [PATCH 0437/2658] scsi: libfc: Free skb in fc_disc_gpn_id_resp() for
 valid cases

[ Upstream commit ec007ef40abb6a164d148b0dc19789a7a2de2cc8 ]

In fc_disc_gpn_id_resp(), skb is supposed to get freed in all cases except
for PTR_ERR. However, in some cases it didn't.

This fix is to call fc_frame_free(fp) before function returns.

Link: https://lore.kernel.org/r/20200729081824.30996-2-jhasan@marvell.com
Reviewed-by: Girish Basrur <gbasrur@marvell.com>
Reviewed-by: Santosh Vernekar <svernekar@marvell.com>
Reviewed-by: Saurav Kashyap <skashyap@marvell.com>
Reviewed-by: Shyam Sundar <ssundar@marvell.com>
Signed-off-by: Javed Hasan <jhasan@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/libfc/fc_disc.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c
index 880a9068ca12..ef06af4e3611 100644
--- a/drivers/scsi/libfc/fc_disc.c
+++ b/drivers/scsi/libfc/fc_disc.c
@@ -595,8 +595,12 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct fc_frame *fp,
 	mutex_lock(&disc->disc_mutex);
 	if (PTR_ERR(fp) == -FC_EX_CLOSED)
 		goto out;
-	if (IS_ERR(fp))
-		goto redisc;
+	if (IS_ERR(fp)) {
+		mutex_lock(&disc->disc_mutex);
+		fc_disc_restart(disc);
+		mutex_unlock(&disc->disc_mutex);
+		goto out;
+	}
 
 	cp = fc_frame_payload_get(fp, sizeof(*cp));
 	if (!cp)
@@ -621,7 +625,7 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct fc_frame *fp,
 				new_rdata->disc_id = disc->disc_id;
 				lport->tt.rport_login(new_rdata);
 			}
-			goto out;
+			goto free_fp;
 		}
 		rdata->disc_id = disc->disc_id;
 		lport->tt.rport_login(rdata);
@@ -635,6 +639,8 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct fc_frame *fp,
 redisc:
 		fc_disc_restart(disc);
 	}
+free_fp:
+	fc_frame_free(fp);
 out:
 	mutex_unlock(&disc->disc_mutex);
 	kref_put(&rdata->kref, lport->tt.rport_destroy);

From 6e1112f9fa727caf191bafa2592596ee6afecdad Mon Sep 17 00:00:00 2001
From: Mao Wenan <wenan.mao@linux.alibaba.com>
Date: Sun, 2 Aug 2020 15:44:09 +0800
Subject: [PATCH 0438/2658] virtio_ring: Avoid loop when vq is broken in
 virtqueue_poll

[ Upstream commit 481a0d7422db26fb63e2d64f0652667a5c6d0f3e ]

The loop may exist if vq->broken is true,
virtqueue_get_buf_ctx_packed or virtqueue_get_buf_ctx_split
will return NULL, so virtnet_poll will reschedule napi to
receive packet, it will lead cpu usage(si) to 100%.

call trace as below:
virtnet_poll
	virtnet_receive
		virtqueue_get_buf_ctx
			virtqueue_get_buf_ctx_packed
			virtqueue_get_buf_ctx_split
	virtqueue_napi_complete
		virtqueue_poll           //return true
		virtqueue_napi_schedule //it will reschedule napi

to fix this, return false if vq is broken in virtqueue_poll.

Signed-off-by: Mao Wenan <wenan.mao@linux.alibaba.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Link: https://lore.kernel.org/r/1596354249-96204-1-git-send-email-wenan.mao@linux.alibaba.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/virtio/virtio_ring.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index a01a41a41269..6b3565feddb2 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -603,6 +603,9 @@ bool virtqueue_poll(struct virtqueue *_vq, unsigned last_used_idx)
 {
 	struct vring_virtqueue *vq = to_vvq(_vq);
 
+	if (unlikely(vq->broken))
+		return false;
+
 	virtio_mb(vq->weak_barriers);
 	return (u16)last_used_idx != virtio16_to_cpu(_vq->vdev, vq->vring.used->idx);
 }

From b44e92e5f570b0265d201f2911c1c20ef4f98ba4 Mon Sep 17 00:00:00 2001
From: Eiichi Tsukata <devel@etsukata.com>
Date: Thu, 6 Aug 2020 15:18:48 -0700
Subject: [PATCH 0439/2658] xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init

[ Upstream commit 96cf2a2c75567ff56195fe3126d497a2e7e4379f ]

If xfs_sysfs_init is called with parent_kobj == NULL, UBSAN
shows the following warning:

  UBSAN: null-ptr-deref in ./fs/xfs/xfs_sysfs.h:37:23
  member access within null pointer of type 'struct xfs_kobj'
  Call Trace:
   dump_stack+0x10e/0x195
   ubsan_type_mismatch_common+0x241/0x280
   __ubsan_handle_type_mismatch_v1+0x32/0x40
   init_xfs_fs+0x12b/0x28f
   do_one_initcall+0xdd/0x1d0
   do_initcall_level+0x151/0x1b6
   do_initcalls+0x50/0x8f
   do_basic_setup+0x29/0x2b
   kernel_init_freeable+0x19f/0x20b
   kernel_init+0x11/0x1e0
   ret_from_fork+0x22/0x30

Fix it by checking parent_kobj before the code accesses its member.

Signed-off-by: Eiichi Tsukata <devel@etsukata.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
[darrick: minor whitespace edits]
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/xfs_sysfs.h | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/xfs_sysfs.h b/fs/xfs/xfs_sysfs.h
index be692e59938d..c457b010c623 100644
--- a/fs/xfs/xfs_sysfs.h
+++ b/fs/xfs/xfs_sysfs.h
@@ -44,9 +44,11 @@ xfs_sysfs_init(
 	struct xfs_kobj		*parent_kobj,
 	const char		*name)
 {
+	struct kobject		*parent;
+
+	parent = parent_kobj ? &parent_kobj->kobject : NULL;
 	init_completion(&kobj->complete);
-	return kobject_init_and_add(&kobj->kobject, ktype,
-				    &parent_kobj->kobject, "%s", name);
+	return kobject_init_and_add(&kobj->kobject, ktype, parent, "%s", name);
 }
 
 static inline void

From dffeabeaab996ade157df61285ae717d6ca6226b Mon Sep 17 00:00:00 2001
From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
Date: Tue, 11 Aug 2020 18:33:54 -0700
Subject: [PATCH 0440/2658] alpha: fix annotation of io{read,write}{16,32}be()

[ Upstream commit bd72866b8da499e60633ff28f8a4f6e09ca78efe ]

These accessors must be used to read/write a big-endian bus.  The value
returned or written is native-endian.

However, these accessors are defined using be{16,32}_to_cpu() or
cpu_to_be{16,32}() to make the endian conversion but these expect a
__be{16,32} when none is present.  Keeping them would need a force cast
that would solve nothing at all.

So, do the conversion using swab{16,32}, like done in asm-generic for
similar situations.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Matt Turner <mattst88@gmail.com>
Cc: Stephen Boyd <sboyd@kernel.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Link: http://lkml.kernel.org/r/20200622114232.80039-1-luc.vanoostenryck@gmail.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/alpha/include/asm/io.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h
index ff4049155c84..355aec0867f4 100644
--- a/arch/alpha/include/asm/io.h
+++ b/arch/alpha/include/asm/io.h
@@ -491,10 +491,10 @@ extern inline void writeq(u64 b, volatile void __iomem *addr)
 }
 #endif
 
-#define ioread16be(p) be16_to_cpu(ioread16(p))
-#define ioread32be(p) be32_to_cpu(ioread32(p))
-#define iowrite16be(v,p) iowrite16(cpu_to_be16(v), (p))
-#define iowrite32be(v,p) iowrite32(cpu_to_be32(v), (p))
+#define ioread16be(p) swab16(ioread16(p))
+#define ioread32be(p) swab32(ioread32(p))
+#define iowrite16be(v,p) iowrite16(swab16(v), (p))
+#define iowrite32be(v,p) iowrite32(swab32(v), (p))
 
 #define inb_p		inb
 #define inw_p		inw

From a8ee5068259aa7157b7290c4c16e9b2f6af85dc9 Mon Sep 17 00:00:00 2001
From: Eric Sandeen <sandeen@redhat.com>
Date: Wed, 17 Jun 2020 14:19:04 -0500
Subject: [PATCH 0441/2658] ext4: fix potential negative array index in
 do_split()

[ Upstream commit 5872331b3d91820e14716632ebb56b1399b34fe1 ]

If for any reason a directory passed to do_split() does not have enough
active entries to exceed half the size of the block, we can end up
iterating over all "count" entries without finding a split point.

In this case, count == move, and split will be zero, and we will
attempt a negative index into map[].

Guard against this by detecting this case, and falling back to
split-to-half-of-count instead; in this case we will still have
plenty of space (> half blocksize) in each split block.

Fixes: ef2b02d3e617 ("ext34: ensure do_split leaves enough free space in both blocks")
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/f53e246b-647c-64bb-16ec-135383c70ad7@redhat.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/namei.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 97d4bca9642e..e7378688736c 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1730,7 +1730,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
 			     blocksize, hinfo, map);
 	map -= count;
 	dx_sort_map(map, count);
-	/* Split the existing block in the middle, size-wise */
+	/* Ensure that neither split block is over half full */
 	size = 0;
 	move = 0;
 	for (i = count-1; i >= 0; i--) {
@@ -1740,8 +1740,18 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
 		size += map[i].size;
 		move++;
 	}
-	/* map index at which we will split */
-	split = count - move;
+	/*
+	 * map index at which we will split
+	 *
+	 * If the sum of active entries didn't exceed half the block size, just
+	 * split it in half by count; each resulting block will have at least
+	 * half the space free.
+	 */
+	if (i > 0)
+		split = count - move;
+	else
+		split = count/2;
+
 	hash2 = map[split].hash;
 	continued = hash2 == map[split - 1].hash;
 	dxtrace(printk(KERN_INFO "Split block %lu at %x, %i/%i\n",

From dd9fffdfcfdd15741e29caef69d4ee382d7b5cc6 Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Thu, 13 Aug 2020 16:41:10 +0800
Subject: [PATCH 0442/2658] ASoC: intel: Fix memleak in sst_media_open

[ Upstream commit 062fa09f44f4fb3776a23184d5d296b0c8872eb9 ]

When power_up_sst() fails, stream needs to be freed
just like when try_module_get() fails. However, current
code is returning directly and ends up leaking memory.

Fixes: 0121327c1a68b ("ASoC: Intel: mfld-pcm: add control for powering up/down dsp")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20200813084112.26205-1-dinghao.liu@zju.edu.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/intel/atom/sst-mfld-platform-pcm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
index 1d9dfb92b3b4..edb244331e6e 100644
--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
@@ -338,7 +338,7 @@ static int sst_media_open(struct snd_pcm_substream *substream,
 
 	ret_val = power_up_sst(stream);
 	if (ret_val < 0)
-		return ret_val;
+		goto out_power_up;
 
 	/* Make sure, that the period size is always even */
 	snd_pcm_hw_constraint_step(substream->runtime, 0,
@@ -347,8 +347,9 @@ static int sst_media_open(struct snd_pcm_substream *substream,
 	return snd_pcm_hw_constraint_integer(runtime,
 			 SNDRV_PCM_HW_PARAM_PERIODS);
 out_ops:
-	kfree(stream);
 	mutex_unlock(&sst_lock);
+out_power_up:
+	kfree(stream);
 	return ret_val;
 }
 

From b83f112b03518ec0c47b72d3636bb8717627da4a Mon Sep 17 00:00:00 2001
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Fri, 24 Jul 2020 19:25:25 +1000
Subject: [PATCH 0443/2658] powerpc: Allow 4224 bytes of stack expansion for
 the signal frame

commit 63dee5df43a31f3844efabc58972f0a206ca4534 upstream.

We have powerpc specific logic in our page fault handling to decide if
an access to an unmapped address below the stack pointer should expand
the stack VMA.

The code was originally added in 2004 "ported from 2.4". The rough
logic is that the stack is allowed to grow to 1MB with no extra
checking. Over 1MB the access must be within 2048 bytes of the stack
pointer, or be from a user instruction that updates the stack pointer.

The 2048 byte allowance below the stack pointer is there to cover the
288 byte "red zone" as well as the "about 1.5kB" needed by the signal
delivery code.

Unfortunately since then the signal frame has expanded, and is now
4224 bytes on 64-bit kernels with transactional memory enabled. This
means if a process has consumed more than 1MB of stack, and its stack
pointer lies less than 4224 bytes from the next page boundary, signal
delivery will fault when trying to expand the stack and the process
will see a SEGV.

The total size of the signal frame is the size of struct rt_sigframe
(which includes the red zone) plus __SIGNAL_FRAMESIZE (128 bytes on
64-bit).

The 2048 byte allowance was correct until 2008 as the signal frame
was:

struct rt_sigframe {
        struct ucontext    uc;                           /*     0  1440 */
        /* --- cacheline 11 boundary (1408 bytes) was 32 bytes ago --- */
        long unsigned int          _unused[2];           /*  1440    16 */
        unsigned int               tramp[6];             /*  1456    24 */
        struct siginfo *           pinfo;                /*  1480     8 */
        void *                     puc;                  /*  1488     8 */
        struct siginfo     info;                         /*  1496   128 */
        /* --- cacheline 12 boundary (1536 bytes) was 88 bytes ago --- */
        char                       abigap[288];          /*  1624   288 */

        /* size: 1920, cachelines: 15, members: 7 */
        /* padding: 8 */
};

1920 + 128 = 2048

Then in commit ce48b2100785 ("powerpc: Add VSX context save/restore,
ptrace and signal support") (Jul 2008) the signal frame expanded to
2304 bytes:

struct rt_sigframe {
        struct ucontext    uc;                           /*     0  1696 */	<--
        /* --- cacheline 13 boundary (1664 bytes) was 32 bytes ago --- */
        long unsigned int          _unused[2];           /*  1696    16 */
        unsigned int               tramp[6];             /*  1712    24 */
        struct siginfo *           pinfo;                /*  1736     8 */
        void *                     puc;                  /*  1744     8 */
        struct siginfo     info;                         /*  1752   128 */
        /* --- cacheline 14 boundary (1792 bytes) was 88 bytes ago --- */
        char                       abigap[288];          /*  1880   288 */

        /* size: 2176, cachelines: 17, members: 7 */
        /* padding: 8 */
};

2176 + 128 = 2304

At this point we should have been exposed to the bug, though as far as
I know it was never reported. I no longer have a system old enough to
easily test on.

Then in 2010 commit 320b2b8de126 ("mm: keep a guard page below a
grow-down stack segment") caused our stack expansion code to never
trigger, as there was always a VMA found for a write up to PAGE_SIZE
below r1.

That meant the bug was hidden as we continued to expand the signal
frame in commit 2b0a576d15e0 ("powerpc: Add new transactional memory
state to the signal context") (Feb 2013):

struct rt_sigframe {
        struct ucontext    uc;                           /*     0  1696 */
        /* --- cacheline 13 boundary (1664 bytes) was 32 bytes ago --- */
        struct ucontext    uc_transact;                  /*  1696  1696 */	<--
        /* --- cacheline 26 boundary (3328 bytes) was 64 bytes ago --- */
        long unsigned int          _unused[2];           /*  3392    16 */
        unsigned int               tramp[6];             /*  3408    24 */
        struct siginfo *           pinfo;                /*  3432     8 */
        void *                     puc;                  /*  3440     8 */
        struct siginfo     info;                         /*  3448   128 */
        /* --- cacheline 27 boundary (3456 bytes) was 120 bytes ago --- */
        char                       abigap[288];          /*  3576   288 */

        /* size: 3872, cachelines: 31, members: 8 */
        /* padding: 8 */
        /* last cacheline: 32 bytes */
};

3872 + 128 = 4000

And commit 573ebfa6601f ("powerpc: Increase stack redzone for 64-bit
userspace to 512 bytes") (Feb 2014):

struct rt_sigframe {
        struct ucontext    uc;                           /*     0  1696 */
        /* --- cacheline 13 boundary (1664 bytes) was 32 bytes ago --- */
        struct ucontext    uc_transact;                  /*  1696  1696 */
        /* --- cacheline 26 boundary (3328 bytes) was 64 bytes ago --- */
        long unsigned int          _unused[2];           /*  3392    16 */
        unsigned int               tramp[6];             /*  3408    24 */
        struct siginfo *           pinfo;                /*  3432     8 */
        void *                     puc;                  /*  3440     8 */
        struct siginfo     info;                         /*  3448   128 */
        /* --- cacheline 27 boundary (3456 bytes) was 120 bytes ago --- */
        char                       abigap[512];          /*  3576   512 */	<--

        /* size: 4096, cachelines: 32, members: 8 */
        /* padding: 8 */
};

4096 + 128 = 4224

Then finally in 2017, commit 1be7107fbe18 ("mm: larger stack guard
gap, between vmas") exposed us to the existing bug, because it changed
the stack VMA to be the correct/real size, meaning our stack expansion
code is now triggered.

Fix it by increasing the allowance to 4224 bytes.

Hard-coding 4224 is obviously unsafe against future expansions of the
signal frame in the same way as the existing code. We can't easily use
sizeof() because the signal frame structure is not in a header. We
will either fix that, or rip out all the custom stack expansion
checking logic entirely.

Fixes: ce48b2100785 ("powerpc: Add VSX context save/restore, ptrace and signal support")
Cc: stable@vger.kernel.org # v2.6.27+
Reported-by: Tom Lane <tgl@sss.pgh.pa.us>
Tested-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200724092528.1578671-2-mpe@ellerman.id.au
Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/mm/fault.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index d1f860ca03ad..101c202c813c 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -192,6 +192,9 @@ static int mm_fault_error(struct pt_regs *regs, unsigned long addr, int fault)
 	return MM_FAULT_CONTINUE;
 }
 
+// This comes from 64-bit struct rt_sigframe + __SIGNAL_FRAMESIZE
+#define SIGFRAME_MAX_SIZE	(4096 + 128)
+
 /*
  * For 600- and 800-family processors, the error_code parameter is DSISR
  * for a data fault, SRR1 for an instruction fault. For 400-family processors
@@ -341,7 +344,7 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
 	/*
 	 * N.B. The POWER/Open ABI allows programs to access up to
 	 * 288 bytes below the stack pointer.
-	 * The kernel signal delivery code writes up to about 1.5kB
+	 * The kernel signal delivery code writes up to about 4kB
 	 * below the stack pointer (r1) before decrementing it.
 	 * The exec code can write slightly over 640kB to the stack
 	 * before setting the user r1.  Thus we allow the stack to
@@ -365,7 +368,7 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
 		 * between the last mapped region and the stack will
 		 * expand the stack rather than segfaulting.
 		 */
-		if (address + 2048 < uregs->gpr[1] && !store_update_sp)
+		if (address + SIGFRAME_MAX_SIZE < uregs->gpr[1] && !store_update_sp)
 			goto bad_area;
 	}
 	if (expand_stack(vma, address))

From 26a17c2cc459d00fd2098204610f9e9769e8bdc9 Mon Sep 17 00:00:00 2001
From: Marc Zyngier <maz@kernel.org>
Date: Wed, 19 Aug 2020 17:12:17 +0100
Subject: [PATCH 0444/2658] epoll: Keep a reference on files added to the check
 list

commit a9ed4a6560b8562b7e2e2bed9527e88001f7b682 upstream.

When adding a new fd to an epoll, and that this new fd is an
epoll fd itself, we recursively scan the fds attached to it
to detect cycles, and add non-epool files to a "check list"
that gets subsequently parsed.

However, this check list isn't completely safe when deletions
can happen concurrently. To sidestep the issue, make sure that
a struct file placed on the check list sees its f_count increased,
ensuring that a concurrent deletion won't result in the file
disapearing from under our feet.

Cc: stable@vger.kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/eventpoll.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index df21fc0cda2b..65369867f4f5 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1723,9 +1723,11 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
 			 * not already there, and calling reverse_path_check()
 			 * during ep_insert().
 			 */
-			if (list_empty(&epi->ffd.file->f_tfile_llink))
+			if (list_empty(&epi->ffd.file->f_tfile_llink)) {
+				get_file(epi->ffd.file);
 				list_add(&epi->ffd.file->f_tfile_llink,
 					 &tfile_check_list);
+			}
 		}
 	}
 	mutex_unlock(&ep->mtx);
@@ -1769,6 +1771,7 @@ static void clear_tfile_check_list(void)
 		file = list_first_entry(&tfile_check_list, struct file,
 					f_tfile_llink);
 		list_del_init(&file->f_tfile_llink);
+		fput(file);
 	}
 	INIT_LIST_HEAD(&tfile_check_list);
 }
@@ -1910,9 +1913,11 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
 					clear_tfile_check_list();
 					goto error_tgt_fput;
 				}
-			} else
+			} else {
+				get_file(tf.file);
 				list_add(&tf.file->f_tfile_llink,
 							&tfile_check_list);
+			}
 			mutex_lock_nested(&ep->mtx, 0);
 			if (is_file_epoll(tf.file)) {
 				tep = tf.file->private_data;

From 4ec1afdc6497f1902b4cbf4fcba5255e7662b88e Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Sat, 22 Aug 2020 18:25:52 -0400
Subject: [PATCH 0445/2658] do_epoll_ctl(): clean the failure exits up a bit

commit 52c479697c9b73f628140dcdfcd39ea302d05482 upstream.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/eventpoll.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 65369867f4f5..ae7767db3a95 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1909,10 +1909,8 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
 			mutex_lock(&epmutex);
 			if (is_file_epoll(tf.file)) {
 				error = -ELOOP;
-				if (ep_loop_check(ep, tf.file) != 0) {
-					clear_tfile_check_list();
+				if (ep_loop_check(ep, tf.file) != 0)
 					goto error_tgt_fput;
-				}
 			} else {
 				get_file(tf.file);
 				list_add(&tf.file->f_tfile_llink,
@@ -1941,8 +1939,6 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
 			error = ep_insert(ep, &epds, tf.file, fd, full_check);
 		} else
 			error = -EEXIST;
-		if (full_check)
-			clear_tfile_check_list();
 		break;
 	case EPOLL_CTL_DEL:
 		if (epi)
@@ -1963,8 +1959,10 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
 	mutex_unlock(&ep->mtx);
 
 error_tgt_fput:
-	if (full_check)
+	if (full_check) {
+		clear_tfile_check_list();
 		mutex_unlock(&epmutex);
+	}
 
 	fdput(tf);
 error_fput:

From 3c553bda8ff1d15c009b897293ab8d9275b49e01 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Thu, 6 Aug 2020 23:26:11 -0700
Subject: [PATCH 0446/2658] mm/hugetlb: fix calculation of
 adjust_range_if_pmd_sharing_possible

commit 75802ca66354a39ab8e35822747cd08b3384a99a upstream.

This is found by code observation only.

Firstly, the worst case scenario should assume the whole range was covered
by pmd sharing.  The old algorithm might not work as expected for ranges
like (1g-2m, 1g+2m), where the adjusted range should be (0, 1g+2m) but the
expected range should be (0, 2g).

Since at it, remove the loop since it should not be required.  With that,
the new code should be faster too when the invalidating range is huge.

Mike said:

: With range (1g-2m, 1g+2m) within a vma (0, 2g) the existing code will only
: adjust to (0, 1g+2m) which is incorrect.
:
: We should cc stable.  The original reason for adjusting the range was to
: prevent data corruption (getting wrong page).  Since the range is not
: always adjusted correctly, the potential for corruption still exists.
:
: However, I am fairly confident that adjust_range_if_pmd_sharing_possible
: is only gong to be called in two cases:
:
: 1) for a single page
: 2) for range == entire vma
:
: In those cases, the current code should produce the correct results.
:
: To be safe, let's just cc stable.

Fixes: 017b1660df89 ("mm: migration: fix migration of huge PMD shared pages")
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/20200730201636.74778-1-peterx@redhat.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/hugetlb.c | 25 +++++++++++--------------
 1 file changed, 11 insertions(+), 14 deletions(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 3a1501e85483..baac9a09ec0a 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4257,6 +4257,7 @@ static bool vma_shareable(struct vm_area_struct *vma, unsigned long addr)
 	return false;
 }
 
+#define ALIGN_DOWN(x, a)	__ALIGN_KERNEL((x) - ((a) - 1), (a))
 /*
  * Determine if start,end range within vma could be mapped by shared pmd.
  * If yes, adjust start and end to cover range associated with possible
@@ -4265,25 +4266,21 @@ static bool vma_shareable(struct vm_area_struct *vma, unsigned long addr)
 void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
 				unsigned long *start, unsigned long *end)
 {
-	unsigned long check_addr = *start;
+	unsigned long a_start, a_end;
 
 	if (!(vma->vm_flags & VM_MAYSHARE))
 		return;
 
-	for (check_addr = *start; check_addr < *end; check_addr += PUD_SIZE) {
-		unsigned long a_start = check_addr & PUD_MASK;
-		unsigned long a_end = a_start + PUD_SIZE;
+	/* Extend the range to be PUD aligned for a worst case scenario */
+	a_start = ALIGN_DOWN(*start, PUD_SIZE);
+	a_end = ALIGN(*end, PUD_SIZE);
 
-		/*
-		 * If sharing is possible, adjust start/end if necessary.
-		 */
-		if (range_in_vma(vma, a_start, a_end)) {
-			if (a_start < *start)
-				*start = a_start;
-			if (a_end > *end)
-				*end = a_end;
-		}
-	}
+	/*
+	 * Intersect the range with the vma range, since pmd sharing won't be
+	 * across vma after all
+	 */
+	*start = max(vma->vm_start, a_start);
+	*end = min(vma->vm_end, a_end);
 }
 
 /*

From ee8e808e1dad62be6ba8d11459fc0b1d609bdb8f Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Thu, 20 Aug 2020 08:59:08 +0200
Subject: [PATCH 0447/2658] xen: don't reschedule in preemption off sections

For support of long running hypercalls xen_maybe_preempt_hcall() is
calling cond_resched() in case a hypercall marked as preemptible has
been interrupted.

Normally this is no problem, as only hypercalls done via some ioctl()s
are marked to be preemptible. In rare cases when during such a
preemptible hypercall an interrupt occurs and any softirq action is
started from irq_exit(), a further hypercall issued by the softirq
handler will be regarded to be preemptible, too. This might lead to
rescheduling in spite of the softirq handler potentially having set
preempt_disable(), leading to splats like:

BUG: sleeping function called from invalid context at drivers/xen/preempt.c:37
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 20775, name: xl
INFO: lockdep is turned off.
CPU: 1 PID: 20775 Comm: xl Tainted: G D W 5.4.46-1_prgmr_debug.el7.x86_64 #1
Call Trace:
<IRQ>
dump_stack+0x8f/0xd0
___might_sleep.cold.76+0xb2/0x103
xen_maybe_preempt_hcall+0x48/0x70
xen_do_hypervisor_callback+0x37/0x40
RIP: e030:xen_hypercall_xen_version+0xa/0x20
Code: ...
RSP: e02b:ffffc900400dcc30 EFLAGS: 00000246
RAX: 000000000004000d RBX: 0000000000000200 RCX: ffffffff8100122a
RDX: ffff88812e788000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffffff83ee3ad0 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: ffff8881824aa0b0
R13: 0000000865496000 R14: 0000000865496000 R15: ffff88815d040000
? xen_hypercall_xen_version+0xa/0x20
? xen_force_evtchn_callback+0x9/0x10
? check_events+0x12/0x20
? xen_restore_fl_direct+0x1f/0x20
? _raw_spin_unlock_irqrestore+0x53/0x60
? debug_dma_sync_single_for_cpu+0x91/0xc0
? _raw_spin_unlock_irqrestore+0x53/0x60
? xen_swiotlb_sync_single_for_cpu+0x3d/0x140
? mlx4_en_process_rx_cq+0x6b6/0x1110 [mlx4_en]
? mlx4_en_poll_rx_cq+0x64/0x100 [mlx4_en]
? net_rx_action+0x151/0x4a0
? __do_softirq+0xed/0x55b
? irq_exit+0xea/0x100
? xen_evtchn_do_upcall+0x2c/0x40
? xen_do_hypervisor_callback+0x29/0x40
</IRQ>
? xen_hypercall_domctl+0xa/0x20
? xen_hypercall_domctl+0x8/0x20
? privcmd_ioctl+0x221/0x990 [xen_privcmd]
? do_vfs_ioctl+0xa5/0x6f0
? ksys_ioctl+0x60/0x90
? trace_hardirqs_off_thunk+0x1a/0x20
? __x64_sys_ioctl+0x16/0x20
? do_syscall_64+0x62/0x250
? entry_SYSCALL_64_after_hwframe+0x49/0xbe

Fix that by testing preempt_count() before calling cond_resched().

In kernel 5.8 this can't happen any more due to the entry code rework
(more than 100 patches, so not a candidate for backporting).

The issue was introduced in kernel 4.3, so this patch should go into
all stable kernels in [4.3 ... 5.7].

Reported-by: Sarah Newman <srn@prgmr.com>
Fixes: 0fa2f5cb2b0ecd8 ("sched/preempt, xen: Use need_resched() instead of should_resched()")
Cc: Sarah Newman <srn@prgmr.com>
Cc: stable@vger.kernel.org
Signed-off-by: Juergen Gross <jgross@suse.com>
Tested-by: Chris Brannon <cmb@prgmr.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/preempt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/xen/preempt.c b/drivers/xen/preempt.c
index 5f6b77ea34fb..128375ff80b8 100644
--- a/drivers/xen/preempt.c
+++ b/drivers/xen/preempt.c
@@ -31,7 +31,7 @@ EXPORT_SYMBOL_GPL(xen_in_preemptible_hcall);
 asmlinkage __visible void xen_maybe_preempt_hcall(void)
 {
 	if (unlikely(__this_cpu_read(xen_in_preemptible_hcall)
-		     && need_resched())) {
+		     && need_resched() && !preempt_count())) {
 		/*
 		 * Clear flag as we may be rescheduled on a different
 		 * cpu.

From 9253731fd3ba15b6de0d81291c697836ce66877a Mon Sep 17 00:00:00 2001
From: Adam Ford <aford173@gmail.com>
Date: Thu, 9 Jul 2020 07:12:32 -0500
Subject: [PATCH 0448/2658] omapfb: dss: Fix max fclk divider for omap36xx

There appears to be a timing issue where using a divider of 32 breaks
the DSS for OMAP36xx despite the TRM stating 32 is a valid
number.  Through experimentation, it appears that 31 works.

This same fix was issued for kernels 4.5+.  However, between
kernels 4.4 and 4.5, the directory structure was changed when the
dss directory was moved inside the omapfb directory. That broke the
patch on kernels older than 4.5, because it didn't permit the patch
to apply cleanly for 4.4 and older.

A similar patch was applied to the 3.16 kernel already, but not to 4.4.
Commit 4b911101a5cd ("drm/omap: fix max fclk divider for omap36xx") is
on the 3.16 stable branch with notes from Ben about the path change.

Since this was applied for 3.16 already, this patch is for kernels
3.17 through 4.4 only.

Fixes: f7018c213502 ("video: move fbdev to drivers/video/fbdev")
Cc: <stable@vger.kernel.org> #3.17 - 4.4
CC: <tomi.valkeinen@ti.com>
Signed-off-by: Adam Ford <aford173@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/fbdev/omap2/dss/dss.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/omap2/dss/dss.c b/drivers/video/fbdev/omap2/dss/dss.c
index 9200a8668b49..a57c3a5f4bf8 100644
--- a/drivers/video/fbdev/omap2/dss/dss.c
+++ b/drivers/video/fbdev/omap2/dss/dss.c
@@ -843,7 +843,7 @@ static const struct dss_features omap34xx_dss_feats = {
 };
 
 static const struct dss_features omap3630_dss_feats = {
-	.fck_div_max		=	32,
+	.fck_div_max		=	31,
 	.dss_fck_multiplier	=	1,
 	.parent_clk_name	=	"dpll4_ck",
 	.dpi_select_source	=	&dss_dpi_select_source_omap2_omap3,

From 20f318ed9a3074c4676f10192af574958e750065 Mon Sep 17 00:00:00 2001
From: Will Deacon <will@kernel.org>
Date: Mon, 24 Aug 2020 12:28:54 +0100
Subject: [PATCH 0449/2658] KVM: arm/arm64: Don't reschedule in
 unmap_stage2_range()

Upstream commits fdfe7cbd5880 ("KVM: Pass MMU notifier range flags to
kvm_unmap_hva_range()") and b5331379bc62 ("KVM: arm64: Only reschedule
if MMU_NOTIFIER_RANGE_BLOCKABLE is not set") fix a "sleeping from invalid
context" BUG caused by unmap_stage2_range() attempting to reschedule when
called on the OOM path.

Unfortunately, these patches rely on the MMU notifier callback being
passed knowledge about whether or not blocking is permitted, which was
introduced in 4.19. Rather than backport this considerable amount of
infrastructure just for KVM on arm, instead just remove the conditional
reschedule.

Cc: <stable@vger.kernel.org> # v4.4 only
Cc: Marc Zyngier <maz@kernel.org>
Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
Cc: James Morse <james.morse@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Acked-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/kvm/mmu.c | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index f2c4207ac70a..5979436048d6 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -301,14 +301,6 @@ static void unmap_range(struct kvm *kvm, pgd_t *pgdp,
 		next = kvm_pgd_addr_end(addr, end);
 		if (!pgd_none(*pgd))
 			unmap_puds(kvm, pgd, addr, next);
-		/*
-		 * If we are dealing with a large range in
-		 * stage2 table, release the kvm->mmu_lock
-		 * to prevent starvation and lockup detector
-		 * warnings.
-		 */
-		if (kvm && (next != end))
-			cond_resched_lock(&kvm->mmu_lock);
 	} while (pgd++, addr = next, addr != end);
 }
 

From b24c56f8528f354e8da8c7f944863a6aafb2f71b Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 26 Aug 2020 10:27:10 +0200
Subject: [PATCH 0450/2658] Linux 4.4.234

Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index b045f041cfd6..c3b92a791b93 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 233
+SUBLEVEL = 234
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 760dd802f69d5feeaa613913e748e3ac96a0edf1 Mon Sep 17 00:00:00 2001
From: Miaohe Lin <linmiaohe@huawei.com>
Date: Sat, 15 Aug 2020 04:44:31 -0400
Subject: [PATCH 0451/2658] net: Fix potential wrong skb->protocol in
 skb_vlan_untag()

[ Upstream commit 55eff0eb7460c3d50716ed9eccf22257b046ca92 ]

We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). So
we should pull VLAN_HLEN + sizeof(unsigned short) in skb_vlan_untag() or
we may access the wrong data.

Fixes: 0d5501c1c828 ("net: Always untag vlan-tagged traffic on input.")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/skbuff.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 144f655afe8b..7b8bd8562879 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4396,8 +4396,8 @@ struct sk_buff *skb_vlan_untag(struct sk_buff *skb)
 	skb = skb_share_check(skb, GFP_ATOMIC);
 	if (unlikely(!skb))
 		goto err_free;
-
-	if (unlikely(!pskb_may_pull(skb, VLAN_HLEN)))
+	/* We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). */
+	if (unlikely(!pskb_may_pull(skb, VLAN_HLEN + sizeof(unsigned short))))
 		goto err_free;
 
 	vhdr = (struct vlan_hdr *)skb->data;

From 9089861c33cc01a07f54a92b720b646139611bd3 Mon Sep 17 00:00:00 2001
From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Sat, 15 Aug 2020 16:29:15 -0700
Subject: [PATCH 0452/2658] tipc: fix uninit skb->data in
 tipc_nl_compat_dumpit()

[ Upstream commit 47733f9daf4fe4f7e0eb9e273f21ad3a19130487 ]

__tipc_nl_compat_dumpit() has two callers, and it expects them to
pass a valid nlmsghdr via arg->data. This header is artificial and
crafted just for __tipc_nl_compat_dumpit().

tipc_nl_compat_publ_dump() does so by putting a genlmsghdr as well
as some nested attribute, TIPC_NLA_SOCK. But the other caller
tipc_nl_compat_dumpit() does not, this leaves arg->data uninitialized
on this call path.

Fix this by just adding a similar nlmsghdr without any payload in
tipc_nl_compat_dumpit().

This bug exists since day 1, but the recent commit 6ea67769ff33
("net: tipc: prepare attrs in __tipc_nl_compat_dumpit()") makes it
easier to appear.

Reported-and-tested-by: syzbot+0e7181deafa7e0b79923@syzkaller.appspotmail.com
Fixes: d0796d1ef63d ("tipc: convert legacy nl bearer dump to nl compat")
Cc: Jon Maloy <jmaloy@redhat.com>
Cc: Ying Xue <ying.xue@windriver.com>
Cc: Richard Alpe <richard.alpe@ericsson.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tipc/netlink_compat.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 8d2e54c4bda6..0975a28f8686 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -250,8 +250,9 @@ static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
 static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
 				 struct tipc_nl_compat_msg *msg)
 {
-	int err;
+	struct nlmsghdr *nlh;
 	struct sk_buff *arg;
+	int err;
 
 	if (msg->req_type && (!msg->req_size ||
 			      !TLV_CHECK_TYPE(msg->req, msg->req_type)))
@@ -280,6 +281,15 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
 		return -ENOMEM;
 	}
 
+	nlh = nlmsg_put(arg, 0, 0, tipc_genl_family.id, 0, NLM_F_MULTI);
+	if (!nlh) {
+		kfree_skb(arg);
+		kfree_skb(msg->rep);
+		msg->rep = NULL;
+		return -EMSGSIZE;
+	}
+	nlmsg_end(arg, nlh);
+
 	err = __tipc_nl_compat_dumpit(cmd, msg, arg);
 	if (err) {
 		kfree_skb(msg->rep);

From 9eb60b989b7670baaa59821f3d680de8cbf5918d Mon Sep 17 00:00:00 2001
From: Mahesh Bandewar <maheshb@google.com>
Date: Fri, 14 Aug 2020 22:53:24 -0700
Subject: [PATCH 0453/2658] ipvlan: fix device features

[ Upstream commit d0f5c7076e01fef6fcb86988d9508bf3ce258bd4 ]

Processing NETDEV_FEAT_CHANGE causes IPvlan links to lose
NETIF_F_LLTX feature because of the incorrect handling of
features in ipvlan_fix_features().

--before--
lpaa10:~# ethtool -k ipvl0 | grep tx-lockless
tx-lockless: on [fixed]
lpaa10:~# ethtool -K ipvl0 tso off
Cannot change tcp-segmentation-offload
Actual changes:
vlan-challenged: off [fixed]
tx-lockless: off [fixed]
lpaa10:~# ethtool -k ipvl0 | grep tx-lockless
tx-lockless: off [fixed]
lpaa10:~#

--after--
lpaa10:~# ethtool -k ipvl0 | grep tx-lockless
tx-lockless: on [fixed]
lpaa10:~# ethtool -K ipvl0 tso off
Cannot change tcp-segmentation-offload
Could not change any device features
lpaa10:~# ethtool -k ipvl0 | grep tx-lockless
tx-lockless: on [fixed]
lpaa10:~#

Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.")
Signed-off-by: Mahesh Bandewar <maheshb@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ipvlan/ipvlan_main.c | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index b4d5f53c97d3..b7a122a1b89a 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -87,12 +87,21 @@ static void ipvlan_port_destroy(struct net_device *dev)
 static struct lock_class_key ipvlan_netdev_xmit_lock_key;
 static struct lock_class_key ipvlan_netdev_addr_lock_key;
 
+#define IPVLAN_ALWAYS_ON_OFLOADS \
+	(NETIF_F_SG | NETIF_F_HW_CSUM | \
+	 NETIF_F_GSO_ROBUST | NETIF_F_GSO_SOFTWARE | NETIF_F_GSO_ENCAP_ALL)
+
+#define IPVLAN_ALWAYS_ON \
+	(IPVLAN_ALWAYS_ON_OFLOADS | NETIF_F_LLTX | NETIF_F_VLAN_CHALLENGED)
+
 #define IPVLAN_FEATURES \
 	(NETIF_F_SG | NETIF_F_ALL_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
 	 NETIF_F_GSO | NETIF_F_TSO | NETIF_F_UFO | NETIF_F_GSO_ROBUST | \
 	 NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_GRO | NETIF_F_RXCSUM | \
 	 NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_HW_VLAN_STAG_FILTER)
 
+	/* NETIF_F_GSO_ENCAP_ALL NETIF_F_GSO_SOFTWARE Newly added */
+
 #define IPVLAN_STATE_MASK \
 	((1<<__LINK_STATE_NOCARRIER) | (1<<__LINK_STATE_DORMANT))
 
@@ -117,7 +126,9 @@ static int ipvlan_init(struct net_device *dev)
 	dev->state = (dev->state & ~IPVLAN_STATE_MASK) |
 		     (phy_dev->state & IPVLAN_STATE_MASK);
 	dev->features = phy_dev->features & IPVLAN_FEATURES;
-	dev->features |= NETIF_F_LLTX;
+	dev->features |= IPVLAN_ALWAYS_ON;
+	dev->vlan_features = phy_dev->vlan_features & IPVLAN_FEATURES;
+	dev->vlan_features |= IPVLAN_ALWAYS_ON_OFLOADS;
 	dev->gso_max_size = phy_dev->gso_max_size;
 	dev->hard_header_len = phy_dev->hard_header_len;
 
@@ -201,7 +212,14 @@ static netdev_features_t ipvlan_fix_features(struct net_device *dev,
 {
 	struct ipvl_dev *ipvlan = netdev_priv(dev);
 
-	return features & (ipvlan->sfeatures | ~IPVLAN_FEATURES);
+	features |= NETIF_F_ALL_FOR_ALL;
+	features &= (ipvlan->sfeatures | ~IPVLAN_FEATURES);
+	features = netdev_increment_features(ipvlan->phy_dev->features,
+					     features, features);
+	features |= IPVLAN_ALWAYS_ON;
+	features &= (IPVLAN_FEATURES | IPVLAN_ALWAYS_ON);
+
+	return features;
 }
 
 static void ipvlan_change_rx_flags(struct net_device *dev, int change)
@@ -590,9 +608,8 @@ static int ipvlan_device_event(struct notifier_block *unused,
 
 	case NETDEV_FEAT_CHANGE:
 		list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
-			ipvlan->dev->features = dev->features & IPVLAN_FEATURES;
 			ipvlan->dev->gso_max_size = dev->gso_max_size;
-			netdev_features_change(ipvlan->dev);
+			netdev_update_features(ipvlan->dev);
 		}
 		break;
 

From d74922b80ad547aaea582468d3276b03dd03c880 Mon Sep 17 00:00:00 2001
From: Jarod Wilson <jarod@redhat.com>
Date: Thu, 13 Aug 2020 10:09:00 -0400
Subject: [PATCH 0454/2658] bonding: show saner speed for broadcast mode

[ Upstream commit 4ca0d9ac3fd8f9f90b72a15d8da2aca3ffb58418 ]

Broadcast mode bonds transmit a copy of all traffic simultaneously out of
all interfaces, so the "speed" of the bond isn't really the aggregate of
all interfaces, but rather, the speed of the slowest active interface.

Also, the type of the speed field is u32, not unsigned long, so adjust
that accordingly, as required to make min() function here without
complaining about mismatching types.

Fixes: bb5b052f751b ("bond: add support to read speed and duplex via ethtool")
CC: Jay Vosburgh <j.vosburgh@gmail.com>
CC: Veaceslav Falico <vfalico@gmail.com>
CC: Andy Gospodarek <andy@greyhouse.net>
CC: "David S. Miller" <davem@davemloft.net>
CC: netdev@vger.kernel.org
Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com>
Signed-off-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/bonding/bond_main.c | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index e31b4c7d2522..52e023fa313b 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4057,13 +4057,23 @@ static netdev_tx_t bond_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	return ret;
 }
 
+static u32 bond_mode_bcast_speed(struct slave *slave, u32 speed)
+{
+	if (speed == 0 || speed == SPEED_UNKNOWN)
+		speed = slave->speed;
+	else
+		speed = min(speed, slave->speed);
+
+	return speed;
+}
+
 static int bond_ethtool_get_settings(struct net_device *bond_dev,
 				     struct ethtool_cmd *ecmd)
 {
 	struct bonding *bond = netdev_priv(bond_dev);
-	unsigned long speed = 0;
 	struct list_head *iter;
 	struct slave *slave;
+	u32 speed = 0;
 
 	ecmd->duplex = DUPLEX_UNKNOWN;
 	ecmd->port = PORT_OTHER;
@@ -4075,8 +4085,13 @@ static int bond_ethtool_get_settings(struct net_device *bond_dev,
 	 */
 	bond_for_each_slave(bond, slave, iter) {
 		if (bond_slave_can_tx(slave)) {
-			if (slave->speed != SPEED_UNKNOWN)
-				speed += slave->speed;
+			if (slave->speed != SPEED_UNKNOWN) {
+				if (BOND_MODE(bond) == BOND_MODE_BROADCAST)
+					speed = bond_mode_bcast_speed(slave,
+								      speed);
+				else
+					speed += slave->speed;
+			}
 			if (ecmd->duplex == DUPLEX_UNKNOWN &&
 			    slave->duplex != DUPLEX_UNKNOWN)
 				ecmd->duplex = slave->duplex;

From 554fad36ccbe7405c80e6d43b0f21b996fbba0de Mon Sep 17 00:00:00 2001
From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Fri, 14 Aug 2020 20:05:58 -0700
Subject: [PATCH 0455/2658] bonding: fix a potential double-unregister

[ Upstream commit 832707021666411d04795c564a4adea5d6b94f17 ]

When we tear down a network namespace, we unregister all
the netdevices within it. So we may queue a slave device
and a bonding device together in the same unregister queue.

If the only slave device is non-ethernet, it would
automatically unregister the bonding device as well. Thus,
we may end up unregistering the bonding device twice.

Workaround this special case by checking reg_state.

Fixes: 9b5e383c11b0 ("net: Introduce unregister_netdevice_many()")
Reported-by: syzbot+af23e7f3e0a7e10c8b67@syzkaller.appspotmail.com
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Andy Gospodarek <andy@greyhouse.net>
Cc: Jay Vosburgh <j.vosburgh@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/bonding/bond_main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 52e023fa313b..aaf75d5e6e48 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1940,7 +1940,8 @@ static int  bond_release_and_destroy(struct net_device *bond_dev,
 	int ret;
 
 	ret = bond_release(bond_dev, slave_dev);
-	if (ret == 0 && !bond_has_slaves(bond)) {
+	if (ret == 0 && !bond_has_slaves(bond) &&
+	    bond_dev->reg_state != NETREG_UNREGISTERING) {
 		bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
 		netdev_info(bond_dev, "Destroying bond %s\n",
 			    bond_dev->name);

From 79f8f45e2927a768d0157a79762f318870d6a424 Mon Sep 17 00:00:00 2001
From: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
Date: Thu, 27 Aug 2020 13:13:07 +0530
Subject: [PATCH 0456/2658] powerpc/pseries: Do not initiate shutdown when
 system is running on UPS

commit 90a9b102eddf6a3f987d15f4454e26a2532c1c98 upstream.

As per PAPR we have to look for both EPOW sensor value and event
modifier to identify the type of event and take appropriate action.

In LoPAPR v1.1 section 10.2.2 includes table 136 "EPOW Action Codes":

  SYSTEM_SHUTDOWN 3

  The system must be shut down. An EPOW-aware OS logs the EPOW error
  log information, then schedules the system to be shut down to begin
  after an OS defined delay internal (default is 10 minutes.)

Then in section 10.3.2.2.8 there is table 146 "Platform Event Log
Format, Version 6, EPOW Section", which includes the "EPOW Event
Modifier":

  For EPOW sensor value = 3
  0x01 = Normal system shutdown with no additional delay
  0x02 = Loss of utility power, system is running on UPS/Battery
  0x03 = Loss of system critical functions, system should be shutdown
  0x04 = Ambient temperature too high
  All other values = reserved

We have a user space tool (rtas_errd) on LPAR to monitor for
EPOW_SHUTDOWN_ON_UPS. Once it gets an event it initiates shutdown
after predefined time. It also starts monitoring for any new EPOW
events. If it receives "Power restored" event before predefined time
it will cancel the shutdown. Otherwise after predefined time it will
shutdown the system.

Commit 79872e35469b ("powerpc/pseries: All events of
EPOW_SYSTEM_SHUTDOWN must initiate shutdown") changed our handling of
the "on UPS/Battery" case, to immediately shutdown the system. This
breaks existing setups that rely on the userspace tool to delay
shutdown and let the system run on the UPS.

Fixes: 79872e35469b ("powerpc/pseries: All events of EPOW_SYSTEM_SHUTDOWN must initiate shutdown")
Cc: stable@vger.kernel.org # v4.0+
Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
[mpe: Massage change log and add PAPR references]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200820061844.306460-1-hegdevasant@linux.vnet.ibm.com
Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/ras.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
index 9e817c1b7808..1fa8e492ce27 100644
--- a/arch/powerpc/platforms/pseries/ras.c
+++ b/arch/powerpc/platforms/pseries/ras.c
@@ -90,7 +90,6 @@ static void handle_system_shutdown(char event_modifier)
 		pr_emerg("Loss of power reported by firmware, system is "
 			"running on UPS/battery");
 		pr_emerg("Check RTAS error log for details");
-		orderly_poweroff(true);
 		break;
 
 	case EPOW_SHUTDOWN_LOSS_OF_CRITICAL_FUNCTIONS:

From 58faf2de2d346a68a5f8610ad0a404be8e901c85 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Wed, 5 Aug 2020 19:19:26 -0700
Subject: [PATCH 0457/2658] ALSA: pci: delete repeated words in comments

[ Upstream commit c7fabbc51352f50cc58242a6dc3b9c1a3599849b ]

Drop duplicated words in sound/pci/.
{and, the, at}

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://lore.kernel.org/r/20200806021926.32418-1-rdunlap@infradead.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/cs46xx/cs46xx_lib.c       | 2 +-
 sound/pci/cs46xx/dsp_spos_scb_lib.c | 2 +-
 sound/pci/hda/hda_codec.c           | 2 +-
 sound/pci/hda/hda_generic.c         | 2 +-
 sound/pci/hda/patch_sigmatel.c      | 2 +-
 sound/pci/ice1712/prodigy192.c      | 2 +-
 sound/pci/oxygen/xonar_dg.c         | 2 +-
 7 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/sound/pci/cs46xx/cs46xx_lib.c b/sound/pci/cs46xx/cs46xx_lib.c
index 2706f271a83b..8a174c170e0a 100644
--- a/sound/pci/cs46xx/cs46xx_lib.c
+++ b/sound/pci/cs46xx/cs46xx_lib.c
@@ -780,7 +780,7 @@ static void snd_cs46xx_set_capture_sample_rate(struct snd_cs46xx *chip, unsigned
 		rate = 48000 / 9;
 
 	/*
-	 *  We can not capture at at rate greater than the Input Rate (48000).
+	 *  We can not capture at a rate greater than the Input Rate (48000).
 	 *  Return an error if an attempt is made to stray outside that limit.
 	 */
 	if (rate > 48000)
diff --git a/sound/pci/cs46xx/dsp_spos_scb_lib.c b/sound/pci/cs46xx/dsp_spos_scb_lib.c
index 7488e1b7a770..4e726d39b05d 100644
--- a/sound/pci/cs46xx/dsp_spos_scb_lib.c
+++ b/sound/pci/cs46xx/dsp_spos_scb_lib.c
@@ -1742,7 +1742,7 @@ int cs46xx_iec958_pre_open (struct snd_cs46xx *chip)
 	struct dsp_spos_instance * ins = chip->dsp_spos_instance;
 
 	if ( ins->spdif_status_out & DSP_SPDIF_STATUS_OUTPUT_ENABLED ) {
-		/* remove AsynchFGTxSCB and and PCMSerialInput_II */
+		/* remove AsynchFGTxSCB and PCMSerialInput_II */
 		cs46xx_dsp_disable_spdif_out (chip);
 
 		/* save state */
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 825d9b27dbe1..4962a9d8a572 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -3496,7 +3496,7 @@ EXPORT_SYMBOL_GPL(snd_hda_set_power_save);
  * @nid: NID to check / update
  *
  * Check whether the given NID is in the amp list.  If it's in the list,
- * check the current AMP status, and update the the power-status according
+ * check the current AMP status, and update the power-status according
  * to the mute status.
  *
  * This function is supposed to be set or called from the check_power_status
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 869c322ddae3..7cd1047a4edf 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -837,7 +837,7 @@ static void activate_amp_in(struct hda_codec *codec, struct nid_path *path,
 	}
 }
 
-/* sync power of each widget in the the given path */
+/* sync power of each widget in the given path */
 static hda_nid_t path_power_update(struct hda_codec *codec,
 				   struct nid_path *path,
 				   bool allow_powerdown)
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index d1a6d20ace0d..80b72d0702c5 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -862,7 +862,7 @@ static int stac_auto_create_beep_ctls(struct hda_codec *codec,
 	static struct snd_kcontrol_new beep_vol_ctl =
 		HDA_CODEC_VOLUME(NULL, 0, 0, 0);
 
-	/* check for mute support for the the amp */
+	/* check for mute support for the amp */
 	if ((caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT) {
 		const struct snd_kcontrol_new *temp;
 		if (spec->anabeep_nid == nid)
diff --git a/sound/pci/ice1712/prodigy192.c b/sound/pci/ice1712/prodigy192.c
index 3919aed39ca0..5e52086d7b98 100644
--- a/sound/pci/ice1712/prodigy192.c
+++ b/sound/pci/ice1712/prodigy192.c
@@ -31,7 +31,7 @@
  *		  Experimentally I found out that only a combination of
  *		  OCKS0=1, OCKS1=1 (128fs, 64fs output) and ice1724 -
  *		  VT1724_MT_I2S_MCLK_128X=0 (256fs input) yields correct
- *		  sampling rate. That means the the FPGA doubles the
+ *		  sampling rate. That means that the FPGA doubles the
  *		  MCK01 rate.
  *
  *	Copyright (c) 2003 Takashi Iwai <tiwai@suse.de>
diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c
index 4cf3200e988b..df44135e1b0c 100644
--- a/sound/pci/oxygen/xonar_dg.c
+++ b/sound/pci/oxygen/xonar_dg.c
@@ -39,7 +39,7 @@
  *   GPIO 4 <- headphone detect
  *   GPIO 5 -> enable ADC analog circuit for the left channel
  *   GPIO 6 -> enable ADC analog circuit for the right channel
- *   GPIO 7 -> switch green rear output jack between CS4245 and and the first
+ *   GPIO 7 -> switch green rear output jack between CS4245 and the first
  *             channel of CS4361 (mechanical relay)
  *   GPIO 8 -> enable output to speakers
  *

From 782a278065db78d31731632d697224e7f0747d7e Mon Sep 17 00:00:00 2001
From: Qiushi Wu <wu000273@umn.edu>
Date: Sat, 13 Jun 2020 15:44:19 -0500
Subject: [PATCH 0458/2658] ASoC: tegra: Fix reference count leaks.

[ Upstream commit deca195383a6085be62cb453079e03e04d618d6e ]

Calling pm_runtime_get_sync increments the counter even in case of
failure, causing incorrect ref count if pm_runtime_put is not called in
error handling paths. Call pm_runtime_put if pm_runtime_get_sync fails.

Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://lore.kernel.org/r/20200613204422.24484-1-wu000273@umn.edu
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/tegra/tegra30_ahub.c | 4 +++-
 sound/soc/tegra/tegra30_i2s.c  | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/sound/soc/tegra/tegra30_ahub.c b/sound/soc/tegra/tegra30_ahub.c
index fef3b9a21a66..e441e23a37e4 100644
--- a/sound/soc/tegra/tegra30_ahub.c
+++ b/sound/soc/tegra/tegra30_ahub.c
@@ -656,8 +656,10 @@ static int tegra30_ahub_resume(struct device *dev)
 	int ret;
 
 	ret = pm_runtime_get_sync(dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put(dev);
 		return ret;
+	}
 	ret = regcache_sync(ahub->regmap_ahub);
 	ret |= regcache_sync(ahub->regmap_apbif);
 	pm_runtime_put(dev);
diff --git a/sound/soc/tegra/tegra30_i2s.c b/sound/soc/tegra/tegra30_i2s.c
index 8e55583aa104..516f37896092 100644
--- a/sound/soc/tegra/tegra30_i2s.c
+++ b/sound/soc/tegra/tegra30_i2s.c
@@ -552,8 +552,10 @@ static int tegra30_i2s_resume(struct device *dev)
 	int ret;
 
 	ret = pm_runtime_get_sync(dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put(dev);
 		return ret;
+	}
 	ret = regcache_sync(i2s->regmap);
 	pm_runtime_put(dev);
 

From 54e750ae140eeda96907d3bd49fb6ed027438b10 Mon Sep 17 00:00:00 2001
From: Jia-Ju Bai <baijiaju@tsinghua.edu.cn>
Date: Sat, 30 May 2020 16:42:08 +0200
Subject: [PATCH 0459/2658] media: pci: ttpci: av7110: fix possible buffer
 overflow caused by bad DMA value in debiirq()

[ Upstream commit 6499a0db9b0f1e903d52f8244eacc1d4be00eea2 ]

The value av7110->debi_virt is stored in DMA memory, and it is assigned
to data, and thus data[0] can be modified at any time by malicious
hardware. In this case, "if (data[0] < 2)" can be passed, but then
data[0] can be changed into a large number, which may cause buffer
overflow when the code "av7110->ci_slot[data[0]]" is used.

To fix this possible bug, data[0] is assigned to a local variable, which
replaces the use of data[0].

Signed-off-by: Jia-Ju Bai <baijiaju@tsinghua.edu.cn>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/ttpci/av7110.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/pci/ttpci/av7110.c b/drivers/media/pci/ttpci/av7110.c
index f89364951ebd..fb13cc3c591d 100644
--- a/drivers/media/pci/ttpci/av7110.c
+++ b/drivers/media/pci/ttpci/av7110.c
@@ -426,14 +426,15 @@ static void debiirq(unsigned long cookie)
 	case DATA_CI_GET:
 	{
 		u8 *data = av7110->debi_virt;
+		u8 data_0 = data[0];
 
-		if ((data[0] < 2) && data[2] == 0xff) {
+		if (data_0 < 2 && data[2] == 0xff) {
 			int flags = 0;
 			if (data[5] > 0)
 				flags |= CA_CI_MODULE_PRESENT;
 			if (data[5] > 5)
 				flags |= CA_CI_MODULE_READY;
-			av7110->ci_slot[data[0]].flags = flags;
+			av7110->ci_slot[data_0].flags = flags;
 		} else
 			ci_get_data(&av7110->ci_rbuffer,
 				    av7110->debi_virt,

From 4826667e29acf1846da1e840291fefe055e1be75 Mon Sep 17 00:00:00 2001
From: Bodo Stroesser <bstroesser@ts.fujitsu.com>
Date: Mon, 29 Jun 2020 11:37:56 +0200
Subject: [PATCH 0460/2658] scsi: target: tcmu: Fix crash on ARM during cmd
 completion

[ Upstream commit 5a0c256d96f020e4771f6fd5524b80f89a2d3132 ]

If tcmu_handle_completions() has to process a padding shorter than
sizeof(struct tcmu_cmd_entry), the current call to
tcmu_flush_dcache_range() with sizeof(struct tcmu_cmd_entry) as length
param is wrong and causes crashes on e.g. ARM, because
tcmu_flush_dcache_range() in this case calls
flush_dcache_page(vmalloc_to_page(start)); with start being an invalid
address above the end of the vmalloc'ed area.

The fix is to use the minimum of remaining ring space and sizeof(struct
tcmu_cmd_entry) as the length param.

The patch was tested on kernel 4.19.118.

See https://bugzilla.kernel.org/show_bug.cgi?id=208045#c10

Link: https://lore.kernel.org/r/20200629093756.8947-1-bstroesser@ts.fujitsu.com
Tested-by: JiangYu <lnsyyj@hotmail.com>
Acked-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Bodo Stroesser <bstroesser@ts.fujitsu.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/target/target_core_user.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index c43c942e1f87..bccde58bc5e3 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -590,7 +590,14 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
 		struct tcmu_cmd_entry *entry = (void *) mb + CMDR_OFF + udev->cmdr_last_cleaned;
 		struct tcmu_cmd *cmd;
 
-		tcmu_flush_dcache_range(entry, sizeof(*entry));
+		/*
+		 * Flush max. up to end of cmd ring since current entry might
+		 * be a padding that is shorter than sizeof(*entry)
+		 */
+		size_t ring_left = head_to_end(udev->cmdr_last_cleaned,
+					       udev->cmdr_size);
+		tcmu_flush_dcache_range(entry, ring_left < sizeof(*entry) ?
+					ring_left : sizeof(*entry));
 
 		if (tcmu_hdr_get_op(entry->hdr.len_op) == TCMU_OP_PAD) {
 			UPDATE_HEAD(udev->cmdr_last_cleaned,

From 7942afdb9c85d4aca1edd3c2a9537b074a678b5a Mon Sep 17 00:00:00 2001
From: Qiushi Wu <wu000273@umn.edu>
Date: Sat, 13 Jun 2020 14:32:26 -0500
Subject: [PATCH 0461/2658] drm/amdkfd: Fix reference count leaks.

[ Upstream commit 20eca0123a35305e38b344d571cf32768854168c ]

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object.

Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
index 2acbd43f9a53..965489b20429 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -841,8 +841,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
 
 	ret = kobject_init_and_add(dev->kobj_node, &node_type,
 			sys_props.kobj_nodes, "%d", id);
-	if (ret < 0)
+	if (ret < 0) {
+		kobject_put(dev->kobj_node);
 		return ret;
+	}
 
 	dev->kobj_mem = kobject_create_and_add("mem_banks", dev->kobj_node);
 	if (!dev->kobj_mem)
@@ -885,8 +887,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
 			return -ENOMEM;
 		ret = kobject_init_and_add(mem->kobj, &mem_type,
 				dev->kobj_mem, "%d", i);
-		if (ret < 0)
+		if (ret < 0) {
+			kobject_put(mem->kobj);
 			return ret;
+		}
 
 		mem->attr.name = "properties";
 		mem->attr.mode = KFD_SYSFS_FILE_MODE;
@@ -904,8 +908,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
 			return -ENOMEM;
 		ret = kobject_init_and_add(cache->kobj, &cache_type,
 				dev->kobj_cache, "%d", i);
-		if (ret < 0)
+		if (ret < 0) {
+			kobject_put(cache->kobj);
 			return ret;
+		}
 
 		cache->attr.name = "properties";
 		cache->attr.mode = KFD_SYSFS_FILE_MODE;
@@ -923,8 +929,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
 			return -ENOMEM;
 		ret = kobject_init_and_add(iolink->kobj, &iolink_type,
 				dev->kobj_iolink, "%d", i);
-		if (ret < 0)
+		if (ret < 0) {
+			kobject_put(iolink->kobj);
 			return ret;
+		}
 
 		iolink->attr.name = "properties";
 		iolink->attr.mode = KFD_SYSFS_FILE_MODE;
@@ -976,8 +984,10 @@ static int kfd_topology_update_sysfs(void)
 		ret = kobject_init_and_add(sys_props.kobj_topology,
 				&sysprops_type,  &kfd_device->kobj,
 				"topology");
-		if (ret < 0)
+		if (ret < 0) {
+			kobject_put(sys_props.kobj_topology);
 			return ret;
+		}
 
 		sys_props.kobj_nodes = kobject_create_and_add("nodes",
 				sys_props.kobj_topology);

From f0dc003ec1571d52e7f6989d3650a3bdd1e69c7c Mon Sep 17 00:00:00 2001
From: Aditya Pakki <pakki001@umn.edu>
Date: Sat, 13 Jun 2020 20:55:39 -0500
Subject: [PATCH 0462/2658] drm/radeon: fix multiple reference count leak

[ Upstream commit 6f2e8acdb48ed166b65d47837c31b177460491ec ]

On calling pm_runtime_get_sync() the reference count of the device
is incremented. In case of failure, decrement the
reference count before returning the error.

Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/radeon/radeon_connectors.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index bebcef2ce6b8..a9f1d99bb6f9 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -886,8 +886,10 @@ radeon_lvds_detect(struct drm_connector *connector, bool force)
 
 	if (!drm_kms_helper_is_poll_worker()) {
 		r = pm_runtime_get_sync(connector->dev->dev);
-		if (r < 0)
+		if (r < 0) {
+			pm_runtime_put_autosuspend(connector->dev->dev);
 			return connector_status_disconnected;
+		}
 	}
 
 	if (encoder) {
@@ -1021,8 +1023,10 @@ radeon_vga_detect(struct drm_connector *connector, bool force)
 
 	if (!drm_kms_helper_is_poll_worker()) {
 		r = pm_runtime_get_sync(connector->dev->dev);
-		if (r < 0)
+		if (r < 0) {
+			pm_runtime_put_autosuspend(connector->dev->dev);
 			return connector_status_disconnected;
+		}
 	}
 
 	encoder = radeon_best_single_encoder(connector);
@@ -1158,8 +1162,10 @@ radeon_tv_detect(struct drm_connector *connector, bool force)
 
 	if (!drm_kms_helper_is_poll_worker()) {
 		r = pm_runtime_get_sync(connector->dev->dev);
-		if (r < 0)
+		if (r < 0) {
+			pm_runtime_put_autosuspend(connector->dev->dev);
 			return connector_status_disconnected;
+		}
 	}
 
 	encoder = radeon_best_single_encoder(connector);
@@ -1241,8 +1247,10 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
 
 	if (!drm_kms_helper_is_poll_worker()) {
 		r = pm_runtime_get_sync(connector->dev->dev);
-		if (r < 0)
+		if (r < 0) {
+			pm_runtime_put_autosuspend(connector->dev->dev);
 			return connector_status_disconnected;
+		}
 	}
 
 	if (radeon_connector->detected_hpd_without_ddc) {
@@ -1681,8 +1689,10 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
 
 	if (!drm_kms_helper_is_poll_worker()) {
 		r = pm_runtime_get_sync(connector->dev->dev);
-		if (r < 0)
+		if (r < 0) {
+			pm_runtime_put_autosuspend(connector->dev->dev);
 			return connector_status_disconnected;
+		}
 	}
 
 	if (!force && radeon_check_hpd_status_unchanged(connector)) {

From b5bc4c1db9b080901ecf5dddcab4e1b6595e7ef1 Mon Sep 17 00:00:00 2001
From: Navid Emamdoost <navid.emamdoost@gmail.com>
Date: Sun, 14 Jun 2020 02:12:29 -0500
Subject: [PATCH 0463/2658] drm/amdgpu: fix ref count leak in
 amdgpu_driver_open_kms

[ Upstream commit 9ba8923cbbe11564dd1bf9f3602add9a9cfbb5c6 ]

in amdgpu_driver_open_kms the call to pm_runtime_get_sync increments the
counter even in case of failure, leading to incorrect
ref count. In case of failure, decrement the ref count before returning.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index 5bf98f0195fb..6025c69871a8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -522,7 +522,7 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
 
 	r = pm_runtime_get_sync(dev->dev);
 	if (r < 0)
-		return r;
+		goto pm_put;
 
 	fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL);
 	if (unlikely(!fpriv))
@@ -540,6 +540,7 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
 	file_priv->driver_priv = fpriv;
 
 	pm_runtime_mark_last_busy(dev->dev);
+pm_put:
 	pm_runtime_put_autosuspend(dev->dev);
 	return 0;
 

From 0dba4d5d7c6ce6c5bd8ad01ddd364afe476869fb Mon Sep 17 00:00:00 2001
From: Navid Emamdoost <navid.emamdoost@gmail.com>
Date: Sun, 14 Jun 2020 02:14:50 -0500
Subject: [PATCH 0464/2658] drm/amd/display: fix ref count leak in
 amdgpu_drm_ioctl

[ Upstream commit 5509ac65f2fe5aa3c0003237ec629ca55024307c ]

in amdgpu_drm_ioctl the call to pm_runtime_get_sync increments the
counter even in case of failure, leading to incorrect
ref count. In case of failure, decrement the ref count before returning.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 8d6668cedf6d..eb3c54e1f1ca 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -443,11 +443,12 @@ long amdgpu_drm_ioctl(struct file *filp,
 	dev = file_priv->minor->dev;
 	ret = pm_runtime_get_sync(dev->dev);
 	if (ret < 0)
-		return ret;
+		goto out;
 
 	ret = drm_ioctl(filp, cmd, arg);
 
 	pm_runtime_mark_last_busy(dev->dev);
+out:
 	pm_runtime_put_autosuspend(dev->dev);
 	return ret;
 }

From 8f932b82d0bd2302eca196883e0f47d202611d5a Mon Sep 17 00:00:00 2001
From: Navid Emamdoost <navid.emamdoost@gmail.com>
Date: Sun, 14 Jun 2020 02:09:44 -0500
Subject: [PATCH 0465/2658] drm/amdgpu: fix ref count leak in
 amdgpu_display_crtc_set_config

[ Upstream commit e008fa6fb41544b63973a529b704ef342f47cc65 ]

in amdgpu_display_crtc_set_config, the call to pm_runtime_get_sync
increments the counter even in case of failure, leading to incorrect
ref count. In case of failure, decrement the ref count before returning.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
index c555781685ea..d3ee8f19f1ef 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -296,7 +296,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set)
 
 	ret = pm_runtime_get_sync(dev->dev);
 	if (ret < 0)
-		return ret;
+		goto out;
 
 	ret = drm_crtc_helper_set_config(set);
 
@@ -311,7 +311,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set)
 	   take the current one */
 	if (active && !adev->have_disp_power_ref) {
 		adev->have_disp_power_ref = true;
-		return ret;
+		goto out;
 	}
 	/* if we have no active crtcs, then drop the power ref
 	   we got before */
@@ -320,6 +320,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set)
 		adev->have_disp_power_ref = false;
 	}
 
+out:
 	/* drop the power reference we got coming in here */
 	pm_runtime_put_autosuspend(dev->dev);
 	return ret;

From ddfc99f4b6317716712516fd0047c293a1401507 Mon Sep 17 00:00:00 2001
From: Navid Emamdoost <navid.emamdoost@gmail.com>
Date: Sun, 14 Jun 2020 02:05:28 -0500
Subject: [PATCH 0466/2658] drm/amdgpu/display: fix ref count leak when
 pm_runtime_get_sync fails

[ Upstream commit f79f94765f8c39db0b7dec1d335ab046aac03f20 ]

The call to pm_runtime_get_sync increments the counter even in case of
failure, leading to incorrect ref count.
In case of failure, decrement the ref count before returning.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
index 1f0e6ede120c..1b3fda2331be 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
@@ -734,8 +734,10 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force)
 
 	if (!drm_kms_helper_is_poll_worker()) {
 		r = pm_runtime_get_sync(connector->dev->dev);
-		if (r < 0)
+		if (r < 0) {
+			pm_runtime_put_autosuspend(connector->dev->dev);
 			return connector_status_disconnected;
+		}
 	}
 
 	if (encoder) {
@@ -863,8 +865,10 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force)
 
 	if (!drm_kms_helper_is_poll_worker()) {
 		r = pm_runtime_get_sync(connector->dev->dev);
-		if (r < 0)
+		if (r < 0) {
+			pm_runtime_put_autosuspend(connector->dev->dev);
 			return connector_status_disconnected;
+		}
 	}
 
 	encoder = amdgpu_connector_best_single_encoder(connector);
@@ -986,8 +990,10 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force)
 
 	if (!drm_kms_helper_is_poll_worker()) {
 		r = pm_runtime_get_sync(connector->dev->dev);
-		if (r < 0)
+		if (r < 0) {
+			pm_runtime_put_autosuspend(connector->dev->dev);
 			return connector_status_disconnected;
+		}
 	}
 
 	if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
@@ -1360,8 +1366,10 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force)
 
 	if (!drm_kms_helper_is_poll_worker()) {
 		r = pm_runtime_get_sync(connector->dev->dev);
-		if (r < 0)
+		if (r < 0) {
+			pm_runtime_put_autosuspend(connector->dev->dev);
 			return connector_status_disconnected;
+		}
 	}
 
 	if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {

From 5b54a33eb698e19caa096f9487fcb4263e471d83 Mon Sep 17 00:00:00 2001
From: Dick Kennedy <dick.kennedy@broadcom.com>
Date: Tue, 30 Jun 2020 14:49:54 -0700
Subject: [PATCH 0467/2658] scsi: lpfc: Fix shost refcount mismatch when
 deleting vport

[ Upstream commit 03dbfe0668e6692917ac278883e0586cd7f7d753 ]

When vports are deleted, it is observed that there is memory/kthread
leakage as the vport isn't fully being released.

There is a shost reference taken in scsi_add_host_dma that is not released
during scsi_remove_host. It was noticed that other drivers resolve this by
doing a scsi_host_put after calling scsi_remove_host.

The vport_delete routine is taking two references one that corresponds to
an access to the scsi_host in the vport_delete routine and another that is
released after the adapter mailbox command completes that destroys the VPI
that corresponds to the vport.

Remove one of the references taken such that the second reference that is
put will complete the missing scsi_add_host_dma reference and the shost
will be terminated.

Link: https://lore.kernel.org/r/20200630215001.70793-8-jsmart2021@gmail.com
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/lpfc/lpfc_vport.c | 26 ++++++++------------------
 1 file changed, 8 insertions(+), 18 deletions(-)

diff --git a/drivers/scsi/lpfc/lpfc_vport.c b/drivers/scsi/lpfc/lpfc_vport.c
index 861c57bc4520..72248712949e 100644
--- a/drivers/scsi/lpfc/lpfc_vport.c
+++ b/drivers/scsi/lpfc/lpfc_vport.c
@@ -615,27 +615,16 @@ lpfc_vport_delete(struct fc_vport *fc_vport)
 		    vport->port_state < LPFC_VPORT_READY)
 			return -EAGAIN;
 	}
+
 	/*
-	 * This is a bit of a mess.  We want to ensure the shost doesn't get
-	 * torn down until we're done with the embedded lpfc_vport structure.
-	 *
-	 * Beyond holding a reference for this function, we also need a
-	 * reference for outstanding I/O requests we schedule during delete
-	 * processing.  But once we scsi_remove_host() we can no longer obtain
-	 * a reference through scsi_host_get().
-	 *
-	 * So we take two references here.  We release one reference at the
-	 * bottom of the function -- after delinking the vport.  And we
-	 * release the other at the completion of the unreg_vpi that get's
-	 * initiated after we've disposed of all other resources associated
-	 * with the port.
+	 * Take early refcount for outstanding I/O requests we schedule during
+	 * delete processing for unreg_vpi.  Always keep this before
+	 * scsi_remove_host() as we can no longer obtain a reference through
+	 * scsi_host_get() after scsi_host_remove as shost is set to SHOST_DEL.
 	 */
 	if (!scsi_host_get(shost))
 		return VPORT_INVAL;
-	if (!scsi_host_get(shost)) {
-		scsi_host_put(shost);
-		return VPORT_INVAL;
-	}
+
 	lpfc_free_sysfs_attr(vport);
 
 	lpfc_debugfs_terminate(vport);
@@ -783,8 +772,9 @@ lpfc_vport_delete(struct fc_vport *fc_vport)
 		if (!(vport->vpi_state & LPFC_VPI_REGISTERED) ||
 				lpfc_mbx_unreg_vpi(vport))
 			scsi_host_put(shost);
-	} else
+	} else {
 		scsi_host_put(shost);
+	}
 
 	lpfc_free_vpi(phba, vport->vpi);
 	vport->work_port_events = 0;

From 42b6a9c37230bf48a5a042114080d9e2dbd73733 Mon Sep 17 00:00:00 2001
From: "Desnes A. Nunes do Rosario" <desnesn@linux.ibm.com>
Date: Fri, 26 Jun 2020 13:47:37 -0300
Subject: [PATCH 0468/2658] selftests/powerpc: Purge extra count_pmc() calls of
 ebb selftests

[ Upstream commit 3337bf41e0dd70b4064cdf60acdfcdc2d050066c ]

An extra count on ebb_state.stats.pmc_count[PMC_INDEX(pmc)] is being per-
formed when count_pmc() is used to reset PMCs on a few selftests. This
extra pmc_count can occasionally invalidate results, such as the ones from
cycles_test shown hereafter. The ebb_check_count() failed with an above
the upper limit error due to the extra value on ebb_state.stats.pmc_count.

Furthermore, this extra count is also indicated by extra PMC1 trace_log on
the output of the cycle test (as well as on pmc56_overflow_test):

==========
   ...
   [21]: counter = 8
   [22]: register SPRN_MMCR0 = 0x0000000080000080
   [23]: register SPRN_PMC1  = 0x0000000080000004
   [24]: counter = 9
   [25]: register SPRN_MMCR0 = 0x0000000080000080
   [26]: register SPRN_PMC1  = 0x0000000080000004
   [27]: counter = 10
   [28]: register SPRN_MMCR0 = 0x0000000080000080
   [29]: register SPRN_PMC1  = 0x0000000080000004
>> [30]: register SPRN_PMC1  = 0x000000004000051e
PMC1 count (0x280000546) above upper limit 0x2800003e8 (+0x15e)
[FAIL] Test FAILED on line 52
failure: cycles
==========

Signed-off-by: Desnes A. Nunes do Rosario <desnesn@linux.ibm.com>
Tested-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200626164737.21943-1-desnesn@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c     | 2 --
 tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c      | 2 --
 .../selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c    | 2 --
 .../selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c     | 2 --
 tools/testing/selftests/powerpc/pmu/ebb/ebb.c              | 2 --
 .../selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c  | 2 --
 .../selftests/powerpc/pmu/ebb/lost_exception_test.c        | 1 -
 .../testing/selftests/powerpc/pmu/ebb/multi_counter_test.c | 7 -------
 .../selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c       | 2 --
 .../testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c | 2 --
 .../selftests/powerpc/pmu/ebb/pmc56_overflow_test.c        | 2 --
 11 files changed, 26 deletions(-)

diff --git a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c
index 94110b1dcd3d..031baa43646f 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c
@@ -91,8 +91,6 @@ int back_to_back_ebbs(void)
 	ebb_global_disable();
 	ebb_freeze_pmcs();
 
-	count_pmc(1, sample_period);
-
 	dump_ebb_state();
 
 	event_close(&event);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c
index 7c57a8d79535..361e0be9df9a 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c
@@ -42,8 +42,6 @@ int cycles(void)
 	ebb_global_disable();
 	ebb_freeze_pmcs();
 
-	count_pmc(1, sample_period);
-
 	dump_ebb_state();
 
 	event_close(&event);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c
index ecf5ee3283a3..fe7d0dc2a1a2 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c
@@ -99,8 +99,6 @@ int cycles_with_freeze(void)
 	ebb_global_disable();
 	ebb_freeze_pmcs();
 
-	count_pmc(1, sample_period);
-
 	dump_ebb_state();
 
 	printf("EBBs while frozen %d\n", ebbs_while_frozen);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c
index c0faba520b35..b9b30f974b5e 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c
@@ -71,8 +71,6 @@ int cycles_with_mmcr2(void)
 	ebb_global_disable();
 	ebb_freeze_pmcs();
 
-	count_pmc(1, sample_period);
-
 	dump_ebb_state();
 
 	event_close(&event);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c
index 9729d9f90218..4154498bc5dc 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c
@@ -398,8 +398,6 @@ int ebb_child(union pipe read_pipe, union pipe write_pipe)
 	ebb_global_disable();
 	ebb_freeze_pmcs();
 
-	count_pmc(1, sample_period);
-
 	dump_ebb_state();
 
 	event_close(&event);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c
index a991d2ea8d0a..174e4f4dae6c 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c
@@ -38,8 +38,6 @@ static int victim_child(union pipe read_pipe, union pipe write_pipe)
 	ebb_global_disable();
 	ebb_freeze_pmcs();
 
-	count_pmc(1, sample_period);
-
 	dump_ebb_state();
 
 	FAIL_IF(ebb_state.stats.ebb_count == 0);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c
index eb8acb78bc6c..531083accfca 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c
@@ -75,7 +75,6 @@ static int test_body(void)
 	ebb_freeze_pmcs();
 	ebb_global_disable();
 
-	count_pmc(4, sample_period);
 	mtspr(SPRN_PMC4, 0xdead);
 
 	dump_summary_ebb_state();
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c
index 6ff8c8ff27d6..035c02273cd4 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c
@@ -70,13 +70,6 @@ int multi_counter(void)
 	ebb_global_disable();
 	ebb_freeze_pmcs();
 
-	count_pmc(1, sample_period);
-	count_pmc(2, sample_period);
-	count_pmc(3, sample_period);
-	count_pmc(4, sample_period);
-	count_pmc(5, sample_period);
-	count_pmc(6, sample_period);
-
 	dump_ebb_state();
 
 	for (i = 0; i < 6; i++)
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c
index 037cb6154f36..3e9d4ac965c8 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c
@@ -61,8 +61,6 @@ static int cycles_child(void)
 	ebb_global_disable();
 	ebb_freeze_pmcs();
 
-	count_pmc(1, sample_period);
-
 	dump_summary_ebb_state();
 
 	event_close(&event);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c
index c5fa64790c22..d90891fe96a3 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c
@@ -82,8 +82,6 @@ static int test_body(void)
 	ebb_global_disable();
 	ebb_freeze_pmcs();
 
-	count_pmc(1, sample_period);
-
 	dump_ebb_state();
 
 	if (mmcr0_mismatch)
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
index 30e1ac62e8cb..8ca92b9ee5b0 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
@@ -76,8 +76,6 @@ int pmc56_overflow(void)
 	ebb_global_disable();
 	ebb_freeze_pmcs();
 
-	count_pmc(2, sample_period);
-
 	dump_ebb_state();
 
 	printf("PMC5/6 overflow %d\n", pmc56_overflowed);

From 096edfefbccc2988c0d6fabcc6714f7a3d0b1c8f Mon Sep 17 00:00:00 2001
From: Qiushi Wu <wu000273@umn.edu>
Date: Wed, 27 May 2020 21:13:22 -0500
Subject: [PATCH 0469/2658] PCI: Fix pci_create_slot() reference count leak

[ Upstream commit 8a94644b440eef5a7b9c104ac8aa7a7f413e35e5 ]

kobject_init_and_add() takes a reference even when it fails.  If it returns
an error, kobject_put() must be called to clean up the memory associated
with the object.

When kobject_init_and_add() fails, call kobject_put() instead of kfree().

b8eb718348b8 ("net-sysfs: Fix reference count leak in
rx|netdev_queue_add_kobject") fixed a similar problem.

Link: https://lore.kernel.org/r/20200528021322.1984-1-wu000273@umn.edu
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/slot.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
index 429d34c348b9..01a343ad7155 100644
--- a/drivers/pci/slot.c
+++ b/drivers/pci/slot.c
@@ -303,13 +303,16 @@ struct pci_slot *pci_create_slot(struct pci_bus *parent, int slot_nr,
 	slot_name = make_slot_name(name);
 	if (!slot_name) {
 		err = -ENOMEM;
+		kfree(slot);
 		goto err;
 	}
 
 	err = kobject_init_and_add(&slot->kobj, &pci_slot_ktype, NULL,
 				   "%s", slot_name);
-	if (err)
+	if (err) {
+		kobject_put(&slot->kobj);
 		goto err;
+	}
 
 	INIT_LIST_HEAD(&slot->list);
 	list_add(&slot->list, &parent->slots);
@@ -328,7 +331,6 @@ struct pci_slot *pci_create_slot(struct pci_bus *parent, int slot_nr,
 	mutex_unlock(&pci_slot_mutex);
 	return slot;
 err:
-	kfree(slot);
 	slot = ERR_PTR(err);
 	goto out;
 }

From 610180a405ed43530bddfe2aa106b9c7cb671785 Mon Sep 17 00:00:00 2001
From: Reto Schneider <code@reto-schneider.ch>
Date: Mon, 22 Jun 2020 15:21:12 +0200
Subject: [PATCH 0470/2658] rtlwifi: rtl8192cu: Prevent leaking urb

[ Upstream commit 03128643eb5453a798db5770952c73dc64fcaf00 ]

If usb_submit_urb fails the allocated urb should be unanchored and
released.

Signed-off-by: Reto Schneider <code@reto-schneider.ch>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200622132113.14508-3-code@reto-schneider.ch
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtlwifi/usb.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
index 9408c1f8e397..f01ef8ecfaf3 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -755,8 +755,11 @@ static int _rtl_usb_receive(struct ieee80211_hw *hw)
 
 		usb_anchor_urb(urb, &rtlusb->rx_submitted);
 		err = usb_submit_urb(urb, GFP_KERNEL);
-		if (err)
+		if (err) {
+			usb_unanchor_urb(urb);
+			usb_free_urb(urb);
 			goto err_out;
+		}
 		usb_free_urb(urb);
 	}
 	return 0;

From bf815aa763be95cc88ae8645e52189c81a0d3320 Mon Sep 17 00:00:00 2001
From: Peng Fan <fanpeng@loongson.cn>
Date: Tue, 14 Jul 2020 20:30:18 +0800
Subject: [PATCH 0471/2658] mips/vdso: Fix resource leaks in genvdso.c

[ Upstream commit a859647b4e6bfeb192284d27d24b6a0c914cae1d ]

Close "fd" before the return of map_vdso() and close "out_file"
in main().

Signed-off-by: Peng Fan <fanpeng@loongson.cn>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/vdso/genvdso.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/arch/mips/vdso/genvdso.c b/arch/mips/vdso/genvdso.c
index 530a36f465ce..afcc86726448 100644
--- a/arch/mips/vdso/genvdso.c
+++ b/arch/mips/vdso/genvdso.c
@@ -126,6 +126,7 @@ static void *map_vdso(const char *path, size_t *_size)
 	if (fstat(fd, &stat) != 0) {
 		fprintf(stderr, "%s: Failed to stat '%s': %s\n", program_name,
 			path, strerror(errno));
+		close(fd);
 		return NULL;
 	}
 
@@ -134,6 +135,7 @@ static void *map_vdso(const char *path, size_t *_size)
 	if (addr == MAP_FAILED) {
 		fprintf(stderr, "%s: Failed to map '%s': %s\n", program_name,
 			path, strerror(errno));
+		close(fd);
 		return NULL;
 	}
 
@@ -143,6 +145,7 @@ static void *map_vdso(const char *path, size_t *_size)
 	if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG) != 0) {
 		fprintf(stderr, "%s: '%s' is not an ELF file\n", program_name,
 			path);
+		close(fd);
 		return NULL;
 	}
 
@@ -154,6 +157,7 @@ static void *map_vdso(const char *path, size_t *_size)
 	default:
 		fprintf(stderr, "%s: '%s' has invalid ELF class\n",
 			program_name, path);
+		close(fd);
 		return NULL;
 	}
 
@@ -165,6 +169,7 @@ static void *map_vdso(const char *path, size_t *_size)
 	default:
 		fprintf(stderr, "%s: '%s' has invalid ELF data order\n",
 			program_name, path);
+		close(fd);
 		return NULL;
 	}
 
@@ -172,15 +177,18 @@ static void *map_vdso(const char *path, size_t *_size)
 		fprintf(stderr,
 			"%s: '%s' has invalid ELF machine (expected EM_MIPS)\n",
 			program_name, path);
+		close(fd);
 		return NULL;
 	} else if (swap_uint16(ehdr->e_type) != ET_DYN) {
 		fprintf(stderr,
 			"%s: '%s' has invalid ELF type (expected ET_DYN)\n",
 			program_name, path);
+		close(fd);
 		return NULL;
 	}
 
 	*_size = stat.st_size;
+	close(fd);
 	return addr;
 }
 
@@ -284,10 +292,12 @@ int main(int argc, char **argv)
 	/* Calculate and write symbol offsets to <output file> */
 	if (!get_symbols(dbg_vdso_path, dbg_vdso)) {
 		unlink(out_path);
+		fclose(out_file);
 		return EXIT_FAILURE;
 	}
 
 	fprintf(out_file, "};\n");
+	fclose(out_file);
 
 	return EXIT_SUCCESS;
 }

From 8a13f274c6eb32cfa370d6272bbe57cfa6bd6896 Mon Sep 17 00:00:00 2001
From: Aditya Pakki <pakki001@umn.edu>
Date: Sat, 13 Jun 2020 20:33:42 -0500
Subject: [PATCH 0472/2658] drm/nouveau/drm/noveau: fix reference count leak in
 nouveau_fbcon_open

[ Upstream commit bfad51c7633325b5d4b32444efe04329d53297b2 ]

nouveau_fbcon_open() calls calls pm_runtime_get_sync() that
increments the reference count. In case of failure, decrement the
ref count before returning the error.

Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nouveau_fbcon.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index edb3a23ded5d..11183839f6fa 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -184,8 +184,10 @@ nouveau_fbcon_open(struct fb_info *info, int user)
 	struct nouveau_fbdev *fbcon = info->par;
 	struct nouveau_drm *drm = nouveau_drm(fbcon->dev);
 	int ret = pm_runtime_get_sync(drm->dev->dev);
-	if (ret < 0 && ret != -EACCES)
+	if (ret < 0 && ret != -EACCES) {
+		pm_runtime_put(drm->dev->dev);
 		return ret;
+	}
 	return 0;
 }
 

From 449f9d5a32029e86fe2f130ac83cc9397507ae2b Mon Sep 17 00:00:00 2001
From: Aditya Pakki <pakki001@umn.edu>
Date: Sat, 13 Jun 2020 20:22:23 -0500
Subject: [PATCH 0473/2658] drm/nouveau: Fix reference count leak in
 nouveau_connector_detect

[ Upstream commit 990a1162986e8eff7ca18cc5a0e03b4304392ae2 ]

nouveau_connector_detect() calls pm_runtime_get_sync and in turn
increments the reference count. In case of failure, decrement the
ref count before returning the error.

Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nouveau_connector.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index 1855b475cc0b..42be04813b68 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -263,8 +263,10 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)
 		pm_runtime_get_noresume(dev->dev);
 	} else {
 		ret = pm_runtime_get_sync(dev->dev);
-		if (ret < 0 && ret != -EACCES)
+		if (ret < 0 && ret != -EACCES) {
+			pm_runtime_put_autosuspend(dev->dev);
 			return conn_status;
+		}
 	}
 
 	nv_encoder = nouveau_connector_ddc_detect(connector);

From 2147f3d325fe33eae48ac3edde9ba6a1ac543474 Mon Sep 17 00:00:00 2001
From: Chris Wilson <chris@chris-wilson.co.uk>
Date: Sat, 25 Jul 2020 19:51:10 +0100
Subject: [PATCH 0474/2658] locking/lockdep: Fix overflow in presentation of
 average lock-time

[ Upstream commit a7ef9b28aa8d72a1656fa6f0a01bbd1493886317 ]

Though the number of lock-acquisitions is tracked as unsigned long, this
is passed as the divisor to div_s64() which interprets it as a s32,
giving nonsense values with more than 2 billion acquisitons. E.g.

  acquisitions   holdtime-min   holdtime-max holdtime-total   holdtime-avg
  -------------------------------------------------------------------------
    2350439395           0.07         353.38   649647067.36          0.-32

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/r/20200725185110.11588-1-chris@chris-wilson.co.uk
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/locking/lockdep_proc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c
index 35b34eccdd10..9484f934aa34 100644
--- a/kernel/locking/lockdep_proc.c
+++ b/kernel/locking/lockdep_proc.c
@@ -423,7 +423,7 @@ static void seq_lock_time(struct seq_file *m, struct lock_time *lt)
 	seq_time(m, lt->min);
 	seq_time(m, lt->max);
 	seq_time(m, lt->total);
-	seq_time(m, lt->nr ? div_s64(lt->total, lt->nr) : 0);
+	seq_time(m, lt->nr ? div64_u64(lt->total, lt->nr) : 0);
 }
 
 static void seq_stats(struct seq_file *m, struct lock_stat_data *data)

From bd96994737b27f544cd3a58cb0a66f0fd5fee87d Mon Sep 17 00:00:00 2001
From: Jing Xiangfeng <jingxiangfeng@huawei.com>
Date: Mon, 15 Jun 2020 16:12:26 +0800
Subject: [PATCH 0475/2658] scsi: iscsi: Do not put host in
 iscsi_set_flashnode_param()

[ Upstream commit 68e12e5f61354eb42cfffbc20a693153fc39738e ]

If scsi_host_lookup() fails we will jump to put_host which may cause a
panic. Jump to exit_set_fnode instead.

Link: https://lore.kernel.org/r/20200615081226.183068-1-jingxiangfeng@huawei.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/scsi_transport_iscsi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index de10b461ec7e..490364031648 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -3192,7 +3192,7 @@ static int iscsi_set_flashnode_param(struct iscsi_transport *transport,
 		pr_err("%s could not find host no %u\n",
 		       __func__, ev->u.set_flashnode.host_no);
 		err = -ENODEV;
-		goto put_host;
+		goto exit_set_fnode;
 	}
 
 	idx = ev->u.set_flashnode.flashnode_idx;

From 0d54420b1be219b9e78ac60fca990988c49bb6bf Mon Sep 17 00:00:00 2001
From: Xiubo Li <xiubli@redhat.com>
Date: Wed, 1 Jul 2020 01:52:48 -0400
Subject: [PATCH 0476/2658] ceph: fix potential mdsc use-after-free crash

[ Upstream commit fa9967734227b44acb1b6918033f9122dc7825b9 ]

Make sure the delayed work stopped before releasing the resources.

cancel_delayed_work_sync() will only guarantee that the work finishes
executing if the work is already in the ->worklist.  That means after
the cancel_delayed_work_sync() returns, it will leave the work requeued
if it was rearmed at the end. That can lead to a use after free once the
work struct is freed.

Fix it by flushing the delayed work instead of trying to cancel it, and
ensure that the work doesn't rearm if the mdsc is stopping.

URL: https://tracker.ceph.com/issues/46293
Signed-off-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/mds_client.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index a5de8e22629b..b7fd7d69be07 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -3428,6 +3428,9 @@ static void delayed_work(struct work_struct *work)
 	dout("mdsc delayed_work\n");
 	ceph_check_delayed_caps(mdsc);
 
+	if (mdsc->stopping)
+		return;
+
 	mutex_lock(&mdsc->mutex);
 	renew_interval = mdsc->mdsmap->m_session_timeout >> 2;
 	renew_caps = time_after_eq(jiffies, HZ*renew_interval +
@@ -3752,7 +3755,16 @@ void ceph_mdsc_force_umount(struct ceph_mds_client *mdsc)
 static void ceph_mdsc_stop(struct ceph_mds_client *mdsc)
 {
 	dout("stop\n");
-	cancel_delayed_work_sync(&mdsc->delayed_work); /* cancel timer */
+	/*
+	 * Make sure the delayed work stopped before releasing
+	 * the resources.
+	 *
+	 * Because the cancel_delayed_work_sync() will only
+	 * guarantee that the work finishes executing. But the
+	 * delayed work will re-arm itself again after that.
+	 */
+	flush_delayed_work(&mdsc->delayed_work);
+
 	if (mdsc->mdsmap)
 		ceph_mdsmap_destroy(mdsc->mdsmap);
 	kfree(mdsc->sessions);

From b8ef9cebff73e39fbda3c9c1520b5f5a167c381c Mon Sep 17 00:00:00 2001
From: Javed Hasan <jhasan@marvell.com>
Date: Wed, 29 Jul 2020 01:18:24 -0700
Subject: [PATCH 0477/2658] scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del()

[ Upstream commit e95b4789ff4380733006836d28e554dc296b2298 ]

In fcoe_sysfs_fcf_del(), we first deleted the fcf from the list and then
freed it if ctlr_dev was not NULL. This was causing a memory leak.

Free the fcf even if ctlr_dev is NULL.

Link: https://lore.kernel.org/r/20200729081824.30996-3-jhasan@marvell.com
Reviewed-by: Girish Basrur <gbasrur@marvell.com>
Reviewed-by: Santosh Vernekar <svernekar@marvell.com>
Reviewed-by: Saurav Kashyap <skashyap@marvell.com>
Reviewed-by: Shyam Sundar <ssundar@marvell.com>
Signed-off-by: Javed Hasan <jhasan@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/fcoe/fcoe_ctlr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index 3bc610d160f5..53afdbe17d71 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -264,9 +264,9 @@ static void fcoe_sysfs_fcf_del(struct fcoe_fcf *new)
 		WARN_ON(!fcf_dev);
 		new->fcf_dev = NULL;
 		fcoe_fcf_device_delete(fcf_dev);
-		kfree(new);
 		mutex_unlock(&cdev->lock);
 	}
+	kfree(new);
 }
 
 /**

From ebbba5d11e8603c703910eee93c7997e75be53d7 Mon Sep 17 00:00:00 2001
From: Jason Baron <jbaron@akamai.com>
Date: Thu, 16 Jul 2020 14:25:11 -0400
Subject: [PATCH 0478/2658] EDAC/ie31200: Fallback if host bridge device is
 already initialized

[ Upstream commit 709ed1bcef12398ac1a35c149f3e582db04456c2 ]

The Intel uncore driver may claim some of the pci ids from ie31200 which
means that the ie31200 edac driver will not initialize them as part of
pci_register_driver().

Let's add a fallback for this case to 'pci_get_device()' to get a
reference on the device such that it can still be configured. This is
similar in approach to other edac drivers.

Signed-off-by: Jason Baron <jbaron@akamai.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: linux-edac <linux-edac@vger.kernel.org>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Link: https://lore.kernel.org/r/1594923911-10885-1-git-send-email-jbaron@akamai.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/edac/ie31200_edac.c | 50 ++++++++++++++++++++++++++++++++++---
 1 file changed, 47 insertions(+), 3 deletions(-)

diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c
index 18d77ace4813..30f83fb6b145 100644
--- a/drivers/edac/ie31200_edac.c
+++ b/drivers/edac/ie31200_edac.c
@@ -131,6 +131,8 @@
 #define IE31200_PAGES(n)		(n << (28 - PAGE_SHIFT))
 
 static int nr_channels;
+static struct pci_dev *mci_pdev;
+static int ie31200_registered = 1;
 
 struct ie31200_priv {
 	void __iomem *window;
@@ -456,12 +458,16 @@ static int ie31200_probe1(struct pci_dev *pdev, int dev_idx)
 static int ie31200_init_one(struct pci_dev *pdev,
 			    const struct pci_device_id *ent)
 {
-	edac_dbg(0, "MC:\n");
+	int rc;
 
+	edac_dbg(0, "MC:\n");
 	if (pci_enable_device(pdev) < 0)
 		return -EIO;
+	rc = ie31200_probe1(pdev, ent->driver_data);
+	if (rc == 0 && !mci_pdev)
+		mci_pdev = pci_dev_get(pdev);
 
-	return ie31200_probe1(pdev, ent->driver_data);
+	return rc;
 }
 
 static void ie31200_remove_one(struct pci_dev *pdev)
@@ -470,6 +476,8 @@ static void ie31200_remove_one(struct pci_dev *pdev)
 	struct ie31200_priv *priv;
 
 	edac_dbg(0, "\n");
+	pci_dev_put(mci_pdev);
+	mci_pdev = NULL;
 	mci = edac_mc_del_mc(&pdev->dev);
 	if (!mci)
 		return;
@@ -515,17 +523,53 @@ static struct pci_driver ie31200_driver = {
 
 static int __init ie31200_init(void)
 {
+	int pci_rc, i;
+
 	edac_dbg(3, "MC:\n");
 	/* Ensure that the OPSTATE is set correctly for POLL or NMI */
 	opstate_init();
 
-	return pci_register_driver(&ie31200_driver);
+	pci_rc = pci_register_driver(&ie31200_driver);
+	if (pci_rc < 0)
+		goto fail0;
+
+	if (!mci_pdev) {
+		ie31200_registered = 0;
+		for (i = 0; ie31200_pci_tbl[i].vendor != 0; i++) {
+			mci_pdev = pci_get_device(ie31200_pci_tbl[i].vendor,
+						  ie31200_pci_tbl[i].device,
+						  NULL);
+			if (mci_pdev)
+				break;
+		}
+		if (!mci_pdev) {
+			edac_dbg(0, "ie31200 pci_get_device fail\n");
+			pci_rc = -ENODEV;
+			goto fail1;
+		}
+		pci_rc = ie31200_init_one(mci_pdev, &ie31200_pci_tbl[i]);
+		if (pci_rc < 0) {
+			edac_dbg(0, "ie31200 init fail\n");
+			pci_rc = -ENODEV;
+			goto fail1;
+		}
+	}
+	return 0;
+
+fail1:
+	pci_unregister_driver(&ie31200_driver);
+fail0:
+	pci_dev_put(mci_pdev);
+
+	return pci_rc;
 }
 
 static void __exit ie31200_exit(void)
 {
 	edac_dbg(3, "MC:\n");
 	pci_unregister_driver(&ie31200_driver);
+	if (!ie31200_registered)
+		ie31200_remove_one(mci_pdev);
 }
 
 module_init(ie31200_init);

From b00ff80fd2ac05b3286d708669a3de912c959389 Mon Sep 17 00:00:00 2001
From: Evgeny Novikov <novikov@ispras.ru>
Date: Thu, 23 Jul 2020 19:04:53 +0200
Subject: [PATCH 0479/2658] media: davinci: vpif_capture: fix potential double
 free

[ Upstream commit 602649eadaa0c977e362e641f51ec306bc1d365d ]

In case of errors vpif_probe_complete() releases memory for vpif_obj.sd
and unregisters the V4L2 device. But then this is done again by
vpif_probe() itself. The patch removes the cleaning from
vpif_probe_complete().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/davinci/vpif_capture.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c
index c1e573b7cc6f..50122ac2ac02 100644
--- a/drivers/media/platform/davinci/vpif_capture.c
+++ b/drivers/media/platform/davinci/vpif_capture.c
@@ -1417,8 +1417,6 @@ static int vpif_probe_complete(void)
 		/* Unregister video device */
 		video_unregister_device(&ch->video_dev);
 	}
-	kfree(vpif_obj.sd);
-	v4l2_device_unregister(&vpif_obj.v4l2_dev);
 
 	return err;
 }

From 880ee8801ab8b456aef913a4c60d6ba98416ac26 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 6 Jul 2020 15:22:46 +0200
Subject: [PATCH 0480/2658] powerpc/spufs: add CONFIG_COREDUMP dependency

[ Upstream commit b648a5132ca3237a0f1ce5d871fff342b0efcf8a ]

The kernel test robot pointed out a slightly different error message
after recent commit 5456ffdee666 ("powerpc/spufs: simplify spufs core
dumping") to spufs for a configuration that never worked:

   powerpc64-linux-ld: arch/powerpc/platforms/cell/spufs/file.o: in function `.spufs_proxydma_info_dump':
>> file.c:(.text+0x4c68): undefined reference to `.dump_emit'
   powerpc64-linux-ld: arch/powerpc/platforms/cell/spufs/file.o: in function `.spufs_dma_info_dump':
   file.c:(.text+0x4d70): undefined reference to `.dump_emit'
   powerpc64-linux-ld: arch/powerpc/platforms/cell/spufs/file.o: in function `.spufs_wbox_info_dump':
   file.c:(.text+0x4df4): undefined reference to `.dump_emit'

Add a Kconfig dependency to prevent this from happening again.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200706132302.3885935-1-arnd@arndb.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/cell/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/powerpc/platforms/cell/Kconfig b/arch/powerpc/platforms/cell/Kconfig
index 429fc59d2a47..9acca9c79ef6 100644
--- a/arch/powerpc/platforms/cell/Kconfig
+++ b/arch/powerpc/platforms/cell/Kconfig
@@ -50,6 +50,7 @@ config SPU_FS
 	tristate "SPU file system"
 	default m
 	depends on PPC_CELL
+	depends on COREDUMP
 	select SPU_BASE
 	select MEMORY_HOTPLUG
 	help

From b6f1e5842bac795a0d1bc0114738957eac5b2900 Mon Sep 17 00:00:00 2001
From: Changming Liu <charley.ashbringer@gmail.com>
Date: Sat, 11 Jul 2020 00:30:18 -0400
Subject: [PATCH 0481/2658] USB: sisusbvga: Fix a potential UB casued by left
 shifting a negative value

[ Upstream commit 2b53a19284f537168fb506f2f40d7fda40a01162 ]

The char buffer buf, receives data directly from user space,
so its content might be negative and its elements are left
shifted to form an unsigned integer.

Since left shifting a negative value is undefined behavior, thus
change the char to u8 to elimintate this UB.

Signed-off-by: Changming Liu <charley.ashbringer@gmail.com>
Link: https://lore.kernel.org/r/20200711043018.928-1-charley.ashbringer@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/misc/sisusbvga/sisusb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
index 22da70fada5e..971f1165dc4b 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -790,7 +790,7 @@ static int sisusb_write_mem_bulk(struct sisusb_usb_data *sisusb, u32 addr,
 	u8   swap8, fromkern = kernbuffer ? 1 : 0;
 	u16  swap16;
 	u32  swap32, flag = (length >> 28) & 1;
-	char buf[4];
+	u8 buf[4];
 
 	/* if neither kernbuffer not userbuffer are given, assume
 	 * data in obuf

From 18d99fe9afa3c62166250e2068195815b6a71a61 Mon Sep 17 00:00:00 2001
From: Zhi Chen <zhichen@codeaurora.org>
Date: Tue, 14 Jan 2020 12:35:21 +0800
Subject: [PATCH 0482/2658] Revert "ath10k: fix DMA related firmware crashes on
 multiple devices"

[ Upstream commit a1769bb68a850508a492e3674ab1e5e479b11254 ]

This reverts commit 76d164f582150fd0259ec0fcbc485470bcd8033e.
PCIe hung issue was observed on multiple platforms. The issue was reproduced
when DUT was configured as AP and associated with 50+ STAs.

For QCA9984/QCA9888, the DMA_BURST_SIZE register controls the AXI burst size
of the RD/WR access to the HOST MEM.
0 - No split , RAW read/write transfer size from MAC is put out on bus
    as burst length
1 - Split at 256 byte boundary
2,3 - Reserved

With PCIe protocol analyzer, we can see DMA Read crossing 4KB boundary when
issue happened. It broke PCIe spec and caused PCIe stuck. So revert
the default value from 0 to 1.

Tested:  IPQ8064 + QCA9984 with firmware 10.4-3.10-00047
         QCS404 + QCA9984 with firmware 10.4-3.9.0.2--00044
         Synaptics AS370 + QCA9888  with firmware 10.4-3.9.0.2--00040

Signed-off-by: Zhi Chen <zhichen@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/hw.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
index 37479589b8e1..ed4d291f1f62 100644
--- a/drivers/net/wireless/ath/ath10k/hw.h
+++ b/drivers/net/wireless/ath/ath10k/hw.h
@@ -671,7 +671,7 @@ ath10k_rx_desc_get_l3_pad_bytes(struct ath10k_hw_params *hw,
 
 #define TARGET_10_4_TX_DBG_LOG_SIZE		1024
 #define TARGET_10_4_NUM_WDS_ENTRIES		32
-#define TARGET_10_4_DMA_BURST_SIZE		0
+#define TARGET_10_4_DMA_BURST_SIZE		1
 #define TARGET_10_4_MAC_AGGR_DELIM		0
 #define TARGET_10_4_RX_SKIP_DEFRAG_TIMEOUT_DUP_DETECTION_CHECK 1
 #define TARGET_10_4_VOW_CONFIG			0

From 0cf7fd9581be6bf7d66f7c29aaa4a7fcd303776b Mon Sep 17 00:00:00 2001
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
Date: Mon, 17 Aug 2020 14:19:30 +0200
Subject: [PATCH 0483/2658] i2c: rcar: in slave mode, clear NACK earlier

[ Upstream commit 914a7b3563b8fb92f976619bbd0fa3a4a708baae ]

Currently, a NACK in slave mode is set/cleared when SCL is held low by
the IP core right before the bit is about to be pushed out. This is too
late for clearing and then a NACK from the previous byte is still used
for the current one. Now, let's clear the NACK right after we detected
the STOP condition following the NACK.

Fixes: de20d1857dd6 ("i2c: rcar: add slave support")
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-rcar.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index ddfb08a3e6c2..00b3178c36a7 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -393,6 +393,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
 	/* master sent stop */
 	if (ssr_filtered & SSR) {
 		i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value);
+		rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */
 		rcar_i2c_write(priv, ICSIER, SAR);
 		rcar_i2c_write(priv, ICSSR, ~SSR & 0xff);
 	}

From 0de161246142e53a5082643cda807f0462a1f4fc Mon Sep 17 00:00:00 2001
From: Lukas Czerner <lczerner@redhat.com>
Date: Wed, 17 Jun 2020 11:25:49 +0200
Subject: [PATCH 0484/2658] jbd2: make sure jh have b_transaction set in
 refile/unfile_buffer

[ Upstream commit 24dc9864914eb5813173cfa53313fcd02e4aea7d ]

Callers of __jbd2_journal_unfile_buffer() and
__jbd2_journal_refile_buffer() assume that the b_transaction is set. In
fact if it's not, we can end up with journal_head refcounting errors
leading to crash much later that might be very hard to track down. Add
asserts to make sure that is the case.

We also make sure that b_next_transaction is NULL in
__jbd2_journal_unfile_buffer() since the callers expect that as well and
we should not get into that stage in this state anyway, leading to
problems later on if we do.

Tested with fstests.

Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20200617092549.6712-1-lczerner@redhat.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/jbd2/transaction.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 3233e5ac9774..622610934c9a 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1906,6 +1906,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh)
  */
 static void __jbd2_journal_unfile_buffer(struct journal_head *jh)
 {
+	J_ASSERT_JH(jh, jh->b_transaction != NULL);
+	J_ASSERT_JH(jh, jh->b_next_transaction == NULL);
+
 	__jbd2_journal_temp_unlink_buffer(jh);
 	jh->b_transaction = NULL;
 	jbd2_journal_put_journal_head(jh);
@@ -2453,6 +2456,13 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh)
 
 	was_dirty = test_clear_buffer_jbddirty(bh);
 	__jbd2_journal_temp_unlink_buffer(jh);
+
+	/*
+	 * b_transaction must be set, otherwise the new b_transaction won't
+	 * be holding jh reference
+	 */
+	J_ASSERT_JH(jh, jh->b_transaction != NULL);
+
 	/*
 	 * We set b_transaction here because b_next_transaction will inherit
 	 * our jh reference and thus __jbd2_journal_file_buffer() must not

From 9ff1cda7bad2624dc11036af3dcfebdc0c9c3077 Mon Sep 17 00:00:00 2001
From: "zhangyi (F)" <yi.zhang@huawei.com>
Date: Sat, 20 Jun 2020 10:54:26 +0800
Subject: [PATCH 0485/2658] jbd2: abort journal if free a async write error
 metadata buffer

[ Upstream commit c044f3d8360d2ecf831ba2cc9f08cf9fb2c699fb ]

If we free a metadata buffer which has been failed to async write out
in the background, the jbd2 checkpoint procedure will not detect this
failure in jbd2_log_do_checkpoint(), so it may lead to filesystem
inconsistency after cleanup journal tail. This patch abort the journal
if free a buffer has write_io_error flag to prevent potential further
inconsistency.

Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
Link: https://lore.kernel.org/r/20200620025427.1756360-5-yi.zhang@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/jbd2/transaction.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 622610934c9a..ce2bf9d74224 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -2000,6 +2000,7 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal,
 {
 	struct buffer_head *head;
 	struct buffer_head *bh;
+	bool has_write_io_error = false;
 	int ret = 0;
 
 	J_ASSERT(PageLocked(page));
@@ -2024,11 +2025,26 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal,
 		jbd_unlock_bh_state(bh);
 		if (buffer_jbd(bh))
 			goto busy;
+
+		/*
+		 * If we free a metadata buffer which has been failed to
+		 * write out, the jbd2 checkpoint procedure will not detect
+		 * this failure and may lead to filesystem inconsistency
+		 * after cleanup journal tail.
+		 */
+		if (buffer_write_io_error(bh)) {
+			pr_err("JBD2: Error while async write back metadata bh %llu.",
+			       (unsigned long long)bh->b_blocknr);
+			has_write_io_error = true;
+		}
 	} while ((bh = bh->b_this_page) != head);
 
 	ret = try_to_free_buffers(page);
 
 busy:
+	if (has_write_io_error)
+		jbd2_journal_abort(journal, -EIO);
+
 	return ret;
 }
 

From fee5226195fd2c312da647eb996a8cfc6f007f42 Mon Sep 17 00:00:00 2001
From: Vineeth Vijayan <vneethv@linux.ibm.com>
Date: Thu, 18 Jun 2020 16:42:45 +0200
Subject: [PATCH 0486/2658] s390/cio: add cond_resched() in the
 slow_eval_known_fn() loop

[ Upstream commit 0b8eb2ee9da1e8c9b8082f404f3948aa82a057b2 ]

The scanning through subchannels during the time of an event could
take significant amount of time in case of platforms with lots of
known subchannels. This might result in higher scheduling latencies
for other tasks especially on systems with a single CPU. Add
cond_resched() call, as the loop in slow_eval_known_fn() can be
executed for a longer duration.

Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/cio/css.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 8ecc956ecb59..370a3a2c6de7 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -529,6 +529,11 @@ static int slow_eval_known_fn(struct subchannel *sch, void *data)
 		rc = css_evaluate_known_subchannel(sch, 1);
 		if (rc == -EAGAIN)
 			css_schedule_eval(sch->schid);
+		/*
+		 * The loop might take long time for platforms with lots of
+		 * known devices. Allow scheduling here.
+		 */
+		cond_resched();
 	}
 	return 0;
 }

From 1b257462dd5a353e85a51898c37399012d87c203 Mon Sep 17 00:00:00 2001
From: Stanley Chu <stanley.chu@mediatek.com>
Date: Sun, 9 Aug 2020 13:07:34 +0800
Subject: [PATCH 0487/2658] scsi: ufs: Fix possible infinite loop in
 ufshcd_hold

[ Upstream commit 93b6c5db06028a3b55122bbb74d0715dd8ca4ae0 ]

In ufshcd_suspend(), after clk-gating is suspended and link is set
as Hibern8 state, ufshcd_hold() is still possibly invoked before
ufshcd_suspend() returns. For example, MediaTek's suspend vops may
issue UIC commands which would call ufshcd_hold() during the command
issuing flow.

Now if UFSHCD_CAP_HIBERN8_WITH_CLK_GATING capability is enabled,
then ufshcd_hold() may enter infinite loops because there is no
clk-ungating work scheduled or pending. In this case, ufshcd_hold()
shall just bypass, and keep the link as Hibern8 state.

Link: https://lore.kernel.org/r/20200809050734.18740-1-stanley.chu@mediatek.com
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Co-developed-by: Andy Teng <andy.teng@mediatek.com>
Signed-off-by: Andy Teng <andy.teng@mediatek.com>
Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ufs/ufshcd.c | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index c3204fe6a343..ea35b5c98a9f 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -1893,6 +1893,7 @@ static void ufshcd_set_auto_hibern8_timer(struct ufs_hba *hba, u32 delay)
 static int ufshcd_hibern8_hold(struct ufs_hba *hba, bool async)
 {
 	int rc = 0;
+	bool flush_result;
 	unsigned long flags;
 
 	if (!ufshcd_is_hibern8_on_idle_allowed(hba))
@@ -1907,8 +1908,30 @@ static int ufshcd_hibern8_hold(struct ufs_hba *hba, bool async)
 	}
 
 start:
-	switch (hba->hibern8_on_idle.state) {
-	case HIBERN8_EXITED:
+	switch (hba->clk_gating.state) {
+	case CLKS_ON:
+		/*
+		 * Wait for the ungate work to complete if in progress.
+		 * Though the clocks may be in ON state, the link could
+		 * still be in hibner8 state if hibern8 is allowed
+		 * during clock gating.
+		 * Make sure we exit hibern8 state also in addition to
+		 * clocks being ON.
+		 */
+		if (ufshcd_can_hibern8_during_gating(hba) &&
+		    ufshcd_is_link_hibern8(hba)) {
+			if (async) {
+				rc = -EAGAIN;
+				hba->clk_gating.active_reqs--;
+				break;
+			}
+			spin_unlock_irqrestore(hba->host->host_lock, flags);
+			flush_result = flush_work(&hba->clk_gating.ungate_work);
+			if (hba->clk_gating.is_suspended && !flush_result)
+				goto out;
+			spin_lock_irqsave(hba->host->host_lock, flags);
+			goto start;
+		}
 		break;
 	case REQ_HIBERN8_ENTER:
 		if (cancel_delayed_work(&hba->hibern8_on_idle.enter_work)) {

From 0309a8eef50111fa64186f17d758a1fd2521bada Mon Sep 17 00:00:00 2001
From: Sumera Priyadarsini <sylphrenadin@gmail.com>
Date: Wed, 19 Aug 2020 00:22:41 +0530
Subject: [PATCH 0488/2658] net: gianfar: Add of_node_put() before goto
 statement

[ Upstream commit 989e4da042ca4a56bbaca9223d1a93639ad11e17 ]

Every iteration of for_each_available_child_of_node() decrements
reference count of the previous node, however when control
is transferred from the middle of the loop, as in the case of
a return or break or goto, there is no decrement thus ultimately
resulting in a memory leak.

Fix a potential memory leak in gianfar.c by inserting of_node_put()
before the goto statement.

Issue found with Coccinelle.

Signed-off-by: Sumera Priyadarsini <sylphrenadin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/gianfar.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 37cc1f838dd8..96310e2ee545 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -845,8 +845,10 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
 				continue;
 
 			err = gfar_parse_group(child, priv, model);
-			if (err)
+			if (err) {
+				of_node_put(child);
 				goto err_grp_init;
+			}
 		}
 	} else { /* SQ_SG_MODE */
 		err = gfar_parse_group(np, priv, model);

From 2aaa1ddee842495904cd82750117bdfc9aff142d Mon Sep 17 00:00:00 2001
From: George Kennedy <george.kennedy@oracle.com>
Date: Fri, 31 Jul 2020 12:33:11 -0400
Subject: [PATCH 0489/2658] fbcon: prevent user font height or width change
 from causing potential out-of-bounds access

commit 39b3cffb8cf3111738ea993e2757ab382253d86a upstream.

Add a check to fbcon_resize() to ensure that a possible change to user font
height or user font width will not allow a font data out-of-bounds access.
NOTE: must use original charcount in calculation as font charcount can
change and cannot be used to determine the font data allocated size.

Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Cc: stable <stable@vger.kernel.org>
Reported-by: syzbot+38a3699c7eaf165b97a6@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/1596213192-6635-1-git-send-email-george.kennedy@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/console/fbcon.c | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index c03c5b9602bb..fe0663787b3c 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -2117,6 +2117,9 @@ static void updatescrollmode(struct display *p,
 	}
 }
 
+#define PITCH(w) (((w) + 7) >> 3)
+#define CALC_FONTSZ(h, p, c) ((h) * (p) * (c)) /* size = height * pitch * charcount */
+
 static int fbcon_resize(struct vc_data *vc, unsigned int width, 
 			unsigned int height, unsigned int user)
 {
@@ -2126,6 +2129,24 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,
 	struct fb_var_screeninfo var = info->var;
 	int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;
 
+	if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) {
+		int size;
+		int pitch = PITCH(vc->vc_font.width);
+
+		/*
+		 * If user font, ensure that a possible change to user font
+		 * height or width will not allow a font data out-of-bounds access.
+		 * NOTE: must use original charcount in calculation as font
+		 * charcount can change and cannot be used to determine the
+		 * font data allocated size.
+		 */
+		if (pitch <= 0)
+			return -EINVAL;
+		size = CALC_FONTSZ(vc->vc_font.height, pitch, FNTCHARCNT(vc->vc_font.data));
+		if (size > FNTSIZE(vc->vc_font.data))
+			return -EINVAL;
+	}
+
 	virt_w = FBCON_SWAP(ops->rotate, width, height);
 	virt_h = FBCON_SWAP(ops->rotate, height, width);
 	virt_fw = FBCON_SWAP(ops->rotate, vc->vc_font.width,
@@ -2587,7 +2608,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigne
 	int size;
 	int i, csum;
 	u8 *new_data, *data = font->data;
-	int pitch = (font->width+7) >> 3;
+	int pitch = PITCH(font->width);
 
 	/* Is there a reason why fbconsole couldn't handle any charcount >256?
 	 * If not this check should be changed to charcount < 256 */
@@ -2603,7 +2624,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigne
 	if (fbcon_invalid_charcount(info, charcount))
 		return -EINVAL;
 
-	size = h * pitch * charcount;
+	size = CALC_FONTSZ(h, pitch, charcount);
 
 	new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER);
 

From 13faf36be68406776b85b06c5d9334a90171f10d Mon Sep 17 00:00:00 2001
From: Evgeny Novikov <novikov@ispras.ru>
Date: Wed, 5 Aug 2020 12:06:43 +0300
Subject: [PATCH 0490/2658] USB: lvtest: return proper error code in probe

commit 531412492ce93ea29b9ca3b4eb5e3ed771f851dd upstream.

lvs_rh_probe() can return some nonnegative value from usb_control_msg()
when it is less than "USB_DT_HUB_NONVAR_SIZE + 2" that is considered as
a failure. Make lvs_rh_probe() return -EINVAL in this case.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200805090643.3432-1-novikov@ispras.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/misc/lvstest.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/misc/lvstest.c b/drivers/usb/misc/lvstest.c
index 383fa007348f..bda82e63c1a9 100644
--- a/drivers/usb/misc/lvstest.c
+++ b/drivers/usb/misc/lvstest.c
@@ -396,7 +396,7 @@ static int lvs_rh_probe(struct usb_interface *intf,
 			USB_DT_SS_HUB_SIZE, USB_CTRL_GET_TIMEOUT);
 	if (ret < (USB_DT_HUB_NONVAR_SIZE + 2)) {
 		dev_err(&hdev->dev, "wrong root hub descriptor read %d\n", ret);
-		return ret;
+		return ret < 0 ? ret : -EINVAL;
 	}
 
 	/* submit urb to poll interrupt endpoint */

From 81f449a2ec4f6b5f4cc90cb48e4ad80a0cdf900f Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date: Wed, 29 Jul 2020 23:57:01 +0900
Subject: [PATCH 0491/2658] vt: defer kfree() of vc_screenbuf in vc_do_resize()

commit f8d1653daec02315e06d30246cff4af72e76e54e upstream.

syzbot is reporting UAF bug in set_origin() from vc_do_resize() [1], for
vc_do_resize() calls kfree(vc->vc_screenbuf) before calling set_origin().

Unfortunately, in set_origin(), vc->vc_sw->con_set_origin() might access
vc->vc_pos when scroll is involved in order to manipulate cursor, but
vc->vc_pos refers already released vc->vc_screenbuf until vc->vc_pos gets
updated based on the result of vc->vc_sw->con_set_origin().

Preserving old buffer and tolerating outdated vc members until set_origin()
completes would be easier than preventing vc->vc_sw->con_set_origin() from
accessing outdated vc members.

[1] https://syzkaller.appspot.com/bug?id=6649da2081e2ebdc65c0642c214b27fe91099db3

Reported-by: syzbot <syzbot+9116ecc1978ca3a12f43@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1596034621-4714-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/vt/vt.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 4785ae061b65..0e4f54832fc7 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -864,7 +864,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
 	unsigned int old_rows, old_row_size;
 	unsigned int new_cols, new_rows, new_row_size, new_screen_size;
 	unsigned int user;
-	unsigned short *newscreen;
+	unsigned short *oldscreen, *newscreen;
 
 	WARN_CONSOLE_UNLOCKED();
 
@@ -946,10 +946,11 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
 	if (new_scr_end > new_origin)
 		scr_memsetw((void *)new_origin, vc->vc_video_erase_char,
 			    new_scr_end - new_origin);
-	kfree(vc->vc_screenbuf);
+	oldscreen = vc->vc_screenbuf;
 	vc->vc_screenbuf = newscreen;
 	vc->vc_screenbuf_size = new_screen_size;
 	set_origin(vc);
+	kfree(oldscreen);
 
 	/* do part of a reset_terminal() */
 	vc->vc_top = 0;

From 221b1ff02ab4bda8a064474cca6a5a214fbc106c Mon Sep 17 00:00:00 2001
From: George Kennedy <george.kennedy@oracle.com>
Date: Fri, 31 Jul 2020 12:33:12 -0400
Subject: [PATCH 0492/2658] vt_ioctl: change VT_RESIZEX ioctl to check for
 error return from vc_resize()

commit bc5269ca765057a1b762e79a1cfd267cd7bf1c46 upstream.

vc_resize() can return with an error after failure. Change VT_RESIZEX ioctl
to save struct vc_data values that are modified and restore the original
values in case of error.

Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Cc: stable <stable@vger.kernel.org>
Reported-by: syzbot+38a3699c7eaf165b97a6@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/1596213192-6635-2-git-send-email-george.kennedy@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/vt/vt_ioctl.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
index 9353789e4337..b0f0771a5729 100644
--- a/drivers/tty/vt/vt_ioctl.c
+++ b/drivers/tty/vt/vt_ioctl.c
@@ -896,12 +896,22 @@ int vt_ioctl(struct tty_struct *tty,
 			console_lock();
 			vcp = vc_cons[i].d;
 			if (vcp) {
+				int ret;
+				int save_scan_lines = vcp->vc_scan_lines;
+				int save_font_height = vcp->vc_font.height;
+
 				if (v.v_vlin)
 					vcp->vc_scan_lines = v.v_vlin;
 				if (v.v_clin)
 					vcp->vc_font.height = v.v_clin;
 				vcp->vc_resize_user = 1;
-				vc_resize(vcp, v.v_cols, v.v_rows);
+				ret = vc_resize(vcp, v.v_cols, v.v_rows);
+				if (ret) {
+					vcp->vc_scan_lines = save_scan_lines;
+					vcp->vc_font.height = save_font_height;
+					console_unlock();
+					return ret;
+				}
 			}
 			console_unlock();
 		}

From 5c4077e213688b1c6112b292da11732e62577cac Mon Sep 17 00:00:00 2001
From: Tamseel Shams <m.shams@samsung.com>
Date: Mon, 10 Aug 2020 08:30:21 +0530
Subject: [PATCH 0493/2658] serial: samsung: Removes the IRQ not found warning

commit 8c6c378b0cbe0c9f1390986b5f8ffb5f6ff7593b upstream.

In few older Samsung SoCs like s3c2410, s3c2412
and s3c2440, UART IP is having 2 interrupt lines.
However, in other SoCs like s3c6400, s5pv210,
exynos5433, and exynos4210 UART is having only 1
interrupt line. Due to this, "platform_get_irq(platdev, 1)"
call in the driver gives the following false-positive error:
"IRQ index 1 not found" on newer SoC's.

This patch adds the condition to check for Tx interrupt
only for the those SoC's which have 2 interrupt lines.

Tested-by: Alim Akhtar <alim.akhtar@samsung.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
Signed-off-by: Tamseel Shams <m.shams@samsung.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200810030021.45348-1-m.shams@samsung.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/samsung.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
index 12746a90d8e5..8250343c19c6 100644
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -1719,9 +1719,11 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport,
 		ourport->tx_irq = ret + 1;
 	}
 
-	ret = platform_get_irq(platdev, 1);
-	if (ret > 0)
-		ourport->tx_irq = ret;
+	if (!s3c24xx_serial_has_interrupt_mask(port)) {
+		ret = platform_get_irq(platdev, 1);
+		if (ret > 0)
+			ourport->tx_irq = ret;
+	}
 	/*
 	 * DMA is currently supported only on DT platforms, if DMA properties
 	 * are specified.

From 55474082bdea2ba4c5ead498f0a185c894492983 Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@wunner.de>
Date: Thu, 13 Aug 2020 12:59:54 +0200
Subject: [PATCH 0494/2658] serial: pl011: Don't leak amba_ports entry on
 driver register error

commit 89efbe70b27dd325d8a8c177743a26b885f7faec upstream.

pl011_probe() calls pl011_setup_port() to reserve an amba_ports[] entry,
then calls pl011_register_port() to register the uart driver with the
tty layer.

If registration of the uart driver fails, the amba_ports[] entry is not
released.  If this happens 14 times (value of UART_NR macro), then all
amba_ports[] entries will have been leaked and driver probing is no
longer possible.  (To be fair, that can only happen if the DeviceTree
doesn't contain alias IDs since they cause the same entry to be used for
a given port.)   Fix it.

Fixes: ef2889f7ffee ("serial: pl011: Move uart_register_driver call to device")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v3.15+
Cc: Tushar Behera <tushar.behera@linaro.org>
Link: https://lore.kernel.org/r/138f8c15afb2f184d8102583f8301575566064a6.1597316167.git.lukas@wunner.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/amba-pl011.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 200d9a019413..cc99a2b6e3eb 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2331,7 +2331,7 @@ static int pl011_setup_port(struct device *dev, struct uart_amba_port *uap,
 
 static int pl011_register_port(struct uart_amba_port *uap)
 {
-	int ret;
+	int ret, i;
 
 	/* Ensure interrupts from this UART are masked and cleared */
 	writew(0, uap->port.membase + UART011_IMSC);
@@ -2342,6 +2342,9 @@ static int pl011_register_port(struct uart_amba_port *uap)
 		if (ret < 0) {
 			dev_err(uap->port.dev,
 				"Failed to register AMBA-PL011 driver\n");
+			for (i = 0; i < ARRAY_SIZE(amba_ports); i++)
+				if (amba_ports[i] == uap)
+					amba_ports[i] = NULL;
 			return ret;
 		}
 	}

From a136cf0cd7f12ced6ae42b4fdf7e75e3b7401905 Mon Sep 17 00:00:00 2001
From: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Date: Mon, 17 Aug 2020 11:26:46 +0900
Subject: [PATCH 0495/2658] serial: 8250: change lock order in
 serial8250_do_startup()

commit 205d300aea75623e1ae4aa43e0d265ab9cf195fd upstream.

We have a number of "uart.port->desc.lock vs desc.lock->uart.port"
lockdep reports coming from 8250 driver; this causes a bit of trouble
to people, so let's fix it.

The problem is reverse lock order in two different call paths:

chain #1:

 serial8250_do_startup()
  spin_lock_irqsave(&port->lock);
   disable_irq_nosync(port->irq);
    raw_spin_lock_irqsave(&desc->lock)

chain #2:

  __report_bad_irq()
   raw_spin_lock_irqsave(&desc->lock)
    for_each_action_of_desc()
     printk()
      spin_lock_irqsave(&port->lock);

Fix this by changing the order of locks in serial8250_do_startup():
 do disable_irq_nosync() first, which grabs desc->lock, and grab
 uart->port after that, so that chain #1 and chain #2 have same lock
 order.

Full lockdep splat:

 ======================================================
 WARNING: possible circular locking dependency detected
 5.4.39 #55 Not tainted
 ======================================================

 swapper/0/0 is trying to acquire lock:
 ffffffffab65b6c0 (console_owner){-...}, at: console_lock_spinning_enable+0x31/0x57

 but task is already holding lock:
 ffff88810a8e34c0 (&irq_desc_lock_class){-.-.}, at: __report_bad_irq+0x5b/0xba

 which lock already depends on the new lock.

 the existing dependency chain (in reverse order) is:

 -> #2 (&irq_desc_lock_class){-.-.}:
        _raw_spin_lock_irqsave+0x61/0x8d
        __irq_get_desc_lock+0x65/0x89
        __disable_irq_nosync+0x3b/0x93
        serial8250_do_startup+0x451/0x75c
        uart_startup+0x1b4/0x2ff
        uart_port_activate+0x73/0xa0
        tty_port_open+0xae/0x10a
        uart_open+0x1b/0x26
        tty_open+0x24d/0x3a0
        chrdev_open+0xd5/0x1cc
        do_dentry_open+0x299/0x3c8
        path_openat+0x434/0x1100
        do_filp_open+0x9b/0x10a
        do_sys_open+0x15f/0x3d7
        kernel_init_freeable+0x157/0x1dd
        kernel_init+0xe/0x105
        ret_from_fork+0x27/0x50

 -> #1 (&port_lock_key){-.-.}:
        _raw_spin_lock_irqsave+0x61/0x8d
        serial8250_console_write+0xa7/0x2a0
        console_unlock+0x3b7/0x528
        vprintk_emit+0x111/0x17f
        printk+0x59/0x73
        register_console+0x336/0x3a4
        uart_add_one_port+0x51b/0x5be
        serial8250_register_8250_port+0x454/0x55e
        dw8250_probe+0x4dc/0x5b9
        platform_drv_probe+0x67/0x8b
        really_probe+0x14a/0x422
        driver_probe_device+0x66/0x130
        device_driver_attach+0x42/0x5b
        __driver_attach+0xca/0x139
        bus_for_each_dev+0x97/0xc9
        bus_add_driver+0x12b/0x228
        driver_register+0x64/0xed
        do_one_initcall+0x20c/0x4a6
        do_initcall_level+0xb5/0xc5
        do_basic_setup+0x4c/0x58
        kernel_init_freeable+0x13f/0x1dd
        kernel_init+0xe/0x105
        ret_from_fork+0x27/0x50

 -> #0 (console_owner){-...}:
        __lock_acquire+0x118d/0x2714
        lock_acquire+0x203/0x258
        console_lock_spinning_enable+0x51/0x57
        console_unlock+0x25d/0x528
        vprintk_emit+0x111/0x17f
        printk+0x59/0x73
        __report_bad_irq+0xa3/0xba
        note_interrupt+0x19a/0x1d6
        handle_irq_event_percpu+0x57/0x79
        handle_irq_event+0x36/0x55
        handle_fasteoi_irq+0xc2/0x18a
        do_IRQ+0xb3/0x157
        ret_from_intr+0x0/0x1d
        cpuidle_enter_state+0x12f/0x1fd
        cpuidle_enter+0x2e/0x3d
        do_idle+0x1ce/0x2ce
        cpu_startup_entry+0x1d/0x1f
        start_kernel+0x406/0x46a
        secondary_startup_64+0xa4/0xb0

 other info that might help us debug this:

 Chain exists of:
   console_owner --> &port_lock_key --> &irq_desc_lock_class

  Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   lock(&irq_desc_lock_class);
                                lock(&port_lock_key);
                                lock(&irq_desc_lock_class);
   lock(console_owner);

  *** DEADLOCK ***

 2 locks held by swapper/0/0:
  #0: ffff88810a8e34c0 (&irq_desc_lock_class){-.-.}, at: __report_bad_irq+0x5b/0xba
  #1: ffffffffab65b5c0 (console_lock){+.+.}, at: console_trylock_spinning+0x20/0x181

 stack backtrace:
 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.39 #55
 Hardware name: XXXXXX
 Call Trace:
  <IRQ>
  dump_stack+0xbf/0x133
  ? print_circular_bug+0xd6/0xe9
  check_noncircular+0x1b9/0x1c3
  __lock_acquire+0x118d/0x2714
  lock_acquire+0x203/0x258
  ? console_lock_spinning_enable+0x31/0x57
  console_lock_spinning_enable+0x51/0x57
  ? console_lock_spinning_enable+0x31/0x57
  console_unlock+0x25d/0x528
  ? console_trylock+0x18/0x4e
  vprintk_emit+0x111/0x17f
  ? lock_acquire+0x203/0x258
  printk+0x59/0x73
  __report_bad_irq+0xa3/0xba
  note_interrupt+0x19a/0x1d6
  handle_irq_event_percpu+0x57/0x79
  handle_irq_event+0x36/0x55
  handle_fasteoi_irq+0xc2/0x18a
  do_IRQ+0xb3/0x157
  common_interrupt+0xf/0xf
  </IRQ>

Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Fixes: 768aec0b5bcc ("serial: 8250: fix shared interrupts issues with SMP and RT kernels")
Reported-by: Guenter Roeck <linux@roeck-us.net>
Reported-by: Raul Rangel <rrangel@google.com>
BugLink: https://bugs.chromium.org/p/chromium/issues/detail?id=1114800
Link: https://lore.kernel.org/lkml/CAHQZ30BnfX+gxjPm1DUd5psOTqbyDh4EJE=2=VAMW_VDafctkA@mail.gmail.com/T/#u
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200817022646.1484638-1-sergey.senozhatsky@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_port.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index d42d66b72d5a..fef1b9335f60 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -1902,6 +1902,10 @@ int serial8250_do_startup(struct uart_port *port)
 
 	if (port->irq) {
 		unsigned char iir1;
+
+		if (port->irqflags & IRQF_SHARED)
+			disable_irq_nosync(port->irq);
+
 		/*
 		 * Test for UARTs that do not reassert THRE when the
 		 * transmitter is idle and the interrupt has already
@@ -1911,8 +1915,6 @@ int serial8250_do_startup(struct uart_port *port)
 		 * allow register changes to become visible.
 		 */
 		spin_lock_irqsave(&port->lock, flags);
-		if (up->port.irqflags & IRQF_SHARED)
-			disable_irq_nosync(port->irq);
 
 		wait_for_xmitr(up, UART_LSR_THRE);
 		serial_port_out_sync(port, UART_IER, UART_IER_THRI);
@@ -1924,9 +1926,10 @@ int serial8250_do_startup(struct uart_port *port)
 		iir = serial_port_in(port, UART_IIR);
 		serial_port_out(port, UART_IER, 0);
 
+		spin_unlock_irqrestore(&port->lock, flags);
+
 		if (port->irqflags & IRQF_SHARED)
 			enable_irq(port->irq);
-		spin_unlock_irqrestore(&port->lock, flags);
 
 		/*
 		 * If the interrupt is not reasserted, or we otherwise

From caf48f4314ff1fa8ff1a05a23747617b623bd7a0 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Wed, 10 Jun 2020 17:36:03 +0200
Subject: [PATCH 0496/2658] writeback: Protect inode->i_io_list with
 inode->i_lock

commit b35250c0816c7cf7d0a8de92f5fafb6a7508a708 upstream.

Currently, operations on inode->i_io_list are protected by
wb->list_lock. In the following patches we'll need to maintain
consistency between inode->i_state and inode->i_io_list so change the
code so that inode->i_lock protects also all inode's i_io_list handling.

Reviewed-by: Martijn Coenen <maco@android.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
CC: stable@vger.kernel.org # Prerequisite for "writeback: Avoid skipping inode writeback"
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/fs-writeback.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 1df85bd5f34b..e58f1287208a 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -160,6 +160,7 @@ static void inode_io_list_del_locked(struct inode *inode,
 				     struct bdi_writeback *wb)
 {
 	assert_spin_locked(&wb->list_lock);
+	assert_spin_locked(&inode->i_lock);
 
 	list_del_init(&inode->i_io_list);
 	wb_io_lists_depopulated(wb);
@@ -1034,7 +1035,9 @@ void inode_io_list_del(struct inode *inode)
 	struct bdi_writeback *wb;
 
 	wb = inode_to_wb_and_lock_list(inode);
+	spin_lock(&inode->i_lock);
 	inode_io_list_del_locked(inode, wb);
+	spin_unlock(&inode->i_lock);
 	spin_unlock(&wb->list_lock);
 }
 
@@ -1047,8 +1050,10 @@ void inode_io_list_del(struct inode *inode)
  * the case then the inode must have been redirtied while it was being written
  * out and we don't reset its dirtied_when.
  */
-static void redirty_tail(struct inode *inode, struct bdi_writeback *wb)
+static void redirty_tail_locked(struct inode *inode, struct bdi_writeback *wb)
 {
+	assert_spin_locked(&inode->i_lock);
+
 	if (!list_empty(&wb->b_dirty)) {
 		struct inode *tail;
 
@@ -1059,6 +1064,13 @@ static void redirty_tail(struct inode *inode, struct bdi_writeback *wb)
 	inode_io_list_move_locked(inode, wb, &wb->b_dirty);
 }
 
+static void redirty_tail(struct inode *inode, struct bdi_writeback *wb)
+{
+	spin_lock(&inode->i_lock);
+	redirty_tail_locked(inode, wb);
+	spin_unlock(&inode->i_lock);
+}
+
 /*
  * requeue inode for re-scanning after bdi->b_io list is exhausted.
  */
@@ -1269,7 +1281,7 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb,
 		 * writeback is not making progress due to locked
 		 * buffers. Skip this inode for now.
 		 */
-		redirty_tail(inode, wb);
+		redirty_tail_locked(inode, wb);
 		return;
 	}
 
@@ -1289,7 +1301,7 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb,
 			 * retrying writeback of the dirty page/inode
 			 * that cannot be performed immediately.
 			 */
-			redirty_tail(inode, wb);
+			redirty_tail_locked(inode, wb);
 		}
 	} else if (inode->i_state & I_DIRTY) {
 		/*
@@ -1297,7 +1309,7 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb,
 		 * such as delayed allocation during submission or metadata
 		 * updates after data IO completion.
 		 */
-		redirty_tail(inode, wb);
+		redirty_tail_locked(inode, wb);
 	} else if (inode->i_state & I_DIRTY_TIME) {
 		inode->dirtied_when = jiffies;
 		inode_io_list_move_locked(inode, wb, &wb->b_dirty_time);
@@ -1543,8 +1555,8 @@ static long writeback_sb_inodes(struct super_block *sb,
 		 */
 		spin_lock(&inode->i_lock);
 		if (inode->i_state & (I_NEW | I_FREEING | I_WILL_FREE)) {
+			redirty_tail_locked(inode, wb);
 			spin_unlock(&inode->i_lock);
-			redirty_tail(inode, wb);
 			continue;
 		}
 		if ((inode->i_state & I_SYNC) && wbc.sync_mode != WB_SYNC_ALL) {

From fba11ab5d520ac4171c806455166e27d7e7a81aa Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Fri, 29 May 2020 15:05:22 +0200
Subject: [PATCH 0497/2658] writeback: Avoid skipping inode writeback

commit 5afced3bf28100d81fb2fe7e98918632a08feaf5 upstream.

Inode's i_io_list list head is used to attach inode to several different
lists - wb->{b_dirty, b_dirty_time, b_io, b_more_io}. When flush worker
prepares a list of inodes to writeback e.g. for sync(2), it moves inodes
to b_io list. Thus it is critical for sync(2) data integrity guarantees
that inode is not requeued to any other writeback list when inode is
queued for processing by flush worker. That's the reason why
writeback_single_inode() does not touch i_io_list (unless the inode is
completely clean) and why __mark_inode_dirty() does not touch i_io_list
if I_SYNC flag is set.

However there are two flaws in the current logic:

1) When inode has only I_DIRTY_TIME set but it is already queued in b_io
list due to sync(2), concurrent __mark_inode_dirty(inode, I_DIRTY_SYNC)
can still move inode back to b_dirty list resulting in skipping
writeback of inode time stamps during sync(2).

2) When inode is on b_dirty_time list and writeback_single_inode() races
with __mark_inode_dirty() like:

writeback_single_inode()		__mark_inode_dirty(inode, I_DIRTY_PAGES)
  inode->i_state |= I_SYNC
  __writeback_single_inode()
					  inode->i_state |= I_DIRTY_PAGES;
					  if (inode->i_state & I_SYNC)
					    bail
  if (!(inode->i_state & I_DIRTY_ALL))
  - not true so nothing done

We end up with I_DIRTY_PAGES inode on b_dirty_time list and thus
standard background writeback will not writeback this inode leading to
possible dirty throttling stalls etc. (thanks to Martijn Coenen for this
analysis).

Fix these problems by tracking whether inode is queued in b_io or
b_more_io lists in a new I_SYNC_QUEUED flag. When this flag is set, we
know flush worker has queued inode and we should not touch i_io_list.
On the other hand we also know that once flush worker is done with the
inode it will requeue the inode to appropriate dirty list. When
I_SYNC_QUEUED is not set, __mark_inode_dirty() can (and must) move inode
to appropriate dirty list.

Reported-by: Martijn Coenen <maco@android.com>
Reviewed-by: Martijn Coenen <maco@android.com>
Tested-by: Martijn Coenen <maco@android.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Fixes: 0ae45f63d4ef ("vfs: add support for a lazytime mount option")
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/fs-writeback.c  | 17 ++++++++++++-----
 include/linux/fs.h |  8 ++++++--
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index e58f1287208a..d42c1d1c2484 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -162,6 +162,7 @@ static void inode_io_list_del_locked(struct inode *inode,
 	assert_spin_locked(&wb->list_lock);
 	assert_spin_locked(&inode->i_lock);
 
+	inode->i_state &= ~I_SYNC_QUEUED;
 	list_del_init(&inode->i_io_list);
 	wb_io_lists_depopulated(wb);
 }
@@ -1062,6 +1063,7 @@ static void redirty_tail_locked(struct inode *inode, struct bdi_writeback *wb)
 			inode->dirtied_when = jiffies;
 	}
 	inode_io_list_move_locked(inode, wb, &wb->b_dirty);
+	inode->i_state &= ~I_SYNC_QUEUED;
 }
 
 static void redirty_tail(struct inode *inode, struct bdi_writeback *wb)
@@ -1137,8 +1139,11 @@ static int move_expired_inodes(struct list_head *delaying_queue,
 			break;
 		list_move(&inode->i_io_list, &tmp);
 		moved++;
+		spin_lock(&inode->i_lock);
 		if (flags & EXPIRE_DIRTY_ATIME)
-			set_bit(__I_DIRTY_TIME_EXPIRED, &inode->i_state);
+			inode->i_state |= I_DIRTY_TIME_EXPIRED;
+		inode->i_state |= I_SYNC_QUEUED;
+		spin_unlock(&inode->i_lock);
 		if (sb_is_blkdev_sb(inode->i_sb))
 			continue;
 		if (sb && sb != inode->i_sb)
@@ -1313,6 +1318,7 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb,
 	} else if (inode->i_state & I_DIRTY_TIME) {
 		inode->dirtied_when = jiffies;
 		inode_io_list_move_locked(inode, wb, &wb->b_dirty_time);
+		inode->i_state &= ~I_SYNC_QUEUED;
 	} else {
 		/* The inode is clean. Remove from writeback lists. */
 		inode_io_list_del_locked(inode, wb);
@@ -2140,11 +2146,12 @@ void __mark_inode_dirty(struct inode *inode, int flags)
 		inode->i_state |= flags;
 
 		/*
-		 * If the inode is being synced, just update its dirty state.
-		 * The unlocker will place the inode on the appropriate
-		 * superblock list, based upon its state.
+		 * If the inode is queued for writeback by flush worker, just
+		 * update its dirty state. Once the flush worker is done with
+		 * the inode it will place it on the appropriate superblock
+		 * list, based upon its state.
 		 */
-		if (inode->i_state & I_SYNC)
+		if (inode->i_state & I_SYNC_QUEUED)
 			goto out_unlock_inode;
 
 		/*
diff --git a/include/linux/fs.h b/include/linux/fs.h
index c22f0f30295b..3facd85514d6 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1910,6 +1910,10 @@ struct super_operations {
  *			wb stat updates to grab mapping->tree_lock.  See
  *			inode_switch_wb_work_fn() for details.
  *
+ * I_SYNC_QUEUED	Inode is queued in b_io or b_more_io writeback lists.
+ *			Used to detect that mark_inode_dirty() should not move
+ * 			inode between dirty lists.
+ *
  * Q: What is the difference between I_WILL_FREE and I_FREEING?
  */
 #define I_DIRTY_SYNC		(1 << 0)
@@ -1927,9 +1931,9 @@ struct super_operations {
 #define I_DIO_WAKEUP		(1 << __I_DIO_WAKEUP)
 #define I_LINKABLE		(1 << 10)
 #define I_DIRTY_TIME		(1 << 11)
-#define __I_DIRTY_TIME_EXPIRED	12
-#define I_DIRTY_TIME_EXPIRED	(1 << __I_DIRTY_TIME_EXPIRED)
+#define I_DIRTY_TIME_EXPIRED	(1 << 12)
 #define I_WB_SWITCH		(1 << 13)
+#define I_SYNC_QUEUED		(1 << 17)
 
 #define I_DIRTY (I_DIRTY_SYNC | I_DIRTY_DATASYNC | I_DIRTY_PAGES)
 #define I_DIRTY_ALL (I_DIRTY | I_DIRTY_TIME)

From f839221e8c367bc5e54d59467ebf30964217e9e8 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Fri, 29 May 2020 16:08:58 +0200
Subject: [PATCH 0498/2658] writeback: Fix sync livelock due to b_dirty_time
 processing

commit f9cae926f35e8230330f28c7b743ad088611a8de upstream.

When we are processing writeback for sync(2), move_expired_inodes()
didn't set any inode expiry value (older_than_this). This can result in
writeback never completing if there's steady stream of inodes added to
b_dirty_time list as writeback rechecks dirty lists after each writeback
round whether there's more work to be done. Fix the problem by using
sync(2) start time is inode expiry value when processing b_dirty_time
list similarly as for ordinarily dirtied inodes. This requires some
refactoring of older_than_this handling which simplifies the code
noticeably as a bonus.

Fixes: 0ae45f63d4ef ("vfs: add support for a lazytime mount option")
CC: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/fs-writeback.c                | 44 ++++++++++++--------------------
 include/trace/events/writeback.h | 13 +++++-----
 2 files changed, 23 insertions(+), 34 deletions(-)

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index d42c1d1c2484..516f7eb36a73 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -45,7 +45,6 @@ struct wb_completion {
 struct wb_writeback_work {
 	long nr_pages;
 	struct super_block *sb;
-	unsigned long *older_than_this;
 	enum writeback_sync_modes sync_mode;
 	unsigned int tagged_writepages:1;
 	unsigned int for_kupdate:1;
@@ -1109,16 +1108,13 @@ static bool inode_dirtied_after(struct inode *inode, unsigned long t)
 #define EXPIRE_DIRTY_ATIME 0x0001
 
 /*
- * Move expired (dirtied before work->older_than_this) dirty inodes from
+ * Move expired (dirtied before dirtied_before) dirty inodes from
  * @delaying_queue to @dispatch_queue.
  */
 static int move_expired_inodes(struct list_head *delaying_queue,
 			       struct list_head *dispatch_queue,
-			       int flags,
-			       struct wb_writeback_work *work)
+			       int flags, unsigned long dirtied_before)
 {
-	unsigned long *older_than_this = NULL;
-	unsigned long expire_time;
 	LIST_HEAD(tmp);
 	struct list_head *pos, *node;
 	struct super_block *sb = NULL;
@@ -1126,16 +1122,9 @@ static int move_expired_inodes(struct list_head *delaying_queue,
 	int do_sb_sort = 0;
 	int moved = 0;
 
-	if ((flags & EXPIRE_DIRTY_ATIME) == 0)
-		older_than_this = work->older_than_this;
-	else if (!work->for_sync) {
-		expire_time = jiffies - (dirtytime_expire_interval * HZ);
-		older_than_this = &expire_time;
-	}
 	while (!list_empty(delaying_queue)) {
 		inode = wb_inode(delaying_queue->prev);
-		if (older_than_this &&
-		    inode_dirtied_after(inode, *older_than_this))
+		if (inode_dirtied_after(inode, dirtied_before))
 			break;
 		list_move(&inode->i_io_list, &tmp);
 		moved++;
@@ -1181,18 +1170,22 @@ static int move_expired_inodes(struct list_head *delaying_queue,
  *                                           |
  *                                           +--> dequeue for IO
  */
-static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work)
+static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work,
+		     unsigned long dirtied_before)
 {
 	int moved;
+	unsigned long time_expire_jif = dirtied_before;
 
 	assert_spin_locked(&wb->list_lock);
 	list_splice_init(&wb->b_more_io, &wb->b_io);
-	moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, work);
+	moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, dirtied_before);
+	if (!work->for_sync)
+		time_expire_jif = jiffies - dirtytime_expire_interval * HZ;
 	moved += move_expired_inodes(&wb->b_dirty_time, &wb->b_io,
-				     EXPIRE_DIRTY_ATIME, work);
+				     EXPIRE_DIRTY_ATIME, time_expire_jif);
 	if (moved)
 		wb_io_lists_populated(wb);
-	trace_writeback_queue_io(wb, work, moved);
+	trace_writeback_queue_io(wb, work, dirtied_before, moved);
 }
 
 static int write_inode(struct inode *inode, struct writeback_control *wbc)
@@ -1703,7 +1696,7 @@ static long writeback_inodes_wb(struct bdi_writeback *wb, long nr_pages,
 	blk_start_plug(&plug);
 	spin_lock(&wb->list_lock);
 	if (list_empty(&wb->b_io))
-		queue_io(wb, &work);
+		queue_io(wb, &work, jiffies);
 	__writeback_inodes_wb(wb, &work);
 	spin_unlock(&wb->list_lock);
 	blk_finish_plug(&plug);
@@ -1723,7 +1716,7 @@ static long writeback_inodes_wb(struct bdi_writeback *wb, long nr_pages,
  * takes longer than a dirty_writeback_interval interval, then leave a
  * one-second gap.
  *
- * older_than_this takes precedence over nr_to_write.  So we'll only write back
+ * dirtied_before takes precedence over nr_to_write.  So we'll only write back
  * all dirty pages if they are all attached to "old" mappings.
  */
 static long wb_writeback(struct bdi_writeback *wb,
@@ -1731,14 +1724,11 @@ static long wb_writeback(struct bdi_writeback *wb,
 {
 	unsigned long wb_start = jiffies;
 	long nr_pages = work->nr_pages;
-	unsigned long oldest_jif;
+	unsigned long dirtied_before = jiffies;
 	struct inode *inode;
 	long progress;
 	struct blk_plug plug;
 
-	oldest_jif = jiffies;
-	work->older_than_this = &oldest_jif;
-
 	blk_start_plug(&plug);
 	spin_lock(&wb->list_lock);
 	for (;;) {
@@ -1772,14 +1762,14 @@ static long wb_writeback(struct bdi_writeback *wb,
 		 * safe.
 		 */
 		if (work->for_kupdate) {
-			oldest_jif = jiffies -
+			dirtied_before = jiffies -
 				msecs_to_jiffies(dirty_expire_interval * 10);
 		} else if (work->for_background)
-			oldest_jif = jiffies;
+			dirtied_before = jiffies;
 
 		trace_writeback_start(wb, work);
 		if (list_empty(&wb->b_io))
-			queue_io(wb, work);
+			queue_io(wb, work, dirtied_before);
 		if (work->sb)
 			progress = writeback_sb_inodes(work->sb, wb, work);
 		else
diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h
index fff846b512e6..2609b1c3549e 100644
--- a/include/trace/events/writeback.h
+++ b/include/trace/events/writeback.h
@@ -390,8 +390,9 @@ DEFINE_WBC_EVENT(wbc_writepage);
 TRACE_EVENT(writeback_queue_io,
 	TP_PROTO(struct bdi_writeback *wb,
 		 struct wb_writeback_work *work,
+		 unsigned long dirtied_before,
 		 int moved),
-	TP_ARGS(wb, work, moved),
+	TP_ARGS(wb, work, dirtied_before, moved),
 	TP_STRUCT__entry(
 		__array(char,		name, 32)
 		__field(unsigned long,	older)
@@ -401,19 +402,17 @@ TRACE_EVENT(writeback_queue_io,
 		__dynamic_array(char, cgroup, __trace_wb_cgroup_size(wb))
 	),
 	TP_fast_assign(
-		unsigned long *older_than_this = work->older_than_this;
 		strncpy(__entry->name, dev_name(wb->bdi->dev), 32);
-		__entry->older	= older_than_this ?  *older_than_this : 0;
-		__entry->age	= older_than_this ?
-				  (jiffies - *older_than_this) * 1000 / HZ : -1;
+		__entry->older	= dirtied_before;
+		__entry->age	= (jiffies - dirtied_before) * 1000 / HZ;
 		__entry->moved	= moved;
 		__entry->reason	= work->reason;
 		__trace_wb_assign_cgroup(__get_str(cgroup), wb);
 	),
 	TP_printk("bdi %s: older=%lu age=%ld enqueue=%d reason=%s cgroup=%s",
 		__entry->name,
-		__entry->older,	/* older_than_this in jiffies */
-		__entry->age,	/* older_than_this in relative milliseconds */
+		__entry->older,	/* dirtied_before in jiffies */
+		__entry->age,	/* dirtied_before in relative milliseconds */
 		__entry->moved,
 		__print_symbolic(__entry->reason, WB_WORK_REASON),
 		__get_str(cgroup)

From 4ab8c4f4ed10383ae391796553827dc74eaa223e Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Tue, 25 Aug 2020 17:22:58 +0200
Subject: [PATCH 0499/2658] XEN uses irqdesc::irq_data_common::handler_data to
 store a per interrupt XEN data pointer which contains XEN specific
 information.

commit c330fb1ddc0a922f044989492b7fcca77ee1db46 upstream.

handler data is meant for interrupt handlers and not for storing irq chip
specific information as some devices require handler data to store internal
per interrupt information, e.g. pinctrl/GPIO chained interrupt handlers.

This obviously creates a conflict of interests and crashes the machine
because the XEN pointer is overwritten by the driver pointer.

As the XEN data is not handler specific it should be stored in
irqdesc::irq_data::chip_data instead.

A simple sed s/irq_[sg]et_handler_data/irq_[sg]et_chip_data/ cures that.

Cc: stable@vger.kernel.org
Reported-by: Roman Shaposhnik <roman@zededa.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Roman Shaposhnik <roman@zededa.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/87lfi2yckt.fsf@nanos.tec.linutronix.de
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/events/events_base.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 878a40950a3a..e4dd991e2888 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -155,7 +155,7 @@ int get_evtchn_to_irq(unsigned evtchn)
 /* Get info for IRQ */
 struct irq_info *info_for_irq(unsigned irq)
 {
-	return irq_get_handler_data(irq);
+	return irq_get_chip_data(irq);
 }
 
 /* Constructors for packed IRQ information. */
@@ -384,7 +384,7 @@ static void xen_irq_init(unsigned irq)
 	info->type = IRQT_UNBOUND;
 	info->refcnt = -1;
 
-	irq_set_handler_data(irq, info);
+	irq_set_chip_data(irq, info);
 
 	list_add_tail(&info->list, &xen_irq_list_head);
 }
@@ -433,14 +433,14 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi)
 
 static void xen_free_irq(unsigned irq)
 {
-	struct irq_info *info = irq_get_handler_data(irq);
+	struct irq_info *info = irq_get_chip_data(irq);
 
 	if (WARN_ON(!info))
 		return;
 
 	list_del(&info->list);
 
-	irq_set_handler_data(irq, NULL);
+	irq_set_chip_data(irq, NULL);
 
 	WARN_ON(info->refcnt > 0);
 
@@ -610,7 +610,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi);
 static void __unbind_from_irq(unsigned int irq)
 {
 	int evtchn = evtchn_from_irq(irq);
-	struct irq_info *info = irq_get_handler_data(irq);
+	struct irq_info *info = irq_get_chip_data(irq);
 
 	if (info->refcnt > 0) {
 		info->refcnt--;
@@ -1114,7 +1114,7 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi,
 
 void unbind_from_irqhandler(unsigned int irq, void *dev_id)
 {
-	struct irq_info *info = irq_get_handler_data(irq);
+	struct irq_info *info = irq_get_chip_data(irq);
 
 	if (WARN_ON(!info))
 		return;
@@ -1148,7 +1148,7 @@ int evtchn_make_refcounted(unsigned int evtchn)
 	if (irq == -1)
 		return -ENOENT;
 
-	info = irq_get_handler_data(irq);
+	info = irq_get_chip_data(irq);
 
 	if (!info)
 		return -ENOENT;
@@ -1176,7 +1176,7 @@ int evtchn_get(unsigned int evtchn)
 	if (irq == -1)
 		goto done;
 
-	info = irq_get_handler_data(irq);
+	info = irq_get_chip_data(irq);
 
 	if (!info)
 		goto done;

From 0f35ed17fd344cebd2ab150995e7a303d25a895c Mon Sep 17 00:00:00 2001
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date: Fri, 21 Aug 2020 12:15:48 +0300
Subject: [PATCH 0500/2658] xhci: Do warm-reset when both CAS and XDEV_RESUME
 are set

commit 904df64a5f4d5ebd670801d869ca0a6d6a6e8df6 upstream.

Sometimes re-plugging a USB device during system sleep renders the device
useless:
[  173.418345] xhci_hcd 0000:00:14.0: Get port status 2-4 read: 0x14203e2, return 0x10262
...
[  176.496485] usb 2-4: Waited 2000ms for CONNECT
[  176.496781] usb usb2-port4: status 0000.0262 after resume, -19
[  176.497103] usb 2-4: can't resume, status -19
[  176.497438] usb usb2-port4: logical disconnect

Because PLS equals to XDEV_RESUME, xHCI driver reports U3 to usbcore,
despite of CAS bit is flagged.

So proritize CAS over XDEV_RESUME to let usbcore handle warm-reset for
the port.

Cc: stable <stable@vger.kernel.org>
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200821091549.20556-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-hub.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 3b12f7c4db69..d6c76ab7a0de 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -602,15 +602,6 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci,
 {
 	u32 pls = status_reg & PORT_PLS_MASK;
 
-	/* resume state is a xHCI internal state.
-	 * Do not report it to usb core, instead, pretend to be U3,
-	 * thus usb core knows it's not ready for transfer
-	 */
-	if (pls == XDEV_RESUME) {
-		*status |= USB_SS_PORT_LS_U3;
-		return;
-	}
-
 	/* When the CAS bit is set then warm reset
 	 * should be performed on port
 	 */
@@ -632,6 +623,16 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci,
 		 */
 		pls |= USB_PORT_STAT_CONNECTION;
 	} else {
+		/*
+		 * Resume state is an xHCI internal state.  Do not report it to
+		 * usb core, instead, pretend to be U3, thus usb core knows
+		 * it's not ready for transfer.
+		 */
+		if (pls == XDEV_RESUME) {
+			*status |= USB_SS_PORT_LS_U3;
+			return;
+		}
+
 		/*
 		 * If CAS bit isn't set but the Port is already at
 		 * Compliance Mode, fake a connection so the USB core

From c905bc3410fe6c9c4b14360fad0bc9ecc76cb737 Mon Sep 17 00:00:00 2001
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Date: Mon, 24 Aug 2020 19:35:31 +0200
Subject: [PATCH 0501/2658] PM: sleep: core: Fix the handling of pending
 runtime resume requests

commit e3eb6e8fba65094328b8dca635d00de74ba75b45 upstream.

It has been reported that system-wide suspend may be aborted in the
absence of any wakeup events due to unforseen interactions of it with
the runtume PM framework.

One failing scenario is when there are multiple devices sharing an
ACPI power resource and runtime-resume needs to be carried out for
one of them during system-wide suspend (for example, because it needs
to be reconfigured before the whole system goes to sleep).  In that
case, the runtime-resume of that device involves turning the ACPI
power resource "on" which in turn causes runtime-resume requests
to be queued up for all of the other devices sharing it.  Those
requests go to the runtime PM workqueue which is frozen during
system-wide suspend, so they are not actually taken care of until
the resume of the whole system, but the pm_runtime_barrier()
call in __device_suspend() sees them and triggers system wakeup
events for them which then cause the system-wide suspend to be
aborted if wakeup source objects are in active use.

Of course, the logic that leads to triggering those wakeup events is
questionable in the first place, because clearly there are cases in
which a pending runtime resume request for a device is not connected
to any real wakeup events in any way (like the one above).  Moreover,
it is racy, because the device may be resuming already by the time
the pm_runtime_barrier() runs and so if the driver doesn't take care
of signaling the wakeup event as appropriate, it will be lost.
However, if the driver does take care of that, the extra
pm_wakeup_event() call in the core is redundant.

Accordingly, drop the conditional pm_wakeup_event() call fron
__device_suspend() and make the latter call pm_runtime_barrier()
alone.  Also modify the comment next to that call to reflect the new
code and extend it to mention the need to avoid unwanted interactions
between runtime PM and system-wide device suspend callbacks.

Fixes: 1e2ef05bb8cf8 ("PM: Limit race conditions between runtime PM and system sleep (v2)")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Utkarsh H Patel <utkarsh.h.patel@intel.com>
Tested-by: Utkarsh H Patel <utkarsh.h.patel@intel.com>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/power/main.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 14434c01d9c9..c63cb220fc1c 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1367,13 +1367,17 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
 	}
 
 	/*
-	 * If a device configured to wake up the system from sleep states
-	 * has been suspended at run time and there's a resume request pending
-	 * for it, this is equivalent to the device signaling wakeup, so the
-	 * system suspend operation should be aborted.
+	 * Wait for possible runtime PM transitions of the device in progress
+	 * to complete and if there's a runtime resume request pending for it,
+	 * resume it before proceeding with invoking the system-wide suspend
+	 * callbacks for it.
+	 *
+	 * If the system-wide suspend callbacks below change the configuration
+	 * of the device, they must disable runtime PM for it or otherwise
+	 * ensure that its runtime-resume callbacks will not be confused by that
+	 * change in case they are invoked going forward.
 	 */
-	if (pm_runtime_barrier(dev) && device_may_wakeup(dev))
-		pm_wakeup_event(dev, 0);
+	pm_runtime_barrier(dev);
 
 	if (pm_wakeup_pending()) {
 		dev->power.direct_complete = false;

From 5ab85ad3d9a3e322b6048b0fd85fe0a984de2130 Mon Sep 17 00:00:00 2001
From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Date: Fri, 21 Aug 2020 13:53:42 +0300
Subject: [PATCH 0502/2658] device property: Fix the secondary firmware node
 handling in set_primary_fwnode()

commit c15e1bdda4365a5f17cdadf22bf1c1df13884a9e upstream.

When the primary firmware node pointer is removed from a
device (set to NULL) the secondary firmware node pointer,
when it exists, is made the primary node for the device.
However, the secondary firmware node pointer of the original
primary firmware node is never cleared (set to NULL).

To avoid situation where the secondary firmware node pointer
is pointing to a non-existing object, clearing it properly
when the primary node is removed from a device in
set_primary_fwnode().

Fixes: 97badf873ab6 ("device property: Make it possible to use secondary firmware nodes")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/core.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index 146d8c081695..39e67fb94f21 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2349,17 +2349,21 @@ static inline bool fwnode_is_primary(struct fwnode_handle *fwnode)
  */
 void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode)
 {
-	if (fwnode) {
-		struct fwnode_handle *fn = dev->fwnode;
+	struct fwnode_handle *fn = dev->fwnode;
 
+	if (fwnode) {
 		if (fwnode_is_primary(fn))
 			fn = fn->secondary;
 
 		fwnode->secondary = fn;
 		dev->fwnode = fwnode;
 	} else {
-		dev->fwnode = fwnode_is_primary(dev->fwnode) ?
-			dev->fwnode->secondary : NULL;
+		if (fwnode_is_primary(fn)) {
+			dev->fwnode = fn->secondary;
+			fn->secondary = NULL;
+		} else {
+			dev->fwnode = NULL;
+		}
 	}
 }
 EXPORT_SYMBOL_GPL(set_primary_fwnode);

From 0e43e7fad33e6cd68b6a35b2a2a4bcb28f67b2a1 Mon Sep 17 00:00:00 2001
From: Alan Stern <stern@rowland.harvard.edu>
Date: Mon, 10 Aug 2020 14:29:54 -0400
Subject: [PATCH 0503/2658] USB: yurex: Fix bad gfp argument

commit f176ede3a3bde5b398a6777a7f9ff091baa2d3ff upstream.

The syzbot fuzzer identified a bug in the yurex driver: It passes
GFP_KERNEL as a memory-allocation flag to usb_submit_urb() at a time
when its state is TASK_INTERRUPTIBLE, not TASK_RUNNING:

do not call blocking ops when !TASK_RUNNING; state=1 set at [<00000000370c7c68>] prepare_to_wait+0xb1/0x2a0 kernel/sched/wait.c:247
WARNING: CPU: 1 PID: 340 at kernel/sched/core.c:7253 __might_sleep+0x135/0x190
kernel/sched/core.c:7253
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 340 Comm: syz-executor677 Not tainted 5.8.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xf6/0x16e lib/dump_stack.c:118
 panic+0x2aa/0x6e1 kernel/panic.c:231
 __warn.cold+0x20/0x50 kernel/panic.c:600
 report_bug+0x1bd/0x210 lib/bug.c:198
 handle_bug+0x41/0x80 arch/x86/kernel/traps.c:234
 exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:__might_sleep+0x135/0x190 kernel/sched/core.c:7253
Code: 65 48 8b 1c 25 40 ef 01 00 48 8d 7b 10 48 89 fe 48 c1 ee 03 80 3c 06 00 75
2b 48 8b 73 10 48 c7 c7 e0 9e 06 86 e8 ed 12 f6 ff <0f> 0b e9 46 ff ff ff e8 1f
b2 4b 00 e9 29 ff ff ff e8 15 b2 4b 00
RSP: 0018:ffff8881cdb77a28 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8881c6458000 RCX: 0000000000000000
RDX: ffff8881c6458000 RSI: ffffffff8129ec93 RDI: ffffed1039b6ef37
RBP: ffffffff86fdade2 R08: 0000000000000001 R09: ffff8881db32f54f
R10: 0000000000000000 R11: 0000000030343354 R12: 00000000000001f2
R13: 0000000000000000 R14: 0000000000000068 R15: ffffffff83c1b1aa
 slab_pre_alloc_hook.constprop.0+0xea/0x200 mm/slab.h:498
 slab_alloc_node mm/slub.c:2816 [inline]
 slab_alloc mm/slub.c:2900 [inline]
 kmem_cache_alloc_trace+0x46/0x220 mm/slub.c:2917
 kmalloc include/linux/slab.h:554 [inline]
 dummy_urb_enqueue+0x7a/0x880 drivers/usb/gadget/udc/dummy_hcd.c:1251
 usb_hcd_submit_urb+0x2b2/0x22d0 drivers/usb/core/hcd.c:1547
 usb_submit_urb+0xb4e/0x13e0 drivers/usb/core/urb.c:570
 yurex_write+0x3ea/0x820 drivers/usb/misc/yurex.c:495

This patch changes the call to use GFP_ATOMIC instead of GFP_KERNEL.

Reported-and-tested-by: syzbot+c2c3302f9c601a4b1be2@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200810182954.GB307778@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/misc/yurex.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index 44c6ced5d442..b17aeaafbb7c 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -510,7 +510,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
 	prepare_to_wait(&dev->waitq, &wait, TASK_INTERRUPTIBLE);
 	dev_dbg(&dev->interface->dev, "%s - submit %c\n", __func__,
 		dev->cntl_buffer[0]);
-	retval = usb_submit_urb(dev->cntl_urb, GFP_KERNEL);
+	retval = usb_submit_urb(dev->cntl_urb, GFP_ATOMIC);
 	if (retval >= 0)
 		timeout = schedule_timeout(YUREX_WRITE_TIMEOUT);
 	finish_wait(&dev->waitq, &wait);

From b8f57a79296a01092b75d8ba48c39e17bd864506 Mon Sep 17 00:00:00 2001
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Date: Tue, 18 Aug 2020 19:27:47 -0700
Subject: [PATCH 0504/2658] usb: uas: Add quirk for PNY Pro Elite

commit 9a469bc9f32dd33c7aac5744669d21a023a719cd upstream.

PNY Pro Elite USB 3.1 Gen 2 device (SSD) doesn't respond to ATA_12
pass-through command (i.e. it just hangs). If it doesn't support this
command, it should respond properly to the host. Let's just add a quirk
to be able to move forward with other operations.

Cc: stable@vger.kernel.org
Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
Link: https://lore.kernel.org/r/2b0585228b003eedcc82db84697b31477df152e0.1597803605.git.thinhn@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/unusual_uas.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index cb0af57aad6e..ad3eb8711331 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -155,6 +155,13 @@ UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999,
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_BROKEN_FUA),
 
+/* Reported-by: Thinh Nguyen <thinhn@synopsys.com> */
+UNUSUAL_DEV(0x154b, 0xf00d, 0x0000, 0x9999,
+		"PNY",
+		"Pro Elite SSD",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_NO_ATA_1X),
+
 /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
 UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
 		"VIA",

From 9cb4692df7f9a4ade6d2d92a26324fd1d2aa2e3b Mon Sep 17 00:00:00 2001
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date: Fri, 31 Jul 2020 13:16:20 +0800
Subject: [PATCH 0505/2658] USB: quirks: Add no-lpm quirk for another Raydium
 touchscreen

commit 5967116e8358899ebaa22702d09b0af57fef23e1 upstream.

There's another Raydium touchscreen needs the no-lpm quirk:
[    1.339149] usb 1-9: New USB device found, idVendor=2386, idProduct=350e, bcdDevice= 0.00
[    1.339150] usb 1-9: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[    1.339151] usb 1-9: Product: Raydium Touch System
[    1.339152] usb 1-9: Manufacturer: Raydium Corporation
...
[    6.450497] usb 1-9: can't set config #1, error -110

BugLink: https://bugs.launchpad.net/bugs/1889446
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200731051622.28643-1-kai.heng.feng@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/quirks.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index e6e0f786547b..eed7c8d8e3d4 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -299,6 +299,8 @@ static const struct usb_device_id usb_quirk_list[] = {
 
 	{ USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM },
 
+	{ USB_DEVICE(0x2386, 0x350e), .driver_info = USB_QUIRK_NO_LPM },
+
 	/* DJI CineSSD */
 	{ USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
 

From 82b8ee95565f6207c82bf9d1a7cf082eb29f554a Mon Sep 17 00:00:00 2001
From: Cyril Roelandt <tipecaml@gmail.com>
Date: Tue, 25 Aug 2020 23:22:31 +0200
Subject: [PATCH 0506/2658] USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge

commit 9aa37788e7ebb3f489fb4b71ce07adadd444264a upstream.

This device does not support UAS properly and a similar entry already
exists in drivers/usb/storage/unusual_uas.h. Without this patch,
storage_probe() defers the handling of this device to UAS, which cannot
handle it either.

Tested-by: Brice Goglin <brice.goglin@gmail.com>
Fixes: bc3bdb12bbb3 ("usb-storage: Disable UAS on JMicron SATA enclosure")
Acked-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Cyril Roelandt <tipecaml@gmail.com>
Link: https://lore.kernel.org/r/20200825212231.46309-1-tipecaml@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/unusual_devs.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index ccf2d50e0d2e..2c2ac15d2554 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2213,7 +2213,7 @@ UNUSUAL_DEV(  0x357d, 0x7788, 0x0114, 0x0114,
 		"JMicron",
 		"USB to ATA/ATAPI Bridge",
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
-		US_FL_BROKEN_FUA ),
+		US_FL_BROKEN_FUA | US_FL_IGNORE_UAS ),
 
 /* Reported by Andrey Rahmatullin <wrar@altlinux.org> */
 UNUSUAL_DEV(  0x4102, 0x1020, 0x0100,  0x0100,

From 52203146e0a32db3ae31c130bfdd6b514dcf9d7a Mon Sep 17 00:00:00 2001
From: Tang Bin <tangbin@cmss.chinamobile.com>
Date: Wed, 26 Aug 2020 22:49:31 +0800
Subject: [PATCH 0507/2658] usb: host: ohci-exynos: Fix error handling in
 exynos_ohci_probe()

commit 1d4169834628d18b2392a2da92b7fbf5e8e2ce89 upstream.

If the function platform_get_irq() failed, the negative value
returned will not be detected here. So fix error handling in
exynos_ohci_probe(). And when get irq failed, the function
platform_get_irq() logs an error message, so remove redundant
message here.

Fixes: 62194244cf87 ("USB: Add Samsung Exynos OHCI diver")
Signed-off-by: Zhang Shengju <zhangshengju@cmss.chinamobile.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20200826144931.1828-1-tangbin@cmss.chinamobile.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/ohci-exynos.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/host/ohci-exynos.c b/drivers/usb/host/ohci-exynos.c
index 6865b919403f..2ed062a2e93b 100644
--- a/drivers/usb/host/ohci-exynos.c
+++ b/drivers/usb/host/ohci-exynos.c
@@ -166,9 +166,8 @@ static int exynos_ohci_probe(struct platform_device *pdev)
 	hcd->rsrc_len = resource_size(res);
 
 	irq = platform_get_irq(pdev, 0);
-	if (!irq) {
-		dev_err(&pdev->dev, "Failed to get IRQ\n");
-		err = -ENODEV;
+	if (irq < 0) {
+		err = irq;
 		goto fail_io;
 	}
 

From f04d84defeee4b1791c8883e53ebab2c3ee3f28b Mon Sep 17 00:00:00 2001
From: Alan Stern <stern@rowland.harvard.edu>
Date: Wed, 26 Aug 2020 10:32:29 -0400
Subject: [PATCH 0508/2658] usb: storage: Add unusual_uas entry for Sony PSZ
 drives
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 20934c0de13b49a072fb1e0ca79fe0fe0e40eae5 upstream.

The PSZ-HA* family of USB disk drives from Sony can't handle the
REPORT OPCODES command when using the UAS protocol.  This patch adds
an appropriate quirks entry.

Reported-and-tested-by: Till Dörges <doerges@pre-sense.de>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200826143229.GB400430@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/unusual_uas.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index ad3eb8711331..b7171c19fca2 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -40,6 +40,13 @@
  * and don't forget to CC: the USB development list <linux-usb@vger.kernel.org>
  */
 
+/* Reported-by: Till Dörges <doerges@pre-sense.de> */
+UNUSUAL_DEV(0x054c, 0x087d, 0x0000, 0x9999,
+		"Sony",
+		"PSZ-HA*",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_NO_REPORT_OPCODES),
+
 /* Reported-by: Julian Groß <julian.g@posteo.de> */
 UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x9999,
 		"LaCie",

From 17db706d03827feb7127940cabf117641f654034 Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Mon, 10 Aug 2020 17:31:16 -0400
Subject: [PATCH 0509/2658] btrfs: check the right error variable in
 btrfs_del_dir_entries_in_log

[ Upstream commit fb2fecbad50964b9f27a3b182e74e437b40753ef ]

With my new locking code dbench is so much faster that I tripped over a
transaction abort from ENOSPC.  This turned out to be because
btrfs_del_dir_entries_in_log was checking for ret == -ENOSPC, but this
function sets err on error, and returns err.  So instead of properly
marking the inode as needing a full commit, we were returning -ENOSPC
and aborting in __btrfs_unlink_inode.  Fix this by checking the proper
variable so that we return the correct thing in the case of ENOSPC.

The ENOENT needs to be checked, because btrfs_lookup_dir_item_index()
can return -ENOENT if the dir item isn't in the tree log (which would
happen if we hadn't fsync'ed this guy).  We actually handle that case in
__btrfs_unlink_inode, so it's an expected error to get back.

Fixes: 4a500fd178c8 ("Btrfs: Metadata ENOSPC handling for tree log")
CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
[ add note and comment about ENOENT ]
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/tree-log.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 820d3b5bc415..8f0f91de436d 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3169,11 +3169,13 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
 	btrfs_free_path(path);
 out_unlock:
 	mutex_unlock(&BTRFS_I(dir)->log_mutex);
-	if (ret == -ENOSPC) {
+	if (err == -ENOSPC) {
 		btrfs_set_log_full_commit(root->fs_info, trans);
-		ret = 0;
-	} else if (ret < 0)
-		btrfs_abort_transaction(trans, root, ret);
+		err = 0;
+	} else if (err < 0 && err != -ENOENT) {
+		/* ENOENT can be returned if the entry hasn't been fsynced yet */
+		btrfs_abort_transaction(trans, root, err);
+	}
 
 	btrfs_end_log_trans(root);
 

From 38bb17af94d49fce0588ca958087a4bcbac12f9f Mon Sep 17 00:00:00 2001
From: Peilin Ye <yepeilin.cs@gmail.com>
Date: Wed, 29 Jul 2020 07:37:12 -0400
Subject: [PATCH 0510/2658] HID: hiddev: Fix slab-out-of-bounds write in
 hiddev_ioctl_usage()

commit 25a097f5204675550afb879ee18238ca917cba7a upstream.

`uref->usage_index` is not always being properly checked, causing
hiddev_ioctl_usage() to go out of bounds under some cases. Fix it.

Reported-by: syzbot+34ee1b45d88571c2fa8b@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=f2aebe90b8c56806b050a20b36f51ed6acabe802
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/usbhid/hiddev.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index dbdd265075da..7bce23a43907 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -554,12 +554,16 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
 
 		switch (cmd) {
 		case HIDIOCGUSAGE:
+			if (uref->usage_index >= field->report_count)
+				goto inval;
 			uref->value = field->value[uref->usage_index];
 			if (copy_to_user(user_arg, uref, sizeof(*uref)))
 				goto fault;
 			goto goodreturn;
 
 		case HIDIOCSUSAGE:
+			if (uref->usage_index >= field->report_count)
+				goto inval;
 			field->value[uref->usage_index] = uref->value;
 			goto goodreturn;
 

From d4ae64ae50101a68557aecc9128240a6b8060d02 Mon Sep 17 00:00:00 2001
From: Hector Martin <marcan@marcan.st>
Date: Sun, 16 Aug 2020 17:44:31 +0900
Subject: [PATCH 0511/2658] ALSA: usb-audio: Update documentation comment for
 MS2109 quirk

commit 74a2a7de81a2ef20732ec02087314e92692a7a1b upstream.

As the recent fix addressed the channel swap problem more properly,
update the comment as well.

Fixes: 1b7ecc241a67 ("ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109")
Signed-off-by: Hector Martin <marcan@marcan.st>
Link: https://lore.kernel.org/r/20200816084431.102151-1-marcan@marcan.st
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/quirks-table.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index 689fd3103e5b..a917b7e02d31 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -3331,8 +3331,8 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
  * they pretend to be 96kHz mono as a workaround for stereo being broken
  * by that...
  *
- * They also have swapped L-R channels, but that's for userspace to deal
- * with.
+ * They also have an issue with initial stream alignment that causes the
+ * channels to be swapped and out of phase, which is dealt with in quirks.c.
  */
 {
 	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |

From bdf3cb017bcf09f7a3a79cd51a4ac7d5f3156b5c Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 3 Sep 2020 11:19:28 +0200
Subject: [PATCH 0512/2658] Linux 4.4.235

Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index c3b92a791b93..ba409a9ca8b0 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 234
+SUBLEVEL = 235
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 6e0d08a2f1c5506240d427ff3d1bea08ddd80d48 Mon Sep 17 00:00:00 2001
From: Marc Zyngier <maz@kernel.org>
Date: Sat, 29 Aug 2020 12:26:01 +0100
Subject: [PATCH 0513/2658] HID: core: Correctly handle ReportSize being zero

commit bce1305c0ece3dc549663605e567655dd701752c upstream.

It appears that a ReportSize value of zero is legal, even if a bit
non-sensical. Most of the HID code seems to handle that gracefully,
except when computing the total size in bytes. When fed as input to
memset, this leads to some funky outcomes.

Detect the corner case and correctly compute the size.

Cc: stable@vger.kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-core.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f8303a989dea..fe03201d6add 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1367,6 +1367,17 @@ static void hid_output_field(const struct hid_device *hid,
 	}
 }
 
+/*
+ * Compute the size of a report.
+ */
+static size_t hid_compute_report_size(struct hid_report *report)
+{
+	if (report->size)
+		return ((report->size - 1) >> 3) + 1;
+
+	return 0;
+}
+
 /*
  * Create a report. 'data' has to be allocated using
  * hid_alloc_report_buf() so that it has proper size.
@@ -1379,7 +1390,7 @@ void hid_output_report(struct hid_report *report, __u8 *data)
 	if (report->id > 0)
 		*data++ = report->id;
 
-	memset(data, 0, ((report->size - 1) >> 3) + 1);
+	memset(data, 0, hid_compute_report_size(report));
 	for (n = 0; n < report->maxfield; n++)
 		hid_output_field(report->device, report->field[n], data);
 }
@@ -1506,7 +1517,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
 		csize--;
 	}
 
-	rsize = ((report->size - 1) >> 3) + 1;
+	rsize = hid_compute_report_size(report);
 
 	if (report_enum->numbered && rsize >= HID_MAX_BUFFER_SIZE)
 		rsize = HID_MAX_BUFFER_SIZE - 1;

From 1c07cc9407810fd490b7595527357824f9ab96f6 Mon Sep 17 00:00:00 2001
From: Marc Zyngier <maz@kernel.org>
Date: Tue, 1 Sep 2020 10:52:33 +0100
Subject: [PATCH 0514/2658] HID: core: Sanitize event code and type when
 mapping input

commit 35556bed836f8dc07ac55f69c8d17dce3e7f0e25 upstream.

When calling into hid_map_usage(), the passed event code is
blindly stored as is, even if it doesn't fit in the associated bitmap.

This event code can come from a variety of sources, including devices
masquerading as input devices, only a bit more "programmable".

Instead of taking the event code at face value, check that it actually
fits the corresponding bitmap, and if it doesn't:
- spit out a warning so that we know which device is acting up
- NULLify the bitmap pointer so that we catch unexpected uses

Code paths that can make use of untrusted inputs can now check
that the mapping was indeed correct and bail out if not.

Cc: stable@vger.kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-input.c      |  4 ++++
 drivers/hid/hid-multitouch.c |  2 ++
 include/linux/hid.h          | 42 +++++++++++++++++++++++++-----------
 3 files changed, 35 insertions(+), 13 deletions(-)

diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 3331bf8ad85e..c033d12070c3 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -994,6 +994,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
 	}
 
 mapped:
+	/* Mapping failed, bail out */
+	if (!bit)
+		return;
+
 	if (device->driver->input_mapped &&
 	    device->driver->input_mapped(device, hidinput, field, usage,
 					 &bit, &max) < 0) {
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 56c4a81d3ea2..5187f3975c65 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -569,6 +569,8 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
 	case HID_UP_BUTTON:
 		code = BTN_MOUSE + ((usage->hid - 1) & HID_USAGE);
 		hid_map_usage(hi, usage, bit, max, EV_KEY, code);
+		if (!*bit)
+			return -1;
 		input_set_capability(hi->input, EV_KEY, code);
 		return 1;
 
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 2149f650982e..d93ba6014e3c 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -866,34 +866,49 @@ static inline void hid_device_io_stop(struct hid_device *hid) {
  * @max: maximal valid usage->code to consider later (out parameter)
  * @type: input event type (EV_KEY, EV_REL, ...)
  * @c: code which corresponds to this usage and type
+ *
+ * The value pointed to by @bit will be set to NULL if either @type is
+ * an unhandled event type, or if @c is out of range for @type. This
+ * can be used as an error condition.
  */
 static inline void hid_map_usage(struct hid_input *hidinput,
 		struct hid_usage *usage, unsigned long **bit, int *max,
-		__u8 type, __u16 c)
+		__u8 type, unsigned int c)
 {
 	struct input_dev *input = hidinput->input;
-
-	usage->type = type;
-	usage->code = c;
+	unsigned long *bmap = NULL;
+	unsigned int limit = 0;
 
 	switch (type) {
 	case EV_ABS:
-		*bit = input->absbit;
-		*max = ABS_MAX;
+		bmap = input->absbit;
+		limit = ABS_MAX;
 		break;
 	case EV_REL:
-		*bit = input->relbit;
-		*max = REL_MAX;
+		bmap = input->relbit;
+		limit = REL_MAX;
 		break;
 	case EV_KEY:
-		*bit = input->keybit;
-		*max = KEY_MAX;
+		bmap = input->keybit;
+		limit = KEY_MAX;
 		break;
 	case EV_LED:
-		*bit = input->ledbit;
-		*max = LED_MAX;
+		bmap = input->ledbit;
+		limit = LED_MAX;
 		break;
 	}
+
+	if (unlikely(c > limit || !bmap)) {
+		pr_warn_ratelimited("%s: Invalid code %d type %d\n",
+				    input->name, c, type);
+		*bit = NULL;
+		return;
+	}
+
+	usage->type = type;
+	usage->code = c;
+	*max = limit;
+	*bit = bmap;
 }
 
 /**
@@ -907,7 +922,8 @@ static inline void hid_map_usage_clear(struct hid_input *hidinput,
 		__u8 type, __u16 c)
 {
 	hid_map_usage(hidinput, usage, bit, max, type, c);
-	clear_bit(c, *bit);
+	if (*bit)
+		clear_bit(usage->code, *bit);
 }
 
 /**

From b3735c7f6a326294d6034f974c4fcdf3b8dd7887 Mon Sep 17 00:00:00 2001
From: Kim Phillips <kim.phillips@amd.com>
Date: Tue, 1 Sep 2020 16:58:53 -0500
Subject: [PATCH 0515/2658] perf record/stat: Explicitly call out event
 modifiers in the documentation

commit e48a73a312ebf19cc3d72aa74985db25c30757c1 upstream.

Event modifiers are not mentioned in the perf record or perf stat
manpages.  Add them to orient new users more effectively by pointing
them to the perf list manpage for details.

Fixes: 2055fdaf8703 ("perf list: Document precise event sampling for AMD IBS")
Signed-off-by: Kim Phillips <kim.phillips@amd.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Jin Yao <yao.jin@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Paul Clarke <pc@us.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Tony Jones <tonyj@suse.de>
Cc: stable@vger.kernel.org
Link: http://lore.kernel.org/lkml/20200901215853.276234-1-kim.phillips@amd.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/Documentation/perf-record.txt | 4 ++++
 tools/perf/Documentation/perf-stat.txt   | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/tools/perf/Documentation/perf-record.txt b/tools/perf/Documentation/perf-record.txt
index e630a7d2c348..e4eee57ad229 100644
--- a/tools/perf/Documentation/perf-record.txt
+++ b/tools/perf/Documentation/perf-record.txt
@@ -33,6 +33,10 @@ OPTIONS
         - a raw PMU event (eventsel+umask) in the form of rNNN where NNN is a
 	  hexadecimal event descriptor.
 
+        - a symbolic or raw PMU event followed by an optional colon
+	  and a list of event modifiers, e.g., cpu-cycles:p.  See the
+	  linkperf:perf-list[1] man page for details on event modifiers.
+
 	- a symbolically formed PMU event like 'pmu/param1=0x3,param2/' where
 	  'param1', 'param2', etc are defined as formats for the PMU in
 	  /sys/bus/event_sources/devices/<pmu>/format/*.
diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt
index 90c3558c2c12..ee7fe04fc4b6 100644
--- a/tools/perf/Documentation/perf-stat.txt
+++ b/tools/perf/Documentation/perf-stat.txt
@@ -32,6 +32,10 @@ OPTIONS
 	- a raw PMU event (eventsel+umask) in the form of rNNN where NNN is a
 	  hexadecimal event descriptor.
 
+        - a symbolic or raw PMU event followed by an optional colon
+	  and a list of event modifiers, e.g., cpu-cycles:p.  See the
+	  linkperf:perf-list[1] man page for details on event modifiers.
+
 	- a symbolically formed event like 'pmu/param1=0x3,param2/' where
 	  param1 and param2 are defined as formats for the PMU in
 	  /sys/bus/event_sources/devices/<pmu>/format/*

From 95938bce334c821f328f4efda326bfb5cc4b4c9a Mon Sep 17 00:00:00 2001
From: Mel Gorman <mgorman@techsingularity.net>
Date: Thu, 19 May 2016 17:14:24 -0700
Subject: [PATCH 0516/2658] mm, page_alloc: remove unnecessary variable from
 free_pcppages_bulk

commit e5b31ac2ca2cd0cf6bf2fcbb708ed01466c89aaa upstream.

The original count is never reused so it can be removed.

Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[dwagner: update context]
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/page_alloc.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index b18faa167bf8..287d59da337b 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -859,7 +859,6 @@ static void free_pcppages_bulk(struct zone *zone, int count,
 {
 	int migratetype = 0;
 	int batch_free = 0;
-	int to_free = count;
 	unsigned long nr_scanned;
 
 	spin_lock(&zone->lock);
@@ -872,7 +871,7 @@ static void free_pcppages_bulk(struct zone *zone, int count,
 	 * below while (list_empty(list)) loop.
 	 */
 	count = min(pcp->count, count);
-	while (to_free) {
+	while (count) {
 		struct page *page;
 		struct list_head *list;
 
@@ -892,7 +891,7 @@ static void free_pcppages_bulk(struct zone *zone, int count,
 
 		/* This is the only non-empty list. Free them all. */
 		if (batch_free == MIGRATE_PCPTYPES)
-			batch_free = to_free;
+			batch_free = count;
 
 		do {
 			int mt;	/* migratetype of the to-be-freed page */
@@ -910,7 +909,7 @@ static void free_pcppages_bulk(struct zone *zone, int count,
 
 			__free_one_page(page, page_to_pfn(page), zone, 0, mt);
 			trace_mm_page_pcpu_drain(page, 0, mt);
-		} while (--to_free && --batch_free && !list_empty(list));
+		} while (--count && --batch_free && !list_empty(list));
 	}
 	spin_unlock(&zone->lock);
 }

From 882c9daed354505b88a903bd66f8f9a4ca13dcdc Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Thu, 20 Aug 2020 06:19:32 -0700
Subject: [PATCH 0517/2658] hwmon: (applesmc) check status earlier.

[ Upstream commit cecf7560f00a8419396a2ed0f6e5d245ccb4feac ]

clang static analysis reports this representative problem

applesmc.c:758:10: warning: 1st function call argument is an
  uninitialized value
        left = be16_to_cpu(*(__be16 *)(buffer + 6)) >> 2;
               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

buffer is filled by the earlier call

	ret = applesmc_read_key(LIGHT_SENSOR_LEFT_KEY, ...

This problem is reported because a goto skips the status check.
Other similar problems use data from applesmc_read_key before checking
the status.  So move the checks to before the use.

Signed-off-by: Tom Rix <trix@redhat.com>
Reviewed-by: Henrik Rydberg <rydberg@bitmath.org>
Link: https://lore.kernel.org/r/20200820131932.10590-1-trix@redhat.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/applesmc.c | 31 ++++++++++++++++---------------
 1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 0af7fd311979..587fc5c686b3 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -758,15 +758,18 @@ static ssize_t applesmc_light_show(struct device *dev,
 	}
 
 	ret = applesmc_read_key(LIGHT_SENSOR_LEFT_KEY, buffer, data_length);
+	if (ret)
+		goto out;
 	/* newer macbooks report a single 10-bit bigendian value */
 	if (data_length == 10) {
 		left = be16_to_cpu(*(__be16 *)(buffer + 6)) >> 2;
 		goto out;
 	}
 	left = buffer[2];
+
+	ret = applesmc_read_key(LIGHT_SENSOR_RIGHT_KEY, buffer, data_length);
 	if (ret)
 		goto out;
-	ret = applesmc_read_key(LIGHT_SENSOR_RIGHT_KEY, buffer, data_length);
 	right = buffer[2];
 
 out:
@@ -814,12 +817,11 @@ static ssize_t applesmc_show_fan_speed(struct device *dev,
 	sprintf(newkey, fan_speed_fmt[to_option(attr)], to_index(attr));
 
 	ret = applesmc_read_key(newkey, buffer, 2);
-	speed = ((buffer[0] << 8 | buffer[1]) >> 2);
-
 	if (ret)
 		return ret;
-	else
-		return snprintf(sysfsbuf, PAGE_SIZE, "%u\n", speed);
+
+	speed = ((buffer[0] << 8 | buffer[1]) >> 2);
+	return snprintf(sysfsbuf, PAGE_SIZE, "%u\n", speed);
 }
 
 static ssize_t applesmc_store_fan_speed(struct device *dev,
@@ -854,12 +856,11 @@ static ssize_t applesmc_show_fan_manual(struct device *dev,
 	u8 buffer[2];
 
 	ret = applesmc_read_key(FANS_MANUAL, buffer, 2);
-	manual = ((buffer[0] << 8 | buffer[1]) >> to_index(attr)) & 0x01;
-
 	if (ret)
 		return ret;
-	else
-		return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", manual);
+
+	manual = ((buffer[0] << 8 | buffer[1]) >> to_index(attr)) & 0x01;
+	return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", manual);
 }
 
 static ssize_t applesmc_store_fan_manual(struct device *dev,
@@ -875,10 +876,11 @@ static ssize_t applesmc_store_fan_manual(struct device *dev,
 		return -EINVAL;
 
 	ret = applesmc_read_key(FANS_MANUAL, buffer, 2);
-	val = (buffer[0] << 8 | buffer[1]);
 	if (ret)
 		goto out;
 
+	val = (buffer[0] << 8 | buffer[1]);
+
 	if (input)
 		val = val | (0x01 << to_index(attr));
 	else
@@ -954,13 +956,12 @@ static ssize_t applesmc_key_count_show(struct device *dev,
 	u32 count;
 
 	ret = applesmc_read_key(KEY_COUNT_KEY, buffer, 4);
-	count = ((u32)buffer[0]<<24) + ((u32)buffer[1]<<16) +
-						((u32)buffer[2]<<8) + buffer[3];
-
 	if (ret)
 		return ret;
-	else
-		return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", count);
+
+	count = ((u32)buffer[0]<<24) + ((u32)buffer[1]<<16) +
+						((u32)buffer[2]<<8) + buffer[3];
+	return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", count);
 }
 
 static ssize_t applesmc_key_at_index_read_show(struct device *dev,

From 52f5901d9a52638f860aa023c70a3d93fe1961cf Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@kernel.org>
Date: Thu, 20 Aug 2020 11:00:26 -0400
Subject: [PATCH 0518/2658] ceph: don't allow setlease on cephfs

[ Upstream commit 496ceaf12432b3d136dcdec48424312e71359ea7 ]

Leases don't currently work correctly on kcephfs, as they are not broken
when caps are revoked. They could eventually be implemented similarly to
how we did them in libcephfs, but for now don't allow them.

[ idryomov: no need for simple_nosetlease() in ceph_dir_fops and
  ceph_snapdir_fops ]

Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/file.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index ee96d0b2aafc..7d6f2b0934d8 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -1430,6 +1430,7 @@ const struct file_operations ceph_file_fops = {
 	.mmap = ceph_mmap,
 	.fsync = ceph_fsync,
 	.lock = ceph_lock,
+	.setlease = simple_nosetlease,
 	.flock = ceph_flock,
 	.splice_read = generic_file_splice_read,
 	.splice_write = iter_file_splice_write,

From bfc317066720512e8fc62cb156292b2e792cbabe Mon Sep 17 00:00:00 2001
From: Sven Schnelle <svens@linux.ibm.com>
Date: Thu, 20 Aug 2020 09:48:23 +0200
Subject: [PATCH 0519/2658] s390: don't trace preemption in percpu macros

[ Upstream commit 1196f12a2c960951d02262af25af0bb1775ebcc2 ]

Since commit a21ee6055c30 ("lockdep: Change hardirq{s_enabled,_context}
to per-cpu variables") the lockdep code itself uses percpu variables. This
leads to recursions because the percpu macros are calling preempt_enable()
which might call trace_preempt_on().

Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/include/asm/percpu.h | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/arch/s390/include/asm/percpu.h b/arch/s390/include/asm/percpu.h
index 6d6556ca24aa..f715419a72cf 100644
--- a/arch/s390/include/asm/percpu.h
+++ b/arch/s390/include/asm/percpu.h
@@ -28,7 +28,7 @@
 	typedef typeof(pcp) pcp_op_T__;					\
 	pcp_op_T__ old__, new__, prev__;				\
 	pcp_op_T__ *ptr__;						\
-	preempt_disable();						\
+	preempt_disable_notrace();					\
 	ptr__ = raw_cpu_ptr(&(pcp));					\
 	prev__ = *ptr__;						\
 	do {								\
@@ -36,7 +36,7 @@
 		new__ = old__ op (val);					\
 		prev__ = cmpxchg(ptr__, old__, new__);			\
 	} while (prev__ != old__);					\
-	preempt_enable();						\
+	preempt_enable_notrace();					\
 	new__;								\
 })
 
@@ -67,7 +67,7 @@
 	typedef typeof(pcp) pcp_op_T__; 				\
 	pcp_op_T__ val__ = (val);					\
 	pcp_op_T__ old__, *ptr__;					\
-	preempt_disable();						\
+	preempt_disable_notrace();					\
 	ptr__ = raw_cpu_ptr(&(pcp)); 				\
 	if (__builtin_constant_p(val__) &&				\
 	    ((szcast)val__ > -129) && ((szcast)val__ < 128)) {		\
@@ -83,7 +83,7 @@
 			: [val__] "d" (val__)				\
 			: "cc");					\
 	}								\
-	preempt_enable();						\
+	preempt_enable_notrace();					\
 }
 
 #define this_cpu_add_4(pcp, val) arch_this_cpu_add(pcp, val, "laa", "asi", int)
@@ -94,14 +94,14 @@
 	typedef typeof(pcp) pcp_op_T__; 				\
 	pcp_op_T__ val__ = (val);					\
 	pcp_op_T__ old__, *ptr__;					\
-	preempt_disable();						\
+	preempt_disable_notrace();					\
 	ptr__ = raw_cpu_ptr(&(pcp));	 				\
 	asm volatile(							\
 		op "    %[old__],%[val__],%[ptr__]\n"			\
 		: [old__] "=d" (old__), [ptr__] "+Q" (*ptr__)		\
 		: [val__] "d" (val__)					\
 		: "cc");						\
-	preempt_enable();						\
+	preempt_enable_notrace();						\
 	old__ + val__;							\
 })
 
@@ -113,14 +113,14 @@
 	typedef typeof(pcp) pcp_op_T__; 				\
 	pcp_op_T__ val__ = (val);					\
 	pcp_op_T__ old__, *ptr__;					\
-	preempt_disable();						\
+	preempt_disable_notrace();					\
 	ptr__ = raw_cpu_ptr(&(pcp));	 				\
 	asm volatile(							\
 		op "    %[old__],%[val__],%[ptr__]\n"			\
 		: [old__] "=d" (old__), [ptr__] "+Q" (*ptr__)		\
 		: [val__] "d" (val__)					\
 		: "cc");						\
-	preempt_enable();						\
+	preempt_enable_notrace();					\
 }
 
 #define this_cpu_and_4(pcp, val)	arch_this_cpu_to_op(pcp, val, "lan")
@@ -135,10 +135,10 @@
 	typedef typeof(pcp) pcp_op_T__;					\
 	pcp_op_T__ ret__;						\
 	pcp_op_T__ *ptr__;						\
-	preempt_disable();						\
+	preempt_disable_notrace();					\
 	ptr__ = raw_cpu_ptr(&(pcp));					\
 	ret__ = cmpxchg(ptr__, oval, nval);				\
-	preempt_enable();						\
+	preempt_enable_notrace();					\
 	ret__;								\
 })
 
@@ -151,10 +151,10 @@
 ({									\
 	typeof(pcp) *ptr__;						\
 	typeof(pcp) ret__;						\
-	preempt_disable();						\
+	preempt_disable_notrace();					\
 	ptr__ = raw_cpu_ptr(&(pcp));					\
 	ret__ = xchg(ptr__, nval);					\
-	preempt_enable();						\
+	preempt_enable_notrace();					\
 	ret__;								\
 })
 
@@ -170,11 +170,11 @@
 	typeof(pcp1) *p1__;						\
 	typeof(pcp2) *p2__;						\
 	int ret__;							\
-	preempt_disable();						\
+	preempt_disable_notrace();					\
 	p1__ = raw_cpu_ptr(&(pcp1));					\
 	p2__ = raw_cpu_ptr(&(pcp2));					\
 	ret__ = __cmpxchg_double(p1__, p2__, o1__, o2__, n1__, n2__);	\
-	preempt_enable();						\
+	preempt_enable_notrace();					\
 	ret__;								\
 })
 

From 5de746e780f8a3e6af2eb1da75cd18cc2a13d5b2 Mon Sep 17 00:00:00 2001
From: Simon Leiner <simon@leiner.me>
Date: Tue, 25 Aug 2020 11:31:52 +0200
Subject: [PATCH 0520/2658] xen/xenbus: Fix granting of vmalloc'd memory

[ Upstream commit d742db70033c745e410523e00522ee0cfe2aa416 ]

On some architectures (like ARM), virt_to_gfn cannot be used for
vmalloc'd memory because of its reliance on virt_to_phys. This patch
introduces a check for vmalloc'd addresses and obtains the PFN using
vmalloc_to_pfn in that case.

Signed-off-by: Simon Leiner <simon@leiner.me>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Link: https://lore.kernel.org/r/20200825093153.35500-1-simon@leiner.me
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/xen/xenbus/xenbus_client.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
index df27cefb2fa3..266f446ba331 100644
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -384,8 +384,14 @@ int xenbus_grant_ring(struct xenbus_device *dev, void *vaddr,
 	int i, j;
 
 	for (i = 0; i < nr_pages; i++) {
-		err = gnttab_grant_foreign_access(dev->otherend_id,
-						  virt_to_gfn(vaddr), 0);
+		unsigned long gfn;
+
+		if (is_vmalloc_addr(vaddr))
+			gfn = pfn_to_gfn(vmalloc_to_pfn(vaddr));
+		else
+			gfn = virt_to_gfn(vaddr);
+
+		err = gnttab_grant_foreign_access(dev->otherend_id, gfn, 0);
 		if (err < 0) {
 			xenbus_dev_fatal(dev, err,
 					 "granting access to ring page");

From 6e5337bed9d251f567d2a615eff4801b80bb7402 Mon Sep 17 00:00:00 2001
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
Date: Thu, 6 Aug 2020 13:49:28 +0300
Subject: [PATCH 0521/2658] dmaengine: of-dma: Fix of_dma_router_xlate's
 of_dma_xlate handling

[ Upstream commit 5b2aa9f918f6837ae943557f8cec02c34fcf80e7 ]

of_dma_xlate callback can return ERR_PTR as well NULL in case of failure.

If error code is returned (not NULL) then the route should be released and
the router should not be registered for the channel.

Fixes: 56f13c0d9524c ("dmaengine: of_dma: Support for DMA routers")
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Link: https://lore.kernel.org/r/20200806104928.25975-1-peter.ujfalusi@ti.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/of-dma.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/dma/of-dma.c b/drivers/dma/of-dma.c
index 1e1f2986eba8..86c591481dfe 100644
--- a/drivers/dma/of-dma.c
+++ b/drivers/dma/of-dma.c
@@ -72,12 +72,12 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec,
 		return NULL;
 
 	chan = ofdma_target->of_dma_xlate(&dma_spec_target, ofdma_target);
-	if (chan) {
-		chan->router = ofdma->dma_router;
-		chan->route_data = route_data;
-	} else {
+	if (IS_ERR_OR_NULL(chan)) {
 		ofdma->dma_router->route_free(ofdma->dma_router->dev,
 					      route_data);
+	} else {
+		chan->router = ofdma->dma_router;
+		chan->route_data = route_data;
 	}
 
 	/*

From 413dd5a51a66f8d709c58b440ab1d1eb02d28d80 Mon Sep 17 00:00:00 2001
From: Sven Eckelmann <sven@narfation.org>
Date: Wed, 22 Jul 2020 20:36:43 +0200
Subject: [PATCH 0522/2658] batman-adv: Avoid uninitialized chaddr when
 handling DHCP

[ Upstream commit 303216e76dcab6049c9d42390b1032f0649a8206 ]

The gateway client code can try to optimize the delivery of DHCP packets to
avoid broadcasting them through the whole mesh. But also transmissions to
the client can be optimized by looking up the destination via the chaddr of
the DHCP packet.

But the chaddr is currently only done when chaddr is fully inside the
non-paged area of the skbuff. Otherwise it will not be initialized and the
unoptimized path should have been taken.

But the implementation didn't handle this correctly. It didn't retrieve the
correct chaddr but still tried to perform the TT lookup with this
uninitialized memory.

Reported-by: syzbot+ab16e463b903f5a37036@syzkaller.appspotmail.com
Fixes: 6c413b1c22a2 ("batman-adv: send every DHCP packet as bat-unicast")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Acked-by: Antonio Quartulli <a@unstable.cc>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/batman-adv/gateway_client.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index a88b529b7ca0..5fdb88f72b68 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -757,8 +757,10 @@ batadv_gw_dhcp_recipient_get(struct sk_buff *skb, unsigned int *header_len,
 
 	chaddr_offset = *header_len + BATADV_DHCP_CHADDR_OFFSET;
 	/* store the client address if the message is going to a client */
-	if (ret == BATADV_DHCP_TO_CLIENT &&
-	    pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) {
+	if (ret == BATADV_DHCP_TO_CLIENT) {
+		if (!pskb_may_pull(skb, chaddr_offset + ETH_ALEN))
+			return BATADV_DHCP_NO;
+
 		/* check if the DHCP packet carries an Ethernet DHCP */
 		p = skb->data + *header_len + BATADV_DHCP_HTYPE_OFFSET;
 		if (*p != BATADV_DHCP_HTYPE_ETHERNET)

From ddaf79b9f2575fd103d5abe9241c9759866e6487 Mon Sep 17 00:00:00 2001
From: Jussi Kivilinna <jussi.kivilinna@haltian.com>
Date: Tue, 18 Aug 2020 17:46:10 +0300
Subject: [PATCH 0523/2658] batman-adv: bla: use netif_rx_ni when not in
 interrupt context

[ Upstream commit 279e89b2281af3b1a9f04906e157992c19c9f163 ]

batadv_bla_send_claim() gets called from worker thread context through
batadv_bla_periodic_work(), thus netif_rx_ni needs to be used in that
case. This fixes "NOHZ: local_softirq_pending 08" log messages seen
when batman-adv is enabled.

Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code")
Signed-off-by: Jussi Kivilinna <jussi.kivilinna@haltian.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/batman-adv/bridge_loop_avoidance.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index cea7fdeac5aa..9aa5daa55127 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -380,7 +380,10 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, u8 *mac,
 			   skb->len + ETH_HLEN);
 	soft_iface->last_rx = jiffies;
 
-	netif_rx(skb);
+	if (in_interrupt())
+		netif_rx(skb);
+	else
+		netif_rx_ni(skb);
 out:
 	if (primary_if)
 		batadv_hardif_free_ref(primary_if);

From be23260712f0d12dc443b7e9cc4b92485a989b83 Mon Sep 17 00:00:00 2001
From: Yu Kuai <yukuai3@huawei.com>
Date: Mon, 17 Aug 2020 19:57:26 +0800
Subject: [PATCH 0524/2658] dmaengine: at_hdmac: check return value of
 of_find_device_by_node() in at_dma_xlate()

[ Upstream commit 0cef8e2c5a07d482ec907249dbd6687e8697677f ]

The reurn value of of_find_device_by_node() is not checked, thus null
pointer dereference will be triggered if of_find_device_by_node()
failed.

Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20200817115728.1706719-2-yukuai3@huawei.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/at_hdmac.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 941ace052130..5276074d0e36 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -1817,6 +1817,8 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec,
 		return NULL;
 
 	dmac_pdev = of_find_device_by_node(dma_spec->np);
+	if (!dmac_pdev)
+		return NULL;
 
 	dma_cap_zero(mask);
 	dma_cap_set(DMA_SLAVE, mask);

From 2cc15c015066e24192f7f9318bae7543b289586a Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 20 Aug 2020 14:12:55 +0200
Subject: [PATCH 0525/2658] netfilter: nf_tables: incorrect enum
 nft_list_attributes definition

[ Upstream commit da9125df854ea48a6240c66e8a67be06e2c12c03 ]

This should be NFTA_LIST_UNSPEC instead of NFTA_LIST_UNPEC, all other
similar attribute definitions are postfixed with _UNSPEC.

Fixes: 96518518cc41 ("netfilter: add nftables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/uapi/linux/netfilter/nf_tables.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index d8c8a7c9d88a..b0a1c33d4a15 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -111,7 +111,7 @@ enum nf_tables_msg_types {
  * @NFTA_LIST_ELEM: list element (NLA_NESTED)
  */
 enum nft_list_attributes {
-	NFTA_LIST_UNPEC,
+	NFTA_LIST_UNSPEC,
 	NFTA_LIST_ELEM,
 	__NFTA_LIST_MAX
 };

From 12bc1e8e42939711544c31108b334de0b535a4e5 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Thu, 20 Aug 2020 21:05:50 +0200
Subject: [PATCH 0526/2658] netfilter: nf_tables: fix destination register
 zeroing

[ Upstream commit 1e105e6afa6c3d32bfb52c00ffa393894a525c27 ]

Following bug was reported via irc:
nft list ruleset
   set knock_candidates_ipv4 {
      type ipv4_addr . inet_service
      size 65535
      elements = { 127.0.0.1 . 123,
                   127.0.0.1 . 123 }
      }
 ..
   udp dport 123 add @knock_candidates_ipv4 { ip saddr . 123 }
   udp dport 123 add @knock_candidates_ipv4 { ip saddr . udp dport }

It should not have been possible to add a duplicate set entry.

After some debugging it turned out that the problem is the immediate
value (123) in the second-to-last rule.

Concatenations use 32bit registers, i.e. the elements are 8 bytes each,
not 6 and it turns out the kernel inserted

inet firewall @knock_candidates_ipv4
        element 0100007f ffff7b00  : 0 [end]
        element 0100007f 00007b00  : 0 [end]

Note the non-zero upper bits of the first element.  It turns out that
nft_immediate doesn't zero the destination register, but this is needed
when the length isn't a multiple of 4.

Furthermore, the zeroing in nft_payload is broken.  We can't use
[len / 4] = 0 -- if len is a multiple of 4, index is off by one.

Skip zeroing in this case and use a conditional instead of (len -1) / 4.

Fixes: 49499c3e6e18 ("netfilter: nf_tables: switch registers to 32 bit addressing")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/netfilter/nf_tables.h | 2 ++
 net/netfilter/nft_payload.c       | 4 +++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index b96df7499600..bee9031a4006 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -74,6 +74,8 @@ struct nft_regs {
 static inline void nft_data_copy(u32 *dst, const struct nft_data *src,
 				 unsigned int len)
 {
+	if (len % NFT_REG32_SIZE)
+		dst[len / NFT_REG32_SIZE] = 0;
 	memcpy(dst, src, len);
 }
 
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 09b4b07eb676..ab3e7b14de09 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -74,7 +74,9 @@ static void nft_payload_eval(const struct nft_expr *expr,
 	u32 *dest = &regs->data[priv->dreg];
 	int offset;
 
-	dest[priv->len / NFT_REG32_SIZE] = 0;
+	if (priv->len % NFT_REG32_SIZE)
+		dest[priv->len / NFT_REG32_SIZE] = 0;
+
 	switch (priv->base) {
 	case NFT_PAYLOAD_LL_HEADER:
 		if (!skb_mac_header_was_set(skb))

From 020cae61f8ce0906fc740c0890c8b0f20a782c7d Mon Sep 17 00:00:00 2001
From: Marek Szyprowski <m.szyprowski@samsung.com>
Date: Tue, 25 Aug 2020 08:46:17 +0200
Subject: [PATCH 0527/2658] dmaengine: pl330: Fix burst length if burst size is
 smaller than bus width

[ Upstream commit 0661cef675d37e2c4b66a996389ebeae8568e49e ]

Move the burst len fixup after setting the generic value for it. This
finally enables the fixup introduced by commit 137bd11090d8 ("dmaengine:
pl330: Align DMA memcpy operations to MFIFO width"), which otherwise was
overwritten by the generic value.

Reported-by: kernel test robot <lkp@intel.com>
Fixes: 137bd11090d8 ("dmaengine: pl330: Align DMA memcpy operations to MFIFO width")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20200825064617.16193-1-m.szyprowski@samsung.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/pl330.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 799c182c3eac..9aa57b37381a 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2629,6 +2629,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
 	while (burst != (1 << desc->rqcfg.brst_size))
 		desc->rqcfg.brst_size++;
 
+	desc->rqcfg.brst_len = get_burst_len(desc, len);
 	/*
 	 * If burst size is smaller than bus width then make sure we only
 	 * transfer one at a time to avoid a burst stradling an MFIFO entry.
@@ -2636,7 +2637,6 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
 	if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width)
 		desc->rqcfg.brst_len = 1;
 
-	desc->rqcfg.brst_len = get_burst_len(desc, len);
 	desc->bytes_requested = len;
 
 	desc->txd.flags = flags;

From 946683eb603902b01173228ee0158a0980203a05 Mon Sep 17 00:00:00 2001
From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
Date: Wed, 26 Aug 2020 01:08:33 -0400
Subject: [PATCH 0528/2658] bnxt_en: Check for zero dir entries in NVRAM.

[ Upstream commit dbbfa96ad920c50d58bcaefa57f5f33ceef9d00e ]

If firmware goes into unstable state, HWRM_NVM_GET_DIR_INFO firmware
command may return zero dir entries. Return error in such case to
avoid zero length dma buffer request.

Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
index 45bd628eaf3a..416fb16686a6 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -991,6 +991,9 @@ static int bnxt_get_nvram_directory(struct net_device *dev, u32 len, u8 *data)
 	if (rc != 0)
 		return rc;
 
+	if (!dir_entries || !entry_length)
+		return -EIO;
+
 	/* Insert 2 bytes of directory info (count and size of entries) */
 	if (len < 2)
 		return -EINVAL;

From d6515430882f227244ceffbbff03f7254b0feaa8 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Wed, 2 Sep 2020 11:30:48 -0400
Subject: [PATCH 0529/2658] fix regression in "epoll: Keep a reference on files
 added to the check list"

[ Upstream commit 77f4689de17c0887775bb77896f4cc11a39bf848 ]

epoll_loop_check_proc() can run into a file already committed to destruction;
we can't grab a reference on those and don't need to add them to the set for
reverse path check anyway.

Tested-by: Marc Zyngier <maz@kernel.org>
Fixes: a9ed4a6560b8 ("epoll: Keep a reference on files added to the check list")
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/eventpoll.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index ae7767db3a95..4013e98621c4 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1724,9 +1724,9 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
 			 * during ep_insert().
 			 */
 			if (list_empty(&epi->ffd.file->f_tfile_llink)) {
-				get_file(epi->ffd.file);
-				list_add(&epi->ffd.file->f_tfile_llink,
-					 &tfile_check_list);
+				if (get_file_rcu(epi->ffd.file))
+					list_add(&epi->ffd.file->f_tfile_llink,
+						 &tfile_check_list);
 			}
 		}
 	}

From c5864950c034f1fbba4d65f3262977d96eb50ecd Mon Sep 17 00:00:00 2001
From: Michael Chan <michael.chan@broadcom.com>
Date: Thu, 3 Sep 2020 14:28:54 -0400
Subject: [PATCH 0530/2658] tg3: Fix soft lockup when tg3_reset_task() fails.

[ Upstream commit 556699341efa98243e08e34401b3f601da91f5a3 ]

If tg3_reset_task() fails, the device state is left in an inconsistent
state with IFF_RUNNING still set but NAPI state not enabled.  A
subsequent operation, such as ifdown or AER error can cause it to
soft lock up when it tries to disable NAPI state.

Fix it by bringing down the device to !IFF_RUNNING state when
tg3_reset_task() fails.  tg3_reset_task() running from workqueue
will now call tg3_close() when the reset fails.  We need to
modify tg3_reset_task_cancel() slightly to avoid tg3_close()
calling cancel_work_sync() to cancel tg3_reset_task().  Otherwise
cancel_work_sync() will wait forever for tg3_reset_task() to
finish.

Reported-by: David Christensen <drc@linux.vnet.ibm.com>
Reported-by: Baptiste Covolato <baptiste@arista.com>
Fixes: db2199737990 ("tg3: Schedule at most one tg3_reset_task run")
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/tg3.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index e198427d0f29..2ee2b6e85828 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -7203,8 +7203,8 @@ static inline void tg3_reset_task_schedule(struct tg3 *tp)
 
 static inline void tg3_reset_task_cancel(struct tg3 *tp)
 {
-	cancel_work_sync(&tp->reset_task);
-	tg3_flag_clear(tp, RESET_TASK_PENDING);
+	if (test_and_clear_bit(TG3_FLAG_RESET_TASK_PENDING, tp->tg3_flags))
+		cancel_work_sync(&tp->reset_task);
 	tg3_flag_clear(tp, TX_RECOVERY_PENDING);
 }
 
@@ -11176,18 +11176,27 @@ static void tg3_reset_task(struct work_struct *work)
 
 	tg3_halt(tp, RESET_KIND_SHUTDOWN, 0);
 	err = tg3_init_hw(tp, true);
-	if (err)
+	if (err) {
+		tg3_full_unlock(tp);
+		tp->irq_sync = 0;
+		tg3_napi_enable(tp);
+		/* Clear this flag so that tg3_reset_task_cancel() will not
+		 * call cancel_work_sync() and wait forever.
+		 */
+		tg3_flag_clear(tp, RESET_TASK_PENDING);
+		dev_close(tp->dev);
 		goto out;
+	}
 
 	tg3_netif_start(tp);
 
-out:
 	tg3_full_unlock(tp);
 
 	if (!err)
 		tg3_phy_start(tp);
 
 	tg3_flag_clear(tp, RESET_TASK_PENDING);
+out:
 	rtnl_unlock();
 }
 

From f5a05c043c44ca2f9f8f4daa514970a76aac1d73 Mon Sep 17 00:00:00 2001
From: Lu Baolu <baolu.lu@linux.intel.com>
Date: Fri, 28 Aug 2020 08:06:15 +0800
Subject: [PATCH 0531/2658] iommu/vt-d: Serialize IOMMU GCMD register
 modifications

[ Upstream commit 6e4e9ec65078093165463c13d4eb92b3e8d7b2e8 ]

The VT-d spec requires (10.4.4 Global Command Register, GCMD_REG General
Description) that:

If multiple control fields in this register need to be modified, software
must serialize the modifications through multiple writes to this register.

However, in irq_remapping.c, modifications of IRE and CFI are done in one
write. We need to do two separate writes with STS checking after each. It
also checks the status register before writing command register to avoid
unnecessary register write.

Fixes: af8d102f999a4 ("x86/intel/irq_remapping: Clean up x2apic opt-out security warning mess")
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
Cc: Kevin Tian <kevin.tian@intel.com>
Cc: Ashok Raj <ashok.raj@intel.com>
Link: https://lore.kernel.org/r/20200828000615.8281-1-baolu.lu@linux.intel.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/intel_irq_remapping.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
index ac596928f6b4..ce125ec23d2a 100644
--- a/drivers/iommu/intel_irq_remapping.c
+++ b/drivers/iommu/intel_irq_remapping.c
@@ -486,12 +486,18 @@ static void iommu_enable_irq_remapping(struct intel_iommu *iommu)
 
 	/* Enable interrupt-remapping */
 	iommu->gcmd |= DMA_GCMD_IRE;
-	iommu->gcmd &= ~DMA_GCMD_CFI;  /* Block compatibility-format MSIs */
 	writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG);
-
 	IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG,
 		      readl, (sts & DMA_GSTS_IRES), sts);
 
+	/* Block compatibility-format MSIs */
+	if (sts & DMA_GSTS_CFIS) {
+		iommu->gcmd &= ~DMA_GCMD_CFI;
+		writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG);
+		IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG,
+			      readl, !(sts & DMA_GSTS_CFIS), sts);
+	}
+
 	/*
 	 * With CFI clear in the Global Command register, we should be
 	 * protected from dangerous (i.e. compatibility) interrupts

From 5b5c10a1e89f2f40ad5ed52a0fbd6e9bca52e586 Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Mon, 6 Jul 2020 11:33:38 -0700
Subject: [PATCH 0532/2658] thermal: ti-soc-thermal: Fix bogus thermal
 shutdowns for omap4430

[ Upstream commit 30d24faba0532d6972df79a1bf060601994b5873 ]

We can sometimes get bogus thermal shutdowns on omap4430 at least with
droid4 running idle with a battery charger connected:

thermal thermal_zone0: critical temperature reached (143 C), shutting down

Dumping out the register values shows we can occasionally get a 0x7f value
that is outside the TRM listed values in the ADC conversion table. And then
we get a normal value when reading again after that. Reading the register
multiple times does not seem help avoiding the bogus values as they stay
until the next sample is ready.

Looking at the TRM chapter "18.4.10.2.3 ADC Codes Versus Temperature", we
should have values from 13 to 107 listed with a total of 95 values. But
looking at the omap4430_adc_to_temp array, the values are off, and the
end values are missing. And it seems that the 4430 ADC table is similar
to omap3630 rather than omap4460.

Let's fix the issue by using values based on the omap3630 table and just
ignoring invalid values. Compared to the 4430 TRM, the omap3630 table has
the missing values added while the TRM table only shows every second
value.

Note that sometimes the ADC register values within the valid table can
also be way off for about 1 out of 10 values. But it seems that those
just show about 25 C too low values rather than too high values. So those
do not cause a bogus thermal shutdown.

Fixes: 1a31270e54d7 ("staging: omap-thermal: add OMAP4 data structures")
Cc: Merlijn Wajer <merlijn@wizzup.org>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20200706183338.25622-1-tony@atomide.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../ti-soc-thermal/omap4-thermal-data.c       | 23 ++++++++++---------
 .../thermal/ti-soc-thermal/omap4xxx-bandgap.h | 10 +++++---
 2 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c
index d255d33da9eb..02e71d461d5c 100644
--- a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c
+++ b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c
@@ -49,20 +49,21 @@ static struct temp_sensor_data omap4430_mpu_temp_sensor_data = {
 
 /*
  * Temperature values in milli degree celsius
- * ADC code values from 530 to 923
+ * ADC code values from 13 to 107, see TRM
+ * "18.4.10.2.3 ADC Codes Versus Temperature".
  */
 static const int
 omap4430_adc_to_temp[OMAP4430_ADC_END_VALUE - OMAP4430_ADC_START_VALUE + 1] = {
-	-38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000, -22000,
-	-20000, -18000, -17000, -15000, -13000, -12000, -10000, -8000, -6000,
-	-5000, -3000, -1000, 0, 2000, 3000, 5000, 6000, 8000, 10000, 12000,
-	13000, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28000, 30000,
-	32000, 33000, 35000, 37000, 38000, 40000, 42000, 43000, 45000, 47000,
-	48000, 50000, 52000, 53000, 55000, 57000, 58000, 60000, 62000, 64000,
-	66000, 68000, 70000, 71000, 73000, 75000, 77000, 78000, 80000, 82000,
-	83000, 85000, 87000, 88000, 90000, 92000, 93000, 95000, 97000, 98000,
-	100000, 102000, 103000, 105000, 107000, 109000, 111000, 113000, 115000,
-	117000, 118000, 120000, 122000, 123000,
+	-40000, -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000,
+	-22000,	-20000, -18500, -17000, -15000, -13500, -12000, -10000, -8000,
+	-6500, -5000, -3500, -1500, 0, 2000, 3500, 5000, 6500, 8500, 10000,
+	12000, 13500, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28500,
+	30000, 32000, 33500, 35000, 37000, 38500, 40000, 42000, 43500, 45000,
+	47000, 48500, 50000, 52000, 53500, 55000, 57000, 58500, 60000, 62000,
+	64000, 66000, 68000, 70000, 71500, 73500, 75000, 77000, 78500, 80000,
+	82000, 83500, 85000, 87000, 88500, 90000, 92000, 93500, 95000, 97000,
+	98500, 100000, 102000, 103500, 105000, 107000, 109000, 111000, 113000,
+	115000, 117000, 118500, 120000, 122000, 123500, 125000,
 };
 
 /* OMAP4430 data */
diff --git a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h
index 6f2de3a3356d..86850082b24b 100644
--- a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h
+++ b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h
@@ -67,9 +67,13 @@
  * and thresholds for OMAP4430.
  */
 
-/* ADC conversion table limits */
-#define OMAP4430_ADC_START_VALUE			0
-#define OMAP4430_ADC_END_VALUE				127
+/*
+ * ADC conversion table limits. Ignore values outside the TRM listed
+ * range to avoid bogus thermal shutdowns. See omap4430 TRM chapter
+ * "18.4.10.2.3 ADC Codes Versus Temperature".
+ */
+#define OMAP4430_ADC_START_VALUE			13
+#define OMAP4430_ADC_END_VALUE				107
 /* bandgap clock limits (no control on 4430) */
 #define OMAP4430_MAX_FREQ				32768
 #define OMAP4430_MIN_FREQ				32768

From c126664f1e84656447870a61e55167f84c03626c Mon Sep 17 00:00:00 2001
From: Jason Gunthorpe <jgg@nvidia.com>
Date: Fri, 4 Sep 2020 16:36:19 -0700
Subject: [PATCH 0533/2658] include/linux/log2.h: add missing () around n in
 roundup_pow_of_two()

[ Upstream commit 428fc0aff4e59399ec719ffcc1f7a5d29a4ee476 ]

Otherwise gcc generates warnings if the expression is complicated.

Fixes: 312a0c170945 ("[PATCH] LOG2: Alter roundup_pow_of_two() so that it can use a ilog2() on a constant")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Link: https://lkml.kernel.org/r/0-v1-8a2697e3c003+41165-log_brackets_jgg@nvidia.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/log2.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/log2.h b/include/linux/log2.h
index c373295f359f..cca606609e1b 100644
--- a/include/linux/log2.h
+++ b/include/linux/log2.h
@@ -159,7 +159,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n)
 #define roundup_pow_of_two(n)			\
 (						\
 	__builtin_constant_p(n) ? (		\
-		(n == 1) ? 1 :			\
+		((n) == 1) ? 1 :		\
 		(1UL << (ilog2((n) - 1) + 1))	\
 				   ) :		\
 	__roundup_pow_of_two(n)			\

From 55e940879f0673c09864ba2dc76b8eeb0cbbd9ac Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Mon, 10 Aug 2020 11:42:26 -0400
Subject: [PATCH 0534/2658] btrfs: drop path before adding new uuid tree entry

commit 9771a5cf937129307d9f58922d60484d58ababe7 upstream.

With the conversion of the tree locks to rwsem I got the following
lockdep splat:

  ======================================================
  WARNING: possible circular locking dependency detected
  5.8.0-rc7-00167-g0d7ba0c5b375-dirty #925 Not tainted
  ------------------------------------------------------
  btrfs-uuid/7955 is trying to acquire lock:
  ffff88bfbafec0f8 (btrfs-root-00){++++}-{3:3}, at: __btrfs_tree_read_lock+0x39/0x180

  but task is already holding lock:
  ffff88bfbafef2a8 (btrfs-uuid-00){++++}-{3:3}, at: __btrfs_tree_read_lock+0x39/0x180

  which lock already depends on the new lock.

  the existing dependency chain (in reverse order) is:

  -> #1 (btrfs-uuid-00){++++}-{3:3}:
	 down_read_nested+0x3e/0x140
	 __btrfs_tree_read_lock+0x39/0x180
	 __btrfs_read_lock_root_node+0x3a/0x50
	 btrfs_search_slot+0x4bd/0x990
	 btrfs_uuid_tree_add+0x89/0x2d0
	 btrfs_uuid_scan_kthread+0x330/0x390
	 kthread+0x133/0x150
	 ret_from_fork+0x1f/0x30

  -> #0 (btrfs-root-00){++++}-{3:3}:
	 __lock_acquire+0x1272/0x2310
	 lock_acquire+0x9e/0x360
	 down_read_nested+0x3e/0x140
	 __btrfs_tree_read_lock+0x39/0x180
	 __btrfs_read_lock_root_node+0x3a/0x50
	 btrfs_search_slot+0x4bd/0x990
	 btrfs_find_root+0x45/0x1b0
	 btrfs_read_tree_root+0x61/0x100
	 btrfs_get_root_ref.part.50+0x143/0x630
	 btrfs_uuid_tree_iterate+0x207/0x314
	 btrfs_uuid_rescan_kthread+0x12/0x50
	 kthread+0x133/0x150
	 ret_from_fork+0x1f/0x30

  other info that might help us debug this:

   Possible unsafe locking scenario:

	 CPU0                    CPU1
	 ----                    ----
    lock(btrfs-uuid-00);
				 lock(btrfs-root-00);
				 lock(btrfs-uuid-00);
    lock(btrfs-root-00);

   *** DEADLOCK ***

  1 lock held by btrfs-uuid/7955:
   #0: ffff88bfbafef2a8 (btrfs-uuid-00){++++}-{3:3}, at: __btrfs_tree_read_lock+0x39/0x180

  stack backtrace:
  CPU: 73 PID: 7955 Comm: btrfs-uuid Kdump: loaded Not tainted 5.8.0-rc7-00167-g0d7ba0c5b375-dirty #925
  Hardware name: Quanta Tioga Pass Single Side 01-0030993006/Tioga Pass Single Side, BIOS F08_3A18 12/20/2018
  Call Trace:
   dump_stack+0x78/0xa0
   check_noncircular+0x165/0x180
   __lock_acquire+0x1272/0x2310
   lock_acquire+0x9e/0x360
   ? __btrfs_tree_read_lock+0x39/0x180
   ? btrfs_root_node+0x1c/0x1d0
   down_read_nested+0x3e/0x140
   ? __btrfs_tree_read_lock+0x39/0x180
   __btrfs_tree_read_lock+0x39/0x180
   __btrfs_read_lock_root_node+0x3a/0x50
   btrfs_search_slot+0x4bd/0x990
   btrfs_find_root+0x45/0x1b0
   btrfs_read_tree_root+0x61/0x100
   btrfs_get_root_ref.part.50+0x143/0x630
   btrfs_uuid_tree_iterate+0x207/0x314
   ? btree_readpage+0x20/0x20
   btrfs_uuid_rescan_kthread+0x12/0x50
   kthread+0x133/0x150
   ? kthread_create_on_node+0x60/0x60
   ret_from_fork+0x1f/0x30

This problem exists because we have two different rescan threads,
btrfs_uuid_scan_kthread which creates the uuid tree, and
btrfs_uuid_tree_iterate that goes through and updates or deletes any out
of date roots.  The problem is they both do things in different order.
btrfs_uuid_scan_kthread() reads the tree_root, and then inserts entries
into the uuid_root.  btrfs_uuid_tree_iterate() scans the uuid_root, but
then does a btrfs_get_fs_root() which can read from the tree_root.

It's actually easy enough to not be holding the path in
btrfs_uuid_scan_kthread() when we add a uuid entry, as we already drop
it further down and re-start the search when we loop.  So simply move
the path release before we add our entry to the uuid tree.

This also fixes a problem where we're holding a path open after we do
btrfs_end_transaction(), which has it's own problems.

CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/volumes.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index dcae0cf4924b..2d10b818399b 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -4065,6 +4065,7 @@ static int btrfs_uuid_scan_kthread(void *data)
 			goto skip;
 		}
 update_tree:
+		btrfs_release_path(path);
 		if (!btrfs_is_empty_uuid(root_item.uuid)) {
 			ret = btrfs_uuid_tree_add(trans, fs_info->uuid_root,
 						  root_item.uuid,
@@ -4090,6 +4091,7 @@ static int btrfs_uuid_scan_kthread(void *data)
 		}
 
 skip:
+		btrfs_release_path(path);
 		if (trans) {
 			ret = btrfs_end_transaction(trans, fs_info->uuid_root);
 			trans = NULL;
@@ -4097,7 +4099,6 @@ static int btrfs_uuid_scan_kthread(void *data)
 				break;
 		}
 
-		btrfs_release_path(path);
 		if (key.offset < (u64)-1) {
 			key.offset++;
 		} else if (key.type < BTRFS_ROOT_ITEM_KEY) {

From 04650379190e8694b4f064885757b43963a08b28 Mon Sep 17 00:00:00 2001
From: Nikolay Borisov <nborisov@suse.com>
Date: Wed, 15 Aug 2018 18:26:53 +0300
Subject: [PATCH 0535/2658] btrfs: Remove redundant extent_buffer_get in
 get_old_root

[ Upstream commit 6c122e2a0c515cfb3f3a9cefb5dad4cb62109c78 ]

get_old_root used used only by btrfs_search_old_slot to initialise the
path structure. The old root is always a cloned buffer (either via alloc
dummy or via btrfs_clone_extent_buffer) and its reference count is 2: 1
from allocation, 1 from extent_buffer_get call in get_old_root.

This latter explicit ref count acquire operation is in fact unnecessary
since the semantic is such that the newly allocated buffer is handed
over to the btrfs_path for lifetime management. Considering this just
remove the extra extent_buffer_get in get_old_root.

Signed-off-by: Nikolay Borisov <nborisov@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/ctree.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 8eac5f75bca3..8765312743f1 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -1441,7 +1441,6 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
 
 	if (!eb)
 		return NULL;
-	extent_buffer_get(eb);
 	btrfs_tree_read_lock(eb);
 	if (old_root) {
 		btrfs_set_header_bytenr(eb, eb->start);

From b1bff990461c181845e7097493ad31893f4390bf Mon Sep 17 00:00:00 2001
From: Nikolay Borisov <nborisov@suse.com>
Date: Wed, 15 Aug 2018 18:26:54 +0300
Subject: [PATCH 0536/2658] btrfs: Remove extraneous extent_buffer_get from
 tree_mod_log_rewind

[ Upstream commit 24cee18a1c1d7c731ea5987e0c99daea22ae7f4a ]

When a rewound buffer is created it already has a ref count of 1 and the
dummy flag set. Then another ref is taken bumping the count to 2.
Finally when this buffer is released from btrfs_release_path the extra
reference is decremented by the special handling code in
free_extent_buffer.

However, this special code is in fact redundant sinca ref count of 1 is
still correct since the buffer is only accessed via btrfs_path struct.
This paves the way forward of removing the special handling in
free_extent_buffer.

Signed-off-by: Nikolay Borisov <nborisov@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/ctree.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 8765312743f1..a8660b503bf3 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -1372,7 +1372,6 @@ tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct btrfs_path *path,
 	btrfs_tree_read_unlock_blocking(eb);
 	free_extent_buffer(eb);
 
-	extent_buffer_get(eb_rewin);
 	btrfs_tree_read_lock(eb_rewin);
 	__tree_mod_log_rewind(fs_info, eb_rewin, time_seq, tm);
 	WARN_ON(btrfs_header_nritems(eb_rewin) >

From 46445c0c74bc42a312f8928e94950e187223f868 Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Mon, 10 Aug 2020 11:42:31 -0400
Subject: [PATCH 0537/2658] btrfs: set the lockdep class for log tree extent
 buffers

[ Upstream commit d3beaa253fd6fa40b8b18a216398e6e5376a9d21 ]

These are special extent buffers that get rewound in order to lookup
the state of the tree at a specific point in time.  As such they do not
go through the normal initialization paths that set their lockdep class,
so handle them appropriately when they are created and before they are
locked.

CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/ctree.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index a8660b503bf3..3fa0515d7685 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -1372,6 +1372,8 @@ tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct btrfs_path *path,
 	btrfs_tree_read_unlock_blocking(eb);
 	free_extent_buffer(eb);
 
+	btrfs_set_buffer_lockdep_class(btrfs_header_owner(eb_rewin),
+				       eb_rewin, btrfs_header_level(eb_rewin));
 	btrfs_tree_read_lock(eb_rewin);
 	__tree_mod_log_rewind(fs_info, eb_rewin, time_seq, tm);
 	WARN_ON(btrfs_header_nritems(eb_rewin) >
@@ -1440,7 +1442,6 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
 
 	if (!eb)
 		return NULL;
-	btrfs_tree_read_lock(eb);
 	if (old_root) {
 		btrfs_set_header_bytenr(eb, eb->start);
 		btrfs_set_header_backref_rev(eb, BTRFS_MIXED_BACKREF_REV);
@@ -1448,6 +1449,9 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
 		btrfs_set_header_level(eb, old_root->level);
 		btrfs_set_header_generation(eb, old_generation);
 	}
+	btrfs_set_buffer_lockdep_class(btrfs_header_owner(eb), eb,
+				       btrfs_header_level(eb));
+	btrfs_tree_read_lock(eb);
 	if (tm)
 		__tree_mod_log_rewind(root->fs_info, eb, time_seq, tm);
 	else

From 2101658f27dd88f9fc51cd7363603c80641cf25d Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: Wed, 15 May 2019 14:38:18 +0900
Subject: [PATCH 0538/2658] uaccess: Add non-pagefault user-space read
 functions

[ Upstream commit 3d7081822f7f9eab867d9bcc8fd635208ec438e0 ]

Add probe_user_read(), strncpy_from_unsafe_user() and
strnlen_unsafe_user() which allows caller to access user-space
in IRQ context.

Current probe_kernel_read() and strncpy_from_unsafe() are
not available for user-space memory, because it sets
KERNEL_DS while accessing data. On some arch, user address
space and kernel address space can be co-exist, but others
can not. In that case, setting KERNEL_DS means given
address is treated as a kernel address space.
Also strnlen_user() is only available from user context since
it can sleep if pagefault is enabled.

To access user-space memory without pagefault, we need
these new functions which sets USER_DS while accessing
the data.

Link: http://lkml.kernel.org/r/155789869802.26965.4940338412595759063.stgit@devnote2

Acked-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/uaccess.h |  14 +++++
 mm/maccess.c            | 122 ++++++++++++++++++++++++++++++++++++++--
 2 files changed, 130 insertions(+), 6 deletions(-)

diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
index 9442423979c1..6d27d58ca4e0 100644
--- a/include/linux/uaccess.h
+++ b/include/linux/uaccess.h
@@ -90,6 +90,17 @@ static inline unsigned long __copy_from_user_nocache(void *to,
 extern long probe_kernel_read(void *dst, const void *src, size_t size);
 extern long __probe_kernel_read(void *dst, const void *src, size_t size);
 
+/*
+ * probe_user_read(): safely attempt to read from a location in user space
+ * @dst: pointer to the buffer that shall take the data
+ * @src: address to read from
+ * @size: size of the data chunk
+ *
+ * Safely read from address @src to the buffer at @dst.  If a kernel fault
+ * happens, handle that and return -EFAULT.
+ */
+extern long probe_user_read(void *dst, const void __user *src, size_t size);
+
 /*
  * probe_kernel_write(): safely attempt to write to a location
  * @dst: address to write to
@@ -103,6 +114,9 @@ extern long notrace probe_kernel_write(void *dst, const void *src, size_t size);
 extern long notrace __probe_kernel_write(void *dst, const void *src, size_t size);
 
 extern long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count);
+extern long strncpy_from_unsafe_user(char *dst, const void __user *unsafe_addr,
+				     long count);
+extern long strnlen_unsafe_user(const void __user *unsafe_addr, long count);
 
 /**
  * probe_kernel_address(): safely attempt to read from a location
diff --git a/mm/maccess.c b/mm/maccess.c
index 78f9274dd49d..5ebf9a3ca367 100644
--- a/mm/maccess.c
+++ b/mm/maccess.c
@@ -5,8 +5,20 @@
 #include <linux/mm.h>
 #include <linux/uaccess.h>
 
+static __always_inline long
+probe_read_common(void *dst, const void __user *src, size_t size)
+{
+	long ret;
+
+	pagefault_disable();
+	ret = __copy_from_user_inatomic(dst, src, size);
+	pagefault_enable();
+
+	return ret ? -EFAULT : 0;
+}
+
 /**
- * probe_kernel_read(): safely attempt to read from a location
+ * probe_kernel_read(): safely attempt to read from a kernel-space location
  * @dst: pointer to the buffer that shall take the data
  * @src: address to read from
  * @size: size of the data chunk
@@ -29,16 +41,40 @@ long __probe_kernel_read(void *dst, const void *src, size_t size)
 	mm_segment_t old_fs = get_fs();
 
 	set_fs(KERNEL_DS);
-	pagefault_disable();
-	ret = __copy_from_user_inatomic(dst,
-			(__force const void __user *)src, size);
-	pagefault_enable();
+	ret = probe_read_common(dst, (__force const void __user *)src, size);
 	set_fs(old_fs);
 
-	return ret ? -EFAULT : 0;
+	return ret;
 }
 EXPORT_SYMBOL_GPL(probe_kernel_read);
 
+/**
+ * probe_user_read(): safely attempt to read from a user-space location
+ * @dst: pointer to the buffer that shall take the data
+ * @src: address to read from. This must be a user address.
+ * @size: size of the data chunk
+ *
+ * Safely read from user address @src to the buffer at @dst. If a kernel fault
+ * happens, handle that and return -EFAULT.
+ */
+
+long __weak probe_user_read(void *dst, const void __user *src, size_t size)
+    __attribute__((alias("__probe_user_read")));
+
+long __probe_user_read(void *dst, const void __user *src, size_t size)
+{
+	long ret = -EFAULT;
+	mm_segment_t old_fs = get_fs();
+
+	set_fs(USER_DS);
+	if (access_ok(VERIFY_READ, src, size))
+		ret = probe_read_common(dst, src, size);
+	set_fs(old_fs);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(probe_user_read);
+
 /**
  * probe_kernel_write(): safely attempt to write to a location
  * @dst: address to write to
@@ -66,6 +102,7 @@ long __probe_kernel_write(void *dst, const void *src, size_t size)
 }
 EXPORT_SYMBOL_GPL(probe_kernel_write);
 
+
 /**
  * strncpy_from_unsafe: - Copy a NUL terminated string from unsafe address.
  * @dst:   Destination address, in kernel space.  This buffer must be at
@@ -105,3 +142,76 @@ long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count)
 
 	return ret ? -EFAULT : src - unsafe_addr;
 }
+
+/**
+ * strncpy_from_unsafe_user: - Copy a NUL terminated string from unsafe user
+ *				address.
+ * @dst:   Destination address, in kernel space.  This buffer must be at
+ *         least @count bytes long.
+ * @unsafe_addr: Unsafe user address.
+ * @count: Maximum number of bytes to copy, including the trailing NUL.
+ *
+ * Copies a NUL-terminated string from unsafe user address to kernel buffer.
+ *
+ * On success, returns the length of the string INCLUDING the trailing NUL.
+ *
+ * If access fails, returns -EFAULT (some data may have been copied
+ * and the trailing NUL added).
+ *
+ * If @count is smaller than the length of the string, copies @count-1 bytes,
+ * sets the last byte of @dst buffer to NUL and returns @count.
+ */
+long strncpy_from_unsafe_user(char *dst, const void __user *unsafe_addr,
+			      long count)
+{
+	mm_segment_t old_fs = get_fs();
+	long ret;
+
+	if (unlikely(count <= 0))
+		return 0;
+
+	set_fs(USER_DS);
+	pagefault_disable();
+	ret = strncpy_from_user(dst, unsafe_addr, count);
+	pagefault_enable();
+	set_fs(old_fs);
+
+	if (ret >= count) {
+		ret = count;
+		dst[ret - 1] = '\0';
+	} else if (ret > 0) {
+		ret++;
+	}
+
+	return ret;
+}
+
+/**
+ * strnlen_unsafe_user: - Get the size of a user string INCLUDING final NUL.
+ * @unsafe_addr: The string to measure.
+ * @count: Maximum count (including NUL)
+ *
+ * Get the size of a NUL-terminated string in user space without pagefault.
+ *
+ * Returns the size of the string INCLUDING the terminating NUL.
+ *
+ * If the string is too long, returns a number larger than @count. User
+ * has to check the return value against "> count".
+ * On exception (or invalid count), returns 0.
+ *
+ * Unlike strnlen_user, this can be used from IRQ handler etc. because
+ * it disables pagefaults.
+ */
+long strnlen_unsafe_user(const void __user *unsafe_addr, long count)
+{
+	mm_segment_t old_fs = get_fs();
+	int ret;
+
+	set_fs(USER_DS);
+	pagefault_disable();
+	ret = strnlen_user(unsafe_addr, count);
+	pagefault_enable();
+	set_fs(old_fs);
+
+	return ret;
+}

From c19f02fe1081e41d80f4f05d3efb16f624d45ad6 Mon Sep 17 00:00:00 2001
From: Daniel Borkmann <daniel@iogearbox.net>
Date: Sat, 2 Nov 2019 00:17:56 +0100
Subject: [PATCH 0539/2658] uaccess: Add non-pagefault user-space write
 function

[ Upstream commit 1d1585ca0f48fe7ed95c3571f3e4a82b2b5045dc ]

Commit 3d7081822f7f ("uaccess: Add non-pagefault user-space read functions")
missed to add probe write function, therefore factor out a probe_write_common()
helper with most logic of probe_kernel_write() except setting KERNEL_DS, and
add a new probe_user_write() helper so it can be used from BPF side.

Again, on some archs, the user address space and kernel address space can
co-exist and be overlapping, so in such case, setting KERNEL_DS would mean
that the given address is treated as being in kernel address space.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Link: https://lore.kernel.org/bpf/9df2542e68141bfa3addde631441ee45503856a8.1572649915.git.daniel@iogearbox.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/uaccess.h | 12 +++++++++++
 mm/maccess.c            | 45 +++++++++++++++++++++++++++++++++++++----
 2 files changed, 53 insertions(+), 4 deletions(-)

diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
index 6d27d58ca4e0..cc5ba47062e8 100644
--- a/include/linux/uaccess.h
+++ b/include/linux/uaccess.h
@@ -113,6 +113,18 @@ extern long probe_user_read(void *dst, const void __user *src, size_t size);
 extern long notrace probe_kernel_write(void *dst, const void *src, size_t size);
 extern long notrace __probe_kernel_write(void *dst, const void *src, size_t size);
 
+/*
+ * probe_user_write(): safely attempt to write to a location in user space
+ * @dst: address to write to
+ * @src: pointer to the data that shall be written
+ * @size: size of the data chunk
+ *
+ * Safely write to address @dst from the buffer at @src.  If a kernel fault
+ * happens, handle that and return -EFAULT.
+ */
+extern long notrace probe_user_write(void __user *dst, const void *src, size_t size);
+extern long notrace __probe_user_write(void __user *dst, const void *src, size_t size);
+
 extern long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count);
 extern long strncpy_from_unsafe_user(char *dst, const void __user *unsafe_addr,
 				     long count);
diff --git a/mm/maccess.c b/mm/maccess.c
index 5ebf9a3ca367..03ea550f5a74 100644
--- a/mm/maccess.c
+++ b/mm/maccess.c
@@ -17,6 +17,18 @@ probe_read_common(void *dst, const void __user *src, size_t size)
 	return ret ? -EFAULT : 0;
 }
 
+static __always_inline long
+probe_write_common(void __user *dst, const void *src, size_t size)
+{
+	long ret;
+
+	pagefault_disable();
+	ret = __copy_to_user_inatomic(dst, src, size);
+	pagefault_enable();
+
+	return ret ? -EFAULT : 0;
+}
+
 /**
  * probe_kernel_read(): safely attempt to read from a kernel-space location
  * @dst: pointer to the buffer that shall take the data
@@ -84,6 +96,7 @@ EXPORT_SYMBOL_GPL(probe_user_read);
  * Safely write to address @dst from the buffer at @src.  If a kernel fault
  * happens, handle that and return -EFAULT.
  */
+
 long __weak probe_kernel_write(void *dst, const void *src, size_t size)
     __attribute__((alias("__probe_kernel_write")));
 
@@ -93,15 +106,39 @@ long __probe_kernel_write(void *dst, const void *src, size_t size)
 	mm_segment_t old_fs = get_fs();
 
 	set_fs(KERNEL_DS);
-	pagefault_disable();
-	ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
-	pagefault_enable();
+	ret = probe_write_common((__force void __user *)dst, src, size);
 	set_fs(old_fs);
 
-	return ret ? -EFAULT : 0;
+	return ret;
 }
 EXPORT_SYMBOL_GPL(probe_kernel_write);
 
+/**
+ * probe_user_write(): safely attempt to write to a user-space location
+ * @dst: address to write to
+ * @src: pointer to the data that shall be written
+ * @size: size of the data chunk
+ *
+ * Safely write to address @dst from the buffer at @src.  If a kernel fault
+ * happens, handle that and return -EFAULT.
+ */
+
+long __weak probe_user_write(void __user *dst, const void *src, size_t size)
+    __attribute__((alias("__probe_user_write")));
+
+long __probe_user_write(void __user *dst, const void *src, size_t size)
+{
+	long ret = -EFAULT;
+	mm_segment_t old_fs = get_fs();
+
+	set_fs(USER_DS);
+	if (access_ok(VERIFY_WRITE, dst, size))
+		ret = probe_write_common(dst, src, size);
+	set_fs(old_fs);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(probe_user_write);
 
 /**
  * strncpy_from_unsafe: - Copy a NUL terminated string from unsafe address.

From 1ed66f606ceada593be3051b280b3b85b20b9b97 Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Mon, 10 Aug 2020 11:42:27 -0400
Subject: [PATCH 0540/2658] btrfs: fix potential deadlock in the search ioctl

[ Upstream commit a48b73eca4ceb9b8a4b97f290a065335dbcd8a04 ]

With the conversion of the tree locks to rwsem I got the following
lockdep splat:

  ======================================================
  WARNING: possible circular locking dependency detected
  5.8.0-rc7-00165-g04ec4da5f45f-dirty #922 Not tainted
  ------------------------------------------------------
  compsize/11122 is trying to acquire lock:
  ffff889fabca8768 (&mm->mmap_lock#2){++++}-{3:3}, at: __might_fault+0x3e/0x90

  but task is already holding lock:
  ffff889fe720fe40 (btrfs-fs-00){++++}-{3:3}, at: __btrfs_tree_read_lock+0x39/0x180

  which lock already depends on the new lock.

  the existing dependency chain (in reverse order) is:

  -> #2 (btrfs-fs-00){++++}-{3:3}:
	 down_write_nested+0x3b/0x70
	 __btrfs_tree_lock+0x24/0x120
	 btrfs_search_slot+0x756/0x990
	 btrfs_lookup_inode+0x3a/0xb4
	 __btrfs_update_delayed_inode+0x93/0x270
	 btrfs_async_run_delayed_root+0x168/0x230
	 btrfs_work_helper+0xd4/0x570
	 process_one_work+0x2ad/0x5f0
	 worker_thread+0x3a/0x3d0
	 kthread+0x133/0x150
	 ret_from_fork+0x1f/0x30

  -> #1 (&delayed_node->mutex){+.+.}-{3:3}:
	 __mutex_lock+0x9f/0x930
	 btrfs_delayed_update_inode+0x50/0x440
	 btrfs_update_inode+0x8a/0xf0
	 btrfs_dirty_inode+0x5b/0xd0
	 touch_atime+0xa1/0xd0
	 btrfs_file_mmap+0x3f/0x60
	 mmap_region+0x3a4/0x640
	 do_mmap+0x376/0x580
	 vm_mmap_pgoff+0xd5/0x120
	 ksys_mmap_pgoff+0x193/0x230
	 do_syscall_64+0x50/0x90
	 entry_SYSCALL_64_after_hwframe+0x44/0xa9

  -> #0 (&mm->mmap_lock#2){++++}-{3:3}:
	 __lock_acquire+0x1272/0x2310
	 lock_acquire+0x9e/0x360
	 __might_fault+0x68/0x90
	 _copy_to_user+0x1e/0x80
	 copy_to_sk.isra.32+0x121/0x300
	 search_ioctl+0x106/0x200
	 btrfs_ioctl_tree_search_v2+0x7b/0xf0
	 btrfs_ioctl+0x106f/0x30a0
	 ksys_ioctl+0x83/0xc0
	 __x64_sys_ioctl+0x16/0x20
	 do_syscall_64+0x50/0x90
	 entry_SYSCALL_64_after_hwframe+0x44/0xa9

  other info that might help us debug this:

  Chain exists of:
    &mm->mmap_lock#2 --> &delayed_node->mutex --> btrfs-fs-00

   Possible unsafe locking scenario:

	 CPU0                    CPU1
	 ----                    ----
    lock(btrfs-fs-00);
				 lock(&delayed_node->mutex);
				 lock(btrfs-fs-00);
    lock(&mm->mmap_lock#2);

   *** DEADLOCK ***

  1 lock held by compsize/11122:
   #0: ffff889fe720fe40 (btrfs-fs-00){++++}-{3:3}, at: __btrfs_tree_read_lock+0x39/0x180

  stack backtrace:
  CPU: 17 PID: 11122 Comm: compsize Kdump: loaded Not tainted 5.8.0-rc7-00165-g04ec4da5f45f-dirty #922
  Hardware name: Quanta Tioga Pass Single Side 01-0030993006/Tioga Pass Single Side, BIOS F08_3A18 12/20/2018
  Call Trace:
   dump_stack+0x78/0xa0
   check_noncircular+0x165/0x180
   __lock_acquire+0x1272/0x2310
   lock_acquire+0x9e/0x360
   ? __might_fault+0x3e/0x90
   ? find_held_lock+0x72/0x90
   __might_fault+0x68/0x90
   ? __might_fault+0x3e/0x90
   _copy_to_user+0x1e/0x80
   copy_to_sk.isra.32+0x121/0x300
   ? btrfs_search_forward+0x2a6/0x360
   search_ioctl+0x106/0x200
   btrfs_ioctl_tree_search_v2+0x7b/0xf0
   btrfs_ioctl+0x106f/0x30a0
   ? __do_sys_newfstat+0x5a/0x70
   ? ksys_ioctl+0x83/0xc0
   ksys_ioctl+0x83/0xc0
   __x64_sys_ioctl+0x16/0x20
   do_syscall_64+0x50/0x90
   entry_SYSCALL_64_after_hwframe+0x44/0xa9

The problem is we're doing a copy_to_user() while holding tree locks,
which can deadlock if we have to do a page fault for the copy_to_user().
This exists even without my locking changes, so it needs to be fixed.
Rework the search ioctl to do the pre-fault and then
copy_to_user_nofault for the copying.

CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/extent_io.c |  8 ++++----
 fs/btrfs/extent_io.h |  6 +++---
 fs/btrfs/ioctl.c     | 27 ++++++++++++++++++++-------
 3 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 2f9f738ecf84..97a80238fdee 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -5431,9 +5431,9 @@ void read_extent_buffer(const struct extent_buffer *eb, void *dstv,
 	}
 }
 
-int read_extent_buffer_to_user(const struct extent_buffer *eb,
-			       void __user *dstv,
-			       unsigned long start, unsigned long len)
+int read_extent_buffer_to_user_nofault(const struct extent_buffer *eb,
+				       void __user *dstv,
+				       unsigned long start, unsigned long len)
 {
 	size_t cur;
 	size_t offset;
@@ -5454,7 +5454,7 @@ int read_extent_buffer_to_user(const struct extent_buffer *eb,
 
 		cur = min(len, (PAGE_CACHE_SIZE - offset));
 		kaddr = page_address(page);
-		if (copy_to_user(dst, kaddr + offset, cur)) {
+		if (probe_user_write(dst, kaddr + offset, cur)) {
 			ret = -EFAULT;
 			break;
 		}
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index 751435967724..9631be7fc9e2 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -313,9 +313,9 @@ int memcmp_extent_buffer(const struct extent_buffer *eb, const void *ptrv,
 void read_extent_buffer(const struct extent_buffer *eb, void *dst,
 			unsigned long start,
 			unsigned long len);
-int read_extent_buffer_to_user(const struct extent_buffer *eb,
-			       void __user *dst, unsigned long start,
-			       unsigned long len);
+int read_extent_buffer_to_user_nofault(const struct extent_buffer *eb,
+				       void __user *dst, unsigned long start,
+				       unsigned long len);
 void write_extent_buffer(struct extent_buffer *eb, const void *src,
 			 unsigned long start, unsigned long len);
 void copy_extent_buffer(struct extent_buffer *dst, struct extent_buffer *src,
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 245a50f490f6..91a45ef69152 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2017,9 +2017,14 @@ static noinline int copy_to_sk(struct btrfs_root *root,
 		sh.len = item_len;
 		sh.transid = found_transid;
 
-		/* copy search result header */
-		if (copy_to_user(ubuf + *sk_offset, &sh, sizeof(sh))) {
-			ret = -EFAULT;
+		/*
+		 * Copy search result header. If we fault then loop again so we
+		 * can fault in the pages and -EFAULT there if there's a
+		 * problem. Otherwise we'll fault and then copy the buffer in
+		 * properly this next time through
+		 */
+		if (probe_user_write(ubuf + *sk_offset, &sh, sizeof(sh))) {
+			ret = 0;
 			goto out;
 		}
 
@@ -2027,10 +2032,14 @@ static noinline int copy_to_sk(struct btrfs_root *root,
 
 		if (item_len) {
 			char __user *up = ubuf + *sk_offset;
-			/* copy the item */
-			if (read_extent_buffer_to_user(leaf, up,
-						       item_off, item_len)) {
-				ret = -EFAULT;
+			/*
+			 * Copy the item, same behavior as above, but reset the
+			 * * sk_offset so we copy the full thing again.
+			 */
+			if (read_extent_buffer_to_user_nofault(leaf, up,
+						item_off, item_len)) {
+				ret = 0;
+				*sk_offset -= sizeof(sh);
 				goto out;
 			}
 
@@ -2120,6 +2129,10 @@ static noinline int search_ioctl(struct inode *inode,
 	key.offset = sk->min_offset;
 
 	while (1) {
+		ret = fault_in_pages_writeable(ubuf, *buf_size - sk_offset);
+		if (ret)
+			break;
+
 		ret = btrfs_search_forward(root, &key, path, sk->min_transid);
 		if (ret != 0) {
 			if (ret > 0)

From 58550a349c2cfd1cb88e47a925391b545e74bd9a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
Date: Thu, 3 Dec 2015 19:24:18 +0100
Subject: [PATCH 0541/2658] net: qmi_wwan: MDM9x30 specific power management
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 93725149794d3d418cf1eddcae60c7b536c5faa1 ]

MDM9x30 based modems appear to go into a deeper sleep when
suspended without "Remote Wakeup" enabled.  The QMI interface
will not respond unless a "set DTR" control request is sent
on resume. The effect is similar to a QMI_CTL SYNC request,
resetting (some of) the firmware state.

We allow userspace sessions to span multiple character device
open/close sequences.  This means that userspace can depend
on firmware state while both the netdev and the character
device are closed.  We have disabled "needs_remote_wakeup" at
this point to allow devices without remote wakeup support to
be auto-suspended.

To make sure the MDM9x30 keeps firmware state, we need to
keep "needs_remote_wakeup" always set. We also need to
issue a "set DTR" request to enable the QMI interface.

Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/qmi_wwan.c | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 4391430e2527..b8b15deb94bd 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -223,6 +223,20 @@ static int qmi_wwan_register_subdriver(struct usbnet *dev)
 	return rv;
 }
 
+/* Send CDC SetControlLineState request, setting or clearing the DTR.
+ * "Required for Autoconnect and 9x30 to wake up" according to the
+ * GobiNet driver. The requirement has been verified on an MDM9230
+ * based Sierra Wireless MC7455
+ */
+static int qmi_wwan_change_dtr(struct usbnet *dev, bool on)
+{
+	u8 intf = dev->intf->cur_altsetting->desc.bInterfaceNumber;
+
+	return usbnet_write_cmd(dev, USB_CDC_REQ_SET_CONTROL_LINE_STATE,
+				USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+				on ? 0x01 : 0x00, intf, NULL, 0);
+}
+
 static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf)
 {
 	int status = -1;
@@ -280,6 +294,24 @@ static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf)
 		usb_driver_release_interface(driver, info->data);
 	}
 
+	/* disabling remote wakeup on MDM9x30 devices has the same
+	 * effect as clearing DTR. The device will not respond to QMI
+	 * requests until we set DTR again.  This is similar to a
+	 * QMI_CTL SYNC request, clearing a lot of firmware state
+	 * including the client ID allocations.
+	 *
+	 * Our usage model allows a session to span multiple
+	 * open/close events, so we must prevent the firmware from
+	 * clearing out state the clients might need.
+	 *
+	 * MDM9x30 is the first QMI chipset with USB3 support. Abuse
+	 * this fact to enable the quirk.
+	 */
+	if (le16_to_cpu(dev->udev->descriptor.bcdUSB) >= 0x0201) {
+		qmi_wwan_manage_power(dev, 1);
+		qmi_wwan_change_dtr(dev, true);
+	}
+
 	/* Never use the same address on both ends of the link, even if the
 	 * buggy firmware told us to. Or, if device is assigned the well-known
 	 * buggy firmware MAC address, replace it with a random address,
@@ -307,6 +339,12 @@ static void qmi_wwan_unbind(struct usbnet *dev, struct usb_interface *intf)
 	if (info->subdriver && info->subdriver->disconnect)
 		info->subdriver->disconnect(info->control);
 
+	/* disable MDM9x30 quirk */
+	if (le16_to_cpu(dev->udev->descriptor.bcdUSB) >= 0x0201) {
+		qmi_wwan_change_dtr(dev, false);
+		qmi_wwan_manage_power(dev, 0);
+	}
+
 	/* allow user to unbind using either control or data */
 	if (intf == info->control)
 		other = info->data;

From bfc0ad57e9ce6f95d253082089ad8b0680bcc4f0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
Date: Thu, 3 Dec 2015 19:24:21 +0100
Subject: [PATCH 0542/2658] net: qmi_wwan: support "raw IP" mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 32f7adf633b9f99ad5089901bc7ebff57704aaa9 ]

QMI wwan devices have traditionally emulated ethernet devices
by default. But they have always had the capability of operating
without any L2 header at all, transmitting and receiving "raw"
IP packets over the USB link.  This firmware feature used to be
configurable through the QMI management protocol.

Traditionally there was no way to verify the firmware mode
without attempting to change it.  And the firmware would often
disallow changes anyway, i.e. due to a session already being
established.  In some cases, this could be a hidden firmware
internal session, completely outside host control.  For these
reasons, sticking with the "well known" default mode was safest.

But newer generations of QMI hardware and firmware have moved
towards defaulting to "raw IP" mode instead, followed by an
increasing number of bugs in the already buggy "802.3" firmware
implementation. At the same time, the QMI management protocol
gained the ability to detect the current mode.  This has enabled
the userspace QMI management application to verify the current
firmware mode without trying to modify it.

Following this development, the latest QMI hardware and firmware
(the MDM9x30 generation) has dropped support for "802.3" mode
entirely. Support for "raw IP" framing in the driver is therefore
necessary for these devices, and to a certain degree to work
around problems with the previous generation,

This patch adds support for "raw IP" framing for QMI devices,
changing the netdev from an ethernet device to an ARPHRD_NONE
p-t-p device when "raw IP" framing is enabled.

The firmware setup is fully delegated to the QMI userspace
management application, through simple tunneling of the QMI
protocol. The driver will therefore not know which mode has been
"negotiated" between firmware and userspace. Allowing userspace
to inform the driver of the result through a sysfs switch is
considered a better alternative than to change the well established
clean delegation of firmware management to userspace.

Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/qmi_wwan.c | 98 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 97 insertions(+), 1 deletion(-)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index b8b15deb94bd..d6ecb3ac25b6 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -14,6 +14,7 @@
 #include <linux/netdevice.h>
 #include <linux/ethtool.h>
 #include <linux/etherdevice.h>
+#include <linux/if_arp.h>
 #include <linux/mii.h>
 #include <linux/usb.h>
 #include <linux/usb/cdc.h>
@@ -48,11 +49,93 @@
 struct qmi_wwan_state {
 	struct usb_driver *subdriver;
 	atomic_t pmcount;
-	unsigned long unused;
+	unsigned long flags;
 	struct usb_interface *control;
 	struct usb_interface *data;
 };
 
+enum qmi_wwan_flags {
+	QMI_WWAN_FLAG_RAWIP = 1 << 0,
+};
+
+static void qmi_wwan_netdev_setup(struct net_device *net)
+{
+	struct usbnet *dev = netdev_priv(net);
+	struct qmi_wwan_state *info = (void *)&dev->data;
+
+	if (info->flags & QMI_WWAN_FLAG_RAWIP) {
+		net->header_ops      = NULL;  /* No header */
+		net->type            = ARPHRD_NONE;
+		net->hard_header_len = 0;
+		net->addr_len        = 0;
+		net->flags           = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
+		netdev_dbg(net, "mode: raw IP\n");
+	} else if (!net->header_ops) { /* don't bother if already set */
+		ether_setup(net);
+		netdev_dbg(net, "mode: Ethernet\n");
+	}
+
+	/* recalculate buffers after changing hard_header_len */
+	usbnet_change_mtu(net, net->mtu);
+}
+
+static ssize_t raw_ip_show(struct device *d, struct device_attribute *attr, char *buf)
+{
+	struct usbnet *dev = netdev_priv(to_net_dev(d));
+	struct qmi_wwan_state *info = (void *)&dev->data;
+
+	return sprintf(buf, "%c\n", info->flags & QMI_WWAN_FLAG_RAWIP ? 'Y' : 'N');
+}
+
+static ssize_t raw_ip_store(struct device *d,  struct device_attribute *attr, const char *buf, size_t len)
+{
+	struct usbnet *dev = netdev_priv(to_net_dev(d));
+	struct qmi_wwan_state *info = (void *)&dev->data;
+	bool enable;
+	int err;
+
+	if (strtobool(buf, &enable))
+		return -EINVAL;
+
+	/* no change? */
+	if (enable == (info->flags & QMI_WWAN_FLAG_RAWIP))
+		return len;
+
+	/* we don't want to modify a running netdev */
+	if (netif_running(dev->net)) {
+		netdev_err(dev->net, "Cannot change a running device\n");
+		return -EBUSY;
+	}
+
+	/* let other drivers deny the change */
+	err = call_netdevice_notifiers(NETDEV_PRE_TYPE_CHANGE, dev->net);
+	err = notifier_to_errno(err);
+	if (err) {
+		netdev_err(dev->net, "Type change was refused\n");
+		return err;
+	}
+
+	if (enable)
+		info->flags |= QMI_WWAN_FLAG_RAWIP;
+	else
+		info->flags &= ~QMI_WWAN_FLAG_RAWIP;
+	qmi_wwan_netdev_setup(dev->net);
+	call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev->net);
+	return len;
+}
+
+static DEVICE_ATTR_RW(raw_ip);
+
+static struct attribute *qmi_wwan_sysfs_attrs[] = {
+	&dev_attr_raw_ip.attr,
+	NULL,
+};
+
+static struct attribute_group qmi_wwan_sysfs_attr_group = {
+	.name = "qmi",
+	.attrs = qmi_wwan_sysfs_attrs,
+};
+
 /* default ethernet address used by the modem */
 static const u8 default_modem_addr[ETH_ALEN] = {0x02, 0x50, 0xf3};
 
@@ -80,6 +163,8 @@ static const u8 buggy_fw_addr[ETH_ALEN] = {0x00, 0xa0, 0xc6, 0x00, 0x00, 0x00};
  */
 static int qmi_wwan_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 {
+	struct qmi_wwan_state *info = (void *)&dev->data;
+	bool rawip = info->flags & QMI_WWAN_FLAG_RAWIP;
 	__be16 proto;
 
 	/* This check is no longer done by usbnet */
@@ -94,15 +179,25 @@ static int qmi_wwan_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 		proto = htons(ETH_P_IPV6);
 		break;
 	case 0x00:
+		if (rawip)
+			return 0;
 		if (is_multicast_ether_addr(skb->data))
 			return 1;
 		/* possibly bogus destination - rewrite just in case */
 		skb_reset_mac_header(skb);
 		goto fix_dest;
 	default:
+		if (rawip)
+			return 0;
 		/* pass along other packets without modifications */
 		return 1;
 	}
+	if (rawip) {
+		skb->dev = dev->net; /* normally set by eth_type_trans */
+		skb->protocol = proto;
+		return 1;
+	}
+
 	if (skb_headroom(skb) < ETH_HLEN)
 		return 0;
 	skb_push(skb, ETH_HLEN);
@@ -326,6 +421,7 @@ static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf)
 		dev->net->dev_addr[0] &= 0xbf;	/* clear "IP" bit */
 	}
 	dev->net->netdev_ops = &qmi_wwan_netdev_ops;
+	dev->net->sysfs_groups[0] = &qmi_wwan_sysfs_attr_group;
 err:
 	return status;
 }

From 03b7dd5943bf82a9f8f9b3619335fc1c68a2090b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
Date: Sun, 6 Dec 2015 21:25:50 +0100
Subject: [PATCH 0543/2658] net: qmi_wwan: should hold RTNL while changing
 netdev type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 6c730080e663b1d629f8aa89348291fbcdc46cd9 ]

The notifier calls were thrown in as a last-minute fix for an
imagined "this device could be part of a bridge" problem. That
revealed a certain lack of locking.  Not to mention testing...

Avoid this splat:

RTNL: assertion failed at net/core/dev.c (1639)
CPU: 0 PID: 4293 Comm: bash Not tainted 4.4.0-rc3+ #358
Hardware name: LENOVO 2776LEG/2776LEG, BIOS 6EET55WW (3.15 ) 12/19/2011
 0000000000000000 ffff8800ad253d60 ffffffff8122f7cf ffff8800ad253d98
 ffff8800ad253d88 ffffffff813833ab 0000000000000002 ffff880230f48560
 ffff880230a12900 ffff8800ad253da0 ffffffff813833da 0000000000000002
Call Trace:
 [<ffffffff8122f7cf>] dump_stack+0x4b/0x63
 [<ffffffff813833ab>] call_netdevice_notifiers_info+0x3d/0x59
 [<ffffffff813833da>] call_netdevice_notifiers+0x13/0x15
 [<ffffffffa09be227>] raw_ip_store+0x81/0x193 [qmi_wwan]
 [<ffffffff8131e149>] dev_attr_store+0x20/0x22
 [<ffffffff811d858b>] sysfs_kf_write+0x49/0x50
 [<ffffffff811d8027>] kernfs_fop_write+0x10a/0x151
 [<ffffffff8117249a>] __vfs_write+0x26/0xa5
 [<ffffffff81085ed4>] ? percpu_down_read+0x53/0x7f
 [<ffffffff81174c9e>] ? __sb_start_write+0x5f/0xb0
 [<ffffffff81174c9e>] ? __sb_start_write+0x5f/0xb0
 [<ffffffff81172c37>] vfs_write+0xa3/0xe7
 [<ffffffff811734ad>] SyS_write+0x50/0x7e
 [<ffffffff8145c517>] entry_SYSCALL_64_fastpath+0x12/0x6f

Fixes: 32f7adf633b9 ("net: qmi_wwan: support "raw IP" mode")
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/qmi_wwan.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index d6ecb3ac25b6..e75e984483bc 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -16,6 +16,7 @@
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
 #include <linux/mii.h>
+#include <linux/rtnetlink.h>
 #include <linux/usb.h>
 #include <linux/usb/cdc.h>
 #include <linux/usb/usbnet.h>
@@ -92,7 +93,7 @@ static ssize_t raw_ip_store(struct device *d,  struct device_attribute *attr, co
 	struct usbnet *dev = netdev_priv(to_net_dev(d));
 	struct qmi_wwan_state *info = (void *)&dev->data;
 	bool enable;
-	int err;
+	int ret;
 
 	if (strtobool(buf, &enable))
 		return -EINVAL;
@@ -101,18 +102,22 @@ static ssize_t raw_ip_store(struct device *d,  struct device_attribute *attr, co
 	if (enable == (info->flags & QMI_WWAN_FLAG_RAWIP))
 		return len;
 
+	if (!rtnl_trylock())
+		return restart_syscall();
+
 	/* we don't want to modify a running netdev */
 	if (netif_running(dev->net)) {
 		netdev_err(dev->net, "Cannot change a running device\n");
-		return -EBUSY;
+		ret = -EBUSY;
+		goto err;
 	}
 
 	/* let other drivers deny the change */
-	err = call_netdevice_notifiers(NETDEV_PRE_TYPE_CHANGE, dev->net);
-	err = notifier_to_errno(err);
-	if (err) {
+	ret = call_netdevice_notifiers(NETDEV_PRE_TYPE_CHANGE, dev->net);
+	ret = notifier_to_errno(ret);
+	if (ret) {
 		netdev_err(dev->net, "Type change was refused\n");
-		return err;
+		goto err;
 	}
 
 	if (enable)
@@ -121,7 +126,10 @@ static ssize_t raw_ip_store(struct device *d,  struct device_attribute *attr, co
 		info->flags &= ~QMI_WWAN_FLAG_RAWIP;
 	qmi_wwan_netdev_setup(dev->net);
 	call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev->net);
-	return len;
+	ret = len;
+err:
+	rtnl_unlock();
+	return ret;
 }
 
 static DEVICE_ATTR_RW(raw_ip);

From 38d484ce95633e429221cd79888d2f2119841345 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
Date: Thu, 17 Dec 2015 12:44:04 +0100
Subject: [PATCH 0544/2658] net: qmi_wwan: ignore bogus CDC Union descriptors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 34a55d5e858e81a20d33fd9490149d6a1058be0c ]

The CDC descriptors found on these vendor specific functions should
not be considered authoritative.  They seem to be ignored by drivers
for other systems, and the quality is therefore low.

One device (1e0e:9001) has been reported to have such a bogus union
descriptor on the QMI function, making it fail probing even if the
device id was dynamically added.  The report was not complete enough
to allow adding a device entry for this modem. But this should at
least fix the dynamic id probing problem.

Reported-by: Kanerva Topi <Topi.Kanerva@cinia.fi>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/qmi_wwan.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index e75e984483bc..f8d00846b4a5 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -374,7 +374,10 @@ static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf)
 				"bogus CDC Union: master=%u, slave=%u\n",
 				cdc_union->bMasterInterface0,
 				cdc_union->bSlaveInterface0);
-			goto err;
+
+			/* ignore and continue... */
+			cdc_union = NULL;
+			info->data = intf;
 		}
 	}
 

From 84e51da9791cddf3ccd0a5d1c5154cdb626154fb Mon Sep 17 00:00:00 2001
From: Patrik Halfar <patrik_halfar@halfarit.cz>
Date: Sat, 20 Feb 2016 18:49:40 +0100
Subject: [PATCH 0545/2658] Add Dell Wireless 5809e Gobi 4G HSPA+ Mobile
 Broadband Card (rev3) to qmi_wwan
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit fb5eb24cdd5cdb83be77d3e4b2f16e92e06bd9e9 ]

New revison of Dell Wireless 5809e Gobi 4G HSPA+ Mobile Broadband Card has new idProduct

Bus 002 Device 006: ID 413c:81b3 Dell Computer Corp.
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  idVendor           0x413c Dell Computer Corp.
  idProduct          0x81b3
  bcdDevice            0.06
  iManufacturer           1 Sierra Wireless, Incorporated
  iProduct                2 Dell Wireless 5809e Gobi™ 4G HSPA+ Mobile Broadband Card
  iSerial                 3
  bNumConfigurations      2

Signed-off-by: Patrik Halfar <patrik_halfar@halfarit.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/qmi_wwan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index f8d00846b4a5..977df611164a 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -913,6 +913,7 @@ static const struct usb_device_id products[] = {
 	{QMI_FIXED_INTF(0x413c, 0x81a8, 8)},	/* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */
 	{QMI_FIXED_INTF(0x413c, 0x81a9, 8)},	/* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
 	{QMI_FIXED_INTF(0x413c, 0x81b1, 8)},	/* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */
+	{QMI_FIXED_INTF(0x413c, 0x81b3, 8)},	/* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
 	{QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)},	/* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */
 	{QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)},	/* HP lt4120 Snapdragon X5 LTE */
 	{QMI_FIXED_INTF(0x22de, 0x9061, 3)},	/* WeTelecom WPD-600N */

From 12f928994063549786b8a7aad8516466d15f8d84 Mon Sep 17 00:00:00 2001
From: Schemmel Hans-Christoph <Hans-Christoph.Schemmel@gemalto.com>
Date: Thu, 17 Mar 2016 10:07:56 +0000
Subject: [PATCH 0546/2658] qmi_wwan: Added support for Gemalto's Cinterion
 PHxx WWAN interface
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit bd9e33508c5e1eb5d807d11d7bfc52125fcdb04e ]

Added support for Gemalto's Cinterion PHxx WWAN interfaces
by adding QMI_FIXED_INTF with Cinterion's VID and PID.

PHxx can have:
2 RmNet Interfaces (PID 0x0082) or
1 RmNet + 1 USB Audio interface (PID 0x0083).

Signed-off-by: Hans-Christoph Schemmel <hans-christoph.schemmel@gemalto.com>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/qmi_wwan.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 977df611164a..ec03cf1f107b 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -907,6 +907,9 @@ static const struct usb_device_id products[] = {
 	{QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)},	/* Olivetti Olicard 500 */
 	{QMI_FIXED_INTF(0x1e2d, 0x0060, 4)},	/* Cinterion PLxx */
 	{QMI_FIXED_INTF(0x1e2d, 0x0053, 4)},	/* Cinterion PHxx,PXxx */
+	{QMI_FIXED_INTF(0x1e2d, 0x0082, 4)},	/* Cinterion PHxx,PXxx (2 RmNet) */
+	{QMI_FIXED_INTF(0x1e2d, 0x0082, 5)},	/* Cinterion PHxx,PXxx (2 RmNet) */
+	{QMI_FIXED_INTF(0x1e2d, 0x0083, 4)},	/* Cinterion PHxx,PXxx (1 RmNet + USB Audio)*/
 	{QMI_FIXED_INTF(0x413c, 0x81a2, 8)},	/* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
 	{QMI_FIXED_INTF(0x413c, 0x81a3, 8)},	/* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
 	{QMI_FIXED_INTF(0x413c, 0x81a4, 8)},	/* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */

From e9ce8d95824148f960b12b1eb64f4dae74e774dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
Date: Mon, 10 Oct 2016 21:12:49 +0200
Subject: [PATCH 0547/2658] qmi_wwan: add support for Quectel EC21 and EC25
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 9a765881bf3dcd32847d7108cf48cb04a4ed993f ]

The Quectel EC21 and EC25 need the same "set DTR" request as devices
based on the MDM9230 chipset, but has no USB3 support. Our best guess
is that the "set DTR" functionality depends on chipset and/or
baseband firmware generation. But USB3 is still an optional feature.

Since we cannot enable this unconditionally for all older devices, and
there doesn't appear to be anything we can use in the USB descriptors
to identify these chips, we are forced to use a device specific quirk
flag.

Reported-and-tested-by: Sebastian Sjoholm <sebastian.sjoholm@gmail.com>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/qmi_wwan.c | 30 ++++++++++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index ec03cf1f107b..ffb2499a222d 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -59,6 +59,10 @@ enum qmi_wwan_flags {
 	QMI_WWAN_FLAG_RAWIP = 1 << 0,
 };
 
+enum qmi_wwan_quirks {
+	QMI_WWAN_QUIRK_DTR = 1 << 0,	/* needs "set DTR" request */
+};
+
 static void qmi_wwan_netdev_setup(struct net_device *net)
 {
 	struct usbnet *dev = netdev_priv(net);
@@ -411,9 +415,14 @@ static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf)
 	 * clearing out state the clients might need.
 	 *
 	 * MDM9x30 is the first QMI chipset with USB3 support. Abuse
-	 * this fact to enable the quirk.
+	 * this fact to enable the quirk for all USB3 devices.
+	 *
+	 * There are also chipsets with the same "set DTR" requirement
+	 * but without USB3 support.  Devices based on these chips
+	 * need a quirk flag in the device ID table.
 	 */
-	if (le16_to_cpu(dev->udev->descriptor.bcdUSB) >= 0x0201) {
+	if (dev->driver_info->data & QMI_WWAN_QUIRK_DTR ||
+	    le16_to_cpu(dev->udev->descriptor.bcdUSB) >= 0x0201) {
 		qmi_wwan_manage_power(dev, 1);
 		qmi_wwan_change_dtr(dev, true);
 	}
@@ -526,6 +535,16 @@ static const struct driver_info	qmi_wwan_info = {
 	.rx_fixup       = qmi_wwan_rx_fixup,
 };
 
+static const struct driver_info	qmi_wwan_info_quirk_dtr = {
+	.description	= "WWAN/QMI device",
+	.flags		= FLAG_WWAN,
+	.bind		= qmi_wwan_bind,
+	.unbind		= qmi_wwan_unbind,
+	.manage_power	= qmi_wwan_manage_power,
+	.rx_fixup       = qmi_wwan_rx_fixup,
+	.data           = QMI_WWAN_QUIRK_DTR,
+};
+
 #define HUAWEI_VENDOR_ID	0x12D1
 
 /* map QMI/wwan function by a fixed interface number */
@@ -533,6 +552,11 @@ static const struct driver_info	qmi_wwan_info = {
 	USB_DEVICE_INTERFACE_NUMBER(vend, prod, num), \
 	.driver_info = (unsigned long)&qmi_wwan_info
 
+/* devices requiring "set DTR" quirk */
+#define QMI_QUIRK_SET_DTR(vend, prod, num) \
+	USB_DEVICE_INTERFACE_NUMBER(vend, prod, num), \
+	.driver_info = (unsigned long)&qmi_wwan_info_quirk_dtr
+
 /* Gobi 1000 QMI/wwan interface number is 3 according to qcserial */
 #define QMI_GOBI1K_DEVICE(vend, prod) \
 	QMI_FIXED_INTF(vend, prod, 3)
@@ -921,6 +945,8 @@ static const struct usb_device_id products[] = {
 	{QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)},	/* HP lt4120 Snapdragon X5 LTE */
 	{QMI_FIXED_INTF(0x22de, 0x9061, 3)},	/* WeTelecom WPD-600N */
 	{QMI_FIXED_INTF(0x1e0e, 0x9001, 5)},	/* SIMCom 7230E */
+	{QMI_QUIRK_SET_DTR(0x2c7c, 0x0125, 4)},	/* Quectel EC25, EC20 R2.0  Mini PCIe */
+	{QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)},	/* Quectel EC21 Mini PCIe */
 
 	/* 4. Gobi 1000 devices */
 	{QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},	/* Acer Gobi Modem Device */

From aa8e0cec42afd3cc483be249748f90d8e9b6ff5b Mon Sep 17 00:00:00 2001
From: Daniele Palmas <dnlplm@gmail.com>
Date: Thu, 1 Dec 2016 16:52:05 +0100
Subject: [PATCH 0548/2658] NET: usb: qmi_wwan: add support for Telit LE922A
 PID 0x1040
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 9bd813da24cd49d749911d7fdc0e9ae9a673d746 ]

This patch adds support for PID 0x1040 of Telit LE922A.

The qmi adapter requires to have DTR set for proper working,
so QMI_WWAN_QUIRK_DTR has been enabled.

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/qmi_wwan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index ffb2499a222d..d48639cfec37 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -919,6 +919,7 @@ static const struct usb_device_id products[] = {
 	{QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},	/* Alcatel L800MA */
 	{QMI_FIXED_INTF(0x2357, 0x0201, 4)},	/* TP-LINK HSUPA Modem MA180 */
 	{QMI_FIXED_INTF(0x2357, 0x9000, 4)},	/* TP-LINK MA260 */
+	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)},	/* Telit LE922A */
 	{QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},	/* Telit LE920 */
 	{QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},	/* Telit LE920 */
 	{QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)},	/* XS Stick W100-2 from 4G Systems */

From 070d180001b660de4ecbb7dbdcdd9c9e6e0e5171 Mon Sep 17 00:00:00 2001
From: Daniele Palmas <dnlplm@gmail.com>
Date: Mon, 10 Apr 2017 17:34:23 +0200
Subject: [PATCH 0549/2658] drivers: net: usb: qmi_wwan: add QMI_QUIRK_SET_DTR
 for Telit PID 0x1201

[ Upstream commit 14cf4a771b3098e431d2677e3533bdd962e478d8 ]

Telit LE920A4 uses the same pid 0x1201 of LE920, but modem
implementation is different, since it requires DTR to be set for
answering to qmi messages.

This patch replaces QMI_FIXED_INTF with QMI_QUIRK_SET_DTR: tests on
LE920 have been performed in order to verify backward compatibility.

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/qmi_wwan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index d48639cfec37..36aadc89175f 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -921,7 +921,7 @@ static const struct usb_device_id products[] = {
 	{QMI_FIXED_INTF(0x2357, 0x9000, 4)},	/* TP-LINK MA260 */
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)},	/* Telit LE922A */
 	{QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},	/* Telit LE920 */
-	{QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},	/* Telit LE920 */
+	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)},	/* Telit LE920, LE920A4 */
 	{QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)},	/* XS Stick W100-2 from 4G Systems */
 	{QMI_FIXED_INTF(0x0b3c, 0xc000, 4)},	/* Olivetti Olicard 100 */
 	{QMI_FIXED_INTF(0x0b3c, 0xc001, 4)},	/* Olivetti Olicard 120 */

From d72fc133b784807460bffddccc8d2ec60f4c56f0 Mon Sep 17 00:00:00 2001
From: Rogan Dawes <rogan@dawes.za.net>
Date: Wed, 17 Jul 2019 11:14:33 +0200
Subject: [PATCH 0550/2658] usb: qmi_wwan: add D-Link DWM-222 A2 device ID

[ Upstream commit 7d6053097311643545a8118100175a39bd6fa637 ]

Signed-off-by: Rogan Dawes <rogan@dawes.za.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/qmi_wwan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 36aadc89175f..ce3b81039522 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -886,6 +886,7 @@ static const struct usb_device_id products[] = {
 	{QMI_FIXED_INTF(0x19d2, 0x2002, 4)},	/* ZTE (Vodafone) K3765-Z */
 	{QMI_FIXED_INTF(0x2001, 0x7e19, 4)},	/* D-Link DWM-221 B1 */
 	{QMI_FIXED_INTF(0x2001, 0x7e35, 4)},	/* D-Link DWM-222 */
+	{QMI_FIXED_INTF(0x2001, 0x7e3d, 4)},	/* D-Link DWM-222 A2 */
 	{QMI_FIXED_INTF(0x2020, 0x2031, 4)},	/* Olicard 600 */
 	{QMI_FIXED_INTF(0x2020, 0x2033, 4)},	/* BroadMobi BM806U */
 	{QMI_FIXED_INTF(0x2020, 0x2060, 4)},	/* BroadMobi BM818 */

From 794496f0232e0b2532b5425d772302efeae7cd6d Mon Sep 17 00:00:00 2001
From: Daniele Palmas <dnlplm@gmail.com>
Date: Wed, 3 May 2017 10:30:11 +0200
Subject: [PATCH 0551/2658] net: usb: qmi_wwan: add Telit ME910 support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 4c54dc0277d0d55a9248c43aebd31858f926a056 ]

This patch adds support for Telit ME910 PID 0x1100.

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/qmi_wwan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index ce3b81039522..c5c8224fc8cb 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -921,6 +921,7 @@ static const struct usb_device_id products[] = {
 	{QMI_FIXED_INTF(0x2357, 0x0201, 4)},	/* TP-LINK HSUPA Modem MA180 */
 	{QMI_FIXED_INTF(0x2357, 0x9000, 4)},	/* TP-LINK MA260 */
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)},	/* Telit LE922A */
+	{QMI_FIXED_INTF(0x1bc7, 0x1100, 3)},	/* Telit ME910 */
 	{QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},	/* Telit LE920 */
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)},	/* Telit LE920, LE920A4 */
 	{QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)},	/* XS Stick W100-2 from 4G Systems */

From 7cda7819c490ddd74469f8e14f9541842b9c84b9 Mon Sep 17 00:00:00 2001
From: Daniele Palmas <dnlplm@gmail.com>
Date: Wed, 9 Oct 2019 11:07:18 +0200
Subject: [PATCH 0552/2658] net: usb: qmi_wwan: add Telit 0x1050 composition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit e0ae2c578d3909e60e9448207f5d83f785f1129f ]

This patch adds support for Telit FN980 0x1050 composition

0x1050: tty, adb, rmnet, tty, tty, tty, tty

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/qmi_wwan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index c5c8224fc8cb..14eca1f80ce3 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -921,6 +921,7 @@ static const struct usb_device_id products[] = {
 	{QMI_FIXED_INTF(0x2357, 0x0201, 4)},	/* TP-LINK HSUPA Modem MA180 */
 	{QMI_FIXED_INTF(0x2357, 0x9000, 4)},	/* TP-LINK MA260 */
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)},	/* Telit LE922A */
+	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)},	/* Telit FN980 */
 	{QMI_FIXED_INTF(0x1bc7, 0x1100, 3)},	/* Telit ME910 */
 	{QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},	/* Telit LE920 */
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)},	/* Telit LE920, LE920A4 */

From 6b854d2a46278680edc6e5956bfe41cd0ad32024 Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Mon, 24 Aug 2020 18:45:41 -0400
Subject: [PATCH 0553/2658] ALSA: ca0106: fix error code handling

commit ee0761d1d8222bcc5c86bf10849dc86cf008557c upstream.

snd_ca0106_spi_write() returns 1 on error, snd_ca0106_pcm_power_dac()
is returning the error code directly, and the caller is expecting an
negative error code

Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200824224541.1260307-1-ztong0001@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/ca0106/ca0106_main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/pci/ca0106/ca0106_main.c b/sound/pci/ca0106/ca0106_main.c
index d3cd95633ee2..e7ee51b7aa6b 100644
--- a/sound/pci/ca0106/ca0106_main.c
+++ b/sound/pci/ca0106/ca0106_main.c
@@ -551,7 +551,8 @@ static int snd_ca0106_pcm_power_dac(struct snd_ca0106 *chip, int channel_id,
 		else
 			/* Power down */
 			chip->spi_dac_reg[reg] |= bit;
-		return snd_ca0106_spi_write(chip, chip->spi_dac_reg[reg]);
+		if (snd_ca0106_spi_write(chip, chip->spi_dac_reg[reg]) != 0)
+			return -ENXIO;
 	}
 	return 0;
 }

From 9bc712c06ee948929db6c6f7c2cc1221112dcc80 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 1 Sep 2020 15:18:02 +0200
Subject: [PATCH 0554/2658] ALSA: pcm: oss: Remove superfluous WARN_ON() for
 mulaw sanity check

commit 949a1ebe8cea7b342085cb6a4946b498306b9493 upstream.

The PCM OSS mulaw plugin has a check of the format of the counter part
whether it's a linear format.  The check is with snd_BUG_ON() that
emits WARN_ON() when the debug config is set, and it confuses
syzkaller as if it were a serious issue.  Let's drop snd_BUG_ON() for
avoiding that.

While we're at it, correct the error code to a more suitable, EINVAL.

Reported-by: syzbot+23b22dc2e0b81cbfcc95@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200901131802.18157-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/oss/mulaw.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/core/oss/mulaw.c b/sound/core/oss/mulaw.c
index 3788906421a7..fe27034f2846 100644
--- a/sound/core/oss/mulaw.c
+++ b/sound/core/oss/mulaw.c
@@ -329,8 +329,8 @@ int snd_pcm_plugin_build_mulaw(struct snd_pcm_substream *plug,
 		snd_BUG();
 		return -EINVAL;
 	}
-	if (snd_BUG_ON(!snd_pcm_format_linear(format->format)))
-		return -ENXIO;
+	if (!snd_pcm_format_linear(format->format))
+		return -EINVAL;
 
 	err = snd_pcm_plugin_build(plug, "Mu-Law<->linear conversion",
 				   src_format, dst_format,

From 1803dd04d563472d075ebf0543d0e98cff2261d8 Mon Sep 17 00:00:00 2001
From: Ye Bin <yebin10@huawei.com>
Date: Tue, 1 Sep 2020 14:25:42 +0800
Subject: [PATCH 0555/2658] dm cache metadata: Avoid returning cmd->bm wild
 pointer on error

commit d16ff19e69ab57e08bf908faaacbceaf660249de upstream.

Maybe __create_persistent_data_objects() caller will use PTR_ERR as a
pointer, it will lead to some strange things.

Signed-off-by: Ye Bin <yebin10@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-cache-metadata.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
index 905badc6cb17..216675b96e02 100644
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -501,12 +501,16 @@ static int __create_persistent_data_objects(struct dm_cache_metadata *cmd,
 					  CACHE_MAX_CONCURRENT_LOCKS);
 	if (IS_ERR(cmd->bm)) {
 		DMERR("could not create block manager");
-		return PTR_ERR(cmd->bm);
+		r = PTR_ERR(cmd->bm);
+		cmd->bm = NULL;
+		return r;
 	}
 
 	r = __open_or_format_metadata(cmd, may_format_device);
-	if (r)
+	if (r) {
 		dm_block_manager_destroy(cmd->bm);
+		cmd->bm = NULL;
+	}
 
 	return r;
 }

From f17038d6f4211e6c658c0ec1cf1bb201fb52af15 Mon Sep 17 00:00:00 2001
From: Ye Bin <yebin10@huawei.com>
Date: Tue, 1 Sep 2020 14:25:43 +0800
Subject: [PATCH 0556/2658] dm thin metadata: Avoid returning cmd->bm wild
 pointer on error

commit 219403d7e56f9b716ad80ab87db85d29547ee73e upstream.

Maybe __create_persistent_data_objects() caller will use PTR_ERR as a
pointer, it will lead to some strange things.

Signed-off-by: Ye Bin <yebin10@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-thin-metadata.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 2711aa965445..266d366fc2f0 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -700,12 +700,16 @@ static int __create_persistent_data_objects(struct dm_pool_metadata *pmd, bool f
 					  THIN_MAX_CONCURRENT_LOCKS);
 	if (IS_ERR(pmd->bm)) {
 		DMERR("could not create block manager");
-		return PTR_ERR(pmd->bm);
+		r = PTR_ERR(pmd->bm);
+		pmd->bm = NULL;
+		return r;
 	}
 
 	r = __open_or_format_metadata(pmd, format_device);
-	if (r)
+	if (r) {
 		dm_block_manager_destroy(pmd->bm);
+		pmd->bm = NULL;
+	}
 
 	return r;
 }

From 875166311ff9eeba0fba682f9f56cbf41c9f73b8 Mon Sep 17 00:00:00 2001
From: Tim Froidcoeur <tim.froidcoeur@tessares.net>
Date: Tue, 11 Aug 2020 20:33:23 +0200
Subject: [PATCH 0557/2658] net: refactor bind_bucket fastreuse into helper

commit 62ffc589abb176821662efc4525ee4ac0b9c3894 upstream.

Refactor the fastreuse update code in inet_csk_get_port into a small
helper function that can be called from other places.

Acked-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Tim Froidcoeur <tim.froidcoeur@tessares.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Tim Froidcoeur <tim.froidcoeur@tessares.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/inet_connection_sock.h |  4 +++
 net/ipv4/inet_connection_sock.c    | 46 ++++++++++++++++++------------
 2 files changed, 32 insertions(+), 18 deletions(-)

diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 72599bbc8255..a77a37c6349d 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -319,5 +319,9 @@ int inet_csk_compat_getsockopt(struct sock *sk, int level, int optname,
 int inet_csk_compat_setsockopt(struct sock *sk, int level, int optname,
 			       char __user *optval, unsigned int optlen);
 
+/* update the fast reuse flag when adding a socket */
+void inet_csk_update_fastreuse(struct inet_bind_bucket *tb,
+			       struct sock *sk);
+
 struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu);
 #endif /* _INET_CONNECTION_SOCK_H */
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 0b6a72428bc2..4b50bcbc6100 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -87,6 +87,31 @@ int inet_csk_bind_conflict(const struct sock *sk,
 }
 EXPORT_SYMBOL_GPL(inet_csk_bind_conflict);
 
+void inet_csk_update_fastreuse(struct inet_bind_bucket *tb,
+			       struct sock *sk)
+{
+	kuid_t uid = sock_i_uid(sk);
+
+	if (hlist_empty(&tb->owners)) {
+		if (sk->sk_reuse && sk->sk_state != TCP_LISTEN)
+			tb->fastreuse = 1;
+		else
+			tb->fastreuse = 0;
+		if (sk->sk_reuseport) {
+			tb->fastreuseport = 1;
+			tb->fastuid = uid;
+		} else
+			tb->fastreuseport = 0;
+	} else {
+		if (tb->fastreuse &&
+		    (!sk->sk_reuse || sk->sk_state == TCP_LISTEN))
+			tb->fastreuse = 0;
+		if (tb->fastreuseport &&
+		    (!sk->sk_reuseport || !uid_eq(tb->fastuid, uid)))
+			tb->fastreuseport = 0;
+	}
+}
+
 /* Obtain a reference to a local port for the given sock,
  * if snum is zero it means select any available local port.
  */
@@ -223,24 +248,9 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum)
 	if (!tb && (tb = inet_bind_bucket_create(hashinfo->bind_bucket_cachep,
 					net, head, snum)) == NULL)
 		goto fail_unlock;
-	if (hlist_empty(&tb->owners)) {
-		if (sk->sk_reuse && sk->sk_state != TCP_LISTEN)
-			tb->fastreuse = 1;
-		else
-			tb->fastreuse = 0;
-		if (sk->sk_reuseport) {
-			tb->fastreuseport = 1;
-			tb->fastuid = uid;
-		} else
-			tb->fastreuseport = 0;
-	} else {
-		if (tb->fastreuse &&
-		    (!sk->sk_reuse || sk->sk_state == TCP_LISTEN))
-			tb->fastreuse = 0;
-		if (tb->fastreuseport &&
-		    (!sk->sk_reuseport || !uid_eq(tb->fastuid, uid)))
-			tb->fastreuseport = 0;
-	}
+
+	inet_csk_update_fastreuse(tb, sk);
+
 success:
 	if (!inet_csk(sk)->icsk_bind_hash)
 		inet_bind_hash(sk, tb, snum);

From 8966400080b709c63f82ca5239884d97495b1301 Mon Sep 17 00:00:00 2001
From: Tim Froidcoeur <tim.froidcoeur@tessares.net>
Date: Tue, 11 Aug 2020 20:33:24 +0200
Subject: [PATCH 0558/2658] net: initialize fastreuse on inet_inherit_port

commit d76f3351cea2d927fdf70dd7c06898235035e84e upstream.

In the case of TPROXY, bind_conflict optimizations for SO_REUSEADDR or
SO_REUSEPORT are broken, possibly resulting in O(n) instead of O(1) bind
behaviour or in the incorrect reuse of a bind.

the kernel keeps track for each bind_bucket if all sockets in the
bind_bucket support SO_REUSEADDR or SO_REUSEPORT in two fastreuse flags.
These flags allow skipping the costly bind_conflict check when possible
(meaning when all sockets have the proper SO_REUSE option).

For every socket added to a bind_bucket, these flags need to be updated.
As soon as a socket that does not support reuse is added, the flag is
set to false and will never go back to true, unless the bind_bucket is
deleted.

Note that there is no mechanism to re-evaluate these flags when a socket
is removed (this might make sense when removing a socket that would not
allow reuse; this leaves room for a future patch).

For this optimization to work, it is mandatory that these flags are
properly initialized and updated.

When a child socket is created from a listen socket in
__inet_inherit_port, the TPROXY case could create a new bind bucket
without properly initializing these flags, thus preventing the
optimization to work. Alternatively, a socket not allowing reuse could
be added to an existing bind bucket without updating the flags, causing
bind_conflict to never be called as it should.

Call inet_csk_update_fastreuse when __inet_inherit_port decides to create
a new bind_bucket or use a different bind_bucket than the one of the
listen socket.

Fixes: 093d282321da ("tproxy: fix hash locking issue when using port redirection in __inet_inherit_port()")
Acked-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Tim Froidcoeur <tim.froidcoeur@tessares.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Tim Froidcoeur <tim.froidcoeur@tessares.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/inet_hashtables.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 33d1e1274323..d1864e806788 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -160,6 +160,7 @@ int __inet_inherit_port(const struct sock *sk, struct sock *child)
 				return -ENOMEM;
 			}
 		}
+		inet_csk_update_fastreuse(tb, child);
 	}
 	inet_bind_hash(child, tb, port);
 	spin_unlock(&head->lock);

From fe8c92234ea591c9970e3aff339732ed22692c6e Mon Sep 17 00:00:00 2001
From: Mrinal Pandey <mrinalmni@gmail.com>
Date: Fri, 4 Sep 2020 16:35:52 -0700
Subject: [PATCH 0559/2658] checkpatch: fix the usage of capture group ( ... )

commit 13e45417cedbfc44b1926124b1846f5ee8c6ba4a upstream.

The usage of "capture group (...)" in the immediate condition after `&&`
results in `$1` being uninitialized.  This issues a warning "Use of
uninitialized value $1 in regexp compilation at ./scripts/checkpatch.pl
line 2638".

I noticed this bug while running checkpatch on the set of commits from
v5.7 to v5.8-rc1 of the kernel on the commits with a diff content in
their commit message.

This bug was introduced in the script by commit e518e9a59ec3
("checkpatch: emit an error when there's a diff in a changelog").  It
has been in the script since then.

The author intended to store the match made by capture group in variable
`$1`.  This should have contained the name of the file as `[\w/]+`
matched.  However, this couldn't be accomplished due to usage of capture
group and `$1` in the same regular expression.

Fix this by placing the capture group in the condition before `&&`.
Thus, `$1` can be initialized to the text that capture group matches
thereby setting it to the desired and required value.

Fixes: e518e9a59ec3 ("checkpatch: emit an error when there's a diff in a changelog")
Signed-off-by: Mrinal Pandey <mrinalmni@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Reviewed-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Cc: Joe Perches <joe@perches.com>
Link: https://lkml.kernel.org/r/20200714032352.f476hanaj2dlmiot@mrinalpandey
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 scripts/checkpatch.pl | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 02996be239bc..2951d2622489 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -2343,8 +2343,8 @@ sub process {
 
 # Check if the commit log has what seems like a diff which can confuse patch
 		if ($in_commit_log && !$commit_log_has_diff &&
-		    (($line =~ m@^\s+diff\b.*a/[\w/]+@ &&
-		      $line =~ m@^\s+diff\b.*a/([\w/]+)\s+b/$1\b@) ||
+		    (($line =~ m@^\s+diff\b.*a/([\w/]+)@ &&
+		      $line =~ m@^\s+diff\b.*a/[\w/]+\s+b/$1\b@) ||
 		     $line =~ m@^\s*(?:\-\-\-\s+a/|\+\+\+\s+b/)@ ||
 		     $line =~ m/^\s*\@\@ \-\d+,\d+ \+\d+,\d+ \@\@/)) {
 			ERROR("DIFF_IN_COMMIT_MSG",

From 81008bc9660070e1ccc9577b335512aabdf8f384 Mon Sep 17 00:00:00 2001
From: Muchun Song <songmuchun@bytedance.com>
Date: Fri, 4 Sep 2020 16:36:13 -0700
Subject: [PATCH 0560/2658] mm/hugetlb: fix a race between hugetlb sysctl
 handlers

commit 17743798d81238ab13050e8e2833699b54e15467 upstream.

There is a race between the assignment of `table->data` and write value
to the pointer of `table->data` in the __do_proc_doulongvec_minmax() on
the other thread.

  CPU0:                                 CPU1:
                                        proc_sys_write
  hugetlb_sysctl_handler                  proc_sys_call_handler
  hugetlb_sysctl_handler_common             hugetlb_sysctl_handler
    table->data = &tmp;                       hugetlb_sysctl_handler_common
                                                table->data = &tmp;
      proc_doulongvec_minmax
        do_proc_doulongvec_minmax           sysctl_head_finish
          __do_proc_doulongvec_minmax         unuse_table
            i = table->data;
            *i = val;  // corrupt CPU1's stack

Fix this by duplicating the `table`, and only update the duplicate of
it.  And introduce a helper of proc_hugetlb_doulongvec_minmax() to
simplify the code.

The following oops was seen:

    BUG: kernel NULL pointer dereference, address: 0000000000000000
    #PF: supervisor instruction fetch in kernel mode
    #PF: error_code(0x0010) - not-present page
    Code: Bad RIP value.
    ...
    Call Trace:
     ? set_max_huge_pages+0x3da/0x4f0
     ? alloc_pool_huge_page+0x150/0x150
     ? proc_doulongvec_minmax+0x46/0x60
     ? hugetlb_sysctl_handler_common+0x1c7/0x200
     ? nr_hugepages_store+0x20/0x20
     ? copy_fd_bitmaps+0x170/0x170
     ? hugetlb_sysctl_handler+0x1e/0x20
     ? proc_sys_call_handler+0x2f1/0x300
     ? unregister_sysctl_table+0xb0/0xb0
     ? __fd_install+0x78/0x100
     ? proc_sys_write+0x14/0x20
     ? __vfs_write+0x4d/0x90
     ? vfs_write+0xef/0x240
     ? ksys_write+0xc0/0x160
     ? __ia32_sys_read+0x50/0x50
     ? __close_fd+0x129/0x150
     ? __x64_sys_write+0x43/0x50
     ? do_syscall_64+0x6c/0x200
     ? entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: e5ff215941d5 ("hugetlb: multiple hstates for multiple page sizes")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Andi Kleen <ak@linux.intel.com>
Link: http://lkml.kernel.org/r/20200828031146.43035-1-songmuchun@bytedance.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/hugetlb.c | 26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index baac9a09ec0a..44970b17f4fe 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2812,6 +2812,22 @@ static unsigned int cpuset_mems_nr(unsigned int *array)
 }
 
 #ifdef CONFIG_SYSCTL
+static int proc_hugetlb_doulongvec_minmax(struct ctl_table *table, int write,
+					  void *buffer, size_t *length,
+					  loff_t *ppos, unsigned long *out)
+{
+	struct ctl_table dup_table;
+
+	/*
+	 * In order to avoid races with __do_proc_doulongvec_minmax(), we
+	 * can duplicate the @table and alter the duplicate of it.
+	 */
+	dup_table = *table;
+	dup_table.data = out;
+
+	return proc_doulongvec_minmax(&dup_table, write, buffer, length, ppos);
+}
+
 static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
 			 struct ctl_table *table, int write,
 			 void __user *buffer, size_t *length, loff_t *ppos)
@@ -2823,9 +2839,8 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
 	if (!hugepages_supported())
 		return -ENOTSUPP;
 
-	table->data = &tmp;
-	table->maxlen = sizeof(unsigned long);
-	ret = proc_doulongvec_minmax(table, write, buffer, length, ppos);
+	ret = proc_hugetlb_doulongvec_minmax(table, write, buffer, length, ppos,
+					     &tmp);
 	if (ret)
 		goto out;
 
@@ -2869,9 +2884,8 @@ int hugetlb_overcommit_handler(struct ctl_table *table, int write,
 	if (write && hstate_is_gigantic(h))
 		return -EINVAL;
 
-	table->data = &tmp;
-	table->maxlen = sizeof(unsigned long);
-	ret = proc_doulongvec_minmax(table, write, buffer, length, ppos);
+	ret = proc_hugetlb_doulongvec_minmax(table, write, buffer, length, ppos,
+					     &tmp);
 	if (ret)
 		goto out;
 

From ea38ab18221e405c0db9c822f0f779a8c3657f5f Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Wed, 19 Aug 2020 10:46:48 +0200
Subject: [PATCH 0561/2658] cfg80211: regulatory: reject invalid hints

commit 47caf685a6854593348f216e0b489b71c10cbe03 upstream.

Reject invalid hints early in order to not cause a kernel
WARN later if they're restored to or similar.

Reported-by: syzbot+d451401ffd00a60677ee@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=d451401ffd00a60677ee
Link: https://lore.kernel.org/r/20200819084648.13956-1-johannes@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/wireless/reg.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 91f0ea8cc3aa..edb3b64233e5 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2429,6 +2429,9 @@ int regulatory_hint_user(const char *alpha2,
 	if (WARN_ON(!alpha2))
 		return -EINVAL;
 
+	if (!is_world_regdom(alpha2) && !is_an_alpha2(alpha2))
+		return -EINVAL;
+
 	request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
 	if (!request)
 		return -ENOMEM;

From 911df3b513d315f490e3c47701b45ea30b010cb1 Mon Sep 17 00:00:00 2001
From: Himadri Pandya <himadrispandya@gmail.com>
Date: Thu, 27 Aug 2020 12:23:55 +0530
Subject: [PATCH 0562/2658] net: usb: Fix uninit-was-stored issue in
 asix_read_phy_addr()

commit a092b7233f0e000cc6f2c71a49e2ecc6f917a5fc upstream.

The buffer size is 2 Bytes and we expect to receive the same amount of
data. But sometimes we receive less data and run into uninit-was-stored
issue upon read. Hence modify the error check on the return value to match
with the buffer size as a prevention.

Reported-and-tested by: syzbot+a7e220df5a81d1ab400e@syzkaller.appspotmail.com
Signed-off-by: Himadri Pandya <himadrispandya@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/asix_common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
index 2092ef6431f2..712765976a22 100644
--- a/drivers/net/usb/asix_common.c
+++ b/drivers/net/usb/asix_common.c
@@ -251,7 +251,7 @@ int asix_read_phy_addr(struct usbnet *dev, int internal)
 
 	netdev_dbg(dev->net, "asix_get_phy_addr()\n");
 
-	if (ret < 0) {
+	if (ret < 2) {
 		netdev_err(dev->net, "Error reading PHYID register: %02x\n", ret);
 		goto out;
 	}

From f0d8f9ff943e05d3025a85f420b99a063cd9aaef Mon Sep 17 00:00:00 2001
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Date: Sun, 2 Apr 2017 23:48:24 +0900
Subject: [PATCH 0563/2658] ALSA: firewire-digi00x: add support for console
 models of Digi00x series

[ Upstream commit 13e005f9f933a35b5e55c9d36f151efe2a8383ec ]

Digi00x series includes two types of unit; rack and console. As long as
reading information on config rom of Digi 002 console, 'MODEL_ID' field
has a different value from the one on Digi 002 rack.

We've already got a test report from users with Digi 003 rack. We can
assume that console type and rack type has different value in the field.

This commit adds a device entry for console type. For following commits,
this commit also adds a member to 'struct snd_digi00x' to identify console
type.

$ cd linux-firewire-utils/src
$ python2 ./crpp < /sys/bus/firewire/devices/fw1/config_rom
               ROM header and bus information block
               -----------------------------------------------------------------
400  0404f9d0  bus_info_length 4, crc_length 4, crc 63952
404  31333934  bus_name "1394"
408  60647002  irmc 0, cmc 1, isc 1, bmc 0, cyc_clk_acc 100, max_rec 7 (256)
40c  00a07e00  company_id 00a07e     |
410  00a30000  device_id 0000a30000  | EUI-64 00a07e0000a30000

               root directory
               -----------------------------------------------------------------
414  00058a39  directory_length 5, crc 35385
418  0c0043a0  node capabilities
41c  04000001  hardware version
420  0300a07e  vendor
424  81000007  --> descriptor leaf at 440
428  d1000001  --> unit directory at 42c

               unit directory at 42c
               -----------------------------------------------------------------
42c  00046674  directory_length 4, crc 26228
430  120000a3  specifier id
434  13000001  version
438  17000001  model
43c  81000007  --> descriptor leaf at 458

               descriptor leaf at 440
               -----------------------------------------------------------------
440  00055913  leaf_length 5, crc 22803
444  000050f2  descriptor_type 00, specifier_ID 50f2
448  80000000
44c  44696769
450  64657369
454  676e0000

               descriptor leaf at 458
               -----------------------------------------------------------------
458  0004a6fd  leaf_length 4, crc 42749
45c  00000000  textual descriptor
460  00000000  minimal ASCII
464  44696769  "Digi"
468  20303032  " 002"

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/firewire/digi00x/digi00x.c | 13 +++++++++++--
 sound/firewire/digi00x/digi00x.h |  1 +
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/sound/firewire/digi00x/digi00x.c b/sound/firewire/digi00x/digi00x.c
index 1f33b7a1fca4..6973a7ff1c50 100644
--- a/sound/firewire/digi00x/digi00x.c
+++ b/sound/firewire/digi00x/digi00x.c
@@ -13,7 +13,8 @@ MODULE_AUTHOR("Takashi Sakamoto <o-takashi@sakamocchi.jp>");
 MODULE_LICENSE("GPL v2");
 
 #define VENDOR_DIGIDESIGN	0x00a07e
-#define MODEL_DIGI00X		0x000002
+#define MODEL_CONSOLE		0x000001
+#define MODEL_RACK		0x000002
 
 static int name_card(struct snd_dg00x *dg00x)
 {
@@ -75,6 +76,8 @@ static int snd_dg00x_probe(struct fw_unit *unit,
 	spin_lock_init(&dg00x->lock);
 	init_waitqueue_head(&dg00x->hwdep_wait);
 
+	dg00x->is_console = entry->model_id == MODEL_CONSOLE;
+
 	err = name_card(dg00x);
 	if (err < 0)
 		goto error;
@@ -138,7 +141,13 @@ static const struct ieee1394_device_id snd_dg00x_id_table[] = {
 		.match_flags = IEEE1394_MATCH_VENDOR_ID |
 			       IEEE1394_MATCH_MODEL_ID,
 		.vendor_id = VENDOR_DIGIDESIGN,
-		.model_id = MODEL_DIGI00X,
+		.model_id = MODEL_CONSOLE,
+	},
+	{
+		.match_flags = IEEE1394_MATCH_VENDOR_ID |
+			       IEEE1394_MATCH_MODEL_ID,
+		.vendor_id = VENDOR_DIGIDESIGN,
+		.model_id = MODEL_RACK,
 	},
 	{}
 };
diff --git a/sound/firewire/digi00x/digi00x.h b/sound/firewire/digi00x/digi00x.h
index 907e73993677..d641a0cf077a 100644
--- a/sound/firewire/digi00x/digi00x.h
+++ b/sound/firewire/digi00x/digi00x.h
@@ -57,6 +57,7 @@ struct snd_dg00x {
 	/* For asynchronous MIDI controls. */
 	struct snd_rawmidi_substream *in_control;
 	struct snd_fw_async_midi_port out_control;
+	bool is_console;
 };
 
 #define DG00X_ADDR_BASE		0xffffe0000000ull

From 5c0d2d94d48e56d0b30a5186a7549a78b1cc3a49 Mon Sep 17 00:00:00 2001
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Date: Sun, 23 Aug 2020 16:55:45 +0900
Subject: [PATCH 0564/2658] ALSA: firewire-digi00x: exclude Avid Adrenaline
 from detection

[ Upstream commit acd46a6b6de88569654567810acad2b0a0a25cea ]

Avid Adrenaline is reported that ALSA firewire-digi00x driver is bound to.
However, as long as he investigated, the design of this model is hardly
similar to the one of Digi 00x family. It's better to exclude the model
from modalias of ALSA firewire-digi00x driver.

This commit changes device entries so that the model is excluded.

$ python3 crpp < ~/git/am-config-rom/misc/avid-adrenaline.img
               ROM header and bus information block
               -----------------------------------------------------------------
400  04203a9c  bus_info_length 4, crc_length 32, crc 15004
404  31333934  bus_name "1394"
408  e064a002  irmc 1, cmc 1, isc 1, bmc 0, cyc_clk_acc 100, max_rec 10 (2048)
40c  00a07e01  company_id 00a07e     |
410  00085257  device_id 0100085257  | EUI-64 00a07e0100085257

               root directory
               -----------------------------------------------------------------
414  0005d08c  directory_length 5, crc 53388
418  0300a07e  vendor
41c  8100000c  --> descriptor leaf at 44c
420  0c008380  node capabilities
424  8d000002  --> eui-64 leaf at 42c
428  d1000004  --> unit directory at 438

               eui-64 leaf at 42c
               -----------------------------------------------------------------
42c  0002410f  leaf_length 2, crc 16655
430  00a07e01  company_id 00a07e     |
434  00085257  device_id 0100085257  | EUI-64 00a07e0100085257

               unit directory at 438
               -----------------------------------------------------------------
438  0004d6c9  directory_length 4, crc 54985
43c  1200a02d  specifier id: 1394 TA
440  13014001  version: Vender Unique and AV/C
444  17000001  model
448  81000009  --> descriptor leaf at 46c

               descriptor leaf at 44c
               -----------------------------------------------------------------
44c  00077205  leaf_length 7, crc 29189
450  00000000  textual descriptor
454  00000000  minimal ASCII
458  41766964  "Avid"
45c  20546563  " Tec"
460  686e6f6c  "hnol"
464  6f677900  "ogy"
468  00000000

               descriptor leaf at 46c
               -----------------------------------------------------------------
46c  000599a5  leaf_length 5, crc 39333
470  00000000  textual descriptor
474  00000000  minimal ASCII
478  41647265  "Adre"
47c  6e616c69  "nali"
480  6e650000  "ne"

Reported-by: Simon Wood <simon@mungewell.org>
Fixes: 9edf723fd858 ("ALSA: firewire-digi00x: add skeleton for Digi 002/003 family")
Cc: <stable@vger.kernel.org> # 4.4+
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20200823075545.56305-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/firewire/digi00x/digi00x.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sound/firewire/digi00x/digi00x.c b/sound/firewire/digi00x/digi00x.c
index 6973a7ff1c50..659e8224a4de 100644
--- a/sound/firewire/digi00x/digi00x.c
+++ b/sound/firewire/digi00x/digi00x.c
@@ -15,6 +15,7 @@ MODULE_LICENSE("GPL v2");
 #define VENDOR_DIGIDESIGN	0x00a07e
 #define MODEL_CONSOLE		0x000001
 #define MODEL_RACK		0x000002
+#define SPEC_VERSION		0x000001
 
 static int name_card(struct snd_dg00x *dg00x)
 {
@@ -139,14 +140,18 @@ static const struct ieee1394_device_id snd_dg00x_id_table[] = {
 	/* Both of 002/003 use the same ID. */
 	{
 		.match_flags = IEEE1394_MATCH_VENDOR_ID |
+			       IEEE1394_MATCH_VERSION |
 			       IEEE1394_MATCH_MODEL_ID,
 		.vendor_id = VENDOR_DIGIDESIGN,
+		.version = SPEC_VERSION,
 		.model_id = MODEL_CONSOLE,
 	},
 	{
 		.match_flags = IEEE1394_MATCH_VENDOR_ID |
+			       IEEE1394_MATCH_VERSION |
 			       IEEE1394_MATCH_MODEL_ID,
 		.vendor_id = VENDOR_DIGIDESIGN,
+		.version = SPEC_VERSION,
 		.model_id = MODEL_RACK,
 	},
 	{}

From 6809d4c613931723996cdc03f471629abfbdac64 Mon Sep 17 00:00:00 2001
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Date: Sun, 23 Aug 2020 16:55:37 +0900
Subject: [PATCH 0565/2658] ALSA; firewire-tascam: exclude Tascam FE-8 from
 detection

Tascam FE-8 is known to support communication by asynchronous transaction
only. The support can be implemented in userspace application and
snd-firewire-ctl-services project has the support. However, ALSA
firewire-tascam driver is bound to the model.

This commit changes device entries so that the model is excluded. In a
commit 53b3ffee7885 ("ALSA: firewire-tascam: change device probing
processing"), I addressed to the concern that version field in
configuration differs depending on installed firmware. However, as long
as I checked, the version number is fixed. It's safe to return version
number back to modalias.

Fixes: 53b3ffee7885 ("ALSA: firewire-tascam: change device probing processing")
Cc: <stable@vger.kernel.org> # 4.4+
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20200823075537.56255-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 sound/firewire/tascam/tascam.c | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/sound/firewire/tascam/tascam.c b/sound/firewire/tascam/tascam.c
index ee0bc1839508..a4143f45c7f7 100644
--- a/sound/firewire/tascam/tascam.c
+++ b/sound/firewire/tascam/tascam.c
@@ -172,11 +172,39 @@ static void snd_tscm_remove(struct fw_unit *unit)
 }
 
 static const struct ieee1394_device_id snd_tscm_id_table[] = {
+	// Tascam, FW-1884.
 	{
 		.match_flags = IEEE1394_MATCH_VENDOR_ID |
-			       IEEE1394_MATCH_SPECIFIER_ID,
+			       IEEE1394_MATCH_SPECIFIER_ID |
+			       IEEE1394_MATCH_VERSION,
 		.vendor_id = 0x00022e,
 		.specifier_id = 0x00022e,
+		.version = 0x800000,
+	},
+	// Tascam, FE-8 (.version = 0x800001)
+	// This kernel module doesn't support FE-8 because the most of features
+	// can be implemented in userspace without any specific support of this
+	// module.
+	//
+	// .version = 0x800002 is unknown.
+	//
+	// Tascam, FW-1082.
+	{
+		.match_flags = IEEE1394_MATCH_VENDOR_ID |
+			       IEEE1394_MATCH_SPECIFIER_ID |
+			       IEEE1394_MATCH_VERSION,
+		.vendor_id = 0x00022e,
+		.specifier_id = 0x00022e,
+		.version = 0x800003,
+	},
+	// Tascam, FW-1804.
+	{
+		.match_flags = IEEE1394_MATCH_VENDOR_ID |
+			       IEEE1394_MATCH_SPECIFIER_ID |
+			       IEEE1394_MATCH_VERSION,
+		.vendor_id = 0x00022e,
+		.specifier_id = 0x00022e,
+		.version = 0x800004,
 	},
 	/* FE-08 requires reverse-engineering because it just has faders. */
 	{}

From b1ad248fdbfaba348a7dba66abde89c6c3f90ea4 Mon Sep 17 00:00:00 2001
From: Fabian Frederick <fabf@skynet.be>
Date: Mon, 27 Feb 2017 14:27:52 -0800
Subject: [PATCH 0566/2658] fs/affs: use octal for permissions

[ Upstream commit 1bafd6f164d9ec9bf2fa9829051fbeb36342be0b ]

According to commit f90774e1fd27 ("checkpatch: look for symbolic
permissions and suggest octal instead")

Link: http://lkml.kernel.org/r/20170109191208.6085-5-fabf@skynet.be
Signed-off-by: Fabian Frederick <fabf@skynet.be>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/affs/amigaffs.c | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/fs/affs/amigaffs.c b/fs/affs/amigaffs.c
index 5fa92bc790ef..a148c7ecb35d 100644
--- a/fs/affs/amigaffs.c
+++ b/fs/affs/amigaffs.c
@@ -390,23 +390,23 @@ prot_to_mode(u32 prot)
 	umode_t mode = 0;
 
 	if (!(prot & FIBF_NOWRITE))
-		mode |= S_IWUSR;
+		mode |= 0200;
 	if (!(prot & FIBF_NOREAD))
-		mode |= S_IRUSR;
+		mode |= 0400;
 	if (!(prot & FIBF_NOEXECUTE))
-		mode |= S_IXUSR;
+		mode |= 0100;
 	if (prot & FIBF_GRP_WRITE)
-		mode |= S_IWGRP;
+		mode |= 0020;
 	if (prot & FIBF_GRP_READ)
-		mode |= S_IRGRP;
+		mode |= 0040;
 	if (prot & FIBF_GRP_EXECUTE)
-		mode |= S_IXGRP;
+		mode |= 0010;
 	if (prot & FIBF_OTR_WRITE)
-		mode |= S_IWOTH;
+		mode |= 0002;
 	if (prot & FIBF_OTR_READ)
-		mode |= S_IROTH;
+		mode |= 0004;
 	if (prot & FIBF_OTR_EXECUTE)
-		mode |= S_IXOTH;
+		mode |= 0001;
 
 	return mode;
 }
@@ -417,23 +417,23 @@ mode_to_prot(struct inode *inode)
 	u32 prot = AFFS_I(inode)->i_protect;
 	umode_t mode = inode->i_mode;
 
-	if (!(mode & S_IXUSR))
+	if (!(mode & 0100))
 		prot |= FIBF_NOEXECUTE;
-	if (!(mode & S_IRUSR))
+	if (!(mode & 0400))
 		prot |= FIBF_NOREAD;
-	if (!(mode & S_IWUSR))
+	if (!(mode & 0200))
 		prot |= FIBF_NOWRITE;
-	if (mode & S_IXGRP)
+	if (mode & 0010)
 		prot |= FIBF_GRP_EXECUTE;
-	if (mode & S_IRGRP)
+	if (mode & 0040)
 		prot |= FIBF_GRP_READ;
-	if (mode & S_IWGRP)
+	if (mode & 0020)
 		prot |= FIBF_GRP_WRITE;
-	if (mode & S_IXOTH)
+	if (mode & 0001)
 		prot |= FIBF_OTR_EXECUTE;
-	if (mode & S_IROTH)
+	if (mode & 0004)
 		prot |= FIBF_OTR_READ;
-	if (mode & S_IWOTH)
+	if (mode & 0002)
 		prot |= FIBF_OTR_WRITE;
 
 	AFFS_I(inode)->i_protect = prot;

From 91665d7dcf794f28ae1390e1754b340b94de05f2 Mon Sep 17 00:00:00 2001
From: Max Staudt <max@enpas.org>
Date: Thu, 27 Aug 2020 17:49:00 +0200
Subject: [PATCH 0567/2658] affs: fix basic permission bits to actually work

[ Upstream commit d3a84a8d0dde4e26bc084b36ffcbdc5932ac85e2 ]

The basic permission bits (protection bits in AmigaOS) have been broken
in Linux' AFFS - it would only set bits, but never delete them.
Also, contrary to the documentation, the Archived bit was not handled.

Let's fix this for good, and set the bits such that Linux and classic
AmigaOS can coexist in the most peaceful manner.

Also, update the documentation to represent the current state of things.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Max Staudt <max@enpas.org>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/filesystems/affs.txt | 16 ++++++++++------
 fs/affs/amigaffs.c                 | 27 +++++++++++++++++++++++++++
 fs/affs/file.c                     | 26 +++++++++++++++++++++++++-
 3 files changed, 62 insertions(+), 7 deletions(-)

diff --git a/Documentation/filesystems/affs.txt b/Documentation/filesystems/affs.txt
index 71b63c2b9841..a8f1a58e3692 100644
--- a/Documentation/filesystems/affs.txt
+++ b/Documentation/filesystems/affs.txt
@@ -93,13 +93,15 @@ The Amiga protection flags RWEDRWEDHSPARWED are handled as follows:
 
   - R maps to r for user, group and others. On directories, R implies x.
 
-  - If both W and D are allowed, w will be set.
+  - W maps to w.
 
   - E maps to x.
 
-  - H and P are always retained and ignored under Linux.
+  - D is ignored.
 
-  - A is always reset when a file is written to.
+  - H, S and P are always retained and ignored under Linux.
+
+  - A is cleared when a file is written to.
 
 User id and group id will be used unless set[gu]id are given as mount
 options. Since most of the Amiga file systems are single user systems
@@ -111,11 +113,13 @@ Linux -> Amiga:
 
 The Linux rwxrwxrwx file mode is handled as follows:
 
-  - r permission will set R for user, group and others.
+  - r permission will allow R for user, group and others.
+
+  - w permission will allow W for user, group and others.
 
-  - w permission will set W and D for user, group and others.
+  - x permission of the user will allow E for plain files.
 
-  - x permission of the user will set E for plain files.
+  - D will be allowed for user, group and others.
 
   - All other flags (suid, sgid, ...) are ignored and will
     not be retained.
diff --git a/fs/affs/amigaffs.c b/fs/affs/amigaffs.c
index a148c7ecb35d..c1b344e56e85 100644
--- a/fs/affs/amigaffs.c
+++ b/fs/affs/amigaffs.c
@@ -417,24 +417,51 @@ mode_to_prot(struct inode *inode)
 	u32 prot = AFFS_I(inode)->i_protect;
 	umode_t mode = inode->i_mode;
 
+	/*
+	 * First, clear all RWED bits for owner, group, other.
+	 * Then, recalculate them afresh.
+	 *
+	 * We'll always clear the delete-inhibit bit for the owner, as that is
+	 * the classic single-user mode AmigaOS protection bit and we need to
+	 * stay compatible with all scenarios.
+	 *
+	 * Since multi-user AmigaOS is an extension, we'll only set the
+	 * delete-allow bit if any of the other bits in the same user class
+	 * (group/other) are used.
+	 */
+	prot &= ~(FIBF_NOEXECUTE | FIBF_NOREAD
+		  | FIBF_NOWRITE | FIBF_NODELETE
+		  | FIBF_GRP_EXECUTE | FIBF_GRP_READ
+		  | FIBF_GRP_WRITE   | FIBF_GRP_DELETE
+		  | FIBF_OTR_EXECUTE | FIBF_OTR_READ
+		  | FIBF_OTR_WRITE   | FIBF_OTR_DELETE);
+
+	/* Classic single-user AmigaOS flags. These are inverted. */
 	if (!(mode & 0100))
 		prot |= FIBF_NOEXECUTE;
 	if (!(mode & 0400))
 		prot |= FIBF_NOREAD;
 	if (!(mode & 0200))
 		prot |= FIBF_NOWRITE;
+
+	/* Multi-user extended flags. Not inverted. */
 	if (mode & 0010)
 		prot |= FIBF_GRP_EXECUTE;
 	if (mode & 0040)
 		prot |= FIBF_GRP_READ;
 	if (mode & 0020)
 		prot |= FIBF_GRP_WRITE;
+	if (mode & 0070)
+		prot |= FIBF_GRP_DELETE;
+
 	if (mode & 0001)
 		prot |= FIBF_OTR_EXECUTE;
 	if (mode & 0004)
 		prot |= FIBF_OTR_READ;
 	if (mode & 0002)
 		prot |= FIBF_OTR_WRITE;
+	if (mode & 0007)
+		prot |= FIBF_OTR_DELETE;
 
 	AFFS_I(inode)->i_protect = prot;
 }
diff --git a/fs/affs/file.c b/fs/affs/file.c
index 659c579c4588..38e0fd4caf2b 100644
--- a/fs/affs/file.c
+++ b/fs/affs/file.c
@@ -426,6 +426,24 @@ static int affs_write_begin(struct file *file, struct address_space *mapping,
 	return ret;
 }
 
+static int affs_write_end(struct file *file, struct address_space *mapping,
+			  loff_t pos, unsigned int len, unsigned int copied,
+			  struct page *page, void *fsdata)
+{
+	struct inode *inode = mapping->host;
+	int ret;
+
+	ret = generic_write_end(file, mapping, pos, len, copied, page, fsdata);
+
+	/* Clear Archived bit on file writes, as AmigaOS would do */
+	if (AFFS_I(inode)->i_protect & FIBF_ARCHIVED) {
+		AFFS_I(inode)->i_protect &= ~FIBF_ARCHIVED;
+		mark_inode_dirty(inode);
+	}
+
+	return ret;
+}
+
 static sector_t _affs_bmap(struct address_space *mapping, sector_t block)
 {
 	return generic_block_bmap(mapping,block,affs_get_block);
@@ -435,7 +453,7 @@ const struct address_space_operations affs_aops = {
 	.readpage = affs_readpage,
 	.writepage = affs_writepage,
 	.write_begin = affs_write_begin,
-	.write_end = generic_write_end,
+	.write_end = affs_write_end,
 	.direct_IO = affs_direct_IO,
 	.bmap = _affs_bmap
 };
@@ -793,6 +811,12 @@ static int affs_write_end_ofs(struct file *file, struct address_space *mapping,
 	if (tmp > inode->i_size)
 		inode->i_size = AFFS_I(inode)->mmu_private = tmp;
 
+	/* Clear Archived bit on file writes, as AmigaOS would do */
+	if (AFFS_I(inode)->i_protect & FIBF_ARCHIVED) {
+		AFFS_I(inode)->i_protect &= ~FIBF_ARCHIVED;
+		mark_inode_dirty(inode);
+	}
+
 err_first_bh:
 	unlock_page(page);
 	page_cache_release(page);

From 205895b86c11f9a2100a110ffb32ef0032085aea Mon Sep 17 00:00:00 2001
From: Yuusuke Ashizuka <ashiduka@fujitsu.com>
Date: Thu, 20 Aug 2020 18:43:07 +0900
Subject: [PATCH 0568/2658] ravb: Fixed to be able to unload modules

commit 1838d6c62f57836639bd3d83e7855e0ee4f6defc upstream.

When this driver is built as a module, I cannot rmmod it after insmoding
it.
This is because that this driver calls ravb_mdio_init() at the time of
probe, and module->refcnt is incremented by alloc_mdio_bitbang() called
after that.
Therefore, even if ifup is not performed, the driver is in use and rmmod
cannot be performed.

$ lsmod
Module                  Size  Used by
ravb                   40960  1
$ rmmod ravb
rmmod: ERROR: Module ravb is in use

Call ravb_mdio_init() at open and free_mdio_bitbang() at close, thereby
rmmod is possible in the ifdown state.

Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
Signed-off-by: Yuusuke Ashizuka <ashiduka@fujitsu.com>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/renesas/ravb_main.c | 110 +++++++++++------------
 1 file changed, 55 insertions(+), 55 deletions(-)

diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 460b29ac5fd8..d5bf0f275307 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1214,12 +1214,64 @@ static const struct ethtool_ops ravb_ethtool_ops = {
 	.get_ts_info		= ravb_get_ts_info,
 };
 
+/* MDIO bus init function */
+static int ravb_mdio_init(struct ravb_private *priv)
+{
+	struct platform_device *pdev = priv->pdev;
+	struct device *dev = &pdev->dev;
+	int error;
+
+	/* Bitbang init */
+	priv->mdiobb.ops = &bb_ops;
+
+	/* MII controller setting */
+	priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
+	if (!priv->mii_bus)
+		return -ENOMEM;
+
+	/* Hook up MII support for ethtool */
+	priv->mii_bus->name = "ravb_mii";
+	priv->mii_bus->parent = dev;
+	snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
+		 pdev->name, pdev->id);
+
+	/* Register MDIO bus */
+	error = of_mdiobus_register(priv->mii_bus, dev->of_node);
+	if (error)
+		goto out_free_bus;
+
+	return 0;
+
+out_free_bus:
+	free_mdio_bitbang(priv->mii_bus);
+	return error;
+}
+
+/* MDIO bus release function */
+static int ravb_mdio_release(struct ravb_private *priv)
+{
+	/* Unregister mdio bus */
+	mdiobus_unregister(priv->mii_bus);
+
+	/* Free bitbang info */
+	free_mdio_bitbang(priv->mii_bus);
+
+	return 0;
+}
+
 /* Network device open function for Ethernet AVB */
 static int ravb_open(struct net_device *ndev)
 {
 	struct ravb_private *priv = netdev_priv(ndev);
 	int error;
 
+	/* MDIO bus init */
+	error = ravb_mdio_init(priv);
+	if (error) {
+		netdev_err(ndev, "failed to initialize MDIO\n");
+		return error;
+	}
+
 	napi_enable(&priv->napi[RAVB_BE]);
 	napi_enable(&priv->napi[RAVB_NC]);
 
@@ -1268,6 +1320,7 @@ static int ravb_open(struct net_device *ndev)
 out_napi_off:
 	napi_disable(&priv->napi[RAVB_NC]);
 	napi_disable(&priv->napi[RAVB_BE]);
+	ravb_mdio_release(priv);
 	return error;
 }
 
@@ -1561,6 +1614,8 @@ static int ravb_close(struct net_device *ndev)
 	ravb_ring_free(ndev, RAVB_BE);
 	ravb_ring_free(ndev, RAVB_NC);
 
+	ravb_mdio_release(priv);
+
 	return 0;
 }
 
@@ -1664,51 +1719,6 @@ static const struct net_device_ops ravb_netdev_ops = {
 	.ndo_change_mtu		= eth_change_mtu,
 };
 
-/* MDIO bus init function */
-static int ravb_mdio_init(struct ravb_private *priv)
-{
-	struct platform_device *pdev = priv->pdev;
-	struct device *dev = &pdev->dev;
-	int error;
-
-	/* Bitbang init */
-	priv->mdiobb.ops = &bb_ops;
-
-	/* MII controller setting */
-	priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
-	if (!priv->mii_bus)
-		return -ENOMEM;
-
-	/* Hook up MII support for ethtool */
-	priv->mii_bus->name = "ravb_mii";
-	priv->mii_bus->parent = dev;
-	snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
-		 pdev->name, pdev->id);
-
-	/* Register MDIO bus */
-	error = of_mdiobus_register(priv->mii_bus, dev->of_node);
-	if (error)
-		goto out_free_bus;
-
-	return 0;
-
-out_free_bus:
-	free_mdio_bitbang(priv->mii_bus);
-	return error;
-}
-
-/* MDIO bus release function */
-static int ravb_mdio_release(struct ravb_private *priv)
-{
-	/* Unregister mdio bus */
-	mdiobus_unregister(priv->mii_bus);
-
-	/* Free bitbang info */
-	free_mdio_bitbang(priv->mii_bus);
-
-	return 0;
-}
-
 static const struct of_device_id ravb_match_table[] = {
 	{ .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 },
 	{ .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 },
@@ -1847,13 +1857,6 @@ static int ravb_probe(struct platform_device *pdev)
 		eth_hw_addr_random(ndev);
 	}
 
-	/* MDIO bus init */
-	error = ravb_mdio_init(priv);
-	if (error) {
-		dev_err(&pdev->dev, "failed to initialize MDIO\n");
-		goto out_dma_free;
-	}
-
 	netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64);
 	netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64);
 
@@ -1873,8 +1876,6 @@ static int ravb_probe(struct platform_device *pdev)
 out_napi_del:
 	netif_napi_del(&priv->napi[RAVB_NC]);
 	netif_napi_del(&priv->napi[RAVB_BE]);
-	ravb_mdio_release(priv);
-out_dma_free:
 	dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat,
 			  priv->desc_bat_dma);
 out_release:
@@ -1899,7 +1900,6 @@ static int ravb_remove(struct platform_device *pdev)
 	unregister_netdev(ndev);
 	netif_napi_del(&priv->napi[RAVB_NC]);
 	netif_napi_del(&priv->napi[RAVB_BE]);
-	ravb_mdio_release(priv);
 	pm_runtime_disable(&pdev->dev);
 	free_netdev(ndev);
 	platform_set_drvdata(pdev, NULL);

From 6a0543e7d3d2c7b9c46a3654d2f017f0e95619f7 Mon Sep 17 00:00:00 2001
From: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Date: Mon, 31 Aug 2020 22:37:09 +0800
Subject: [PATCH 0569/2658] net: ethernet: mlx4: Fix memory allocation in
 mlx4_buddy_init()

commit cbedcb044e9cc4e14bbe6658111224bb923094f4 upstream.

On machines with much memory (> 2 TByte) and log_mtts_per_seg == 0, a
max_order of 31 will be passed to mlx_buddy_init(), which results in
s = BITS_TO_LONGS(1 << 31) becoming a negative value, leading to
kvmalloc_array() failure when it is converted to size_t.

  mlx4_core 0000:b1:00.0: Failed to initialize memory region table, aborting
  mlx4_core: probe of 0000:b1:00.0 failed with error -12

Fix this issue by changing the left shifting operand from a signed literal to
an unsigned one.

Fixes: 225c7b1feef1 ("IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters")
Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx4/mr.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
index f01bc7ea3e44..00a105c63567 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
@@ -114,10 +114,13 @@ static int mlx4_buddy_init(struct mlx4_buddy *buddy, int max_order)
 		goto err_out;
 
 	for (i = 0; i <= buddy->max_order; ++i) {
-		s = BITS_TO_LONGS(1 << (buddy->max_order - i));
-		buddy->bits[i] = kvmalloc_array(s, sizeof(long), GFP_KERNEL | __GFP_ZERO);
-		if (!buddy->bits[i])
-			goto err_out_free;
+		s = BITS_TO_LONGS(1UL << (buddy->max_order - i));
+		buddy->bits[i] = kcalloc(s, sizeof (long), GFP_KERNEL | __GFP_NOWARN);
+		if (!buddy->bits[i]) {
+			buddy->bits[i] = vzalloc(s * sizeof(long));
+			if (!buddy->bits[i])
+				goto err_out_free;
+		}
 	}
 
 	set_bit(0, buddy->bits[buddy->max_order]);

From ac04e8bbda7fed997f122c47353f0c0c400273b0 Mon Sep 17 00:00:00 2001
From: Michael Chan <mchan@broadcom.com>
Date: Fri, 19 Feb 2016 19:43:21 -0500
Subject: [PATCH 0570/2658] bnxt_en: Failure to update PHY is not fatal
 condition.

commit ba41d46fe03223279054e58d570069fdc62fb768 upstream.

If we fail to update the PHY, we should print a warning and continue.
The current code to exit is buggy as it has not freed up the NIC
resources yet.

Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index a3949c1a0c23..0d7ed152504f 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -4623,7 +4623,7 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
 	if (link_re_init) {
 		rc = bnxt_update_phy_setting(bp);
 		if (rc)
-			goto open_err;
+			netdev_warn(bp->dev, "failed to update phy settings\n");
 	}
 
 	if (irq_re_init) {

From 1407518d9f11c512c3388fc0d65f88b0e0e3e586 Mon Sep 17 00:00:00 2001
From: Jakub Kicinski <kuba@kernel.org>
Date: Wed, 26 Aug 2020 12:40:07 -0700
Subject: [PATCH 0571/2658] bnxt: don't enable NAPI until rings are ready

commit 96ecdcc992eb7f468b2cf829b0f5408a1fad4668 upstream.

Netpoll can try to poll napi as soon as napi_enable() is called.
It crashes trying to access a doorbell which is still NULL:

 BUG: kernel NULL pointer dereference, address: 0000000000000000
 CPU: 59 PID: 6039 Comm: ethtool Kdump: loaded Tainted: G S                5.9.0-rc1-00469-g5fd99b5d9950-dirty #26
 RIP: 0010:bnxt_poll+0x121/0x1c0
 Code: c4 20 44 89 e0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 41 8b 86 a0 01 00 00 41 23 85 18 01 00 00 49 8b 96 a8 01 00 00 0d 00 00 00 24 <89> 02
41 f6 45 77 02 74 cb 49 8b ae d8 01 00 00 31 c0 c7 44 24 1a
  netpoll_poll_dev+0xbd/0x1a0
  __netpoll_send_skb+0x1b2/0x210
  netpoll_send_udp+0x2c9/0x406
  write_ext_msg+0x1d7/0x1f0
  console_unlock+0x23c/0x520
  vprintk_emit+0xe0/0x1d0
  printk+0x58/0x6f
  x86_vector_activate.cold+0xf/0x46
  __irq_domain_activate_irq+0x50/0x80
  __irq_domain_activate_irq+0x32/0x80
  __irq_domain_activate_irq+0x32/0x80
  irq_domain_activate_irq+0x25/0x40
  __setup_irq+0x2d2/0x700
  request_threaded_irq+0xfb/0x160
  __bnxt_open_nic+0x3b1/0x750
  bnxt_open_nic+0x19/0x30
  ethtool_set_channels+0x1ac/0x220
  dev_ethtool+0x11ba/0x2240
  dev_ioctl+0x1cf/0x390
  sock_do_ioctl+0x95/0x130

Reported-by: Rob Sherwood <rsher@fb.com>
Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 0d7ed152504f..2da1c2294645 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -4612,14 +4612,14 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
 		}
 	}
 
-	bnxt_enable_napi(bp);
-
 	rc = bnxt_init_nic(bp, irq_re_init);
 	if (rc) {
 		netdev_err(bp->dev, "bnxt_init_nic err: %x\n", rc);
-		goto open_err;
+		goto open_err_irq;
 	}
 
+	bnxt_enable_napi(bp);
+
 	if (link_re_init) {
 		rc = bnxt_update_phy_setting(bp);
 		if (rc)
@@ -4644,9 +4644,6 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
 
 	return 0;
 
-open_err:
-	bnxt_disable_napi(bp);
-
 open_err_irq:
 	bnxt_del_napi(bp);
 

From 7d81bf4586f7fb492cc7d58c5a85ba3c36005282 Mon Sep 17 00:00:00 2001
From: Kamil Lorenc <kamil@re-ws.pl>
Date: Tue, 1 Sep 2020 10:57:38 +0200
Subject: [PATCH 0572/2658] net: usb: dm9601: Add USB ID of Keenetic Plus DSL

[ Upstream commit a609d0259183a841621f252e067f40f8cc25d6f6 ]

Keenetic Plus DSL is a xDSL modem that uses dm9620 as its USB interface.

Signed-off-by: Kamil Lorenc <kamil@re-ws.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/dm9601.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 0b4bdd39106b..fb18801d0fe7 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -624,6 +624,10 @@ static const struct usb_device_id products[] = {
 	 USB_DEVICE(0x0a46, 0x1269),	/* DM9621A USB to Fast Ethernet Adapter */
 	 .driver_info = (unsigned long)&dm9601_info,
 	},
+	{
+	 USB_DEVICE(0x0586, 0x3427),	/* ZyXEL Keenetic Plus DSL xDSL modem */
+	 .driver_info = (unsigned long)&dm9601_info,
+	},
 	{},			// END
 };
 

From d780e01cc8b819243993a646d717d07b2bcf0d60 Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Fri, 21 Aug 2020 14:59:38 +0800
Subject: [PATCH 0573/2658] sctp: not disable bh in the whole
 sctp_get_port_local()

[ Upstream commit 3106ecb43a05dc3e009779764b9da245a5d082de ]

With disabling bh in the whole sctp_get_port_local(), when
snum == 0 and too many ports have been used, the do-while
loop will take the cpu for a long time and cause cpu stuck:

  [ ] watchdog: BUG: soft lockup - CPU#11 stuck for 22s!
  [ ] RIP: 0010:native_queued_spin_lock_slowpath+0x4de/0x940
  [ ] Call Trace:
  [ ]  _raw_spin_lock+0xc1/0xd0
  [ ]  sctp_get_port_local+0x527/0x650 [sctp]
  [ ]  sctp_do_bind+0x208/0x5e0 [sctp]
  [ ]  sctp_autobind+0x165/0x1e0 [sctp]
  [ ]  sctp_connect_new_asoc+0x355/0x480 [sctp]
  [ ]  __sctp_connect+0x360/0xb10 [sctp]

There's no need to disable bh in the whole function of
sctp_get_port_local. So fix this cpu stuck by removing
local_bh_disable() called at the beginning, and using
spin_lock_bh() instead.

The same thing was actually done for inet_csk_get_port() in
Commit ea8add2b1903 ("tcp/dccp: better use of ephemeral
ports in bind()").

Thanks to Marcelo for pointing the buggy code out.

v1->v2:
  - use cond_resched() to yield cpu to other tasks if needed,
    as Eric noticed.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Ying Xu <yinxu@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/socket.c | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 5803d0807e9a..62ba9a49c126 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -6206,8 +6206,6 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
 
 	pr_debug("%s: begins, snum:%d\n", __func__, snum);
 
-	local_bh_disable();
-
 	if (snum == 0) {
 		/* Search for an available port. */
 		int low, high, remaining, index;
@@ -6226,20 +6224,21 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
 				continue;
 			index = sctp_phashfn(sock_net(sk), rover);
 			head = &sctp_port_hashtable[index];
-			spin_lock(&head->lock);
+			spin_lock_bh(&head->lock);
 			sctp_for_each_hentry(pp, &head->chain)
 				if ((pp->port == rover) &&
 				    net_eq(sock_net(sk), pp->net))
 					goto next;
 			break;
 		next:
-			spin_unlock(&head->lock);
+			spin_unlock_bh(&head->lock);
+			cond_resched();
 		} while (--remaining > 0);
 
 		/* Exhausted local port range during search? */
 		ret = 1;
 		if (remaining <= 0)
-			goto fail;
+			return ret;
 
 		/* OK, here is the one we will use.  HEAD (the port
 		 * hash table list entry) is non-NULL and we hold it's
@@ -6254,7 +6253,7 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
 		 * port iterator, pp being NULL.
 		 */
 		head = &sctp_port_hashtable[sctp_phashfn(sock_net(sk), snum)];
-		spin_lock(&head->lock);
+		spin_lock_bh(&head->lock);
 		sctp_for_each_hentry(pp, &head->chain) {
 			if ((pp->port == snum) && net_eq(pp->net, sock_net(sk)))
 				goto pp_found;
@@ -6338,10 +6337,7 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
 	ret = 0;
 
 fail_unlock:
-	spin_unlock(&head->lock);
-
-fail:
-	local_bh_enable();
+	spin_unlock_bh(&head->lock);
 	return ret;
 }
 

From 93a16596fb1c994bab7b7789cbede092dee44551 Mon Sep 17 00:00:00 2001
From: Jakub Kicinski <kuba@kernel.org>
Date: Wed, 26 Aug 2020 12:40:06 -0700
Subject: [PATCH 0574/2658] net: disable netpoll on fresh napis

[ Upstream commit 96e97bc07e90f175a8980a22827faf702ca4cb30 ]

napi_disable() makes sure to set the NAPI_STATE_NPSVC bit to prevent
netpoll from accessing rings before init is complete. However, the
same is not done for fresh napi instances in netif_napi_add(),
even though we expect NAPI instances to be added as disabled.

This causes crashes during driver reconfiguration (enabling XDP,
changing the channel count) - if there is any printk() after
netif_napi_add() but before napi_enable().

To ensure memory ordering is correct we need to use RCU accessors.

Reported-by: Rob Sherwood <rsher@fb.com>
Fixes: 2d8bff12699a ("netpoll: Close race condition between poll_one_napi and napi_disable")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/dev.c     | 3 ++-
 net/core/netpoll.c | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index 067bca407602..97a9536203bf 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4873,13 +4873,14 @@ void netif_napi_add(struct net_device *dev, struct napi_struct *napi,
 		pr_err_once("netif_napi_add() called with weight %d on device %s\n",
 			    weight, dev->name);
 	napi->weight = weight;
-	list_add(&napi->dev_list, &dev->napi_list);
 	napi->dev = dev;
 #ifdef CONFIG_NETPOLL
 	spin_lock_init(&napi->poll_lock);
 	napi->poll_owner = -1;
 #endif
 	set_bit(NAPI_STATE_SCHED, &napi->state);
+	set_bit(NAPI_STATE_NPSVC, &napi->state);
+	list_add_rcu(&napi->dev_list, &dev->napi_list);
 }
 EXPORT_SYMBOL(netif_napi_add);
 
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 0d7c2cc1ff09..f2610f8f171c 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -178,7 +178,7 @@ static void poll_napi(struct net_device *dev)
 {
 	struct napi_struct *napi;
 
-	list_for_each_entry(napi, &dev->napi_list, dev_list) {
+	list_for_each_entry_rcu(napi, &dev->napi_list, dev_list) {
 		if (napi->poll_owner != smp_processor_id() &&
 		    spin_trylock(&napi->poll_lock)) {
 			poll_one_napi(napi);

From 95a952210cb579bce10e08a9b81f936e2fe9de10 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sat, 12 Sep 2020 11:45:33 +0200
Subject: [PATCH 0575/2658] Linux 4.4.236

Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index ba409a9ca8b0..4ec303ff71e3 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 235
+SUBLEVEL = 236
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 6666ca201c77f0452f073172fdc8de8267829c43 Mon Sep 17 00:00:00 2001
From: Dinh Nguyen <dinguyen@kernel.org>
Date: Fri, 31 Jul 2020 10:26:40 -0500
Subject: [PATCH 0576/2658] ARM: dts: socfpga: fix register entry for timer3 on
 Arria10

[ Upstream commit 0ff5a4812be4ebd4782bbb555d369636eea164f7 ]

Fixes the register address for the timer3 entry on Arria10.

Fixes: 475dc86d08de4 ("arm: dts: socfpga: Add a base DTSI for Altera's Arria10 SOC")
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/socfpga_arria10.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi
index cce9e50acf68..b648b1b253c5 100644
--- a/arch/arm/boot/dts/socfpga_arria10.dtsi
+++ b/arch/arm/boot/dts/socfpga_arria10.dtsi
@@ -652,7 +652,7 @@
 		timer3: timer3@ffd00100 {
 			compatible = "snps,dw-apb-timer";
 			interrupts = <0 118 IRQ_TYPE_LEVEL_HIGH>;
-			reg = <0xffd01000 0x100>;
+			reg = <0xffd00100 0x100>;
 			clocks = <&l4_sys_free_clk>;
 			clock-names = "timer";
 		};

From 8131112516bb7cbd405b7871bb80effaf2ca1ee3 Mon Sep 17 00:00:00 2001
From: Luo Jiaxing <luojiaxing@huawei.com>
Date: Wed, 26 Aug 2020 15:24:26 +0800
Subject: [PATCH 0577/2658] scsi: libsas: Set data_dir as DMA_NONE if libata
 marks qc as NODATA

[ Upstream commit 53de092f47ff40e8d4d78d590d95819d391bf2e0 ]

It was discovered that sdparm will fail when attempting to disable write
cache on a SATA disk connected via libsas.

In the ATA command set the write cache state is controlled through the SET
FEATURES operation. This is roughly corresponds to MODE SELECT in SCSI and
the latter command is what is used in the SCSI-ATA translation layer. A
subtle difference is that a MODE SELECT carries data whereas SET FEATURES
is defined as a non-data command in ATA.

Set the DMA data direction to DMA_NONE if the requested ATA command is
identified as non-data.

[mkp: commit desc]

Fixes: fa1c1e8f1ece ("[SCSI] Add SATA support to libsas")
Link: https://lore.kernel.org/r/1598426666-54544-1-git-send-email-luojiaxing@huawei.com
Reviewed-by: John Garry <john.garry@huawei.com>
Reviewed-by: Jason Yan <yanaijie@huawei.com>
Signed-off-by: Luo Jiaxing <luojiaxing@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/libsas/sas_ata.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 6f5e2720ffad..68b33abeaa5f 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -224,7 +224,10 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc)
 		task->num_scatter = si;
 	}
 
-	task->data_dir = qc->dma_dir;
+	if (qc->tf.protocol == ATA_PROT_NODATA)
+		task->data_dir = DMA_NONE;
+	else
+		task->data_dir = qc->dma_dir;
 	task->scatter = qc->sg;
 	task->ata_task.retry_count = 1;
 	task->task_state_flags = SAS_TASK_STATE_PENDING;

From 74abded43934e452ead616df26f9a8260c7a5f34 Mon Sep 17 00:00:00 2001
From: Xie He <xie.he.0141@gmail.com>
Date: Fri, 21 Aug 2020 14:26:59 -0700
Subject: [PATCH 0578/2658] drivers/net/wan/lapbether: Added needed_tailroom

[ Upstream commit 1ee39c1448c4e0d480c5b390e2db1987561fb5c2 ]

The underlying Ethernet device may request necessary tailroom to be
allocated by setting needed_tailroom. This driver should also set
needed_tailroom to request the tailroom needed by the underlying
Ethernet device to be allocated.

Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Cc: Martin Schiller <ms@dev.tdt.de>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wan/lapbether.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index 6eb0f7a85e53..5befc7f3f0e7 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -343,6 +343,7 @@ static int lapbeth_new_device(struct net_device *dev)
 	 */
 	ndev->needed_headroom = -1 + 3 + 2 + dev->hard_header_len
 					   + dev->needed_headroom;
+	ndev->needed_tailroom = dev->needed_tailroom;
 
 	lapbeth = netdev_priv(ndev);
 	lapbeth->axdev = ndev;

From 3b87d678d9671c3e699711599160019fee9fc32d Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Sun, 23 Aug 2020 19:29:35 +0800
Subject: [PATCH 0579/2658] firestream: Fix memleak in fs_open

[ Upstream commit 15ac5cdafb9202424206dc5bd376437a358963f9 ]

When make_rate() fails, vcc should be freed just
like other error paths in fs_open().

Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/atm/firestream.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
index 04b39d0da868..70708608ab1e 100644
--- a/drivers/atm/firestream.c
+++ b/drivers/atm/firestream.c
@@ -1009,6 +1009,7 @@ static int fs_open(struct atm_vcc *atm_vcc)
 				error = make_rate (pcr, r, &tmc0, NULL);
 				if (error) {
 					kfree(tc);
+					kfree(vcc);
 					return error;
 				}
 			}

From 105dc071ea46ba1665670ccc856f0a44b6a6696f Mon Sep 17 00:00:00 2001
From: Xie He <xie.he.0141@gmail.com>
Date: Tue, 25 Aug 2020 20:03:53 -0700
Subject: [PATCH 0580/2658] drivers/net/wan/lapbether: Set network_header
 before transmitting

[ Upstream commit 91244d108441013b7367b3b4dcc6869998676473 ]

Set the skb's network_header before it is passed to the underlying
Ethernet device for transmission.

This patch fixes the following issue:

When we use this driver with AF_PACKET sockets, there would be error
messages of:
   protocol 0805 is buggy, dev (Ethernet interface name)
printed in the system "dmesg" log.

This is because skbs passed down to the Ethernet device for transmission
don't have their network_header properly set, and the dev_queue_xmit_nit
function in net/core/dev.c complains about this.

Reason of setting the network_header to this place (at the end of the
Ethernet header, and at the beginning of the Ethernet payload):

Because when this driver receives an skb from the Ethernet device, the
network_header is also set at this place.

Cc: Martin Schiller <ms@dev.tdt.de>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wan/lapbether.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index 5befc7f3f0e7..c6db9a4e7c45 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -213,6 +213,8 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb)
 
 	skb->dev = dev = lapbeth->ethdev;
 
+	skb_reset_network_header(skb);
+
 	dev_hard_header(skb, dev, ETH_P_DEC, bcast_addr, NULL, 0);
 
 	dev_queue_xmit(skb);

From 40cbcba4e7e74c1a5a3e75bca4747f70a884c4d7 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <darrick.wong@oracle.com>
Date: Wed, 26 Aug 2020 14:12:18 -0700
Subject: [PATCH 0581/2658] xfs: initialize the shortform attr header padding
 entry

[ Upstream commit 125eac243806e021f33a1fdea3687eccbb9f7636 ]

Don't leak kernel memory contents into the shortform attr fork.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/libxfs/xfs_attr_leaf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
index 445a3f2f871f..da8747b870df 100644
--- a/fs/xfs/libxfs/xfs_attr_leaf.c
+++ b/fs/xfs/libxfs/xfs_attr_leaf.c
@@ -514,8 +514,8 @@ xfs_attr_shortform_create(xfs_da_args_t *args)
 		ASSERT(ifp->if_flags & XFS_IFINLINE);
 	}
 	xfs_idata_realloc(dp, sizeof(*hdr), XFS_ATTR_FORK);
-	hdr = (xfs_attr_sf_hdr_t *)ifp->if_u1.if_data;
-	hdr->count = 0;
+	hdr = (struct xfs_attr_sf_hdr *)ifp->if_u1.if_data;
+	memset(hdr, 0, sizeof(*hdr));
 	hdr->totsize = cpu_to_be16(sizeof(*hdr));
 	xfs_trans_log_inode(args->trans, dp, XFS_ILOG_CORE | XFS_ILOG_ADATA);
 }

From b9ef72ce12878c9a05fe9e6964a6df2a2488e23e Mon Sep 17 00:00:00 2001
From: Xie He <xie.he.0141@gmail.com>
Date: Fri, 28 Aug 2020 00:07:52 -0700
Subject: [PATCH 0582/2658] drivers/net/wan/hdlc_cisco: Add hard_header_len

[ Upstream commit 1a545ebe380bf4c1433e3c136e35a77764fda5ad ]

This driver didn't set hard_header_len. This patch sets hard_header_len
for it according to its header_ops->create function.

This driver's header_ops->create function (cisco_hard_header) creates
a header of (struct hdlc_header), so hard_header_len should be set to
sizeof(struct hdlc_header).

Cc: Martin Schiller <ms@dev.tdt.de>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Acked-by: Krzysztof Halasa <khc@pm.waw.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wan/hdlc_cisco.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c
index 3f20808b5ff8..f8ed079d8bc3 100644
--- a/drivers/net/wan/hdlc_cisco.c
+++ b/drivers/net/wan/hdlc_cisco.c
@@ -377,6 +377,7 @@ static int cisco_ioctl(struct net_device *dev, struct ifreq *ifr)
 		memcpy(&state(hdlc)->settings, &new_settings, size);
 		spin_lock_init(&state(hdlc)->lock);
 		dev->header_ops = &cisco_header_ops;
+		dev->hard_header_len = sizeof(struct hdlc_header);
 		dev->type = ARPHRD_CISCO;
 		netif_dormant_on(dev);
 		return 0;

From 68bdc3550a21329339e891b13ab63a5589be2a4d Mon Sep 17 00:00:00 2001
From: Rander Wang <rander.wang@intel.com>
Date: Wed, 2 Sep 2020 18:42:18 +0300
Subject: [PATCH 0583/2658] ALSA: hda: fix a runtime pm issue in SOF when
 integrated GPU is disabled

[ Upstream commit 13774d81f38538c5fa2924bdcdfa509155480fa6 ]

In snd_hdac_device_init pm_runtime_set_active is called to
increase child_count in parent device. But when it is failed
to build connection with GPU for one case that integrated
graphic gpu is disabled, snd_hdac_ext_bus_device_exit will be
invoked to clean up a HD-audio extended codec base device. At
this time the child_count of parent is not decreased, which
makes parent device can't get suspended.

This patch calls pm_runtime_set_suspended to decrease child_count
in parent device in snd_hdac_device_exit to match with
snd_hdac_device_init. pm_runtime_set_suspended can make sure that
it will not decrease child_count if the device is already suspended.

Signed-off-by: Rander Wang <rander.wang@intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Link: https://lore.kernel.org/r/20200902154218.1440441-1-kai.vehmanen@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/hdac_device.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/hda/hdac_device.c b/sound/hda/hdac_device.c
index e361024eabb6..020ec48f3904 100644
--- a/sound/hda/hdac_device.c
+++ b/sound/hda/hdac_device.c
@@ -123,6 +123,8 @@ EXPORT_SYMBOL_GPL(snd_hdac_device_init);
 void snd_hdac_device_exit(struct hdac_device *codec)
 {
 	pm_runtime_put_noidle(&codec->dev);
+	/* keep balance of runtime PM child_count in parent device */
+	pm_runtime_set_suspended(&codec->dev);
 	snd_hdac_bus_remove_device(codec->bus, codec);
 	kfree(codec->vendor_name);
 	kfree(codec->chip_name);

From b7d6df05114e5c260b16da309f82948252af179e Mon Sep 17 00:00:00 2001
From: Leon Romanovsky <leonro@nvidia.com>
Date: Fri, 4 Sep 2020 18:58:08 +0300
Subject: [PATCH 0584/2658] gcov: Disable gcov build with GCC 10

[ Upstream commit cfc905f158eaa099d6258031614d11869e7ef71c ]

GCOV built with GCC 10 doesn't initialize n_function variable.  This
produces different kernel panics as was seen by Colin in Ubuntu and me
in FC 32.

As a workaround, let's disable GCOV build for broken GCC 10 version.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1891288
Link: https://lore.kernel.org/lkml/20200827133932.3338519-1-leon@kernel.org
Link: https://lore.kernel.org/lkml/CAHk-=whbijeSdSvx-Xcr0DPMj0BiwhJ+uiNnDSVZcr_h_kg7UA@mail.gmail.com/
Cc: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/gcov/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/gcov/Kconfig b/kernel/gcov/Kconfig
index 1276aabaab55..1d78ed19a351 100644
--- a/kernel/gcov/Kconfig
+++ b/kernel/gcov/Kconfig
@@ -3,6 +3,7 @@ menu "GCOV-based kernel profiling"
 config GCOV_KERNEL
 	bool "Enable gcov-based kernel profiling"
 	depends on DEBUG_FS
+	depends on !CC_IS_GCC || GCC_VERSION < 100000
 	select CONSTRUCTORS if !UML
 	default n
 	---help---

From 30a9744c091adbc86968a04d77d555926df2fa1f Mon Sep 17 00:00:00 2001
From: Angelo Compagnucci <angelo.compagnucci@gmail.com>
Date: Wed, 19 Aug 2020 09:55:25 +0200
Subject: [PATCH 0585/2658] iio: adc: mcp3422: fix locking scope

commit 3f1093d83d7164e4705e4232ccf76da54adfda85 upstream.

Locking should be held for the entire reading sequence involving setting
the channel, waiting for the channel switch and reading from the
channel.
If not, reading from a channel can result mixing with the reading from
another channel.

Fixes: 07914c84ba30 ("iio: adc: Add driver for Microchip MCP3422/3/4 high resolution ADC")
Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
Link: https://lore.kernel.org/r/20200819075525.1395248-1-angelo.compagnucci@gmail.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/mcp3422.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/iio/adc/mcp3422.c b/drivers/iio/adc/mcp3422.c
index 3555122008b4..22993ebb4cb5 100644
--- a/drivers/iio/adc/mcp3422.c
+++ b/drivers/iio/adc/mcp3422.c
@@ -98,16 +98,12 @@ static int mcp3422_update_config(struct mcp3422 *adc, u8 newconfig)
 {
 	int ret;
 
-	mutex_lock(&adc->lock);
-
 	ret = i2c_master_send(adc->i2c, &newconfig, 1);
 	if (ret > 0) {
 		adc->config = newconfig;
 		ret = 0;
 	}
 
-	mutex_unlock(&adc->lock);
-
 	return ret;
 }
 
@@ -140,6 +136,8 @@ static int mcp3422_read_channel(struct mcp3422 *adc,
 	u8 config;
 	u8 req_channel = channel->channel;
 
+	mutex_lock(&adc->lock);
+
 	if (req_channel != MCP3422_CHANNEL(adc->config)) {
 		config = adc->config;
 		config &= ~MCP3422_CHANNEL_MASK;
@@ -152,7 +150,11 @@ static int mcp3422_read_channel(struct mcp3422 *adc,
 		msleep(mcp3422_read_times[MCP3422_SAMPLE_RATE(adc->config)]);
 	}
 
-	return mcp3422_read(adc, value, &config);
+	ret = mcp3422_read(adc, value, &config);
+
+	mutex_unlock(&adc->lock);
+
+	return ret;
 }
 
 static int mcp3422_read_raw(struct iio_dev *iio,

From fb373765a6609ad0321bcd868efe1497e5eeff8d Mon Sep 17 00:00:00 2001
From: Angelo Compagnucci <angelo.compagnucci@gmail.com>
Date: Tue, 1 Sep 2020 11:32:18 +0200
Subject: [PATCH 0586/2658] iio: adc: mcp3422: fix locking on error path

[ Upstream commit a139ffa40f0c24b753838b8ef3dcf6ad10eb7854 ]

Reading from the chip should be unlocked on error path else the lock
could never being released.

Fixes: 07914c84ba30 ("iio: adc: Add driver for Microchip MCP3422/3/4 high resolution ADC")
Fixes: 3f1093d83d71 ("iio: adc: mcp3422: fix locking scope")
Acked-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
Link: https://lore.kernel.org/r/20200901093218.1500845-1-angelo.compagnucci@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/mcp3422.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/adc/mcp3422.c b/drivers/iio/adc/mcp3422.c
index 22993ebb4cb5..26fc1021a2c2 100644
--- a/drivers/iio/adc/mcp3422.c
+++ b/drivers/iio/adc/mcp3422.c
@@ -145,8 +145,10 @@ static int mcp3422_read_channel(struct mcp3422 *adc,
 		config &= ~MCP3422_PGA_MASK;
 		config |= MCP3422_PGA_VALUE(adc->pga[req_channel]);
 		ret = mcp3422_update_config(adc, config);
-		if (ret < 0)
+		if (ret < 0) {
+			mutex_unlock(&adc->lock);
 			return ret;
+		}
 		msleep(mcp3422_read_times[MCP3422_SAMPLE_RATE(adc->config)]);
 	}
 

From ed5f43dbf8f722335e5d61403d9af409a3e84517 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Wed, 22 Jul 2020 16:50:48 +0100
Subject: [PATCH 0587/2658] iio:light:ltr501 Fix timestamp alignment issue.

commit 2684d5003490df5398aeafe2592ba9d4a4653998 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
Here we use a structure on the stack.  The driver already did an
explicit memset so no data leak was possible.

Forced alignment of ts is not strictly necessary but probably makes
the code slightly less fragile.

Note there has been some rework in this driver of the years, so no
way this will apply cleanly all the way back.

Fixes: 2690be905123 ("iio: Add Lite-On ltr501 ambient light / proximity sensor driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/light/ltr501.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
index b9d1e5c58ec5..9f5825f4fc0e 100644
--- a/drivers/iio/light/ltr501.c
+++ b/drivers/iio/light/ltr501.c
@@ -1218,13 +1218,16 @@ static irqreturn_t ltr501_trigger_handler(int irq, void *p)
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct ltr501_data *data = iio_priv(indio_dev);
-	u16 buf[8];
+	struct {
+		u16 channels[3];
+		s64 ts __aligned(8);
+	} scan;
 	__le16 als_buf[2];
 	u8 mask = 0;
 	int j = 0;
 	int ret, psdata;
 
-	memset(buf, 0, sizeof(buf));
+	memset(&scan, 0, sizeof(scan));
 
 	/* figure out which data needs to be ready */
 	if (test_bit(0, indio_dev->active_scan_mask) ||
@@ -1243,9 +1246,9 @@ static irqreturn_t ltr501_trigger_handler(int irq, void *p)
 		if (ret < 0)
 			return ret;
 		if (test_bit(0, indio_dev->active_scan_mask))
-			buf[j++] = le16_to_cpu(als_buf[1]);
+			scan.channels[j++] = le16_to_cpu(als_buf[1]);
 		if (test_bit(1, indio_dev->active_scan_mask))
-			buf[j++] = le16_to_cpu(als_buf[0]);
+			scan.channels[j++] = le16_to_cpu(als_buf[0]);
 	}
 
 	if (mask & LTR501_STATUS_PS_RDY) {
@@ -1253,10 +1256,10 @@ static irqreturn_t ltr501_trigger_handler(int irq, void *p)
 				       &psdata, 2);
 		if (ret < 0)
 			goto done;
-		buf[j++] = psdata & LTR501_PS_DATA_MASK;
+		scan.channels[j++] = psdata & LTR501_PS_DATA_MASK;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, buf, iio_get_time_ns());
+	iio_push_to_buffers_with_timestamp(indio_dev, &scan, iio_get_time_ns());
 
 done:
 	iio_trigger_notify_done(indio_dev->trig);

From 62e9952a9c37cd81359704c4b7a92d1c4a803c8b Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Wed, 22 Jul 2020 16:50:39 +0100
Subject: [PATCH 0588/2658] iio:accel:bmc150-accel: Fix timestamp alignment and
 prevent data leak.

commit a6f86f724394de3629da63fe5e1b7a4ab3396efe upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses a 16 byte array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by moving
to a suitable structure in the iio_priv() data with alignment
ensured by use of an explicit c structure.  This data is allocated
with kzalloc so no data can leak appart from previous readings.

Fixes tag is beyond some major refactoring so likely manual backporting
would be needed to get that far back.

Whilst the force alignment of the ts is not strictly necessary, it
does make the code less fragile.

Fixes: 3bbec9773389 ("iio: bmc150_accel: add support for hardware fifo")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/accel/bmc150-accel-core.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c
index ec7ddf867349..e5e231b6476e 100644
--- a/drivers/iio/accel/bmc150-accel-core.c
+++ b/drivers/iio/accel/bmc150-accel-core.c
@@ -198,6 +198,14 @@ struct bmc150_accel_data {
 	struct mutex mutex;
 	u8 fifo_mode, watermark;
 	s16 buffer[8];
+	/*
+	 * Ensure there is sufficient space and correct alignment for
+	 * the timestamp if enabled
+	 */
+	struct {
+		__le16 channels[3];
+		s64 ts __aligned(8);
+	} scan;
 	u8 bw_bits;
 	u32 slope_dur;
 	u32 slope_thres;
@@ -924,15 +932,16 @@ static int __bmc150_accel_fifo_flush(struct iio_dev *indio_dev,
 	 * now.
 	 */
 	for (i = 0; i < count; i++) {
-		u16 sample[8];
 		int j, bit;
 
 		j = 0;
 		for_each_set_bit(bit, indio_dev->active_scan_mask,
 				 indio_dev->masklength)
-			memcpy(&sample[j++], &buffer[i * 3 + bit], 2);
+			memcpy(&data->scan.channels[j++], &buffer[i * 3 + bit],
+			       sizeof(data->scan.channels[0]));
 
-		iio_push_to_buffers_with_timestamp(indio_dev, sample, tstamp);
+		iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+						   tstamp);
 
 		tstamp += sample_period;
 	}

From 89de0213db78a50a0208b6d3d0ab917bab2a5958 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Wed, 22 Jul 2020 16:50:38 +0100
Subject: [PATCH 0589/2658] iio:accel:mma8452: Fix timestamp alignment and
 prevent data leak.

commit 89226a296d816727405d3fea684ef69e7d388bd8 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses a 16 byte u8 array on the stack.  As Lars also noted
this anti pattern can involve a leak of data to userspace and that
indeed can happen here.  We close both issues by moving to
a suitable structure in the iio_priv() data with alignment
ensured by use of an explicit c structure.  This data is allocated
with kzalloc so no data can leak appart from previous readings.

The additional forcing of the 8 byte alignment of the timestamp
is not strictly necessary but makes the code less fragile by
making this explicit.

Fixes: c7eeea93ac60 ("iio: Add Freescale MMA8452Q 3-axis accelerometer driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: Peter Meerwald <pmeerw@pmeerw.net>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/accel/mma8452.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
index 1eccc2dcf14c..d44c1b3a131c 100644
--- a/drivers/iio/accel/mma8452.c
+++ b/drivers/iio/accel/mma8452.c
@@ -96,6 +96,12 @@ struct mma8452_data {
 	u8 ctrl_reg1;
 	u8 data_cfg;
 	const struct mma_chip_info *chip_info;
+
+	/* Ensure correct alignment of time stamp when present */
+	struct {
+		__be16 channels[3];
+		s64 ts __aligned(8);
+	} buffer;
 };
 
 /**
@@ -700,14 +706,13 @@ static irqreturn_t mma8452_trigger_handler(int irq, void *p)
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct mma8452_data *data = iio_priv(indio_dev);
-	u8 buffer[16]; /* 3 16-bit channels + padding + ts */
 	int ret;
 
-	ret = mma8452_read(data, (__be16 *)buffer);
+	ret = mma8452_read(data, data->buffer.channels);
 	if (ret < 0)
 		goto done;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, buffer,
+	iio_push_to_buffers_with_timestamp(indio_dev, &data->buffer,
 					   iio_get_time_ns());
 
 done:

From 190f9b96a3513549796ee10deb9ac6ffd8dac390 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Fri, 17 Mar 2017 11:35:30 +0100
Subject: [PATCH 0590/2658] USB: core: add helpers to retrieve endpoints

commit 66a359390e7e34f9a4c489467234b107b3d76169 upstream.

Many USB drivers iterate over the available endpoints to find required
endpoints of a specific type and direction. Typically the endpoints are
required for proper function and a missing endpoint should abort probe.

To facilitate code reuse, add a helper to retrieve common endpoints
(bulk or interrupt, in or out) and four wrappers to find a single
endpoint.

Note that the helpers are marked as __must_check to serve as a reminder
to always verify that all expected endpoints are indeed present. This
also means that any optional endpoints, typically need to be looked up
through separate calls.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/usb.c | 83 ++++++++++++++++++++++++++++++++++++++++++
 include/linux/usb.h    | 35 ++++++++++++++++++
 2 files changed, 118 insertions(+)

diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index d96ed8fe6442..ebb53165df42 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -76,6 +76,89 @@ MODULE_PARM_DESC(autosuspend, "default autosuspend delay");
 #endif
 
 
+/**
+ * usb_find_common_endpoints() -- look up common endpoint descriptors
+ * @alt:	alternate setting to search
+ * @bulk_in:	pointer to descriptor pointer, or NULL
+ * @bulk_out:	pointer to descriptor pointer, or NULL
+ * @int_in:	pointer to descriptor pointer, or NULL
+ * @int_out:	pointer to descriptor pointer, or NULL
+ *
+ * Search the alternate setting's endpoint descriptors for the first bulk-in,
+ * bulk-out, interrupt-in and interrupt-out endpoints and return them in the
+ * provided pointers (unless they are NULL).
+ *
+ * If a requested endpoint is not found, the corresponding pointer is set to
+ * NULL.
+ *
+ * Return: Zero if all requested descriptors were found, or -ENXIO otherwise.
+ */
+int usb_find_common_endpoints(struct usb_host_interface *alt,
+		struct usb_endpoint_descriptor **bulk_in,
+		struct usb_endpoint_descriptor **bulk_out,
+		struct usb_endpoint_descriptor **int_in,
+		struct usb_endpoint_descriptor **int_out)
+{
+	struct usb_endpoint_descriptor *epd;
+	int i;
+
+	if (bulk_in)
+		*bulk_in = NULL;
+	if (bulk_out)
+		*bulk_out = NULL;
+	if (int_in)
+		*int_in = NULL;
+	if (int_out)
+		*int_out = NULL;
+
+	for (i = 0; i < alt->desc.bNumEndpoints; ++i) {
+		epd = &alt->endpoint[i].desc;
+
+		switch (usb_endpoint_type(epd)) {
+		case USB_ENDPOINT_XFER_BULK:
+			if (usb_endpoint_dir_in(epd)) {
+				if (bulk_in && !*bulk_in) {
+					*bulk_in = epd;
+					break;
+				}
+			} else {
+				if (bulk_out && !*bulk_out) {
+					*bulk_out = epd;
+					break;
+				}
+			}
+
+			continue;
+		case USB_ENDPOINT_XFER_INT:
+			if (usb_endpoint_dir_in(epd)) {
+				if (int_in && !*int_in) {
+					*int_in = epd;
+					break;
+				}
+			} else {
+				if (int_out && !*int_out) {
+					*int_out = epd;
+					break;
+				}
+			}
+
+			continue;
+		default:
+			continue;
+		}
+
+		if ((!bulk_in || *bulk_in) &&
+				(!bulk_out || *bulk_out) &&
+				(!int_in || *int_in) &&
+				(!int_out || *int_out)) {
+			return 0;
+		}
+	}
+
+	return -ENXIO;
+}
+EXPORT_SYMBOL_GPL(usb_find_common_endpoints);
+
 /**
  * usb_find_alt_setting() - Given a configuration, find the alternate setting
  * for the given interface.
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 898d650bb47d..62b6785343bf 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -97,6 +97,41 @@ enum usb_interface_condition {
 	USB_INTERFACE_UNBINDING,
 };
 
+int __must_check
+usb_find_common_endpoints(struct usb_host_interface *alt,
+		struct usb_endpoint_descriptor **bulk_in,
+		struct usb_endpoint_descriptor **bulk_out,
+		struct usb_endpoint_descriptor **int_in,
+		struct usb_endpoint_descriptor **int_out);
+
+static inline int __must_check
+usb_find_bulk_in_endpoint(struct usb_host_interface *alt,
+		struct usb_endpoint_descriptor **bulk_in)
+{
+	return usb_find_common_endpoints(alt, bulk_in, NULL, NULL, NULL);
+}
+
+static inline int __must_check
+usb_find_bulk_out_endpoint(struct usb_host_interface *alt,
+		struct usb_endpoint_descriptor **bulk_out)
+{
+	return usb_find_common_endpoints(alt, NULL, bulk_out, NULL, NULL);
+}
+
+static inline int __must_check
+usb_find_int_in_endpoint(struct usb_host_interface *alt,
+		struct usb_endpoint_descriptor **int_in)
+{
+	return usb_find_common_endpoints(alt, NULL, NULL, int_in, NULL);
+}
+
+static inline int __must_check
+usb_find_int_out_endpoint(struct usb_host_interface *alt,
+		struct usb_endpoint_descriptor **int_out)
+{
+	return usb_find_common_endpoints(alt, NULL, NULL, NULL, int_out);
+}
+
 /**
  * struct usb_interface - what usb device drivers talk to
  * @altsetting: array of interface structures, one for each alternate

From 7553ebca3d86c3d29e48cb0b2574e730a3fd571c Mon Sep 17 00:00:00 2001
From: Rustam Kovhaev <rkovhaev@gmail.com>
Date: Tue, 4 Aug 2020 07:56:14 -0700
Subject: [PATCH 0591/2658] staging: wlan-ng: fix out of bounds read in
 prism2sta_probe_usb()

commit fea22e159d51c766ba70473f473a0ec914cc7e92 upstream.

let's use usb_find_common_endpoints() to discover endpoints, it does all
necessary checks for type and xfer direction

remove memset() in hfa384x_create(), because we now assign endpoints in
prism2sta_probe_usb() and because create_wlan() uses kzalloc() to
allocate hfa384x struct before calling hfa384x_create()

Fixes: faaff9765664 ("staging: wlan-ng: properly check endpoint types")
Reported-and-tested-by: syzbot+22794221ab96b0bab53a@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=22794221ab96b0bab53a
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200804145614.104320-1-rkovhaev@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/wlan-ng/hfa384x_usb.c |  5 -----
 drivers/staging/wlan-ng/prism2usb.c   | 19 ++++++-------------
 2 files changed, 6 insertions(+), 18 deletions(-)

diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c
index 3903f681ef6c..2772c7179a61 100644
--- a/drivers/staging/wlan-ng/hfa384x_usb.c
+++ b/drivers/staging/wlan-ng/hfa384x_usb.c
@@ -530,13 +530,8 @@ static void hfa384x_usb_defer(struct work_struct *data)
 ----------------------------------------------------------------*/
 void hfa384x_create(hfa384x_t *hw, struct usb_device *usb)
 {
-	memset(hw, 0, sizeof(hfa384x_t));
 	hw->usb = usb;
 
-	/* set up the endpoints */
-	hw->endp_in = usb_rcvbulkpipe(usb, 1);
-	hw->endp_out = usb_sndbulkpipe(usb, 2);
-
 	/* Set up the waitq */
 	init_waitqueue_head(&hw->cmdq);
 
diff --git a/drivers/staging/wlan-ng/prism2usb.c b/drivers/staging/wlan-ng/prism2usb.c
index 6da5c66bb3d5..f4276943dc97 100644
--- a/drivers/staging/wlan-ng/prism2usb.c
+++ b/drivers/staging/wlan-ng/prism2usb.c
@@ -60,23 +60,14 @@ static int prism2sta_probe_usb(struct usb_interface *interface,
 			       const struct usb_device_id *id)
 {
 	struct usb_device *dev;
-	const struct usb_endpoint_descriptor *epd;
-	const struct usb_host_interface *iface_desc = interface->cur_altsetting;
+	struct usb_endpoint_descriptor *bulk_in, *bulk_out;
+	struct usb_host_interface *iface_desc = interface->cur_altsetting;
 	wlandevice_t *wlandev = NULL;
 	hfa384x_t *hw = NULL;
 	int result = 0;
 
-	if (iface_desc->desc.bNumEndpoints != 2) {
-		result = -ENODEV;
-		goto failed;
-	}
-
-	result = -EINVAL;
-	epd = &iface_desc->endpoint[1].desc;
-	if (!usb_endpoint_is_bulk_in(epd))
-		goto failed;
-	epd = &iface_desc->endpoint[2].desc;
-	if (!usb_endpoint_is_bulk_out(epd))
+	result = usb_find_common_endpoints(iface_desc, &bulk_in, &bulk_out, NULL, NULL);
+	if (result)
 		goto failed;
 
 	dev = interface_to_usbdev(interface);
@@ -95,6 +86,8 @@ static int prism2sta_probe_usb(struct usb_interface *interface,
 	}
 
 	/* Initialize the hw data */
+	hw->endp_in = usb_rcvbulkpipe(dev, bulk_in->bEndpointAddress);
+	hw->endp_out = usb_sndbulkpipe(dev, bulk_out->bEndpointAddress);
 	hfa384x_create(hw, dev);
 	hw->wlandev = wlandev;
 

From 1fa4e1259ee5a9f5764a1029db409b48fc55017b Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Mon, 14 Sep 2020 09:01:04 +0100
Subject: [PATCH 0592/2658] btrfs: fix wrong address when faulting in pages in
 the search ioctl

commit 1c78544eaa4660096aeb6a57ec82b42cdb3bfe5a upstream.

When faulting in the pages for the user supplied buffer for the search
ioctl, we are passing only the base address of the buffer to the function
fault_in_pages_writeable(). This means that after the first iteration of
the while loop that searches for leaves, when we have a non-zero offset,
stored in 'sk_offset', we try to fault in a wrong page range.

So fix this by adding the offset in 'sk_offset' to the base address of the
user supplied buffer when calling fault_in_pages_writeable().

Several users have reported that the applications compsize and bees have
started to operate incorrectly since commit a48b73eca4ceb9 ("btrfs: fix
potential deadlock in the search ioctl") was added to stable trees, and
these applications make heavy use of the search ioctls. This fixes their
issues.

Link: https://lore.kernel.org/linux-btrfs/632b888d-a3c3-b085-cdf5-f9bb61017d92@lechevalier.se/
Link: https://github.com/kilobyte/compsize/issues/34
Fixes: a48b73eca4ceb9 ("btrfs: fix potential deadlock in the search ioctl")
CC: stable@vger.kernel.org # 4.4+
Tested-by: A L <mail@lechevalier.se>
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/ioctl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 91a45ef69152..67366515a29d 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2129,7 +2129,8 @@ static noinline int search_ioctl(struct inode *inode,
 	key.offset = sk->min_offset;
 
 	while (1) {
-		ret = fault_in_pages_writeable(ubuf, *buf_size - sk_offset);
+		ret = fault_in_pages_writeable(ubuf + sk_offset,
+					       *buf_size - sk_offset);
 		if (ret)
 			break;
 

From 7868ad35846b8e3231ba3be80c22f6671116a8a6 Mon Sep 17 00:00:00 2001
From: Hou Pu <houpu@bytedance.com>
Date: Wed, 29 Jul 2020 09:03:43 -0400
Subject: [PATCH 0593/2658] scsi: target: iscsi: Fix hang in iscsit_access_np()
 when getting tpg->np_login_sem

commit ed43ffea78dcc97db3f561da834f1a49c8961e33 upstream.

The iSCSI target login thread might get stuck with the following stack:

cat /proc/`pidof iscsi_np`/stack
[<0>] down_interruptible+0x42/0x50
[<0>] iscsit_access_np+0xe3/0x167
[<0>] iscsi_target_locate_portal+0x695/0x8ac
[<0>] __iscsi_target_login_thread+0x855/0xb82
[<0>] iscsi_target_login_thread+0x2f/0x5a
[<0>] kthread+0xfa/0x130
[<0>] ret_from_fork+0x1f/0x30

This can be reproduced via the following steps:

1. Initiator A tries to log in to iqn1-tpg1 on port 3260. After finishing
   PDU exchange in the login thread and before the negotiation is finished
   the the network link goes down. At this point A has not finished login
   and tpg->np_login_sem is held.

2. Initiator B tries to log in to iqn2-tpg1 on port 3260. After finishing
   PDU exchange in the login thread the target expects to process remaining
   login PDUs in workqueue context.

3. Initiator A' tries to log in to iqn1-tpg1 on port 3260 from a new
   socket. A' will wait for tpg->np_login_sem with np->np_login_timer
   loaded to wait for at most 15 seconds. The lock is held by A so A'
   eventually times out.

4. Before A' got timeout initiator B gets negotiation failed and calls
   iscsi_target_login_drop()->iscsi_target_login_sess_out().  The
   np->np_login_timer is canceled and initiator A' will hang forever.
   Because A' is now in the login thread, no new login requests can be
   serviced.

Fix this by moving iscsi_stop_login_thread_timer() out of
iscsi_target_login_sess_out(). Also remove iscsi_np parameter from
iscsi_target_login_sess_out().

Link: https://lore.kernel.org/r/20200729130343.24976-1-houpu@bytedance.com
Cc: stable@vger.kernel.org
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Hou Pu <houpu@bytedance.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/target/iscsi/iscsi_target_login.c | 6 +++---
 drivers/target/iscsi/iscsi_target_login.h | 3 +--
 drivers/target/iscsi/iscsi_target_nego.c  | 3 +--
 3 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 63e54beed196..f10bcd0563c0 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1139,7 +1139,7 @@ iscsit_conn_set_transport(struct iscsi_conn *conn, struct iscsit_transport *t)
 }
 
 void iscsi_target_login_sess_out(struct iscsi_conn *conn,
-		struct iscsi_np *np, bool zero_tsih, bool new_sess)
+				 bool zero_tsih, bool new_sess)
 {
 	if (!new_sess)
 		goto old_sess_out;
@@ -1161,7 +1161,6 @@ void iscsi_target_login_sess_out(struct iscsi_conn *conn,
 	conn->sess = NULL;
 
 old_sess_out:
-	iscsi_stop_login_thread_timer(np);
 	/*
 	 * If login negotiation fails check if the Time2Retain timer
 	 * needs to be restarted.
@@ -1407,8 +1406,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
 new_sess_out:
 	new_sess = true;
 old_sess_out:
+	iscsi_stop_login_thread_timer(np);
 	tpg_np = conn->tpg_np;
-	iscsi_target_login_sess_out(conn, np, zero_tsih, new_sess);
+	iscsi_target_login_sess_out(conn, zero_tsih, new_sess);
 	new_sess = false;
 
 	if (tpg) {
diff --git a/drivers/target/iscsi/iscsi_target_login.h b/drivers/target/iscsi/iscsi_target_login.h
index b597aa2c61a1..e9daabbb4f54 100644
--- a/drivers/target/iscsi/iscsi_target_login.h
+++ b/drivers/target/iscsi/iscsi_target_login.h
@@ -14,8 +14,7 @@ extern int iscsit_put_login_tx(struct iscsi_conn *, struct iscsi_login *, u32);
 extern void iscsit_free_conn(struct iscsi_np *, struct iscsi_conn *);
 extern int iscsit_start_kthreads(struct iscsi_conn *);
 extern void iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8);
-extern void iscsi_target_login_sess_out(struct iscsi_conn *, struct iscsi_np *,
-				bool, bool);
+extern void iscsi_target_login_sess_out(struct iscsi_conn *, bool, bool);
 extern int iscsi_target_login_thread(void *);
 
 #endif   /*** ISCSI_TARGET_LOGIN_H ***/
diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index 58c629aec73c..31c3e37c41e5 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -547,12 +547,11 @@ static bool iscsi_target_sk_check_and_clear(struct iscsi_conn *conn, unsigned in
 
 static void iscsi_target_login_drop(struct iscsi_conn *conn, struct iscsi_login *login)
 {
-	struct iscsi_np *np = login->np;
 	bool zero_tsih = login->zero_tsih;
 
 	iscsi_remove_failed_auth_entry(conn);
 	iscsi_target_nego_release(conn);
-	iscsi_target_login_sess_out(conn, np, zero_tsih, true);
+	iscsi_target_login_sess_out(conn, zero_tsih, true);
 }
 
 static void iscsi_target_login_timeout(unsigned long data)

From d88dd89393ec244c7ed5d5f90ef41bf5c9798c90 Mon Sep 17 00:00:00 2001
From: Ilya Dryomov <idryomov@gmail.com>
Date: Thu, 3 Sep 2020 13:24:11 +0200
Subject: [PATCH 0594/2658] rbd: require global CAP_SYS_ADMIN for mapping and
 unmapping

commit f44d04e696feaf13d192d942c4f14ad2e117065a upstream.

It turns out that currently we rely only on sysfs attribute
permissions:

  $ ll /sys/bus/rbd/{add*,remove*}
  --w------- 1 root root 4096 Sep  3 20:37 /sys/bus/rbd/add
  --w------- 1 root root 4096 Sep  3 20:37 /sys/bus/rbd/add_single_major
  --w------- 1 root root 4096 Sep  3 20:37 /sys/bus/rbd/remove
  --w------- 1 root root 4096 Sep  3 20:38 /sys/bus/rbd/remove_single_major

This means that images can be mapped and unmapped (i.e. block devices
can be created and deleted) by a UID 0 process even after it drops all
privileges or by any process with CAP_DAC_OVERRIDE in its user namespace
as long as UID 0 is mapped into that user namespace.

Be consistent with other virtual block devices (loop, nbd, dm, md, etc)
and require CAP_SYS_ADMIN in the initial user namespace for mapping and
unmapping, and also for dumping the configuration string and refreshing
the image header.

Cc: stable@vger.kernel.org
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/block/rbd.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index e0699a20859f..445ca973edd6 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -3945,6 +3945,9 @@ static ssize_t rbd_image_refresh(struct device *dev,
 	struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
 	int ret;
 
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
 	ret = rbd_dev_refresh(rbd_dev);
 	if (ret)
 		return ret;
@@ -5404,6 +5407,9 @@ static ssize_t do_rbd_add(struct bus_type *bus,
 	bool read_only;
 	int rc;
 
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
 	if (!try_module_get(THIS_MODULE))
 		return -ENODEV;
 
@@ -5548,6 +5554,9 @@ static ssize_t do_rbd_remove(struct bus_type *bus,
 	bool already = false;
 	int ret;
 
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
 	ret = kstrtoul(buf, 10, &ul);
 	if (ret)
 		return ret;

From aa2b8f2abc30cb43c0bfe65727b2a3a9ddcccfa2 Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Mon, 7 Sep 2020 11:45:27 -0700
Subject: [PATCH 0595/2658] fbcon: remove soft scrollback code

commit 50145474f6ef4a9c19205b173da6264a644c7489 upstream.

This (and the VGA soft scrollback) turns out to have various nasty small
special cases that nobody really is willing to fight.  The soft
scrollback code was really useful a few decades ago when you typically
used the console interactively as the main way to interact with the
machine, but that just isn't the case any more.

So it's not worth dragging along.

Tested-by: Yuan Ming <yuanmingbuaa@gmail.com>
Tested-by: Willy Tarreau <w@1wt.eu>
Acked-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/console/fbcon.c | 336 +---------------------------------
 1 file changed, 4 insertions(+), 332 deletions(-)

diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index fe0663787b3c..0a0bb4ec52d6 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -101,12 +101,6 @@ static int logo_lines;
 /* logo_shown is an index to vc_cons when >= 0; otherwise follows FBCON_LOGO
    enums.  */
 static int logo_shown = FBCON_LOGO_CANSHOW;
-/* Software scrollback */
-static int fbcon_softback_size = 32768;
-static unsigned long softback_buf, softback_curr;
-static unsigned long softback_in;
-static unsigned long softback_top, softback_end;
-static int softback_lines;
 /* console mappings */
 static int first_fb_vc;
 static int last_fb_vc = MAX_NR_CONSOLES - 1;
@@ -140,8 +134,6 @@ static int fbcon_has_sysfs;
 
 static const struct consw fb_con;
 
-#define CM_SOFTBACK	(8)
-
 #define advance_row(p, delta) (unsigned short *)((unsigned long)(p) + (delta) * vc->vc_size_row)
 
 static int fbcon_set_origin(struct vc_data *);
@@ -171,7 +163,6 @@ static void fbcon_bmove(struct vc_data *vc, int sy, int sx, int dy, int dx,
 static int fbcon_switch(struct vc_data *vc);
 static int fbcon_blank(struct vc_data *vc, int blank, int mode_switch);
 static int fbcon_set_palette(struct vc_data *vc, unsigned char *table);
-static int fbcon_scrolldelta(struct vc_data *vc, int lines);
 
 /*
  *  Internal routines
@@ -350,18 +341,6 @@ static int get_color(struct vc_data *vc, struct fb_info *info,
 	return color;
 }
 
-static void fbcon_update_softback(struct vc_data *vc)
-{
-	int l = fbcon_softback_size / vc->vc_size_row;
-
-	if (l > 5)
-		softback_end = softback_buf + l * vc->vc_size_row;
-	else
-		/* Smaller scrollback makes no sense, and 0 would screw
-		   the operation totally */
-		softback_top = 0;
-}
-
 static void fb_flashcursor(struct work_struct *work)
 {
 	struct fb_info *info = container_of(work, struct fb_info, queue);
@@ -391,7 +370,7 @@ static void fb_flashcursor(struct work_struct *work)
 	c = scr_readw((u16 *) vc->vc_pos);
 	mode = (!ops->cursor_flash || ops->cursor_state.enable) ?
 		CM_ERASE : CM_DRAW;
-	ops->cursor(vc, info, mode, softback_lines, get_color(vc, info, c, 1),
+	ops->cursor(vc, info, mode, 0, get_color(vc, info, c, 1),
 		    get_color(vc, info, c, 0));
 	console_unlock();
 }
@@ -451,13 +430,7 @@ static int __init fb_console_setup(char *this_opt)
 		}
 		
 		if (!strncmp(options, "scrollback:", 11)) {
-			options += 11;
-			if (*options) {
-				fbcon_softback_size = simple_strtoul(options, &options, 0);
-				if (*options == 'k' || *options == 'K') {
-					fbcon_softback_size *= 1024;
-				}
-			}
+			pr_warn("Ignoring scrollback size option\n");
 			continue;
 		}
 		
@@ -962,31 +935,6 @@ static const char *fbcon_startup(void)
 	p->con_rotate = initial_rotation;
 	set_blitting_type(vc, info);
 
-	if (info->fix.type != FB_TYPE_TEXT) {
-		if (fbcon_softback_size) {
-			if (!softback_buf) {
-				softback_buf =
-				    (unsigned long)
-				    kmalloc(fbcon_softback_size,
-					    GFP_KERNEL);
-				if (!softback_buf) {
-					fbcon_softback_size = 0;
-					softback_top = 0;
-				}
-			}
-		} else {
-			if (softback_buf) {
-				kfree((void *) softback_buf);
-				softback_buf = 0;
-				softback_top = 0;
-			}
-		}
-		if (softback_buf)
-			softback_in = softback_top = softback_curr =
-			    softback_buf;
-		softback_lines = 0;
-	}
-
 	/* Setup default font */
 	if (!p->fontdata && !vc->vc_font.data) {
 		if (!fontname[0] || !(font = find_font(fontname)))
@@ -1149,9 +1097,6 @@ static void fbcon_init(struct vc_data *vc, int init)
 	if (logo)
 		fbcon_prepare_logo(vc, info, cols, rows, new_cols, new_rows);
 
-	if (vc == svc && softback_buf)
-		fbcon_update_softback(vc);
-
 	if (ops->rotate_font && ops->rotate_font(info, vc)) {
 		ops->rotate = FB_ROTATE_UR;
 		set_blitting_type(vc, info);
@@ -1311,7 +1256,6 @@ static void fbcon_cursor(struct vc_data *vc, int mode)
 {
 	struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];
 	struct fbcon_ops *ops = info->fbcon_par;
-	int y;
  	int c = scr_readw((u16 *) vc->vc_pos);
 
 	ops->cur_blink_jiffies = msecs_to_jiffies(vc->vc_cur_blink_ms);
@@ -1325,16 +1269,8 @@ static void fbcon_cursor(struct vc_data *vc, int mode)
 		fbcon_add_cursor_timer(info);
 
 	ops->cursor_flash = (mode == CM_ERASE) ? 0 : 1;
-	if (mode & CM_SOFTBACK) {
-		mode &= ~CM_SOFTBACK;
-		y = softback_lines;
-	} else {
-		if (softback_lines)
-			fbcon_set_origin(vc);
-		y = 0;
-	}
 
-	ops->cursor(vc, info, mode, y, get_color(vc, info, c, 1),
+	ops->cursor(vc, info, mode, 0, get_color(vc, info, c, 1),
 		    get_color(vc, info, c, 0));
 }
 
@@ -1405,8 +1341,6 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var,
 
 	if (CON_IS_VISIBLE(vc)) {
 		update_screen(vc);
-		if (softback_buf)
-			fbcon_update_softback(vc);
 	}
 }
 
@@ -1544,99 +1478,6 @@ static __inline__ void ypan_down_redraw(struct vc_data *vc, int t, int count)
 	scrollback_current = 0;
 }
 
-static void fbcon_redraw_softback(struct vc_data *vc, struct display *p,
-				  long delta)
-{
-	int count = vc->vc_rows;
-	unsigned short *d, *s;
-	unsigned long n;
-	int line = 0;
-
-	d = (u16 *) softback_curr;
-	if (d == (u16 *) softback_in)
-		d = (u16 *) vc->vc_origin;
-	n = softback_curr + delta * vc->vc_size_row;
-	softback_lines -= delta;
-	if (delta < 0) {
-		if (softback_curr < softback_top && n < softback_buf) {
-			n += softback_end - softback_buf;
-			if (n < softback_top) {
-				softback_lines -=
-				    (softback_top - n) / vc->vc_size_row;
-				n = softback_top;
-			}
-		} else if (softback_curr >= softback_top
-			   && n < softback_top) {
-			softback_lines -=
-			    (softback_top - n) / vc->vc_size_row;
-			n = softback_top;
-		}
-	} else {
-		if (softback_curr > softback_in && n >= softback_end) {
-			n += softback_buf - softback_end;
-			if (n > softback_in) {
-				n = softback_in;
-				softback_lines = 0;
-			}
-		} else if (softback_curr <= softback_in && n > softback_in) {
-			n = softback_in;
-			softback_lines = 0;
-		}
-	}
-	if (n == softback_curr)
-		return;
-	softback_curr = n;
-	s = (u16 *) softback_curr;
-	if (s == (u16 *) softback_in)
-		s = (u16 *) vc->vc_origin;
-	while (count--) {
-		unsigned short *start;
-		unsigned short *le;
-		unsigned short c;
-		int x = 0;
-		unsigned short attr = 1;
-
-		start = s;
-		le = advance_row(s, 1);
-		do {
-			c = scr_readw(s);
-			if (attr != (c & 0xff00)) {
-				attr = c & 0xff00;
-				if (s > start) {
-					fbcon_putcs(vc, start, s - start,
-						    line, x);
-					x += s - start;
-					start = s;
-				}
-			}
-			if (c == scr_readw(d)) {
-				if (s > start) {
-					fbcon_putcs(vc, start, s - start,
-						    line, x);
-					x += s - start + 1;
-					start = s + 1;
-				} else {
-					x++;
-					start++;
-				}
-			}
-			s++;
-			d++;
-		} while (s < le);
-		if (s > start)
-			fbcon_putcs(vc, start, s - start, line, x);
-		line++;
-		if (d == (u16 *) softback_end)
-			d = (u16 *) softback_buf;
-		if (d == (u16 *) softback_in)
-			d = (u16 *) vc->vc_origin;
-		if (s == (u16 *) softback_end)
-			s = (u16 *) softback_buf;
-		if (s == (u16 *) softback_in)
-			s = (u16 *) vc->vc_origin;
-	}
-}
-
 static void fbcon_redraw_move(struct vc_data *vc, struct display *p,
 			      int line, int count, int dy)
 {
@@ -1776,31 +1617,6 @@ static void fbcon_redraw(struct vc_data *vc, struct display *p,
 	}
 }
 
-static inline void fbcon_softback_note(struct vc_data *vc, int t,
-				       int count)
-{
-	unsigned short *p;
-
-	if (vc->vc_num != fg_console)
-		return;
-	p = (unsigned short *) (vc->vc_origin + t * vc->vc_size_row);
-
-	while (count) {
-		scr_memcpyw((u16 *) softback_in, p, vc->vc_size_row);
-		count--;
-		p = advance_row(p, 1);
-		softback_in += vc->vc_size_row;
-		if (softback_in == softback_end)
-			softback_in = softback_buf;
-		if (softback_in == softback_top) {
-			softback_top += vc->vc_size_row;
-			if (softback_top == softback_end)
-				softback_top = softback_buf;
-		}
-	}
-	softback_curr = softback_in;
-}
-
 static int fbcon_scroll(struct vc_data *vc, int t, int b, int dir,
 			int count)
 {
@@ -1823,8 +1639,6 @@ static int fbcon_scroll(struct vc_data *vc, int t, int b, int dir,
 	case SM_UP:
 		if (count > vc->vc_rows)	/* Maximum realistic size */
 			count = vc->vc_rows;
-		if (softback_top)
-			fbcon_softback_note(vc, t, count);
 		if (logo_shown >= 0)
 			goto redraw_up;
 		switch (p->scrollmode) {
@@ -2195,14 +2009,6 @@ static int fbcon_switch(struct vc_data *vc)
 	info = registered_fb[con2fb_map[vc->vc_num]];
 	ops = info->fbcon_par;
 
-	if (softback_top) {
-		if (softback_lines)
-			fbcon_set_origin(vc);
-		softback_top = softback_curr = softback_in = softback_buf;
-		softback_lines = 0;
-		fbcon_update_softback(vc);
-	}
-
 	if (logo_shown >= 0) {
 		struct vc_data *conp2 = vc_cons[logo_shown].d;
 
@@ -2536,9 +2342,6 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
 	int cnt;
 	char *old_data = NULL;
 
-	if (CON_IS_VISIBLE(vc) && softback_lines)
-		fbcon_set_origin(vc);
-
 	resize = (w != vc->vc_font.width) || (h != vc->vc_font.height);
 	if (p->userfont)
 		old_data = vc->vc_font.data;
@@ -2564,8 +2367,6 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
 		cols /= w;
 		rows /= h;
 		vc_resize(vc, cols, rows);
-		if (CON_IS_VISIBLE(vc) && softback_buf)
-			fbcon_update_softback(vc);
 	} else if (CON_IS_VISIBLE(vc)
 		   && vc->vc_mode == KD_TEXT) {
 		fbcon_clear_margins(vc, 0);
@@ -2723,19 +2524,7 @@ static int fbcon_set_palette(struct vc_data *vc, unsigned char *table)
 
 static u16 *fbcon_screen_pos(struct vc_data *vc, int offset)
 {
-	unsigned long p;
-	int line;
-	
-	if (vc->vc_num != fg_console || !softback_lines)
-		return (u16 *) (vc->vc_origin + offset);
-	line = offset / vc->vc_size_row;
-	if (line >= softback_lines)
-		return (u16 *) (vc->vc_origin + offset -
-				softback_lines * vc->vc_size_row);
-	p = softback_curr + offset;
-	if (p >= softback_end)
-		p += softback_buf - softback_end;
-	return (u16 *) p;
+	return (u16 *) (vc->vc_origin + offset);
 }
 
 static unsigned long fbcon_getxy(struct vc_data *vc, unsigned long pos,
@@ -2749,22 +2538,7 @@ static unsigned long fbcon_getxy(struct vc_data *vc, unsigned long pos,
 
 		x = offset % vc->vc_cols;
 		y = offset / vc->vc_cols;
-		if (vc->vc_num == fg_console)
-			y += softback_lines;
 		ret = pos + (vc->vc_cols - x) * 2;
-	} else if (vc->vc_num == fg_console && softback_lines) {
-		unsigned long offset = pos - softback_curr;
-
-		if (pos < softback_curr)
-			offset += softback_end - softback_buf;
-		offset /= 2;
-		x = offset % vc->vc_cols;
-		y = offset / vc->vc_cols;
-		ret = pos + (vc->vc_cols - x) * 2;
-		if (ret == softback_end)
-			ret = softback_buf;
-		if (ret == softback_in)
-			ret = vc->vc_origin;
 	} else {
 		/* Should not happen */
 		x = y = 0;
@@ -2792,107 +2566,11 @@ static void fbcon_invert_region(struct vc_data *vc, u16 * p, int cnt)
 			a = ((a) & 0x88ff) | (((a) & 0x7000) >> 4) |
 			    (((a) & 0x0700) << 4);
 		scr_writew(a, p++);
-		if (p == (u16 *) softback_end)
-			p = (u16 *) softback_buf;
-		if (p == (u16 *) softback_in)
-			p = (u16 *) vc->vc_origin;
 	}
 }
 
-static int fbcon_scrolldelta(struct vc_data *vc, int lines)
-{
-	struct fb_info *info = registered_fb[con2fb_map[fg_console]];
-	struct fbcon_ops *ops = info->fbcon_par;
-	struct display *disp = &fb_display[fg_console];
-	int offset, limit, scrollback_old;
-
-	if (softback_top) {
-		if (vc->vc_num != fg_console)
-			return 0;
-		if (vc->vc_mode != KD_TEXT || !lines)
-			return 0;
-		if (logo_shown >= 0) {
-			struct vc_data *conp2 = vc_cons[logo_shown].d;
-
-			if (conp2->vc_top == logo_lines
-			    && conp2->vc_bottom == conp2->vc_rows)
-				conp2->vc_top = 0;
-			if (logo_shown == vc->vc_num) {
-				unsigned long p, q;
-				int i;
-
-				p = softback_in;
-				q = vc->vc_origin +
-				    logo_lines * vc->vc_size_row;
-				for (i = 0; i < logo_lines; i++) {
-					if (p == softback_top)
-						break;
-					if (p == softback_buf)
-						p = softback_end;
-					p -= vc->vc_size_row;
-					q -= vc->vc_size_row;
-					scr_memcpyw((u16 *) q, (u16 *) p,
-						    vc->vc_size_row);
-				}
-				softback_in = softback_curr = p;
-				update_region(vc, vc->vc_origin,
-					      logo_lines * vc->vc_cols);
-			}
-			logo_shown = FBCON_LOGO_CANSHOW;
-		}
-		fbcon_cursor(vc, CM_ERASE | CM_SOFTBACK);
-		fbcon_redraw_softback(vc, disp, lines);
-		fbcon_cursor(vc, CM_DRAW | CM_SOFTBACK);
-		return 0;
-	}
-
-	if (!scrollback_phys_max)
-		return -ENOSYS;
-
-	scrollback_old = scrollback_current;
-	scrollback_current -= lines;
-	if (scrollback_current < 0)
-		scrollback_current = 0;
-	else if (scrollback_current > scrollback_max)
-		scrollback_current = scrollback_max;
-	if (scrollback_current == scrollback_old)
-		return 0;
-
-	if (fbcon_is_inactive(vc, info))
-		return 0;
-
-	fbcon_cursor(vc, CM_ERASE);
-
-	offset = disp->yscroll - scrollback_current;
-	limit = disp->vrows;
-	switch (disp->scrollmode) {
-	case SCROLL_WRAP_MOVE:
-		info->var.vmode |= FB_VMODE_YWRAP;
-		break;
-	case SCROLL_PAN_MOVE:
-	case SCROLL_PAN_REDRAW:
-		limit -= vc->vc_rows;
-		info->var.vmode &= ~FB_VMODE_YWRAP;
-		break;
-	}
-	if (offset < 0)
-		offset += limit;
-	else if (offset >= limit)
-		offset -= limit;
-
-	ops->var.xoffset = 0;
-	ops->var.yoffset = offset * vc->vc_font.height;
-	ops->update_start(info);
-
-	if (!scrollback_current)
-		fbcon_cursor(vc, CM_DRAW);
-	return 0;
-}
-
 static int fbcon_set_origin(struct vc_data *vc)
 {
-	if (softback_lines)
-		fbcon_scrolldelta(vc, softback_lines);
 	return 0;
 }
 
@@ -2956,8 +2634,6 @@ static void fbcon_modechanged(struct fb_info *info)
 
 		fbcon_set_palette(vc, color_table);
 		update_screen(vc);
-		if (softback_buf)
-			fbcon_update_softback(vc);
 	}
 }
 
@@ -3378,7 +3054,6 @@ static const struct consw fb_con = {
 	.con_font_default	= fbcon_set_def_font,
 	.con_font_copy 		= fbcon_copy_font,
 	.con_set_palette 	= fbcon_set_palette,
-	.con_scrolldelta 	= fbcon_scrolldelta,
 	.con_set_origin 	= fbcon_set_origin,
 	.con_invert_region 	= fbcon_invert_region,
 	.con_screen_pos 	= fbcon_screen_pos,
@@ -3587,9 +3262,6 @@ static void fbcon_exit(void)
 	if (fbcon_has_exited)
 		return;
 
-	kfree((void *)softback_buf);
-	softback_buf = 0UL;
-
 	for (i = 0; i < FB_MAX; i++) {
 		int pending = 0;
 

From 434bb3277cff66caed67930d0b2c8660f99193c2 Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Tue, 8 Sep 2020 10:56:27 -0700
Subject: [PATCH 0596/2658] fbcon: remove now unusued 'softback_lines' cursor()
 argument

commit 06a0df4d1b8b13b551668e47b11fd7629033b7df upstream.

Since the softscroll code got removed, this argument is always zero and
makes no sense any more.

Tested-by: Yuan Ming <yuanmingbuaa@gmail.com>
Tested-by: Willy Tarreau <w@1wt.eu>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/console/bitblit.c   | 11 +----------
 drivers/video/console/fbcon.c     |  4 ++--
 drivers/video/console/fbcon.h     |  2 +-
 drivers/video/console/fbcon_ccw.c | 11 +----------
 drivers/video/console/fbcon_cw.c  | 11 +----------
 drivers/video/console/fbcon_ud.c  | 11 +----------
 drivers/video/console/tileblit.c  |  2 +-
 7 files changed, 8 insertions(+), 44 deletions(-)

diff --git a/drivers/video/console/bitblit.c b/drivers/video/console/bitblit.c
index 05d1d36a5665..a7ab8323304d 100644
--- a/drivers/video/console/bitblit.c
+++ b/drivers/video/console/bitblit.c
@@ -234,7 +234,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info,
 }
 
 static void bit_cursor(struct vc_data *vc, struct fb_info *info, int mode,
-		       int softback_lines, int fg, int bg)
+		       int fg, int bg)
 {
 	struct fb_cursor cursor;
 	struct fbcon_ops *ops = info->fbcon_par;
@@ -247,15 +247,6 @@ static void bit_cursor(struct vc_data *vc, struct fb_info *info, int mode,
 
 	cursor.set = 0;
 
-	if (softback_lines) {
-		if (y + softback_lines >= vc->vc_rows) {
-			mode = CM_ERASE;
-			ops->cursor_flash = 0;
-			return;
-		} else
-			y += softback_lines;
-	}
-
  	c = scr_readw((u16 *) vc->vc_pos);
 	attribute = get_attribute(info, c);
 	src = vc->vc_font.data + ((c & charmask) * (w * vc->vc_font.height));
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 0a0bb4ec52d6..c62db94cf945 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -370,7 +370,7 @@ static void fb_flashcursor(struct work_struct *work)
 	c = scr_readw((u16 *) vc->vc_pos);
 	mode = (!ops->cursor_flash || ops->cursor_state.enable) ?
 		CM_ERASE : CM_DRAW;
-	ops->cursor(vc, info, mode, 0, get_color(vc, info, c, 1),
+	ops->cursor(vc, info, mode, get_color(vc, info, c, 1),
 		    get_color(vc, info, c, 0));
 	console_unlock();
 }
@@ -1270,7 +1270,7 @@ static void fbcon_cursor(struct vc_data *vc, int mode)
 
 	ops->cursor_flash = (mode == CM_ERASE) ? 0 : 1;
 
-	ops->cursor(vc, info, mode, 0, get_color(vc, info, c, 1),
+	ops->cursor(vc, info, mode, get_color(vc, info, c, 1),
 		    get_color(vc, info, c, 0));
 }
 
diff --git a/drivers/video/console/fbcon.h b/drivers/video/console/fbcon.h
index 7aaa4eabbba0..5ebdccd070eb 100644
--- a/drivers/video/console/fbcon.h
+++ b/drivers/video/console/fbcon.h
@@ -62,7 +62,7 @@ struct fbcon_ops {
 	void (*clear_margins)(struct vc_data *vc, struct fb_info *info,
 			      int bottom_only);
 	void (*cursor)(struct vc_data *vc, struct fb_info *info, int mode,
-		       int softback_lines, int fg, int bg);
+		       int fg, int bg);
 	int  (*update_start)(struct fb_info *info);
 	int  (*rotate_font)(struct fb_info *info, struct vc_data *vc);
 	struct fb_var_screeninfo var;  /* copy of the current fb_var_screeninfo */
diff --git a/drivers/video/console/fbcon_ccw.c b/drivers/video/console/fbcon_ccw.c
index 34da8bba9273..586702752005 100644
--- a/drivers/video/console/fbcon_ccw.c
+++ b/drivers/video/console/fbcon_ccw.c
@@ -219,7 +219,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info,
 }
 
 static void ccw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
-		       int softback_lines, int fg, int bg)
+		       int fg, int bg)
 {
 	struct fb_cursor cursor;
 	struct fbcon_ops *ops = info->fbcon_par;
@@ -236,15 +236,6 @@ static void ccw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
 
 	cursor.set = 0;
 
-	if (softback_lines) {
-		if (y + softback_lines >= vc->vc_rows) {
-			mode = CM_ERASE;
-			ops->cursor_flash = 0;
-			return;
-		} else
-			y += softback_lines;
-	}
-
  	c = scr_readw((u16 *) vc->vc_pos);
 	attribute = get_attribute(info, c);
 	src = ops->fontbuffer + ((c & charmask) * (w * vc->vc_font.width));
diff --git a/drivers/video/console/fbcon_cw.c b/drivers/video/console/fbcon_cw.c
index 0b552b3fc22a..f5a1134049f8 100644
--- a/drivers/video/console/fbcon_cw.c
+++ b/drivers/video/console/fbcon_cw.c
@@ -202,7 +202,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info,
 }
 
 static void cw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
-		      int softback_lines, int fg, int bg)
+		      int fg, int bg)
 {
 	struct fb_cursor cursor;
 	struct fbcon_ops *ops = info->fbcon_par;
@@ -219,15 +219,6 @@ static void cw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
 
 	cursor.set = 0;
 
-	if (softback_lines) {
-		if (y + softback_lines >= vc->vc_rows) {
-			mode = CM_ERASE;
-			ops->cursor_flash = 0;
-			return;
-		} else
-			y += softback_lines;
-	}
-
  	c = scr_readw((u16 *) vc->vc_pos);
 	attribute = get_attribute(info, c);
 	src = ops->fontbuffer + ((c & charmask) * (w * vc->vc_font.width));
diff --git a/drivers/video/console/fbcon_ud.c b/drivers/video/console/fbcon_ud.c
index 7f62efe2da52..cf8dac9ca2bb 100644
--- a/drivers/video/console/fbcon_ud.c
+++ b/drivers/video/console/fbcon_ud.c
@@ -249,7 +249,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info,
 }
 
 static void ud_cursor(struct vc_data *vc, struct fb_info *info, int mode,
-		      int softback_lines, int fg, int bg)
+		      int fg, int bg)
 {
 	struct fb_cursor cursor;
 	struct fbcon_ops *ops = info->fbcon_par;
@@ -267,15 +267,6 @@ static void ud_cursor(struct vc_data *vc, struct fb_info *info, int mode,
 
 	cursor.set = 0;
 
-	if (softback_lines) {
-		if (y + softback_lines >= vc->vc_rows) {
-			mode = CM_ERASE;
-			ops->cursor_flash = 0;
-			return;
-		} else
-			y += softback_lines;
-	}
-
  	c = scr_readw((u16 *) vc->vc_pos);
 	attribute = get_attribute(info, c);
 	src = ops->fontbuffer + ((c & charmask) * (w * vc->vc_font.height));
diff --git a/drivers/video/console/tileblit.c b/drivers/video/console/tileblit.c
index 15e8e1a89c45..3c0b242dba5f 100644
--- a/drivers/video/console/tileblit.c
+++ b/drivers/video/console/tileblit.c
@@ -80,7 +80,7 @@ static void tile_clear_margins(struct vc_data *vc, struct fb_info *info,
 }
 
 static void tile_cursor(struct vc_data *vc, struct fb_info *info, int mode,
-			int softback_lines, int fg, int bg)
+			int fg, int bg)
 {
 	struct fb_tilecursor cursor;
 	int use_sw = (vc->vc_cursor_type & 0x10);

From b4eab4c00ce211f87364152d6e59f17d626c556d Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Wed, 9 Sep 2020 14:53:50 -0700
Subject: [PATCH 0597/2658] vgacon: remove software scrollback support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 973c096f6a85e5b5f2a295126ba6928d9a6afd45 upstream.

Yunhai Zhang recently fixed a VGA software scrollback bug in commit
ebfdfeeae8c0 ("vgacon: Fix for missing check in scrollback handling"),
but that then made people look more closely at some of this code, and
there were more problems on the vgacon side, but also the fbcon software
scrollback.

We don't really have anybody who maintains this code - probably because
nobody actually _uses_ it any more.  Sure, people still use both VGA and
the framebuffer consoles, but they are no longer the main user
interfaces to the kernel, and haven't been for decades, so these kinds
of extra features end up bitrotting and not really being used.

So rather than try to maintain a likely unused set of code, I'll just
aggressively remove it, and see if anybody even notices.  Maybe there
are people who haven't jumped on the whole GUI badnwagon yet, and think
it's just a fad.  And maybe those people use the scrollback code.

If that turns out to be the case, we can resurrect this again, once
we've found the sucker^Wmaintainer for it who actually uses it.

Reported-by: NopNop Nop <nopitydays@gmail.com>
Tested-by: Willy Tarreau <w@1wt.eu>
Cc: 张云海 <zhangyunhai@nsfocus.com>
Acked-by: Andy Lutomirski <luto@amacapital.net>
Acked-by: Willy Tarreau <w@1wt.eu>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/configs/pasemi_defconfig |   1 -
 arch/powerpc/configs/ppc6xx_defconfig |   1 -
 arch/x86/configs/i386_defconfig       |   1 -
 arch/x86/configs/x86_64_defconfig     |   1 -
 drivers/video/console/Kconfig         |  25 ----
 drivers/video/console/vgacon.c        | 161 +-------------------------
 6 files changed, 1 insertion(+), 189 deletions(-)

diff --git a/arch/powerpc/configs/pasemi_defconfig b/arch/powerpc/configs/pasemi_defconfig
index 8f94782eb907..dc57fa11c687 100644
--- a/arch/powerpc/configs/pasemi_defconfig
+++ b/arch/powerpc/configs/pasemi_defconfig
@@ -115,7 +115,6 @@ CONFIG_FB_NVIDIA=y
 CONFIG_FB_NVIDIA_I2C=y
 CONFIG_FB_RADEON=y
 # CONFIG_LCD_CLASS_DEVICE is not set
-CONFIG_VGACON_SOFT_SCROLLBACK=y
 CONFIG_LOGO=y
 CONFIG_SOUND=y
 CONFIG_SND=y
diff --git a/arch/powerpc/configs/ppc6xx_defconfig b/arch/powerpc/configs/ppc6xx_defconfig
index e5d2c3dc07f1..c82bda4d27df 100644
--- a/arch/powerpc/configs/ppc6xx_defconfig
+++ b/arch/powerpc/configs/ppc6xx_defconfig
@@ -797,7 +797,6 @@ CONFIG_FB_TRIDENT=m
 CONFIG_FB_SM501=m
 CONFIG_FB_IBM_GXT4500=y
 CONFIG_LCD_PLATFORM=m
-CONFIG_VGACON_SOFT_SCROLLBACK=y
 CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
 CONFIG_LOGO=y
diff --git a/arch/x86/configs/i386_defconfig b/arch/x86/configs/i386_defconfig
index 028be48c8839..8710c27907f8 100644
--- a/arch/x86/configs/i386_defconfig
+++ b/arch/x86/configs/i386_defconfig
@@ -218,7 +218,6 @@ CONFIG_FB_MODE_HELPERS=y
 CONFIG_FB_TILEBLITTING=y
 CONFIG_FB_EFI=y
 # CONFIG_LCD_CLASS_DEVICE is not set
-CONFIG_VGACON_SOFT_SCROLLBACK=y
 CONFIG_LOGO=y
 # CONFIG_LOGO_LINUX_MONO is not set
 # CONFIG_LOGO_LINUX_VGA16 is not set
diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig
index cb5b3ab5beec..8848e62a60aa 100644
--- a/arch/x86/configs/x86_64_defconfig
+++ b/arch/x86/configs/x86_64_defconfig
@@ -212,7 +212,6 @@ CONFIG_FB_MODE_HELPERS=y
 CONFIG_FB_TILEBLITTING=y
 CONFIG_FB_EFI=y
 # CONFIG_LCD_CLASS_DEVICE is not set
-CONFIG_VGACON_SOFT_SCROLLBACK=y
 CONFIG_LOGO=y
 # CONFIG_LOGO_LINUX_MONO is not set
 # CONFIG_LOGO_LINUX_VGA16 is not set
diff --git a/drivers/video/console/Kconfig b/drivers/video/console/Kconfig
index 38da6e299149..c31715019cb4 100644
--- a/drivers/video/console/Kconfig
+++ b/drivers/video/console/Kconfig
@@ -22,31 +22,6 @@ config VGA_CONSOLE
 
 	  Say Y.
 
-config VGACON_SOFT_SCROLLBACK
-       bool "Enable Scrollback Buffer in System RAM"
-       depends on VGA_CONSOLE
-       default n
-       help
-         The scrollback buffer of the standard VGA console is located in
-	 the VGA RAM.  The size of this RAM is fixed and is quite small.
-	 If you require a larger scrollback buffer, this can be placed in
-	 System RAM which is dynamically allocated during initialization.
-	 Placing the scrollback buffer in System RAM will slightly slow
-	 down the console.
-
-	 If you want this feature, say 'Y' here and enter the amount of
-	 RAM to allocate for this buffer.  If unsure, say 'N'.
-
-config VGACON_SOFT_SCROLLBACK_SIZE
-       int "Scrollback Buffer Size (in KB)"
-       depends on VGACON_SOFT_SCROLLBACK
-       range 1 1024
-       default "64"
-       help
-         Enter the amount of System RAM to allocate for the scrollback
-	 buffer.  Each 64KB will give you approximately 16 80x25
-	 screenfuls of scrollback buffer
-
 config MDA_CONSOLE
 	depends on !M68K && !PARISC && ISA
 	tristate "MDA text console (dual-headed)"
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index edf0af8dd0a4..c35ae8c732f6 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -180,159 +180,6 @@ static inline void vga_set_mem_top(struct vc_data *c)
 	write_vga(12, (c->vc_visible_origin - vga_vram_base) / 2);
 }
 
-#ifdef CONFIG_VGACON_SOFT_SCROLLBACK
-/* software scrollback */
-static void *vgacon_scrollback;
-static int vgacon_scrollback_tail;
-static int vgacon_scrollback_size;
-static int vgacon_scrollback_rows;
-static int vgacon_scrollback_cnt;
-static int vgacon_scrollback_cur;
-static int vgacon_scrollback_save;
-static int vgacon_scrollback_restore;
-
-static void vgacon_scrollback_init(int pitch)
-{
-	int rows = CONFIG_VGACON_SOFT_SCROLLBACK_SIZE * 1024/pitch;
-
-	if (vgacon_scrollback) {
-		vgacon_scrollback_cnt  = 0;
-		vgacon_scrollback_tail = 0;
-		vgacon_scrollback_cur  = 0;
-		vgacon_scrollback_rows = rows - 1;
-		vgacon_scrollback_size = rows * pitch;
-	}
-}
-
-static void vgacon_scrollback_startup(void)
-{
-	vgacon_scrollback = kcalloc(CONFIG_VGACON_SOFT_SCROLLBACK_SIZE, 1024, GFP_NOWAIT);
-	vgacon_scrollback_init(vga_video_num_columns * 2);
-}
-
-static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
-{
-	void *p;
-
-	if (!vgacon_scrollback_size || c->vc_num != fg_console)
-		return;
-
-	p = (void *) (c->vc_origin + t * c->vc_size_row);
-
-	while (count--) {
-		if ((vgacon_scrollback_tail + c->vc_size_row) >
-		    vgacon_scrollback_size)
-			vgacon_scrollback_tail = 0;
-
-		scr_memcpyw(vgacon_scrollback + vgacon_scrollback_tail,
-			    p, c->vc_size_row);
-		vgacon_scrollback_cnt++;
-		p += c->vc_size_row;
-		vgacon_scrollback_tail += c->vc_size_row;
-
-		if (vgacon_scrollback_tail >= vgacon_scrollback_size)
-			vgacon_scrollback_tail = 0;
-
-		if (vgacon_scrollback_cnt > vgacon_scrollback_rows)
-			vgacon_scrollback_cnt = vgacon_scrollback_rows;
-
-		vgacon_scrollback_cur = vgacon_scrollback_cnt;
-	}
-}
-
-static void vgacon_restore_screen(struct vc_data *c)
-{
-	vgacon_scrollback_save = 0;
-
-	if (!vga_is_gfx && !vgacon_scrollback_restore) {
-		scr_memcpyw((u16 *) c->vc_origin, (u16 *) c->vc_screenbuf,
-			    c->vc_screenbuf_size > vga_vram_size ?
-			    vga_vram_size : c->vc_screenbuf_size);
-		vgacon_scrollback_restore = 1;
-		vgacon_scrollback_cur = vgacon_scrollback_cnt;
-	}
-}
-
-static int vgacon_scrolldelta(struct vc_data *c, int lines)
-{
-	int start, end, count, soff;
-
-	if (!lines) {
-		c->vc_visible_origin = c->vc_origin;
-		vga_set_mem_top(c);
-		return 1;
-	}
-
-	if (!vgacon_scrollback)
-		return 1;
-
-	if (!vgacon_scrollback_save) {
-		vgacon_cursor(c, CM_ERASE);
-		vgacon_save_screen(c);
-		vgacon_scrollback_save = 1;
-	}
-
-	vgacon_scrollback_restore = 0;
-	start = vgacon_scrollback_cur + lines;
-	end = start + abs(lines);
-
-	if (start < 0)
-		start = 0;
-
-	if (start > vgacon_scrollback_cnt)
-		start = vgacon_scrollback_cnt;
-
-	if (end < 0)
-		end = 0;
-
-	if (end > vgacon_scrollback_cnt)
-		end = vgacon_scrollback_cnt;
-
-	vgacon_scrollback_cur = start;
-	count = end - start;
-	soff = vgacon_scrollback_tail - ((vgacon_scrollback_cnt - end) *
-					 c->vc_size_row);
-	soff -= count * c->vc_size_row;
-
-	if (soff < 0)
-		soff += vgacon_scrollback_size;
-
-	count = vgacon_scrollback_cnt - start;
-
-	if (count > c->vc_rows)
-		count = c->vc_rows;
-
-	if (count) {
-		int copysize;
-
-		int diff = c->vc_rows - count;
-		void *d = (void *) c->vc_origin;
-		void *s = (void *) c->vc_screenbuf;
-
-		count *= c->vc_size_row;
-		/* how much memory to end of buffer left? */
-		copysize = min(count, vgacon_scrollback_size - soff);
-		scr_memcpyw(d, vgacon_scrollback + soff, copysize);
-		d += copysize;
-		count -= copysize;
-
-		if (count) {
-			scr_memcpyw(d, vgacon_scrollback, count);
-			d += count;
-		}
-
-		if (diff)
-			scr_memcpyw(d, s, diff * c->vc_size_row);
-	} else
-		vgacon_cursor(c, CM_MOVE);
-
-	return 1;
-}
-#else
-#define vgacon_scrollback_startup(...) do { } while (0)
-#define vgacon_scrollback_init(...)    do { } while (0)
-#define vgacon_scrollback_update(...)  do { } while (0)
-
 static void vgacon_restore_screen(struct vc_data *c)
 {
 	if (c->vc_origin != c->vc_visible_origin)
@@ -369,7 +216,6 @@ static int vgacon_scrolldelta(struct vc_data *c, int lines)
 	vga_set_mem_top(c);
 	return 1;
 }
-#endif /* CONFIG_VGACON_SOFT_SCROLLBACK */
 
 static const char *vgacon_startup(void)
 {
@@ -566,10 +412,7 @@ static const char *vgacon_startup(void)
 	vgacon_xres = screen_info.orig_video_cols * VGA_FONTWIDTH;
 	vgacon_yres = vga_scan_lines;
 
-	if (!vga_init_done) {
-		vgacon_scrollback_startup();
-		vga_init_done = 1;
-	}
+	vga_init_done = 1;
 
 	return display_desc;
 }
@@ -865,7 +708,6 @@ static int vgacon_switch(struct vc_data *c)
 			vgacon_doresize(c, c->vc_cols, c->vc_rows);
 	}
 
-	vgacon_scrollback_init(c->vc_size_row);
 	return 0;		/* Redrawing not needed */
 }
 
@@ -1398,7 +1240,6 @@ static int vgacon_scroll(struct vc_data *c, int t, int b, int dir,
 	oldo = c->vc_origin;
 	delta = lines * c->vc_size_row;
 	if (dir == SM_UP) {
-		vgacon_scrollback_update(c, t, lines);
 		if (c->vc_scr_end + delta >= vga_vram_end) {
 			scr_memcpyw((u16 *) vga_vram_base,
 				    (u16 *) (oldo + delta),

From 2dbe554e8970609c70c1d7f3cb403d3765694771 Mon Sep 17 00:00:00 2001
From: Wanpeng Li <wanpengli@tencent.com>
Date: Wed, 19 Aug 2020 16:55:27 +0800
Subject: [PATCH 0598/2658] KVM: VMX: Don't freeze guest when event delivery
 causes an APIC-access exit

commit 99b82a1437cb31340dbb2c437a2923b9814a7b15 upstream.

According to SDM 27.2.4, Event delivery causes an APIC-access VM exit.
Don't report internal error and freeze guest when event delivery causes
an APIC-access exit, it is handleable and the event will be re-injected
during the next vmentry.

Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
Message-Id: <1597827327-25055-2-git-send-email-wanpengli@tencent.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/vmx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 22da8f87bd64..6646edaa5123 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -8235,6 +8235,7 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu)
 			(exit_reason != EXIT_REASON_EXCEPTION_NMI &&
 			exit_reason != EXIT_REASON_EPT_VIOLATION &&
 			exit_reason != EXIT_REASON_PML_FULL &&
+			exit_reason != EXIT_REASON_APIC_ACCESS &&
 			exit_reason != EXIT_REASON_TASK_SWITCH)) {
 		vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
 		vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_DELIVERY_EV;

From 09b642b9218a5f6630cd136628e8ff7372d826a6 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Date: Mon, 31 Aug 2020 19:37:00 +0900
Subject: [PATCH 0599/2658] video: fbdev: fix OOB read in
 vga_8planes_imageblit()

commit bd018a6a75cebb511bb55a0e7690024be975fe93 upstream.

syzbot is reporting OOB read at vga_8planes_imageblit() [1], for
"cdat[y] >> 4" can become a negative value due to "const char *cdat".

[1] https://syzkaller.appspot.com/bug?id=0d7a0da1557dcd1989e00cb3692b26d4173b4132

Reported-by: syzbot <syzbot+69fbd3e01470f169c8c4@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/90b55ec3-d5b0-3307-9f7c-7ff5c5fd6ad3@i-love.sakura.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/fbdev/vga16fb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c
index 283d335a759f..1acdb41a8a7c 100644
--- a/drivers/video/fbdev/vga16fb.c
+++ b/drivers/video/fbdev/vga16fb.c
@@ -1122,7 +1122,7 @@ static void vga_8planes_imageblit(struct fb_info *info, const struct fb_image *i
         char oldop = setop(0);
         char oldsr = setsr(0);
         char oldmask = selectmask();
-        const char *cdat = image->data;
+	const unsigned char *cdat = image->data;
 	u32 dx = image->dx;
         char __iomem *where;
         int y;

From 84567abb2b4342a8030ad4fd8c1e9177afb0f61f Mon Sep 17 00:00:00 2001
From: Patrick Riphagen <patrick.riphagen@xsens.com>
Date: Thu, 6 Aug 2020 13:55:47 +0200
Subject: [PATCH 0600/2658] USB: serial: ftdi_sio: add IDs for Xsens Mti USB
 converter

commit 6ccc48e0eb2f3a5f3bd39954a21317e5f8874726 upstream.

The device added has an FTDI chip inside.
The device is used to connect Xsens USB Motion Trackers.

Cc: stable@vger.kernel.org
Signed-off-by: Patrick Riphagen <patrick.riphagen@xsens.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/ftdi_sio.c     | 1 +
 drivers/usb/serial/ftdi_sio_ids.h | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 0afea511eb37..25e76d4c1505 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -708,6 +708,7 @@ static const struct usb_device_id id_table_combined[] = {
 	{ USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) },
 	{ USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) },
 	{ USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) },
+	{ USB_DEVICE(XSENS_VID, XSENS_MTIUSBCONVERTER_PID) },
 	{ USB_DEVICE(XSENS_VID, XSENS_MTW_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
 	{ USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 32a40ab9a385..c33e06752b5f 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -159,6 +159,7 @@
 #define XSENS_AWINDA_DONGLE_PID 0x0102
 #define XSENS_MTW_PID		0x0200	/* Xsens MTw */
 #define XSENS_MTDEVBOARD_PID	0x0300	/* Motion Tracker Development Board */
+#define XSENS_MTIUSBCONVERTER_PID	0x0301	/* MTi USB converter */
 #define XSENS_CONVERTER_PID	0xD00D	/* Xsens USB-serial converter */
 
 /* Xsens devices using FTDI VID */

From cd91deda0179a53f615f776baa3db04c69c745e4 Mon Sep 17 00:00:00 2001
From: Aleksander Morgado <aleksander@aleksander.es>
Date: Sat, 29 Aug 2020 11:05:39 +0200
Subject: [PATCH 0601/2658] USB: serial: option: add support for
 SIM7070/SIM7080/SIM7090 modules

commit 1ac698790819b83f39fd7ea4f6cdabee9bdd7b38 upstream.

These modules have 2 different USB layouts:

The default layout with PID 0x9205 (AT+CUSBSELNV=1) exposes 4 TTYs and
an ECM interface:

  T:  Bus=02 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#=  6 Spd=480 MxCh= 0
  D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
  P:  Vendor=1e0e ProdID=9205 Rev=00.00
  S:  Manufacturer=SimTech, Incorporated
  S:  Product=SimTech SIM7080
  S:  SerialNumber=1234567890ABCDEF
  C:  #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA
  I:  If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
  I:  If#=0x1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
  I:  If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
  I:  If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
  I:  If#=0x4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
  I:  If#=0x5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether

The purpose of each TTY is as follows:
 * ttyUSB0: DIAG/QCDM port.
 * ttyUSB1: GNSS data.
 * ttyUSB2: AT-capable port (control).
 * ttyUSB3: AT-capable port (data).

In the secondary layout with PID=0x9206 (AT+CUSBSELNV=86) the module
exposes 6 TTY ports:

  T:  Bus=02 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#=  8 Spd=480 MxCh= 0
  D:  Ver= 2.00 Cls=02(commc) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
  P:  Vendor=1e0e ProdID=9206 Rev=00.00
  S:  Manufacturer=SimTech, Incorporated
  S:  Product=SimTech SIM7080
  S:  SerialNumber=1234567890ABCDEF
  C:  #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA
  I:  If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
  I:  If#=0x1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
  I:  If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
  I:  If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
  I:  If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
  I:  If#=0x5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option

The purpose of each TTY is as follows:
 * ttyUSB0: DIAG/QCDM port.
 * ttyUSB1: GNSS data.
 * ttyUSB2: AT-capable port (control).
 * ttyUSB3: QFLOG interface.
 * ttyUSB4: DAM interface.
 * ttyUSB5: AT-capable port (data).

Signed-off-by: Aleksander Morgado <aleksander@aleksander.es>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 52b1092ed57e..8cff50ef4fd1 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1808,6 +1808,8 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) },	/* Simcom SIM7500/SIM7600 MBIM mode */
 	{ USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9011, 0xff),	/* Simcom SIM7500/SIM7600 RNDIS mode */
 	  .driver_info = RSVD(7) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9205, 0xff) },	/* Simcom SIM7070/SIM7080/SIM7090 AT+ECM mode */
+	{ USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9206, 0xff) },	/* Simcom SIM7070/SIM7080/SIM7090 AT-only mode */
 	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
 	  .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) },
 	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D),

From 0847d21c34ddfab5775a9a78f27e1e62de1f8905 Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Tue, 1 Sep 2020 11:25:28 +0300
Subject: [PATCH 0602/2658] usb: Fix out of sync data toggle if a configured
 device is reconfigured

commit cfd54fa83a5068b61b7eb28d3c117d8354c74c7a upstream.

Userspace drivers that use a SetConfiguration() request to "lightweight"
reset an already configured usb device might cause data toggles to get out
of sync between the device and host, and the device becomes unusable.

The xHCI host requires endpoints to be dropped and added back to reset the
toggle. If USB core notices the new configuration is the same as the
current active configuration it will avoid these extra steps by calling
usb_reset_configuration() instead of usb_set_configuration().

A SetConfiguration() request will reset the device side data toggles.
Make sure usb_reset_configuration() function also drops and adds back the
endpoints to ensure data toggles are in sync.

To avoid code duplication split the current usb_disable_device() function
and reuse the endpoint specific part.

Cc: stable <stable@vger.kernel.org>
Tested-by: Martin Thierer <mthierer@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200901082528.12557-1-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/message.c | 91 ++++++++++++++++++--------------------
 1 file changed, 42 insertions(+), 49 deletions(-)

diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index f083ecfddd1b..e568325cb6e1 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1141,6 +1141,34 @@ void usb_disable_interface(struct usb_device *dev, struct usb_interface *intf,
 	}
 }
 
+/*
+ * usb_disable_device_endpoints -- Disable all endpoints for a device
+ * @dev: the device whose endpoints are being disabled
+ * @skip_ep0: 0 to disable endpoint 0, 1 to skip it.
+ */
+static void usb_disable_device_endpoints(struct usb_device *dev, int skip_ep0)
+{
+	struct usb_hcd *hcd = bus_to_hcd(dev->bus);
+	int i;
+
+	if (hcd->driver->check_bandwidth) {
+		/* First pass: Cancel URBs, leave endpoint pointers intact. */
+		for (i = skip_ep0; i < 16; ++i) {
+			usb_disable_endpoint(dev, i, false);
+			usb_disable_endpoint(dev, i + USB_DIR_IN, false);
+		}
+		/* Remove endpoints from the host controller internal state */
+		mutex_lock(hcd->bandwidth_mutex);
+		usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
+		mutex_unlock(hcd->bandwidth_mutex);
+	}
+	/* Second pass: remove endpoint pointers */
+	for (i = skip_ep0; i < 16; ++i) {
+		usb_disable_endpoint(dev, i, true);
+		usb_disable_endpoint(dev, i + USB_DIR_IN, true);
+	}
+}
+
 /**
  * usb_disable_device - Disable all the endpoints for a USB device
  * @dev: the device whose endpoints are being disabled
@@ -1154,7 +1182,6 @@ void usb_disable_interface(struct usb_device *dev, struct usb_interface *intf,
 void usb_disable_device(struct usb_device *dev, int skip_ep0)
 {
 	int i;
-	struct usb_hcd *hcd = bus_to_hcd(dev->bus);
 
 	/* getting rid of interfaces will disconnect
 	 * any drivers bound to them (a key side effect)
@@ -1200,22 +1227,8 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
 
 	dev_dbg(&dev->dev, "%s nuking %s URBs\n", __func__,
 		skip_ep0 ? "non-ep0" : "all");
-	if (hcd->driver->check_bandwidth) {
-		/* First pass: Cancel URBs, leave endpoint pointers intact. */
-		for (i = skip_ep0; i < 16; ++i) {
-			usb_disable_endpoint(dev, i, false);
-			usb_disable_endpoint(dev, i + USB_DIR_IN, false);
-		}
-		/* Remove endpoints from the host controller internal state */
-		mutex_lock(hcd->bandwidth_mutex);
-		usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
-		mutex_unlock(hcd->bandwidth_mutex);
-		/* Second pass: remove endpoint pointers */
-	}
-	for (i = skip_ep0; i < 16; ++i) {
-		usb_disable_endpoint(dev, i, true);
-		usb_disable_endpoint(dev, i + USB_DIR_IN, true);
-	}
+
+	usb_disable_device_endpoints(dev, skip_ep0);
 }
 
 /**
@@ -1458,6 +1471,9 @@ EXPORT_SYMBOL_GPL(usb_set_interface);
  * The caller must own the device lock.
  *
  * Return: Zero on success, else a negative error code.
+ *
+ * If this routine fails the device will probably be in an unusable state
+ * with endpoints disabled, and interfaces only partially enabled.
  */
 int usb_reset_configuration(struct usb_device *dev)
 {
@@ -1473,10 +1489,7 @@ int usb_reset_configuration(struct usb_device *dev)
 	 * calls during probe() are fine
 	 */
 
-	for (i = 1; i < 16; ++i) {
-		usb_disable_endpoint(dev, i, true);
-		usb_disable_endpoint(dev, i + USB_DIR_IN, true);
-	}
+	usb_disable_device_endpoints(dev, 1); /* skip ep0*/
 
 	config = dev->actconfig;
 	retval = 0;
@@ -1489,34 +1502,10 @@ int usb_reset_configuration(struct usb_device *dev)
 		mutex_unlock(hcd->bandwidth_mutex);
 		return -ENOMEM;
 	}
-	/* Make sure we have enough bandwidth for each alternate setting 0 */
-	for (i = 0; i < config->desc.bNumInterfaces; i++) {
-		struct usb_interface *intf = config->interface[i];
-		struct usb_host_interface *alt;
 
-		alt = usb_altnum_to_altsetting(intf, 0);
-		if (!alt)
-			alt = &intf->altsetting[0];
-		if (alt != intf->cur_altsetting)
-			retval = usb_hcd_alloc_bandwidth(dev, NULL,
-					intf->cur_altsetting, alt);
-		if (retval < 0)
-			break;
-	}
-	/* If not, reinstate the old alternate settings */
+	/* xHCI adds all endpoints in usb_hcd_alloc_bandwidth */
+	retval = usb_hcd_alloc_bandwidth(dev, config, NULL, NULL);
 	if (retval < 0) {
-reset_old_alts:
-		for (i--; i >= 0; i--) {
-			struct usb_interface *intf = config->interface[i];
-			struct usb_host_interface *alt;
-
-			alt = usb_altnum_to_altsetting(intf, 0);
-			if (!alt)
-				alt = &intf->altsetting[0];
-			if (alt != intf->cur_altsetting)
-				usb_hcd_alloc_bandwidth(dev, NULL,
-						alt, intf->cur_altsetting);
-		}
 		usb_enable_lpm(dev);
 		mutex_unlock(hcd->bandwidth_mutex);
 		return retval;
@@ -1525,8 +1514,12 @@ int usb_reset_configuration(struct usb_device *dev)
 			USB_REQ_SET_CONFIGURATION, 0,
 			config->desc.bConfigurationValue, 0,
 			NULL, 0, USB_CTRL_SET_TIMEOUT);
-	if (retval < 0)
-		goto reset_old_alts;
+	if (retval < 0) {
+		usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
+		usb_enable_lpm(dev);
+		mutex_unlock(hcd->bandwidth_mutex);
+		return retval;
+	}
 	mutex_unlock(hcd->bandwidth_mutex);
 
 	/* re-init hc/hcd interface/endpoint state */

From 4c2a9c440a56b6c939f762e6095a058d18c18b84 Mon Sep 17 00:00:00 2001
From: Peter Oberparleiter <oberpar@linux.ibm.com>
Date: Thu, 10 Sep 2020 14:52:01 +0200
Subject: [PATCH 0603/2658] gcov: add support for GCC 10.1

[ Upstream commit 40249c6962075c040fd071339acae524f18bfac9 ]

Using gcov to collect coverage data for kernels compiled with GCC 10.1
causes random malfunctions and kernel crashes.  This is the result of a
changed GCOV_COUNTERS value in GCC 10.1 that causes a mismatch between
the layout of the gcov_info structure created by GCC profiling code and
the related structure used by the kernel.

Fix this by updating the in-kernel GCOV_COUNTERS value.  Also re-enable
config GCOV_KERNEL for use with GCC 10.

Reported-by: Colin Ian King <colin.king@canonical.com>
Reported-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Tested-by: Leon Romanovsky <leonro@nvidia.com>
Tested-and-Acked-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/gcov/Kconfig   | 1 -
 kernel/gcov/gcc_4_7.c | 4 +++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/gcov/Kconfig b/kernel/gcov/Kconfig
index 1d78ed19a351..1276aabaab55 100644
--- a/kernel/gcov/Kconfig
+++ b/kernel/gcov/Kconfig
@@ -3,7 +3,6 @@ menu "GCOV-based kernel profiling"
 config GCOV_KERNEL
 	bool "Enable gcov-based kernel profiling"
 	depends on DEBUG_FS
-	depends on !CC_IS_GCC || GCC_VERSION < 100000
 	select CONSTRUCTORS if !UML
 	default n
 	---help---
diff --git a/kernel/gcov/gcc_4_7.c b/kernel/gcov/gcc_4_7.c
index 46a18e72bce6..6d5ef6220afe 100644
--- a/kernel/gcov/gcc_4_7.c
+++ b/kernel/gcov/gcc_4_7.c
@@ -18,7 +18,9 @@
 #include <linux/vmalloc.h>
 #include "gcov.h"
 
-#if (__GNUC__ >= 7)
+#if (__GNUC__ >= 10)
+#define GCOV_COUNTERS			8
+#elif (__GNUC__ >= 7)
 #define GCOV_COUNTERS			9
 #elif (__GNUC__ > 5) || (__GNUC__ == 5 && __GNUC_MINOR__ >= 1)
 #define GCOV_COUNTERS			10

From 56e2544caa93995a74041fc7b8eea437f9f3ac68 Mon Sep 17 00:00:00 2001
From: Olga Kornievskaia <kolga@netapp.com>
Date: Thu, 20 Aug 2020 18:52:43 -0400
Subject: [PATCH 0604/2658] NFSv4.1 handle ERR_DELAY error reclaiming locking
 state on delegation recall

[ Upstream commit 3d7a9520f0c3e6a68b6de8c5812fc8b6d7a52626 ]

A client should be able to handle getting an ERR_DELAY error
while doing a LOCK call to reclaim state due to delegation being
recalled. This is a transient error that can happen due to server
moving its volumes and invalidating its file location cache and
upon reference to it during the LOCK call needing to do an
expensive lookup (leading to an ERR_DELAY error on a PUTFH).

Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs4proc.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ca1702cefb85..64d15c2662db 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -6171,7 +6171,12 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state,
 	err = nfs4_set_lock_state(state, fl);
 	if (err != 0)
 		return err;
-	err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW);
+	do {
+		err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW);
+		if (err != -NFS4ERR_DELAY)
+			break;
+		ssleep(1);
+	} while (err == -NFS4ERR_DELAY);
 	return nfs4_handle_delegation_recall_error(server, state, stateid, fl, err);
 }
 

From 630db0fdc31c7b4cf7e5cf57a85fdbdf61e9df90 Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Sun, 23 Aug 2020 17:14:53 +0800
Subject: [PATCH 0605/2658] scsi: pm8001: Fix memleak in
 pm8001_exec_internal_task_abort

[ Upstream commit ea403fde7552bd61bad6ea45e3feb99db77cb31e ]

When pm8001_tag_alloc() fails, task should be freed just like it is done in
the subsequent error paths.

Link: https://lore.kernel.org/r/20200823091453.4782-1-dinghao.liu@zju.edu.cn
Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/pm8001/pm8001_sas.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index 3862d8b1defe..ee6c941123e1 100644
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -792,7 +792,7 @@ pm8001_exec_internal_task_abort(struct pm8001_hba_info *pm8001_ha,
 
 		res = pm8001_tag_alloc(pm8001_ha, &ccb_tag);
 		if (res)
-			return res;
+			goto ex_err;
 		ccb = &pm8001_ha->ccb_info[ccb_tag];
 		ccb->device = pm8001_dev;
 		ccb->ccb_tag = ccb_tag;

From 3a1d169b2e0291dbf9cd856f09a5b534d0b41bb5 Mon Sep 17 00:00:00 2001
From: James Smart <james.smart@broadcom.com>
Date: Fri, 28 Aug 2020 10:53:30 -0700
Subject: [PATCH 0606/2658] scsi: lpfc: Fix FLOGI/PLOGI receive race condition
 in pt2pt discovery

[ Upstream commit 7b08e89f98cee9907895fabb64cf437bc505ce9a ]

The driver is unable to successfully login with remote device. During pt2pt
login, the driver completes its FLOGI request with the remote device having
WWN precedence.  The remote device issues its own (delayed) FLOGI after
accepting the driver's and, upon transmitting the FLOGI, immediately
recognizes it has already processed the driver's FLOGI thus it transitions
to sending a PLOGI before waiting for an ACC to its FLOGI.

In the driver, the FLOGI is received and an ACC sent, followed by the PLOGI
being received and an ACC sent. The issue is that the PLOGI reception
occurs before the response from the adapter from the FLOGI ACC is
received. Processing of the PLOGI sets state flags to perform the REG_RPI
mailbox command and proceed with the rest of discovery on the port. The
same completion routine used by both FLOGI and PLOGI is generic in
nature. One of the things it does is clear flags, and those flags happen to
drive the rest of discovery.  So what happened was the PLOGI processing set
the flags, the FLOGI ACC completion cleared them, thus when the PLOGI ACC
completes it doesn't see the flags and stops.

Fix by modifying the generic completion routine to not clear the rest of
discovery flag (NLP_ACC_REGLOGIN) unless the completion is also associated
with performing a mailbox command as part of its handling.  For things such
as FLOGI ACC, there isn't a subsequent action to perform with the adapter,
thus there is no mailbox cmd ptr. PLOGI ACC though will perform REG_RPI
upon completion, thus there is a mailbox cmd ptr.

Link: https://lore.kernel.org/r/20200828175332.130300-3-james.smart@broadcom.com
Co-developed-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/lpfc/lpfc_els.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 315dd25a0c44..5be938b47f48 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -3841,7 +3841,9 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 out:
 	if (ndlp && NLP_CHK_NODE_ACT(ndlp) && shost) {
 		spin_lock_irq(shost->host_lock);
-		ndlp->nlp_flag &= ~(NLP_ACC_REGLOGIN | NLP_RM_DFLT_RPI);
+		if (mbox)
+			ndlp->nlp_flag &= ~NLP_ACC_REGLOGIN;
+		ndlp->nlp_flag &= ~NLP_RM_DFLT_RPI;
 		spin_unlock_irq(shost->host_lock);
 
 		/* If the node is not being used by another discovery thread,

From 6683d83ebfd4acfa8198f2f3d743f461ec98c582 Mon Sep 17 00:00:00 2001
From: "J. Bruce Fields" <bfields@redhat.com>
Date: Sat, 5 Sep 2020 10:03:26 -0400
Subject: [PATCH 0607/2658] SUNRPC: stop printk reading past end of string

[ Upstream commit 8c6b6c793ed32b8f9770ebcdf1ba99af423c303b ]

Since p points at raw xdr data, there's no guarantee that it's NULL
terminated, so we should give a length.  And probably escape any special
characters too.

Reported-by: Zhi Li <yieli@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/rpcb_clnt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index c89626b2afff..696381a51634 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -977,8 +977,8 @@ static int rpcb_dec_getaddr(struct rpc_rqst *req, struct xdr_stream *xdr,
 	p = xdr_inline_decode(xdr, len);
 	if (unlikely(p == NULL))
 		goto out_fail;
-	dprintk("RPC: %5u RPCB_%s reply: %s\n", req->rq_task->tk_pid,
-			req->rq_task->tk_msg.rpc_proc->p_name, (char *)p);
+	dprintk("RPC: %5u RPCB_%s reply: %*pE\n", req->rq_task->tk_pid,
+			req->rq_task->tk_msg.rpc_proc->p_name, len, (char *)p);
 
 	if (rpc_uaddr2sockaddr(req->rq_xprt->xprt_net, (char *)p, len,
 				sap, sizeof(address)) == 0)

From 785b720e9bced3ca0837e3857a4a59ff6350ed79 Mon Sep 17 00:00:00 2001
From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Date: Wed, 29 Jul 2020 01:19:40 +0300
Subject: [PATCH 0608/2658] rapidio: Replace 'select' DMAENGINES 'with depends
 on'

[ Upstream commit d2b86100245080cfdf1e95e9e07477474c1be2bd ]

Enabling a whole subsystem from a single driver 'select' is frowned
upon and won't be accepted in new drivers, that need to use 'depends on'
instead. Existing selection of DMAENGINES will then cause circular
dependencies. Replace them with a dependency.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rapidio/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/rapidio/Kconfig b/drivers/rapidio/Kconfig
index 3e3be57e9a1a..4d0c1a40a6e6 100644
--- a/drivers/rapidio/Kconfig
+++ b/drivers/rapidio/Kconfig
@@ -25,7 +25,7 @@ config RAPIDIO_ENABLE_RX_TX_PORTS
 config RAPIDIO_DMA_ENGINE
 	bool "DMA Engine support for RapidIO"
 	depends on RAPIDIO
-	select DMADEVICES
+	depends on DMADEVICES
 	select DMA_ENGINE
 	help
 	  Say Y here if you want to use DMA Engine frameork for RapidIO data

From 1dd3a991f6b2bd079acd604722aa50b1eb8084e4 Mon Sep 17 00:00:00 2001
From: Evan Nimmo <evan.nimmo@alliedtelesis.co.nz>
Date: Wed, 9 Sep 2020 08:32:47 +1200
Subject: [PATCH 0609/2658] i2c: algo: pca: Reapply i2c bus settings after
 reset

[ Upstream commit 0a355aeb24081e4538d4d424cd189f16c0bbd983 ]

If something goes wrong (such as the SCL being stuck low) then we need
to reset the PCA chip. The issue with this is that on reset we lose all
config settings and the chip ends up in a disabled state which results
in a lock up/high CPU usage. We need to re-apply any configuration that
had previously been set and re-enable the chip.

Signed-off-by: Evan Nimmo <evan.nimmo@alliedtelesis.co.nz>
Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/algos/i2c-algo-pca.c | 35 +++++++++++++++++++++-----------
 include/linux/i2c-algo-pca.h     | 15 ++++++++++++++
 2 files changed, 38 insertions(+), 12 deletions(-)

diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c
index 3a9db4626cb6..1886588b9ea3 100644
--- a/drivers/i2c/algos/i2c-algo-pca.c
+++ b/drivers/i2c/algos/i2c-algo-pca.c
@@ -50,8 +50,22 @@ static void pca_reset(struct i2c_algo_pca_data *adap)
 		pca_outw(adap, I2C_PCA_INDPTR, I2C_PCA_IPRESET);
 		pca_outw(adap, I2C_PCA_IND, 0xA5);
 		pca_outw(adap, I2C_PCA_IND, 0x5A);
+
+		/*
+		 * After a reset we need to re-apply any configuration
+		 * (calculated in pca_init) to get the bus in a working state.
+		 */
+		pca_outw(adap, I2C_PCA_INDPTR, I2C_PCA_IMODE);
+		pca_outw(adap, I2C_PCA_IND, adap->bus_settings.mode);
+		pca_outw(adap, I2C_PCA_INDPTR, I2C_PCA_ISCLL);
+		pca_outw(adap, I2C_PCA_IND, adap->bus_settings.tlow);
+		pca_outw(adap, I2C_PCA_INDPTR, I2C_PCA_ISCLH);
+		pca_outw(adap, I2C_PCA_IND, adap->bus_settings.thi);
+
+		pca_set_con(adap, I2C_PCA_CON_ENSIO);
 	} else {
 		adap->reset_chip(adap->data);
+		pca_set_con(adap, I2C_PCA_CON_ENSIO | adap->bus_settings.clock_freq);
 	}
 }
 
@@ -435,13 +449,14 @@ static int pca_init(struct i2c_adapter *adap)
 				" Use the nominal frequency.\n", adap->name);
 		}
 
-		pca_reset(pca_data);
-
 		clock = pca_clock(pca_data);
 		printk(KERN_INFO "%s: Clock frequency is %dkHz\n",
 		     adap->name, freqs[clock]);
 
-		pca_set_con(pca_data, I2C_PCA_CON_ENSIO | clock);
+		/* Store settings as these will be needed when the PCA chip is reset */
+		pca_data->bus_settings.clock_freq = clock;
+
+		pca_reset(pca_data);
 	} else {
 		int clock;
 		int mode;
@@ -508,19 +523,15 @@ static int pca_init(struct i2c_adapter *adap)
 			thi = tlow * min_thi / min_tlow;
 		}
 
+		/* Store settings as these will be needed when the PCA chip is reset */
+		pca_data->bus_settings.mode = mode;
+		pca_data->bus_settings.tlow = tlow;
+		pca_data->bus_settings.thi = thi;
+
 		pca_reset(pca_data);
 
 		printk(KERN_INFO
 		     "%s: Clock frequency is %dHz\n", adap->name, clock * 100);
-
-		pca_outw(pca_data, I2C_PCA_INDPTR, I2C_PCA_IMODE);
-		pca_outw(pca_data, I2C_PCA_IND, mode);
-		pca_outw(pca_data, I2C_PCA_INDPTR, I2C_PCA_ISCLL);
-		pca_outw(pca_data, I2C_PCA_IND, tlow);
-		pca_outw(pca_data, I2C_PCA_INDPTR, I2C_PCA_ISCLH);
-		pca_outw(pca_data, I2C_PCA_IND, thi);
-
-		pca_set_con(pca_data, I2C_PCA_CON_ENSIO);
 	}
 	udelay(500); /* 500 us for oscillator to stabilise */
 
diff --git a/include/linux/i2c-algo-pca.h b/include/linux/i2c-algo-pca.h
index a3c3ecd59f08..7a43afd27365 100644
--- a/include/linux/i2c-algo-pca.h
+++ b/include/linux/i2c-algo-pca.h
@@ -52,6 +52,20 @@
 #define I2C_PCA_CON_SI		0x08 /* Serial Interrupt */
 #define I2C_PCA_CON_CR		0x07 /* Clock Rate (MASK) */
 
+/**
+ * struct pca_i2c_bus_settings - The configured PCA i2c bus settings
+ * @mode: Configured i2c bus mode
+ * @tlow: Configured SCL LOW period
+ * @thi: Configured SCL HIGH period
+ * @clock_freq: The configured clock frequency
+ */
+struct pca_i2c_bus_settings {
+	int mode;
+	int tlow;
+	int thi;
+	int clock_freq;
+};
+
 struct i2c_algo_pca_data {
 	void 				*data;	/* private low level data */
 	void (*write_byte)		(void *data, int reg, int val);
@@ -63,6 +77,7 @@ struct i2c_algo_pca_data {
 	 * For PCA9665, use the frequency you want here. */
 	unsigned int			i2c_clock;
 	unsigned int			chip;
+	struct pca_i2c_bus_settings		bus_settings;
 };
 
 int i2c_pca_add_bus(struct i2c_adapter *);

From b9098de07a886744a3aa0b18cc770265c9fc592f Mon Sep 17 00:00:00 2001
From: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Date: Mon, 14 Sep 2020 18:05:00 +0200
Subject: [PATCH 0610/2658] MIPS: SNI: Fix MIPS_L1_CACHE_SHIFT

[ Upstream commit 564c836fd945a94b5dd46597d6b7adb464092650 ]

Commit 930beb5ac09a ("MIPS: introduce MIPS_L1_CACHE_SHIFT_<N>") forgot
to select the correct MIPS_L1_CACHE_SHIFT for SNI RM. This breaks non
coherent DMA because of a wrong allocation alignment.

Fixes: 930beb5ac09a ("MIPS: introduce MIPS_L1_CACHE_SHIFT_<N>")
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 596cbda9cb3d..9d8bc19edc48 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -817,6 +817,7 @@ config SNI_RM
 	select I8253
 	select I8259
 	select ISA
+	select MIPS_L1_CACHE_SHIFT_6
 	select SWAP_IO_SPACE if CPU_BIG_ENDIAN
 	select SYS_HAS_CPU_R4X00
 	select SYS_HAS_CPU_R5000

From d33933f93505cbd5d8ac1dacb2e7f073deda56c9 Mon Sep 17 00:00:00 2001
From: Namhyung Kim <namhyung@kernel.org>
Date: Tue, 15 Sep 2020 12:18:19 +0900
Subject: [PATCH 0611/2658] perf test: Free formats for perf pmu parse test

[ Upstream commit d26383dcb2b4b8629fde05270b4e3633be9e3d4b ]

The following leaks were detected by ASAN:

  Indirect leak of 360 byte(s) in 9 object(s) allocated from:
    #0 0x7fecc305180e in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10780e)
    #1 0x560578f6dce5 in perf_pmu__new_format util/pmu.c:1333
    #2 0x560578f752fc in perf_pmu_parse util/pmu.y:59
    #3 0x560578f6a8b7 in perf_pmu__format_parse util/pmu.c:73
    #4 0x560578e07045 in test__pmu tests/pmu.c:155
    #5 0x560578de109b in run_test tests/builtin-test.c:410
    #6 0x560578de109b in test_and_print tests/builtin-test.c:440
    #7 0x560578de401a in __cmd_test tests/builtin-test.c:661
    #8 0x560578de401a in cmd_test tests/builtin-test.c:807
    #9 0x560578e49354 in run_builtin /home/namhyung/project/linux/tools/perf/perf.c:312
    #10 0x560578ce71a8 in handle_internal_command /home/namhyung/project/linux/tools/perf/perf.c:364
    #11 0x560578ce71a8 in run_argv /home/namhyung/project/linux/tools/perf/perf.c:408
    #12 0x560578ce71a8 in main /home/namhyung/project/linux/tools/perf/perf.c:538
    #13 0x7fecc2b7acc9 in __libc_start_main ../csu/libc-start.c:308

Fixes: cff7f956ec4a1 ("perf tests: Move pmu tests into separate object")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Acked-by: Jiri Olsa <jolsa@redhat.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Link: http://lore.kernel.org/lkml/20200915031819.386559-12-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/tests/pmu.c |  1 +
 tools/perf/util/pmu.c  | 11 +++++++++++
 tools/perf/util/pmu.h  |  1 +
 3 files changed, 13 insertions(+)

diff --git a/tools/perf/tests/pmu.c b/tools/perf/tests/pmu.c
index b776831ceeea..4ca6d4dc8661 100644
--- a/tools/perf/tests/pmu.c
+++ b/tools/perf/tests/pmu.c
@@ -169,6 +169,7 @@ int test__pmu(void)
 		ret = 0;
 	} while (0);
 
+	perf_pmu__del_formats(&formats);
 	test_format_dir_put(format);
 	return ret;
 }
diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
index 5245fbd09106..8d99b6d9c36a 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
@@ -921,6 +921,17 @@ void perf_pmu__set_format(unsigned long *bits, long from, long to)
 		set_bit(b, bits);
 }
 
+void perf_pmu__del_formats(struct list_head *formats)
+{
+	struct perf_pmu_format *fmt, *tmp;
+
+	list_for_each_entry_safe(fmt, tmp, formats, list) {
+		list_del(&fmt->list);
+		free(fmt->name);
+		free(fmt);
+	}
+}
+
 static int sub_non_neg(int a, int b)
 {
 	if (b > a)
diff --git a/tools/perf/util/pmu.h b/tools/perf/util/pmu.h
index 5d7e84466bee..6789b1efc7d6 100644
--- a/tools/perf/util/pmu.h
+++ b/tools/perf/util/pmu.h
@@ -66,6 +66,7 @@ int perf_pmu__new_format(struct list_head *list, char *name,
 			 int config, unsigned long *bits);
 void perf_pmu__set_format(unsigned long *bits, long from, long to);
 int perf_pmu__format_parse(char *dir, struct list_head *head);
+void perf_pmu__del_formats(struct list_head *formats);
 
 struct perf_pmu *perf_pmu__scan(struct perf_pmu *pmu);
 

From 32ceca22beb30e0d9926e1c51d337e6248710859 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date: Fri, 11 Sep 2020 07:57:06 +0900
Subject: [PATCH 0612/2658] fbcon: Fix user font detection test at
 fbcon_resize().

[ Upstream commit ec0972adecb391a8d8650832263a4790f3bfb4df ]

syzbot is reporting OOB read at fbcon_resize() [1], for
commit 39b3cffb8cf31117 ("fbcon: prevent user font height or width change
 from causing potential out-of-bounds access") is by error using
registered_fb[con2fb_map[vc->vc_num]]->fbcon_par->p->userfont (which was
set to non-zero) instead of fb_display[vc->vc_num].userfont (which remains
zero for that display).

We could remove tricky userfont flag [2], for we can determine it by
comparing address of the font data and addresses of built-in font data.
But since that commit is failing to fix the original OOB read [3], this
patch keeps the change minimal in case we decide to revert altogether.

[1] https://syzkaller.appspot.com/bug?id=ebcbbb6576958a496500fee9cf7aa83ea00b5920
[2] https://syzkaller.appspot.com/text?tag=Patch&x=14030853900000
[3] https://syzkaller.appspot.com/bug?id=6fba8c186d97cf1011ab17660e633b1cc4e080c9

Reported-by: syzbot <syzbot+b38b1ef6edf0c74a8d97@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 39b3cffb8cf31117 ("fbcon: prevent user font height or width change from causing potential out-of-bounds access")
Cc: George Kennedy <george.kennedy@oracle.com>
Link: https://lore.kernel.org/r/f6e3e611-8704-1263-d163-f52c906a4f06@I-love.SAKURA.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/console/fbcon.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index c62db94cf945..e57fa26bcff1 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -1943,7 +1943,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,
 	struct fb_var_screeninfo var = info->var;
 	int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;
 
-	if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) {
+	if (p->userfont && FNTSIZE(vc->vc_font.data)) {
 		int size;
 		int pitch = PITCH(vc->vc_font.width);
 

From f3c74973f7c678253c27b853bc8b671f63f69e5d Mon Sep 17 00:00:00 2001
From: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Date: Wed, 16 Sep 2020 15:54:37 +0200
Subject: [PATCH 0613/2658] MIPS: SNI: Fix spurious interrupts

[ Upstream commit b959b97860d0fee8c8f6a3e641d3c2ad76eab6be ]

On A20R machines the interrupt pending bits in cause register need to be
updated by requesting the chipset to do it. This needs to be done to
find the interrupt cause and after interrupt service. In
commit 0b888c7f3a03 ("MIPS: SNI: Convert to new irq_chip functions") the
function to do after service update got lost, which caused spurious
interrupts.

Fixes: 0b888c7f3a03 ("MIPS: SNI: Convert to new irq_chip functions")
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/sni/a20r.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/mips/sni/a20r.c b/arch/mips/sni/a20r.c
index f9407e170476..c6af7047eb0d 100644
--- a/arch/mips/sni/a20r.c
+++ b/arch/mips/sni/a20r.c
@@ -143,7 +143,10 @@ static struct platform_device sc26xx_pdev = {
 	},
 };
 
-static u32 a20r_ack_hwint(void)
+/*
+ * Trigger chipset to update CPU's CAUSE IP field
+ */
+static u32 a20r_update_cause_ip(void)
 {
 	u32 status = read_c0_status();
 
@@ -205,12 +208,14 @@ static void a20r_hwint(void)
 	int irq;
 
 	clear_c0_status(IE_IRQ0);
-	status = a20r_ack_hwint();
+	status = a20r_update_cause_ip();
 	cause = read_c0_cause();
 
 	irq = ffs(((cause & status) >> 8) & 0xf8);
 	if (likely(irq > 0))
 		do_IRQ(SNI_A20R_IRQ_BASE + irq - 1);
+
+	a20r_update_cause_ip();
 	set_c0_status(IE_IRQ0);
 }
 

From 2ef4a7bdc58cd23b3d0c47893a2d44bec321b9ad Mon Sep 17 00:00:00 2001
From: Penghao <penghao@uniontech.com>
Date: Mon, 7 Sep 2020 10:30:26 +0800
Subject: [PATCH 0614/2658] USB: quirks: Add USB_QUIRK_IGNORE_REMOTE_WAKEUP
 quirk for BYD zhaoxin notebook

commit bcea6dafeeef7d1a6a8320a249aabf981d63b881 upstream.

Add a USB_QUIRK_IGNORE_REMOTE_WAKEUP quirk for the BYD zhaoxin notebook.
This notebook come with usb touchpad. And we would like to disable
touchpad wakeup on this notebook by default.

Signed-off-by: Penghao <penghao@uniontech.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200907023026.28189-1-penghao@uniontech.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/quirks.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index eed7c8d8e3d4..dd72e85f2e17 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -236,6 +236,10 @@ static const struct usb_device_id usb_quirk_list[] = {
 	/* Generic RTL8153 based ethernet adapters */
 	{ USB_DEVICE(0x0bda, 0x8153), .driver_info = USB_QUIRK_NO_LPM },
 
+	/* SONiX USB DEVICE Touchpad */
+	{ USB_DEVICE(0x0c45, 0x7056), .driver_info =
+			USB_QUIRK_IGNORE_REMOTE_WAKEUP },
+
 	/* Action Semiconductor flash disk */
 	{ USB_DEVICE(0x10d6, 0x2200), .driver_info =
 			USB_QUIRK_STRING_FETCH_255 },

From 6bb48534c8fcee944f8f20c30cbfabf7f63980a3 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Wed, 16 Sep 2020 11:40:25 +0200
Subject: [PATCH 0615/2658] USB: UAS: fix disconnect by unplugging a hub

commit 325b008723b2dd31de020e85ab9d2e9aa4637d35 upstream.

The SCSI layer can go into an ugly loop if you ignore that a device is
gone. You need to report an error in the command rather than in the
return value of the queue method.

We need to specifically check for ENODEV. The issue goes back to the
introduction of the driver.

Fixes: 115bb1ffa54c3 ("USB: Add UAS driver")
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200916094026.30085-2-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/uas.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index 698ba127b635..34dcd2e1b4fe 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -646,8 +646,7 @@ static int uas_queuecommand_lck(struct scsi_cmnd *cmnd,
 	if (devinfo->resetting) {
 		cmnd->result = DID_ERROR << 16;
 		cmnd->scsi_done(cmnd);
-		spin_unlock_irqrestore(&devinfo->lock, flags);
-		return 0;
+		goto zombie;
 	}
 
 	/* Find a free uas-tag */
@@ -682,6 +681,16 @@ static int uas_queuecommand_lck(struct scsi_cmnd *cmnd,
 		cmdinfo->state &= ~(SUBMIT_DATA_IN_URB | SUBMIT_DATA_OUT_URB);
 
 	err = uas_submit_urbs(cmnd, devinfo, GFP_ATOMIC);
+	/*
+	 * in case of fatal errors the SCSI layer is peculiar
+	 * a command that has finished is a success for the purpose
+	 * of queueing, no matter how fatal the error
+	 */
+	if (err == -ENODEV) {
+		cmnd->result = DID_ERROR << 16;
+		cmnd->scsi_done(cmnd);
+		goto zombie;
+	}
 	if (err) {
 		/* If we did nothing, give up now */
 		if (cmdinfo->state & SUBMIT_STATUS_URB) {
@@ -692,6 +701,7 @@ static int uas_queuecommand_lck(struct scsi_cmnd *cmnd,
 	}
 
 	devinfo->cmnd[idx] = cmnd;
+zombie:
 	spin_unlock_irqrestore(&devinfo->lock, flags);
 	return 0;
 }

From 05b16342030f1071e4374a6e0db6c6f8d5305918 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Thu, 17 Sep 2020 12:34:27 +0200
Subject: [PATCH 0616/2658] usblp: fix race between disconnect() and read()

commit 9cdabcb3ef8c24ca3a456e4db7b012befb688e73 upstream.

read() needs to check whether the device has been
disconnected before it tries to talk to the device.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+be5b5f86a162a6c281e6@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20200917103427.15740-1-oneukum@suse.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/usblp.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
index c578d64edc15..71c2ae4b8106 100644
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -840,6 +840,11 @@ static ssize_t usblp_read(struct file *file, char __user *buffer, size_t len, lo
 	if (rv < 0)
 		return rv;
 
+	if (!usblp->present) {
+		count = -ENODEV;
+		goto done;
+	}
+
 	if ((avail = usblp->rstatus) < 0) {
 		printk(KERN_ERR "usblp%d: error %d reading from printer\n",
 		    usblp->minor, (int)avail);

From 154261f5ca04e4b008476d758f370cbad192429b Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Tue, 8 Sep 2020 16:27:29 -0700
Subject: [PATCH 0617/2658] Input: i8042 - add Entroware Proteus EL07R4 to
 nomux and reset lists

commit c4440b8a457779adeec42c5e181cb4016f19ce0f upstream.

The keyboard drops keypresses early during boot unless both the nomux
and reset quirks are set. Add DMI table entries for this.

BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1806085
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20200907095656.13155-1-hdegoede@redhat.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/serio/i8042-x86ia64io.h | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index bdc42923523e..e5799639fb54 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -552,6 +552,14 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5738"),
 		},
 	},
+	{
+		/* Entroware Proteus */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Entroware"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Proteus"),
+			DMI_MATCH(DMI_PRODUCT_VERSION, "EL07R4"),
+		},
+	},
 	{ }
 };
 
@@ -752,6 +760,14 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"),
 		},
 	},
+	{
+		/* Entroware Proteus */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Entroware"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Proteus"),
+			DMI_MATCH(DMI_PRODUCT_VERSION, "EL07R4"),
+		},
+	},
 	{ }
 };
 

From 19e2e3740c1908f730d95cb83d90cab2114c60fa Mon Sep 17 00:00:00 2001
From: Tobias Diedrich <tobiasdiedrich@gmail.com>
Date: Mon, 14 Sep 2020 19:36:28 +0200
Subject: [PATCH 0618/2658] serial: 8250_pci: Add Realtek 816a and 816b

commit 3c5a87be170aba8ac40982182f812dcff6ed1ad1 upstream.

These serial ports are exposed by the OOB-management-engine on
RealManage-enabled network cards (e.g. AMD DASH enabled systems using
Realtek cards).

Because these have 3 BARs, they fail the "num_iomem <= 1" check in
serial_pci_guess_board.

I've manually checked the two IOMEM regions and BAR 2 doesn't seem to
respond to reads, but BAR 4 seems to be an MMIO version of the IO ports
(untested).

With this change, the ports are detected:
0000:02:00.1: ttyS0 at I/O 0x2200 (irq = 82, base_baud = 115200) is a 16550A
0000:02:00.2: ttyS1 at I/O 0x2100 (irq = 55, base_baud = 115200) is a 16550A

lspci output:
02:00.1 0700: 10ec:816a (rev 0e) (prog-if 02 [16550])
        Subsystem: 17aa:5082
        Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
        Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort+ <TAbort- <MAbort- >SERR- <PERR- INTx-
        Interrupt: pin B routed to IRQ 82
        IOMMU group: 11
        Region 0: I/O ports at 2200 [size=256]
        Region 2: Memory at fd715000 (64-bit, non-prefetchable) [size=4K]
        Region 4: Memory at fd704000 (64-bit, non-prefetchable) [size=16K]
        Capabilities: [40] Power Management version 3
                Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=375mA PME(D0+,D1+,D2+,D3hot+,D3cold+)
                Status: D0 NoSoftRst+ PME-Enable- DSel=0 DScale=0 PME-
        Capabilities: [50] MSI: Enable- Count=1/1 Maskable- 64bit+
                Address: 0000000000000000  Data: 0000
        Capabilities: [70] Express (v2) Endpoint, MSI 01
                DevCap: MaxPayload 128 bytes, PhantFunc 0, Latency L0s unlimited, L1 <64us
                        ExtTag- AttnBtn- AttnInd- PwrInd- RBE+ FLReset- SlotPowerLimit 0.000W
                DevCtl: CorrErr- NonFatalErr- FatalErr- UnsupReq-
                        RlxdOrd+ ExtTag- PhantFunc- AuxPwr- NoSnoop-
                        MaxPayload 128 bytes, MaxReadReq 512 bytes
                DevSta: CorrErr+ NonFatalErr- FatalErr- UnsupReq+ AuxPwr+ TransPend-
                LnkCap: Port #0, Speed 2.5GT/s, Width x1, ASPM L0s L1, Exit Latency L0s unlimited, L1 <64us
                        ClockPM+ Surprise- LLActRep- BwNot- ASPMOptComp+
                LnkCtl: ASPM L1 Enabled; RCB 64 bytes, Disabled- CommClk+
                        ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
                LnkSta: Speed 2.5GT/s (ok), Width x1 (ok)
                        TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-
                DevCap2: Completion Timeout: Range ABCD, TimeoutDis+ NROPrPrP- LTR+
                         10BitTagComp- 10BitTagReq- OBFF Via message/WAKE#, ExtFmt- EETLPPrefix-
                         EmergencyPowerReduction Not Supported, EmergencyPowerReductionInit-
                         FRS- TPHComp- ExtTPHComp-
                         AtomicOpsCap: 32bit- 64bit- 128bitCAS-
                DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis- LTR- OBFF Disabled,
                         AtomicOpsCtl: ReqEn-
                LnkSta2: Current De-emphasis Level: -6dB, EqualizationComplete- EqualizationPhase1-
                         EqualizationPhase2- EqualizationPhase3- LinkEqualizationRequest-
                         Retimer- 2Retimers- CrosslinkRes: unsupported
        Capabilities: [b0] MSI-X: Enable- Count=4 Masked-
                Vector table: BAR=4 offset=00000000
                PBA: BAR=4 offset=00000800
        Capabilities: [d0] Vital Product Data
                Not readable
        Capabilities: [100 v2] Advanced Error Reporting
                UESta:  DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
                UEMsk:  DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
                UESvrt: DLP+ SDES+ TLP- FCP+ CmpltTO- CmpltAbrt- UnxCmplt- RxOF+ MalfTLP+ ECRC- UnsupReq- ACSViol-
                CESta:  RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr+
                CEMsk:  RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr+
                AERCap: First Error Pointer: 00, ECRCGenCap+ ECRCGenEn- ECRCChkCap+ ECRCChkEn-
                        MultHdrRecCap- MultHdrRecEn- TLPPfxPres- HdrLogCap-
                HeaderLog: 00000000 00000000 00000000 00000000
        Capabilities: [160 v1] Device Serial Number 00-00-00-00-00-00-00-00
        Capabilities: [170 v1] Latency Tolerance Reporting
                Max snoop latency: 0ns
                Max no snoop latency: 0ns
        Capabilities: [178 v1] L1 PM Substates
                L1SubCap: PCI-PM_L1.2+ PCI-PM_L1.1+ ASPM_L1.2+ ASPM_L1.1+ L1_PM_Substates+
                          PortCommonModeRestoreTime=150us PortTPowerOnTime=150us
                L1SubCtl1: PCI-PM_L1.2- PCI-PM_L1.1- ASPM_L1.2- ASPM_L1.1-
                           T_CommonMode=0us LTR1.2_Threshold=0ns
                L1SubCtl2: T_PwrOn=10us
02:00.2 0700: 10ec:816b (rev 0e)
[...same...]

Signed-off-by: Tobias Diedrich <tobiasdiedrich@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200914173628.GA22508@yamamaya.is-a-geek.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_pci.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index b032add92722..72f6cde146b5 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -5904,6 +5904,17 @@ static struct pci_device_id serial_pci_tbl[] = {
 		0,
 		0, pbn_exar_XR17V358 },
 
+	/*
+	 * Realtek RealManage
+	 */
+	{	PCI_VENDOR_ID_REALTEK, 0x816a,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0, pbn_b0_1_115200 },
+
+	{	PCI_VENDOR_ID_REALTEK, 0x816b,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0, pbn_b0_1_115200 },
+
 	/* Fintek PCI serial cards */
 	{ PCI_DEVICE(0x1c29, 0x1104), .driver_data = pbn_fintek_4 },
 	{ PCI_DEVICE(0x1c29, 0x1108), .driver_data = pbn_fintek_8 },

From e73e271187ae00071a356a2afcaf11b2e78d1f60 Mon Sep 17 00:00:00 2001
From: Quentin Perret <qperret@google.com>
Date: Wed, 16 Sep 2020 18:18:25 +0100
Subject: [PATCH 0619/2658] ehci-hcd: Move include to keep CRC stable

commit 29231826f3bd65500118c473fccf31c0cf14dbc0 upstream.

The CRC calculation done by genksyms is triggered when the parser hits
EXPORT_SYMBOL*() macros. At this point, genksyms recursively expands the
types of the function parameters, and uses that as the input for the CRC
calculation. In the case of forward-declared structs, the type expands
to 'UNKNOWN'. Following this, it appears that the result of the
expansion of each type is cached somewhere, and seems to be re-used
when/if the same type is seen again for another exported symbol in the
same C file.

Unfortunately, this can cause CRC 'stability' issues when a struct
definition becomes visible in the middle of a C file. For example, let's
assume code with the following pattern:

    struct foo;

    int bar(struct foo *arg)
    {
	/* Do work ... */
    }
    EXPORT_SYMBOL_GPL(bar);

    /* This contains struct foo's definition */
    #include "foo.h"

    int baz(struct foo *arg)
    {
	/* Do more work ... */
    }
    EXPORT_SYMBOL_GPL(baz);

Here, baz's CRC will be computed using the expansion of struct foo that
was cached after bar's CRC calculation ('UNKOWN' here). But if
EXPORT_SYMBOL_GPL(bar) is removed from the file (because of e.g. symbol
trimming using CONFIG_TRIM_UNUSED_KSYMS), struct foo will be expanded
late, during baz's CRC calculation, which now has visibility over the
full struct definition, hence resulting in a different CRC for baz.

The proper fix for this certainly is in genksyms, but that will take me
some time to get right. In the meantime, we have seen one occurrence of
this in the ehci-hcd code which hits this problem because of the way it
includes C files halfway through the code together with an unlucky mix
of symbol trimming.

In order to workaround this, move the include done in ehci-hub.c early
in ehci-hcd.c, hence making sure the struct definitions are visible to
the entire file. This improves CRC stability of the ehci-hcd exports
even when symbol trimming is enabled.

Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Quentin Perret <qperret@google.com>
Link: https://lore.kernel.org/r/20200916171825.3228122-1-qperret@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/ehci-hcd.c | 1 +
 drivers/usb/host/ehci-hub.c | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 18a05e4b3c5f..3e51c0a51049 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -35,6 +35,7 @@
 #include <linux/interrupt.h>
 #include <linux/usb.h>
 #include <linux/usb/hcd.h>
+#include <linux/usb/otg.h>
 #include <linux/moduleparam.h>
 #include <linux/dma-mapping.h>
 #include <linux/debugfs.h>
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 086a7115d263..4dc93547e927 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -27,7 +27,6 @@
  */
 
 /*-------------------------------------------------------------------------*/
-#include <linux/usb/otg.h>
 
 #define	PORT_WAKE_BITS	(PORT_WKOC_E|PORT_WKDISC_E|PORT_WKCONN_E)
 

From 944b2cea0c422dfabc81d655a206715c48ae9773 Mon Sep 17 00:00:00 2001
From: Alexey Kardashevskiy <aik@ozlabs.ru>
Date: Tue, 8 Sep 2020 11:51:06 +1000
Subject: [PATCH 0620/2658] powerpc/dma: Fix dma_map_ops::get_required_mask

commit 437ef802e0adc9f162a95213a3488e8646e5fc03 upstream.

There are 2 problems with it:
  1. "<" vs expected "<<"
  2. the shift number is an IOMMU page number mask, not an address
  mask as the IOMMU page shift is missing.

This did not hit us before f1565c24b596 ("powerpc: use the generic
dma_ops_bypass mode") because we had additional code to handle bypass
mask so this chunk (almost?) never executed.However there were
reports that aacraid does not work with "iommu=nobypass".

After f1565c24b596, aacraid (and probably others which call
dma_get_required_mask() before setting the mask) was unable to enable
64bit DMA and fall back to using IOMMU which was known not to work,
one of the problems is double free of an IOMMU page.

This fixes DMA for aacraid, both with and without "iommu=nobypass" in
the kernel command line. Verified with "stress-ng -d 4".

Fixes: 6a5c7be5e484 ("powerpc: Override dma_get_required_mask by platform hook and ops")
Cc: stable@vger.kernel.org # v3.2+
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200908015106.79661-1-aik@ozlabs.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kernel/dma-iommu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/kernel/dma-iommu.c b/arch/powerpc/kernel/dma-iommu.c
index 41a7d9d49a5a..3d3e8795e934 100644
--- a/arch/powerpc/kernel/dma-iommu.c
+++ b/arch/powerpc/kernel/dma-iommu.c
@@ -99,7 +99,8 @@ static u64 dma_iommu_get_required_mask(struct device *dev)
 	if (!tbl)
 		return 0;
 
-	mask = 1ULL < (fls_long(tbl->it_offset + tbl->it_size) - 1);
+	mask = 1ULL << (fls_long(tbl->it_offset + tbl->it_size) +
+			tbl->it_page_shift - 1);
 	mask += mask - 1;
 
 	return mask;

From 89703523e1e25ecd8ab99e61954febd2cb8c6167 Mon Sep 17 00:00:00 2001
From: Adam Borowski <kilobyte@angband.pl>
Date: Tue, 9 Oct 2018 08:28:03 +0200
Subject: [PATCH 0621/2658] x86/defconfig: Enable CONFIG_USB_XHCI_HCD=y

commit 72a9c673636b779e370983fea08e40f97039b981 upstream.

A spanking new machine I just got has all but one USB ports wired as 3.0.
Booting defconfig resulted in no keyboard or mouse, which was pretty
uncool.  Let's enable that -- USB3 is ubiquitous rather than an oddity.
As 'y' not 'm' -- recovering from initrd problems needs a keyboard.

Also add it to the 32-bit defconfig.

Signed-off-by: Adam Borowski <kilobyte@angband.pl>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-usb@vger.kernel.org
Link: http://lkml.kernel.org/r/20181009062803.4332-1-kilobyte@angband.pl
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/configs/i386_defconfig   | 1 +
 arch/x86/configs/x86_64_defconfig | 1 +
 2 files changed, 2 insertions(+)

diff --git a/arch/x86/configs/i386_defconfig b/arch/x86/configs/i386_defconfig
index 8710c27907f8..a628b2474e6d 100644
--- a/arch/x86/configs/i386_defconfig
+++ b/arch/x86/configs/i386_defconfig
@@ -247,6 +247,7 @@ CONFIG_USB_HIDDEV=y
 CONFIG_USB=y
 CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_MON=y
+CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_TT_NEWSCHED=y
 CONFIG_USB_OHCI_HCD=y
diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig
index 8848e62a60aa..649f7d604b12 100644
--- a/arch/x86/configs/x86_64_defconfig
+++ b/arch/x86/configs/x86_64_defconfig
@@ -241,6 +241,7 @@ CONFIG_USB_HIDDEV=y
 CONFIG_USB=y
 CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_MON=y
+CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_TT_NEWSCHED=y
 CONFIG_USB_OHCI_HCD=y

From 0325a8df18d1ec1cc765a0a1c8d24573a7c11f9c Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 23 Sep 2020 08:44:28 +0200
Subject: [PATCH 0622/2658] Linux 4.4.237

Link: https://lore.kernel.org/lkml/20200921162033.346434578@linuxfoundation.org/
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 4ec303ff71e3..c814888201fb 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 236
+SUBLEVEL = 237
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 7e84bb7a63de280318ae80def88134f945845308 Mon Sep 17 00:00:00 2001
From: Mark Salyzyn <salyzyn@android.com>
Date: Wed, 22 Jul 2020 04:00:53 -0700
Subject: [PATCH 0623/2658] af_key: pfkey_dump needs parameter validation

commit 37bd22420f856fcd976989f1d4f1f7ad28e1fcac upstream.

In pfkey_dump() dplen and splen can both be specified to access the
xfrm_address_t structure out of bounds in__xfrm_state_filter_match()
when it calls addr_match() with the indexes.  Return EINVAL if either
are out of range.

Signed-off-by: Mark Salyzyn <salyzyn@android.com>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: kernel-team@android.com
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/key/af_key.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/key/af_key.c b/net/key/af_key.c
index d2ec620319d7..76a008b1cbe5 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1873,6 +1873,13 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
 	if (ext_hdrs[SADB_X_EXT_FILTER - 1]) {
 		struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1];
 
+		if ((xfilter->sadb_x_filter_splen >=
+			(sizeof(xfrm_address_t) << 3)) ||
+		    (xfilter->sadb_x_filter_dplen >=
+			(sizeof(xfrm_address_t) << 3))) {
+			mutex_unlock(&pfk->dump_lock);
+			return -EINVAL;
+		}
 		filter = kmalloc(sizeof(*filter), GFP_KERNEL);
 		if (filter == NULL) {
 			mutex_unlock(&pfk->dump_lock);

From fe8c845b82f88bf3e5201a036035bd080097166c Mon Sep 17 00:00:00 2001
From: Rustam Kovhaev <rkovhaev@gmail.com>
Date: Mon, 7 Sep 2020 11:55:35 -0700
Subject: [PATCH 0624/2658] KVM: fix memory leak in kvm_io_bus_unregister_dev()

[ Upstream commit f65886606c2d3b562716de030706dfe1bea4ed5e ]

when kmalloc() fails in kvm_io_bus_unregister_dev(), before removing
the bus, we should iterate over all other devices linked to it and call
kvm_iodevice_destructor() for them

Fixes: 90db10434b16 ("KVM: kvm_io_bus_unregister_dev() should never fail")
Cc: stable@vger.kernel.org
Reported-and-tested-by: syzbot+f196caa45793d6374707@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=f196caa45793d6374707
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Message-Id: <20200907185535.233114-1-rkovhaev@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 virt/kvm/kvm_main.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 8df828ba5f72..374e698e0ac1 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -3380,7 +3380,7 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
 void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
 			       struct kvm_io_device *dev)
 {
-	int i;
+	int i, j;
 	struct kvm_io_bus *new_bus, *bus;
 
 	bus = kvm->buses[bus_idx];
@@ -3397,17 +3397,20 @@ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
 
 	new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count - 1) *
 			  sizeof(struct kvm_io_range)), GFP_KERNEL);
-	if (!new_bus)  {
+	if (new_bus) {
+		memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
+		new_bus->dev_count--;
+		memcpy(new_bus->range + i, bus->range + i + 1,
+		       (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
+	} else {
 		pr_err("kvm: failed to shrink bus, removing it completely\n");
-		goto broken;
+		for (j = 0; j < bus->dev_count; j++) {
+			if (j == i)
+				continue;
+			kvm_iodevice_destructor(bus->range[j].dev);
+		}
 	}
 
-	memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
-	new_bus->dev_count--;
-	memcpy(new_bus->range + i, bus->range + i + 1,
-	       (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
-
-broken:
 	rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
 	synchronize_srcu_expedited(&kvm->srcu);
 	kfree(bus);

From 856df7849a5574156b35d7b9615a900f842a075d Mon Sep 17 00:00:00 2001
From: Muchun Song <songmuchun@bytedance.com>
Date: Fri, 18 Sep 2020 21:20:21 -0700
Subject: [PATCH 0625/2658] kprobes: fix kill kprobe which has been marked as
 gone

[ Upstream commit b0399092ccebd9feef68d4ceb8d6219a8c0caa05 ]

If a kprobe is marked as gone, we should not kill it again.  Otherwise, we
can disarm the kprobe more than once.  In that case, the statistics of
kprobe_ftrace_enabled can unbalance which can lead to that kprobe do not
work.

Fixes: e8386a0cb22f ("kprobes: support probing module __exit function")
Co-developed-by: Chengming Zhou <zhouchengming@bytedance.com>
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Signed-off-by: Chengming Zhou <zhouchengming@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Cc: "Naveen N . Rao" <naveen.n.rao@linux.ibm.com>
Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Song Liu <songliubraving@fb.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20200822030055.32383-1-songmuchun@bytedance.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/kprobes.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 9241a29a1f9d..574f650eb818 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -2012,6 +2012,9 @@ static void kill_kprobe(struct kprobe *p)
 {
 	struct kprobe *kp;
 
+	if (WARN_ON_ONCE(kprobe_gone(p)))
+		return;
+
 	p->flags |= KPROBE_FLAG_GONE;
 	if (kprobe_aggrprobe(p)) {
 		/*
@@ -2154,7 +2157,10 @@ static int kprobes_module_callback(struct notifier_block *nb,
 	mutex_lock(&kprobe_mutex);
 	for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
 		head = &kprobe_table[i];
-		hlist_for_each_entry_rcu(p, head, hlist)
+		hlist_for_each_entry_rcu(p, head, hlist) {
+			if (kprobe_gone(p))
+				continue;
+
 			if (within_module_init((unsigned long)p->addr, mod) ||
 			    (checkcore &&
 			     within_module_core((unsigned long)p->addr, mod))) {
@@ -2165,6 +2171,7 @@ static int kprobes_module_callback(struct notifier_block *nb,
 				 */
 				kill_kprobe(p);
 			}
+		}
 	}
 	mutex_unlock(&kprobe_mutex);
 	return NOTIFY_DONE;

From f62a5b917fe29d63abf4de56e30f2ad2519e9f7c Mon Sep 17 00:00:00 2001
From: Chengming Zhou <zhouchengming@bytedance.com>
Date: Wed, 29 Jul 2020 02:05:53 +0800
Subject: [PATCH 0626/2658] ftrace: Setup correct FTRACE_FL_REGS flags for
 module

[ Upstream commit 8a224ffb3f52b0027f6b7279854c71a31c48fc97 ]

When module loaded and enabled, we will use __ftrace_replace_code
for module if any ftrace_ops referenced it found. But we will get
wrong ftrace_addr for module rec in ftrace_get_addr_new, because
rec->flags has not been setup correctly. It can cause the callback
function of a ftrace_ops has FTRACE_OPS_FL_SAVE_REGS to be called
with pt_regs set to NULL.
So setup correct FTRACE_FL_REGS flags for rec when we call
referenced_filters to find ftrace_ops references it.

Link: https://lkml.kernel.org/r/20200728180554.65203-1-zhouchengming@bytedance.com

Cc: stable@vger.kernel.org
Fixes: 8c4f3c3fa9681 ("ftrace: Check module functions being traced on reload")
Signed-off-by: Chengming Zhou <zhouchengming@bytedance.com>
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/ftrace.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index e4c6f89b6b11..89ed01911a9a 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -2823,8 +2823,11 @@ static int referenced_filters(struct dyn_ftrace *rec)
 	int cnt = 0;
 
 	for (ops = ftrace_ops_list; ops != &ftrace_list_end; ops = ops->next) {
-		if (ops_references_rec(ops, rec))
-		    cnt++;
+		if (ops_references_rec(ops, rec)) {
+			cnt++;
+			if (ops->flags & FTRACE_OPS_FL_SAVE_REGS)
+				rec->flags |= FTRACE_FL_REGS;
+		}
 	}
 
 	return cnt;
@@ -2874,7 +2877,7 @@ static int ftrace_update_code(struct module *mod, struct ftrace_page *new_pgs)
 			p = &pg->records[i];
 			if (test)
 				cnt += referenced_filters(p);
-			p->flags = cnt;
+			p->flags += cnt;
 
 			/*
 			 * Do the initial record conversion from mcount jump

From b8170631668f6939538d013bcb98bdaa466139b1 Mon Sep 17 00:00:00 2001
From: Shamir Rabinovitch <shamir.rabinovitch@oracle.com>
Date: Thu, 24 Sep 2020 18:24:49 +0900
Subject: [PATCH 0627/2658] RDMA/ucma: ucma_context reference leak in error
 path

commit ef95a90ae6f4f21990e1f7ced6719784a409e811 upstream.

Validating input parameters should be done before getting the cm_id
otherwise it can leak a cm_id reference.

Fixes: 6a21dfc0d0db ("RDMA/ucma: Limit possible option size")
Signed-off-by: Shamir Rabinovitch <shamir.rabinovitch@oracle.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
[iwamatsu: Backported to 4.4, 4.9 and 4.14: adjust context]
Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/ucma.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 3e4d3d5560bf..6315f77b4a58 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1295,13 +1295,13 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf,
 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
 		return -EFAULT;
 
+	if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE))
+		return -EINVAL;
+
 	ctx = ucma_get_ctx(file, cmd.id);
 	if (IS_ERR(ctx))
 		return PTR_ERR(ctx);
 
-	if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE))
-		return -EINVAL;
-
 	optval = memdup_user((void __user *) (unsigned long) cmd.optval,
 			     cmd.optlen);
 	if (IS_ERR(optval)) {

From 6389f74e9e3dc25d56c17f0a010aa5b3f07b49d0 Mon Sep 17 00:00:00 2001
From: Ben Hutchings <ben@decadent.org.uk>
Date: Thu, 24 Sep 2020 19:00:54 +0900
Subject: [PATCH 0628/2658] mtd: Fix comparison in map_word_andequal()

commit ea739a287f4f16d6250bea779a1026ead79695f2 upstream.

Commit 9e343e87d2c4 ("mtd: cfi: convert inline functions to macros")
changed map_word_andequal() into a macro, but also changed the right
hand side of the comparison from val3 to val2.  Change it back to use
val3 on the right hand side.

Thankfully this did not cause a regression because all callers
currently pass the same argument for val2 and val3.

Fixes: 9e343e87d2c4 ("mtd: cfi: convert inline functions to macros")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Signed-off-by: Nobuhiro Iwamatsu (CIP) <noburhio1.nobuhiro@toshiba.co.jp>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/mtd/map.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h
index 676d3d2a1a0a..d8bae7cb86f3 100644
--- a/include/linux/mtd/map.h
+++ b/include/linux/mtd/map.h
@@ -307,7 +307,7 @@ void map_destroy(struct mtd_info *mtd);
 ({									\
 	int i, ret = 1;							\
 	for (i = 0; i < map_words(map); i++) {				\
-		if (((val1).x[i] & (val2).x[i]) != (val2).x[i]) {	\
+		if (((val1).x[i] & (val2).x[i]) != (val3).x[i]) {	\
 			ret = 0;					\
 			break;						\
 		}							\

From 111705f2ce7c8dbfc37c3746160b128135c5215f Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 9 Sep 2020 12:46:48 +0300
Subject: [PATCH 0629/2658] hdlc_ppp: add range checks in ppp_cp_parse_cr()

[ Upstream commit 66d42ed8b25b64eb63111a2b8582c5afc8bf1105 ]

There are a couple bugs here:
1) If opt[1] is zero then this results in a forever loop.  If the value
   is less than 2 then it is invalid.
2) It assumes that "len" is more than sizeof(valid_accm) or 6 which can
   result in memory corruption.

In the case of LCP_OPTION_ACCM, then  we should check "opt[1]" instead
of "len" because, if "opt[1]" is less than sizeof(valid_accm) then
"nak_len" gets out of sync and it can lead to memory corruption in the
next iterations through the loop.  In case of LCP_OPTION_MAGIC, the
only valid value for opt[1] is 6, but the code is trying to log invalid
data so we should only discard the data when "len" is less than 6
because that leads to a read overflow.

Reported-by: ChenNan Of Chaitin Security Research Lab  <whutchennan@gmail.com>
Fixes: e022c2f07ae5 ("WAN: new synchronous PPP implementation for generic HDLC.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wan/hdlc_ppp.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c
index 4842344a96f1..a2559f213dae 100644
--- a/drivers/net/wan/hdlc_ppp.c
+++ b/drivers/net/wan/hdlc_ppp.c
@@ -386,11 +386,8 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id,
 	}
 
 	for (opt = data; len; len -= opt[1], opt += opt[1]) {
-		if (len < 2 || len < opt[1]) {
-			dev->stats.rx_errors++;
-			kfree(out);
-			return; /* bad packet, drop silently */
-		}
+		if (len < 2 || opt[1] < 2 || len < opt[1])
+			goto err_out;
 
 		if (pid == PID_LCP)
 			switch (opt[0]) {
@@ -398,6 +395,8 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id,
 				continue; /* MRU always OK and > 1500 bytes? */
 
 			case LCP_OPTION_ACCM: /* async control character map */
+				if (opt[1] < sizeof(valid_accm))
+					goto err_out;
 				if (!memcmp(opt, valid_accm,
 					    sizeof(valid_accm)))
 					continue;
@@ -409,6 +408,8 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id,
 				}
 				break;
 			case LCP_OPTION_MAGIC:
+				if (len < 6)
+					goto err_out;
 				if (opt[1] != 6 || (!opt[2] && !opt[3] &&
 						    !opt[4] && !opt[5]))
 					break; /* reject invalid magic number */
@@ -427,6 +428,11 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id,
 		ppp_cp_event(dev, pid, RCR_GOOD, CP_CONF_ACK, id, req_len, data);
 
 	kfree(out);
+	return;
+
+err_out:
+	dev->stats.rx_errors++;
+	kfree(out);
 }
 
 static int ppp_rx(struct sk_buff *skb)

From 7189b24d03eb2f07e40f24012981aaecf84a430e Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Sun, 13 Sep 2020 19:37:31 +0800
Subject: [PATCH 0630/2658] tipc: use skb_unshare() instead in
 tipc_buf_append()

[ Upstream commit ff48b6222e65ebdba5a403ef1deba6214e749193 ]

In tipc_buf_append() it may change skb's frag_list, and it causes
problems when this skb is cloned. skb_unclone() doesn't really
make this skb's flag_list available to change.

Shuang Li has reported an use-after-free issue because of this
when creating quite a few macvlan dev over the same dev, where
the broadcast packets will be cloned and go up to the stack:

 [ ] BUG: KASAN: use-after-free in pskb_expand_head+0x86d/0xea0
 [ ] Call Trace:
 [ ]  dump_stack+0x7c/0xb0
 [ ]  print_address_description.constprop.7+0x1a/0x220
 [ ]  kasan_report.cold.10+0x37/0x7c
 [ ]  check_memory_region+0x183/0x1e0
 [ ]  pskb_expand_head+0x86d/0xea0
 [ ]  process_backlog+0x1df/0x660
 [ ]  net_rx_action+0x3b4/0xc90
 [ ]
 [ ] Allocated by task 1786:
 [ ]  kmem_cache_alloc+0xbf/0x220
 [ ]  skb_clone+0x10a/0x300
 [ ]  macvlan_broadcast+0x2f6/0x590 [macvlan]
 [ ]  macvlan_process_broadcast+0x37c/0x516 [macvlan]
 [ ]  process_one_work+0x66a/0x1060
 [ ]  worker_thread+0x87/0xb10
 [ ]
 [ ] Freed by task 3253:
 [ ]  kmem_cache_free+0x82/0x2a0
 [ ]  skb_release_data+0x2c3/0x6e0
 [ ]  kfree_skb+0x78/0x1d0
 [ ]  tipc_recvmsg+0x3be/0xa40 [tipc]

So fix it by using skb_unshare() instead, which would create a new
skb for the cloned frag and it'll be safe to change its frag_list.
The similar things were also done in sctp_make_reassembled_event(),
which is using skb_copy().

Reported-by: Shuang Li <shuali@redhat.com>
Fixes: 37e22164a8a3 ("tipc: rename and move message reassembly function")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tipc/msg.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 67bddcb2ff46..fc1aa8bcb185 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -138,7 +138,8 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
 	if (fragid == FIRST_FRAGMENT) {
 		if (unlikely(head))
 			goto err;
-		if (unlikely(skb_unclone(frag, GFP_ATOMIC)))
+		frag = skb_unshare(frag, GFP_ATOMIC);
+		if (unlikely(!frag))
 			goto err;
 		head = *headbuf = frag;
 		*buf = NULL;

From 2d745a869be78769a653c44f721812017b127700 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 9 Sep 2020 01:27:40 -0700
Subject: [PATCH 0631/2658] net: add __must_check to skb_put_padto()

[ Upstream commit 4a009cb04aeca0de60b73f37b102573354214b52 ]

skb_put_padto() and __skb_put_padto() callers
must check return values or risk use-after-free.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/skbuff.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 735ff1525f48..2528f712b8c0 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2651,7 +2651,7 @@ static inline int skb_padto(struct sk_buff *skb, unsigned int len)
  *	is untouched. Otherwise it is extended. Returns zero on
  *	success. The skb is freed on error.
  */
-static inline int skb_put_padto(struct sk_buff *skb, unsigned int len)
+static inline int __must_check skb_put_padto(struct sk_buff *skb, unsigned int len)
 {
 	unsigned int size = skb->len;
 

From ff0fe561f0b1d88bcecf055448b802da4b5027ee Mon Sep 17 00:00:00 2001
From: Wei Wang <weiwan@google.com>
Date: Tue, 8 Sep 2020 14:09:34 -0700
Subject: [PATCH 0632/2658] ip: fix tos reflection in ack and reset packets

[ Upstream commit ba9e04a7ddf4f22a10e05bf9403db6b97743c7bf ]

Currently, in tcp_v4_reqsk_send_ack() and tcp_v4_send_reset(), we
echo the TOS value of the received packets in the response.
However, we do not want to echo the lower 2 ECN bits in accordance
with RFC 3168 6.1.5 robustness principles.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

Signed-off-by: Wei Wang <weiwan@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/ip_output.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 3526024f1825..0750126f3b7d 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -73,6 +73,7 @@
 #include <net/icmp.h>
 #include <net/checksum.h>
 #include <net/inetpeer.h>
+#include <net/inet_ecn.h>
 #include <linux/igmp.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter_bridge.h>
@@ -1598,7 +1599,7 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb,
 	if (IS_ERR(rt))
 		return;
 
-	inet_sk(sk)->tos = arg->tos;
+	inet_sk(sk)->tos = arg->tos & ~INET_ECN_MASK;
 
 	sk->sk_priority = skb->priority;
 	sk->sk_protocol = ip_hdr(skb)->protocol;

From d8dd4ba262369b459c7b31c37e4907898765c1c0 Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@wunner.de>
Date: Tue, 12 May 2020 14:40:01 +0200
Subject: [PATCH 0633/2658] serial: 8250: Avoid error message on reprobe

commit e0a851fe6b9b619527bd928aa93caaddd003f70c upstream.

If the call to uart_add_one_port() in serial8250_register_8250_port()
fails, a half-initialized entry in the serial_8250ports[] array is left
behind.

A subsequent reprobe of the same serial port causes that entry to be
reused.  Because uart->port.dev is set, uart_remove_one_port() is called
for the half-initialized entry and bails out with an error message:

bcm2835-aux-uart 3f215040.serial: Removing wrong port: (null) != (ptrval)

The same happens on failure of mctrl_gpio_init() since commit
4a96895f74c9 ("tty/serial/8250: use mctrl_gpio helpers").

Fix by zeroing the uart->port.dev pointer in the probe error path.

The bug was introduced in v2.6.10 by historical commit befff6f5bf5f
("[SERIAL] Add new port registration/unregistration functions."):
https://git.kernel.org/tglx/history/c/befff6f5bf5f

The commit added an unconditional call to uart_remove_one_port() in
serial8250_register_port().  In v3.7, commit 835d844d1a28 ("8250_pnp:
do pnp probe before legacy probe") made that call conditional on
uart->port.dev which allows me to fix the issue by zeroing that pointer
in the error path.  Thus, the present commit will fix the problem as far
back as v3.7 whereas still older versions need to also cherry-pick
835d844d1a28.

Fixes: 835d844d1a28 ("8250_pnp: do pnp probe before legacy probe")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v2.6.10
Cc: stable@vger.kernel.org # v2.6.10: 835d844d1a28: 8250_pnp: do pnp probe before legacy
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/b4a072013ee1a1d13ee06b4325afb19bda57ca1b.1589285873.git.lukas@wunner.de
[iwamatsu: Backported to 4.4, 4.9: adjust context]
Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_core.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index e9ea9005a984..f24fa99da69f 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -1037,8 +1037,10 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
 
 			ret = uart_add_one_port(&serial8250_reg,
 						&uart->port);
-			if (ret == 0)
-				ret = uart->port.line;
+			if (ret)
+				goto err;
+
+			ret = uart->port.line;
 		} else {
 			dev_info(uart->port.dev,
 				"skipping CIR port at 0x%lx / 0x%llx, IRQ %d\n",
@@ -1052,6 +1054,11 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
 	mutex_unlock(&serial_mutex);
 
 	return ret;
+
+err:
+	uart->port.dev = NULL;
+	mutex_unlock(&serial_mutex);
+	return ret;
 }
 EXPORT_SYMBOL(serial8250_register_8250_port);
 

From bcae50a6eb11e092a57a86d798e8b6c809c6e0ac Mon Sep 17 00:00:00 2001
From: Balsundar P <balsundar.p@microsemi.com>
Date: Tue, 15 Oct 2019 11:51:58 +0530
Subject: [PATCH 0634/2658] scsi: aacraid: fix illegal IO beyond last LBA

[ Upstream commit c86fbe484c10b2cd1e770770db2d6b2c88801c1d ]

The driver fails to handle data when read or written beyond device reported
LBA, which triggers kernel panic

Link: https://lore.kernel.org/r/1571120524-6037-2-git-send-email-balsundar.p@microsemi.com
Signed-off-by: Balsundar P <balsundar.p@microsemi.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/aacraid/aachba.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index de33801ca31e..0614d05a990a 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -1938,13 +1938,13 @@ static int aac_read(struct scsi_cmnd * scsicmd)
 		scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 |
 			SAM_STAT_CHECK_CONDITION;
 		set_sense(&dev->fsa_dev[cid].sense_data,
-			  HARDWARE_ERROR, SENCODE_INTERNAL_TARGET_FAILURE,
+			  ILLEGAL_REQUEST, SENCODE_LBA_OUT_OF_RANGE,
 			  ASENCODE_INTERNAL_TARGET_FAILURE, 0, 0);
 		memcpy(scsicmd->sense_buffer, &dev->fsa_dev[cid].sense_data,
 		       min_t(size_t, sizeof(dev->fsa_dev[cid].sense_data),
 			     SCSI_SENSE_BUFFERSIZE));
 		scsicmd->scsi_done(scsicmd);
-		return 1;
+		return 0;
 	}
 
 	dprintk((KERN_DEBUG "aac_read[cpu %d]: lba = %llu, t = %ld.\n",
@@ -2035,13 +2035,13 @@ static int aac_write(struct scsi_cmnd * scsicmd)
 		scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 |
 			SAM_STAT_CHECK_CONDITION;
 		set_sense(&dev->fsa_dev[cid].sense_data,
-			  HARDWARE_ERROR, SENCODE_INTERNAL_TARGET_FAILURE,
+			  ILLEGAL_REQUEST, SENCODE_LBA_OUT_OF_RANGE,
 			  ASENCODE_INTERNAL_TARGET_FAILURE, 0, 0);
 		memcpy(scsicmd->sense_buffer, &dev->fsa_dev[cid].sense_data,
 		       min_t(size_t, sizeof(dev->fsa_dev[cid].sense_data),
 			     SCSI_SENSE_BUFFERSIZE));
 		scsicmd->scsi_done(scsicmd);
-		return 1;
+		return 0;
 	}
 
 	dprintk((KERN_DEBUG "aac_write[cpu %d]: lba = %llu, t = %ld.\n",

From 00cd4deed0c95d0525d94b508c6b99ce945e1ebb Mon Sep 17 00:00:00 2001
From: Fuqian Huang <huangfq.daxian@gmail.com>
Date: Fri, 27 Sep 2019 20:15:44 +0800
Subject: [PATCH 0635/2658] m68k: q40: Fix info-leak in rtc_ioctl

[ Upstream commit 7cf78b6b12fd5550545e4b73b35dca18bd46b44c ]

When the option is RTC_PLL_GET, pll will be copied to userland
via copy_to_user. pll is initialized using mach_get_rtc_pll indirect
call and mach_get_rtc_pll is only assigned with function
q40_get_rtc_pll in arch/m68k/q40/config.c.
In function q40_get_rtc_pll, the field pll_ctrl is not initialized.
This will leak uninitialized stack content to userland.
Fix this by zeroing the uninitialized field.

Signed-off-by: Fuqian Huang <huangfq.daxian@gmail.com>
Link: https://lore.kernel.org/r/20190927121544.7650-1-huangfq.daxian@gmail.com
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/m68k/q40/config.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/m68k/q40/config.c b/arch/m68k/q40/config.c
index e90fe903613e..4e5f04d33318 100644
--- a/arch/m68k/q40/config.c
+++ b/arch/m68k/q40/config.c
@@ -303,6 +303,7 @@ static int q40_get_rtc_pll(struct rtc_pll_info *pll)
 {
 	int tmp = Q40_RTC_CTRL;
 
+	pll->pll_ctrl = 0;
 	pll->pll_value = tmp & Q40_RTC_PLL_MASK;
 	if (tmp & Q40_RTC_PLL_SIGN)
 		pll->pll_value = -pll->pll_value;

From 6c2bfdfae9874a49530670ffb83c4ac0f89a221c Mon Sep 17 00:00:00 2001
From: Kangjie Lu <kjlu@umn.edu>
Date: Thu, 17 Oct 2019 23:29:53 -0500
Subject: [PATCH 0636/2658] gma/gma500: fix a memory disclosure bug due to
 uninitialized bytes

[ Upstream commit 57a25a5f754ce27da2cfa6f413cfd366f878db76 ]

`best_clock` is an object that may be sent out. Object `clock`
contains uninitialized bytes that are copied to `best_clock`,
which leads to memory disclosure and information leak.

Signed-off-by: Kangjie Lu <kjlu@umn.edu>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20191018042953.31099-1-kjlu@umn.edu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/gma500/cdv_intel_display.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/gma500/cdv_intel_display.c b/drivers/gpu/drm/gma500/cdv_intel_display.c
index 7d47b3d5cc0d..54d554d72000 100644
--- a/drivers/gpu/drm/gma500/cdv_intel_display.c
+++ b/drivers/gpu/drm/gma500/cdv_intel_display.c
@@ -415,6 +415,8 @@ static bool cdv_intel_find_dp_pll(const struct gma_limit_t *limit,
 	struct gma_crtc *gma_crtc = to_gma_crtc(crtc);
 	struct gma_clock_t clock;
 
+	memset(&clock, 0, sizeof(clock));
+
 	switch (refclk) {
 	case 27000:
 		if (target < 200000) {

From c3796c54b789005042b066be47191b4319afbd51 Mon Sep 17 00:00:00 2001
From: Russell King <rmk+kernel@armlinux.org.uk>
Date: Wed, 23 Oct 2019 16:46:59 +0100
Subject: [PATCH 0637/2658] ASoC: kirkwood: fix IRQ error handling

[ Upstream commit 175fc928198236037174e5c5c066fe3c4691903e ]

Propagate the error code from request_irq(), rather than returning
-EBUSY.

Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Link: https://lore.kernel.org/r/E1iNIqh-0000tW-EZ@rmk-PC.armlinux.org.uk
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/kirkwood/kirkwood-dma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/kirkwood/kirkwood-dma.c b/sound/soc/kirkwood/kirkwood-dma.c
index dbfdfe99c69d..231c7d97333c 100644
--- a/sound/soc/kirkwood/kirkwood-dma.c
+++ b/sound/soc/kirkwood/kirkwood-dma.c
@@ -136,7 +136,7 @@ static int kirkwood_dma_open(struct snd_pcm_substream *substream)
 		err = request_irq(priv->irq, kirkwood_dma_irq, IRQF_SHARED,
 				  "kirkwood-i2s", priv);
 		if (err)
-			return -EBUSY;
+			return err;
 
 		/*
 		 * Enable Error interrupts. We're only ack'ing them but

From f160b6270d31f44f79253e948ba01a4c58ec61e0 Mon Sep 17 00:00:00 2001
From: Dmitry Osipenko <digetx@gmail.com>
Date: Tue, 5 Nov 2019 00:56:03 +0300
Subject: [PATCH 0638/2658] PM / devfreq: tegra30: Fix integer overflow on
 CPU's freq max out

[ Upstream commit 53b4b2aeee26f42cde5ff2a16dd0d8590c51a55a ]

There is another kHz-conversion bug in the code, resulting in integer
overflow. Although, this time the resulting value is 4294966296 and it's
close to ULONG_MAX, which is okay in this case.

Reviewed-by: Chanwoo Choi <cw00.choi@samsung.com>
Tested-by: Peter Geis <pgwipeout@gmail.com>
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/devfreq/tegra-devfreq.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/devfreq/tegra-devfreq.c b/drivers/devfreq/tegra-devfreq.c
index 64a2e02b87d7..0b0de6a049af 100644
--- a/drivers/devfreq/tegra-devfreq.c
+++ b/drivers/devfreq/tegra-devfreq.c
@@ -79,6 +79,8 @@
 
 #define KHZ							1000
 
+#define KHZ_MAX						(ULONG_MAX / KHZ)
+
 /* Assume that the bus is saturated if the utilization is 25% */
 #define BUS_SATURATION_RATIO					25
 
@@ -179,7 +181,7 @@ struct tegra_actmon_emc_ratio {
 };
 
 static struct tegra_actmon_emc_ratio actmon_emc_ratios[] = {
-	{ 1400000, ULONG_MAX },
+	{ 1400000,    KHZ_MAX },
 	{ 1200000,    750000 },
 	{ 1100000,    600000 },
 	{ 1000000,    500000 },

From ec3cfdfdb45bdfc4cd27126a1e95924de0c5c8ad Mon Sep 17 00:00:00 2001
From: Hou Tao <houtao1@huawei.com>
Date: Tue, 8 Oct 2019 10:36:37 +0800
Subject: [PATCH 0639/2658] mtd: cfi_cmdset_0002: don't free cfi->cfiq in error
 path of cfi_amdstd_setup()

[ Upstream commit 03976af89e3bd9489d542582a325892e6a8cacc0 ]

Else there may be a double-free problem, because cfi->cfiq will
be freed by mtd_do_chip_probe() if both the two invocations of
check_cmd_set() return failure.

Signed-off-by: Hou Tao <houtao1@huawei.com>
Reviewed-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/chips/cfi_cmdset_0002.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 972935f1b2f7..3a3da0eeef1f 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -724,7 +724,6 @@ static struct mtd_info *cfi_amdstd_setup(struct mtd_info *mtd)
 	kfree(mtd->eraseregions);
 	kfree(mtd);
 	kfree(cfi->cmdset_priv);
-	kfree(cfi->cfiq);
 	return NULL;
 }
 

From 1a17f414dd6ff0926d05e54f5298ba2447b1727c Mon Sep 17 00:00:00 2001
From: Lee Jones <lee.jones@linaro.org>
Date: Mon, 21 Oct 2019 10:16:34 +0100
Subject: [PATCH 0640/2658] mfd: mfd-core: Protect against NULL call-back
 function pointer

[ Upstream commit b195e101580db390f50b0d587b7f66f241d2bc88 ]

If a child device calls mfd_cell_{en,dis}able() without an appropriate
call-back being set, we are likely to encounter a panic.  Avoid this
by adding suitable checking.

Signed-off-by: Lee Jones <lee.jones@linaro.org>
Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
Reviewed-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/mfd-core.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index 215bb5eeb5ac..c57e375fad6e 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -31,6 +31,11 @@ int mfd_cell_enable(struct platform_device *pdev)
 	const struct mfd_cell *cell = mfd_get_cell(pdev);
 	int err = 0;
 
+	if (!cell->enable) {
+		dev_dbg(&pdev->dev, "No .enable() call-back registered\n");
+		return 0;
+	}
+
 	/* only call enable hook if the cell wasn't previously enabled */
 	if (atomic_inc_return(cell->usage_count) == 1)
 		err = cell->enable(pdev);
@@ -48,6 +53,11 @@ int mfd_cell_disable(struct platform_device *pdev)
 	const struct mfd_cell *cell = mfd_get_cell(pdev);
 	int err = 0;
 
+	if (!cell->disable) {
+		dev_dbg(&pdev->dev, "No .disable() call-back registered\n");
+		return 0;
+	}
+
 	/* only disable if no other clients are using it */
 	if (atomic_dec_return(cell->usage_count) == 0)
 		err = cell->disable(pdev);

From 543275945b91ffdab4c2d086b4970aba19fdad25 Mon Sep 17 00:00:00 2001
From: Divya Indi <divya.indi@oracle.com>
Date: Wed, 14 Aug 2019 10:55:25 -0700
Subject: [PATCH 0641/2658] tracing: Adding NULL checks for trace_array
 descriptor pointer

[ Upstream commit 953ae45a0c25e09428d4a03d7654f97ab8a36647 ]

As part of commit f45d1225adb0 ("tracing: Kernel access to Ftrace
instances") we exported certain functions. Here, we are adding some additional
NULL checks to ensure safe usage by users of these APIs.

Link: http://lkml.kernel.org/r/1565805327-579-4-git-send-email-divya.indi@oracle.com

Signed-off-by: Divya Indi <divya.indi@oracle.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/trace.c        | 3 +++
 kernel/trace/trace_events.c | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index b0ebb271bae7..120f16d3e231 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2323,6 +2323,9 @@ int trace_array_printk(struct trace_array *tr,
 	if (!(global_trace.trace_flags & TRACE_ITER_PRINTK))
 		return 0;
 
+	if (!tr)
+		return -ENOENT;
+
 	va_start(ap, fmt);
 	ret = trace_array_vprintk(tr, ip, fmt, ap);
 	va_end(ap);
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index d0451cfd9daa..faeb44077cd8 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -756,6 +756,8 @@ static int ftrace_set_clr_event(struct trace_array *tr, char *buf, int set)
 	char *event = NULL, *sub = NULL, *match;
 	int ret;
 
+	if (!tr)
+		return -ENOENT;
 	/*
 	 * The buf format can be <subsystem>:<event-name>
 	 *  *:<event-name> means any event by that name.

From 32b371b9173e665d0f38eb7705d2e42e5dbaa285 Mon Sep 17 00:00:00 2001
From: Guoju Fang <fangguoju@gmail.com>
Date: Wed, 13 Nov 2019 16:03:16 +0800
Subject: [PATCH 0642/2658] bcache: fix a lost wake-up problem caused by
 mca_cannibalize_lock

[ Upstream commit 34cf78bf34d48dddddfeeadb44f9841d7864997a ]

This patch fix a lost wake-up problem caused by the race between
mca_cannibalize_lock and bch_cannibalize_unlock.

Consider two processes, A and B. Process A is executing
mca_cannibalize_lock, while process B takes c->btree_cache_alloc_lock
and is executing bch_cannibalize_unlock. The problem happens that after
process A executes cmpxchg and will execute prepare_to_wait. In this
timeslice process B executes wake_up, but after that process A executes
prepare_to_wait and set the state to TASK_INTERRUPTIBLE. Then process A
goes to sleep but no one will wake up it. This problem may cause bcache
device to dead.

Signed-off-by: Guoju Fang <fangguoju@gmail.com>
Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/bcache/bcache.h |  1 +
 drivers/md/bcache/btree.c  | 12 ++++++++----
 drivers/md/bcache/super.c  |  1 +
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index 7fe7df56fa33..f0939fc1cfe5 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -547,6 +547,7 @@ struct cache_set {
 	 */
 	wait_queue_head_t	btree_cache_wait;
 	struct task_struct	*btree_cache_alloc_lock;
+	spinlock_t		btree_cannibalize_lock;
 
 	/*
 	 * When we free a btree node, we increment the gen of the bucket the
diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 122d97522094..bdf6071c1b18 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -841,15 +841,17 @@ static struct btree *mca_find(struct cache_set *c, struct bkey *k)
 
 static int mca_cannibalize_lock(struct cache_set *c, struct btree_op *op)
 {
-	struct task_struct *old;
-
-	old = cmpxchg(&c->btree_cache_alloc_lock, NULL, current);
-	if (old && old != current) {
+	spin_lock(&c->btree_cannibalize_lock);
+	if (likely(c->btree_cache_alloc_lock == NULL)) {
+		c->btree_cache_alloc_lock = current;
+	} else if (c->btree_cache_alloc_lock != current) {
 		if (op)
 			prepare_to_wait(&c->btree_cache_wait, &op->wait,
 					TASK_UNINTERRUPTIBLE);
+		spin_unlock(&c->btree_cannibalize_lock);
 		return -EINTR;
 	}
+	spin_unlock(&c->btree_cannibalize_lock);
 
 	return 0;
 }
@@ -884,10 +886,12 @@ static struct btree *mca_cannibalize(struct cache_set *c, struct btree_op *op,
  */
 static void bch_cannibalize_unlock(struct cache_set *c)
 {
+	spin_lock(&c->btree_cannibalize_lock);
 	if (c->btree_cache_alloc_lock == current) {
 		c->btree_cache_alloc_lock = NULL;
 		wake_up(&c->btree_cache_wait);
 	}
+	spin_unlock(&c->btree_cannibalize_lock);
 }
 
 static struct btree *mca_alloc(struct cache_set *c, struct btree_op *op,
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index f7f8fb079d2a..d73f9ea77686 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1511,6 +1511,7 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)
 	sema_init(&c->sb_write_mutex, 1);
 	mutex_init(&c->bucket_lock);
 	init_waitqueue_head(&c->btree_cache_wait);
+	spin_lock_init(&c->btree_cannibalize_lock);
 	init_waitqueue_head(&c->bucket_wait);
 	init_waitqueue_head(&c->gc_wait);
 	sema_init(&c->uuid_write_mutex, 1);

From 3ba48dad4eaffac35bbbc944a8bb1f9ac281f392 Mon Sep 17 00:00:00 2001
From: Brian Foster <bfoster@redhat.com>
Date: Fri, 15 Nov 2019 21:15:08 -0800
Subject: [PATCH 0643/2658] xfs: fix attr leaf header freemap.size underflow

[ Upstream commit 2a2b5932db67586bacc560cc065d62faece5b996 ]

The leaf format xattr addition helper xfs_attr3_leaf_add_work()
adjusts the block freemap in a couple places. The first update drops
the size of the freemap that the caller had already selected to
place the xattr name/value data. Before the function returns, it
also checks whether the entries array has encroached on a freemap
range by virtue of the new entry addition. This is necessary because
the entries array grows from the start of the block (but end of the
block header) towards the end of the block while the name/value data
grows from the end of the block in the opposite direction. If the
associated freemap is already empty, however, size is zero and the
subtraction underflows the field and causes corruption.

This is reproduced rarely by generic/070. The observed behavior is
that a smaller sized freemap is aligned to the end of the entries
list, several subsequent xattr additions land in larger freemaps and
the entries list expands into the smaller freemap until it is fully
consumed and then underflows. Note that it is not otherwise a
corruption for the entries array to consume an empty freemap because
the nameval list (i.e. the firstused pointer in the xattr header)
starts beyond the end of the corrupted freemap.

Update the freemap size modification to account for the fact that
the freemap entry can be empty and thus stale.

Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/libxfs/xfs_attr_leaf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
index da8747b870df..4539ff4d351f 100644
--- a/fs/xfs/libxfs/xfs_attr_leaf.c
+++ b/fs/xfs/libxfs/xfs_attr_leaf.c
@@ -1326,7 +1326,9 @@ xfs_attr3_leaf_add_work(
 	for (i = 0; i < XFS_ATTR_LEAF_MAPSIZE; i++) {
 		if (ichdr->freemap[i].base == tmp) {
 			ichdr->freemap[i].base += sizeof(xfs_attr_leaf_entry_t);
-			ichdr->freemap[i].size -= sizeof(xfs_attr_leaf_entry_t);
+			ichdr->freemap[i].size -=
+				min_t(uint16_t, ichdr->freemap[i].size,
+						sizeof(xfs_attr_leaf_entry_t));
 		}
 	}
 	ichdr->usedbytes += xfs_attr_leaf_entsize(leaf, args->index);

From 95ad02356d4b2212cd7632378daab4aae7428c37 Mon Sep 17 00:00:00 2001
From: Joe Perches <joe@perches.com>
Date: Wed, 4 Dec 2019 16:50:53 -0800
Subject: [PATCH 0644/2658] kernel/sys.c: avoid copying possible padding bytes
 in copy_to_user

[ Upstream commit 5e1aada08cd19ea652b2d32a250501d09b02ff2e ]

Initialization is not guaranteed to zero padding bytes so use an
explicit memset instead to avoid leaking any kernel content in any
possible padding bytes.

Link: http://lkml.kernel.org/r/dfa331c00881d61c8ee51577a082d8bebd61805c.camel@perches.com
Signed-off-by: Joe Perches <joe@perches.com>
Cc: Dan Carpenter <error27@gmail.com>
Cc: Julia Lawall <julia.lawall@lip6.fr>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sys.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/sys.c b/kernel/sys.c
index 29413e2bee41..5a40f5c07054 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1185,11 +1185,13 @@ SYSCALL_DEFINE1(uname, struct old_utsname __user *, name)
 
 SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
 {
-	struct oldold_utsname tmp = {};
+	struct oldold_utsname tmp;
 
 	if (!name)
 		return -EFAULT;
 
+	memset(&tmp, 0, sizeof(tmp));
+
 	down_read(&uts_sem);
 	memcpy(&tmp.sysname, &utsname()->sysname, __OLD_UTS_LEN);
 	memcpy(&tmp.nodename, &utsname()->nodename, __OLD_UTS_LEN);

From bdeceee13f6604faf7e50c3736aa79a96e3a9240 Mon Sep 17 00:00:00 2001
From: Vasily Averin <vvs@virtuozzo.com>
Date: Thu, 23 Jan 2020 10:11:28 +0300
Subject: [PATCH 0645/2658] neigh_stat_seq_next() should increase position
 index

[ Upstream commit 1e3f9f073c47bee7c23e77316b07bc12338c5bba ]

if seq_file .next fuction does not change position index,
read after some lseek can generate unexpected output.

https://bugzilla.kernel.org/show_bug.cgi?id=206283
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/neighbour.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 59d2897acd6e..7044c2636985 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2798,6 +2798,7 @@ static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 		*pos = cpu+1;
 		return per_cpu_ptr(tbl->stats, cpu);
 	}
+	(*pos)++;
 	return NULL;
 }
 

From ac9f6d990ca86a82febaec64447edab4290701d1 Mon Sep 17 00:00:00 2001
From: Vasily Averin <vvs@virtuozzo.com>
Date: Thu, 23 Jan 2020 10:11:35 +0300
Subject: [PATCH 0646/2658] rt_cpu_seq_next should increase position index

[ Upstream commit a3ea86739f1bc7e121d921842f0f4a8ab1af94d9 ]

if seq_file .next fuction does not change position index,
read after some lseek can generate unexpected output.

https://bugzilla.kernel.org/show_bug.cgi?id=206283
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/route.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 2fcb524cd75b..a9df7487c929 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -271,6 +271,7 @@ static void *rt_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 		*pos = cpu+1;
 		return &per_cpu(rt_cache_stat, cpu);
 	}
+	(*pos)++;
 	return NULL;
 
 }

From 550b8b2cf89524dc83fe492cfec93bd245202937 Mon Sep 17 00:00:00 2001
From: Marco Elver <elver@google.com>
Date: Thu, 14 Nov 2019 19:03:00 +0100
Subject: [PATCH 0647/2658] seqlock: Require WRITE_ONCE surrounding
 raw_seqcount_barrier

[ Upstream commit bf07132f96d426bcbf2098227fb680915cf44498 ]

This patch proposes to require marked atomic accesses surrounding
raw_write_seqcount_barrier. We reason that otherwise there is no way to
guarantee propagation nor atomicity of writes before/after the barrier
[1]. For example, consider the compiler tears stores either before or
after the barrier; in this case, readers may observe a partial value,
and because readers are unaware that writes are going on (writes are not
in a seq-writer critical section), will complete the seq-reader critical
section while having observed some partial state.
[1] https://lwn.net/Articles/793253/

This came up when designing and implementing KCSAN, because KCSAN would
flag these accesses as data-races. After careful analysis, our reasoning
as above led us to conclude that the best thing to do is to propose an
amendment to the raw_seqcount_barrier usage.

Signed-off-by: Marco Elver <elver@google.com>
Acked-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/seqlock.h | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h
index e0582106ef4f..a10f36378417 100644
--- a/include/linux/seqlock.h
+++ b/include/linux/seqlock.h
@@ -242,6 +242,13 @@ static inline void raw_write_seqcount_end(seqcount_t *s)
  * usual consistency guarantee. It is one wmb cheaper, because we can
  * collapse the two back-to-back wmb()s.
  *
+ * Note that, writes surrounding the barrier should be declared atomic (e.g.
+ * via WRITE_ONCE): a) to ensure the writes become visible to other threads
+ * atomically, avoiding compiler optimizations; b) to document which writes are
+ * meant to propagate to the reader critical section. This is necessary because
+ * neither writes before and after the barrier are enclosed in a seq-writer
+ * critical section that would ensure readers are aware of ongoing writes.
+ *
  *      seqcount_t seq;
  *      bool X = true, Y = false;
  *
@@ -261,11 +268,11 @@ static inline void raw_write_seqcount_end(seqcount_t *s)
  *
  *      void write(void)
  *      {
- *              Y = true;
+ *              WRITE_ONCE(Y, true);
  *
  *              raw_write_seqcount_barrier(seq);
  *
- *              X = false;
+ *              WRITE_ONCE(X, false);
  *      }
  */
 static inline void raw_write_seqcount_barrier(seqcount_t *s)

From 0824a813445dd61a9f516cc8670f2c6c601f487d Mon Sep 17 00:00:00 2001
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Date: Fri, 27 Dec 2019 11:04:21 +0100
Subject: [PATCH 0648/2658] ACPI: EC: Reference count query handlers under lock

[ Upstream commit 3df663a147fe077a6ee8444ec626738946e65547 ]

There is a race condition in acpi_ec_get_query_handler()
theoretically allowing query handlers to go away before refernce
counting them.

In order to avoid it, call kref_get() on query handlers under
ec->mutex.

Also simplify the code a bit while at it.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/ec.c | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 43f20328f830..3096c087b732 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -943,29 +943,21 @@ void acpi_ec_unblock_transactions_early(void)
 /* --------------------------------------------------------------------------
                                 Event Management
    -------------------------------------------------------------------------- */
-static struct acpi_ec_query_handler *
-acpi_ec_get_query_handler(struct acpi_ec_query_handler *handler)
-{
-	if (handler)
-		kref_get(&handler->kref);
-	return handler;
-}
-
 static struct acpi_ec_query_handler *
 acpi_ec_get_query_handler_by_value(struct acpi_ec *ec, u8 value)
 {
 	struct acpi_ec_query_handler *handler;
-	bool found = false;
 
 	mutex_lock(&ec->mutex);
 	list_for_each_entry(handler, &ec->list, node) {
 		if (value == handler->query_bit) {
-			found = true;
-			break;
+			kref_get(&handler->kref);
+			mutex_unlock(&ec->mutex);
+			return handler;
 		}
 	}
 	mutex_unlock(&ec->mutex);
-	return found ? acpi_ec_get_query_handler(handler) : NULL;
+	return NULL;
 }
 
 static void acpi_ec_query_handler_release(struct kref *kref)

From a9b7cc1a1284a977a70eb99ccbffc85186624f9c Mon Sep 17 00:00:00 2001
From: Josef Bacik <jbacik@fb.com>
Date: Wed, 24 Sep 2014 16:14:12 -0400
Subject: [PATCH 0649/2658] tracing: Set kernel_stack's caller size properly

[ Upstream commit cbc3b92ce037f5e7536f6db157d185cd8b8f615c ]

I noticed when trying to use the trace-cmd python interface that reading the raw
buffer wasn't working for kernel_stack events.  This is because it uses a
stubbed version of __dynamic_array that doesn't do the __data_loc trick and
encode the length of the array into the field.  Instead it just shows up as a
size of 0.  So change this to __array and set the len to FTRACE_STACK_ENTRIES
since this is what we actually do in practice and matches how user_stack_trace
works.

Link: http://lkml.kernel.org/r/1411589652-1318-1-git-send-email-jbacik@fb.com

Signed-off-by: Josef Bacik <jbacik@fb.com>
[ Pulled from the archeological digging of my INBOX ]
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/trace_entries.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/trace/trace_entries.h b/kernel/trace/trace_entries.h
index ee7b94a4810a..246db27dbdc9 100644
--- a/kernel/trace/trace_entries.h
+++ b/kernel/trace/trace_entries.h
@@ -178,7 +178,7 @@ FTRACE_ENTRY(kernel_stack, stack_entry,
 
 	F_STRUCT(
 		__field(	int,		size	)
-		__dynamic_array(unsigned long,	caller	)
+		__array(	unsigned long,	caller,	FTRACE_STACK_ENTRIES	)
 	),
 
 	F_printk("\t=> (" IP_FMT ")\n\t=> (" IP_FMT ")\n\t=> (" IP_FMT ")\n"

From e4e009dda937e8d4a1575ac8e50c970034134eb3 Mon Sep 17 00:00:00 2001
From: Mert Dirik <mertdirik@gmail.com>
Date: Thu, 16 Jan 2020 14:11:25 +0300
Subject: [PATCH 0650/2658] ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter

[ Upstream commit 5b362498a79631f283578b64bf6f4d15ed4cc19a ]

Add the required USB ID for running SMCWUSBT-G2 wireless adapter (SMC
"EZ Connect g").

This device uses ar5523 chipset and requires firmware to be loaded. Even
though pid of the device is 4507, this patch adds it as 4506 so that
AR5523_DEVICE_UG macro can set the AR5523_FLAG_PRE_FIRMWARE flag for pid
4507.

Signed-off-by: Mert Dirik <mertdirik@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ar5523/ar5523.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
index 5bf22057459e..bc6330b43795 100644
--- a/drivers/net/wireless/ath/ar5523/ar5523.c
+++ b/drivers/net/wireless/ath/ar5523/ar5523.c
@@ -1774,6 +1774,8 @@ static struct usb_device_id ar5523_id_table[] = {
 	AR5523_DEVICE_UX(0x0846, 0x4300),	/* Netgear / WG111U */
 	AR5523_DEVICE_UG(0x0846, 0x4250),	/* Netgear / WG111T */
 	AR5523_DEVICE_UG(0x0846, 0x5f00),	/* Netgear / WPN111 */
+	AR5523_DEVICE_UG(0x083a, 0x4506),	/* SMC / EZ Connect
+						   SMCWUSBT-G2 */
 	AR5523_DEVICE_UG(0x157e, 0x3006),	/* Umedia / AR5523_1 */
 	AR5523_DEVICE_UX(0x157e, 0x3205),	/* Umedia / AR5523_2 */
 	AR5523_DEVICE_UG(0x157e, 0x3006),	/* Umedia / TEW444UBEU */

From df5fd0d81e61f3498529752cb67cbf544e4d3197 Mon Sep 17 00:00:00 2001
From: Manish Mandlik <mmandlik@google.com>
Date: Tue, 28 Jan 2020 10:54:14 -0800
Subject: [PATCH 0651/2658] Bluetooth: Fix refcount use-after-free issue

[ Upstream commit 6c08fc896b60893c5d673764b0668015d76df462 ]

There is no lock preventing both l2cap_sock_release() and
chan->ops->close() from running at the same time.

If we consider Thread A running l2cap_chan_timeout() and Thread B running
l2cap_sock_release(), expected behavior is:
  A::l2cap_chan_timeout()->l2cap_chan_close()->l2cap_sock_teardown_cb()
  A::l2cap_chan_timeout()->l2cap_sock_close_cb()->l2cap_sock_kill()
  B::l2cap_sock_release()->sock_orphan()
  B::l2cap_sock_release()->l2cap_sock_kill()

where,
sock_orphan() clears "sk->sk_socket" and l2cap_sock_teardown_cb() marks
socket as SOCK_ZAPPED.

In l2cap_sock_kill(), there is an "if-statement" that checks if both
sock_orphan() and sock_teardown() has been run i.e. sk->sk_socket is NULL
and socket is marked as SOCK_ZAPPED. Socket is killed if the condition is
satisfied.

In the race condition, following occurs:
  A::l2cap_chan_timeout()->l2cap_chan_close()->l2cap_sock_teardown_cb()
  B::l2cap_sock_release()->sock_orphan()
  B::l2cap_sock_release()->l2cap_sock_kill()
  A::l2cap_chan_timeout()->l2cap_sock_close_cb()->l2cap_sock_kill()

In this scenario, "if-statement" is true in both B::l2cap_sock_kill() and
A::l2cap_sock_kill() and we hit "refcount: underflow; use-after-free" bug.

Similar condition occurs at other places where teardown/sock_kill is
happening:
  l2cap_disconnect_rsp()->l2cap_chan_del()->l2cap_sock_teardown_cb()
  l2cap_disconnect_rsp()->l2cap_sock_close_cb()->l2cap_sock_kill()

  l2cap_conn_del()->l2cap_chan_del()->l2cap_sock_teardown_cb()
  l2cap_conn_del()->l2cap_sock_close_cb()->l2cap_sock_kill()

  l2cap_disconnect_req()->l2cap_chan_del()->l2cap_sock_teardown_cb()
  l2cap_disconnect_req()->l2cap_sock_close_cb()->l2cap_sock_kill()

  l2cap_sock_cleanup_listen()->l2cap_chan_close()->l2cap_sock_teardown_cb()
  l2cap_sock_cleanup_listen()->l2cap_sock_kill()

Protect teardown/sock_kill and orphan/sock_kill by adding hold_lock on
l2cap channel to ensure that the socket is killed only after marked as
zapped and orphan.

Signed-off-by: Manish Mandlik <mmandlik@google.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/l2cap_core.c | 26 +++++++++++++++-----------
 net/bluetooth/l2cap_sock.c | 16 +++++++++++++---
 2 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index fdfae7334e77..49070cc77f74 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -403,6 +403,9 @@ static void l2cap_chan_timeout(struct work_struct *work)
 	BT_DBG("chan %pK state %s", chan, state_to_string(chan->state));
 
 	mutex_lock(&conn->chan_lock);
+	/* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling
+	 * this work. No need to call l2cap_chan_hold(chan) here again.
+	 */
 	l2cap_chan_lock(chan);
 
 	if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
@@ -415,12 +418,12 @@ static void l2cap_chan_timeout(struct work_struct *work)
 
 	l2cap_chan_close(chan, reason);
 
-	l2cap_chan_unlock(chan);
-
 	chan->ops->close(chan);
-	mutex_unlock(&conn->chan_lock);
 
+	l2cap_chan_unlock(chan);
 	l2cap_chan_put(chan);
+
+	mutex_unlock(&conn->chan_lock);
 }
 
 struct l2cap_chan *l2cap_chan_create(void)
@@ -1714,9 +1717,9 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
 
 		l2cap_chan_del(chan, err);
 
-		l2cap_chan_unlock(chan);
-
 		chan->ops->close(chan);
+
+		l2cap_chan_unlock(chan);
 		l2cap_chan_put(chan);
 	}
 
@@ -4316,6 +4319,7 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
 		return 0;
 	}
 
+	l2cap_chan_hold(chan);
 	l2cap_chan_lock(chan);
 
 	rsp.dcid = cpu_to_le16(chan->scid);
@@ -4324,12 +4328,11 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
 
 	chan->ops->set_shutdown(chan);
 
-	l2cap_chan_hold(chan);
 	l2cap_chan_del(chan, ECONNRESET);
 
-	l2cap_chan_unlock(chan);
-
 	chan->ops->close(chan);
+
+	l2cap_chan_unlock(chan);
 	l2cap_chan_put(chan);
 
 	mutex_unlock(&conn->chan_lock);
@@ -4361,20 +4364,21 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
 		return 0;
 	}
 
+	l2cap_chan_hold(chan);
 	l2cap_chan_lock(chan);
 
 	if (chan->state != BT_DISCONN) {
 		l2cap_chan_unlock(chan);
+		l2cap_chan_put(chan);
 		mutex_unlock(&conn->chan_lock);
 		return 0;
 	}
 
-	l2cap_chan_hold(chan);
 	l2cap_chan_del(chan, 0);
 
-	l2cap_chan_unlock(chan);
-
 	chan->ops->close(chan);
+
+	l2cap_chan_unlock(chan);
 	l2cap_chan_put(chan);
 
 	mutex_unlock(&conn->chan_lock);
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index bd3c021932be..49c2c7b2874e 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1038,7 +1038,7 @@ static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
 }
 
 /* Kill socket (only if zapped and orphan)
- * Must be called on unlocked socket.
+ * Must be called on unlocked socket, with l2cap channel lock.
  */
 static void l2cap_sock_kill(struct sock *sk)
 {
@@ -1199,8 +1199,15 @@ static int l2cap_sock_release(struct socket *sock)
 
 	err = l2cap_sock_shutdown(sock, 2);
 
+	l2cap_chan_hold(l2cap_pi(sk)->chan);
+	l2cap_chan_lock(l2cap_pi(sk)->chan);
+
 	sock_orphan(sk);
 	l2cap_sock_kill(sk);
+
+	l2cap_chan_unlock(l2cap_pi(sk)->chan);
+	l2cap_chan_put(l2cap_pi(sk)->chan);
+
 	return err;
 }
 
@@ -1218,12 +1225,15 @@ static void l2cap_sock_cleanup_listen(struct sock *parent)
 		BT_DBG("child chan %pK state %s", chan,
 		       state_to_string(chan->state));
 
+		l2cap_chan_hold(chan);
 		l2cap_chan_lock(chan);
+
 		__clear_chan_timer(chan);
 		l2cap_chan_close(chan, ECONNRESET);
-		l2cap_chan_unlock(chan);
-
 		l2cap_sock_kill(sk);
+
+		l2cap_chan_unlock(chan);
+		l2cap_chan_put(chan);
 	}
 }
 

From fd375fa1aa2e4fa68295b4f1512dd9394a03cc7b Mon Sep 17 00:00:00 2001
From: Steven Price <steven.price@arm.com>
Date: Mon, 3 Feb 2020 17:35:58 -0800
Subject: [PATCH 0652/2658] mm: pagewalk: fix termination condition in
 walk_pte_range()

[ Upstream commit c02a98753e0a36ba65a05818626fa6adeb4e7c97 ]

If walk_pte_range() is called with a 'end' argument that is beyond the
last page of memory (e.g.  ~0UL) then the comparison between 'addr' and
'end' will always fail and the loop will be infinite.  Instead change the
comparison to >= while accounting for overflow.

Link: http://lkml.kernel.org/r/20191218162402.45610-15-steven.price@arm.com
Signed-off-by: Steven Price <steven.price@arm.com>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Alexandre Ghiti <alex@ghiti.fr>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Hogan <jhogan@kernel.org>
Cc: James Morse <james.morse@arm.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: "Liang, Kan" <kan.liang@linux.intel.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Paul Burton <paul.burton@mips.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Paul Walmsley <paul.walmsley@sifive.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: Vineet Gupta <vgupta@synopsys.com>
Cc: Will Deacon <will@kernel.org>
Cc: Zong Li <zong.li@sifive.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/pagewalk.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/pagewalk.c b/mm/pagewalk.c
index c2cbd2620169..a024667a9c04 100644
--- a/mm/pagewalk.c
+++ b/mm/pagewalk.c
@@ -14,9 +14,9 @@ static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
 		err = walk->pte_entry(pte, addr, addr + PAGE_SIZE, walk);
 		if (err)
 		       break;
-		addr += PAGE_SIZE;
-		if (addr == end)
+		if (addr >= end - PAGE_SIZE)
 			break;
+		addr += PAGE_SIZE;
 		pte++;
 	}
 

From 4ef9b22bb750b526ef32b4d13137acd257f1f9f8 Mon Sep 17 00:00:00 2001
From: Hillf Danton <hdanton@sina.com>
Date: Wed, 5 Feb 2020 10:31:59 +0800
Subject: [PATCH 0653/2658] Bluetooth: prefetch channel before killing sock

[ Upstream commit 2a154903cec20fb64ff4d7d617ca53c16f8fd53a ]

Prefetch channel before killing sock in order to fix UAF like

 BUG: KASAN: use-after-free in l2cap_sock_release+0x24c/0x290 net/bluetooth/l2cap_sock.c:1212
 Read of size 8 at addr ffff8880944904a0 by task syz-fuzzer/9751

Reported-by: syzbot+c3c5bdea7863886115dc@syzkaller.appspotmail.com
Fixes: 6c08fc896b60 ("Bluetooth: Fix refcount use-after-free issue")
Cc: Manish Mandlik <mmandlik@google.com>
Signed-off-by: Hillf Danton <hdanton@sina.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/l2cap_sock.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 49c2c7b2874e..b6860dc540ed 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1189,6 +1189,7 @@ static int l2cap_sock_release(struct socket *sock)
 {
 	struct sock *sk = sock->sk;
 	int err;
+	struct l2cap_chan *chan;
 
 	BT_DBG("sock %pK, sk %pK", sock, sk);
 
@@ -1198,15 +1199,16 @@ static int l2cap_sock_release(struct socket *sock)
 	bt_sock_unlink(&l2cap_sk_list, sk);
 
 	err = l2cap_sock_shutdown(sock, 2);
+	chan = l2cap_pi(sk)->chan;
 
-	l2cap_chan_hold(l2cap_pi(sk)->chan);
-	l2cap_chan_lock(l2cap_pi(sk)->chan);
+	l2cap_chan_hold(chan);
+	l2cap_chan_lock(chan);
 
 	sock_orphan(sk);
 	l2cap_sock_kill(sk);
 
-	l2cap_chan_unlock(l2cap_pi(sk)->chan);
-	l2cap_chan_put(l2cap_pi(sk)->chan);
+	l2cap_chan_unlock(chan);
+	l2cap_chan_put(chan);
 
 	return err;
 }

From c9fe73f2c1cbcfa6575d4eb421aed27592860f35 Mon Sep 17 00:00:00 2001
From: Qian Cai <cai@lca.pw>
Date: Tue, 4 Feb 2020 13:40:29 -0500
Subject: [PATCH 0654/2658] skbuff: fix a data race in skb_queue_len()

[ Upstream commit 86b18aaa2b5b5bb48e609cd591b3d2d0fdbe0442 ]

sk_buff.qlen can be accessed concurrently as noticed by KCSAN,

 BUG: KCSAN: data-race in __skb_try_recv_from_queue / unix_dgram_sendmsg

 read to 0xffff8a1b1d8a81c0 of 4 bytes by task 5371 on cpu 96:
  unix_dgram_sendmsg+0x9a9/0xb70 include/linux/skbuff.h:1821
				 net/unix/af_unix.c:1761
  ____sys_sendmsg+0x33e/0x370
  ___sys_sendmsg+0xa6/0xf0
  __sys_sendmsg+0x69/0xf0
  __x64_sys_sendmsg+0x51/0x70
  do_syscall_64+0x91/0xb47
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

 write to 0xffff8a1b1d8a81c0 of 4 bytes by task 1 on cpu 99:
  __skb_try_recv_from_queue+0x327/0x410 include/linux/skbuff.h:2029
  __skb_try_recv_datagram+0xbe/0x220
  unix_dgram_recvmsg+0xee/0x850
  ____sys_recvmsg+0x1fb/0x210
  ___sys_recvmsg+0xa2/0xf0
  __sys_recvmsg+0x66/0xf0
  __x64_sys_recvmsg+0x51/0x70
  do_syscall_64+0x91/0xb47
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

Since only the read is operating as lockless, it could introduce a logic
bug in unix_recvq_full() due to the load tearing. Fix it by adding
a lockless variant of skb_queue_len() and unix_recvq_full() where
READ_ONCE() is on the read while WRITE_ONCE() is on the write similar to
the commit d7d16a89350a ("net: add skb_queue_empty_lockless()").

Signed-off-by: Qian Cai <cai@lca.pw>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/skbuff.h | 14 +++++++++++++-
 net/unix/af_unix.c     | 11 +++++++++--
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 2528f712b8c0..95feb153fe9a 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1438,6 +1438,18 @@ static inline __u32 skb_queue_len(const struct sk_buff_head *list_)
 	return list_->qlen;
 }
 
+/**
+ *	skb_queue_len_lockless	- get queue length
+ *	@list_: list to measure
+ *
+ *	Return the length of an &sk_buff queue.
+ *	This variant can be used in lockless contexts.
+ */
+static inline __u32 skb_queue_len_lockless(const struct sk_buff_head *list_)
+{
+	return READ_ONCE(list_->qlen);
+}
+
 /**
  *	__skb_queue_head_init - initialize non-spinlock portions of sk_buff_head
  *	@list: queue to initialize
@@ -1641,7 +1653,7 @@ static inline void __skb_unlink(struct sk_buff *skb, struct sk_buff_head *list)
 {
 	struct sk_buff *next, *prev;
 
-	list->qlen--;
+	WRITE_ONCE(list->qlen, list->qlen - 1);
 	next	   = skb->next;
 	prev	   = skb->prev;
 	skb->next  = skb->prev = NULL;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 4f547eebfd36..014e35c2723a 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -191,11 +191,17 @@ static inline int unix_may_send(struct sock *sk, struct sock *osk)
 	return unix_peer(osk) == NULL || unix_our_peer(sk, osk);
 }
 
-static inline int unix_recvq_full(struct sock const *sk)
+static inline int unix_recvq_full(const struct sock *sk)
 {
 	return skb_queue_len(&sk->sk_receive_queue) > sk->sk_max_ack_backlog;
 }
 
+static inline int unix_recvq_full_lockless(const struct sock *sk)
+{
+	return skb_queue_len_lockless(&sk->sk_receive_queue) >
+		READ_ONCE(sk->sk_max_ack_backlog);
+}
+
 struct sock *unix_peer_get(struct sock *s)
 {
 	struct sock *peer;
@@ -1792,7 +1798,8 @@ static int unix_dgram_sendmsg(struct socket *sock, struct msghdr *msg,
 	 * - unix_peer(sk) == sk by time of get but disconnected before lock
 	 */
 	if (other != sk &&
-	    unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
+	    unlikely(unix_peer(other) != sk &&
+	    unix_recvq_full_lockless(other))) {
 		if (timeo) {
 			timeo = unix_wait_for_peer(other, timeo);
 

From 74879c4a1ed1d702e6fe18743bb2aeb2cb3dd84e Mon Sep 17 00:00:00 2001
From: Steve Grubb <sgrubb@redhat.com>
Date: Fri, 24 Jan 2020 17:29:16 -0500
Subject: [PATCH 0655/2658] audit: CONFIG_CHANGE don't log internal bookkeeping
 as an event

[ Upstream commit 70b3eeed49e8190d97139806f6fbaf8964306cdb ]

Common Criteria calls out for any action that modifies the audit trail to
be recorded. That usually is interpreted to mean insertion or removal of
rules. It is not required to log modification of the inode information
since the watch is still in effect. Additionally, if the rule is a never
rule and the underlying file is one they do not want events for, they
get an event for this bookkeeping update against their wishes.

Since no device/inode info is logged at insertion and no device/inode
information is logged on update, there is nothing meaningful being
communicated to the admin by the CONFIG_CHANGE updated_rules event. One
can assume that the rule was not "modified" because it is still watching
the intended target. If the device or inode cannot be resolved, then
audit_panic is called which is sufficient.

The correct resolution is to drop logging config_update events since
the watch is still in effect but just on another unknown inode.

Signed-off-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/audit_watch.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index f45a9a5d3e47..af453f3c2b3d 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -316,8 +316,6 @@ static void audit_update_watch(struct audit_parent *parent,
 			if (oentry->rule.exe)
 				audit_remove_mark(oentry->rule.exe);
 
-			audit_watch_log_rule_change(r, owatch, "updated_rules");
-
 			call_rcu(&oentry->rcu, audit_free_rule_rcu);
 		}
 

From 51ed4d31135d5d5feb18173d2a06491e06d305c2 Mon Sep 17 00:00:00 2001
From: Vasily Averin <vvs@virtuozzo.com>
Date: Sat, 1 Feb 2020 10:47:47 +0300
Subject: [PATCH 0656/2658] selinux: sel_avc_get_stat_idx should increase
 position index

[ Upstream commit 8d269a8e2a8f0bca89022f4ec98de460acb90365 ]

If seq_file .next function does not change position index,
read after some lseek can generate unexpected output.

$ dd if=/sys/fs/selinux/avc/cache_stats # usual output
lookups hits misses allocations reclaims frees
817223 810034 7189 7189 6992 7037
1934894 1926896 7998 7998 7632 7683
1322812 1317176 5636 5636 5456 5507
1560571 1551548 9023 9023 9056 9115
0+1 records in
0+1 records out
189 bytes copied, 5,1564e-05 s, 3,7 MB/s

$# read after lseek to midle of last line
$ dd if=/sys/fs/selinux/avc/cache_stats bs=180 skip=1
dd: /sys/fs/selinux/avc/cache_stats: cannot skip to specified offset
056 9115   <<<< end of last line
1560571 1551548 9023 9023 9056 9115  <<< whole last line once again
0+1 records in
0+1 records out
45 bytes copied, 8,7221e-05 s, 516 kB/s

$# read after lseek beyond  end of of file
$ dd if=/sys/fs/selinux/avc/cache_stats bs=1000 skip=1
dd: /sys/fs/selinux/avc/cache_stats: cannot skip to specified offset
1560571 1551548 9023 9023 9056 9115  <<<< generates whole last line
0+1 records in
0+1 records out
36 bytes copied, 9,0934e-05 s, 396 kB/s

https://bugzilla.kernel.org/show_bug.cgi?id=206283

Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/selinux/selinuxfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index c02da25d7b63..7778e28cce9d 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -1370,6 +1370,7 @@ static struct avc_cache_stats *sel_avc_get_stat_idx(loff_t *idx)
 		*idx = cpu + 1;
 		return &per_cpu(avc_cache_stats, cpu);
 	}
+	(*idx)++;
 	return NULL;
 }
 

From dc0ced762a557953184cdd44f617d59806b61008 Mon Sep 17 00:00:00 2001
From: James Smart <jsmart2021@gmail.com>
Date: Mon, 27 Jan 2020 16:23:01 -0800
Subject: [PATCH 0657/2658] scsi: lpfc: Fix RQ buffer leakage when no IOCBs
 available

[ Upstream commit 39c4f1a965a9244c3ba60695e8ff8da065ec6ac4 ]

The driver is occasionally seeing the following SLI Port error, requiring
reset and reinit:

 Port Status Event: ... error 1=0x52004a01, error 2=0x218

The failure means an RQ timeout. That is, the adapter had received
asynchronous receive frames, ran out of buffer slots to place the frames,
and the driver did not replenish the buffer slots before a timeout
occurred. The driver should not be so slow in replenishing buffers that a
timeout can occur.

When the driver received all the frames of a sequence, it allocates an IOCB
to put the frames in. In a situation where there was no IOCB available for
the frame of a sequence, the RQ buffer corresponding to the first frame of
the sequence was not returned to the FW. Eventually, with enough traffic
encountering the situation, the timeout occurred.

Fix by releasing the buffer back to firmware whenever there is no IOCB for
the first frame.

[mkp: typo]

Link: https://lore.kernel.org/r/20200128002312.16346-2-jsmart2021@gmail.com
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/lpfc/lpfc_sli.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 7a94c2d35239..97c0d79a2601 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -15445,6 +15445,10 @@ lpfc_prep_seq(struct lpfc_vport *vport, struct hbq_dmabuf *seq_dmabuf)
 			list_add_tail(&iocbq->list, &first_iocbq->list);
 		}
 	}
+	/* Free the sequence's header buffer */
+	if (!first_iocbq)
+		lpfc_in_buf_free(vport->phba, &seq_dmabuf->dbuf);
+
 	return first_iocbq;
 }
 

From 3e35afff8ab18aa74d6e090c9debde93d8e06946 Mon Sep 17 00:00:00 2001
From: Wen Yang <wen.yang99@zte.com.cn>
Date: Mon, 8 Apr 2019 10:58:32 +0800
Subject: [PATCH 0658/2658] drm/omap: fix possible object reference leak

[ Upstream commit 47340e46f34a3b1d80e40b43ae3d7a8da34a3541 ]

The call to of_find_matching_node returns a node pointer with refcount
incremented thus it must be explicitly decremented after the last
usage.

Detected by coccinelle with the following warnings:
drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c:212:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 209, but without a corresponding object release within this function.
drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c:237:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 209, but without a corresponding object release within this function.

Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: David Airlie <airlied@linux.ie>
Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: Sebastian Reichel <sebastian.reichel@collabora.com>
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: dri-devel@lists.freedesktop.org
Cc: linux-kernel@vger.kernel.org
Cc: Markus Elfring <Markus.Elfring@web.de>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1554692313-28882-2-git-send-email-wen.yang99@zte.com.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/omap2/dss/omapdss-boot-init.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c b/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c
index 8b6f6d5fdd68..43186fa8a13c 100644
--- a/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c
+++ b/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c
@@ -194,7 +194,7 @@ static int __init omapdss_boot_init(void)
 	dss = of_find_matching_node(NULL, omapdss_of_match);
 
 	if (dss == NULL || !of_device_is_available(dss))
-		return 0;
+		goto put_node;
 
 	omapdss_walk_device(dss, true);
 
@@ -221,6 +221,8 @@ static int __init omapdss_boot_init(void)
 		kfree(n);
 	}
 
+put_node:
+	of_node_put(dss);
 	return 0;
 }
 

From 90a953d751ea8103ee03cacb62955e3d481ea36e Mon Sep 17 00:00:00 2001
From: Dmitry Osipenko <digetx@gmail.com>
Date: Sun, 9 Feb 2020 19:33:41 +0300
Subject: [PATCH 0659/2658] dmaengine: tegra-apb: Prevent race conditions on
 channel's freeing

[ Upstream commit 8e84172e372bdca20c305d92d51d33640d2da431 ]

It's incorrect to check the channel's "busy" state without taking a lock.
That shouldn't cause any real troubles, nevertheless it's always better
not to have any race conditions in the code.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Acked-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://lore.kernel.org/r/20200209163356.6439-5-digetx@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/tegra20-apb-dma.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c
index b5cf5d36de2b..68c460a2b16e 100644
--- a/drivers/dma/tegra20-apb-dma.c
+++ b/drivers/dma/tegra20-apb-dma.c
@@ -1207,8 +1207,7 @@ static void tegra_dma_free_chan_resources(struct dma_chan *dc)
 
 	dev_dbg(tdc2dev(tdc), "Freeing channel %d\n", tdc->id);
 
-	if (tdc->busy)
-		tegra_dma_terminate_all(dc);
+	tegra_dma_terminate_all(dc);
 
 	spin_lock_irqsave(&tdc->lock, flags);
 	list_splice_init(&tdc->pending_sg_req, &sg_req_list);

From 4b8da31ca0d9d5faeaaff8754eb3c0a962ba48c1 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Thu, 6 Feb 2020 16:45:27 +0100
Subject: [PATCH 0660/2658] media: go7007: Fix URB type for interrupt handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit a3ea410cac41b19a5490aad7fe6d9a9a772e646e ]

Josef reported that his old-and-good Plextor ConvertX M402U video
converter spews lots of WARNINGs on the recent kernels, and it turned
out that the device uses a bulk endpoint for interrupt handling just
like 2250 board.

For fixing it, generalize the check with the proper verification of
the endpoint instead of hard-coded board type check.

Fixes: 7e5219d18e93 ("[media] go7007: Fix 2250 urb type")
Reported-and-tested-by: Josef Möllers <josef.moellers@suse.com>
BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1162583
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206427

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/go7007/go7007-usb.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
index 4857c467e76c..4490786936a0 100644
--- a/drivers/media/usb/go7007/go7007-usb.c
+++ b/drivers/media/usb/go7007/go7007-usb.c
@@ -1052,6 +1052,7 @@ static int go7007_usb_probe(struct usb_interface *intf,
 	struct go7007_usb *usb;
 	const struct go7007_usb_board *board;
 	struct usb_device *usbdev = interface_to_usbdev(intf);
+	struct usb_host_endpoint *ep;
 	unsigned num_i2c_devs;
 	char *name;
 	int video_pipe, i, v_urb_len;
@@ -1147,7 +1148,8 @@ static int go7007_usb_probe(struct usb_interface *intf,
 	if (usb->intr_urb->transfer_buffer == NULL)
 		goto allocfail;
 
-	if (go->board_id == GO7007_BOARDID_SENSORAY_2250)
+	ep = usb->usbdev->ep_in[4];
+	if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
 		usb_fill_bulk_urb(usb->intr_urb, usb->usbdev,
 			usb_rcvbulkpipe(usb->usbdev, 4),
 			usb->intr_urb->transfer_buffer, 2*sizeof(u16),

From 5a5d460216dd015f460db7ab7d23e916f39c1671 Mon Sep 17 00:00:00 2001
From: Alain Michaud <alainm@chromium.org>
Date: Tue, 3 Mar 2020 15:55:34 +0000
Subject: [PATCH 0661/2658] Bluetooth: guard against controllers sending zero'd
 events

[ Upstream commit 08bb4da90150e2a225f35e0f642cdc463958d696 ]

Some controllers have been observed to send zero'd events under some
conditions.  This change guards against this condition as well as adding
a trace to facilitate diagnosability of this condition.

Signed-off-by: Alain Michaud <alainm@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_event.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index a85e4e1a8d5a..3bc03280894d 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -5230,6 +5230,11 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
 	u8 status = 0, event = hdr->evt, req_evt = 0;
 	u16 opcode = HCI_OP_NOP;
 
+	if (!event) {
+		bt_dev_warn(hdev, "Received unexpected HCI Event 00000000");
+		goto done;
+	}
+
 	if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
 		struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
 		opcode = __le16_to_cpu(cmd_hdr->opcode);
@@ -5441,6 +5446,7 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
 		req_complete_skb(hdev, status, opcode, orig_skb);
 	}
 
+done:
 	kfree_skb(orig_skb);
 	kfree_skb(skb);
 	hdev->stat.evt_rx++;

From f58a73ef229fd8106881bc1191131893be155c7d Mon Sep 17 00:00:00 2001
From: John Clements <john.clements@amd.com>
Date: Thu, 5 Mar 2020 17:48:56 +0800
Subject: [PATCH 0662/2658] drm/amdgpu: increase atombios cmd timeout

[ Upstream commit 1b3460a8b19688ad3033b75237d40fa580a5a953 ]

mitigates race condition on BACO reset between GPU bootcode and driver reload

Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: John Clements <john.clements@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/atom.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c
index 1b50e6c13fb3..5fbf99d60058 100644
--- a/drivers/gpu/drm/amd/amdgpu/atom.c
+++ b/drivers/gpu/drm/amd/amdgpu/atom.c
@@ -748,8 +748,8 @@ static void atom_op_jump(atom_exec_context *ctx, int *ptr, int arg)
 			cjiffies = jiffies;
 			if (time_after(cjiffies, ctx->last_jump_jiffies)) {
 				cjiffies -= ctx->last_jump_jiffies;
-				if ((jiffies_to_msecs(cjiffies) > 5000)) {
-					DRM_ERROR("atombios stuck in loop for more than 5secs aborting\n");
+				if ((jiffies_to_msecs(cjiffies) > 10000)) {
+					DRM_ERROR("atombios stuck in loop for more than 10secs aborting\n");
 					ctx->abort = true;
 				}
 			} else {

From af4978399db20a162b9d5089e370f1a0f8fcc4cd Mon Sep 17 00:00:00 2001
From: Howard Chung <howardchung@google.com>
Date: Thu, 12 Mar 2020 12:35:27 +0800
Subject: [PATCH 0663/2658] Bluetooth: L2CAP: handle l2cap config request
 during open state

[ Upstream commit 96298f640104e4cd9a913a6e50b0b981829b94ff ]

According to Core Spec Version 5.2 | Vol 3, Part A 6.1.5,
the incoming L2CAP_ConfigReq should be handled during
OPEN state.

The section below shows the btmon trace when running
L2CAP/COS/CFD/BV-12-C before and after this change.

=== Before ===
...
> ACL Data RX: Handle 256 flags 0x02 dlen 12                #22
      L2CAP: Connection Request (0x02) ident 2 len 4
        PSM: 1 (0x0001)
        Source CID: 65
< ACL Data TX: Handle 256 flags 0x00 dlen 16                #23
      L2CAP: Connection Response (0x03) ident 2 len 8
        Destination CID: 64
        Source CID: 65
        Result: Connection successful (0x0000)
        Status: No further information available (0x0000)
< ACL Data TX: Handle 256 flags 0x00 dlen 12                #24
      L2CAP: Configure Request (0x04) ident 2 len 4
        Destination CID: 65
        Flags: 0x0000
> HCI Event: Number of Completed Packets (0x13) plen 5      #25
        Num handles: 1
        Handle: 256
        Count: 1
> HCI Event: Number of Completed Packets (0x13) plen 5      #26
        Num handles: 1
        Handle: 256
        Count: 1
> ACL Data RX: Handle 256 flags 0x02 dlen 16                #27
      L2CAP: Configure Request (0x04) ident 3 len 8
        Destination CID: 64
        Flags: 0x0000
        Option: Unknown (0x10) [hint]
        01 00                                            ..
< ACL Data TX: Handle 256 flags 0x00 dlen 18                #28
      L2CAP: Configure Response (0x05) ident 3 len 10
        Source CID: 65
        Flags: 0x0000
        Result: Success (0x0000)
        Option: Maximum Transmission Unit (0x01) [mandatory]
          MTU: 672
> HCI Event: Number of Completed Packets (0x13) plen 5      #29
        Num handles: 1
        Handle: 256
        Count: 1
> ACL Data RX: Handle 256 flags 0x02 dlen 14                #30
      L2CAP: Configure Response (0x05) ident 2 len 6
        Source CID: 64
        Flags: 0x0000
        Result: Success (0x0000)
> ACL Data RX: Handle 256 flags 0x02 dlen 20                #31
      L2CAP: Configure Request (0x04) ident 3 len 12
        Destination CID: 64
        Flags: 0x0000
        Option: Unknown (0x10) [hint]
        01 00 91 02 11 11                                ......
< ACL Data TX: Handle 256 flags 0x00 dlen 14                #32
      L2CAP: Command Reject (0x01) ident 3 len 6
        Reason: Invalid CID in request (0x0002)
        Destination CID: 64
        Source CID: 65
> HCI Event: Number of Completed Packets (0x13) plen 5      #33
        Num handles: 1
        Handle: 256
        Count: 1
...
=== After ===
...
> ACL Data RX: Handle 256 flags 0x02 dlen 12               #22
      L2CAP: Connection Request (0x02) ident 2 len 4
        PSM: 1 (0x0001)
        Source CID: 65
< ACL Data TX: Handle 256 flags 0x00 dlen 16               #23
      L2CAP: Connection Response (0x03) ident 2 len 8
        Destination CID: 64
        Source CID: 65
        Result: Connection successful (0x0000)
        Status: No further information available (0x0000)
< ACL Data TX: Handle 256 flags 0x00 dlen 12               #24
      L2CAP: Configure Request (0x04) ident 2 len 4
        Destination CID: 65
        Flags: 0x0000
> HCI Event: Number of Completed Packets (0x13) plen 5     #25
        Num handles: 1
        Handle: 256
        Count: 1
> HCI Event: Number of Completed Packets (0x13) plen 5     #26
        Num handles: 1
        Handle: 256
        Count: 1
> ACL Data RX: Handle 256 flags 0x02 dlen 16               #27
      L2CAP: Configure Request (0x04) ident 3 len 8
        Destination CID: 64
        Flags: 0x0000
        Option: Unknown (0x10) [hint]
        01 00                                            ..
< ACL Data TX: Handle 256 flags 0x00 dlen 18               #28
      L2CAP: Configure Response (0x05) ident 3 len 10
        Source CID: 65
        Flags: 0x0000
        Result: Success (0x0000)
        Option: Maximum Transmission Unit (0x01) [mandatory]
          MTU: 672
> HCI Event: Number of Completed Packets (0x13) plen 5     #29
        Num handles: 1
        Handle: 256
        Count: 1
> ACL Data RX: Handle 256 flags 0x02 dlen 14               #30
      L2CAP: Configure Response (0x05) ident 2 len 6
        Source CID: 64
        Flags: 0x0000
        Result: Success (0x0000)
> ACL Data RX: Handle 256 flags 0x02 dlen 20               #31
      L2CAP: Configure Request (0x04) ident 3 len 12
        Destination CID: 64
        Flags: 0x0000
        Option: Unknown (0x10) [hint]
        01 00 91 02 11 11                                .....
< ACL Data TX: Handle 256 flags 0x00 dlen 18               #32
      L2CAP: Configure Response (0x05) ident 3 len 10
        Source CID: 65
        Flags: 0x0000
        Result: Success (0x0000)
        Option: Maximum Transmission Unit (0x01) [mandatory]
          MTU: 672
< ACL Data TX: Handle 256 flags 0x00 dlen 12               #33
      L2CAP: Configure Request (0x04) ident 3 len 4
        Destination CID: 65
        Flags: 0x0000
> HCI Event: Number of Completed Packets (0x13) plen 5     #34
        Num handles: 1
        Handle: 256
        Count: 1
> HCI Event: Number of Completed Packets (0x13) plen 5     #35
        Num handles: 1
        Handle: 256
        Count: 1
...

Signed-off-by: Howard Chung <howardchung@google.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/l2cap_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 49070cc77f74..27bf8e591e28 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4096,7 +4096,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
 		return 0;
 	}
 
-	if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
+	if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 &&
+	    chan->state != BT_CONNECTED) {
 		cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
 				       chan->dcid);
 		goto unlock;

From ee6ea100f452a6dc783949116623114a78aa04b5 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Mon, 10 Feb 2020 15:26:46 +0100
Subject: [PATCH 0664/2658] media: tda10071: fix unsigned sign extension
 overflow

[ Upstream commit a7463e2dc698075132de9905b89f495df888bb79 ]

The shifting of buf[3] by 24 bits to the left will be promoted to
a 32 bit signed int and then sign-extended to an unsigned long. In
the unlikely event that the the top bit of buf[3] is set then all
then all the upper bits end up as also being set because of
the sign-extension and this affect the ev->post_bit_error sum.
Fix this by using the temporary u32 variable bit_error to avoid
the sign-extension promotion. This also removes the need to do the
computation twice.

Addresses-Coverity: ("Unintended sign extension")

Fixes: 267897a4708f ("[media] tda10071: implement DVBv5 statistics")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/dvb-frontends/tda10071.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/media/dvb-frontends/tda10071.c b/drivers/media/dvb-frontends/tda10071.c
index 119d47596ac8..b81887c4f72a 100644
--- a/drivers/media/dvb-frontends/tda10071.c
+++ b/drivers/media/dvb-frontends/tda10071.c
@@ -483,10 +483,11 @@ static int tda10071_read_status(struct dvb_frontend *fe, enum fe_status *status)
 			goto error;
 
 		if (dev->delivery_system == SYS_DVBS) {
-			dev->dvbv3_ber = buf[0] << 24 | buf[1] << 16 |
-					 buf[2] << 8 | buf[3] << 0;
-			dev->post_bit_error += buf[0] << 24 | buf[1] << 16 |
-					       buf[2] << 8 | buf[3] << 0;
+			u32 bit_error = buf[0] << 24 | buf[1] << 16 |
+					buf[2] << 8 | buf[3] << 0;
+
+			dev->dvbv3_ber = bit_error;
+			dev->post_bit_error += bit_error;
 			c->post_bit_error.stat[0].scale = FE_SCALE_COUNTER;
 			c->post_bit_error.stat[0].uvalue = dev->post_bit_error;
 			dev->block_error += buf[4] << 8 | buf[5] << 0;

From d896f1e9f8528e07e9c596adbb7a5841ad359e00 Mon Sep 17 00:00:00 2001
From: Stefan Berger <stefanb@linux.ibm.com>
Date: Thu, 12 Mar 2020 11:53:31 -0400
Subject: [PATCH 0665/2658] tpm: ibmvtpm: Wait for buffer to be set before
 proceeding

[ Upstream commit d8d74ea3c00214aee1e1826ca18e77944812b9b4 ]

Synchronize with the results from the CRQs before continuing with
the initialization. This avoids trying to send TPM commands while
the rtce buffer has not been allocated, yet.

This patch fixes an existing race condition that may occurr if the
hypervisor does not quickly respond to the VTPM_GET_RTCE_BUFFER_SIZE
request sent during initialization and therefore the ibmvtpm->rtce_buf
has not been allocated at the time the first TPM command is sent.

Fixes: 132f76294744 ("drivers/char/tpm: Add new device driver to support IBM vTPM")
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Acked-by: Nayna Jain <nayna@linux.ibm.com>
Tested-by: Nayna Jain <nayna@linux.ibm.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/tpm/tpm_ibmvtpm.c | 9 +++++++++
 drivers/char/tpm/tpm_ibmvtpm.h | 1 +
 2 files changed, 10 insertions(+)

diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
index 3e6a22658b63..d4cc1a1ac1f7 100644
--- a/drivers/char/tpm/tpm_ibmvtpm.c
+++ b/drivers/char/tpm/tpm_ibmvtpm.c
@@ -543,6 +543,7 @@ static irqreturn_t ibmvtpm_interrupt(int irq, void *vtpm_instance)
 	 */
 	while ((crq = ibmvtpm_crq_get_next(ibmvtpm)) != NULL) {
 		ibmvtpm_crq_process(crq, ibmvtpm);
+		wake_up_interruptible(&ibmvtpm->crq_queue.wq);
 		crq->valid = 0;
 		smp_wmb();
 	}
@@ -589,6 +590,7 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
 	}
 
 	crq_q->num_entry = CRQ_RES_BUF_SIZE / sizeof(*crq_q->crq_addr);
+	init_waitqueue_head(&crq_q->wq);
 	ibmvtpm->crq_dma_handle = dma_map_single(dev, crq_q->crq_addr,
 						 CRQ_RES_BUF_SIZE,
 						 DMA_BIDIRECTIONAL);
@@ -641,6 +643,13 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
 	if (rc)
 		goto init_irq_cleanup;
 
+	if (!wait_event_timeout(ibmvtpm->crq_queue.wq,
+				ibmvtpm->rtce_buf != NULL,
+				HZ)) {
+		dev_err(dev, "CRQ response timed out\n");
+		goto init_irq_cleanup;
+	}
+
 	return tpm_chip_register(chip);
 init_irq_cleanup:
 	do {
diff --git a/drivers/char/tpm/tpm_ibmvtpm.h b/drivers/char/tpm/tpm_ibmvtpm.h
index 6af92890518f..1a8c3b698f10 100644
--- a/drivers/char/tpm/tpm_ibmvtpm.h
+++ b/drivers/char/tpm/tpm_ibmvtpm.h
@@ -31,6 +31,7 @@ struct ibmvtpm_crq_queue {
 	struct ibmvtpm_crq *crq_addr;
 	u32 index;
 	u32 num_entry;
+	wait_queue_head_t wq;
 };
 
 struct ibmvtpm_dev {

From fd75aad8379c9d0e94694ba1e1b56f4ed59ca4ab Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <natechancellor@gmail.com>
Date: Wed, 19 Feb 2020 22:10:12 -0700
Subject: [PATCH 0666/2658] tracing: Use address-of operator on section symbols

[ Upstream commit bf2cbe044da275021b2de5917240411a19e5c50d ]

Clang warns:

../kernel/trace/trace.c:9335:33: warning: array comparison always
evaluates to true [-Wtautological-compare]
        if (__stop___trace_bprintk_fmt != __start___trace_bprintk_fmt)
                                       ^
1 warning generated.

These are not true arrays, they are linker defined symbols, which are
just addresses. Using the address of operator silences the warning and
does not change the runtime result of the check (tested with some print
statements compiled in with clang + ld.lld and gcc + ld.bfd in QEMU).

Link: http://lkml.kernel.org/r/20200220051011.26113-1-natechancellor@gmail.com

Link: https://github.com/ClangBuiltLinux/linux/issues/893
Suggested-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/trace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 120f16d3e231..18f7913a4ef1 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -7427,7 +7427,7 @@ __init static int tracer_alloc_buffers(void)
 		goto out_free_buffer_mask;
 
 	/* Only allocate trace_printk buffers if a trace_printk exists */
-	if (__stop___trace_bprintk_fmt != __start___trace_bprintk_fmt)
+	if (&__stop___trace_bprintk_fmt != &__start___trace_bprintk_fmt)
 		/* Must be called before global_trace.buffer is allocated */
 		trace_printk_init_buffers();
 

From a43348a2f5d6a99f7b271dce16ef67d0dbccabc9 Mon Sep 17 00:00:00 2001
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
Date: Fri, 20 Mar 2020 14:52:00 +0200
Subject: [PATCH 0667/2658] serial: 8250_omap: Fix sleeping function called
 from invalid context during probe

[ Upstream commit 4ce35a3617c0ac758c61122b2218b6c8c9ac9398 ]

When booting j721e the following bug is printed:

[    1.154821] BUG: sleeping function called from invalid context at kernel/sched/completion.c:99
[    1.154827] in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 12, name: kworker/0:1
[    1.154832] 3 locks held by kworker/0:1/12:
[    1.154836]  #0: ffff000840030728 ((wq_completion)events){+.+.}, at: process_one_work+0x1d4/0x6e8
[    1.154852]  #1: ffff80001214fdd8 (deferred_probe_work){+.+.}, at: process_one_work+0x1d4/0x6e8
[    1.154860]  #2: ffff00084060b170 (&dev->mutex){....}, at: __device_attach+0x38/0x138
[    1.154872] irq event stamp: 63096
[    1.154881] hardirqs last  enabled at (63095): [<ffff800010b74318>] _raw_spin_unlock_irqrestore+0x70/0x78
[    1.154887] hardirqs last disabled at (63096): [<ffff800010b740d8>] _raw_spin_lock_irqsave+0x28/0x80
[    1.154893] softirqs last  enabled at (62254): [<ffff800010080c88>] _stext+0x488/0x564
[    1.154899] softirqs last disabled at (62247): [<ffff8000100fdb3c>] irq_exit+0x114/0x140
[    1.154906] CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.6.0-rc6-next-20200318-00094-g45e4089b0bd3 #221
[    1.154911] Hardware name: Texas Instruments K3 J721E SoC (DT)
[    1.154917] Workqueue: events deferred_probe_work_func
[    1.154923] Call trace:
[    1.154928]  dump_backtrace+0x0/0x190
[    1.154933]  show_stack+0x14/0x20
[    1.154940]  dump_stack+0xe0/0x148
[    1.154946]  ___might_sleep+0x150/0x1f0
[    1.154952]  __might_sleep+0x4c/0x80
[    1.154957]  wait_for_completion_timeout+0x40/0x140
[    1.154964]  ti_sci_set_device_state+0xa0/0x158
[    1.154969]  ti_sci_cmd_get_device_exclusive+0x14/0x20
[    1.154977]  ti_sci_dev_start+0x34/0x50
[    1.154984]  genpd_runtime_resume+0x78/0x1f8
[    1.154991]  __rpm_callback+0x3c/0x140
[    1.154996]  rpm_callback+0x20/0x80
[    1.155001]  rpm_resume+0x568/0x758
[    1.155007]  __pm_runtime_resume+0x44/0xb0
[    1.155013]  omap8250_probe+0x2b4/0x508
[    1.155019]  platform_drv_probe+0x50/0xa0
[    1.155023]  really_probe+0xd4/0x318
[    1.155028]  driver_probe_device+0x54/0xe8
[    1.155033]  __device_attach_driver+0x80/0xb8
[    1.155039]  bus_for_each_drv+0x74/0xc0
[    1.155044]  __device_attach+0xdc/0x138
[    1.155049]  device_initial_probe+0x10/0x18
[    1.155053]  bus_probe_device+0x98/0xa0
[    1.155058]  deferred_probe_work_func+0x74/0xb0
[    1.155063]  process_one_work+0x280/0x6e8
[    1.155068]  worker_thread+0x48/0x430
[    1.155073]  kthread+0x108/0x138
[    1.155079]  ret_from_fork+0x10/0x18

To fix the bug we need to first call pm_runtime_enable() prior to any
pm_runtime calls.

Reported-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Link: https://lore.kernel.org/r/20200320125200.6772-1-peter.ujfalusi@ti.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/8250/8250_omap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index c4383573cf66..0377b35d62b8 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -1188,11 +1188,11 @@ static int omap8250_probe(struct platform_device *pdev)
 	spin_lock_init(&priv->rx_dma_lock);
 
 	device_init_wakeup(&pdev->dev, true);
+	pm_runtime_enable(&pdev->dev);
 	pm_runtime_use_autosuspend(&pdev->dev);
 	pm_runtime_set_autosuspend_delay(&pdev->dev, -1);
 
 	pm_runtime_irq_safe(&pdev->dev);
-	pm_runtime_enable(&pdev->dev);
 
 	pm_runtime_get_sync(&pdev->dev);
 

From 32affe9bdd6a70a5d9ee2b8831d3a87852428662 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Fri, 27 Mar 2020 17:15:39 +0100
Subject: [PATCH 0668/2658] SUNRPC: Fix a potential buffer overflow in
 'svc_print_xprts()'

[ Upstream commit b25b60d7bfb02a74bc3c2d998e09aab159df8059 ]

'maxlen' is the total size of the destination buffer. There is only one
caller and this value is 256.

When we compute the size already used and what we would like to add in
the buffer, the trailling NULL character is not taken into account.
However, this trailling character will be added by the 'strcat' once we
have checked that we have enough place.

So, there is a off-by-one issue and 1 byte of the stack could be
erroneously overwridden.

Take into account the trailling NULL, when checking if there is enough
place in the destination buffer.

While at it, also replace a 'sprintf' by a safer 'snprintf', check for
output truncation and avoid a superfluous 'strlen'.

Fixes: dc9a16e49dbba ("svc: Add /proc/sys/sunrpc/transport files")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ cel: very minor fix to documenting comment
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/svc_xprt.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 2b8e80c721db..a7cd03165680 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -97,8 +97,17 @@ void svc_unreg_xprt_class(struct svc_xprt_class *xcl)
 }
 EXPORT_SYMBOL_GPL(svc_unreg_xprt_class);
 
-/*
- * Format the transport list for printing
+/**
+ * svc_print_xprts - Format the transport list for printing
+ * @buf: target buffer for formatted address
+ * @maxlen: length of target buffer
+ *
+ * Fills in @buf with a string containing a list of transport names, each name
+ * terminated with '\n'. If the buffer is too small, some entries may be
+ * missing, but it is guaranteed that all lines in the output buffer are
+ * complete.
+ *
+ * Returns positive length of the filled-in string.
  */
 int svc_print_xprts(char *buf, int maxlen)
 {
@@ -111,9 +120,9 @@ int svc_print_xprts(char *buf, int maxlen)
 	list_for_each_entry(xcl, &svc_xprt_class_list, xcl_list) {
 		int slen;
 
-		sprintf(tmpstr, "%s %d\n", xcl->xcl_name, xcl->xcl_max_payload);
-		slen = strlen(tmpstr);
-		if (len + slen > maxlen)
+		slen = snprintf(tmpstr, sizeof(tmpstr), "%s %d\n",
+				xcl->xcl_name, xcl->xcl_max_payload);
+		if (slen >= sizeof(tmpstr) || len + slen >= maxlen)
 			break;
 		len += slen;
 		strcat(buf, tmpstr);

From 682930149e510bc95a5e767e8f1e18066b022914 Mon Sep 17 00:00:00 2001
From: Liu Song <liu.song11@zte.com.cn>
Date: Thu, 16 Jan 2020 23:36:07 +0800
Subject: [PATCH 0669/2658] ubifs: Fix out-of-bounds memory access caused by
 abnormal value of node_len
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit acc5af3efa303d5f36cc8c0f61716161f6ca1384 ]

In “ubifs_check_node”, when the value of "node_len" is abnormal,
the code will goto label of "out_len" for execution. Then, in the
following "ubifs_dump_node", if inode type is "UBIFS_DATA_NODE",
in "print_hex_dump", an out-of-bounds access may occur due to the
wrong "ch->len".

Therefore, when the value of "node_len" is abnormal, data length
should to be adjusted to a reasonable safe range. At this time,
structured data is not credible, so dump the corrupted data directly
for analysis.

Signed-off-by: Liu Song <liu.song11@zte.com.cn>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ubifs/io.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
index 97be41215332..9213a9e046ae 100644
--- a/fs/ubifs/io.c
+++ b/fs/ubifs/io.c
@@ -237,7 +237,7 @@ int ubifs_is_mapped(const struct ubifs_info *c, int lnum)
 int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
 		     int offs, int quiet, int must_chk_crc)
 {
-	int err = -EINVAL, type, node_len;
+	int err = -EINVAL, type, node_len, dump_node = 1;
 	uint32_t crc, node_crc, magic;
 	const struct ubifs_ch *ch = buf;
 
@@ -290,10 +290,22 @@ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
 out_len:
 	if (!quiet)
 		ubifs_err(c, "bad node length %d", node_len);
+	if (type == UBIFS_DATA_NODE && node_len > UBIFS_DATA_NODE_SZ)
+		dump_node = 0;
 out:
 	if (!quiet) {
 		ubifs_err(c, "bad node at LEB %d:%d", lnum, offs);
-		ubifs_dump_node(c, buf);
+		if (dump_node) {
+			ubifs_dump_node(c, buf);
+		} else {
+			int safe_len = min3(node_len, c->leb_size - offs,
+				(int)UBIFS_MAX_DATA_NODE_SZ);
+			pr_err("\tprevent out-of-bounds memory access\n");
+			pr_err("\ttruncated data node length      %d\n", safe_len);
+			pr_err("\tcorrupted data node:\n");
+			print_hex_dump(KERN_ERR, "\t", DUMP_PREFIX_OFFSET, 32, 1,
+					buf, safe_len, 0);
+		}
 		dump_stack();
 	}
 	return err;

From 4420034c46c19a7d35da6f90c914218cd9cc6f97 Mon Sep 17 00:00:00 2001
From: Andreas Steinmetz <ast@domdv.de>
Date: Tue, 31 Mar 2020 14:25:54 +0200
Subject: [PATCH 0670/2658] ALSA: usb-audio: Fix case when USB MIDI interface
 has more than one extra endpoint descriptor

[ Upstream commit 5c6cd7021a05a02fcf37f360592d7c18d4d807fb ]

The Miditech MIDIFACE 16x16 (USB ID 1290:1749) has more than one extra
endpoint descriptor.

The first extra descriptor is: 0x06 0x30 0x00 0x00 0x00 0x00

As the code in snd_usbmidi_get_ms_info() looks only at the
first extra descriptor to find USB_DT_CS_ENDPOINT the device
as such is recognized but there is neither input nor output
configured.

The patch iterates through the extra descriptors to find the
proper one. With this patch the device is correctly configured.

Signed-off-by: Andreas Steinmetz <ast@domdv.de>
Link: https://lore.kernel.org/r/1c3b431a86f69e1d60745b6110cdb93c299f120b.camel@domdv.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/midi.c | 29 ++++++++++++++++++++++++-----
 1 file changed, 24 insertions(+), 5 deletions(-)

diff --git a/sound/usb/midi.c b/sound/usb/midi.c
index 5c4a3d6c4234..934540042bc2 100644
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -1803,6 +1803,28 @@ static int snd_usbmidi_create_endpoints(struct snd_usb_midi *umidi,
 	return 0;
 }
 
+static struct usb_ms_endpoint_descriptor *find_usb_ms_endpoint_descriptor(
+					struct usb_host_endpoint *hostep)
+{
+	unsigned char *extra = hostep->extra;
+	int extralen = hostep->extralen;
+
+	while (extralen > 3) {
+		struct usb_ms_endpoint_descriptor *ms_ep =
+				(struct usb_ms_endpoint_descriptor *)extra;
+
+		if (ms_ep->bLength > 3 &&
+		    ms_ep->bDescriptorType == USB_DT_CS_ENDPOINT &&
+		    ms_ep->bDescriptorSubtype == UAC_MS_GENERAL)
+			return ms_ep;
+		if (!extra[0])
+			break;
+		extralen -= extra[0];
+		extra += extra[0];
+	}
+	return NULL;
+}
+
 /*
  * Returns MIDIStreaming device capabilities.
  */
@@ -1840,11 +1862,8 @@ static int snd_usbmidi_get_ms_info(struct snd_usb_midi *umidi,
 		ep = get_ep_desc(hostep);
 		if (!usb_endpoint_xfer_bulk(ep) && !usb_endpoint_xfer_int(ep))
 			continue;
-		ms_ep = (struct usb_ms_endpoint_descriptor *)hostep->extra;
-		if (hostep->extralen < 4 ||
-		    ms_ep->bLength < 4 ||
-		    ms_ep->bDescriptorType != USB_DT_CS_ENDPOINT ||
-		    ms_ep->bDescriptorSubtype != UAC_MS_GENERAL)
+		ms_ep = find_usb_ms_endpoint_descriptor(hostep);
+		if (!ms_ep)
 			continue;
 		if (usb_endpoint_dir_out(ep)) {
 			if (endpoints[epidx].out_ep) {

From e1dc39bd8edc2b00e12e690227fa516443379c7c Mon Sep 17 00:00:00 2001
From: Xianting Tian <xianting_tian@126.com>
Date: Wed, 1 Apr 2020 21:04:47 -0700
Subject: [PATCH 0671/2658] mm/filemap.c: clear page error before actual read

[ Upstream commit faffdfa04fa11ccf048cebdde73db41ede0679e0 ]

Mount failure issue happens under the scenario: Application forked dozens
of threads to mount the same number of cramfs images separately in docker,
but several mounts failed with high probability.  Mount failed due to the
checking result of the page(read from the superblock of loop dev) is not
uptodate after wait_on_page_locked(page) returned in function cramfs_read:

   wait_on_page_locked(page);
   if (!PageUptodate(page)) {
      ...
   }

The reason of the checking result of the page not uptodate: systemd-udevd
read the loopX dev before mount, because the status of loopX is Lo_unbound
at this time, so loop_make_request directly trigger the calling of io_end
handler end_buffer_async_read, which called SetPageError(page).  So It
caused the page can't be set to uptodate in function
end_buffer_async_read:

   if(page_uptodate && !PageError(page)) {
      SetPageUptodate(page);
   }

Then mount operation is performed, it used the same page which is just
accessed by systemd-udevd above, Because this page is not uptodate, it
will launch a actual read via submit_bh, then wait on this page by calling
wait_on_page_locked(page).  When the I/O of the page done, io_end handler
end_buffer_async_read is called, because no one cleared the page
error(during the whole read path of mount), which is caused by
systemd-udevd reading, so this page is still in "PageError" status, which
can't be set to uptodate in function end_buffer_async_read, then caused
mount failure.

But sometimes mount succeed even through systemd-udeved read loopX dev
just before, The reason is systemd-udevd launched other loopX read just
between step 3.1 and 3.2, the steps as below:

1, loopX dev default status is Lo_unbound;
2, systemd-udved read loopX dev (page is set to PageError);
3, mount operation
   1) set loopX status to Lo_bound;
   ==>systemd-udevd read loopX dev<==
   2) read loopX dev(page has no error)
   3) mount succeed

As the loopX dev status is set to Lo_bound after step 3.1, so the other
loopX dev read by systemd-udevd will go through the whole I/O stack, part
of the call trace as below:

   SYS_read
      vfs_read
          do_sync_read
              blkdev_aio_read
                 generic_file_aio_read
                     do_generic_file_read:
                        ClearPageError(page);
                        mapping->a_ops->readpage(filp, page);

here, mapping->a_ops->readpage() is blkdev_readpage.  In latest kernel,
some function name changed, the call trace as below:

   blkdev_read_iter
      generic_file_read_iter
         generic_file_buffered_read:
            /*
             * A previous I/O error may have been due to temporary
             * failures, eg. mutipath errors.
             * Pg_error will be set again if readpage fails.
             */
            ClearPageError(page);
            /* Start the actual read. The read will unlock the page*/
            error=mapping->a_ops->readpage(flip, page);

We can see ClearPageError(page) is called before the actual read,
then the read in step 3.2 succeed.

This patch is to add the calling of ClearPageError just before the actual
read of read path of cramfs mount.  Without the patch, the call trace as
below when performing cramfs mount:

   do_mount
      cramfs_read
         cramfs_blkdev_read
            read_cache_page
               do_read_cache_page:
                  filler(data, page);
                  or
                  mapping->a_ops->readpage(data, page);

With the patch, the call trace as below when performing mount:

   do_mount
      cramfs_read
         cramfs_blkdev_read
            read_cache_page:
               do_read_cache_page:
                  ClearPageError(page); <== new add
                  filler(data, page);
                  or
                  mapping->a_ops->readpage(data, page);

With the patch, mount operation trigger the calling of
ClearPageError(page) before the actual read, the page has no error if no
additional page error happen when I/O done.

Signed-off-by: Xianting Tian <xianting_tian@126.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Jan Kara <jack@suse.cz>
Cc: <yubin@h3c.com>
Link: http://lkml.kernel.org/r/1583318844-22971-1-git-send-email-xianting_tian@126.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/filemap.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/mm/filemap.c b/mm/filemap.c
index 314e050e74a3..1c0f5051e7e6 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2315,6 +2315,14 @@ static struct page *do_read_cache_page(struct address_space *mapping,
 		unlock_page(page);
 		goto out;
 	}
+
+	/*
+	 * A previous I/O error may have been due to temporary
+	 * failures.
+	 * Clear page error before actual read, PG_error will be
+	 * set again if read page fails.
+	 */
+	ClearPageError(page);
 	goto filler;
 
 out:

From 35b8cd9d653ba2a6b1dac294f8a6523d08b51e85 Mon Sep 17 00:00:00 2001
From: Jaewon Kim <jaewon31.kim@samsung.com>
Date: Fri, 10 Apr 2020 14:32:48 -0700
Subject: [PATCH 0672/2658] mm/mmap.c: initialize align_offset explicitly for
 vm_unmapped_area

[ Upstream commit 09ef5283fd96ac424ef0e569626f359bf9ab86c9 ]

On passing requirement to vm_unmapped_area, arch_get_unmapped_area and
arch_get_unmapped_area_topdown did not set align_offset.  Internally on
both unmapped_area and unmapped_area_topdown, if info->align_mask is 0,
then info->align_offset was meaningless.

But commit df529cabb7a2 ("mm: mmap: add trace point of
vm_unmapped_area") always prints info->align_offset even though it is
uninitialized.

Fix this uninitialized value issue by setting it to 0 explicitly.

Before:
  vm_unmapped_area: addr=0x755b155000 err=0 total_vm=0x15aaf0 flags=0x1 len=0x109000 lo=0x8000 hi=0x75eed48000 mask=0x0 ofs=0x4022

After:
  vm_unmapped_area: addr=0x74a4ca1000 err=0 total_vm=0x168ab1 flags=0x1 len=0x9000 lo=0x8000 hi=0x753d94b000 mask=0x0 ofs=0x0

Signed-off-by: Jaewon Kim <jaewon31.kim@samsung.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Michel Lespinasse <walken@google.com>
Cc: Borislav Petkov <bp@suse.de>
Link: http://lkml.kernel.org/r/20200409094035.19457-1-jaewon31.kim@samsung.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/mmap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mm/mmap.c b/mm/mmap.c
index 9704dba5ee30..506382007e26 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2023,6 +2023,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
 	info.low_limit = mm->mmap_base;
 	info.high_limit = TASK_SIZE;
 	info.align_mask = 0;
+	info.align_offset = 0;
 	return vm_unmapped_area(&info);
 }
 #endif
@@ -2064,6 +2065,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
 	info.low_limit = max(PAGE_SIZE, mmap_min_addr);
 	info.high_limit = mm->mmap_base;
 	info.align_mask = 0;
+	info.align_offset = 0;
 	addr = vm_unmapped_area(&info);
 
 	/*

From 9e864f9d7c1ef2f0f0143ff6ca3e3d3f0db2d476 Mon Sep 17 00:00:00 2001
From: Steve Rutherford <srutherford@google.com>
Date: Thu, 16 Apr 2020 12:11:52 -0700
Subject: [PATCH 0673/2658] KVM: Remove CREATE_IRQCHIP/SET_PIT2 race

[ Upstream commit 7289fdb5dcdbc5155b5531529c44105868a762f2 ]

Fixes a NULL pointer dereference, caused by the PIT firing an interrupt
before the interrupt table has been initialized.

SET_PIT2 can race with the creation of the IRQchip. In particular,
if SET_PIT2 is called with a low PIT timer period (after the creation of
the IOAPIC, but before the instantiation of the irq routes), the PIT can
fire an interrupt at an uninitialized table.

Signed-off-by: Steve Rutherford <srutherford@google.com>
Signed-off-by: Jon Cargille <jcargill@google.com>
Reviewed-by: Jim Mattson <jmattson@google.com>
Message-Id: <20200416191152.259434-1-jcargill@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kvm/x86.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 1bca988136fb..07461699953b 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -4013,10 +4013,13 @@ long kvm_arch_vm_ioctl(struct file *filp,
 		r = -EFAULT;
 		if (copy_from_user(&u.ps, argp, sizeof u.ps))
 			goto out;
+		mutex_lock(&kvm->lock);
 		r = -ENXIO;
 		if (!kvm->arch.vpit)
-			goto out;
+			goto set_pit_out;
 		r = kvm_vm_ioctl_set_pit(kvm, &u.ps);
+set_pit_out:
+		mutex_unlock(&kvm->lock);
 		break;
 	}
 	case KVM_GET_PIT2: {
@@ -4036,10 +4039,13 @@ long kvm_arch_vm_ioctl(struct file *filp,
 		r = -EFAULT;
 		if (copy_from_user(&u.ps2, argp, sizeof(u.ps2)))
 			goto out;
+		mutex_lock(&kvm->lock);
 		r = -ENXIO;
 		if (!kvm->arch.vpit)
-			goto out;
+			goto set_pit2_out;
 		r = kvm_vm_ioctl_set_pit2(kvm, &u.ps2);
+set_pit2_out:
+		mutex_unlock(&kvm->lock);
 		break;
 	}
 	case KVM_REINJECT_CONTROL: {

From 79a3e35ae04bf498da5c8e23f37ae8c3c4b9e71a Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Tue, 24 Mar 2020 14:48:27 -0700
Subject: [PATCH 0674/2658] bdev: Reduce time holding bd_mutex in sync in
 blkdev_close()

[ Upstream commit b849dd84b6ccfe32622988b79b7b073861fcf9f7 ]

While trying to "dd" to the block device for a USB stick, I
encountered a hung task warning (blocked for > 120 seconds).  I
managed to come up with an easy way to reproduce this on my system
(where /dev/sdb is the block device for my USB stick) with:

  while true; do dd if=/dev/zero of=/dev/sdb bs=4M; done

With my reproduction here are the relevant bits from the hung task
detector:

 INFO: task udevd:294 blocked for more than 122 seconds.
 ...
 udevd           D    0   294      1 0x00400008
 Call trace:
  ...
  mutex_lock_nested+0x40/0x50
  __blkdev_get+0x7c/0x3d4
  blkdev_get+0x118/0x138
  blkdev_open+0x94/0xa8
  do_dentry_open+0x268/0x3a0
  vfs_open+0x34/0x40
  path_openat+0x39c/0xdf4
  do_filp_open+0x90/0x10c
  do_sys_open+0x150/0x3c8
  ...

 ...
 Showing all locks held in the system:
 ...
 1 lock held by dd/2798:
  #0: ffffff814ac1a3b8 (&bdev->bd_mutex){+.+.}, at: __blkdev_put+0x50/0x204
 ...
 dd              D    0  2798   2764 0x00400208
 Call trace:
  ...
  schedule+0x8c/0xbc
  io_schedule+0x1c/0x40
  wait_on_page_bit_common+0x238/0x338
  __lock_page+0x5c/0x68
  write_cache_pages+0x194/0x500
  generic_writepages+0x64/0xa4
  blkdev_writepages+0x24/0x30
  do_writepages+0x48/0xa8
  __filemap_fdatawrite_range+0xac/0xd8
  filemap_write_and_wait+0x30/0x84
  __blkdev_put+0x88/0x204
  blkdev_put+0xc4/0xe4
  blkdev_close+0x28/0x38
  __fput+0xe0/0x238
  ____fput+0x1c/0x28
  task_work_run+0xb0/0xe4
  do_notify_resume+0xfc0/0x14bc
  work_pending+0x8/0x14

The problem appears related to the fact that my USB disk is terribly
slow and that I have a lot of RAM in my system to cache things.
Specifically my writes seem to be happening at ~15 MB/s and I've got
~4 GB of RAM in my system that can be used for buffering.  To write 4
GB of buffer to disk thus takes ~4000 MB / ~15 MB/s = ~267 seconds.

The 267 second number is a problem because in __blkdev_put() we call
sync_blockdev() while holding the bd_mutex.  Any other callers who
want the bd_mutex will be blocked for the whole time.

The problem is made worse because I believe blkdev_put() specifically
tells other tasks (namely udev) to go try to access the device at right
around the same time we're going to hold the mutex for a long time.

Putting some traces around this (after disabling the hung task detector),
I could confirm:
 dd:    437.608600: __blkdev_put() right before sync_blockdev() for sdb
 udevd: 437.623901: blkdev_open() right before blkdev_get() for sdb
 dd:    661.468451: __blkdev_put() right after sync_blockdev() for sdb
 udevd: 663.820426: blkdev_open() right after blkdev_get() for sdb

A simple fix for this is to realize that sync_blockdev() works fine if
you're not holding the mutex.  Also, it's not the end of the world if
you sync a little early (though it can have performance impacts).
Thus we can make a guess that we're going to need to do the sync and
then do it without holding the mutex.  We still do one last sync with
the mutex but it should be much, much faster.

With this, my hung task warnings for my test case are gone.

Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/block_dev.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/fs/block_dev.c b/fs/block_dev.c
index b2ebfd96785b..a71d442ef7d0 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1515,6 +1515,16 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part)
 	struct gendisk *disk = bdev->bd_disk;
 	struct block_device *victim = NULL;
 
+	/*
+	 * Sync early if it looks like we're the last one.  If someone else
+	 * opens the block device between now and the decrement of bd_openers
+	 * then we did a sync that we didn't need to, but that's not the end
+	 * of the world and we want to avoid long (could be several minute)
+	 * syncs while holding the mutex.
+	 */
+	if (bdev->bd_openers == 1)
+		sync_blockdev(bdev);
+
 	mutex_lock_nested(&bdev->bd_mutex, for_part);
 	if (for_part)
 		bdev->bd_part_count--;

From 43d5a82532475b657c7d4fa1edb02d2d7f9d49a7 Mon Sep 17 00:00:00 2001
From: Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
Date: Fri, 17 Apr 2020 21:04:51 +0530
Subject: [PATCH 0675/2658] drivers: char: tlclk.c: Avoid data race between
 init and interrupt handler

[ Upstream commit 44b8fb6eaa7c3fb770bf1e37619cdb3902cca1fc ]

After registering character device the file operation callbacks can be
called. The open callback registers interrupt handler.
Therefore interrupt handler can execute in parallel with rest of the init
function. To avoid such data race initialize telclk_interrupt variable
and struct alarm_events before registering character device.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
Link: https://lore.kernel.org/r/20200417153451.1551-1-madhuparnabhowmik10@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/tlclk.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
index 100cd1de9939..59e1e94d12c0 100644
--- a/drivers/char/tlclk.c
+++ b/drivers/char/tlclk.c
@@ -777,17 +777,21 @@ static int __init tlclk_init(void)
 {
 	int ret;
 
+	telclk_interrupt = (inb(TLCLK_REG7) & 0x0f);
+
+	alarm_events = kzalloc( sizeof(struct tlclk_alarms), GFP_KERNEL);
+	if (!alarm_events) {
+		ret = -ENOMEM;
+		goto out1;
+	}
+
 	ret = register_chrdev(tlclk_major, "telco_clock", &tlclk_fops);
 	if (ret < 0) {
 		printk(KERN_ERR "tlclk: can't get major %d.\n", tlclk_major);
+		kfree(alarm_events);
 		return ret;
 	}
 	tlclk_major = ret;
-	alarm_events = kzalloc( sizeof(struct tlclk_alarms), GFP_KERNEL);
-	if (!alarm_events) {
-		ret = -ENOMEM;
-		goto out1;
-	}
 
 	/* Read telecom clock IRQ number (Set by BIOS) */
 	if (!request_region(TLCLK_BASE, 8, "telco_clock")) {
@@ -796,7 +800,6 @@ static int __init tlclk_init(void)
 		ret = -EBUSY;
 		goto out2;
 	}
-	telclk_interrupt = (inb(TLCLK_REG7) & 0x0f);
 
 	if (0x0F == telclk_interrupt ) { /* not MCPBL0010 ? */
 		printk(KERN_ERR "telclk_interrupt = 0x%x non-mcpbl0010 hw.\n",
@@ -837,8 +840,8 @@ static int __init tlclk_init(void)
 	release_region(TLCLK_BASE, 8);
 out2:
 	kfree(alarm_events);
-out1:
 	unregister_chrdev(tlclk_major, "telco_clock");
+out1:
 	return ret;
 }
 

From 261b22909de681404d9b7c580f76e7c4344a535b Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Fri, 1 May 2020 15:35:34 +0200
Subject: [PATCH 0676/2658] dt-bindings: sound: wm8994: Correct required
 supplies based on actual implementaion

[ Upstream commit 8c149b7d75e53be47648742f40fc90d9fc6fa63a ]

The required supplies in bindings were actually not matching
implementation making the bindings incorrect and misleading.  The Linux
kernel driver requires all supplies to be present.  Also for wlf,wm8994
uses just DBVDD-supply instead of DBVDDn-supply (n: <1,3>).

Reported-by: Jonathan Bakker <xc-racer2@live.ca>
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20200501133534.6706-1-krzk@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../devicetree/bindings/sound/wm8994.txt       | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/Documentation/devicetree/bindings/sound/wm8994.txt b/Documentation/devicetree/bindings/sound/wm8994.txt
index e045e90a0924..0f03b8228d08 100644
--- a/Documentation/devicetree/bindings/sound/wm8994.txt
+++ b/Documentation/devicetree/bindings/sound/wm8994.txt
@@ -14,9 +14,15 @@ Required properties:
   - #gpio-cells : Must be 2. The first cell is the pin number and the
     second cell is used to specify optional parameters (currently unused).
 
-  - AVDD2-supply, DBVDD1-supply, DBVDD2-supply, DBVDD3-supply, CPVDD-supply,
-    SPKVDD1-supply, SPKVDD2-supply : power supplies for the device, as covered
-    in Documentation/devicetree/bindings/regulator/regulator.txt
+  - power supplies for the device, as covered in
+    Documentation/devicetree/bindings/regulator/regulator.txt, depending
+    on compatible:
+    - for wlf,wm1811 and wlf,wm8958:
+      AVDD1-supply, AVDD2-supply, DBVDD1-supply, DBVDD2-supply, DBVDD3-supply,
+      DCVDD-supply, CPVDD-supply, SPKVDD1-supply, SPKVDD2-supply
+    - for wlf,wm8994:
+      AVDD1-supply, AVDD2-supply, DBVDD-supply, DCVDD-supply, CPVDD-supply,
+      SPKVDD1-supply, SPKVDD2-supply
 
 Optional properties:
 
@@ -68,11 +74,11 @@ codec: wm8994@1a {
 
 	lineout1-se;
 
+	AVDD1-supply = <&regulator>;
 	AVDD2-supply = <&regulator>;
 	CPVDD-supply = <&regulator>;
-	DBVDD1-supply = <&regulator>;
-	DBVDD2-supply = <&regulator>;
-	DBVDD3-supply = <&regulator>;
+	DBVDD-supply = <&regulator>;
+	DCVDD-supply = <&regulator>;
 	SPKVDD1-supply = <&regulator>;
 	SPKVDD2-supply = <&regulator>;
 };

From 93d1bfd6e96040b02480a3bfec1a405b20e7bf53 Mon Sep 17 00:00:00 2001
From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Fri, 1 May 2020 11:11:09 -0700
Subject: [PATCH 0677/2658] atm: fix a memory leak of vcc->user_back

[ Upstream commit 8d9f73c0ad2f20e9fed5380de0a3097825859d03 ]

In lec_arp_clear_vccs() only entry->vcc is freed, but vcc
could be installed on entry->recv_vcc too in lec_vcc_added().

This fixes the following memory leak:

unreferenced object 0xffff8880d9266b90 (size 16):
  comm "atm2", pid 425, jiffies 4294907980 (age 23.488s)
  hex dump (first 16 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 6b 6b 6b a5  ............kkk.
  backtrace:
    [<(____ptrval____)>] kmem_cache_alloc_trace+0x10e/0x151
    [<(____ptrval____)>] lane_ioctl+0x4b3/0x569
    [<(____ptrval____)>] do_vcc_ioctl+0x1ea/0x236
    [<(____ptrval____)>] svc_ioctl+0x17d/0x198
    [<(____ptrval____)>] sock_do_ioctl+0x47/0x12f
    [<(____ptrval____)>] sock_ioctl+0x2f9/0x322
    [<(____ptrval____)>] vfs_ioctl+0x1e/0x2b
    [<(____ptrval____)>] ksys_ioctl+0x61/0x80
    [<(____ptrval____)>] __x64_sys_ioctl+0x16/0x19
    [<(____ptrval____)>] do_syscall_64+0x57/0x65
    [<(____ptrval____)>] entry_SYSCALL_64_after_hwframe+0x49/0xb3

Cc: Gengming Liu <l.dmxcsnsbh@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/atm/lec.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/atm/lec.c b/net/atm/lec.c
index e4afac94ff15..a38680e19443 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -1290,6 +1290,12 @@ static void lec_arp_clear_vccs(struct lec_arp_table *entry)
 		entry->vcc = NULL;
 	}
 	if (entry->recv_vcc) {
+		struct atm_vcc *vcc = entry->recv_vcc;
+		struct lec_vcc_priv *vpriv = LEC_VCC_PRIV(vcc);
+
+		kfree(vpriv);
+		vcc->user_back = NULL;
+
 		entry->recv_vcc->push = entry->old_recv_push;
 		vcc_release_async(entry->recv_vcc, -EPIPE);
 		entry->recv_vcc = NULL;

From 28058618fa553089f9953762e079d51b354c2096 Mon Sep 17 00:00:00 2001
From: Jonathan Bakker <xc-racer2@live.ca>
Date: Sat, 25 Apr 2020 10:36:33 -0700
Subject: [PATCH 0678/2658] phy: samsung: s5pv210-usb2: Add delay after reset

[ Upstream commit 05942b8c36c7eb5d3fc5e375d4b0d0c49562e85d ]

The USB phy takes some time to reset, so make sure we give it to it. The
delay length was taken from the 4x12 phy driver.

This manifested in issues with the DWC2 driver since commit fe369e1826b3
("usb: dwc2: Make dwc2_readl/writel functions endianness-agnostic.")
where the endianness check would read the DWC ID as 0 due to the phy still
resetting, resulting in the wrong endian mode being chosen.

Signed-off-by: Jonathan Bakker <xc-racer2@live.ca>
Link: https://lore.kernel.org/r/BN6PR04MB06605D52502816E500683553A3D10@BN6PR04MB0660.namprd04.prod.outlook.com
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/phy-s5pv210-usb2.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/phy/phy-s5pv210-usb2.c b/drivers/phy/phy-s5pv210-usb2.c
index 004d320767e4..bb36cfd4e3e9 100644
--- a/drivers/phy/phy-s5pv210-usb2.c
+++ b/drivers/phy/phy-s5pv210-usb2.c
@@ -142,6 +142,10 @@ static void s5pv210_phy_pwr(struct samsung_usb2_phy_instance *inst, bool on)
 		udelay(10);
 		rst &= ~rstbits;
 		writel(rst, drv->reg_phy + S5PV210_UPHYRST);
+		/* The following delay is necessary for the reset sequence to be
+		 * completed
+		 */
+		udelay(80);
 	} else {
 		pwr = readl(drv->reg_phy + S5PV210_UPHYPWR);
 		pwr |= phypwr;

From 0bc33fcc13f13d375e0560e16d50072b0ef5471b Mon Sep 17 00:00:00 2001
From: Sonny Sasaka <sonnysasaka@chromium.org>
Date: Wed, 6 May 2020 12:55:03 -0700
Subject: [PATCH 0679/2658] Bluetooth: Handle Inquiry Cancel error after
 Inquiry Complete

[ Upstream commit adf1d6926444029396861413aba8a0f2a805742a ]

After sending Inquiry Cancel command to the controller, it is possible
that Inquiry Complete event comes before Inquiry Cancel command complete
event. In this case the Inquiry Cancel command will have status of
Command Disallowed since there is no Inquiry session to be cancelled.
This case should not be treated as error, otherwise we can reach an
inconsistent state.

Example of a btmon trace when this happened:

< HCI Command: Inquiry Cancel (0x01|0x0002) plen 0
> HCI Event: Inquiry Complete (0x01) plen 1
        Status: Success (0x00)
> HCI Event: Command Complete (0x0e) plen 4
      Inquiry Cancel (0x01|0x0002) ncmd 1
        Status: Command Disallowed (0x0c)

Signed-off-by: Sonny Sasaka <sonnysasaka@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_event.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 3bc03280894d..7bd8ae4df08d 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -41,12 +41,27 @@
 
 /* Handle HCI Event packets */
 
-static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb,
+				  u8 *new_status)
 {
 	__u8 status = *((__u8 *) skb->data);
 
 	BT_DBG("%s status 0x%2.2x", hdev->name, status);
 
+	/* It is possible that we receive Inquiry Complete event right
+	 * before we receive Inquiry Cancel Command Complete event, in
+	 * which case the latter event should have status of Command
+	 * Disallowed (0x0c). This should not be treated as error, since
+	 * we actually achieve what Inquiry Cancel wants to achieve,
+	 * which is to end the last Inquiry session.
+	 */
+	if (status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
+		bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
+		status = 0x00;
+	}
+
+	*new_status = status;
+
 	if (status)
 		return;
 
@@ -2758,7 +2773,7 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
 
 	switch (*opcode) {
 	case HCI_OP_INQUIRY_CANCEL:
-		hci_cc_inquiry_cancel(hdev, skb);
+		hci_cc_inquiry_cancel(hdev, skb, status);
 		break;
 
 	case HCI_OP_PERIODIC_INQ:

From 83b1adc05b1de9a5e722e657b0061e4c3d9762d7 Mon Sep 17 00:00:00 2001
From: Tang Bin <tangbin@cmss.chinamobile.com>
Date: Fri, 8 May 2020 19:43:05 +0800
Subject: [PATCH 0680/2658] USB: EHCI: ehci-mv: fix error handling in
 mv_ehci_probe()

[ Upstream commit c856b4b0fdb5044bca4c0acf9a66f3b5cc01a37a ]

If the function platform_get_irq() failed, the negative value
returned will not be detected here. So fix error handling in
mv_ehci_probe(). And when get irq failed, the function
platform_get_irq() logs an error message, so remove redundant
message here.

Signed-off-by: Zhang Shengju <zhangshengju@cmss.chinamobile.com>
Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
Link: https://lore.kernel.org/r/20200508114305.15740-1-tangbin@cmss.chinamobile.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/ehci-mv.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/host/ehci-mv.c b/drivers/usb/host/ehci-mv.c
index 849806a75f1c..273736e1d33f 100644
--- a/drivers/usb/host/ehci-mv.c
+++ b/drivers/usb/host/ehci-mv.c
@@ -197,9 +197,8 @@ static int mv_ehci_probe(struct platform_device *pdev)
 	hcd->regs = ehci_mv->op_regs;
 
 	hcd->irq = platform_get_irq(pdev, 0);
-	if (!hcd->irq) {
-		dev_err(&pdev->dev, "Cannot get irq.");
-		retval = -ENODEV;
+	if (hcd->irq < 0) {
+		retval = hcd->irq;
 		goto err_disable_clk;
 	}
 

From 96e97caa17ecdd955a487b0e987a31f4d62b19ad Mon Sep 17 00:00:00 2001
From: Jonathan Bakker <xc-racer2@live.ca>
Date: Fri, 8 May 2020 18:34:33 -0700
Subject: [PATCH 0681/2658] tty: serial: samsung: Correct clock selection logic

[ Upstream commit 7d31676a8d91dd18e08853efd1cb26961a38c6a6 ]

Some variants of the samsung tty driver can pick which clock
to use for their baud rate generation.  In the DT conversion,
a default clock was selected to be used if a specific one wasn't
assigned and then a comparison of which clock rate worked better
was done.  Unfortunately, the comparison was implemented in such
a way that only the default clock was ever actually compared.
Fix this by iterating through all possible clocks, except when a
specific clock has already been picked via clk_sel (which is
only possible via board files).

Signed-off-by: Jonathan Bakker <xc-racer2@live.ca>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/BN6PR04MB06604E63833EA41837EBF77BA3A30@BN6PR04MB0660.namprd04.prod.outlook.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/samsung.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
index 8250343c19c6..c0c6b89de598 100644
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -1151,14 +1151,14 @@ static unsigned int s3c24xx_serial_getclk(struct s3c24xx_uart_port *ourport,
 	struct s3c24xx_uart_info *info = ourport->info;
 	struct clk *clk;
 	unsigned long rate;
-	unsigned int cnt, baud, quot, clk_sel, best_quot = 0;
+	unsigned int cnt, baud, quot, best_quot = 0;
 	char clkname[MAX_CLK_NAME_LENGTH];
 	int calc_deviation, deviation = (1 << 30) - 1;
 
-	clk_sel = (ourport->cfg->clk_sel) ? ourport->cfg->clk_sel :
-			ourport->info->def_clk_sel;
 	for (cnt = 0; cnt < info->num_clks; cnt++) {
-		if (!(clk_sel & (1 << cnt)))
+		/* Keep selected clock if provided */
+		if (ourport->cfg->clk_sel &&
+			!(ourport->cfg->clk_sel & (1 << cnt)))
 			continue;
 
 		sprintf(clkname, "clk_uart_baud%d", cnt);

From 49d764974e505b1e26bd340dd19966b0d9da8e78 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Sat, 16 May 2020 08:25:56 +0200
Subject: [PATCH 0682/2658] ALSA: hda: Fix potential race in unsol event
 handler

[ Upstream commit c637fa151259c0f74665fde7cba5b7eac1417ae5 ]

The unsol event handling code has a loop retrieving the read/write
indices and the arrays without locking while the append to the array
may happen concurrently.  This may lead to some inconsistency.
Although there hasn't been any proof of this bad results, it's still
safer to protect the racy accesses.

This patch adds the spinlock protection around the unsol handling loop
for addressing it.  Here we take bus->reg_lock as the writer side
snd_hdac_bus_queue_event() is also protected by that lock.

Link: https://lore.kernel.org/r/20200516062556.30951-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/hdac_bus.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/hda/hdac_bus.c b/sound/hda/hdac_bus.c
index 0e81ea89a596..e3f68a76d90e 100644
--- a/sound/hda/hdac_bus.c
+++ b/sound/hda/hdac_bus.c
@@ -155,6 +155,7 @@ static void process_unsol_events(struct work_struct *work)
 	struct hdac_driver *drv;
 	unsigned int rp, caddr, res;
 
+	spin_lock_irq(&bus->reg_lock);
 	while (bus->unsol_rp != bus->unsol_wp) {
 		rp = (bus->unsol_rp + 1) % HDA_UNSOL_QUEUE_SIZE;
 		bus->unsol_rp = rp;
@@ -166,10 +167,13 @@ static void process_unsol_events(struct work_struct *work)
 		codec = bus->caddr_tbl[caddr & 0x0f];
 		if (!codec || !codec->dev.driver)
 			continue;
+		spin_unlock_irq(&bus->reg_lock);
 		drv = drv_to_hdac_driver(codec->dev.driver);
 		if (drv->unsol_event)
 			drv->unsol_event(codec, res);
+		spin_lock_irq(&bus->reg_lock);
 	}
+	spin_unlock_irq(&bus->reg_lock);
 }
 
 /**

From 2590116afc65c4745b1a23df12f0786d2c95a7bc Mon Sep 17 00:00:00 2001
From: Miklos Szeredi <mszeredi@redhat.com>
Date: Tue, 19 May 2020 14:50:37 +0200
Subject: [PATCH 0683/2658] fuse: don't check refcount after stealing page

[ Upstream commit 32f98877c57bee6bc27f443a96f49678a2cd6a50 ]

page_count() is unstable.  Unless there has been an RCU grace period
between when the page was removed from the page cache and now, a
speculative reference may exist from the page cache.

Reported-by: Matthew Wilcox <willy@infradead.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fuse/dev.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 7157d2ee5aed..f78179db7256 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -860,7 +860,6 @@ static int fuse_check_page(struct page *page)
 {
 	if (page_mapcount(page) ||
 	    page->mapping != NULL ||
-	    page_count(page) != 1 ||
 	    (page->flags & PAGE_FLAGS_CHECK_AT_PREP &
 	     ~(1 << PG_locked |
 	       1 << PG_referenced |

From 0cab07691243bcb01e2e73e4930ea3eb095f9d81 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Fri, 15 May 2020 17:54:53 +0100
Subject: [PATCH 0684/2658] USB: EHCI: ehci-mv: fix less than zero comparison
 of an unsigned int

[ Upstream commit a7f40c233a6b0540d28743267560df9cfb571ca9 ]

The comparison of hcd->irq to less than zero for an error check will
never be true because hcd->irq is an unsigned int.  Fix this by
assigning the int retval to the return of platform_get_irq and checking
this for the -ve error condition and assigning hcd->irq to retval.

Addresses-Coverity: ("Unsigned compared against 0")
Fixes: c856b4b0fdb5 ("USB: EHCI: ehci-mv: fix error handling in mv_ehci_probe()")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20200515165453.104028-1-colin.king@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/ehci-mv.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/host/ehci-mv.c b/drivers/usb/host/ehci-mv.c
index 273736e1d33f..b29610899c9f 100644
--- a/drivers/usb/host/ehci-mv.c
+++ b/drivers/usb/host/ehci-mv.c
@@ -196,11 +196,10 @@ static int mv_ehci_probe(struct platform_device *pdev)
 	hcd->rsrc_len = resource_size(r);
 	hcd->regs = ehci_mv->op_regs;
 
-	hcd->irq = platform_get_irq(pdev, 0);
-	if (hcd->irq < 0) {
-		retval = hcd->irq;
+	retval = platform_get_irq(pdev, 0);
+	if (retval < 0)
 		goto err_disable_clk;
-	}
+	hcd->irq = retval;
 
 	ehci = hcd_to_ehci(hcd);
 	ehci->caps = (struct ehci_caps *) ehci_mv->cap_regs;

From 794d10003431a24986332a2bc89375415c66ca18 Mon Sep 17 00:00:00 2001
From: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Date: Fri, 17 Apr 2020 09:35:31 -0700
Subject: [PATCH 0685/2658] e1000: Do not perform reset in reset_task if we are
 already down

[ Upstream commit 49ee3c2ab5234757bfb56a0b3a3cb422f427e3a3 ]

We are seeing a deadlock in e1000 down when NAPI is being disabled. Looking
over the kernel function trace of the system it appears that the interface
is being closed and then a reset is hitting which deadlocks the interface
as the NAPI interface is already disabled.

To prevent this from happening I am disabling the reset task when
__E1000_DOWN is already set. In addition code has been added so that we set
the __E1000_DOWN while holding the __E1000_RESET flag in e1000_close in
order to guarantee that the reset task will not run after we have started
the close call.

Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Tested-by: Maxim Zhukov <mussitantesmortem@gmail.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/e1000/e1000_main.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index f958188207fd..e57aca6239f8 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -568,8 +568,13 @@ void e1000_reinit_locked(struct e1000_adapter *adapter)
 	WARN_ON(in_interrupt());
 	while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
 		msleep(1);
-	e1000_down(adapter);
-	e1000_up(adapter);
+
+	/* only run the task if not already down */
+	if (!test_bit(__E1000_DOWN, &adapter->flags)) {
+		e1000_down(adapter);
+		e1000_up(adapter);
+	}
+
 	clear_bit(__E1000_RESETTING, &adapter->flags);
 }
 
@@ -1456,10 +1461,15 @@ static int e1000_close(struct net_device *netdev)
 	struct e1000_hw *hw = &adapter->hw;
 	int count = E1000_CHECK_RESET_COUNT;
 
-	while (test_bit(__E1000_RESETTING, &adapter->flags) && count--)
+	while (test_and_set_bit(__E1000_RESETTING, &adapter->flags) && count--)
 		usleep_range(10000, 20000);
 
-	WARN_ON(test_bit(__E1000_RESETTING, &adapter->flags));
+	WARN_ON(count < 0);
+
+	/* signal that we're down so that the reset task will no longer run */
+	set_bit(__E1000_DOWN, &adapter->flags);
+	clear_bit(__E1000_RESETTING, &adapter->flags);
+
 	e1000_down(adapter);
 	e1000_power_down_phy(adapter);
 	e1000_free_irq(adapter);

From bdd8a012d61bd2cee9a795a14d6e98ea9e921578 Mon Sep 17 00:00:00 2001
From: Shreyas Joshi <shreyas.joshi@biamp.com>
Date: Fri, 22 May 2020 16:53:06 +1000
Subject: [PATCH 0686/2658] printk: handle blank console arguments passed in.

[ Upstream commit 48021f98130880dd74286459a1ef48b5e9bc374f ]

If uboot passes a blank string to console_setup then it results in
a trashed memory. Ultimately, the kernel crashes during freeing up
the memory.

This fix checks if there is a blank parameter being
passed to console_setup from uboot. In case it detects that
the console parameter is blank then it doesn't setup the serial
device and it gracefully exits.

Link: https://lore.kernel.org/r/20200522065306.83-1-shreyas.joshi@biamp.com
Signed-off-by: Shreyas Joshi <shreyas.joshi@biamp.com>
Acked-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
[pmladek@suse.com: Better format the commit message and code, remove unnecessary brackets.]
Signed-off-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/printk/printk.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index a3afa5e70153..68506a10123d 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -2040,6 +2040,9 @@ static int __init console_setup(char *str)
 	char *s, *options, *brl_options = NULL;
 	int idx;
 
+	if (str[0] == 0)
+		return 1;
+
 	if (_braille_console_setup(&str, &brl_options))
 		return 1;
 

From bd50484d1f8ec36dc9b5ac8bb732d23af5ffeee1 Mon Sep 17 00:00:00 2001
From: Qian Cai <cai@lca.pw>
Date: Mon, 11 May 2020 00:34:50 -0400
Subject: [PATCH 0687/2658] vfio/pci: fix memory leaks of eventfd ctx

[ Upstream commit 1518ac272e789cae8c555d69951b032a275b7602 ]

Finished a qemu-kvm (-device vfio-pci,host=0001:01:00.0) triggers a few
memory leaks after a while because vfio_pci_set_ctx_trigger_single()
calls eventfd_ctx_fdget() without the matching eventfd_ctx_put() later.
Fix it by calling eventfd_ctx_put() for those memory in
vfio_pci_release() before vfio_device_release().

unreferenced object 0xebff008981cc2b00 (size 128):
  comm "qemu-kvm", pid 4043, jiffies 4294994816 (age 9796.310s)
  hex dump (first 32 bytes):
    01 00 00 00 6b 6b 6b 6b 00 00 00 00 ad 4e ad de  ....kkkk.....N..
    ff ff ff ff 6b 6b 6b 6b ff ff ff ff ff ff ff ff  ....kkkk........
  backtrace:
    [<00000000917e8f8d>] slab_post_alloc_hook+0x74/0x9c
    [<00000000df0f2aa2>] kmem_cache_alloc_trace+0x2b4/0x3d4
    [<000000005fcec025>] do_eventfd+0x54/0x1ac
    [<0000000082791a69>] __arm64_sys_eventfd2+0x34/0x44
    [<00000000b819758c>] do_el0_svc+0x128/0x1dc
    [<00000000b244e810>] el0_sync_handler+0xd0/0x268
    [<00000000d495ef94>] el0_sync+0x164/0x180
unreferenced object 0x29ff008981cc4180 (size 128):
  comm "qemu-kvm", pid 4043, jiffies 4294994818 (age 9796.290s)
  hex dump (first 32 bytes):
    01 00 00 00 6b 6b 6b 6b 00 00 00 00 ad 4e ad de  ....kkkk.....N..
    ff ff ff ff 6b 6b 6b 6b ff ff ff ff ff ff ff ff  ....kkkk........
  backtrace:
    [<00000000917e8f8d>] slab_post_alloc_hook+0x74/0x9c
    [<00000000df0f2aa2>] kmem_cache_alloc_trace+0x2b4/0x3d4
    [<000000005fcec025>] do_eventfd+0x54/0x1ac
    [<0000000082791a69>] __arm64_sys_eventfd2+0x34/0x44
    [<00000000b819758c>] do_el0_svc+0x128/0x1dc
    [<00000000b244e810>] el0_sync_handler+0xd0/0x268
    [<00000000d495ef94>] el0_sync+0x164/0x180

Signed-off-by: Qian Cai <cai@lca.pw>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/pci/vfio_pci.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 7a82735d5308..ab765770e8dd 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -255,6 +255,10 @@ static void vfio_pci_release(void *device_data)
 	if (!(--vdev->refcnt)) {
 		vfio_spapr_pci_eeh_release(vdev->pdev);
 		vfio_pci_disable(vdev);
+		if (vdev->err_trigger)
+			eventfd_ctx_put(vdev->err_trigger);
+		if (vdev->req_trigger)
+			eventfd_ctx_put(vdev->req_trigger);
 	}
 
 	mutex_unlock(&driver_lock);

From e2b284c46a757ec26a98437dc7afeecd05aa4775 Mon Sep 17 00:00:00 2001
From: Adrian Hunter <adrian.hunter@intel.com>
Date: Tue, 12 May 2020 15:19:16 +0300
Subject: [PATCH 0688/2658] perf kcore_copy: Fix module map when there are no
 modules loaded

[ Upstream commit 61f82e3fb697a8e85f22fdec786528af73dc36d1 ]

In the absence of any modules, no "modules" map is created, but there
are other executable pages to map, due to eBPF JIT, kprobe or ftrace.
Map them by recognizing that the first "module" symbol is not
necessarily from a module, and adjust the map accordingly.

Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Leo Yan <leo.yan@linaro.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
Cc: x86@kernel.org
Link: http://lore.kernel.org/lkml/20200512121922.8997-10-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/symbol-elf.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 2070c02de3af..ea55cb6b614f 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -1390,6 +1390,7 @@ struct kcore_copy_info {
 	u64 first_symbol;
 	u64 last_symbol;
 	u64 first_module;
+	u64 first_module_symbol;
 	u64 last_module_symbol;
 	struct phdr_data kernel_map;
 	struct phdr_data modules_map;
@@ -1404,6 +1405,8 @@ static int kcore_copy__process_kallsyms(void *arg, const char *name, char type,
 		return 0;
 
 	if (strchr(name, '[')) {
+		if (!kci->first_module_symbol || start < kci->first_module_symbol)
+			kci->first_module_symbol = start;
 		if (start > kci->last_module_symbol)
 			kci->last_module_symbol = start;
 		return 0;
@@ -1528,6 +1531,10 @@ static int kcore_copy__calc_maps(struct kcore_copy_info *kci, const char *dir,
 		kci->etext += page_size;
 	}
 
+	if (kci->first_module_symbol &&
+	    (!kci->first_module || kci->first_module_symbol < kci->first_module))
+		kci->first_module = kci->first_module_symbol;
+
 	kci->first_module = round_down(kci->first_module, page_size);
 
 	if (kci->last_module_symbol) {

From 63782c3f206360c1e31627ec8f1792f2b37d88ca Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Fri, 22 May 2020 18:40:06 +0800
Subject: [PATCH 0689/2658] mtd: rawnand: omap_elm: Fix runtime PM imbalance on
 error

[ Upstream commit 37f7212148cf1d796135cdf8d0c7fee13067674b ]

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code. Thus a pairing decrement is needed on
the error handling path to keep the counter balanced.

Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20200522104008.28340-1-dinghao.liu@zju.edu.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/nand/omap_elm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mtd/nand/omap_elm.c b/drivers/mtd/nand/omap_elm.c
index 235ec7992b4c..e46b11847082 100644
--- a/drivers/mtd/nand/omap_elm.c
+++ b/drivers/mtd/nand/omap_elm.c
@@ -421,6 +421,7 @@ static int elm_probe(struct platform_device *pdev)
 	pm_runtime_enable(&pdev->dev);
 	if (pm_runtime_get_sync(&pdev->dev) < 0) {
 		ret = -EINVAL;
+		pm_runtime_put_sync(&pdev->dev);
 		pm_runtime_disable(&pdev->dev);
 		dev_err(&pdev->dev, "can't enable clock\n");
 		return ret;

From ae58cb0500c7a25a25a4272245d11078d86a749a Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@kernel.org>
Date: Fri, 20 Mar 2020 16:45:45 -0400
Subject: [PATCH 0690/2658] ceph: fix potential race in ceph_check_caps

[ Upstream commit dc3da0461cc4b76f2d0c5b12247fcb3b520edbbf ]

Nothing ensures that session will still be valid by the time we
dereference the pointer. Take and put a reference.

In principle, we should always be able to get a reference here, but
throw a warning if that's ever not the case.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/caps.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 3d0497421e62..49e693232916 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1777,12 +1777,24 @@ void ceph_check_caps(struct ceph_inode_info *ci, int flags,
 			if (mutex_trylock(&session->s_mutex) == 0) {
 				dout("inverting session/ino locks on %p\n",
 				     session);
+				session = ceph_get_mds_session(session);
 				spin_unlock(&ci->i_ceph_lock);
 				if (took_snap_rwsem) {
 					up_read(&mdsc->snap_rwsem);
 					took_snap_rwsem = 0;
 				}
-				mutex_lock(&session->s_mutex);
+				if (session) {
+					mutex_lock(&session->s_mutex);
+					ceph_put_mds_session(session);
+				} else {
+					/*
+					 * Because we take the reference while
+					 * holding the i_ceph_lock, it should
+					 * never be NULL. Throw a warning if it
+					 * ever is.
+					 */
+					WARN_ON_ONCE(true);
+				}
 				goto retry;
 			}
 		}

From 4ae4aad71c63d410604567f4616730681b8ccd0d Mon Sep 17 00:00:00 2001
From: Boris Brezillon <boris.brezillon@collabora.com>
Date: Wed, 29 Apr 2020 09:53:47 -0700
Subject: [PATCH 0691/2658] mtd: parser: cmdline: Support MTD names containing
 one or more colons

[ Upstream commit eb13fa0227417e84aecc3bd9c029d376e33474d3 ]

Looks like some drivers define MTD names with a colon in it, thus
making mtdpart= parsing impossible. Let's fix the parser to gracefully
handle that case: the last ':' in a partition definition sequence is
considered instead of the first one.

Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Ron Minnich <rminnich@google.com>
Tested-by: Ron Minnich <rminnich@google.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/cmdlinepart.c | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/cmdlinepart.c b/drivers/mtd/cmdlinepart.c
index 08f62987cc37..ffbc9b304beb 100644
--- a/drivers/mtd/cmdlinepart.c
+++ b/drivers/mtd/cmdlinepart.c
@@ -228,12 +228,29 @@ static int mtdpart_setup_real(char *s)
 		struct cmdline_mtd_partition *this_mtd;
 		struct mtd_partition *parts;
 		int mtd_id_len, num_parts;
-		char *p, *mtd_id;
+		char *p, *mtd_id, *semicol;
+
+		/*
+		 * Replace the first ';' by a NULL char so strrchr can work
+		 * properly.
+		 */
+		semicol = strchr(s, ';');
+		if (semicol)
+			*semicol = '\0';
 
 		mtd_id = s;
 
-		/* fetch <mtd-id> */
-		p = strchr(s, ':');
+		/*
+		 * fetch <mtd-id>. We use strrchr to ignore all ':' that could
+		 * be present in the MTD name, only the last one is interpreted
+		 * as an <mtd-id>/<part-definition> separator.
+		 */
+		p = strrchr(s, ':');
+
+		/* Restore the ';' now. */
+		if (semicol)
+			*semicol = ';';
+
 		if (!p) {
 			pr_err("no mtd-id\n");
 			return -EINVAL;

From 0423971e10f9503e51fbd1e4efe93ccc29bca6ea Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Wed, 4 Mar 2020 12:49:18 +0100
Subject: [PATCH 0692/2658] x86/speculation/mds: Mark
 mds_user_clear_cpu_buffers() __always_inline

[ Upstream commit a7ef9ba986b5fae9d80f8a7b31db0423687efe4e ]

Prevent the compiler from uninlining and creating traceable/probable
functions as this is invoked _after_ context tracking switched to
CONTEXT_USER and rcu idle.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Alexandre Chartre <alexandre.chartre@oracle.com>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20200505134340.902709267@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/nospec-branch.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
index 664e8505ccd6..2f84887e8934 100644
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -275,7 +275,7 @@ DECLARE_STATIC_KEY_FALSE(mds_idle_clear);
  * combination with microcode which triggers a CPU buffer flush when the
  * instruction is executed.
  */
-static inline void mds_clear_cpu_buffers(void)
+static __always_inline void mds_clear_cpu_buffers(void)
 {
 	static const u16 ds = __KERNEL_DS;
 
@@ -296,7 +296,7 @@ static inline void mds_clear_cpu_buffers(void)
  *
  * Clear CPU buffers if the corresponding static key is enabled
  */
-static inline void mds_user_clear_cpu_buffers(void)
+static __always_inline void mds_user_clear_cpu_buffers(void)
 {
 	if (static_branch_likely(&mds_user_clear))
 		mds_clear_cpu_buffers();

From 5f3fd284ef0a4e3bb0746a394128f7c71cc45705 Mon Sep 17 00:00:00 2001
From: Alex Williamson <alex.williamson@redhat.com>
Date: Tue, 16 Jun 2020 15:26:36 -0600
Subject: [PATCH 0693/2658] vfio/pci: Clear error and request eventfd ctx after
 releasing

[ Upstream commit 5c5866c593bbd444d0339ede6a8fb5f14ff66d72 ]

The next use of the device will generate an underflow from the
stale reference.

Cc: Qian Cai <cai@lca.pw>
Fixes: 1518ac272e78 ("vfio/pci: fix memory leaks of eventfd ctx")
Reported-by: Daniel Wagner <dwagner@suse.de>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Tested-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/pci/vfio_pci.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index ab765770e8dd..662ea7ec8292 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -255,10 +255,14 @@ static void vfio_pci_release(void *device_data)
 	if (!(--vdev->refcnt)) {
 		vfio_spapr_pci_eeh_release(vdev->pdev);
 		vfio_pci_disable(vdev);
-		if (vdev->err_trigger)
+		if (vdev->err_trigger) {
 			eventfd_ctx_put(vdev->err_trigger);
-		if (vdev->req_trigger)
+			vdev->err_trigger = NULL;
+		}
+		if (vdev->req_trigger) {
 			eventfd_ctx_put(vdev->req_trigger);
+			vdev->req_trigger = NULL;
+		}
 	}
 
 	mutex_unlock(&driver_lock);

From e81fa38d990d454d17d5500b7fcbc5a0dd0f7abe Mon Sep 17 00:00:00 2001
From: Zeng Tao <prime.zeng@hisilicon.com>
Date: Wed, 15 Jul 2020 15:34:41 +0800
Subject: [PATCH 0694/2658] vfio/pci: fix racy on error and request eventfd ctx

[ Upstream commit b872d0640840018669032b20b6375a478ed1f923 ]

The vfio_pci_release call will free and clear the error and request
eventfd ctx while these ctx could be in use at the same time in the
function like vfio_pci_request, and it's expected to protect them under
the vdev->igate mutex, which is missing in vfio_pci_release.

This issue is introduced since commit 1518ac272e78 ("vfio/pci: fix memory
leaks of eventfd ctx"),and since commit 5c5866c593bb ("vfio/pci: Clear
error and request eventfd ctx after releasing"), it's very easily to
trigger the kernel panic like this:

[ 9513.904346] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
[ 9513.913091] Mem abort info:
[ 9513.915871]   ESR = 0x96000006
[ 9513.918912]   EC = 0x25: DABT (current EL), IL = 32 bits
[ 9513.924198]   SET = 0, FnV = 0
[ 9513.927238]   EA = 0, S1PTW = 0
[ 9513.930364] Data abort info:
[ 9513.933231]   ISV = 0, ISS = 0x00000006
[ 9513.937048]   CM = 0, WnR = 0
[ 9513.940003] user pgtable: 4k pages, 48-bit VAs, pgdp=0000007ec7d12000
[ 9513.946414] [0000000000000008] pgd=0000007ec7d13003, p4d=0000007ec7d13003, pud=0000007ec728c003, pmd=0000000000000000
[ 9513.956975] Internal error: Oops: 96000006 [#1] PREEMPT SMP
[ 9513.962521] Modules linked in: vfio_pci vfio_virqfd vfio_iommu_type1 vfio hclge hns3 hnae3 [last unloaded: vfio_pci]
[ 9513.972998] CPU: 4 PID: 1327 Comm: bash Tainted: G        W         5.8.0-rc4+ #3
[ 9513.980443] Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V3.B270.01 05/08/2020
[ 9513.989274] pstate: 80400089 (Nzcv daIf +PAN -UAO BTYPE=--)
[ 9513.994827] pc : _raw_spin_lock_irqsave+0x48/0x88
[ 9513.999515] lr : eventfd_signal+0x6c/0x1b0
[ 9514.003591] sp : ffff800038a0b960
[ 9514.006889] x29: ffff800038a0b960 x28: ffff007ef7f4da10
[ 9514.012175] x27: ffff207eefbbfc80 x26: ffffbb7903457000
[ 9514.017462] x25: ffffbb7912191000 x24: ffff007ef7f4d400
[ 9514.022747] x23: ffff20be6e0e4c00 x22: 0000000000000008
[ 9514.028033] x21: 0000000000000000 x20: 0000000000000000
[ 9514.033321] x19: 0000000000000008 x18: 0000000000000000
[ 9514.038606] x17: 0000000000000000 x16: ffffbb7910029328
[ 9514.043893] x15: 0000000000000000 x14: 0000000000000001
[ 9514.049179] x13: 0000000000000000 x12: 0000000000000002
[ 9514.054466] x11: 0000000000000000 x10: 0000000000000a00
[ 9514.059752] x9 : ffff800038a0b840 x8 : ffff007ef7f4de60
[ 9514.065038] x7 : ffff007fffc96690 x6 : fffffe01faffb748
[ 9514.070324] x5 : 0000000000000000 x4 : 0000000000000000
[ 9514.075609] x3 : 0000000000000000 x2 : 0000000000000001
[ 9514.080895] x1 : ffff007ef7f4d400 x0 : 0000000000000000
[ 9514.086181] Call trace:
[ 9514.088618]  _raw_spin_lock_irqsave+0x48/0x88
[ 9514.092954]  eventfd_signal+0x6c/0x1b0
[ 9514.096691]  vfio_pci_request+0x84/0xd0 [vfio_pci]
[ 9514.101464]  vfio_del_group_dev+0x150/0x290 [vfio]
[ 9514.106234]  vfio_pci_remove+0x30/0x128 [vfio_pci]
[ 9514.111007]  pci_device_remove+0x48/0x108
[ 9514.115001]  device_release_driver_internal+0x100/0x1b8
[ 9514.120200]  device_release_driver+0x28/0x38
[ 9514.124452]  pci_stop_bus_device+0x68/0xa8
[ 9514.128528]  pci_stop_and_remove_bus_device+0x20/0x38
[ 9514.133557]  pci_iov_remove_virtfn+0xb4/0x128
[ 9514.137893]  sriov_disable+0x3c/0x108
[ 9514.141538]  pci_disable_sriov+0x28/0x38
[ 9514.145445]  hns3_pci_sriov_configure+0x48/0xb8 [hns3]
[ 9514.150558]  sriov_numvfs_store+0x110/0x198
[ 9514.154724]  dev_attr_store+0x44/0x60
[ 9514.158373]  sysfs_kf_write+0x5c/0x78
[ 9514.162018]  kernfs_fop_write+0x104/0x210
[ 9514.166010]  __vfs_write+0x48/0x90
[ 9514.169395]  vfs_write+0xbc/0x1c0
[ 9514.172694]  ksys_write+0x74/0x100
[ 9514.176079]  __arm64_sys_write+0x24/0x30
[ 9514.179987]  el0_svc_common.constprop.4+0x110/0x200
[ 9514.184842]  do_el0_svc+0x34/0x98
[ 9514.188144]  el0_svc+0x14/0x40
[ 9514.191185]  el0_sync_handler+0xb0/0x2d0
[ 9514.195088]  el0_sync+0x140/0x180
[ 9514.198389] Code: b9001020 d2800000 52800022 f9800271 (885ffe61)
[ 9514.204455] ---[ end trace 648de00c8406465f ]---
[ 9514.212308] note: bash[1327] exited with preempt_count 1

Cc: Qian Cai <cai@lca.pw>
Cc: Alex Williamson <alex.williamson@redhat.com>
Fixes: 1518ac272e78 ("vfio/pci: fix memory leaks of eventfd ctx")
Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/pci/vfio_pci.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 662ea7ec8292..8276ef7f3e83 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -255,14 +255,19 @@ static void vfio_pci_release(void *device_data)
 	if (!(--vdev->refcnt)) {
 		vfio_spapr_pci_eeh_release(vdev->pdev);
 		vfio_pci_disable(vdev);
+		mutex_lock(&vdev->igate);
 		if (vdev->err_trigger) {
 			eventfd_ctx_put(vdev->err_trigger);
 			vdev->err_trigger = NULL;
 		}
+		mutex_unlock(&vdev->igate);
+
+		mutex_lock(&vdev->igate);
 		if (vdev->req_trigger) {
 			eventfd_ctx_put(vdev->req_trigger);
 			vdev->req_trigger = NULL;
 		}
+		mutex_unlock(&vdev->igate);
 	}
 
 	mutex_unlock(&driver_lock);

From a2683d9a90c1373282b4e7ea715606bfa7fdf56c Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Wed, 9 Sep 2020 14:27:25 +0200
Subject: [PATCH 0695/2658] s390/init: add missing __init annotations

[ Upstream commit fcb2b70cdb194157678fb1a75f9ff499aeba3d2a ]

Add __init to reserve_memory_end, reserve_oldmem and remove_oldmem.
Sometimes these functions are not inlined, and then the build
complains about section mismatch.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/kernel/setup.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 47692c78d09c..fdc5e76e1f6b 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -513,7 +513,7 @@ static struct notifier_block kdump_mem_nb = {
 /*
  * Make sure that the area behind memory_end is protected
  */
-static void reserve_memory_end(void)
+static void __init reserve_memory_end(void)
 {
 #ifdef CONFIG_CRASH_DUMP
 	if (ipl_info.type == IPL_TYPE_FCP_DUMP &&
@@ -531,7 +531,7 @@ static void reserve_memory_end(void)
 /*
  * Make sure that oldmem, where the dump is stored, is protected
  */
-static void reserve_oldmem(void)
+static void __init reserve_oldmem(void)
 {
 #ifdef CONFIG_CRASH_DUMP
 	if (OLDMEM_BASE)
@@ -543,7 +543,7 @@ static void reserve_oldmem(void)
 /*
  * Make sure that oldmem, where the dump is stored, is protected
  */
-static void remove_oldmem(void)
+static void __init remove_oldmem(void)
 {
 #ifdef CONFIG_CRASH_DUMP
 	if (OLDMEM_BASE)

From 3ec903282842d8435335ae310147905b6e075b5c Mon Sep 17 00:00:00 2001
From: Maximilian Luz <luzmaximilian@gmail.com>
Date: Tue, 25 Aug 2020 17:38:29 +0200
Subject: [PATCH 0696/2658] mwifiex: Increase AES key storage size to 256 bits

[ Upstream commit 4afc850e2e9e781976fb2c7852ce7bac374af938 ]

Following commit e18696786548 ("mwifiex: Prevent memory corruption
handling keys") the mwifiex driver fails to authenticate with certain
networks, specifically networks with 256 bit keys, and repeatedly asks
for the password. The kernel log repeats the following lines (id and
bssid redacted):

    mwifiex_pcie 0000:01:00.0: info: trying to associate to '<id>' bssid <bssid>
    mwifiex_pcie 0000:01:00.0: info: associated to bssid <bssid> successfully
    mwifiex_pcie 0000:01:00.0: crypto keys added
    mwifiex_pcie 0000:01:00.0: info: successfully disconnected from <bssid>: reason code 3

Tracking down this problem lead to the overflow check introduced by the
aforementioned commit into mwifiex_ret_802_11_key_material_v2(). This
check fails on networks with 256 bit keys due to the current storage
size for AES keys in struct mwifiex_aes_param being only 128 bit.

To fix this issue, increase the storage size for AES keys to 256 bit.

Fixes: e18696786548 ("mwifiex: Prevent memory corruption handling keys")
Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
Reported-by: Kaloyan Nikolov <konik98@gmail.com>
Tested-by: Kaloyan Nikolov <konik98@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Tested-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200825153829.38043-1-luzmaximilian@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mwifiex/fw.h          | 2 +-
 drivers/net/wireless/mwifiex/sta_cmdresp.c | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index 9a5eb9ed8921..233af2292366 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -848,7 +848,7 @@ struct mwifiex_tkip_param {
 struct mwifiex_aes_param {
 	u8 pn[WPA_PN_SIZE];
 	__le16 key_len;
-	u8 key[WLAN_KEY_LEN_CCMP];
+	u8 key[WLAN_KEY_LEN_CCMP_256];
 } __packed;
 
 struct mwifiex_wapi_param {
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index 9e3853c8a22d..32b0b06b74f1 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -631,7 +631,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,
 	key_v2 = &resp->params.key_material_v2;
 
 	len = le16_to_cpu(key_v2->key_param_set.key_params.aes.key_len);
-	if (len > WLAN_KEY_LEN_CCMP)
+	if (len > sizeof(key_v2->key_param_set.key_params.aes.key))
 		return -EINVAL;
 
 	if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) {
@@ -647,7 +647,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,
 		return 0;
 
 	memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0,
-	       WLAN_KEY_LEN_CCMP);
+	       sizeof(key_v2->key_param_set.key_params.aes.key));
 	priv->aes_key_v2.key_param_set.key_params.aes.key_len =
 				cpu_to_le16(len);
 	memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key,

From a983995a6800d4b1d66d9e6564e53c9989babf30 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Linus=20L=C3=BCssing?= <ll@simonwunderlich.de>
Date: Thu, 27 Aug 2020 17:34:48 +0200
Subject: [PATCH 0697/2658] batman-adv: bla: fix type misuse for backbone_gw
 hash indexing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 097930e85f90f252c44dc0d084598265dd44ca48 ]

It seems that due to a copy & paste error the void pointer
in batadv_choose_backbone_gw() is cast to the wrong type.

Fixing this by using "struct batadv_bla_backbone_gw" instead of "struct
batadv_bla_claim" which better matches the caller's side.

For now it seems that we were lucky because the two structs both have
their orig/vid and addr/vid in the beginning. However I stumbled over
this issue when I was trying to add some debug variables in front of
"orig" in batadv_backbone_gw, which caused hash lookups to fail.

Fixes: 07568d0369f9 ("batman-adv: don't rely on positions in struct for hashing")
Signed-off-by: Linus Lüssing <ll@simonwunderlich.de>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/batman-adv/bridge_loop_avoidance.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index 9aa5daa55127..1267cbb1a329 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -73,11 +73,12 @@ static inline u32 batadv_choose_claim(const void *data, u32 size)
 /* return the index of the backbone gateway */
 static inline u32 batadv_choose_backbone_gw(const void *data, u32 size)
 {
-	const struct batadv_bla_claim *claim = (struct batadv_bla_claim *)data;
+	const struct batadv_bla_backbone_gw *gw;
 	u32 hash = 0;
 
-	hash = jhash(&claim->addr, sizeof(claim->addr), hash);
-	hash = jhash(&claim->vid, sizeof(claim->vid), hash);
+	gw = (struct batadv_bla_backbone_gw *)data;
+	hash = jhash(&gw->orig, sizeof(gw->orig), hash);
+	hash = jhash(&gw->vid, sizeof(gw->vid), hash);
 
 	return hash % size;
 }

From ca27f6af0e143dfac6e626ec55378315cda0e44d Mon Sep 17 00:00:00 2001
From: Jing Xiangfeng <jingxiangfeng@huawei.com>
Date: Fri, 4 Sep 2020 10:51:03 +0800
Subject: [PATCH 0698/2658] atm: eni: fix the missed pci_disable_device() for
 eni_init_one()

[ Upstream commit c2b947879ca320ac5505c6c29a731ff17da5e805 ]

eni_init_one() misses to call pci_disable_device() in an error path.
Jump to err_disable to fix it.

Fixes: ede58ef28e10 ("atm: remove deprecated use of pci api")
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/atm/eni.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
index ad591a2f7c82..340a1ee79d28 100644
--- a/drivers/atm/eni.c
+++ b/drivers/atm/eni.c
@@ -2242,7 +2242,7 @@ static int eni_init_one(struct pci_dev *pci_dev,
 
 	rc = dma_set_mask_and_coherent(&pci_dev->dev, DMA_BIT_MASK(32));
 	if (rc < 0)
-		goto out;
+		goto err_disable;
 
 	rc = -ENOMEM;
 	eni_dev = kmalloc(sizeof(struct eni_dev), GFP_KERNEL);

From c50afca45d5a6b9654bf36c54d19f60f2e5cc61f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
Date: Fri, 4 Sep 2020 20:28:00 +0200
Subject: [PATCH 0699/2658] batman-adv: mcast/TT: fix wrongly dropped or
 rerouted packets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 7dda5b3384121181c4e79f6eaeac2b94c0622c8d ]

The unicast packet rerouting code makes several assumptions. For
instance it assumes that there is always exactly one destination in the
TT. This breaks for multicast frames in a unicast packets in several ways:

For one thing if there is actually no TT entry and the destination node
was selected due to the multicast tvlv flags it announced. Then an
intermediate node will wrongly drop the packet.

For another thing if there is a TT entry but the TTVN of this entry is
newer than the originally addressed destination node: Then the
intermediate node will wrongly redirect the packet, leading to
duplicated multicast packets at a multicast listener and missing
packets at other multicast listeners or multicast routers.

Fixing this by not applying the unicast packet rerouting to batman-adv
unicast packets with a multicast payload. We are not able to detect a
roaming multicast listener at the moment and will just continue to send
the multicast frame to both the new and old destination for a while in
case of such a roaming multicast listener.

Fixes: a73105b8d4c7 ("batman-adv: improved client announcement mechanism")
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/batman-adv/routing.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index b3e8b0e3073c..e470410abb44 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -782,6 +782,10 @@ static int batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
 	vid = batadv_get_vid(skb, hdr_len);
 	ethhdr = (struct ethhdr *)(skb->data + hdr_len);
 
+	/* do not reroute multicast frames in a unicast header */
+	if (is_multicast_ether_addr(ethhdr->h_dest))
+		return true;
+
 	/* check if the destination client was served by this node and it is now
 	 * roaming. In this case, it means that the node has got a ROAM_ADV
 	 * message and that it knows the new destination in the mesh to re-route

From 68be181e87f1c1af895bccd12b630e292c78a173 Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Sun, 13 Sep 2020 09:52:30 -0700
Subject: [PATCH 0700/2658] ALSA: asihpi: fix iounmap in error handler

[ Upstream commit 472eb39103e885f302fd8fd6eff104fcf5503f1b ]

clang static analysis flags this problem
hpioctl.c:513:7: warning: Branch condition evaluates to
  a garbage value
                if (pci.ap_mem_base[idx]) {
                    ^~~~~~~~~~~~~~~~~~~~

If there is a failure in the middle of the memory space loop,
only some of the memory spaces need to be cleaned up.

At the error handler, idx holds the number of successful
memory spaces mapped.  So rework the handler loop to use the
old idx.

There is a second problem, the memory space loop conditionally
iomaps()/sets the mem_base so it is necessay to initize pci.

Fixes: 719f82d3987a ("ALSA: Add support of AudioScience ASI boards")
Signed-off-by: Tom Rix <trix@redhat.com>
Link: https://lore.kernel.org/r/20200913165230.17166-1-trix@redhat.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/asihpi/hpioctl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c
index 7a32abbe0cef..4bdcb7443b1f 100644
--- a/sound/pci/asihpi/hpioctl.c
+++ b/sound/pci/asihpi/hpioctl.c
@@ -346,7 +346,7 @@ int asihpi_adapter_probe(struct pci_dev *pci_dev,
 	struct hpi_message hm;
 	struct hpi_response hr;
 	struct hpi_adapter adapter;
-	struct hpi_pci pci;
+	struct hpi_pci pci = { 0 };
 
 	memset(&adapter, 0, sizeof(adapter));
 
@@ -502,7 +502,7 @@ int asihpi_adapter_probe(struct pci_dev *pci_dev,
 	return 0;
 
 err:
-	for (idx = 0; idx < HPI_MAX_ADAPTER_MEM_SPACES; idx++) {
+	while (--idx >= 0) {
 		if (pci.ap_mem_base[idx]) {
 			iounmap(pci.ap_mem_base[idx]);
 			pci.ap_mem_base[idx] = NULL;

From 8ae25ddb7f84d62aebfaf8f94b1b9ec7dd7e66d2 Mon Sep 17 00:00:00 2001
From: Wei Li <liwei391@huawei.com>
Date: Wed, 23 Sep 2020 14:53:12 +0800
Subject: [PATCH 0701/2658] MIPS: Add the missing 'CPU_1074K' into
 __get_cpu_type()

[ Upstream commit e393fbe6fa27af23f78df6e16a8fd2963578a8c4 ]

Commit 442e14a2c55e ("MIPS: Add 1074K CPU support explicitly.") split
1074K from the 74K as an unique CPU type, while it missed to add the
'CPU_1074K' in __get_cpu_type(). So let's add it back.

Fixes: 442e14a2c55e ("MIPS: Add 1074K CPU support explicitly.")
Signed-off-by: Wei Li <liwei391@huawei.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/include/asm/cpu-type.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/include/asm/cpu-type.h b/arch/mips/include/asm/cpu-type.h
index abee2bfd10dc..cea0bbb71590 100644
--- a/arch/mips/include/asm/cpu-type.h
+++ b/arch/mips/include/asm/cpu-type.h
@@ -46,6 +46,7 @@ static inline int __pure __get_cpu_type(const int cpu_type)
 	case CPU_34K:
 	case CPU_1004K:
 	case CPU_74K:
+	case CPU_1074K:
 	case CPU_M14KC:
 	case CPU_M14KEC:
 	case CPU_INTERAPTIV:

From ee040afaad035333d1399ec8bb88304c25630249 Mon Sep 17 00:00:00 2001
From: Jiri Slaby <jslaby@suse.cz>
Date: Thu, 23 Jun 2016 13:34:26 +0200
Subject: [PATCH 0702/2658] tty: vt, consw->con_scrolldelta cleanup

commit 97293de977365fe672daec2523e66ef457104921 upstream.

* allow NULL consw->con_scrolldelta (some consoles define an empty
  hook)
* => remove empty hooks now
* return value of consw->con_scrolldelta is never checked => make the
  function void
* document consw->con_scrolldelta a bit

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Thomas Winischhofer <thomas@winischhofer.net>
Cc: linux-usb@vger.kernel.org
Cc: Jean-Christophe Plagniol-Villard <plagnioj@jcrosoft.com>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: "James E.J. Bottomley" <jejb@parisc-linux.org>
Cc: Helge Deller <deller@gmx.de>
Cc: linux-fbdev@vger.kernel.org
Cc: linux-parisc@vger.kernel.org
Cc: Ajay Kaher <akaher@vmware.com>
[ for 4.4.y backport, only do the first change above, to prevent
.con_scrolldelta from being called if not present - gregkh]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/vt/vt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 0e4f54832fc7..01aeffcdf984 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -2484,7 +2484,7 @@ static void console_callback(struct work_struct *ignored)
 	if (scrollback_delta) {
 		struct vc_data *vc = vc_cons[fg_console].d;
 		clear_selection();
-		if (vc->vc_mode == KD_TEXT)
+		if (vc->vc_mode == KD_TEXT && vc->vc_sw->con_scrolldelta)
 			vc->vc_sw->con_scrolldelta(vc, scrollback_delta);
 		scrollback_delta = 0;
 	}

From 391c6f4b9c2893c83ec33fec3d9b22920bdd8d66 Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: Tue, 1 Sep 2020 00:12:07 +0900
Subject: [PATCH 0703/2658] kprobes: Fix to check probe enabled before
 disarm_kprobe_ftrace()

commit 3031313eb3d549b7ad6f9fbcc52ba04412e3eb9e upstream.

Commit 0cb2f1372baa ("kprobes: Fix NULL pointer dereference at
kprobe_ftrace_handler") fixed one bug but not completely fixed yet.
If we run a kprobe_module.tc of ftracetest, kernel showed a warning
as below.

# ./ftracetest test.d/kprobe/kprobe_module.tc
=== Ftrace unit tests ===
[1] Kprobe dynamic event - probing module
...
[   22.400215] ------------[ cut here ]------------
[   22.400962] Failed to disarm kprobe-ftrace at trace_printk_irq_work+0x0/0x7e [trace_printk] (-2)
[   22.402139] WARNING: CPU: 7 PID: 200 at kernel/kprobes.c:1091 __disarm_kprobe_ftrace.isra.0+0x7e/0xa0
[   22.403358] Modules linked in: trace_printk(-)
[   22.404028] CPU: 7 PID: 200 Comm: rmmod Not tainted 5.9.0-rc2+ #66
[   22.404870] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014
[   22.406139] RIP: 0010:__disarm_kprobe_ftrace.isra.0+0x7e/0xa0
[   22.406947] Code: 30 8b 03 eb c9 80 3d e5 09 1f 01 00 75 dc 49 8b 34 24 89 c2 48 c7 c7 a0 c2 05 82 89 45 e4 c6 05 cc 09 1f 01 01 e8 a9 c7 f0 ff <0f> 0b 8b 45 e4 eb b9 89 c6 48 c7 c7 70 c2 05 82 89 45 e4 e8 91 c7
[   22.409544] RSP: 0018:ffffc90000237df0 EFLAGS: 00010286
[   22.410385] RAX: 0000000000000000 RBX: ffffffff83066024 RCX: 0000000000000000
[   22.411434] RDX: 0000000000000001 RSI: ffffffff810de8d3 RDI: ffffffff810de8d3
[   22.412687] RBP: ffffc90000237e10 R08: 0000000000000001 R09: 0000000000000001
[   22.413762] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88807c478640
[   22.414852] R13: ffffffff8235ebc0 R14: ffffffffa00060c0 R15: 0000000000000000
[   22.415941] FS:  00000000019d48c0(0000) GS:ffff88807d7c0000(0000) knlGS:0000000000000000
[   22.417264] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   22.418176] CR2: 00000000005bb7e3 CR3: 0000000078f7a000 CR4: 00000000000006a0
[   22.419309] Call Trace:
[   22.419990]  kill_kprobe+0x94/0x160
[   22.420652]  kprobes_module_callback+0x64/0x230
[   22.421470]  notifier_call_chain+0x4f/0x70
[   22.422184]  blocking_notifier_call_chain+0x49/0x70
[   22.422979]  __x64_sys_delete_module+0x1ac/0x240
[   22.423733]  do_syscall_64+0x38/0x50
[   22.424366]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   22.425176] RIP: 0033:0x4bb81d
[   22.425741] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e0 ff ff ff f7 d8 64 89 01 48
[   22.428726] RSP: 002b:00007ffc70fef008 EFLAGS: 00000246 ORIG_RAX: 00000000000000b0
[   22.430169] RAX: ffffffffffffffda RBX: 00000000019d48a0 RCX: 00000000004bb81d
[   22.431375] RDX: 0000000000000000 RSI: 0000000000000880 RDI: 00007ffc70fef028
[   22.432543] RBP: 0000000000000880 R08: 00000000ffffffff R09: 00007ffc70fef320
[   22.433692] R10: 0000000000656300 R11: 0000000000000246 R12: 00007ffc70fef028
[   22.434635] R13: 0000000000000000 R14: 0000000000000002 R15: 0000000000000000
[   22.435682] irq event stamp: 1169
[   22.436240] hardirqs last  enabled at (1179): [<ffffffff810df542>] console_unlock+0x422/0x580
[   22.437466] hardirqs last disabled at (1188): [<ffffffff810df19b>] console_unlock+0x7b/0x580
[   22.438608] softirqs last  enabled at (866): [<ffffffff81c0038e>] __do_softirq+0x38e/0x490
[   22.439637] softirqs last disabled at (859): [<ffffffff81a00f42>] asm_call_on_stack+0x12/0x20
[   22.440690] ---[ end trace 1e7ce7e1e4567276 ]---
[   22.472832] trace_kprobe: This probe might be able to register after target module is loaded. Continue.

This is because the kill_kprobe() calls disarm_kprobe_ftrace() even
if the given probe is not enabled. In that case, ftrace_set_filter_ip()
fails because the given probe point is not registered to ftrace.

Fix to check the given (going) probe is enabled before invoking
disarm_kprobe_ftrace().

Link: https://lkml.kernel.org/r/159888672694.1411785.5987998076694782591.stgit@devnote2

Fixes: 0cb2f1372baa ("kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler")
Cc: Ingo Molnar <mingo@kernel.org>
Cc: "Naveen N . Rao" <naveen.n.rao@linux.ibm.com>
Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
Cc: David Miller <davem@davemloft.net>
Cc: Muchun Song <songmuchun@bytedance.com>
Cc: Chengming Zhou <zhouchengming@bytedance.com>
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/kprobes.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 574f650eb818..33c37dbc56a0 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -2035,9 +2035,10 @@ static void kill_kprobe(struct kprobe *p)
 
 	/*
 	 * The module is going away. We should disarm the kprobe which
-	 * is using ftrace.
+	 * is using ftrace, because ftrace framework is still available at
+	 * MODULE_STATE_GOING notification.
 	 */
-	if (kprobe_ftrace(p))
+	if (kprobe_ftrace(p) && !kprobe_disabled(p) && !kprobes_all_disarmed)
 		disarm_kprobe_ftrace(p);
 }
 

From 77bdd567ee264a6801eb02a168d7743a526d0414 Mon Sep 17 00:00:00 2001
From: Nick Desaulniers <ndesaulniers@google.com>
Date: Fri, 25 Sep 2020 21:19:18 -0700
Subject: [PATCH 0704/2658] lib/string.c: implement stpcpy

commit 1e1b6d63d6340764e00356873e5794225a2a03ea upstream.

LLVM implemented a recent "libcall optimization" that lowers calls to
`sprintf(dest, "%s", str)` where the return value is used to
`stpcpy(dest, str) - dest`.

This generally avoids the machinery involved in parsing format strings.
`stpcpy` is just like `strcpy` except it returns the pointer to the new
tail of `dest`.  This optimization was introduced into clang-12.

Implement this so that we don't observe linkage failures due to missing
symbol definitions for `stpcpy`.

Similar to last year's fire drill with: commit 5f074f3e192f
("lib/string.c: implement a basic bcmp")

The kernel is somewhere between a "freestanding" environment (no full
libc) and "hosted" environment (many symbols from libc exist with the
same type, function signature, and semantics).

As Peter Anvin notes, there's not really a great way to inform the
compiler that you're targeting a freestanding environment but would like
to opt-in to some libcall optimizations (see pr/47280 below), rather
than opt-out.

Arvind notes, -fno-builtin-* behaves slightly differently between GCC
and Clang, and Clang is missing many __builtin_* definitions, which I
consider a bug in Clang and am working on fixing.

Masahiro summarizes the subtle distinction between compilers justly:
  To prevent transformation from foo() into bar(), there are two ways in
  Clang to do that; -fno-builtin-foo, and -fno-builtin-bar.  There is
  only one in GCC; -fno-buitin-foo.

(Any difference in that behavior in Clang is likely a bug from a missing
__builtin_* definition.)

Masahiro also notes:
  We want to disable optimization from foo() to bar(),
  but we may still benefit from the optimization from
  foo() into something else. If GCC implements the same transform, we
  would run into a problem because it is not -fno-builtin-bar, but
  -fno-builtin-foo that disables that optimization.

  In this regard, -fno-builtin-foo would be more future-proof than
  -fno-built-bar, but -fno-builtin-foo is still potentially overkill. We
  may want to prevent calls from foo() being optimized into calls to
  bar(), but we still may want other optimization on calls to foo().

It seems that compilers today don't quite provide the fine grain control
over which libcall optimizations pseudo-freestanding environments would
prefer.

Finally, Kees notes that this interface is unsafe, so we should not
encourage its use.  As such, I've removed the declaration from any
header, but it still needs to be exported to avoid linkage errors in
modules.

Reported-by: Sami Tolvanen <samitolvanen@google.com>
Suggested-by: Andy Lavr <andy.lavr@gmail.com>
Suggested-by: Arvind Sankar <nivedita@alum.mit.edu>
Suggested-by: Joe Perches <joe@perches.com>
Suggested-by: Kees Cook <keescook@chromium.org>
Suggested-by: Masahiro Yamada <masahiroy@kernel.org>
Suggested-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Nathan Chancellor <natechancellor@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20200914161643.938408-1-ndesaulniers@google.com
Link: https://bugs.llvm.org/show_bug.cgi?id=47162
Link: https://bugs.llvm.org/show_bug.cgi?id=47280
Link: https://github.com/ClangBuiltLinux/linux/issues/1126
Link: https://man7.org/linux/man-pages/man3/stpcpy.3.html
Link: https://pubs.opengroup.org/onlinepubs/9699919799/functions/stpcpy.html
Link: https://reviews.llvm.org/D85963
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/string.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/lib/string.c b/lib/string.c
index c7cf65ac42ad..c9983dc01e72 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -235,6 +235,30 @@ ssize_t strscpy(char *dest, const char *src, size_t count)
 EXPORT_SYMBOL(strscpy);
 #endif
 
+/**
+ * stpcpy - copy a string from src to dest returning a pointer to the new end
+ *          of dest, including src's %NUL-terminator. May overrun dest.
+ * @dest: pointer to end of string being copied into. Must be large enough
+ *        to receive copy.
+ * @src: pointer to the beginning of string being copied from. Must not overlap
+ *       dest.
+ *
+ * stpcpy differs from strcpy in a key way: the return value is a pointer
+ * to the new %NUL-terminating character in @dest. (For strcpy, the return
+ * value is a pointer to the start of @dest). This interface is considered
+ * unsafe as it doesn't perform bounds checking of the inputs. As such it's
+ * not recommended for usage. Instead, its definition is provided in case
+ * the compiler lowers other libcalls to stpcpy.
+ */
+char *stpcpy(char *__restrict__ dest, const char *__restrict__ src);
+char *stpcpy(char *__restrict__ dest, const char *__restrict__ src)
+{
+	while ((*dest++ = *src++) != '\0')
+		/* nothing */;
+	return --dest;
+}
+EXPORT_SYMBOL(stpcpy);
+
 #ifndef __HAVE_ARCH_STRCAT
 /**
  * strcat - Append one %NUL-terminated string to another

From 2270dbb382bafbc073db28d7877429172dd7e782 Mon Sep 17 00:00:00 2001
From: Jiri Slaby <jslaby@suse.cz>
Date: Thu, 31 Oct 2019 10:59:44 +0100
Subject: [PATCH 0705/2658] ata: define AC_ERR_OK

commit 25937580a5065d6fbd92d9c8ebd47145ad80052e upstream.

Since we will return enum ata_completion_errors from qc_prep in the next
patch, let's define AC_ERR_OK to mark the OK status.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: linux-ide@vger.kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/libata.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/linux/libata.h b/include/linux/libata.h
index af561d33221d..446121d1b7b3 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -500,6 +500,7 @@ enum hsm_task_states {
 };
 
 enum ata_completion_errors {
+	AC_ERR_OK		= 0,	    /* no error */
 	AC_ERR_DEV		= (1 << 0), /* device reported error */
 	AC_ERR_HSM		= (1 << 1), /* host state machine violation */
 	AC_ERR_TIMEOUT		= (1 << 2), /* timeout */

From df742fed6c487d108f7891de9190abfec6f7e88b Mon Sep 17 00:00:00 2001
From: Jiri Slaby <jslaby@suse.cz>
Date: Thu, 31 Oct 2019 10:59:45 +0100
Subject: [PATCH 0706/2658] ata: make qc_prep return ata_completion_errors

commit 95364f36701e62dd50eee91e1303187fd1a9f567 upstream.

In case a driver wants to return an error from qc_prep, return enum
ata_completion_errors. sata_mv is one of those drivers -- see the next
patch. Other drivers return the newly defined AC_ERR_OK.

[v2] use enum ata_completion_errors and AC_ERR_OK.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: linux-ide@vger.kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/DocBook/libata.tmpl |  2 +-
 drivers/ata/acard-ahci.c          |  6 ++++--
 drivers/ata/libahci.c             |  6 ++++--
 drivers/ata/libata-core.c         |  9 +++++++--
 drivers/ata/libata-sff.c          | 12 ++++++++----
 drivers/ata/pata_macio.c          |  6 ++++--
 drivers/ata/pata_pxa.c            |  8 +++++---
 drivers/ata/pdc_adma.c            |  7 ++++---
 drivers/ata/sata_fsl.c            |  4 +++-
 drivers/ata/sata_inic162x.c       |  4 +++-
 drivers/ata/sata_mv.c             | 26 +++++++++++++++-----------
 drivers/ata/sata_nv.c             | 18 +++++++++++-------
 drivers/ata/sata_promise.c        |  6 ++++--
 drivers/ata/sata_qstor.c          |  8 +++++---
 drivers/ata/sata_rcar.c           |  6 ++++--
 drivers/ata/sata_sil.c            |  8 +++++---
 drivers/ata/sata_sil24.c          |  6 ++++--
 drivers/ata/sata_sx4.c            |  6 ++++--
 include/linux/libata.h            | 12 ++++++------
 19 files changed, 101 insertions(+), 59 deletions(-)

diff --git a/Documentation/DocBook/libata.tmpl b/Documentation/DocBook/libata.tmpl
index d7fcdc5a4379..9b55778ab024 100644
--- a/Documentation/DocBook/libata.tmpl
+++ b/Documentation/DocBook/libata.tmpl
@@ -324,7 +324,7 @@ Many legacy IDE drivers use ata_bmdma_status() as the bmdma_status() hook.
 
 	<sect2><title>High-level taskfile hooks</title>
 	<programlisting>
-void (*qc_prep) (struct ata_queued_cmd *qc);
+enum ata_completion_errors (*qc_prep) (struct ata_queued_cmd *qc);
 int (*qc_issue) (struct ata_queued_cmd *qc);
 	</programlisting>
 
diff --git a/drivers/ata/acard-ahci.c b/drivers/ata/acard-ahci.c
index ed6a30cd681a..98581ae397c1 100644
--- a/drivers/ata/acard-ahci.c
+++ b/drivers/ata/acard-ahci.c
@@ -72,7 +72,7 @@ struct acard_sg {
 	__le32			size;	 /* bit 31 (EOT) max==0x10000 (64k) */
 };
 
-static void acard_ahci_qc_prep(struct ata_queued_cmd *qc);
+static enum ata_completion_errors acard_ahci_qc_prep(struct ata_queued_cmd *qc);
 static bool acard_ahci_qc_fill_rtf(struct ata_queued_cmd *qc);
 static int acard_ahci_port_start(struct ata_port *ap);
 static int acard_ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
@@ -257,7 +257,7 @@ static unsigned int acard_ahci_fill_sg(struct ata_queued_cmd *qc, void *cmd_tbl)
 	return si;
 }
 
-static void acard_ahci_qc_prep(struct ata_queued_cmd *qc)
+static enum ata_completion_errors acard_ahci_qc_prep(struct ata_queued_cmd *qc)
 {
 	struct ata_port *ap = qc->ap;
 	struct ahci_port_priv *pp = ap->private_data;
@@ -295,6 +295,8 @@ static void acard_ahci_qc_prep(struct ata_queued_cmd *qc)
 		opts |= AHCI_CMD_ATAPI | AHCI_CMD_PREFETCH;
 
 	ahci_fill_cmd_slot(pp, qc->tag, opts);
+
+	return AC_ERR_OK;
 }
 
 static bool acard_ahci_qc_fill_rtf(struct ata_queued_cmd *qc)
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 1241cecfcfca..48338da2ecdf 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -71,7 +71,7 @@ static int ahci_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
 static bool ahci_qc_fill_rtf(struct ata_queued_cmd *qc);
 static int ahci_port_start(struct ata_port *ap);
 static void ahci_port_stop(struct ata_port *ap);
-static void ahci_qc_prep(struct ata_queued_cmd *qc);
+static enum ata_completion_errors ahci_qc_prep(struct ata_queued_cmd *qc);
 static int ahci_pmp_qc_defer(struct ata_queued_cmd *qc);
 static void ahci_freeze(struct ata_port *ap);
 static void ahci_thaw(struct ata_port *ap);
@@ -1535,7 +1535,7 @@ static int ahci_pmp_qc_defer(struct ata_queued_cmd *qc)
 		return sata_pmp_qc_defer_cmd_switch(qc);
 }
 
-static void ahci_qc_prep(struct ata_queued_cmd *qc)
+static enum ata_completion_errors ahci_qc_prep(struct ata_queued_cmd *qc)
 {
 	struct ata_port *ap = qc->ap;
 	struct ahci_port_priv *pp = ap->private_data;
@@ -1571,6 +1571,8 @@ static void ahci_qc_prep(struct ata_queued_cmd *qc)
 		opts |= AHCI_CMD_ATAPI | AHCI_CMD_PREFETCH;
 
 	ahci_fill_cmd_slot(pp, qc->tag, opts);
+
+	return AC_ERR_OK;
 }
 
 static void ahci_fbs_dec_intr(struct ata_port *ap)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 17cebfe5acc8..8ed3f6d75ff1 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4713,7 +4713,10 @@ int ata_std_qc_defer(struct ata_queued_cmd *qc)
 	return ATA_DEFER_LINK;
 }
 
-void ata_noop_qc_prep(struct ata_queued_cmd *qc) { }
+enum ata_completion_errors ata_noop_qc_prep(struct ata_queued_cmd *qc)
+{
+	return AC_ERR_OK;
+}
 
 /**
  *	ata_sg_init - Associate command with scatter-gather table.
@@ -5126,7 +5129,9 @@ void ata_qc_issue(struct ata_queued_cmd *qc)
 		return;
 	}
 
-	ap->ops->qc_prep(qc);
+	qc->err_mask |= ap->ops->qc_prep(qc);
+	if (unlikely(qc->err_mask))
+		goto err;
 	trace_ata_qc_issue(qc);
 	qc->err_mask |= ap->ops->qc_issue(qc);
 	if (unlikely(qc->err_mask))
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 1d8901fc0bfa..0c69bc1d30c6 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -2741,12 +2741,14 @@ static void ata_bmdma_fill_sg_dumb(struct ata_queued_cmd *qc)
  *	LOCKING:
  *	spin_lock_irqsave(host lock)
  */
-void ata_bmdma_qc_prep(struct ata_queued_cmd *qc)
+enum ata_completion_errors ata_bmdma_qc_prep(struct ata_queued_cmd *qc)
 {
 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
-		return;
+		return AC_ERR_OK;
 
 	ata_bmdma_fill_sg(qc);
+
+	return AC_ERR_OK;
 }
 EXPORT_SYMBOL_GPL(ata_bmdma_qc_prep);
 
@@ -2759,12 +2761,14 @@ EXPORT_SYMBOL_GPL(ata_bmdma_qc_prep);
  *	LOCKING:
  *	spin_lock_irqsave(host lock)
  */
-void ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc)
+enum ata_completion_errors ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc)
 {
 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
-		return;
+		return AC_ERR_OK;
 
 	ata_bmdma_fill_sg_dumb(qc);
+
+	return AC_ERR_OK;
 }
 EXPORT_SYMBOL_GPL(ata_bmdma_dumb_qc_prep);
 
diff --git a/drivers/ata/pata_macio.c b/drivers/ata/pata_macio.c
index e3d4b059fcd1..f1a20d1a65be 100644
--- a/drivers/ata/pata_macio.c
+++ b/drivers/ata/pata_macio.c
@@ -507,7 +507,7 @@ static int pata_macio_cable_detect(struct ata_port *ap)
 	return ATA_CBL_PATA40;
 }
 
-static void pata_macio_qc_prep(struct ata_queued_cmd *qc)
+static enum ata_completion_errors pata_macio_qc_prep(struct ata_queued_cmd *qc)
 {
 	unsigned int write = (qc->tf.flags & ATA_TFLAG_WRITE);
 	struct ata_port *ap = qc->ap;
@@ -520,7 +520,7 @@ static void pata_macio_qc_prep(struct ata_queued_cmd *qc)
 		   __func__, qc, qc->flags, write, qc->dev->devno);
 
 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
-		return;
+		return AC_ERR_OK;
 
 	table = (struct dbdma_cmd *) priv->dma_table_cpu;
 
@@ -565,6 +565,8 @@ static void pata_macio_qc_prep(struct ata_queued_cmd *qc)
 	table->command = cpu_to_le16(DBDMA_STOP);
 
 	dev_dbgdma(priv->dev, "%s: %d DMA list entries\n", __func__, pi);
+
+	return AC_ERR_OK;
 }
 
 
diff --git a/drivers/ata/pata_pxa.c b/drivers/ata/pata_pxa.c
index f6c46e9a4dc0..d7186a503e35 100644
--- a/drivers/ata/pata_pxa.c
+++ b/drivers/ata/pata_pxa.c
@@ -59,25 +59,27 @@ static void pxa_ata_dma_irq(void *d)
 /*
  * Prepare taskfile for submission.
  */
-static void pxa_qc_prep(struct ata_queued_cmd *qc)
+static enum ata_completion_errors pxa_qc_prep(struct ata_queued_cmd *qc)
 {
 	struct pata_pxa_data *pd = qc->ap->private_data;
 	struct dma_async_tx_descriptor *tx;
 	enum dma_transfer_direction dir;
 
 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
-		return;
+		return AC_ERR_OK;
 
 	dir = (qc->dma_dir == DMA_TO_DEVICE ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM);
 	tx = dmaengine_prep_slave_sg(pd->dma_chan, qc->sg, qc->n_elem, dir,
 				     DMA_PREP_INTERRUPT);
 	if (!tx) {
 		ata_dev_err(qc->dev, "prep_slave_sg() failed\n");
-		return;
+		return AC_ERR_OK;
 	}
 	tx->callback = pxa_ata_dma_irq;
 	tx->callback_param = pd;
 	pd->dma_cookie = dmaengine_submit(tx);
+
+	return AC_ERR_OK;
 }
 
 /*
diff --git a/drivers/ata/pdc_adma.c b/drivers/ata/pdc_adma.c
index 64d682c6ee57..11da13bea2c9 100644
--- a/drivers/ata/pdc_adma.c
+++ b/drivers/ata/pdc_adma.c
@@ -132,7 +132,7 @@ static int adma_ata_init_one(struct pci_dev *pdev,
 				const struct pci_device_id *ent);
 static int adma_port_start(struct ata_port *ap);
 static void adma_port_stop(struct ata_port *ap);
-static void adma_qc_prep(struct ata_queued_cmd *qc);
+static enum ata_completion_errors adma_qc_prep(struct ata_queued_cmd *qc);
 static unsigned int adma_qc_issue(struct ata_queued_cmd *qc);
 static int adma_check_atapi_dma(struct ata_queued_cmd *qc);
 static void adma_freeze(struct ata_port *ap);
@@ -311,7 +311,7 @@ static int adma_fill_sg(struct ata_queued_cmd *qc)
 	return i;
 }
 
-static void adma_qc_prep(struct ata_queued_cmd *qc)
+static enum ata_completion_errors adma_qc_prep(struct ata_queued_cmd *qc)
 {
 	struct adma_port_priv *pp = qc->ap->private_data;
 	u8  *buf = pp->pkt;
@@ -322,7 +322,7 @@ static void adma_qc_prep(struct ata_queued_cmd *qc)
 
 	adma_enter_reg_mode(qc->ap);
 	if (qc->tf.protocol != ATA_PROT_DMA)
-		return;
+		return AC_ERR_OK;
 
 	buf[i++] = 0;	/* Response flags */
 	buf[i++] = 0;	/* reserved */
@@ -387,6 +387,7 @@ static void adma_qc_prep(struct ata_queued_cmd *qc)
 			printk("%s\n", obuf);
 	}
 #endif
+	return AC_ERR_OK;
 }
 
 static inline void adma_packet_start(struct ata_queued_cmd *qc)
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index a723ae929783..100b5a3621ef 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -513,7 +513,7 @@ static unsigned int sata_fsl_fill_sg(struct ata_queued_cmd *qc, void *cmd_desc,
 	return num_prde;
 }
 
-static void sata_fsl_qc_prep(struct ata_queued_cmd *qc)
+static enum ata_completion_errors sata_fsl_qc_prep(struct ata_queued_cmd *qc)
 {
 	struct ata_port *ap = qc->ap;
 	struct sata_fsl_port_priv *pp = ap->private_data;
@@ -559,6 +559,8 @@ static void sata_fsl_qc_prep(struct ata_queued_cmd *qc)
 
 	VPRINTK("SATA FSL : xx_qc_prep, di = 0x%x, ttl = %d, num_prde = %d\n",
 		desc_info, ttl_dwords, num_prde);
+
+	return AC_ERR_OK;
 }
 
 static unsigned int sata_fsl_qc_issue(struct ata_queued_cmd *qc)
diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
index e81a8217f1ff..349a175f0267 100644
--- a/drivers/ata/sata_inic162x.c
+++ b/drivers/ata/sata_inic162x.c
@@ -472,7 +472,7 @@ static void inic_fill_sg(struct inic_prd *prd, struct ata_queued_cmd *qc)
 	prd[-1].flags |= PRD_END;
 }
 
-static void inic_qc_prep(struct ata_queued_cmd *qc)
+static enum ata_completion_errors inic_qc_prep(struct ata_queued_cmd *qc)
 {
 	struct inic_port_priv *pp = qc->ap->private_data;
 	struct inic_pkt *pkt = pp->pkt;
@@ -532,6 +532,8 @@ static void inic_qc_prep(struct ata_queued_cmd *qc)
 		inic_fill_sg(prd, qc);
 
 	pp->cpb_tbl[0] = pp->pkt_dma;
+
+	return AC_ERR_OK;
 }
 
 static unsigned int inic_qc_issue(struct ata_queued_cmd *qc)
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 729f26322095..ad9dcc574f85 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -605,8 +605,8 @@ static int mv5_scr_write(struct ata_link *link, unsigned int sc_reg_in, u32 val)
 static int mv_port_start(struct ata_port *ap);
 static void mv_port_stop(struct ata_port *ap);
 static int mv_qc_defer(struct ata_queued_cmd *qc);
-static void mv_qc_prep(struct ata_queued_cmd *qc);
-static void mv_qc_prep_iie(struct ata_queued_cmd *qc);
+static enum ata_completion_errors mv_qc_prep(struct ata_queued_cmd *qc);
+static enum ata_completion_errors mv_qc_prep_iie(struct ata_queued_cmd *qc);
 static unsigned int mv_qc_issue(struct ata_queued_cmd *qc);
 static int mv_hardreset(struct ata_link *link, unsigned int *class,
 			unsigned long deadline);
@@ -2046,7 +2046,7 @@ static void mv_rw_multi_errata_sata24(struct ata_queued_cmd *qc)
  *      LOCKING:
  *      Inherited from caller.
  */
-static void mv_qc_prep(struct ata_queued_cmd *qc)
+static enum ata_completion_errors mv_qc_prep(struct ata_queued_cmd *qc)
 {
 	struct ata_port *ap = qc->ap;
 	struct mv_port_priv *pp = ap->private_data;
@@ -2058,15 +2058,15 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
 	switch (tf->protocol) {
 	case ATA_PROT_DMA:
 		if (tf->command == ATA_CMD_DSM)
-			return;
+			return AC_ERR_OK;
 		/* fall-thru */
 	case ATA_PROT_NCQ:
 		break;	/* continue below */
 	case ATA_PROT_PIO:
 		mv_rw_multi_errata_sata24(qc);
-		return;
+		return AC_ERR_OK;
 	default:
-		return;
+		return AC_ERR_OK;
 	}
 
 	/* Fill in command request block
@@ -2131,8 +2131,10 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
 	mv_crqb_pack_cmd(cw++, tf->command, ATA_REG_CMD, 1);	/* last */
 
 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
-		return;
+		return AC_ERR_OK;
 	mv_fill_sg(qc);
+
+	return AC_ERR_OK;
 }
 
 /**
@@ -2147,7 +2149,7 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
  *      LOCKING:
  *      Inherited from caller.
  */
-static void mv_qc_prep_iie(struct ata_queued_cmd *qc)
+static enum ata_completion_errors mv_qc_prep_iie(struct ata_queued_cmd *qc)
 {
 	struct ata_port *ap = qc->ap;
 	struct mv_port_priv *pp = ap->private_data;
@@ -2158,9 +2160,9 @@ static void mv_qc_prep_iie(struct ata_queued_cmd *qc)
 
 	if ((tf->protocol != ATA_PROT_DMA) &&
 	    (tf->protocol != ATA_PROT_NCQ))
-		return;
+		return AC_ERR_OK;
 	if (tf->command == ATA_CMD_DSM)
-		return;  /* use bmdma for this */
+		return AC_ERR_OK;  /* use bmdma for this */
 
 	/* Fill in Gen IIE command request block */
 	if (!(tf->flags & ATA_TFLAG_WRITE))
@@ -2201,8 +2203,10 @@ static void mv_qc_prep_iie(struct ata_queued_cmd *qc)
 		);
 
 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
-		return;
+		return AC_ERR_OK;
 	mv_fill_sg(qc);
+
+	return AC_ERR_OK;
 }
 
 /**
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index 734f563b8d37..bb098c4ae177 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -313,7 +313,7 @@ static void nv_ck804_freeze(struct ata_port *ap);
 static void nv_ck804_thaw(struct ata_port *ap);
 static int nv_adma_slave_config(struct scsi_device *sdev);
 static int nv_adma_check_atapi_dma(struct ata_queued_cmd *qc);
-static void nv_adma_qc_prep(struct ata_queued_cmd *qc);
+static enum ata_completion_errors nv_adma_qc_prep(struct ata_queued_cmd *qc);
 static unsigned int nv_adma_qc_issue(struct ata_queued_cmd *qc);
 static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance);
 static void nv_adma_irq_clear(struct ata_port *ap);
@@ -335,7 +335,7 @@ static void nv_mcp55_freeze(struct ata_port *ap);
 static void nv_swncq_error_handler(struct ata_port *ap);
 static int nv_swncq_slave_config(struct scsi_device *sdev);
 static int nv_swncq_port_start(struct ata_port *ap);
-static void nv_swncq_qc_prep(struct ata_queued_cmd *qc);
+static enum ata_completion_errors nv_swncq_qc_prep(struct ata_queued_cmd *qc);
 static void nv_swncq_fill_sg(struct ata_queued_cmd *qc);
 static unsigned int nv_swncq_qc_issue(struct ata_queued_cmd *qc);
 static void nv_swncq_irq_clear(struct ata_port *ap, u16 fis);
@@ -1382,7 +1382,7 @@ static int nv_adma_use_reg_mode(struct ata_queued_cmd *qc)
 	return 1;
 }
 
-static void nv_adma_qc_prep(struct ata_queued_cmd *qc)
+static enum ata_completion_errors nv_adma_qc_prep(struct ata_queued_cmd *qc)
 {
 	struct nv_adma_port_priv *pp = qc->ap->private_data;
 	struct nv_adma_cpb *cpb = &pp->cpb[qc->tag];
@@ -1394,7 +1394,7 @@ static void nv_adma_qc_prep(struct ata_queued_cmd *qc)
 			(qc->flags & ATA_QCFLAG_DMAMAP));
 		nv_adma_register_mode(qc->ap);
 		ata_bmdma_qc_prep(qc);
-		return;
+		return AC_ERR_OK;
 	}
 
 	cpb->resp_flags = NV_CPB_RESP_DONE;
@@ -1426,6 +1426,8 @@ static void nv_adma_qc_prep(struct ata_queued_cmd *qc)
 	cpb->ctl_flags = ctl_flags;
 	wmb();
 	cpb->resp_flags = 0;
+
+	return AC_ERR_OK;
 }
 
 static unsigned int nv_adma_qc_issue(struct ata_queued_cmd *qc)
@@ -1989,17 +1991,19 @@ static int nv_swncq_port_start(struct ata_port *ap)
 	return 0;
 }
 
-static void nv_swncq_qc_prep(struct ata_queued_cmd *qc)
+static enum ata_completion_errors nv_swncq_qc_prep(struct ata_queued_cmd *qc)
 {
 	if (qc->tf.protocol != ATA_PROT_NCQ) {
 		ata_bmdma_qc_prep(qc);
-		return;
+		return AC_ERR_OK;
 	}
 
 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
-		return;
+		return AC_ERR_OK;
 
 	nv_swncq_fill_sg(qc);
+
+	return AC_ERR_OK;
 }
 
 static void nv_swncq_fill_sg(struct ata_queued_cmd *qc)
diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
index 0fa211e2831c..8ad8b376a642 100644
--- a/drivers/ata/sata_promise.c
+++ b/drivers/ata/sata_promise.c
@@ -155,7 +155,7 @@ static int pdc_sata_scr_write(struct ata_link *link, unsigned int sc_reg, u32 va
 static int pdc_ata_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
 static int pdc_common_port_start(struct ata_port *ap);
 static int pdc_sata_port_start(struct ata_port *ap);
-static void pdc_qc_prep(struct ata_queued_cmd *qc);
+static enum ata_completion_errors pdc_qc_prep(struct ata_queued_cmd *qc);
 static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
 static void pdc_exec_command_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
 static int pdc_check_atapi_dma(struct ata_queued_cmd *qc);
@@ -649,7 +649,7 @@ static void pdc_fill_sg(struct ata_queued_cmd *qc)
 	prd[idx - 1].flags_len |= cpu_to_le32(ATA_PRD_EOT);
 }
 
-static void pdc_qc_prep(struct ata_queued_cmd *qc)
+static enum ata_completion_errors pdc_qc_prep(struct ata_queued_cmd *qc)
 {
 	struct pdc_port_priv *pp = qc->ap->private_data;
 	unsigned int i;
@@ -681,6 +681,8 @@ static void pdc_qc_prep(struct ata_queued_cmd *qc)
 	default:
 		break;
 	}
+
+	return AC_ERR_OK;
 }
 
 static int pdc_is_sataii_tx4(unsigned long flags)
diff --git a/drivers/ata/sata_qstor.c b/drivers/ata/sata_qstor.c
index af987a4f33d1..80ff3bbfc826 100644
--- a/drivers/ata/sata_qstor.c
+++ b/drivers/ata/sata_qstor.c
@@ -116,7 +116,7 @@ static int qs_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
 static int qs_ata_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
 static int qs_port_start(struct ata_port *ap);
 static void qs_host_stop(struct ata_host *host);
-static void qs_qc_prep(struct ata_queued_cmd *qc);
+static enum ata_completion_errors qs_qc_prep(struct ata_queued_cmd *qc);
 static unsigned int qs_qc_issue(struct ata_queued_cmd *qc);
 static int qs_check_atapi_dma(struct ata_queued_cmd *qc);
 static void qs_freeze(struct ata_port *ap);
@@ -276,7 +276,7 @@ static unsigned int qs_fill_sg(struct ata_queued_cmd *qc)
 	return si;
 }
 
-static void qs_qc_prep(struct ata_queued_cmd *qc)
+static enum ata_completion_errors qs_qc_prep(struct ata_queued_cmd *qc)
 {
 	struct qs_port_priv *pp = qc->ap->private_data;
 	u8 dflags = QS_DF_PORD, *buf = pp->pkt;
@@ -288,7 +288,7 @@ static void qs_qc_prep(struct ata_queued_cmd *qc)
 
 	qs_enter_reg_mode(qc->ap);
 	if (qc->tf.protocol != ATA_PROT_DMA)
-		return;
+		return AC_ERR_OK;
 
 	nelem = qs_fill_sg(qc);
 
@@ -311,6 +311,8 @@ static void qs_qc_prep(struct ata_queued_cmd *qc)
 
 	/* frame information structure (FIS) */
 	ata_tf_to_fis(&qc->tf, 0, 1, &buf[32]);
+
+	return AC_ERR_OK;
 }
 
 static inline void qs_packet_start(struct ata_queued_cmd *qc)
diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
index 21b80f5ee092..4199f7a39be0 100644
--- a/drivers/ata/sata_rcar.c
+++ b/drivers/ata/sata_rcar.c
@@ -551,12 +551,14 @@ static void sata_rcar_bmdma_fill_sg(struct ata_queued_cmd *qc)
 	prd[si - 1].addr |= cpu_to_le32(SATA_RCAR_DTEND);
 }
 
-static void sata_rcar_qc_prep(struct ata_queued_cmd *qc)
+static enum ata_completion_errors sata_rcar_qc_prep(struct ata_queued_cmd *qc)
 {
 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
-		return;
+		return AC_ERR_OK;
 
 	sata_rcar_bmdma_fill_sg(qc);
+
+	return AC_ERR_OK;
 }
 
 static void sata_rcar_bmdma_setup(struct ata_queued_cmd *qc)
diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
index 29bcff086bce..73156a301912 100644
--- a/drivers/ata/sata_sil.c
+++ b/drivers/ata/sata_sil.c
@@ -119,7 +119,7 @@ static void sil_dev_config(struct ata_device *dev);
 static int sil_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val);
 static int sil_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
 static int sil_set_mode(struct ata_link *link, struct ata_device **r_failed);
-static void sil_qc_prep(struct ata_queued_cmd *qc);
+static enum ata_completion_errors sil_qc_prep(struct ata_queued_cmd *qc);
 static void sil_bmdma_setup(struct ata_queued_cmd *qc);
 static void sil_bmdma_start(struct ata_queued_cmd *qc);
 static void sil_bmdma_stop(struct ata_queued_cmd *qc);
@@ -333,12 +333,14 @@ static void sil_fill_sg(struct ata_queued_cmd *qc)
 		last_prd->flags_len |= cpu_to_le32(ATA_PRD_EOT);
 }
 
-static void sil_qc_prep(struct ata_queued_cmd *qc)
+static enum ata_completion_errors sil_qc_prep(struct ata_queued_cmd *qc)
 {
 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
-		return;
+		return AC_ERR_OK;
 
 	sil_fill_sg(qc);
+
+	return AC_ERR_OK;
 }
 
 static unsigned char sil_get_device_cache_line(struct pci_dev *pdev)
diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
index 4b1995e2d044..ffa3bf724054 100644
--- a/drivers/ata/sata_sil24.c
+++ b/drivers/ata/sata_sil24.c
@@ -336,7 +336,7 @@ static void sil24_dev_config(struct ata_device *dev);
 static int sil24_scr_read(struct ata_link *link, unsigned sc_reg, u32 *val);
 static int sil24_scr_write(struct ata_link *link, unsigned sc_reg, u32 val);
 static int sil24_qc_defer(struct ata_queued_cmd *qc);
-static void sil24_qc_prep(struct ata_queued_cmd *qc);
+static enum ata_completion_errors sil24_qc_prep(struct ata_queued_cmd *qc);
 static unsigned int sil24_qc_issue(struct ata_queued_cmd *qc);
 static bool sil24_qc_fill_rtf(struct ata_queued_cmd *qc);
 static void sil24_pmp_attach(struct ata_port *ap);
@@ -840,7 +840,7 @@ static int sil24_qc_defer(struct ata_queued_cmd *qc)
 	return ata_std_qc_defer(qc);
 }
 
-static void sil24_qc_prep(struct ata_queued_cmd *qc)
+static enum ata_completion_errors sil24_qc_prep(struct ata_queued_cmd *qc)
 {
 	struct ata_port *ap = qc->ap;
 	struct sil24_port_priv *pp = ap->private_data;
@@ -884,6 +884,8 @@ static void sil24_qc_prep(struct ata_queued_cmd *qc)
 
 	if (qc->flags & ATA_QCFLAG_DMAMAP)
 		sil24_fill_sg(qc, sge);
+
+	return AC_ERR_OK;
 }
 
 static unsigned int sil24_qc_issue(struct ata_queued_cmd *qc)
diff --git a/drivers/ata/sata_sx4.c b/drivers/ata/sata_sx4.c
index fab504fd9cfd..a7cd2c7ee138 100644
--- a/drivers/ata/sata_sx4.c
+++ b/drivers/ata/sata_sx4.c
@@ -218,7 +218,7 @@ static void pdc_error_handler(struct ata_port *ap);
 static void pdc_freeze(struct ata_port *ap);
 static void pdc_thaw(struct ata_port *ap);
 static int pdc_port_start(struct ata_port *ap);
-static void pdc20621_qc_prep(struct ata_queued_cmd *qc);
+static enum ata_completion_errors pdc20621_qc_prep(struct ata_queued_cmd *qc);
 static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
 static void pdc_exec_command_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
 static unsigned int pdc20621_dimm_init(struct ata_host *host);
@@ -546,7 +546,7 @@ static void pdc20621_nodata_prep(struct ata_queued_cmd *qc)
 	VPRINTK("ata pkt buf ofs %u, mmio copied\n", i);
 }
 
-static void pdc20621_qc_prep(struct ata_queued_cmd *qc)
+static enum ata_completion_errors pdc20621_qc_prep(struct ata_queued_cmd *qc)
 {
 	switch (qc->tf.protocol) {
 	case ATA_PROT_DMA:
@@ -558,6 +558,8 @@ static void pdc20621_qc_prep(struct ata_queued_cmd *qc)
 	default:
 		break;
 	}
+
+	return AC_ERR_OK;
 }
 
 static void __pdc20621_push_hdma(struct ata_queued_cmd *qc,
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 446121d1b7b3..ec49344f7555 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -897,9 +897,9 @@ struct ata_port_operations {
 	/*
 	 * Command execution
 	 */
-	int  (*qc_defer)(struct ata_queued_cmd *qc);
-	int  (*check_atapi_dma)(struct ata_queued_cmd *qc);
-	void (*qc_prep)(struct ata_queued_cmd *qc);
+	int (*qc_defer)(struct ata_queued_cmd *qc);
+	int (*check_atapi_dma)(struct ata_queued_cmd *qc);
+	enum ata_completion_errors (*qc_prep)(struct ata_queued_cmd *qc);
 	unsigned int (*qc_issue)(struct ata_queued_cmd *qc);
 	bool (*qc_fill_rtf)(struct ata_queued_cmd *qc);
 
@@ -1191,7 +1191,7 @@ extern int ata_xfer_mode2shift(unsigned long xfer_mode);
 extern const char *ata_mode_string(unsigned long xfer_mask);
 extern unsigned long ata_id_xfermask(const u16 *id);
 extern int ata_std_qc_defer(struct ata_queued_cmd *qc);
-extern void ata_noop_qc_prep(struct ata_queued_cmd *qc);
+extern enum ata_completion_errors ata_noop_qc_prep(struct ata_queued_cmd *qc);
 extern void ata_sg_init(struct ata_queued_cmd *qc, struct scatterlist *sg,
 		 unsigned int n_elem);
 extern unsigned int ata_dev_classify(const struct ata_taskfile *tf);
@@ -1882,9 +1882,9 @@ extern const struct ata_port_operations ata_bmdma_port_ops;
 	.sg_tablesize		= LIBATA_MAX_PRD,		\
 	.dma_boundary		= ATA_DMA_BOUNDARY
 
-extern void ata_bmdma_qc_prep(struct ata_queued_cmd *qc);
+extern enum ata_completion_errors ata_bmdma_qc_prep(struct ata_queued_cmd *qc);
 extern unsigned int ata_bmdma_qc_issue(struct ata_queued_cmd *qc);
-extern void ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc);
+extern enum ata_completion_errors ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc);
 extern unsigned int ata_bmdma_port_intr(struct ata_port *ap,
 				      struct ata_queued_cmd *qc);
 extern irqreturn_t ata_bmdma_interrupt(int irq, void *dev_instance);

From 52723644c1451c67199129f5f6541fb862008520 Mon Sep 17 00:00:00 2001
From: Jiri Slaby <jslaby@suse.cz>
Date: Thu, 31 Oct 2019 10:59:46 +0100
Subject: [PATCH 0707/2658] ata: sata_mv, avoid trigerrable BUG_ON

commit e9f691d899188679746eeb96e6cb520459eda9b4 upstream.

There are several reports that the BUG_ON on unsupported command in
mv_qc_prep can be triggered under some circumstances:
https://bugzilla.suse.com/show_bug.cgi?id=1110252
https://serverfault.com/questions/888897/raid-problems-after-power-outage
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1652185
https://bugs.centos.org/view.php?id=14998

Let sata_mv handle the failure gracefully: warn about that incl. the
failed command number and return an AC_ERR_INVALID error. We can do that
now thanks to the previous patch.

Remove also the long-standing FIXME.

[v2] use %.2x as commands are defined as hexa.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: linux-ide@vger.kernel.org
Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ata/sata_mv.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index ad9dcc574f85..5718dc94c90c 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -2113,12 +2113,10 @@ static enum ata_completion_errors mv_qc_prep(struct ata_queued_cmd *qc)
 		 * non-NCQ mode are: [RW] STREAM DMA and W DMA FUA EXT, none
 		 * of which are defined/used by Linux.  If we get here, this
 		 * driver needs work.
-		 *
-		 * FIXME: modify libata to give qc_prep a return value and
-		 * return error here.
 		 */
-		BUG_ON(tf->command);
-		break;
+		ata_port_err(ap, "%s: unsupported command: %.2x\n", __func__,
+				tf->command);
+		return AC_ERR_INVALID;
 	}
 	mv_crqb_pack_cmd(cw++, tf->nsect, ATA_REG_NSECT, 0);
 	mv_crqb_pack_cmd(cw++, tf->hob_lbal, ATA_REG_LBAL, 0);

From 724f64ed12a86dc88dedda9d9716116bd32e0713 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 1 Oct 2020 11:11:58 +0200
Subject: [PATCH 0708/2658] Linux 4.4.238

Link: https://lore.kernel.org/r/20200929105928.198942536@linuxfoundation.org
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index c814888201fb..7b0e6ec88caa 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 237
+SUBLEVEL = 238
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 6f663bdd1f298e19edaba785a271bb5ad4ba438e Mon Sep 17 00:00:00 2001
From: dillon min <dillon.minfei@gmail.com>
Date: Thu, 3 Sep 2020 15:30:21 +0800
Subject: [PATCH 0709/2658] gpio: tc35894: fix up tc35894 interrupt
 configuration

commit 214b0e1ad01abf4c1f6d8d28fa096bf167e47cef upstream.

The offset of regmap is incorrect, j * 8 is move to the
wrong register.

for example:

asume i = 0, j = 1. we want to set KPY5 as interrupt
falling edge mode, regmap[0][1] should be TC3589x_GPIOIBE1 0xcd
but, regmap[i] + j * 8 = TC3589x_GPIOIBE0 + 8 ,point to 0xd4,
this is TC3589x_GPIOIE2 not TC3589x_GPIOIBE1.

Fixes: d88b25be3584 ("gpio: Add TC35892 GPIO driver")
Cc: Cc: stable@vger.kernel.org
Signed-off-by: dillon min <dillon.minfei@gmail.com>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpio/gpio-tc3589x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpio/gpio-tc3589x.c b/drivers/gpio/gpio-tc3589x.c
index d1d585ddb9ab..dd19805d587d 100644
--- a/drivers/gpio/gpio-tc3589x.c
+++ b/drivers/gpio/gpio-tc3589x.c
@@ -157,7 +157,7 @@ static void tc3589x_gpio_irq_sync_unlock(struct irq_data *d)
 				continue;
 
 			tc3589x_gpio->oldregs[i][j] = new;
-			tc3589x_reg_write(tc3589x, regmap[i] + j * 8, new);
+			tc3589x_reg_write(tc3589x, regmap[i] + j, new);
 		}
 	}
 

From 97b55c18971c3cf5f5e00daaf44c32d11688a362 Mon Sep 17 00:00:00 2001
From: Jiri Kosina <jkosina@suse.cz>
Date: Mon, 28 Sep 2020 16:21:17 -0700
Subject: [PATCH 0710/2658] Input: i8042 - add nopnp quirk for Acer Aspire 5
 A515
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 5fc27b098dafb8e30794a9db0705074c7d766179 upstream.

Touchpad on this laptop is not detected properly during boot, as PNP
enumerates (wrongly) AUX port as disabled on this machine.

Fix that by adding this board (with admittedly quite funny DMI
identifiers) to nopnp quirk list.

Reported-by: Andrés Barrantes Silman <andresbs2000@protonmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Link: https://lore.kernel.org/r/nycvar.YFH.7.76.2009252337340.3336@cbobk.fhfr.pm
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/serio/i8042-x86ia64io.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index e5799639fb54..82ff44637ed7 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -797,6 +797,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nopnp_table[] = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
 		},
 	},
+	{
+		/* Acer Aspire 5 A515 */
+		.matches = {
+			DMI_MATCH(DMI_BOARD_NAME, "Grumpy_PK"),
+			DMI_MATCH(DMI_BOARD_VENDOR, "PK"),
+		},
+	},
 	{ }
 };
 

From 037e111fe93715360a661638dd9472459f6d81f3 Mon Sep 17 00:00:00 2001
From: Jean Delvare <jdelvare@suse.de>
Date: Mon, 28 Sep 2020 11:10:37 +0200
Subject: [PATCH 0711/2658] drm/amdgpu: restore proper ref count in
 amdgpu_display_crtc_set_config

commit a39d0d7bdf8c21ac7645c02e9676b5cb2b804c31 upstream.

A recent attempt to fix a ref count leak in
amdgpu_display_crtc_set_config() turned out to be doing too much and
"fixed" an intended decrease as if it were a leak. Undo that part to
restore the proper balance. This is the very nature of this function
to increase or decrease the power reference count depending on the
situation.

Consequences of this bug is that the power reference would
eventually get down to 0 while the display was still in use,
resulting in that display switching off unexpectedly.

Signed-off-by: Jean Delvare <jdelvare@suse.de>
Fixes: e008fa6fb415 ("drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config")
Cc: stable@vger.kernel.org
Cc: Navid Emamdoost <navid.emamdoost@gmail.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
index d3ee8f19f1ef..5ff941bbfb5b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -311,7 +311,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set)
 	   take the current one */
 	if (active && !adev->have_disp_power_ref) {
 		adev->have_disp_power_ref = true;
-		goto out;
+		return ret;
 	}
 	/* if we have no active crtcs, then drop the power ref
 	   we got before */

From 91c036a2dc0bd9961cedebf83efcab75a0158e0a Mon Sep 17 00:00:00 2001
From: Lucy Yan <lucyyan@google.com>
Date: Thu, 10 Sep 2020 12:05:09 -0700
Subject: [PATCH 0712/2658] net: dec: de2104x: Increase receive ring size for
 Tulip

[ Upstream commit ee460417d254d941dfea5fb7cff841f589643992 ]

Increase Rx ring size to address issue where hardware is reaching
the receive work limit.

Before:

[  102.223342] de2104x 0000:17:00.0 eth0: rx work limit reached
[  102.245695] de2104x 0000:17:00.0 eth0: rx work limit reached
[  102.251387] de2104x 0000:17:00.0 eth0: rx work limit reached
[  102.267444] de2104x 0000:17:00.0 eth0: rx work limit reached

Signed-off-by: Lucy Yan <lucyyan@google.com>
Reviewed-by: Moritz Fischer <mdf@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/dec/tulip/de2104x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/dec/tulip/de2104x.c b/drivers/net/ethernet/dec/tulip/de2104x.c
index cadcee645f74..11ce50a05799 100644
--- a/drivers/net/ethernet/dec/tulip/de2104x.c
+++ b/drivers/net/ethernet/dec/tulip/de2104x.c
@@ -91,7 +91,7 @@ MODULE_PARM_DESC (rx_copybreak, "de2104x Breakpoint at which Rx packets are copi
 #define DSL			CONFIG_DE2104X_DSL
 #endif
 
-#define DE_RX_RING_SIZE		64
+#define DE_RX_RING_SIZE		128
 #define DE_TX_RING_SIZE		64
 #define DE_RING_BYTES		\
 		((sizeof(struct de_desc) * DE_RX_RING_SIZE) +	\

From 98c4d869ada074bdd0d970e23466107f1037ce08 Mon Sep 17 00:00:00 2001
From: Olympia Giannou <ogiannou@gmail.com>
Date: Fri, 11 Sep 2020 14:17:24 +0000
Subject: [PATCH 0713/2658] rndis_host: increase sleep time in the
 query-response loop

[ Upstream commit 4202c9fdf03d79dedaa94b2c4cf574f25793d669 ]

Some WinCE devices face connectivity issues via the NDIS interface. They
fail to register, resulting in -110 timeout errors and failures during the
probe procedure.

In this kind of WinCE devices, the Windows-side ndis driver needs quite
more time to be loaded and configured, so that the linux rndis host queries
to them fail to be responded correctly on time.

More specifically, when INIT is called on the WinCE side - no other
requests can be served by the Client and this results in a failed QUERY
afterwards.

The increase of the waiting time on the side of the linux rndis host in
the command-response loop leaves the INIT process to complete and respond
to a QUERY, which comes afterwards. The WinCE devices with this special
"feature" in their ndis driver are satisfied by this fix.

Signed-off-by: Olympia Giannou <olympia.giannou@leica-geosystems.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/rndis_host.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index 524a47a28120..b20b380d91bf 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -213,7 +213,7 @@ int rndis_command(struct usbnet *dev, struct rndis_msg_hdr *buf, int buflen)
 			dev_dbg(&info->control->dev,
 				"rndis response error, code %d\n", retval);
 		}
-		msleep(20);
+		msleep(40);
 	}
 	dev_dbg(&info->control->dev, "rndis response timeout\n");
 	return -ETIMEDOUT;

From 2aa429908f5e0d81b3797cfc30629221639e1a84 Mon Sep 17 00:00:00 2001
From: Xie He <xie.he.0141@gmail.com>
Date: Wed, 16 Sep 2020 09:49:18 -0700
Subject: [PATCH 0714/2658] drivers/net/wan/lapbether: Make skb->protocol
 consistent with the header

[ Upstream commit 83f9a9c8c1edc222846dc1bde6e3479703e8e5a3 ]

This driver is a virtual driver stacked on top of Ethernet interfaces.

When this driver transmits data on the Ethernet device, the skb->protocol
setting is inconsistent with the Ethernet header prepended to the skb.

This causes a user listening on the Ethernet interface with an AF_PACKET
socket, to see different sll_protocol values for incoming and outgoing
frames, because incoming frames would have this value set by parsing the
Ethernet header.

This patch changes the skb->protocol value for outgoing Ethernet frames,
making it consistent with the Ethernet header prepended. This makes a
user listening on the Ethernet device with an AF_PACKET socket, to see
the same sll_protocol value for incoming and outgoing frames.

Cc: Martin Schiller <ms@dev.tdt.de>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wan/lapbether.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index c6db9a4e7c45..ef746ba74ab4 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -201,8 +201,6 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb)
 	struct net_device *dev;
 	int size = skb->len;
 
-	skb->protocol = htons(ETH_P_X25);
-
 	ptr = skb_push(skb, 2);
 
 	*ptr++ = size % 256;
@@ -213,6 +211,8 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb)
 
 	skb->dev = dev = lapbeth->ethdev;
 
+	skb->protocol = htons(ETH_P_DEC);
+
 	skb_reset_network_header(skb);
 
 	dev_hard_header(skb, dev, ETH_P_DEC, bcast_addr, NULL, 0);

From c9cc218caa9d47664d3e29115aba0c7e6a052030 Mon Sep 17 00:00:00 2001
From: Xie He <xie.he.0141@gmail.com>
Date: Wed, 16 Sep 2020 14:25:07 -0700
Subject: [PATCH 0715/2658] drivers/net/wan/hdlc: Set skb->protocol before
 transmitting

[ Upstream commit 9fb030a70431a2a2a1b292dbf0b2f399cc072c16 ]

This patch sets skb->protocol before transmitting frames on the HDLC
device, so that a user listening on the HDLC device with an AF_PACKET
socket will see outgoing frames' sll_protocol field correctly set and
consistent with that of incoming frames.

1. Control frames in hdlc_cisco and hdlc_ppp

When these drivers send control frames, skb->protocol is not set.

This value should be set to htons(ETH_P_HDLC), because when receiving
control frames, their skb->protocol is set to htons(ETH_P_HDLC).

When receiving, hdlc_type_trans in hdlc.h is called, which then calls
cisco_type_trans or ppp_type_trans. The skb->protocol of control frames
is set to htons(ETH_P_HDLC) so that the control frames can be received
by hdlc_rcv in hdlc.c, which calls cisco_rx or ppp_rx to process the
control frames.

2. hdlc_fr

When this driver sends control frames, skb->protocol is set to internal
values used in this driver.

When this driver sends data frames (from upper stacked PVC devices),
skb->protocol is the same as that of the user data packet being sent on
the upper PVC device (for normal PVC devices), or is htons(ETH_P_802_3)
(for Ethernet-emulating PVC devices).

However, skb->protocol for both control frames and data frames should be
set to htons(ETH_P_HDLC), because when receiving, all frames received on
the HDLC device will have their skb->protocol set to htons(ETH_P_HDLC).

When receiving, hdlc_type_trans in hdlc.h is called, and because this
driver doesn't provide a type_trans function in struct hdlc_proto,
all frames will have their skb->protocol set to htons(ETH_P_HDLC).
The frames are then received by hdlc_rcv in hdlc.c, which calls fr_rx
to process the frames (control frames are consumed and data frames
are re-received on upper PVC devices).

Cc: Krzysztof Halasa <khc@pm.waw.pl>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wan/hdlc_cisco.c | 1 +
 drivers/net/wan/hdlc_fr.c    | 3 +++
 drivers/net/wan/hdlc_ppp.c   | 1 +
 3 files changed, 5 insertions(+)

diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c
index f8ed079d8bc3..7a6f851d9843 100644
--- a/drivers/net/wan/hdlc_cisco.c
+++ b/drivers/net/wan/hdlc_cisco.c
@@ -120,6 +120,7 @@ static void cisco_keepalive_send(struct net_device *dev, u32 type,
 	skb_put(skb, sizeof(struct cisco_packet));
 	skb->priority = TC_PRIO_CONTROL;
 	skb->dev = dev;
+	skb->protocol = htons(ETH_P_HDLC);
 	skb_reset_network_header(skb);
 
 	dev_queue_xmit(skb);
diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
index 89541cc90e87..74d46f7e77ea 100644
--- a/drivers/net/wan/hdlc_fr.c
+++ b/drivers/net/wan/hdlc_fr.c
@@ -435,6 +435,8 @@ static netdev_tx_t pvc_xmit(struct sk_buff *skb, struct net_device *dev)
 			if (pvc->state.fecn) /* TX Congestion counter */
 				dev->stats.tx_compressed++;
 			skb->dev = pvc->frad;
+			skb->protocol = htons(ETH_P_HDLC);
+			skb_reset_network_header(skb);
 			dev_queue_xmit(skb);
 			return NETDEV_TX_OK;
 		}
@@ -557,6 +559,7 @@ static void fr_lmi_send(struct net_device *dev, int fullrep)
 	skb_put(skb, i);
 	skb->priority = TC_PRIO_CONTROL;
 	skb->dev = dev;
+	skb->protocol = htons(ETH_P_HDLC);
 	skb_reset_network_header(skb);
 
 	dev_queue_xmit(skb);
diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c
index a2559f213dae..473a9b8ec9ba 100644
--- a/drivers/net/wan/hdlc_ppp.c
+++ b/drivers/net/wan/hdlc_ppp.c
@@ -254,6 +254,7 @@ static void ppp_tx_cp(struct net_device *dev, u16 pid, u8 code,
 
 	skb->priority = TC_PRIO_CONTROL;
 	skb->dev = dev;
+	skb->protocol = htons(ETH_P_HDLC);
 	skb_reset_network_header(skb);
 	skb_queue_tail(&tx_queue, skb);
 }

From c4bbbc05deaa8eacfbebb085a454f1e49a71d672 Mon Sep 17 00:00:00 2001
From: Jeffrey Mitchell <jeffrey.mitchell@starlab.io>
Date: Tue, 15 Sep 2020 16:42:52 -0500
Subject: [PATCH 0716/2658] nfs: Fix security label length not being reset

[ Upstream commit d33030e2ee3508d65db5644551435310df86010e ]

nfs_readdir_page_filler() iterates over entries in a directory, reusing
the same security label buffer, but does not reset the buffer's length.
This causes decode_attr_security_label() to return -ERANGE if an entry's
security label is longer than the previous one's. This error, in
nfs4_decode_dirent(), only gets passed up as -EAGAIN, which causes another
failed attempt to copy into the buffer. The second error is ignored and
the remaining entries do not show up in ls, specifically the getdents64()
syscall.

Reproduce by creating multiple files in NFS and giving one of the later
files a longer security label. ls will not see that file nor any that are
added afterwards, though they will exist on the backend.

In nfs_readdir_page_filler(), reset security label buffer length before
every reuse

Signed-off-by: Jeffrey Mitchell <jeffrey.mitchell@starlab.io>
Fixes: b4487b935452 ("nfs: Fix getxattr kernel panic and memory overflow")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/dir.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 21e5fcbcb227..ba7e98d8ce09 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -562,6 +562,9 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en
 	xdr_set_scratch_buffer(&stream, page_address(scratch), PAGE_SIZE);
 
 	do {
+		if (entry->label)
+			entry->label->len = NFS4_MAXLABELLEN;
+
 		status = xdr_decode(desc, entry, &stream);
 		if (status != 0) {
 			if (status == -EAGAIN)

From 5fd8a0384097ed6ab0f74cb490c586a138dd9e02 Mon Sep 17 00:00:00 2001
From: Marek Szyprowski <m.szyprowski@samsung.com>
Date: Tue, 22 Sep 2020 14:40:46 +0200
Subject: [PATCH 0717/2658] clk: samsung: exynos4: mark 'chipid' clock as
 CLK_IGNORE_UNUSED

[ Upstream commit f3bb0f796f5ffe32f0fbdce5b1b12eb85511158f ]

The ChipID IO region has it's own clock, which is being disabled while
scanning for unused clocks. It turned out that some CPU hotplug, CPU idle
or even SOC firmware code depends on the reads from that area. Fix the
mysterious hang caused by entering deep CPU idle state by ignoring the
'chipid' clock during unused clocks scan, as there are no direct clients
for it which will keep it enabled.

Fixes: e062b571777f ("clk: exynos4: register clocks using common clock framework")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20200922124046.10496-1-m.szyprowski@samsung.com
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/samsung/clk-exynos4.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
index 6c8e45e007c8..8edbb20ccff5 100644
--- a/drivers/clk/samsung/clk-exynos4.c
+++ b/drivers/clk/samsung/clk-exynos4.c
@@ -1059,7 +1059,7 @@ static struct samsung_gate_clock exynos4210_gate_clks[] __initdata = {
 	GATE(CLK_PCIE, "pcie", "aclk133", GATE_IP_FSYS, 14, 0, 0),
 	GATE(CLK_SMMU_PCIE, "smmu_pcie", "aclk133", GATE_IP_FSYS, 18, 0, 0),
 	GATE(CLK_MODEMIF, "modemif", "aclk100", GATE_IP_PERIL, 28, 0, 0),
-	GATE(CLK_CHIPID, "chipid", "aclk100", E4210_GATE_IP_PERIR, 0, 0, 0),
+	GATE(CLK_CHIPID, "chipid", "aclk100", E4210_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0),
 	GATE(CLK_SYSREG, "sysreg", "aclk100", E4210_GATE_IP_PERIR, 0,
 			CLK_IGNORE_UNUSED, 0),
 	GATE(CLK_HDMI_CEC, "hdmi_cec", "aclk100", E4210_GATE_IP_PERIR, 11, 0,
@@ -1100,7 +1100,7 @@ static struct samsung_gate_clock exynos4x12_gate_clks[] __initdata = {
 		0),
 	GATE(CLK_TSADC, "tsadc", "aclk133", E4X12_GATE_BUS_FSYS1, 16, 0, 0),
 	GATE(CLK_MIPI_HSI, "mipi_hsi", "aclk133", GATE_IP_FSYS, 10, 0, 0),
-	GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, 0, 0),
+	GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0),
 	GATE(CLK_SYSREG, "sysreg", "aclk100", E4X12_GATE_IP_PERIR, 1,
 			CLK_IGNORE_UNUSED, 0),
 	GATE(CLK_HDMI_CEC, "hdmi_cec", "aclk100", E4X12_GATE_IP_PERIR, 11, 0,

From 8761ff7957075a68e316032a116944882f558152 Mon Sep 17 00:00:00 2001
From: Yu Kuai <yukuai3@huawei.com>
Date: Fri, 18 Sep 2020 09:13:35 +0800
Subject: [PATCH 0718/2658] iommu/exynos: add missing put_device() call in
 exynos_iommu_of_xlate()

[ Upstream commit 1a26044954a6d1f4d375d5e62392446af663be7a ]

if of_find_device_by_node() succeed, exynos_iommu_of_xlate() doesn't have
a corresponding put_device(). Thus add put_device() to fix the exception
handling for this function implementation.

Fixes: aa759fd376fb ("iommu/exynos: Add callback for initializing devices from device tree")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20200918011335.909141-1-yukuai3@huawei.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/exynos-iommu.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
index 29a31eb9ace3..02df8d9dc842 100644
--- a/drivers/iommu/exynos-iommu.c
+++ b/drivers/iommu/exynos-iommu.c
@@ -1158,13 +1158,17 @@ static int exynos_iommu_of_xlate(struct device *dev,
 		return -ENODEV;
 
 	data = platform_get_drvdata(sysmmu);
-	if (!data)
+	if (!data) {
+		put_device(&sysmmu->dev);
 		return -ENODEV;
+	}
 
 	if (!owner) {
 		owner = kzalloc(sizeof(*owner), GFP_KERNEL);
-		if (!owner)
+		if (!owner) {
+			put_device(&sysmmu->dev);
 			return -ENOMEM;
+		}
 
 		INIT_LIST_HEAD(&owner->controllers);
 		dev->archdata.iommu = owner;

From 57a7419cf2559d3988104be7c7300cd142fea7d0 Mon Sep 17 00:00:00 2001
From: Nicolas VINCENT <nicolas.vincent@vossloh.com>
Date: Wed, 23 Sep 2020 16:08:40 +0200
Subject: [PATCH 0719/2658] i2c: cpm: Fix i2c_ram structure

[ Upstream commit a2bd970aa62f2f7f80fd0d212b1d4ccea5df4aed ]

the i2c_ram structure is missing the sdmatmp field mentionned in
datasheet for MPC8272 at paragraph 36.5. With this field missing, the
hardware would write past the allocated memory done through
cpm_muram_alloc for the i2c_ram structure and land in memory allocated
for the buffers descriptors corrupting the cbd_bufaddr field. Since this
field is only set during setup(), the first i2c transaction would work
and the following would send data read from an arbitrary memory
location.

Fixes: 61045dbe9d8d ("i2c: Add support for I2C bus on Freescale CPM1/CPM2 controllers")
Signed-off-by: Nicolas VINCENT <nicolas.vincent@vossloh.com>
Acked-by: Jochen Friedrich <jochen@scram.de>
Acked-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-cpm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
index b167ab25310a..34a35e927fc6 100644
--- a/drivers/i2c/busses/i2c-cpm.c
+++ b/drivers/i2c/busses/i2c-cpm.c
@@ -74,6 +74,9 @@ struct i2c_ram {
 	char    res1[4];	/* Reserved */
 	ushort  rpbase;		/* Relocation pointer */
 	char    res2[2];	/* Reserved */
+	/* The following elements are only for CPM2 */
+	char    res3[4];	/* Reserved */
+	uint    sdmatmp;	/* Internal */
 };
 
 #define I2COM_START	0x80

From c46e29e3796e57d81a68d882d6ef1acd1f42f24b Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Wed, 9 Sep 2020 22:25:06 -0400
Subject: [PATCH 0720/2658] epoll: do not insert into poll queues until all
 sanity checks are done

commit f8d4f44df056c5b504b0d49683fb7279218fd207 upstream.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/eventpoll.c | 37 ++++++++++++++++++-------------------
 1 file changed, 18 insertions(+), 19 deletions(-)

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 4013e98621c4..2fdcab10ab27 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1307,6 +1307,22 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
 		RCU_INIT_POINTER(epi->ws, NULL);
 	}
 
+	/* Add the current item to the list of active epoll hook for this file */
+	spin_lock(&tfile->f_lock);
+	list_add_tail_rcu(&epi->fllink, &tfile->f_ep_links);
+	spin_unlock(&tfile->f_lock);
+
+	/*
+	 * Add the current item to the RB tree. All RB tree operations are
+	 * protected by "mtx", and ep_insert() is called with "mtx" held.
+	 */
+	ep_rbtree_insert(ep, epi);
+
+	/* now check if we've created too many backpaths */
+	error = -EINVAL;
+	if (full_check && reverse_path_check())
+		goto error_remove_epi;
+
 	/* Initialize the poll table using the queue callback */
 	epq.epi = epi;
 	init_poll_funcptr(&epq.pt, ep_ptable_queue_proc);
@@ -1329,22 +1345,6 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
 	if (epi->nwait < 0)
 		goto error_unregister;
 
-	/* Add the current item to the list of active epoll hook for this file */
-	spin_lock(&tfile->f_lock);
-	list_add_tail_rcu(&epi->fllink, &tfile->f_ep_links);
-	spin_unlock(&tfile->f_lock);
-
-	/*
-	 * Add the current item to the RB tree. All RB tree operations are
-	 * protected by "mtx", and ep_insert() is called with "mtx" held.
-	 */
-	ep_rbtree_insert(ep, epi);
-
-	/* now check if we've created too many backpaths */
-	error = -EINVAL;
-	if (full_check && reverse_path_check())
-		goto error_remove_epi;
-
 	/* We have to drop the new item inside our item list to keep track of it */
 	spin_lock_irqsave(&ep->lock, flags);
 
@@ -1370,6 +1370,8 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
 
 	return 0;
 
+error_unregister:
+	ep_unregister_pollwait(ep, epi);
 error_remove_epi:
 	spin_lock(&tfile->f_lock);
 	list_del_rcu(&epi->fllink);
@@ -1377,9 +1379,6 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
 
 	rb_erase(&epi->rbn, &ep->rbr);
 
-error_unregister:
-	ep_unregister_pollwait(ep, epi);
-
 	/*
 	 * We need to do this because an event could have been arrived on some
 	 * allocated wait queue. Note that we don't care about the ep->ovflist

From b6f671c1ffba44dfb398c0e1beff63eb8f817821 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Thu, 10 Sep 2020 08:30:05 -0400
Subject: [PATCH 0721/2658] epoll: replace ->visited/visited_list with
 generation count

commit 18306c404abe18a0972587a6266830583c60c928 upstream.

removes the need to clear it, along with the races.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/eventpoll.c | 26 +++++++-------------------
 1 file changed, 7 insertions(+), 19 deletions(-)

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 2fdcab10ab27..261099b73fb9 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -218,8 +218,7 @@ struct eventpoll {
 	struct file *file;
 
 	/* used to optimize loop detection check */
-	int visited;
-	struct list_head visited_list_link;
+	u64 gen;
 };
 
 /* Wait structure used by the poll hooks */
@@ -263,6 +262,8 @@ static long max_user_watches __read_mostly;
  */
 static DEFINE_MUTEX(epmutex);
 
+static u64 loop_check_gen = 0;
+
 /* Used to check for epoll file descriptor inclusion loops */
 static struct nested_calls poll_loop_ncalls;
 
@@ -278,9 +279,6 @@ static struct kmem_cache *epi_cache __read_mostly;
 /* Slab cache used to allocate "struct eppoll_entry" */
 static struct kmem_cache *pwq_cache __read_mostly;
 
-/* Visited nodes during ep_loop_check(), so we can unset them when we finish */
-static LIST_HEAD(visited_list);
-
 /*
  * List of files with newly added links, where we may need to limit the number
  * of emanating paths. Protected by the epmutex.
@@ -1700,13 +1698,12 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
 	struct epitem *epi;
 
 	mutex_lock_nested(&ep->mtx, call_nests + 1);
-	ep->visited = 1;
-	list_add(&ep->visited_list_link, &visited_list);
+	ep->gen = loop_check_gen;
 	for (rbp = rb_first(&ep->rbr); rbp; rbp = rb_next(rbp)) {
 		epi = rb_entry(rbp, struct epitem, rbn);
 		if (unlikely(is_file_epoll(epi->ffd.file))) {
 			ep_tovisit = epi->ffd.file->private_data;
-			if (ep_tovisit->visited)
+			if (ep_tovisit->gen == loop_check_gen)
 				continue;
 			error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
 					ep_loop_check_proc, epi->ffd.file,
@@ -1747,18 +1744,8 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
  */
 static int ep_loop_check(struct eventpoll *ep, struct file *file)
 {
-	int ret;
-	struct eventpoll *ep_cur, *ep_next;
-
-	ret = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
+	return ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
 			      ep_loop_check_proc, file, ep, current);
-	/* clear visited list */
-	list_for_each_entry_safe(ep_cur, ep_next, &visited_list,
-							visited_list_link) {
-		ep_cur->visited = 0;
-		list_del(&ep_cur->visited_list_link);
-	}
-	return ret;
 }
 
 static void clear_tfile_check_list(void)
@@ -1960,6 +1947,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
 error_tgt_fput:
 	if (full_check) {
 		clear_tfile_check_list();
+		loop_check_gen++;
 		mutex_unlock(&epmutex);
 	}
 

From 31a3e16f859b4d32af0035b054e0343d4cec5b88 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Thu, 10 Sep 2020 08:33:27 -0400
Subject: [PATCH 0722/2658] epoll: EPOLL_CTL_ADD: close the race in decision to
 take fast path

commit fe0a916c1eae8e17e86c3753d13919177d63ed7e upstream.

Checking for the lack of epitems refering to the epoll we want to insert into
is not enough; we might have an insertion of that epoll into another one that
has already collected the set of files to recheck for excessive reverse paths,
but hasn't gotten to creating/inserting the epitem for it.

However, any such insertion in progress can be detected - it will update the
generation count in our epoll when it's done looking through it for files
to check.  That gets done under ->mtx of our epoll and that allows us to
detect that safely.

We are *not* holding epmutex here, so the generation count is not stable.
However, since both the update of ep->gen by loop check and (later)
insertion into ->f_ep_link are done with ep->mtx held, we are fine -
the sequence is
	grab epmutex
	bump loop_check_gen
	...
	grab tep->mtx		// 1
	tep->gen = loop_check_gen
	...
	drop tep->mtx		// 2
	...
	grab tep->mtx		// 3
	...
	insert into ->f_ep_link
	...
	drop tep->mtx		// 4
	bump loop_check_gen
	drop epmutex
and if the fastpath check in another thread happens for that
eventpoll, it can come
	* before (1) - in that case fastpath is just fine
	* after (4) - we'll see non-empty ->f_ep_link, slow path
taken
	* between (2) and (3) - loop_check_gen is stable,
with ->mtx providing barriers and we end up taking slow path.

Note that ->f_ep_link emptiness check is slightly racy - we are protected
against insertions into that list, but removals can happen right under us.
Not a problem - in the worst case we'll end up taking a slow path for
no good reason.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/eventpoll.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 261099b73fb9..1cc3c9fe39d5 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1889,6 +1889,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
 	mutex_lock_nested(&ep->mtx, 0);
 	if (op == EPOLL_CTL_ADD) {
 		if (!list_empty(&f.file->f_ep_links) ||
+				ep->gen == loop_check_gen ||
 						is_file_epoll(tf.file)) {
 			full_check = 1;
 			mutex_unlock(&ep->mtx);

From b76cf1290a163f4efbcb564dc1a5118fe60673c5 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Thu, 24 Sep 2020 19:41:58 -0400
Subject: [PATCH 0723/2658] ep_create_wakeup_source(): dentry name can change
 under you...

commit 3701cb59d892b88d569427586f01491552f377b1 upstream.

or get freed, for that matter, if it's a long (separately stored)
name.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/eventpoll.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 1cc3c9fe39d5..89a37992a297 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1233,7 +1233,7 @@ static int reverse_path_check(void)
 
 static int ep_create_wakeup_source(struct epitem *epi)
 {
-	const char *name;
+	struct name_snapshot n;
 	struct wakeup_source *ws;
 
 	name = epi->ffd.file->f_path.dentry->d_name.name;
@@ -1245,7 +1245,9 @@ static int ep_create_wakeup_source(struct epitem *epi)
 			return -ENOMEM;
 	}
 
-	ws = wakeup_source_register(name);
+	take_dentry_name_snapshot(&n, epi->ffd.file->f_path.dentry);
+	ws = wakeup_source_register(n.name);
+	release_dentry_name_snapshot(&n);
 
 	if (!ws)
 		return -ENOMEM;

From b826016cea56deec0d445758a0504ce212d9482e Mon Sep 17 00:00:00 2001
From: Will McVicker <willmcvicker@google.com>
Date: Mon, 24 Aug 2020 19:38:32 +0000
Subject: [PATCH 0724/2658] netfilter: ctnetlink: add a range check for l3/l4
 protonum

commit 1cc5ef91d2ff94d2bf2de3b3585423e8a1051cb6 upstream.

The indexes to the nf_nat_l[34]protos arrays come from userspace. So
check the tuple's family, e.g. l3num, when creating the conntrack in
order to prevent an OOB memory access during setup.  Here is an example
kernel panic on 4.14.180 when userspace passes in an index greater than
NFPROTO_NUMPROTO.

Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:...
Process poc (pid: 5614, stack limit = 0x00000000a3933121)
CPU: 4 PID: 5614 Comm: poc Tainted: G S      W  O    4.14.180-g051355490483
Hardware name: Qualcomm Technologies, Inc. SM8150 V2 PM8150 Google Inc. MSM
task: 000000002a3dfffe task.stack: 00000000a3933121
pc : __cfi_check_fail+0x1c/0x24
lr : __cfi_check_fail+0x1c/0x24
...
Call trace:
__cfi_check_fail+0x1c/0x24
name_to_dev_t+0x0/0x468
nfnetlink_parse_nat_setup+0x234/0x258
ctnetlink_parse_nat_setup+0x4c/0x228
ctnetlink_new_conntrack+0x590/0xc40
nfnetlink_rcv_msg+0x31c/0x4d4
netlink_rcv_skb+0x100/0x184
nfnetlink_rcv+0xf4/0x180
netlink_unicast+0x360/0x770
netlink_sendmsg+0x5a0/0x6a4
___sys_sendmsg+0x314/0x46c
SyS_sendmsg+0xb4/0x108
el0_svc_naked+0x34/0x38

This crash is not happening since 5.4+, however, ctnetlink still
allows for creating entries with unsupported layer 3 protocol number.

Fixes: c1d10adb4a521 ("[NETFILTER]: Add ctnetlink port for nf_conntrack")
Signed-off-by: Will McVicker <willmcvicker@google.com>
[pablo@netfilter.org: rebased original patch on top of nf.git]
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/nf_conntrack_netlink.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index f324a1124418..b349b8410ec8 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1022,6 +1022,8 @@ ctnetlink_parse_tuple(const struct nlattr * const cda[],
 	if (!tb[CTA_TUPLE_IP])
 		return -EINVAL;
 
+	if (l3num != NFPROTO_IPV4 && l3num != NFPROTO_IPV6)
+		return -EOPNOTSUPP;
 	tuple->src.l3num = l3num;
 
 	err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple);

From ffcb88143c224b69b200763fad9cec437ff27721 Mon Sep 17 00:00:00 2001
From: Peilin Ye <yepeilin.cs@gmail.com>
Date: Thu, 24 Sep 2020 09:40:53 -0400
Subject: [PATCH 0725/2658] fbdev, newport_con: Move FONT_EXTRA_WORDS macros
 into linux/font.h

commit bb0890b4cd7f8203e3aa99c6d0f062d6acdaad27 upstream.

drivers/video/console/newport_con.c is borrowing FONT_EXTRA_WORDS macros
from drivers/video/fbdev/core/fbcon.h. To keep things simple, move all
definitions into <linux/font.h>.

Since newport_con now uses four extra words, initialize the fourth word in
newport_set_font() properly.

Cc: stable@vger.kernel.org
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/7fb8bc9b0abc676ada6b7ac0e0bd443499357267.1600953813.git.yepeilin.cs@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/console/fbcon.h        | 7 -------
 drivers/video/console/fbcon_rotate.c | 1 +
 drivers/video/console/newport_con.c  | 7 +------
 drivers/video/console/tileblit.c     | 1 +
 include/linux/font.h                 | 8 ++++++++
 5 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/drivers/video/console/fbcon.h b/drivers/video/console/fbcon.h
index 5ebdccd070eb..701eecab3317 100644
--- a/drivers/video/console/fbcon.h
+++ b/drivers/video/console/fbcon.h
@@ -151,13 +151,6 @@ static inline int attr_col_ec(int shift, struct vc_data *vc,
 #define attr_bgcol_ec(bgshift, vc, info) attr_col_ec(bgshift, vc, info, 0)
 #define attr_fgcol_ec(fgshift, vc, info) attr_col_ec(fgshift, vc, info, 1)
 
-/* Font */
-#define REFCOUNT(fd)	(((int *)(fd))[-1])
-#define FNTSIZE(fd)	(((int *)(fd))[-2])
-#define FNTCHARCNT(fd)	(((int *)(fd))[-3])
-#define FNTSUM(fd)	(((int *)(fd))[-4])
-#define FONT_EXTRA_WORDS 4
-
     /*
      *  Scroll Method
      */
diff --git a/drivers/video/console/fbcon_rotate.c b/drivers/video/console/fbcon_rotate.c
index db6528f2d3f2..0e3321081945 100644
--- a/drivers/video/console/fbcon_rotate.c
+++ b/drivers/video/console/fbcon_rotate.c
@@ -14,6 +14,7 @@
 #include <linux/fb.h>
 #include <linux/vt_kern.h>
 #include <linux/console.h>
+#include <linux/font.h>
 #include <asm/types.h>
 #include "fbcon.h"
 #include "fbcon_rotate.h"
diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c
index bd0c6e53bec1..740284a4554c 100644
--- a/drivers/video/console/newport_con.c
+++ b/drivers/video/console/newport_con.c
@@ -35,12 +35,6 @@
 
 #define FONT_DATA ((unsigned char *)font_vga_8x16.data)
 
-/* borrowed from fbcon.c */
-#define REFCOUNT(fd)	(((int *)(fd))[-1])
-#define FNTSIZE(fd)	(((int *)(fd))[-2])
-#define FNTCHARCNT(fd)	(((int *)(fd))[-3])
-#define FONT_EXTRA_WORDS 3
-
 static unsigned char *font_data[MAX_NR_CONSOLES];
 
 static struct newport_regs *npregs;
@@ -522,6 +516,7 @@ static int newport_set_font(int unit, struct console_font *op)
 	FNTSIZE(new_data) = size;
 	FNTCHARCNT(new_data) = op->charcount;
 	REFCOUNT(new_data) = 0;	/* usage counter */
+	FNTSUM(new_data) = 0;
 
 	p = new_data;
 	for (i = 0; i < op->charcount; i++) {
diff --git a/drivers/video/console/tileblit.c b/drivers/video/console/tileblit.c
index 3c0b242dba5f..691717276c3e 100644
--- a/drivers/video/console/tileblit.c
+++ b/drivers/video/console/tileblit.c
@@ -13,6 +13,7 @@
 #include <linux/fb.h>
 #include <linux/vt_kern.h>
 #include <linux/console.h>
+#include <linux/font.h>
 #include <asm/types.h>
 #include "fbcon.h"
 
diff --git a/include/linux/font.h b/include/linux/font.h
index d6821769dd1e..0a3639a00b3a 100644
--- a/include/linux/font.h
+++ b/include/linux/font.h
@@ -57,4 +57,12 @@ extern const struct font_desc *get_default_font(int xres, int yres,
 /* Max. length for the name of a predefined font */
 #define MAX_FONT_NAME	32
 
+/* Extra word getters */
+#define REFCOUNT(fd)	(((int *)(fd))[-1])
+#define FNTSIZE(fd)	(((int *)(fd))[-2])
+#define FNTCHARCNT(fd)	(((int *)(fd))[-3])
+#define FNTSUM(fd)	(((int *)(fd))[-4])
+
+#define FONT_EXTRA_WORDS 4
+
 #endif /* _VIDEO_FONT_H */

From 209adad7d1ff18fdb5d2b9d8f4f1554726fa94ea Mon Sep 17 00:00:00 2001
From: Peilin Ye <yepeilin.cs@gmail.com>
Date: Thu, 24 Sep 2020 09:42:22 -0400
Subject: [PATCH 0726/2658] Fonts: Support FONT_EXTRA_WORDS macros for built-in
 fonts

commit 6735b4632def0640dbdf4eb9f99816aca18c4f16 upstream.

syzbot has reported an issue in the framebuffer layer, where a malicious
user may overflow our built-in font data buffers.

In order to perform a reliable range check, subsystems need to know
`FONTDATAMAX` for each built-in font. Unfortunately, our font descriptor,
`struct console_font` does not contain `FONTDATAMAX`, and is part of the
UAPI, making it infeasible to modify it.

For user-provided fonts, the framebuffer layer resolves this issue by
reserving four extra words at the beginning of data buffers. Later,
whenever a function needs to access them, it simply uses the following
macros:

Recently we have gathered all the above macros to <linux/font.h>. Let us
do the same thing for built-in fonts, prepend four extra words (including
`FONTDATAMAX`) to their data buffers, so that subsystems can use these
macros for all fonts, no matter built-in or user-provided.

This patch depends on patch "fbdev, newport_con: Move FONT_EXTRA_WORDS
macros into linux/font.h".

Cc: stable@vger.kernel.org
Link: https://syzkaller.appspot.com/bug?id=08b8be45afea11888776f897895aef9ad1c3ecfd
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/ef18af00c35fb3cc826048a5f70924ed6ddce95b.1600953813.git.yepeilin.cs@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/font.h       | 5 +++++
 lib/fonts/font_10x18.c     | 9 ++++-----
 lib/fonts/font_6x10.c      | 9 +++++----
 lib/fonts/font_6x11.c      | 9 ++++-----
 lib/fonts/font_7x14.c      | 9 ++++-----
 lib/fonts/font_8x16.c      | 9 ++++-----
 lib/fonts/font_8x8.c       | 9 ++++-----
 lib/fonts/font_acorn_8x8.c | 9 ++++++---
 lib/fonts/font_mini_4x6.c  | 8 ++++----
 lib/fonts/font_pearl_8x8.c | 9 ++++-----
 lib/fonts/font_sun12x22.c  | 9 ++++-----
 lib/fonts/font_sun8x16.c   | 7 ++++---
 12 files changed, 52 insertions(+), 49 deletions(-)

diff --git a/include/linux/font.h b/include/linux/font.h
index 0a3639a00b3a..f85e70bd4793 100644
--- a/include/linux/font.h
+++ b/include/linux/font.h
@@ -65,4 +65,9 @@ extern const struct font_desc *get_default_font(int xres, int yres,
 
 #define FONT_EXTRA_WORDS 4
 
+struct font_data {
+	unsigned int extra[FONT_EXTRA_WORDS];
+	const unsigned char data[];
+} __packed;
+
 #endif /* _VIDEO_FONT_H */
diff --git a/lib/fonts/font_10x18.c b/lib/fonts/font_10x18.c
index 6be72bb218ee..87e904f550c1 100644
--- a/lib/fonts/font_10x18.c
+++ b/lib/fonts/font_10x18.c
@@ -7,8 +7,8 @@
 
 #define FONTDATAMAX 9216
 
-static const unsigned char fontdata_10x18[FONTDATAMAX] = {
-
+static struct font_data fontdata_10x18 = {
+	{ 0, 0, FONTDATAMAX, 0 }, {
 	/* 0 0x00 '^@' */
 	0x00, 0x00, /* 0000000000 */
 	0x00, 0x00, /* 0000000000 */
@@ -5128,8 +5128,7 @@ static const unsigned char fontdata_10x18[FONTDATAMAX] = {
 	0x00, 0x00, /* 0000000000 */
 	0x00, 0x00, /* 0000000000 */
 	0x00, 0x00, /* 0000000000 */
-
-};
+} };
 
 
 const struct font_desc font_10x18 = {
@@ -5137,7 +5136,7 @@ const struct font_desc font_10x18 = {
 	.name	= "10x18",
 	.width	= 10,
 	.height	= 18,
-	.data	= fontdata_10x18,
+	.data	= fontdata_10x18.data,
 #ifdef __sparc__
 	.pref	= 5,
 #else
diff --git a/lib/fonts/font_6x10.c b/lib/fonts/font_6x10.c
index b20620904d31..896ffa987c97 100644
--- a/lib/fonts/font_6x10.c
+++ b/lib/fonts/font_6x10.c
@@ -1,7 +1,9 @@
 #include <linux/font.h>
 
-static const unsigned char fontdata_6x10[] = {
+#define FONTDATAMAX 2560
 
+static struct font_data fontdata_6x10 = {
+	{ 0, 0, FONTDATAMAX, 0 }, {
 	/* 0 0x00 '^@' */
 	0x00, /* 00000000 */
 	0x00, /* 00000000 */
@@ -3073,14 +3075,13 @@ static const unsigned char fontdata_6x10[] = {
 	0x00, /* 00000000 */
 	0x00, /* 00000000 */
 	0x00, /* 00000000 */
-
-};
+} };
 
 const struct font_desc font_6x10 = {
 	.idx	= FONT6x10_IDX,
 	.name	= "6x10",
 	.width	= 6,
 	.height	= 10,
-	.data	= fontdata_6x10,
+	.data	= fontdata_6x10.data,
 	.pref	= 0,
 };
diff --git a/lib/fonts/font_6x11.c b/lib/fonts/font_6x11.c
index 46e86e67aa6a..eb46a59307d2 100644
--- a/lib/fonts/font_6x11.c
+++ b/lib/fonts/font_6x11.c
@@ -8,8 +8,8 @@
 
 #define FONTDATAMAX (11*256)
 
-static const unsigned char fontdata_6x11[FONTDATAMAX] = {
-
+static struct font_data fontdata_6x11 = {
+	{ 0, 0, FONTDATAMAX, 0 }, {
 	/* 0 0x00 '^@' */
 	0x00, /* 00000000 */
 	0x00, /* 00000000 */
@@ -3337,8 +3337,7 @@ static const unsigned char fontdata_6x11[FONTDATAMAX] = {
 	0x00, /* 00000000 */
 	0x00, /* 00000000 */
 	0x00, /* 00000000 */
-
-};
+} };
 
 
 const struct font_desc font_vga_6x11 = {
@@ -3346,7 +3345,7 @@ const struct font_desc font_vga_6x11 = {
 	.name	= "ProFont6x11",
 	.width	= 6,
 	.height	= 11,
-	.data	= fontdata_6x11,
+	.data	= fontdata_6x11.data,
 	/* Try avoiding this font if possible unless on MAC */
 	.pref	= -2000,
 };
diff --git a/lib/fonts/font_7x14.c b/lib/fonts/font_7x14.c
index 3b7dbf9c060b..c88b3bba001b 100644
--- a/lib/fonts/font_7x14.c
+++ b/lib/fonts/font_7x14.c
@@ -7,8 +7,8 @@
 
 #define FONTDATAMAX 3584
 
-static const unsigned char fontdata_7x14[FONTDATAMAX] = {
-
+static struct font_data fontdata_7x14 = {
+	{ 0, 0, FONTDATAMAX, 0 }, {
 	/* 0 0x00 '^@' */
 	0x00, /* 0000000 */
 	0x00, /* 0000000 */
@@ -4104,8 +4104,7 @@ static const unsigned char fontdata_7x14[FONTDATAMAX] = {
 	0x00, /* 0000000 */
 	0x00, /* 0000000 */
 	0x00, /* 0000000 */
-
-};
+} };
 
 
 const struct font_desc font_7x14 = {
@@ -4113,6 +4112,6 @@ const struct font_desc font_7x14 = {
 	.name	= "7x14",
 	.width	= 7,
 	.height	= 14,
-	.data	= fontdata_7x14,
+	.data	= fontdata_7x14.data,
 	.pref	= 0,
 };
diff --git a/lib/fonts/font_8x16.c b/lib/fonts/font_8x16.c
index 00a0c67a5c7d..ba53e2643670 100644
--- a/lib/fonts/font_8x16.c
+++ b/lib/fonts/font_8x16.c
@@ -9,8 +9,8 @@
 
 #define FONTDATAMAX 4096
 
-static const unsigned char fontdata_8x16[FONTDATAMAX] = {
-
+static struct font_data fontdata_8x16 = {
+	{ 0, 0, FONTDATAMAX, 0 }, {
 	/* 0 0x00 '^@' */
 	0x00, /* 00000000 */
 	0x00, /* 00000000 */
@@ -4618,8 +4618,7 @@ static const unsigned char fontdata_8x16[FONTDATAMAX] = {
 	0x00, /* 00000000 */
 	0x00, /* 00000000 */
 	0x00, /* 00000000 */
-
-};
+} };
 
 
 const struct font_desc font_vga_8x16 = {
@@ -4627,7 +4626,7 @@ const struct font_desc font_vga_8x16 = {
 	.name	= "VGA8x16",
 	.width	= 8,
 	.height	= 16,
-	.data	= fontdata_8x16,
+	.data	= fontdata_8x16.data,
 	.pref	= 0,
 };
 EXPORT_SYMBOL(font_vga_8x16);
diff --git a/lib/fonts/font_8x8.c b/lib/fonts/font_8x8.c
index 9f56efe2cee7..4d28b81e8237 100644
--- a/lib/fonts/font_8x8.c
+++ b/lib/fonts/font_8x8.c
@@ -8,8 +8,8 @@
 
 #define FONTDATAMAX 2048
 
-static const unsigned char fontdata_8x8[FONTDATAMAX] = {
-
+static struct font_data fontdata_8x8 = {
+	{ 0, 0, FONTDATAMAX, 0 }, {
 	/* 0 0x00 '^@' */
 	0x00, /* 00000000 */
 	0x00, /* 00000000 */
@@ -2569,8 +2569,7 @@ static const unsigned char fontdata_8x8[FONTDATAMAX] = {
 	0x00, /* 00000000 */
 	0x00, /* 00000000 */
 	0x00, /* 00000000 */
-
-};
+} };
 
 
 const struct font_desc font_vga_8x8 = {
@@ -2578,6 +2577,6 @@ const struct font_desc font_vga_8x8 = {
 	.name	= "VGA8x8",
 	.width	= 8,
 	.height	= 8,
-	.data	= fontdata_8x8,
+	.data	= fontdata_8x8.data,
 	.pref	= 0,
 };
diff --git a/lib/fonts/font_acorn_8x8.c b/lib/fonts/font_acorn_8x8.c
index 639e31ae1100..957398b762d3 100644
--- a/lib/fonts/font_acorn_8x8.c
+++ b/lib/fonts/font_acorn_8x8.c
@@ -2,7 +2,10 @@
 
 #include <linux/font.h>
 
-static const unsigned char acorndata_8x8[] = {
+#define FONTDATAMAX 2048
+
+static struct font_data acorndata_8x8 = {
+{ 0, 0, FONTDATAMAX, 0 }, {
 /* 00 */  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* ^@ */
 /* 01 */  0x7e, 0x81, 0xa5, 0x81, 0xbd, 0x99, 0x81, 0x7e, /* ^A */
 /* 02 */  0x7e, 0xff, 0xbd, 0xff, 0xc3, 0xe7, 0xff, 0x7e, /* ^B */
@@ -259,14 +262,14 @@ static const unsigned char acorndata_8x8[] = {
 /* FD */  0x38, 0x04, 0x18, 0x20, 0x3c, 0x00, 0x00, 0x00,
 /* FE */  0x00, 0x00, 0x3c, 0x3c, 0x3c, 0x3c, 0x00, 0x00,
 /* FF */  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
-};
+} };
 
 const struct font_desc font_acorn_8x8 = {
 	.idx	= ACORN8x8_IDX,
 	.name	= "Acorn8x8",
 	.width	= 8,
 	.height	= 8,
-	.data	= acorndata_8x8,
+	.data	= acorndata_8x8.data,
 #ifdef CONFIG_ARCH_ACORN
 	.pref	= 20,
 #else
diff --git a/lib/fonts/font_mini_4x6.c b/lib/fonts/font_mini_4x6.c
index 838caa1cfef7..1449876c6a27 100644
--- a/lib/fonts/font_mini_4x6.c
+++ b/lib/fonts/font_mini_4x6.c
@@ -43,8 +43,8 @@ __END__;
 
 #define FONTDATAMAX 1536
 
-static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = {
-
+static struct font_data fontdata_mini_4x6 = {
+	{ 0, 0, FONTDATAMAX, 0 }, {
 	/*{*/
 	  	/*   Char 0: ' '  */
 	0xee,	/*=  [*** ]       */
@@ -2145,14 +2145,14 @@ static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = {
 	0xee,	/*=   [*** ]        */
 	0x00,	/*=   [    ]        */
 	/*}*/
-};
+} };
 
 const struct font_desc font_mini_4x6 = {
 	.idx	= MINI4x6_IDX,
 	.name	= "MINI4x6",
 	.width	= 4,
 	.height	= 6,
-	.data	= fontdata_mini_4x6,
+	.data	= fontdata_mini_4x6.data,
 	.pref	= 3,
 };
 
diff --git a/lib/fonts/font_pearl_8x8.c b/lib/fonts/font_pearl_8x8.c
index dc6ad539ca4e..4649314333bb 100644
--- a/lib/fonts/font_pearl_8x8.c
+++ b/lib/fonts/font_pearl_8x8.c
@@ -13,8 +13,8 @@
 
 #define FONTDATAMAX 2048
 
-static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = {
-
+static struct font_data fontdata_pearl8x8 = {
+   { 0, 0, FONTDATAMAX, 0 }, {
    /* 0 0x00 '^@' */
    0x00, /* 00000000 */
    0x00, /* 00000000 */
@@ -2574,14 +2574,13 @@ static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = {
    0x00, /* 00000000 */
    0x00, /* 00000000 */
    0x00, /* 00000000 */
-
-};
+} };
 
 const struct font_desc font_pearl_8x8 = {
 	.idx	= PEARL8x8_IDX,
 	.name	= "PEARL8x8",
 	.width	= 8,
 	.height	= 8,
-	.data	= fontdata_pearl8x8,
+	.data	= fontdata_pearl8x8.data,
 	.pref	= 2,
 };
diff --git a/lib/fonts/font_sun12x22.c b/lib/fonts/font_sun12x22.c
index d3643853c33a..c6967cdf4207 100644
--- a/lib/fonts/font_sun12x22.c
+++ b/lib/fonts/font_sun12x22.c
@@ -2,8 +2,8 @@
 
 #define FONTDATAMAX 11264
 
-static const unsigned char fontdata_sun12x22[FONTDATAMAX] = {
-
+static struct font_data fontdata_sun12x22 = {
+	{ 0, 0, FONTDATAMAX, 0 }, {
 	/* 0 0x00 '^@' */
 	0x00, 0x00, /* 000000000000 */
 	0x00, 0x00, /* 000000000000 */
@@ -6147,8 +6147,7 @@ static const unsigned char fontdata_sun12x22[FONTDATAMAX] = {
 	0x00, 0x00, /* 000000000000 */
 	0x00, 0x00, /* 000000000000 */
 	0x00, 0x00, /* 000000000000 */
-
-};
+} };
 
 
 const struct font_desc font_sun_12x22 = {
@@ -6156,7 +6155,7 @@ const struct font_desc font_sun_12x22 = {
 	.name	= "SUN12x22",
 	.width	= 12,
 	.height	= 22,
-	.data	= fontdata_sun12x22,
+	.data	= fontdata_sun12x22.data,
 #ifdef __sparc__
 	.pref	= 5,
 #else
diff --git a/lib/fonts/font_sun8x16.c b/lib/fonts/font_sun8x16.c
index 268151325b83..7d979e578899 100644
--- a/lib/fonts/font_sun8x16.c
+++ b/lib/fonts/font_sun8x16.c
@@ -2,7 +2,8 @@
 
 #define FONTDATAMAX 4096
 
-static const unsigned char fontdata_sun8x16[FONTDATAMAX] = {
+static struct font_data fontdata_sun8x16 = {
+{ 0, 0, FONTDATAMAX, 0 }, {
 /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
 /* */ 0x00,0x00,0x7e,0x81,0xa5,0x81,0x81,0xbd,0x99,0x81,0x81,0x7e,0x00,0x00,0x00,0x00,
 /* */ 0x00,0x00,0x7e,0xff,0xdb,0xff,0xff,0xc3,0xe7,0xff,0xff,0x7e,0x00,0x00,0x00,0x00,
@@ -259,14 +260,14 @@ static const unsigned char fontdata_sun8x16[FONTDATAMAX] = {
 /* */ 0x00,0x70,0xd8,0x30,0x60,0xc8,0xf8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
 /* */ 0x00,0x00,0x00,0x00,0x7c,0x7c,0x7c,0x7c,0x7c,0x7c,0x7c,0x00,0x00,0x00,0x00,0x00,
 /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
-};
+} };
 
 const struct font_desc font_sun_8x16 = {
 	.idx	= SUN8x16_IDX,
 	.name	= "SUN8x16",
 	.width	= 8,
 	.height	= 16,
-	.data	= fontdata_sun8x16,
+	.data	= fontdata_sun8x16.data,
 #ifdef __sparc__
 	.pref	= 10,
 #else

From 98b8b49edb045e615771516caf9dcc3cc0455657 Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Tue, 22 Sep 2020 09:29:31 +0200
Subject: [PATCH 0727/2658] Revert "ravb: Fixed to be able to unload modules"

commit 77972b55fb9d35d4a6b0abca99abffaa4ec6a85b upstream.

This reverts commit 1838d6c62f57836639bd3d83e7855e0ee4f6defc.

This commit moved the ravb_mdio_init() call (and thus the
of_mdiobus_register() call) from the ravb_probe() to the ravb_open()
call.  This causes a regression during system resume (s2idle/s2ram), as
new PHY devices cannot be bound while suspended.

During boot, the Micrel PHY is detected like this:

    Micrel KSZ9031 Gigabit PHY e6800000.ethernet-ffffffff:00: attached PHY driver [Micrel KSZ9031 Gigabit PHY] (mii_bus:phy_addr=e6800000.ethernet-ffffffff:00, irq=228)
    ravb e6800000.ethernet eth0: Link is Up - 1Gbps/Full - flow control off

During system suspend, (A) defer_all_probes is set to true, and (B)
usermodehelper_disabled is set to UMH_DISABLED, to avoid drivers being
probed while suspended.

  A. If CONFIG_MODULES=n, phy_device_register() calling device_add()
     merely adds the device, but does not probe it yet, as
     really_probe() returns early due to defer_all_probes being set:

       dpm_resume+0x128/0x4f8
	 device_resume+0xcc/0x1b0
	   dpm_run_callback+0x74/0x340
	     ravb_resume+0x190/0x1b8
	       ravb_open+0x84/0x770
		 of_mdiobus_register+0x1e0/0x468
		   of_mdiobus_register_phy+0x1b8/0x250
		     of_mdiobus_phy_device_register+0x178/0x1e8
		       phy_device_register+0x114/0x1b8
			 device_add+0x3d4/0x798
			   bus_probe_device+0x98/0xa0
			     device_initial_probe+0x10/0x18
			       __device_attach+0xe4/0x140
				 bus_for_each_drv+0x64/0xc8
				   __device_attach_driver+0xb8/0xe0
				     driver_probe_device.part.11+0xc4/0xd8
				       really_probe+0x32c/0x3b8

     Later, phy_attach_direct() notices no PHY driver has been bound,
     and falls back to the Generic PHY, leading to degraded operation:

       Generic PHY e6800000.ethernet-ffffffff:00: attached PHY driver [Generic PHY] (mii_bus:phy_addr=e6800000.ethernet-ffffffff:00, irq=POLL)
       ravb e6800000.ethernet eth0: Link is Up - 1Gbps/Full - flow control off

  B. If CONFIG_MODULES=y, request_module() returns early with -EBUSY due
     to UMH_DISABLED, and MDIO initialization fails completely:

       mdio_bus e6800000.ethernet-ffffffff:00: error -16 loading PHY driver module for ID 0x00221622
       ravb e6800000.ethernet eth0: failed to initialize MDIO
       PM: dpm_run_callback(): ravb_resume+0x0/0x1b8 returns -16
       PM: Device e6800000.ethernet failed to resume: error -16

     Ignoring -EBUSY in phy_request_driver_module(), like was done for
     -ENOENT in commit 21e194425abd65b5 ("net: phy: fix issue with loading
     PHY driver w/o initramfs"), would makes it fall back to the Generic
     PHY, like in the CONFIG_MODULES=n case.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: stable@vger.kernel.org
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/renesas/ravb_main.c | 110 +++++++++++------------
 1 file changed, 55 insertions(+), 55 deletions(-)

diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index d5bf0f275307..460b29ac5fd8 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1214,64 +1214,12 @@ static const struct ethtool_ops ravb_ethtool_ops = {
 	.get_ts_info		= ravb_get_ts_info,
 };
 
-/* MDIO bus init function */
-static int ravb_mdio_init(struct ravb_private *priv)
-{
-	struct platform_device *pdev = priv->pdev;
-	struct device *dev = &pdev->dev;
-	int error;
-
-	/* Bitbang init */
-	priv->mdiobb.ops = &bb_ops;
-
-	/* MII controller setting */
-	priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
-	if (!priv->mii_bus)
-		return -ENOMEM;
-
-	/* Hook up MII support for ethtool */
-	priv->mii_bus->name = "ravb_mii";
-	priv->mii_bus->parent = dev;
-	snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
-		 pdev->name, pdev->id);
-
-	/* Register MDIO bus */
-	error = of_mdiobus_register(priv->mii_bus, dev->of_node);
-	if (error)
-		goto out_free_bus;
-
-	return 0;
-
-out_free_bus:
-	free_mdio_bitbang(priv->mii_bus);
-	return error;
-}
-
-/* MDIO bus release function */
-static int ravb_mdio_release(struct ravb_private *priv)
-{
-	/* Unregister mdio bus */
-	mdiobus_unregister(priv->mii_bus);
-
-	/* Free bitbang info */
-	free_mdio_bitbang(priv->mii_bus);
-
-	return 0;
-}
-
 /* Network device open function for Ethernet AVB */
 static int ravb_open(struct net_device *ndev)
 {
 	struct ravb_private *priv = netdev_priv(ndev);
 	int error;
 
-	/* MDIO bus init */
-	error = ravb_mdio_init(priv);
-	if (error) {
-		netdev_err(ndev, "failed to initialize MDIO\n");
-		return error;
-	}
-
 	napi_enable(&priv->napi[RAVB_BE]);
 	napi_enable(&priv->napi[RAVB_NC]);
 
@@ -1320,7 +1268,6 @@ static int ravb_open(struct net_device *ndev)
 out_napi_off:
 	napi_disable(&priv->napi[RAVB_NC]);
 	napi_disable(&priv->napi[RAVB_BE]);
-	ravb_mdio_release(priv);
 	return error;
 }
 
@@ -1614,8 +1561,6 @@ static int ravb_close(struct net_device *ndev)
 	ravb_ring_free(ndev, RAVB_BE);
 	ravb_ring_free(ndev, RAVB_NC);
 
-	ravb_mdio_release(priv);
-
 	return 0;
 }
 
@@ -1719,6 +1664,51 @@ static const struct net_device_ops ravb_netdev_ops = {
 	.ndo_change_mtu		= eth_change_mtu,
 };
 
+/* MDIO bus init function */
+static int ravb_mdio_init(struct ravb_private *priv)
+{
+	struct platform_device *pdev = priv->pdev;
+	struct device *dev = &pdev->dev;
+	int error;
+
+	/* Bitbang init */
+	priv->mdiobb.ops = &bb_ops;
+
+	/* MII controller setting */
+	priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
+	if (!priv->mii_bus)
+		return -ENOMEM;
+
+	/* Hook up MII support for ethtool */
+	priv->mii_bus->name = "ravb_mii";
+	priv->mii_bus->parent = dev;
+	snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
+		 pdev->name, pdev->id);
+
+	/* Register MDIO bus */
+	error = of_mdiobus_register(priv->mii_bus, dev->of_node);
+	if (error)
+		goto out_free_bus;
+
+	return 0;
+
+out_free_bus:
+	free_mdio_bitbang(priv->mii_bus);
+	return error;
+}
+
+/* MDIO bus release function */
+static int ravb_mdio_release(struct ravb_private *priv)
+{
+	/* Unregister mdio bus */
+	mdiobus_unregister(priv->mii_bus);
+
+	/* Free bitbang info */
+	free_mdio_bitbang(priv->mii_bus);
+
+	return 0;
+}
+
 static const struct of_device_id ravb_match_table[] = {
 	{ .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 },
 	{ .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 },
@@ -1857,6 +1847,13 @@ static int ravb_probe(struct platform_device *pdev)
 		eth_hw_addr_random(ndev);
 	}
 
+	/* MDIO bus init */
+	error = ravb_mdio_init(priv);
+	if (error) {
+		dev_err(&pdev->dev, "failed to initialize MDIO\n");
+		goto out_dma_free;
+	}
+
 	netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64);
 	netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64);
 
@@ -1876,6 +1873,8 @@ static int ravb_probe(struct platform_device *pdev)
 out_napi_del:
 	netif_napi_del(&priv->napi[RAVB_NC]);
 	netif_napi_del(&priv->napi[RAVB_BE]);
+	ravb_mdio_release(priv);
+out_dma_free:
 	dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat,
 			  priv->desc_bat_dma);
 out_release:
@@ -1900,6 +1899,7 @@ static int ravb_remove(struct platform_device *pdev)
 	unregister_netdev(ndev);
 	netif_napi_del(&priv->napi[RAVB_NC]);
 	netif_napi_del(&priv->napi[RAVB_BE]);
+	ravb_mdio_release(priv);
 	pm_runtime_disable(&pdev->dev);
 	free_netdev(ndev);
 	platform_set_drvdata(pdev, NULL);

From d772b2cf7cfbdd8d1b54cf54fa439496af151e7a Mon Sep 17 00:00:00 2001
From: Peilin Ye <yepeilin.cs@gmail.com>
Date: Thu, 24 Sep 2020 09:43:48 -0400
Subject: [PATCH 0728/2658] fbcon: Fix global-out-of-bounds read in
 fbcon_get_font()

commit 5af08640795b2b9a940c9266c0260455377ae262 upstream.

fbcon_get_font() is reading out-of-bounds. A malicious user may resize
`vc->vc_font.height` to a large value, causing fbcon_get_font() to
read out of `fontdata`.

fbcon_get_font() handles both built-in and user-provided fonts.
Fortunately, recently we have added FONT_EXTRA_WORDS support for built-in
fonts, so fix it by adding range checks using FNTSIZE().

This patch depends on patch "fbdev, newport_con: Move FONT_EXTRA_WORDS
macros into linux/font.h", and patch "Fonts: Support FONT_EXTRA_WORDS
macros for built-in fonts".

Cc: stable@vger.kernel.org
Reported-and-tested-by: syzbot+29d4ed7f3bdedf2aa2fd@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=08b8be45afea11888776f897895aef9ad1c3ecfd
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/b34544687a1a09d6de630659eb7a773f4953238b.1600953813.git.yepeilin.cs@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/console/fbcon.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index e57fa26bcff1..29bb67921639 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -2234,6 +2234,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
 
 	if (font->width <= 8) {
 		j = vc->vc_font.height;
+		if (font->charcount * j > FNTSIZE(fontdata))
+			return -EINVAL;
+
 		for (i = 0; i < font->charcount; i++) {
 			memcpy(data, fontdata, j);
 			memset(data + j, 0, 32 - j);
@@ -2242,6 +2245,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
 		}
 	} else if (font->width <= 16) {
 		j = vc->vc_font.height * 2;
+		if (font->charcount * j > FNTSIZE(fontdata))
+			return -EINVAL;
+
 		for (i = 0; i < font->charcount; i++) {
 			memcpy(data, fontdata, j);
 			memset(data + j, 0, 64 - j);
@@ -2249,6 +2255,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
 			fontdata += j;
 		}
 	} else if (font->width <= 24) {
+		if (font->charcount * (vc->vc_font.height * sizeof(u32)) > FNTSIZE(fontdata))
+			return -EINVAL;
+
 		for (i = 0; i < font->charcount; i++) {
 			for (j = 0; j < vc->vc_font.height; j++) {
 				*data++ = fontdata[0];
@@ -2261,6 +2270,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
 		}
 	} else {
 		j = vc->vc_font.height * 4;
+		if (font->charcount * j > FNTSIZE(fontdata))
+			return -EINVAL;
+
 		for (i = 0; i < font->charcount; i++) {
 			memcpy(data, fontdata, j);
 			memset(data + j, 0, 128 - j);

From 7b1dd1eccee524490142b76f655e60f2efa0991d Mon Sep 17 00:00:00 2001
From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Date: Wed, 7 Oct 2020 09:24:01 +0530
Subject: [PATCH 0729/2658] net: wireless: nl80211: fix out-of-bounds access in
 nl80211_del_key()

commit 3dc289f8f139997f4e9d3cfccf8738f20d23e47b upstream.

In nl80211_parse_key(), key.idx is first initialized as -1.
If this value of key.idx remains unmodified and gets returned, and
nl80211_key_allowed() also returns 0, then rdev_del_key() gets called
with key.idx = -1.
This causes an out-of-bounds array access.

Handle this issue by checking if the value of key.idx after
nl80211_parse_key() is called and return -EINVAL if key.idx < 0.

Cc: stable@vger.kernel.org
Reported-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com
Tested-by: syzbot+b1bb342d1d097516cbda@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Link: https://lore.kernel.org/r/20201007035401.9522-1-anant.thazhemadam@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/wireless/nl80211.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 47873ebfd8c1..c44b2ee18cd7 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3195,6 +3195,9 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
 	if (err)
 		return err;
 
+	if (key.idx < 0)
+		return -EINVAL;
+
 	if (info->attrs[NL80211_ATTR_MAC])
 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 

From 4309629be657e60aaa763442bd5b9c751cf488ce Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Mon, 5 Oct 2020 10:56:22 -0700
Subject: [PATCH 0730/2658] usermodehelper: reset umask to default before
 executing user process

commit 4013c1496c49615d90d36b9d513eee8e369778e9 upstream.

Kernel threads intentionally do CLONE_FS in order to follow any changes
that 'init' does to set up the root directory (or cwd).

It is admittedly a bit odd, but it avoids the situation where 'init'
does some extensive setup to initialize the system environment, and then
we execute a usermode helper program, and it uses the original FS setup
from boot time that may be very limited and incomplete.

[ Both Al Viro and Eric Biederman point out that 'pivot_root()' will
  follow the root regardless, since it fixes up other users of root (see
  chroot_fs_refs() for details), but overmounting root and doing a
  chroot() would not. ]

However, Vegard Nossum noticed that the CLONE_FS not only means that we
follow the root and current working directories, it also means we share
umask with whatever init changed it to. That wasn't intentional.

Just reset umask to the original default (0022) before actually starting
the usermode helper program.

Reported-by: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/kmod.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/kernel/kmod.c b/kernel/kmod.c
index e4e5e98002fe..3f3bbae4cec3 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -28,6 +28,7 @@
 #include <linux/cred.h>
 #include <linux/file.h>
 #include <linux/fdtable.h>
+#include <linux/fs_struct.h>
 #include <linux/workqueue.h>
 #include <linux/security.h>
 #include <linux/mount.h>
@@ -222,6 +223,14 @@ static int call_usermodehelper_exec_async(void *data)
 	flush_signal_handlers(current, 1);
 	spin_unlock_irq(&current->sighand->siglock);
 
+	/*
+	 * Initial kernel threads share ther FS with init, in order to
+	 * get the init root directory. But we've now created a new
+	 * thread that is going to execve a user process and has its own
+	 * 'struct fs_struct'. Reset umask to the default.
+	 */
+	current->fs->umask = 0022;
+
 	/*
 	 * Our parent (unbound workqueue) runs with elevated scheduling
 	 * priority. Avoid propagating that into the userspace child.

From 812fb77654630db1dc58c528cd287fa21c306549 Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Sun, 13 Sep 2020 12:02:03 -0700
Subject: [PATCH 0731/2658] platform/x86: thinkpad_acpi: initialize
 tp_nvram_state variable

commit 5f38b06db8af3ed6c2fc1b427504ca56fae2eacc upstream.

clang static analysis flags this represenative problem
thinkpad_acpi.c:2523:7: warning: Branch condition evaluates
  to a garbage value
                if (!oldn->mute ||
                    ^~~~~~~~~~~

In hotkey_kthread() mute is conditionally set by hotkey_read_nvram()
but unconditionally checked by hotkey_compare_and_issue_event().
So the tp_nvram_state variable s[2] needs to be initialized.

Fixes: 01e88f25985d ("ACPI: thinkpad-acpi: add CMOS NVRAM polling for hot keys (v9)")
Signed-off-by: Tom Rix <trix@redhat.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: mark gross <mgross@linux.intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/platform/x86/thinkpad_acpi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 0bed4733c4f0..45e78bf6f9bb 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -2474,7 +2474,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
  */
 static int hotkey_kthread(void *data)
 {
-	struct tp_nvram_state s[2];
+	struct tp_nvram_state s[2] = { 0 };
 	u32 poll_mask, event_mask;
 	unsigned int si, so;
 	unsigned long t;

From 92faba46067ba5346b4a2baf3561d81fcbc957fd Mon Sep 17 00:00:00 2001
From: Aaron Ma <aaron.ma@canonical.com>
Date: Sat, 3 Oct 2020 01:09:16 +0800
Subject: [PATCH 0732/2658] platform/x86: thinkpad_acpi: re-initialize ACPI
 buffer size when reuse

commit 720ef73d1a239e33c3ad8fac356b9b1348e68aaf upstream.

Evaluating ACPI _BCL could fail, then ACPI buffer size will be set to 0.
When reuse this ACPI buffer, AE_BUFFER_OVERFLOW will be triggered.

Re-initialize buffer size will make ACPI evaluate successfully.

Fixes: 46445b6b896fd ("thinkpad-acpi: fix handle locate for video and query of _BCL")
Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/platform/x86/thinkpad_acpi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 45e78bf6f9bb..9180b24ba60a 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -6362,8 +6362,10 @@ static int __init tpacpi_query_bcl_levels(acpi_handle handle)
 	list_for_each_entry(child, &device->children, node) {
 		acpi_status status = acpi_evaluate_object(child->handle, "_BCL",
 							  NULL, &buffer);
-		if (ACPI_FAILURE(status))
+		if (ACPI_FAILURE(status)) {
+			buffer.length = ACPI_ALLOCATE_BUFFER;
 			continue;
+		}
 
 		obj = (union acpi_object *)buffer.pointer;
 		if (!obj || (obj->type != ACPI_TYPE_PACKAGE)) {

From 170f8dee5ebb9a6e879c96151711567253b4489d Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date: Mon, 13 Jul 2020 11:12:54 +0900
Subject: [PATCH 0733/2658] driver core: Fix probe_count imbalance in
 really_probe()

commit b292b50b0efcc7095d8bf15505fba6909bb35dce upstream.

syzbot is reporting hung task in wait_for_device_probe() [1]. At least,
we always need to decrement probe_count if we incremented probe_count in
really_probe().

However, since I can't find "Resources present before probing" message in
the console log, both "this message simply flowed off" and "syzbot is not
hitting this path" will be possible. Therefore, while we are at it, let's
also prepare for concurrent wait_for_device_probe() calls by replacing
wake_up() with wake_up_all().

[1] https://syzkaller.appspot.com/bug?id=25c833f1983c9c1d512f4ff860dd0d7f5a2e2c0f

Reported-by: syzbot <syzbot+805f5f6ae37411f15b64@syzkaller.appspotmail.com>
Fixes: 7c35e699c88bd607 ("driver core: Print device when resources present in really_probe()")
Cc: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/20200713021254.3444-1-penguin-kernel@I-love.SAKURA.ne.jp
[iwamatsu: Drop patch for deferred_probe_timeout_work_func()]
Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/dd.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index ca3fe2de71d3..1ed2a8dde98d 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -310,7 +310,8 @@ static int really_probe(struct device *dev, struct device_driver *drv)
 		 drv->bus->name, __func__, drv->name, dev_name(dev));
 	if (!list_empty(&dev->devres_head)) {
 		dev_crit(dev, "Resources present before probing\n");
-		return -EBUSY;
+		ret = -EBUSY;
+		goto done;
 	}
 
 	dev->driver = drv;
@@ -388,7 +389,7 @@ static int really_probe(struct device *dev, struct device_driver *drv)
 	ret = 0;
 done:
 	atomic_dec(&probe_count);
-	wake_up(&probe_waitqueue);
+	wake_up_all(&probe_waitqueue);
 	return ret;
 }
 

From c085b6a4d7b2c6ef4f403877150f55d23d531663 Mon Sep 17 00:00:00 2001
From: Tommi Rantala <tommi.t.rantala@nokia.com>
Date: Thu, 5 Mar 2020 10:37:12 +0200
Subject: [PATCH 0734/2658] perf top: Fix stdio interface input handling with
 glibc 2.28+

commit 29b4f5f188571c112713c35cc87eefb46efee612 upstream.

Since glibc 2.28 when running 'perf top --stdio', input handling no
longer works, but hitting any key always just prints the "Mapped keys"
help text.

To fix it, call clearerr() in the display_thread() loop to clear any EOF
sticky errors, as instructed in the glibc NEWS file
(https://sourceware.org/git/?p=glibc.git;a=blob;f=NEWS):

 * All stdio functions now treat end-of-file as a sticky condition.  If you
   read from a file until EOF, and then the file is enlarged by another
   process, you must call clearerr or another function with the same effect
   (e.g. fseek, rewind) before you can read the additional data.  This
   corrects a longstanding C99 conformance bug.  It is most likely to affect
   programs that use stdio to read interactive input from a terminal.
   (Bug #1190.)

Signed-off-by: Tommi Rantala <tommi.t.rantala@nokia.com>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lore.kernel.org/lkml/20200305083714.9381-2-tommi.t.rantala@nokia.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/builtin-top.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 4e64ba8163bb..7d6dd799bbcd 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -626,7 +626,9 @@ static void *display_thread(void *arg)
 	delay_msecs = top->delay_secs * 1000;
 	set_term_quiet_input(&save);
 	/* trash return*/
-	getc(stdin);
+	clearerr(stdin);
+	if (poll(&stdin_poll, 1, 0) > 0)
+		getc(stdin);
 
 	while (!done) {
 		perf_top__print_sym_table(top);

From 8b45fe8705e99aa755d3ba5a54e971ce6b12a259 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 8 Oct 2020 01:38:31 -0700
Subject: [PATCH 0735/2658] sctp: fix sctp_auth_init_hmacs() error path

commit d42ee76ecb6c49d499fc5eb32ca34468d95dbc3e upstream.

After freeing ep->auth_hmacs we have to clear the pointer
or risk use-after-free as reported by syzbot:

BUG: KASAN: use-after-free in sctp_auth_destroy_hmacs net/sctp/auth.c:509 [inline]
BUG: KASAN: use-after-free in sctp_auth_destroy_hmacs net/sctp/auth.c:501 [inline]
BUG: KASAN: use-after-free in sctp_auth_free+0x17e/0x1d0 net/sctp/auth.c:1070
Read of size 8 at addr ffff8880a8ff52c0 by task syz-executor941/6874

CPU: 0 PID: 6874 Comm: syz-executor941 Not tainted 5.9.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x198/0x1fd lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
 sctp_auth_destroy_hmacs net/sctp/auth.c:509 [inline]
 sctp_auth_destroy_hmacs net/sctp/auth.c:501 [inline]
 sctp_auth_free+0x17e/0x1d0 net/sctp/auth.c:1070
 sctp_endpoint_destroy+0x95/0x240 net/sctp/endpointola.c:203
 sctp_endpoint_put net/sctp/endpointola.c:236 [inline]
 sctp_endpoint_free+0xd6/0x110 net/sctp/endpointola.c:183
 sctp_destroy_sock+0x9c/0x3c0 net/sctp/socket.c:4981
 sctp_v6_destroy_sock+0x11/0x20 net/sctp/socket.c:9415
 sk_common_release+0x64/0x390 net/core/sock.c:3254
 sctp_close+0x4ce/0x8b0 net/sctp/socket.c:1533
 inet_release+0x12e/0x280 net/ipv4/af_inet.c:431
 inet6_release+0x4c/0x70 net/ipv6/af_inet6.c:475
 __sock_release+0xcd/0x280 net/socket.c:596
 sock_close+0x18/0x20 net/socket.c:1277
 __fput+0x285/0x920 fs/file_table.c:281
 task_work_run+0xdd/0x190 kernel/task_work.c:141
 exit_task_work include/linux/task_work.h:25 [inline]
 do_exit+0xb7d/0x29f0 kernel/exit.c:806
 do_group_exit+0x125/0x310 kernel/exit.c:903
 __do_sys_exit_group kernel/exit.c:914 [inline]
 __se_sys_exit_group kernel/exit.c:912 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:912
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x43f278
Code: Bad RIP value.
RSP: 002b:00007fffe0995c38 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043f278
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00000000004bf068 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 0000000020000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d1180 R14: 0000000000000000 R15: 0000000000000000

Allocated by task 6874:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:461
 kmem_cache_alloc_trace+0x174/0x300 mm/slab.c:3554
 kmalloc include/linux/slab.h:554 [inline]
 kmalloc_array include/linux/slab.h:593 [inline]
 kcalloc include/linux/slab.h:605 [inline]
 sctp_auth_init_hmacs+0xdb/0x3b0 net/sctp/auth.c:464
 sctp_auth_init+0x8a/0x4a0 net/sctp/auth.c:1049
 sctp_setsockopt_auth_supported net/sctp/socket.c:4354 [inline]
 sctp_setsockopt+0x477e/0x97f0 net/sctp/socket.c:4631
 __sys_setsockopt+0x2db/0x610 net/socket.c:2132
 __do_sys_setsockopt net/socket.c:2143 [inline]
 __se_sys_setsockopt net/socket.c:2140 [inline]
 __x64_sys_setsockopt+0xba/0x150 net/socket.c:2140
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 6874:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track+0x1c/0x30 mm/kasan/common.c:56
 kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355
 __kasan_slab_free+0xd8/0x120 mm/kasan/common.c:422
 __cache_free mm/slab.c:3422 [inline]
 kfree+0x10e/0x2b0 mm/slab.c:3760
 sctp_auth_destroy_hmacs net/sctp/auth.c:511 [inline]
 sctp_auth_destroy_hmacs net/sctp/auth.c:501 [inline]
 sctp_auth_init_hmacs net/sctp/auth.c:496 [inline]
 sctp_auth_init_hmacs+0x2b7/0x3b0 net/sctp/auth.c:454
 sctp_auth_init+0x8a/0x4a0 net/sctp/auth.c:1049
 sctp_setsockopt_auth_supported net/sctp/socket.c:4354 [inline]
 sctp_setsockopt+0x477e/0x97f0 net/sctp/socket.c:4631
 __sys_setsockopt+0x2db/0x610 net/socket.c:2132
 __do_sys_setsockopt net/socket.c:2143 [inline]
 __se_sys_setsockopt net/socket.c:2140 [inline]
 __x64_sys_setsockopt+0xba/0x150 net/socket.c:2140
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 1f485649f529 ("[SCTP]: Implement SCTP-AUTH internals")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Vlad Yasevich <vyasevich@gmail.com>
Cc: Neil Horman <nhorman@tuxdriver.com>
Cc: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/auth.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 1543e39f47c3..04cd87d26ed1 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -496,6 +496,7 @@ int sctp_auth_init_hmacs(struct sctp_endpoint *ep, gfp_t gfp)
 out_err:
 	/* Clean up any successful allocations */
 	sctp_auth_destroy_hmacs(ep->auth_hmacs);
+	ep->auth_hmacs = NULL;
 	return -ENOMEM;
 }
 

From c18c35d4ab0c1a3cf579196a182ace4781a6cc47 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Fri, 25 Sep 2020 06:38:08 -0700
Subject: [PATCH 0736/2658] team: set dev->needed_headroom in
 team_setup_by_port()

commit 89d01748b2354e210b5d4ea47bc25a42a1b42c82 upstream.

Some devices set needed_headroom. If we ignore it, we might
end up crashing in various skb_push() for example in ipgre_header()
since some layers assume enough headroom has been reserved.

Fixes: 1d76efe1577b ("team: add support for non-ethernet devices")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/team/team.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index d0943415aeff..71dd9d69d6cb 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -2038,6 +2038,7 @@ static void team_setup_by_port(struct net_device *dev,
 	dev->header_ops	= port_dev->header_ops;
 	dev->type = port_dev->type;
 	dev->hard_header_len = port_dev->hard_header_len;
+	dev->needed_headroom = port_dev->needed_headroom;
 	dev->addr_len = port_dev->addr_len;
 	dev->mtu = port_dev->mtu;
 	memcpy(dev->broadcast, port_dev->broadcast, port_dev->addr_len);

From f13a9161cac07f2660b72854a25e2da95319ae47 Mon Sep 17 00:00:00 2001
From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Date: Mon, 5 Oct 2020 02:25:36 +0530
Subject: [PATCH 0737/2658] net: team: fix memory leak in
 __team_options_register

commit 9a9e77495958c7382b2438bc19746dd3aaaabb8e upstream.

The variable "i" isn't initialized back correctly after the first loop
under the label inst_rollback gets executed.

The value of "i" is assigned to be option_count - 1, and the ensuing
loop (under alloc_rollback) begins by initializing i--.
Thus, the value of i when the loop begins execution will now become
i = option_count - 2.

Thus, when kfree(dst_opts[i]) is called in the second loop in this
order, (i.e., inst_rollback followed by alloc_rollback),
dst_optsp[option_count - 2] is the first element freed, and
dst_opts[option_count - 1] does not get freed, and thus, a memory
leak is caused.

This memory leak can be fixed, by assigning i = option_count (instead of
option_count - 1).

Fixes: 80f7c6683fe0 ("team: add support for per-port options")
Reported-by: syzbot+69b804437cfec30deac3@syzkaller.appspotmail.com
Tested-by: syzbot+69b804437cfec30deac3@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/team/team.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 71dd9d69d6cb..2ed1453b9224 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -285,7 +285,7 @@ static int __team_options_register(struct team *team,
 	for (i--; i >= 0; i--)
 		__team_option_inst_del_option(team, dst_opts[i]);
 
-	i = option_count - 1;
+	i = option_count;
 alloc_rollback:
 	for (i--; i >= 0; i--)
 		kfree(dst_opts[i]);

From 9a808a3c3dda2032eed39bcbff6911efaa6d98ac Mon Sep 17 00:00:00 2001
From: Richard Weinberger <richard@nod.at>
Date: Wed, 21 Sep 2016 11:44:41 +0200
Subject: [PATCH 0738/2658] mtd: nand: Provide nand_cleanup() function to free
 NAND related resources

[ Upstream commit d44154f969a44269a9288c274c1c2fd9e85df8a5 ]

Provide a nand_cleanup() function to free all nand related resources
without unregistering the mtd device.
This should allow drivers to call mtd_device_unregister() and handle
its return value and still being able to cleanup all nand related
resources.

Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Daniel Walter <dwalter@sigma-star.at>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/nand/nand_base.c | 22 +++++++++++++++-------
 include/linux/mtd/nand.h     |  6 +++++-
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 8406f346b0be..09864226428b 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -4427,18 +4427,14 @@ int nand_scan(struct mtd_info *mtd, int maxchips)
 EXPORT_SYMBOL(nand_scan);
 
 /**
- * nand_release - [NAND Interface] Free resources held by the NAND device
- * @mtd: MTD device structure
+ * nand_cleanup - [NAND Interface] Free resources held by the NAND device
+ * @chip: NAND chip object
  */
-void nand_release(struct mtd_info *mtd)
+void nand_cleanup(struct nand_chip *chip)
 {
-	struct nand_chip *chip = mtd->priv;
-
 	if (chip->ecc.mode == NAND_ECC_SOFT_BCH)
 		nand_bch_free((struct nand_bch_control *)chip->ecc.priv);
 
-	mtd_device_unregister(mtd);
-
 	/* Free bad block table memory */
 	kfree(chip->bbt);
 	if (!(chip->options & NAND_OWN_BUFFERS))
@@ -4449,6 +4445,18 @@ void nand_release(struct mtd_info *mtd)
 			& NAND_BBT_DYNAMICSTRUCT)
 		kfree(chip->badblock_pattern);
 }
+EXPORT_SYMBOL_GPL(nand_cleanup);
+
+/**
+ * nand_release - [NAND Interface] Unregister the MTD device and free resources
+ *		  held by the NAND device
+ * @mtd: MTD device structure
+ */
+void nand_release(struct mtd_info *mtd)
+{
+	mtd_device_unregister(mtd);
+	nand_cleanup(mtd->priv);
+}
 EXPORT_SYMBOL_GPL(nand_release);
 
 static int __init nand_base_init(void)
diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
index 93fc37200793..1a066faf7b80 100644
--- a/include/linux/mtd/nand.h
+++ b/include/linux/mtd/nand.h
@@ -38,7 +38,7 @@ extern int nand_scan_ident(struct mtd_info *mtd, int max_chips,
 			   struct nand_flash_dev *table);
 extern int nand_scan_tail(struct mtd_info *mtd);
 
-/* Free resources held by the NAND device */
+/* Unregister the MTD device and free resources held by the NAND device */
 extern void nand_release(struct mtd_info *mtd);
 
 /* Internal helper for board drivers which need to override command function */
@@ -1029,4 +1029,8 @@ int nand_check_erased_ecc_chunk(void *data, int datalen,
 				void *ecc, int ecclen,
 				void *extraoob, int extraooblen,
 				int threshold);
+
+/* Free resources held by the NAND device */
+void nand_cleanup(struct nand_chip *chip);
+
 #endif /* __LINUX_MTD_NAND_H */

From c510f365645ea96b6cfcc1fc7e23c8779472ebd3 Mon Sep 17 00:00:00 2001
From: Antony Antony <antony.antony@secunet.com>
Date: Fri, 4 Sep 2020 08:49:55 +0200
Subject: [PATCH 0739/2658] xfrm: clone XFRMA_REPLAY_ESN_VAL in xfrm_do_migrate

[ Upstream commit 91a46c6d1b4fcbfa4773df9421b8ad3e58088101 ]

XFRMA_REPLAY_ESN_VAL was not cloned completely from the old to the new.
Migrate this attribute during XFRMA_MSG_MIGRATE

v1->v2:
 - move curleft cloning to a separate patch

Fixes: af2f464e326e ("xfrm: Assign esn pointers when cloning a state")
Signed-off-by: Antony Antony <antony.antony@secunet.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/xfrm.h | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 11c64d2595ef..4cc895546f94 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1729,21 +1729,17 @@ static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay
 static inline int xfrm_replay_clone(struct xfrm_state *x,
 				     struct xfrm_state *orig)
 {
-	x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn),
+
+	x->replay_esn = kmemdup(orig->replay_esn,
+				xfrm_replay_state_esn_len(orig->replay_esn),
 				GFP_KERNEL);
 	if (!x->replay_esn)
 		return -ENOMEM;
-
-	x->replay_esn->bmp_len = orig->replay_esn->bmp_len;
-	x->replay_esn->replay_window = orig->replay_esn->replay_window;
-
-	x->preplay_esn = kmemdup(x->replay_esn,
-				 xfrm_replay_state_esn_len(x->replay_esn),
+	x->preplay_esn = kmemdup(orig->preplay_esn,
+				 xfrm_replay_state_esn_len(orig->preplay_esn),
 				 GFP_KERNEL);
-	if (!x->preplay_esn) {
-		kfree(x->replay_esn);
+	if (!x->preplay_esn)
 		return -ENOMEM;
-	}
 
 	return 0;
 }

From bdadfb22f754e19446c78c5f9e67c7718fcbd56f Mon Sep 17 00:00:00 2001
From: Antony Antony <antony.antony@secunet.com>
Date: Fri, 4 Sep 2020 08:50:29 +0200
Subject: [PATCH 0740/2658] xfrm: clone whole liftime_cur structure in
 xfrm_do_migrate

[ Upstream commit 8366685b2883e523f91e9816d7be371eb1144749 ]

When we clone state only add_time was cloned. It missed values like
bytes, packets.  Now clone the all members of the structure.

v1->v3:
 - use memcpy to copy the entire structure

Fixes: 80c9abaabf42 ("[XFRM]: Extension for dynamic update of endpoint address(es)")
Signed-off-by: Antony Antony <antony.antony@secunet.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xfrm/xfrm_state.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index d3595f1d00f2..a3114abe74f2 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1207,7 +1207,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig)
 	x->tfcpad = orig->tfcpad;
 	x->replay_maxdiff = orig->replay_maxdiff;
 	x->replay_maxage = orig->replay_maxage;
-	x->curlft.add_time = orig->curlft.add_time;
+	memcpy(&x->curlft, &orig->curlft, sizeof(x->curlft));
 	x->km.state = orig->km.state;
 	x->km.seq = orig->km.seq;
 	x->replay = orig->replay;

From 86fe21dc69970fe4df6cd694b9eb6fd038cf15e8 Mon Sep 17 00:00:00 2001
From: Voon Weifeng <weifeng.voon@intel.com>
Date: Wed, 23 Sep 2020 16:56:14 +0800
Subject: [PATCH 0741/2658] net: stmmac: removed enabling eee in EEE set
 callback

[ Upstream commit 7241c5a697479c7d0c5a96595822cdab750d41ae ]

EEE should be only be enabled during stmmac_mac_link_up() when the
link are up and being set up properly. set_eee should only do settings
configuration and disabling the eee.

Without this fix, turning on EEE using ethtool will return
"Operation not supported". This is due to the driver is in a dead loop
waiting for eee to be advertised in the for eee to be activated but the
driver will only configure the EEE advertisement after the eee is
activated.

Ethtool should only return "Operation not supported" if there is no EEE
capbility in the MAC controller.

Fixes: 8a7493e58ad6 ("net: stmmac: Fix a race in EEE enable callback")
Signed-off-by: Voon Weifeng <weifeng.voon@intel.com>
Acked-by: Mark Gross <mgross@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/stmicro/stmmac/stmmac_ethtool.c  | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
index fbf701e5f1e9..6fe441696882 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
@@ -616,23 +616,16 @@ static int stmmac_ethtool_op_set_eee(struct net_device *dev,
 	struct stmmac_priv *priv = netdev_priv(dev);
 	int ret;
 
-	if (!edata->eee_enabled) {
+	if (!priv->dma_cap.eee)
+		return -EOPNOTSUPP;
+
+	if (!edata->eee_enabled)
 		stmmac_disable_eee_mode(priv);
-	} else {
-		/* We are asking for enabling the EEE but it is safe
-		 * to verify all by invoking the eee_init function.
-		 * In case of failure it will return an error.
-		 */
-		edata->eee_enabled = stmmac_eee_init(priv);
-		if (!edata->eee_enabled)
-			return -EOPNOTSUPP;
-	}
 
 	ret = phy_ethtool_set_eee(dev->phydev, edata);
 	if (ret)
 		return ret;
 
-	priv->eee_enabled = edata->eee_enabled;
 	priv->tx_lpi_timer = edata->tx_lpi_timer;
 	return 0;
 }

From b2c985f28502cd825fffe4cc0079e5ec91c4a93b Mon Sep 17 00:00:00 2001
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Fri, 25 Sep 2020 14:42:56 +1000
Subject: [PATCH 0742/2658] xfrm: Use correct address family in xfrm_state_find

[ Upstream commit e94ee171349db84c7cfdc5fefbebe414054d0924 ]

The struct flowi must never be interpreted by itself as its size
depends on the address family.  Therefore it must always be grouped
with its original family value.

In this particular instance, the original family value is lost in
the function xfrm_state_find.  Therefore we get a bogus read when
it's coupled with the wrong family which would occur with inter-
family xfrm states.

This patch fixes it by keeping the original family value.

Note that the same bug could potentially occur in LSM through
the xfrm_state_pol_flow_match hook.  I checked the current code
there and it seems to be safe for now as only secid is used which
is part of struct flowi_common.  But that API should be changed
so that so that we don't get new bugs in the future.  We could
do that by replacing fl with just secid or adding a family field.

Reported-by: syzbot+577fbac3145a6eb2e7a5@syzkaller.appspotmail.com
Fixes: 48b8d78315bf ("[XFRM]: State selection update to use inner...")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xfrm/xfrm_state.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index a3114abe74f2..5bb5950d6276 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -742,7 +742,8 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
 	 */
 	if (x->km.state == XFRM_STATE_VALID) {
 		if ((x->sel.family &&
-		     !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
+		     (x->sel.family != family ||
+		      !xfrm_selector_match(&x->sel, fl, family))) ||
 		    !security_xfrm_state_pol_flow_match(x, pol, fl))
 			return;
 
@@ -755,7 +756,9 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
 		*acq_in_progress = 1;
 	} else if (x->km.state == XFRM_STATE_ERROR ||
 		   x->km.state == XFRM_STATE_EXPIRED) {
-		if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
+		if ((!x->sel.family ||
+		     (x->sel.family == family &&
+		      xfrm_selector_match(&x->sel, fl, family))) &&
 		    security_xfrm_state_pol_flow_match(x, pol, fl))
 			*error = -ESRCH;
 	}
@@ -791,7 +794,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
 		    tmpl->mode == x->props.mode &&
 		    tmpl->id.proto == x->id.proto &&
 		    (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
-			xfrm_state_look_at(pol, x, fl, encap_family,
+			xfrm_state_look_at(pol, x, fl, family,
 					   &best, &acquire_in_progress, &error);
 	}
 	if (best || acquire_in_progress)
@@ -807,7 +810,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
 		    tmpl->mode == x->props.mode &&
 		    tmpl->id.proto == x->id.proto &&
 		    (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
-			xfrm_state_look_at(pol, x, fl, encap_family,
+			xfrm_state_look_at(pol, x, fl, family,
 					   &best, &acquire_in_progress, &error);
 	}
 

From 67ba65ccbbf1f076942db495bc2b4097dfcaafcc Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Fri, 25 Sep 2020 06:38:07 -0700
Subject: [PATCH 0743/2658] bonding: set dev->needed_headroom in
 bond_setup_by_slave()

[ Upstream commit f32f19339596b214c208c0dba716f4b6cc4f6958 ]

syzbot managed to crash a host by creating a bond
with a GRE device.

For non Ethernet device, bonding calls bond_setup_by_slave()
instead of ether_setup(), and unfortunately dev->needed_headroom
was not copied from the new added member.

[  171.243095] skbuff: skb_under_panic: text:ffffffffa184b9ea len:116 put:20 head:ffff883f84012dc0 data:ffff883f84012dbc tail:0x70 end:0xd00 dev:bond0
[  171.243111] ------------[ cut here ]------------
[  171.243112] kernel BUG at net/core/skbuff.c:112!
[  171.243117] invalid opcode: 0000 [#1] SMP KASAN PTI
[  171.243469] gsmi: Log Shutdown Reason 0x03
[  171.243505] Call Trace:
[  171.243506]  <IRQ>
[  171.243512]  [<ffffffffa171be59>] skb_push+0x49/0x50
[  171.243516]  [<ffffffffa184b9ea>] ipgre_header+0x2a/0xf0
[  171.243520]  [<ffffffffa17452d7>] neigh_connected_output+0xb7/0x100
[  171.243524]  [<ffffffffa186f1d3>] ip6_finish_output2+0x383/0x490
[  171.243528]  [<ffffffffa186ede2>] __ip6_finish_output+0xa2/0x110
[  171.243531]  [<ffffffffa186acbc>] ip6_finish_output+0x2c/0xa0
[  171.243534]  [<ffffffffa186abe9>] ip6_output+0x69/0x110
[  171.243537]  [<ffffffffa186ac90>] ? ip6_output+0x110/0x110
[  171.243541]  [<ffffffffa189d952>] mld_sendpack+0x1b2/0x2d0
[  171.243544]  [<ffffffffa189d290>] ? mld_send_report+0xf0/0xf0
[  171.243548]  [<ffffffffa189c797>] mld_ifc_timer_expire+0x2d7/0x3b0
[  171.243551]  [<ffffffffa189c4c0>] ? mld_gq_timer_expire+0x50/0x50
[  171.243556]  [<ffffffffa0fea270>] call_timer_fn+0x30/0x130
[  171.243559]  [<ffffffffa0fea17c>] expire_timers+0x4c/0x110
[  171.243563]  [<ffffffffa0fea0e3>] __run_timers+0x213/0x260
[  171.243566]  [<ffffffffa0fecb7d>] ? ktime_get+0x3d/0xa0
[  171.243570]  [<ffffffffa0ff9c4e>] ? clockevents_program_event+0x7e/0xe0
[  171.243574]  [<ffffffffa0f7e5d5>] ? sched_clock_cpu+0x15/0x190
[  171.243577]  [<ffffffffa0fe973d>] run_timer_softirq+0x1d/0x40
[  171.243581]  [<ffffffffa1c00152>] __do_softirq+0x152/0x2f0
[  171.243585]  [<ffffffffa0f44e1f>] irq_exit+0x9f/0xb0
[  171.243588]  [<ffffffffa1a02e1d>] smp_apic_timer_interrupt+0xfd/0x1a0
[  171.243591]  [<ffffffffa1a01ea6>] apic_timer_interrupt+0x86/0x90

Fixes: f5184d267c1a ("net: Allow netdevices to specify needed head/tailroom")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/bonding/bond_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index aaf75d5e6e48..5811235a64c8 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1132,6 +1132,7 @@ static void bond_setup_by_slave(struct net_device *bond_dev,
 
 	bond_dev->type		    = slave_dev->type;
 	bond_dev->hard_header_len   = slave_dev->hard_header_len;
+	bond_dev->needed_headroom   = slave_dev->needed_headroom;
 	bond_dev->addr_len	    = slave_dev->addr_len;
 
 	memcpy(bond_dev->broadcast, slave_dev->broadcast,

From ae51ab360a322d6e12995ad966db8ff3a7ccbbee Mon Sep 17 00:00:00 2001
From: Marc Dionne <marc.dionne@auristor.com>
Date: Fri, 4 Sep 2020 14:01:24 -0300
Subject: [PATCH 0744/2658] rxrpc: Fix rxkad token xdr encoding

[ Upstream commit 56305118e05b2db8d0395bba640ac9a3aee92624 ]

The session key should be encoded with just the 8 data bytes and
no length; ENCODE_DATA precedes it with a 4 byte length, which
confuses some existing tools that try to parse this format.

Add an ENCODE_BYTES macro that does not include a length, and use
it for the key.  Also adjust the expected length.

Note that commit 774521f353e1d ("rxrpc: Fix an assertion in
rxrpc_read()") had fixed a BUG by changing the length rather than
fixing the encoding.  The original length was correct.

Fixes: 99455153d067 ("RxRPC: Parse security index 5 keys (Kerberos 5)")
Signed-off-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rxrpc/ar-key.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c
index 91d43ab3a961..543d200f4fa1 100644
--- a/net/rxrpc/ar-key.c
+++ b/net/rxrpc/ar-key.c
@@ -1149,6 +1149,14 @@ static long rxrpc_read(const struct key *key,
 			goto fault;					\
 		xdr += (_l + 3) >> 2;					\
 	} while(0)
+#define ENCODE_BYTES(l, s)						\
+	do {								\
+		u32 _l = (l);						\
+		memcpy(xdr, (s), _l);					\
+		if (_l & 3)						\
+			memcpy((u8 *)xdr + _l, &zero, 4 - (_l & 3));	\
+		xdr += (_l + 3) >> 2;					\
+	} while(0)
 #define ENCODE64(x)					\
 	do {						\
 		__be64 y = cpu_to_be64(x);		\
@@ -1177,7 +1185,7 @@ static long rxrpc_read(const struct key *key,
 		case RXRPC_SECURITY_RXKAD:
 			ENCODE(token->kad->vice_id);
 			ENCODE(token->kad->kvno);
-			ENCODE_DATA(8, token->kad->session_key);
+			ENCODE_BYTES(8, token->kad->session_key);
 			ENCODE(token->kad->start);
 			ENCODE(token->kad->expiry);
 			ENCODE(token->kad->primary_flag);

From df157b1b59ee1b27a2faaa3522db50f42700e259 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Tue, 8 Sep 2020 22:09:04 +0100
Subject: [PATCH 0745/2658] rxrpc: Downgrade the BUG() for unsupported token
 type in rxrpc_read()

[ Upstream commit 9a059cd5ca7d9c5c4ca5a6e755cf72f230176b6a ]

If rxrpc_read() (which allows KEYCTL_READ to read a key), sees a token of a
type it doesn't recognise, it can BUG in a couple of places, which is
unnecessary as it can easily get back to userspace.

Fix this to print an error message instead.

Fixes: 99455153d067 ("RxRPC: Parse security index 5 keys (Kerberos 5)")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rxrpc/ar-key.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c
index 543d200f4fa1..20549c13eb13 100644
--- a/net/rxrpc/ar-key.c
+++ b/net/rxrpc/ar-key.c
@@ -1114,7 +1114,8 @@ static long rxrpc_read(const struct key *key,
 			break;
 
 		default: /* we have a ticket we can't encode */
-			BUG();
+			pr_err("Unsupported key token type (%u)\n",
+			       token->security_index);
 			continue;
 		}
 
@@ -1235,7 +1236,6 @@ static long rxrpc_read(const struct key *key,
 			break;
 
 		default:
-			BUG();
 			break;
 		}
 

From c408c614f409677fb026fd314ab565d3dcf2c523 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Fri, 2 Oct 2020 14:04:51 +0100
Subject: [PATCH 0746/2658] rxrpc: Fix server keyring leak

[ Upstream commit 38b1dc47a35ba14c3f4472138ea56d014c2d609b ]

If someone calls setsockopt() twice to set a server key keyring, the first
keyring is leaked.

Fix it to return an error instead if the server key keyring is already set.

Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rxrpc/ar-key.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c
index 20549c13eb13..ea615e53eab2 100644
--- a/net/rxrpc/ar-key.c
+++ b/net/rxrpc/ar-key.c
@@ -897,7 +897,7 @@ int rxrpc_request_key(struct rxrpc_sock *rx, char __user *optval, int optlen)
 
 	_enter("");
 
-	if (optlen <= 0 || optlen > PAGE_SIZE - 1)
+	if (optlen <= 0 || optlen > PAGE_SIZE - 1 || rx->securities)
 		return -EINVAL;
 
 	description = kmalloc(optlen + 1, GFP_KERNEL);

From ea1be1a9e689e3f67842aad2967fa667b76fc343 Mon Sep 17 00:00:00 2001
From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Date: Mon, 5 Oct 2020 18:59:58 +0530
Subject: [PATCH 0747/2658] net: usb: rtl8150: set random MAC address when
 set_ethernet_addr() fails

commit f45a4248ea4cc13ed50618ff066849f9587226b2 upstream.

When get_registers() fails in set_ethernet_addr(),the uninitialized
value of node_id gets copied over as the address.
So, check the return value of get_registers().

If get_registers() executed successfully (i.e., it returns
sizeof(node_id)), copy over the MAC address using ether_addr_copy()
(instead of using memcpy()).

Else, if get_registers() failed instead, a randomly generated MAC
address is set as the MAC address instead.

Reported-by: syzbot+abbc768b560c84d92fd3@syzkaller.appspotmail.com
Tested-by: syzbot+abbc768b560c84d92fd3@syzkaller.appspotmail.com
Acked-by: Petko Manolov <petkan@nucleusys.com>
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/rtl8150.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index 58b1e18fdd64..7230f1e8210f 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -277,12 +277,20 @@ static int write_mii_word(rtl8150_t * dev, u8 phy, __u8 indx, u16 reg)
 		return 1;
 }
 
-static inline void set_ethernet_addr(rtl8150_t * dev)
+static void set_ethernet_addr(rtl8150_t *dev)
 {
-	u8 node_id[6];
+	u8 node_id[ETH_ALEN];
+	int ret;
+
+	ret = get_registers(dev, IDR, sizeof(node_id), node_id);
 
-	get_registers(dev, IDR, sizeof(node_id), node_id);
-	memcpy(dev->netdev->dev_addr, node_id, sizeof(node_id));
+	if (ret == sizeof(node_id)) {
+		ether_addr_copy(dev->netdev->dev_addr, node_id);
+	} else {
+		eth_hw_addr_random(dev->netdev);
+		netdev_notice(dev->netdev, "Assigned a random MAC address: %pM\n",
+			      dev->netdev->dev_addr);
+	}
 }
 
 static int rtl8150_set_mac_address(struct net_device *netdev, void *p)

From 7751b35207b30a6fb93a46968bf0e14ed151f66e Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 14 Oct 2020 09:46:23 +0200
Subject: [PATCH 0748/2658] Linux 4.4.239

Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Pavel Machek  (CIP) <pavel@denx.de>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/20201012132628.130632267@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 7b0e6ec88caa..98d0759fccb1 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 238
+SUBLEVEL = 239
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From bd36e626bd9f54924b310e4013c68953aa870f77 Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Thu, 6 Aug 2020 11:17:11 -0700
Subject: [PATCH 0749/2658] Bluetooth: A2MP: Fix not initializing all members

commit eddb7732119d53400f48a02536a84c509692faa8 upstream.

This fixes various places where a stack variable is used uninitialized.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/a2mp.c | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index 5f123c3320a7..8f918155685d 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -233,6 +233,9 @@ static int a2mp_discover_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
 			struct a2mp_info_req req;
 
 			found = true;
+
+			memset(&req, 0, sizeof(req));
+
 			req.id = cl->id;
 			a2mp_send(mgr, A2MP_GETINFO_REQ, __next_ident(mgr),
 				  sizeof(req), &req);
@@ -312,6 +315,8 @@ static int a2mp_getinfo_req(struct amp_mgr *mgr, struct sk_buff *skb,
 	if (!hdev || hdev->dev_type != HCI_AMP) {
 		struct a2mp_info_rsp rsp;
 
+		memset(&rsp, 0, sizeof(rsp));
+
 		rsp.id = req->id;
 		rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
 
@@ -355,6 +360,8 @@ static int a2mp_getinfo_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
 	if (!ctrl)
 		return -ENOMEM;
 
+	memset(&req, 0, sizeof(req));
+
 	req.id = rsp->id;
 	a2mp_send(mgr, A2MP_GETAMPASSOC_REQ, __next_ident(mgr), sizeof(req),
 		  &req);
@@ -383,6 +390,8 @@ static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb,
 		struct a2mp_amp_assoc_rsp rsp;
 		rsp.id = req->id;
 
+		memset(&rsp, 0, sizeof(rsp));
+
 		if (tmp) {
 			rsp.status = A2MP_STATUS_COLLISION_OCCURED;
 			amp_mgr_put(tmp);
@@ -471,7 +480,6 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
 				   struct a2mp_cmd *hdr)
 {
 	struct a2mp_physlink_req *req = (void *) skb->data;
-
 	struct a2mp_physlink_rsp rsp;
 	struct hci_dev *hdev;
 	struct hci_conn *hcon;
@@ -482,6 +490,8 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
 
 	BT_DBG("local_id %d, remote_id %d", req->local_id, req->remote_id);
 
+	memset(&rsp, 0, sizeof(rsp));
+
 	rsp.local_id = req->remote_id;
 	rsp.remote_id = req->local_id;
 
@@ -560,6 +570,8 @@ static int a2mp_discphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
 
 	BT_DBG("local_id %d remote_id %d", req->local_id, req->remote_id);
 
+	memset(&rsp, 0, sizeof(rsp));
+
 	rsp.local_id = req->remote_id;
 	rsp.remote_id = req->local_id;
 	rsp.status = A2MP_STATUS_SUCCESS;
@@ -682,6 +694,8 @@ static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
 	if (err) {
 		struct a2mp_cmd_rej rej;
 
+		memset(&rej, 0, sizeof(rej));
+
 		rej.reason = cpu_to_le16(0);
 		hdr = (void *) skb->data;
 
@@ -905,6 +919,8 @@ void a2mp_send_getinfo_rsp(struct hci_dev *hdev)
 
 	BT_DBG("%s mgr %p", hdev->name, mgr);
 
+	memset(&rsp, 0, sizeof(rsp));
+
 	rsp.id = hdev->id;
 	rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
 
@@ -1002,6 +1018,8 @@ void a2mp_send_create_phy_link_rsp(struct hci_dev *hdev, u8 status)
 	if (!mgr)
 		return;
 
+	memset(&rsp, 0, sizeof(rsp));
+
 	hs_hcon = hci_conn_hash_lookup_state(hdev, AMP_LINK, BT_CONNECT);
 	if (!hs_hcon) {
 		rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION;
@@ -1034,6 +1052,8 @@ void a2mp_discover_amp(struct l2cap_chan *chan)
 
 	mgr->bredr_chan = chan;
 
+	memset(&req, 0, sizeof(req));
+
 	req.mtu = cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU);
 	req.ext_feat = 0;
 	a2mp_send(mgr, A2MP_DISCOVER_REQ, 1, sizeof(req), &req);

From 95ef61e3cbc495710c6b8fbf09773a99aefff1e0 Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Thu, 6 Aug 2020 11:17:14 -0700
Subject: [PATCH 0750/2658] Bluetooth: MGMT: Fix not checking if BT_HS is
 enabled

commit b560a208cda0297fef6ff85bbfd58a8f0a52a543 upstream.

This checks if BT_HS is enabled relecting it on MGMT_SETTING_HS instead
of always reporting it as supported.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/mgmt.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 1f4a4a790df6..9f2f850f5841 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -628,7 +628,8 @@ static u32 get_supported_settings(struct hci_dev *hdev)
 
 		if (lmp_ssp_capable(hdev)) {
 			settings |= MGMT_SETTING_SSP;
-			settings |= MGMT_SETTING_HS;
+			if (IS_ENABLED(CONFIG_BT_HS))
+				settings |= MGMT_SETTING_HS;
 		}
 
 		if (lmp_sc_capable(hdev))
@@ -2281,6 +2282,10 @@ static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
 
 	BT_DBG("request for %s", hdev->name);
 
+	if (!IS_ENABLED(CONFIG_BT_HS))
+		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+				       MGMT_STATUS_NOT_SUPPORTED);
+
 	status = mgmt_bredr_support(hdev);
 	if (status)
 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,

From 263ba26fc57a33d1fa6a8ead8280446df65ec684 Mon Sep 17 00:00:00 2001
From: Alain Michaud <alainm@chromium.org>
Date: Mon, 27 Jul 2020 20:48:55 +0000
Subject: [PATCH 0751/2658] Bluetooth: fix kernel oops in
 store_pending_adv_report

commit a2ec905d1e160a33b2e210e45ad30445ef26ce0e upstream.

Fix kernel oops observed when an ext adv data is larger than 31 bytes.

This can be reproduced by setting up an advertiser with advertisement
larger than 31 bytes.  The issue is not sensitive to the advertisement
content.  In particular, this was reproduced with an advertisement of
229 bytes filled with 'A'.  See stack trace below.

This is fixed by not catching ext_adv as legacy adv are only cached to
be able to concatenate a scanable adv with its scan response before
sending it up through mgmt.

With ext_adv, this is no longer necessary.

  general protection fault: 0000 [#1] SMP PTI
  CPU: 6 PID: 205 Comm: kworker/u17:0 Not tainted 5.4.0-37-generic #41-Ubuntu
  Hardware name: Dell Inc. XPS 15 7590/0CF6RR, BIOS 1.7.0 05/11/2020
  Workqueue: hci0 hci_rx_work [bluetooth]
  RIP: 0010:hci_bdaddr_list_lookup+0x1e/0x40 [bluetooth]
  Code: ff ff e9 26 ff ff ff 0f 1f 44 00 00 0f 1f 44 00 00 55 48 8b 07 48 89 e5 48 39 c7 75 0a eb 24 48 8b 00 48 39 f8 74 1c 44 8b 06 <44> 39 40 10 75 ef 44 0f b7 4e 04 66 44 39 48 14 75 e3 38 50 16 75
  RSP: 0018:ffffbc6a40493c70 EFLAGS: 00010286
  RAX: 4141414141414141 RBX: 000000000000001b RCX: 0000000000000000
  RDX: 0000000000000000 RSI: ffff9903e76c100f RDI: ffff9904289d4b28
  RBP: ffffbc6a40493c70 R08: 0000000093570362 R09: 0000000000000000
  R10: 0000000000000000 R11: ffff9904344eae38 R12: ffff9904289d4000
  R13: 0000000000000000 R14: 00000000ffffffa3 R15: ffff9903e76c100f
  FS: 0000000000000000(0000) GS:ffff990434580000(0000) knlGS:0000000000000000
  CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00007feed125a000 CR3: 00000001b860a003 CR4: 00000000003606e0
  Call Trace:
    process_adv_report+0x12e/0x560 [bluetooth]
    hci_le_meta_evt+0x7b2/0xba0 [bluetooth]
    hci_event_packet+0x1c29/0x2a90 [bluetooth]
    hci_rx_work+0x19b/0x360 [bluetooth]
    process_one_work+0x1eb/0x3b0
    worker_thread+0x4d/0x400
    kthread+0x104/0x140

Fixes: c215e9397b00 ("Bluetooth: Process extended ADV report event")
Reported-by: Andy Nguyen <theflow@google.com>
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Reported-by: Balakrishna Godavarthi <bgodavar@codeaurora.org>
Signed-off-by: Alain Michaud <alainm@chromium.org>
Tested-by: Sonny Sasaka <sonnysasaka@chromium.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_event.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 7bd8ae4df08d..418b009f3d02 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1133,6 +1133,9 @@ static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
 {
 	struct discovery_state *d = &hdev->discovery;
 
+	if (len > HCI_MAX_AD_LENGTH)
+		return;
+
 	bacpy(&d->last_adv_addr, bdaddr);
 	d->last_adv_addr_type = bdaddr_type;
 	d->last_adv_rssi = rssi;
@@ -4752,6 +4755,11 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
 	u32 flags;
 	u8 *ptr, real_len;
 
+	if (len > HCI_MAX_AD_LENGTH) {
+		pr_err_ratelimited("legacy adv larger than 31 bytes");
+		return;
+	}
+
 	/* Find the end of the data in case the report contains padded zero
 	 * bytes at the end causing an invalid length value.
 	 *
@@ -4812,7 +4820,7 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
 	 */
 	conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
 								direct_addr);
-	if (conn && type == LE_ADV_IND) {
+	if (conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) {
 		/* Store report for later inclusion by
 		 * mgmt_device_connected
 		 */
@@ -4937,10 +4945,14 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
 		struct hci_ev_le_advertising_info *ev = ptr;
 		s8 rssi;
 
-		rssi = ev->data[ev->length];
-		process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
-				   ev->bdaddr_type, NULL, 0, rssi,
-				   ev->data, ev->length);
+		if (ev->length <= HCI_MAX_AD_LENGTH) {
+			rssi = ev->data[ev->length];
+			process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
+					   ev->bdaddr_type, NULL, 0, rssi,
+					   ev->data, ev->length);
+		} else {
+			bt_dev_err(hdev, "Dropping invalid advertising data");
+		}
 
 		ptr += sizeof(*ev) + ev->length + 1;
 	}

From 1f323e82cf988cf801000ca978512b09656df495 Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Tue, 19 May 2020 13:25:19 -0700
Subject: [PATCH 0752/2658] Bluetooth: Consolidate encryption handling in
 hci_encrypt_cfm

commit 3ca44c16b0dcc764b641ee4ac226909f5c421aa3 upstream.

This makes hci_encrypt_cfm calls hci_connect_cfm in case the connection
state is BT_CONFIG so callers don't have to check the state.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: Hans-Christian Noren Egtvedt <hegtvedt@cisco.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/bluetooth/hci_core.h | 20 ++++++++++++++++++--
 net/bluetooth/hci_event.c        | 28 +++-------------------------
 2 files changed, 21 insertions(+), 27 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 7c0c83dfe86e..0269a772bfe1 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -1235,10 +1235,26 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
 		conn->security_cfm_cb(conn, status);
 }
 
-static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status,
-								__u8 encrypt)
+static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status)
 {
 	struct hci_cb *cb;
+	__u8 encrypt;
+
+	if (conn->state == BT_CONFIG) {
+		if (status)
+			conn->state = BT_CONNECTED;
+
+		hci_connect_cfm(conn, status);
+		hci_conn_drop(conn);
+		return;
+	}
+
+	if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+		encrypt = 0x00;
+	else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
+		encrypt = 0x02;
+	else
+		encrypt = 0x01;
 
 	if (conn->sec_level == BT_SECURITY_SDP)
 		conn->sec_level = BT_SECURITY_LOW;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 418b009f3d02..e06dcafbeaf0 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2482,7 +2482,7 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 				     &cp);
 		} else {
 			clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
-			hci_encrypt_cfm(conn, ev->status, 0x00);
+			hci_encrypt_cfm(conn, ev->status);
 		}
 	}
 
@@ -2568,22 +2568,7 @@ static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
 		conn->enc_key_size = rp->key_size;
 	}
 
-	if (conn->state == BT_CONFIG) {
-		conn->state = BT_CONNECTED;
-		hci_connect_cfm(conn, 0);
-		hci_conn_drop(conn);
-	} else {
-		u8 encrypt;
-
-		if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
-			encrypt = 0x00;
-		else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
-			encrypt = 0x02;
-		else
-			encrypt = 0x01;
-
-		hci_encrypt_cfm(conn, 0, encrypt);
-	}
+	hci_encrypt_cfm(conn, 0);
 
 unlock:
 	hci_dev_unlock(hdev);
@@ -2677,14 +2662,7 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
 	}
 
 notify:
-	if (conn->state == BT_CONFIG) {
-		if (!ev->status)
-			conn->state = BT_CONNECTED;
-
-		hci_connect_cfm(conn, ev->status);
-		hci_conn_drop(conn);
-	} else
-		hci_encrypt_cfm(conn, ev->status, ev->encrypt);
+	hci_encrypt_cfm(conn, ev->status);
 
 unlock:
 	hci_dev_unlock(hdev);

From ced8ba3d4f13c901151e58ed1cfb2d2453dc72c9 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Wed, 15 Jul 2020 19:43:33 +0200
Subject: [PATCH 0753/2658] Bluetooth: Fix update of connection state in
 `hci_encrypt_cfm`

commit 339ddaa626995bc6218972ca241471f3717cc5f4 upstream.

Starting with the upgrade to v5.8-rc3, I've noticed I wasn't able to
connect to my Bluetooth headset properly anymore. While connecting to
the device would eventually succeed, bluetoothd seemed to be confused
about the current connection state where the state was flapping hence
and forth. Bisecting this issue led to commit 3ca44c16b0dc (Bluetooth:
Consolidate encryption handling in hci_encrypt_cfm, 2020-05-19), which
refactored `hci_encrypt_cfm` to also handle updating the connection
state.

The commit in question changed the code to call `hci_connect_cfm` inside
`hci_encrypt_cfm` and to change the connection state. But with the
conversion, we now only update the connection state if a status was set
already. In fact, the reverse should be true: the status should be
updated if no status is yet set. So let's fix the isuse by reversing the
condition.

Fixes: 3ca44c16b0dc ("Bluetooth: Consolidate encryption handling in hci_encrypt_cfm")
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Acked-by:  Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/bluetooth/hci_core.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 0269a772bfe1..dfa672b6f89d 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -1241,7 +1241,7 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status)
 	__u8 encrypt;
 
 	if (conn->state == BT_CONFIG) {
-		if (status)
+		if (!status)
 			conn->state = BT_CONNECTED;
 
 		hci_connect_cfm(conn, status);

From 51e8dfb46218f974ade20d1321a8f611d405a36f Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Wed, 20 May 2020 14:20:14 -0700
Subject: [PATCH 0754/2658] Bluetooth: Disconnect if E0 is used for Level 4

commit 8746f135bb01872ff412d408ea1aa9ebd328c1f5 upstream.

E0 is not allowed with Level 4:

BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C page 1319:

  '128-bit equivalent strength for link and encryption keys
   required using FIPS approved algorithms (E0 not allowed,
   SAFER+ not allowed, and P-192 not allowed; encryption key
   not shortened'

SC enabled:

> HCI Event: Read Remote Extended Features (0x23) plen 13
        Status: Success (0x00)
        Handle: 256
        Page: 1/2
        Features: 0x0b 0x00 0x00 0x00 0x00 0x00 0x00 0x00
          Secure Simple Pairing (Host Support)
          LE Supported (Host)
          Secure Connections (Host Support)
> HCI Event: Encryption Change (0x08) plen 4
        Status: Success (0x00)
        Handle: 256
        Encryption: Enabled with AES-CCM (0x02)

SC disabled:

> HCI Event: Read Remote Extended Features (0x23) plen 13
        Status: Success (0x00)
        Handle: 256
        Page: 1/2
        Features: 0x03 0x00 0x00 0x00 0x00 0x00 0x00 0x00
          Secure Simple Pairing (Host Support)
          LE Supported (Host)
> HCI Event: Encryption Change (0x08) plen 4
        Status: Success (0x00)
        Handle: 256
        Encryption: Enabled with E0 (0x01)
[May 8 20:23] Bluetooth: hci0: Invalid security: expect AES but E0 was used
< HCI Command: Disconnect (0x01|0x0006) plen 3
        Handle: 256
        Reason: Authentication Failure (0x05)

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: Hans-Christian Noren Egtvedt <hegtvedt@cisco.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/bluetooth/hci_core.h | 10 ++++++----
 net/bluetooth/hci_conn.c         | 17 +++++++++++++++++
 net/bluetooth/hci_event.c        | 20 ++++++++------------
 3 files changed, 31 insertions(+), 16 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index dfa672b6f89d..5aaf6cdb121a 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -1256,11 +1256,13 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status)
 	else
 		encrypt = 0x01;
 
-	if (conn->sec_level == BT_SECURITY_SDP)
-		conn->sec_level = BT_SECURITY_LOW;
+	if (!status) {
+		if (conn->sec_level == BT_SECURITY_SDP)
+			conn->sec_level = BT_SECURITY_LOW;
 
-	if (conn->pending_sec_level > conn->sec_level)
-		conn->sec_level = conn->pending_sec_level;
+		if (conn->pending_sec_level > conn->sec_level)
+			conn->sec_level = conn->pending_sec_level;
+	}
 
 	mutex_lock(&hci_cb_list_lock);
 	list_for_each_entry(cb, &hci_cb_list, list) {
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 211c2599ab96..6e5316031916 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1173,6 +1173,23 @@ int hci_conn_check_link_mode(struct hci_conn *conn)
 			return 0;
 	}
 
+	 /* AES encryption is required for Level 4:
+	  *
+	  * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C
+	  * page 1319:
+	  *
+	  * 128-bit equivalent strength for link and encryption keys
+	  * required using FIPS approved algorithms (E0 not allowed,
+	  * SAFER+ not allowed, and P-192 not allowed; encryption key
+	  * not shortened)
+	  */
+	if (conn->sec_level == BT_SECURITY_FIPS &&
+	    !test_bit(HCI_CONN_AES_CCM, &conn->flags)) {
+		bt_dev_err(conn->hdev,
+			   "Invalid security: Missing AES-CCM usage");
+		return 0;
+	}
+
 	if (hci_conn_ssp_enabled(conn) &&
 	    !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
 		return 0;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index e06dcafbeaf0..19df2343734f 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2615,24 +2615,20 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
 	clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
 
+	/* Check link security requirements are met */
+	if (!hci_conn_check_link_mode(conn))
+		ev->status = HCI_ERROR_AUTH_FAILURE;
+
 	if (ev->status && conn->state == BT_CONNECTED) {
+		/* Notify upper layers so they can cleanup before
+		 * disconnecting.
+		 */
+		hci_encrypt_cfm(conn, ev->status);
 		hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
 		hci_conn_drop(conn);
 		goto unlock;
 	}
 
-	/* In Secure Connections Only mode, do not allow any connections
-	 * that are not encrypted with AES-CCM using a P-256 authenticated
-	 * combination key.
-	 */
-	if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
-	    (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
-	     conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
-		hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
-		hci_conn_drop(conn);
-		goto unlock;
-	}
-
 	/* Try reading the encryption key size for encrypted ACL links */
 	if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
 		struct hci_cp_read_enc_key_size cp;

From 44376d0662a7491a630d07bfcf6a1d5baef5b680 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Thu, 24 Sep 2020 11:14:10 +0200
Subject: [PATCH 0755/2658] media: usbtv: Fix refcounting mixup

commit bf65f8aabdb37bc1a785884374e919477fe13e10 upstream.

The premature free in the error path is blocked by V4L
refcounting, not USB refcounting. Thanks to
Ben Hutchings for review.

[v2] corrected attributions

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Fixes: 50e704453553 ("media: usbtv: prevent double free in error case")
CC: stable@vger.kernel.org
Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/usbtv/usbtv-core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c
index a2eb87d74656..8a1440a573a3 100644
--- a/drivers/media/usb/usbtv/usbtv-core.c
+++ b/drivers/media/usb/usbtv/usbtv-core.c
@@ -96,7 +96,8 @@ static int usbtv_probe(struct usb_interface *intf,
 
 usbtv_audio_fail:
 	/* we must not free at this point */
-	usb_get_dev(usbtv->udev);
+	v4l2_device_get(&usbtv->v4l2_dev);
+	/* this will undo the v4l2_device_get() */
 	usbtv_video_free(usbtv);
 
 usbtv_video_fail:

From f6445bc1e76c7d5467537cfdb92374daa62137eb Mon Sep 17 00:00:00 2001
From: Wilken Gottwalt <wilken.gottwalt@mailbox.org>
Date: Sat, 3 Oct 2020 11:40:29 +0200
Subject: [PATCH 0756/2658] USB: serial: option: add Cellient MPL200 card

commit 3e765cab8abe7f84cb80d4a7a973fc97d5742647 upstream.

Add usb ids of the Cellient MPL200 card.

Signed-off-by: Wilken Gottwalt <wilken.gottwalt@mailbox.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/3db5418fe9e516f4b290736c5a199c9796025e3c.1601715478.git.wilken.gottwalt@mailbox.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 8cff50ef4fd1..a628a6e4ac4a 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -529,6 +529,7 @@ static void option_instat_callback(struct urb *urb);
 /* Cellient products */
 #define CELLIENT_VENDOR_ID			0x2692
 #define CELLIENT_PRODUCT_MEN200			0x9005
+#define CELLIENT_PRODUCT_MPL200			0x9025
 
 /* Hyundai Petatel Inc. products */
 #define PETATEL_VENDOR_ID			0x1ff4
@@ -1967,6 +1968,8 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) },
 	{ USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
+	{ USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MPL200),
+	  .driver_info = RSVD(1) | RSVD(4) },
 	{ USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600A) },
 	{ USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(TPLINK_VENDOR_ID, TPLINK_PRODUCT_LTE, 0xff, 0x00, 0x00) },	/* TP-Link LTE Module */

From 68a6c60392daaa1bd4b3d3e73598f10ca21b4685 Mon Sep 17 00:00:00 2001
From: Leonid Bloch <lb.workbox@gmail.com>
Date: Sun, 4 Oct 2020 18:58:13 +0300
Subject: [PATCH 0757/2658] USB: serial: option: Add Telit FT980-KS composition

commit 924a9213358fb92fa3c3225d6d042aa058167405 upstream.

This commit adds the following Telit FT980-KS composition:

0x1054: rndis, diag, adb, nmea, modem, modem, aux

AT commands can be sent to /dev/ttyUSB2.

Signed-off-by: Leonid Bloch <lb.workbox@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/ce86bc05-f4e2-b199-0cdc-792715e3f275@asocscloud.com
Link: https://lore.kernel.org/r/20201004155813.2342-1-lb.workbox@gmail.com
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index a628a6e4ac4a..5017d37afe39 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1172,6 +1172,8 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = NCTRL(2) | RSVD(3) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1053, 0xff),	/* Telit FN980 (ECM) */
 	  .driver_info = NCTRL(0) | RSVD(1) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1054, 0xff),	/* Telit FT980-KS */
+	  .driver_info = NCTRL(2) | RSVD(3) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),

From 01bcb632c1e4991bf8d593d41f9249008b49c53b Mon Sep 17 00:00:00 2001
From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Date: Sat, 10 Oct 2020 13:59:32 +0530
Subject: [PATCH 0758/2658] staging: comedi: check validity of wMaxPacketSize
 of usb endpoints found

commit e1f13c879a7c21bd207dc6242455e8e3a1e88b40 upstream.

While finding usb endpoints in vmk80xx_find_usb_endpoints(), check if
wMaxPacketSize = 0 for the endpoints found.

Some devices have isochronous endpoints that have wMaxPacketSize = 0
(as required by the USB-2 spec).
However, since this doesn't apply here, wMaxPacketSize = 0 can be
considered to be invalid.

Reported-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com
Tested-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201010082933.5417-1-anant.thazhemadam@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/vmk80xx.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
index 95e53cfd76a4..51f9a7800edf 100644
--- a/drivers/staging/comedi/drivers/vmk80xx.c
+++ b/drivers/staging/comedi/drivers/vmk80xx.c
@@ -676,6 +676,9 @@ static int vmk80xx_find_usb_endpoints(struct comedi_device *dev)
 	if (!devpriv->ep_rx || !devpriv->ep_tx)
 		return -ENODEV;
 
+	if (!usb_endpoint_maxp(devpriv->ep_rx) || !usb_endpoint_maxp(devpriv->ep_tx))
+		return -EINVAL;
+
 	return 0;
 }
 

From 86eb1c62745b3e156b4bb1a57f67b86e4c9a70ce Mon Sep 17 00:00:00 2001
From: Scott Chen <scott@labau.com.tw>
Date: Thu, 24 Sep 2020 14:27:45 +0800
Subject: [PATCH 0759/2658] USB: serial: pl2303: add device-id for HP GC device

commit 031f9664f8f9356cee662335bc56c93d16e75665 upstream.

This is adds a device id for HP LD381 which is a pl2303GC-base device.

Signed-off-by: Scott Chen <scott@labau.com.tw>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/pl2303.c | 1 +
 drivers/usb/serial/pl2303.h | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 4fcded2971d1..bf5533d6d83b 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -89,6 +89,7 @@ static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
 	{ USB_DEVICE(HP_VENDOR_ID, HP_LD220TA_PRODUCT_ID) },
 	{ USB_DEVICE(HP_VENDOR_ID, HP_LD381_PRODUCT_ID) },
+	{ USB_DEVICE(HP_VENDOR_ID, HP_LD381GC_PRODUCT_ID) },
 	{ USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) },
 	{ USB_DEVICE(HP_VENDOR_ID, HP_LD960TA_PRODUCT_ID) },
 	{ USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) },
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 54d2fb974a41..9d27c076f477 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -125,6 +125,7 @@
 
 /* Hewlett-Packard POS Pole Displays */
 #define HP_VENDOR_ID		0x03f0
+#define HP_LD381GC_PRODUCT_ID	0x0183
 #define HP_LM920_PRODUCT_ID	0x026b
 #define HP_TD620_PRODUCT_ID	0x0956
 #define HP_LD960_PRODUCT_ID	0x0b39

From 3e87e807b3e6d94de1de5f5ce900195bbc677983 Mon Sep 17 00:00:00 2001
From: "Mychaela N. Falconia" <falcon@freecalypso.org>
Date: Wed, 16 Sep 2020 01:56:29 +0000
Subject: [PATCH 0760/2658] USB: serial: ftdi_sio: add support for FreeCalypso
 JTAG+UART adapters

commit 6cf87e5edd9944e1d3b6efd966ea401effc304ee upstream.

There exist many FT2232-based JTAG+UART adapter designs in which
FT2232 Channel A is used for JTAG and Channel B is used for UART.
The best way to handle them in Linux is to have the ftdi_sio driver
create a ttyUSB device only for Channel B and not for Channel A:
a ttyUSB device for Channel A would be bogus and will disappear as
soon as the user runs OpenOCD or other applications that access
Channel A for JTAG from userspace, causing undesirable noise for
users.  The ftdi_sio driver already has a dedicated quirk for such
JTAG+UART FT2232 adapters, and it requires assigning custom USB IDs
to such adapters and adding these IDs to the driver with the
ftdi_jtag_quirk applied.

Boutique hardware manufacturer Falconia Partners LLC has created a
couple of JTAG+UART adapter designs (one buffered, one unbuffered)
as part of FreeCalypso project, and this hardware is specifically made
to be used with Linux hosts, with the intent that Channel A will be
accessed only from userspace via appropriate applications, and that
Channel B will be supported by the ftdi_sio kernel driver, presenting
a standard ttyUSB device to userspace.  Toward this end the hardware
manufacturer will be programming FT2232 EEPROMs with custom USB IDs,
specifically with the intent that these IDs will be recognized by
the ftdi_sio driver with the ftdi_jtag_quirk applied.

Signed-off-by: Mychaela N. Falconia <falcon@freecalypso.org>
[johan: insert in PID order and drop unused define]
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/ftdi_sio.c     | 5 +++++
 drivers/usb/serial/ftdi_sio_ids.h | 7 +++++++
 2 files changed, 12 insertions(+)

diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 25e76d4c1505..5b42b8d760cb 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1032,6 +1032,11 @@ static const struct usb_device_id id_table_combined[] = {
 	/* U-Blox devices */
 	{ USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) },
 	{ USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) },
+	/* FreeCalypso USB adapters */
+	{ USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID),
+		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID),
+		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
 	{ }					/* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index c33e06752b5f..f3302516a1e4 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -38,6 +38,13 @@
 
 #define FTDI_LUMEL_PD12_PID	0x6002
 
+/*
+ * Custom USB adapters made by Falconia Partners LLC
+ * for FreeCalypso project, ID codes allocated to Falconia by FTDI.
+ */
+#define FTDI_FALCONIA_JTAG_BUF_PID	0x7150
+#define FTDI_FALCONIA_JTAG_UNBUF_PID	0x7151
+
 /* Sienna Serial Interface by Secyourit GmbH */
 #define FTDI_SIENNA_PID		0x8348
 

From 39d635c8c4f010057781cfe582a3b46db9605224 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Mon, 21 Sep 2020 15:08:50 +0200
Subject: [PATCH 0761/2658] reiserfs: Initialize inode keys properly

commit 4443390e08d34d5771ab444f601cf71b3c9634a4 upstream.

reiserfs_read_locked_inode() didn't initialize key length properly. Use
_make_cpu_key() macro for key initialization so that all key member are
properly initialized.

CC: stable@vger.kernel.org
Reported-by: syzbot+d94d02749498bb7bab4b@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/reiserfs/inode.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index 60ba35087d12..cfb4691d9274 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -1553,11 +1553,7 @@ void reiserfs_read_locked_inode(struct inode *inode,
 	 * set version 1, version 2 could be used too, because stat data
 	 * key is the same in both versions
 	 */
-	key.version = KEY_FORMAT_3_5;
-	key.on_disk_key.k_dir_id = dirino;
-	key.on_disk_key.k_objectid = inode->i_ino;
-	key.on_disk_key.k_offset = 0;
-	key.on_disk_key.k_type = 0;
+	_make_cpu_key(&key, KEY_FORMAT_3_5, dirino, inode->i_ino, 0, 0, 3);
 
 	/* look for the object's stat data */
 	retval = search_item(inode->i_sb, &key, &path_to_sd);

From a0d75ec499dee34c36012dd304f8a5d8727c600b Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Wed, 30 Sep 2020 17:08:20 +0200
Subject: [PATCH 0762/2658] reiserfs: Fix oops during mount

commit c2bb80b8bdd04dfe32364b78b61b6a47f717af52 upstream.

With suitably crafted reiserfs image and mount command reiserfs will
crash when trying to verify that XATTR_ROOT directory can be looked up
in / as that recurses back to xattr code like:

 xattr_lookup+0x24/0x280 fs/reiserfs/xattr.c:395
 reiserfs_xattr_get+0x89/0x540 fs/reiserfs/xattr.c:677
 reiserfs_get_acl+0x63/0x690 fs/reiserfs/xattr_acl.c:209
 get_acl+0x152/0x2e0 fs/posix_acl.c:141
 check_acl fs/namei.c:277 [inline]
 acl_permission_check fs/namei.c:309 [inline]
 generic_permission+0x2ba/0x550 fs/namei.c:353
 do_inode_permission fs/namei.c:398 [inline]
 inode_permission+0x234/0x4a0 fs/namei.c:463
 lookup_one_len+0xa6/0x200 fs/namei.c:2557
 reiserfs_lookup_privroot+0x85/0x1e0 fs/reiserfs/xattr.c:972
 reiserfs_fill_super+0x2b51/0x3240 fs/reiserfs/super.c:2176
 mount_bdev+0x24f/0x360 fs/super.c:1417

Fix the problem by bailing from reiserfs_xattr_get() when xattrs are not
yet initialized.

CC: stable@vger.kernel.org
Reported-by: syzbot+9b33c9b118d77ff59b6f@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/reiserfs/xattr.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
index d424b3d4bf3b..92d39cbc2d64 100644
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -656,6 +656,13 @@ reiserfs_xattr_get(struct inode *inode, const char *name, void *buffer,
 	if (get_inode_sd_version(inode) == STAT_DATA_V1)
 		return -EOPNOTSUPP;
 
+	/*
+	 * priv_root needn't be initialized during mount so allow initial
+	 * lookups to succeed.
+	 */
+	if (!REISERFS_SB(inode->i_sb)->priv_root)
+		return 0;
+
 	dentry = xattr_lookup(inode, name, XATTR_REPLACE);
 	if (IS_ERR(dentry)) {
 		err = PTR_ERR(dentry);

From 31ad1632ab53daec11eef971bf96aa05fd12afa3 Mon Sep 17 00:00:00 2001
From: yangerkun <yangerkun@huawei.com>
Date: Thu, 15 Oct 2020 22:38:34 +0800
Subject: [PATCH 0763/2658] spi: unbinding slave before calling
 spi_destroy_queue

We make a mistake while backport 'commit 84855678add8 ("spi: Fix
controller unregister order")'. What we should do is call __unreigster
for each device before spi_destroy_queue. This problem exist in
linux-4.4.y/linux-4.9.y.

Signed-off-by: yangerkun <yangerkun@huawei.com>
---
 drivers/spi/spi.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 57001f8f727a..6ed2959ce4dc 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1917,13 +1917,13 @@ static int __unregister(struct device *dev, void *null)
  */
 void spi_unregister_master(struct spi_master *master)
 {
+	device_for_each_child(&master->dev, NULL, __unregister);
+
 	if (master->queued) {
 		if (spi_destroy_queue(master))
 			dev_err(&master->dev, "queue remove failed\n");
 	}
 
-	device_for_each_child(&master->dev, NULL, __unregister);
-
 	mutex_lock(&board_lock);
 	list_del(&master->list);
 	mutex_unlock(&board_lock);

From 59ffefc031c6e54f72d633061727f3a37f0ebe62 Mon Sep 17 00:00:00 2001
From: Dominik Przychodni <dominik.przychodni@intel.com>
Date: Mon, 31 Aug 2020 11:59:59 +0100
Subject: [PATCH 0764/2658] crypto: qat - check cipher length for aead
 AES-CBC-HMAC-SHA

commit 45cb6653b0c355fc1445a8069ba78a4ce8720511 upstream.

Return -EINVAL for authenc(hmac(sha1),cbc(aes)),
authenc(hmac(sha256),cbc(aes)) and authenc(hmac(sha512),cbc(aes))
if the cipher length is not multiple of the AES block.
This is to prevent an undefined device behaviour.

Fixes: d370cec32194 ("crypto: qat - Intel(R) QAT crypto interface")
Cc: <stable@vger.kernel.org>
Signed-off-by: Dominik Przychodni <dominik.przychodni@intel.com>
[giovanni.cabiddu@intel.com: reworded commit message]
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/qat/qat_common/qat_algs.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
index 367b6661ee04..4dda526bd21b 100644
--- a/drivers/crypto/qat/qat_common/qat_algs.c
+++ b/drivers/crypto/qat/qat_common/qat_algs.c
@@ -822,6 +822,11 @@ static int qat_alg_aead_dec(struct aead_request *areq)
 	struct icp_qat_fw_la_bulk_req *msg;
 	int digst_size = crypto_aead_authsize(aead_tfm);
 	int ret, ctr = 0;
+	u32 cipher_len;
+
+	cipher_len = areq->cryptlen - digst_size;
+	if (cipher_len % AES_BLOCK_SIZE != 0)
+		return -EINVAL;
 
 	ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req);
 	if (unlikely(ret))
@@ -836,7 +841,7 @@ static int qat_alg_aead_dec(struct aead_request *areq)
 	qat_req->req.comn_mid.src_data_addr = qat_req->buf.blp;
 	qat_req->req.comn_mid.dest_data_addr = qat_req->buf.bloutp;
 	cipher_param = (void *)&qat_req->req.serv_specif_rqpars;
-	cipher_param->cipher_length = areq->cryptlen - digst_size;
+	cipher_param->cipher_length = cipher_len;
 	cipher_param->cipher_offset = areq->assoclen;
 	memcpy(cipher_param->u.cipher_IV_array, areq->iv, AES_BLOCK_SIZE);
 	auth_param = (void *)((uint8_t *)cipher_param + sizeof(*cipher_param));
@@ -865,6 +870,9 @@ static int qat_alg_aead_enc(struct aead_request *areq)
 	uint8_t *iv = areq->iv;
 	int ret, ctr = 0;
 
+	if (areq->cryptlen % AES_BLOCK_SIZE != 0)
+		return -EINVAL;
+
 	ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req);
 	if (unlikely(ret))
 		return ret;

From c5dabac76c6618637635481138f0f813fa37c872 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sat, 17 Oct 2020 11:03:31 +0200
Subject: [PATCH 0765/2658] Linux 4.4.240

Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Link: https://lore.kernel.org/r/20201016090435.423923738@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 98d0759fccb1..110652b34518 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 239
+SUBLEVEL = 240
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From b10a97bf4c66578d0d59ca728270a64ce2425a9d Mon Sep 17 00:00:00 2001
From: David Wilder <dwilder@us.ibm.com>
Date: Tue, 13 Oct 2020 16:20:14 -0700
Subject: [PATCH 0766/2658] ibmveth: Identify ingress large send packets.

[ Upstream commit 413f142cc05cb03f2d1ea83388e40c1ddc0d74e9 ]

Ingress large send packets are identified by either:
The IBMVETH_RXQ_LRG_PKT flag in the receive buffer
or with a -1 placed in the ip header checksum.
The method used depends on firmware version. Frame
geometry and sufficient header validation is performed by the
hypervisor eliminating the need for further header checks here.

Fixes: 7b5967389f5a ("ibmveth: set correct gso_size and gso_type")
Signed-off-by: David Wilder <dwilder@us.ibm.com>
Reviewed-by: Thomas Falcon <tlfalcon@linux.ibm.com>
Reviewed-by: Cristobal Forno <cris.forno@ibm.com>
Reviewed-by: Pradeep Satyanarayana <pradeeps@linux.vnet.ibm.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/ibm/ibmveth.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index b46fc37c1a94..18d17a7bba6c 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1254,6 +1254,7 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
 			int offset = ibmveth_rxq_frame_offset(adapter);
 			int csum_good = ibmveth_rxq_csum_good(adapter);
 			int lrg_pkt = ibmveth_rxq_large_packet(adapter);
+			__sum16 iph_check = 0;
 
 			skb = ibmveth_rxq_get_buffer(adapter);
 
@@ -1305,7 +1306,17 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
 				}
 			}
 
-			if (length > netdev->mtu + ETH_HLEN) {
+			/* PHYP without PLSO support places a -1 in the ip
+			 * checksum for large send frames.
+			 */
+			if (skb->protocol == cpu_to_be16(ETH_P_IP)) {
+				struct iphdr *iph = (struct iphdr *)skb->data;
+
+				iph_check = iph->check;
+			}
+
+			if ((length > netdev->mtu + ETH_HLEN) ||
+			    lrg_pkt || iph_check == 0xffff) {
 				ibmveth_rx_mss_helper(skb, mss, lrg_pkt);
 				adapter->rx_large_packets++;
 			}

From e9c29c7d2435868b0d8c22131c7ef17ee288df65 Mon Sep 17 00:00:00 2001
From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Wed, 7 Oct 2020 21:12:50 -0700
Subject: [PATCH 0767/2658] tipc: fix the skb_unshare() in tipc_buf_append()

[ Upstream commit ed42989eab57d619667d7e87dfbd8fe207db54fe ]

skb_unshare() drops a reference count on the old skb unconditionally,
so in the failure case, we end up freeing the skb twice here.
And because the skb is allocated in fclone and cloned by caller
tipc_msg_reassemble(), the consequence is actually freeing the
original skb too, thus triggered the UAF by syzbot.

Fix this by replacing this skb_unshare() with skb_cloned()+skb_copy().

Fixes: ff48b6222e65 ("tipc: use skb_unshare() instead in tipc_buf_append()")
Reported-and-tested-by: syzbot+e96a7ba46281824cc46a@syzkaller.appspotmail.com
Cc: Jon Maloy <jmaloy@redhat.com>
Cc: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tipc/msg.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index fc1aa8bcb185..30c3a7985fa4 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -138,7 +138,8 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
 	if (fragid == FIRST_FRAGMENT) {
 		if (unlikely(head))
 			goto err;
-		frag = skb_unshare(frag, GFP_ATOMIC);
+		if (skb_cloned(frag))
+			frag = skb_copy(frag, GFP_ATOMIC);
 		if (unlikely(!frag))
 			goto err;
 		head = *headbuf = frag;

From 4458c0b531a18d2134e917bbf52022995d3e978b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Wed, 23 Sep 2020 13:18:15 -0700
Subject: [PATCH 0768/2658] net/ipv4: always honour route mtu during forwarding
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 02a1b175b0e92d9e0fa5df3957ade8d733ceb6a0 ]

Documentation/networking/ip-sysctl.txt:46 says:
  ip_forward_use_pmtu - BOOLEAN
    By default we don't trust protocol path MTUs while forwarding
    because they could be easily forged and can lead to unwanted
    fragmentation by the router.
    You only need to enable this if you have user-space software
    which tries to discover path mtus by itself and depends on the
    kernel honoring this information. This is normally not the case.
    Default: 0 (disabled)
    Possible values:
    0 - disabled
    1 - enabled

Which makes it pretty clear that setting it to 1 is a potential
security/safety/DoS issue, and yet it is entirely reasonable to want
forwarded traffic to honour explicitly administrator configured
route mtus (instead of defaulting to device mtu).

Indeed, I can't think of a single reason why you wouldn't want to.
Since you configured a route mtu you probably know better...

It is pretty common to have a higher device mtu to allow receiving
large (jumbo) frames, while having some routes via that interface
(potentially including the default route to the internet) specify
a lower mtu.

Note that ipv6 forwarding uses device mtu unless the route is locked
(in which case it will use the route mtu).

This approach is not usable for IPv4 where an 'mtu lock' on a route
also has the side effect of disabling TCP path mtu discovery via
disabling the IPv4 DF (don't frag) bit on all outgoing frames.

I'm not aware of a way to lock a route from an IPv6 RA, so that also
potentially seems wrong.

Signed-off-by: Maciej Żenczykowski <maze@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Sunmeet Gill (Sunny) <sgill@quicinc.com>
Cc: Vinay Paradkar <vparadka@qti.qualcomm.com>
Cc: Tyler Wear <twear@quicinc.com>
Cc: David Ahern <dsahern@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/ip.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/net/ip.h b/include/net/ip.h
index 0a611067daf2..c0429f813013 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -320,12 +320,18 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
 						    bool forwarding)
 {
 	struct net *net = dev_net(dst->dev);
+	unsigned int mtu;
 
 	if (net->ipv4.sysctl_ip_fwd_use_pmtu ||
 	    ip_mtu_locked(dst) ||
 	    !forwarding)
 		return dst_mtu(dst);
 
+	/* 'forwarding = true' case should always honour route mtu */
+	mtu = dst_metric_raw(dst, RTAX_MTU);
+	if (mtu)
+		return mtu;
+
 	return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU);
 }
 

From ed0d3e8aeb4d8950adf5c88678efdae430e3c2fe Mon Sep 17 00:00:00 2001
From: Heiner Kallweit <hkallweit1@gmail.com>
Date: Thu, 1 Oct 2020 09:23:02 +0200
Subject: [PATCH 0769/2658] r8169: fix data corruption issue on RTL8402

[ Upstream commit ef9da46ddef071e1bbb943afbbe9b38771855554 ]

Petr reported that after resume from suspend RTL8402 partially
truncates incoming packets, and re-initializing register RxConfig
before the actual chip re-initialization sequence is needed to avoid
the issue.

Reported-by: Petr Tesarik <ptesarik@suse.cz>
Proposed-by: Petr Tesarik <ptesarik@suse.cz>
Tested-by: Petr Tesarik <ptesarik@suse.cz>
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/realtek/r8169.c | 116 ++++++++++++++-------------
 1 file changed, 60 insertions(+), 56 deletions(-)

diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 8f40e121f7d4..f3a685d3f649 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -4452,6 +4452,62 @@ static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr)
 	rtl_unlock_work(tp);
 }
 
+static void rtl_init_rxcfg(struct rtl8169_private *tp)
+{
+	void __iomem *ioaddr = tp->mmio_addr;
+
+	switch (tp->mac_version) {
+	case RTL_GIGA_MAC_VER_01:
+	case RTL_GIGA_MAC_VER_02:
+	case RTL_GIGA_MAC_VER_03:
+	case RTL_GIGA_MAC_VER_04:
+	case RTL_GIGA_MAC_VER_05:
+	case RTL_GIGA_MAC_VER_06:
+	case RTL_GIGA_MAC_VER_10:
+	case RTL_GIGA_MAC_VER_11:
+	case RTL_GIGA_MAC_VER_12:
+	case RTL_GIGA_MAC_VER_13:
+	case RTL_GIGA_MAC_VER_14:
+	case RTL_GIGA_MAC_VER_15:
+	case RTL_GIGA_MAC_VER_16:
+	case RTL_GIGA_MAC_VER_17:
+		RTL_W32(RxConfig, RX_FIFO_THRESH | RX_DMA_BURST);
+		break;
+	case RTL_GIGA_MAC_VER_18:
+	case RTL_GIGA_MAC_VER_19:
+	case RTL_GIGA_MAC_VER_20:
+	case RTL_GIGA_MAC_VER_21:
+	case RTL_GIGA_MAC_VER_22:
+	case RTL_GIGA_MAC_VER_23:
+	case RTL_GIGA_MAC_VER_24:
+	case RTL_GIGA_MAC_VER_34:
+	case RTL_GIGA_MAC_VER_35:
+		RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST);
+		break;
+	case RTL_GIGA_MAC_VER_40:
+		RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
+		break;
+	case RTL_GIGA_MAC_VER_41:
+	case RTL_GIGA_MAC_VER_42:
+	case RTL_GIGA_MAC_VER_43:
+	case RTL_GIGA_MAC_VER_44:
+	case RTL_GIGA_MAC_VER_45:
+	case RTL_GIGA_MAC_VER_46:
+	case RTL_GIGA_MAC_VER_47:
+	case RTL_GIGA_MAC_VER_48:
+		RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST | RX_EARLY_OFF);
+		break;
+	case RTL_GIGA_MAC_VER_49:
+	case RTL_GIGA_MAC_VER_50:
+	case RTL_GIGA_MAC_VER_51:
+		RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
+		break;
+	default:
+		RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST);
+		break;
+	}
+}
+
 static int rtl_set_mac_address(struct net_device *dev, void *p)
 {
 	struct rtl8169_private *tp = netdev_priv(dev);
@@ -4464,6 +4520,10 @@ static int rtl_set_mac_address(struct net_device *dev, void *p)
 
 	rtl_rar_set(tp, dev->dev_addr);
 
+	/* Reportedly at least Asus X453MA truncates packets otherwise */
+	if (tp->mac_version == RTL_GIGA_MAC_VER_37)
+		rtl_init_rxcfg(tp);
+
 	return 0;
 }
 
@@ -4901,62 +4961,6 @@ static void rtl_init_pll_power_ops(struct rtl8169_private *tp)
 	}
 }
 
-static void rtl_init_rxcfg(struct rtl8169_private *tp)
-{
-	void __iomem *ioaddr = tp->mmio_addr;
-
-	switch (tp->mac_version) {
-	case RTL_GIGA_MAC_VER_01:
-	case RTL_GIGA_MAC_VER_02:
-	case RTL_GIGA_MAC_VER_03:
-	case RTL_GIGA_MAC_VER_04:
-	case RTL_GIGA_MAC_VER_05:
-	case RTL_GIGA_MAC_VER_06:
-	case RTL_GIGA_MAC_VER_10:
-	case RTL_GIGA_MAC_VER_11:
-	case RTL_GIGA_MAC_VER_12:
-	case RTL_GIGA_MAC_VER_13:
-	case RTL_GIGA_MAC_VER_14:
-	case RTL_GIGA_MAC_VER_15:
-	case RTL_GIGA_MAC_VER_16:
-	case RTL_GIGA_MAC_VER_17:
-		RTL_W32(RxConfig, RX_FIFO_THRESH | RX_DMA_BURST);
-		break;
-	case RTL_GIGA_MAC_VER_18:
-	case RTL_GIGA_MAC_VER_19:
-	case RTL_GIGA_MAC_VER_20:
-	case RTL_GIGA_MAC_VER_21:
-	case RTL_GIGA_MAC_VER_22:
-	case RTL_GIGA_MAC_VER_23:
-	case RTL_GIGA_MAC_VER_24:
-	case RTL_GIGA_MAC_VER_34:
-	case RTL_GIGA_MAC_VER_35:
-		RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST);
-		break;
-	case RTL_GIGA_MAC_VER_40:
-		RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
-		break;
-	case RTL_GIGA_MAC_VER_41:
-	case RTL_GIGA_MAC_VER_42:
-	case RTL_GIGA_MAC_VER_43:
-	case RTL_GIGA_MAC_VER_44:
-	case RTL_GIGA_MAC_VER_45:
-	case RTL_GIGA_MAC_VER_46:
-	case RTL_GIGA_MAC_VER_47:
-	case RTL_GIGA_MAC_VER_48:
-		RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST | RX_EARLY_OFF);
-		break;
-	case RTL_GIGA_MAC_VER_49:
-	case RTL_GIGA_MAC_VER_50:
-	case RTL_GIGA_MAC_VER_51:
-		RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
-		break;
-	default:
-		RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST);
-		break;
-	}
-}
-
 static void rtl8169_init_ring_indexes(struct rtl8169_private *tp)
 {
 	tp->dirty_tx = tp->cur_tx = tp->cur_rx = 0;

From 0e6d7145a9259ece40452944e4b80c8f3f639b00 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 7 Oct 2020 10:49:28 +0300
Subject: [PATCH 0770/2658] ALSA: bebob: potential info leak in hwdep_read()

commit b41c15f4e1c1f1657da15c482fa837c1b7384452 upstream.

The "count" variable needs to be capped on every path so that we don't
copy too much information to the user.

Fixes: 618eabeae711 ("ALSA: bebob: Add hwdep interface")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201007074928.GA2529578@mwanda
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/firewire/bebob/bebob_hwdep.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/sound/firewire/bebob/bebob_hwdep.c b/sound/firewire/bebob/bebob_hwdep.c
index ce731f4d8b4f..733ba42e2462 100644
--- a/sound/firewire/bebob/bebob_hwdep.c
+++ b/sound/firewire/bebob/bebob_hwdep.c
@@ -37,12 +37,11 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf,  long count,
 	}
 
 	memset(&event, 0, sizeof(event));
+	count = min_t(long, count, sizeof(event.lock_status));
 	if (bebob->dev_lock_changed) {
 		event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
 		event.lock_status.status = (bebob->dev_lock_count > 0);
 		bebob->dev_lock_changed = false;
-
-		count = min_t(long, count, sizeof(event.lock_status));
 	}
 
 	spin_unlock_irq(&bebob->lock);

From 70f69ad16cfda946b6e0fb0d12b5c14e6b888126 Mon Sep 17 00:00:00 2001
From: Andrey Ryabinin <aryabinin@virtuozzo.com>
Date: Fri, 20 May 2016 16:59:20 -0700
Subject: [PATCH 0771/2658] mm/kasan: print name of mem[set,cpy,move]() caller
 in report

commit 936bb4bbbb832f81055328b84e5afe1fc7246a8d upstream.

When bogus memory access happens in mem[set,cpy,move]() it's usually
caller's fault.  So don't blame mem[set,cpy,move]() in bug report, blame
the caller instead.

Before:
  BUG: KASAN: out-of-bounds access in memset+0x23/0x40 at <address>
After:
  BUG: KASAN: out-of-bounds access in <memset_caller> at <address>

Link: http://lkml.kernel.org/r/1462538722-1574-2-git-send-email-aryabinin@virtuozzo.com
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Acked-by: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

From a01f148d5c6308af1aa756ae9fe595b2abf4988b Mon Sep 17 00:00:00 2001
From: Andrey Ryabinin <aryabinin@virtuozzo.com>
Date: Fri, 20 May 2016 16:59:28 -0700
Subject: [PATCH 0772/2658] mm/kasan: add API to check memory regions

commit 64f8ebaf115bcddc4aaa902f981c57ba6506bc42 upstream.

Memory access coded in an assembly won't be seen by KASAN as a compiler
can instrument only C code.  Add kasan_check_[read,write]() API which is
going to be used to check a certain memory range.

Link: http://lkml.kernel.org/r/1462538722-1574-3-git-send-email-aryabinin@virtuozzo.com
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Acked-by: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 4.4: drop change in MAINTAINERS]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

From 7503ba0d9e255e2f7123ae6a1a7cc37ddd7cfc60 Mon Sep 17 00:00:00 2001
From: Andrey Ryabinin <aryabinin@virtuozzo.com>
Date: Thu, 1 Feb 2018 21:00:48 +0300
Subject: [PATCH 0773/2658] compiler.h, kasan: Avoid duplicating
 __read_once_size_nocheck()

commit bdb5ac801af3d81d36732c2f640d6a1d3df83826 upstream.

Instead of having two identical __read_once_size_nocheck() functions
with different attributes, consolidate all the difference in new macro
__no_kasan_or_inline and use it. No functional changes.

Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/compiler.h | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index e5d349d65ae9..92a51e00b904 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -241,23 +241,21 @@ void __read_once_size(const volatile void *p, void *res, int size)
 
 #ifdef CONFIG_KASAN
 /*
- * This function is not 'inline' because __no_sanitize_address confilcts
+ * We can't declare function 'inline' because __no_sanitize_address confilcts
  * with inlining. Attempt to inline it may cause a build failure.
  * 	https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67368
  * '__maybe_unused' allows us to avoid defined-but-not-used warnings.
  */
-static __no_sanitize_address __maybe_unused
-void __read_once_size_nocheck(const volatile void *p, void *res, int size)
-{
-	__READ_ONCE_SIZE;
-}
+# define __no_kasan_or_inline __no_sanitize_address __maybe_unused
 #else
-static __always_inline
+# define __no_kasan_or_inline __always_inline
+#endif
+
+static __no_kasan_or_inline
 void __read_once_size_nocheck(const volatile void *p, void *res, int size)
 {
 	__READ_ONCE_SIZE;
 }
-#endif
 
 static __always_inline void __write_once_size(volatile void *p, void *res, int size)
 {

From 9dc198098de0393746ab8167de61ff8879b49667 Mon Sep 17 00:00:00 2001
From: Andrey Ryabinin <aryabinin@virtuozzo.com>
Date: Thu, 1 Feb 2018 21:00:49 +0300
Subject: [PATCH 0774/2658] compiler.h: Add read_word_at_a_time() function.

commit 7f1e541fc8d57a143dd5df1d0a1276046e08c083 upstream.

Sometimes we know that it's safe to do potentially out-of-bounds access
because we know it won't cross a page boundary.  Still, KASAN will
report this as a bug.

Add read_word_at_a_time() function which is supposed to be used in such
cases.  In read_word_at_a_time() KASAN performs relaxed check - only the
first byte of access is validated.

Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 4.4: adjust context]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/compiler.h | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 92a51e00b904..7cabe0cc8665 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -292,6 +292,7 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
  * with an explicit memory barrier or atomic instruction that provides the
  * required ordering.
  */
+#include <linux/kasan-checks.h>
 
 #define __READ_ONCE(x, check)						\
 ({									\
@@ -310,6 +311,13 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
  */
 #define READ_ONCE_NOCHECK(x) __READ_ONCE(x, 0)
 
+static __no_kasan_or_inline
+unsigned long read_word_at_a_time(const void *addr)
+{
+	kasan_check_read(addr, 1);
+	return *(unsigned long *)addr;
+}
+
 #define WRITE_ONCE(x, val) \
 ({							\
 	union { typeof(x) __val; char __c[1]; } __u =	\

From 0759c4409a77afe6982b4118862496a0a9263e62 Mon Sep 17 00:00:00 2001
From: Andrey Ryabinin <aryabinin@virtuozzo.com>
Date: Thu, 1 Feb 2018 21:00:50 +0300
Subject: [PATCH 0775/2658] lib/strscpy: Shut up KASAN false-positives in
 strscpy()

commit 1a3241ff10d038ecd096d03380327f2a0b5840a6 upstream.

strscpy() performs the word-at-a-time optimistic reads.  So it may may
access the memory past the end of the object, which is perfectly fine
since strscpy() doesn't use that (past-the-end) data and makes sure the
optimistic read won't cross a page boundary.

Use new read_word_at_a_time() to shut up the KASAN.

Note that this potentially could hide some bugs.  In example bellow,
stscpy() will copy more than we should (1-3 extra uninitialized bytes):

        char dst[8];
        char *src;

        src = kmalloc(5, GFP_KERNEL);
        memset(src, 0xff, 5);
        strscpy(dst, src, 8);

Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/string.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/string.c b/lib/string.c
index c9983dc01e72..7f4baad6fb19 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -202,7 +202,7 @@ ssize_t strscpy(char *dest, const char *src, size_t count)
 	while (max >= sizeof(unsigned long)) {
 		unsigned long c, data;
 
-		c = *(unsigned long *)(src+res);
+		c = read_word_at_a_time(src+res);
 		if (has_zero(c, &data, &constants)) {
 			data = prep_zero_mask(c, data, &constants);
 			data = create_zero_mask(data);

From 9632f2c9aa3b12e08c7939eceda367344236d758 Mon Sep 17 00:00:00 2001
From: Andrey Ryabinin <aryabinin@virtuozzo.com>
Date: Fri, 10 Feb 2017 12:54:05 +0300
Subject: [PATCH 0776/2658] x86/mm/ptdump: Fix soft lockup in page table walker

commit 146fbb766934dc003fcbf755b519acef683576bf upstream.

CONFIG_KASAN=y needs a lot of virtual memory mapped for its shadow.
In that case ptdump_walk_pgd_level_core() takes a lot of time to
walk across all page tables and doing this without
a rescheduling causes soft lockups:

 NMI watchdog: BUG: soft lockup - CPU#3 stuck for 23s! [swapper/0:1]
 ...
 Call Trace:
  ptdump_walk_pgd_level_core+0x40c/0x550
  ptdump_walk_pgd_level_checkwx+0x17/0x20
  mark_rodata_ro+0x13b/0x150
  kernel_init+0x2f/0x120
  ret_from_fork+0x2c/0x40

I guess that this issue might arise even without KASAN on huge machines
with several terabytes of RAM.

Stick cond_resched() in pgd loop to fix this.

Reported-by: Tobias Regnery <tobias.regnery@gmail.com>
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: kasan-dev@googlegroups.com
Cc: Alexander Potapenko <glider@google.com>
Cc: "Paul E . McKenney" <paulmck@linux.vnet.ibm.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/20170210095405.31802-1-aryabinin@virtuozzo.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
[bwh: Backported to 4.4: adjust context]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/mm/dump_pagetables.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
index 0f1c6fc3ddd8..47770ccab6d7 100644
--- a/arch/x86/mm/dump_pagetables.c
+++ b/arch/x86/mm/dump_pagetables.c
@@ -15,6 +15,7 @@
 #include <linux/debugfs.h>
 #include <linux/mm.h>
 #include <linux/module.h>
+#include <linux/sched.h>
 #include <linux/seq_file.h>
 
 #include <asm/pgtable.h>
@@ -407,6 +408,7 @@ static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd,
 		} else
 			note_page(m, &st, __pgprot(0), 1);
 
+		cond_resched();
 		start++;
 	}
 

From baa2021e1ae6021d75e31ae13d985e396539ff48 Mon Sep 17 00:00:00 2001
From: Xie He <xie.he.0141@gmail.com>
Date: Mon, 19 Oct 2020 18:31:52 -0700
Subject: [PATCH 0777/2658] net: hdlc: In hdlc_rcv, check to make sure dev is
 an HDLC device

[ Upstream commit 01c4ceae0a38a0bdbfea6896f41efcd985a9c064 ]

The hdlc_rcv function is used as hdlc_packet_type.func to process any
skb received in the kernel with skb->protocol == htons(ETH_P_HDLC).
The purpose of this function is to provide second-stage processing for
skbs not assigned a "real" L3 skb->protocol value in the first stage.

This function assumes the device from which the skb is received is an
HDLC device (a device created by this module). It assumes that
netdev_priv(dev) returns a pointer to "struct hdlc_device".

However, it is possible that some driver in the kernel (not necessarily
in our control) submits a received skb with skb->protocol ==
htons(ETH_P_HDLC), from a non-HDLC device. In this case, the skb would
still be received by hdlc_rcv. This will cause problems.

hdlc_rcv should be able to recognize and drop invalid skbs. It should
first make sure "dev" is actually an HDLC device, before starting its
processing. This patch adds this check to hdlc_rcv.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: Krzysztof Halasa <khc@pm.waw.pl>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Link: https://lore.kernel.org/r/20201020013152.89259-1-xie.he.0141@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wan/hdlc.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wan/hdlc.c b/drivers/net/wan/hdlc.c
index 51f6cee8aab2..b9216c3d4946 100644
--- a/drivers/net/wan/hdlc.c
+++ b/drivers/net/wan/hdlc.c
@@ -57,7 +57,15 @@ int hdlc_change_mtu(struct net_device *dev, int new_mtu)
 static int hdlc_rcv(struct sk_buff *skb, struct net_device *dev,
 		    struct packet_type *p, struct net_device *orig_dev)
 {
-	struct hdlc_device *hdlc = dev_to_hdlc(dev);
+	struct hdlc_device *hdlc;
+
+	/* First make sure "dev" is an HDLC device */
+	if (!(dev->priv_flags & IFF_WAN_HDLC)) {
+		kfree_skb(skb);
+		return NET_RX_SUCCESS;
+	}
+
+	hdlc = dev_to_hdlc(dev);
 
 	if (!net_eq(dev_net(dev), &init_net)) {
 		kfree_skb(skb);

From 22681e95dda9e3afbbde356db7f80303cdc440f6 Mon Sep 17 00:00:00 2001
From: Xie He <xie.he.0141@gmail.com>
Date: Mon, 19 Oct 2020 23:34:20 -0700
Subject: [PATCH 0778/2658] net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING
 flag after calling ether_setup

[ Upstream commit 5fce1e43e2d5bf2f7e3224d7b99b1c65ab2c26e2 ]

This driver calls ether_setup to set up the network device.
The ether_setup function would add the IFF_TX_SKB_SHARING flag to the
device. This flag indicates that it is safe to transmit shared skbs to
the device.

However, this is not true. This driver may pad the frame (in eth_tx)
before transmission, so the skb may be modified.

Fixes: 550fd08c2ceb ("net: Audit drivers to identify those needing IFF_TX_SKB_SHARING cleared")
Cc: Neil Horman <nhorman@tuxdriver.com>
Cc: Krzysztof Halasa <khc@pm.waw.pl>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Link: https://lore.kernel.org/r/20201020063420.187497-1-xie.he.0141@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wan/hdlc_raw_eth.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wan/hdlc_raw_eth.c b/drivers/net/wan/hdlc_raw_eth.c
index 3ab72b3082de..bb7c362b23ad 100644
--- a/drivers/net/wan/hdlc_raw_eth.c
+++ b/drivers/net/wan/hdlc_raw_eth.c
@@ -101,6 +101,7 @@ static int raw_eth_ioctl(struct net_device *dev, struct ifreq *ifr)
 		old_qlen = dev->tx_queue_len;
 		ether_setup(dev);
 		dev->tx_queue_len = old_qlen;
+		dev->priv_flags &= ~IFF_TX_SKB_SHARING;
 		eth_hw_addr_random(dev);
 		netif_dormant_off(dev);
 		return 0;

From 81e7f49e5329eadc7e4ddfbe190afdfc2f46039e Mon Sep 17 00:00:00 2001
From: Defang Bo <bodefang@126.com>
Date: Mon, 19 Oct 2020 19:38:58 +0800
Subject: [PATCH 0779/2658] nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME
 attribute in nfc_genl_fw_download()

[ Upstream commit 280e3ebdafb863b3cb50d5842f056267e15bf40c ]

Check that the NFC_ATTR_FIRMWARE_NAME attributes are provided by
the netlink client prior to accessing them.This prevents potential
unhandled NULL pointer dereference exceptions which can be triggered
by malicious user-mode programs, if they omit one or both of these
attributes.

Similar to commit a0323b979f81 ("nfc: Ensure presence of required attributes in the activate_target handler").

Fixes: 9674da8759df ("NFC: Add firmware upload netlink command")
Signed-off-by: Defang Bo <bodefang@126.com>
Link: https://lore.kernel.org/r/1603107538-4744-1-git-send-email-bodefang@126.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/nfc/netlink.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index c9d5e9c62178..639e5cad0442 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -1190,7 +1190,7 @@ static int nfc_genl_fw_download(struct sk_buff *skb, struct genl_info *info)
 	u32 idx;
 	char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1];
 
-	if (!info->attrs[NFC_ATTR_DEVICE_INDEX])
+	if (!info->attrs[NFC_ATTR_DEVICE_INDEX] || !info->attrs[NFC_ATTR_FIRMWARE_NAME])
 		return -EINVAL;
 
 	idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);

From 1d34f2a53922898b40b853008c11452671d0453e Mon Sep 17 00:00:00 2001
From: Neal Cardwell <ncardwell@google.com>
Date: Thu, 22 Oct 2020 10:33:31 -0400
Subject: [PATCH 0780/2658] tcp: fix to update snd_wl1 in bulk receiver fast
 path

[ Upstream commit 18ded910b589839e38a51623a179837ab4cc3789 ]

In the header prediction fast path for a bulk data receiver, if no
data is newly acknowledged then we do not call tcp_ack() and do not
call tcp_ack_update_window(). This means that a bulk receiver that
receives large amounts of data can have the incoming sequence numbers
wrap, so that the check in tcp_may_update_window fails:
   after(ack_seq, tp->snd_wl1)

If the incoming receive windows are zero in this state, and then the
connection that was a bulk data receiver later wants to send data,
that connection can find itself persistently rejecting the window
updates in incoming ACKs. This means the connection can persistently
fail to discover that the receive window has opened, which in turn
means that the connection is unable to send anything, and the
connection's sending process can get permanently "stuck".

The fix is to update snd_wl1 in the header prediction fast path for a
bulk data receiver, so that it keeps up and does not see wrapping
problems.

This fix is based on a very nice and thorough analysis and diagnosis
by Apollon Oikonomopoulos (see link below).

This is a stable candidate but there is no Fixes tag here since the
bug predates current git history. Just for fun: looks like the bug
dates back to when header prediction was added in Linux v2.1.8 in Nov
1996. In that version tcp_rcv_established() was added, and the code
only updates snd_wl1 in tcp_ack(), and in the new "Bulk data transfer:
receiver" code path it does not call tcp_ack(). This fix seems to
apply cleanly at least as far back as v3.2.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Reported-by: Apollon Oikonomopoulos <apoikos@dmesg.gr>
Tested-by: Apollon Oikonomopoulos <apoikos@dmesg.gr>
Link: https://www.spinics.net/lists/netdev/msg692430.html
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20201022143331.1887495-1-ncardwell.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_input.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 7510f578c2c1..14ed25f50ed5 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5533,6 +5533,8 @@ void tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
 				tcp_data_snd_check(sk);
 				if (!inet_csk_ack_scheduled(sk))
 					goto no_ack;
+			} else {
+				tcp_update_wl(tp, TCP_SKB_CB(skb)->seq);
 			}
 
 			__tcp_ack_snd_check(sk, 0);

From 3c8ee32f5ba05b753cf992625988b187fe2622a5 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 15 Oct 2020 11:42:00 -0700
Subject: [PATCH 0781/2658] icmp: randomize the global rate limiter

[ Upstream commit b38e7819cae946e2edf869e604af1e65a5d241c5 ]

Keyu Man reported that the ICMP rate limiter could be used
by attackers to get useful signal. Details will be provided
in an upcoming academic publication.

Our solution is to add some noise, so that the attackers
no longer can get help from the predictable token bucket limiter.

Fixes: 4cdf507d5452 ("icmp: add a global rate limitation")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Keyu Man <kman001@ucr.edu>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/networking/ip-sysctl.txt | 4 +++-
 net/ipv4/icmp.c                        | 7 +++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 0d7b88acd015..59ff536f4c03 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -883,12 +883,14 @@ icmp_ratelimit - INTEGER
 icmp_msgs_per_sec - INTEGER
 	Limit maximal number of ICMP packets sent per second from this host.
 	Only messages whose type matches icmp_ratemask (see below) are
-	controlled by this limit.
+	controlled by this limit. For security reasons, the precise count
+	of messages per second is randomized.
 	Default: 1000
 
 icmp_msgs_burst - INTEGER
 	icmp_msgs_per_sec controls number of ICMP packets sent per second,
 	while icmp_msgs_burst controls the burst size of these packets.
+	For security reasons, the precise burst size is randomized.
 	Default: 50
 
 icmp_ratemask - INTEGER
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 41559375e58c..d3685fa18246 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -246,7 +246,7 @@ static struct {
 /**
  * icmp_global_allow - Are we allowed to send one more ICMP message ?
  *
- * Uses a token bucket to limit our ICMP messages to sysctl_icmp_msgs_per_sec.
+ * Uses a token bucket to limit our ICMP messages to ~sysctl_icmp_msgs_per_sec.
  * Returns false if we reached the limit and can not send another packet.
  * Note: called with BH disabled
  */
@@ -274,7 +274,10 @@ bool icmp_global_allow(void)
 	}
 	credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst);
 	if (credit) {
-		credit--;
+		/* We want to use a credit of one in average, but need to randomize
+		 * it for security reasons.
+		 */
+		credit = max_t(int, credit - prandom_u32_max(3), 0);
 		rc = true;
 	}
 	WRITE_ONCE(icmp_global.credit, credit);

From 6db4b6fb3dd275ca3ab410a65c557072a34f5a49 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 16 Sep 2020 23:18:21 +0300
Subject: [PATCH 0782/2658] cifs: remove bogus debug code

commit d367cb960ce88914898cbfa43645c2e43ede9465 upstream.

The "end" pointer is either NULL or it points to the next byte to parse.
If there isn't a next byte then dereferencing "end" is an off-by-one out
of bounds error.  And, of course, if it's NULL that leads to an Oops.
Printing "*end" doesn't seem very useful so let's delete this code.

Also for the last debug statement, I noticed that it should be printing
"sequence_end" instead of "end" so fix that as well.

Reported-by: Dominik Maier <dmaier@sect.tu-berlin.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/asn1.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
index a3b56544c21b..ae1f2817bd6a 100644
--- a/fs/cifs/asn1.c
+++ b/fs/cifs/asn1.c
@@ -541,8 +541,8 @@ decode_negTokenInit(unsigned char *security_blob, int length,
 		return 0;
 	} else if ((cls != ASN1_CTX) || (con != ASN1_CON)
 		   || (tag != ASN1_EOC)) {
-		cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 0\n",
-			 cls, con, tag, end, *end);
+		cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 0\n",
+			 cls, con, tag, end);
 		return 0;
 	}
 
@@ -552,8 +552,8 @@ decode_negTokenInit(unsigned char *security_blob, int length,
 		return 0;
 	} else if ((cls != ASN1_UNI) || (con != ASN1_CON)
 		   || (tag != ASN1_SEQ)) {
-		cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 1\n",
-			 cls, con, tag, end, *end);
+		cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 1\n",
+			 cls, con, tag, end);
 		return 0;
 	}
 
@@ -563,8 +563,8 @@ decode_negTokenInit(unsigned char *security_blob, int length,
 		return 0;
 	} else if ((cls != ASN1_CTX) || (con != ASN1_CON)
 		   || (tag != ASN1_EOC)) {
-		cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 0\n",
-			 cls, con, tag, end, *end);
+		cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 0\n",
+			 cls, con, tag, end);
 		return 0;
 	}
 
@@ -575,8 +575,8 @@ decode_negTokenInit(unsigned char *security_blob, int length,
 		return 0;
 	} else if ((cls != ASN1_UNI) || (con != ASN1_CON)
 		   || (tag != ASN1_SEQ)) {
-		cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 1\n",
-			 cls, con, tag, end, *end);
+		cifs_dbg(FYI, "cls = %d con = %d tag = %d sequence_end = %p exit 1\n",
+			 cls, con, tag, sequence_end);
 		return 0;
 	}
 

From 6bb2dd167bbffb3d3770b7454ec413e22c259553 Mon Sep 17 00:00:00 2001
From: Roberto Sassu <roberto.sassu@huawei.com>
Date: Fri, 4 Sep 2020 11:23:28 +0200
Subject: [PATCH 0783/2658] ima: Don't ignore errors from crypto_shash_update()

commit 60386b854008adc951c470067f90a2d85b5d520f upstream.

Errors returned by crypto_shash_update() are not checked in
ima_calc_boot_aggregate_tfm() and thus can be overwritten at the next
iteration of the loop. This patch adds a check after calling
crypto_shash_update() and returns immediately if the result is not zero.

Cc: stable@vger.kernel.org
Fixes: 3323eec921efd ("integrity: IMA as an integrity service provider")
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 security/integrity/ima/ima_crypto.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
index 5c87baaefafb..0c0df76170ae 100644
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -555,6 +555,8 @@ static int __init ima_calc_boot_aggregate_tfm(char *digest,
 		ima_pcrread(i, pcr_i);
 		/* now accumulate with current aggregate */
 		rc = crypto_shash_update(shash, pcr_i, TPM_DIGEST_SIZE);
+		if (rc != 0)
+			return rc;
 	}
 	if (!rc)
 		crypto_shash_final(shash, digest);

From 44b68c6ba24da7fa1beb03785943df00f5c6fb04 Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Wed, 26 Aug 2020 20:14:37 +0800
Subject: [PATCH 0784/2658] EDAC/i5100: Fix error handling order in
 i5100_init_one()

[ Upstream commit 857a3139bd8be4f702c030c8ca06f3fd69c1741a ]

When pci_get_device_func() fails, the driver doesn't need to execute
pci_dev_put(). mci should still be freed, though, to prevent a memory
leak. When pci_enable_device() fails, the error injection PCI device
"einj" doesn't need to be disabled either.

 [ bp: Massage commit message, rename label to "bail_mc_free". ]

Fixes: 52608ba205461 ("i5100_edac: probe for device 19 function 0")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20200826121437.31606-1-dinghao.liu@zju.edu.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/edac/i5100_edac.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c
index 40917775dca1..59d10f48ed6a 100644
--- a/drivers/edac/i5100_edac.c
+++ b/drivers/edac/i5100_edac.c
@@ -1075,16 +1075,15 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
 				    PCI_DEVICE_ID_INTEL_5100_19, 0);
 	if (!einj) {
 		ret = -ENODEV;
-		goto bail_einj;
+		goto bail_mc_free;
 	}
 
 	rc = pci_enable_device(einj);
 	if (rc < 0) {
 		ret = rc;
-		goto bail_disable_einj;
+		goto bail_einj;
 	}
 
-
 	mci->pdev = &pdev->dev;
 
 	priv = mci->pvt_info;
@@ -1151,14 +1150,14 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
 bail_scrub:
 	priv->scrub_enable = 0;
 	cancel_delayed_work_sync(&(priv->i5100_scrubbing));
-	edac_mc_free(mci);
-
-bail_disable_einj:
 	pci_disable_device(einj);
 
 bail_einj:
 	pci_dev_put(einj);
 
+bail_mc_free:
+	edac_mc_free(mci);
+
 bail_disable_ch1:
 	pci_disable_device(ch1mm);
 

From 1f2df9b60cfc3cd8afd2587d989ee22f45dfb3ac Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sun, 2 Aug 2020 16:56:48 +0200
Subject: [PATCH 0785/2658] crypto: ixp4xx - Fix the size used in a
 'dma_free_coherent()' call

[ Upstream commit f7ade9aaf66bd5599690acf0597df2c0f6cd825a ]

Update the size used in 'dma_free_coherent()' in order to match the one
used in the corresponding 'dma_alloc_coherent()', in 'setup_crypt_desc()'.

Fixes: 81bef0150074 ("crypto: ixp4xx - Hardware crypto support for IXP4xx CPUs")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/ixp4xx_crypto.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index 8f2790353281..13657105cfb9 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -533,7 +533,7 @@ static void release_ixp_crypto(struct device *dev)
 
 	if (crypt_virt) {
 		dma_free_coherent(dev,
-			NPE_QLEN_TOTAL * sizeof( struct crypt_ctl),
+			NPE_QLEN * sizeof(struct crypt_ctl),
 			crypt_virt, crypt_phys);
 	}
 	return;

From 3536715332763455d100dad1b53a9a925a2b99ef Mon Sep 17 00:00:00 2001
From: Sylwester Nawrocki <s.nawrocki@samsung.com>
Date: Mon, 10 Aug 2020 17:32:39 +0200
Subject: [PATCH 0786/2658] media: Revert "media: exynos4-is: Add missed check
 for pinctrl_lookup_state()"

[ Upstream commit 00d21f325d58567d81d9172096692d0a9ea7f725 ]

The "idle" pinctrl state is optional as documented in the DT binding.
The change introduced by the commit being reverted makes that pinctrl state
mandatory and breaks initialization of the whole media driver, since the
"idle" state is not specified in any mainline dts.

This reverts commit 18ffec750578 ("media: exynos4-is: Add missed check for pinctrl_lookup_state()")
to fix the regression.

Fixes: 18ffec750578 ("media: exynos4-is: Add missed check for pinctrl_lookup_state()")
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/exynos4-is/media-dev.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
index 31cc7d94064e..6bc3c8a2e144 100644
--- a/drivers/media/platform/exynos4-is/media-dev.c
+++ b/drivers/media/platform/exynos4-is/media-dev.c
@@ -1170,11 +1170,9 @@ static int fimc_md_get_pinctrl(struct fimc_md *fmd)
 	if (IS_ERR(pctl->state_default))
 		return PTR_ERR(pctl->state_default);
 
+	/* PINCTRL_STATE_IDLE is optional */
 	pctl->state_idle = pinctrl_lookup_state(pctl->pinctrl,
 					PINCTRL_STATE_IDLE);
-	if (IS_ERR(pctl->state_idle))
-		return PTR_ERR(pctl->state_idle);
-
 	return 0;
 }
 

From 8aec32c64729d21d2dce181c81da18b15c57f0e1 Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Sun, 19 Jul 2020 17:34:47 +0200
Subject: [PATCH 0787/2658] media: m5mols: Check function pointer in
 m5mols_sensor_power

[ Upstream commit 52438c4463ac904d14bf3496765e67750766f3a6 ]

clang static analysis reports this error

m5mols_core.c:767:4: warning: Called function pointer
  is null (null dereference) [core.CallAndMessage]
    info->set_power(&client->dev, 0);
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In other places, the set_power ptr is checked.
So add a check.

Fixes: bc125106f8af ("[media] Add support for M-5MOLS 8 Mega Pixel camera ISP")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/m5mols/m5mols_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/i2c/m5mols/m5mols_core.c b/drivers/media/i2c/m5mols/m5mols_core.c
index 6404c0d93e7a..514267680dc9 100644
--- a/drivers/media/i2c/m5mols/m5mols_core.c
+++ b/drivers/media/i2c/m5mols/m5mols_core.c
@@ -754,7 +754,8 @@ static int m5mols_sensor_power(struct m5mols_info *info, bool enable)
 
 		ret = regulator_bulk_enable(ARRAY_SIZE(supplies), supplies);
 		if (ret) {
-			info->set_power(&client->dev, 0);
+			if (info->set_power)
+				info->set_power(&client->dev, 0);
 			return ret;
 		}
 

From 209281e3ae277a39153bed017b5ea27bf8d37361 Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Mon, 24 Aug 2020 08:53:52 +0200
Subject: [PATCH 0788/2658] media: omap3isp: Fix memleak in isp_probe

[ Upstream commit d8fc21c17099635e8ebd986d042be65a6c6b5bd0 ]

When devm_ioremap_resource() fails, isp should be
freed just like other error paths in isp_probe.

Fixes: 8644cdf972dd6 ("[media] omap3isp: Replace many MMIO regions by two")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/omap3isp/isp.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
index f41e0d08de93..4c6842202e47 100644
--- a/drivers/media/platform/omap3isp/isp.c
+++ b/drivers/media/platform/omap3isp/isp.c
@@ -2388,8 +2388,10 @@ static int isp_probe(struct platform_device *pdev)
 		mem = platform_get_resource(pdev, IORESOURCE_MEM, i);
 		isp->mmio_base[map_idx] =
 			devm_ioremap_resource(isp->dev, mem);
-		if (IS_ERR(isp->mmio_base[map_idx]))
-			return PTR_ERR(isp->mmio_base[map_idx]);
+		if (IS_ERR(isp->mmio_base[map_idx])) {
+			ret = PTR_ERR(isp->mmio_base[map_idx]);
+			goto error;
+		}
 	}
 
 	ret = isp_get_clocks(isp);

From 447578f61d08a1015640abe484ffc8656e3d4785 Mon Sep 17 00:00:00 2001
From: Tero Kristo <t-kristo@ti.com>
Date: Mon, 7 Sep 2020 10:56:24 +0300
Subject: [PATCH 0789/2658] crypto: omap-sham - fix digcnt register handling
 with export/import

[ Upstream commit 3faf757bad75f3fc1b2736f0431e295a073a7423 ]

Running export/import for hashes in peculiar order (mostly done by
openssl) can mess up the internal book keeping of the OMAP SHA core.
Fix by forcibly writing the correct DIGCNT back to hardware. This issue
was noticed while transitioning to openssl 1.1 support.

Fixes: 0d373d603202 ("crypto: omap-sham - Add OMAP4/AM33XX SHAM Support")
Signed-off-by: Tero Kristo <t-kristo@ti.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/omap-sham.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
index 48adb2a0903e..7e9a44cee425 100644
--- a/drivers/crypto/omap-sham.c
+++ b/drivers/crypto/omap-sham.c
@@ -453,6 +453,9 @@ static void omap_sham_write_ctrl_omap4(struct omap_sham_dev *dd, size_t length,
 	struct omap_sham_reqctx *ctx = ahash_request_ctx(dd->req);
 	u32 val, mask;
 
+	if (likely(ctx->digcnt))
+		omap_sham_write(dd, SHA_REG_DIGCNT(dd), ctx->digcnt);
+
 	/*
 	 * Setting ALGO_CONST only for the first iteration and
 	 * CLOSE_HASH only for the last one. Note that flags mode bits

From 2fea6822cddf60f864741bb3a9019151ae5092df Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Sun, 30 Aug 2020 18:30:43 +0200
Subject: [PATCH 0790/2658] media: tc358743: initialize variable

[ Upstream commit 274cf92d5dff5c2fec1a518078542ffe70d07646 ]

clang static analysis flags this error

tc358743.c:1468:9: warning: Branch condition evaluates
  to a garbage value
        return handled ? IRQ_HANDLED : IRQ_NONE;
               ^~~~~~~
handled should be initialized to false.

Fixes: d747b806abf4 ("[media] tc358743: add direct interrupt handling")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/tc358743.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index bc630a719776..1e95fdb61041 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -1325,7 +1325,7 @@ static int tc358743_isr(struct v4l2_subdev *sd, u32 status, bool *handled)
 static irqreturn_t tc358743_irq_handler(int irq, void *dev_id)
 {
 	struct tc358743_state *state = dev_id;
-	bool handled;
+	bool handled = false;
 
 	tc358743_isr(&state->sd, 0, &handled);
 

From ad403b10ed98caf2d83bf75a3716479ff0485f8c Mon Sep 17 00:00:00 2001
From: Qiushi Wu <wu000273@umn.edu>
Date: Sun, 14 Jun 2020 04:56:05 +0200
Subject: [PATCH 0791/2658] media: ti-vpe: Fix a missing check and reference
 count leak

[ Upstream commit 7dae2aaaf432767ca7aa11fa84643a7c2600dbdd ]

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
pm_runtime_put_noidle() is not called in error handling paths.
And also, when the call of function vpe_runtime_get() failed,
we won't call vpe_runtime_put().
Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails
inside vpe_runtime_get().

Fixes: 4571912743ac ("[media] v4l: ti-vpe: Add VPE mem to mem driver")
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/ti-vpe/vpe.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c
index b5f8c425cd2e..8a3714bfb77e 100644
--- a/drivers/media/platform/ti-vpe/vpe.c
+++ b/drivers/media/platform/ti-vpe/vpe.c
@@ -2135,6 +2135,8 @@ static int vpe_runtime_get(struct platform_device *pdev)
 
 	r = pm_runtime_get_sync(&pdev->dev);
 	WARN_ON(r < 0);
+	if (r)
+		pm_runtime_put_noidle(&pdev->dev);
 	return r < 0 ? r : 0;
 }
 

From 71caa3e928c20255421df4a66bab38d18b2f65cd Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 13 Aug 2020 17:13:15 +0300
Subject: [PATCH 0792/2658] ath6kl: prevent potential array overflow in
 ath6kl_add_new_sta()

[ Upstream commit 54f9ab7b870934b70e5a21786d951fbcf663970f ]

The value for "aid" comes from skb->data so Smatch marks it as
untrusted.  If it's invalid then it can result in an out of bounds array
access in ath6kl_add_new_sta().

Fixes: 572e27c00c9d ("ath6kl: Fix AP mode connect event parsing and TIM updates")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200813141315.GB457408@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath6kl/main.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
index 1af3fed5a72c..1a6851827968 100644
--- a/drivers/net/wireless/ath/ath6kl/main.c
+++ b/drivers/net/wireless/ath/ath6kl/main.c
@@ -430,6 +430,9 @@ void ath6kl_connect_ap_mode_sta(struct ath6kl_vif *vif, u16 aid, u8 *mac_addr,
 
 	ath6kl_dbg(ATH6KL_DBG_TRC, "new station %pM aid=%d\n", mac_addr, aid);
 
+	if (aid < 1 || aid > AP_MAX_NUM_STA)
+		return;
+
 	if (assoc_req_len > sizeof(struct ieee80211_hdr_3addr)) {
 		struct ieee80211_mgmt *mgmt =
 			(struct ieee80211_mgmt *) assoc_info;

From f5b83f3911a34fdb53796fca573a895c36551479 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 13 Aug 2020 17:12:53 +0300
Subject: [PATCH 0793/2658] ath9k: Fix potential out of bounds in
 ath9k_htc_txcompletion_cb()

[ Upstream commit 2705cd7558e718a7240c64eb0afb2edad5f8c190 ]

The value of "htc_hdr->endpoint_id" comes from skb->data so Smatch marks
it as untrusted so we have to check it before using it as an array
offset.

This is similar to a bug that syzkaller found in commit e4ff08a4d727
("ath9k: Fix use-after-free Write in ath9k_htc_rx_msg") so it is
probably a real issue.

Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200813141253.GA457408@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath9k/htc_hst.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index 1af216aa5ada..625823e45d8f 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -346,6 +346,8 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
 
 	if (skb) {
 		htc_hdr = (struct htc_frame_hdr *) skb->data;
+		if (htc_hdr->endpoint_id >= ARRAY_SIZE(htc_handle->endpoint))
+			goto ret;
 		endpoint = &htc_handle->endpoint[htc_hdr->endpoint_id];
 		skb_pull(skb, sizeof(struct htc_frame_hdr));
 

From fb154b6a7a684518ff26e9e87e69ccf0ea731c0f Mon Sep 17 00:00:00 2001
From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Date: Sun, 2 Aug 2020 01:48:24 +0100
Subject: [PATCH 0794/2658] wcn36xx: Fix reported 802.11n rx_highest rate
 wcn3660/wcn3680

[ Upstream commit 3b9fb6791e7113679b1eb472e6ce1659e80f5797 ]

Qualcomm's document "80-WL007-1 Rev. J" states that the highest rx rate for
the WCN3660 and WCN3680 on MCS 7 is 150 Mbps not the 72 Mbps stated here.

This patch fixes the data-rate declared in the 5GHz table.

Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680
hardware")

Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200802004824.1307124-1-bryan.odonoghue@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/wcn36xx/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index a27279c2c695..274d114962e8 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -156,7 +156,7 @@ static struct ieee80211_supported_band wcn_band_5ghz = {
 		.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
 		.mcs = {
 			.rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
-			.rx_highest = cpu_to_le16(72),
+			.rx_highest = cpu_to_le16(150),
 			.tx_params = IEEE80211_HT_MCS_TX_DEFINED,
 		}
 	}

From aaae43404c39d835862f24dfefe0e7e941531b02 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sun, 9 Aug 2020 11:29:06 +0200
Subject: [PATCH 0795/2658] mwifiex: Do not use GFP_KERNEL in atomic context

[ Upstream commit d2ab7f00f4321370a8ee14e5630d4349fdacc42e ]

A possible call chain is as follow:
  mwifiex_sdio_interrupt                            (sdio.c)
    --> mwifiex_main_process                        (main.c)
      --> mwifiex_process_cmdresp                   (cmdevt.c)
        --> mwifiex_process_sta_cmdresp             (sta_cmdresp.c)
          --> mwifiex_ret_802_11_scan               (scan.c)
            --> mwifiex_parse_single_response_buf   (scan.c)

'mwifiex_sdio_interrupt()' is an interrupt function.

Also note that 'mwifiex_ret_802_11_scan()' already uses GFP_ATOMIC.

So use GFP_ATOMIC instead of GFP_KERNEL when memory is allocated in
'mwifiex_parse_single_response_buf()'.

Fixes: 7c6fa2a843c5 ("mwifiex: use cfg80211 dynamic scan table and cfg80211_get_bss API")
or
Fixes: 601216e12c65e ("mwifiex: process RX packets in SDIO IRQ thread directly")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200809092906.744621-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mwifiex/scan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index e7c8972431d3..e54dd4b7face 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1862,7 +1862,7 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
 					    chan, CFG80211_BSS_FTYPE_UNKNOWN,
 					    bssid, timestamp,
 					    cap_info_bitmap, beacon_period,
-					    ie_buf, ie_len, rssi, GFP_KERNEL);
+					    ie_buf, ie_len, rssi, GFP_ATOMIC);
 			if (bss) {
 				bss_priv = (struct mwifiex_bss_priv *)bss->priv;
 				bss_priv->band = band;

From 82c63455af0486c0c516ab311193dbfe709e7983 Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Wed, 5 Aug 2020 13:59:11 -0700
Subject: [PATCH 0796/2658] drm/gma500: fix error check

[ Upstream commit cdd296cdae1af2d27dae3fcfbdf12c5252ab78cf ]

Reviewing this block of code in cdv_intel_dp_init()

ret = cdv_intel_dp_aux_native_read(gma_encoder, DP_DPCD_REV, ...

cdv_intel_edp_panel_vdd_off(gma_encoder);
if (ret == 0) {
	/* if this fails, presume the device is a ghost */
	DRM_INFO("failed to retrieve link info, disabling eDP\n");
	drm_encoder_cleanup(encoder);
	cdv_intel_dp_destroy(connector);
	goto err_priv;
} else {

The (ret == 0) is not strict enough.
cdv_intel_dp_aux_native_read() returns > 0 on success
otherwise it is failure.

So change to <=

Fixes: d112a8163f83 ("gma500/cdv: Add eDP support")

Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200805205911.20927-1-trix@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c
index d3de377dc857..25c68e4dc7a5 100644
--- a/drivers/gpu/drm/gma500/cdv_intel_dp.c
+++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c
@@ -2120,7 +2120,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev
 					       intel_dp->dpcd,
 					       sizeof(intel_dp->dpcd));
 		cdv_intel_edp_panel_vdd_off(gma_encoder);
-		if (ret == 0) {
+		if (ret <= 0) {
 			/* if this fails, presume the device is a ghost */
 			DRM_INFO("failed to retrieve link info, disabling eDP\n");
 			cdv_intel_dp_encoder_destroy(encoder);

From 5f535b05c301e129e478cb32dcb06ced6125707b Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sun, 2 Aug 2020 12:15:27 +0200
Subject: [PATCH 0797/2658] scsi: qla4xxx: Fix an error handling path in
 'qla4xxx_get_host_stats()'

[ Upstream commit 574918e69720fe62ab3eb42ec3750230c8d16b06 ]

Update the size used in 'dma_free_coherent()' in order to match the one
used in the corresponding 'dma_alloc_coherent()'.

Link: https://lore.kernel.org/r/20200802101527.676054-1-christophe.jaillet@wanadoo.fr
Fixes: 4161cee52df8 ("[SCSI] qla4xxx: Add host statistics support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla4xxx/ql4_os.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index 3fda5836aac6..f10088a1d38c 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -1223,7 +1223,7 @@ static int qla4xxx_get_host_stats(struct Scsi_Host *shost, char *buf, int len)
 			le64_to_cpu(ql_iscsi_stats->iscsi_sequence_error);
 exit_host_stats:
 	if (ql_iscsi_stats)
-		dma_free_coherent(&ha->pdev->dev, host_stats_size,
+		dma_free_coherent(&ha->pdev->dev, stats_size,
 				  ql_iscsi_stats, iscsi_stats_dma);
 
 	ql4_printk(KERN_INFO, ha, "%s: Get host stats done\n",

From 0216480962ddb59c417ae1ae0782626132dd24a4 Mon Sep 17 00:00:00 2001
From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Date: Sun, 2 Aug 2020 19:15:31 +0800
Subject: [PATCH 0798/2658] scsi: csiostor: Fix wrong return value in
 csio_hw_prep_fw()

[ Upstream commit 44f4daf8678ae5f08c93bbe70792f90cd88e4649 ]

On an error exit path, a negative error code should be returned instead of
a positive return value.

Link: https://lore.kernel.org/r/20200802111531.5065-1-tianjia.zhang@linux.alibaba.com
Fixes: f40e74ffa3de ("csiostor:firmware upgrade fix")
Cc: Praveen Madhavan <praveenm@chelsio.com>
Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/csiostor/csio_hw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
index dab195f04da7..06ca0495f3e8 100644
--- a/drivers/scsi/csiostor/csio_hw.c
+++ b/drivers/scsi/csiostor/csio_hw.c
@@ -1973,7 +1973,7 @@ static int csio_hw_prep_fw(struct csio_hw *hw, struct fw_info *fw_info,
 			FW_HDR_FW_VER_MICRO_G(c), FW_HDR_FW_VER_BUILD_G(c),
 			FW_HDR_FW_VER_MAJOR_G(k), FW_HDR_FW_VER_MINOR_G(k),
 			FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k));
-		ret = EINVAL;
+		ret = -EINVAL;
 		goto bye;
 	}
 

From 83328aeafe829b686c56477484026a6feae620a4 Mon Sep 17 00:00:00 2001
From: "dinghao.liu@zju.edu.cn" <dinghao.liu@zju.edu.cn>
Date: Thu, 20 Aug 2020 14:38:17 +0800
Subject: [PATCH 0799/2658] backlight: sky81452-backlight: Fix refcount
 imbalance on error

[ Upstream commit b7a4f80bc316a56d6ec8750e93e66f42431ed960 ]

When of_property_read_u32_array() returns an error code, a
pairing refcount decrement is needed to keep np's refcount
balanced.

Fixes: f705806c9f355 ("backlight: Add support Skyworks SKY81452 backlight driver")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/backlight/sky81452-backlight.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/video/backlight/sky81452-backlight.c b/drivers/video/backlight/sky81452-backlight.c
index d414c7a3acf5..a2f77625b717 100644
--- a/drivers/video/backlight/sky81452-backlight.c
+++ b/drivers/video/backlight/sky81452-backlight.c
@@ -207,6 +207,7 @@ static struct sky81452_bl_platform_data *sky81452_bl_parse_dt(
 					num_entry);
 		if (ret < 0) {
 			dev_err(dev, "led-sources node is invalid.\n");
+			of_node_put(np);
 			return ERR_PTR(-EINVAL);
 		}
 

From f6e4d5408171fdad2b4499d256f9b5780154bf81 Mon Sep 17 00:00:00 2001
From: Alex Dewar <alex.dewar90@gmail.com>
Date: Tue, 25 Aug 2020 17:45:18 +0100
Subject: [PATCH 0800/2658] VMCI: check return value of get_user_pages_fast()
 for errors

[ Upstream commit 90ca6333fd65f318c47bff425e1ea36c0a5539f6 ]

In a couple of places in qp_host_get_user_memory(),
get_user_pages_fast() is called without properly checking for errors. If
e.g. -EFAULT is returned, this negative value will then be passed on to
qp_release_pages(), which expects a u64 as input.

Fix this by only calling qp_release_pages() when we have a positive
number returned.

Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.")
Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
Link: https://lore.kernel.org/r/20200825164522.412392-1-alex.dewar90@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/vmw_vmci/vmci_queue_pair.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
index 3877f534fd3f..e57340e980c4 100644
--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
@@ -758,8 +758,9 @@ static int qp_host_get_user_memory(u64 produce_uva,
 	if (retval < (int)produce_q->kernel_if->num_pages) {
 		pr_debug("get_user_pages_fast(produce) failed (retval=%d)",
 			retval);
-		qp_release_pages(produce_q->kernel_if->u.h.header_page,
-				 retval, false);
+		if (retval > 0)
+			qp_release_pages(produce_q->kernel_if->u.h.header_page,
+					retval, false);
 		err = VMCI_ERROR_NO_MEM;
 		goto out;
 	}
@@ -770,8 +771,9 @@ static int qp_host_get_user_memory(u64 produce_uva,
 	if (retval < (int)consume_q->kernel_if->num_pages) {
 		pr_debug("get_user_pages_fast(consume) failed (retval=%d)",
 			retval);
-		qp_release_pages(consume_q->kernel_if->u.h.header_page,
-				 retval, false);
+		if (retval > 0)
+			qp_release_pages(consume_q->kernel_if->u.h.header_page,
+					retval, false);
 		qp_release_pages(produce_q->kernel_if->u.h.header_page,
 				 produce_q->kernel_if->num_pages, false);
 		err = VMCI_ERROR_NO_MEM;

From 69f633b80e9c405ee0a983317be8ec506464c39a Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Fri, 28 Aug 2020 08:39:50 -0400
Subject: [PATCH 0801/2658] tty: serial: earlycon dependency

[ Upstream commit 0fb9342d06b0f667b915ba58bfefc030e534a218 ]

parse_options() in drivers/tty/serial/earlycon.c calls uart_parse_earlycon
in drivers/tty/serial/serial_core.c therefore selecting SERIAL_EARLYCON
should automatically select SERIAL_CORE, otherwise will result in symbol
not found error during linking if SERIAL_CORE is not configured as builtin

Fixes: 9aac5887595b ("tty/serial: add generic serial earlycon")
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Link: https://lore.kernel.org/r/20200828123949.2642-1-ztong0001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
index 10cc5c045c1c..dcef571299e7 100644
--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -9,6 +9,7 @@ menu "Serial drivers"
 
 config SERIAL_EARLYCON
 	bool
+	depends on SERIAL_CORE
 	help
 	  Support for early consoles with the earlycon parameter. This enables
 	  the console before standard serial driver is probed. The console is

From 81ff4a52124c4d015e9eb1c101cb0d5c890361f5 Mon Sep 17 00:00:00 2001
From: Tyrel Datwyler <tyreld@linux.ibm.com>
Date: Thu, 20 Aug 2020 18:46:38 -0500
Subject: [PATCH 0802/2658] tty: hvcs: Don't NULL tty->driver_data until
 hvcs_cleanup()

[ Upstream commit 63ffcbdad738e3d1c857027789a2273df3337624 ]

The code currently NULLs tty->driver_data in hvcs_close() with the
intent of informing the next call to hvcs_open() that device needs to be
reconfigured. However, when hvcs_cleanup() is called we copy hvcsd from
tty->driver_data which was previoulsy NULLed by hvcs_close() and our
call to tty_port_put(&hvcsd->port) doesn't actually do anything since
&hvcsd->port ends up translating to NULL by chance. This has the side
effect that when hvcs_remove() is called we have one too many port
references preventing hvcs_destuct_port() from ever being called. This
also prevents us from reusing the /dev/hvcsX node in a future
hvcs_probe() and we can eventually run out of /dev/hvcsX devices.

Fix this by waiting to NULL tty->driver_data in hvcs_cleanup().

Fixes: 27bf7c43a19c ("TTY: hvcs, add tty install")
Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
Link: https://lore.kernel.org/r/20200820234643.70412-1-tyreld@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/hvc/hvcs.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
index 5997b1731111..cba662c50f91 100644
--- a/drivers/tty/hvc/hvcs.c
+++ b/drivers/tty/hvc/hvcs.c
@@ -1232,13 +1232,6 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
 
 		tty_wait_until_sent(tty, HVCS_CLOSE_WAIT);
 
-		/*
-		 * This line is important because it tells hvcs_open that this
-		 * device needs to be re-configured the next time hvcs_open is
-		 * called.
-		 */
-		tty->driver_data = NULL;
-
 		free_irq(irq, hvcsd);
 		return;
 	} else if (hvcsd->port.count < 0) {
@@ -1254,6 +1247,13 @@ static void hvcs_cleanup(struct tty_struct * tty)
 {
 	struct hvcs_struct *hvcsd = tty->driver_data;
 
+	/*
+	 * This line is important because it tells hvcs_open that this
+	 * device needs to be re-configured the next time hvcs_open is
+	 * called.
+	 */
+	tty->driver_data = NULL;
+
 	tty_port_put(&hvcsd->port);
 }
 

From 3d2662e40b0d46ecefda3fe65fb3b5621a9a602c Mon Sep 17 00:00:00 2001
From: Artem Savkov <asavkov@redhat.com>
Date: Wed, 2 Sep 2020 14:00:45 +0200
Subject: [PATCH 0803/2658] pty: do tty_flip_buffer_push without port->lock in
 pty_write

[ Upstream commit 71a174b39f10b4b93223d374722aa894b5d8a82e ]

b6da31b2c07c "tty: Fix data race in tty_insert_flip_string_fixed_flag"
puts tty_flip_buffer_push under port->lock introducing the following
possible circular locking dependency:

[30129.876566] ======================================================
[30129.876566] WARNING: possible circular locking dependency detected
[30129.876567] 5.9.0-rc2+ #3 Tainted: G S      W
[30129.876568] ------------------------------------------------------
[30129.876568] sysrq.sh/1222 is trying to acquire lock:
[30129.876569] ffffffff92c39480 (console_owner){....}-{0:0}, at: console_unlock+0x3fe/0xa90

[30129.876572] but task is already holding lock:
[30129.876572] ffff888107cb9018 (&pool->lock/1){-.-.}-{2:2}, at: show_workqueue_state.cold.55+0x15b/0x6ca

[30129.876576] which lock already depends on the new lock.

[30129.876577] the existing dependency chain (in reverse order) is:

[30129.876578] -> #3 (&pool->lock/1){-.-.}-{2:2}:
[30129.876581]        _raw_spin_lock+0x30/0x70
[30129.876581]        __queue_work+0x1a3/0x10f0
[30129.876582]        queue_work_on+0x78/0x80
[30129.876582]        pty_write+0x165/0x1e0
[30129.876583]        n_tty_write+0x47f/0xf00
[30129.876583]        tty_write+0x3d6/0x8d0
[30129.876584]        vfs_write+0x1a8/0x650

[30129.876588] -> #2 (&port->lock#2){-.-.}-{2:2}:
[30129.876590]        _raw_spin_lock_irqsave+0x3b/0x80
[30129.876591]        tty_port_tty_get+0x1d/0xb0
[30129.876592]        tty_port_default_wakeup+0xb/0x30
[30129.876592]        serial8250_tx_chars+0x3d6/0x970
[30129.876593]        serial8250_handle_irq.part.12+0x216/0x380
[30129.876593]        serial8250_default_handle_irq+0x82/0xe0
[30129.876594]        serial8250_interrupt+0xdd/0x1b0
[30129.876595]        __handle_irq_event_percpu+0xfc/0x850

[30129.876602] -> #1 (&port->lock){-.-.}-{2:2}:
[30129.876605]        _raw_spin_lock_irqsave+0x3b/0x80
[30129.876605]        serial8250_console_write+0x12d/0x900
[30129.876606]        console_unlock+0x679/0xa90
[30129.876606]        register_console+0x371/0x6e0
[30129.876607]        univ8250_console_init+0x24/0x27
[30129.876607]        console_init+0x2f9/0x45e

[30129.876609] -> #0 (console_owner){....}-{0:0}:
[30129.876611]        __lock_acquire+0x2f70/0x4e90
[30129.876612]        lock_acquire+0x1ac/0xad0
[30129.876612]        console_unlock+0x460/0xa90
[30129.876613]        vprintk_emit+0x130/0x420
[30129.876613]        printk+0x9f/0xc5
[30129.876614]        show_pwq+0x154/0x618
[30129.876615]        show_workqueue_state.cold.55+0x193/0x6ca
[30129.876615]        __handle_sysrq+0x244/0x460
[30129.876616]        write_sysrq_trigger+0x48/0x4a
[30129.876616]        proc_reg_write+0x1a6/0x240
[30129.876617]        vfs_write+0x1a8/0x650

[30129.876619] other info that might help us debug this:

[30129.876620] Chain exists of:
[30129.876621]   console_owner --> &port->lock#2 --> &pool->lock/1

[30129.876625]  Possible unsafe locking scenario:

[30129.876626]        CPU0                    CPU1
[30129.876626]        ----                    ----
[30129.876627]   lock(&pool->lock/1);
[30129.876628]                                lock(&port->lock#2);
[30129.876630]                                lock(&pool->lock/1);
[30129.876631]   lock(console_owner);

[30129.876633]  *** DEADLOCK ***

[30129.876634] 5 locks held by sysrq.sh/1222:
[30129.876634]  #0: ffff8881d3ce0470 (sb_writers#3){.+.+}-{0:0}, at: vfs_write+0x359/0x650
[30129.876637]  #1: ffffffff92c612c0 (rcu_read_lock){....}-{1:2}, at: __handle_sysrq+0x4d/0x460
[30129.876640]  #2: ffffffff92c612c0 (rcu_read_lock){....}-{1:2}, at: show_workqueue_state+0x5/0xf0
[30129.876642]  #3: ffff888107cb9018 (&pool->lock/1){-.-.}-{2:2}, at: show_workqueue_state.cold.55+0x15b/0x6ca
[30129.876645]  #4: ffffffff92c39980 (console_lock){+.+.}-{0:0}, at: vprintk_emit+0x123/0x420

[30129.876648] stack backtrace:
[30129.876649] CPU: 3 PID: 1222 Comm: sysrq.sh Tainted: G S      W         5.9.0-rc2+ #3
[30129.876649] Hardware name: Intel Corporation 2012 Client Platform/Emerald Lake 2, BIOS ACRVMBY1.86C.0078.P00.1201161002 01/16/2012
[30129.876650] Call Trace:
[30129.876650]  dump_stack+0x9d/0xe0
[30129.876651]  check_noncircular+0x34f/0x410
[30129.876653]  __lock_acquire+0x2f70/0x4e90
[30129.876656]  lock_acquire+0x1ac/0xad0
[30129.876658]  console_unlock+0x460/0xa90
[30129.876660]  vprintk_emit+0x130/0x420
[30129.876660]  printk+0x9f/0xc5
[30129.876661]  show_pwq+0x154/0x618
[30129.876662]  show_workqueue_state.cold.55+0x193/0x6ca
[30129.876664]  __handle_sysrq+0x244/0x460
[30129.876665]  write_sysrq_trigger+0x48/0x4a
[30129.876665]  proc_reg_write+0x1a6/0x240
[30129.876666]  vfs_write+0x1a8/0x650

It looks like the commit was aimed to protect tty_insert_flip_string and
there is no need for tty_flip_buffer_push to be under this lock.

Fixes: b6da31b2c07c ("tty: Fix data race in tty_insert_flip_string_fixed_flag")
Signed-off-by: Artem Savkov <asavkov@redhat.com>
Acked-by: Jiri Slaby <jirislaby@kernel.org>
Link: https://lore.kernel.org/r/20200902120045.3693075-1-asavkov@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/pty.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index c8a2e5b0eff7..8ee146b14aae 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -115,10 +115,10 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
 		spin_lock_irqsave(&to->port->lock, flags);
 		/* Stuff the data into the input queue of the other end */
 		c = tty_insert_flip_string(to->port, buf, c);
+		spin_unlock_irqrestore(&to->port->lock, flags);
 		/* And shovel */
 		if (c)
 			tty_flip_buffer_push(to->port);
-		spin_unlock_irqrestore(&to->port->lock, flags);
 	}
 	return c;
 }

From 18fceee1018b549e81447366902e257d8b73c90b Mon Sep 17 00:00:00 2001
From: Souptick Joarder <jrdr.linux@gmail.com>
Date: Wed, 2 Sep 2020 02:51:11 +0530
Subject: [PATCH 0804/2658] drivers/virt/fsl_hypervisor: Fix error handling
 path

[ Upstream commit 7f360bec37857bfd5a48cef21d86f58a09a3df63 ]

First, when memory allocation for sg_list_unaligned failed, there
is a bug of calling put_pages() as we haven't pinned any pages.

Second, if get_user_pages_fast() failed we should unpin num_pinned
pages.

This will address both.

As part of these changes, minor update in documentation.

Fixes: 6db7199407ca ("drivers/virt: introduce Freescale hypervisor management driver")
Signed-off-by: Souptick Joarder <jrdr.linux@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Link: https://lore.kernel.org/r/1598995271-6755-1-git-send-email-jrdr.linux@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/virt/fsl_hypervisor.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c
index 9f96c7e61387..0d11b5043db5 100644
--- a/drivers/virt/fsl_hypervisor.c
+++ b/drivers/virt/fsl_hypervisor.c
@@ -157,7 +157,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
 
 	unsigned int i;
 	long ret = 0;
-	int num_pinned; /* return value from get_user_pages() */
+	int num_pinned = 0; /* return value from get_user_pages_fast() */
 	phys_addr_t remote_paddr; /* The next address in the remote buffer */
 	uint32_t count; /* The number of bytes left to copy */
 
@@ -174,7 +174,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
 		return -EINVAL;
 
 	/*
-	 * The array of pages returned by get_user_pages() covers only
+	 * The array of pages returned by get_user_pages_fast() covers only
 	 * page-aligned memory.  Since the user buffer is probably not
 	 * page-aligned, we need to handle the discrepancy.
 	 *
@@ -224,7 +224,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
 
 	/*
 	 * 'pages' is an array of struct page pointers that's initialized by
-	 * get_user_pages().
+	 * get_user_pages_fast().
 	 */
 	pages = kzalloc(num_pages * sizeof(struct page *), GFP_KERNEL);
 	if (!pages) {
@@ -241,7 +241,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
 	if (!sg_list_unaligned) {
 		pr_debug("fsl-hv: could not allocate S/G list\n");
 		ret = -ENOMEM;
-		goto exit;
+		goto free_pages;
 	}
 	sg_list = PTR_ALIGN(sg_list_unaligned, sizeof(struct fh_sg_list));
 
@@ -254,7 +254,6 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
 	up_read(&current->mm->mmap_sem);
 
 	if (num_pinned != num_pages) {
-		/* get_user_pages() failed */
 		pr_debug("fsl-hv: could not lock source buffer\n");
 		ret = (num_pinned < 0) ? num_pinned : -EFAULT;
 		goto exit;
@@ -296,13 +295,13 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
 		virt_to_phys(sg_list), num_pages);
 
 exit:
-	if (pages) {
-		for (i = 0; i < num_pages; i++)
-			if (pages[i])
-				put_page(pages[i]);
+	if (pages && (num_pinned > 0)) {
+		for (i = 0; i < num_pinned; i++)
+			put_page(pages[i]);
 	}
 
 	kfree(sg_list_unaligned);
+free_pages:
 	kfree(pages);
 
 	if (!ret)

From 592b865f4d131e4ba98e5a581539ac887dd356bc Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Thu, 23 Jul 2020 18:02:27 +0100
Subject: [PATCH 0805/2658] video: fbdev: vga16fb: fix setting of pixclock
 because a pass-by-value error

[ Upstream commit c72fab81ceaa54408b827a2f0486d9a0f4be34cf ]

The pixclock is being set locally because it is being passed as a
pass-by-value argument rather than pass-by-reference, so the computed
pixclock is never being set in var->pixclock. Fix this by passing
by reference.

[This dates back to 2002, I found the offending commit from the git
history git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git ]

Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Jani Nikula <jani.nikula@intel.com>
[b.zolnierkie: minor patch summary fixup]
[b.zolnierkie: removed "Fixes:" tag (not in upstream tree)]
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200723170227.996229-1-colin.king@canonical.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/vga16fb.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c
index 1acdb41a8a7c..06cee2a40a9b 100644
--- a/drivers/video/fbdev/vga16fb.c
+++ b/drivers/video/fbdev/vga16fb.c
@@ -243,7 +243,7 @@ static void vga16fb_update_fix(struct fb_info *info)
 }
 
 static void vga16fb_clock_chip(struct vga16fb_par *par,
-			       unsigned int pixclock,
+			       unsigned int *pixclock,
 			       const struct fb_info *info,
 			       int mul, int div)
 {
@@ -259,14 +259,14 @@ static void vga16fb_clock_chip(struct vga16fb_par *par,
 		{     0 /* bad */,    0x00, 0x00}};
 	int err;
 
-	pixclock = (pixclock * mul) / div;
+	*pixclock = (*pixclock * mul) / div;
 	best = vgaclocks;
-	err = pixclock - best->pixclock;
+	err = *pixclock - best->pixclock;
 	if (err < 0) err = -err;
 	for (ptr = vgaclocks + 1; ptr->pixclock; ptr++) {
 		int tmp;
 
-		tmp = pixclock - ptr->pixclock;
+		tmp = *pixclock - ptr->pixclock;
 		if (tmp < 0) tmp = -tmp;
 		if (tmp < err) {
 			err = tmp;
@@ -275,7 +275,7 @@ static void vga16fb_clock_chip(struct vga16fb_par *par,
 	}
 	par->misc |= best->misc;
 	par->clkdiv = best->seq_clock_mode;
-	pixclock = (best->pixclock * div) / mul;		
+	*pixclock = (best->pixclock * div) / mul;
 }
 			       
 #define FAIL(X) return -EINVAL
@@ -497,10 +497,10 @@ static int vga16fb_check_var(struct fb_var_screeninfo *var,
 
 	if (mode & MODE_8BPP)
 		/* pixel clock == vga clock / 2 */
-		vga16fb_clock_chip(par, var->pixclock, info, 1, 2);
+		vga16fb_clock_chip(par, &var->pixclock, info, 1, 2);
 	else
 		/* pixel clock == vga clock */
-		vga16fb_clock_chip(par, var->pixclock, info, 1, 1);
+		vga16fb_clock_chip(par, &var->pixclock, info, 1, 1);
 	
 	var->red.offset = var->green.offset = var->blue.offset = 
 	var->transp.offset = 0;

From 3cec364d24de2e4d4914d9e3e5342eef16d6919e Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Wed, 5 Aug 2020 07:52:08 -0700
Subject: [PATCH 0806/2658] video: fbdev: sis: fix null ptr dereference

[ Upstream commit ad6f93e9cd56f0b10e9b22e3e137d17a1a035242 ]

Clang static analysis reports this representative error

init.c:2501:18: warning: Array access (from variable 'queuedata') results
  in a null pointer dereference
      templ |= ((queuedata[i] & 0xc0) << 3);

This is the problem block of code

   if(ModeNo > 0x13) {
      ...
      if(SiS_Pr->ChipType == SIS_730) {
	 queuedata = &FQBQData730[0];
      } else {
	 queuedata = &FQBQData[0];
      }
   } else {

   }

queuedata is not set in the else block

Reviewing the old code, the arrays FQBQData730 and FQBQData were
used directly.

So hoist the setting of queuedata out of the if-else block.

Fixes: 544393fe584d ("[PATCH] sisfb update")
Signed-off-by: Tom Rix <trix@redhat.com>
Cc: Thomas Winischhofer <thomas@winischhofer.net>
Cc: Andrew Morton <akpm@osdl.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200805145208.17727-1-trix@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/sis/init.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c
index dfe3eb769638..fde27feae5d0 100644
--- a/drivers/video/fbdev/sis/init.c
+++ b/drivers/video/fbdev/sis/init.c
@@ -2428,6 +2428,11 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
 
    i = 0;
 
+	if (SiS_Pr->ChipType == SIS_730)
+		queuedata = &FQBQData730[0];
+	else
+		queuedata = &FQBQData[0];
+
    if(ModeNo > 0x13) {
 
       /* Get VCLK  */
@@ -2445,12 +2450,6 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
       /* Get half colordepth */
       colorth = colortharray[(SiS_Pr->SiS_ModeType - ModeEGA)];
 
-      if(SiS_Pr->ChipType == SIS_730) {
-	 queuedata = &FQBQData730[0];
-      } else {
-	 queuedata = &FQBQData[0];
-      }
-
       do {
 	 templ = SiS_CalcDelay2(SiS_Pr, queuedata[i]) * VCLK * colorth;
 

From 849f5649c8b0ae3e1babca3b23b4aaff3b652b2a Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Mon, 24 Aug 2020 11:57:35 +0300
Subject: [PATCH 0807/2658] HID: roccat: add bounds checking in
 kone_sysfs_write_settings()

[ Upstream commit d4f98dbfe717490e771b6e701904bfcf4b4557f0 ]

This code doesn't check if "settings->startup_profile" is within bounds
and that could result in an out of bounds array access.  What the code
does do is it checks if the settings can be written to the firmware, so
it's possible that the firmware has a bounds check?  It's safer and
easier to verify when the bounds checking is done in the kernel.

Fixes: 14bf62cde794 ("HID: add driver for Roccat Kone gaming mouse")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-roccat-kone.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c
index c29265055ac1..6c2b821c8d8b 100644
--- a/drivers/hid/hid-roccat-kone.c
+++ b/drivers/hid/hid-roccat-kone.c
@@ -299,31 +299,40 @@ static ssize_t kone_sysfs_write_settings(struct file *fp, struct kobject *kobj,
 	struct kone_device *kone = hid_get_drvdata(dev_get_drvdata(dev));
 	struct usb_device *usb_dev = interface_to_usbdev(to_usb_interface(dev));
 	int retval = 0, difference, old_profile;
+	struct kone_settings *settings = (struct kone_settings *)buf;
 
 	/* I need to get my data in one piece */
 	if (off != 0 || count != sizeof(struct kone_settings))
 		return -EINVAL;
 
 	mutex_lock(&kone->kone_lock);
-	difference = memcmp(buf, &kone->settings, sizeof(struct kone_settings));
+	difference = memcmp(settings, &kone->settings,
+			    sizeof(struct kone_settings));
 	if (difference) {
-		retval = kone_set_settings(usb_dev,
-				(struct kone_settings const *)buf);
-		if (retval) {
-			mutex_unlock(&kone->kone_lock);
-			return retval;
+		if (settings->startup_profile < 1 ||
+		    settings->startup_profile > 5) {
+			retval = -EINVAL;
+			goto unlock;
 		}
 
+		retval = kone_set_settings(usb_dev, settings);
+		if (retval)
+			goto unlock;
+
 		old_profile = kone->settings.startup_profile;
-		memcpy(&kone->settings, buf, sizeof(struct kone_settings));
+		memcpy(&kone->settings, settings, sizeof(struct kone_settings));
 
 		kone_profile_activated(kone, kone->settings.startup_profile);
 
 		if (kone->settings.startup_profile != old_profile)
 			kone_profile_report(kone, kone->settings.startup_profile);
 	}
+unlock:
 	mutex_unlock(&kone->kone_lock);
 
+	if (retval)
+		return retval;
+
 	return sizeof(struct kone_settings);
 }
 static BIN_ATTR(settings, 0660, kone_sysfs_read_settings,

From d20b2cc73d7cd4814dc15e2d58df135a4b6bc214 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 18 Sep 2020 17:27:32 +0300
Subject: [PATCH 0808/2658] ath6kl: wmi: prevent a shift wrapping bug in
 ath6kl_wmi_delete_pstream_cmd()

[ Upstream commit 6a950755cec1a90ddaaff3e4acb5333617441c32 ]

The "tsid" is a user controlled u8 which comes from debugfs.  Values
more than 15 are invalid because "active_tsids" is a 16 bit variable.
If the value of "tsid" is more than 31 then that leads to a shift
wrapping bug.

Fixes: 8fffd9e5ec9e ("ath6kl: Implement support for QOS-enable and QOS-disable from userspace")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200918142732.GA909725@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath6kl/wmi.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index b2ec254f154e..7e1010475cfb 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -2644,6 +2644,11 @@ int ath6kl_wmi_delete_pstream_cmd(struct wmi *wmi, u8 if_idx, u8 traffic_class,
 		return -EINVAL;
 	}
 
+	if (tsid >= 16) {
+		ath6kl_err("invalid tsid: %d\n", tsid);
+		return -EINVAL;
+	}
+
 	skb = ath6kl_wmi_get_new_buf(sizeof(*cmd));
 	if (!skb)
 		return -ENOMEM;

From 08ed67d1f4cfb11fed36857f11519a41d737a292 Mon Sep 17 00:00:00 2001
From: Souptick Joarder <jrdr.linux@gmail.com>
Date: Sun, 20 Sep 2020 08:21:35 +0530
Subject: [PATCH 0809/2658] misc: mic: scif: Fix error handling path

[ Upstream commit a81072a9c0ae734b7889929b0bc070fe3f353f0e ]

Inside __scif_pin_pages(), when map_flags != SCIF_MAP_KERNEL it
will call pin_user_pages_fast() to map nr_pages. However,
pin_user_pages_fast() might fail with a return value -ERRNO.

The return value is stored in pinned_pages->nr_pages. which in
turn is passed to unpin_user_pages(), which expects
pinned_pages->nr_pages >=0, else disaster.

Fix this by assigning pinned_pages->nr_pages to 0 if
pin_user_pages_fast() returns -ERRNO.

Fixes: ba612aa8b487 ("misc: mic: SCIF memory registration and unregistration")
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Ira Weiny <ira.weiny@intel.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Signed-off-by: Souptick Joarder <jrdr.linux@gmail.com>
Link: https://lore.kernel.org/r/1600570295-29546-1-git-send-email-jrdr.linux@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/mic/scif/scif_rma.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c
index 71c69e1c4ac0..4188b88c20a4 100644
--- a/drivers/misc/mic/scif/scif_rma.c
+++ b/drivers/misc/mic/scif/scif_rma.c
@@ -1403,6 +1403,8 @@ int __scif_pin_pages(void *addr, size_t len, int *out_prot,
 				NULL);
 		up_write(&mm->mmap_sem);
 		if (nr_pages != pinned_pages->nr_pages) {
+			if (pinned_pages->nr_pages < 0)
+				pinned_pages->nr_pages = 0;
 			if (try_upgrade) {
 				if (ulimit)
 					__scif_dec_pinned_vm_lock(mm,
@@ -1423,7 +1425,6 @@ int __scif_pin_pages(void *addr, size_t len, int *out_prot,
 
 	if (pinned_pages->nr_pages < nr_pages) {
 		err = -EFAULT;
-		pinned_pages->nr_pages = nr_pages;
 		goto dec_pinned;
 	}
 
@@ -1436,7 +1437,6 @@ int __scif_pin_pages(void *addr, size_t len, int *out_prot,
 		__scif_dec_pinned_vm_lock(mm, nr_pages, 0);
 	/* Something went wrong! Rollback */
 error_unmap:
-	pinned_pages->nr_pages = nr_pages;
 	scif_destroy_pinned_pages(pinned_pages);
 	*pages = NULL;
 	dev_dbg(scif_info.mdev.this_device,

From f65f9c17b9b93d6c0fe5f71ec405c2ad3bb6eea1 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 22 Sep 2020 10:38:56 +0200
Subject: [PATCH 0810/2658] ALSA: seq: oss: Avoid mutex lock for a long-time
 ioctl

[ Upstream commit 2759caad2600d503c3b0ed800e7e03d2cd7a4c05 ]

Recently we applied a fix to cover the whole OSS sequencer ioctls with
the mutex for dealing with the possible races.  This works fine in
general, but in theory, this may lead to unexpectedly long stall if an
ioctl like SNDCTL_SEQ_SYNC is issued and an event with the far future
timestamp was queued.

For fixing such a potential stall, this patch changes the mutex lock
applied conditionally excluding such an ioctl command.  Also, change
the mutex_lock() with the interruptible version for user to allow
escaping from the big-hammer mutex.

Fixes: 80982c7e834e ("ALSA: seq: oss: Serialize ioctls")
Suggested-by: Pavel Machek <pavel@ucw.cz>
Link: https://lore.kernel.org/r/20200922083856.28572-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/core/seq/oss/seq_oss.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c
index 8044775999ed..4d1548b951c4 100644
--- a/sound/core/seq/oss/seq_oss.c
+++ b/sound/core/seq/oss/seq_oss.c
@@ -186,9 +186,12 @@ odev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	if (snd_BUG_ON(!dp))
 		return -ENXIO;
 
-	mutex_lock(&register_mutex);
+	if (cmd != SNDCTL_SEQ_SYNC &&
+	    mutex_lock_interruptible(&register_mutex))
+		return -ERESTARTSYS;
 	rc = snd_seq_oss_ioctl(dp, cmd, arg);
-	mutex_unlock(&register_mutex);
+	if (cmd != SNDCTL_SEQ_SYNC)
+		mutex_unlock(&register_mutex);
 	return rc;
 }
 

From 7900f70eb997ce79a1fb0eb1e932a6b18c0dca05 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 24 Sep 2020 11:36:19 -0700
Subject: [PATCH 0811/2658] quota: clear padding in v2r1_mem2diskdqb()

[ Upstream commit 3d3dc274ce736227e3197868ff749cff2f175f63 ]

Freshly allocated memory contains garbage, better make sure
to init all struct v2r1_disk_dqblk fields to avoid KMSAN report:

BUG: KMSAN: uninit-value in qtree_entry_unused+0x137/0x1b0 fs/quota/quota_tree.c:218
CPU: 0 PID: 23373 Comm: syz-executor.1 Not tainted 5.9.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x21c/0x280 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:122
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:219
 qtree_entry_unused+0x137/0x1b0 fs/quota/quota_tree.c:218
 v2r1_mem2diskdqb+0x43d/0x710 fs/quota/quota_v2.c:285
 qtree_write_dquot+0x226/0x870 fs/quota/quota_tree.c:394
 v2_write_dquot+0x1ad/0x280 fs/quota/quota_v2.c:333
 dquot_commit+0x4af/0x600 fs/quota/dquot.c:482
 ext4_write_dquot fs/ext4/super.c:5934 [inline]
 ext4_mark_dquot_dirty+0x4d8/0x6a0 fs/ext4/super.c:5985
 mark_dquot_dirty fs/quota/dquot.c:347 [inline]
 mark_all_dquot_dirty fs/quota/dquot.c:385 [inline]
 dquot_alloc_inode+0xc05/0x12b0 fs/quota/dquot.c:1755
 __ext4_new_inode+0x8204/0x9d70 fs/ext4/ialloc.c:1155
 ext4_tmpfile+0x41a/0x850 fs/ext4/namei.c:2686
 vfs_tmpfile+0x2a2/0x570 fs/namei.c:3283
 do_tmpfile fs/namei.c:3316 [inline]
 path_openat+0x4035/0x6a90 fs/namei.c:3359
 do_filp_open+0x2b8/0x710 fs/namei.c:3395
 do_sys_openat2+0xa88/0x1140 fs/open.c:1168
 do_sys_open fs/open.c:1184 [inline]
 __do_compat_sys_openat fs/open.c:1242 [inline]
 __se_compat_sys_openat+0x2a4/0x310 fs/open.c:1240
 __ia32_compat_sys_openat+0x56/0x70 fs/open.c:1240
 do_syscall_32_irqs_on arch/x86/entry/common.c:80 [inline]
 __do_fast_syscall_32+0x129/0x180 arch/x86/entry/common.c:139
 do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:162
 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:205
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
RIP: 0023:0xf7ff4549
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000f55cd0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000127
RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000020000000
RDX: 0000000000410481 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:143 [inline]
 kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:126
 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:80
 slab_alloc_node mm/slub.c:2907 [inline]
 slab_alloc mm/slub.c:2916 [inline]
 __kmalloc+0x2bb/0x4b0 mm/slub.c:3982
 kmalloc include/linux/slab.h:559 [inline]
 getdqbuf+0x56/0x150 fs/quota/quota_tree.c:52
 qtree_write_dquot+0xf2/0x870 fs/quota/quota_tree.c:378
 v2_write_dquot+0x1ad/0x280 fs/quota/quota_v2.c:333
 dquot_commit+0x4af/0x600 fs/quota/dquot.c:482
 ext4_write_dquot fs/ext4/super.c:5934 [inline]
 ext4_mark_dquot_dirty+0x4d8/0x6a0 fs/ext4/super.c:5985
 mark_dquot_dirty fs/quota/dquot.c:347 [inline]
 mark_all_dquot_dirty fs/quota/dquot.c:385 [inline]
 dquot_alloc_inode+0xc05/0x12b0 fs/quota/dquot.c:1755
 __ext4_new_inode+0x8204/0x9d70 fs/ext4/ialloc.c:1155
 ext4_tmpfile+0x41a/0x850 fs/ext4/namei.c:2686
 vfs_tmpfile+0x2a2/0x570 fs/namei.c:3283
 do_tmpfile fs/namei.c:3316 [inline]
 path_openat+0x4035/0x6a90 fs/namei.c:3359
 do_filp_open+0x2b8/0x710 fs/namei.c:3395
 do_sys_openat2+0xa88/0x1140 fs/open.c:1168
 do_sys_open fs/open.c:1184 [inline]
 __do_compat_sys_openat fs/open.c:1242 [inline]
 __se_compat_sys_openat+0x2a4/0x310 fs/open.c:1240
 __ia32_compat_sys_openat+0x56/0x70 fs/open.c:1240
 do_syscall_32_irqs_on arch/x86/entry/common.c:80 [inline]
 __do_fast_syscall_32+0x129/0x180 arch/x86/entry/common.c:139
 do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:162
 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:205
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Fixes: 498c60153ebb ("quota: Implement quota format with 64-bit space and inode limits")
Link: https://lore.kernel.org/r/20200924183619.4176790-1-edumazet@google.com
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jan Kara <jack@suse.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/quota/quota_v2.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c
index 2aa012a68e90..9891b8fb0432 100644
--- a/fs/quota/quota_v2.c
+++ b/fs/quota/quota_v2.c
@@ -266,6 +266,7 @@ static void v2r1_mem2diskdqb(void *dp, struct dquot *dquot)
 	d->dqb_curspace = cpu_to_le64(m->dqb_curspace);
 	d->dqb_btime = cpu_to_le64(m->dqb_btime);
 	d->dqb_id = cpu_to_le32(from_kqid(&init_user_ns, dquot->dq_id));
+	d->dqb_pad = 0;
 	if (qtree_entry_unused(info, dp))
 		d->dqb_itime = cpu_to_le64(1);
 }

From b095233a94beff09b39f81aaa09a5831cca3832d Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Tue, 29 Sep 2020 22:25:10 +0200
Subject: [PATCH 0812/2658] net: enic: Cure the enic api locking trainwreck

[ Upstream commit a53b59ece86c86d16d12ccdaa1ad0c78250a9d96 ]

enic_dev_wait() has a BUG_ON(in_interrupt()).

Chasing the callers of enic_dev_wait() revealed the gems of enic_reset()
and enic_tx_hang_reset() which are both invoked through work queues in
order to be able to call rtnl_lock(). So far so good.

After locking rtnl both functions acquire enic::enic_api_lock which
serializes against the (ab)use from infiniband. This is where the
trainwreck starts.

enic::enic_api_lock is a spin_lock() which implicitly disables preemption,
but both functions invoke a ton of functions under that lock which can
sleep. The BUG_ON(in_interrupt()) does not trigger in that case because it
can't detect the preempt disabled condition.

This clearly has never been tested with any of the mandatory debug options
for 7+ years, which would have caught that for sure.

Cure it by adding a enic_api_busy member to struct enic, which is modified
and evaluated with enic::enic_api_lock held.

If enic_api_devcmd_proxy_by_index() observes enic::enic_api_busy as true,
it drops enic::enic_api_lock and busy waits for enic::enic_api_busy to
become false.

It would be smarter to wait for a completion of that busy period, but
enic_api_devcmd_proxy_by_index() is called with other spin locks held which
obviously can't sleep.

Remove the BUG_ON(in_interrupt()) check as well because it's incomplete and
with proper debugging enabled the problem would have been caught from the
debug checks in schedule_timeout().

Fixes: 0b038566c0ea ("drivers/net: enic: Add an interface for USNIC to interact with firmware")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/cisco/enic/enic.h      |  1 +
 drivers/net/ethernet/cisco/enic/enic_api.c  |  6 +++++
 drivers/net/ethernet/cisco/enic/enic_main.c | 27 ++++++++++++++++-----
 3 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h
index 7ba6d530b0c0..230a4157ae9d 100644
--- a/drivers/net/ethernet/cisco/enic/enic.h
+++ b/drivers/net/ethernet/cisco/enic/enic.h
@@ -163,6 +163,7 @@ struct enic {
 	u16 num_vfs;
 #endif
 	spinlock_t enic_api_lock;
+	bool enic_api_busy;
 	struct enic_port_profile *pp;
 
 	/* work queue cache line section */
diff --git a/drivers/net/ethernet/cisco/enic/enic_api.c b/drivers/net/ethernet/cisco/enic/enic_api.c
index b161f24522b8..b028ea2dec2b 100644
--- a/drivers/net/ethernet/cisco/enic/enic_api.c
+++ b/drivers/net/ethernet/cisco/enic/enic_api.c
@@ -34,6 +34,12 @@ int enic_api_devcmd_proxy_by_index(struct net_device *netdev, int vf,
 	struct vnic_dev *vdev = enic->vdev;
 
 	spin_lock(&enic->enic_api_lock);
+	while (enic->enic_api_busy) {
+		spin_unlock(&enic->enic_api_lock);
+		cpu_relax();
+		spin_lock(&enic->enic_api_lock);
+	}
+
 	spin_lock_bh(&enic->devcmd_lock);
 
 	vnic_dev_cmd_proxy_by_index_start(vdev, vf);
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 3fd1cba0c7ec..5c74e55b75e5 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1938,8 +1938,6 @@ static int enic_dev_wait(struct vnic_dev *vdev,
 	int done;
 	int err;
 
-	BUG_ON(in_interrupt());
-
 	err = start(vdev, arg);
 	if (err)
 		return err;
@@ -2116,6 +2114,13 @@ static int enic_set_rss_nic_cfg(struct enic *enic)
 		rss_hash_bits, rss_base_cpu, rss_enable);
 }
 
+static void enic_set_api_busy(struct enic *enic, bool busy)
+{
+	spin_lock(&enic->enic_api_lock);
+	enic->enic_api_busy = busy;
+	spin_unlock(&enic->enic_api_lock);
+}
+
 static void enic_reset(struct work_struct *work)
 {
 	struct enic *enic = container_of(work, struct enic, reset);
@@ -2125,7 +2130,9 @@ static void enic_reset(struct work_struct *work)
 
 	rtnl_lock();
 
-	spin_lock(&enic->enic_api_lock);
+	/* Stop any activity from infiniband */
+	enic_set_api_busy(enic, true);
+
 	enic_stop(enic->netdev);
 	enic_dev_soft_reset(enic);
 	enic_reset_addr_lists(enic);
@@ -2133,7 +2140,10 @@ static void enic_reset(struct work_struct *work)
 	enic_set_rss_nic_cfg(enic);
 	enic_dev_set_ig_vlan_rewrite_mode(enic);
 	enic_open(enic->netdev);
-	spin_unlock(&enic->enic_api_lock);
+
+	/* Allow infiniband to fiddle with the device again */
+	enic_set_api_busy(enic, false);
+
 	call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev);
 
 	rtnl_unlock();
@@ -2145,7 +2155,9 @@ static void enic_tx_hang_reset(struct work_struct *work)
 
 	rtnl_lock();
 
-	spin_lock(&enic->enic_api_lock);
+	/* Stop any activity from infiniband */
+	enic_set_api_busy(enic, true);
+
 	enic_dev_hang_notify(enic);
 	enic_stop(enic->netdev);
 	enic_dev_hang_reset(enic);
@@ -2154,7 +2166,10 @@ static void enic_tx_hang_reset(struct work_struct *work)
 	enic_set_rss_nic_cfg(enic);
 	enic_dev_set_ig_vlan_rewrite_mode(enic);
 	enic_open(enic->netdev);
-	spin_unlock(&enic->enic_api_lock);
+
+	/* Allow infiniband to fiddle with the device again */
+	enic_set_api_busy(enic, false);
+
 	call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev);
 
 	rtnl_unlock();

From ac03891760aaa8a58bd5433d6fce7fa19004ddc2 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 11 Sep 2020 14:33:26 +0300
Subject: [PATCH 0813/2658] mfd: sm501: Fix leaks in probe()

[ Upstream commit 8ce24f8967df2836b4557a23e74dc4bb098249f1 ]

This code should clean up if sm501_init_dev() fails.

Fixes: b6d6454fdb66 ("[PATCH] mfd: SM501 core driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/sm501.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c
index fbec711c4195..0fe273d2f619 100644
--- a/drivers/mfd/sm501.c
+++ b/drivers/mfd/sm501.c
@@ -1430,8 +1430,14 @@ static int sm501_plat_probe(struct platform_device *dev)
 		goto err_claim;
 	}
 
-	return sm501_init_dev(sm);
+	ret = sm501_init_dev(sm);
+	if (ret)
+		goto err_unmap;
+
+	return 0;
 
+ err_unmap:
+	iounmap(sm->regs);
  err_claim:
 	release_resource(sm->regs_claim);
 	kfree(sm->regs_claim);

From f5f2da2f716692108676ed458b3f981d526b777f Mon Sep 17 00:00:00 2001
From: Lorenzo Colitti <lorenzo@google.com>
Date: Wed, 19 Aug 2020 01:19:49 +0900
Subject: [PATCH 0814/2658] usb: gadget: u_ether: enable qmult on SuperSpeed
 Plus as well
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 4eea21dc67b0c6ba15ae41b1defa113a680a858e ]

The u_ether driver has a qmult setting that multiplies the
transmit queue length (which by default is 2).

The intent is that it should be enabled at high/super speed, but
because the code does not explicitly check for USB_SUPER_PLUS,
it is disabled at that speed.

Fix this by ensuring that the queue multiplier is enabled for any
wired link at high speed or above. Using >= for USB_SPEED_*
constants seems correct because it is what the gadget_is_xxxspeed
functions do.

The queue multiplier substantially helps performance at higher
speeds. On a direct SuperSpeed Plus link to a Linux laptop,
iperf3 single TCP stream:

Before (qmult=1): 1.3 Gbps
After  (qmult=5): 3.2 Gbps

Fixes: 04617db7aa68 ("usb: gadget: add SS descriptors to Ethernet gadget")
Reviewed-by: Maciej Żenczykowski <maze@google.com>
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/function/u_ether.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index eec0ae6d0314..60df871568de 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -106,7 +106,7 @@ struct eth_dev {
 static inline int qlen(struct usb_gadget *gadget, unsigned qmult)
 {
 	if (gadget_is_dualspeed(gadget) && (gadget->speed == USB_SPEED_HIGH ||
-					    gadget->speed == USB_SPEED_SUPER))
+					    gadget->speed >= USB_SPEED_SUPER))
 		return qmult * DEFAULT_QLEN;
 	else
 		return DEFAULT_QLEN;

From 14d0f37bcb8d3f3de6e4a8f4617c9fa91cfafda1 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 28 Sep 2020 13:07:18 +0200
Subject: [PATCH 0815/2658] nl80211: fix non-split wiphy information

[ Upstream commit ab10c22bc3b2024f0c9eafa463899a071eac8d97 ]

When dumping wiphy information, we try to split the data into
many submessages, but for old userspace we still support the
old mode where this doesn't happen.

However, in this case we were not resetting our state correctly
and dumping multiple messages for each wiphy, which would have
broken such older userspace.

This was broken pretty much immediately afterwards because it
only worked in the original commit where non-split dumps didn't
have any more data than split dumps...

Fixes: fe1abafd942f ("nl80211: re-add channel width and extended capa advertising")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Link: https://lore.kernel.org/r/20200928130717.3e6d9c6bada2.Ie0f151a8d0d00a8e1e18f6a8c9244dd02496af67@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/wireless/nl80211.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index c44b2ee18cd7..5cbfffe2632f 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1706,7 +1706,10 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
 		 * case we'll continue with more data in the next round,
 		 * but break unconditionally so unsplit data stops here.
 		 */
-		state->split_start++;
+		if (state->split)
+			state->split_start++;
+		else
+			state->split_start = 0;
 		break;
 	case 9:
 		if (rdev->wiphy.extended_capabilities &&

From f5a5b6694d799e875ee708406155563786b6c1f3 Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Sun, 4 Oct 2020 06:19:31 -0700
Subject: [PATCH 0816/2658] mwifiex: fix double free

[ Upstream commit 53708f4fd9cfe389beab5c8daa763bcd0e0b4aef ]

clang static analysis reports this problem:

sdio.c:2403:3: warning: Attempt to free released memory
        kfree(card->mpa_rx.buf);
        ^~~~~~~~~~~~~~~~~~~~~~~

When mwifiex_init_sdio() fails in its first call to
mwifiex_alloc_sdio_mpa_buffer, it falls back to calling it
again.  If the second alloc of mpa_tx.buf fails, the error
handler will try to free the old, previously freed mpa_rx.buf.
Reviewing the code, it looks like a second double free would
happen with mwifiex_cleanup_sdio().

So set both pointers to NULL when they are freed.

Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Signed-off-by: Tom Rix <trix@redhat.com>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201004131931.29782-1-trix@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mwifiex/sdio.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index 78a8474e1a3d..abfe4e8700ed 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -1928,6 +1928,8 @@ static int mwifiex_alloc_sdio_mpa_buffers(struct mwifiex_adapter *adapter,
 		kfree(card->mpa_rx.buf);
 		card->mpa_tx.buf_size = 0;
 		card->mpa_rx.buf_size = 0;
+		card->mpa_tx.buf = NULL;
+		card->mpa_rx.buf = NULL;
 	}
 
 	return ret;

From 955b124ca41fe653d3dc49f5e173d4e086eef64e Mon Sep 17 00:00:00 2001
From: Valentin Vidic <vvidic@valentin-vidic.from.hr>
Date: Mon, 12 Oct 2020 00:03:29 +0200
Subject: [PATCH 0817/2658] net: korina: fix kfree of rx/tx descriptor array

[ Upstream commit 3af5f0f5c74ecbaf757ef06c3f80d56751277637 ]

kmalloc returns KSEG0 addresses so convert back from KSEG1
in kfree. Also make sure array is freed when the driver is
unloaded from the kernel.

Fixes: ef11291bcd5f ("Add support the Korina (IDT RC32434) Ethernet MAC")
Signed-off-by: Valentin Vidic <vvidic@valentin-vidic.from.hr>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/korina.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
index 07eabf72c480..3954c80f70fc 100644
--- a/drivers/net/ethernet/korina.c
+++ b/drivers/net/ethernet/korina.c
@@ -1188,7 +1188,7 @@ static int korina_probe(struct platform_device *pdev)
 	return rc;
 
 probe_err_register:
-	kfree(lp->td_ring);
+	kfree(KSEG0ADDR(lp->td_ring));
 probe_err_td_ring:
 	iounmap(lp->tx_dma_regs);
 probe_err_dma_tx:
@@ -1208,6 +1208,7 @@ static int korina_remove(struct platform_device *pdev)
 	iounmap(lp->eth_regs);
 	iounmap(lp->rx_dma_regs);
 	iounmap(lp->tx_dma_regs);
+	kfree(KSEG0ADDR(lp->td_ring));
 
 	unregister_netdev(bif->dev);
 	free_netdev(bif->dev);

From 76314653f66816386aff838342cf1707476b1139 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?H=C3=A5kon=20Bugge?= <haakon.bugge@oracle.com>
Date: Mon, 3 Aug 2020 08:19:41 +0200
Subject: [PATCH 0818/2658] IB/mlx4: Adjust delayed work when a dup is observed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 785167a114855c5aa75efca97000e405c2cc85bf ]

When scheduling delayed work to clean up the cache, if the entry already
has been scheduled for deletion, we adjust the delay.

Fixes: 3cf69cc8dbeb ("IB/mlx4: Add CM paravirtualization")
Link: https://lore.kernel.org/r/20200803061941.1139994-7-haakon.bugge@oracle.com
Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/mlx4/cm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c
index 5dc920fe1326..c8c586c78d07 100644
--- a/drivers/infiniband/hw/mlx4/cm.c
+++ b/drivers/infiniband/hw/mlx4/cm.c
@@ -309,6 +309,9 @@ static void schedule_delayed(struct ib_device *ibdev, struct id_map_entry *id)
 	if (!sriov->is_going_down) {
 		id->scheduled_delete = 1;
 		schedule_delayed_work(&id->timeout, CM_CLEANUP_CACHE_TIMEOUT);
+	} else if (id->scheduled_delete) {
+		/* Adjust timeout if already scheduled */
+		mod_delayed_work(system_wq, &id->timeout, CM_CLEANUP_CACHE_TIMEOUT);
 	}
 	spin_unlock_irqrestore(&sriov->going_down_lock, flags);
 	spin_unlock(&sriov->id_map_lock);

From 129d2f2cd93662327c3c1d0e28dc3a12598353ad Mon Sep 17 00:00:00 2001
From: Nicholas Mc Guire <hofrat@osadl.org>
Date: Mon, 2 Jul 2018 11:08:16 +0200
Subject: [PATCH 0819/2658] powerpc/pseries: Fix missing of_node_put() in
 rng_init()

[ Upstream commit 67c3e59443f5fc77be39e2ce0db75fbfa78c7965 ]

The call to of_find_compatible_node() returns a node pointer with
refcount incremented thus it must be explicitly decremented here
before returning.

Fixes: a489043f4626 ("powerpc/pseries: Implement arch_get_random_long() based on H_RANDOM")
Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1530522496-14816-1-git-send-email-hofrat@osadl.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/rng.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/powerpc/platforms/pseries/rng.c b/arch/powerpc/platforms/pseries/rng.c
index 31ca557af60b..262b8c5e1b9d 100644
--- a/arch/powerpc/platforms/pseries/rng.c
+++ b/arch/powerpc/platforms/pseries/rng.c
@@ -40,6 +40,7 @@ static __init int rng_init(void)
 
 	ppc_md.get_random_seed = pseries_get_random_long;
 
+	of_node_put(dn);
 	return 0;
 }
 machine_subsys_initcall(pseries, rng_init);

From b0c035d8df560a0bcb3229d822ec227e6230e883 Mon Sep 17 00:00:00 2001
From: Nicholas Mc Guire <hofrat@osadl.org>
Date: Wed, 4 Jul 2018 10:03:27 +0200
Subject: [PATCH 0820/2658] powerpc/icp-hv: Fix missing of_node_put() in
 success path

[ Upstream commit d3e669f31ec35856f5e85df9224ede5bdbf1bc7b ]

Both of_find_compatible_node() and of_find_node_by_type() will return
a refcounted node on success - thus for the success path the node must
be explicitly released with a of_node_put().

Fixes: 0b05ac6e2480 ("powerpc/xics: Rewrite XICS driver")
Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1530691407-3991-1-git-send-email-hofrat@osadl.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/sysdev/xics/icp-hv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/powerpc/sysdev/xics/icp-hv.c b/arch/powerpc/sysdev/xics/icp-hv.c
index c1917cf67c3d..3205e64c452b 100644
--- a/arch/powerpc/sysdev/xics/icp-hv.c
+++ b/arch/powerpc/sysdev/xics/icp-hv.c
@@ -179,6 +179,7 @@ int icp_hv_init(void)
 
 	icp_ops = &icp_hv_ops;
 
+	of_node_put(np);
 	return 0;
 }
 

From 7b1ca532355718df2130e281f6261edae3bfe00d Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Tue, 5 May 2020 16:01:16 +0200
Subject: [PATCH 0821/2658] mtd: lpddr: fix excessive stack usage with clang

[ Upstream commit 3e1b6469f8324bee5927b063e2aca30d3e56b907 ]

Building lpddr2_nvm with clang can result in a giant stack usage
in one function:

drivers/mtd/lpddr/lpddr2_nvm.c:399:12: error: stack frame size of 1144 bytes in function 'lpddr2_nvm_probe' [-Werror,-Wframe-larger-than=]

The problem is that clang decides to build a copy of the mtd_info
structure on the stack and then do a memcpy() into the actual version. It
shouldn't really do it that way, but it's not strictly a bug either.

As a workaround, use a static const version of the structure to assign
most of the members upfront and then only set the few members that
require runtime knowledge at probe time.

Fixes: 96ba9dd65788 ("mtd: lpddr: add driver for LPDDR2-NVM PCM memories")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Acked-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20200505140136.263461-1-arnd@arndb.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/lpddr/lpddr2_nvm.c | 35 ++++++++++++++++++----------------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/drivers/mtd/lpddr/lpddr2_nvm.c b/drivers/mtd/lpddr/lpddr2_nvm.c
index 2342277c9bcb..5e36366d9b36 100644
--- a/drivers/mtd/lpddr/lpddr2_nvm.c
+++ b/drivers/mtd/lpddr/lpddr2_nvm.c
@@ -408,6 +408,17 @@ static int lpddr2_nvm_lock(struct mtd_info *mtd, loff_t start_add,
 	return lpddr2_nvm_do_block_op(mtd, start_add, len, LPDDR2_NVM_LOCK);
 }
 
+static const struct mtd_info lpddr2_nvm_mtd_info = {
+	.type		= MTD_RAM,
+	.writesize	= 1,
+	.flags		= (MTD_CAP_NVRAM | MTD_POWERUP_LOCK),
+	._read		= lpddr2_nvm_read,
+	._write		= lpddr2_nvm_write,
+	._erase		= lpddr2_nvm_erase,
+	._unlock	= lpddr2_nvm_unlock,
+	._lock		= lpddr2_nvm_lock,
+};
+
 /*
  * lpddr2_nvm driver probe method
  */
@@ -448,6 +459,7 @@ static int lpddr2_nvm_probe(struct platform_device *pdev)
 		.pfow_base	= OW_BASE_ADDRESS,
 		.fldrv_priv	= pcm_data,
 	};
+
 	if (IS_ERR(map->virt))
 		return PTR_ERR(map->virt);
 
@@ -459,22 +471,13 @@ static int lpddr2_nvm_probe(struct platform_device *pdev)
 		return PTR_ERR(pcm_data->ctl_regs);
 
 	/* Populate mtd_info data structure */
-	*mtd = (struct mtd_info) {
-		.dev		= { .parent = &pdev->dev },
-		.name		= pdev->dev.init_name,
-		.type		= MTD_RAM,
-		.priv		= map,
-		.size		= resource_size(add_range),
-		.erasesize	= ERASE_BLOCKSIZE * pcm_data->bus_width,
-		.writesize	= 1,
-		.writebufsize	= WRITE_BUFFSIZE * pcm_data->bus_width,
-		.flags		= (MTD_CAP_NVRAM | MTD_POWERUP_LOCK),
-		._read		= lpddr2_nvm_read,
-		._write		= lpddr2_nvm_write,
-		._erase		= lpddr2_nvm_erase,
-		._unlock	= lpddr2_nvm_unlock,
-		._lock		= lpddr2_nvm_lock,
-	};
+	*mtd = lpddr2_nvm_mtd_info;
+	mtd->dev.parent		= &pdev->dev;
+	mtd->name		= pdev->dev.init_name;
+	mtd->priv		= map;
+	mtd->size		= resource_size(add_range);
+	mtd->erasesize		= ERASE_BLOCKSIZE * pcm_data->bus_width;
+	mtd->writebufsize	= WRITE_BUFFSIZE * pcm_data->bus_width;
 
 	/* Verify the presence of the device looking for PFOW string */
 	if (!lpddr2_nvm_pfow_present(map)) {

From 001a5aec67b9288a4b0b79bc477d638e62767afe Mon Sep 17 00:00:00 2001
From: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
Date: Thu, 3 Sep 2020 15:42:17 +1200
Subject: [PATCH 0822/2658] mtd: mtdoops: Don't write panic data twice

[ Upstream commit c1cf1d57d1492235309111ea6a900940213a9166 ]

If calling mtdoops_write, don't also schedule work to be done later.

Although this appears to not be causing an issue, possibly because the
scheduled work will never get done, it is confusing.

Fixes: 016c1291ce70 ("mtd: mtdoops: do not use mtd->panic_write directly")
Signed-off-by: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20200903034217.23079-1-mark.tomlinson@alliedtelesis.co.nz
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/mtdoops.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c
index 97bb8f6304d4..09165eaac7a1 100644
--- a/drivers/mtd/mtdoops.c
+++ b/drivers/mtd/mtdoops.c
@@ -313,12 +313,13 @@ static void mtdoops_do_dump(struct kmsg_dumper *dumper,
 	kmsg_dump_get_buffer(dumper, true, cxt->oops_buf + MTDOOPS_HEADER_SIZE,
 			     record_size - MTDOOPS_HEADER_SIZE, NULL);
 
-	/* Panics must be written immediately */
-	if (reason != KMSG_DUMP_OOPS)
+	if (reason != KMSG_DUMP_OOPS) {
+		/* Panics must be written immediately */
 		mtdoops_write(cxt, 1);
-
-	/* For other cases, schedule work to write it "nicely" */
-	schedule_work(&cxt->work_write);
+	} else {
+		/* For other cases, schedule work to write it "nicely" */
+		schedule_work(&cxt->work_write);
+	}
 }
 
 static void mtdoops_notify_add(struct mtd_info *mtd)

From 2a1e7d2091e60d9b1afa860923bba4d2e45a8a49 Mon Sep 17 00:00:00 2001
From: Guillaume Tucker <guillaume.tucker@collabora.com>
Date: Tue, 1 Sep 2020 16:58:06 +0100
Subject: [PATCH 0823/2658] ARM: 9007/1: l2c: fix prefetch bits init in
 L2X0_AUX_CTRL using DT values

[ Upstream commit 8e007b367a59bcdf484c81f6df9bd5a4cc179ca6 ]

The L310_PREFETCH_CTRL register bits 28 and 29 to enable data and
instruction prefetch respectively can also be accessed via the
L2X0_AUX_CTRL register.  They appear to be actually wired together in
hardware between the registers.  Changing them in the prefetch
register only will get undone when restoring the aux control register
later on.  For this reason, set these bits in both registers during
initialisation according to the devicetree property values.

Link: https://lore.kernel.org/lkml/76f2f3ad5e77e356e0a5b99ceee1e774a2842c25.1597061474.git.guillaume.tucker@collabora.com/

Fixes: ec3bd0e68a67 ("ARM: 8391/1: l2c: add options to overwrite prefetching behavior")
Signed-off-by: Guillaume Tucker <guillaume.tucker@collabora.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mm/cache-l2x0.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
index 493692d838c6..0b6f8a93d8c6 100644
--- a/arch/arm/mm/cache-l2x0.c
+++ b/arch/arm/mm/cache-l2x0.c
@@ -1228,20 +1228,28 @@ static void __init l2c310_of_parse(const struct device_node *np,
 
 	ret = of_property_read_u32(np, "prefetch-data", &val);
 	if (ret == 0) {
-		if (val)
+		if (val) {
 			prefetch |= L310_PREFETCH_CTRL_DATA_PREFETCH;
-		else
+			*aux_val |= L310_PREFETCH_CTRL_DATA_PREFETCH;
+		} else {
 			prefetch &= ~L310_PREFETCH_CTRL_DATA_PREFETCH;
+			*aux_val &= ~L310_PREFETCH_CTRL_DATA_PREFETCH;
+		}
+		*aux_mask &= ~L310_PREFETCH_CTRL_DATA_PREFETCH;
 	} else if (ret != -EINVAL) {
 		pr_err("L2C-310 OF prefetch-data property value is missing\n");
 	}
 
 	ret = of_property_read_u32(np, "prefetch-instr", &val);
 	if (ret == 0) {
-		if (val)
+		if (val) {
 			prefetch |= L310_PREFETCH_CTRL_INSTR_PREFETCH;
-		else
+			*aux_val |= L310_PREFETCH_CTRL_INSTR_PREFETCH;
+		} else {
 			prefetch &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH;
+			*aux_val &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH;
+		}
+		*aux_mask &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH;
 	} else if (ret != -EINVAL) {
 		pr_err("L2C-310 OF prefetch-instr property value is missing\n");
 	}

From 7c38782d0942e1a0b50b0b110be1a7c81195bbb3 Mon Sep 17 00:00:00 2001
From: Finn Thain <fthain@telegraphics.com.au>
Date: Sat, 5 Sep 2020 09:02:20 +1000
Subject: [PATCH 0824/2658] powerpc/tau: Use appropriate temperature sample
 interval

[ Upstream commit 66943005cc41f48e4d05614e8f76c0ca1812f0fd ]

According to the MPC750 Users Manual, the SITV value in Thermal
Management Register 3 is 13 bits long. The present code calculates the
SITV value as 60 * 500 cycles. This would overflow to give 10 us on
a 500 MHz CPU rather than the intended 60 us. (But according to the
Microprocessor Datasheet, there is also a factor of 266 that has to be
applied to this value on certain parts i.e. speed sort above 266 MHz.)
Always use the maximum cycle count, as recommended by the Datasheet.

Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Tested-by: Stan Johnson <userm57@yahoo.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/896f542e5f0f1d6cf8218524c2b67d79f3d69b3c.1599260540.git.fthain@telegraphics.com.au
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/reg.h |  2 +-
 arch/powerpc/kernel/tau_6xx.c  | 12 ++++--------
 2 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index ca372bbc0ffe..dd262f09a99e 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -647,7 +647,7 @@
 #define THRM1_TIN	(1 << 31)
 #define THRM1_TIV	(1 << 30)
 #define THRM1_THRES(x)	((x&0x7f)<<23)
-#define THRM3_SITV(x)	((x&0x3fff)<<1)
+#define THRM3_SITV(x)	((x & 0x1fff) << 1)
 #define THRM1_TID	(1<<2)
 #define THRM1_TIE	(1<<1)
 #define THRM1_V		(1<<0)
diff --git a/arch/powerpc/kernel/tau_6xx.c b/arch/powerpc/kernel/tau_6xx.c
index a753b72efbc0..188048132288 100644
--- a/arch/powerpc/kernel/tau_6xx.c
+++ b/arch/powerpc/kernel/tau_6xx.c
@@ -174,15 +174,11 @@ static void tau_timeout(void * info)
 	 * complex sleep code needs to be added. One mtspr every time
 	 * tau_timeout is called is probably not a big deal.
 	 *
-	 * Enable thermal sensor and set up sample interval timer
-	 * need 20 us to do the compare.. until a nice 'cpu_speed' function
-	 * call is implemented, just assume a 500 mhz clock. It doesn't really
-	 * matter if we take too long for a compare since it's all interrupt
-	 * driven anyway.
-	 *
-	 * use a extra long time.. (60 us @ 500 mhz)
+	 * The "PowerPC 740 and PowerPC 750 Microprocessor Datasheet"
+	 * recommends that "the maximum value be set in THRM3 under all
+	 * conditions."
 	 */
-	mtspr(SPRN_THRM3, THRM3_SITV(500*60) | THRM3_E);
+	mtspr(SPRN_THRM3, THRM3_SITV(0x1fff) | THRM3_E);
 
 	local_irq_restore(flags);
 }

From 6d3d52716070430bff63070d1a00a46321da44e9 Mon Sep 17 00:00:00 2001
From: Finn Thain <fthain@telegraphics.com.au>
Date: Sat, 5 Sep 2020 09:02:20 +1000
Subject: [PATCH 0825/2658] powerpc/tau: Remove duplicated set_thresholds()
 call

[ Upstream commit 420ab2bc7544d978a5d0762ee736412fe9c796ab ]

The commentary at the call site seems to disagree with the code. The
conditional prevents calling set_thresholds() via the exception handler,
which appears to crash. Perhaps that's because it immediately triggers
another TAU exception. Anyway, calling set_thresholds() from TAUupdate()
is redundant because tau_timeout() does so.

Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Tested-by: Stan Johnson <userm57@yahoo.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/d7c7ee33232cf72a6a6bbb6ef05838b2e2b113c0.1599260540.git.fthain@telegraphics.com.au
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/tau_6xx.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/arch/powerpc/kernel/tau_6xx.c b/arch/powerpc/kernel/tau_6xx.c
index 188048132288..f6a92bf5ebfc 100644
--- a/arch/powerpc/kernel/tau_6xx.c
+++ b/arch/powerpc/kernel/tau_6xx.c
@@ -107,11 +107,6 @@ void TAUupdate(int cpu)
 #ifdef DEBUG
 	printk("grew = %d\n", tau[cpu].grew);
 #endif
-
-#ifndef CONFIG_TAU_INT /* tau_timeout will do this if not using interrupts */
-	set_thresholds(cpu);
-#endif
-
 }
 
 #ifdef CONFIG_TAU_INT

From d8021a3ee4d3453bf86fa48c1ab03553dc7869cd Mon Sep 17 00:00:00 2001
From: Finn Thain <fthain@telegraphics.com.au>
Date: Sat, 5 Sep 2020 09:02:20 +1000
Subject: [PATCH 0826/2658] powerpc/tau: Disable TAU between measurements

[ Upstream commit e63d6fb5637e92725cf143559672a34b706bca4f ]

Enabling CONFIG_TAU_INT causes random crashes:

Unrecoverable exception 1700 at c0009414 (msr=1000)
Oops: Unrecoverable exception, sig: 6 [#1]
BE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=2 PowerMac
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.7.0-pmac-00043-gd5f545e1a8593 #5
NIP:  c0009414 LR: c0009414 CTR: c00116fc
REGS: c0799eb8 TRAP: 1700   Not tainted  (5.7.0-pmac-00043-gd5f545e1a8593)
MSR:  00001000 <ME>  CR: 22000228  XER: 00000100

GPR00: 00000000 c0799f70 c076e300 00800000 0291c0ac 00e00000 c076e300 00049032
GPR08: 00000001 c00116fc 00000000 dfbd3200 ffffffff 007f80a8 00000000 00000000
GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 c075ce04
GPR24: c075ce04 dfff8880 c07b0000 c075ce04 00080000 00000001 c079ef98 c079ef5c
NIP [c0009414] arch_cpu_idle+0x24/0x6c
LR [c0009414] arch_cpu_idle+0x24/0x6c
Call Trace:
[c0799f70] [00000001] 0x1 (unreliable)
[c0799f80] [c0060990] do_idle+0xd8/0x17c
[c0799fa0] [c0060ba4] cpu_startup_entry+0x20/0x28
[c0799fb0] [c072d220] start_kernel+0x434/0x44c
[c0799ff0] [00003860] 0x3860
Instruction dump:
XXXXXXXX XXXXXXXX XXXXXXXX 3d20c07b XXXXXXXX XXXXXXXX XXXXXXXX 7c0802a6
XXXXXXXX XXXXXXXX XXXXXXXX 4e800421 XXXXXXXX XXXXXXXX XXXXXXXX 7d2000a6
---[ end trace 3a0c9b5cb216db6b ]---

Resolve this problem by disabling each THRMn comparator when handling
the associated THRMn interrupt and by disabling the TAU entirely when
updating THRMn thresholds.

Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Tested-by: Stan Johnson <userm57@yahoo.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/5a0ba3dc5612c7aac596727331284a3676c08472.1599260540.git.fthain@telegraphics.com.au
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/tau_6xx.c  | 65 +++++++++++++---------------------
 arch/powerpc/platforms/Kconfig |  9 ++---
 2 files changed, 26 insertions(+), 48 deletions(-)

diff --git a/arch/powerpc/kernel/tau_6xx.c b/arch/powerpc/kernel/tau_6xx.c
index f6a92bf5ebfc..70c9d134a9d4 100644
--- a/arch/powerpc/kernel/tau_6xx.c
+++ b/arch/powerpc/kernel/tau_6xx.c
@@ -37,8 +37,6 @@ static struct tau_temp
 
 struct timer_list tau_timer;
 
-#undef DEBUG
-
 /* TODO: put these in a /proc interface, with some sanity checks, and maybe
  * dynamic adjustment to minimize # of interrupts */
 /* configurable values for step size and how much to expand the window when
@@ -71,42 +69,33 @@ void set_thresholds(unsigned long cpu)
 
 void TAUupdate(int cpu)
 {
-	unsigned thrm;
-
-#ifdef DEBUG
-	printk("TAUupdate ");
-#endif
+	u32 thrm;
+	u32 bits = THRM1_TIV | THRM1_TIN | THRM1_V;
 
 	/* if both thresholds are crossed, the step_sizes cancel out
 	 * and the window winds up getting expanded twice. */
-	if((thrm = mfspr(SPRN_THRM1)) & THRM1_TIV){ /* is valid? */
-		if(thrm & THRM1_TIN){ /* crossed low threshold */
-			if (tau[cpu].low >= step_size){
-				tau[cpu].low -= step_size;
-				tau[cpu].high -= (step_size - window_expand);
-			}
-			tau[cpu].grew = 1;
-#ifdef DEBUG
-			printk("low threshold crossed ");
-#endif
+	thrm = mfspr(SPRN_THRM1);
+	if ((thrm & bits) == bits) {
+		mtspr(SPRN_THRM1, 0);
+
+		if (tau[cpu].low >= step_size) {
+			tau[cpu].low -= step_size;
+			tau[cpu].high -= (step_size - window_expand);
 		}
+		tau[cpu].grew = 1;
+		pr_debug("%s: low threshold crossed\n", __func__);
 	}
-	if((thrm = mfspr(SPRN_THRM2)) & THRM1_TIV){ /* is valid? */
-		if(thrm & THRM1_TIN){ /* crossed high threshold */
-			if (tau[cpu].high <= 127-step_size){
-				tau[cpu].low += (step_size - window_expand);
-				tau[cpu].high += step_size;
-			}
-			tau[cpu].grew = 1;
-#ifdef DEBUG
-			printk("high threshold crossed ");
-#endif
+	thrm = mfspr(SPRN_THRM2);
+	if ((thrm & bits) == bits) {
+		mtspr(SPRN_THRM2, 0);
+
+		if (tau[cpu].high <= 127 - step_size) {
+			tau[cpu].low += (step_size - window_expand);
+			tau[cpu].high += step_size;
 		}
+		tau[cpu].grew = 1;
+		pr_debug("%s: high threshold crossed\n", __func__);
 	}
-
-#ifdef DEBUG
-	printk("grew = %d\n", tau[cpu].grew);
-#endif
 }
 
 #ifdef CONFIG_TAU_INT
@@ -131,18 +120,18 @@ void TAUException(struct pt_regs * regs)
 static void tau_timeout(void * info)
 {
 	int cpu;
-	unsigned long flags;
 	int size;
 	int shrink;
 
-	/* disabling interrupts *should* be okay */
-	local_irq_save(flags);
 	cpu = smp_processor_id();
 
 #ifndef CONFIG_TAU_INT
 	TAUupdate(cpu);
 #endif
 
+	/* Stop thermal sensor comparisons and interrupts */
+	mtspr(SPRN_THRM3, 0);
+
 	size = tau[cpu].high - tau[cpu].low;
 	if (size > min_window && ! tau[cpu].grew) {
 		/* do an exponential shrink of half the amount currently over size */
@@ -164,18 +153,12 @@ static void tau_timeout(void * info)
 
 	set_thresholds(cpu);
 
-	/*
-	 * Do the enable every time, since otherwise a bunch of (relatively)
-	 * complex sleep code needs to be added. One mtspr every time
-	 * tau_timeout is called is probably not a big deal.
-	 *
+	/* Restart thermal sensor comparisons and interrupts.
 	 * The "PowerPC 740 and PowerPC 750 Microprocessor Datasheet"
 	 * recommends that "the maximum value be set in THRM3 under all
 	 * conditions."
 	 */
 	mtspr(SPRN_THRM3, THRM3_SITV(0x1fff) | THRM3_E);
-
-	local_irq_restore(flags);
 }
 
 static void tau_timeout_smp(unsigned long unused)
diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig
index b7f9c408bf24..0a0281a21ea5 100644
--- a/arch/powerpc/platforms/Kconfig
+++ b/arch/powerpc/platforms/Kconfig
@@ -242,7 +242,7 @@ config TAU
 	  temp is actually what /proc/cpuinfo says it is.
 
 config TAU_INT
-	bool "Interrupt driven TAU driver (DANGEROUS)"
+	bool "Interrupt driven TAU driver (EXPERIMENTAL)"
 	depends on TAU
 	---help---
 	  The TAU supports an interrupt driven mode which causes an interrupt
@@ -250,12 +250,7 @@ config TAU_INT
 	  to get notified the temp has exceeded a range. With this option off,
 	  a timer is used to re-check the temperature periodically.
 
-	  However, on some cpus it appears that the TAU interrupt hardware
-	  is buggy and can cause a situation which would lead unexplained hard
-	  lockups.
-
-	  Unless you are extending the TAU driver, or enjoy kernel/hardware
-	  debugging, leave this option off.
+	  If in doubt, say N here.
 
 config TAU_AVERAGE
 	bool "Average high and low temp"

From ff7d851c4149a629ed9a4b9bca35061f377b65de Mon Sep 17 00:00:00 2001
From: Adrian Hunter <adrian.hunter@intel.com>
Date: Wed, 9 Sep 2020 11:49:23 +0300
Subject: [PATCH 0827/2658] perf intel-pt: Fix "context_switch event has no
 tid" error

[ Upstream commit 7d537a8d2e76bc4fc71e34545ceaa463ac2cd928 ]

A context_switch event can have no tid because pids can be detached from
a task while the task is still running (in do_exit()). Note this won't
happen with per-task contexts because then tracing stops at
perf_event_exit_task()

If a task with no tid gets preempted, or a dying task gets preempted and
its parent releases it, when it subsequently gets switched back in,
Intel PT will not be able to determine what task is running and prints
an error "context_switch event has no tid". However, it is not really an
error because the task is in kernel space and the decoder can continue
to decode successfully. Fix by changing the error to be only a logged
message, and make allowance for tid == -1.

Example:

  Using 5.9-rc4 with Preemptible Kernel (Low-Latency Desktop) e.g.
  $ uname -r
  5.9.0-rc4
  $ grep PREEMPT .config
  # CONFIG_PREEMPT_NONE is not set
  # CONFIG_PREEMPT_VOLUNTARY is not set
  CONFIG_PREEMPT=y
  CONFIG_PREEMPT_COUNT=y
  CONFIG_PREEMPTION=y
  CONFIG_PREEMPT_RCU=y
  CONFIG_PREEMPT_NOTIFIERS=y
  CONFIG_DRM_I915_PREEMPT_TIMEOUT=640
  CONFIG_DEBUG_PREEMPT=y
  # CONFIG_PREEMPT_TRACER is not set
  # CONFIG_PREEMPTIRQ_DELAY_TEST is not set

Before:

  $ cat forkit.c

  #include <sys/types.h>
  #include <unistd.h>
  #include <sys/wait.h>

  int main()
  {
          pid_t child;
          int status = 0;

          child = fork();
          if (child == 0)
                  return 123;
          wait(&status);
          return 0;
  }

  $ gcc -o forkit forkit.c
  $ sudo ~/bin/perf record --kcore -a -m,64M -e intel_pt/cyc/k &
  [1] 11016
  $ taskset 2 ./forkit
  $ sudo pkill perf
  $ [ perf record: Woken up 1 times to write data ]
  [ perf record: Captured and wrote 17.262 MB perf.data ]

  [1]+  Terminated              sudo ~/bin/perf record --kcore -a -m,64M -e intel_pt/cyc/k
  $ sudo ~/bin/perf script --show-task-events --show-switch-events --itrace=iqqe-o -C 1 --ns | grep -C 2 forkit
  context_switch event has no tid
           taskset 11019 [001] 66663.270045029:          1 instructions:k:  ffffffffb1d9f844 strnlen_user+0xb4 ([kernel.kallsyms])
           taskset 11019 [001] 66663.270201816:          1 instructions:k:  ffffffffb1a83121 unmap_page_range+0x561 ([kernel.kallsyms])
            forkit 11019 [001] 66663.270327553: PERF_RECORD_COMM exec: forkit:11019/11019
            forkit 11019 [001] 66663.270420028:          1 instructions:k:  ffffffffb1db9537 __clear_user+0x27 ([kernel.kallsyms])
            forkit 11019 [001] 66663.270648704:          1 instructions:k:  ffffffffb18829e6 do_user_addr_fault+0xf6 ([kernel.kallsyms])
            forkit 11019 [001] 66663.270833163:          1 instructions:k:  ffffffffb230a825 irqentry_exit_to_user_mode+0x15 ([kernel.kallsyms])
            forkit 11019 [001] 66663.271092359:          1 instructions:k:  ffffffffb1aea3d9 lock_page_memcg+0x9 ([kernel.kallsyms])
            forkit 11019 [001] 66663.271207092: PERF_RECORD_FORK(11020:11020):(11019:11019)
            forkit 11019 [001] 66663.271234775: PERF_RECORD_SWITCH_CPU_WIDE OUT          next pid/tid: 11020/11020
            forkit 11020 [001] 66663.271238407: PERF_RECORD_SWITCH_CPU_WIDE IN           prev pid/tid: 11019/11019
            forkit 11020 [001] 66663.271312066:          1 instructions:k:  ffffffffb1a88140 handle_mm_fault+0x10 ([kernel.kallsyms])
            forkit 11020 [001] 66663.271476225: PERF_RECORD_EXIT(11020:11020):(11019:11019)
            forkit 11020 [001] 66663.271497488: PERF_RECORD_SWITCH_CPU_WIDE OUT preempt  next pid/tid: 11019/11019
            forkit 11019 [001] 66663.271500523: PERF_RECORD_SWITCH_CPU_WIDE IN           prev pid/tid: 11020/11020
            forkit 11019 [001] 66663.271517241:          1 instructions:k:  ffffffffb24012cd error_entry+0x6d ([kernel.kallsyms])
            forkit 11019 [001] 66663.271664080: PERF_RECORD_EXIT(11019:11019):(1386:1386)

After:

  $ sudo ~/bin/perf script --show-task-events --show-switch-events --itrace=iqqe-o -C 1 --ns | grep -C 2 forkit
           taskset 11019 [001] 66663.270045029:          1 instructions:k:  ffffffffb1d9f844 strnlen_user+0xb4 ([kernel.kallsyms])
           taskset 11019 [001] 66663.270201816:          1 instructions:k:  ffffffffb1a83121 unmap_page_range+0x561 ([kernel.kallsyms])
            forkit 11019 [001] 66663.270327553: PERF_RECORD_COMM exec: forkit:11019/11019
            forkit 11019 [001] 66663.270420028:          1 instructions:k:  ffffffffb1db9537 __clear_user+0x27 ([kernel.kallsyms])
            forkit 11019 [001] 66663.270648704:          1 instructions:k:  ffffffffb18829e6 do_user_addr_fault+0xf6 ([kernel.kallsyms])
            forkit 11019 [001] 66663.270833163:          1 instructions:k:  ffffffffb230a825 irqentry_exit_to_user_mode+0x15 ([kernel.kallsyms])
            forkit 11019 [001] 66663.271092359:          1 instructions:k:  ffffffffb1aea3d9 lock_page_memcg+0x9 ([kernel.kallsyms])
            forkit 11019 [001] 66663.271207092: PERF_RECORD_FORK(11020:11020):(11019:11019)
            forkit 11019 [001] 66663.271234775: PERF_RECORD_SWITCH_CPU_WIDE OUT          next pid/tid: 11020/11020
            forkit 11020 [001] 66663.271238407: PERF_RECORD_SWITCH_CPU_WIDE IN           prev pid/tid: 11019/11019
            forkit 11020 [001] 66663.271312066:          1 instructions:k:  ffffffffb1a88140 handle_mm_fault+0x10 ([kernel.kallsyms])
            forkit 11020 [001] 66663.271476225: PERF_RECORD_EXIT(11020:11020):(11019:11019)
            forkit 11020 [001] 66663.271497488: PERF_RECORD_SWITCH_CPU_WIDE OUT preempt  next pid/tid: 11019/11019
            forkit 11019 [001] 66663.271500523: PERF_RECORD_SWITCH_CPU_WIDE IN           prev pid/tid: 11020/11020
            forkit 11019 [001] 66663.271517241:          1 instructions:k:  ffffffffb24012cd error_entry+0x6d ([kernel.kallsyms])
            forkit 11019 [001] 66663.271664080: PERF_RECORD_EXIT(11019:11019):(1386:1386)
            forkit 11019 [001] 66663.271688752: PERF_RECORD_SWITCH_CPU_WIDE OUT          next pid/tid:    -1/-1
               :-1    -1 [001] 66663.271692086: PERF_RECORD_SWITCH_CPU_WIDE IN           prev pid/tid: 11019/11019
                :-1    -1 [001] 66663.271707466:          1 instructions:k:  ffffffffb18eb096 update_load_avg+0x306 ([kernel.kallsyms])

Fixes: 86c2786994bd7c ("perf intel-pt: Add support for PERF_RECORD_SWITCH")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Yu-cheng Yu <yu-cheng.yu@intel.com>
Link: http://lore.kernel.org/lkml/20200909084923.9096-3-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/intel-pt.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
index c8f2d084a8ce..be5a7c1b36ff 100644
--- a/tools/perf/util/intel-pt.c
+++ b/tools/perf/util/intel-pt.c
@@ -794,6 +794,8 @@ static void intel_pt_set_pid_tid_cpu(struct intel_pt *pt,
 
 	if (queue->tid == -1 || pt->have_sched_switch) {
 		ptq->tid = machine__get_current_tid(pt->machine, ptq->cpu);
+		if (ptq->tid == -1)
+			ptq->pid = -1;
 		thread__zput(ptq->thread);
 	}
 
@@ -1634,10 +1636,8 @@ static int intel_pt_context_switch(struct intel_pt *pt, union perf_event *event,
 		tid = sample->tid;
 	}
 
-	if (tid == -1) {
-		pr_err("context_switch event has no tid\n");
-		return -EINVAL;
-	}
+	if (tid == -1)
+		intel_pt_log("context_switch event has no tid\n");
 
 	intel_pt_log("context_switch: cpu %d pid %d tid %d time %"PRIu64" tsc %#"PRIx64"\n",
 		     cpu, pid, tid, sample->time, perf_time_to_tsc(sample->time,

From aab77d10ba3036f38c279a14c5c25f4a1471f51e Mon Sep 17 00:00:00 2001
From: Daniel Thompson <daniel.thompson@linaro.org>
Date: Wed, 9 Sep 2020 15:17:08 +0100
Subject: [PATCH 0828/2658] kdb: Fix pager search for multi-line strings

[ Upstream commit d081a6e353168f15e63eb9e9334757f20343319f ]

Currently using forward search doesn't handle multi-line strings correctly.
The search routine replaces line breaks with \0 during the search and, for
regular searches ("help | grep Common\n"), there is code after the line
has been discarded or printed to replace the break character.

However during a pager search ("help\n" followed by "/Common\n") when the
string is matched we will immediately return to normal output and the code
that should restore the \n becomes unreachable. Fix this by restoring the
replaced character when we disable the search mode and update the comment
accordingly.

Fixes: fb6daa7520f9d ("kdb: Provide forward search at more prompt")
Link: https://lore.kernel.org/r/20200909141708.338273-1-daniel.thompson@linaro.org
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/debug/kdb/kdb_io.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c
index d3c5b15c86c1..4b537520432a 100644
--- a/kernel/debug/kdb/kdb_io.c
+++ b/kernel/debug/kdb/kdb_io.c
@@ -691,12 +691,16 @@ int vkdb_printf(enum kdb_msgsrc src, const char *fmt, va_list ap)
 			size_avail = sizeof(kdb_buffer) - len;
 			goto kdb_print_out;
 		}
-		if (kdb_grepping_flag >= KDB_GREPPING_FLAG_SEARCH)
+		if (kdb_grepping_flag >= KDB_GREPPING_FLAG_SEARCH) {
 			/*
 			 * This was a interactive search (using '/' at more
-			 * prompt) and it has completed. Clear the flag.
+			 * prompt) and it has completed. Replace the \0 with
+			 * its original value to ensure multi-line strings
+			 * are handled properly, and return to normal mode.
 			 */
+			*cphold = replaced_byte;
 			kdb_grepping_flag = 0;
+		}
 		/*
 		 * at this point the string is a full line and
 		 * should be printed, up to the null.

From 798f1105942abacab009dcb5616c1ec516237063 Mon Sep 17 00:00:00 2001
From: Kajol Jain <kjain@linux.ibm.com>
Date: Sat, 3 Oct 2020 13:19:39 +0530
Subject: [PATCH 0829/2658] powerpc/perf/hv-gpci: Fix starting index value

[ Upstream commit 0f9866f7e85765bbda86666df56c92f377c3bc10 ]

Commit 9e9f60108423f ("powerpc/perf/{hv-gpci, hv-common}: generate
requests with counters annotated") adds a framework for defining
gpci counters.
In this patch, they adds starting_index value as '0xffffffffffffffff'.
which is wrong as starting_index is of size 32 bits.

Because of this, incase we try to run hv-gpci event we get error.

In power9 machine:

command#: perf stat -e hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
          -C 0 -I 1000
event syntax error: '..bie_count_and_time_tlbie_instructions_issued/'
                                  \___ value too big for format, maximum is 4294967295

This patch fix this issue and changes starting_index value to '0xffffffff'

After this patch:

command#: perf stat -e hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/ -C 0 -I 1000
     1.000085786              1,024      hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
     2.000287818              1,024      hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
     2.439113909             17,408      hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/

Fixes: 9e9f60108423 ("powerpc/perf/{hv-gpci, hv-common}: generate requests with counters annotated")
Signed-off-by: Kajol Jain <kjain@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201003074943.338618-1-kjain@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/perf/hv-gpci-requests.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/perf/hv-gpci-requests.h b/arch/powerpc/perf/hv-gpci-requests.h
index acd17648cd18..5ea24d16a74a 100644
--- a/arch/powerpc/perf/hv-gpci-requests.h
+++ b/arch/powerpc/perf/hv-gpci-requests.h
@@ -94,7 +94,7 @@ REQUEST(__field(0,	8,	partition_id)
 
 #define REQUEST_NAME system_performance_capabilities
 #define REQUEST_NUM 0x40
-#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff"
+#define REQUEST_IDX_KIND "starting_index=0xffffffff"
 #include I(REQUEST_BEGIN)
 REQUEST(__field(0,	1,	perf_collect_privileged)
 	__field(0x1,	1,	capability_mask)
@@ -222,7 +222,7 @@ REQUEST(__field(0,	2, partition_id)
 
 #define REQUEST_NAME system_hypervisor_times
 #define REQUEST_NUM 0xF0
-#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff"
+#define REQUEST_IDX_KIND "starting_index=0xffffffff"
 #include I(REQUEST_BEGIN)
 REQUEST(__count(0,	8,	time_spent_to_dispatch_virtual_processors)
 	__count(0x8,	8,	time_spent_processing_virtual_processor_timers)
@@ -233,7 +233,7 @@ REQUEST(__count(0,	8,	time_spent_to_dispatch_virtual_processors)
 
 #define REQUEST_NAME system_tlbie_count_and_time
 #define REQUEST_NUM 0xF4
-#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff"
+#define REQUEST_IDX_KIND "starting_index=0xffffffff"
 #include I(REQUEST_BEGIN)
 REQUEST(__count(0,	8,	tlbie_instructions_issued)
 	/*

From a1f53653c79c0a00c014548679eb8fede5bd07e7 Mon Sep 17 00:00:00 2001
From: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Date: Tue, 22 Sep 2020 13:32:54 +0530
Subject: [PATCH 0830/2658] cpufreq: powernv: Fix frame-size-overflow in
 powernv_cpufreq_reboot_notifier

[ Upstream commit a2d0230b91f7e23ceb5d8fb6a9799f30517ec33a ]

The patch avoids allocating cpufreq_policy on stack hence fixing frame
size overflow in 'powernv_cpufreq_reboot_notifier':

  drivers/cpufreq/powernv-cpufreq.c: In function powernv_cpufreq_reboot_notifier:
  drivers/cpufreq/powernv-cpufreq.c:906:1: error: the frame size of 2064 bytes is larger than 2048 bytes

Fixes: cf30af76 ("cpufreq: powernv: Set the cpus to nominal frequency during reboot/kexec")
Signed-off-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Reviewed-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200922080254.41497-1-srikar@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/powernv-cpufreq.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c
index 57e6c45724e7..1930a1d1a189 100644
--- a/drivers/cpufreq/powernv-cpufreq.c
+++ b/drivers/cpufreq/powernv-cpufreq.c
@@ -410,12 +410,15 @@ static int powernv_cpufreq_reboot_notifier(struct notifier_block *nb,
 				unsigned long action, void *unused)
 {
 	int cpu;
-	struct cpufreq_policy cpu_policy;
+	struct cpufreq_policy *cpu_policy;
 
 	rebooting = true;
 	for_each_online_cpu(cpu) {
-		cpufreq_get_policy(&cpu_policy, cpu);
-		powernv_cpufreq_target_index(&cpu_policy, get_nominal_index());
+		cpu_policy = cpufreq_cpu_get(cpu);
+		if (!cpu_policy)
+			continue;
+		powernv_cpufreq_target_index(cpu_policy, get_nominal_index());
+		cpufreq_cpu_put(cpu_policy);
 	}
 
 	return NOTIFY_DONE;

From 173b936376d419d6a8e52fb07026317041e4da4b Mon Sep 17 00:00:00 2001
From: Tobias Jordan <kernel@cdqe.de>
Date: Thu, 15 Oct 2020 20:11:38 -0700
Subject: [PATCH 0831/2658] lib/crc32.c: fix trivial typo in preprocessor
 condition

[ Upstream commit 904542dc56524f921a6bab0639ff6249c01e775f ]

Whether crc32_be needs a lookup table is chosen based on CRC_LE_BITS.
Obviously, the _be function should be governed by the _BE_ define.

This probably never pops up as it's hard to come up with a configuration
where CRC_BE_BITS isn't the same as CRC_LE_BITS and as nobody is using
bitwise CRC anyway.

Fixes: 46c5801eaf86 ("crc32: bolt on crc32c")
Signed-off-by: Tobias Jordan <kernel@cdqe.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Krzysztof Kozlowski <krzk@kernel.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Link: https://lkml.kernel.org/r/20200923182122.GA3338@agrajag.zerfleddert.de
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/crc32.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/crc32.c b/lib/crc32.c
index 9a907d489d95..eed675bcd675 100644
--- a/lib/crc32.c
+++ b/lib/crc32.c
@@ -327,7 +327,7 @@ static inline u32 __pure crc32_be_generic(u32 crc, unsigned char const *p,
 	return crc;
 }
 
-#if CRC_LE_BITS == 1
+#if CRC_BE_BITS == 1
 u32 __pure crc32_be(u32 crc, unsigned char const *p, size_t len)
 {
 	return crc32_be_generic(crc, p, len, NULL, CRCPOLY_BE);

From 95538131b4b2b8c2f851335a25ce2007ec9c2096 Mon Sep 17 00:00:00 2001
From: Alex Williamson <alex.williamson@redhat.com>
Date: Mon, 19 Oct 2020 07:13:55 -0600
Subject: [PATCH 0832/2658] vfio/pci: Clear token on bypass registration
 failure

[ Upstream commit 852b1beecb6ff9326f7ca4bc0fe69ae860ebdb9e ]

The eventfd context is used as our irqbypass token, therefore if an
eventfd is re-used, our token is the same.  The irqbypass code will
return an -EBUSY in this case, but we'll still attempt to unregister
the producer, where if that duplicate token still exists, results in
removing the wrong object.  Clear the token of failed producers so
that they harmlessly fall out when unregistered.

Fixes: 6d7425f109d2 ("vfio: Register/unregister irq_bypass_producer")
Reported-by: guomin chen <guomin_chen@sina.com>
Tested-by: guomin chen <guomin_chen@sina.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/pci/vfio_pci_intrs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index f7d48661aa94..af4f7ebb45a7 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -364,11 +364,13 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev,
 	vdev->ctx[vector].producer.token = trigger;
 	vdev->ctx[vector].producer.irq = irq;
 	ret = irq_bypass_register_producer(&vdev->ctx[vector].producer);
-	if (unlikely(ret))
+	if (unlikely(ret)) {
 		dev_info(&pdev->dev,
 		"irq bypass producer (token %p) registration fails: %d\n",
 		vdev->ctx[vector].producer.token, ret);
 
+		vdev->ctx[vector].producer.token = NULL;
+	}
 	vdev->ctx[vector].trigger = trigger;
 
 	return 0;

From 7a8908c8d4b6a453acb549bc1d708dab094e7f60 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Mon, 14 Sep 2020 10:17:01 -0700
Subject: [PATCH 0833/2658] Input: imx6ul_tsc - clean up some errors in
 imx6ul_tsc_resume()

[ Upstream commit 30df23c5ecdfb8da5b0bc17ceef67eff9e1b0957 ]

If imx6ul_tsc_init() fails then we need to clean up the clocks.

I reversed the "if (input_dev->users) {" condition to make the code a
bit simpler.

Fixes: 6cc527b05847 ("Input: imx6ul_tsc - propagate the errors")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20200905124942.GC183976@mwanda
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/touchscreen/imx6ul_tsc.c | 27 +++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/drivers/input/touchscreen/imx6ul_tsc.c b/drivers/input/touchscreen/imx6ul_tsc.c
index 8275267eac25..4be7ddc04af0 100644
--- a/drivers/input/touchscreen/imx6ul_tsc.c
+++ b/drivers/input/touchscreen/imx6ul_tsc.c
@@ -490,20 +490,25 @@ static int __maybe_unused imx6ul_tsc_resume(struct device *dev)
 
 	mutex_lock(&input_dev->mutex);
 
-	if (input_dev->users) {
-		retval = clk_prepare_enable(tsc->adc_clk);
-		if (retval)
-			goto out;
-
-		retval = clk_prepare_enable(tsc->tsc_clk);
-		if (retval) {
-			clk_disable_unprepare(tsc->adc_clk);
-			goto out;
-		}
+	if (!input_dev->users)
+		goto out;
 
-		retval = imx6ul_tsc_init(tsc);
+	retval = clk_prepare_enable(tsc->adc_clk);
+	if (retval)
+		goto out;
+
+	retval = clk_prepare_enable(tsc->tsc_clk);
+	if (retval) {
+		clk_disable_unprepare(tsc->adc_clk);
+		goto out;
 	}
 
+	retval = imx6ul_tsc_init(tsc);
+	if (retval) {
+		clk_disable_unprepare(tsc->tsc_clk);
+		clk_disable_unprepare(tsc->adc_clk);
+		goto out;
+	}
 out:
 	mutex_unlock(&input_dev->mutex);
 	return retval;

From e3f87949d7ae1963ef73e81787d22a175c15b494 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Tue, 15 Sep 2020 17:51:05 -0700
Subject: [PATCH 0834/2658] Input: ep93xx_keypad - fix handling of
 platform_get_irq() error

[ Upstream commit 7d50f6656dacf085a00beeedbc48b19a37d17881 ]

platform_get_irq() returns -ERRNO on error.  In such case comparison
to 0 would pass the check.

Fixes: 60214f058f44 ("Input: ep93xx_keypad - update driver to new core support")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20200828145744.3636-1-krzk@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/keyboard/ep93xx_keypad.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/input/keyboard/ep93xx_keypad.c b/drivers/input/keyboard/ep93xx_keypad.c
index f77b295e0123..01788a78041b 100644
--- a/drivers/input/keyboard/ep93xx_keypad.c
+++ b/drivers/input/keyboard/ep93xx_keypad.c
@@ -257,8 +257,8 @@ static int ep93xx_keypad_probe(struct platform_device *pdev)
 	}
 
 	keypad->irq = platform_get_irq(pdev, 0);
-	if (!keypad->irq) {
-		err = -ENXIO;
+	if (keypad->irq < 0) {
+		err = keypad->irq;
 		goto failed_free;
 	}
 

From 5a7da884fad61c5cee07540a91b1114104258061 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Tue, 15 Sep 2020 17:52:15 -0700
Subject: [PATCH 0835/2658] Input: omap4-keypad - fix handling of
 platform_get_irq() error

[ Upstream commit 4738dd1992fa13acfbbd71800c71c612f466fa44 ]

platform_get_irq() returns -ERRNO on error.  In such case comparison
to 0 would pass the check.

Fixes: f3a1ba60dbdb ("Input: omap4-keypad - use platform device helpers")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20200828145744.3636-2-krzk@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/keyboard/omap4-keypad.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
index 3d2c60c8de83..c6a468dfdfb4 100644
--- a/drivers/input/keyboard/omap4-keypad.c
+++ b/drivers/input/keyboard/omap4-keypad.c
@@ -253,10 +253,8 @@ static int omap4_keypad_probe(struct platform_device *pdev)
 	}
 
 	irq = platform_get_irq(pdev, 0);
-	if (!irq) {
-		dev_err(&pdev->dev, "no keyboard irq assigned\n");
-		return -EINVAL;
-	}
+	if (irq < 0)
+		return irq;
 
 	keypad_data = kzalloc(sizeof(struct omap4_keypad), GFP_KERNEL);
 	if (!keypad_data) {

From dc8d7f97b59088fc29a05233f529dd803b04ed36 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Tue, 15 Sep 2020 17:56:40 -0700
Subject: [PATCH 0836/2658] Input: sun4i-ps2 - fix handling of
 platform_get_irq() error

[ Upstream commit cafb3abea6136e59ea534004e5773361e196bb94 ]

platform_get_irq() returns -ERRNO on error.  In such case comparison
to 0 would pass the check.

Fixes: e443631d20f5 ("Input: serio - add support for Alwinner A10/A20 PS/2 controller")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Chen-Yu Tsai <wens@csie.org>
Link: https://lore.kernel.org/r/20200828145744.3636-4-krzk@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/serio/sun4i-ps2.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/input/serio/sun4i-ps2.c b/drivers/input/serio/sun4i-ps2.c
index 04b96fe39339..46512b4d686a 100644
--- a/drivers/input/serio/sun4i-ps2.c
+++ b/drivers/input/serio/sun4i-ps2.c
@@ -210,7 +210,6 @@ static int sun4i_ps2_probe(struct platform_device *pdev)
 	struct sun4i_ps2data *drvdata;
 	struct serio *serio;
 	struct device *dev = &pdev->dev;
-	unsigned int irq;
 	int error;
 
 	drvdata = kzalloc(sizeof(struct sun4i_ps2data), GFP_KERNEL);
@@ -263,14 +262,12 @@ static int sun4i_ps2_probe(struct platform_device *pdev)
 	writel(0, drvdata->reg_base + PS2_REG_GCTL);
 
 	/* Get IRQ for the device */
-	irq = platform_get_irq(pdev, 0);
-	if (!irq) {
-		dev_err(dev, "no IRQ found\n");
-		error = -ENXIO;
+	drvdata->irq = platform_get_irq(pdev, 0);
+	if (drvdata->irq < 0) {
+		error = drvdata->irq;
 		goto err_disable_clk;
 	}
 
-	drvdata->irq = irq;
 	drvdata->serio = serio;
 	drvdata->dev = dev;
 

From 66a2f99b7043f56d45cea20d6ebb1af38871625c Mon Sep 17 00:00:00 2001
From: Robert Hoo <robert.hu@linux.intel.com>
Date: Fri, 28 Aug 2020 10:23:42 +0800
Subject: [PATCH 0837/2658] KVM: x86: emulating RDPID failure shall return #UD
 rather than #GP

[ Upstream commit a9e2e0ae686094571378c72d8146b5a1a92d0652 ]

Per Intel's SDM, RDPID takes a #UD if it is unsupported, which is more or
less what KVM is emulating when MSR_TSC_AUX is not available.  In fact,
there are no scenarios in which RDPID is supposed to #GP.

Fixes: fb6d4d340e ("KVM: x86: emulate RDPID")
Signed-off-by: Robert Hoo <robert.hu@linux.intel.com>
Message-Id: <1598581422-76264-1-git-send-email-robert.hu@linux.intel.com>
Reviewed-by: Jim Mattson <jmattson@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kvm/emulate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index d266e5af2a02..5dff8482626e 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -3523,7 +3523,7 @@ static int em_rdpid(struct x86_emulate_ctxt *ctxt)
 	u64 tsc_aux = 0;
 
 	if (ctxt->ops->get_msr(ctxt, MSR_TSC_AUX, &tsc_aux))
-		return emulate_gp(ctxt, 0);
+		return emulate_ud(ctxt);
 	ctxt->dst.val = tsc_aux;
 	return X86EMUL_CONTINUE;
 }

From d560d0aade2085890033ebee47ed8c7d9f6280c9 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 25 Aug 2020 13:47:07 +0300
Subject: [PATCH 0838/2658] memory: omap-gpmc: Fix a couple off by ones

[ Upstream commit 4c54228ac8fd55044195825873c50a524131fa53 ]

These comparisons should be >= instead of > to prevent reading one
element beyond the end of the gpmc_cs[] array.

Fixes: cdd6928c589a ("ARM: OMAP2+: Add device-tree support for NOR flash")
Fixes: f37e4580c409 ("ARM: OMAP2: Dynamic allocator for GPMC memory space")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Roger Quadros <rogerq@ti.com>
Link: https://lore.kernel.org/r/20200825104707.GB278587@mwanda
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/omap-gpmc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index 49691a8c74ee..af187c91fc33 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -928,7 +928,7 @@ static int gpmc_cs_remap(int cs, u32 base)
 	int ret;
 	u32 old_base, size;
 
-	if (cs > gpmc_cs_num) {
+	if (cs >= gpmc_cs_num) {
 		pr_err("%s: requested chip-select is disabled\n", __func__);
 		return -ENODEV;
 	}
@@ -963,7 +963,7 @@ int gpmc_cs_request(int cs, unsigned long size, unsigned long *base)
 	struct resource *res = &gpmc->mem;
 	int r = -1;
 
-	if (cs > gpmc_cs_num) {
+	if (cs >= gpmc_cs_num) {
 		pr_err("%s: requested chip-select is disabled\n", __func__);
 		return -ENODEV;
 	}

From 7b1aafd8f0960f2bd9a3df59f4889e7c5d44e1e9 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Thu, 27 Aug 2020 09:33:15 +0200
Subject: [PATCH 0839/2658] memory: fsl-corenet-cf: Fix handling of
 platform_get_irq() error

[ Upstream commit dd85345abca60a8916617e8d75c0f9ce334336dd ]

platform_get_irq() returns -ERRNO on error.  In such case comparison
to 0 would pass the check.

Fixes: 54afbec0d57f ("memory: Freescale CoreNet Coherency Fabric error reporting driver")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20200827073315.29351-1-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/fsl-corenet-cf.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/memory/fsl-corenet-cf.c b/drivers/memory/fsl-corenet-cf.c
index 662d050243be..2fbf8d09af36 100644
--- a/drivers/memory/fsl-corenet-cf.c
+++ b/drivers/memory/fsl-corenet-cf.c
@@ -215,10 +215,8 @@ static int ccf_probe(struct platform_device *pdev)
 	dev_set_drvdata(&pdev->dev, ccf);
 
 	irq = platform_get_irq(pdev, 0);
-	if (!irq) {
-		dev_err(&pdev->dev, "%s: no irq\n", __func__);
-		return -ENXIO;
-	}
+	if (irq < 0)
+		return irq;
 
 	ret = devm_request_irq(&pdev->dev, irq, ccf_irq, 0, pdev->name, ccf);
 	if (ret) {

From d4d6c1f1e2e2603a671e8d8af2b192f862423946 Mon Sep 17 00:00:00 2001
From: Michal Simek <michal.simek@xilinx.com>
Date: Mon, 24 Aug 2020 10:59:14 +0200
Subject: [PATCH 0840/2658] arm64: dts: zynqmp: Remove additional compatible
 string for i2c IPs

[ Upstream commit 35292518cb0a626fcdcabf739aed75060a018ab5 ]

DT binding permits only one compatible string which was decribed in past by
commit 63cab195bf49 ("i2c: removed work arounds in i2c driver for Zynq
Ultrascale+ MPSoC").
The commit aea37006e183 ("dt-bindings: i2c: cadence: Migrate i2c-cadence
documentation to YAML") has converted binding to yaml and the following
issues is reported:
...: i2c@ff030000: compatible: Additional items are not allowed
('cdns,i2c-r1p10' was unexpected)
	From schema:
.../Documentation/devicetree/bindings/i2c/cdns,i2c-r1p10.yaml fds
...: i2c@ff030000: compatible: ['cdns,i2c-r1p14', 'cdns,i2c-r1p10'] is too
long

The commit c415f9e8304a ("ARM64: zynqmp: Fix i2c node's compatible string")
has added the second compatible string but without removing origin one.
The patch is only keeping one compatible string "cdns,i2c-r1p14".

Fixes: c415f9e8304a ("ARM64: zynqmp: Fix i2c node's compatible string")
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Link: https://lore.kernel.org/r/cc294ae1a79ef845af6809ddb4049f0c0f5bb87a.1598259551.git.michal.simek@xilinx.com
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
index 172402cc1a0f..ae2cbbdb634e 100644
--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
@@ -191,7 +191,7 @@
 		};
 
 		i2c0: i2c@ff020000 {
-			compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10";
+			compatible = "cdns,i2c-r1p14";
 			status = "disabled";
 			interrupt-parent = <&gic>;
 			interrupts = <0 17 4>;
@@ -202,7 +202,7 @@
 		};
 
 		i2c1: i2c@ff030000 {
-			compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10";
+			compatible = "cdns,i2c-r1p14";
 			status = "disabled";
 			interrupt-parent = <&gic>;
 			interrupts = <0 18 4>;

From 35935bc3b4466038ac404286e1d6f068f4e226fc Mon Sep 17 00:00:00 2001
From: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
Date: Sat, 17 Oct 2020 22:12:10 +0530
Subject: [PATCH 0841/2658] powerpc/powernv/dump: Fix race while processing
 OPAL dump

[ Upstream commit 0a43ae3e2beb77e3481d812834d33abe270768ab ]

Every dump reported by OPAL is exported to userspace through a sysfs
interface and notified using kobject_uevent(). The userspace daemon
(opal_errd) then reads the dump and acknowledges that the dump is
saved safely to disk. Once acknowledged the kernel removes the
respective sysfs file entry causing respective resources to be
released including kobject.

However it's possible the userspace daemon may already be scanning
dump entries when a new sysfs dump entry is created by the kernel.
User daemon may read this new entry and ack it even before kernel can
notify userspace about it through kobject_uevent() call. If that
happens then we have a potential race between
dump_ack_store->kobject_put() and kobject_uevent which can lead to
use-after-free of a kernfs object resulting in a kernel crash.

This patch fixes this race by protecting the sysfs file
creation/notification by holding a reference count on kobject until we
safely send kobject_uevent().

The function create_dump_obj() returns the dump object which if used
by caller function will end up in use-after-free problem again.
However, the return value of create_dump_obj() function isn't being
used today and there is no need as well. Hence change it to return
void to make this fix complete.

Fixes: c7e64b9ce04a ("powerpc/powernv Platform dump interface")
Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201017164210.264619-1-hegdevasant@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/powernv/opal-dump.c | 41 +++++++++++++++-------
 1 file changed, 29 insertions(+), 12 deletions(-)

diff --git a/arch/powerpc/platforms/powernv/opal-dump.c b/arch/powerpc/platforms/powernv/opal-dump.c
index 4c827826c05e..e21e2c0af69d 100644
--- a/arch/powerpc/platforms/powernv/opal-dump.c
+++ b/arch/powerpc/platforms/powernv/opal-dump.c
@@ -319,15 +319,14 @@ static ssize_t dump_attr_read(struct file *filep, struct kobject *kobj,
 	return count;
 }
 
-static struct dump_obj *create_dump_obj(uint32_t id, size_t size,
-					uint32_t type)
+static void create_dump_obj(uint32_t id, size_t size, uint32_t type)
 {
 	struct dump_obj *dump;
 	int rc;
 
 	dump = kzalloc(sizeof(*dump), GFP_KERNEL);
 	if (!dump)
-		return NULL;
+		return;
 
 	dump->kobj.kset = dump_kset;
 
@@ -347,21 +346,39 @@ static struct dump_obj *create_dump_obj(uint32_t id, size_t size,
 	rc = kobject_add(&dump->kobj, NULL, "0x%x-0x%x", type, id);
 	if (rc) {
 		kobject_put(&dump->kobj);
-		return NULL;
+		return;
 	}
 
+	/*
+	 * As soon as the sysfs file for this dump is created/activated there is
+	 * a chance the opal_errd daemon (or any userspace) might read and
+	 * acknowledge the dump before kobject_uevent() is called. If that
+	 * happens then there is a potential race between
+	 * dump_ack_store->kobject_put() and kobject_uevent() which leads to a
+	 * use-after-free of a kernfs object resulting in a kernel crash.
+	 *
+	 * To avoid that, we need to take a reference on behalf of the bin file,
+	 * so that our reference remains valid while we call kobject_uevent().
+	 * We then drop our reference before exiting the function, leaving the
+	 * bin file to drop the last reference (if it hasn't already).
+	 */
+
+	/* Take a reference for the bin file */
+	kobject_get(&dump->kobj);
 	rc = sysfs_create_bin_file(&dump->kobj, &dump->dump_attr);
-	if (rc) {
+	if (rc == 0) {
+		kobject_uevent(&dump->kobj, KOBJ_ADD);
+
+		pr_info("%s: New platform dump. ID = 0x%x Size %u\n",
+			__func__, dump->id, dump->size);
+	} else {
+		/* Drop reference count taken for bin file */
 		kobject_put(&dump->kobj);
-		return NULL;
 	}
 
-	pr_info("%s: New platform dump. ID = 0x%x Size %u\n",
-		__func__, dump->id, dump->size);
-
-	kobject_uevent(&dump->kobj, KOBJ_ADD);
-
-	return dump;
+	/* Drop our reference */
+	kobject_put(&dump->kobj);
+	return;
 }
 
 static irqreturn_t process_dump(int irq, void *data)

From 09118d10075abc20a7e5e36e3ed7ddcc3af9c76f Mon Sep 17 00:00:00 2001
From: Pavel Machek <pavel@ucw.cz>
Date: Sun, 20 Sep 2020 11:01:37 +0200
Subject: [PATCH 0842/2658] media: firewire: fix memory leak

[ Upstream commit b28e32798c78a346788d412f1958f36bb760ec03 ]

Fix memory leak in node_probe.

Signed-off-by: Pavel Machek (CIP) <pavel@denx.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/firewire/firedtv-fw.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/media/firewire/firedtv-fw.c b/drivers/media/firewire/firedtv-fw.c
index 5d634706a7ea..382f290c3f4d 100644
--- a/drivers/media/firewire/firedtv-fw.c
+++ b/drivers/media/firewire/firedtv-fw.c
@@ -271,8 +271,10 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id)
 
 	name_len = fw_csr_string(unit->directory, CSR_MODEL,
 				 name, sizeof(name));
-	if (name_len < 0)
-		return name_len;
+	if (name_len < 0) {
+		err = name_len;
+		goto fail_free;
+	}
 	for (i = ARRAY_SIZE(model_names); --i; )
 		if (strlen(model_names[i]) <= name_len &&
 		    strncmp(name, model_names[i], name_len) == 0)

From 333191afa8a4b71f5e65be23f27069467f71ef43 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Wed, 16 Sep 2020 15:50:51 +0200
Subject: [PATCH 0843/2658] media: ati_remote: sanity check for both endpoints

[ Upstream commit a8be80053ea74bd9c3f9a3810e93b802236d6498 ]

If you do sanity checks, you should do them for both endpoints.
Hence introduce checking for endpoint type for the output
endpoint, too.

Reported-by: syzbot+998261c2ae5932458f6c@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/ati_remote.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/media/rc/ati_remote.c b/drivers/media/rc/ati_remote.c
index a35631891cc0..3c3f4c4f6be4 100644
--- a/drivers/media/rc/ati_remote.c
+++ b/drivers/media/rc/ati_remote.c
@@ -843,6 +843,10 @@ static int ati_remote_probe(struct usb_interface *interface,
 		err("%s: endpoint_in message size==0? \n", __func__);
 		return -ENODEV;
 	}
+	if (!usb_endpoint_is_int_out(endpoint_out)) {
+		err("%s: Unexpected endpoint_out\n", __func__);
+		return -ENODEV;
+	}
 
 	ati_remote = kzalloc(sizeof (struct ati_remote), GFP_KERNEL);
 	rc_dev = rc_allocate_device();

From c707006f9c40b5ddd8eff68ea325a3d285c925fb Mon Sep 17 00:00:00 2001
From: Qiushi Wu <wu000273@umn.edu>
Date: Sun, 14 Jun 2020 05:18:29 +0200
Subject: [PATCH 0844/2658] media: exynos4-is: Fix several reference count
 leaks due to pm_runtime_get_sync

[ Upstream commit 7ef64ceea0008c17e94a8a2c60c5d6d46f481996 ]

On calling pm_runtime_get_sync() the reference count of the device
is incremented. In case of failure, decrement the
reference count before returning the error.

Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/exynos4-is/fimc-isp.c  | 4 +++-
 drivers/media/platform/exynos4-is/fimc-lite.c | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/exynos4-is/fimc-isp.c b/drivers/media/platform/exynos4-is/fimc-isp.c
index 5d78f5716f3b..ad280c5258b3 100644
--- a/drivers/media/platform/exynos4-is/fimc-isp.c
+++ b/drivers/media/platform/exynos4-is/fimc-isp.c
@@ -311,8 +311,10 @@ static int fimc_isp_subdev_s_power(struct v4l2_subdev *sd, int on)
 
 	if (on) {
 		ret = pm_runtime_get_sync(&is->pdev->dev);
-		if (ret < 0)
+		if (ret < 0) {
+			pm_runtime_put(&is->pdev->dev);
 			return ret;
+		}
 		set_bit(IS_ST_PWR_ON, &is->state);
 
 		ret = fimc_is_start_firmware(is);
diff --git a/drivers/media/platform/exynos4-is/fimc-lite.c b/drivers/media/platform/exynos4-is/fimc-lite.c
index 60660c3a5de0..65b33470a1b1 100644
--- a/drivers/media/platform/exynos4-is/fimc-lite.c
+++ b/drivers/media/platform/exynos4-is/fimc-lite.c
@@ -487,7 +487,7 @@ static int fimc_lite_open(struct file *file)
 	set_bit(ST_FLITE_IN_USE, &fimc->state);
 	ret = pm_runtime_get_sync(&fimc->pdev->dev);
 	if (ret < 0)
-		goto unlock;
+		goto err_pm;
 
 	ret = v4l2_fh_open(file);
 	if (ret < 0)

From 76229f82f25cb268e3a10b4af9b403c8b53a80a7 Mon Sep 17 00:00:00 2001
From: Qiushi Wu <wu000273@umn.edu>
Date: Sun, 14 Jun 2020 05:10:58 +0200
Subject: [PATCH 0845/2658] media: exynos4-is: Fix a reference count leak due
 to pm_runtime_get_sync

[ Upstream commit c47f7c779ef0458a58583f00c9ed71b7f5a4d0a2 ]

On calling pm_runtime_get_sync() the reference count of the device
is incremented. In case of failure, decrement the
reference count before returning the error.

Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/exynos4-is/media-dev.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
index 6bc3c8a2e144..76fadd3e3ada 100644
--- a/drivers/media/platform/exynos4-is/media-dev.c
+++ b/drivers/media/platform/exynos4-is/media-dev.c
@@ -413,8 +413,10 @@ static int fimc_md_register_sensor_entities(struct fimc_md *fmd)
 		return -ENXIO;
 
 	ret = pm_runtime_get_sync(fmd->pmf);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put(fmd->pmf);
 		return ret;
+	}
 
 	fmd->num_sensors = 0;
 

From 8d7f14571e41f1222b37697d428b9081cb691da1 Mon Sep 17 00:00:00 2001
From: Qiushi Wu <wu000273@umn.edu>
Date: Sun, 14 Jun 2020 05:01:11 +0200
Subject: [PATCH 0846/2658] media: exynos4-is: Fix a reference count leak

[ Upstream commit 64157b2cb1940449e7df2670e85781c690266588 ]

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
pm_runtime_put_noidle() is not called in error handling paths.
Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.

Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/exynos4-is/mipi-csis.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/exynos4-is/mipi-csis.c b/drivers/media/platform/exynos4-is/mipi-csis.c
index 4b85105dc159..4f7a0f59f36c 100644
--- a/drivers/media/platform/exynos4-is/mipi-csis.c
+++ b/drivers/media/platform/exynos4-is/mipi-csis.c
@@ -513,8 +513,10 @@ static int s5pcsis_s_stream(struct v4l2_subdev *sd, int enable)
 	if (enable) {
 		s5pcsis_clear_counters(state);
 		ret = pm_runtime_get_sync(&state->pdev->dev);
-		if (ret && ret != 1)
+		if (ret && ret != 1) {
+			pm_runtime_put_noidle(&state->pdev->dev);
 			return ret;
+		}
 	}
 
 	mutex_lock(&state->lock);

From ba01171f7d6f27a6de5b1239afc0ded719ba1d7e Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Thu, 21 May 2020 12:00:21 +0200
Subject: [PATCH 0847/2658] media: bdisp: Fix runtime PM imbalance on error

[ Upstream commit dbd2f2dc025f9be8ae063e4f270099677238f620 ]

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code. Thus a pairing decrement is needed on
the error handling path to keep the counter balanced.

Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Reviewed-by: Fabien Dessenne <fabien.dessenne@st.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/sti/bdisp/bdisp-v4l2.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
index a00dfaa1b945..6c97063cb3b3 100644
--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
+++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
@@ -1369,7 +1369,7 @@ static int bdisp_probe(struct platform_device *pdev)
 	ret = pm_runtime_get_sync(dev);
 	if (ret < 0) {
 		dev_err(dev, "failed to set PM\n");
-		goto err_dbg;
+		goto err_pm;
 	}
 
 	/* Continuous memory allocator */
@@ -1406,7 +1406,6 @@ static int bdisp_probe(struct platform_device *pdev)
 	vb2_dma_contig_cleanup_ctx(bdisp->alloc_ctx);
 err_pm:
 	pm_runtime_put(dev);
-err_dbg:
 	bdisp_debugfs_remove(bdisp);
 err_v4l2:
 	v4l2_device_unregister(&bdisp->v4l2_dev);

From 2b270f6a62da988a17452b650487144ee9a77fb9 Mon Sep 17 00:00:00 2001
From: Xiaolong Huang <butterflyhuangxx@gmail.com>
Date: Fri, 17 Apr 2020 11:52:30 +0200
Subject: [PATCH 0848/2658] media: media/pci: prevent memory leak in bttv_probe

[ Upstream commit 7b817585b730665126b45df5508dd69526448bc8 ]

In bttv_probe if some functions such as pci_enable_device,
pci_set_dma_mask and request_mem_region fails the allocated
 memory for btv should be released.

Signed-off-by: Xiaolong Huang <butterflyhuangxx@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/bt8xx/bttv-driver.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
index 51dbef2f9a48..10c9c078af01 100644
--- a/drivers/media/pci/bt8xx/bttv-driver.c
+++ b/drivers/media/pci/bt8xx/bttv-driver.c
@@ -4053,11 +4053,13 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id)
 	btv->id  = dev->device;
 	if (pci_enable_device(dev)) {
 		pr_warn("%d: Can't enable device\n", btv->c.nr);
-		return -EIO;
+		result = -EIO;
+		goto free_mem;
 	}
 	if (pci_set_dma_mask(dev, DMA_BIT_MASK(32))) {
 		pr_warn("%d: No suitable DMA available\n", btv->c.nr);
-		return -EIO;
+		result = -EIO;
+		goto free_mem;
 	}
 	if (!request_mem_region(pci_resource_start(dev,0),
 				pci_resource_len(dev,0),
@@ -4065,7 +4067,8 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id)
 		pr_warn("%d: can't request iomem (0x%llx)\n",
 			btv->c.nr,
 			(unsigned long long)pci_resource_start(dev, 0));
-		return -EBUSY;
+		result = -EBUSY;
+		goto free_mem;
 	}
 	pci_set_master(dev);
 	pci_set_command(dev);
@@ -4251,6 +4254,10 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id)
 	release_mem_region(pci_resource_start(btv->c.pci,0),
 			   pci_resource_len(btv->c.pci,0));
 	pci_disable_device(btv->c.pci);
+
+free_mem:
+	bttvs[btv->c.nr] = NULL;
+	kfree(btv);
 	return result;
 }
 

From b21beae87bd63b40a6643f7ea5fdc5cecbf371d9 Mon Sep 17 00:00:00 2001
From: Adam Goode <agoode@google.com>
Date: Sun, 23 Aug 2020 03:21:33 +0200
Subject: [PATCH 0849/2658] media: uvcvideo: Ensure all probed info is returned
 to v4l2

[ Upstream commit 8a652a17e3c005dcdae31b6c8fdf14382a29cbbe ]

bFrameIndex and bFormatIndex can be negotiated by the camera during
probing, resulting in the camera choosing a different format than
expected. v4l2 can already accommodate such changes, but the code was
not updating the proper fields.

Without such a change, v4l2 would potentially interpret the payload
incorrectly, causing corrupted output. This was happening on the
Elgato HD60 S+, which currently always renegotiates to format 1.

As an aside, the Elgato firmware is buggy and should not be renegotating,
but it is still a valid thing for the camera to do. Both macOS and Windows
will properly probe and read uncorrupted images from this camera.

With this change, both qv4l2 and chromium can now read uncorrupted video
from the Elgato HD60 S+.

[Add blank lines, remove periods at the of messages]

Signed-off-by: Adam Goode <agoode@google.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/uvc/uvc_v4l2.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index 0e7d16fe84d4..a0a544628053 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -242,11 +242,41 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
 	if (ret < 0)
 		goto done;
 
+	/* After the probe, update fmt with the values returned from
+	 * negotiation with the device.
+	 */
+	for (i = 0; i < stream->nformats; ++i) {
+		if (probe->bFormatIndex == stream->format[i].index) {
+			format = &stream->format[i];
+			break;
+		}
+	}
+
+	if (i == stream->nformats) {
+		uvc_trace(UVC_TRACE_FORMAT, "Unknown bFormatIndex %u\n",
+			  probe->bFormatIndex);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < format->nframes; ++i) {
+		if (probe->bFrameIndex == format->frame[i].bFrameIndex) {
+			frame = &format->frame[i];
+			break;
+		}
+	}
+
+	if (i == format->nframes) {
+		uvc_trace(UVC_TRACE_FORMAT, "Unknown bFrameIndex %u\n",
+			  probe->bFrameIndex);
+		return -EINVAL;
+	}
+
 	fmt->fmt.pix.width = frame->wWidth;
 	fmt->fmt.pix.height = frame->wHeight;
 	fmt->fmt.pix.field = V4L2_FIELD_NONE;
 	fmt->fmt.pix.bytesperline = format->bpp * frame->wWidth / 8;
 	fmt->fmt.pix.sizeimage = probe->dwMaxVideoFrameSize;
+	fmt->fmt.pix.pixelformat = format->fcc;
 	fmt->fmt.pix.colorspace = format->colorspace;
 	fmt->fmt.pix.priv = 0;
 

From d9a56bb9c5ad8087f39d952c6c9d72423cb93343 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Mon, 27 Jul 2020 15:38:34 +0200
Subject: [PATCH 0850/2658] mmc: sdio: Check for CISTPL_VERS_1 buffer size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 8ebe2607965d3e2dc02029e8c7dd35fbe508ffd0 ]

Before parsing CISTPL_VERS_1 structure check that its size is at least two
bytes to prevent buffer overflow.

Signed-off-by: Pali Rohár <pali@kernel.org>
Link: https://lore.kernel.org/r/20200727133837.19086-2-pali@kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/core/sdio_cis.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/mmc/core/sdio_cis.c b/drivers/mmc/core/sdio_cis.c
index 1ab4560003ef..cf3978b6247b 100644
--- a/drivers/mmc/core/sdio_cis.c
+++ b/drivers/mmc/core/sdio_cis.c
@@ -30,6 +30,9 @@ static int cistpl_vers_1(struct mmc_card *card, struct sdio_func *func,
 	unsigned i, nr_strings;
 	char **buffer, *string;
 
+	if (size < 2)
+		return 0;
+
 	/* Find all null-terminated (including zero length) strings in
 	   the TPLLV1_INFO field. Trailing garbage is ignored. */
 	buf += 2;

From f295eb5ffcf3de883b1b008615b9dcbe9f6420c3 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Wed, 2 Sep 2020 08:37:12 +0200
Subject: [PATCH 0851/2658] media: saa7134: avoid a shift overflow

[ Upstream commit 15a36aae1ec1c1f17149b6113b92631791830740 ]

As reported by smatch:
	drivers/media/pci/saa7134//saa7134-tvaudio.c:686 saa_dsp_writel() warn: should 'reg << 2' be a 64 bit type?

On a 64-bits Kernel, the shift might be bigger than 32 bits.

In real, this should never happen, but let's shut up the warning.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/saa7134/saa7134-tvaudio.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/pci/saa7134/saa7134-tvaudio.c b/drivers/media/pci/saa7134/saa7134-tvaudio.c
index 21a579309575..02407983ce23 100644
--- a/drivers/media/pci/saa7134/saa7134-tvaudio.c
+++ b/drivers/media/pci/saa7134/saa7134-tvaudio.c
@@ -696,7 +696,8 @@ int saa_dsp_writel(struct saa7134_dev *dev, int reg, u32 value)
 {
 	int err;
 
-	audio_dbg(2, "dsp write reg 0x%x = 0x%06x\n", reg << 2, value);
+	audio_dbg(2, "dsp write reg 0x%x = 0x%06x\n",
+		  (reg << 2) & 0xffffffff, value);
 	err = saa_dsp_wait_bit(dev,SAA7135_DSP_RWSTATE_WRR);
 	if (err < 0)
 		return err;

From 53a367f1ee531fc8048c195182dec1e289a57389 Mon Sep 17 00:00:00 2001
From: Rustam Kovhaev <rkovhaev@gmail.com>
Date: Tue, 13 Oct 2020 16:48:17 -0700
Subject: [PATCH 0852/2658] ntfs: add check for mft record size in superblock

[ Upstream commit 4f8c94022f0bc3babd0a124c0a7dcdd7547bd94e ]

Number of bytes allocated for mft record should be equal to the mft record
size stored in ntfs superblock as reported by syzbot, userspace might
trigger out-of-bounds read by dereferencing ctx->attr in ntfs_attr_find()

Reported-by: syzbot+aed06913f36eff9b544e@syzkaller.appspotmail.com
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: syzbot+aed06913f36eff9b544e@syzkaller.appspotmail.com
Acked-by: Anton Altaparmakov <anton@tuxera.com>
Link: https://syzkaller.appspot.com/bug?extid=aed06913f36eff9b544e
Link: https://lkml.kernel.org/r/20200824022804.226242-1-rkovhaev@gmail.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ntfs/inode.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index d284f07eda77..38260c07de8b 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -1844,6 +1844,12 @@ int ntfs_read_inode_mount(struct inode *vi)
 		brelse(bh);
 	}
 
+	if (le32_to_cpu(m->bytes_allocated) != vol->mft_record_size) {
+		ntfs_error(sb, "Incorrect mft record size %u in superblock, should be %u.",
+				le32_to_cpu(m->bytes_allocated), vol->mft_record_size);
+		goto err_out;
+	}
+
 	/* Apply the mst fixups. */
 	if (post_read_mst_fixup((NTFS_RECORD*)m, vol->mft_record_size)) {
 		/* FIXME: Try to use the $MFTMirr now. */

From 83dd4768bf5280e19639c8e89f26fd260c272a21 Mon Sep 17 00:00:00 2001
From: Christoph Hellwig <hch@lst.de>
Date: Fri, 25 Sep 2020 18:14:47 +0200
Subject: [PATCH 0853/2658] PM: hibernate: remove the bogus call to
 get_gendisk() in software_resume()

[ Upstream commit 428805c0c5e76ef643b1fbc893edfb636b3d8aef ]

get_gendisk grabs a reference on the disk and file operation, so this
code will leak both of them while having absolutely no use for the
gendisk itself.

This effectively reverts commit 2df83fa4bce421f ("PM / Hibernate: Use
get_gendisk to verify partition if resume_file is integer format")

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/power/hibernate.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index 1535c46808f1..b792190f2a9c 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -781,17 +781,6 @@ static int software_resume(void)
 
 	/* Check if the device is there */
 	swsusp_resume_device = name_to_dev_t(resume_file);
-
-	/*
-	 * name_to_dev_t is ineffective to verify parition if resume_file is in
-	 * integer format. (e.g. major:minor)
-	 */
-	if (isdigit(resume_file[0]) && resume_wait) {
-		int partno;
-		while (!get_gendisk(swsusp_resume_device, &partno))
-			msleep(10);
-	}
-
 	if (!swsusp_resume_device) {
 		/*
 		 * Some device discovery might still be in progress; we need

From 2b00bc6ac30bbc5809b78124d60c798308fba79b Mon Sep 17 00:00:00 2001
From: Jing Xiangfeng <jingxiangfeng@huawei.com>
Date: Thu, 10 Sep 2020 20:38:48 +0800
Subject: [PATCH 0854/2658] scsi: mvumi: Fix error return in mvumi_io_attach()

[ Upstream commit 055f15ab2cb4a5cbc4c0a775ef3d0066e0fa9b34 ]

Return PTR_ERR() from the error handling case instead of 0.

Link: https://lore.kernel.org/r/20200910123848.93649-1-jingxiangfeng@huawei.com
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/mvumi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c
index 39285070f3b5..17ec51f9d988 100644
--- a/drivers/scsi/mvumi.c
+++ b/drivers/scsi/mvumi.c
@@ -2476,6 +2476,7 @@ static int mvumi_io_attach(struct mvumi_hba *mhba)
 	if (IS_ERR(mhba->dm_thread)) {
 		dev_err(&mhba->pdev->dev,
 			"failed to create device scan thread\n");
+		ret = PTR_ERR(mhba->dm_thread);
 		mutex_unlock(&mhba->sas_discovery_mutex);
 		goto fail_create_thread;
 	}

From ceea7eec3f3301169eafcfa6d070bc00cd3cd296 Mon Sep 17 00:00:00 2001
From: Roman Bolshakov <r.bolshakov@yadro.com>
Date: Tue, 29 Sep 2020 15:59:57 +0300
Subject: [PATCH 0855/2658] scsi: target: core: Add CONTROL field for trace
 events

[ Upstream commit 7010645ba7256992818b518163f46bd4cdf8002a ]

trace-cmd report doesn't show events from target subsystem because
scsi_command_size() leaks through event format string:

  [target:target_sequencer_start] function scsi_command_size not defined
  [target:target_cmd_complete] function scsi_command_size not defined

Addition of scsi_command_size() to plugin_scsi.c in trace-cmd doesn't
help because an expression is used inside TP_printk(). trace-cmd event
parser doesn't understand minus sign inside [ ]:

  Error: expected ']' but read '-'

Rather than duplicating kernel code in plugin_scsi.c, provide a dedicated
field for CONTROL byte.

Link: https://lore.kernel.org/r/20200929125957.83069-1-r.bolshakov@yadro.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/scsi/scsi_common.h    |  7 +++++++
 include/trace/events/target.h | 12 ++++++------
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/include/scsi/scsi_common.h b/include/scsi/scsi_common.h
index 11571b2a831e..92ba09200f89 100644
--- a/include/scsi/scsi_common.h
+++ b/include/scsi/scsi_common.h
@@ -24,6 +24,13 @@ scsi_command_size(const unsigned char *cmnd)
 		scsi_varlen_cdb_length(cmnd) : COMMAND_SIZE(cmnd[0]);
 }
 
+static inline unsigned char
+scsi_command_control(const unsigned char *cmnd)
+{
+	return (cmnd[0] == VARIABLE_LENGTH_CMD) ?
+		cmnd[1] : cmnd[COMMAND_SIZE(cmnd[0]) - 1];
+}
+
 /* Returns a human-readable name for the device */
 extern const char *scsi_device_type(unsigned type);
 
diff --git a/include/trace/events/target.h b/include/trace/events/target.h
index 50fea660c0f8..d543e8b87e50 100644
--- a/include/trace/events/target.h
+++ b/include/trace/events/target.h
@@ -139,6 +139,7 @@ TRACE_EVENT(target_sequencer_start,
 		__field( unsigned int,	opcode		)
 		__field( unsigned int,	data_length	)
 		__field( unsigned int,	task_attribute  )
+		__field( unsigned char,	control		)
 		__array( unsigned char,	cdb, TCM_MAX_COMMAND_SIZE	)
 		__string( initiator,	cmd->se_sess->se_node_acl->initiatorname	)
 	),
@@ -148,6 +149,7 @@ TRACE_EVENT(target_sequencer_start,
 		__entry->opcode		= cmd->t_task_cdb[0];
 		__entry->data_length	= cmd->data_length;
 		__entry->task_attribute	= cmd->sam_task_attr;
+		__entry->control	= scsi_command_control(cmd->t_task_cdb);
 		memcpy(__entry->cdb, cmd->t_task_cdb, TCM_MAX_COMMAND_SIZE);
 		__assign_str(initiator, cmd->se_sess->se_node_acl->initiatorname);
 	),
@@ -157,9 +159,7 @@ TRACE_EVENT(target_sequencer_start,
 		  show_opcode_name(__entry->opcode),
 		  __entry->data_length, __print_hex(__entry->cdb, 16),
 		  show_task_attribute_name(__entry->task_attribute),
-		  scsi_command_size(__entry->cdb) <= 16 ?
-			__entry->cdb[scsi_command_size(__entry->cdb) - 1] :
-			__entry->cdb[1]
+		  __entry->control
 	)
 );
 
@@ -174,6 +174,7 @@ TRACE_EVENT(target_cmd_complete,
 		__field( unsigned int,	opcode		)
 		__field( unsigned int,	data_length	)
 		__field( unsigned int,	task_attribute  )
+		__field( unsigned char,	control		)
 		__field( unsigned char,	scsi_status	)
 		__field( unsigned char,	sense_length	)
 		__array( unsigned char,	cdb, TCM_MAX_COMMAND_SIZE	)
@@ -186,6 +187,7 @@ TRACE_EVENT(target_cmd_complete,
 		__entry->opcode		= cmd->t_task_cdb[0];
 		__entry->data_length	= cmd->data_length;
 		__entry->task_attribute	= cmd->sam_task_attr;
+		__entry->control	= scsi_command_control(cmd->t_task_cdb);
 		__entry->scsi_status	= cmd->scsi_status;
 		__entry->sense_length	= cmd->scsi_status == SAM_STAT_CHECK_CONDITION ?
 			min(18, ((u8 *) cmd->sense_buffer)[SPC_ADD_SENSE_LEN_OFFSET] + 8) : 0;
@@ -202,9 +204,7 @@ TRACE_EVENT(target_cmd_complete,
 		  show_opcode_name(__entry->opcode),
 		  __entry->data_length, __print_hex(__entry->cdb, 16),
 		  show_task_attribute_name(__entry->task_attribute),
-		  scsi_command_size(__entry->cdb) <= 16 ?
-			__entry->cdb[scsi_command_size(__entry->cdb) - 1] :
-			__entry->cdb[1]
+		  __entry->control
 	)
 );
 

From 87b6ee688b89ff0b11e9219c9b932f16187c494c Mon Sep 17 00:00:00 2001
From: Zqiang <qiang.zhang@windriver.com>
Date: Fri, 5 Jun 2020 11:05:33 +0800
Subject: [PATCH 0856/2658] usb: gadget: function: printer: fix use-after-free
 in __lock_acquire

[ Upstream commit e8d5f92b8d30bb4ade76494490c3c065e12411b1 ]

Fix this by increase object reference count.

BUG: KASAN: use-after-free in __lock_acquire+0x3fd4/0x4180
kernel/locking/lockdep.c:3831
Read of size 8 at addr ffff8880683b0018 by task syz-executor.0/3377

CPU: 1 PID: 3377 Comm: syz-executor.0 Not tainted 5.6.11 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xce/0x128 lib/dump_stack.c:118
 print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374
 __kasan_report+0x131/0x1b0 mm/kasan/report.c:506
 kasan_report+0x12/0x20 mm/kasan/common.c:641
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135
 __lock_acquire+0x3fd4/0x4180 kernel/locking/lockdep.c:3831
 lock_acquire+0x127/0x350 kernel/locking/lockdep.c:4488
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159
 printer_ioctl+0x4a/0x110 drivers/usb/gadget/function/f_printer.c:723
 vfs_ioctl fs/ioctl.c:47 [inline]
 ksys_ioctl+0xfb/0x130 fs/ioctl.c:763
 __do_sys_ioctl fs/ioctl.c:772 [inline]
 __se_sys_ioctl fs/ioctl.c:770 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:770
 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4531a9
Code: ed 60 fc ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48
89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
01 f0 ff ff 0f 83 bb 60 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fd14ad72c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000073bfa8 RCX: 00000000004531a9
RDX: fffffffffffffff9 RSI: 000000000000009e RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004bbd61
R13: 00000000004d0a98 R14: 00007fd14ad736d4 R15: 00000000ffffffff

Allocated by task 2393:
 save_stack+0x21/0x90 mm/kasan/common.c:72
 set_track mm/kasan/common.c:80 [inline]
 __kasan_kmalloc.constprop.3+0xa7/0xd0 mm/kasan/common.c:515
 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:529
 kmem_cache_alloc_trace+0xfa/0x2d0 mm/slub.c:2813
 kmalloc include/linux/slab.h:555 [inline]
 kzalloc include/linux/slab.h:669 [inline]
 gprinter_alloc+0xa1/0x870 drivers/usb/gadget/function/f_printer.c:1416
 usb_get_function+0x58/0xc0 drivers/usb/gadget/functions.c:61
 config_usb_cfg_link+0x1ed/0x3e0 drivers/usb/gadget/configfs.c:444
 configfs_symlink+0x527/0x11d0 fs/configfs/symlink.c:202
 vfs_symlink+0x33d/0x5b0 fs/namei.c:4201
 do_symlinkat+0x11b/0x1d0 fs/namei.c:4228
 __do_sys_symlinkat fs/namei.c:4242 [inline]
 __se_sys_symlinkat fs/namei.c:4239 [inline]
 __x64_sys_symlinkat+0x73/0xb0 fs/namei.c:4239
 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 3368:
 save_stack+0x21/0x90 mm/kasan/common.c:72
 set_track mm/kasan/common.c:80 [inline]
 kasan_set_free_info mm/kasan/common.c:337 [inline]
 __kasan_slab_free+0x135/0x190 mm/kasan/common.c:476
 kasan_slab_free+0xe/0x10 mm/kasan/common.c:485
 slab_free_hook mm/slub.c:1444 [inline]
 slab_free_freelist_hook mm/slub.c:1477 [inline]
 slab_free mm/slub.c:3034 [inline]
 kfree+0xf7/0x410 mm/slub.c:3995
 gprinter_free+0x49/0xd0 drivers/usb/gadget/function/f_printer.c:1353
 usb_put_function+0x38/0x50 drivers/usb/gadget/functions.c:87
 config_usb_cfg_unlink+0x2db/0x3b0 drivers/usb/gadget/configfs.c:485
 configfs_unlink+0x3b9/0x7f0 fs/configfs/symlink.c:250
 vfs_unlink+0x287/0x570 fs/namei.c:4073
 do_unlinkat+0x4f9/0x620 fs/namei.c:4137
 __do_sys_unlink fs/namei.c:4184 [inline]
 __se_sys_unlink fs/namei.c:4182 [inline]
 __x64_sys_unlink+0x42/0x50 fs/namei.c:4182
 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8880683b0000
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 24 bytes inside of
 1024-byte region [ffff8880683b0000, ffff8880683b0400)
The buggy address belongs to the page:
page:ffffea0001a0ec00 refcount:1 mapcount:0 mapping:ffff88806c00e300
index:0xffff8880683b1800 compound_mapcount: 0
flags: 0x100000000010200(slab|head)
raw: 0100000000010200 0000000000000000 0000000600000001 ffff88806c00e300
raw: ffff8880683b1800 000000008010000a 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Reported-by: Kyungtae Kim <kt0755@gmail.com>
Signed-off-by: Zqiang <qiang.zhang@windriver.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/function/f_printer.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
index 69afc17fca38..7b21ef09fffc 100644
--- a/drivers/usb/gadget/function/f_printer.c
+++ b/drivers/usb/gadget/function/f_printer.c
@@ -35,6 +35,7 @@
 #include <linux/types.h>
 #include <linux/ctype.h>
 #include <linux/cdev.h>
+#include <linux/kref.h>
 
 #include <asm/byteorder.h>
 #include <linux/io.h>
@@ -69,7 +70,7 @@ struct printer_dev {
 	struct usb_gadget	*gadget;
 	s8			interface;
 	struct usb_ep		*in_ep, *out_ep;
-
+	struct kref             kref;
 	struct list_head	rx_reqs;	/* List of free RX structs */
 	struct list_head	rx_reqs_active;	/* List of Active RX xfers */
 	struct list_head	rx_buffers;	/* List of completed xfers */
@@ -223,6 +224,13 @@ static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget,
 
 /*-------------------------------------------------------------------------*/
 
+static void printer_dev_free(struct kref *kref)
+{
+	struct printer_dev *dev = container_of(kref, struct printer_dev, kref);
+
+	kfree(dev);
+}
+
 static struct usb_request *
 printer_req_alloc(struct usb_ep *ep, unsigned len, gfp_t gfp_flags)
 {
@@ -353,6 +361,7 @@ printer_open(struct inode *inode, struct file *fd)
 
 	spin_unlock_irqrestore(&dev->lock, flags);
 
+	kref_get(&dev->kref);
 	DBG(dev, "printer_open returned %x\n", ret);
 	return ret;
 }
@@ -370,6 +379,7 @@ printer_close(struct inode *inode, struct file *fd)
 	dev->printer_status &= ~PRINTER_SELECTED;
 	spin_unlock_irqrestore(&dev->lock, flags);
 
+	kref_put(&dev->kref, printer_dev_free);
 	DBG(dev, "printer_close\n");
 
 	return 0;
@@ -1316,7 +1326,8 @@ static void gprinter_free(struct usb_function *f)
 	struct f_printer_opts *opts;
 
 	opts = container_of(f->fi, struct f_printer_opts, func_inst);
-	kfree(dev);
+
+	kref_put(&dev->kref, printer_dev_free);
 	mutex_lock(&opts->lock);
 	--opts->refcnt;
 	mutex_unlock(&opts->lock);
@@ -1385,6 +1396,7 @@ static struct usb_function *gprinter_alloc(struct usb_function_instance *fi)
 		return ERR_PTR(-ENOMEM);
 	}
 
+	kref_init(&dev->kref);
 	++opts->refcnt;
 	dev->minor = opts->minor;
 	dev->pnp_string = opts->pnp_string;

From 37e3ab94c9ff7f6982ab3655aaf40906bbf47814 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Fri, 25 Sep 2020 14:53:08 +0200
Subject: [PATCH 0857/2658] udf: Limit sparing table size

[ Upstream commit 44ac6b829c4e173fdf6df18e6dd86aecf9a3dc99 ]

Although UDF standard allows it, we don't support sparing table larger
than a single block. Check it during mount so that we don't try to
access memory beyond end of buffer.

Reported-by: syzbot+9991561e714f597095da@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/udf/super.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/udf/super.c b/fs/udf/super.c
index 159977ec8e54..710f1b8fad9b 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1390,6 +1390,12 @@ static int udf_load_sparable_map(struct super_block *sb,
 			(int)spm->numSparingTables);
 		return -EIO;
 	}
+	if (le32_to_cpu(spm->sizeSparingTable) > sb->s_blocksize) {
+		udf_err(sb, "error loading logical volume descriptor: "
+			"Too big sparing table size (%u)\n",
+			le32_to_cpu(spm->sizeSparingTable));
+		return -EIO;
+	}
 
 	for (i = 0; i < spm->numSparingTables; i++) {
 		loc = le32_to_cpu(spm->locSparingTable[i]);

From ec406d88417751f6ce84d8bb6e129f61f420af65 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Fri, 25 Sep 2020 12:14:03 +0200
Subject: [PATCH 0858/2658] udf: Avoid accessing uninitialized data on failed
 inode read

[ Upstream commit 044e2e26f214e5ab26af85faffd8d1e4ec066931 ]

When we fail to read inode, some data accessed in udf_evict_inode() may
be uninitialized. Move the accesses to !is_bad_inode() branch.

Reported-by: syzbot+91f02b28f9bb5f5f1341@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/udf/inode.c | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 3876448ec0dc..2c39c1c81196 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -140,21 +140,24 @@ void udf_evict_inode(struct inode *inode)
 	struct udf_inode_info *iinfo = UDF_I(inode);
 	int want_delete = 0;
 
-	if (!inode->i_nlink && !is_bad_inode(inode)) {
-		want_delete = 1;
-		udf_setsize(inode, 0);
-		udf_update_inode(inode, IS_SYNC(inode));
+	if (!is_bad_inode(inode)) {
+		if (!inode->i_nlink) {
+			want_delete = 1;
+			udf_setsize(inode, 0);
+			udf_update_inode(inode, IS_SYNC(inode));
+		}
+		if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB &&
+		    inode->i_size != iinfo->i_lenExtents) {
+			udf_warn(inode->i_sb,
+				 "Inode %lu (mode %o) has inode size %llu different from extent length %llu. Filesystem need not be standards compliant.\n",
+				 inode->i_ino, inode->i_mode,
+				 (unsigned long long)inode->i_size,
+				 (unsigned long long)iinfo->i_lenExtents);
+		}
 	}
 	truncate_inode_pages_final(&inode->i_data);
 	invalidate_inode_buffers(inode);
 	clear_inode(inode);
-	if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB &&
-	    inode->i_size != iinfo->i_lenExtents) {
-		udf_warn(inode->i_sb, "Inode %lu (mode %o) has inode size %llu different from extent length %llu. Filesystem need not be standards compliant.\n",
-			 inode->i_ino, inode->i_mode,
-			 (unsigned long long)inode->i_size,
-			 (unsigned long long)iinfo->i_lenExtents);
-	}
 	kfree(iinfo->i_ext.i_data);
 	iinfo->i_ext.i_data = NULL;
 	udf_clear_extent_cache(inode);

From 1bcc73ff43704b507433083342dce11ce4b99683 Mon Sep 17 00:00:00 2001
From: Brooke Basile <brookebasile@gmail.com>
Date: Fri, 11 Sep 2020 03:14:27 -0400
Subject: [PATCH 0859/2658] ath9k: hif_usb: fix race condition between
 usb_get_urb() and usb_kill_anchored_urbs()

[ Upstream commit 03fb92a432ea5abe5909bca1455b7e44a9380480 ]

Calls to usb_kill_anchored_urbs() after usb_kill_urb() on multiprocessor
systems create a race condition in which usb_kill_anchored_urbs() deallocates
the URB before the completer callback is called in usb_kill_urb(), resulting
in a use-after-free.
To fix this, add proper lock protection to usb_kill_urb() calls that can
possibly run concurrently with usb_kill_anchored_urbs().

Reported-by: syzbot+89bd486af9427a9fc605@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=cabffad18eb74197f84871802fd2c5117b61febf
Signed-off-by: Brooke Basile <brookebasile@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200911071427.32354-1-brookebasile@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath9k/hif_usb.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 76d91859cfde..75072a8f8cf4 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -445,10 +445,19 @@ static void hif_usb_stop(void *hif_handle)
 	spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
 
 	/* The pending URBs have to be canceled. */
+	spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
 	list_for_each_entry_safe(tx_buf, tx_buf_tmp,
 				 &hif_dev->tx.tx_pending, list) {
+		usb_get_urb(tx_buf->urb);
+		spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
 		usb_kill_urb(tx_buf->urb);
+		list_del(&tx_buf->list);
+		usb_free_urb(tx_buf->urb);
+		kfree(tx_buf->buf);
+		kfree(tx_buf);
+		spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
 	}
+	spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
 
 	usb_kill_anchored_urbs(&hif_dev->mgmt_submitted);
 }
@@ -758,27 +767,37 @@ static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)
 	struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
 	unsigned long flags;
 
+	spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
 	list_for_each_entry_safe(tx_buf, tx_buf_tmp,
 				 &hif_dev->tx.tx_buf, list) {
+		usb_get_urb(tx_buf->urb);
+		spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
 		usb_kill_urb(tx_buf->urb);
 		list_del(&tx_buf->list);
 		usb_free_urb(tx_buf->urb);
 		kfree(tx_buf->buf);
 		kfree(tx_buf);
+		spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
 	}
+	spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
 
 	spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
 	hif_dev->tx.flags |= HIF_USB_TX_FLUSH;
 	spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
 
+	spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
 	list_for_each_entry_safe(tx_buf, tx_buf_tmp,
 				 &hif_dev->tx.tx_pending, list) {
+		usb_get_urb(tx_buf->urb);
+		spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
 		usb_kill_urb(tx_buf->urb);
 		list_del(&tx_buf->list);
 		usb_free_urb(tx_buf->urb);
 		kfree(tx_buf->buf);
 		kfree(tx_buf);
+		spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
 	}
+	spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
 
 	usb_kill_anchored_urbs(&hif_dev->mgmt_submitted);
 }

From 58b5ec37b27a1ca712e3fa57596efd54ec9645c2 Mon Sep 17 00:00:00 2001
From: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
Date: Wed, 9 Sep 2020 07:18:51 +0000
Subject: [PATCH 0860/2658] misc: rtsx: Fix memory leak in rtsx_pci_probe

[ Upstream commit bc28369c6189009b66d9619dd9f09bd8c684bb98 ]

When mfd_add_devices() fail, pcr->slots should also be freed. However,
the current implementation does not free the member, leading to a memory
leak.

Fix this by adding a new goto label that frees pcr->slots.

Signed-off-by: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
Link: https://lore.kernel.org/r/20200909071853.4053-1-keitasuzuki.park@sslab.ics.keio.ac.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/rtsx_pcr.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c
index 98029ee0959e..be61f8606a04 100644
--- a/drivers/mfd/rtsx_pcr.c
+++ b/drivers/mfd/rtsx_pcr.c
@@ -1255,12 +1255,14 @@ static int rtsx_pci_probe(struct pci_dev *pcidev,
 	ret = mfd_add_devices(&pcidev->dev, pcr->id, rtsx_pcr_cells,
 			ARRAY_SIZE(rtsx_pcr_cells), NULL, 0, NULL);
 	if (ret < 0)
-		goto disable_irq;
+		goto free_slots;
 
 	schedule_delayed_work(&pcr->idle_work, msecs_to_jiffies(200));
 
 	return 0;
 
+free_slots:
+	kfree(pcr->slots);
 disable_irq:
 	free_irq(pcr->irq, (void *)pcr);
 disable_msi:

From 0ae648ad94cce5e3a0a8abb916b073d7cb91f8fc Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Sun, 28 Jun 2020 00:00:57 -0700
Subject: [PATCH 0861/2658] reiserfs: only call unlock_new_inode() if I_NEW

[ Upstream commit 8859bf2b1278d064a139e3031451524a49a56bd0 ]

unlock_new_inode() is only meant to be called after a new inode has
already been inserted into the hash table.  But reiserfs_new_inode() can
call it even before it has inserted the inode, triggering the WARNING in
unlock_new_inode().  Fix this by only calling unlock_new_inode() if the
inode has the I_NEW flag set, indicating that it's in the table.

This addresses the syzbot report "WARNING in unlock_new_inode"
(https://syzkaller.appspot.com/bug?extid=187510916eb6a14598f7).

Link: https://lore.kernel.org/r/20200628070057.820213-1-ebiggers@kernel.org
Reported-by: syzbot+187510916eb6a14598f7@syzkaller.appspotmail.com
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/reiserfs/inode.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index cfb4691d9274..ccbb15ab029f 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -2157,7 +2157,8 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th,
 out_inserted_sd:
 	clear_nlink(inode);
 	th->t_trans_id = 0;	/* so the caller can't use this handle later */
-	unlock_new_inode(inode); /* OK to do even if we hadn't locked it */
+	if (inode->i_state & I_NEW)
+		unlock_new_inode(inode);
 	iput(inode);
 	return err;
 }

From c1d2e8bcc9fb17371bc55f4ee10c4b6d8c5b8b4d Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <darrick.wong@oracle.com>
Date: Wed, 9 Sep 2020 14:21:06 -0700
Subject: [PATCH 0862/2658] xfs: make sure the rt allocator doesn't run off the
 end

[ Upstream commit 2a6ca4baed620303d414934aa1b7b0a8e7bab05f ]

There's an overflow bug in the realtime allocator.  If the rt volume is
large enough to handle a single allocation request that is larger than
the maximum bmap extent length and the rt bitmap ends exactly on a
bitmap block boundary, it's possible that the near allocator will try to
check the freeness of a range that extends past the end of the bitmap.
This fails with a corruption error and shuts down the fs.

Therefore, constrain maxlen so that the range scan cannot run off the
end of the rt bitmap.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/xfs_rtalloc.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
index 919b6544b61a..bda5248fc649 100644
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -256,6 +256,9 @@ xfs_rtallocate_extent_block(
 		end = XFS_BLOCKTOBIT(mp, bbno + 1) - 1;
 	     i <= end;
 	     i++) {
+		/* Make sure we don't scan off the end of the rt volume. */
+		maxlen = min(mp->m_sb.sb_rextents, i + maxlen) - i;
+
 		/*
 		 * See if there's a free extent of maxlen starting at i.
 		 * If it's not so then next will contain the first non-free.
@@ -447,6 +450,14 @@ xfs_rtallocate_extent_near(
 	 */
 	if (bno >= mp->m_sb.sb_rextents)
 		bno = mp->m_sb.sb_rextents - 1;
+
+	/* Make sure we don't run off the end of the rt volume. */
+	maxlen = min(mp->m_sb.sb_rextents, bno + maxlen) - bno;
+	if (maxlen < minlen) {
+		*rtblock = NULLRTBLOCK;
+		return 0;
+	}
+
 	/*
 	 * Try the exact allocation first.
 	 */

From c4a814abde1380177c11fcdfb88f89bffc27d24e Mon Sep 17 00:00:00 2001
From: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
Date: Fri, 11 Sep 2020 09:25:11 +1200
Subject: [PATCH 0863/2658] usb: ohci: Default to per-port over-current
 protection

[ Upstream commit b77d2a0a223bc139ee8904991b2922d215d02636 ]

Some integrated OHCI controller hubs do not expose all ports of the hub
to pins on the SoC. In some cases the unconnected ports generate
spurious over-current events. For example the Broadcom 56060/Ranger 2 SoC
contains a nominally 3 port hub but only the first port is wired.

Default behaviour for ohci-platform driver is to use global over-current
protection mode (AKA "ganged"). This leads to the spurious over-current
events affecting all ports in the hub.

We now alter the default to use per-port over-current protection.

This patch results in the following configuration changes depending
on quirks:
- For quirk OHCI_QUIRK_SUPERIO no changes. These systems remain set up
  for ganged power switching and no over-current protection.
- For quirk OHCI_QUIRK_AMD756 or OHCI_QUIRK_HUB_POWER power switching
  remains at none, while over-current protection is now guaranteed to be
  set to per-port rather than the previous behaviour where it was either
  none or global over-current protection depending on the value at
  function entry.

Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
Link: https://lore.kernel.org/r/20200910212512.16670-1-hamish.martin@alliedtelesis.co.nz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/ohci-hcd.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 228960dbcc6b..d34b15bf0f41 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -663,20 +663,24 @@ static int ohci_run (struct ohci_hcd *ohci)
 
 	/* handle root hub init quirks ... */
 	val = roothub_a (ohci);
-	val &= ~(RH_A_PSM | RH_A_OCPM);
+	/* Configure for per-port over-current protection by default */
+	val &= ~RH_A_NOCP;
+	val |= RH_A_OCPM;
 	if (ohci->flags & OHCI_QUIRK_SUPERIO) {
-		/* NSC 87560 and maybe others */
+		/* NSC 87560 and maybe others.
+		 * Ganged power switching, no over-current protection.
+		 */
 		val |= RH_A_NOCP;
-		val &= ~(RH_A_POTPGT | RH_A_NPS);
-		ohci_writel (ohci, val, &ohci->regs->roothub.a);
+		val &= ~(RH_A_POTPGT | RH_A_NPS | RH_A_PSM | RH_A_OCPM);
 	} else if ((ohci->flags & OHCI_QUIRK_AMD756) ||
 			(ohci->flags & OHCI_QUIRK_HUB_POWER)) {
 		/* hub power always on; required for AMD-756 and some
-		 * Mac platforms.  ganged overcurrent reporting, if any.
+		 * Mac platforms.
 		 */
 		val |= RH_A_NPS;
-		ohci_writel (ohci, val, &ohci->regs->roothub.a);
 	}
+	ohci_writel(ohci, val, &ohci->regs->roothub.a);
+
 	ohci_writel (ohci, RH_HS_LPSC, &ohci->regs->roothub.status);
 	ohci_writel (ohci, (val & RH_A_NPS) ? 0 : RH_B_PPCM,
 						&ohci->regs->roothub.b);

From 790507df9890139930e3df0b79dd9ca60c0917ff Mon Sep 17 00:00:00 2001
From: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
Date: Fri, 11 Sep 2020 15:33:18 -0700
Subject: [PATCH 0864/2658] Bluetooth: Only mark socket zapped after unlocking

[ Upstream commit 20ae4089d0afeb24e9ceb026b996bfa55c983cc2 ]

Since l2cap_sock_teardown_cb doesn't acquire the channel lock before
setting the socket as zapped, it could potentially race with
l2cap_sock_release which frees the socket. Thus, wait until the cleanup
is complete before marking the socket as zapped.

This race was reproduced on a JBL GO speaker after the remote device
rejected L2CAP connection due to resource unavailability.

Here is a dmesg log with debug logs from a repro of this bug:
[ 3465.424086] Bluetooth: hci_core.c:hci_acldata_packet() hci0 len 16 handle 0x0003 flags 0x0002
[ 3465.424090] Bluetooth: hci_conn.c:hci_conn_enter_active_mode() hcon 00000000cfedd07d mode 0
[ 3465.424094] Bluetooth: l2cap_core.c:l2cap_recv_acldata() conn 000000007eae8952 len 16 flags 0x2
[ 3465.424098] Bluetooth: l2cap_core.c:l2cap_recv_frame() len 12, cid 0x0001
[ 3465.424102] Bluetooth: l2cap_core.c:l2cap_raw_recv() conn 000000007eae8952
[ 3465.424175] Bluetooth: l2cap_core.c:l2cap_sig_channel() code 0x03 len 8 id 0x0c
[ 3465.424180] Bluetooth: l2cap_core.c:l2cap_connect_create_rsp() dcid 0x0045 scid 0x0000 result 0x02 status 0x00
[ 3465.424189] Bluetooth: l2cap_core.c:l2cap_chan_put() chan 000000006acf9bff orig refcnt 4
[ 3465.424196] Bluetooth: l2cap_core.c:l2cap_chan_del() chan 000000006acf9bff, conn 000000007eae8952, err 111, state BT_CONNECT
[ 3465.424203] Bluetooth: l2cap_sock.c:l2cap_sock_teardown_cb() chan 000000006acf9bff state BT_CONNECT
[ 3465.424221] Bluetooth: l2cap_core.c:l2cap_chan_put() chan 000000006acf9bff orig refcnt 3
[ 3465.424226] Bluetooth: hci_core.h:hci_conn_drop() hcon 00000000cfedd07d orig refcnt 6
[ 3465.424234] BUG: spinlock bad magic on CPU#2, kworker/u17:0/159
[ 3465.425626] Bluetooth: hci_sock.c:hci_sock_sendmsg() sock 000000002bb0cb64 sk 00000000a7964053
[ 3465.430330]  lock: 0xffffff804410aac0, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
[ 3465.430332] Causing a watchdog bite!

Signed-off-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
Reported-by: Balakrishna Godavarthi <bgodavar@codeaurora.org>
Reviewed-by: Manish Mandlik <mmandlik@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/l2cap_sock.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index b6860dc540ed..493d84bfdfa6 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1330,8 +1330,6 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
 
 	parent = bt_sk(sk)->parent;
 
-	sock_set_flag(sk, SOCK_ZAPPED);
-
 	switch (chan->state) {
 	case BT_OPEN:
 	case BT_BOUND:
@@ -1358,8 +1356,11 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
 
 		break;
 	}
-
 	release_sock(sk);
+
+	/* Only zap after cleanup to avoid use after free race */
+	sock_set_flag(sk, SOCK_ZAPPED);
+
 }
 
 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,

From caf1ddc9fb4083c2e8ea902b1b0f26a7b7b244a9 Mon Sep 17 00:00:00 2001
From: Jing Xiangfeng <jingxiangfeng@huawei.com>
Date: Mon, 7 Sep 2020 16:39:49 +0800
Subject: [PATCH 0865/2658] scsi: ibmvfc: Fix error return in ibmvfc_probe()

[ Upstream commit 5e48a084f4e824e1b624d3fd7ddcf53d2ba69e53 ]

Fix to return error code PTR_ERR() from the error handling case instead of
0.

Link: https://lore.kernel.org/r/20200907083949.154251-1-jingxiangfeng@huawei.com
Acked-by: Tyrel Datwyler <tyreld@linux.ibm.com>
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ibmvscsi/ibmvfc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
index 0526a47e30a3..db80ab8335df 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc.c
+++ b/drivers/scsi/ibmvscsi/ibmvfc.c
@@ -4790,6 +4790,7 @@ static int ibmvfc_probe(struct vio_dev *vdev, const struct vio_device_id *id)
 	if (IS_ERR(vhost->work_thread)) {
 		dev_err(dev, "Couldn't create kernel thread: %ld\n",
 			PTR_ERR(vhost->work_thread));
+		rc = PTR_ERR(vhost->work_thread);
 		goto free_host_mem;
 	}
 

From 7f033d8fdbbcfc99f64001f7b7ddbd56c8723650 Mon Sep 17 00:00:00 2001
From: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
Date: Tue, 8 Sep 2020 12:17:41 +0000
Subject: [PATCH 0866/2658] brcmsmac: fix memory leak in wlc_phy_attach_lcnphy

[ Upstream commit f4443293d741d1776b86ed1dd8c4e4285d0775fc ]

When wlc_phy_txpwr_srom_read_lcnphy fails in wlc_phy_attach_lcnphy,
the allocated pi->u.pi_lcnphy is leaked, since struct brcms_phy will be
freed in the caller function.

Fix this by calling wlc_phy_detach_lcnphy in the error handler of
wlc_phy_txpwr_srom_read_lcnphy before returning.

Signed-off-by: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200908121743.23108-1-keitasuzuki.park@sslab.ics.keio.ac.jp
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
index 93d4cde0eb31..c9f48ec46f4a 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
@@ -5090,8 +5090,10 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi)
 	pi->pi_fptr.radioloftget = wlc_lcnphy_get_radio_loft;
 	pi->pi_fptr.detach = wlc_phy_detach_lcnphy;
 
-	if (!wlc_phy_txpwr_srom_read_lcnphy(pi))
+	if (!wlc_phy_txpwr_srom_read_lcnphy(pi)) {
+		kfree(pi->u.pi_lcnphy);
 		return false;
+	}
 
 	if (LCNREV_IS(pi->pubpi.phy_rev, 1)) {
 		if (pi_lcn->lcnphy_tempsense_option == 3) {

From 398a5a2158f2977531bc07fdd2233e806b5ac4ee Mon Sep 17 00:00:00 2001
From: Chris Chiu <chiu@endlessm.com>
Date: Sun, 6 Sep 2020 12:04:24 +0800
Subject: [PATCH 0867/2658] rtl8xxxu: prevent potential memory leak

[ Upstream commit 86279456a4d47782398d3cb8193f78f672e36cac ]

Free the skb if usb_submit_urb fails on rx_urb. And free the urb
no matter usb_submit_urb succeeds or not in rtl8xxxu_submit_int_urb.

Signed-off-by: Chris Chiu <chiu@endlessm.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200906040424.22022-1-chiu@endlessm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c
index 8254d4b22c50..b8d387edde65 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c
@@ -5135,7 +5135,6 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw)
 	ret = usb_submit_urb(urb, GFP_KERNEL);
 	if (ret) {
 		usb_unanchor_urb(urb);
-		usb_free_urb(urb);
 		goto error;
 	}
 
@@ -5144,6 +5143,7 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw)
 	rtl8xxxu_write32(priv, REG_USB_HIMR, val32);
 
 error:
+	usb_free_urb(urb);
 	return ret;
 }
 
@@ -5424,6 +5424,7 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw)
 	struct rtl8xxxu_priv *priv = hw->priv;
 	struct rtl8xxxu_rx_urb *rx_urb;
 	struct rtl8xxxu_tx_urb *tx_urb;
+	struct sk_buff *skb;
 	unsigned long flags;
 	int ret, i;
 
@@ -5472,6 +5473,13 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw)
 		rx_urb->hw = hw;
 
 		ret = rtl8xxxu_submit_rx_urb(priv, rx_urb);
+		if (ret) {
+			if (ret != -ENOMEM) {
+				skb = (struct sk_buff *)rx_urb->urb.context;
+				dev_kfree_skb(skb);
+			}
+			rtl8xxxu_queue_rx_urb(priv, rx_urb);
+		}
 	}
 exit:
 	/*

From 802ffae718413f8f709e26df73c50db0a7b10554 Mon Sep 17 00:00:00 2001
From: Doug Horn <doughorn@google.com>
Date: Wed, 2 Sep 2020 14:08:25 -0700
Subject: [PATCH 0868/2658] Fix use after free in get_capset_info callback.

[ Upstream commit e219688fc5c3d0d9136f8d29d7e0498388f01440 ]

If a response to virtio_gpu_cmd_get_capset_info takes longer than
five seconds to return, the callback will access freed kernel memory
in vg->capsets.

Signed-off-by: Doug Horn <doughorn@google.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20200902210847.2689-2-gurchetansingh@chromium.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/virtio/virtgpu_kms.c |  2 ++
 drivers/gpu/drm/virtio/virtgpu_vq.c  | 10 +++++++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c
index 06496a128162..476b9993b068 100644
--- a/drivers/gpu/drm/virtio/virtgpu_kms.c
+++ b/drivers/gpu/drm/virtio/virtgpu_kms.c
@@ -113,8 +113,10 @@ static void virtio_gpu_get_capsets(struct virtio_gpu_device *vgdev,
 					 vgdev->capsets[i].id > 0, 5 * HZ);
 		if (ret == 0) {
 			DRM_ERROR("timed out waiting for cap set %d\n", i);
+			spin_lock(&vgdev->display_info_lock);
 			kfree(vgdev->capsets);
 			vgdev->capsets = NULL;
+			spin_unlock(&vgdev->display_info_lock);
 			return;
 		}
 		DRM_INFO("cap set %d: id %d, max-version %d, max-size %d\n",
diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
index 772a5a3b0ce1..18e8fcad6690 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
@@ -596,9 +596,13 @@ static void virtio_gpu_cmd_get_capset_info_cb(struct virtio_gpu_device *vgdev,
 	int i = le32_to_cpu(cmd->capset_index);
 
 	spin_lock(&vgdev->display_info_lock);
-	vgdev->capsets[i].id = le32_to_cpu(resp->capset_id);
-	vgdev->capsets[i].max_version = le32_to_cpu(resp->capset_max_version);
-	vgdev->capsets[i].max_size = le32_to_cpu(resp->capset_max_size);
+	if (vgdev->capsets) {
+		vgdev->capsets[i].id = le32_to_cpu(resp->capset_id);
+		vgdev->capsets[i].max_version = le32_to_cpu(resp->capset_max_version);
+		vgdev->capsets[i].max_size = le32_to_cpu(resp->capset_max_size);
+	} else {
+		DRM_ERROR("invalid capset memory.");
+	}
 	spin_unlock(&vgdev->display_info_lock);
 	wake_up(&vgdev->resp_wq);
 }

From f634d62de95b9a04554326082d757df0ee041883 Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Fri, 21 Aug 2020 12:19:40 -0400
Subject: [PATCH 0869/2658] tty: ipwireless: fix error handling

[ Upstream commit db332356222d9429731ab9395c89cca403828460 ]

ipwireless_send_packet() can only return 0 on success and -ENOMEM on
error, the caller should check non zero for error condition

Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Acked-by: David Sterba <dsterba@suse.com>
Link: https://lore.kernel.org/r/20200821161942.36589-1-ztong0001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/ipwireless/network.c | 4 ++--
 drivers/tty/ipwireless/tty.c     | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/ipwireless/network.c b/drivers/tty/ipwireless/network.c
index c0dfb642383b..dc7f4eb18e0a 100644
--- a/drivers/tty/ipwireless/network.c
+++ b/drivers/tty/ipwireless/network.c
@@ -116,7 +116,7 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel,
 					       skb->len,
 					       notify_packet_sent,
 					       network);
-			if (ret == -1) {
+			if (ret < 0) {
 				skb_pull(skb, 2);
 				return 0;
 			}
@@ -133,7 +133,7 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel,
 					       notify_packet_sent,
 					       network);
 			kfree(buf);
-			if (ret == -1)
+			if (ret < 0)
 				return 0;
 		}
 		kfree_skb(skb);
diff --git a/drivers/tty/ipwireless/tty.c b/drivers/tty/ipwireless/tty.c
index 345cebb07ae7..0b06b1847450 100644
--- a/drivers/tty/ipwireless/tty.c
+++ b/drivers/tty/ipwireless/tty.c
@@ -217,7 +217,7 @@ static int ipw_write(struct tty_struct *linux_tty,
 	ret = ipwireless_send_packet(tty->hardware, IPW_CHANNEL_RAS,
 			       buf, count,
 			       ipw_write_packet_sent_callback, tty);
-	if (ret == -1) {
+	if (ret < 0) {
 		mutex_unlock(&tty->ipw_tty_mutex);
 		return 0;
 	}

From effe33d679a28cbd441bd47abb9839bc6b37447f Mon Sep 17 00:00:00 2001
From: Peilin Ye <yepeilin.cs@gmail.com>
Date: Tue, 11 Aug 2020 03:46:40 -0400
Subject: [PATCH 0870/2658] ipvs: Fix uninit-value in do_ip_vs_set_ctl()

[ Upstream commit c5a8a8498eed1c164afc94f50a939c1a10abf8ad ]

do_ip_vs_set_ctl() is referencing uninitialized stack value when `len` is
zero. Fix it.

Reported-by: syzbot+23b5f9e7caf61d9a3898@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=46ebfb92a8a812621a001ef04d90dfa459520fe2
Suggested-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Reviewed-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/ipvs/ip_vs_ctl.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index b176f76dfaa1..c7ee962a547b 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2383,6 +2383,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 		/* Set timeout values for (tcp tcpfin udp) */
 		ret = ip_vs_set_timeout(ipvs, (struct ip_vs_timeout_user *)arg);
 		goto out_unlock;
+	} else if (!len) {
+		/* No more commands with len == 0 below */
+		ret = -EINVAL;
+		goto out_unlock;
 	}
 
 	usvc_compat = (struct ip_vs_service_user *)arg;
@@ -2459,9 +2463,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 		break;
 	case IP_VS_SO_SET_DELDEST:
 		ret = ip_vs_del_dest(svc, &udest);
-		break;
-	default:
-		ret = -EINVAL;
 	}
 
   out_unlock:

From ecdf3f3096294dc2020cd34a4ef64c2aaf34a299 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Wed, 4 Mar 2020 14:01:44 +0100
Subject: [PATCH 0871/2658] reiserfs: Fix memory leak in
 reiserfs_parse_options()

[ Upstream commit e9d4709fcc26353df12070566970f080e651f0c9 ]

When a usrjquota or grpjquota mount option is used multiple times, we
will leak memory allocated for the file name. Make sure the last setting
is used and all the previous ones are properly freed.

Reported-by: syzbot+c9e294bbe0333a6b7640@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/reiserfs/super.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index f9796fd51531..503d8c06e0d9 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -1232,6 +1232,10 @@ static int reiserfs_parse_options(struct super_block *s,
 						 "turned on.");
 				return 0;
 			}
+			if (qf_names[qtype] !=
+			    REISERFS_SB(s)->s_qf_names[qtype])
+				kfree(qf_names[qtype]);
+			qf_names[qtype] = NULL;
 			if (*arg) {	/* Some filename specified? */
 				if (REISERFS_SB(s)->s_qf_names[qtype]
 				    && strcmp(REISERFS_SB(s)->s_qf_names[qtype],
@@ -1261,10 +1265,6 @@ static int reiserfs_parse_options(struct super_block *s,
 				else
 					*mount_options |= 1 << REISERFS_GRPQUOTA;
 			} else {
-				if (qf_names[qtype] !=
-				    REISERFS_SB(s)->s_qf_names[qtype])
-					kfree(qf_names[qtype]);
-				qf_names[qtype] = NULL;
 				if (qtype == USRQUOTA)
 					*mount_options &= ~(1 << REISERFS_USRQUOTA);
 				else

From bc9a1ad8cb1d99bb832f708aa1e3c8ed555ab511 Mon Sep 17 00:00:00 2001
From: Wang Yufen <wangyufen@huawei.com>
Date: Mon, 20 Jul 2020 17:36:05 +0800
Subject: [PATCH 0872/2658] brcm80211: fix possible memleak in
 brcmf_proto_msgbuf_attach

[ Upstream commit 6c151410d5b57e6bb0d91a735ac511459539a7bf ]

When brcmf_proto_msgbuf_attach fail and msgbuf->txflow_wq != NULL,
we should destroy the workqueue.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Yufen <wangyufen@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1595237765-66238-1-git-send-email-wangyufen@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
index f944f356d9c5..cacb43573f57 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
@@ -1530,6 +1530,8 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
 					  BRCMF_TX_IOCTL_MAX_MSG_SIZE,
 					  msgbuf->ioctbuf,
 					  msgbuf->ioctbuf_handle);
+		if (msgbuf->txflow_wq)
+			destroy_workqueue(msgbuf->txflow_wq);
 		kfree(msgbuf);
 	}
 	return -ENOMEM;

From f3f4d402084f7f1f14d292d5a283febef553caf3 Mon Sep 17 00:00:00 2001
From: Eli Billauer <eli.billauer@gmail.com>
Date: Fri, 31 Jul 2020 08:46:50 +0300
Subject: [PATCH 0873/2658] usb: core: Solve race condition in anchor cleanup
 functions

[ Upstream commit fbc299437c06648afcc7891e6e2e6638dd48d4df ]

usb_kill_anchored_urbs() is commonly used to cancel all URBs on an
anchor just before releasing resources which the URBs rely on. By doing
so, users of this function rely on that no completer callbacks will take
place from any URB on the anchor after it returns.

However if this function is called in parallel with __usb_hcd_giveback_urb
processing a URB on the anchor, the latter may call the completer
callback after usb_kill_anchored_urbs() returns. This can lead to a
kernel panic due to use after release of memory in interrupt context.

The race condition is that __usb_hcd_giveback_urb() first unanchors the URB
and then makes the completer callback. Such URB is hence invisible to
usb_kill_anchored_urbs(), allowing it to return before the completer has
been called, since the anchor's urb_list is empty.

Even worse, if the racing completer callback resubmits the URB, it may
remain in the system long after usb_kill_anchored_urbs() returns.

Hence list_empty(&anchor->urb_list), which is used in the existing
while-loop, doesn't reliably ensure that all URBs of the anchor are gone.

A similar problem exists with usb_poison_anchored_urbs() and
usb_scuttle_anchored_urbs().

This patch adds an external do-while loop, which ensures that all URBs
are indeed handled before these three functions return. This change has
no effect at all unless the race condition occurs, in which case the
loop will busy-wait until the racing completer callback has finished.
This is a rare condition, so the CPU waste of this spinning is
negligible.

The additional do-while loop relies on usb_anchor_check_wakeup(), which
returns true iff the anchor list is empty, and there is no
__usb_hcd_giveback_urb() in the system that is in the middle of the
unanchor-before-complete phase. The @suspend_wakeups member of
struct usb_anchor is used for this purpose, which was introduced to solve
another problem which the same race condition causes, in commit
6ec4147e7bdb ("usb-anchor: Delay usb_wait_anchor_empty_timeout wake up
till completion is done").

The surely_empty variable is necessary, because usb_anchor_check_wakeup()
must be called with the lock held to prevent races. However the spinlock
must be released and reacquired if the outer loop spins with an empty
URB list while waiting for the unanchor-before-complete passage to finish:
The completer callback may very well attempt to take the very same lock.

To summarize, using usb_anchor_check_wakeup() means that the patched
functions can return only when the anchor's list is empty, and there is
no invisible URB being processed. Since the inner while loop finishes on
the empty list condition, the new do-while loop will terminate as well,
except for when the said race condition occurs.

Signed-off-by: Eli Billauer <eli.billauer@gmail.com>
Acked-by: Oliver Neukum <oneukum@suse.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20200731054650.30644-1-eli.billauer@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/core/urb.c | 89 +++++++++++++++++++++++++-----------------
 1 file changed, 54 insertions(+), 35 deletions(-)

diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
index c095cde55329..8c4bfd42f785 100644
--- a/drivers/usb/core/urb.c
+++ b/drivers/usb/core/urb.c
@@ -767,11 +767,12 @@ void usb_block_urb(struct urb *urb)
 EXPORT_SYMBOL_GPL(usb_block_urb);
 
 /**
- * usb_kill_anchored_urbs - cancel transfer requests en masse
+ * usb_kill_anchored_urbs - kill all URBs associated with an anchor
  * @anchor: anchor the requests are bound to
  *
- * this allows all outstanding URBs to be killed starting
- * from the back of the queue
+ * This kills all outstanding URBs starting from the back of the queue,
+ * with guarantee that no completer callbacks will take place from the
+ * anchor after this function returns.
  *
  * This routine should not be called by a driver after its disconnect
  * method has returned.
@@ -779,20 +780,26 @@ EXPORT_SYMBOL_GPL(usb_block_urb);
 void usb_kill_anchored_urbs(struct usb_anchor *anchor)
 {
 	struct urb *victim;
+	int surely_empty;
 
-	spin_lock_irq(&anchor->lock);
-	while (!list_empty(&anchor->urb_list)) {
-		victim = list_entry(anchor->urb_list.prev, struct urb,
-				    anchor_list);
-		/* we must make sure the URB isn't freed before we kill it*/
-		usb_get_urb(victim);
-		spin_unlock_irq(&anchor->lock);
-		/* this will unanchor the URB */
-		usb_kill_urb(victim);
-		usb_put_urb(victim);
+	do {
 		spin_lock_irq(&anchor->lock);
-	}
-	spin_unlock_irq(&anchor->lock);
+		while (!list_empty(&anchor->urb_list)) {
+			victim = list_entry(anchor->urb_list.prev,
+					    struct urb, anchor_list);
+			/* make sure the URB isn't freed before we kill it */
+			usb_get_urb(victim);
+			spin_unlock_irq(&anchor->lock);
+			/* this will unanchor the URB */
+			usb_kill_urb(victim);
+			usb_put_urb(victim);
+			spin_lock_irq(&anchor->lock);
+		}
+		surely_empty = usb_anchor_check_wakeup(anchor);
+
+		spin_unlock_irq(&anchor->lock);
+		cpu_relax();
+	} while (!surely_empty);
 }
 EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs);
 
@@ -811,21 +818,27 @@ EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs);
 void usb_poison_anchored_urbs(struct usb_anchor *anchor)
 {
 	struct urb *victim;
+	int surely_empty;
 
-	spin_lock_irq(&anchor->lock);
-	anchor->poisoned = 1;
-	while (!list_empty(&anchor->urb_list)) {
-		victim = list_entry(anchor->urb_list.prev, struct urb,
-				    anchor_list);
-		/* we must make sure the URB isn't freed before we kill it*/
-		usb_get_urb(victim);
-		spin_unlock_irq(&anchor->lock);
-		/* this will unanchor the URB */
-		usb_poison_urb(victim);
-		usb_put_urb(victim);
+	do {
 		spin_lock_irq(&anchor->lock);
-	}
-	spin_unlock_irq(&anchor->lock);
+		anchor->poisoned = 1;
+		while (!list_empty(&anchor->urb_list)) {
+			victim = list_entry(anchor->urb_list.prev,
+					    struct urb, anchor_list);
+			/* make sure the URB isn't freed before we kill it */
+			usb_get_urb(victim);
+			spin_unlock_irq(&anchor->lock);
+			/* this will unanchor the URB */
+			usb_poison_urb(victim);
+			usb_put_urb(victim);
+			spin_lock_irq(&anchor->lock);
+		}
+		surely_empty = usb_anchor_check_wakeup(anchor);
+
+		spin_unlock_irq(&anchor->lock);
+		cpu_relax();
+	} while (!surely_empty);
 }
 EXPORT_SYMBOL_GPL(usb_poison_anchored_urbs);
 
@@ -965,14 +978,20 @@ void usb_scuttle_anchored_urbs(struct usb_anchor *anchor)
 {
 	struct urb *victim;
 	unsigned long flags;
+	int surely_empty;
+
+	do {
+		spin_lock_irqsave(&anchor->lock, flags);
+		while (!list_empty(&anchor->urb_list)) {
+			victim = list_entry(anchor->urb_list.prev,
+					    struct urb, anchor_list);
+			__usb_unanchor_urb(victim, anchor);
+		}
+		surely_empty = usb_anchor_check_wakeup(anchor);
 
-	spin_lock_irqsave(&anchor->lock, flags);
-	while (!list_empty(&anchor->urb_list)) {
-		victim = list_entry(anchor->urb_list.prev, struct urb,
-				    anchor_list);
-		__usb_unanchor_urb(victim, anchor);
-	}
-	spin_unlock_irqrestore(&anchor->lock, flags);
+		spin_unlock_irqrestore(&anchor->lock, flags);
+		cpu_relax();
+	} while (!surely_empty);
 }
 
 EXPORT_SYMBOL_GPL(usb_scuttle_anchored_urbs);

From 13fbc507a0fb7b5e9b5e33982836e917b191a293 Mon Sep 17 00:00:00 2001
From: Zekun Shen <bruceshenzk@gmail.com>
Date: Tue, 23 Jun 2020 18:11:05 -0400
Subject: [PATCH 0874/2658] ath10k: check idx validity in
 __ath10k_htt_rx_ring_fill_n()

[ Upstream commit bad60b8d1a7194df38fd7fe4b22f3f4dcf775099 ]

The idx in __ath10k_htt_rx_ring_fill_n function lives in
consistent dma region writable by the device. Malfunctional
or malicious device could manipulate such idx to have a OOB
write. Either by
    htt->rx_ring.netbufs_ring[idx] = skb;
or by
    ath10k_htt_set_paddrs_ring(htt, paddr, idx);

The idx can also be negative as it's signed, giving a large
memory space to write to.

It's possibly exploitable by corruptting a legit pointer with
a skb pointer. And then fill skb with payload as rougue object.

Part of the log here. Sometimes it appears as UAF when writing
to a freed memory by chance.

 [   15.594376] BUG: unable to handle page fault for address: ffff887f5c1804f0
 [   15.595483] #PF: supervisor write access in kernel mode
 [   15.596250] #PF: error_code(0x0002) - not-present page
 [   15.597013] PGD 0 P4D 0
 [   15.597395] Oops: 0002 [#1] SMP KASAN PTI
 [   15.597967] CPU: 0 PID: 82 Comm: kworker/u2:2 Not tainted 5.6.0 #69
 [   15.598843] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
 BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
 [   15.600438] Workqueue: ath10k_wq ath10k_core_register_work [ath10k_core]
 [   15.601389] RIP: 0010:__ath10k_htt_rx_ring_fill_n
 (linux/drivers/net/wireless/ath/ath10k/htt_rx.c:173) ath10k_core

Signed-off-by: Zekun Shen <bruceshenzk@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200623221105.3486-1-bruceshenzk@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/htt_rx.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index b9c627fc48ad..26d9ea6d4b5f 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -101,6 +101,14 @@ static int __ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num)
 	BUILD_BUG_ON(HTT_RX_RING_FILL_LEVEL >= HTT_RX_RING_SIZE / 2);
 
 	idx = __le32_to_cpu(*htt->rx_ring.alloc_idx.vaddr);
+
+	if (idx < 0 || idx >= htt->rx_ring.size) {
+		ath10k_err(htt->ar, "rx ring index is not valid, firmware malfunctioning?\n");
+		idx &= htt->rx_ring.size_mask;
+		ret = -ENOMEM;
+		goto fail;
+	}
+
 	while (num > 0) {
 		skb = dev_alloc_skb(HTT_RX_BUF_SIZE + HTT_RX_DESC_ALIGN);
 		if (!skb) {

From 8927bcceeec6a36c357340d6265446d126b9994b Mon Sep 17 00:00:00 2001
From: Valentin Vidic <vvidic@valentin-vidic.from.hr>
Date: Sun, 18 Oct 2020 20:42:55 +0200
Subject: [PATCH 0875/2658] net: korina: cast KSEG0 address to pointer in kfree

[ Upstream commit 3bd57b90554b4bb82dce638e0668ef9dc95d3e96 ]

Fixes gcc warning:

passing argument 1 of 'kfree' makes pointer from integer without a cast

Fixes: 3af5f0f5c74e ("net: korina: fix kfree of rx/tx descriptor array")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Valentin Vidic <vvidic@valentin-vidic.from.hr>
Link: https://lore.kernel.org/r/20201018184255.28989-1-vvidic@valentin-vidic.from.hr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/korina.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
index 3954c80f70fc..b491de946a0e 100644
--- a/drivers/net/ethernet/korina.c
+++ b/drivers/net/ethernet/korina.c
@@ -1188,7 +1188,7 @@ static int korina_probe(struct platform_device *pdev)
 	return rc;
 
 probe_err_register:
-	kfree(KSEG0ADDR(lp->td_ring));
+	kfree((struct dma_desc *)KSEG0ADDR(lp->td_ring));
 probe_err_td_ring:
 	iounmap(lp->tx_dma_regs);
 probe_err_dma_tx:
@@ -1208,7 +1208,7 @@ static int korina_remove(struct platform_device *pdev)
 	iounmap(lp->eth_regs);
 	iounmap(lp->rx_dma_regs);
 	iounmap(lp->tx_dma_regs);
-	kfree(KSEG0ADDR(lp->td_ring));
+	kfree((struct dma_desc *)KSEG0ADDR(lp->td_ring));
 
 	unregister_netdev(bif->dev);
 	free_netdev(bif->dev);

From 28d218acad4272c1c4a0623db2410c9a824c0089 Mon Sep 17 00:00:00 2001
From: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Date: Sat, 3 Oct 2020 00:41:51 +0900
Subject: [PATCH 0876/2658] usb: cdc-acm: add quirk to blacklist ETAS ES58X
 devices

commit a4f88430af896bf34ec25a7a5f0e053fb3d928e0 upstream.

The ES58X devices has a CDC ACM interface (used for debug
purpose). During probing, the device is thus recognized as USB Modem
(CDC ACM), preventing the etas-es58x module to load:
  usbcore: registered new interface driver etas_es58x
  usb 1-1.1: new full-speed USB device number 14 using xhci_hcd
  usb 1-1.1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice= 1.00
  usb 1-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
  usb 1-1.1: Product: ES581.4
  usb 1-1.1: Manufacturer: ETAS GmbH
  usb 1-1.1: SerialNumber: 2204355
  cdc_acm 1-1.1:1.0: No union descriptor, testing for castrated device
  cdc_acm 1-1.1:1.0: ttyACM0: USB ACM device

Thus, these have been added to the ignore list in
drivers/usb/class/cdc-acm.c

N.B. Future firmware release of the ES58X will remove the CDC-ACM
interface.

`lsusb -v` of the three devices variant (ES581.4, ES582.1 and
ES584.1):

  Bus 001 Device 011: ID 108c:0159 Robert Bosch GmbH ES581.4
  Device Descriptor:
    bLength                18
    bDescriptorType         1
    bcdUSB               1.10
    bDeviceClass            2 Communications
    bDeviceSubClass         0
    bDeviceProtocol         0
    bMaxPacketSize0        64
    idVendor           0x108c Robert Bosch GmbH
    idProduct          0x0159
    bcdDevice            1.00
    iManufacturer           1 ETAS GmbH
    iProduct                2 ES581.4
    iSerial                 3 2204355
    bNumConfigurations      1
    Configuration Descriptor:
      bLength                 9
      bDescriptorType         2
      wTotalLength       0x0035
      bNumInterfaces          1
      bConfigurationValue     1
      iConfiguration          5 Bus Powered Configuration
      bmAttributes         0x80
        (Bus Powered)
      MaxPower              100mA
      Interface Descriptor:
        bLength                 9
        bDescriptorType         4
        bInterfaceNumber        0
        bAlternateSetting       0
        bNumEndpoints           3
        bInterfaceClass         2 Communications
        bInterfaceSubClass      2 Abstract (modem)
        bInterfaceProtocol      0
        iInterface              4 ACM Control Interface
        CDC Header:
          bcdCDC               1.10
        CDC Call Management:
          bmCapabilities       0x01
            call management
          bDataInterface          0
        CDC ACM:
          bmCapabilities       0x06
            sends break
            line coding and serial state
        Endpoint Descriptor:
          bLength                 7
          bDescriptorType         5
          bEndpointAddress     0x81  EP 1 IN
          bmAttributes            3
            Transfer Type            Interrupt
            Synch Type               None
            Usage Type               Data
          wMaxPacketSize     0x0010  1x 16 bytes
          bInterval              10
        Endpoint Descriptor:
          bLength                 7
          bDescriptorType         5
          bEndpointAddress     0x82  EP 2 IN
          bmAttributes            2
            Transfer Type            Bulk
            Synch Type               None
            Usage Type               Data
          wMaxPacketSize     0x0040  1x 64 bytes
          bInterval               0
        Endpoint Descriptor:
          bLength                 7
          bDescriptorType         5
          bEndpointAddress     0x03  EP 3 OUT
          bmAttributes            2
            Transfer Type            Bulk
            Synch Type               None
            Usage Type               Data
          wMaxPacketSize     0x0040  1x 64 bytes
          bInterval               0
  Device Status:     0x0000
    (Bus Powered)

  Bus 001 Device 012: ID 108c:0168 Robert Bosch GmbH ES582
  Device Descriptor:
    bLength                18
    bDescriptorType         1
    bcdUSB               2.00
    bDeviceClass            2 Communications
    bDeviceSubClass         0
    bDeviceProtocol         0
    bMaxPacketSize0        64
    idVendor           0x108c Robert Bosch GmbH
    idProduct          0x0168
    bcdDevice            1.00
    iManufacturer           1 ETAS GmbH
    iProduct                2 ES582
    iSerial                 3 0108933
    bNumConfigurations      1
    Configuration Descriptor:
      bLength                 9
      bDescriptorType         2
      wTotalLength       0x0043
      bNumInterfaces          2
      bConfigurationValue     1
      iConfiguration          0
      bmAttributes         0x80
        (Bus Powered)
      MaxPower              500mA
      Interface Descriptor:
        bLength                 9
        bDescriptorType         4
        bInterfaceNumber        0
        bAlternateSetting       0
        bNumEndpoints           1
        bInterfaceClass         2 Communications
        bInterfaceSubClass      2 Abstract (modem)
        bInterfaceProtocol      1 AT-commands (v.25ter)
        iInterface              0
        CDC Header:
          bcdCDC               1.10
        CDC ACM:
          bmCapabilities       0x02
            line coding and serial state
        CDC Union:
          bMasterInterface        0
          bSlaveInterface         1
        CDC Call Management:
          bmCapabilities       0x03
            call management
            use DataInterface
          bDataInterface          1
        Endpoint Descriptor:
          bLength                 7
          bDescriptorType         5
          bEndpointAddress     0x83  EP 3 IN
          bmAttributes            3
            Transfer Type            Interrupt
            Synch Type               None
            Usage Type               Data
          wMaxPacketSize     0x0040  1x 64 bytes
          bInterval              16
      Interface Descriptor:
        bLength                 9
        bDescriptorType         4
        bInterfaceNumber        1
        bAlternateSetting       0
        bNumEndpoints           2
        bInterfaceClass        10 CDC Data
        bInterfaceSubClass      0
        bInterfaceProtocol      0
        iInterface              0
        Endpoint Descriptor:
          bLength                 7
          bDescriptorType         5
          bEndpointAddress     0x81  EP 1 IN
          bmAttributes            2
            Transfer Type            Bulk
            Synch Type               None
            Usage Type               Data
          wMaxPacketSize     0x0200  1x 512 bytes
          bInterval               0
        Endpoint Descriptor:
          bLength                 7
          bDescriptorType         5
          bEndpointAddress     0x02  EP 2 OUT
          bmAttributes            2
            Transfer Type            Bulk
            Synch Type               None
            Usage Type               Data
          wMaxPacketSize     0x0200  1x 512 bytes
          bInterval               0
  Device Qualifier (for other device speed):
    bLength                10
    bDescriptorType         6
    bcdUSB               2.00
    bDeviceClass            2 Communications
    bDeviceSubClass         0
    bDeviceProtocol         0
    bMaxPacketSize0        64
    bNumConfigurations      1
  Device Status:     0x0000
    (Bus Powered)

  Bus 001 Device 013: ID 108c:0169 Robert Bosch GmbH ES584.1
  Device Descriptor:
    bLength                18
    bDescriptorType         1
    bcdUSB               2.00
    bDeviceClass            2 Communications
    bDeviceSubClass         0
    bDeviceProtocol         0
    bMaxPacketSize0        64
    idVendor           0x108c Robert Bosch GmbH
    idProduct          0x0169
    bcdDevice            1.00
    iManufacturer           1 ETAS GmbH
    iProduct                2 ES584.1
    iSerial                 3 0100320
    bNumConfigurations      1
    Configuration Descriptor:
      bLength                 9
      bDescriptorType         2
      wTotalLength       0x0043
      bNumInterfaces          2
      bConfigurationValue     1
      iConfiguration          0
      bmAttributes         0x80
        (Bus Powered)
      MaxPower              500mA
      Interface Descriptor:
        bLength                 9
        bDescriptorType         4
        bInterfaceNumber        0
        bAlternateSetting       0
        bNumEndpoints           1
        bInterfaceClass         2 Communications
        bInterfaceSubClass      2 Abstract (modem)
        bInterfaceProtocol      1 AT-commands (v.25ter)
        iInterface              0
        CDC Header:
          bcdCDC               1.10
        CDC ACM:
          bmCapabilities       0x02
            line coding and serial state
        CDC Union:
          bMasterInterface        0
          bSlaveInterface         1
        CDC Call Management:
          bmCapabilities       0x03
            call management
            use DataInterface
          bDataInterface          1
        Endpoint Descriptor:
          bLength                 7
          bDescriptorType         5
          bEndpointAddress     0x83  EP 3 IN
          bmAttributes            3
            Transfer Type            Interrupt
            Synch Type               None
            Usage Type               Data
          wMaxPacketSize     0x0040  1x 64 bytes
          bInterval              16
      Interface Descriptor:
        bLength                 9
        bDescriptorType         4
        bInterfaceNumber        1
        bAlternateSetting       0
        bNumEndpoints           2
        bInterfaceClass        10 CDC Data
        bInterfaceSubClass      0
        bInterfaceProtocol      0
        iInterface              0
        Endpoint Descriptor:
          bLength                 7
          bDescriptorType         5
          bEndpointAddress     0x81  EP 1 IN
          bmAttributes            2
            Transfer Type            Bulk
            Synch Type               None
            Usage Type               Data
          wMaxPacketSize     0x0200  1x 512 bytes
          bInterval               0
        Endpoint Descriptor:
          bLength                 7
          bDescriptorType         5
          bEndpointAddress     0x02  EP 2 OUT
          bmAttributes            2
            Transfer Type            Bulk
            Synch Type               None
            Usage Type               Data
          wMaxPacketSize     0x0200  1x 512 bytes
          bInterval               0
  Device Qualifier (for other device speed):
    bLength                10
    bDescriptorType         6
    bcdUSB               2.00
    bDeviceClass            2 Communications
    bDeviceSubClass         0
    bDeviceProtocol         0
    bMaxPacketSize0        64
    bNumConfigurations      1
  Device Status:     0x0000
    (Bus Powered)

Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201002154219.4887-8-mailhol.vincent@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/cdc-acm.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 515839034dfb..fb7e56fad41c 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1897,6 +1897,17 @@ static const struct usb_device_id acm_ids[] = {
 	.driver_info = IGNORE_DEVICE,
 	},
 
+	/* Exclude ETAS ES58x */
+	{ USB_DEVICE(0x108c, 0x0159), /* ES581.4 */
+	.driver_info = IGNORE_DEVICE,
+	},
+	{ USB_DEVICE(0x108c, 0x0168), /* ES582.1 */
+	.driver_info = IGNORE_DEVICE,
+	},
+	{ USB_DEVICE(0x108c, 0x0169), /* ES584.1 */
+	.driver_info = IGNORE_DEVICE,
+	},
+
 	{ USB_DEVICE(0x1bc7, 0x0021), /* Telit 3G ACM only composition */
 	.driver_info = SEND_ZERO_PACKET,
 	},

From d834105f68e9f66866e33a34a03591708bc14241 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Mon, 28 Sep 2020 23:17:55 +0900
Subject: [PATCH 0877/2658] USB: cdc-wdm: Make wdm_flush() interruptible and
 add wdm_fsync().

commit 37d2a36394d954413a495da61da1b2a51ecd28ab upstream.

syzbot is reporting hung task at wdm_flush() [1], for there is a circular
dependency that wdm_flush() from flip_close() for /dev/cdc-wdm0 forever
waits for /dev/raw-gadget to be closed while close() for /dev/raw-gadget
cannot be called unless close() for /dev/cdc-wdm0 completes.

Tetsuo Handa considered that such circular dependency is an usage error [2]
which corresponds to an unresponding broken hardware [3]. But Alan Stern
responded that we should be prepared for such hardware [4]. Therefore,
this patch changes wdm_flush() to use wait_event_interruptible_timeout()
which gives up after 30 seconds, for hardware that remains silent must be
ignored. The 30 seconds are coming out of thin air.

Changing wait_event() to wait_event_interruptible_timeout() makes error
reporting from close() syscall less reliable. To compensate it, this patch
also implements wdm_fsync() which does not use timeout. Those who want to
be very sure that data has gone out to the device are now advised to call
fsync(), with a caveat that fsync() can return -EINVAL when running on
older kernels which do not implement wdm_fsync().

This patch also fixes three more problems (listed below) found during
exhaustive discussion and testing.

  Since multiple threads can concurrently call wdm_write()/wdm_flush(),
  we need to use wake_up_all() whenever clearing WDM_IN_USE in order to
  make sure that all waiters are woken up. Also, error reporting needs
  to use fetch-and-clear approach in order not to report same error for
  multiple times.

  Since wdm_flush() checks WDM_DISCONNECTING, wdm_write() should as well
  check WDM_DISCONNECTING.

  In wdm_flush(), since locks are not held, it is not safe to dereference
  desc->intf after checking that WDM_DISCONNECTING is not set [5]. Thus,
  remove dev_err() from wdm_flush().

[1] https://syzkaller.appspot.com/bug?id=e7b761593b23eb50855b9ea31e3be5472b711186
[2] https://lkml.kernel.org/r/27b7545e-8f41-10b8-7c02-e35a08eb1611@i-love.sakura.ne.jp
[3] https://lkml.kernel.org/r/79ba410f-e0ef-2465-b94f-6b9a4a82adf5@i-love.sakura.ne.jp
[4] https://lkml.kernel.org/r/20200530011040.GB12419@rowland.harvard.edu
[5] https://lkml.kernel.org/r/c85331fc-874c-6e46-a77f-0ef1dc075308@i-love.sakura.ne.jp

Reported-by: syzbot <syzbot+854768b99f19e89d7f81@syzkaller.appspotmail.com>
Cc: stable <stable@vger.kernel.org>
Co-developed-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20200928141755.3476-1-penguin-kernel@I-love.SAKURA.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/cdc-wdm.c | 72 ++++++++++++++++++++++++++++---------
 1 file changed, 55 insertions(+), 17 deletions(-)

diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 1a1d1cfc3704..35ee2233ad17 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -61,6 +61,9 @@ MODULE_DEVICE_TABLE (usb, wdm_ids);
 
 #define WDM_MAX			16
 
+/* we cannot wait forever at flush() */
+#define WDM_FLUSH_TIMEOUT	(30 * HZ)
+
 /* CDC-WMC r1.1 requires wMaxCommand to be "at least 256 decimal (0x100)" */
 #define WDM_DEFAULT_BUFSIZE	256
 
@@ -151,7 +154,7 @@ static void wdm_out_callback(struct urb *urb)
 	kfree(desc->outbuf);
 	desc->outbuf = NULL;
 	clear_bit(WDM_IN_USE, &desc->flags);
-	wake_up(&desc->wait);
+	wake_up_all(&desc->wait);
 }
 
 static void wdm_in_callback(struct urb *urb)
@@ -382,6 +385,9 @@ static ssize_t wdm_write
 	if (test_bit(WDM_RESETTING, &desc->flags))
 		r = -EIO;
 
+	if (test_bit(WDM_DISCONNECTING, &desc->flags))
+		r = -ENODEV;
+
 	if (r < 0) {
 		rv = r;
 		goto out_free_mem_pm;
@@ -413,6 +419,7 @@ static ssize_t wdm_write
 	if (rv < 0) {
 		desc->outbuf = NULL;
 		clear_bit(WDM_IN_USE, &desc->flags);
+		wake_up_all(&desc->wait); /* for wdm_wait_for_response() */
 		dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv);
 		rv = usb_translate_errors(rv);
 		goto out_free_mem_pm;
@@ -573,28 +580,58 @@ static ssize_t wdm_read
 	return rv;
 }
 
-static int wdm_flush(struct file *file, fl_owner_t id)
+static int wdm_wait_for_response(struct file *file, long timeout)
 {
 	struct wdm_device *desc = file->private_data;
+	long rv; /* Use long here because (int) MAX_SCHEDULE_TIMEOUT < 0. */
 
-	wait_event(desc->wait,
-			/*
-			 * needs both flags. We cannot do with one
-			 * because resetting it would cause a race
-			 * with write() yet we need to signal
-			 * a disconnect
-			 */
-			!test_bit(WDM_IN_USE, &desc->flags) ||
-			test_bit(WDM_DISCONNECTING, &desc->flags));
-
-	/* cannot dereference desc->intf if WDM_DISCONNECTING */
+	/*
+	 * Needs both flags. We cannot do with one because resetting it would
+	 * cause a race with write() yet we need to signal a disconnect.
+	 */
+	rv = wait_event_interruptible_timeout(desc->wait,
+			      !test_bit(WDM_IN_USE, &desc->flags) ||
+			      test_bit(WDM_DISCONNECTING, &desc->flags),
+			      timeout);
+
+	/*
+	 * To report the correct error. This is best effort.
+	 * We are inevitably racing with the hardware.
+	 */
 	if (test_bit(WDM_DISCONNECTING, &desc->flags))
 		return -ENODEV;
-	if (desc->werr < 0)
-		dev_err(&desc->intf->dev, "Error in flush path: %d\n",
-			desc->werr);
+	if (!rv)
+		return -EIO;
+	if (rv < 0)
+		return -EINTR;
 
-	return usb_translate_errors(desc->werr);
+	spin_lock_irq(&desc->iuspin);
+	rv = desc->werr;
+	desc->werr = 0;
+	spin_unlock_irq(&desc->iuspin);
+
+	return usb_translate_errors(rv);
+
+}
+
+/*
+ * You need to send a signal when you react to malicious or defective hardware.
+ * Also, don't abort when fsync() returned -EINVAL, for older kernels which do
+ * not implement wdm_flush() will return -EINVAL.
+ */
+static int wdm_fsync(struct file *file, loff_t start, loff_t end, int datasync)
+{
+	return wdm_wait_for_response(file, MAX_SCHEDULE_TIMEOUT);
+}
+
+/*
+ * Same with wdm_fsync(), except it uses finite timeout in order to react to
+ * malicious or defective hardware which ceased communication after close() was
+ * implicitly called due to process termination.
+ */
+static int wdm_flush(struct file *file, fl_owner_t id)
+{
+	return wdm_wait_for_response(file, WDM_FLUSH_TIMEOUT);
 }
 
 static unsigned int wdm_poll(struct file *file, struct poll_table_struct *wait)
@@ -719,6 +756,7 @@ static const struct file_operations wdm_fops = {
 	.owner =	THIS_MODULE,
 	.read =		wdm_read,
 	.write =	wdm_write,
+	.fsync =	wdm_fsync,
 	.open =		wdm_open,
 	.flush =	wdm_flush,
 	.release =	wdm_release,

From 55c2f3da86846a0cd2c40a1f86d6ffb6f957cf7f Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 29 Oct 2020 09:03:11 +0100
Subject: [PATCH 0878/2658] Linux 4.4.241

Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://lore.kernel.org/r/20201027134900.532249571@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 110652b34518..7e4d05c02429 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 240
+SUBLEVEL = 241
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From a15b34e57a1b6faace7d3fc4e72aa815f7dedba0 Mon Sep 17 00:00:00 2001
From: NeilBrown <neilb@suse.com>
Date: Fri, 18 Aug 2017 17:12:51 +1000
Subject: [PATCH 0879/2658] SUNRPC: ECONNREFUSED should cause a rebind.

commit fd01b2597941d9c17980222999b0721648b383b8 upstream.

If you
 - mount and NFSv3 filesystem
 - do some file locking which requires the server
   to make a GRANT call back
 - unmount
 - mount again and do the same locking

then the second attempt at locking suffers a 30 second delay.
Unmounting and remounting causes lockd to stop and restart,
which causes it to bind to a new port.
The server still thinks the old port is valid and gets ECONNREFUSED
when trying to contact it.
ECONNREFUSED should be seen as a hard error that is not worth
retrying.  Rebinding is the only reasonable response.

This patch forces a rebind if that makes sense.

Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Cc: Calum Mackay <calum.mackay@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/clnt.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index f28aeb2cfd32..cc308f7a2c02 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1826,6 +1826,14 @@ call_connect_status(struct rpc_task *task)
 	task->tk_status = 0;
 	switch (status) {
 	case -ECONNREFUSED:
+		/* A positive refusal suggests a rebind is needed. */
+		if (RPC_IS_SOFTCONN(task))
+			break;
+		if (clnt->cl_autobind) {
+			rpc_force_rebind(clnt);
+			task->tk_action = call_bind;
+			return;
+		}
 	case -ECONNRESET:
 	case -ECONNABORTED:
 	case -ENETUNREACH:

From fc70d511dd2dcf57aa039c4303330df7e64b6400 Mon Sep 17 00:00:00 2001
From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Date: Thu, 17 Sep 2020 08:56:11 +0200
Subject: [PATCH 0880/2658] scripts/setlocalversion: make git describe output
 more reliable

commit 548b8b5168c90c42e88f70fcf041b4ce0b8e7aa8 upstream.

When building for an embedded target using Yocto, we're sometimes
observing that the version string that gets built into vmlinux (and
thus what uname -a reports) differs from the path under /lib/modules/
where modules get installed in the rootfs, but only in the length of
the -gabc123def suffix. Hence modprobe always fails.

The problem is that Yocto has the concept of "sstate" (shared state),
which allows different developers/buildbots/etc. to share build
artifacts, based on a hash of all the metadata that went into building
that artifact - and that metadata includes all dependencies (e.g. the
compiler used etc.). That normally works quite well; usually a clean
build (without using any sstate cache) done by one developer ends up
being binary identical to a build done on another host. However, one
thing that can cause two developers to end up with different builds
[and thus make one's vmlinux package incompatible with the other's
kernel-dev package], which is not captured by the metadata hashing, is
this `git describe`: The output of that can be affected by

(1) git version: before 2.11 git defaulted to a minimum of 7, since
2.11 (git.git commit e6c587) the default is dynamic based on the
number of objects in the repo
(2) hence even if both run the same git version, the output can differ
based on how many remotes are being tracked (or just lots of local
development branches or plain old garbage)
(3) and of course somebody could have a core.abbrev config setting in
~/.gitconfig

So in order to avoid `uname -a` output relying on such random details
of the build environment which are rather hard to ensure are
consistent between developers and buildbots, make sure the abbreviated
sha1 always consists of exactly 12 hex characters. That is consistent
with the current rule for -stable patches, and is almost always enough
to identify the head commit unambigously - in the few cases where it
does not, the v5.4.3-00021- prefix would certainly nail it down.

[Adapt to `` vs $() differences between 5.4 and upstream.]
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 scripts/setlocalversion | 25 +++++++++++++++++--------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/scripts/setlocalversion b/scripts/setlocalversion
index 1bbde3a91099..c1b10a7ff4c5 100755
--- a/scripts/setlocalversion
+++ b/scripts/setlocalversion
@@ -44,7 +44,7 @@ scm_version()
 
 	# Check for git and a git repo.
 	if test -z "$(git rev-parse --show-cdup 2>/dev/null)" &&
-	   head=`git rev-parse --verify --short HEAD 2>/dev/null`; then
+	   head=$(git rev-parse --verify HEAD 2>/dev/null); then
 
 		# If we are at a tagged commit (like "v2.6.30-rc6"), we ignore
 		# it, because this version is defined in the top level Makefile.
@@ -70,14 +70,23 @@ scm_version()
 				return
 			fi
 			# If we are past a tagged commit (like
-			# "v2.6.30-rc5-302-g72357d5"), we pretty print it and
-			# include the hash of any new tag on top.
-			if atag="`git describe 2>/dev/null`"; then
-				tag="`git describe --abbrev=0 2>/dev/null`"
-				commit="`echo "$atag" | awk -F- '{printf("-%05d-%s", $(NF-1),$(NF))}'`"
-				printf '%s%s%s' -g "`git show-ref -s --abbrev --tags $tag 2>/dev/null`" $commit
-			# If we don't have a tag at all we print -g{commitish}.
+			# "v2.6.30-rc5-302-g72357d5"), we pretty print it.
+			#
+			# Ensure the abbreviated sha1 has exactly 12
+			# hex characters, to make the output
+			# independent of git version, local
+			# core.abbrev settings and/or total number of
+			# objects in the current repository - passing
+			# --abbrev=12 ensures a minimum of 12, and the
+			# awk substr() then picks the 'g' and first 12
+			# hex chars.
+			if atag="$(git describe --abbrev=12 2>/dev/null)"; then
+				echo "$atag" | awk -F- '{printf("-%05d-%s", $(NF-1),substr($(NF),0,13))}'
+
+			# If we don't have a tag at all we print -g{commitish},
+			# again using exactly 12 hex chars.
 			else
+				head="$(echo $head | cut -c1-12)"
 				printf '%s%s' -g $head
 			fi
 		fi

From 315ca04c9c6f7990dddd844c93775dc06a475791 Mon Sep 17 00:00:00 2001
From: Mukesh Ojha <mukesh02@linux.vnet.ibm.com>
Date: Mon, 20 Feb 2017 18:52:11 +0530
Subject: [PATCH 0881/2658] powerpc/powernv/opal-dump : Use IRQ_HANDLED instead
 of numbers in interrupt handler

commit b29336c0e1785a28bc40a9fd47c2321671e9792e upstream.

Fixes: 8034f715f ("powernv/opal-dump: Convert to irq domain")

Converts all the return explicit number to a more proper IRQ_HANDLED,
which looks proper incase of interrupt handler returning case.

Here, It also removes error message like "nobody cared" which was
getting unveiled while returning -1 or 0 from handler.

Signed-off-by: Mukesh Ojha <mukesh02@linux.vnet.ibm.com>
Reviewed-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Cc: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/platforms/powernv/opal-dump.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/arch/powerpc/platforms/powernv/opal-dump.c b/arch/powerpc/platforms/powernv/opal-dump.c
index e21e2c0af69d..1a8b6e276a11 100644
--- a/arch/powerpc/platforms/powernv/opal-dump.c
+++ b/arch/powerpc/platforms/powernv/opal-dump.c
@@ -385,13 +385,12 @@ static irqreturn_t process_dump(int irq, void *data)
 {
 	int rc;
 	uint32_t dump_id, dump_size, dump_type;
-	struct dump_obj *dump;
 	char name[22];
 	struct kobject *kobj;
 
 	rc = dump_read_info(&dump_id, &dump_size, &dump_type);
 	if (rc != OPAL_SUCCESS)
-		return rc;
+		return IRQ_HANDLED;
 
 	sprintf(name, "0x%x-0x%x", dump_type, dump_id);
 
@@ -403,12 +402,10 @@ static irqreturn_t process_dump(int irq, void *data)
 	if (kobj) {
 		/* Drop reference added by kset_find_obj() */
 		kobject_put(kobj);
-		return 0;
+		return IRQ_HANDLED;
 	}
 
-	dump = create_dump_obj(dump_id, dump_size, dump_type);
-	if (!dump)
-		return -1;
+	create_dump_obj(dump_id, dump_size, dump_type);
 
 	return IRQ_HANDLED;
 }

From b1173292c386072c399b6d784be61b7f4e8d3a6c Mon Sep 17 00:00:00 2001
From: Michael Schaller <misch@google.com>
Date: Fri, 25 Sep 2020 09:45:02 +0200
Subject: [PATCH 0882/2658] efivarfs: Replace invalid slashes with exclamation
 marks in dentries.

commit 336af6a4686d885a067ecea8c3c3dd129ba4fc75 upstream.

Without this patch efivarfs_alloc_dentry creates dentries with slashes in
their name if the respective EFI variable has slashes in its name. This in
turn causes EIO on getdents64, which prevents a complete directory listing
of /sys/firmware/efi/efivars/.

This patch replaces the invalid shlashes with exclamation marks like
kobject_set_name_vargs does for /sys/firmware/efi/vars/ to have consistently
named dentries under /sys/firmware/efi/vars/ and /sys/firmware/efi/efivars/.

Signed-off-by: Michael Schaller <misch@google.com>
Link: https://lore.kernel.org/r/20200925074502.150448-1-misch@google.com
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: dann frazier <dann.frazier@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/efivarfs/super.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
index abb244b06024..fca235020312 100644
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -147,6 +147,9 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
 
 	name[len + EFI_VARIABLE_GUID_LEN+1] = '\0';
 
+	/* replace invalid slashes like kobject_set_name_vargs does for /sys/firmware/efi/vars. */
+	strreplace(name, '/', '!');
+
 	inode = efivarfs_get_inode(sb, d_inode(root), S_IFREG | 0644, 0,
 				   is_removable);
 	if (!inode)

From 219b988a9dc6706496bb87326e17738822b9a5b3 Mon Sep 17 00:00:00 2001
From: Andrew Gabbasov <andrew_gabbasov@mentor.com>
Date: Mon, 26 Oct 2020 05:21:30 -0500
Subject: [PATCH 0883/2658] ravb: Fix bit fields checking in
 ravb_hwtstamp_get()

[ Upstream commit 68b9f0865b1ef545da180c57d54b82c94cb464a4 ]

In the function ravb_hwtstamp_get() in ravb_main.c with the existing
values for RAVB_RXTSTAMP_TYPE_V2_L2_EVENT (0x2) and RAVB_RXTSTAMP_TYPE_ALL
(0x6)

if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_V2_L2_EVENT)
	config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
else if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_ALL)
	config.rx_filter = HWTSTAMP_FILTER_ALL;

if the test on RAVB_RXTSTAMP_TYPE_ALL should be true,
it will never be reached.

This issue can be verified with 'hwtstamp_config' testing program
(tools/testing/selftests/net/hwtstamp_config.c). Setting filter type
to ALL and subsequent retrieving it gives incorrect value:

$ hwtstamp_config eth0 OFF ALL
flags = 0
tx_type = OFF
rx_filter = ALL
$ hwtstamp_config eth0
flags = 0
tx_type = OFF
rx_filter = PTP_V2_L2_EVENT

Correct this by converting if-else's to switch.

Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
Reported-by: Julia Lawall <julia.lawall@inria.fr>
Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@gmail.com>
Link: https://lore.kernel.org/r/20201026102130.29368-1-andrew_gabbasov@mentor.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/renesas/ravb_main.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 460b29ac5fd8..c6850287362b 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1572,12 +1572,16 @@ static int ravb_hwtstamp_get(struct net_device *ndev, struct ifreq *req)
 	config.flags = 0;
 	config.tx_type = priv->tstamp_tx_ctrl ? HWTSTAMP_TX_ON :
 						HWTSTAMP_TX_OFF;
-	if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_V2_L2_EVENT)
+	switch (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE) {
+	case RAVB_RXTSTAMP_TYPE_V2_L2_EVENT:
 		config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
-	else if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_ALL)
+		break;
+	case RAVB_RXTSTAMP_TYPE_ALL:
 		config.rx_filter = HWTSTAMP_FILTER_ALL;
-	else
+		break;
+	default:
 		config.rx_filter = HWTSTAMP_FILTER_NONE;
+	}
 
 	return copy_to_user(req->ifr_data, &config, sizeof(config)) ?
 		-EFAULT : 0;

From 3e76af1856b693cec82d2ff9c0d36abccfec9e17 Mon Sep 17 00:00:00 2001
From: Tung Nguyen <tung.q.nguyen@dektech.com.au>
Date: Tue, 27 Oct 2020 10:24:03 +0700
Subject: [PATCH 0884/2658] tipc: fix memory leak caused by tipc_buf_append()

[ Upstream commit ceb1eb2fb609c88363e06618b8d4bbf7815a4e03 ]

Commit ed42989eab57 ("tipc: fix the skb_unshare() in tipc_buf_append()")
replaced skb_unshare() with skb_copy() to not reduce the data reference
counter of the original skb intentionally. This is not the correct
way to handle the cloned skb because it causes memory leak in 2
following cases:
 1/ Sending multicast messages via broadcast link
  The original skb list is cloned to the local skb list for local
  destination. After that, the data reference counter of each skb
  in the original list has the value of 2. This causes each skb not
  to be freed after receiving ACK:
  tipc_link_advance_transmq()
  {
   ...
   /* release skb */
   __skb_unlink(skb, &l->transmq);
   kfree_skb(skb); <-- memory exists after being freed
  }

 2/ Sending multicast messages via replicast link
  Similar to the above case, each skb cannot be freed after purging
  the skb list:
  tipc_mcast_xmit()
  {
   ...
   __skb_queue_purge(pkts); <-- memory exists after being freed
  }

This commit fixes this issue by using skb_unshare() instead. Besides,
to avoid use-after-free error reported by KASAN, the pointer to the
fragment is set to NULL before calling skb_unshare() to make sure that
the original skb is not freed after freeing the fragment 2 times in
case skb_unshare() returns NULL.

Fixes: ed42989eab57 ("tipc: fix the skb_unshare() in tipc_buf_append()")
Acked-by: Jon Maloy <jmaloy@redhat.com>
Reported-by: Thang Hoang Ngo <thang.h.ngo@dektech.com.au>
Signed-off-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Link: https://lore.kernel.org/r/20201027032403.1823-1-tung.q.nguyen@dektech.com.au
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tipc/msg.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 30c3a7985fa4..f3c7e5d1fc57 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -138,12 +138,11 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
 	if (fragid == FIRST_FRAGMENT) {
 		if (unlikely(head))
 			goto err;
-		if (skb_cloned(frag))
-			frag = skb_copy(frag, GFP_ATOMIC);
+		*buf = NULL;
+		frag = skb_unshare(frag, GFP_ATOMIC);
 		if (unlikely(!frag))
 			goto err;
 		head = *headbuf = frag;
-		*buf = NULL;
 		TIPC_SKB_CB(head)->tail = NULL;
 		if (skb_is_nonlinear(head)) {
 			skb_walk_frags(head, tail) {

From bd3095c213560df34fe2b8e7cf74c261a1e950b3 Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
Date: Mon, 27 Apr 2020 14:50:37 -0500
Subject: [PATCH 0885/2658] mtd: lpddr: Fix bad logic in print_drs_error

commit 1c9c02bb22684f6949d2e7ddc0a3ff364fd5a6fc upstream.

Update logic for broken test. Use a more common logging style.

It appears the logic in this function is broken for the
consecutive tests of

        if (prog_status & 0x3)
                ...
        else if (prog_status & 0x2)
                ...
        else (prog_status & 0x1)
                ...

Likely the first test should be

        if ((prog_status & 0x3) == 0x3)

Found by inspection of include files using printk.

Fixes: eb3db27507f7 ("[MTD] LPDDR PFOW definition")
Cc: stable@vger.kernel.org
Reported-by: Joe Perches <joe@perches.com>
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Acked-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/3fb0e29f5b601db8be2938a01d974b00c8788501.1588016644.git.gustavo@embeddedor.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/mtd/pfow.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/mtd/pfow.h b/include/linux/mtd/pfow.h
index 42ff7ff09bf5..09404fb36b34 100644
--- a/include/linux/mtd/pfow.h
+++ b/include/linux/mtd/pfow.h
@@ -127,7 +127,7 @@ static inline void print_drs_error(unsigned dsr)
 
 	if (!(dsr & DSR_AVAILABLE))
 		printk(KERN_NOTICE"DSR.15: (0) Device not Available\n");
-	if (prog_status & 0x03)
+	if ((prog_status & 0x03) == 0x03)
 		printk(KERN_NOTICE"DSR.9,8: (11) Attempt to program invalid "
 						"half with 41h command\n");
 	else if (prog_status & 0x02)

From 81e2a2b89d75eaf9d1858a51792ad2265f40b4dd Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Thu, 17 Sep 2020 15:09:20 +0200
Subject: [PATCH 0886/2658] ata: sata_rcar: Fix DMA boundary mask

commit df9c590986fdb6db9d5636d6cd93bc919c01b451 upstream.

Before commit 9495b7e92f716ab2 ("driver core: platform: Initialize
dma_parms for platform devices"), the R-Car SATA device didn't have DMA
parameters.  Hence the DMA boundary mask supplied by its driver was
silently ignored, as __scsi_init_queue() doesn't check the return value
of dma_set_seg_boundary(), and the default value of 0xffffffff was used.

Now the device has gained DMA parameters, the driver-supplied value is
used, and the following warning is printed on Salvator-XS:

    DMA-API: sata_rcar ee300000.sata: mapping sg segment across boundary [start=0x00000000ffffe000] [end=0x00000000ffffefff] [boundary=0x000000001ffffffe]
    WARNING: CPU: 5 PID: 38 at kernel/dma/debug.c:1233 debug_dma_map_sg+0x298/0x300

(the range of start/end values depend on whether IOMMU support is
 enabled or not)

The issue here is that SATA_RCAR_DMA_BOUNDARY doesn't have bit 0 set, so
any typical end value, which is odd, will trigger the check.

Fix this by increasing the DMA boundary value by 1.

This also fixes the following WRITE DMA EXT timeout issue:

    # dd if=/dev/urandom of=/mnt/de1/file1-1024M bs=1M count=1024
    ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x6 frozen
    ata1.00: failed command: WRITE DMA EXT
    ata1.00: cmd 35/00:00:00:e6:0c/00:0a:00:00:00/e0 tag 0 dma 1310720 out
    res 40/00:01:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout)
    ata1.00: status: { DRDY }

as seen by Shimoda-san since commit 429120f3df2dba2b ("block: fix
splitting segments on boundary masks").

Fixes: 8bfbeed58665dbbf ("sata_rcar: correct 'sata_rcar_sht'")
Fixes: 9495b7e92f716ab2 ("driver core: platform: Initialize dma_parms for platform devices")
Fixes: 429120f3df2dba2b ("block: fix splitting segments on boundary masks")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ata/sata_rcar.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
index 4199f7a39be0..3adfba441b43 100644
--- a/drivers/ata/sata_rcar.c
+++ b/drivers/ata/sata_rcar.c
@@ -122,7 +122,7 @@
 /* Descriptor table word 0 bit (when DTA32M = 1) */
 #define SATA_RCAR_DTEND			BIT(0)
 
-#define SATA_RCAR_DMA_BOUNDARY		0x1FFFFFFEUL
+#define SATA_RCAR_DMA_BOUNDARY		0x1FFFFFFFUL
 
 /* Gen2 Physical Layer Control Registers */
 #define RCAR_GEN2_PHY_CTL1_REG		0x1704

From 6b679318f5cf08da0625ef55e60ee20659bfe558 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Tue, 22 Jan 2019 16:20:21 -0800
Subject: [PATCH 0887/2658] fscrypt: return -EXDEV for incompatible rename or
 link into encrypted dir

commit f5e55e777cc93eae1416f0fa4908e8846b6d7825 upstream.

Currently, trying to rename or link a regular file, directory, or
symlink into an encrypted directory fails with EPERM when the source
file is unencrypted or is encrypted with a different encryption policy,
and is on the same mountpoint.  It is correct for the operation to fail,
but the choice of EPERM breaks tools like 'mv' that know to copy rather
than rename if they see EXDEV, but don't know what to do with EPERM.

Our original motivation for EPERM was to encourage users to securely
handle their data.  Encrypting files by "moving" them into an encrypted
directory can be insecure because the unencrypted data may remain in
free space on disk, where it can later be recovered by an attacker.
It's much better to encrypt the data from the start, or at least try to
securely delete the source data e.g. using the 'shred' program.

However, the current behavior hasn't been effective at achieving its
goal because users tend to be confused, hack around it, and complain;
see e.g. https://github.com/google/fscrypt/issues/76.  And in some cases
it's actually inconsistent or unnecessary.  For example, 'mv'-ing files
between differently encrypted directories doesn't work even in cases
where it can be secure, such as when in userspace the same passphrase
protects both directories.  Yet, you *can* already 'mv' unencrypted
files into an encrypted directory if the source files are on a different
mountpoint, even though doing so is often insecure.

There are probably better ways to teach users to securely handle their
files.  For example, the 'fscrypt' userspace tool could provide a
command that migrates unencrypted files into an encrypted directory,
acting like 'shred' on the source files and providing appropriate
warnings depending on the type of the source filesystem and disk.

Receiving errors on unimportant files might also force some users to
disable encryption, thus making the behavior counterproductive.  It's
desirable to make encryption as unobtrusive as possible.

Therefore, change the error code from EPERM to EXDEV so that tools
looking for EXDEV will fall back to a copy.

This, of course, doesn't prevent users from still doing the right things
to securely manage their files.  Note that this also matches the
behavior when a file is renamed between two project quota hierarchies;
so there's precedent for using EXDEV for things other than mountpoints.

xfstests generic/398 will require an update with this change.

[Rewritten from an earlier patch series by Michael Halcrow.]

Cc: Michael Halcrow <mhalcrow@google.com>
Cc: Joe Richey <joerichey@google.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/namei.c | 6 +++---
 fs/f2fs/namei.c | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index e7378688736c..c8c104fb3fec 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3215,7 +3215,7 @@ static int ext4_link(struct dentry *old_dentry,
 		return -EMLINK;
 	if (ext4_encrypted_inode(dir) &&
 	    !ext4_is_child_context_consistent_with_parent(dir, inode))
-		return -EPERM;
+		return -EXDEV;
 	err = dquot_initialize(dir);
 	if (err)
 		return err;
@@ -3534,7 +3534,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
 	    ext4_encrypted_inode(new.dir) &&
 	    !ext4_is_child_context_consistent_with_parent(new.dir,
 							  old.inode)) {
-		retval = -EPERM;
+		retval = -EXDEV;
 		goto end_rename;
 	}
 
@@ -3715,7 +3715,7 @@ static int ext4_cross_rename(struct inode *old_dir, struct dentry *old_dentry,
 							   old.inode) ||
 	     !ext4_is_child_context_consistent_with_parent(old_dir,
 							   new.inode)))
-		return -EPERM;
+		return -EXDEV;
 
 	retval = dquot_initialize(old.dir);
 	if (retval)
diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
index e5553cd8fe4e..1475a00ae7c8 100644
--- a/fs/f2fs/namei.c
+++ b/fs/f2fs/namei.c
@@ -169,7 +169,7 @@ static int f2fs_link(struct dentry *old_dentry, struct inode *dir,
 
 	if (f2fs_encrypted_inode(dir) &&
 		!f2fs_is_child_context_consistent_with_parent(dir, inode))
-		return -EPERM;
+		return -EXDEV;
 
 	f2fs_balance_fs(sbi);
 
@@ -597,7 +597,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
 	if ((old_dir != new_dir) && f2fs_encrypted_inode(new_dir) &&
 		!f2fs_is_child_context_consistent_with_parent(new_dir,
 							old_inode)) {
-		err = -EPERM;
+		err = -EXDEV;
 		goto out;
 	}
 
@@ -758,7 +758,7 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry,
 								old_inode) ||
 		!f2fs_is_child_context_consistent_with_parent(old_dir,
 								new_inode)))
-		return -EPERM;
+		return -EXDEV;
 
 	f2fs_balance_fs(sbi);
 

From f885db15b1875c01c78fc6cf1e0ce68e57668977 Mon Sep 17 00:00:00 2001
From: Chao Yu <yuchao0@huawei.com>
Date: Sun, 28 Aug 2016 22:00:12 +0800
Subject: [PATCH 0888/2658] f2fs crypto: avoid unneeded memory allocation in
 ->readdir

commit e06f86e61d7a67fe6e826010f57aa39c674f4b1b upstream.

When decrypting dirents in ->readdir, fscrypt_fname_disk_to_usr won't
change content of original encrypted dirent, we don't need to allocate
additional buffer for storing mirror of it, so get rid of it.

[This backport fixes a regression in 4.4-stable caused by commit
11a6e8f89521 ("f2fs: check memory boundary by insane namelen"), which
depended on this missing commit.  This bad backport broke f2fs
encryption because it moved the incrementing of 'bit_pos' to earlier in
f2fs_fill_dentries() without accounting for it being used in the
encrypted dir case.  This caused readdir() on encrypted directories to
start failing.  Tested with 'kvm-xfstests -c f2fs -g encrypt'.]

Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/f2fs/dir.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index e2ff0eb16f89..c1130914d6ed 100644
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -820,15 +820,8 @@ bool f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
 			int save_len = fstr->len;
 			int ret;
 
-			de_name.name = kmalloc(de_name.len, GFP_NOFS);
-			if (!de_name.name)
-				return false;
-
-			memcpy(de_name.name, d->filename[bit_pos], de_name.len);
-
 			ret = f2fs_fname_disk_to_usr(d->inode, &de->hash_code,
 							&de_name, fstr);
-			kfree(de_name.name);
 			if (ret < 0)
 				return true;
 

From 25bc363861cbb33fb7266459b990a9b3bba00f1f Mon Sep 17 00:00:00 2001
From: Oliver O'Halloran <oohall@gmail.com>
Date: Tue, 4 Aug 2020 10:54:05 +1000
Subject: [PATCH 0889/2658] powerpc/powernv/smp: Fix spurious DBG() warning
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit f6bac19cf65c5be21d14a0c9684c8f560f2096dd ]

When building with W=1 we get the following warning:

 arch/powerpc/platforms/powernv/smp.c: In function ‘pnv_smp_cpu_kill_self’:
 arch/powerpc/platforms/powernv/smp.c:276:16: error: suggest braces around
 	empty body in an ‘if’ statement [-Werror=empty-body]
   276 |      cpu, srr1);
       |                ^
 cc1: all warnings being treated as errors

The full context is this block:

 if (srr1 && !generic_check_cpu_restart(cpu))
 	DBG("CPU%d Unexpected exit while offline srr1=%lx!\n",
 			cpu, srr1);

When building with DEBUG undefined DBG() expands to nothing and GCC emits
the warning due to the lack of braces around an empty statement.

Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200804005410.146094-2-oohall@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/powernv/smp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
index ad7b1a3dbed0..c605c78a8089 100644
--- a/arch/powerpc/platforms/powernv/smp.c
+++ b/arch/powerpc/platforms/powernv/smp.c
@@ -41,7 +41,7 @@
 #include <asm/udbg.h>
 #define DBG(fmt...) udbg_printf(fmt)
 #else
-#define DBG(fmt...)
+#define DBG(fmt...) do { } while (0)
 #endif
 
 static void pnv_smp_setup_cpu(int cpu)

From c2964a62aa4b2eab22af1853094de9f9fd19de99 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 14 Sep 2020 14:52:18 +1000
Subject: [PATCH 0890/2658] sparc64: remove mm_cpumask clearing to fix
 kthread_use_mm race

[ Upstream commit bafb056ce27940c9994ea905336aa8f27b4f7275 ]

The de facto (and apparently uncommented) standard for using an mm had,
thanks to this code in sparc if nothing else, been that you must have a
reference on mm_users *and that reference must have been obtained with
mmget()*, i.e., from a thread with a reference to mm_users that had used
the mm.

The introduction of mmget_not_zero() in commit d2005e3f41d4
("userfaultfd: don't pin the user memory in userfaultfd_file_create()")
allowed mm_count holders to aoperate on user mappings asynchronously
from the actual threads using the mm, but they were not to load those
mappings into their TLB (i.e., walking vmas and page tables is okay,
kthread_use_mm() is not).

io_uring 2b188cc1bb857 ("Add io_uring IO interface") added code which
does a kthread_use_mm() from a mmget_not_zero() refcount.

The problem with this is code which previously assumed mm == current->mm
and mm->mm_users == 1 implies the mm will remain single-threaded at
least until this thread creates another mm_users reference, has now
broken.

arch/sparc/kernel/smp_64.c:

    if (atomic_read(&mm->mm_users) == 1) {
        cpumask_copy(mm_cpumask(mm), cpumask_of(cpu));
        goto local_flush_and_out;
    }

vs fs/io_uring.c

    if (unlikely(!(ctx->flags & IORING_SETUP_SQPOLL) ||
                 !mmget_not_zero(ctx->sqo_mm)))
        return -EFAULT;
    kthread_use_mm(ctx->sqo_mm);

mmget_not_zero() could come in right after the mm_users == 1 test, then
kthread_use_mm() which sets its CPU in the mm_cpumask. That update could
be lost if cpumask_copy() occurs afterward.

I propose we fix this by allowing mmget_not_zero() to be a first-class
reference, and not have this obscure undocumented and unchecked
restriction.

The basic fix for sparc64 is to remove its mm_cpumask clearing code. The
optimisation could be effectively restored by sending IPIs to mm_cpumask
members and having them remove themselves from mm_cpumask. This is more
tricky so I leave it as an exercise for someone with a sparc64 SMP.
powerpc has a (currently similarly broken) example.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200914045219.3736466-4-npiggin@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/sparc/kernel/smp_64.c | 65 ++++++++------------------------------
 1 file changed, 14 insertions(+), 51 deletions(-)

diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index 46866b2097e8..bd27e86ce36d 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -1030,38 +1030,9 @@ void smp_fetch_global_pmu(void)
  * are flush_tlb_*() routines, and these run after flush_cache_*()
  * which performs the flushw.
  *
- * The SMP TLB coherency scheme we use works as follows:
- *
- * 1) mm->cpu_vm_mask is a bit mask of which cpus an address
- *    space has (potentially) executed on, this is the heuristic
- *    we use to avoid doing cross calls.
- *
- *    Also, for flushing from kswapd and also for clones, we
- *    use cpu_vm_mask as the list of cpus to make run the TLB.
- *
- * 2) TLB context numbers are shared globally across all processors
- *    in the system, this allows us to play several games to avoid
- *    cross calls.
- *
- *    One invariant is that when a cpu switches to a process, and
- *    that processes tsk->active_mm->cpu_vm_mask does not have the
- *    current cpu's bit set, that tlb context is flushed locally.
- *
- *    If the address space is non-shared (ie. mm->count == 1) we avoid
- *    cross calls when we want to flush the currently running process's
- *    tlb state.  This is done by clearing all cpu bits except the current
- *    processor's in current->mm->cpu_vm_mask and performing the
- *    flush locally only.  This will force any subsequent cpus which run
- *    this task to flush the context from the local tlb if the process
- *    migrates to another cpu (again).
- *
- * 3) For shared address spaces (threads) and swapping we bite the
- *    bullet for most cases and perform the cross call (but only to
- *    the cpus listed in cpu_vm_mask).
- *
- *    The performance gain from "optimizing" away the cross call for threads is
- *    questionable (in theory the big win for threads is the massive sharing of
- *    address space state across processors).
+ * mm->cpu_vm_mask is a bit mask of which cpus an address
+ * space has (potentially) executed on, this is the heuristic
+ * we use to limit cross calls.
  */
 
 /* This currently is only used by the hugetlb arch pre-fault
@@ -1071,18 +1042,13 @@ void smp_fetch_global_pmu(void)
 void smp_flush_tlb_mm(struct mm_struct *mm)
 {
 	u32 ctx = CTX_HWBITS(mm->context);
-	int cpu = get_cpu();
 
-	if (atomic_read(&mm->mm_users) == 1) {
-		cpumask_copy(mm_cpumask(mm), cpumask_of(cpu));
-		goto local_flush_and_out;
-	}
+	get_cpu();
 
 	smp_cross_call_masked(&xcall_flush_tlb_mm,
 			      ctx, 0, 0,
 			      mm_cpumask(mm));
 
-local_flush_and_out:
 	__flush_tlb_mm(ctx, SECONDARY_CONTEXT);
 
 	put_cpu();
@@ -1105,17 +1071,15 @@ void smp_flush_tlb_pending(struct mm_struct *mm, unsigned long nr, unsigned long
 {
 	u32 ctx = CTX_HWBITS(mm->context);
 	struct tlb_pending_info info;
-	int cpu = get_cpu();
+
+	get_cpu();
 
 	info.ctx = ctx;
 	info.nr = nr;
 	info.vaddrs = vaddrs;
 
-	if (mm == current->mm && atomic_read(&mm->mm_users) == 1)
-		cpumask_copy(mm_cpumask(mm), cpumask_of(cpu));
-	else
-		smp_call_function_many(mm_cpumask(mm), tlb_pending_func,
-				       &info, 1);
+	smp_call_function_many(mm_cpumask(mm), tlb_pending_func,
+			       &info, 1);
 
 	__flush_tlb_pending(ctx, nr, vaddrs);
 
@@ -1125,14 +1089,13 @@ void smp_flush_tlb_pending(struct mm_struct *mm, unsigned long nr, unsigned long
 void smp_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr)
 {
 	unsigned long context = CTX_HWBITS(mm->context);
-	int cpu = get_cpu();
 
-	if (mm == current->mm && atomic_read(&mm->mm_users) == 1)
-		cpumask_copy(mm_cpumask(mm), cpumask_of(cpu));
-	else
-		smp_cross_call_masked(&xcall_flush_tlb_page,
-				      context, vaddr, 0,
-				      mm_cpumask(mm));
+	get_cpu();
+
+	smp_cross_call_masked(&xcall_flush_tlb_page,
+			      context, vaddr, 0,
+			      mm_cpumask(mm));
+
 	__flush_tlb_page(context, vaddr);
 
 	put_cpu();

From c29e8e5b09b81e53df8b3ee045c514981bcbcb8f Mon Sep 17 00:00:00 2001
From: Chao Yu <yuchao0@huawei.com>
Date: Tue, 29 Sep 2020 09:23:12 +0800
Subject: [PATCH 0891/2658] f2fs: fix to check segment boundary during SIT page
 readahead

[ Upstream commit 6a257471fa42c8c9c04a875cd3a2a22db148e0f0 ]

As syzbot reported:

kernel BUG at fs/f2fs/segment.h:657!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 16220 Comm: syz-executor.0 Not tainted 5.9.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:f2fs_ra_meta_pages+0xa51/0xdc0 fs/f2fs/segment.h:657
Call Trace:
 build_sit_entries fs/f2fs/segment.c:4195 [inline]
 f2fs_build_segment_manager+0x4b8a/0xa3c0 fs/f2fs/segment.c:4779
 f2fs_fill_super+0x377d/0x6b80 fs/f2fs/super.c:3633
 mount_bdev+0x32e/0x3f0 fs/super.c:1417
 legacy_get_tree+0x105/0x220 fs/fs_context.c:592
 vfs_get_tree+0x89/0x2f0 fs/super.c:1547
 do_new_mount fs/namespace.c:2875 [inline]
 path_mount+0x1387/0x2070 fs/namespace.c:3192
 do_mount fs/namespace.c:3205 [inline]
 __do_sys_mount fs/namespace.c:3413 [inline]
 __se_sys_mount fs/namespace.c:3390 [inline]
 __x64_sys_mount+0x27f/0x300 fs/namespace.c:3390
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

@blkno in f2fs_ra_meta_pages could exceed max segment count, causing panic
in following sanity check in current_sit_addr(), add check condition to
avoid this issue.

Reported-by: syzbot+3698081bcf0bb2d12174@syzkaller.appspotmail.com
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/checkpoint.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index 4b2f609f376d..047da0f10527 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -188,6 +188,8 @@ int ra_meta_pages(struct f2fs_sb_info *sbi, block_t start, int nrpages,
 					blkno * NAT_ENTRY_PER_BLOCK);
 			break;
 		case META_SIT:
+			if (unlikely(blkno >= TOTAL_SEGS(sbi)))
+				goto out;
 			/* get sit block addr */
 			fio.blk_addr = current_sit_addr(sbi,
 					blkno * SIT_ENTRY_PER_BLOCK);

From d84b44e0e11a83758157341515a216012ca7e6a2 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Thu, 4 Jun 2020 13:23:17 +0200
Subject: [PATCH 0892/2658] um: change sigio_spinlock to a mutex

[ Upstream commit f2d05059e15af3f70502074f4e3a504530af504a ]

Lockdep complains at boot:

=============================
[ BUG: Invalid wait context ]
5.7.0-05093-g46d91ecd597b #98 Not tainted
-----------------------------
swapper/1 is trying to lock:
0000000060931b98 (&desc[i].request_mutex){+.+.}-{3:3}, at: __setup_irq+0x11d/0x623
other info that might help us debug this:
context-{4:4}
1 lock held by swapper/1:
 #0: 000000006074fed8 (sigio_spinlock){+.+.}-{2:2}, at: sigio_lock+0x1a/0x1c
stack backtrace:
CPU: 0 PID: 1 Comm: swapper Not tainted 5.7.0-05093-g46d91ecd597b #98
Stack:
 7fa4fab0 6028dfd1 0000002a 6008bea5
 7fa50700 7fa50040 7fa4fac0 6028e016
 7fa4fb50 6007f6da 60959c18 00000000
Call Trace:
 [<60023a0e>] show_stack+0x13b/0x155
 [<6028e016>] dump_stack+0x2a/0x2c
 [<6007f6da>] __lock_acquire+0x515/0x15f2
 [<6007eb50>] lock_acquire+0x245/0x273
 [<6050d9f1>] __mutex_lock+0xbd/0x325
 [<6050dc76>] mutex_lock_nested+0x1d/0x1f
 [<6008e27e>] __setup_irq+0x11d/0x623
 [<6008e8ed>] request_threaded_irq+0x169/0x1a6
 [<60021eb0>] um_request_irq+0x1ee/0x24b
 [<600234ee>] write_sigio_irq+0x3b/0x76
 [<600383ca>] sigio_broken+0x146/0x2e4
 [<60020bd8>] do_one_initcall+0xde/0x281

Because we hold sigio_spinlock and then get into requesting
an interrupt with a mutex.

Change the spinlock to a mutex to avoid that.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/um/kernel/sigio.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/um/kernel/sigio.c b/arch/um/kernel/sigio.c
index b5e0cbb34382..476ded92affa 100644
--- a/arch/um/kernel/sigio.c
+++ b/arch/um/kernel/sigio.c
@@ -36,14 +36,14 @@ int write_sigio_irq(int fd)
 }
 
 /* These are called from os-Linux/sigio.c to protect its pollfds arrays. */
-static DEFINE_SPINLOCK(sigio_spinlock);
+static DEFINE_MUTEX(sigio_mutex);
 
 void sigio_lock(void)
 {
-	spin_lock(&sigio_spinlock);
+	mutex_lock(&sigio_mutex);
 }
 
 void sigio_unlock(void)
 {
-	spin_unlock(&sigio_spinlock);
+	mutex_unlock(&sigio_mutex);
 }

From dafd2bd25dd9712794c2ae95aa7198d3c0a47964 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <darrick.wong@oracle.com>
Date: Wed, 7 Oct 2020 13:55:16 -0700
Subject: [PATCH 0893/2658] xfs: fix realtime bitmap/summary file truncation
 when growing rt volume

[ Upstream commit f4c32e87de7d66074d5612567c5eac7325024428 ]

The realtime bitmap and summary files are regular files that are hidden
away from the directory tree.  Since they're regular files, inode
inactivation will try to purge what it thinks are speculative
preallocations beyond the incore size of the file.  Unfortunately,
xfs_growfs_rt forgets to update the incore size when it resizes the
inodes, with the result that inactivating the rt inodes at unmount time
will cause their contents to be truncated.

Fix this by updating the incore size when we change the ondisk size as
part of updating the superblock.  Note that we don't do this when we're
allocating blocks to the rt inodes because we actually want those blocks
to get purged if the growfs fails.

This fixes corruption complaints from the online rtsummary checker when
running xfs/233.  Since that test requires rmap, one can also trigger
this by growing an rt volume, cycling the mount, and creating rt files.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Chandan Babu R <chandanrlinux@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/xfs_rtalloc.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
index bda5248fc649..acadeaf72674 100644
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -1017,10 +1017,13 @@ xfs_growfs_rt(
 		xfs_ilock(mp->m_rbmip, XFS_ILOCK_EXCL);
 		xfs_trans_ijoin(tp, mp->m_rbmip, XFS_ILOCK_EXCL);
 		/*
-		 * Update the bitmap inode's size.
+		 * Update the bitmap inode's size ondisk and incore.  We need
+		 * to update the incore size so that inode inactivation won't
+		 * punch what it thinks are "posteof" blocks.
 		 */
 		mp->m_rbmip->i_d.di_size =
 			nsbp->sb_rbmblocks * nsbp->sb_blocksize;
+		i_size_write(VFS_I(mp->m_rbmip), mp->m_rbmip->i_d.di_size);
 		xfs_trans_log_inode(tp, mp->m_rbmip, XFS_ILOG_CORE);
 		/*
 		 * Get the summary inode into the transaction.
@@ -1028,9 +1031,12 @@ xfs_growfs_rt(
 		xfs_ilock(mp->m_rsumip, XFS_ILOCK_EXCL);
 		xfs_trans_ijoin(tp, mp->m_rsumip, XFS_ILOCK_EXCL);
 		/*
-		 * Update the summary inode's size.
+		 * Update the summary inode's size.  We need to update the
+		 * incore size so that inode inactivation won't punch what it
+		 * thinks are "posteof" blocks.
 		 */
 		mp->m_rsumip->i_d.di_size = nmp->m_rsumsize;
+		i_size_write(VFS_I(mp->m_rsumip), mp->m_rsumip->i_d.di_size);
 		xfs_trans_log_inode(tp, mp->m_rsumip, XFS_ILOG_CORE);
 		/*
 		 * Copy summary data from old to new sizes.

From 4467ee29b174d59563bcf754a147cdacd6f1b35b Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Mon, 20 Jul 2020 12:18:45 -0700
Subject: [PATCH 0894/2658] video: fbdev: pvr2fb: initialize variables

[ Upstream commit 8e1ba47c60bcd325fdd097cd76054639155e5d2e ]

clang static analysis reports this repesentative error

pvr2fb.c:1049:2: warning: 1st function call argument
  is an uninitialized value [core.CallAndMessage]
        if (*cable_arg)
        ^~~~~~~~~~~~~~~

Problem is that cable_arg depends on the input loop to
set the cable_arg[0].  If it does not, then some random
value from the stack is used.

A similar problem exists for output_arg.

So initialize cable_arg and output_arg.

Signed-off-by: Tom Rix <trix@redhat.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20200720191845.20115-1-trix@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/pvr2fb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/video/fbdev/pvr2fb.c b/drivers/video/fbdev/pvr2fb.c
index 750a384bf191..1a015a6b682e 100644
--- a/drivers/video/fbdev/pvr2fb.c
+++ b/drivers/video/fbdev/pvr2fb.c
@@ -1029,6 +1029,8 @@ static int __init pvr2fb_setup(char *options)
 	if (!options || !*options)
 		return 0;
 
+	cable_arg[0] = output_arg[0] = 0;
+
 	while ((this_opt = strsep(&options, ","))) {
 		if (!*this_opt)
 			continue;

From 6a7f90708452cde59b8f2984c17f68c3eb038357 Mon Sep 17 00:00:00 2001
From: Sathishkumar Muruganandam <murugana@codeaurora.org>
Date: Fri, 14 Aug 2020 13:46:11 +0530
Subject: [PATCH 0895/2658] ath10k: fix VHT NSS calculation when STBC is
 enabled

[ Upstream commit 99f41b8e43b8b4b31262adb8ac3e69088fff1289 ]

When STBC is enabled, NSTS_SU value need to be accounted for VHT NSS
calculation for SU case.

Without this fix, 1SS + STBC enabled case was reported wrongly as 2SS
in radiotap header on monitor mode capture.

Tested-on: QCA9984 10.4-3.10-00047

Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1597392971-3897-1-git-send-email-murugana@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/htt_rx.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 26d9ea6d4b5f..11b566233c78 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -626,6 +626,7 @@ static void ath10k_htt_rx_h_rates(struct ath10k *ar,
 	u8 preamble = 0;
 	u8 group_id;
 	u32 info1, info2, info3;
+	u32 stbc, nsts_su;
 
 	info1 = __le32_to_cpu(rxd->ppdu_start.info1);
 	info2 = __le32_to_cpu(rxd->ppdu_start.info2);
@@ -669,11 +670,16 @@ static void ath10k_htt_rx_h_rates(struct ath10k *ar,
 		   TODO check this */
 		bw = info2 & 3;
 		sgi = info3 & 1;
+		stbc = (info2 >> 3) & 1;
 		group_id = (info2 >> 4) & 0x3F;
 
 		if (GROUP_ID_IS_SU_MIMO(group_id)) {
 			mcs = (info3 >> 4) & 0x0F;
-			nss = ((info2 >> 10) & 0x07) + 1;
+			nsts_su = ((info2 >> 10) & 0x07);
+			if (stbc)
+				nss = (nsts_su >> 2) + 1;
+			else
+				nss = (nsts_su + 1);
 		} else {
 			/* Hardware doesn't decode VHT-SIG-B into Rx descriptor
 			 * so it's impossible to decode MCS. Also since

From 2255f53695256439b317b8f5344bc139d1d91856 Mon Sep 17 00:00:00 2001
From: Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
Date: Sat, 22 Aug 2020 11:45:28 +0530
Subject: [PATCH 0896/2658] mmc: via-sdmmc: Fix data race bug

[ Upstream commit 87d7ad089b318b4f319bf57f1daa64eb6d1d10ad ]

via_save_pcictrlreg() should be called with host->lock held
as it writes to pm_pcictrl_reg, otherwise there can be a race
condition between via_sd_suspend() and via_sdc_card_detect().
The same pattern is used in the function via_reset_pcictrl()
as well, where via_save_pcictrlreg() is called with host->lock
held.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
Link: https://lore.kernel.org/r/20200822061528.7035-1-madhuparnabhowmik10@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/via-sdmmc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/mmc/host/via-sdmmc.c b/drivers/mmc/host/via-sdmmc.c
index 63fac78b3d46..b455e9cf95af 100644
--- a/drivers/mmc/host/via-sdmmc.c
+++ b/drivers/mmc/host/via-sdmmc.c
@@ -1269,11 +1269,14 @@ static void via_init_sdc_pm(struct via_crdr_mmc_host *host)
 static int via_sd_suspend(struct pci_dev *pcidev, pm_message_t state)
 {
 	struct via_crdr_mmc_host *host;
+	unsigned long flags;
 
 	host = pci_get_drvdata(pcidev);
 
+	spin_lock_irqsave(&host->lock, flags);
 	via_save_pcictrlreg(host);
 	via_save_sdcreg(host);
+	spin_unlock_irqrestore(&host->lock, flags);
 
 	pci_save_state(pcidev);
 	pci_enable_wake(pcidev, pci_choose_state(pcidev, state), 0);

From e202e5362e75e0abb7b4b44f3f5afec7227e89be Mon Sep 17 00:00:00 2001
From: John Ogness <john.ogness@linutronix.de>
Date: Wed, 12 Aug 2020 09:37:22 +0206
Subject: [PATCH 0897/2658] printk: reduce LOG_BUF_SHIFT range for H8300

[ Upstream commit 550c10d28d21bd82a8bb48debbb27e6ed53262f6 ]

The .bss section for the h8300 is relatively small. A value of
CONFIG_LOG_BUF_SHIFT that is larger than 19 will create a static
printk ringbuffer that is too large. Limit the range appropriately
for the H8300.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: John Ogness <john.ogness@linutronix.de>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20200812073122.25412-1-john.ogness@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 init/Kconfig | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/init/Kconfig b/init/Kconfig
index be46b2d2d3fd..ebb210b400d1 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -833,7 +833,8 @@ config IKCONFIG_PROC
 
 config LOG_BUF_SHIFT
 	int "Kernel log buffer size (16 => 64KB, 17 => 128KB)"
-	range 12 25
+	range 12 25 if !H8300
+	range 12 19 if H8300
 	default 17
 	depends on PRINTK
 	help

From f30af3e10f233d6f699809e5ccb087682fb9eaf4 Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Tue, 30 Jun 2020 15:14:38 -0700
Subject: [PATCH 0898/2658] kgdb: Make "kgdbcon" work properly with
 "kgdb_earlycon"

[ Upstream commit b18b099e04f450cdc77bec72acefcde7042bd1f3 ]

On my system the kernel processes the "kgdb_earlycon" parameter before
the "kgdbcon" parameter.  When we setup "kgdb_earlycon" we'll end up
in kgdb_register_callbacks() and "kgdb_use_con" won't have been set
yet so we'll never get around to starting "kgdbcon".  Let's remedy
this by detecting that the IO module was already registered when
setting "kgdb_use_con" and registering the console then.

As part of this, to avoid pre-declaring things, move the handling of
the "kgdbcon" further down in the file.

Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20200630151422.1.I4aa062751ff5e281f5116655c976dff545c09a46@changeid
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/debug/debug_core.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
index 321ccdbb7364..bc791cec58e6 100644
--- a/kernel/debug/debug_core.c
+++ b/kernel/debug/debug_core.c
@@ -94,14 +94,6 @@ int dbg_switch_cpu;
 /* Use kdb or gdbserver mode */
 int dbg_kdb_mode = 1;
 
-static int __init opt_kgdb_con(char *str)
-{
-	kgdb_use_con = 1;
-	return 0;
-}
-
-early_param("kgdbcon", opt_kgdb_con);
-
 module_param(kgdb_use_con, int, 0644);
 module_param(kgdbreboot, int, 0644);
 
@@ -811,6 +803,20 @@ static struct console kgdbcons = {
 	.index		= -1,
 };
 
+static int __init opt_kgdb_con(char *str)
+{
+	kgdb_use_con = 1;
+
+	if (kgdb_io_module_registered && !kgdb_con_registered) {
+		register_console(&kgdbcons);
+		kgdb_con_registered = 1;
+	}
+
+	return 0;
+}
+
+early_param("kgdbcon", opt_kgdb_con);
+
 #ifdef CONFIG_MAGIC_SYSRQ
 static void sysrq_handle_dbg(int key)
 {

From 631e4c990aa273d2c5cd9077f18b6d5ca0876b23 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Thu, 17 Sep 2020 13:26:00 +0200
Subject: [PATCH 0899/2658] USB: adutux: fix debugging

[ Upstream commit c56150c1bc8da5524831b1dac2eec3c67b89f587 ]

Handling for removal of the controller was missing at one place.
Add it.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Link: https://lore.kernel.org/r/20200917112600.26508-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/misc/adutux.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
index ba5c0a4591ac..012d97f9c30c 100644
--- a/drivers/usb/misc/adutux.c
+++ b/drivers/usb/misc/adutux.c
@@ -210,6 +210,7 @@ static void adu_interrupt_out_callback(struct urb *urb)
 
 	if (status != 0) {
 		if ((status != -ENOENT) &&
+		    (status != -ESHUTDOWN) &&
 		    (status != -ECONNRESET)) {
 			dev_dbg(&dev->udev->dev,
 				"%s :nonzero status received: %d\n", __func__,

From 6450a80ded94bb0fe4d22f83bd8445dfc06245f8 Mon Sep 17 00:00:00 2001
From: Xie He <xie.he.0141@gmail.com>
Date: Mon, 28 Sep 2020 05:56:43 -0700
Subject: [PATCH 0900/2658] drivers/net/wan/hdlc_fr: Correctly handle special
 skb->protocol values

[ Upstream commit 8306266c1d51aac9aa7aa907fe99032a58c6382c ]

The fr_hard_header function is used to prepend the header to skbs before
transmission. It is used in 3 situations:
1) When a control packet is generated internally in this driver;
2) When a user sends an skb on an Ethernet-emulating PVC device;
3) When a user sends an skb on a normal PVC device.

These 3 situations need to be handled differently by fr_hard_header.
Different headers should be prepended to the skb in different situations.

Currently fr_hard_header distinguishes these 3 situations using
skb->protocol. For situation 1 and 2, a special skb->protocol value
will be assigned before calling fr_hard_header, so that it can recognize
these 2 situations. All skb->protocol values other than these special ones
are treated by fr_hard_header as situation 3.

However, it is possible that in situation 3, the user sends an skb with
one of the special skb->protocol values. In this case, fr_hard_header
would incorrectly treat it as situation 1 or 2.

This patch tries to solve this issue by using skb->dev instead of
skb->protocol to distinguish between these 3 situations. For situation
1, skb->dev would be NULL; for situation 2, skb->dev->type would be
ARPHRD_ETHER; and for situation 3, skb->dev->type would be ARPHRD_DLCI.

This way fr_hard_header would be able to distinguish these 3 situations
correctly regardless what skb->protocol value the user tries to use in
situation 3.

Cc: Krzysztof Halasa <khc@pm.waw.pl>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wan/hdlc_fr.c | 98 ++++++++++++++++++++-------------------
 1 file changed, 51 insertions(+), 47 deletions(-)

diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
index 74d46f7e77ea..045158fab8fe 100644
--- a/drivers/net/wan/hdlc_fr.c
+++ b/drivers/net/wan/hdlc_fr.c
@@ -275,63 +275,69 @@ static inline struct net_device **get_dev_p(struct pvc_device *pvc,
 
 static int fr_hard_header(struct sk_buff **skb_p, u16 dlci)
 {
-	u16 head_len;
 	struct sk_buff *skb = *skb_p;
 
-	switch (skb->protocol) {
-	case cpu_to_be16(NLPID_CCITT_ANSI_LMI):
-		head_len = 4;
-		skb_push(skb, head_len);
-		skb->data[3] = NLPID_CCITT_ANSI_LMI;
-		break;
-
-	case cpu_to_be16(NLPID_CISCO_LMI):
-		head_len = 4;
-		skb_push(skb, head_len);
-		skb->data[3] = NLPID_CISCO_LMI;
-		break;
-
-	case cpu_to_be16(ETH_P_IP):
-		head_len = 4;
-		skb_push(skb, head_len);
-		skb->data[3] = NLPID_IP;
-		break;
-
-	case cpu_to_be16(ETH_P_IPV6):
-		head_len = 4;
-		skb_push(skb, head_len);
-		skb->data[3] = NLPID_IPV6;
-		break;
-
-	case cpu_to_be16(ETH_P_802_3):
-		head_len = 10;
-		if (skb_headroom(skb) < head_len) {
-			struct sk_buff *skb2 = skb_realloc_headroom(skb,
-								    head_len);
+	if (!skb->dev) { /* Control packets */
+		switch (dlci) {
+		case LMI_CCITT_ANSI_DLCI:
+			skb_push(skb, 4);
+			skb->data[3] = NLPID_CCITT_ANSI_LMI;
+			break;
+
+		case LMI_CISCO_DLCI:
+			skb_push(skb, 4);
+			skb->data[3] = NLPID_CISCO_LMI;
+			break;
+
+		default:
+			return -EINVAL;
+		}
+
+	} else if (skb->dev->type == ARPHRD_DLCI) {
+		switch (skb->protocol) {
+		case htons(ETH_P_IP):
+			skb_push(skb, 4);
+			skb->data[3] = NLPID_IP;
+			break;
+
+		case htons(ETH_P_IPV6):
+			skb_push(skb, 4);
+			skb->data[3] = NLPID_IPV6;
+			break;
+
+		default:
+			skb_push(skb, 10);
+			skb->data[3] = FR_PAD;
+			skb->data[4] = NLPID_SNAP;
+			/* OUI 00-00-00 indicates an Ethertype follows */
+			skb->data[5] = 0x00;
+			skb->data[6] = 0x00;
+			skb->data[7] = 0x00;
+			/* This should be an Ethertype: */
+			*(__be16 *)(skb->data + 8) = skb->protocol;
+		}
+
+	} else if (skb->dev->type == ARPHRD_ETHER) {
+		if (skb_headroom(skb) < 10) {
+			struct sk_buff *skb2 = skb_realloc_headroom(skb, 10);
 			if (!skb2)
 				return -ENOBUFS;
 			dev_kfree_skb(skb);
 			skb = *skb_p = skb2;
 		}
-		skb_push(skb, head_len);
+		skb_push(skb, 10);
 		skb->data[3] = FR_PAD;
 		skb->data[4] = NLPID_SNAP;
-		skb->data[5] = FR_PAD;
+		/* OUI 00-80-C2 stands for the 802.1 organization */
+		skb->data[5] = 0x00;
 		skb->data[6] = 0x80;
 		skb->data[7] = 0xC2;
+		/* PID 00-07 stands for Ethernet frames without FCS */
 		skb->data[8] = 0x00;
-		skb->data[9] = 0x07; /* bridged Ethernet frame w/out FCS */
-		break;
+		skb->data[9] = 0x07;
 
-	default:
-		head_len = 10;
-		skb_push(skb, head_len);
-		skb->data[3] = FR_PAD;
-		skb->data[4] = NLPID_SNAP;
-		skb->data[5] = FR_PAD;
-		skb->data[6] = FR_PAD;
-		skb->data[7] = FR_PAD;
-		*(__be16*)(skb->data + 8) = skb->protocol;
+	} else {
+		return -EINVAL;
 	}
 
 	dlci_to_q922(skb->data, dlci);
@@ -427,8 +433,8 @@ static netdev_tx_t pvc_xmit(struct sk_buff *skb, struct net_device *dev)
 				skb_put(skb, pad);
 				memset(skb->data + len, 0, pad);
 			}
-			skb->protocol = cpu_to_be16(ETH_P_802_3);
 		}
+		skb->dev = dev;
 		if (!fr_hard_header(&skb, pvc->dlci)) {
 			dev->stats.tx_bytes += skb->len;
 			dev->stats.tx_packets++;
@@ -496,10 +502,8 @@ static void fr_lmi_send(struct net_device *dev, int fullrep)
 	memset(skb->data, 0, len);
 	skb_reserve(skb, 4);
 	if (lmi == LMI_CISCO) {
-		skb->protocol = cpu_to_be16(NLPID_CISCO_LMI);
 		fr_hard_header(&skb, LMI_CISCO_DLCI);
 	} else {
-		skb->protocol = cpu_to_be16(NLPID_CCITT_ANSI_LMI);
 		fr_hard_header(&skb, LMI_CCITT_ANSI_DLCI);
 	}
 	data = skb_tail_pointer(skb);

From e3466359a9ac93cc7cfed70ac15e6e32e835b357 Mon Sep 17 00:00:00 2001
From: Xiongfeng Wang <wangxiongfeng2@huawei.com>
Date: Fri, 4 Sep 2020 14:09:58 +0800
Subject: [PATCH 0901/2658] power: supply: test_power: add missing newlines
 when printing parameters by sysfs

[ Upstream commit c07fa6c1631333f02750cf59f22b615d768b4d8f ]

When I cat some module parameters by sysfs, it displays as follows.
It's better to add a newline for easy reading.

root@syzkaller:~# cd /sys/module/test_power/parameters/
root@syzkaller:/sys/module/test_power/parameters# cat ac_online
onroot@syzkaller:/sys/module/test_power/parameters# cat battery_present
trueroot@syzkaller:/sys/module/test_power/parameters# cat battery_health
goodroot@syzkaller:/sys/module/test_power/parameters# cat battery_status
dischargingroot@syzkaller:/sys/module/test_power/parameters# cat battery_technology
LIONroot@syzkaller:/sys/module/test_power/parameters# cat usb_online
onroot@syzkaller:/sys/module/test_power/parameters#

Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/test_power.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/power/test_power.c b/drivers/power/test_power.c
index 57246cdbd042..925abec45380 100644
--- a/drivers/power/test_power.c
+++ b/drivers/power/test_power.c
@@ -344,6 +344,7 @@ static int param_set_ac_online(const char *key, const struct kernel_param *kp)
 static int param_get_ac_online(char *buffer, const struct kernel_param *kp)
 {
 	strcpy(buffer, map_get_key(map_ac_online, ac_online, "unknown"));
+	strcat(buffer, "\n");
 	return strlen(buffer);
 }
 
@@ -357,6 +358,7 @@ static int param_set_usb_online(const char *key, const struct kernel_param *kp)
 static int param_get_usb_online(char *buffer, const struct kernel_param *kp)
 {
 	strcpy(buffer, map_get_key(map_ac_online, usb_online, "unknown"));
+	strcat(buffer, "\n");
 	return strlen(buffer);
 }
 
@@ -371,6 +373,7 @@ static int param_set_battery_status(const char *key,
 static int param_get_battery_status(char *buffer, const struct kernel_param *kp)
 {
 	strcpy(buffer, map_get_key(map_status, battery_status, "unknown"));
+	strcat(buffer, "\n");
 	return strlen(buffer);
 }
 
@@ -385,6 +388,7 @@ static int param_set_battery_health(const char *key,
 static int param_get_battery_health(char *buffer, const struct kernel_param *kp)
 {
 	strcpy(buffer, map_get_key(map_health, battery_health, "unknown"));
+	strcat(buffer, "\n");
 	return strlen(buffer);
 }
 
@@ -400,6 +404,7 @@ static int param_get_battery_present(char *buffer,
 					const struct kernel_param *kp)
 {
 	strcpy(buffer, map_get_key(map_present, battery_present, "unknown"));
+	strcat(buffer, "\n");
 	return strlen(buffer);
 }
 
@@ -417,6 +422,7 @@ static int param_get_battery_technology(char *buffer,
 {
 	strcpy(buffer,
 		map_get_key(map_technology, battery_technology, "unknown"));
+	strcat(buffer, "\n");
 	return strlen(buffer);
 }
 

From d6aaf6c8cc471cefbcbfd276f0d1195c404681f0 Mon Sep 17 00:00:00 2001
From: Zhao Heming <heming.zhao@suse.com>
Date: Tue, 6 Oct 2020 00:00:24 +0800
Subject: [PATCH 0902/2658] md/bitmap: md_bitmap_get_counter returns wrong
 blocks

[ Upstream commit d837f7277f56e70d82b3a4a037d744854e62f387 ]

md_bitmap_get_counter() has code:

```
    if (bitmap->bp[page].hijacked ||
        bitmap->bp[page].map == NULL)
        csize = ((sector_t)1) << (bitmap->chunkshift +
                      PAGE_COUNTER_SHIFT - 1);
```

The minus 1 is wrong, this branch should report 2048 bits of space.
With "-1" action, this only report 1024 bit of space.

This bug code returns wrong blocks, but it doesn't inflence bitmap logic:
1. Most callers focus this function return value (the counter of offset),
   not the parameter blocks.
2. The bug is only triggered when hijacked is true or map is NULL.
   the hijacked true condition is very rare.
   the "map == null" only true when array is creating or resizing.
3. Even the caller gets wrong blocks, current code makes caller just to
   call md_bitmap_get_counter() one more time.

Signed-off-by: Zhao Heming <heming.zhao@suse.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/bitmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 391090c455ce..65281f168c6f 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -1332,7 +1332,7 @@ __acquires(bitmap->lock)
 	if (bitmap->bp[page].hijacked ||
 	    bitmap->bp[page].map == NULL)
 		csize = ((sector_t)1) << (bitmap->chunkshift +
-					  PAGE_COUNTER_SHIFT - 1);
+					  PAGE_COUNTER_SHIFT);
 	else
 		csize = ((sector_t)1) << bitmap->chunkshift;
 	*blocks = csize - (offset & (csize - 1));

From 9c419b26033d1bdf473e68a1d3bcb47532339935 Mon Sep 17 00:00:00 2001
From: Tero Kristo <t-kristo@ti.com>
Date: Mon, 7 Sep 2020 11:25:59 +0300
Subject: [PATCH 0903/2658] clk: ti: clockdomain: fix static checker warning

[ Upstream commit b7a7943fe291b983b104bcbd2f16e8e896f56590 ]

Fix a memory leak induced by not calling clk_put after doing of_clk_get.

Reported-by: Dan Murphy <dmurphy@ti.com>
Signed-off-by: Tero Kristo <t-kristo@ti.com>
Link: https://lore.kernel.org/r/20200907082600.454-3-t-kristo@ti.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/ti/clockdomain.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/clk/ti/clockdomain.c b/drivers/clk/ti/clockdomain.c
index b9bc3b8df659..4fde9767392e 100644
--- a/drivers/clk/ti/clockdomain.c
+++ b/drivers/clk/ti/clockdomain.c
@@ -124,10 +124,12 @@ static void __init of_ti_clockdomain_setup(struct device_node *node)
 		if (clk_hw_get_flags(clk_hw) & CLK_IS_BASIC) {
 			pr_warn("can't setup clkdm for basic clk %s\n",
 				__clk_get_name(clk));
+			clk_put(clk);
 			continue;
 		}
 		to_clk_hw_omap(clk_hw)->clkdm_name = clkdm_name;
 		omap2_init_clk_clkdm(clk_hw);
+		clk_put(clk);
 	}
 }
 

From 993ab86fe8b986f9d869788c55f8a1602f1e0d81 Mon Sep 17 00:00:00 2001
From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Date: Mon, 12 Oct 2020 09:54:04 +0530
Subject: [PATCH 0904/2658] net: 9p: initialize sun_server.sun_path to have
 addr's value only when addr is valid

[ Upstream commit 7ca1db21ef8e0e6725b4d25deed1ca196f7efb28 ]

In p9_fd_create_unix, checking is performed to see if the addr (passed
as an argument) is NULL or not.
However, no check is performed to see if addr is a valid address, i.e.,
it doesn't entirely consist of only 0's.
The initialization of sun_server.sun_path to be equal to this faulty
addr value leads to an uninitialized variable, as detected by KMSAN.
Checking for this (faulty addr) and returning a negative error number
appropriately, resolves this issue.

Link: http://lkml.kernel.org/r/20201012042404.2508-1-anant.thazhemadam@gmail.com
Reported-by: syzbot+75d51fe5bf4ebe988518@syzkaller.appspotmail.com
Tested-by: syzbot+75d51fe5bf4ebe988518@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/9p/trans_fd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index eab058f93ec9..6f8e84844bb2 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -991,7 +991,7 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args)
 
 	csocket = NULL;
 
-	if (addr == NULL)
+	if (!addr || !strlen(addr))
 		return -EINVAL;
 
 	if (strlen(addr) >= UNIX_PATH_MAX) {

From 4cee12d02e692402fcf4acc9b1e91e83c5613340 Mon Sep 17 00:00:00 2001
From: Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
Date: Fri, 7 Aug 2020 16:59:02 +0530
Subject: [PATCH 0905/2658] drivers: watchdog: rdc321x_wdt: Fix race condition
 bugs

[ Upstream commit 4b2e7f99cdd314263c9d172bc17193b8b6bba463 ]

In rdc321x_wdt_probe(), rdc321x_wdt_device.queue is initialized
after misc_register(), hence if ioctl is called before its
initialization which can call rdc321x_wdt_start() function,
it will see an uninitialized value of rdc321x_wdt_device.queue,
hence initialize it before misc_register().
Also, rdc321x_wdt_device.default_ticks is accessed in reset()
function called from write callback, thus initialize it before
misc_register().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20200807112902.28764-1-madhuparnabhowmik10@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/rdc321x_wdt.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/watchdog/rdc321x_wdt.c b/drivers/watchdog/rdc321x_wdt.c
index 47a8f1b1087d..4568af9a165b 100644
--- a/drivers/watchdog/rdc321x_wdt.c
+++ b/drivers/watchdog/rdc321x_wdt.c
@@ -244,6 +244,8 @@ static int rdc321x_wdt_probe(struct platform_device *pdev)
 
 	rdc321x_wdt_device.sb_pdev = pdata->sb_pdev;
 	rdc321x_wdt_device.base_reg = r->start;
+	rdc321x_wdt_device.queue = 0;
+	rdc321x_wdt_device.default_ticks = ticks;
 
 	err = misc_register(&rdc321x_wdt_misc);
 	if (err < 0) {
@@ -258,14 +260,11 @@ static int rdc321x_wdt_probe(struct platform_device *pdev)
 				rdc321x_wdt_device.base_reg, RDC_WDT_RST);
 
 	init_completion(&rdc321x_wdt_device.stop);
-	rdc321x_wdt_device.queue = 0;
 
 	clear_bit(0, &rdc321x_wdt_device.inuse);
 
 	setup_timer(&rdc321x_wdt_device.timer, rdc321x_wdt_trigger, 0);
 
-	rdc321x_wdt_device.default_ticks = ticks;
-
 	dev_info(&pdev->dev, "watchdog init success\n");
 
 	return 0;

From fc6714f0e4d56a5302beb5555deceabe6f84ff99 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Thu, 15 Oct 2020 13:03:30 +0200
Subject: [PATCH 0906/2658] ext4: Detect already used quota file early

[ Upstream commit e0770e91424f694b461141cbc99adf6b23006b60 ]

When we try to use file already used as a quota file again (for the same
or different quota type), strange things can happen. At the very least
lockdep annotations may be wrong but also inode flags may be wrongly set
/ reset. When the file is used for two quota types at once we can even
corrupt the file and likely crash the kernel. Catch all these cases by
checking whether passed file is already used as quota file and bail
early in that case.

This fixes occasional generic/219 failure due to lockdep complaint.

Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Reported-by: Ritesh Harjani <riteshh@linux.ibm.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20201015110330.28716-1-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/super.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index aeb85b5d0688..bf969fc0103e 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5178,6 +5178,11 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id,
 	/* Quotafile not on the same filesystem? */
 	if (path->dentry->d_sb != sb)
 		return -EXDEV;
+
+	/* Quota already enabled for this file? */
+	if (IS_NOQUOTA(d_inode(path->dentry)))
+		return -EBUSY;
+
 	/* Journaling quota? */
 	if (EXT4_SB(sb)->s_qf_names[type]) {
 		/* Quotafile not in fs root? */

From 78520c091135bd6279daf3ff5c7b7d6787fa5b83 Mon Sep 17 00:00:00 2001
From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Date: Wed, 14 Oct 2020 22:01:09 +0530
Subject: [PATCH 0907/2658] gfs2: add validation checks for size of superblock

[ Upstream commit 0ddc5154b24c96f20e94d653b0a814438de6032b ]

In gfs2_check_sb(), no validation checks are performed with regards to
the size of the superblock.
syzkaller detected a slab-out-of-bounds bug that was primarily caused
because the block size for a superblock was set to zero.
A valid size for a superblock is a power of 2 between 512 and PAGE_SIZE.
Performing validation checks and ensuring that the size of the superblock
is valid fixes this bug.

Reported-by: syzbot+af90d47a37376844e731@syzkaller.appspotmail.com
Tested-by: syzbot+af90d47a37376844e731@syzkaller.appspotmail.com
Suggested-by: Andrew Price <anprice@redhat.com>
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
[Minor code reordering.]
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/ops_fstype.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index b7b43d00cc6d..8ed2b1a71637 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -160,15 +160,19 @@ static int gfs2_check_sb(struct gfs2_sbd *sdp, int silent)
 		return -EINVAL;
 	}
 
-	/*  If format numbers match exactly, we're done.  */
-
-	if (sb->sb_fs_format == GFS2_FORMAT_FS &&
-	    sb->sb_multihost_format == GFS2_FORMAT_MULTI)
-		return 0;
+	if (sb->sb_fs_format != GFS2_FORMAT_FS ||
+	    sb->sb_multihost_format != GFS2_FORMAT_MULTI) {
+		fs_warn(sdp, "Unknown on-disk format, unable to mount\n");
+		return -EINVAL;
+	}
 
-	fs_warn(sdp, "Unknown on-disk format, unable to mount\n");
+	if (sb->sb_bsize < 512 || sb->sb_bsize > PAGE_SIZE ||
+	    (sb->sb_bsize & (sb->sb_bsize - 1))) {
+		pr_warn("Invalid superblock size\n");
+		return -EINVAL;
+	}
 
-	return -EINVAL;
+	return 0;
 }
 
 static void end_bio_io_page(struct bio *bio)

From 6140a41a947cd7520c80fa27fc82c29bcc4ec97b Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 26 Aug 2020 14:37:59 +0300
Subject: [PATCH 0908/2658] memory: emif: Remove bogus debugfs error handling

[ Upstream commit fd22781648080cc400772b3c68aa6b059d2d5420 ]

Callers are generally not supposed to check the return values from
debugfs functions.  Debugfs functions never return NULL so this error
handling will never trigger.  (Historically debugfs functions used to
return a mix of NULL and error pointers but it was eventually deemed too
complicated for something which wasn't intended to be used in normal
situations).

Delete all the error handling.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Santosh Shilimkar <ssantosh@kernel.org>
Link: https://lore.kernel.org/r/20200826113759.GF393664@mwanda
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/emif.c | 33 +++++----------------------------
 1 file changed, 5 insertions(+), 28 deletions(-)

diff --git a/drivers/memory/emif.c b/drivers/memory/emif.c
index 04644e7b42b1..88c32b8dc88a 100644
--- a/drivers/memory/emif.c
+++ b/drivers/memory/emif.c
@@ -165,35 +165,12 @@ static const struct file_operations emif_mr4_fops = {
 
 static int __init_or_module emif_debugfs_init(struct emif_data *emif)
 {
-	struct dentry	*dentry;
-	int		ret;
-
-	dentry = debugfs_create_dir(dev_name(emif->dev), NULL);
-	if (!dentry) {
-		ret = -ENOMEM;
-		goto err0;
-	}
-	emif->debugfs_root = dentry;
-
-	dentry = debugfs_create_file("regcache_dump", S_IRUGO,
-			emif->debugfs_root, emif, &emif_regdump_fops);
-	if (!dentry) {
-		ret = -ENOMEM;
-		goto err1;
-	}
-
-	dentry = debugfs_create_file("mr4", S_IRUGO,
-			emif->debugfs_root, emif, &emif_mr4_fops);
-	if (!dentry) {
-		ret = -ENOMEM;
-		goto err1;
-	}
-
+	emif->debugfs_root = debugfs_create_dir(dev_name(emif->dev), NULL);
+	debugfs_create_file("regcache_dump", S_IRUGO, emif->debugfs_root, emif,
+			    &emif_regdump_fops);
+	debugfs_create_file("mr4", S_IRUGO, emif->debugfs_root, emif,
+			    &emif_mr4_fops);
 	return 0;
-err1:
-	debugfs_remove_recursive(emif->debugfs_root);
-err0:
-	return ret;
 }
 
 static void __exit emif_debugfs_exit(struct emif_data *emif)

From cd420fef5e0a399b0c4703be80fc2aea4f593a57 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Mon, 7 Sep 2020 18:11:23 +0200
Subject: [PATCH 0909/2658] ARM: dts: s5pv210: move PMU node out of clock
 controller

[ Upstream commit bb98fff84ad1ea321823759edaba573a16fa02bd ]

The Power Management Unit (PMU) is a separate device which has little
common with clock controller.  Moving it to one level up (from clock
controller child to SoC) allows to remove fake simple-bus compatible and
dtbs_check warnings like:

  clock-controller@e0100000: $nodename:0:
    'clock-controller@e0100000' does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$'

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Tested-by: Jonathan Bakker <xc-racer2@live.ca>
Link: https://lore.kernel.org/r/20200907161141.31034-8-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/s5pv210.dtsi | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/arch/arm/boot/dts/s5pv210.dtsi b/arch/arm/boot/dts/s5pv210.dtsi
index b03fe747b98c..b78346d9c319 100644
--- a/arch/arm/boot/dts/s5pv210.dtsi
+++ b/arch/arm/boot/dts/s5pv210.dtsi
@@ -99,19 +99,16 @@
 		};
 
 		clocks: clock-controller@e0100000 {
-			compatible = "samsung,s5pv210-clock", "simple-bus";
+			compatible = "samsung,s5pv210-clock";
 			reg = <0xe0100000 0x10000>;
 			clock-names = "xxti", "xusbxti";
 			clocks = <&xxti>, <&xusbxti>;
 			#clock-cells = <1>;
-			#address-cells = <1>;
-			#size-cells = <1>;
-			ranges;
+		};
 
-			pmu_syscon: syscon@e0108000 {
-				compatible = "samsung-s5pv210-pmu", "syscon";
-				reg = <0xe0108000 0x8000>;
-			};
+		pmu_syscon: syscon@e0108000 {
+			compatible = "samsung-s5pv210-pmu", "syscon";
+			reg = <0xe0108000 0x8000>;
 		};
 
 		pinctrl0: pinctrl@e0200000 {

From bb4adc7bb091a674316be4a4a301a8973109ba50 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Mon, 7 Sep 2020 18:11:24 +0200
Subject: [PATCH 0910/2658] ARM: dts: s5pv210: remove dedicated
 'audio-subsystem' node

[ Upstream commit 6c17a2974abf68a58517f75741b15c4aba42b4b8 ]

The 'audio-subsystem' node is an artificial creation, not representing
real hardware.  The hardware is described by its nodes - AUDSS clock
controller and I2S0.

Remove the 'audio-subsystem' node along with its undocumented compatible
to fix dtbs_check warnings like:

  audio-subsystem: $nodename:0: 'audio-subsystem' does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$'

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Tested-by: Jonathan Bakker <xc-racer2@live.ca>
Link: https://lore.kernel.org/r/20200907161141.31034-9-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/s5pv210.dtsi | 65 +++++++++++++++-------------------
 1 file changed, 29 insertions(+), 36 deletions(-)

diff --git a/arch/arm/boot/dts/s5pv210.dtsi b/arch/arm/boot/dts/s5pv210.dtsi
index b78346d9c319..48bcab25720a 100644
--- a/arch/arm/boot/dts/s5pv210.dtsi
+++ b/arch/arm/boot/dts/s5pv210.dtsi
@@ -225,43 +225,36 @@
 			status = "disabled";
 		};
 
-		audio-subsystem {
-			compatible = "samsung,s5pv210-audss", "simple-bus";
-			#address-cells = <1>;
-			#size-cells = <1>;
-			ranges;
-
-			clk_audss: clock-controller@eee10000 {
-				compatible = "samsung,s5pv210-audss-clock";
-				reg = <0xeee10000 0x1000>;
-				clock-names = "hclk", "xxti",
-						"fout_epll",
-						"sclk_audio0";
-				clocks = <&clocks DOUT_HCLKP>, <&xxti>,
-						<&clocks FOUT_EPLL>,
-						<&clocks SCLK_AUDIO0>;
-				#clock-cells = <1>;
-			};
+		clk_audss: clock-controller@eee10000 {
+			compatible = "samsung,s5pv210-audss-clock";
+			reg = <0xeee10000 0x1000>;
+			clock-names = "hclk", "xxti",
+				      "fout_epll",
+				      "sclk_audio0";
+			clocks = <&clocks DOUT_HCLKP>, <&xxti>,
+				 <&clocks FOUT_EPLL>,
+				 <&clocks SCLK_AUDIO0>;
+			#clock-cells = <1>;
+		};
 
-			i2s0: i2s@eee30000 {
-				compatible = "samsung,s5pv210-i2s";
-				reg = <0xeee30000 0x1000>;
-				interrupt-parent = <&vic2>;
-				interrupts = <16>;
-				dma-names = "rx", "tx", "tx-sec";
-				dmas = <&pdma1 9>, <&pdma1 10>, <&pdma1 11>;
-				clock-names = "iis",
-						"i2s_opclk0",
-						"i2s_opclk1";
-				clocks = <&clk_audss CLK_I2S>,
-						<&clk_audss CLK_I2S>,
-						<&clk_audss CLK_DOUT_AUD_BUS>;
-				samsung,idma-addr = <0xc0010000>;
-				pinctrl-names = "default";
-				pinctrl-0 = <&i2s0_bus>;
-				#sound-dai-cells = <0>;
-				status = "disabled";
-			};
+		i2s0: i2s@eee30000 {
+			compatible = "samsung,s5pv210-i2s";
+			reg = <0xeee30000 0x1000>;
+			interrupt-parent = <&vic2>;
+			interrupts = <16>;
+			dma-names = "rx", "tx", "tx-sec";
+			dmas = <&pdma1 9>, <&pdma1 10>, <&pdma1 11>;
+			clock-names = "iis",
+				      "i2s_opclk0",
+				      "i2s_opclk1";
+			clocks = <&clk_audss CLK_I2S>,
+				 <&clk_audss CLK_I2S>,
+				 <&clk_audss CLK_DOUT_AUD_BUS>;
+			samsung,idma-addr = <0xc0010000>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&i2s0_bus>;
+			#sound-dai-cells = <0>;
+			status = "disabled";
 		};
 
 		i2s1: i2s@e2100000 {

From 2b5cf639ec904f19378f29e6b71f38bbc0bad5ec Mon Sep 17 00:00:00 2001
From: Song Liu <songliubraving@fb.com>
Date: Mon, 5 Oct 2020 09:35:21 -0700
Subject: [PATCH 0911/2658] md/raid5: fix oops during stripe resizing

commit b44c018cdf748b96b676ba09fdbc5b34fc443ada upstream.

KoWei reported crash during raid5 reshape:

[ 1032.252932] Oops: 0002 [#1] SMP PTI
[...]
[ 1032.252943] RIP: 0010:memcpy_erms+0x6/0x10
[...]
[ 1032.252947] RSP: 0018:ffffba1ac0c03b78 EFLAGS: 00010286
[ 1032.252949] RAX: 0000784ac0000000 RBX: ffff91bec3d09740 RCX: 0000000000001000
[ 1032.252951] RDX: 0000000000001000 RSI: ffff91be6781c000 RDI: 0000784ac0000000
[ 1032.252953] RBP: ffffba1ac0c03bd8 R08: 0000000000001000 R09: ffffba1ac0c03bf8
[ 1032.252954] R10: 0000000000000000 R11: 0000000000000000 R12: ffffba1ac0c03bf8
[ 1032.252955] R13: 0000000000001000 R14: 0000000000000000 R15: 0000000000000000
[ 1032.252958] FS:  0000000000000000(0000) GS:ffff91becf500000(0000) knlGS:0000000000000000
[ 1032.252959] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1032.252961] CR2: 0000784ac0000000 CR3: 000000031780a002 CR4: 00000000001606e0
[ 1032.252962] Call Trace:
[ 1032.252969]  ? async_memcpy+0x179/0x1000 [async_memcpy]
[ 1032.252977]  ? raid5_release_stripe+0x8e/0x110 [raid456]
[ 1032.252982]  handle_stripe_expansion+0x15a/0x1f0 [raid456]
[ 1032.252988]  handle_stripe+0x592/0x1270 [raid456]
[ 1032.252993]  handle_active_stripes.isra.0+0x3cb/0x5a0 [raid456]
[ 1032.252999]  raid5d+0x35c/0x550 [raid456]
[ 1032.253002]  ? schedule+0x42/0xb0
[ 1032.253006]  ? schedule_timeout+0x10e/0x160
[ 1032.253011]  md_thread+0x97/0x160
[ 1032.253015]  ? wait_woken+0x80/0x80
[ 1032.253019]  kthread+0x104/0x140
[ 1032.253022]  ? md_start_sync+0x60/0x60
[ 1032.253024]  ? kthread_park+0x90/0x90
[ 1032.253027]  ret_from_fork+0x35/0x40

This is because cache_size_mutex was unlocked too early in resize_stripes,
which races with grow_one_stripe() that grow_one_stripe() allocates a
stripe with wrong pool_size.

Fix this issue by unlocking cache_size_mutex after updating pool_size.

Cc: <stable@vger.kernel.org> # v4.4+
Reported-by: KoWei Sung <winders@amazon.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/raid5.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 99cd843351c2..24708dcf0bb4 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2238,8 +2238,6 @@ static int resize_stripes(struct r5conf *conf, int newsize)
 	} else
 		err = -ENOMEM;
 
-	mutex_unlock(&conf->cache_size_mutex);
-
 	conf->slab_cache = sc;
 	conf->active_name = 1-conf->active_name;
 
@@ -2262,6 +2260,8 @@ static int resize_stripes(struct r5conf *conf, int newsize)
 
 	if (!err)
 		conf->pool_size = newsize;
+	mutex_unlock(&conf->cache_size_mutex);
+
 	return err;
 }
 

From c85bb81a210a1f9bc27e58d46b6c6fa8e848b86a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Beh=C3=BAn?= <marek.behun@nic.cz>
Date: Fri, 18 Sep 2020 00:32:58 +0200
Subject: [PATCH 0912/2658] leds: bcm6328, bcm6358: use devres LED registering
 function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit ff5c89d44453e7ad99502b04bf798a3fc32c758b upstream.

These two drivers do not provide remove method and use devres for
allocation of other resources, yet they use led_classdev_register
instead of the devres variant, devm_led_classdev_register.

Fix this.

Signed-off-by: Marek Behún <marek.behun@nic.cz>
Cc: Álvaro Fernández Rojas <noltari@gmail.com>
Cc: Kevin Cernekee <cernekee@gmail.com>
Cc: Jaedon Shin <jaedon.shin@gmail.com>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/leds/leds-bcm6328.c | 2 +-
 drivers/leds/leds-bcm6358.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/leds/leds-bcm6328.c b/drivers/leds/leds-bcm6328.c
index c7ea5c626331..be728106baae 100644
--- a/drivers/leds/leds-bcm6328.c
+++ b/drivers/leds/leds-bcm6328.c
@@ -325,7 +325,7 @@ static int bcm6328_led(struct device *dev, struct device_node *nc, u32 reg,
 	led->cdev.brightness_set = bcm6328_led_set;
 	led->cdev.blink_set = bcm6328_blink_set;
 
-	rc = led_classdev_register(dev, &led->cdev);
+	rc = devm_led_classdev_register(dev, &led->cdev);
 	if (rc < 0)
 		return rc;
 
diff --git a/drivers/leds/leds-bcm6358.c b/drivers/leds/leds-bcm6358.c
index 82b4ee1bc87e..dae1fd097941 100644
--- a/drivers/leds/leds-bcm6358.c
+++ b/drivers/leds/leds-bcm6358.c
@@ -146,7 +146,7 @@ static int bcm6358_led(struct device *dev, struct device_node *nc, u32 reg,
 
 	led->cdev.brightness_set = bcm6358_led_set;
 
-	rc = led_classdev_register(dev, &led->cdev);
+	rc = devm_led_classdev_register(dev, &led->cdev);
 	if (rc < 0)
 		return rc;
 

From dd765620cbf959a33939c83e1ffd23be28e646ba Mon Sep 17 00:00:00 2001
From: Ashish Sangwan <ashishsangwan2@gmail.com>
Date: Mon, 5 Oct 2020 02:22:43 -0700
Subject: [PATCH 0913/2658] NFS: fix nfs_path in case of a rename retry

commit 247db73560bc3e5aef6db50c443c3c0db115bc93 upstream.

We are generating incorrect path in case of rename retry because
we are restarting from wrong dentry. We should restart from the
dentry which was received in the call to nfs_path.

CC: stable@vger.kernel.org
Signed-off-by: Ashish Sangwan <ashishsangwan2@gmail.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/namespace.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index c8162c660c44..d29ad4e02d33 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -30,9 +30,9 @@ int nfs_mountpoint_expiry_timeout = 500 * HZ;
 /*
  * nfs_path - reconstruct the path given an arbitrary dentry
  * @base - used to return pointer to the end of devname part of path
- * @dentry - pointer to dentry
+ * @dentry_in - pointer to dentry
  * @buffer - result buffer
- * @buflen - length of buffer
+ * @buflen_in - length of buffer
  * @flags - options (see below)
  *
  * Helper function for constructing the server pathname
@@ -47,15 +47,19 @@ int nfs_mountpoint_expiry_timeout = 500 * HZ;
  *		       the original device (export) name
  *		       (if unset, the original name is returned verbatim)
  */
-char *nfs_path(char **p, struct dentry *dentry, char *buffer, ssize_t buflen,
-	       unsigned flags)
+char *nfs_path(char **p, struct dentry *dentry_in, char *buffer,
+	       ssize_t buflen_in, unsigned flags)
 {
 	char *end;
 	int namelen;
 	unsigned seq;
 	const char *base;
+	struct dentry *dentry;
+	ssize_t buflen;
 
 rename_retry:
+	buflen = buflen_in;
+	dentry = dentry_in;
 	end = buffer+buflen;
 	*--end = '\0';
 	buflen--;

From 58996783d50663b8639ba94aa23f917c9201b16a Mon Sep 17 00:00:00 2001
From: Ben Hutchings <ben@decadent.org.uk>
Date: Sun, 27 Sep 2020 22:50:42 +0100
Subject: [PATCH 0914/2658] ACPI / extlog: Check for RDMSR failure

commit 7cecb47f55e00282f972a1e0b09136c8cd938221 upstream.

extlog_init() uses rdmsrl() to read an MSR, which on older CPUs
provokes a error message at boot:

    unchecked MSR access error: RDMSR from 0x179 at rIP: 0xcd047307 (native_read_msr+0x7/0x40)

Use rdmsrl_safe() instead, and return -ENODEV if it fails.

Reported-by: jim@photojim.ca
References: https://bugs.debian.org/971058
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/acpi/acpi_extlog.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c
index b3842ffc19ba..46d201fc7ecc 100644
--- a/drivers/acpi/acpi_extlog.c
+++ b/drivers/acpi/acpi_extlog.c
@@ -223,9 +223,9 @@ static int __init extlog_init(void)
 	u64 cap;
 	int rc;
 
-	rdmsrl(MSR_IA32_MCG_CAP, cap);
-
-	if (!(cap & MCG_ELOG_P) || !extlog_get_l1addr())
+	if (rdmsrl_safe(MSR_IA32_MCG_CAP, &cap) ||
+	    !(cap & MCG_ELOG_P) ||
+	    !extlog_get_l1addr())
 		return -ENODEV;
 
 	if (get_edac_report_status() == EDAC_REPORTING_FORCE) {

From b75b6125ab5bd86f44ac6220e399f1af9c81462a Mon Sep 17 00:00:00 2001
From: Alex Hung <alex.hung@canonical.com>
Date: Sun, 13 Sep 2020 16:34:03 -0600
Subject: [PATCH 0915/2658] ACPI: video: use ACPI backlight for HP 635 Notebook

commit b226faab4e7890bbbccdf794e8b94276414f9058 upstream.

The default backlight interface is AMD's radeon_bl0 which does not
work on this system, so use the ACPI backlight interface on it
instead.

BugLink: https://bugs.launchpad.net/bugs/1894667
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Alex Hung <alex.hung@canonical.com>
[ rjw: Changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/acpi/video_detect.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index 0936b68eff80..df3df21852fe 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -251,6 +251,15 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
 		DMI_MATCH(DMI_PRODUCT_NAME, "XPS L521X"),
 		},
 	},
+	/* https://bugs.launchpad.net/bugs/1894667 */
+	{
+	 .callback = video_detect_force_video,
+	 .ident = "HP 635 Notebook",
+	 .matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+		DMI_MATCH(DMI_PRODUCT_NAME, "HP 635 Notebook PC"),
+		},
+	},
 
 	/* Non win8 machines which need native backlight nevertheless */
 	{

From 23fe23dbeb981c44bee917d097ba00f4f7a38016 Mon Sep 17 00:00:00 2001
From: Wei Huang <wei.huang2@amd.com>
Date: Sun, 18 Oct 2020 22:57:41 -0500
Subject: [PATCH 0916/2658] acpi-cpufreq: Honor _PSD table setting on new AMD
 CPUs

commit 5368512abe08a28525d9b24abbfc2a72493e8dba upstream.

acpi-cpufreq has a old quirk that overrides the _PSD table supplied by
BIOS on AMD CPUs. However the _PSD table of new AMD CPUs (Family 19h+)
now accurately reports the P-state dependency of CPU cores. Hence this
quirk needs to be fixed in order to support new CPUs' frequency control.

Fixes: acd316248205 ("acpi-cpufreq: Add quirk to disable _PSD usage on all AMD CPUs")
Signed-off-by: Wei Huang <wei.huang2@amd.com>
[ rjw: Subject edit ]
Cc: 3.10+ <stable@vger.kernel.org> # 3.10+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/cpufreq/acpi-cpufreq.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
index c2598381fbc8..9738244a18dd 100644
--- a/drivers/cpufreq/acpi-cpufreq.c
+++ b/drivers/cpufreq/acpi-cpufreq.c
@@ -713,7 +713,8 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
 		cpumask_copy(policy->cpus, topology_core_cpumask(cpu));
 	}
 
-	if (check_amd_hwpstate_cpu(cpu) && !acpi_pstate_strict) {
+	if (check_amd_hwpstate_cpu(cpu) && boot_cpu_data.x86 < 0x19 &&
+	    !acpi_pstate_strict) {
 		cpumask_clear(policy->cpus);
 		cpumask_set_cpu(cpu, policy->cpus);
 		cpumask_copy(data->freqdomain_cpus,

From 28272c57a71d51a981853e8d7cdf5acdd5ddb608 Mon Sep 17 00:00:00 2001
From: Martin Fuzzey <martin.fuzzey@flowbird.group>
Date: Wed, 30 Sep 2020 10:36:46 +0200
Subject: [PATCH 0917/2658] w1: mxc_w1: Fix timeout resolution problem leading
 to bus error

commit c9723750a699c3bd465493ac2be8992b72ccb105 upstream.

On my platform (i.MX53) bus access sometimes fails with
	w1_search: max_slave_count 64 reached, will continue next search.

The reason is the use of jiffies to implement a 200us timeout in
mxc_w1_ds2_touch_bit().
On some platforms the jiffies timer resolution is insufficient for this.

Fix by replacing jiffies by ktime_get().

For consistency apply the same change to the other use of jiffies in
mxc_w1_ds2_reset_bus().

Fixes: f80b2581a706 ("w1: mxc_w1: Optimize mxc_w1_ds2_touch_bit()")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Martin Fuzzey <martin.fuzzey@flowbird.group>
Link: https://lore.kernel.org/r/1601455030-6607-1-git-send-email-martin.fuzzey@flowbird.group
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/w1/masters/mxc_w1.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/w1/masters/mxc_w1.c b/drivers/w1/masters/mxc_w1.c
index dacb5919970c..d2e9d2f6a784 100644
--- a/drivers/w1/masters/mxc_w1.c
+++ b/drivers/w1/masters/mxc_w1.c
@@ -15,7 +15,7 @@
 #include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/io.h>
-#include <linux/jiffies.h>
+#include <linux/ktime.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 
@@ -48,12 +48,12 @@ struct mxc_w1_device {
 static u8 mxc_w1_ds2_reset_bus(void *data)
 {
 	struct mxc_w1_device *dev = data;
-	unsigned long timeout;
+	ktime_t timeout;
 
 	writeb(MXC_W1_CONTROL_RPP, dev->regs + MXC_W1_CONTROL);
 
 	/* Wait for reset sequence 511+512us, use 1500us for sure */
-	timeout = jiffies + usecs_to_jiffies(1500);
+	timeout = ktime_add_us(ktime_get(), 1500);
 
 	udelay(511 + 512);
 
@@ -63,7 +63,7 @@ static u8 mxc_w1_ds2_reset_bus(void *data)
 		/* PST bit is valid after the RPP bit is self-cleared */
 		if (!(ctrl & MXC_W1_CONTROL_RPP))
 			return !(ctrl & MXC_W1_CONTROL_PST);
-	} while (time_is_after_jiffies(timeout));
+	} while (ktime_before(ktime_get(), timeout));
 
 	return 1;
 }
@@ -76,12 +76,12 @@ static u8 mxc_w1_ds2_reset_bus(void *data)
 static u8 mxc_w1_ds2_touch_bit(void *data, u8 bit)
 {
 	struct mxc_w1_device *dev = data;
-	unsigned long timeout;
+	ktime_t timeout;
 
 	writeb(MXC_W1_CONTROL_WR(bit), dev->regs + MXC_W1_CONTROL);
 
 	/* Wait for read/write bit (60us, Max 120us), use 200us for sure */
-	timeout = jiffies + usecs_to_jiffies(200);
+	timeout = ktime_add_us(ktime_get(), 200);
 
 	udelay(60);
 
@@ -91,7 +91,7 @@ static u8 mxc_w1_ds2_touch_bit(void *data, u8 bit)
 		/* RDST bit is valid after the WR1/RD bit is self-cleared */
 		if (!(ctrl & MXC_W1_CONTROL_WR(bit)))
 			return !!(ctrl & MXC_W1_CONTROL_RDST);
-	} while (time_is_after_jiffies(timeout));
+	} while (ktime_before(ktime_get(), timeout));
 
 	return 0;
 }

From 0cb1a3d81a5dcda26a9242a651850e1a466ba4dc Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Thu, 22 Oct 2020 11:00:05 +0200
Subject: [PATCH 0918/2658] scsi: mptfusion: Fix null pointer dereferences in
 mptscsih_remove()

commit 2f4843b172c2c0360ee7792ad98025fae7baefde upstream.

The mptscsih_remove() function triggers a kernel oops if the Scsi_Host
pointer (ioc->sh) is NULL, as can be seen in this syslog:

 ioc0: LSI53C1030 B2: Capabilities={Initiator,Target}
 Begin: Waiting for root file system ...
 scsi host2: error handler thread failed to spawn, error = -4
 mptspi: ioc0: WARNING - Unable to register controller with SCSI subsystem
 Backtrace:
  [<000000001045b7cc>] mptspi_probe+0x248/0x3d0 [mptspi]
  [<0000000040946470>] pci_device_probe+0x1ac/0x2d8
  [<0000000040add668>] really_probe+0x1bc/0x988
  [<0000000040ade704>] driver_probe_device+0x160/0x218
  [<0000000040adee24>] device_driver_attach+0x160/0x188
  [<0000000040adef90>] __driver_attach+0x144/0x320
  [<0000000040ad7c78>] bus_for_each_dev+0xd4/0x158
  [<0000000040adc138>] driver_attach+0x4c/0x80
  [<0000000040adb3ec>] bus_add_driver+0x3e0/0x498
  [<0000000040ae0130>] driver_register+0xf4/0x298
  [<00000000409450c4>] __pci_register_driver+0x78/0xa8
  [<000000000007d248>] mptspi_init+0x18c/0x1c4 [mptspi]

This patch adds the necessary NULL-pointer checks.  Successfully tested on
a HP C8000 parisc workstation with buggy SCSI drives.

Link: https://lore.kernel.org/r/20201022090005.GA9000@ls3530.fritz.box
Cc: <stable@vger.kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/message/fusion/mptscsih.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
index e77185e143ab..32083759b93d 100644
--- a/drivers/message/fusion/mptscsih.c
+++ b/drivers/message/fusion/mptscsih.c
@@ -1176,8 +1176,10 @@ mptscsih_remove(struct pci_dev *pdev)
 
 	scsi_remove_host(host);
 
-	if((hd = shost_priv(host)) == NULL)
-		return;
+	if (host == NULL)
+		hd = NULL;
+	else
+		hd = shost_priv(host);
 
 	mptscsih_shutdown(pdev);
 
@@ -1193,14 +1195,15 @@ mptscsih_remove(struct pci_dev *pdev)
 	    "Free'd ScsiLookup (%d) memory\n",
 	    ioc->name, sz1));
 
-	kfree(hd->info_kbuf);
+	if (hd)
+		kfree(hd->info_kbuf);
 
 	/* NULL the Scsi_Host pointer
 	 */
 	ioc->sh = NULL;
 
-	scsi_host_put(host);
-
+	if (host)
+		scsi_host_put(host);
 	mpt_detach(pdev);
 
 }

From 3d25eddf76cd8b7e3f80dec90c441efafc133bfc Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Mon, 14 Sep 2020 15:27:50 +0100
Subject: [PATCH 0919/2658] btrfs: reschedule if necessary when logging
 directory items

commit bb56f02f26fe23798edb1b2175707419b28c752a upstream.

Logging directories with many entries can take a significant amount of
time, and in some cases monopolize a cpu/core for a long time if the
logging task doesn't happen to block often enough.

Johannes and Lu Fengqi reported test case generic/041 triggering a soft
lockup when the kernel has CONFIG_SOFTLOCKUP_DETECTOR=y. For this test
case we log an inode with 3002 hard links, and because the test removed
one hard link before fsyncing the file, the inode logging causes the
parent directory do be logged as well, which has 6004 directory items to
log (3002 BTRFS_DIR_ITEM_KEY items plus 3002 BTRFS_DIR_INDEX_KEY items),
so it can take a significant amount of time and trigger the soft lockup.

So just make tree-log.c:log_dir_items() reschedule when necessary,
releasing the current search path before doing so and then resume from
where it was before the reschedule.

The stack trace produced when the soft lockup happens is the following:

[10480.277653] watchdog: BUG: soft lockup - CPU#2 stuck for 22s! [xfs_io:28172]
[10480.279418] Modules linked in: dm_thin_pool dm_persistent_data (...)
[10480.284915] irq event stamp: 29646366
[10480.285987] hardirqs last  enabled at (29646365): [<ffffffff85249b66>] __slab_alloc.constprop.0+0x56/0x60
[10480.288482] hardirqs last disabled at (29646366): [<ffffffff8579b00d>] irqentry_enter+0x1d/0x50
[10480.290856] softirqs last  enabled at (4612): [<ffffffff85a00323>] __do_softirq+0x323/0x56c
[10480.293615] softirqs last disabled at (4483): [<ffffffff85800dbf>] asm_call_on_stack+0xf/0x20
[10480.296428] CPU: 2 PID: 28172 Comm: xfs_io Not tainted 5.9.0-rc4-default+ #1248
[10480.298948] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba527-rebuilt.opensuse.org 04/01/2014
[10480.302455] RIP: 0010:__slab_alloc.constprop.0+0x19/0x60
[10480.304151] Code: 86 e8 31 75 21 00 66 66 2e 0f 1f 84 00 00 00 (...)
[10480.309558] RSP: 0018:ffffadbe09397a58 EFLAGS: 00000282
[10480.311179] RAX: ffff8a495ab92840 RBX: 0000000000000282 RCX: 0000000000000006
[10480.313242] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff85249b66
[10480.315260] RBP: ffff8a497d04b740 R08: 0000000000000001 R09: 0000000000000001
[10480.317229] R10: ffff8a497d044800 R11: ffff8a495ab93c40 R12: 0000000000000000
[10480.319169] R13: 0000000000000000 R14: 0000000000000c40 R15: ffffffffc01daf70
[10480.321104] FS:  00007fa1dc5c0e40(0000) GS:ffff8a497da00000(0000) knlGS:0000000000000000
[10480.323559] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[10480.325235] CR2: 00007fa1dc5befb8 CR3: 0000000004f8a006 CR4: 0000000000170ea0
[10480.327259] Call Trace:
[10480.328286]  ? overwrite_item+0x1f0/0x5a0 [btrfs]
[10480.329784]  __kmalloc+0x831/0xa20
[10480.331009]  ? btrfs_get_32+0xb0/0x1d0 [btrfs]
[10480.332464]  overwrite_item+0x1f0/0x5a0 [btrfs]
[10480.333948]  log_dir_items+0x2ee/0x570 [btrfs]
[10480.335413]  log_directory_changes+0x82/0xd0 [btrfs]
[10480.336926]  btrfs_log_inode+0xc9b/0xda0 [btrfs]
[10480.338374]  ? init_once+0x20/0x20 [btrfs]
[10480.339711]  btrfs_log_inode_parent+0x8d3/0xd10 [btrfs]
[10480.341257]  ? dget_parent+0x97/0x2e0
[10480.342480]  btrfs_log_dentry_safe+0x3a/0x50 [btrfs]
[10480.343977]  btrfs_sync_file+0x24b/0x5e0 [btrfs]
[10480.345381]  do_fsync+0x38/0x70
[10480.346483]  __x64_sys_fsync+0x10/0x20
[10480.347703]  do_syscall_64+0x2d/0x70
[10480.348891]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[10480.350444] RIP: 0033:0x7fa1dc80970b
[10480.351642] Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 (...)
[10480.356952] RSP: 002b:00007fffb3d081d0 EFLAGS: 00000293 ORIG_RAX: 000000000000004a
[10480.359458] RAX: ffffffffffffffda RBX: 0000562d93d45e40 RCX: 00007fa1dc80970b
[10480.361426] RDX: 0000562d93d44ab0 RSI: 0000562d93d45e60 RDI: 0000000000000003
[10480.363367] RBP: 0000000000000001 R08: 0000000000000000 R09: 00007fa1dc7b2a40
[10480.365317] R10: 0000562d93d0e366 R11: 0000000000000293 R12: 0000000000000001
[10480.367299] R13: 0000562d93d45290 R14: 0000562d93d45e40 R15: 0000562d93d45e60

Link: https://lore.kernel.org/linux-btrfs/20180713090216.GC575@fnst.localdomain/
Reported-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
CC: stable@vger.kernel.org # 4.4+
Tested-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/tree-log.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 8f0f91de436d..ee26ccd12da8 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3335,6 +3335,7 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans,
 	 * search and this search we'll not find the key again and can just
 	 * bail.
 	 */
+search:
 	ret = btrfs_search_slot(NULL, root, &min_key, path, 0, 0);
 	if (ret != 0)
 		goto done;
@@ -3354,6 +3355,13 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans,
 
 			if (min_key.objectid != ino || min_key.type != key_type)
 				goto done;
+
+			if (need_resched()) {
+				btrfs_release_path(path);
+				cond_resched();
+				goto search;
+			}
+
 			ret = overwrite_item(trans, log, dst_path, src, i,
 					     &min_key);
 			if (ret) {

From 1a0fad43d249393b66161cde36419c9dcc28be08 Mon Sep 17 00:00:00 2001
From: Jiri Slaby <jslaby@suse.cz>
Date: Mon, 19 Oct 2020 10:55:16 +0200
Subject: [PATCH 0920/2658] vt: keyboard, simplify vt_kdgkbsent

commit 6ca03f90527e499dd5e32d6522909e2ad390896b upstream.

Use 'strlen' of the string, add one for NUL terminator and simply do
'copy_to_user' instead of the explicit 'for' loop. This makes the
KDGKBSENT case more compact.

The only thing we need to take care about is NULL 'func_table[i]'. Use
an empty string in that case.

The original check for overflow could never trigger as the func_buf
strings are always shorter or equal to 'struct kbsentry's.

Cc: <stable@vger.kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Link: https://lore.kernel.org/r/20201019085517.10176-1-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/vt/keyboard.c | 28 +++++++++-------------------
 1 file changed, 9 insertions(+), 19 deletions(-)

diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index 96c65fe64141..53321b35b4ff 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -1973,9 +1973,7 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm,
 int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
 {
 	struct kbsentry *kbs;
-	char *p;
 	u_char *q;
-	u_char __user *up;
 	int sz, fnw_sz;
 	int delta;
 	char *first_free, *fj, *fnw;
@@ -2001,23 +1999,15 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
 	i = kbs->kb_func;
 
 	switch (cmd) {
-	case KDGKBSENT:
-		sz = sizeof(kbs->kb_string) - 1; /* sz should have been
-						  a struct member */
-		up = user_kdgkb->kb_string;
-		p = func_table[i];
-		if(p)
-			for ( ; *p && sz; p++, sz--)
-				if (put_user(*p, up++)) {
-					ret = -EFAULT;
-					goto reterr;
-				}
-		if (put_user('\0', up)) {
-			ret = -EFAULT;
-			goto reterr;
-		}
-		kfree(kbs);
-		return ((p && *p) ? -EOVERFLOW : 0);
+	case KDGKBSENT: {
+		/* size should have been a struct member */
+		unsigned char *from = func_table[i] ? : "";
+
+		ret = copy_to_user(user_kdgkb->kb_string, from,
+				strlen(from) + 1) ? -EFAULT : 0;
+
+		goto reterr;
+	}
 	case KDSKBSENT:
 		if (!perm) {
 			ret = -EPERM;

From 191d5dcee693cafb11caec3389f8d1e9ffd9829b Mon Sep 17 00:00:00 2001
From: Jiri Slaby <jslaby@suse.cz>
Date: Mon, 19 Oct 2020 10:55:17 +0200
Subject: [PATCH 0921/2658] vt: keyboard, extend func_buf_lock to readers

commit 82e61c3909db51d91b9d3e2071557b6435018b80 upstream.

Both read-side users of func_table/func_buf need locking. Without that,
one can easily confuse the code by repeatedly setting altering strings
like:
while (1)
	for (a = 0; a < 2; a++) {
		struct kbsentry kbs = {};
		strcpy((char *)kbs.kb_string, a ? ".\n" : "88888\n");
		ioctl(fd, KDSKBSENT, &kbs);
	}

When that program runs, one can get unexpected output by holding F1
(note the unxpected period on the last line):
.
88888
.8888

So protect all accesses to 'func_table' (and func_buf) by preexisting
'func_buf_lock'.

It is easy in 'k_fn' handler as 'puts_queue' is expected not to sleep.
On the other hand, KDGKBSENT needs a local (atomic) copy of the string
because copy_to_user can sleep. Use already allocated, but unused
'kbs->kb_string' for that purpose.

Note that the program above needs at least CAP_SYS_TTY_CONFIG.

This depends on the previous patch and on the func_buf_lock lock added
in commit 46ca3f735f34 (tty/vt: fix write/write race in ioctl(KDSKBSENT)
handler) in 5.2.

Likely fixes CVE-2020-25656.

Cc: <stable@vger.kernel.org>
Reported-by: Minh Yuan <yuanmingbuaa@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Link: https://lore.kernel.org/r/20201019085517.10176-2-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/vt/keyboard.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index 53321b35b4ff..05941f86df3d 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -712,8 +712,13 @@ static void k_fn(struct vc_data *vc, unsigned char value, char up_flag)
 		return;
 
 	if ((unsigned)value < ARRAY_SIZE(func_table)) {
+		unsigned long flags;
+
+		spin_lock_irqsave(&func_buf_lock, flags);
 		if (func_table[value])
 			puts_queue(vc, func_table[value]);
+		spin_unlock_irqrestore(&func_buf_lock, flags);
+
 	} else
 		pr_err("k_fn called with value=%d\n", value);
 }
@@ -1969,7 +1974,7 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm,
 #undef s
 #undef v
 
-/* FIXME: This one needs untangling and locking */
+/* FIXME: This one needs untangling */
 int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
 {
 	struct kbsentry *kbs;
@@ -2001,10 +2006,14 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
 	switch (cmd) {
 	case KDGKBSENT: {
 		/* size should have been a struct member */
-		unsigned char *from = func_table[i] ? : "";
+		ssize_t len = sizeof(user_kdgkb->kb_string);
+
+		spin_lock_irqsave(&func_buf_lock, flags);
+		len = strlcpy(kbs->kb_string, func_table[i] ? : "", len);
+		spin_unlock_irqrestore(&func_buf_lock, flags);
 
-		ret = copy_to_user(user_kdgkb->kb_string, from,
-				strlen(from) + 1) ? -EFAULT : 0;
+		ret = copy_to_user(user_kdgkb->kb_string, kbs->kb_string,
+				len + 1) ? -EFAULT : 0;
 
 		goto reterr;
 	}

From 7596826d953aeb4443bce9bca2809b32e2fd6b51 Mon Sep 17 00:00:00 2001
From: Paul Cercueil <paul@crapouillou.net>
Date: Sun, 4 Oct 2020 16:03:07 +0200
Subject: [PATCH 0922/2658] dmaengine: dma-jz4780: Fix race in
 jz4780_dma_tx_status

commit baf6fd97b16ea8f981b8a8b04039596f32fc2972 upstream.

The jz4780_dma_tx_status() function would check if a channel's cookie
state was set to 'completed', and if not, it would enter the critical
section. However, in that time frame, the jz4780_dma_chan_irq() function
was able to set the cookie to 'completed', and clear the jzchan->vchan
pointer, which was deferenced in the critical section of the first
function.

Fix this race by checking the channel's cookie state after entering the
critical function and not before.

Fixes: d894fc6046fe ("dmaengine: jz4780: add driver for the Ingenic JZ4780 DMA controller")
Cc: stable@vger.kernel.org # v4.0
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Reported-by: Artur Rojek <contact@artur-rojek.eu>
Tested-by: Artur Rojek <contact@artur-rojek.eu>
Link: https://lore.kernel.org/r/20201004140307.885556-1-paul@crapouillou.net
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/dma/dma-jz4780.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
index 1d01e3805f9c..f417fba9bf1c 100644
--- a/drivers/dma/dma-jz4780.c
+++ b/drivers/dma/dma-jz4780.c
@@ -563,11 +563,11 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan,
 	enum dma_status status;
 	unsigned long flags;
 
+	spin_lock_irqsave(&jzchan->vchan.lock, flags);
+
 	status = dma_cookie_status(chan, cookie, txstate);
 	if ((status == DMA_COMPLETE) || (txstate == NULL))
-		return status;
-
-	spin_lock_irqsave(&jzchan->vchan.lock, flags);
+		goto out_unlock_irqrestore;
 
 	vdesc = vchan_find_desc(&jzchan->vchan, cookie);
 	if (vdesc) {
@@ -584,6 +584,7 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan,
 	    && jzchan->desc->status & (JZ_DMA_DCS_AR | JZ_DMA_DCS_HLT))
 		status = DMA_ERROR;
 
+out_unlock_irqrestore:
 	spin_unlock_irqrestore(&jzchan->vchan.lock, flags);
 	return status;
 }

From dd6ecaa35d20a46d6fefe645808369255f89d4f7 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Wed, 22 Jul 2020 16:50:41 +0100
Subject: [PATCH 0923/2658] iio:gyro:itg3200: Fix timestamp alignment and
 prevent data leak.

commit 10ab7cfd5522f0041028556dac864a003e158556 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses a 16 byte array of smaller elements on the stack.
This is fixed by using an explicit c structure. As there are no
holes in the structure, there is no possiblity of data leakage
in this case.

The explicit alignment of ts is not strictly necessary but potentially
makes the code slightly less fragile.  It also removes the possibility
of this being cut and paste into another driver where the alignment
isn't already true.

Fixes: 36e0371e7764 ("iio:itg3200: Use iio_push_to_buffers_with_timestamp()")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200722155103.979802-6-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/gyro/itg3200_buffer.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c
index eef50e91f17c..e04483254b28 100644
--- a/drivers/iio/gyro/itg3200_buffer.c
+++ b/drivers/iio/gyro/itg3200_buffer.c
@@ -49,13 +49,20 @@ static irqreturn_t itg3200_trigger_handler(int irq, void *p)
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct itg3200 *st = iio_priv(indio_dev);
-	__be16 buf[ITG3200_SCAN_ELEMENTS + sizeof(s64)/sizeof(u16)];
-
-	int ret = itg3200_read_all_channels(st->i2c, buf);
+	/*
+	 * Ensure correct alignment and padding including for the
+	 * timestamp that may be inserted.
+	 */
+	struct {
+		__be16 buf[ITG3200_SCAN_ELEMENTS];
+		s64 ts __aligned(8);
+	} scan;
+
+	int ret = itg3200_read_all_channels(st->i2c, scan.buf);
 	if (ret < 0)
 		goto error_ret;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, buf, pf->timestamp);
+	iio_push_to_buffers_with_timestamp(indio_dev, &scan, pf->timestamp);
 
 	iio_trigger_notify_done(indio_dev->trig);
 

From 867d95509b392bf4837950bb01887ae6bf07f283 Mon Sep 17 00:00:00 2001
From: Mahesh Salgaonkar <mahesh@linux.ibm.com>
Date: Tue, 6 Oct 2020 13:02:18 +0530
Subject: [PATCH 0924/2658] powerpc/powernv/elog: Fix race while processing
 OPAL error log event.

commit aea948bb80b478ddc2448f7359d574387521a52d upstream.

Every error log reported by OPAL is exported to userspace through a
sysfs interface and notified using kobject_uevent(). The userspace
daemon (opal_errd) then reads the error log and acknowledges the error
log is saved safely to disk. Once acknowledged the kernel removes the
respective sysfs file entry causing respective resources to be
released including kobject.

However it's possible the userspace daemon may already be scanning
elog entries when a new sysfs elog entry is created by the kernel.
User daemon may read this new entry and ack it even before kernel can
notify userspace about it through kobject_uevent() call. If that
happens then we have a potential race between
elog_ack_store->kobject_put() and kobject_uevent which can lead to
use-after-free of a kernfs object resulting in a kernel crash. eg:

  BUG: Unable to handle kernel data access on read at 0x6b6b6b6b6b6b6bfb
  Faulting instruction address: 0xc0000000008ff2a0
  Oops: Kernel access of bad area, sig: 11 [#1]
  LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA PowerNV
  CPU: 27 PID: 805 Comm: irq/29-opal-elo Not tainted 5.9.0-rc2-gcc-8.2.0-00214-g6f56a67bcbb5-dirty #363
  ...
  NIP kobject_uevent_env+0xa0/0x910
  LR  elog_event+0x1f4/0x2d0
  Call Trace:
    0x5deadbeef0000122 (unreliable)
    elog_event+0x1f4/0x2d0
    irq_thread_fn+0x4c/0xc0
    irq_thread+0x1c0/0x2b0
    kthread+0x1c4/0x1d0
    ret_from_kernel_thread+0x5c/0x6c

This patch fixes this race by protecting the sysfs file
creation/notification by holding a reference count on kobject until we
safely send kobject_uevent().

The function create_elog_obj() returns the elog object which if used
by caller function will end up in use-after-free problem again.
However, the return value of create_elog_obj() function isn't being
used today and there is no need as well. Hence change it to return
void to make this fix complete.

Fixes: 774fea1a38c6 ("powerpc/powernv: Read OPAL error log and export it through sysfs")
Cc: stable@vger.kernel.org # v3.15+
Reported-by: Oliver O'Halloran <oohall@gmail.com>
Signed-off-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
Reviewed-by: Oliver O'Halloran <oohall@gmail.com>
Reviewed-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
[mpe: Rework the logic to use a single return, reword comments, add oops]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201006122051.190176-1-mpe@ellerman.id.au
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/platforms/powernv/opal-elog.c | 33 +++++++++++++++++-----
 1 file changed, 26 insertions(+), 7 deletions(-)

diff --git a/arch/powerpc/platforms/powernv/opal-elog.c b/arch/powerpc/platforms/powernv/opal-elog.c
index f2344cbd2f46..3595f3cfefa3 100644
--- a/arch/powerpc/platforms/powernv/opal-elog.c
+++ b/arch/powerpc/platforms/powernv/opal-elog.c
@@ -183,14 +183,14 @@ static ssize_t raw_attr_read(struct file *filep, struct kobject *kobj,
 	return count;
 }
 
-static struct elog_obj *create_elog_obj(uint64_t id, size_t size, uint64_t type)
+static void create_elog_obj(uint64_t id, size_t size, uint64_t type)
 {
 	struct elog_obj *elog;
 	int rc;
 
 	elog = kzalloc(sizeof(*elog), GFP_KERNEL);
 	if (!elog)
-		return NULL;
+		return;
 
 	elog->kobj.kset = elog_kset;
 
@@ -223,18 +223,37 @@ static struct elog_obj *create_elog_obj(uint64_t id, size_t size, uint64_t type)
 	rc = kobject_add(&elog->kobj, NULL, "0x%llx", id);
 	if (rc) {
 		kobject_put(&elog->kobj);
-		return NULL;
+		return;
 	}
 
+	/*
+	 * As soon as the sysfs file for this elog is created/activated there is
+	 * a chance the opal_errd daemon (or any userspace) might read and
+	 * acknowledge the elog before kobject_uevent() is called. If that
+	 * happens then there is a potential race between
+	 * elog_ack_store->kobject_put() and kobject_uevent() which leads to a
+	 * use-after-free of a kernfs object resulting in a kernel crash.
+	 *
+	 * To avoid that, we need to take a reference on behalf of the bin file,
+	 * so that our reference remains valid while we call kobject_uevent().
+	 * We then drop our reference before exiting the function, leaving the
+	 * bin file to drop the last reference (if it hasn't already).
+	 */
+
+	/* Take a reference for the bin file */
+	kobject_get(&elog->kobj);
 	rc = sysfs_create_bin_file(&elog->kobj, &elog->raw_attr);
-	if (rc) {
+	if (rc == 0) {
+		kobject_uevent(&elog->kobj, KOBJ_ADD);
+	} else {
+		/* Drop the reference taken for the bin file */
 		kobject_put(&elog->kobj);
-		return NULL;
 	}
 
-	kobject_uevent(&elog->kobj, KOBJ_ADD);
+	/* Drop our reference */
+	kobject_put(&elog->kobj);
 
-	return elog;
+	return;
 }
 
 static irqreturn_t elog_event(int irq, void *data)

From ea7680edcd24533a07510f8805de8bceca45fcef Mon Sep 17 00:00:00 2001
From: Zhihao Cheng <chengzhihao1@huawei.com>
Date: Mon, 1 Jun 2020 17:10:37 +0800
Subject: [PATCH 0925/2658] ubifs: dent: Fix some potential memory leaks while
 iterating entries

commit 58f6e78a65f1fcbf732f60a7478ccc99873ff3ba upstream.

Fix some potential memory leaks in error handling branches while
iterating dent entries. For example, function dbg_check_dir()
forgets to free pdent if it exists.

Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Cc: <stable@vger.kernel.org>
Fixes: 1e51764a3c2ac05a2 ("UBIFS: add new flash file system")
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ubifs/debug.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
index 595ca0debe11..09134a13a39c 100644
--- a/fs/ubifs/debug.c
+++ b/fs/ubifs/debug.c
@@ -1125,6 +1125,7 @@ int dbg_check_dir(struct ubifs_info *c, const struct inode *dir)
 			err = PTR_ERR(dent);
 			if (err == -ENOENT)
 				break;
+			kfree(pdent);
 			return err;
 		}
 

From e9af91c9cb53837896d7855cbe767b7ca21bc42b Mon Sep 17 00:00:00 2001
From: Zhihao Cheng <chengzhihao1@huawei.com>
Date: Mon, 1 Jun 2020 17:12:31 +0800
Subject: [PATCH 0926/2658] ubi: check kthread_should_stop() after the setting
 of task state

commit d005f8c6588efcfbe88099b6edafc6f58c84a9c1 upstream.

A detach hung is possible when a race occurs between the detach process
and the ubi background thread. The following sequences outline the race:

  ubi thread: if (list_empty(&ubi->works)...

  ubi detach: set_bit(KTHREAD_SHOULD_STOP, &kthread->flags)
              => by kthread_stop()
              wake_up_process()
              => ubi thread is still running, so 0 is returned

  ubi thread: set_current_state(TASK_INTERRUPTIBLE)
              schedule()
              => ubi thread will never be scheduled again

  ubi detach: wait_for_completion()
              => hung task!

To fix that, we need to check kthread_should_stop() after we set the
task state, so the ubi thread will either see the stop bit and exit or
the task state is reset to runnable such that it isn't scheduled out
indefinitely.

Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Cc: <stable@vger.kernel.org>
Fixes: 801c135ce73d5df1ca ("UBI: Unsorted Block Images")
Reported-by: syzbot+853639d0cb16c31c7a14@syzkaller.appspotmail.com
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/ubi/wl.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index 7e97ecd727a0..227a28c9fc21 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -1710,6 +1710,19 @@ int ubi_thread(void *u)
 		    !ubi->thread_enabled || ubi_dbg_is_bgt_disabled(ubi)) {
 			set_current_state(TASK_INTERRUPTIBLE);
 			spin_unlock(&ubi->wl_lock);
+
+			/*
+			 * Check kthread_should_stop() after we set the task
+			 * state to guarantee that we either see the stop bit
+			 * and exit or the task state is reset to runnable such
+			 * that it's not scheduled out indefinitely and detects
+			 * the stop bit at kthread_should_stop().
+			 */
+			if (kthread_should_stop()) {
+				set_current_state(TASK_RUNNING);
+				break;
+			}
+
 			schedule();
 			continue;
 		}

From 72e321536f6c2345789cd7a5ef6d325693dd8de3 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Sat, 17 Oct 2020 16:13:37 -0700
Subject: [PATCH 0927/2658] ia64: fix build error with !COREDUMP

commit 7404840d87557c4092bf0272bce5e0354c774bf9 upstream.

Fix linkage error when CONFIG_BINFMT_ELF is selected but CONFIG_COREDUMP
is not:

    ia64-linux-ld: arch/ia64/kernel/elfcore.o: in function `elf_core_write_extra_phdrs':
    elfcore.c:(.text+0x172): undefined reference to `dump_emit'
    ia64-linux-ld: arch/ia64/kernel/elfcore.o: in function `elf_core_write_extra_data':
    elfcore.c:(.text+0x2b2): undefined reference to `dump_emit'

Fixes: 1fcccbac89f5 ("elf coredump: replace ELF_CORE_EXTRA_* macros by functions")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20200819064146.12529-1-krzk@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/ia64/kernel/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/ia64/kernel/Makefile b/arch/ia64/kernel/Makefile
index 9edda5466020..bcd3668f1bb8 100644
--- a/arch/ia64/kernel/Makefile
+++ b/arch/ia64/kernel/Makefile
@@ -42,7 +42,7 @@ endif
 obj-$(CONFIG_INTEL_IOMMU)	+= pci-dma.o
 obj-$(CONFIG_SWIOTLB)		+= pci-swiotlb.o
 
-obj-$(CONFIG_BINFMT_ELF)	+= elfcore.o
+obj-$(CONFIG_ELF_CORE)		+= elfcore.o
 
 # fp_emulate() expects f2-f5,f16-f31 to contain the user-level state.
 CFLAGS_traps.o  += -mfixed-range=f2-f5,f16-f31

From 2f24d34276fdc6f0664d9d0c50b35245c292b2cb Mon Sep 17 00:00:00 2001
From: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Date: Sun, 4 Oct 2020 19:04:24 +0100
Subject: [PATCH 0928/2658] ceph: promote to unsigned long long before shifting

commit c403c3a2fbe24d4ed33e10cabad048583ebd4edf upstream.

On 32-bit systems, this shift will overflow for files larger than 4GB.

Cc: stable@vger.kernel.org
Fixes: 61f68816211e ("ceph: check caps in filemap_fault and page_mkwrite")
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ceph/addr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index 22bae2b434e2..fbf383048409 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -1243,7 +1243,7 @@ static int ceph_filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 	struct ceph_inode_info *ci = ceph_inode(inode);
 	struct ceph_file_info *fi = vma->vm_file->private_data;
 	struct page *pinned_page = NULL;
-	loff_t off = vmf->pgoff << PAGE_CACHE_SHIFT;
+	loff_t off = (loff_t)vmf->pgoff << PAGE_CACHE_SHIFT;
 	int want, got, ret;
 
 	dout("filemap_fault %p %llx.%llx %llu~%zd trying to get caps\n",

From ba9df092b84822e9dfd8630cb4f124d6e57e00cc Mon Sep 17 00:00:00 2001
From: Ilya Dryomov <idryomov@gmail.com>
Date: Wed, 7 Oct 2020 20:06:48 +0200
Subject: [PATCH 0929/2658] libceph: clear con->out_msg on
 Policy::stateful_server faults

commit 28e1581c3b4ea5f98530064a103c6217bedeea73 upstream.

con->out_msg must be cleared on Policy::stateful_server
(!CEPH_MSG_CONNECT_LOSSY) faults.  Not doing so botches the
reconnection attempt, because after writing the banner the
messenger moves on to writing the data section of that message
(either from where it got interrupted by the connection reset or
from the beginning) instead of writing struct ceph_msg_connect.
This results in a bizarre error message because the server
sends CEPH_MSGR_TAG_BADPROTOVER but we think we wrote struct
ceph_msg_connect:

  libceph: mds0 (1)172.21.15.45:6828 socket error on write
  ceph: mds0 reconnect start
  libceph: mds0 (1)172.21.15.45:6829 socket closed (con state OPEN)
  libceph: mds0 (1)172.21.15.45:6829 protocol version mismatch, my 32 != server's 32
  libceph: mds0 (1)172.21.15.45:6829 protocol version mismatch

AFAICT this bug goes back to the dawn of the kernel client.
The reason it survived for so long is that only MDS sessions
are stateful and only two MDS messages have a data section:
CEPH_MSG_CLIENT_RECONNECT (always, but reconnecting is rare)
and CEPH_MSG_CLIENT_REQUEST (only when xattrs are involved).
The connection has to get reset precisely when such message
is being sent -- in this case it was the former.

Cc: stable@vger.kernel.org
Link: https://tracker.ceph.com/issues/47723
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ceph/messenger.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 3ed2796d008b..3fbc312e43ce 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -2976,6 +2976,11 @@ static void con_fault(struct ceph_connection *con)
 		ceph_msg_put(con->in_msg);
 		con->in_msg = NULL;
 	}
+	if (con->out_msg) {
+		BUG_ON(con->out_msg->con != con);
+		ceph_msg_put(con->out_msg);
+		con->out_msg = NULL;
+	}
 
 	/* Requeue anything that hasn't been acked */
 	list_splice_init(&con->out_sent, &con->out_queue);

From 2cb7d175ffb1f0e6a119f09ae5bf5b027c619671 Mon Sep 17 00:00:00 2001
From: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Date: Sun, 4 Oct 2020 19:04:22 +0100
Subject: [PATCH 0930/2658] 9P: Cast to loff_t before multiplying

commit f5f7ab168b9a60e12a4b8f2bb6fcc91321dc23c1 upstream.

On 32-bit systems, this multiplication will overflow for files larger
than 4GB.

Link: http://lkml.kernel.org/r/20201004180428.14494-2-willy@infradead.org
Cc: stable@vger.kernel.org
Fixes: fb89b45cdfdc ("9P: introduction of a new cache=mmap model.")
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/9p/vfs_file.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index 9dbf37147126..b5aa3e005b9e 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -624,9 +624,9 @@ static void v9fs_mmap_vm_close(struct vm_area_struct *vma)
 	struct writeback_control wbc = {
 		.nr_to_write = LONG_MAX,
 		.sync_mode = WB_SYNC_ALL,
-		.range_start = vma->vm_pgoff * PAGE_SIZE,
+		.range_start = (loff_t)vma->vm_pgoff * PAGE_SIZE,
 		 /* absolute end, byte at end included */
-		.range_end = vma->vm_pgoff * PAGE_SIZE +
+		.range_end = (loff_t)vma->vm_pgoff * PAGE_SIZE +
 			(vma->vm_end - vma->vm_start - 1),
 	};
 

From 0be860b3dd8bf12ed946c595b051729ff0bb2024 Mon Sep 17 00:00:00 2001
From: Qiujun Huang <hqjagain@gmail.com>
Date: Mon, 19 Oct 2020 22:22:42 +0800
Subject: [PATCH 0931/2658] ring-buffer: Return 0 on success from
 ring_buffer_resize()

commit 0a1754b2a97efa644aa6e84d1db5b17c42251483 upstream.

We don't need to check the new buffer size, and the return value
had confused resize_buffer_duplicate_size().
...
	ret = ring_buffer_resize(trace_buf->buffer,
		per_cpu_ptr(size_buf->data,cpu_id)->entries, cpu_id);
	if (ret == 0)
		per_cpu_ptr(trace_buf->data, cpu_id)->entries =
			per_cpu_ptr(size_buf->data, cpu_id)->entries;
...

Link: https://lkml.kernel.org/r/20201019142242.11560-1-hqjagain@gmail.com

Cc: stable@vger.kernel.org
Fixes: d60da506cbeb3 ("tracing: Add a resize function to make one buffer equivalent to another buffer")
Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/ring_buffer.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 1cf2402c6922..1c1ecc1d49ad 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1659,18 +1659,18 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size,
 {
 	struct ring_buffer_per_cpu *cpu_buffer;
 	unsigned long nr_pages;
-	int cpu, err = 0;
+	int cpu, err;
 
 	/*
 	 * Always succeed at resizing a non-existent buffer:
 	 */
 	if (!buffer)
-		return size;
+		return 0;
 
 	/* Make sure the requested buffer exists */
 	if (cpu_id != RING_BUFFER_ALL_CPUS &&
 	    !cpumask_test_cpu(cpu_id, buffer->cpumask))
-		return size;
+		return 0;
 
 	nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE);
 
@@ -1810,7 +1810,7 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size,
 	}
 
 	mutex_unlock(&buffer->mutex);
-	return size;
+	return 0;
 
  out_err:
 	for_each_buffer_cpu(buffer, cpu) {

From 90125e83af18b6445cbd4a29a489b0c7dabb3011 Mon Sep 17 00:00:00 2001
From: Stefano Garzarella <sgarzare@redhat.com>
Date: Thu, 8 Oct 2020 22:42:56 +0200
Subject: [PATCH 0932/2658] vringh: fix __vringh_iov() when riov and wiov are
 different

commit 5745bcfbbf89b158416075374254d3c013488f21 upstream.

If riov and wiov are both defined and they point to different
objects, only riov is initialized. If the wiov is not initialized
by the caller, the function fails returning -EINVAL and printing
"Readable desc 0x... after writable" error message.

This issue happens when descriptors have both readable and writable
buffers (eg. virtio-blk devices has virtio_blk_outhdr in the readable
buffer and status as last byte of writable buffer) and we call
__vringh_iov() to get both type of buffers in two different iovecs.

Let's replace the 'else if' clause with 'if' to initialize both
riov and wiov if they are not NULL.

As checkpatch pointed out, we also avoid crashing the kernel
when riov and wiov are both NULL, replacing BUG() with WARN_ON()
and returning -EINVAL.

Fixes: f87d0fbb5798 ("vringh: host-side implementation of virtio rings.")
Cc: stable@vger.kernel.org
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://lore.kernel.org/r/20201008204256.162292-1-sgarzare@redhat.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/vhost/vringh.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index 3bb02c60a2f5..d56736655dec 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -272,13 +272,14 @@ __vringh_iov(struct vringh *vrh, u16 i,
 	desc_max = vrh->vring.num;
 	up_next = -1;
 
+	/* You must want something! */
+	if (WARN_ON(!riov && !wiov))
+		return -EINVAL;
+
 	if (riov)
 		riov->i = riov->used = 0;
-	else if (wiov)
+	if (wiov)
 		wiov->i = wiov->used = 0;
-	else
-		/* You must want something! */
-		BUG();
 
 	for (;;) {
 		void *addr;

From 68032cbbf1c6ea55aa9baea9637949b34e69e071 Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Mon, 26 Oct 2020 13:15:23 -0700
Subject: [PATCH 0933/2658] tty: make FONTX ioctl use the tty pointer they were
 actually passed

commit 90bfdeef83f1d6c696039b6a917190dcbbad3220 upstream.

Some of the font tty ioctl's always used the current foreground VC for
their operations.  Don't do that then.

This fixes a data race on fg_console.

Side note: both Michael Ellerman and Jiri Slaby point out that all these
ioctls are deprecated, and should probably have been removed long ago,
and everything seems to be using the KDFONTOP ioctl instead.

In fact, Michael points out that it looks like busybox's loadfont
program seems to have switched over to using KDFONTOP exactly _because_
of this bug (ahem.. 12 years ago ;-).

Reported-by: Minh Yuan <yuanmingbuaa@gmail.com>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
Acked-by: Jiri Slaby <jirislaby@kernel.org>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/vt/vt_ioctl.c | 32 +++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
index b0f0771a5729..b111071d19b5 100644
--- a/drivers/tty/vt/vt_ioctl.c
+++ b/drivers/tty/vt/vt_ioctl.c
@@ -243,7 +243,7 @@ int vt_waitactive(int n)
 
 
 static inline int 
-do_fontx_ioctl(int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op)
+do_fontx_ioctl(struct vc_data *vc, int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op)
 {
 	struct consolefontdesc cfdarg;
 	int i;
@@ -261,15 +261,16 @@ do_fontx_ioctl(int cmd, struct consolefontdesc __user *user_cfd, int perm, struc
 		op->height = cfdarg.charheight;
 		op->charcount = cfdarg.charcount;
 		op->data = cfdarg.chardata;
-		return con_font_op(vc_cons[fg_console].d, op);
-	case GIO_FONTX: {
+		return con_font_op(vc, op);
+
+	case GIO_FONTX:
 		op->op = KD_FONT_OP_GET;
 		op->flags = KD_FONT_FLAG_OLD;
 		op->width = 8;
 		op->height = cfdarg.charheight;
 		op->charcount = cfdarg.charcount;
 		op->data = cfdarg.chardata;
-		i = con_font_op(vc_cons[fg_console].d, op);
+		i = con_font_op(vc, op);
 		if (i)
 			return i;
 		cfdarg.charheight = op->height;
@@ -277,7 +278,6 @@ do_fontx_ioctl(int cmd, struct consolefontdesc __user *user_cfd, int perm, struc
 		if (copy_to_user(user_cfd, &cfdarg, sizeof(struct consolefontdesc)))
 			return -EFAULT;
 		return 0;
-		}
 	}
 	return -EINVAL;
 }
@@ -927,7 +927,7 @@ int vt_ioctl(struct tty_struct *tty,
 		op.height = 0;
 		op.charcount = 256;
 		op.data = up;
-		ret = con_font_op(vc_cons[fg_console].d, &op);
+		ret = con_font_op(vc, &op);
 		break;
 	}
 
@@ -938,7 +938,7 @@ int vt_ioctl(struct tty_struct *tty,
 		op.height = 32;
 		op.charcount = 256;
 		op.data = up;
-		ret = con_font_op(vc_cons[fg_console].d, &op);
+		ret = con_font_op(vc, &op);
 		break;
 	}
 
@@ -955,7 +955,7 @@ int vt_ioctl(struct tty_struct *tty,
 
 	case PIO_FONTX:
 	case GIO_FONTX:
-		ret = do_fontx_ioctl(cmd, up, perm, &op);
+		ret = do_fontx_ioctl(vc, cmd, up, perm, &op);
 		break;
 
 	case PIO_FONTRESET:
@@ -972,11 +972,11 @@ int vt_ioctl(struct tty_struct *tty,
 		{
 		op.op = KD_FONT_OP_SET_DEFAULT;
 		op.data = NULL;
-		ret = con_font_op(vc_cons[fg_console].d, &op);
+		ret = con_font_op(vc, &op);
 		if (ret)
 			break;
 		console_lock();
-		con_set_default_unimap(vc_cons[fg_console].d);
+		con_set_default_unimap(vc);
 		console_unlock();
 		break;
 		}
@@ -1109,8 +1109,9 @@ struct compat_consolefontdesc {
 };
 
 static inline int
-compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd,
-			 int perm, struct console_font_op *op)
+compat_fontx_ioctl(struct vc_data *vc, int cmd,
+		   struct compat_consolefontdesc __user *user_cfd,
+		   int perm, struct console_font_op *op)
 {
 	struct compat_consolefontdesc cfdarg;
 	int i;
@@ -1128,7 +1129,8 @@ compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd,
 		op->height = cfdarg.charheight;
 		op->charcount = cfdarg.charcount;
 		op->data = compat_ptr(cfdarg.chardata);
-		return con_font_op(vc_cons[fg_console].d, op);
+		return con_font_op(vc, op);
+
 	case GIO_FONTX:
 		op->op = KD_FONT_OP_GET;
 		op->flags = KD_FONT_FLAG_OLD;
@@ -1136,7 +1138,7 @@ compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd,
 		op->height = cfdarg.charheight;
 		op->charcount = cfdarg.charcount;
 		op->data = compat_ptr(cfdarg.chardata);
-		i = con_font_op(vc_cons[fg_console].d, op);
+		i = con_font_op(vc, op);
 		if (i)
 			return i;
 		cfdarg.charheight = op->height;
@@ -1231,7 +1233,7 @@ long vt_compat_ioctl(struct tty_struct *tty,
 	 */
 	case PIO_FONTX:
 	case GIO_FONTX:
-		ret = compat_fontx_ioctl(cmd, up, perm, &op);
+		ret = compat_fontx_ioctl(vc, cmd, up, perm, &op);
 		break;
 
 	case KDFONTOP:

From 7bb5b26b78715b2f5419a6e085c57c74ddb05e11 Mon Sep 17 00:00:00 2001
From: Jisheng Zhang <Jisheng.Zhang@synaptics.com>
Date: Fri, 9 Oct 2020 15:08:31 +0800
Subject: [PATCH 0934/2658] arm64: berlin: Select DW_APB_TIMER_OF

commit b0fc70ce1f028e14a37c186d9f7a55e51439b83a upstream.

Berlin SoCs always contain some DW APB timers which can be used as an
always-on broadcast timer.

Link: https://lore.kernel.org/r/20201009150536.214181fb@xhacker.debian
Cc: <stable@vger.kernel.org> # v3.14+
Signed-off-by: Jisheng Zhang <Jisheng.Zhang@synaptics.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/Kconfig.platforms | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms
index 3206dc4aec53..4c30bfb9b06f 100644
--- a/arch/arm64/Kconfig.platforms
+++ b/arch/arm64/Kconfig.platforms
@@ -9,6 +9,7 @@ config ARCH_BERLIN
 	bool "Marvell Berlin SoC Family"
 	select ARCH_REQUIRE_GPIOLIB
 	select DW_APB_ICTL
+	select DW_APB_TIMER_OF
 	help
 	  This enables support for Marvell Berlin SoC Family
 

From 41473bda5790de11f2b0ebc32cdb97e5d77cc361 Mon Sep 17 00:00:00 2001
From: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Date: Mon, 26 Oct 2020 09:12:10 +0000
Subject: [PATCH 0935/2658] cachefiles: Handle readpage error correctly

commit 9480b4e75b7108ee68ecf5bc6b4bd68e8031c521 upstream.

If ->readpage returns an error, it has already unlocked the page.

Fixes: 5e929b33c393 ("CacheFiles: Handle truncate unlocking the page we're reading")
Cc: stable@vger.kernel.org
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cachefiles/rdwr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
index 5df898fd0a0a..9047f0e64bc0 100644
--- a/fs/cachefiles/rdwr.c
+++ b/fs/cachefiles/rdwr.c
@@ -125,7 +125,7 @@ static int cachefiles_read_reissue(struct cachefiles_object *object,
 		_debug("reissue read");
 		ret = bmapping->a_ops->readpage(NULL, backpage);
 		if (ret < 0)
-			goto unlock_discard;
+			goto discard;
 	}
 
 	/* but the page may have been read before the monitor was installed, so
@@ -142,6 +142,7 @@ static int cachefiles_read_reissue(struct cachefiles_object *object,
 
 unlock_discard:
 	unlock_page(backpage);
+discard:
 	spin_lock_irq(&object->work_lock);
 	list_del(&monitor->op_link);
 	spin_unlock_irq(&object->work_lock);

From 4842907543edf02c51e0748b51f907f8ddfbe71b Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Mon, 19 Oct 2020 16:57:50 +0200
Subject: [PATCH 0936/2658] hil/parisc: Disable HIL driver when it gets stuck

commit 879bc2d27904354b98ca295b6168718e045c4aa2 upstream.

When starting a HP machine with HIL driver but without an HIL keyboard
or HIL mouse attached, it may happen that data written to the HIL loop
gets stuck (e.g. because the transaction queue is full).  Usually one
will then have to reboot the machine because all you see is and endless
output of:
 Transaction add failed: transaction already queued?

In the higher layers hp_sdc_enqueue_transaction() is called to queued up
a HIL packet. This function returns an error code, and this patch adds
the necessary checks for this return code and disables the HIL driver if
further packets can't be sent.

Tested on a HP 730 and a HP 715/64 machine.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/serio/hil_mlc.c    | 21 ++++++++++++++++++---
 drivers/input/serio/hp_sdc_mlc.c |  8 ++++----
 include/linux/hil_mlc.h          |  2 +-
 3 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/drivers/input/serio/hil_mlc.c b/drivers/input/serio/hil_mlc.c
index 65605e4ef3cf..1491a9a5c6b0 100644
--- a/drivers/input/serio/hil_mlc.c
+++ b/drivers/input/serio/hil_mlc.c
@@ -74,7 +74,7 @@ EXPORT_SYMBOL(hil_mlc_unregister);
 static LIST_HEAD(hil_mlcs);
 static DEFINE_RWLOCK(hil_mlcs_lock);
 static struct timer_list	hil_mlcs_kicker;
-static int			hil_mlcs_probe;
+static int			hil_mlcs_probe, hil_mlc_stop;
 
 static void hil_mlcs_process(unsigned long unused);
 static DECLARE_TASKLET_DISABLED(hil_mlcs_tasklet, hil_mlcs_process, 0);
@@ -704,9 +704,13 @@ static int hilse_donode(hil_mlc *mlc)
 		if (!mlc->ostarted) {
 			mlc->ostarted = 1;
 			mlc->opacket = pack;
-			mlc->out(mlc);
+			rc = mlc->out(mlc);
 			nextidx = HILSEN_DOZE;
 			write_unlock_irqrestore(&mlc->lock, flags);
+			if (rc) {
+				hil_mlc_stop = 1;
+				return 1;
+			}
 			break;
 		}
 		mlc->ostarted = 0;
@@ -717,8 +721,13 @@ static int hilse_donode(hil_mlc *mlc)
 
 	case HILSE_CTS:
 		write_lock_irqsave(&mlc->lock, flags);
-		nextidx = mlc->cts(mlc) ? node->bad : node->good;
+		rc = mlc->cts(mlc);
+		nextidx = rc ? node->bad : node->good;
 		write_unlock_irqrestore(&mlc->lock, flags);
+		if (rc) {
+			hil_mlc_stop = 1;
+			return 1;
+		}
 		break;
 
 	default:
@@ -786,6 +795,12 @@ static void hil_mlcs_process(unsigned long unused)
 
 static void hil_mlcs_timer(unsigned long data)
 {
+	if (hil_mlc_stop) {
+		/* could not send packet - stop immediately. */
+		pr_warn(PREFIX "HIL seems stuck - Disabling HIL MLC.\n");
+		return;
+	}
+
 	hil_mlcs_probe = 1;
 	tasklet_schedule(&hil_mlcs_tasklet);
 	/* Re-insert the periodic task. */
diff --git a/drivers/input/serio/hp_sdc_mlc.c b/drivers/input/serio/hp_sdc_mlc.c
index d50f0678bf47..078cbe6522a2 100644
--- a/drivers/input/serio/hp_sdc_mlc.c
+++ b/drivers/input/serio/hp_sdc_mlc.c
@@ -213,7 +213,7 @@ static int hp_sdc_mlc_cts(hil_mlc *mlc)
 	priv->tseq[2] = 1;
 	priv->tseq[3] = 0;
 	priv->tseq[4] = 0;
-	__hp_sdc_enqueue_transaction(&priv->trans);
+	return __hp_sdc_enqueue_transaction(&priv->trans);
  busy:
 	return 1;
  done:
@@ -222,7 +222,7 @@ static int hp_sdc_mlc_cts(hil_mlc *mlc)
 	return 0;
 }
 
-static void hp_sdc_mlc_out(hil_mlc *mlc)
+static int hp_sdc_mlc_out(hil_mlc *mlc)
 {
 	struct hp_sdc_mlc_priv_s *priv;
 
@@ -237,7 +237,7 @@ static void hp_sdc_mlc_out(hil_mlc *mlc)
  do_data:
 	if (priv->emtestmode) {
 		up(&mlc->osem);
-		return;
+		return 0;
 	}
 	/* Shouldn't be sending commands when loop may be busy */
 	BUG_ON(down_trylock(&mlc->csem));
@@ -299,7 +299,7 @@ static void hp_sdc_mlc_out(hil_mlc *mlc)
 		BUG_ON(down_trylock(&mlc->csem));
 	}
  enqueue:
-	hp_sdc_enqueue_transaction(&priv->trans);
+	return hp_sdc_enqueue_transaction(&priv->trans);
 }
 
 static int __init hp_sdc_mlc_init(void)
diff --git a/include/linux/hil_mlc.h b/include/linux/hil_mlc.h
index 394a8405dd74..e0521a1d9325 100644
--- a/include/linux/hil_mlc.h
+++ b/include/linux/hil_mlc.h
@@ -103,7 +103,7 @@ struct hilse_node {
 
 /* Methods for back-end drivers, e.g. hp_sdc_mlc */
 typedef int	(hil_mlc_cts) (hil_mlc *mlc);
-typedef void	(hil_mlc_out) (hil_mlc *mlc);
+typedef int	(hil_mlc_out) (hil_mlc *mlc);
 typedef int	(hil_mlc_in)  (hil_mlc *mlc, suseconds_t timeout);
 
 struct hil_mlc_devinfo {

From 832bbb93be1cbfde948d7d5c246760f584226e87 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Thu, 10 Sep 2020 17:41:49 +0200
Subject: [PATCH 0937/2658] ARM: samsung: fix PM debug build with DEBUG_LL but
 !MMU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 7be0d19c751b02db778ca95e3274d5ea7f31891c upstream.

Selecting CONFIG_SAMSUNG_PM_DEBUG (depending on CONFIG_DEBUG_LL) but
without CONFIG_MMU leads to build errors:

  arch/arm/plat-samsung/pm-debug.c: In function ‘s3c_pm_uart_base’:
  arch/arm/plat-samsung/pm-debug.c:57:2: error:
    implicit declaration of function ‘debug_ll_addr’ [-Werror=implicit-function-declaration]

Fixes: 99b2fc2b8b40 ("ARM: SAMSUNG: Use debug_ll_addr() to get UART base address")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200910154150.3318-1-krzk@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/plat-samsung/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/plat-samsung/Kconfig b/arch/arm/plat-samsung/Kconfig
index b9396dcf836d..ffdf9f2ca437 100644
--- a/arch/arm/plat-samsung/Kconfig
+++ b/arch/arm/plat-samsung/Kconfig
@@ -239,6 +239,7 @@ config SAMSUNG_PM_DEBUG
 	bool "Samsung PM Suspend debug"
 	depends on PM && DEBUG_KERNEL
 	depends on DEBUG_EXYNOS_UART || DEBUG_S3C24XX_UART || DEBUG_S3C2410_UART
+	depends on DEBUG_LL && MMU
 	help
 	  Say Y here if you want verbose debugging from the PM Suspend and
 	  Resume code. See <file:Documentation/arm/Samsung-S3C24XX/Suspend.txt>

From 9e0ae7648498869abb6aa6df0fe5278f12d0712b Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Tue, 4 Aug 2020 21:26:49 +0200
Subject: [PATCH 0938/2658] ARM: s3c24xx: fix missing system reset

commit f6d7cde84f6c5551586c8b9b68d70f8e6dc9a000 upstream.

Commit f6361c6b3880 ("ARM: S3C24XX: remove separate restart code")
removed usage of the watchdog reset platform code in favor of the
Samsung SoC watchdog driver.  However the latter was not selected thus
S3C24xx platforms lost reset abilities.

Cc: <stable@vger.kernel.org>
Fixes: f6361c6b3880 ("ARM: S3C24XX: remove separate restart code")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/Kconfig | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index f19b2cee885f..28051cf4504f 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -716,7 +716,9 @@ config ARCH_S3C24XX
 	select HAVE_S3C_RTC if RTC_CLASS
 	select MULTI_IRQ_HANDLER
 	select NEED_MACH_IO_H
+	select S3C2410_WATCHDOG
 	select SAMSUNG_ATAGS
+	select WATCHDOG
 	help
 	  Samsung S3C2410, S3C2412, S3C2413, S3C2416, S3C2440, S3C2442, S3C2443
 	  and S3C2450 SoCs based systems, such as the Simtec Electronics BAST

From 2c67fe75f9fa3365d990b241772d17abecca5d54 Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Thu, 22 Oct 2020 21:40:59 +0300
Subject: [PATCH 0939/2658] device property: Keep secondary firmware node
 secondary by type

commit d5dcce0c414fcbfe4c2037b66ac69ea5f9b3f75c upstream.

Behind primary and secondary we understand the type of the nodes
which might define their ordering. However, if primary node gone,
we can't maintain the ordering by definition of the linked list.
Thus, by ordering secondary node becomes first in the list.
But in this case the meaning of it is still secondary (or auxiliary).
The type of the node is maintained by the secondary pointer in it:

	secondary pointer		Meaning
	NULL or valid			primary node
	ERR_PTR(-ENODEV)		secondary node

So, if by some reason we do the following sequence of calls

	set_primary_fwnode(dev, NULL);
	set_primary_fwnode(dev, primary);

we should preserve secondary node.

This concept is supported by the description of set_primary_fwnode()
along with implementation of set_secondary_fwnode(). Hence, fix
the commit c15e1bdda436 to follow this as well.

Fixes: c15e1bdda436 ("device property: Fix the secondary firmware node handling in set_primary_fwnode()")
Cc: Ferry Toth <fntoth@gmail.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Tested-by: Ferry Toth <fntoth@gmail.com>
Cc: 5.9+ <stable@vger.kernel.org> # 5.9+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index 39e67fb94f21..b152f7bf525f 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2360,7 +2360,7 @@ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode)
 	} else {
 		if (fwnode_is_primary(fn)) {
 			dev->fwnode = fn->secondary;
-			fn->secondary = NULL;
+			fn->secondary = ERR_PTR(-ENODEV);
 		} else {
 			dev->fwnode = NULL;
 		}

From c761880595fdaaa373f5b101ba38302be314c2b9 Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Thu, 22 Oct 2020 21:41:00 +0300
Subject: [PATCH 0940/2658] device property: Don't clear secondary pointer for
 shared primary firmware node

commit 99aed9227073fb34ce2880cbc7063e04185a65e1 upstream.

It appears that firmware nodes can be shared between devices. In such case
when a (child) device is about to be deleted, its firmware node may be shared
and ACPI_COMPANION_SET(..., NULL) call for it breaks the secondary link
of the shared primary firmware node.

In order to prevent that, check, if the device has a parent and parent's
firmware node is shared with its child, and avoid crashing the link.

Fixes: c15e1bdda436 ("device property: Fix the secondary firmware node handling in set_primary_fwnode()")
Reported-by: Ferry Toth <fntoth@gmail.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Tested-by: Ferry Toth <fntoth@gmail.com>
Cc: 5.9+ <stable@vger.kernel.org> # 5.9+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index b152f7bf525f..5c2a99e2cb84 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2349,6 +2349,7 @@ static inline bool fwnode_is_primary(struct fwnode_handle *fwnode)
  */
 void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode)
 {
+	struct device *parent = dev->parent;
 	struct fwnode_handle *fn = dev->fwnode;
 
 	if (fwnode) {
@@ -2360,7 +2361,8 @@ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode)
 	} else {
 		if (fwnode_is_primary(fn)) {
 			dev->fwnode = fn->secondary;
-			fn->secondary = ERR_PTR(-ENODEV);
+			if (!(parent && fn == parent->fwnode))
+				fn->secondary = ERR_PTR(-ENODEV);
 		} else {
 			dev->fwnode = NULL;
 		}

From 0a1462d559488232491908c522752a2bb8e7417d Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Wed, 21 Oct 2020 13:21:42 +0100
Subject: [PATCH 0941/2658] staging: comedi: cb_pcidas: Allow 2-channel
 commands for AO subdevice

commit 647a6002cb41d358d9ac5de101a8a6dc74748a59 upstream.

The "cb_pcidas" driver supports asynchronous commands on the analog
output (AO) subdevice for those boards that have an AO FIFO.  The code
(in `cb_pcidas_ao_check_chanlist()` and `cb_pcidas_ao_cmd()`) to
validate and set up the command supports output to a single channel or
to two channels simultaneously (the boards have two AO channels).
However, the code in `cb_pcidas_auto_attach()` that initializes the
subdevices neglects to initialize the AO subdevice's `len_chanlist`
member, leaving it set to 0, but the Comedi core will "correct" it to 1
if the driver neglected to set it.  This limits commands to use a single
channel (either channel 0 or 1), but the limit should be two channels.
Set the AO subdevice's `len_chanlist` member to be the same value as the
`n_chan` member, which will be 2.

Cc: <stable@vger.kernel.org>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20201021122142.81628-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/cb_pcidas.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/staging/comedi/drivers/cb_pcidas.c b/drivers/staging/comedi/drivers/cb_pcidas.c
index 3cd008acb657..3ea15bb0e56e 100644
--- a/drivers/staging/comedi/drivers/cb_pcidas.c
+++ b/drivers/staging/comedi/drivers/cb_pcidas.c
@@ -1351,6 +1351,7 @@ static int cb_pcidas_auto_attach(struct comedi_device *dev,
 		if (dev->irq && board->has_ao_fifo) {
 			dev->write_subdev = s;
 			s->subdev_flags	|= SDF_CMD_WRITE;
+			s->len_chanlist	= s->n_chan;
 			s->do_cmdtest	= cb_pcidas_ao_cmdtest;
 			s->do_cmd	= cb_pcidas_ao_cmd;
 			s->cancel	= cb_pcidas_ao_cancel;

From c9ddf70301a4b05d498d371df9446ee1699f21a6 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Wed, 30 Sep 2020 11:16:14 +0200
Subject: [PATCH 0942/2658] xen/events: don't use chip_data for legacy IRQs

commit 0891fb39ba67bd7ae023ea0d367297ffff010781 upstream.

Since commit c330fb1ddc0a ("XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.")
Xen is using the chip_data pointer for storing IRQ specific data. When
running as a HVM domain this can result in problems for legacy IRQs, as
those might use chip_data for their own purposes.

Use a local array for this purpose in case of legacy IRQs, avoiding the
double use.

Cc: stable@vger.kernel.org
Fixes: c330fb1ddc0a ("XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.")
Signed-off-by: Juergen Gross <jgross@suse.com>
Tested-by: Stefan Bader <stefan.bader@canonical.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Link: https://lore.kernel.org/r/20200930091614.13660-1-jgross@suse.com
Signed-off-by: Juergen Gross <jgross@suse.com>
[bwh: Backported to 4.9: adjust context]
Signed-off-by: Ben Hutchings <benh@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/events/events_base.c | 29 +++++++++++++++++++++--------
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index e4dd991e2888..9a126732d5d9 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -91,6 +91,8 @@ static bool (*pirq_needs_eoi)(unsigned irq);
 /* Xen will never allocate port zero for any purpose. */
 #define VALID_EVTCHN(chn)	((chn) != 0)
 
+static struct irq_info *legacy_info_ptrs[NR_IRQS_LEGACY];
+
 static struct irq_chip xen_dynamic_chip;
 static struct irq_chip xen_percpu_chip;
 static struct irq_chip xen_pirq_chip;
@@ -155,7 +157,18 @@ int get_evtchn_to_irq(unsigned evtchn)
 /* Get info for IRQ */
 struct irq_info *info_for_irq(unsigned irq)
 {
-	return irq_get_chip_data(irq);
+	if (irq < nr_legacy_irqs())
+		return legacy_info_ptrs[irq];
+	else
+		return irq_get_chip_data(irq);
+}
+
+static void set_info_for_irq(unsigned int irq, struct irq_info *info)
+{
+	if (irq < nr_legacy_irqs())
+		legacy_info_ptrs[irq] = info;
+	else
+		irq_set_chip_data(irq, info);
 }
 
 /* Constructors for packed IRQ information. */
@@ -384,7 +397,7 @@ static void xen_irq_init(unsigned irq)
 	info->type = IRQT_UNBOUND;
 	info->refcnt = -1;
 
-	irq_set_chip_data(irq, info);
+	set_info_for_irq(irq, info);
 
 	list_add_tail(&info->list, &xen_irq_list_head);
 }
@@ -433,14 +446,14 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi)
 
 static void xen_free_irq(unsigned irq)
 {
-	struct irq_info *info = irq_get_chip_data(irq);
+	struct irq_info *info = info_for_irq(irq);
 
 	if (WARN_ON(!info))
 		return;
 
 	list_del(&info->list);
 
-	irq_set_chip_data(irq, NULL);
+	set_info_for_irq(irq, NULL);
 
 	WARN_ON(info->refcnt > 0);
 
@@ -610,7 +623,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi);
 static void __unbind_from_irq(unsigned int irq)
 {
 	int evtchn = evtchn_from_irq(irq);
-	struct irq_info *info = irq_get_chip_data(irq);
+	struct irq_info *info = info_for_irq(irq);
 
 	if (info->refcnt > 0) {
 		info->refcnt--;
@@ -1114,7 +1127,7 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi,
 
 void unbind_from_irqhandler(unsigned int irq, void *dev_id)
 {
-	struct irq_info *info = irq_get_chip_data(irq);
+	struct irq_info *info = info_for_irq(irq);
 
 	if (WARN_ON(!info))
 		return;
@@ -1148,7 +1161,7 @@ int evtchn_make_refcounted(unsigned int evtchn)
 	if (irq == -1)
 		return -ENOENT;
 
-	info = irq_get_chip_data(irq);
+	info = info_for_irq(irq);
 
 	if (!info)
 		return -ENOENT;
@@ -1176,7 +1189,7 @@ int evtchn_get(unsigned int evtchn)
 	if (irq == -1)
 		goto done;
 
-	info = irq_get_chip_data(irq);
+	info = info_for_irq(irq);
 
 	if (!info)
 		goto done;

From 747f8c29b2398353b1cc8f8dda94beaff81829ba Mon Sep 17 00:00:00 2001
From: Hoang Huu Le <hoang.h.le@dektech.com.au>
Date: Thu, 27 Aug 2020 09:56:51 +0700
Subject: [PATCH 0943/2658] tipc: fix use-after-free in tipc_bcast_get_mode

commit fdeba99b1e58ecd18c2940c453e19e4ef20ff591 upstream.

Syzbot has reported those issues as:

==================================================================
BUG: KASAN: use-after-free in tipc_bcast_get_mode+0x3ab/0x400 net/tipc/bcast.c:759
Read of size 1 at addr ffff88805e6b3571 by task kworker/0:6/3850

CPU: 0 PID: 3850 Comm: kworker/0:6 Not tainted 5.8.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events tipc_net_finalize_work

Thread 1's call trace:
[...]
  kfree+0x103/0x2c0 mm/slab.c:3757 <- bcbase releasing
  tipc_bcast_stop+0x1b0/0x2f0 net/tipc/bcast.c:721
  tipc_exit_net+0x24/0x270 net/tipc/core.c:112
[...]

Thread 2's call trace:
[...]
  tipc_bcast_get_mode+0x3ab/0x400 net/tipc/bcast.c:759 <- bcbase
has already been freed by Thread 1

  tipc_node_broadcast+0x9e/0xcc0 net/tipc/node.c:1744
  tipc_nametbl_publish+0x60b/0x970 net/tipc/name_table.c:752
  tipc_net_finalize net/tipc/net.c:141 [inline]
  tipc_net_finalize+0x1fa/0x310 net/tipc/net.c:131
  tipc_net_finalize_work+0x55/0x80 net/tipc/net.c:150
[...]

==================================================================
BUG: KASAN: use-after-free in tipc_named_reinit+0xef/0x290 net/tipc/name_distr.c:344
Read of size 8 at addr ffff888052ab2000 by task kworker/0:13/30628
CPU: 0 PID: 30628 Comm: kworker/0:13 Not tainted 5.8.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events tipc_net_finalize_work
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1f0/0x31e lib/dump_stack.c:118
 print_address_description+0x66/0x5a0 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report+0x132/0x1d0 mm/kasan/report.c:530
 tipc_named_reinit+0xef/0x290 net/tipc/name_distr.c:344
 tipc_net_finalize+0x85/0xe0 net/tipc/net.c:138
 tipc_net_finalize_work+0x50/0x70 net/tipc/net.c:150
 process_one_work+0x789/0xfc0 kernel/workqueue.c:2269
 worker_thread+0xaa4/0x1460 kernel/workqueue.c:2415
 kthread+0x37e/0x3a0 drivers/block/aoe/aoecmd.c:1234
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
[...]
Freed by task 14058:
 save_stack mm/kasan/common.c:48 [inline]
 set_track mm/kasan/common.c:56 [inline]
 kasan_set_free_info mm/kasan/common.c:316 [inline]
 __kasan_slab_free+0x114/0x170 mm/kasan/common.c:455
 __cache_free mm/slab.c:3426 [inline]
 kfree+0x10a/0x220 mm/slab.c:3757
 tipc_exit_net+0x29/0x50 net/tipc/core.c:113
 ops_exit_list net/core/net_namespace.c:186 [inline]
 cleanup_net+0x708/0xba0 net/core/net_namespace.c:603
 process_one_work+0x789/0xfc0 kernel/workqueue.c:2269
 worker_thread+0xaa4/0x1460 kernel/workqueue.c:2415
 kthread+0x37e/0x3a0 drivers/block/aoe/aoecmd.c:1234
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293

Fix it by calling flush_scheduled_work() to make sure the
tipc_net_finalize_work() stopped before releasing bcbase object.

Reported-by: syzbot+6ea1f7a8df64596ef4d7@syzkaller.appspotmail.com
Reported-by: syzbot+e9cc557752ab126c1b99@syzkaller.appspotmail.com
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Hoang Huu Le <hoang.h.le@dektech.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tipc/core.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/tipc/core.c b/net/tipc/core.c
index 1aa16b00f105..758e59a20a6c 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -88,6 +88,11 @@ static int __net_init tipc_init_net(struct net *net)
 static void __net_exit tipc_exit_net(struct net *net)
 {
 	tipc_net_stop(net);
+
+	/* Make sure the tipc_net_finalize_work stopped
+	 * before releasing the resources.
+	 */
+	flush_scheduled_work();
 	tipc_bcast_stop(net);
 	tipc_nametbl_stop(net);
 	tipc_sk_rht_destroy(net);

From 8cf2c53af4ea7fcde76b33143bde293bd8921ebc Mon Sep 17 00:00:00 2001
From: Claudiu Manoil <claudiu.manoil@nxp.com>
Date: Thu, 29 Oct 2020 10:10:56 +0200
Subject: [PATCH 0944/2658] gianfar: Replace skb_realloc_headroom with
 skb_cow_head for PTP

[ Upstream commit d145c9031325fed963a887851d9fa42516efd52b ]

When PTP timestamping is enabled on Tx, the controller
inserts the Tx timestamp at the beginning of the frame
buffer, between SFD and the L2 frame header.  This means
that the skb provided by the stack is required to have
enough headroom otherwise a new skb needs to be created
by the driver to accommodate the timestamp inserted by h/w.
Up until now the driver was relying on skb_realloc_headroom()
to create new skbs to accommodate PTP frames.  Turns out that
this method is not reliable in this context at least, as
skb_realloc_headroom() for PTP frames can cause random crashes,
mostly in subsequent skb_*() calls, when multiple concurrent
TCP streams are run at the same time with the PTP flow
on the same device (as seen in James' report).  I also noticed
that when the system is loaded by sending multiple TCP streams,
the driver receives cloned skbs in large numbers.
skb_cow_head() instead proves to be stable in this scenario,
and not only handles cloned skbs too but it's also more efficient
and widely used in other drivers.
The commit introducing skb_realloc_headroom in the driver
goes back to 2009, commit 93c1285c5d92
("gianfar: reallocate skb when headroom is not enough for fcb").
For practical purposes I'm referencing a newer commit (from 2012)
that brings the code to its current structure (and fixes the PTP
case).

Fixes: 9c4886e5e63b ("gianfar: Fix invalid TX frames returned on error queue when time stamping")
Reported-by: James Jurack <james.jurack@ametek.com>
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Link: https://lore.kernel.org/r/20201029081057.8506-1-claudiu.manoil@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/freescale/gianfar.c | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 96310e2ee545..a968b3206f6f 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -2353,20 +2353,12 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
 		fcb_len = GMAC_FCB_LEN + GMAC_TXPAL_LEN;
 
 	/* make space for additional header when fcb is needed */
-	if (fcb_len && unlikely(skb_headroom(skb) < fcb_len)) {
-		struct sk_buff *skb_new;
-
-		skb_new = skb_realloc_headroom(skb, fcb_len);
-		if (!skb_new) {
+	if (fcb_len) {
+		if (unlikely(skb_cow_head(skb, fcb_len))) {
 			dev->stats.tx_errors++;
 			dev_kfree_skb_any(skb);
 			return NETDEV_TX_OK;
 		}
-
-		if (skb->sk)
-			skb_set_owner_w(skb_new, skb->sk);
-		dev_consume_skb_any(skb);
-		skb = skb_new;
 	}
 
 	/* total number of fragments in the SKB */

From 4551d9e841fa590813e65e7bbfafa86bbb57fedc Mon Sep 17 00:00:00 2001
From: Claudiu Manoil <claudiu.manoil@nxp.com>
Date: Tue, 20 Oct 2020 20:36:05 +0300
Subject: [PATCH 0945/2658] gianfar: Account for Tx PTP timestamp in the skb
 headroom

[ Upstream commit d6a076d68c6b5d6a5800f3990a513facb7016dea ]

When PTP timestamping is enabled on Tx, the controller
inserts the Tx timestamp at the beginning of the frame
buffer, between SFD and the L2 frame header. This means
that the skb provided by the stack is required to have
enough headroom otherwise a new skb needs to be created
by the driver to accommodate the timestamp inserted by h/w.
Up until now the driver was relying on the second option,
using skb_realloc_headroom() to create a new skb to accommodate
PTP frames. Turns out that this method is not reliable, as
reallocation of skbs for PTP frames along with the required
overhead (skb_set_owner_w, consume_skb) is causing random
crashes in subsequent skb_*() calls, when multiple concurrent
TCP streams are run at the same time on the same device
(as seen in James' report).
Note that these crashes don't occur with a single TCP stream,
nor with multiple concurrent UDP streams, but only when multiple
TCP streams are run concurrently with the PTP packet flow
(doing skb reallocation).
This patch enforces the first method, by requesting enough
headroom from the stack to accommodate PTP frames, and so avoiding
skb_realloc_headroom() & co, and the crashes no longer occur.
There's no reason not to set needed_headroom to a large enough
value to accommodate PTP frames, so in this regard this patch
is a fix.

Reported-by: James Jurack <james.jurack@ametek.com>
Fixes: bee9e58c9e98 ("gianfar:don't add FCB length to hard_header_len")
Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Link: https://lore.kernel.org/r/20201020173605.1173-1-claudiu.manoil@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/freescale/gianfar.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index a968b3206f6f..bc00fa5e864f 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -1385,7 +1385,7 @@ static int gfar_probe(struct platform_device *ofdev)
 
 	if (dev->features & NETIF_F_IP_CSUM ||
 	    priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER)
-		dev->needed_headroom = GMAC_FCB_LEN;
+		dev->needed_headroom = GMAC_FCB_LEN + GMAC_TXPAL_LEN;
 
 	/* Initializing some of the rx/tx queue level parameters */
 	for (i = 0; i < priv->num_tx_queues; i++) {

From 893cd05a84b52400249e0c681e7c2adf481f90ac Mon Sep 17 00:00:00 2001
From: Lee Jones <lee.jones@linaro.org>
Date: Mon, 2 Nov 2020 13:32:42 -0500
Subject: [PATCH 0946/2658] Fonts: Replace discarded const qualifier

commit 9522750c66c689b739e151fcdf895420dc81efc0 upstream.

Commit 6735b4632def ("Fonts: Support FONT_EXTRA_WORDS macros for built-in
fonts") introduced the following error when building rpc_defconfig (only
this build appears to be affected):

 `acorndata_8x8' referenced in section `.text' of arch/arm/boot/compressed/ll_char_wr.o:
    defined in discarded section `.data' of arch/arm/boot/compressed/font.o
 `acorndata_8x8' referenced in section `.data.rel.ro' of arch/arm/boot/compressed/font.o:
    defined in discarded section `.data' of arch/arm/boot/compressed/font.o
 make[3]: *** [/scratch/linux/arch/arm/boot/compressed/Makefile:191: arch/arm/boot/compressed/vmlinux] Error 1
 make[2]: *** [/scratch/linux/arch/arm/boot/Makefile:61: arch/arm/boot/compressed/vmlinux] Error 2
 make[1]: *** [/scratch/linux/arch/arm/Makefile:317: zImage] Error 2

The .data section is discarded at link time.  Reinstating acorndata_8x8 as
const ensures it is still available after linking.  Do the same for the
other 12 built-in fonts as well, for consistency purposes.

Cc: <stable@vger.kernel.org>
Cc: Russell King <linux@armlinux.org.uk>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fixes: 6735b4632def ("Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts")
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Co-developed-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20201102183242.2031659-1-yepeilin.cs@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/fonts/font_10x18.c     | 2 +-
 lib/fonts/font_6x10.c      | 2 +-
 lib/fonts/font_6x11.c      | 2 +-
 lib/fonts/font_7x14.c      | 2 +-
 lib/fonts/font_8x16.c      | 2 +-
 lib/fonts/font_8x8.c       | 2 +-
 lib/fonts/font_acorn_8x8.c | 2 +-
 lib/fonts/font_mini_4x6.c  | 2 +-
 lib/fonts/font_pearl_8x8.c | 2 +-
 lib/fonts/font_sun12x22.c  | 2 +-
 lib/fonts/font_sun8x16.c   | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/lib/fonts/font_10x18.c b/lib/fonts/font_10x18.c
index 87e904f550c1..0ea39bfdc3cf 100644
--- a/lib/fonts/font_10x18.c
+++ b/lib/fonts/font_10x18.c
@@ -7,7 +7,7 @@
 
 #define FONTDATAMAX 9216
 
-static struct font_data fontdata_10x18 = {
+static const struct font_data fontdata_10x18 = {
 	{ 0, 0, FONTDATAMAX, 0 }, {
 	/* 0 0x00 '^@' */
 	0x00, 0x00, /* 0000000000 */
diff --git a/lib/fonts/font_6x10.c b/lib/fonts/font_6x10.c
index 896ffa987c97..ec243d7d2e0e 100644
--- a/lib/fonts/font_6x10.c
+++ b/lib/fonts/font_6x10.c
@@ -2,7 +2,7 @@
 
 #define FONTDATAMAX 2560
 
-static struct font_data fontdata_6x10 = {
+static const struct font_data fontdata_6x10 = {
 	{ 0, 0, FONTDATAMAX, 0 }, {
 	/* 0 0x00 '^@' */
 	0x00, /* 00000000 */
diff --git a/lib/fonts/font_6x11.c b/lib/fonts/font_6x11.c
index eb46a59307d2..0010e213fbe2 100644
--- a/lib/fonts/font_6x11.c
+++ b/lib/fonts/font_6x11.c
@@ -8,7 +8,7 @@
 
 #define FONTDATAMAX (11*256)
 
-static struct font_data fontdata_6x11 = {
+static const struct font_data fontdata_6x11 = {
 	{ 0, 0, FONTDATAMAX, 0 }, {
 	/* 0 0x00 '^@' */
 	0x00, /* 00000000 */
diff --git a/lib/fonts/font_7x14.c b/lib/fonts/font_7x14.c
index c88b3bba001b..2900b59325e5 100644
--- a/lib/fonts/font_7x14.c
+++ b/lib/fonts/font_7x14.c
@@ -7,7 +7,7 @@
 
 #define FONTDATAMAX 3584
 
-static struct font_data fontdata_7x14 = {
+static const struct font_data fontdata_7x14 = {
 	{ 0, 0, FONTDATAMAX, 0 }, {
 	/* 0 0x00 '^@' */
 	0x00, /* 0000000 */
diff --git a/lib/fonts/font_8x16.c b/lib/fonts/font_8x16.c
index ba53e2643670..cc3fa17ff94d 100644
--- a/lib/fonts/font_8x16.c
+++ b/lib/fonts/font_8x16.c
@@ -9,7 +9,7 @@
 
 #define FONTDATAMAX 4096
 
-static struct font_data fontdata_8x16 = {
+static const struct font_data fontdata_8x16 = {
 	{ 0, 0, FONTDATAMAX, 0 }, {
 	/* 0 0x00 '^@' */
 	0x00, /* 00000000 */
diff --git a/lib/fonts/font_8x8.c b/lib/fonts/font_8x8.c
index 4d28b81e8237..1519b7ce8827 100644
--- a/lib/fonts/font_8x8.c
+++ b/lib/fonts/font_8x8.c
@@ -8,7 +8,7 @@
 
 #define FONTDATAMAX 2048
 
-static struct font_data fontdata_8x8 = {
+static const struct font_data fontdata_8x8 = {
 	{ 0, 0, FONTDATAMAX, 0 }, {
 	/* 0 0x00 '^@' */
 	0x00, /* 00000000 */
diff --git a/lib/fonts/font_acorn_8x8.c b/lib/fonts/font_acorn_8x8.c
index 957398b762d3..c6367ed4c5bc 100644
--- a/lib/fonts/font_acorn_8x8.c
+++ b/lib/fonts/font_acorn_8x8.c
@@ -4,7 +4,7 @@
 
 #define FONTDATAMAX 2048
 
-static struct font_data acorndata_8x8 = {
+static const struct font_data acorndata_8x8 = {
 { 0, 0, FONTDATAMAX, 0 }, {
 /* 00 */  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* ^@ */
 /* 01 */  0x7e, 0x81, 0xa5, 0x81, 0xbd, 0x99, 0x81, 0x7e, /* ^A */
diff --git a/lib/fonts/font_mini_4x6.c b/lib/fonts/font_mini_4x6.c
index 1449876c6a27..592774a90917 100644
--- a/lib/fonts/font_mini_4x6.c
+++ b/lib/fonts/font_mini_4x6.c
@@ -43,7 +43,7 @@ __END__;
 
 #define FONTDATAMAX 1536
 
-static struct font_data fontdata_mini_4x6 = {
+static const struct font_data fontdata_mini_4x6 = {
 	{ 0, 0, FONTDATAMAX, 0 }, {
 	/*{*/
 	  	/*   Char 0: ' '  */
diff --git a/lib/fonts/font_pearl_8x8.c b/lib/fonts/font_pearl_8x8.c
index 4649314333bb..6351b759ae70 100644
--- a/lib/fonts/font_pearl_8x8.c
+++ b/lib/fonts/font_pearl_8x8.c
@@ -13,7 +13,7 @@
 
 #define FONTDATAMAX 2048
 
-static struct font_data fontdata_pearl8x8 = {
+static const struct font_data fontdata_pearl8x8 = {
    { 0, 0, FONTDATAMAX, 0 }, {
    /* 0 0x00 '^@' */
    0x00, /* 00000000 */
diff --git a/lib/fonts/font_sun12x22.c b/lib/fonts/font_sun12x22.c
index c6967cdf4207..057b0bf368a2 100644
--- a/lib/fonts/font_sun12x22.c
+++ b/lib/fonts/font_sun12x22.c
@@ -2,7 +2,7 @@
 
 #define FONTDATAMAX 11264
 
-static struct font_data fontdata_sun12x22 = {
+static const struct font_data fontdata_sun12x22 = {
 	{ 0, 0, FONTDATAMAX, 0 }, {
 	/* 0 0x00 '^@' */
 	0x00, 0x00, /* 000000000000 */
diff --git a/lib/fonts/font_sun8x16.c b/lib/fonts/font_sun8x16.c
index 7d979e578899..84db7275e053 100644
--- a/lib/fonts/font_sun8x16.c
+++ b/lib/fonts/font_sun8x16.c
@@ -2,7 +2,7 @@
 
 #define FONTDATAMAX 4096
 
-static struct font_data fontdata_sun8x16 = {
+static const struct font_data fontdata_sun8x16 = {
 { 0, 0, FONTDATAMAX, 0 }, {
 /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
 /* */ 0x00,0x00,0x7e,0x81,0xa5,0x81,0x81,0xbd,0x99,0x81,0x81,0x7e,0x00,0x00,0x00,0x00,

From 618099b38ed7662fe3e6dc0935103c36a98ac265 Mon Sep 17 00:00:00 2001
From: "Geoffrey D. Bennett" <g@b4.vu>
Date: Wed, 4 Nov 2020 22:27:17 +1030
Subject: [PATCH 0947/2658] ALSA: usb-audio: Add implicit feedback quirk for
 Qu-16

commit 0938ecae432e7ac8b01080c35dd81d50a1e43033 upstream.

This patch fixes audio distortion on playback for the Allen&Heath
Qu-16.

Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201104115717.GA19046@b4.vu
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/pcm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 6eabd643c0d3..65552875692c 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -332,6 +332,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
 	switch (subs->stream->chip->usb_id) {
 	case USB_ID(0x0763, 0x2030): /* M-Audio Fast Track C400 */
 	case USB_ID(0x0763, 0x2031): /* M-Audio Fast Track C600 */
+	case USB_ID(0x22f0, 0x0006): /* Allen&Heath Qu-16 */
 		ep = 0x81;
 		iface = usb_ifnum_to_if(dev, 3);
 

From eeeec6abf9f8f7b4c9b76325364172d668f276b0 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Thu, 29 Oct 2020 17:31:45 -0400
Subject: [PATCH 0948/2658] ftrace: Fix recursion check for NMI test

commit ee11b93f95eabdf8198edd4668bf9102e7248270 upstream.

The code that checks recursion will work to only do the recursion check once
if there's nested checks. The top one will do the check, the other nested
checks will see recursion was already checked and return zero for its "bit".
On the return side, nothing will be done if the "bit" is zero.

The problem is that zero is returned for the "good" bit when in NMI context.
This will set the bit for NMIs making it look like *all* NMI tracing is
recursing, and prevent tracing of anything in NMI context!

The simple fix is to return "bit + 1" and subtract that bit on the end to
get the real bit.

Cc: stable@vger.kernel.org
Fixes: edc15cafcbfa3 ("tracing: Avoid unnecessary multiple recursion checks")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index f62768288592..a7ec8d99b6ce 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -529,7 +529,7 @@ static __always_inline int trace_test_and_set_recursion(int start, int max)
 	current->trace_recursion = val;
 	barrier();
 
-	return bit;
+	return bit + 1;
 }
 
 static __always_inline void trace_clear_recursion(int bit)
@@ -539,6 +539,7 @@ static __always_inline void trace_clear_recursion(int bit)
 	if (!bit)
 		return;
 
+	bit--;
 	bit = 1 << bit;
 	val &= ~bit;
 

From 105b6c3fcb2e0a6c356811d1c4e0a8c0dc660ad5 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Thu, 29 Oct 2020 19:35:08 -0400
Subject: [PATCH 0949/2658] ftrace: Handle tracing when switching between
 context

commit 726b3d3f141fba6f841d715fc4d8a4a84f02c02a upstream.

When an interrupt or NMI comes in and switches the context, there's a delay
from when the preempt_count() shows the update. As the preempt_count() is
used to detect recursion having each context have its own bit get set when
tracing starts, and if that bit is already set, it is considered a recursion
and the function exits. But if this happens in that section where context
has changed but preempt_count() has not been updated, this will be
incorrectly flagged as a recursion.

To handle this case, create another bit call TRANSITION and test it if the
current context bit is already set. Flag the call as a recursion if the
TRANSITION bit is already set, and if not, set it and continue. The
TRANSITION bit will be cleared normally on the return of the function that
set it, or if the current context bit is clear, set it and clear the
TRANSITION bit to allow for another transition between the current context
and an even higher one.

Cc: stable@vger.kernel.org
Fixes: edc15cafcbfa3 ("tracing: Avoid unnecessary multiple recursion checks")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace.h          | 23 +++++++++++++++++++++--
 kernel/trace/trace_selftest.c |  9 +++++++--
 2 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index a7ec8d99b6ce..6f9534635129 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -478,6 +478,12 @@ enum {
  * can only be modified by current, we can reuse trace_recursion.
  */
 	TRACE_IRQ_BIT,
+
+	/*
+	 * When transitioning between context, the preempt_count() may
+	 * not be correct. Allow for a single recursion to cover this case.
+	 */
+	TRACE_TRANSITION_BIT,
 };
 
 #define trace_recursion_set(bit)	do { (current)->trace_recursion |= (1<<(bit)); } while (0)
@@ -522,8 +528,21 @@ static __always_inline int trace_test_and_set_recursion(int start, int max)
 		return 0;
 
 	bit = trace_get_context_bit() + start;
-	if (unlikely(val & (1 << bit)))
-		return -1;
+	if (unlikely(val & (1 << bit))) {
+		/*
+		 * It could be that preempt_count has not been updated during
+		 * a switch between contexts. Allow for a single recursion.
+		 */
+		bit = TRACE_TRANSITION_BIT;
+		if (trace_recursion_test(bit))
+			return -1;
+		trace_recursion_set(bit);
+		barrier();
+		return bit + 1;
+	}
+
+	/* Normal check passed, clear the transition to allow it again */
+	trace_recursion_clear(TRACE_TRANSITION_BIT);
 
 	val |= 1 << bit;
 	current->trace_recursion = val;
diff --git a/kernel/trace/trace_selftest.c b/kernel/trace/trace_selftest.c
index ca70d11b8aa7..f444f57f1338 100644
--- a/kernel/trace/trace_selftest.c
+++ b/kernel/trace/trace_selftest.c
@@ -490,8 +490,13 @@ trace_selftest_function_recursion(void)
 	unregister_ftrace_function(&test_rec_probe);
 
 	ret = -1;
-	if (trace_selftest_recursion_cnt != 1) {
-		pr_cont("*callback not called once (%d)* ",
+	/*
+	 * Recursion allows for transitions between context,
+	 * and may call the callback twice.
+	 */
+	if (trace_selftest_recursion_cnt != 1 &&
+	    trace_selftest_recursion_cnt != 2) {
+		pr_cont("*callback not called once (or twice) (%d)* ",
 			trace_selftest_recursion_cnt);
 		goto out;
 	}

From 33ce44183a573446fd5786ee2959add8946b23a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20P=C3=A9ron?= <peron.clem@gmail.com>
Date: Sat, 3 Oct 2020 12:03:32 +0200
Subject: [PATCH 0950/2658] ARM: dts: sun4i-a10: fix cpu_alert temperature
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit dea252fa41cd8ce332d148444e4799235a8a03ec ]

When running dtbs_check thermal_zone warn about the
temperature declared.

thermal-zones: cpu-thermal:trips:cpu-alert0:temperature:0:0: 850000 is greater than the maximum of 200000

It's indeed wrong the real value is 85°C and not 850°C.

Signed-off-by: Clément Péron <peron.clem@gmail.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20201003100332.431178-1-peron.clem@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun4i-a10.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
index aa90f319309b..b8bbc8c18799 100644
--- a/arch/arm/boot/dts/sun4i-a10.dtsi
+++ b/arch/arm/boot/dts/sun4i-a10.dtsi
@@ -137,7 +137,7 @@
 			trips {
 				cpu_alert0: cpu_alert0 {
 					/* milliCelsius */
-					temperature = <850000>;
+					temperature = <85000>;
 					hysteresis = <2000>;
 					type = "passive";
 				};

From ebef4cd02c832e68a063628f7dda86d38280c73c Mon Sep 17 00:00:00 2001
From: Kairui Song <kasong@redhat.com>
Date: Wed, 14 Oct 2020 17:24:28 +0800
Subject: [PATCH 0951/2658] x86/kexec: Use up-to-dated screen_info copy to fill
 boot params

[ Upstream commit afc18069a2cb7ead5f86623a5f3d4ad6e21f940d ]

kexec_file_load() currently reuses the old boot_params.screen_info,
but if drivers have change the hardware state, boot_param.screen_info
could contain invalid info.

For example, the video type might be no longer VGA, or the frame buffer
address might be changed. If the kexec kernel keeps using the old screen_info,
kexec'ed kernel may attempt to write to an invalid framebuffer
memory region.

There are two screen_info instances globally available, boot_params.screen_info
and screen_info. Later one is a copy, and is updated by drivers.

So let kexec_file_load use the updated copy.

[ mingo: Tidied up the changelog. ]

Signed-off-by: Kairui Song <kasong@redhat.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/20201014092429.1415040-2-kasong@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/kexec-bzimage64.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 0bf17576dd2a..299e7fb55f16 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -212,8 +212,7 @@ setup_boot_parameters(struct kimage *image, struct boot_params *params,
 	params->hdr.hardware_subarch = boot_params.hdr.hardware_subarch;
 
 	/* Copying screen_info will do? */
-	memcpy(&params->screen_info, &boot_params.screen_info,
-				sizeof(struct screen_info));
+	memcpy(&params->screen_info, &screen_info, sizeof(struct screen_info));
 
 	/* Fill in memsize later */
 	params->screen_info.ext_mem_k = 0;

From 0d3fbab51904a4b4dc9a2699418106bc21f786e0 Mon Sep 17 00:00:00 2001
From: Vincent Whitchurch <vincent.whitchurch@axis.com>
Date: Wed, 21 Oct 2020 11:53:59 +0200
Subject: [PATCH 0952/2658] of: Fix reserved-memory overlap detection

[ Upstream commit ca05f33316559a04867295dd49f85aeedbfd6bfd ]

The reserved-memory overlap detection code fails to detect overlaps if
either of the regions starts at address 0x0.  The code explicitly checks
for and ignores such regions, apparently in order to ignore dynamically
allocated regions which have an address of 0x0 at this point.  These
dynamically allocated regions also have a size of 0x0 at this point, so
fix this by removing the check and sorting the dynamically allocated
regions ahead of any static regions at address 0x0.

For example, there are two overlaps in this case but they are not
currently reported:

	foo@0 {
	        reg = <0x0 0x2000>;
	};

	bar@0 {
	        reg = <0x0 0x1000>;
	};

	baz@1000 {
	        reg = <0x1000 0x1000>;
	};

	quux {
	        size = <0x1000>;
	};

but they are after this patch:

 OF: reserved mem: OVERLAP DETECTED!
 bar@0 (0x00000000--0x00001000) overlaps with foo@0 (0x00000000--0x00002000)
 OF: reserved mem: OVERLAP DETECTED!
 foo@0 (0x00000000--0x00002000) overlaps with baz@1000 (0x00001000--0x00002000)

Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
Link: https://lore.kernel.org/r/ded6fd6b47b58741aabdcc6967f73eca6a3f311e.1603273666.git-series.vincent.whitchurch@axis.com
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/of/of_reserved_mem.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index 8c60dcf35514..c8e31dd0389a 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -218,6 +218,16 @@ static int __init __rmem_cmp(const void *a, const void *b)
 	if (ra->base > rb->base)
 		return 1;
 
+	/*
+	 * Put the dynamic allocations (address == 0, size == 0) before static
+	 * allocations at address 0x0 so that overlap detection works
+	 * correctly.
+	 */
+	if (ra->size < rb->size)
+		return -1;
+	if (ra->size > rb->size)
+		return 1;
+
 	return 0;
 }
 
@@ -235,8 +245,7 @@ static void __init __rmem_check_for_overlap(void)
 
 		this = &reserved_mem[i];
 		next = &reserved_mem[i + 1];
-		if (!(this->base && next->base))
-			continue;
+
 		if (this->base + this->size > next->base) {
 			phys_addr_t this_end, next_end;
 

From 1b2b9500008a8012f2f329370feec36b965acc69 Mon Sep 17 00:00:00 2001
From: Ming Lei <ming.lei@redhat.com>
Date: Sat, 10 Oct 2020 11:25:39 +0800
Subject: [PATCH 0953/2658] scsi: core: Don't start concurrent async scan on
 same host

[ Upstream commit 831e3405c2a344018a18fcc2665acc5a38c3a707 ]

The current scanning mechanism is supposed to fall back to a synchronous
host scan if an asynchronous scan is in progress. However, this rule isn't
strictly respected, scsi_prep_async_scan() doesn't hold scan_mutex when
checking shost->async_scan. When scsi_scan_host() is called concurrently,
two async scans on same host can be started and a hang in do_scan_async()
is observed.

Fixes this issue by checking & setting shost->async_scan atomically with
shost->scan_mutex.

Link: https://lore.kernel.org/r/20201010032539.426615-1-ming.lei@redhat.com
Cc: Christoph Hellwig <hch@lst.de>
Cc: Ewan D. Milne <emilne@redhat.com>
Cc: Hannes Reinecke <hare@suse.de>
Cc: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/scsi_scan.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 119b218e2c19..271e8035f5fb 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -1709,15 +1709,16 @@ static void scsi_sysfs_add_devices(struct Scsi_Host *shost)
  */
 static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost)
 {
-	struct async_scan_data *data;
+	struct async_scan_data *data = NULL;
 	unsigned long flags;
 
 	if (strncmp(scsi_scan_type, "sync", 4) == 0)
 		return NULL;
 
+	mutex_lock(&shost->scan_mutex);
 	if (shost->async_scan) {
 		shost_printk(KERN_DEBUG, shost, "%s called twice\n", __func__);
-		return NULL;
+		goto err;
 	}
 
 	data = kmalloc(sizeof(*data), GFP_KERNEL);
@@ -1728,7 +1729,6 @@ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost)
 		goto err;
 	init_completion(&data->prev_finished);
 
-	mutex_lock(&shost->scan_mutex);
 	spin_lock_irqsave(shost->host_lock, flags);
 	shost->async_scan = 1;
 	spin_unlock_irqrestore(shost->host_lock, flags);
@@ -1743,6 +1743,7 @@ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost)
 	return data;
 
  err:
+	mutex_unlock(&shost->scan_mutex);
 	kfree(data);
 	return NULL;
 }

From 3d182942987f888dc4e704f0f44c4e2516c4860e Mon Sep 17 00:00:00 2001
From: Jeff Vander Stoep <jeffv@google.com>
Date: Fri, 23 Oct 2020 16:37:57 +0200
Subject: [PATCH 0954/2658] vsock: use ns_capable_noaudit() on socket create

[ Upstream commit af545bb5ee53f5261db631db2ac4cde54038bdaf ]

During __vsock_create() CAP_NET_ADMIN is used to determine if the
vsock_sock->trusted should be set to true. This value is used later
for determing if a remote connection should be allowed to connect
to a restricted VM. Unfortunately, if the caller doesn't have
CAP_NET_ADMIN, an audit message such as an selinux denial is
generated even if the caller does not want a trusted socket.

Logging errors on success is confusing. To avoid this, switch the
capable(CAP_NET_ADMIN) check to the noaudit version.

Reported-by: Roman Kiryanov <rkir@google.com>
https://android-review.googlesource.com/c/device/generic/goldfish/+/1468545/
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Reviewed-by: James Morris <jamorris@linux.microsoft.com>
Link: https://lore.kernel.org/r/20201023143757.377574-1-jeffv@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/vmw_vsock/af_vsock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index a645352e366a..07b1a2775210 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -633,7 +633,7 @@ struct sock *__vsock_create(struct net *net,
 		vsk->owner = get_cred(psk->owner);
 		vsk->connect_timeout = psk->connect_timeout;
 	} else {
-		vsk->trusted = capable(CAP_NET_ADMIN);
+		vsk->trusted = ns_capable_noaudit(&init_user_ns, CAP_NET_ADMIN);
 		vsk->owner = get_current_cred();
 		vsk->connect_timeout = VSOCK_DEFAULT_CONNECT_TIMEOUT;
 	}

From e08cdd60ed4e874ed9da7befe8f6a6ad78ec8b9d Mon Sep 17 00:00:00 2001
From: Daniel Vetter <daniel.vetter@ffwll.ch>
Date: Sun, 8 Nov 2020 16:38:06 +0100
Subject: [PATCH 0955/2658] vt: Disable KD_FONT_OP_COPY

commit 3c4e0dff2095c579b142d5a0693257f1c58b4804 upstream.

It's buggy:

On Fri, Nov 06, 2020 at 10:30:08PM +0800, Minh Yuan wrote:
> We recently discovered a slab-out-of-bounds read in fbcon in the latest
> kernel ( v5.10-rc2 for now ).  The root cause of this vulnerability is that
> "fbcon_do_set_font" did not handle "vc->vc_font.data" and
> "vc->vc_font.height" correctly, and the patch
> <https://lkml.org/lkml/2020/9/27/223> for VT_RESIZEX can't handle this
> issue.
>
> Specifically, we use KD_FONT_OP_SET to set a small font.data for tty6, and
> use  KD_FONT_OP_SET again to set a large font.height for tty1. After that,
> we use KD_FONT_OP_COPY to assign tty6's vc_font.data to tty1's vc_font.data
> in "fbcon_do_set_font", while tty1 retains the original larger
> height. Obviously, this will cause an out-of-bounds read, because we can
> access a smaller vc_font.data with a larger vc_font.height.

Further there was only one user ever.
- Android's loadfont, busybox and console-tools only ever use OP_GET
  and OP_SET
- fbset documentation only mentions the kernel cmdline font: option,
  not anything else.
- systemd used OP_COPY before release 232 published in Nov 2016

Now unfortunately the crucial report seems to have gone down with
gmane, and the commit message doesn't say much. But the pull request
hints at OP_COPY being broken

https://github.com/systemd/systemd/pull/3651

So in other words, this never worked, and the only project which
foolishly every tried to use it, realized that rather quickly too.

Instead of trying to fix security issues here on dead code by adding
missing checks, fix the entire thing by removing the functionality.

Note that systemd code using the OP_COPY function ignored the return
value, so it doesn't matter what we're doing here really - just in
case a lone server somewhere happens to be extremely unlucky and
running an affected old version of systemd. The relevant code from
font_copy_to_all_vcs() in systemd was:

	/* copy font from active VT, where the font was uploaded to */
	cfo.op = KD_FONT_OP_COPY;
	cfo.height = vcs.v_active-1; /* tty1 == index 0 */
	(void) ioctl(vcfd, KDFONTOP, &cfo);

Note this just disables the ioctl, garbage collecting the now unused
callbacks is left for -next.

v2: Tetsuo found the old mail, which allowed me to find it on another
archive. Add the link too.

Acked-by: Peilin Ye <yepeilin.cs@gmail.com>
Reported-by: Minh Yuan <yuanmingbuaa@gmail.com>
References: https://lists.freedesktop.org/archives/systemd-devel/2016-June/036935.html
References: https://github.com/systemd/systemd/pull/3651
Cc: Greg KH <greg@kroah.com>
Cc: Peilin Ye <yepeilin.cs@gmail.com>
Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Link: https://lore.kernel.org/r/20201108153806.3140315-1-daniel.vetter@ffwll.ch
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/vt/vt.c | 24 ++----------------------
 1 file changed, 2 insertions(+), 22 deletions(-)

diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 01aeffcdf984..7ec5e6dd60e5 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -4226,27 +4226,6 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op)
 	return rc;
 }
 
-static int con_font_copy(struct vc_data *vc, struct console_font_op *op)
-{
-	int con = op->height;
-	int rc;
-
-
-	console_lock();
-	if (vc->vc_mode != KD_TEXT)
-		rc = -EINVAL;
-	else if (!vc->vc_sw->con_font_copy)
-		rc = -ENOSYS;
-	else if (con < 0 || !vc_cons_allocated(con))
-		rc = -ENOTTY;
-	else if (con == vc->vc_num)	/* nothing to do */
-		rc = 0;
-	else
-		rc = vc->vc_sw->con_font_copy(vc, con);
-	console_unlock();
-	return rc;
-}
-
 int con_font_op(struct vc_data *vc, struct console_font_op *op)
 {
 	switch (op->op) {
@@ -4257,7 +4236,8 @@ int con_font_op(struct vc_data *vc, struct console_font_op *op)
 	case KD_FONT_OP_SET_DEFAULT:
 		return con_font_default(vc, op);
 	case KD_FONT_OP_COPY:
-		return con_font_copy(vc, op);
+		/* was buggy and never really used */
+		return -EINVAL;
 	}
 	return -ENOSYS;
 }

From 99837355d330932bc3f86e94696ea37a6021a18a Mon Sep 17 00:00:00 2001
From: Eddy Wu <itseddy0402@gmail.com>
Date: Sat, 7 Nov 2020 14:47:22 +0800
Subject: [PATCH 0956/2658] fork: fix copy_process(CLONE_PARENT) race with the
 exiting ->real_parent

commit b4e00444cab4c3f3fec876dc0cccc8cbb0d1a948 upstream.

current->group_leader->exit_signal may change during copy_process() if
current->real_parent exits.

Move the assignment inside tasklist_lock to avoid the race.

Signed-off-by: Eddy Wu <eddy_wu@trendmicro.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/fork.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/kernel/fork.c b/kernel/fork.c
index c075c907ba30..d80f45c20690 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1579,14 +1579,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 	/* ok, now we should be set up.. */
 	p->pid = pid_nr(pid);
 	if (clone_flags & CLONE_THREAD) {
-		p->exit_signal = -1;
 		p->group_leader = current->group_leader;
 		p->tgid = current->tgid;
 	} else {
-		if (clone_flags & CLONE_PARENT)
-			p->exit_signal = current->group_leader->exit_signal;
-		else
-			p->exit_signal = (clone_flags & CSIGNAL);
 		p->group_leader = p;
 		p->tgid = p->pid;
 	}
@@ -1631,9 +1626,14 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
 		p->real_parent = current->real_parent;
 		p->parent_exec_id = current->parent_exec_id;
+		if (clone_flags & CLONE_THREAD)
+			p->exit_signal = -1;
+		else
+			p->exit_signal = current->group_leader->exit_signal;
 	} else {
 		p->real_parent = current;
 		p->parent_exec_id = current->self_exec_id;
+		p->exit_signal = (clone_flags & CSIGNAL);
 	}
 
 	spin_lock(&current->sighand->siglock);

From 5953071bcb9a2202a1f5e29e269fa64a70146384 Mon Sep 17 00:00:00 2001
From: Claire Chang <tientzu@chromium.org>
Date: Mon, 2 Nov 2020 20:07:49 +0800
Subject: [PATCH 0957/2658] serial: 8250_mtk: Fix uart_get_baud_rate warning

commit 912ab37c798770f21b182d656937072b58553378 upstream.

Mediatek 8250 port supports speed higher than uartclk / 16. If the baud
rates in both the new and the old termios setting are higher than
uartclk / 16, the WARN_ON in uart_get_baud_rate() will be triggered.
Passing NULL as the old termios so uart_get_baud_rate() will use
uartclk / 16 - 1 as the new baud rate which will be replaced by the
original baud rate later by tty_termios_encode_baud_rate() in
mtk8250_set_termios().

Fixes: 551e553f0d4a ("serial: 8250_mtk: Fix high-speed baud rates clamping")
Signed-off-by: Claire Chang <tientzu@chromium.org>
Link: https://lore.kernel.org/r/20201102120749.374458-1-tientzu@chromium.org
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_mtk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
index 470ccf729d59..93334e07dd5f 100644
--- a/drivers/tty/serial/8250/8250_mtk.c
+++ b/drivers/tty/serial/8250/8250_mtk.c
@@ -58,7 +58,7 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios,
 	 */
 	baud = tty_termios_baud_rate(termios);
 
-	serial8250_do_set_termios(port, termios, old);
+	serial8250_do_set_termios(port, termios, NULL);
 
 	tty_termios_encode_baud_rate(termios, baud, baud);
 

From 8191c96d6e2203fd8098fb5f56ce48f03fc47c4b Mon Sep 17 00:00:00 2001
From: Qinglang Miao <miaoqinglang@huawei.com>
Date: Tue, 3 Nov 2020 16:49:42 +0800
Subject: [PATCH 0958/2658] serial: txx9: add missing
 platform_driver_unregister() on error in serial_txx9_init

commit 0c5fc92622ed5531ff324b20f014e9e3092f0187 upstream.

Add the missing platform_driver_unregister() before return
from serial_txx9_init in the error handling case when failed
to register serial_txx9_pci_driver with macro ENABLE_SERIAL_TXX9_PCI
defined.

Fixes: ab4382d27412 ("tty: move drivers/serial/ to drivers/tty/serial/")
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Link: https://lore.kernel.org/r/20201103084942.109076-1-miaoqinglang@huawei.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/serial_txx9.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/tty/serial/serial_txx9.c b/drivers/tty/serial/serial_txx9.c
index f80312eed4fd..ffb3fb1bda9e 100644
--- a/drivers/tty/serial/serial_txx9.c
+++ b/drivers/tty/serial/serial_txx9.c
@@ -1287,6 +1287,9 @@ static int __init serial_txx9_init(void)
 
 #ifdef ENABLE_SERIAL_TXX9_PCI
 	ret = pci_register_driver(&serial_txx9_pci_driver);
+	if (ret) {
+		platform_driver_unregister(&serial_txx9_plat_driver);
+	}
 #endif
 	if (ret == 0)
 		goto out;

From 18b2ec861dcde253c3045199fd97774f193dcbbf Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 26 Oct 2020 09:25:48 +0100
Subject: [PATCH 0959/2658] USB: serial: cyberjack: fix write-URB completion
 race

commit 985616f0457d9f555fff417d0da56174f70cc14f upstream.

The write-URB busy flag was being cleared before the completion handler
was done with the URB, something which could lead to corrupt transfers
due to a racing write request if the URB is resubmitted.

Fixes: 507ca9bc0476 ("[PATCH] USB: add ability for usb-serial drivers to determine if their write urb is currently being used.")
Cc: stable <stable@vger.kernel.org>     # 2.6.13
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/cyberjack.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c
index 8948f375e75d..5a29ea0d00c5 100644
--- a/drivers/usb/serial/cyberjack.c
+++ b/drivers/usb/serial/cyberjack.c
@@ -368,11 +368,12 @@ static void cyberjack_write_bulk_callback(struct urb *urb)
 	struct cyberjack_private *priv = usb_get_serial_port_data(port);
 	struct device *dev = &port->dev;
 	int status = urb->status;
+	bool resubmitted = false;
 
-	set_bit(0, &port->write_urbs_free);
 	if (status) {
 		dev_dbg(dev, "%s - nonzero write bulk status received: %d\n",
 			__func__, status);
+		set_bit(0, &port->write_urbs_free);
 		return;
 	}
 
@@ -405,6 +406,8 @@ static void cyberjack_write_bulk_callback(struct urb *urb)
 			goto exit;
 		}
 
+		resubmitted = true;
+
 		dev_dbg(dev, "%s - priv->wrsent=%d\n", __func__, priv->wrsent);
 		dev_dbg(dev, "%s - priv->wrfilled=%d\n", __func__, priv->wrfilled);
 
@@ -421,6 +424,8 @@ static void cyberjack_write_bulk_callback(struct urb *urb)
 
 exit:
 	spin_unlock(&priv->lock);
+	if (!resubmitted)
+		set_bit(0, &port->write_urbs_free);
 	usb_serial_port_softint(port);
 }
 

From c55be36f3fe529e58f032bd90298f8b5ff95c736 Mon Sep 17 00:00:00 2001
From: Daniele Palmas <dnlplm@gmail.com>
Date: Sat, 31 Oct 2020 23:54:58 +0100
Subject: [PATCH 0960/2658] USB: serial: option: add LE910Cx compositions
 0x1203, 0x1230, 0x1231

commit 489979b4aab490b6b917c11dc02d81b4b742784a upstream.

Add following Telit LE910Cx compositions:

0x1203: rndis, tty, adb, tty, tty, tty, tty
0x1230: tty, adb, rmnet, audio, tty, tty, tty, tty
0x1231: rndis, tty, adb, audio, tty, tty, tty, tty

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Link: https://lore.kernel.org/r/20201031225458.10512-1-dnlplm@gmail.com
[ johan: add comments after entries ]
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 5017d37afe39..ca962caf3b57 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1186,6 +1186,8 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = NCTRL(0) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1203, 0xff),	/* Telit LE910Cx (RNDIS) */
+	  .driver_info = NCTRL(2) | RSVD(3) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
@@ -1200,6 +1202,10 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1230, 0xff),	/* Telit LE910Cx (rmnet) */
+	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff),	/* Telit LE910Cx (RNDIS) */
+	  .driver_info = NCTRL(2) | RSVD(3) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, 0x1260),
 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, 0x1261),

From 73e75cd8b6a0f36176f5fd87aba2cdc0948dec40 Mon Sep 17 00:00:00 2001
From: Daniele Palmas <dnlplm@gmail.com>
Date: Tue, 3 Nov 2020 13:44:25 +0100
Subject: [PATCH 0961/2658] USB: serial: option: add Telit FN980 composition
 0x1055

commit db0362eeb22992502764e825c79b922d7467e0eb upstream.

Add the following Telit FN980 composition:

0x1055: tty, adb, tty, tty, tty, tty

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Link: https://lore.kernel.org/r/20201103124425.12940-1-dnlplm@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index ca962caf3b57..34ac1265afe4 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1174,6 +1174,8 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = NCTRL(0) | RSVD(1) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1054, 0xff),	/* Telit FT980-KS */
 	  .driver_info = NCTRL(2) | RSVD(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1055, 0xff),	/* Telit FN980 (PCIe) */
+	  .driver_info = NCTRL(0) | RSVD(1) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),

From a9058c6458bd9a9f443719ceb26b8e7adf1eeabd Mon Sep 17 00:00:00 2001
From: Alan Stern <stern@rowland.harvard.edu>
Date: Mon, 2 Nov 2020 09:58:21 -0500
Subject: [PATCH 0962/2658] USB: Add NO_LPM quirk for Kingston flash drive

commit afaa2e745a246c5ab95103a65b1ed00101e1bc63 upstream.

In Bugzilla #208257, Julien Humbert reports that a 32-GB Kingston
flash drive spontaneously disconnects and reconnects, over and over.
Testing revealed that disabling Link Power Management for the drive
fixed the problem.

This patch adds a quirk entry for that drive to turn off LPM permanently.

CC: Hans de Goede <jwrdegoede@fedoraproject.org>
CC: <stable@vger.kernel.org>
Reported-and-tested-by: Julien Humbert <julroy67@gmail.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20201102145821.GA1478741@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/quirks.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index dd72e85f2e17..ca74b67c4450 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -217,6 +217,9 @@ static const struct usb_device_id usb_quirk_list[] = {
 	{ USB_DEVICE(0x0926, 0x3333), .driver_info =
 			USB_QUIRK_CONFIG_INTF_STRINGS },
 
+	/* Kingston DataTraveler 3.0 */
+	{ USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM },
+
 	/* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */
 	{ USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
 

From 91277c3b3b9c01449376490d15c692c4d6fc2289 Mon Sep 17 00:00:00 2001
From: Vineet Gupta <vgupta@synopsys.com>
Date: Tue, 27 Oct 2020 15:01:17 -0700
Subject: [PATCH 0963/2658] ARC: stack unwinding: avoid indefinite looping

commit 328d2168ca524d501fc4b133d6be076142bd305c upstream.

Currently stack unwinder is a while(1) loop which relies on the dwarf
unwinder to signal termination, which in turn relies on dwarf info to do
so. This in theory could cause an infinite loop if the dwarf info was
somehow messed up or the register contents were etc.

This fix thus detects the excessive looping and breaks the loop.

| Mem: 26184K used, 1009136K free, 0K shrd, 0K buff, 14416K cached
| CPU:  0.0% usr 72.8% sys  0.0% nic 27.1% idle  0.0% io  0.0% irq  0.0% sirq
| Load average: 4.33 2.60 1.11 2/74 139
|   PID  PPID USER     STAT   VSZ %VSZ CPU %CPU COMMAND
|   133     2 root     SWN      0  0.0   3 22.9 [rcu_torture_rea]
|   132     2 root     SWN      0  0.0   0 22.0 [rcu_torture_rea]
|   131     2 root     SWN      0  0.0   3 21.5 [rcu_torture_rea]
|   126     2 root     RW       0  0.0   2  5.4 [rcu_torture_wri]
|   129     2 root     SWN      0  0.0   0  0.2 [rcu_torture_fak]
|   137     2 root     SW       0  0.0   0  0.2 [rcu_torture_cbf]
|   127     2 root     SWN      0  0.0   0  0.1 [rcu_torture_fak]
|   138   115 root     R     1464  0.1   2  0.1 top
|   130     2 root     SWN      0  0.0   0  0.1 [rcu_torture_fak]
|   128     2 root     SWN      0  0.0   0  0.1 [rcu_torture_fak]
|   115     1 root     S     1472  0.1   1  0.0 -/bin/sh
|   104     1 root     S     1464  0.1   0  0.0 inetd
|     1     0 root     S     1456  0.1   2  0.0 init
|    78     1 root     S     1456  0.1   0  0.0 syslogd -O /var/log/messages
|   134     2 root     SW       0  0.0   2  0.0 [rcu_torture_sta]
|    10     2 root     IW       0  0.0   1  0.0 [rcu_preempt]
|    88     2 root     IW       0  0.0   1  0.0 [kworker/1:1-eve]
|    66     2 root     IW       0  0.0   2  0.0 [kworker/2:2-eve]
|    39     2 root     IW       0  0.0   2  0.0 [kworker/2:1-eve]
| unwinder looping too long, aborting !

Cc: <stable@vger.kernel.org>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arc/kernel/stacktrace.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c
index 11b50959f20e..5401e2bab3da 100644
--- a/arch/arc/kernel/stacktrace.c
+++ b/arch/arc/kernel/stacktrace.c
@@ -113,7 +113,7 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs,
 		int (*consumer_fn) (unsigned int, void *), void *arg)
 {
 #ifdef CONFIG_ARC_DW2_UNWIND
-	int ret = 0;
+	int ret = 0, cnt = 0;
 	unsigned int address;
 	struct unwind_frame_info frame_info;
 
@@ -133,6 +133,11 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs,
 			break;
 
 		frame_info.regs.r63 = frame_info.regs.r31;
+
+		if (cnt++ > 128) {
+			printk("unwinder looping too long, aborting !\n");
+			return 0;
+		}
 	}
 
 	return address;		/* return the last address it saw */

From 0423a7d1ff6124576a106952beca2d1ac43c6a2f Mon Sep 17 00:00:00 2001
From: Vineet Gupta <Vineet.Gupta1@synopsys.com>
Date: Mon, 19 Oct 2020 19:19:57 -0700
Subject: [PATCH 0964/2658] Revert "ARC: entry: fix potential EFA clobber when
 TIF_SYSCALL_TRACE"

This reverts commit 00fdec98d9881bf5173af09aebd353ab3b9ac729.
(but only from 5.2 and prior kernels)

The original commit was a preventive fix based on code-review and was
auto-picked for stable back-port (for better or worse).
It was OK for v5.3+ kernels, but turned up needing an implicit change
68e5c6f073bcf70 "(ARC: entry: EV_Trap expects r10 (vs. r9) to have
 exception cause)" merged in v5.3 which itself was not backported.
So to summarize the stable backport of this patch for v5.2 and prior
kernels is busted and it won't boot.

The obvious solution is backport 68e5c6f073bcf70 but that is a pain as
it doesn't revert cleanly and each of affected kernels (so far v4.19,
v4.14, v4.9, v4.4) needs a slightly different massaged varaint.
So the easier fix is to simply revert the backport from 5.2 and prior.
The issue was not a big deal as it would cause strace to sporadically
not work correctly.

Waldemar Brodkorb first reported this when running ARC uClibc regressions
on latest stable kernels (with offending backport). Once he bisected it,
the analysis was trivial, so thx to him for this.

Reported-by: Waldemar Brodkorb <wbx@uclibc-ng.org>
Bisected-by: Waldemar Brodkorb <wbx@uclibc-ng.org>
Cc: stable <stable@vger.kernel.org> # 5.2 and prior
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arc/kernel/entry.S | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S
index 5e3f1edf5a29..db1eee5fe502 100644
--- a/arch/arc/kernel/entry.S
+++ b/arch/arc/kernel/entry.S
@@ -168,6 +168,7 @@ END(EV_Extension)
 tracesys:
 	; save EFA in case tracer wants the PC of traced task
 	; using ERET won't work since next-PC has already committed
+	lr  r12, [efa]
 	GET_CURR_TASK_FIELD_PTR   TASK_THREAD, r11
 	st  r12, [r11, THREAD_FAULT_ADDR]	; thread.fault_address
 
@@ -210,9 +211,15 @@ tracesys_exit:
 ; Breakpoint TRAP
 ; ---------------------------------------------
 trap_with_param:
-	mov r0, r12	; EFA in case ptracer/gdb wants stop_pc
+
+	; stop_pc info by gdb needs this info
+	lr  r0, [efa]
 	mov r1, sp
 
+	; Now that we have read EFA, it is safe to do "fake" rtie
+	;   and get out of CPU exception mode
+	FAKE_RET_FROM_EXCPN
+
 	; Save callee regs in case gdb wants to have a look
 	; SP will grow up by size of CALLEE Reg-File
 	; NOTE: clobbers r12
@@ -239,10 +246,6 @@ ENTRY(EV_Trap)
 
 	EXCEPTION_PROLOGUE
 
-	lr  r12, [efa]
-
-	FAKE_RET_FROM_EXCPN
-
 	;============ TRAP 1   :breakpoints
 	; Check ECR for trap with arg (PROLOGUE ensures r9 has ECR)
 	bmsk.f 0, r9, 7
@@ -250,6 +253,9 @@ ENTRY(EV_Trap)
 
 	;============ TRAP  (no param): syscall top level
 
+	; First return from Exception to pure K mode (Exception/IRQs renabled)
+	FAKE_RET_FROM_EXCPN
+
 	; If syscall tracing ongoing, invoke pre-post-hooks
 	GET_CURR_THR_INFO_FLAGS   r10
 	btst r10, TIF_SYSCALL_TRACE

From 7735659aeb5bc11ff0a561d1c6286bb0251d5f5c Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 10 Nov 2020 10:22:21 +0100
Subject: [PATCH 0965/2658] Linux 4.4.242

Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20201109125020.852643676@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 7e4d05c02429..92d6e3f6570f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 241
+SUBLEVEL = 242
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 51ca1bfaa4a1ee4459c3373d3f6ab66b715df4fc Mon Sep 17 00:00:00 2001
From: Len Brown <len.brown@intel.com>
Date: Tue, 10 Nov 2020 13:00:00 -0800
Subject: [PATCH 0966/2658] powercap: restrict energy meter to root access

commit 949dd0104c496fa7c14991a23c03c62e44637e71 upstream.

Remove non-privileged user access to power data contained in
/sys/class/powercap/intel-rapl*/*/energy_uj

Non-privileged users currently have read access to power data and can
use this data to form a security attack. Some privileged
drivers/applications need read access to this data, but don't expose it
to non-privileged users.

For example, thermald uses this data to ensure that power management
works correctly. Thus removing non-privileged access is preferred over
completely disabling this power reporting capability with
CONFIG_INTEL_RAPL=n.

Fixes: 95677a9a3847 ("PowerCap: Fix mode for energy counter")
Signed-off-by: Len Brown <len.brown@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/powercap/powercap_sys.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
index fd12ccc11e26..2313bb93f5c2 100644
--- a/drivers/powercap/powercap_sys.c
+++ b/drivers/powercap/powercap_sys.c
@@ -379,9 +379,9 @@ static void create_power_zone_common_attributes(
 					&dev_attr_max_energy_range_uj.attr;
 	if (power_zone->ops->get_energy_uj) {
 		if (power_zone->ops->reset_energy_uj)
-			dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO;
+			dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUSR;
 		else
-			dev_attr_energy_uj.attr.mode = S_IRUGO;
+			dev_attr_energy_uj.attr.mode = S_IRUSR;
 		power_zone->zone_dev_attrs[count++] =
 					&dev_attr_energy_uj.attr;
 	}

From 014443d7a39b3c003f6ce62e1f58fafddf87d522 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 10 Nov 2020 21:03:57 +0100
Subject: [PATCH 0967/2658] Linux 4.4.243

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 92d6e3f6570f..ef381f15cb7c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 242
+SUBLEVEL = 243
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 67c695ded51ca62e9753a10b04ea4fbd5ac91937 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Mon, 2 Nov 2020 15:31:27 -0500
Subject: [PATCH 0968/2658] ring-buffer: Fix recursion protection transitions
 between interrupt context

[ Upstream commit b02414c8f045ab3b9afc816c3735bc98c5c3d262 ]

The recursion protection of the ring buffer depends on preempt_count() to be
correct. But it is possible that the ring buffer gets called after an
interrupt comes in but before it updates the preempt_count(). This will
trigger a false positive in the recursion code.

Use the same trick from the ftrace function callback recursion code which
uses a "transition" bit that gets set, to allow for a single recursion for
to handle transitions between contexts.

Cc: stable@vger.kernel.org
Fixes: 567cd4da54ff4 ("ring-buffer: User context bit recursion checking")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/ring_buffer.c | 54 +++++++++++++++++++++++++++++++-------
 1 file changed, 44 insertions(+), 10 deletions(-)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 1c1ecc1d49ad..547a3a5ac57b 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -416,14 +416,16 @@ struct rb_event_info {
 
 /*
  * Used for which event context the event is in.
- *  NMI     = 0
- *  IRQ     = 1
- *  SOFTIRQ = 2
- *  NORMAL  = 3
+ *  TRANSITION = 0
+ *  NMI     = 1
+ *  IRQ     = 2
+ *  SOFTIRQ = 3
+ *  NORMAL  = 4
  *
  * See trace_recursive_lock() comment below for more details.
  */
 enum {
+	RB_CTX_TRANSITION,
 	RB_CTX_NMI,
 	RB_CTX_IRQ,
 	RB_CTX_SOFTIRQ,
@@ -2585,10 +2587,10 @@ rb_wakeups(struct ring_buffer *buffer, struct ring_buffer_per_cpu *cpu_buffer)
  * a bit of overhead in something as critical as function tracing,
  * we use a bitmask trick.
  *
- *  bit 0 =  NMI context
- *  bit 1 =  IRQ context
- *  bit 2 =  SoftIRQ context
- *  bit 3 =  normal context.
+ *  bit 1 =  NMI context
+ *  bit 2 =  IRQ context
+ *  bit 3 =  SoftIRQ context
+ *  bit 4 =  normal context.
  *
  * This works because this is the order of contexts that can
  * preempt other contexts. A SoftIRQ never preempts an IRQ
@@ -2611,6 +2613,30 @@ rb_wakeups(struct ring_buffer *buffer, struct ring_buffer_per_cpu *cpu_buffer)
  * The least significant bit can be cleared this way, and it
  * just so happens that it is the same bit corresponding to
  * the current context.
+ *
+ * Now the TRANSITION bit breaks the above slightly. The TRANSITION bit
+ * is set when a recursion is detected at the current context, and if
+ * the TRANSITION bit is already set, it will fail the recursion.
+ * This is needed because there's a lag between the changing of
+ * interrupt context and updating the preempt count. In this case,
+ * a false positive will be found. To handle this, one extra recursion
+ * is allowed, and this is done by the TRANSITION bit. If the TRANSITION
+ * bit is already set, then it is considered a recursion and the function
+ * ends. Otherwise, the TRANSITION bit is set, and that bit is returned.
+ *
+ * On the trace_recursive_unlock(), the TRANSITION bit will be the first
+ * to be cleared. Even if it wasn't the context that set it. That is,
+ * if an interrupt comes in while NORMAL bit is set and the ring buffer
+ * is called before preempt_count() is updated, since the check will
+ * be on the NORMAL bit, the TRANSITION bit will then be set. If an
+ * NMI then comes in, it will set the NMI bit, but when the NMI code
+ * does the trace_recursive_unlock() it will clear the TRANSTION bit
+ * and leave the NMI bit set. But this is fine, because the interrupt
+ * code that set the TRANSITION bit will then clear the NMI bit when it
+ * calls trace_recursive_unlock(). If another NMI comes in, it will
+ * set the TRANSITION bit and continue.
+ *
+ * Note: The TRANSITION bit only handles a single transition between context.
  */
 
 static __always_inline int
@@ -2629,8 +2655,16 @@ trace_recursive_lock(struct ring_buffer_per_cpu *cpu_buffer)
 	} else
 		bit = RB_CTX_NORMAL;
 
-	if (unlikely(val & (1 << bit)))
-		return 1;
+	if (unlikely(val & (1 << bit))) {
+		/*
+		 * It is possible that this was called by transitioning
+		 * between interrupt context, and preempt_count() has not
+		 * been updated yet. In this case, use the TRANSITION bit.
+		 */
+		bit = RB_CTX_TRANSITION;
+		if (val & (1 << bit))
+			return 1;
+	}
 
 	val |= (1 << bit);
 	cpu_buffer->current_context = val;

From 394147465aa4be7bcaa335ed74ba3a0de64c26b1 Mon Sep 17 00:00:00 2001
From: Alexander Aring <aahringo@redhat.com>
Date: Mon, 26 Oct 2020 10:52:29 -0400
Subject: [PATCH 0969/2658] gfs2: Wake up when sd_glock_disposal becomes zero

[ Upstream commit da7d554f7c62d0c17c1ac3cc2586473c2d99f0bd ]

Commit fc0e38dae645 ("GFS2: Fix glock deallocation race") fixed a
sd_glock_disposal accounting bug by adding a missing atomic_dec
statement, but it failed to wake up sd_glock_wait when that decrement
causes sd_glock_disposal to reach zero.  As a consequence,
gfs2_gl_hash_clear can now run into a 10-minute timeout instead of
being woken up.  Add the missing wakeup.

Fixes: fc0e38dae645 ("GFS2: Fix glock deallocation race")
Cc: stable@vger.kernel.org # v2.6.39+
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/glock.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 1eb737c466dd..8e8695eb652a 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -751,7 +751,8 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number,
 	}
 	kfree(gl->gl_lksb.sb_lvbptr);
 	kmem_cache_free(cachep, gl);
-	atomic_dec(&sdp->sd_glock_disposal);
+	if (atomic_dec_and_test(&sdp->sd_glock_disposal))
+		wake_up(&sdp->sd_glock_wait);
 	*glp = tmp;
 
 	return ret;

From 15242830bcd840c5c24136d7a8de17d0e8e679e8 Mon Sep 17 00:00:00 2001
From: Shijie Luo <luoshijie1@huawei.com>
Date: Sun, 1 Nov 2020 17:07:40 -0800
Subject: [PATCH 0970/2658] mm: mempolicy: fix potential pte_unmap_unlock pte
 error

[ Upstream commit 3f08842098e842c51e3b97d0dcdebf810b32558e ]

When flags in queue_pages_pte_range don't have MPOL_MF_MOVE or
MPOL_MF_MOVE_ALL bits, code breaks and passing origin pte - 1 to
pte_unmap_unlock seems like not a good idea.

queue_pages_pte_range can run in MPOL_MF_MOVE_ALL mode which doesn't
migrate misplaced pages but returns with EIO when encountering such a
page.  Since commit a7f40cfe3b7a ("mm: mempolicy: make mbind() return
-EIO when MPOL_MF_STRICT is specified") and early break on the first pte
in the range results in pte_unmap_unlock on an underflow pte.  This can
lead to lockups later on when somebody tries to lock the pte resp.
page_table_lock again..

Fixes: a7f40cfe3b7a ("mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified")
Signed-off-by: Shijie Luo <luoshijie1@huawei.com>
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Oscar Salvador <osalvador@suse.de>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Feilong Lin <linfeilong@huawei.com>
Cc: Shijie Luo <luoshijie1@huawei.com>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20201019074853.50856-1-luoshijie1@huawei.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/mempolicy.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 7f95df7bad2c..ce7596b408ff 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -490,14 +490,14 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
 	struct queue_pages *qp = walk->private;
 	unsigned long flags = qp->flags;
 	int nid;
-	pte_t *pte;
+	pte_t *pte, *mapped_pte;
 	spinlock_t *ptl;
 
 	split_huge_page_pmd(vma, addr, pmd);
 	if (pmd_trans_unstable(pmd))
 		return 0;
 
-	pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
+	mapped_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
 	for (; addr != end; pte++, addr += PAGE_SIZE) {
 		if (!pte_present(*pte))
 			continue;
@@ -521,7 +521,7 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
 		} else
 			break;
 	}
-	pte_unmap_unlock(pte - 1, ptl);
+	pte_unmap_unlock(mapped_pte, ptl);
 	cond_resched();
 	return addr != end ? -EIO : 0;
 }

From 51a629082e87f224151a4915c4cb255918d204f7 Mon Sep 17 00:00:00 2001
From: Zeng Tao <prime.zeng@hisilicon.com>
Date: Tue, 1 Sep 2020 17:30:13 +0800
Subject: [PATCH 0971/2658] time: Prevent undefined behaviour in
 timespec64_to_ns()

[ Upstream commit cb47755725da7b90fecbb2aa82ac3b24a7adb89b ]

UBSAN reports:

Undefined behaviour in ./include/linux/time64.h:127:27
signed integer overflow:
17179869187 * 1000000000 cannot be represented in type 'long long int'
Call Trace:
 timespec64_to_ns include/linux/time64.h:127 [inline]
 set_cpu_itimer+0x65c/0x880 kernel/time/itimer.c:180
 do_setitimer+0x8e/0x740 kernel/time/itimer.c:245
 __x64_sys_setitimer+0x14c/0x2c0 kernel/time/itimer.c:336
 do_syscall_64+0xa1/0x540 arch/x86/entry/common.c:295

Commit bd40a175769d ("y2038: itimer: change implementation to timespec64")
replaced the original conversion which handled time clamping correctly with
timespec64_to_ns() which has no overflow protection.

Fix it in timespec64_to_ns() as this is not necessarily limited to the
usage in itimers.

[ tglx: Added comment and adjusted the fixes tag ]

Fixes: 361a3bf00582 ("time64: Add time64.h header and define struct timespec64")
Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/1598952616-6416-1-git-send-email-prime.zeng@hisilicon.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/time64.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/include/linux/time64.h b/include/linux/time64.h
index 367d5af899e8..10239cffd70f 100644
--- a/include/linux/time64.h
+++ b/include/linux/time64.h
@@ -197,6 +197,10 @@ static inline bool timespec64_valid_strict(const struct timespec64 *ts)
  */
 static inline s64 timespec64_to_ns(const struct timespec64 *ts)
 {
+	/* Prevent multiplication overflow */
+	if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX)
+		return KTIME_MAX;
+
 	return ((s64) ts->tv_sec * NSEC_PER_SEC) + ts->tv_nsec;
 }
 

From bef9a5770dca49b0d7e51639503c98f0613ccbc4 Mon Sep 17 00:00:00 2001
From: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Date: Tue, 22 Sep 2020 17:27:29 +0900
Subject: [PATCH 0972/2658] btrfs: reschedule when cloning lots of extents

[ Upstream commit 6b613cc97f0ace77f92f7bc112b8f6ad3f52baf8 ]

We have several occurrences of a soft lockup from fstest's generic/175
testcase, which look more or less like this one:

  watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [xfs_io:10030]
  Kernel panic - not syncing: softlockup: hung tasks
  CPU: 0 PID: 10030 Comm: xfs_io Tainted: G             L    5.9.0-rc5+ #768
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4-rebuilt.opensuse.org 04/01/2014
  Call Trace:
   <IRQ>
   dump_stack+0x77/0xa0
   panic+0xfa/0x2cb
   watchdog_timer_fn.cold+0x85/0xa5
   ? lockup_detector_update_enable+0x50/0x50
   __hrtimer_run_queues+0x99/0x4c0
   ? recalibrate_cpu_khz+0x10/0x10
   hrtimer_run_queues+0x9f/0xb0
   update_process_times+0x28/0x80
   tick_handle_periodic+0x1b/0x60
   __sysvec_apic_timer_interrupt+0x76/0x210
   asm_call_on_stack+0x12/0x20
   </IRQ>
   sysvec_apic_timer_interrupt+0x7f/0x90
   asm_sysvec_apic_timer_interrupt+0x12/0x20
  RIP: 0010:btrfs_tree_unlock+0x91/0x1a0 [btrfs]
  RSP: 0018:ffffc90007123a58 EFLAGS: 00000282
  RAX: ffff8881cea2fbe0 RBX: ffff8881cea2fbe0 RCX: 0000000000000000
  RDX: ffff8881d23fd200 RSI: ffffffff82045220 RDI: ffff8881cea2fba0
  RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000032
  R10: 0000160000000000 R11: 0000000000001000 R12: 0000000000001000
  R13: ffff8882357fd5b0 R14: ffff88816fa76e70 R15: ffff8881cea2fad0
   ? btrfs_tree_unlock+0x15b/0x1a0 [btrfs]
   btrfs_release_path+0x67/0x80 [btrfs]
   btrfs_insert_replace_extent+0x177/0x2c0 [btrfs]
   btrfs_replace_file_extents+0x472/0x7c0 [btrfs]
   btrfs_clone+0x9ba/0xbd0 [btrfs]
   btrfs_clone_files.isra.0+0xeb/0x140 [btrfs]
   ? file_update_time+0xcd/0x120
   btrfs_remap_file_range+0x322/0x3b0 [btrfs]
   do_clone_file_range+0xb7/0x1e0
   vfs_clone_file_range+0x30/0xa0
   ioctl_file_clone+0x8a/0xc0
   do_vfs_ioctl+0x5b2/0x6f0
   __x64_sys_ioctl+0x37/0xa0
   do_syscall_64+0x33/0x40
   entry_SYSCALL_64_after_hwframe+0x44/0xa9
  RIP: 0033:0x7f87977fc247
  RSP: 002b:00007ffd51a2f6d8 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
  RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f87977fc247
  RDX: 00007ffd51a2f710 RSI: 000000004020940d RDI: 0000000000000003
  RBP: 0000000000000004 R08: 00007ffd51a79080 R09: 0000000000000000
  R10: 00005621f11352f2 R11: 0000000000000206 R12: 0000000000000000
  R13: 0000000000000000 R14: 00005621f128b958 R15: 0000000080000000
  Kernel Offset: disabled
  ---[ end Kernel panic - not syncing: softlockup: hung tasks ]---

All of these lockup reports have the call chain btrfs_clone_files() ->
btrfs_clone() in common. btrfs_clone_files() calls btrfs_clone() with
both source and destination extents locked and loops over the source
extent to create the clones.

Conditionally reschedule in the btrfs_clone() loop, to give some time back
to other processes.

CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/ioctl.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 67366515a29d..f35e18e76f16 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3856,6 +3856,8 @@ static int btrfs_clone(struct inode *src, struct inode *inode,
 			ret = -EINTR;
 			goto out;
 		}
+
+		cond_resched();
 	}
 	ret = 0;
 

From 3d923eb9711cbed33f4b496ae65b8e7ed64b7e00 Mon Sep 17 00:00:00 2001
From: zhuoliang zhang <zhuoliang.zhang@mediatek.com>
Date: Fri, 23 Oct 2020 09:05:35 +0200
Subject: [PATCH 0973/2658] net: xfrm: fix a race condition during allocing spi

[ Upstream commit a779d91314ca7208b7feb3ad817b62904397c56d ]

we found that the following race condition exists in
xfrm_alloc_userspi flow:

user thread                                    state_hash_work thread
----                                           ----
xfrm_alloc_userspi()
 __find_acq_core()
   /*alloc new xfrm_state:x*/
   xfrm_state_alloc()
   /*schedule state_hash_work thread*/
   xfrm_hash_grow_check()   	               xfrm_hash_resize()
 xfrm_alloc_spi                                  /*hold lock*/
      x->id.spi = htonl(spi)                     spin_lock_bh(&net->xfrm.xfrm_state_lock)
      /*waiting lock release*/                     xfrm_hash_transfer()
      spin_lock_bh(&net->xfrm.xfrm_state_lock)      /*add x into hlist:net->xfrm.state_byspi*/
	                                                hlist_add_head_rcu(&x->byspi)
                                                 spin_unlock_bh(&net->xfrm.xfrm_state_lock)

    /*add x into hlist:net->xfrm.state_byspi 2 times*/
    hlist_add_head_rcu(&x->byspi)

1. a new state x is alloced in xfrm_state_alloc() and added into the bydst hlist
in  __find_acq_core() on the LHS;
2. on the RHS, state_hash_work thread travels the old bydst and tranfers every xfrm_state
(include x) into the new bydst hlist and new byspi hlist;
3. user thread on the LHS gets the lock and adds x into the new byspi hlist again.

So the same xfrm_state (x) is added into the same list_hash
(net->xfrm.state_byspi) 2 times that makes the list_hash become
an inifite loop.

To fix the race, x->id.spi = htonl(spi) in the xfrm_alloc_spi() is moved
to the back of spin_lock_bh, sothat state_hash_work thread no longer add x
which id.spi is zero into the hash_list.

Fixes: f034b5d4efdf ("[XFRM]: Dynamic xfrm_state hash table sizing.")
Signed-off-by: zhuoliang zhang <zhuoliang.zhang@mediatek.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xfrm/xfrm_state.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 5bb5950d6276..ed05cd7a4ef2 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1554,6 +1554,7 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
 	int err = -ENOENT;
 	__be32 minspi = htonl(low);
 	__be32 maxspi = htonl(high);
+	__be32 newspi = 0;
 	u32 mark = x->mark.v & x->mark.m;
 
 	spin_lock_bh(&x->lock);
@@ -1572,21 +1573,22 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
 			xfrm_state_put(x0);
 			goto unlock;
 		}
-		x->id.spi = minspi;
+		newspi = minspi;
 	} else {
 		u32 spi = 0;
 		for (h = 0; h < high-low+1; h++) {
 			spi = low + prandom_u32()%(high-low+1);
 			x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family);
 			if (x0 == NULL) {
-				x->id.spi = htonl(spi);
+				newspi = htonl(spi);
 				break;
 			}
 			xfrm_state_put(x0);
 		}
 	}
-	if (x->id.spi) {
+	if (newspi) {
 		spin_lock_bh(&net->xfrm.xfrm_state_lock);
+		x->id.spi = newspi;
 		h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family);
 		hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
 		spin_unlock_bh(&net->xfrm.xfrm_state_lock);

From ceaa643a84e455c716c6a62927eefaad40b9bd40 Mon Sep 17 00:00:00 2001
From: Jiri Olsa <jolsa@kernel.org>
Date: Mon, 2 Nov 2020 00:31:03 +0100
Subject: [PATCH 0974/2658] perf tools: Add missing swap for ino_generation

[ Upstream commit fe01adb72356a4e2f8735e4128af85921ca98fa1 ]

We are missing swap for ino_generation field.

Fixes: 5c5e854bc760 ("perf tools: Add attr->mmap2 support")
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Link: https://lore.kernel.org/r/20201101233103.3537427-2-jolsa@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/session.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index 4596496f6c0f..24bb782886eb 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -389,6 +389,7 @@ static void perf_event__mmap2_swap(union perf_event *event,
 	event->mmap2.maj   = bswap_32(event->mmap2.maj);
 	event->mmap2.min   = bswap_32(event->mmap2.min);
 	event->mmap2.ino   = bswap_64(event->mmap2.ino);
+	event->mmap2.ino_generation = bswap_64(event->mmap2.ino_generation);
 
 	if (sample_id_all) {
 		void *data = &event->mmap2.filename;

From a03db8d003f1b4d947b2e3d6a1f21464b9b1f8ec Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 3 Nov 2020 13:18:07 +0300
Subject: [PATCH 0975/2658] ALSA: hda: prevent undefined shift in
 snd_hdac_ext_bus_get_link()

[ Upstream commit 158e1886b6262c1d1c96a18c85fac5219b8bf804 ]

This is harmless, but the "addr" comes from the user and it could lead
to a negative shift or to shift wrapping if it's too high.

Fixes: 0b00a5615dc4 ("ALSA: hdac_ext: add hdac extended controller")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20201103101807.GC1127762@mwanda
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/ext/hdac_ext_controller.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/hda/ext/hdac_ext_controller.c b/sound/hda/ext/hdac_ext_controller.c
index 63215b17247c..379250dd0668 100644
--- a/sound/hda/ext/hdac_ext_controller.c
+++ b/sound/hda/ext/hdac_ext_controller.c
@@ -221,6 +221,8 @@ struct hdac_ext_link *snd_hdac_ext_bus_get_link(struct hdac_ext_bus *ebus,
 		return NULL;
 	if (ebus->idx != bus_idx)
 		return NULL;
+	if (addr < 0 || addr > 31)
+		return NULL;
 
 	list_for_each_entry(hlink, &ebus->hlink_list, list) {
 		for (i = 0; i < HDA_MAX_CODECS; i++) {

From bac6162b88a824f606306a27a3fed2d1d4e1e50b Mon Sep 17 00:00:00 2001
From: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Date: Sat, 3 Oct 2020 00:41:45 +0900
Subject: [PATCH 0976/2658] can: dev: can_get_echo_skb(): prevent call to
 kfree_skb() in hard IRQ context

[ Upstream commit 2283f79b22684d2812e5c76fc2280aae00390365 ]

If a driver calls can_get_echo_skb() during a hardware IRQ (which is often, but
not always, the case), the 'WARN_ON(in_irq)' in
net/core/skbuff.c#skb_release_head_state() might be triggered, under network
congestion circumstances, together with the potential risk of a NULL pointer
dereference.

The root cause of this issue is the call to kfree_skb() instead of
dev_kfree_skb_irq() in net/core/dev.c#enqueue_to_backlog().

This patch prevents the skb to be freed within the call to netif_rx() by
incrementing its reference count with skb_get(). The skb is finally freed by
one of the in-irq-context safe functions: dev_consume_skb_any() or
dev_kfree_skb_any(). The "any" version is used because some drivers might call
can_get_echo_skb() in a normal context.

The reason for this issue to occur is that initially, in the core network
stack, loopback skb were not supposed to be received in hardware IRQ context.
The CAN stack is an exeption.

This bug was previously reported back in 2017 in [1] but the proposed patch
never got accepted.

While [1] directly modifies net/core/dev.c, we try to propose here a
smoother modification local to CAN network stack (the assumption
behind is that only CAN devices are affected by this issue).

[1] http://lore.kernel.org/r/57a3ffb6-3309-3ad5-5a34-e93c3fe3614d@cetitec.com

Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Link: https://lore.kernel.org/r/20201002154219.4887-2-mailhol.vincent@wanadoo.fr
Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/dev.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 9dd968ee792e..3c0f141262ad 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -466,7 +466,11 @@ unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx)
 	if (!skb)
 		return 0;
 
-	netif_rx(skb);
+	skb_get(skb);
+	if (netif_rx(skb) == NET_RX_SUCCESS)
+		dev_consume_skb_any(skb);
+	else
+		dev_kfree_skb_any(skb);
 
 	return len;
 }

From 04a02996b8562e56ffdfec1063e74458c1cc064f Mon Sep 17 00:00:00 2001
From: Oliver Hartkopp <socketcan@hartkopp.net>
Date: Tue, 20 Oct 2020 08:44:43 +0200
Subject: [PATCH 0977/2658] can: dev: __can_get_echo_skb(): fix real payload
 length return value for RTR frames

[ Upstream commit ed3320cec279407a86bc4c72edc4a39eb49165ec ]

The can_get_echo_skb() function returns the number of received bytes to
be used for netdev statistics. In the case of RTR frames we get a valid
(potential non-zero) data length value which has to be passed for further
operations. But on the wire RTR frames have no payload length. Therefore
the value to be used in the statistics has to be zero for RTR frames.

Reported-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://lore.kernel.org/r/20201020064443.80164-1-socketcan@hartkopp.net
Fixes: cf5046b309b3 ("can: dev: let can_get_echo_skb() return dlc of CAN frame")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/dev.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 3c0f141262ad..9579dae54af2 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -439,9 +439,13 @@ struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8
 		 */
 		struct sk_buff *skb = priv->echo_skb[idx];
 		struct canfd_frame *cf = (struct canfd_frame *)skb->data;
-		u8 len = cf->len;
 
-		*len_ptr = len;
+		/* get the real payload length for netdev statistics */
+		if (cf->can_id & CAN_RTR_FLAG)
+			*len_ptr = 0;
+		else
+			*len_ptr = cf->len;
+
 		priv->echo_skb[idx] = NULL;
 
 		return skb;

From 54266b6709a2f4fa53c4986669180eb17442525a Mon Sep 17 00:00:00 2001
From: Oleksij Rempel <o.rempel@pengutronix.de>
Date: Wed, 18 Dec 2019 09:39:02 +0100
Subject: [PATCH 0978/2658] can: can_create_echo_skb(): fix echo skb
 generation: always use skb_clone()

[ Upstream commit 286228d382ba6320f04fa2e7c6fc8d4d92e428f4 ]

All user space generated SKBs are owned by a socket (unless injected into the
key via AF_PACKET). If a socket is closed, all associated skbs will be cleaned
up.

This leads to a problem when a CAN driver calls can_put_echo_skb() on a
unshared SKB. If the socket is closed prior to the TX complete handler,
can_get_echo_skb() and the subsequent delivering of the echo SKB to all
registered callbacks, a SKB with a refcount of 0 is delivered.

To avoid the problem, in can_get_echo_skb() the original SKB is now always
cloned, regardless of shared SKB or not. If the process exists it can now
safely discard its SKBs, without disturbing the delivery of the echo SKB.

The problem shows up in the j1939 stack, when it clones the incoming skb, which
detects the already 0 refcount.

We can easily reproduce this with following example:

testj1939 -B -r can0: &
cansend can0 1823ff40#0123

WARNING: CPU: 0 PID: 293 at lib/refcount.c:25 refcount_warn_saturate+0x108/0x174
refcount_t: addition on 0; use-after-free.
Modules linked in: coda_vpu imx_vdoa videobuf2_vmalloc dw_hdmi_ahb_audio vcan
CPU: 0 PID: 293 Comm: cansend Not tainted 5.5.0-rc6-00376-g9e20dcb7040d #1
Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
Backtrace:
[<c010f570>] (dump_backtrace) from [<c010f90c>] (show_stack+0x20/0x24)
[<c010f8ec>] (show_stack) from [<c0c3e1a4>] (dump_stack+0x8c/0xa0)
[<c0c3e118>] (dump_stack) from [<c0127fec>] (__warn+0xe0/0x108)
[<c0127f0c>] (__warn) from [<c01283c8>] (warn_slowpath_fmt+0xa8/0xcc)
[<c0128324>] (warn_slowpath_fmt) from [<c0539c0c>] (refcount_warn_saturate+0x108/0x174)
[<c0539b04>] (refcount_warn_saturate) from [<c0ad2cac>] (j1939_can_recv+0x20c/0x210)
[<c0ad2aa0>] (j1939_can_recv) from [<c0ac9dc8>] (can_rcv_filter+0xb4/0x268)
[<c0ac9d14>] (can_rcv_filter) from [<c0aca2cc>] (can_receive+0xb0/0xe4)
[<c0aca21c>] (can_receive) from [<c0aca348>] (can_rcv+0x48/0x98)
[<c0aca300>] (can_rcv) from [<c09b1fdc>] (__netif_receive_skb_one_core+0x64/0x88)
[<c09b1f78>] (__netif_receive_skb_one_core) from [<c09b2070>] (__netif_receive_skb+0x38/0x94)
[<c09b2038>] (__netif_receive_skb) from [<c09b2130>] (netif_receive_skb_internal+0x64/0xf8)
[<c09b20cc>] (netif_receive_skb_internal) from [<c09b21f8>] (netif_receive_skb+0x34/0x19c)
[<c09b21c4>] (netif_receive_skb) from [<c0791278>] (can_rx_offload_napi_poll+0x58/0xb4)

Fixes: 0ae89beb283a ("can: add destructor for self generated skbs")
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: http://lore.kernel.org/r/20200124132656.22156-1-o.rempel@pengutronix.de
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/can/skb.h | 20 ++++++++------------
 1 file changed, 8 insertions(+), 12 deletions(-)

diff --git a/include/linux/can/skb.h b/include/linux/can/skb.h
index 51bb6532785c..1a2111c775ae 100644
--- a/include/linux/can/skb.h
+++ b/include/linux/can/skb.h
@@ -60,21 +60,17 @@ static inline void can_skb_set_owner(struct sk_buff *skb, struct sock *sk)
  */
 static inline struct sk_buff *can_create_echo_skb(struct sk_buff *skb)
 {
-	if (skb_shared(skb)) {
-		struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
+	struct sk_buff *nskb;
 
-		if (likely(nskb)) {
-			can_skb_set_owner(nskb, skb->sk);
-			consume_skb(skb);
-			return nskb;
-		} else {
-			kfree_skb(skb);
-			return NULL;
-		}
+	nskb = skb_clone(skb, GFP_ATOMIC);
+	if (unlikely(!nskb)) {
+		kfree_skb(skb);
+		return NULL;
 	}
 
-	/* we can assume to have an unshared skb with proper owner */
-	return skb;
+	can_skb_set_owner(nskb, skb->sk);
+	consume_skb(skb);
+	return nskb;
 }
 
 #endif /* !_CAN_SKB_H */

From 72332f173c98fb3302d55afc64e8623967d17272 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 13 Aug 2020 17:06:04 +0300
Subject: [PATCH 0979/2658] can: peak_usb: add range checking in decode
 operations

[ Upstream commit a6921dd524fe31d1f460c161d3526a407533b6db ]

These values come from skb->data so Smatch considers them untrusted.  I
believe Smatch is correct but I don't have a way to test this.

The usb_if->dev[] array has 2 elements but the index is in the 0-15
range without checks.  The cfd->len can be up to 255 but the maximum
valid size is CANFD_MAX_DLEN (64) so that could lead to memory
corruption.

Fixes: 0a25e1f4f185 ("can: peak_usb: add support for PEAK new CANFD USB adapters")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20200813140604.GA456946@mwanda
Acked-by: Stephane Grosjean <s.grosjean@peak-system.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 48 +++++++++++++++++-----
 1 file changed, 37 insertions(+), 11 deletions(-)

diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
index 1b75d5304a2c..2e62cdc7ec7a 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
@@ -475,12 +475,18 @@ static int pcan_usb_fd_decode_canmsg(struct pcan_usb_fd_if *usb_if,
 				     struct pucan_msg *rx_msg)
 {
 	struct pucan_rx_msg *rm = (struct pucan_rx_msg *)rx_msg;
-	struct peak_usb_device *dev = usb_if->dev[pucan_msg_get_channel(rm)];
-	struct net_device *netdev = dev->netdev;
+	struct peak_usb_device *dev;
+	struct net_device *netdev;
 	struct canfd_frame *cfd;
 	struct sk_buff *skb;
 	const u16 rx_msg_flags = le16_to_cpu(rm->flags);
 
+	if (pucan_msg_get_channel(rm) >= ARRAY_SIZE(usb_if->dev))
+		return -ENOMEM;
+
+	dev = usb_if->dev[pucan_msg_get_channel(rm)];
+	netdev = dev->netdev;
+
 	if (rx_msg_flags & PUCAN_MSG_EXT_DATA_LEN) {
 		/* CANFD frame case */
 		skb = alloc_canfd_skb(netdev, &cfd);
@@ -527,15 +533,21 @@ static int pcan_usb_fd_decode_status(struct pcan_usb_fd_if *usb_if,
 				     struct pucan_msg *rx_msg)
 {
 	struct pucan_status_msg *sm = (struct pucan_status_msg *)rx_msg;
-	struct peak_usb_device *dev = usb_if->dev[pucan_stmsg_get_channel(sm)];
-	struct pcan_usb_fd_device *pdev =
-			container_of(dev, struct pcan_usb_fd_device, dev);
+	struct pcan_usb_fd_device *pdev;
 	enum can_state new_state = CAN_STATE_ERROR_ACTIVE;
 	enum can_state rx_state, tx_state;
-	struct net_device *netdev = dev->netdev;
+	struct peak_usb_device *dev;
+	struct net_device *netdev;
 	struct can_frame *cf;
 	struct sk_buff *skb;
 
+	if (pucan_stmsg_get_channel(sm) >= ARRAY_SIZE(usb_if->dev))
+		return -ENOMEM;
+
+	dev = usb_if->dev[pucan_stmsg_get_channel(sm)];
+	pdev = container_of(dev, struct pcan_usb_fd_device, dev);
+	netdev = dev->netdev;
+
 	/* nothing should be sent while in BUS_OFF state */
 	if (dev->can.state == CAN_STATE_BUS_OFF)
 		return 0;
@@ -588,9 +600,14 @@ static int pcan_usb_fd_decode_error(struct pcan_usb_fd_if *usb_if,
 				    struct pucan_msg *rx_msg)
 {
 	struct pucan_error_msg *er = (struct pucan_error_msg *)rx_msg;
-	struct peak_usb_device *dev = usb_if->dev[pucan_ermsg_get_channel(er)];
-	struct pcan_usb_fd_device *pdev =
-			container_of(dev, struct pcan_usb_fd_device, dev);
+	struct pcan_usb_fd_device *pdev;
+	struct peak_usb_device *dev;
+
+	if (pucan_ermsg_get_channel(er) >= ARRAY_SIZE(usb_if->dev))
+		return -EINVAL;
+
+	dev = usb_if->dev[pucan_ermsg_get_channel(er)];
+	pdev = container_of(dev, struct pcan_usb_fd_device, dev);
 
 	/* keep a trace of tx and rx error counters for later use */
 	pdev->bec.txerr = er->tx_err_cnt;
@@ -604,11 +621,17 @@ static int pcan_usb_fd_decode_overrun(struct pcan_usb_fd_if *usb_if,
 				      struct pucan_msg *rx_msg)
 {
 	struct pcan_ufd_ovr_msg *ov = (struct pcan_ufd_ovr_msg *)rx_msg;
-	struct peak_usb_device *dev = usb_if->dev[pufd_omsg_get_channel(ov)];
-	struct net_device *netdev = dev->netdev;
+	struct peak_usb_device *dev;
+	struct net_device *netdev;
 	struct can_frame *cf;
 	struct sk_buff *skb;
 
+	if (pufd_omsg_get_channel(ov) >= ARRAY_SIZE(usb_if->dev))
+		return -EINVAL;
+
+	dev = usb_if->dev[pufd_omsg_get_channel(ov)];
+	netdev = dev->netdev;
+
 	/* allocate an skb to store the error frame */
 	skb = alloc_can_err_skb(netdev, &cf);
 	if (!skb)
@@ -726,6 +749,9 @@ static int pcan_usb_fd_encode_msg(struct peak_usb_device *dev,
 	u16 tx_msg_size, tx_msg_flags;
 	u8 can_dlc;
 
+	if (cfd->len > CANFD_MAX_DLEN)
+		return -EINVAL;
+
 	tx_msg_size = ALIGN(sizeof(struct pucan_tx_msg) + cfd->len, 4);
 	tx_msg->size = cpu_to_le16(tx_msg_size);
 	tx_msg->type = cpu_to_le16(PUCAN_MSG_CAN_TX);

From 603a30ad61a58bd8b47df738a44dd6d7bce0ff71 Mon Sep 17 00:00:00 2001
From: Stephane Grosjean <s.grosjean@peak-system.com>
Date: Wed, 14 Oct 2020 10:56:31 +0200
Subject: [PATCH 0980/2658] can: peak_usb: peak_usb_get_ts_time(): fix
 timestamp wrapping

[ Upstream commit ecc7b4187dd388549544195fb13a11b4ea8e6a84 ]

Fabian Inostroza <fabianinostrozap@gmail.com> has discovered a potential
problem in the hardware timestamp reporting from the PCAN-USB USB CAN interface
(only), related to the fact that a timestamp of an event may precede the
timestamp used for synchronization when both records are part of the same USB
packet. However, this case was used to detect the wrapping of the time counter.

This patch details and fixes the two identified cases where this problem can
occur.

Reported-by: Fabian Inostroza <fabianinostrozap@gmail.com>
Signed-off-by: Stephane Grosjean <s.grosjean@peak-system.com>
Link: https://lore.kernel.org/r/20201014085631.15128-1-s.grosjean@peak-system.com
Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/usb/peak_usb/pcan_usb_core.c | 51 ++++++++++++++++++--
 1 file changed, 46 insertions(+), 5 deletions(-)

diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index 8c47cc8dc896..22deddb2dbf5 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -150,14 +150,55 @@ void peak_usb_get_ts_tv(struct peak_time_ref *time_ref, u32 ts,
 	/* protect from getting timeval before setting now */
 	if (time_ref->tv_host.tv_sec > 0) {
 		u64 delta_us;
+		s64 delta_ts = 0;
+
+		/* General case: dev_ts_1 < dev_ts_2 < ts, with:
+		 *
+		 * - dev_ts_1 = previous sync timestamp
+		 * - dev_ts_2 = last sync timestamp
+		 * - ts = event timestamp
+		 * - ts_period = known sync period (theoretical)
+		 *             ~ dev_ts2 - dev_ts1
+		 * *but*:
+		 *
+		 * - time counters wrap (see adapter->ts_used_bits)
+		 * - sometimes, dev_ts_1 < ts < dev_ts2
+		 *
+		 * "normal" case (sync time counters increase):
+		 * must take into account case when ts wraps (tsw)
+		 *
+		 *      < ts_period > <          >
+		 *     |             |            |
+		 *  ---+--------+----+-------0-+--+-->
+		 *     ts_dev_1 |    ts_dev_2  |
+		 *              ts             tsw
+		 */
+		if (time_ref->ts_dev_1 < time_ref->ts_dev_2) {
+			/* case when event time (tsw) wraps */
+			if (ts < time_ref->ts_dev_1)
+				delta_ts = 1 << time_ref->adapter->ts_used_bits;
+
+		/* Otherwise, sync time counter (ts_dev_2) has wrapped:
+		 * handle case when event time (tsn) hasn't.
+		 *
+		 *      < ts_period > <          >
+		 *     |             |            |
+		 *  ---+--------+--0-+---------+--+-->
+		 *     ts_dev_1 |    ts_dev_2  |
+		 *              tsn            ts
+		 */
+		} else if (time_ref->ts_dev_1 < ts) {
+			delta_ts = -(1 << time_ref->adapter->ts_used_bits);
+		}
 
-		delta_us = ts - time_ref->ts_dev_2;
-		if (ts < time_ref->ts_dev_2)
-			delta_us &= (1 << time_ref->adapter->ts_used_bits) - 1;
+		/* add delay between last sync and event timestamps */
+		delta_ts += (signed int)(ts - time_ref->ts_dev_2);
 
-		delta_us += time_ref->ts_total;
+		/* add time from beginning to last sync */
+		delta_ts += time_ref->ts_total;
 
-		delta_us *= time_ref->adapter->us_per_ts_scale;
+		/* convert ticks number into microseconds */
+		delta_us = delta_ts * time_ref->adapter->us_per_ts_scale;
 		delta_us >>= time_ref->adapter->us_per_ts_shift;
 
 		*tv = time_ref->tv_host_0;

From 67d6b0c2eeb4b11b0ac8c08fd181033cc127813c Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Wed, 11 Sep 2019 17:42:28 +0100
Subject: [PATCH 0981/2658] Btrfs: fix missing error return if writeback for
 extent buffer never started

[ Upstream commit 0607eb1d452d45c5ac4c745a9e9e0d95152ea9d0 ]

If lock_extent_buffer_for_io() fails, it returns a negative value, but its
caller btree_write_cache_pages() ignores such error. This means that a
call to flush_write_bio(), from lock_extent_buffer_for_io(), might have
failed. We should make btree_write_cache_pages() notice such error values
and stop immediatelly, making sure filemap_fdatawrite_range() returns an
error to the transaction commit path. A failure from flush_write_bio()
should also result in the endio callback end_bio_extent_buffer_writepage()
being invoked, which sets the BTRFS_FS_*_ERR bits appropriately, so that
there's no risk a transaction or log commit doesn't catch a writeback
failure.

Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/extent_io.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 97a80238fdee..b28bc7690d4b 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -4000,6 +4000,10 @@ int btree_write_cache_pages(struct address_space *mapping,
 			if (!ret) {
 				free_extent_buffer(eb);
 				continue;
+			} else if (ret < 0) {
+				done = 1;
+				free_extent_buffer(eb);
+				break;
 			}
 
 			ret = write_one_eb(eb, fs_info, wbc, &epd);

From 74f26ff685a6739f25005156e2ffa341671d7b77 Mon Sep 17 00:00:00 2001
From: Will Deacon <will@kernel.org>
Date: Wed, 2 Oct 2019 13:42:06 +0100
Subject: [PATCH 0982/2658] pinctrl: devicetree: Avoid taking direct reference
 to device name string

commit be4c60b563edee3712d392aaeb0943a768df7023 upstream.

When populating the pinctrl mapping table entries for a device, the
'dev_name' field for each entry is initialised to point directly at the
string returned by 'dev_name()' for the device and subsequently used by
'create_pinctrl()' when looking up the mappings for the device being
probed.

This is unreliable in the presence of calls to 'dev_set_name()', which may
reallocate the device name string leaving the pinctrl mappings with a
dangling reference. This then leads to a use-after-free every time the
name is dereferenced by a device probe:

  | BUG: KASAN: invalid-access in strcmp+0x20/0x64
  | Read of size 1 at addr 13ffffc153494b00 by task modprobe/590
  | Pointer tag: [13], memory tag: [fe]
  |
  | Call trace:
  |  __kasan_report+0x16c/0x1dc
  |  kasan_report+0x10/0x18
  |  check_memory_region
  |  __hwasan_load1_noabort+0x4c/0x54
  |  strcmp+0x20/0x64
  |  create_pinctrl+0x18c/0x7f4
  |  pinctrl_get+0x90/0x114
  |  devm_pinctrl_get+0x44/0x98
  |  pinctrl_bind_pins+0x5c/0x450
  |  really_probe+0x1c8/0x9a4
  |  driver_probe_device+0x120/0x1d8

Follow the example of sysfs, and duplicate the device name string before
stashing it away in the pinctrl mapping entries.

Cc: Linus Walleij <linus.walleij@linaro.org>
Reported-by: Elena Petrova <lenaptr@google.com>
Tested-by: Elena Petrova <lenaptr@google.com>
Signed-off-by: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20191002124206.22928-1-will@kernel.org
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
[bwh: Backported to 4.4: adjust context]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/devicetree.c | 26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c
index 619afc5496ce..244cbc5b5210 100644
--- a/drivers/pinctrl/devicetree.c
+++ b/drivers/pinctrl/devicetree.c
@@ -40,6 +40,13 @@ struct pinctrl_dt_map {
 static void dt_free_map(struct pinctrl_dev *pctldev,
 		     struct pinctrl_map *map, unsigned num_maps)
 {
+	int i;
+
+	for (i = 0; i < num_maps; ++i) {
+		kfree_const(map[i].dev_name);
+		map[i].dev_name = NULL;
+	}
+
 	if (pctldev) {
 		const struct pinctrl_ops *ops = pctldev->desc->pctlops;
 		ops->dt_free_map(pctldev, map, num_maps);
@@ -73,7 +80,13 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename,
 
 	/* Initialize common mapping table entry fields */
 	for (i = 0; i < num_maps; i++) {
-		map[i].dev_name = dev_name(p->dev);
+		const char *devname;
+
+		devname = kstrdup_const(dev_name(p->dev), GFP_KERNEL);
+		if (!devname)
+			goto err_free_map;
+
+		map[i].dev_name = devname;
 		map[i].name = statename;
 		if (pctldev)
 			map[i].ctrl_dev_name = dev_name(pctldev->dev);
@@ -81,11 +94,8 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename,
 
 	/* Remember the converted mapping table entries */
 	dt_map = kzalloc(sizeof(*dt_map), GFP_KERNEL);
-	if (!dt_map) {
-		dev_err(p->dev, "failed to alloc struct pinctrl_dt_map\n");
-		dt_free_map(pctldev, map, num_maps);
-		return -ENOMEM;
-	}
+	if (!dt_map)
+		goto err_free_map;
 
 	dt_map->pctldev = pctldev;
 	dt_map->map = map;
@@ -93,6 +103,10 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename,
 	list_add_tail(&dt_map->node, &p->dt_maps);
 
 	return pinctrl_register_map(map, num_maps, false);
+
+err_free_map:
+	dt_free_map(pctldev, map, num_maps);
+	return -ENOMEM;
 }
 
 struct pinctrl_dev *of_pinctrl_get(struct device_node *np)

From a8c1aef5a8e53eaa9099c5dbceaf58792b55c25e Mon Sep 17 00:00:00 2001
From: Grzegorz Siwik <grzegorz.siwik@intel.com>
Date: Fri, 29 Mar 2019 15:08:37 -0700
Subject: [PATCH 0983/2658] i40e: Wrong truncation from u16 to u8

commit c004804dceee9ca384d97d9857ea2e2795c2651d upstream.

In this patch fixed wrong truncation method from u16 to u8 during
validation.

It was changed by changing u8 to u32 parameter in method declaration
and arguments were changed to u32.

Signed-off-by: Grzegorz Siwik <grzegorz.siwik@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index cdb263875efb..18e10357f1d0 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -203,7 +203,7 @@ static inline bool i40e_vc_isvalid_queue_id(struct i40e_vf *vf, u16 vsi_id,
  *
  * check for the valid vector id
  **/
-static inline bool i40e_vc_isvalid_vector_id(struct i40e_vf *vf, u8 vector_id)
+static inline bool i40e_vc_isvalid_vector_id(struct i40e_vf *vf, u32 vector_id)
 {
 	struct i40e_pf *pf = vf->pf;
 

From e6020cbef4361386519ae7188663c81797292b1e Mon Sep 17 00:00:00 2001
From: Martyna Szapar <martyna.szapar@intel.com>
Date: Mon, 15 Apr 2019 14:43:07 -0700
Subject: [PATCH 0984/2658] i40e: Fix of memory leak and integer truncation in
 i40e_virtchnl.c

commit 24474f2709af6729b9b1da1c5e160ab62e25e3a4 upstream.

Fixed possible memory leak in i40e_vc_add_cloud_filter function:
cfilter is being allocated and in some error conditions
the function returns without freeing the memory.

Fix of integer truncation from u16 (type of queue_id value) to u8
when calling i40e_vc_isvalid_queue_id function.

Signed-off-by: Martyna Szapar <martyna.szapar@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
[bwh: Backported to 4.4: i40e_vc_add_cloud_filter() does not exist
 but the integer truncation is still possible]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 18e10357f1d0..b4b4d46da173 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -188,7 +188,7 @@ static inline bool i40e_vc_isvalid_vsi_id(struct i40e_vf *vf, u16 vsi_id)
  * check for the valid queue id
  **/
 static inline bool i40e_vc_isvalid_queue_id(struct i40e_vf *vf, u16 vsi_id,
-					    u8 qid)
+					    u16 qid)
 {
 	struct i40e_pf *pf = vf->pf;
 	struct i40e_vsi *vsi = i40e_find_vsi_from_id(pf, vsi_id);

From 8ed7cd6858e24dccf25719f3f35850ee50f9e3dd Mon Sep 17 00:00:00 2001
From: Mark Gray <mark.d.gray@redhat.com>
Date: Wed, 16 Sep 2020 05:19:35 -0400
Subject: [PATCH 0985/2658] geneve: add transport ports in route lookup for
 geneve

commit 34beb21594519ce64a55a498c2fe7d567bc1ca20 upstream.

This patch adds transport ports information for route lookup so that
IPsec can select Geneve tunnel traffic to do encryption. This is
needed for OVS/OVN IPsec with encrypted Geneve tunnels.

This can be tested by configuring a host-host VPN using an IKE
daemon and specifying port numbers. For example, for an
Openswan-type configuration, the following parameters should be
configured on both hosts and IPsec set up as-per normal:

$ cat /etc/ipsec.conf

conn in
...
left=$IP1
right=$IP2
...
leftprotoport=udp/6081
rightprotoport=udp
...
conn out
...
left=$IP1
right=$IP2
...
leftprotoport=udp
rightprotoport=udp/6081
...

The tunnel can then be setup using "ip" on both hosts (but
changing the relevant IP addresses):

$ ip link add tun type geneve id 1000 remote $IP2
$ ip addr add 192.168.0.1/24 dev tun
$ ip link set tun up

This can then be tested by pinging from $IP1:

$ ping 192.168.0.2

Without this patch the traffic is unencrypted on the wire.

Fixes: 2d07dc79fe04 ("geneve: add initial netdev driver for GENEVE tunnels")
Signed-off-by: Qiuyu Xiao <qiuyu.xiao.qyx@gmail.com>
Signed-off-by: Mark Gray <mark.d.gray@redhat.com>
Reviewed-by: Greg Rose <gvrose8192@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 4.4:
 - Use geneve->dst_port instead of geneve->cfg.info.key.tp_dst
 - Adjust context]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/geneve.c | 36 ++++++++++++++++++++++++++----------
 1 file changed, 26 insertions(+), 10 deletions(-)

diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 1988bc00de3c..6993b0e1e55c 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -711,7 +711,8 @@ static int geneve6_build_skb(struct dst_entry *dst, struct sk_buff *skb,
 static struct rtable *geneve_get_v4_rt(struct sk_buff *skb,
 				       struct net_device *dev,
 				       struct flowi4 *fl4,
-				       struct ip_tunnel_info *info)
+				       struct ip_tunnel_info *info,
+				       __be16 dport, __be16 sport)
 {
 	struct geneve_dev *geneve = netdev_priv(dev);
 	struct rtable *rt = NULL;
@@ -720,6 +721,8 @@ static struct rtable *geneve_get_v4_rt(struct sk_buff *skb,
 	memset(fl4, 0, sizeof(*fl4));
 	fl4->flowi4_mark = skb->mark;
 	fl4->flowi4_proto = IPPROTO_UDP;
+	fl4->fl4_dport = dport;
+	fl4->fl4_sport = sport;
 
 	if (info) {
 		fl4->daddr = info->key.u.ipv4.dst;
@@ -754,7 +757,8 @@ static struct rtable *geneve_get_v4_rt(struct sk_buff *skb,
 static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb,
 					   struct net_device *dev,
 					   struct flowi6 *fl6,
-					   struct ip_tunnel_info *info)
+					   struct ip_tunnel_info *info,
+					   __be16 dport, __be16 sport)
 {
 	struct geneve_dev *geneve = netdev_priv(dev);
 	struct geneve_sock *gs6 = geneve->sock6;
@@ -764,6 +768,8 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb,
 	memset(fl6, 0, sizeof(*fl6));
 	fl6->flowi6_mark = skb->mark;
 	fl6->flowi6_proto = IPPROTO_UDP;
+	fl6->fl6_dport = dport;
+	fl6->fl6_sport = sport;
 
 	if (info) {
 		fl6->daddr = info->key.u.ipv6.dst;
@@ -832,13 +838,14 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
 			goto tx_error;
 	}
 
-	rt = geneve_get_v4_rt(skb, dev, &fl4, info);
+	sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
+	rt = geneve_get_v4_rt(skb, dev, &fl4, info,
+			      geneve->dst_port, sport);
 	if (IS_ERR(rt)) {
 		err = PTR_ERR(rt);
 		goto tx_error;
 	}
 
-	sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
 	skb_reset_mac_header(skb);
 
 	if (info) {
@@ -914,13 +921,14 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
 		}
 	}
 
-	dst = geneve_get_v6_dst(skb, dev, &fl6, info);
+	sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
+	dst = geneve_get_v6_dst(skb, dev, &fl6, info,
+				geneve->dst_port, sport);
 	if (IS_ERR(dst)) {
 		err = PTR_ERR(dst);
 		goto tx_error;
 	}
 
-	sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
 	skb_reset_mac_header(skb);
 
 	if (info) {
@@ -1009,9 +1017,14 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
 	struct dst_entry *dst;
 	struct flowi6 fl6;
 #endif
+	__be16 sport;
 
 	if (ip_tunnel_info_af(info) == AF_INET) {
-		rt = geneve_get_v4_rt(skb, dev, &fl4, info);
+		sport = udp_flow_src_port(geneve->net, skb,
+					  1, USHRT_MAX, true);
+
+		rt = geneve_get_v4_rt(skb, dev, &fl4, info,
+				      geneve->dst_port, sport);
 		if (IS_ERR(rt))
 			return PTR_ERR(rt);
 
@@ -1019,7 +1032,11 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
 		info->key.u.ipv4.src = fl4.saddr;
 #if IS_ENABLED(CONFIG_IPV6)
 	} else if (ip_tunnel_info_af(info) == AF_INET6) {
-		dst = geneve_get_v6_dst(skb, dev, &fl6, info);
+		sport = udp_flow_src_port(geneve->net, skb,
+					  1, USHRT_MAX, true);
+
+		dst = geneve_get_v6_dst(skb, dev, &fl6, info,
+					geneve->dst_port, sport);
 		if (IS_ERR(dst))
 			return PTR_ERR(dst);
 
@@ -1030,8 +1047,7 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
 		return -EINVAL;
 	}
 
-	info->key.tp_src = udp_flow_src_port(geneve->net, skb,
-					     1, USHRT_MAX, true);
+	info->key.tp_src = sport;
 	info->key.tp_dst = geneve->dst_port;
 	return 0;
 }

From 1e3d1183b93297c833d276ddfce5b88f4f3ddee5 Mon Sep 17 00:00:00 2001
From: Masashi Honma <masashi.honma@gmail.com>
Date: Sun, 9 Aug 2020 08:32:58 +0900
Subject: [PATCH 0986/2658] ath9k_htc: Use appropriate rs_datalen type

commit 5024f21c159f8c1668f581fff37140741c0b1ba9 upstream.

kernel test robot says:
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: warning: incorrect type in assignment (different base types)
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse:    expected restricted __be16 [usertype] rs_datalen
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse:    got unsigned short [usertype]
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:988:13: sparse: warning: restricted __be16 degrades to integer
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:1001:13: sparse: warning: restricted __be16 degrades to integer

Indeed rs_datalen has host byte order, so modify it's own type.

Reported-by: kernel test robot <lkp@intel.com>
Fixes: cd486e627e67 ("ath9k_htc: Discard undersized packets")
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200808233258.4596-1-masashi.honma@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 91d199481a37..64ff52eed9f5 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -972,7 +972,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
 	struct ath_htc_rx_status *rxstatus;
 	struct ath_rx_status rx_stats;
 	bool decrypt_error = false;
-	__be16 rs_datalen;
+	u16 rs_datalen;
 	bool is_phyerr;
 
 	if (skb->len < HTC_RX_FRAME_HEADER_SIZE) {

From d38bd0827a70c46317f2f954ea70a0cdb2f741b2 Mon Sep 17 00:00:00 2001
From: Evgeny Novikov <novikov@ispras.ru>
Date: Fri, 2 Oct 2020 18:01:55 +0300
Subject: [PATCH 0987/2658] usb: gadget: goku_udc: fix potential crashes in
 probe

[ Upstream commit 0d66e04875c5aae876cf3d4f4be7978fa2b00523 ]

goku_probe() goes to error label "err" and invokes goku_remove()
in case of failures of pci_enable_device(), pci_resource_start()
and ioremap(). goku_remove() gets a device from
pci_get_drvdata(pdev) and works with it without any checks, in
particular it dereferences a corresponding pointer. But
goku_probe() did not set this device yet. So, one can expect
various crashes. The patch moves setting the device just after
allocation of memory for it.

Found by Linux Driver Verification project (linuxtesting.org).

Reported-by: Pavel Andrianov <andrianov@ispras.ru>
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/goku_udc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/goku_udc.c b/drivers/usb/gadget/udc/goku_udc.c
index 1fdfec14a3ba..5d4616061309 100644
--- a/drivers/usb/gadget/udc/goku_udc.c
+++ b/drivers/usb/gadget/udc/goku_udc.c
@@ -1773,6 +1773,7 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		goto err;
 	}
 
+	pci_set_drvdata(pdev, dev);
 	spin_lock_init(&dev->lock);
 	dev->pdev = pdev;
 	dev->gadget.ops = &goku_ops;
@@ -1806,7 +1807,6 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	}
 	dev->regs = (struct goku_udc_regs __iomem *) base;
 
-	pci_set_drvdata(pdev, dev);
 	INFO(dev, "%s\n", driver_desc);
 	INFO(dev, "version: " DRIVER_VERSION " %s\n", dmastr());
 	INFO(dev, "irq %d, pci mem %p\n", pdev->irq, base);

From 70c5e00a3c4ed42307a61ac74f08767161ade547 Mon Sep 17 00:00:00 2001
From: Bob Peterson <rpeterso@redhat.com>
Date: Tue, 27 Oct 2020 10:10:01 -0500
Subject: [PATCH 0988/2658] gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix
 use-after-free

[ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ]

Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling
return_all_reservations, but return_all_reservations still dereferences
rgd->rd_bits in __rs_deltree.  Fix that by moving the call to kfree below the
call to return_all_reservations.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/rgrp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 2736e9cfc2ee..99dcbdc1ff3a 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -747,9 +747,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
 		}
 
 		gfs2_free_clones(rgd);
+		return_all_reservations(rgd);
 		kfree(rgd->rd_bits);
 		rgd->rd_bits = NULL;
-		return_all_reservations(rgd);
 		kmem_cache_free(gfs2_rgrpd_cachep, rgd);
 	}
 }

From ca174170716ee0b4cce61c56d61804c2d3253179 Mon Sep 17 00:00:00 2001
From: Bob Peterson <rpeterso@redhat.com>
Date: Wed, 28 Oct 2020 13:42:18 -0500
Subject: [PATCH 0989/2658] gfs2: check for live vs. read-only file system in
 gfs2_fitrim

[ Upstream commit c5c68724696e7d2f8db58a5fce3673208d35c485 ]

Before this patch, gfs2_fitrim was not properly checking for a "live" file
system. If the file system had something to trim and the file system
was read-only (or spectator) it would start the trim, but when it starts
the transaction, gfs2_trans_begin returns -EROFS (read-only file system)
and it errors out. However, if the file system was already trimmed so
there's no work to do, it never called gfs2_trans_begin. That code is
bypassed so it never returns the error. Instead, it returns a good
return code with 0 work. All this makes for inconsistent behavior:
The same fstrim command can return -EROFS in one case and 0 in another.
This tripped up xfstests generic/537 which reports the error as:

    +fstrim with unrecovered metadata just ate your filesystem

This patch adds a check for a "live" (iow, active journal, iow, RW)
file system, and if not, returns the error properly.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/rgrp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 99dcbdc1ff3a..faa5e0e2c449 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -1388,6 +1388,9 @@ int gfs2_fitrim(struct file *filp, void __user *argp)
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
+	if (!test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags))
+		return -EROFS;
+
 	if (!blk_queue_discard(q))
 		return -EOPNOTSUPP;
 

From 06af91add98d0d6d46bac7c0e39dcc1867ad29d9 Mon Sep 17 00:00:00 2001
From: Evan Quan <evan.quan@amd.com>
Date: Wed, 28 Oct 2020 15:29:59 +0800
Subject: [PATCH 0990/2658] drm/amdgpu: perform srbm soft reset always on SDMA
 resume

[ Upstream commit 253475c455eb5f8da34faa1af92709e7bb414624 ]

This can address the random SDMA hang after pci config reset
seen on Hawaii.

Signed-off-by: Evan Quan <evan.quan@amd.com>
Tested-by: Sandeep Raghuraman <sandy.8925@gmail.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/cik_sdma.c | 27 ++++++++++++---------------
 1 file changed, 12 insertions(+), 15 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
index c568293cb6c1..f1745c5cdf7b 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
@@ -1118,22 +1118,19 @@ static int cik_sdma_soft_reset(void *handle)
 {
 	u32 srbm_soft_reset = 0;
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-	u32 tmp = RREG32(mmSRBM_STATUS2);
+	u32 tmp;
 
-	if (tmp & SRBM_STATUS2__SDMA_BUSY_MASK) {
-		/* sdma0 */
-		tmp = RREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET);
-		tmp |= SDMA0_F32_CNTL__HALT_MASK;
-		WREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET, tmp);
-		srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA_MASK;
-	}
-	if (tmp & SRBM_STATUS2__SDMA1_BUSY_MASK) {
-		/* sdma1 */
-		tmp = RREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET);
-		tmp |= SDMA0_F32_CNTL__HALT_MASK;
-		WREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET, tmp);
-		srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA1_MASK;
-	}
+	/* sdma0 */
+	tmp = RREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET);
+	tmp |= SDMA0_F32_CNTL__HALT_MASK;
+	WREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET, tmp);
+	srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA_MASK;
+
+	/* sdma1 */
+	tmp = RREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET);
+	tmp |= SDMA0_F32_CNTL__HALT_MASK;
+	WREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET, tmp);
+	srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA1_MASK;
 
 	if (srbm_soft_reset) {
 		cik_sdma_print_status((void *)adev);

From 1500db02ff3401503e1a2b7512e376269b1e1b2d Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Fri, 9 Oct 2020 13:25:41 +0200
Subject: [PATCH 0991/2658] mac80211: fix use of skb payload instead of header

[ Upstream commit 14f46c1e5108696ec1e5a129e838ecedf108c7bf ]

When ieee80211_skb_resize() is called from ieee80211_build_hdr()
the skb has no 802.11 header yet, in fact it consist only of the
payload as the ethernet frame is removed. As such, we're using
the payload data for ieee80211_is_mgmt(), which is of course
completely wrong. This didn't really hurt us because these are
always data frames, so we could only have added more tailroom
than we needed if we determined it was a management frame and
sdata->crypto_tx_tailroom_needed_cnt was false.

However, syzbot found that of course there need not be any payload,
so we're using at best uninitialized memory for the check.

Fix this to pass explicitly the kind of frame that we have instead
of checking there, by replacing the "bool may_encrypt" argument
with an argument that can carry the three possible states - it's
not going to be encrypted, it's a management frame, or it's a data
frame (and then we check sdata->crypto_tx_tailroom_needed_cnt).

Reported-by: syzbot+32fd1a1bfe355e93f1e2@syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Link: https://lore.kernel.org/r/20201009132538.e1fd7f802947.I799b288466ea2815f9d4c84349fae697dca2f189@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/tx.c | 35 +++++++++++++++++++++++------------
 1 file changed, 23 insertions(+), 12 deletions(-)

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index cab8d35b2e0c..10d8425e9708 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1600,19 +1600,24 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
 
 /* device xmit handlers */
 
+enum ieee80211_encrypt {
+	ENCRYPT_NO,
+	ENCRYPT_MGMT,
+	ENCRYPT_DATA,
+};
+
 static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
 				struct sk_buff *skb,
-				int head_need, bool may_encrypt)
+				int head_need,
+				enum ieee80211_encrypt encrypt)
 {
 	struct ieee80211_local *local = sdata->local;
-	struct ieee80211_hdr *hdr;
 	bool enc_tailroom;
 	int tail_need = 0;
 
-	hdr = (struct ieee80211_hdr *) skb->data;
-	enc_tailroom = may_encrypt &&
-		       (sdata->crypto_tx_tailroom_needed_cnt ||
-			ieee80211_is_mgmt(hdr->frame_control));
+	enc_tailroom = encrypt == ENCRYPT_MGMT ||
+		       (encrypt == ENCRYPT_DATA &&
+			sdata->crypto_tx_tailroom_needed_cnt);
 
 	if (enc_tailroom) {
 		tail_need = IEEE80211_ENCRYPT_TAILROOM;
@@ -1645,21 +1650,27 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 	int headroom;
-	bool may_encrypt;
+	enum ieee80211_encrypt encrypt;
 
-	may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT);
+	if (info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)
+		encrypt = ENCRYPT_NO;
+	else if (ieee80211_is_mgmt(hdr->frame_control))
+		encrypt = ENCRYPT_MGMT;
+	else
+		encrypt = ENCRYPT_DATA;
 
 	headroom = local->tx_headroom;
-	if (may_encrypt)
+	if (encrypt != ENCRYPT_NO)
 		headroom += sdata->encrypt_headroom;
 	headroom -= skb_headroom(skb);
 	headroom = max_t(int, 0, headroom);
 
-	if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) {
+	if (ieee80211_skb_resize(sdata, skb, headroom, encrypt)) {
 		ieee80211_free_txskb(&local->hw, skb);
 		return;
 	}
 
+	/* reload after potential resize */
 	hdr = (struct ieee80211_hdr *) skb->data;
 	info->control.vif = &sdata->vif;
 
@@ -2352,7 +2363,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
 		head_need += sdata->encrypt_headroom;
 		head_need += local->tx_headroom;
 		head_need = max_t(int, 0, head_need);
-		if (ieee80211_skb_resize(sdata, skb, head_need, true)) {
+		if (ieee80211_skb_resize(sdata, skb, head_need, ENCRYPT_DATA)) {
 			ieee80211_free_txskb(&local->hw, skb);
 			skb = NULL;
 			return ERR_PTR(-ENOMEM);
@@ -2762,7 +2773,7 @@ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
 	if (unlikely(ieee80211_skb_resize(sdata, skb,
 					  max_t(int, extra_head + hw_headroom -
 						     skb_headroom(skb), 0),
-					  false))) {
+					  ENCRYPT_NO))) {
 		kfree_skb(skb);
 		return true;
 	}

From 70b48d796c716ad4fda159244ed50b290c0849ea Mon Sep 17 00:00:00 2001
From: Ye Bin <yebin10@huawei.com>
Date: Fri, 9 Oct 2020 15:02:15 +0800
Subject: [PATCH 0992/2658] cfg80211: regulatory: Fix inconsistent format
 argument

[ Upstream commit db18d20d1cb0fde16d518fb5ccd38679f174bc04 ]

Fix follow warning:
[net/wireless/reg.c:3619]: (warning) %d in format string (no. 2)
requires 'int' but the argument type is 'unsigned int'.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Ye Bin <yebin10@huawei.com>
Link: https://lore.kernel.org/r/20201009070215.63695-1-yebin10@huawei.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/wireless/reg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index edb3b64233e5..1e489471da79 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2822,7 +2822,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
 		power_rule = &reg_rule->power_rule;
 
 		if (reg_rule->flags & NL80211_RRF_AUTO_BW)
-			snprintf(bw, sizeof(bw), "%d KHz, %d KHz AUTO",
+			snprintf(bw, sizeof(bw), "%d KHz, %u KHz AUTO",
 				 freq_range->max_bandwidth_khz,
 				 reg_get_max_bandwidth(rd, reg_rule));
 		else

From d8260d76c8b7f6ccf2c7ee1ed6e23ccc4e21f0f7 Mon Sep 17 00:00:00 2001
From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Date: Thu, 15 Oct 2020 02:50:02 +0000
Subject: [PATCH 0993/2658] iommu/amd: Increase interrupt remapping table limit
 to 512 entries

[ Upstream commit 73db2fc595f358460ce32bcaa3be1f0cce4a2db1 ]

Certain device drivers allocate IO queues on a per-cpu basis.
On AMD EPYC platform, which can support up-to 256 cpu threads,
this can exceed the current MAX_IRQ_PER_TABLE limit of 256,
and result in the error message:

    AMD-Vi: Failed to allocate IRTE

This has been observed with certain NVME devices.

AMD IOMMU hardware can actually support upto 512 interrupt
remapping table entries. Therefore, update the driver to
match the hardware limit.

Please note that this also increases the size of interrupt remapping
table to 8KB per device when using the 128-bit IRTE format.

Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Link: https://lore.kernel.org/r/20201015025002.87997-1-suravee.suthikulpanit@amd.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/amd_iommu_types.h | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
index 695d4e235438..90832bf00538 100644
--- a/drivers/iommu/amd_iommu_types.h
+++ b/drivers/iommu/amd_iommu_types.h
@@ -351,7 +351,11 @@ extern bool amd_iommu_np_cache;
 /* Only true if all IOMMUs support device IOTLBs */
 extern bool amd_iommu_iotlb_sup;
 
-#define MAX_IRQS_PER_TABLE	256
+/*
+ * AMD IOMMU hardware only support 512 IRTEs despite
+ * the architectural limitation of 2048 entries.
+ */
+#define MAX_IRQS_PER_TABLE	512
 #define IRQ_TABLE_ALIGNMENT	128
 
 struct irq_remap_table {

From 5a203348c255e6c5b37d33c693ce95938184cf4a Mon Sep 17 00:00:00 2001
From: Christoph Hellwig <hch@lst.de>
Date: Wed, 11 Nov 2020 08:07:37 -0800
Subject: [PATCH 0994/2658] xfs: fix a missing unlock on error in
 xfs_fs_map_blocks

[ Upstream commit 2bd3fa793aaa7e98b74e3653fdcc72fa753913b5 ]

We also need to drop the iolock when invalidate_inode_pages2 fails, not
only on all other error or successful cases.

Fixes: 527851124d10 ("xfs: implement pNFS export operations")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/xfs_pnfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c
index dc6221942b85..ab66ea0a72bf 100644
--- a/fs/xfs/xfs_pnfs.c
+++ b/fs/xfs/xfs_pnfs.c
@@ -162,7 +162,7 @@ xfs_fs_map_blocks(
 		goto out_unlock;
 	error = invalidate_inode_pages2(inode->i_mapping);
 	if (WARN_ON_ONCE(error))
-		return error;
+		goto out_unlock;
 
 	end_fsb = XFS_B_TO_FSB(mp, (xfs_ufsize_t)offset + length);
 	offset_fsb = XFS_B_TO_FSBT(mp, offset);

From 8b3318790ed6df5ad6cdbbb162f5b54a21ccc589 Mon Sep 17 00:00:00 2001
From: Evan Nimmo <evan.nimmo@alliedtelesis.co.nz>
Date: Tue, 10 Nov 2020 15:28:25 +1300
Subject: [PATCH 0995/2658] of/address: Fix of_node memory leak in
 of_dma_is_coherent

[ Upstream commit a5bea04fcc0b3c0aec71ee1fd58fd4ff7ee36177 ]

Commit dabf6b36b83a ("of: Add OF_DMA_DEFAULT_COHERENT & select it on
powerpc") added a check to of_dma_is_coherent which returns early
if OF_DMA_DEFAULT_COHERENT is enabled. This results in the of_node_put()
being skipped causing a memory leak. Moved the of_node_get() below this
check so we now we only get the node if OF_DMA_DEFAULT_COHERENT is not
enabled.

Fixes: dabf6b36b83a ("of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc")
Signed-off-by: Evan Nimmo <evan.nimmo@alliedtelesis.co.nz>
Link: https://lore.kernel.org/r/20201110022825.30895-1-evan.nimmo@alliedtelesis.co.nz
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/of/address.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/of/address.c b/drivers/of/address.c
index 555d328cbd2c..f565eaf88acb 100644
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -1030,11 +1030,13 @@ EXPORT_SYMBOL_GPL(of_dma_get_range);
  */
 bool of_dma_is_coherent(struct device_node *np)
 {
-	struct device_node *node = of_node_get(np);
+	struct device_node *node;
 
 	if (IS_ENABLED(CONFIG_OF_DMA_DEFAULT_COHERENT))
 		return true;
 
+	node = of_node_get(np);
+
 	while (node) {
 		if (of_property_read_bool(node, "dma-coherent")) {
 			of_node_put(node);

From cd3588ef73d6ac639f26347bd2eb42a443a71284 Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38@huawei.com>
Date: Tue, 10 Nov 2020 22:46:14 +0800
Subject: [PATCH 0996/2658] cosa: Add missing kfree in error path of cosa_write

[ Upstream commit 52755b66ddcef2e897778fac5656df18817b59ab ]

If memory allocation for 'kbuf' succeed, cosa_write() doesn't have a
corresponding kfree() in exception handling. Thus add kfree() for this
function implementation.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Acked-by: Jan "Yenya" Kasprzak <kas@fi.muni.cz>
Link: https://lore.kernel.org/r/20201110144614.43194-1-wanghai38@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wan/cosa.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wan/cosa.c b/drivers/net/wan/cosa.c
index 848ea6a399f2..cbda69e58e08 100644
--- a/drivers/net/wan/cosa.c
+++ b/drivers/net/wan/cosa.c
@@ -903,6 +903,7 @@ static ssize_t cosa_write(struct file *file,
 			chan->tx_status = 1;
 			spin_unlock_irqrestore(&cosa->lock, flags);
 			up(&chan->wsem);
+			kfree(kbuf);
 			return -ERESTARTSYS;
 		}
 	}

From 7470aa7c87a2337903d1bea7f91aca7df826d934 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Fri, 30 Oct 2020 12:49:45 +0100
Subject: [PATCH 0997/2658] perf: Fix get_recursion_context()

[ Upstream commit ce0f17fc93f63ee91428af10b7b2ddef38cd19e5 ]

One should use in_serving_softirq() to detect SoftIRQ context.

Fixes: 96f6d4444302 ("perf_counter: avoid recursion")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20201030151955.120572175@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/events/internal.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/events/internal.h b/kernel/events/internal.h
index 2b229fdcfc09..7e59e583e1a3 100644
--- a/kernel/events/internal.h
+++ b/kernel/events/internal.h
@@ -192,7 +192,7 @@ static inline int get_recursion_context(int *recursion)
 		rctx = 3;
 	else if (in_irq())
 		rctx = 2;
-	else if (in_softirq())
+	else if (in_serving_softirq())
 		rctx = 1;
 	else
 		rctx = 0;

From 69ee9c5f13ffab06dc5ae05a26c37dbfaecac437 Mon Sep 17 00:00:00 2001
From: Kaixu Xia <kaixuxia@tencent.com>
Date: Thu, 29 Oct 2020 23:46:36 +0800
Subject: [PATCH 0998/2658] ext4: correctly report "not supported" for
 {usr,grp}jquota when !CONFIG_QUOTA

commit 174fe5ba2d1ea0d6c5ab2a7d4aa058d6d497ae4d upstream.

The macro MOPT_Q is used to indicates the mount option is related to
quota stuff and is defined to be MOPT_NOSUPPORT when CONFIG_QUOTA is
disabled.  Normally the quota options are handled explicitly, so it
didn't matter that the MOPT_STRING flag was missing, even though the
usrjquota and grpjquota mount options take a string argument.  It's
important that's present in the !CONFIG_QUOTA case, since without
MOPT_STRING, the mount option matcher will match usrjquota= followed
by an integer, and will otherwise skip the table entry, and so "mount
option not supported" error message is never reported.

[ Fixed up the commit description to better explain why the fix
  works. --TYT ]

Fixes: 26092bf52478 ("ext4: use a table-driven handler for mount options")
Signed-off-by: Kaixu Xia <kaixuxia@tencent.com>
Link: https://lore.kernel.org/r/1603986396-28917-1-git-send-email-kaixuxia@tencent.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/super.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index bf969fc0103e..92c6f445dd8d 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1447,8 +1447,8 @@ static const struct mount_opts {
 							MOPT_SET | MOPT_Q},
 	{Opt_noquota, (EXT4_MOUNT_QUOTA | EXT4_MOUNT_USRQUOTA |
 		       EXT4_MOUNT_GRPQUOTA), MOPT_CLEAR | MOPT_Q},
-	{Opt_usrjquota, 0, MOPT_Q},
-	{Opt_grpjquota, 0, MOPT_Q},
+	{Opt_usrjquota, 0, MOPT_Q | MOPT_STRING},
+	{Opt_grpjquota, 0, MOPT_Q | MOPT_STRING},
 	{Opt_offusrjquota, 0, MOPT_Q},
 	{Opt_offgrpjquota, 0, MOPT_Q},
 	{Opt_jqfmt_vfsold, QFMT_VFS_OLD, MOPT_QFMT},

From fdf3cac4af11ce862757643ba671c01588dd9394 Mon Sep 17 00:00:00 2001
From: Joseph Qi <joseph.qi@linux.alibaba.com>
Date: Tue, 3 Nov 2020 10:29:02 +0800
Subject: [PATCH 0999/2658] ext4: unlock xattr_sem properly in
 ext4_inline_data_truncate()

commit 7067b2619017d51e71686ca9756b454de0e5826a upstream.

It takes xattr_sem to check inline data again but without unlock it
in case not have. So unlock it before return.

Fixes: aef1c8513c1f ("ext4: let ext4_truncate handle inline data correctly")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Tao Ma <boyu.mt@taobao.com>
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Link: https://lore.kernel.org/r/1604370542-124630-1-git-send-email-joseph.qi@linux.alibaba.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/inline.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index f7ed5072436e..1016a8ddd3b0 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1904,6 +1904,7 @@ void ext4_inline_data_truncate(struct inode *inode, int *has_inline)
 
 	ext4_write_lock_xattr(inode, &no_expand);
 	if (!ext4_has_inline_data(inode)) {
+		ext4_write_unlock_xattr(inode, &no_expand);
 		*has_inline = 0;
 		ext4_journal_stop(handle);
 		return;

From d0691ecfd8094d9c9bfc6e936f315d7e490fe5ae Mon Sep 17 00:00:00 2001
From: Chris Brandt <chris.brandt@renesas.com>
Date: Wed, 11 Nov 2020 08:12:09 -0500
Subject: [PATCH 1000/2658] usb: cdc-acm: Add DISABLE_ECHO for Renesas USB
 Download mode

commit 6d853c9e4104b4fc8d55dc9cd3b99712aa347174 upstream.

Renesas R-Car and RZ/G SoCs have a firmware download mode over USB.
However, on reset a banner string is transmitted out which is not expected
to be echoed back and will corrupt the protocol.

Cc: stable <stable@vger.kernel.org>
Acked-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Chris Brandt <chris.brandt@renesas.com>
Link: https://lore.kernel.org/r/20201111131209.3977903-1-chris.brandt@renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/cdc-acm.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index fb7e56fad41c..a74a5c0eba6e 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1693,6 +1693,15 @@ static const struct usb_device_id acm_ids[] = {
 	{ USB_DEVICE(0x0870, 0x0001), /* Metricom GS Modem */
 	.driver_info = NO_UNION_NORMAL, /* has no union descriptor */
 	},
+	{ USB_DEVICE(0x045b, 0x023c),	/* Renesas USB Download mode */
+	.driver_info = DISABLE_ECHO,	/* Don't echo banner */
+	},
+	{ USB_DEVICE(0x045b, 0x0248),	/* Renesas USB Download mode */
+	.driver_info = DISABLE_ECHO,	/* Don't echo banner */
+	},
+	{ USB_DEVICE(0x045b, 0x024D),	/* Renesas USB Download mode */
+	.driver_info = DISABLE_ECHO,	/* Don't echo banner */
+	},
 	{ USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */
 	.driver_info = NO_UNION_NORMAL, /* has no union descriptor */
 	},

From 61e30f6385c54d50113a8130b3a1492d725f84b8 Mon Sep 17 00:00:00 2001
From: Alexander Usyskin <alexander.usyskin@intel.com>
Date: Thu, 29 Oct 2020 11:54:42 +0200
Subject: [PATCH 1001/2658] mei: protect mei_cl_mtu from null dereference

commit bcbc0b2e275f0a797de11a10eff495b4571863fc upstream.

A receive callback is queued while the client is still connected
but can still be called after the client was disconnected. Upon
disconnect cl->me_cl is set to NULL, hence we need to check
that ME client is not-NULL in mei_cl_mtu to avoid
null dereference.

Cc: <stable@vger.kernel.org>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20201029095444.957924-2-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/mei/client.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/misc/mei/client.h b/drivers/misc/mei/client.h
index 04e1aa39243f..993d8f3e51d4 100644
--- a/drivers/misc/mei/client.h
+++ b/drivers/misc/mei/client.h
@@ -156,11 +156,11 @@ static inline u8 mei_cl_me_id(const struct mei_cl *cl)
  *
  * @cl: host client
  *
- * Return: mtu
+ * Return: mtu or 0 if client is not connected
  */
 static inline size_t mei_cl_mtu(const struct mei_cl *cl)
 {
-	return cl->me_cl->props.max_msg_length;
+	return cl->me_cl ? cl->me_cl->props.max_msg_length : 0;
 }
 
 /**

From 473ae3da24fbecd2801db50ec26d61630fd01326 Mon Sep 17 00:00:00 2001
From: Wengang Wang <wen.gang.wang@oracle.com>
Date: Fri, 13 Nov 2020 22:52:23 -0800
Subject: [PATCH 1002/2658] ocfs2: initialize ip_next_orphan

commit f5785283dd64867a711ca1fb1f5bb172f252ecdf upstream.

Though problem if found on a lower 4.1.12 kernel, I think upstream has
same issue.

In one node in the cluster, there is the following callback trace:

   # cat /proc/21473/stack
   __ocfs2_cluster_lock.isra.36+0x336/0x9e0 [ocfs2]
   ocfs2_inode_lock_full_nested+0x121/0x520 [ocfs2]
   ocfs2_evict_inode+0x152/0x820 [ocfs2]
   evict+0xae/0x1a0
   iput+0x1c6/0x230
   ocfs2_orphan_filldir+0x5d/0x100 [ocfs2]
   ocfs2_dir_foreach_blk+0x490/0x4f0 [ocfs2]
   ocfs2_dir_foreach+0x29/0x30 [ocfs2]
   ocfs2_recover_orphans+0x1b6/0x9a0 [ocfs2]
   ocfs2_complete_recovery+0x1de/0x5c0 [ocfs2]
   process_one_work+0x169/0x4a0
   worker_thread+0x5b/0x560
   kthread+0xcb/0xf0
   ret_from_fork+0x61/0x90

The above stack is not reasonable, the final iput shouldn't happen in
ocfs2_orphan_filldir() function.  Looking at the code,

  2067         /* Skip inodes which are already added to recover list, since dio may
  2068          * happen concurrently with unlink/rename */
  2069         if (OCFS2_I(iter)->ip_next_orphan) {
  2070                 iput(iter);
  2071                 return 0;
  2072         }
  2073

The logic thinks the inode is already in recover list on seeing
ip_next_orphan is non-NULL, so it skip this inode after dropping a
reference which incremented in ocfs2_iget().

While, if the inode is already in recover list, it should have another
reference and the iput() at line 2070 should not be the final iput
(dropping the last reference).  So I don't think the inode is really in
the recover list (no vmcore to confirm).

Note that ocfs2_queue_orphans(), though not shown up in the call back
trace, is holding cluster lock on the orphan directory when looking up
for unlinked inodes.  The on disk inode eviction could involve a lot of
IOs which may need long time to finish.  That means this node could hold
the cluster lock for very long time, that can lead to the lock requests
(from other nodes) to the orhpan directory hang for long time.

Looking at more on ip_next_orphan, I found it's not initialized when
allocating a new ocfs2_inode_info structure.

This causes te reflink operations from some nodes hang for very long
time waiting for the cluster lock on the orphan directory.

Fix: initialize ip_next_orphan as NULL.

Signed-off-by: Wengang Wang <wen.gang.wang@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20201109171746.27884-1-wen.gang.wang@oracle.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/super.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index d97403bb3622..0ee1f088bace 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1751,6 +1751,7 @@ static void ocfs2_inode_init_once(void *data)
 
 	oi->ip_blkno = 0ULL;
 	oi->ip_clusters = 0;
+	oi->ip_next_orphan = NULL;
 
 	ocfs2_resv_init_once(&oi->ip_la_data_resv);
 

From 72995d7c8e859bca02cd36ba24fee92352da566b Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Wed, 28 Oct 2020 16:39:49 -0400
Subject: [PATCH 1003/2658] don't dump the threads that had been already
 exiting when zapped.

commit 77f6ab8b7768cf5e6bdd0e72499270a0671506ee upstream.

Coredump logics needs to report not only the registers of the dumping
thread, but (since 2.5.43) those of other threads getting killed.

Doing that might require extra state saved on the stack in asm glue at
kernel entry; signal delivery logics does that (we need to be able to
save sigcontext there, at the very least) and so does seccomp.

That covers all callers of do_coredump().  Secondary threads get hit with
SIGKILL and caught as soon as they reach exit_mm(), which normally happens
in signal delivery, so those are also fine most of the time.  Unfortunately,
it is possible to end up with secondary zapped when it has already entered
exit(2) (or, worse yet, is oopsing).  In those cases we reach exit_mm()
when mm->core_state is already set, but the stack contents is not what
we would have in signal delivery.

At least on two architectures (alpha and m68k) it leads to infoleaks - we
end up with a chunk of kernel stack written into coredump, with the contents
consisting of normal C stack frames of the call chain leading to exit_mm()
instead of the expected copy of userland registers.  In case of alpha we
leak 312 bytes of stack.  Other architectures (including the regset-using
ones) might have similar problems - the normal user of regsets is ptrace
and the state of tracee at the time of such calls is special in the same
way signal delivery is.

Note that had the zapper gotten to the exiting thread slightly later,
it wouldn't have been included into coredump anyway - we skip the threads
that have already cleared their ->mm.  So let's pretend that zapper always
loses the race.  IOW, have exit_mm() only insert into the dumper list if
we'd gotten there from handling a fatal signal[*]

As the result, the callers of do_exit() that have *not* gone through get_signal()
are not seen by coredump logics as secondary threads.  Which excludes voluntary
exit()/oopsen/traps/etc.  The dumper thread itself is unaffected by that,
so seccomp is fine.

[*] originally I intended to add a new flag in tsk->flags, but ebiederman pointed
out that PF_SIGNALED is already doing just what we need.

Cc: stable@vger.kernel.org
Fixes: d89f3847def4 ("[PATCH] thread-aware coredumps, 2.5.43-C3")
History-tree: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/exit.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernel/exit.c b/kernel/exit.c
index 01766cbd3fae..09e7723c7483 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -413,7 +413,10 @@ static void exit_mm(struct task_struct *tsk)
 		up_read(&mm->mmap_sem);
 
 		self.task = tsk;
-		self.next = xchg(&core_state->dumper.next, &self);
+		if (self.task->flags & PF_SIGNALED)
+			self.next = xchg(&core_state->dumper.next, &self);
+		else
+			self.task = NULL;
 		/*
 		 * Implies mb(), the result of xchg() must be visible
 		 * to core_state->dumper.

From 05d2dc76028ed615a1570d984a3a304e81396b1a Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Thu, 5 Nov 2020 20:02:56 +0100
Subject: [PATCH 1004/2658] drm/gma500: Fix out-of-bounds access to struct
 drm_device.vblank[]

commit 06ad8d339524bf94b89859047822c31df6ace239 upstream.

The gma500 driver expects 3 pipelines in several it's IRQ functions.
Accessing struct drm_device.vblank[], this fails with devices that only
have 2 pipelines. An example KASAN report is shown below.

  [   62.267688] ==================================================================
  [   62.268856] BUG: KASAN: slab-out-of-bounds in psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
  [   62.269450] Read of size 1 at addr ffff8880012bc6d0 by task systemd-udevd/285
  [   62.269949]
  [   62.270192] CPU: 0 PID: 285 Comm: systemd-udevd Tainted: G            E     5.10.0-rc1-1-default+ #572
  [   62.270807] Hardware name:  /DN2800MT, BIOS MTCDT10N.86A.0164.2012.1213.1024 12/13/2012
  [   62.271366] Call Trace:
  [   62.271705]  dump_stack+0xae/0xe5
  [   62.272180]  print_address_description.constprop.0+0x17/0xf0
  [   62.272987]  ? psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
  [   62.273474]  __kasan_report.cold+0x20/0x38
  [   62.273989]  ? psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
  [   62.274460]  kasan_report+0x3a/0x50
  [   62.274891]  psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
  [   62.275380]  drm_irq_install+0x131/0x1f0
  <...>
  [   62.300751] Allocated by task 285:
  [   62.301223]  kasan_save_stack+0x1b/0x40
  [   62.301731]  __kasan_kmalloc.constprop.0+0xbf/0xd0
  [   62.302293]  drmm_kmalloc+0x55/0x100
  [   62.302773]  drm_vblank_init+0x77/0x210

Resolve the issue by only handling vblank entries up to the number of
CRTCs.

I'm adding a Fixes tag for reference, although the bug has been present
since the driver's initial commit.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Fixes: 5c49fd3aa0ab ("gma500: Add the core DRM files and headers")
Cc: Alan Cox <alan@linux.intel.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Cc: dri-devel@lists.freedesktop.org
Cc: stable@vger.kernel.org#v3.3+
Link: https://patchwork.freedesktop.org/patch/msgid/20201105190256.3893-1-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/gma500/psb_irq.c | 34 +++++++++++---------------------
 1 file changed, 12 insertions(+), 22 deletions(-)

diff --git a/drivers/gpu/drm/gma500/psb_irq.c b/drivers/gpu/drm/gma500/psb_irq.c
index 78eb10902809..076b6da44f46 100644
--- a/drivers/gpu/drm/gma500/psb_irq.c
+++ b/drivers/gpu/drm/gma500/psb_irq.c
@@ -350,6 +350,7 @@ int psb_irq_postinstall(struct drm_device *dev)
 {
 	struct drm_psb_private *dev_priv = dev->dev_private;
 	unsigned long irqflags;
+	unsigned int i;
 
 	spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags);
 
@@ -362,20 +363,12 @@ int psb_irq_postinstall(struct drm_device *dev)
 	PSB_WVDC32(dev_priv->vdc_irq_mask, PSB_INT_ENABLE_R);
 	PSB_WVDC32(0xFFFFFFFF, PSB_HWSTAM);
 
-	if (dev->vblank[0].enabled)
-		psb_enable_pipestat(dev_priv, 0, PIPE_VBLANK_INTERRUPT_ENABLE);
-	else
-		psb_disable_pipestat(dev_priv, 0, PIPE_VBLANK_INTERRUPT_ENABLE);
-
-	if (dev->vblank[1].enabled)
-		psb_enable_pipestat(dev_priv, 1, PIPE_VBLANK_INTERRUPT_ENABLE);
-	else
-		psb_disable_pipestat(dev_priv, 1, PIPE_VBLANK_INTERRUPT_ENABLE);
-
-	if (dev->vblank[2].enabled)
-		psb_enable_pipestat(dev_priv, 2, PIPE_VBLANK_INTERRUPT_ENABLE);
-	else
-		psb_disable_pipestat(dev_priv, 2, PIPE_VBLANK_INTERRUPT_ENABLE);
+	for (i = 0; i < dev->num_crtcs; ++i) {
+		if (dev->vblank[i].enabled)
+			psb_enable_pipestat(dev_priv, i, PIPE_VBLANK_INTERRUPT_ENABLE);
+		else
+			psb_disable_pipestat(dev_priv, i, PIPE_VBLANK_INTERRUPT_ENABLE);
+	}
 
 	if (dev_priv->ops->hotplug_enable)
 		dev_priv->ops->hotplug_enable(dev, true);
@@ -388,6 +381,7 @@ void psb_irq_uninstall(struct drm_device *dev)
 {
 	struct drm_psb_private *dev_priv = dev->dev_private;
 	unsigned long irqflags;
+	unsigned int i;
 
 	spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags);
 
@@ -396,14 +390,10 @@ void psb_irq_uninstall(struct drm_device *dev)
 
 	PSB_WVDC32(0xFFFFFFFF, PSB_HWSTAM);
 
-	if (dev->vblank[0].enabled)
-		psb_disable_pipestat(dev_priv, 0, PIPE_VBLANK_INTERRUPT_ENABLE);
-
-	if (dev->vblank[1].enabled)
-		psb_disable_pipestat(dev_priv, 1, PIPE_VBLANK_INTERRUPT_ENABLE);
-
-	if (dev->vblank[2].enabled)
-		psb_disable_pipestat(dev_priv, 2, PIPE_VBLANK_INTERRUPT_ENABLE);
+	for (i = 0; i < dev->num_crtcs; ++i) {
+		if (dev->vblank[i].enabled)
+			psb_disable_pipestat(dev_priv, i, PIPE_VBLANK_INTERRUPT_ENABLE);
+	}
 
 	dev_priv->vdc_irq_mask &= _PSB_IRQ_SGX_FLAG |
 				  _PSB_IRQ_MSVDX_FLAG |

From b95117c4d09a86b56a3597ec36e463527597931a Mon Sep 17 00:00:00 2001
From: Coiby Xu <coiby.xu@gmail.com>
Date: Fri, 6 Nov 2020 07:19:10 +0800
Subject: [PATCH 1005/2658] pinctrl: amd: use higher precision for 512 RtcClk

commit c64a6a0d4a928c63e5bc3b485552a8903a506c36 upstream.

RTC is 32.768kHz thus 512 RtcClk equals 15625 usec. The documentation
likely has dropped precision and that's why the driver mistakenly took
the slightly deviated value.

Cc: stable@vger.kernel.org
Reported-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Suggested-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Suggested-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/linux-gpio/2f4706a1-502f-75f0-9596-cc25b4933b6c@redhat.com/
Link: https://lore.kernel.org/r/20201105231912.69527-3-coiby.xu@gmail.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pinctrl/pinctrl-amd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
index 7340ff78839a..3ebc41baa350 100644
--- a/drivers/pinctrl/pinctrl-amd.c
+++ b/drivers/pinctrl/pinctrl-amd.c
@@ -144,7 +144,7 @@ static int amd_gpio_set_debounce(struct gpio_chip *gc, unsigned offset,
 			pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF);
 			pin_reg &= ~BIT(DB_TMR_LARGE_OFF);
 		} else if (debounce < 250000) {
-			time = debounce / 15600;
+			time = debounce / 15625;
 			pin_reg |= time & DB_TMR_OUT_MASK;
 			pin_reg &= ~BIT(DB_TMR_OUT_UNIT_OFF);
 			pin_reg |= BIT(DB_TMR_LARGE_OFF);

From 2dafdff9a505ea3d3486d747813e23b36c74aed7 Mon Sep 17 00:00:00 2001
From: Coiby Xu <coiby.xu@gmail.com>
Date: Fri, 6 Nov 2020 07:19:09 +0800
Subject: [PATCH 1006/2658] pinctrl: amd: fix incorrect way to disable debounce
 filter

commit 06abe8291bc31839950f7d0362d9979edc88a666 upstream.

The correct way to disable debounce filter is to clear bit 5 and 6
of the register.

Cc: stable@vger.kerne.org
Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Cc: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/linux-gpio/df2c008b-e7b5-4fdd-42ea-4d1c62b52139@redhat.com/
Link: https://lore.kernel.org/r/20201105231912.69527-2-coiby.xu@gmail.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pinctrl/pinctrl-amd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
index 3ebc41baa350..a3b27856b9e9 100644
--- a/drivers/pinctrl/pinctrl-amd.c
+++ b/drivers/pinctrl/pinctrl-amd.c
@@ -154,14 +154,14 @@ static int amd_gpio_set_debounce(struct gpio_chip *gc, unsigned offset,
 			pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF);
 			pin_reg |= BIT(DB_TMR_LARGE_OFF);
 		} else {
-			pin_reg &= ~DB_CNTRl_MASK;
+			pin_reg &= ~(DB_CNTRl_MASK << DB_CNTRL_OFF);
 			ret = -EINVAL;
 		}
 	} else {
 		pin_reg &= ~BIT(DB_TMR_OUT_UNIT_OFF);
 		pin_reg &= ~BIT(DB_TMR_LARGE_OFF);
 		pin_reg &= ~DB_TMR_OUT_MASK;
-		pin_reg &= ~DB_CNTRl_MASK;
+		pin_reg &= ~(DB_CNTRl_MASK << DB_CNTRL_OFF);
 	}
 	writel(pin_reg, gpio_dev->base + offset * 4);
 	spin_unlock_irqrestore(&gpio_dev->lock, flags);

From 8756af6c799e6025493b1dadb1f0eb6231157464 Mon Sep 17 00:00:00 2001
From: Stefano Stabellini <stefano.stabellini@xilinx.com>
Date: Mon, 26 Oct 2020 17:02:14 -0700
Subject: [PATCH 1007/2658] swiotlb: fix "x86: Don't panic if can not alloc
 buffer for swiotlb"

commit e9696d259d0fb5d239e8c28ca41089838ea76d13 upstream.

kernel/dma/swiotlb.c:swiotlb_init gets called first and tries to
allocate a buffer for the swiotlb. It does so by calling

  memblock_alloc_low(PAGE_ALIGN(bytes), PAGE_SIZE);

If the allocation must fail, no_iotlb_memory is set.

Later during initialization swiotlb-xen comes in
(drivers/xen/swiotlb-xen.c:xen_swiotlb_init) and given that io_tlb_start
is != 0, it thinks the memory is ready to use when actually it is not.

When the swiotlb is actually needed, swiotlb_tbl_map_single gets called
and since no_iotlb_memory is set the kernel panics.

Instead, if swiotlb-xen.c:xen_swiotlb_init knew the swiotlb hadn't been
initialized, it would do the initialization itself, which might still
succeed.

Fix the panic by setting io_tlb_start to 0 on swiotlb initialization
failure, and also by setting no_iotlb_memory to false on swiotlb
initialization success.

Fixes: ac2cbab21f31 ("x86: Don't panic if can not alloc buffer for swiotlb")

Reported-by: Elliott Mitchell <ehem+xen@m5p.com>
Tested-by: Elliott Mitchell <ehem+xen@m5p.com>
Signed-off-by: Stefano Stabellini <stefano.stabellini@xilinx.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/swiotlb.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index 6bc452b33b76..7ccc45c3fdd7 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -195,6 +195,7 @@ int __init swiotlb_init_with_tbl(char *tlb, unsigned long nslabs, int verbose)
 		io_tlb_orig_addr[i] = INVALID_PHYS_ADDR;
 	}
 	io_tlb_index = 0;
+	no_iotlb_memory = false;
 
 	if (verbose)
 		swiotlb_print_info();
@@ -225,9 +226,11 @@ swiotlb_init(int verbose)
 	if (vstart && !swiotlb_init_with_tbl(vstart, io_tlb_nslabs, verbose))
 		return;
 
-	if (io_tlb_start)
+	if (io_tlb_start) {
 		memblock_free_early(io_tlb_start,
 				    PAGE_ALIGN(io_tlb_nslabs << IO_TLB_SHIFT));
+		io_tlb_start = 0;
+	}
 	pr_warn("Cannot allocate buffer");
 	no_iotlb_memory = true;
 }
@@ -326,6 +329,7 @@ swiotlb_late_init_with_tbl(char *tlb, unsigned long nslabs)
 		io_tlb_orig_addr[i] = INVALID_PHYS_ADDR;
 	}
 	io_tlb_index = 0;
+	no_iotlb_memory = false;
 
 	swiotlb_print_info();
 

From 83cd9d3498368fa5651f88df94c452899a4dcd40 Mon Sep 17 00:00:00 2001
From: Oliver Herms <oliver.peter.herms@gmail.com>
Date: Tue, 3 Nov 2020 11:41:33 +0100
Subject: [PATCH 1008/2658] IPv6: Set SIT tunnel hard_header_len to zero

[ Upstream commit 8ef9ba4d666614497a057d09b0a6eafc1e34eadf ]

Due to the legacy usage of hard_header_len for SIT tunnels while
already using infrastructure from net/ipv4/ip_tunnel.c the
calculation of the path MTU in tnl_update_pmtu is incorrect.
This leads to unnecessary creation of MTU exceptions for any
flow going over a SIT tunnel.

As SIT tunnels do not have a header themsevles other than their
transport (L3, L2) headers we're leaving hard_header_len set to zero
as tnl_update_pmtu is already taking care of the transport headers
sizes.

This will also help avoiding unnecessary IPv6 GC runs and spinlock
contention seen when using SIT tunnels and for more than
net.ipv6.route.gc_thresh flows.

Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.")
Signed-off-by: Oliver Herms <oliver.peter.herms@gmail.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/r/20201103104133.GA1573211@tws
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/sit.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 5039486c4f86..8bab7e64ffcf 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1079,7 +1079,6 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
 	if (tdev && !netif_is_l3_master(tdev)) {
 		int t_hlen = tunnel->hlen + sizeof(struct iphdr);
 
-		dev->hard_header_len = tdev->hard_header_len + sizeof(struct iphdr);
 		dev->mtu = tdev->mtu - t_hlen;
 		if (dev->mtu < IPV6_MIN_MTU)
 			dev->mtu = IPV6_MIN_MTU;
@@ -1371,7 +1370,6 @@ static void ipip6_tunnel_setup(struct net_device *dev)
 	dev->destructor		= ipip6_dev_free;
 
 	dev->type		= ARPHRD_SIT;
-	dev->hard_header_len	= LL_MAX_HEADER + t_hlen;
 	dev->mtu		= ETH_DATA_LEN - t_hlen;
 	dev->flags		= IFF_NOARP;
 	netif_keep_dst(dev);

From 993000028286902361b0349f183e4f8adb3f33b6 Mon Sep 17 00:00:00 2001
From: Ursula Braun <ubraun@linux.ibm.com>
Date: Mon, 9 Nov 2020 08:57:05 +0100
Subject: [PATCH 1009/2658] net/af_iucv: fix null pointer dereference on
 shutdown

[ Upstream commit 4031eeafa71eaf22ae40a15606a134ae86345daf ]

syzbot reported the following KASAN finding:

BUG: KASAN: nullptr-dereference in iucv_send_ctrl+0x390/0x3f0 net/iucv/af_iucv.c:385
Read of size 2 at addr 000000000000021e by task syz-executor907/519

CPU: 0 PID: 519 Comm: syz-executor907 Not tainted 5.9.0-syzkaller-07043-gbcf9877ad213 #0
Hardware name: IBM 3906 M04 701 (KVM/Linux)
Call Trace:
 [<00000000c576af60>] unwind_start arch/s390/include/asm/unwind.h:65 [inline]
 [<00000000c576af60>] show_stack+0x180/0x228 arch/s390/kernel/dumpstack.c:135
 [<00000000c9dcd1f8>] __dump_stack lib/dump_stack.c:77 [inline]
 [<00000000c9dcd1f8>] dump_stack+0x268/0x2f0 lib/dump_stack.c:118
 [<00000000c5fed016>] print_address_description.constprop.0+0x5e/0x218 mm/kasan/report.c:383
 [<00000000c5fec82a>] __kasan_report mm/kasan/report.c:517 [inline]
 [<00000000c5fec82a>] kasan_report+0x11a/0x168 mm/kasan/report.c:534
 [<00000000c98b5b60>] iucv_send_ctrl+0x390/0x3f0 net/iucv/af_iucv.c:385
 [<00000000c98b6262>] iucv_sock_shutdown+0x44a/0x4c0 net/iucv/af_iucv.c:1457
 [<00000000c89d3a54>] __sys_shutdown+0x12c/0x1c8 net/socket.c:2204
 [<00000000c89d3b70>] __do_sys_shutdown net/socket.c:2212 [inline]
 [<00000000c89d3b70>] __s390x_sys_shutdown+0x38/0x48 net/socket.c:2210
 [<00000000c9e36eac>] system_call+0xe0/0x28c arch/s390/kernel/entry.S:415

There is nothing to shutdown if a connection has never been established.
Besides that iucv->hs_dev is not yet initialized if a socket is in
IUCV_OPEN state and iucv->path is not yet initialized if socket is in
IUCV_BOUND state.
So, just skip the shutdown calls for a socket in these states.

Fixes: eac3731bd04c ("[S390]: Add AF_IUCV socket support")
Fixes: 82492a355fac ("af_iucv: add shutdown for HS transport")
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
[jwi: correct one Fixes tag]
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/iucv/af_iucv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 3edffb7bf2a4..f94107e27b5e 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1513,7 +1513,8 @@ static int iucv_sock_shutdown(struct socket *sock, int how)
 		break;
 	}
 
-	if (how == SEND_SHUTDOWN || how == SHUTDOWN_MASK) {
+	if ((how == SEND_SHUTDOWN || how == SHUTDOWN_MASK) &&
+	    sk->sk_state == IUCV_CONNECTED) {
 		if (iucv->transport == AF_IUCV_TRANS_IUCV) {
 			txmsg.class = 0;
 			txmsg.tag = 0;

From e30135568729adf9a87d63ee301cc740c8ac0eee Mon Sep 17 00:00:00 2001
From: Martin Schiller <ms@dev.tdt.de>
Date: Mon, 9 Nov 2020 07:54:49 +0100
Subject: [PATCH 1010/2658] net/x25: Fix null-ptr-deref in x25_connect

[ Upstream commit 361182308766a265b6c521879b34302617a8c209 ]

This fixes a regression for blocking connects introduced by commit
4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect").

The x25->neighbour is already set to "NULL" by x25_disconnect() now,
while a blocking connect is waiting in
x25_wait_for_connection_establishment(). Therefore x25->neighbour must
not be accessed here again and x25->state is also already set to
X25_STATE_0 by x25_disconnect().

Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect")
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
Reviewed-by: Xie He <xie.he.0141@gmail.com>
Link: https://lore.kernel.org/r/20201109065449.9014-1-ms@dev.tdt.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/x25/af_x25.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index f9fb8613fb28..e39bb38eedf3 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -823,7 +823,7 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
 	sock->state = SS_CONNECTED;
 	rc = 0;
 out_put_neigh:
-	if (rc) {
+	if (rc && x25->neighbour) {
 		read_lock_bh(&x25_list_lock);
 		x25_neigh_put(x25->neighbour);
 		x25->neighbour = NULL;

From c4cff37d30040535597e2c68554406ad442d72a0 Mon Sep 17 00:00:00 2001
From: Mao Wenan <wenan.mao@linux.alibaba.com>
Date: Tue, 10 Nov 2020 08:16:31 +0800
Subject: [PATCH 1011/2658] net: Update window_clamp if SOCK_RCVBUF is set

[ Upstream commit 909172a149749242990a6e64cb55d55460d4e417 ]

When net.ipv4.tcp_syncookies=1 and syn flood is happened,
cookie_v4_check or cookie_v6_check tries to redo what
tcp_v4_send_synack or tcp_v6_send_synack did,
rsk_window_clamp will be changed if SOCK_RCVBUF is set,
which will make rcv_wscale is different, the client
still operates with initial window scale and can overshot
granted window, the client use the initial scale but local
server use new scale to advertise window value, and session
work abnormally.

Fixes: e88c64f0a425 ("tcp: allow effective reduction of TCP's rcv-buffer via setsockopt")
Signed-off-by: Mao Wenan <wenan.mao@linux.alibaba.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/1604967391-123737-1-git-send-email-wenan.mao@linux.alibaba.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/syncookies.c |  9 +++++++--
 net/ipv6/syncookies.c | 10 ++++++++--
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 4cebe913a0b3..ba0301860985 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -307,7 +307,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
 	__u32 cookie = ntohl(th->ack_seq) - 1;
 	struct sock *ret = sk;
 	struct request_sock *req;
-	int mss;
+	int full_space, mss;
 	struct rtable *rt;
 	__u8 rcv_wscale;
 	struct flowi4 fl4;
@@ -391,8 +391,13 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
 
 	/* Try to redo what tcp_v4_send_synack did. */
 	req->rsk_window_clamp = tp->window_clamp ? :dst_metric(&rt->dst, RTAX_WINDOW);
+	/* limit the window selection if the user enforce a smaller rx buffer */
+	full_space = tcp_full_space(sk);
+	if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
+	    (req->rsk_window_clamp > full_space || req->rsk_window_clamp == 0))
+		req->rsk_window_clamp = full_space;
 
-	tcp_select_initial_window(tcp_full_space(sk), req->mss,
+	tcp_select_initial_window(full_space, req->mss,
 				  &req->rsk_rcv_wnd, &req->rsk_window_clamp,
 				  ireq->wscale_ok, &rcv_wscale,
 				  dst_metric(&rt->dst, RTAX_INITRWND));
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 7f3667635431..cc80f97c598c 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -144,7 +144,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 	__u32 cookie = ntohl(th->ack_seq) - 1;
 	struct sock *ret = sk;
 	struct request_sock *req;
-	int mss;
+	int full_space, mss;
 	struct dst_entry *dst;
 	__u8 rcv_wscale;
 
@@ -238,7 +238,13 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 	}
 
 	req->rsk_window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
-	tcp_select_initial_window(tcp_full_space(sk), req->mss,
+	/* limit the window selection if the user enforce a smaller rx buffer */
+	full_space = tcp_full_space(sk);
+	if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
+	    (req->rsk_window_clamp > full_space || req->rsk_window_clamp == 0))
+		req->rsk_window_clamp = full_space;
+
+	tcp_select_initial_window(full_space, req->mss,
 				  &req->rsk_rcv_wnd, &req->rsk_window_clamp,
 				  ireq->wscale_ok, &rcv_wscale,
 				  dst_metric(dst, RTAX_INITRWND));

From e9862ffc39fc27dca7fd1a322d9295bbd0b14edf Mon Sep 17 00:00:00 2001
From: George Spelvin <lkml@sdf.org>
Date: Sun, 9 Aug 2020 06:57:44 +0000
Subject: [PATCH 1012/2658] random32: make prandom_u32() output unpredictable

commit c51f8f88d705e06bd696d7510aff22b33eb8e638 upstream.

Non-cryptographic PRNGs may have great statistical properties, but
are usually trivially predictable to someone who knows the algorithm,
given a small sample of their output.  An LFSR like prandom_u32() is
particularly simple, even if the sample is widely scattered bits.

It turns out the network stack uses prandom_u32() for some things like
random port numbers which it would prefer are *not* trivially predictable.
Predictability led to a practical DNS spoofing attack.  Oops.

This patch replaces the LFSR with a homebrew cryptographic PRNG based
on the SipHash round function, which is in turn seeded with 128 bits
of strong random key.  (The authors of SipHash have *not* been consulted
about this abuse of their algorithm.)  Speed is prioritized over security;
attacks are rare, while performance is always wanted.

Replacing all callers of prandom_u32() is the quick fix.
Whether to reinstate a weaker PRNG for uses which can tolerate it
is an open question.

Commit f227e3ec3b5c ("random32: update the net random state on interrupt
and activity") was an earlier attempt at a solution.  This patch replaces
it.

Reported-by: Amit Klein <aksecurity@gmail.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: Eric Dumazet <edumazet@google.com>
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: tytso@mit.edu
Cc: Florian Westphal <fw@strlen.de>
Cc: Marc Plumb <lkml.mplumb@gmail.com>
Fixes: f227e3ec3b5c ("random32: update the net random state on interrupt and activity")
Signed-off-by: George Spelvin <lkml@sdf.org>
Link: https://lore.kernel.org/netdev/20200808152628.GA27941@SDF.ORG/
[ willy: partial reversal of f227e3ec3b5c; moved SIPROUND definitions
  to prandom.h for later use; merged George's prandom_seed() proposal;
  inlined siprand_u32(); replaced the net_rand_state[] array with 4
  members to fix a build issue; cosmetic cleanups to make checkpatch
  happy; fixed RANDOM32_SELFTEST build ]
[wt: backported to 4.4 -- no latent_entropy, drop prandom_reseed_late]
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/char/random.c   |   2 -
 include/linux/prandom.h |  36 +++-
 kernel/time/timer.c     |   7 -
 lib/random32.c          | 463 ++++++++++++++++++++++++----------------
 4 files changed, 317 insertions(+), 191 deletions(-)

diff --git a/drivers/char/random.c b/drivers/char/random.c
index 7bb1e423eb19..08d96d58f1f2 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -678,7 +678,6 @@ static void credit_entropy_bits(struct entropy_store *r, int nbits)
 		r->initialized = 1;
 		r->entropy_total = 0;
 		if (r == &nonblocking_pool) {
-			prandom_reseed_late();
 			process_random_ready_list();
 			wake_up_all(&urandom_init_wait);
 			pr_notice("random: %s pool is initialized\n", r->name);
@@ -923,7 +922,6 @@ void add_interrupt_randomness(int irq, int irq_flags)
 
 	fast_mix(fast_pool);
 	add_interrupt_bench(cycles);
-	this_cpu_add(net_rand_state.s1, fast_pool->pool[cycles & 3]);
 
 	if ((fast_pool->count < 64) &&
 	    !time_after(now, fast_pool->last + HZ))
diff --git a/include/linux/prandom.h b/include/linux/prandom.h
index aa16e6468f91..cc1e71334e53 100644
--- a/include/linux/prandom.h
+++ b/include/linux/prandom.h
@@ -16,12 +16,44 @@ void prandom_bytes(void *buf, size_t nbytes);
 void prandom_seed(u32 seed);
 void prandom_reseed_late(void);
 
+#if BITS_PER_LONG == 64
+/*
+ * The core SipHash round function.  Each line can be executed in
+ * parallel given enough CPU resources.
+ */
+#define PRND_SIPROUND(v0, v1, v2, v3) ( \
+	v0 += v1, v1 = rol64(v1, 13),  v2 += v3, v3 = rol64(v3, 16), \
+	v1 ^= v0, v0 = rol64(v0, 32),  v3 ^= v2,                     \
+	v0 += v3, v3 = rol64(v3, 21),  v2 += v1, v1 = rol64(v1, 17), \
+	v3 ^= v0,                      v1 ^= v2, v2 = rol64(v2, 32)  \
+)
+
+#define PRND_K0 (0x736f6d6570736575 ^ 0x6c7967656e657261)
+#define PRND_K1 (0x646f72616e646f6d ^ 0x7465646279746573)
+
+#elif BITS_PER_LONG == 32
+/*
+ * On 32-bit machines, we use HSipHash, a reduced-width version of SipHash.
+ * This is weaker, but 32-bit machines are not used for high-traffic
+ * applications, so there is less output for an attacker to analyze.
+ */
+#define PRND_SIPROUND(v0, v1, v2, v3) ( \
+	v0 += v1, v1 = rol32(v1,  5),  v2 += v3, v3 = rol32(v3,  8), \
+	v1 ^= v0, v0 = rol32(v0, 16),  v3 ^= v2,                     \
+	v0 += v3, v3 = rol32(v3,  7),  v2 += v1, v1 = rol32(v1, 13), \
+	v3 ^= v0,                      v1 ^= v2, v2 = rol32(v2, 16)  \
+)
+#define PRND_K0 0x6c796765
+#define PRND_K1 0x74656462
+
+#else
+#error Unsupported BITS_PER_LONG
+#endif
+
 struct rnd_state {
 	__u32 s1, s2, s3, s4;
 };
 
-DECLARE_PER_CPU(struct rnd_state, net_rand_state);
-
 u32 prandom_u32_state(struct rnd_state *state);
 void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes);
 void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state);
diff --git a/kernel/time/timer.c b/kernel/time/timer.c
index 539070e3ae3a..67646a316436 100644
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -1470,13 +1470,6 @@ void update_process_times(int user_tick)
 #endif
 	scheduler_tick();
 	run_posix_cpu_timers(p);
-
-	/* The current CPU might make use of net randoms without receiving IRQs
-	 * to renew them often enough. Let's update the net_rand_state from a
-	 * non-constant value that's not affine to the number of calls to make
-	 * sure it's updated when there's some activity (we don't care in idle).
-	 */
-	this_cpu_add(net_rand_state.s1, rol32(jiffies, 24) + user_tick);
 }
 
 /*
diff --git a/lib/random32.c b/lib/random32.c
index 8072ccd9eed5..17e5780eebd7 100644
--- a/lib/random32.c
+++ b/lib/random32.c
@@ -39,16 +39,6 @@
 #include <linux/sched.h>
 #include <asm/unaligned.h>
 
-#ifdef CONFIG_RANDOM32_SELFTEST
-static void __init prandom_state_selftest(void);
-#else
-static inline void prandom_state_selftest(void)
-{
-}
-#endif
-
-DEFINE_PER_CPU(struct rnd_state, net_rand_state);
-
 /**
  *	prandom_u32_state - seeded pseudo-random number generator.
  *	@state: pointer to state structure holding seeded state.
@@ -68,25 +58,6 @@ u32 prandom_u32_state(struct rnd_state *state)
 }
 EXPORT_SYMBOL(prandom_u32_state);
 
-/**
- *	prandom_u32 - pseudo random number generator
- *
- *	A 32 bit pseudo-random number is generated using a fast
- *	algorithm suitable for simulation. This algorithm is NOT
- *	considered safe for cryptographic use.
- */
-u32 prandom_u32(void)
-{
-	struct rnd_state *state = &get_cpu_var(net_rand_state);
-	u32 res;
-
-	res = prandom_u32_state(state);
-	put_cpu_var(state);
-
-	return res;
-}
-EXPORT_SYMBOL(prandom_u32);
-
 /**
  *	prandom_bytes_state - get the requested number of pseudo-random bytes
  *
@@ -118,20 +89,6 @@ void prandom_bytes_state(struct rnd_state *state, void *buf, size_t bytes)
 }
 EXPORT_SYMBOL(prandom_bytes_state);
 
-/**
- *	prandom_bytes - get the requested number of pseudo-random bytes
- *	@buf: where to copy the pseudo-random bytes to
- *	@bytes: the requested number of bytes
- */
-void prandom_bytes(void *buf, size_t bytes)
-{
-	struct rnd_state *state = &get_cpu_var(net_rand_state);
-
-	prandom_bytes_state(state, buf, bytes);
-	put_cpu_var(state);
-}
-EXPORT_SYMBOL(prandom_bytes);
-
 static void prandom_warmup(struct rnd_state *state)
 {
 	/* Calling RNG ten times to satisfy recurrence condition */
@@ -147,97 +104,6 @@ static void prandom_warmup(struct rnd_state *state)
 	prandom_u32_state(state);
 }
 
-static u32 __extract_hwseed(void)
-{
-	unsigned int val = 0;
-
-	(void)(arch_get_random_seed_int(&val) ||
-	       arch_get_random_int(&val));
-
-	return val;
-}
-
-static void prandom_seed_early(struct rnd_state *state, u32 seed,
-			       bool mix_with_hwseed)
-{
-#define LCG(x)	 ((x) * 69069U)	/* super-duper LCG */
-#define HWSEED() (mix_with_hwseed ? __extract_hwseed() : 0)
-	state->s1 = __seed(HWSEED() ^ LCG(seed),        2U);
-	state->s2 = __seed(HWSEED() ^ LCG(state->s1),   8U);
-	state->s3 = __seed(HWSEED() ^ LCG(state->s2),  16U);
-	state->s4 = __seed(HWSEED() ^ LCG(state->s3), 128U);
-}
-
-/**
- *	prandom_seed - add entropy to pseudo random number generator
- *	@seed: seed value
- *
- *	Add some additional seeding to the prandom pool.
- */
-void prandom_seed(u32 entropy)
-{
-	int i;
-	/*
-	 * No locking on the CPUs, but then somewhat random results are, well,
-	 * expected.
-	 */
-	for_each_possible_cpu(i) {
-		struct rnd_state *state = &per_cpu(net_rand_state, i);
-
-		state->s1 = __seed(state->s1 ^ entropy, 2U);
-		prandom_warmup(state);
-	}
-}
-EXPORT_SYMBOL(prandom_seed);
-
-/*
- *	Generate some initially weak seeding values to allow
- *	to start the prandom_u32() engine.
- */
-static int __init prandom_init(void)
-{
-	int i;
-
-	prandom_state_selftest();
-
-	for_each_possible_cpu(i) {
-		struct rnd_state *state = &per_cpu(net_rand_state, i);
-		u32 weak_seed = (i + jiffies) ^ random_get_entropy();
-
-		prandom_seed_early(state, weak_seed, true);
-		prandom_warmup(state);
-	}
-
-	return 0;
-}
-core_initcall(prandom_init);
-
-static void __prandom_timer(unsigned long dontcare);
-
-static DEFINE_TIMER(seed_timer, __prandom_timer, 0, 0);
-
-static void __prandom_timer(unsigned long dontcare)
-{
-	u32 entropy;
-	unsigned long expires;
-
-	get_random_bytes(&entropy, sizeof(entropy));
-	prandom_seed(entropy);
-
-	/* reseed every ~60 seconds, in [40 .. 80) interval with slack */
-	expires = 40 + prandom_u32_max(40);
-	seed_timer.expires = jiffies + msecs_to_jiffies(expires * MSEC_PER_SEC);
-
-	add_timer(&seed_timer);
-}
-
-static void __init __prandom_start_seed_timer(void)
-{
-	set_timer_slack(&seed_timer, HZ);
-	seed_timer.expires = jiffies + msecs_to_jiffies(40 * MSEC_PER_SEC);
-	add_timer(&seed_timer);
-}
-
 void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state)
 {
 	int i;
@@ -256,51 +122,6 @@ void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state)
 	}
 }
 
-/*
- *	Generate better values after random number generator
- *	is fully initialized.
- */
-static void __prandom_reseed(bool late)
-{
-	unsigned long flags;
-	static bool latch = false;
-	static DEFINE_SPINLOCK(lock);
-
-	/* Asking for random bytes might result in bytes getting
-	 * moved into the nonblocking pool and thus marking it
-	 * as initialized. In this case we would double back into
-	 * this function and attempt to do a late reseed.
-	 * Ignore the pointless attempt to reseed again if we're
-	 * already waiting for bytes when the nonblocking pool
-	 * got initialized.
-	 */
-
-	/* only allow initial seeding (late == false) once */
-	if (!spin_trylock_irqsave(&lock, flags))
-		return;
-
-	if (latch && !late)
-		goto out;
-
-	latch = true;
-	prandom_seed_full_state(&net_rand_state);
-out:
-	spin_unlock_irqrestore(&lock, flags);
-}
-
-void prandom_reseed_late(void)
-{
-	__prandom_reseed(true);
-}
-
-static int __init prandom_reseed(void)
-{
-	__prandom_reseed(false);
-	__prandom_start_seed_timer();
-	return 0;
-}
-late_initcall(prandom_reseed);
-
 #ifdef CONFIG_RANDOM32_SELFTEST
 static struct prandom_test1 {
 	u32 seed;
@@ -420,7 +241,28 @@ static struct prandom_test2 {
 	{  407983964U, 921U,  728767059U },
 };
 
-static void __init prandom_state_selftest(void)
+static u32 __extract_hwseed(void)
+{
+	unsigned int val = 0;
+
+	(void)(arch_get_random_seed_int(&val) ||
+	       arch_get_random_int(&val));
+
+	return val;
+}
+
+static void prandom_seed_early(struct rnd_state *state, u32 seed,
+			       bool mix_with_hwseed)
+{
+#define LCG(x)	 ((x) * 69069U)	/* super-duper LCG */
+#define HWSEED() (mix_with_hwseed ? __extract_hwseed() : 0)
+	state->s1 = __seed(HWSEED() ^ LCG(seed),        2U);
+	state->s2 = __seed(HWSEED() ^ LCG(state->s1),   8U);
+	state->s3 = __seed(HWSEED() ^ LCG(state->s2),  16U);
+	state->s4 = __seed(HWSEED() ^ LCG(state->s3), 128U);
+}
+
+static int __init prandom_state_selftest(void)
 {
 	int i, j, errors = 0, runs = 0;
 	bool error = false;
@@ -460,5 +302,266 @@ static void __init prandom_state_selftest(void)
 		pr_warn("prandom: %d/%d self tests failed\n", errors, runs);
 	else
 		pr_info("prandom: %d self tests passed\n", runs);
+	return 0;
 }
+core_initcall(prandom_state_selftest);
 #endif
+
+/*
+ * The prandom_u32() implementation is now completely separate from the
+ * prandom_state() functions, which are retained (for now) for compatibility.
+ *
+ * Because of (ab)use in the networking code for choosing random TCP/UDP port
+ * numbers, which open DoS possibilities if guessable, we want something
+ * stronger than a standard PRNG.  But the performance requirements of
+ * the network code do not allow robust crypto for this application.
+ *
+ * So this is a homebrew Junior Spaceman implementation, based on the
+ * lowest-latency trustworthy crypto primitive available, SipHash.
+ * (The authors of SipHash have not been consulted about this abuse of
+ * their work.)
+ *
+ * Standard SipHash-2-4 uses 2n+4 rounds to hash n words of input to
+ * one word of output.  This abbreviated version uses 2 rounds per word
+ * of output.
+ */
+
+struct siprand_state {
+	unsigned long v0;
+	unsigned long v1;
+	unsigned long v2;
+	unsigned long v3;
+};
+
+static DEFINE_PER_CPU(struct siprand_state, net_rand_state);
+
+/*
+ * This is the core CPRNG function.  As "pseudorandom", this is not used
+ * for truly valuable things, just intended to be a PITA to guess.
+ * For maximum speed, we do just two SipHash rounds per word.  This is
+ * the same rate as 4 rounds per 64 bits that SipHash normally uses,
+ * so hopefully it's reasonably secure.
+ *
+ * There are two changes from the official SipHash finalization:
+ * - We omit some constants XORed with v2 in the SipHash spec as irrelevant;
+ *   they are there only to make the output rounds distinct from the input
+ *   rounds, and this application has no input rounds.
+ * - Rather than returning v0^v1^v2^v3, return v1+v3.
+ *   If you look at the SipHash round, the last operation on v3 is
+ *   "v3 ^= v0", so "v0 ^ v3" just undoes that, a waste of time.
+ *   Likewise "v1 ^= v2".  (The rotate of v2 makes a difference, but
+ *   it still cancels out half of the bits in v2 for no benefit.)
+ *   Second, since the last combining operation was xor, continue the
+ *   pattern of alternating xor/add for a tiny bit of extra non-linearity.
+ */
+static inline u32 siprand_u32(struct siprand_state *s)
+{
+	unsigned long v0 = s->v0, v1 = s->v1, v2 = s->v2, v3 = s->v3;
+
+	PRND_SIPROUND(v0, v1, v2, v3);
+	PRND_SIPROUND(v0, v1, v2, v3);
+	s->v0 = v0;  s->v1 = v1;  s->v2 = v2;  s->v3 = v3;
+	return v1 + v3;
+}
+
+
+/**
+ *	prandom_u32 - pseudo random number generator
+ *
+ *	A 32 bit pseudo-random number is generated using a fast
+ *	algorithm suitable for simulation. This algorithm is NOT
+ *	considered safe for cryptographic use.
+ */
+u32 prandom_u32(void)
+{
+	struct siprand_state *state = get_cpu_ptr(&net_rand_state);
+	u32 res = siprand_u32(state);
+
+	put_cpu_ptr(&net_rand_state);
+	return res;
+}
+EXPORT_SYMBOL(prandom_u32);
+
+/**
+ *	prandom_bytes - get the requested number of pseudo-random bytes
+ *	@buf: where to copy the pseudo-random bytes to
+ *	@bytes: the requested number of bytes
+ */
+void prandom_bytes(void *buf, size_t bytes)
+{
+	struct siprand_state *state = get_cpu_ptr(&net_rand_state);
+	u8 *ptr = buf;
+
+	while (bytes >= sizeof(u32)) {
+		put_unaligned(siprand_u32(state), (u32 *)ptr);
+		ptr += sizeof(u32);
+		bytes -= sizeof(u32);
+	}
+
+	if (bytes > 0) {
+		u32 rem = siprand_u32(state);
+
+		do {
+			*ptr++ = (u8)rem;
+			rem >>= BITS_PER_BYTE;
+		} while (--bytes > 0);
+	}
+	put_cpu_ptr(&net_rand_state);
+}
+EXPORT_SYMBOL(prandom_bytes);
+
+/**
+ *	prandom_seed - add entropy to pseudo random number generator
+ *	@entropy: entropy value
+ *
+ *	Add some additional seed material to the prandom pool.
+ *	The "entropy" is actually our IP address (the only caller is
+ *	the network code), not for unpredictability, but to ensure that
+ *	different machines are initialized differently.
+ */
+void prandom_seed(u32 entropy)
+{
+	int i;
+
+	add_device_randomness(&entropy, sizeof(entropy));
+
+	for_each_possible_cpu(i) {
+		struct siprand_state *state = per_cpu_ptr(&net_rand_state, i);
+		unsigned long v0 = state->v0, v1 = state->v1;
+		unsigned long v2 = state->v2, v3 = state->v3;
+
+		do {
+			v3 ^= entropy;
+			PRND_SIPROUND(v0, v1, v2, v3);
+			PRND_SIPROUND(v0, v1, v2, v3);
+			v0 ^= entropy;
+		} while (unlikely(!v0 || !v1 || !v2 || !v3));
+
+		WRITE_ONCE(state->v0, v0);
+		WRITE_ONCE(state->v1, v1);
+		WRITE_ONCE(state->v2, v2);
+		WRITE_ONCE(state->v3, v3);
+	}
+}
+EXPORT_SYMBOL(prandom_seed);
+
+/*
+ *	Generate some initially weak seeding values to allow
+ *	the prandom_u32() engine to be started.
+ */
+static int __init prandom_init_early(void)
+{
+	int i;
+	unsigned long v0, v1, v2, v3;
+
+	if (!arch_get_random_long(&v0))
+		v0 = jiffies;
+	if (!arch_get_random_long(&v1))
+		v1 = random_get_entropy();
+	v2 = v0 ^ PRND_K0;
+	v3 = v1 ^ PRND_K1;
+
+	for_each_possible_cpu(i) {
+		struct siprand_state *state;
+
+		v3 ^= i;
+		PRND_SIPROUND(v0, v1, v2, v3);
+		PRND_SIPROUND(v0, v1, v2, v3);
+		v0 ^= i;
+
+		state = per_cpu_ptr(&net_rand_state, i);
+		state->v0 = v0;  state->v1 = v1;
+		state->v2 = v2;  state->v3 = v3;
+	}
+
+	return 0;
+}
+core_initcall(prandom_init_early);
+
+
+/* Stronger reseeding when available, and periodically thereafter. */
+static void prandom_reseed(unsigned long dontcare);
+
+static DEFINE_TIMER(seed_timer, prandom_reseed, 0, 0);
+
+static void prandom_reseed(unsigned long dontcare)
+{
+	unsigned long expires;
+	int i;
+
+	/*
+	 * Reinitialize each CPU's PRNG with 128 bits of key.
+	 * No locking on the CPUs, but then somewhat random results are,
+	 * well, expected.
+	 */
+	for_each_possible_cpu(i) {
+		struct siprand_state *state;
+		unsigned long v0 = get_random_long(), v2 = v0 ^ PRND_K0;
+		unsigned long v1 = get_random_long(), v3 = v1 ^ PRND_K1;
+#if BITS_PER_LONG == 32
+		int j;
+
+		/*
+		 * On 32-bit machines, hash in two extra words to
+		 * approximate 128-bit key length.  Not that the hash
+		 * has that much security, but this prevents a trivial
+		 * 64-bit brute force.
+		 */
+		for (j = 0; j < 2; j++) {
+			unsigned long m = get_random_long();
+
+			v3 ^= m;
+			PRND_SIPROUND(v0, v1, v2, v3);
+			PRND_SIPROUND(v0, v1, v2, v3);
+			v0 ^= m;
+		}
+#endif
+		/*
+		 * Probably impossible in practice, but there is a
+		 * theoretical risk that a race between this reseeding
+		 * and the target CPU writing its state back could
+		 * create the all-zero SipHash fixed point.
+		 *
+		 * To ensure that never happens, ensure the state
+		 * we write contains no zero words.
+		 */
+		state = per_cpu_ptr(&net_rand_state, i);
+		WRITE_ONCE(state->v0, v0 ? v0 : -1ul);
+		WRITE_ONCE(state->v1, v1 ? v1 : -1ul);
+		WRITE_ONCE(state->v2, v2 ? v2 : -1ul);
+		WRITE_ONCE(state->v3, v3 ? v3 : -1ul);
+	}
+
+	/* reseed every ~60 seconds, in [40 .. 80) interval with slack */
+	expires = round_jiffies(jiffies + 40 * HZ + prandom_u32_max(40 * HZ));
+	mod_timer(&seed_timer, expires);
+}
+
+/*
+ * The random ready callback can be called from almost any interrupt.
+ * To avoid worrying about whether it's safe to delay that interrupt
+ * long enough to seed all CPUs, just schedule an immediate timer event.
+ */
+static void prandom_timer_start(struct random_ready_callback *unused)
+{
+	mod_timer(&seed_timer, jiffies);
+}
+
+/*
+ * Start periodic full reseeding as soon as strong
+ * random numbers are available.
+ */
+static int __init prandom_init_late(void)
+{
+	static struct random_ready_callback random_ready = {
+		.func = prandom_timer_start
+	};
+	int ret = add_random_ready_callback(&random_ready);
+
+	if (ret == -EALREADY) {
+		prandom_timer_start(&random_ready);
+		ret = 0;
+	}
+	return ret;
+}
+late_initcall(prandom_init_late);

From ccb073d523ce3179c3f3f0fd12c7548256cadb51 Mon Sep 17 00:00:00 2001
From: Anand K Mistry <amistry@google.com>
Date: Thu, 5 Nov 2020 16:33:04 +1100
Subject: [PATCH 1013/2658] x86/speculation: Allow IBPB to be conditionally
 enabled on CPUs with always-on STIBP

commit 1978b3a53a74e3230cd46932b149c6e62e832e9a upstream.

On AMD CPUs which have the feature X86_FEATURE_AMD_STIBP_ALWAYS_ON,
STIBP is set to on and

  spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED

At the same time, IBPB can be set to conditional.

However, this leads to the case where it's impossible to turn on IBPB
for a process because in the PR_SPEC_DISABLE case in ib_prctl_set() the

  spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED

condition leads to a return before the task flag is set. Similarly,
ib_prctl_get() will return PR_SPEC_DISABLE even though IBPB is set to
conditional.

More generally, the following cases are possible:

1. STIBP = conditional && IBPB = on for spectre_v2_user=seccomp,ibpb
2. STIBP = on && IBPB = conditional for AMD CPUs with
   X86_FEATURE_AMD_STIBP_ALWAYS_ON

The first case functions correctly today, but only because
spectre_v2_user_ibpb isn't updated to reflect the IBPB mode.

At a high level, this change does one thing. If either STIBP or IBPB
is set to conditional, allow the prctl to change the task flag.
Also, reflect that capability when querying the state. This isn't
perfect since it doesn't take into account if only STIBP or IBPB is
unconditionally on. But it allows the conditional feature to work as
expected, without affecting the unconditional one.

 [ bp: Massage commit message and comment; space out statements for
   better readability. ]

Fixes: 21998a351512 ("x86/speculation: Avoid force-disabling IBPB based on STIBP and enhanced IBRS.")
Signed-off-by: Anand K Mistry <amistry@google.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
Link: https://lkml.kernel.org/r/20201105163246.v2.1.Ifd7243cd3e2c2206a893ad0a5b9a4f19549e22c6@changeid
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/cpu/bugs.c | 52 ++++++++++++++++++++++++--------------
 1 file changed, 33 insertions(+), 19 deletions(-)

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 2d2631f9a519..2c9a2992863b 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1223,6 +1223,14 @@ static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
 	return 0;
 }
 
+static bool is_spec_ib_user_controlled(void)
+{
+	return spectre_v2_user_ibpb == SPECTRE_V2_USER_PRCTL ||
+		spectre_v2_user_ibpb == SPECTRE_V2_USER_SECCOMP ||
+		spectre_v2_user_stibp == SPECTRE_V2_USER_PRCTL ||
+		spectre_v2_user_stibp == SPECTRE_V2_USER_SECCOMP;
+}
+
 static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)
 {
 	switch (ctrl) {
@@ -1230,17 +1238,26 @@ static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)
 		if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE &&
 		    spectre_v2_user_stibp == SPECTRE_V2_USER_NONE)
 			return 0;
-		/*
-		 * Indirect branch speculation is always disabled in strict
-		 * mode. It can neither be enabled if it was force-disabled
-		 * by a  previous prctl call.
 
+		/*
+		 * With strict mode for both IBPB and STIBP, the instruction
+		 * code paths avoid checking this task flag and instead,
+		 * unconditionally run the instruction. However, STIBP and IBPB
+		 * are independent and either can be set to conditionally
+		 * enabled regardless of the mode of the other.
+		 *
+		 * If either is set to conditional, allow the task flag to be
+		 * updated, unless it was force-disabled by a previous prctl
+		 * call. Currently, this is possible on an AMD CPU which has the
+		 * feature X86_FEATURE_AMD_STIBP_ALWAYS_ON. In this case, if the
+		 * kernel is booted with 'spectre_v2_user=seccomp', then
+		 * spectre_v2_user_ibpb == SPECTRE_V2_USER_SECCOMP and
+		 * spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED.
 		 */
-		if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT ||
-		    spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT ||
-		    spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED ||
+		if (!is_spec_ib_user_controlled() ||
 		    task_spec_ib_force_disable(task))
 			return -EPERM;
+
 		task_clear_spec_ib_disable(task);
 		task_update_spec_tif(task);
 		break;
@@ -1253,10 +1270,10 @@ static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)
 		if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE &&
 		    spectre_v2_user_stibp == SPECTRE_V2_USER_NONE)
 			return -EPERM;
-		if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT ||
-		    spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT ||
-		    spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED)
+
+		if (!is_spec_ib_user_controlled())
 			return 0;
+
 		task_set_spec_ib_disable(task);
 		if (ctrl == PR_SPEC_FORCE_DISABLE)
 			task_set_spec_ib_force_disable(task);
@@ -1319,20 +1336,17 @@ static int ib_prctl_get(struct task_struct *task)
 	if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE &&
 	    spectre_v2_user_stibp == SPECTRE_V2_USER_NONE)
 		return PR_SPEC_ENABLE;
-	else if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT ||
-	    spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT ||
-	    spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED)
-		return PR_SPEC_DISABLE;
-	else if (spectre_v2_user_ibpb == SPECTRE_V2_USER_PRCTL ||
-	    spectre_v2_user_ibpb == SPECTRE_V2_USER_SECCOMP ||
-	    spectre_v2_user_stibp == SPECTRE_V2_USER_PRCTL ||
-	    spectre_v2_user_stibp == SPECTRE_V2_USER_SECCOMP) {
+	else if (is_spec_ib_user_controlled()) {
 		if (task_spec_ib_force_disable(task))
 			return PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE;
 		if (task_spec_ib_disable(task))
 			return PR_SPEC_PRCTL | PR_SPEC_DISABLE;
 		return PR_SPEC_PRCTL | PR_SPEC_ENABLE;
-	} else
+	} else if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT ||
+	    spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT ||
+	    spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED)
+		return PR_SPEC_DISABLE;
+	else
 		return PR_SPEC_NOT_AFFECTED;
 }
 

From 099124ebdf361e25989e70fd2aae8349a1a77d59 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 3 Nov 2020 17:22:27 +0100
Subject: [PATCH 1014/2658] xen/events: avoid removing an event channel while
 handling it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 073d0552ead5bfc7a3a9c01de590e924f11b5dd2 upstream.

Today it can happen that an event channel is being removed from the
system while the event handling loop is active. This can lead to a
race resulting in crashes or WARN() splats when trying to access the
irq_info structure related to the event channel.

Fix this problem by using a rwlock taken as reader in the event
handling loop and as writer when deallocating the irq_info structure.

As the observed problem was a NULL dereference in evtchn_from_irq()
make this function more robust against races by testing the irq_info
pointer to be not NULL before dereferencing it.

And finally make all accesses to evtchn_to_irq[row][col] atomic ones
in order to avoid seeing partial updates of an array element in irq
handling. Note that irq handling can be entered only for event channels
which have been valid before, so any not populated row isn't a problem
in this regard, as rows are only ever added and never removed.

This is XSA-331.

Cc: stable@vger.kernel.org
Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Reported-by: Jinoh Kang <luke1337@theori.io>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Wei Liu <wl@xen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/events/events_base.c | 40 ++++++++++++++++++++++++++++----
 1 file changed, 35 insertions(+), 5 deletions(-)

diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 9a126732d5d9..6308d4fdf41d 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -32,6 +32,7 @@
 #include <linux/slab.h>
 #include <linux/irqnr.h>
 #include <linux/pci.h>
+#include <linux/spinlock.h>
 
 #ifdef CONFIG_X86
 #include <asm/desc.h>
@@ -70,6 +71,23 @@ const struct evtchn_ops *evtchn_ops;
  */
 static DEFINE_MUTEX(irq_mapping_update_lock);
 
+/*
+ * Lock protecting event handling loop against removing event channels.
+ * Adding of event channels is no issue as the associated IRQ becomes active
+ * only after everything is setup (before request_[threaded_]irq() the handler
+ * can't be entered for an event, as the event channel will be unmasked only
+ * then).
+ */
+static DEFINE_RWLOCK(evtchn_rwlock);
+
+/*
+ * Lock hierarchy:
+ *
+ * irq_mapping_update_lock
+ *   evtchn_rwlock
+ *     IRQ-desc lock
+ */
+
 static LIST_HEAD(xen_irq_list_head);
 
 /* IRQ <-> VIRQ mapping. */
@@ -104,7 +122,7 @@ static void clear_evtchn_to_irq_row(unsigned row)
 	unsigned col;
 
 	for (col = 0; col < EVTCHN_PER_ROW; col++)
-		evtchn_to_irq[row][col] = -1;
+		WRITE_ONCE(evtchn_to_irq[row][col], -1);
 }
 
 static void clear_evtchn_to_irq_all(void)
@@ -141,7 +159,7 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq)
 		clear_evtchn_to_irq_row(row);
 	}
 
-	evtchn_to_irq[row][col] = irq;
+	WRITE_ONCE(evtchn_to_irq[row][col], irq);
 	return 0;
 }
 
@@ -151,7 +169,7 @@ int get_evtchn_to_irq(unsigned evtchn)
 		return -1;
 	if (evtchn_to_irq[EVTCHN_ROW(evtchn)] == NULL)
 		return -1;
-	return evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)];
+	return READ_ONCE(evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)]);
 }
 
 /* Get info for IRQ */
@@ -260,10 +278,14 @@ static void xen_irq_info_cleanup(struct irq_info *info)
  */
 unsigned int evtchn_from_irq(unsigned irq)
 {
-	if (unlikely(WARN(irq >= nr_irqs, "Invalid irq %d!\n", irq)))
+	const struct irq_info *info = NULL;
+
+	if (likely(irq < nr_irqs))
+		info = info_for_irq(irq);
+	if (!info)
 		return 0;
 
-	return info_for_irq(irq)->evtchn;
+	return info->evtchn;
 }
 
 unsigned irq_from_evtchn(unsigned int evtchn)
@@ -447,16 +469,21 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi)
 static void xen_free_irq(unsigned irq)
 {
 	struct irq_info *info = info_for_irq(irq);
+	unsigned long flags;
 
 	if (WARN_ON(!info))
 		return;
 
+	write_lock_irqsave(&evtchn_rwlock, flags);
+
 	list_del(&info->list);
 
 	set_info_for_irq(irq, NULL);
 
 	WARN_ON(info->refcnt > 0);
 
+	write_unlock_irqrestore(&evtchn_rwlock, flags);
+
 	kfree(info);
 
 	/* Legacy IRQ descriptors are managed by the arch. */
@@ -1241,6 +1268,8 @@ static void __xen_evtchn_do_upcall(void)
 	int cpu = get_cpu();
 	unsigned count;
 
+	read_lock(&evtchn_rwlock);
+
 	do {
 		vcpu_info->evtchn_upcall_pending = 0;
 
@@ -1256,6 +1285,7 @@ static void __xen_evtchn_do_upcall(void)
 	} while (count != 1 || vcpu_info->evtchn_upcall_pending);
 
 out:
+	read_unlock(&evtchn_rwlock);
 
 	put_cpu();
 }

From b240a924c9eea23f35915747072e2ef849ec23da Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 3 Nov 2020 17:22:28 +0100
Subject: [PATCH 1015/2658] xen/events: add a proper barrier to 2-level uevent
 unmasking

commit 4d3fe31bd993ef504350989786858aefdb877daa upstream.

A follow-up patch will require certain write to happen before an event
channel is unmasked.

While the memory barrier is not strictly necessary for all the callers,
the main one will need it. In order to avoid an extra memory barrier
when using fifo event channels, mandate evtchn_unmask() to provide
write ordering.

The 2-level event handling unmask operation is missing an appropriate
barrier, so add it. Fifo event channels are fine in this regard due to
using sync_cmpxchg().

This is part of XSA-332.

Cc: stable@vger.kernel.org
Suggested-by: Julien Grall <julien@xen.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
Reviewed-by: Wei Liu <wl@xen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/events/events_2l.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/xen/events/events_2l.c b/drivers/xen/events/events_2l.c
index 7dd46312c180..04d1b025b29d 100644
--- a/drivers/xen/events/events_2l.c
+++ b/drivers/xen/events/events_2l.c
@@ -90,6 +90,8 @@ static void evtchn_2l_unmask(unsigned port)
 
 	BUG_ON(!irqs_disabled());
 
+	smp_wmb();	/* All writes before unmask must be visible. */
+
 	if (unlikely((cpu != cpu_from_evtchn(port))))
 		do_hypercall = 1;
 	else {

From f100a95cb5fd3a6169c6bb93d77572e8f9b94ba5 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 3 Nov 2020 17:22:29 +0100
Subject: [PATCH 1016/2658] xen/events: fix race in evtchn_fifo_unmask()

commit f01337197419b7e8a492e83089552b77d3b5fb90 upstream.

Unmasking a fifo event channel can result in unmasking it twice, once
directly in the kernel and once via a hypercall in case the event was
pending.

Fix that by doing the local unmask only if the event is not pending.

This is part of XSA-332.

Cc: stable@vger.kernel.org
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/events/events_fifo.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/xen/events/events_fifo.c b/drivers/xen/events/events_fifo.c
index 96a1b8da5371..ce909d830973 100644
--- a/drivers/xen/events/events_fifo.c
+++ b/drivers/xen/events/events_fifo.c
@@ -227,19 +227,25 @@ static bool evtchn_fifo_is_masked(unsigned port)
 	return sync_test_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word));
 }
 /*
- * Clear MASKED, spinning if BUSY is set.
+ * Clear MASKED if not PENDING, spinning if BUSY is set.
+ * Return true if mask was cleared.
  */
-static void clear_masked(volatile event_word_t *word)
+static bool clear_masked_cond(volatile event_word_t *word)
 {
 	event_word_t new, old, w;
 
 	w = *word;
 
 	do {
+		if (w & (1 << EVTCHN_FIFO_PENDING))
+			return false;
+
 		old = w & ~(1 << EVTCHN_FIFO_BUSY);
 		new = old & ~(1 << EVTCHN_FIFO_MASKED);
 		w = sync_cmpxchg(word, old, new);
 	} while (w != old);
+
+	return true;
 }
 
 static void evtchn_fifo_unmask(unsigned port)
@@ -248,8 +254,7 @@ static void evtchn_fifo_unmask(unsigned port)
 
 	BUG_ON(!irqs_disabled());
 
-	clear_masked(word);
-	if (evtchn_fifo_is_pending(port)) {
+	if (!clear_masked_cond(word)) {
 		struct evtchn_unmask unmask = { .port = port };
 		(void)HYPERVISOR_event_channel_op(EVTCHNOP_unmask, &unmask);
 	}

From c0c8afdd7629c07890d82a61e76b7b8869a8f853 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 3 Nov 2020 17:22:30 +0100
Subject: [PATCH 1017/2658] xen/events: add a new "late EOI" evtchn framework

commit 54c9de89895e0a36047fcc4ae754ea5b8655fb9d upstream.

In order to avoid tight event channel related IRQ loops add a new
framework of "late EOI" handling: the IRQ the event channel is bound
to will be masked until the event has been handled and the related
driver is capable to handle another event. The driver is responsible
for unmasking the event channel via the new function xen_irq_lateeoi().

This is similar to binding an event channel to a threaded IRQ, but
without having to structure the driver accordingly.

In order to support a future special handling in case a rogue guest
is sending lots of unsolicited events, add a flag to xen_irq_lateeoi()
which can be set by the caller to indicate the event was a spurious
one.

This is part of XSA-332.

Cc: stable@vger.kernel.org
Reported-by: Julien Grall <julien@xen.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Wei Liu <wl@xen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/events/events_base.c | 151 +++++++++++++++++++++++++++----
 include/xen/events.h             |  29 +++++-
 2 files changed, 159 insertions(+), 21 deletions(-)

diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 6308d4fdf41d..fe01950ef78c 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -112,6 +112,7 @@ static bool (*pirq_needs_eoi)(unsigned irq);
 static struct irq_info *legacy_info_ptrs[NR_IRQS_LEGACY];
 
 static struct irq_chip xen_dynamic_chip;
+static struct irq_chip xen_lateeoi_chip;
 static struct irq_chip xen_percpu_chip;
 static struct irq_chip xen_pirq_chip;
 static void enable_dynirq(struct irq_data *data);
@@ -404,6 +405,33 @@ void notify_remote_via_irq(int irq)
 }
 EXPORT_SYMBOL_GPL(notify_remote_via_irq);
 
+static void xen_irq_lateeoi_locked(struct irq_info *info)
+{
+	evtchn_port_t evtchn;
+
+	evtchn = info->evtchn;
+	if (!VALID_EVTCHN(evtchn))
+		return;
+
+	unmask_evtchn(evtchn);
+}
+
+void xen_irq_lateeoi(unsigned int irq, unsigned int eoi_flags)
+{
+	struct irq_info *info;
+	unsigned long flags;
+
+	read_lock_irqsave(&evtchn_rwlock, flags);
+
+	info = info_for_irq(irq);
+
+	if (info)
+		xen_irq_lateeoi_locked(info);
+
+	read_unlock_irqrestore(&evtchn_rwlock, flags);
+}
+EXPORT_SYMBOL_GPL(xen_irq_lateeoi);
+
 static void xen_irq_init(unsigned irq)
 {
 	struct irq_info *info;
@@ -875,7 +903,7 @@ int xen_pirq_from_irq(unsigned irq)
 }
 EXPORT_SYMBOL_GPL(xen_pirq_from_irq);
 
-int bind_evtchn_to_irq(unsigned int evtchn)
+static int bind_evtchn_to_irq_chip(evtchn_port_t evtchn, struct irq_chip *chip)
 {
 	int irq;
 	int ret;
@@ -892,7 +920,7 @@ int bind_evtchn_to_irq(unsigned int evtchn)
 		if (irq < 0)
 			goto out;
 
-		irq_set_chip_and_handler_name(irq, &xen_dynamic_chip,
+		irq_set_chip_and_handler_name(irq, chip,
 					      handle_edge_irq, "event");
 
 		ret = xen_irq_info_evtchn_setup(irq, evtchn);
@@ -913,8 +941,19 @@ int bind_evtchn_to_irq(unsigned int evtchn)
 
 	return irq;
 }
+
+int bind_evtchn_to_irq(evtchn_port_t evtchn)
+{
+	return bind_evtchn_to_irq_chip(evtchn, &xen_dynamic_chip);
+}
 EXPORT_SYMBOL_GPL(bind_evtchn_to_irq);
 
+int bind_evtchn_to_irq_lateeoi(evtchn_port_t evtchn)
+{
+	return bind_evtchn_to_irq_chip(evtchn, &xen_lateeoi_chip);
+}
+EXPORT_SYMBOL_GPL(bind_evtchn_to_irq_lateeoi);
+
 static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu)
 {
 	struct evtchn_bind_ipi bind_ipi;
@@ -956,8 +995,9 @@ static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu)
 	return irq;
 }
 
-int bind_interdomain_evtchn_to_irq(unsigned int remote_domain,
-				   unsigned int remote_port)
+static int bind_interdomain_evtchn_to_irq_chip(unsigned int remote_domain,
+					       evtchn_port_t remote_port,
+					       struct irq_chip *chip)
 {
 	struct evtchn_bind_interdomain bind_interdomain;
 	int err;
@@ -968,10 +1008,26 @@ int bind_interdomain_evtchn_to_irq(unsigned int remote_domain,
 	err = HYPERVISOR_event_channel_op(EVTCHNOP_bind_interdomain,
 					  &bind_interdomain);
 
-	return err ? : bind_evtchn_to_irq(bind_interdomain.local_port);
+	return err ? : bind_evtchn_to_irq_chip(bind_interdomain.local_port,
+					       chip);
+}
+
+int bind_interdomain_evtchn_to_irq(unsigned int remote_domain,
+				   evtchn_port_t remote_port)
+{
+	return bind_interdomain_evtchn_to_irq_chip(remote_domain, remote_port,
+						   &xen_dynamic_chip);
 }
 EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irq);
 
+int bind_interdomain_evtchn_to_irq_lateeoi(unsigned int remote_domain,
+					   evtchn_port_t remote_port)
+{
+	return bind_interdomain_evtchn_to_irq_chip(remote_domain, remote_port,
+						   &xen_lateeoi_chip);
+}
+EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irq_lateeoi);
+
 static int find_virq(unsigned int virq, unsigned int cpu)
 {
 	struct evtchn_status status;
@@ -1067,14 +1123,15 @@ static void unbind_from_irq(unsigned int irq)
 	mutex_unlock(&irq_mapping_update_lock);
 }
 
-int bind_evtchn_to_irqhandler(unsigned int evtchn,
-			      irq_handler_t handler,
-			      unsigned long irqflags,
-			      const char *devname, void *dev_id)
+static int bind_evtchn_to_irqhandler_chip(evtchn_port_t evtchn,
+					  irq_handler_t handler,
+					  unsigned long irqflags,
+					  const char *devname, void *dev_id,
+					  struct irq_chip *chip)
 {
 	int irq, retval;
 
-	irq = bind_evtchn_to_irq(evtchn);
+	irq = bind_evtchn_to_irq_chip(evtchn, chip);
 	if (irq < 0)
 		return irq;
 	retval = request_irq(irq, handler, irqflags, devname, dev_id);
@@ -1085,18 +1142,38 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn,
 
 	return irq;
 }
+
+int bind_evtchn_to_irqhandler(evtchn_port_t evtchn,
+			      irq_handler_t handler,
+			      unsigned long irqflags,
+			      const char *devname, void *dev_id)
+{
+	return bind_evtchn_to_irqhandler_chip(evtchn, handler, irqflags,
+					      devname, dev_id,
+					      &xen_dynamic_chip);
+}
 EXPORT_SYMBOL_GPL(bind_evtchn_to_irqhandler);
 
-int bind_interdomain_evtchn_to_irqhandler(unsigned int remote_domain,
-					  unsigned int remote_port,
-					  irq_handler_t handler,
-					  unsigned long irqflags,
-					  const char *devname,
-					  void *dev_id)
+int bind_evtchn_to_irqhandler_lateeoi(evtchn_port_t evtchn,
+				      irq_handler_t handler,
+				      unsigned long irqflags,
+				      const char *devname, void *dev_id)
+{
+	return bind_evtchn_to_irqhandler_chip(evtchn, handler, irqflags,
+					      devname, dev_id,
+					      &xen_lateeoi_chip);
+}
+EXPORT_SYMBOL_GPL(bind_evtchn_to_irqhandler_lateeoi);
+
+static int bind_interdomain_evtchn_to_irqhandler_chip(
+		unsigned int remote_domain, evtchn_port_t remote_port,
+		irq_handler_t handler, unsigned long irqflags,
+		const char *devname, void *dev_id, struct irq_chip *chip)
 {
 	int irq, retval;
 
-	irq = bind_interdomain_evtchn_to_irq(remote_domain, remote_port);
+	irq = bind_interdomain_evtchn_to_irq_chip(remote_domain, remote_port,
+						  chip);
 	if (irq < 0)
 		return irq;
 
@@ -1108,8 +1185,33 @@ int bind_interdomain_evtchn_to_irqhandler(unsigned int remote_domain,
 
 	return irq;
 }
+
+int bind_interdomain_evtchn_to_irqhandler(unsigned int remote_domain,
+					  evtchn_port_t remote_port,
+					  irq_handler_t handler,
+					  unsigned long irqflags,
+					  const char *devname,
+					  void *dev_id)
+{
+	return bind_interdomain_evtchn_to_irqhandler_chip(remote_domain,
+				remote_port, handler, irqflags, devname,
+				dev_id, &xen_dynamic_chip);
+}
 EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irqhandler);
 
+int bind_interdomain_evtchn_to_irqhandler_lateeoi(unsigned int remote_domain,
+						  evtchn_port_t remote_port,
+						  irq_handler_t handler,
+						  unsigned long irqflags,
+						  const char *devname,
+						  void *dev_id)
+{
+	return bind_interdomain_evtchn_to_irqhandler_chip(remote_domain,
+				remote_port, handler, irqflags, devname,
+				dev_id, &xen_lateeoi_chip);
+}
+EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irqhandler_lateeoi);
+
 int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
 			    irq_handler_t handler,
 			    unsigned long irqflags, const char *devname, void *dev_id)
@@ -1642,6 +1744,21 @@ static struct irq_chip xen_dynamic_chip __read_mostly = {
 	.irq_retrigger		= retrigger_dynirq,
 };
 
+static struct irq_chip xen_lateeoi_chip __read_mostly = {
+	/* The chip name needs to contain "xen-dyn" for irqbalance to work. */
+	.name			= "xen-dyn-lateeoi",
+
+	.irq_disable		= disable_dynirq,
+	.irq_mask		= disable_dynirq,
+	.irq_unmask		= enable_dynirq,
+
+	.irq_ack		= mask_ack_dynirq,
+	.irq_mask_ack		= mask_ack_dynirq,
+
+	.irq_set_affinity	= set_affinity_irq,
+	.irq_retrigger		= retrigger_dynirq,
+};
+
 static struct irq_chip xen_pirq_chip __read_mostly = {
 	.name			= "xen-pirq",
 
diff --git a/include/xen/events.h b/include/xen/events.h
index 88da2abaf535..ad0c61cf399b 100644
--- a/include/xen/events.h
+++ b/include/xen/events.h
@@ -12,11 +12,16 @@
 
 unsigned xen_evtchn_nr_channels(void);
 
-int bind_evtchn_to_irq(unsigned int evtchn);
-int bind_evtchn_to_irqhandler(unsigned int evtchn,
+int bind_evtchn_to_irq(evtchn_port_t evtchn);
+int bind_evtchn_to_irq_lateeoi(evtchn_port_t evtchn);
+int bind_evtchn_to_irqhandler(evtchn_port_t evtchn,
 			      irq_handler_t handler,
 			      unsigned long irqflags, const char *devname,
 			      void *dev_id);
+int bind_evtchn_to_irqhandler_lateeoi(evtchn_port_t evtchn,
+				      irq_handler_t handler,
+				      unsigned long irqflags, const char *devname,
+				      void *dev_id);
 int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu);
 int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
 			    irq_handler_t handler,
@@ -29,13 +34,21 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi,
 			   const char *devname,
 			   void *dev_id);
 int bind_interdomain_evtchn_to_irq(unsigned int remote_domain,
-				   unsigned int remote_port);
+				   evtchn_port_t remote_port);
+int bind_interdomain_evtchn_to_irq_lateeoi(unsigned int remote_domain,
+					   evtchn_port_t remote_port);
 int bind_interdomain_evtchn_to_irqhandler(unsigned int remote_domain,
-					  unsigned int remote_port,
+					  evtchn_port_t remote_port,
 					  irq_handler_t handler,
 					  unsigned long irqflags,
 					  const char *devname,
 					  void *dev_id);
+int bind_interdomain_evtchn_to_irqhandler_lateeoi(unsigned int remote_domain,
+						  evtchn_port_t remote_port,
+						  irq_handler_t handler,
+						  unsigned long irqflags,
+						  const char *devname,
+						  void *dev_id);
 
 /*
  * Common unbind function for all event sources. Takes IRQ to unbind from.
@@ -44,6 +57,14 @@ int bind_interdomain_evtchn_to_irqhandler(unsigned int remote_domain,
  */
 void unbind_from_irqhandler(unsigned int irq, void *dev_id);
 
+/*
+ * Send late EOI for an IRQ bound to an event channel via one of the *_lateeoi
+ * functions above.
+ */
+void xen_irq_lateeoi(unsigned int irq, unsigned int eoi_flags);
+/* Signal an event was spurious, i.e. there was no action resulting from it. */
+#define XEN_EOI_FLAG_SPURIOUS	0x00000001
+
 #define XEN_IRQ_PRIORITY_MAX     EVTCHN_FIFO_PRIORITY_MAX
 #define XEN_IRQ_PRIORITY_DEFAULT EVTCHN_FIFO_PRIORITY_DEFAULT
 #define XEN_IRQ_PRIORITY_MIN     EVTCHN_FIFO_PRIORITY_MIN

From 6f98cd54926eeb8c83dd601bfea056a62433b71c Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 3 Nov 2020 17:22:31 +0100
Subject: [PATCH 1018/2658] xen/blkback: use lateeoi irq binding

commit 01263a1fabe30b4d542f34c7e2364a22587ddaf2 upstream.

In order to reduce the chance for the system becoming unresponsive due
to event storms triggered by a misbehaving blkfront use the lateeoi
irq binding for blkback and unmask the event channel only after
processing all pending requests.

As the thread processing requests is used to do purging work in regular
intervals an EOI may be sent only after having received an event. If
there was no pending I/O request flag the EOI as spurious.

This is part of XSA-332.

Cc: stable@vger.kernel.org
Reported-by: Julien Grall <julien@xen.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Wei Liu <wl@xen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/block/xen-blkback/blkback.c | 22 +++++++++++++++++-----
 drivers/block/xen-blkback/xenbus.c  |  5 ++---
 2 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index a295ad6a1674..8dbdd156e0d3 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -173,7 +173,7 @@ static inline void shrink_free_pagepool(struct xen_blkif *blkif, int num)
 
 #define vaddr(page) ((unsigned long)pfn_to_kaddr(page_to_pfn(page)))
 
-static int do_block_io_op(struct xen_blkif *blkif);
+static int do_block_io_op(struct xen_blkif *blkif, unsigned int *eoi_flags);
 static int dispatch_rw_block_io(struct xen_blkif *blkif,
 				struct blkif_request *req,
 				struct pending_req *pending_req);
@@ -594,6 +594,8 @@ int xen_blkif_schedule(void *arg)
 	struct xen_vbd *vbd = &blkif->vbd;
 	unsigned long timeout;
 	int ret;
+	bool do_eoi;
+	unsigned int eoi_flags = XEN_EOI_FLAG_SPURIOUS;
 
 	while (!kthread_should_stop()) {
 		if (try_to_freeze())
@@ -617,16 +619,23 @@ int xen_blkif_schedule(void *arg)
 		if (timeout == 0)
 			goto purge_gnt_list;
 
+		do_eoi = blkif->waiting_reqs;
+
 		blkif->waiting_reqs = 0;
 		smp_mb(); /* clear flag *before* checking for work */
 
-		ret = do_block_io_op(blkif);
+		ret = do_block_io_op(blkif, &eoi_flags);
 		if (ret > 0)
 			blkif->waiting_reqs = 1;
 		if (ret == -EACCES)
 			wait_event_interruptible(blkif->shutdown_wq,
 						 kthread_should_stop());
 
+		if (do_eoi && !blkif->waiting_reqs) {
+			xen_irq_lateeoi(blkif->irq, eoi_flags);
+			eoi_flags |= XEN_EOI_FLAG_SPURIOUS;
+		}
+
 purge_gnt_list:
 		if (blkif->vbd.feature_gnt_persistent &&
 		    time_after(jiffies, blkif->next_lru)) {
@@ -1094,7 +1103,7 @@ static void end_block_io_op(struct bio *bio)
  * and transmute  it to the block API to hand it over to the proper block disk.
  */
 static int
-__do_block_io_op(struct xen_blkif *blkif)
+__do_block_io_op(struct xen_blkif *blkif, unsigned int *eoi_flags)
 {
 	union blkif_back_rings *blk_rings = &blkif->blk_rings;
 	struct blkif_request req;
@@ -1117,6 +1126,9 @@ __do_block_io_op(struct xen_blkif *blkif)
 		if (RING_REQUEST_CONS_OVERFLOW(&blk_rings->common, rc))
 			break;
 
+		/* We've seen a request, so clear spurious eoi flag. */
+		*eoi_flags &= ~XEN_EOI_FLAG_SPURIOUS;
+
 		if (kthread_should_stop()) {
 			more_to_do = 1;
 			break;
@@ -1175,13 +1187,13 @@ __do_block_io_op(struct xen_blkif *blkif)
 }
 
 static int
-do_block_io_op(struct xen_blkif *blkif)
+do_block_io_op(struct xen_blkif *blkif, unsigned int *eoi_flags)
 {
 	union blkif_back_rings *blk_rings = &blkif->blk_rings;
 	int more_to_do;
 
 	do {
-		more_to_do = __do_block_io_op(blkif);
+		more_to_do = __do_block_io_op(blkif, eoi_flags);
 		if (more_to_do)
 			break;
 
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 923308201375..0ec257e69e95 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -200,9 +200,8 @@ static int xen_blkif_map(struct xen_blkif *blkif, grant_ref_t *gref,
 		BUG();
 	}
 
-	err = bind_interdomain_evtchn_to_irqhandler(blkif->domid, evtchn,
-						    xen_blkif_be_int, 0,
-						    "blkif-backend", blkif);
+	err = bind_interdomain_evtchn_to_irqhandler_lateeoi(blkif->domid,
+			evtchn, xen_blkif_be_int, 0, "blkif-backend", blkif);
 	if (err < 0) {
 		xenbus_unmap_ring_vfree(blkif->be->dev, blkif->blk_ring);
 		blkif->blk_rings.common.sring = NULL;

From 3e4c2c194fe8262ef56523624add1b4d64a0f84f Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 3 Nov 2020 17:22:32 +0100
Subject: [PATCH 1019/2658] xen/netback: use lateeoi irq binding

commit 23025393dbeb3b8b3b60ebfa724cdae384992e27 upstream.

In order to reduce the chance for the system becoming unresponsive due
to event storms triggered by a misbehaving netfront use the lateeoi
irq binding for netback and unmask the event channel only just before
going to sleep waiting for new events.

Make sure not to issue an EOI when none is pending by introducing an
eoi_pending element to struct xenvif_queue.

When no request has been consumed set the spurious flag when sending
the EOI for an interrupt.

This is part of XSA-332.

Cc: stable@vger.kernel.org
Reported-by: Julien Grall <julien@xen.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Wei Liu <wl@xen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/xen-netback/common.h    | 39 +++++++++++++++++++
 drivers/net/xen-netback/interface.c | 59 +++++++++++++++++++++++++----
 drivers/net/xen-netback/netback.c   | 17 +++++++--
 3 files changed, 103 insertions(+), 12 deletions(-)

diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 34173b5e886f..53c2fa244c64 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -137,6 +137,20 @@ struct xenvif_queue { /* Per-queue data for xenvif */
 	char name[QUEUE_NAME_SIZE]; /* DEVNAME-qN */
 	struct xenvif *vif; /* Parent VIF */
 
+	/*
+	 * TX/RX common EOI handling.
+	 * When feature-split-event-channels = 0, interrupt handler sets
+	 * NETBK_COMMON_EOI, otherwise NETBK_RX_EOI and NETBK_TX_EOI are set
+	 * by the RX and TX interrupt handlers.
+	 * RX and TX handler threads will issue an EOI when either
+	 * NETBK_COMMON_EOI or their specific bits (NETBK_RX_EOI or
+	 * NETBK_TX_EOI) are set and they will reset those bits.
+	 */
+	atomic_t eoi_pending;
+#define NETBK_RX_EOI		0x01
+#define NETBK_TX_EOI		0x02
+#define NETBK_COMMON_EOI	0x04
+
 	/* Use NAPI for guest TX */
 	struct napi_struct napi;
 	/* When feature-split-event-channels = 0, tx_irq = rx_irq. */
@@ -317,6 +331,7 @@ void xenvif_kick_thread(struct xenvif_queue *queue);
 
 int xenvif_dealloc_kthread(void *data);
 
+bool xenvif_have_rx_work(struct xenvif_queue *queue, bool test_kthread);
 void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb);
 
 void xenvif_carrier_on(struct xenvif *vif);
@@ -353,4 +368,28 @@ void xenvif_skb_zerocopy_complete(struct xenvif_queue *queue);
 bool xenvif_mcast_match(struct xenvif *vif, const u8 *addr);
 void xenvif_mcast_addr_list_free(struct xenvif *vif);
 
+#include <linux/atomic.h>
+
+static inline int xenvif_atomic_fetch_or(int i, atomic_t *v)
+{
+	int c, old;
+
+	c = v->counter;
+	while ((old = cmpxchg(&v->counter, c, c | i)) != c)
+		c = old;
+
+	return c;
+}
+
+static inline int xenvif_atomic_fetch_andnot(int i, atomic_t *v)
+{
+	int c, old;
+
+	c = v->counter;
+	while ((old = cmpxchg(&v->counter, c, c & ~i)) != c)
+		c = old;
+
+	return c;
+}
+
 #endif /* __XEN_NETBACK__COMMON_H__ */
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 2008c6a02b8a..66260ea74d7d 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -76,12 +76,28 @@ int xenvif_schedulable(struct xenvif *vif)
 		!vif->disabled;
 }
 
+static bool xenvif_handle_tx_interrupt(struct xenvif_queue *queue)
+{
+	bool rc;
+
+	rc = RING_HAS_UNCONSUMED_REQUESTS(&queue->tx);
+	if (rc)
+		napi_schedule(&queue->napi);
+	return rc;
+}
+
 static irqreturn_t xenvif_tx_interrupt(int irq, void *dev_id)
 {
 	struct xenvif_queue *queue = dev_id;
+	int old;
 
-	if (RING_HAS_UNCONSUMED_REQUESTS(&queue->tx))
-		napi_schedule(&queue->napi);
+	old = xenvif_atomic_fetch_or(NETBK_TX_EOI, &queue->eoi_pending);
+	WARN(old & NETBK_TX_EOI, "Interrupt while EOI pending\n");
+
+	if (!xenvif_handle_tx_interrupt(queue)) {
+		atomic_andnot(NETBK_TX_EOI, &queue->eoi_pending);
+		xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS);
+	}
 
 	return IRQ_HANDLED;
 }
@@ -115,19 +131,46 @@ static int xenvif_poll(struct napi_struct *napi, int budget)
 	return work_done;
 }
 
+static bool xenvif_handle_rx_interrupt(struct xenvif_queue *queue)
+{
+	bool rc;
+
+	rc = xenvif_have_rx_work(queue, false);
+	if (rc)
+		xenvif_kick_thread(queue);
+	return rc;
+}
+
 static irqreturn_t xenvif_rx_interrupt(int irq, void *dev_id)
 {
 	struct xenvif_queue *queue = dev_id;
+	int old;
 
-	xenvif_kick_thread(queue);
+	old = xenvif_atomic_fetch_or(NETBK_RX_EOI, &queue->eoi_pending);
+	WARN(old & NETBK_RX_EOI, "Interrupt while EOI pending\n");
+
+	if (!xenvif_handle_rx_interrupt(queue)) {
+		atomic_andnot(NETBK_RX_EOI, &queue->eoi_pending);
+		xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS);
+	}
 
 	return IRQ_HANDLED;
 }
 
 irqreturn_t xenvif_interrupt(int irq, void *dev_id)
 {
-	xenvif_tx_interrupt(irq, dev_id);
-	xenvif_rx_interrupt(irq, dev_id);
+	struct xenvif_queue *queue = dev_id;
+	int old;
+
+	old = xenvif_atomic_fetch_or(NETBK_COMMON_EOI, &queue->eoi_pending);
+	WARN(old, "Interrupt while EOI pending\n");
+
+	/* Use bitwise or as we need to call both functions. */
+	if ((!xenvif_handle_tx_interrupt(queue) |
+	     !xenvif_handle_rx_interrupt(queue))) {
+		atomic_andnot(NETBK_COMMON_EOI, &queue->eoi_pending);
+		xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS);
+	}
 
 	return IRQ_HANDLED;
 }
@@ -555,7 +598,7 @@ int xenvif_connect(struct xenvif_queue *queue, unsigned long tx_ring_ref,
 
 	if (tx_evtchn == rx_evtchn) {
 		/* feature-split-event-channels == 0 */
-		err = bind_interdomain_evtchn_to_irqhandler(
+		err = bind_interdomain_evtchn_to_irqhandler_lateeoi(
 			queue->vif->domid, tx_evtchn, xenvif_interrupt, 0,
 			queue->name, queue);
 		if (err < 0)
@@ -566,7 +609,7 @@ int xenvif_connect(struct xenvif_queue *queue, unsigned long tx_ring_ref,
 		/* feature-split-event-channels == 1 */
 		snprintf(queue->tx_irq_name, sizeof(queue->tx_irq_name),
 			 "%s-tx", queue->name);
-		err = bind_interdomain_evtchn_to_irqhandler(
+		err = bind_interdomain_evtchn_to_irqhandler_lateeoi(
 			queue->vif->domid, tx_evtchn, xenvif_tx_interrupt, 0,
 			queue->tx_irq_name, queue);
 		if (err < 0)
@@ -576,7 +619,7 @@ int xenvif_connect(struct xenvif_queue *queue, unsigned long tx_ring_ref,
 
 		snprintf(queue->rx_irq_name, sizeof(queue->rx_irq_name),
 			 "%s-rx", queue->name);
-		err = bind_interdomain_evtchn_to_irqhandler(
+		err = bind_interdomain_evtchn_to_irqhandler_lateeoi(
 			queue->vif->domid, rx_evtchn, xenvif_rx_interrupt, 0,
 			queue->rx_irq_name, queue);
 		if (err < 0)
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 65d37257e033..ee7a800c16d5 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -670,6 +670,10 @@ void xenvif_napi_schedule_or_enable_events(struct xenvif_queue *queue)
 
 	if (more_to_do)
 		napi_schedule(&queue->napi);
+	else if (xenvif_atomic_fetch_andnot(NETBK_TX_EOI | NETBK_COMMON_EOI,
+				     &queue->eoi_pending) &
+		 (NETBK_TX_EOI | NETBK_COMMON_EOI))
+		xen_irq_lateeoi(queue->tx_irq, 0);
 }
 
 static void tx_add_credit(struct xenvif_queue *queue)
@@ -2010,14 +2014,14 @@ static bool xenvif_rx_queue_ready(struct xenvif_queue *queue)
 	return queue->stalled && prod - cons >= 1;
 }
 
-static bool xenvif_have_rx_work(struct xenvif_queue *queue)
+bool xenvif_have_rx_work(struct xenvif_queue *queue, bool test_kthread)
 {
 	return (!skb_queue_empty(&queue->rx_queue)
 		&& xenvif_rx_ring_slots_available(queue))
 		|| (queue->vif->stall_timeout &&
 		    (xenvif_rx_queue_stalled(queue)
 		     || xenvif_rx_queue_ready(queue)))
-		|| kthread_should_stop()
+		|| (test_kthread && kthread_should_stop())
 		|| queue->vif->disabled;
 }
 
@@ -2048,15 +2052,20 @@ static void xenvif_wait_for_rx_work(struct xenvif_queue *queue)
 {
 	DEFINE_WAIT(wait);
 
-	if (xenvif_have_rx_work(queue))
+	if (xenvif_have_rx_work(queue, true))
 		return;
 
 	for (;;) {
 		long ret;
 
 		prepare_to_wait(&queue->wq, &wait, TASK_INTERRUPTIBLE);
-		if (xenvif_have_rx_work(queue))
+		if (xenvif_have_rx_work(queue, true))
 			break;
+		if (xenvif_atomic_fetch_andnot(NETBK_RX_EOI | NETBK_COMMON_EOI,
+					&queue->eoi_pending) &
+		    (NETBK_RX_EOI | NETBK_COMMON_EOI))
+			xen_irq_lateeoi(queue->rx_irq, 0);
+
 		ret = schedule_timeout(xenvif_rx_queue_timeout(queue));
 		if (!ret)
 			break;

From b7a7a31f8c23f857bf8ffdbd01a3aff847df5233 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 3 Nov 2020 17:22:33 +0100
Subject: [PATCH 1020/2658] xen/scsiback: use lateeoi irq binding

commit 86991b6e7ea6c613b7692f65106076943449b6b7 upstream.

In order to reduce the chance for the system becoming unresponsive due
to event storms triggered by a misbehaving scsifront use the lateeoi
irq binding for scsiback and unmask the event channel only just before
leaving the event handling function.

In case of a ring protocol error don't issue an EOI in order to avoid
the possibility to use that for producing an event storm. This at once
will result in no further call of scsiback_irq_fn(), so the ring_error
struct member can be dropped and scsiback_do_cmd_fn() can signal the
protocol error via a negative return value.

This is part of XSA-332.

Cc: stable@vger.kernel.org
Reported-by: Julien Grall <julien@xen.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Wei Liu <wl@xen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/xen-scsiback.c | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
index 51387d75c7bf..29a1b8054a4d 100644
--- a/drivers/xen/xen-scsiback.c
+++ b/drivers/xen/xen-scsiback.c
@@ -91,7 +91,6 @@ struct vscsibk_info {
 	unsigned int irq;
 
 	struct vscsiif_back_ring ring;
-	int ring_error;
 
 	spinlock_t ring_lock;
 	atomic_t nr_unreplied_reqs;
@@ -698,7 +697,8 @@ static int prepare_pending_reqs(struct vscsibk_info *info,
 	return 0;
 }
 
-static int scsiback_do_cmd_fn(struct vscsibk_info *info)
+static int scsiback_do_cmd_fn(struct vscsibk_info *info,
+			      unsigned int *eoi_flags)
 {
 	struct vscsiif_back_ring *ring = &info->ring;
 	struct vscsiif_request ring_req;
@@ -715,11 +715,12 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
 		rc = ring->rsp_prod_pvt;
 		pr_warn("Dom%d provided bogus ring requests (%#x - %#x = %u). Halting ring processing\n",
 			   info->domid, rp, rc, rp - rc);
-		info->ring_error = 1;
-		return 0;
+		return -EINVAL;
 	}
 
 	while ((rc != rp)) {
+		*eoi_flags &= ~XEN_EOI_FLAG_SPURIOUS;
+
 		if (RING_REQUEST_CONS_OVERFLOW(ring, rc))
 			break;
 		pending_req = kmem_cache_alloc(scsiback_cachep, GFP_KERNEL);
@@ -782,13 +783,16 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
 static irqreturn_t scsiback_irq_fn(int irq, void *dev_id)
 {
 	struct vscsibk_info *info = dev_id;
+	int rc;
+	unsigned int eoi_flags = XEN_EOI_FLAG_SPURIOUS;
 
-	if (info->ring_error)
-		return IRQ_HANDLED;
-
-	while (scsiback_do_cmd_fn(info))
+	while ((rc = scsiback_do_cmd_fn(info, &eoi_flags)) > 0)
 		cond_resched();
 
+	/* In case of a ring error we keep the event channel masked. */
+	if (!rc)
+		xen_irq_lateeoi(irq, eoi_flags);
+
 	return IRQ_HANDLED;
 }
 
@@ -809,7 +813,7 @@ static int scsiback_init_sring(struct vscsibk_info *info, grant_ref_t ring_ref,
 	sring = (struct vscsiif_sring *)area;
 	BACK_RING_INIT(&info->ring, sring, PAGE_SIZE);
 
-	err = bind_interdomain_evtchn_to_irq(info->domid, evtchn);
+	err = bind_interdomain_evtchn_to_irq_lateeoi(info->domid, evtchn);
 	if (err < 0)
 		goto unmap_page;
 
@@ -1210,7 +1214,6 @@ static int scsiback_probe(struct xenbus_device *dev,
 
 	info->domid = dev->otherend_id;
 	spin_lock_init(&info->ring_lock);
-	info->ring_error = 0;
 	atomic_set(&info->nr_unreplied_reqs, 0);
 	init_waitqueue_head(&info->waiting_to_free);
 	info->dev = dev;

From dcd5114f3c14083ffd8c05a77f30ab4b19fa3e74 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 3 Nov 2020 17:22:34 +0100
Subject: [PATCH 1021/2658] xen/pciback: use lateeoi irq binding

commit c2711441bc961b37bba0615dd7135857d189035f upstream.

In order to reduce the chance for the system becoming unresponsive due
to event storms triggered by a misbehaving pcifront use the lateeoi irq
binding for pciback and unmask the event channel only just before
leaving the event handling function.

Restructure the handling to support that scheme. Basically an event can
come in for two reasons: either a normal request for a pciback action,
which is handled in a worker, or in case the guest has finished an AER
request which was requested by pciback.

When an AER request is issued to the guest and a normal pciback action
is currently active issue an EOI early in order to be able to receive
another event when the AER request has been finished by the guest.

Let the worker processing the normal requests run until no further
request is pending, instead of starting a new worker ion that case.
Issue the EOI only just before leaving the worker.

This scheme allows to drop calling the generic function
xen_pcibk_test_and_schedule_op() after processing of any request as
the handling of both request types is now separated more cleanly.

This is part of XSA-332.

Cc: stable@vger.kernel.org
Reported-by: Julien Grall <julien@xen.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Wei Liu <wl@xen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/xen-pciback/pci_stub.c    | 14 ++++----
 drivers/xen/xen-pciback/pciback.h     | 12 +++++--
 drivers/xen/xen-pciback/pciback_ops.c | 48 +++++++++++++++++++++------
 drivers/xen/xen-pciback/xenbus.c      |  2 +-
 4 files changed, 56 insertions(+), 20 deletions(-)

diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
index 47c6df53cabf..e21b82921c33 100644
--- a/drivers/xen/xen-pciback/pci_stub.c
+++ b/drivers/xen/xen-pciback/pci_stub.c
@@ -681,10 +681,17 @@ static pci_ers_result_t common_process(struct pcistub_device *psdev,
 	wmb();
 	notify_remote_via_irq(pdev->evtchn_irq);
 
+	/* Enable IRQ to signal "request done". */
+	xen_pcibk_lateeoi(pdev, 0);
+
 	ret = wait_event_timeout(xen_pcibk_aer_wait_queue,
 				 !(test_bit(_XEN_PCIB_active, (unsigned long *)
 				 &sh_info->flags)), 300*HZ);
 
+	/* Enable IRQ for pcifront request if not already active. */
+	if (!test_bit(_PDEVF_op_active, &pdev->flags))
+		xen_pcibk_lateeoi(pdev, 0);
+
 	if (!ret) {
 		if (test_bit(_XEN_PCIB_active,
 			(unsigned long *)&sh_info->flags)) {
@@ -698,13 +705,6 @@ static pci_ers_result_t common_process(struct pcistub_device *psdev,
 	}
 	clear_bit(_PCIB_op_pending, (unsigned long *)&pdev->flags);
 
-	if (test_bit(_XEN_PCIF_active,
-		(unsigned long *)&sh_info->flags)) {
-		dev_dbg(&psdev->dev->dev,
-			"schedule pci_conf service in " DRV_NAME "\n");
-		xen_pcibk_test_and_schedule_op(psdev->pdev);
-	}
-
 	res = (pci_ers_result_t)aer_op->err;
 	return res;
 }
diff --git a/drivers/xen/xen-pciback/pciback.h b/drivers/xen/xen-pciback/pciback.h
index 4d529f3e40df..f44a425d1a5a 100644
--- a/drivers/xen/xen-pciback/pciback.h
+++ b/drivers/xen/xen-pciback/pciback.h
@@ -13,6 +13,7 @@
 #include <linux/spinlock.h>
 #include <linux/workqueue.h>
 #include <linux/atomic.h>
+#include <xen/events.h>
 #include <xen/interface/io/pciif.h>
 
 #define DRV_NAME	"xen-pciback"
@@ -26,6 +27,8 @@ struct pci_dev_entry {
 #define PDEVF_op_active		(1<<(_PDEVF_op_active))
 #define _PCIB_op_pending	(1)
 #define PCIB_op_pending		(1<<(_PCIB_op_pending))
+#define _EOI_pending		(2)
+#define EOI_pending		(1<<(_EOI_pending))
 
 struct xen_pcibk_device {
 	void *pci_dev_data;
@@ -182,12 +185,17 @@ static inline void xen_pcibk_release_devices(struct xen_pcibk_device *pdev)
 irqreturn_t xen_pcibk_handle_event(int irq, void *dev_id);
 void xen_pcibk_do_op(struct work_struct *data);
 
+static inline void xen_pcibk_lateeoi(struct xen_pcibk_device *pdev,
+				     unsigned int eoi_flag)
+{
+	if (test_and_clear_bit(_EOI_pending, &pdev->flags))
+		xen_irq_lateeoi(pdev->evtchn_irq, eoi_flag);
+}
+
 int xen_pcibk_xenbus_register(void);
 void xen_pcibk_xenbus_unregister(void);
 
 extern int verbose_request;
-
-void xen_pcibk_test_and_schedule_op(struct xen_pcibk_device *pdev);
 #endif
 
 /* Handles shared IRQs that can to device domain and control domain. */
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index 49c5f0e9600a..232db7fcc523 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -296,26 +296,41 @@ int xen_pcibk_disable_msix(struct xen_pcibk_device *pdev,
 	return 0;
 }
 #endif
+
+static inline bool xen_pcibk_test_op_pending(struct xen_pcibk_device *pdev)
+{
+	return test_bit(_XEN_PCIF_active,
+			(unsigned long *)&pdev->sh_info->flags) &&
+	       !test_and_set_bit(_PDEVF_op_active, &pdev->flags);
+}
+
 /*
 * Now the same evtchn is used for both pcifront conf_read_write request
 * as well as pcie aer front end ack. We use a new work_queue to schedule
 * xen_pcibk conf_read_write service for avoiding confict with aer_core
 * do_recovery job which also use the system default work_queue
 */
-void xen_pcibk_test_and_schedule_op(struct xen_pcibk_device *pdev)
+static void xen_pcibk_test_and_schedule_op(struct xen_pcibk_device *pdev)
 {
+	bool eoi = true;
+
 	/* Check that frontend is requesting an operation and that we are not
 	 * already processing a request */
-	if (test_bit(_XEN_PCIF_active, (unsigned long *)&pdev->sh_info->flags)
-	    && !test_and_set_bit(_PDEVF_op_active, &pdev->flags)) {
+	if (xen_pcibk_test_op_pending(pdev)) {
 		queue_work(xen_pcibk_wq, &pdev->op_work);
+		eoi = false;
 	}
 	/*_XEN_PCIB_active should have been cleared by pcifront. And also make
 	sure xen_pcibk is waiting for ack by checking _PCIB_op_pending*/
 	if (!test_bit(_XEN_PCIB_active, (unsigned long *)&pdev->sh_info->flags)
 	    && test_bit(_PCIB_op_pending, &pdev->flags)) {
 		wake_up(&xen_pcibk_aer_wait_queue);
+		eoi = false;
 	}
+
+	/* EOI if there was nothing to do. */
+	if (eoi)
+		xen_pcibk_lateeoi(pdev, XEN_EOI_FLAG_SPURIOUS);
 }
 
 /* Performing the configuration space reads/writes must not be done in atomic
@@ -323,10 +338,8 @@ void xen_pcibk_test_and_schedule_op(struct xen_pcibk_device *pdev)
  * use of semaphores). This function is intended to be called from a work
  * queue in process context taking a struct xen_pcibk_device as a parameter */
 
-void xen_pcibk_do_op(struct work_struct *data)
+static void xen_pcibk_do_one_op(struct xen_pcibk_device *pdev)
 {
-	struct xen_pcibk_device *pdev =
-		container_of(data, struct xen_pcibk_device, op_work);
 	struct pci_dev *dev;
 	struct xen_pcibk_dev_data *dev_data = NULL;
 	struct xen_pci_op *op = &pdev->op;
@@ -399,16 +412,31 @@ void xen_pcibk_do_op(struct work_struct *data)
 	smp_mb__before_atomic(); /* /after/ clearing PCIF_active */
 	clear_bit(_PDEVF_op_active, &pdev->flags);
 	smp_mb__after_atomic(); /* /before/ final check for work */
+}
 
-	/* Check to see if the driver domain tried to start another request in
-	 * between clearing _XEN_PCIF_active and clearing _PDEVF_op_active.
-	*/
-	xen_pcibk_test_and_schedule_op(pdev);
+void xen_pcibk_do_op(struct work_struct *data)
+{
+	struct xen_pcibk_device *pdev =
+		container_of(data, struct xen_pcibk_device, op_work);
+
+	do {
+		xen_pcibk_do_one_op(pdev);
+	} while (xen_pcibk_test_op_pending(pdev));
+
+	xen_pcibk_lateeoi(pdev, 0);
 }
 
 irqreturn_t xen_pcibk_handle_event(int irq, void *dev_id)
 {
 	struct xen_pcibk_device *pdev = dev_id;
+	bool eoi;
+
+	/* IRQs might come in before pdev->evtchn_irq is written. */
+	if (unlikely(pdev->evtchn_irq != irq))
+		pdev->evtchn_irq = irq;
+
+	eoi = test_and_set_bit(_EOI_pending, &pdev->flags);
+	WARN(eoi, "IRQ while EOI pending\n");
 
 	xen_pcibk_test_and_schedule_op(pdev);
 
diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c
index 4843741e703a..48196347f2f9 100644
--- a/drivers/xen/xen-pciback/xenbus.c
+++ b/drivers/xen/xen-pciback/xenbus.c
@@ -124,7 +124,7 @@ static int xen_pcibk_do_attach(struct xen_pcibk_device *pdev, int gnt_ref,
 
 	pdev->sh_info = vaddr;
 
-	err = bind_interdomain_evtchn_to_irqhandler(
+	err = bind_interdomain_evtchn_to_irqhandler_lateeoi(
 		pdev->xdev->otherend_id, remote_evtchn, xen_pcibk_handle_event,
 		0, DRV_NAME, pdev);
 	if (err < 0) {

From e0671bc38b00018818b1dfc887a9826daea2f0ca Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 3 Nov 2020 17:22:35 +0100
Subject: [PATCH 1022/2658] xen/events: switch user event channels to lateeoi
 model

commit c44b849cee8c3ac587da3b0980e01f77500d158c upstream.

Instead of disabling the irq when an event is received and enabling
it again when handled by the user process use the lateeoi model.

This is part of XSA-332.

Cc: stable@vger.kernel.org
Reported-by: Julien Grall <julien@xen.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Tested-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Wei Liu <wl@xen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/evtchn.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
index a475ad72e229..fada54a26348 100644
--- a/drivers/xen/evtchn.c
+++ b/drivers/xen/evtchn.c
@@ -161,7 +161,6 @@ static irqreturn_t evtchn_interrupt(int irq, void *data)
 	     "Interrupt for port %d, but apparently not enabled; per-user %p\n",
 	     evtchn->port, u);
 
-	disable_irq_nosync(irq);
 	evtchn->enabled = false;
 
 	spin_lock(&u->ring_prod_lock);
@@ -287,7 +286,7 @@ static ssize_t evtchn_write(struct file *file, const char __user *buf,
 		evtchn = find_evtchn(u, port);
 		if (evtchn && !evtchn->enabled) {
 			evtchn->enabled = true;
-			enable_irq(irq_from_evtchn(port));
+			xen_irq_lateeoi(irq_from_evtchn(port), 0);
 		}
 	}
 
@@ -387,8 +386,8 @@ static int evtchn_bind_to_user(struct per_user_data *u, int port)
 	if (rc < 0)
 		goto err;
 
-	rc = bind_evtchn_to_irqhandler(port, evtchn_interrupt, 0,
-				       u->name, evtchn);
+	rc = bind_evtchn_to_irqhandler_lateeoi(port, evtchn_interrupt, 0,
+					       u->name, evtchn);
 	if (rc < 0)
 		goto err;
 

From 6947abdc3f16835faa2915797f7c22516d1c8e28 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 3 Nov 2020 17:22:36 +0100
Subject: [PATCH 1023/2658] xen/events: use a common cpu hotplug hook for event
 channels

commit 7beb290caa2adb0a399e735a1e175db9aae0523a upstream.

Today only fifo event channels have a cpu hotplug callback. In order
to prepare for more percpu (de)init work move that callback into
events_base.c and add percpu_init() and percpu_deinit() hooks to
struct evtchn_ops.

This is part of XSA-332.

Cc: stable@vger.kernel.org
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Wei Liu <wl@xen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/events/events_base.c     | 47 +++++++++++++++++++++
 drivers/xen/events/events_fifo.c     | 61 ++++++++++++----------------
 drivers/xen/events/events_internal.h |  3 ++
 3 files changed, 75 insertions(+), 36 deletions(-)

diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index fe01950ef78c..9e7cbc3369f7 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -33,6 +33,7 @@
 #include <linux/irqnr.h>
 #include <linux/pci.h>
 #include <linux/spinlock.h>
+#include <linux/cpu.h>
 
 #ifdef CONFIG_X86
 #include <asm/desc.h>
@@ -1832,6 +1833,50 @@ void xen_callback_vector(void) {}
 static bool fifo_events = true;
 module_param(fifo_events, bool, 0);
 
+static int xen_evtchn_cpu_prepare(unsigned int cpu)
+{
+	int ret = 0;
+
+	if (evtchn_ops->percpu_init)
+		ret = evtchn_ops->percpu_init(cpu);
+
+	return ret;
+}
+
+static int xen_evtchn_cpu_dead(unsigned int cpu)
+{
+	int ret = 0;
+
+	if (evtchn_ops->percpu_deinit)
+		ret = evtchn_ops->percpu_deinit(cpu);
+
+	return ret;
+}
+
+static int evtchn_cpu_notification(struct notifier_block *self,
+				   unsigned long action, void *hcpu)
+{
+	int cpu = (long)hcpu;
+	int ret = 0;
+
+	switch (action) {
+	case CPU_UP_PREPARE:
+		ret = xen_evtchn_cpu_prepare(cpu);
+		break;
+	case CPU_DEAD:
+		ret = xen_evtchn_cpu_dead(cpu);
+		break;
+	default:
+		break;
+	}
+
+	return ret < 0 ? NOTIFY_BAD : NOTIFY_OK;
+}
+
+static struct notifier_block evtchn_cpu_notifier = {
+	.notifier_call  = evtchn_cpu_notification,
+};
+
 void __init xen_init_IRQ(void)
 {
 	int ret = -EINVAL;
@@ -1841,6 +1886,8 @@ void __init xen_init_IRQ(void)
 	if (ret < 0)
 		xen_evtchn_2l_init();
 
+	register_cpu_notifier(&evtchn_cpu_notifier);
+
 	evtchn_to_irq = kcalloc(EVTCHN_ROW(xen_evtchn_max_channels()),
 				sizeof(*evtchn_to_irq), GFP_KERNEL);
 	BUG_ON(!evtchn_to_irq);
diff --git a/drivers/xen/events/events_fifo.c b/drivers/xen/events/events_fifo.c
index ce909d830973..db809ee3197b 100644
--- a/drivers/xen/events/events_fifo.c
+++ b/drivers/xen/events/events_fifo.c
@@ -386,21 +386,6 @@ static void evtchn_fifo_resume(void)
 	event_array_pages = 0;
 }
 
-static const struct evtchn_ops evtchn_ops_fifo = {
-	.max_channels      = evtchn_fifo_max_channels,
-	.nr_channels       = evtchn_fifo_nr_channels,
-	.setup             = evtchn_fifo_setup,
-	.bind_to_cpu       = evtchn_fifo_bind_to_cpu,
-	.clear_pending     = evtchn_fifo_clear_pending,
-	.set_pending       = evtchn_fifo_set_pending,
-	.is_pending        = evtchn_fifo_is_pending,
-	.test_and_set_mask = evtchn_fifo_test_and_set_mask,
-	.mask              = evtchn_fifo_mask,
-	.unmask            = evtchn_fifo_unmask,
-	.handle_events     = evtchn_fifo_handle_events,
-	.resume            = evtchn_fifo_resume,
-};
-
 static int evtchn_fifo_alloc_control_block(unsigned cpu)
 {
 	void *control_block = NULL;
@@ -423,29 +408,34 @@ static int evtchn_fifo_alloc_control_block(unsigned cpu)
 	return ret;
 }
 
-static int evtchn_fifo_cpu_notification(struct notifier_block *self,
-						  unsigned long action,
-						  void *hcpu)
+static int evtchn_fifo_percpu_init(unsigned int cpu)
 {
-	int cpu = (long)hcpu;
-	int ret = 0;
-
-	switch (action) {
-	case CPU_UP_PREPARE:
-		if (!per_cpu(cpu_control_block, cpu))
-			ret = evtchn_fifo_alloc_control_block(cpu);
-		break;
-	case CPU_DEAD:
-		__evtchn_fifo_handle_events(cpu, true);
-		break;
-	default:
-		break;
-	}
-	return ret < 0 ? NOTIFY_BAD : NOTIFY_OK;
+	if (!per_cpu(cpu_control_block, cpu))
+		return evtchn_fifo_alloc_control_block(cpu);
+	return 0;
 }
 
-static struct notifier_block evtchn_fifo_cpu_notifier = {
-	.notifier_call	= evtchn_fifo_cpu_notification,
+static int evtchn_fifo_percpu_deinit(unsigned int cpu)
+{
+	__evtchn_fifo_handle_events(cpu, true);
+	return 0;
+}
+
+static const struct evtchn_ops evtchn_ops_fifo = {
+	.max_channels      = evtchn_fifo_max_channels,
+	.nr_channels       = evtchn_fifo_nr_channels,
+	.setup             = evtchn_fifo_setup,
+	.bind_to_cpu       = evtchn_fifo_bind_to_cpu,
+	.clear_pending     = evtchn_fifo_clear_pending,
+	.set_pending       = evtchn_fifo_set_pending,
+	.is_pending        = evtchn_fifo_is_pending,
+	.test_and_set_mask = evtchn_fifo_test_and_set_mask,
+	.mask              = evtchn_fifo_mask,
+	.unmask            = evtchn_fifo_unmask,
+	.handle_events     = evtchn_fifo_handle_events,
+	.resume            = evtchn_fifo_resume,
+	.percpu_init       = evtchn_fifo_percpu_init,
+	.percpu_deinit     = evtchn_fifo_percpu_deinit,
 };
 
 int __init xen_evtchn_fifo_init(void)
@@ -461,7 +451,6 @@ int __init xen_evtchn_fifo_init(void)
 
 	evtchn_ops = &evtchn_ops_fifo;
 
-	register_cpu_notifier(&evtchn_fifo_cpu_notifier);
 out:
 	put_cpu();
 	return ret;
diff --git a/drivers/xen/events/events_internal.h b/drivers/xen/events/events_internal.h
index 50c2050a1e32..980a56d51e4c 100644
--- a/drivers/xen/events/events_internal.h
+++ b/drivers/xen/events/events_internal.h
@@ -71,6 +71,9 @@ struct evtchn_ops {
 
 	void (*handle_events)(unsigned cpu);
 	void (*resume)(void);
+
+	int (*percpu_init)(unsigned int cpu);
+	int (*percpu_deinit)(unsigned int cpu);
 };
 
 extern const struct evtchn_ops *evtchn_ops;

From e0f392a01ac03de36b7314952c6d00508a245be2 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 3 Nov 2020 17:22:37 +0100
Subject: [PATCH 1024/2658] xen/events: defer eoi in case of excessive number
 of events

commit e99502f76271d6bc4e374fe368c50c67a1fd3070 upstream.

In case rogue guests are sending events at high frequency it might
happen that xen_evtchn_do_upcall() won't stop processing events in
dom0. As this is done in irq handling a crash might be the result.

In order to avoid that, delay further inter-domain events after some
time in xen_evtchn_do_upcall() by forcing eoi processing into a
worker on the same cpu, thus inhibiting new events coming in.

The time after which eoi processing is to be delayed is configurable
via a new module parameter "event_loop_timeout" which specifies the
maximum event loop time in jiffies (default: 2, the value was chosen
after some tests showing that a value of 2 was the lowest with an
only slight drop of dom0 network throughput while multiple guests
performed an event storm).

How long eoi processing will be delayed can be specified via another
parameter "event_eoi_delay" (again in jiffies, default 10, again the
value was chosen after testing with different delay values).

This is part of XSA-332.

Cc: stable@vger.kernel.org
Reported-by: Julien Grall <julien@xen.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Wei Liu <wl@xen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/kernel-parameters.txt  |   8 ++
 drivers/xen/events/events_2l.c       |   7 +-
 drivers/xen/events/events_base.c     | 189 ++++++++++++++++++++++++++-
 drivers/xen/events/events_fifo.c     |  30 ++---
 drivers/xen/events/events_internal.h |  14 +-
 5 files changed, 216 insertions(+), 32 deletions(-)

diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 6f9a8013cafd..9d27670c7a2f 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -4522,6 +4522,14 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 			Disables the PV optimizations forcing the HVM guest to
 			run as generic HVM guest with no PV drivers.
 
+	xen.event_eoi_delay=	[XEN]
+			How long to delay EOI handling in case of event
+			storms (jiffies). Default is 10.
+
+	xen.event_loop_timeout=	[XEN]
+			After which time (jiffies) the event handling loop
+			should start to delay EOI handling. Default is 2.
+
 	xirc2ps_cs=	[NET,PCMCIA]
 			Format:
 			<irq>,<irq_mask>,<io>,<full_duplex>,<do_sound>,<lockup_hack>[,<irq2>[,<irq3>[,<irq4>]]]
diff --git a/drivers/xen/events/events_2l.c b/drivers/xen/events/events_2l.c
index 04d1b025b29d..e902512fcfb5 100644
--- a/drivers/xen/events/events_2l.c
+++ b/drivers/xen/events/events_2l.c
@@ -160,7 +160,7 @@ static inline xen_ulong_t active_evtchns(unsigned int cpu,
  * a bitset of words which contain pending event bits.  The second
  * level is a bitset of pending events themselves.
  */
-static void evtchn_2l_handle_events(unsigned cpu)
+static void evtchn_2l_handle_events(unsigned cpu, struct evtchn_loop_ctrl *ctrl)
 {
 	int irq;
 	xen_ulong_t pending_words;
@@ -241,10 +241,7 @@ static void evtchn_2l_handle_events(unsigned cpu)
 
 			/* Process port. */
 			port = (word_idx * BITS_PER_EVTCHN_WORD) + bit_idx;
-			irq = get_evtchn_to_irq(port);
-
-			if (irq != -1)
-				generic_handle_irq(irq);
+			handle_irq_for_port(port, ctrl);
 
 			bit_idx = (bit_idx + 1) % BITS_PER_EVTCHN_WORD;
 
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 9e7cbc3369f7..07cef5fb4515 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -34,6 +34,8 @@
 #include <linux/pci.h>
 #include <linux/spinlock.h>
 #include <linux/cpu.h>
+#include <linux/atomic.h>
+#include <linux/ktime.h>
 
 #ifdef CONFIG_X86
 #include <asm/desc.h>
@@ -64,6 +66,15 @@
 
 #include "events_internal.h"
 
+#undef MODULE_PARAM_PREFIX
+#define MODULE_PARAM_PREFIX "xen."
+
+static uint __read_mostly event_loop_timeout = 2;
+module_param(event_loop_timeout, uint, 0644);
+
+static uint __read_mostly event_eoi_delay = 10;
+module_param(event_eoi_delay, uint, 0644);
+
 const struct evtchn_ops *evtchn_ops;
 
 /*
@@ -87,6 +98,7 @@ static DEFINE_RWLOCK(evtchn_rwlock);
  * irq_mapping_update_lock
  *   evtchn_rwlock
  *     IRQ-desc lock
+ *       percpu eoi_list_lock
  */
 
 static LIST_HEAD(xen_irq_list_head);
@@ -119,6 +131,8 @@ static struct irq_chip xen_pirq_chip;
 static void enable_dynirq(struct irq_data *data);
 static void disable_dynirq(struct irq_data *data);
 
+static DEFINE_PER_CPU(unsigned int, irq_epoch);
+
 static void clear_evtchn_to_irq_row(unsigned row)
 {
 	unsigned col;
@@ -406,17 +420,120 @@ void notify_remote_via_irq(int irq)
 }
 EXPORT_SYMBOL_GPL(notify_remote_via_irq);
 
+struct lateeoi_work {
+	struct delayed_work delayed;
+	spinlock_t eoi_list_lock;
+	struct list_head eoi_list;
+};
+
+static DEFINE_PER_CPU(struct lateeoi_work, lateeoi);
+
+static void lateeoi_list_del(struct irq_info *info)
+{
+	struct lateeoi_work *eoi = &per_cpu(lateeoi, info->eoi_cpu);
+	unsigned long flags;
+
+	spin_lock_irqsave(&eoi->eoi_list_lock, flags);
+	list_del_init(&info->eoi_list);
+	spin_unlock_irqrestore(&eoi->eoi_list_lock, flags);
+}
+
+static void lateeoi_list_add(struct irq_info *info)
+{
+	struct lateeoi_work *eoi = &per_cpu(lateeoi, info->eoi_cpu);
+	struct irq_info *elem;
+	u64 now = get_jiffies_64();
+	unsigned long delay;
+	unsigned long flags;
+
+	if (now < info->eoi_time)
+		delay = info->eoi_time - now;
+	else
+		delay = 1;
+
+	spin_lock_irqsave(&eoi->eoi_list_lock, flags);
+
+	if (list_empty(&eoi->eoi_list)) {
+		list_add(&info->eoi_list, &eoi->eoi_list);
+		mod_delayed_work_on(info->eoi_cpu, system_wq,
+				    &eoi->delayed, delay);
+	} else {
+		list_for_each_entry_reverse(elem, &eoi->eoi_list, eoi_list) {
+			if (elem->eoi_time <= info->eoi_time)
+				break;
+		}
+		list_add(&info->eoi_list, &elem->eoi_list);
+	}
+
+	spin_unlock_irqrestore(&eoi->eoi_list_lock, flags);
+}
+
 static void xen_irq_lateeoi_locked(struct irq_info *info)
 {
 	evtchn_port_t evtchn;
+	unsigned int cpu;
 
 	evtchn = info->evtchn;
-	if (!VALID_EVTCHN(evtchn))
+	if (!VALID_EVTCHN(evtchn) || !list_empty(&info->eoi_list))
 		return;
 
+	cpu = info->eoi_cpu;
+	if (info->eoi_time && info->irq_epoch == per_cpu(irq_epoch, cpu)) {
+		lateeoi_list_add(info);
+		return;
+	}
+
+	info->eoi_time = 0;
 	unmask_evtchn(evtchn);
 }
 
+static void xen_irq_lateeoi_worker(struct work_struct *work)
+{
+	struct lateeoi_work *eoi;
+	struct irq_info *info;
+	u64 now = get_jiffies_64();
+	unsigned long flags;
+
+	eoi = container_of(to_delayed_work(work), struct lateeoi_work, delayed);
+
+	read_lock_irqsave(&evtchn_rwlock, flags);
+
+	while (true) {
+		spin_lock(&eoi->eoi_list_lock);
+
+		info = list_first_entry_or_null(&eoi->eoi_list, struct irq_info,
+						eoi_list);
+
+		if (info == NULL || now < info->eoi_time) {
+			spin_unlock(&eoi->eoi_list_lock);
+			break;
+		}
+
+		list_del_init(&info->eoi_list);
+
+		spin_unlock(&eoi->eoi_list_lock);
+
+		info->eoi_time = 0;
+
+		xen_irq_lateeoi_locked(info);
+	}
+
+	if (info)
+		mod_delayed_work_on(info->eoi_cpu, system_wq,
+				    &eoi->delayed, info->eoi_time - now);
+
+	read_unlock_irqrestore(&evtchn_rwlock, flags);
+}
+
+static void xen_cpu_init_eoi(unsigned int cpu)
+{
+	struct lateeoi_work *eoi = &per_cpu(lateeoi, cpu);
+
+	INIT_DELAYED_WORK(&eoi->delayed, xen_irq_lateeoi_worker);
+	spin_lock_init(&eoi->eoi_list_lock);
+	INIT_LIST_HEAD(&eoi->eoi_list);
+}
+
 void xen_irq_lateeoi(unsigned int irq, unsigned int eoi_flags)
 {
 	struct irq_info *info;
@@ -436,6 +553,7 @@ EXPORT_SYMBOL_GPL(xen_irq_lateeoi);
 static void xen_irq_init(unsigned irq)
 {
 	struct irq_info *info;
+
 #ifdef CONFIG_SMP
 	/* By default all event channels notify CPU#0. */
 	cpumask_copy(irq_get_affinity_mask(irq), cpumask_of(0));
@@ -450,6 +568,7 @@ static void xen_irq_init(unsigned irq)
 
 	set_info_for_irq(irq, info);
 
+	INIT_LIST_HEAD(&info->eoi_list);
 	list_add_tail(&info->list, &xen_irq_list_head);
 }
 
@@ -505,6 +624,9 @@ static void xen_free_irq(unsigned irq)
 
 	write_lock_irqsave(&evtchn_rwlock, flags);
 
+	if (!list_empty(&info->eoi_list))
+		lateeoi_list_del(info);
+
 	list_del(&info->list);
 
 	set_info_for_irq(irq, NULL);
@@ -1363,6 +1485,54 @@ void xen_send_IPI_one(unsigned int cpu, enum ipi_vector vector)
 	notify_remote_via_irq(irq);
 }
 
+struct evtchn_loop_ctrl {
+	ktime_t timeout;
+	unsigned count;
+	bool defer_eoi;
+};
+
+void handle_irq_for_port(evtchn_port_t port, struct evtchn_loop_ctrl *ctrl)
+{
+	int irq;
+	struct irq_info *info;
+
+	irq = get_evtchn_to_irq(port);
+	if (irq == -1)
+		return;
+
+	/*
+	 * Check for timeout every 256 events.
+	 * We are setting the timeout value only after the first 256
+	 * events in order to not hurt the common case of few loop
+	 * iterations. The 256 is basically an arbitrary value.
+	 *
+	 * In case we are hitting the timeout we need to defer all further
+	 * EOIs in order to ensure to leave the event handling loop rather
+	 * sooner than later.
+	 */
+	if (!ctrl->defer_eoi && !(++ctrl->count & 0xff)) {
+		ktime_t kt = ktime_get();
+
+		if (!ctrl->timeout.tv64) {
+			kt = ktime_add_ms(kt,
+					  jiffies_to_msecs(event_loop_timeout));
+			ctrl->timeout = kt;
+		} else if (kt.tv64 > ctrl->timeout.tv64) {
+			ctrl->defer_eoi = true;
+		}
+	}
+
+	info = info_for_irq(irq);
+
+	if (ctrl->defer_eoi) {
+		info->eoi_cpu = smp_processor_id();
+		info->irq_epoch = __this_cpu_read(irq_epoch);
+		info->eoi_time = get_jiffies_64() + event_eoi_delay;
+	}
+
+	generic_handle_irq(irq);
+}
+
 static DEFINE_PER_CPU(unsigned, xed_nesting_count);
 
 static void __xen_evtchn_do_upcall(void)
@@ -1370,6 +1540,7 @@ static void __xen_evtchn_do_upcall(void)
 	struct vcpu_info *vcpu_info = __this_cpu_read(xen_vcpu);
 	int cpu = get_cpu();
 	unsigned count;
+	struct evtchn_loop_ctrl ctrl = { 0 };
 
 	read_lock(&evtchn_rwlock);
 
@@ -1379,7 +1550,7 @@ static void __xen_evtchn_do_upcall(void)
 		if (__this_cpu_inc_return(xed_nesting_count) - 1)
 			goto out;
 
-		xen_evtchn_handle_events(cpu);
+		xen_evtchn_handle_events(cpu, &ctrl);
 
 		BUG_ON(!irqs_disabled());
 
@@ -1390,6 +1561,13 @@ static void __xen_evtchn_do_upcall(void)
 out:
 	read_unlock(&evtchn_rwlock);
 
+	/*
+	 * Increment irq_epoch only now to defer EOIs only for
+	 * xen_irq_lateeoi() invocations occurring from inside the loop
+	 * above.
+	 */
+	__this_cpu_inc(irq_epoch);
+
 	put_cpu();
 }
 
@@ -1827,9 +2005,6 @@ void xen_callback_vector(void)
 void xen_callback_vector(void) {}
 #endif
 
-#undef MODULE_PARAM_PREFIX
-#define MODULE_PARAM_PREFIX "xen."
-
 static bool fifo_events = true;
 module_param(fifo_events, bool, 0);
 
@@ -1837,6 +2012,8 @@ static int xen_evtchn_cpu_prepare(unsigned int cpu)
 {
 	int ret = 0;
 
+	xen_cpu_init_eoi(cpu);
+
 	if (evtchn_ops->percpu_init)
 		ret = evtchn_ops->percpu_init(cpu);
 
@@ -1886,6 +2063,8 @@ void __init xen_init_IRQ(void)
 	if (ret < 0)
 		xen_evtchn_2l_init();
 
+	xen_cpu_init_eoi(smp_processor_id());
+
 	register_cpu_notifier(&evtchn_cpu_notifier);
 
 	evtchn_to_irq = kcalloc(EVTCHN_ROW(xen_evtchn_max_channels()),
diff --git a/drivers/xen/events/events_fifo.c b/drivers/xen/events/events_fifo.c
index db809ee3197b..7addca0d8d26 100644
--- a/drivers/xen/events/events_fifo.c
+++ b/drivers/xen/events/events_fifo.c
@@ -275,19 +275,9 @@ static uint32_t clear_linked(volatile event_word_t *word)
 	return w & EVTCHN_FIFO_LINK_MASK;
 }
 
-static void handle_irq_for_port(unsigned port)
-{
-	int irq;
-
-	irq = get_evtchn_to_irq(port);
-	if (irq != -1)
-		generic_handle_irq(irq);
-}
-
-static void consume_one_event(unsigned cpu,
+static void consume_one_event(unsigned cpu, struct evtchn_loop_ctrl *ctrl,
 			      struct evtchn_fifo_control_block *control_block,
-			      unsigned priority, unsigned long *ready,
-			      bool drop)
+			      unsigned priority, unsigned long *ready)
 {
 	struct evtchn_fifo_queue *q = &per_cpu(cpu_queue, cpu);
 	uint32_t head;
@@ -320,16 +310,17 @@ static void consume_one_event(unsigned cpu,
 		clear_bit(priority, ready);
 
 	if (evtchn_fifo_is_pending(port) && !evtchn_fifo_is_masked(port)) {
-		if (unlikely(drop))
+		if (unlikely(!ctrl))
 			pr_warn("Dropping pending event for port %u\n", port);
 		else
-			handle_irq_for_port(port);
+			handle_irq_for_port(port, ctrl);
 	}
 
 	q->head[priority] = head;
 }
 
-static void __evtchn_fifo_handle_events(unsigned cpu, bool drop)
+static void __evtchn_fifo_handle_events(unsigned cpu,
+					struct evtchn_loop_ctrl *ctrl)
 {
 	struct evtchn_fifo_control_block *control_block;
 	unsigned long ready;
@@ -341,14 +332,15 @@ static void __evtchn_fifo_handle_events(unsigned cpu, bool drop)
 
 	while (ready) {
 		q = find_first_bit(&ready, EVTCHN_FIFO_MAX_QUEUES);
-		consume_one_event(cpu, control_block, q, &ready, drop);
+		consume_one_event(cpu, ctrl, control_block, q, &ready);
 		ready |= xchg(&control_block->ready, 0);
 	}
 }
 
-static void evtchn_fifo_handle_events(unsigned cpu)
+static void evtchn_fifo_handle_events(unsigned cpu,
+				      struct evtchn_loop_ctrl *ctrl)
 {
-	__evtchn_fifo_handle_events(cpu, false);
+	__evtchn_fifo_handle_events(cpu, ctrl);
 }
 
 static void evtchn_fifo_resume(void)
@@ -417,7 +409,7 @@ static int evtchn_fifo_percpu_init(unsigned int cpu)
 
 static int evtchn_fifo_percpu_deinit(unsigned int cpu)
 {
-	__evtchn_fifo_handle_events(cpu, true);
+	__evtchn_fifo_handle_events(cpu, NULL);
 	return 0;
 }
 
diff --git a/drivers/xen/events/events_internal.h b/drivers/xen/events/events_internal.h
index 980a56d51e4c..2cb9c2d2c5c0 100644
--- a/drivers/xen/events/events_internal.h
+++ b/drivers/xen/events/events_internal.h
@@ -32,11 +32,15 @@ enum xen_irq_type {
  */
 struct irq_info {
 	struct list_head list;
+	struct list_head eoi_list;
 	int refcnt;
 	enum xen_irq_type type;	/* type */
 	unsigned irq;
 	unsigned int evtchn;	/* event channel */
 	unsigned short cpu;	/* cpu bound */
+	unsigned short eoi_cpu;	/* EOI must happen on this cpu */
+	unsigned int irq_epoch;	/* If eoi_cpu valid: irq_epoch of event */
+	u64 eoi_time;		/* Time in jiffies when to EOI. */
 
 	union {
 		unsigned short virq;
@@ -55,6 +59,8 @@ struct irq_info {
 #define PIRQ_SHAREABLE	(1 << 1)
 #define PIRQ_MSI_GROUP	(1 << 2)
 
+struct evtchn_loop_ctrl;
+
 struct evtchn_ops {
 	unsigned (*max_channels)(void);
 	unsigned (*nr_channels)(void);
@@ -69,7 +75,7 @@ struct evtchn_ops {
 	void (*mask)(unsigned port);
 	void (*unmask)(unsigned port);
 
-	void (*handle_events)(unsigned cpu);
+	void (*handle_events)(unsigned cpu, struct evtchn_loop_ctrl *ctrl);
 	void (*resume)(void);
 
 	int (*percpu_init)(unsigned int cpu);
@@ -80,6 +86,7 @@ extern const struct evtchn_ops *evtchn_ops;
 
 extern int **evtchn_to_irq;
 int get_evtchn_to_irq(unsigned int evtchn);
+void handle_irq_for_port(evtchn_port_t port, struct evtchn_loop_ctrl *ctrl);
 
 struct irq_info *info_for_irq(unsigned irq);
 unsigned cpu_from_irq(unsigned irq);
@@ -137,9 +144,10 @@ static inline void unmask_evtchn(unsigned port)
 	return evtchn_ops->unmask(port);
 }
 
-static inline void xen_evtchn_handle_events(unsigned cpu)
+static inline void xen_evtchn_handle_events(unsigned cpu,
+					    struct evtchn_loop_ctrl *ctrl)
 {
-	return evtchn_ops->handle_events(cpu);
+	return evtchn_ops->handle_events(cpu, ctrl);
 }
 
 static inline void xen_evtchn_resume(void)

From fbc2d05454033377292af5b9a4e5928e1eab6c62 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 3 Nov 2020 17:22:38 +0100
Subject: [PATCH 1025/2658] xen/events: block rogue events for some time

commit 5f7f77400ab5b357b5fdb7122c3442239672186c upstream.

In order to avoid high dom0 load due to rogue guests sending events at
high frequency, block those events in case there was no action needed
in dom0 to handle the events.

This is done by adding a per-event counter, which set to zero in case
an EOI without the XEN_EOI_FLAG_SPURIOUS is received from a backend
driver, and incremented when this flag has been set. In case the
counter is 2 or higher delay the EOI by 1 << (cnt - 2) jiffies, but
not more than 1 second.

In order not to waste memory shorten the per-event refcnt to two bytes
(it should normally never exceed a value of 2). Add an overflow check
to evtchn_get() to make sure the 2 bytes really won't overflow.

This is part of XSA-332.

Cc: stable@vger.kernel.org
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Wei Liu <wl@xen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/events/events_base.c     | 27 ++++++++++++++++++++++-----
 drivers/xen/events/events_internal.h |  3 ++-
 2 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 07cef5fb4515..ec4074c66d9d 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -468,17 +468,34 @@ static void lateeoi_list_add(struct irq_info *info)
 	spin_unlock_irqrestore(&eoi->eoi_list_lock, flags);
 }
 
-static void xen_irq_lateeoi_locked(struct irq_info *info)
+static void xen_irq_lateeoi_locked(struct irq_info *info, bool spurious)
 {
 	evtchn_port_t evtchn;
 	unsigned int cpu;
+	unsigned int delay = 0;
 
 	evtchn = info->evtchn;
 	if (!VALID_EVTCHN(evtchn) || !list_empty(&info->eoi_list))
 		return;
 
+	if (spurious) {
+		if ((1 << info->spurious_cnt) < (HZ << 2))
+			info->spurious_cnt++;
+		if (info->spurious_cnt > 1) {
+			delay = 1 << (info->spurious_cnt - 2);
+			if (delay > HZ)
+				delay = HZ;
+			if (!info->eoi_time)
+				info->eoi_cpu = smp_processor_id();
+			info->eoi_time = get_jiffies_64() + delay;
+		}
+	} else {
+		info->spurious_cnt = 0;
+	}
+
 	cpu = info->eoi_cpu;
-	if (info->eoi_time && info->irq_epoch == per_cpu(irq_epoch, cpu)) {
+	if (info->eoi_time &&
+	    (info->irq_epoch == per_cpu(irq_epoch, cpu) || delay)) {
 		lateeoi_list_add(info);
 		return;
 	}
@@ -515,7 +532,7 @@ static void xen_irq_lateeoi_worker(struct work_struct *work)
 
 		info->eoi_time = 0;
 
-		xen_irq_lateeoi_locked(info);
+		xen_irq_lateeoi_locked(info, false);
 	}
 
 	if (info)
@@ -544,7 +561,7 @@ void xen_irq_lateeoi(unsigned int irq, unsigned int eoi_flags)
 	info = info_for_irq(irq);
 
 	if (info)
-		xen_irq_lateeoi_locked(info);
+		xen_irq_lateeoi_locked(info, eoi_flags & XEN_EOI_FLAG_SPURIOUS);
 
 	read_unlock_irqrestore(&evtchn_rwlock, flags);
 }
@@ -1447,7 +1464,7 @@ int evtchn_get(unsigned int evtchn)
 		goto done;
 
 	err = -EINVAL;
-	if (info->refcnt <= 0)
+	if (info->refcnt <= 0 || info->refcnt == SHRT_MAX)
 		goto done;
 
 	info->refcnt++;
diff --git a/drivers/xen/events/events_internal.h b/drivers/xen/events/events_internal.h
index 2cb9c2d2c5c0..b9b4f5919893 100644
--- a/drivers/xen/events/events_internal.h
+++ b/drivers/xen/events/events_internal.h
@@ -33,7 +33,8 @@ enum xen_irq_type {
 struct irq_info {
 	struct list_head list;
 	struct list_head eoi_list;
-	int refcnt;
+	short refcnt;
+	short spurious_cnt;
 	enum xen_irq_type type;	/* type */
 	unsigned irq;
 	unsigned int evtchn;	/* event channel */

From 631546f7897dc73197515e92786ab8c6a3679f5b Mon Sep 17 00:00:00 2001
From: Jiri Olsa <jolsa@redhat.com>
Date: Wed, 16 Sep 2020 13:53:11 +0200
Subject: [PATCH 1026/2658] perf/core: Fix race in the perf_mmap_close()
 function

commit f91072ed1b7283b13ca57fcfbece5a3b92726143 upstream.

There's a possible race in perf_mmap_close() when checking ring buffer's
mmap_count refcount value. The problem is that the mmap_count check is
not atomic because we call atomic_dec() and atomic_read() separately.

  perf_mmap_close:
  ...
   atomic_dec(&rb->mmap_count);
   ...
   if (atomic_read(&rb->mmap_count))
      goto out_put;

   <ring buffer detach>
   free_uid

out_put:
  ring_buffer_put(rb); /* could be last */

The race can happen when we have two (or more) events sharing same ring
buffer and they go through atomic_dec() and then they both see 0 as refcount
value later in atomic_read(). Then both will go on and execute code which
is meant to be run just once.

The code that detaches ring buffer is probably fine to be executed more
than once, but the problem is in calling free_uid(), which will later on
demonstrate in related crashes and refcount warnings, like:

  refcount_t: addition on 0; use-after-free.
  ...
  RIP: 0010:refcount_warn_saturate+0x6d/0xf
  ...
  Call Trace:
  prepare_creds+0x190/0x1e0
  copy_creds+0x35/0x172
  copy_process+0x471/0x1a80
  _do_fork+0x83/0x3a0
  __do_sys_wait4+0x83/0x90
  __do_sys_clone+0x85/0xa0
  do_syscall_64+0x5b/0x1e0
  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Using atomic decrease and check instead of separated calls.

Tested-by: Michael Petlan <mpetlan@redhat.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Acked-by: Wade Mealing <wmealing@redhat.com>
Fixes: 9bb5d40cd93c ("perf: Fix mmap() accounting hole");
Link: https://lore.kernel.org/r/20200916115311.GE2301783@krava
[sudip: backport to v4.9.y by using ring_buffer]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/events/core.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 9f9d1590a215..8214073f9eb8 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -4768,11 +4768,11 @@ static void perf_pmu_output_stop(struct perf_event *event);
 static void perf_mmap_close(struct vm_area_struct *vma)
 {
 	struct perf_event *event = vma->vm_file->private_data;
-
 	struct ring_buffer *rb = ring_buffer_get(event);
 	struct user_struct *mmap_user = rb->mmap_user;
 	int mmap_locked = rb->mmap_locked;
 	unsigned long size = perf_data_size(rb);
+	bool detach_rest = false;
 
 	if (event->pmu->event_unmapped)
 		event->pmu->event_unmapped(event);
@@ -4803,7 +4803,8 @@ static void perf_mmap_close(struct vm_area_struct *vma)
 		mutex_unlock(&event->mmap_mutex);
 	}
 
-	atomic_dec(&rb->mmap_count);
+	if (atomic_dec_and_test(&rb->mmap_count))
+		detach_rest = true;
 
 	if (!atomic_dec_and_mutex_lock(&event->mmap_count, &event->mmap_mutex))
 		goto out_put;
@@ -4812,7 +4813,7 @@ static void perf_mmap_close(struct vm_area_struct *vma)
 	mutex_unlock(&event->mmap_mutex);
 
 	/* If there's still other mmap()s of this buffer, we're done. */
-	if (atomic_read(&rb->mmap_count))
+	if (!detach_rest)
 		goto out_put;
 
 	/*

From e60f2b0f68450d497c472089445d9991adc787c3 Mon Sep 17 00:00:00 2001
From: Matteo Croce <mcroce@microsoft.com>
Date: Fri, 13 Nov 2020 22:52:02 -0800
Subject: [PATCH 1027/2658] Revert "kernel/reboot.c: convert simple_strtoul to
 kstrtoint"

commit 8b92c4ff4423aa9900cf838d3294fcade4dbda35 upstream.

Patch series "fix parsing of reboot= cmdline", v3.

The parsing of the reboot= cmdline has two major errors:

 - a missing bound check can crash the system on reboot

 - parsing of the cpu number only works if specified last

Fix both.

This patch (of 2):

This reverts commit 616feab753972b97.

kstrtoint() and simple_strtoul() have a subtle difference which makes
them non interchangeable: if a non digit character is found amid the
parsing, the former will return an error, while the latter will just
stop parsing, e.g.  simple_strtoul("123xyx") = 123.

The kernel cmdline reboot= argument allows to specify the CPU used for
rebooting, with the syntax `s####` among the other flags, e.g.
"reboot=warm,s31,force", so if this flag is not the last given, it's
silently ignored as well as the subsequent ones.

Fixes: 616feab75397 ("kernel/reboot.c: convert simple_strtoul to kstrtoint")
Signed-off-by: Matteo Croce <mcroce@microsoft.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Pavel Tatashin <pasha.tatashin@soleen.com>
Cc: Robin Holt <robinmholt@gmail.com>
Cc: Fabian Frederick <fabf@skynet.be>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20201103214025.116799-2-mcroce@linux.microsoft.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[sudip: use reboot_mode instead of mode]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/reboot.c | 21 +++++++--------------
 1 file changed, 7 insertions(+), 14 deletions(-)

diff --git a/kernel/reboot.c b/kernel/reboot.c
index 5c1d0ba6bcd1..25c8cae97354 100644
--- a/kernel/reboot.c
+++ b/kernel/reboot.c
@@ -520,22 +520,15 @@ static int __init reboot_setup(char *str)
 			break;
 
 		case 's':
-		{
-			int rc;
-
-			if (isdigit(*(str+1))) {
-				rc = kstrtoint(str+1, 0, &reboot_cpu);
-				if (rc)
-					return rc;
-			} else if (str[1] == 'm' && str[2] == 'p' &&
-				   isdigit(*(str+3))) {
-				rc = kstrtoint(str+3, 0, &reboot_cpu);
-				if (rc)
-					return rc;
-			} else
+			if (isdigit(*(str+1)))
+				reboot_cpu = simple_strtoul(str+1, NULL, 0);
+			else if (str[1] == 'm' && str[2] == 'p' &&
+							isdigit(*(str+3)))
+				reboot_cpu = simple_strtoul(str+3, NULL, 0);
+			else
 				reboot_mode = REBOOT_SOFT;
 			break;
-		}
+
 		case 'g':
 			reboot_mode = REBOOT_GPIO;
 			break;

From 0a26e530b6a17e6f25ae0cc0e6bd52d8c757c5a6 Mon Sep 17 00:00:00 2001
From: Matteo Croce <mcroce@microsoft.com>
Date: Fri, 13 Nov 2020 22:52:07 -0800
Subject: [PATCH 1028/2658] reboot: fix overflow parsing reboot cpu number

commit df5b0ab3e08a156701b537809914b339b0daa526 upstream.

Limit the CPU number to num_possible_cpus(), because setting it to a
value lower than INT_MAX but higher than NR_CPUS produces the following
error on reboot and shutdown:

    BUG: unable to handle page fault for address: ffffffff90ab1bb0
    #PF: supervisor read access in kernel mode
    #PF: error_code(0x0000) - not-present page
    PGD 1c09067 P4D 1c09067 PUD 1c0a063 PMD 0
    Oops: 0000 [#1] SMP
    CPU: 1 PID: 1 Comm: systemd-shutdow Not tainted 5.9.0-rc8-kvm #110
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014
    RIP: 0010:migrate_to_reboot_cpu+0xe/0x60
    Code: ea ea 00 48 89 fa 48 c7 c7 30 57 f1 81 e9 fa ef ff ff 66 2e 0f 1f 84 00 00 00 00 00 53 8b 1d d5 ea ea 00 e8 14 33 fe ff 89 da <48> 0f a3 15 ea fc bd 00 48 89 d0 73 29 89 c2 c1 e8 06 65 48 8b 3c
    RSP: 0018:ffffc90000013e08 EFLAGS: 00010246
    RAX: ffff88801f0a0000 RBX: 0000000077359400 RCX: 0000000000000000
    RDX: 0000000077359400 RSI: 0000000000000002 RDI: ffffffff81c199e0
    RBP: ffffffff81c1e3c0 R08: ffff88801f41f000 R09: ffffffff81c1e348
    R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
    R13: 00007f32bedf8830 R14: 00000000fee1dead R15: 0000000000000000
    FS:  00007f32bedf8980(0000) GS:ffff88801f480000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: ffffffff90ab1bb0 CR3: 000000001d057000 CR4: 00000000000006a0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
      __do_sys_reboot.cold+0x34/0x5b
      do_syscall_64+0x2d/0x40

Fixes: 1b3a5d02ee07 ("reboot: move arch/x86 reboot= handling to generic kernel")
Signed-off-by: Matteo Croce <mcroce@microsoft.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Fabian Frederick <fabf@skynet.be>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Kees Cook <keescook@chromium.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Pavel Tatashin <pasha.tatashin@soleen.com>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Robin Holt <robinmholt@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20201103214025.116799-3-mcroce@linux.microsoft.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[sudip: use reboot_mode instead of mode]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/reboot.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/kernel/reboot.c b/kernel/reboot.c
index 25c8cae97354..3416c026337f 100644
--- a/kernel/reboot.c
+++ b/kernel/reboot.c
@@ -527,6 +527,13 @@ static int __init reboot_setup(char *str)
 				reboot_cpu = simple_strtoul(str+3, NULL, 0);
 			else
 				reboot_mode = REBOOT_SOFT;
+			if (reboot_cpu >= num_possible_cpus()) {
+				pr_err("Ignoring the CPU number in reboot= option. "
+				       "CPU %d exceeds possible cpu number %d\n",
+				       reboot_cpu, num_possible_cpus());
+				reboot_cpu = 0;
+				break;
+			}
 			break;
 
 		case 'g':

From 5a32bd71af52032444c46f622469f8f2375a6109 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Tue, 22 Sep 2020 09:24:56 -0700
Subject: [PATCH 1029/2658] ext4: fix leaking sysfs kobject after failed mount

commit cb8d53d2c97369029cc638c9274ac7be0a316c75 upstream.

ext4_unregister_sysfs() only deletes the kobject.  The reference to it
needs to be put separately, like ext4_put_super() does.

This addresses the syzbot report
"memory leak in kobject_set_name_vargs (3)"
(https://syzkaller.appspot.com/bug?extid=9f864abad79fae7c17e1).

Reported-by: syzbot+9f864abad79fae7c17e1@syzkaller.appspotmail.com
Fixes: 72ba74508b28 ("ext4: release sysfs kobject when failing to enable quotas on mount")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Link: https://lore.kernel.org/r/20200922162456.93657-1-ebiggers@kernel.org
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/super.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 92c6f445dd8d..ba0e52fa3e56 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -4147,6 +4147,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
 #ifdef CONFIG_QUOTA
 failed_mount8:
 	ext4_unregister_sysfs(sb);
+	kobject_put(&sbi->s_kobj);
 #endif
 failed_mount7:
 	ext4_unregister_li_request(sb);

From c1570f706eb12805acf95d6094910f07466e8932 Mon Sep 17 00:00:00 2001
From: Boris Protopopov <pboris@amazon.com>
Date: Thu, 24 Sep 2020 00:36:38 +0000
Subject: [PATCH 1030/2658] Convert trailing spaces and periods in path
 components

commit 57c176074057531b249cf522d90c22313fa74b0b upstream.

When converting trailing spaces and periods in paths, do so
for every component of the path, not just the last component.
If the conversion is not done for every path component, then
subsequent operations in directories with trailing spaces or
periods (e.g. create(), mkdir()) will fail with ENOENT. This
is because on the server, the directory will have a special
symbol in its name, and the client needs to provide the same.

Signed-off-by: Boris Protopopov <pboris@amazon.com>
Acked-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/cifs_unicode.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 211ac472cb9d..942874257a09 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -493,7 +493,13 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
 		else if (map_chars == SFM_MAP_UNI_RSVD) {
 			bool end_of_string;
 
-			if (i == srclen - 1)
+			/**
+			 * Remap spaces and periods found at the end of every
+			 * component of the path. The special cases of '.' and
+			 * '..' do not need to be dealt with explicitly because
+			 * they are addressed in namei.c:link_path_walk().
+			 **/
+			if ((i == srclen - 1) || (source[i+1] == '\\'))
 				end_of_string = true;
 			else
 				end_of_string = false;

From 0e03c55d2d2dbaf6ec9230529a3903e01df7ef30 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 18 Nov 2020 18:25:04 +0100
Subject: [PATCH 1031/2658] Linux 4.4.244

Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20201117122106.144800239@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index ef381f15cb7c..4e13e9b31f71 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 243
+SUBLEVEL = 244
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From bcc0a0af07c95306e02930f54e7141ae1e7e3222 Mon Sep 17 00:00:00 2001
From: Daniel Axtens <dja@axtens.net>
Date: Fri, 20 Nov 2020 11:06:57 +1100
Subject: [PATCH 1032/2658] powerpc/64s: Define
 MASKABLE_RELON_EXCEPTION_PSERIES_OOL

Add a definition provided by mpe and fixed up for 4.4. It doesn't exist
for 4.4 and we'd quite like to use it.

Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/include/asm/exception-64s.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
index 3ed536bec462..26f00ab2d0c9 100644
--- a/arch/powerpc/include/asm/exception-64s.h
+++ b/arch/powerpc/include/asm/exception-64s.h
@@ -597,6 +597,12 @@ label##_relon_hv:							\
 	EXCEPTION_PROLOG_1(PACA_EXGEN, SOFTEN_NOTEST_HV, vec);		\
 	EXCEPTION_PROLOG_PSERIES_1(label##_common, EXC_HV);
 
+#define MASKABLE_RELON_EXCEPTION_PSERIES_OOL(vec, label)               \
+       .globl label##_relon_pSeries;                                   \
+label##_relon_pSeries:                                                 \
+       EXCEPTION_PROLOG_1(PACA_EXGEN, SOFTEN_NOTEST_PR, vec);          \
+       EXCEPTION_PROLOG_PSERIES_1(label##_common, EXC_STD)
+
 /*
  * Our exception common code can be passed various "additions"
  * to specify the behaviour of interrupts, whether to kick the

From 0363ad42648ad9276847f067eaa9af21c88c793e Mon Sep 17 00:00:00 2001
From: Daniel Axtens <dja@axtens.net>
Date: Fri, 20 Nov 2020 11:06:58 +1100
Subject: [PATCH 1033/2658] powerpc/64s: move some exception handlers out of
 line

(backport only)

We're about to grow the exception handlers, which will make a bunch of them
no longer fit within the space available. We move them out of line.

This is a fiddly and error-prone business, so in the interests of reviewability
I haven't merged this in with the addition of the entry flush.

Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kernel/exceptions-64s.S | 138 +++++++++++++++++----------
 1 file changed, 90 insertions(+), 48 deletions(-)

diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 536718ed033f..3d843e1a162c 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -202,8 +202,8 @@ ALT_FTR_SECTION_END_IFSET(CPU_FTR_HVMODE)
 data_access_pSeries:
 	HMT_MEDIUM_PPR_DISCARD
 	SET_SCRATCH0(r13)
-	EXCEPTION_PROLOG_PSERIES(PACA_EXGEN, data_access_common, EXC_STD,
-				 KVMTEST, 0x300)
+	EXCEPTION_PROLOG_0(PACA_EXGEN)
+	b data_access_pSeries_ool
 
 	. = 0x380
 	.globl data_access_slb_pSeries
@@ -211,31 +211,15 @@ data_access_slb_pSeries:
 	HMT_MEDIUM_PPR_DISCARD
 	SET_SCRATCH0(r13)
 	EXCEPTION_PROLOG_0(PACA_EXSLB)
-	EXCEPTION_PROLOG_1(PACA_EXSLB, KVMTEST, 0x380)
-	std	r3,PACA_EXSLB+EX_R3(r13)
-	mfspr	r3,SPRN_DAR
-#ifdef __DISABLED__
-	/* Keep that around for when we re-implement dynamic VSIDs */
-	cmpdi	r3,0
-	bge	slb_miss_user_pseries
-#endif /* __DISABLED__ */
-	mfspr	r12,SPRN_SRR1
-#ifndef CONFIG_RELOCATABLE
-	b	slb_miss_realmode
-#else
-	/*
-	 * We can't just use a direct branch to slb_miss_realmode
-	 * because the distance from here to there depends on where
-	 * the kernel ends up being put.
-	 */
-	mfctr	r11
-	ld	r10,PACAKBASE(r13)
-	LOAD_HANDLER(r10, slb_miss_realmode)
-	mtctr	r10
-	bctr
-#endif
+	b data_access_slb_pSeries_ool
 
-	STD_EXCEPTION_PSERIES(0x400, 0x400, instruction_access)
+	. = 0x400
+	.globl instruction_access_pSeries
+instruction_access_pSeries:
+	HMT_MEDIUM_PPR_DISCARD
+	SET_SCRATCH0(r13)
+	EXCEPTION_PROLOG_0(PACA_EXGEN)
+	b instruction_access_pSeries_ool
 
 	. = 0x480
 	.globl instruction_access_slb_pSeries
@@ -243,24 +227,7 @@ instruction_access_slb_pSeries:
 	HMT_MEDIUM_PPR_DISCARD
 	SET_SCRATCH0(r13)
 	EXCEPTION_PROLOG_0(PACA_EXSLB)
-	EXCEPTION_PROLOG_1(PACA_EXSLB, KVMTEST_PR, 0x480)
-	std	r3,PACA_EXSLB+EX_R3(r13)
-	mfspr	r3,SPRN_SRR0		/* SRR0 is faulting address */
-#ifdef __DISABLED__
-	/* Keep that around for when we re-implement dynamic VSIDs */
-	cmpdi	r3,0
-	bge	slb_miss_user_pseries
-#endif /* __DISABLED__ */
-	mfspr	r12,SPRN_SRR1
-#ifndef CONFIG_RELOCATABLE
-	b	slb_miss_realmode
-#else
-	mfctr	r11
-	ld	r10,PACAKBASE(r13)
-	LOAD_HANDLER(r10, slb_miss_realmode)
-	mtctr	r10
-	bctr
-#endif
+	b instruction_access_slb_pSeries_ool
 
 	/* We open code these as we can't have a ". = x" (even with
 	 * x = "." within a feature section
@@ -291,13 +258,19 @@ hardware_interrupt_hv:
 	KVM_HANDLER_PR(PACA_EXGEN, EXC_STD, 0x800)
 
 	. = 0x900
-	.globl decrementer_pSeries
-decrementer_pSeries:
+	.globl decrementer_trampoline
+decrementer_trampoline:
 	SET_SCRATCH0(r13)
 	EXCEPTION_PROLOG_0(PACA_EXGEN)
 	b	decrementer_ool
 
-	STD_EXCEPTION_HV(0x980, 0x982, hdecrementer)
+	. = 0x980
+	.globl hdecrementer_trampoline
+hdecrementer_trampoline:
+	HMT_MEDIUM_PPR_DISCARD;
+	SET_SCRATCH0(r13);
+	EXCEPTION_PROLOG_0(PACA_EXGEN)
+	b hdecrementer_hv
 
 	MASKABLE_EXCEPTION_PSERIES(0xa00, 0xa00, doorbell_super)
 	KVM_HANDLER_PR(PACA_EXGEN, EXC_STD, 0xa00)
@@ -545,6 +518,64 @@ machine_check_pSeries_0:
 	KVM_HANDLER_PR(PACA_EXGEN, EXC_STD, 0x900)
 	KVM_HANDLER(PACA_EXGEN, EXC_HV, 0x982)
 
+/* moved from 0x300 */
+	.globl data_access_pSeries_ool
+data_access_pSeries_ool:
+	EXCEPTION_PROLOG_1(PACA_EXGEN, KVMTEST, 0x300)
+	EXCEPTION_PROLOG_PSERIES_1(data_access_common, EXC_STD)
+
+	.globl data_access_slb_pSeries_ool
+data_access_slb_pSeries_ool:
+	EXCEPTION_PROLOG_1(PACA_EXSLB, KVMTEST, 0x380)
+	std	r3,PACA_EXSLB+EX_R3(r13)
+	mfspr	r3,SPRN_DAR
+#ifdef __DISABLED__
+	/* Keep that around for when we re-implement dynamic VSIDs */
+	cmpdi	r3,0
+	bge	slb_miss_user_pseries
+#endif /* __DISABLED__ */
+	mfspr	r12,SPRN_SRR1
+#ifndef CONFIG_RELOCATABLE
+	b	slb_miss_realmode
+#else
+	/*
+	 * We can't just use a direct branch to slb_miss_realmode
+	 * because the distance from here to there depends on where
+	 * the kernel ends up being put.
+	 */
+	mfctr	r11
+	ld	r10,PACAKBASE(r13)
+	LOAD_HANDLER(r10, slb_miss_realmode)
+	mtctr	r10
+	bctr
+#endif
+
+	.globl instruction_access_pSeries_ool
+instruction_access_pSeries_ool:
+	EXCEPTION_PROLOG_1(PACA_EXGEN, KVMTEST_PR, 0x400)
+	EXCEPTION_PROLOG_PSERIES_1(instruction_access_common, EXC_STD)
+
+	.globl instruction_access_slb_pSeries_ool
+instruction_access_slb_pSeries_ool:
+	EXCEPTION_PROLOG_1(PACA_EXSLB, KVMTEST_PR, 0x480)
+	std	r3,PACA_EXSLB+EX_R3(r13)
+	mfspr	r3,SPRN_SRR0		/* SRR0 is faulting address */
+#ifdef __DISABLED__
+	/* Keep that around for when we re-implement dynamic VSIDs */
+	cmpdi	r3,0
+	bge	slb_miss_user_pseries
+#endif /* __DISABLED__ */
+	mfspr	r12,SPRN_SRR1
+#ifndef CONFIG_RELOCATABLE
+	b	slb_miss_realmode
+#else
+	mfctr	r11
+	ld	r10,PACAKBASE(r13)
+	LOAD_HANDLER(r10, slb_miss_realmode)
+	mtctr	r10
+	bctr
+#endif
+
 #ifdef CONFIG_PPC_DENORMALISATION
 denorm_assist:
 BEGIN_FTR_SECTION
@@ -612,6 +643,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_CFAR)
 	.align	7
 	/* moved from 0xe00 */
 	MASKABLE_EXCEPTION_OOL(0x900, decrementer)
+	STD_EXCEPTION_HV_OOL(0x982, hdecrementer)
 	STD_EXCEPTION_HV_OOL(0xe02, h_data_storage)
 	KVM_HANDLER_SKIP(PACA_EXGEN, EXC_HV, 0xe02)
 	STD_EXCEPTION_HV_OOL(0xe22, h_instr_storage)
@@ -894,7 +926,15 @@ hardware_interrupt_relon_hv:
 	STD_RELON_EXCEPTION_PSERIES(0x4600, 0x600, alignment)
 	STD_RELON_EXCEPTION_PSERIES(0x4700, 0x700, program_check)
 	STD_RELON_EXCEPTION_PSERIES(0x4800, 0x800, fp_unavailable)
-	MASKABLE_RELON_EXCEPTION_PSERIES(0x4900, 0x900, decrementer)
+
+	. = 0x4900
+	.globl decrementer_relon_trampoline
+decrementer_relon_trampoline:
+	HMT_MEDIUM_PPR_DISCARD
+	SET_SCRATCH0(r13)
+	EXCEPTION_PROLOG_0(PACA_EXGEN)
+	b decrementer_relon_pSeries
+
 	STD_RELON_EXCEPTION_HV(0x4980, 0x982, hdecrementer)
 	MASKABLE_RELON_EXCEPTION_PSERIES(0x4a00, 0xa00, doorbell_super)
 	STD_RELON_EXCEPTION_PSERIES(0x4b00, 0xb00, trap_0b)
@@ -1244,6 +1284,8 @@ END_FTR_SECTION_IFSET(CPU_FTR_VSX)
 __end_handlers:
 
 	/* Equivalents to the above handlers for relocation-on interrupt vectors */
+	MASKABLE_RELON_EXCEPTION_PSERIES_OOL(0x900, decrementer)
+
 	STD_RELON_EXCEPTION_HV_OOL(0xe40, emulation_assist)
 	MASKABLE_RELON_EXCEPTION_HV_OOL(0xe80, h_doorbell)
 

From 55bd5dc8e5d1e4250e4d115715b22603ec979abd Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Fri, 20 Nov 2020 11:06:59 +1100
Subject: [PATCH 1034/2658] powerpc/64s: flush L1D on kernel entry

commit f79643787e0a0762d2409b7b8334e83f22d85695 upstream.

IBM Power9 processors can speculatively operate on data in the L1 cache before
it has been completely validated, via a way-prediction mechanism. It is not possible
for an attacker to determine the contents of impermissible memory using this method,
since these systems implement a combination of hardware and software security measures
to prevent scenarios where protected data could be leaked.

However these measures don't address the scenario where an attacker induces
the operating system to speculatively execute instructions using data that the
attacker controls. This can be used for example to speculatively bypass "kernel
user access prevention" techniques, as discovered by Anthony Steinhauser of
Google's Safeside Project. This is not an attack by itself, but there is a possibility
it could be used in conjunction with side-channels or other weaknesses in the
privileged code to construct an attack.

This issue can be mitigated by flushing the L1 cache between privilege boundaries
of concern. This patch flushes the L1 cache on kernel entry.

This is part of the fix for CVE-2020-4788.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/kernel-parameters.txt          |  3 +
 arch/powerpc/include/asm/exception-64s.h     |  9 ++-
 arch/powerpc/include/asm/feature-fixups.h    | 10 ++++
 arch/powerpc/include/asm/security_features.h |  4 ++
 arch/powerpc/include/asm/setup.h             |  3 +
 arch/powerpc/kernel/exceptions-64s.S         | 38 +++++++++++++
 arch/powerpc/kernel/setup_64.c               | 58 ++++++++++++++++++++
 arch/powerpc/kernel/vmlinux.lds.S            |  7 +++
 arch/powerpc/lib/feature-fixups.c            | 54 ++++++++++++++++++
 arch/powerpc/platforms/powernv/setup.c       | 10 ++++
 arch/powerpc/platforms/pseries/setup.c       |  4 ++
 11 files changed, 199 insertions(+), 1 deletion(-)

diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 9d27670c7a2f..11256f42d342 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2212,6 +2212,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 					       spec_store_bypass_disable=off [X86]
 					       mds=off [X86]
 					       tsx_async_abort=off [X86]
+					       no_entry_flush [PPC]
 
 			auto (default)
 				Mitigate all CPU vulnerabilities, but leave SMT
@@ -2492,6 +2493,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
 	noefi		Disable EFI runtime services support.
 
+	no_entry_flush	[PPC] Don't flush the L1-D cache when entering the kernel.
+
 	noexec		[IA-64]
 
 	noexec		[X86]
diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
index 26f00ab2d0c9..fbcfc722d109 100644
--- a/arch/powerpc/include/asm/exception-64s.h
+++ b/arch/powerpc/include/asm/exception-64s.h
@@ -65,11 +65,18 @@
 	nop;								\
 	nop
 
+#define ENTRY_FLUSH_SLOT						\
+	ENTRY_FLUSH_FIXUP_SECTION;					\
+	nop;								\
+	nop;								\
+	nop;
+
 /*
  * r10 must be free to use, r13 must be paca
  */
 #define INTERRUPT_TO_KERNEL						\
-	STF_ENTRY_BARRIER_SLOT
+	STF_ENTRY_BARRIER_SLOT;						\
+	ENTRY_FLUSH_SLOT
 
 /*
  * Macros for annotating the expected destination of (h)rfid
diff --git a/arch/powerpc/include/asm/feature-fixups.h b/arch/powerpc/include/asm/feature-fixups.h
index 145a37ab2d3e..a963c26b2d34 100644
--- a/arch/powerpc/include/asm/feature-fixups.h
+++ b/arch/powerpc/include/asm/feature-fixups.h
@@ -200,6 +200,14 @@ label##3:					       	\
 	FTR_ENTRY_OFFSET 955b-956b;			\
 	.popsection;
 
+#define ENTRY_FLUSH_FIXUP_SECTION			\
+957:							\
+	.pushsection __entry_flush_fixup,"a";		\
+	.align 2;					\
+958:							\
+	FTR_ENTRY_OFFSET 957b-958b;			\
+	.popsection;
+
 #define RFI_FLUSH_FIXUP_SECTION				\
 951:							\
 	.pushsection __rfi_flush_fixup,"a";		\
@@ -231,8 +239,10 @@ label##3:					       	\
 #ifndef __ASSEMBLY__
 
 extern long stf_barrier_fallback;
+extern long entry_flush_fallback;
 extern long __start___stf_entry_barrier_fixup, __stop___stf_entry_barrier_fixup;
 extern long __start___stf_exit_barrier_fixup, __stop___stf_exit_barrier_fixup;
+extern long __start___entry_flush_fixup, __stop___entry_flush_fixup;
 extern long __start___rfi_flush_fixup, __stop___rfi_flush_fixup;
 extern long __start___barrier_nospec_fixup, __stop___barrier_nospec_fixup;
 extern long __start__btb_flush_fixup, __stop__btb_flush_fixup;
diff --git a/arch/powerpc/include/asm/security_features.h b/arch/powerpc/include/asm/security_features.h
index ccf44c135389..082b56bf678d 100644
--- a/arch/powerpc/include/asm/security_features.h
+++ b/arch/powerpc/include/asm/security_features.h
@@ -84,12 +84,16 @@ static inline bool security_ftr_enabled(unsigned long feature)
 // Software required to flush link stack on context switch
 #define SEC_FTR_FLUSH_LINK_STACK	0x0000000000001000ull
 
+// The L1-D cache should be flushed when entering the kernel
+#define SEC_FTR_L1D_FLUSH_ENTRY		0x0000000000004000ull
+
 
 // Features enabled by default
 #define SEC_FTR_DEFAULT \
 	(SEC_FTR_L1D_FLUSH_HV | \
 	 SEC_FTR_L1D_FLUSH_PR | \
 	 SEC_FTR_BNDS_CHK_SPEC_BAR | \
+	 SEC_FTR_L1D_FLUSH_ENTRY | \
 	 SEC_FTR_FAVOUR_SECURITY)
 
 #endif /* _ASM_POWERPC_SECURITY_FEATURES_H */
diff --git a/arch/powerpc/include/asm/setup.h b/arch/powerpc/include/asm/setup.h
index d299479c770b..26b55f23cf64 100644
--- a/arch/powerpc/include/asm/setup.h
+++ b/arch/powerpc/include/asm/setup.h
@@ -38,12 +38,15 @@ enum l1d_flush_type {
 };
 
 void setup_rfi_flush(enum l1d_flush_type, bool enable);
+void setup_entry_flush(bool enable);
+void setup_uaccess_flush(bool enable);
 void do_rfi_flush_fixups(enum l1d_flush_type types);
 #ifdef CONFIG_PPC_BARRIER_NOSPEC
 void setup_barrier_nospec(void);
 #else
 static inline void setup_barrier_nospec(void) { };
 #endif
+void do_entry_flush_fixups(enum l1d_flush_type types);
 void do_barrier_nospec_fixups(bool enable);
 extern bool barrier_nospec_enabled;
 
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 3d843e1a162c..7715fd89bb94 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1712,6 +1712,44 @@ hrfi_flush_fallback:
 	GET_SCRATCH0(r13);
 	hrfid
 
+	.globl entry_flush_fallback
+entry_flush_fallback:
+	std	r9,PACA_EXRFI+EX_R9(r13)
+	std	r10,PACA_EXRFI+EX_R10(r13)
+	std	r11,PACA_EXRFI+EX_R11(r13)
+	mfctr	r9
+	ld	r10,PACA_RFI_FLUSH_FALLBACK_AREA(r13)
+	ld	r11,PACA_L1D_FLUSH_SIZE(r13)
+	srdi	r11,r11,(7 + 3) /* 128 byte lines, unrolled 8x */
+	mtctr	r11
+	DCBT_STOP_ALL_STREAM_IDS(r11) /* Stop prefetch streams */
+
+	/* order ld/st prior to dcbt stop all streams with flushing */
+	sync
+
+	/*
+	 * The load addresses are at staggered offsets within cachelines,
+	 * which suits some pipelines better (on others it should not
+	 * hurt).
+	 */
+1:
+	ld	r11,(0x80 + 8)*0(r10)
+	ld	r11,(0x80 + 8)*1(r10)
+	ld	r11,(0x80 + 8)*2(r10)
+	ld	r11,(0x80 + 8)*3(r10)
+	ld	r11,(0x80 + 8)*4(r10)
+	ld	r11,(0x80 + 8)*5(r10)
+	ld	r11,(0x80 + 8)*6(r10)
+	ld	r11,(0x80 + 8)*7(r10)
+	addi	r10,r10,0x80*8
+	bdnz	1b
+
+	mtctr	r9
+	ld	r9,PACA_EXRFI+EX_R9(r13)
+	ld	r10,PACA_EXRFI+EX_R10(r13)
+	ld	r11,PACA_EXRFI+EX_R11(r13)
+	blr
+
 /*
  * Hash table stuff
  */
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 11590f6cb2f9..cd405eaffa23 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -844,7 +844,9 @@ early_initcall(disable_hardlockup_detector);
 static enum l1d_flush_type enabled_flush_types;
 static void *l1d_flush_fallback_area;
 static bool no_rfi_flush;
+static bool no_entry_flush;
 bool rfi_flush;
+bool entry_flush;
 
 static int __init handle_no_rfi_flush(char *p)
 {
@@ -854,6 +856,14 @@ static int __init handle_no_rfi_flush(char *p)
 }
 early_param("no_rfi_flush", handle_no_rfi_flush);
 
+static int __init handle_no_entry_flush(char *p)
+{
+	pr_info("entry-flush: disabled on command line.");
+	no_entry_flush = true;
+	return 0;
+}
+early_param("no_entry_flush", handle_no_entry_flush);
+
 /*
  * The RFI flush is not KPTI, but because users will see doco that says to use
  * nopti we hijack that option here to also disable the RFI flush.
@@ -885,6 +895,18 @@ void rfi_flush_enable(bool enable)
 	rfi_flush = enable;
 }
 
+void entry_flush_enable(bool enable)
+{
+	if (enable) {
+		do_entry_flush_fixups(enabled_flush_types);
+		on_each_cpu(do_nothing, NULL, 1);
+	} else {
+		do_entry_flush_fixups(L1D_FLUSH_NONE);
+	}
+
+	entry_flush = enable;
+}
+
 static void __ref init_fallback_flush(void)
 {
 	u64 l1d_size, limit;
@@ -930,6 +952,15 @@ void setup_rfi_flush(enum l1d_flush_type types, bool enable)
 		rfi_flush_enable(enable);
 }
 
+void setup_entry_flush(bool enable)
+{
+	if (cpu_mitigations_off())
+		return;
+
+	if (!no_entry_flush)
+		entry_flush_enable(enable);
+}
+
 #ifdef CONFIG_DEBUG_FS
 static int rfi_flush_set(void *data, u64 val)
 {
@@ -957,9 +988,36 @@ static int rfi_flush_get(void *data, u64 *val)
 
 DEFINE_SIMPLE_ATTRIBUTE(fops_rfi_flush, rfi_flush_get, rfi_flush_set, "%llu\n");
 
+static int entry_flush_set(void *data, u64 val)
+{
+	bool enable;
+
+	if (val == 1)
+		enable = true;
+	else if (val == 0)
+		enable = false;
+	else
+		return -EINVAL;
+
+	/* Only do anything if we're changing state */
+	if (enable != entry_flush)
+		entry_flush_enable(enable);
+
+	return 0;
+}
+
+static int entry_flush_get(void *data, u64 *val)
+{
+	*val = entry_flush ? 1 : 0;
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(fops_entry_flush, entry_flush_get, entry_flush_set, "%llu\n");
+
 static __init int rfi_flush_debugfs_init(void)
 {
 	debugfs_create_file("rfi_flush", 0600, powerpc_debugfs_root, NULL, &fops_rfi_flush);
+	debugfs_create_file("entry_flush", 0600, powerpc_debugfs_root, NULL, &fops_entry_flush);
 	return 0;
 }
 device_initcall(rfi_flush_debugfs_init);
diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
index 0c71f9e5acea..1c949eb4329f 100644
--- a/arch/powerpc/kernel/vmlinux.lds.S
+++ b/arch/powerpc/kernel/vmlinux.lds.S
@@ -81,6 +81,13 @@ SECTIONS
 		__stop___stf_entry_barrier_fixup = .;
 	}
 
+	. = ALIGN(8);
+	__entry_flush_fixup : AT(ADDR(__entry_flush_fixup) - LOAD_OFFSET) {
+		__start___entry_flush_fixup = .;
+		*(__entry_flush_fixup)
+		__stop___entry_flush_fixup = .;
+	}
+
 	. = ALIGN(8);
 	__stf_exit_barrier_fixup : AT(ADDR(__stf_exit_barrier_fixup) - LOAD_OFFSET) {
 		__start___stf_exit_barrier_fixup = .;
diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c
index 7bdfc19a491d..4f13bba13596 100644
--- a/arch/powerpc/lib/feature-fixups.c
+++ b/arch/powerpc/lib/feature-fixups.c
@@ -229,6 +229,60 @@ void do_stf_barrier_fixups(enum stf_barrier_type types)
 	do_stf_exit_barrier_fixups(types);
 }
 
+void do_entry_flush_fixups(enum l1d_flush_type types)
+{
+	unsigned int instrs[3], *dest;
+	long *start, *end;
+	int i;
+
+	start = PTRRELOC(&__start___entry_flush_fixup);
+	end = PTRRELOC(&__stop___entry_flush_fixup);
+
+	instrs[0] = 0x60000000; /* nop */
+	instrs[1] = 0x60000000; /* nop */
+	instrs[2] = 0x60000000; /* nop */
+
+	i = 0;
+	if (types == L1D_FLUSH_FALLBACK) {
+		instrs[i++] = 0x7d4802a6; /* mflr r10		*/
+		instrs[i++] = 0x60000000; /* branch patched below */
+		instrs[i++] = 0x7d4803a6; /* mtlr r10		*/
+	}
+
+	if (types & L1D_FLUSH_ORI) {
+		instrs[i++] = 0x63ff0000; /* ori 31,31,0 speculation barrier */
+		instrs[i++] = 0x63de0000; /* ori 30,30,0 L1d flush*/
+	}
+
+	if (types & L1D_FLUSH_MTTRIG)
+		instrs[i++] = 0x7c12dba6; /* mtspr TRIG2,r0 (SPR #882) */
+
+	for (i = 0; start < end; start++, i++) {
+		dest = (void *)start + *start;
+
+		pr_devel("patching dest %lx\n", (unsigned long)dest);
+
+		patch_instruction(dest, instrs[0]);
+
+		if (types == L1D_FLUSH_FALLBACK)
+			patch_branch((dest + 1), (unsigned long)&entry_flush_fallback,
+				     BRANCH_SET_LINK);
+		else
+			patch_instruction((dest + 1), instrs[1]);
+
+		patch_instruction((dest + 2), instrs[2]);
+	}
+
+	printk(KERN_DEBUG "entry-flush: patched %d locations (%s flush)\n", i,
+		(types == L1D_FLUSH_NONE)       ? "no" :
+		(types == L1D_FLUSH_FALLBACK)   ? "fallback displacement" :
+		(types &  L1D_FLUSH_ORI)        ? (types & L1D_FLUSH_MTTRIG)
+							? "ori+mttrig type"
+							: "ori type" :
+		(types &  L1D_FLUSH_MTTRIG)     ? "mttrig type"
+						: "unknown");
+}
+
 void do_rfi_flush_fixups(enum l1d_flush_type types)
 {
 	unsigned int instrs[3], *dest;
diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
index e14b52c7ebd8..fe3f1f438f78 100644
--- a/arch/powerpc/platforms/powernv/setup.c
+++ b/arch/powerpc/platforms/powernv/setup.c
@@ -124,12 +124,22 @@ static void pnv_setup_rfi_flush(void)
 			type = L1D_FLUSH_ORI;
 	}
 
+	/*
+	 * 4.4 doesn't support Power9 bare metal, so we don't need to flush
+	 * here - the flush fixes a P9 specific vulnerability.
+	 */
+	security_ftr_clear(SEC_FTR_L1D_FLUSH_ENTRY);
+
 	enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) && \
 		 (security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR)   || \
 		  security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV));
 
 	setup_rfi_flush(type, enable);
 	setup_count_cache_flush();
+
+	enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) &&
+		 security_ftr_enabled(SEC_FTR_L1D_FLUSH_ENTRY);
+	setup_entry_flush(enable);
 }
 
 static void __init pnv_setup_arch(void)
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 88fcf6a95fa6..69f1808ecbd2 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -584,6 +584,10 @@ void pseries_setup_rfi_flush(void)
 
 	setup_rfi_flush(types, enable);
 	setup_count_cache_flush();
+
+	enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) &&
+		 security_ftr_enabled(SEC_FTR_L1D_FLUSH_ENTRY);
+	setup_entry_flush(enable);
 }
 
 static void __init pSeries_setup_arch(void)

From cf4db35061a1e84d020479dffc03b88ac49257a0 Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@c-s.fr>
Date: Fri, 20 Nov 2020 11:07:00 +1100
Subject: [PATCH 1035/2658] powerpc: Add a framework for user access tracking

Backported from commit de78a9c42a79 ("powerpc: Add a framework
for Kernel Userspace Access Protection"). Here we don't try to
add the KUAP framework, we just want the helper functions
because we want to put uaccess flush helpers in them.

In terms of fixes, we don't need commit 1d8f739b07bd ("powerpc/kuap:
Fix set direction in allow/prevent_user_access()") as we don't have
real KUAP. Likewise as all our allows are noops and all our prevents
are just flushes, we don't need commit 9dc086f1e9ef ("powerpc/futex:
Fix incorrect user access blocking") The other 2 fixes we do need.

The original description is:

This patch implements a framework for Kernel Userspace Access
Protection.

Then subarches will have the possibility to provide their own
implementation by providing setup_kuap() and
allow/prevent_user_access().

Some platforms will need to know the area accessed and whether it is
accessed from read, write or both. Therefore source, destination and
size and handed over to the two functions.

mpe: Rename to allow/prevent rather than unlock/lock, and add
read/write wrappers. Drop the 32-bit code for now until we have an
implementation for it. Add kuap to pt_regs for 64-bit as well as
32-bit. Don't split strings, use pr_crit_ratelimited().

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Russell Currey <ruscur@russell.cc>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/include/asm/futex.h        |  4 +++
 arch/powerpc/include/asm/kup.h          | 36 ++++++++++++++++++++++
 arch/powerpc/include/asm/uaccess.h      | 41 ++++++++++++++++++-------
 arch/powerpc/lib/checksum_wrappers_64.c |  4 +++
 4 files changed, 74 insertions(+), 11 deletions(-)
 create mode 100644 arch/powerpc/include/asm/kup.h

diff --git a/arch/powerpc/include/asm/futex.h b/arch/powerpc/include/asm/futex.h
index b73ab8a7ebc3..10746519b351 100644
--- a/arch/powerpc/include/asm/futex.h
+++ b/arch/powerpc/include/asm/futex.h
@@ -36,6 +36,7 @@ static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval,
 {
 	int oldval = 0, ret;
 
+	allow_write_to_user(uaddr, sizeof(*uaddr));
 	pagefault_disable();
 
 	switch (op) {
@@ -62,6 +63,7 @@ static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval,
 
 	*oval = oldval;
 
+	prevent_write_to_user(uaddr, sizeof(*uaddr));
 	return ret;
 }
 
@@ -75,6 +77,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
 	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
 		return -EFAULT;
 
+	allow_write_to_user(uaddr, sizeof(*uaddr));
         __asm__ __volatile__ (
         PPC_ATOMIC_ENTRY_BARRIER
 "1:     lwarx   %1,0,%3         # futex_atomic_cmpxchg_inatomic\n\
@@ -97,6 +100,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
         : "cc", "memory");
 
 	*uval = prev;
+	prevent_write_to_user(uaddr, sizeof(*uaddr));
         return ret;
 }
 
diff --git a/arch/powerpc/include/asm/kup.h b/arch/powerpc/include/asm/kup.h
new file mode 100644
index 000000000000..7895d5eeaf21
--- /dev/null
+++ b/arch/powerpc/include/asm/kup.h
@@ -0,0 +1,36 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_POWERPC_KUP_H_
+#define _ASM_POWERPC_KUP_H_
+
+#ifndef __ASSEMBLY__
+
+#include <asm/pgtable.h>
+
+static inline void allow_user_access(void __user *to, const void __user *from,
+				     unsigned long size) { }
+static inline void prevent_user_access(void __user *to, const void __user *from,
+				       unsigned long size) { }
+
+static inline void allow_read_from_user(const void __user *from, unsigned long size)
+{
+	allow_user_access(NULL, from, size);
+}
+
+static inline void allow_write_to_user(void __user *to, unsigned long size)
+{
+	allow_user_access(to, NULL, size);
+}
+
+static inline void prevent_read_from_user(const void __user *from, unsigned long size)
+{
+	prevent_user_access(NULL, from, size);
+}
+
+static inline void prevent_write_to_user(void __user *to, unsigned long size)
+{
+	prevent_user_access(to, NULL, size);
+}
+
+#endif /* !__ASSEMBLY__ */
+
+#endif /* _ASM_POWERPC_KUP_H_ */
diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
index 5e8da20e8305..f5b75f936cf4 100644
--- a/arch/powerpc/include/asm/uaccess.h
+++ b/arch/powerpc/include/asm/uaccess.h
@@ -9,6 +9,7 @@
 #include <asm/asm-compat.h>
 #include <asm/processor.h>
 #include <asm/page.h>
+#include <asm/kup.h>
 
 #define VERIFY_READ	0
 #define VERIFY_WRITE	1
@@ -164,6 +165,7 @@ extern long __put_user_bad(void);
 #define __put_user_size(x, ptr, size, retval)			\
 do {								\
 	retval = 0;						\
+	allow_write_to_user(ptr, size);				\
 	switch (size) {						\
 	  case 1: __put_user_asm(x, ptr, retval, "stb"); break;	\
 	  case 2: __put_user_asm(x, ptr, retval, "sth"); break;	\
@@ -171,6 +173,7 @@ do {								\
 	  case 8: __put_user_asm2(x, ptr, retval); break;	\
 	  default: __put_user_bad();				\
 	}							\
+	prevent_write_to_user(ptr, size);			\
 } while (0)
 
 #define __put_user_nocheck(x, ptr, size)			\
@@ -252,6 +255,7 @@ do {								\
 	__chk_user_ptr(ptr);					\
 	if (size > sizeof(x))					\
 		(x) = __get_user_bad();				\
+	allow_read_from_user(ptr, size);			\
 	switch (size) {						\
 	case 1: __get_user_asm(x, ptr, retval, "lbz"); break;	\
 	case 2: __get_user_asm(x, ptr, retval, "lhz"); break;	\
@@ -259,6 +263,7 @@ do {								\
 	case 8: __get_user_asm2(x, ptr, retval);  break;	\
 	default: (x) = __get_user_bad();			\
 	}							\
+	prevent_read_from_user(ptr, size);			\
 } while (0)
 
 #define __get_user_nocheck(x, ptr, size)			\
@@ -328,10 +333,14 @@ extern unsigned long __copy_tofrom_user(void __user *to,
 static inline unsigned long copy_from_user(void *to,
 		const void __user *from, unsigned long n)
 {
+	unsigned long ret;
+
 	if (likely(access_ok(VERIFY_READ, from, n))) {
+		allow_user_access(to, from, n);
 		barrier_nospec();
-		check_object_size(to, n, false);
-		return __copy_tofrom_user((__force void __user *)to, from, n);
+		ret = __copy_tofrom_user((__force void __user *)to, from, n);
+		prevent_user_access(to, from, n);
+		return ret;
 	}
 	memset(to, 0, n);
 	return n;
@@ -364,8 +373,9 @@ extern unsigned long copy_in_user(void __user *to, const void __user *from,
 static inline unsigned long __copy_from_user_inatomic(void *to,
 		const void __user *from, unsigned long n)
 {
+	unsigned long ret;
 	if (__builtin_constant_p(n) && (n <= 8)) {
-		unsigned long ret = 1;
+		ret = 1;
 
 		switch (n) {
 		case 1:
@@ -391,14 +401,18 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
 
 	check_object_size(to, n, false);
 	barrier_nospec();
-	return __copy_tofrom_user((__force void __user *)to, from, n);
+	allow_read_from_user(from, n);
+	ret = __copy_tofrom_user((__force void __user *)to, from, n);
+	prevent_read_from_user(from, n);
+	return ret;
 }
 
 static inline unsigned long __copy_to_user_inatomic(void __user *to,
 		const void *from, unsigned long n)
 {
+	unsigned long ret;
 	if (__builtin_constant_p(n) && (n <= 8)) {
-		unsigned long ret = 1;
+		ret = 1;
 
 		switch (n) {
 		case 1:
@@ -418,9 +432,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
 			return 0;
 	}
 
-	check_object_size(from, n, true);
-
-	return __copy_tofrom_user(to, (__force const void __user *)from, n);
+	allow_write_to_user(to, n);
+	ret = __copy_tofrom_user(to, (__force const void __user *)from, n);
+	prevent_write_to_user(to, n);
+	return ret;
 }
 
 static inline unsigned long __copy_from_user(void *to,
@@ -441,10 +456,14 @@ extern unsigned long __clear_user(void __user *addr, unsigned long size);
 
 static inline unsigned long clear_user(void __user *addr, unsigned long size)
 {
+	unsigned long ret = size;
 	might_fault();
-	if (likely(access_ok(VERIFY_WRITE, addr, size)))
-		return __clear_user(addr, size);
-	return size;
+	if (likely(access_ok(VERIFY_WRITE, addr, size))) {
+		allow_write_to_user(addr, size);
+		ret = __clear_user(addr, size);
+		prevent_write_to_user(addr, size);
+	}
+	return ret;
 }
 
 extern long strncpy_from_user(char *dst, const char __user *src, long count);
diff --git a/arch/powerpc/lib/checksum_wrappers_64.c b/arch/powerpc/lib/checksum_wrappers_64.c
index 08e3a3356c40..11b58949eb62 100644
--- a/arch/powerpc/lib/checksum_wrappers_64.c
+++ b/arch/powerpc/lib/checksum_wrappers_64.c
@@ -29,6 +29,7 @@ __wsum csum_and_copy_from_user(const void __user *src, void *dst,
 	unsigned int csum;
 
 	might_sleep();
+	allow_read_from_user(src, len);
 
 	*err_ptr = 0;
 
@@ -60,6 +61,7 @@ __wsum csum_and_copy_from_user(const void __user *src, void *dst,
 	}
 
 out:
+	prevent_read_from_user(src, len);
 	return (__force __wsum)csum;
 }
 EXPORT_SYMBOL(csum_and_copy_from_user);
@@ -70,6 +72,7 @@ __wsum csum_and_copy_to_user(const void *src, void __user *dst, int len,
 	unsigned int csum;
 
 	might_sleep();
+	allow_write_to_user(dst, len);
 
 	*err_ptr = 0;
 
@@ -97,6 +100,7 @@ __wsum csum_and_copy_to_user(const void *src, void __user *dst, int len,
 	}
 
 out:
+	prevent_write_to_user(dst, len);
 	return (__force __wsum)csum;
 }
 EXPORT_SYMBOL(csum_and_copy_to_user);

From ded0e7310c7b71ee15cde7939aa3e2816ef555e5 Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@c-s.fr>
Date: Fri, 20 Nov 2020 11:07:01 +1100
Subject: [PATCH 1036/2658] powerpc: Implement user_access_begin and friends

commit 5cd623333e7cf4e3a334c70529268b65f2a6c2c7 upstream.

Today, when a function like strncpy_from_user() is called,
the userspace access protection is de-activated and re-activated
for every word read.

By implementing user_access_begin and friends, the protection
is de-activated at the beginning of the copy and re-activated at the
end.

Implement user_access_begin(), user_access_end() and
unsafe_get_user(), unsafe_put_user() and unsafe_copy_to_user()

For the time being, we keep user_access_save() and
user_access_restore() as nops.

Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/36d4fbf9e56a75994aca4ee2214c77b26a5a8d35.1579866752.git.christophe.leroy@c-s.fr
Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/include/asm/uaccess.h | 60 +++++++++++++++++++++++-------
 1 file changed, 46 insertions(+), 14 deletions(-)

diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
index f5b75f936cf4..b55feda2838d 100644
--- a/arch/powerpc/include/asm/uaccess.h
+++ b/arch/powerpc/include/asm/uaccess.h
@@ -106,9 +106,14 @@ struct exception_table_entry {
 	__put_user_check((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
 
 #define __get_user(x, ptr) \
-	__get_user_nocheck((x), (ptr), sizeof(*(ptr)))
+	__get_user_nocheck((x), (ptr), sizeof(*(ptr)), true)
 #define __put_user(x, ptr) \
-	__put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
+	__put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)), true)
+
+#define __get_user_allowed(x, ptr) \
+	__get_user_nocheck((x), (ptr), sizeof(*(ptr)), false)
+#define __put_user_allowed(x, ptr) \
+	__put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)), false)
 
 #define __get_user_inatomic(x, ptr) \
 	__get_user_nosleep((x), (ptr), sizeof(*(ptr)))
@@ -162,10 +167,9 @@ extern long __put_user_bad(void);
 		: "r" (x), "b" (addr), "i" (-EFAULT), "0" (err))
 #endif /* __powerpc64__ */
 
-#define __put_user_size(x, ptr, size, retval)			\
+#define __put_user_size_allowed(x, ptr, size, retval)		\
 do {								\
 	retval = 0;						\
-	allow_write_to_user(ptr, size);				\
 	switch (size) {						\
 	  case 1: __put_user_asm(x, ptr, retval, "stb"); break;	\
 	  case 2: __put_user_asm(x, ptr, retval, "sth"); break;	\
@@ -173,17 +177,26 @@ do {								\
 	  case 8: __put_user_asm2(x, ptr, retval); break;	\
 	  default: __put_user_bad();				\
 	}							\
+} while (0)
+
+#define __put_user_size(x, ptr, size, retval)			\
+do {								\
+	allow_write_to_user(ptr, size);				\
+	__put_user_size_allowed(x, ptr, size, retval);		\
 	prevent_write_to_user(ptr, size);			\
 } while (0)
 
-#define __put_user_nocheck(x, ptr, size)			\
+#define __put_user_nocheck(x, ptr, size, do_allow)			\
 ({								\
 	long __pu_err;						\
 	__typeof__(*(ptr)) __user *__pu_addr = (ptr);		\
 	if (!is_kernel_addr((unsigned long)__pu_addr))		\
 		might_fault();					\
 	__chk_user_ptr(ptr);					\
-	__put_user_size((x), __pu_addr, (size), __pu_err);	\
+	if (do_allow)								\
+		__put_user_size((x), __pu_addr, (size), __pu_err);		\
+	else									\
+		__put_user_size_allowed((x), __pu_addr, (size), __pu_err);	\
 	__pu_err;						\
 })
 
@@ -249,13 +262,12 @@ extern long __get_user_bad(void);
 		: "b" (addr), "i" (-EFAULT), "0" (err))
 #endif /* __powerpc64__ */
 
-#define __get_user_size(x, ptr, size, retval)			\
+#define __get_user_size_allowed(x, ptr, size, retval)		\
 do {								\
 	retval = 0;						\
 	__chk_user_ptr(ptr);					\
 	if (size > sizeof(x))					\
 		(x) = __get_user_bad();				\
-	allow_read_from_user(ptr, size);			\
 	switch (size) {						\
 	case 1: __get_user_asm(x, ptr, retval, "lbz"); break;	\
 	case 2: __get_user_asm(x, ptr, retval, "lhz"); break;	\
@@ -263,10 +275,16 @@ do {								\
 	case 8: __get_user_asm2(x, ptr, retval);  break;	\
 	default: (x) = __get_user_bad();			\
 	}							\
+} while (0)
+
+#define __get_user_size(x, ptr, size, retval)			\
+do {								\
+	allow_read_from_user(ptr, size);			\
+	__get_user_size_allowed(x, ptr, size, retval);		\
 	prevent_read_from_user(ptr, size);			\
 } while (0)
 
-#define __get_user_nocheck(x, ptr, size)			\
+#define __get_user_nocheck(x, ptr, size, do_allow)			\
 ({								\
 	long __gu_err;						\
 	unsigned long __gu_val;					\
@@ -275,7 +293,10 @@ do {								\
 	if (!is_kernel_addr((unsigned long)__gu_addr))		\
 		might_fault();					\
 	barrier_nospec();					\
-	__get_user_size(__gu_val, __gu_addr, (size), __gu_err);	\
+	if (do_allow)								\
+		__get_user_size(__gu_val, __gu_addr, (size), __gu_err);		\
+	else									\
+		__get_user_size_allowed(__gu_val, __gu_addr, (size), __gu_err);	\
 	(x) = (__typeof__(*(ptr)))__gu_val;			\
 	__gu_err;						\
 })
@@ -411,21 +432,22 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
 		const void *from, unsigned long n)
 {
 	unsigned long ret;
+
 	if (__builtin_constant_p(n) && (n <= 8)) {
 		ret = 1;
 
 		switch (n) {
 		case 1:
-			__put_user_size(*(u8 *)from, (u8 __user *)to, 1, ret);
+			__put_user_size_allowed(*(u8 *)from, (u8 __user *)to, 1, ret);
 			break;
 		case 2:
-			__put_user_size(*(u16 *)from, (u16 __user *)to, 2, ret);
+			__put_user_size_allowed(*(u16 *)from, (u16 __user *)to, 2, ret);
 			break;
 		case 4:
-			__put_user_size(*(u32 *)from, (u32 __user *)to, 4, ret);
+			__put_user_size_allowed(*(u32 *)from, (u32 __user *)to, 4, ret);
 			break;
 		case 8:
-			__put_user_size(*(u64 *)from, (u64 __user *)to, 8, ret);
+			__put_user_size_allowed(*(u64 *)from, (u64 __user *)to, 8, ret);
 			break;
 		}
 		if (ret == 0)
@@ -470,6 +492,16 @@ extern long strncpy_from_user(char *dst, const char __user *src, long count);
 extern __must_check long strlen_user(const char __user *str);
 extern __must_check long strnlen_user(const char __user *str, long n);
 
+
+#define user_access_begin()	do { } while (0)
+#define user_access_end()	prevent_user_access(NULL, NULL, ~0ul)
+
+#define unsafe_op_wrap(op, err) do { if (unlikely(op)) goto err; } while (0)
+#define unsafe_get_user(x, p, e) unsafe_op_wrap(__get_user_allowed(x, p), e)
+#define unsafe_put_user(x, p, e) unsafe_op_wrap(__put_user_allowed(x, p), e)
+#define unsafe_copy_to_user(d, s, l, e) \
+	unsafe_op_wrap(__copy_to_user_inatomic(d, s, l), e)
+
 #endif  /* __ASSEMBLY__ */
 #endif /* __KERNEL__ */
 

From fd110e2584faac73273160300c86b73e22476b29 Mon Sep 17 00:00:00 2001
From: Andrew Donnellan <ajd@linux.ibm.com>
Date: Fri, 20 Nov 2020 11:07:02 +1100
Subject: [PATCH 1037/2658] powerpc: Fix __clear_user() with KUAP enabled

commit 61e3acd8c693a14fc69b824cb5b08d02cb90a6e7 upstream.

The KUAP implementation adds calls in clear_user() to enable and
disable access to userspace memory. However, it doesn't add these to
__clear_user(), which is used in the ptrace regset code.

As there's only one direct user of __clear_user() (the regset code),
and the time taken to set the AMR for KUAP purposes is going to
dominate the cost of a quick access_ok(), there's not much point
having a separate path.

Rename __clear_user() to __arch_clear_user(), and make __clear_user()
just call clear_user().

Reported-by: syzbot+f25ecf4b2982d8c7a640@syzkaller-ppc64.appspotmail.com
Reported-by: Daniel Axtens <dja@axtens.net>
Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
Fixes: de78a9c42a79 ("powerpc: Add a framework for Kernel Userspace Access Protection")
Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com>
[mpe: Use __arch_clear_user() for the asm version like arm64 & nds32]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20191209132221.15328-1-ajd@linux.ibm.com
Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/include/asm/uaccess.h | 9 +++++++--
 arch/powerpc/kernel/ppc_ksyms.c    | 3 +++
 arch/powerpc/lib/string.S          | 2 +-
 arch/powerpc/lib/string_64.S       | 4 ++--
 4 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
index b55feda2838d..2332a17905ec 100644
--- a/arch/powerpc/include/asm/uaccess.h
+++ b/arch/powerpc/include/asm/uaccess.h
@@ -474,7 +474,7 @@ static inline unsigned long __copy_to_user(void __user *to,
 	return __copy_to_user_inatomic(to, from, size);
 }
 
-extern unsigned long __clear_user(void __user *addr, unsigned long size);
+unsigned long __arch_clear_user(void __user *addr, unsigned long size);
 
 static inline unsigned long clear_user(void __user *addr, unsigned long size)
 {
@@ -482,12 +482,17 @@ static inline unsigned long clear_user(void __user *addr, unsigned long size)
 	might_fault();
 	if (likely(access_ok(VERIFY_WRITE, addr, size))) {
 		allow_write_to_user(addr, size);
-		ret = __clear_user(addr, size);
+		ret = __arch_clear_user(addr, size);
 		prevent_write_to_user(addr, size);
 	}
 	return ret;
 }
 
+static inline unsigned long __clear_user(void __user *addr, unsigned long size)
+{
+	return clear_user(addr, size);
+}
+
 extern long strncpy_from_user(char *dst, const char __user *src, long count);
 extern __must_check long strlen_user(const char __user *str);
 extern __must_check long strnlen_user(const char __user *str, long n);
diff --git a/arch/powerpc/kernel/ppc_ksyms.c b/arch/powerpc/kernel/ppc_ksyms.c
index 202963ee013a..b92debacb821 100644
--- a/arch/powerpc/kernel/ppc_ksyms.c
+++ b/arch/powerpc/kernel/ppc_ksyms.c
@@ -5,6 +5,7 @@
 #include <asm/switch_to.h>
 #include <asm/cacheflush.h>
 #include <asm/epapr_hcalls.h>
+#include <asm/uaccess.h>
 
 EXPORT_SYMBOL(flush_dcache_range);
 EXPORT_SYMBOL(flush_icache_range);
@@ -43,3 +44,5 @@ EXPORT_SYMBOL(epapr_hypercall_start);
 #endif
 
 EXPORT_SYMBOL(current_stack_pointer);
+
+EXPORT_SYMBOL(__arch_clear_user);
diff --git a/arch/powerpc/lib/string.S b/arch/powerpc/lib/string.S
index c80fb49ce607..93c4c34ad091 100644
--- a/arch/powerpc/lib/string.S
+++ b/arch/powerpc/lib/string.S
@@ -122,7 +122,7 @@ _GLOBAL(memchr)
 	blr
 
 #ifdef CONFIG_PPC32
-_GLOBAL(__clear_user)
+_GLOBAL(__arch_clear_user)
 	addi	r6,r3,-4
 	li	r3,0
 	li	r5,0
diff --git a/arch/powerpc/lib/string_64.S b/arch/powerpc/lib/string_64.S
index 7bd9549a90a2..14d26ad2cd69 100644
--- a/arch/powerpc/lib/string_64.S
+++ b/arch/powerpc/lib/string_64.S
@@ -27,7 +27,7 @@ PPC64_CACHES:
 	.section	".text"
 
 /**
- * __clear_user: - Zero a block of memory in user space, with less checking.
+ * __arch_clear_user: - Zero a block of memory in user space, with less checking.
  * @to:   Destination address, in user space.
  * @n:    Number of bytes to zero.
  *
@@ -77,7 +77,7 @@ err3;	stb	r0,0(r3)
 	mr	r3,r4
 	blr
 
-_GLOBAL_TOC(__clear_user)
+_GLOBAL_TOC(__arch_clear_user)
 	cmpdi	r4,32
 	neg	r6,r3
 	li	r0,0

From 5c5ae5a19a7efa498a5d6848d425df48814655f7 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Fri, 20 Nov 2020 11:07:03 +1100
Subject: [PATCH 1038/2658] powerpc/uaccess: Evaluate macro arguments once,
 before user access is allowed

commit d02f6b7dab8228487268298ea1f21081c0b4b3eb upstream.

get/put_user() can be called with nontrivial arguments. fs/proc/page.c
has a good example:

    if (put_user(stable_page_flags(ppage), out)) {

stable_page_flags() is quite a lot of code, including spin locks in
the page allocator.

Ensure these arguments are evaluated before user access is allowed.

This improves security by reducing code with access to userspace, but
it also fixes a PREEMPT bug with KUAP on powerpc/64s:
stable_page_flags() is currently called with AMR set to allow writes,
it ends up calling spin_unlock(), which can call preempt_schedule. But
the task switch code can not be called with AMR set (it relies on
interrupts saving the register), so this blows up.

It's fine if the code inside allow_user_access() is preemptible,
because a timer or IPI will save the AMR, but it's not okay to
explicitly cause a reschedule.

Fixes: de78a9c42a79 ("powerpc: Add a framework for Kernel Userspace Access Protection")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200407041245.600651-1-npiggin@gmail.com
Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/include/asm/uaccess.h | 49 +++++++++++++++++++++---------
 1 file changed, 35 insertions(+), 14 deletions(-)

diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
index 2332a17905ec..f26d6cfec3e3 100644
--- a/arch/powerpc/include/asm/uaccess.h
+++ b/arch/powerpc/include/asm/uaccess.h
@@ -190,13 +190,17 @@ do {								\
 ({								\
 	long __pu_err;						\
 	__typeof__(*(ptr)) __user *__pu_addr = (ptr);		\
+	__typeof__(*(ptr)) __pu_val = (x);			\
+	__typeof__(size) __pu_size = (size);			\
+								\
 	if (!is_kernel_addr((unsigned long)__pu_addr))		\
 		might_fault();					\
-	__chk_user_ptr(ptr);					\
+	__chk_user_ptr(__pu_addr);				\
 	if (do_allow)								\
-		__put_user_size((x), __pu_addr, (size), __pu_err);		\
+		__put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err);	\
 	else									\
-		__put_user_size_allowed((x), __pu_addr, (size), __pu_err);	\
+		__put_user_size_allowed(__pu_val, __pu_addr, __pu_size, __pu_err); \
+								\
 	__pu_err;						\
 })
 
@@ -204,9 +208,13 @@ do {								\
 ({									\
 	long __pu_err = -EFAULT;					\
 	__typeof__(*(ptr)) __user *__pu_addr = (ptr);			\
+	__typeof__(*(ptr)) __pu_val = (x);				\
+	__typeof__(size) __pu_size = (size);				\
+									\
 	might_fault();							\
-	if (access_ok(VERIFY_WRITE, __pu_addr, size))			\
-		__put_user_size((x), __pu_addr, (size), __pu_err);	\
+	if (access_ok(VERIFY_WRITE, __pu_addr, __pu_size))			\
+		__put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \
+									\
 	__pu_err;							\
 })
 
@@ -214,8 +222,12 @@ do {								\
 ({								\
 	long __pu_err;						\
 	__typeof__(*(ptr)) __user *__pu_addr = (ptr);		\
-	__chk_user_ptr(ptr);					\
-	__put_user_size((x), __pu_addr, (size), __pu_err);	\
+	__typeof__(*(ptr)) __pu_val = (x);			\
+	__typeof__(size) __pu_size = (size);			\
+								\
+	__chk_user_ptr(__pu_addr);				\
+	__put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \
+								\
 	__pu_err;						\
 })
 
@@ -289,15 +301,18 @@ do {								\
 	long __gu_err;						\
 	unsigned long __gu_val;					\
 	__typeof__(*(ptr)) __user *__gu_addr = (ptr);	\
-	__chk_user_ptr(ptr);					\
+	__typeof__(size) __gu_size = (size);			\
+								\
+	__chk_user_ptr(__gu_addr);				\
 	if (!is_kernel_addr((unsigned long)__gu_addr))		\
 		might_fault();					\
 	barrier_nospec();					\
 	if (do_allow)								\
-		__get_user_size(__gu_val, __gu_addr, (size), __gu_err);		\
+		__get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err);	\
 	else									\
-		__get_user_size_allowed(__gu_val, __gu_addr, (size), __gu_err);	\
+		__get_user_size_allowed(__gu_val, __gu_addr, __gu_size, __gu_err); \
 	(x) = (__typeof__(*(ptr)))__gu_val;			\
+								\
 	__gu_err;						\
 })
 
@@ -322,12 +337,15 @@ do {								\
 	long __gu_err = -EFAULT;					\
 	unsigned long  __gu_val = 0;					\
 	__typeof__(*(ptr)) __user *__gu_addr = (ptr);		\
+	__typeof__(size) __gu_size = (size);				\
+									\
 	might_fault();							\
-	if (access_ok(VERIFY_READ, __gu_addr, (size))) {		\
+	if (access_ok(VERIFY_READ, __gu_addr, __gu_size)) {		\
 		barrier_nospec();					\
-		__get_user_size(__gu_val, __gu_addr, (size), __gu_err);	\
+		__get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \
 	}								\
 	(x) = (__force __typeof__(*(ptr)))__gu_val;				\
+									\
 	__gu_err;							\
 })
 
@@ -336,10 +354,13 @@ do {								\
 	long __gu_err;						\
 	unsigned long __gu_val;					\
 	__typeof__(*(ptr)) __user *__gu_addr = (ptr);	\
-	__chk_user_ptr(ptr);					\
+	__typeof__(size) __gu_size = (size);			\
+								\
+	__chk_user_ptr(__gu_addr);				\
 	barrier_nospec();					\
-	__get_user_size(__gu_val, __gu_addr, (size), __gu_err);	\
+	__get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \
 	(x) = (__force __typeof__(*(ptr)))__gu_val;			\
+								\
 	__gu_err;						\
 })
 

From f59f5dc7cae594f1789e792db6cfae40d453442e Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Fri, 20 Nov 2020 11:07:04 +1100
Subject: [PATCH 1039/2658] powerpc/64s: flush L1D after user accesses

commit 9a32a7e78bd0cd9a9b6332cbdc345ee5ffd0c5de upstream.

IBM Power9 processors can speculatively operate on data in the L1 cache before
it has been completely validated, via a way-prediction mechanism. It is not possible
for an attacker to determine the contents of impermissible memory using this method,
since these systems implement a combination of hardware and software security measures
to prevent scenarios where protected data could be leaked.

However these measures don't address the scenario where an attacker induces
the operating system to speculatively execute instructions using data that the
attacker controls. This can be used for example to speculatively bypass "kernel
user access prevention" techniques, as discovered by Anthony Steinhauser of
Google's Safeside Project. This is not an attack by itself, but there is a possibility
it could be used in conjunction with side-channels or other weaknesses in the
privileged code to construct an attack.

This issue can be mitigated by flushing the L1 cache between privilege boundaries
of concern. This patch flushes the L1 cache after user accesses.

This is part of the fix for CVE-2020-4788.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/kernel-parameters.txt           |  4 +
 .../powerpc/include/asm/book3s/64/kup-radix.h | 23 +++++
 arch/powerpc/include/asm/feature-fixups.h     |  9 ++
 arch/powerpc/include/asm/kup.h                |  4 +
 arch/powerpc/include/asm/security_features.h  |  3 +
 arch/powerpc/include/asm/setup.h              |  1 +
 arch/powerpc/kernel/exceptions-64s.S          | 86 ++++++-------------
 arch/powerpc/kernel/ppc_ksyms.c               |  7 ++
 arch/powerpc/kernel/setup_64.c                | 80 +++++++++++++++++
 arch/powerpc/kernel/vmlinux.lds.S             |  7 ++
 arch/powerpc/lib/feature-fixups.c             | 50 +++++++++++
 arch/powerpc/platforms/powernv/setup.c        |  7 +-
 arch/powerpc/platforms/pseries/setup.c        |  4 +
 13 files changed, 224 insertions(+), 61 deletions(-)
 create mode 100644 arch/powerpc/include/asm/book3s/64/kup-radix.h

diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 11256f42d342..e6db71817141 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2213,6 +2213,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 					       mds=off [X86]
 					       tsx_async_abort=off [X86]
 					       no_entry_flush [PPC]
+					       no_uaccess_flush [PPC]
 
 			auto (default)
 				Mitigate all CPU vulnerabilities, but leave SMT
@@ -2537,6 +2538,9 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 	nospec_store_bypass_disable
 			[HW] Disable all mitigations for the Speculative Store Bypass vulnerability
 
+	no_uaccess_flush
+			[PPC] Don't flush the L1-D cache after accessing user data.
+
 	noxsave		[BUGS=X86] Disables x86 extended register state save
 			and restore using xsave. The kernel will fallback to
 			enabling legacy floating-point and sse state.
diff --git a/arch/powerpc/include/asm/book3s/64/kup-radix.h b/arch/powerpc/include/asm/book3s/64/kup-radix.h
new file mode 100644
index 000000000000..cce8e7497d72
--- /dev/null
+++ b/arch/powerpc/include/asm/book3s/64/kup-radix.h
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_POWERPC_BOOK3S_64_KUP_RADIX_H
+#define _ASM_POWERPC_BOOK3S_64_KUP_RADIX_H
+#include <linux/jump_label.h>
+
+DECLARE_STATIC_KEY_FALSE(uaccess_flush_key);
+
+/* Prototype for function defined in exceptions-64s.S */
+void do_uaccess_flush(void);
+
+static __always_inline void allow_user_access(void __user *to, const void __user *from,
+					      unsigned long size)
+{
+}
+
+static inline void prevent_user_access(void __user *to, const void __user *from,
+				       unsigned long size)
+{
+	if (static_branch_unlikely(&uaccess_flush_key))
+		do_uaccess_flush();
+}
+
+#endif /* _ASM_POWERPC_BOOK3S_64_KUP_RADIX_H */
diff --git a/arch/powerpc/include/asm/feature-fixups.h b/arch/powerpc/include/asm/feature-fixups.h
index a963c26b2d34..83219710e904 100644
--- a/arch/powerpc/include/asm/feature-fixups.h
+++ b/arch/powerpc/include/asm/feature-fixups.h
@@ -200,6 +200,14 @@ label##3:					       	\
 	FTR_ENTRY_OFFSET 955b-956b;			\
 	.popsection;
 
+#define UACCESS_FLUSH_FIXUP_SECTION			\
+959:							\
+	.pushsection __uaccess_flush_fixup,"a";		\
+	.align 2;					\
+960:							\
+	FTR_ENTRY_OFFSET 959b-960b;			\
+	.popsection;
+
 #define ENTRY_FLUSH_FIXUP_SECTION			\
 957:							\
 	.pushsection __entry_flush_fixup,"a";		\
@@ -242,6 +250,7 @@ extern long stf_barrier_fallback;
 extern long entry_flush_fallback;
 extern long __start___stf_entry_barrier_fixup, __stop___stf_entry_barrier_fixup;
 extern long __start___stf_exit_barrier_fixup, __stop___stf_exit_barrier_fixup;
+extern long __start___uaccess_flush_fixup, __stop___uaccess_flush_fixup;
 extern long __start___entry_flush_fixup, __stop___entry_flush_fixup;
 extern long __start___rfi_flush_fixup, __stop___rfi_flush_fixup;
 extern long __start___barrier_nospec_fixup, __stop___barrier_nospec_fixup;
diff --git a/arch/powerpc/include/asm/kup.h b/arch/powerpc/include/asm/kup.h
index 7895d5eeaf21..f0f8e36ad71f 100644
--- a/arch/powerpc/include/asm/kup.h
+++ b/arch/powerpc/include/asm/kup.h
@@ -6,10 +6,14 @@
 
 #include <asm/pgtable.h>
 
+#ifdef CONFIG_PPC_BOOK3S_64
+#include <asm/book3s/64/kup-radix.h>
+#else
 static inline void allow_user_access(void __user *to, const void __user *from,
 				     unsigned long size) { }
 static inline void prevent_user_access(void __user *to, const void __user *from,
 				       unsigned long size) { }
+#endif /* CONFIG_PPC_BOOK3S_64 */
 
 static inline void allow_read_from_user(const void __user *from, unsigned long size)
 {
diff --git a/arch/powerpc/include/asm/security_features.h b/arch/powerpc/include/asm/security_features.h
index 082b56bf678d..3b45a64e491e 100644
--- a/arch/powerpc/include/asm/security_features.h
+++ b/arch/powerpc/include/asm/security_features.h
@@ -87,6 +87,8 @@ static inline bool security_ftr_enabled(unsigned long feature)
 // The L1-D cache should be flushed when entering the kernel
 #define SEC_FTR_L1D_FLUSH_ENTRY		0x0000000000004000ull
 
+// The L1-D cache should be flushed after user accesses from the kernel
+#define SEC_FTR_L1D_FLUSH_UACCESS	0x0000000000008000ull
 
 // Features enabled by default
 #define SEC_FTR_DEFAULT \
@@ -94,6 +96,7 @@ static inline bool security_ftr_enabled(unsigned long feature)
 	 SEC_FTR_L1D_FLUSH_PR | \
 	 SEC_FTR_BNDS_CHK_SPEC_BAR | \
 	 SEC_FTR_L1D_FLUSH_ENTRY | \
+	 SEC_FTR_L1D_FLUSH_UACCESS | \
 	 SEC_FTR_FAVOUR_SECURITY)
 
 #endif /* _ASM_POWERPC_SECURITY_FEATURES_H */
diff --git a/arch/powerpc/include/asm/setup.h b/arch/powerpc/include/asm/setup.h
index 26b55f23cf64..1ccf474f08ab 100644
--- a/arch/powerpc/include/asm/setup.h
+++ b/arch/powerpc/include/asm/setup.h
@@ -46,6 +46,7 @@ void setup_barrier_nospec(void);
 #else
 static inline void setup_barrier_nospec(void) { };
 #endif
+void do_uaccess_flush_fixups(enum l1d_flush_type types);
 void do_entry_flush_fixups(enum l1d_flush_type types);
 void do_barrier_nospec_fixups(bool enable);
 extern bool barrier_nospec_enabled;
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 7715fd89bb94..7f8e1bdbe3e2 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1630,14 +1630,9 @@ stf_barrier_fallback:
 	.endr
 	blr
 
-	.globl rfi_flush_fallback
-rfi_flush_fallback:
-	SET_SCRATCH0(r13);
-	GET_PACA(r13);
-	std	r9,PACA_EXRFI+EX_R9(r13)
-	std	r10,PACA_EXRFI+EX_R10(r13)
-	std	r11,PACA_EXRFI+EX_R11(r13)
-	mfctr	r9
+
+/* Clobbers r10, r11, ctr */
+.macro L1D_DISPLACEMENT_FLUSH
 	ld	r10,PACA_RFI_FLUSH_FALLBACK_AREA(r13)
 	ld	r11,PACA_L1D_FLUSH_SIZE(r13)
 	srdi	r11,r11,(7 + 3) /* 128 byte lines, unrolled 8x */
@@ -1663,7 +1658,18 @@ rfi_flush_fallback:
 	ld	r11,(0x80 + 8)*7(r10)
 	addi	r10,r10,0x80*8
 	bdnz	1b
+.endm
+
 
+	.globl rfi_flush_fallback
+rfi_flush_fallback:
+	SET_SCRATCH0(r13);
+	GET_PACA(r13);
+	std	r9,PACA_EXRFI+EX_R9(r13)
+	std	r10,PACA_EXRFI+EX_R10(r13)
+	std	r11,PACA_EXRFI+EX_R11(r13)
+	mfctr	r9
+	L1D_DISPLACEMENT_FLUSH
 	mtctr	r9
 	ld	r9,PACA_EXRFI+EX_R9(r13)
 	ld	r10,PACA_EXRFI+EX_R10(r13)
@@ -1679,32 +1685,7 @@ hrfi_flush_fallback:
 	std	r10,PACA_EXRFI+EX_R10(r13)
 	std	r11,PACA_EXRFI+EX_R11(r13)
 	mfctr	r9
-	ld	r10,PACA_RFI_FLUSH_FALLBACK_AREA(r13)
-	ld	r11,PACA_L1D_FLUSH_SIZE(r13)
-	srdi	r11,r11,(7 + 3) /* 128 byte lines, unrolled 8x */
-	mtctr	r11
-	DCBT_STOP_ALL_STREAM_IDS(r11) /* Stop prefetch streams */
-
-	/* order ld/st prior to dcbt stop all streams with flushing */
-	sync
-
-	/*
-	 * The load adresses are at staggered offsets within cachelines,
-	 * which suits some pipelines better (on others it should not
-	 * hurt).
-	 */
-1:
-	ld	r11,(0x80 + 8)*0(r10)
-	ld	r11,(0x80 + 8)*1(r10)
-	ld	r11,(0x80 + 8)*2(r10)
-	ld	r11,(0x80 + 8)*3(r10)
-	ld	r11,(0x80 + 8)*4(r10)
-	ld	r11,(0x80 + 8)*5(r10)
-	ld	r11,(0x80 + 8)*6(r10)
-	ld	r11,(0x80 + 8)*7(r10)
-	addi	r10,r10,0x80*8
-	bdnz	1b
-
+	L1D_DISPLACEMENT_FLUSH
 	mtctr	r9
 	ld	r9,PACA_EXRFI+EX_R9(r13)
 	ld	r10,PACA_EXRFI+EX_R10(r13)
@@ -1718,38 +1699,14 @@ entry_flush_fallback:
 	std	r10,PACA_EXRFI+EX_R10(r13)
 	std	r11,PACA_EXRFI+EX_R11(r13)
 	mfctr	r9
-	ld	r10,PACA_RFI_FLUSH_FALLBACK_AREA(r13)
-	ld	r11,PACA_L1D_FLUSH_SIZE(r13)
-	srdi	r11,r11,(7 + 3) /* 128 byte lines, unrolled 8x */
-	mtctr	r11
-	DCBT_STOP_ALL_STREAM_IDS(r11) /* Stop prefetch streams */
-
-	/* order ld/st prior to dcbt stop all streams with flushing */
-	sync
-
-	/*
-	 * The load addresses are at staggered offsets within cachelines,
-	 * which suits some pipelines better (on others it should not
-	 * hurt).
-	 */
-1:
-	ld	r11,(0x80 + 8)*0(r10)
-	ld	r11,(0x80 + 8)*1(r10)
-	ld	r11,(0x80 + 8)*2(r10)
-	ld	r11,(0x80 + 8)*3(r10)
-	ld	r11,(0x80 + 8)*4(r10)
-	ld	r11,(0x80 + 8)*5(r10)
-	ld	r11,(0x80 + 8)*6(r10)
-	ld	r11,(0x80 + 8)*7(r10)
-	addi	r10,r10,0x80*8
-	bdnz	1b
-
+	L1D_DISPLACEMENT_FLUSH
 	mtctr	r9
 	ld	r9,PACA_EXRFI+EX_R9(r13)
 	ld	r10,PACA_EXRFI+EX_R10(r13)
 	ld	r11,PACA_EXRFI+EX_R11(r13)
 	blr
 
+
 /*
  * Hash table stuff
  */
@@ -1909,3 +1866,12 @@ END_FTR_SECTION_IFSET(CPU_FTR_CFAR)
 1:	addi	r3,r1,STACK_FRAME_OVERHEAD
 	bl	kernel_bad_stack
 	b	1b
+
+_KPROBE(do_uaccess_flush)
+	UACCESS_FLUSH_FIXUP_SECTION
+	nop
+	nop
+	nop
+	blr
+	L1D_DISPLACEMENT_FLUSH
+	blr
diff --git a/arch/powerpc/kernel/ppc_ksyms.c b/arch/powerpc/kernel/ppc_ksyms.c
index b92debacb821..80eb47113d5d 100644
--- a/arch/powerpc/kernel/ppc_ksyms.c
+++ b/arch/powerpc/kernel/ppc_ksyms.c
@@ -6,6 +6,9 @@
 #include <asm/cacheflush.h>
 #include <asm/epapr_hcalls.h>
 #include <asm/uaccess.h>
+#ifdef CONFIG_PPC64
+#include <asm/book3s/64/kup-radix.h>
+#endif
 
 EXPORT_SYMBOL(flush_dcache_range);
 EXPORT_SYMBOL(flush_icache_range);
@@ -46,3 +49,7 @@ EXPORT_SYMBOL(epapr_hypercall_start);
 EXPORT_SYMBOL(current_stack_pointer);
 
 EXPORT_SYMBOL(__arch_clear_user);
+
+#ifdef CONFIG_PPC64
+EXPORT_SYMBOL(do_uaccess_flush);
+#endif
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index cd405eaffa23..3c6717569360 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -845,8 +845,12 @@ static enum l1d_flush_type enabled_flush_types;
 static void *l1d_flush_fallback_area;
 static bool no_rfi_flush;
 static bool no_entry_flush;
+static bool no_uaccess_flush;
 bool rfi_flush;
 bool entry_flush;
+bool uaccess_flush;
+DEFINE_STATIC_KEY_FALSE(uaccess_flush_key);
+EXPORT_SYMBOL(uaccess_flush_key);
 
 static int __init handle_no_rfi_flush(char *p)
 {
@@ -864,6 +868,14 @@ static int __init handle_no_entry_flush(char *p)
 }
 early_param("no_entry_flush", handle_no_entry_flush);
 
+static int __init handle_no_uaccess_flush(char *p)
+{
+	pr_info("uaccess-flush: disabled on command line.");
+	no_uaccess_flush = true;
+	return 0;
+}
+early_param("no_uaccess_flush", handle_no_uaccess_flush);
+
 /*
  * The RFI flush is not KPTI, but because users will see doco that says to use
  * nopti we hijack that option here to also disable the RFI flush.
@@ -907,6 +919,23 @@ void entry_flush_enable(bool enable)
 	entry_flush = enable;
 }
 
+void uaccess_flush_enable(bool enable)
+{
+	if (enable) {
+		do_uaccess_flush_fixups(enabled_flush_types);
+		if (static_key_initialized)
+			static_branch_enable(&uaccess_flush_key);
+		else
+			printk(KERN_DEBUG "uaccess-flush: deferring static key until after static key initialization\n");
+		on_each_cpu(do_nothing, NULL, 1);
+	} else {
+		static_branch_disable(&uaccess_flush_key);
+		do_uaccess_flush_fixups(L1D_FLUSH_NONE);
+	}
+
+	uaccess_flush = enable;
+}
+
 static void __ref init_fallback_flush(void)
 {
 	u64 l1d_size, limit;
@@ -961,6 +990,15 @@ void setup_entry_flush(bool enable)
 		entry_flush_enable(enable);
 }
 
+void setup_uaccess_flush(bool enable)
+{
+	if (cpu_mitigations_off())
+		return;
+
+	if (!no_uaccess_flush)
+		uaccess_flush_enable(enable);
+}
+
 #ifdef CONFIG_DEBUG_FS
 static int rfi_flush_set(void *data, u64 val)
 {
@@ -1014,12 +1052,54 @@ static int entry_flush_get(void *data, u64 *val)
 
 DEFINE_SIMPLE_ATTRIBUTE(fops_entry_flush, entry_flush_get, entry_flush_set, "%llu\n");
 
+static int uaccess_flush_set(void *data, u64 val)
+{
+	bool enable;
+
+	if (val == 1)
+		enable = true;
+	else if (val == 0)
+		enable = false;
+	else
+		return -EINVAL;
+
+	/* Only do anything if we're changing state */
+	if (enable != uaccess_flush)
+		uaccess_flush_enable(enable);
+
+	return 0;
+}
+
+static int uaccess_flush_get(void *data, u64 *val)
+{
+	*val = uaccess_flush ? 1 : 0;
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(fops_uaccess_flush, uaccess_flush_get, uaccess_flush_set, "%llu\n");
+
+
 static __init int rfi_flush_debugfs_init(void)
 {
 	debugfs_create_file("rfi_flush", 0600, powerpc_debugfs_root, NULL, &fops_rfi_flush);
 	debugfs_create_file("entry_flush", 0600, powerpc_debugfs_root, NULL, &fops_entry_flush);
+	debugfs_create_file("uaccess_flush", 0600, powerpc_debugfs_root, NULL, &fops_uaccess_flush);
 	return 0;
 }
 device_initcall(rfi_flush_debugfs_init);
 #endif
+
+/*
+ * setup_uaccess_flush runs before jump_label_init, so we can't do the setup
+ * there. Do it now instead.
+ */
+static __init int uaccess_flush_static_key_init(void)
+{
+	if (uaccess_flush) {
+		printk(KERN_DEBUG "uaccess-flush: switching on static key\n");
+		static_branch_enable(&uaccess_flush_key);
+	}
+	return 0;
+}
+early_initcall(uaccess_flush_static_key_init);
 #endif /* CONFIG_PPC_BOOK3S_64 */
diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
index 1c949eb4329f..ef72c0f1368d 100644
--- a/arch/powerpc/kernel/vmlinux.lds.S
+++ b/arch/powerpc/kernel/vmlinux.lds.S
@@ -81,6 +81,13 @@ SECTIONS
 		__stop___stf_entry_barrier_fixup = .;
 	}
 
+	. = ALIGN(8);
+	__uaccess_flush_fixup : AT(ADDR(__uaccess_flush_fixup) - LOAD_OFFSET) {
+		__start___uaccess_flush_fixup = .;
+		*(__uaccess_flush_fixup)
+		__stop___uaccess_flush_fixup = .;
+	}
+
 	. = ALIGN(8);
 	__entry_flush_fixup : AT(ADDR(__entry_flush_fixup) - LOAD_OFFSET) {
 		__start___entry_flush_fixup = .;
diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c
index 4f13bba13596..40b134bf5a68 100644
--- a/arch/powerpc/lib/feature-fixups.c
+++ b/arch/powerpc/lib/feature-fixups.c
@@ -229,6 +229,56 @@ void do_stf_barrier_fixups(enum stf_barrier_type types)
 	do_stf_exit_barrier_fixups(types);
 }
 
+void do_uaccess_flush_fixups(enum l1d_flush_type types)
+{
+	unsigned int instrs[4], *dest;
+	long *start, *end;
+	int i;
+
+	start = PTRRELOC(&__start___uaccess_flush_fixup);
+	end = PTRRELOC(&__stop___uaccess_flush_fixup);
+
+	instrs[0] = 0x60000000; /* nop */
+	instrs[1] = 0x60000000; /* nop */
+	instrs[2] = 0x60000000; /* nop */
+	instrs[3] = 0x4e800020; /* blr */
+
+	i = 0;
+	if (types == L1D_FLUSH_FALLBACK) {
+		instrs[3] = 0x60000000; /* nop */
+		/* fallthrough to fallback flush */
+	}
+
+	if (types & L1D_FLUSH_ORI) {
+		instrs[i++] = 0x63ff0000; /* ori 31,31,0 speculation barrier */
+		instrs[i++] = 0x63de0000; /* ori 30,30,0 L1d flush*/
+	}
+
+	if (types & L1D_FLUSH_MTTRIG)
+		instrs[i++] = 0x7c12dba6; /* mtspr TRIG2,r0 (SPR #882) */
+
+	for (i = 0; start < end; start++, i++) {
+		dest = (void *)start + *start;
+
+		pr_devel("patching dest %lx\n", (unsigned long)dest);
+
+		patch_instruction(dest, instrs[0]);
+
+		patch_instruction((dest + 1), instrs[1]);
+		patch_instruction((dest + 2), instrs[2]);
+		patch_instruction((dest + 3), instrs[3]);
+	}
+
+	printk(KERN_DEBUG "uaccess-flush: patched %d locations (%s flush)\n", i,
+		(types == L1D_FLUSH_NONE)       ? "no" :
+		(types == L1D_FLUSH_FALLBACK)   ? "fallback displacement" :
+		(types &  L1D_FLUSH_ORI)        ? (types & L1D_FLUSH_MTTRIG)
+							? "ori+mttrig type"
+							: "ori type" :
+		(types &  L1D_FLUSH_MTTRIG)     ? "mttrig type"
+						: "unknown");
+}
+
 void do_entry_flush_fixups(enum l1d_flush_type types)
 {
 	unsigned int instrs[3], *dest;
diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
index fe3f1f438f78..6259228a0e18 100644
--- a/arch/powerpc/platforms/powernv/setup.c
+++ b/arch/powerpc/platforms/powernv/setup.c
@@ -126,9 +126,10 @@ static void pnv_setup_rfi_flush(void)
 
 	/*
 	 * 4.4 doesn't support Power9 bare metal, so we don't need to flush
-	 * here - the flush fixes a P9 specific vulnerability.
+	 * here - the flushes fix a P9 specific vulnerability.
 	 */
 	security_ftr_clear(SEC_FTR_L1D_FLUSH_ENTRY);
+	security_ftr_clear(SEC_FTR_L1D_FLUSH_UACCESS);
 
 	enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) && \
 		 (security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR)   || \
@@ -140,6 +141,10 @@ static void pnv_setup_rfi_flush(void)
 	enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) &&
 		 security_ftr_enabled(SEC_FTR_L1D_FLUSH_ENTRY);
 	setup_entry_flush(enable);
+
+	enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) &&
+		 security_ftr_enabled(SEC_FTR_L1D_FLUSH_UACCESS);
+	setup_uaccess_flush(enable);
 }
 
 static void __init pnv_setup_arch(void)
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 69f1808ecbd2..498c5092bd23 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -588,6 +588,10 @@ void pseries_setup_rfi_flush(void)
 	enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) &&
 		 security_ftr_enabled(SEC_FTR_L1D_FLUSH_ENTRY);
 	setup_entry_flush(enable);
+
+	enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) &&
+		 security_ftr_enabled(SEC_FTR_L1D_FLUSH_UACCESS);
+	setup_uaccess_flush(enable);
 }
 
 static void __init pSeries_setup_arch(void)

From 13d830614e83e854ca3a6e415faf3e2e50452063 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Sun, 20 Sep 2020 23:12:38 +0200
Subject: [PATCH 1040/2658] i2c: imx: Fix external abort on interrupt in exit
 paths

commit e50e4f0b85be308a01b830c5fbdffc657e1a6dd0 upstream

If interrupt comes late, during probe error path or device remove (could
be triggered with CONFIG_DEBUG_SHIRQ), the interrupt handler
i2c_imx_isr() will access registers with the clock being disabled.  This
leads to external abort on non-linefetch on Toradex Colibri VF50 module
(with Vybrid VF5xx):

    Unhandled fault: external abort on non-linefetch (0x1008) at 0x8882d003
    Internal error: : 1008 [#1] ARM
    Modules linked in:
    CPU: 0 PID: 1 Comm: swapper Not tainted 5.7.0 #607
    Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree)
      (i2c_imx_isr) from [<8017009c>] (free_irq+0x25c/0x3b0)
      (free_irq) from [<805844ec>] (release_nodes+0x178/0x284)
      (release_nodes) from [<80580030>] (really_probe+0x10c/0x348)
      (really_probe) from [<80580380>] (driver_probe_device+0x60/0x170)
      (driver_probe_device) from [<80580630>] (device_driver_attach+0x58/0x60)
      (device_driver_attach) from [<805806bc>] (__driver_attach+0x84/0xc0)
      (__driver_attach) from [<8057e228>] (bus_for_each_dev+0x68/0xb4)
      (bus_for_each_dev) from [<8057f3ec>] (bus_add_driver+0x144/0x1ec)
      (bus_add_driver) from [<80581320>] (driver_register+0x78/0x110)
      (driver_register) from [<8010213c>] (do_one_initcall+0xa8/0x2f4)
      (do_one_initcall) from [<80c0100c>] (kernel_init_freeable+0x178/0x1dc)
      (kernel_init_freeable) from [<80807048>] (kernel_init+0x8/0x110)
      (kernel_init) from [<80100114>] (ret_from_fork+0x14/0x20)

Additionally, the i2c_imx_isr() could wake up the wait queue
(imx_i2c_struct->queue) before its initialization happens.

The resource-managed framework should not be used for interrupt handling,
because the resource will be released too late - after disabling clocks.
The interrupt handler is not prepared for such case.

Fixes: 1c4b6c3bcf30 ("i2c: imx: implement bus recovery")
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
[sudip: manual backport with extra label for goto]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/i2c/busses/i2c-imx.c | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index d121c5732d7d..37303a7a2e73 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -1093,20 +1093,20 @@ static int i2c_imx_probe(struct platform_device *pdev)
 		goto clk_disable;
 	}
 
-	/* Request IRQ */
-	ret = devm_request_irq(&pdev->dev, irq, i2c_imx_isr, 0,
-				pdev->name, i2c_imx);
-	if (ret) {
-		dev_err(&pdev->dev, "can't claim irq %d\n", irq);
-		goto clk_disable;
-	}
-
 	/* Init queue */
 	init_waitqueue_head(&i2c_imx->queue);
 
 	/* Set up adapter data */
 	i2c_set_adapdata(&i2c_imx->adapter, i2c_imx);
 
+	/* Request IRQ */
+	ret = request_threaded_irq(irq, i2c_imx_isr, NULL, 0,
+				   pdev->name, i2c_imx);
+	if (ret) {
+		dev_err(&pdev->dev, "can't claim irq %d\n", irq);
+		goto clk_disable;
+	}
+
 	/* Set up clock divider */
 	i2c_imx->bitrate = IMX_I2C_BIT_RATE;
 	ret = of_property_read_u32(pdev->dev.of_node,
@@ -1125,7 +1125,7 @@ static int i2c_imx_probe(struct platform_device *pdev)
 	ret = i2c_add_numbered_adapter(&i2c_imx->adapter);
 	if (ret < 0) {
 		dev_err(&pdev->dev, "registration failed\n");
-		goto clk_disable;
+		goto clk_free_irq;
 	}
 
 	/* Set up platform driver data */
@@ -1143,6 +1143,8 @@ static int i2c_imx_probe(struct platform_device *pdev)
 
 	return 0;   /* Return OK */
 
+clk_free_irq:
+	free_irq(irq, i2c_imx);
 clk_disable:
 	clk_disable_unprepare(i2c_imx->clk);
 	return ret;
@@ -1151,6 +1153,7 @@ static int i2c_imx_probe(struct platform_device *pdev)
 static int i2c_imx_remove(struct platform_device *pdev)
 {
 	struct imx_i2c_struct *i2c_imx = platform_get_drvdata(pdev);
+	int irq;
 
 	/* remove adapter */
 	dev_dbg(&i2c_imx->adapter.dev, "adapter removed\n");
@@ -1165,6 +1168,10 @@ static int i2c_imx_remove(struct platform_device *pdev)
 	imx_i2c_write_reg(0, i2c_imx, IMX_I2C_I2CR);
 	imx_i2c_write_reg(0, i2c_imx, IMX_I2C_I2SR);
 
+	irq = platform_get_irq(pdev, 0);
+	if (irq >= 0)
+		free_irq(irq, i2c_imx);
+
 	return 0;
 }
 

From b2b6625f31f76226d88643bcbb0915e2d540af7e Mon Sep 17 00:00:00 2001
From: Dave Chinner <dchinner@redhat.com>
Date: Fri, 23 Mar 2018 10:22:53 -0700
Subject: [PATCH 1041/2658] xfs: catch inode allocation state mismatch
 corruption

commit ee457001ed6c6f31ddad69c24c1da8f377d8472d upstream

We recently came across a V4 filesystem causing memory corruption
due to a newly allocated inode being setup twice and being added to
the superblock inode list twice. From code inspection, the only way
this could happen is if a newly allocated inode was not marked as
free on disk (i.e. di_mode wasn't zero).

Running the metadump on an upstream debug kernel fails during inode
allocation like so:

XFS: Assertion failed: ip->i_d.di_nblocks == 0, file: fs/xfs/xfs_inod=
e.c, line: 838
 ------------[ cut here ]------------
kernel BUG at fs/xfs/xfs_message.c:114!
invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 11 PID: 3496 Comm: mkdir Not tainted 4.16.0-rc5-dgc #442
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/0=
1/2014
RIP: 0010:assfail+0x28/0x30
RSP: 0018:ffffc9000236fc80 EFLAGS: 00010202
RAX: 00000000ffffffea RBX: 0000000000004000 RCX: 0000000000000000
RDX: 00000000ffffffc0 RSI: 000000000000000a RDI: ffffffff8227211b
RBP: ffffc9000236fce8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000bec R11: f000000000000000 R12: ffffc9000236fd30
R13: ffff8805c76bab80 R14: ffff8805c77ac800 R15: ffff88083fb12e10
FS:  00007fac8cbff040(0000) GS:ffff88083fd00000(0000) knlGS:0000000000000=
000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffa6783ff8 CR3: 00000005c6e2b003 CR4: 00000000000606e0
Call Trace:
 xfs_ialloc+0x383/0x570
 xfs_dir_ialloc+0x6a/0x2a0
 xfs_create+0x412/0x670
 xfs_generic_create+0x1f7/0x2c0
 ? capable_wrt_inode_uidgid+0x3f/0x50
 vfs_mkdir+0xfb/0x1b0
 SyS_mkdir+0xcf/0xf0
 do_syscall_64+0x73/0x1a0
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

Extracting the inode number we crashed on from an event trace and
looking at it with xfs_db:

xfs_db> inode 184452204
xfs_db> p
core.magic = 0x494e
core.mode = 0100644
core.version = 2
core.format = 2 (extents)
core.nlinkv2 = 1
core.onlink = 0
.....

Confirms that it is not a free inode on disk. xfs_repair
also trips over this inode:

.....
zero length extent (off = 0, fsbno = 0) in ino 184452204
correcting nextents for inode 184452204
bad attribute fork in inode 184452204, would clear attr fork
bad nblocks 1 for inode 184452204, would reset to 0
bad anextents 1 for inode 184452204, would reset to 0
imap claims in-use inode 184452204 is free, would correct imap
would have cleared inode 184452204
.....
disconnected inode 184452204, would move to lost+found

And so we have a situation where the directory structure and the
inobt thinks the inode is free, but the inode on disk thinks it is
still in use. Where this corruption came from is not possible to
diagnose, but we can detect it and prevent the kernel from oopsing
on lookup. The reproducer now results in:

$ sudo mkdir /mnt/scratch/{0,1,2,3,4,5}{0,1,2,3,4,5}
mkdir: cannot create directory =E2=80=98/mnt/scratch/00=E2=80=99: File ex=
ists
mkdir: cannot create directory =E2=80=98/mnt/scratch/01=E2=80=99: File ex=
ists
mkdir: cannot create directory =E2=80=98/mnt/scratch/03=E2=80=99: Structu=
re needs cleaning
mkdir: cannot create directory =E2=80=98/mnt/scratch/04=E2=80=99: Input/o=
utput error
mkdir: cannot create directory =E2=80=98/mnt/scratch/05=E2=80=99: Input/o=
utput error
....

And this corruption shutdown:

[   54.843517] XFS (loop0): Corruption detected! Free inode 0xafe846c not=
 marked free on disk
[   54.845885] XFS (loop0): Internal error xfs_trans_cancel at line 1023 =
of file fs/xfs/xfs_trans.c.  Caller xfs_create+0x425/0x670
[   54.848994] CPU: 10 PID: 3541 Comm: mkdir Not tainted 4.16.0-rc5-dgc #=
443
[   54.850753] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIO=
S 1.10.2-1 04/01/2014
[   54.852859] Call Trace:
[   54.853531]  dump_stack+0x85/0xc5
[   54.854385]  xfs_trans_cancel+0x197/0x1c0
[   54.855421]  xfs_create+0x425/0x670
[   54.856314]  xfs_generic_create+0x1f7/0x2c0
[   54.857390]  ? capable_wrt_inode_uidgid+0x3f/0x50
[   54.858586]  vfs_mkdir+0xfb/0x1b0
[   54.859458]  SyS_mkdir+0xcf/0xf0
[   54.860254]  do_syscall_64+0x73/0x1a0
[   54.861193]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[   54.862492] RIP: 0033:0x7fb73bddf547
[   54.863358] RSP: 002b:00007ffdaa553338 EFLAGS: 00000246 ORIG_RAX: 0000=
000000000053
[   54.865133] RAX: ffffffffffffffda RBX: 00007ffdaa55449a RCX: 00007fb73=
bddf547
[   54.866766] RDX: 0000000000000001 RSI: 00000000000001ff RDI: 00007ffda=
a55449a
[   54.868432] RBP: 00007ffdaa55449a R08: 00000000000001ff R09: 00005623a=
8670dd0
[   54.870110] R10: 00007fb73be72d5b R11: 0000000000000246 R12: 000000000=
00001ff
[   54.871752] R13: 00007ffdaa5534b0 R14: 0000000000000000 R15: 00007ffda=
a553500
[   54.873429] XFS (loop0): xfs_do_force_shutdown(0x8) called from line 1=
024 of file fs/xfs/xfs_trans.c.  Return address = ffffffff814cd050
[   54.882790] XFS (loop0): Corruption of in-memory data detected.  Shutt=
ing down filesystem
[   54.884597] XFS (loop0): Please umount the filesystem and rectify the =
problem(s)

Note that this crash is only possible on v4 filesystemsi or v5
filesystems mounted with the ikeep mount option. For all other V5
filesystems, this problem cannot occur because we don't read inodes
we are allocating from disk - we simply overwrite them with the new
inode information.

Signed-Off-By: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Tested-by: Carlos Maiolino <cmaiolino@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
[sudip: use ip->i_d.di_mode instead of VFS_I(ip)->i_mode]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/xfs_icache.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
index adbc1f59969a..8ba4635ef1b3 100644
--- a/fs/xfs/xfs_icache.c
+++ b/fs/xfs/xfs_icache.c
@@ -298,7 +298,28 @@ xfs_iget_cache_miss(
 
 	trace_xfs_iget_miss(ip);
 
-	if ((ip->i_d.di_mode == 0) && !(flags & XFS_IGET_CREATE)) {
+
+	/*
+	 * If we are allocating a new inode, then check what was returned is
+	 * actually a free, empty inode. If we are not allocating an inode,
+	 * the check we didn't find a free inode.
+	 */
+	if (flags & XFS_IGET_CREATE) {
+		if (ip->i_d.di_mode != 0) {
+			xfs_warn(mp,
+"Corruption detected! Free inode 0x%llx not marked free on disk",
+				ino);
+			error = -EFSCORRUPTED;
+			goto out_destroy;
+		}
+		if (ip->i_d.di_nblocks != 0) {
+			xfs_warn(mp,
+"Corruption detected! Free inode 0x%llx has blocks allocated!",
+				ino);
+			error = -EFSCORRUPTED;
+			goto out_destroy;
+		}
+	} else if (ip->i_d.di_mode == 0) {
 		error = -ENOENT;
 		goto out_destroy;
 	}

From 57aaf4051ff64e815fc0de76949251e5f82a3d5d Mon Sep 17 00:00:00 2001
From: Dave Chinner <dchinner@redhat.com>
Date: Tue, 17 Apr 2018 17:17:34 -0700
Subject: [PATCH 1042/2658] xfs: validate cached inodes are free when allocated

commit afca6c5b2595fc44383919fba740c194b0b76aff upstream

A recent fuzzed filesystem image cached random dcache corruption
when the reproducer was run. This often showed up as panics in
lookup_slow() on a null inode->i_ops pointer when doing pathwalks.

BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
....
Call Trace:
 lookup_slow+0x44/0x60
 walk_component+0x3dd/0x9f0
 link_path_walk+0x4a7/0x830
 path_lookupat+0xc1/0x470
 filename_lookup+0x129/0x270
 user_path_at_empty+0x36/0x40
 path_listxattr+0x98/0x110
 SyS_listxattr+0x13/0x20
 do_syscall_64+0xf5/0x280
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

but had many different failure modes including deadlocks trying to
lock the inode that was just allocated or KASAN reports of
use-after-free violations.

The cause of the problem was a corrupt INOBT on a v4 fs where the
root inode was marked as free in the inobt record. Hence when we
allocated an inode, it chose the root inode to allocate, found it in
the cache and re-initialised it.

We recently fixed a similar inode allocation issue caused by inobt
record corruption problem in xfs_iget_cache_miss() in commit
ee457001ed6c ("xfs: catch inode allocation state mismatch
corruption"). This change adds similar checks to the cache-hit path
to catch it, and turns the reproducer into a corruption shutdown
situation.

Reported-by: Wen Xu <wen.xu@gatech.edu>
Signed-Off-By: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
[darrick: fix typos in comment]
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
[sudip: use ip->i_d.di_mode instead of VFS_I(ip)->i_mode]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/xfs_icache.c | 73 +++++++++++++++++++++++++++++----------------
 1 file changed, 48 insertions(+), 25 deletions(-)

diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
index 8ba4635ef1b3..d8cdab4bfd30 100644
--- a/fs/xfs/xfs_icache.c
+++ b/fs/xfs/xfs_icache.c
@@ -134,6 +134,46 @@ xfs_inode_free(
 	call_rcu(&VFS_I(ip)->i_rcu, xfs_inode_free_callback);
 }
 
+/*
+ * If we are allocating a new inode, then check what was returned is
+ * actually a free, empty inode. If we are not allocating an inode,
+ * then check we didn't find a free inode.
+ *
+ * Returns:
+ *	0		if the inode free state matches the lookup context
+ *	-ENOENT		if the inode is free and we are not allocating
+ *	-EFSCORRUPTED	if there is any state mismatch at all
+ */
+static int
+xfs_iget_check_free_state(
+	struct xfs_inode	*ip,
+	int			flags)
+{
+	if (flags & XFS_IGET_CREATE) {
+		/* should be a free inode */
+		if (ip->i_d.di_mode != 0) {
+			xfs_warn(ip->i_mount,
+"Corruption detected! Free inode 0x%llx not marked free! (mode 0x%x)",
+				ip->i_ino, ip->i_d.di_mode);
+			return -EFSCORRUPTED;
+		}
+
+		if (ip->i_d.di_nblocks != 0) {
+			xfs_warn(ip->i_mount,
+"Corruption detected! Free inode 0x%llx has blocks allocated!",
+				ip->i_ino);
+			return -EFSCORRUPTED;
+		}
+		return 0;
+	}
+
+	/* should be an allocated inode */
+	if (ip->i_d.di_mode == 0)
+		return -ENOENT;
+
+	return 0;
+}
+
 /*
  * Check the validity of the inode we just found it the cache
  */
@@ -183,12 +223,12 @@ xfs_iget_cache_hit(
 	}
 
 	/*
-	 * If lookup is racing with unlink return an error immediately.
+	 * Check the inode free state is valid. This also detects lookup
+	 * racing with unlinks.
 	 */
-	if (ip->i_d.di_mode == 0 && !(flags & XFS_IGET_CREATE)) {
-		error = -ENOENT;
+	error = xfs_iget_check_free_state(ip, flags);
+	if (error)
 		goto out_error;
-	}
 
 	/*
 	 * If IRECLAIMABLE is set, we've torn down the VFS inode already.
@@ -300,29 +340,12 @@ xfs_iget_cache_miss(
 
 
 	/*
-	 * If we are allocating a new inode, then check what was returned is
-	 * actually a free, empty inode. If we are not allocating an inode,
-	 * the check we didn't find a free inode.
+	 * Check the inode free state is valid. This also detects lookup
+	 * racing with unlinks.
 	 */
-	if (flags & XFS_IGET_CREATE) {
-		if (ip->i_d.di_mode != 0) {
-			xfs_warn(mp,
-"Corruption detected! Free inode 0x%llx not marked free on disk",
-				ino);
-			error = -EFSCORRUPTED;
-			goto out_destroy;
-		}
-		if (ip->i_d.di_nblocks != 0) {
-			xfs_warn(mp,
-"Corruption detected! Free inode 0x%llx has blocks allocated!",
-				ino);
-			error = -EFSCORRUPTED;
-			goto out_destroy;
-		}
-	} else if (ip->i_d.di_mode == 0) {
-		error = -ENOENT;
+	error = xfs_iget_check_free_state(ip, flags);
+	if (error)
 		goto out_destroy;
-	}
 
 	/*
 	 * Preload the radix tree so we can insert safely under the

From 8197ba9f4b496ef015fb944d6ac33eadfb552ab9 Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@csgroup.eu>
Date: Mon, 12 Oct 2020 08:54:31 +0000
Subject: [PATCH 1043/2658] powerpc/8xx: Always fault when _PAGE_ACCESSED is
 not set

commit 29daf869cbab69088fe1755d9dd224e99ba78b56 upstream.

The kernel expects pte_young() to work regardless of CONFIG_SWAP.

Make sure a minor fault is taken to set _PAGE_ACCESSED when it
is not already set, regardless of the selection of CONFIG_SWAP.

This adds at least 3 instructions to the TLB miss exception
handlers fast path. Following patch will reduce this overhead.

Also update the rotation instruction to the correct number of bits
to reflect all changes done to _PAGE_ACCESSED over time.

Fixes: d069cb4373fe ("powerpc/8xx: Don't touch ACCESSED when no SWAP.")
Fixes: 5f356497c384 ("powerpc/8xx: remove unused _PAGE_WRITETHRU")
Fixes: e0a8e0d90a9f ("powerpc/8xx: Handle PAGE_USER via APG bits")
Fixes: 5b2753fc3e8a ("powerpc/8xx: Implementation of PAGE_EXEC")
Fixes: a891c43b97d3 ("powerpc/8xx: Prepare handlers for _PAGE_HUGE for 512k pages.")
Cc: stable@vger.kernel.org
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/af834e8a0f1fa97bfae65664950f0984a70c4750.1602492856.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kernel/head_8xx.S | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
index 01e274e6907b..3d7512e72900 100644
--- a/arch/powerpc/kernel/head_8xx.S
+++ b/arch/powerpc/kernel/head_8xx.S
@@ -361,11 +361,9 @@ InstructionTLBMiss:
 	/* Load the MI_TWC with the attributes for this "segment." */
 	MTSPR_CPU6(SPRN_MI_TWC, r11, r3)	/* Set segment attributes */
 
-#ifdef CONFIG_SWAP
-	rlwinm	r11, r10, 32-5, _PAGE_PRESENT
+	rlwinm	r11, r10, 32-11, _PAGE_PRESENT
 	and	r11, r11, r10
 	rlwimi	r10, r11, 0, _PAGE_PRESENT
-#endif
 	li	r11, RPN_PATTERN
 	/* The Linux PTE won't go exactly into the MMU TLB.
 	 * Software indicator bits 20-23 and 28 must be clear.
@@ -436,11 +434,9 @@ DataStoreTLBMiss:
 	 * r11 = ((r10 & PRESENT) & ((r10 & ACCESSED) >> 5));
 	 * r10 = (r10 & ~PRESENT) | r11;
 	 */
-#ifdef CONFIG_SWAP
-	rlwinm	r11, r10, 32-5, _PAGE_PRESENT
+	rlwinm	r11, r10, 32-11, _PAGE_PRESENT
 	and	r11, r11, r10
 	rlwimi	r10, r11, 0, _PAGE_PRESENT
-#endif
 	/* The Linux PTE won't go exactly into the MMU TLB.
 	 * Software indicator bits 22 and 28 must be clear.
 	 * Software indicator bits 24, 25, 26, and 27 must be

From 3c761a31de691f9d880c6635323d4615d8b45d88 Mon Sep 17 00:00:00 2001
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: Mon, 26 Oct 2020 13:36:17 -0700
Subject: [PATCH 1044/2658] Input: sunkbd - avoid use-after-free in teardown
 paths

commit 77e70d351db7de07a46ac49b87a6c3c7a60fca7e upstream.

We need to make sure we cancel the reinit work before we tear down the
driver structures.

Reported-by: Bodong Zhao <nopitydays@gmail.com>
Tested-by: Bodong Zhao <nopitydays@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/keyboard/sunkbd.c | 41 ++++++++++++++++++++++++++-------
 1 file changed, 33 insertions(+), 8 deletions(-)

diff --git a/drivers/input/keyboard/sunkbd.c b/drivers/input/keyboard/sunkbd.c
index dc6bb9d5b4f0..191c27dda386 100644
--- a/drivers/input/keyboard/sunkbd.c
+++ b/drivers/input/keyboard/sunkbd.c
@@ -115,7 +115,8 @@ static irqreturn_t sunkbd_interrupt(struct serio *serio,
 	switch (data) {
 
 	case SUNKBD_RET_RESET:
-		schedule_work(&sunkbd->tq);
+		if (sunkbd->enabled)
+			schedule_work(&sunkbd->tq);
 		sunkbd->reset = -1;
 		break;
 
@@ -216,16 +217,12 @@ static int sunkbd_initialize(struct sunkbd *sunkbd)
 }
 
 /*
- * sunkbd_reinit() sets leds and beeps to a state the computer remembers they
- * were in.
+ * sunkbd_set_leds_beeps() sets leds and beeps to a state the computer remembers
+ * they were in.
  */
 
-static void sunkbd_reinit(struct work_struct *work)
+static void sunkbd_set_leds_beeps(struct sunkbd *sunkbd)
 {
-	struct sunkbd *sunkbd = container_of(work, struct sunkbd, tq);
-
-	wait_event_interruptible_timeout(sunkbd->wait, sunkbd->reset >= 0, HZ);
-
 	serio_write(sunkbd->serio, SUNKBD_CMD_SETLED);
 	serio_write(sunkbd->serio,
 		(!!test_bit(LED_CAPSL,   sunkbd->dev->led) << 3) |
@@ -238,11 +235,39 @@ static void sunkbd_reinit(struct work_struct *work)
 		SUNKBD_CMD_BELLOFF - !!test_bit(SND_BELL, sunkbd->dev->snd));
 }
 
+
+/*
+ * sunkbd_reinit() wait for the keyboard reset to complete and restores state
+ * of leds and beeps.
+ */
+
+static void sunkbd_reinit(struct work_struct *work)
+{
+	struct sunkbd *sunkbd = container_of(work, struct sunkbd, tq);
+
+	/*
+	 * It is OK that we check sunkbd->enabled without pausing serio,
+	 * as we only want to catch true->false transition that will
+	 * happen once and we will be woken up for it.
+	 */
+	wait_event_interruptible_timeout(sunkbd->wait,
+					 sunkbd->reset >= 0 || !sunkbd->enabled,
+					 HZ);
+
+	if (sunkbd->reset >= 0 && sunkbd->enabled)
+		sunkbd_set_leds_beeps(sunkbd);
+}
+
 static void sunkbd_enable(struct sunkbd *sunkbd, bool enable)
 {
 	serio_pause_rx(sunkbd->serio);
 	sunkbd->enabled = enable;
 	serio_continue_rx(sunkbd->serio);
+
+	if (!enable) {
+		wake_up_interruptible(&sunkbd->wait);
+		cancel_work_sync(&sunkbd->tq);
+	}
 }
 
 /*

From 9836fdf0fe35c1b111ec21700ef81bfd43332e34 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Fri, 9 Oct 2020 14:17:11 +0200
Subject: [PATCH 1045/2658] mac80211: always wind down STA state

commit dcd479e10a0510522a5d88b29b8f79ea3467d501 upstream.

When (for example) an IBSS station is pre-moved to AUTHORIZED
before it's inserted, and then the insertion fails, we don't
clean up the fast RX/TX states that might already have been
created, since we don't go through all the state transitions
again on the way down.

Do that, if it hasn't been done already, when the station is
freed. I considered only freeing the fast TX/RX state there,
but we might add more state so it's more robust to wind down
the state properly.

Note that we warn if the station was ever inserted, it should
have been properly cleaned up in that case, and the driver
will probably not like things happening out of order.

Reported-by: syzbot+2e293dbd67de2836ba42@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20201009141710.7223b322a955.I95bd08b9ad0e039c034927cce0b75beea38e059b@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/sta_info.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 91d8e9dd5c80..e302c71ad3cf 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -243,6 +243,24 @@ struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata,
  */
 void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
 {
+	/*
+	 * If we had used sta_info_pre_move_state() then we might not
+	 * have gone through the state transitions down again, so do
+	 * it here now (and warn if it's inserted).
+	 *
+	 * This will clear state such as fast TX/RX that may have been
+	 * allocated during state transitions.
+	 */
+	while (sta->sta_state > IEEE80211_STA_NONE) {
+		int ret;
+
+		WARN_ON_ONCE(test_sta_flag(sta, WLAN_STA_INSERTED));
+
+		ret = sta_info_move_state(sta, sta->sta_state - 1);
+		if (WARN_ONCE(ret, "sta_info_move_state() returned %d\n", ret))
+			break;
+	}
+
 	if (sta->rate_ctrl)
 		rate_control_free_sta(sta);
 

From 56e3203683be2cf35715082700c46302bc7615a5 Mon Sep 17 00:00:00 2001
From: David Edmondson <david.edmondson@oracle.com>
Date: Tue, 3 Nov 2020 12:04:00 +0000
Subject: [PATCH 1046/2658] KVM: x86: clflushopt should be treated as a no-op
 by emulation

commit 51b958e5aeb1e18c00332e0b37c5d4e95a3eff84 upstream.

The instruction emulator ignores clflush instructions, yet fails to
support clflushopt. Treat both similarly.

Fixes: 13e457e0eebf ("KVM: x86: Emulator does not decode clflush well")
Signed-off-by: David Edmondson <david.edmondson@oracle.com>
Message-Id: <20201103120400.240882-1-david.edmondson@oracle.com>
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/emulate.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 5dff8482626e..7dec8a40c706 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -3921,6 +3921,12 @@ static int em_clflush(struct x86_emulate_ctxt *ctxt)
 	return X86EMUL_CONTINUE;
 }
 
+static int em_clflushopt(struct x86_emulate_ctxt *ctxt)
+{
+	/* emulating clflushopt regardless of cpuid */
+	return X86EMUL_CONTINUE;
+}
+
 static int em_movsxd(struct x86_emulate_ctxt *ctxt)
 {
 	ctxt->dst.val = (s32) ctxt->src.val;
@@ -4410,7 +4416,7 @@ static const struct opcode group11[] = {
 };
 
 static const struct gprefix pfx_0f_ae_7 = {
-	I(SrcMem | ByteOp, em_clflush), N, N, N,
+	I(SrcMem | ByteOp, em_clflush), I(SrcMem | ByteOp, em_clflushopt), N, N,
 };
 
 static const struct group_dual group15 = { {

From 75295ef09de3091d5f78582039be9019ddfd59f8 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sun, 22 Nov 2020 09:56:59 +0100
Subject: [PATCH 1047/2658] Linux 4.4.245

Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20201120104539.534424264@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 4e13e9b31f71..3e9059bf121d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 244
+SUBLEVEL = 245
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 58cfba709d51ecb1c450aec0cd246e7369576b57 Mon Sep 17 00:00:00 2001
From: Zhang Changzhong <zhangchangzhong@huawei.com>
Date: Tue, 17 Nov 2020 10:45:05 +0800
Subject: [PATCH 1048/2658] ah6: fix error return code in ah6_input()

[ Upstream commit a5ebcbdf34b65fcc07f38eaf2d60563b42619a59 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Link: https://lore.kernel.org/r/1605581105-35295-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/ah6.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index e742c4deb13d..98d253d7bed3 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -595,7 +595,8 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
 	memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
 	memset(ah->auth_data, 0, ahp->icv_trunc_len);
 
-	if (ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN))
+	err = ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN);
+	if (err)
 		goto out_free;
 
 	ip6h->priority    = 0;

From b2678d401f00dcb7d84d04d377b3db74dbc84cd2 Mon Sep 17 00:00:00 2001
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date: Mon, 16 Nov 2020 17:21:14 +0100
Subject: [PATCH 1049/2658] atm: nicstar: Unmap DMA on send error

[ Upstream commit 6dceaa9f56e22d0f9b4c4ad2ed9e04e315ce7fe5 ]

The `skb' is mapped for DMA in ns_send() but does not unmap DMA in case
push_scqe() fails to submit the `skb'. The memory of the `skb' is
released so only the DMA mapping is leaking.

Unmap the DMA mapping in case push_scqe() failed.

Fixes: 864a3ff635fa7 ("atm: [nicstar] remove virt_to_bus() and support 64-bit platforms")
Cc: Chas Williams <3chas3@gmail.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/atm/nicstar.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
index ddc4ceb85fc5..49da83f87170 100644
--- a/drivers/atm/nicstar.c
+++ b/drivers/atm/nicstar.c
@@ -1704,6 +1704,8 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
 
 	if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
 		atomic_inc(&vcc->stats->tx_err);
+		dma_unmap_single(&card->pcidev->dev, NS_PRV_DMA(skb), skb->len,
+				 DMA_TO_DEVICE);
 		dev_kfree_skb_any(skb);
 		return -EIO;
 	}

From c0f60dd099b64b634edc8750fb04a1a3b84d2692 Mon Sep 17 00:00:00 2001
From: Zhang Changzhong <zhangchangzhong@huawei.com>
Date: Tue, 17 Nov 2020 11:02:11 +0800
Subject: [PATCH 1050/2658] net: b44: fix error return code in b44_init_one()

[ Upstream commit 7b027c249da54f492699c43e26cba486cfd48035 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 39a6f4bce6b4 ("b44: replace the ssb_dma API with the generic DMA API")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Link: https://lore.kernel.org/r/1605582131-36735-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/b44.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index e7214edfe5b4..4db19cf5b587 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -2393,7 +2393,8 @@ static int b44_init_one(struct ssb_device *sdev,
 		goto err_out_free_dev;
 	}
 
-	if (dma_set_mask_and_coherent(sdev->dma_dev, DMA_BIT_MASK(30))) {
+	err = dma_set_mask_and_coherent(sdev->dma_dev, DMA_BIT_MASK(30));
+	if (err) {
 		dev_err(sdev->dev,
 			"Required 30BIT DMA mask unsupported by the system\n");
 		goto err_out_powerdown;

From c7b56a262c9bea2e026d4cf26a5fd0bc77419cf8 Mon Sep 17 00:00:00 2001
From: Heiner Kallweit <hkallweit1@gmail.com>
Date: Fri, 13 Nov 2020 10:27:27 +0100
Subject: [PATCH 1051/2658] net: bridge: add missing counters to
 ndo_get_stats64 callback

[ Upstream commit 7a30ecc9237681bb125cbd30eee92bef7e86293d ]

In br_forward.c and br_input.c fields dev->stats.tx_dropped and
dev->stats.multicast are populated, but they are ignored in
ndo_get_stats64.

Fixes: 28172739f0a2 ("net: fix 64 bit counters on 32 bit arches")
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/58ea9963-77ad-a7cf-8dfd-fc95ab95f606@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bridge/br_device.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 8d013fed5298..49c29fa7fd30 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -167,6 +167,7 @@ static struct rtnl_link_stats64 *br_get_stats64(struct net_device *dev,
 		sum.rx_packets += tmp.rx_packets;
 	}
 
+	netdev_stats_to_stats64(stats, &dev->stats);
 	stats->tx_bytes   = sum.tx_bytes;
 	stats->tx_packets = sum.tx_packets;
 	stats->rx_bytes   = sum.rx_bytes;

From 777c336472f0c3932502521b167c184c48a67a41 Mon Sep 17 00:00:00 2001
From: Paul Moore <paul@paul-moore.com>
Date: Sun, 8 Nov 2020 09:08:26 -0500
Subject: [PATCH 1052/2658] netlabel: fix our progress tracking in
 netlbl_unlabel_staticlist()

[ Upstream commit 866358ec331f8faa394995fb4b511af1db0247c8 ]

The current NetLabel code doesn't correctly keep track of the netlink
dump state in some cases, in particular when multiple interfaces with
large configurations are loaded.  The problem manifests itself by not
reporting the full configuration to userspace, even though it is
loaded and active in the kernel.  This patch fixes this by ensuring
that the dump state is properly reset when necessary inside the
netlbl_unlabel_staticlist() function.

Fixes: 8cc44579d1bd ("NetLabel: Introduce static network labels for unlabeled connections")
Signed-off-by: Paul Moore <paul@paul-moore.com>
Link: https://lore.kernel.org/r/160484450633.3752.16512718263560813473.stgit@sifl
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netlabel/netlabel_unlabeled.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index 9f4ec16abfcf..2e13c31e5832 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -1185,12 +1185,13 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
 	struct netlbl_unlhsh_walk_arg cb_arg;
 	u32 skip_bkt = cb->args[0];
 	u32 skip_chain = cb->args[1];
-	u32 iter_bkt;
-	u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
+	u32 skip_addr4 = cb->args[2];
+	u32 iter_bkt, iter_chain, iter_addr4 = 0, iter_addr6 = 0;
 	struct netlbl_unlhsh_iface *iface;
 	struct list_head *iter_list;
 	struct netlbl_af4list *addr4;
 #if IS_ENABLED(CONFIG_IPV6)
+	u32 skip_addr6 = cb->args[3];
 	struct netlbl_af6list *addr6;
 #endif
 
@@ -1201,7 +1202,7 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
 	rcu_read_lock();
 	for (iter_bkt = skip_bkt;
 	     iter_bkt < rcu_dereference(netlbl_unlhsh)->size;
-	     iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) {
+	     iter_bkt++) {
 		iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt];
 		list_for_each_entry_rcu(iface, iter_list, list) {
 			if (!iface->valid ||
@@ -1209,7 +1210,7 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
 				continue;
 			netlbl_af4list_foreach_rcu(addr4,
 						   &iface->addr4_list) {
-				if (iter_addr4++ < cb->args[2])
+				if (iter_addr4++ < skip_addr4)
 					continue;
 				if (netlbl_unlabel_staticlist_gen(
 					      NLBL_UNLABEL_C_STATICLIST,
@@ -1222,10 +1223,12 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
 					goto unlabel_staticlist_return;
 				}
 			}
+			iter_addr4 = 0;
+			skip_addr4 = 0;
 #if IS_ENABLED(CONFIG_IPV6)
 			netlbl_af6list_foreach_rcu(addr6,
 						   &iface->addr6_list) {
-				if (iter_addr6++ < cb->args[3])
+				if (iter_addr6++ < skip_addr6)
 					continue;
 				if (netlbl_unlabel_staticlist_gen(
 					      NLBL_UNLABEL_C_STATICLIST,
@@ -1238,8 +1241,12 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
 					goto unlabel_staticlist_return;
 				}
 			}
+			iter_addr6 = 0;
+			skip_addr6 = 0;
 #endif /* IPv6 */
 		}
+		iter_chain = 0;
+		skip_chain = 0;
 	}
 
 unlabel_staticlist_return:

From ad732b99a2f9ef35fd43931242ce91b5b58f884f Mon Sep 17 00:00:00 2001
From: Paul Moore <paul@paul-moore.com>
Date: Fri, 13 Nov 2020 16:30:40 -0500
Subject: [PATCH 1053/2658] netlabel: fix an uninitialized warning in
 netlbl_unlabel_staticlist()

[ Upstream commit 1ba86d4366e023d96df3dbe415eea7f1dc08c303 ]

Static checking revealed that a previous fix to
netlbl_unlabel_staticlist() leaves a stack variable uninitialized,
this patches fixes that.

Fixes: 866358ec331f ("netlabel: fix our progress tracking in netlbl_unlabel_staticlist()")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Reviewed-by: James Morris <jamorris@linux.microsoft.com>
Link: https://lore.kernel.org/r/160530304068.15651.18355773009751195447.stgit@sifl
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netlabel/netlabel_unlabeled.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index 2e13c31e5832..5210f5546e3e 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -1186,7 +1186,7 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
 	u32 skip_bkt = cb->args[0];
 	u32 skip_chain = cb->args[1];
 	u32 skip_addr4 = cb->args[2];
-	u32 iter_bkt, iter_chain, iter_addr4 = 0, iter_addr6 = 0;
+	u32 iter_bkt, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
 	struct netlbl_unlhsh_iface *iface;
 	struct list_head *iter_list;
 	struct netlbl_af4list *addr4;

From 263a3069e3ec006c4966a4060d87336a117648a3 Mon Sep 17 00:00:00 2001
From: Aya Levin <ayal@nvidia.com>
Date: Wed, 18 Nov 2020 10:19:22 +0200
Subject: [PATCH 1054/2658] net/mlx4_core: Fix init_hca fields offset

[ Upstream commit 6d9c8d15af0ef20a66a0b432cac0d08319920602 ]

Slave function read the following capabilities from the wrong offset:
1. log_mc_entry_sz
2. fs_log_entry_sz
3. log_mc_hash_sz

Fix that by adjusting these capabilities offset to match firmware
layout.

Due to the wrong offset read, the following issues might occur:
1+2. Negative value reported at max_mcast_qp_attach.
3. Driver to init FW with multicast hash size of zero.

Fixes: a40ded604365 ("net/mlx4_core: Add masking for a few queries on HCA caps")
Signed-off-by: Aya Levin <ayal@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Reviewed-by: Eran Ben Elisha <eranbe@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://lore.kernel.org/r/20201118081922.553-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx4/fw.c | 6 +++---
 drivers/net/ethernet/mellanox/mlx4/fw.h | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 0a4e9731d33b..b6ae4b17555b 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -1711,14 +1711,14 @@ int mlx4_INIT_HCA(struct mlx4_dev *dev, struct mlx4_init_hca_param *param)
 #define	 INIT_HCA_LOG_RD_OFFSET		 (INIT_HCA_QPC_OFFSET + 0x77)
 #define INIT_HCA_MCAST_OFFSET		 0x0c0
 #define	 INIT_HCA_MC_BASE_OFFSET	 (INIT_HCA_MCAST_OFFSET + 0x00)
-#define	 INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x12)
-#define	 INIT_HCA_LOG_MC_HASH_SZ_OFFSET	 (INIT_HCA_MCAST_OFFSET + 0x16)
+#define	 INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x13)
+#define	 INIT_HCA_LOG_MC_HASH_SZ_OFFSET	 (INIT_HCA_MCAST_OFFSET + 0x17)
 #define  INIT_HCA_UC_STEERING_OFFSET	 (INIT_HCA_MCAST_OFFSET + 0x18)
 #define	 INIT_HCA_LOG_MC_TABLE_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x1b)
 #define  INIT_HCA_DEVICE_MANAGED_FLOW_STEERING_EN	0x6
 #define  INIT_HCA_FS_PARAM_OFFSET         0x1d0
 #define  INIT_HCA_FS_BASE_OFFSET          (INIT_HCA_FS_PARAM_OFFSET + 0x00)
-#define  INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET  (INIT_HCA_FS_PARAM_OFFSET + 0x12)
+#define  INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET  (INIT_HCA_FS_PARAM_OFFSET + 0x13)
 #define  INIT_HCA_FS_A0_OFFSET		  (INIT_HCA_FS_PARAM_OFFSET + 0x18)
 #define  INIT_HCA_FS_LOG_TABLE_SZ_OFFSET  (INIT_HCA_FS_PARAM_OFFSET + 0x1b)
 #define  INIT_HCA_FS_ETH_BITS_OFFSET      (INIT_HCA_FS_PARAM_OFFSET + 0x21)
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.h b/drivers/net/ethernet/mellanox/mlx4/fw.h
index 074631be342b..8f04c26da36e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.h
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.h
@@ -184,8 +184,8 @@ struct mlx4_init_hca_param {
 	u64 cmpt_base;
 	u64 mtt_base;
 	u64 global_caps;
-	u16 log_mc_entry_sz;
-	u16 log_mc_hash_sz;
+	u8 log_mc_entry_sz;
+	u8 log_mc_hash_sz;
 	u16 hca_core_clock; /* Internal Clock Frequency (in MHz) */
 	u8  log_num_qps;
 	u8  log_num_srqs;

From 90f93f2f0f4900e87154d116d11ddc8850e22906 Mon Sep 17 00:00:00 2001
From: Xie He <xie.he.0141@gmail.com>
Date: Thu, 12 Nov 2020 02:35:06 -0800
Subject: [PATCH 1055/2658] net: x25: Increase refcnt of "struct x25_neigh" in
 x25_rx_call_request

[ Upstream commit 4ee18c179e5e815fa5575e0d2db0c05795a804ee ]

The x25_disconnect function in x25_subr.c would decrease the refcount of
"x25->neighbour" (struct x25_neigh) and reset this pointer to NULL.

However, the x25_rx_call_request function in af_x25.c, which is called
when we receive a connection request, does not increase the refcount when
it assigns the pointer.

Fix this issue by increasing the refcount of "struct x25_neigh" in
x25_rx_call_request.

This patch fixes frequent kernel crashes when using AF_X25 sockets.

Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect")
Cc: Martin Schiller <ms@dev.tdt.de>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Link: https://lore.kernel.org/r/20201112103506.5875-1-xie.he.0141@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/x25/af_x25.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index e39bb38eedf3..dd9a0cff2287 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1047,6 +1047,7 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
 	makex25->lci           = lci;
 	makex25->dest_addr     = dest_addr;
 	makex25->source_addr   = source_addr;
+	x25_neigh_hold(nb);
 	makex25->neighbour     = nb;
 	makex25->facilities    = facilities;
 	makex25->dte_facilities= dte_facilities;

From a7c2014293a7941c2394b0baf01080f0f1729870 Mon Sep 17 00:00:00 2001
From: Zhang Changzhong <zhangchangzhong@huawei.com>
Date: Fri, 13 Nov 2020 14:16:26 +0800
Subject: [PATCH 1056/2658] qlcnic: fix error return code in
 qlcnic_83xx_restart_hw()

[ Upstream commit 3beb9be165083c2964eba1923601c3bfac0b02d4 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 3ced0a88cd4c ("qlcnic: Add support to run firmware POST")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Link: https://lore.kernel.org/r/1605248186-16013-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
index 083aeca77c75..b0f51ff9e5b3 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -2255,7 +2255,8 @@ static int qlcnic_83xx_restart_hw(struct qlcnic_adapter *adapter)
 
 	/* Boot either flash image or firmware image from host file system */
 	if (qlcnic_load_fw_file == 1) {
-		if (qlcnic_83xx_load_fw_image_from_host(adapter))
+		err = qlcnic_83xx_load_fw_image_from_host(adapter);
+		if (err)
 			return err;
 	} else {
 		QLC_SHARED_REG_WR32(adapter, QLCNIC_FW_IMG_VALID,

From 9007628e91c1a9e09db10d2f18dacca26ab8c694 Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Sat, 14 Nov 2020 13:22:53 +0800
Subject: [PATCH 1057/2658] sctp: change to hold/put transport for
 proto_unreach_timer

[ Upstream commit 057a10fa1f73d745c8e69aa54ab147715f5630ae ]

A call trace was found in Hangbin's Codenomicon testing with debug kernel:

  [ 2615.981988] ODEBUG: free active (active state 0) object type: timer_list hint: sctp_generate_proto_unreach_event+0x0/0x3a0 [sctp]
  [ 2615.995050] WARNING: CPU: 17 PID: 0 at lib/debugobjects.c:328 debug_print_object+0x199/0x2b0
  [ 2616.095934] RIP: 0010:debug_print_object+0x199/0x2b0
  [ 2616.191533] Call Trace:
  [ 2616.194265]  <IRQ>
  [ 2616.202068]  debug_check_no_obj_freed+0x25e/0x3f0
  [ 2616.207336]  slab_free_freelist_hook+0xeb/0x140
  [ 2616.220971]  kfree+0xd6/0x2c0
  [ 2616.224293]  rcu_do_batch+0x3bd/0xc70
  [ 2616.243096]  rcu_core+0x8b9/0xd00
  [ 2616.256065]  __do_softirq+0x23d/0xacd
  [ 2616.260166]  irq_exit+0x236/0x2a0
  [ 2616.263879]  smp_apic_timer_interrupt+0x18d/0x620
  [ 2616.269138]  apic_timer_interrupt+0xf/0x20
  [ 2616.273711]  </IRQ>

This is because it holds asoc when transport->proto_unreach_timer starts
and puts asoc when the timer stops, and without holding transport the
transport could be freed when the timer is still running.

So fix it by holding/putting transport instead for proto_unreach_timer
in transport, just like other timers in transport.

v1->v2:
  - Also use sctp_transport_put() for the "out_unlock:" path in
    sctp_generate_proto_unreach_event(), as Marcelo noticed.

Fixes: 50b5d6ad6382 ("sctp: Fix a race between ICMP protocol unreachable and connect()")
Reported-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Link: https://lore.kernel.org/r/102788809b554958b13b95d33440f5448113b8d6.1605331373.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/input.c         | 4 ++--
 net/sctp/sm_sideeffect.c | 4 ++--
 net/sctp/transport.c     | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/net/sctp/input.c b/net/sctp/input.c
index 71c2ef84c5b0..9fa89a35afcd 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -448,7 +448,7 @@ void sctp_icmp_proto_unreachable(struct sock *sk,
 		else {
 			if (!mod_timer(&t->proto_unreach_timer,
 						jiffies + (HZ/20)))
-				sctp_association_hold(asoc);
+				sctp_transport_hold(t);
 		}
 	} else {
 		struct net *net = sock_net(sk);
@@ -457,7 +457,7 @@ void sctp_icmp_proto_unreachable(struct sock *sk,
 			 "encountered!\n", __func__);
 
 		if (del_timer(&t->proto_unreach_timer))
-			sctp_association_put(asoc);
+			sctp_transport_put(t);
 
 		sctp_do_sm(net, SCTP_EVENT_T_OTHER,
 			   SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 8e2e10d12728..fc3d8ca21f6e 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -416,7 +416,7 @@ void sctp_generate_proto_unreach_event(unsigned long data)
 		/* Try again later.  */
 		if (!mod_timer(&transport->proto_unreach_timer,
 				jiffies + (HZ/20)))
-			sctp_association_hold(asoc);
+			sctp_transport_hold(transport);
 		goto out_unlock;
 	}
 
@@ -432,7 +432,7 @@ void sctp_generate_proto_unreach_event(unsigned long data)
 
 out_unlock:
 	bh_unlock_sock(sk);
-	sctp_association_put(asoc);
+	sctp_transport_put(transport);
 }
 
 
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index fbbe268e34e7..f8041fb03290 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -148,7 +148,7 @@ void sctp_transport_free(struct sctp_transport *transport)
 
 	/* Delete the ICMP proto unreachable timer if it's active. */
 	if (del_timer(&transport->proto_unreach_timer))
-		sctp_association_put(transport->asoc);
+		sctp_transport_put(transport);
 
 	sctp_transport_put(transport);
 }

From 786f78b5ae8b760ead31b9f836114188d6de09ca Mon Sep 17 00:00:00 2001
From: Filip Moc <dev@moc6.cz>
Date: Tue, 17 Nov 2020 18:36:31 +0100
Subject: [PATCH 1058/2658] net: usb: qmi_wwan: Set DTR quirk for MR400
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit df8d85d8c69d6837817e54dcb73c84a8b5a13877 ]

LTE module MR400 embedded in TL-MR6400 v4 requires DTR to be set.

Signed-off-by: Filip Moc <dev@moc6.cz>
Acked-by: Bjørn Mork <bjorn@mork.no>
Link: https://lore.kernel.org/r/20201117173631.GA550981@moc6.cz
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/qmi_wwan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 14eca1f80ce3..42303f3f1348 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -702,7 +702,7 @@ static const struct usb_device_id products[] = {
 	{QMI_FIXED_INTF(0x05c6, 0x9011, 4)},
 	{QMI_FIXED_INTF(0x05c6, 0x9021, 1)},
 	{QMI_FIXED_INTF(0x05c6, 0x9022, 2)},
-	{QMI_FIXED_INTF(0x05c6, 0x9025, 4)},	/* Alcatel-sbell ASB TL131 TDD LTE  (China Mobile) */
+	{QMI_QUIRK_SET_DTR(0x05c6, 0x9025, 4)},	/* Alcatel-sbell ASB TL131 TDD LTE (China Mobile) */
 	{QMI_FIXED_INTF(0x05c6, 0x9026, 3)},
 	{QMI_FIXED_INTF(0x05c6, 0x902e, 5)},
 	{QMI_FIXED_INTF(0x05c6, 0x9031, 5)},

From f1e7e892a79d6c7db0bec71927bce693a9c6f439 Mon Sep 17 00:00:00 2001
From: Florian Fainelli <f.fainelli@gmail.com>
Date: Mon, 16 Nov 2020 19:52:34 -0800
Subject: [PATCH 1059/2658] net: Have netpoll bring-up DSA management interface

[ Upstream commit 1532b9778478577152201adbafa7738b1e844868 ]

DSA network devices rely on having their DSA management interface up and
running otherwise their ndo_open() will return -ENETDOWN. Without doing
this it would not be possible to use DSA devices as netconsole when
configured on the command line. These devices also do not utilize the
upper/lower linking so the check about the netpoll device having upper
is not going to be a problem.

The solution adopted here is identical to the one done for
net/ipv4/ipconfig.c with 728c02089a0e ("net: ipv4: handle DSA enabled
master network devices"), with the network namespace scope being
restricted to that of the process configuring netpoll.

Fixes: 04ff53f96a93 ("net: dsa: Add netconsole support")
Tested-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20201117035236.22658-1-f.fainelli@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/netpoll.c | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index f2610f8f171c..2a64de757be9 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -28,6 +28,7 @@
 #include <linux/slab.h>
 #include <linux/export.h>
 #include <linux/if_vlan.h>
+#include <net/dsa.h>
 #include <net/tcp.h>
 #include <net/udp.h>
 #include <net/addrconf.h>
@@ -661,15 +662,15 @@ EXPORT_SYMBOL_GPL(__netpoll_setup);
 
 int netpoll_setup(struct netpoll *np)
 {
-	struct net_device *ndev = NULL;
+	struct net_device *ndev = NULL, *dev = NULL;
+	struct net *net = current->nsproxy->net_ns;
 	struct in_device *in_dev;
 	int err;
 
 	rtnl_lock();
-	if (np->dev_name) {
-		struct net *net = current->nsproxy->net_ns;
+	if (np->dev_name)
 		ndev = __dev_get_by_name(net, np->dev_name);
-	}
+
 	if (!ndev) {
 		np_err(np, "%s doesn't exist, aborting\n", np->dev_name);
 		err = -ENODEV;
@@ -677,6 +678,19 @@ int netpoll_setup(struct netpoll *np)
 	}
 	dev_hold(ndev);
 
+	/* bring up DSA management network devices up first */
+	for_each_netdev(net, dev) {
+		if (!netdev_uses_dsa(dev))
+			continue;
+
+		err = dev_change_flags(dev, dev->flags | IFF_UP);
+		if (err < 0) {
+			np_err(np, "%s failed to open %s\n",
+			       np->dev_name, dev->name);
+			goto put;
+		}
+	}
+
 	if (netdev_master_upper_dev_get(ndev)) {
 		np_err(np, "%s is a slave device, aborting\n", np->dev_name);
 		err = -EBUSY;

From 063bef24962b0d7d3a2bedf04c9bbd401d8ed196 Mon Sep 17 00:00:00 2001
From: Jianqun Xu <jay.xu@rock-chips.com>
Date: Tue, 13 Oct 2020 14:37:30 +0800
Subject: [PATCH 1060/2658] pinctrl: rockchip: enable gpio pclk for
 rockchip_gpio_to_irq

[ Upstream commit 63fbf8013b2f6430754526ef9594f229c7219b1f ]

There need to enable pclk_gpio when do irq_create_mapping, since it will
do access to gpio controller.

Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Kever Yang<kever.yang@rock-chips.com>
Link: https://lore.kernel.org/r/20201013063731.3618-3-jay.xu@rock-chips.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/pinctrl-rockchip.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index 616055b5e996..eba400df8215 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -1445,7 +1445,9 @@ static int rockchip_gpio_to_irq(struct gpio_chip *gc, unsigned offset)
 	if (!bank->domain)
 		return -ENXIO;
 
+	clk_enable(bank->clk);
 	virq = irq_create_mapping(bank->domain, offset);
+	clk_disable(bank->clk);
 
 	return (virq) ? : -ENXIO;
 }

From 7b9576e8ce47726343ce6bce86665dba4b477300 Mon Sep 17 00:00:00 2001
From: Will Deacon <will@kernel.org>
Date: Fri, 6 Nov 2020 09:57:55 +0000
Subject: [PATCH 1061/2658] arm64: psci: Avoid printing in cpu_psci_cpu_die()

[ Upstream commit 891deb87585017d526b67b59c15d38755b900fea ]

cpu_psci_cpu_die() is called in the context of the dying CPU, which
will no longer be online or tracked by RCU. It is therefore not generally
safe to call printk() if the PSCI "cpu off" request fails, so remove the
pr_crit() invocation.

Cc: Qian Cai <cai@redhat.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20201106103602.9849-2-will@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/psci.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c
index 684367d615bf..65cda866678e 100644
--- a/arch/arm64/kernel/psci.c
+++ b/arch/arm64/kernel/psci.c
@@ -69,7 +69,6 @@ static int cpu_psci_cpu_disable(unsigned int cpu)
 
 static void cpu_psci_cpu_die(unsigned int cpu)
 {
-	int ret;
 	/*
 	 * There are no known implementations of PSCI actually using the
 	 * power state field, pass a sensible default for now.
@@ -77,9 +76,7 @@ static void cpu_psci_cpu_die(unsigned int cpu)
 	u32 state = PSCI_POWER_STATE_TYPE_POWER_DOWN <<
 		    PSCI_0_2_POWER_STATE_TYPE_SHIFT;
 
-	ret = psci_ops.cpu_off(state);
-
-	pr_crit("unable to power off CPU%u (%d)\n", cpu, ret);
+	psci_ops.cpu_off(state);
 }
 
 static int cpu_psci_cpu_kill(unsigned int cpu)

From 611be84a2ce90a77871d29538a60f7576fd2fbf6 Mon Sep 17 00:00:00 2001
From: Paul Burton <paul.burton@imgtec.com>
Date: Fri, 19 Aug 2016 18:15:40 +0100
Subject: [PATCH 1062/2658] MIPS: Fix BUILD_ROLLBACK_PROLOGUE for microMIPS

[ Upstream commit 1eefcbc89cf3a8e252e5aeb25825594699b47360 ]

When the kernel is built for microMIPS, branches targets need to be
known to be microMIPS code in order to result in bit 0 of the PC being
set. The branch target in the BUILD_ROLLBACK_PROLOGUE macro was simply
the end of the macro, which may be pointing at padding rather than at
code. This results in recent enough GNU linkers complaining like so:

    mips-img-linux-gnu-ld: arch/mips/built-in.o: .text+0x3e3c: Unsupported branch between ISA modes.
    mips-img-linux-gnu-ld: final link failed: Bad value
    Makefile:936: recipe for target 'vmlinux' failed
    make: *** [vmlinux] Error 1

Fix this by changing the branch target to be the start of the
appropriate handler, skipping over any padding.

Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14019/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/kernel/genex.S | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index 7ffd158de76e..1b837d6f73de 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -142,9 +142,8 @@ LEAF(__r4k_wait)
 	PTR_LA	k1, __r4k_wait
 	ori	k0, 0x1f	/* 32 byte rollback region */
 	xori	k0, 0x1f
-	bne	k0, k1, 9f
+	bne	k0, k1, \handler
 	MTC0	k0, CP0_EPC
-9:
 	.set pop
 	.endm
 

From 1ab7035f5efde4add1d4b4f731173ff9d40cc6a0 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Mon, 26 Oct 2020 17:10:09 -0700
Subject: [PATCH 1063/2658] Input: adxl34x - clean up a data type in
 adxl34x_probe()

[ Upstream commit 33b6c39e747c552fa770eecebd1776f1f4a222b1 ]

The "revid" is used to store negative error codes so it should be an int
type.

Fixes: e27c729219ad ("Input: add driver for ADXL345/346 Digital Accelerometers")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Michael Hennerich <michael.hennerich@analog.com>
Link: https://lore.kernel.org/r/20201026072824.GA1620546@mwanda
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/misc/adxl34x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c
index 2b2d02f408bb..2e189646d8fe 100644
--- a/drivers/input/misc/adxl34x.c
+++ b/drivers/input/misc/adxl34x.c
@@ -696,7 +696,7 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq,
 	struct input_dev *input_dev;
 	const struct adxl34x_platform_data *pdata;
 	int err, range, i;
-	unsigned char revid;
+	int revid;
 
 	if (!irq) {
 		dev_err(dev, "no IRQ?\n");

From 6bf0c9d925417bdefe21c63fc92733692cd43c52 Mon Sep 17 00:00:00 2001
From: Sergey Matyukevich <geomatsi@gmail.com>
Date: Sat, 24 Oct 2020 23:11:20 +0300
Subject: [PATCH 1064/2658] arm: dts: imx6qdl-udoo: fix rgmii phy-mode for
 ksz9031 phy

[ Upstream commit 7dd8f0ba88fce98e2953267a66af74c6f4792a56 ]

Commit bcf3440c6dd7 ("net: phy: micrel: add phy-mode support for the
KSZ9031 PHY") fixed micrel phy driver adding proper support for phy
modes. Adapt imx6q-udoo board phy settings : explicitly set required
delay configuration using "rgmii-id".

Fixes: cbd54fe0b2bc ("ARM: dts: imx6dl-udoo: Add board support based off imx6q-udoo")
Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/imx6qdl-udoo.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
index 1211da894ee9..061e6a00b255 100644
--- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
@@ -39,7 +39,7 @@
 &fec {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_enet>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	status = "okay";
 };
 

From 0a6852a5aca2c121e83d108e2ee41a57a625dad2 Mon Sep 17 00:00:00 2001
From: Fabio Estevam <festevam@gmail.com>
Date: Thu, 5 Nov 2020 18:13:20 -0300
Subject: [PATCH 1065/2658] ARM: dts: imx50-evk: Fix the chip select 1 IOMUX

[ Upstream commit 33d0d843872c5ddbe28457a92fc6f2487315fb9f ]

The SPI chip selects are represented as:

cs-gpios = <&gpio4 11 GPIO_ACTIVE_LOW>, <&gpio4 13 GPIO_ACTIVE_LOW>;

, which means that they are used in GPIO function instead of native
SPI mode.

Fix the IOMUX for the chip select 1 to use GPIO4_13 instead of
the native CSPI_SSI function.

Fixes: c605cbf5e135 ("ARM: dts: imx: add device tree support for Freescale imx50evk board")
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/imx50-evk.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/imx50-evk.dts b/arch/arm/boot/dts/imx50-evk.dts
index 27d763c7a307..4dbd180e72ba 100644
--- a/arch/arm/boot/dts/imx50-evk.dts
+++ b/arch/arm/boot/dts/imx50-evk.dts
@@ -66,7 +66,7 @@
 				MX50_PAD_CSPI_MISO__CSPI_MISO		0x00
 				MX50_PAD_CSPI_MOSI__CSPI_MOSI		0x00
 				MX50_PAD_CSPI_SS0__GPIO4_11		0xc4
-				MX50_PAD_ECSPI1_MOSI__CSPI_SS1		0xf4
+				MX50_PAD_ECSPI1_MOSI__GPIO4_13		0x84
 			>;
 		};
 

From f9348e090ad7e26aac693c0f821e8613ac67d463 Mon Sep 17 00:00:00 2001
From: Leo Yan <leo.yan@linaro.org>
Date: Wed, 4 Nov 2020 17:42:29 +0800
Subject: [PATCH 1066/2658] perf lock: Don't free "lock_seq_stat" if read_count
 isn't zero

[ Upstream commit b0e5a05cc9e37763c7f19366d94b1a6160c755bc ]

When execute command "perf lock report", it hits failure and outputs log
as follows:

  perf: builtin-lock.c:623: report_lock_release_event: Assertion `!(seq->read_count < 0)' failed.
  Aborted

This is an imbalance issue.  The locking sequence structure
"lock_seq_stat" contains the reader counter and it is used to check if
the locking sequence is balance or not between acquiring and releasing.

If the tool wrongly frees "lock_seq_stat" when "read_count" isn't zero,
the "read_count" will be reset to zero when allocate a new structure at
the next time; thus it causes the wrong counting for reader and finally
results in imbalance issue.

To fix this issue, if detects "read_count" is not zero (means still have
read user in the locking sequence), goto the "end" tag to skip freeing
structure "lock_seq_stat".

Fixes: e4cef1f65061 ("perf lock: Fix state machine to recognize lock sequence")
Signed-off-by: Leo Yan <leo.yan@linaro.org>
Acked-by: Jiri Olsa <jolsa@redhat.com>
Link: https://lore.kernel.org/r/20201104094229.17509-2-leo.yan@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/builtin-lock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c
index de16aaed516e..daf2dc023245 100644
--- a/tools/perf/builtin-lock.c
+++ b/tools/perf/builtin-lock.c
@@ -616,7 +616,7 @@ static int report_lock_release_event(struct perf_evsel *evsel,
 	case SEQ_STATE_READ_ACQUIRED:
 		seq->read_count--;
 		BUG_ON(seq->read_count < 0);
-		if (!seq->read_count) {
+		if (seq->read_count) {
 			ls->nr_release++;
 			goto end;
 		}

From 09eec0bf925e58ef441d9b3085adf99786c92556 Mon Sep 17 00:00:00 2001
From: Alejandro Concepcion Rodriguez <alejandro@acoro.eu>
Date: Thu, 5 Nov 2020 21:51:47 +0000
Subject: [PATCH 1067/2658] can: dev: can_restart(): post buffer from the right
 context

[ Upstream commit a1e654070a60d5d4f7cce59c38f4ca790bb79121 ]

netif_rx() is meant to be called from interrupt contexts. can_restart() may be
called by can_restart_work(), which is called from a worqueue, so it may run in
process context. Use netif_rx_ni() instead.

Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface")
Co-developed-by: Loris Fauster <loris.fauster@ttcontrol.com>
Signed-off-by: Loris Fauster <loris.fauster@ttcontrol.com>
Signed-off-by: Alejandro Concepcion Rodriguez <alejandro@acoro.eu>
Link: https://lore.kernel.org/r/4e84162b-fb31-3a73-fa9a-9438b4bd5234@acoro.eu
[mkl: use netif_rx_ni() instead of netif_rx_any_context()]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 9579dae54af2..52110017fd40 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -525,7 +525,7 @@ static void can_restart(struct net_device *dev)
 	}
 	cf->can_id |= CAN_ERR_RESTARTED;
 
-	netif_rx(skb);
+	netif_rx_ni(skb);
 
 	stats->rx_packets++;
 	stats->rx_bytes += cf->can_dlc;

From 2f652ac64edc8ac90b544d7139f2c53576c500d5 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Thu, 5 Nov 2020 11:24:27 +0000
Subject: [PATCH 1068/2658] can: peak_usb: fix potential integer overflow on
 shift of a int

[ Upstream commit 8a68cc0d690c9e5730d676b764c6f059343b842c ]

The left shift of int 32 bit integer constant 1 is evaluated using 32 bit
arithmetic and then assigned to a signed 64 bit variable. In the case where
time_ref->adapter->ts_used_bits is 32 or more this can lead to an oveflow.
Avoid this by shifting using the BIT_ULL macro instead.

Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20201105112427.40688-1-colin.king@canonical.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/usb/peak_usb/pcan_usb_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index 22deddb2dbf5..7b148174eb76 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -176,7 +176,7 @@ void peak_usb_get_ts_tv(struct peak_time_ref *time_ref, u32 ts,
 		if (time_ref->ts_dev_1 < time_ref->ts_dev_2) {
 			/* case when event time (tsw) wraps */
 			if (ts < time_ref->ts_dev_1)
-				delta_ts = 1 << time_ref->adapter->ts_used_bits;
+				delta_ts = BIT_ULL(time_ref->adapter->ts_used_bits);
 
 		/* Otherwise, sync time counter (ts_dev_2) has wrapped:
 		 * handle case when event time (tsn) hasn't.
@@ -188,7 +188,7 @@ void peak_usb_get_ts_tv(struct peak_time_ref *time_ref, u32 ts,
 		 *              tsn            ts
 		 */
 		} else if (time_ref->ts_dev_1 < ts) {
-			delta_ts = -(1 << time_ref->adapter->ts_used_bits);
+			delta_ts = -BIT_ULL(time_ref->adapter->ts_used_bits);
 		}
 
 		/* add delay between last sync and event timestamps */

From d2c55e9ef5b42dbc9bae83fa9008ca5ed89593c0 Mon Sep 17 00:00:00 2001
From: Wu Bo <wubo.oduw@gmail.com>
Date: Wed, 29 Jan 2020 10:23:30 +0800
Subject: [PATCH 1069/2658] can: m_can: m_can_handle_state_change(): fix state
 change

[ Upstream commit cd0d83eab2e0c26fe87a10debfedbb23901853c1 ]

m_can_handle_state_change() is called with the new_state as an argument.

In the switch statements for CAN_STATE_ERROR_ACTIVE, the comment and the
following code indicate that a CAN_STATE_ERROR_WARNING is handled.

This patch fixes this problem by changing the case to CAN_STATE_ERROR_WARNING.

Signed-off-by: Wu Bo <wubo.oduw@gmail.com>
Link: http://lore.kernel.org/r/20200129022330.21248-2-wubo.oduw@gmail.com
Cc: Dan Murphy <dmurphy@ti.com>
Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/m_can/m_can.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index 195f15edb32e..0bd7e7164796 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -572,7 +572,7 @@ static int m_can_handle_state_change(struct net_device *dev,
 	unsigned int ecr;
 
 	switch (new_state) {
-	case CAN_STATE_ERROR_ACTIVE:
+	case CAN_STATE_ERROR_WARNING:
 		/* error warning state */
 		priv->can.can_stats.error_warning++;
 		priv->can.state = CAN_STATE_ERROR_WARNING;
@@ -601,7 +601,7 @@ static int m_can_handle_state_change(struct net_device *dev,
 	__m_can_get_berr_counter(dev, &bec);
 
 	switch (new_state) {
-	case CAN_STATE_ERROR_ACTIVE:
+	case CAN_STATE_ERROR_WARNING:
 		/* error warning state */
 		cf->can_id |= CAN_ERR_CRTL;
 		cf->data[1] = (bec.txerr > bec.rxerr) ?

From 14da405704547fe18183cc90f078b8114c69bb33 Mon Sep 17 00:00:00 2001
From: Zhang Qilong <zhangqilong3@huawei.com>
Date: Fri, 13 Nov 2020 21:18:56 +0800
Subject: [PATCH 1070/2658] MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu

[ Upstream commit ac3b57adf87ad9bac7e33ca26bbbb13fae1ed62b ]

If the clk_register fails, we should free h before
function returns to prevent memleak.

Fixes: 474402291a0ad ("MIPS: Alchemy: clock framework integration of onchip clocks")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/alchemy/common/clock.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/arch/mips/alchemy/common/clock.c b/arch/mips/alchemy/common/clock.c
index bd34f4093cd9..7b0dec333c96 100644
--- a/arch/mips/alchemy/common/clock.c
+++ b/arch/mips/alchemy/common/clock.c
@@ -151,6 +151,7 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name,
 {
 	struct clk_init_data id;
 	struct clk_hw *h;
+	struct clk *clk;
 
 	h = kzalloc(sizeof(*h), GFP_KERNEL);
 	if (!h)
@@ -163,7 +164,13 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name,
 	id.ops = &alchemy_clkops_cpu;
 	h->init = &id;
 
-	return clk_register(NULL, h);
+	clk = clk_register(NULL, h);
+	if (IS_ERR(clk)) {
+		pr_err("failed to register clock\n");
+		kfree(h);
+	}
+
+	return clk;
 }
 
 /* AUXPLLs ************************************************************/

From 5473361eeefc47d0a1e779d4cac54de94d13bd06 Mon Sep 17 00:00:00 2001
From: Nishanth Menon <nm@ti.com>
Date: Wed, 18 Nov 2020 08:50:09 -0600
Subject: [PATCH 1071/2658] regulator: ti-abb: Fix array out of bound read
 access on the first transition

[ Upstream commit 2ba546ebe0ce2af47833d8912ced9b4a579f13cb ]

At the start of driver initialization, we do not know what bias
setting the bootloader has configured the system for and we only know
for certain the very first time we do a transition.

However, since the initial value of the comparison index is -EINVAL,
this negative value results in an array out of bound access on the
very first transition.

Since we don't know what the setting is, we just set the bias
configuration as there is nothing to compare against. This prevents
the array out of bound access.

NOTE: Even though we could use a more relaxed check of "< 0" the only
valid values(ignoring cosmic ray induced bitflips) are -EINVAL, 0+.

Fixes: 40b1936efebd ("regulator: Introduce TI Adaptive Body Bias(ABB) on-chip LDO driver")
Link: https://lore.kernel.org/linux-mm/CA+G9fYuk4imvhyCN7D7T6PMDH6oNp6HDCRiTUKMQ6QXXjBa4ag@mail.gmail.com/
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Nishanth Menon <nm@ti.com>
Link: https://lore.kernel.org/r/20201118145009.10492-1-nm@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/ti-abb-regulator.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c
index 6d17357b3a24..5f5f63eb8c76 100644
--- a/drivers/regulator/ti-abb-regulator.c
+++ b/drivers/regulator/ti-abb-regulator.c
@@ -342,8 +342,17 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel)
 		return ret;
 	}
 
-	/* If data is exactly the same, then just update index, no change */
 	info = &abb->info[sel];
+	/*
+	 * When Linux kernel is starting up, we are'nt sure of the
+	 * Bias configuration that bootloader has configured.
+	 * So, we get to know the actual setting the first time
+	 * we are asked to transition.
+	 */
+	if (abb->current_info_idx == -EINVAL)
+		goto just_set_abb;
+
+	/* If data is exactly the same, then just update index, no change */
 	oinfo = &abb->info[abb->current_info_idx];
 	if (!memcmp(info, oinfo, sizeof(*info))) {
 		dev_dbg(dev, "%s: Same data new idx=%d, old idx=%d\n", __func__,
@@ -351,6 +360,7 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel)
 		goto out;
 	}
 
+just_set_abb:
 	ret = ti_abb_set_opp(rdev, abb, info);
 
 out:

From c228216f136173eaca6d95637b805ed1d574db7e Mon Sep 17 00:00:00 2001
From: Yicong Yang <yangyicong@hisilicon.com>
Date: Sat, 21 Nov 2020 22:17:19 -0800
Subject: [PATCH 1072/2658] libfs: fix error cast of negative value in
 simple_attr_write()

[ Upstream commit 488dac0c9237647e9b8f788b6a342595bfa40bda ]

The attr->set() receive a value of u64, but simple_strtoll() is used for
doing the conversion.  It will lead to the error cast if user inputs a
negative value.

Use kstrtoull() instead of simple_strtoll() to convert a string got from
the user to an unsigned value.  The former will return '-EINVAL' if it
gets a negetive value, but the latter can't handle the situation
correctly.  Make 'val' unsigned long long as what kstrtoull() takes,
this will eliminate the compile warning on no 64-bit architectures.

Fixes: f7b88631a897 ("fs/libfs.c: fix simple_attr_write() on 32bit machines")
Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Link: https://lkml.kernel.org/r/1605341356-11872-1-git-send-email-yangyicong@hisilicon.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/libfs.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/libfs.c b/fs/libfs.c
index a33e95f8729b..01e9cae5b160 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -827,7 +827,7 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
 			  size_t len, loff_t *ppos)
 {
 	struct simple_attr *attr;
-	u64 val;
+	unsigned long long val;
 	size_t size;
 	ssize_t ret;
 
@@ -845,7 +845,9 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
 		goto out;
 
 	attr->set_buf[size] = '\0';
-	val = simple_strtoll(attr->set_buf, NULL, 0);
+	ret = kstrtoull(attr->set_buf, 0, &val);
+	if (ret)
+		goto out;
 	ret = attr->set(attr->data, val);
 	if (ret == 0)
 		ret = len; /* on success, claim we got the whole input */

From 20b59cdb2c4810770a3c5dec755adff0e32b60eb Mon Sep 17 00:00:00 2001
From: Daniel Axtens <dja@axtens.net>
Date: Mon, 23 Nov 2020 13:58:22 +1100
Subject: [PATCH 1073/2658] powerpc/uaccess-flush: fix corenet64_smp_defconfig
 build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Gunter reports problems with the corenet64_smp_defconfig:

In file included from arch/powerpc/kernel/ppc_ksyms.c:10:0:
arch/powerpc/include/asm/book3s/64/kup-radix.h:11:29: error: redefinition of ‘allow_user_access’
 static __always_inline void allow_user_access(void __user *to, const void __user *from,
			     ^~~~~~~~~~~~~~~~~
In file included from arch/powerpc/include/asm/uaccess.h:12:0,
		 from arch/powerpc/kernel/ppc_ksyms.c:8:
arch/powerpc/include/asm/kup.h:12:20: note: previous definition of ‘allow_user_access’ was here
 static inline void allow_user_access(void __user *to, const void __user *from,
		    ^~~~~~~~~~~~~~~~~

This is because ppc_ksyms.c imports asm/book3s/64/kup-radix.h guarded by
CONFIG_PPC64, rather than CONFIG_PPC_BOOK3S_64 which it should do.

Fix it.

Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kernel/ppc_ksyms.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/kernel/ppc_ksyms.c b/arch/powerpc/kernel/ppc_ksyms.c
index 80eb47113d5d..0f05c85cbde3 100644
--- a/arch/powerpc/kernel/ppc_ksyms.c
+++ b/arch/powerpc/kernel/ppc_ksyms.c
@@ -6,7 +6,7 @@
 #include <asm/cacheflush.h>
 #include <asm/epapr_hcalls.h>
 #include <asm/uaccess.h>
-#ifdef CONFIG_PPC64
+#ifdef CONFIG_PPC_BOOK3S_64
 #include <asm/book3s/64/kup-radix.h>
 #endif
 
@@ -50,6 +50,6 @@ EXPORT_SYMBOL(current_stack_pointer);
 
 EXPORT_SYMBOL(__arch_clear_user);
 
-#ifdef CONFIG_PPC64
+#ifdef CONFIG_PPC_BOOK3S_64
 EXPORT_SYMBOL(do_uaccess_flush);
 #endif

From 3968e3d3d5f7bfdc7cebac759bb60343cabc8f49 Mon Sep 17 00:00:00 2001
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Date: Fri, 13 Nov 2020 18:20:43 +0900
Subject: [PATCH 1074/2658] ALSA: ctl: fix error path at adding user-defined
 element set

commit 95a793c3bc75cf888e0e641d656e7d080f487d8b upstream.

When processing request to add/replace user-defined element set, check
of given element identifier and decision of numeric identifier is done
in "__snd_ctl_add_replace()" helper function. When the result of check
is wrong, the helper function returns error code. The error code shall
be returned to userspace application.

Current implementation includes bug to return zero to userspace application
regardless of the result. This commit fixes the bug.

Cc: <stable@vger.kernel.org>
Fixes: e1a7bfe38079 ("ALSA: control: Fix race between adding and removing a user element")
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20201113092043.16148-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/control.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/core/control.c b/sound/core/control.c
index 2be860a446a2..43c8eac250b8 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1349,7 +1349,7 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
 
  unlock:
 	up_write(&card->controls_rwsem);
-	return 0;
+	return err;
 }
 
 static int snd_ctl_elem_add_user(struct snd_ctl_file *file,

From 9189dd908499985a558539945483d8aa48bf49f0 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Thu, 19 Nov 2020 13:14:40 +0100
Subject: [PATCH 1075/2658] ALSA: mixart: Fix mutex deadlock

commit d21b96c8ed2aea7e6b7bf4735e1d2503cfbf4072 upstream.

The code change for switching to non-atomic mode brought the
unexpected mutex deadlock in get_msg().  It converted the spinlock
with the existing mutex, but there were calls with the already holding
the mutex.  Since the only place that needs the extra lock is the code
path from snd_mixart_send_msg(), remove the mutex lock in get_msg()
and apply in the caller side for fixing the mutex deadlock.

Fixes: 8d3a8b5cb57d ("ALSA: mixart: Use nonatomic PCM ops")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201119121440.18945-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/mixart/mixart_core.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/sound/pci/mixart/mixart_core.c b/sound/pci/mixart/mixart_core.c
index dccf3db48fe0..1381f4fa0856 100644
--- a/sound/pci/mixart/mixart_core.c
+++ b/sound/pci/mixart/mixart_core.c
@@ -83,7 +83,6 @@ static int get_msg(struct mixart_mgr *mgr, struct mixart_msg *resp,
 	unsigned int i;
 #endif
 
-	mutex_lock(&mgr->msg_lock);
 	err = 0;
 
 	/* copy message descriptor from miXart to driver */
@@ -132,8 +131,6 @@ static int get_msg(struct mixart_mgr *mgr, struct mixart_msg *resp,
 	writel_be(headptr, MIXART_MEM(mgr, MSG_OUTBOUND_FREE_HEAD));
 
  _clean_exit:
-	mutex_unlock(&mgr->msg_lock);
-
 	return err;
 }
 
@@ -271,7 +268,9 @@ int snd_mixart_send_msg(struct mixart_mgr *mgr, struct mixart_msg *request, int
 	resp.data = resp_data;
 	resp.size = max_resp_size;
 
+	mutex_lock(&mgr->msg_lock);
 	err = get_msg(mgr, &resp, msg_frame);
+	mutex_unlock(&mgr->msg_lock);
 
 	if( request->message_id != resp.message_id )
 		dev_err(&mgr->pci->dev, "RESPONSE ERROR!\n");

From d74484323c3181e80d3269514f9fd74f9d1121c7 Mon Sep 17 00:00:00 2001
From: Fugang Duan <fugang.duan@nxp.com>
Date: Wed, 11 Nov 2020 10:51:36 +0800
Subject: [PATCH 1076/2658] tty: serial: imx: keep console clocks always on
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit e67c139c488e84e7eae6c333231e791f0e89b3fb upstream.

For below code, there has chance to cause deadlock in SMP system:
Thread 1:
clk_enable_lock();
pr_info("debug message");
clk_enable_unlock();

Thread 2:
imx_uart_console_write()
	clk_enable()
		clk_enable_lock();

Thread 1:
Acuired clk enable_lock -> printk -> console_trylock_spinning
Thread 2:
console_unlock() -> imx_uart_console_write -> clk_disable -> Acquite clk enable_lock

So the patch is to keep console port clocks always on like
other console drivers.

Fixes: 1cf93e0d5488 ("serial: imx: remove the uart_console() check")
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
Link: https://lore.kernel.org/r/20201111025136.29818-1-fugang.duan@nxp.com
Cc: stable <stable@vger.kernel.org>
[fix up build warning - gregkh]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/imx.c | 20 +++-----------------
 1 file changed, 3 insertions(+), 17 deletions(-)

diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index ca69e2ca6b56..6a9fa718bfd8 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -1628,16 +1628,6 @@ imx_console_write(struct console *co, const char *s, unsigned int count)
 	unsigned int ucr1;
 	unsigned long flags = 0;
 	int locked = 1;
-	int retval;
-
-	retval = clk_enable(sport->clk_per);
-	if (retval)
-		return;
-	retval = clk_enable(sport->clk_ipg);
-	if (retval) {
-		clk_disable(sport->clk_per);
-		return;
-	}
 
 	if (sport->port.sysrq)
 		locked = 0;
@@ -1673,9 +1663,6 @@ imx_console_write(struct console *co, const char *s, unsigned int count)
 
 	if (locked)
 		spin_unlock_irqrestore(&sport->port.lock, flags);
-
-	clk_disable(sport->clk_ipg);
-	clk_disable(sport->clk_per);
 }
 
 /*
@@ -1776,15 +1763,14 @@ imx_console_setup(struct console *co, char *options)
 
 	retval = uart_set_options(&sport->port, co, baud, parity, bits, flow);
 
-	clk_disable(sport->clk_ipg);
 	if (retval) {
-		clk_unprepare(sport->clk_ipg);
+		clk_disable_unprepare(sport->clk_ipg);
 		goto error_console;
 	}
 
-	retval = clk_prepare(sport->clk_per);
+	retval = clk_prepare_enable(sport->clk_per);
 	if (retval)
-		clk_unprepare(sport->clk_ipg);
+		clk_disable_unprepare(sport->clk_ipg);
 
 error_console:
 	return retval;

From 6e2b0fc82f941e80e30ac28a21cf8c73540ce960 Mon Sep 17 00:00:00 2001
From: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>
Date: Fri, 23 Oct 2020 17:24:39 +0530
Subject: [PATCH 1077/2658] efivarfs: fix memory leak in efivarfs_create()

commit fe5186cf12e30facfe261e9be6c7904a170bd822 upstream.

kmemleak report:
  unreferenced object 0xffff9b8915fcb000 (size 4096):
  comm "efivarfs.sh", pid 2360, jiffies 4294920096 (age 48.264s)
  hex dump (first 32 bytes):
    2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  -...............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000cc4d897c>] kmem_cache_alloc_trace+0x155/0x4b0
    [<000000007d1dfa72>] efivarfs_create+0x6e/0x1a0
    [<00000000e6ee18fc>] path_openat+0xe4b/0x1120
    [<000000000ad0414f>] do_filp_open+0x91/0x100
    [<00000000ce93a198>] do_sys_openat2+0x20c/0x2d0
    [<000000002a91be6d>] do_sys_open+0x46/0x80
    [<000000000a854999>] __x64_sys_openat+0x20/0x30
    [<00000000c50d89c9>] do_syscall_64+0x38/0x90
    [<00000000cecd6b5f>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

In efivarfs_create(), inode->i_private is setup with efivar_entry
object which is never freed.

Cc: <stable@vger.kernel.org>
Signed-off-by: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>
Link: https://lore.kernel.org/r/20201023115429.GA2479@cosmos
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/efivarfs/super.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
index fca235020312..0e4f20377d19 100644
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -23,6 +23,7 @@ LIST_HEAD(efivarfs_list);
 static void efivarfs_evict_inode(struct inode *inode)
 {
 	clear_inode(inode);
+	kfree(inode->i_private);
 }
 
 static const struct super_operations efivarfs_ops = {

From 7d33ce9de4f50d6902fae54690c902978a22bd82 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Wed, 18 Nov 2020 16:30:32 +0100
Subject: [PATCH 1078/2658] ext4: fix bogus warning in ext4_update_dx_flag()

commit f902b216501094495ff75834035656e8119c537f upstream.

The idea of the warning in ext4_update_dx_flag() is that we should warn
when we are clearing EXT4_INODE_INDEX on a filesystem with metadata
checksums enabled since after clearing the flag, checksums for internal
htree nodes will become invalid. So there's no need to warn (or actually
do anything) when EXT4_INODE_INDEX is not set.

Link: https://lore.kernel.org/r/20201118153032.17281-1-jack@suse.cz
Fixes: 48a34311953d ("ext4: fix checksum errors with indexed dirs")
Reported-by: Eric Biggers <ebiggers@kernel.org>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/ext4.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 2e581e478047..dfd9d446ea8b 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -2412,7 +2412,8 @@ int ext4_insert_dentry(struct inode *dir,
 		       struct ext4_filename *fname);
 static inline void ext4_update_dx_flag(struct inode *inode)
 {
-	if (!ext4_has_feature_dir_index(inode->i_sb)) {
+	if (!ext4_has_feature_dir_index(inode->i_sb) &&
+	    ext4_test_inode_flag(inode, EXT4_INODE_INDEX)) {
 		/* ext4_iget() should have caught this... */
 		WARN_ON_ONCE(ext4_has_feature_metadata_csum(inode->i_sb));
 		ext4_clear_inode_flag(inode, EXT4_INODE_INDEX);

From 543faed4448d3496c6a041700638fe42d291ee67 Mon Sep 17 00:00:00 2001
From: Max Filippov <jcmvbkbc@gmail.com>
Date: Mon, 16 Nov 2020 01:38:59 -0800
Subject: [PATCH 1079/2658] xtensa: disable preemption around cache alias
 management calls

commit 3a860d165eb5f4d7cf0bf81ef6a5b5c5e1754422 upstream.

Although cache alias management calls set up and tear down TLB entries
and fast_second_level_miss is able to restore TLB entry should it be
evicted they absolutely cannot preempt each other because they use the
same TLBTEMP area for different purposes.
Disable preemption around all cache alias management calls to enforce
that.

Cc: stable@vger.kernel.org
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/xtensa/mm/cache.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/arch/xtensa/mm/cache.c b/arch/xtensa/mm/cache.c
index 1a804a2f9a5b..2fe5cabfc41e 100644
--- a/arch/xtensa/mm/cache.c
+++ b/arch/xtensa/mm/cache.c
@@ -74,8 +74,10 @@ static inline void kmap_invalidate_coherent(struct page *page,
 			kvaddr = TLBTEMP_BASE_1 +
 				(page_to_phys(page) & DCACHE_ALIAS_MASK);
 
+			preempt_disable();
 			__invalidate_dcache_page_alias(kvaddr,
 						       page_to_phys(page));
+			preempt_enable();
 		}
 	}
 }
@@ -162,6 +164,7 @@ void flush_dcache_page(struct page *page)
 		if (!alias && !mapping)
 			return;
 
+		preempt_disable();
 		virt = TLBTEMP_BASE_1 + (phys & DCACHE_ALIAS_MASK);
 		__flush_invalidate_dcache_page_alias(virt, phys);
 
@@ -172,6 +175,7 @@ void flush_dcache_page(struct page *page)
 
 		if (mapping)
 			__invalidate_icache_page_alias(virt, phys);
+		preempt_enable();
 	}
 
 	/* There shouldn't be an entry in the cache for this page anymore. */
@@ -204,8 +208,10 @@ void local_flush_cache_page(struct vm_area_struct *vma, unsigned long address,
 	unsigned long phys = page_to_phys(pfn_to_page(pfn));
 	unsigned long virt = TLBTEMP_BASE_1 + (address & DCACHE_ALIAS_MASK);
 
+	preempt_disable();
 	__flush_invalidate_dcache_page_alias(virt, phys);
 	__invalidate_icache_page_alias(virt, phys);
+	preempt_enable();
 }
 
 #endif
@@ -231,11 +237,13 @@ update_mmu_cache(struct vm_area_struct * vma, unsigned long addr, pte_t *ptep)
 		unsigned long phys = page_to_phys(page);
 		unsigned long tmp;
 
+		preempt_disable();
 		tmp = TLBTEMP_BASE_1 + (phys & DCACHE_ALIAS_MASK);
 		__flush_invalidate_dcache_page_alias(tmp, phys);
 		tmp = TLBTEMP_BASE_1 + (addr & DCACHE_ALIAS_MASK);
 		__flush_invalidate_dcache_page_alias(tmp, phys);
 		__invalidate_icache_page_alias(tmp, phys);
+		preempt_enable();
 
 		clear_bit(PG_arch_1, &page->flags);
 	}
@@ -269,7 +277,9 @@ void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
 
 	if (alias) {
 		unsigned long t = TLBTEMP_BASE_1 + (vaddr & DCACHE_ALIAS_MASK);
+		preempt_disable();
 		__flush_invalidate_dcache_page_alias(t, phys);
+		preempt_enable();
 	}
 
 	/* Copy data */
@@ -284,9 +294,11 @@ void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
 	if (alias) {
 		unsigned long t = TLBTEMP_BASE_1 + (vaddr & DCACHE_ALIAS_MASK);
 
+		preempt_disable();
 		__flush_invalidate_dcache_range((unsigned long) dst, len);
 		if ((vma->vm_flags & VM_EXEC) != 0)
 			__invalidate_icache_page_alias(t, phys);
+		preempt_enable();
 
 	} else if ((vma->vm_flags & VM_EXEC) != 0) {
 		__flush_dcache_range((unsigned long)dst,len);
@@ -308,7 +320,9 @@ extern void copy_from_user_page(struct vm_area_struct *vma, struct page *page,
 
 	if (alias) {
 		unsigned long t = TLBTEMP_BASE_1 + (vaddr & DCACHE_ALIAS_MASK);
+		preempt_disable();
 		__flush_invalidate_dcache_page_alias(t, phys);
+		preempt_enable();
 	}
 
 	memcpy(dst, src, len);

From 67f862d857143b78e72d27201faa0681089cc692 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Wed, 11 Nov 2020 19:33:58 +0100
Subject: [PATCH 1080/2658] mac80211: minstrel: remove deferred sampling code

commit 4fe40b8e1566dad04c87fbf299049a1d0d4bd58d upstream.

Deferring sampling attempts to the second stage has some bad interactions
with drivers that process the rate table in hardware and use the probe flag
to indicate probing packets (e.g. most mt76 drivers). On affected drivers
it can lead to probing not working at all.

If the link conditions turn worse, it might not be such a good idea to
do a lot of sampling for lower rates in this case.

Fix this by simply skipping the sample attempt instead of deferring it,
but keep the checks that would allow it to be sampled if it was skipped
too often, but only if it has less than 95% success probability.

Also ensure that IEEE80211_TX_CTL_RATE_CTRL_PROBE is set for all probing
packets.

Cc: stable@vger.kernel.org
Fixes: cccf129f820e ("mac80211: add the 'minstrel' rate control algorithm")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20201111183359.43528-2-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/rc80211_minstrel.c | 25 ++++---------------------
 net/mac80211/rc80211_minstrel.h |  1 -
 2 files changed, 4 insertions(+), 22 deletions(-)

diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index b54f398cda5d..e22410ad3404 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -287,12 +287,6 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
 			mi->r[ndx].stats.success += success;
 	}
 
-	if ((info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) && (i >= 0))
-		mi->sample_packets++;
-
-	if (mi->sample_deferred > 0)
-		mi->sample_deferred--;
-
 	if (time_after(jiffies, mi->last_stats_update +
 				(mp->update_interval * HZ) / 1000))
 		minstrel_update_stats(mp, mi);
@@ -366,7 +360,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
 #endif
 
 	delta = (mi->total_packets * sampling_ratio / 100) -
-			(mi->sample_packets + mi->sample_deferred / 2);
+			mi->sample_packets;
 
 	/* delta < 0: no sampling required */
 	prev_sample = mi->prev_sample;
@@ -375,7 +369,6 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
 		return;
 
 	if (mi->total_packets >= 10000) {
-		mi->sample_deferred = 0;
 		mi->sample_packets = 0;
 		mi->total_packets = 0;
 	} else if (delta > mi->n_rates * 2) {
@@ -400,19 +393,8 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
 	 * rate sampling method should be used.
 	 * Respect such rates that are not sampled for 20 interations.
 	 */
-	if (mrr_capable &&
-	    msr->perfect_tx_time > mr->perfect_tx_time &&
-	    msr->stats.sample_skipped < 20) {
-		/* Only use IEEE80211_TX_CTL_RATE_CTRL_PROBE to mark
-		 * packets that have the sampling rate deferred to the
-		 * second MRR stage. Increase the sample counter only
-		 * if the deferred sample rate was actually used.
-		 * Use the sample_deferred counter to make sure that
-		 * the sampling is not done in large bursts */
-		info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
-		rate++;
-		mi->sample_deferred++;
-	} else {
+	if (msr->perfect_tx_time < mr->perfect_tx_time ||
+	    msr->stats.sample_skipped >= 20) {
 		if (!msr->sample_limit)
 			return;
 
@@ -432,6 +414,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
 
 	rate->idx = mi->r[ndx].rix;
 	rate->count = minstrel_get_retry_count(&mi->r[ndx], info);
+	info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
 }
 
 
diff --git a/net/mac80211/rc80211_minstrel.h b/net/mac80211/rc80211_minstrel.h
index c230bbe93262..5a9e44f4fba4 100644
--- a/net/mac80211/rc80211_minstrel.h
+++ b/net/mac80211/rc80211_minstrel.h
@@ -105,7 +105,6 @@ struct minstrel_sta_info {
 	u8 max_prob_rate;
 	unsigned int total_packets;
 	unsigned int sample_packets;
-	int sample_deferred;
 
 	unsigned int sample_row;
 	unsigned int sample_column;

From ebd082d4f58e194cc0f1d3cada0d51ac6cdcceff Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Wed, 11 Nov 2020 19:33:59 +0100
Subject: [PATCH 1081/2658] mac80211: minstrel: fix tx status processing corner
 case

commit b2911a84396f72149dce310a3b64d8948212c1b3 upstream.

Some drivers fill the status rate list without setting the rate index after
the final rate to -1. minstrel_ht already deals with this, but minstrel
doesn't, which causes it to get stuck at the lowest rate on these drivers.

Fix this by checking the count as well.

Cc: stable@vger.kernel.org
Fixes: cccf129f820e ("mac80211: add the 'minstrel' rate control algorithm")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20201111183359.43528-3-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/rc80211_minstrel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index e22410ad3404..dfcb65d36832 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -274,7 +274,7 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
 	success = !!(info->flags & IEEE80211_TX_STAT_ACK);
 
 	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
-		if (ar[i].idx < 0)
+		if (ar[i].idx < 0 || !ar[i].count)
 			break;
 
 		ndx = rix_to_ndx(mi, ar[i].idx);

From 91bf48180c8cd7af872b2997746cfdb22bac1aa4 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Thu, 22 Oct 2015 17:35:19 +0200
Subject: [PATCH 1082/2658] mac80211: allow driver to prevent two stations w/
 same address

commit 3110489117581a980537b6d999a3724214ba772c upstream.

Some devices or drivers cannot deal with having the same station
address for different virtual interfaces, say as a client to two
virtual AP interfaces. Rather than requiring each driver with a
limitation like that to enforce it, add a hardware flag for it.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/mac80211.h  |  6 ++++++
 net/mac80211/debugfs.c  |  1 +
 net/mac80211/sta_info.c | 18 ++++++++++++++++--
 3 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index c1744c2f8aca..13044fe77379 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1926,6 +1926,11 @@ struct ieee80211_txq {
  * @IEEE80211_HW_BEACON_TX_STATUS: The device/driver provides TX status
  *	for sent beacons.
  *
+ * @IEEE80211_HW_NEEDS_UNIQUE_STA_ADDR: Hardware (or driver) requires that each
+ *	station has a unique address, i.e. each station entry can be identified
+ *	by just its MAC address; this prevents, for example, the same station
+ *	from connecting to two virtual AP interfaces at the same time.
+ *
  * @NUM_IEEE80211_HW_FLAGS: number of hardware flags, used for sizing arrays
  */
 enum ieee80211_hw_flags {
@@ -1961,6 +1966,7 @@ enum ieee80211_hw_flags {
 	IEEE80211_HW_TDLS_WIDER_BW,
 	IEEE80211_HW_SUPPORTS_AMSDU_IN_AMPDU,
 	IEEE80211_HW_BEACON_TX_STATUS,
+	IEEE80211_HW_NEEDS_UNIQUE_STA_ADDR,
 
 	/* keep last, obviously */
 	NUM_IEEE80211_HW_FLAGS
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index e546a987a9d3..3e24d0ddb51b 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -125,6 +125,7 @@ static const char *hw_flag_names[] = {
 	FLAG(TDLS_WIDER_BW),
 	FLAG(SUPPORTS_AMSDU_IN_AMPDU),
 	FLAG(BEACON_TX_STATUS),
+	FLAG(NEEDS_UNIQUE_STA_ADDR),
 #undef FLAG
 };
 
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index e302c71ad3cf..939b2b87ab37 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -458,6 +458,19 @@ static int sta_info_insert_check(struct sta_info *sta)
 		    is_multicast_ether_addr(sta->sta.addr)))
 		return -EINVAL;
 
+	/* Strictly speaking this isn't necessary as we hold the mutex, but
+	 * the rhashtable code can't really deal with that distinction. We
+	 * do require the mutex for correctness though.
+	 */
+	rcu_read_lock();
+	lockdep_assert_held(&sdata->local->sta_mtx);
+	if (ieee80211_hw_check(&sdata->local->hw, NEEDS_UNIQUE_STA_ADDR) &&
+	    ieee80211_find_sta_by_ifaddr(&sdata->local->hw, sta->addr, NULL)) {
+		rcu_read_unlock();
+		return -ENOTUNIQ;
+	}
+	rcu_read_unlock();
+
 	return 0;
 }
 
@@ -586,14 +599,15 @@ int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
 
 	might_sleep();
 
+	mutex_lock(&local->sta_mtx);
+
 	err = sta_info_insert_check(sta);
 	if (err) {
+		mutex_unlock(&local->sta_mtx);
 		rcu_read_lock();
 		goto out_free;
 	}
 
-	mutex_lock(&local->sta_mtx);
-
 	err = sta_info_insert_finish(sta);
 	if (err)
 		goto out_free;

From 428448c8378da4837528a6a605bda46365095cac Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Thu, 12 Nov 2020 11:22:04 +0100
Subject: [PATCH 1083/2658] mac80211: free sta in sta_info_insert_finish() on
 errors

commit 7bc40aedf24d31d8bea80e1161e996ef4299fb10 upstream.

If sta_info_insert_finish() fails, we currently keep the station
around and free it only in the caller, but there's only one such
caller and it always frees it immediately.

As syzbot found, another consequence of this split is that we can
put things that sleep only into __cleanup_single_sta() and not in
sta_info_free(), but this is the only place that requires such of
sta_info_free() now.

Change this to free the station in sta_info_insert_finish(), in
which case we can still sleep. This will also let us unify the
cleanup code later.

Cc: stable@vger.kernel.org
Fixes: dcd479e10a05 ("mac80211: always wind down STA state")
Reported-by: syzbot+32c6c38c4812d22f2f0b@syzkaller.appspotmail.com
Reported-by: syzbot+4c81fe92e372d26c4246@syzkaller.appspotmail.com
Reported-by: syzbot+6a7fe9faf0d1d61bc24a@syzkaller.appspotmail.com
Reported-by: syzbot+abed06851c5ffe010921@syzkaller.appspotmail.com
Reported-by: syzbot+b7aeb9318541a1c709f1@syzkaller.appspotmail.com
Reported-by: syzbot+d5a9416c6cafe53b5dd0@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20201112112201.ee6b397b9453.I9c31d667a0ea2151441cc64ed6613d36c18a48e0@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/sta_info.c | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 939b2b87ab37..c4b192e7f48f 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -584,7 +584,7 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
  out_drop_sta:
 	local->num_sta--;
 	synchronize_net();
-	__cleanup_single_sta(sta);
+	cleanup_single_sta(sta);
  out_err:
 	mutex_unlock(&local->sta_mtx);
 	kfree(sinfo);
@@ -603,19 +603,13 @@ int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
 
 	err = sta_info_insert_check(sta);
 	if (err) {
+		sta_info_free(local, sta);
 		mutex_unlock(&local->sta_mtx);
 		rcu_read_lock();
-		goto out_free;
+		return err;
 	}
 
-	err = sta_info_insert_finish(sta);
-	if (err)
-		goto out_free;
-
-	return 0;
- out_free:
-	sta_info_free(local, sta);
-	return err;
+	return sta_info_insert_finish(sta);
 }
 
 int sta_info_insert(struct sta_info *sta)

From d408fb6ed8eb561d19c76362c5b907aa04375497 Mon Sep 17 00:00:00 2001
From: Thomas Richter <tmricht@linux.ibm.com>
Date: Wed, 11 Nov 2020 16:26:25 +0100
Subject: [PATCH 1084/2658] s390/cpum_sf.c: fix file permission for
 cpum_sfb_size

commit 78d732e1f326f74f240d416af9484928303d9951 upstream.

This file is installed by the s390 CPU Measurement sampling
facility device driver to export supported minimum and
maximum sample buffer sizes.
This file is read by lscpumf tool to display the details
of the device driver capabilities. The lscpumf tool might
be invoked by a non-root user. In this case it does not
print anything because the file contents can not be read.

Fix this by allowing read access for all users. Reading
the file contents is ok, changing the file contents is
left to the root user only.

For further reference and details see:
 [1] https://github.com/ibm-s390-tools/s390-tools/issues/97

Fixes: 69f239ed335a ("s390/cpum_sf: Dynamically extend the sampling buffer if overflows occur")
Cc: <stable@vger.kernel.org> # 3.14
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/kernel/perf_cpum_sf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
index 4a76b381d25a..59429133491c 100644
--- a/arch/s390/kernel/perf_cpum_sf.c
+++ b/arch/s390/kernel/perf_cpum_sf.c
@@ -1666,4 +1666,4 @@ static int __init init_cpum_sampling_pmu(void)
 	return err;
 }
 arch_initcall(init_cpum_sampling_pmu);
-core_param(cpum_sfb_size, CPUM_SF_MAX_SDB, sfb_size, 0640);
+core_param(cpum_sfb_size, CPUM_SF_MAX_SDB, sfb_size, 0644);

From b3c10aef4137fd07db2410c36b3c59b369d116de Mon Sep 17 00:00:00 2001
From: Chen Yu <yu.c.chen@intel.com>
Date: Fri, 13 Nov 2020 09:59:23 +0800
Subject: [PATCH 1085/2658] x86/microcode/intel: Check patch signature before
 saving microcode for early loading

commit 1a371e67dc77125736cc56d3a0893f06b75855b6 upstream.

Currently, scan_microcode() leverages microcode_matches() to check
if the microcode matches the CPU by comparing the family and model.
However, the processor stepping and flags of the microcode signature
should also be considered when saving a microcode patch for early
update.

Use find_matching_signature() in scan_microcode() and get rid of the
now-unused microcode_matches() which is a good cleanup in itself.

Complete the verification of the patch being saved for early loading in
save_microcode_patch() directly. This needs to be done there too because
save_mc_for_early() will call save_microcode_patch() too.

The second reason why this needs to be done is because the loader still
tries to support, at least hypothetically, mixed-steppings systems and
thus adds all patches to the cache that belong to the same CPU model
albeit with different steppings.

For example:

  microcode: CPU: sig=0x906ec, pf=0x2, rev=0xd6
  microcode: mc_saved[0]: sig=0x906e9, pf=0x2a, rev=0xd6, total size=0x19400, date = 2020-04-23
  microcode: mc_saved[1]: sig=0x906ea, pf=0x22, rev=0xd6, total size=0x19000, date = 2020-04-27
  microcode: mc_saved[2]: sig=0x906eb, pf=0x2, rev=0xd6, total size=0x19400, date = 2020-04-23
  microcode: mc_saved[3]: sig=0x906ec, pf=0x22, rev=0xd6, total size=0x19000, date = 2020-04-27
  microcode: mc_saved[4]: sig=0x906ed, pf=0x22, rev=0xd6, total size=0x19400, date = 2020-04-23

The patch which is being saved for early loading, however, can only be
the one which fits the CPU this runs on so do the signature verification
before saving.

 [ bp: Do signature verification in save_microcode_patch()
       and rewrite commit message. ]

Fixes: ec400ddeff20 ("x86/microcode_intel_early.c: Early update ucode on Intel's CPU")
Signed-off-by: Chen Yu <yu.c.chen@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: stable@vger.kernel.org
Link: https://bugzilla.kernel.org/show_bug.cgi?id=208535
Link: https://lkml.kernel.org/r/20201113015923.13960-1-yu.c.chen@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/cpu/microcode/intel.c | 49 ++-------------------------
 1 file changed, 2 insertions(+), 47 deletions(-)

diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index 619d69aa81c8..d4c3a30a7b33 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -132,51 +132,6 @@ load_microcode(struct mc_saved_data *mc_saved_data, unsigned long *initrd,
 	}
 }
 
-/*
- * Given CPU signature and a microcode patch, this function finds if the
- * microcode patch has matching family and model with the CPU.
- */
-static enum ucode_state
-matching_model_microcode(struct microcode_header_intel *mc_header,
-			unsigned long sig)
-{
-	unsigned int fam, model;
-	unsigned int fam_ucode, model_ucode;
-	struct extended_sigtable *ext_header;
-	unsigned long total_size = get_totalsize(mc_header);
-	unsigned long data_size = get_datasize(mc_header);
-	int ext_sigcount, i;
-	struct extended_signature *ext_sig;
-
-	fam   = __x86_family(sig);
-	model = x86_model(sig);
-
-	fam_ucode   = __x86_family(mc_header->sig);
-	model_ucode = x86_model(mc_header->sig);
-
-	if (fam == fam_ucode && model == model_ucode)
-		return UCODE_OK;
-
-	/* Look for ext. headers: */
-	if (total_size <= data_size + MC_HEADER_SIZE)
-		return UCODE_NFOUND;
-
-	ext_header   = (void *) mc_header + data_size + MC_HEADER_SIZE;
-	ext_sig      = (void *)ext_header + EXT_HEADER_SIZE;
-	ext_sigcount = ext_header->count;
-
-	for (i = 0; i < ext_sigcount; i++) {
-		fam_ucode   = __x86_family(ext_sig->sig);
-		model_ucode = x86_model(ext_sig->sig);
-
-		if (fam == fam_ucode && model == model_ucode)
-			return UCODE_OK;
-
-		ext_sig++;
-	}
-	return UCODE_NFOUND;
-}
-
 static int
 save_microcode(struct mc_saved_data *mc_saved_data,
 	       struct microcode_intel **mc_saved_src,
@@ -321,8 +276,8 @@ get_matching_model_microcode(int cpu, unsigned long start,
 		 * the platform, we need to find and save microcode patches
 		 * with the same family and model as the BSP.
 		 */
-		if (matching_model_microcode(mc_header, uci->cpu_sig.sig) !=
-			 UCODE_OK) {
+		if (!find_matching_signature(mc_header, uci->cpu_sig.sig,
+					     uci->cpu_sig.pf)) {
 			ucode_ptr += mc_size;
 			continue;
 		}

From 2f40ae1bdbabf5b993ff628ea280a500ce98aa0c Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 24 Nov 2020 12:48:13 +0100
Subject: [PATCH 1086/2658] Linux 4.4.246

Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Link: https://lore.kernel.org/r/20201123121804.306030358@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 3e9059bf121d..f92c285c0125 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 245
+SUBLEVEL = 246
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 70ea57d58c98108436f140be9f4e178ba500c803 Mon Sep 17 00:00:00 2001
From: Qu Wenruo <wqu@suse.com>
Date: Wed, 13 Mar 2019 12:17:50 +0800
Subject: [PATCH 1087/2658] btrfs: tree-checker: Enhance chunk checker to
 validate chunk profile

commit 80e46cf22ba0bcb57b39c7c3b52961ab3a0fd5f2 upstream

Btrfs-progs already have a comprehensive type checker, to ensure there
is only 0 (SINGLE profile) or 1 (DUP/RAID0/1/5/6/10) bit set for chunk
profile bits.

Do the same work for kernel.

Reported-by: Yoon Jungyeon <jungyeon@gatech.edu>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=202765
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
[sudip: manually backport, use btrfs_err with root->fs_info]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/volumes.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 2d10b818399b..cd1e9411f926 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -6262,6 +6262,13 @@ static int btrfs_check_chunk_valid(struct btrfs_root *root,
 		return -EIO;
 	}
 
+	if (!is_power_of_2(type & BTRFS_BLOCK_GROUP_PROFILE_MASK) &&
+	    (type & BTRFS_BLOCK_GROUP_PROFILE_MASK) != 0) {
+		btrfs_err(root->fs_info,
+		"invalid chunk profile flag: 0x%llx, expect 0 or 1 bit set",
+			  type & BTRFS_BLOCK_GROUP_PROFILE_MASK);
+		return -EUCLEAN;
+	}
 	if ((type & BTRFS_BLOCK_GROUP_TYPE_MASK) == 0) {
 		btrfs_err(root->fs_info, "missing chunk type flag: 0x%llx", type);
 		return -EIO;

From d3035fbab6b3528b54429f4d392ac52fa8b0668d Mon Sep 17 00:00:00 2001
From: Qu Wenruo <wqu@suse.com>
Date: Wed, 13 Mar 2019 13:55:11 +0800
Subject: [PATCH 1088/2658] btrfs: inode: Verify inode mode to avoid NULL
 pointer dereference

commit 6bf9e4bd6a277840d3fe8c5d5d530a1fbd3db592 upstream

[BUG]
When accessing a file on a crafted image, btrfs can crash in block layer:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
  PGD 136501067 P4D 136501067 PUD 124519067 PMD 0
  CPU: 3 PID: 0 Comm: swapper/3 Not tainted 5.0.0-rc8-default #252
  RIP: 0010:end_bio_extent_readpage+0x144/0x700
  Call Trace:
   <IRQ>
   blk_update_request+0x8f/0x350
   blk_mq_end_request+0x1a/0x120
   blk_done_softirq+0x99/0xc0
   __do_softirq+0xc7/0x467
   irq_exit+0xd1/0xe0
   call_function_single_interrupt+0xf/0x20
   </IRQ>
  RIP: 0010:default_idle+0x1e/0x170

[CAUSE]
The crafted image has a tricky corruption, the INODE_ITEM has a
different type against its parent dir:

        item 20 key (268 INODE_ITEM 0) itemoff 2808 itemsize 160
                generation 13 transid 13 size 1048576 nbytes 1048576
                block group 0 mode 121644 links 1 uid 0 gid 0 rdev 0
                sequence 9 flags 0x0(none)

This mode number 0120000 means it's a symlink.

But the dir item think it's still a regular file:

        item 8 key (264 DIR_INDEX 5) itemoff 3707 itemsize 32
                location key (268 INODE_ITEM 0) type FILE
                transid 13 data_len 0 name_len 2
                name: f4
        item 40 key (264 DIR_ITEM 51821248) itemoff 1573 itemsize 32
                location key (268 INODE_ITEM 0) type FILE
                transid 13 data_len 0 name_len 2
                name: f4

For symlink, we don't set BTRFS_I(inode)->io_tree.ops and leave it
empty, as symlink is only designed to have inlined extent, all handled
by tree block read.  Thus no need to trigger btrfs_submit_bio_hook() for
inline file extent.

However end_bio_extent_readpage() expects tree->ops populated, as it's
reading regular data extent.  This causes NULL pointer dereference.

[FIX]
This patch fixes the problem in two ways:

- Verify inode mode against its dir item when looking up inode
  So in btrfs_lookup_dentry() if we find inode mode mismatch with dir
  item, we error out so that corrupted inode will not be accessed.

- Verify inode mode when getting extent mapping
  Only regular file should have regular or preallocated extent.
  If we found regular/preallocated file extent for symlink or
  the rest, we error out before submitting the read bio.

With this fix that crafted image can be rejected gracefully:

  BTRFS critical (device loop0): inode mode mismatch with dir: inode mode=0121644 btrfs type=7 dir type=1

Reported-by: Yoon Jungyeon <jungyeon@gatech.edu>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=202763
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
[sudip: use original btrfs_inode_type(), btrfs_crit with root->fs_info,
ISREG with inode->i_mode and adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/inode.c             | 41 +++++++++++++++++++++++++++++-------
 fs/btrfs/tests/inode-tests.c |  1 +
 2 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index b1125778b908..9e1f9910bdf2 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -5370,11 +5370,13 @@ void btrfs_evict_inode(struct inode *inode)
 }
 
 /*
- * this returns the key found in the dir entry in the location pointer.
+ * Return the key found in the dir entry in the location pointer, fill @type
+ * with BTRFS_FT_*, and return 0.
+ *
  * If no dir entries were found, location->objectid is 0.
  */
 static int btrfs_inode_by_name(struct inode *dir, struct dentry *dentry,
-			       struct btrfs_key *location)
+			       struct btrfs_key *location, u8 *type)
 {
 	const char *name = dentry->d_name.name;
 	int namelen = dentry->d_name.len;
@@ -5396,6 +5398,8 @@ static int btrfs_inode_by_name(struct inode *dir, struct dentry *dentry,
 		goto out_err;
 
 	btrfs_dir_item_key_to_cpu(path->nodes[0], di, location);
+	if (!ret)
+		*type = btrfs_dir_type(path->nodes[0], di);
 out:
 	btrfs_free_path(path);
 	return ret;
@@ -5681,19 +5685,25 @@ static struct inode *new_simple_dir(struct super_block *s,
 	return inode;
 }
 
+static inline u8 btrfs_inode_type(struct inode *inode)
+{
+	return btrfs_type_by_mode[(inode->i_mode & S_IFMT) >> S_SHIFT];
+}
+
 struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
 {
 	struct inode *inode;
 	struct btrfs_root *root = BTRFS_I(dir)->root;
 	struct btrfs_root *sub_root = root;
 	struct btrfs_key location;
+	u8 di_type = 0;
 	int index;
 	int ret = 0;
 
 	if (dentry->d_name.len > BTRFS_NAME_LEN)
 		return ERR_PTR(-ENAMETOOLONG);
 
-	ret = btrfs_inode_by_name(dir, dentry, &location);
+	ret = btrfs_inode_by_name(dir, dentry, &location, &di_type);
 	if (ret < 0)
 		return ERR_PTR(ret);
 
@@ -5702,6 +5712,18 @@ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
 
 	if (location.type == BTRFS_INODE_ITEM_KEY) {
 		inode = btrfs_iget(dir->i_sb, &location, root, NULL);
+		if (IS_ERR(inode))
+			return inode;
+
+		/* Do extra check against inode mode with di_type */
+		if (btrfs_inode_type(inode) != di_type) {
+			btrfs_crit(root->fs_info,
+"inode mode mismatch with dir: inode mode=0%o btrfs type=%u dir type=%u",
+				  inode->i_mode, btrfs_inode_type(inode),
+				  di_type);
+			iput(inode);
+			return ERR_PTR(-EUCLEAN);
+		}
 		return inode;
 	}
 
@@ -6315,11 +6337,6 @@ static struct inode *btrfs_new_inode(struct btrfs_trans_handle *trans,
 	return ERR_PTR(ret);
 }
 
-static inline u8 btrfs_inode_type(struct inode *inode)
-{
-	return btrfs_type_by_mode[(inode->i_mode & S_IFMT) >> S_SHIFT];
-}
-
 /*
  * utility function to add 'inode' into 'parent_inode' with
  * a give name and a given sequence number.
@@ -6904,6 +6921,14 @@ struct extent_map *btrfs_get_extent(struct inode *inode, struct page *page,
 	extent_start = found_key.offset;
 	if (found_type == BTRFS_FILE_EXTENT_REG ||
 	    found_type == BTRFS_FILE_EXTENT_PREALLOC) {
+		/* Only regular file could have regular/prealloc extent */
+		if (!S_ISREG(inode->i_mode)) {
+			ret = -EUCLEAN;
+			btrfs_crit(root->fs_info,
+		"regular/prealloc extent found for non-regular inode %llu",
+				   btrfs_ino(inode));
+			goto out;
+		}
 		extent_end = extent_start +
 		       btrfs_file_extent_num_bytes(leaf, item);
 	} else if (found_type == BTRFS_FILE_EXTENT_INLINE) {
diff --git a/fs/btrfs/tests/inode-tests.c b/fs/btrfs/tests/inode-tests.c
index 054fc0d97131..5ff676df698f 100644
--- a/fs/btrfs/tests/inode-tests.c
+++ b/fs/btrfs/tests/inode-tests.c
@@ -235,6 +235,7 @@ static noinline int test_btrfs_get_extent(void)
 		return ret;
 	}
 
+	inode->i_mode = S_IFREG;
 	BTRFS_I(inode)->location.type = BTRFS_INODE_ITEM_KEY;
 	BTRFS_I(inode)->location.objectid = BTRFS_FIRST_FREE_OBJECTID;
 	BTRFS_I(inode)->location.offset = 0;

From 0d5e66230d110230181d9b33ca49fa7d39043255 Mon Sep 17 00:00:00 2001
From: Frank Yang <puilp0502@gmail.com>
Date: Fri, 21 Aug 2020 03:16:50 +0900
Subject: [PATCH 1089/2658] HID: cypress: Support Varmilo Keyboards' media
 hotkeys

[ Upstream commit 652f3d00de523a17b0cebe7b90debccf13aa8c31 ]

The Varmilo VA104M Keyboard (04b4:07b1, reported as Varmilo Z104M)
exposes media control hotkeys as a USB HID consumer control device, but
these keys do not work in the current (5.8-rc1) kernel due to the
incorrect HID report descriptor. Fix the problem by modifying the
internal HID report descriptor.

More specifically, the keyboard report descriptor specifies the
logical boundary as 572~10754 (0x023c ~ 0x2a02) while the usage
boundary is specified as 0~10754 (0x00 ~ 0x2a02). This results in an
incorrect interpretation of input reports, causing inputs to be ignored.
By setting the Logical Minimum to zero, we align the logical boundary
with the Usage ID boundary.

Some notes:

* There seem to be multiple variants of the VA104M keyboard. This
  patch specifically targets 04b4:07b1 variant.

* The device works out-of-the-box on Windows platform with the generic
  consumer control device driver (hidserv.inf). This suggests that
  Windows either ignores the Logical Minimum/Logical Maximum or
  interprets the Usage ID assignment differently from the linux
  implementation; Maybe there are other devices out there that only
  works on Windows due to this problem?

Signed-off-by: Frank Yang <puilp0502@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-cypress.c | 44 ++++++++++++++++++++++++++++++++++-----
 drivers/hid/hid-ids.h     |  2 ++
 2 files changed, 41 insertions(+), 5 deletions(-)

diff --git a/drivers/hid/hid-cypress.c b/drivers/hid/hid-cypress.c
index 1689568b597d..12c5d7c96527 100644
--- a/drivers/hid/hid-cypress.c
+++ b/drivers/hid/hid-cypress.c
@@ -26,19 +26,17 @@
 #define CP_2WHEEL_MOUSE_HACK		0x02
 #define CP_2WHEEL_MOUSE_HACK_ON		0x04
 
+#define VA_INVAL_LOGICAL_BOUNDARY	0x08
+
 /*
  * Some USB barcode readers from cypress have usage min and usage max in
  * the wrong order
  */
-static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+static __u8 *cp_rdesc_fixup(struct hid_device *hdev, __u8 *rdesc,
 		unsigned int *rsize)
 {
-	unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
 	unsigned int i;
 
-	if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX))
-		return rdesc;
-
 	if (*rsize < 4)
 		return rdesc;
 
@@ -51,6 +49,40 @@ static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 	return rdesc;
 }
 
+static __u8 *va_logical_boundary_fixup(struct hid_device *hdev, __u8 *rdesc,
+		unsigned int *rsize)
+{
+	/*
+	 * Varmilo VA104M (with VID Cypress and device ID 07B1) incorrectly
+	 * reports Logical Minimum of its Consumer Control device as 572
+	 * (0x02 0x3c). Fix this by setting its Logical Minimum to zero.
+	 */
+	if (*rsize == 25 &&
+			rdesc[0] == 0x05 && rdesc[1] == 0x0c &&
+			rdesc[2] == 0x09 && rdesc[3] == 0x01 &&
+			rdesc[6] == 0x19 && rdesc[7] == 0x00 &&
+			rdesc[11] == 0x16 && rdesc[12] == 0x3c && rdesc[13] == 0x02) {
+		hid_info(hdev,
+			 "fixing up varmilo VA104M consumer control report descriptor\n");
+		rdesc[12] = 0x00;
+		rdesc[13] = 0x00;
+	}
+	return rdesc;
+}
+
+static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+		unsigned int *rsize)
+{
+	unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
+
+	if (quirks & CP_RDESC_SWAPPED_MIN_MAX)
+		rdesc = cp_rdesc_fixup(hdev, rdesc, rsize);
+	if (quirks & VA_INVAL_LOGICAL_BOUNDARY)
+		rdesc = va_logical_boundary_fixup(hdev, rdesc, rsize);
+
+	return rdesc;
+}
+
 static int cp_input_mapped(struct hid_device *hdev, struct hid_input *hi,
 		struct hid_field *field, struct hid_usage *usage,
 		unsigned long **bit, int *max)
@@ -131,6 +163,8 @@ static const struct hid_device_id cp_devices[] = {
 		.driver_data = CP_RDESC_SWAPPED_MIN_MAX },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE),
 		.driver_data = CP_2WHEEL_MOUSE_HACK },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1),
+		.driver_data = VA_INVAL_LOGICAL_BOUNDARY },
 	{ }
 };
 MODULE_DEVICE_TABLE(hid, cp_devices);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index d328fda5640f..a473c965e797 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -279,6 +279,8 @@
 #define USB_DEVICE_ID_CYPRESS_BARCODE_4	0xed81
 #define USB_DEVICE_ID_CYPRESS_TRUETOUCH	0xc001
 
+#define USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1   0X07b1
+
 #define USB_VENDOR_ID_DATA_MODUL	0x7374
 #define USB_VENDOR_ID_DATA_MODUL_EASYMAXTOUCH	0x1201
 

From 532044fa768ea1b5dada6c98fa379703bf77e96a Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Mon, 26 Oct 2020 20:53:57 -0700
Subject: [PATCH 1090/2658] Input: i8042 - allow insmod to succeed on devices
 without an i8042 controller

[ Upstream commit b1884583fcd17d6a1b1bba94bbb5826e6b5c6e17 ]

The i8042 module exports several symbols which may be used by other
modules.

Before this commit it would refuse to load (when built as a module itself)
on systems without an i8042 controller.

This is a problem specifically for the asus-nb-wmi module. Many Asus
laptops support the Asus WMI interface. Some of them have an i8042
controller and need to use i8042_install_filter() to filter some kbd
events. Other models do not have an i8042 controller (e.g. they use an
USB attached kbd).

Before this commit the asus-nb-wmi driver could not be loaded on Asus
models without an i8042 controller, when the i8042 code was built as
a module (as Arch Linux does) because the module_init function of the
i8042 module would fail with -ENODEV and thus the i8042_install_filter
symbol could not be loaded.

This commit fixes this by exiting from module_init with a return code
of 0 if no controller is found.  It also adds a i8042_present bool to
make the module_exit function a no-op in this case and also adds a
check for i8042_present to the exported i8042_command function.

The latter i8042_present check should not really be necessary because
when builtin that function can already be used on systems without
an i8042 controller, but better safe then sorry.

Reported-and-tested-by: Marius Iacob <themariusus@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20201008112628.3979-2-hdegoede@redhat.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/serio/i8042.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index c84c685056b9..6b648339733f 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -125,6 +125,7 @@ module_param_named(unmask_kbd_data, i8042_unmask_kbd_data, bool, 0600);
 MODULE_PARM_DESC(unmask_kbd_data, "Unconditional enable (may reveal sensitive data) of normally sanitize-filtered kbd data traffic debug log [pre-condition: i8042.debug=1 enabled]");
 #endif
 
+static bool i8042_present;
 static bool i8042_bypass_aux_irq_test;
 static char i8042_kbd_firmware_id[128];
 static char i8042_aux_firmware_id[128];
@@ -343,6 +344,9 @@ int i8042_command(unsigned char *param, int command)
 	unsigned long flags;
 	int retval;
 
+	if (!i8042_present)
+		return -1;
+
 	spin_lock_irqsave(&i8042_lock, flags);
 	retval = __i8042_command(param, command);
 	spin_unlock_irqrestore(&i8042_lock, flags);
@@ -1597,12 +1601,15 @@ static int __init i8042_init(void)
 
 	err = i8042_platform_init();
 	if (err)
-		return err;
+		return (err == -ENODEV) ? 0 : err;
 
 	err = i8042_controller_check();
 	if (err)
 		goto err_platform_exit;
 
+	/* Set this before creating the dev to allow i8042_command to work right away */
+	i8042_present = true;
+
 	pdev = platform_create_bundle(&i8042_driver, i8042_probe, NULL, 0, NULL, 0);
 	if (IS_ERR(pdev)) {
 		err = PTR_ERR(pdev);
@@ -1621,6 +1628,9 @@ static int __init i8042_init(void)
 
 static void __exit i8042_exit(void)
 {
+	if (!i8042_present)
+		return;
+
 	platform_device_unregister(i8042_platform_device);
 	platform_driver_unregister(&i8042_driver);
 	i8042_platform_exit();

From 91ce0ca48cf0fc0a36b336ebd67ec24e26fcebc7 Mon Sep 17 00:00:00 2001
From: Pablo Ceballos <pceballos@google.com>
Date: Mon, 2 Nov 2020 19:29:39 -0500
Subject: [PATCH 1091/2658] HID: hid-sensor-hub: Fix issue with devices with no
 report ID

[ Upstream commit 34a9fa2025d9d3177c99351c7aaf256c5f50691f ]

Some HID devices don't use a report ID because they only have a single
report. In those cases, the report ID in struct hid_report will be zero
and the data for the report will start at the first byte, so don't skip
over the first byte.

Signed-off-by: Pablo Ceballos <pceballos@google.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-sensor-hub.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 8efaa88329aa..83e45d5801a9 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -473,7 +473,8 @@ static int sensor_hub_raw_event(struct hid_device *hdev,
 		return 1;
 
 	ptr = raw_data;
-	ptr++; /* Skip report id */
+	if (report->id)
+		ptr++; /* Skip report id */
 
 	spin_lock_irqsave(&pdata->lock, flags);
 

From 3e791a8124a60cf5c5e8966c5861a5ef815c7df9 Mon Sep 17 00:00:00 2001
From: Brian Masney <bmasney@redhat.com>
Date: Fri, 6 Nov 2020 20:11:19 -0500
Subject: [PATCH 1092/2658] x86/xen: don't unbind uninitialized lock_kicker_irq

[ Upstream commit 65cae18882f943215d0505ddc7e70495877308e6 ]

When booting a hyperthreaded system with the kernel parameter
'mitigations=auto,nosmt', the following warning occurs:

    WARNING: CPU: 0 PID: 1 at drivers/xen/events/events_base.c:1112 unbind_from_irqhandler+0x4e/0x60
    ...
    Hardware name: Xen HVM domU, BIOS 4.2.amazon 08/24/2006
    ...
    Call Trace:
     xen_uninit_lock_cpu+0x28/0x62
     xen_hvm_cpu_die+0x21/0x30
     takedown_cpu+0x9c/0xe0
     ? trace_suspend_resume+0x60/0x60
     cpuhp_invoke_callback+0x9a/0x530
     _cpu_up+0x11a/0x130
     cpu_up+0x7e/0xc0
     bringup_nonboot_cpus+0x48/0x50
     smp_init+0x26/0x79
     kernel_init_freeable+0xea/0x229
     ? rest_init+0xaa/0xaa
     kernel_init+0xa/0x106
     ret_from_fork+0x35/0x40

The secondary CPUs are not activated with the nosmt mitigations and only
the primary thread on each CPU core is used. In this situation,
xen_hvm_smp_prepare_cpus(), and more importantly xen_init_lock_cpu(), is
not called, so the lock_kicker_irq is not initialized for the secondary
CPUs. Let's fix this by exiting early in xen_uninit_lock_cpu() if the
irq is not set to avoid the warning from above for each secondary CPU.

Signed-off-by: Brian Masney <bmasney@redhat.com>
Link: https://lore.kernel.org/r/20201107011119.631442-1-bmasney@redhat.com
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/xen/spinlock.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
index 85872a08994a..e9fc0f7df0da 100644
--- a/arch/x86/xen/spinlock.c
+++ b/arch/x86/xen/spinlock.c
@@ -301,10 +301,20 @@ void xen_init_lock_cpu(int cpu)
 
 void xen_uninit_lock_cpu(int cpu)
 {
+	int irq;
+
 	if (!xen_pvspin)
 		return;
 
-	unbind_from_irqhandler(per_cpu(lock_kicker_irq, cpu), NULL);
+	/*
+	 * When booting the kernel with 'mitigations=auto,nosmt', the secondary
+	 * CPUs are not activated, and lock_kicker_irq is not initialized.
+	 */
+	irq = per_cpu(lock_kicker_irq, cpu);
+	if (irq == -1)
+		return;
+
+	unbind_from_irqhandler(irq, NULL);
 	per_cpu(lock_kicker_irq, cpu) = -1;
 	kfree(per_cpu(irq_name, cpu));
 	per_cpu(irq_name, cpu) = NULL;

From d6acef715f75670d6717299926d0c285a9aee3b8 Mon Sep 17 00:00:00 2001
From: Jens Axboe <axboe@kernel.dk>
Date: Fri, 13 Nov 2020 16:47:52 -0700
Subject: [PATCH 1093/2658] proc: don't allow async path resolution of
 /proc/self components

[ Upstream commit 8d4c3e76e3be11a64df95ddee52e99092d42fc19 ]

If this is attempted by a kthread, then return -EOPNOTSUPP as we don't
currently support that. Once we can get task_pid_ptr() doing the right
thing, then this can go away again.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/proc/self.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/proc/self.c b/fs/proc/self.c
index 2dcc2558b3aa..dffbe533d53f 100644
--- a/fs/proc/self.c
+++ b/fs/proc/self.c
@@ -24,6 +24,13 @@ static const char *proc_self_follow_link(struct dentry *dentry, void **cookie)
 	pid_t tgid = task_tgid_nr_ns(current, ns);
 	char *name;
 
+	/*
+	 * Not currently supported. Once we can inherit all of struct pid,
+	 * we can allow this.
+	 */
+	if (current->flags & PF_KTHREAD)
+		return ERR_PTR(-EOPNOTSUPP);
+
 	if (!tgid)
 		return ERR_PTR(-ENOENT);
 	/* 11 for max length of signed int in decimal + NULL term */

From 5b643881f26b25edb5e8df88152e06dbc8422450 Mon Sep 17 00:00:00 2001
From: Sugar Zhang <sugar.zhang@rock-chips.com>
Date: Sat, 14 Nov 2020 11:55:06 +0800
Subject: [PATCH 1094/2658] dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst
 size

[ Upstream commit e773ca7da8beeca7f17fe4c9d1284a2b66839cc1 ]

Actually, burst size is equal to '1 << desc->rqcfg.brst_size'.
we should use burst size, not desc->rqcfg.brst_size.

dma memcpy performance on Rockchip RV1126
@ 1512MHz A7, 1056MHz LPDDR3, 200MHz DMA:

dmatest:

/# echo dma0chan0 > /sys/module/dmatest/parameters/channel
/# echo 4194304 > /sys/module/dmatest/parameters/test_buf_size
/# echo 8 > /sys/module/dmatest/parameters/iterations
/# echo y > /sys/module/dmatest/parameters/norandom
/# echo y > /sys/module/dmatest/parameters/verbose
/# echo 1 > /sys/module/dmatest/parameters/run

dmatest: dma0chan0-copy0: result #1: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
dmatest: dma0chan0-copy0: result #2: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
dmatest: dma0chan0-copy0: result #3: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
dmatest: dma0chan0-copy0: result #4: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
dmatest: dma0chan0-copy0: result #5: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
dmatest: dma0chan0-copy0: result #6: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
dmatest: dma0chan0-copy0: result #7: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
dmatest: dma0chan0-copy0: result #8: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000

Before:

  dmatest: dma0chan0-copy0: summary 8 tests, 0 failures 48 iops 200338 KB/s (0)

After this patch:

  dmatest: dma0chan0-copy0: summary 8 tests, 0 failures 179 iops 734873 KB/s (0)

After this patch and increase dma clk to 400MHz:

  dmatest: dma0chan0-copy0: summary 8 tests, 0 failures 259 iops 1062929 KB/s (0)

Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com>
Link: https://lore.kernel.org/r/1605326106-55681-1-git-send-email-sugar.zhang@rock-chips.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/pl330.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 9aa57b37381a..7f66ae1945b2 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2634,7 +2634,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
 	 * If burst size is smaller than bus width then make sure we only
 	 * transfer one at a time to avoid a burst stradling an MFIFO entry.
 	 */
-	if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width)
+	if (burst * 8 < pl330->pcfg.data_bus_width)
 		desc->rqcfg.brst_len = 1;
 
 	desc->bytes_requested = len;

From f488b20b07998eb7fe0357774b8cf504f2b44d7d Mon Sep 17 00:00:00 2001
From: Lee Duncan <lduncan@suse.com>
Date: Fri, 6 Nov 2020 11:33:17 -0800
Subject: [PATCH 1095/2658] scsi: libiscsi: Fix NOP race condition

[ Upstream commit fe0a8a95e7134d0b44cd407bc0085b9ba8d8fe31 ]

iSCSI NOPs are sometimes "lost", mistakenly sent to the user-land iscsid
daemon instead of handled in the kernel, as they should be, resulting in a
message from the daemon like:

  iscsid: Got nop in, but kernel supports nop handling.

This can occur because of the new forward- and back-locks, and the fact
that an iSCSI NOP response can occur before processing of the NOP send is
complete. This can result in "conn->ping_task" being NULL in
iscsi_nop_out_rsp(), when the pointer is actually in the process of being
set.

To work around this, we add a new state to the "ping_task" pointer. In
addition to NULL (not assigned) and a pointer (assigned), we add the state
"being set", which is signaled with an INVALID pointer (using "-1").

Link: https://lore.kernel.org/r/20201106193317.16993-1-leeman.duncan@gmail.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/libiscsi.c | 23 +++++++++++++++--------
 include/scsi/libiscsi.h |  3 +++
 2 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index b4fbcf4cade8..36e415487fe5 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -570,8 +570,8 @@ static void iscsi_complete_task(struct iscsi_task *task, int state)
 	if (conn->task == task)
 		conn->task = NULL;
 
-	if (conn->ping_task == task)
-		conn->ping_task = NULL;
+	if (READ_ONCE(conn->ping_task) == task)
+		WRITE_ONCE(conn->ping_task, NULL);
 
 	/* release get from queueing */
 	__iscsi_put_task(task);
@@ -780,6 +780,9 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
 						   task->conn->session->age);
 	}
 
+	if (unlikely(READ_ONCE(conn->ping_task) == INVALID_SCSI_TASK))
+		WRITE_ONCE(conn->ping_task, task);
+
 	if (!ihost->workq) {
 		if (iscsi_prep_mgmt_task(conn, task))
 			goto free_task;
@@ -987,8 +990,11 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
         struct iscsi_nopout hdr;
 	struct iscsi_task *task;
 
-	if (!rhdr && conn->ping_task)
-		return -EINVAL;
+	if (!rhdr) {
+		if (READ_ONCE(conn->ping_task))
+			return -EINVAL;
+		WRITE_ONCE(conn->ping_task, INVALID_SCSI_TASK);
+	}
 
 	memset(&hdr, 0, sizeof(struct iscsi_nopout));
 	hdr.opcode = ISCSI_OP_NOOP_OUT | ISCSI_OP_IMMEDIATE;
@@ -1003,11 +1009,12 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
 
 	task = __iscsi_conn_send_pdu(conn, (struct iscsi_hdr *)&hdr, NULL, 0);
 	if (!task) {
+		if (!rhdr)
+			WRITE_ONCE(conn->ping_task, NULL);
 		iscsi_conn_printk(KERN_ERR, conn, "Could not send nopout\n");
 		return -EIO;
 	} else if (!rhdr) {
 		/* only track our nops */
-		conn->ping_task = task;
 		conn->last_ping = jiffies;
 	}
 
@@ -1020,7 +1027,7 @@ static int iscsi_nop_out_rsp(struct iscsi_task *task,
 	struct iscsi_conn *conn = task->conn;
 	int rc = 0;
 
-	if (conn->ping_task != task) {
+	if (READ_ONCE(conn->ping_task) != task) {
 		/*
 		 * If this is not in response to one of our
 		 * nops then it must be from userspace.
@@ -1960,7 +1967,7 @@ static void iscsi_start_tx(struct iscsi_conn *conn)
  */
 static int iscsi_has_ping_timed_out(struct iscsi_conn *conn)
 {
-	if (conn->ping_task &&
+	if (READ_ONCE(conn->ping_task) &&
 	    time_before_eq(conn->last_recv + (conn->recv_timeout * HZ) +
 			   (conn->ping_timeout * HZ), jiffies))
 		return 1;
@@ -2095,7 +2102,7 @@ static enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc)
 	 * Checking the transport already or nop from a cmd timeout still
 	 * running
 	 */
-	if (conn->ping_task) {
+	if (READ_ONCE(conn->ping_task)) {
 		task->have_checked_conn = true;
 		rc = BLK_EH_RESET_TIMER;
 		goto done;
diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h
index c7b1dc713cdd..9c7f4aad6db6 100644
--- a/include/scsi/libiscsi.h
+++ b/include/scsi/libiscsi.h
@@ -144,6 +144,9 @@ struct iscsi_task {
 	void			*dd_data;	/* driver/transport data */
 };
 
+/* invalid scsi_task pointer */
+#define	INVALID_SCSI_TASK	(struct iscsi_task *)-1l
+
 static inline int iscsi_task_has_unsol_data(struct iscsi_task *task)
 {
 	return task->unsol_r2t.data_length > task->unsol_r2t.sent;

From 1b9c79f57485cebf7f3e6dfc67b59d55518761f1 Mon Sep 17 00:00:00 2001
From: Mike Christie <michael.christie@oracle.com>
Date: Fri, 13 Nov 2020 19:46:18 -0600
Subject: [PATCH 1096/2658] scsi: target: iscsi: Fix cmd abort fabric stop race

[ Upstream commit f36199355c64a39fe82cfddc7623d827c7e050da ]

Maurizio found a race where the abort and cmd stop paths can race as
follows:

 1. thread1 runs iscsit_release_commands_from_conn and sets
    CMD_T_FABRIC_STOP.

 2. thread2 runs iscsit_aborted_task and then does __iscsit_free_cmd. It
    then returns from the aborted_task callout and we finish
    target_handle_abort and do:

    target_handle_abort -> transport_cmd_check_stop_to_fabric ->
	lio_check_stop_free -> target_put_sess_cmd

    The cmd is now freed.

 3. thread1 now finishes iscsit_release_commands_from_conn and runs
    iscsit_free_cmd while accessing a command we just released.

In __target_check_io_state we check for CMD_T_FABRIC_STOP and set the
CMD_T_ABORTED if the driver is not cleaning up the cmd because of a session
shutdown. However, iscsit_release_commands_from_conn only sets the
CMD_T_FABRIC_STOP and does not check to see if the abort path has claimed
completion ownership of the command.

This adds a check in iscsit_release_commands_from_conn so only the abort or
fabric stop path cleanup the command.

Link: https://lore.kernel.org/r/1605318378-9269-1-git-send-email-michael.christie@oracle.com
Reported-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Maurizio Lombardi <mlombard@redhat.com>
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/target/iscsi/iscsi_target.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index cbb4414edd71..c48aca1360c8 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -493,8 +493,7 @@ static void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
 	bool scsi_cmd = (cmd->iscsi_opcode == ISCSI_OP_SCSI_CMD);
 
 	spin_lock_bh(&conn->cmd_lock);
-	if (!list_empty(&cmd->i_conn_node) &&
-	    !(cmd->se_cmd.transport_state & CMD_T_FABRIC_STOP))
+	if (!list_empty(&cmd->i_conn_node))
 		list_del_init(&cmd->i_conn_node);
 	spin_unlock_bh(&conn->cmd_lock);
 
@@ -4228,12 +4227,22 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
 	spin_lock_bh(&conn->cmd_lock);
 	list_splice_init(&conn->conn_cmd_list, &tmp_list);
 
-	list_for_each_entry(cmd, &tmp_list, i_conn_node) {
+	list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) {
 		struct se_cmd *se_cmd = &cmd->se_cmd;
 
 		if (se_cmd->se_tfo != NULL) {
 			spin_lock_irq(&se_cmd->t_state_lock);
-			se_cmd->transport_state |= CMD_T_FABRIC_STOP;
+			if (se_cmd->transport_state & CMD_T_ABORTED) {
+				/*
+				 * LIO's abort path owns the cleanup for this,
+				 * so put it back on the list and let
+				 * aborted_task handle it.
+				 */
+				list_move_tail(&cmd->i_conn_node,
+					       &conn->conn_cmd_list);
+			} else {
+				se_cmd->transport_state |= CMD_T_FABRIC_STOP;
+			}
 			spin_unlock_irq(&se_cmd->t_state_lock);
 		}
 	}

From ad87783aa16ce22558da24752f0bbcb6859de635 Mon Sep 17 00:00:00 2001
From: Stanley Chu <stanley.chu@mediatek.com>
Date: Thu, 19 Nov 2020 14:29:16 +0800
Subject: [PATCH 1097/2658] scsi: ufs: Fix race between shutdown and runtime
 resume flow

[ Upstream commit e92643db514803c2c87d72caf5950b4c0a8faf4a ]

If UFS host device is in runtime-suspended state while UFS shutdown
callback is invoked, UFS device shall be resumed for register
accesses. Currently only UFS local runtime resume function will be invoked
to wake up the host.  This is not enough because if someone triggers
runtime resume from block layer, then race may happen between shutdown and
runtime resume flow, and finally lead to unlocked register access.

To fix this, in ufshcd_shutdown(), use pm_runtime_get_sync() instead of
resuming UFS device by ufshcd_runtime_resume() "internally" to let runtime
PM framework manage the whole resume flow.

Link: https://lore.kernel.org/r/20201119062916.12931-1-stanley.chu@mediatek.com
Fixes: 57d104c153d3 ("ufs: add UFS power management support")
Reviewed-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

From de283ef6886e37c60b8a8293232fc160ee690d1e Mon Sep 17 00:00:00 2001
From: Zhang Changzhong <zhangchangzhong@huawei.com>
Date: Thu, 19 Nov 2020 21:30:21 +0800
Subject: [PATCH 1098/2658] bnxt_en: fix error return code in bnxt_init_board()

[ Upstream commit 3383176efc0fb0c0900a191026468a58668b4214 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
Link: https://lore.kernel.org/r/1605792621-6268-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 2da1c2294645..aff1a2307890 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -5198,6 +5198,7 @@ static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev)
 	if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)) != 0 &&
 	    dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)) != 0) {
 		dev_err(&pdev->dev, "System does not support DMA, aborting\n");
+		rc = -EIO;
 		goto init_err_disable;
 	}
 

From d8df63d8794606749095e4e62fb0958d1e76574a Mon Sep 17 00:00:00 2001
From: Dexuan Cui <decui@microsoft.com>
Date: Tue, 17 Nov 2020 16:03:05 -0800
Subject: [PATCH 1099/2658] video: hyperv_fb: Fix the cache type when mapping
 the VRAM

[ Upstream commit 5f1251a48c17b54939d7477305e39679a565382c ]

x86 Hyper-V used to essentially always overwrite the effective cache type
of guest memory accesses to WB. This was problematic in cases where there
is a physical device assigned to the VM, since that often requires that
the VM should have control over cache types. Thus, on newer Hyper-V since
2018, Hyper-V always honors the VM's cache type, but unexpectedly Linux VM
users start to complain that Linux VM's VRAM becomes very slow, and it
turns out that Linux VM should not map the VRAM uncacheable by ioremap().
Fix this slowness issue by using ioremap_cache().

On ARM64, ioremap_cache() is also required as the host also maps the VRAM
cacheable, otherwise VM Connect can't display properly with ioremap() or
ioremap_wc().

With this change, the VRAM on new Hyper-V is as fast as regular RAM, so
it's no longer necessary to use the hacks we added to mitigate the
slowness, i.e. we no longer need to allocate physical memory and use
it to back up the VRAM in Generation-1 VM, and we also no longer need to
allocate physical memory to back up the framebuffer in a Generation-2 VM
and copy the framebuffer to the real VRAM. A further big change will
address these for v5.11.

Fixes: 68a2d20b79b1 ("drivers/video: add Hyper-V Synthetic Video Frame Buffer Driver")
Tested-by: Boqun Feng <boqun.feng@gmail.com>
Signed-off-by: Dexuan Cui <decui@microsoft.com>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Link: https://lore.kernel.org/r/20201118000305.24797-1-decui@microsoft.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/hyperv_fb.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c
index e2451bdb4525..299412abb165 100644
--- a/drivers/video/fbdev/hyperv_fb.c
+++ b/drivers/video/fbdev/hyperv_fb.c
@@ -712,7 +712,12 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info)
 		goto err1;
 	}
 
-	fb_virt = ioremap(par->mem->start, screen_fb_size);
+	/*
+	 * Map the VRAM cacheable for performance. This is also required for
+	 * VM Connect to display properly for ARM64 Linux VM, as the host also
+	 * maps the VRAM cacheable.
+	 */
+	fb_virt = ioremap_cache(par->mem->start, screen_fb_size);
 	if (!fb_virt)
 		goto err2;
 

From b85f5a0e403d57cab1d35603295a2c34e3e30bac Mon Sep 17 00:00:00 2001
From: Michael Chan <michael.chan@broadcom.com>
Date: Fri, 20 Nov 2020 02:44:31 -0500
Subject: [PATCH 1100/2658] bnxt_en: Release PCI regions when DMA mask setup
 fails during probe.

[ Upstream commit c54bc3ced5106663c2f2b44071800621f505b00e ]

Jump to init_err_release to cleanup.  bnxt_unmap_bars() will also be
called but it will do nothing if the BARs are not mapped yet.

Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
Reported-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Link: https://lore.kernel.org/r/1605858271-8209-1-git-send-email-michael.chan@broadcom.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index aff1a2307890..250ecbcca019 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -5199,7 +5199,7 @@ static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev)
 	    dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)) != 0) {
 		dev_err(&pdev->dev, "System does not support DMA, aborting\n");
 		rc = -EIO;
-		goto init_err_disable;
+		goto init_err_release;
 	}
 
 	pci_set_master(pdev);

From ecb83de13b47c2c74eb4dc2598b13d067ec8d699 Mon Sep 17 00:00:00 2001
From: Xiongfeng Wang <wangxiongfeng2@huawei.com>
Date: Fri, 20 Nov 2020 09:57:02 +0800
Subject: [PATCH 1101/2658] IB/mthca: fix return value of error branch in
 mthca_init_cq()

[ Upstream commit 6830ff853a5764c75e56750d59d0bbb6b26f1835 ]

We return 'err' in the error branch, but this variable may be set as zero
by the above code. Fix it by setting 'err' as a negative value before we
goto the error label.

Fixes: 74c2174e7be5 ("IB uverbs: add mthca user CQ support")
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Link: https://lore.kernel.org/r/1605837422-42724-1-git-send-email-wangxiongfeng2@huawei.com
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/mthca/mthca_cq.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
index 40ba83338155..59e1f6ea2ede 100644
--- a/drivers/infiniband/hw/mthca/mthca_cq.c
+++ b/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -811,8 +811,10 @@ int mthca_init_cq(struct mthca_dev *dev, int nent,
 	}
 
 	mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL);
-	if (IS_ERR(mailbox))
+	if (IS_ERR(mailbox)) {
+		err = PTR_ERR(mailbox);
 		goto err_out_arm;
+	}
 
 	cq_context = mailbox->buf;
 
@@ -854,9 +856,9 @@ int mthca_init_cq(struct mthca_dev *dev, int nent,
 	}
 
 	spin_lock_irq(&dev->cq_table.lock);
-	if (mthca_array_set(&dev->cq_table.cq,
-			    cq->cqn & (dev->limits.num_cqs - 1),
-			    cq)) {
+	err = mthca_array_set(&dev->cq_table.cq,
+			      cq->cqn & (dev->limits.num_cqs - 1), cq);
+	if (err) {
 		spin_unlock_irq(&dev->cq_table.lock);
 		goto err_out_free_mr;
 	}

From 0ccd094e62baccec117244663b7c7b6fd3352d71 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Mon, 23 Nov 2020 17:23:51 +0100
Subject: [PATCH 1102/2658] nfc: s3fwrn5: use signed integer for parsing GPIO
 numbers

[ Upstream commit d8f0a86795c69f5b697f7d9e5274c124da93c92d ]

GPIOs - as returned by of_get_named_gpio() and used by the gpiolib - are
signed integers, where negative number indicates error.  The return
value of of_get_named_gpio() should not be assigned to an unsigned int
because in case of !CONFIG_GPIOLIB such number would be a valid GPIO.

Fixes: c04c674fadeb ("nfc: s3fwrn5: Add driver for Samsung S3FWRN5 NFC Chip")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201123162351.209100-1-krzk@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nfc/s3fwrn5/i2c.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/nfc/s3fwrn5/i2c.c b/drivers/nfc/s3fwrn5/i2c.c
index c61d8a308da4..779f7a76ecd3 100644
--- a/drivers/nfc/s3fwrn5/i2c.c
+++ b/drivers/nfc/s3fwrn5/i2c.c
@@ -37,8 +37,8 @@ struct s3fwrn5_i2c_phy {
 	struct i2c_client *i2c_dev;
 	struct nci_dev *ndev;
 
-	unsigned int gpio_en;
-	unsigned int gpio_fw_wake;
+	int gpio_en;
+	int gpio_fw_wake;
 
 	struct mutex mutex;
 

From 3850802c7b362312ae75a5c8ff4aa1cc6bd2cbf3 Mon Sep 17 00:00:00 2001
From: Ard Biesheuvel <ardb@kernel.org>
Date: Wed, 25 Nov 2020 08:45:55 +0100
Subject: [PATCH 1103/2658] efivarfs: revert "fix memory leak in
 efivarfs_create()"

[ Upstream commit ff04f3b6f2e27f8ae28a498416af2a8dd5072b43 ]

The memory leak addressed by commit fe5186cf12e3 is a false positive:
all allocations are recorded in a linked list, and freed when the
filesystem is unmounted. This leads to double frees, and as reported
by David, leads to crashes if SLUB is configured to self destruct when
double frees occur.

So drop the redundant kfree() again, and instead, mark the offending
pointer variable so the allocation is ignored by kmemleak.

Cc: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>
Fixes: fe5186cf12e3 ("efivarfs: fix memory leak in efivarfs_create()")
Reported-by: David Laight <David.Laight@aculab.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/efivarfs/inode.c | 2 ++
 fs/efivarfs/super.c | 1 -
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c
index e2ab6d0497f2..151884b95ee2 100644
--- a/fs/efivarfs/inode.c
+++ b/fs/efivarfs/inode.c
@@ -10,6 +10,7 @@
 #include <linux/efi.h>
 #include <linux/fs.h>
 #include <linux/ctype.h>
+#include <linux/kmemleak.h>
 #include <linux/slab.h>
 
 #include "internal.h"
@@ -138,6 +139,7 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry,
 	var->var.VariableName[i] = '\0';
 
 	inode->i_private = var;
+	kmemleak_ignore(var);
 
 	efivar_entry_add(var, &efivarfs_list);
 	d_instantiate(dentry, inode);
diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
index 0e4f20377d19..fca235020312 100644
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -23,7 +23,6 @@ LIST_HEAD(efivarfs_list);
 static void efivarfs_evict_inode(struct inode *inode)
 {
 	clear_inode(inode);
-	kfree(inode->i_private);
 }
 
 static const struct super_operations efivarfs_ops = {

From def84fdd9c5acf4d0f57610de69d82cd9fb3e640 Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: Fri, 27 Nov 2020 14:48:46 +0900
Subject: [PATCH 1104/2658] perf probe: Fix to die_entrypc() returns error
 correctly

[ Upstream commit ab4200c17ba6fe71d2da64317aae8a8aa684624c ]

Fix die_entrypc() to return error correctly if the DIE has no
DW_AT_ranges attribute. Since dwarf_ranges() will treat the case as an
empty ranges and return 0, we have to check it by ourselves.

Fixes: 91e2f539eeda ("perf probe: Fix to show function entry line as probe-able")
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
Cc: Thomas Richter <tmricht@linux.ibm.com>
Link: http://lore.kernel.org/lkml/160645612634.2824037.5284932731175079426.stgit@devnote2
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/dwarf-aux.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
index fd460aca36e5..40e4c933b372 100644
--- a/tools/perf/util/dwarf-aux.c
+++ b/tools/perf/util/dwarf-aux.c
@@ -305,6 +305,7 @@ bool die_is_func_def(Dwarf_Die *dw_die)
 int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr)
 {
 	Dwarf_Addr base, end;
+	Dwarf_Attribute attr;
 
 	if (!addr)
 		return -EINVAL;
@@ -312,6 +313,13 @@ int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr)
 	if (dwarf_entrypc(dw_die, addr) == 0)
 		return 0;
 
+	/*
+	 *  Since the dwarf_ranges() will return 0 if there is no
+	 * DW_AT_ranges attribute, we should check it first.
+	 */
+	if (!dwarf_attr(dw_die, DW_AT_ranges, &attr))
+		return -ENOENT;
+
 	return dwarf_ranges(dw_die, 0, &base, addr, &end) < 0 ? -ENOENT : 0;
 }
 

From 7fba8d9e6ee19e818549a0979f7c5e464e9df8f0 Mon Sep 17 00:00:00 2001
From: Alan Stern <stern@rowland.harvard.edu>
Date: Thu, 19 Nov 2020 12:02:28 -0500
Subject: [PATCH 1105/2658] USB: core: Change %pK for __user pointers to %px

commit f3bc432aa8a7a2bfe9ebb432502be5c5d979d7fe upstream.

Commit 2f964780c03b ("USB: core: replace %p with %pK") used the %pK
format specifier for a bunch of __user pointers.  But as the 'K' in
the specifier indicates, it is meant for kernel pointers.  The reason
for the %pK specifier is to avoid leaks of kernel addresses, but when
the pointer is to an address in userspace the security implications
are minimal.  In particular, no kernel information is leaked.

This patch changes the __user %pK specifiers (used in a bunch of
debugging output lines) to %px, which will always print the actual
address with no mangling.  (Notably, there is no printk format
specifier particularly intended for __user pointers.)

Fixes: 2f964780c03b ("USB: core: replace %p with %pK")
CC: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
CC: <stable@vger.kernel.org>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20201119170228.GB576844@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/devio.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 7559d96695da..4c1679cc5742 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -369,11 +369,11 @@ static void snoop_urb(struct usb_device *udev,
 
 	if (userurb) {		/* Async */
 		if (when == SUBMIT)
-			dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
+			dev_info(&udev->dev, "userurb %px, ep%d %s-%s, "
 					"length %u\n",
 					userurb, ep, t, d, length);
 		else
-			dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
+			dev_info(&udev->dev, "userurb %px, ep%d %s-%s, "
 					"actual_length %u status %d\n",
 					userurb, ep, t, d, length,
 					timeout_or_status);

From d07ca99157df7785405cf92e35523e30afd21150 Mon Sep 17 00:00:00 2001
From: Anand K Mistry <amistry@google.com>
Date: Tue, 10 Nov 2020 12:33:53 +1100
Subject: [PATCH 1106/2658] x86/speculation: Fix prctl() when
 spectre_v2_user={seccomp,prctl},ibpb

commit 33fc379df76b4991e5ae312f07bcd6820811971e upstream.

When spectre_v2_user={seccomp,prctl},ibpb is specified on the command
line, IBPB is force-enabled and STIPB is conditionally-enabled (or not
available).

However, since

  21998a351512 ("x86/speculation: Avoid force-disabling IBPB based on STIBP and enhanced IBRS.")

the spectre_v2_user_ibpb variable is set to SPECTRE_V2_USER_{PRCTL,SECCOMP}
instead of SPECTRE_V2_USER_STRICT, which is the actual behaviour.
Because the issuing of IBPB relies on the switch_mm_*_ibpb static
branches, the mitigations behave as expected.

Since

  1978b3a53a74 ("x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP")

this discrepency caused the misreporting of IB speculation via prctl().

On CPUs with STIBP always-on and spectre_v2_user=seccomp,ibpb,
prctl(PR_GET_SPECULATION_CTRL) would return PR_SPEC_PRCTL |
PR_SPEC_ENABLE instead of PR_SPEC_DISABLE since both IBPB and STIPB are
always on. It also allowed prctl(PR_SET_SPECULATION_CTRL) to set the IB
speculation mode, even though the flag is ignored.

Similarly, for CPUs without SMT, prctl(PR_GET_SPECULATION_CTRL) should
also return PR_SPEC_DISABLE since IBPB is always on and STIBP is not
available.

 [ bp: Massage commit message. ]

Fixes: 21998a351512 ("x86/speculation: Avoid force-disabling IBPB based on STIBP and enhanced IBRS.")
Fixes: 1978b3a53a74 ("x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP")
Signed-off-by: Anand K Mistry <amistry@google.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20201110123349.1.Id0cbf996d2151f4c143c90f9028651a5b49a5908@changeid
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/cpu/bugs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 2c9a2992863b..ffc3bc8111b8 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -707,11 +707,13 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
 	if (boot_cpu_has(X86_FEATURE_IBPB)) {
 		setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
 
+		spectre_v2_user_ibpb = mode;
 		switch (cmd) {
 		case SPECTRE_V2_USER_CMD_FORCE:
 		case SPECTRE_V2_USER_CMD_PRCTL_IBPB:
 		case SPECTRE_V2_USER_CMD_SECCOMP_IBPB:
 			static_branch_enable(&switch_mm_always_ibpb);
+			spectre_v2_user_ibpb = SPECTRE_V2_USER_STRICT;
 			break;
 		case SPECTRE_V2_USER_CMD_PRCTL:
 		case SPECTRE_V2_USER_CMD_AUTO:
@@ -725,8 +727,6 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
 		pr_info("mitigation: Enabling %s Indirect Branch Prediction Barrier\n",
 			static_key_enabled(&switch_mm_always_ibpb) ?
 			"always-on" : "conditional");
-
-		spectre_v2_user_ibpb = mode;
 	}
 
 	/*

From 0f500aeb1b734372ee421e59789b0639b1946715 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 3 Feb 2020 16:38:28 +0100
Subject: [PATCH 1107/2658] USB: core: add endpoint-blacklist quirk

commit 73f8bda9b5dc1c69df2bc55c0cbb24461a6391a9 upstream

Add a new device quirk that can be used to blacklist endpoints.

Since commit 3e4f8e21c4f2 ("USB: core: fix check for duplicate
endpoints") USB core ignores any duplicate endpoints found during
descriptor parsing.

In order to handle devices where the first interfaces with duplicate
endpoints are the ones that should have their endpoints ignored, we need
to add a blacklist.

Tested-by: edes <edes@gmx.net>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20200203153830.26394-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/config.c  | 11 +++++++++++
 drivers/usb/core/quirks.c  | 32 ++++++++++++++++++++++++++++++++
 drivers/usb/core/usb.h     |  3 +++
 include/linux/usb/quirks.h |  3 +++
 4 files changed, 49 insertions(+)

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 9b584d82e346..4504de6147b4 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -222,6 +222,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
 		struct usb_host_interface *ifp, int num_ep,
 		unsigned char *buffer, int size)
 {
+	struct usb_device *udev = to_usb_device(ddev);
 	unsigned char *buffer0 = buffer;
 	struct usb_endpoint_descriptor *d;
 	struct usb_host_endpoint *endpoint;
@@ -263,6 +264,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
 		goto skip_to_next_endpoint_or_interface_descriptor;
 	}
 
+	/* Ignore blacklisted endpoints */
+	if (udev->quirks & USB_QUIRK_ENDPOINT_BLACKLIST) {
+		if (usb_endpoint_is_blacklisted(udev, ifp, d)) {
+			dev_warn(ddev, "config %d interface %d altsetting %d has a blacklisted endpoint with address 0x%X, skipping\n",
+					cfgno, inum, asnum,
+					d->bEndpointAddress);
+			goto skip_to_next_endpoint_or_interface_descriptor;
+		}
+	}
+
 	endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints];
 	++ifp->desc.bNumEndpoints;
 
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index ca74b67c4450..26c316bbba99 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -344,6 +344,38 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = {
 	{ }  /* terminating entry must be last */
 };
 
+/*
+ * Entries for blacklisted endpoints that should be ignored when parsing
+ * configuration descriptors.
+ *
+ * Matched for devices with USB_QUIRK_ENDPOINT_BLACKLIST.
+ */
+static const struct usb_device_id usb_endpoint_blacklist[] = {
+	{ }
+};
+
+bool usb_endpoint_is_blacklisted(struct usb_device *udev,
+		struct usb_host_interface *intf,
+		struct usb_endpoint_descriptor *epd)
+{
+	const struct usb_device_id *id;
+	unsigned int address;
+
+	for (id = usb_endpoint_blacklist; id->match_flags; ++id) {
+		if (!usb_match_device(udev, id))
+			continue;
+
+		if (!usb_match_one_id_intf(udev, intf, id))
+			continue;
+
+		address = id->driver_info;
+		if (address == epd->bEndpointAddress)
+			return true;
+	}
+
+	return false;
+}
+
 static bool usb_match_any_interface(struct usb_device *udev,
 				    const struct usb_device_id *id)
 {
diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
index dde0e997799e..6447ea618a08 100644
--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
@@ -31,6 +31,9 @@ extern void usb_deauthorize_interface(struct usb_interface *);
 extern void usb_authorize_interface(struct usb_interface *);
 extern void usb_detect_quirks(struct usb_device *udev);
 extern void usb_detect_interface_quirks(struct usb_device *udev);
+extern bool usb_endpoint_is_blacklisted(struct usb_device *udev,
+		struct usb_host_interface *intf,
+		struct usb_endpoint_descriptor *epd);
 extern int usb_remove_device(struct usb_device *udev);
 
 extern int usb_get_device_descriptor(struct usb_device *dev,
diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
index ea4f81c2a6d5..602dff213bae 100644
--- a/include/linux/usb/quirks.h
+++ b/include/linux/usb/quirks.h
@@ -59,4 +59,7 @@
 /* Device needs a pause after every control message. */
 #define USB_QUIRK_DELAY_CTRL_MSG		BIT(13)
 
+/* device has blacklisted endpoints */
+#define USB_QUIRK_ENDPOINT_BLACKLIST		BIT(15)
+
 #endif /* __LINUX_USB_QUIRKS_H */

From ed12acf6579eb367e8fa070e2bd379f72987e2bd Mon Sep 17 00:00:00 2001
From: Alan Stern <stern@rowland.harvard.edu>
Date: Thu, 19 Nov 2020 12:00:40 -0500
Subject: [PATCH 1108/2658] USB: core: Fix regression in Hercules audio card

commit 184eead057cc7e803558269babc1f2cfb9113ad1 upstream

Commit 3e4f8e21c4f2 ("USB: core: fix check for duplicate endpoints")
aimed to make the USB stack more reliable by detecting and skipping
over endpoints that are duplicated between interfaces.  This caused a
regression for a Hercules audio card (reported as Bugzilla #208357),
which contains such non-compliant duplications.  Although the
duplications are harmless, skipping the valid endpoints prevented the
device from working.

This patch fixes the regression by adding ENDPOINT_IGNORE quirks for
the Hercules card, telling the kernel to ignore the invalid duplicate
endpoints and thereby allowing the valid endpoints to be used as
intended.

Fixes: 3e4f8e21c4f2 ("USB: core: fix check for duplicate endpoints")
CC: <stable@vger.kernel.org>
Reported-by: Alexander Chalikiopoulos <bugzilla.kernel.org@mrtoasted.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20201119170040.GA576844@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[sudip: use usb_endpoint_blacklist and USB_QUIRK_ENDPOINT_BLACKLIST]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/quirks.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 26c316bbba99..34d8cece6dd3 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -195,6 +195,10 @@ static const struct usb_device_id usb_quirk_list[] = {
 	/* Guillemot Webcam Hercules Dualpix Exchange*/
 	{ USB_DEVICE(0x06f8, 0x3005), .driver_info = USB_QUIRK_RESET_RESUME },
 
+	/* Guillemot Hercules DJ Console audio card (BZ 208357) */
+	{ USB_DEVICE(0x06f8, 0xb000), .driver_info =
+			USB_QUIRK_ENDPOINT_BLACKLIST },
+
 	/* Midiman M-Audio Keystation 88es */
 	{ USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME },
 
@@ -351,6 +355,8 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = {
  * Matched for devices with USB_QUIRK_ENDPOINT_BLACKLIST.
  */
 static const struct usb_device_id usb_endpoint_blacklist[] = {
+	{ USB_DEVICE_INTERFACE_NUMBER(0x06f8, 0xb000, 5), .driver_info = 0x01 },
+	{ USB_DEVICE_INTERFACE_NUMBER(0x06f8, 0xb000, 5), .driver_info = 0x81 },
 	{ }
 };
 

From a8e2ac5a206ad64b98de012512a03f9026f6ac91 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Mon, 23 Nov 2020 14:28:44 +0000
Subject: [PATCH 1109/2658] btrfs: fix lockdep splat when reading qgroup config
 on mount

commit 3d05cad3c357a2b749912914356072b38435edfa upstream

Lockdep reported the following splat when running test btrfs/190 from
fstests:

  [ 9482.126098] ======================================================
  [ 9482.126184] WARNING: possible circular locking dependency detected
  [ 9482.126281] 5.10.0-rc4-btrfs-next-73 #1 Not tainted
  [ 9482.126365] ------------------------------------------------------
  [ 9482.126456] mount/24187 is trying to acquire lock:
  [ 9482.126534] ffffa0c869a7dac0 (&fs_info->qgroup_rescan_lock){+.+.}-{3:3}, at: qgroup_rescan_init+0x43/0xf0 [btrfs]
  [ 9482.126647]
		 but task is already holding lock:
  [ 9482.126777] ffffa0c892ebd3a0 (btrfs-quota-00){++++}-{3:3}, at: __btrfs_tree_read_lock+0x27/0x120 [btrfs]
  [ 9482.126886]
		 which lock already depends on the new lock.

  [ 9482.127078]
		 the existing dependency chain (in reverse order) is:
  [ 9482.127213]
		 -> #1 (btrfs-quota-00){++++}-{3:3}:
  [ 9482.127366]        lock_acquire+0xd8/0x490
  [ 9482.127436]        down_read_nested+0x45/0x220
  [ 9482.127528]        __btrfs_tree_read_lock+0x27/0x120 [btrfs]
  [ 9482.127613]        btrfs_read_lock_root_node+0x41/0x130 [btrfs]
  [ 9482.127702]        btrfs_search_slot+0x514/0xc30 [btrfs]
  [ 9482.127788]        update_qgroup_status_item+0x72/0x140 [btrfs]
  [ 9482.127877]        btrfs_qgroup_rescan_worker+0xde/0x680 [btrfs]
  [ 9482.127964]        btrfs_work_helper+0xf1/0x600 [btrfs]
  [ 9482.128039]        process_one_work+0x24e/0x5e0
  [ 9482.128110]        worker_thread+0x50/0x3b0
  [ 9482.128181]        kthread+0x153/0x170
  [ 9482.128256]        ret_from_fork+0x22/0x30
  [ 9482.128327]
		 -> #0 (&fs_info->qgroup_rescan_lock){+.+.}-{3:3}:
  [ 9482.128464]        check_prev_add+0x91/0xc60
  [ 9482.128551]        __lock_acquire+0x1740/0x3110
  [ 9482.128623]        lock_acquire+0xd8/0x490
  [ 9482.130029]        __mutex_lock+0xa3/0xb30
  [ 9482.130590]        qgroup_rescan_init+0x43/0xf0 [btrfs]
  [ 9482.131577]        btrfs_read_qgroup_config+0x43a/0x550 [btrfs]
  [ 9482.132175]        open_ctree+0x1228/0x18a0 [btrfs]
  [ 9482.132756]        btrfs_mount_root.cold+0x13/0xed [btrfs]
  [ 9482.133325]        legacy_get_tree+0x30/0x60
  [ 9482.133866]        vfs_get_tree+0x28/0xe0
  [ 9482.134392]        fc_mount+0xe/0x40
  [ 9482.134908]        vfs_kern_mount.part.0+0x71/0x90
  [ 9482.135428]        btrfs_mount+0x13b/0x3e0 [btrfs]
  [ 9482.135942]        legacy_get_tree+0x30/0x60
  [ 9482.136444]        vfs_get_tree+0x28/0xe0
  [ 9482.136949]        path_mount+0x2d7/0xa70
  [ 9482.137438]        do_mount+0x75/0x90
  [ 9482.137923]        __x64_sys_mount+0x8e/0xd0
  [ 9482.138400]        do_syscall_64+0x33/0x80
  [ 9482.138873]        entry_SYSCALL_64_after_hwframe+0x44/0xa9
  [ 9482.139346]
		 other info that might help us debug this:

  [ 9482.140735]  Possible unsafe locking scenario:

  [ 9482.141594]        CPU0                    CPU1
  [ 9482.142011]        ----                    ----
  [ 9482.142411]   lock(btrfs-quota-00);
  [ 9482.142806]                                lock(&fs_info->qgroup_rescan_lock);
  [ 9482.143216]                                lock(btrfs-quota-00);
  [ 9482.143629]   lock(&fs_info->qgroup_rescan_lock);
  [ 9482.144056]
		  *** DEADLOCK ***

  [ 9482.145242] 2 locks held by mount/24187:
  [ 9482.145637]  #0: ffffa0c8411c40e8 (&type->s_umount_key#44/1){+.+.}-{3:3}, at: alloc_super+0xb9/0x400
  [ 9482.146061]  #1: ffffa0c892ebd3a0 (btrfs-quota-00){++++}-{3:3}, at: __btrfs_tree_read_lock+0x27/0x120 [btrfs]
  [ 9482.146509]
		 stack backtrace:
  [ 9482.147350] CPU: 1 PID: 24187 Comm: mount Not tainted 5.10.0-rc4-btrfs-next-73 #1
  [ 9482.147788] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
  [ 9482.148709] Call Trace:
  [ 9482.149169]  dump_stack+0x8d/0xb5
  [ 9482.149628]  check_noncircular+0xff/0x110
  [ 9482.150090]  check_prev_add+0x91/0xc60
  [ 9482.150561]  ? kvm_clock_read+0x14/0x30
  [ 9482.151017]  ? kvm_sched_clock_read+0x5/0x10
  [ 9482.151470]  __lock_acquire+0x1740/0x3110
  [ 9482.151941]  ? __btrfs_tree_read_lock+0x27/0x120 [btrfs]
  [ 9482.152402]  lock_acquire+0xd8/0x490
  [ 9482.152887]  ? qgroup_rescan_init+0x43/0xf0 [btrfs]
  [ 9482.153354]  __mutex_lock+0xa3/0xb30
  [ 9482.153826]  ? qgroup_rescan_init+0x43/0xf0 [btrfs]
  [ 9482.154301]  ? qgroup_rescan_init+0x43/0xf0 [btrfs]
  [ 9482.154768]  ? qgroup_rescan_init+0x43/0xf0 [btrfs]
  [ 9482.155226]  qgroup_rescan_init+0x43/0xf0 [btrfs]
  [ 9482.155690]  btrfs_read_qgroup_config+0x43a/0x550 [btrfs]
  [ 9482.156160]  open_ctree+0x1228/0x18a0 [btrfs]
  [ 9482.156643]  btrfs_mount_root.cold+0x13/0xed [btrfs]
  [ 9482.157108]  ? rcu_read_lock_sched_held+0x5d/0x90
  [ 9482.157567]  ? kfree+0x31f/0x3e0
  [ 9482.158030]  legacy_get_tree+0x30/0x60
  [ 9482.158489]  vfs_get_tree+0x28/0xe0
  [ 9482.158947]  fc_mount+0xe/0x40
  [ 9482.159403]  vfs_kern_mount.part.0+0x71/0x90
  [ 9482.159875]  btrfs_mount+0x13b/0x3e0 [btrfs]
  [ 9482.160335]  ? rcu_read_lock_sched_held+0x5d/0x90
  [ 9482.160805]  ? kfree+0x31f/0x3e0
  [ 9482.161260]  ? legacy_get_tree+0x30/0x60
  [ 9482.161714]  legacy_get_tree+0x30/0x60
  [ 9482.162166]  vfs_get_tree+0x28/0xe0
  [ 9482.162616]  path_mount+0x2d7/0xa70
  [ 9482.163070]  do_mount+0x75/0x90
  [ 9482.163525]  __x64_sys_mount+0x8e/0xd0
  [ 9482.163986]  do_syscall_64+0x33/0x80
  [ 9482.164437]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
  [ 9482.164902] RIP: 0033:0x7f51e907caaa

This happens because at btrfs_read_qgroup_config() we can call
qgroup_rescan_init() while holding a read lock on a quota btree leaf,
acquired by the previous call to btrfs_search_slot_for_read(), and
qgroup_rescan_init() acquires the mutex qgroup_rescan_lock.

A qgroup rescan worker does the opposite: it acquires the mutex
qgroup_rescan_lock, at btrfs_qgroup_rescan_worker(), and then tries to
update the qgroup status item in the quota btree through the call to
update_qgroup_status_item(). This inversion of locking order
between the qgroup_rescan_lock mutex and quota btree locks causes the
splat.

Fix this simply by releasing and freeing the path before calling
qgroup_rescan_init() at btrfs_read_qgroup_config().

CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/qgroup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 734babb6626c..18e667fbd054 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -462,6 +462,7 @@ int btrfs_read_qgroup_config(struct btrfs_fs_info *fs_info)
 			break;
 	}
 out:
+	btrfs_free_path(path);
 	fs_info->qgroup_flags |= flags;
 	if (!(fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_ON)) {
 		fs_info->quota_enabled = 0;
@@ -470,7 +471,6 @@ int btrfs_read_qgroup_config(struct btrfs_fs_info *fs_info)
 		   ret >= 0) {
 		ret = qgroup_rescan_init(fs_info, rescan_progress, 0);
 	}
-	btrfs_free_path(path);
 
 	if (ret < 0) {
 		ulist_free(fs_info->qgroup_ulist);

From e6a6dc2866d10b9f19ccc96c4c7179be5b5b9d6c Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 2 Dec 2020 08:29:29 +0100
Subject: [PATCH 1110/2658] Linux 4.4.247

Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Link: https://lore.kernel.org/r/20201201084637.754785180@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index f92c285c0125..4ed3196c5a7f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 246
+SUBLEVEL = 247
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 80448863a96c26faa0e1ac78e1b3e7505bea6a36 Mon Sep 17 00:00:00 2001
From: Julian Wiedmann <jwi@linux.ibm.com>
Date: Fri, 20 Nov 2020 11:06:57 +0100
Subject: [PATCH 1111/2658] net/af_iucv: set correct sk_protocol for child
 sockets

[ Upstream commit c5dab0941fcdc9664eb0ec0d4d51433216d91336 ]

Child sockets erroneously inherit their parent's sk_type (ie. SOCK_*),
instead of the PF_IUCV protocol that the parent was created with in
iucv_sock_create().

We're currently not using sk->sk_protocol ourselves, so this shouldn't
have much impact (except eg. getting the output in skb_dump() right).

Fixes: eac3731bd04c ("[S390]: Add AF_IUCV socket support")
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Link: https://lore.kernel.org/r/20201120100657.34407-1-jwi@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/iucv/af_iucv.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index f94107e27b5e..78a4b9dd6167 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1724,7 +1724,7 @@ static int iucv_callback_connreq(struct iucv_path *path,
 	}
 
 	/* Create the new socket */
-	nsk = iucv_sock_alloc(NULL, sk->sk_type, GFP_ATOMIC, 0);
+	nsk = iucv_sock_alloc(NULL, sk->sk_protocol, GFP_ATOMIC, 0);
 	if (!nsk) {
 		err = pr_iucv->path_sever(path, user_data);
 		iucv_path_free(path);
@@ -1934,7 +1934,7 @@ static int afiucv_hs_callback_syn(struct sock *sk, struct sk_buff *skb)
 		goto out;
 	}
 
-	nsk = iucv_sock_alloc(NULL, sk->sk_type, GFP_ATOMIC, 0);
+	nsk = iucv_sock_alloc(NULL, sk->sk_protocol, GFP_ATOMIC, 0);
 	bh_lock_sock(sk);
 	if ((sk->sk_state != IUCV_LISTEN) ||
 	    sk_acceptq_is_full(sk) ||

From 12445337a5a371f4be67c05b5833c6ae0117405b Mon Sep 17 00:00:00 2001
From: Anmol Karn <anmol.karan123@gmail.com>
Date: Fri, 20 Nov 2020 00:40:43 +0530
Subject: [PATCH 1112/2658] rose: Fix Null pointer dereference in
 rose_send_frame()

[ Upstream commit 3b3fd068c56e3fbea30090859216a368398e39bf ]

rose_send_frame() dereferences `neigh->dev` when called from
rose_transmit_clear_request(), and the first occurrence of the
`neigh` is in rose_loopback_timer() as `rose_loopback_neigh`,
and it is initialized in rose_add_loopback_neigh() as NULL.
i.e when `rose_loopback_neigh` used in rose_loopback_timer()
its `->dev` was still NULL and rose_loopback_timer() was calling
rose_rx_call_request() without checking for NULL.

- net/rose/rose_link.c
This bug seems to get triggered in this line:

rose_call = (ax25_address *)neigh->dev->dev_addr;

Fix it by adding NULL checking for `rose_loopback_neigh->dev`
in rose_loopback_timer().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Reported-by: syzbot+a1c743815982d9496393@syzkaller.appspotmail.com
Tested-by: syzbot+a1c743815982d9496393@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=9d2a7ca8c7f2e4b682c97578dfa3f236258300b3
Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
Link: https://lore.kernel.org/r/20201119191043.28813-1-anmol.karan123@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/rose/rose_loopback.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/net/rose/rose_loopback.c b/net/rose/rose_loopback.c
index 344456206b70..0f371e50d9c4 100644
--- a/net/rose/rose_loopback.c
+++ b/net/rose/rose_loopback.c
@@ -99,10 +99,19 @@ static void rose_loopback_timer(unsigned long param)
 		}
 
 		if (frametype == ROSE_CALL_REQUEST) {
-			if ((dev = rose_dev_get(dest)) != NULL) {
-				if (rose_rx_call_request(skb, dev, rose_loopback_neigh, lci_o) == 0)
-					kfree_skb(skb);
-			} else {
+			if (!rose_loopback_neigh->dev) {
+				kfree_skb(skb);
+				continue;
+			}
+
+			dev = rose_dev_get(dest);
+			if (!dev) {
+				kfree_skb(skb);
+				continue;
+			}
+
+			if (rose_rx_call_request(skb, dev, rose_loopback_neigh, lci_o) == 0) {
+				dev_put(dev);
 				kfree_skb(skb);
 			}
 		} else {

From 34d34baf1bb2ec5002710cb75310c0974b2e0278 Mon Sep 17 00:00:00 2001
From: Yves-Alexis Perez <corsac@corsac.net>
Date: Thu, 19 Nov 2020 18:24:39 +0100
Subject: [PATCH 1113/2658] usbnet: ipheth: fix connectivity with iOS 14

[ Upstream commit f33d9e2b48a34e1558b67a473a1fc1d6e793f93c ]

Starting with iOS 14 released in September 2020, connectivity using the
personal hotspot USB tethering function of iOS devices is broken.

Communication between the host and the device (for example ICMP traffic
or DNS resolution using the DNS service running in the device itself)
works fine, but communication to endpoints further away doesn't work.

Investigation on the matter shows that no UDP and ICMP traffic from the
tethered host is reaching the Internet at all. For TCP traffic there are
exchanges between tethered host and server but packets are modified in
transit leading to impossible communication.

After some trials Matti Vuorela discovered that reducing the URB buffer
size by two bytes restored the previous behavior. While a better
solution might exist to fix the issue, since the protocol is not
publicly documented and considering the small size of the fix, let's do
that.

Tested-by: Matti Vuorela <matti.vuorela@bitfactor.fi>
Signed-off-by: Yves-Alexis Perez <corsac@corsac.net>
Link: https://lore.kernel.org/linux-usb/CAAn0qaXmysJ9vx3ZEMkViv_B19ju-_ExN8Yn_uSefxpjS6g4Lw@mail.gmail.com/
Link: https://github.com/libimobiledevice/libimobiledevice/issues/1038
Link: https://lore.kernel.org/r/20201119172439.94988-1-corsac@corsac.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/ipheth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index 2b16a5fed9de..0cf5324d493e 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -70,7 +70,7 @@
 #define IPHETH_USBINTF_SUBCLASS 253
 #define IPHETH_USBINTF_PROTO    1
 
-#define IPHETH_BUF_SIZE         1516
+#define IPHETH_BUF_SIZE         1514
 #define IPHETH_IP_ALIGN		2	/* padding at front of URB */
 #define IPHETH_TX_TIMEOUT       (5 * HZ)
 

From 89b83ae78f3f7b744c265770bbc8ea546bc01de5 Mon Sep 17 00:00:00 2001
From: Jamie Iles <jamie@nuviainc.com>
Date: Fri, 20 Nov 2020 14:28:27 +0000
Subject: [PATCH 1114/2658] bonding: wait for sysfs kobject destruction before
 freeing struct slave

[ Upstream commit b9ad3e9f5a7a760ab068e33e1f18d240ba32ce92 ]

syzkaller found that with CONFIG_DEBUG_KOBJECT_RELEASE=y, releasing a
struct slave device could result in the following splat:

  kobject: 'bonding_slave' (00000000cecdd4fe): kobject_release, parent 0000000074ceb2b2 (delayed 1000)
  bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
  ------------[ cut here ]------------
  ODEBUG: free active (active state 0) object type: timer_list hint: workqueue_select_cpu_near kernel/workqueue.c:1549 [inline]
  ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x98 kernel/workqueue.c:1600
  WARNING: CPU: 1 PID: 842 at lib/debugobjects.c:485 debug_print_object+0x180/0x240 lib/debugobjects.c:485
  Kernel panic - not syncing: panic_on_warn set ...
  CPU: 1 PID: 842 Comm: kworker/u4:4 Tainted: G S                5.9.0-rc8+ #96
  Hardware name: linux,dummy-virt (DT)
  Workqueue: netns cleanup_net
  Call trace:
   dump_backtrace+0x0/0x4d8 include/linux/bitmap.h:239
   show_stack+0x34/0x48 arch/arm64/kernel/traps.c:142
   __dump_stack lib/dump_stack.c:77 [inline]
   dump_stack+0x174/0x1f8 lib/dump_stack.c:118
   panic+0x360/0x7a0 kernel/panic.c:231
   __warn+0x244/0x2ec kernel/panic.c:600
   report_bug+0x240/0x398 lib/bug.c:198
   bug_handler+0x50/0xc0 arch/arm64/kernel/traps.c:974
   call_break_hook+0x160/0x1d8 arch/arm64/kernel/debug-monitors.c:322
   brk_handler+0x30/0xc0 arch/arm64/kernel/debug-monitors.c:329
   do_debug_exception+0x184/0x340 arch/arm64/mm/fault.c:864
   el1_dbg+0x48/0xb0 arch/arm64/kernel/entry-common.c:65
   el1_sync_handler+0x170/0x1c8 arch/arm64/kernel/entry-common.c:93
   el1_sync+0x80/0x100 arch/arm64/kernel/entry.S:594
   debug_print_object+0x180/0x240 lib/debugobjects.c:485
   __debug_check_no_obj_freed lib/debugobjects.c:967 [inline]
   debug_check_no_obj_freed+0x200/0x430 lib/debugobjects.c:998
   slab_free_hook mm/slub.c:1536 [inline]
   slab_free_freelist_hook+0x190/0x210 mm/slub.c:1577
   slab_free mm/slub.c:3138 [inline]
   kfree+0x13c/0x460 mm/slub.c:4119
   bond_free_slave+0x8c/0xf8 drivers/net/bonding/bond_main.c:1492
   __bond_release_one+0xe0c/0xec8 drivers/net/bonding/bond_main.c:2190
   bond_slave_netdev_event drivers/net/bonding/bond_main.c:3309 [inline]
   bond_netdev_event+0x8f0/0xa70 drivers/net/bonding/bond_main.c:3420
   notifier_call_chain+0xf0/0x200 kernel/notifier.c:83
   __raw_notifier_call_chain kernel/notifier.c:361 [inline]
   raw_notifier_call_chain+0x44/0x58 kernel/notifier.c:368
   call_netdevice_notifiers_info+0xbc/0x150 net/core/dev.c:2033
   call_netdevice_notifiers_extack net/core/dev.c:2045 [inline]
   call_netdevice_notifiers net/core/dev.c:2059 [inline]
   rollback_registered_many+0x6a4/0xec0 net/core/dev.c:9347
   unregister_netdevice_many.part.0+0x2c/0x1c0 net/core/dev.c:10509
   unregister_netdevice_many net/core/dev.c:10508 [inline]
   default_device_exit_batch+0x294/0x338 net/core/dev.c:10992
   ops_exit_list.isra.0+0xec/0x150 net/core/net_namespace.c:189
   cleanup_net+0x44c/0x888 net/core/net_namespace.c:603
   process_one_work+0x96c/0x18c0 kernel/workqueue.c:2269
   worker_thread+0x3f0/0xc30 kernel/workqueue.c:2415
   kthread+0x390/0x498 kernel/kthread.c:292
   ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:925

This is a potential use-after-free if the sysfs nodes are being accessed
whilst removing the struct slave, so wait for the object destruction to
complete before freeing the struct slave itself.

Fixes: 07699f9a7c8d ("bonding: add sysfs /slave dir for bond slave devices.")
Fixes: a068aab42258 ("bonding: Fix reference count leak in bond_sysfs_slave_add.")
Cc: Qiushi Wu <wu000273@umn.edu>
Cc: Jay Vosburgh <j.vosburgh@gmail.com>
Cc: Veaceslav Falico <vfalico@gmail.com>
Cc: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Jamie Iles <jamie@nuviainc.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20201120142827.879226-1-jamie@nuviainc.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/bonding/bond_main.c        | 61 ++++++++++++++++++--------
 drivers/net/bonding/bond_sysfs_slave.c | 18 +-------
 include/net/bonding.h                  |  8 ++++
 3 files changed, 52 insertions(+), 35 deletions(-)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 5811235a64c8..a33e8a3b5f0a 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1225,7 +1225,39 @@ static void bond_upper_dev_unlink(struct net_device *bond_dev,
 	rtmsg_ifinfo(RTM_NEWLINK, slave_dev, IFF_SLAVE, GFP_KERNEL);
 }
 
-static struct slave *bond_alloc_slave(struct bonding *bond)
+static void slave_kobj_release(struct kobject *kobj)
+{
+	struct slave *slave = to_slave(kobj);
+	struct bonding *bond = bond_get_bond_by_slave(slave);
+
+	cancel_delayed_work_sync(&slave->notify_work);
+	if (BOND_MODE(bond) == BOND_MODE_8023AD)
+		kfree(SLAVE_AD_INFO(slave));
+
+	kfree(slave);
+}
+
+static struct kobj_type slave_ktype = {
+	.release = slave_kobj_release,
+#ifdef CONFIG_SYSFS
+	.sysfs_ops = &slave_sysfs_ops,
+#endif
+};
+
+static int bond_kobj_init(struct slave *slave)
+{
+	int err;
+
+	err = kobject_init_and_add(&slave->kobj, &slave_ktype,
+				   &(slave->dev->dev.kobj), "bonding_slave");
+	if (err)
+		kobject_put(&slave->kobj);
+
+	return err;
+}
+
+static struct slave *bond_alloc_slave(struct bonding *bond,
+				      struct net_device *slave_dev)
 {
 	struct slave *slave = NULL;
 
@@ -1233,11 +1265,17 @@ static struct slave *bond_alloc_slave(struct bonding *bond)
 	if (!slave)
 		return NULL;
 
+	slave->bond = bond;
+	slave->dev = slave_dev;
+
+	if (bond_kobj_init(slave))
+		return NULL;
+
 	if (BOND_MODE(bond) == BOND_MODE_8023AD) {
 		SLAVE_AD_INFO(slave) = kzalloc(sizeof(struct ad_slave_info),
 					       GFP_KERNEL);
 		if (!SLAVE_AD_INFO(slave)) {
-			kfree(slave);
+			kobject_put(&slave->kobj);
 			return NULL;
 		}
 	}
@@ -1246,17 +1284,6 @@ static struct slave *bond_alloc_slave(struct bonding *bond)
 	return slave;
 }
 
-static void bond_free_slave(struct slave *slave)
-{
-	struct bonding *bond = bond_get_bond_by_slave(slave);
-
-	cancel_delayed_work_sync(&slave->notify_work);
-	if (BOND_MODE(bond) == BOND_MODE_8023AD)
-		kfree(SLAVE_AD_INFO(slave));
-
-	kfree(slave);
-}
-
 static void bond_fill_ifbond(struct bonding *bond, struct ifbond *info)
 {
 	info->bond_mode = BOND_MODE(bond);
@@ -1420,14 +1447,12 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 	    bond->dev->addr_assign_type == NET_ADDR_RANDOM)
 		bond_set_dev_addr(bond->dev, slave_dev);
 
-	new_slave = bond_alloc_slave(bond);
+	new_slave = bond_alloc_slave(bond, slave_dev);
 	if (!new_slave) {
 		res = -ENOMEM;
 		goto err_undo_flags;
 	}
 
-	new_slave->bond = bond;
-	new_slave->dev = slave_dev;
 	/* Set the new_slave's queue_id to be zero.  Queue ID mapping
 	 * is set via sysfs or module option if desired.
 	 */
@@ -1741,7 +1766,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 	dev_set_mtu(slave_dev, new_slave->original_mtu);
 
 err_free:
-	bond_free_slave(new_slave);
+	kobject_put(&new_slave->kobj);
 
 err_undo_flags:
 	/* Enslave of first slave has failed and we need to fix master's mac */
@@ -1920,7 +1945,7 @@ static int __bond_release_one(struct net_device *bond_dev,
 	if (!netif_is_bond_master(slave_dev))
 		slave_dev->priv_flags &= ~IFF_BONDING;
 
-	bond_free_slave(slave);
+	kobject_put(&slave->kobj);
 
 	return 0;
 }
diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c
index 3f756fa2f603..68bbac4715c3 100644
--- a/drivers/net/bonding/bond_sysfs_slave.c
+++ b/drivers/net/bonding/bond_sysfs_slave.c
@@ -125,7 +125,6 @@ static const struct slave_attribute *slave_attrs[] = {
 };
 
 #define to_slave_attr(_at) container_of(_at, struct slave_attribute, attr)
-#define to_slave(obj)	container_of(obj, struct slave, kobj)
 
 static ssize_t slave_show(struct kobject *kobj,
 			  struct attribute *attr, char *buf)
@@ -136,28 +135,15 @@ static ssize_t slave_show(struct kobject *kobj,
 	return slave_attr->show(slave, buf);
 }
 
-static const struct sysfs_ops slave_sysfs_ops = {
+const struct sysfs_ops slave_sysfs_ops = {
 	.show = slave_show,
 };
 
-static struct kobj_type slave_ktype = {
-#ifdef CONFIG_SYSFS
-	.sysfs_ops = &slave_sysfs_ops,
-#endif
-};
-
 int bond_sysfs_slave_add(struct slave *slave)
 {
 	const struct slave_attribute **a;
 	int err;
 
-	err = kobject_init_and_add(&slave->kobj, &slave_ktype,
-				   &(slave->dev->dev.kobj), "bonding_slave");
-	if (err) {
-		kobject_put(&slave->kobj);
-		return err;
-	}
-
 	for (a = slave_attrs; *a; ++a) {
 		err = sysfs_create_file(&slave->kobj, &((*a)->attr));
 		if (err) {
@@ -175,6 +161,4 @@ void bond_sysfs_slave_del(struct slave *slave)
 
 	for (a = slave_attrs; *a; ++a)
 		sysfs_remove_file(&slave->kobj, &((*a)->attr));
-
-	kobject_put(&slave->kobj);
 }
diff --git a/include/net/bonding.h b/include/net/bonding.h
index 6fbfc21b27b1..1d85c5179fa8 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -181,6 +181,11 @@ struct slave {
 	struct rtnl_link_stats64 slave_stats;
 };
 
+static inline struct slave *to_slave(struct kobject *kobj)
+{
+	return container_of(kobj, struct slave, kobj);
+}
+
 struct bond_up_slave {
 	unsigned int	count;
 	struct rcu_head rcu;
@@ -667,6 +672,9 @@ extern struct bond_parm_tbl ad_select_tbl[];
 /* exported from bond_netlink.c */
 extern struct rtnl_link_ops bond_link_ops;
 
+/* exported from bond_sysfs_slave.c */
+extern const struct sysfs_ops slave_sysfs_ops;
+
 static inline void bond_tx_drop(struct net_device *dev, struct sk_buff *skb)
 {
 	atomic_long_inc(&dev->tx_dropped);

From c0737389ffa921dc3203189619d66391581e0e2a Mon Sep 17 00:00:00 2001
From: Antoine Tenart <atenart@kernel.org>
Date: Mon, 23 Nov 2020 18:49:02 +0100
Subject: [PATCH 1115/2658] netfilter: bridge: reset skb->pkt_type after
 NF_INET_POST_ROUTING traversal

[ Upstream commit 44f64f23bae2f0fad25503bc7ab86cd08d04cd47 ]

Netfilter changes PACKET_OTHERHOST to PACKET_HOST before invoking the
hooks as, while it's an expected value for a bridge, routing expects
PACKET_HOST. The change is undone later on after hook traversal. This
can be seen with pairs of functions updating skb>pkt_type and then
reverting it to its original value:

For hook NF_INET_PRE_ROUTING:
  setup_pre_routing / br_nf_pre_routing_finish

For hook NF_INET_FORWARD:
  br_nf_forward_ip / br_nf_forward_finish

But the third case where netfilter does this, for hook
NF_INET_POST_ROUTING, the packet type is changed in br_nf_post_routing
but never reverted. A comment says:

  /* We assume any code from br_dev_queue_push_xmit onwards doesn't care
   * about the value of skb->pkt_type. */

But when having a tunnel (say vxlan) attached to a bridge we have the
following call trace:

  br_nf_pre_routing
  br_nf_pre_routing_ipv6
     br_nf_pre_routing_finish
  br_nf_forward_ip
     br_nf_forward_finish
  br_nf_post_routing           <- pkt_type is updated to PACKET_HOST
     br_nf_dev_queue_xmit      <- but not reverted to its original value
  vxlan_xmit
     vxlan_xmit_one
        skb_tunnel_check_pmtu  <- a check on pkt_type is performed

In this specific case, this creates issues such as when an ICMPv6 PTB
should be sent back. When CONFIG_BRIDGE_NETFILTER is enabled, the PTB
isn't sent (as skb_tunnel_check_pmtu checks if pkt_type is PACKET_HOST
and returns early).

If the comment is right and no one cares about the value of
skb->pkt_type after br_dev_queue_push_xmit (which isn't true), resetting
it to its original value should be safe.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Antoine Tenart <atenart@kernel.org>
Reviewed-by: Florian Westphal <fw@strlen.de>
Link: https://lore.kernel.org/r/20201123174902.622102-1-atenart@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bridge/br_netfilter_hooks.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index 6c84c9b8d60b..24eea1303555 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -711,6 +711,11 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff
 	mtu_reserved = nf_bridge_mtu_reduction(skb);
 	mtu = skb->dev->mtu;
 
+	if (nf_bridge->pkt_otherhost) {
+		skb->pkt_type = PACKET_OTHERHOST;
+		nf_bridge->pkt_otherhost = false;
+	}
+
 	if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu)
 		mtu = nf_bridge->frag_max_size;
 
@@ -804,8 +809,6 @@ static unsigned int br_nf_post_routing(void *priv,
 	else
 		return NF_ACCEPT;
 
-	/* We assume any code from br_dev_queue_push_xmit onwards doesn't care
-	 * about the value of skb->pkt_type. */
 	if (skb->pkt_type == PACKET_OTHERHOST) {
 		skb->pkt_type = PACKET_HOST;
 		nf_bridge->pkt_otherhost = true;

From 39cf8e3ae4af70f349e14241c2f1a39b75a569c0 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 1 Dec 2020 18:15:12 +0300
Subject: [PATCH 1116/2658] net/x25: prevent a couple of overflows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 6ee50c8e262a0f0693dad264c3c99e30e6442a56 ]

The .x25_addr[] address comes from the user and is not necessarily
NUL terminated.  This leads to a couple problems.  The first problem is
that the strlen() in x25_bind() can read beyond the end of the buffer.

The second problem is more subtle and could result in memory corruption.
The call tree is:
  x25_connect()
  --> x25_write_internal()
      --> x25_addr_aton()

The .x25_addr[] buffers are copied to the "addresses" buffer from
x25_write_internal() so it will lead to stack corruption.

Verify that the strings are NUL terminated and return -EINVAL if they
are not.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Fixes: a9288525d2ae ("X25: Dont let x25_bind use addresses containing characters")
Reported-by: "kiyin(尹亮)" <kiyin@tencent.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Martin Schiller <ms@dev.tdt.de>
Link: https://lore.kernel.org/r/X8ZeAKm8FnFpN//B@mwanda
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/x25/af_x25.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index dd9a0cff2287..a9fd95d10e84 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -679,7 +679,8 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 	int len, i, rc = 0;
 
 	if (addr_len != sizeof(struct sockaddr_x25) ||
-	    addr->sx25_family != AF_X25) {
+	    addr->sx25_family != AF_X25 ||
+	    strnlen(addr->sx25_addr.x25_addr, X25_ADDR_LEN) == X25_ADDR_LEN) {
 		rc = -EINVAL;
 		goto out;
 	}
@@ -773,7 +774,8 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
 
 	rc = -EINVAL;
 	if (addr_len != sizeof(struct sockaddr_x25) ||
-	    addr->sx25_family != AF_X25)
+	    addr->sx25_family != AF_X25 ||
+	    strnlen(addr->sx25_addr.x25_addr, X25_ADDR_LEN) == X25_ADDR_LEN)
 		goto out;
 
 	rc = -ENETUNREACH;

From f75f4bf2a38eed3e98afeb0121d4b7da8ee3df38 Mon Sep 17 00:00:00 2001
From: Zhang Changzhong <zhangchangzhong@huawei.com>
Date: Wed, 2 Dec 2020 17:56:05 +0800
Subject: [PATCH 1117/2658] cxgb3: fix error return code in t3_sge_alloc_qset()

[ Upstream commit ff9924897f8bfed82e61894b373ab9d2dfea5b10 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: b1fb1f280d09 ("cxgb3 - Fix dma mapping error path")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Acked-by: Raju Rangoju <rajur@chelsio.com>
Link: https://lore.kernel.org/r/1606902965-1646-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/chelsio/cxgb3/sge.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/chelsio/cxgb3/sge.c b/drivers/net/ethernet/chelsio/cxgb3/sge.c
index e4b5b057f417..f012649891da 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/sge.c
@@ -3111,6 +3111,7 @@ int t3_sge_alloc_qset(struct adapter *adapter, unsigned int id, int nports,
 			  GFP_KERNEL | __GFP_COMP);
 	if (!avail) {
 		CH_ALERT(adapter, "free list queue 0 initialization failed\n");
+		ret = -ENOMEM;
 		goto err;
 	}
 	if (avail < q->fl[0].size)

From e89c0156efd3f59c8893cd8cc12bfb6b3b31ab15 Mon Sep 17 00:00:00 2001
From: Zhang Changzhong <zhangchangzhong@huawei.com>
Date: Wed, 2 Dec 2020 17:57:15 +0800
Subject: [PATCH 1118/2658] net: pasemi: fix error return code in
 pasemi_mac_open()

[ Upstream commit aba84871bd4f52c4dfcf3ad5d4501a6c9d2de90e ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 72b05b9940f0 ("pasemi_mac: RX/TX ring management cleanup")
Fixes: 8d636d8bc5ff ("pasemi_mac: jumbo frame support")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Link: https://lore.kernel.org/r/1606903035-1838-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/pasemi/pasemi_mac.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
index 48106953cf64..56326a56068b 100644
--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
+++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
@@ -1129,16 +1129,20 @@ static int pasemi_mac_open(struct net_device *dev)
 
 	mac->tx = pasemi_mac_setup_tx_resources(dev);
 
-	if (!mac->tx)
+	if (!mac->tx) {
+		ret = -ENOMEM;
 		goto out_tx_ring;
+	}
 
 	/* We might already have allocated rings in case mtu was changed
 	 * before interface was brought up.
 	 */
 	if (dev->mtu > 1500 && !mac->num_cs) {
 		pasemi_mac_setup_csrings(mac);
-		if (!mac->num_cs)
+		if (!mac->num_cs) {
+			ret = -ENOMEM;
 			goto out_tx_ring;
+		}
 	}
 
 	/* Zero out rmon counters */

From b7db2fced01d24979ce39394811f5753b850c549 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Mon, 26 Oct 2020 16:36:20 +0100
Subject: [PATCH 1119/2658] dt-bindings: net: correct interrupt flags in
 examples

[ Upstream commit 4d521943f76bd0d1e68ea5e02df7aadd30b2838a ]

GPIO_ACTIVE_x flags are not correct in the context of interrupt flags.
These are simple defines so they could be used in DTS but they will not
have the same meaning:
1. GPIO_ACTIVE_HIGH = 0 = IRQ_TYPE_NONE
2. GPIO_ACTIVE_LOW  = 1 = IRQ_TYPE_EDGE_RISING

Correct the interrupt flags, assuming the author of the code wanted same
logical behavior behind the name "ACTIVE_xxx", this is:
  ACTIVE_LOW  => IRQ_TYPE_LEVEL_LOW
  ACTIVE_HIGH => IRQ_TYPE_LEVEL_HIGH

Fixes: a1a8b4594f8d ("NFC: pn544: i2c: Add DTS Documentation")
Fixes: 6be88670fc59 ("NFC: nxp-nci_i2c: Add I2C support to NXP NCI driver")
Fixes: e3b329221567 ("dt-bindings: can: tcan4x5x: Update binding to use interrupt property")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Rob Herring <robh@kernel.org>
Acked-by: Marc Kleine-Budde <mkl@pengutronix.de> # for tcan4x5x.txt
Link: https://lore.kernel.org/r/20201026153620.89268-1-krzk@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/devicetree/bindings/net/nfc/nxp-nci.txt | 2 +-
 Documentation/devicetree/bindings/net/nfc/pn544.txt   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt b/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt
index 5b6cd9b3f628..0188bbd2e35f 100644
--- a/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt
+++ b/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt
@@ -27,7 +27,7 @@ Example (for ARM-based BeagleBone with NPC100 NFC controller on I2C2):
 		clock-frequency = <100000>;
 
 		interrupt-parent = <&gpio1>;
-		interrupts = <29 GPIO_ACTIVE_HIGH>;
+		interrupts = <29 IRQ_TYPE_LEVEL_HIGH>;
 
 		enable-gpios = <&gpio0 30 GPIO_ACTIVE_HIGH>;
 		firmware-gpios = <&gpio0 31 GPIO_ACTIVE_HIGH>;
diff --git a/Documentation/devicetree/bindings/net/nfc/pn544.txt b/Documentation/devicetree/bindings/net/nfc/pn544.txt
index dab69f36167c..8541e8dafd55 100644
--- a/Documentation/devicetree/bindings/net/nfc/pn544.txt
+++ b/Documentation/devicetree/bindings/net/nfc/pn544.txt
@@ -27,7 +27,7 @@ Example (for ARM-based BeagleBone with PN544 on I2C2):
 		clock-frequency = <400000>;
 
 		interrupt-parent = <&gpio1>;
-		interrupts = <17 GPIO_ACTIVE_HIGH>;
+		interrupts = <17 IRQ_TYPE_LEVEL_HIGH>;
 
 		enable-gpios = <&gpio3 21 GPIO_ACTIVE_HIGH>;
 		firmware-gpios = <&gpio3 19 GPIO_ACTIVE_HIGH>;

From e8bb0da7a779929f61fde6565b06115470581e9d Mon Sep 17 00:00:00 2001
From: Sanjay Govind <sanjay.govind9@gmail.com>
Date: Mon, 30 Nov 2020 23:41:48 -0800
Subject: [PATCH 1120/2658] Input: xpad - support Ardwiino Controllers

commit 2aab1561439032be2e98811dd0ddbeb5b2ae4c61 upstream.

This commit adds support for Ardwiino Controllers

Signed-off-by: Sanjay Govind <sanjay.govind9@gmail.com>
Link: https://lore.kernel.org/r/20201201071922.131666-1-sanjay.govind9@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/joystick/xpad.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 54a6691d7d87..637f1347cd13 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -258,6 +258,7 @@ static const struct xpad_device {
 	{ 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
 	{ 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
 	{ 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 },
+	{ 0x1209, 0x2882, "Ardwiino Controller", 0, XTYPE_XBOX360 },
 	{ 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
 	{ 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 },
 	{ 0x12ab, 0x0303, "Mortal Kombat Klassic FightStick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
@@ -435,6 +436,7 @@ static const struct usb_device_id xpad_table[] = {
 	XPAD_XBOXONE_VENDOR(0x0f0d),		/* Hori Controllers */
 	XPAD_XBOX360_VENDOR(0x1038),		/* SteelSeries Controllers */
 	XPAD_XBOX360_VENDOR(0x11c9),		/* Nacon GC100XF */
+	XPAD_XBOX360_VENDOR(0x1209),		/* Ardwiino Controllers */
 	XPAD_XBOX360_VENDOR(0x12ab),		/* X-Box 360 dance pads */
 	XPAD_XBOX360_VENDOR(0x1430),		/* RedOctane X-Box 360 controllers */
 	XPAD_XBOX360_VENDOR(0x146b),		/* BigBen Interactive Controllers */

From c10115cfa921abdd23d4ed922797b12927a8a605 Mon Sep 17 00:00:00 2001
From: Po-Hsu Lin <po-hsu.lin@canonical.com>
Date: Mon, 30 Nov 2020 22:39:40 -0800
Subject: [PATCH 1121/2658] Input: i8042 - add ByteSpeed touchpad to noloop
 table

commit a48491c65b513e5cdc3e7a886a4db915f848a5f5 upstream.

It looks like the C15B laptop got another vendor: ByteSpeed LLC.

Avoid AUX loopback on this touchpad as well, thus input subsystem will
be able to recognize a Synaptics touchpad in the AUX port.

BugLink: https://bugs.launchpad.net/bugs/1906128
Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
Link: https://lore.kernel.org/r/20201201054723.5939-1-po-hsu.lin@canonical.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/serio/i8042-x86ia64io.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 82ff44637ed7..1f45010a5b81 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -223,6 +223,10 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
 			DMI_MATCH(DMI_SYS_VENDOR, "PEGATRON CORPORATION"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "C15B"),
 		},
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ByteSpeed LLC"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "ByteSpeed Laptop C15B"),
+		},
 	},
 	{ }
 };

From 22d2bc74cf2843f2a8f42a9600fd40e83f099da0 Mon Sep 17 00:00:00 2001
From: Michal Suchanek <msuchanek@suse.de>
Date: Sat, 5 Dec 2020 00:28:07 +0100
Subject: [PATCH 1122/2658] powerpc: Stop exporting __clear_user which is now
 inlined.

Stable commit 452e2a83ea23 ("powerpc: Fix __clear_user() with KUAP
enabled") redefines __clear_user as inline function but does not remove
the export.

Fixes: 452e2a83ea23 ("powerpc: Fix __clear_user() with KUAP enabled")

Signed-off-by: Michal Suchanek <msuchanek@suse.de>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
---
 arch/powerpc/lib/ppc_ksyms.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/powerpc/lib/ppc_ksyms.c b/arch/powerpc/lib/ppc_ksyms.c
index c7f8e9586316..4b81fd96aa3e 100644
--- a/arch/powerpc/lib/ppc_ksyms.c
+++ b/arch/powerpc/lib/ppc_ksyms.c
@@ -24,7 +24,6 @@ EXPORT_SYMBOL(csum_tcpudp_magic);
 #endif
 
 EXPORT_SYMBOL(__copy_tofrom_user);
-EXPORT_SYMBOL(__clear_user);
 EXPORT_SYMBOL(copy_page);
 
 #ifdef CONFIG_PPC64

From 650d24fe22e3b85e06b1ac93bd31d0e199d634fa Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Tue, 1 Sep 2020 08:09:01 -0400
Subject: [PATCH 1123/2658] btrfs: sysfs: init devices outside of the
 chunk_mutex

commit ca10845a56856fff4de3804c85e6424d0f6d0cde upstream

While running btrfs/061, btrfs/073, btrfs/078, or btrfs/178 we hit the
following lockdep splat:

  ======================================================
  WARNING: possible circular locking dependency detected
  5.9.0-rc3+ #4 Not tainted
  ------------------------------------------------------
  kswapd0/100 is trying to acquire lock:
  ffff96ecc22ef4a0 (&delayed_node->mutex){+.+.}-{3:3}, at: __btrfs_release_delayed_node.part.0+0x3f/0x330

  but task is already holding lock:
  ffffffff8dd74700 (fs_reclaim){+.+.}-{0:0}, at: __fs_reclaim_acquire+0x5/0x30

  which lock already depends on the new lock.

  the existing dependency chain (in reverse order) is:

  -> #3 (fs_reclaim){+.+.}-{0:0}:
	 fs_reclaim_acquire+0x65/0x80
	 slab_pre_alloc_hook.constprop.0+0x20/0x200
	 kmem_cache_alloc+0x37/0x270
	 alloc_inode+0x82/0xb0
	 iget_locked+0x10d/0x2c0
	 kernfs_get_inode+0x1b/0x130
	 kernfs_get_tree+0x136/0x240
	 sysfs_get_tree+0x16/0x40
	 vfs_get_tree+0x28/0xc0
	 path_mount+0x434/0xc00
	 __x64_sys_mount+0xe3/0x120
	 do_syscall_64+0x33/0x40
	 entry_SYSCALL_64_after_hwframe+0x44/0xa9

  -> #2 (kernfs_mutex){+.+.}-{3:3}:
	 __mutex_lock+0x7e/0x7e0
	 kernfs_add_one+0x23/0x150
	 kernfs_create_link+0x63/0xa0
	 sysfs_do_create_link_sd+0x5e/0xd0
	 btrfs_sysfs_add_devices_dir+0x81/0x130
	 btrfs_init_new_device+0x67f/0x1250
	 btrfs_ioctl+0x1ef/0x2e20
	 __x64_sys_ioctl+0x83/0xb0
	 do_syscall_64+0x33/0x40
	 entry_SYSCALL_64_after_hwframe+0x44/0xa9

  -> #1 (&fs_info->chunk_mutex){+.+.}-{3:3}:
	 __mutex_lock+0x7e/0x7e0
	 btrfs_chunk_alloc+0x125/0x3a0
	 find_free_extent+0xdf6/0x1210
	 btrfs_reserve_extent+0xb3/0x1b0
	 btrfs_alloc_tree_block+0xb0/0x310
	 alloc_tree_block_no_bg_flush+0x4a/0x60
	 __btrfs_cow_block+0x11a/0x530
	 btrfs_cow_block+0x104/0x220
	 btrfs_search_slot+0x52e/0x9d0
	 btrfs_insert_empty_items+0x64/0xb0
	 btrfs_insert_delayed_items+0x90/0x4f0
	 btrfs_commit_inode_delayed_items+0x93/0x140
	 btrfs_log_inode+0x5de/0x2020
	 btrfs_log_inode_parent+0x429/0xc90
	 btrfs_log_new_name+0x95/0x9b
	 btrfs_rename2+0xbb9/0x1800
	 vfs_rename+0x64f/0x9f0
	 do_renameat2+0x320/0x4e0
	 __x64_sys_rename+0x1f/0x30
	 do_syscall_64+0x33/0x40
	 entry_SYSCALL_64_after_hwframe+0x44/0xa9

  -> #0 (&delayed_node->mutex){+.+.}-{3:3}:
	 __lock_acquire+0x119c/0x1fc0
	 lock_acquire+0xa7/0x3d0
	 __mutex_lock+0x7e/0x7e0
	 __btrfs_release_delayed_node.part.0+0x3f/0x330
	 btrfs_evict_inode+0x24c/0x500
	 evict+0xcf/0x1f0
	 dispose_list+0x48/0x70
	 prune_icache_sb+0x44/0x50
	 super_cache_scan+0x161/0x1e0
	 do_shrink_slab+0x178/0x3c0
	 shrink_slab+0x17c/0x290
	 shrink_node+0x2b2/0x6d0
	 balance_pgdat+0x30a/0x670
	 kswapd+0x213/0x4c0
	 kthread+0x138/0x160
	 ret_from_fork+0x1f/0x30

  other info that might help us debug this:

  Chain exists of:
    &delayed_node->mutex --> kernfs_mutex --> fs_reclaim

   Possible unsafe locking scenario:

	 CPU0                    CPU1
	 ----                    ----
    lock(fs_reclaim);
				 lock(kernfs_mutex);
				 lock(fs_reclaim);
    lock(&delayed_node->mutex);

   *** DEADLOCK ***

  3 locks held by kswapd0/100:
   #0: ffffffff8dd74700 (fs_reclaim){+.+.}-{0:0}, at: __fs_reclaim_acquire+0x5/0x30
   #1: ffffffff8dd65c50 (shrinker_rwsem){++++}-{3:3}, at: shrink_slab+0x115/0x290
   #2: ffff96ed2ade30e0 (&type->s_umount_key#36){++++}-{3:3}, at: super_cache_scan+0x38/0x1e0

  stack backtrace:
  CPU: 0 PID: 100 Comm: kswapd0 Not tainted 5.9.0-rc3+ #4
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014
  Call Trace:
   dump_stack+0x8b/0xb8
   check_noncircular+0x12d/0x150
   __lock_acquire+0x119c/0x1fc0
   lock_acquire+0xa7/0x3d0
   ? __btrfs_release_delayed_node.part.0+0x3f/0x330
   __mutex_lock+0x7e/0x7e0
   ? __btrfs_release_delayed_node.part.0+0x3f/0x330
   ? __btrfs_release_delayed_node.part.0+0x3f/0x330
   ? lock_acquire+0xa7/0x3d0
   ? find_held_lock+0x2b/0x80
   __btrfs_release_delayed_node.part.0+0x3f/0x330
   btrfs_evict_inode+0x24c/0x500
   evict+0xcf/0x1f0
   dispose_list+0x48/0x70
   prune_icache_sb+0x44/0x50
   super_cache_scan+0x161/0x1e0
   do_shrink_slab+0x178/0x3c0
   shrink_slab+0x17c/0x290
   shrink_node+0x2b2/0x6d0
   balance_pgdat+0x30a/0x670
   kswapd+0x213/0x4c0
   ? _raw_spin_unlock_irqrestore+0x41/0x50
   ? add_wait_queue_exclusive+0x70/0x70
   ? balance_pgdat+0x670/0x670
   kthread+0x138/0x160
   ? kthread_create_worker_on_cpu+0x40/0x40
   ret_from_fork+0x1f/0x30

This happens because we are holding the chunk_mutex at the time of
adding in a new device.  However we only need to hold the
device_list_mutex, as we're going to iterate over the fs_devices
devices.  Move the sysfs init stuff outside of the chunk_mutex to get
rid of this lockdep splat.

CC: stable@vger.kernel.org # 4.4.x: f3cd2c58110dad14e: btrfs: sysfs, rename device_link add/remove functions
CC: stable@vger.kernel.org # 4.4.x
Reported-by: David Sterba <dsterba@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/volumes.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index cd1e9411f926..d6383d362e27 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -2357,9 +2357,6 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
 	btrfs_set_super_num_devices(root->fs_info->super_copy,
 				    tmp + 1);
 
-	/* add sysfs device entry */
-	btrfs_sysfs_add_device_link(root->fs_info->fs_devices, device);
-
 	/*
 	 * we've got more storage, clear any full flags on the space
 	 * infos
@@ -2367,6 +2364,10 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
 	btrfs_clear_space_info_full(root->fs_info);
 
 	unlock_chunks(root);
+
+	/* add sysfs device entry */
+	btrfs_sysfs_add_device_link(root->fs_info->fs_devices, device);
+
 	mutex_unlock(&root->fs_info->fs_devices->device_list_mutex);
 
 	if (seeding_dev) {

From 5e71dd3de4ae2c6aa6a5ecd99d5b4c62524c551c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@redhat.com>
Date: Tue, 7 Jul 2020 13:03:25 +0200
Subject: [PATCH 1124/2658] vlan: consolidate VLAN parsing code and limit max
 parsing depth
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 469aceddfa3ed16e17ee30533fae45e90f62efd8 ]

Toshiaki pointed out that we now have two very similar functions to extract
the L3 protocol number in the presence of VLAN tags. And Daniel pointed out
that the unbounded parsing loop makes it possible for maliciously crafted
packets to loop through potentially hundreds of tags.

Fix both of these issues by consolidating the two parsing functions and
limiting the VLAN tag parsing to a max depth of 8 tags. As part of this,
switch over __vlan_get_protocol() to use skb_header_pointer() instead of
pskb_may_pull(), to avoid the possible side effects of the latter and keep
the skb pointer 'const' through all the parsing functions.

v2:
- Use limit of 8 tags instead of 32 (matching XMIT_RECURSION_LIMIT)

Reported-by: Toshiaki Makita <toshiaki.makita1@gmail.com>
Reported-by: Daniel Borkmann <daniel@iogearbox.net>
Fixes: d7bf2ebebc2b ("sched: consistently handle layer3 header accesses in the presence of VLANs")
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/if_vlan.h | 29 ++++++++++++++++++++++-------
 include/net/inet_ecn.h  |  1 +
 2 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index dd676ba758ee..40429b818b45 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -30,6 +30,8 @@
 #define VLAN_ETH_DATA_LEN	1500	/* Max. octets in payload	 */
 #define VLAN_ETH_FRAME_LEN	1518	/* Max. octets in frame sans FCS */
 
+#define VLAN_MAX_DEPTH	8		/* Max. number of nested VLAN tags parsed */
+
 /*
  * 	struct vlan_hdr - vlan header
  * 	@h_vlan_TCI: priority and VLAN ID
@@ -478,10 +480,10 @@ static inline int vlan_get_tag(const struct sk_buff *skb, u16 *vlan_tci)
  * Returns the EtherType of the packet, regardless of whether it is
  * vlan encapsulated (normal or hardware accelerated) or not.
  */
-static inline __be16 __vlan_get_protocol(struct sk_buff *skb, __be16 type,
+static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type,
 					 int *depth)
 {
-	unsigned int vlan_depth = skb->mac_len;
+	unsigned int vlan_depth = skb->mac_len, parse_depth = VLAN_MAX_DEPTH;
 
 	/* if type is 802.1Q/AD then the header should already be
 	 * present at mac_len - VLAN_HLEN (if mac_len > 0), or at
@@ -496,13 +498,12 @@ static inline __be16 __vlan_get_protocol(struct sk_buff *skb, __be16 type,
 			vlan_depth = ETH_HLEN;
 		}
 		do {
-			struct vlan_hdr *vh;
+			struct vlan_hdr vhdr, *vh;
 
-			if (unlikely(!pskb_may_pull(skb,
-						    vlan_depth + VLAN_HLEN)))
+			vh = skb_header_pointer(skb, vlan_depth, sizeof(vhdr), &vhdr);
+			if (unlikely(!vh || !--parse_depth))
 				return 0;
 
-			vh = (struct vlan_hdr *)(skb->data + vlan_depth);
 			type = vh->h_vlan_encapsulated_proto;
 			vlan_depth += VLAN_HLEN;
 		} while (type == htons(ETH_P_8021Q) ||
@@ -522,11 +523,25 @@ static inline __be16 __vlan_get_protocol(struct sk_buff *skb, __be16 type,
  * Returns the EtherType of the packet, regardless of whether it is
  * vlan encapsulated (normal or hardware accelerated) or not.
  */
-static inline __be16 vlan_get_protocol(struct sk_buff *skb)
+static inline __be16 vlan_get_protocol(const struct sk_buff *skb)
 {
 	return __vlan_get_protocol(skb, skb->protocol, NULL);
 }
 
+/* A getter for the SKB protocol field which will handle VLAN tags consistently
+ * whether VLAN acceleration is enabled or not.
+ */
+static inline __be16 skb_protocol(const struct sk_buff *skb, bool skip_vlan)
+{
+	if (!skip_vlan)
+		/* VLAN acceleration strips the VLAN header from the skb and
+		 * moves it to skb->vlan_proto
+		 */
+		return skb_vlan_tag_present(skb) ? skb->vlan_proto : skb->protocol;
+
+	return vlan_get_protocol(skb);
+}
+
 static inline void vlan_set_encap_proto(struct sk_buff *skb,
 					struct vlan_hdr *vhdr)
 {
diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
index dce2d586d9ce..245d999c0eac 100644
--- a/include/net/inet_ecn.h
+++ b/include/net/inet_ecn.h
@@ -3,6 +3,7 @@
 
 #include <linux/ip.h>
 #include <linux/skbuff.h>
+#include <linux/if_vlan.h>
 
 #include <net/inet_sock.h>
 #include <net/dsfield.h>

From 3625aeec9844a5f364199aea19f8bea176cbe9c2 Mon Sep 17 00:00:00 2001
From: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
Date: Mon, 30 Nov 2020 12:34:53 -0800
Subject: [PATCH 1125/2658] usb: gadget: f_fs: Use local copy of descriptors
 for userspace copy

commit a4b98a7512f18534ce33a7e98e49115af59ffa00 upstream.

The function may be unbound causing the ffs_ep and its descriptors
to be freed while userspace is in the middle of an ioctl requesting
the same descriptors. Avoid dangling pointer reference by first
making a local copy of desctiptors before releasing the spinlock.

Fixes: c559a3534109 ("usb: gadget: f_fs: add ioctl returning ep descriptor")
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201130203453.28154-1-jackp@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/function/f_fs.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 33499a1a6232..2dd7623b10fd 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1256,7 +1256,7 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
 		case FUNCTIONFS_ENDPOINT_DESC:
 		{
 			int desc_idx;
-			struct usb_endpoint_descriptor *desc;
+			struct usb_endpoint_descriptor desc1, *desc;
 
 			switch (epfile->ffs->gadget->speed) {
 			case USB_SPEED_SUPER:
@@ -1268,10 +1268,12 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
 			default:
 				desc_idx = 0;
 			}
+
 			desc = epfile->ep->descs[desc_idx];
+			memcpy(&desc1, desc, desc->bLength);
 
 			spin_unlock_irq(&epfile->ffs->eps_lock);
-			ret = copy_to_user((void *)value, desc, sizeof(*desc));
+			ret = copy_to_user((void *)value, &desc1, desc1.bLength);
 			if (ret)
 				ret = -EFAULT;
 			return ret;

From d8f475f74e8ebf19aa9c6538aa38fc845785e7e0 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Fri, 4 Dec 2020 09:55:19 +0100
Subject: [PATCH 1126/2658] USB: serial: kl5kusb105: fix memleak on open

commit 3f203f057edfcf6bd02c6b942799262bfcf31f73 upstream.

Fix memory leak of control-message transfer buffer on successful open().

Fixes: 6774d5f53271 ("USB: serial: kl5kusb105: fix open error path")
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/kl5kusb105.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
index 83c823d32ff9..7b006fd4de0e 100644
--- a/drivers/usb/serial/kl5kusb105.c
+++ b/drivers/usb/serial/kl5kusb105.c
@@ -293,12 +293,12 @@ static int  klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port)
 	priv->cfg.unknown2 = cfg->unknown2;
 	spin_unlock_irqrestore(&priv->lock, flags);
 
+	kfree(cfg);
+
 	/* READ_ON and urb submission */
 	rc = usb_serial_generic_open(tty, port);
-	if (rc) {
-		retval = rc;
-		goto err_free_cfg;
-	}
+	if (rc)
+		return rc;
 
 	rc = usb_control_msg(port->serial->dev,
 			     usb_sndctrlpipe(port->serial->dev, 0),
@@ -341,8 +341,6 @@ static int  klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port)
 			     KLSI_TIMEOUT);
 err_generic_close:
 	usb_serial_generic_close(port);
-err_free_cfg:
-	kfree(cfg);
 
 	return retval;
 }

From 42dfb0238d95689fa13ad69e9f6019009e82174f Mon Sep 17 00:00:00 2001
From: Jan-Niklas Burfeind <kernel@aiyionpri.me>
Date: Thu, 3 Dec 2020 04:03:59 +0100
Subject: [PATCH 1127/2658] USB: serial: ch341: add new Product ID for CH341A

commit 46ee4abb10a07bd8f8ce910ee6b4ae6a947d7f63 upstream.

Add PID for CH340 that's found on a ch341 based Programmer made by keeyees.
The specific device that contains the serial converter is described
here: http://www.keeyees.com/a/Products/ej/36.html

The driver works flawlessly as soon as the new PID (0x5512) is added to
it.

Signed-off-by: Jan-Niklas Burfeind <kernel@aiyionpri.me>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/ch341.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index 3ec59c2b4f65..66b5316a198c 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -73,6 +73,7 @@ static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(0x4348, 0x5523) },
 	{ USB_DEVICE(0x1a86, 0x7522) },
 	{ USB_DEVICE(0x1a86, 0x7523) },
+	{ USB_DEVICE(0x1a86, 0x5512) },
 	{ USB_DEVICE(0x1a86, 0x5523) },
 	{ },
 };

From aa875e25c1164d98eaf46358fc132f48d0c896ab Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Thu, 3 Dec 2020 10:11:59 +0100
Subject: [PATCH 1128/2658] USB: serial: ch341: sort device-id entries

commit bf193bfc12dbc3754fc8a6e0e1e3702f1af2f772 upstream.

Keep the device-id entries sorted to make it easier to add new ones in
the right spot.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/ch341.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index 66b5316a198c..c3d82cabbe65 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -70,11 +70,11 @@
 
 
 static const struct usb_device_id id_table[] = {
-	{ USB_DEVICE(0x4348, 0x5523) },
-	{ USB_DEVICE(0x1a86, 0x7522) },
-	{ USB_DEVICE(0x1a86, 0x7523) },
 	{ USB_DEVICE(0x1a86, 0x5512) },
 	{ USB_DEVICE(0x1a86, 0x5523) },
+	{ USB_DEVICE(0x1a86, 0x7522) },
+	{ USB_DEVICE(0x1a86, 0x7523) },
+	{ USB_DEVICE(0x4348, 0x5523) },
 	{ },
 };
 MODULE_DEVICE_TABLE(usb, id_table);

From ca796f2d16b7fdbde54fd4330af017998d89fb21 Mon Sep 17 00:00:00 2001
From: Vincent Palatin <vpalatin@chromium.org>
Date: Fri, 20 Nov 2020 10:28:28 +0100
Subject: [PATCH 1129/2658] USB: serial: option: add Fibocom NL668 variants

commit 5e4d659b10fde14403adb2e215df4a3168fe8465 upstream.

Update the USB serial option driver support for the Fibocom NL668 Cat.4
LTE modules as there are actually several different variants.
Got clarifications from Fibocom, there are distinct products:
- VID:PID 1508:1001, NL668 for IOT (no MBIM interface)
- VID:PID 2cb7:01a0, NL668-AM and NL652-EU are laptop M.2 cards (with
  MBIM interfaces for Windows/Linux/Chrome OS), respectively for Americas
  and Europe.

usb-devices output for the laptop M.2 cards:
T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  4 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=2cb7 ProdID=01a0 Rev=03.18
S:  Manufacturer=Fibocom Wireless Inc.
S:  Product=Fibocom NL652-EU Modem
S:  SerialNumber=0123456789ABCDEF
C:  #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
I:  If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)

Signed-off-by: Vincent Palatin <vpalatin@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 34ac1265afe4..99eeb8d1fe53 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2031,12 +2031,13 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
 	{ USB_DEVICE(0x0489, 0xe0b5),						/* Foxconn T77W968 ESIM */
 	  .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
-	{ USB_DEVICE(0x1508, 0x1001),						/* Fibocom NL668 */
+	{ USB_DEVICE(0x1508, 0x1001),						/* Fibocom NL668 (IOT version) */
 	  .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
 	{ USB_DEVICE(0x2cb7, 0x0104),						/* Fibocom NL678 series */
 	  .driver_info = RSVD(4) | RSVD(5) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff),			/* Fibocom NL678 series */
 	  .driver_info = RSVD(6) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) },			/* Fibocom NL668-AM/NL652-EU (laptop MBIM) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) },			/* GosunCn GM500 RNDIS */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) },			/* GosunCn GM500 MBIM */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) },			/* GosunCn GM500 ECM/NCM */

From 63a51e8bc0e3105c24d524eeeb259bec64dd1c64 Mon Sep 17 00:00:00 2001
From: Giacinto Cifelli <gciofono@gmail.com>
Date: Wed, 25 Nov 2020 15:53:04 +0100
Subject: [PATCH 1130/2658] USB: serial: option: add support for Thales
 Cinterion EXS82

commit 6d6556c04ebaeaf4e7fa8b791c97e2a7c41b38a3 upstream.

There is a single option port in this modem, and it is used as debug port.

lsusb -v for this device:

Bus 001 Device 002: ID 1e2d:006c
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass          239 Miscellaneous Device
  bDeviceSubClass         2 ?
  bDeviceProtocol         1 Interface Association
  bMaxPacketSize0        64
  idVendor           0x1e2d
  idProduct          0x006c
  bcdDevice            0.00
  iManufacturer           4
  iProduct                3
  iSerial                 5
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength          243
    bNumInterfaces          7
    bConfigurationValue     1
    iConfiguration          2
    bmAttributes         0xe0
      Self Powered
      Remote Wakeup
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         1
      bInterfaceCount         2
      bFunctionClass          2 Communications
      bFunctionSubClass       2 Abstract (modem)
      bFunctionProtocol       1 AT-commands (v.25ter)
      iFunction               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface              0
      CDC Header:
        bcdCDC               1.10
      CDC ACM:
        bmCapabilities       0x02
          line coding and serial state
      CDC Call Management:
        bmCapabilities       0x03
          call management
          use DataInterface
        bDataInterface          2
      CDC Union:
        bMasterInterface        1
        bSlaveInterface         2
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         3
      bInterfaceCount         2
      bFunctionClass          2 Communications
      bFunctionSubClass       2 Abstract (modem)
      bFunctionProtocol       1 AT-commands (v.25ter)
      iFunction               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        3
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface              0
      CDC Header:
        bcdCDC               1.10
      CDC ACM:
        bmCapabilities       0x02
          line coding and serial state
      CDC Call Management:
        bmCapabilities       0x03
          call management
          use DataInterface
        bDataInterface          4
      CDC Union:
        bMasterInterface        3
        bSlaveInterface         4
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x84  EP 4 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        4
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x85  EP 5 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x03  EP 3 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         5
      bInterfaceCount         2
      bFunctionClass          2 Communications
      bFunctionSubClass       2 Abstract (modem)
      bFunctionProtocol       1 AT-commands (v.25ter)
      iFunction               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        5
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      6 Ethernet Networking
      bInterfaceProtocol      0
      iInterface              0
      CDC Header:
        bcdCDC               1.10
      CDC Ethernet:
        iMacAddress                      1 (??)
        bmEthernetStatistics    0x00000000
        wMaxSegmentSize              16384
        wNumberMCFilters            0x0001
        bNumberPowerFilters              0
      CDC Union:
        bMasterInterface        5
        bSlaveInterface         6
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x86  EP 6 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        6
      bAlternateSetting       0
      bNumEndpoints           0
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface              0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        6
      bAlternateSetting       1
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x87  EP 7 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x04  EP 4 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0

Signed-off-by: Giacinto Cifelli <gciofono@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 99eeb8d1fe53..e8643612e9a3 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -419,6 +419,7 @@ static void option_instat_callback(struct urb *urb);
 #define CINTERION_PRODUCT_PH8			0x0053
 #define CINTERION_PRODUCT_AHXX			0x0055
 #define CINTERION_PRODUCT_PLXX			0x0060
+#define CINTERION_PRODUCT_EXS82			0x006c
 #define CINTERION_PRODUCT_PH8_2RMNET		0x0082
 #define CINTERION_PRODUCT_PH8_AUDIO		0x0083
 #define CINTERION_PRODUCT_AHXX_2RMNET		0x0084
@@ -1885,6 +1886,7 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) },
 	{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_CLS8, 0xff),
 	  .driver_info = RSVD(0) | RSVD(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EXS82, 0xff) },
 	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
 	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
 	{ USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) },

From 288439d79344ca39b35b9241a03968da7153ae8e Mon Sep 17 00:00:00 2001
From: Jann Horn <jannh@google.com>
Date: Thu, 3 Dec 2020 02:25:04 +0100
Subject: [PATCH 1131/2658] tty: Fix ->pgrp locking in tiocspgrp()

commit 54ffccbf053b5b6ca4f6e45094b942fab92a25fc upstream.

tiocspgrp() takes two tty_struct pointers: One to the tty that userspace
passed to ioctl() (`tty`) and one to the TTY being changed (`real_tty`).
These pointers are different when ioctl() is called with a master fd.

To properly lock real_tty->pgrp, we must take real_tty->ctrl_lock.

This bug makes it possible for racing ioctl(TIOCSPGRP, ...) calls on
both sides of a PTY pair to corrupt the refcount of `struct pid`,
leading to use-after-free errors.

Fixes: 47f86834bbd4 ("redo locking of tty->pgrp")
CC: stable@kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/tty_io.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index b7effcfee91d..65c06ff7510e 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2618,10 +2618,10 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t
 	if (session_of_pgrp(pgrp) != task_session(current))
 		goto out_unlock;
 	retval = 0;
-	spin_lock_irq(&tty->ctrl_lock);
+	spin_lock_irq(&real_tty->ctrl_lock);
 	put_pid(real_tty->pgrp);
 	real_tty->pgrp = get_pid(pgrp);
-	spin_unlock_irq(&tty->ctrl_lock);
+	spin_unlock_irq(&real_tty->ctrl_lock);
 out_unlock:
 	rcu_read_unlock();
 	return retval;

From 8ca576d4ea86478c0a95fc02ae7739b88e384ae5 Mon Sep 17 00:00:00 2001
From: Kailang Yang <kailang@realtek.com>
Date: Fri, 27 Nov 2020 14:39:23 +0800
Subject: [PATCH 1132/2658] ALSA: hda/realtek - Add new codec supported for
 ALC897

commit e5782a5d5054bf1e03cb7fbd87035037c2a22698 upstream.

Enable new codec supported for ALC897.

Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/3b00520f304842aab8291eb8d9191bd8@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 0d6de70b4e08..df6f8e904eb6 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -378,6 +378,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
 			alc_update_coef_idx(codec, 0x7, 1<<5, 0);
 		break;
 	case 0x10ec0892:
+	case 0x10ec0897:
 		alc_update_coef_idx(codec, 0x7, 1<<5, 0);
 		break;
 	case 0x10ec0899:
@@ -7342,6 +7343,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
 	HDA_CODEC_ENTRY(0x10ec0888, "ALC888", patch_alc882),
 	HDA_CODEC_ENTRY(0x10ec0889, "ALC889", patch_alc882),
 	HDA_CODEC_ENTRY(0x10ec0892, "ALC892", patch_alc662),
+	HDA_CODEC_ENTRY(0x10ec0897, "ALC897", patch_alc662),
 	HDA_CODEC_ENTRY(0x10ec0899, "ALC898", patch_alc882),
 	HDA_CODEC_ENTRY(0x10ec0900, "ALC1150", patch_alc882),
 	{} /* terminator */

From 3838b0df3a0d60fdeb1d023c1f0184061f60d4f3 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Fri, 27 Nov 2020 15:11:03 +0100
Subject: [PATCH 1133/2658] ALSA: hda/generic: Add option to enforce
 preferred_dacs pairs

commit 242d990c158d5b1dabd166516e21992baef5f26a upstream.

The generic parser accepts the preferred_dacs[] pairs as a hint for
assigning a DAC to each pin, but this hint doesn't work always
effectively.  Currently it's merely a secondary choice after the trial
with the path index failed.  This made sometimes it difficult to
assign DACs without mimicking the connection list and/or the badness
table.

This patch adds a new flag, obey_preferred_dacs, that changes the
behavior of the parser.  As its name stands, the parser obeys the
given preferred_dacs[] pairs by skipping the path index matching and
giving a high penalty if no DAC is assigned by the pairs.  This mode
will help for assigning the fixed DACs forcibly from the codec
driver.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201127141104.11041-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/hda_generic.c | 12 ++++++++----
 sound/pci/hda/hda_generic.h |  1 +
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 7cd1047a4edf..dcefb12557f1 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -1344,16 +1344,20 @@ static int try_assign_dacs(struct hda_codec *codec, int num_outs,
 		struct nid_path *path;
 		hda_nid_t pin = pins[i];
 
-		path = snd_hda_get_path_from_idx(codec, path_idx[i]);
-		if (path) {
-			badness += assign_out_path_ctls(codec, path);
-			continue;
+		if (!spec->obey_preferred_dacs) {
+			path = snd_hda_get_path_from_idx(codec, path_idx[i]);
+			if (path) {
+				badness += assign_out_path_ctls(codec, path);
+				continue;
+			}
 		}
 
 		dacs[i] = get_preferred_dac(codec, pin);
 		if (dacs[i]) {
 			if (is_dac_already_used(codec, dacs[i]))
 				badness += bad->shared_primary;
+		} else if (spec->obey_preferred_dacs) {
+			badness += BAD_NO_PRIMARY_DAC;
 		}
 
 		if (!dacs[i])
diff --git a/sound/pci/hda/hda_generic.h b/sound/pci/hda/hda_generic.h
index 25f2397c29f7..37cc6c8505ee 100644
--- a/sound/pci/hda/hda_generic.h
+++ b/sound/pci/hda/hda_generic.h
@@ -229,6 +229,7 @@ struct hda_gen_spec {
 	unsigned int add_jack_modes:1; /* add i/o jack mode enum ctls */
 	unsigned int power_down_unused:1; /* power down unused widgets */
 	unsigned int dac_min_mute:1; /* minimal = mute for DACs */
+	unsigned int obey_preferred_dacs:1; /* obey preferred_dacs assignment */
 
 	/* other internal flags */
 	unsigned int no_analog:1; /* digital I/O only */

From 44cedc2c984d0a3bfb37fd374db0c45a3c13df2b Mon Sep 17 00:00:00 2001
From: Jann Horn <jannh@google.com>
Date: Thu, 3 Dec 2020 02:25:05 +0100
Subject: [PATCH 1134/2658] tty: Fix ->session locking

commit c8bcd9c5be24fb9e6132e97da5a35e55a83e36b9 upstream.

Currently, locking of ->session is very inconsistent; most places
protect it using the legacy tty mutex, but disassociate_ctty(),
__do_SAK(), tiocspgrp() and tiocgsid() don't.
Two of the writers hold the ctrl_lock (because they already need it for
->pgrp), but __proc_set_tty() doesn't do that yet.

On a PREEMPT=y system, an unprivileged user can theoretically abuse
this broken locking to read 4 bytes of freed memory via TIOCGSID if
tiocgsid() is preempted long enough at the right point. (Other things
might also go wrong, especially if root-only ioctls are involved; I'm
not sure about that.)

Change the locking on ->session such that:

 - tty_lock() is held by all writers: By making disassociate_ctty()
   hold it. This should be fine because the same lock can already be
   taken through the call to tty_vhangup_session().
   The tricky part is that we need to shorten the area covered by
   siglock to be able to take tty_lock() without ugly retry logic; as
   far as I can tell, this should be fine, since nothing in the
   signal_struct is touched in the `if (tty)` branch.
 - ctrl_lock is held by all writers: By changing __proc_set_tty() to
   hold the lock a little longer.
 - All readers that aren't holding tty_lock() hold ctrl_lock: By
   adding locking to tiocgsid() and __do_SAK(), and expanding the area
   covered by ctrl_lock in tiocspgrp().

Cc: stable@kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/tty_io.c | 51 ++++++++++++++++++++++++++++++++------------
 include/linux/tty.h  |  4 ++++
 2 files changed, 41 insertions(+), 14 deletions(-)

diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 65c06ff7510e..dff507cd0250 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -537,8 +537,8 @@ static void __proc_set_tty(struct tty_struct *tty)
 	put_pid(tty->session);
 	put_pid(tty->pgrp);
 	tty->pgrp = get_pid(task_pgrp(current));
-	spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 	tty->session = get_pid(task_session(current));
+	spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 	if (current->signal->tty) {
 		tty_debug(tty, "current tty %s not NULL!!\n",
 			  current->signal->tty->name);
@@ -929,21 +929,24 @@ void disassociate_ctty(int on_exit)
 	spin_lock_irq(&current->sighand->siglock);
 	put_pid(current->signal->tty_old_pgrp);
 	current->signal->tty_old_pgrp = NULL;
-
 	tty = tty_kref_get(current->signal->tty);
+	spin_unlock_irq(&current->sighand->siglock);
+
 	if (tty) {
 		unsigned long flags;
+
+		tty_lock(tty);
 		spin_lock_irqsave(&tty->ctrl_lock, flags);
 		put_pid(tty->session);
 		put_pid(tty->pgrp);
 		tty->session = NULL;
 		tty->pgrp = NULL;
 		spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+		tty_unlock(tty);
 		tty_kref_put(tty);
 	} else
 		tty_debug_hangup(tty, "no current tty\n");
 
-	spin_unlock_irq(&current->sighand->siglock);
 	/* Now clear signal->tty under the lock */
 	read_lock(&tasklist_lock);
 	session_clear_tty(task_session(current));
@@ -2601,14 +2604,19 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t
 		return -ENOTTY;
 	if (retval)
 		return retval;
-	if (!current->signal->tty ||
-	    (current->signal->tty != real_tty) ||
-	    (real_tty->session != task_session(current)))
-		return -ENOTTY;
+
 	if (get_user(pgrp_nr, p))
 		return -EFAULT;
 	if (pgrp_nr < 0)
 		return -EINVAL;
+
+	spin_lock_irq(&real_tty->ctrl_lock);
+	if (!current->signal->tty ||
+	    (current->signal->tty != real_tty) ||
+	    (real_tty->session != task_session(current))) {
+		retval = -ENOTTY;
+		goto out_unlock_ctrl;
+	}
 	rcu_read_lock();
 	pgrp = find_vpid(pgrp_nr);
 	retval = -ESRCH;
@@ -2618,12 +2626,12 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t
 	if (session_of_pgrp(pgrp) != task_session(current))
 		goto out_unlock;
 	retval = 0;
-	spin_lock_irq(&real_tty->ctrl_lock);
 	put_pid(real_tty->pgrp);
 	real_tty->pgrp = get_pid(pgrp);
-	spin_unlock_irq(&real_tty->ctrl_lock);
 out_unlock:
 	rcu_read_unlock();
+out_unlock_ctrl:
+	spin_unlock_irq(&real_tty->ctrl_lock);
 	return retval;
 }
 
@@ -2635,21 +2643,31 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t
  *
  *	Obtain the session id of the tty. If there is no session
  *	return an error.
- *
- *	Locking: none. Reference to current->signal->tty is safe.
  */
 
 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
 {
+	unsigned long flags;
+	pid_t sid;
+
 	/*
 	 * (tty == real_tty) is a cheap way of
 	 * testing if the tty is NOT a master pty.
 	*/
 	if (tty == real_tty && current->signal->tty != real_tty)
 		return -ENOTTY;
+
+	spin_lock_irqsave(&real_tty->ctrl_lock, flags);
 	if (!real_tty->session)
-		return -ENOTTY;
-	return put_user(pid_vnr(real_tty->session), p);
+		goto err;
+	sid = pid_vnr(real_tty->session);
+	spin_unlock_irqrestore(&real_tty->ctrl_lock, flags);
+
+	return put_user(sid, p);
+
+err:
+	spin_unlock_irqrestore(&real_tty->ctrl_lock, flags);
+	return -ENOTTY;
 }
 
 /**
@@ -3061,10 +3079,14 @@ void __do_SAK(struct tty_struct *tty)
 	struct task_struct *g, *p;
 	struct pid *session;
 	int		i;
+	unsigned long flags;
 
 	if (!tty)
 		return;
-	session = tty->session;
+
+	spin_lock_irqsave(&tty->ctrl_lock, flags);
+	session = get_pid(tty->session);
+	spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 
 	tty_ldisc_flush(tty);
 
@@ -3100,6 +3122,7 @@ void __do_SAK(struct tty_struct *tty)
 		task_unlock(p);
 	} while_each_thread(g, p);
 	read_unlock(&tasklist_lock);
+	put_pid(session);
 #endif
 }
 
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 006b82142f7b..68392a4ca28a 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -282,6 +282,10 @@ struct tty_struct {
 	struct termiox *termiox;	/* May be NULL for unsupported */
 	char name[64];
 	struct pid *pgrp;		/* Protected by ctrl lock */
+	/*
+	 * Writes protected by both ctrl lock and legacy mutex, readers must use
+	 * at least one of them.
+	 */
 	struct pid *session;
 	unsigned long flags;
 	int count;

From 4a3f5e082933f6801b2f1c30be7def3f4bf01740 Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <pc@cjr.nz>
Date: Sat, 28 Nov 2020 16:54:02 -0300
Subject: [PATCH 1135/2658] cifs: fix potential use-after-free in
 cifs_echo_request()

commit 212253367dc7b49ed3fc194ce71b0992eacaecf2 upstream.

This patch fixes a potential use-after-free bug in
cifs_echo_request().

For instance,

  thread 1
  --------
  cifs_demultiplex_thread()
    clean_demultiplex_info()
      kfree(server)

  thread 2 (workqueue)
  --------
  apic_timer_interrupt()
    smp_apic_timer_interrupt()
      irq_exit()
        __do_softirq()
          run_timer_softirq()
            call_timer_fn()
	      cifs_echo_request() <- use-after-free in server ptr

Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
CC: Stable <stable@vger.kernel.org>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/connect.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index f4ef8d6ea8ed..71c9ed70aa68 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -783,6 +783,8 @@ static void clean_demultiplex_info(struct TCP_Server_Info *server)
 	list_del_init(&server->tcp_ses_list);
 	spin_unlock(&cifs_tcp_ses_lock);
 
+	cancel_delayed_work_sync(&server->echo);
+
 	spin_lock(&GlobalMid_Lock);
 	server->tcpStatus = CifsExiting;
 	spin_unlock(&GlobalMid_Lock);

From ee088a547ec9e12a239ab70cd3a6cdcaffcd7a3d Mon Sep 17 00:00:00 2001
From: Christian Eggers <ceggers@arri.de>
Date: Fri, 9 Oct 2020 13:03:18 +0200
Subject: [PATCH 1136/2658] i2c: imx: Fix reset of I2SR_IAL flag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 384a9565f70a876c2e78e58c5ca0bbf0547e4f6d upstream.

According to the "VFxxx Controller Reference Manual" (and the comment
block starting at line 97), Vybrid requires writing a one for clearing
an interrupt flag. Syncing the method for clearing I2SR_IIF in
i2c_imx_isr().

Signed-off-by: Christian Eggers <ceggers@arri.de>
Fixes: 4b775022f6fd ("i2c: imx: add struct to hold more configurable quirks")
Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/i2c/busses/i2c-imx.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index 37303a7a2e73..c7315623ccbb 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -420,6 +420,19 @@ static void i2c_imx_dma_free(struct imx_i2c_struct *i2c_imx)
 /** Functions for IMX I2C adapter driver ***************************************
 *******************************************************************************/
 
+static void i2c_imx_clear_irq(struct imx_i2c_struct *i2c_imx, unsigned int bits)
+{
+	unsigned int temp;
+
+	/*
+	 * i2sr_clr_opcode is the value to clear all interrupts. Here we want to
+	 * clear only <bits>, so we write ~i2sr_clr_opcode with just <bits>
+	 * toggled. This is required because i.MX needs W0C and Vybrid uses W1C.
+	 */
+	temp = ~i2c_imx->hwdata->i2sr_clr_opcode ^ bits;
+	imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2SR);
+}
+
 static int i2c_imx_bus_busy(struct imx_i2c_struct *i2c_imx, int for_busy)
 {
 	unsigned long orig_jiffies = jiffies;
@@ -432,8 +445,7 @@ static int i2c_imx_bus_busy(struct imx_i2c_struct *i2c_imx, int for_busy)
 
 		/* check for arbitration lost */
 		if (temp & I2SR_IAL) {
-			temp &= ~I2SR_IAL;
-			imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2SR);
+			i2c_imx_clear_irq(i2c_imx, I2SR_IAL);
 			return -EAGAIN;
 		}
 
@@ -595,9 +607,7 @@ static irqreturn_t i2c_imx_isr(int irq, void *dev_id)
 	if (temp & I2SR_IIF) {
 		/* save status register */
 		i2c_imx->i2csr = temp;
-		temp &= ~I2SR_IIF;
-		temp |= (i2c_imx->hwdata->i2sr_clr_opcode & I2SR_IIF);
-		imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2SR);
+		i2c_imx_clear_irq(i2c_imx, I2SR_IIF);
 		wake_up(&i2c_imx->queue);
 		return IRQ_HANDLED;
 	}

From a8f88d6df5009426195899c28cce147771c7ac47 Mon Sep 17 00:00:00 2001
From: Christian Eggers <ceggers@arri.de>
Date: Fri, 9 Oct 2020 13:03:19 +0200
Subject: [PATCH 1137/2658] i2c: imx: Check for I2SR_IAL after every byte

commit 1de67a3dee7a279ebe4d892b359fe3696938ec15 upstream.

Arbitration Lost (IAL) can happen after every single byte transfer. If
arbitration is lost, the I2C hardware will autonomously switch from
master mode to slave. If a transfer is not aborted in this state,
consecutive transfers will not be executed by the hardware and will
timeout.

Signed-off-by: Christian Eggers <ceggers@arri.de>
Tested (not extensively) on Vybrid VF500 (Toradex VF50):
Tested-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/i2c/busses/i2c-imx.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index c7315623ccbb..117f367636b8 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -472,6 +472,16 @@ static int i2c_imx_trx_complete(struct imx_i2c_struct *i2c_imx)
 		dev_dbg(&i2c_imx->adapter.dev, "<%s> Timeout\n", __func__);
 		return -ETIMEDOUT;
 	}
+
+	/* check for arbitration lost */
+	if (i2c_imx->i2csr & I2SR_IAL) {
+		dev_dbg(&i2c_imx->adapter.dev, "<%s> Arbitration lost\n", __func__);
+		i2c_imx_clear_irq(i2c_imx, I2SR_IAL);
+
+		i2c_imx->i2csr = 0;
+		return -EAGAIN;
+	}
+
 	dev_dbg(&i2c_imx->adapter.dev, "<%s> TRX complete\n", __func__);
 	i2c_imx->i2csr = 0;
 	return 0;

From e3a63c4c46c25f574fdf2d8839c21ffa18953c08 Mon Sep 17 00:00:00 2001
From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Date: Mon, 7 Dec 2020 18:10:34 -0700
Subject: [PATCH 1138/2658] arm64: assembler: make adr_l work in modules under
 KASLR

commit 41c066f2c4d436c535616fe182331766c57838f0 upstream

When CONFIG_RANDOMIZE_MODULE_REGION_FULL=y, the offset between loaded
modules and the core kernel may exceed 4 GB, putting symbols exported
by the core kernel out of the reach of the ordinary adrp/add instruction
pairs used to generate relative symbol references. So make the adr_l
macro emit a movz/movk sequence instead when executing in module context.

While at it, remove the pointless special case for the stack pointer.

Acked-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ dannf: backported to v4.4 by replacing the 3-arg adr_l macro in head.S
  with it's output, as this commit drops the 3-arg variant ]
Fixes: c042dd600f4e ("crypto: arm64/sha - avoid non-standard inline asm tricks")
Signed-off-by: dann frazier <dann.frazier@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/assembler.h | 36 ++++++++++++++++++++++--------
 arch/arm64/kernel/head.S           | 29 +++++++++---------------
 2 files changed, 38 insertions(+), 27 deletions(-)

diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
index c16959fcc4df..7db7edf481d7 100644
--- a/arch/arm64/include/asm/assembler.h
+++ b/arch/arm64/include/asm/assembler.h
@@ -189,22 +189,25 @@ lr	.req	x30		// link register
 
 /*
  * Pseudo-ops for PC-relative adr/ldr/str <reg>, <symbol> where
- * <symbol> is within the range +/- 4 GB of the PC.
+ * <symbol> is within the range +/- 4 GB of the PC when running
+ * in core kernel context. In module context, a movz/movk sequence
+ * is used, since modules may be loaded far away from the kernel
+ * when KASLR is in effect.
  */
 	/*
 	 * @dst: destination register (64 bit wide)
 	 * @sym: name of the symbol
-	 * @tmp: optional scratch register to be used if <dst> == sp, which
-	 *       is not allowed in an adrp instruction
 	 */
-	.macro	adr_l, dst, sym, tmp=
-	.ifb	\tmp
+	.macro	adr_l, dst, sym
+#ifndef MODULE
 	adrp	\dst, \sym
 	add	\dst, \dst, :lo12:\sym
-	.else
-	adrp	\tmp, \sym
-	add	\dst, \tmp, :lo12:\sym
-	.endif
+#else
+	movz	\dst, #:abs_g3:\sym
+	movk	\dst, #:abs_g2_nc:\sym
+	movk	\dst, #:abs_g1_nc:\sym
+	movk	\dst, #:abs_g0_nc:\sym
+#endif
 	.endm
 
 	/*
@@ -215,6 +218,7 @@ lr	.req	x30		// link register
 	 *       the address
 	 */
 	.macro	ldr_l, dst, sym, tmp=
+#ifndef MODULE
 	.ifb	\tmp
 	adrp	\dst, \sym
 	ldr	\dst, [\dst, :lo12:\sym]
@@ -222,6 +226,15 @@ lr	.req	x30		// link register
 	adrp	\tmp, \sym
 	ldr	\dst, [\tmp, :lo12:\sym]
 	.endif
+#else
+	.ifb	\tmp
+	adr_l	\dst, \sym
+	ldr	\dst, [\dst]
+	.else
+	adr_l	\tmp, \sym
+	ldr	\dst, [\tmp]
+	.endif
+#endif
 	.endm
 
 	/*
@@ -231,8 +244,13 @@ lr	.req	x30		// link register
 	 *       while <src> needs to be preserved.
 	 */
 	.macro	str_l, src, sym, tmp
+#ifndef MODULE
 	adrp	\tmp, \sym
 	str	\src, [\tmp, :lo12:\sym]
+#else
+	adr_l	\tmp, \sym
+	str	\src, [\tmp]
+#endif
 	.endm
 
 	/*
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 3645b4b57908..7ccfbd987236 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -416,24 +416,17 @@ ENDPROC(__create_page_tables)
  * The following fragment of code is executed with the MMU enabled.
  */
 	.set	initial_sp, init_thread_union + THREAD_START_SP
-__primary_switched:
-	mov	x28, lr				// preserve LR
-	adr_l	x8, vectors			// load VBAR_EL1 with virtual
-	msr	vbar_el1, x8			// vector table address
-	isb
-
-	// Clear BSS
-	adr_l	x0, __bss_start
-	mov	x1, xzr
-	adr_l	x2, __bss_stop
-	sub	x2, x2, x0
-	bl	__pi_memset
-	dsb	ishst				// Make zero page visible to PTW
-
-	adr_l	sp, initial_sp, x4
-	mov	x4, sp
-	and	x4, x4, #~(THREAD_SIZE - 1)
-	msr	sp_el0, x4			// Save thread_info
+__mmap_switched:
+	adr_l	x6, __bss_start
+	adr_l	x7, __bss_stop
+
+1:	cmp	x6, x7
+	b.hs	2f
+	str	xzr, [x6], #8			// Clear BSS
+	b	1b
+2:
+	adrp	x4, initial_sp
+	add	sp, x4, :lo12:initial_sp
 	str_l	x21, __fdt_pointer, x5		// Save FDT pointer
 
 	ldr_l	x4, kimage_vaddr		// Save the offset between

From b686287bf6a2506561f8234c6339be27a57204ee Mon Sep 17 00:00:00 2001
From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Date: Mon, 7 Dec 2020 03:19:20 -0600
Subject: [PATCH 1139/2658] iommu/amd: Set DTE[IntTabLen] to represent 512
 IRTEs

commit 4165bf015ba9454f45beaad621d16c516d5c5afe upstream.

According to the AMD IOMMU spec, the commit 73db2fc595f3
("iommu/amd: Increase interrupt remapping table limit to 512 entries")
also requires the interrupt table length (IntTabLen) to be set to 9
(power of 2) in the device table mapping entry (DTE).

Fixes: 73db2fc595f3 ("iommu/amd: Increase interrupt remapping table limit to 512 entries")
Reported-by: Jerry Snitselaar <jsnitsel@redhat.com>
Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Reviewed-by: Jerry Snitselaar <jsnitsel@redhat.com>
Link: https://lore.kernel.org/r/20201207091920.3052-1-suravee.suthikulpanit@amd.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iommu/amd_iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 66a406e87e11..d916ac079662 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -3625,7 +3625,7 @@ static struct irq_chip amd_ir_chip;
 
 #define DTE_IRQ_PHYS_ADDR_MASK	(((1ULL << 45)-1) << 6)
 #define DTE_IRQ_REMAP_INTCTL    (2ULL << 60)
-#define DTE_IRQ_TABLE_LEN       (8ULL << 1)
+#define DTE_IRQ_TABLE_LEN       (9ULL << 1)
 #define DTE_IRQ_REMAP_ENABLE    1ULL
 
 static void set_dte_irq_entry(u16 devid, struct irq_remap_table *table)

From ab0b770d15f0245b92ae686a6e212821751dbaa5 Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@wunner.de>
Date: Sun, 6 Dec 2020 13:53:00 +0100
Subject: [PATCH 1140/2658] spi: Introduce device-managed SPI controller
 allocation

[ Upstream commit 5e844cc37a5cbaa460e68f9a989d321d63088a89 ]

SPI driver probing currently comprises two steps, whereas removal
comprises only one step:

    spi_alloc_master()
    spi_register_master()

    spi_unregister_master()

That's because spi_unregister_master() calls device_unregister()
instead of device_del(), thereby releasing the reference on the
spi_master which was obtained by spi_alloc_master().

An SPI driver's private data is contained in the same memory allocation
as the spi_master struct.  Thus, once spi_unregister_master() has been
called, the private data is inaccessible.  But some drivers need to
access it after spi_unregister_master() to perform further teardown
steps.

Introduce devm_spi_alloc_master(), which releases a reference on the
spi_master struct only after the driver has unbound, thereby keeping the
memory allocation accessible.  Change spi_unregister_master() to not
release a reference if the spi_master was allocated by the new devm
function.

The present commit is small enough to be backportable to stable.
It allows fixing drivers which use the private data in their ->remove()
hook after it's been freed.  It also allows fixing drivers which neglect
to release a reference on the spi_master in the probe error path.

Long-term, most SPI drivers shall be moved over to the devm function
introduced herein.  The few that can't shall be changed in a treewide
commit to explicitly release the last reference on the master.
That commit shall amend spi_unregister_master() to no longer release
a reference, thereby completing the migration.

As a result, the behaviour will be less surprising and more consistent
with subsystems such as IIO, which also includes the private data in the
allocation of the generic iio_dev struct, but calls device_del() in
iio_device_unregister().

Signed-off-by: Lukas Wunner <lukas@wunner.de>
Link: https://lore.kernel.org/r/272bae2ef08abd21388c98e23729886663d19192.1605121038.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi.c       | 54 ++++++++++++++++++++++++++++++++++++++++-
 include/linux/spi/spi.h |  2 ++
 2 files changed, 55 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 6ed2959ce4dc..ed87f71a428d 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1720,6 +1720,46 @@ struct spi_master *spi_alloc_master(struct device *dev, unsigned size)
 }
 EXPORT_SYMBOL_GPL(spi_alloc_master);
 
+static void devm_spi_release_master(struct device *dev, void *master)
+{
+	spi_master_put(*(struct spi_master **)master);
+}
+
+/**
+ * devm_spi_alloc_master - resource-managed spi_alloc_master()
+ * @dev: physical device of SPI master
+ * @size: how much zeroed driver-private data to allocate
+ * Context: can sleep
+ *
+ * Allocate an SPI master and automatically release a reference on it
+ * when @dev is unbound from its driver.  Drivers are thus relieved from
+ * having to call spi_master_put().
+ *
+ * The arguments to this function are identical to spi_alloc_master().
+ *
+ * Return: the SPI master structure on success, else NULL.
+ */
+struct spi_master *devm_spi_alloc_master(struct device *dev, unsigned int size)
+{
+	struct spi_master **ptr, *master;
+
+	ptr = devres_alloc(devm_spi_release_master, sizeof(*ptr),
+			   GFP_KERNEL);
+	if (!ptr)
+		return NULL;
+
+	master = spi_alloc_master(dev, size);
+	if (master) {
+		*ptr = master;
+		devres_add(dev, ptr);
+	} else {
+		devres_free(ptr);
+	}
+
+	return master;
+}
+EXPORT_SYMBOL_GPL(devm_spi_alloc_master);
+
 #ifdef CONFIG_OF
 static int of_spi_register_master(struct spi_master *master)
 {
@@ -1899,6 +1939,11 @@ int devm_spi_register_master(struct device *dev, struct spi_master *master)
 }
 EXPORT_SYMBOL_GPL(devm_spi_register_master);
 
+static int devm_spi_match_master(struct device *dev, void *res, void *master)
+{
+	return *(struct spi_master **)res == master;
+}
+
 static int __unregister(struct device *dev, void *null)
 {
 	spi_unregister_device(to_spi_device(dev));
@@ -1928,7 +1973,14 @@ void spi_unregister_master(struct spi_master *master)
 	list_del(&master->list);
 	mutex_unlock(&board_lock);
 
-	device_unregister(&master->dev);
+	device_del(&master->dev);
+
+	/* Release the last reference on the master if its driver
+	 * has not yet been converted to devm_spi_alloc_master().
+	 */
+	if (!devres_find(master->dev.parent, devm_spi_release_master,
+			 devm_spi_match_master, master))
+		put_device(&master->dev);
 }
 EXPORT_SYMBOL_GPL(spi_unregister_master);
 
diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
index cce80e6dc7d1..f5d387140c46 100644
--- a/include/linux/spi/spi.h
+++ b/include/linux/spi/spi.h
@@ -568,6 +568,8 @@ extern void spi_finalize_current_transfer(struct spi_master *master);
 /* the spi driver core manages memory for the spi_master classdev */
 extern struct spi_master *
 spi_alloc_master(struct device *host, unsigned size);
+extern struct spi_master *
+devm_spi_alloc_master(struct device *dev, unsigned int size);
 
 extern int spi_register_master(struct spi_master *master);
 extern int devm_spi_register_master(struct device *dev,

From e366915788f63c9de6340345ff6d2ee999466b80 Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@wunner.de>
Date: Sun, 6 Dec 2020 13:53:01 +0100
Subject: [PATCH 1141/2658] spi: bcm2835: Fix use-after-free on unbind

[ Upstream commit e1483ac030fb4c57734289742f1c1d38dca61e22 ]

bcm2835_spi_remove() accesses the driver's private data after calling
spi_unregister_controller() even though that function releases the last
reference on the spi_controller and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.

Fixes: f8043872e796 ("spi: add driver for BCM2835")
Reported-by: Sascha Hauer <s.hauer@pengutronix.de>
Reported-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v3.10+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v3.10+
Cc: Vladimir Oltean <olteanv@gmail.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/ad66e0a0ad96feb848814842ecf5b6a4539ef35c.1605121038.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi-bcm2835.c | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index 27680b336454..d09a93257d65 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -742,7 +742,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
 	struct resource *res;
 	int err;
 
-	master = spi_alloc_master(&pdev->dev, sizeof(*bs));
+	master = devm_spi_alloc_master(&pdev->dev, sizeof(*bs));
 	if (!master) {
 		dev_err(&pdev->dev, "spi_alloc_master() failed\n");
 		return -ENOMEM;
@@ -764,23 +764,20 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	bs->regs = devm_ioremap_resource(&pdev->dev, res);
-	if (IS_ERR(bs->regs)) {
-		err = PTR_ERR(bs->regs);
-		goto out_master_put;
-	}
+	if (IS_ERR(bs->regs))
+		return PTR_ERR(bs->regs);
 
 	bs->clk = devm_clk_get(&pdev->dev, NULL);
 	if (IS_ERR(bs->clk)) {
 		err = PTR_ERR(bs->clk);
 		dev_err(&pdev->dev, "could not get clk: %d\n", err);
-		goto out_master_put;
+		return err;
 	}
 
 	bs->irq = platform_get_irq(pdev, 0);
 	if (bs->irq <= 0) {
 		dev_err(&pdev->dev, "could not get IRQ: %d\n", bs->irq);
-		err = bs->irq ? bs->irq : -ENODEV;
-		goto out_master_put;
+		return bs->irq ? bs->irq : -ENODEV;
 	}
 
 	clk_prepare_enable(bs->clk);
@@ -808,8 +805,6 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
 
 out_clk_disable:
 	clk_disable_unprepare(bs->clk);
-out_master_put:
-	spi_master_put(master);
 	return err;
 }
 

From 8ad2f875f42cc7981c41acb9c07fbe0529688d8d Mon Sep 17 00:00:00 2001
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
Date: Sun, 6 Dec 2020 13:53:03 +0100
Subject: [PATCH 1142/2658] spi: bcm2835: Release the DMA channel if probe
 fails after dma_init

[ Upstream commit 666224b43b4bd4612ce3b758c038f9bc5c5e3fcb ]

The DMA channel was not released if either devm_request_irq() or
devm_spi_register_controller() failed.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Link: https://lore.kernel.org/r/20191212135550.4634-3-peter.ujfalusi@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
[lukas: backport to 4.19-stable]
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi-bcm2835.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index d09a93257d65..dfbcaaaee66f 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -792,18 +792,19 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
 			       dev_name(&pdev->dev), master);
 	if (err) {
 		dev_err(&pdev->dev, "could not request IRQ: %d\n", err);
-		goto out_clk_disable;
+		goto out_dma_release;
 	}
 
 	err = spi_register_master(master);
 	if (err) {
 		dev_err(&pdev->dev, "could not register SPI master: %d\n", err);
-		goto out_clk_disable;
+		goto out_dma_release;
 	}
 
 	return 0;
 
-out_clk_disable:
+out_dma_release:
+	bcm2835_dma_release(master);
 	clk_disable_unprepare(bs->clk);
 	return err;
 }

From a3bf736809f13836b7331efe33b687dee2cda0ba Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Fri, 4 Dec 2020 16:36:16 -0500
Subject: [PATCH 1143/2658] tracing: Fix userstacktrace option for instances

commit bcee5278958802b40ee8b26679155a6d9231783e upstream.

When the instances were able to use their own options, the userstacktrace
option was left hardcoded for the top level. This made the instance
userstacktrace option bascially into a nop, and will confuse users that set
it, but nothing happens (I was confused when it happened to me!)

Cc: stable@vger.kernel.org
Fixes: 16270145ce6b ("tracing: Add trace options for core options to instances")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace.c | 9 +++++----
 kernel/trace/trace.h | 6 ++++--
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 18f7913a4ef1..67805ed4f870 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1757,7 +1757,7 @@ void trace_buffer_unlock_commit(struct trace_array *tr,
 	__buffer_unlock_commit(buffer, event);
 
 	ftrace_trace_stack(tr, buffer, flags, 6, pc, NULL);
-	ftrace_trace_userstack(buffer, flags, pc);
+	ftrace_trace_userstack(tr, buffer, flags, pc);
 }
 EXPORT_SYMBOL_GPL(trace_buffer_unlock_commit);
 
@@ -1819,7 +1819,7 @@ void trace_buffer_unlock_commit_regs(struct trace_array *tr,
 	 * two. They are that meaningful.
 	 */
 	ftrace_trace_stack(tr, buffer, flags, regs ? 0 : 4, pc, regs);
-	ftrace_trace_userstack(buffer, flags, pc);
+	ftrace_trace_userstack(tr, buffer, flags, pc);
 }
 EXPORT_SYMBOL_GPL(trace_buffer_unlock_commit_regs);
 
@@ -1992,14 +1992,15 @@ void trace_dump_stack(int skip)
 static DEFINE_PER_CPU(int, user_stack_count);
 
 void
-ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags, int pc)
+ftrace_trace_userstack(struct trace_array *tr,
+		       struct ring_buffer *buffer, unsigned long flags, int pc)
 {
 	struct trace_event_call *call = &event_user_stack;
 	struct ring_buffer_event *event;
 	struct userstack_entry *entry;
 	struct stack_trace trace;
 
-	if (!(global_trace.trace_flags & TRACE_ITER_USERSTACKTRACE))
+	if (!(tr->trace_flags & TRACE_ITER_USERSTACKTRACE))
 		return;
 
 	/*
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 6f9534635129..c5c6daef8cdf 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -656,13 +656,15 @@ void update_max_tr_single(struct trace_array *tr,
 #endif /* CONFIG_TRACER_MAX_TRACE */
 
 #ifdef CONFIG_STACKTRACE
-void ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags,
+void ftrace_trace_userstack(struct trace_array *tr,
+			    struct ring_buffer *buffer, unsigned long flags,
 			    int pc);
 
 void __trace_stack(struct trace_array *tr, unsigned long flags, int skip,
 		   int pc);
 #else
-static inline void ftrace_trace_userstack(struct ring_buffer *buffer,
+static inline void ftrace_trace_userstack(struct trace_array *tr,
+					  struct ring_buffer *buffer,
 					  unsigned long flags, int pc)
 {
 }

From a102d6b24902ce4a437b02d5a3baec1db2faed89 Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Tue, 29 Sep 2020 08:53:54 -0400
Subject: [PATCH 1144/2658] btrfs: cleanup cow block on error

commit 572c83acdcdafeb04e70aa46be1fa539310be20c upstream.

In fstest btrfs/064 a transaction abort in __btrfs_cow_block could lead
to a system lockup. It gets stuck trying to write back inodes, and the
write back thread was trying to lock an extent buffer:

  $ cat /proc/2143497/stack
  [<0>] __btrfs_tree_lock+0x108/0x250
  [<0>] lock_extent_buffer_for_io+0x35e/0x3a0
  [<0>] btree_write_cache_pages+0x15a/0x3b0
  [<0>] do_writepages+0x28/0xb0
  [<0>] __writeback_single_inode+0x54/0x5c0
  [<0>] writeback_sb_inodes+0x1e8/0x510
  [<0>] wb_writeback+0xcc/0x440
  [<0>] wb_workfn+0xd7/0x650
  [<0>] process_one_work+0x236/0x560
  [<0>] worker_thread+0x55/0x3c0
  [<0>] kthread+0x13a/0x150
  [<0>] ret_from_fork+0x1f/0x30

This is because we got an error while COWing a block, specifically here

        if (test_bit(BTRFS_ROOT_SHAREABLE, &root->state)) {
                ret = btrfs_reloc_cow_block(trans, root, buf, cow);
                if (ret) {
                        btrfs_abort_transaction(trans, ret);
                        return ret;
                }
        }

  [16402.241552] BTRFS: Transaction aborted (error -2)
  [16402.242362] WARNING: CPU: 1 PID: 2563188 at fs/btrfs/ctree.c:1074 __btrfs_cow_block+0x376/0x540
  [16402.249469] CPU: 1 PID: 2563188 Comm: fsstress Not tainted 5.9.0-rc6+ #8
  [16402.249936] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014
  [16402.250525] RIP: 0010:__btrfs_cow_block+0x376/0x540
  [16402.252417] RSP: 0018:ffff9cca40e578b0 EFLAGS: 00010282
  [16402.252787] RAX: 0000000000000025 RBX: 0000000000000002 RCX: ffff9132bbd19388
  [16402.253278] RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff9132bbd19380
  [16402.254063] RBP: ffff9132b41a49c0 R08: 0000000000000000 R09: 0000000000000000
  [16402.254887] R10: 0000000000000000 R11: ffff91324758b080 R12: ffff91326ef17ce0
  [16402.255694] R13: ffff91325fc0f000 R14: ffff91326ef176b0 R15: ffff9132815e2000
  [16402.256321] FS:  00007f542c6d7b80(0000) GS:ffff9132bbd00000(0000) knlGS:0000000000000000
  [16402.256973] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [16402.257374] CR2: 00007f127b83f250 CR3: 0000000133480002 CR4: 0000000000370ee0
  [16402.257867] Call Trace:
  [16402.258072]  btrfs_cow_block+0x109/0x230
  [16402.258356]  btrfs_search_slot+0x530/0x9d0
  [16402.258655]  btrfs_lookup_file_extent+0x37/0x40
  [16402.259155]  __btrfs_drop_extents+0x13c/0xd60
  [16402.259628]  ? btrfs_block_rsv_migrate+0x4f/0xb0
  [16402.259949]  btrfs_replace_file_extents+0x190/0x820
  [16402.260873]  btrfs_clone+0x9ae/0xc00
  [16402.261139]  btrfs_extent_same_range+0x66/0x90
  [16402.261771]  btrfs_remap_file_range+0x353/0x3b1
  [16402.262333]  vfs_dedupe_file_range_one.part.0+0xd5/0x140
  [16402.262821]  vfs_dedupe_file_range+0x189/0x220
  [16402.263150]  do_vfs_ioctl+0x552/0x700
  [16402.263662]  __x64_sys_ioctl+0x62/0xb0
  [16402.264023]  do_syscall_64+0x33/0x40
  [16402.264364]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
  [16402.264862] RIP: 0033:0x7f542c7d15cb
  [16402.266901] RSP: 002b:00007ffd35944ea8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
  [16402.267627] RAX: ffffffffffffffda RBX: 00000000009d1968 RCX: 00007f542c7d15cb
  [16402.268298] RDX: 00000000009d2490 RSI: 00000000c0189436 RDI: 0000000000000003
  [16402.268958] RBP: 00000000009d2520 R08: 0000000000000036 R09: 00000000009d2e64
  [16402.269726] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
  [16402.270659] R13: 000000000001f000 R14: 00000000009d1970 R15: 00000000009d2e80
  [16402.271498] irq event stamp: 0
  [16402.271846] hardirqs last  enabled at (0): [<0000000000000000>] 0x0
  [16402.272497] hardirqs last disabled at (0): [<ffffffff910dbf59>] copy_process+0x6b9/0x1ba0
  [16402.273343] softirqs last  enabled at (0): [<ffffffff910dbf59>] copy_process+0x6b9/0x1ba0
  [16402.273905] softirqs last disabled at (0): [<0000000000000000>] 0x0
  [16402.274338] ---[ end trace 737874a5a41a8236 ]---
  [16402.274669] BTRFS: error (device dm-9) in __btrfs_cow_block:1074: errno=-2 No such entry
  [16402.276179] BTRFS info (device dm-9): forced readonly
  [16402.277046] BTRFS: error (device dm-9) in btrfs_replace_file_extents:2723: errno=-2 No such entry
  [16402.278744] BTRFS: error (device dm-9) in __btrfs_cow_block:1074: errno=-2 No such entry
  [16402.279968] BTRFS: error (device dm-9) in __btrfs_cow_block:1074: errno=-2 No such entry
  [16402.280582] BTRFS info (device dm-9): balance: ended with status: -30

The problem here is that as soon as we allocate the new block it is
locked and marked dirty in the btree inode.  This means that we could
attempt to writeback this block and need to lock the extent buffer.
However we're not unlocking it here and thus we deadlock.

Fix this by unlocking the cow block if we have any errors inside of
__btrfs_cow_block, and also free it so we do not leak it.

CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
[sudip: use old btrfs_abort_transaction()]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/ctree.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 3fa0515d7685..85b64475d808 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -1129,6 +1129,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
 
 	ret = update_ref_for_cow(trans, root, buf, cow, &last_ref);
 	if (ret) {
+		btrfs_tree_unlock(cow);
+		free_extent_buffer(cow);
 		btrfs_abort_transaction(trans, root, ret);
 		return ret;
 	}
@@ -1136,6 +1138,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
 	if (test_bit(BTRFS_ROOT_REF_COWS, &root->state)) {
 		ret = btrfs_reloc_cow_block(trans, root, buf, cow);
 		if (ret) {
+			btrfs_tree_unlock(cow);
+			free_extent_buffer(cow);
 			btrfs_abort_transaction(trans, root, ret);
 			return ret;
 		}
@@ -1174,6 +1178,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
 		if (last_ref) {
 			ret = tree_mod_log_free_eb(root->fs_info, buf);
 			if (ret) {
+				btrfs_tree_unlock(cow);
+				free_extent_buffer(cow);
 				btrfs_abort_transaction(trans, root, ret);
 				return ret;
 			}

From d1b060f30bf5bb6c8443dbd33a032d083579dc3f Mon Sep 17 00:00:00 2001
From: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Date: Sat, 21 Nov 2020 22:17:15 -0800
Subject: [PATCH 1145/2658] mm/userfaultfd: do not access vma->vm_mm after
 calling handle_userfault()

commit bfe8cc1db02ab243c62780f17fc57f65bde0afe1 upstream.

Alexander reported a syzkaller / KASAN finding on s390, see below for
complete output.

In do_huge_pmd_anonymous_page(), the pre-allocated pagetable will be
freed in some cases.  In the case of userfaultfd_missing(), this will
happen after calling handle_userfault(), which might have released the
mmap_lock.  Therefore, the following pte_free(vma->vm_mm, pgtable) will
access an unstable vma->vm_mm, which could have been freed or re-used
already.

For all architectures other than s390 this will go w/o any negative
impact, because pte_free() simply frees the page and ignores the
passed-in mm.  The implementation for SPARC32 would also access
mm->page_table_lock for pte_free(), but there is no THP support in
SPARC32, so the buggy code path will not be used there.

For s390, the mm->context.pgtable_list is being used to maintain the 2K
pagetable fragments, and operating on an already freed or even re-used
mm could result in various more or less subtle bugs due to list /
pagetable corruption.

Fix this by calling pte_free() before handle_userfault(), similar to how
it is already done in __do_huge_pmd_anonymous_page() for the WRITE /
non-huge_zero_page case.

Commit 6b251fc96cf2c ("userfaultfd: call handle_userfault() for
userfaultfd_missing() faults") actually introduced both, the
do_huge_pmd_anonymous_page() and also __do_huge_pmd_anonymous_page()
changes wrt to calling handle_userfault(), but only in the latter case
it put the pte_free() before calling handle_userfault().

  BUG: KASAN: use-after-free in do_huge_pmd_anonymous_page+0xcda/0xd90 mm/huge_memory.c:744
  Read of size 8 at addr 00000000962d6988 by task syz-executor.0/9334

  CPU: 1 PID: 9334 Comm: syz-executor.0 Not tainted 5.10.0-rc1-syzkaller-07083-g4c9720875573 #0
  Hardware name: IBM 3906 M04 701 (KVM/Linux)
  Call Trace:
    do_huge_pmd_anonymous_page+0xcda/0xd90 mm/huge_memory.c:744
    create_huge_pmd mm/memory.c:4256 [inline]
    __handle_mm_fault+0xe6e/0x1068 mm/memory.c:4480
    handle_mm_fault+0x288/0x748 mm/memory.c:4607
    do_exception+0x394/0xae0 arch/s390/mm/fault.c:479
    do_dat_exception+0x34/0x80 arch/s390/mm/fault.c:567
    pgm_check_handler+0x1da/0x22c arch/s390/kernel/entry.S:706
    copy_from_user_mvcos arch/s390/lib/uaccess.c:111 [inline]
    raw_copy_from_user+0x3a/0x88 arch/s390/lib/uaccess.c:174
    _copy_from_user+0x48/0xa8 lib/usercopy.c:16
    copy_from_user include/linux/uaccess.h:192 [inline]
    __do_sys_sigaltstack kernel/signal.c:4064 [inline]
    __s390x_sys_sigaltstack+0xc8/0x240 kernel/signal.c:4060
    system_call+0xe0/0x28c arch/s390/kernel/entry.S:415

  Allocated by task 9334:
    slab_alloc_node mm/slub.c:2891 [inline]
    slab_alloc mm/slub.c:2899 [inline]
    kmem_cache_alloc+0x118/0x348 mm/slub.c:2904
    vm_area_dup+0x9c/0x2b8 kernel/fork.c:356
    __split_vma+0xba/0x560 mm/mmap.c:2742
    split_vma+0xca/0x108 mm/mmap.c:2800
    mlock_fixup+0x4ae/0x600 mm/mlock.c:550
    apply_vma_lock_flags+0x2c6/0x398 mm/mlock.c:619
    do_mlock+0x1aa/0x718 mm/mlock.c:711
    __do_sys_mlock2 mm/mlock.c:738 [inline]
    __s390x_sys_mlock2+0x86/0xa8 mm/mlock.c:728
    system_call+0xe0/0x28c arch/s390/kernel/entry.S:415

  Freed by task 9333:
    slab_free mm/slub.c:3142 [inline]
    kmem_cache_free+0x7c/0x4b8 mm/slub.c:3158
    __vma_adjust+0x7b2/0x2508 mm/mmap.c:960
    vma_merge+0x87e/0xce0 mm/mmap.c:1209
    userfaultfd_release+0x412/0x6b8 fs/userfaultfd.c:868
    __fput+0x22c/0x7a8 fs/file_table.c:281
    task_work_run+0x200/0x320 kernel/task_work.c:151
    tracehook_notify_resume include/linux/tracehook.h:188 [inline]
    do_notify_resume+0x100/0x148 arch/s390/kernel/signal.c:538
    system_call+0xe6/0x28c arch/s390/kernel/entry.S:416

  The buggy address belongs to the object at 00000000962d6948 which belongs to the cache vm_area_struct of size 200
  The buggy address is located 64 bytes inside of 200-byte region [00000000962d6948, 00000000962d6a10)
  The buggy address belongs to the page: page:00000000313a09fe refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x962d6 flags: 0x3ffff00000000200(slab)
  raw: 3ffff00000000200 000040000257e080 0000000c0000000c 000000008020ba00
  raw: 0000000000000000 000f001e00000000 ffffffff00000001 0000000096959501
  page dumped because: kasan: bad access detected
  page->mem_cgroup:0000000096959501

  Memory state around the buggy address:
   00000000962d6880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   00000000962d6900: 00 fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb
  >00000000962d6980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                        ^
   00000000962d6a00: fb fb fc fc fc fc fc fc fc fc 00 00 00 00 00 00
   00000000962d6a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ==================================================================

Changes for v4.4 stable:
  - Make it apply w/o
    * Commit 4cf58924951ef ("mm: treewide: remove unused address argument
      from pte_alloc functions")
    * Commit 2b7403035459c ("mm: Change return type int to vm_fault_t for
      fault handlers")
    * Commit 82b0f8c39a386 ("mm: join struct fault_env and vm_fault")
    * Commit bae473a423f65 ("mm: introduce fault_env")
    * Commit 6fcb52a56ff60 ("thp: reduce usage of huge zero page's atomic counter")

Fixes: 6b251fc96cf2c ("userfaultfd: call handle_userfault() for userfaultfd_missing() faults")
Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: <stable@vger.kernel.org>	[4.3+]
Link: https://lkml.kernel.org/r/20201110190329.11920-1-gerald.schaefer@linux.ibm.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/huge_memory.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index f38d24bb8a1b..6404e4fcb4ed 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -824,7 +824,6 @@ int do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
 		spinlock_t *ptl;
 		pgtable_t pgtable;
 		struct page *zero_page;
-		bool set;
 		int ret;
 		pgtable = pte_alloc_one(mm, haddr);
 		if (unlikely(!pgtable))
@@ -837,10 +836,11 @@ int do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
 		}
 		ptl = pmd_lock(mm, pmd);
 		ret = 0;
-		set = false;
 		if (pmd_none(*pmd)) {
 			if (userfaultfd_missing(vma)) {
 				spin_unlock(ptl);
+				pte_free(mm, pgtable);
+				put_huge_zero_page();
 				ret = handle_userfault(vma, address, flags,
 						       VM_UFFD_MISSING);
 				VM_BUG_ON(ret & VM_FAULT_FALLBACK);
@@ -849,11 +849,9 @@ int do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
 						   haddr, pmd,
 						   zero_page);
 				spin_unlock(ptl);
-				set = true;
 			}
-		} else
+		} else {
 			spin_unlock(ptl);
-		if (!set) {
 			pte_free(mm, pgtable);
 			put_huge_zero_page();
 		}

From 2acef05b66193ede2dd2a5bd4dfba087789a4e9f Mon Sep 17 00:00:00 2001
From: Bob Peterson <rpeterso@redhat.com>
Date: Tue, 24 Nov 2020 10:44:36 -0500
Subject: [PATCH 1146/2658] gfs2: check for empty rgrp tree in gfs2_ri_update

commit 778721510e84209f78e31e2ccb296ae36d623f5e upstream.

If gfs2 tries to mount a (corrupt) file system that has no resource
groups it still tries to set preferences on the first one, which causes
a kernel null pointer dereference. This patch adds a check to function
gfs2_ri_update so this condition is detected and reported back as an
error.

Reported-by: syzbot+e3f23ce40269a4c9053a@syzkaller.appspotmail.com
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/gfs2/rgrp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index faa5e0e2c449..dd0d8c1bf5c5 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -1017,6 +1017,10 @@ static int gfs2_ri_update(struct gfs2_inode *ip)
 	if (error < 0)
 		return error;
 
+	if (RB_EMPTY_ROOT(&sdp->sd_rindex_tree)) {
+		fs_err(sdp, "no resource groups found in the file system.\n");
+		return -ENOENT;
+	}
 	set_rgrp_preferences(sdp);
 
 	sdp->sd_rindex_uptodate = 1;

From 8b386bbd1dad70b2dfe8342765e130af6d7c14b6 Mon Sep 17 00:00:00 2001
From: Luo Meng <luomeng12@huawei.com>
Date: Tue, 24 Nov 2020 17:45:23 -0800
Subject: [PATCH 1147/2658] Input: i8042 - fix error return code in
 i8042_setup_aux()

commit 855b69857830f8d918d715014f05e59a3f7491a0 upstream.

Fix to return a negative error code from the error handling case
instead of 0 in function i8042_setup_aux(), as done elsewhere in this
function.

Fixes: f81134163fc7 ("Input: i8042 - use platform_driver_probe")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Luo Meng <luomeng12@huawei.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20201123133420.4071187-1-luomeng12@huawei.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/serio/i8042.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index 6b648339733f..37f84ba11f05 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -1456,7 +1456,8 @@ static int __init i8042_setup_aux(void)
 	if (error)
 		goto err_free_ports;
 
-	if (aux_enable())
+	error = aux_enable();
+	if (error)
 		goto err_free_irq;
 
 	i8042_aux_irq_registered = true;

From 87dfd8db3ec075e68fb0c61e2583813db4499dba Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: Thu, 3 Dec 2020 13:50:37 +0900
Subject: [PATCH 1148/2658] x86/uprobes: Do not use prefixes.nbytes when
 looping over prefixes.bytes

commit 4e9a5ae8df5b3365183150f6df49e49dece80d8c upstream

Since insn.prefixes.nbytes can be bigger than the size of
insn.prefixes.bytes[] when a prefix is repeated, the proper check must
be

  insn.prefixes.bytes[i] != 0 and i < 4

instead of using insn.prefixes.nbytes.

Introduce a for_each_insn_prefix() macro for this purpose. Debugged by
Kees Cook <keescook@chromium.org>.

 [ bp: Massage commit message, sync with the respective header in tools/
   and drop "we". ]

Fixes: 2b1444983508 ("uprobes, mm, x86: Add the ability to install and remove uprobes breakpoints")
Reported-by: syzbot+9b64b619f10f19d19a7c@syzkaller.appspotmail.com
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/160697103739.3146288.7437620795200799020.stgit@devnote2
[sudip: adjust context, drop change of insn.h in tools]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/insn.h | 15 +++++++++++++++
 arch/x86/kernel/uprobes.c   | 10 ++++++----
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/arch/x86/include/asm/insn.h b/arch/x86/include/asm/insn.h
index 5a51fcbbe563..6db02d52cdf4 100644
--- a/arch/x86/include/asm/insn.h
+++ b/arch/x86/include/asm/insn.h
@@ -198,6 +198,21 @@ static inline int insn_offset_immediate(struct insn *insn)
 	return insn_offset_displacement(insn) + insn->displacement.nbytes;
 }
 
+/**
+ * for_each_insn_prefix() -- Iterate prefixes in the instruction
+ * @insn: Pointer to struct insn.
+ * @idx:  Index storage.
+ * @prefix: Prefix byte.
+ *
+ * Iterate prefix bytes of given @insn. Each prefix byte is stored in @prefix
+ * and the index is stored in @idx (note that this @idx is just for a cursor,
+ * do not change it.)
+ * Since prefixes.nbytes can be bigger than 4 if some prefixes
+ * are repeated, it cannot be used for looping over the prefixes.
+ */
+#define for_each_insn_prefix(insn, idx, prefix)	\
+	for (idx = 0; idx < ARRAY_SIZE(insn->prefixes.bytes) && (prefix = insn->prefixes.bytes[idx]) != 0; idx++)
+
 #define POP_SS_OPCODE 0x1f
 #define MOV_SREG_OPCODE 0x8e
 
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index 8c38784cf992..60ccfa4c2768 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -268,10 +268,11 @@ static volatile u32 good_2byte_insns[256 / 32] = {
 
 static bool is_prefix_bad(struct insn *insn)
 {
+	insn_byte_t p;
 	int i;
 
-	for (i = 0; i < insn->prefixes.nbytes; i++) {
-		switch (insn->prefixes.bytes[i]) {
+	for_each_insn_prefix(insn, i, p) {
+		switch (p) {
 		case 0x26:	/* INAT_PFX_ES   */
 		case 0x2E:	/* INAT_PFX_CS   */
 		case 0x36:	/* INAT_PFX_DS   */
@@ -711,6 +712,7 @@ static struct uprobe_xol_ops branch_xol_ops = {
 static int branch_setup_xol_ops(struct arch_uprobe *auprobe, struct insn *insn)
 {
 	u8 opc1 = OPCODE1(insn);
+	insn_byte_t p;
 	int i;
 
 	switch (opc1) {
@@ -741,8 +743,8 @@ static int branch_setup_xol_ops(struct arch_uprobe *auprobe, struct insn *insn)
 	 * Intel and AMD behavior differ in 64-bit mode: Intel ignores 66 prefix.
 	 * No one uses these insns, reject any branch insns with such prefix.
 	 */
-	for (i = 0; i < insn->prefixes.nbytes; i++) {
-		if (insn->prefixes.bytes[i] == 0x66)
+	for_each_insn_prefix(insn, i, p) {
+		if (p == 0x66)
 			return -ENOTSUPP;
 	}
 

From 8c06f2dbe4c5e49d900f27a19b67815b466b01f2 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 11 Dec 2020 13:36:47 +0100
Subject: [PATCH 1149/2658] Linux 4.4.248

Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20201210142600.887734129@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 4ed3196c5a7f..219906da8bc4 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 247
+SUBLEVEL = 248
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From bacc0c57d00e3170f53d365973b19c4a022cfc5b Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@wunner.de>
Date: Thu, 10 Dec 2020 20:20:01 +0100
Subject: [PATCH 1150/2658] spi: bcm2835aux: Fix use-after-free on unbind

[ Upstream commit e13ee6cc4781edaf8c7321bee19217e3702ed481 ]

bcm2835aux_spi_remove() accesses the driver's private data after calling
spi_unregister_master() even though that function releases the last
reference on the spi_master and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.

Fixes: b9dd3f6d4172 ("spi: bcm2835aux: Fix controller unregister order")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.4+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.4+: b9dd3f6d4172: spi: bcm2835aux: Fix controller unregister order
Cc: <stable@vger.kernel.org> # v4.4+
Link: https://lore.kernel.org/r/b290b06357d0c0bdee9cecc539b840a90630f101.1605121038.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi-bcm2835aux.c | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
index 5ffc2765a8dd..79edab7b384c 100644
--- a/drivers/spi/spi-bcm2835aux.c
+++ b/drivers/spi/spi-bcm2835aux.c
@@ -381,7 +381,7 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
 	unsigned long clk_hz;
 	int err;
 
-	master = spi_alloc_master(&pdev->dev, sizeof(*bs));
+	master = devm_spi_alloc_master(&pdev->dev, sizeof(*bs));
 	if (!master) {
 		dev_err(&pdev->dev, "spi_alloc_master() failed\n");
 		return -ENOMEM;
@@ -411,30 +411,26 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
 	/* the main area */
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	bs->regs = devm_ioremap_resource(&pdev->dev, res);
-	if (IS_ERR(bs->regs)) {
-		err = PTR_ERR(bs->regs);
-		goto out_master_put;
-	}
+	if (IS_ERR(bs->regs))
+		return PTR_ERR(bs->regs);
 
 	bs->clk = devm_clk_get(&pdev->dev, NULL);
 	if ((!bs->clk) || (IS_ERR(bs->clk))) {
-		err = PTR_ERR(bs->clk);
 		dev_err(&pdev->dev, "could not get clk: %d\n", err);
-		goto out_master_put;
+		return PTR_ERR(bs->clk);
 	}
 
 	bs->irq = platform_get_irq(pdev, 0);
 	if (bs->irq <= 0) {
 		dev_err(&pdev->dev, "could not get IRQ: %d\n", bs->irq);
-		err = bs->irq ? bs->irq : -ENODEV;
-		goto out_master_put;
+		return bs->irq ? bs->irq : -ENODEV;
 	}
 
 	/* this also enables the HW block */
 	err = clk_prepare_enable(bs->clk);
 	if (err) {
 		dev_err(&pdev->dev, "could not prepare clock: %d\n", err);
-		goto out_master_put;
+		return err;
 	}
 
 	/* just checking if the clock returns a sane value */
@@ -467,8 +463,6 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
 
 out_clk_disable:
 	clk_disable_unprepare(bs->clk);
-out_master_put:
-	spi_master_put(master);
 	return err;
 }
 

From 464220c51ce68bac6fe93c2bc3772f155e6983b7 Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <natechancellor@gmail.com>
Date: Thu, 10 Dec 2020 20:20:02 +0100
Subject: [PATCH 1151/2658] spi: bcm2835aux: Restore err assignment in
 bcm2835aux_spi_probe

[ Upstream commit d853b3406903a7dc5b14eb5bada3e8cd677f66a2 ]

Clang warns:

drivers/spi/spi-bcm2835aux.c:532:50: warning: variable 'err' is
uninitialized when used here [-Wuninitialized]
                dev_err(&pdev->dev, "could not get clk: %d\n", err);
                                                               ^~~
./include/linux/dev_printk.h:112:32: note: expanded from macro 'dev_err'
        _dev_err(dev, dev_fmt(fmt), ##__VA_ARGS__)
                                      ^~~~~~~~~~~
drivers/spi/spi-bcm2835aux.c:495:9: note: initialize the variable 'err'
to silence this warning
        int err;
               ^
                = 0
1 warning generated.

Restore the assignment so that the error value can be used in the
dev_err statement and there is no uninitialized memory being leaked.

Fixes: e13ee6cc4781 ("spi: bcm2835aux: Fix use-after-free on unbind")
Link: https://github.com/ClangBuiltLinux/linux/issues/1199
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Link: https://lore.kernel.org/r/20201113180701.455541-1-natechancellor@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
[lukas: backport to 4.19-stable, add stable designation]
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.4+: e13ee6cc4781: spi: bcm2835aux: Fix use-after-free on unbind
Cc: <stable@vger.kernel.org> # v4.4+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi-bcm2835aux.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
index 79edab7b384c..0b5aff090b2e 100644
--- a/drivers/spi/spi-bcm2835aux.c
+++ b/drivers/spi/spi-bcm2835aux.c
@@ -416,8 +416,9 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
 
 	bs->clk = devm_clk_get(&pdev->dev, NULL);
 	if ((!bs->clk) || (IS_ERR(bs->clk))) {
+		err = PTR_ERR(bs->clk);
 		dev_err(&pdev->dev, "could not get clk: %d\n", err);
-		return PTR_ERR(bs->clk);
+		return err;
 	}
 
 	bs->irq = platform_get_irq(pdev, 0);

From fc6aa06f96e658ec245e3931e74e898100aecdc2 Mon Sep 17 00:00:00 2001
From: Vineet Gupta <vgupta@synopsys.com>
Date: Fri, 6 Nov 2020 16:59:27 -0800
Subject: [PATCH 1152/2658] ARC: stack unwinding: don't assume non-current task
 is sleeping

[ Upstream commit e42404fa10fd11fe72d0a0e149a321d10e577715 ]

To start stack unwinding (SP, PC and BLINK) are needed. When the
explicit execution context (pt_regs etc) is not available, unwinder
assumes the task is sleeping (in __switch_to()) and fetches SP and BLINK
from kernel mode stack.

But this assumption is not true, specially in a SMP system, when top
runs on 1 core, there may be active running processes on all cores.

So when unwinding non courrent tasks, ensure they are NOT running.

And while at it, handle the self unwinding case explicitly.

This came out of investigation of a customer reported hang with
rcutorture+top

Link: https://github.com/foss-for-synopsys-dwc-arc-processors/linux/issues/31
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arc/kernel/stacktrace.c | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c
index 5401e2bab3da..054511f571df 100644
--- a/arch/arc/kernel/stacktrace.c
+++ b/arch/arc/kernel/stacktrace.c
@@ -39,15 +39,15 @@
 
 #ifdef CONFIG_ARC_DW2_UNWIND
 
-static void seed_unwind_frame_info(struct task_struct *tsk,
-				   struct pt_regs *regs,
-				   struct unwind_frame_info *frame_info)
+static int
+seed_unwind_frame_info(struct task_struct *tsk, struct pt_regs *regs,
+		       struct unwind_frame_info *frame_info)
 {
 	/*
 	 * synchronous unwinding (e.g. dump_stack)
 	 *  - uses current values of SP and friends
 	 */
-	if (tsk == NULL && regs == NULL) {
+	if (regs == NULL && (tsk == NULL || tsk == current)) {
 		unsigned long fp, sp, blink, ret;
 		frame_info->task = current;
 
@@ -66,11 +66,15 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
 		frame_info->call_frame = 0;
 	} else if (regs == NULL) {
 		/*
-		 * Asynchronous unwinding of sleeping task
-		 *  - Gets SP etc from task's pt_regs (saved bottom of kernel
-		 *    mode stack of task)
+		 * Asynchronous unwinding of a likely sleeping task
+		 *  - first ensure it is actually sleeping
+		 *  - if so, it will be in __switch_to, kernel mode SP of task
+		 *    is safe-kept and BLINK at a well known location in there
 		 */
 
+		if (tsk->state == TASK_RUNNING)
+			return -1;
+
 		frame_info->task = tsk;
 
 		frame_info->regs.r27 = TSK_K_FP(tsk);
@@ -104,6 +108,8 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
 		frame_info->regs.r63 = regs->ret;
 		frame_info->call_frame = 0;
 	}
+
+	return 0;
 }
 
 #endif
@@ -117,7 +123,8 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs,
 	unsigned int address;
 	struct unwind_frame_info frame_info;
 
-	seed_unwind_frame_info(tsk, regs, &frame_info);
+	if (seed_unwind_frame_info(tsk, regs, &frame_info))
+		return 0;
 
 	while (1) {
 		address = UNW_PC(&frame_info);

From e92e10654f4813cd9d0115ef3d5424c205e21aac Mon Sep 17 00:00:00 2001
From: Timo Witte <timo.witte@gmail.com>
Date: Tue, 4 Aug 2020 02:14:23 +0200
Subject: [PATCH 1153/2658] platform/x86: acer-wmi: add automatic keyboard
 background light toggle key as KEY_LIGHTS_TOGGLE

[ Upstream commit 9e7a005ad56aa7d6ea5830c5ffcc60bf35de380b ]

Got a dmesg message on my AMD Renoir based Acer laptop:
"acer_wmi: Unknown key number - 0x84" when toggling keyboard
background light

Signed-off-by: Timo Witte <timo.witte@gmail.com>
Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
Link: https://lore.kernel.org/r/20200804001423.36778-1-timo.witte@gmail.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/acer-wmi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 5c169a837ebd..b336f2620f9d 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -124,6 +124,7 @@ static const struct key_entry acer_wmi_keymap[] __initconst = {
 	{KE_KEY, 0x64, {KEY_SWITCHVIDEOMODE} },	/* Display Switch */
 	{KE_IGNORE, 0x81, {KEY_SLEEP} },
 	{KE_KEY, 0x82, {KEY_TOUCHPAD_TOGGLE} },	/* Touch Pad Toggle */
+	{KE_IGNORE, 0x84, {KEY_KBDILLUMTOGGLE} }, /* Automatic Keyboard background light toggle */
 	{KE_KEY, KEY_TOUCHPAD_ON, {KEY_TOUCHPAD_ON} },
 	{KE_KEY, KEY_TOUCHPAD_OFF, {KEY_TOUCHPAD_OFF} },
 	{KE_IGNORE, 0x83, {KEY_TOUCHPAD_TOGGLE} },

From f37015455ce9b79acf4a33a7a8a0576894e457cc Mon Sep 17 00:00:00 2001
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: Wed, 9 Dec 2020 20:13:24 -0800
Subject: [PATCH 1154/2658] Input: cm109 - do not stomp on control URB

commit 82e06090473289ce63e23fdeb8737aad59b10645 upstream.

We need to make sure we are not stomping on the control URB that was
issued when opening the device when attempting to toggle buzzer.
To do that we need to mark it as pending in cm109_open().

Reported-and-tested-by: syzbot+150f793ac5bc18eee150@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/misc/cm109.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c
index 50a7faa504f7..c8c6650b9140 100644
--- a/drivers/input/misc/cm109.c
+++ b/drivers/input/misc/cm109.c
@@ -546,12 +546,15 @@ static int cm109_input_open(struct input_dev *idev)
 	dev->ctl_data->byte[HID_OR2] = dev->keybit;
 	dev->ctl_data->byte[HID_OR3] = 0x00;
 
+	dev->ctl_urb_pending = 1;
 	error = usb_submit_urb(dev->urb_ctl, GFP_KERNEL);
-	if (error)
+	if (error) {
+		dev->ctl_urb_pending = 0;
 		dev_err(&dev->intf->dev, "%s: usb_submit_urb (urb_ctl) failed %d\n",
 			__func__, error);
-	else
+	} else {
 		dev->open = 1;
+	}
 
 	mutex_unlock(&dev->pm_mutex);
 

From c9e735b0560bbb8181b456119bb4d0b60e766278 Mon Sep 17 00:00:00 2001
From: Chris Chiu <chiu@endlessos.org>
Date: Wed, 9 Dec 2020 20:24:47 -0800
Subject: [PATCH 1155/2658] Input: i8042 - add Acer laptops to the i8042 reset
 list

commit ce6520b0eafad5962ffc21dc47cd7bd3250e9045 upstream.

The touchpad operates in Basic Mode by default in the Acer BIOS
setup, but some Aspire/TravelMate models require the i8042 to be
reset in order to be correctly detected.

Signed-off-by: Chris Chiu <chiu@endlessos.org>
Link: https://lore.kernel.org/r/20201207071250.15021-1-chiu@endlessos.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/serio/i8042-x86ia64io.h | 42 +++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 1f45010a5b81..fa07be0b4500 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -687,6 +687,48 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "AOA150"),
 		},
 	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A114-31"),
+		},
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A314-31"),
+		},
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A315-31"),
+		},
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-132"),
+		},
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-332"),
+		},
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-432"),
+		},
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate Spin B118-RN"),
+		},
+	},
 	{
 		/* Advent 4211 */
 		.matches = {

From 94de45acb666777dadf77d74dcd969ca59469c9d Mon Sep 17 00:00:00 2001
From: Coiby Xu <coiby.xu@gmail.com>
Date: Wed, 25 Nov 2020 21:03:19 +0800
Subject: [PATCH 1156/2658] pinctrl: amd: remove debounce filter setting in IRQ
 type setting

commit 47a0001436352c9853d72bf2071e85b316d688a2 upstream.

Debounce filter setting should be independent from IRQ type setting
because according to the ACPI specs, there are separate arguments for
specifying debounce timeout and IRQ type in GpioIo() and GpioInt().

Together with commit 06abe8291bc31839950f7d0362d9979edc88a666
("pinctrl: amd: fix incorrect way to disable debounce filter") and
Andy's patch "gpiolib: acpi: Take into account debounce settings" [1],
this will fix broken touchpads for laptops whose BIOS set the
debounce timeout to a relatively large value. For example, the BIOS
of Lenovo AMD gaming laptops including Legion-5 15ARH05 (R7000),
Legion-5P (R7000P) and IdeaPad Gaming 3 15ARH05, set the debounce
timeout to 124.8ms. This led to the kernel receiving only ~7 HID
reports per second from the Synaptics touchpad
(MSFT0001:00 06CB:7F28).

Existing touchpads like [2][3] are not troubled by this bug because
the debounce timeout has been set to 0 by the BIOS before enabling
the debounce filter in setting IRQ type.

[1] https://lore.kernel.org/linux-gpio/20201111222008.39993-11-andriy.shevchenko@linux.intel.com/
    8dcb7a15a585 ("gpiolib: acpi: Take into account debounce settings")
[2] https://github.com/Syniurge/i2c-amd-mp2/issues/11#issuecomment-721331582
[3] https://forum.manjaro.org/t/random-short-touchpad-freezes/30832/28

Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Hans de Goede <hdegoede@redhat.com>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-gpio/CAHp75VcwiGREBUJ0A06EEw-SyabqYsp%2Bdqs2DpSrhaY-2GVdAA%40mail.gmail.com/
BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1887190
Link: https://lore.kernel.org/r/20201125130320.311059-1-coiby.xu@gmail.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pinctrl/pinctrl-amd.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
index a3b27856b9e9..43440b6b85bc 100644
--- a/drivers/pinctrl/pinctrl-amd.c
+++ b/drivers/pinctrl/pinctrl-amd.c
@@ -399,7 +399,6 @@ static int amd_gpio_irq_set_type(struct irq_data *d, unsigned int type)
 		pin_reg &= ~BIT(LEVEL_TRIG_OFF);
 		pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
 		pin_reg |= ACTIVE_HIGH << ACTIVE_LEVEL_OFF;
-		pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF;
 		irq_set_handler_locked(d, handle_edge_irq);
 		break;
 
@@ -407,7 +406,6 @@ static int amd_gpio_irq_set_type(struct irq_data *d, unsigned int type)
 		pin_reg &= ~BIT(LEVEL_TRIG_OFF);
 		pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
 		pin_reg |= ACTIVE_LOW << ACTIVE_LEVEL_OFF;
-		pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF;
 		irq_set_handler_locked(d, handle_edge_irq);
 		break;
 
@@ -415,7 +413,6 @@ static int amd_gpio_irq_set_type(struct irq_data *d, unsigned int type)
 		pin_reg &= ~BIT(LEVEL_TRIG_OFF);
 		pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
 		pin_reg |= BOTH_EADGE << ACTIVE_LEVEL_OFF;
-		pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF;
 		irq_set_handler_locked(d, handle_edge_irq);
 		break;
 
@@ -423,8 +420,6 @@ static int amd_gpio_irq_set_type(struct irq_data *d, unsigned int type)
 		pin_reg |= LEVEL_TRIGGER << LEVEL_TRIG_OFF;
 		pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
 		pin_reg |= ACTIVE_HIGH << ACTIVE_LEVEL_OFF;
-		pin_reg &= ~(DB_CNTRl_MASK << DB_CNTRL_OFF);
-		pin_reg |= DB_TYPE_PRESERVE_LOW_GLITCH << DB_CNTRL_OFF;
 		irq_set_handler_locked(d, handle_level_irq);
 		break;
 
@@ -432,8 +427,6 @@ static int amd_gpio_irq_set_type(struct irq_data *d, unsigned int type)
 		pin_reg |= LEVEL_TRIGGER << LEVEL_TRIG_OFF;
 		pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
 		pin_reg |= ACTIVE_LOW << ACTIVE_LEVEL_OFF;
-		pin_reg &= ~(DB_CNTRl_MASK << DB_CNTRL_OFF);
-		pin_reg |= DB_TYPE_PRESERVE_HIGH_GLITCH << DB_CNTRL_OFF;
 		irq_set_handler_locked(d, handle_level_irq);
 		break;
 

From c91c98d3451b66ab1c8bee47ba8a38d731187c10 Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@wunner.de>
Date: Mon, 3 Aug 2020 13:09:01 +0200
Subject: [PATCH 1157/2658] spi: Prevent adding devices below an unregistering
 controller

commit ddf75be47ca748f8b12d28ac64d624354fddf189 upstream

CONFIG_OF_DYNAMIC and CONFIG_ACPI allow adding SPI devices at runtime
using a DeviceTree overlay or DSDT patch.  CONFIG_SPI_SLAVE allows the
same via sysfs.

But there are no precautions to prevent adding a device below a
controller that's being removed.  Such a device is unusable and may not
even be able to unbind cleanly as it becomes inaccessible once the
controller has been torn down.  E.g. it is then impossible to quiesce
the device's interrupt.

of_spi_notify() and acpi_spi_notify() do hold a ref on the controller,
but otherwise run lockless against spi_unregister_controller().

Fix by holding the spi_add_lock in spi_unregister_controller() and
bailing out of spi_add_device() if the controller has been unregistered
concurrently.

Fixes: ce79d54ae447 ("spi/of: Add OF notifier handler")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v3.19+
Cc: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: Octavian Purdila <octavian.purdila@intel.com>
Cc: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Link: https://lore.kernel.org/r/a8c3205088a969dc8410eec1eba9aface60f36af.1596451035.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/Kconfig |  3 +++
 drivers/spi/spi.c   | 21 ++++++++++++++++++++-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 8b9c2a38d1cc..a81a3cbf1439 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -706,4 +706,7 @@ endif # SPI_MASTER
 
 # (slave support would go here)
 
+config SPI_DYNAMIC
+	def_bool ACPI || OF_DYNAMIC || SPI_SLAVE
+
 endif # SPI
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index ed87f71a428d..e85feee750e3 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -418,6 +418,12 @@ static LIST_HEAD(spi_master_list);
  */
 static DEFINE_MUTEX(board_lock);
 
+/*
+ * Prevents addition of devices with same chip select and
+ * addition of devices below an unregistering controller.
+ */
+static DEFINE_MUTEX(spi_add_lock);
+
 /**
  * spi_alloc_device - Allocate a new SPI device
  * @master: Controller to which device is connected
@@ -496,7 +502,6 @@ static int spi_dev_check(struct device *dev, void *data)
  */
 int spi_add_device(struct spi_device *spi)
 {
-	static DEFINE_MUTEX(spi_add_lock);
 	struct spi_master *master = spi->master;
 	struct device *dev = master->dev.parent;
 	int status;
@@ -525,6 +530,13 @@ int spi_add_device(struct spi_device *spi)
 		goto done;
 	}
 
+	/* Controller may unregister concurrently */
+	if (IS_ENABLED(CONFIG_SPI_DYNAMIC) &&
+	    !device_is_registered(&master->dev)) {
+		status = -ENODEV;
+		goto done;
+	}
+
 	if (master->cs_gpios)
 		spi->cs_gpio = master->cs_gpios[spi->chip_select];
 
@@ -1962,6 +1974,10 @@ static int __unregister(struct device *dev, void *null)
  */
 void spi_unregister_master(struct spi_master *master)
 {
+	/* Prevent addition of new devices, unregister existing ones */
+	if (IS_ENABLED(CONFIG_SPI_DYNAMIC))
+		mutex_lock(&spi_add_lock);
+
 	device_for_each_child(&master->dev, NULL, __unregister);
 
 	if (master->queued) {
@@ -1981,6 +1997,9 @@ void spi_unregister_master(struct spi_master *master)
 	if (!devres_find(master->dev.parent, devm_spi_release_master,
 			 devm_spi_match_master, master))
 		put_device(&master->dev);
+
+	if (IS_ENABLED(CONFIG_SPI_DYNAMIC))
+		mutex_unlock(&spi_add_lock);
 }
 EXPORT_SYMBOL_GPL(spi_unregister_master);
 

From 41de1c0ac1d66d5e62b59a23bcf785fd983d0d2b Mon Sep 17 00:00:00 2001
From: Moshe Shemesh <moshe@mellanox.com>
Date: Wed, 9 Dec 2020 15:03:38 +0200
Subject: [PATCH 1158/2658] net/mlx4_en: Avoid scheduling restart task if it is
 already running

[ Upstream commit fed91613c9dd455dd154b22fa8e11b8526466082 ]

Add restarting state flag to avoid scheduling another restart task while
such task is already running. Change task name from watchdog_task to
restart_task to better fit the task role.

Fixes: 1e338db56e5a ("mlx4_en: Fix a race at restart task")
Signed-off-by: Moshe Shemesh <moshe@mellanox.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 17 +++++++++++------
 drivers/net/ethernet/mellanox/mlx4/mlx4_en.h   |  7 ++++++-
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 7d61a5de9d5a..b7bde70a3e95 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1313,8 +1313,10 @@ static void mlx4_en_tx_timeout(struct net_device *dev)
 	}
 
 	priv->port_stats.tx_timeout++;
-	en_dbg(DRV, priv, "Scheduling watchdog\n");
-	queue_work(mdev->workqueue, &priv->watchdog_task);
+	if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state)) {
+		en_dbg(DRV, priv, "Scheduling port restart\n");
+		queue_work(mdev->workqueue, &priv->restart_task);
+	}
 }
 
 
@@ -1730,6 +1732,7 @@ int mlx4_en_start_port(struct net_device *dev)
 		local_bh_enable();
 	}
 
+	clear_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state);
 	netif_tx_start_all_queues(dev);
 	netif_device_attach(dev);
 
@@ -1891,7 +1894,7 @@ void mlx4_en_stop_port(struct net_device *dev, int detach)
 static void mlx4_en_restart(struct work_struct *work)
 {
 	struct mlx4_en_priv *priv = container_of(work, struct mlx4_en_priv,
-						 watchdog_task);
+						 restart_task);
 	struct mlx4_en_dev *mdev = priv->mdev;
 	struct net_device *dev = priv->dev;
 
@@ -2121,7 +2124,7 @@ static int mlx4_en_change_mtu(struct net_device *dev, int new_mtu)
 	if (netif_running(dev)) {
 		mutex_lock(&mdev->state_lock);
 		if (!mdev->device_up) {
-			/* NIC is probably restarting - let watchdog task reset
+			/* NIC is probably restarting - let restart task reset
 			 * the port */
 			en_dbg(DRV, priv, "Change MTU called with card down!?\n");
 		} else {
@@ -2130,7 +2133,9 @@ static int mlx4_en_change_mtu(struct net_device *dev, int new_mtu)
 			if (err) {
 				en_err(priv, "Failed restarting port:%d\n",
 					 priv->port);
-				queue_work(mdev->workqueue, &priv->watchdog_task);
+				if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING,
+						      &priv->state))
+					queue_work(mdev->workqueue, &priv->restart_task);
 			}
 		}
 		mutex_unlock(&mdev->state_lock);
@@ -2850,7 +2855,7 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
 	priv->counter_index = MLX4_SINK_COUNTER_INDEX(mdev->dev);
 	spin_lock_init(&priv->stats_lock);
 	INIT_WORK(&priv->rx_mode_task, mlx4_en_do_set_rx_mode);
-	INIT_WORK(&priv->watchdog_task, mlx4_en_restart);
+	INIT_WORK(&priv->restart_task, mlx4_en_restart);
 	INIT_WORK(&priv->linkstate_task, mlx4_en_linkstate);
 	INIT_DELAYED_WORK(&priv->stats_task, mlx4_en_do_get_stats);
 	INIT_DELAYED_WORK(&priv->service_task, mlx4_en_service_task);
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 607daaffae98..440f1ab6d92e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -495,6 +495,10 @@ struct mlx4_en_stats_bitmap {
 	struct mutex mutex; /* for mutual access to stats bitmap */
 };
 
+enum {
+	MLX4_EN_STATE_FLAG_RESTARTING,
+};
+
 struct mlx4_en_priv {
 	struct mlx4_en_dev *mdev;
 	struct mlx4_en_port_profile *prof;
@@ -560,7 +564,7 @@ struct mlx4_en_priv {
 	struct mlx4_en_cq *rx_cq[MAX_RX_RINGS];
 	struct mlx4_qp drop_qp;
 	struct work_struct rx_mode_task;
-	struct work_struct watchdog_task;
+	struct work_struct restart_task;
 	struct work_struct linkstate_task;
 	struct delayed_work stats_task;
 	struct delayed_work service_task;
@@ -605,6 +609,7 @@ struct mlx4_en_priv {
 	u32 pflags;
 	u8 rss_key[MLX4_EN_RSS_KEY_SIZE];
 	u8 rss_hash_fn;
+	unsigned long state;
 };
 
 enum mlx4_en_wol {

From 66ef23e9fdc422d157a12f81d5db7bfd25d1305c Mon Sep 17 00:00:00 2001
From: Neal Cardwell <ncardwell@google.com>
Date: Tue, 8 Dec 2020 22:57:59 -0500
Subject: [PATCH 1159/2658] tcp: fix cwnd-limited bug for TSO deferral where we
 send nothing

[ Upstream commit 299bcb55ecd1412f6df606e9dc0912d55610029e ]

When cwnd is not a multiple of the TSO skb size of N*MSS, we can get
into persistent scenarios where we have the following sequence:

(1) ACK for full-sized skb of N*MSS arrives
  -> tcp_write_xmit() transmit full-sized skb with N*MSS
  -> move pacing release time forward
  -> exit tcp_write_xmit() because pacing time is in the future

(2) TSQ callback or TCP internal pacing timer fires
  -> try to transmit next skb, but TSO deferral finds remainder of
     available cwnd is not big enough to trigger an immediate send
     now, so we defer sending until the next ACK.

(3) repeat...

So we can get into a case where we never mark ourselves as
cwnd-limited for many seconds at a time, even with
bulk/infinite-backlog senders, because:

o In case (1) above, every time in tcp_write_xmit() we have enough
cwnd to send a full-sized skb, we are not fully using the cwnd
(because cwnd is not a multiple of the TSO skb size). So every time we
send data, we are not cwnd limited, and so in the cwnd-limited
tracking code in tcp_cwnd_validate() we mark ourselves as not
cwnd-limited.

o In case (2) above, every time in tcp_write_xmit() that we try to
transmit the "remainder" of the cwnd but defer, we set the local
variable is_cwnd_limited to true, but we do not send any packets, so
sent_pkts is zero, so we don't call the cwnd-limited logic to update
tp->is_cwnd_limited.

Fixes: ca8a22634381 ("tcp: make cwnd-limited checks measurement-based, and gentler")
Reported-by: Ingemar Johansson <ingemar.s.johansson@ericsson.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20201209035759.1225145-1-ncardwell.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_output.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 26de4da6341f..5a56b2356dde 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1501,7 +1501,8 @@ static void tcp_cwnd_validate(struct sock *sk, bool is_cwnd_limited)
 	 * window, and remember whether we were cwnd-limited then.
 	 */
 	if (!before(tp->snd_una, tp->max_packets_seq) ||
-	    tp->packets_out > tp->max_packets_out) {
+	    tp->packets_out > tp->max_packets_out ||
+	    is_cwnd_limited) {
 		tp->max_packets_out = tp->packets_out;
 		tp->max_packets_seq = tp->snd_nxt;
 		tp->is_cwnd_limited = is_cwnd_limited;
@@ -2172,6 +2173,10 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
 			break;
 	}
 
+	is_cwnd_limited |= (tcp_packets_in_flight(tp) >= tp->snd_cwnd);
+	if (likely(sent_pkts || is_cwnd_limited))
+		tcp_cwnd_validate(sk, is_cwnd_limited);
+
 	if (likely(sent_pkts)) {
 		if (tcp_in_cwnd_reduction(sk))
 			tp->prr_out += sent_pkts;
@@ -2179,8 +2184,6 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
 		/* Send one loss probe per tail loss episode. */
 		if (push_one != 2)
 			tcp_schedule_loss_probe(sk);
-		is_cwnd_limited |= (tcp_packets_in_flight(tp) >= tp->snd_cwnd);
-		tcp_cwnd_validate(sk, is_cwnd_limited);
 		return false;
 	}
 	return !tp->packets_out && tcp_send_head(sk);

From 69b765725a7446fa3d819399136030e4be8f8f07 Mon Sep 17 00:00:00 2001
From: Fugang Duan <fugang.duan@nxp.com>
Date: Mon, 7 Dec 2020 18:51:40 +0800
Subject: [PATCH 1160/2658] net: stmmac: delete the eee_ctrl_timer after napi
 disabled

[ Upstream commit 5f58591323bf3f342920179f24515935c4b5fd60 ]

There have chance to re-enable the eee_ctrl_timer and fire the timer
in napi callback after delete the timer in .stmmac_release(), which
introduces to access eee registers in the timer function after clocks
are disabled then causes system hang. Found this issue when do
suspend/resume and reboot stress test.

It is safe to delete the timer after napi disabled and disable lpi mode.

Fixes: d765955d2ae0b ("stmmac: add the Energy Efficient Ethernet support")
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 6f695239e658..d9462ee91a4b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1897,9 +1897,6 @@ static int stmmac_release(struct net_device *dev)
 {
 	struct stmmac_priv *priv = netdev_priv(dev);
 
-	if (priv->eee_enabled)
-		del_timer_sync(&priv->eee_ctrl_timer);
-
 	/* Stop and disconnect the PHY */
 	if (priv->phydev) {
 		phy_stop(priv->phydev);
@@ -1920,6 +1917,11 @@ static int stmmac_release(struct net_device *dev)
 	if (priv->lpi_irq > 0)
 		free_irq(priv->lpi_irq, dev);
 
+	if (priv->eee_enabled) {
+		priv->tx_path_in_lpi_mode = false;
+		del_timer_sync(&priv->eee_ctrl_timer);
+	}
+
 	/* Stop TX/RX DMA and clear the descriptors */
 	priv->hw->dma->stop_tx(priv->ioaddr);
 	priv->hw->dma->stop_rx(priv->ioaddr);
@@ -3068,6 +3070,11 @@ int stmmac_suspend(struct net_device *ndev)
 
 	napi_disable(&priv->napi);
 
+	if (priv->eee_enabled) {
+		priv->tx_path_in_lpi_mode = false;
+		del_timer_sync(&priv->eee_ctrl_timer);
+	}
+
 	/* Stop TX/RX DMA */
 	priv->hw->dma->stop_tx(priv->ioaddr);
 	priv->hw->dma->stop_rx(priv->ioaddr);

From e96a1d5a966204c3eb5653eb2ec0b5bb2fa2c43a Mon Sep 17 00:00:00 2001
From: Zhang Changzhong <zhangchangzhong@huawei.com>
Date: Fri, 4 Dec 2020 16:48:56 +0800
Subject: [PATCH 1161/2658] net: bridge: vlan: fix error return code in
 __vlan_add()

[ Upstream commit ee4f52a8de2c6f78b01f10b4c330867d88c1653a ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: f8ed289fab84 ("bridge: vlan: use br_vlan_(get|put)_master to deal with refcounts")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Link: https://lore.kernel.org/r/1607071737-33875-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bridge/br_vlan.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index a7953962112a..1b848a45047b 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -225,8 +225,10 @@ static int __vlan_add(struct net_bridge_vlan *v, u16 flags)
 		}
 
 		masterv = br_vlan_get_master(br, v->vid);
-		if (!masterv)
+		if (!masterv) {
+			err = -ENOMEM;
 			goto out_filt;
+		}
 		v->brvlan = masterv;
 	}
 

From e76a00ac41734726d507f126c4c0989c7912dee0 Mon Sep 17 00:00:00 2001
From: Bui Quang Minh <minhquangbui99@gmail.com>
Date: Fri, 4 Dec 2020 06:24:49 +0000
Subject: [PATCH 1162/2658] USB: dummy-hcd: Fix uninitialized array use in
 init()

commit e90cfa813da7a527785033a0b247594c2de93dd8 upstream.

This error path

	err_add_pdata:
		for (i = 0; i < mod_data.num; i++)
			kfree(dum[i]);

can be triggered when not all dum's elements are initialized.

Fix this by initializing all dum's elements to NULL.

Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
Link: https://lore.kernel.org/r/1607063090-3426-1-git-send-email-minhquangbui99@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/udc/dummy_hcd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index 0321b9ce9faf..cbd4ef2c74b8 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -2741,7 +2741,7 @@ static int __init init(void)
 {
 	int	retval = -ENOMEM;
 	int	i;
-	struct	dummy *dum[MAX_NUM_UDC];
+	struct	dummy *dum[MAX_NUM_UDC] = {};
 
 	if (usb_disabled())
 		return -ENODEV;

From b305279640ec564e649b763b5292d74c77c82141 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Mon, 7 Dec 2020 14:03:23 +0100
Subject: [PATCH 1163/2658] USB: add RESET_RESUME quirk for Snapscan 1212

commit 08a02f954b0def3ada8ed6d4b2c7bcb67e885e9c upstream.

I got reports that some models of this old scanner need
this when using runtime PM.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201207130323.23857-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/quirks.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 34d8cece6dd3..5d109717ac4e 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -189,6 +189,9 @@ static const struct usb_device_id usb_quirk_list[] = {
 	{ USB_DEVICE(0x06a3, 0x0006), .driver_info =
 			USB_QUIRK_CONFIG_INTF_STRINGS },
 
+	/* Agfa SNAPSCAN 1212U */
+	{ USB_DEVICE(0x06bd, 0x0001), .driver_info = USB_QUIRK_RESET_RESUME },
+
 	/* Guillemot Webcam Hercules Dualpix Exchange (2nd ID) */
 	{ USB_DEVICE(0x06f8, 0x0804), .driver_info = USB_QUIRK_RESET_RESUME },
 

From 78344a1593079e29d277538bf79322594fce6cf1 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 9 Dec 2020 09:45:51 +0100
Subject: [PATCH 1164/2658] ALSA: usb-audio: Fix potential out-of-bounds shift

commit 43d5ca88dfcd35e43010fdd818e067aa9a55f5ba upstream.

syzbot spotted a potential out-of-bounds shift in the USB-audio format
parser that receives the arbitrary shift value from the USB
descriptor.

Add a range check for avoiding the undefined behavior.

Reported-by: syzbot+df7dc146ebdd6435eea3@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201209084552.17109-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/format.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/usb/format.c b/sound/usb/format.c
index daff52e78317..5af1fd34e8bd 100644
--- a/sound/usb/format.c
+++ b/sound/usb/format.c
@@ -53,6 +53,8 @@ static u64 parse_audio_format_i_type(struct snd_usb_audio *chip,
 	case UAC_VERSION_1:
 	default: {
 		struct uac_format_type_i_discrete_descriptor *fmt = _fmt;
+		if (format >= 64)
+			return 0; /* invalid format */
 		sample_width = fmt->bBitResolution;
 		sample_bytes = fmt->bSubframeSize;
 		format = 1 << format;

From 44803e9cb35fd697caa41957d58164507f1e0cc5 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Fri, 11 Dec 2020 14:00:48 +0100
Subject: [PATCH 1165/2658] ALSA: usb-audio: Fix control 'access overflow'
 errors from chmap

commit c6dde8ffd071aea9d1ce64279178e470977b235c upstream.

The current channel-map control implementation in USB-audio driver may
lead to an error message like
  "control 3:0:0:Playback Channel Map:0: access overflow"
when CONFIG_SND_CTL_VALIDATION is set.  It's because the chmap get
callback clears the whole array no matter which count is set, and
rather the false-positive detection.

This patch fixes the problem by clearing only the needed array range
at usb_chmap_ctl_get().

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201211130048.6358-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/stream.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index 0204fe014a5b..f1186ba3958c 100644
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -193,16 +193,16 @@ static int usb_chmap_ctl_get(struct snd_kcontrol *kcontrol,
 	struct snd_pcm_chmap *info = snd_kcontrol_chip(kcontrol);
 	struct snd_usb_substream *subs = info->private_data;
 	struct snd_pcm_chmap_elem *chmap = NULL;
-	int i;
+	int i = 0;
 
-	memset(ucontrol->value.integer.value, 0,
-	       sizeof(ucontrol->value.integer.value));
 	if (subs->cur_audiofmt)
 		chmap = subs->cur_audiofmt->chmap;
 	if (chmap) {
 		for (i = 0; i < chmap->channels; i++)
 			ucontrol->value.integer.value[i] = chmap->map[i];
 	}
+	for (; i < subs->channels_max; i++)
+		ucontrol->value.integer.value[i] = 0;
 	return 0;
 }
 

From fe7b2acea6422be9120d47ae401e1770fba13a93 Mon Sep 17 00:00:00 2001
From: Li Jun <jun.li@nxp.com>
Date: Tue, 8 Dec 2020 11:29:12 +0200
Subject: [PATCH 1166/2658] xhci: Give USB2 ports time to enter U3 in bus
 suspend

commit c1373f10479b624fb6dba0805d673e860f1b421d upstream.

If a USB2 device wakeup is not enabled/supported the link state may
still be in U0 in xhci_bus_suspend(), where it's then manually put
to suspended U3 state.

Just as with selective suspend the device needs time to enter U3
suspend before continuing with further suspend operations
(e.g. system suspend), otherwise we may enter system suspend with link
state in U0.

[commit message rewording -Mathias]

Cc: <stable@vger.kernel.org>
Signed-off-by: Li Jun <jun.li@nxp.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20201208092912.1773650-6-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-hub.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index d6c76ab7a0de..d57c6cfb7412 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1575,6 +1575,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
 	hcd->state = HC_STATE_SUSPENDED;
 	bus_state->next_statechange = jiffies + msecs_to_jiffies(10);
 	spin_unlock_irqrestore(&xhci->lock, flags);
+
+	if (bus_state->bus_suspended)
+		usleep_range(5000, 10000);
+
 	return 0;
 }
 

From 27656b902eb162971ed5a9301ca10f07a76996a1 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 19 Oct 2020 12:06:30 +0200
Subject: [PATCH 1167/2658] USB: sisusbvga: Make console support depend on
 BROKEN

commit 862ee699fefe1e6d6f2c1518395f0b999b8beb15 upstream.

The console part of sisusbvga is broken vs. printk(). It uses in_atomic()
to detect contexts in which it cannot sleep despite the big fat comment in
preempt.h which says: Do not use in_atomic() in driver code.

in_atomic() does not work on kernels with CONFIG_PREEMPT_COUNT=n which
means that spin/rw_lock held regions are not detected by it.

There is no way to make this work by handing context information through to
the driver and this only can be solved once the core printk infrastructure
supports sleepable console drivers.

Make it depend on BROKEN for now.

Fixes: 1bbb4f2035d9 ("[PATCH] USB: sisusb[vga] update")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Thomas Winischhofer <thomas@winischhofer.net>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-usb@vger.kernel.org
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201019101109.603244207@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/misc/sisusbvga/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/misc/sisusbvga/Kconfig b/drivers/usb/misc/sisusbvga/Kconfig
index 36bc28c884ad..47dabccafef4 100644
--- a/drivers/usb/misc/sisusbvga/Kconfig
+++ b/drivers/usb/misc/sisusbvga/Kconfig
@@ -15,7 +15,7 @@ config USB_SISUSBVGA
 
 config USB_SISUSBVGA_CON
 	bool "Text console and mode switching support" if USB_SISUSBVGA
-	depends on VT
+	depends on VT && BROKEN
 	select FONT_8x16
 	---help---
 	  Say Y here if you want a VGA text console via the USB dongle or

From f731ca1841ede66a224e663e6aabcf2786b93959 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 9 Dec 2020 09:45:52 +0100
Subject: [PATCH 1168/2658] ALSA: pcm: oss: Fix potential out-of-bounds shift

commit 175b8d89fe292796811fdee87fa39799a5b6b87a upstream.

syzbot spotted a potential out-of-bounds shift in the PCM OSS layer
where it calculates the buffer size with the arbitrary shift value
given via an ioctl.

Add a range check for avoiding the undefined behavior.
As the value can be treated by a signed integer, the max shift should
be 30.

Reported-by: syzbot+df7dc146ebdd6435eea3@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201209084552.17109-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/oss/pcm_oss.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index 443bb8ce8255..4140ea9cf7c1 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -2000,11 +2000,15 @@ static int snd_pcm_oss_set_subdivide(struct snd_pcm_oss_file *pcm_oss_file, int
 static int snd_pcm_oss_set_fragment1(struct snd_pcm_substream *substream, unsigned int val)
 {
 	struct snd_pcm_runtime *runtime;
+	int fragshift;
 
 	runtime = substream->runtime;
 	if (runtime->oss.subdivision || runtime->oss.fragshift)
 		return -EINVAL;
-	runtime->oss.fragshift = val & 0xffff;
+	fragshift = val & 0xffff;
+	if (fragshift >= 31)
+		return -EINVAL;
+	runtime->oss.fragshift = fragshift;
 	runtime->oss.maxfrags = (val >> 16) & 0xffff;
 	if (runtime->oss.fragshift < 4)		/* < 16 */
 		runtime->oss.fragshift = 4;

From 6225f777c9eacdad5582792bc06ac9790f7c05f2 Mon Sep 17 00:00:00 2001
From: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Date: Thu, 10 Dec 2020 06:52:57 +0100
Subject: [PATCH 1169/2658] serial: 8250_omap: Avoid FIFO corruption caused by
 MDR1 access

commit d96f04d347e4011977abdbb4da5d8f303ebd26f8 upstream.

It has been observed that once per 300-1300 port openings the first
transmitted byte is being corrupted on AM3352 ("v" written to FIFO appeared
as "e" on the wire). It only happened if single byte has been transmitted
right after port open, which means, DMA is not used for this transfer and
the corruption never happened afterwards.

Therefore I've carefully re-read the MDR1 errata (link below), which says
"when accessing the MDR1 registers that causes a dummy under-run condition
that will freeze the UART in IrDA transmission. In UART mode, this may
corrupt the transferred data". Strictly speaking,
omap_8250_mdr1_errataset() performs a read access and if the value is the
same as should be written, exits without errata-recommended FIFO reset.

A brief check of the serial_omap_mdr1_errataset() from the competing
omap-serial driver showed it has no read access of MDR1. After removing the
read access from omap_8250_mdr1_errataset() the data corruption never
happened any more.

Link: https://www.ti.com/lit/er/sprz360i/sprz360i.pdf
Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver")
Cc: stable@vger.kernel.org
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Link: https://lore.kernel.org/r/20201210055257.1053028-1-alexander.sverdlin@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_omap.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index 0377b35d62b8..4bcb8dfa4874 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -155,11 +155,6 @@ static void omap_8250_mdr1_errataset(struct uart_8250_port *up,
 				     struct omap8250_priv *priv)
 {
 	u8 timeout = 255;
-	u8 old_mdr1;
-
-	old_mdr1 = serial_in(up, UART_OMAP_MDR1);
-	if (old_mdr1 == priv->mdr1)
-		return;
 
 	serial_out(up, UART_OMAP_MDR1, priv->mdr1);
 	udelay(2);

From f5a41f172b7eec2d5ba0407f7bfd89c0e5711ff7 Mon Sep 17 00:00:00 2001
From: Brant Merryman <brant.merryman@silabs.com>
Date: Fri, 26 Jun 2020 04:22:58 +0000
Subject: [PATCH 1170/2658] USB: serial: cp210x: enable usb generic
 throttle/unthrottle

commit 4387b3dbb079d482d3c2b43a703ceed4dd27ed28 upstream

Assign the .throttle and .unthrottle functions to be generic function
in the driver structure to prevent data loss that can otherwise occur
if the host does not enable USB throttling.

Signed-off-by: Brant Merryman <brant.merryman@silabs.com>
Co-developed-by: Phu Luu <phu.luu@silabs.com>
Signed-off-by: Phu Luu <phu.luu@silabs.com>
Link: https://lore.kernel.org/r/57401AF3-9961-461F-95E1-F8AFC2105F5E@silabs.com
[ johan: fix up tags ]
Fixes: 39a66b8d22a3 ("[PATCH] USB: CP2101 Add support for flow control")
Cc: stable <stable@vger.kernel.org>     # 2.6.12
Signed-off-by: Johan Hovold <johan@kernel.org>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/cp210x.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 205f31200264..13c718ebaee5 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -252,6 +252,8 @@ static struct usb_serial_driver cp210x_device = {
 	.close			= cp210x_close,
 	.break_ctl		= cp210x_break_ctl,
 	.set_termios		= cp210x_set_termios,
+	.throttle		= usb_serial_generic_throttle,
+	.unthrottle		= usb_serial_generic_unthrottle,
 	.tiocmget		= cp210x_tiocmget,
 	.tiocmset		= cp210x_tiocmset,
 	.attach			= cp210x_startup,

From 341438a091edaf06491cea7923f59b4dc7f162fa Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Sat, 28 Nov 2020 23:09:16 -0800
Subject: [PATCH 1171/2658] scsi: bnx2i: Requires MMU

[ Upstream commit 2d586494c4a001312650f0b919d534e429dd1e09 ]

The SCSI_BNX2_ISCSI kconfig symbol selects CNIC and CNIC selects UIO, which
depends on MMU.

Since 'select' does not follow dependency chains, add the same MMU
dependency to SCSI_BNX2_ISCSI.

Quietens this kconfig warning:

WARNING: unmet direct dependencies detected for CNIC
  Depends on [n]: NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_BROADCOM [=y] && PCI [=y] && (IPV6 [=m] || IPV6 [=m]=n) && MMU [=n]
  Selected by [m]:
  - SCSI_BNX2_ISCSI [=m] && SCSI_LOWLEVEL [=y] && SCSI [=y] && NET [=y] && PCI [=y] && (IPV6 [=m] || IPV6 [=m]=n)

Link: https://lore.kernel.org/r/20201129070916.3919-1-rdunlap@infradead.org
Fixes: cf4e6363859d ("[SCSI] bnx2i: Add bnx2i iSCSI driver.")
Cc: linux-scsi@vger.kernel.org
Cc: Nilesh Javali <njavali@marvell.com>
Cc: Manish Rangankar <mrangankar@marvell.com>
Cc: GR-QLogic-Storage-Upstream@marvell.com
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/bnx2i/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/bnx2i/Kconfig b/drivers/scsi/bnx2i/Kconfig
index ba30ff86d581..b27a3738d940 100644
--- a/drivers/scsi/bnx2i/Kconfig
+++ b/drivers/scsi/bnx2i/Kconfig
@@ -3,6 +3,7 @@ config SCSI_BNX2_ISCSI
 	depends on NET
 	depends on PCI
 	depends on (IPV6 || IPV6=n)
+	depends on MMU
 	select SCSI_ISCSI_ATTRS
 	select NETDEVICES
 	select ETHERNET

From 5a39d1e89a97ac71e7edea633d2f54c4f99186cd Mon Sep 17 00:00:00 2001
From: Zhang Qilong <zhangqilong3@huawei.com>
Date: Fri, 4 Dec 2020 14:35:06 +0100
Subject: [PATCH 1172/2658] can: softing: softing_netdev_open(): fix error
 handling

[ Upstream commit 4d1be581ec6b92a338bb7ed23e1381f45ddf336f ]

If softing_netdev_open() fails, we should call close_candev() to avoid
reference leak.

Fixes: 03fd3cf5a179d ("can: add driver for Softing card")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Acked-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
Link: https://lore.kernel.org/r/20201202151632.1343786-1-zhangqilong3@huawei.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Link: https://lore.kernel.org/r/20201204133508.742120-2-mkl@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/softing/softing_main.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/softing/softing_main.c b/drivers/net/can/softing/softing_main.c
index 7621f91a8a20..fd48770ba792 100644
--- a/drivers/net/can/softing/softing_main.c
+++ b/drivers/net/can/softing/softing_main.c
@@ -393,8 +393,13 @@ static int softing_netdev_open(struct net_device *ndev)
 
 	/* check or determine and set bittime */
 	ret = open_candev(ndev);
-	if (!ret)
-		ret = softing_startstop(ndev, 1);
+	if (ret)
+		return ret;
+
+	ret = softing_startstop(ndev, 1);
+	if (ret < 0)
+		close_candev(ndev);
+
 	return ret;
 }
 

From 8ecb2ee473f41a831be88f5dc1ff8777a02658e1 Mon Sep 17 00:00:00 2001
From: Leon Romanovsky <leonro@nvidia.com>
Date: Fri, 4 Dec 2020 08:42:05 +0200
Subject: [PATCH 1173/2658] RDMA/cm: Fix an attempt to use non-valid pointer
 when cleaning timewait
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 340b940ea0ed12d9adbb8f72dea17d516b2019e8 ]

If cm_create_timewait_info() fails, the timewait_info pointer will contain
an error value and will be used in cm_remove_remote() later.

  general protection fault, probably for non-canonical address 0xdffffc0000000024: 0000 [#1] SMP KASAN PTI
  KASAN: null-ptr-deref in range [0×0000000000000120-0×0000000000000127]
  CPU: 2 PID: 12446 Comm: syz-executor.3 Not tainted 5.10.0-rc5-5d4c0742a60e #27
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
  RIP: 0010:cm_remove_remote.isra.0+0x24/0×170 drivers/infiniband/core/cm.c:978
  Code: 84 00 00 00 00 00 41 54 55 53 48 89 fb 48 8d ab 2d 01 00 00 e8 7d bf 4b fe 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 48 89 ea 83 e2 07 38 d0 7f 08 84 c0 0f 85 fc 00 00 00
  RSP: 0018:ffff888013127918 EFLAGS: 00010006
  RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffc9000a18b000
  RDX: 0000000000000024 RSI: ffffffff82edc573 RDI: fffffffffffffff4
  RBP: 0000000000000121 R08: 0000000000000001 R09: ffffed1002624f1d
  R10: 0000000000000003 R11: ffffed1002624f1c R12: ffff888107760c70
  R13: ffff888107760c40 R14: fffffffffffffff4 R15: ffff888107760c9c
  FS:  00007fe1ffcc1700(0000) GS:ffff88811a600000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000001b2ff21000 CR3: 000000010f504001 CR4: 0000000000370ee0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Call Trace:
   cm_destroy_id+0x189/0×15b0 drivers/infiniband/core/cm.c:1155
   cma_connect_ib drivers/infiniband/core/cma.c:4029 [inline]
   rdma_connect_locked+0x1100/0×17c0 drivers/infiniband/core/cma.c:4107
   rdma_connect+0x2a/0×40 drivers/infiniband/core/cma.c:4140
   ucma_connect+0x277/0×340 drivers/infiniband/core/ucma.c:1069
   ucma_write+0x236/0×2f0 drivers/infiniband/core/ucma.c:1724
   vfs_write+0x220/0×830 fs/read_write.c:603
   ksys_write+0x1df/0×240 fs/read_write.c:658
   do_syscall_64+0x33/0×40 arch/x86/entry/common.c:46
   entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: a977049dacde ("[PATCH] IB: Add the kernel CM implementation")
Link: https://lore.kernel.org/r/20201204064205.145795-1-leon@kernel.org
Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
Reported-by: Amit Matityahu <mitm@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/cm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index 53c622c99ee4..ba713bc27c5f 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -1252,6 +1252,7 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
 							    id.local_id);
 	if (IS_ERR(cm_id_priv->timewait_info)) {
 		ret = PTR_ERR(cm_id_priv->timewait_info);
+		cm_id_priv->timewait_info = NULL;
 		goto out;
 	}
 
@@ -1681,6 +1682,7 @@ static int cm_req_handler(struct cm_work *work)
 							    id.local_id);
 	if (IS_ERR(cm_id_priv->timewait_info)) {
 		ret = PTR_ERR(cm_id_priv->timewait_info);
+		cm_id_priv->timewait_info = NULL;
 		goto destroy;
 	}
 	cm_id_priv->timewait_info->work.remote_id = req_msg->local_comm_id;

From eb82c8c46b863cb89d517c21ff8502cbf82a35aa Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Fri, 13 Nov 2020 15:19:10 +0100
Subject: [PATCH 1174/2658] dm table: Remove BUG_ON(in_interrupt())

[ Upstream commit e7b624183d921b49ef0a96329f21647d38865ee9 ]

The BUG_ON(in_interrupt()) in dm_table_event() is a historic leftover from
a rework of the dm table code which changed the calling context.

Issuing a BUG for a wrong calling context is frowned upon and
in_interrupt() is deprecated and only covering parts of the wrong
contexts. The sanity check for the context is covered by
CONFIG_DEBUG_ATOMIC_SLEEP and other debug facilities already.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-table.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index e82695fc0a8b..3edebf626a03 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1155,12 +1155,6 @@ void dm_table_event_callback(struct dm_table *t,
 
 void dm_table_event(struct dm_table *t)
 {
-	/*
-	 * You can no longer call dm_table_event() from interrupt
-	 * context, use a bottom half instead.
-	 */
-	BUG_ON(in_interrupt());
-
 	mutex_lock(&_event_lock);
 	if (t->event_fn)
 		t->event_fn(t->event_context);

From c0706a5603990024aac9501d3c1e64ddcf347592 Mon Sep 17 00:00:00 2001
From: Nicolin Chen <nicoleotsuka@gmail.com>
Date: Wed, 18 Nov 2020 20:44:57 -0800
Subject: [PATCH 1175/2658] soc/tegra: fuse: Fix index bug in get_process_id

commit b9ce9b0f83b536a4ac7de7567a265d28d13e5bea upstream.

This patch simply fixes a bug of referencing speedos[num] in every
for-loop iteration in get_process_id function.

Fixes: 0dc5a0d83675 ("soc/tegra: fuse: Add Tegra210 support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Nicolin Chen <nicoleotsuka@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/soc/tegra/fuse/speedo-tegra210.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soc/tegra/fuse/speedo-tegra210.c b/drivers/soc/tegra/fuse/speedo-tegra210.c
index 5373f4c16b54..4403b89561fd 100644
--- a/drivers/soc/tegra/fuse/speedo-tegra210.c
+++ b/drivers/soc/tegra/fuse/speedo-tegra210.c
@@ -105,7 +105,7 @@ static int get_process_id(int value, const u32 *speedos, unsigned int num)
 	unsigned int i;
 
 	for (i = 0; i < num; i++)
-		if (value < speedos[num])
+		if (value < speedos[i])
 			return i;
 
 	return -EINVAL;

From 6ce177d161b324a8d81702f6e119a4d09e6dd25c Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 9 Dec 2020 11:42:21 +0100
Subject: [PATCH 1176/2658] USB: serial: option: add interface-number sanity
 check to flag handling

commit a251963f76fa0226d0fdf0c4f989496f18d9ae7f upstream.

Add an interface-number sanity check before testing the device flags to
avoid relying on undefined behaviour when left shifting in case a device
uses an interface number greater than or equal to BITS_PER_LONG (i.e. 64
or 32).

Reported-by: syzbot+8881b478dad0a7971f79@syzkaller.appspotmail.com
Fixes: c3a65808f04a ("USB: serial: option: reimplement interface masking")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index e8643612e9a3..6045a8e24068 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -563,6 +563,9 @@ static void option_instat_callback(struct urb *urb);
 
 /* Device flags */
 
+/* Highest interface number which can be used with NCTRL() and RSVD() */
+#define FLAG_IFNUM_MAX	7
+
 /* Interface does not support modem-control requests */
 #define NCTRL(ifnum)	((BIT(ifnum) & 0xff) << 8)
 
@@ -2086,6 +2089,14 @@ static struct usb_serial_driver * const serial_drivers[] = {
 
 module_usb_serial_driver(serial_drivers, option_ids);
 
+static bool iface_is_reserved(unsigned long device_flags, u8 ifnum)
+{
+	if (ifnum > FLAG_IFNUM_MAX)
+		return false;
+
+	return device_flags & RSVD(ifnum);
+}
+
 static int option_probe(struct usb_serial *serial,
 			const struct usb_device_id *id)
 {
@@ -2103,7 +2114,7 @@ static int option_probe(struct usb_serial *serial,
 	 * the same class/subclass/protocol as the serial interfaces.  Look at
 	 * the Windows driver .INF files for reserved interface numbers.
 	 */
-	if (device_flags & RSVD(iface_desc->bInterfaceNumber))
+	if (iface_is_reserved(device_flags, iface_desc->bInterfaceNumber))
 		return -ENODEV;
 	/*
 	 * Don't bind network interface on Samsung GT-B3730, it is handled by
@@ -2120,6 +2131,14 @@ static int option_probe(struct usb_serial *serial,
 	return 0;
 }
 
+static bool iface_no_modem_control(unsigned long device_flags, u8 ifnum)
+{
+	if (ifnum > FLAG_IFNUM_MAX)
+		return false;
+
+	return device_flags & NCTRL(ifnum);
+}
+
 static int option_attach(struct usb_serial *serial)
 {
 	struct usb_interface_descriptor *iface_desc;
@@ -2135,7 +2154,7 @@ static int option_attach(struct usb_serial *serial)
 
 	iface_desc = &serial->interface->cur_altsetting->desc;
 
-	if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber)))
+	if (!iface_no_modem_control(device_flags, iface_desc->bInterfaceNumber))
 		data->use_send_setup = 1;
 
 	if (device_flags & ZLP)

From e1f7599a26641581bb67f74cb141c898df51fca9 Mon Sep 17 00:00:00 2001
From: Will McVicker <willmcvicker@google.com>
Date: Fri, 27 Nov 2020 15:05:55 +0100
Subject: [PATCH 1177/2658] USB: gadget: f_rndis: fix bitrate for SuperSpeed
 and above

commit b00f444f9add39b64d1943fa75538a1ebd54a290 upstream.

Align the SuperSpeed Plus bitrate for f_rndis to match f_ncm's ncm_bitrate
defined by commit 1650113888fe ("usb: gadget: f_ncm: add SuperSpeed descriptors
for CDC NCM").

Cc: Felipe Balbi <balbi@kernel.org>
Cc: EJ Hsu <ejh@nvidia.com>
Cc: Peter Chen <peter.chen@nxp.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Will McVicker <willmcvicker@google.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20201127140559.381351-2-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/function/f_rndis.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c
index 63f4be80b651..9e1b838ce86f 100644
--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -101,8 +101,10 @@ static inline struct f_rndis *func_to_rndis(struct usb_function *f)
 /* peak (theoretical) bulk transfer rate in bits-per-second */
 static unsigned int bitrate(struct usb_gadget *g)
 {
+	if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS)
+		return 4250000000U;
 	if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER)
-		return 13 * 1024 * 8 * 1000 * 8;
+		return 3750000000U;
 	else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
 		return 13 * 512 * 8 * 1000 * 8;
 	else

From 71b80dac94179cfee0e44c8055cac62e4616416e Mon Sep 17 00:00:00 2001
From: Fabio Estevam <festevam@gmail.com>
Date: Mon, 7 Dec 2020 10:09:09 +0800
Subject: [PATCH 1178/2658] usb: chipidea: ci_hdrc_imx: Pass
 DISABLE_DEVICE_STREAMING flag to imx6ul

commit c7721e15f434920145c376e8fe77e1c079fc3726 upstream.

According to the i.MX6UL Errata document:
https://www.nxp.com/docs/en/errata/IMX6ULCE.pdf

ERR007881 also affects i.MX6UL, so pass the
CI_HDRC_DISABLE_DEVICE_STREAMING flag to workaround the issue.

Fixes: 52fe568e5d71 ("usb: chipidea: imx: add imx6ul usb support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20201207020909.22483-2-peter.chen@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/chipidea/ci_hdrc_imx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
index 2949289bb3c5..97eb52b97605 100644
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -58,7 +58,8 @@ static const struct ci_hdrc_imx_platform_flag imx6sx_usb_data = {
 
 static const struct ci_hdrc_imx_platform_flag imx6ul_usb_data = {
 	.flags = CI_HDRC_SUPPORTS_RUNTIME_PM |
-		CI_HDRC_TURN_VBUS_EARLY_ON,
+		CI_HDRC_TURN_VBUS_EARLY_ON |
+		CI_HDRC_DISABLE_DEVICE_STREAMING,
 };
 
 static const struct ci_hdrc_imx_platform_flag imx7d_usb_data = {

From ec6205b4f5d25270931f7cc074b9b88b2255777e Mon Sep 17 00:00:00 2001
From: Antti Palosaari <crope@iki.fi>
Date: Sat, 17 Aug 2019 03:12:10 +0200
Subject: [PATCH 1179/2658] media: msi2500: assign SPI bus number dynamically

commit 9c60cc797cf72e95bb39f32316e9f0e5f85435f9 upstream.

SPI bus number must be assigned dynamically for each device, otherwise it
will crash when multiple devices are plugged to system.

Reported-and-tested-by: syzbot+c60ddb60b685777d9d59@syzkaller.appspotmail.com

Cc: stable@vger.kernel.org
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/msi2500/msi2500.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/msi2500/msi2500.c b/drivers/media/usb/msi2500/msi2500.c
index e06a21a4fbd9..322238d9aa71 100644
--- a/drivers/media/usb/msi2500/msi2500.c
+++ b/drivers/media/usb/msi2500/msi2500.c
@@ -1254,7 +1254,7 @@ static int msi2500_probe(struct usb_interface *intf,
 	}
 
 	dev->master = master;
-	master->bus_num = 0;
+	master->bus_num = -1;
 	master->num_chipselect = 1;
 	master->transfer_one_message = msi2500_transfer_one_message;
 	spi_master_set_devdata(master, dev);

From 419d116047d48ebfc3f045d72ab32a1581f4d6cc Mon Sep 17 00:00:00 2001
From: Peilin Ye <yepeilin.cs@gmail.com>
Date: Wed, 9 Sep 2020 03:17:00 -0400
Subject: [PATCH 1180/2658] Bluetooth: Fix slab-out-of-bounds read in
 hci_le_direct_adv_report_evt()

commit f7e0e8b2f1b0a09b527885babda3e912ba820798 upstream.

`num_reports` is not being properly checked. A malformed event packet with
a large `num_reports` number makes hci_le_direct_adv_report_evt() read out
of bounds. Fix it.

Cc: stable@vger.kernel.org
Fixes: 2f010b55884e ("Bluetooth: Add support for handling LE Direct Advertising Report events")
Reported-and-tested-by: syzbot+24ebd650e20bd263ca01@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=24ebd650e20bd263ca01
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_event.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 19df2343734f..2e21df43945b 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -5114,20 +5114,18 @@ static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
 					 struct sk_buff *skb)
 {
 	u8 num_reports = skb->data[0];
-	void *ptr = &skb->data[1];
+	struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1];
 
-	hci_dev_lock(hdev);
+	if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1)
+		return;
 
-	while (num_reports--) {
-		struct hci_ev_le_direct_adv_info *ev = ptr;
+	hci_dev_lock(hdev);
 
+	for (; num_reports; num_reports--, ev++)
 		process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
 				   ev->bdaddr_type, &ev->direct_addr,
 				   ev->direct_addr_type, ev->rssi, NULL, 0);
 
-		ptr += sizeof(*ev);
-	}
-
 	hci_dev_unlock(hdev);
 }
 

From 94c6e2b132dbbba8aae2f4ec8c5bd55336acd619 Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Sat, 3 Oct 2020 12:39:28 -0700
Subject: [PATCH 1181/2658] drm/gma500: fix double free of gma_connector

[ Upstream commit 4e19d51ca5b28a1d435a844c7b2a8e1b1b6fa237 ]

clang static analysis reports this problem:

cdv_intel_dp.c:2101:2: warning: Attempt to free released memory
        kfree(gma_connector);
        ^~~~~~~~~~~~~~~~~~~~

In cdv_intel_dp_init() when the call to cdv_intel_edp_panel_vdd_off()
fails, the handler calls cdv_intel_dp_destroy(connector) which does
the first free of gma_connector. So adjust the goto label and skip
the second free.

Fixes: d112a8163f83 ("gma500/cdv: Add eDP support")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20201003193928.18869-1-trix@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c
index 25c68e4dc7a5..e465d7127258 100644
--- a/drivers/gpu/drm/gma500/cdv_intel_dp.c
+++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c
@@ -2125,7 +2125,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev
 			DRM_INFO("failed to retrieve link info, disabling eDP\n");
 			cdv_intel_dp_encoder_destroy(encoder);
 			cdv_intel_dp_destroy(connector);
-			goto err_priv;
+			goto err_connector;
 		} else {
         		DRM_DEBUG_KMS("DPCD: Rev=%x LN_Rate=%x LN_CNT=%x LN_DOWNSP=%x\n",
 				intel_dp->dpcd[0], intel_dp->dpcd[1], 

From f89c0d0162574b4b112d38621e7eea021949e1a7 Mon Sep 17 00:00:00 2001
From: Ard Biesheuvel <ardb@kernel.org>
Date: Mon, 21 Sep 2020 00:10:16 +0200
Subject: [PATCH 1182/2658] ARM: p2v: fix handling of LPAE translation in BE
 mode

[ Upstream commit 4e79f0211b473f8e1eab8211a9fd50cc41a3a061 ]

When running in BE mode on LPAE hardware with a PA-to-VA translation
that exceeds 4 GB, we patch bits 39:32 of the offset into the wrong
byte of the opcode. So fix that, by rotating the offset in r0 to the
right by 8 bits, which will put the 8-bit immediate in bits 31:24.

Note that this will also move bit #22 in its correct place when
applying the rotation to the constant #0x400000.

Fixes: d9a790df8e984 ("ARM: 7883/1: fix mov to mvn conversion in case of 64 bit phys_addr_t and BE")
Acked-by: Nicolas Pitre <nico@fluxnic.net>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/kernel/head.S | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 04286fd9e09c..2e336acd68b0 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -673,12 +673,8 @@ ARM_BE8(rev16	ip, ip)
 	ldrcc	r7, [r4], #4	@ use branch for delay slot
 	bcc	1b
 	bx	lr
-#else
-#ifdef CONFIG_CPU_ENDIAN_BE8
-	moveq	r0, #0x00004000	@ set bit 22, mov to mvn instruction
 #else
 	moveq	r0, #0x400000	@ set bit 22, mov to mvn instruction
-#endif
 	b	2f
 1:	ldr	ip, [r7, r3]
 #ifdef CONFIG_CPU_ENDIAN_BE8
@@ -687,7 +683,7 @@ ARM_BE8(rev16	ip, ip)
 	tst	ip, #0x000f0000	@ check the rotation field
 	orrne	ip, ip, r6, lsl #24 @ mask in offset bits 31-24
 	biceq	ip, ip, #0x00004000 @ clear bit 22
-	orreq	ip, ip, r0      @ mask in offset bits 7-0
+	orreq	ip, ip, r0, ror #8  @ mask in offset bits 7-0
 #else
 	bic	ip, ip, #0x000000ff
 	tst	ip, #0xf00	@ check the rotation field

From 22f5fa6f712b88e81e1bfa23321519214eef20fe Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@csgroup.eu>
Date: Thu, 8 Oct 2020 09:34:56 +0000
Subject: [PATCH 1183/2658] crypto: talitos - Fix return type of
 current_desc_hdr()

[ Upstream commit 0237616173fd363a54bd272aa3bd376faa1d7caa ]

current_desc_hdr() returns a u32 but in fact this is a __be32,
leading to a lot of sparse warnings.

Change the return type to __be32 and ensure it is handled as
sure by the caller.

Fixes: 3e721aeb3df3 ("crypto: talitos - handle descriptor not found in error path")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/talitos.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 1c8857e7db89..cfefa18bca28 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -440,7 +440,7 @@ DEF_TALITOS2_DONE(ch1_3, TALITOS2_ISR_CH_1_3_DONE)
 /*
  * locate current (offending) descriptor
  */
-static u32 current_desc_hdr(struct device *dev, int ch)
+static __be32 current_desc_hdr(struct device *dev, int ch)
 {
 	struct talitos_private *priv = dev_get_drvdata(dev);
 	int tail, iter;
@@ -471,13 +471,13 @@ static u32 current_desc_hdr(struct device *dev, int ch)
 /*
  * user diagnostics; report root cause of error based on execution unit status
  */
-static void report_eu_error(struct device *dev, int ch, u32 desc_hdr)
+static void report_eu_error(struct device *dev, int ch, __be32 desc_hdr)
 {
 	struct talitos_private *priv = dev_get_drvdata(dev);
 	int i;
 
 	if (!desc_hdr)
-		desc_hdr = in_be32(priv->chan[ch].reg + TALITOS_DESCBUF);
+		desc_hdr = cpu_to_be32(in_be32(priv->chan[ch].reg + TALITOS_DESCBUF));
 
 	switch (desc_hdr & DESC_HDR_SEL0_MASK) {
 	case DESC_HDR_SEL0_AFEU:

From c1d2e14512b382c60524a2744228098b3d0db9db Mon Sep 17 00:00:00 2001
From: Zhang Qilong <zhangqilong3@huawei.com>
Date: Mon, 2 Nov 2020 22:56:51 +0800
Subject: [PATCH 1184/2658] spi: img-spfi: fix reference leak in
 img_spfi_resume

[ Upstream commit ee5558a9084584015c8754ffd029ce14a5827fa8 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in img_spfi_resume, so we should fix it.

Fixes: deba25800a12b ("spi: Add driver for IMG SPFI controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201102145651.3875-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-img-spfi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
index c46c0738c734..e58319e58ba4 100644
--- a/drivers/spi/spi-img-spfi.c
+++ b/drivers/spi/spi-img-spfi.c
@@ -773,8 +773,10 @@ static int img_spfi_resume(struct device *dev)
 	int ret;
 
 	ret = pm_runtime_get_sync(dev);
-	if (ret)
+	if (ret) {
+		pm_runtime_put_noidle(dev);
 		return ret;
+	}
 	spfi_reset(spfi);
 	pm_runtime_put(dev);
 

From 8c21545bea41e8a5b6e02b99954e39c9beb7dbd4 Mon Sep 17 00:00:00 2001
From: Cezary Rojewski <cezary.rojewski@intel.com>
Date: Mon, 26 Oct 2020 11:01:29 +0100
Subject: [PATCH 1185/2658] ASoC: pcm: DRAIN support reactivation

[ Upstream commit 4c22b80f61540ea99d9b4af0127315338755f05b ]

soc-pcm's dpcm_fe_dai_do_trigger() supported DRAIN commnad up to kernel
v5.4 where explicit switch(cmd) has been introduced which takes into
account all SNDRV_PCM_TRIGGER_xxx but SNDRV_PCM_TRIGGER_DRAIN. Update
switch statement to reactive support for it.

As DRAIN is somewhat unique by lacking negative/stop counterpart, bring
behaviour of dpcm_fe_dai_do_trigger() for said command back to its
pre-v5.4 state by adding it to START/RESUME/PAUSE_RELEASE group.

Fixes: acbf27746ecf ("ASoC: pcm: update FE/BE trigger order based on the command")
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Link: https://lore.kernel.org/r/20201026100129.8216-1-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/soc-pcm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 459576ad8e05..bb54a22a1695 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -2261,6 +2261,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
 		case SNDRV_PCM_TRIGGER_START:
 		case SNDRV_PCM_TRIGGER_RESUME:
 		case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+		case SNDRV_PCM_TRIGGER_DRAIN:
 			ret = dpcm_dai_trigger_fe_be(substream, cmd, true);
 			break;
 		case SNDRV_PCM_TRIGGER_STOP:
@@ -2278,6 +2279,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
 		case SNDRV_PCM_TRIGGER_START:
 		case SNDRV_PCM_TRIGGER_RESUME:
 		case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+		case SNDRV_PCM_TRIGGER_DRAIN:
 			ret = dpcm_dai_trigger_fe_be(substream, cmd, false);
 			break;
 		case SNDRV_PCM_TRIGGER_STOP:

From 18db8c0e600ff0df85badca411061be4f9e5c5aa Mon Sep 17 00:00:00 2001
From: Anmol Karn <anmol.karan123@gmail.com>
Date: Wed, 30 Sep 2020 19:48:13 +0530
Subject: [PATCH 1186/2658] Bluetooth: Fix null pointer dereference in
 hci_event_packet()

[ Upstream commit 6dfccd13db2ff2b709ef60a50163925d477549aa ]

AMP_MGR is getting derefernced in hci_phy_link_complete_evt(), when called
from hci_event_packet() and there is a possibility, that hcon->amp_mgr may
not be found when accessing after initialization of hcon.

- net/bluetooth/hci_event.c:4945
The bug seems to get triggered in this line:

bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;

Fix it by adding a NULL check for the hcon->amp_mgr before checking the ev-status.

Fixes: d5e911928bd8 ("Bluetooth: AMP: Process Physical Link Complete evt")
Reported-and-tested-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=0bef568258653cff272f
Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_event.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 2e21df43945b..011f05cdca38 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4336,6 +4336,11 @@ static void hci_phy_link_complete_evt(struct hci_dev *hdev,
 		return;
 	}
 
+	if (!hcon->amp_mgr) {
+		hci_dev_unlock(hdev);
+		return;
+	}
+
 	if (ev->status) {
 		hci_conn_del(hcon);
 		hci_dev_unlock(hdev);

From 6f1b36c5615492ab49eb11fca77b2ff24eddee54 Mon Sep 17 00:00:00 2001
From: Zhang Qilong <zhangqilong3@huawei.com>
Date: Tue, 3 Nov 2020 22:09:47 +0800
Subject: [PATCH 1187/2658] spi: spi-ti-qspi: fix reference leak in
 ti_qspi_setup

[ Upstream commit 45c0cba753641e5d7c3207f04241bd0e7a021698 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in ti_qspi_setup, so we should fix it.

Fixes: 505a14954e2d7 ("spi/qspi: Add qspi flash controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103140947.3815-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-ti-qspi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index 5044c6198332..6e97f71a8cea 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -159,6 +159,7 @@ static int ti_qspi_setup(struct spi_device *spi)
 
 	ret = pm_runtime_get_sync(qspi->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(qspi->dev);
 		dev_err(qspi->dev, "pm_runtime_get_sync() failed\n");
 		return ret;
 	}

From f395702b0e614bd230f08b62c0e473402ea964a2 Mon Sep 17 00:00:00 2001
From: Zhang Qilong <zhangqilong3@huawei.com>
Date: Tue, 3 Nov 2020 22:13:45 +0800
Subject: [PATCH 1188/2658] spi: tegra20-slink: fix reference leak in slink ops
 of tegra20

[ Upstream commit 763eab7074f6e71babd85d796156f05a675f9510 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in two callers(tegra_slink_setup and
tegra_slink_resume), so we should fix it.

Fixes: dc4dc36056392 ("spi: tegra: add spi driver for SLINK controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103141345.6188-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra20-slink.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
index cf2a329fd895..9f14560686b6 100644
--- a/drivers/spi/spi-tegra20-slink.c
+++ b/drivers/spi/spi-tegra20-slink.c
@@ -761,6 +761,7 @@ static int tegra_slink_setup(struct spi_device *spi)
 
 	ret = pm_runtime_get_sync(tspi->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(tspi->dev);
 		dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret);
 		return ret;
 	}
@@ -1197,6 +1198,7 @@ static int tegra_slink_resume(struct device *dev)
 
 	ret = pm_runtime_get_sync(dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(dev);
 		dev_err(dev, "pm runtime failed, e = %d\n", ret);
 		return ret;
 	}

From 7abc3bf8788756b1f1cf9e8e08a48e8da52f5c24 Mon Sep 17 00:00:00 2001
From: Zhang Qilong <zhangqilong3@huawei.com>
Date: Tue, 3 Nov 2020 22:13:23 +0800
Subject: [PATCH 1189/2658] spi: tegra20-sflash: fix reference leak in
 tegra_sflash_resume

[ Upstream commit 3482e797ab688da6703fe18d8bad52f94199f4f2 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in tegra_sflash_resume, so we should fix it.

Fixes: 8528547bcc336 ("spi: tegra: add spi driver for sflash controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103141323.5841-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra20-sflash.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c
index b6558bb6f9df..4b9541e1726a 100644
--- a/drivers/spi/spi-tegra20-sflash.c
+++ b/drivers/spi/spi-tegra20-sflash.c
@@ -564,6 +564,7 @@ static int tegra_sflash_resume(struct device *dev)
 
 	ret = pm_runtime_get_sync(dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(dev);
 		dev_err(dev, "pm runtime failed, e = %d\n", ret);
 		return ret;
 	}

From 2bb26e1a4aac3b551326cd2f27d2d5508e01f640 Mon Sep 17 00:00:00 2001
From: Zhang Qilong <zhangqilong3@huawei.com>
Date: Tue, 3 Nov 2020 22:13:06 +0800
Subject: [PATCH 1190/2658] spi: tegra114: fix reference leak in tegra spi ops

[ Upstream commit a042184c7fb99961ea083d4ec192614bec671969 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in two callers(tegra_spi_setup and
tegra_spi_resume), so we should fix it.

Fixes: f333a331adfac ("spi/tegra114: add spi driver")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103141306.5607-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra114.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index e37712bed0b2..d1ca8f619b82 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -801,6 +801,7 @@ static int tegra_spi_setup(struct spi_device *spi)
 
 	ret = pm_runtime_get_sync(tspi->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(tspi->dev);
 		dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret);
 		return ret;
 	}
@@ -1214,6 +1215,7 @@ static int tegra_spi_resume(struct device *dev)
 
 	ret = pm_runtime_get_sync(dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(dev);
 		dev_err(dev, "pm runtime failed, e = %d\n", ret);
 		return ret;
 	}

From 29923ddc33cd2fdcd7ba546484ba36c55be1bdaf Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 26 Oct 2020 22:12:30 +0100
Subject: [PATCH 1191/2658] RDMa/mthca: Work around -Wenum-conversion warning

[ Upstream commit fbb7dc5db6dee553b5a07c27e86364a5223e244c ]

gcc points out a suspicious mixing of enum types in a function that
converts from MTHCA_OPCODE_* values to IB_WC_* values:

drivers/infiniband/hw/mthca/mthca_cq.c: In function 'mthca_poll_one':
drivers/infiniband/hw/mthca/mthca_cq.c:607:21: warning: implicit conversion from 'enum <anonymous>' to 'enum ib_wc_opcode' [-Wenum-conversion]
  607 |    entry->opcode    = MTHCA_OPCODE_INVALID;

Nothing seems to ever check for MTHCA_OPCODE_INVALID again, no idea if
this is meaningful, but it seems harmless as it deals with an invalid
input.

Remove MTHCA_OPCODE_INVALID and set the ib_wc_opcode to 0xFF, which is
still bogus, but at least doesn't make compiler warnings.

Fixes: 2a4443a69934 ("[PATCH] IB/mthca: fill in opcode field for send completions")
Link: https://lore.kernel.org/r/20201026211311.3887003-1-arnd@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/mthca/mthca_cq.c  | 2 +-
 drivers/infiniband/hw/mthca/mthca_dev.h | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
index 59e1f6ea2ede..1b0bb340281e 100644
--- a/drivers/infiniband/hw/mthca/mthca_cq.c
+++ b/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -612,7 +612,7 @@ static inline int mthca_poll_one(struct mthca_dev *dev,
 			entry->opcode    = IB_WC_BIND_MW;
 			break;
 		default:
-			entry->opcode    = MTHCA_OPCODE_INVALID;
+			entry->opcode = 0xFF;
 			break;
 		}
 	} else {
diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h b/drivers/infiniband/hw/mthca/mthca_dev.h
index 4393a022867b..e1fc67e73bf8 100644
--- a/drivers/infiniband/hw/mthca/mthca_dev.h
+++ b/drivers/infiniband/hw/mthca/mthca_dev.h
@@ -105,7 +105,6 @@ enum {
 	MTHCA_OPCODE_ATOMIC_CS      = 0x11,
 	MTHCA_OPCODE_ATOMIC_FA      = 0x12,
 	MTHCA_OPCODE_BIND_MW        = 0x18,
-	MTHCA_OPCODE_INVALID        = 0xff
 };
 
 enum {

From 4577d2a55298cff5dc04e24f777be9972f057374 Mon Sep 17 00:00:00 2001
From: Necip Fazil Yildiran <fazilyildiran@gmail.com>
Date: Tue, 3 Nov 2020 00:34:01 +0300
Subject: [PATCH 1192/2658] MIPS: BCM47XX: fix kconfig dependency bug for
 BCM47XX_BCMA

[ Upstream commit 3a5fe2fb9635c43359c9729352f45044f3c8df6b ]

When BCM47XX_BCMA is enabled and BCMA_DRIVER_PCI is disabled, it results
in the following Kbuild warning:

WARNING: unmet direct dependencies detected for BCMA_DRIVER_PCI_HOSTMODE
  Depends on [n]: MIPS [=y] && BCMA_DRIVER_PCI [=n] && PCI_DRIVERS_LEGACY [=y] && BCMA [=y]=y
  Selected by [y]:
  - BCM47XX_BCMA [=y] && BCM47XX [=y] && PCI [=y]

The reason is that BCM47XX_BCMA selects BCMA_DRIVER_PCI_HOSTMODE without
depending on or selecting BCMA_DRIVER_PCI while BCMA_DRIVER_PCI_HOSTMODE
depends on BCMA_DRIVER_PCI. This can also fail building the kernel.

Honor the kconfig dependency to remove unmet direct dependency warnings
and avoid any potential build failures.

Fixes: c1d1c5d4213e ("bcm47xx: add support for bcma bus")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=209879
Signed-off-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/bcm47xx/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/bcm47xx/Kconfig b/arch/mips/bcm47xx/Kconfig
index e970fd9cf769..7ca7384fd5c9 100644
--- a/arch/mips/bcm47xx/Kconfig
+++ b/arch/mips/bcm47xx/Kconfig
@@ -26,6 +26,7 @@ config BCM47XX_BCMA
 	select BCMA
 	select BCMA_HOST_SOC
 	select BCMA_DRIVER_MIPS
+	select BCMA_DRIVER_PCI if PCI
 	select BCMA_DRIVER_PCI_HOSTMODE if PCI
 	select BCMA_DRIVER_GPIO
 	default y

From 521663253cc6f264406ec3e5e055b7a638cc0f8b Mon Sep 17 00:00:00 2001
From: Qinglang Miao <miaoqinglang@huawei.com>
Date: Wed, 11 Nov 2020 04:22:01 +0100
Subject: [PATCH 1193/2658] media: solo6x10: fix missing snd_card_free in error
 handling case

[ Upstream commit dcdff74fa6bc00c32079d0bebd620764c26f2d89 ]

Fix to goto snd_error in error handling case when fails
to do snd_ctl_add, as done elsewhere in this function.

Fixes: 28cae868cd24 ("[media] solo6x10: move out of staging into drivers/media/pci.")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/pci/solo6x10/solo6x10-g723.c b/drivers/media/pci/solo6x10/solo6x10-g723.c
index 4a37a1c51c48..30407955a4d1 100644
--- a/drivers/media/pci/solo6x10/solo6x10-g723.c
+++ b/drivers/media/pci/solo6x10/solo6x10-g723.c
@@ -385,7 +385,7 @@ int solo_g723_init(struct solo_dev *solo_dev)
 
 	ret = snd_ctl_add(card, snd_ctl_new1(&kctl, solo_dev));
 	if (ret < 0)
-		return ret;
+		goto snd_error;
 
 	ret = solo_snd_pcm_init(solo_dev);
 	if (ret < 0)

From e719f9cf755d2e4a594cde954ebceced639a21aa Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Tue, 17 Nov 2020 14:10:45 +0800
Subject: [PATCH 1194/2658] drm/omap: dmm_tiler: fix return error code in
 omap_dmm_probe()

[ Upstream commit 723ae803218da993143387bf966042eccefac077 ]

Return -ENOMEM when allocating refill memory failed.

Fixes: 71e8831f6407 ("drm/omap: DMM/TILER support for OMAP4+ platform")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20201117061045.3452287-1-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
index 8282ae0c4fc3..bed686279882 100644
--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
@@ -720,6 +720,7 @@ static int omap_dmm_probe(struct platform_device *dev)
 				&omap_dmm->refill_pa, GFP_KERNEL);
 	if (!omap_dmm->refill_va) {
 		dev_err(&dev->dev, "could not allocate refill memory\n");
+		ret = -ENOMEM;
 		goto fail;
 	}
 

From ed09e102e21439549e0ac868c24d628daad1a0f2 Mon Sep 17 00:00:00 2001
From: Oleksij Rempel <o.rempel@pengutronix.de>
Date: Tue, 17 Nov 2020 15:33:24 -0800
Subject: [PATCH 1195/2658] Input: ads7846 - fix integer overflow on Rt
 calculation

[ Upstream commit 820830ec918f6c3dcd77a54a1c6198ab57407916 ]

In some rare cases the 32 bit Rt value will overflow if z2 and x is max,
z1 is minimal value and x_plate_ohms is relatively high (for example 800
ohm). This would happen on some screen age with low pressure.

There are two possible fixes:
- make Rt 64bit
- reorder calculation to avoid overflow

The second variant seems to be preferable, since 64 bit calculation on
32 bit system is a bit more expensive.

Fixes: ffa458c1bd9b6f653008d450f337602f3d52a646 ("spi: ads7846 driver")
Co-developed-by: David Jander <david@protonic.nl>
Signed-off-by: David Jander <david@protonic.nl>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20201113112240.1360-1-o.rempel@pengutronix.de
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/touchscreen/ads7846.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index a61b2153ab8c..b4ded36cc416 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -785,10 +785,11 @@ static void ads7846_report_state(struct ads7846 *ts)
 		/* compute touch pressure resistance using equation #2 */
 		Rt = z2;
 		Rt -= z1;
-		Rt *= x;
 		Rt *= ts->x_plate_ohms;
+		Rt = DIV_ROUND_CLOSEST(Rt, 16);
+		Rt *= x;
 		Rt /= z1;
-		Rt = (Rt + 2047) >> 12;
+		Rt = DIV_ROUND_CLOSEST(Rt, 256);
 	} else {
 		Rt = 0;
 	}

From 2edd026a13848512d3c05140873f053a871abfb6 Mon Sep 17 00:00:00 2001
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: Wed, 11 Nov 2020 17:17:11 -0800
Subject: [PATCH 1196/2658] Input: ads7846 - fix unaligned access on 7845

[ Upstream commit 03e2c9c782f721b661a0e42b1b58f394b5298544 ]

req->sample[1] is not naturally aligned at word boundary, and therefore we
should use get_unaligned_be16() when accessing it.

Fixes: 3eac5c7e44f3 ("Input: ads7846 - extend the driver for ads7845 controller support")
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/touchscreen/ads7846.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index b4ded36cc416..1d98198c4bdf 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -35,6 +35,7 @@
 #include <linux/regulator/consumer.h>
 #include <linux/module.h>
 #include <asm/irq.h>
+#include <asm/unaligned.h>
 
 /*
  * This code has been heavily tested on a Nokia 770, and lightly
@@ -410,7 +411,7 @@ static int ads7845_read12_ser(struct device *dev, unsigned command)
 
 	if (status == 0) {
 		/* BE12 value, then padding */
-		status = be16_to_cpu(*((u16 *)&req->sample[1]));
+		status = get_unaligned_be16(&req->sample[1]);
 		status = status >> 3;
 		status &= 0x0fff;
 	}

From 37617b426e57eeb91753237b1a802d2ae6b03178 Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@csgroup.eu>
Date: Tue, 3 Nov 2020 18:07:12 +0000
Subject: [PATCH 1197/2658] powerpc/feature: Fix CPU_FTRS_ALWAYS by removing
 CPU_FTRS_GENERIC_32

[ Upstream commit 78665179e569c7e1fe102fb6c21d0f5b6951f084 ]

On 8xx, we get the following features:

[    0.000000] cpu_features      = 0x0000000000000100
[    0.000000]   possible        = 0x0000000000000120
[    0.000000]   always          = 0x0000000000000000

This is not correct. As CONFIG_PPC_8xx is mutually exclusive with all
other configurations, the three lines should be equal.

The problem is due to CPU_FTRS_GENERIC_32 which is taken when
CONFIG_BOOK3S_32 is NOT selected. This CPU_FTRS_GENERIC_32 is
pointless because there is no generic configuration supporting
all 32 bits but book3s/32.

Remove this pointless generic features definition to unbreak the
calculation of 'possible' features and 'always' features.

Fixes: 76bc080ef5a3 ("[POWERPC] Make default cputable entries reflect selected CPU family")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/76a85f30bf981d1aeaae00df99321235494da254.1604426550.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/cputable.h | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
index b118072670fb..9fe3f05000e3 100644
--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -400,7 +400,6 @@ enum {
 	    CPU_FTR_DBELL | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \
 	    CPU_FTR_DEBUG_LVL_EXC | CPU_FTR_EMB_HV | CPU_FTR_ALTIVEC_COMP | \
 	    CPU_FTR_CELL_TB_BUG | CPU_FTR_SMT)
-#define CPU_FTRS_GENERIC_32	(CPU_FTR_COMMON | CPU_FTR_NODSISRALIGN)
 
 /* 64-bit CPUs */
 #define CPU_FTRS_POWER4	(CPU_FTR_USE_TB | CPU_FTR_LWSYNC | \
@@ -479,8 +478,6 @@ enum {
 	    CPU_FTRS_7447 | CPU_FTRS_7447A | CPU_FTRS_82XX |
 	    CPU_FTRS_G2_LE | CPU_FTRS_E300 | CPU_FTRS_E300C2 |
 	    CPU_FTRS_CLASSIC32 |
-#else
-	    CPU_FTRS_GENERIC_32 |
 #endif
 #ifdef CONFIG_8xx
 	    CPU_FTRS_8XX |
@@ -530,8 +527,6 @@ enum {
 	    CPU_FTRS_7447 & CPU_FTRS_7447A & CPU_FTRS_82XX &
 	    CPU_FTRS_G2_LE & CPU_FTRS_E300 & CPU_FTRS_E300C2 &
 	    CPU_FTRS_CLASSIC32 &
-#else
-	    CPU_FTRS_GENERIC_32 &
 #endif
 #ifdef CONFIG_8xx
 	    CPU_FTRS_8XX &

From b82665d816d36cdfb7c1c70e6a692672e06f8605 Mon Sep 17 00:00:00 2001
From: Zhang Qilong <zhangqilong3@huawei.com>
Date: Sat, 21 Nov 2020 19:22:00 -0800
Subject: [PATCH 1198/2658] soc: ti: knav_qmss: fix reference leak in
 knav_queue_probe

[ Upstream commit ec8684847d8062496c4619bc3fcff31c19d56847 ]

pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in knav_queue_probe, so we should fix it.

Fixes: 41f93af900a20 ("soc: ti: add Keystone Navigator QMSS driver")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/ti/knav_qmss_queue.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index 8c03a80b482d..3a3bc8ef532a 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -1717,6 +1717,7 @@ static int knav_queue_probe(struct platform_device *pdev)
 	pm_runtime_enable(&pdev->dev);
 	ret = pm_runtime_get_sync(&pdev->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(&pdev->dev);
 		dev_err(dev, "Failed to enable QMSS\n");
 		return ret;
 	}

From b8414c4a259555bdd6b9f94d50c7b3624adf945f Mon Sep 17 00:00:00 2001
From: Zhang Qilong <zhangqilong3@huawei.com>
Date: Sat, 21 Nov 2020 19:22:37 -0800
Subject: [PATCH 1199/2658] soc: ti: Fix reference imbalance in knav_dma_probe

[ Upstream commit b4fa73358c306d747a2200aec6f7acb97e5750e6 ]

The patch fix two reference leak.

  1) pm_runtime_get_sync will increment pm usage counter even it
     failed. Forgetting to call put operation will result in
     reference leak.

  2) The pm_runtime_enable will increase power disable depth. Thus
     a pairing decrement is needed on the error handling path to
     keep it balanced.

We fix it by: 1) adding call pm_runtime_put_noidle or
pm_runtime_put_sync in error handling. 2) adding pm_runtime_disable
in error handling, to keep usage counter and disable depth balanced.

Fixes: 88139ed030583 ("soc: ti: add Keystone Navigator DMA support")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/ti/knav_dma.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/ti/knav_dma.c b/drivers/soc/ti/knav_dma.c
index bc1b80ec6afe..838b87adf48b 100644
--- a/drivers/soc/ti/knav_dma.c
+++ b/drivers/soc/ti/knav_dma.c
@@ -752,8 +752,9 @@ static int knav_dma_probe(struct platform_device *pdev)
 	pm_runtime_enable(kdev->dev);
 	ret = pm_runtime_get_sync(kdev->dev);
 	if (ret < 0) {
+		pm_runtime_put_noidle(kdev->dev);
 		dev_err(kdev->dev, "unable to enable pktdma, err %d\n", ret);
-		return ret;
+		goto err_pm_disable;
 	}
 
 	/* Initialise all packet dmas */
@@ -767,13 +768,21 @@ static int knav_dma_probe(struct platform_device *pdev)
 
 	if (list_empty(&kdev->list)) {
 		dev_err(dev, "no valid dma instance\n");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto err_put_sync;
 	}
 
 	debugfs_create_file("knav_dma", S_IFREG | S_IRUGO, NULL, NULL,
 			    &knav_dma_debug_ops);
 
 	return ret;
+
+err_put_sync:
+	pm_runtime_put_sync(kdev->dev);
+err_pm_disable:
+	pm_runtime_disable(kdev->dev);
+
+	return ret;
 }
 
 static int knav_dma_remove(struct platform_device *pdev)

From a81400eae323d894eabce3e2d73555cee661bf6c Mon Sep 17 00:00:00 2001
From: Zhihao Cheng <chengzhihao1@huawei.com>
Date: Sat, 21 Nov 2020 19:22:38 -0800
Subject: [PATCH 1200/2658] drivers: soc: ti: knav_qmss_queue: Fix error return
 code in knav_queue_probe

[ Upstream commit 4cba398f37f868f515ff12868418dc28574853a1 ]

Fix to return the error code from of_get_child_by_name() instaed of 0
in knav_queue_probe().

Fixes: 41f93af900a20d1a0a ("soc: ti: add Keystone Navigator QMSS driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/ti/knav_qmss_queue.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index 3a3bc8ef532a..1aff6659655e 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -1785,9 +1785,10 @@ static int knav_queue_probe(struct platform_device *pdev)
 	if (ret)
 		goto err;
 
-	regions =  of_get_child_by_name(node, "descriptor-regions");
+	regions = of_get_child_by_name(node, "descriptor-regions");
 	if (!regions) {
 		dev_err(dev, "descriptor-regions not specified\n");
+		ret = -ENODEV;
 		goto err;
 	}
 	ret = knav_queue_setup_regions(kdev, regions);

From ea21f4536b8c51654a360928b858e8466ecdc2f4 Mon Sep 17 00:00:00 2001
From: Qinglang Miao <miaoqinglang@huawei.com>
Date: Fri, 20 Nov 2020 15:48:46 +0800
Subject: [PATCH 1201/2658] memstick: fix a double-free bug in memstick_check

[ Upstream commit e3e9ced5c93803d5b2ea1942c4bf0192622531d6 ]

kfree(host->card) has been called in put_device so that
another kfree would raise cause a double-free bug.

Fixes: 0193383a5833 ("memstick: core: fix device_register() error handling")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Link: https://lore.kernel.org/r/20201120074846.31322-1-miaoqinglang@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memstick/core/memstick.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
index 1041eb7a6167..2cae85a7ca6d 100644
--- a/drivers/memstick/core/memstick.c
+++ b/drivers/memstick/core/memstick.c
@@ -469,7 +469,6 @@ static void memstick_check(struct work_struct *work)
 			host->card = card;
 			if (device_register(&card->dev)) {
 				put_device(&card->dev);
-				kfree(host->card);
 				host->card = NULL;
 			}
 		} else

From 3580909f210b477c8b89b866269bc3882c8b5a97 Mon Sep 17 00:00:00 2001
From: Cristian Birsan <cristian.birsan@microchip.com>
Date: Wed, 18 Nov 2020 14:00:18 +0200
Subject: [PATCH 1202/2658] ARM: dts: at91: sama5d4_xplained: add pincontrol
 for USB Host

[ Upstream commit be4dd2d448816a27c1446f8f37fce375daf64148 ]

The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without
it the driver probes but VBus is not powered because of wrong pincontrol
configuration.

Fixes: 38153a017896f ("ARM: at91/dt: sama5d4: add dts for sama5d4 xplained board")
Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Link: https://lore.kernel.org/r/20201118120019.1257580-3-cristian.birsan@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/at91-sama5d4_xplained.dts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
index e27024cdf48b..17adaa1a65c1 100644
--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
@@ -152,6 +152,11 @@
 						atmel,pins =
 							<AT91_PIOE 31 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>;
 					};
+					pinctrl_usb_default: usb_default {
+						atmel,pins =
+							<AT91_PIOE 11 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
+							 AT91_PIOE 14 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+					};
 					pinctrl_key_gpio: key_gpio_0 {
 						atmel,pins =
 							<AT91_PIOE 8 AT91_PERIPH_GPIO AT91_PINCTRL_PULL_UP_DEGLITCH>;
@@ -177,6 +182,8 @@
 					   &pioE 11 GPIO_ACTIVE_HIGH
 					   &pioE 14 GPIO_ACTIVE_HIGH
 					  >;
+			pinctrl-names = "default";
+			pinctrl-0 = <&pinctrl_usb_default>;
 			status = "okay";
 		};
 

From 208c93a3c8159a7d9c1d267c1ff91fcb62576f65 Mon Sep 17 00:00:00 2001
From: Cristian Birsan <cristian.birsan@microchip.com>
Date: Wed, 18 Nov 2020 14:00:19 +0200
Subject: [PATCH 1203/2658] ARM: dts: at91: sama5d3_xplained: add pincontrol
 for USB Host

[ Upstream commit e1062fa7292f1e3744db0a487c4ac0109e09b03d ]

The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without
it the driver probes but VBus is not powered because of wrong pincontrol
configuration.

Fixes: b7c2b61570798 ("ARM: at91: add Atmel's SAMA5D3 Xplained board")
Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Link: https://lore.kernel.org/r/20201118120019.1257580-4-cristian.birsan@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/at91-sama5d3_xplained.dts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
index 0bd325c314e1..2b882d129b16 100644
--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
@@ -231,6 +231,11 @@
 						atmel,pins =
 							<AT91_PIOE 9 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>;	/* PE9, conflicts with A9 */
 					};
+					pinctrl_usb_default: usb_default {
+						atmel,pins =
+							<AT91_PIOE 3 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
+							 AT91_PIOE 4 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+					};
 				};
 			};
 		};
@@ -288,6 +293,8 @@
 					   &pioE 3 GPIO_ACTIVE_LOW
 					   &pioE 4 GPIO_ACTIVE_LOW
 					  >;
+			pinctrl-names = "default";
+			pinctrl-0 = <&pinctrl_usb_default>;
 			status = "okay";
 		};
 

From f0d1aecdfb3dfede6f41ff4142b487b98e494570 Mon Sep 17 00:00:00 2001
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date: Fri, 13 Nov 2020 22:22:43 +0100
Subject: [PATCH 1204/2658] orinoco: Move context allocation after processing
 the skb

[ Upstream commit a31eb615646a63370aa1da1053c45439c7653d83 ]

ezusb_xmit() allocates a context which is leaked if
orinoco_process_xmit_skb() returns an error.

Move ezusb_alloc_ctx() after the invocation of
orinoco_process_xmit_skb() because the context is not needed so early.
ezusb_access_ltv() will cleanup the context in case of an error.

Fixes: bac6fafd4d6a0 ("orinoco: refactor xmit path")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201113212252.2243570-2-bigeasy@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/orinoco/orinoco_usb.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/orinoco/orinoco_usb.c b/drivers/net/wireless/orinoco/orinoco_usb.c
index 3c5baccd6792..8eb73d54b1d6 100644
--- a/drivers/net/wireless/orinoco/orinoco_usb.c
+++ b/drivers/net/wireless/orinoco/orinoco_usb.c
@@ -1224,13 +1224,6 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
 	if (skb->len < ETH_HLEN)
 		goto drop;
 
-	ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
-	if (!ctx)
-		goto busy;
-
-	memset(ctx->buf, 0, BULK_BUF_SIZE);
-	buf = ctx->buf->data;
-
 	tx_control = 0;
 
 	err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control,
@@ -1238,6 +1231,13 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
 	if (err)
 		goto drop;
 
+	ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
+	if (!ctx)
+		goto drop;
+
+	memset(ctx->buf, 0, BULK_BUF_SIZE);
+	buf = ctx->buf->data;
+
 	{
 		__le16 *tx_cntl = (__le16 *)buf;
 		*tx_cntl = cpu_to_le16(tx_control);

From f96a491f2e5312676ecc53042996490dd60631f7 Mon Sep 17 00:00:00 2001
From: Qinglang Miao <miaoqinglang@huawei.com>
Date: Thu, 19 Nov 2020 15:08:42 +0800
Subject: [PATCH 1205/2658] cw1200: fix missing destroy_workqueue() on error in
 cw1200_init_common

[ Upstream commit 7ec8a926188eb8e7a3cbaca43ec44f2d7146d71b ]

Add the missing destroy_workqueue() before return from
cw1200_init_common in the error handling case.

Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201119070842.1011-1-miaoqinglang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/cw1200/main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/cw1200/main.c b/drivers/net/wireless/cw1200/main.c
index 317daa968e03..057725b06f64 100644
--- a/drivers/net/wireless/cw1200/main.c
+++ b/drivers/net/wireless/cw1200/main.c
@@ -385,6 +385,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
 				    CW1200_LINK_ID_MAX,
 				    cw1200_skb_dtor,
 				    priv)) {
+		destroy_workqueue(priv->workqueue);
 		ieee80211_free_hw(hw);
 		return NULL;
 	}
@@ -396,6 +397,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
 			for (; i > 0; i--)
 				cw1200_queue_deinit(&priv->tx_queue[i - 1]);
 			cw1200_queue_stats_deinit(&priv->tx_queue_stats);
+			destroy_workqueue(priv->workqueue);
 			ieee80211_free_hw(hw);
 			return NULL;
 		}

From 0dbfb1aa1123d075d90ba54913d0c5cc934d304e Mon Sep 17 00:00:00 2001
From: Qinglang Miao <miaoqinglang@huawei.com>
Date: Fri, 20 Nov 2020 15:48:47 +0800
Subject: [PATCH 1206/2658] mips: cdmm: fix use-after-free in
 mips_cdmm_bus_discover

[ Upstream commit f0e82242b16826077a2775eacfe201d803bb7a22 ]

kfree(dev) has been called inside put_device so anther
kfree would cause a use-after-free bug/

Fixes: 8286ae03308c ("MIPS: Add CDMM bus support")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Acked-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bus/mips_cdmm.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/bus/mips_cdmm.c b/drivers/bus/mips_cdmm.c
index 1c543effe062..e6284fc1689b 100644
--- a/drivers/bus/mips_cdmm.c
+++ b/drivers/bus/mips_cdmm.c
@@ -544,10 +544,8 @@ static void mips_cdmm_bus_discover(struct mips_cdmm_bus *bus)
 		dev_set_name(&dev->dev, "cdmm%u-%u", cpu, id);
 		++id;
 		ret = device_register(&dev->dev);
-		if (ret) {
+		if (ret)
 			put_device(&dev->dev);
-			kfree(dev);
-		}
 	}
 }
 

From 2df5699ba4b86f47d6c9de3f65fddf94bea5cfeb Mon Sep 17 00:00:00 2001
From: Olga Kornievskaia <kolga@netapp.com>
Date: Fri, 6 Nov 2020 16:03:38 -0500
Subject: [PATCH 1207/2658] NFSv4.2: condition READDIR's mask for security
 label based on LSM state

[ Upstream commit 05ad917561fca39a03338cb21fe9622f998b0f9c ]

Currently, the client will always ask for security_labels if the server
returns that it supports that feature regardless of any LSM modules
(such as Selinux) enforcing security policy. This adds performance
penalty to the READDIR operation.

Client adjusts superblock's support of the security_label based on
the server's support but also current client's configuration of the
LSM modules. Thus, prior to using the default bitmask in READDIR,
this patch checks the server's capabilities and then instructs
READDIR to remove FATTR4_WORD2_SECURITY_LABEL from the bitmask.

v5: fixing silly mistakes of the rushed v4
v4: simplifying logic
v3: changing label's initialization per Ondrej's comment
v2: dropping selinux hook and using the sb cap.

Suggested-by: Ondrej Mosnacek <omosnace@redhat.com>
Suggested-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Fixes: 2b0143b5c986 ("VFS: normal filesystems (and lustre): d_inode() annotations")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs4proc.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 64d15c2662db..3c15291ba1aa 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -4047,12 +4047,12 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
 		u64 cookie, struct page **pages, unsigned int count, int plus)
 {
 	struct inode		*dir = d_inode(dentry);
+	struct nfs_server	*server = NFS_SERVER(dir);
 	struct nfs4_readdir_arg args = {
 		.fh = NFS_FH(dir),
 		.pages = pages,
 		.pgbase = 0,
 		.count = count,
-		.bitmask = NFS_SERVER(d_inode(dentry))->attr_bitmask,
 		.plus = plus,
 	};
 	struct nfs4_readdir_res res;
@@ -4067,9 +4067,15 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
 	dprintk("%s: dentry = %pd2, cookie = %Lu\n", __func__,
 			dentry,
 			(unsigned long long)cookie);
+	if (!(server->caps & NFS_CAP_SECURITY_LABEL))
+		args.bitmask = server->attr_bitmask_nl;
+	else
+		args.bitmask = server->attr_bitmask;
+
 	nfs4_setup_readdir(cookie, NFS_I(dir)->cookieverf, dentry, &args);
 	res.pgbase = args.pgbase;
-	status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &msg, &args.seq_args, &res.seq_res, 0);
+	status = nfs4_call_sync(server->client, server, &msg, &args.seq_args,
+			&res.seq_res, 0);
 	if (status >= 0) {
 		memcpy(NFS_I(dir)->cookieverf, res.verifier.data, NFS4_VERIFIER_SIZE);
 		status += args.pgbase;

From c908c0dd8de561ae5153ead3ece416a19dd876cc Mon Sep 17 00:00:00 2001
From: Calum Mackay <calum.mackay@oracle.com>
Date: Wed, 28 Oct 2020 20:16:27 +0000
Subject: [PATCH 1208/2658] lockd: don't use interval-based rebinding over TCP

[ Upstream commit 9b82d88d5976e5f2b8015d58913654856576ace5 ]

NLM uses an interval-based rebinding, i.e. it clears the transport's
binding under certain conditions if more than 60 seconds have elapsed
since the connection was last bound.

This rebinding is not necessary for an autobind RPC client over a
connection-oriented protocol like TCP.

It can also cause problems: it is possible for nlm_bind_host() to clear
XPRT_BOUND whilst a connection worker is in the middle of trying to
reconnect, after it had already been checked in xprt_connect().

When the connection worker notices that XPRT_BOUND has been cleared
under it, in xs_tcp_finish_connecting(), that results in:

	xs_tcp_setup_socket: connect returned unhandled error -107

Worse, it's possible that the two can get into lockstep, resulting in
the same behaviour repeated indefinitely, with the above error every
300 seconds, without ever recovering, and the connection never being
established. This has been seen in practice, with a large number of NLM
client tasks, following a server restart.

The existing callers of nlm_bind_host & nlm_rebind_host should not need
to force the rebind, for TCP, so restrict the interval-based rebinding
to UDP only.

For TCP, we will still rebind when needed, e.g. on timeout, and connection
error (including closure), since connection-related errors on an existing
connection, ECONNREFUSED when trying to connect, and rpc_check_timeout(),
already unconditionally clear XPRT_BOUND.

To avoid having to add the fix, and explanation, to both nlm_bind_host()
and nlm_rebind_host(), remove the duplicate code from the former, and
have it call the latter.

Drop the dprintk, which adds no value over a trace.

Signed-off-by: Calum Mackay <calum.mackay@oracle.com>
Fixes: 35f5a422ce1a ("SUNRPC: new interface to force an RPC rebind")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/lockd/host.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/fs/lockd/host.c b/fs/lockd/host.c
index c7eb47f2fb6c..603fa652b965 100644
--- a/fs/lockd/host.c
+++ b/fs/lockd/host.c
@@ -430,12 +430,7 @@ nlm_bind_host(struct nlm_host *host)
 	 * RPC rebind is required
 	 */
 	if ((clnt = host->h_rpcclnt) != NULL) {
-		if (time_after_eq(jiffies, host->h_nextrebind)) {
-			rpc_force_rebind(clnt);
-			host->h_nextrebind = jiffies + NLM_HOST_REBIND;
-			dprintk("lockd: next rebind in %lu jiffies\n",
-					host->h_nextrebind - jiffies);
-		}
+		nlm_rebind_host(host);
 	} else {
 		unsigned long increment = nlmsvc_timeout;
 		struct rpc_timeout timeparms = {
@@ -483,13 +478,20 @@ nlm_bind_host(struct nlm_host *host)
 	return clnt;
 }
 
-/*
- * Force a portmap lookup of the remote lockd port
+/**
+ * nlm_rebind_host - If needed, force a portmap lookup of the peer's lockd port
+ * @host: NLM host handle for peer
+ *
+ * This is not needed when using a connection-oriented protocol, such as TCP.
+ * The existing autobind mechanism is sufficient to force a rebind when
+ * required, e.g. on connection state transitions.
  */
 void
 nlm_rebind_host(struct nlm_host *host)
 {
-	dprintk("lockd: rebind host %s\n", host->h_name);
+	if (host->h_proto != IPPROTO_UDP)
+		return;
+
 	if (host->h_rpcclnt && time_after_eq(jiffies, host->h_nextrebind)) {
 		rpc_force_rebind(host->h_rpcclnt);
 		host->h_nextrebind = jiffies + NLM_HOST_REBIND;

From 770d5e375189e1eeacdb48a2a362b9dad8f516fd Mon Sep 17 00:00:00 2001
From: NeilBrown <neilb@suse.de>
Date: Fri, 27 Nov 2020 11:24:33 +1100
Subject: [PATCH 1209/2658] NFS: switch nfsiod to be an UNBOUND workqueue.

[ Upstream commit bf701b765eaa82dd164d65edc5747ec7288bb5c3 ]

nfsiod is currently a concurrency-managed workqueue (CMWQ).
This means that workitems scheduled to nfsiod on a given CPU are queued
behind all other work items queued on any CMWQ on the same CPU.  This
can introduce unexpected latency.

Occaionally nfsiod can even cause excessive latency.  If the work item
to complete a CLOSE request calls the final iput() on an inode, the
address_space of that inode will be dismantled.  This takes time
proportional to the number of in-memory pages, which on a large host
working on large files (e.g..  5TB), can be a large number of pages
resulting in a noticable number of seconds.

We can avoid these latency problems by switching nfsiod to WQ_UNBOUND.
This causes each concurrent work item to gets a dedicated thread which
can be scheduled to an idle CPU.

There is precedent for this as several other filesystems use WQ_UNBOUND
workqueue for handling various async events.

Signed-off-by: NeilBrown <neilb@suse.de>
Fixes: ada609ee2ac2 ("workqueue: use WQ_MEM_RECLAIM instead of WQ_RESCUER")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index d25b55ceb9d5..b15236641191 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -1964,7 +1964,7 @@ static int nfsiod_start(void)
 {
 	struct workqueue_struct *wq;
 	dprintk("RPC:       creating workqueue nfsiod\n");
-	wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM, 0);
+	wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM | WQ_UNBOUND, 0);
 	if (wq == NULL)
 		return -ENOMEM;
 	nfsiod_workqueue = wq;

From f46f162f0e0bad18dee27e1e3d690dc86afbd390 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 17 Nov 2020 08:23:40 +0100
Subject: [PATCH 1210/2658] media: saa7146: fix array overflow in
 vidioc_s_audio()

[ Upstream commit 8e4d86e241cf035d6d3467cd346e7ce490681937 ]

The "a->index" value comes from the user via the ioctl.  The problem is
that the shift can wrap resulting in setting "mxb->cur_audinput" to an
invalid value, which later results in an array overflow.

Fixes: 6680427791c9 ("[media] mxb: fix audio handling")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/saa7146/mxb.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/drivers/media/pci/saa7146/mxb.c b/drivers/media/pci/saa7146/mxb.c
index 0ca1e07ae783..868af73c5536 100644
--- a/drivers/media/pci/saa7146/mxb.c
+++ b/drivers/media/pci/saa7146/mxb.c
@@ -652,16 +652,17 @@ static int vidioc_s_audio(struct file *file, void *fh, const struct v4l2_audio *
 	struct mxb *mxb = (struct mxb *)dev->ext_priv;
 
 	DEB_D("VIDIOC_S_AUDIO %d\n", a->index);
-	if (mxb_inputs[mxb->cur_input].audioset & (1 << a->index)) {
-		if (mxb->cur_audinput != a->index) {
-			mxb->cur_audinput = a->index;
-			tea6420_route(mxb, a->index);
-			if (mxb->cur_audinput == 0)
-				mxb_update_audmode(mxb);
-		}
-		return 0;
+	if (a->index >= 32 ||
+	    !(mxb_inputs[mxb->cur_input].audioset & (1 << a->index)))
+		return -EINVAL;
+
+	if (mxb->cur_audinput != a->index) {
+		mxb->cur_audinput = a->index;
+		tea6420_route(mxb, a->index);
+		if (mxb->cur_audinput == 0)
+			mxb_update_audmode(mxb);
 	}
-	return -EINVAL;
+	return 0;
 }
 
 #ifdef CONFIG_VIDEO_ADV_DEBUG

From 33a507a4e846ca32064b3762dce82d1983226951 Mon Sep 17 00:00:00 2001
From: Yu Kuai <yukuai3@huawei.com>
Date: Thu, 19 Nov 2020 09:12:19 +0800
Subject: [PATCH 1211/2658] pinctrl: falcon: add missing put_device() call in
 pinctrl_falcon_probe()

[ Upstream commit 89cce2b3f247a434ee174ab6803698041df98014 ]

if of_find_device_by_node() succeed, pinctrl_falcon_probe() doesn't have
a corresponding put_device(). Thus add put_device() to fix the exception
handling for this function implementation.

Fixes: e316cb2b16bb ("OF: pinctrl: MIPS: lantiq: adds support for FALCON SoC")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20201119011219.2248232-1-yukuai3@huawei.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/pinctrl-falcon.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/pinctrl/pinctrl-falcon.c b/drivers/pinctrl/pinctrl-falcon.c
index 0b0fc2eb48e0..adcdb0585d39 100644
--- a/drivers/pinctrl/pinctrl-falcon.c
+++ b/drivers/pinctrl/pinctrl-falcon.c
@@ -438,24 +438,28 @@ static int pinctrl_falcon_probe(struct platform_device *pdev)
 
 	/* load and remap the pad resources of the different banks */
 	for_each_compatible_node(np, NULL, "lantiq,pad-falcon") {
-		struct platform_device *ppdev = of_find_device_by_node(np);
 		const __be32 *bank = of_get_property(np, "lantiq,bank", NULL);
 		struct resource res;
+		struct platform_device *ppdev;
 		u32 avail;
 		int pins;
 
 		if (!of_device_is_available(np))
 			continue;
 
-		if (!ppdev) {
-			dev_err(&pdev->dev, "failed to find pad pdev\n");
-			continue;
-		}
 		if (!bank || *bank >= PORTS)
 			continue;
 		if (of_address_to_resource(np, 0, &res))
 			continue;
+
+		ppdev = of_find_device_by_node(np);
+		if (!ppdev) {
+			dev_err(&pdev->dev, "failed to find pad pdev\n");
+			continue;
+		}
+
 		falcon_info.clk[*bank] = clk_get(&ppdev->dev, NULL);
+		put_device(&ppdev->dev);
 		if (IS_ERR(falcon_info.clk[*bank])) {
 			dev_err(&ppdev->dev, "failed to get clock\n");
 			return PTR_ERR(falcon_info.clk[*bank]);

From dbfaf17685ca3c620ae7cbfcf991edb887cbd993 Mon Sep 17 00:00:00 2001
From: Jing Xiangfeng <jingxiangfeng@huawei.com>
Date: Wed, 25 Nov 2020 09:47:18 +0800
Subject: [PATCH 1212/2658] memstick: r592: Fix error return in r592_probe()

[ Upstream commit db29d3d1c2451e673e29c7257471e3ce9d50383a ]

Fix to return a error code from the error handling case instead of 0.

Fixes: 926341250102 ("memstick: add driver for Ricoh R5C592 card reader")
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Link: https://lore.kernel.org/r/20201125014718.153563-1-jingxiangfeng@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memstick/host/r592.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
index ef09ba0289d7..b3857445d673 100644
--- a/drivers/memstick/host/r592.c
+++ b/drivers/memstick/host/r592.c
@@ -763,8 +763,10 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		goto error3;
 
 	dev->mmio = pci_ioremap_bar(pdev, 0);
-	if (!dev->mmio)
+	if (!dev->mmio) {
+		error = -ENOMEM;
 		goto error4;
+	}
 
 	dev->irq = pdev->irq;
 	spin_lock_init(&dev->irq_lock);
@@ -791,12 +793,14 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		&dev->dummy_dma_page_physical_address, GFP_KERNEL);
 	r592_stop_dma(dev , 0);
 
-	if (request_irq(dev->irq, &r592_irq, IRQF_SHARED,
-			  DRV_NAME, dev))
+	error = request_irq(dev->irq, &r592_irq, IRQF_SHARED,
+			  DRV_NAME, dev);
+	if (error)
 		goto error6;
 
 	r592_update_card_detect(dev);
-	if (memstick_add_host(host))
+	error = memstick_add_host(host);
+	if (error)
 		goto error7;
 
 	message("driver successfully loaded");

From 2ef9cd0e56f160b2d62063f977d087c836784d4a Mon Sep 17 00:00:00 2001
From: Chuhong Yuan <hslester96@gmail.com>
Date: Thu, 3 Dec 2020 22:42:27 +0800
Subject: [PATCH 1213/2658] ASoC: jz4740-i2s: add missed checks for clk_get()

[ Upstream commit 1c1fb2653a0c2e3f310c07eacd8fc3a10e08c97a ]

jz4740_i2s_set_sysclk() does not check the return values of clk_get(),
while the file dereferences the pointers in clk_put().
Add the missed checks to fix it.

Fixes: 11bd3dd1b7c2 ("ASoC: Add JZ4740 ASoC support")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Link: https://lore.kernel.org/r/20201203144227.418194-1-hslester96@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/jz4740/jz4740-i2s.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/soc/jz4740/jz4740-i2s.c b/sound/soc/jz4740/jz4740-i2s.c
index 0dc1ab48fceb..6440729facaf 100644
--- a/sound/soc/jz4740/jz4740-i2s.c
+++ b/sound/soc/jz4740/jz4740-i2s.c
@@ -315,10 +315,14 @@ static int jz4740_i2s_set_sysclk(struct snd_soc_dai *dai, int clk_id,
 	switch (clk_id) {
 	case JZ4740_I2S_CLKSRC_EXT:
 		parent = clk_get(NULL, "ext");
+		if (IS_ERR(parent))
+			return PTR_ERR(parent);
 		clk_set_parent(i2s->clk_i2s, parent);
 		break;
 	case JZ4740_I2S_CLKSRC_PLL:
 		parent = clk_get(NULL, "pll half");
+		if (IS_ERR(parent))
+			return PTR_ERR(parent);
 		clk_set_parent(i2s->clk_i2s, parent);
 		ret = clk_set_rate(i2s->clk_i2s, freq);
 		break;

From 7353b14da2f21097eb33a9ea588a17389fcaa719 Mon Sep 17 00:00:00 2001
From: Qinglang Miao <miaoqinglang@huawei.com>
Date: Sat, 28 Nov 2020 18:19:59 +0800
Subject: [PATCH 1214/2658] dm ioctl: fix error return code in target_message

[ Upstream commit 4d7659bfbe277a43399a4a2d90fca141e70f29e1 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 2ca4c92f58f9 ("dm ioctl: prevent empty message")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-ioctl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index f43bc95d90b5..bbc71bc52c0d 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1539,6 +1539,7 @@ static int target_message(struct dm_ioctl *param, size_t param_size)
 
 	if (!argc) {
 		DMWARN("Empty message received.");
+		r = -EINVAL;
 		goto out_argv;
 	}
 

From 8fdbaa576ba3afe50e61143510475e6484635b6b Mon Sep 17 00:00:00 2001
From: Keqian Zhu <zhukeqian1@huawei.com>
Date: Fri, 4 Dec 2020 15:31:26 +0800
Subject: [PATCH 1215/2658] clocksource/drivers/arm_arch_timer: Correct fault
 programming of CNTKCTL_EL1.EVNTI

[ Upstream commit 8b7770b877d187bfdae1eaf587bd2b792479a31c ]

ARM virtual counter supports event stream, it can only trigger an event
when the trigger bit (the value of CNTKCTL_EL1.EVNTI) of CNTVCT_EL0 changes,
so the actual period of event stream is 2^(cntkctl_evnti + 1). For example,
when the trigger bit is 0, then virtual counter trigger an event for every
two cycles.

While we're at it, rework the way we compute the trigger bit position
by making it more obvious that when bits [n:n-1] are both set (with n
being the most significant bit), we pick bit (n + 1).

Fixes: 037f637767a8 ("drivers: clocksource: add support for ARM architected timer event stream")
Suggested-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
Acked-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20201204073126.6920-3-zhukeqian1@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/arm_arch_timer.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index 6df63afab45e..6742b53ac16f 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -311,15 +311,24 @@ static void arch_timer_evtstrm_enable(int divider)
 
 static void arch_timer_configure_evtstream(void)
 {
-	int evt_stream_div, pos;
+	int evt_stream_div, lsb;
+
+	/*
+	 * As the event stream can at most be generated at half the frequency
+	 * of the counter, use half the frequency when computing the divider.
+	 */
+	evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ / 2;
+
+	/*
+	 * Find the closest power of two to the divisor. If the adjacent bit
+	 * of lsb (last set bit, starts from 0) is set, then we use (lsb + 1).
+	 */
+	lsb = fls(evt_stream_div) - 1;
+	if (lsb > 0 && (evt_stream_div & BIT(lsb - 1)))
+		lsb++;
 
-	/* Find the closest power of two to the divisor */
-	evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ;
-	pos = fls(evt_stream_div);
-	if (pos > 1 && !(evt_stream_div & (1 << (pos - 2))))
-		pos--;
 	/* enable event stream */
-	arch_timer_evtstrm_enable(min(pos, 15));
+	arch_timer_evtstrm_enable(max(0, min(lsb, 15)));
 }
 
 static void arch_counter_set_user_access(void)

From becad43186bdf7a875f21eb31979a588c5290d42 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Tue, 3 Nov 2020 16:11:32 +0100
Subject: [PATCH 1216/2658] cpufreq: highbank: Add missing MODULE_DEVICE_TABLE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 9433777a6e0aae27468d3434b75cd51bb88ff711 ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this cpufreq driver when it is
compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 6754f556103be ("cpufreq / highbank: add support for highbank cpufreq")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/highbank-cpufreq.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/cpufreq/highbank-cpufreq.c b/drivers/cpufreq/highbank-cpufreq.c
index 1608f7105c9f..ad743f2f31e7 100644
--- a/drivers/cpufreq/highbank-cpufreq.c
+++ b/drivers/cpufreq/highbank-cpufreq.c
@@ -104,6 +104,13 @@ static int hb_cpufreq_driver_init(void)
 }
 module_init(hb_cpufreq_driver_init);
 
+static const struct of_device_id __maybe_unused hb_cpufreq_of_match[] = {
+	{ .compatible = "calxeda,highbank" },
+	{ .compatible = "calxeda,ecx-2000" },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, hb_cpufreq_of_match);
+
 MODULE_AUTHOR("Mark Langsdorf <mark.langsdorf@calxeda.com>");
 MODULE_DESCRIPTION("Calxeda Highbank cpufreq driver");
 MODULE_LICENSE("GPL");

From 424b6719c187d0e58c49fe9d979f20f1deb92249 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Tue, 3 Nov 2020 16:11:37 +0100
Subject: [PATCH 1217/2658] cpufreq: loongson1: Add missing MODULE_ALIAS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit b9acab091842ca8b288882798bb809f7abf5408a ]

This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq
driver when it is compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: a0a22cf14472f ("cpufreq: Loongson1: Add cpufreq driver for Loongson1B")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/ls1x-cpufreq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/cpufreq/ls1x-cpufreq.c b/drivers/cpufreq/ls1x-cpufreq.c
index 262581b3318d..367cb1615c30 100644
--- a/drivers/cpufreq/ls1x-cpufreq.c
+++ b/drivers/cpufreq/ls1x-cpufreq.c
@@ -217,6 +217,7 @@ static struct platform_driver ls1x_cpufreq_platdrv = {
 
 module_platform_driver(ls1x_cpufreq_platdrv);
 
+MODULE_ALIAS("platform:ls1x-cpufreq");
 MODULE_AUTHOR("Kelvin Cheung <keguang.zhang@gmail.com>");
 MODULE_DESCRIPTION("Loongson 1 CPUFreq driver");
 MODULE_LICENSE("GPL");

From 5e4dd097c24ff13263a8de51230bfd76a528de04 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Tue, 3 Nov 2020 16:11:38 +0100
Subject: [PATCH 1218/2658] cpufreq: scpi: Add missing MODULE_ALIAS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c0382d049d2def37b81e907a8b22661a4a4a6eb5 ]

This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq
driver when it is compiled as an external module.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 8def31034d033 ("cpufreq: arm_big_little: add SCPI interface driver")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/scpi-cpufreq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c
index de5e89b2eaaa..98f762cca901 100644
--- a/drivers/cpufreq/scpi-cpufreq.c
+++ b/drivers/cpufreq/scpi-cpufreq.c
@@ -119,6 +119,7 @@ static struct platform_driver scpi_cpufreq_platdrv = {
 };
 module_platform_driver(scpi_cpufreq_platdrv);
 
+MODULE_ALIAS("platform:scpi-cpufreq");
 MODULE_AUTHOR("Sudeep Holla <sudeep.holla@arm.com>");
 MODULE_DESCRIPTION("ARM SCPI CPUFreq interface driver");
 MODULE_LICENSE("GPL v2");

From 0756360e031e161972b09386c88174c221fb450c Mon Sep 17 00:00:00 2001
From: Zhang Qilong <zhangqilong3@huawei.com>
Date: Sat, 5 Dec 2020 19:55:51 +0800
Subject: [PATCH 1219/2658] scsi: pm80xx: Fix error return in
 pm8001_pci_probe()

[ Upstream commit 97031ccffa4f62728602bfea8439dd045cd3aeb2 ]

The driver did not return an error in the case where
pm8001_configure_phy_settings() failed.

Use rc to store the return value of pm8001_configure_phy_settings().

Link: https://lore.kernel.org/r/20201205115551.2079471-1-zhangqilong3@huawei.com
Fixes: 279094079a44 ("[SCSI] pm80xx: Phy settings support for motherboard controller.")
Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/pm8001/pm8001_init.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
index 062ab34b86f8..a982701bc3e0 100644
--- a/drivers/scsi/pm8001/pm8001_init.c
+++ b/drivers/scsi/pm8001/pm8001_init.c
@@ -1063,7 +1063,8 @@ static int pm8001_pci_probe(struct pci_dev *pdev,
 
 	pm8001_init_sas_add(pm8001_ha);
 	/* phy setting support for motherboard controller */
-	if (pm8001_configure_phy_settings(pm8001_ha))
+	rc = pm8001_configure_phy_settings(pm8001_ha);
+	if (rc)
 		goto err_out_shost;
 
 	pm8001_post_sas_ha_init(shost, chip);

From 8e6773830b29944f558f2ecdcebde45d73bc8423 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 26 Oct 2020 17:10:58 +0100
Subject: [PATCH 1220/2658] seq_buf: Avoid type mismatch for seq_buf_init

[ Upstream commit d9a9280a0d0ae51dc1d4142138b99242b7ec8ac6 ]

Building with W=2 prints a number of warnings for one function that
has a pointer type mismatch:

linux/seq_buf.h: In function 'seq_buf_init':
linux/seq_buf.h:35:12: warning: pointer targets in assignment from 'unsigned char *' to 'char *' differ in signedness [-Wpointer-sign]

Change the type in the function prototype according to the type in
the structure.

Link: https://lkml.kernel.org/r/20201026161108.3707783-1-arnd@kernel.org

Fixes: 9a7777935c34 ("tracing: Convert seq_buf fields to be like seq_file fields")
Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/seq_buf.h   | 2 +-
 include/linux/trace_seq.h | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/linux/seq_buf.h b/include/linux/seq_buf.h
index fb7eb9ccb1cd..d4c3c9bab582 100644
--- a/include/linux/seq_buf.h
+++ b/include/linux/seq_buf.h
@@ -29,7 +29,7 @@ static inline void seq_buf_clear(struct seq_buf *s)
 }
 
 static inline void
-seq_buf_init(struct seq_buf *s, unsigned char *buf, unsigned int size)
+seq_buf_init(struct seq_buf *s, char *buf, unsigned int size)
 {
 	s->buffer = buf;
 	s->size = size;
diff --git a/include/linux/trace_seq.h b/include/linux/trace_seq.h
index cfaf5a1d4bad..f5be2716b01c 100644
--- a/include/linux/trace_seq.h
+++ b/include/linux/trace_seq.h
@@ -11,7 +11,7 @@
  */
 
 struct trace_seq {
-	unsigned char		buffer[PAGE_SIZE];
+	char			buffer[PAGE_SIZE];
 	struct seq_buf		seq;
 	int			full;
 };
@@ -50,7 +50,7 @@ static inline int trace_seq_used(struct trace_seq *s)
  * that is about to be written to and then return the result
  * of that write.
  */
-static inline unsigned char *
+static inline char *
 trace_seq_buffer_ptr(struct trace_seq *s)
 {
 	return s->buffer + seq_buf_used(&s->seq);

From 15a1f8a1ddca090c55be9dba50f7fe243aa59740 Mon Sep 17 00:00:00 2001
From: Zhang Changzhong <zhangchangzhong@huawei.com>
Date: Fri, 4 Dec 2020 15:47:39 +0800
Subject: [PATCH 1221/2658] scsi: fnic: Fix error return code in fnic_probe()

[ Upstream commit d4fc94fe65578738ded138e9fce043db6bfc3241 ]

Return a negative error code from the error handling case instead of 0 as
done elsewhere in this function.

Link: https://lore.kernel.org/r/1607068060-31203-1-git-send-email-zhangchangzhong@huawei.com
Fixes: 5df6d737dd4b ("[SCSI] fnic: Add new Cisco PCI-Express FCoE HBA")
Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Karan Tilak Kumar <kartilak@cisco.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/fnic/fnic_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c
index 58ce9020d69c..389c13e1c978 100644
--- a/drivers/scsi/fnic/fnic_main.c
+++ b/drivers/scsi/fnic/fnic_main.c
@@ -735,6 +735,7 @@ static int fnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	for (i = 0; i < FNIC_IO_LOCKS; i++)
 		spin_lock_init(&fnic->io_req_lock[i]);
 
+	err = -ENOMEM;
 	fnic->io_req_pool = mempool_create_slab_pool(2, fnic_io_req_cache);
 	if (!fnic->io_req_pool)
 		goto err_out_free_resources;

From 912050dc399769ddf699686ce4a2e48387265150 Mon Sep 17 00:00:00 2001
From: Nathan Lynch <nathanl@linux.ibm.com>
Date: Mon, 7 Dec 2020 15:51:49 -0600
Subject: [PATCH 1222/2658] powerpc/pseries/hibernation: drop
 pseries_suspend_begin() from suspend ops

[ Upstream commit 52719fce3f4c7a8ac9eaa191e8d75a697f9fbcbc ]

There are three ways pseries_suspend_begin() can be reached:

1. When "mem" is written to /sys/power/state:

kobj_attr_store()
-> state_store()
  -> pm_suspend()
    -> suspend_devices_and_enter()
      -> pseries_suspend_begin()

This never works because there is no way to supply a valid stream id
using this interface, and H_VASI_STATE is called with a stream id of
zero. So this call path is useless at best.

2. When a stream id is written to /sys/devices/system/power/hibernate.
pseries_suspend_begin() is polled directly from store_hibernate()
until the stream is in the "Suspending" state (i.e. the platform is
ready for the OS to suspend execution):

dev_attr_store()
-> store_hibernate()
  -> pseries_suspend_begin()

3. When a stream id is written to /sys/devices/system/power/hibernate
(continued). After #2, pseries_suspend_begin() is called once again
from the pm core:

dev_attr_store()
-> store_hibernate()
  -> pm_suspend()
    -> suspend_devices_and_enter()
      -> pseries_suspend_begin()

This is redundant because the VASI suspend state is already known to
be Suspending.

The begin() callback of platform_suspend_ops is optional, so we can
simply remove that assignment with no loss of function.

Fixes: 32d8ad4e621d ("powerpc/pseries: Partition hibernation support")
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201207215200.1785968-18-nathanl@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/suspend.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c
index e76aefae2aa2..0a0e0c8256f6 100644
--- a/arch/powerpc/platforms/pseries/suspend.c
+++ b/arch/powerpc/platforms/pseries/suspend.c
@@ -224,7 +224,6 @@ static struct bus_type suspend_subsys = {
 
 static const struct platform_suspend_ops pseries_suspend_ops = {
 	.valid		= suspend_valid_only_mem,
-	.begin		= pseries_suspend_begin,
 	.prepare_late	= pseries_prepare_late,
 	.enter		= pseries_suspend_enter,
 };

From 22e15a2f2e675c13959629f177c6ade249a1f27c Mon Sep 17 00:00:00 2001
From: Zhang Qilong <zhangqilong3@huawei.com>
Date: Mon, 23 Nov 2020 22:57:19 +0800
Subject: [PATCH 1223/2658] usb: ehci-omap: Fix PM disable depth umbalance in
 ehci_hcd_omap_probe

[ Upstream commit d6ff32478d7e95d6ca199b5c852710d6964d5811 ]

The pm_runtime_enable will decrement the power disable depth. Imbalance
depth will resulted in enabling runtime PM of device fails later.  Thus
a pairing decrement must be needed on the error handling path to keep it
balanced.

Fixes: 6c984b066d84b ("ARM: OMAP: USBHOST: Replace usbhs core driver APIs by Runtime pm APIs")
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201123145719.1455849-1-zhangqilong3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/ehci-omap.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
index cccde8217f28..8e0625cc1801 100644
--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -237,6 +237,7 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
 
 err_pm_runtime:
 	pm_runtime_put_sync(dev);
+	pm_runtime_disable(dev);
 
 err_phy:
 	for (i = 0; i < omap->nports; i++) {

From 2770de586700a6eed71c8ff1539fc65d516728aa Mon Sep 17 00:00:00 2001
From: Zhang Qilong <zhangqilong3@huawei.com>
Date: Mon, 23 Nov 2020 22:58:09 +0800
Subject: [PATCH 1224/2658] usb: oxu210hp-hcd: Fix memory leak in oxu_create

[ Upstream commit e5548b05631ec3e6bfdaef1cad28c799545b791b ]

usb_create_hcd will alloc memory for hcd, and we should
call usb_put_hcd to free it when adding fails to prevent
memory leak.

Fixes: b92a78e582b1a ("usb host: Oxford OXU210HP HCD driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201123145809.1456541-1-zhangqilong3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/oxu210hp-hcd.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
index 1f139d82cee0..d1e0d9d4e7a6 100644
--- a/drivers/usb/host/oxu210hp-hcd.c
+++ b/drivers/usb/host/oxu210hp-hcd.c
@@ -3741,8 +3741,10 @@ static struct usb_hcd *oxu_create(struct platform_device *pdev,
 	oxu->is_otg = otg;
 
 	ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
-	if (ret < 0)
+	if (ret < 0) {
+		usb_put_hcd(hcd);
 		return ERR_PTR(ret);
+	}
 
 	device_wakeup_enable(hcd->self.controller);
 	return hcd;

From aca878f965bd90aaf6ca12ad368411def53dedba Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Tue, 17 Nov 2020 09:22:29 +0800
Subject: [PATCH 1225/2658] speakup: fix uninitialized flush_lock

[ Upstream commit d1b928ee1cfa965a3327bbaa59bfa005d97fa0fe ]

The flush_lock is uninitialized, use DEFINE_SPINLOCK
to define and initialize flush_lock.

Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory")
Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20201117012229.3395186-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/speakup/speakup_dectlk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/speakup/speakup_dectlk.c b/drivers/staging/speakup/speakup_dectlk.c
index 09063b82326f..71aa623facd6 100644
--- a/drivers/staging/speakup/speakup_dectlk.c
+++ b/drivers/staging/speakup/speakup_dectlk.c
@@ -51,7 +51,7 @@ static unsigned char get_index(void);
 static int in_escape;
 static int is_flushing;
 
-static spinlock_t flush_lock;
+static DEFINE_SPINLOCK(flush_lock);
 static DECLARE_WAIT_QUEUE_HEAD(flush);
 
 static struct var_t vars[] = {

From 882830286f2bfc0118cc672ff6aeb6c52d46f6cd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cheng=C2=A0Lin?= <cheng.lin130@zte.com.cn>
Date: Tue, 1 Dec 2020 07:06:35 -0500
Subject: [PATCH 1226/2658] nfs_common: need lock during iterate through the
 list
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 4a9d81caf841cd2c0ae36abec9c2963bf21d0284 ]

If the elem is deleted during be iterated on it, the iteration
process will fall into an endless loop.

kernel: NMI watchdog: BUG: soft lockup - CPU#4 stuck for 22s! [nfsd:17137]

PID: 17137  TASK: ffff8818d93c0000  CPU: 4   COMMAND: "nfsd"
    [exception RIP: __state_in_grace+76]
    RIP: ffffffffc00e817c  RSP: ffff8818d3aefc98  RFLAGS: 00000246
    RAX: ffff881dc0c38298  RBX: ffffffff81b03580  RCX: ffff881dc02c9f50
    RDX: ffff881e3fce8500  RSI: 0000000000000001  RDI: ffffffff81b03580
    RBP: ffff8818d3aefca0   R8: 0000000000000020   R9: ffff8818d3aefd40
    R10: ffff88017fc03800  R11: ffff8818e83933c0  R12: ffff8818d3aefd40
    R13: 0000000000000000  R14: ffff8818e8391068  R15: ffff8818fa6e4000
    CS: 0010  SS: 0018
 #0 [ffff8818d3aefc98] opens_in_grace at ffffffffc00e81e3 [grace]
 #1 [ffff8818d3aefca8] nfs4_preprocess_stateid_op at ffffffffc02a3e6c [nfsd]
 #2 [ffff8818d3aefd18] nfsd4_write at ffffffffc028ed5b [nfsd]
 #3 [ffff8818d3aefd80] nfsd4_proc_compound at ffffffffc0290a0d [nfsd]
 #4 [ffff8818d3aefdd0] nfsd_dispatch at ffffffffc027b800 [nfsd]
 #5 [ffff8818d3aefe08] svc_process_common at ffffffffc02017f3 [sunrpc]
 #6 [ffff8818d3aefe70] svc_process at ffffffffc0201ce3 [sunrpc]
 #7 [ffff8818d3aefe98] nfsd at ffffffffc027b117 [nfsd]
 #8 [ffff8818d3aefec8] kthread at ffffffff810b88c1
 #9 [ffff8818d3aeff50] ret_from_fork at ffffffff816d1607

The troublemake elem:
crash> lock_manager ffff881dc0c38298
struct lock_manager {
  list = {
    next = 0xffff881dc0c38298,
    prev = 0xffff881dc0c38298
  },
  block_opens = false
}

Fixes: c87fb4a378f9 ("lockd: NLM grace period shouldn't block NFSv4 opens")
Signed-off-by: Cheng Lin <cheng.lin130@zte.com.cn>
Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs_common/grace.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/nfs_common/grace.c b/fs/nfs_common/grace.c
index 77d136ac8909..c21fca0dcba7 100644
--- a/fs/nfs_common/grace.c
+++ b/fs/nfs_common/grace.c
@@ -75,10 +75,14 @@ __state_in_grace(struct net *net, bool open)
 	if (!open)
 		return !list_empty(grace_list);
 
+	spin_lock(&grace_lock);
 	list_for_each_entry(lm, grace_list, list) {
-		if (lm->block_opens)
+		if (lm->block_opens) {
+			spin_unlock(&grace_lock);
 			return true;
+		}
 	}
+	spin_unlock(&grace_lock);
 	return false;
 }
 

From 38d748017b486cb883de55d2321f0319ed2fcf81 Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: Wed, 28 Oct 2020 23:31:10 +0900
Subject: [PATCH 1227/2658] x86/kprobes: Restore BTF if the single-stepping is
 cancelled

[ Upstream commit 78ff2733ff352175eb7f4418a34654346e1b6cd2 ]

Fix to restore BTF if single-stepping causes a page fault and
it is cancelled.

Usually the BTF flag was restored when the single stepping is done
(in resume_execution()). However, if a page fault happens on the
single stepping instruction, the fault handler is invoked and
the single stepping is cancelled. Thus, the BTF flag is not
restored.

Fixes: 1ecc798c6764 ("x86: debugctlmsr kprobes")
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/160389546985.106936.12727996109376240993.stgit@devnote2
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/kprobes/core.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index d10de095182e..2251ee76738b 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -1014,6 +1014,11 @@ int kprobe_fault_handler(struct pt_regs *regs, int trapnr)
 		 * So clear it by resetting the current kprobe:
 		 */
 		regs->flags &= ~X86_EFLAGS_TF;
+		/*
+		 * Since the single step (trap) has been cancelled,
+		 * we need to restore BTF here.
+		 */
+		restore_btf();
 
 		/*
 		 * If the TF flag was set before the kprobe hit,

From c9dcc2a011415198f73cd6d42fffe9212c9f4874 Mon Sep 17 00:00:00 2001
From: Marek Szyprowski <m.szyprowski@samsung.com>
Date: Tue, 8 Dec 2020 14:36:27 +0100
Subject: [PATCH 1228/2658] extcon: max77693: Fix modalias string

[ Upstream commit e1efdb604f5c9903a5d92ef42244009d3c04880f ]

The platform device driver name is "max77693-muic", so advertise it
properly in the modalias string. This fixes automated module loading when
this driver is compiled as a module.

Fixes: db1b9037424b ("extcon: MAX77693: Add extcon-max77693 driver to support Maxim MAX77693 MUIC device")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/extcon/extcon-max77693.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
index 44c499e1beee..02b3feb76ca9 100644
--- a/drivers/extcon/extcon-max77693.c
+++ b/drivers/extcon/extcon-max77693.c
@@ -1262,4 +1262,4 @@ module_platform_driver(max77693_muic_driver);
 MODULE_DESCRIPTION("Maxim MAX77693 Extcon driver");
 MODULE_AUTHOR("Chanwoo Choi <cw00.choi@samsung.com>");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:extcon-max77693");
+MODULE_ALIAS("platform:max77693-muic");

From 65ab75833c12285c8d4dac19a0ce293620aefade Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 9 Dec 2020 09:54:09 +0300
Subject: [PATCH 1229/2658] ASoC: wm_adsp: remove "ctl" from list on error in
 wm_adsp_create_control()

[ Upstream commit 85a7555575a0e48f9b73db310d0d762a08a46d63 ]

The error handling frees "ctl" but it's still on the "dsp->ctl_list"
list so that could result in a use after free.  Remove it from the list
before returning.

Fixes: 2323736dca72 ("ASoC: wm_adsp: Add basic support for rev 1 firmware file format")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/X9B0keV/02wrx9Xs@mwanda
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wm_adsp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index f1f990b325ad..5ff0d3b10bcf 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -852,7 +852,7 @@ static int wm_adsp_create_control(struct wm_adsp *dsp,
 	ctl_work = kzalloc(sizeof(*ctl_work), GFP_KERNEL);
 	if (!ctl_work) {
 		ret = -ENOMEM;
-		goto err_ctl_cache;
+		goto err_list_del;
 	}
 
 	ctl_work->dsp = dsp;
@@ -862,7 +862,8 @@ static int wm_adsp_create_control(struct wm_adsp *dsp,
 
 	return 0;
 
-err_ctl_cache:
+err_list_del:
+	list_del(&ctl->list);
 	kfree(ctl->cache);
 err_ctl_name:
 	kfree(ctl->name);

From 1438df02af36e7149369aeaae7cb86e126a7ecbf Mon Sep 17 00:00:00 2001
From: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Date: Mon, 7 Dec 2020 17:19:40 +0000
Subject: [PATCH 1230/2658] um: chan_xterm: Fix fd leak

[ Upstream commit 9431f7c199ab0d02da1482d62255e0b4621cb1b5 ]

xterm serial channel was leaking a fd used in setting up the
port helper

This bug is prehistoric - it predates switching to git. The "fixes"
header here is really just to mark all the versions we would like this to
apply to which is "Anything from the Cretaceous period onwards".

No dinosaurs were harmed in fixing this bug.

Fixes: b40997b872cd ("um: drivers/xterm.c: fix a file descriptor leak")
Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/um/drivers/xterm.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/um/drivers/xterm.c b/arch/um/drivers/xterm.c
index 20e30be44795..e3b422ebce09 100644
--- a/arch/um/drivers/xterm.c
+++ b/arch/um/drivers/xterm.c
@@ -18,6 +18,7 @@
 struct xterm_chan {
 	int pid;
 	int helper_pid;
+	int chan_fd;
 	char *title;
 	int device;
 	int raw;
@@ -33,6 +34,7 @@ static void *xterm_init(char *str, int device, const struct chan_opts *opts)
 		return NULL;
 	*data = ((struct xterm_chan) { .pid 		= -1,
 				       .helper_pid 	= -1,
+				       .chan_fd		= -1,
 				       .device 		= device,
 				       .title 		= opts->xterm_title,
 				       .raw  		= opts->raw } );
@@ -149,6 +151,7 @@ static int xterm_open(int input, int output, int primary, void *d,
 		goto out_kill;
 	}
 
+	data->chan_fd = fd;
 	new = xterm_fd(fd, &data->helper_pid);
 	if (new < 0) {
 		err = new;
@@ -206,6 +209,8 @@ static void xterm_close(int fd, void *d)
 		os_kill_process(data->helper_pid, 0);
 	data->helper_pid = -1;
 
+	if (data->chan_fd != -1)
+		os_close_file(data->chan_fd);
 	os_close_file(fd);
 }
 

From 56f1bc54fdfeec796bc7fce5b80f99b68004b16a Mon Sep 17 00:00:00 2001
From: Bongsu Jeon <bongsu.jeon@samsung.com>
Date: Sun, 13 Dec 2020 18:58:50 +0900
Subject: [PATCH 1231/2658] nfc: s3fwrn5: Release the nfc firmware

[ Upstream commit a4485baefa1efa596702ebffd5a9c760d42b14b5 ]

add the code to release the nfc firmware when the firmware image size is
wrong.

Fixes: c04c674fadeb ("nfc: s3fwrn5: Add driver for Samsung S3FWRN5 NFC Chip")
Signed-off-by: Bongsu Jeon <bongsu.jeon@samsung.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201213095850.28169-1-bongsu.jeon@samsung.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nfc/s3fwrn5/firmware.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/nfc/s3fwrn5/firmware.c b/drivers/nfc/s3fwrn5/firmware.c
index 64a90252c57f..b387845d3c72 100644
--- a/drivers/nfc/s3fwrn5/firmware.c
+++ b/drivers/nfc/s3fwrn5/firmware.c
@@ -304,8 +304,10 @@ static int s3fwrn5_fw_request_firmware(struct s3fwrn5_fw_info *fw_info)
 	if (ret < 0)
 		return ret;
 
-	if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE)
+	if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE) {
+		release_firmware(fw->fw);
 		return -EINVAL;
+	}
 
 	memcpy(fw->date, fw->fw->data + 0x00, 12);
 	fw->date[12] = '\0';

From 0f57a834faf8d93324fe8f63af72f7d30c95be74 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vincent=20Stehl=C3=A9?= <vincent.stehle@laposte.net>
Date: Sun, 13 Dec 2020 19:26:22 +0100
Subject: [PATCH 1232/2658] powerpc/ps3: use dma_mapping_error()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit d0edaa28a1f7830997131cbce87b6c52472825d1 ]

The DMA address returned by dma_map_single() should be checked with
dma_mapping_error(). Fix the ps3stor_setup() function accordingly.

Fixes: 80071802cb9c ("[POWERPC] PS3: Storage Driver Core")
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201213182622.23047-1-vincent.stehle@laposte.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ps3/ps3stor_lib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ps3/ps3stor_lib.c b/drivers/ps3/ps3stor_lib.c
index 8c3f5adf1bc6..2d7618375662 100644
--- a/drivers/ps3/ps3stor_lib.c
+++ b/drivers/ps3/ps3stor_lib.c
@@ -201,7 +201,7 @@ int ps3stor_setup(struct ps3_storage_device *dev, irq_handler_t handler)
 	dev->bounce_lpar = ps3_mm_phys_to_lpar(__pa(dev->bounce_buf));
 	dev->bounce_dma = dma_map_single(&dev->sbd.core, dev->bounce_buf,
 					 dev->bounce_size, DMA_BIDIRECTIONAL);
-	if (!dev->bounce_dma) {
+	if (dma_mapping_error(&dev->sbd.core, dev->bounce_dma)) {
 		dev_err(&dev->sbd.core, "%s:%u: map DMA region failed\n",
 			__func__, __LINE__);
 		error = -ENODEV;

From 054d6f269339d18ca039322a0db5408270aed14e Mon Sep 17 00:00:00 2001
From: Dwaipayan Ray <dwaipayanray1@gmail.com>
Date: Tue, 15 Dec 2020 20:45:02 -0800
Subject: [PATCH 1233/2658] checkpatch: fix unescaped left brace

[ Upstream commit 03f4935135b9efeb780b970ba023c201f81cf4e6 ]

There is an unescaped left brace in a regex in OPEN_BRACE check.  This
throws a runtime error when checkpatch is run with --fix flag and the
OPEN_BRACE check is executed.

Fix it by escaping the left brace.

Link: https://lkml.kernel.org/r/20201115202928.81955-1-dwaipayanray1@gmail.com
Fixes: 8d1824780f2f ("checkpatch: add --fix option for a couple OPEN_BRACE misuses")
Signed-off-by: Dwaipayan Ray <dwaipayanray1@gmail.com>
Acked-by: Joe Perches <joe@perches.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/checkpatch.pl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 2951d2622489..785761eedee0 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -3738,7 +3738,7 @@ sub process {
 			    $fix) {
 				fix_delete_line($fixlinenr, $rawline);
 				my $fixed_line = $rawline;
-				$fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*){(.*)$/;
+				$fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*)\{(.*)$/;
 				my $line1 = $1;
 				my $line2 = $2;
 				fix_insert_line($fixlinenr, ltrim($line1));

From ce67cbfc10c5f678199af89184dc425e4320773a Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 12 Dec 2020 19:20:05 +0100
Subject: [PATCH 1234/2658] net: bcmgenet: Fix a resource leak in an error
 handling path in the probe functin

[ Upstream commit 4375ada01963d1ebf733d60d1bb6e5db401e1ac6 ]

If the 'register_netdev()' call fails, we must undo a previous
'bcmgenet_mii_init()' call.

Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20201212182005.120437-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index bae8df951780..3a6cebff9f42 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -3518,8 +3518,10 @@ static int bcmgenet_probe(struct platform_device *pdev)
 	clk_disable_unprepare(priv->clk);
 
 	err = register_netdev(dev);
-	if (err)
+	if (err) {
+		bcmgenet_mii_exit(dev);
 		goto err;
+	}
 
 	return err;
 

From e1ab7c596a3c2b9e7c2aa29080c8b6b78a081d7e Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Mon, 14 Dec 2020 21:21:17 +0100
Subject: [PATCH 1235/2658] net: allwinner: Fix some resources leak in the
 error handling path of the probe and in the remove function

[ Upstream commit 322e53d1e2529ae9d501f5e0f20604a79b873aef ]

'irq_of_parse_and_map()' should be balanced by a corresponding
'irq_dispose_mapping()' call. Otherwise, there is some resources leaks.

Add such a call in the error handling path of the probe function and in the
remove function.

Fixes: 492205050d77 ("net: Add EMAC ethernet driver found on Allwinner A10 SoC's")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/20201214202117.146293-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/allwinner/sun4i-emac.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index dde3cd2d4763..10dda58849c6 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -853,13 +853,13 @@ static int emac_probe(struct platform_device *pdev)
 	db->clk = devm_clk_get(&pdev->dev, NULL);
 	if (IS_ERR(db->clk)) {
 		ret = PTR_ERR(db->clk);
-		goto out_iounmap;
+		goto out_dispose_mapping;
 	}
 
 	ret = clk_prepare_enable(db->clk);
 	if (ret) {
 		dev_err(&pdev->dev, "Error couldn't enable clock (%d)\n", ret);
-		goto out_iounmap;
+		goto out_dispose_mapping;
 	}
 
 	ret = sunxi_sram_claim(&pdev->dev);
@@ -916,6 +916,8 @@ static int emac_probe(struct platform_device *pdev)
 	sunxi_sram_release(&pdev->dev);
 out_clk_disable_unprepare:
 	clk_disable_unprepare(db->clk);
+out_dispose_mapping:
+	irq_dispose_mapping(ndev->irq);
 out_iounmap:
 	iounmap(db->membase);
 out:
@@ -934,6 +936,7 @@ static int emac_remove(struct platform_device *pdev)
 	unregister_netdev(ndev);
 	sunxi_sram_release(&pdev->dev);
 	clk_disable_unprepare(db->clk);
+	irq_dispose_mapping(ndev->irq);
 	iounmap(db->membase);
 	free_netdev(ndev);
 

From 0cd49fa17749c70d1c6b4064cc96fb9d51a3a7a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vincent=20Stehl=C3=A9?= <vincent.stehle@laposte.net>
Date: Mon, 14 Dec 2020 23:09:52 +0100
Subject: [PATCH 1236/2658] net: korina: fix return value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 7eb000bdbe7c7da811ef51942b356f6e819b13ba ]

The ndo_start_xmit() method must not attempt to free the skb to transmit
when returning NETDEV_TX_BUSY. Therefore, make sure the
korina_send_packet() function returns NETDEV_TX_OK when it frees a packet.

Fixes: ef11291bcd5f ("Add support the Korina (IDT RC32434) Ethernet MAC")
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20201214220952.19935-1-vincent.stehle@laposte.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/korina.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
index b491de946a0e..88f5c45d9eef 100644
--- a/drivers/net/ethernet/korina.c
+++ b/drivers/net/ethernet/korina.c
@@ -216,7 +216,7 @@ static int korina_send_packet(struct sk_buff *skb, struct net_device *dev)
 			dev_kfree_skb_any(skb);
 			spin_unlock_irqrestore(&lp->lock, flags);
 
-			return NETDEV_TX_BUSY;
+			return NETDEV_TX_OK;
 		}
 	}
 

From 4c4667ab9af0c3d6af61c270d5afef6224bcbae0 Mon Sep 17 00:00:00 2001
From: Zhang Qilong <zhangqilong3@huawei.com>
Date: Fri, 13 Nov 2020 21:16:23 +0800
Subject: [PATCH 1237/2658] clk: ti: Fix memleak in ti_fapll_synth_setup

[ Upstream commit 8c6239f6e95f583bb763d0228e02d4dd0fb3d492 ]

If clk_register fails, we should goto free branch
before function returns to prevent memleak.

Fixes: 163152cbbe321 ("clk: ti: Add support for FAPLL on dm816x")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201113131623.2098222-1-zhangqilong3@huawei.com
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/ti/fapll.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/ti/fapll.c b/drivers/clk/ti/fapll.c
index 66a0d0ed8b55..02ff499e3653 100644
--- a/drivers/clk/ti/fapll.c
+++ b/drivers/clk/ti/fapll.c
@@ -497,6 +497,7 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd,
 {
 	struct clk_init_data *init;
 	struct fapll_synth *synth;
+	struct clk *clk = ERR_PTR(-ENOMEM);
 
 	init = kzalloc(sizeof(*init), GFP_KERNEL);
 	if (!init)
@@ -519,13 +520,19 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd,
 	synth->hw.init = init;
 	synth->clk_pll = pll_clk;
 
-	return clk_register(NULL, &synth->hw);
+	clk = clk_register(NULL, &synth->hw);
+	if (IS_ERR(clk)) {
+		pr_err("failed to register clock\n");
+		goto free;
+	}
+
+	return clk;
 
 free:
 	kfree(synth);
 	kfree(init);
 
-	return ERR_PTR(-ENOMEM);
+	return clk;
 }
 
 static void __init ti_fapll_setup(struct device_node *node)

From 1decdd0827e5333991f6a46b0dfc7363be550310 Mon Sep 17 00:00:00 2001
From: Zheng Zengkai <zhengzengkai@huawei.com>
Date: Fri, 3 Jul 2020 17:33:44 +0800
Subject: [PATCH 1238/2658] =?UTF-8?q?perf=20record:=20Fix=20memory=20leak?=
 =?UTF-8?q?=20when=20using=20'--user-regs=3D=3F'=20to=20list=20registers?=

[ Upstream commit 2eb5dd418034ecea2f7031e3d33f2991a878b148 ]

When using 'perf record's option '-I' or '--user-regs=' along with
argument '?' to list available register names, memory of variable 'os'
allocated by strdup() needs to be released before __parse_regs()
returns, otherwise memory leak will occur.

Fixes: bcc84ec65ad1 ("perf record: Add ability to name registers to record")
Signed-off-by: Zheng Zengkai <zhengzengkai@huawei.com>
Acked-by: Jiri Olsa <jolsa@redhat.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Li Bin <huawei.libin@huawei.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Link: https://lore.kernel.org/r/20200703093344.189450-1-zhengzengkai@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/parse-regs-options.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/parse-regs-options.c b/tools/perf/util/parse-regs-options.c
index 4f2c1c255d81..a8865d1c3e81 100644
--- a/tools/perf/util/parse-regs-options.c
+++ b/tools/perf/util/parse-regs-options.c
@@ -40,7 +40,7 @@ parse_regs(const struct option *opt, const char *str, int unset)
 				}
 				fputc('\n', stderr);
 				/* just printing available regs */
-				return -1;
+				goto error;
 			}
 			for (r = sample_reg_masks; r->name; r++) {
 				if (!strcasecmp(s, r->name))

From 449835ffcad487d98da882fbb5b30ac7b65e57c6 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 16 Dec 2020 11:38:04 +0300
Subject: [PATCH 1239/2658] qlcnic: Fix error code in probe

[ Upstream commit 0d52848632a357948028eab67ff9b7cc0c12a0fb ]

Return -EINVAL if we can't find the correct device.  Currently it
returns success.

Fixes: 13159183ec7a ("qlcnic: 83xx base driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X9nHbMqEyI/xPfGd@mwanda
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 1205f6f9c941..a4b10776f834 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -2506,6 +2506,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 		qlcnic_sriov_vf_register_map(ahw);
 		break;
 	default:
+		err = -EINVAL;
 		goto err_out_free_hw_res;
 	}
 

From 80917d0ef084ecec5ef237b09b615b333ce45425 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 12 Dec 2020 13:28:18 +0100
Subject: [PATCH 1240/2658] clk: s2mps11: Fix a resource leak in error handling
 paths in the probe function

[ Upstream commit d2d94fc567624f96187e8b52083795620f93e69f ]

Some resource should be released in the error handling path of the probe
function, as already done in the remove function.

The remove function was fixed in commit bf416bd45738 ("clk: s2mps11: Add
missing of_node_put and of_clk_del_provider")

Fixes: 7cc560dea415 ("clk: s2mps11: Add support for s2mps11")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/20201212122818.86195-1-christophe.jaillet@wanadoo.fr
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/clk-s2mps11.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c
index 14af5c916c9c..8a42a9c2a8f2 100644
--- a/drivers/clk/clk-s2mps11.c
+++ b/drivers/clk/clk-s2mps11.c
@@ -263,6 +263,7 @@ static int s2mps11_clk_probe(struct platform_device *pdev)
 	return ret;
 
 err_reg:
+	of_node_put(s2mps11_clks[0].clk_np);
 	while (--i >= 0)
 		clkdev_drop(s2mps11_clks[i].lookup);
 

From 2c1317209a0a800ac5248a406e366d978e6f309b Mon Sep 17 00:00:00 2001
From: Sara Sharon <sara.sharon@intel.com>
Date: Sun, 29 Nov 2020 17:30:44 +0200
Subject: [PATCH 1241/2658] cfg80211: initialize rekey_data

[ Upstream commit f495acd8851d7b345e5f0e521b2645b1e1f928a0 ]

In case we have old supplicant, the akm field is uninitialized.

Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201129172929.930f0ab7ebee.Ic546e384efab3f4a89f318eafddc3eb7d556aecb@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/wireless/nl80211.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 5cbfffe2632f..0f582933cf82 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -10318,7 +10318,7 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
 	struct net_device *dev = info->user_ptr[1];
 	struct wireless_dev *wdev = dev->ieee80211_ptr;
 	struct nlattr *tb[NUM_NL80211_REKEY_DATA];
-	struct cfg80211_gtk_rekey_data rekey_data;
+	struct cfg80211_gtk_rekey_data rekey_data = {};
 	int err;
 
 	if (!info->attrs[NL80211_ATTR_REKEY_DATA])

From 3f97ad8d170d97939c5a85cd032435582be6d582 Mon Sep 17 00:00:00 2001
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: Wed, 9 Dec 2020 17:59:53 -0800
Subject: [PATCH 1242/2658] Input: cros_ec_keyb - send 'scancodes' in addition
 to key events

[ Upstream commit 80db2a087f425b63f0163bc95217abd01c637cb5 ]

To let userspace know what 'scancodes' should be used in EVIOCGKEYCODE
and EVIOCSKEYCODE ioctls, we should send EV_MSC/MSC_SCAN events in
addition to EV_KEY/KEY_* events. The driver already declared MSC_SCAN
capability, so it is only matter of actually sending the events.

Link: https://lore.kernel.org/r/X87aOaSptPTvZ3nZ@google.com
Acked-by: Rajat Jain <rajatja@google.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/keyboard/cros_ec_keyb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c
index b01966dc7eb3..44a5a5496cfd 100644
--- a/drivers/input/keyboard/cros_ec_keyb.c
+++ b/drivers/input/keyboard/cros_ec_keyb.c
@@ -137,6 +137,7 @@ static void cros_ec_keyb_process(struct cros_ec_keyb *ckdev,
 					"changed: [r%d c%d]: byte %02x\n",
 					row, col, new_state);
 
+				input_event(idev, EV_MSC, MSC_SCAN, pos);
 				input_report_key(idev, keycodes[pos],
 						 new_state);
 			}

From 86185ef43039f8d83479146838ac5eed2fe6ddef Mon Sep 17 00:00:00 2001
From: Simon Beginn <linux@simonmicro.de>
Date: Fri, 11 Dec 2020 16:17:32 -0800
Subject: [PATCH 1243/2658] Input: goodix - add upside-down quirk for Teclast
 X98 Pro tablet

[ Upstream commit cffdd6d90482316e18d686060a4397902ea04bd2 ]

The touchscreen on the Teclast x98 Pro is also mounted upside-down in
relation to the display orientation.

Signed-off-by: Simon Beginn <linux@simonmicro.de>
Signed-off-by: Bastien Nocera <hadess@hadess.net>
Link: https://lore.kernel.org/r/20201117004253.27A5A27EFD@localhost
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/touchscreen/goodix.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c
index 67cadda13ab1..d7cc8f6a292e 100644
--- a/drivers/input/touchscreen/goodix.c
+++ b/drivers/input/touchscreen/goodix.c
@@ -77,6 +77,18 @@ static const struct dmi_system_id rotated_screen[] = {
 			DMI_MATCH(DMI_BIOS_DATE, "12/19/2014"),
 		},
 	},
+	{
+		.ident = "Teclast X98 Pro",
+		.matches = {
+			/*
+			 * Only match BIOS date, because the manufacturers
+			 * BIOS does not report the board name at all
+			 * (sometimes)...
+			 */
+			DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"),
+			DMI_MATCH(DMI_BIOS_DATE, "10/28/2015"),
+		},
+	},
 	{
 		.ident = "WinBook TW100",
 		.matches = {

From d00c8e31190ac157b7c35ad8a21136bcf82f93e9 Mon Sep 17 00:00:00 2001
From: Alan Stern <stern@rowland.harvard.edu>
Date: Wed, 2 Dec 2020 18:20:04 +0100
Subject: [PATCH 1244/2658] media: gspca: Fix memory leak in probe

commit e469d0b09a19496e1972a20974bbf55b728151eb upstream.

The gspca driver leaks memory when a probe fails.  gspca_dev_probe2()
calls v4l2_device_register(), which takes a reference to the
underlying device node (in this case, a USB interface).  But the
failure pathway neglects to call v4l2_device_unregister(), the routine
responsible for dropping this reference.  Consequently the memory for
the USB interface and its device never gets released.

This patch adds the missing function call.

Reported-and-tested-by: syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/gspca/gspca.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c
index 3733c15c753e..17b7b02330c9 100644
--- a/drivers/media/usb/gspca/gspca.c
+++ b/drivers/media/usb/gspca/gspca.c
@@ -2130,6 +2130,7 @@ int gspca_dev_probe2(struct usb_interface *intf,
 		input_unregister_device(gspca_dev->input_dev);
 #endif
 	v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
+	v4l2_device_unregister(&gspca_dev->v4l2_dev);
 	kfree(gspca_dev->usb_buf);
 	kfree(gspca_dev);
 	return ret;

From f57d1f9ef2a38442e059f9b30582dadb82c1059a Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Mon, 9 Nov 2020 23:16:52 +0100
Subject: [PATCH 1245/2658] media: sunxi-cir: ensure IR is handled when it is
 continuous

commit 3f56df4c8ffeb120ed41906d3aae71799b7e726a upstream.

If a user holds a button down on a remote, then no ir idle interrupt will
be generated until the user releases the button, depending on how quickly
the remote repeats. No IR is processed until that point, which means that
holding down a button may not do anything.

This also resolves an issue on a Cubieboard 1 where the IR receiver is
picking up ambient infrared as IR and spews out endless
"rc rc0: IR event FIFO is full!" messages unless you choose to live in
the dark.

Cc: stable@vger.kernel.org
Tested-by: Hans Verkuil <hverkuil@xs4all.nl>
Acked-by: Maxime Ripard <mripard@kernel.org>
Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/rc/sunxi-cir.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/rc/sunxi-cir.c b/drivers/media/rc/sunxi-cir.c
index 40f77685cc4a..3ad7b67797e9 100644
--- a/drivers/media/rc/sunxi-cir.c
+++ b/drivers/media/rc/sunxi-cir.c
@@ -132,6 +132,8 @@ static irqreturn_t sunxi_ir_irq(int irqno, void *dev_id)
 	} else if (status & REG_RXINT_RPEI_EN) {
 		ir_raw_event_set_idle(ir->rc, true);
 		ir_raw_event_handle(ir->rc);
+	} else {
+		ir_raw_event_handle(ir->rc);
 	}
 
 	spin_unlock(&ir->ir_lock);

From d1f27086c5d52bd5a16283377f10014621086428 Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@wunner.de>
Date: Mon, 7 Dec 2020 09:17:12 +0100
Subject: [PATCH 1246/2658] media: netup_unidvb: Don't leak SPI master in probe
 error path

commit e297ddf296de35037fa97f4302782def196d350a upstream.

If the call to spi_register_master() fails on probe of the NetUP
Universal DVB driver, the spi_master struct is erroneously not freed.

Likewise, if spi_new_device() fails, the spi_controller struct is
not unregistered.  Plug the leaks.

While at it, fix an ordering issue in netup_spi_release() wherein
spi_unregister_master() is called after fiddling with the IRQ control
register.  The correct order is to call spi_unregister_master() *before*
this teardown step because bus accesses may still be ongoing until that
function returns.

Fixes: 52b1eaf4c59a ("[media] netup_unidvb: NetUP Universal DVB-S/S2/T/T2/C PCI-E card driver")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Cc: <stable@vger.kernel.org> # v4.3+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.3+
Cc: Kozlov Sergey <serjk@netup.ru>
Link: https://lore.kernel.org/r/c4c24f333fc7840f4a3db24789e6e10dd660bede.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/pci/netup_unidvb/netup_unidvb_spi.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c b/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c
index f33c0de3e849..019bbc18cede 100644
--- a/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c
+++ b/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c
@@ -184,7 +184,7 @@ int netup_spi_init(struct netup_unidvb_dev *ndev)
 	struct spi_master *master;
 	struct netup_spi *nspi;
 
-	master = spi_alloc_master(&ndev->pci_dev->dev,
+	master = devm_spi_alloc_master(&ndev->pci_dev->dev,
 		sizeof(struct netup_spi));
 	if (!master) {
 		dev_err(&ndev->pci_dev->dev,
@@ -217,6 +217,7 @@ int netup_spi_init(struct netup_unidvb_dev *ndev)
 		ndev->pci_slot,
 		ndev->pci_func);
 	if (!spi_new_device(master, &netup_spi_board)) {
+		spi_unregister_master(master);
 		ndev->spi = NULL;
 		dev_err(&ndev->pci_dev->dev,
 			"%s(): unable to create SPI device\n", __func__);
@@ -235,13 +236,13 @@ void netup_spi_release(struct netup_unidvb_dev *ndev)
 	if (!spi)
 		return;
 
+	spi_unregister_master(spi->master);
 	spin_lock_irqsave(&spi->lock, flags);
 	reg = readw(&spi->regs->control_stat);
 	writew(reg | NETUP_SPI_CTRL_IRQ, &spi->regs->control_stat);
 	reg = readw(&spi->regs->control_stat);
 	writew(reg & ~NETUP_SPI_CTRL_IMASK, &spi->regs->control_stat);
 	spin_unlock_irqrestore(&spi->lock, flags);
-	spi_unregister_master(spi->master);
 	ndev->spi = NULL;
 }
 

From 237a8f90447b03edf25ec861e7f4cd87a7281c85 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 14 Dec 2020 13:37:46 -0800
Subject: [PATCH 1247/2658] Input: cyapa_gen6 - fix out-of-bounds stack access

commit f051ae4f6c732c231046945b36234e977f8467c6 upstream.

gcc -Warray-bounds warns about a serious bug in
cyapa_pip_retrieve_data_structure:

drivers/input/mouse/cyapa_gen6.c: In function 'cyapa_pip_retrieve_data_structure.constprop':
include/linux/unaligned/access_ok.h:40:17: warning: array subscript -1 is outside array bounds of 'struct retrieve_data_struct_cmd[1]' [-Warray-bounds]
   40 |  *((__le16 *)p) = cpu_to_le16(val);
drivers/input/mouse/cyapa_gen6.c:569:13: note: while referencing 'cmd'
  569 |  } __packed cmd;
      |             ^~~

Apparently the '-2' was added to the pointer instead of the value,
writing garbage into the stack next to this variable.

Fixes: c2c06c41f700 ("Input: cyapa - add gen6 device module support")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20201026161332.3708389-1-arnd@kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/mouse/cyapa_gen6.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/mouse/cyapa_gen6.c b/drivers/input/mouse/cyapa_gen6.c
index e4eb048d1bf6..c7ab84bc877f 100644
--- a/drivers/input/mouse/cyapa_gen6.c
+++ b/drivers/input/mouse/cyapa_gen6.c
@@ -573,7 +573,7 @@ static int cyapa_pip_retrieve_data_structure(struct cyapa *cyapa,
 
 	memset(&cmd, 0, sizeof(cmd));
 	put_unaligned_le16(PIP_OUTPUT_REPORT_ADDR, &cmd.head.addr);
-	put_unaligned_le16(sizeof(cmd), &cmd.head.length - 2);
+	put_unaligned_le16(sizeof(cmd) - 2, &cmd.head.length);
 	cmd.head.report_id = PIP_APP_CMD_REPORT_ID;
 	cmd.head.cmd_code = PIP_RETRIEVE_DATA_STRUCTURE;
 	put_unaligned_le16(read_offset, &cmd.read_offset);

From d507342cec4b8d7f03aed3187dc2f04e353bdd1f Mon Sep 17 00:00:00 2001
From: Daniel Scally <djrscally@gmail.com>
Date: Sat, 5 Dec 2020 17:04:03 +0000
Subject: [PATCH 1248/2658] Revert "ACPI / resources: Use AE_CTRL_TERMINATE to
 terminate resources walks"

commit 12fc4dad94dfac25599f31257aac181c691ca96f upstream.

This reverts commit 8a66790b7850a6669129af078768a1d42076a0ef.

Switching this function to AE_CTRL_TERMINATE broke the documented
behaviour of acpi_dev_get_resources() - AE_CTRL_TERMINATE does not, in
fact, terminate the resource walk because acpi_walk_resource_buffer()
ignores it (specifically converting it to AE_OK), referring to that
value as "an OK termination by the user function". This means that
acpi_dev_get_resources() does not abort processing when the preproc
function returns a negative value.

Signed-off-by: Daniel Scally <djrscally@gmail.com>
Cc: 3.10+ <stable@vger.kernel.org> # 3.10+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/acpi/resource.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 627f8fbb5e9a..e6003d2baa45 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -506,7 +506,7 @@ static acpi_status acpi_dev_process_resource(struct acpi_resource *ares,
 		ret = c->preproc(ares, c->preproc_data);
 		if (ret < 0) {
 			c->error = ret;
-			return AE_CTRL_TERMINATE;
+			return AE_ABORT_METHOD;
 		} else if (ret > 0) {
 			return AE_OK;
 		}

From c03d836a03d9d93f327661d28ad95a1e22733625 Mon Sep 17 00:00:00 2001
From: Hui Wang <hui.wang@canonical.com>
Date: Fri, 11 Dec 2020 10:18:14 +0800
Subject: [PATCH 1249/2658] ACPI: PNP: compare the string length in the
 matching_id()

commit b08221c40febcbda9309dd70c61cf1b0ebb0e351 upstream.

Recently we met a touchscreen problem on some Thinkpad machines, the
touchscreen driver (i2c-hid) is not loaded and the touchscreen can't
work.

An i2c ACPI device with the name WACF2200 is defined in the BIOS, with
the current rule in matching_id(), this device will be regarded as
a PNP device since there is WACFXXX in the acpi_pnp_device_ids[] and
this PNP device is attached to the acpi device as the 1st
physical_node, this will make the i2c bus match fail when i2c bus
calls acpi_companion_match() to match the acpi_id_table in the i2c-hid
driver.

WACF2200 is an i2c device instead of a PNP device, after adding the
string length comparing, the matching_id() will return false when
matching WACF2200 and WACFXXX, and it is reasonable to compare the
string length when matching two IDs.

Suggested-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/acpi/acpi_pnp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/acpi/acpi_pnp.c b/drivers/acpi/acpi_pnp.c
index 48fc3ad13a4b..1738eb0fa7db 100644
--- a/drivers/acpi/acpi_pnp.c
+++ b/drivers/acpi/acpi_pnp.c
@@ -320,6 +320,9 @@ static bool matching_id(const char *idstr, const char *list_id)
 {
 	int i;
 
+	if (strlen(idstr) != strlen(list_id))
+		return false;
+
 	if (memcmp(idstr, list_id, 3))
 		return false;
 

From bc28b73862ca109fec85823252265631a464c3ec Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Fri, 18 Dec 2020 17:17:30 +0100
Subject: [PATCH 1250/2658] ALSA: pcm: oss: Fix a few more UBSAN fixes

commit 11cb881bf075cea41092a20236ba708b18e1dbb2 upstream.

There are a few places that call round{up|down}_pow_of_two() with the
value zero, and this causes undefined behavior warnings.  Avoid
calling those macros if such a nonsense value is passed; it's a minor
optimization as well, as we handle it as either an error or a value to
be skipped, instead.

Reported-by: syzbot+33ef0b6639a8d2d42b4c@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201218161730.26596-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/oss/pcm_oss.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index 4140ea9cf7c1..1d1faf192517 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -718,6 +718,8 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream,
 
 	oss_buffer_size = snd_pcm_plug_client_size(substream,
 						   snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_BUFFER_SIZE, NULL)) * oss_frame_size;
+	if (!oss_buffer_size)
+		return -EINVAL;
 	oss_buffer_size = rounddown_pow_of_two(oss_buffer_size);
 	if (atomic_read(&substream->mmap_count)) {
 		if (oss_buffer_size > runtime->oss.mmap_bytes)
@@ -753,17 +755,21 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream,
 
 	min_period_size = snd_pcm_plug_client_size(substream,
 						   snd_pcm_hw_param_value_min(slave_params, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, NULL));
-	min_period_size *= oss_frame_size;
-	min_period_size = roundup_pow_of_two(min_period_size);
-	if (oss_period_size < min_period_size)
-		oss_period_size = min_period_size;
+	if (min_period_size) {
+		min_period_size *= oss_frame_size;
+		min_period_size = roundup_pow_of_two(min_period_size);
+		if (oss_period_size < min_period_size)
+			oss_period_size = min_period_size;
+	}
 
 	max_period_size = snd_pcm_plug_client_size(substream,
 						   snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, NULL));
-	max_period_size *= oss_frame_size;
-	max_period_size = rounddown_pow_of_two(max_period_size);
-	if (oss_period_size > max_period_size)
-		oss_period_size = max_period_size;
+	if (max_period_size) {
+		max_period_size *= oss_frame_size;
+		max_period_size = rounddown_pow_of_two(max_period_size);
+		if (oss_period_size > max_period_size)
+			oss_period_size = max_period_size;
+	}
 
 	oss_periods = oss_buffer_size / oss_period_size;
 

From 7a716c01224b6d2abb68e148b0844d9fa36ae18f Mon Sep 17 00:00:00 2001
From: Stefan Haberland <sth@linux.ibm.com>
Date: Thu, 17 Dec 2020 16:59:06 +0100
Subject: [PATCH 1251/2658] s390/dasd: fix list corruption of pavgroup group
 list

commit 0ede91f83aa335da1c3ec68eb0f9e228f269f6d8 upstream.

dasd_alias_add_device() moves devices to the active_devices list in case
of a scheduled LCU update regardless if they have previously been in a
pavgroup or not.

Example: device A and B are in the same pavgroup.

Device A has already been in a pavgroup and the private->pavgroup pointer
is set and points to a valid pavgroup. While going through dasd_add_device
it is moved from the pavgroup to the active_devices list.

In parallel device B might be removed from the same pavgroup in
remove_device_from_lcu() which in turn checks if the group is empty
and deletes it accordingly because device A has already been removed from
there.

When now device A enters remove_device_from_lcu() it is tried to remove it
from the pavgroup again because the pavgroup pointer is still set and again
the empty group will be cleaned up which leads to a list corruption.

Fix by setting private->pavgroup to NULL in dasd_add_device.

If the device has been the last device on the pavgroup an empty pavgroup
remains but this will be cleaned up by the scheduled lcu_update which
iterates over all existing pavgroups.

Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1")
Cc: stable@vger.kernel.org
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/s390/block/dasd_alias.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index 6601047d4b65..d76967ee057f 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -637,6 +637,7 @@ int dasd_alias_add_device(struct dasd_device *device)
 	}
 	if (lcu->flags & UPDATE_PENDING) {
 		list_move(&device->alias_list, &lcu->active_devices);
+		private->pavgroup = NULL;
 		_schedule_lcu_update(lcu, device);
 	}
 	spin_unlock(&lcu->lock);

From cac227333946e0a004c4ff3e2e46b9e30ed6e5c8 Mon Sep 17 00:00:00 2001
From: Stefan Haberland <sth@linux.ibm.com>
Date: Thu, 17 Dec 2020 16:59:07 +0100
Subject: [PATCH 1252/2658] s390/dasd: fix list corruption of lcu list

commit 53a7f655834c7c335bf683f248208d4fbe4b47bc upstream.

In dasd_alias_disconnect_device_from_lcu the device is removed from any
list on the LCU. Afterwards the LCU is removed from the lcu list if it
does not contain devices any longer.

The lcu->lock protects the lcu from parallel updates. But to cancel all
workers and wait for completion the lcu->lock has to be unlocked.

If two devices are removed in parallel and both are removed from the LCU
the first device that takes the lcu->lock again will delete the LCU because
it is already empty but the second device also tries to free the LCU which
leads to a list corruption of the lcu list.

Fix by removing the device right before the lcu is checked without
unlocking the lcu->lock in between.

Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1")
Cc: stable@vger.kernel.org
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/s390/block/dasd_alias.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index d76967ee057f..89b708135000 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -258,7 +258,6 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device)
 		return;
 	device->discipline->get_uid(device, &uid);
 	spin_lock_irqsave(&lcu->lock, flags);
-	list_del_init(&device->alias_list);
 	/* make sure that the workers don't use this device */
 	if (device == lcu->suc_data.device) {
 		spin_unlock_irqrestore(&lcu->lock, flags);
@@ -285,6 +284,7 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device)
 
 	spin_lock_irqsave(&aliastree.lock, flags);
 	spin_lock(&lcu->lock);
+	list_del_init(&device->alias_list);
 	if (list_empty(&lcu->grouplist) &&
 	    list_empty(&lcu->active_devices) &&
 	    list_empty(&lcu->inactive_devices)) {

From c6f69508d0776d93ecaf05c6ea90d2981cd9166f Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Mon, 7 Dec 2020 14:58:06 +0000
Subject: [PATCH 1253/2658] staging: comedi: mf6x4: Fix AI end-of-conversion
 detection

commit 56c90457ebfe9422496aac6ef3d3f0f0ea8b2ec2 upstream.

I have had reports from two different people that attempts to read the
analog input channels of the MF624 board fail with an `ETIMEDOUT` error.

After triggering the conversion, the code calls `comedi_timeout()` with
`mf6x4_ai_eoc()` as the callback function to check if the conversion is
complete.  The callback returns 0 if complete or `-EBUSY` if not yet
complete.  `comedi_timeout()` returns `-ETIMEDOUT` if it has not
completed within a timeout period which is propagated as an error to the
user application.

The existing code considers the conversion to be complete when the EOLC
bit is high.  However, according to the user manuals for the MF624 and
MF634 boards, this test is incorrect because EOLC is an active low
signal that goes high when the conversion is triggered, and goes low
when the conversion is complete.  Fix the problem by inverting the test
of the EOLC bit state.

Fixes: 04b565021a83 ("comedi: Humusoft MF634 and MF624 DAQ cards driver")
Cc: <stable@vger.kernel.org> # v4.4+
Cc: Rostislav Lisovy <lisovy@gmail.com>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20201207145806.4046-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/mf6x4.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/mf6x4.c b/drivers/staging/comedi/drivers/mf6x4.c
index fbdf181d8ccc..40aa24a9b2c3 100644
--- a/drivers/staging/comedi/drivers/mf6x4.c
+++ b/drivers/staging/comedi/drivers/mf6x4.c
@@ -121,8 +121,9 @@ static int mf6x4_ai_eoc(struct comedi_device *dev,
 	struct mf6x4_private *devpriv = dev->private;
 	unsigned int status;
 
+	/* EOLC goes low at end of conversion. */
 	status = ioread32(devpriv->gpioc_reg);
-	if (status & MF6X4_GPIOC_EOLC)
+	if ((status & MF6X4_GPIOC_EOLC) == 0)
 		return 0;
 	return -EBUSY;
 }

From 433be17a56a6a031a01508a02954d45f8db2a7d0 Mon Sep 17 00:00:00 2001
From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Date: Wed, 25 Nov 2020 02:26:55 -0500
Subject: [PATCH 1254/2658] powerpc/perf: Exclude kernel samples while counting
 events in user space.

commit aa8e21c053d72b6639ea5a7f1d3a1d0209534c94 upstream.

Perf event attritube supports exclude_kernel flag to avoid
sampling/profiling in supervisor state (kernel). Based on this event
attr flag, Monitor Mode Control Register bit is set to freeze on
supervisor state. But sometimes (due to hardware limitation), Sampled
Instruction Address Register (SIAR) locks on to kernel address even
when freeze on supervisor is set. Patch here adds a check to drop
those samples.

Cc: stable@vger.kernel.org
Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1606289215-1433-1-git-send-email-atrajeev@linux.vnet.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/perf/core-book3s.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 30e2e8efbe6b..e593e7f856ed 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -2020,6 +2020,16 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
 	local64_set(&event->hw.period_left, left);
 	perf_event_update_userpage(event);
 
+	/*
+	 * Due to hardware limitation, sometimes SIAR could sample a kernel
+	 * address even when freeze on supervisor state (kernel) is set in
+	 * MMCR2. Check attr.exclude_kernel and address to drop the sample in
+	 * these cases.
+	 */
+	if (event->attr.exclude_kernel && record)
+		if (is_kernel_addr(mfspr(SPRN_SIAR)))
+			record = 0;
+
 	/*
 	 * Finally record data if requested.
 	 */

From dadc5f5352099b3192e3aa4ca84360643abddead Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 4 Nov 2020 17:47:27 +0100
Subject: [PATCH 1255/2658] USB: serial: mos7720: fix parallel-port state
 restore

commit 975323ab8f116667676c30ca3502a6757bd89e8d upstream.

The parallel-port restore operations is called when a driver claims the
port and is supposed to restore the provided state (e.g. saved when
releasing the port).

Fixes: b69578df7e98 ("USB: usbserial: mos7720: add support for parallel port on moschip 7715")
Cc: stable <stable@vger.kernel.org>     # 2.6.35
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/mos7720.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 1927f41ccafc..1d8a6c17c9eb 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -640,6 +640,8 @@ static void parport_mos7715_restore_state(struct parport *pp,
 		spin_unlock(&release_lock);
 		return;
 	}
+	mos_parport->shadowDCR = s->u.pc.ctr;
+	mos_parport->shadowECR = s->u.pc.ecr;
 	write_parport_reg_nonblock(mos_parport, MOS7720_DCR,
 				   mos_parport->shadowDCR);
 	write_parport_reg_nonblock(mos_parport, MOS7720_ECR,

From f9a9e646034d133c07580454d6f5fabeb5c70756 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Sun, 25 Oct 2020 18:45:47 +0100
Subject: [PATCH 1256/2658] USB: serial: keyspan_pda: fix dropped unthrottle
 interrupts

commit 696c541c8c6cfa05d65aa24ae2b9e720fc01766e upstream.

Commit c528fcb116e6 ("USB: serial: keyspan_pda: fix receive sanity
checks") broke write-unthrottle handling by dropping well-formed
unthrottle-interrupt packets which are precisely two bytes long. This
could lead to blocked writers not being woken up when buffer space again
becomes available.

Instead, stop unconditionally printing the third byte which is
(presumably) only valid on modem-line changes.

Fixes: c528fcb116e6 ("USB: serial: keyspan_pda: fix receive sanity checks")
Cc: stable <stable@vger.kernel.org>     # 4.11
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/keyspan_pda.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index 8a4047de43dc..25bbc1d8a2e2 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -176,11 +176,11 @@ static void keyspan_pda_rx_interrupt(struct urb *urb)
 		break;
 	case 1:
 		/* status interrupt */
-		if (len < 3) {
+		if (len < 2) {
 			dev_warn(&port->dev, "short interrupt message received\n");
 			break;
 		}
-		dev_dbg(&port->dev, "rx int, d1=%d, d2=%d\n", data[1], data[2]);
+		dev_dbg(&port->dev, "rx int, d1=%d\n", data[1]);
 		switch (data[1]) {
 		case 1: /* modemline change */
 			break;

From 2caf2b4196ce9eb068c60c9193bd0b7ceed578d3 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Sun, 25 Oct 2020 18:45:48 +0100
Subject: [PATCH 1257/2658] USB: serial: keyspan_pda: fix write deadlock

commit 7353cad7ee4deaefc16e94727e69285563e219f6 upstream.

The write() callback can be called in interrupt context (e.g. when used
as a console) so interrupts must be disabled while holding the port lock
to prevent a possible deadlock.

Fixes: e81ee637e4ae ("usb-serial: possible irq lock inversion (PPP vs. usb/serial)")
Fixes: 507ca9bc0476 ("[PATCH] USB: add ability for usb-serial drivers to determine if their write urb is currently being used.")
Cc: stable <stable@vger.kernel.org>     # 2.6.19
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/keyspan_pda.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index 25bbc1d8a2e2..6e09ce63d2e6 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -447,6 +447,7 @@ static int keyspan_pda_write(struct tty_struct *tty,
 	int request_unthrottle = 0;
 	int rc = 0;
 	struct keyspan_pda_private *priv;
+	unsigned long flags;
 
 	priv = usb_get_serial_port_data(port);
 	/* guess how much room is left in the device's ring buffer, and if we
@@ -466,13 +467,13 @@ static int keyspan_pda_write(struct tty_struct *tty,
 	   the TX urb is in-flight (wait until it completes)
 	   the device is full (wait until it says there is room)
 	*/
-	spin_lock_bh(&port->lock);
+	spin_lock_irqsave(&port->lock, flags);
 	if (!test_bit(0, &port->write_urbs_free) || priv->tx_throttled) {
-		spin_unlock_bh(&port->lock);
+		spin_unlock_irqrestore(&port->lock, flags);
 		return 0;
 	}
 	clear_bit(0, &port->write_urbs_free);
-	spin_unlock_bh(&port->lock);
+	spin_unlock_irqrestore(&port->lock, flags);
 
 	/* At this point the URB is in our control, nobody else can submit it
 	   again (the only sudden transition was the one from EINPROGRESS to

From de852e377012fca70a9c6cef525b90b86e943bdd Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Sun, 25 Oct 2020 18:45:49 +0100
Subject: [PATCH 1258/2658] USB: serial: keyspan_pda: fix stalled writes

commit c01d2c58698f710c9e13ba3e2d296328606f74fd upstream.

Make sure to clear the write-busy flag also in case no new data was
submitted due to lack of device buffer space so that writing is
resumed once space again becomes available.

Fixes: 507ca9bc0476 ("[PATCH] USB: add ability for usb-serial drivers to determine if their write urb is currently being used.")
Cc: stable <stable@vger.kernel.org>     # 2.6.13
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/keyspan_pda.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index 6e09ce63d2e6..ac649431be2f 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -552,7 +552,7 @@ static int keyspan_pda_write(struct tty_struct *tty,
 
 	rc = count;
 exit:
-	if (rc < 0)
+	if (rc <= 0)
 		set_bit(0, &port->write_urbs_free);
 	return rc;
 }

From 14db4a3ba2af4afda8d32c55936486076130df31 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Sun, 25 Oct 2020 18:45:50 +0100
Subject: [PATCH 1259/2658] USB: serial: keyspan_pda: fix write-wakeup
 use-after-free

commit 37faf50615412947868c49aee62f68233307f4e4 upstream.

The driver's deferred write wakeup was never flushed on disconnect,
something which could lead to the driver port data being freed while the
wakeup work is still scheduled.

Fix this by using the usb-serial write wakeup which gets cancelled
properly on disconnect.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/keyspan_pda.c | 17 +++--------------
 1 file changed, 3 insertions(+), 14 deletions(-)

diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index ac649431be2f..ef2e6ffe2a7a 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -47,8 +47,7 @@
 struct keyspan_pda_private {
 	int			tx_room;
 	int			tx_throttled;
-	struct work_struct			wakeup_work;
-	struct work_struct			unthrottle_work;
+	struct work_struct	unthrottle_work;
 	struct usb_serial	*serial;
 	struct usb_serial_port	*port;
 };
@@ -101,15 +100,6 @@ static const struct usb_device_id id_table_fake_xircom[] = {
 };
 #endif
 
-static void keyspan_pda_wakeup_write(struct work_struct *work)
-{
-	struct keyspan_pda_private *priv =
-		container_of(work, struct keyspan_pda_private, wakeup_work);
-	struct usb_serial_port *port = priv->port;
-
-	tty_port_tty_wakeup(&port->port);
-}
-
 static void keyspan_pda_request_unthrottle(struct work_struct *work)
 {
 	struct keyspan_pda_private *priv =
@@ -187,7 +177,7 @@ static void keyspan_pda_rx_interrupt(struct urb *urb)
 		case 2: /* tx unthrottle interrupt */
 			priv->tx_throttled = 0;
 			/* queue up a wakeup at scheduler time */
-			schedule_work(&priv->wakeup_work);
+			usb_serial_port_softint(port);
 			break;
 		default:
 			break;
@@ -567,7 +557,7 @@ static void keyspan_pda_write_bulk_callback(struct urb *urb)
 	priv = usb_get_serial_port_data(port);
 
 	/* queue up a wakeup at scheduler time */
-	schedule_work(&priv->wakeup_work);
+	usb_serial_port_softint(port);
 }
 
 
@@ -733,7 +723,6 @@ static int keyspan_pda_port_probe(struct usb_serial_port *port)
 	if (!priv)
 		return -ENOMEM;
 
-	INIT_WORK(&priv->wakeup_work, keyspan_pda_wakeup_write);
 	INIT_WORK(&priv->unthrottle_work, keyspan_pda_request_unthrottle);
 	priv->serial = port->serial;
 	priv->port = port;

From 7c34fdb8af31b86d62963cef3d4b7564781e2a0e Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Sun, 25 Oct 2020 18:45:51 +0100
Subject: [PATCH 1260/2658] USB: serial: keyspan_pda: fix tx-unthrottle
 use-after-free

commit 49fbb8e37a961396a5b6c82937c70df91de45e9d upstream.

The driver's transmit-unthrottle work was never flushed on disconnect,
something which could lead to the driver port data being freed while the
unthrottle work is still scheduled.

Fix this by cancelling the unthrottle work when shutting down the port.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/keyspan_pda.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index ef2e6ffe2a7a..3a7cb1ae1950 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -651,8 +651,12 @@ static int keyspan_pda_open(struct tty_struct *tty,
 }
 static void keyspan_pda_close(struct usb_serial_port *port)
 {
+	struct keyspan_pda_private *priv = usb_get_serial_port_data(port);
+
 	usb_kill_urb(port->write_urb);
 	usb_kill_urb(port->interrupt_in_urb);
+
+	cancel_work_sync(&priv->unthrottle_work);
 }
 
 

From 15e2854204d60308becd19477978defc64cb3029 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Sun, 25 Oct 2020 18:45:52 +0100
Subject: [PATCH 1261/2658] USB: serial: keyspan_pda: fix write unthrottling

commit 320f9028c7873c3c7710e8e93e5c979f4c857490 upstream.

The driver did not update its view of the available device buffer space
until write() was called in task context. This meant that write_room()
would return 0 even after the device had sent a write-unthrottle
notification, something which could lead to blocked writers not being
woken up (e.g. when using OPOST).

Note that we must also request an unthrottle notification is case a
write() request fills the device buffer exactly.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/keyspan_pda.c | 29 ++++++++++++++++++++---------
 1 file changed, 20 insertions(+), 9 deletions(-)

diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index 3a7cb1ae1950..e25ea9069350 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -44,6 +44,8 @@
 #define DRIVER_AUTHOR "Brian Warner <warner@lothar.com>"
 #define DRIVER_DESC "USB Keyspan PDA Converter driver"
 
+#define KEYSPAN_TX_THRESHOLD	16
+
 struct keyspan_pda_private {
 	int			tx_room;
 	int			tx_throttled;
@@ -114,7 +116,7 @@ static void keyspan_pda_request_unthrottle(struct work_struct *work)
 				 7, /* request_unthrottle */
 				 USB_TYPE_VENDOR | USB_RECIP_INTERFACE
 				 | USB_DIR_OUT,
-				 16, /* value: threshold */
+				 KEYSPAN_TX_THRESHOLD,
 				 0, /* index */
 				 NULL,
 				 0,
@@ -133,6 +135,8 @@ static void keyspan_pda_rx_interrupt(struct urb *urb)
 	int retval;
 	int status = urb->status;
 	struct keyspan_pda_private *priv;
+	unsigned long flags;
+
 	priv = usb_get_serial_port_data(port);
 
 	switch (status) {
@@ -175,7 +179,10 @@ static void keyspan_pda_rx_interrupt(struct urb *urb)
 		case 1: /* modemline change */
 			break;
 		case 2: /* tx unthrottle interrupt */
+			spin_lock_irqsave(&port->lock, flags);
 			priv->tx_throttled = 0;
+			priv->tx_room = max(priv->tx_room, KEYSPAN_TX_THRESHOLD);
+			spin_unlock_irqrestore(&port->lock, flags);
 			/* queue up a wakeup at scheduler time */
 			usb_serial_port_softint(port);
 			break;
@@ -509,7 +516,8 @@ static int keyspan_pda_write(struct tty_struct *tty,
 			goto exit;
 		}
 	}
-	if (count > priv->tx_room) {
+
+	if (count >= priv->tx_room) {
 		/* we're about to completely fill the Tx buffer, so
 		   we'll be throttled afterwards. */
 		count = priv->tx_room;
@@ -564,14 +572,17 @@ static void keyspan_pda_write_bulk_callback(struct urb *urb)
 static int keyspan_pda_write_room(struct tty_struct *tty)
 {
 	struct usb_serial_port *port = tty->driver_data;
-	struct keyspan_pda_private *priv;
-	priv = usb_get_serial_port_data(port);
-	/* used by n_tty.c for processing of tabs and such. Giving it our
-	   conservative guess is probably good enough, but needs testing by
-	   running a console through the device. */
-	return priv->tx_room;
-}
+	struct keyspan_pda_private *priv = usb_get_serial_port_data(port);
+	unsigned long flags;
+	int room = 0;
+
+	spin_lock_irqsave(&port->lock, flags);
+	if (test_bit(0, &port->write_urbs_free) && !priv->tx_throttled)
+		room = priv->tx_room;
+	spin_unlock_irqrestore(&port->lock, flags);
 
+	return room;
+}
 
 static int keyspan_pda_chars_in_buffer(struct tty_struct *tty)
 {

From 4495416e22d07e6236142c42a753eb219f319799 Mon Sep 17 00:00:00 2001
From: Qu Wenruo <wqu@suse.com>
Date: Wed, 27 Jun 2018 18:19:55 +0800
Subject: [PATCH 1262/2658] btrfs: quota: Set rescan progress to (u64)-1 if we
 hit last leaf

commoit 6f7de19ed3d4d3526ca5eca428009f97cf969c2f upstream

Commit ff3d27a048d9 ("btrfs: qgroup: Finish rescan when hit the last leaf
of extent tree") added a new exit for rescan finish.

However after finishing quota rescan, we set
fs_info->qgroup_rescan_progress to (u64)-1 before we exit through the
original exit path.
While we missed that assignment of (u64)-1 in the new exit path.

The end result is, the quota status item doesn't have the same value.
(-1 vs the last bytenr + 1)
Although it doesn't affect quota accounting, it's still better to keep
the original behavior.

Reported-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
Fixes: ff3d27a048d9 ("btrfs: qgroup: Finish rescan when hit the last leaf of extent tree")
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/qgroup.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 18e667fbd054..bc4cc417e7ab 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -2288,8 +2288,10 @@ qgroup_rescan_leaf(struct btrfs_fs_info *fs_info, struct btrfs_path *path,
 	}
 	btrfs_put_tree_mod_seq(fs_info, &tree_mod_seq_elem);
 
-	if (done && !ret)
+	if (done && !ret) {
 		ret = 1;
+		fs_info->qgroup_rescan_progress.objectid = (u64)-1;
+	}
 	return ret;
 }
 

From 22afe46c196152eb1ee7015fa894bf3da0335037 Mon Sep 17 00:00:00 2001
From: Qu Wenruo <wqu@suse.com>
Date: Wed, 11 Jul 2018 13:41:21 +0800
Subject: [PATCH 1263/2658] btrfs: scrub: Don't use inode page cache in
 scrub_handle_errored_block()

commit 665d4953cde6d9e75c62a07ec8f4f8fd7d396ade upstream

In commit ac0b4145d662 ("btrfs: scrub: Don't use inode pages for device
replace") we removed the branch of copy_nocow_pages() to avoid
corruption for compressed nodatasum extents.

However above commit only solves the problem in scrub_extent(), if
during scrub_pages() we failed to read some pages,
sctx->no_io_error_seen will be non-zero and we go to fixup function
scrub_handle_errored_block().

In scrub_handle_errored_block(), for sctx without csum (no matter if
we're doing replace or scrub) we go to scrub_fixup_nodatasum() routine,
which does the similar thing with copy_nocow_pages(), but does it
without the extra check in copy_nocow_pages() routine.

So for test cases like btrfs/100, where we emulate read errors during
replace/scrub, we could corrupt compressed extent data again.

This patch will fix it just by avoiding any "optimization" for
nodatasum, just falls back to the normal fixup routine by try read from
any good copy.

This also solves WARN_ON() or dead lock caused by lame backref iteration
in scrub_fixup_nodatasum() routine.

The deadlock or WARN_ON() won't be triggered before commit ac0b4145d662
("btrfs: scrub: Don't use inode pages for device replace") since
copy_nocow_pages() have better locking and extra check for data extent,
and it's already doing the fixup work by try to read data from any good
copy, so it won't go scrub_fixup_nodatasum() anyway.

This patch disables the faulty code and will be removed completely in a
followup patch.

Fixes: ac0b4145d662 ("btrfs: scrub: Don't use inode pages for device replace")
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/scrub.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index cc9ccc42f469..0b41a88ef9e9 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -918,11 +918,6 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check)
 	have_csum = sblock_to_check->pagev[0]->have_csum;
 	dev = sblock_to_check->pagev[0]->dev;
 
-	if (sctx->is_dev_replace && !is_metadata && !have_csum) {
-		sblocks_for_recheck = NULL;
-		goto nodatasum_case;
-	}
-
 	/*
 	 * read all mirrors one after the other. This includes to
 	 * re-read the extent or metadata block that failed (that was
@@ -1035,13 +1030,19 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check)
 		goto out;
 	}
 
-	if (!is_metadata && !have_csum) {
+	/*
+	 * NOTE: Even for nodatasum case, it's still possible that it's a
+	 * compressed data extent, thus scrub_fixup_nodatasum(), which write
+	 * inode page cache onto disk, could cause serious data corruption.
+	 *
+	 * So here we could only read from disk, and hope our recovery could
+	 * reach disk before the newer write.
+	 */
+	if (0 && !is_metadata && !have_csum) {
 		struct scrub_fixup_nodatasum *fixup_nodatasum;
 
 		WARN_ON(sctx->is_dev_replace);
 
-nodatasum_case:
-
 		/*
 		 * !is_metadata and !have_csum, this means that the data
 		 * might not be COW'ed, that it might be modified

From ef5e8bd9e2a4e48dad095b31f26875ffa5bb6243 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Wed, 18 Sep 2019 13:08:52 +0100
Subject: [PATCH 1264/2658] Btrfs: fix selftests failure due to uninitialized
 i_mode in test inodes

commit 9f7fec0ba89108b9385f1b9fb167861224912a4a upstream

Some of the self tests create a test inode, setup some extents and then do
calls to btrfs_get_extent() to test that the corresponding extent maps
exist and are correct. However btrfs_get_extent(), since the 5.2 merge
window, now errors out when it finds a regular or prealloc extent for an
inode that does not correspond to a regular file (its ->i_mode is not
S_IFREG). This causes the self tests to fail sometimes, specially when
KASAN, slub_debug and page poisoning are enabled:

  $ modprobe btrfs
  modprobe: ERROR: could not insert 'btrfs': Invalid argument

  $ dmesg
  [ 9414.691648] Btrfs loaded, crc32c=crc32c-intel, debug=on, assert=on, integrity-checker=on, ref-verify=on
  [ 9414.692655] BTRFS: selftest: sectorsize: 4096  nodesize: 4096
  [ 9414.692658] BTRFS: selftest: running btrfs free space cache tests
  [ 9414.692918] BTRFS: selftest: running extent only tests
  [ 9414.693061] BTRFS: selftest: running bitmap only tests
  [ 9414.693366] BTRFS: selftest: running bitmap and extent tests
  [ 9414.696455] BTRFS: selftest: running space stealing from bitmap to extent tests
  [ 9414.697131] BTRFS: selftest: running extent buffer operation tests
  [ 9414.697133] BTRFS: selftest: running btrfs_split_item tests
  [ 9414.697564] BTRFS: selftest: running extent I/O tests
  [ 9414.697583] BTRFS: selftest: running find delalloc tests
  [ 9415.081125] BTRFS: selftest: running find_first_clear_extent_bit test
  [ 9415.081278] BTRFS: selftest: running extent buffer bitmap tests
  [ 9415.124192] BTRFS: selftest: running inode tests
  [ 9415.124195] BTRFS: selftest: running btrfs_get_extent tests
  [ 9415.127909] BTRFS: selftest: running hole first btrfs_get_extent test
  [ 9415.128343] BTRFS critical (device (efault)): regular/prealloc extent found for non-regular inode 256
  [ 9415.131428] BTRFS: selftest: fs/btrfs/tests/inode-tests.c:904 expected a real extent, got 0

This happens because the test inodes are created without ever initializing
the i_mode field of the inode, and neither VFS's new_inode() nor the btrfs
callback btrfs_alloc_inode() initialize the i_mode. Initialization of the
i_mode is done through the various callbacks used by the VFS to create
new inodes (regular files, directories, symlinks, tmpfiles, etc), which
all call btrfs_new_inode() which in turn calls inode_init_owner(), which
sets the inode's i_mode. Since the tests only uses new_inode() to create
the test inodes, the i_mode was never initialized.

This always happens on a VM I used with kasan, slub_debug and many other
debug facilities enabled. It also happened to someone who reported this
on bugzilla (on a 5.3-rc).

Fix this by setting i_mode to S_IFREG at btrfs_new_test_inode().

Fixes: 6bf9e4bd6a2778 ("btrfs: inode: Verify inode mode to avoid NULL pointer dereference")
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204397
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/tests/btrfs-tests.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/tests/btrfs-tests.c b/fs/btrfs/tests/btrfs-tests.c
index 69255148f0c8..2825cbe3ea8d 100644
--- a/fs/btrfs/tests/btrfs-tests.c
+++ b/fs/btrfs/tests/btrfs-tests.c
@@ -48,7 +48,13 @@ static struct file_system_type test_type = {
 
 struct inode *btrfs_new_test_inode(void)
 {
-	return new_inode(test_mnt->mnt_sb);
+	struct inode *inode;
+
+	inode = new_inode(test_mnt->mnt_sb);
+	if (inode)
+		inode_init_owner(inode, NULL, S_IFREG);
+
+	return inode;
 }
 
 int btrfs_init_test_fs(void)

From 3cad59db69249cc73c607758eefc8e62ad7ba024 Mon Sep 17 00:00:00 2001
From: Pavel Machek <pavel@denx.de>
Date: Mon, 3 Aug 2020 11:35:06 +0200
Subject: [PATCH 1265/2658] btrfs: fix return value mixup in btrfs_get_extent

commit 881a3a11c2b858fe9b69ef79ac5ee9978a266dc9 upstream

btrfs_get_extent() sets variable ret, but out: error path expect error
to be in variable err so the error code is lost.

Fixes: 6bf9e4bd6a27 ("btrfs: inode: Verify inode mode to avoid NULL pointer dereference")
CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Pavel Machek (CIP) <pavel@denx.de>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 9e1f9910bdf2..6d846ff696fb 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6923,7 +6923,7 @@ struct extent_map *btrfs_get_extent(struct inode *inode, struct page *page,
 	    found_type == BTRFS_FILE_EXTENT_PREALLOC) {
 		/* Only regular file could have regular/prealloc extent */
 		if (!S_ISREG(inode->i_mode)) {
-			ret = -EUCLEAN;
+			err = -EUCLEAN;
 			btrfs_crit(root->fs_info,
 		"regular/prealloc extent found for non-regular inode %llu",
 				   btrfs_ino(inode));

From f964083bfcdcf5c144b9d8a296edcd60299df275 Mon Sep 17 00:00:00 2001
From: Chunguang Xu <brookxu@tencent.com>
Date: Sat, 7 Nov 2020 23:58:18 +0800
Subject: [PATCH 1266/2658] ext4: fix a memory leak of ext4_free_data

commit cca415537244f6102cbb09b5b90db6ae2c953bdd upstream.

When freeing metadata, we will create an ext4_free_data and
insert it into the pending free list.  After the current
transaction is committed, the object will be freed.

ext4_mb_free_metadata() will check whether the area to be freed
overlaps with the pending free list. If true, return directly. At this
time, ext4_free_data is leaked.  Fortunately, the probability of this
problem is small, since it only occurs if the file system is corrupted
such that a block is claimed by more one inode and those inodes are
deleted within a single jbd2 transaction.

Signed-off-by: Chunguang Xu <brookxu@tencent.com>
Link: https://lore.kernel.org/r/1604764698-4269-8-git-send-email-brookxu@tencent.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/mballoc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index bff7c3434603..8075fc8f4e61 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -4628,6 +4628,7 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b,
 				ext4_group_first_block_no(sb, group) +
 				EXT4_C2B(sbi, cluster),
 				"Block already on to-be-freed list");
+			kmem_cache_free(ext4_free_data_cachep, new_entry);
 			return 0;
 		}
 	}

From d19efd7492ac7f0c1eca095b53d58c0a9d16cd81 Mon Sep 17 00:00:00 2001
From: Luis Henriques <lhenriques@suse.de>
Date: Thu, 12 Nov 2020 10:45:12 +0000
Subject: [PATCH 1267/2658] ceph: fix race in concurrent __ceph_remove_cap
 invocations

commit e5cafce3ad0f8652d6849314d951459c2bff7233 upstream.

A NULL pointer dereference may occur in __ceph_remove_cap with some of the
callbacks used in ceph_iterate_session_caps, namely trim_caps_cb and
remove_session_caps_cb. Those callers hold the session->s_mutex, so they
are prevented from concurrent execution, but ceph_evict_inode does not.

Since the callers of this function hold the i_ceph_lock, the fix is simply
a matter of returning immediately if caps->ci is NULL.

Cc: stable@vger.kernel.org
URL: https://tracker.ceph.com/issues/43272
Suggested-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Luis Henriques <lhenriques@suse.de>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ceph/caps.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 49e693232916..9d74cd37b395 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -920,12 +920,19 @@ void __ceph_remove_cap(struct ceph_cap *cap, bool queue_release)
 {
 	struct ceph_mds_session *session = cap->session;
 	struct ceph_inode_info *ci = cap->ci;
-	struct ceph_mds_client *mdsc =
-		ceph_sb_to_client(ci->vfs_inode.i_sb)->mdsc;
+	struct ceph_mds_client *mdsc;
 	int removed = 0;
 
+	/* 'ci' being NULL means the remove have already occurred */
+	if (!ci) {
+		dout("%s: cap inode is NULL\n", __func__);
+		return;
+	}
+
 	dout("__ceph_remove_cap %p from %p\n", cap, &ci->vfs_inode);
 
+	mdsc = ceph_inode_to_client(&ci->vfs_inode)->mdsc;
+
 	/* remove from inode's cap rbtree, and clear auth cap */
 	rb_erase(&cap->ci_node, &ci->i_caps);
 	if (ci->i_auth_cap == cap)

From c706328a1fe03a2fa6fbcf054ca2547232736fe0 Mon Sep 17 00:00:00 2001
From: Zhe Li <lizhe67@huawei.com>
Date: Fri, 29 May 2020 11:37:11 +0800
Subject: [PATCH 1268/2658] jffs2: Fix GC exit abnormally

commit 9afc9a8a4909fece0e911e72b1060614ba2f7969 upstream.

The log of this problem is:
jffs2: Error garbage collecting node at 0x***!
jffs2: No space for garbage collection. Aborting GC thread

This is because GC believe that it do nothing, so it abort.

After going over the image of jffs2, I find a scene that
can trigger this problem stably.
The scene is: there is a normal dirent node at summary-area,
but abnormal at corresponding not-summary-area with error
name_crc.

The reason that GC exit abnormally is because it find that
abnormal dirent node to GC, but when it goes to function
jffs2_add_fd_to_list, it cannot meet the condition listed
below:

if ((*prev)->nhash == new->nhash && !strcmp((*prev)->name, new->name))

So no node is marked obsolete, statistical information of
erase_block do not change, which cause GC exit abnormally.

The root cause of this problem is: we do not check the
name_crc of the abnormal dirent node with summary is enabled.

Noticed that in function jffs2_scan_dirent_node, we use
function jffs2_scan_dirty_space to deal with the dirent
node with error name_crc. So this patch add a checking
code in function read_direntry to ensure the correctness
of dirent node. If checked failed, the dirent node will
be marked obsolete so GC will pass this node and this
problem will be fixed.

Cc: <stable@vger.kernel.org>
Signed-off-by: Zhe Li <lizhe67@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/jffs2/readinode.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index 5b52ea41b84f..bee8964682f8 100644
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -672,6 +672,22 @@ static inline int read_direntry(struct jffs2_sb_info *c, struct jffs2_raw_node_r
 			jffs2_free_full_dirent(fd);
 			return -EIO;
 		}
+
+#ifdef CONFIG_JFFS2_SUMMARY
+		/*
+		 * we use CONFIG_JFFS2_SUMMARY because without it, we
+		 * have checked it while mounting
+		 */
+		crc = crc32(0, fd->name, rd->nsize);
+		if (unlikely(crc != je32_to_cpu(rd->name_crc))) {
+			JFFS2_NOTICE("name CRC failed on dirent node at"
+			   "%#08x: read %#08x,calculated %#08x\n",
+			   ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
+			jffs2_mark_node_obsolete(c, ref);
+			jffs2_free_full_dirent(fd);
+			return 0;
+		}
+#endif
 	}
 
 	fd->nhash = full_name_hash(fd->name, rd->nsize);

From cab054c593873117c791e751c2465e55d89321c3 Mon Sep 17 00:00:00 2001
From: Dave Kleikamp <dave.kleikamp@oracle.com>
Date: Fri, 13 Nov 2020 14:58:46 -0600
Subject: [PATCH 1269/2658] jfs: Fix array index bounds check in dbAdjTree

commit c61b3e4839007668360ed8b87d7da96d2e59fc6c upstream.

Bounds checking tools can flag a bug in dbAdjTree() for an array index
out of bounds in dmt_stree. Since dmt_stree can refer to the stree in
both structures dmaptree and dmapctl, use the larger array to eliminate
the false positive.

Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/jfs/jfs_dmap.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/jfs/jfs_dmap.h b/fs/jfs/jfs_dmap.h
index 562b9a7e4311..f502a15c6c98 100644
--- a/fs/jfs/jfs_dmap.h
+++ b/fs/jfs/jfs_dmap.h
@@ -196,7 +196,7 @@ typedef union dmtree {
 #define	dmt_leafidx	t1.leafidx
 #define	dmt_height	t1.height
 #define	dmt_budmin	t1.budmin
-#define	dmt_stree	t1.stree
+#define	dmt_stree	t2.stree
 
 /*
  *	on-disk aggregate disk allocation map descriptor.

From 817db44391d5a5453cabfcbf3bbd352ae1bb277b Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@wunner.de>
Date: Mon, 7 Dec 2020 09:17:10 +0100
Subject: [PATCH 1270/2658] spi: rb4xx: Don't leak SPI master in probe error
 path

commit a4729c3506c3eb1a6ca5c0289f4e7cafa4115065 upstream.

If the calls to devm_clk_get(), devm_spi_register_master() or
clk_prepare_enable() fail on probe of the Mikrotik RB4xx SPI driver,
the spi_master struct is erroneously not freed.

Fix by switching over to the new devm_spi_alloc_master() helper.

Fixes: 05aec357871f ("spi: Add SPI driver for Mikrotik RB4xx series boards")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.2+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.2+
Cc: Bert Vermeulen <bert@biot.com>
Link: https://lore.kernel.org/r/369bf26d71927f60943b1d9d8f51810f00b0237d.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi-rb4xx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/spi/spi-rb4xx.c b/drivers/spi/spi-rb4xx.c
index 3641d0e20135..1d7fd6dbaf87 100644
--- a/drivers/spi/spi-rb4xx.c
+++ b/drivers/spi/spi-rb4xx.c
@@ -148,7 +148,7 @@ static int rb4xx_spi_probe(struct platform_device *pdev)
 	if (IS_ERR(spi_base))
 		return PTR_ERR(spi_base);
 
-	master = spi_alloc_master(&pdev->dev, sizeof(*rbspi));
+	master = devm_spi_alloc_master(&pdev->dev, sizeof(*rbspi));
 	if (!master)
 		return -ENOMEM;
 

From 677639d9b54f06bc6de9d8c50ef4623c5b4902ab Mon Sep 17 00:00:00 2001
From: Sven Eckelmann <sven@narfation.org>
Date: Tue, 24 Nov 2020 07:25:06 +0100
Subject: [PATCH 1271/2658] mtd: parser: cmdline: Fix parsing of part-names
 with colons

commit 639a82434f16a6df0ce0e7c8595976f1293940fd upstream.

Some devices (especially QCA ones) are already using hardcoded partition
names with colons in it. The OpenMesh A62 for example provides following
mtd relevant information via cmdline:

  root=31:11 mtdparts=spi0.0:256k(0:SBL1),128k(0:MIBIB),384k(0:QSEE),64k(0:CDT),64k(0:DDRPARAMS),64k(0:APPSBLENV),512k(0:APPSBL),64k(0:ART),64k(custom),64k(0:KEYS),0x002b0000(kernel),0x00c80000(rootfs),15552k(inactive) rootfsname=rootfs rootwait

The change to split only on the last colon between mtd-id and partitions
will cause newpart to see following string for the first partition:

  KEYS),0x002b0000(kernel),0x00c80000(rootfs),15552k(inactive)

Such a partition list cannot be parsed and thus the device fails to boot.

Avoid this behavior by making sure that the start of the first part-name
("(") will also be the last byte the mtd-id split algorithm is using for
its colon search.

Fixes: eb13fa022741 ("mtd: parser: cmdline: Support MTD names containing one or more colons")
Cc: stable@vger.kernel.org
Cc: Ron Minnich <rminnich@google.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20201124062506.185392-1-sven@narfation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/cmdlinepart.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/cmdlinepart.c b/drivers/mtd/cmdlinepart.c
index ffbc9b304beb..ab5b023ad279 100644
--- a/drivers/mtd/cmdlinepart.c
+++ b/drivers/mtd/cmdlinepart.c
@@ -228,7 +228,7 @@ static int mtdpart_setup_real(char *s)
 		struct cmdline_mtd_partition *this_mtd;
 		struct mtd_partition *parts;
 		int mtd_id_len, num_parts;
-		char *p, *mtd_id, *semicol;
+		char *p, *mtd_id, *semicol, *open_parenth;
 
 		/*
 		 * Replace the first ';' by a NULL char so strrchr can work
@@ -238,6 +238,14 @@ static int mtdpart_setup_real(char *s)
 		if (semicol)
 			*semicol = '\0';
 
+		/*
+		 * make sure that part-names with ":" will not be handled as
+		 * part of the mtd-id with an ":"
+		 */
+		open_parenth = strchr(s, '(');
+		if (open_parenth)
+			*open_parenth = '\0';
+
 		mtd_id = s;
 
 		/*
@@ -247,6 +255,10 @@ static int mtdpart_setup_real(char *s)
 		 */
 		p = strrchr(s, ':');
 
+		/* Restore the '(' now. */
+		if (open_parenth)
+			*open_parenth = '(';
+
 		/* Restore the ';' now. */
 		if (semicol)
 			*semicol = ';';

From aa8747a249712dab7d02d47cdf005f03465ea0c7 Mon Sep 17 00:00:00 2001
From: Qinglang Miao <miaoqinglang@huawei.com>
Date: Tue, 3 Nov 2020 20:07:43 +0800
Subject: [PATCH 1272/2658] iio: adc: rockchip_saradc: fix missing
 clk_disable_unprepare() on error in rockchip_saradc_resume

commit 560c6b914c6ec7d9d9a69fddbb5bf3bf71433e8b upstream.

Fix the missing clk_disable_unprepare() of info->pclk
before return from rockchip_saradc_resume in the error
handling case when fails to prepare and enable info->clk.

Suggested-by: Robin Murphy <robin.murphy@arm.com>
Fixes: 44d6f2ef94f9 ("iio: adc: add driver for Rockchip saradc")
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201103120743.110662-1-miaoqinglang@huawei.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/rockchip_saradc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c
index dffff64b5989..da91e9e9ed8f 100644
--- a/drivers/iio/adc/rockchip_saradc.c
+++ b/drivers/iio/adc/rockchip_saradc.c
@@ -359,7 +359,7 @@ static int rockchip_saradc_resume(struct device *dev)
 
 	ret = clk_prepare_enable(info->clk);
 	if (ret)
-		return ret;
+		clk_disable_unprepare(info->pclk);
 
 	return ret;
 }

From 379d283bf9f023dfd0b00224f6df29f3bf9bebd9 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Sun, 20 Sep 2020 12:27:40 +0100
Subject: [PATCH 1273/2658] iio:pressure:mpl3115: Force alignment of buffer

commit 198cf32f0503d2ad60d320b95ef6fb8243db857f upstream.

Whilst this is another case of the issue Lars reported with
an array of elements of smaller than 8 bytes being passed
to iio_push_to_buffers_with_timestamp(), the solution here is
a bit different from the other cases and relies on __aligned
working on the stack (true since 4.6?)

This one is unusual.  We have to do an explicit memset() each time
as we are reading 3 bytes into a potential 4 byte channel which
may sometimes be a 2 byte channel depending on what is enabled.
As such, moving the buffer to the heap in the iio_priv structure
doesn't save us much.  We can't use a nice explicit structure
on the stack either as the data channels have different storage
sizes and are all separately controlled.

Fixes: cc26ad455f57 ("iio: Add Freescale MPL3115A2 pressure / temperature sensor driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Peter Meerwald <pmeerw@pmeerw.net>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-7-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/pressure/mpl3115.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/pressure/mpl3115.c b/drivers/iio/pressure/mpl3115.c
index 0f5b8767ec2e..6ed4e6902eff 100644
--- a/drivers/iio/pressure/mpl3115.c
+++ b/drivers/iio/pressure/mpl3115.c
@@ -139,7 +139,14 @@ static irqreturn_t mpl3115_trigger_handler(int irq, void *p)
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct mpl3115_data *data = iio_priv(indio_dev);
-	u8 buffer[16]; /* 32-bit channel + 16-bit channel + padding + ts */
+	/*
+	 * 32-bit channel + 16-bit channel + padding + ts
+	 * Note that it is possible for only one of the first 2
+	 * channels to be enabled. If that happens, the first element
+	 * of the buffer may be either 16 or 32-bits.  As such we cannot
+	 * use a simple structure definition to express this data layout.
+	 */
+	u8 buffer[16] __aligned(8);
 	int ret, pos = 0;
 
 	mutex_lock(&data->lock);

From 640927b9f87bef6d1f2a00d36030c31dba0254f0 Mon Sep 17 00:00:00 2001
From: SeongJae Park <sjpark@amazon.de>
Date: Mon, 14 Dec 2020 10:02:45 +0100
Subject: [PATCH 1274/2658] xen/xenbus: Allow watches discard events before
 queueing

commit fed1755b118147721f2c87b37b9d66e62c39b668 upstream.

If handling logics of watch events are slower than the events enqueue
logic and the events can be created from the guests, the guests could
trigger memory pressure by intensively inducing the events, because it
will create a huge number of pending events that exhausting the memory.

Fortunately, some watch events could be ignored, depending on its
handler callback.  For example, if the callback has interest in only one
single path, the watch wouldn't want multiple pending events.  Or, some
watches could ignore events to same path.

To let such watches to volutarily help avoiding the memory pressure
situation, this commit introduces new watch callback, 'will_handle'.  If
it is not NULL, it will be called for each new event just before
enqueuing it.  Then, if the callback returns false, the event will be
discarded.  No watch is using the callback for now, though.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/xen-netback/xenbus.c   | 2 ++
 drivers/xen/xenbus/xenbus_client.c | 1 +
 drivers/xen/xenbus/xenbus_xs.c     | 7 ++++++-
 include/xen/xenbus.h               | 7 +++++++
 4 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 56ebd8267386..23f03af0a2d4 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -697,12 +697,14 @@ static int xen_register_watchers(struct xenbus_device *dev, struct xenvif *vif)
 		return -ENOMEM;
 	snprintf(node, maxlen, "%s/rate", dev->nodename);
 	vif->credit_watch.node = node;
+	vif->credit_watch.will_handle = NULL;
 	vif->credit_watch.callback = xen_net_rate_changed;
 	err = register_xenbus_watch(&vif->credit_watch);
 	if (err) {
 		pr_err("Failed to set watcher %s\n", vif->credit_watch.node);
 		kfree(node);
 		vif->credit_watch.node = NULL;
+		vif->credit_watch.will_handle = NULL;
 		vif->credit_watch.callback = NULL;
 	}
 	return err;
diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
index 266f446ba331..d02d25f784c9 100644
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -120,6 +120,7 @@ int xenbus_watch_path(struct xenbus_device *dev, const char *path,
 	int err;
 
 	watch->node = path;
+	watch->will_handle = NULL;
 	watch->callback = callback;
 
 	err = register_xenbus_watch(watch);
diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index ce65591b4168..0ea1c259f2f1 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -903,7 +903,12 @@ static int process_msg(void)
 		spin_lock(&watches_lock);
 		msg->u.watch.handle = find_watch(
 			msg->u.watch.vec[XS_WATCH_TOKEN]);
-		if (msg->u.watch.handle != NULL) {
+		if (msg->u.watch.handle != NULL &&
+				(!msg->u.watch.handle->will_handle ||
+				 msg->u.watch.handle->will_handle(
+					 msg->u.watch.handle,
+					 (const char **)msg->u.watch.vec,
+					 msg->u.watch.vec_size))) {
 			spin_lock(&watch_events_lock);
 			list_add_tail(&msg->list, &watch_events);
 			wake_up(&watch_events_waitq);
diff --git a/include/xen/xenbus.h b/include/xen/xenbus.h
index 32b944b7cebd..11697aa023b5 100644
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -58,6 +58,13 @@ struct xenbus_watch
 	/* Path being watched. */
 	const char *node;
 
+	/*
+	 * Called just before enqueing new event while a spinlock is held.
+	 * The event will be discarded if this callback returns false.
+	 */
+	bool (*will_handle)(struct xenbus_watch *,
+			    const char **vec, unsigned int len);
+
 	/* Callback (executed in a process context with no locks held). */
 	void (*callback)(struct xenbus_watch *,
 			 const char **vec, unsigned int len);

From 04aa407ab105f717b2148bc7ad06c6cd2a802d45 Mon Sep 17 00:00:00 2001
From: SeongJae Park <sjpark@amazon.de>
Date: Mon, 14 Dec 2020 10:04:18 +0100
Subject: [PATCH 1275/2658] xen/xenbus: Add 'will_handle' callback support in
 xenbus_watch_path()

commit 2e85d32b1c865bec703ce0c962221a5e955c52c2 upstream.

Some code does not directly make 'xenbus_watch' object and call
'register_xenbus_watch()' but use 'xenbus_watch_path()' instead.  This
commit adds support of 'will_handle' callback in the
'xenbus_watch_path()' and it's wrapper, 'xenbus_watch_pathfmt()'.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/block/xen-blkback/xenbus.c | 3 ++-
 drivers/net/xen-netback/xenbus.c   | 2 +-
 drivers/xen/xen-pciback/xenbus.c   | 2 +-
 drivers/xen/xenbus/xenbus_client.c | 9 +++++++--
 drivers/xen/xenbus/xenbus_probe.c  | 2 +-
 include/xen/xenbus.h               | 6 +++++-
 6 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 0ec257e69e95..823f3480ebd1 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -553,7 +553,8 @@ static int xen_blkbk_probe(struct xenbus_device *dev,
 	/* setup back pointer */
 	be->blkif->be = be;
 
-	err = xenbus_watch_pathfmt(dev, &be->backend_watch, backend_changed,
+	err = xenbus_watch_pathfmt(dev, &be->backend_watch, NULL,
+				   backend_changed,
 				   "%s/%s", dev->nodename, "physical-device");
 	if (err)
 		goto fail;
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 23f03af0a2d4..21c8e2720b40 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -849,7 +849,7 @@ static void connect(struct backend_info *be)
 	xenvif_carrier_on(be->vif);
 
 	unregister_hotplug_status_watch(be);
-	err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch,
+	err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch, NULL,
 				   hotplug_status_changed,
 				   "%s/%s", dev->nodename, "hotplug-status");
 	if (!err)
diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c
index 48196347f2f9..12497a2140c2 100644
--- a/drivers/xen/xen-pciback/xenbus.c
+++ b/drivers/xen/xen-pciback/xenbus.c
@@ -691,7 +691,7 @@ static int xen_pcibk_xenbus_probe(struct xenbus_device *dev,
 
 	/* watch the backend node for backend configuration information */
 	err = xenbus_watch_path(dev, dev->nodename, &pdev->be_watch,
-				xen_pcibk_be_watch);
+				NULL, xen_pcibk_be_watch);
 	if (err)
 		goto out;
 
diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
index d02d25f784c9..8bbd887ca422 100644
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -114,19 +114,22 @@ EXPORT_SYMBOL_GPL(xenbus_strstate);
  */
 int xenbus_watch_path(struct xenbus_device *dev, const char *path,
 		      struct xenbus_watch *watch,
+		      bool (*will_handle)(struct xenbus_watch *,
+					  const char **, unsigned int),
 		      void (*callback)(struct xenbus_watch *,
 				       const char **, unsigned int))
 {
 	int err;
 
 	watch->node = path;
-	watch->will_handle = NULL;
+	watch->will_handle = will_handle;
 	watch->callback = callback;
 
 	err = register_xenbus_watch(watch);
 
 	if (err) {
 		watch->node = NULL;
+		watch->will_handle = NULL;
 		watch->callback = NULL;
 		xenbus_dev_fatal(dev, err, "adding watch on %s", path);
 	}
@@ -153,6 +156,8 @@ EXPORT_SYMBOL_GPL(xenbus_watch_path);
  */
 int xenbus_watch_pathfmt(struct xenbus_device *dev,
 			 struct xenbus_watch *watch,
+			 bool (*will_handle)(struct xenbus_watch *,
+					     const char **, unsigned int),
 			 void (*callback)(struct xenbus_watch *,
 					const char **, unsigned int),
 			 const char *pathfmt, ...)
@@ -169,7 +174,7 @@ int xenbus_watch_pathfmt(struct xenbus_device *dev,
 		xenbus_dev_fatal(dev, -ENOMEM, "allocating path for watch");
 		return -ENOMEM;
 	}
-	err = xenbus_watch_path(dev, path, watch, callback);
+	err = xenbus_watch_path(dev, path, watch, will_handle, callback);
 
 	if (err)
 		kfree(path);
diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index c2d447687e33..c560c1b8489a 100644
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -137,7 +137,7 @@ static int watch_otherend(struct xenbus_device *dev)
 		container_of(dev->dev.bus, struct xen_bus_type, bus);
 
 	return xenbus_watch_pathfmt(dev, &dev->otherend_watch,
-				    bus->otherend_changed,
+				    NULL, bus->otherend_changed,
 				    "%s/%s", dev->otherend, "state");
 }
 
diff --git a/include/xen/xenbus.h b/include/xen/xenbus.h
index 11697aa023b5..1772507dc2c9 100644
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -201,10 +201,14 @@ void xenbus_suspend_cancel(void);
 
 int xenbus_watch_path(struct xenbus_device *dev, const char *path,
 		      struct xenbus_watch *watch,
+		      bool (*will_handle)(struct xenbus_watch *,
+					  const char **, unsigned int),
 		      void (*callback)(struct xenbus_watch *,
 				       const char **, unsigned int));
-__printf(4, 5)
+__printf(5, 6)
 int xenbus_watch_pathfmt(struct xenbus_device *dev, struct xenbus_watch *watch,
+			 bool (*will_handle)(struct xenbus_watch *,
+					     const char **, unsigned int),
 			 void (*callback)(struct xenbus_watch *,
 					  const char **, unsigned int),
 			 const char *pathfmt, ...);

From b49ff0cf6d4a65b1cc335e75971a0caf79e16826 Mon Sep 17 00:00:00 2001
From: SeongJae Park <sjpark@amazon.de>
Date: Mon, 14 Dec 2020 10:05:47 +0100
Subject: [PATCH 1276/2658] xen/xenbus/xen_bus_type: Support will_handle watch
 callback

commit be987200fbaceaef340872841d4f7af2c5ee8dc3 upstream.

This commit adds support of the 'will_handle' watch callback for
'xen_bus_type' users.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/xenbus/xenbus_probe.c | 3 ++-
 drivers/xen/xenbus/xenbus_probe.h | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index c560c1b8489a..ba7590d75985 100644
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -137,7 +137,8 @@ static int watch_otherend(struct xenbus_device *dev)
 		container_of(dev->dev.bus, struct xen_bus_type, bus);
 
 	return xenbus_watch_pathfmt(dev, &dev->otherend_watch,
-				    NULL, bus->otherend_changed,
+				    bus->otherend_will_handle,
+				    bus->otherend_changed,
 				    "%s/%s", dev->otherend, "state");
 }
 
diff --git a/drivers/xen/xenbus/xenbus_probe.h b/drivers/xen/xenbus/xenbus_probe.h
index c9ec7ca1f7ab..2c394c6ba605 100644
--- a/drivers/xen/xenbus/xenbus_probe.h
+++ b/drivers/xen/xenbus/xenbus_probe.h
@@ -42,6 +42,8 @@ struct xen_bus_type {
 	int (*get_bus_id)(char bus_id[XEN_BUS_ID_SIZE], const char *nodename);
 	int (*probe)(struct xen_bus_type *bus, const char *type,
 		     const char *dir);
+	bool (*otherend_will_handle)(struct xenbus_watch *watch,
+				     const char **vec, unsigned int len);
 	void (*otherend_changed)(struct xenbus_watch *watch, const char **vec,
 				 unsigned int len);
 	struct bus_type bus;

From e3dfc1379252a83add82663bc867f5b58638725a Mon Sep 17 00:00:00 2001
From: SeongJae Park <sjpark@amazon.de>
Date: Mon, 14 Dec 2020 10:07:13 +0100
Subject: [PATCH 1277/2658] xen/xenbus: Count pending messages for each watch

commit 3dc86ca6b4c8cfcba9da7996189d1b5a358a94fc upstream.

This commit adds a counter of pending messages for each watch in the
struct.  It is used to skip unnecessary pending messages lookup in
'unregister_xenbus_watch()'.  It could also be used in 'will_handle'
callback.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/xenbus/xenbus_xs.c | 31 +++++++++++++++++++------------
 include/xen/xenbus.h           |  2 ++
 2 files changed, 21 insertions(+), 12 deletions(-)

diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index 0ea1c259f2f1..d98d88fae58a 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -701,6 +701,8 @@ int register_xenbus_watch(struct xenbus_watch *watch)
 
 	sprintf(token, "%lX", (long)watch);
 
+	watch->nr_pending = 0;
+
 	down_read(&xs_state.watch_mutex);
 
 	spin_lock(&watches_lock);
@@ -750,12 +752,15 @@ void unregister_xenbus_watch(struct xenbus_watch *watch)
 
 	/* Cancel pending watch events. */
 	spin_lock(&watch_events_lock);
-	list_for_each_entry_safe(msg, tmp, &watch_events, list) {
-		if (msg->u.watch.handle != watch)
-			continue;
-		list_del(&msg->list);
-		kfree(msg->u.watch.vec);
-		kfree(msg);
+	if (watch->nr_pending) {
+		list_for_each_entry_safe(msg, tmp, &watch_events, list) {
+			if (msg->u.watch.handle != watch)
+				continue;
+			list_del(&msg->list);
+			kfree(msg->u.watch.vec);
+			kfree(msg);
+		}
+		watch->nr_pending = 0;
 	}
 	spin_unlock(&watch_events_lock);
 
@@ -802,7 +807,6 @@ void xs_suspend_cancel(void)
 
 static int xenwatch_thread(void *unused)
 {
-	struct list_head *ent;
 	struct xs_stored_msg *msg;
 
 	for (;;) {
@@ -815,13 +819,15 @@ static int xenwatch_thread(void *unused)
 		mutex_lock(&xenwatch_mutex);
 
 		spin_lock(&watch_events_lock);
-		ent = watch_events.next;
-		if (ent != &watch_events)
-			list_del(ent);
+		msg = list_first_entry_or_null(&watch_events,
+				struct xs_stored_msg, list);
+		if (msg) {
+			list_del(&msg->list);
+			msg->u.watch.handle->nr_pending--;
+		}
 		spin_unlock(&watch_events_lock);
 
-		if (ent != &watch_events) {
-			msg = list_entry(ent, struct xs_stored_msg, list);
+		if (msg) {
 			msg->u.watch.handle->callback(
 				msg->u.watch.handle,
 				(const char **)msg->u.watch.vec,
@@ -911,6 +917,7 @@ static int process_msg(void)
 					 msg->u.watch.vec_size))) {
 			spin_lock(&watch_events_lock);
 			list_add_tail(&msg->list, &watch_events);
+			msg->u.watch.handle->nr_pending++;
 			wake_up(&watch_events_waitq);
 			spin_unlock(&watch_events_lock);
 		} else {
diff --git a/include/xen/xenbus.h b/include/xen/xenbus.h
index 1772507dc2c9..ed9e7e3307b7 100644
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -58,6 +58,8 @@ struct xenbus_watch
 	/* Path being watched. */
 	const char *node;
 
+	unsigned int nr_pending;
+
 	/*
 	 * Called just before enqueing new event while a spinlock is held.
 	 * The event will be discarded if this callback returns false.

From 4412c1578198f553af3c81a7059e20e40ee014ba Mon Sep 17 00:00:00 2001
From: SeongJae Park <sjpark@amazon.de>
Date: Mon, 14 Dec 2020 10:08:40 +0100
Subject: [PATCH 1278/2658] xenbus/xenbus_backend: Disallow pending watch
 messages

commit 9996bd494794a2fe393e97e7a982388c6249aa76 upstream.

'xenbus_backend' watches 'state' of devices, which is writable by
guests.  Hence, if guests intensively updates it, dom0 will have lots of
pending events that exhausting memory of dom0.  In other words, guests
can trigger dom0 memory pressure.  This is known as XSA-349.  However,
the watch callback of it, 'frontend_changed()', reads only 'state', so
doesn't need to have the pending events.

To avoid the problem, this commit disallows pending watch messages for
'xenbus_backend' using the 'will_handle()' watch callback.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/xenbus/xenbus_probe_backend.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/xen/xenbus/xenbus_probe_backend.c b/drivers/xen/xenbus/xenbus_probe_backend.c
index 04f7f85a5edf..597c0b038454 100644
--- a/drivers/xen/xenbus/xenbus_probe_backend.c
+++ b/drivers/xen/xenbus/xenbus_probe_backend.c
@@ -181,6 +181,12 @@ static int xenbus_probe_backend(struct xen_bus_type *bus, const char *type,
 	return err;
 }
 
+static bool frontend_will_handle(struct xenbus_watch *watch,
+				 const char **vec, unsigned int len)
+{
+	return watch->nr_pending == 0;
+}
+
 static void frontend_changed(struct xenbus_watch *watch,
 			    const char **vec, unsigned int len)
 {
@@ -192,6 +198,7 @@ static struct xen_bus_type xenbus_backend = {
 	.levels = 3,		/* backend/type/<frontend>/<id> */
 	.get_bus_id = backend_bus_id,
 	.probe = xenbus_probe_backend,
+	.otherend_will_handle = frontend_will_handle,
 	.otherend_changed = frontend_changed,
 	.bus = {
 		.name		= "xen-backend",

From 7ce79cc87e8f6a868fa026f4072452b7d17427e7 Mon Sep 17 00:00:00 2001
From: Jubin Zhong <zhongjubin@huawei.com>
Date: Wed, 2 Dec 2020 10:33:42 +0800
Subject: [PATCH 1279/2658] PCI: Fix pci_slot_release() NULL pointer
 dereference

commit 4684709bf81a2d98152ed6b610e3d5c403f9bced upstream.

If kobject_init_and_add() fails, pci_slot_release() is called to delete
slot->list from parent->slots.  But slot->list hasn't been initialized
yet, so we dereference a NULL pointer:

  Unable to handle kernel NULL pointer dereference at virtual address
00000000
  ...
  CPU: 10 PID: 1 Comm: swapper/0 Not tainted 4.4.240 #197
  task: ffffeb398a45ef10 task.stack: ffffeb398a470000
  PC is at __list_del_entry_valid+0x5c/0xb0
  LR is at pci_slot_release+0x84/0xe4
  ...
  __list_del_entry_valid+0x5c/0xb0
  pci_slot_release+0x84/0xe4
  kobject_put+0x184/0x1c4
  pci_create_slot+0x17c/0x1b4
  __pci_hp_initialize+0x68/0xa4
  pciehp_probe+0x1a4/0x2fc
  pcie_port_probe_service+0x58/0x84
  driver_probe_device+0x320/0x470

Initialize slot->list before calling kobject_init_and_add() to avoid this.

Fixes: 8a94644b440e ("PCI: Fix pci_create_slot() reference count leak")
Link: https://lore.kernel.org/r/1606876422-117457-1-git-send-email-zhongjubin@huawei.com
Signed-off-by: Jubin Zhong <zhongjubin@huawei.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org	# v5.9+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/slot.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
index 01a343ad7155..14d84d5a0f58 100644
--- a/drivers/pci/slot.c
+++ b/drivers/pci/slot.c
@@ -307,6 +307,9 @@ struct pci_slot *pci_create_slot(struct pci_bus *parent, int slot_nr,
 		goto err;
 	}
 
+	INIT_LIST_HEAD(&slot->list);
+	list_add(&slot->list, &parent->slots);
+
 	err = kobject_init_and_add(&slot->kobj, &pci_slot_ktype, NULL,
 				   "%s", slot_name);
 	if (err) {
@@ -314,9 +317,6 @@ struct pci_slot *pci_create_slot(struct pci_bus *parent, int slot_nr,
 		goto err;
 	}
 
-	INIT_LIST_HEAD(&slot->list);
-	list_add(&slot->list, &parent->slots);
-
 	down_read(&pci_bus_sem);
 	list_for_each_entry(dev, &parent->devices, bus_list)
 		if (PCI_SLOT(dev->devfn) == slot_nr)

From 8c0ea67c45d73090f81c6e9b64d7fc2c023d4a91 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 29 Dec 2020 13:42:46 +0100
Subject: [PATCH 1280/2658] Linux 4.4.249

Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Link: https://lore.kernel.org/r/20201228124846.409999325@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 219906da8bc4..ee8e4171f988 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 248
+SUBLEVEL = 249
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 4e5e2dd978d888faefc6ad64aaa7f1681f10a0d6 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Fri, 13 Dec 2019 09:51:11 +0100
Subject: [PATCH 1281/2658] ALSA: hda/ca0132 - Fix work handling in delayed HP
 detection

commit 42fb6b1d41eb5905d77c06cad2e87b70289bdb76 upstream

CA0132 has the delayed HP jack detection code that is invoked from the
unsol handler, but it does a few weird things: it contains the cancel
of a work inside the work handler, and yet it misses the cancel-sync
call at (runtime-)suspend.  This patch addresses those issues.

Fixes: 15c2b3cc09a3 ("ALSA: hda/ca0132 - Fix possible workqueue stall")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20191213085111.22855-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_ca0132.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index c05119a3e13b..366e0386e296 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -4443,11 +4443,10 @@ static void hp_callback(struct hda_codec *codec, struct hda_jack_callback *cb)
 	/* Delay enabling the HP amp, to let the mic-detection
 	 * state machine run.
 	 */
-	cancel_delayed_work(&spec->unsol_hp_work);
-	schedule_delayed_work(&spec->unsol_hp_work, msecs_to_jiffies(500));
 	tbl = snd_hda_jack_tbl_get(codec, cb->nid);
 	if (tbl)
 		tbl->block_report = 1;
+	schedule_delayed_work(&spec->unsol_hp_work, msecs_to_jiffies(500));
 }
 
 static void amic_callback(struct hda_codec *codec, struct hda_jack_callback *cb)
@@ -4625,12 +4624,25 @@ static void ca0132_free(struct hda_codec *codec)
 	kfree(codec->spec);
 }
 
+#ifdef CONFIG_PM
+static int ca0132_suspend(struct hda_codec *codec)
+{
+	struct ca0132_spec *spec = codec->spec;
+
+	cancel_delayed_work_sync(&spec->unsol_hp_work);
+	return 0;
+}
+#endif
+
 static struct hda_codec_ops ca0132_patch_ops = {
 	.build_controls = ca0132_build_controls,
 	.build_pcms = ca0132_build_pcms,
 	.init = ca0132_init,
 	.free = ca0132_free,
 	.unsol_event = snd_hda_jack_unsol_event,
+#ifdef CONFIG_PM
+	.suspend = ca0132_suspend,
+#endif
 };
 
 static void ca0132_config(struct hda_codec *codec)

From 3b4a3bd1d6fff0a6dd429bb42c3112bcc81e4a89 Mon Sep 17 00:00:00 2001
From: Alberto Aguirre <albaguirre@gmail.com>
Date: Wed, 18 Apr 2018 09:35:34 -0500
Subject: [PATCH 1282/2658] ALSA: usb-audio: simplify
 set_sync_ep_implicit_fb_quirk

commit 103e9625647ad74d201e26fb74afcd8479142a37 upstream

Signed-off-by: Alberto Aguirre <albaguirre@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/pcm.c | 38 ++++++++++++++++----------------------
 1 file changed, 16 insertions(+), 22 deletions(-)

diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 65552875692c..e5221fc51ede 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -324,6 +324,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
 	struct usb_host_interface *alts;
 	struct usb_interface *iface;
 	unsigned int ep;
+	unsigned int ifnum;
 
 	/* Implicit feedback sync EPs consumers are always playback EPs */
 	if (subs->direction != SNDRV_PCM_STREAM_PLAYBACK)
@@ -334,34 +335,19 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
 	case USB_ID(0x0763, 0x2031): /* M-Audio Fast Track C600 */
 	case USB_ID(0x22f0, 0x0006): /* Allen&Heath Qu-16 */
 		ep = 0x81;
-		iface = usb_ifnum_to_if(dev, 3);
-
-		if (!iface || iface->num_altsetting == 0)
-			return -EINVAL;
-
-		alts = &iface->altsetting[1];
-		goto add_sync_ep;
-		break;
+		ifnum = 3;
+		goto add_sync_ep_from_ifnum;
 	case USB_ID(0x0763, 0x2080): /* M-Audio FastTrack Ultra */
 	case USB_ID(0x0763, 0x2081):
 		ep = 0x81;
-		iface = usb_ifnum_to_if(dev, 2);
-
-		if (!iface || iface->num_altsetting == 0)
-			return -EINVAL;
-
-		alts = &iface->altsetting[1];
-		goto add_sync_ep;
+		ifnum = 2;
+		goto add_sync_ep_from_ifnum;
 	case USB_ID(0x1397, 0x0002):
 		ep = 0x81;
-		iface = usb_ifnum_to_if(dev, 1);
-
-		if (!iface || iface->num_altsetting == 0)
-			return -EINVAL;
-
-		alts = &iface->altsetting[1];
-		goto add_sync_ep;
+		ifnum = 1;
+		goto add_sync_ep_from_ifnum;
 	}
+
 	if (attr == USB_ENDPOINT_SYNC_ASYNC &&
 	    altsd->bInterfaceClass == USB_CLASS_VENDOR_SPEC &&
 	    altsd->bInterfaceProtocol == 2 &&
@@ -376,6 +362,14 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
 	/* No quirk */
 	return 0;
 
+add_sync_ep_from_ifnum:
+	iface = usb_ifnum_to_if(dev, ifnum);
+
+	if (!iface || iface->num_altsetting == 0)
+		return -EINVAL;
+
+	alts = &iface->altsetting[1];
+
 add_sync_ep:
 	subs->sync_endpoint = snd_usb_add_endpoint(subs->stream->chip,
 						   alts, ep, !subs->direction,

From 659057f0da333a2c3ae6781d0db2226cc0714dd4 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Tue, 14 Jan 2020 09:39:53 +0100
Subject: [PATCH 1283/2658] ALSA: usb-audio: fix sync-ep altsetting sanity
 check

commit 5d1b71226dc4d44b4b65766fa9d74492f9d4587b upstream

The altsetting sanity check in set_sync_ep_implicit_fb_quirk() was
checking for there to be at least one altsetting but then went on to
access the second one, which may not exist.

This could lead to random slab data being used to initialise the sync
endpoint in snd_usb_add_endpoint().

Fixes: c75a8a7ae565 ("ALSA: snd-usb: add support for implicit feedback")
Fixes: ca10a7ebdff1 ("ALSA: usb-audio: FT C400 sync playback EP to capture EP")
Fixes: 5e35dc0338d8 ("ALSA: usb-audio: add implicit fb quirk for Behringer UFX1204")
Fixes: 17f08b0d9aaf ("ALSA: usb-audio: add implicit fb quirk for Axe-Fx II")
Fixes: 103e9625647a ("ALSA: usb-audio: simplify set_sync_ep_implicit_fb_quirk")
Cc: stable <stable@vger.kernel.org>     # 3.5
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20200114083953.1106-1-johan@kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/pcm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index e5221fc51ede..a56eb871784b 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -365,7 +365,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
 add_sync_ep_from_ifnum:
 	iface = usb_ifnum_to_if(dev, ifnum);
 
-	if (!iface || iface->num_altsetting == 0)
+	if (!iface || iface->num_altsetting < 2)
 		return -EINVAL;
 
 	alts = &iface->altsetting[1];

From b42c2feacade4ada816b654bd84767ea6531d111 Mon Sep 17 00:00:00 2001
From: Kailang Yang <kailang@realtek.com>
Date: Thu, 29 Jun 2017 15:21:27 +0800
Subject: [PATCH 1284/2658] ALSA: hda/realtek - Support Dell headset mode for
 ALC3271

commit fcc6c877a01f83cbce1cca885ea62df6a10d33c3 upstream

Add DELL4_MIC_NO_PRESENCE model.
Add the pin configuration value of this machine into the pin_quirk
table to make DELL4_MIC_NO_PRESENCE apply to this machine.

Signed-off-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index df6f8e904eb6..38ef6346ca40 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4848,6 +4848,7 @@ enum {
 	ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
 	ALC269_FIXUP_DELL2_MIC_NO_PRESENCE,
 	ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
+	ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
 	ALC269_FIXUP_HEADSET_MODE,
 	ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC,
 	ALC269_FIXUP_ASPIRE_HEADSET_MIC,
@@ -5150,6 +5151,16 @@ static const struct hda_fixup alc269_fixups[] = {
 		.chained = true,
 		.chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
 	},
+	[ALC269_FIXUP_DELL4_MIC_NO_PRESENCE] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+			{ 0x1b, 0x01a1913d }, /* use as headphone mic, without its own jack detect */
+			{ }
+		},
+		.chained = true,
+		.chain_id = ALC269_FIXUP_HEADSET_MODE
+	},
 	[ALC269_FIXUP_HEADSET_MODE] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc_fixup_headset_mode,
@@ -6194,6 +6205,11 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
 		{0x17, 0x90170110},
 		{0x1a, 0x03011020},
 		{0x21, 0x03211030}),
+	SND_HDA_PIN_QUIRK(0x10ec0299, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
+		ALC225_STANDARD_PINS,
+		{0x12, 0xb7a60130},
+		{0x13, 0xb8a60140},
+		{0x17, 0x90170110}),
 	{}
 };
 

From 9b2739d75e0a91b82e1e6ff34625d01f8788bcd0 Mon Sep 17 00:00:00 2001
From: Hui Wang <hui.wang@canonical.com>
Date: Fri, 2 Mar 2018 13:05:36 +0800
Subject: [PATCH 1285/2658] ALSA: hda - Fix a wrong FIXUP for alc289 on Dell
 machines

commit d5078193e56bb24f4593f00102a3b5e07bb84ee0 upstream

With the alc289, the Pin 0x1b is Headphone-Mic, so we should assign
ALC269_FIXUP_DELL4_MIC_NO_PRESENCE rather than
ALC225_FIXUP_DELL1_MIC_NO_PRESENCE to it. And this change is suggested
by Kailang of Realtek and is verified on the machine.

Fixes: 3f2f7c553d07 ("ALSA: hda - Fix headset mic detection problem for two Dell machines")
Cc: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 38ef6346ca40..d9408d394747 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6121,7 +6121,7 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
 		{0x12, 0x90a60120},
 		{0x14, 0x90170110},
 		{0x21, 0x0321101f}),
-	SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+	SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
 		{0x12, 0xb7a60130},
 		{0x14, 0x90170110},
 		{0x21, 0x04211020}),

From c8673ea27eac76213473ff4d5cdecd66f264bb3f Mon Sep 17 00:00:00 2001
From: Kailang Yang <kailang@realtek.com>
Date: Tue, 26 Nov 2019 17:04:23 +0800
Subject: [PATCH 1286/2658] ALSA: hda/realtek - Dell headphone has noise on
 unmute for ALC236

commit e1e8c1fdce8b00fce08784d9d738c60ebf598ebc upstream

headphone have noise even the volume is very small.
Let it fill up pcbeep hidden register to default value.
The issue was gone.

Fixes: 4344aec84bd8 ("ALSA: hda/realtek - New codec support for ALC256")
Fixes: 736f20a70608 ("ALSA: hda/realtek - Add support for ALC236/ALC3204")
Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/9ae47f23a64d4e41a9c81e263cd8a250@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index d9408d394747..854d2da02cc9 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -330,9 +330,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
 	case 0x10ec0225:
 	case 0x10ec0233:
 	case 0x10ec0235:
-	case 0x10ec0236:
 	case 0x10ec0255:
-	case 0x10ec0256:
 	case 0x10ec0282:
 	case 0x10ec0283:
 	case 0x10ec0286:
@@ -342,6 +340,11 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
 	case 0x10ec0299:
 		alc_update_coef_idx(codec, 0x10, 1<<9, 0);
 		break;
+	case 0x10ec0236:
+	case 0x10ec0256:
+		alc_write_coef_idx(codec, 0x36, 0x5757);
+		alc_update_coef_idx(codec, 0x10, 1<<9, 0);
+		break;
 	case 0x10ec0285:
 	case 0x10ec0293:
 		alc_update_coef_idx(codec, 0xa, 1<<13, 0);

From 56b979d660066e822fa8cb28b8cc9dde6013786d Mon Sep 17 00:00:00 2001
From: Stefan Haberland <sth@linux.ibm.com>
Date: Thu, 17 Dec 2020 16:59:04 +0100
Subject: [PATCH 1287/2658] s390/dasd: fix hanging device offline processing

[ Upstream commit 658a337a606f48b7ebe451591f7681d383fa115e ]

For an LCU update a read unit address configuration IO is required.
This is started using sleep_on(), which has early exit paths in case the
device is not usable for IO. For example when it is in offline processing.

In those cases the LCU update should fail and not be retried.
Therefore lcu_update_work checks if EOPNOTSUPP is returned or not.

Commit 41995342b40c ("s390/dasd: fix endless loop after read unit address configuration")
accidentally removed the EOPNOTSUPP return code from
read_unit_address_configuration(), which in turn might lead to an endless
loop of the LCU update in offline processing.

Fix by returning EOPNOTSUPP again if the device is not able to perform the
request.

Fixes: 41995342b40c ("s390/dasd: fix endless loop after read unit address configuration")
Cc: stable@vger.kernel.org #5.3
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/block/dasd_alias.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index 89b708135000..03543c0a2dd0 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -475,11 +475,19 @@ static int read_unit_address_configuration(struct dasd_device *device,
 	spin_unlock_irqrestore(&lcu->lock, flags);
 
 	rc = dasd_sleep_on(cqr);
-	if (rc && !suborder_not_supported(cqr)) {
+	if (!rc)
+		goto out;
+
+	if (suborder_not_supported(cqr)) {
+		/* suborder not supported or device unusable for IO */
+		rc = -EOPNOTSUPP;
+	} else {
+		/* IO failed but should be retried */
 		spin_lock_irqsave(&lcu->lock, flags);
 		lcu->flags |= NEED_UAC_UPDATE;
 		spin_unlock_irqrestore(&lcu->lock, flags);
 	}
+out:
 	dasd_kfree_request(cqr, cqr->memdev);
 	return rc;
 }

From 29ff059e4746b6d081ffbb5165080424147ee911 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 26 Oct 2020 11:43:06 +0100
Subject: [PATCH 1288/2658] USB: serial: digi_acceleport: fix write-wakeup
 deadlocks

[ Upstream commit 5098e77962e7c8947f87bd8c5869c83e000a522a ]

The driver must not call tty_wakeup() while holding its private lock as
line disciplines are allowed to call back into write() from
write_wakeup(), leading to a deadlock.

Also remove the unneeded work struct that was used to defer wakeup in
order to work around a possible race in ancient times (see comment about
n_tty write_chan() in commit 14b54e39b412 ("USB: serial: remove
changelogs and old todo entries")).

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/digi_acceleport.c | 45 ++++++++--------------------
 1 file changed, 13 insertions(+), 32 deletions(-)

diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index be93b9ff2d98..b630048c4988 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -23,7 +23,6 @@
 #include <linux/tty_flip.h>
 #include <linux/module.h>
 #include <linux/spinlock.h>
-#include <linux/workqueue.h>
 #include <linux/uaccess.h>
 #include <linux/usb.h>
 #include <linux/wait.h>
@@ -201,14 +200,12 @@ struct digi_port {
 	int dp_throttle_restart;
 	wait_queue_head_t dp_flush_wait;
 	wait_queue_head_t dp_close_wait;	/* wait queue for close */
-	struct work_struct dp_wakeup_work;
 	struct usb_serial_port *dp_port;
 };
 
 
 /* Local Function Declarations */
 
-static void digi_wakeup_write_lock(struct work_struct *work);
 static int digi_write_oob_command(struct usb_serial_port *port,
 	unsigned char *buf, int count, int interruptible);
 static int digi_write_inb_command(struct usb_serial_port *port,
@@ -355,26 +352,6 @@ __releases(lock)
 	return timeout;
 }
 
-
-/*
- *  Digi Wakeup Write
- *
- *  Wake up port, line discipline, and tty processes sleeping
- *  on writes.
- */
-
-static void digi_wakeup_write_lock(struct work_struct *work)
-{
-	struct digi_port *priv =
-			container_of(work, struct digi_port, dp_wakeup_work);
-	struct usb_serial_port *port = priv->dp_port;
-	unsigned long flags;
-
-	spin_lock_irqsave(&priv->dp_port_lock, flags);
-	tty_port_tty_wakeup(&port->port);
-	spin_unlock_irqrestore(&priv->dp_port_lock, flags);
-}
-
 /*
  *  Digi Write OOB Command
  *
@@ -986,6 +963,7 @@ static void digi_write_bulk_callback(struct urb *urb)
 	struct digi_serial *serial_priv;
 	int ret = 0;
 	int status = urb->status;
+	bool wakeup;
 
 	/* port and serial sanity check */
 	if (port == NULL || (priv = usb_get_serial_port_data(port)) == NULL) {
@@ -1012,6 +990,7 @@ static void digi_write_bulk_callback(struct urb *urb)
 	}
 
 	/* try to send any buffered data on this port */
+	wakeup = true;
 	spin_lock(&priv->dp_port_lock);
 	priv->dp_write_urb_in_use = 0;
 	if (priv->dp_out_buf_len > 0) {
@@ -1027,19 +1006,18 @@ static void digi_write_bulk_callback(struct urb *urb)
 		if (ret == 0) {
 			priv->dp_write_urb_in_use = 1;
 			priv->dp_out_buf_len = 0;
+			wakeup = false;
 		}
 	}
-	/* wake up processes sleeping on writes immediately */
-	tty_port_tty_wakeup(&port->port);
-	/* also queue up a wakeup at scheduler time, in case we */
-	/* lost the race in write_chan(). */
-	schedule_work(&priv->dp_wakeup_work);
-
 	spin_unlock(&priv->dp_port_lock);
+
 	if (ret && ret != -EPERM)
 		dev_err_console(port,
 			"%s: usb_submit_urb failed, ret=%d, port=%d\n",
 			__func__, ret, priv->dp_port_num);
+
+	if (wakeup)
+		tty_port_tty_wakeup(&port->port);
 }
 
 static int digi_write_room(struct tty_struct *tty)
@@ -1239,7 +1217,6 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num)
 	init_waitqueue_head(&priv->dp_transmit_idle_wait);
 	init_waitqueue_head(&priv->dp_flush_wait);
 	init_waitqueue_head(&priv->dp_close_wait);
-	INIT_WORK(&priv->dp_wakeup_work, digi_wakeup_write_lock);
 	priv->dp_port = port;
 
 	init_waitqueue_head(&port->write_wait);
@@ -1525,13 +1502,14 @@ static int digi_read_oob_callback(struct urb *urb)
 			rts = tty->termios.c_cflag & CRTSCTS;
 		
 		if (tty && opcode == DIGI_CMD_READ_INPUT_SIGNALS) {
+			bool wakeup = false;
+
 			spin_lock(&priv->dp_port_lock);
 			/* convert from digi flags to termiox flags */
 			if (val & DIGI_READ_INPUT_SIGNALS_CTS) {
 				priv->dp_modem_signals |= TIOCM_CTS;
-				/* port must be open to use tty struct */
 				if (rts)
-					tty_port_tty_wakeup(&port->port);
+					wakeup = true;
 			} else {
 				priv->dp_modem_signals &= ~TIOCM_CTS;
 				/* port must be open to use tty struct */
@@ -1550,6 +1528,9 @@ static int digi_read_oob_callback(struct urb *urb)
 				priv->dp_modem_signals &= ~TIOCM_CD;
 
 			spin_unlock(&priv->dp_port_lock);
+
+			if (wakeup)
+				tty_port_tty_wakeup(&port->port);
 		} else if (opcode == DIGI_CMD_TRANSMIT_IDLE) {
 			spin_lock(&priv->dp_port_lock);
 			priv->dp_transmit_idle = 1;

From 1100314110d625adb927bc52e17917cea2b71beb Mon Sep 17 00:00:00 2001
From: Petr Vorel <petr.vorel@gmail.com>
Date: Mon, 14 Dec 2020 19:03:21 -0800
Subject: [PATCH 1289/2658] uapi: move constants from <linux/kernel.h> to
 <linux/const.h>

commit a85cbe6159ffc973e5702f70a3bd5185f8f3c38d upstream.

and include <linux/const.h> in UAPI headers instead of <linux/kernel.h>.

The reason is to avoid indirect <linux/sysinfo.h> include when using
some network headers: <linux/netlink.h> or others -> <linux/kernel.h>
-> <linux/sysinfo.h>.

This indirect include causes on MUSL redefinition of struct sysinfo when
included both <sys/sysinfo.h> and some of UAPI headers:

    In file included from x86_64-buildroot-linux-musl/sysroot/usr/include/linux/kernel.h:5,
                     from x86_64-buildroot-linux-musl/sysroot/usr/include/linux/netlink.h:5,
                     from ../include/tst_netlink.h:14,
                     from tst_crypto.c:13:
    x86_64-buildroot-linux-musl/sysroot/usr/include/linux/sysinfo.h:8:8: error: redefinition of `struct sysinfo'
     struct sysinfo {
            ^~~~~~~
    In file included from ../include/tst_safe_macros.h:15,
                     from ../include/tst_test.h:93,
                     from tst_crypto.c:11:
    x86_64-buildroot-linux-musl/sysroot/usr/include/sys/sysinfo.h:10:8: note: originally defined here

Link: https://lkml.kernel.org/r/20201015190013.8901-1-petr.vorel@gmail.com
Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Suggested-by: Rich Felker <dalias@aerifal.cx>
Acked-by: Rich Felker <dalias@libc.org>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Baruch Siach <baruch@tkos.co.il>
Cc: Florian Weimer <fweimer@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/uapi/linux/const.h              | 5 +++++
 include/uapi/linux/lightnvm.h           | 2 +-
 include/uapi/linux/netfilter/x_tables.h | 2 +-
 include/uapi/linux/netlink.h            | 2 +-
 include/uapi/linux/sysctl.h             | 2 +-
 5 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/include/uapi/linux/const.h b/include/uapi/linux/const.h
index c872bfd25e13..03c3e1869be7 100644
--- a/include/uapi/linux/const.h
+++ b/include/uapi/linux/const.h
@@ -24,4 +24,9 @@
 #define _BITUL(x)	(_AC(1,UL) << (x))
 #define _BITULL(x)	(_AC(1,ULL) << (x))
 
+#define __ALIGN_KERNEL(x, a)		__ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1)
+#define __ALIGN_KERNEL_MASK(x, mask)	(((x) + (mask)) & ~(mask))
+
+#define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
+
 #endif /* !(_LINUX_CONST_H) */
diff --git a/include/uapi/linux/lightnvm.h b/include/uapi/linux/lightnvm.h
index 928f98997d8a..4acefd697677 100644
--- a/include/uapi/linux/lightnvm.h
+++ b/include/uapi/linux/lightnvm.h
@@ -20,7 +20,7 @@
 #define _UAPI_LINUX_LIGHTNVM_H
 
 #ifdef __KERNEL__
-#include <linux/kernel.h>
+#include <linux/const.h>
 #include <linux/ioctl.h>
 #else /* __KERNEL__ */
 #include <stdio.h>
diff --git a/include/uapi/linux/netfilter/x_tables.h b/include/uapi/linux/netfilter/x_tables.h
index c36969b91533..8f40c2fe0ed4 100644
--- a/include/uapi/linux/netfilter/x_tables.h
+++ b/include/uapi/linux/netfilter/x_tables.h
@@ -1,6 +1,6 @@
 #ifndef _UAPI_X_TABLES_H
 #define _UAPI_X_TABLES_H
-#include <linux/kernel.h>
+#include <linux/const.h>
 #include <linux/types.h>
 
 #define XT_FUNCTION_MAXNAMELEN 30
diff --git a/include/uapi/linux/netlink.h b/include/uapi/linux/netlink.h
index a9d1772199bf..8edc617e566a 100644
--- a/include/uapi/linux/netlink.h
+++ b/include/uapi/linux/netlink.h
@@ -1,7 +1,7 @@
 #ifndef _UAPI__LINUX_NETLINK_H
 #define _UAPI__LINUX_NETLINK_H
 
-#include <linux/kernel.h>
+#include <linux/const.h>
 #include <linux/socket.h> /* for __kernel_sa_family_t */
 #include <linux/types.h>
 
diff --git a/include/uapi/linux/sysctl.h b/include/uapi/linux/sysctl.h
index 01eb22ca6b3d..f447b7361107 100644
--- a/include/uapi/linux/sysctl.h
+++ b/include/uapi/linux/sysctl.h
@@ -22,7 +22,7 @@
 #ifndef _UAPI_LINUX_SYSCTL_H
 #define _UAPI_LINUX_SYSCTL_H
 
-#include <linux/kernel.h>
+#include <linux/const.h>
 #include <linux/types.h>
 #include <linux/compiler.h>
 

From 292b2ff6d7e2e62d1fe5cee183b1edcc0d9d1147 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 23 Nov 2020 11:23:12 +0100
Subject: [PATCH 1290/2658] of: fix linker-section match-table corruption

commit 5812b32e01c6d86ba7a84110702b46d8a8531fe9 upstream.

Specify type alignment when declaring linker-section match-table entries
to prevent gcc from increasing alignment and corrupting the various
tables with padding (e.g. timers, irqchips, clocks, reserved memory).

This is specifically needed on x86 where gcc (typically) aligns larger
objects like struct of_device_id with static extent on 32-byte
boundaries which at best prevents matching on anything but the first
entry. Specifying alignment when declaring variables suppresses this
optimisation.

Here's a 64-bit example where all entries are corrupt as 16 bytes of
padding has been inserted before the first entry:

	ffffffff8266b4b0 D __clk_of_table
	ffffffff8266b4c0 d __of_table_fixed_factor_clk
	ffffffff8266b5a0 d __of_table_fixed_clk
	ffffffff8266b680 d __clk_of_table_sentinel

And here's a 32-bit example where the 8-byte-aligned table happens to be
placed on a 32-byte boundary so that all but the first entry are corrupt
due to the 28 bytes of padding inserted between entries:

	812b3ec0 D __irqchip_of_table
	812b3ec0 d __of_table_irqchip1
	812b3fa0 d __of_table_irqchip2
	812b4080 d __of_table_irqchip3
	812b4160 d irqchip_of_match_end

Verified on x86 using gcc-9.3 and gcc-4.9 (which uses 64-byte
alignment), and on arm using gcc-7.2.

Note that there are no in-tree users of these tables on x86 currently
(even if they are included in the image).

Fixes: 54196ccbe0ba ("of: consolidate linker section OF match table declarations")
Fixes: f6e916b82022 ("irqchip: add basic infrastructure")
Cc: stable <stable@vger.kernel.org>     # 3.9
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20201123102319.8090-2-johan@kernel.org
[ johan: adjust context to 5.4 ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/of.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/linux/of.h b/include/linux/of.h
index 2772f027f88f..31964ddc2442 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -941,6 +941,7 @@ static inline int of_get_available_child_count(const struct device_node *np)
 #define _OF_DECLARE(table, name, compat, fn, fn_type)			\
 	static const struct of_device_id __of_table_##name		\
 		__used __section(__##table##_of_table)			\
+		__aligned(__alignof__(struct of_device_id))		\
 		 = { .compatible = compat,				\
 		     .data = (fn == (fn_type)NULL) ? fn : fn  }
 #else

From e128aff88cb1f14152e48b6f6f32a6f48208a8de Mon Sep 17 00:00:00 2001
From: Rustam Kovhaev <rkovhaev@gmail.com>
Date: Sun, 1 Nov 2020 06:09:58 -0800
Subject: [PATCH 1291/2658] reiserfs: add check for an invalid ih_entry_count

commit d24396c5290ba8ab04ba505176874c4e04a2d53c upstream.

when directory item has an invalid value set for ih_entry_count it might
trigger use-after-free or out-of-bounds read in bin_search_in_dir_item()

ih_entry_count * IH_SIZE for directory item should not be larger than
ih_item_len

Link: https://lore.kernel.org/r/20201101140958.3650143-1-rkovhaev@gmail.com
Reported-and-tested-by: syzbot+83b6f7cf9922cae5c4d7@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=83b6f7cf9922cae5c4d7
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/reiserfs/stree.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
index e3a4cbad9620..33b78ee9fb9e 100644
--- a/fs/reiserfs/stree.c
+++ b/fs/reiserfs/stree.c
@@ -453,6 +453,12 @@ static int is_leaf(char *buf, int blocksize, struct buffer_head *bh)
 					 "(second one): %h", ih);
 			return 0;
 		}
+		if (is_direntry_le_ih(ih) && (ih_item_len(ih) < (ih_entry_count(ih) * IH_SIZE))) {
+			reiserfs_warning(NULL, "reiserfs-5093",
+					 "item entry count seems wrong %h",
+					 ih);
+			return 0;
+		}
 		prev_location = ih_location(ih);
 	}
 

From 5f53de7f82d0a974ea47e6540b6d365a7f49e0be Mon Sep 17 00:00:00 2001
From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Date: Mon, 23 Nov 2020 04:15:34 +0530
Subject: [PATCH 1292/2658] misc: vmw_vmci: fix kernel info-leak by
 initializing dbells in vmci_ctx_get_chkpt_doorbells()

commit 31dcb6c30a26d32650ce134820f27de3c675a45a upstream.

A kernel-infoleak was reported by syzbot, which was caused because
dbells was left uninitialized.
Using kzalloc() instead of kmalloc() fixes this issue.

Reported-by: syzbot+a79e17c39564bedf0930@syzkaller.appspotmail.com
Tested-by: syzbot+a79e17c39564bedf0930@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Link: https://lore.kernel.org/r/20201122224534.333471-1-anant.thazhemadam@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/vmw_vmci/vmci_context.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/vmw_vmci/vmci_context.c b/drivers/misc/vmw_vmci/vmci_context.c
index b9da2c6cc981..0bdfa90ea6cd 100644
--- a/drivers/misc/vmw_vmci/vmci_context.c
+++ b/drivers/misc/vmw_vmci/vmci_context.c
@@ -750,7 +750,7 @@ static int vmci_ctx_get_chkpt_doorbells(struct vmci_ctx *context,
 			return VMCI_ERROR_MORE_DATA;
 		}
 
-		dbells = kmalloc(data_size, GFP_ATOMIC);
+		dbells = kzalloc(data_size, GFP_ATOMIC);
 		if (!dbells)
 			return VMCI_ERROR_NO_MEM;
 

From d1d441a06e10cf20a4b762c88705f664fed6c227 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Fri, 27 Nov 2020 07:40:21 +0100
Subject: [PATCH 1293/2658] media: gp8psk: initialize stats at power control
 logic

commit d0ac1a26ed5943127cb0156148735f5f52a07075 upstream.

As reported on:
	https://lore.kernel.org/linux-media/20190627222020.45909-1-willemdebruijn.kernel@gmail.com/

if gp8psk_usb_in_op() returns an error, the status var is not
initialized. Yet, this var is used later on, in order to
identify:
	- if the device was already started;
	- if firmware has loaded;
	- if the LNBf was powered on.

Using status = 0 seems to ensure that everything will be
properly powered up.

So, instead of the proposed solution, let's just set
status = 0.

Reported-by: syzbot <syzkaller@googlegroups.com>
Reported-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/dvb-usb/gp8psk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb/gp8psk.c b/drivers/media/usb/dvb-usb/gp8psk.c
index 5d0384dd45b5..7225ae1905eb 100644
--- a/drivers/media/usb/dvb-usb/gp8psk.c
+++ b/drivers/media/usb/dvb-usb/gp8psk.c
@@ -163,7 +163,7 @@ static int gp8psk_load_bcm4500fw(struct dvb_usb_device *d)
 
 static int gp8psk_power_ctrl(struct dvb_usb_device *d, int onoff)
 {
-	u8 status, buf;
+	u8 status = 0, buf;
 	int gp_product_id = le16_to_cpu(d->udev->descriptor.idProduct);
 
 	if (onoff) {

From b352b137f43c4e153cf662c18964718b783e8aa4 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Sun, 6 Dec 2020 09:34:56 +0100
Subject: [PATCH 1294/2658] ALSA: seq: Use bool for snd_seq_queue internal
 flags

commit 4ebd47037027c4beae99680bff3b20fdee5d7c1e upstream.

The snd_seq_queue struct contains various flags in the bit fields.
Those are categorized to two different use cases, both of which are
protected by different spinlocks.  That implies that there are still
potential risks of the bad operations for bit fields by concurrent
accesses.

For addressing the problem, this patch rearranges those flags to be
a standard bool instead of a bit field.

Reported-by: syzbot+63cbe31877bb80ef58f5@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20201206083456.21110-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/seq/seq_queue.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/sound/core/seq/seq_queue.h b/sound/core/seq/seq_queue.h
index 719093489a2c..7909cf6040e3 100644
--- a/sound/core/seq/seq_queue.h
+++ b/sound/core/seq/seq_queue.h
@@ -40,10 +40,10 @@ struct snd_seq_queue {
 	
 	struct snd_seq_timer *timer;	/* time keeper for this queue */
 	int	owner;		/* client that 'owns' the timer */
-	unsigned int	locked:1,	/* timer is only accesibble by owner if set */
-		klocked:1,	/* kernel lock (after START) */	
-		check_again:1,
-		check_blocked:1;
+	bool	locked;		/* timer is only accesibble by owner if set */
+	bool	klocked;	/* kernel lock (after START) */
+	bool	check_again;	/* concurrent access happened during check */
+	bool	check_blocked;	/* queue being checked */
 
 	unsigned int flags;		/* status flags */
 	unsigned int info_flags;	/* info for sync */

From 5c403206529923f72ccdbd5d93fc5e0f32be088f Mon Sep 17 00:00:00 2001
From: Miroslav Benes <mbenes@suse.cz>
Date: Tue, 27 Oct 2020 15:03:36 +0100
Subject: [PATCH 1295/2658] module: set MODULE_STATE_GOING state when a module
 fails to load

[ Upstream commit 5e8ed280dab9eeabc1ba0b2db5dbe9fe6debb6b5 ]

If a module fails to load due to an error in prepare_coming_module(),
the following error handling in load_module() runs with
MODULE_STATE_COMING in module's state. Fix it by correctly setting
MODULE_STATE_GOING under "bug_cleanup" label.

Signed-off-by: Miroslav Benes <mbenes@suse.cz>
Signed-off-by: Jessica Yu <jeyu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/module.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/module.c b/kernel/module.c
index 3b7aac2ea1e5..25494d5be05c 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -3595,6 +3595,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
 	return do_init_module(mod);
 
  bug_cleanup:
+	mod->state = MODULE_STATE_GOING;
 	/* module_bug_cleanup needs module_mutex protection */
 	mutex_lock(&module_mutex);
 	module_bug_cleanup(mod);

From dd7967bb5bce3d29aa1aa8fcc229a5cc061c5e73 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Mon, 2 Nov 2020 16:32:10 +0100
Subject: [PATCH 1296/2658] quota: Don't overflow quota file offsets

[ Upstream commit 10f04d40a9fa29785206c619f80d8beedb778837 ]

The on-disk quota format supports quota files with upto 2^32 blocks. Be
careful when computing quota file offsets in the quota files from block
numbers as they can overflow 32-bit types. Since quota files larger than
4GB would require ~26 millions of quota users, this is mostly a
theoretical concern now but better be careful, fuzzers would find the
problem sooner or later anyway...

Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/quota/quota_tree.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/quota/quota_tree.c b/fs/quota/quota_tree.c
index 58efb83dec1c..3069b1186719 100644
--- a/fs/quota/quota_tree.c
+++ b/fs/quota/quota_tree.c
@@ -55,7 +55,7 @@ static ssize_t read_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf)
 
 	memset(buf, 0, info->dqi_usable_bs);
 	return sb->s_op->quota_read(sb, info->dqi_type, buf,
-	       info->dqi_usable_bs, blk << info->dqi_blocksize_bits);
+	       info->dqi_usable_bs, (loff_t)blk << info->dqi_blocksize_bits);
 }
 
 static ssize_t write_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf)
@@ -64,7 +64,7 @@ static ssize_t write_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf)
 	ssize_t ret;
 
 	ret = sb->s_op->quota_write(sb, info->dqi_type, buf,
-	       info->dqi_usable_bs, blk << info->dqi_blocksize_bits);
+	       info->dqi_usable_bs, (loff_t)blk << info->dqi_blocksize_bits);
 	if (ret != info->dqi_usable_bs) {
 		quota_error(sb, "dquota write failed");
 		if (ret >= 0)
@@ -277,7 +277,7 @@ static uint find_free_dqentry(struct qtree_mem_dqinfo *info,
 			    blk);
 		goto out_buf;
 	}
-	dquot->dq_off = (blk << info->dqi_blocksize_bits) +
+	dquot->dq_off = ((loff_t)blk << info->dqi_blocksize_bits) +
 			sizeof(struct qt_disk_dqdbheader) +
 			i * info->dqi_entry_size;
 	kfree(buf);
@@ -552,7 +552,7 @@ static loff_t find_block_dqentry(struct qtree_mem_dqinfo *info,
 		ret = -EIO;
 		goto out_buf;
 	} else {
-		ret = (blk << info->dqi_blocksize_bits) + sizeof(struct
+		ret = ((loff_t)blk << info->dqi_blocksize_bits) + sizeof(struct
 		  qt_disk_dqdbheader) + i * info->dqi_entry_size;
 	}
 out_buf:

From 0dace3f510e95e25629adddcc51358c2ffdfd418 Mon Sep 17 00:00:00 2001
From: Qinglang Miao <miaoqinglang@huawei.com>
Date: Wed, 28 Oct 2020 17:15:51 +0800
Subject: [PATCH 1297/2658] powerpc: sysdev: add missing iounmap() on error in
 mpic_msgr_probe()

[ Upstream commit ffa1797040c5da391859a9556be7b735acbe1242 ]

I noticed that iounmap() of msgr_block_addr before return from
mpic_msgr_probe() in the error handling case is missing. So use
devm_ioremap() instead of just ioremap() when remapping the message
register block, so the mapping will be automatically released on
probe failure.

Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201028091551.136400-1-miaoqinglang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/sysdev/mpic_msgr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/sysdev/mpic_msgr.c b/arch/powerpc/sysdev/mpic_msgr.c
index 994fe73c2ed0..3140095ee757 100644
--- a/arch/powerpc/sysdev/mpic_msgr.c
+++ b/arch/powerpc/sysdev/mpic_msgr.c
@@ -196,7 +196,7 @@ static int mpic_msgr_probe(struct platform_device *dev)
 
 	/* IO map the message register block. */
 	of_address_to_resource(np, 0, &rsrc);
-	msgr_block_addr = ioremap(rsrc.start, resource_size(&rsrc));
+	msgr_block_addr = devm_ioremap(&dev->dev, rsrc.start, resource_size(&rsrc));
 	if (!msgr_block_addr) {
 		dev_err(&dev->dev, "Failed to iomap MPIC message registers");
 		return -EFAULT;

From b48b09aa921527eb72b5768f7596691037f118e7 Mon Sep 17 00:00:00 2001
From: Jessica Yu <jeyu@kernel.org>
Date: Fri, 27 Nov 2020 10:09:39 +0100
Subject: [PATCH 1298/2658] module: delay kobject uevent until after module
 init call

[ Upstream commit 38dc717e97153e46375ee21797aa54777e5498f3 ]

Apparently there has been a longstanding race between udev/systemd and
the module loader. Currently, the module loader sends a uevent right
after sysfs initialization, but before the module calls its init
function. However, some udev rules expect that the module has
initialized already upon receiving the uevent.

This race has been triggered recently (see link in references) in some
systemd mount unit files. For instance, the configfs module creates the
/sys/kernel/config mount point in its init function, however the module
loader issues the uevent before this happens. sys-kernel-config.mount
expects to be able to mount /sys/kernel/config upon receipt of the
module loading uevent, but if the configfs module has not called its
init function yet, then this directory will not exist and the mount unit
fails. A similar situation exists for sys-fs-fuse-connections.mount, as
the fuse sysfs mount point is created during the fuse module's init
function. If udev is faster than module initialization then the mount
unit would fail in a similar fashion.

To fix this race, delay the module KOBJ_ADD uevent until after the
module has finished calling its init routine.

References: https://github.com/systemd/systemd/issues/17586
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Tested-By: Nicolas Morey-Chaisemartin <nmoreychaisemartin@suse.com>
Signed-off-by: Jessica Yu <jeyu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/module.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/module.c b/kernel/module.c
index 25494d5be05c..3b3c4723fe68 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1779,7 +1779,6 @@ static int mod_sysfs_init(struct module *mod)
 	if (err)
 		mod_kobject_put(mod);
 
-	/* delay uevent until full sysfs population */
 out:
 	return err;
 }
@@ -1813,7 +1812,6 @@ static int mod_sysfs_setup(struct module *mod,
 	add_sect_attrs(mod, info);
 	add_notes_attrs(mod, info);
 
-	kobject_uevent(&mod->mkobj.kobj, KOBJ_ADD);
 	return 0;
 
 out_unreg_param:
@@ -3307,6 +3305,9 @@ static noinline int do_init_module(struct module *mod)
 	blocking_notifier_call_chain(&module_notify_list,
 				     MODULE_STATE_LIVE, mod);
 
+	/* Delay uevent until module has finished its init routine */
+	kobject_uevent(&mod->mkobj.kobj, KOBJ_ADD);
+
 	/*
 	 * We need to finish all async code before the module init sequence
 	 * is done.  This has potential to deadlock.  For example, a newly

From 13b7b3e60dbba90d3cdff7debdec3c63f5ffa021 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Sun, 20 Sep 2020 12:27:37 +0100
Subject: [PATCH 1299/2658] iio:magnetometer:mag3110: Fix alignment and data
 leak issues.

commit 89deb1334252ea4a8491d47654811e28b0790364 upstream

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv() data.
This data is allocated with kzalloc() so no data can leak apart from
previous readings.

The explicit alignment of ts is not necessary in this case but
does make the code slightly less fragile so I have included it.

Fixes: 39631b5f9584 ("iio: Add Freescale mag3110 magnetometer driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-4-jic23@kernel.org
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/magnetometer/mag3110.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/iio/magnetometer/mag3110.c b/drivers/iio/magnetometer/mag3110.c
index 261d517428e4..4900ad1ac51f 100644
--- a/drivers/iio/magnetometer/mag3110.c
+++ b/drivers/iio/magnetometer/mag3110.c
@@ -52,6 +52,12 @@ struct mag3110_data {
 	struct i2c_client *client;
 	struct mutex lock;
 	u8 ctrl_reg1;
+	/* Ensure natural alignment of timestamp */
+	struct {
+		__be16 channels[3];
+		u8 temperature;
+		s64 ts __aligned(8);
+	} scan;
 };
 
 static int mag3110_request(struct mag3110_data *data)
@@ -245,10 +251,9 @@ static irqreturn_t mag3110_trigger_handler(int irq, void *p)
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct mag3110_data *data = iio_priv(indio_dev);
-	u8 buffer[16]; /* 3 16-bit channels + 1 byte temp + padding + ts */
 	int ret;
 
-	ret = mag3110_read(data, (__be16 *) buffer);
+	ret = mag3110_read(data, data->scan.channels);
 	if (ret < 0)
 		goto done;
 
@@ -257,10 +262,10 @@ static irqreturn_t mag3110_trigger_handler(int irq, void *p)
 			MAG3110_DIE_TEMP);
 		if (ret < 0)
 			goto done;
-		buffer[6] = ret;
+		data->scan.temperature = ret;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, buffer,
+	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
 		iio_get_time_ns());
 
 done:

From 4d3c49efb09f9286a446e5c503120e0a1daaa0a5 Mon Sep 17 00:00:00 2001
From: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
Date: Sun, 6 Dec 2020 16:48:01 +0800
Subject: [PATCH 1300/2658] mwifiex: Fix possible buffer overflows in
 mwifiex_cmd_802_11_ad_hoc_start

[ Upstream commit 5c455c5ab332773464d02ba17015acdca198f03d ]

mwifiex_cmd_802_11_ad_hoc_start() calls memcpy() without checking
the destination size may trigger a buffer overflower,
which a local user could use to cause denial of service
or the execution of arbitrary code.
Fix it by putting the length check before calling memcpy().

Signed-off-by: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201206084801.26479-1-ruc_zhangxiaohui@163.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mwifiex/join.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 6378dfd3b4e8..83b7cd5bdf93 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -856,6 +856,8 @@ mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv,
 
 	memset(adhoc_start->ssid, 0, IEEE80211_MAX_SSID_LEN);
 
+	if (req_ssid->ssid_len > IEEE80211_MAX_SSID_LEN)
+		req_ssid->ssid_len = IEEE80211_MAX_SSID_LEN;
 	memcpy(adhoc_start->ssid, req_ssid->ssid, req_ssid->ssid_len);
 
 	mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: SSID = %s\n",

From 4eedcc5f8caa9c51af945a4e43d92b704dc88216 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sat, 9 Jan 2021 13:34:16 +0100
Subject: [PATCH 1301/2658] Linux 4.4.250

Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20210107143049.179580814@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index ee8e4171f988..21b816442cd3 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 249
+SUBLEVEL = 250
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From ef6b0f273148ca23e093eab4dae3a9e04e177923 Mon Sep 17 00:00:00 2001
From: Dominique Martinet <asmadeus@codewreck.org>
Date: Tue, 1 Dec 2020 14:17:30 +0100
Subject: [PATCH 1302/2658] kbuild: don't hardcode depmod path

commit 436e980e2ed526832de822cbf13c317a458b78e1 upstream.

depmod is not guaranteed to be in /sbin, just let make look for
it in the path like all the other invoked programs

Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 21b816442cd3..918ccdcec8e3 100644
--- a/Makefile
+++ b/Makefile
@@ -354,7 +354,7 @@ OBJDUMP		= $(CROSS_COMPILE)objdump
 AWK		= awk
 GENKSYMS	= scripts/genksyms/genksyms
 INSTALLKERNEL  := installkernel
-DEPMOD		= /sbin/depmod
+DEPMOD		= depmod
 PERL		= perl
 PYTHON		= python
 CHECK		= sparse

From 7ea325d0c217805b5fac88c3f784841098b9bccc Mon Sep 17 00:00:00 2001
From: Yunfeng Ye <yeyunfeng@huawei.com>
Date: Thu, 19 Nov 2020 14:21:25 +0800
Subject: [PATCH 1303/2658] workqueue: Kick a worker based on the actual
 activation of delayed works

[ Upstream commit 01341fbd0d8d4e717fc1231cdffe00343088ce0b ]

In realtime scenario, We do not want to have interference on the
isolated cpu cores. but when invoking alloc_workqueue() for percpu wq
on the housekeeping cpu, it kick a kworker on the isolated cpu.

  alloc_workqueue
    pwq_adjust_max_active
      wake_up_worker

The comment in pwq_adjust_max_active() said:
  "Need to kick a worker after thawed or an unbound wq's
   max_active is bumped"

So it is unnecessary to kick a kworker for percpu's wq when invoking
alloc_workqueue(). this patch only kick a worker based on the actual
activation of delayed works.

Signed-off-by: Yunfeng Ye <yeyunfeng@huawei.com>
Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/workqueue.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 777c5868091a..ba6c2aa5bcc0 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -3383,17 +3383,24 @@ static void pwq_adjust_max_active(struct pool_workqueue *pwq)
 	 * is updated and visible.
 	 */
 	if (!freezable || !workqueue_freezing) {
+		bool kick = false;
+
 		pwq->max_active = wq->saved_max_active;
 
 		while (!list_empty(&pwq->delayed_works) &&
-		       pwq->nr_active < pwq->max_active)
+		       pwq->nr_active < pwq->max_active) {
 			pwq_activate_first_delayed(pwq);
+			kick = true;
+		}
 
 		/*
 		 * Need to kick a worker after thawed or an unbound wq's
-		 * max_active is bumped.  It's a slow path.  Do it always.
+		 * max_active is bumped. In realtime scenarios, always kicking a
+		 * worker will cause interference on the isolated cpu cores, so
+		 * let's kick iff work items were activated.
 		 */
-		wake_up_worker(pwq->pool);
+		if (kick)
+			wake_up_worker(pwq->pool);
 	} else {
 		pwq->max_active = 0;
 	}

From f57a74f1ecdb366ed584dafe97fe79c677872957 Mon Sep 17 00:00:00 2001
From: Huang Shijie <sjhuang@iluvatar.ai>
Date: Tue, 29 Dec 2020 15:14:58 -0800
Subject: [PATCH 1304/2658] lib/genalloc: fix the overflow when size is too big

[ Upstream commit 36845663843fc59c5d794e3dc0641472e3e572da ]

Some graphic card has very big memory on chip, such as 32G bytes.

In the following case, it will cause overflow:

    pool = gen_pool_create(PAGE_SHIFT, NUMA_NO_NODE);
    ret = gen_pool_add(pool, 0x1000000, SZ_32G, NUMA_NO_NODE);

    va = gen_pool_alloc(pool, SZ_4G);

The overflow occurs in gen_pool_alloc_algo_owner():

		....
		size = nbits << order;
		....

The @nbits is "int" type, so it will overflow.
Then the gen_pool_avail() will return the wrong value.

This patch converts some "int" to "unsigned long", and
changes the compare code in while.

Link: https://lkml.kernel.org/r/20201229060657.3389-1-sjhuang@iluvatar.ai
Signed-off-by: Huang Shijie <sjhuang@iluvatar.ai>
Reported-by: Shi Jiasheng <jiasheng.shi@iluvatar.ai>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/genalloc.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/lib/genalloc.c b/lib/genalloc.c
index e3a475b14e26..b8ac0450a2a6 100644
--- a/lib/genalloc.c
+++ b/lib/genalloc.c
@@ -83,14 +83,14 @@ static int clear_bits_ll(unsigned long *addr, unsigned long mask_to_clear)
  * users set the same bit, one user will return remain bits, otherwise
  * return 0.
  */
-static int bitmap_set_ll(unsigned long *map, int start, int nr)
+static int bitmap_set_ll(unsigned long *map, unsigned long start, unsigned long nr)
 {
 	unsigned long *p = map + BIT_WORD(start);
-	const int size = start + nr;
+	const unsigned long size = start + nr;
 	int bits_to_set = BITS_PER_LONG - (start % BITS_PER_LONG);
 	unsigned long mask_to_set = BITMAP_FIRST_WORD_MASK(start);
 
-	while (nr - bits_to_set >= 0) {
+	while (nr >= bits_to_set) {
 		if (set_bits_ll(p, mask_to_set))
 			return nr;
 		nr -= bits_to_set;
@@ -118,14 +118,15 @@ static int bitmap_set_ll(unsigned long *map, int start, int nr)
  * users clear the same bit, one user will return remain bits,
  * otherwise return 0.
  */
-static int bitmap_clear_ll(unsigned long *map, int start, int nr)
+static unsigned long
+bitmap_clear_ll(unsigned long *map, unsigned long start, unsigned long nr)
 {
 	unsigned long *p = map + BIT_WORD(start);
-	const int size = start + nr;
+	const unsigned long size = start + nr;
 	int bits_to_clear = BITS_PER_LONG - (start % BITS_PER_LONG);
 	unsigned long mask_to_clear = BITMAP_FIRST_WORD_MASK(start);
 
-	while (nr - bits_to_clear >= 0) {
+	while (nr >= bits_to_clear) {
 		if (clear_bits_ll(p, mask_to_clear))
 			return nr;
 		nr -= bits_to_clear;
@@ -184,8 +185,8 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy
 		 size_t size, int nid)
 {
 	struct gen_pool_chunk *chunk;
-	int nbits = size >> pool->min_alloc_order;
-	int nbytes = sizeof(struct gen_pool_chunk) +
+	unsigned long nbits = size >> pool->min_alloc_order;
+	unsigned long nbytes = sizeof(struct gen_pool_chunk) +
 				BITS_TO_LONGS(nbits) * sizeof(long);
 
 	chunk = vzalloc_node(nbytes, nid);
@@ -242,7 +243,7 @@ void gen_pool_destroy(struct gen_pool *pool)
 	struct list_head *_chunk, *_next_chunk;
 	struct gen_pool_chunk *chunk;
 	int order = pool->min_alloc_order;
-	int bit, end_bit;
+	unsigned long bit, end_bit;
 
 	list_for_each_safe(_chunk, _next_chunk, &pool->chunks) {
 		chunk = list_entry(_chunk, struct gen_pool_chunk, next_chunk);
@@ -274,7 +275,7 @@ unsigned long gen_pool_alloc(struct gen_pool *pool, size_t size)
 	struct gen_pool_chunk *chunk;
 	unsigned long addr = 0;
 	int order = pool->min_alloc_order;
-	int nbits, start_bit, end_bit, remain;
+	unsigned long nbits, start_bit, end_bit, remain;
 
 #ifndef CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG
 	BUG_ON(in_nmi());
@@ -357,7 +358,7 @@ void gen_pool_free(struct gen_pool *pool, unsigned long addr, size_t size)
 {
 	struct gen_pool_chunk *chunk;
 	int order = pool->min_alloc_order;
-	int start_bit, nbits, remain;
+	unsigned long start_bit, nbits, remain;
 
 #ifndef CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG
 	BUG_ON(in_nmi());
@@ -553,7 +554,7 @@ unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size,
 	index = bitmap_find_next_zero_area(map, size, start, nr, 0);
 
 	while (index < size) {
-		int next_bit = find_next_bit(map, size, index + nr);
+		unsigned long next_bit = find_next_bit(map, size, index + nr);
 		if ((next_bit - index) < len) {
 			len = next_bit - index;
 			start_bit = index;

From bcab444f305c7d7d6137e87a54b46a0a51455e7c Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Mon, 28 Dec 2020 11:40:22 -0800
Subject: [PATCH 1305/2658] depmod: handle the case of /sbin/depmod without
 /sbin in PATH

[ Upstream commit cedd1862be7e666be87ec824dabc6a2b05618f36 ]

Commit 436e980e2ed5 ("kbuild: don't hardcode depmod path") stopped
hard-coding the path of depmod, but in the process caused trouble for
distributions that had that /sbin location, but didn't have it in the
PATH (generally because /sbin is limited to the super-user path).

Work around it for now by just adding /sbin to the end of PATH in the
depmod.sh script.

Reported-and-tested-by: Sedat Dilek <sedat.dilek@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/depmod.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/scripts/depmod.sh b/scripts/depmod.sh
index baedaef53ca0..b0cb89e73bc5 100755
--- a/scripts/depmod.sh
+++ b/scripts/depmod.sh
@@ -14,6 +14,8 @@ if ! test -r System.map ; then
 	exit 0
 fi
 
+# legacy behavior: "depmod" in /sbin, no /sbin in PATH
+PATH="$PATH:/sbin"
 if [ -z $(command -v $DEPMOD) ]; then
 	echo "Warning: 'make modules_install' requires $DEPMOD. Please install it." >&2
 	echo "This is probably in the kmod package." >&2

From 5f6d66b4ff4e43577f0ae6f0154d8e105f391dda Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Sat, 19 Dec 2020 14:01:44 +0300
Subject: [PATCH 1306/2658] atm: idt77252: call pci_disable_device() on error
 path

[ Upstream commit 8df66af5c1e5f80562fe728db5ec069b21810144 ]

This error path needs to disable the pci device before returning.

Fixes: ede58ef28e10 ("atm: remove deprecated use of pci api")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X93dmC4NX0vbTpGp@mwanda
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/atm/idt77252.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
index 074616b39f4d..89adb49e435e 100644
--- a/drivers/atm/idt77252.c
+++ b/drivers/atm/idt77252.c
@@ -3615,7 +3615,7 @@ static int idt77252_init_one(struct pci_dev *pcidev,
 
 	if ((err = dma_set_mask_and_coherent(&pcidev->dev, DMA_BIT_MASK(32)))) {
 		printk("idt77252: can't enable DMA for PCI device at %s\n", pci_name(pcidev));
-		return err;
+		goto err_out_disable_pdev;
 	}
 
 	card = kzalloc(sizeof(struct idt77252_dev), GFP_KERNEL);

From 3ba4c6e8d66d88cbeb5c6a8c07dce2dd372ba8de Mon Sep 17 00:00:00 2001
From: Guillaume Nault <gnault@redhat.com>
Date: Thu, 24 Dec 2020 20:01:09 +0100
Subject: [PATCH 1307/2658] ipv4: Ignore ECN bits for fib lookups in
 fib_compute_spec_dst()

[ Upstream commit 21fdca22eb7df2a1e194b8adb812ce370748b733 ]

RT_TOS() only clears one of the ECN bits. Therefore, when
fib_compute_spec_dst() resorts to a fib lookup, it can return
different results depending on the value of the second ECN bit.

For example, ECT(0) and ECT(1) packets could be treated differently.

  $ ip netns add ns0
  $ ip netns add ns1
  $ ip link add name veth01 netns ns0 type veth peer name veth10 netns ns1
  $ ip -netns ns0 link set dev lo up
  $ ip -netns ns1 link set dev lo up
  $ ip -netns ns0 link set dev veth01 up
  $ ip -netns ns1 link set dev veth10 up

  $ ip -netns ns0 address add 192.0.2.10/24 dev veth01
  $ ip -netns ns1 address add 192.0.2.11/24 dev veth10

  $ ip -netns ns1 address add 192.0.2.21/32 dev lo
  $ ip -netns ns1 route add 192.0.2.10/32 tos 4 dev veth10 src 192.0.2.21
  $ ip netns exec ns1 sysctl -wq net.ipv4.icmp_echo_ignore_broadcasts=0

With TOS 4 and ECT(1), ns1 replies using source address 192.0.2.21
(ping uses -Q to set all TOS and ECN bits):

  $ ip netns exec ns0 ping -c 1 -b -Q 5 192.0.2.255
  [...]
  64 bytes from 192.0.2.21: icmp_seq=1 ttl=64 time=0.544 ms

But with TOS 4 and ECT(0), ns1 replies using source address 192.0.2.11
because the "tos 4" route isn't matched:

  $ ip netns exec ns0 ping -c 1 -b -Q 6 192.0.2.255
  [...]
  64 bytes from 192.0.2.11: icmp_seq=1 ttl=64 time=0.597 ms

After this patch the ECN bits don't affect the result anymore:

  $ ip netns exec ns0 ping -c 1 -b -Q 6 192.0.2.255
  [...]
  64 bytes from 192.0.2.21: icmp_seq=1 ttl=64 time=0.591 ms

Fixes: 35ebf65e851c ("ipv4: Create and use fib_compute_spec_dst() helper.")
Signed-off-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/fib_frontend.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 632d28592933..c01149331f46 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -299,7 +299,7 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
 			.flowi4_iif = LOOPBACK_IFINDEX,
 			.flowi4_oif = l3mdev_master_ifindex_rcu(dev),
 			.daddr = ip_hdr(skb)->saddr,
-			.flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
+			.flowi4_tos = ip_hdr(skb)->tos & IPTOS_RT_MASK,
 			.flowi4_scope = scope,
 			.flowi4_mark = vmark ? skb->mark : 0,
 		};

From 0129606b8cc4ef4fabf14ec9ed320ecc85fbd77b Mon Sep 17 00:00:00 2001
From: Yunjian Wang <wangyunjian@huawei.com>
Date: Sat, 26 Dec 2020 16:10:05 +0800
Subject: [PATCH 1308/2658] net: hns: fix return value check in
 __lb_other_process()

[ Upstream commit 5ede3ada3da7f050519112b81badc058190b9f9f ]

The function skb_copy() could return NULL, the return value
need to be checked.

Fixes: b5996f11ea54 ("net: add Hisilicon Network Subsystem basic ethernet support")
Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
index a2f2db58b5ab..82f179b33a80 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
@@ -433,6 +433,10 @@ static void __lb_other_process(struct hns_nic_ring_data *ring_data,
 	/* for mutl buffer*/
 	new_skb = skb_copy(skb, GFP_ATOMIC);
 	dev_kfree_skb_any(skb);
+	if (!new_skb) {
+		netdev_err(ndev, "skb alloc failed\n");
+		return;
+	}
 	skb = new_skb;
 
 	check_ok = 0;

From 3a4a6daca5c248972854a4333beaeac3215c2be5 Mon Sep 17 00:00:00 2001
From: Xie He <xie.he.0141@gmail.com>
Date: Sun, 27 Dec 2020 18:53:39 -0800
Subject: [PATCH 1309/2658] net: hdlc_ppp: Fix issues when mod_timer is called
 while timer is running

[ Upstream commit 1fef73597fa545c35fddc953979013882fbd4e55 ]

ppp_cp_event is called directly or indirectly by ppp_rx with "ppp->lock"
held. It may call mod_timer to add a new timer. However, at the same time
ppp_timer may be already running and waiting for "ppp->lock". In this
case, there's no need for ppp_timer to continue running and it can just
exit.

If we let ppp_timer continue running, it may call add_timer. This causes
kernel panic because add_timer can't be called with a timer pending.
This patch fixes this problem.

Fixes: e022c2f07ae5 ("WAN: new synchronous PPP implementation for generic HDLC.")
Cc: Krzysztof Halasa <khc@pm.waw.pl>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wan/hdlc_ppp.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c
index 473a9b8ec9ba..e38a8dca24cb 100644
--- a/drivers/net/wan/hdlc_ppp.c
+++ b/drivers/net/wan/hdlc_ppp.c
@@ -572,6 +572,13 @@ static void ppp_timer(unsigned long arg)
 	unsigned long flags;
 
 	spin_lock_irqsave(&ppp->lock, flags);
+	/* mod_timer could be called after we entered this function but
+	 * before we got the lock.
+	 */
+	if (timer_pending(&proto->timer)) {
+		spin_unlock_irqrestore(&ppp->lock, flags);
+		return;
+	}
 	switch (proto->state) {
 	case STOPPING:
 	case REQ_SENT:

From bf381e0ac8ca25cb2f1a2e0dacac9af692e786be Mon Sep 17 00:00:00 2001
From: Roland Dreier <roland@kernel.org>
Date: Wed, 23 Dec 2020 19:21:16 -0800
Subject: [PATCH 1310/2658] CDC-NCM: remove "connected" log message

[ Upstream commit 59b4a8fa27f5a895582ada1ae5034af7c94a57b5 ]

The cdc_ncm driver passes network connection notifications up to
usbnet_link_change(), which is the right place for any logging.
Remove the netdev_info() duplicating this from the driver itself.

This stops devices such as my "TRENDnet USB 10/100/1G/2.5G LAN"
(ID 20f4:e02b) adapter from spamming the kernel log with

    cdc_ncm 2-2:2.0 enp0s2u2c2: network connection: connected

messages every 60 msec or so.

Signed-off-by: Roland Dreier <roland@kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20201224032116.2453938-1-roland@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/cdc_ncm.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index bab13ccfb085..e9f82b67c7ed 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1553,9 +1553,6 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb)
 		 * USB_CDC_NOTIFY_NETWORK_CONNECTION notification shall be
 		 * sent by device after USB_CDC_NOTIFY_SPEED_CHANGE.
 		 */
-		netif_info(dev, link, dev->net,
-			   "network connection: %sconnected\n",
-			   !!event->wValue ? "" : "dis");
 		usbnet_link_change(dev, !!event->wValue, 0);
 		break;
 

From ce9667077b9b6fc7b8d2445285cf97ea2f265a3f Mon Sep 17 00:00:00 2001
From: Yunjian Wang <wangyunjian@huawei.com>
Date: Tue, 29 Dec 2020 10:01:48 +0800
Subject: [PATCH 1311/2658] vhost_net: fix ubuf refcount incorrectly when
 sendmsg fails

[ Upstream commit 01e31bea7e622f1890c274f4aaaaf8bccd296aa5 ]

Currently the vhost_zerocopy_callback() maybe be called to decrease
the refcount when sendmsg fails in tun. The error handling in vhost
handle_tx_zerocopy() will try to decrease the same refcount again.
This is wrong. To fix this issue, we only call vhost_net_ubuf_put()
when vq->heads[nvq->desc].len == VHOST_DMA_IN_PROGRESS.

Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support")
Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/1609207308-20544-1-git-send-email-wangyunjian@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/vhost/net.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 5efac33c29dc..3c6ca66cb819 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -313,6 +313,7 @@ static void handle_tx(struct vhost_net *net)
 	size_t hdr_size;
 	struct socket *sock;
 	struct vhost_net_ubuf_ref *uninitialized_var(ubufs);
+	struct ubuf_info *ubuf;
 	bool zcopy, zcopy_used;
 	int sent_pkts = 0;
 
@@ -378,9 +379,7 @@ static void handle_tx(struct vhost_net *net)
 
 		/* use msg_control to pass vhost zerocopy ubuf info to skb */
 		if (zcopy_used) {
-			struct ubuf_info *ubuf;
 			ubuf = nvq->ubuf_info + nvq->upend_idx;
-
 			vq->heads[nvq->upend_idx].id = cpu_to_vhost32(vq, head);
 			vq->heads[nvq->upend_idx].len = VHOST_DMA_IN_PROGRESS;
 			ubuf->callback = vhost_zerocopy_callback;
@@ -399,7 +398,8 @@ static void handle_tx(struct vhost_net *net)
 		err = sock->ops->sendmsg(sock, &msg, len);
 		if (unlikely(err < 0)) {
 			if (zcopy_used) {
-				vhost_net_ubuf_put(ubufs);
+				if (vq->heads[ubuf->desc].len == VHOST_DMA_IN_PROGRESS)
+					vhost_net_ubuf_put(ubufs);
 				nvq->upend_idx = ((unsigned)nvq->upend_idx - 1)
 					% UIO_MAXIOV;
 			}

From d3f0dc280343e8343097b22d2f5598dccca5b5d2 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Thu, 24 Dec 2020 22:23:44 -0800
Subject: [PATCH 1312/2658] net: sched: prevent invalid Scell_log shift count

[ Upstream commit bd1248f1ddbc48b0c30565fce897a3b6423313b8 ]

Check Scell_log shift size in red_check_params() and modify all callers
of red_check_params() to pass Scell_log.

This prevents a shift out-of-bounds as detected by UBSAN:
  UBSAN: shift-out-of-bounds in ./include/net/red.h:252:22
  shift exponent 72 is too large for 32-bit type 'int'

Fixes: 8afa10cbe281 ("net_sched: red: Avoid illegal values")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: syzbot+97c5bd9cc81eca63d36e@syzkaller.appspotmail.com
Cc: Nogah Frankel <nogahf@mellanox.com>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Cc: netdev@vger.kernel.org
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/red.h     | 4 +++-
 net/sched/sch_choke.c | 2 +-
 net/sched/sch_gred.c  | 2 +-
 net/sched/sch_red.c   | 2 +-
 net/sched/sch_sfq.c   | 2 +-
 5 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/include/net/red.h b/include/net/red.h
index 3618cdfec884..17821f66de11 100644
--- a/include/net/red.h
+++ b/include/net/red.h
@@ -167,12 +167,14 @@ static inline void red_set_vars(struct red_vars *v)
 	v->qcount	= -1;
 }
 
-static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog)
+static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_log)
 {
 	if (fls(qth_min) + Wlog > 32)
 		return false;
 	if (fls(qth_max) + Wlog > 32)
 		return false;
+	if (Scell_log >= 32)
+		return false;
 	if (qth_max < qth_min)
 		return false;
 	return true;
diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
index 785b32e14af3..8e154e755df6 100644
--- a/net/sched/sch_choke.c
+++ b/net/sched/sch_choke.c
@@ -439,7 +439,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt)
 
 	ctl = nla_data(tb[TCA_CHOKE_PARMS]);
 
-	if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
+	if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
 		return -EINVAL;
 
 	if (ctl->limit > CHOKE_MAX_QUEUE)
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index a5745cb2d014..7af75caf0703 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -389,7 +389,7 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp,
 	struct gred_sched *table = qdisc_priv(sch);
 	struct gred_sched_data *q = table->tab[dp];
 
-	if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
+	if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
 		return -EINVAL;
 
 	if (!q) {
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 4bf2b599ef98..842e0b103c3e 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -203,7 +203,7 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt)
 	max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0;
 
 	ctl = nla_data(tb[TCA_RED_PARMS]);
-	if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
+	if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
 		return -EINVAL;
 
 	if (ctl->limit > 0) {
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index f56b910fa46d..ae51bdeaddfd 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -645,7 +645,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
 	}
 
 	if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max,
-					ctl_v1->Wlog))
+					ctl_v1->Wlog, ctl_v1->Scell_log))
 		return -EINVAL;
 	if (ctl_v1 && ctl_v1->qth_min) {
 		p = kmalloc(sizeof(*p), GFP_KERNEL);

From 068621c6ee1ef29e506ac1a1835fcd0b5c5edaff Mon Sep 17 00:00:00 2001
From: Jeff Dike <jdike@akamai.com>
Date: Tue, 22 Dec 2020 21:54:21 -0500
Subject: [PATCH 1313/2658] virtio_net: Fix recursive call to cpus_read_lock()

[ Upstream commit de33212f768c5d9e2fe791b008cb26f92f0aa31c ]

virtnet_set_channels can recursively call cpus_read_lock if CONFIG_XPS
and CONFIG_HOTPLUG are enabled.

The path is:
    virtnet_set_channels - calls get_online_cpus(), which is a trivial
wrapper around cpus_read_lock()
    netif_set_real_num_tx_queues
    netif_reset_xps_queues_gt
    netif_reset_xps_queues - calls cpus_read_lock()

This call chain and potential deadlock happens when the number of TX
queues is reduced.

This commit the removes netif_set_real_num_[tr]x_queues calls from
inside the get/put_online_cpus section, as they don't require that it
be held.

Fixes: 47be24796c13 ("virtio-net: fix the set affinity bug when CPU IDs are not consecutive")
Signed-off-by: Jeff Dike <jdike@akamai.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Link: https://lore.kernel.org/r/20201223025421.671-1-jdike@akamai.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/virtio_net.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 2759d386ade7..345784274410 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1372,14 +1372,16 @@ static int virtnet_set_channels(struct net_device *dev,
 
 	get_online_cpus();
 	err = virtnet_set_queues(vi, queue_pairs);
-	if (!err) {
-		netif_set_real_num_tx_queues(dev, queue_pairs);
-		netif_set_real_num_rx_queues(dev, queue_pairs);
-
-		virtnet_set_affinity(vi);
+	if (err) {
+		put_online_cpus();
+		goto err;
 	}
+	virtnet_set_affinity(vi);
 	put_online_cpus();
 
+	netif_set_real_num_tx_queues(dev, queue_pairs);
+	netif_set_real_num_rx_queues(dev, queue_pairs);
+err:
 	return err;
 }
 

From 9ddc5b8f7fd82732fa9e1b839701d60f5bf59904 Mon Sep 17 00:00:00 2001
From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Date: Fri, 18 Dec 2020 11:55:38 +0100
Subject: [PATCH 1314/2658] ethernet: ucc_geth: fix use-after-free in
 ucc_geth_remove()

[ Upstream commit e925e0cd2a705aaacb0b907bb3691fcac3a973a4 ]

ugeth is the netdiv_priv() part of the netdevice. Accessing the memory
pointed to by ugeth (such as done by ucc_geth_memclean() and the two
of_node_puts) after free_netdev() is thus use-after-free.

Fixes: 80a9fad8e89a ("ucc_geth: fix module removal")
Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/freescale/ucc_geth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index 96a1f62cc148..faf8dfb49fb5 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -3934,10 +3934,10 @@ static int ucc_geth_remove(struct platform_device* ofdev)
 	struct ucc_geth_private *ugeth = netdev_priv(dev);
 
 	unregister_netdev(dev);
-	free_netdev(dev);
 	ucc_geth_memclean(ugeth);
 	of_node_put(ugeth->ug_info->tbi_node);
 	of_node_put(ugeth->ug_info->phy_node);
+	free_netdev(dev);
 
 	return 0;
 }

From c5e873f7f4d4aad5818279c23e60b11cba438aa2 Mon Sep 17 00:00:00 2001
From: Dexuan Cui <decui@microsoft.com>
Date: Sat, 9 Jan 2021 14:53:58 -0800
Subject: [PATCH 1315/2658] video: hyperv_fb: Fix the mmap() regression for
 v5.4.y and older
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

db49200b1dad is backported from the mainline commit
5f1251a48c17 ("video: hyperv_fb: Fix the cache type when mapping the VRAM"),
to v5.4.y and older stable branches, but unluckily db49200b1dad causes
mmap() to fail for /dev/fb0 due to EINVAL:

[ 5797.049560] x86/PAT: a.out:1910 map pfn expected mapping type
  uncached-minus for [mem 0xf8200000-0xf85cbfff], got write-back

This means the v5.4.y kernel detects an incompatibility issue about the
mapping type of the VRAM: db49200b1dad changes to use Write-Back when
mapping the VRAM, while the mmap() syscall tries to use Uncached-minus.
That’s to say, the kernel thinks Uncached-minus is incompatible with
Write-Back: see drivers/video/fbdev/core/fbmem.c: fb_mmap() ->
vm_iomap_memory() -> io_remap_pfn_range() -> ... -> track_pfn_remap() ->
reserve_pfn_range().

Note: any v5.5 and newer kernel doesn't have the issue, because they
have commit
d21987d709e8 ("video: hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver")
, and when the hyperv_fb driver has the deferred_io support,
fb_deferred_io_init() overrides info->fbops->fb_mmap with
fb_deferred_io_mmap(), which doesn’t check the mapping type
incompatibility. Note: since it's VRAM here, the checking is not really
necessary.

Fix the regression by ioremap_wc(), which uses Write-combining. The kernel
thinks it's compatible with Uncached-minus. The VRAM mappped by
ioremap_wc() is slightly slower than mapped by ioremap_cache(), but is
still significantly faster than by ioremap().

Change the comment accordingly. Linux VM on ARM64 Hyper-V is still not
working in the latest mainline yet, and when it works in future, the ARM64
support is unlikely to be backported to v5.4 and older, so using
ioremap_wc() in v5.4 and older should be ok.

Note: this fix is only targeted at the stable branches:
v5.4.y, v4.19.y, v4.14.y, v4.9.y and v4.4.y.

Fixes: db49200b1dad ("video: hyperv_fb: Fix the cache type when mapping the VRAM")
Signed-off-by: Dexuan Cui <decui@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/hyperv_fb.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c
index 299412abb165..883c06381e7c 100644
--- a/drivers/video/fbdev/hyperv_fb.c
+++ b/drivers/video/fbdev/hyperv_fb.c
@@ -713,11 +713,9 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info)
 	}
 
 	/*
-	 * Map the VRAM cacheable for performance. This is also required for
-	 * VM Connect to display properly for ARM64 Linux VM, as the host also
-	 * maps the VRAM cacheable.
+	 * Map the VRAM cacheable for performance.
 	 */
-	fb_virt = ioremap_cache(par->mem->start, screen_fb_size);
+	fb_virt = ioremap_wc(par->mem->start, screen_fb_size);
 	if (!fb_virt)
 		goto err2;
 

From 9aed5a7cda7fc1e51da845ad3632479c1d6e517c Mon Sep 17 00:00:00 2001
From: "taehyun.cho" <taehyun.cho@samsung.com>
Date: Thu, 7 Jan 2021 00:46:25 +0900
Subject: [PATCH 1316/2658] usb: gadget: enable super speed plus

commit e2459108b5a0604c4b472cae2b3cb8d3444c77fb upstream.

Enable Super speed plus in configfs to support USB3.1 Gen2.
This ensures that when a USB gadget is plugged in, it is
enumerated as Gen 2 and connected at 10 Gbps if the host and
cable are capable of it.

Many in-tree gadget functions (fs, midi, acm, ncm, mass_storage,
etc.) already have SuperSpeed Plus support.

Tested: plugged gadget into Linux host and saw:
[284907.385986] usb 8-2: new SuperSpeedPlus Gen 2 USB device number 3 using xhci_hcd

Tested-by: Lorenzo Colitti <lorenzo@google.com>
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: taehyun.cho <taehyun.cho@samsung.com>
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Link: https://lore.kernel.org/r/20210106154625.2801030-1-lorenzo@google.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/configfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 2a0bd71a4fa3..28b62d971d7f 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1687,7 +1687,7 @@ static const struct usb_gadget_driver configfs_driver_template = {
 	.suspend	= configfs_composite_suspend,
 	.resume		= configfs_composite_resume,
 
-	.max_speed	= USB_SPEED_SUPER,
+	.max_speed	= USB_SPEED_SUPER_PLUS,
 	.driver = {
 		.owner          = THIS_MODULE,
 		.name		= "configfs-gadget",
@@ -1810,7 +1810,7 @@ static struct config_group *gadgets_make(
 	gi->composite.unbind = configfs_do_nothing;
 	gi->composite.suspend = NULL;
 	gi->composite.resume = NULL;
-	gi->composite.max_speed = USB_SPEED_SUPER;
+	gi->composite.max_speed = USB_SPEED_SUPER_PLUS;
 
 	spin_lock_init(&gi->spinlock);
 	mutex_init(&gi->lock);

From 7e4180ab72aa22854fbf1694c7469ceb610385b6 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Sun, 27 Dec 2020 13:45:02 +0000
Subject: [PATCH 1317/2658] USB: cdc-acm: blacklist another IR Droid device

commit 0ffc76539e6e8d28114f95ac25c167c37b5191b3 upstream.

This device is supported by the IR Toy driver.

Reported-by: Georgi Bakalski <georgi.bakalski@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Acked-by: Oliver Neukum <oneukum@suse.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201227134502.4548-2-sean@mess.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/cdc-acm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index a74a5c0eba6e..e5ee349a5382 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1894,6 +1894,10 @@ static const struct usb_device_id acm_ids[] = {
 	{ USB_DEVICE(0x04d8, 0x0083),	/* Bootloader mode */
 	.driver_info = IGNORE_DEVICE,
 	},
+
+	{ USB_DEVICE(0x04d8, 0xf58b),
+	.driver_info = IGNORE_DEVICE,
+	},
 #endif
 
 	/*Samsung phone in firmware update mode */

From 2f40bce407644c11a8358fbb410722344c34ff77 Mon Sep 17 00:00:00 2001
From: Yu Kuai <yukuai3@huawei.com>
Date: Tue, 17 Nov 2020 09:14:30 +0800
Subject: [PATCH 1318/2658] usb: chipidea: ci_hdrc_imx: add missing
 put_device() call in usbmisc_get_init_data()

commit 83a43ff80a566de8718dfc6565545a0080ec1fb5 upstream.

if of_find_device_by_node() succeed, usbmisc_get_init_data() doesn't have
a corresponding put_device(). Thus add put_device() to fix the exception
handling for this function implementation.

Fixes: ef12da914ed6 ("usb: chipidea: imx: properly check for usbmisc")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201117011430.642589-1-yukuai3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/chipidea/ci_hdrc_imx.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
index 97eb52b97605..8aced1a4a48b 100644
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -127,9 +127,13 @@ static struct imx_usbmisc_data *usbmisc_get_init_data(struct device *dev)
 	misc_pdev = of_find_device_by_node(args.np);
 	of_node_put(args.np);
 
-	if (!misc_pdev || !platform_get_drvdata(misc_pdev))
+	if (!misc_pdev)
 		return ERR_PTR(-EPROBE_DEFER);
 
+	if (!platform_get_drvdata(misc_pdev)) {
+		put_device(&misc_pdev->dev);
+		return ERR_PTR(-EPROBE_DEFER);
+	}
 	data->dev = &misc_pdev->dev;
 
 	if (of_find_property(np, "disable-over-current", NULL))

From fa1c583a4d29f86dba1e8409c993e9bc1666ce2b Mon Sep 17 00:00:00 2001
From: Michael Grzeschik <m.grzeschik@pengutronix.de>
Date: Tue, 15 Dec 2020 20:31:47 +0100
Subject: [PATCH 1319/2658] USB: xhci: fix U1/U2 handling for hardware with
 XHCI_INTEL_HOST quirk set

commit 5d5323a6f3625f101dbfa94ba3ef7706cce38760 upstream.

The commit 0472bf06c6fd ("xhci: Prevent U1/U2 link pm states if exit
latency is too long") was constraining the xhci code not to allow U1/U2
sleep states if the latency to wake up from the U-states reached the
service interval of an periodic endpoint. This fix was not taking into
account that in case the quirk XHCI_INTEL_HOST is set, the wakeup time
will be calculated and configured differently.

It checks for u1_params.mel/u2_params.mel as a limit. But the code could
decide to write another MEL into the hardware. This leads to broken
cases where not enough bandwidth is available for other devices:

usb 1-2: can't set config #1, error -28

This patch is fixing that case by checking for timeout_ns after the
wakeup time was calculated depending on the quirks.

Fixes: 0472bf06c6fd ("xhci: Prevent U1/U2 link pm states if exit latency is too long")
Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201215193147.11738-1-m.grzeschik@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci.c | 28 ++++++++++++----------------
 1 file changed, 12 insertions(+), 16 deletions(-)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 56d67ef8f38d..d0197bd1f567 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4446,21 +4446,19 @@ static u16 xhci_calculate_u1_timeout(struct xhci_hcd *xhci,
 {
 	unsigned long long timeout_ns;
 
+	if (xhci->quirks & XHCI_INTEL_HOST)
+		timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc);
+	else
+		timeout_ns = udev->u1_params.sel;
+
 	/* Prevent U1 if service interval is shorter than U1 exit latency */
 	if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
-		if (xhci_service_interval_to_ns(desc) <= udev->u1_params.mel) {
+		if (xhci_service_interval_to_ns(desc) <= timeout_ns) {
 			dev_dbg(&udev->dev, "Disable U1, ESIT shorter than exit latency\n");
 			return USB3_LPM_DISABLED;
 		}
 	}
 
-	if (xhci->quirks & XHCI_INTEL_HOST)
-		timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc);
-	else if (xhci->quirks & XHCI_SIBEAM_QUIRK)
-		timeout_ns = 254000;
-	else
-		timeout_ns = udev->u1_params.sel;
-
 	/* The U1 timeout is encoded in 1us intervals.
 	 * Don't return a timeout of zero, because that's USB3_LPM_DISABLED.
 	 */
@@ -4512,21 +4510,19 @@ static u16 xhci_calculate_u2_timeout(struct xhci_hcd *xhci,
 {
 	unsigned long long timeout_ns;
 
+	if (xhci->quirks & XHCI_INTEL_HOST)
+		timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc);
+	else
+		timeout_ns = udev->u2_params.sel;
+
 	/* Prevent U2 if service interval is shorter than U2 exit latency */
 	if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
-		if (xhci_service_interval_to_ns(desc) <= udev->u2_params.mel) {
+		if (xhci_service_interval_to_ns(desc) <= timeout_ns) {
 			dev_dbg(&udev->dev, "Disable U2, ESIT shorter than exit latency\n");
 			return USB3_LPM_DISABLED;
 		}
 	}
 
-	if (xhci->quirks & XHCI_INTEL_HOST)
-		timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc);
-	else if (xhci->quirks & XHCI_SIBEAM_QUIRK)
-		timeout_ns = 256000;
-	else
-		timeout_ns = udev->u2_params.sel;
-
 	/* The U2 timeout is encoded in 256us intervals */
 	timeout_ns = DIV_ROUND_UP_ULL(timeout_ns, 256 * 1000);
 	/* If the necessary timeout value is bigger than what we can set in the

From 6c2b08fb6774b51fa76440f5f94a81397fbe7d45 Mon Sep 17 00:00:00 2001
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Date: Mon, 4 Jan 2021 20:07:15 -0800
Subject: [PATCH 1320/2658] usb: uas: Add PNY USB Portable SSD to unusual_uas

commit 96ebc9c871d8a28fb22aa758dd9188a4732df482 upstream.

Here's another variant PNY Pro Elite USB 3.1 Gen 2 portable SSD that
hangs and doesn't respond to ATA_1x pass-through commands. If it doesn't
support these commands, it should respond properly to the host. Add it
to the unusual uas list to be able to move forward with other
operations.

Cc: stable@vger.kernel.org
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/2edc7af892d0913bf06f5b35e49ec463f03d5ed8.1609819418.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/unusual_uas.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index b7171c19fca2..7f4245b01bae 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -162,6 +162,13 @@ UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999,
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_BROKEN_FUA),
 
+/* Reported-by: Thinh Nguyen <thinhn@synopsys.com> */
+UNUSUAL_DEV(0x154b, 0xf00b, 0x0000, 0x9999,
+		"PNY",
+		"Pro Elite SSD",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_NO_ATA_1X),
+
 /* Reported-by: Thinh Nguyen <thinhn@synopsys.com> */
 UNUSUAL_DEV(0x154b, 0xf00d, 0x0000, 0x9999,
 		"PNY",

From a148d8ea8b31260fe5ee7aa629a9b0c6c97b0495 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 4 Jan 2021 15:50:07 +0100
Subject: [PATCH 1321/2658] USB: serial: iuu_phoenix: fix DMA from stack

commit 54d0a3ab80f49f19ee916def62fe067596833403 upstream.

Stack-allocated buffers cannot be used for DMA (on all architectures) so
allocate the flush command buffer using kmalloc().

Fixes: 60a8fc017103 ("USB: add iuu_phoenix driver")
Cc: stable <stable@vger.kernel.org>     # 2.6.25
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/iuu_phoenix.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
index 1a966f25b3ef..ef948285a142 100644
--- a/drivers/usb/serial/iuu_phoenix.c
+++ b/drivers/usb/serial/iuu_phoenix.c
@@ -551,23 +551,29 @@ static int iuu_uart_flush(struct usb_serial_port *port)
 	struct device *dev = &port->dev;
 	int i;
 	int status;
-	u8 rxcmd = IUU_UART_RX;
+	u8 *rxcmd;
 	struct iuu_private *priv = usb_get_serial_port_data(port);
 
 	if (iuu_led(port, 0xF000, 0, 0, 0xFF) < 0)
 		return -EIO;
 
+	rxcmd = kmalloc(1, GFP_KERNEL);
+	if (!rxcmd)
+		return -ENOMEM;
+
+	rxcmd[0] = IUU_UART_RX;
+
 	for (i = 0; i < 2; i++) {
-		status = bulk_immediate(port, &rxcmd, 1);
+		status = bulk_immediate(port, rxcmd, 1);
 		if (status != IUU_OPERATION_OK) {
 			dev_dbg(dev, "%s - uart_flush_write error\n", __func__);
-			return status;
+			goto out_free;
 		}
 
 		status = read_immediate(port, &priv->len, 1);
 		if (status != IUU_OPERATION_OK) {
 			dev_dbg(dev, "%s - uart_flush_read error\n", __func__);
-			return status;
+			goto out_free;
 		}
 
 		if (priv->len > 0) {
@@ -575,12 +581,16 @@ static int iuu_uart_flush(struct usb_serial_port *port)
 			status = read_immediate(port, priv->buf, priv->len);
 			if (status != IUU_OPERATION_OK) {
 				dev_dbg(dev, "%s - uart_flush_read error\n", __func__);
-				return status;
+				goto out_free;
 			}
 		}
 	}
 	dev_dbg(dev, "%s - uart_flush_read OK!\n", __func__);
 	iuu_led(port, 0, 0xF000, 0, 0xFF);
+
+out_free:
+	kfree(rxcmd);
+
 	return status;
 }
 

From 5ca88da1fd61f430cf9f0578e59627a4a85e009c Mon Sep 17 00:00:00 2001
From: Daniel Palmer <daniel@0x0f.com>
Date: Sun, 27 Dec 2020 12:17:16 +0900
Subject: [PATCH 1322/2658] USB: serial: option: add LongSung M5710 module
 support

commit 0e2d6795e8dbe91c2f5473564c6b25d11df3778b upstream.

Add a device-id entry for the LongSung M5710 module.

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=2df3 ProdID=9d03 Rev= 1.00
S:  Manufacturer=Marvell
S:  Product=Mobile Composite Device Bus
S:  SerialNumber=<snip>
C:* #Ifs= 5 Cfg#= 1 Atr=c0 MxPwr=500mA
A:  FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03
I:* If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host
E:  Ad=87(I) Atr=03(Int.) MxPS=  64 Ivl=4096ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=89(I) Atr=03(Int.) MxPS=  64 Ivl=4096ms
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=88(I) Atr=03(Int.) MxPS=  64 Ivl=4096ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

Signed-off-by: Daniel Palmer <daniel@0x0f.com>
https://lore.kernel.org/r/20201227031716.1343300-1-daniel@0x0f.com
[ johan: drop id defines, only bind to vendor class ]
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 6045a8e24068..1998b314368e 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2043,6 +2043,7 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff),			/* Fibocom NL678 series */
 	  .driver_info = RSVD(6) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) },			/* Fibocom NL668-AM/NL652-EU (laptop MBIM) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) },			/* LongSung M5710 */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) },			/* GosunCn GM500 RNDIS */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) },			/* GosunCn GM500 MBIM */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) },			/* GosunCn GM500 ECM/NCM */

From 9317af8ff3263d40b60a3d7d26ae93f4e4e0486f Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 14 Dec 2020 11:30:53 +0100
Subject: [PATCH 1323/2658] USB: yurex: fix control-URB timeout handling

commit 372c93131998c0622304bed118322d2a04489e63 upstream.

Make sure to always cancel the control URB in write() so that it can be
reused after a timeout or spurious CMD_ACK.

Currently any further write requests after a timeout would fail after
triggering a WARN() in usb_submit_urb() when attempting to submit the
already active URB.

Reported-by: syzbot+e87ebe0f7913f71f2ea5@syzkaller.appspotmail.com
Fixes: 6bc235a2e24a ("USB: add driver for Meywa-Denki & Kayac YUREX")
Cc: stable <stable@vger.kernel.org>     # 2.6.37
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/misc/yurex.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index b17aeaafbb7c..e7761c00eda5 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -515,6 +515,9 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
 		timeout = schedule_timeout(YUREX_WRITE_TIMEOUT);
 	finish_wait(&dev->waitq, &wait);
 
+	/* make sure URB is idle after timeout or (spurious) CMD_ACK */
+	usb_kill_urb(dev->cntl_urb);
+
 	mutex_unlock(&dev->io_mutex);
 
 	if (retval < 0) {

From 8e1e5b04dbf616e6efb1fe4247781d75c469d8c3 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 4 Jan 2021 15:53:02 +0100
Subject: [PATCH 1324/2658] USB: usblp: fix DMA to stack

commit 020a1f453449294926ca548d8d5ca970926e8dfd upstream.

Stack-allocated buffers cannot be used for DMA (on all architectures).

Replace the HP-channel macro with a helper function that allocates a
dedicated transfer buffer so that it can continue to be used with
arguments from the stack.

Note that the buffer is cleared on allocation as usblp_ctrl_msg()
returns success also on short transfers (the buffer is only used for
debugging).

Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210104145302.2087-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/usblp.c | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
index 71c2ae4b8106..76701d6ce92c 100644
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -289,8 +289,25 @@ static int usblp_ctrl_msg(struct usblp *usblp, int request, int type, int dir, i
 #define usblp_reset(usblp)\
 	usblp_ctrl_msg(usblp, USBLP_REQ_RESET, USB_TYPE_CLASS, USB_DIR_OUT, USB_RECIP_OTHER, 0, NULL, 0)
 
-#define usblp_hp_channel_change_request(usblp, channel, buffer) \
-	usblp_ctrl_msg(usblp, USBLP_REQ_HP_CHANNEL_CHANGE_REQUEST, USB_TYPE_VENDOR, USB_DIR_IN, USB_RECIP_INTERFACE, channel, buffer, 1)
+static int usblp_hp_channel_change_request(struct usblp *usblp, int channel, u8 *new_channel)
+{
+	u8 *buf;
+	int ret;
+
+	buf = kzalloc(1, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	ret = usblp_ctrl_msg(usblp, USBLP_REQ_HP_CHANNEL_CHANGE_REQUEST,
+			USB_TYPE_VENDOR, USB_DIR_IN, USB_RECIP_INTERFACE,
+			channel, buf, 1);
+	if (ret == 0)
+		*new_channel = buf[0];
+
+	kfree(buf);
+
+	return ret;
+}
 
 /*
  * See the description for usblp_select_alts() below for the usage

From e782c266bd9789fae9fca99c25915bec5a545698 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 23 Dec 2020 18:45:57 +0100
Subject: [PATCH 1325/2658] ALSA: usb-audio: Fix UBSAN warnings for MIDI jacks

commit c06ccf3ebb7503706ea49fd248e709287ef385a3 upstream.

The calculation of in_cables and out_cables bitmaps are done with the
bit shift by the value from the descriptor, which is an arbitrary
value, and can lead to UBSAN shift-out-of-bounds warnings.

Fix it by filtering the bad descriptor values with the check of the
upper bound 0x10 (the cable bitmaps are 16 bits).

Reported-by: syzbot+92e45ae45543f89e8c88@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201223174557.10249-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/midi.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/usb/midi.c b/sound/usb/midi.c
index 934540042bc2..df6fde6fd2b6 100644
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -1865,6 +1865,8 @@ static int snd_usbmidi_get_ms_info(struct snd_usb_midi *umidi,
 		ms_ep = find_usb_ms_endpoint_descriptor(hostep);
 		if (!ms_ep)
 			continue;
+		if (ms_ep->bNumEmbMIDIJack > 0x10)
+			continue;
 		if (usb_endpoint_dir_out(ep)) {
 			if (endpoints[epidx].out_ep) {
 				if (++epidx >= MIDI_MAX_ENDPOINTS) {
@@ -2117,6 +2119,8 @@ static int snd_usbmidi_detect_roland(struct snd_usb_midi *umidi,
 		    cs_desc[1] == USB_DT_CS_INTERFACE &&
 		    cs_desc[2] == 0xf1 &&
 		    cs_desc[3] == 0x02) {
+			if (cs_desc[4] > 0x10 || cs_desc[5] > 0x10)
+				continue;
 			endpoint->in_cables  = (1 << cs_desc[4]) - 1;
 			endpoint->out_cables = (1 << cs_desc[5]) - 1;
 			return snd_usbmidi_detect_endpoints(umidi, endpoint, 1);

From 2c3f32d7d798aac7168e6fe3563b362c56cc77f5 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Sun, 3 Jan 2021 22:42:17 +0100
Subject: [PATCH 1326/2658] usb: gadget: select CONFIG_CRC32

commit d7889c2020e08caab0d7e36e947f642d91015bd0 upstream.

Without crc32 support, this driver fails to link:

arm-linux-gnueabi-ld: drivers/usb/gadget/function/f_eem.o: in function `eem_unwrap':
f_eem.c:(.text+0x11cc): undefined reference to `crc32_le'
arm-linux-gnueabi-ld: drivers/usb/gadget/function/f_ncm.o:f_ncm.c:(.text+0x1e40):
more undefined references to `crc32_le' follow

Fixes: 6d3865f9d41f ("usb: gadget: NCM: Add transmit multi-frame.")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210103214224.1996535-1-arnd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/Kconfig | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 0787e36742aa..131caf565b5d 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -300,6 +300,7 @@ config USB_CONFIGFS_NCM
 	depends on NET
 	select USB_U_ETHER
 	select USB_F_NCM
+	select CRC32
 	help
 	  NCM is an advanced protocol for Ethernet encapsulation, allows
 	  grouping of several ethernet frames into one USB transfer and
@@ -363,6 +364,7 @@ config USB_CONFIGFS_EEM
 	depends on NET
 	select USB_U_ETHER
 	select USB_F_EEM
+	select CRC32
 	help
 	  CDC EEM is a newer USB standard that is somewhat simpler than CDC ECM
 	  and therefore can be supported by more hardware.  Technically ECM and

From 22c9b48363c6cc55905d169c26e7a475b11410f5 Mon Sep 17 00:00:00 2001
From: Jerome Brunet <jbrunet@baylibre.com>
Date: Mon, 21 Dec 2020 18:35:28 +0100
Subject: [PATCH 1327/2658] usb: gadget: f_uac2: reset wMaxPacketSize

commit 9389044f27081d6ec77730c36d5bf9a1288bcda2 upstream.

With commit 913e4a90b6f9 ("usb: gadget: f_uac2: finalize wMaxPacketSize according to bandwidth")
wMaxPacketSize is computed dynamically but the value is never reset.

Because of this, the actual maximum packet size can only decrease each time
the audio gadget is instantiated.

Reset the endpoint maximum packet size and mark wMaxPacketSize as dynamic
to solve the problem.

Fixes: 913e4a90b6f9 ("usb: gadget: f_uac2: finalize wMaxPacketSize according to bandwidth")
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201221173531.215169-2-jbrunet@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/function/f_uac2.c | 69 ++++++++++++++++++++++------
 1 file changed, 55 insertions(+), 14 deletions(-)

diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 24c8fbda1a54..81af315774c6 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -766,7 +766,7 @@ static struct usb_endpoint_descriptor fs_epout_desc = {
 
 	.bEndpointAddress = USB_DIR_OUT,
 	.bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
-	.wMaxPacketSize = cpu_to_le16(1023),
+	/* .wMaxPacketSize = DYNAMIC */
 	.bInterval = 1,
 };
 
@@ -775,7 +775,7 @@ static struct usb_endpoint_descriptor hs_epout_desc = {
 	.bDescriptorType = USB_DT_ENDPOINT,
 
 	.bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
-	.wMaxPacketSize = cpu_to_le16(1024),
+	/* .wMaxPacketSize = DYNAMIC */
 	.bInterval = 4,
 };
 
@@ -843,7 +843,7 @@ static struct usb_endpoint_descriptor fs_epin_desc = {
 
 	.bEndpointAddress = USB_DIR_IN,
 	.bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
-	.wMaxPacketSize = cpu_to_le16(1023),
+	/* .wMaxPacketSize = DYNAMIC */
 	.bInterval = 1,
 };
 
@@ -852,7 +852,7 @@ static struct usb_endpoint_descriptor hs_epin_desc = {
 	.bDescriptorType = USB_DT_ENDPOINT,
 
 	.bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
-	.wMaxPacketSize = cpu_to_le16(1024),
+	/* .wMaxPacketSize = DYNAMIC */
 	.bInterval = 4,
 };
 
@@ -963,12 +963,28 @@ free_ep(struct uac2_rtd_params *prm, struct usb_ep *ep)
 			"%s:%d Error!\n", __func__, __LINE__);
 }
 
-static void set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts,
+static int set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts,
 	struct usb_endpoint_descriptor *ep_desc,
-	unsigned int factor, bool is_playback)
+	enum usb_device_speed speed, bool is_playback)
 {
 	int chmask, srate, ssize;
-	u16 max_packet_size;
+	u16 max_size_bw, max_size_ep;
+	unsigned int factor;
+
+	switch (speed) {
+	case USB_SPEED_FULL:
+		max_size_ep = 1023;
+		factor = 1000;
+		break;
+
+	case USB_SPEED_HIGH:
+		max_size_ep = 1024;
+		factor = 8000;
+		break;
+
+	default:
+		return -EINVAL;
+	}
 
 	if (is_playback) {
 		chmask = uac2_opts->p_chmask;
@@ -980,10 +996,12 @@ static void set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts,
 		ssize = uac2_opts->c_ssize;
 	}
 
-	max_packet_size = num_channels(chmask) * ssize *
+	max_size_bw = num_channels(chmask) * ssize *
 		DIV_ROUND_UP(srate, factor / (1 << (ep_desc->bInterval - 1)));
-	ep_desc->wMaxPacketSize = cpu_to_le16(min_t(u16, max_packet_size,
-				le16_to_cpu(ep_desc->wMaxPacketSize)));
+	ep_desc->wMaxPacketSize = cpu_to_le16(min_t(u16, max_size_bw,
+						    max_size_ep));
+
+	return 0;
 }
 
 static int
@@ -1082,10 +1100,33 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
 	uac2->c_prm.uac2 = uac2;
 
 	/* Calculate wMaxPacketSize according to audio bandwidth */
-	set_ep_max_packet_size(uac2_opts, &fs_epin_desc, 1000, true);
-	set_ep_max_packet_size(uac2_opts, &fs_epout_desc, 1000, false);
-	set_ep_max_packet_size(uac2_opts, &hs_epin_desc, 8000, true);
-	set_ep_max_packet_size(uac2_opts, &hs_epout_desc, 8000, false);
+	ret = set_ep_max_packet_size(uac2_opts, &fs_epin_desc, USB_SPEED_FULL,
+				     true);
+	if (ret < 0) {
+		dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
+		return ret;
+	}
+
+	ret = set_ep_max_packet_size(uac2_opts, &fs_epout_desc, USB_SPEED_FULL,
+				     false);
+	if (ret < 0) {
+		dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
+		return ret;
+	}
+
+	ret = set_ep_max_packet_size(uac2_opts, &hs_epin_desc, USB_SPEED_HIGH,
+				     true);
+	if (ret < 0) {
+		dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
+		return ret;
+	}
+
+	ret = set_ep_max_packet_size(uac2_opts, &hs_epout_desc, USB_SPEED_HIGH,
+				     false);
+	if (ret < 0) {
+		dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
+		return ret;
+	}
 
 	hs_epout_desc.bEndpointAddress = fs_epout_desc.bEndpointAddress;
 	hs_epin_desc.bEndpointAddress = fs_epin_desc.bEndpointAddress;

From 95dff52cd88dca2e35aa78278124e300ecbffca9 Mon Sep 17 00:00:00 2001
From: Zqiang <qiang.zhang@windriver.com>
Date: Thu, 10 Dec 2020 10:01:48 +0800
Subject: [PATCH 1328/2658] usb: gadget: function: printer: Fix a memory leak
 for interface descriptor

commit 2cc332e4ee4febcbb685e2962ad323fe4b3b750a upstream.

When printer driver is loaded, the printer_func_bind function is called, in
this function, the interface descriptor be allocated memory, if after that,
the error occurred, the interface descriptor memory need to be free.

Reviewed-by: Peter Chen <peter.chen@nxp.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Zqiang <qiang.zhang@windriver.com>
Link: https://lore.kernel.org/r/20201210020148.6691-1-qiang.zhang@windriver.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/function/f_printer.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
index 7b21ef09fffc..8e32b41fc129 100644
--- a/drivers/usb/gadget/function/f_printer.c
+++ b/drivers/usb/gadget/function/f_printer.c
@@ -1116,6 +1116,7 @@ static int printer_func_bind(struct usb_configuration *c,
 		printer_req_free(dev->in_ep, req);
 	}
 
+	usb_free_all_descriptors(f);
 	return ret;
 
 }

From 3213f267404b58ffb2d463a89cc68a70fe63a8ff Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Tue, 17 Nov 2020 17:29:55 +0800
Subject: [PATCH 1329/2658] USB: gadget: legacy: fix return error code in
 acm_ms_bind()

commit c91d3a6bcaa031f551ba29a496a8027b31289464 upstream.

If usb_otg_descriptor_alloc() failed, it need return ENOMEM.

Fixes: 578aa8a2b12c ("usb: gadget: acm_ms: allocate and init otg descriptor by otg capabilities")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201117092955.4102785-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/legacy/acm_ms.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/legacy/acm_ms.c b/drivers/usb/gadget/legacy/acm_ms.c
index 64b2cbb0bc6b..4fe499cf5b77 100644
--- a/drivers/usb/gadget/legacy/acm_ms.c
+++ b/drivers/usb/gadget/legacy/acm_ms.c
@@ -207,8 +207,10 @@ static int acm_ms_bind(struct usb_composite_dev *cdev)
 		struct usb_descriptor_header *usb_desc;
 
 		usb_desc = usb_otg_descriptor_alloc(gadget);
-		if (!usb_desc)
+		if (!usb_desc) {
+			status = -ENOMEM;
 			goto fail_string_ids;
+		}
 		usb_otg_descriptor_init(gadget, usb_desc);
 		otg_desc[0] = usb_desc;
 		otg_desc[1] = NULL;

From 1fa6f2f928f9d77cb5aacaf8d2e213e336e9860c Mon Sep 17 00:00:00 2001
From: Sriharsha Allenki <sallenki@codeaurora.org>
Date: Wed, 2 Dec 2020 18:32:20 +0530
Subject: [PATCH 1330/2658] usb: gadget: Fix spinlock lockup on
 usb_function_deactivate

commit 5cc35c224a80aa5a5a539510ef049faf0d6ed181 upstream.

There is a spinlock lockup as part of composite_disconnect
when it tries to acquire cdev->lock as part of usb_gadget_deactivate.
This is because the usb_gadget_deactivate is called from
usb_function_deactivate with the same spinlock held.

This would result in the below call stack and leads to stall.

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu:     3-...0: (1 GPs behind) idle=162/1/0x4000000000000000
softirq=10819/10819 fqs=2356
 (detected by 2, t=5252 jiffies, g=20129, q=3770)
 Task dump for CPU 3:
 task:uvc-gadget_wlhe state:R  running task     stack:    0 pid:  674 ppid:
 636 flags:0x00000202
 Call trace:
  __switch_to+0xc0/0x170
  _raw_spin_lock_irqsave+0x84/0xb0
  composite_disconnect+0x28/0x78
  configfs_composite_disconnect+0x68/0x70
  usb_gadget_disconnect+0x10c/0x128
  usb_gadget_deactivate+0xd4/0x108
  usb_function_deactivate+0x6c/0x80
  uvc_function_disconnect+0x20/0x58
  uvc_v4l2_release+0x30/0x88
  v4l2_release+0xbc/0xf0
  __fput+0x7c/0x230
  ____fput+0x14/0x20
  task_work_run+0x88/0x140
  do_notify_resume+0x240/0x6f0
  work_pending+0x8/0x200

Fix this by doing an unlock on cdev->lock before the usb_gadget_deactivate
call from usb_function_deactivate.

The same lockup can happen in the usb_gadget_activate path. Fix that path
as well.

Reported-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/linux-usb/20201102094936.GA29581@b29397-desktop/
Tested-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201202130220.24926-1-sallenki@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/composite.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 8f924a05fe24..3be990b61992 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -311,8 +311,11 @@ int usb_function_deactivate(struct usb_function *function)
 
 	spin_lock_irqsave(&cdev->lock, flags);
 
-	if (cdev->deactivations == 0)
+	if (cdev->deactivations == 0) {
+		spin_unlock_irqrestore(&cdev->lock, flags);
 		status = usb_gadget_deactivate(cdev->gadget);
+		spin_lock_irqsave(&cdev->lock, flags);
+	}
 	if (status == 0)
 		cdev->deactivations++;
 
@@ -343,8 +346,11 @@ int usb_function_activate(struct usb_function *function)
 		status = -EINVAL;
 	else {
 		cdev->deactivations--;
-		if (cdev->deactivations == 0)
+		if (cdev->deactivations == 0) {
+			spin_unlock_irqrestore(&cdev->lock, flags);
 			status = usb_gadget_activate(cdev->gadget);
+			spin_lock_irqsave(&cdev->lock, flags);
+		}
 	}
 
 	spin_unlock_irqrestore(&cdev->lock, flags);

From facfadee6c9f807257073ea8d2dcc3cc14598d03 Mon Sep 17 00:00:00 2001
From: Chandana Kishori Chiluveru <cchiluve@codeaurora.org>
Date: Tue, 29 Dec 2020 14:44:43 -0800
Subject: [PATCH 1331/2658] usb: gadget: configfs: Preserve function ordering
 after bind failure

commit 6cd0fe91387917be48e91385a572a69dfac2f3f7 upstream.

When binding the ConfigFS gadget to a UDC, the functions in each
configuration are added in list order. However, if usb_add_function()
fails, the failed function is put back on its configuration's
func_list and purge_configs_funcs() is called to further clean up.

purge_configs_funcs() iterates over the configurations and functions
in forward order, calling unbind() on each of the previously added
functions. But after doing so, each function gets moved to the
tail of the configuration's func_list. This results in reshuffling
the original order of the functions within a configuration such
that the failed function now appears first even though it may have
originally appeared in the middle or even end of the list. At this
point if the ConfigFS gadget is attempted to re-bind to the UDC,
the functions will be added in a different order than intended,
with the only recourse being to remove and relink the functions all
over again.

An example of this as follows:

ln -s functions/mass_storage.0 configs/c.1
ln -s functions/ncm.0 configs/c.1
ln -s functions/ffs.adb configs/c.1	# oops, forgot to start adbd
echo "<udc device>" > UDC		# fails
start adbd
echo "<udc device>" > UDC		# now succeeds, but...
					# bind order is
					# "ADB", mass_storage, ncm

[30133.118289] configfs-gadget gadget: adding 'Mass Storage Function'/ffffff810af87200 to config 'c'/ffffff817d6a2520
[30133.119875] configfs-gadget gadget: adding 'cdc_network'/ffffff80f48d1a00 to config 'c'/ffffff817d6a2520
[30133.119974] using random self ethernet address
[30133.120002] using random host ethernet address
[30133.139604] usb0: HOST MAC 3e:27:46:ba:3e:26
[30133.140015] usb0: MAC 6e:28:7e:42:66:6a
[30133.140062] configfs-gadget gadget: adding 'Function FS Gadget'/ffffff80f3868438 to config 'c'/ffffff817d6a2520
[30133.140081] configfs-gadget gadget: adding 'Function FS Gadget'/ffffff80f3868438 --> -19
[30133.140098] configfs-gadget gadget: unbind function 'Mass Storage Function'/ffffff810af87200
[30133.140119] configfs-gadget gadget: unbind function 'cdc_network'/ffffff80f48d1a00
[30133.173201] configfs-gadget a600000.dwc3: failed to start g1: -19
[30136.661933] init: starting service 'adbd'...
[30136.700126] read descriptors
[30136.700413] read strings
[30138.574484] configfs-gadget gadget: adding 'Function FS Gadget'/ffffff80f3868438 to config 'c'/ffffff817d6a2520
[30138.575497] configfs-gadget gadget: adding 'Mass Storage Function'/ffffff810af87200 to config 'c'/ffffff817d6a2520
[30138.575554] configfs-gadget gadget: adding 'cdc_network'/ffffff80f48d1a00 to config 'c'/ffffff817d6a2520
[30138.575631] using random self ethernet address
[30138.575660] using random host ethernet address
[30138.595338] usb0: HOST MAC 2e:cf:43:cd:ca:c8
[30138.597160] usb0: MAC 6a:f0:9f:ee:82:a0
[30138.791490] configfs-gadget gadget: super-speed config #1: c

Fix this by reversing the iteration order of the functions in
purge_config_funcs() when unbinding them, and adding them back to
the config's func_list at the head instead of the tail. This
ensures that we unbind and unwind back to the original list order.

Fixes: 88af8bbe4ef7 ("usb: gadget: the start of the configfs interface")
Signed-off-by: Chandana Kishori Chiluveru <cchiluve@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20201229224443.31623-1-jackp@codeaurora.org
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/configfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 28b62d971d7f..d5fcb7037ad2 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1261,9 +1261,9 @@ static void purge_configs_funcs(struct gadget_info *gi)
 
 		cfg = container_of(c, struct config_usb_cfg, c);
 
-		list_for_each_entry_safe(f, tmp, &c->functions, list) {
+		list_for_each_entry_safe_reverse(f, tmp, &c->functions, list) {
 
-			list_move_tail(&f->list, &cfg->func_list);
+			list_move(&f->list, &cfg->func_list);
 			if (f->unbind) {
 				dev_err(&gi->cdev.gadget->dev, "unbind function"
 						" '%s'/%pK\n", f->name, f);

From c7a0ff197d09620187717b661b54f46efd87bc14 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Fri, 8 Jan 2021 15:55:28 +0100
Subject: [PATCH 1332/2658] USB: serial: keyspan_pda: remove unused variable

Remove an unused variable which was mistakingly left by commit
37faf5061541 ("USB: serial: keyspan_pda: fix write-wakeup
use-after-free") and only removed by a later change.

This is needed to suppress a W=1 warning about the unused variable in
the stable trees that the build bots triggers.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/keyspan_pda.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index e25ea9069350..c40b64244160 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -559,10 +559,8 @@ static int keyspan_pda_write(struct tty_struct *tty,
 static void keyspan_pda_write_bulk_callback(struct urb *urb)
 {
 	struct usb_serial_port *port = urb->context;
-	struct keyspan_pda_private *priv;
 
 	set_bit(0, &port->write_urbs_free);
-	priv = usb_get_serial_port_data(port);
 
 	/* queue up a wakeup at scheduler time */
 	usb_serial_port_softint(port);

From 0c76d3f5d9cd10c3ebce648a2ee58ef0aefe8335 Mon Sep 17 00:00:00 2001
From: Dan Williams <dan.j.williams@intel.com>
Date: Wed, 2 Dec 2020 22:28:12 -0800
Subject: [PATCH 1333/2658] x86/mm: Fix leak of pmd ptlock

commit d1c5246e08eb64991001d97a3bd119c93edbc79a upstream.

Commit

  28ee90fe6048 ("x86/mm: implement free pmd/pte page interfaces")

introduced a new location where a pmd was released, but neglected to
run the pmd page destructor. In fact, this happened previously for a
different pmd release path and was fixed by commit:

  c283610e44ec ("x86, mm: do not leak page->ptl for pmd page tables").

This issue was hidden until recently because the failure mode is silent,
but commit:

  b2b29d6d0119 ("mm: account PMD tables like PTE tables")

turns the failure mode into this signature:

 BUG: Bad page state in process lt-pmem-ns  pfn:15943d
 page:000000007262ed7b refcount:0 mapcount:-1024 mapping:0000000000000000 index:0x0 pfn:0x15943d
 flags: 0xaffff800000000()
 raw: 00affff800000000 dead000000000100 0000000000000000 0000000000000000
 raw: 0000000000000000 ffff913a029bcc08 00000000fffffbff 0000000000000000
 page dumped because: nonzero mapcount
 [..]
  dump_stack+0x8b/0xb0
  bad_page.cold+0x63/0x94
  free_pcp_prepare+0x224/0x270
  free_unref_page+0x18/0xd0
  pud_free_pmd_page+0x146/0x160
  ioremap_pud_range+0xe3/0x350
  ioremap_page_range+0x108/0x160
  __ioremap_caller.constprop.0+0x174/0x2b0
  ? memremap+0x7a/0x110
  memremap+0x7a/0x110
  devm_memremap+0x53/0xa0
  pmem_attach_disk+0x4ed/0x530 [nd_pmem]
  ? __devm_release_region+0x52/0x80
  nvdimm_bus_probe+0x85/0x210 [libnvdimm]

Given this is a repeat occurrence it seemed prudent to look for other
places where this destructor might be missing and whether a better
helper is needed. try_to_free_pmd_page() looks like a candidate, but
testing with setting up and tearing down pmd mappings via the dax unit
tests is thus far not triggering the failure.

As for a better helper pmd_free() is close, but it is a messy fit
due to requiring an @mm arg. Also, ___pmd_free_tlb() wants to call
paravirt_tlb_remove_table() instead of free_page(), so open-coded
pgtable_pmd_page_dtor() seems the best way forward for now.

Debugged together with Matthew Wilcox <willy@infradead.org>.

Fixes: 28ee90fe6048 ("x86/mm: implement free pmd/pte page interfaces")
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Tested-by: Yi Zhang <yi.zhang@redhat.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/160697689204.605323.17629854984697045602.stgit@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/mm/pgtable.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 3ed4753280aa..289518bb0e8d 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -720,6 +720,8 @@ int pud_free_pmd_page(pud_t *pud, unsigned long addr)
 	}
 
 	free_page((unsigned long)pmd_sv);
+
+	pgtable_pmd_page_dtor(virt_to_page(pmd));
 	free_page((unsigned long)pmd);
 
 	return 1;

From 083d6ca0044150390318328fd41309b755d079e6 Mon Sep 17 00:00:00 2001
From: bo liu <bo.liu@senarytech.com>
Date: Tue, 29 Dec 2020 11:52:26 +0800
Subject: [PATCH 1334/2658] ALSA: hda/conexant: add a new hda codec CX11970

commit 744a11abc56405c5a106e63da30a941b6d27f737 upstream.

The current kernel does not support the cx11970 codec chip.
Add a codec configuration item to kernel.

[ Minor coding style fix by tiwai ]

Signed-off-by: bo liu <bo.liu@senarytech.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201229035226.62120-1-bo.liu@senarytech.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_conexant.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 3150ddfbdb25..4c5f70302524 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -1011,6 +1011,7 @@ static int patch_conexant_auto(struct hda_codec *codec)
 static const struct hda_device_id snd_hda_id_conexant[] = {
 	HDA_CODEC_ENTRY(0x14f11f86, "CX8070", patch_conexant_auto),
 	HDA_CODEC_ENTRY(0x14f12008, "CX8200", patch_conexant_auto),
+	HDA_CODEC_ENTRY(0x14f120d0, "CX11970", patch_conexant_auto),
 	HDA_CODEC_ENTRY(0x14f15045, "CX20549 (Venice)", patch_conexant_auto),
 	HDA_CODEC_ENTRY(0x14f15047, "CX20551 (Waikiki)", patch_conexant_auto),
 	HDA_CODEC_ENTRY(0x14f15051, "CX20561 (Hermosa)", patch_conexant_auto),

From 4058161a9678c65fc5ca0657f9f8c70c55f294bd Mon Sep 17 00:00:00 2001
From: Bard Liao <yung-chuan.liao@linux.intel.com>
Date: Tue, 5 Jan 2021 17:11:45 +0800
Subject: [PATCH 1335/2658] Revert "device property: Keep secondary firmware
 node secondary by type"

commit 47f4469970d8861bc06d2d4d45ac8200ff07c693 upstream.

While commit d5dcce0c414f ("device property: Keep secondary firmware
node secondary by type") describes everything correct in its commit
message, the change it made does the opposite and original commit
c15e1bdda436 ("device property: Fix the secondary firmware node handling
in set_primary_fwnode()") was fully correct.

Revert the former one here and improve documentation in the next patch.

Fixes: d5dcce0c414f ("device property: Keep secondary firmware node secondary by type")
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Cc: 5.10+ <stable@vger.kernel.org> # 5.10+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index 5c2a99e2cb84..a51b0d010d44 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2362,7 +2362,7 @@ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode)
 		if (fwnode_is_primary(fn)) {
 			dev->fwnode = fn->secondary;
 			if (!(parent && fn == parent->fwnode))
-				fn->secondary = ERR_PTR(-ENODEV);
+				fn->secondary = NULL;
 		} else {
 			dev->fwnode = NULL;
 		}

From 78200133071ccd223068b2be6f86067c902f4dad Mon Sep 17 00:00:00 2001
From: Vasily Averin <vvs@virtuozzo.com>
Date: Thu, 17 Dec 2020 17:53:18 +0300
Subject: [PATCH 1336/2658] netfilter: ipset: fix shift-out-of-bounds in
 htable_bits()

commit 5c8193f568ae16f3242abad6518dc2ca6c8eef86 upstream.

htable_bits() can call jhash_size(32) and trigger shift-out-of-bounds

UBSAN: shift-out-of-bounds in net/netfilter/ipset/ip_set_hash_gen.h:151:6
shift exponent 32 is too large for 32-bit type 'unsigned int'
CPU: 0 PID: 8498 Comm: syz-executor519
 Not tainted 5.10.0-rc7-next-20201208-syzkaller #0
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
 htable_bits net/netfilter/ipset/ip_set_hash_gen.h:151 [inline]
 hash_mac_create.cold+0x58/0x9b net/netfilter/ipset/ip_set_hash_gen.h:1524
 ip_set_create+0x610/0x1380 net/netfilter/ipset/ip_set_core.c:1115
 nfnetlink_rcv_msg+0xecc/0x1180 net/netfilter/nfnetlink.c:252
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
 nfnetlink_rcv+0x1ac/0x420 net/netfilter/nfnetlink.c:600
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x907/0xe40 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:672
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2345
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2399
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2432
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

This patch replaces htable_bits() by simple fls(hashsize - 1) call:
it alone returns valid nbits both for round and non-round hashsizes.
It is normal to set any nbits here because it is validated inside
following htable_size() call which returns 0 for nbits>31.

Fixes: 1feab10d7e6d("netfilter: ipset: Unified hash type generation")
Reported-by: syzbot+d66bfadebca46cf61a2b@syzkaller.appspotmail.com
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/ipset/ip_set_hash_gen.h | 20 +++++---------------
 1 file changed, 5 insertions(+), 15 deletions(-)

diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index e5336ab36d67..da0aa720da6f 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -113,20 +113,6 @@ htable_size(u8 hbits)
 	return hsize * sizeof(struct hbucket *) + sizeof(struct htable);
 }
 
-/* Compute htable_bits from the user input parameter hashsize */
-static u8
-htable_bits(u32 hashsize)
-{
-	/* Assume that hashsize == 2^htable_bits */
-	u8 bits = fls(hashsize - 1);
-
-	if (jhash_size(bits) != hashsize)
-		/* Round up to the first 2^n value */
-		bits = fls(hashsize);
-
-	return bits;
-}
-
 #ifdef IP_SET_HASH_WITH_NETS
 #if IPSET_NET_COUNT > 1
 #define __CIDR(cidr, i)		(cidr[i])
@@ -1309,7 +1295,11 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set,
 	get_random_bytes(&h->initval, sizeof(h->initval));
 	set->timeout = IPSET_NO_TIMEOUT;
 
-	hbits = htable_bits(hashsize);
+	/* Compute htable_bits from the user input parameter hashsize.
+	 * Assume that hashsize == 2^htable_bits,
+	 * otherwise round up to the first 2^n value.
+	 */
+	hbits = fls(hashsize - 1);
 	hsize = htable_size(hbits);
 	if (hsize == 0) {
 		kfree(h);

From f6f55a0f83ce2082e4458fcbae671d89849ca0f4 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Tue, 22 Dec 2020 23:23:56 +0100
Subject: [PATCH 1337/2658] netfilter: xt_RATEEST: reject non-null terminated
 string from userspace

commit 6cb56218ad9e580e519dcd23bfb3db08d8692e5a upstream.

syzbot reports:
detected buffer overflow in strlen
[..]
Call Trace:
 strlen include/linux/string.h:325 [inline]
 strlcpy include/linux/string.h:348 [inline]
 xt_rateest_tg_checkentry+0x2a5/0x6b0 net/netfilter/xt_RATEEST.c:143

strlcpy assumes src is a c-string. Check info->name before its used.

Reported-by: syzbot+e86f7c428c8c50db65b4@syzkaller.appspotmail.com
Fixes: 5859034d7eb8793 ("[NETFILTER]: x_tables: add RATEEST target")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/xt_RATEEST.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
index 0be96f8475f7..3b5c76ae4375 100644
--- a/net/netfilter/xt_RATEEST.c
+++ b/net/netfilter/xt_RATEEST.c
@@ -107,6 +107,9 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par)
 	} cfg;
 	int ret;
 
+	if (strnlen(info->name, sizeof(est->name)) >= sizeof(est->name))
+		return -ENAMETOOLONG;
+
 	if (unlikely(!rnd_inited)) {
 		get_random_bytes(&jhash_rnd, sizeof(jhash_rnd));
 		rnd_inited = true;

From d1e1baa0e50bbb182d94ebb44b5acfd7200805e9 Mon Sep 17 00:00:00 2001
From: Ying-Tsun Huang <ying-tsun.huang@amd.com>
Date: Tue, 15 Dec 2020 15:07:20 +0800
Subject: [PATCH 1338/2658] x86/mtrr: Correct the range check before performing
 MTRR type lookups

commit cb7f4a8b1fb426a175d1708f05581939c61329d4 upstream.

In mtrr_type_lookup(), if the input memory address region is not in the
MTRR, over 4GB, and not over the top of memory, a write-back attribute
is returned. These condition checks are for ensuring the input memory
address region is actually mapped to the physical memory.

However, if the end address is just aligned with the top of memory,
the condition check treats the address is over the top of memory, and
write-back attribute is not returned.

And this hits in a real use case with NVDIMM: the nd_pmem module tries
to map NVDIMMs as cacheable memories when NVDIMMs are connected. If a
NVDIMM is the last of the DIMMs, the performance of this NVDIMM becomes
very low since it is aligned with the top of memory and its memory type
is uncached-minus.

Move the input end address change to inclusive up into
mtrr_type_lookup(), before checking for the top of memory in either
mtrr_type_lookup_{variable,fixed}() helpers.

 [ bp: Massage commit message. ]

Fixes: 0cc705f56e40 ("x86/mm/mtrr: Clean up mtrr_type_lookup()")
Signed-off-by: Ying-Tsun Huang <ying-tsun.huang@amd.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20201215070721.4349-1-ying-tsun.huang@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/cpu/mtrr/generic.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
index 55d499593e6a..e2fa0fcbaa69 100644
--- a/arch/x86/kernel/cpu/mtrr/generic.c
+++ b/arch/x86/kernel/cpu/mtrr/generic.c
@@ -166,9 +166,6 @@ static u8 mtrr_type_lookup_variable(u64 start, u64 end, u64 *partial_end,
 	*repeat = 0;
 	*uniform = 1;
 
-	/* Make end inclusive instead of exclusive */
-	end--;
-
 	prev_match = MTRR_TYPE_INVALID;
 	for (i = 0; i < num_var_ranges; ++i) {
 		unsigned short start_state, end_state, inclusive;
@@ -260,6 +257,9 @@ u8 mtrr_type_lookup(u64 start, u64 end, u8 *uniform)
 	int repeat;
 	u64 partial_end;
 
+	/* Make end inclusive instead of exclusive */
+	end--;
+
 	if (!mtrr_state_set)
 		return MTRR_TYPE_INVALID;
 

From 72fc659e042a587c209860a0b2de58e379da60fb Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 12 Jan 2021 19:47:57 +0100
Subject: [PATCH 1339/2658] Linux 4.4.251

Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Link: https://lore.kernel.org/r/20210111130032.469630231@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 918ccdcec8e3..82fde8e3e565 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 250
+SUBLEVEL = 251
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From e9e097f16213f76858e0e1d04ac4af0cfa7dd5dc Mon Sep 17 00:00:00 2001
From: David Disseldorp <ddiss@suse.de>
Date: Fri, 23 Dec 2016 11:37:53 +0100
Subject: [PATCH 1340/2658] target: add XCOPY target/segment desc sense codes

[ Upstream commit e864212078ded276bdb272b2e0ee6a979357ca8a ]

As defined in http://www.t10.org/lists/asc-num.htm. To be used during
validation of XCOPY target and segment descriptor lists.

Signed-off-by: David Disseldorp <ddiss@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/target/target_core_transport.c | 24 ++++++++++++++++++++++++
 include/target/target_core_base.h      |  4 ++++
 2 files changed, 28 insertions(+)

diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 7199bac67333..96cf2448a1f4 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1730,6 +1730,10 @@ void transport_generic_request_failure(struct se_cmd *cmd,
 	case TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED:
 	case TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED:
 	case TCM_COPY_TARGET_DEVICE_NOT_REACHABLE:
+	case TCM_TOO_MANY_TARGET_DESCS:
+	case TCM_UNSUPPORTED_TARGET_DESC_TYPE_CODE:
+	case TCM_TOO_MANY_SEGMENT_DESCS:
+	case TCM_UNSUPPORTED_SEGMENT_DESC_TYPE_CODE:
 		break;
 	case TCM_OUT_OF_RESOURCES:
 		sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
@@ -2864,6 +2868,26 @@ static const struct sense_info sense_info_table[] = {
 		.key = ILLEGAL_REQUEST,
 		.asc = 0x26, /* INVALID FIELD IN PARAMETER LIST */
 	},
+	[TCM_TOO_MANY_TARGET_DESCS] = {
+		.key = ILLEGAL_REQUEST,
+		.asc = 0x26,
+		.ascq = 0x06, /* TOO MANY TARGET DESCRIPTORS */
+	},
+	[TCM_UNSUPPORTED_TARGET_DESC_TYPE_CODE] = {
+		.key = ILLEGAL_REQUEST,
+		.asc = 0x26,
+		.ascq = 0x07, /* UNSUPPORTED TARGET DESCRIPTOR TYPE CODE */
+	},
+	[TCM_TOO_MANY_SEGMENT_DESCS] = {
+		.key = ILLEGAL_REQUEST,
+		.asc = 0x26,
+		.ascq = 0x08, /* TOO MANY SEGMENT DESCRIPTORS */
+	},
+	[TCM_UNSUPPORTED_SEGMENT_DESC_TYPE_CODE] = {
+		.key = ILLEGAL_REQUEST,
+		.asc = 0x26,
+		.ascq = 0x09, /* UNSUPPORTED SEGMENT DESCRIPTOR TYPE CODE */
+	},
 	[TCM_PARAMETER_LIST_LENGTH_ERROR] = {
 		.key = ILLEGAL_REQUEST,
 		.asc = 0x1a, /* PARAMETER LIST LENGTH ERROR */
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 0eed9fd79ea5..5aa8e0e62e30 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -181,6 +181,10 @@ enum tcm_sense_reason_table {
 	TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED	= R(0x16),
 	TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED	= R(0x17),
 	TCM_COPY_TARGET_DEVICE_NOT_REACHABLE	= R(0x18),
+	TCM_TOO_MANY_TARGET_DESCS		= R(0x19),
+	TCM_UNSUPPORTED_TARGET_DESC_TYPE_CODE	= R(0x1a),
+	TCM_TOO_MANY_SEGMENT_DESCS		= R(0x1b),
+	TCM_UNSUPPORTED_SEGMENT_DESC_TYPE_CODE	= R(0x1c),
 #undef R
 };
 

From 59ffd03656380c52271c685be76278b521b51d9b Mon Sep 17 00:00:00 2001
From: David Disseldorp <ddiss@suse.de>
Date: Fri, 23 Dec 2016 11:37:55 +0100
Subject: [PATCH 1341/2658] target: bounds check XCOPY segment descriptor list

[ Upstream commit af9f62c1686268c0517b289274d38f3a03bebd2a ]

Check the length of the XCOPY request segment descriptor list against
the value advertised via the MAXIMUM SEGMENT DESCRIPTOR COUNT field in
the RECEIVE COPY OPERATING PARAMETERS response.

spc4r37 6.4.3.5 states:
  If the number of segment descriptors exceeds the allowed number, the
  copy manager shall terminate the command with CHECK CONDITION status,
  with the sense key set to ILLEGAL REQUEST, and the additional sense
  code set to TOO MANY SEGMENT DESCRIPTORS.

This functionality is testable using the libiscsi
ExtendedCopy.DescrLimits test.

Signed-off-by: David Disseldorp <ddiss@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/target/target_core_xcopy.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
index 6415e9b09a52..cd71957c7075 100644
--- a/drivers/target/target_core_xcopy.c
+++ b/drivers/target/target_core_xcopy.c
@@ -305,17 +305,26 @@ static int target_xcopy_parse_segdesc_02(struct se_cmd *se_cmd, struct xcopy_op
 
 static int target_xcopy_parse_segment_descriptors(struct se_cmd *se_cmd,
 				struct xcopy_op *xop, unsigned char *p,
-				unsigned int sdll)
+				unsigned int sdll, sense_reason_t *sense_ret)
 {
 	unsigned char *desc = p;
 	unsigned int start = 0;
 	int offset = sdll % XCOPY_SEGMENT_DESC_LEN, rc, ret = 0;
 
+	*sense_ret = TCM_INVALID_PARAMETER_LIST;
+
 	if (offset != 0) {
 		pr_err("XCOPY segment descriptor list length is not"
 			" multiple of %d\n", XCOPY_SEGMENT_DESC_LEN);
 		return -EINVAL;
 	}
+	if (sdll > RCR_OP_MAX_SG_DESC_COUNT * XCOPY_SEGMENT_DESC_LEN) {
+		pr_err("XCOPY supports %u segment descriptor(s), sdll: %u too"
+			" large..\n", RCR_OP_MAX_SG_DESC_COUNT, sdll);
+		/* spc4r37 6.4.3.5 SEGMENT DESCRIPTOR LIST LENGTH field */
+		*sense_ret = TCM_TOO_MANY_SEGMENT_DESCS;
+		return -EINVAL;
+	}
 
 	while (start < sdll) {
 		/*
@@ -913,7 +922,8 @@ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
 	seg_desc = &p[16];
 	seg_desc += (rc * XCOPY_TARGET_DESC_LEN);
 
-	rc = target_xcopy_parse_segment_descriptors(se_cmd, xop, seg_desc, sdll);
+	rc = target_xcopy_parse_segment_descriptors(se_cmd, xop, seg_desc,
+						    sdll, &ret);
 	if (rc <= 0) {
 		xcopy_pt_undepend_remotedev(xop);
 		goto out;

From 7930fb075c7bde7cd520bd5f719aa18493ff0cfa Mon Sep 17 00:00:00 2001
From: David Disseldorp <ddiss@suse.de>
Date: Mon, 2 Jan 2017 18:04:05 +0100
Subject: [PATCH 1342/2658] target: simplify XCOPY wwn->se_dev lookup helper

[ Upstream commit 94aae4caacda89a1bdb7198b260f4ca3595b7ed7 ]

target_xcopy_locate_se_dev_e4() is used to locate an se_dev, based on
the WWN provided with the XCOPY request. Remove a couple of unneeded
arguments, and rely on the caller for the src/dst test.

Signed-off-by: David Disseldorp <ddiss@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/target/target_core_xcopy.c | 28 +++++++++-------------------
 1 file changed, 9 insertions(+), 19 deletions(-)

diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
index cd71957c7075..c7bd27bfe3d8 100644
--- a/drivers/target/target_core_xcopy.c
+++ b/drivers/target/target_core_xcopy.c
@@ -52,18 +52,13 @@ static int target_xcopy_gen_naa_ieee(struct se_device *dev, unsigned char *buf)
 	return 0;
 }
 
-static int target_xcopy_locate_se_dev_e4(struct se_cmd *se_cmd, struct xcopy_op *xop,
-					bool src)
+static int target_xcopy_locate_se_dev_e4(const unsigned char *dev_wwn,
+					struct se_device **found_dev)
 {
 	struct se_device *se_dev;
-	unsigned char tmp_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN], *dev_wwn;
+	unsigned char tmp_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
 	int rc;
 
-	if (src)
-		dev_wwn = &xop->dst_tid_wwn[0];
-	else
-		dev_wwn = &xop->src_tid_wwn[0];
-
 	mutex_lock(&g_device_mutex);
 	list_for_each_entry(se_dev, &g_device_list, g_dev_node) {
 
@@ -77,15 +72,8 @@ static int target_xcopy_locate_se_dev_e4(struct se_cmd *se_cmd, struct xcopy_op
 		if (rc != 0)
 			continue;
 
-		if (src) {
-			xop->dst_dev = se_dev;
-			pr_debug("XCOPY 0xe4: Setting xop->dst_dev: %p from located"
-				" se_dev\n", xop->dst_dev);
-		} else {
-			xop->src_dev = se_dev;
-			pr_debug("XCOPY 0xe4: Setting xop->src_dev: %p from located"
-				" se_dev\n", xop->src_dev);
-		}
+		*found_dev = se_dev;
+		pr_debug("XCOPY 0xe4: located se_dev: %p\n", se_dev);
 
 		rc = target_depend_item(&se_dev->dev_group.cg_item);
 		if (rc != 0) {
@@ -242,9 +230,11 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
 	}
 
 	if (xop->op_origin == XCOL_SOURCE_RECV_OP)
-		rc = target_xcopy_locate_se_dev_e4(se_cmd, xop, true);
+		rc = target_xcopy_locate_se_dev_e4(xop->dst_tid_wwn,
+						&xop->dst_dev);
 	else
-		rc = target_xcopy_locate_se_dev_e4(se_cmd, xop, false);
+		rc = target_xcopy_locate_se_dev_e4(xop->src_tid_wwn,
+						&xop->src_dev);
 	/*
 	 * If a matching IEEE NAA 0x83 descriptor for the requested device
 	 * is not located on this node, return COPY_ABORTED with ASQ/ASQC

From 1057c88602e6e9d32702171b84bcb302c1a8339d Mon Sep 17 00:00:00 2001
From: David Disseldorp <ddiss@suse.de>
Date: Mon, 2 Jan 2017 18:04:07 +0100
Subject: [PATCH 1343/2658] target: use XCOPY segment descriptor CSCD IDs

[ Upstream commit 66640d35c1e4ef3c96ba5edb3c5e2ff8ab812e7a ]

The XCOPY specification in SPC4r37 states that the XCOPY source and
destination device(s) should be derived from the copy source and copy
destination (CSCD) descriptor IDs in the XCOPY segment descriptor.

The CSCD IDs are generally (for block -> block copies), indexes into
the corresponding CSCD descriptor list, e.g.
=================================
EXTENDED COPY Header
=================================
CSCD Descriptor List
- entry 0
  + LU ID <--------------<------------------\
- entry 1                                   |
  + LU ID <______________<_____________     |
=================================      |    |
Segment Descriptor List                |    |
- segment 0                            |    |
  + src CSCD ID = 0 --------->---------+----/
  + dest CSCD ID = 1 ___________>______|
  + len
  + src lba
  + dest lba
=================================

Currently LIO completely ignores the src and dest CSCD IDs in the
Segment Descriptor List, and instead assumes that the first entry in the
CSCD list corresponds to the source, and the second to the destination.

This commit removes this assumption, by ensuring that the Segment
Descriptor List is parsed prior to processing the CSCD Descriptor List.
CSCD Descriptor List processing is modified to compare the current list
index with the previously obtained src and dest CSCD IDs.

Additionally, XCOPY requests where the src and dest CSCD IDs refer to
the CSCD Descriptor List entry can now be successfully processed.

Fixes: cbf031f ("target: Add support for EXTENDED_COPY copy offload")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=191381
Signed-off-by: David Disseldorp <ddiss@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/target/target_core_xcopy.c | 79 ++++++++++++++++++------------
 1 file changed, 48 insertions(+), 31 deletions(-)

diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
index c7bd27bfe3d8..32db9180820e 100644
--- a/drivers/target/target_core_xcopy.c
+++ b/drivers/target/target_core_xcopy.c
@@ -97,7 +97,7 @@ static int target_xcopy_locate_se_dev_e4(const unsigned char *dev_wwn,
 }
 
 static int target_xcopy_parse_tiddesc_e4(struct se_cmd *se_cmd, struct xcopy_op *xop,
-				unsigned char *p, bool src)
+				unsigned char *p, unsigned short cscd_index)
 {
 	unsigned char *desc = p;
 	unsigned short ript;
@@ -142,7 +142,13 @@ static int target_xcopy_parse_tiddesc_e4(struct se_cmd *se_cmd, struct xcopy_op
 		return -EINVAL;
 	}
 
-	if (src) {
+	if (cscd_index != xop->stdi && cscd_index != xop->dtdi) {
+		pr_debug("XCOPY 0xe4: ignoring CSCD entry %d - neither src nor "
+			 "dest\n", cscd_index);
+		return 0;
+	}
+
+	if (cscd_index == xop->stdi) {
 		memcpy(&xop->src_tid_wwn[0], &desc[8], XCOPY_NAA_IEEE_REGEX_LEN);
 		/*
 		 * Determine if the source designator matches the local device
@@ -154,10 +160,15 @@ static int target_xcopy_parse_tiddesc_e4(struct se_cmd *se_cmd, struct xcopy_op
 			pr_debug("XCOPY 0xe4: Set xop->src_dev %p from source"
 					" received xop\n", xop->src_dev);
 		}
-	} else {
+	}
+
+	if (cscd_index == xop->dtdi) {
 		memcpy(&xop->dst_tid_wwn[0], &desc[8], XCOPY_NAA_IEEE_REGEX_LEN);
 		/*
-		 * Determine if the destination designator matches the local device
+		 * Determine if the destination designator matches the local
+		 * device. If @cscd_index corresponds to both source (stdi) and
+		 * destination (dtdi), or dtdi comes after stdi, then
+		 * XCOL_DEST_RECV_OP wins.
 		 */
 		if (!memcmp(&xop->local_dev_wwn[0], &xop->dst_tid_wwn[0],
 				XCOPY_NAA_IEEE_REGEX_LEN)) {
@@ -177,9 +188,9 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
 {
 	struct se_device *local_dev = se_cmd->se_dev;
 	unsigned char *desc = p;
-	int offset = tdll % XCOPY_TARGET_DESC_LEN, rc, ret = 0;
+	int offset = tdll % XCOPY_TARGET_DESC_LEN, rc;
+	unsigned short cscd_index = 0;
 	unsigned short start = 0;
-	bool src = true;
 
 	*sense_ret = TCM_INVALID_PARAMETER_LIST;
 
@@ -202,25 +213,19 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
 
 	while (start < tdll) {
 		/*
-		 * Check target descriptor identification with 0xE4 type with
-		 * use VPD 0x83 WWPN matching ..
+		 * Check target descriptor identification with 0xE4 type, and
+		 * compare the current index with the CSCD descriptor IDs in
+		 * the segment descriptor. Use VPD 0x83 WWPN matching ..
 		 */
 		switch (desc[0]) {
 		case 0xe4:
 			rc = target_xcopy_parse_tiddesc_e4(se_cmd, xop,
-							&desc[0], src);
+							&desc[0], cscd_index);
 			if (rc != 0)
 				goto out;
-			/*
-			 * Assume target descriptors are in source -> destination order..
-			 */
-			if (src)
-				src = false;
-			else
-				src = true;
 			start += XCOPY_TARGET_DESC_LEN;
 			desc += XCOPY_TARGET_DESC_LEN;
-			ret++;
+			cscd_index++;
 			break;
 		default:
 			pr_err("XCOPY unsupported descriptor type code:"
@@ -229,12 +234,21 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
 		}
 	}
 
-	if (xop->op_origin == XCOL_SOURCE_RECV_OP)
+	switch (xop->op_origin) {
+	case XCOL_SOURCE_RECV_OP:
 		rc = target_xcopy_locate_se_dev_e4(xop->dst_tid_wwn,
 						&xop->dst_dev);
-	else
+		break;
+	case XCOL_DEST_RECV_OP:
 		rc = target_xcopy_locate_se_dev_e4(xop->src_tid_wwn,
 						&xop->src_dev);
+		break;
+	default:
+		pr_err("XCOPY CSCD descriptor IDs not found in CSCD list - "
+			"stdi: %hu dtdi: %hu\n", xop->stdi, xop->dtdi);
+		rc = -EINVAL;
+		break;
+	}
 	/*
 	 * If a matching IEEE NAA 0x83 descriptor for the requested device
 	 * is not located on this node, return COPY_ABORTED with ASQ/ASQC
@@ -251,7 +265,7 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
 	pr_debug("XCOPY TGT desc: Dest dev: %p NAA IEEE WWN: 0x%16phN\n",
 		 xop->dst_dev, &xop->dst_tid_wwn[0]);
 
-	return ret;
+	return cscd_index;
 
 out:
 	return -EINVAL;
@@ -892,6 +906,20 @@ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
 		" tdll: %hu sdll: %u inline_dl: %u\n", list_id, list_id_usage,
 		tdll, sdll, inline_dl);
 
+	/*
+	 * skip over the target descriptors until segment descriptors
+	 * have been passed - CSCD ids are needed to determine src and dest.
+	 */
+	seg_desc = &p[16] + tdll;
+
+	rc = target_xcopy_parse_segment_descriptors(se_cmd, xop, seg_desc,
+						    sdll, &ret);
+	if (rc <= 0)
+		goto out;
+
+	pr_debug("XCOPY: Processed %d segment descriptors, length: %u\n", rc,
+				rc * XCOPY_SEGMENT_DESC_LEN);
+
 	rc = target_xcopy_parse_target_descriptors(se_cmd, xop, &p[16], tdll, &ret);
 	if (rc <= 0)
 		goto out;
@@ -909,19 +937,8 @@ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
 
 	pr_debug("XCOPY: Processed %d target descriptors, length: %u\n", rc,
 				rc * XCOPY_TARGET_DESC_LEN);
-	seg_desc = &p[16];
-	seg_desc += (rc * XCOPY_TARGET_DESC_LEN);
-
-	rc = target_xcopy_parse_segment_descriptors(se_cmd, xop, seg_desc,
-						    sdll, &ret);
-	if (rc <= 0) {
-		xcopy_pt_undepend_remotedev(xop);
-		goto out;
-	}
 	transport_kunmap_data_sg(se_cmd);
 
-	pr_debug("XCOPY: Processed %d segment descriptors, length: %u\n", rc,
-				rc * XCOPY_SEGMENT_DESC_LEN);
 	INIT_WORK(&xop->xop_work, target_xcopy_do_work);
 	queue_work(xcopy_wq, &xop->xop_work);
 	return TCM_NO_SENSE;

From aaa27ede8c2f903ca6f32bd2d379ca1010dab046 Mon Sep 17 00:00:00 2001
From: Mike Christie <mchristi@redhat.com>
Date: Fri, 23 Jun 2017 01:18:17 -0500
Subject: [PATCH 1344/2658] xcopy: loop over devices using idr helper

[ Upstream commit 6906d008b4b06e42cad393ac25bec76fbf31fabd ]

This converts the xcopy code to use the idr helper. The next patch
will drop the g_device_list and make g_device_mutex local to the
target_core_device.c file.

Signed-off-by: Mike Christie <mchristi@redhat.com>
Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/target/target_core_xcopy.c | 70 +++++++++++++++++-------------
 1 file changed, 41 insertions(+), 29 deletions(-)

diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
index 32db9180820e..b0e8f432c720 100644
--- a/drivers/target/target_core_xcopy.c
+++ b/drivers/target/target_core_xcopy.c
@@ -52,48 +52,60 @@ static int target_xcopy_gen_naa_ieee(struct se_device *dev, unsigned char *buf)
 	return 0;
 }
 
-static int target_xcopy_locate_se_dev_e4(const unsigned char *dev_wwn,
-					struct se_device **found_dev)
+struct xcopy_dev_search_info {
+	const unsigned char *dev_wwn;
+	struct se_device *found_dev;
+};
+
+static int target_xcopy_locate_se_dev_e4_iter(struct se_device *se_dev,
+					      void *data)
 {
-	struct se_device *se_dev;
+	struct xcopy_dev_search_info *info = data;
 	unsigned char tmp_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
 	int rc;
 
-	mutex_lock(&g_device_mutex);
-	list_for_each_entry(se_dev, &g_device_list, g_dev_node) {
+	if (!se_dev->dev_attrib.emulate_3pc)
+		return 0;
 
-		if (!se_dev->dev_attrib.emulate_3pc)
-			continue;
+	memset(&tmp_dev_wwn[0], 0, XCOPY_NAA_IEEE_REGEX_LEN);
+	target_xcopy_gen_naa_ieee(se_dev, &tmp_dev_wwn[0]);
 
-		memset(&tmp_dev_wwn[0], 0, XCOPY_NAA_IEEE_REGEX_LEN);
-		target_xcopy_gen_naa_ieee(se_dev, &tmp_dev_wwn[0]);
+	rc = memcmp(&tmp_dev_wwn[0], info->dev_wwn, XCOPY_NAA_IEEE_REGEX_LEN);
+	if (rc != 0)
+		return 0;
 
-		rc = memcmp(&tmp_dev_wwn[0], dev_wwn, XCOPY_NAA_IEEE_REGEX_LEN);
-		if (rc != 0)
-			continue;
+	info->found_dev = se_dev;
+	pr_debug("XCOPY 0xe4: located se_dev: %p\n", se_dev);
 
-		*found_dev = se_dev;
-		pr_debug("XCOPY 0xe4: located se_dev: %p\n", se_dev);
+	rc = target_depend_item(&se_dev->dev_group.cg_item);
+	if (rc != 0) {
+		pr_err("configfs_depend_item attempt failed: %d for se_dev: %p\n",
+		       rc, se_dev);
+		return rc;
+	}
 
-		rc = target_depend_item(&se_dev->dev_group.cg_item);
-		if (rc != 0) {
-			pr_err("configfs_depend_item attempt failed:"
-				" %d for se_dev: %p\n", rc, se_dev);
-			mutex_unlock(&g_device_mutex);
-			return rc;
-		}
+	pr_debug("Called configfs_depend_item for se_dev: %p se_dev->se_dev_group: %p\n",
+		 se_dev, &se_dev->dev_group);
+	return 1;
+}
+
+static int target_xcopy_locate_se_dev_e4(const unsigned char *dev_wwn,
+					struct se_device **found_dev)
+{
+	struct xcopy_dev_search_info info;
+	int ret;
 
-		pr_debug("Called configfs_depend_item for se_dev: %p"
-			" se_dev->se_dev_group: %p\n", se_dev,
-			&se_dev->dev_group);
+	memset(&info, 0, sizeof(info));
+	info.dev_wwn = dev_wwn;
 
-		mutex_unlock(&g_device_mutex);
+	ret = target_for_each_device(target_xcopy_locate_se_dev_e4_iter, &info);
+	if (ret == 1) {
+		*found_dev = info.found_dev;
 		return 0;
+	} else {
+		pr_debug_ratelimited("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n");
+		return -EINVAL;
 	}
-	mutex_unlock(&g_device_mutex);
-
-	pr_debug_ratelimited("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n");
-	return -EINVAL;
 }
 
 static int target_xcopy_parse_tiddesc_e4(struct se_cmd *se_cmd, struct xcopy_op *xop,

From e71045cc9da592c9cb8f4dd268794394dde56bbb Mon Sep 17 00:00:00 2001
From: David Disseldorp <ddiss@suse.de>
Date: Tue, 3 Nov 2020 02:21:58 +0100
Subject: [PATCH 1345/2658] scsi: target: Fix XCOPY NAA identifier lookup

[ Upstream commit 2896c93811e39d63a4d9b63ccf12a8fbc226e5e4 ]

When attempting to match EXTENDED COPY CSCD descriptors with corresponding
se_devices, target_xcopy_locate_se_dev_e4() currently iterates over LIO's
global devices list which includes all configured backstores.

This change ensures that only initiator-accessible backstores are
considered during CSCD descriptor lookup, according to the session's
se_node_acl LUN list.

To avoid LUN removal race conditions, device pinning is changed from being
configfs based to instead using the se_node_acl lun_ref.

Reference: CVE-2020-28374
Fixes: cbf031f425fd ("target: Add support for EXTENDED_COPY copy offload emulation")
Reviewed-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: David Disseldorp <ddiss@suse.de>
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/target/target_core_xcopy.c | 119 +++++++++++++++++------------
 drivers/target/target_core_xcopy.h |   1 +
 2 files changed, 71 insertions(+), 49 deletions(-)

diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
index b0e8f432c720..958737512229 100644
--- a/drivers/target/target_core_xcopy.c
+++ b/drivers/target/target_core_xcopy.c
@@ -52,60 +52,83 @@ static int target_xcopy_gen_naa_ieee(struct se_device *dev, unsigned char *buf)
 	return 0;
 }
 
-struct xcopy_dev_search_info {
-	const unsigned char *dev_wwn;
-	struct se_device *found_dev;
-};
-
+/**
+ * target_xcopy_locate_se_dev_e4_iter - compare XCOPY NAA device identifiers
+ *
+ * @se_dev: device being considered for match
+ * @dev_wwn: XCOPY requested NAA dev_wwn
+ * @return: 1 on match, 0 on no-match
+ */
 static int target_xcopy_locate_se_dev_e4_iter(struct se_device *se_dev,
-					      void *data)
+					      const unsigned char *dev_wwn)
 {
-	struct xcopy_dev_search_info *info = data;
 	unsigned char tmp_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
 	int rc;
 
-	if (!se_dev->dev_attrib.emulate_3pc)
+	if (!se_dev->dev_attrib.emulate_3pc) {
+		pr_debug("XCOPY: emulate_3pc disabled on se_dev %p\n", se_dev);
 		return 0;
+	}
 
 	memset(&tmp_dev_wwn[0], 0, XCOPY_NAA_IEEE_REGEX_LEN);
 	target_xcopy_gen_naa_ieee(se_dev, &tmp_dev_wwn[0]);
 
-	rc = memcmp(&tmp_dev_wwn[0], info->dev_wwn, XCOPY_NAA_IEEE_REGEX_LEN);
-	if (rc != 0)
-		return 0;
-
-	info->found_dev = se_dev;
-	pr_debug("XCOPY 0xe4: located se_dev: %p\n", se_dev);
-
-	rc = target_depend_item(&se_dev->dev_group.cg_item);
+	rc = memcmp(&tmp_dev_wwn[0], dev_wwn, XCOPY_NAA_IEEE_REGEX_LEN);
 	if (rc != 0) {
-		pr_err("configfs_depend_item attempt failed: %d for se_dev: %p\n",
-		       rc, se_dev);
-		return rc;
+		pr_debug("XCOPY: skip non-matching: %*ph\n",
+			 XCOPY_NAA_IEEE_REGEX_LEN, tmp_dev_wwn);
+		return 0;
 	}
+	pr_debug("XCOPY 0xe4: located se_dev: %p\n", se_dev);
 
-	pr_debug("Called configfs_depend_item for se_dev: %p se_dev->se_dev_group: %p\n",
-		 se_dev, &se_dev->dev_group);
 	return 1;
 }
 
-static int target_xcopy_locate_se_dev_e4(const unsigned char *dev_wwn,
-					struct se_device **found_dev)
+static int target_xcopy_locate_se_dev_e4(struct se_session *sess,
+					const unsigned char *dev_wwn,
+					struct se_device **_found_dev,
+					struct percpu_ref **_found_lun_ref)
 {
-	struct xcopy_dev_search_info info;
-	int ret;
-
-	memset(&info, 0, sizeof(info));
-	info.dev_wwn = dev_wwn;
-
-	ret = target_for_each_device(target_xcopy_locate_se_dev_e4_iter, &info);
-	if (ret == 1) {
-		*found_dev = info.found_dev;
-		return 0;
-	} else {
-		pr_debug_ratelimited("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n");
-		return -EINVAL;
+	struct se_dev_entry *deve;
+	struct se_node_acl *nacl;
+	struct se_lun *this_lun = NULL;
+	struct se_device *found_dev = NULL;
+
+	/* cmd with NULL sess indicates no associated $FABRIC_MOD */
+	if (!sess)
+		goto err_out;
+
+	pr_debug("XCOPY 0xe4: searching for: %*ph\n",
+		 XCOPY_NAA_IEEE_REGEX_LEN, dev_wwn);
+
+	nacl = sess->se_node_acl;
+	rcu_read_lock();
+	hlist_for_each_entry_rcu(deve, &nacl->lun_entry_hlist, link) {
+		struct se_device *this_dev;
+		int rc;
+
+		this_lun = rcu_dereference(deve->se_lun);
+		this_dev = rcu_dereference_raw(this_lun->lun_se_dev);
+
+		rc = target_xcopy_locate_se_dev_e4_iter(this_dev, dev_wwn);
+		if (rc) {
+			if (percpu_ref_tryget_live(&this_lun->lun_ref))
+				found_dev = this_dev;
+			break;
+		}
 	}
+	rcu_read_unlock();
+	if (found_dev == NULL)
+		goto err_out;
+
+	pr_debug("lun_ref held for se_dev: %p se_dev->se_dev_group: %p\n",
+		 found_dev, &found_dev->dev_group);
+	*_found_dev = found_dev;
+	*_found_lun_ref = &this_lun->lun_ref;
+	return 0;
+err_out:
+	pr_debug_ratelimited("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n");
+	return -EINVAL;
 }
 
 static int target_xcopy_parse_tiddesc_e4(struct se_cmd *se_cmd, struct xcopy_op *xop,
@@ -248,12 +271,16 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
 
 	switch (xop->op_origin) {
 	case XCOL_SOURCE_RECV_OP:
-		rc = target_xcopy_locate_se_dev_e4(xop->dst_tid_wwn,
-						&xop->dst_dev);
+		rc = target_xcopy_locate_se_dev_e4(se_cmd->se_sess,
+						xop->dst_tid_wwn,
+						&xop->dst_dev,
+						&xop->remote_lun_ref);
 		break;
 	case XCOL_DEST_RECV_OP:
-		rc = target_xcopy_locate_se_dev_e4(xop->src_tid_wwn,
-						&xop->src_dev);
+		rc = target_xcopy_locate_se_dev_e4(se_cmd->se_sess,
+						xop->src_tid_wwn,
+						&xop->src_dev,
+						&xop->remote_lun_ref);
 		break;
 	default:
 		pr_err("XCOPY CSCD descriptor IDs not found in CSCD list - "
@@ -397,18 +424,12 @@ static int xcopy_pt_get_cmd_state(struct se_cmd *se_cmd)
 
 static void xcopy_pt_undepend_remotedev(struct xcopy_op *xop)
 {
-	struct se_device *remote_dev;
-
 	if (xop->op_origin == XCOL_SOURCE_RECV_OP)
-		remote_dev = xop->dst_dev;
+		pr_debug("putting dst lun_ref for %p\n", xop->dst_dev);
 	else
-		remote_dev = xop->src_dev;
-
-	pr_debug("Calling configfs_undepend_item for"
-		  " remote_dev: %p remote_dev->dev_group: %p\n",
-		  remote_dev, &remote_dev->dev_group.cg_item);
+		pr_debug("putting src lun_ref for %p\n", xop->src_dev);
 
-	target_undepend_item(&remote_dev->dev_group.cg_item);
+	percpu_ref_put(xop->remote_lun_ref);
 }
 
 static void xcopy_pt_release_cmd(struct se_cmd *se_cmd)
diff --git a/drivers/target/target_core_xcopy.h b/drivers/target/target_core_xcopy.h
index 700a981c7b41..7db8d0c9223f 100644
--- a/drivers/target/target_core_xcopy.h
+++ b/drivers/target/target_core_xcopy.h
@@ -19,6 +19,7 @@ struct xcopy_op {
 	struct se_device *dst_dev;
 	unsigned char dst_tid_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
 	unsigned char local_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
+	struct percpu_ref *remote_lun_ref;
 
 	sector_t src_lba;
 	sector_t dst_lba;

From f0e2c7d52659a8a9cebed9343a8b854592ce5ccd Mon Sep 17 00:00:00 2001
From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Date: Wed, 13 Jan 2021 07:12:43 +0000
Subject: [PATCH 1346/2658] powerpc: Fix incorrect stw{, ux, u, x} instructions
 in __set_pte_at

[ Upstream commit d85be8a49e733dcd23674aa6202870d54bf5600d ]

The placeholder for instruction selection should use the second
argument's operand, which is %1, not %0. This could generate incorrect
assembly code if the memory addressing of operand %0 is a different
form from that of operand %1.

Also remove the %Un placeholder because having %Un placeholders
for two operands which are based on the same local var (ptep) doesn't
make much sense. By the way, it doesn't change the current behaviour
because "<>" constraint is missing for the associated "=m".

[chleroy: revised commit log iaw segher's comments and removed %U0]

Fixes: 9bf2b5cdc5fe ("powerpc: Fixes for CONFIG_PTE_64BIT for SMP support")
Cc: <stable@vger.kernel.org> # v2.6.28+
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Acked-by: Segher Boessenkool <segher@kernel.crashing.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/96354bd77977a6a933fe9020da57629007fdb920.1603358942.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/pgtable.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
index b64b4212b71f..408f9e1fa24a 100644
--- a/arch/powerpc/include/asm/pgtable.h
+++ b/arch/powerpc/include/asm/pgtable.h
@@ -149,9 +149,9 @@ static inline void __set_pte_at(struct mm_struct *mm, unsigned long addr,
 		flush_hash_entry(mm, ptep, addr);
 #endif
 	__asm__ __volatile__("\
-		stw%U0%X0 %2,%0\n\
+		stw%X0 %2,%0\n\
 		eieio\n\
-		stw%U0%X0 %L2,%1"
+		stw%X1 %L2,%1"
 	: "=m" (*ptep), "=m" (*((unsigned char *)ptep+4))
 	: "r" (pte) : "memory");
 

From cc91ad1ed13fdc79b84d847a473d225c205e8ab3 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Wed, 6 Jan 2021 00:15:23 +0100
Subject: [PATCH 1347/2658] net: ip: always refragment ip defragmented packets

[ Upstream commit bb4cc1a18856a73f0ff5137df0c2a31f4c50f6cf ]

Conntrack reassembly records the largest fragment size seen in IPCB.
However, when this gets forwarded/transmitted, fragmentation will only
be forced if one of the fragmented packets had the DF bit set.

In that case, a flag in IPCB will force fragmentation even if the
MTU is large enough.

This should work fine, but this breaks with ip tunnels.
Consider client that sends a UDP datagram of size X to another host.

The client fragments the datagram, so two packets, of size y and z, are
sent. DF bit is not set on any of these packets.

Middlebox netfilter reassembles those packets back to single size-X
packet, before routing decision.

packet-size-vs-mtu checks in ip_forward are irrelevant, because DF bit
isn't set.  At output time, ip refragmentation is skipped as well
because x is still smaller than the mtu of the output device.

If ttransmit device is an ip tunnel, the packet size increases to
x+overhead.

Also, tunnel might be configured to force DF bit on outer header.

In this case, packet will be dropped (exceeds MTU) and an ICMP error is
generated back to sender.

But sender already respects the announced MTU, all the packets that
it sent did fit the announced mtu.

Force refragmentation as per original sizes unconditionally so ip tunnel
will encapsulate the fragments instead.

The only other solution I see is to place ip refragmentation in
the ip_tunnel code to handle this case.

Fixes: d6b915e29f4ad ("ip_fragment: don't forward defragmented DF packet")
Reported-by: Christian Perle <christian.perle@secunet.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/ip_output.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 0750126f3b7d..411badb5bbb5 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -283,7 +283,7 @@ static int ip_finish_output(struct net *net, struct sock *sk, struct sk_buff *sk
 	if (skb_is_gso(skb))
 		return ip_finish_output_gso(net, sk, skb, mtu);
 
-	if (skb->len > mtu || (IPCB(skb)->flags & IPSKB_FRAG_PMTU))
+	if (skb->len > mtu || IPCB(skb)->frag_max_size)
 		return ip_fragment(net, sk, skb, mtu, ip_finish_output2);
 
 	return ip_finish_output2(net, sk, skb);

From 28f7692087fa1a11594a4410a44831766b0cb2d9 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Wed, 6 Jan 2021 00:15:22 +0100
Subject: [PATCH 1348/2658] net: fix pmtu check in nopmtudisc mode

[ Upstream commit 50c661670f6a3908c273503dfa206dfc7aa54c07 ]

For some reason ip_tunnel insist on setting the DF bit anyway when the
inner header has the DF bit set, EVEN if the tunnel was configured with
'nopmtudisc'.

This means that the script added in the previous commit
cannot be made to work by adding the 'nopmtudisc' flag to the
ip tunnel configuration. Doing so breaks connectivity even for the
without-conntrack/netfilter scenario.

When nopmtudisc is set, the tunnel will skip the mtu check, so no
icmp error is sent to client. Then, because inner header has DF set,
the outer header gets added with DF bit set as well.

IP stack then sends an error to itself because the packet exceeds
the device MTU.

Fixes: 23a3647bc4f93 ("ip_tunnels: Use skb-len to PMTU check.")
Cc: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/ip_tunnel.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 3d9761516683..dc92780f9e8c 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -708,7 +708,11 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
 		goto tx_error;
 	}
 
-	if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off, inner_iph)) {
+	df = tnl_params->frag_off;
+	if (skb->protocol == htons(ETH_P_IP))
+		df |= (inner_iph->frag_off & htons(IP_DF));
+
+	if (tnl_update_pmtu(dev, skb, rt, df, inner_iph)) {
 		ip_rt_put(rt);
 		goto tx_error;
 	}
@@ -736,10 +740,6 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
 			ttl = ip4_dst_hoplimit(&rt->dst);
 	}
 
-	df = tnl_params->frag_off;
-	if (skb->protocol == htons(ETH_P_IP))
-		df |= (inner_iph->frag_off&htons(IP_DF));
-
 	max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr)
 			+ rt->dst.header_len + ip_encap_hlen(&tunnel->encap);
 	if (max_headroom > dev->needed_headroom)

From d4a8f3f706d33eb1d2188858e1c05b5e1b98e2a7 Mon Sep 17 00:00:00 2001
From: Nick Desaulniers <ndesaulniers@google.com>
Date: Fri, 21 Aug 2020 12:42:47 -0700
Subject: [PATCH 1349/2658] vmlinux.lds.h: Add PGO and AutoFDO input sections
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit eff8728fe69880d3f7983bec3fb6cea4c306261f upstream.

Basically, consider .text.{hot|unlikely|unknown}.* part of .text, too.

When compiling with profiling information (collected via PGO
instrumentations or AutoFDO sampling), Clang will separate code into
.text.hot, .text.unlikely, or .text.unknown sections based on profiling
information. After D79600 (clang-11), these sections will have a
trailing `.` suffix, ie.  .text.hot., .text.unlikely., .text.unknown..

When using -ffunction-sections together with profiling infomation,
either explicitly (FGKASLR) or implicitly (LTO), code may be placed in
sections following the convention:
.text.hot.<foo>, .text.unlikely.<bar>, .text.unknown.<baz>
where <foo>, <bar>, and <baz> are functions.  (This produces one section
per function; we generally try to merge these all back via linker script
so that we don't have 50k sections).

For the above cases, we need to teach our linker scripts that such
sections might exist and that we'd explicitly like them grouped
together, otherwise we can wind up with code outside of the
_stext/_etext boundaries that might not be mapped properly for some
architectures, resulting in boot failures.

If the linker script is not told about possible input sections, then
where the section is placed as output is a heuristic-laiden mess that's
non-portable between linkers (ie. BFD and LLD), and has resulted in many
hard to debug bugs.  Kees Cook is working on cleaning this up by adding
--orphan-handling=warn linker flag used in ARCH=powerpc to additional
architectures. In the case of linker scripts, borrowing from the Zen of
Python: explicit is better than implicit.

Also, ld.bfd's internal linker script considers .text.hot AND
.text.hot.* to be part of .text, as well as .text.unlikely and
.text.unlikely.*. I didn't see support for .text.unknown.*, and didn't
see Clang producing such code in our kernel builds, but I see code in
LLVM that can produce such section names if profiling information is
missing. That may point to a larger issue with generating or collecting
profiles, but I would much rather be safe and explicit than have to
debug yet another issue related to orphan section placement.

Reported-by: Jian Cai <jiancai@google.com>
Suggested-by: Fāng-ruì Sòng <maskray@google.com>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Tested-by: Luis Lozano <llozano@google.com>
Tested-by: Manoj Gupta <manojgupta@google.com>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: linux-arch@vger.kernel.org
Cc: stable@vger.kernel.org
Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=add44f8d5c5c05e08b11e033127a744d61c26aee
Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=1de778ed23ce7492c523d5850c6c6dbb34152655
Link: https://reviews.llvm.org/D79600
Link: https://bugs.chromium.org/p/chromium/issues/detail?id=1084760
Link: https://lore.kernel.org/r/20200821194310.3089815-7-keescook@chromium.org

Debugged-by: Luis Lozano <llozano@google.com>
[nc: Fix conflicts around lack of TEXT_MAIN, NOINSTR_TEXT, and
     .text..refcount]
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/asm-generic/vmlinux.lds.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index e821bf27fc70..05fee19d5571 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -430,7 +430,10 @@
  * during second ld run in second ld pass when generating System.map */
 #define TEXT_TEXT							\
 		ALIGN_FUNCTION();					\
-		*(.text.hot .text .text.fixup .text.unlikely)		\
+		*(.text.hot .text.hot.*)				\
+		*(.text .text.fixup)					\
+		*(.text.unlikely .text.unlikely.*)			\
+		*(.text.unknown .text.unknown.*)			\
 		*(.ref.text)						\
 	MEM_KEEP(init.text)						\
 	MEM_KEEP(exit.text)						\

From d0132bdba14129859ed008f2c291cf166bc4c681 Mon Sep 17 00:00:00 2001
From: Richard Weinberger <richard@nod.at>
Date: Mon, 16 Nov 2020 22:05:30 +0100
Subject: [PATCH 1350/2658] ubifs: wbuf: Don't leak kernel memory to flash

commit 20f1431160c6b590cdc269a846fc5a448abf5b98 upstream

Write buffers use a kmalloc()'ed buffer, they can leak
up to seven bytes of kernel memory to flash if writes are not
aligned.
So use ubifs_pad() to fill these gaps with padding bytes.
This was never a problem while scanning because the scanner logic
manually aligns node lengths and skips over these gaps.

Cc: <stable@vger.kernel.org>
Fixes: 1e51764a3c2ac05a2 ("UBIFS: add new flash file system")
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ubifs/io.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
index 9213a9e046ae..99caaae01cab 100644
--- a/fs/ubifs/io.c
+++ b/fs/ubifs/io.c
@@ -331,7 +331,7 @@ void ubifs_pad(const struct ubifs_info *c, void *buf, int pad)
 {
 	uint32_t crc;
 
-	ubifs_assert(pad >= 0 && !(pad & 7));
+	ubifs_assert(pad >= 0);
 
 	if (pad >= UBIFS_PAD_NODE_SZ) {
 		struct ubifs_ch *ch = buf;
@@ -721,6 +721,10 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
 		 * write-buffer.
 		 */
 		memcpy(wbuf->buf + wbuf->used, buf, len);
+		if (aligned_len > len) {
+			ubifs_assert(aligned_len - len < 8);
+			ubifs_pad(c, wbuf->buf + wbuf->used + len, aligned_len - len);
+		}
 
 		if (aligned_len == wbuf->avail) {
 			dbg_io("flush jhead %s wbuf to LEB %d:%d",
@@ -813,13 +817,18 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
 	}
 
 	spin_lock(&wbuf->lock);
-	if (aligned_len)
+	if (aligned_len) {
 		/*
 		 * And now we have what's left and what does not take whole
 		 * max. write unit, so write it to the write-buffer and we are
 		 * done.
 		 */
 		memcpy(wbuf->buf, buf + written, len);
+		if (aligned_len > len) {
+			ubifs_assert(aligned_len - len < 8);
+			ubifs_pad(c, wbuf->buf + len, aligned_len - len);
+		}
+	}
 
 	if (c->leb_size - wbuf->offs >= c->max_write_size)
 		wbuf->size = c->max_write_size;

From 4989a3803dbce04fecb03993ab904587b03c47bf Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@wunner.de>
Date: Mon, 7 Dec 2020 09:17:05 +0100
Subject: [PATCH 1351/2658] spi: pxa2xx: Fix use-after-free on unbind

commit 5626308bb94d9f930aa5f7c77327df4c6daa7759 upstream

pxa2xx_spi_remove() accesses the driver's private data after calling
spi_unregister_controller() even though that function releases the last
reference on the spi_controller and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master/slave() helper
which keeps the private data accessible until the driver has unbound.

Fixes: 32e5b57232c0 ("spi: pxa2xx: Fix controller unregister order")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v2.6.17+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v2.6.17+: 32e5b57232c0: spi: pxa2xx: Fix controller unregister order
Cc: <stable@vger.kernel.org> # v2.6.17+
Link: https://lore.kernel.org/r/5764b04d4a6e43069ebb7808f64c2f774ac6f193.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi-pxa2xx.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index cfcc5a9a5cc9..d696cdd961a9 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -1479,7 +1479,7 @@ static int pxa2xx_spi_probe(struct platform_device *pdev)
 		return -ENODEV;
 	}
 
-	master = spi_alloc_master(dev, sizeof(struct driver_data));
+	master = devm_spi_alloc_master(dev, sizeof(*drv_data));
 	if (!master) {
 		dev_err(&pdev->dev, "cannot alloc spi_master\n");
 		pxa_ssp_free(ssp);
@@ -1619,7 +1619,6 @@ static int pxa2xx_spi_probe(struct platform_device *pdev)
 	free_irq(ssp->irq, drv_data);
 
 out_error_master_alloc:
-	spi_master_put(master);
 	pxa_ssp_free(ssp);
 	return status;
 }

From 80e55c68a978fbd374be00089e0f8b0be9849f10 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Tue, 5 Jan 2021 10:19:57 +0000
Subject: [PATCH 1352/2658] cpufreq: powernow-k8: pass policy rather than use
 cpufreq_cpu_get()

commit 943bdd0cecad06da8392a33093230e30e501eccc upstream.

Currently there is an unlikely case where cpufreq_cpu_get() returns a
NULL policy and this will cause a NULL pointer dereference later on.

Fix this by passing the policy to transition_frequency_fidvid() from
the caller and hence eliminating the need for the cpufreq_cpu_get()
and cpufreq_cpu_put().

Thanks to Viresh Kumar for suggesting the fix.

Addresses-Coverity: ("Dereference null return")
Fixes: b43a7ffbf33b ("cpufreq: Notify all policy->cpus in cpufreq_notify_transition()")
Suggested-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/cpufreq/powernow-k8.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
index 0b5bf135b090..59f16807921a 100644
--- a/drivers/cpufreq/powernow-k8.c
+++ b/drivers/cpufreq/powernow-k8.c
@@ -887,9 +887,9 @@ static int get_transition_latency(struct powernow_k8_data *data)
 
 /* Take a frequency, and issue the fid/vid transition command */
 static int transition_frequency_fidvid(struct powernow_k8_data *data,
-		unsigned int index)
+		unsigned int index,
+		struct cpufreq_policy *policy)
 {
-	struct cpufreq_policy *policy;
 	u32 fid = 0;
 	u32 vid = 0;
 	int res;
@@ -921,9 +921,6 @@ static int transition_frequency_fidvid(struct powernow_k8_data *data,
 	freqs.old = find_khz_freq_from_fid(data->currfid);
 	freqs.new = find_khz_freq_from_fid(fid);
 
-	policy = cpufreq_cpu_get(smp_processor_id());
-	cpufreq_cpu_put(policy);
-
 	cpufreq_freq_transition_begin(policy, &freqs);
 	res = transition_fid_vid(data, fid, vid);
 	cpufreq_freq_transition_end(policy, &freqs, res);
@@ -978,7 +975,7 @@ static long powernowk8_target_fn(void *arg)
 
 	powernow_k8_acpi_pst_values(data, newstate);
 
-	ret = transition_frequency_fidvid(data, newstate);
+	ret = transition_frequency_fidvid(data, newstate, pol);
 
 	if (ret) {
 		pr_err("transition frequency failed\n");

From 3fd9951a190c4285434eb082b97437ae4bba9880 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Sun, 3 Jan 2021 22:36:20 +0100
Subject: [PATCH 1353/2658] wil6210: select CONFIG_CRC32

commit e186620d7bf11b274b985b839c38266d7918cc05 upstream.

Without crc32, the driver fails to link:

arm-linux-gnueabi-ld: drivers/net/wireless/ath/wil6210/fw.o: in function `wil_fw_verify':
fw.c:(.text+0x74c): undefined reference to `crc32_le'
arm-linux-gnueabi-ld: drivers/net/wireless/ath/wil6210/fw.o:fw.c:(.text+0x758): more undefined references to `crc32_le' follow

Fixes: 151a9706503f ("wil6210: firmware download")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/wil6210/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/ath/wil6210/Kconfig b/drivers/net/wireless/ath/wil6210/Kconfig
index 0e66348e7513..28e5be8c7669 100644
--- a/drivers/net/wireless/ath/wil6210/Kconfig
+++ b/drivers/net/wireless/ath/wil6210/Kconfig
@@ -1,6 +1,7 @@
 config WIL6210
 	tristate "Wilocity 60g WiFi card wil6210 support"
 	select WANT_DEV_COREDUMP
+	select CRC32
 	depends on CFG80211
 	depends on PCI
 	default n

From 1a6da6a5ce3ce7b5d92861aef3dd23d595c5e5e6 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Sun, 3 Jan 2021 22:42:39 +0100
Subject: [PATCH 1354/2658] block: rsxx: select CONFIG_CRC32

commit 36a106a4c1c100d55ba3d32a21ef748cfcd4fa99 upstream.

Without crc32, the driver fails to link:

arm-linux-gnueabi-ld: drivers/block/rsxx/config.o: in function `rsxx_load_config':
config.c:(.text+0x124): undefined reference to `crc32_le'

Fixes: 8722ff8cdbfa ("block: IBM RamSan 70/80 device driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/block/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index 29819e719afa..c794e215ea3d 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -540,6 +540,7 @@ config BLK_DEV_RBD
 config BLK_DEV_RSXX
 	tristate "IBM Flash Adapter 900GB Full Height PCIe Device Driver"
 	depends on PCI
+	select CRC32
 	help
 	  Device driver for IBM's high speed PCIe SSD
 	  storage device: Flash Adapter 900GB Full Height.

From ed6f942e918c3a363ac67dca10e276fa2348d857 Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Tue, 5 Jan 2021 13:18:37 +0800
Subject: [PATCH 1355/2658] iommu/intel: Fix memleak in
 intel_irq_remapping_alloc

commit ff2b46d7cff80d27d82f7f3252711f4ca1666129 upstream.

When irq_domain_get_irq_data() or irqd_cfg() fails
at i == 0, data allocated by kzalloc() has not been
freed before returning, which leads to memleak.

Fixes: b106ee63abcc ("irq_remapping/vt-d: Enhance Intel IR driver to support hierarchical irqdomains")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Acked-by: Lu Baolu <baolu.lu@linux.intel.com>
Link: https://lore.kernel.org/r/20210105051837.32118-1-dinghao.liu@zju.edu.cn
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iommu/intel_irq_remapping.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
index ce125ec23d2a..88ba1a65c283 100644
--- a/drivers/iommu/intel_irq_remapping.c
+++ b/drivers/iommu/intel_irq_remapping.c
@@ -1350,6 +1350,8 @@ static int intel_irq_remapping_alloc(struct irq_domain *domain,
 		irq_data = irq_domain_get_irq_data(domain, virq + i);
 		irq_cfg = irqd_cfg(irq_data);
 		if (!irq_data || !irq_cfg) {
+			if (!i)
+				kfree(data);
 			ret = -EINVAL;
 			goto out_free_data;
 		}

From adf92d592b993c4b829af70c320e602f7dc56573 Mon Sep 17 00:00:00 2001
From: Ming Lei <ming.lei@redhat.com>
Date: Mon, 21 Dec 2020 12:33:35 +0800
Subject: [PATCH 1356/2658] block: fix use-after-free in disk_part_iter_next

commit aebf5db917055b38f4945ed6d621d9f07a44ff30 upstream.

Make sure that bdgrab() is done on the 'block_device' instance before
referring to it for avoiding use-after-free.

Cc: <stable@vger.kernel.org>
Reported-by: syzbot+825f0f9657d4e528046e@syzkaller.appspotmail.com
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 block/genhd.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/block/genhd.c b/block/genhd.c
index de2a6162e3f3..f0b10ebef7f4 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -158,14 +158,17 @@ struct hd_struct *disk_part_iter_next(struct disk_part_iter *piter)
 		part = rcu_dereference(ptbl->part[piter->idx]);
 		if (!part)
 			continue;
+		get_device(part_to_dev(part));
+		piter->part = part;
 		if (!part_nr_sects_read(part) &&
 		    !(piter->flags & DISK_PITER_INCL_EMPTY) &&
 		    !(piter->flags & DISK_PITER_INCL_EMPTY_PART0 &&
-		      piter->idx == 0))
+		      piter->idx == 0)) {
+			put_device(part_to_dev(part));
+			piter->part = NULL;
 			continue;
+		}
 
-		get_device(part_to_dev(part));
-		piter->part = part;
 		piter->idx += inc;
 		break;
 	}

From 2d050af2150a960dd7850b5e877bf9e9e63ba26a Mon Sep 17 00:00:00 2001
From: Vasily Averin <vvs@virtuozzo.com>
Date: Mon, 14 Dec 2020 22:07:39 +0300
Subject: [PATCH 1357/2658] net: drop bogus skb with CHECKSUM_PARTIAL and
 offset beyond end of trimmed packet

commit 54970a2fbb673f090b7f02d7f57b10b2e0707155 upstream.

syzbot reproduces BUG_ON in skb_checksum_help():
tun creates (bogus) skb with huge partial-checksummed area and
small ip packet inside. Then ip_rcv trims the skb based on size
of internal ip packet, after that csum offset points beyond of
trimmed skb. Then checksum_tg() called via netfilter hook
triggers BUG_ON:

        offset = skb_checksum_start_offset(skb);
        BUG_ON(offset >= skb_headlen(skb));

To work around the problem this patch forces pskb_trim_rcsum_slow()
to return -EINVAL in described scenario. It allows its callers to
drop such kind of packets.

Link: https://syzkaller.appspot.com/bug?id=b419a5ca95062664fe1a60b764621eb4526e2cd0
Reported-by: syzbot+7010af67ced6105e5ab6@syzkaller.appspotmail.com
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/r/1b2494af-2c56-8ee2-7bc0-923fcad1cdf8@virtuozzo.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/skbuff.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 7b8bd8562879..acc6b74dcd42 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1542,6 +1542,12 @@ int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len)
 		skb->csum = csum_block_sub(skb->csum,
 					   skb_checksum(skb, len, delta, 0),
 					   len);
+	} else if (skb->ip_summed == CHECKSUM_PARTIAL) {
+		int hdlen = (len > skb_headlen(skb)) ? skb_headlen(skb) : len;
+		int offset = skb_checksum_start_offset(skb) + skb->csum_offset;
+
+		if (offset + sizeof(__sum16) > hdlen)
+			return -EINVAL;
 	}
 	return __pskb_trim(skb, len);
 }

From 88d4bba7b79cc50a4b885fd0d49e6593106a6e55 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sun, 17 Jan 2021 13:55:14 +0100
Subject: [PATCH 1358/2658] Linux 4.4.252

Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Link: https://lore.kernel.org/r/20210115121955.112329537@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 82fde8e3e565..cd61cea78154 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 251
+SUBLEVEL = 252
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From c1d7f3f239b29beca6f10795257fd0701b71ee96 Mon Sep 17 00:00:00 2001
From: Thomas Hebb <tommyhebb@gmail.com>
Date: Sat, 12 Dec 2020 17:20:12 -0800
Subject: [PATCH 1359/2658] ASoC: dapm: remove widget from dirty list on free

commit 5c6679b5cb120f07652418524ab186ac47680b49 upstream.

A widget's "dirty" list_head, much like its "list" list_head, eventually
chains back to a list_head on the snd_soc_card itself. This means that
the list can stick around even after the widget (or all widgets) have
been freed. Currently, however, widgets that are in the dirty list when
freed remain there, corrupting the entire list and leading to memory
errors and undefined behavior when the list is next accessed or
modified.

I encountered this issue when a component failed to probe relatively
late in snd_soc_bind_card(), causing it to bail out and call
soc_cleanup_card_resources(), which eventually called
snd_soc_dapm_free() with widgets that were still dirty from when they'd
been added.

Fixes: db432b414e20 ("ASoC: Do DAPM power checks only for widgets changed since last run")
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/f8b5f031d50122bf1a9bfc9cae046badf4a7a31a.1607822410.git.tommyhebb@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/soc/soc-dapm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index eea6585925f3..c47962c12c16 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -2332,6 +2332,7 @@ void snd_soc_dapm_free_widget(struct snd_soc_dapm_widget *w)
 	enum snd_soc_dapm_direction dir;
 
 	list_del(&w->list);
+	list_del(&w->dirty);
 	/*
 	 * remove source and sink paths associated to this widget.
 	 * While removing the path, remove reference to it from both

From 1a4ddf190c6a38f4b3bb687337df2713310bb3a6 Mon Sep 17 00:00:00 2001
From: Miaohe Lin <linmiaohe@huawei.com>
Date: Tue, 12 Jan 2021 15:49:24 -0800
Subject: [PATCH 1360/2658] mm/hugetlb: fix potential missing huge page size
 info

commit 0eb98f1588c2cc7a79816d84ab18a55d254f481c upstream.

The huge page size is encoded for VM_FAULT_HWPOISON errors only.  So if
we return VM_FAULT_HWPOISON, huge page size would just be ignored.

Link: https://lkml.kernel.org/r/20210107123449.38481-1-linmiaohe@huawei.com
Fixes: aa50d3a7aa81 ("Encode huge page size for VM_FAULT_HWPOISON errors")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/hugetlb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 44970b17f4fe..7a2379223085 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3659,7 +3659,7 @@ static int hugetlb_no_page(struct mm_struct *mm, struct vm_area_struct *vma,
 		 * So we need to block hugepage fault by PG_hwpoison bit check.
 		 */
 		if (unlikely(PageHWPoison(page))) {
-			ret = VM_FAULT_HWPOISON |
+			ret = VM_FAULT_HWPOISON_LARGE |
 				VM_FAULT_SET_HINDEX(hstate_index(h));
 			goto backout_unlocked;
 		}

From b39a8fb95396d79e5c1b0bdabf8f1f35a7ebc65f Mon Sep 17 00:00:00 2001
From: yangerkun <yangerkun@huawei.com>
Date: Tue, 5 Jan 2021 14:28:57 +0800
Subject: [PATCH 1361/2658] ext4: fix bug for rename with RENAME_WHITEOUT

[ Upstream commit 6b4b8e6b4ad8553660421d6360678b3811d5deb9 ]

We got a "deleted inode referenced" warning cross our fsstress test. The
bug can be reproduced easily with following steps:

  cd /dev/shm
  mkdir test/
  fallocate -l 128M img
  mkfs.ext4 -b 1024 img
  mount img test/
  dd if=/dev/zero of=test/foo bs=1M count=128
  mkdir test/dir/ && cd test/dir/
  for ((i=0;i<1000;i++)); do touch file$i; done # consume all block
  cd ~ && renameat2(AT_FDCWD, /dev/shm/test/dir/file1, AT_FDCWD,
    /dev/shm/test/dir/dst_file, RENAME_WHITEOUT) # ext4_add_entry in
    ext4_rename will return ENOSPC!!
  cd /dev/shm/ && umount test/ && mount img test/ && ls -li test/dir/file1
  We will get the output:
  "ls: cannot access 'test/dir/file1': Structure needs cleaning"
  and the dmesg show:
  "EXT4-fs error (device loop0): ext4_lookup:1626: inode #2049: comm ls:
  deleted inode referenced: 139"

ext4_rename will create a special inode for whiteout and use this 'ino'
to replace the source file's dir entry 'ino'. Once error happens
latter(the error above was the ENOSPC return from ext4_add_entry in
ext4_rename since all space has been consumed), the cleanup do drop the
nlink for whiteout, but forget to restore 'ino' with source file. This
will trigger the bug describle as above.

Signed-off-by: yangerkun <yangerkun@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: stable@vger.kernel.org
Fixes: cd808deced43 ("ext4: support RENAME_WHITEOUT")
Link: https://lore.kernel.org/r/20210105062857.3566-1-yangerkun@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/namei.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index c8c104fb3fec..c261f5983713 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3368,8 +3368,6 @@ static int ext4_setent(handle_t *handle, struct ext4_renament *ent,
 			return retval;
 		}
 	}
-	brelse(ent->bh);
-	ent->bh = NULL;
 
 	return 0;
 }
@@ -3572,6 +3570,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
 		}
 	}
 
+	old_file_type = old.de->file_type;
 	if (IS_DIRSYNC(old.dir) || IS_DIRSYNC(new.dir))
 		ext4_handle_sync(handle);
 
@@ -3599,7 +3598,6 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
 	force_reread = (new.dir->i_ino == old.dir->i_ino &&
 			ext4_test_inode_flag(new.dir, EXT4_INODE_INLINE_DATA));
 
-	old_file_type = old.de->file_type;
 	if (whiteout) {
 		/*
 		 * Do this before adding a new entry, so the old entry is sure
@@ -3671,15 +3669,19 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
 	retval = 0;
 
 end_rename:
-	brelse(old.dir_bh);
-	brelse(old.bh);
-	brelse(new.bh);
 	if (whiteout) {
-		if (retval)
+		if (retval) {
+			ext4_setent(handle, &old,
+				old.inode->i_ino, old_file_type);
 			drop_nlink(whiteout);
+		}
 		unlock_new_inode(whiteout);
 		iput(whiteout);
+
 	}
+	brelse(old.dir_bh);
+	brelse(old.bh);
+	brelse(new.bh);
 	if (handle)
 		ext4_journal_stop(handle);
 	return retval;

From 9d93d8b4c1cebd4f481f34d0a0acbe55e947e7c4 Mon Sep 17 00:00:00 2001
From: Masahiro Yamada <masahiroy@kernel.org>
Date: Sun, 22 Nov 2020 04:36:54 +0900
Subject: [PATCH 1362/2658] ARC: build: add boot_targets to PHONY

[ Upstream commit 0cfccb3c04934cdef42ae26042139f16e805b5f7 ]

The top-level boot_targets (uImage and uImage.*) should be phony
targets. They just let Kbuild descend into arch/arc/boot/ and create
files there.

If a file exists in the top directory with the same name, the boot
image will not be created.

You can confirm it by the following steps:

  $ export CROSS_COMPILE=<your-arc-compiler-prefix>
  $ make -s ARCH=arc defconfig all   # vmlinux will be built
  $ touch uImage.gz
  $ make ARCH=arc uImage.gz
  CALL    scripts/atomic/check-atomics.sh
  CALL    scripts/checksyscalls.sh
  CHK     include/generated/compile.h
  # arch/arc/boot/uImage.gz is not created

Specify the targets as PHONY to fix this.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arc/Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index 8f8d53f08141..150656503c11 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -108,6 +108,7 @@ bootpImage: vmlinux
 
 boot_targets += uImage uImage.bin uImage.gz
 
+PHONY += $(boot_targets)
 $(boot_targets): vmlinux
 	$(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
 

From 9c141273c65fbde9403ccce491702b606c449426 Mon Sep 17 00:00:00 2001
From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Date: Fri, 18 Dec 2020 11:55:37 +0100
Subject: [PATCH 1363/2658] ethernet: ucc_geth: fix definition and size of
 ucc_geth_tx_global_pram

[ Upstream commit 887078de2a23689e29d6fa1b75d7cbc544c280be ]

Table 8-53 in the QUICC Engine Reference manual shows definitions of
fields up to a size of 192 bytes, not just 128. But in table 8-111,
one does find the text

  Base Address of the Global Transmitter Parameter RAM Page. [...]
  The user needs to allocate 128 bytes for this page. The address must
  be aligned to the page size.

I've checked both rev. 7 (11/2015) and rev. 9 (05/2018) of the manual;
they both have this inconsistency (and the table numbers are the
same).

Adding a bit of debug printing, on my board the struct
ucc_geth_tx_global_pram is allocated at offset 0x880, while
the (opaque) ucc_geth_thread_data_tx gets allocated immediately
afterwards, at 0x900. So whatever the engine writes into the thread
data overlaps with the tail of the global tx pram (and devmem says
that something does get written during a simple ping).

I haven't observed any failure that could be attributed to this, but
it seems to be the kind of thing that would be extremely hard to
debug. So extend the struct definition so that we do allocate 192
bytes.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/ucc_geth.h | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/freescale/ucc_geth.h b/drivers/net/ethernet/freescale/ucc_geth.h
index 75f337163ce3..1a40a5f11081 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.h
+++ b/drivers/net/ethernet/freescale/ucc_geth.h
@@ -580,7 +580,14 @@ struct ucc_geth_tx_global_pram {
 	u32 vtagtable[0x8];	/* 8 4-byte VLAN tags */
 	u32 tqptr;		/* a base pointer to the Tx Queues Memory
 				   Region */
-	u8 res2[0x80 - 0x74];
+	u8 res2[0x78 - 0x74];
+	u64 snums_en;
+	u32 l2l3baseptr;	/* top byte consists of a few other bit fields */
+
+	u16 mtu[8];
+	u8 res3[0xa8 - 0x94];
+	u32 wrrtablebase;	/* top byte is reserved */
+	u8 res4[0xc0 - 0xac];
 } __packed;
 
 /* structure representing Extended Filtering Global Parameters in PRAM */

From e40a1e5209f4c835b4c921a4c9afd52f42b254fd Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Mon, 4 Jan 2021 19:44:53 -0800
Subject: [PATCH 1364/2658] arch/arc: add copy_user_page() to <asm/page.h> to
 fix build error on ARC

[ Upstream commit 8a48c0a3360bf2bf4f40c980d0ec216e770e58ee ]

fs/dax.c uses copy_user_page() but ARC does not provide that interface,
resulting in a build error.

Provide copy_user_page() in <asm/page.h>.

../fs/dax.c: In function 'copy_cow_page_dax':
../fs/dax.c:702:2: error: implicit declaration of function 'copy_user_page'; did you mean 'copy_to_user_page'? [-Werror=implicit-function-declaration]

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Vineet Gupta <vgupta@synopsys.com>
Cc: linux-snps-arc@lists.infradead.org
Cc: Dan Williams <dan.j.williams@intel.com>
#Acked-by: Vineet Gupta <vgupta@synopsys.com> # v1
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Jan Kara <jack@suse.cz>
Cc: linux-fsdevel@vger.kernel.org
Cc: linux-nvdimm@lists.01.org
#Reviewed-by: Ira Weiny <ira.weiny@intel.com> # v2
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arc/include/asm/page.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arc/include/asm/page.h b/arch/arc/include/asm/page.h
index 8f1145ed0046..fd2c88ef2e2b 100644
--- a/arch/arc/include/asm/page.h
+++ b/arch/arc/include/asm/page.h
@@ -17,6 +17,7 @@
 #define free_user_page(page, addr)	free_page(addr)
 
 #define clear_page(paddr)		memset((paddr), 0, PAGE_SIZE)
+#define copy_user_page(to, from, vaddr, pg)	copy_page(to, from)
 #define copy_page(to, from)		memcpy((to), (from), PAGE_SIZE)
 
 struct vm_area_struct;

From 22b389479f267014a25676b49c214a2015e0797e Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Sun, 3 Jan 2021 22:36:22 +0100
Subject: [PATCH 1365/2658] misdn: dsp: select CONFIG_BITREVERSE

[ Upstream commit 51049bd903a81307f751babe15a1df8d197884e8 ]

Without this, we run into a link error

arm-linux-gnueabi-ld: drivers/isdn/mISDN/dsp_audio.o: in function `dsp_audio_generate_law_tables':
(.text+0x30c): undefined reference to `byte_rev_table'
arm-linux-gnueabi-ld: drivers/isdn/mISDN/dsp_audio.o:(.text+0x5e4): more undefined references to `byte_rev_table' follow

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/isdn/mISDN/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/isdn/mISDN/Kconfig b/drivers/isdn/mISDN/Kconfig
index c0730d5c734d..fb61181a5c4f 100644
--- a/drivers/isdn/mISDN/Kconfig
+++ b/drivers/isdn/mISDN/Kconfig
@@ -12,6 +12,7 @@ if MISDN != n
 config MISDN_DSP
 	tristate "Digital Audio Processing of transparent data"
 	depends on MISDN
+	select BITREVERSE
 	help
 	  Enable support for digital audio processing capability.
 

From 013950fad83bc092177e9c78e040d1dfcf083d46 Mon Sep 17 00:00:00 2001
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Tue, 5 Jan 2021 20:15:15 +1100
Subject: [PATCH 1366/2658] net: ethernet: fs_enet: Add missing MODULE_LICENSE

[ Upstream commit 445c6198fe7be03b7d38e66fe8d4b3187bc251d4 ]

Since commit 1d6cd3929360 ("modpost: turn missing MODULE_LICENSE()
into error") the ppc32_allmodconfig build fails with:

  ERROR: modpost: missing MODULE_LICENSE() in drivers/net/ethernet/freescale/fs_enet/mii-fec.o
  ERROR: modpost: missing MODULE_LICENSE() in drivers/net/ethernet/freescale/fs_enet/mii-bitbang.o

Add the missing MODULE_LICENSEs to fix the build. Both files include a
copyright header indicating they are GPL v2.

Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c | 1 +
 drivers/net/ethernet/freescale/fs_enet/mii-fec.c     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c b/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c
index 68a428de0bc0..cfae74d8e659 100644
--- a/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c
+++ b/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c
@@ -231,3 +231,4 @@ static struct platform_driver fs_enet_bb_mdio_driver = {
 };
 
 module_platform_driver(fs_enet_bb_mdio_driver);
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/ethernet/freescale/fs_enet/mii-fec.c b/drivers/net/ethernet/freescale/fs_enet/mii-fec.c
index 2be383e6d258..3b6232a6a56d 100644
--- a/drivers/net/ethernet/freescale/fs_enet/mii-fec.c
+++ b/drivers/net/ethernet/freescale/fs_enet/mii-fec.c
@@ -232,3 +232,4 @@ static struct platform_driver fs_enet_fec_mdio_driver = {
 };
 
 module_platform_driver(fs_enet_fec_mdio_driver);
+MODULE_LICENSE("GPL");

From fd7e419ed57fa843cd5afaaf88e40dfd85336e4a Mon Sep 17 00:00:00 2001
From: Shawn Guo <shawn.guo@linaro.org>
Date: Thu, 31 Dec 2020 19:35:25 +0800
Subject: [PATCH 1367/2658] ACPI: scan: add stub acpi_create_platform_device()
 for !CONFIG_ACPI

[ Upstream commit ee61cfd955a64a58ed35cbcfc54068fcbd486945 ]

It adds a stub acpi_create_platform_device() for !CONFIG_ACPI build, so
that caller doesn't have to deal with !CONFIG_ACPI build issue.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/acpi.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 0bd0a9ad5455..719fb8b320fd 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -604,6 +604,13 @@ static inline int acpi_device_modalias(struct device *dev,
 	return -ENODEV;
 }
 
+static inline struct platform_device *
+acpi_create_platform_device(struct acpi_device *adev,
+			    struct property_entry *properties)
+{
+	return NULL;
+}
+
 static inline bool acpi_dma_supported(struct acpi_device *adev)
 {
 	return false;

From 8f5df017915718bb2c0763a88053f3af9223267d Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Wed, 30 Dec 2020 16:20:05 +0100
Subject: [PATCH 1368/2658] ARM: picoxcell: fix missing interrupt-parent
 properties

[ Upstream commit bac717171971176b78c72d15a8b6961764ab197f ]

dtc points out that the interrupts for some devices are not parsable:

picoxcell-pc3x2.dtsi:45.19-49.5: Warning (interrupts_property): /paxi/gem@30000: Missing interrupt-parent
picoxcell-pc3x2.dtsi:51.21-55.5: Warning (interrupts_property): /paxi/dmac@40000: Missing interrupt-parent
picoxcell-pc3x2.dtsi:57.21-61.5: Warning (interrupts_property): /paxi/dmac@50000: Missing interrupt-parent
picoxcell-pc3x2.dtsi:233.21-237.5: Warning (interrupts_property): /rwid-axi/axi2pico@c0000000: Missing interrupt-parent

There are two VIC instances, so it's not clear which one needs to be
used. I found the BSP sources that reference VIC0, so use that:

https://github.com/r1mikey/meta-picoxcell/blob/master/recipes-kernel/linux/linux-picochip-3.0/0001-picoxcell-support-for-Picochip-picoXcell-SoC.patch

Acked-by: Jamie Iles <jamie@jamieiles.com>
Link: https://lore.kernel.org/r/20201230152010.3914962-1-arnd@kernel.org'
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/picoxcell-pc3x2.dtsi | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/arm/boot/dts/picoxcell-pc3x2.dtsi b/arch/arm/boot/dts/picoxcell-pc3x2.dtsi
index 533919e96eae..f22a6b436317 100644
--- a/arch/arm/boot/dts/picoxcell-pc3x2.dtsi
+++ b/arch/arm/boot/dts/picoxcell-pc3x2.dtsi
@@ -54,18 +54,21 @@
 		emac: gem@30000 {
 			compatible = "cadence,gem";
 			reg = <0x30000 0x10000>;
+			interrupt-parent = <&vic0>;
 			interrupts = <31>;
 		};
 
 		dmac1: dmac@40000 {
 			compatible = "snps,dw-dmac";
 			reg = <0x40000 0x10000>;
+			interrupt-parent = <&vic0>;
 			interrupts = <25>;
 		};
 
 		dmac2: dmac@50000 {
 			compatible = "snps,dw-dmac";
 			reg = <0x50000 0x10000>;
+			interrupt-parent = <&vic0>;
 			interrupts = <26>;
 		};
 
@@ -243,6 +246,7 @@
 		axi2pico@c0000000 {
 			compatible = "picochip,axi2pico-pc3x2";
 			reg = <0xc0000000 0x10000>;
+			interrupt-parent = <&vic0>;
 			interrupts = <13 14 15 16 17 18 19 20 21>;
 		};
 	};

From 6b8f6abdb26ea1f7ae7733a6f102d3923669843e Mon Sep 17 00:00:00 2001
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: Fri, 1 Sep 2017 17:13:43 -0700
Subject: [PATCH 1369/2658] Input: uinput - avoid FF flush when destroying
 device
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit e8b95728f724797f958912fd9b765a695595d3a6 upstream.

Normally, when input device supporting force feedback effects is being
destroyed, we try to "flush" currently playing effects, so that the
physical device does not continue vibrating (or executing other effects).
Unfortunately this does not work well for uinput as flushing of the effects
deadlocks with the destroy action:

- if device is being destroyed because the file descriptor is being closed,
  then there is noone to even service FF requests;

- if device is being destroyed because userspace sent UI_DEV_DESTROY,
  while theoretically it could be possible to service FF requests,
  userspace is unlikely to do so (they'd need to make sure FF handling
  happens on a separate thread) even if kernel solves the issue with FF
  ioctls deadlocking with UI_DEV_DESTROY ioctl on udev->mutex.

To avoid lockups like the one below, let's install a custom input device
flush handler, and avoid trying to flush force feedback effects when we
destroying the device, and instead rely on uinput to shut off the device
properly.

NMI watchdog: Watchdog detected hard LOCKUP on cpu 3
...
 <<EOE>>  [<ffffffff817a0307>] _raw_spin_lock_irqsave+0x37/0x40
 [<ffffffff810e633d>] complete+0x1d/0x50
 [<ffffffffa00ba08c>] uinput_request_done+0x3c/0x40 [uinput]
 [<ffffffffa00ba587>] uinput_request_submit.part.7+0x47/0xb0 [uinput]
 [<ffffffffa00bb62b>] uinput_dev_erase_effect+0x5b/0x76 [uinput]
 [<ffffffff815d91ad>] erase_effect+0xad/0xf0
 [<ffffffff815d929d>] flush_effects+0x4d/0x90
 [<ffffffff815d4cc0>] input_flush_device+0x40/0x60
 [<ffffffff815daf1c>] evdev_cleanup+0xac/0xc0
 [<ffffffff815daf5b>] evdev_disconnect+0x2b/0x60
 [<ffffffff815d74ac>] __input_unregister_device+0xac/0x150
 [<ffffffff815d75f7>] input_unregister_device+0x47/0x70
 [<ffffffffa00bac45>] uinput_destroy_device+0xb5/0xc0 [uinput]
 [<ffffffffa00bb2de>] uinput_ioctl_handler.isra.9+0x65e/0x740 [uinput]
 [<ffffffff811231ab>] ? do_futex+0x12b/0xad0
 [<ffffffffa00bb3f8>] uinput_ioctl+0x18/0x20 [uinput]
 [<ffffffff81241248>] do_vfs_ioctl+0x298/0x480
 [<ffffffff81337553>] ? security_file_ioctl+0x43/0x60
 [<ffffffff812414a9>] SyS_ioctl+0x79/0x90
 [<ffffffff817a04ee>] entry_SYSCALL_64_fastpath+0x12/0x71

Reported-by: Rodrigo Rivas Costa <rodrigorivascosta@gmail.com>
Reported-by: Clément VUCHENER <clement.vuchener@gmail.com>
Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=193741
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/ff-core.c     | 13 ++++++++++---
 drivers/input/misc/uinput.c | 18 ++++++++++++++++++
 include/linux/input.h       |  1 +
 3 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/drivers/input/ff-core.c b/drivers/input/ff-core.c
index 8f2042432c85..66a46c84e28f 100644
--- a/drivers/input/ff-core.c
+++ b/drivers/input/ff-core.c
@@ -237,9 +237,15 @@ int input_ff_erase(struct input_dev *dev, int effect_id, struct file *file)
 EXPORT_SYMBOL_GPL(input_ff_erase);
 
 /*
- * flush_effects - erase all effects owned by a file handle
+ * input_ff_flush - erase all effects owned by a file handle
+ * @dev: input device to erase effect from
+ * @file: purported owner of the effects
+ *
+ * This function erases all force-feedback effects associated with
+ * the given owner from specified device. Note that @file may be %NULL,
+ * in which case all effects will be erased.
  */
-static int flush_effects(struct input_dev *dev, struct file *file)
+int input_ff_flush(struct input_dev *dev, struct file *file)
 {
 	struct ff_device *ff = dev->ff;
 	int i;
@@ -255,6 +261,7 @@ static int flush_effects(struct input_dev *dev, struct file *file)
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(input_ff_flush);
 
 /**
  * input_ff_event() - generic handler for force-feedback events
@@ -343,7 +350,7 @@ int input_ff_create(struct input_dev *dev, unsigned int max_effects)
 	mutex_init(&ff->mutex);
 
 	dev->ff = ff;
-	dev->flush = flush_effects;
+	dev->flush = input_ff_flush;
 	dev->event = input_ff_event;
 	__set_bit(EV_FF, dev->evbit);
 
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 7cffff22a1ca..c67a0113020c 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -230,6 +230,18 @@ static int uinput_dev_erase_effect(struct input_dev *dev, int effect_id)
 	return uinput_request_submit(udev, &request);
 }
 
+static int uinput_dev_flush(struct input_dev *dev, struct file *file)
+{
+	/*
+	 * If we are called with file == NULL that means we are tearing
+	 * down the device, and therefore we can not handle FF erase
+	 * requests: either we are handling UI_DEV_DESTROY (and holding
+	 * the udev->mutex), or the file descriptor is closed and there is
+	 * nobody on the other side anymore.
+	 */
+	return file ? input_ff_flush(dev, file) : 0;
+}
+
 static void uinput_destroy_device(struct uinput_device *udev)
 {
 	const char *name, *phys;
@@ -273,6 +285,12 @@ static int uinput_create_device(struct uinput_device *udev)
 		dev->ff->playback = uinput_dev_playback;
 		dev->ff->set_gain = uinput_dev_set_gain;
 		dev->ff->set_autocenter = uinput_dev_set_autocenter;
+		/*
+		 * The standard input_ff_flush() implementation does
+		 * not quite work for uinput as we can't reasonably
+		 * handle FF requests during device teardown.
+		 */
+		dev->flush = uinput_dev_flush;
 	}
 
 	error = input_register_device(udev->dev);
diff --git a/include/linux/input.h b/include/linux/input.h
index 1e967694e9a5..b365d7c31e58 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -529,6 +529,7 @@ int input_ff_event(struct input_dev *dev, unsigned int type, unsigned int code,
 
 int input_ff_upload(struct input_dev *dev, struct ff_effect *effect, struct file *file);
 int input_ff_erase(struct input_dev *dev, int effect_id, struct file *file);
+int input_ff_flush(struct input_dev *dev, struct file *file);
 
 int input_ff_create_memless(struct input_dev *dev, void *data,
 		int (*play_effect)(struct input_dev *, void *, struct ff_effect *));

From 1e05a9137bf8b56436d86d8b78742e443b51075a Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Tue, 5 Jan 2021 14:43:46 -0500
Subject: [PATCH 1370/2658] dump_common_audit_data(): fix racy accesses to
 ->d_name

commit d36a1dd9f77ae1e72da48f4123ed35627848507d upstream.

We are not guaranteed the locking environment that would prevent
dentry getting renamed right under us.  And it's possible for
old long name to be freed after rename, leading to UAF here.

Cc: stable@kernel.org # v2.6.2+
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 security/lsm_audit.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/security/lsm_audit.c b/security/lsm_audit.c
index d0b74c12d56d..24ea1eeee9cd 100644
--- a/security/lsm_audit.c
+++ b/security/lsm_audit.c
@@ -264,7 +264,9 @@ static void dump_common_audit_data(struct audit_buffer *ab,
 		struct inode *inode;
 
 		audit_log_format(ab, " name=");
+		spin_lock(&a->u.dentry->d_lock);
 		audit_log_untrustedstring(ab, a->u.dentry->d_name.name);
+		spin_unlock(&a->u.dentry->d_lock);
 
 		inode = d_backing_inode(a->u.dentry);
 		if (inode) {
@@ -282,8 +284,9 @@ static void dump_common_audit_data(struct audit_buffer *ab,
 		dentry = d_find_alias(inode);
 		if (dentry) {
 			audit_log_format(ab, " name=");
-			audit_log_untrustedstring(ab,
-					 dentry->d_name.name);
+			spin_lock(&dentry->d_lock);
+			audit_log_untrustedstring(ab, dentry->d_name.name);
+			spin_unlock(&dentry->d_lock);
 			dput(dentry);
 		}
 		audit_log_format(ab, " dev=");

From 8e42595b5c424847eec5e2cfb710f2c76da90789 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Sun, 10 Jan 2021 15:58:08 -0500
Subject: [PATCH 1371/2658] NFS: nfs_igrab_and_active must first reference the
 superblock

commit 896567ee7f17a8a736cda8a28cc987228410a2ac upstream.

Before referencing the inode, we must ensure that the superblock can be
referenced. Otherwise, we can end up with iput() calling superblock
operations that are no longer valid or accessible.

Fixes: ea7c38fef0b7 ("NFSv4: Ensure we reference the inode for return-on-close in delegreturn")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/internal.h | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 578350fd96e1..7eeab683a81f 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -534,12 +534,14 @@ extern int nfs41_walk_client_list(struct nfs_client *clp,
 
 static inline struct inode *nfs_igrab_and_active(struct inode *inode)
 {
-	inode = igrab(inode);
-	if (inode != NULL && !nfs_sb_active(inode->i_sb)) {
-		iput(inode);
-		inode = NULL;
+	struct super_block *sb = inode->i_sb;
+
+	if (sb && nfs_sb_active(sb)) {
+		if (igrab(inode))
+			return inode;
+		nfs_sb_deactive(sb);
 	}
-	return inode;
+	return NULL;
 }
 
 static inline void nfs_iput_and_deactive(struct inode *inode)

From 79a9a04ee79bcad8180b8db8e146b9503c8f7871 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Wed, 16 Dec 2020 11:18:43 +0100
Subject: [PATCH 1372/2658] ext4: fix superblock checksum failure when setting
 password salt

commit dfd56c2c0c0dbb11be939b804ddc8d5395ab3432 upstream.

When setting password salt in the superblock, we forget to recompute the
superblock checksum so it will not match until the next superblock
modification which recomputes the checksum. Fix it.

CC: Michael Halcrow <mhalcrow@google.com>
Reported-by: Andreas Dilger <adilger@dilger.ca>
Fixes: 9bd8212f981e ("ext4 crypto: add encryption policy and password salt support")
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20201216101844.22917-8-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/ioctl.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index aca311a57abd..0b8e9873dd31 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -677,7 +677,10 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 			err = ext4_journal_get_write_access(handle, sbi->s_sbh);
 			if (err)
 				goto pwsalt_err_journal;
+			lock_buffer(sbi->s_sbh);
 			generate_random_uuid(sbi->s_es->s_encrypt_pw_salt);
+			ext4_superblock_csum_set(sb);
+			unlock_buffer(sbi->s_sbh);
 			err = ext4_handle_dirty_metadata(handle, NULL,
 							 sbi->s_sbh);
 		pwsalt_err_journal:

From f51c75434d71113cec2bbf04488ab8d30065436c Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Sat, 26 Dec 2020 15:42:48 +0800
Subject: [PATCH 1373/2658] RDMA/usnic: Fix memleak in
 find_free_vf_and_create_qp_grp

commit a306aba9c8d869b1fdfc8ad9237f1ed718ea55e6 upstream.

If usnic_ib_qp_grp_create() fails at the first call, dev_list
will not be freed on error, which leads to memleak.

Fixes: e3cf00d0a87f ("IB/usnic: Add Cisco VIC low-level hardware driver")
Link: https://lore.kernel.org/r/20201226074248.2893-1-dinghao.liu@zju.edu.cn
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
index 8e18bfca5516..99d65f211b44 100644
--- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
@@ -180,6 +180,7 @@ find_free_vf_and_create_qp_grp(struct usnic_ib_dev *us_ibdev,
 
 		}
 		usnic_uiom_free_dev_list(dev_list);
+		dev_list = NULL;
 	}
 
 	if (!found) {
@@ -207,6 +208,8 @@ find_free_vf_and_create_qp_grp(struct usnic_ib_dev *us_ibdev,
 	spin_unlock(&vf->lock);
 	if (IS_ERR_OR_NULL(qp_grp)) {
 		usnic_err("Failed to allocate qp_grp\n");
+		if (usnic_ib_share_vf)
+			usnic_uiom_free_dev_list(dev_list);
 		return ERR_PTR(qp_grp ? PTR_ERR(qp_grp) : -ENOMEM);
 	}
 

From fd308cc5d4ee9cd33c1858303f23077a0ee8ab7e Mon Sep 17 00:00:00 2001
From: Jann Horn <jannh@google.com>
Date: Tue, 12 Jan 2021 15:49:04 -0800
Subject: [PATCH 1374/2658] mm, slub: consider rest of partial list if
 acquire_slab() fails

commit 8ff60eb052eeba95cfb3efe16b08c9199f8121cf upstream.

acquire_slab() fails if there is contention on the freelist of the page
(probably because some other CPU is concurrently freeing an object from
the page).  In that case, it might make sense to look for a different page
(since there might be more remote frees to the page from other CPUs, and
we don't want contention on struct page).

However, the current code accidentally stops looking at the partial list
completely in that case.  Especially on kernels without CONFIG_NUMA set,
this means that get_partial() fails and new_slab_objects() falls back to
new_slab(), allocating new pages.  This could lead to an unnecessary
increase in memory fragmentation.

Link: https://lkml.kernel.org/r/20201228130853.1871516-1-jannh@google.com
Fixes: 7ced37197196 ("slub: Acquire_slab() avoid loop")
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: David Rientjes <rientjes@google.com>
Acked-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/slub.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/slub.c b/mm/slub.c
index b80b74173782..03a345817225 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1791,7 +1791,7 @@ static void *get_partial_node(struct kmem_cache *s, struct kmem_cache_node *n,
 
 		t = acquire_slab(s, n, page, object == NULL, &objects);
 		if (!t)
-			break;
+			continue; /* cmpxchg raced */
 
 		available += objects;
 		if (!object) {

From d51d28ed97341c447db6820b807186d97dfa78b4 Mon Sep 17 00:00:00 2001
From: "j.nixdorf@avm.de" <j.nixdorf@avm.de>
Date: Tue, 5 Jan 2021 15:17:01 +0100
Subject: [PATCH 1375/2658] net: sunrpc: interpret the return value of
 kstrtou32 correctly

commit 86b53fbf08f48d353a86a06aef537e78e82ba721 upstream.

A return value of 0 means success. This is documented in lib/kstrtox.c.

This was found by trying to mount an NFS share from a link-local IPv6
address with the interface specified by its index:

  mount("[fe80::1%1]:/srv/nfs", "/mnt", "nfs", 0, "nolock,addr=fe80::1%1")

Before this commit this failed with EINVAL and also caused the following
message in dmesg:

  [...] NFS: bad IP address specified: addr=fe80::1%1

The syscall using the same address based on the interface name instead
of its index succeeds.

Credits for this patch go to my colleague Christian Speich, who traced
the origin of this bug to this line of code.

Signed-off-by: Johannes Nixdorf <j.nixdorf@avm.de>
Fixes: 00cfaa943ec3 ("replace strict_strto calls")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/addr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c
index 8391c2785550..7404f02702a1 100644
--- a/net/sunrpc/addr.c
+++ b/net/sunrpc/addr.c
@@ -184,7 +184,7 @@ static int rpc_parse_scope_id(struct net *net, const char *buf,
 			scope_id = dev->ifindex;
 			dev_put(dev);
 		} else {
-			if (kstrtou32(p, 10, &scope_id) == 0) {
+			if (kstrtou32(p, 10, &scope_id) != 0) {
 				kfree(p);
 				return 0;
 			}

From b65ea90ac04a0025390caf6b8036e366c89f66a1 Mon Sep 17 00:00:00 2001
From: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
Date: Fri, 11 Sep 2020 09:25:12 +1200
Subject: [PATCH 1376/2658] usb: ohci: Make distrust_firmware param default to
 false

commit c4005a8f65edc55fb1700dfc5c1c3dc58be80209 upstream.

The 'distrust_firmware' module parameter dates from 2004 and the USB
subsystem is a lot more mature and reliable now than it was then.
Alter the default to false now.

Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
Link: https://lore.kernel.org/r/20200910212512.16670-2-hamish.martin@alliedtelesis.co.nz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/ohci-hcd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index d34b15bf0f41..5137b1d5b312 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -99,7 +99,7 @@ static void io_watchdog_func(unsigned long _ohci);
 
 
 /* Some boards misreport power switching/overcurrent */
-static bool distrust_firmware = 1;
+static bool distrust_firmware;
 module_param (distrust_firmware, bool, 0);
 MODULE_PARM_DESC (distrust_firmware,
 	"true to distrust firmware power/overcurrent setup");

From 49454b44b8ae0ffcdfa6a0eb0ac37c6c3937a02f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nuno=20S=C3=A1?= <nuno.sa@analog.com>
Date: Thu, 12 Nov 2020 15:43:22 +0100
Subject: [PATCH 1377/2658] iio: buffer: Fix demux update
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 19ef7b70ca9487773c29b449adf0c70f540a0aab upstream

When updating the buffer demux, we will skip a scan element from the
device in the case `in_ind != out_ind` and we enter the while loop.
in_ind should only be refreshed with `find_next_bit()` in the end of the
loop.

Note, to cause problems we need a situation where we are skippig over
an element (channel not enabled) that happens to not have the same size
as the next element.   Whilst this is a possible situation we haven't
actually identified any cases in mainline where it happens as most drivers
have consistent channel storage sizes with the exception of the timestamp
which is the last element and hence never skipped over.

Fixes: 5ada4ea9be16 ("staging:iio: add demux optionally to path from device to buffer")
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20201112144323.28887-1-nuno.sa@analog.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/industrialio-buffer.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 864a61b05665..d3cdd742972f 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -1281,9 +1281,6 @@ static int iio_buffer_update_demux(struct iio_dev *indio_dev,
 				       indio_dev->masklength,
 				       in_ind + 1);
 		while (in_ind != out_ind) {
-			in_ind = find_next_bit(indio_dev->active_scan_mask,
-					       indio_dev->masklength,
-					       in_ind + 1);
 			ch = iio_find_channel_from_si(indio_dev, in_ind);
 			if (ch->scan_type.repeat > 1)
 				length = ch->scan_type.storagebits / 8 *
@@ -1292,6 +1289,9 @@ static int iio_buffer_update_demux(struct iio_dev *indio_dev,
 				length = ch->scan_type.storagebits / 8;
 			/* Make sure we are aligned */
 			in_loc = roundup(in_loc, length) + length;
+			in_ind = find_next_bit(indio_dev->active_scan_mask,
+					       indio_dev->masklength,
+					       in_ind + 1);
 		}
 		ch = iio_find_channel_from_si(indio_dev, in_ind);
 		if (ch->scan_type.repeat > 1)

From f3c7b0e0978fc9bffe57b17d9699b7af6ef67670 Mon Sep 17 00:00:00 2001
From: "J. Bruce Fields" <bfields@redhat.com>
Date: Mon, 11 Jan 2021 16:01:29 -0500
Subject: [PATCH 1378/2658] nfsd4: readdirplus shouldn't return parent of
 export

commit 51b2ee7d006a736a9126e8111d1f24e4fd0afaa6 upstream.

If you export a subdirectory of a filesystem, a READDIRPLUS on the root
of that export will return the filehandle of the parent with the ".."
entry.

The filehandle is optional, so let's just not return the filehandle for
".." if we're at the root of an export.

Note that once the client learns one filehandle outside of the export,
they can trivially access the rest of the export using further lookups.

However, it is also not very difficult to guess filehandles outside of
the export.  So exporting a subdirectory of a filesystem should
considered equivalent to providing access to the entire filesystem.  To
avoid confusion, we recommend only exporting entire filesystems.

Reported-by: Youjipeng <wangzhibei1999@gmail.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs3xdr.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index d4fa7fbc37dc..d6c443a874f2 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -821,9 +821,14 @@ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
 	if (isdotent(name, namlen)) {
 		if (namlen == 2) {
 			dchild = dget_parent(dparent);
-			/* filesystem root - cannot return filehandle for ".." */
+			/*
+			 * Don't return filehandle for ".." if we're at
+			 * the filesystem or export root:
+			 */
 			if (dchild == dparent)
 				goto out;
+			if (dparent == exp->ex_path.dentry)
+				goto out;
 		} else
 			dchild = dget(dparent);
 	} else

From 6f05b4bf2842c14ba047f3f4bb973f78a25a5eaf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jouni=20K=2E=20Sepp=C3=A4nen?= <jks@iki.fi>
Date: Tue, 5 Jan 2021 06:52:49 +0200
Subject: [PATCH 1379/2658] net: cdc_ncm: correct overhead in delayed_ndp_size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 7a68d725e4ea384977445e0bcaed3d7de83ab5b3 upstream.

Aligning to tx_ndp_modulus is not sufficient because the next align
call can be cdc_ncm_align_tail, which can add up to ctx->tx_modulus +
ctx->tx_remainder - 1 bytes. This used to lead to occasional crashes
on a Huawei 909s-120 LTE module as follows:

- the condition marked /* if there is a remaining skb [...] */ is true
  so the swaps happen
- skb_out is set from ctx->tx_curr_skb
- skb_out->len is exactly 0x3f52
- ctx->tx_curr_size is 0x4000 and delayed_ndp_size is 0xac
  (note that the sum of skb_out->len and delayed_ndp_size is 0x3ffe)
- the for loop over n is executed once
- the cdc_ncm_align_tail call marked /* align beginning of next frame */
  increases skb_out->len to 0x3f56 (the sum is now 0x4002)
- the condition marked /* check if we had enough room left [...] */ is
  false so we break out of the loop
- the condition marked /* If requested, put NDP at end of frame. */ is
  true so the NDP is written into skb_out
- now skb_out->len is 0x4002, so padding_count is minus two interpreted
  as an unsigned number, which is used as the length argument to memset,
  leading to a crash with various symptoms but usually including

> Call Trace:
>  <IRQ>
>  cdc_ncm_fill_tx_frame+0x83a/0x970 [cdc_ncm]
>  cdc_mbim_tx_fixup+0x1d9/0x240 [cdc_mbim]
>  usbnet_start_xmit+0x5d/0x720 [usbnet]

The cdc_ncm_align_tail call first aligns on a ctx->tx_modulus
boundary (adding at most ctx->tx_modulus-1 bytes), then adds
ctx->tx_remainder bytes. Alternatively, the next alignment call can
occur in cdc_ncm_ndp16 or cdc_ncm_ndp32, in which case at most
ctx->tx_ndp_modulus-1 bytes are added.

A similar problem has occurred before, and the code is nontrivial to
reason about, so add a guard before the crashing call. By that time it
is too late to prevent any memory corruption (we'll have written past
the end of the buffer already) but we can at least try to get a warning
written into an on-disk log by avoiding the hard crash caused by padding
past the buffer with a huge number of zeros.

Signed-off-by: Jouni K. Seppänen <jks@iki.fi>
Fixes: 4a0e3e989d66 ("cdc_ncm: Add support for moving NDP to end of NCM frame")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=209407
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
[jks@iki.fi: backport to 4.4.y, 4.9.y]
Signed-off-by: Jouni K. Seppänen <jks@iki.fi>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/cdc_ncm.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index e9f82b67c7ed..8de7797ea7e7 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1079,7 +1079,10 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
 	 * accordingly. Otherwise, we should check here.
 	 */
 	if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END)
-		delayed_ndp_size = ALIGN(ctx->max_ndp_size, ctx->tx_ndp_modulus);
+		delayed_ndp_size = ctx->max_ndp_size +
+			max_t(u32,
+			      ctx->tx_ndp_modulus,
+			      ctx->tx_modulus + ctx->tx_remainder) - 1;
 	else
 		delayed_ndp_size = 0;
 
@@ -1232,7 +1235,8 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
 	if (!(dev->driver_info->flags & FLAG_SEND_ZLP) &&
 	    skb_out->len > ctx->min_tx_pkt) {
 		padding_count = ctx->tx_max - skb_out->len;
-		memset(skb_put(skb_out, padding_count), 0, padding_count);
+		if (!WARN_ON(padding_count > ctx->tx_max))
+			memset(skb_put(skb_out, padding_count), 0, padding_count);
 	} else if (skb_out->len < ctx->tx_max &&
 		   (skb_out->len % dev->maxpacket) == 0) {
 		*skb_put(skb_out, 1) = 0;	/* force short packet */

From 5d03a7527f29cfbdb95666a60c911d6501216cb3 Mon Sep 17 00:00:00 2001
From: Manish Chopra <manishc@marvell.com>
Date: Thu, 7 Jan 2021 02:15:20 -0800
Subject: [PATCH 1380/2658] netxen_nic: fix MSI/MSI-x interrupts

[ Upstream commit a2bc221b972db91e4be1970e776e98f16aa87904 ]

For all PCI functions on the netxen_nic adapter, interrupt
mode (INTx or MSI) configuration is dependent on what has
been configured by the PCI function zero in the shared
interrupt register, as these adapters do not support mixed
mode interrupts among the functions of a given adapter.

Logic for setting MSI/MSI-x interrupt mode in the shared interrupt
register based on PCI function id zero check is not appropriate for
all family of netxen adapters, as for some of the netxen family
adapters PCI function zero is not really meant to be probed/loaded
in the host but rather just act as a management function on the device,
which caused all the other PCI functions on the adapter to always use
legacy interrupt (INTx) mode instead of choosing MSI/MSI-x interrupt mode.

This patch replaces that check with port number so that for all
type of adapters driver attempts for MSI/MSI-x interrupt modes.

Fixes: b37eb210c076 ("netxen_nic: Avoid mixed mode interrupts")
Signed-off-by: Manish Chopra <manishc@marvell.com>
Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
Link: https://lore.kernel.org/r/20210107101520.6735-1-manishc@marvell.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index 6409a06bbdf6..f5fc0c416e51 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -586,11 +586,6 @@ static const struct net_device_ops netxen_netdev_ops = {
 #endif
 };
 
-static inline bool netxen_function_zero(struct pci_dev *pdev)
-{
-	return (PCI_FUNC(pdev->devfn) == 0) ? true : false;
-}
-
 static inline void netxen_set_interrupt_mode(struct netxen_adapter *adapter,
 					     u32 mode)
 {
@@ -686,7 +681,7 @@ static int netxen_setup_intr(struct netxen_adapter *adapter)
 	netxen_initialize_interrupt_registers(adapter);
 	netxen_set_msix_bit(pdev, 0);
 
-	if (netxen_function_zero(pdev)) {
+	if (adapter->portnum == 0) {
 		if (!netxen_setup_msi_interrupts(adapter, num_msix))
 			netxen_set_interrupt_mode(adapter, NETXEN_MSI_MODE);
 		else

From 215d12785319c7d312344805734be0110e33def9 Mon Sep 17 00:00:00 2001
From: Andrey Zhizhikin <andrey.zhizhikin@leica-geosystems.com>
Date: Fri, 8 Jan 2021 09:58:39 +0000
Subject: [PATCH 1381/2658] rndis_host: set proper input size for
 OID_GEN_PHYSICAL_MEDIUM request

[ Upstream commit e56b3d94d939f52d46209b9e1b6700c5bfff3123 ]

MSFT ActiveSync implementation requires that the size of the response for
incoming query is to be provided in the request input length. Failure to
set the input size proper results in failed request transfer, where the
ActiveSync counterpart reports the NDIS_STATUS_INVALID_LENGTH (0xC0010014L)
error.

Set the input size for OID_GEN_PHYSICAL_MEDIUM query to the expected size
of the response in order for the ActiveSync to properly respond to the
request.

Fixes: 039ee17d1baa ("rndis_host: Add RNDIS physical medium checking into generic_rndis_bind()")
Signed-off-by: Andrey Zhizhikin <andrey.zhizhikin@leica-geosystems.com>
Link: https://lore.kernel.org/r/20210108095839.3335-1-andrey.zhizhikin@leica-geosystems.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/rndis_host.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index b20b380d91bf..2b57bd8f0d72 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -398,7 +398,7 @@ generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags)
 	reply_len = sizeof *phym;
 	retval = rndis_query(dev, intf, u.buf,
 			     RNDIS_OID_GEN_PHYSICAL_MEDIUM,
-			     0, (void **) &phym, &reply_len);
+			     reply_len, (void **)&phym, &reply_len);
 	if (retval != 0 || !phym) {
 		/* OID is optional so don't fail here. */
 		phym_unspec = cpu_to_le32(RNDIS_PHYSICAL_MEDIUM_UNSPECIFIED);

From 0be57ef40f3947c4c49dcc6c5228671abbf8e852 Mon Sep 17 00:00:00 2001
From: Petr Machata <me@pmachata.org>
Date: Tue, 22 Dec 2020 22:49:44 +0100
Subject: [PATCH 1382/2658] net: dcb: Validate netlink message in DCB handler

[ Upstream commit 826f328e2b7e8854dd42ea44e6519cd75018e7b1 ]

DCB uses the same handler function for both RTM_GETDCB and RTM_SETDCB
messages. dcb_doit() bounces RTM_SETDCB mesasges if the user does not have
the CAP_NET_ADMIN capability.

However, the operation to be performed is not decided from the DCB message
type, but from the DCB command. Thus DCB_CMD_*_GET commands are used for
reading DCB objects, the corresponding SET and DEL commands are used for
manipulation.

The assumption is that set-like commands will be sent via an RTM_SETDCB
message, and get-like ones via RTM_GETDCB. However, this assumption is not
enforced.

It is therefore possible to manipulate DCB objects without CAP_NET_ADMIN
capability by sending the corresponding command in an RTM_GETDCB message.
That is a bug. Fix it by validating the type of the request message against
the type used for the response.

Fixes: 2f90b8657ec9 ("ixgbe: this patch adds support for DCB to the kernel and ixgbe driver")
Signed-off-by: Petr Machata <me@pmachata.org>
Link: https://lore.kernel.org/r/a2a9b88418f3a58ef211b718f2970128ef9e3793.1608673640.git.me@pmachata.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/dcb/dcbnl.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index 6fe2b615518c..6a675fd36f9b 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -1725,6 +1725,8 @@ static int dcb_doit(struct sk_buff *skb, struct nlmsghdr *nlh)
 	fn = &reply_funcs[dcb->cmd];
 	if (!fn->cb)
 		return -EOPNOTSUPP;
+	if (fn->type != nlh->nlmsg_type)
+		return -EPERM;
 
 	if (!tb[DCB_ATTR_IFNAME])
 		return -EINVAL;

From 01086cec1b84bc37aba71bbec3ddc95495fc3d43 Mon Sep 17 00:00:00 2001
From: Petr Machata <petrm@nvidia.com>
Date: Mon, 11 Jan 2021 18:07:07 +0100
Subject: [PATCH 1383/2658] net: dcb: Accept RTM_GETDCB messages carrying
 set-like DCB commands

[ Upstream commit df85bc140a4d6cbaa78d8e9c35154e1a2f0622c7 ]

In commit 826f328e2b7e ("net: dcb: Validate netlink message in DCB
handler"), Linux started rejecting RTM_GETDCB netlink messages if they
contained a set-like DCB_CMD_ command.

The reason was that privileges were only verified for RTM_SETDCB messages,
but the value that determined the action to be taken is the command, not
the message type. And validation of message type against the DCB command
was the obvious missing piece.

Unfortunately it turns out that mlnx_qos, a somewhat widely deployed tool
for configuration of DCB, accesses the DCB set-like APIs through
RTM_GETDCB.

Therefore do not bounce the discrepancy between message type and command.
Instead, in addition to validating privileges based on the actual message
type, validate them also based on the expected message type. This closes
the loophole of allowing DCB configuration on non-admin accounts, while
maintaining backward compatibility.

Fixes: 2f90b8657ec9 ("ixgbe: this patch adds support for DCB to the kernel and ixgbe driver")
Fixes: 826f328e2b7e ("net: dcb: Validate netlink message in DCB handler")
Signed-off-by: Petr Machata <petrm@nvidia.com>
Link: https://lore.kernel.org/r/a3edcfda0825f2aa2591801c5232f2bbf2d8a554.1610384801.git.me@pmachata.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/dcb/dcbnl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index 6a675fd36f9b..426c30f9fdb0 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -1725,7 +1725,7 @@ static int dcb_doit(struct sk_buff *skb, struct nlmsghdr *nlh)
 	fn = &reply_funcs[dcb->cmd];
 	if (!fn->cb)
 		return -EOPNOTSUPP;
-	if (fn->type != nlh->nlmsg_type)
+	if (fn->type == RTM_SETDCB && !netlink_capable(skb, CAP_NET_ADMIN))
 		return -EPERM;
 
 	if (!tb[DCB_ATTR_IFNAME])

From c67d3b881ce4aa728da1bc9fae28a7ac1340dee0 Mon Sep 17 00:00:00 2001
From: Jakub Kicinski <kuba@kernel.org>
Date: Wed, 13 Jan 2021 17:29:47 -0800
Subject: [PATCH 1384/2658] net: sit: unregister_netdevice on newlink's error
 path

[ Upstream commit 47e4bb147a96f1c9b4e7691e7e994e53838bfff8 ]

We need to unregister the netdevice if config failed.
.ndo_uninit takes care of most of the heavy lifting.

This was uncovered by recent commit c269a24ce057 ("net: make
free_netdev() more lenient with unregistering devices").
Previously the partially-initialized device would be left
in the system.

Reported-and-tested-by: syzbot+2393580080a2da190f04@syzkaller.appspotmail.com
Fixes: e2f1f072db8d ("sit: allow to configure 6rd tunnels via netlink")
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Link: https://lore.kernel.org/r/20210114012947.2515313-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/sit.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 8bab7e64ffcf..1ee190137da4 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1584,8 +1584,11 @@ static int ipip6_newlink(struct net *src_net, struct net_device *dev,
 	}
 
 #ifdef CONFIG_IPV6_SIT_6RD
-	if (ipip6_netlink_6rd_parms(data, &ip6rd))
+	if (ipip6_netlink_6rd_parms(data, &ip6rd)) {
 		err = ipip6_tunnel_update_6rd(nt, &ip6rd);
+		if (err < 0)
+			unregister_netdevice_queue(dev, NULL);
+	}
 #endif
 
 	return err;

From 3ebd36793e335f651b937e82abd9de8581007241 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Tue, 12 Jan 2021 15:23:51 +0000
Subject: [PATCH 1385/2658] rxrpc: Fix handling of an unsupported token type in
 rxrpc_read()

[ Upstream commit d52e419ac8b50c8bef41b398ed13528e75d7ad48 ]

Clang static analysis reports the following:

net/rxrpc/key.c:657:11: warning: Assigned value is garbage or undefined
                toksize = toksizes[tok++];
                        ^ ~~~~~~~~~~~~~~~

rxrpc_read() contains two consecutive loops.  The first loop calculates the
token sizes and stores the results in toksizes[] and the second one uses
the array.  When there is an error in identifying the token in the first
loop, the token is skipped, no change is made to the toksizes[] array.
When the same error happens in the second loop, the token is not skipped.
This will cause the toksizes[] array to be out of step and will overrun
past the calculated sizes.

Fix this by making both loops log a message and return an error in this
case.  This should only happen if a new token type is incompletely
implemented, so it should normally be impossible to trigger this.

Fixes: 9a059cd5ca7d ("rxrpc: Downgrade the BUG() for unsupported token type in rxrpc_read()")
Reported-by: Tom Rix <trix@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Tom Rix <trix@redhat.com>
Link: https://lore.kernel.org/r/161046503122.2445787.16714129930607546635.stgit@warthog.procyon.org.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/rxrpc/ar-key.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c
index ea615e53eab2..f4ad63d6e540 100644
--- a/net/rxrpc/ar-key.c
+++ b/net/rxrpc/ar-key.c
@@ -1116,7 +1116,7 @@ static long rxrpc_read(const struct key *key,
 		default: /* we have a ticket we can't encode */
 			pr_err("Unsupported key token type (%u)\n",
 			       token->security_index);
-			continue;
+			return -ENOPKG;
 		}
 
 		_debug("token[%u]: toksize=%u", ntoks, toksize);
@@ -1236,7 +1236,9 @@ static long rxrpc_read(const struct key *key,
 			break;
 
 		default:
-			break;
+			pr_err("Unsupported key token type (%u)\n",
+			       token->security_index);
+			return -ENOPKG;
 		}
 
 		ASSERTCMP((unsigned long)xdr - (unsigned long)oldxdr, ==,

From ce6c2ce6fe260f664d6d59c3f8d70ac747c90b34 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 13 Jan 2021 08:18:19 -0800
Subject: [PATCH 1386/2658] net: avoid 32 x truesize under-estimation for tiny
 skbs

[ Upstream commit 3226b158e67cfaa677fd180152bfb28989cb2fac ]

Both virtio net and napi_get_frags() allocate skbs
with a very small skb->head

While using page fragments instead of a kmalloc backed skb->head might give
a small performance improvement in some cases, there is a huge risk of
under estimating memory usage.

For both GOOD_COPY_LEN and GRO_MAX_HEAD, we can fit at least 32 allocations
per page (order-3 page in x86), or even 64 on PowerPC

We have been tracking OOM issues on GKE hosts hitting tcp_mem limits
but consuming far more memory for TCP buffers than instructed in tcp_mem[2]

Even if we force napi_alloc_skb() to only use order-0 pages, the issue
would still be there on arches with PAGE_SIZE >= 32768

This patch makes sure that small skb head are kmalloc backed, so that
other objects in the slab page can be reused instead of being held as long
as skbs are sitting in socket queues.

Note that we might in the future use the sk_buff napi cache,
instead of going through a more expensive __alloc_skb()

Another idea would be to use separate page sizes depending
on the allocated length (to never have more than 4 frags per page)

I would like to thank Greg Thelen for his precious help on this matter,
analysing crash dumps is always a time consuming task.

Fixes: fd11a83dd363 ("net: Pull out core bits of __netdev_alloc_skb and add __napi_alloc_skb")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Greg Thelen <gthelen@google.com>
Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Link: https://lore.kernel.org/r/20210113161819.1155526-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/skbuff.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index acc6b74dcd42..f42391c41b23 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -506,13 +506,17 @@ EXPORT_SYMBOL(__netdev_alloc_skb);
 struct sk_buff *__napi_alloc_skb(struct napi_struct *napi, unsigned int len,
 				 gfp_t gfp_mask)
 {
-	struct page_frag_cache *nc = this_cpu_ptr(&napi_alloc_cache);
+	struct page_frag_cache *nc;
 	struct sk_buff *skb;
 	void *data;
 
 	len += NET_SKB_PAD + NET_IP_ALIGN;
 
-	if ((len > SKB_WITH_OVERHEAD(PAGE_SIZE)) ||
+	/* If requested length is either too small or too big,
+	 * we use kmalloc() for skb->head allocation.
+	 */
+	if (len <= SKB_WITH_OVERHEAD(1024) ||
+	    len > SKB_WITH_OVERHEAD(PAGE_SIZE) ||
 	    (gfp_mask & (__GFP_DIRECT_RECLAIM | GFP_DMA))) {
 		skb = __alloc_skb(len, gfp_mask, SKB_ALLOC_RX, NUMA_NO_NODE);
 		if (!skb)
@@ -520,6 +524,7 @@ struct sk_buff *__napi_alloc_skb(struct napi_struct *napi, unsigned int len,
 		goto skb_success;
 	}
 
+	nc = this_cpu_ptr(&napi_alloc_cache);
 	len += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
 	len = SKB_DATA_ALIGN(len);
 

From 22a2a97e9f0566884d8f6eb63a00bdb5b689a9aa Mon Sep 17 00:00:00 2001
From: Michael Hennerich <michael.hennerich@analog.com>
Date: Thu, 14 Jan 2021 17:42:17 +0200
Subject: [PATCH 1387/2658] spi: cadence: cache reference clock rate during
 probe

commit 4d163ad79b155c71bf30366dc38f8d2502f78844 upstream.

The issue is that using SPI from a callback under the CCF lock will
deadlock, since this code uses clk_get_rate().

Fixes: c474b38665463 ("spi: Add driver for Cadence SPI controller")
Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Link: https://lore.kernel.org/r/20210114154217.51996-1-alexandru.ardelean@analog.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi-cadence.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c
index 5a6749881ff9..05b5df04f3b8 100644
--- a/drivers/spi/spi-cadence.c
+++ b/drivers/spi/spi-cadence.c
@@ -116,6 +116,7 @@ struct cdns_spi {
 	void __iomem *regs;
 	struct clk *ref_clk;
 	struct clk *pclk;
+	unsigned int clk_rate;
 	u32 speed_hz;
 	const u8 *txbuf;
 	u8 *rxbuf;
@@ -257,7 +258,7 @@ static void cdns_spi_config_clock_freq(struct spi_device *spi,
 	u32 ctrl_reg, baud_rate_val;
 	unsigned long frequency;
 
-	frequency = clk_get_rate(xspi->ref_clk);
+	frequency = xspi->clk_rate;
 
 	ctrl_reg = cdns_spi_read(xspi, CDNS_SPI_CR_OFFSET);
 
@@ -557,8 +558,9 @@ static int cdns_spi_probe(struct platform_device *pdev)
 	master->set_cs = cdns_spi_chipselect;
 	master->mode_bits = SPI_CPOL | SPI_CPHA;
 
+	xspi->clk_rate = clk_get_rate(xspi->ref_clk);
 	/* Set to default valid value */
-	master->max_speed_hz = clk_get_rate(xspi->ref_clk) / 4;
+	master->max_speed_hz = xspi->clk_rate / 4;
 	xspi->speed_hz = master->max_speed_hz;
 
 	master->bits_per_word_mask = SPI_BPW_MASK(8);

From d9f6b5dc01891b0610a3e66ae7a47bcd6a91375b Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sat, 23 Jan 2021 15:36:57 +0100
Subject: [PATCH 1388/2658] Linux 4.4.253

Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20210122160822.198606273@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index cd61cea78154..c9c0274ccb66 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 252
+SUBLEVEL = 253
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 729434d21d0b76cc8295a8506626a08a860e80fe Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Fri, 15 Jan 2021 10:34:28 +0100
Subject: [PATCH 1389/2658] ALSA: seq: oss: Fix missing error check in
 snd_seq_oss_synth_make_info()

commit 217bfbb8b0bfa24619b11ab75c135fec99b99b20 upstream.

snd_seq_oss_synth_make_info() didn't check the error code from
snd_seq_oss_midi_make_info(), and this leads to the call of strlcpy()
with the uninitialized string as the source, which may lead to the
access over the limit.

Add the proper error check for avoiding the failure.

Reported-by: syzbot+e42504ff21cff05a595f@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210115093428.15882-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/seq/oss/seq_oss_synth.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c
index df5b984bb33f..48b3398e9e9d 100644
--- a/sound/core/seq/oss/seq_oss_synth.c
+++ b/sound/core/seq/oss/seq_oss_synth.c
@@ -624,7 +624,8 @@ snd_seq_oss_synth_make_info(struct seq_oss_devinfo *dp, int dev, struct synth_in
 
 	if (info->is_midi) {
 		struct midi_info minf;
-		snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf);
+		if (snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf))
+			return -ENXIO;
 		inf->synth_type = SYNTH_TYPE_MIDI;
 		inf->synth_subtype = 0;
 		inf->nr_voices = 16;

From 3c4159586384f547aa59d1e08573207015320adf Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Thu, 14 Jan 2021 08:24:53 +0100
Subject: [PATCH 1390/2658] ALSA: hda/via: Add minimum mute flag

commit 67ea698c3950d10925be33c21ca49ffb64e21842 upstream.

It turned out that VIA codecs also mute the sound in the lowest mixer
level.  Turn on the dac_min_mute flag to indicate the mute-as-minimum
in TLV like already done in Conexant and IDT codecs.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=210559
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210114072453.11379-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_via.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
index fc30d1e8aa76..9dd104c308e1 100644
--- a/sound/pci/hda/patch_via.c
+++ b/sound/pci/hda/patch_via.c
@@ -135,6 +135,7 @@ static struct via_spec *via_new_spec(struct hda_codec *codec)
 		spec->codec_type = VT1708S;
 	spec->gen.indep_hp = 1;
 	spec->gen.keep_eapd_on = 1;
+	spec->gen.dac_min_mute = 1;
 	spec->gen.pcm_playback_hook = via_playback_pcm_hook;
 	spec->gen.add_stereo_mix_input = HDA_HINT_STEREO_MIX_AUTO;
 	codec->power_save_node = 1;

From e54f5117798cbf05254706940fbd82c3007dcb03 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Fri, 15 Jan 2021 22:57:52 +0100
Subject: [PATCH 1391/2658] ACPI: scan: Make acpi_bus_get_device() clear return
 pointer on error

commit 78a18fec5258c8df9435399a1ea022d73d3eceb9 upstream.

Set the acpi_device pointer which acpi_bus_get_device() returns-by-
reference to NULL on errors.

We've recently had 2 cases where callers of acpi_bus_get_device()
did not properly error check the return value, so set the returned-
by-reference acpi_device pointer to NULL, because at least some
callers of acpi_bus_get_device() expect that to be done on errors.

[ rjw: This issue was exposed by commit 71da201f38df ("ACPI: scan:
  Defer enumeration of devices with _DEP lists") which caused it to
  be much more likely to occur on some systems, but the real defect
  had been introduced by an earlier commit. ]

Fixes: 40e7fcb19293 ("ACPI: Add _DEP support to fix battery issue on Asus T100TA")
Fixes: bcfcd409d4db ("usb: split code locating ACPI companion into port and device")
Reported-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Tested-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Diagnosed-by: Rafael J. Wysocki <rafael@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Cc: All applicable <stable@vger.kernel.org>
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/acpi/scan.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 2ab4568aaddd..90ed17aacaa7 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -564,6 +564,8 @@ static int acpi_get_device_data(acpi_handle handle, struct acpi_device **device,
 	if (!device)
 		return -EINVAL;
 
+	*device = NULL;
+
 	status = acpi_get_data_full(handle, acpi_scan_drop_device,
 				    (void **)device, callback);
 	if (ACPI_FAILURE(status) || !*device) {

From 0711dd3b595209a5bda9467e50968b1d5b721626 Mon Sep 17 00:00:00 2001
From: Hannes Reinecke <hare@suse.de>
Date: Thu, 21 Jan 2021 18:50:56 +0100
Subject: [PATCH 1392/2658] dm: avoid filesystem lookup in dm_get_dev_t()

commit 809b1e4945774c9ec5619a8f4e2189b7b3833c0c upstream.

This reverts commit
644bda6f3460 ("dm table: fall back to getting device using name_to_dev_t()")

dm_get_dev_t() is just used to convert an arbitrary 'path' string
into a dev_t. It doesn't presume that the device is present; that
check will be done later, as the only caller is dm_get_device(),
which does a dm_get_table_device() later on, which will properly
open the device.

So if the path string already _is_ in major:minor representation
we can convert it directly, avoiding a recursion into the filesystem
to lookup the block device.

This avoids a hang in multipath_message() when the filesystem is
inaccessible.

Fixes: 644bda6f3460 ("dm table: fall back to getting device using name_to_dev_t()")
Cc: stable@vger.kernel.org
Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Martin Wilck <mwilck@suse.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-table.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 3edebf626a03..7e5bc6921c1f 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -394,14 +394,23 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
 {
 	int r;
 	dev_t dev;
+	unsigned int major, minor;
+	char dummy;
 	struct dm_dev_internal *dd;
 	struct dm_table *t = ti->table;
 
 	BUG_ON(!t);
 
-	dev = dm_get_dev_t(path);
-	if (!dev)
-		return -ENODEV;
+	if (sscanf(path, "%u:%u%c", &major, &minor, &dummy) == 2) {
+		/* Extract the major/minor numbers */
+		dev = MKDEV(major, minor);
+		if (MAJOR(dev) != major || MINOR(dev) != minor)
+			return -EOVERFLOW;
+	} else {
+		dev = dm_get_dev_t(path);
+		if (!dev)
+			return -ENODEV;
+	}
 
 	dd = find_device(&t->devices, dev);
 	if (!dd) {

From dd67415c7aaf993b0626e72b5957ae4d61eedcc3 Mon Sep 17 00:00:00 2001
From: Cezary Rojewski <cezary.rojewski@intel.com>
Date: Thu, 17 Dec 2020 11:54:01 +0100
Subject: [PATCH 1393/2658] ASoC: Intel: haswell: Add missing pm_ops

[ Upstream commit bb224c3e3e41d940612d4cc9573289cdbd5cb8f5 ]

haswell machine board is missing pm_ops what prevents it from undergoing
suspend-resume procedure successfully. Assign default snd_soc_pm_ops so
this is no longer the case.

Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://lore.kernel.org/r/20201217105401.27865-1-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/intel/boards/haswell.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/intel/boards/haswell.c b/sound/soc/intel/boards/haswell.c
index de955c2e8c4e..a0e67d5f5968 100644
--- a/sound/soc/intel/boards/haswell.c
+++ b/sound/soc/intel/boards/haswell.c
@@ -197,6 +197,7 @@ static struct platform_driver haswell_audio = {
 	.probe = haswell_audio_probe,
 	.driver = {
 		.name = "haswell-audio",
+		.pm = &snd_soc_pm_ops,
 	},
 };
 

From 210cc7a037636935f043872a0874e6de07708429 Mon Sep 17 00:00:00 2001
From: Can Guo <cang@codeaurora.org>
Date: Mon, 28 Dec 2020 04:04:36 -0800
Subject: [PATCH 1394/2658] scsi: ufs: Correct the LUN used in
 eh_device_reset_handler() callback

[ Upstream commit 35fc4cd34426c242ab015ef280853b7bff101f48 ]

Users can initiate resets to specific SCSI device/target/host through
IOCTL. When this happens, the SCSI cmd passed to eh_device/target/host
_reset_handler() callbacks is initialized with a request whose tag is -1.
In this case it is not right for eh_device_reset_handler() callback to
count on the LUN get from hba->lrb[-1]. Fix it by getting LUN from the SCSI
device associated with the SCSI cmd.

Link: https://lore.kernel.org/r/1609157080-26283-1-git-send-email-cang@codeaurora.org
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
Signed-off-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ufs/ufshcd.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index ea35b5c98a9f..f83b251fa77b 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -6733,20 +6733,16 @@ static int ufshcd_eh_device_reset_handler(struct scsi_cmnd *cmd)
 {
 	struct Scsi_Host *host;
 	struct ufs_hba *hba;
-	unsigned int tag;
 	u32 pos;
 	int err;
-	u8 resp = 0xF;
-	struct ufshcd_lrb *lrbp;
+	u8 resp = 0xF, lun;
 	unsigned long flags;
 
 	host = cmd->device->host;
 	hba = shost_priv(host);
-	tag = cmd->request->tag;
 
-	ufshcd_print_cmd_log(hba);
-	lrbp = &hba->lrb[tag];
-	err = ufshcd_issue_tm_cmd(hba, lrbp->lun, 0, UFS_LOGICAL_RESET, &resp);
+	lun = ufshcd_scsi_to_upiu_lun(cmd->device->lun);
+	err = ufshcd_issue_tm_cmd(hba, lun, 0, UFS_LOGICAL_RESET, &resp);
 	if (err || resp != UPIU_TASK_MANAGEMENT_FUNC_COMPL) {
 		if (!err)
 			err = resp;
@@ -6755,7 +6751,7 @@ static int ufshcd_eh_device_reset_handler(struct scsi_cmnd *cmd)
 
 	/* clear the commands that were pending for corresponding LUN */
 	for_each_set_bit(pos, &hba->outstanding_reqs, hba->nutrs) {
-		if (hba->lrb[pos].lun == lrbp->lun) {
+		if (hba->lrb[pos].lun == lun) {
 			err = ufshcd_clear_cmd(hba, pos);
 			if (err)
 				break;

From a38efe1fe5cb80ade3943d40219516066f86f7ef Mon Sep 17 00:00:00 2001
From: Ben Skeggs <bskeggs@redhat.com>
Date: Wed, 13 Jan 2021 17:12:52 +1000
Subject: [PATCH 1395/2658] drm/nouveau/bios: fix issue shadowing expansion
 ROMs

[ Upstream commit 402a89660e9dc880710b12773076a336c9dab3d7 ]

This issue has generally been covered up by the presence of additional
expansion ROMs after the ones we're interested in, with header fetches
of subsequent images loading enough of the ROM to hide the issue.

Noticed on GA102, which lacks a type 0x70 image compared to TU102,.

[  906.364197] nouveau 0000:09:00.0: bios: 00000000: type 00, 65024 bytes
[  906.381205] nouveau 0000:09:00.0: bios: 0000fe00: type 03, 91648 bytes
[  906.405213] nouveau 0000:09:00.0: bios: 00026400: type e0, 22016 bytes
[  906.410984] nouveau 0000:09:00.0: bios: 0002ba00: type e0, 366080 bytes

vs

[   22.961901] nouveau 0000:09:00.0: bios: 00000000: type 00, 60416 bytes
[   22.984174] nouveau 0000:09:00.0: bios: 0000ec00: type 03, 71168 bytes
[   23.010446] nouveau 0000:09:00.0: bios: 00020200: type e0, 48128 bytes
[   23.028220] nouveau 0000:09:00.0: bios: 0002be00: type e0, 140800 bytes
[   23.080196] nouveau 0000:09:00.0: bios: 0004e400: type 70, 7168 bytes

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
index 7deb81b6dbac..4b571cc6bc70 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
@@ -75,7 +75,7 @@ shadow_image(struct nvkm_bios *bios, int idx, u32 offset, struct shadow *mthd)
 	nvkm_debug(subdev, "%08x: type %02x, %d bytes\n",
 		   image.base, image.type, image.size);
 
-	if (!shadow_fetch(bios, mthd, image.size)) {
+	if (!shadow_fetch(bios, mthd, image.base + image.size)) {
 		nvkm_debug(subdev, "%08x: fetch failed\n", image.base);
 		return 0;
 	}

From b5c9aa83f2f7210c9f50ed7d4fe5560a72b79781 Mon Sep 17 00:00:00 2001
From: Ben Skeggs <bskeggs@redhat.com>
Date: Wed, 13 Jan 2021 17:12:52 +1000
Subject: [PATCH 1396/2658] drm/nouveau/i2c/gm200: increase width of aux
 semaphore owner fields

[ Upstream commit ba6e9ab0fcf3d76e3952deb12b5f993991621d9c ]

Noticed while debugging GA102.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm204.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm204.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm204.c
index 7cac8fe372b6..a3cede8df4fd 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm204.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm204.c
@@ -33,7 +33,7 @@ static void
 gm204_i2c_aux_fini(struct gm204_i2c_aux *aux)
 {
 	struct nvkm_device *device = aux->base.pad->i2c->subdev.device;
-	nvkm_mask(device, 0x00d954 + (aux->ch * 0x50), 0x00310000, 0x00000000);
+	nvkm_mask(device, 0x00d954 + (aux->ch * 0x50), 0x00710000, 0x00000000);
 }
 
 static int
@@ -54,10 +54,10 @@ gm204_i2c_aux_init(struct gm204_i2c_aux *aux)
 			AUX_ERR(&aux->base, "begin idle timeout %08x", ctrl);
 			return -EBUSY;
 		}
-	} while (ctrl & 0x03010000);
+	} while (ctrl & 0x07010000);
 
 	/* set some magic, and wait up to 1ms for it to appear */
-	nvkm_mask(device, 0x00d954 + (aux->ch * 0x50), 0x00300000, ureq);
+	nvkm_mask(device, 0x00d954 + (aux->ch * 0x50), 0x00700000, ureq);
 	timeout = 1000;
 	do {
 		ctrl = nvkm_rd32(device, 0x00d954 + (aux->ch * 0x50));
@@ -67,7 +67,7 @@ gm204_i2c_aux_init(struct gm204_i2c_aux *aux)
 			gm204_i2c_aux_fini(aux);
 			return -EBUSY;
 		}
-	} while ((ctrl & 0x03000000) != urep);
+	} while ((ctrl & 0x07000000) != urep);
 
 	return 0;
 }

From ece1bd9211bc413e44fd6b8758e782be63f037b6 Mon Sep 17 00:00:00 2001
From: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Date: Wed, 20 Jan 2021 20:41:35 +0900
Subject: [PATCH 1397/2658] can: dev: can_restart: fix use after free bug

[ Upstream commit 03f16c5075b22c8902d2af739969e878b0879c94 ]

After calling netif_rx_ni(skb), dereferencing skb is unsafe.
Especially, the can_frame cf which aliases skb memory is accessed
after the netif_rx_ni() in:
      stats->rx_bytes += cf->len;

Reordering the lines solves the issue.

Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface")
Link: https://lore.kernel.org/r/20210120114137.200019-2-mailhol.vincent@wanadoo.fr
Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/dev.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 52110017fd40..45f15ac6b101 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -525,11 +525,11 @@ static void can_restart(struct net_device *dev)
 	}
 	cf->can_id |= CAN_ERR_RESTARTED;
 
-	netif_rx_ni(skb);
-
 	stats->rx_packets++;
 	stats->rx_bytes += cf->can_dlc;
 
+	netif_rx_ni(skb);
+
 restart:
 	netdev_dbg(dev, "restarted\n");
 	priv->can_stats.restarts++;

From ca6235af286bc4bd1055b59fcba047c4d59436dc Mon Sep 17 00:00:00 2001
From: Lars-Peter Clausen <lars@metafoo.de>
Date: Wed, 9 Dec 2020 11:46:49 +0100
Subject: [PATCH 1398/2658] iio: ad5504: Fix setting power-down state

commit efd597b2839a9895e8a98fcb0b76d2f545802cd4 upstream.

The power-down mask of the ad5504 is actually a power-up mask. Meaning if
a bit is set the corresponding channel is powered up and if it is not set
the channel is powered down.

The driver currently has this the wrong way around, resulting in the
channel being powered up when requested to be powered down and vice versa.

Fixes: 3bbbf150ffde ("staging:iio:dac:ad5504: Use strtobool for boolean values")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Link: https://lore.kernel.org/r/20201209104649.5794-1-lars@metafoo.de
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/dac/ad5504.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/dac/ad5504.c b/drivers/iio/dac/ad5504.c
index 4e4c20d6d8b5..0367641aed07 100644
--- a/drivers/iio/dac/ad5504.c
+++ b/drivers/iio/dac/ad5504.c
@@ -189,9 +189,9 @@ static ssize_t ad5504_write_dac_powerdown(struct iio_dev *indio_dev,
 		return ret;
 
 	if (pwr_down)
-		st->pwr_down_mask |= (1 << chan->channel);
-	else
 		st->pwr_down_mask &= ~(1 << chan->channel);
+	else
+		st->pwr_down_mask |= (1 << chan->channel);
 
 	ret = ad5504_spi_write(st, AD5504_ADDR_CTRL,
 				AD5504_DAC_PWRDWN_MODE(st->pwr_down_mode) |

From 13853853ff2a082c8b8198b9490f83a7c36261d2 Mon Sep 17 00:00:00 2001
From: Eugene Korenevsky <ekorenevsky@astralinux.ru>
Date: Sun, 10 Jan 2021 20:36:09 +0300
Subject: [PATCH 1399/2658] ehci: fix EHCI host controller initialization
 sequence

commit 280a9045bb18833db921b316a5527d2b565e9f2e upstream.

According to EHCI spec, EHCI HC clears USBSTS.HCHalted whenever
USBCMD.RS=1.

However, it is a good practice to wait some time after setting USBCMD.RS
(approximately 100ms) until USBSTS.HCHalted become zero.

Without this waiting, VirtualBox's EHCI virtual HC accidentally hangs
(see BugLink).

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211095
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Eugene Korenevsky <ekorenevsky@astralinux.ru>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210110173609.GA17313@himera.home
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/ehci-hcd.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 3e51c0a51049..56a32d4e2cbc 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -575,6 +575,7 @@ static int ehci_run (struct usb_hcd *hcd)
 	struct ehci_hcd		*ehci = hcd_to_ehci (hcd);
 	u32			temp;
 	u32			hcc_params;
+	int			rc;
 
 	hcd->uses_new_polling = 1;
 
@@ -630,9 +631,20 @@ static int ehci_run (struct usb_hcd *hcd)
 	down_write(&ehci_cf_port_reset_rwsem);
 	ehci->rh_state = EHCI_RH_RUNNING;
 	ehci_writel(ehci, FLAG_CF, &ehci->regs->configured_flag);
+
+	/* Wait until HC become operational */
 	ehci_readl(ehci, &ehci->regs->command);	/* unblock posted writes */
 	msleep(5);
+	rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, 0, 100 * 1000);
+
 	up_write(&ehci_cf_port_reset_rwsem);
+
+	if (rc) {
+		ehci_err(ehci, "USB %x.%x, controller refused to start: %d\n",
+			 ((ehci->sbrn & 0xf0)>>4), (ehci->sbrn & 0x0f), rc);
+		return rc;
+	}
+
 	ehci->last_periodic_enable = ktime_get_real();
 
 	temp = HC_VERSION(ehci, ehci_readl(ehci, &ehci->caps->hc_capbase));

From 10e46f62cd28e6421a4aeb946e64b8d7253fe5ef Mon Sep 17 00:00:00 2001
From: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Date: Mon, 18 Jan 2021 21:36:15 +0100
Subject: [PATCH 1400/2658] usb: bdc: Make bdc pci driver depend on BROKEN

commit ef02684c4e67d8c35ac83083564135bc7b1d3445 upstream.

The bdc pci driver is going to be removed due to it not existing in the
wild. This patch turns off compilation of the driver so that stable
kernels can also pick up the change. This helps the out-of-tree
facetimehd webcam driver as the pci id conflicts with bdc.

Cc: Al Cooper <alcooperx@gmail.com>
Cc: <stable@vger.kernel.org>
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: https://lore.kernel.org/r/20210118203615.13995-1-patrik.r.jakobsson@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/udc/bdc/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/bdc/Kconfig b/drivers/usb/gadget/udc/bdc/Kconfig
index 0d7b8c9f72fd..778df4badf88 100644
--- a/drivers/usb/gadget/udc/bdc/Kconfig
+++ b/drivers/usb/gadget/udc/bdc/Kconfig
@@ -14,7 +14,7 @@ if USB_BDC_UDC
 comment "Platform Support"
 config	USB_BDC_PCI
 	tristate "BDC support for PCIe based platforms"
-	depends on PCI
+	depends on PCI && BROKEN
 	default USB_BDC_UDC
 	help
 		Enable support for platforms which have BDC connected through PCIe, such as Lego3 FPGA platform.

From 756ca23d362dabfa43f795cec662f6d07ccfd095 Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Fri, 15 Jan 2021 18:19:06 +0200
Subject: [PATCH 1401/2658] xhci: make sure TRB is fully written before giving
 it to the controller

commit 576667bad341516edc4e18eb85acb0a2b4c9c9d9 upstream.

Once the command ring doorbell is rung the xHC controller will parse all
command TRBs on the command ring that have the cycle bit set properly.

If the driver just started writing the next command TRB to the ring when
hardware finished the previous TRB, then HW might fetch an incomplete TRB
as long as its cycle bit set correctly.

A command TRB is 16 bytes (128 bits) long.
Driver writes the command TRB in four 32 bit chunks, with the chunk
containing the cycle bit last. This does however not guarantee that
chunks actually get written in that order.

This was detected in stress testing when canceling URBs with several
connected USB devices.
Two consecutive "Set TR Dequeue pointer" commands got queued right
after each other, and the second one was only partially written when
the controller parsed it, causing the dequeue pointer to be set
to bogus values. This was seen as error messages:

"Mismatch between completed Set TR Deq Ptr command & xHCI internal state"

Solution is to add a write memory barrier before writing the cycle bit.

Cc: <stable@vger.kernel.org>
Tested-by: Ross Zwisler <zwisler@google.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20210115161907.2875631-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-ring.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 37dd9613f639..828093fc36e2 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2840,6 +2840,8 @@ static void queue_trb(struct xhci_hcd *xhci, struct xhci_ring *ring,
 	trb->field[0] = cpu_to_le32(field1);
 	trb->field[1] = cpu_to_le32(field2);
 	trb->field[2] = cpu_to_le32(field3);
+	/* make sure TRB is fully written before giving it to the controller */
+	wmb();
 	trb->field[3] = cpu_to_le32(field4);
 	inc_enq(xhci, ring, more_trbs_coming);
 }

From 9f938608378b28a93af580c5cd6f68f8ff9b3105 Mon Sep 17 00:00:00 2001
From: Will Deacon <will@kernel.org>
Date: Tue, 12 Jan 2021 22:48:32 +0000
Subject: [PATCH 1402/2658] compiler.h: Raise minimum version of GCC to 5.1 for
 arm64

commit dca5244d2f5b94f1809f0c02a549edf41ccd5493 upstream.

GCC versions >= 4.9 and < 5.1 have been shown to emit memory references
beyond the stack pointer, resulting in memory corruption if an interrupt
is taken after the stack pointer has been adjusted but before the
reference has been executed. This leads to subtle, infrequent data
corruption such as the EXT4 problems reported by Russell King at the
link below.

Life is too short for buggy compilers, so raise the minimum GCC version
required by arm64 to 5.1.

Reported-by: Russell King <linux@armlinux.org.uk>
Suggested-by: Arnd Bergmann <arnd@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
Tested-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: <stable@vger.kernel.org>
Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Florian Weimer <fweimer@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Link: https://lore.kernel.org/r/20210105154726.GD1551@shell.armlinux.org.uk
Link: https://lore.kernel.org/r/20210112224832.10980-1-will@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[will: backport to 4.4.y/4.9.y/4.14.y; add __clang__ check]
Link: https://lore.kernel.org/r/CA+G9fYuzE9WMSB7uGjV4gTzK510SHEdJb_UXQCzsQ5MqA=h9SA@mail.gmail.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/compiler-gcc.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index 8fe8b1b33dfa..ab3f6ec018da 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -130,6 +130,12 @@
 
 #if GCC_VERSION < 30200
 # error Sorry, your compiler is too old - please upgrade it.
+#elif defined(CONFIG_ARM64) && GCC_VERSION < 50100 && !defined(__clang__)
+/*
+ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63293
+ * https://lore.kernel.org/r/20210107111841.GN1551@shell.armlinux.org.uk
+ */
+# error Sorry, your version of GCC is too old - please use 5.1 or newer.
 #endif
 
 #if GCC_VERSION < 30300

From 36e271a13dd6f617e7d22e8b1a215190696524e2 Mon Sep 17 00:00:00 2001
From: Guillaume Nault <gnault@redhat.com>
Date: Sat, 16 Jan 2021 11:44:26 +0100
Subject: [PATCH 1403/2658] netfilter: rpfilter: mask ecn bits before fib
 lookup

commit 2e5a6266fbb11ae93c468dfecab169aca9c27b43 upstream.

RT_TOS() only masks one of the two ECN bits. Therefore rpfilter_mt()
treats Not-ECT or ECT(1) packets in a different way than those with
ECT(0) or CE.

Reproducer:

  Create two netns, connected with a veth:
  $ ip netns add ns0
  $ ip netns add ns1
  $ ip link add name veth01 netns ns0 type veth peer name veth10 netns ns1
  $ ip -netns ns0 link set dev veth01 up
  $ ip -netns ns1 link set dev veth10 up
  $ ip -netns ns0 address add 192.0.2.10/32 dev veth01
  $ ip -netns ns1 address add 192.0.2.11/32 dev veth10

  Add a route to ns1 in ns0:
  $ ip -netns ns0 route add 192.0.2.11/32 dev veth01

  In ns1, only packets with TOS 4 can be routed to ns0:
  $ ip -netns ns1 route add 192.0.2.10/32 tos 4 dev veth10

  Ping from ns0 to ns1 works regardless of the ECN bits, as long as TOS
  is 4:
  $ ip netns exec ns0 ping -Q 4 192.0.2.11   # TOS 4, Not-ECT
    ... 0% packet loss ...
  $ ip netns exec ns0 ping -Q 5 192.0.2.11   # TOS 4, ECT(1)
    ... 0% packet loss ...
  $ ip netns exec ns0 ping -Q 6 192.0.2.11   # TOS 4, ECT(0)
    ... 0% packet loss ...
  $ ip netns exec ns0 ping -Q 7 192.0.2.11   # TOS 4, CE
    ... 0% packet loss ...

  Now use iptable's rpfilter module in ns1:
  $ ip netns exec ns1 iptables-legacy -t raw -A PREROUTING -m rpfilter --invert -j DROP

  Not-ECT and ECT(1) packets still pass:
  $ ip netns exec ns0 ping -Q 4 192.0.2.11   # TOS 4, Not-ECT
    ... 0% packet loss ...
  $ ip netns exec ns0 ping -Q 5 192.0.2.11   # TOS 4, ECT(1)
    ... 0% packet loss ...

  But ECT(0) and ECN packets are dropped:
  $ ip netns exec ns0 ping -Q 6 192.0.2.11   # TOS 4, ECT(0)
    ... 100% packet loss ...
  $ ip netns exec ns0 ping -Q 7 192.0.2.11   # TOS 4, CE
    ... 100% packet loss ...

After this patch, rpfilter doesn't drop ECT(0) and CE packets anymore.

Fixes: 8f97339d3feb ("netfilter: add ipv4 reverse path filter match")
Signed-off-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/netfilter/ipt_rpfilter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c
index 78cc64eddfc1..32a363465e0a 100644
--- a/net/ipv4/netfilter/ipt_rpfilter.c
+++ b/net/ipv4/netfilter/ipt_rpfilter.c
@@ -92,7 +92,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	flow.saddr = rpfilter_get_saddr(iph->daddr);
 	flow.flowi4_oif = 0;
 	flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
-	flow.flowi4_tos = RT_TOS(iph->tos);
+	flow.flowi4_tos = iph->tos & IPTOS_RT_MASK;
 	flow.flowi4_scope = RT_SCOPE_UNIVERSE;
 
 	return rpfilter_lookup_reverse(par->net, &flow, par->in, info->flags) ^ invert;

From a5eb56386732196fa4b575d8085ebd4e7b2a7500 Mon Sep 17 00:00:00 2001
From: Necip Fazil Yildiran <fazilyildiran@gmail.com>
Date: Thu, 17 Sep 2020 18:45:48 +0300
Subject: [PATCH 1404/2658] sh: dma: fix kconfig dependency for G2_DMA

commit f477a538c14d07f8c45e554c8c5208d588514e98 upstream.

When G2_DMA is enabled and SH_DMA is disabled, it results in the following
Kbuild warning:

WARNING: unmet direct dependencies detected for SH_DMA_API
  Depends on [n]: SH_DMA [=n]
  Selected by [y]:
  - G2_DMA [=y] && SH_DREAMCAST [=y]

The reason is that G2_DMA selects SH_DMA_API without depending on or
selecting SH_DMA while SH_DMA_API depends on SH_DMA.

When G2_DMA was first introduced with commit 40f49e7ed77f
("sh: dma: Make G2 DMA configurable."), this wasn't an issue since
SH_DMA_API didn't have such dependency, and this way was the only way to
enable it since SH_DMA_API was non-visible. However, later SH_DMA_API was
made visible and dependent on SH_DMA with commit d8902adcc1a9
("dmaengine: sh: Add Support SuperH DMA Engine driver").

Let G2_DMA depend on SH_DMA_API instead to avoid Kbuild issues.

Fixes: d8902adcc1a9 ("dmaengine: sh: Add Support SuperH DMA Engine driver")
Signed-off-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
Signed-off-by: Rich Felker <dalias@libc.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/sh/drivers/dma/Kconfig | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/sh/drivers/dma/Kconfig b/arch/sh/drivers/dma/Kconfig
index 78bc97b1d027..ac834e9e0e0a 100644
--- a/arch/sh/drivers/dma/Kconfig
+++ b/arch/sh/drivers/dma/Kconfig
@@ -62,8 +62,7 @@ config PVR2_DMA
 
 config G2_DMA
 	tristate "G2 Bus DMA support"
-	depends on SH_DREAMCAST
-	select SH_DMA_API
+	depends on SH_DREAMCAST && SH_DMA_API
 	help
 	  This enables support for the DMA controller for the Dreamcast's
 	  G2 bus. Drivers that want this will generally enable this on

From 305e247390f7d05cddd0f8bac9020bbd5e72d789 Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Mon, 18 Jan 2021 16:08:12 +0100
Subject: [PATCH 1405/2658] sh_eth: Fix power down vs. is_opened flag ordering
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit f6a2e94b3f9d89cb40771ff746b16b5687650cbb upstream.

sh_eth_close() does a synchronous power down of the device before
marking it closed.  Revert the order, to make sure the device is never
marked opened while suspended.

While at it, use pm_runtime_put() instead of pm_runtime_put_sync(), as
there is no reason to do a synchronous power down.

Fixes: 7fa2955ff70ce453 ("sh_eth: Fix sleeping function called from invalid context")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@gmail.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Link: https://lore.kernel.org/r/20210118150812.796791-1-geert+renesas@glider.be
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/renesas/sh_eth.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 8413f93f5cd9..614b83c7ce81 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -2507,10 +2507,10 @@ static int sh_eth_close(struct net_device *ndev)
 	/* Free all the skbuffs in the Rx queue and the DMA buffer. */
 	sh_eth_ring_free(ndev);
 
-	pm_runtime_put_sync(&mdp->pdev->dev);
-
 	mdp->is_opened = 0;
 
+	pm_runtime_put(&mdp->pdev->dev);
+
 	return 0;
 }
 

From bdfc911d5949d32eebce6c344af49d8f4103e76a Mon Sep 17 00:00:00 2001
From: Alexander Lobakin <alobakin@pm.me>
Date: Fri, 15 Jan 2021 15:04:40 +0000
Subject: [PATCH 1406/2658] skbuff: back tiny skbs with kmalloc() in
 __netdev_alloc_skb() too

commit 66c556025d687dbdd0f748c5e1df89c977b6c02a upstream.

Commit 3226b158e67c ("net: avoid 32 x truesize under-estimation for
tiny skbs") ensured that skbs with data size lower than 1025 bytes
will be kmalloc'ed to avoid excessive page cache fragmentation and
memory consumption.
However, the fix adressed only __napi_alloc_skb() (primarily for
virtio_net and napi_get_frags()), but the issue can still be achieved
through __netdev_alloc_skb(), which is still used by several drivers.
Drivers often allocate a tiny skb for headers and place the rest of
the frame to frags (so-called copybreak).
Mirror the condition to __netdev_alloc_skb() to handle this case too.

Since v1 [0]:
 - fix "Fixes:" tag;
 - refine commit message (mention copybreak usecase).

[0] https://lore.kernel.org/netdev/20210114235423.232737-1-alobakin@pm.me

Fixes: a1c7fff7e18f ("net: netdev_alloc_skb() use build_skb()")
Signed-off-by: Alexander Lobakin <alobakin@pm.me>
Link: https://lore.kernel.org/r/20210115150354.85967-1-alobakin@pm.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/skbuff.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index f42391c41b23..8395c6489fca 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -426,10 +426,11 @@ struct sk_buff *__netdev_alloc_skb(struct net_device *dev, unsigned int len,
 
 	len += NET_SKB_PAD;
 
-	if (IS_ENABLED(CONFIG_FORCE_ALLOC_FROM_DMA_ZONE))
-		gfp_mask |= GFP_DMA;
-
-	if ((len > SKB_WITH_OVERHEAD(PAGE_SIZE)) ||
+	/* If requested length is either too small or too big,
+	 * we use kmalloc() for skb->head allocation.
+	 */
+	if (len <= SKB_WITH_OVERHEAD(1024) ||
+	    len > SKB_WITH_OVERHEAD(PAGE_SIZE) ||
 	    (gfp_mask & (__GFP_DIRECT_RECLAIM | GFP_DMA))) {
 		skb = __alloc_skb(len, gfp_mask, SKB_ALLOC_RX, NUMA_NO_NODE);
 		if (!skb)

From 1a38d4f83820b52af39bda4d8f1bdb4145176394 Mon Sep 17 00:00:00 2001
From: Matteo Croce <mcroce@microsoft.com>
Date: Fri, 15 Jan 2021 19:42:08 +0100
Subject: [PATCH 1407/2658] ipv6: create multicast route with RTPROT_KERNEL

commit a826b04303a40d52439aa141035fca5654ccaccd upstream.

The ff00::/8 multicast route is created without specifying the fc_protocol
field, so the default RTPROT_BOOT value is used:

  $ ip -6 -d route
  unicast ::1 dev lo proto kernel scope global metric 256 pref medium
  unicast fe80::/64 dev eth0 proto kernel scope global metric 256 pref medium
  unicast ff00::/8 dev eth0 proto boot scope global metric 256 pref medium

As the documentation says, this value identifies routes installed during
boot, but the route is created when interface is set up.
Change the value to RTPROT_KERNEL which is a better value.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Matteo Croce <mcroce@microsoft.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/addrconf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 520e82106b9d..6e29bf188383 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2302,6 +2302,7 @@ static void addrconf_add_mroute(struct net_device *dev)
 		.fc_dst_len = 8,
 		.fc_flags = RTF_UP,
 		.fc_nlinfo.nl_net = dev_net(dev),
+		.fc_protocol = RTPROT_KERNEL,
 	};
 
 	ipv6_addr_set(&cfg.fc_dst, htonl(0xFF000000), 0, 0, 0);

From 4f44dad24da11c3672f205fa75b4e21c14366df7 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 14 Jan 2021 10:52:29 -0800
Subject: [PATCH 1408/2658] net_sched: avoid shift-out-of-bounds in
 tcindex_set_parms()

commit bcd0cf19ef8258ac31b9a20248b05c15a1f4b4b0 upstream.

tc_index being 16bit wide, we need to check that TCA_TCINDEX_SHIFT
attribute is not silly.

UBSAN: shift-out-of-bounds in net/sched/cls_tcindex.c:260:29
shift exponent 255 is too large for 32-bit type 'int'
CPU: 0 PID: 8516 Comm: syz-executor228 Not tainted 5.10.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
 valid_perfect_hash net/sched/cls_tcindex.c:260 [inline]
 tcindex_set_parms.cold+0x1b/0x215 net/sched/cls_tcindex.c:425
 tcindex_change+0x232/0x340 net/sched/cls_tcindex.c:546
 tc_new_tfilter+0x13fb/0x21b0 net/sched/cls_api.c:2127
 rtnetlink_rcv_msg+0x8b6/0xb80 net/core/rtnetlink.c:5555
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x907/0xe40 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:672
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2336
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2390
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2423
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Link: https://lore.kernel.org/r/20210114185229.1742255-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/cls_tcindex.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index 755e9ff40fca..3d891b11c077 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -273,9 +273,13 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
 	if (tb[TCA_TCINDEX_MASK])
 		cp->mask = nla_get_u16(tb[TCA_TCINDEX_MASK]);
 
-	if (tb[TCA_TCINDEX_SHIFT])
+	if (tb[TCA_TCINDEX_SHIFT]) {
 		cp->shift = nla_get_u32(tb[TCA_TCINDEX_SHIFT]);
-
+		if (cp->shift > 16) {
+			err = -EINVAL;
+			goto errout;
+		}
+	}
 	if (!cp->hash) {
 		/* Hash not specified, use perfect hash if the upper limit
 		 * of the hashing index is below the threshold.

From 31d9e2af1d9ab2d1018f6a9777d0e3051a1fa1e6 Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38@huawei.com>
Date: Thu, 28 Jan 2021 19:32:50 +0800
Subject: [PATCH 1409/2658] Revert "mm/slub: fix a memory leak in
 sysfs_slab_add()"

commit 757fed1d0898b893d7daa84183947c70f27632f3 upstream.

This reverts commit dde3c6b72a16c2db826f54b2d49bdea26c3534a2.

syzbot report a double-free bug. The following case can cause this bug.

 - mm/slab_common.c: create_cache(): if the __kmem_cache_create() fails,
   it does:

	out_free_cache:
		kmem_cache_free(kmem_cache, s);

 - but __kmem_cache_create() - at least for slub() - will have done

	sysfs_slab_add(s)
		-> sysfs_create_group() .. fails ..
		-> kobject_del(&s->kobj); .. which frees s ...

We can't remove the kmem_cache_free() in create_cache(), because other
error cases of __kmem_cache_create() do not free this.

So, revert the commit dde3c6b72a16 ("mm/slub: fix a memory leak in
sysfs_slab_add()") to fix this.

Reported-by: syzbot+d0bd96b4696c1ef67991@syzkaller.appspotmail.com
Fixes: dde3c6b72a16 ("mm/slub: fix a memory leak in sysfs_slab_add()")
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/slub.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/mm/slub.c b/mm/slub.c
index 03a345817225..d0e21f0faa69 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5616,10 +5616,8 @@ static int sysfs_slab_add(struct kmem_cache *s)
 
 	s->kobj.kset = cache_kset(s);
 	err = kobject_init_and_add(&s->kobj, &slab_ktype, NULL, "%s", name);
-	if (err) {
-		kobject_put(&s->kobj);
+	if (err)
 		goto out;
-	}
 
 	err = sysfs_create_group(&s->kobj, &slab_attr_group);
 	if (err)

From 2bd5caf010cb25e6ca3ee5fc9bb0a6da2e7d96ef Mon Sep 17 00:00:00 2001
From: Gaurav Kohli <gkohli@codeaurora.org>
Date: Tue, 6 Oct 2020 15:03:53 +0530
Subject: [PATCH 1410/2658] tracing: Fix race in trace_open and buffer resize
 call

commit bbeb97464eefc65f506084fd9f18f21653e01137 upstream.

Below race can come, if trace_open and resize of
cpu buffer is running parallely on different cpus
CPUX                                CPUY
				    ring_buffer_resize
				    atomic_read(&buffer->resize_disabled)
tracing_open
tracing_reset_online_cpus
ring_buffer_reset_cpu
rb_reset_cpu
				    rb_update_pages
				    remove/insert pages
resetting pointer

This race can cause data abort or some times infinte loop in
rb_remove_pages and rb_insert_pages while checking pages
for sanity.

Take buffer lock to fix this.

Link: https://lkml.kernel.org/r/1601976833-24377-1-git-send-email-gkohli@codeaurora.org

Cc: stable@vger.kernel.org
Fixes: 83f40318dab00 ("ring-buffer: Make removal of ring buffer pages atomic")
Reported-by: Denis Efremov <efremov@linux.com>
Signed-off-by: Gaurav Kohli <gkohli@codeaurora.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/ring_buffer.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 547a3a5ac57b..1ec760f6bf58 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -4294,6 +4294,8 @@ void ring_buffer_reset_cpu(struct ring_buffer *buffer, int cpu)
 
 	if (!cpumask_test_cpu(cpu, buffer->cpumask))
 		return;
+	/* prevent another thread from changing buffer sizes */
+	mutex_lock(&buffer->mutex);
 
 	atomic_inc(&buffer->resize_disabled);
 	atomic_inc(&cpu_buffer->record_disabled);
@@ -4317,6 +4319,8 @@ void ring_buffer_reset_cpu(struct ring_buffer *buffer, int cpu)
 
 	atomic_dec(&cpu_buffer->record_disabled);
 	atomic_dec(&buffer->resize_disabled);
+
+	mutex_unlock(&buffer->mutex);
 }
 EXPORT_SYMBOL_GPL(ring_buffer_reset_cpu);
 

From 9597bc40914b51fb1a15b04e2c227fbe80cd4a77 Mon Sep 17 00:00:00 2001
From: Pawel Wieczorkiewicz <wipawel@amazon.de>
Date: Mon, 14 Dec 2020 10:25:57 +0100
Subject: [PATCH 1411/2658] xen-blkback: set ring->xenblkd to NULL after
 kthread_stop()

commit 1c728719a4da6e654afb9cc047164755072ed7c9 upstream.

When xen_blkif_disconnect() is called, the kernel thread behind the
block interface is stopped by calling kthread_stop(ring->xenblkd).
The ring->xenblkd thread pointer being non-NULL determines if the
thread has been already stopped.
Normally, the thread's function xen_blkif_schedule() sets the
ring->xenblkd to NULL, when the thread's main loop ends.

However, when the thread has not been started yet (i.e.
wake_up_process() has not been called on it), the xen_blkif_schedule()
function would not be called yet.

In such case the kthread_stop() call returns -EINTR and the
ring->xenblkd remains dangling.
When this happens, any consecutive call to xen_blkif_disconnect (for
example in frontend_changed() callback) leads to a kernel crash in
kthread_stop() (e.g. NULL pointer dereference in exit_creds()).

This is XSA-350.

Cc: <stable@vger.kernel.org> # 4.12
Fixes: a24fa22ce22a ("xen/blkback: don't use xen_blkif_get() in xen-blkback kthread")
Reported-by: Olivier Benjamin <oliben@amazon.com>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Signed-off-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Julien Grall <jgrall@amazon.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
[iwamatsu: change from ring to blkif]
Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/block/xen-blkback/xenbus.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 823f3480ebd1..f974ed7c33b5 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -219,6 +219,7 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
 
 	if (blkif->xenblkd) {
 		kthread_stop(blkif->xenblkd);
+		blkif->xenblkd = NULL;
 		wake_up(&blkif->shutdown_wq);
 	}
 

From 6b3bb416f03eac30998385a79a71692947dd590b Mon Sep 17 00:00:00 2001
From: Arvind Sankar <nivedita@alum.mit.edu>
Date: Tue, 11 Aug 2020 20:43:08 -0400
Subject: [PATCH 1412/2658] x86/boot/compressed: Disable relocation relaxation

commit 09e43968db40c33a73e9ddbfd937f46d5c334924 upstream.

The x86-64 psABI [0] specifies special relocation types
(R_X86_64_[REX_]GOTPCRELX) for indirection through the Global Offset
Table, semantically equivalent to R_X86_64_GOTPCREL, which the linker
can take advantage of for optimization (relaxation) at link time. This
is supported by LLD and binutils versions 2.26 onwards.

The compressed kernel is position-independent code, however, when using
LLD or binutils versions before 2.27, it must be linked without the -pie
option. In this case, the linker may optimize certain instructions into
a non-position-independent form, by converting foo@GOTPCREL(%rip) to $foo.

This potential issue has been present with LLD and binutils-2.26 for a
long time, but it has never manifested itself before now:

- LLD and binutils-2.26 only relax
	movq	foo@GOTPCREL(%rip), %reg
  to
	leaq	foo(%rip), %reg
  which is still position-independent, rather than
	mov	$foo, %reg
  which is permitted by the psABI when -pie is not enabled.

- GCC happens to only generate GOTPCREL relocations on mov instructions.

- CLang does generate GOTPCREL relocations on non-mov instructions, but
  when building the compressed kernel, it uses its integrated assembler
  (due to the redefinition of KBUILD_CFLAGS dropping -no-integrated-as),
  which has so far defaulted to not generating the GOTPCRELX
  relocations.

Nick Desaulniers reports [1,2]:

  "A recent change [3] to a default value of configuration variable
   (ENABLE_X86_RELAX_RELOCATIONS OFF -> ON) in LLVM now causes Clang's
   integrated assembler to emit R_X86_64_GOTPCRELX/R_X86_64_REX_GOTPCRELX
   relocations. LLD will relax instructions with these relocations based
   on whether the image is being linked as position independent or not.
   When not, then LLD will relax these instructions to use absolute
   addressing mode (R_RELAX_GOT_PC_NOPIC). This causes kernels built with
   Clang and linked with LLD to fail to boot."

Patch series [4] is a solution to allow the compressed kernel to be
linked with -pie unconditionally, but even if merged is unlikely to be
backported. As a simple solution that can be applied to stable as well,
prevent the assembler from generating the relaxed relocation types using
the -mrelax-relocations=no option. For ease of backporting, do this
unconditionally.

[0] https://gitlab.com/x86-psABIs/x86-64-ABI/-/blob/master/x86-64-ABI/linker-optimization.tex#L65
[1] https://lore.kernel.org/lkml/20200807194100.3570838-1-ndesaulniers@google.com/
[2] https://github.com/ClangBuiltLinux/linux/issues/1121
[3] https://reviews.llvm.org/rGc41a18cf61790fc898dcda1055c3efbf442c14c0
[4] https://lore.kernel.org/lkml/20200731202738.2577854-1-nivedita@alum.mit.edu/

Reported-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200812004308.1448603-1-nivedita@alum.mit.edu
[nc: Backport to 4.4]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/boot/compressed/Makefile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index 5993813c733d..b9d8d72d397e 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -34,6 +34,8 @@ KBUILD_CFLAGS += -mno-mmx -mno-sse
 KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
 KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
 KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member)
+# Disable relocation relaxation in case the link is not PIE.
+KBUILD_CFLAGS += $(call as-option,-Wa$(comma)-mrelax-relocations=no)
 
 KBUILD_AFLAGS  := $(KBUILD_CFLAGS) -D__ASSEMBLY__
 GCOV_PROFILE := n

From 1231557f987e593f0bec21772974251a436881fa Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sat, 30 Jan 2021 13:25:58 +0100
Subject: [PATCH 1413/2658] Linux 4.4.254

Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Link: https://lore.kernel.org/r/20210129105909.630107942@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index c9c0274ccb66..ab85a1b8c40f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 253
+SUBLEVEL = 254
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 6463e45a191c7002f5b38b55a6548cc79a3b6b0d Mon Sep 17 00:00:00 2001
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date: Fri, 22 Jan 2021 20:53:02 +0800
Subject: [PATCH 1414/2658] ACPI: sysfs: Prefer "compatible" modalias

commit 36af2d5c4433fb40ee2af912c4ac0a30991aecfc upstream.

Commit 8765c5ba1949 ("ACPI / scan: Rework modalias creation when
"compatible" is present") may create two "MODALIAS=" in one uevent
file if specific conditions are met.

This breaks systemd-udevd, which assumes each "key" in one uevent file
to be unique. The internal implementation of systemd-udevd overwrites
the first MODALIAS with the second one, so its kmod rule doesn't load
the driver for the first MODALIAS.

So if both the ACPI modalias and the OF modalias are present, use the
latter to ensure that there will be only one MODALIAS.

Link: https://github.com/systemd/systemd/pull/18163
Suggested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Fixes: 8765c5ba1949 ("ACPI / scan: Rework modalias creation when "compatible" is present")
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: 4.1+ <stable@vger.kernel.org> # 4.1+
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/acpi/device_sysfs.c | 20 ++++++--------------
 1 file changed, 6 insertions(+), 14 deletions(-)

diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c
index a899a7abcf63..139ee989b0d0 100644
--- a/drivers/acpi/device_sysfs.c
+++ b/drivers/acpi/device_sysfs.c
@@ -259,20 +259,12 @@ int __acpi_device_uevent_modalias(struct acpi_device *adev,
 	if (add_uevent_var(env, "MODALIAS="))
 		return -ENOMEM;
 
-	len = create_pnp_modalias(adev, &env->buf[env->buflen - 1],
-				  sizeof(env->buf) - env->buflen);
-	if (len < 0)
-		return len;
-
-	env->buflen += len;
-	if (!adev->data.of_compatible)
-		return 0;
-
-	if (len > 0 && add_uevent_var(env, "MODALIAS="))
-		return -ENOMEM;
-
-	len = create_of_modalias(adev, &env->buf[env->buflen - 1],
-				 sizeof(env->buf) - env->buflen);
+	if (adev->data.of_compatible)
+		len = create_of_modalias(adev, &env->buf[env->buflen - 1],
+					 sizeof(env->buf) - env->buflen);
+	else
+		len = create_pnp_modalias(adev, &env->buf[env->buflen - 1],
+					  sizeof(env->buf) - env->buflen);
 	if (len < 0)
 		return len;
 

From ba5cbd21cb142c1293a10089bfe4e4d636c4a879 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Thu, 21 Jan 2021 17:16:22 +0100
Subject: [PATCH 1415/2658] wext: fix NULL-ptr-dereference with cfg80211's lack
 of commit()

commit 5122565188bae59d507d90a9a9fd2fd6107f4439 upstream.

Since cfg80211 doesn't implement commit, we never really cared about
that code there (and it's configured out w/o CONFIG_WIRELESS_EXT).
After all, since it has no commit, it shouldn't return -EIWCOMMIT to
indicate commit is needed.

However, EIWCOMMIT is actually an alias for EINPROGRESS, which _can_
happen if e.g. we try to change the frequency but we're already in
the process of connecting to some network, and drivers could return
that value (or even cfg80211 itself might).

This then causes us to crash because dev->wireless_handlers is NULL
but we try to check dev->wireless_handlers->standard[0].

Fix this by also checking dev->wireless_handlers. Also simplify the
code a little bit.

Cc: stable@vger.kernel.org
Reported-by: syzbot+444248c79e117bc99f46@syzkaller.appspotmail.com
Reported-by: syzbot+8b2a88a09653d4084179@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20210121171621.2076e4a37d5a.I5d9c72220fe7bb133fb718751da0180a57ecba4e@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/wireless/wext-core.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 843d2cf1e6a6..9a929010ea9d 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -895,8 +895,9 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
 int call_commit_handler(struct net_device *dev)
 {
 #ifdef CONFIG_WIRELESS_EXT
-	if ((netif_running(dev)) &&
-	   (dev->wireless_handlers->standard[0] != NULL))
+	if (netif_running(dev) &&
+	    dev->wireless_handlers &&
+	    dev->wireless_handlers->standard[0])
 		/* Call the commit handler on the driver */
 		return dev->wireless_handlers->standard[0](dev, NULL,
 							   NULL, NULL);

From 7f4a1e627ceb621dc3f758a1e52dd9e42267d089 Mon Sep 17 00:00:00 2001
From: Giacinto Cifelli <gciofono@gmail.com>
Date: Wed, 20 Jan 2021 05:56:50 +0100
Subject: [PATCH 1416/2658] net: usb: qmi_wwan: added support for Thales
 Cinterion PLSx3 modem family
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 7e0e63d09516e96994c879f07c5a3c3269d7015e upstream.

Bus 003 Device 009: ID 1e2d:006f
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass          239 Miscellaneous Device
  bDeviceSubClass         2 ?
  bDeviceProtocol         1 Interface Association
  bMaxPacketSize0        64
  idVendor           0x1e2d
  idProduct          0x006f
  bcdDevice            0.00
  iManufacturer           3 Cinterion Wireless Modules
  iProduct                2 PLSx3
  iSerial                 4 fa3c1419
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength          303
    bNumInterfaces          9
    bConfigurationValue     1
    iConfiguration          1 Cinterion Configuration
    bmAttributes         0xe0
      Self Powered
      Remote Wakeup
    MaxPower              500mA
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         0
      bInterfaceCount         2
      bFunctionClass          2 Communications
      bFunctionSubClass       2 Abstract (modem)
      bFunctionProtocol       1 AT-commands (v.25ter)
      iFunction               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface              0
      CDC Header:
        bcdCDC               1.10
      CDC ACM:
        bmCapabilities       0x02
          line coding and serial state
      CDC Call Management:
        bmCapabilities       0x03
          call management
          use DataInterface
        bDataInterface          1
      CDC Union:
        bMasterInterface        0
        bSlaveInterface         1
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         2
      bInterfaceCount         2
      bFunctionClass          2 Communications
      bFunctionSubClass       2 Abstract (modem)
      bFunctionProtocol       1 AT-commands (v.25ter)
      iFunction               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface              0
      CDC Header:
        bcdCDC               1.10
      CDC ACM:
        bmCapabilities       0x02
          line coding and serial state
      CDC Call Management:
        bmCapabilities       0x03
          call management
          use DataInterface
        bDataInterface          3
      CDC Union:
        bMasterInterface        2
        bSlaveInterface         3
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        3
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x84  EP 4 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         4
      bInterfaceCount         2
      bFunctionClass          2 Communications
      bFunctionSubClass       2 Abstract (modem)
      bFunctionProtocol       1 AT-commands (v.25ter)
      iFunction               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        4
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface              0
      CDC Header:
        bcdCDC               1.10
      CDC ACM:
        bmCapabilities       0x02
          line coding and serial state
      CDC Call Management:
        bmCapabilities       0x03
          call management
          use DataInterface
        bDataInterface          5
      CDC Union:
        bMasterInterface        4
        bSlaveInterface         5
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x85  EP 5 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        5
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x86  EP 6 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x03  EP 3 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         6
      bInterfaceCount         2
      bFunctionClass          2 Communications
      bFunctionSubClass       2 Abstract (modem)
      bFunctionProtocol       1 AT-commands (v.25ter)
      iFunction               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        6
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface              0
      CDC Header:
        bcdCDC               1.10
      CDC ACM:
        bmCapabilities       0x02
          line coding and serial state
      CDC Call Management:
        bmCapabilities       0x03
          call management
          use DataInterface
        bDataInterface          7
      CDC Union:
        bMasterInterface        6
        bSlaveInterface         7
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x87  EP 7 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        7
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x88  EP 8 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x04  EP 4 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        8
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x89  EP 9 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x8a  EP 10 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x05  EP 5 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass          239 Miscellaneous Device
  bDeviceSubClass         2 ?
  bDeviceProtocol         1 Interface Association
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0000
  (Bus Powered)

Cc: stable@vger.kernel.org
Signed-off-by: Giacinto Cifelli <gciofono@gmail.com>
Acked-by: Bjørn Mork <bjorn@mork.no>
Link: https://lore.kernel.org/r/20210120045650.10855-1-gciofono@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/qmi_wwan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 42303f3f1348..3f18faf99367 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -934,6 +934,7 @@ static const struct usb_device_id products[] = {
 	{QMI_FIXED_INTF(0x0b3c, 0xc00a, 6)},	/* Olivetti Olicard 160 */
 	{QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)},	/* Olivetti Olicard 500 */
 	{QMI_FIXED_INTF(0x1e2d, 0x0060, 4)},	/* Cinterion PLxx */
+	{QMI_QUIRK_SET_DTR(0x1e2d, 0x006f, 8)}, /* Cinterion PLS83/PLS63 */
 	{QMI_FIXED_INTF(0x1e2d, 0x0053, 4)},	/* Cinterion PHxx,PXxx */
 	{QMI_FIXED_INTF(0x1e2d, 0x0082, 4)},	/* Cinterion PHxx,PXxx (2 RmNet) */
 	{QMI_FIXED_INTF(0x1e2d, 0x0082, 5)},	/* Cinterion PHxx,PXxx (2 RmNet) */

From 6c32f90d80bd17fd50a2fc5e7f2369268e18d7e9 Mon Sep 17 00:00:00 2001
From: Like Xu <like.xu@linux.intel.com>
Date: Wed, 30 Dec 2020 16:19:16 +0800
Subject: [PATCH 1417/2658] KVM: x86/pmu: Fix HW_REF_CPU_CYCLES event
 pseudo-encoding in intel_arch_events[]

commit 98dd2f108e448988d91e296173e773b06fb978b8 upstream.

The HW_REF_CPU_CYCLES event on the fixed counter 2 is pseudo-encoded as
0x0300 in the intel_perfmon_event_map[]. Correct its usage.

Fixes: 62079d8a4312 ("KVM: PMU: add proper support for fixed counter 2")
Signed-off-by: Like Xu <like.xu@linux.intel.com>
Message-Id: <20201230081916.63417-1-like.xu@linux.intel.com>
Reviewed-by: Sean Christopherson <seanjc@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/pmu_intel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/pmu_intel.c b/arch/x86/kvm/pmu_intel.c
index 822829f00590..04890ac518d0 100644
--- a/arch/x86/kvm/pmu_intel.c
+++ b/arch/x86/kvm/pmu_intel.c
@@ -29,7 +29,7 @@ static struct kvm_event_hw_type_mapping intel_arch_events[] = {
 	[4] = { 0x2e, 0x41, PERF_COUNT_HW_CACHE_MISSES },
 	[5] = { 0xc4, 0x00, PERF_COUNT_HW_BRANCH_INSTRUCTIONS },
 	[6] = { 0xc5, 0x00, PERF_COUNT_HW_BRANCH_MISSES },
-	[7] = { 0x00, 0x30, PERF_COUNT_HW_REF_CPU_CYCLES },
+	[7] = { 0x00, 0x03, PERF_COUNT_HW_REF_CPU_CYCLES },
 };
 
 /* mapping between fixed pmc index and intel_arch_events array */

From 4f9abd345e9f94fc5c5a376224d887d621225ef4 Mon Sep 17 00:00:00 2001
From: Lorenzo Bianconi <lorenzo@kernel.org>
Date: Sun, 17 Jan 2021 22:46:01 +0100
Subject: [PATCH 1418/2658] mt7601u: fix kernel crash unplugging the device

commit 0acb20a5438c36e0cf2b8bf255f314b59fcca6ef upstream.

The following crash log can occur unplugging the usb dongle since,
after the urb poison in mt7601u_free_tx_queue(), usb_submit_urb() will
always fail resulting in a skb kfree while the skb has been already
queued.

Fix the issue enqueuing the skb only if usb_submit_urb() succeed.

Hardware name: Hewlett-Packard 500-539ng/2B2C, BIOS 80.06 04/01/2015
Workqueue: usb_hub_wq hub_event
RIP: 0010:skb_trim+0x2c/0x30
RSP: 0000:ffffb4c88005bba8 EFLAGS: 00010206
RAX: 000000004ad483ee RBX: ffff9a236625dee0 RCX: 000000000000662f
RDX: 000000000000000c RSI: 0000000000000000 RDI: ffff9a2343179300
RBP: ffff9a2343179300 R08: 0000000000000001 R09: 0000000000000000
R10: ffff9a23748f7840 R11: 0000000000000001 R12: ffff9a236625e4d4
R13: ffff9a236625dee0 R14: 0000000000001080 R15: 0000000000000008
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd410a34ef8 CR3: 00000001416ee001 CR4: 00000000001706f0
Call Trace:
 mt7601u_tx_status+0x3e/0xa0 [mt7601u]
 mt7601u_dma_cleanup+0xca/0x110 [mt7601u]
 mt7601u_cleanup+0x22/0x30 [mt7601u]
 mt7601u_disconnect+0x22/0x60 [mt7601u]
 usb_unbind_interface+0x8a/0x270
 ? kernfs_find_ns+0x35/0xd0
 __device_release_driver+0x17a/0x230
 device_release_driver+0x24/0x30
 bus_remove_device+0xdb/0x140
 device_del+0x18b/0x430
 ? kobject_put+0x98/0x1d0
 usb_disable_device+0xc6/0x1f0
 usb_disconnect.cold+0x7e/0x20a
 hub_event+0xbf3/0x1870
 process_one_work+0x1b6/0x350
 worker_thread+0x53/0x3e0
 ? process_one_work+0x350/0x350
 kthread+0x11b/0x140
 ? __kthread_bind_mask+0x60/0x60
 ret_from_fork+0x22/0x30

Fixes: 23377c200b2eb ("mt7601u: fix possible memory leak when the device is disconnected")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Acked-by: Jakub Kicinski <kubakici@wp.pl>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/3b85219f669a63a8ced1f43686de05915a580489.1610919247.git.lorenzo@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/mediatek/mt7601u/dma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c
index 3d0b9324d5bf..d94eb556f76d 100644
--- a/drivers/net/wireless/mediatek/mt7601u/dma.c
+++ b/drivers/net/wireless/mediatek/mt7601u/dma.c
@@ -318,7 +318,6 @@ static int mt7601u_dma_submit_tx(struct mt7601u_dev *dev,
 	}
 
 	e = &q->e[q->end];
-	e->skb = skb;
 	usb_fill_bulk_urb(e->urb, usb_dev, snd_pipe, skb->data, skb->len,
 			  mt7601u_complete_tx, q);
 	ret = usb_submit_urb(e->urb, GFP_ATOMIC);
@@ -336,6 +335,7 @@ static int mt7601u_dma_submit_tx(struct mt7601u_dev *dev,
 
 	q->end = (q->end + 1) % q->entries;
 	q->used++;
+	e->skb = skb;
 
 	if (q->used >= q->entries)
 		ieee80211_stop_queue(dev->hw, skb_get_queue_mapping(skb));

From d53ad2aac3590844a6bc24f47777c04a65ccf220 Mon Sep 17 00:00:00 2001
From: Lorenzo Bianconi <lorenzo@kernel.org>
Date: Thu, 14 Jan 2021 18:10:52 +0100
Subject: [PATCH 1419/2658] mt7601u: fix rx buffer refcounting

commit d24c790577ef01bfa01da2b131313a38c843a634 upstream.

Fix the following crash due to erroneous page refcounting:

[   32.445919] BUG: Bad page state in process swapper/1  pfn:11f65a
[   32.447409] page:00000000938f0632 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x11f65a
[   32.449605] flags: 0x8000000000000000()
[   32.450421] raw: 8000000000000000 ffffffff825b0148 ffffea00045ae988 0000000000000000
[   32.451795] raw: 0000000000000000 0000000000000001 00000000ffffff7f 0000000000000000
[   32.452999] page dumped because: nonzero mapcount
[   32.453888] Modules linked in:
[   32.454492] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.11.0-rc2+ #1976
[   32.455695] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-1.fc33 04/01/2014
[   32.457157] Call Trace:
[   32.457636]  <IRQ>
[   32.457993]  dump_stack+0x77/0x97
[   32.458576]  bad_page.cold+0x65/0x96
[   32.459198]  get_page_from_freelist+0x46a/0x11f0
[   32.460008]  __alloc_pages_nodemask+0x10a/0x2b0
[   32.460794]  mt7601u_rx_tasklet+0x651/0x720
[   32.461505]  tasklet_action_common.constprop.0+0x6b/0xd0
[   32.462343]  __do_softirq+0x152/0x46c
[   32.462928]  asm_call_irq_on_stack+0x12/0x20
[   32.463610]  </IRQ>
[   32.463953]  do_softirq_own_stack+0x5b/0x70
[   32.464582]  irq_exit_rcu+0x9f/0xe0
[   32.465028]  common_interrupt+0xae/0x1a0
[   32.465536]  asm_common_interrupt+0x1e/0x40
[   32.466071] RIP: 0010:default_idle+0x18/0x20
[   32.468981] RSP: 0018:ffffc90000077f00 EFLAGS: 00000246
[   32.469648] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
[   32.470550] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff81aac3dd
[   32.471463] RBP: ffff88810022ab00 R08: 0000000000000001 R09: 0000000000000001
[   32.472335] R10: 0000000000000046 R11: 0000000000005aa0 R12: 0000000000000000
[   32.473235] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   32.474139]  ? default_idle_call+0x4d/0x200
[   32.474681]  default_idle_call+0x74/0x200
[   32.475192]  do_idle+0x1d5/0x250
[   32.475612]  cpu_startup_entry+0x19/0x20
[   32.476114]  secondary_startup_64_no_verify+0xb0/0xbb
[   32.476765] Disabling lock debugging due to kernel taint

Fixes: c869f77d6abb ("add mt7601u driver")
Co-developed-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Acked-by: Jakub Kicinski <kubakici@wp.pl>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/62b2380c8c2091834cfad05e1059b55f945bd114.1610643952.git.lorenzo@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/mediatek/mt7601u/dma.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c
index d94eb556f76d..970aaf2ed3a7 100644
--- a/drivers/net/wireless/mediatek/mt7601u/dma.c
+++ b/drivers/net/wireless/mediatek/mt7601u/dma.c
@@ -160,8 +160,7 @@ mt7601u_rx_process_entry(struct mt7601u_dev *dev, struct mt7601u_dma_buf_rx *e)
 
 	if (new_p) {
 		/* we have one extra ref from the allocator */
-		__free_pages(e->p, MT_RX_ORDER);
-
+		put_page(e->p);
 		e->p = new_p;
 	}
 }

From 928154be5608752d043178d3fbbd59c9f4abf09a Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 1 Feb 2021 15:12:03 +0000
Subject: [PATCH 1420/2658] y2038: futex: Move compat implementation into
 futex.c

commit 04e7712f4460585e5eed5b853fd8b82a9943958f upstream.

We are going to share the compat_sys_futex() handler between 64-bit
architectures and 32-bit architectures that need to deal with both 32-bit
and 64-bit time_t, and this is easier if both entry points are in the
same file.

In fact, most other system call handlers do the same thing these days, so
let's follow the trend here and merge all of futex_compat.c into futex.c.

In the process, a few minor changes have to be done to make sure everything
still makes sense: handle_futex_death() and futex_cmpxchg_enabled() become
local symbol, and the compat version of the fetch_robust_entry() function
gets renamed to compat_fetch_robust_entry() to avoid a symbol clash.

This is intended as a purely cosmetic patch, no behavior should
change.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[Lee: Back-ported to satisfy a build dependency]
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/futex.h |   8 --
 kernel/Makefile       |   3 -
 kernel/futex.c        | 195 +++++++++++++++++++++++++++++++++++++++-
 kernel/futex_compat.c | 201 ------------------------------------------
 4 files changed, 192 insertions(+), 215 deletions(-)
 delete mode 100644 kernel/futex_compat.c

diff --git a/include/linux/futex.h b/include/linux/futex.h
index c015fa91e7cc..fb4e12cbe887 100644
--- a/include/linux/futex.h
+++ b/include/linux/futex.h
@@ -11,9 +11,6 @@ union ktime;
 long do_futex(u32 __user *uaddr, int op, u32 val, union ktime *timeout,
 	      u32 __user *uaddr2, u32 val2, u32 val3);
 
-extern int
-handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi);
-
 /*
  * Futexes are matched on equal values of this key.
  * The key type depends on whether it's a shared or private mapping.
@@ -58,11 +55,6 @@ union futex_key {
 #ifdef CONFIG_FUTEX
 extern void exit_robust_list(struct task_struct *curr);
 extern void exit_pi_state_list(struct task_struct *curr);
-#ifdef CONFIG_HAVE_FUTEX_CMPXCHG
-#define futex_cmpxchg_enabled 1
-#else
-extern int futex_cmpxchg_enabled;
-#endif
 #else
 static inline void exit_robust_list(struct task_struct *curr)
 {
diff --git a/kernel/Makefile b/kernel/Makefile
index 2dea801370f2..51a42c443e25 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -47,9 +47,6 @@ obj-$(CONFIG_PROFILING) += profile.o
 obj-$(CONFIG_STACKTRACE) += stacktrace.o
 obj-y += time/
 obj-$(CONFIG_FUTEX) += futex.o
-ifeq ($(CONFIG_COMPAT),y)
-obj-$(CONFIG_FUTEX) += futex_compat.o
-endif
 obj-$(CONFIG_GENERIC_ISA_DMA) += dma.o
 obj-$(CONFIG_SMP) += smp.o
 ifneq ($(CONFIG_SMP),y)
diff --git a/kernel/futex.c b/kernel/futex.c
index 7dfbc693b303..ef0b04cdfb69 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -44,6 +44,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
+#include <linux/compat.h>
 #include <linux/slab.h>
 #include <linux/poll.h>
 #include <linux/fs.h>
@@ -171,8 +172,10 @@
  * double_lock_hb() and double_unlock_hb(), respectively.
  */
 
-#ifndef CONFIG_HAVE_FUTEX_CMPXCHG
-int __read_mostly futex_cmpxchg_enabled;
+#ifdef CONFIG_HAVE_FUTEX_CMPXCHG
+#define futex_cmpxchg_enabled 1
+#else
+static int  __read_mostly futex_cmpxchg_enabled;
 #endif
 
 /*
@@ -3088,7 +3091,7 @@ SYSCALL_DEFINE3(get_robust_list, int, pid,
  * Process a futex-list entry, check whether it's owned by the
  * dying task, and do notification if so:
  */
-int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi)
+static int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi)
 {
 	u32 uval, uninitialized_var(nval), mval;
 
@@ -3318,6 +3321,192 @@ SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val,
 	return do_futex(uaddr, op, val, tp, uaddr2, val2, val3);
 }
 
+#ifdef CONFIG_COMPAT
+/*
+ * Fetch a robust-list pointer. Bit 0 signals PI futexes:
+ */
+static inline int
+compat_fetch_robust_entry(compat_uptr_t *uentry, struct robust_list __user **entry,
+		   compat_uptr_t __user *head, unsigned int *pi)
+{
+	if (get_user(*uentry, head))
+		return -EFAULT;
+
+	*entry = compat_ptr((*uentry) & ~1);
+	*pi = (unsigned int)(*uentry) & 1;
+
+	return 0;
+}
+
+static void __user *futex_uaddr(struct robust_list __user *entry,
+				compat_long_t futex_offset)
+{
+	compat_uptr_t base = ptr_to_compat(entry);
+	void __user *uaddr = compat_ptr(base + futex_offset);
+
+	return uaddr;
+}
+
+/*
+ * Walk curr->robust_list (very carefully, it's a userspace list!)
+ * and mark any locks found there dead, and notify any waiters.
+ *
+ * We silently return on any sign of list-walking problem.
+ */
+void compat_exit_robust_list(struct task_struct *curr)
+{
+	struct compat_robust_list_head __user *head = curr->compat_robust_list;
+	struct robust_list __user *entry, *next_entry, *pending;
+	unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
+	unsigned int uninitialized_var(next_pi);
+	compat_uptr_t uentry, next_uentry, upending;
+	compat_long_t futex_offset;
+	int rc;
+
+	if (!futex_cmpxchg_enabled)
+		return;
+
+	/*
+	 * Fetch the list head (which was registered earlier, via
+	 * sys_set_robust_list()):
+	 */
+	if (compat_fetch_robust_entry(&uentry, &entry, &head->list.next, &pi))
+		return;
+	/*
+	 * Fetch the relative futex offset:
+	 */
+	if (get_user(futex_offset, &head->futex_offset))
+		return;
+	/*
+	 * Fetch any possibly pending lock-add first, and handle it
+	 * if it exists:
+	 */
+	if (compat_fetch_robust_entry(&upending, &pending,
+			       &head->list_op_pending, &pip))
+		return;
+
+	next_entry = NULL;	/* avoid warning with gcc */
+	while (entry != (struct robust_list __user *) &head->list) {
+		/*
+		 * Fetch the next entry in the list before calling
+		 * handle_futex_death:
+		 */
+		rc = compat_fetch_robust_entry(&next_uentry, &next_entry,
+			(compat_uptr_t __user *)&entry->next, &next_pi);
+		/*
+		 * A pending lock might already be on the list, so
+		 * dont process it twice:
+		 */
+		if (entry != pending) {
+			void __user *uaddr = futex_uaddr(entry, futex_offset);
+
+			if (handle_futex_death(uaddr, curr, pi))
+				return;
+		}
+		if (rc)
+			return;
+		uentry = next_uentry;
+		entry = next_entry;
+		pi = next_pi;
+		/*
+		 * Avoid excessively long or circular lists:
+		 */
+		if (!--limit)
+			break;
+
+		cond_resched();
+	}
+	if (pending) {
+		void __user *uaddr = futex_uaddr(pending, futex_offset);
+
+		handle_futex_death(uaddr, curr, pip);
+	}
+}
+
+COMPAT_SYSCALL_DEFINE2(set_robust_list,
+		struct compat_robust_list_head __user *, head,
+		compat_size_t, len)
+{
+	if (!futex_cmpxchg_enabled)
+		return -ENOSYS;
+
+	if (unlikely(len != sizeof(*head)))
+		return -EINVAL;
+
+	current->compat_robust_list = head;
+
+	return 0;
+}
+
+COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
+			compat_uptr_t __user *, head_ptr,
+			compat_size_t __user *, len_ptr)
+{
+	struct compat_robust_list_head __user *head;
+	unsigned long ret;
+	struct task_struct *p;
+
+	if (!futex_cmpxchg_enabled)
+		return -ENOSYS;
+
+	rcu_read_lock();
+
+	ret = -ESRCH;
+	if (!pid)
+		p = current;
+	else {
+		p = find_task_by_vpid(pid);
+		if (!p)
+			goto err_unlock;
+	}
+
+	ret = -EPERM;
+	if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+		goto err_unlock;
+
+	head = p->compat_robust_list;
+	rcu_read_unlock();
+
+	if (put_user(sizeof(*head), len_ptr))
+		return -EFAULT;
+	return put_user(ptr_to_compat(head), head_ptr);
+
+err_unlock:
+	rcu_read_unlock();
+
+	return ret;
+}
+
+COMPAT_SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val,
+		struct compat_timespec __user *, utime, u32 __user *, uaddr2,
+		u32, val3)
+{
+	struct timespec ts;
+	ktime_t t, *tp = NULL;
+	int val2 = 0;
+	int cmd = op & FUTEX_CMD_MASK;
+
+	if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI ||
+		      cmd == FUTEX_WAIT_BITSET ||
+		      cmd == FUTEX_WAIT_REQUEUE_PI)) {
+		if (compat_get_timespec(&ts, utime))
+			return -EFAULT;
+		if (!timespec_valid(&ts))
+			return -EINVAL;
+
+		t = timespec_to_ktime(ts);
+		if (cmd == FUTEX_WAIT)
+			t = ktime_add_safe(ktime_get(), t);
+		tp = &t;
+	}
+	if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE ||
+	    cmd == FUTEX_CMP_REQUEUE_PI || cmd == FUTEX_WAKE_OP)
+		val2 = (int) (unsigned long) utime;
+
+	return do_futex(uaddr, op, val, tp, uaddr2, val2, val3);
+}
+#endif /* CONFIG_COMPAT */
+
 static void __init futex_detect_cmpxchg(void)
 #if defined(__clang__) && IS_ENABLED(CONFIG_ARM64)
 __attribute__((optnone))
diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
deleted file mode 100644
index 4ae3232e7a28..000000000000
--- a/kernel/futex_compat.c
+++ /dev/null
@@ -1,201 +0,0 @@
-/*
- * linux/kernel/futex_compat.c
- *
- * Futex compatibililty routines.
- *
- * Copyright 2006, Red Hat, Inc., Ingo Molnar
- */
-
-#include <linux/linkage.h>
-#include <linux/compat.h>
-#include <linux/nsproxy.h>
-#include <linux/futex.h>
-#include <linux/ptrace.h>
-#include <linux/syscalls.h>
-
-#include <asm/uaccess.h>
-
-
-/*
- * Fetch a robust-list pointer. Bit 0 signals PI futexes:
- */
-static inline int
-fetch_robust_entry(compat_uptr_t *uentry, struct robust_list __user **entry,
-		   compat_uptr_t __user *head, unsigned int *pi)
-{
-	if (get_user(*uentry, head))
-		return -EFAULT;
-
-	*entry = compat_ptr((*uentry) & ~1);
-	*pi = (unsigned int)(*uentry) & 1;
-
-	return 0;
-}
-
-static void __user *futex_uaddr(struct robust_list __user *entry,
-				compat_long_t futex_offset)
-{
-	compat_uptr_t base = ptr_to_compat(entry);
-	void __user *uaddr = compat_ptr(base + futex_offset);
-
-	return uaddr;
-}
-
-/*
- * Walk curr->robust_list (very carefully, it's a userspace list!)
- * and mark any locks found there dead, and notify any waiters.
- *
- * We silently return on any sign of list-walking problem.
- */
-void compat_exit_robust_list(struct task_struct *curr)
-{
-	struct compat_robust_list_head __user *head = curr->compat_robust_list;
-	struct robust_list __user *entry, *next_entry, *pending;
-	unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
-	unsigned int uninitialized_var(next_pi);
-	compat_uptr_t uentry, next_uentry, upending;
-	compat_long_t futex_offset;
-	int rc;
-
-	if (!futex_cmpxchg_enabled)
-		return;
-
-	/*
-	 * Fetch the list head (which was registered earlier, via
-	 * sys_set_robust_list()):
-	 */
-	if (fetch_robust_entry(&uentry, &entry, &head->list.next, &pi))
-		return;
-	/*
-	 * Fetch the relative futex offset:
-	 */
-	if (get_user(futex_offset, &head->futex_offset))
-		return;
-	/*
-	 * Fetch any possibly pending lock-add first, and handle it
-	 * if it exists:
-	 */
-	if (fetch_robust_entry(&upending, &pending,
-			       &head->list_op_pending, &pip))
-		return;
-
-	next_entry = NULL;	/* avoid warning with gcc */
-	while (entry != (struct robust_list __user *) &head->list) {
-		/*
-		 * Fetch the next entry in the list before calling
-		 * handle_futex_death:
-		 */
-		rc = fetch_robust_entry(&next_uentry, &next_entry,
-			(compat_uptr_t __user *)&entry->next, &next_pi);
-		/*
-		 * A pending lock might already be on the list, so
-		 * dont process it twice:
-		 */
-		if (entry != pending) {
-			void __user *uaddr = futex_uaddr(entry, futex_offset);
-
-			if (handle_futex_death(uaddr, curr, pi))
-				return;
-		}
-		if (rc)
-			return;
-		uentry = next_uentry;
-		entry = next_entry;
-		pi = next_pi;
-		/*
-		 * Avoid excessively long or circular lists:
-		 */
-		if (!--limit)
-			break;
-
-		cond_resched();
-	}
-	if (pending) {
-		void __user *uaddr = futex_uaddr(pending, futex_offset);
-
-		handle_futex_death(uaddr, curr, pip);
-	}
-}
-
-COMPAT_SYSCALL_DEFINE2(set_robust_list,
-		struct compat_robust_list_head __user *, head,
-		compat_size_t, len)
-{
-	if (!futex_cmpxchg_enabled)
-		return -ENOSYS;
-
-	if (unlikely(len != sizeof(*head)))
-		return -EINVAL;
-
-	current->compat_robust_list = head;
-
-	return 0;
-}
-
-COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
-			compat_uptr_t __user *, head_ptr,
-			compat_size_t __user *, len_ptr)
-{
-	struct compat_robust_list_head __user *head;
-	unsigned long ret;
-	struct task_struct *p;
-
-	if (!futex_cmpxchg_enabled)
-		return -ENOSYS;
-
-	rcu_read_lock();
-
-	ret = -ESRCH;
-	if (!pid)
-		p = current;
-	else {
-		p = find_task_by_vpid(pid);
-		if (!p)
-			goto err_unlock;
-	}
-
-	ret = -EPERM;
-	if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
-		goto err_unlock;
-
-	head = p->compat_robust_list;
-	rcu_read_unlock();
-
-	if (put_user(sizeof(*head), len_ptr))
-		return -EFAULT;
-	return put_user(ptr_to_compat(head), head_ptr);
-
-err_unlock:
-	rcu_read_unlock();
-
-	return ret;
-}
-
-COMPAT_SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val,
-		struct compat_timespec __user *, utime, u32 __user *, uaddr2,
-		u32, val3)
-{
-	struct timespec ts;
-	ktime_t t, *tp = NULL;
-	int val2 = 0;
-	int cmd = op & FUTEX_CMD_MASK;
-
-	if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI ||
-		      cmd == FUTEX_WAIT_BITSET ||
-		      cmd == FUTEX_WAIT_REQUEUE_PI)) {
-		if (compat_get_timespec(&ts, utime))
-			return -EFAULT;
-		if (!timespec_valid(&ts))
-			return -EINVAL;
-
-		t = timespec_to_ktime(ts);
-		if (cmd == FUTEX_WAIT)
-			t = ktime_add_safe(ktime_get(), t);
-		tp = &t;
-	}
-	if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE ||
-	    cmd == FUTEX_CMP_REQUEUE_PI || cmd == FUTEX_WAKE_OP)
-		val2 = (int) (unsigned long) utime;
-
-	return do_futex(uaddr, op, val, tp, uaddr2, val2, val3);
-}

From 07581a6363e1c39a04c0a1bcf95a8db11afb3d50 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 1 Feb 2021 15:12:04 +0000
Subject: [PATCH 1421/2658] futex: Move futex exit handling into futex code

commit ba31c1a48538992316cc71ce94fa9cd3e7b427c0 upstream.

The futex exit handling is #ifdeffed into mm_release() which is not pretty
to begin with. But upcoming changes to address futex exit races need to add
more functionality to this exit code.

Split it out into a function, move it into futex code and make the various
futex exit functions static.

Preparatory only and no functional change.

Folded build fix from Borislav.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20191106224556.049705556@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/compat.h |  2 --
 include/linux/futex.h  | 24 +++++++++++++++++-------
 kernel/fork.c          | 25 +++----------------------
 kernel/futex.c         | 28 ++++++++++++++++++++++++++--
 4 files changed, 46 insertions(+), 33 deletions(-)

diff --git a/include/linux/compat.h b/include/linux/compat.h
index a76c9172b2eb..24dd42910d7c 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -306,8 +306,6 @@ struct compat_kexec_segment;
 struct compat_mq_attr;
 struct compat_msgbuf;
 
-extern void compat_exit_robust_list(struct task_struct *curr);
-
 asmlinkage long
 compat_sys_set_robust_list(struct compat_robust_list_head __user *head,
 			   compat_size_t len);
diff --git a/include/linux/futex.h b/include/linux/futex.h
index fb4e12cbe887..63d353cedfcd 100644
--- a/include/linux/futex.h
+++ b/include/linux/futex.h
@@ -1,6 +1,8 @@
 #ifndef _LINUX_FUTEX_H
 #define _LINUX_FUTEX_H
 
+#include <linux/sched.h>
+
 #include <uapi/linux/futex.h>
 
 struct inode;
@@ -53,14 +55,22 @@ union futex_key {
 #define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = 0ULL } }
 
 #ifdef CONFIG_FUTEX
-extern void exit_robust_list(struct task_struct *curr);
-extern void exit_pi_state_list(struct task_struct *curr);
-#else
-static inline void exit_robust_list(struct task_struct *curr)
-{
-}
-static inline void exit_pi_state_list(struct task_struct *curr)
+static inline void futex_init_task(struct task_struct *tsk)
 {
+	tsk->robust_list = NULL;
+#ifdef CONFIG_COMPAT
+	tsk->compat_robust_list = NULL;
+#endif
+	INIT_LIST_HEAD(&tsk->pi_state_list);
+	tsk->pi_state_cache = NULL;
 }
+
+void futex_mm_release(struct task_struct *tsk);
+
+long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
+	      u32 __user *uaddr2, u32 val2, u32 val3);
+#else
+static inline void futex_init_task(struct task_struct *tsk) { }
+static inline void futex_mm_release(struct task_struct *tsk) { }
 #endif
 #endif
diff --git a/kernel/fork.c b/kernel/fork.c
index d80f45c20690..357ca2560e70 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -926,20 +926,7 @@ static int wait_for_vfork_done(struct task_struct *child,
 void mm_release(struct task_struct *tsk, struct mm_struct *mm)
 {
 	/* Get rid of any futexes when releasing the mm */
-#ifdef CONFIG_FUTEX
-	if (unlikely(tsk->robust_list)) {
-		exit_robust_list(tsk);
-		tsk->robust_list = NULL;
-	}
-#ifdef CONFIG_COMPAT
-	if (unlikely(tsk->compat_robust_list)) {
-		compat_exit_robust_list(tsk);
-		tsk->compat_robust_list = NULL;
-	}
-#endif
-	if (unlikely(!list_empty(&tsk->pi_state_list)))
-		exit_pi_state_list(tsk);
-#endif
+	futex_mm_release(tsk);
 
 	uprobe_free_utask(tsk);
 
@@ -1551,14 +1538,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 #ifdef CONFIG_BLOCK
 	p->plug = NULL;
 #endif
-#ifdef CONFIG_FUTEX
-	p->robust_list = NULL;
-#ifdef CONFIG_COMPAT
-	p->compat_robust_list = NULL;
-#endif
-	INIT_LIST_HEAD(&p->pi_state_list);
-	p->pi_state_cache = NULL;
-#endif
+	futex_init_task(p);
+
 	/*
 	 * sigaltstack should be cleared when sharing the same VM
 	 */
diff --git a/kernel/futex.c b/kernel/futex.c
index ef0b04cdfb69..e8d4407b69e1 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -331,6 +331,12 @@ static inline bool should_fail_futex(bool fshared)
 }
 #endif /* CONFIG_FAIL_FUTEX */
 
+#ifdef CONFIG_COMPAT
+static void compat_exit_robust_list(struct task_struct *curr);
+#else
+static inline void compat_exit_robust_list(struct task_struct *curr) { }
+#endif
+
 static inline void futex_get_mm(union futex_key *key)
 {
 	atomic_inc(&key->private.mm->mm_count);
@@ -889,7 +895,7 @@ static struct task_struct * futex_find_get_task(pid_t pid)
  * Kernel cleans up PI-state, but userspace is likely hosed.
  * (Robust-futex cleanup is separate and might save the day for userspace.)
  */
-void exit_pi_state_list(struct task_struct *curr)
+static void exit_pi_state_list(struct task_struct *curr)
 {
 	struct list_head *next, *head = &curr->pi_state_list;
 	struct futex_pi_state *pi_state;
@@ -3166,7 +3172,7 @@ static inline int fetch_robust_entry(struct robust_list __user **entry,
  *
  * We silently return on any sign of list-walking problem.
  */
-void exit_robust_list(struct task_struct *curr)
+static void exit_robust_list(struct task_struct *curr)
 {
 	struct robust_list_head __user *head = curr->robust_list;
 	struct robust_list __user *entry, *next_entry, *pending;
@@ -3229,6 +3235,24 @@ void exit_robust_list(struct task_struct *curr)
 				   curr, pip);
 }
 
+void futex_mm_release(struct task_struct *tsk)
+{
+	if (unlikely(tsk->robust_list)) {
+		exit_robust_list(tsk);
+		tsk->robust_list = NULL;
+	}
+
+#ifdef CONFIG_COMPAT
+	if (unlikely(tsk->compat_robust_list)) {
+		compat_exit_robust_list(tsk);
+		tsk->compat_robust_list = NULL;
+	}
+#endif
+
+	if (unlikely(!list_empty(&tsk->pi_state_list)))
+		exit_pi_state_list(tsk);
+}
+
 long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
 		u32 __user *uaddr2, u32 val2, u32 val3)
 {

From f9f01e6a4b42b03570b76d44a29fe7f4eade1dde Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 1 Feb 2021 15:12:05 +0000
Subject: [PATCH 1422/2658] futex: Replace PF_EXITPIDONE with a state

commit 3d4775df0a89240f671861c6ab6e8d59af8e9e41 upstream.

The futex exit handling relies on PF_ flags. That's suboptimal as it
requires a smp_mb() and an ugly lock/unlock of the exiting tasks pi_lock in
the middle of do_exit() to enforce the observability of PF_EXITING in the
futex code.

Add a futex_state member to task_struct and convert the PF_EXITPIDONE logic
over to the new state. The PF_EXITING dependency will be cleaned up in a
later step.

This prepares for handling various futex exit issues later.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20191106224556.149449274@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/futex.h | 34 ++++++++++++++++++++++++++++++++++
 include/linux/sched.h |  2 +-
 kernel/exit.c         | 18 ++----------------
 kernel/futex.c        | 17 ++++++++---------
 4 files changed, 45 insertions(+), 26 deletions(-)

diff --git a/include/linux/futex.h b/include/linux/futex.h
index 63d353cedfcd..a0de6fe28e00 100644
--- a/include/linux/futex.h
+++ b/include/linux/futex.h
@@ -55,6 +55,11 @@ union futex_key {
 #define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = 0ULL } }
 
 #ifdef CONFIG_FUTEX
+enum {
+	FUTEX_STATE_OK,
+	FUTEX_STATE_DEAD,
+};
+
 static inline void futex_init_task(struct task_struct *tsk)
 {
 	tsk->robust_list = NULL;
@@ -63,6 +68,34 @@ static inline void futex_init_task(struct task_struct *tsk)
 #endif
 	INIT_LIST_HEAD(&tsk->pi_state_list);
 	tsk->pi_state_cache = NULL;
+	tsk->futex_state = FUTEX_STATE_OK;
+}
+
+/**
+ * futex_exit_done - Sets the tasks futex state to FUTEX_STATE_DEAD
+ * @tsk:	task to set the state on
+ *
+ * Set the futex exit state of the task lockless. The futex waiter code
+ * observes that state when a task is exiting and loops until the task has
+ * actually finished the futex cleanup. The worst case for this is that the
+ * waiter runs through the wait loop until the state becomes visible.
+ *
+ * This has two callers:
+ *
+ * - futex_mm_release() after the futex exit cleanup has been done
+ *
+ * - do_exit() from the recursive fault handling path.
+ *
+ * In case of a recursive fault this is best effort. Either the futex exit
+ * code has run already or not. If the OWNER_DIED bit has been set on the
+ * futex then the waiter can take it over. If not, the problem is pushed
+ * back to user space. If the futex exit code did not run yet, then an
+ * already queued waiter might block forever, but there is nothing which
+ * can be done about that.
+ */
+static inline void futex_exit_done(struct task_struct *tsk)
+{
+	tsk->futex_state = FUTEX_STATE_DEAD;
 }
 
 void futex_mm_release(struct task_struct *tsk);
@@ -72,5 +105,6 @@ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
 #else
 static inline void futex_init_task(struct task_struct *tsk) { }
 static inline void futex_mm_release(struct task_struct *tsk) { }
+static inline void futex_exit_done(struct task_struct *tsk) { }
 #endif
 #endif
diff --git a/include/linux/sched.h b/include/linux/sched.h
index fc408502043a..515851d2a2bb 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1947,6 +1947,7 @@ struct task_struct {
 #endif
 	struct list_head pi_state_list;
 	struct futex_pi_state *pi_state_cache;
+	unsigned int futex_state;
 #endif
 #ifdef CONFIG_PERF_EVENTS
 	struct perf_event_context *perf_event_ctxp[perf_nr_task_contexts];
@@ -2355,7 +2356,6 @@ extern void thread_group_cputime_adjusted(struct task_struct *p, cputime_t *ut,
  */
 #define PF_WAKE_UP_IDLE 0x00000002	/* try to wake up on an idle CPU */
 #define PF_EXITING	0x00000004	/* getting shut down */
-#define PF_EXITPIDONE	0x00000008	/* pi exit done on shut down */
 #define PF_VCPU		0x00000010	/* I'm a virtual CPU */
 #define PF_WQ_WORKER	0x00000020	/* I'm a workqueue worker */
 #define PF_FORKNOEXEC	0x00000040	/* forked but didn't exec */
diff --git a/kernel/exit.c b/kernel/exit.c
index 09e7723c7483..109d30ab146a 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -710,16 +710,7 @@ void do_exit(long code)
 	 */
 	if (unlikely(tsk->flags & PF_EXITING)) {
 		pr_alert("Fixing recursive fault but reboot is needed!\n");
-		/*
-		 * We can do this unlocked here. The futex code uses
-		 * this flag just to verify whether the pi state
-		 * cleanup has been done or not. In the worst case it
-		 * loops once more. We pretend that the cleanup was
-		 * done as there is no way to return. Either the
-		 * OWNER_DIED bit is set by now or we push the blocked
-		 * task into the wait for ever nirwana as well.
-		 */
-		tsk->flags |= PF_EXITPIDONE;
+		futex_exit_done(tsk);
 		set_current_state(TASK_UNINTERRUPTIBLE);
 		schedule();
 	}
@@ -812,12 +803,7 @@ void do_exit(long code)
 	 * Make sure we are holding no locks:
 	 */
 	debug_check_no_locks_held();
-	/*
-	 * We can do this unlocked here. The futex code uses this flag
-	 * just to verify whether the pi state cleanup has been done
-	 * or not. In the worst case it loops once more.
-	 */
-	tsk->flags |= PF_EXITPIDONE;
+	futex_exit_done(tsk);
 
 	if (tsk->io_context)
 		exit_io_context(tsk);
diff --git a/kernel/futex.c b/kernel/futex.c
index e8d4407b69e1..7a252c18ce4e 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1094,19 +1094,18 @@ static int attach_to_pi_owner(u32 uval, union futex_key *key,
 	}
 
 	/*
-	 * We need to look at the task state flags to figure out,
-	 * whether the task is exiting. To protect against the do_exit
-	 * change of the task flags, we do this protected by
-	 * p->pi_lock:
+	 * We need to look at the task state to figure out, whether the
+	 * task is exiting. To protect against the change of the task state
+	 * in futex_exit_release(), we do this protected by p->pi_lock:
 	 */
 	raw_spin_lock_irq(&p->pi_lock);
-	if (unlikely(p->flags & PF_EXITING)) {
+	if (unlikely(p->futex_state != FUTEX_STATE_OK)) {
 		/*
-		 * The task is on the way out. When PF_EXITPIDONE is
-		 * set, we know that the task has finished the
-		 * cleanup:
+		 * The task is on the way out. When the futex state is
+		 * FUTEX_STATE_DEAD, we know that the task has finished
+		 * the cleanup:
 		 */
-		int ret = (p->flags & PF_EXITPIDONE) ? -ESRCH : -EAGAIN;
+		int ret = (p->futex_state = FUTEX_STATE_DEAD) ? -ESRCH : -EAGAIN;
 
 		raw_spin_unlock_irq(&p->pi_lock);
 		put_task_struct(p);

From 04b55d0344dcc91180c4262a76134369f126ee69 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 1 Feb 2021 15:12:06 +0000
Subject: [PATCH 1423/2658] exit/exec: Seperate mm_release()

commit 4610ba7ad877fafc0a25a30c6c82015304120426 upstream.

mm_release() contains the futex exit handling. mm_release() is called from
do_exit()->exit_mm() and from exec()->exec_mm().

In the exit_mm() case PF_EXITING and the futex state is updated. In the
exec_mm() case these states are not touched.

As the futex exit code needs further protections against exit races, this
needs to be split into two functions.

Preparatory only, no functional change.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20191106224556.240518241@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/exec.c             |  2 +-
 include/linux/sched.h |  6 ++++--
 kernel/exit.c         |  2 +-
 kernel/fork.c         | 12 +++++++++++-
 4 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/fs/exec.c b/fs/exec.c
index 84b6c88fcc7a..341b872d758f 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -875,7 +875,7 @@ static int exec_mmap(struct mm_struct *mm)
 	/* Notify parent that we're no longer interested in the old VM */
 	tsk = current;
 	old_mm = current->mm;
-	mm_release(tsk, old_mm);
+	exec_mm_release(tsk, old_mm);
 
 	if (old_mm) {
 		sync_mm_rss(old_mm);
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 515851d2a2bb..91f74fc0aa50 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -3021,8 +3021,10 @@ extern struct mm_struct *get_task_mm(struct task_struct *task);
  * succeeds.
  */
 extern struct mm_struct *mm_access(struct task_struct *task, unsigned int mode);
-/* Remove the current tasks stale references to the old mm_struct */
-extern void mm_release(struct task_struct *, struct mm_struct *);
+/* Remove the current tasks stale references to the old mm_struct on exit() */
+extern void exit_mm_release(struct task_struct *, struct mm_struct *);
+/* Remove the current tasks stale references to the old mm_struct on exec() */
+extern void exec_mm_release(struct task_struct *, struct mm_struct *);
 
 #ifdef CONFIG_HAVE_COPY_THREAD_TLS
 extern int copy_thread_tls(unsigned long, unsigned long, unsigned long,
diff --git a/kernel/exit.c b/kernel/exit.c
index 109d30ab146a..bbed0f4987e5 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -394,7 +394,7 @@ static void exit_mm(struct task_struct *tsk)
 	struct core_state *core_state;
 	int mm_released;
 
-	mm_release(tsk, mm);
+	exit_mm_release(tsk, mm);
 	if (!mm)
 		return;
 	sync_mm_rss(mm);
diff --git a/kernel/fork.c b/kernel/fork.c
index 357ca2560e70..edd7333c9e52 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -923,7 +923,7 @@ static int wait_for_vfork_done(struct task_struct *child,
  * restoring the old one. . .
  * Eric Biederman 10 January 1998
  */
-void mm_release(struct task_struct *tsk, struct mm_struct *mm)
+static void mm_release(struct task_struct *tsk, struct mm_struct *mm)
 {
 	/* Get rid of any futexes when releasing the mm */
 	futex_mm_release(tsk);
@@ -960,6 +960,16 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
 		complete_vfork_done(tsk);
 }
 
+void exit_mm_release(struct task_struct *tsk, struct mm_struct *mm)
+{
+	mm_release(tsk, mm);
+}
+
+void exec_mm_release(struct task_struct *tsk, struct mm_struct *mm)
+{
+	mm_release(tsk, mm);
+}
+
 /*
  * Allocate a new mm structure and copy contents from the
  * mm structure of the passed in task structure.

From f1d9c83332973ac1de374de386ff48e3b130a60d Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 1 Feb 2021 15:12:07 +0000
Subject: [PATCH 1424/2658] futex: Split futex_mm_release() for exit/exec

commit 150d71584b12809144b8145b817e83b81158ae5f upstream.

To allow separate handling of the futex exit state in the futex exit code
for exit and exec, split futex_mm_release() into two functions and invoke
them from the corresponding exit/exec_mm_release() callsites.

Preparatory only, no functional change.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20191106224556.332094221@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/futex.h | 6 ++++--
 kernel/fork.c         | 5 ++---
 kernel/futex.c        | 7 ++++++-
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/include/linux/futex.h b/include/linux/futex.h
index a0de6fe28e00..063a5cd00d77 100644
--- a/include/linux/futex.h
+++ b/include/linux/futex.h
@@ -98,13 +98,15 @@ static inline void futex_exit_done(struct task_struct *tsk)
 	tsk->futex_state = FUTEX_STATE_DEAD;
 }
 
-void futex_mm_release(struct task_struct *tsk);
+void futex_exit_release(struct task_struct *tsk);
+void futex_exec_release(struct task_struct *tsk);
 
 long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
 	      u32 __user *uaddr2, u32 val2, u32 val3);
 #else
 static inline void futex_init_task(struct task_struct *tsk) { }
-static inline void futex_mm_release(struct task_struct *tsk) { }
 static inline void futex_exit_done(struct task_struct *tsk) { }
+static inline void futex_exit_release(struct task_struct *tsk) { }
+static inline void futex_exec_release(struct task_struct *tsk) { }
 #endif
 #endif
diff --git a/kernel/fork.c b/kernel/fork.c
index edd7333c9e52..b6dc57517ba2 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -925,9 +925,6 @@ static int wait_for_vfork_done(struct task_struct *child,
  */
 static void mm_release(struct task_struct *tsk, struct mm_struct *mm)
 {
-	/* Get rid of any futexes when releasing the mm */
-	futex_mm_release(tsk);
-
 	uprobe_free_utask(tsk);
 
 	/* Get rid of any cached register state */
@@ -962,11 +959,13 @@ static void mm_release(struct task_struct *tsk, struct mm_struct *mm)
 
 void exit_mm_release(struct task_struct *tsk, struct mm_struct *mm)
 {
+	futex_exit_release(tsk);
 	mm_release(tsk, mm);
 }
 
 void exec_mm_release(struct task_struct *tsk, struct mm_struct *mm)
 {
+	futex_exec_release(tsk);
 	mm_release(tsk, mm);
 }
 
diff --git a/kernel/futex.c b/kernel/futex.c
index 7a252c18ce4e..9d0c2b06c2cd 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -3234,7 +3234,7 @@ static void exit_robust_list(struct task_struct *curr)
 				   curr, pip);
 }
 
-void futex_mm_release(struct task_struct *tsk)
+void futex_exec_release(struct task_struct *tsk)
 {
 	if (unlikely(tsk->robust_list)) {
 		exit_robust_list(tsk);
@@ -3252,6 +3252,11 @@ void futex_mm_release(struct task_struct *tsk)
 		exit_pi_state_list(tsk);
 }
 
+void futex_exit_release(struct task_struct *tsk)
+{
+	futex_exec_release(tsk);
+}
+
 long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
 		u32 __user *uaddr2, u32 val2, u32 val3)
 {

From a10d506860d5121a7b0674076a3835f27ac7394f Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 1 Feb 2021 15:12:08 +0000
Subject: [PATCH 1425/2658] futex: Set task::futex_state to DEAD right after
 handling futex exit

commit f24f22435dcc11389acc87e5586239c1819d217c upstream.

Setting task::futex_state in do_exit() is rather arbitrarily placed for no
reason. Move it into the futex code.

Note, this is only done for the exit cleanup as the exec cleanup cannot set
the state to FUTEX_STATE_DEAD because the task struct is still in active
use.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20191106224556.439511191@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/exit.c  | 1 -
 kernel/futex.c | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/exit.c b/kernel/exit.c
index bbed0f4987e5..dce0623f520e 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -803,7 +803,6 @@ void do_exit(long code)
 	 * Make sure we are holding no locks:
 	 */
 	debug_check_no_locks_held();
-	futex_exit_done(tsk);
 
 	if (tsk->io_context)
 		exit_io_context(tsk);
diff --git a/kernel/futex.c b/kernel/futex.c
index 9d0c2b06c2cd..f169b9e401cb 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -3255,6 +3255,7 @@ void futex_exec_release(struct task_struct *tsk)
 void futex_exit_release(struct task_struct *tsk)
 {
 	futex_exec_release(tsk);
+	futex_exit_done(tsk);
 }
 
 long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,

From 1a477fcc260c03a294c1eea174f43e0ebdf975eb Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 1 Feb 2021 15:12:09 +0000
Subject: [PATCH 1426/2658] futex: Mark the begin of futex exit explicitly

commit 18f694385c4fd77a09851fd301236746ca83f3cb upstream.

Instead of relying on PF_EXITING use an explicit state for the futex exit
and set it in the futex exit function. This moves the smp barrier and the
lock/unlock serialization into the futex code.

As with the DEAD state this is restricted to the exit path as exec
continues to use the same task struct.

This allows to simplify that logic in a next step.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20191106224556.539409004@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/futex.h | 31 +++----------------------------
 kernel/exit.c         | 12 +-----------
 kernel/futex.c        | 37 ++++++++++++++++++++++++++++++++++++-
 3 files changed, 40 insertions(+), 40 deletions(-)

diff --git a/include/linux/futex.h b/include/linux/futex.h
index 063a5cd00d77..805508373fce 100644
--- a/include/linux/futex.h
+++ b/include/linux/futex.h
@@ -57,6 +57,7 @@ union futex_key {
 #ifdef CONFIG_FUTEX
 enum {
 	FUTEX_STATE_OK,
+	FUTEX_STATE_EXITING,
 	FUTEX_STATE_DEAD,
 };
 
@@ -71,33 +72,7 @@ static inline void futex_init_task(struct task_struct *tsk)
 	tsk->futex_state = FUTEX_STATE_OK;
 }
 
-/**
- * futex_exit_done - Sets the tasks futex state to FUTEX_STATE_DEAD
- * @tsk:	task to set the state on
- *
- * Set the futex exit state of the task lockless. The futex waiter code
- * observes that state when a task is exiting and loops until the task has
- * actually finished the futex cleanup. The worst case for this is that the
- * waiter runs through the wait loop until the state becomes visible.
- *
- * This has two callers:
- *
- * - futex_mm_release() after the futex exit cleanup has been done
- *
- * - do_exit() from the recursive fault handling path.
- *
- * In case of a recursive fault this is best effort. Either the futex exit
- * code has run already or not. If the OWNER_DIED bit has been set on the
- * futex then the waiter can take it over. If not, the problem is pushed
- * back to user space. If the futex exit code did not run yet, then an
- * already queued waiter might block forever, but there is nothing which
- * can be done about that.
- */
-static inline void futex_exit_done(struct task_struct *tsk)
-{
-	tsk->futex_state = FUTEX_STATE_DEAD;
-}
-
+void futex_exit_recursive(struct task_struct *tsk);
 void futex_exit_release(struct task_struct *tsk);
 void futex_exec_release(struct task_struct *tsk);
 
@@ -105,7 +80,7 @@ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
 	      u32 __user *uaddr2, u32 val2, u32 val3);
 #else
 static inline void futex_init_task(struct task_struct *tsk) { }
-static inline void futex_exit_done(struct task_struct *tsk) { }
+static inline void futex_exit_recursive(struct task_struct *tsk) { }
 static inline void futex_exit_release(struct task_struct *tsk) { }
 static inline void futex_exec_release(struct task_struct *tsk) { }
 #endif
diff --git a/kernel/exit.c b/kernel/exit.c
index dce0623f520e..475e55457712 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -710,23 +710,13 @@ void do_exit(long code)
 	 */
 	if (unlikely(tsk->flags & PF_EXITING)) {
 		pr_alert("Fixing recursive fault but reboot is needed!\n");
-		futex_exit_done(tsk);
+		futex_exit_recursive(tsk);
 		set_current_state(TASK_UNINTERRUPTIBLE);
 		schedule();
 	}
 
 	exit_signals(tsk);  /* sets PF_EXITING */
 
-	sched_exit(tsk);
-	schedtune_exit_task(tsk);
-
-	/*
-	 * tsk->flags are checked in the futex code to protect against
-	 * an exiting task cleaning up the robust pi futexes.
-	 */
-	smp_mb();
-	raw_spin_unlock_wait(&tsk->pi_lock);
-
 	if (unlikely(in_atomic())) {
 		pr_info("note: %s[%d] exited with preempt_count %d\n",
 			current->comm, task_pid_nr(current),
diff --git a/kernel/futex.c b/kernel/futex.c
index f169b9e401cb..2b828d19a1ac 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -3252,10 +3252,45 @@ void futex_exec_release(struct task_struct *tsk)
 		exit_pi_state_list(tsk);
 }
 
+/**
+ * futex_exit_recursive - Set the tasks futex state to FUTEX_STATE_DEAD
+ * @tsk:	task to set the state on
+ *
+ * Set the futex exit state of the task lockless. The futex waiter code
+ * observes that state when a task is exiting and loops until the task has
+ * actually finished the futex cleanup. The worst case for this is that the
+ * waiter runs through the wait loop until the state becomes visible.
+ *
+ * This is called from the recursive fault handling path in do_exit().
+ *
+ * This is best effort. Either the futex exit code has run already or
+ * not. If the OWNER_DIED bit has been set on the futex then the waiter can
+ * take it over. If not, the problem is pushed back to user space. If the
+ * futex exit code did not run yet, then an already queued waiter might
+ * block forever, but there is nothing which can be done about that.
+ */
+void futex_exit_recursive(struct task_struct *tsk)
+{
+	tsk->futex_state = FUTEX_STATE_DEAD;
+}
+
 void futex_exit_release(struct task_struct *tsk)
 {
+	tsk->futex_state = FUTEX_STATE_EXITING;
+	/*
+	 * Ensure that all new tsk->pi_lock acquisitions must observe
+	 * FUTEX_STATE_EXITING. Serializes against attach_to_pi_owner().
+	 */
+	smp_mb();
+	/*
+	 * Ensure that we must observe the pi_state in exit_pi_state_list().
+	 */
+	raw_spin_lock_irq(&tsk->pi_lock);
+	raw_spin_unlock_irq(&tsk->pi_lock);
+
 	futex_exec_release(tsk);
-	futex_exit_done(tsk);
+
+	tsk->futex_state = FUTEX_STATE_DEAD;
 }
 
 long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,

From d9d2de1b0903fd59f7630bd49030e6f2859704ed Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 1 Feb 2021 15:12:10 +0000
Subject: [PATCH 1427/2658] futex: Sanitize exit state handling

commit 4a8e991b91aca9e20705d434677ac013974e0e30 upstream.

Instead of having a smp_mb() and an empty lock/unlock of task::pi_lock move
the state setting into to the lock section.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20191106224556.645603214@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 2b828d19a1ac..5258885d401b 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -3276,16 +3276,19 @@ void futex_exit_recursive(struct task_struct *tsk)
 
 void futex_exit_release(struct task_struct *tsk)
 {
-	tsk->futex_state = FUTEX_STATE_EXITING;
-	/*
-	 * Ensure that all new tsk->pi_lock acquisitions must observe
-	 * FUTEX_STATE_EXITING. Serializes against attach_to_pi_owner().
-	 */
-	smp_mb();
 	/*
-	 * Ensure that we must observe the pi_state in exit_pi_state_list().
+	 * Switch the state to FUTEX_STATE_EXITING under tsk->pi_lock.
+	 *
+	 * This ensures that all subsequent checks of tsk->futex_state in
+	 * attach_to_pi_owner() must observe FUTEX_STATE_EXITING with
+	 * tsk->pi_lock held.
+	 *
+	 * It guarantees also that a pi_state which was queued right before
+	 * the state change under tsk->pi_lock by a concurrent waiter must
+	 * be observed in exit_pi_state_list().
 	 */
 	raw_spin_lock_irq(&tsk->pi_lock);
+	tsk->futex_state = FUTEX_STATE_EXITING;
 	raw_spin_unlock_irq(&tsk->pi_lock);
 
 	futex_exec_release(tsk);

From 7099d5d2fd70d0a141517c9289bfd6b8e6038cd6 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 1 Feb 2021 15:12:11 +0000
Subject: [PATCH 1428/2658] futex: Provide state handling for exec() as well

commit af8cbda2cfcaa5515d61ec500498d46e9a8247e2 upstream.

exec() attempts to handle potentially held futexes gracefully by running
the futex exit handling code like exit() does.

The current implementation has no protection against concurrent incoming
waiters. The reason is that the futex state cannot be set to
FUTEX_STATE_DEAD after the cleanup because the task struct is still active
and just about to execute the new binary.

While its arguably buggy when a task holds a futex over exec(), for
consistency sake the state handling can at least cover the actual futex
exit cleanup section. This provides state consistency protection accross
the cleanup. As the futex state of the task becomes FUTEX_STATE_OK after the
cleanup has been finished, this cannot prevent subsequent attempts to
attach to the task in case that the cleanup was not successfull in mopping
up all leftovers.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20191106224556.753355618@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 38 ++++++++++++++++++++++++++++++++++----
 1 file changed, 34 insertions(+), 4 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 5258885d401b..10fc5c7d2a1a 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -3234,7 +3234,7 @@ static void exit_robust_list(struct task_struct *curr)
 				   curr, pip);
 }
 
-void futex_exec_release(struct task_struct *tsk)
+static void futex_cleanup(struct task_struct *tsk)
 {
 	if (unlikely(tsk->robust_list)) {
 		exit_robust_list(tsk);
@@ -3274,7 +3274,7 @@ void futex_exit_recursive(struct task_struct *tsk)
 	tsk->futex_state = FUTEX_STATE_DEAD;
 }
 
-void futex_exit_release(struct task_struct *tsk)
+static void futex_cleanup_begin(struct task_struct *tsk)
 {
 	/*
 	 * Switch the state to FUTEX_STATE_EXITING under tsk->pi_lock.
@@ -3290,10 +3290,40 @@ void futex_exit_release(struct task_struct *tsk)
 	raw_spin_lock_irq(&tsk->pi_lock);
 	tsk->futex_state = FUTEX_STATE_EXITING;
 	raw_spin_unlock_irq(&tsk->pi_lock);
+}
 
-	futex_exec_release(tsk);
+static void futex_cleanup_end(struct task_struct *tsk, int state)
+{
+	/*
+	 * Lockless store. The only side effect is that an observer might
+	 * take another loop until it becomes visible.
+	 */
+	tsk->futex_state = state;
+}
 
-	tsk->futex_state = FUTEX_STATE_DEAD;
+void futex_exec_release(struct task_struct *tsk)
+{
+	/*
+	 * The state handling is done for consistency, but in the case of
+	 * exec() there is no way to prevent futher damage as the PID stays
+	 * the same. But for the unlikely and arguably buggy case that a
+	 * futex is held on exec(), this provides at least as much state
+	 * consistency protection which is possible.
+	 */
+	futex_cleanup_begin(tsk);
+	futex_cleanup(tsk);
+	/*
+	 * Reset the state to FUTEX_STATE_OK. The task is alive and about
+	 * exec a new binary.
+	 */
+	futex_cleanup_end(tsk, FUTEX_STATE_OK);
+}
+
+void futex_exit_release(struct task_struct *tsk)
+{
+	futex_cleanup_begin(tsk);
+	futex_cleanup(tsk);
+	futex_cleanup_end(tsk, FUTEX_STATE_DEAD);
 }
 
 long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,

From 48310836ccadba2b846ae55197a3cd73bcaa611b Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 1 Feb 2021 15:12:12 +0000
Subject: [PATCH 1429/2658] futex: Add mutex around futex exit

commit 3f186d974826847a07bc7964d79ec4eded475ad9 upstream.

The mutex will be used in subsequent changes to replace the busy looping of
a waiter when the futex owner is currently executing the exit cleanup to
prevent a potential live lock.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20191106224556.845798895@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/futex.h |  1 +
 include/linux/sched.h |  1 +
 kernel/futex.c        | 16 ++++++++++++++++
 3 files changed, 18 insertions(+)

diff --git a/include/linux/futex.h b/include/linux/futex.h
index 805508373fce..0f294ae63c78 100644
--- a/include/linux/futex.h
+++ b/include/linux/futex.h
@@ -70,6 +70,7 @@ static inline void futex_init_task(struct task_struct *tsk)
 	INIT_LIST_HEAD(&tsk->pi_state_list);
 	tsk->pi_state_cache = NULL;
 	tsk->futex_state = FUTEX_STATE_OK;
+	mutex_init(&tsk->futex_exit_mutex);
 }
 
 void futex_exit_recursive(struct task_struct *tsk);
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 91f74fc0aa50..3f03dba16cb4 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1947,6 +1947,7 @@ struct task_struct {
 #endif
 	struct list_head pi_state_list;
 	struct futex_pi_state *pi_state_cache;
+	struct mutex futex_exit_mutex;
 	unsigned int futex_state;
 #endif
 #ifdef CONFIG_PERF_EVENTS
diff --git a/kernel/futex.c b/kernel/futex.c
index 10fc5c7d2a1a..b7a6c3dfd45c 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -3271,11 +3271,22 @@ static void futex_cleanup(struct task_struct *tsk)
  */
 void futex_exit_recursive(struct task_struct *tsk)
 {
+	/* If the state is FUTEX_STATE_EXITING then futex_exit_mutex is held */
+	if (tsk->futex_state == FUTEX_STATE_EXITING)
+		mutex_unlock(&tsk->futex_exit_mutex);
 	tsk->futex_state = FUTEX_STATE_DEAD;
 }
 
 static void futex_cleanup_begin(struct task_struct *tsk)
 {
+	/*
+	 * Prevent various race issues against a concurrent incoming waiter
+	 * including live locks by forcing the waiter to block on
+	 * tsk->futex_exit_mutex when it observes FUTEX_STATE_EXITING in
+	 * attach_to_pi_owner().
+	 */
+	mutex_lock(&tsk->futex_exit_mutex);
+
 	/*
 	 * Switch the state to FUTEX_STATE_EXITING under tsk->pi_lock.
 	 *
@@ -3299,6 +3310,11 @@ static void futex_cleanup_end(struct task_struct *tsk, int state)
 	 * take another loop until it becomes visible.
 	 */
 	tsk->futex_state = state;
+	/*
+	 * Drop the exit protection. This unblocks waiters which observed
+	 * FUTEX_STATE_EXITING to reevaluate the state.
+	 */
+	mutex_unlock(&tsk->futex_exit_mutex);
 }
 
 void futex_exec_release(struct task_struct *tsk)

From d588e8b4435445ea52628c59f040d37852b00f8d Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 1 Feb 2021 15:12:13 +0000
Subject: [PATCH 1430/2658] futex: Provide distinct return value when owner is
 exiting

commit ac31c7ff8624409ba3c4901df9237a616c187a5d upstream.

attach_to_pi_owner() returns -EAGAIN for various cases:

 - Owner task is exiting
 - Futex value has changed

The caller drops the held locks (hash bucket, mmap_sem) and retries the
operation. In case of the owner task exiting this can result in a live
lock.

As a preparatory step for seperating those cases, provide a distinct return
value (EBUSY) for the owner exiting case.

No functional change.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20191106224556.935606117@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index b7a6c3dfd45c..fe538f137aa0 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1909,12 +1909,13 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
 			if (!ret)
 				goto retry;
 			goto out;
+		case -EBUSY:
 		case -EAGAIN:
 			/*
 			 * Two reasons for this:
-			 * - Owner is exiting and we just wait for the
+			 * - EBUSY: Owner is exiting and we just wait for the
 			 *   exit to complete.
-			 * - The user space value changed.
+			 * - EAGAIN: The user space value changed.
 			 */
 			free_pi_state(pi_state);
 			pi_state = NULL;
@@ -2580,12 +2581,13 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags,
 			goto out_unlock_put_key;
 		case -EFAULT:
 			goto uaddr_faulted;
+		case -EBUSY:
 		case -EAGAIN:
 			/*
 			 * Two reasons for this:
-			 * - Task is exiting and we just wait for the
+			 * - EBUSY: Task is exiting and we just wait for the
 			 *   exit to complete.
-			 * - The user space value changed.
+			 * - EAGAIN: The user space value changed.
 			 */
 			queue_unlock(hb);
 			put_futex_key(&q.key);

From 1118feaaf716dc1d86843df56dc2626759672d25 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 1 Feb 2021 15:12:14 +0000
Subject: [PATCH 1431/2658] futex: Prevent exit livelock

commit 3ef240eaff36b8119ac9e2ea17cbf41179c930ba upstream.

Oleg provided the following test case:

int main(void)
{
	struct sched_param sp = {};

	sp.sched_priority = 2;
	assert(sched_setscheduler(0, SCHED_FIFO, &sp) == 0);

	int lock = vfork();
	if (!lock) {
		sp.sched_priority = 1;
		assert(sched_setscheduler(0, SCHED_FIFO, &sp) == 0);
		_exit(0);
	}

	syscall(__NR_futex, &lock, FUTEX_LOCK_PI, 0,0,0);
	return 0;
}

This creates an unkillable RT process spinning in futex_lock_pi() on a UP
machine or if the process is affine to a single CPU. The reason is:

 parent	    	    			child

  set FIFO prio 2

  vfork()			->	set FIFO prio 1
   implies wait_for_child()	 	sched_setscheduler(...)
 			   		exit()
					do_exit()
 					....
					mm_release()
					  tsk->futex_state = FUTEX_STATE_EXITING;
					  exit_futex(); (NOOP in this case)
					  complete() --> wakes parent
  sys_futex()
    loop infinite because
    tsk->futex_state == FUTEX_STATE_EXITING

The same problem can happen just by regular preemption as well:

  task holds futex
  ...
  do_exit()
    tsk->futex_state = FUTEX_STATE_EXITING;

  --> preemption (unrelated wakeup of some other higher prio task, e.g. timer)

  switch_to(other_task)

  return to user
  sys_futex()
	loop infinite as above

Just for the fun of it the futex exit cleanup could trigger the wakeup
itself before the task sets its futex state to DEAD.

To cure this, the handling of the exiting owner is changed so:

   - A refcount is held on the task

   - The task pointer is stored in a caller visible location

   - The caller drops all locks (hash bucket, mmap_sem) and blocks
     on task::futex_exit_mutex. When the mutex is acquired then
     the exiting task has completed the cleanup and the state
     is consistent and can be reevaluated.

This is not a pretty solution, but there is no choice other than returning
an error code to user space, which would break the state consistency
guarantee and open another can of problems including regressions.

For stable backports the preparatory commits ac31c7ff8624 .. ba31c1a48538
are required as well, but for anything older than 5.3.y the backports are
going to be provided when this hits mainline as the other dependencies for
those kernels are definitely not stable material.

Fixes: 778e9a9c3e71 ("pi-futex: fix exit races and locking problems")
Reported-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Stable Team <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20191106224557.041676471@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 106 ++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 91 insertions(+), 15 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index fe538f137aa0..dc9c9b23cc70 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1067,12 +1067,43 @@ static int attach_to_pi_state(u32 uval, struct futex_pi_state *pi_state,
 	return 0;
 }
 
+/**
+ * wait_for_owner_exiting - Block until the owner has exited
+ * @exiting:	Pointer to the exiting task
+ *
+ * Caller must hold a refcount on @exiting.
+ */
+static void wait_for_owner_exiting(int ret, struct task_struct *exiting)
+{
+	if (ret != -EBUSY) {
+		WARN_ON_ONCE(exiting);
+		return;
+	}
+
+	if (WARN_ON_ONCE(ret == -EBUSY && !exiting))
+		return;
+
+	mutex_lock(&exiting->futex_exit_mutex);
+	/*
+	 * No point in doing state checking here. If the waiter got here
+	 * while the task was in exec()->exec_futex_release() then it can
+	 * have any FUTEX_STATE_* value when the waiter has acquired the
+	 * mutex. OK, if running, EXITING or DEAD if it reached exit()
+	 * already. Highly unlikely and not a problem. Just one more round
+	 * through the futex maze.
+	 */
+	mutex_unlock(&exiting->futex_exit_mutex);
+
+	put_task_struct(exiting);
+}
+
 /*
  * Lookup the task for the TID provided from user space and attach to
  * it after doing proper sanity checks.
  */
 static int attach_to_pi_owner(u32 uval, union futex_key *key,
-			      struct futex_pi_state **ps)
+			      struct futex_pi_state **ps,
+			      struct task_struct **exiting)
 {
 	pid_t pid = uval & FUTEX_TID_MASK;
 	struct futex_pi_state *pi_state;
@@ -1108,7 +1139,19 @@ static int attach_to_pi_owner(u32 uval, union futex_key *key,
 		int ret = (p->futex_state = FUTEX_STATE_DEAD) ? -ESRCH : -EAGAIN;
 
 		raw_spin_unlock_irq(&p->pi_lock);
-		put_task_struct(p);
+		/*
+		 * If the owner task is between FUTEX_STATE_EXITING and
+		 * FUTEX_STATE_DEAD then store the task pointer and keep
+		 * the reference on the task struct. The calling code will
+		 * drop all locks, wait for the task to reach
+		 * FUTEX_STATE_DEAD and then drop the refcount. This is
+		 * required to prevent a live lock when the current task
+		 * preempted the exiting task between the two states.
+		 */
+		if (ret == -EBUSY)
+			*exiting = p;
+		else
+			put_task_struct(p);
 		return ret;
 	}
 
@@ -1139,7 +1182,8 @@ static int attach_to_pi_owner(u32 uval, union futex_key *key,
 }
 
 static int lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
-			   union futex_key *key, struct futex_pi_state **ps)
+			   union futex_key *key, struct futex_pi_state **ps,
+			   struct task_struct **exiting)
 {
 	struct futex_q *match = futex_top_waiter(hb, key);
 
@@ -1154,7 +1198,7 @@ static int lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
 	 * We are the first waiter - try to look up the owner based on
 	 * @uval and attach to it.
 	 */
-	return attach_to_pi_owner(uval, key, ps);
+	return attach_to_pi_owner(uval, key, ps, exiting);
 }
 
 static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval)
@@ -1180,6 +1224,8 @@ static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval)
  *			lookup
  * @task:		the task to perform the atomic lock work for.  This will
  *			be "current" except in the case of requeue pi.
+ * @exiting:		Pointer to store the task pointer of the owner task
+ *			which is in the middle of exiting
  * @set_waiters:	force setting the FUTEX_WAITERS bit (1) or not (0)
  *
  * Return:
@@ -1188,11 +1234,17 @@ static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval)
  * <0 - error
  *
  * The hb->lock and futex_key refs shall be held by the caller.
+ *
+ * @exiting is only set when the return value is -EBUSY. If so, this holds
+ * a refcount on the exiting task on return and the caller needs to drop it
+ * after waiting for the exit to complete.
  */
 static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
 				union futex_key *key,
 				struct futex_pi_state **ps,
-				struct task_struct *task, int set_waiters)
+				struct task_struct *task,
+				struct task_struct **exiting,
+				int set_waiters)
 {
 	u32 uval, newval, vpid = task_pid_vnr(task);
 	struct futex_q *match;
@@ -1262,7 +1314,7 @@ static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
 	 * attach to the owner. If that fails, no harm done, we only
 	 * set the FUTEX_WAITERS bit in the user space variable.
 	 */
-	return attach_to_pi_owner(uval, key, ps);
+	return attach_to_pi_owner(uval, key, ps, exiting);
 }
 
 /**
@@ -1688,6 +1740,8 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
  * @key1:		the from futex key
  * @key2:		the to futex key
  * @ps:			address to store the pi_state pointer
+ * @exiting:		Pointer to store the task pointer of the owner task
+ *			which is in the middle of exiting
  * @set_waiters:	force setting the FUTEX_WAITERS bit (1) or not (0)
  *
  * Try and get the lock on behalf of the top waiter if we can do it atomically.
@@ -1695,16 +1749,20 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
  * then direct futex_lock_pi_atomic() to force setting the FUTEX_WAITERS bit.
  * hb1 and hb2 must be held by the caller.
  *
+ * @exiting is only set when the return value is -EBUSY. If so, this holds
+ * a refcount on the exiting task on return and the caller needs to drop it
+ * after waiting for the exit to complete.
+ *
  * Return:
  *  0 - failed to acquire the lock atomically;
  * >0 - acquired the lock, return value is vpid of the top_waiter
  * <0 - error
  */
-static int futex_proxy_trylock_atomic(u32 __user *pifutex,
-				 struct futex_hash_bucket *hb1,
-				 struct futex_hash_bucket *hb2,
-				 union futex_key *key1, union futex_key *key2,
-				 struct futex_pi_state **ps, int set_waiters)
+static int
+futex_proxy_trylock_atomic(u32 __user *pifutex, struct futex_hash_bucket *hb1,
+			   struct futex_hash_bucket *hb2, union futex_key *key1,
+			   union futex_key *key2, struct futex_pi_state **ps,
+			   struct task_struct **exiting, int set_waiters)
 {
 	struct futex_q *top_waiter = NULL;
 	u32 curval;
@@ -1741,7 +1799,7 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
 	 */
 	vpid = task_pid_vnr(top_waiter->task);
 	ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task,
-				   set_waiters);
+				   exiting, set_waiters);
 	if (ret == 1) {
 		requeue_pi_wake_futex(top_waiter, key2, hb2);
 		return vpid;
@@ -1861,6 +1919,8 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
 	}
 
 	if (requeue_pi && (task_count - nr_wake < nr_requeue)) {
+		struct task_struct *exiting = NULL;
+
 		/*
 		 * Attempt to acquire uaddr2 and wake the top waiter. If we
 		 * intend to requeue waiters, force setting the FUTEX_WAITERS
@@ -1868,7 +1928,8 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
 		 * faults rather in the requeue loop below.
 		 */
 		ret = futex_proxy_trylock_atomic(uaddr2, hb1, hb2, &key1,
-						 &key2, &pi_state, nr_requeue);
+						 &key2, &pi_state,
+						 &exiting, nr_requeue);
 
 		/*
 		 * At this point the top_waiter has either taken uaddr2 or is
@@ -1892,7 +1953,8 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
 			 * rereading and handing potential crap to
 			 * lookup_pi_state.
 			 */
-			ret = lookup_pi_state(ret, hb2, &key2, &pi_state);
+			ret = lookup_pi_state(ret, hb2, &key2,
+					      &pi_state, &exiting);
 		}
 
 		switch (ret) {
@@ -1923,6 +1985,12 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
 			hb_waiters_dec(hb2);
 			put_futex_key(&key2);
 			put_futex_key(&key1);
+			/*
+			 * Handle the case where the owner is in the middle of
+			 * exiting. Wait for the exit to complete otherwise
+			 * this task might loop forever, aka. live lock.
+			 */
+			wait_for_owner_exiting(ret, exiting);
 			cond_resched();
 			goto retry;
 		default:
@@ -2545,6 +2613,7 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags,
 			 ktime_t *time, int trylock)
 {
 	struct hrtimer_sleeper timeout, *to = NULL;
+	struct task_struct *exiting = NULL;
 	struct futex_hash_bucket *hb;
 	struct futex_q q = futex_q_init;
 	int res, ret;
@@ -2568,7 +2637,8 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags,
 retry_private:
 	hb = queue_lock(&q);
 
-	ret = futex_lock_pi_atomic(uaddr, hb, &q.key, &q.pi_state, current, 0);
+	ret = futex_lock_pi_atomic(uaddr, hb, &q.key, &q.pi_state, current,
+				   &exiting, 0);
 	if (unlikely(ret)) {
 		/*
 		 * Atomic work succeeded and we got the lock,
@@ -2591,6 +2661,12 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags,
 			 */
 			queue_unlock(hb);
 			put_futex_key(&q.key);
+			/*
+			 * Handle the case where the owner is in the middle of
+			 * exiting. Wait for the exit to complete otherwise
+			 * this task might loop forever, aka. live lock.
+			 */
+			wait_for_owner_exiting(ret, exiting);
 			cond_resched();
 			goto retry;
 		default:

From 43b503d5fd65106b805e187419fc105fc4fd95be Mon Sep 17 00:00:00 2001
From: Max Krummenacher <max.oss.09@gmail.com>
Date: Mon, 11 Jan 2021 16:17:04 +0100
Subject: [PATCH 1432/2658] ARM: imx: build suspend-imx6.S with arm instruction
 set

commit a88afa46b86ff461c89cc33fc3a45267fff053e8 upstream.

When the kernel is configured to use the Thumb-2 instruction set
"suspend-to-memory" fails to resume. Observed on a Colibri iMX6ULL
(i.MX 6ULL) and Apalis iMX6 (i.MX 6Q).

It looks like the CPU resumes unconditionally in ARM instruction mode
and then chokes on the presented Thumb-2 code it should execute.

Fix this by using the arm instruction set for all code in
suspend-imx6.S.

Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com>
Fixes: df595746fa69 ("ARM: imx: add suspend in ocram support for i.mx6q")
Acked-by: Oleksandr Suvorov <oleksandr.suvorov@toradex.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/mach-imx/suspend-imx6.S | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/mach-imx/suspend-imx6.S b/arch/arm/mach-imx/suspend-imx6.S
index 7d84b617af48..99d2e296082c 100644
--- a/arch/arm/mach-imx/suspend-imx6.S
+++ b/arch/arm/mach-imx/suspend-imx6.S
@@ -73,6 +73,7 @@
 #define MX6Q_CCM_CCR	0x0
 
 	.align 3
+	.arm
 
 	.macro  sync_l2_cache
 

From 60b7b5b63731fcb83fe195768dc7149fefe96781 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sat, 16 Jan 2021 19:20:15 +0100
Subject: [PATCH 1433/2658] netfilter: nft_dynset: add timeout extension to
 template

commit 0c5b7a501e7400869ee905b4f7af3d6717802bcb upstream.

Otherwise, the newly create element shows no timeout when listing the
ruleset. If the set definition does not specify a default timeout, then
the set element only shows the expiration time, but not the timeout.
This is a problem when restoring a stateful ruleset listing since it
skips the timeout policy entirely.

Fixes: 22fe54d5fefc ("netfilter: nf_tables: add support for dynamic set updates")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/nft_dynset.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index a6c29c5bbfbd..d6fcfc995420 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -189,8 +189,10 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
 		nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_EXPR,
 				       priv->expr->ops->size);
 	if (set->flags & NFT_SET_TIMEOUT) {
-		if (timeout || set->timeout)
+		if (timeout || set->timeout) {
+			nft_set_ext_add(&priv->tmpl, NFT_SET_EXT_TIMEOUT);
 			nft_set_ext_add(&priv->tmpl, NFT_SET_EXT_EXPIRATION);
+		}
 	}
 
 	priv->timeout = timeout;

From 584da06f0c821ac0b285058cbcd5af36cd18c5e0 Mon Sep 17 00:00:00 2001
From: Shmulik Ladkani <shmulik@metanetworks.com>
Date: Mon, 14 Dec 2020 15:38:32 +0200
Subject: [PATCH 1434/2658] xfrm: Fix oops in xfrm_replay_advance_bmp

[ Upstream commit 56ce7c25ae1525d83cf80a880cf506ead1914250 ]

When setting xfrm replay_window to values higher than 32, a rare
page-fault occurs in xfrm_replay_advance_bmp:

  BUG: unable to handle page fault for address: ffff8af350ad7920
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD ad001067 P4D ad001067 PUD 0
  Oops: 0002 [#1] SMP PTI
  CPU: 3 PID: 30 Comm: ksoftirqd/3 Kdump: loaded Not tainted 5.4.52-050452-generic #202007160732
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
  RIP: 0010:xfrm_replay_advance_bmp+0xbb/0x130
  RSP: 0018:ffffa1304013ba40 EFLAGS: 00010206
  RAX: 000000000000010d RBX: 0000000000000002 RCX: 00000000ffffff4b
  RDX: 0000000000000018 RSI: 00000000004c234c RDI: 00000000ffb3dbff
  RBP: ffffa1304013ba50 R08: ffff8af330ad7920 R09: 0000000007fffffa
  R10: 0000000000000800 R11: 0000000000000010 R12: ffff8af29d6258c0
  R13: ffff8af28b95c700 R14: 0000000000000000 R15: ffff8af29d6258fc
  FS:  0000000000000000(0000) GS:ffff8af339ac0000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: ffff8af350ad7920 CR3: 0000000015ee4000 CR4: 00000000001406e0
  Call Trace:
   xfrm_input+0x4e5/0xa10
   xfrm4_rcv_encap+0xb5/0xe0
   xfrm4_udp_encap_rcv+0x140/0x1c0

Analysis revealed offending code is when accessing:

	replay_esn->bmp[nr] |= (1U << bitnr);

with 'nr' being 0x07fffffa.

This happened in an SMP system when reordering of packets was present;
A packet arrived with a "too old" sequence number (outside the window,
i.e 'diff > replay_window'), and therefore the following calculation:

			bitnr = replay_esn->replay_window - (diff - pos);

yields a negative result, but since bitnr is u32 we get a large unsigned
quantity (in crash dump above: 0xffffff4b seen in ecx).

This was supposed to be protected by xfrm_input()'s former call to:

		if (x->repl->check(x, skb, seq)) {

However, the state's spinlock x->lock is *released* after '->check()'
is performed, and gets re-acquired before '->advance()' - which gives a
chance for a different core to update the xfrm state, e.g. by advancing
'replay_esn->seq' when it encounters more packets - leading to a
'diff > replay_window' situation when original core continues to
xfrm_replay_advance_bmp().

An attempt to fix this issue was suggested in commit bcf66bf54aab
("xfrm: Perform a replay check after return from async codepaths"),
by calling 'x->repl->recheck()' after lock is re-acquired, but fix
applied only to asyncronous crypto algorithms.

Augment the fix, by *always* calling 'recheck()' - irrespective if we're
using async crypto.

Fixes: 0ebea8ef3559 ("[IPSEC]: Move state lock into x->type->input")
Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xfrm/xfrm_input.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 1e87639f2c27..d613bf77cc0f 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -315,7 +315,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
 		/* only the first xfrm gets the encap type */
 		encap_type = 0;
 
-		if (async && x->repl->recheck(x, skb, seq)) {
+		if (x->repl->recheck(x, skb, seq)) {
 			XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR);
 			goto drop_unlock;
 		}

From 97674ed66b59f5a41f5409a7b20bed4b3bb0d2dd Mon Sep 17 00:00:00 2001
From: Kamal Heib <kamalheib1@gmail.com>
Date: Thu, 14 Jan 2021 21:14:23 +0200
Subject: [PATCH 1435/2658] RDMA/cxgb4: Fix the reported max_recv_sge value

[ Upstream commit a372173bf314d374da4dd1155549d8ca7fc44709 ]

The max_recv_sge value is wrongly reported when calling query_qp, This is
happening due to a typo when assigning the max_recv_sge value, the value
of sq_max_sges was assigned instead of rq_max_sges.

Fixes: 3e5c02c9ef9a ("iw_cxgb4: Support query_qp() verb")
Link: https://lore.kernel.org/r/20210114191423.423529-1-kamalheib1@gmail.com
Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
Reviewed-by: Potnuri Bharat Teja <bharat@chelsio.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/cxgb4/qp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 04206c600098..07579e31168c 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -1898,7 +1898,7 @@ int c4iw_ib_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
 	init_attr->cap.max_send_wr = qhp->attr.sq_num_entries;
 	init_attr->cap.max_recv_wr = qhp->attr.rq_num_entries;
 	init_attr->cap.max_send_sge = qhp->attr.sq_max_sges;
-	init_attr->cap.max_recv_sge = qhp->attr.sq_max_sges;
+	init_attr->cap.max_recv_sge = qhp->attr.rq_max_sges;
 	init_attr->cap.max_inline_data = T4_MAX_SEND_INLINE;
 	init_attr->sq_sig_type = qhp->sq_sig_all ? IB_SIGNAL_ALL_WR : 0;
 	return 0;

From 988ac1f84c8ba1b54bb0781494fc44e229cd9664 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Fri, 22 Jan 2021 17:11:16 +0100
Subject: [PATCH 1436/2658] mac80211: pause TX while changing interface type

[ Upstream commit 054c9939b4800a91475d8d89905827bf9e1ad97a ]

syzbot reported a crash that happened when changing the interface
type around a lot, and while it might have been easy to fix just
the symptom there, a little deeper investigation found that really
the reason is that we allowed packets to be transmitted while in
the middle of changing the interface type.

Disallow TX by stopping the queues while changing the type.

Fixes: 34d4bc4d41d2 ("mac80211: support runtime interface type changes")
Reported-by: syzbot+d7a3b15976bf7de2238a@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20210122171115.b321f98f4d4f.I6997841933c17b093535c31d29355be3c0c39628@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/ieee80211_i.h | 1 +
 net/mac80211/iface.c       | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 39bad288155a..660e9eceaea9 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1028,6 +1028,7 @@ enum queue_stop_reason {
 	IEEE80211_QUEUE_STOP_REASON_FLUSH,
 	IEEE80211_QUEUE_STOP_REASON_TDLS_TEARDOWN,
 	IEEE80211_QUEUE_STOP_REASON_RESERVE_TID,
+	IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE,
 
 	IEEE80211_QUEUE_STOP_REASONS,
 };
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 3678f2d5fcfe..acaa00910ccf 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1508,6 +1508,10 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
 	if (ret)
 		return ret;
 
+	ieee80211_stop_vif_queues(local, sdata,
+				  IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE);
+	synchronize_net();
+
 	ieee80211_do_stop(sdata, false);
 
 	ieee80211_teardown_sdata(sdata);
@@ -1528,6 +1532,8 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
 	err = ieee80211_do_open(&sdata->wdev, false);
 	WARN(err, "type change: do_open returned %d", err);
 
+	ieee80211_wake_vif_queues(local, sdata,
+				  IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE);
 	return ret;
 }
 

From 476c9672d63cdcf8e596e7a27ff83195e12ccd16 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 21 Jan 2021 09:08:05 +0300
Subject: [PATCH 1437/2658] can: dev: prevent potential information leak in
 can_fill_info()

[ Upstream commit b552766c872f5b0d90323b24e4c9e8fa67486dd5 ]

The "bec" struct isn't necessarily always initialized. For example, the
mcp251xfd_get_berr_counter() function doesn't initialize anything if the
interface is down.

Fixes: 52c793f24054 ("can: netlink support for bus-error reporting and counters")
Link: https://lore.kernel.org/r/YAkaRdRJncsJO8Ve@mwanda
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 45f15ac6b101..1a79118b008b 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -987,7 +987,7 @@ static int can_fill_info(struct sk_buff *skb, const struct net_device *dev)
 {
 	struct can_priv *priv = netdev_priv(dev);
 	struct can_ctrlmode cm = {.flags = priv->ctrlmode};
-	struct can_berr_counter bec;
+	struct can_berr_counter bec = { };
 	enum can_state state = priv->state;
 
 	if (priv->do_get_state)

From 8e4b55d30cdaf22c1e8904f9c8f7c9c5762a17d9 Mon Sep 17 00:00:00 2001
From: David Woodhouse <dwmw@amazon.co.uk>
Date: Tue, 2 Feb 2021 01:09:36 +0100
Subject: [PATCH 1438/2658] iommu/vt-d: Gracefully handle DMAR units with no
 supported address widths

commit c40aaaac1018ff1382f2d35df5129a6bcea3df6b upstream.

Instead of bailing out completely, such a unit can still be used for
interrupt remapping.

Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Link: https://lore.kernel.org/linux-iommu/549928db2de6532117f36c9c810373c14cf76f51.camel@infradead.org/
Signed-off-by: Joerg Roedel <jroedel@suse.de>
[ - context change due to moving drivers/iommu/dmar.c to
    drivers/iommu/intel/dmar.c
  - remove the unused err_unmap label
  - use iommu->iommu_dev instead of iommu->iommu.ops to decide whether
    when freeing ]
Signed-off-by: Filippo Sironi <sironi@amazon.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iommu/dmar.c | 42 ++++++++++++++++++++++++++----------------
 1 file changed, 26 insertions(+), 16 deletions(-)

diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index 00169c9eb3ee..095022923258 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -1012,8 +1012,8 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
 {
 	struct intel_iommu *iommu;
 	u32 ver, sts;
-	int agaw = 0;
-	int msagaw = 0;
+	int agaw = -1;
+	int msagaw = -1;
 	int err;
 
 	if (!drhd->reg_base_addr) {
@@ -1038,17 +1038,28 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
 	}
 
 	err = -EINVAL;
-	agaw = iommu_calculate_agaw(iommu);
-	if (agaw < 0) {
-		pr_err("Cannot get a valid agaw for iommu (seq_id = %d)\n",
-			iommu->seq_id);
-		goto err_unmap;
+	if (cap_sagaw(iommu->cap) == 0) {
+		pr_info("%s: No supported address widths. Not attempting DMA translation.\n",
+			iommu->name);
+		drhd->ignored = 1;
 	}
-	msagaw = iommu_calculate_max_sagaw(iommu);
-	if (msagaw < 0) {
-		pr_err("Cannot get a valid max agaw for iommu (seq_id = %d)\n",
-			iommu->seq_id);
-		goto err_unmap;
+
+	if (!drhd->ignored) {
+		agaw = iommu_calculate_agaw(iommu);
+		if (agaw < 0) {
+			pr_err("Cannot get a valid agaw for iommu (seq_id = %d)\n",
+			       iommu->seq_id);
+			drhd->ignored = 1;
+		}
+	}
+	if (!drhd->ignored) {
+		msagaw = iommu_calculate_max_sagaw(iommu);
+		if (msagaw < 0) {
+			pr_err("Cannot get a valid max agaw for iommu (seq_id = %d)\n",
+			       iommu->seq_id);
+			drhd->ignored = 1;
+			agaw = -1;
+		}
 	}
 	iommu->agaw = agaw;
 	iommu->msagaw = msagaw;
@@ -1077,15 +1088,13 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
 
 	drhd->iommu = iommu;
 
-	if (intel_iommu_enabled)
+	if (intel_iommu_enabled && !drhd->ignored)
 		iommu->iommu_dev = iommu_device_create(NULL, iommu,
 						       intel_iommu_groups,
 						       "%s", iommu->name);
 
 	return 0;
 
-err_unmap:
-	unmap_iommu(iommu);
 error_free_seq_id:
 	dmar_free_seq_id(iommu);
 error:
@@ -1095,7 +1104,8 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
 
 static void free_iommu(struct intel_iommu *iommu)
 {
-	iommu_device_destroy(iommu->iommu_dev);
+	if (intel_iommu_enabled && iommu->iommu_dev)
+		iommu_device_destroy(iommu->iommu_dev);
 
 	if (iommu->irq) {
 		if (iommu->pr_irq) {

From 491faeb7c6cff28d3d57db073a60ed8c54f4512e Mon Sep 17 00:00:00 2001
From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Date: Tue, 2 Feb 2021 01:09:37 +0100
Subject: [PATCH 1439/2658] iommu/vt-d: Don't dereference iommu_device if
 IOMMU_API is not built
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 9def3b1a07c41e21c68a0eb353e3e569fdd1d2b1 upstream.

Since commit c40aaaac1018 ("iommu/vt-d: Gracefully handle DMAR units
with no supported address widths") dmar.c needs struct iommu_device to
be selected. We can drop this dependency by not dereferencing struct
iommu_device if IOMMU_API is not selected and by reusing the information
stored in iommu->drhd->ignored instead.

This fixes the following build error when IOMMU_API is not selected:

drivers/iommu/dmar.c: In function ‘free_iommu’:
drivers/iommu/dmar.c:1139:41: error: ‘struct iommu_device’ has no member named ‘ops’
 1139 |  if (intel_iommu_enabled && iommu->iommu.ops) {
                                                ^

Fixes: c40aaaac1018 ("iommu/vt-d: Gracefully handle DMAR units with no supported address widths")
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Acked-by: Lu Baolu <baolu.lu@linux.intel.com>
Acked-by: David Woodhouse <dwmw@amazon.co.uk>
Link: https://lore.kernel.org/r/20201013073055.11262-1-brgl@bgdev.pl
Signed-off-by: Joerg Roedel <jroedel@suse.de>
[ - context change due to moving drivers/iommu/dmar.c to
    drivers/iommu/intel/dmar.c
  - set the drhr in the iommu like in upstream commit b1012ca8dc4f
    ("iommu/vt-d: Skip TE disabling on quirky gfx dedicated iommu") ]
Signed-off-by: Filippo Sironi <sironi@amazon.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iommu/dmar.c        | 3 ++-
 include/linux/intel-iommu.h | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index 095022923258..54f27dd9f156 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -1087,6 +1087,7 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
 	raw_spin_lock_init(&iommu->register_lock);
 
 	drhd->iommu = iommu;
+	iommu->drhd = drhd;
 
 	if (intel_iommu_enabled && !drhd->ignored)
 		iommu->iommu_dev = iommu_device_create(NULL, iommu,
@@ -1104,7 +1105,7 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
 
 static void free_iommu(struct intel_iommu *iommu)
 {
-	if (intel_iommu_enabled && iommu->iommu_dev)
+	if (intel_iommu_enabled && !iommu->drhd->ignored)
 		iommu_device_destroy(iommu->iommu_dev);
 
 	if (iommu->irq) {
diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
index d86ac620f0aa..188bd1768971 100644
--- a/include/linux/intel-iommu.h
+++ b/include/linux/intel-iommu.h
@@ -447,6 +447,8 @@ struct intel_iommu {
 	struct device	*iommu_dev; /* IOMMU-sysfs device */
 	int		node;
 	u32		flags;      /* Software defined flags */
+
+	struct dmar_drhd_unit *drhd;
 };
 
 static inline void __iommu_flush_cache(

From 88a106937e8eb612390ff3f4cdbf1aa34858e853 Mon Sep 17 00:00:00 2001
From: Pan Bian <bianpan2016@163.com>
Date: Thu, 21 Jan 2021 07:27:48 -0800
Subject: [PATCH 1440/2658] NFC: fix resource leak when target index is invalid

commit 3a30537cee233fb7da302491b28c832247d89bbe upstream.

Goto to the label put_dev instead of the label error to fix potential
resource leak on path that the target index is invalid.

Fixes: c4fbb6515a4d ("NFC: The core part should generate the target index")
Signed-off-by: Pan Bian <bianpan2016@163.com>
Link: https://lore.kernel.org/r/20210121152748.98409-1-bianpan2016@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/nfc/rawsock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
index 574af981806f..92a3cfae4de8 100644
--- a/net/nfc/rawsock.c
+++ b/net/nfc/rawsock.c
@@ -117,7 +117,7 @@ static int rawsock_connect(struct socket *sock, struct sockaddr *_addr,
 	if (addr->target_idx > dev->target_next_idx - 1 ||
 	    addr->target_idx < dev->target_next_idx - dev->n_targets) {
 		rc = -EINVAL;
-		goto error;
+		goto put_dev;
 	}
 
 	rc = nfc_activate_target(dev, addr->target_idx, addr->nfc_protocol);

From 1d4930ca25cd0dc360a24b82324e751f0bbbf585 Mon Sep 17 00:00:00 2001
From: Pan Bian <bianpan2016@163.com>
Date: Thu, 21 Jan 2021 07:37:45 -0800
Subject: [PATCH 1441/2658] NFC: fix possible resource leak

commit d8f923c3ab96dbbb4e3c22d1afc1dc1d3b195cd8 upstream.

Put the device to avoid resource leak on path that the polling flag is
invalid.

Fixes: a831b9132065 ("NFC: Do not return EBUSY when stopping a poll that's already stopped")
Signed-off-by: Pan Bian <bianpan2016@163.com>
Link: https://lore.kernel.org/r/20210121153745.122184-1-bianpan2016@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/nfc/netlink.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index 639e5cad0442..c90dc2fd13a7 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -850,6 +850,7 @@ static int nfc_genl_stop_poll(struct sk_buff *skb, struct genl_info *info)
 
 	if (!dev->polling) {
 		device_unlock(&dev->dev);
+		nfc_put_device(dev);
 		return -EINVAL;
 	}
 

From 7b61e58d82d77d96d0394c7ab8d31c55b78d2d87 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 3 Feb 2021 23:16:18 +0100
Subject: [PATCH 1442/2658] Linux 4.4.255

Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20210202132941.180062901@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index ab85a1b8c40f..484724ccd185 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 254
+SUBLEVEL = 255
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From a369736313a77167eed14bca8a5a9426471d6f94 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 5 Feb 2021 14:07:43 +0100
Subject: [PATCH 1443/2658] Linux 4.4.256

"Empty" release where we roll the .y number over...

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 484724ccd185..3af0c32f2e9c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 255
+SUBLEVEL = 256
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From f55c98729763cbdd469a6a0dc7391a36886a69fa Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 14 Jan 2021 08:06:37 -0800
Subject: [PATCH 1444/2658] net_sched: reject silly cell_log in
 qdisc_get_rtab()

commit e4bedf48aaa5552bc1f49703abd17606e7e6e82a upstream

iproute2 probably never goes beyond 8 for the cell exponent,
but stick to the max shift exponent for signed 32bit.

UBSAN reported:
UBSAN: shift-out-of-bounds in net/sched/sch_api.c:389:22
shift exponent 130 is too large for 32-bit type 'int'
CPU: 1 PID: 8450 Comm: syz-executor586 Not tainted 5.11.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x183/0x22e lib/dump_stack.c:120
 ubsan_epilogue lib/ubsan.c:148 [inline]
 __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395
 __detect_linklayer+0x2a9/0x330 net/sched/sch_api.c:389
 qdisc_get_rtab+0x2b5/0x410 net/sched/sch_api.c:435
 cbq_init+0x28f/0x12c0 net/sched/sch_cbq.c:1180
 qdisc_create+0x801/0x1470 net/sched/sch_api.c:1246
 tc_modify_qdisc+0x9e3/0x1fc0 net/sched/sch_api.c:1662
 rtnetlink_rcv_msg+0xb1d/0xe60 net/core/rtnetlink.c:5564
 netlink_rcv_skb+0x1f0/0x460 net/netlink/af_netlink.c:2494
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x7de/0x9b0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0xaa6/0xe90 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 ____sys_sendmsg+0x5a2/0x900 net/socket.c:2345
 ___sys_sendmsg net/socket.c:2399 [inline]
 __sys_sendmsg+0x319/0x400 net/socket.c:2432
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Cong Wang <cong.wang@bytedance.com>
Link: https://lore.kernel.org/r/20210114160637.1660597-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/sch_api.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index a4b492bb7fe5..4ee2e9a3d12e 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -391,7 +391,8 @@ struct qdisc_rate_table *qdisc_get_rtab(struct tc_ratespec *r, struct nlattr *ta
 {
 	struct qdisc_rate_table *rtab;
 
-	if (tab == NULL || r->rate == 0 || r->cell_log == 0 ||
+	if (tab == NULL || r->rate == 0 ||
+	    r->cell_log == 0 || r->cell_log >= 32 ||
 	    nla_len(tab) != TC_RTAB_SIZE)
 		return NULL;
 

From ff957e3e76d603011c4072fd60aae06b5515e542 Mon Sep 17 00:00:00 2001
From: Lee Jones <lee.jones@linaro.org>
Date: Thu, 4 Feb 2021 17:28:54 +0000
Subject: [PATCH 1445/2658] futex,rt_mutex: Provide futex specific rt_mutex API

From: Peter Zijlstra <peterz@infradead.org>

[ Upstream commit 5293c2efda37775346885c7e924d4ef7018ea60b ]

Part of what makes futex_unlock_pi() intricate is that
rt_mutex_futex_unlock() -> rt_mutex_slowunlock() can drop
rt_mutex::wait_lock.

This means it cannot rely on the atomicy of wait_lock, which would be
preferred in order to not rely on hb->lock so much.

The reason rt_mutex_slowunlock() needs to drop wait_lock is because it can
race with the rt_mutex fastpath, however futexes have their own fast path.

Since futexes already have a bunch of separate rt_mutex accessors, complete
that set and implement a rt_mutex variant without fastpath for them.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: juri.lelli@arm.com
Cc: bigeasy@linutronix.de
Cc: xlpang@redhat.com
Cc: rostedt@goodmis.org
Cc: mathieu.desnoyers@efficios.com
Cc: jdesfossez@efficios.com
Cc: dvhart@infradead.org
Cc: bristot@redhat.com
Link: http://lkml.kernel.org/r/20170322104151.702962446@infradead.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
[Lee: Back-ported to solve a dependency]
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c                  | 30 +++++++++---------
 kernel/locking/rtmutex.c        | 56 ++++++++++++++++++++++++---------
 kernel/locking/rtmutex_common.h |  8 +++--
 3 files changed, 61 insertions(+), 33 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index dc9c9b23cc70..65faeec6abd4 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -936,7 +936,7 @@ static void exit_pi_state_list(struct task_struct *curr)
 		pi_state->owner = NULL;
 		raw_spin_unlock_irq(&curr->pi_lock);
 
-		rt_mutex_unlock(&pi_state->pi_mutex);
+		rt_mutex_futex_unlock(&pi_state->pi_mutex);
 
 		spin_unlock(&hb->lock);
 
@@ -1436,20 +1436,18 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this,
 	pi_state->owner = new_owner;
 	raw_spin_unlock_irq(&new_owner->pi_lock);
 
-	raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
-
-	deboost = rt_mutex_futex_unlock(&pi_state->pi_mutex, &wake_q);
-
 	/*
-	 * First unlock HB so the waiter does not spin on it once he got woken
-	 * up. Second wake up the waiter before the priority is adjusted. If we
-	 * deboost first (and lose our higher priority), then the task might get
-	 * scheduled away before the wake up can take place.
+	 * We've updated the uservalue, this unlock cannot fail.
 	 */
+	deboost = __rt_mutex_futex_unlock(&pi_state->pi_mutex, &wake_q);
+
+	raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
 	spin_unlock(&hb->lock);
-	wake_up_q(&wake_q);
-	if (deboost)
+
+	if (deboost) {
+		wake_up_q(&wake_q);
 		rt_mutex_adjust_prio(current);
+	}
 
 	return 0;
 }
@@ -2362,7 +2360,7 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
 		 * task acquired the rt_mutex after we removed ourself from the
 		 * rt_mutex waiters list.
 		 */
-		if (rt_mutex_trylock(&q->pi_state->pi_mutex)) {
+		if (rt_mutex_futex_trylock(&q->pi_state->pi_mutex)) {
 			locked = 1;
 			goto out;
 		}
@@ -2686,7 +2684,7 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags,
 	if (!trylock) {
 		ret = rt_mutex_timed_futex_lock(&q.pi_state->pi_mutex, to);
 	} else {
-		ret = rt_mutex_trylock(&q.pi_state->pi_mutex);
+		ret = rt_mutex_futex_trylock(&q.pi_state->pi_mutex);
 		/* Fixup the trylock return value: */
 		ret = ret ? 0 : -EWOULDBLOCK;
 	}
@@ -2709,7 +2707,7 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags,
 	 * it and return the fault to userspace.
 	 */
 	if (ret && (rt_mutex_owner(&q.pi_state->pi_mutex) == current))
-		rt_mutex_unlock(&q.pi_state->pi_mutex);
+		rt_mutex_futex_unlock(&q.pi_state->pi_mutex);
 
 	/* Unqueue and drop the lock */
 	unqueue_me_pi(&q);
@@ -3016,7 +3014,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
 			spin_lock(q.lock_ptr);
 			ret = fixup_pi_state_owner(uaddr2, &q, current);
 			if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current)
-				rt_mutex_unlock(&q.pi_state->pi_mutex);
+				rt_mutex_futex_unlock(&q.pi_state->pi_mutex);
 			/*
 			 * Drop the reference to the pi state which
 			 * the requeue_pi() code acquired for us.
@@ -3059,7 +3057,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
 		 * userspace.
 		 */
 		if (ret && rt_mutex_owner(pi_mutex) == current)
-			rt_mutex_unlock(pi_mutex);
+			rt_mutex_futex_unlock(pi_mutex);
 
 		/* Unqueue and drop the lock. */
 		unqueue_me_pi(&q);
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index dd173df9ee5e..3323ef935372 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1485,15 +1485,23 @@ EXPORT_SYMBOL_GPL(rt_mutex_lock_interruptible);
 
 /*
  * Futex variant with full deadlock detection.
+ * Futex variants must not use the fast-path, see __rt_mutex_futex_unlock().
  */
-int rt_mutex_timed_futex_lock(struct rt_mutex *lock,
+int __sched rt_mutex_timed_futex_lock(struct rt_mutex *lock,
 			      struct hrtimer_sleeper *timeout)
 {
 	might_sleep();
 
-	return rt_mutex_timed_fastlock(lock, TASK_INTERRUPTIBLE, timeout,
-				       RT_MUTEX_FULL_CHAINWALK,
-				       rt_mutex_slowlock);
+	return rt_mutex_slowlock(lock, TASK_INTERRUPTIBLE,
+				 timeout, RT_MUTEX_FULL_CHAINWALK);
+}
+
+/*
+ * Futex variant, must not use fastpath.
+ */
+int __sched rt_mutex_futex_trylock(struct rt_mutex *lock)
+{
+	return rt_mutex_slowtrylock(lock);
 }
 
 /**
@@ -1552,20 +1560,38 @@ void __sched rt_mutex_unlock(struct rt_mutex *lock)
 EXPORT_SYMBOL_GPL(rt_mutex_unlock);
 
 /**
- * rt_mutex_futex_unlock - Futex variant of rt_mutex_unlock
- * @lock: the rt_mutex to be unlocked
- *
- * Returns: true/false indicating whether priority adjustment is
- * required or not.
+ * Futex variant, that since futex variants do not use the fast-path, can be
+ * simple and will not need to retry.
  */
-bool __sched rt_mutex_futex_unlock(struct rt_mutex *lock,
-				   struct wake_q_head *wqh)
+bool __sched __rt_mutex_futex_unlock(struct rt_mutex *lock,
+				    struct wake_q_head *wake_q)
 {
-	if (likely(rt_mutex_cmpxchg_release(lock, current, NULL))) {
-		rt_mutex_deadlock_account_unlock(current);
-		return false;
+	lockdep_assert_held(&lock->wait_lock);
+
+	debug_rt_mutex_unlock(lock);
+
+	if (!rt_mutex_has_waiters(lock)) {
+		lock->owner = NULL;
+		return false; /* done */
+	}
+
+	mark_wakeup_next_waiter(wake_q, lock);
+	return true; /* deboost and wakeups */
+}
+
+void __sched rt_mutex_futex_unlock(struct rt_mutex *lock)
+{
+	WAKE_Q(wake_q);
+	bool deboost;
+
+	raw_spin_lock_irq(&lock->wait_lock);
+	deboost = __rt_mutex_futex_unlock(lock, &wake_q);
+	raw_spin_unlock_irq(&lock->wait_lock);
+
+	if (deboost) {
+		wake_up_q(&wake_q);
+		rt_mutex_adjust_prio(current);
 	}
-	return rt_mutex_slowunlock(lock, wqh);
 }
 
 /**
diff --git a/kernel/locking/rtmutex_common.h b/kernel/locking/rtmutex_common.h
index 6f8f68edb700..cdcaccfb7443 100644
--- a/kernel/locking/rtmutex_common.h
+++ b/kernel/locking/rtmutex_common.h
@@ -112,8 +112,12 @@ extern int rt_mutex_wait_proxy_lock(struct rt_mutex *lock,
 extern bool rt_mutex_cleanup_proxy_lock(struct rt_mutex *lock,
 				 struct rt_mutex_waiter *waiter);
 extern int rt_mutex_timed_futex_lock(struct rt_mutex *l, struct hrtimer_sleeper *to);
-extern bool rt_mutex_futex_unlock(struct rt_mutex *lock,
-				  struct wake_q_head *wqh);
+extern int rt_mutex_futex_trylock(struct rt_mutex *l);
+
+extern void rt_mutex_futex_unlock(struct rt_mutex *lock);
+extern bool __rt_mutex_futex_unlock(struct rt_mutex *lock,
+				 struct wake_q_head *wqh);
+
 extern void rt_mutex_adjust_prio(struct task_struct *task);
 
 #ifdef CONFIG_DEBUG_RT_MUTEXES

From 4b3fd53953abfe937c45d1028a9b7d23e0543068 Mon Sep 17 00:00:00 2001
From: Lee Jones <lee.jones@linaro.org>
Date: Thu, 4 Feb 2021 17:28:55 +0000
Subject: [PATCH 1446/2658] futex: Remove rt_mutex_deadlock_account_*()

From: Peter Zijlstra <peterz@infradead.org>

These are unused and clutter up the code.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: juri.lelli@arm.com
Cc: bigeasy@linutronix.de
Cc: xlpang@redhat.com
Cc: rostedt@goodmis.org
Cc: mathieu.desnoyers@efficios.com
Cc: jdesfossez@efficios.com
Cc: dvhart@infradead.org
Cc: bristot@redhat.com
Link: http://lkml.kernel.org/r/20170322104151.652692478@infradead.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
[Lee: Back-ported to solve a dependency]
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/locking/rtmutex-debug.c |  9 --------
 kernel/locking/rtmutex-debug.h |  3 ---
 kernel/locking/rtmutex.c       | 42 +++++++++++++---------------------
 kernel/locking/rtmutex.h       |  2 --
 4 files changed, 16 insertions(+), 40 deletions(-)

diff --git a/kernel/locking/rtmutex-debug.c b/kernel/locking/rtmutex-debug.c
index 62b6cee8ea7f..0613c4b1d059 100644
--- a/kernel/locking/rtmutex-debug.c
+++ b/kernel/locking/rtmutex-debug.c
@@ -173,12 +173,3 @@ void debug_rt_mutex_init(struct rt_mutex *lock, const char *name)
 	lock->name = name;
 }
 
-void
-rt_mutex_deadlock_account_lock(struct rt_mutex *lock, struct task_struct *task)
-{
-}
-
-void rt_mutex_deadlock_account_unlock(struct task_struct *task)
-{
-}
-
diff --git a/kernel/locking/rtmutex-debug.h b/kernel/locking/rtmutex-debug.h
index d0519c3432b6..b585af9a1b50 100644
--- a/kernel/locking/rtmutex-debug.h
+++ b/kernel/locking/rtmutex-debug.h
@@ -9,9 +9,6 @@
  * This file contains macros used solely by rtmutex.c. Debug version.
  */
 
-extern void
-rt_mutex_deadlock_account_lock(struct rt_mutex *lock, struct task_struct *task);
-extern void rt_mutex_deadlock_account_unlock(struct task_struct *task);
 extern void debug_rt_mutex_init_waiter(struct rt_mutex_waiter *waiter);
 extern void debug_rt_mutex_free_waiter(struct rt_mutex_waiter *waiter);
 extern void debug_rt_mutex_init(struct rt_mutex *lock, const char *name);
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index 3323ef935372..e3dd1642423f 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -937,8 +937,6 @@ static int try_to_take_rt_mutex(struct rt_mutex *lock, struct task_struct *task,
 	 */
 	rt_mutex_set_owner(lock, task);
 
-	rt_mutex_deadlock_account_lock(lock, task);
-
 	return 1;
 }
 
@@ -1331,8 +1329,6 @@ static bool __sched rt_mutex_slowunlock(struct rt_mutex *lock,
 
 	debug_rt_mutex_unlock(lock);
 
-	rt_mutex_deadlock_account_unlock(current);
-
 	/*
 	 * We must be careful here if the fast path is enabled. If we
 	 * have no waiters queued we cannot set owner to NULL here
@@ -1398,11 +1394,10 @@ rt_mutex_fastlock(struct rt_mutex *lock, int state,
 				struct hrtimer_sleeper *timeout,
 				enum rtmutex_chainwalk chwalk))
 {
-	if (likely(rt_mutex_cmpxchg_acquire(lock, NULL, current))) {
-		rt_mutex_deadlock_account_lock(lock, current);
+	if (likely(rt_mutex_cmpxchg_acquire(lock, NULL, current)))
 		return 0;
-	} else
-		return slowfn(lock, state, NULL, RT_MUTEX_MIN_CHAINWALK);
+
+	return slowfn(lock, state, NULL, RT_MUTEX_MIN_CHAINWALK);
 }
 
 static inline int
@@ -1414,21 +1409,19 @@ rt_mutex_timed_fastlock(struct rt_mutex *lock, int state,
 				      enum rtmutex_chainwalk chwalk))
 {
 	if (chwalk == RT_MUTEX_MIN_CHAINWALK &&
-	    likely(rt_mutex_cmpxchg_acquire(lock, NULL, current))) {
-		rt_mutex_deadlock_account_lock(lock, current);
+	    likely(rt_mutex_cmpxchg_acquire(lock, NULL, current)))
 		return 0;
-	} else
-		return slowfn(lock, state, timeout, chwalk);
+
+	return slowfn(lock, state, timeout, chwalk);
 }
 
 static inline int
 rt_mutex_fasttrylock(struct rt_mutex *lock,
 		     int (*slowfn)(struct rt_mutex *lock))
 {
-	if (likely(rt_mutex_cmpxchg_acquire(lock, NULL, current))) {
-		rt_mutex_deadlock_account_lock(lock, current);
+	if (likely(rt_mutex_cmpxchg_acquire(lock, NULL, current)))
 		return 1;
-	}
+
 	return slowfn(lock);
 }
 
@@ -1438,19 +1431,18 @@ rt_mutex_fastunlock(struct rt_mutex *lock,
 				   struct wake_q_head *wqh))
 {
 	WAKE_Q(wake_q);
+	bool deboost;
 
-	if (likely(rt_mutex_cmpxchg_release(lock, current, NULL))) {
-		rt_mutex_deadlock_account_unlock(current);
+	if (likely(rt_mutex_cmpxchg_release(lock, current, NULL)))
+		return;
 
-	} else {
-		bool deboost = slowfn(lock, &wake_q);
+	deboost = slowfn(lock, &wake_q);
 
-		wake_up_q(&wake_q);
+	wake_up_q(&wake_q);
 
-		/* Undo pi boosting if necessary: */
-		if (deboost)
-			rt_mutex_adjust_prio(current);
-	}
+	/* Undo pi boosting if necessary: */
+	if (deboost)
+		rt_mutex_adjust_prio(current);
 }
 
 /**
@@ -1648,7 +1640,6 @@ void rt_mutex_init_proxy_locked(struct rt_mutex *lock,
 	__rt_mutex_init(lock, NULL);
 	debug_rt_mutex_proxy_lock(lock, proxy_owner);
 	rt_mutex_set_owner(lock, proxy_owner);
-	rt_mutex_deadlock_account_lock(lock, proxy_owner);
 }
 
 /**
@@ -1664,7 +1655,6 @@ void rt_mutex_proxy_unlock(struct rt_mutex *lock,
 {
 	debug_rt_mutex_proxy_unlock(lock);
 	rt_mutex_set_owner(lock, NULL);
-	rt_mutex_deadlock_account_unlock(proxy_owner);
 }
 
 /**
diff --git a/kernel/locking/rtmutex.h b/kernel/locking/rtmutex.h
index c4060584c407..6607802efa8b 100644
--- a/kernel/locking/rtmutex.h
+++ b/kernel/locking/rtmutex.h
@@ -11,8 +11,6 @@
  */
 
 #define rt_mutex_deadlock_check(l)			(0)
-#define rt_mutex_deadlock_account_lock(m, t)		do { } while (0)
-#define rt_mutex_deadlock_account_unlock(l)		do { } while (0)
 #define debug_rt_mutex_init_waiter(w)			do { } while (0)
 #define debug_rt_mutex_free_waiter(w)			do { } while (0)
 #define debug_rt_mutex_lock(l)				do { } while (0)

From 0155c2730c88b9ffe353e560f275d3e1acd094f0 Mon Sep 17 00:00:00 2001
From: Lee Jones <lee.jones@linaro.org>
Date: Thu, 4 Feb 2021 17:28:56 +0000
Subject: [PATCH 1447/2658] futex: Rework inconsistent rt_mutex/futex_q state

From: Peter Zijlstra <peterz@infradead.org>

[Upstream commit 73d786bd043ebc855f349c81ea805f6b11cbf2aa ]

There is a weird state in the futex_unlock_pi() path when it interleaves
with a concurrent futex_lock_pi() at the point where it drops hb->lock.

In this case, it can happen that the rt_mutex wait_list and the futex_q
disagree on pending waiters, in particular rt_mutex will find no pending
waiters where futex_q thinks there are. In this case the rt_mutex unlock
code cannot assign an owner.

The futex side fixup code has to cleanup the inconsistencies with quite a
bunch of interesting corner cases.

Simplify all this by changing wake_futex_pi() to return -EAGAIN when this
situation occurs. This then gives the futex_lock_pi() code the opportunity
to continue and the retried futex_unlock_pi() will now observe a coherent
state.

The only problem is that this breaks RT timeliness guarantees. That
is, consider the following scenario:

  T1 and T2 are both pinned to CPU0. prio(T2) > prio(T1)

    CPU0

    T1
      lock_pi()
      queue_me()  <- Waiter is visible

    preemption

    T2
      unlock_pi()
	loops with -EAGAIN forever

Which is undesirable for PI primitives. Future patches will rectify
this.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: juri.lelli@arm.com
Cc: bigeasy@linutronix.de
Cc: xlpang@redhat.com
Cc: rostedt@goodmis.org
Cc: mathieu.desnoyers@efficios.com
Cc: jdesfossez@efficios.com
Cc: dvhart@infradead.org
Cc: bristot@redhat.com
Link: http://lkml.kernel.org/r/20170322104151.850383690@infradead.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
[Lee: Back-ported to solve a dependency]
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 50 ++++++++++++++------------------------------------
 1 file changed, 14 insertions(+), 36 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 65faeec6abd4..3c35dd29f17a 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1389,12 +1389,19 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this,
 	new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
 
 	/*
-	 * It is possible that the next waiter (the one that brought
-	 * this owner to the kernel) timed out and is no longer
-	 * waiting on the lock.
+	 * When we interleave with futex_lock_pi() where it does
+	 * rt_mutex_timed_futex_lock(), we might observe @this futex_q waiter,
+	 * but the rt_mutex's wait_list can be empty (either still, or again,
+	 * depending on which side we land).
+	 *
+	 * When this happens, give up our locks and try again, giving the
+	 * futex_lock_pi() instance time to complete, either by waiting on the
+	 * rtmutex or removing itself from the futex queue.
 	 */
-	if (!new_owner)
-		new_owner = this->task;
+	if (!new_owner) {
+		raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
+		return -EAGAIN;
+	}
 
 	/*
 	 * We pass it to the next owner. The WAITERS bit is always
@@ -2337,7 +2344,6 @@ static long futex_wait_restart(struct restart_block *restart);
  */
 static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
 {
-	struct task_struct *owner;
 	int ret = 0;
 
 	if (locked) {
@@ -2350,44 +2356,16 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
 		goto out;
 	}
 
-	/*
-	 * Catch the rare case, where the lock was released when we were on the
-	 * way back before we locked the hash bucket.
-	 */
-	if (q->pi_state->owner == current) {
-		/*
-		 * Try to get the rt_mutex now. This might fail as some other
-		 * task acquired the rt_mutex after we removed ourself from the
-		 * rt_mutex waiters list.
-		 */
-		if (rt_mutex_futex_trylock(&q->pi_state->pi_mutex)) {
-			locked = 1;
-			goto out;
-		}
-
-		/*
-		 * pi_state is incorrect, some other task did a lock steal and
-		 * we returned due to timeout or signal without taking the
-		 * rt_mutex. Too late.
-		 */
-		raw_spin_lock(&q->pi_state->pi_mutex.wait_lock);
-		owner = rt_mutex_owner(&q->pi_state->pi_mutex);
-		if (!owner)
-			owner = rt_mutex_next_owner(&q->pi_state->pi_mutex);
-		raw_spin_unlock(&q->pi_state->pi_mutex.wait_lock);
-		ret = fixup_pi_state_owner(uaddr, q, owner);
-		goto out;
-	}
-
 	/*
 	 * Paranoia check. If we did not take the lock, then we should not be
 	 * the owner of the rt_mutex.
 	 */
-	if (rt_mutex_owner(&q->pi_state->pi_mutex) == current)
+	if (rt_mutex_owner(&q->pi_state->pi_mutex) == current) {
 		printk(KERN_ERR "fixup_owner: ret = %d pi-mutex: %p "
 				"pi-state %p\n", ret,
 				q->pi_state->pi_mutex.owner,
 				q->pi_state->owner);
+	}
 
 out:
 	return ret ? ret : locked;

From e6e29f793dc00a92d4f6979a2277fc647b84af12 Mon Sep 17 00:00:00 2001
From: Lee Jones <lee.jones@linaro.org>
Date: Thu, 4 Feb 2021 17:28:57 +0000
Subject: [PATCH 1448/2658] futex: Avoid violating the 10th rule of futex

From: Peter Zijlstra <peterz@infradead.org>

commit c1e2f0eaf015fb7076d51a339011f2383e6dd389 upstream.

Julia reported futex state corruption in the following scenario:

   waiter                                  waker                                            stealer (prio > waiter)

   futex(WAIT_REQUEUE_PI, uaddr, uaddr2,
         timeout=[N ms])
      futex_wait_requeue_pi()
         futex_wait_queue_me()
            freezable_schedule()
            <scheduled out>
                                           futex(LOCK_PI, uaddr2)
                                           futex(CMP_REQUEUE_PI, uaddr,
                                                 uaddr2, 1, 0)
                                              /* requeues waiter to uaddr2 */
                                           futex(UNLOCK_PI, uaddr2)
                                                 wake_futex_pi()
                                                    cmp_futex_value_locked(uaddr2, waiter)
                                                    wake_up_q()
           <woken by waker>
           <hrtimer_wakeup() fires,
            clears sleeper->task>
                                                                                           futex(LOCK_PI, uaddr2)
                                                                                              __rt_mutex_start_proxy_lock()
                                                                                                 try_to_take_rt_mutex() /* steals lock */
                                                                                                    rt_mutex_set_owner(lock, stealer)
                                                                                              <preempted>
         <scheduled in>
         rt_mutex_wait_proxy_lock()
            __rt_mutex_slowlock()
               try_to_take_rt_mutex() /* fails, lock held by stealer */
               if (timeout && !timeout->task)
                  return -ETIMEDOUT;
            fixup_owner()
               /* lock wasn't acquired, so,
                  fixup_pi_state_owner skipped */

   return -ETIMEDOUT;

   /* At this point, we've returned -ETIMEDOUT to userspace, but the
    * futex word shows waiter to be the owner, and the pi_mutex has
    * stealer as the owner */

   futex_lock(LOCK_PI, uaddr2)
     -> bails with EDEADLK, futex word says we're owner.

And suggested that what commit:

  73d786bd043e ("futex: Rework inconsistent rt_mutex/futex_q state")

removes from fixup_owner() looks to be just what is needed. And indeed
it is -- I completely missed that requeue_pi could also result in this
case. So we need to restore that, except that subsequent patches, like
commit:

  16ffa12d7425 ("futex: Pull rt_mutex_futex_unlock() out from under hb->lock")

changed all the locking rules. Even without that, the sequence:

-               if (rt_mutex_futex_trylock(&q->pi_state->pi_mutex)) {
-                       locked = 1;
-                       goto out;
-               }

-               raw_spin_lock_irq(&q->pi_state->pi_mutex.wait_lock);
-               owner = rt_mutex_owner(&q->pi_state->pi_mutex);
-               if (!owner)
-                       owner = rt_mutex_next_owner(&q->pi_state->pi_mutex);
-               raw_spin_unlock_irq(&q->pi_state->pi_mutex.wait_lock);
-               ret = fixup_pi_state_owner(uaddr, q, owner);

already suggests there were races; otherwise we'd never have to look
at next_owner.

So instead of doing 3 consecutive wait_lock sections with who knows
what races, we do it all in a single section. Additionally, the usage
of pi_state->owner in fixup_owner() was only safe because only the
rt_mutex owner would modify it, which this additional case wrecks.

Luckily the values can only change away and not to the value we're
testing, this means we can do a speculative test and double check once
we have the wait_lock.

Fixes: 73d786bd043e ("futex: Rework inconsistent rt_mutex/futex_q state")
Reported-by: Julia Cartwright <julia@ni.com>
Reported-by: Gratian Crisan <gratian.crisan@ni.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Julia Cartwright <julia@ni.com>
Tested-by: Gratian Crisan <gratian.crisan@ni.com>
Cc: Darren Hart <dvhart@infradead.org>
Link: https://lkml.kernel.org/r/20171208124939.7livp7no2ov65rrc@hirez.programming.kicks-ass.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[Lee: Back-ported to solve a dependency]
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c                  | 80 +++++++++++++++++++++++++++------
 kernel/locking/rtmutex.c        | 26 ++++++++---
 kernel/locking/rtmutex_common.h |  1 +
 3 files changed, 87 insertions(+), 20 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 3c35dd29f17a..45b5b5cae621 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2227,30 +2227,34 @@ static void unqueue_me_pi(struct futex_q *q)
 	spin_unlock(q->lock_ptr);
 }
 
-/*
- * Fixup the pi_state owner with the new owner.
- *
- * Must be called with hash bucket lock held and mm->sem held for non
- * private futexes.
- */
 static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
-				struct task_struct *newowner)
+				struct task_struct *argowner)
 {
-	u32 newtid = task_pid_vnr(newowner) | FUTEX_WAITERS;
 	struct futex_pi_state *pi_state = q->pi_state;
-	struct task_struct *oldowner = pi_state->owner;
 	u32 uval, uninitialized_var(curval), newval;
+	struct task_struct *oldowner, *newowner;
+	u32 newtid;
 	int ret;
 
+	lockdep_assert_held(q->lock_ptr);
+
+	oldowner = pi_state->owner;
 	/* Owner died? */
 	if (!pi_state->owner)
 		newtid |= FUTEX_OWNER_DIED;
 
 	/*
-	 * We are here either because we stole the rtmutex from the
-	 * previous highest priority waiter or we are the highest priority
-	 * waiter but failed to get the rtmutex the first time.
-	 * We have to replace the newowner TID in the user space variable.
+	 * We are here because either:
+	 *
+	 *  - we stole the lock and pi_state->owner needs updating to reflect
+	 *    that (@argowner == current),
+	 *
+	 * or:
+	 *
+	 *  - someone stole our lock and we need to fix things to point to the
+	 *    new owner (@argowner == NULL).
+	 *
+	 * Either way, we have to replace the TID in the user space variable.
 	 * This must be atomic as we have to preserve the owner died bit here.
 	 *
 	 * Note: We write the user space value _before_ changing the pi_state
@@ -2264,6 +2268,39 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 	 * in lookup_pi_state.
 	 */
 retry:
+	if (!argowner) {
+		if (oldowner != current) {
+			/*
+			 * We raced against a concurrent self; things are
+			 * already fixed up. Nothing to do.
+			 */
+			return 0;
+		}
+
+		if (__rt_mutex_futex_trylock(&pi_state->pi_mutex)) {
+			/* We got the lock after all, nothing to fix. */
+			return 0;
+		}
+
+		/*
+		 * Since we just failed the trylock; there must be an owner.
+		 */
+		newowner = rt_mutex_owner(&pi_state->pi_mutex);
+		BUG_ON(!newowner);
+	} else {
+		WARN_ON_ONCE(argowner != current);
+		if (oldowner == current) {
+			/*
+			 * We raced against a concurrent self; things are
+			 * already fixed up. Nothing to do.
+			 */
+			return 0;
+		}
+		newowner = argowner;
+	}
+
+	newtid = task_pid_vnr(newowner) | FUTEX_WAITERS;
+
 	if (get_futex_value_locked(&uval, uaddr))
 		goto handle_fault;
 
@@ -2350,12 +2387,29 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
 		/*
 		 * Got the lock. We might not be the anticipated owner if we
 		 * did a lock-steal - fix up the PI-state in that case:
+		 *
+		 * Speculative pi_state->owner read (we don't hold wait_lock);
+		 * since we own the lock pi_state->owner == current is the
+		 * stable state, anything else needs more attention.
 		 */
 		if (q->pi_state->owner != current)
 			ret = fixup_pi_state_owner(uaddr, q, current);
 		goto out;
 	}
 
+	/*
+	 * If we didn't get the lock; check if anybody stole it from us. In
+	 * that case, we need to fix up the uval to point to them instead of
+	 * us, otherwise bad things happen. [10]
+	 *
+	 * Another speculative read; pi_state->owner == current is unstable
+	 * but needs our attention.
+	 */
+	if (q->pi_state->owner == current) {
+		ret = fixup_pi_state_owner(uaddr, q, NULL);
+		goto out;
+	}
+
 	/*
 	 * Paranoia check. If we did not take the lock, then we should not be
 	 * the owner of the rt_mutex.
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index e3dd1642423f..45d3c9aec853 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1284,6 +1284,19 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state,
 	return ret;
 }
 
+static inline int __rt_mutex_slowtrylock(struct rt_mutex *lock)
+{
+	int ret = try_to_take_rt_mutex(lock, current, NULL);
+
+	/*
+	 * try_to_take_rt_mutex() sets the lock waiters bit
+	 * unconditionally. Clean this up.
+	 */
+	fixup_rt_mutex_waiters(lock);
+
+	return ret;
+}
+
 /*
  * Slow path try-lock function:
  */
@@ -1305,13 +1318,7 @@ static inline int rt_mutex_slowtrylock(struct rt_mutex *lock)
 	 */
 	raw_spin_lock(&lock->wait_lock);
 
-	ret = try_to_take_rt_mutex(lock, current, NULL);
-
-	/*
-	 * try_to_take_rt_mutex() sets the lock waiters bit
-	 * unconditionally. Clean this up.
-	 */
-	fixup_rt_mutex_waiters(lock);
+	ret = __rt_mutex_slowtrylock(lock);
 
 	raw_spin_unlock(&lock->wait_lock);
 
@@ -1496,6 +1503,11 @@ int __sched rt_mutex_futex_trylock(struct rt_mutex *lock)
 	return rt_mutex_slowtrylock(lock);
 }
 
+int __sched __rt_mutex_futex_trylock(struct rt_mutex *lock)
+{
+	return __rt_mutex_slowtrylock(lock);
+}
+
 /**
  * rt_mutex_timed_lock - lock a rt_mutex interruptible
  *			the timeout structure is provided
diff --git a/kernel/locking/rtmutex_common.h b/kernel/locking/rtmutex_common.h
index cdcaccfb7443..ea7310b9ce83 100644
--- a/kernel/locking/rtmutex_common.h
+++ b/kernel/locking/rtmutex_common.h
@@ -113,6 +113,7 @@ extern bool rt_mutex_cleanup_proxy_lock(struct rt_mutex *lock,
 				 struct rt_mutex_waiter *waiter);
 extern int rt_mutex_timed_futex_lock(struct rt_mutex *l, struct hrtimer_sleeper *to);
 extern int rt_mutex_futex_trylock(struct rt_mutex *l);
+extern int __rt_mutex_futex_trylock(struct rt_mutex *l);
 
 extern void rt_mutex_futex_unlock(struct rt_mutex *lock);
 extern bool __rt_mutex_futex_unlock(struct rt_mutex *lock,

From b607967e3eeb9ed28118d633071b6db620115262 Mon Sep 17 00:00:00 2001
From: Lee Jones <lee.jones@linaro.org>
Date: Thu, 4 Feb 2021 17:28:58 +0000
Subject: [PATCH 1449/2658] futex: Replace pointless printk in fixup_owner()

From: Thomas Gleixner <tglx@linutronix.de>

[ Upstream commit 04b79c55201f02ffd675e1231d731365e335c307 ]

If that unexpected case of inconsistent arguments ever happens then the
futex state is left completely inconsistent and the printk is not really
helpful. Replace it with a warning and make the state consistent.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 45b5b5cae621..a7ed027ce6a3 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2412,14 +2412,10 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
 
 	/*
 	 * Paranoia check. If we did not take the lock, then we should not be
-	 * the owner of the rt_mutex.
+	 * the owner of the rt_mutex. Warn and establish consistent state.
 	 */
-	if (rt_mutex_owner(&q->pi_state->pi_mutex) == current) {
-		printk(KERN_ERR "fixup_owner: ret = %d pi-mutex: %p "
-				"pi-state %p\n", ret,
-				q->pi_state->pi_mutex.owner,
-				q->pi_state->owner);
-	}
+	if (WARN_ON_ONCE(rt_mutex_owner(&q->pi_state->pi_mutex) == current))
+		return fixup_pi_state_owner(uaddr, q, current);
 
 out:
 	return ret ? ret : locked;

From 8952fd1744a1fbab1bc191874e458300e0a39078 Mon Sep 17 00:00:00 2001
From: Lee Jones <lee.jones@linaro.org>
Date: Thu, 4 Feb 2021 17:28:59 +0000
Subject: [PATCH 1450/2658] futex: Provide and use pi_state_update_owner()

From: Thomas Gleixner <tglx@linutronix.de>

[ Upstream commit c5cade200ab9a2a3be9e7f32a752c8d86b502ec7 ]

Updating pi_state::owner is done at several places with the same
code. Provide a function for it and use that at the obvious places.

This is also a preparation for a bug fix to avoid yet another copy of the
same code or alternatively introducing a completely unpenetratable mess of
gotos.

Originally-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 64 ++++++++++++++++++++++++++------------------------
 1 file changed, 33 insertions(+), 31 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index a7ed027ce6a3..f665661dc8ce 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -835,6 +835,29 @@ static struct futex_pi_state * alloc_pi_state(void)
 	return pi_state;
 }
 
+static void pi_state_update_owner(struct futex_pi_state *pi_state,
+				  struct task_struct *new_owner)
+{
+	struct task_struct *old_owner = pi_state->owner;
+
+	lockdep_assert_held(&pi_state->pi_mutex.wait_lock);
+
+	if (old_owner) {
+		raw_spin_lock(&old_owner->pi_lock);
+		WARN_ON(list_empty(&pi_state->list));
+		list_del_init(&pi_state->list);
+		raw_spin_unlock(&old_owner->pi_lock);
+	}
+
+	if (new_owner) {
+		raw_spin_lock(&new_owner->pi_lock);
+		WARN_ON(!list_empty(&pi_state->list));
+		list_add(&pi_state->list, &new_owner->pi_state_list);
+		pi_state->owner = new_owner;
+		raw_spin_unlock(&new_owner->pi_lock);
+	}
+}
+
 /*
  * Must be called with the hb lock held.
  */
@@ -1427,26 +1450,16 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this,
 		else
 			ret = -EINVAL;
 	}
-	if (ret) {
-		raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
-		return ret;
-	}
-
-	raw_spin_lock_irq(&pi_state->owner->pi_lock);
-	WARN_ON(list_empty(&pi_state->list));
-	list_del_init(&pi_state->list);
-	raw_spin_unlock_irq(&pi_state->owner->pi_lock);
 
-	raw_spin_lock_irq(&new_owner->pi_lock);
-	WARN_ON(!list_empty(&pi_state->list));
-	list_add(&pi_state->list, &new_owner->pi_state_list);
-	pi_state->owner = new_owner;
-	raw_spin_unlock_irq(&new_owner->pi_lock);
-
-	/*
-	 * We've updated the uservalue, this unlock cannot fail.
-	 */
-	deboost = __rt_mutex_futex_unlock(&pi_state->pi_mutex, &wake_q);
+	if (!ret) {
+		/*
+		 * This is a point of no return; once we modified the uval
+		 * there is no going back and subsequent operations must
+		 * not fail.
+		 */
+		pi_state_update_owner(pi_state, new_owner);
+		deboost = __rt_mutex_futex_unlock(&pi_state->pi_mutex, &wake_q);
+	}
 
 	raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
 	spin_unlock(&hb->lock);
@@ -2318,19 +2331,8 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 	 * We fixed up user space. Now we need to fix the pi_state
 	 * itself.
 	 */
-	if (pi_state->owner != NULL) {
-		raw_spin_lock_irq(&pi_state->owner->pi_lock);
-		WARN_ON(list_empty(&pi_state->list));
-		list_del_init(&pi_state->list);
-		raw_spin_unlock_irq(&pi_state->owner->pi_lock);
-	}
-
-	pi_state->owner = newowner;
+	pi_state_update_owner(pi_state, newowner);
 
-	raw_spin_lock_irq(&newowner->pi_lock);
-	WARN_ON(!list_empty(&pi_state->list));
-	list_add(&pi_state->list, &newowner->pi_state_list);
-	raw_spin_unlock_irq(&newowner->pi_lock);
 	return 0;
 
 	/*

From 03d718011a18f9d069f46709756b19ab958843ec Mon Sep 17 00:00:00 2001
From: Lee Jones <lee.jones@linaro.org>
Date: Thu, 4 Feb 2021 17:29:00 +0000
Subject: [PATCH 1451/2658] rtmutex: Remove unused argument from
 rt_mutex_proxy_unlock()

From: Thomas Gleixner <tglx@linutronix.de>

[ Upstream commit 2156ac1934166d6deb6cd0f6ffc4c1076ec63697 ]
Nothing uses the argument. Remove it as preparation to use
pi_state_update_owner().

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c                  | 2 +-
 kernel/locking/rtmutex.c        | 3 +--
 kernel/locking/rtmutex_common.h | 3 +--
 3 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index f665661dc8ce..2c06c085ca27 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -878,7 +878,7 @@ static void free_pi_state(struct futex_pi_state *pi_state)
 		list_del_init(&pi_state->list);
 		raw_spin_unlock_irq(&pi_state->owner->pi_lock);
 
-		rt_mutex_proxy_unlock(&pi_state->pi_mutex, pi_state->owner);
+		rt_mutex_proxy_unlock(&pi_state->pi_mutex);
 	}
 
 	if (current->pi_state_cache)
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index 45d3c9aec853..1c0cb5c3c6ad 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1662,8 +1662,7 @@ void rt_mutex_init_proxy_locked(struct rt_mutex *lock,
  * No locking. Caller has to do serializing itself
  * Special API call for PI-futex support
  */
-void rt_mutex_proxy_unlock(struct rt_mutex *lock,
-			   struct task_struct *proxy_owner)
+void rt_mutex_proxy_unlock(struct rt_mutex *lock)
 {
 	debug_rt_mutex_proxy_unlock(lock);
 	rt_mutex_set_owner(lock, NULL);
diff --git a/kernel/locking/rtmutex_common.h b/kernel/locking/rtmutex_common.h
index ea7310b9ce83..4584db96265d 100644
--- a/kernel/locking/rtmutex_common.h
+++ b/kernel/locking/rtmutex_common.h
@@ -101,8 +101,7 @@ enum rtmutex_chainwalk {
 extern struct task_struct *rt_mutex_next_owner(struct rt_mutex *lock);
 extern void rt_mutex_init_proxy_locked(struct rt_mutex *lock,
 				       struct task_struct *proxy_owner);
-extern void rt_mutex_proxy_unlock(struct rt_mutex *lock,
-				  struct task_struct *proxy_owner);
+extern void rt_mutex_proxy_unlock(struct rt_mutex *lock);
 extern int rt_mutex_start_proxy_lock(struct rt_mutex *lock,
 				     struct rt_mutex_waiter *waiter,
 				     struct task_struct *task);

From 61720c89325f382bb0dc7097c60d26dad4dcda6d Mon Sep 17 00:00:00 2001
From: Lee Jones <lee.jones@linaro.org>
Date: Thu, 4 Feb 2021 17:29:01 +0000
Subject: [PATCH 1452/2658] futex: Use pi_state_update_owner() in
 put_pi_state()

From: Thomas Gleixner <tglx@linutronix.de>

[ Upstream commit 6ccc84f917d33312eb2846bd7b567639f585ad6d ]

No point in open coding it. This way it gains the extra sanity checks.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 2c06c085ca27..e32fcd49fe2e 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -874,10 +874,7 @@ static void free_pi_state(struct futex_pi_state *pi_state)
 	 * and has cleaned up the pi_state already
 	 */
 	if (pi_state->owner) {
-		raw_spin_lock_irq(&pi_state->owner->pi_lock);
-		list_del_init(&pi_state->list);
-		raw_spin_unlock_irq(&pi_state->owner->pi_lock);
-
+		pi_state_update_owner(pi_state, NULL);
 		rt_mutex_proxy_unlock(&pi_state->pi_mutex);
 	}
 

From 46a1953789601eada843d22eb00b5551d4f046e2 Mon Sep 17 00:00:00 2001
From: Lee Jones <lee.jones@linaro.org>
Date: Thu, 4 Feb 2021 17:29:02 +0000
Subject: [PATCH 1453/2658] futex: Simplify fixup_pi_state_owner()

From: Thomas Gleixner <tglx@linutronix.de>

[ Upstream commit f2dac39d93987f7de1e20b3988c8685523247ae2 ]

Too many gotos already and an upcoming fix would make it even more
unreadable.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 41 +++++++++++++++++++++++++++--------------
 1 file changed, 27 insertions(+), 14 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index e32fcd49fe2e..3cfdeb6368a6 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2237,18 +2237,16 @@ static void unqueue_me_pi(struct futex_q *q)
 	spin_unlock(q->lock_ptr);
 }
 
-static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
-				struct task_struct *argowner)
+static int __fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
+				  struct task_struct *argowner)
 {
 	struct futex_pi_state *pi_state = q->pi_state;
-	u32 uval, uninitialized_var(curval), newval;
 	struct task_struct *oldowner, *newowner;
-	u32 newtid;
-	int ret;
-
-	lockdep_assert_held(q->lock_ptr);
+	u32 uval, curval, newval, newtid;
+	int err = 0;
 
 	oldowner = pi_state->owner;
+
 	/* Owner died? */
 	if (!pi_state->owner)
 		newtid |= FUTEX_OWNER_DIED;
@@ -2289,7 +2287,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 
 		if (__rt_mutex_futex_trylock(&pi_state->pi_mutex)) {
 			/* We got the lock after all, nothing to fix. */
-			return 0;
+			return 1;
 		}
 
 		/*
@@ -2304,7 +2302,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 			 * We raced against a concurrent self; things are
 			 * already fixed up. Nothing to do.
 			 */
-			return 0;
+			return 1;
 		}
 		newowner = argowner;
 	}
@@ -2345,7 +2343,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 handle_fault:
 	spin_unlock(q->lock_ptr);
 
-	ret = fault_in_user_writeable(uaddr);
+	err = fault_in_user_writeable(uaddr);
 
 	spin_lock(q->lock_ptr);
 
@@ -2353,12 +2351,27 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 	 * Check if someone else fixed it for us:
 	 */
 	if (pi_state->owner != oldowner)
-		return 0;
+		return argowner == current;
 
-	if (ret)
-		return ret;
+	/* Retry if err was -EAGAIN or the fault in succeeded */
+	if (!err)
+		goto retry;
 
-	goto retry;
+	return err;
+}
+
+static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
+				struct task_struct *argowner)
+{
+	struct futex_pi_state *pi_state = q->pi_state;
+	int ret;
+
+	lockdep_assert_held(q->lock_ptr);
+
+	raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
+	ret = __fixup_pi_state_owner(uaddr, q, argowner);
+	raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
+	return ret;
 }
 
 static long futex_wait_restart(struct restart_block *restart);

From a087ee7c2558dbe3e73642016896e6a00b0847a8 Mon Sep 17 00:00:00 2001
From: Lee Jones <lee.jones@linaro.org>
Date: Thu, 4 Feb 2021 17:29:03 +0000
Subject: [PATCH 1454/2658] futex: Handle faults correctly for PI futexes

From: Thomas Gleixner <tglx@linutronix.de>

fixup_pi_state_owner() tries to ensure that the state of the rtmutex,
pi_state and the user space value related to the PI futex are consistent
before returning to user space. In case that the user space value update
faults and the fault cannot be resolved by faulting the page in via
fault_in_user_writeable() the function returns with -EFAULT and leaves
the rtmutex and pi_state owner state inconsistent.

A subsequent futex_unlock_pi() operates on the inconsistent pi_state and
releases the rtmutex despite not owning it which can corrupt the RB tree of
the rtmutex and cause a subsequent kernel stack use after free.

It was suggested to loop forever in fixup_pi_state_owner() if the fault
cannot be resolved, but that results in runaway tasks which is especially
undesired when the problem happens due to a programming error and not due
to malice.

As the user space value cannot be fixed up, the proper solution is to make
the rtmutex and the pi_state consistent so both have the same owner. This
leaves the user space value out of sync. Any subsequent operation on the
futex will fail because the 10th rule of PI futexes (pi_state owner and
user space value are consistent) has been violated.

As a consequence this removes the inept attempts of 'fixing' the situation
in case that the current task owns the rtmutex when returning with an
unresolvable fault by unlocking the rtmutex which left pi_state::owner and
rtmutex::owner out of sync in a different and only slightly less dangerous
way.

Fixes: 1b7558e457ed ("futexes: fix fault handling in futex_lock_pi")
Reported-by: gzobqq@gmail.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 38 ++++++++++++++++++++------------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 3cfdeb6368a6..4ecf73d2c19a 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1012,7 +1012,8 @@ static void exit_pi_state_list(struct task_struct *curr)
  *	FUTEX_OWNER_DIED bit. See [4]
  *
  * [10] There is no transient state which leaves owner and user space
- *	TID out of sync.
+ *	TID out of sync. Except one error case where the kernel is denied
+ *	write access to the user address, see fixup_pi_state_owner().
  */
 
 /*
@@ -2357,6 +2358,24 @@ static int __fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 	if (!err)
 		goto retry;
 
+	/*
+	 * fault_in_user_writeable() failed so user state is immutable. At
+	 * best we can make the kernel state consistent but user state will
+	 * be most likely hosed and any subsequent unlock operation will be
+	 * rejected due to PI futex rule [10].
+	 *
+	 * Ensure that the rtmutex owner is also the pi_state owner despite
+	 * the user space value claiming something different. There is no
+	 * point in unlocking the rtmutex if current is the owner as it
+	 * would need to wait until the next waiter has taken the rtmutex
+	 * to guarantee consistent state. Keep it simple. Userspace asked
+	 * for this wreckaged state.
+	 *
+	 * The rtmutex has an owner - either current or some other
+	 * task. See the EAGAIN loop above.
+	 */
+	pi_state_update_owner(pi_state, rt_mutex_owner(&pi_state->pi_mutex));
+
 	return err;
 }
 
@@ -2742,13 +2761,6 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags,
 	if (res)
 		ret = (res < 0) ? res : 0;
 
-	/*
-	 * If fixup_owner() faulted and was unable to handle the fault, unlock
-	 * it and return the fault to userspace.
-	 */
-	if (ret && (rt_mutex_owner(&q.pi_state->pi_mutex) == current))
-		rt_mutex_futex_unlock(&q.pi_state->pi_mutex);
-
 	/* Unqueue and drop the lock */
 	unqueue_me_pi(&q);
 
@@ -3053,8 +3065,6 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
 		if (q.pi_state && (q.pi_state->owner != current)) {
 			spin_lock(q.lock_ptr);
 			ret = fixup_pi_state_owner(uaddr2, &q, current);
-			if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current)
-				rt_mutex_futex_unlock(&q.pi_state->pi_mutex);
 			/*
 			 * Drop the reference to the pi state which
 			 * the requeue_pi() code acquired for us.
@@ -3091,14 +3101,6 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
 		if (res)
 			ret = (res < 0) ? res : 0;
 
-		/*
-		 * If fixup_pi_state_owner() faulted and was unable to handle
-		 * the fault, unlock the rt_mutex and return the fault to
-		 * userspace.
-		 */
-		if (ret && rt_mutex_owner(pi_mutex) == current)
-			rt_mutex_futex_unlock(pi_mutex);
-
 		/* Unqueue and drop the lock. */
 		unqueue_me_pi(&q);
 	}

From 01136f458a52b87a30ba94fad8ab5cf6929610a1 Mon Sep 17 00:00:00 2001
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Date: Thu, 14 Jan 2021 00:09:51 -0800
Subject: [PATCH 1455/2658] usb: udc: core: Use lock when write to soft_connect

commit c28095bc99073ddda65e4f31f6ae0d908d4d5cd8 upstream

Use lock to guard against concurrent access for soft-connect/disconnect
operations when writing to soft_connect sysfs.

Fixes: 2ccea03a8f7e ("usb: gadget: introduce UDC Class")
Cc: stable@vger.kernel.org
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/338ea01fbd69b1985ef58f0f59af02c805ddf189.1610611437.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[sudip: manual backporting to old file]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/udc/udc-core.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/udc/udc-core.c b/drivers/usb/gadget/udc/udc-core.c
index 21a7915d6a4a..3454e263fd82 100644
--- a/drivers/usb/gadget/udc/udc-core.c
+++ b/drivers/usb/gadget/udc/udc-core.c
@@ -618,10 +618,13 @@ static ssize_t usb_udc_softconn_store(struct device *dev,
 		struct device_attribute *attr, const char *buf, size_t n)
 {
 	struct usb_udc		*udc = container_of(dev, struct usb_udc, dev);
+	ssize_t			ret;
 
+	mutex_lock(&udc_lock);
 	if (!udc->driver) {
 		dev_err(dev, "soft-connect without a gadget driver\n");
-		return -EOPNOTSUPP;
+		ret = -EOPNOTSUPP;
+		goto out;
 	}
 
 	if (sysfs_streq(buf, "connect")) {
@@ -633,10 +636,14 @@ static ssize_t usb_udc_softconn_store(struct device *dev,
 		usb_gadget_udc_stop(udc);
 	} else {
 		dev_err(dev, "unsupported command '%s'\n", buf);
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out;
 	}
 
-	return n;
+	ret = n;
+out:
+	mutex_unlock(&udc_lock);
+	return ret;
 }
 static DEVICE_ATTR(soft_connect, S_IWUSR, NULL, usb_udc_softconn_store);
 

From b0e1f1470225c23aa28ccc806f76670fdbe6653f Mon Sep 17 00:00:00 2001
From: Javed Hasan <jhasan@marvell.com>
Date: Tue, 15 Dec 2020 11:47:31 -0800
Subject: [PATCH 1456/2658] scsi: libfc: Avoid invoking response handler twice
 if ep is already completed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit b2b0f16fa65e910a3ec8771206bb49ee87a54ac5 ]

A race condition exists between the response handler getting called because
of exchange_mgr_reset() (which clears out all the active XIDs) and the
response we get via an interrupt.

Sequence of events:

	 rport ba0200: Port timeout, state PLOGI
	 rport ba0200: Port entered PLOGI state from PLOGI state
	 xid 1052: Exchange timer armed : 20000 msecs      xid timer armed here
	 rport ba0200: Received LOGO request while in state PLOGI
	 rport ba0200: Delete port
	 rport ba0200: work event 3
	 rport ba0200: lld callback ev 3
	 bnx2fc: rport_event_hdlr: event = 3, port_id = 0xba0200
	 bnx2fc: ba0200 - rport not created Yet!!
	 /* Here we reset any outstanding exchanges before
	 freeing rport using the exch_mgr_reset() */
	 xid 1052: Exchange timer canceled
	 /* Here we got two responses for one xid */
	 xid 1052: invoking resp(), esb 20000000 state 3
	 xid 1052: invoking resp(), esb 20000000 state 3
	 xid 1052: fc_rport_plogi_resp() : ep->resp_active 2
	 xid 1052: fc_rport_plogi_resp() : ep->resp_active 2

Skip the response if the exchange is already completed.

Link: https://lore.kernel.org/r/20201215194731.2326-1-jhasan@marvell.com
Signed-off-by: Javed Hasan <jhasan@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/libfc/fc_exch.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
index b20c575564e4..a088f74a157c 100644
--- a/drivers/scsi/libfc/fc_exch.c
+++ b/drivers/scsi/libfc/fc_exch.c
@@ -1577,8 +1577,13 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
 		rc = fc_exch_done_locked(ep);
 		WARN_ON(fc_seq_exch(sp) != ep);
 		spin_unlock_bh(&ep->ex_lock);
-		if (!rc)
+		if (!rc) {
 			fc_exch_delete(ep);
+		} else {
+			FC_EXCH_DBG(ep, "ep is completed already,"
+					"hence skip calling the resp\n");
+			goto skip_resp;
+		}
 	}
 
 	/*
@@ -1597,6 +1602,7 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
 	if (!fc_invoke_resp(ep, sp, fp))
 		fc_frame_free(fp);
 
+skip_resp:
 	fc_exch_release(ep);
 	return;
 rel:
@@ -1841,10 +1847,16 @@ static void fc_exch_reset(struct fc_exch *ep)
 
 	fc_exch_hold(ep);
 
-	if (!rc)
+	if (!rc) {
 		fc_exch_delete(ep);
+	} else {
+		FC_EXCH_DBG(ep, "ep is completed already,"
+				"hence skip calling the resp\n");
+		goto skip_resp;
+	}
 
 	fc_invoke_resp(ep, sp, ERR_PTR(-FC_EX_CLOSED));
+skip_resp:
 	fc_seq_set_resp(sp, NULL, ep->arg);
 	fc_exch_release(ep);
 }

From 610a09ec53044c40431f6d102da8cb976511ea02 Mon Sep 17 00:00:00 2001
From: Brian King <brking@linux.vnet.ibm.com>
Date: Tue, 12 Jan 2021 09:06:38 -0600
Subject: [PATCH 1457/2658] scsi: ibmvfc: Set default timeout to avoid crash
 during migration

[ Upstream commit 764907293edc1af7ac857389af9dc858944f53dc ]

While testing live partition mobility, we have observed occasional crashes
of the Linux partition. What we've seen is that during the live migration,
for specific configurations with large amounts of memory, slow network
links, and workloads that are changing memory a lot, the partition can end
up being suspended for 30 seconds or longer. This resulted in the following
scenario:

CPU 0                          CPU 1
-------------------------------  ----------------------------------
scsi_queue_rq                    migration_store
 -> blk_mq_start_request          -> rtas_ibm_suspend_me
  -> blk_add_timer                 -> on_each_cpu(rtas_percpu_suspend_me
              _______________________________________V
             |
             V
    -> IPI from CPU 1
     -> rtas_percpu_suspend_me
                                     -> __rtas_suspend_last_cpu

-- Linux partition suspended for > 30 seconds --
                                      -> for_each_online_cpu(cpu)
                                           plpar_hcall_norets(H_PROD
 -> scsi_dispatch_cmd
                                      -> scsi_times_out
                                       -> scsi_abort_command
                                        -> queue_delayed_work
  -> ibmvfc_queuecommand_lck
   -> ibmvfc_send_event
    -> ibmvfc_send_crq
     - returns H_CLOSED
   <- returns SCSI_MLQUEUE_HOST_BUSY
-> __blk_mq_requeue_request

                                      -> scmd_eh_abort_handler
                                       -> scsi_try_to_abort_cmd
                                         - returns SUCCESS
                                       -> scsi_queue_insert

Normally, the SCMD_STATE_COMPLETE bit would protect against the command
completion and the timeout, but that doesn't work here, since we don't
check that at all in the SCSI_MLQUEUE_HOST_BUSY path.

In this case we end up calling scsi_queue_insert on a request that has
already been queued, or possibly even freed, and we crash.

The patch below simply increases the default I/O timeout to avoid this race
condition. This is also the timeout value that nearly all IBM SAN storage
recommends setting as the default value.

Link: https://lore.kernel.org/r/1610463998-19791-1-git-send-email-brking@linux.vnet.ibm.com
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ibmvscsi/ibmvfc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
index db80ab8335df..aa74f72e582a 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc.c
+++ b/drivers/scsi/ibmvscsi/ibmvfc.c
@@ -2883,8 +2883,10 @@ static int ibmvfc_slave_configure(struct scsi_device *sdev)
 	unsigned long flags = 0;
 
 	spin_lock_irqsave(shost->host_lock, flags);
-	if (sdev->type == TYPE_DISK)
+	if (sdev->type == TYPE_DISK) {
 		sdev->allow_restart = 1;
+		blk_queue_rq_timeout(sdev->request_queue, 120 * HZ);
+	}
 	spin_unlock_irqrestore(shost->host_lock, flags);
 	return 0;
 }

From 0bd128c432f57c9d2b3cdc6f6be51d5f429928a4 Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Fri, 5 Feb 2021 12:47:02 -0500
Subject: [PATCH 1458/2658] stable: clamp SUBLEVEL in 4.4 and 4.9

Right now SUBLEVEL is overflowing, and some userspace may start treating
4.9.256 as 4.10. While out of tree modules have different ways of
  extracting the version number (and we're generally ok with breaking
them), we do care about breaking userspace and it would appear that this
overflow might do just that.

Our rules around userspace ABI in the stable kernel are pretty simple:
we don't break it. Thus, while userspace may be checking major/minor, it
shouldn't be doing anything with sublevel.

This patch applies a big band-aid to the 4.9 and 4.4 kernels in the form
of clamping their sublevel to 255.

The clamp is done for the purpose of LINUX_VERSION_CODE only, and
extracting the version number from the Makefile or "make kernelversion"
will continue to work as intended.

We might need to do it later in newer trees, but maybe we'll have a
better solution by then, so I'm ignoring that problem for now.

Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 3af0c32f2e9c..14011c226e4c 100644
--- a/Makefile
+++ b/Makefile
@@ -1100,7 +1100,7 @@ endef
 
 define filechk_version.h
 	(echo \#define LINUX_VERSION_CODE $(shell                         \
-	expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + 0$(SUBLEVEL)); \
+	expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + 255); \
 	echo '#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))';)
 endef
 

From bd046ef536c2d670b2ac7510596d89aad9772019 Mon Sep 17 00:00:00 2001
From: Pho Tran <Pho.Tran@silabs.com>
Date: Mon, 25 Jan 2021 09:26:54 +0000
Subject: [PATCH 1459/2658] USB: serial: cp210x: add pid/vid for WSDA-200-USB

commit 3c4f6ecd93442f4376a58b38bb40ee0b8c46e0e6 upstream.

Information pid/vid of WSDA-200-USB, Lord corporation company:
vid: 199b
pid: ba30

Signed-off-by: Pho Tran <pho.tran@silabs.com>
[ johan: amend comment with product name ]
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/cp210x.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 13c718ebaee5..f67326c9fd27 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -197,6 +197,7 @@ static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(0x1901, 0x0194) },	/* GE Healthcare Remote Alarm Box */
 	{ USB_DEVICE(0x1901, 0x0195) },	/* GE B850/B650/B450 CP2104 DP UART interface */
 	{ USB_DEVICE(0x1901, 0x0196) },	/* GE B850 CP2105 DP UART interface */
+	{ USB_DEVICE(0x199B, 0xBA30) }, /* LORD WSDA-200-USB */
 	{ USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */
 	{ USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
 	{ USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */

From 39eb2daba2a211c7e547335c8d46367714542e5d Mon Sep 17 00:00:00 2001
From: Chenxin Jin <bg4akv@hotmail.com>
Date: Wed, 13 Jan 2021 16:59:05 +0800
Subject: [PATCH 1460/2658] USB: serial: cp210x: add new VID/PID for supporting
 Teraoka AD2000

commit 43377df70480f82919032eb09832e9646a8a5efb upstream.

Teraoka AD2000 uses the CP210x driver, but the chip VID/PID is
customized with 0988/0578. We need the driver to support the new
VID/PID.

Signed-off-by: Chenxin Jin <bg4akv@hotmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/cp210x.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index f67326c9fd27..ded4c8f2bba4 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -57,6 +57,7 @@ static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
 	{ USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */
 	{ USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */
+	{ USB_DEVICE(0x0988, 0x0578) }, /* Teraoka AD2000 */
 	{ USB_DEVICE(0x0B00, 0x3070) }, /* Ingenico 3070 */
 	{ USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */
 	{ USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */

From ee1e1d4f46d8c64a9886f2076ed1525645d82704 Mon Sep 17 00:00:00 2001
From: Christoph Schemmel <christoph.schemmel@gmail.com>
Date: Wed, 27 Jan 2021 20:58:46 +0100
Subject: [PATCH 1461/2658] USB: serial: option: Adding support for Cinterion
 MV31

commit e478d6029dca9d8462f426aee0d32896ef64f10f upstream.

Adding support for Cinterion device MV31 for enumeration with
PID 0x00B3 and 0x00B7.

usb-devices output for 0x00B3
T:  Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  6 Spd=5000 MxCh= 0
D:  Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs=  1
P:  Vendor=1e2d ProdID=00b3 Rev=04.14
S:  Manufacturer=Cinterion
S:  Product=Cinterion PID 0x00B3 USB Mobile Broadband
S:  SerialNumber=b3246eed
C:  #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA
I:  If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
I:  If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=cdc_wdm
I:  If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option

usb-devices output for 0x00B7
T:  Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  5 Spd=5000 MxCh= 0
D:  Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs=  1
P:  Vendor=1e2d ProdID=00b7 Rev=04.14
S:  Manufacturer=Cinterion
S:  Product=Cinterion PID 0x00B3 USB Mobile Broadband
S:  SerialNumber=b3246eed
C:  #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=896mA
I:  If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
I:  If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option

Signed-off-by: Christoph Schemmel <christoph.schemmel@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 1998b314368e..3c536eed0754 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -425,6 +425,8 @@ static void option_instat_callback(struct urb *urb);
 #define CINTERION_PRODUCT_AHXX_2RMNET		0x0084
 #define CINTERION_PRODUCT_AHXX_AUDIO		0x0085
 #define CINTERION_PRODUCT_CLS8			0x00b0
+#define CINTERION_PRODUCT_MV31_MBIM		0x00b3
+#define CINTERION_PRODUCT_MV31_RMNET		0x00b7
 
 /* Olivetti products */
 #define OLIVETTI_VENDOR_ID			0x0b3c
@@ -1896,6 +1898,10 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) },
 	{ USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */
 	{ USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+	{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV31_MBIM, 0xff),
+	  .driver_info = RSVD(3)},
+	{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV31_RMNET, 0xff),
+	  .driver_info = RSVD(0)},
 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100),
 	  .driver_info = RSVD(4) },
 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120),

From e97adcc9e5faced052e4412e55e81a4d74586bb3 Mon Sep 17 00:00:00 2001
From: Alexey Dobriyan <adobriyan@gmail.com>
Date: Sun, 3 Jan 2021 17:59:51 -0800
Subject: [PATCH 1462/2658] Input: i8042 - unbreak Pegatron C15B
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit a3a9060ecad030e2c7903b2b258383d2c716b56c ]

g++ reports

	drivers/input/serio/i8042-x86ia64io.h:225:3: error: ‘.matches’ designator used multiple times in the same initializer list

C99 semantics is that last duplicated initialiser wins,
so DMI entry gets overwritten.

Fixes: a48491c65b51 ("Input: i8042 - add ByteSpeed touchpad to noloop table")
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Acked-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
Link: https://lore.kernel.org/r/20201228072335.GA27766@localhost.localdomain
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/serio/i8042-x86ia64io.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index fa07be0b4500..2317f8d3fef6 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -223,6 +223,8 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
 			DMI_MATCH(DMI_SYS_VENDOR, "PEGATRON CORPORATION"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "C15B"),
 		},
+	},
+	{
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "ByteSpeed LLC"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "ByteSpeed Laptop C15B"),

From b643de5a0c708dbe1b50428bdde58f64556b2e20 Mon Sep 17 00:00:00 2001
From: Xie He <xie.he.0141@gmail.com>
Date: Sun, 31 Jan 2021 21:57:06 -0800
Subject: [PATCH 1463/2658] net: lapb: Copy the skb before sending a packet

[ Upstream commit 88c7a9fd9bdd3e453f04018920964c6f848a591a ]

When sending a packet, we will prepend it with an LAPB header.
This modifies the shared parts of a cloned skb, so we should copy the
skb rather than just clone it, before we prepend the header.

In "Documentation/networking/driver.rst" (the 2nd point), it states
that drivers shouldn't modify the shared parts of a cloned skb when
transmitting.

The "dev_queue_xmit_nit" function in "net/core/dev.c", which is called
when an skb is being sent, clones the skb and sents the clone to
AF_PACKET sockets. Because the LAPB drivers first remove a 1-byte
pseudo-header before handing over the skb to us, if we don't copy the
skb before prepending the LAPB header, the first byte of the packets
received on AF_PACKET sockets can be corrupted.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Acked-by: Martin Schiller <ms@dev.tdt.de>
Link: https://lore.kernel.org/r/20210201055706.415842-1-xie.he.0141@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/lapb/lapb_out.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/lapb/lapb_out.c b/net/lapb/lapb_out.c
index ba4d015bd1a6..7cbb77b7479a 100644
--- a/net/lapb/lapb_out.c
+++ b/net/lapb/lapb_out.c
@@ -87,7 +87,8 @@ void lapb_kick(struct lapb_cb *lapb)
 		skb = skb_dequeue(&lapb->write_queue);
 
 		do {
-			if ((skbn = skb_clone(skb, GFP_ATOMIC)) == NULL) {
+			skbn = skb_copy(skb, GFP_ATOMIC);
+			if (!skbn) {
 				skb_queue_head(&lapb->write_queue, skb);
 				break;
 			}

From 35708f6c9130330e2dfe7a83ef7f823ce539d32a Mon Sep 17 00:00:00 2001
From: Ralf Baechle <ralf@linux-mips.org>
Date: Mon, 23 May 2016 16:22:26 -0700
Subject: [PATCH 1464/2658] ELF/MIPS build fix

commit f43edca7ed08fc02279f2a62015da5cb6aa0ad61 upstream.

CONFIG_MIPS32_N32=y but CONFIG_BINFMT_ELF disabled results in the
following linker errors:

  arch/mips/built-in.o: In function `elf_core_dump':
  binfmt_elfn32.c:(.text+0x23dbc): undefined reference to `elf_core_extra_phdrs'
  binfmt_elfn32.c:(.text+0x246e4): undefined reference to `elf_core_extra_data_size'
  binfmt_elfn32.c:(.text+0x248d0): undefined reference to `elf_core_write_extra_phdrs'
  binfmt_elfn32.c:(.text+0x24ac4): undefined reference to `elf_core_write_extra_data'

CONFIG_MIPS32_O32=y but CONFIG_BINFMT_ELF disabled results in the following
linker errors:

  arch/mips/built-in.o: In function `elf_core_dump':
  binfmt_elfo32.c:(.text+0x28a04): undefined reference to `elf_core_extra_phdrs'
  binfmt_elfo32.c:(.text+0x29330): undefined reference to `elf_core_extra_data_size'
  binfmt_elfo32.c:(.text+0x2951c): undefined reference to `elf_core_write_extra_phdrs'
  binfmt_elfo32.c:(.text+0x29710): undefined reference to `elf_core_write_extra_data'

This is because binfmt_elfn32 and binfmt_elfo32 are using symbols from
elfcore but for these configurations elfcore will not be built.

Fixed by making elfcore selectable by a separate config symbol which
unlike the current mechanism can also be used from other directories
than kernel/, then having each flavor of ELF that relies on elfcore.o,
select it in Kconfig, including CONFIG_MIPS32_N32 and CONFIG_MIPS32_O32
which fixes this issue.

Link: http://lkml.kernel.org/r/20160520141705.GA1913@linux-mips.org
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Reviewed-by: James Hogan <james.hogan@imgtec.com>
Cc: "Maciej W. Rozycki" <macro@linux-mips.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/Kconfig | 1 +
 fs/Kconfig.binfmt | 8 ++++++++
 kernel/Makefile   | 4 +---
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 9d8bc19edc48..9f1376788820 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -2990,6 +2990,7 @@ config MIPS32_N32
 config BINFMT_ELF32
 	bool
 	default y if MIPS32_O32 || MIPS32_N32
+	select ELFCORE
 
 endmenu
 
diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
index 2d0cbbd14cfc..72c03354c14b 100644
--- a/fs/Kconfig.binfmt
+++ b/fs/Kconfig.binfmt
@@ -1,6 +1,7 @@
 config BINFMT_ELF
 	bool "Kernel support for ELF binaries"
 	depends on MMU && (BROKEN || !FRV)
+	select ELFCORE
 	default y
 	---help---
 	  ELF (Executable and Linkable Format) is a format for libraries and
@@ -26,6 +27,7 @@ config BINFMT_ELF
 config COMPAT_BINFMT_ELF
 	bool
 	depends on COMPAT && BINFMT_ELF
+	select ELFCORE
 
 config ARCH_BINFMT_ELF_STATE
 	bool
@@ -34,6 +36,7 @@ config BINFMT_ELF_FDPIC
 	bool "Kernel support for FDPIC ELF binaries"
 	default y
 	depends on (FRV || BLACKFIN || (SUPERH32 && !MMU) || C6X)
+	select ELFCORE
 	help
 	  ELF FDPIC binaries are based on ELF, but allow the individual load
 	  segments of a binary to be located in memory independently of each
@@ -43,6 +46,11 @@ config BINFMT_ELF_FDPIC
 
 	  It is also possible to run FDPIC ELF binaries on MMU linux also.
 
+config ELFCORE
+	bool
+	help
+	  This option enables kernel/elfcore.o.
+
 config CORE_DUMP_DEFAULT_ELF_HEADERS
 	bool "Write ELF core dumps with partial segments"
 	default y
diff --git a/kernel/Makefile b/kernel/Makefile
index 51a42c443e25..d784435fa81c 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -89,9 +89,7 @@ obj-$(CONFIG_TASK_DELAY_ACCT) += delayacct.o
 obj-$(CONFIG_TASKSTATS) += taskstats.o tsacct.o
 obj-$(CONFIG_TRACEPOINTS) += tracepoint.o
 obj-$(CONFIG_LATENCYTOP) += latencytop.o
-obj-$(CONFIG_BINFMT_ELF) += elfcore.o
-obj-$(CONFIG_COMPAT_BINFMT_ELF) += elfcore.o
-obj-$(CONFIG_BINFMT_ELF_FDPIC) += elfcore.o
+obj-$(CONFIG_ELFCORE) += elfcore.o
 obj-$(CONFIG_FUNCTION_TRACER) += trace/
 obj-$(CONFIG_TRACING) += trace/
 obj-$(CONFIG_TRACE_CLOCK) += trace/

From 9710028784cd58c9efaead530670c35cd8d27ac3 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Fri, 11 Dec 2020 13:36:46 -0800
Subject: [PATCH 1465/2658] elfcore: fix building with clang

commit 6e7b64b9dd6d96537d816ea07ec26b7dedd397b9 upstream.

kernel/elfcore.c only contains weak symbols, which triggers a bug with
clang in combination with recordmcount:

  Cannot find symbol for section 2: .text.
  kernel/elfcore.o: failed

Move the empty stubs into linux/elfcore.h as inline functions.  As only
two architectures use these, just use the architecture specific Kconfig
symbols to key off the declaration.

Link: https://lkml.kernel.org/r/20201204165742.3815221-2-arnd@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: Nathan Chancellor <natechancellor@gmail.com>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Barret Rhoden <brho@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/elfcore.h | 22 ++++++++++++++++++++++
 kernel/Makefile         |  1 -
 kernel/elfcore.c        | 25 -------------------------
 3 files changed, 22 insertions(+), 26 deletions(-)
 delete mode 100644 kernel/elfcore.c

diff --git a/include/linux/elfcore.h b/include/linux/elfcore.h
index 698d51a0eea3..4adf7faeaeb5 100644
--- a/include/linux/elfcore.h
+++ b/include/linux/elfcore.h
@@ -55,6 +55,7 @@ static inline int elf_core_copy_task_xfpregs(struct task_struct *t, elf_fpxregse
 }
 #endif
 
+#if defined(CONFIG_UM) || defined(CONFIG_IA64)
 /*
  * These functions parameterize elf_core_dump in fs/binfmt_elf.c to write out
  * extra segments containing the gate DSO contents.  Dumping its
@@ -69,5 +70,26 @@ elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset);
 extern int
 elf_core_write_extra_data(struct coredump_params *cprm);
 extern size_t elf_core_extra_data_size(void);
+#else
+static inline Elf_Half elf_core_extra_phdrs(void)
+{
+	return 0;
+}
+
+static inline int elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset)
+{
+	return 1;
+}
+
+static inline int elf_core_write_extra_data(struct coredump_params *cprm)
+{
+	return 1;
+}
+
+static inline size_t elf_core_extra_data_size(void)
+{
+	return 0;
+}
+#endif
 
 #endif /* _LINUX_ELFCORE_H */
diff --git a/kernel/Makefile b/kernel/Makefile
index d784435fa81c..baf795283df5 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -89,7 +89,6 @@ obj-$(CONFIG_TASK_DELAY_ACCT) += delayacct.o
 obj-$(CONFIG_TASKSTATS) += taskstats.o tsacct.o
 obj-$(CONFIG_TRACEPOINTS) += tracepoint.o
 obj-$(CONFIG_LATENCYTOP) += latencytop.o
-obj-$(CONFIG_ELFCORE) += elfcore.o
 obj-$(CONFIG_FUNCTION_TRACER) += trace/
 obj-$(CONFIG_TRACING) += trace/
 obj-$(CONFIG_TRACE_CLOCK) += trace/
diff --git a/kernel/elfcore.c b/kernel/elfcore.c
deleted file mode 100644
index a2b29b9bdfcb..000000000000
--- a/kernel/elfcore.c
+++ /dev/null
@@ -1,25 +0,0 @@
-#include <linux/elf.h>
-#include <linux/fs.h>
-#include <linux/mm.h>
-#include <linux/binfmts.h>
-#include <linux/elfcore.h>
-
-Elf_Half __weak elf_core_extra_phdrs(void)
-{
-	return 0;
-}
-
-int __weak elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset)
-{
-	return 1;
-}
-
-int __weak elf_core_write_extra_data(struct coredump_params *cprm)
-{
-	return 1;
-}
-
-size_t __weak elf_core_extra_data_size(void)
-{
-	return 0;
-}

From 44c05491efc1753c64d206dddc1259bccd789107 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 28 Jan 2021 12:33:42 +0300
Subject: [PATCH 1466/2658] USB: gadget: legacy: fix an error code in
 eth_bind()

commit 3e1f4a2e1184ae6ad7f4caf682ced9554141a0f4 upstream.

This code should return -ENOMEM if the allocation fails but it currently
returns success.

Fixes: 9b95236eebdb ("usb: gadget: ether: allocate and init otg descriptor by otg capabilities")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YBKE9rqVuJEOUWpW@mwanda
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/legacy/ether.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/legacy/ether.c b/drivers/usb/gadget/legacy/ether.c
index 31e9160223e9..0b7229678b53 100644
--- a/drivers/usb/gadget/legacy/ether.c
+++ b/drivers/usb/gadget/legacy/ether.c
@@ -407,8 +407,10 @@ static int eth_bind(struct usb_composite_dev *cdev)
 		struct usb_descriptor_header *usb_desc;
 
 		usb_desc = usb_otg_descriptor_alloc(gadget);
-		if (!usb_desc)
+		if (!usb_desc) {
+			status = -ENOMEM;
 			goto fail1;
+		}
 		usb_otg_descriptor_init(gadget, usb_desc);
 		otg_desc[0] = usb_desc;
 		otg_desc[1] = NULL;

From 26b36526a9dcf7d5497a0b31cc1d239272e8f5be Mon Sep 17 00:00:00 2001
From: Jeremy Figgins <kernel@jeremyfiggins.com>
Date: Sat, 23 Jan 2021 18:21:36 -0600
Subject: [PATCH 1467/2658] USB: usblp: don't call usb_set_interface if there's
 a single alt

commit d8c6edfa3f4ee0d45d7ce5ef18d1245b78774b9d upstream.

Some devices, such as the Winbond Electronics Corp. Virtual Com Port
(Vendor=0416, ProdId=5011), lockup when usb_set_interface() or
usb_clear_halt() are called. This device has only a single
altsetting, so it should not be necessary to call usb_set_interface().

Acked-by: Pete Zaitcev <zaitcev@redhat.com>
Signed-off-by: Jeremy Figgins <kernel@jeremyfiggins.com>
Link: https://lore.kernel.org/r/YAy9kJhM/rG8EQXC@watson
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/usblp.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
index 76701d6ce92c..582099f4f449 100644
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -1349,14 +1349,17 @@ static int usblp_set_protocol(struct usblp *usblp, int protocol)
 	if (protocol < USBLP_FIRST_PROTOCOL || protocol > USBLP_LAST_PROTOCOL)
 		return -EINVAL;
 
-	alts = usblp->protocol[protocol].alt_setting;
-	if (alts < 0)
-		return -EINVAL;
-	r = usb_set_interface(usblp->dev, usblp->ifnum, alts);
-	if (r < 0) {
-		printk(KERN_ERR "usblp: can't set desired altsetting %d on interface %d\n",
-			alts, usblp->ifnum);
-		return r;
+	/* Don't unnecessarily set the interface if there's a single alt. */
+	if (usblp->intf->num_altsetting > 1) {
+		alts = usblp->protocol[protocol].alt_setting;
+		if (alts < 0)
+			return -EINVAL;
+		r = usb_set_interface(usblp->dev, usblp->ifnum, alts);
+		if (r < 0) {
+			printk(KERN_ERR "usblp: can't set desired altsetting %d on interface %d\n",
+				alts, usblp->ifnum);
+			return r;
+		}
 	}
 
 	usblp->bidir = (usblp->protocol[protocol].epread != NULL);

From 8689b1f6a0a37d1ffe345dfda6bca4003ef11175 Mon Sep 17 00:00:00 2001
From: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
Date: Wed, 27 Jan 2021 11:39:19 +0100
Subject: [PATCH 1468/2658] usb: dwc2: Fix endpoint direction check in
 ep_from_windex

commit f670e9f9c8cac716c3506c6bac9e997b27ad441a upstream.

dwc2_hsotg_process_req_status uses ep_from_windex() to retrieve
the endpoint for the index provided in the wIndex request param.

In a test-case with a rndis gadget running and sending a malformed
packet to it like:
    dev.ctrl_transfer(
        0x82,      # bmRequestType
        0x00,       # bRequest
        0x0000,     # wValue
        0x0001,     # wIndex
        0x00       # wLength
    )
it is possible to cause a crash:

[  217.533022] dwc2 ff300000.usb: dwc2_hsotg_process_req_status: USB_REQ_GET_STATUS
[  217.559003] Unable to handle kernel read from unreadable memory at virtual address 0000000000000088
...
[  218.313189] Call trace:
[  218.330217]  ep_from_windex+0x3c/0x54
[  218.348565]  usb_gadget_giveback_request+0x10/0x20
[  218.368056]  dwc2_hsotg_complete_request+0x144/0x184

This happens because ep_from_windex wants to compare the endpoint
direction even if index_to_ep() didn't return an endpoint due to
the direction not matching.

The fix is easy insofar that the actual direction check is already
happening when calling index_to_ep() which will return NULL if there
is no endpoint for the targeted direction, so the offending check
can go away completely.

Fixes: c6f5c050e2a7 ("usb: dwc2: gadget: add bi-directional endpoint support")
Cc: stable@vger.kernel.org
Reported-by: Gerhard Klostermeier <gerhard.klostermeier@syss.de>
Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
Link: https://lore.kernel.org/r/20210127103919.58215-1-heiko@sntech.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc2/gadget.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index e5ad717cba22..135e97310f11 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -871,7 +871,6 @@ static void dwc2_hsotg_complete_oursetup(struct usb_ep *ep,
 static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
 					   u32 windex)
 {
-	struct dwc2_hsotg_ep *ep;
 	int dir = (windex & USB_DIR_IN) ? 1 : 0;
 	int idx = windex & 0x7F;
 
@@ -881,12 +880,7 @@ static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
 	if (idx > hsotg->num_of_eps)
 		return NULL;
 
-	ep = index_to_ep(hsotg, idx, dir);
-
-	if (idx && ep->dir_in != dir)
-		return NULL;
-
-	return ep;
+	return index_to_ep(hsotg, idx, dir);
 }
 
 /**

From fe4e53298261025c365f9730c6b5a852d208f8e6 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Mon, 1 Feb 2021 09:33:24 +0100
Subject: [PATCH 1469/2658] mac80211: fix station rate table updates on assoc

commit 18fe0fae61252b5ae6e26553e2676b5fac555951 upstream.

If the driver uses .sta_add, station entries are only uploaded after the sta
is in assoc state. Fix early station rate table updates by deferring them
until the sta has been uploaded.

Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20210201083324.3134-1-nbd@nbd.name
[use rcu_access_pointer() instead since we won't dereference here]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/driver-ops.c | 5 ++++-
 net/mac80211/rate.c       | 3 ++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c
index df2e4e311217..5d097ae26b70 100644
--- a/net/mac80211/driver-ops.c
+++ b/net/mac80211/driver-ops.c
@@ -128,8 +128,11 @@ int drv_sta_state(struct ieee80211_local *local,
 	} else if (old_state == IEEE80211_STA_AUTH &&
 		   new_state == IEEE80211_STA_ASSOC) {
 		ret = drv_sta_add(local, sdata, &sta->sta);
-		if (ret == 0)
+		if (ret == 0) {
 			sta->uploaded = true;
+			if (rcu_access_pointer(sta->sta.rates))
+				drv_sta_rate_tbl_update(local, sdata, &sta->sta);
+		}
 	} else if (old_state == IEEE80211_STA_ASSOC &&
 		   new_state == IEEE80211_STA_AUTH) {
 		drv_sta_remove(local, sdata, &sta->sta);
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index a4e2f4e67f94..a4d9e9ee06be 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -888,7 +888,8 @@ int rate_control_set_rates(struct ieee80211_hw *hw,
 	if (old)
 		kfree_rcu(old, rcu_head);
 
-	drv_sta_rate_tbl_update(hw_to_local(hw), sta->sdata, pubsta);
+	if (sta->uploaded)
+		drv_sta_rate_tbl_update(hw_to_local(hw), sta->sdata, pubsta);
 
 	return 0;
 }

From a2efd2997c63c91cc0c610f5482bf589648b1cca Mon Sep 17 00:00:00 2001
From: Wang ShaoBo <bobo.shaobowang@huawei.com>
Date: Thu, 28 Jan 2021 20:44:27 +0800
Subject: [PATCH 1470/2658] kretprobe: Avoid re-registration of the same
 kretprobe earlier

commit 0188b87899ffc4a1d36a0badbe77d56c92fd91dc upstream.

Our system encountered a re-init error when re-registering same kretprobe,
where the kretprobe_instance in rp->free_instances is illegally accessed
after re-init.

Implementation to avoid re-registration has been introduced for kprobe
before, but lags for register_kretprobe(). We must check if kprobe has
been re-registered before re-initializing kretprobe, otherwise it will
destroy the data struct of kretprobe registered, which can lead to memory
leak, system crash, also some unexpected behaviors.

We use check_kprobe_rereg() to check if kprobe has been re-registered
before running register_kretprobe()'s body, for giving a warning message
and terminate registration process.

Link: https://lkml.kernel.org/r/20210128124427.2031088-1-bobo.shaobowang@huawei.com

Cc: stable@vger.kernel.org
Fixes: 1f0ab40976460 ("kprobes: Prevent re-registration of the same kprobe")
[ The above commit should have been done for kretprobes too ]
Acked-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Acked-by: Ananth N Mavinakayanahalli <ananth@linux.ibm.com>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
Signed-off-by: Cheng Jian <cj.chengjian@huawei.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/kprobes.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 33c37dbc56a0..90f46c8aa900 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1884,6 +1884,10 @@ int register_kretprobe(struct kretprobe *rp)
 	int i;
 	void *addr;
 
+	/* If only rp->kp.addr is specified, check reregistering kprobes */
+	if (rp->kp.addr && check_kprobe_rereg(&rp->kp))
+		return -EINVAL;
+
 	if (kretprobe_blacklist_size) {
 		addr = kprobe_addr(&rp->kp);
 		if (IS_ERR(addr))

From 57b3f315c621e396490962792bbc7ed2986d7cea Mon Sep 17 00:00:00 2001
From: Aurelien Aptel <aaptel@suse.com>
Date: Fri, 5 Feb 2021 15:42:48 +0100
Subject: [PATCH 1471/2658] cifs: report error instead of invalid when
 revalidating a dentry fails

commit 21b200d091826a83aafc95d847139b2b0582f6d1 upstream.

Assuming
- //HOST/a is mounted on /mnt
- //HOST/b is mounted on /mnt/b

On a slow connection, running 'df' and killing it while it's
processing /mnt/b can make cifs_get_inode_info() returns -ERESTARTSYS.

This triggers the following chain of events:
=> the dentry revalidation fail
=> dentry is put and released
=> superblock associated with the dentry is put
=> /mnt/b is unmounted

This patch makes cifs_d_revalidate() return the error instead of 0
(invalid) when cifs_revalidate_dentry() fails, except for ENOENT (file
deleted) and ESTALE (file recreated).

Signed-off-by: Aurelien Aptel <aaptel@suse.com>
Suggested-by: Shyam Prasad N <nspmangalore@gmail.com>
Reviewed-by: Shyam Prasad N <nspmangalore@gmail.com>
CC: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/dir.c | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index be16da31cbcc..9f1641324a81 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -831,6 +831,7 @@ static int
 cifs_d_revalidate(struct dentry *direntry, unsigned int flags)
 {
 	struct inode *inode;
+	int rc;
 
 	if (flags & LOOKUP_RCU)
 		return -ECHILD;
@@ -840,8 +841,25 @@ cifs_d_revalidate(struct dentry *direntry, unsigned int flags)
 		if ((flags & LOOKUP_REVAL) && !CIFS_CACHE_READ(CIFS_I(inode)))
 			CIFS_I(inode)->time = 0; /* force reval */
 
-		if (cifs_revalidate_dentry(direntry))
-			return 0;
+		rc = cifs_revalidate_dentry(direntry);
+		if (rc) {
+			cifs_dbg(FYI, "cifs_revalidate_dentry failed with rc=%d", rc);
+			switch (rc) {
+			case -ENOENT:
+			case -ESTALE:
+				/*
+				 * Those errors mean the dentry is invalid
+				 * (file was deleted or recreated)
+				 */
+				return 0;
+			default:
+				/*
+				 * Otherwise some unexpected error happened
+				 * report it as-is to VFS layer
+				 */
+				return rc;
+			}
+		}
 		else {
 			/*
 			 * If the inode wasn't known to be a dfs entry when

From 92137458b2868e88d5730c290c3859bc53d157b0 Mon Sep 17 00:00:00 2001
From: Fengnan Chang <fengnanchang@gmail.com>
Date: Sat, 23 Jan 2021 11:32:31 +0800
Subject: [PATCH 1472/2658] mmc: core: Limit retries when analyse of SDIO
 tuples fails

commit f92e04f764b86e55e522988e6f4b6082d19a2721 upstream.

When analysing tuples fails we may loop indefinitely to retry. Let's avoid
this by using a 10s timeout and bail if not completed earlier.

Signed-off-by: Fengnan Chang <fengnanchang@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210123033230.36442-1-fengnanchang@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/core/sdio_cis.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/mmc/core/sdio_cis.c b/drivers/mmc/core/sdio_cis.c
index cf3978b6247b..dbdedf30837c 100644
--- a/drivers/mmc/core/sdio_cis.c
+++ b/drivers/mmc/core/sdio_cis.c
@@ -24,6 +24,8 @@
 #include "sdio_cis.h"
 #include "sdio_ops.h"
 
+#define SDIO_READ_CIS_TIMEOUT_MS  (10 * 1000) /* 10s */
+
 static int cistpl_vers_1(struct mmc_card *card, struct sdio_func *func,
 			 const unsigned char *buf, unsigned size)
 {
@@ -263,6 +265,8 @@ static int sdio_read_cis(struct mmc_card *card, struct sdio_func *func)
 
 	do {
 		unsigned char tpl_code, tpl_link;
+		unsigned long timeout = jiffies +
+			msecs_to_jiffies(SDIO_READ_CIS_TIMEOUT_MS);
 
 		ret = mmc_io_rw_direct(card, 0, 0, ptr++, 0, &tpl_code);
 		if (ret)
@@ -323,6 +327,8 @@ static int sdio_read_cis(struct mmc_card *card, struct sdio_func *func)
 			prev = &this->next;
 
 			if (ret == -ENOENT) {
+				if (time_after(jiffies, timeout))
+					break;
 				/* warn about unknown tuples */
 				pr_warn_ratelimited("%s: queuing unknown"
 				       " CIS tuple 0x%02x (%u bytes)\n",

From 72979dfb492e7c10b2a95b3eba0b56d2f00e8b6b Mon Sep 17 00:00:00 2001
From: Russell King <rmk+kernel@armlinux.org.uk>
Date: Sun, 18 Oct 2020 09:39:21 +0100
Subject: [PATCH 1473/2658] ARM: footbridge: fix dc21285 PCI configuration
 accessors

commit 39d3454c3513840eb123b3913fda6903e45ce671 upstream.

Building with gcc 4.9.2 reveals a latent bug in the PCI accessors
for Footbridge platforms, which causes a fatal alignment fault
while accessing IO memory. Fix this by making the assembly volatile.

Cc: stable@vger.kernel.org
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/mach-footbridge/dc21285.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/arch/arm/mach-footbridge/dc21285.c b/arch/arm/mach-footbridge/dc21285.c
index 96a3d73ef4bf..fd6c9169fa78 100644
--- a/arch/arm/mach-footbridge/dc21285.c
+++ b/arch/arm/mach-footbridge/dc21285.c
@@ -69,15 +69,15 @@ dc21285_read_config(struct pci_bus *bus, unsigned int devfn, int where,
 	if (addr)
 		switch (size) {
 		case 1:
-			asm("ldrb	%0, [%1, %2]"
+			asm volatile("ldrb	%0, [%1, %2]"
 				: "=r" (v) : "r" (addr), "r" (where) : "cc");
 			break;
 		case 2:
-			asm("ldrh	%0, [%1, %2]"
+			asm volatile("ldrh	%0, [%1, %2]"
 				: "=r" (v) : "r" (addr), "r" (where) : "cc");
 			break;
 		case 4:
-			asm("ldr	%0, [%1, %2]"
+			asm volatile("ldr	%0, [%1, %2]"
 				: "=r" (v) : "r" (addr), "r" (where) : "cc");
 			break;
 		}
@@ -103,17 +103,17 @@ dc21285_write_config(struct pci_bus *bus, unsigned int devfn, int where,
 	if (addr)
 		switch (size) {
 		case 1:
-			asm("strb	%0, [%1, %2]"
+			asm volatile("strb	%0, [%1, %2]"
 				: : "r" (value), "r" (addr), "r" (where)
 				: "cc");
 			break;
 		case 2:
-			asm("strh	%0, [%1, %2]"
+			asm volatile("strh	%0, [%1, %2]"
 				: : "r" (value), "r" (addr), "r" (where)
 				: "cc");
 			break;
 		case 4:
-			asm("str	%0, [%1, %2]"
+			asm volatile("str	%0, [%1, %2]"
 				: : "r" (value), "r" (addr), "r" (where)
 				: "cc");
 			break;

From db8b984e586abb67ce5802d136379c5696831a78 Mon Sep 17 00:00:00 2001
From: Muchun Song <songmuchun@bytedance.com>
Date: Thu, 4 Feb 2021 18:32:03 -0800
Subject: [PATCH 1474/2658] mm: hugetlbfs: fix cannot migrate the fallocated
 HugeTLB page

commit 585fc0d2871c9318c949fbf45b1f081edd489e96 upstream.

If a new hugetlb page is allocated during fallocate it will not be
marked as active (set_page_huge_active) which will result in a later
isolate_huge_page failure when the page migration code would like to
move that page.  Such a failure would be unexpected and wrong.

Only export set_page_huge_active, just leave clear_page_huge_active as
static.  Because there are no external users.

Link: https://lkml.kernel.org/r/20210115124942.46403-3-songmuchun@bytedance.com
Fixes: 70c3547e36f5 (hugetlbfs: add hugetlbfs_fallocate())
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Reviewed-by: Oscar Salvador <osalvador@suse.de>
Cc: David Hildenbrand <david@redhat.com>
Cc: Yang Shi <shy828301@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/hugetlbfs/inode.c    | 3 ++-
 include/linux/hugetlb.h | 3 +++
 mm/hugetlb.c            | 2 +-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 937c6ee1786f..b743aa5bce0d 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -661,8 +661,9 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
 
 		mutex_unlock(&hugetlb_fault_mutex_table[hash]);
 
+		set_page_huge_active(page);
 		/*
-		 * page_put due to reference from alloc_huge_page()
+		 * put_page() due to reference from alloc_huge_page()
 		 * unlock_page because locked by add_to_page_cache()
 		 */
 		put_page(page);
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index b71d142a93f3..d03194174a88 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -504,6 +504,9 @@ static inline void hugetlb_count_sub(long l, struct mm_struct *mm)
 {
 	atomic_long_sub(l, &mm->hugetlb_usage);
 }
+
+void set_page_huge_active(struct page *page);
+
 #else	/* CONFIG_HUGETLB_PAGE */
 struct hstate {};
 #define alloc_huge_page(v, a, r) NULL
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 7a2379223085..492fe02e89db 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1189,7 +1189,7 @@ bool page_huge_active(struct page *page)
 }
 
 /* never called for tail page */
-static void set_page_huge_active(struct page *page)
+void set_page_huge_active(struct page *page)
 {
 	VM_BUG_ON_PAGE(!PageHeadHuge(page), page);
 	SetPagePrivate(&page[1]);

From 1d8a156db7a7c28c8b125a51eb2526a6b807ff31 Mon Sep 17 00:00:00 2001
From: Muchun Song <songmuchun@bytedance.com>
Date: Thu, 4 Feb 2021 18:32:10 -0800
Subject: [PATCH 1475/2658] mm: hugetlb: fix a race between isolating and
 freeing page

commit 0eb2df2b5629794020f75e94655e1994af63f0d4 upstream.

There is a race between isolate_huge_page() and __free_huge_page().

  CPU0:                                     CPU1:

  if (PageHuge(page))
                                            put_page(page)
                                              __free_huge_page(page)
                                                  spin_lock(&hugetlb_lock)
                                                  update_and_free_page(page)
                                                    set_compound_page_dtor(page,
                                                      NULL_COMPOUND_DTOR)
                                                  spin_unlock(&hugetlb_lock)
    isolate_huge_page(page)
      // trigger BUG_ON
      VM_BUG_ON_PAGE(!PageHead(page), page)
      spin_lock(&hugetlb_lock)
      page_huge_active(page)
        // trigger BUG_ON
        VM_BUG_ON_PAGE(!PageHuge(page), page)
      spin_unlock(&hugetlb_lock)

When we isolate a HugeTLB page on CPU0.  Meanwhile, we free it to the
buddy allocator on CPU1.  Then, we can trigger a BUG_ON on CPU0, because
it is already freed to the buddy allocator.

Link: https://lkml.kernel.org/r/20210115124942.46403-5-songmuchun@bytedance.com
Fixes: c8721bbbdd36 ("mm: memory-hotplug: enable memory hotplug to handle hugepage")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Oscar Salvador <osalvador@suse.de>
Cc: David Hildenbrand <david@redhat.com>
Cc: Yang Shi <shy828301@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/hugetlb.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 492fe02e89db..fdb7f84a4903 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4544,9 +4544,9 @@ bool isolate_huge_page(struct page *page, struct list_head *list)
 {
 	bool ret = true;
 
-	VM_BUG_ON_PAGE(!PageHead(page), page);
 	spin_lock(&hugetlb_lock);
-	if (!page_huge_active(page) || !get_page_unless_zero(page)) {
+	if (!PageHeadHuge(page) || !page_huge_active(page) ||
+	    !get_page_unless_zero(page)) {
 		ret = false;
 		goto unlock;
 	}

From c47dd970b6ea49dfd94e3a2f88efd3f0fc757c89 Mon Sep 17 00:00:00 2001
From: Muchun Song <songmuchun@bytedance.com>
Date: Thu, 4 Feb 2021 18:32:13 -0800
Subject: [PATCH 1476/2658] mm: hugetlb: remove VM_BUG_ON_PAGE from
 page_huge_active

commit ecbf4724e6061b4b01be20f6d797d64d462b2bc8 upstream.

The page_huge_active() can be called from scan_movable_pages() which do
not hold a reference count to the HugeTLB page.  So when we call
page_huge_active() from scan_movable_pages(), the HugeTLB page can be
freed parallel.  Then we will trigger a BUG_ON which is in the
page_huge_active() when CONFIG_DEBUG_VM is enabled.  Just remove the
VM_BUG_ON_PAGE.

Link: https://lkml.kernel.org/r/20210115124942.46403-6-songmuchun@bytedance.com
Fixes: 7e1f049efb86 ("mm: hugetlb: cleanup using paeg_huge_active()")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Oscar Salvador <osalvador@suse.de>
Cc: David Hildenbrand <david@redhat.com>
Cc: Yang Shi <shy828301@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/hugetlb.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index fdb7f84a4903..dc877712ef1f 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1184,8 +1184,7 @@ struct hstate *size_to_hstate(unsigned long size)
  */
 bool page_huge_active(struct page *page)
 {
-	VM_BUG_ON_PAGE(!PageHuge(page), page);
-	return PageHead(page) && PagePrivate(&page[1]);
+	return PageHeadHuge(page) && PagePrivate(&page[1]);
 }
 
 /* never called for tail page */

From 8062e914e1959082482f6a73f29d5dff8d3c7dc5 Mon Sep 17 00:00:00 2001
From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Thu, 28 Jan 2021 15:52:19 -0600
Subject: [PATCH 1477/2658] x86/build: Disable CET instrumentation in the
 kernel

commit 20bf2b378729c4a0366a53e2018a0b70ace94bcd upstream.

With retpolines disabled, some configurations of GCC, and specifically
the GCC versions 9 and 10 in Ubuntu will add Intel CET instrumentation
to the kernel by default. That breaks certain tracing scenarios by
adding a superfluous ENDBR64 instruction before the fentry call, for
functions which can be called indirectly.

CET instrumentation isn't currently necessary in the kernel, as CET is
only supported in user space. Disable it unconditionally and move it
into the x86's Makefile as CET/CFI... enablement should be a per-arch
decision anyway.

 [ bp: Massage and extend commit message. ]

Fixes: 29be86d7f9cb ("kbuild: add -fcf-protection=none when using retpoline flags")
Reported-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Tested-by: Nikolay Borisov <nborisov@suse.com>
Cc: <stable@vger.kernel.org>
Cc: Seth Forshee <seth.forshee@canonical.com>
Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
Link: https://lkml.kernel.org/r/20210128215219.6kct3h2eiustncws@treble
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile          | 6 ------
 arch/x86/Makefile | 3 +++
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/Makefile b/Makefile
index 14011c226e4c..20d913cb440a 100644
--- a/Makefile
+++ b/Makefile
@@ -860,12 +860,6 @@ KBUILD_CFLAGS   += $(call cc-option,-Werror=strict-prototypes)
 # Prohibit date/time macros, which would make the build non-deterministic
 KBUILD_CFLAGS   += $(call cc-option,-Werror=date-time)
 
-# ensure -fcf-protection is disabled when using retpoline as it is
-# incompatible with -mindirect-branch=thunk-extern
-ifdef CONFIG_RETPOLINE
-KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
-endif
-
 # use the deterministic mode of AR if available
 KBUILD_ARFLAGS := $(call ar-option,D)
 
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 0a3081d64855..a3c876d23fce 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -139,6 +139,9 @@ else
         KBUILD_CFLAGS += -mno-red-zone
         KBUILD_CFLAGS += -mcmodel=kernel
 
+	# Intel CET isn't enabled in the kernel
+	KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
+
         # -funit-at-a-time shrinks the kernel .text considerably
         # unfortunately it makes reading oopses harder.
         KBUILD_CFLAGS += $(call cc-option,-funit-at-a-time)

From 6853dbd7feecffaff4d444970678d7ef301b310d Mon Sep 17 00:00:00 2001
From: Dave Hansen <dave.hansen@linux.intel.com>
Date: Thu, 5 Mar 2020 09:47:08 -0800
Subject: [PATCH 1478/2658] x86/apic: Add extra serialization for
 non-serializing MSRs

commit 25a068b8e9a4eb193d755d58efcb3c98928636e0 upstream.

Jan Kiszka reported that the x2apic_wrmsr_fence() function uses a plain
MFENCE while the Intel SDM (10.12.3 MSR Access in x2APIC Mode) calls for
MFENCE; LFENCE.

Short summary: we have special MSRs that have weaker ordering than all
the rest. Add fencing consistent with current SDM recommendations.

This is not known to cause any issues in practice, only in theory.

Longer story below:

The reason the kernel uses a different semantic is that the SDM changed
(roughly in late 2017). The SDM changed because folks at Intel were
auditing all of the recommended fences in the SDM and realized that the
x2apic fences were insufficient.

Why was the pain MFENCE judged insufficient?

WRMSR itself is normally a serializing instruction. No fences are needed
because the instruction itself serializes everything.

But, there are explicit exceptions for this serializing behavior written
into the WRMSR instruction documentation for two classes of MSRs:
IA32_TSC_DEADLINE and the X2APIC MSRs.

Back to x2apic: WRMSR is *not* serializing in this specific case.
But why is MFENCE insufficient? MFENCE makes writes visible, but
only affects load/store instructions. WRMSR is unfortunately not a
load/store instruction and is unaffected by MFENCE. This means that a
non-serializing WRMSR could be reordered by the CPU to execute before
the writes made visible by the MFENCE have even occurred in the first
place.

This means that an x2apic IPI could theoretically be triggered before
there is any (visible) data to process.

Does this affect anything in practice? I honestly don't know. It seems
quite possible that by the time an interrupt gets to consume the (not
yet) MFENCE'd data, it has become visible, mostly by accident.

To be safe, add the SDM-recommended fences for all x2apic WRMSRs.

This also leaves open the question of the _other_ weakly-ordered WRMSR:
MSR_IA32_TSC_DEADLINE. While it has the same ordering architecture as
the x2APIC MSRs, it seems substantially less likely to be a problem in
practice. While writes to the in-memory Local Vector Table (LVT) might
theoretically be reordered with respect to a weakly-ordered WRMSR like
TSC_DEADLINE, the SDM has this to say:

  In x2APIC mode, the WRMSR instruction is used to write to the LVT
  entry. The processor ensures the ordering of this write and any
  subsequent WRMSR to the deadline; no fencing is required.

But, that might still leave xAPIC exposed. The safest thing to do for
now is to add the extra, recommended LFENCE.

 [ bp: Massage commit message, fix typos, drop accidentally added
   newline to tools/arch/x86/include/asm/barrier.h. ]

Reported-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20200305174708.F77040DD@viggo.jf.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/apic.h           | 10 ----------
 arch/x86/include/asm/barrier.h        | 18 ++++++++++++++++++
 arch/x86/kernel/apic/apic.c           |  4 ++++
 arch/x86/kernel/apic/x2apic_cluster.c |  3 ++-
 arch/x86/kernel/apic/x2apic_phys.c    |  3 ++-
 5 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
index 3328a37ddc75..34f11bc42d9b 100644
--- a/arch/x86/include/asm/apic.h
+++ b/arch/x86/include/asm/apic.h
@@ -168,16 +168,6 @@ static inline void disable_local_APIC(void) { }
 #endif /* !CONFIG_X86_LOCAL_APIC */
 
 #ifdef CONFIG_X86_X2APIC
-/*
- * Make previous memory operations globally visible before
- * sending the IPI through x2apic wrmsr. We need a serializing instruction or
- * mfence for this.
- */
-static inline void x2apic_wrmsr_fence(void)
-{
-	asm volatile("mfence" : : : "memory");
-}
-
 static inline void native_apic_msr_write(u32 reg, u32 v)
 {
 	if (reg == APIC_DFR || reg == APIC_ID || reg == APIC_LDR ||
diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
index b2a5bef74282..134d7ffc662e 100644
--- a/arch/x86/include/asm/barrier.h
+++ b/arch/x86/include/asm/barrier.h
@@ -119,4 +119,22 @@ do {									\
 #define smp_mb__before_atomic()	do { } while (0)
 #define smp_mb__after_atomic()	do { } while (0)
 
+/*
+ * Make previous memory operations globally visible before
+ * a WRMSR.
+ *
+ * MFENCE makes writes visible, but only affects load/store
+ * instructions.  WRMSR is unfortunately not a load/store
+ * instruction and is unaffected by MFENCE.  The LFENCE ensures
+ * that the WRMSR is not reordered.
+ *
+ * Most WRMSRs are full serializing instructions themselves and
+ * do not require this barrier.  This is only required for the
+ * IA32_TSC_DEADLINE and X2APIC MSRs.
+ */
+static inline void weak_wrmsr_fence(void)
+{
+	asm volatile("mfence; lfence" : : : "memory");
+}
+
 #endif /* _ASM_X86_BARRIER_H */
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 4dcf71c26d64..f53849f3f7fb 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -41,6 +41,7 @@
 #include <asm/x86_init.h>
 #include <asm/pgalloc.h>
 #include <linux/atomic.h>
+#include <asm/barrier.h>
 #include <asm/mpspec.h>
 #include <asm/i8259.h>
 #include <asm/proto.h>
@@ -464,6 +465,9 @@ static int lapic_next_deadline(unsigned long delta,
 {
 	u64 tsc;
 
+	/* This MSR is special and need a special fence: */
+	weak_wrmsr_fence();
+
 	tsc = rdtsc();
 	wrmsrl(MSR_IA32_TSC_DEADLINE, tsc + (((u64) delta) * TSC_DIVISOR));
 	return 0;
diff --git a/arch/x86/kernel/apic/x2apic_cluster.c b/arch/x86/kernel/apic/x2apic_cluster.c
index cc8311c4d298..f474756fc151 100644
--- a/arch/x86/kernel/apic/x2apic_cluster.c
+++ b/arch/x86/kernel/apic/x2apic_cluster.c
@@ -32,7 +32,8 @@ __x2apic_send_IPI_mask(const struct cpumask *mask, int vector, int apic_dest)
 	unsigned long flags;
 	u32 dest;
 
-	x2apic_wrmsr_fence();
+	/* x2apic MSRs are special and need a special fence: */
+	weak_wrmsr_fence();
 
 	local_irq_save(flags);
 
diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c
index 662e9150ea6f..ad7c3544b07f 100644
--- a/arch/x86/kernel/apic/x2apic_phys.c
+++ b/arch/x86/kernel/apic/x2apic_phys.c
@@ -43,7 +43,8 @@ __x2apic_send_IPI_mask(const struct cpumask *mask, int vector, int apic_dest)
 	unsigned long this_cpu;
 	unsigned long flags;
 
-	x2apic_wrmsr_fence();
+	/* x2apic MSRs are special and need a special fence: */
+	weak_wrmsr_fence();
 
 	local_irq_save(flags);
 

From 43974dfe7410fe3e6017384c05caf1ab9e0483d4 Mon Sep 17 00:00:00 2001
From: Benjamin Valentin <benpicco@googlemail.com>
Date: Thu, 21 Jan 2021 19:24:17 -0800
Subject: [PATCH 1479/2658] Input: xpad - sync supported devices with fork on
 GitHub

commit 9bbd77d5bbc9aff8cb74d805c31751f5f0691ba8 upstream.

There is a fork of this driver on GitHub [0] that has been updated
with new device IDs.

Merge those into the mainline driver, so the out-of-tree fork is not
needed for users of those devices anymore.

[0] https://github.com/paroj/xpad

Signed-off-by: Benjamin Valentin <benpicco@googlemail.com>
Link: https://lore.kernel.org/r/20210121142523.1b6b050f@rechenknecht2k11
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/joystick/xpad.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 637f1347cd13..815b69d35722 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -232,9 +232,17 @@ static const struct xpad_device {
 	{ 0x0e6f, 0x0213, "Afterglow Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
 	{ 0x0e6f, 0x021f, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
 	{ 0x0e6f, 0x0246, "Rock Candy Gamepad for Xbox One 2015", 0, XTYPE_XBOXONE },
-	{ 0x0e6f, 0x02ab, "PDP Controller for Xbox One", 0, XTYPE_XBOXONE },
+	{ 0x0e6f, 0x02a0, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
+	{ 0x0e6f, 0x02a1, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
+	{ 0x0e6f, 0x02a2, "PDP Wired Controller for Xbox One - Crimson Red", 0, XTYPE_XBOXONE },
 	{ 0x0e6f, 0x02a4, "PDP Wired Controller for Xbox One - Stealth Series", 0, XTYPE_XBOXONE },
 	{ 0x0e6f, 0x02a6, "PDP Wired Controller for Xbox One - Camo Series", 0, XTYPE_XBOXONE },
+	{ 0x0e6f, 0x02a7, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
+	{ 0x0e6f, 0x02a8, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
+	{ 0x0e6f, 0x02ab, "PDP Controller for Xbox One", 0, XTYPE_XBOXONE },
+	{ 0x0e6f, 0x02ad, "PDP Wired Controller for Xbox One - Stealth Series", 0, XTYPE_XBOXONE },
+	{ 0x0e6f, 0x02b3, "Afterglow Prismatic Wired Controller", 0, XTYPE_XBOXONE },
+	{ 0x0e6f, 0x02b8, "Afterglow Prismatic Wired Controller", 0, XTYPE_XBOXONE },
 	{ 0x0e6f, 0x0301, "Logic3 Controller", 0, XTYPE_XBOX360 },
 	{ 0x0e6f, 0x0346, "Rock Candy Gamepad for Xbox One 2016", 0, XTYPE_XBOXONE },
 	{ 0x0e6f, 0x0401, "Logic3 Controller", 0, XTYPE_XBOX360 },
@@ -313,6 +321,9 @@ static const struct xpad_device {
 	{ 0x1bad, 0xfa01, "MadCatz GamePad", 0, XTYPE_XBOX360 },
 	{ 0x1bad, 0xfd00, "Razer Onza TE", 0, XTYPE_XBOX360 },
 	{ 0x1bad, 0xfd01, "Razer Onza", 0, XTYPE_XBOX360 },
+	{ 0x20d6, 0x2001, "BDA Xbox Series X Wired Controller", 0, XTYPE_XBOXONE },
+	{ 0x20d6, 0x281f, "PowerA Wired Controller For Xbox 360", 0, XTYPE_XBOX360 },
+	{ 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE },
 	{ 0x24c6, 0x5000, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
 	{ 0x24c6, 0x5300, "PowerA MINI PROEX Controller", 0, XTYPE_XBOX360 },
 	{ 0x24c6, 0x5303, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 },
@@ -446,8 +457,12 @@ static const struct usb_device_id xpad_table[] = {
 	XPAD_XBOX360_VENDOR(0x162e),		/* Joytech X-Box 360 controllers */
 	XPAD_XBOX360_VENDOR(0x1689),		/* Razer Onza */
 	XPAD_XBOX360_VENDOR(0x1bad),		/* Harminix Rock Band Guitar and Drums */
+	XPAD_XBOX360_VENDOR(0x20d6),		/* PowerA Controllers */
+	XPAD_XBOXONE_VENDOR(0x20d6),		/* PowerA Controllers */
 	XPAD_XBOX360_VENDOR(0x24c6),		/* PowerA Controllers */
 	XPAD_XBOXONE_VENDOR(0x24c6),		/* PowerA Controllers */
+	XPAD_XBOXONE_VENDOR(0x2e24),		/* Hyperkin Duke X-Box One pad */
+	XPAD_XBOX360_VENDOR(0x2f24),		/* GameSir Controllers */
 	{ }
 };
 

From 34a48bb0e39dfb1f807cf806a8e62ab6074adc2e Mon Sep 17 00:00:00 2001
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Date: Thu, 14 Jan 2021 19:34:22 +0100
Subject: [PATCH 1480/2658] ACPI: thermal: Do not call acpi_thermal_check()
 directly

commit 81b704d3e4674e09781d331df73d76675d5ad8cb upstream.

Calling acpi_thermal_check() from acpi_thermal_notify() directly
is problematic if _TMP triggers Notify () on the thermal zone for
which it has been evaluated (which happens on some systems), because
it causes a new acpi_thermal_notify() invocation to be queued up
every time and if that takes place too often, an indefinite number of
pending work items may accumulate in kacpi_notify_wq over time.

Besides, it is not really useful to queue up a new invocation of
acpi_thermal_check() if one of them is pending already.

For these reasons, rework acpi_thermal_notify() to queue up a thermal
check instead of calling acpi_thermal_check() directly and only allow
one thermal check to be pending at a time.  Moreover, only allow one
acpi_thermal_check_fn() instance at a time to run
thermal_zone_device_update() for one thermal zone and make it return
early if it sees other instances running for the same thermal zone.

While at it, fold acpi_thermal_check() into acpi_thermal_check_fn(),
as it is only called from there after the other changes made here.

[This issue appears to have been exposed by commit 6d25be5782e4
 ("sched/core, workqueues: Distangle worker accounting from rq
 lock"), but it is unclear why it was not visible earlier.]

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208877
Reported-by: Stephen Berman <stephen.berman@gmx.net>
Diagnosed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Tested-by: Stephen Berman <stephen.berman@gmx.net>
Cc: All applicable <stable@vger.kernel.org>
[bigeasy: Backported to v4.4.y, use atomic_t instead of refcount_t]
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/acpi/thermal.c | 54 +++++++++++++++++++++++++++++-------------
 1 file changed, 38 insertions(+), 16 deletions(-)

diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
index 82707f9824ca..b4826335ad0b 100644
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -188,6 +188,8 @@ struct acpi_thermal {
 	int tz_enabled;
 	int kelvin_offset;
 	struct work_struct thermal_check_work;
+	struct mutex thermal_check_lock;
+	atomic_t thermal_check_count;
 };
 
 /* --------------------------------------------------------------------------
@@ -513,16 +515,6 @@ static int acpi_thermal_get_trip_points(struct acpi_thermal *tz)
 	return 0;
 }
 
-static void acpi_thermal_check(void *data)
-{
-	struct acpi_thermal *tz = data;
-
-	if (!tz->tz_enabled)
-		return;
-
-	thermal_zone_device_update(tz->thermal_zone);
-}
-
 /* sys I/F for generic thermal sysfs support */
 
 static int thermal_get_temp(struct thermal_zone_device *thermal, int *temp)
@@ -556,6 +548,8 @@ static int thermal_get_mode(struct thermal_zone_device *thermal,
 	return 0;
 }
 
+static void acpi_thermal_check_fn(struct work_struct *work);
+
 static int thermal_set_mode(struct thermal_zone_device *thermal,
 				enum thermal_device_mode mode)
 {
@@ -581,7 +575,7 @@ static int thermal_set_mode(struct thermal_zone_device *thermal,
 		ACPI_DEBUG_PRINT((ACPI_DB_INFO,
 			"%s kernel ACPI thermal control\n",
 			tz->tz_enabled ? "Enable" : "Disable"));
-		acpi_thermal_check(tz);
+		acpi_thermal_check_fn(&tz->thermal_check_work);
 	}
 	return 0;
 }
@@ -950,6 +944,12 @@ static void acpi_thermal_unregister_thermal_zone(struct acpi_thermal *tz)
                                  Driver Interface
    -------------------------------------------------------------------------- */
 
+static void acpi_queue_thermal_check(struct acpi_thermal *tz)
+{
+	if (!work_pending(&tz->thermal_check_work))
+		queue_work(acpi_thermal_pm_queue, &tz->thermal_check_work);
+}
+
 static void acpi_thermal_notify(struct acpi_device *device, u32 event)
 {
 	struct acpi_thermal *tz = acpi_driver_data(device);
@@ -960,17 +960,17 @@ static void acpi_thermal_notify(struct acpi_device *device, u32 event)
 
 	switch (event) {
 	case ACPI_THERMAL_NOTIFY_TEMPERATURE:
-		acpi_thermal_check(tz);
+		acpi_queue_thermal_check(tz);
 		break;
 	case ACPI_THERMAL_NOTIFY_THRESHOLDS:
 		acpi_thermal_trips_update(tz, ACPI_TRIPS_REFRESH_THRESHOLDS);
-		acpi_thermal_check(tz);
+		acpi_queue_thermal_check(tz);
 		acpi_bus_generate_netlink_event(device->pnp.device_class,
 						  dev_name(&device->dev), event, 0);
 		break;
 	case ACPI_THERMAL_NOTIFY_DEVICES:
 		acpi_thermal_trips_update(tz, ACPI_TRIPS_REFRESH_DEVICES);
-		acpi_thermal_check(tz);
+		acpi_queue_thermal_check(tz);
 		acpi_bus_generate_netlink_event(device->pnp.device_class,
 						  dev_name(&device->dev), event, 0);
 		break;
@@ -1070,7 +1070,27 @@ static void acpi_thermal_check_fn(struct work_struct *work)
 {
 	struct acpi_thermal *tz = container_of(work, struct acpi_thermal,
 					       thermal_check_work);
-	acpi_thermal_check(tz);
+
+	if (!tz->tz_enabled)
+		return;
+	/*
+	 * In general, it is not sufficient to check the pending bit, because
+	 * subsequent instances of this function may be queued after one of them
+	 * has started running (e.g. if _TMP sleeps).  Avoid bailing out if just
+	 * one of them is running, though, because it may have done the actual
+	 * check some time ago, so allow at least one of them to block on the
+	 * mutex while another one is running the update.
+	 */
+	if (!atomic_add_unless(&tz->thermal_check_count, -1, 1))
+		return;
+
+	mutex_lock(&tz->thermal_check_lock);
+
+	thermal_zone_device_update(tz->thermal_zone);
+
+	atomic_inc(&tz->thermal_check_count);
+
+	mutex_unlock(&tz->thermal_check_lock);
 }
 
 static int acpi_thermal_add(struct acpi_device *device)
@@ -1102,6 +1122,8 @@ static int acpi_thermal_add(struct acpi_device *device)
 	if (result)
 		goto free_memory;
 
+	atomic_set(&tz->thermal_check_count, 3);
+	mutex_init(&tz->thermal_check_lock);
 	INIT_WORK(&tz->thermal_check_work, acpi_thermal_check_fn);
 
 	pr_info(PREFIX "%s [%s] (%ld C)\n", acpi_device_name(device),
@@ -1167,7 +1189,7 @@ static int acpi_thermal_resume(struct device *dev)
 		tz->state.active |= tz->trips.active[i].flags.enabled;
 	}
 
-	queue_work(acpi_thermal_pm_queue, &tz->thermal_check_work);
+	acpi_queue_thermal_check(tz);
 
 	return AE_OK;
 }

From fdf220bc9cd09d2220f09bd9f02a99b2fb1525bb Mon Sep 17 00:00:00 2001
From: "Shih-Yuan Lee (FourDollars)" <sylee@canonical.com>
Date: Mon, 3 Jul 2017 14:13:29 +0800
Subject: [PATCH 1481/2658] ALSA: hda/realtek - Fix typo of pincfg for Dell
 quirk

commit b4576de87243c32fab50dda9f8eba1e3cf13a7e2 upstream.

The PIN number for Dell headset mode of ALC3271 is wrong.

Fixes: fcc6c877a01f ("ALSA: hda/realtek - Support Dell headset mode for ALC3271")
Signed-off-by: Shih-Yuan Lee (FourDollars) <sylee@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 854d2da02cc9..c7061a5dd809 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6211,7 +6211,7 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
 	SND_HDA_PIN_QUIRK(0x10ec0299, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
 		ALC225_STANDARD_PINS,
 		{0x12, 0xb7a60130},
-		{0x13, 0xb8a60140},
+		{0x13, 0xb8a61140},
 		{0x17, 0x90170110}),
 	{}
 };

From 4cdda2a1fd14363b98b225acbe594dc1c530156f Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 10 Feb 2021 09:07:28 +0100
Subject: [PATCH 1482/2658] Linux 4.4.257

Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Link: https://lore.kernel.org/r/20210208145805.279815326@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 20d913cb440a..eb9a1a76ea4c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 256
+SUBLEVEL = 257
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From c8d0fb3ac0bdf8d55393cb0930d32f84ede9b398 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Fri, 5 Feb 2021 15:40:04 -0500
Subject: [PATCH 1483/2658] tracing: Do not count ftrace events in top level
 enable output

commit 256cfdd6fdf70c6fcf0f7c8ddb0ebd73ce8f3bc9 upstream.

The file /sys/kernel/tracing/events/enable is used to enable all events by
echoing in "1", or disabling all events when echoing in "0". To know if all
events are enabled, disabled, or some are enabled but not all of them,
cating the file should show either "1" (all enabled), "0" (all disabled), or
"X" (some enabled but not all of them). This works the same as the "enable"
files in the individule system directories (like tracing/events/sched/enable).

But when all events are enabled, the top level "enable" file shows "X". The
reason is that its checking the "ftrace" events, which are special events
that only exist for their format files. These include the format for the
function tracer events, that are enabled when the function tracer is
enabled, but not by the "enable" file. The check includes these events,
which will always be disabled, and even though all true events are enabled,
the top level "enable" file will show "X" instead of "1".

To fix this, have the check test the event's flags to see if it has the
"IGNORE_ENABLE" flag set, and if so, not test it.

Cc: stable@vger.kernel.org
Fixes: 553552ce1796c ("tracing: Combine event filter_active and enable into single flags field")
Reported-by: "Yordan Karadzhov (VMware)" <y.karadz@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace_events.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index faeb44077cd8..48aee7ff6381 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -1084,7 +1084,8 @@ system_enable_read(struct file *filp, char __user *ubuf, size_t cnt,
 	mutex_lock(&event_mutex);
 	list_for_each_entry(file, &tr->events, list) {
 		call = file->event_call;
-		if (!trace_event_name(call) || !call->class || !call->class->reg)
+		if ((call->flags & TRACE_EVENT_FL_IGNORE_ENABLE) ||
+		    !trace_event_name(call) || !call->class || !call->class->reg)
 			continue;
 
 		if (system && strcmp(call->class->system, system->name) != 0)

From a4afdab10e4aa2f8a948fbd06459135db3c8e5d5 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Fri, 29 Jan 2021 10:13:53 -0500
Subject: [PATCH 1484/2658] fgraph: Initialize tracing_graph_pause at task
 creation

commit 7e0a9220467dbcfdc5bc62825724f3e52e50ab31 upstream.

On some archs, the idle task can call into cpu_suspend(). The cpu_suspend()
will disable or pause function graph tracing, as there's some paths in
bringing down the CPU that can have issues with its return address being
modified. The task_struct structure has a "tracing_graph_pause" atomic
counter, that when set to something other than zero, the function graph
tracer will not modify the return address.

The problem is that the tracing_graph_pause counter is initialized when the
function graph tracer is enabled. This can corrupt the counter for the idle
task if it is suspended in these architectures.

   CPU 1				CPU 2
   -----				-----
  do_idle()
    cpu_suspend()
      pause_graph_tracing()
          task_struct->tracing_graph_pause++ (0 -> 1)

				start_graph_tracing()
				  for_each_online_cpu(cpu) {
				    ftrace_graph_init_idle_task(cpu)
				      task-struct->tracing_graph_pause = 0 (1 -> 0)

      unpause_graph_tracing()
          task_struct->tracing_graph_pause-- (0 -> -1)

The above should have gone from 1 to zero, and enabled function graph
tracing again. But instead, it is set to -1, which keeps it disabled.

There's no reason that the field tracing_graph_pause on the task_struct can
not be initialized at boot up.

Cc: stable@vger.kernel.org
Fixes: 380c4b1411ccd ("tracing/function-graph-tracer: append the tracing_graph_flag")
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=211339
Reported-by: pierre.gondois@arm.com
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/ftrace.h | 4 +++-
 kernel/trace/ftrace.c  | 2 --
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index d418f8af7fcb..fb154d2b121b 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -747,7 +747,9 @@ typedef int (*trace_func_graph_ent_t)(struct ftrace_graph_ent *); /* entry */
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
 
 /* for init task */
-#define INIT_FTRACE_GRAPH		.ret_stack = NULL,
+#define INIT_FTRACE_GRAPH				\
+	.ret_stack		= NULL,			\
+	.tracing_graph_pause	= ATOMIC_INIT(0),
 
 /*
  * Stack of return addresses for functions
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 89ed01911a9a..b56b1daa0a59 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -5708,7 +5708,6 @@ static int alloc_retstack_tasklist(struct ftrace_ret_stack **ret_stack_list)
 		}
 
 		if (t->ret_stack == NULL) {
-			atomic_set(&t->tracing_graph_pause, 0);
 			atomic_set(&t->trace_overrun, 0);
 			t->curr_ret_stack = -1;
 			/* Make sure the tasks see the -1 first: */
@@ -5920,7 +5919,6 @@ static DEFINE_PER_CPU(struct ftrace_ret_stack *, idle_ret_stack);
 static void
 graph_init_task(struct task_struct *t, struct ftrace_ret_stack *ret_stack)
 {
-	atomic_set(&t->tracing_graph_pause, 0);
 	atomic_set(&t->trace_overrun, 0);
 	t->ftrace_timestamp = 0;
 	/* make curr_ret_stack visible before we add the ret_stack */

From b1627b84591162a5d8426220c4633c9ac072507c Mon Sep 17 00:00:00 2001
From: Cong Wang <cong.wang@bytedance.com>
Date: Sat, 26 Dec 2020 16:50:20 -0800
Subject: [PATCH 1485/2658] af_key: relax availability checks for skb size
 calculation

[ Upstream commit afbc293add6466f8f3f0c3d944d85f53709c170f ]

xfrm_probe_algs() probes kernel crypto modules and changes the
availability of struct xfrm_algo_desc. But there is a small window
where ealg->available and aalg->available get changed between
count_ah_combs()/count_esp_combs() and dump_ah_combs()/dump_esp_combs(),
in this case we may allocate a smaller skb but later put a larger
amount of data and trigger the panic in skb_put().

Fix this by relaxing the checks when counting the size, that is,
skipping the test of ->available. We may waste some memory for a few
of sizeof(struct sadb_comb), but it is still much better than a panic.

Reported-by: syzbot+b2bf2652983d23734c5c@syzkaller.appspotmail.com
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/key/af_key.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/key/af_key.c b/net/key/af_key.c
index 76a008b1cbe5..adc93329e6aa 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2933,7 +2933,7 @@ static int count_ah_combs(const struct xfrm_tmpl *t)
 			break;
 		if (!aalg->pfkey_supported)
 			continue;
-		if (aalg_tmpl_set(t, aalg) && aalg->available)
+		if (aalg_tmpl_set(t, aalg))
 			sz += sizeof(struct sadb_comb);
 	}
 	return sz + sizeof(struct sadb_prop);
@@ -2951,7 +2951,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
 		if (!ealg->pfkey_supported)
 			continue;
 
-		if (!(ealg_tmpl_set(t, ealg) && ealg->available))
+		if (!(ealg_tmpl_set(t, ealg)))
 			continue;
 
 		for (k = 1; ; k++) {
@@ -2962,7 +2962,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
 			if (!aalg->pfkey_supported)
 				continue;
 
-			if (aalg_tmpl_set(t, aalg) && aalg->available)
+			if (aalg_tmpl_set(t, aalg))
 				sz += sizeof(struct sadb_comb);
 		}
 	}

From 0c58ee7ce4ef630cf2a36f5e2a5c5616b3842118 Mon Sep 17 00:00:00 2001
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date: Fri, 15 Jan 2021 13:05:55 +0200
Subject: [PATCH 1486/2658] iwlwifi: pcie: add a NULL check in
 iwl_pcie_txq_unmap

[ Upstream commit 98c7d21f957b10d9c07a3a60a3a5a8f326a197e5 ]

I hit a NULL pointer exception in this function when the
init flow went really bad.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/iwlwifi.20210115130252.2e8da9f2c132.I0234d4b8ddaf70aaa5028a20c863255e05bc1f84@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/iwlwifi/pcie/tx.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 8dfe6b2bc703..cb03c2855019 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -585,6 +585,11 @@ static void iwl_pcie_txq_unmap(struct iwl_trans *trans, int txq_id)
 	struct iwl_txq *txq = &trans_pcie->txq[txq_id];
 	struct iwl_queue *q = &txq->q;
 
+	if (!txq) {
+		IWL_ERR(trans, "Trying to free a queue that wasn't allocated?\n");
+		return;
+	}
+
 	spin_lock_bh(&txq->lock);
 	while (q->write_ptr != q->read_ptr) {
 		IWL_DEBUG_TX_REPLY(trans, "Q %d Free %d\n",

From 8250c987370c31861ed4a5983b9166ed9794c025 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Fri, 22 Jan 2021 14:52:41 +0200
Subject: [PATCH 1487/2658] iwlwifi: mvm: guard against device removal in
 reprobe

[ Upstream commit 7a21b1d4a728a483f07c638ccd8610d4b4f12684 ]

If we get into a problem severe enough to attempt a reprobe,
we schedule a worker to do that. However, if the problem gets
more severe and the device is actually destroyed before this
worker has a chance to run, we use a free device. Bump up the
reference count of the device until the worker runs to avoid
this situation.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/iwlwifi.20210122144849.871f0892e4b2.I94819e11afd68d875f3e242b98bef724b8236f1e@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/iwlwifi/mvm/ops.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index 13c97f665ba8..bb81261de45f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -909,6 +909,7 @@ static void iwl_mvm_reprobe_wk(struct work_struct *wk)
 	reprobe = container_of(wk, struct iwl_mvm_reprobe, work);
 	if (device_reprobe(reprobe->dev))
 		dev_err(reprobe->dev, "reprobe failed!\n");
+	put_device(reprobe->dev);
 	kfree(reprobe);
 	module_put(THIS_MODULE);
 }
@@ -991,7 +992,7 @@ void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error)
 			module_put(THIS_MODULE);
 			return;
 		}
-		reprobe->dev = mvm->trans->dev;
+		reprobe->dev = get_device(mvm->trans->dev);
 		INIT_WORK(&reprobe->work, iwl_mvm_reprobe_wk);
 		schedule_work(&reprobe->work);
 	} else if (mvm->cur_ucode == IWL_UCODE_REGULAR) {

From 44b35e877a1848a9d95f4dbc95d88f6802a3e29e Mon Sep 17 00:00:00 2001
From: Dave Wysochanski <dwysocha@redhat.com>
Date: Thu, 21 Jan 2021 16:17:23 -0500
Subject: [PATCH 1488/2658] SUNRPC: Move simple_get_bytes and simple_get_netobj
 into private header

[ Upstream commit ba6dfce47c4d002d96cd02a304132fca76981172 ]

Remove duplicated helper functions to parse opaque XDR objects
and place inside new file net/sunrpc/auth_gss/auth_gss_internal.h.
In the new file carry the license and copyright from the source file
net/sunrpc/auth_gss/auth_gss.c.  Finally, update the comment inside
include/linux/sunrpc/xdr.h since lockd is not the only user of
struct xdr_netobj.

Signed-off-by: Dave Wysochanski <dwysocha@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/sunrpc/xdr.h              |  3 +-
 net/sunrpc/auth_gss/auth_gss.c          | 30 +-----------------
 net/sunrpc/auth_gss/auth_gss_internal.h | 42 +++++++++++++++++++++++++
 net/sunrpc/auth_gss/gss_krb5_mech.c     | 31 ++----------------
 4 files changed, 46 insertions(+), 60 deletions(-)
 create mode 100644 net/sunrpc/auth_gss/auth_gss_internal.h

diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
index 70c6b92e15a7..8def5e0a491f 100644
--- a/include/linux/sunrpc/xdr.h
+++ b/include/linux/sunrpc/xdr.h
@@ -23,8 +23,7 @@
 #define XDR_QUADLEN(l)		(((l) + 3) >> 2)
 
 /*
- * Generic opaque `network object.' At the kernel level, this type
- * is used only by lockd.
+ * Generic opaque `network object.'
  */
 #define XDR_MAX_NETOBJ		1024
 struct xdr_netobj {
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 62fca77bf3c7..7bde2976307e 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -53,6 +53,7 @@
 #include <asm/uaccess.h>
 #include <linux/hashtable.h>
 
+#include "auth_gss_internal.h"
 #include "../netns.h"
 
 static const struct rpc_authops authgss_ops;
@@ -147,35 +148,6 @@ gss_cred_set_ctx(struct rpc_cred *cred, struct gss_cl_ctx *ctx)
 	clear_bit(RPCAUTH_CRED_NEW, &cred->cr_flags);
 }
 
-static const void *
-simple_get_bytes(const void *p, const void *end, void *res, size_t len)
-{
-	const void *q = (const void *)((const char *)p + len);
-	if (unlikely(q > end || q < p))
-		return ERR_PTR(-EFAULT);
-	memcpy(res, p, len);
-	return q;
-}
-
-static inline const void *
-simple_get_netobj(const void *p, const void *end, struct xdr_netobj *dest)
-{
-	const void *q;
-	unsigned int len;
-
-	p = simple_get_bytes(p, end, &len, sizeof(len));
-	if (IS_ERR(p))
-		return p;
-	q = (const void *)((const char *)p + len);
-	if (unlikely(q > end || q < p))
-		return ERR_PTR(-EFAULT);
-	dest->data = kmemdup(p, len, GFP_NOFS);
-	if (unlikely(dest->data == NULL))
-		return ERR_PTR(-ENOMEM);
-	dest->len = len;
-	return q;
-}
-
 static struct gss_cl_ctx *
 gss_cred_get_ctx(struct rpc_cred *cred)
 {
diff --git a/net/sunrpc/auth_gss/auth_gss_internal.h b/net/sunrpc/auth_gss/auth_gss_internal.h
new file mode 100644
index 000000000000..c5603242b54b
--- /dev/null
+++ b/net/sunrpc/auth_gss/auth_gss_internal.h
@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/*
+ * linux/net/sunrpc/auth_gss/auth_gss_internal.h
+ *
+ * Internal definitions for RPCSEC_GSS client authentication
+ *
+ * Copyright (c) 2000 The Regents of the University of Michigan.
+ * All rights reserved.
+ *
+ */
+#include <linux/err.h>
+#include <linux/string.h>
+#include <linux/sunrpc/xdr.h>
+
+static inline const void *
+simple_get_bytes(const void *p, const void *end, void *res, size_t len)
+{
+	const void *q = (const void *)((const char *)p + len);
+	if (unlikely(q > end || q < p))
+		return ERR_PTR(-EFAULT);
+	memcpy(res, p, len);
+	return q;
+}
+
+static inline const void *
+simple_get_netobj(const void *p, const void *end, struct xdr_netobj *dest)
+{
+	const void *q;
+	unsigned int len;
+
+	p = simple_get_bytes(p, end, &len, sizeof(len));
+	if (IS_ERR(p))
+		return p;
+	q = (const void *)((const char *)p + len);
+	if (unlikely(q > end || q < p))
+		return ERR_PTR(-EFAULT);
+	dest->data = kmemdup(p, len, GFP_NOFS);
+	if (unlikely(dest->data == NULL))
+		return ERR_PTR(-ENOMEM);
+	dest->len = len;
+	return q;
+}
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index 28db442a0034..89e616da161f 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -45,6 +45,8 @@
 #include <linux/crypto.h>
 #include <linux/sunrpc/gss_krb5_enctypes.h>
 
+#include "auth_gss_internal.h"
+
 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY	RPCDBG_AUTH
 #endif
@@ -186,35 +188,6 @@ get_gss_krb5_enctype(int etype)
 	return NULL;
 }
 
-static const void *
-simple_get_bytes(const void *p, const void *end, void *res, int len)
-{
-	const void *q = (const void *)((const char *)p + len);
-	if (unlikely(q > end || q < p))
-		return ERR_PTR(-EFAULT);
-	memcpy(res, p, len);
-	return q;
-}
-
-static const void *
-simple_get_netobj(const void *p, const void *end, struct xdr_netobj *res)
-{
-	const void *q;
-	unsigned int len;
-
-	p = simple_get_bytes(p, end, &len, sizeof(len));
-	if (IS_ERR(p))
-		return p;
-	q = (const void *)((const char *)p + len);
-	if (unlikely(q > end || q < p))
-		return ERR_PTR(-EFAULT);
-	res->data = kmemdup(p, len, GFP_NOFS);
-	if (unlikely(res->data == NULL))
-		return ERR_PTR(-ENOMEM);
-	res->len = len;
-	return q;
-}
-
 static inline const void *
 get_key(const void *p, const void *end,
 	struct krb5_ctx *ctx, struct crypto_blkcipher **res)

From 559a6a9a1999697fdde5c3da88893172f5592b6c Mon Sep 17 00:00:00 2001
From: Dave Wysochanski <dwysocha@redhat.com>
Date: Thu, 21 Jan 2021 16:17:24 -0500
Subject: [PATCH 1489/2658] SUNRPC: Handle 0 length opaque XDR object data
 properly

[ Upstream commit e4a7d1f7707eb44fd953a31dd59eff82009d879c ]

When handling an auth_gss downcall, it's possible to get 0-length
opaque object for the acceptor.  In the case of a 0-length XDR
object, make sure simple_get_netobj() fills in dest->data = NULL,
and does not continue to kmemdup() which will set
dest->data = ZERO_SIZE_PTR for the acceptor.

The trace event code can handle NULL but not ZERO_SIZE_PTR for a
string, and so without this patch the rpcgss_context trace event
will crash the kernel as follows:

[  162.887992] BUG: kernel NULL pointer dereference, address: 0000000000000010
[  162.898693] #PF: supervisor read access in kernel mode
[  162.900830] #PF: error_code(0x0000) - not-present page
[  162.902940] PGD 0 P4D 0
[  162.904027] Oops: 0000 [#1] SMP PTI
[  162.905493] CPU: 4 PID: 4321 Comm: rpc.gssd Kdump: loaded Not tainted 5.10.0 #133
[  162.908548] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[  162.910978] RIP: 0010:strlen+0x0/0x20
[  162.912505] Code: 48 89 f9 74 09 48 83 c1 01 80 39 00 75 f7 31 d2 44 0f b6 04 16 44 88 04 11 48 83 c2 01 45 84 c0 75 ee c3 0f 1f 80 00 00 00 00 <80> 3f 00 74 10 48 89 f8 48 83 c0 01 80 38 00 75 f7 48 29 f8 c3 31
[  162.920101] RSP: 0018:ffffaec900c77d90 EFLAGS: 00010202
[  162.922263] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000fffde697
[  162.925158] RDX: 000000000000002f RSI: 0000000000000080 RDI: 0000000000000010
[  162.928073] RBP: 0000000000000010 R08: 0000000000000e10 R09: 0000000000000000
[  162.930976] R10: ffff8e698a590cb8 R11: 0000000000000001 R12: 0000000000000e10
[  162.933883] R13: 00000000fffde697 R14: 000000010034d517 R15: 0000000000070028
[  162.936777] FS:  00007f1e1eb93700(0000) GS:ffff8e6ab7d00000(0000) knlGS:0000000000000000
[  162.940067] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  162.942417] CR2: 0000000000000010 CR3: 0000000104eba000 CR4: 00000000000406e0
[  162.945300] Call Trace:
[  162.946428]  trace_event_raw_event_rpcgss_context+0x84/0x140 [auth_rpcgss]
[  162.949308]  ? __kmalloc_track_caller+0x35/0x5a0
[  162.951224]  ? gss_pipe_downcall+0x3a3/0x6a0 [auth_rpcgss]
[  162.953484]  gss_pipe_downcall+0x585/0x6a0 [auth_rpcgss]
[  162.955953]  rpc_pipe_write+0x58/0x70 [sunrpc]
[  162.957849]  vfs_write+0xcb/0x2c0
[  162.959264]  ksys_write+0x68/0xe0
[  162.960706]  do_syscall_64+0x33/0x40
[  162.962238]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  162.964346] RIP: 0033:0x7f1e1f1e57df

Signed-off-by: Dave Wysochanski <dwysocha@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/auth_gss/auth_gss_internal.h | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/sunrpc/auth_gss/auth_gss_internal.h b/net/sunrpc/auth_gss/auth_gss_internal.h
index c5603242b54b..f6d9631bd9d0 100644
--- a/net/sunrpc/auth_gss/auth_gss_internal.h
+++ b/net/sunrpc/auth_gss/auth_gss_internal.h
@@ -34,9 +34,12 @@ simple_get_netobj(const void *p, const void *end, struct xdr_netobj *dest)
 	q = (const void *)((const char *)p + len);
 	if (unlikely(q > end || q < p))
 		return ERR_PTR(-EFAULT);
-	dest->data = kmemdup(p, len, GFP_NOFS);
-	if (unlikely(dest->data == NULL))
-		return ERR_PTR(-ENOMEM);
+	if (len) {
+		dest->data = kmemdup(p, len, GFP_NOFS);
+		if (unlikely(dest->data == NULL))
+			return ERR_PTR(-ENOMEM);
+	} else
+		dest->data = NULL;
 	dest->len = len;
 	return q;
 }

From ce9f8ad927e63b66ec767bbd9e2777094cb89205 Mon Sep 17 00:00:00 2001
From: "Tobin C. Harding" <tobin@kernel.org>
Date: Fri, 5 Apr 2019 12:58:58 +1100
Subject: [PATCH 1490/2658] lib/string: Add strscpy_pad() function

[ Upstream commit 458a3bf82df4fe1f951d0f52b1e0c1e9d5a88a3b ]

We have a function to copy strings safely and we have a function to copy
strings and zero the tail of the destination (if source string is
shorter than destination buffer) but we do not have a function to do
both at once.  This means developers must write this themselves if they
desire this functionality.  This is a chore, and also leaves us open to
off by one errors unnecessarily.

Add a function that calls strscpy() then memset()s the tail to zero if
the source string is shorter than the destination buffer.

Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Tobin C. Harding <tobin@kernel.org>
Signed-off-by: Shuah Khan <shuah@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/string.h |  4 ++++
 lib/string.c           | 47 +++++++++++++++++++++++++++++++++++-------
 2 files changed, 44 insertions(+), 7 deletions(-)

diff --git a/include/linux/string.h b/include/linux/string.h
index 870268d42ae7..7da409760cf1 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -28,6 +28,10 @@ size_t strlcpy(char *, const char *, size_t);
 #ifndef __HAVE_ARCH_STRSCPY
 ssize_t strscpy(char *, const char *, size_t);
 #endif
+
+/* Wraps calls to strscpy()/memset(), no arch specific code required */
+ssize_t strscpy_pad(char *dest, const char *src, size_t count);
+
 #ifndef __HAVE_ARCH_STRCAT
 extern char * strcat(char *, const char *);
 #endif
diff --git a/lib/string.c b/lib/string.c
index 7f4baad6fb19..4351ec43cd6b 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -157,11 +157,9 @@ EXPORT_SYMBOL(strlcpy);
  * @src: Where to copy the string from
  * @count: Size of destination buffer
  *
- * Copy the string, or as much of it as fits, into the dest buffer.
- * The routine returns the number of characters copied (not including
- * the trailing NUL) or -E2BIG if the destination buffer wasn't big enough.
- * The behavior is undefined if the string buffers overlap.
- * The destination buffer is always NUL terminated, unless it's zero-sized.
+ * Copy the string, or as much of it as fits, into the dest buffer.  The
+ * behavior is undefined if the string buffers overlap.  The destination
+ * buffer is always NUL terminated, unless it's zero-sized.
  *
  * Preferred to strlcpy() since the API doesn't require reading memory
  * from the src string beyond the specified "count" bytes, and since
@@ -171,8 +169,10 @@ EXPORT_SYMBOL(strlcpy);
  *
  * Preferred to strncpy() since it always returns a valid string, and
  * doesn't unnecessarily force the tail of the destination buffer to be
- * zeroed.  If the zeroing is desired, it's likely cleaner to use strscpy()
- * with an overflow test, then just memset() the tail of the dest buffer.
+ * zeroed.  If zeroing is desired please use strscpy_pad().
+ *
+ * Return: The number of characters copied (not including the trailing
+ *         %NUL) or -E2BIG if the destination buffer wasn't big enough.
  */
 ssize_t strscpy(char *dest, const char *src, size_t count)
 {
@@ -259,6 +259,39 @@ char *stpcpy(char *__restrict__ dest, const char *__restrict__ src)
 }
 EXPORT_SYMBOL(stpcpy);
 
+/**
+ * strscpy_pad() - Copy a C-string into a sized buffer
+ * @dest: Where to copy the string to
+ * @src: Where to copy the string from
+ * @count: Size of destination buffer
+ *
+ * Copy the string, or as much of it as fits, into the dest buffer.  The
+ * behavior is undefined if the string buffers overlap.  The destination
+ * buffer is always %NUL terminated, unless it's zero-sized.
+ *
+ * If the source string is shorter than the destination buffer, zeros
+ * the tail of the destination buffer.
+ *
+ * For full explanation of why you may want to consider using the
+ * 'strscpy' functions please see the function docstring for strscpy().
+ *
+ * Return: The number of characters copied (not including the trailing
+ *         %NUL) or -E2BIG if the destination buffer wasn't big enough.
+ */
+ssize_t strscpy_pad(char *dest, const char *src, size_t count)
+{
+	ssize_t written;
+
+	written = strscpy(dest, src, count);
+	if (written < 0 || written == count - 1)
+		return written;
+
+	memset(dest + written + 1, 0, count - written - 1);
+
+	return written;
+}
+EXPORT_SYMBOL(strscpy_pad);
+
 #ifndef __HAVE_ARCH_STRCAT
 /**
  * strcat - Append one %NUL-terminated string to another

From ea904558ae910f9718a1fe992c6cdecc60a4d02d Mon Sep 17 00:00:00 2001
From: Qian Cai <cai@lca.pw>
Date: Wed, 25 Sep 2019 16:46:16 -0700
Subject: [PATCH 1491/2658] include/trace/events/writeback.h: fix
 -Wstringop-truncation warnings

[ Upstream commit d1a445d3b86c9341ce7a0954c23be0edb5c9bec5 ]

There are many of those warnings.

In file included from ./arch/powerpc/include/asm/paca.h:15,
                 from ./arch/powerpc/include/asm/current.h:13,
                 from ./include/linux/thread_info.h:21,
                 from ./include/asm-generic/preempt.h:5,
                 from ./arch/powerpc/include/generated/asm/preempt.h:1,
                 from ./include/linux/preempt.h:78,
                 from ./include/linux/spinlock.h:51,
                 from fs/fs-writeback.c:19:
In function 'strncpy',
    inlined from 'perf_trace_writeback_page_template' at
./include/trace/events/writeback.h:56:1:
./include/linux/string.h:260:9: warning: '__builtin_strncpy' specified
bound 32 equals destination size [-Wstringop-truncation]
  return __builtin_strncpy(p, q, size);
         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fix it by using the new strscpy_pad() which was introduced in "lib/string:
Add strscpy_pad() function" and will always be NUL-terminated instead of
strncpy().  Also, change strlcpy() to use strscpy_pad() in this file for
consistency.

Link: http://lkml.kernel.org/r/1564075099-27750-1-git-send-email-cai@lca.pw
Fixes: 455b2864686d ("writeback: Initial tracing support")
Fixes: 028c2dd184c0 ("writeback: Add tracing to balance_dirty_pages")
Fixes: e84d0a4f8e39 ("writeback: trace event writeback_queue_io")
Fixes: b48c104d2211 ("writeback: trace event bdi_dirty_ratelimit")
Fixes: cc1676d917f3 ("writeback: Move requeueing when I_SYNC set to writeback_sb_inodes()")
Fixes: 9fb0a7da0c52 ("writeback: add more tracepoints")
Signed-off-by: Qian Cai <cai@lca.pw>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: Tobin C. Harding <tobin@kernel.org>
Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Dave Chinner <dchinner@redhat.com>
Cc: Fengguang Wu <fengguang.wu@intel.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Joe Perches <joe@perches.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Jann Horn <jannh@google.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Nitin Gote <nitin.r.gote@intel.com>
Cc: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Cc: Stephen Kitt <steve@sk2.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/trace/events/writeback.h | 38 +++++++++++++++++---------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h
index 2609b1c3549e..07a912af1dd7 100644
--- a/include/trace/events/writeback.h
+++ b/include/trace/events/writeback.h
@@ -65,8 +65,9 @@ TRACE_EVENT(writeback_dirty_page,
 	),
 
 	TP_fast_assign(
-		strncpy(__entry->name,
-			mapping ? dev_name(inode_to_bdi(mapping->host)->dev) : "(unknown)", 32);
+		strscpy_pad(__entry->name,
+			    mapping ? dev_name(inode_to_bdi(mapping->host)->dev) : "(unknown)",
+			    32);
 		__entry->ino = mapping ? mapping->host->i_ino : 0;
 		__entry->index = page->index;
 	),
@@ -95,8 +96,8 @@ DECLARE_EVENT_CLASS(writeback_dirty_inode_template,
 		struct backing_dev_info *bdi = inode_to_bdi(inode);
 
 		/* may be called for files on pseudo FSes w/ unregistered bdi */
-		strncpy(__entry->name,
-			bdi->dev ? dev_name(bdi->dev) : "(unknown)", 32);
+		strscpy_pad(__entry->name,
+			    bdi->dev ? dev_name(bdi->dev) : "(unknown)", 32);
 		__entry->ino		= inode->i_ino;
 		__entry->state		= inode->i_state;
 		__entry->flags		= flags;
@@ -205,8 +206,8 @@ DECLARE_EVENT_CLASS(writeback_write_inode_template,
 	),
 
 	TP_fast_assign(
-		strncpy(__entry->name,
-			dev_name(inode_to_bdi(inode)->dev), 32);
+		strscpy_pad(__entry->name,
+			    dev_name(inode_to_bdi(inode)->dev), 32);
 		__entry->ino		= inode->i_ino;
 		__entry->sync_mode	= wbc->sync_mode;
 		__trace_wbc_assign_cgroup(__get_str(cgroup), wbc);
@@ -249,8 +250,9 @@ DECLARE_EVENT_CLASS(writeback_work_class,
 		__dynamic_array(char, cgroup, __trace_wb_cgroup_size(wb))
 	),
 	TP_fast_assign(
-		strncpy(__entry->name,
-			wb->bdi->dev ? dev_name(wb->bdi->dev) : "(unknown)", 32);
+		strscpy_pad(__entry->name,
+			    wb->bdi->dev ? dev_name(wb->bdi->dev) :
+			    "(unknown)", 32);
 		__entry->nr_pages = work->nr_pages;
 		__entry->sb_dev = work->sb ? work->sb->s_dev : 0;
 		__entry->sync_mode = work->sync_mode;
@@ -303,7 +305,7 @@ DECLARE_EVENT_CLASS(writeback_class,
 		__dynamic_array(char, cgroup, __trace_wb_cgroup_size(wb))
 	),
 	TP_fast_assign(
-		strncpy(__entry->name, dev_name(wb->bdi->dev), 32);
+		strscpy_pad(__entry->name, dev_name(wb->bdi->dev), 32);
 		__trace_wb_assign_cgroup(__get_str(cgroup), wb);
 	),
 	TP_printk("bdi %s: cgroup=%s",
@@ -326,7 +328,7 @@ TRACE_EVENT(writeback_bdi_register,
 		__array(char, name, 32)
 	),
 	TP_fast_assign(
-		strncpy(__entry->name, dev_name(bdi->dev), 32);
+		strscpy_pad(__entry->name, dev_name(bdi->dev), 32);
 	),
 	TP_printk("bdi %s",
 		__entry->name
@@ -351,7 +353,7 @@ DECLARE_EVENT_CLASS(wbc_class,
 	),
 
 	TP_fast_assign(
-		strncpy(__entry->name, dev_name(bdi->dev), 32);
+		strscpy_pad(__entry->name, dev_name(bdi->dev), 32);
 		__entry->nr_to_write	= wbc->nr_to_write;
 		__entry->pages_skipped	= wbc->pages_skipped;
 		__entry->sync_mode	= wbc->sync_mode;
@@ -402,7 +404,7 @@ TRACE_EVENT(writeback_queue_io,
 		__dynamic_array(char, cgroup, __trace_wb_cgroup_size(wb))
 	),
 	TP_fast_assign(
-		strncpy(__entry->name, dev_name(wb->bdi->dev), 32);
+		strncpy_pad(__entry->name, dev_name(wb->bdi->dev), 32);
 		__entry->older	= dirtied_before;
 		__entry->age	= (jiffies - dirtied_before) * 1000 / HZ;
 		__entry->moved	= moved;
@@ -487,7 +489,7 @@ TRACE_EVENT(bdi_dirty_ratelimit,
 	),
 
 	TP_fast_assign(
-		strlcpy(__entry->bdi, dev_name(wb->bdi->dev), 32);
+		strscpy_pad(__entry->bdi, dev_name(wb->bdi->dev), 32);
 		__entry->write_bw	= KBps(wb->write_bandwidth);
 		__entry->avg_write_bw	= KBps(wb->avg_write_bandwidth);
 		__entry->dirty_rate	= KBps(dirty_rate);
@@ -552,7 +554,7 @@ TRACE_EVENT(balance_dirty_pages,
 
 	TP_fast_assign(
 		unsigned long freerun = (thresh + bg_thresh) / 2;
-		strlcpy(__entry->bdi, dev_name(wb->bdi->dev), 32);
+		strscpy_pad(__entry->bdi, dev_name(wb->bdi->dev), 32);
 
 		__entry->limit		= global_wb_domain.dirty_limit;
 		__entry->setpoint	= (global_wb_domain.dirty_limit +
@@ -613,8 +615,8 @@ TRACE_EVENT(writeback_sb_inodes_requeue,
 	),
 
 	TP_fast_assign(
-		strncpy(__entry->name,
-		        dev_name(inode_to_bdi(inode)->dev), 32);
+		strscpy_pad(__entry->name,
+			    dev_name(inode_to_bdi(inode)->dev), 32);
 		__entry->ino		= inode->i_ino;
 		__entry->state		= inode->i_state;
 		__entry->dirtied_when	= inode->dirtied_when;
@@ -687,8 +689,8 @@ DECLARE_EVENT_CLASS(writeback_single_inode_template,
 	),
 
 	TP_fast_assign(
-		strncpy(__entry->name,
-			dev_name(inode_to_bdi(inode)->dev), 32);
+		strscpy_pad(__entry->name,
+			    dev_name(inode_to_bdi(inode)->dev), 32);
 		__entry->ino		= inode->i_ino;
 		__entry->state		= inode->i_state;
 		__entry->dirtied_when	= inode->dirtied_when;

From 0a9a7692854af580e93ad75a690716ea994ca2d1 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Thu, 30 Jan 2020 22:11:04 -0800
Subject: [PATCH 1492/2658] memcg: fix a crash in wb_workfn when a device
 disappears

[ Upstream commit 68f23b89067fdf187763e75a56087550624fdbee ]

Without memcg, there is a one-to-one mapping between the bdi and
bdi_writeback structures.  In this world, things are fairly
straightforward; the first thing bdi_unregister() does is to shutdown
the bdi_writeback structure (or wb), and part of that writeback ensures
that no other work queued against the wb, and that the wb is fully
drained.

With memcg, however, there is a one-to-many relationship between the bdi
and bdi_writeback structures; that is, there are multiple wb objects
which can all point to a single bdi.  There is a refcount which prevents
the bdi object from being released (and hence, unregistered).  So in
theory, the bdi_unregister() *should* only get called once its refcount
goes to zero (bdi_put will drop the refcount, and when it is zero,
release_bdi gets called, which calls bdi_unregister).

Unfortunately, del_gendisk() in block/gen_hd.c never got the memo about
the Brave New memcg World, and calls bdi_unregister directly.  It does
this without informing the file system, or the memcg code, or anything
else.  This causes the root wb associated with the bdi to be
unregistered, but none of the memcg-specific wb's are shutdown.  So when
one of these wb's are woken up to do delayed work, they try to
dereference their wb->bdi->dev to fetch the device name, but
unfortunately bdi->dev is now NULL, thanks to the bdi_unregister()
called by del_gendisk().  As a result, *boom*.

Fortunately, it looks like the rest of the writeback path is perfectly
happy with bdi->dev and bdi->owner being NULL, so the simplest fix is to
create a bdi_dev_name() function which can handle bdi->dev being NULL.
This also allows us to bulletproof the writeback tracepoints to prevent
them from dereferencing a NULL pointer and crashing the kernel if one is
tracing with memcg's enabled, and an iSCSI device dies or a USB storage
stick is pulled.

The most common way of triggering this will be hotremoval of a device
while writeback with memcg enabled is going on.  It was triggering
several times a day in a heavily loaded production environment.

Google Bug Id: 145475544

Link: https://lore.kernel.org/r/20191227194829.150110-1-tytso@mit.edu
Link: http://lkml.kernel.org/r/20191228005211.163952-1-tytso@mit.edu
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: Chris Mason <clm@fb.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fs-writeback.c                |  2 +-
 include/linux/backing-dev.h      | 10 ++++++++++
 include/trace/events/writeback.h | 29 +++++++++++++----------------
 mm/backing-dev.c                 |  1 +
 4 files changed, 25 insertions(+), 17 deletions(-)

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 516f7eb36a73..631b484d09a8 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -1929,7 +1929,7 @@ void wb_workfn(struct work_struct *work)
 						struct bdi_writeback, dwork);
 	long pages_written;
 
-	set_worker_desc("flush-%s", dev_name(wb->bdi->dev));
+	set_worker_desc("flush-%s", bdi_dev_name(wb->bdi));
 	current->flags |= PF_SWAPWRITE;
 
 	if (likely(!current_is_workqueue_rescuer() ||
diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
index 361274ce5815..883ce03191e7 100644
--- a/include/linux/backing-dev.h
+++ b/include/linux/backing-dev.h
@@ -12,6 +12,7 @@
 #include <linux/fs.h>
 #include <linux/sched.h>
 #include <linux/blkdev.h>
+#include <linux/device.h>
 #include <linux/writeback.h>
 #include <linux/blk-cgroup.h>
 #include <linux/backing-dev-defs.h>
@@ -518,4 +519,13 @@ static inline int bdi_rw_congested(struct backing_dev_info *bdi)
 				  (1 << WB_async_congested));
 }
 
+extern const char *bdi_unknown_name;
+
+static inline const char *bdi_dev_name(struct backing_dev_info *bdi)
+{
+	if (!bdi || !bdi->dev)
+		return bdi_unknown_name;
+	return dev_name(bdi->dev);
+}
+
 #endif	/* _LINUX_BACKING_DEV_H */
diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h
index 07a912af1dd7..d01217407d6d 100644
--- a/include/trace/events/writeback.h
+++ b/include/trace/events/writeback.h
@@ -66,8 +66,8 @@ TRACE_EVENT(writeback_dirty_page,
 
 	TP_fast_assign(
 		strscpy_pad(__entry->name,
-			    mapping ? dev_name(inode_to_bdi(mapping->host)->dev) : "(unknown)",
-			    32);
+			    bdi_dev_name(mapping ? inode_to_bdi(mapping->host) :
+					 NULL), 32);
 		__entry->ino = mapping ? mapping->host->i_ino : 0;
 		__entry->index = page->index;
 	),
@@ -96,8 +96,7 @@ DECLARE_EVENT_CLASS(writeback_dirty_inode_template,
 		struct backing_dev_info *bdi = inode_to_bdi(inode);
 
 		/* may be called for files on pseudo FSes w/ unregistered bdi */
-		strscpy_pad(__entry->name,
-			    bdi->dev ? dev_name(bdi->dev) : "(unknown)", 32);
+		strscpy_pad(__entry->name, bdi_dev_name(bdi), 32);
 		__entry->ino		= inode->i_ino;
 		__entry->state		= inode->i_state;
 		__entry->flags		= flags;
@@ -207,7 +206,7 @@ DECLARE_EVENT_CLASS(writeback_write_inode_template,
 
 	TP_fast_assign(
 		strscpy_pad(__entry->name,
-			    dev_name(inode_to_bdi(inode)->dev), 32);
+			    bdi_dev_name(inode_to_bdi(inode)), 32);
 		__entry->ino		= inode->i_ino;
 		__entry->sync_mode	= wbc->sync_mode;
 		__trace_wbc_assign_cgroup(__get_str(cgroup), wbc);
@@ -250,9 +249,7 @@ DECLARE_EVENT_CLASS(writeback_work_class,
 		__dynamic_array(char, cgroup, __trace_wb_cgroup_size(wb))
 	),
 	TP_fast_assign(
-		strscpy_pad(__entry->name,
-			    wb->bdi->dev ? dev_name(wb->bdi->dev) :
-			    "(unknown)", 32);
+		strscpy_pad(__entry->name, bdi_dev_name(wb->bdi), 32);
 		__entry->nr_pages = work->nr_pages;
 		__entry->sb_dev = work->sb ? work->sb->s_dev : 0;
 		__entry->sync_mode = work->sync_mode;
@@ -305,7 +302,7 @@ DECLARE_EVENT_CLASS(writeback_class,
 		__dynamic_array(char, cgroup, __trace_wb_cgroup_size(wb))
 	),
 	TP_fast_assign(
-		strscpy_pad(__entry->name, dev_name(wb->bdi->dev), 32);
+		strscpy_pad(__entry->name, bdi_dev_name(wb->bdi), 32);
 		__trace_wb_assign_cgroup(__get_str(cgroup), wb);
 	),
 	TP_printk("bdi %s: cgroup=%s",
@@ -328,7 +325,7 @@ TRACE_EVENT(writeback_bdi_register,
 		__array(char, name, 32)
 	),
 	TP_fast_assign(
-		strscpy_pad(__entry->name, dev_name(bdi->dev), 32);
+		strscpy_pad(__entry->name, bdi_dev_name(bdi), 32);
 	),
 	TP_printk("bdi %s",
 		__entry->name
@@ -353,7 +350,7 @@ DECLARE_EVENT_CLASS(wbc_class,
 	),
 
 	TP_fast_assign(
-		strscpy_pad(__entry->name, dev_name(bdi->dev), 32);
+		strscpy_pad(__entry->name, bdi_dev_name(bdi), 32);
 		__entry->nr_to_write	= wbc->nr_to_write;
 		__entry->pages_skipped	= wbc->pages_skipped;
 		__entry->sync_mode	= wbc->sync_mode;
@@ -404,7 +401,7 @@ TRACE_EVENT(writeback_queue_io,
 		__dynamic_array(char, cgroup, __trace_wb_cgroup_size(wb))
 	),
 	TP_fast_assign(
-		strncpy_pad(__entry->name, dev_name(wb->bdi->dev), 32);
+		strscpy_pad(__entry->name, bdi_dev_name(wb->bdi), 32);
 		__entry->older	= dirtied_before;
 		__entry->age	= (jiffies - dirtied_before) * 1000 / HZ;
 		__entry->moved	= moved;
@@ -489,7 +486,7 @@ TRACE_EVENT(bdi_dirty_ratelimit,
 	),
 
 	TP_fast_assign(
-		strscpy_pad(__entry->bdi, dev_name(wb->bdi->dev), 32);
+		strscpy_pad(__entry->bdi, bdi_dev_name(wb->bdi), 32);
 		__entry->write_bw	= KBps(wb->write_bandwidth);
 		__entry->avg_write_bw	= KBps(wb->avg_write_bandwidth);
 		__entry->dirty_rate	= KBps(dirty_rate);
@@ -554,7 +551,7 @@ TRACE_EVENT(balance_dirty_pages,
 
 	TP_fast_assign(
 		unsigned long freerun = (thresh + bg_thresh) / 2;
-		strscpy_pad(__entry->bdi, dev_name(wb->bdi->dev), 32);
+		strscpy_pad(__entry->bdi, bdi_dev_name(wb->bdi), 32);
 
 		__entry->limit		= global_wb_domain.dirty_limit;
 		__entry->setpoint	= (global_wb_domain.dirty_limit +
@@ -616,7 +613,7 @@ TRACE_EVENT(writeback_sb_inodes_requeue,
 
 	TP_fast_assign(
 		strscpy_pad(__entry->name,
-			    dev_name(inode_to_bdi(inode)->dev), 32);
+			    bdi_dev_name(inode_to_bdi(inode)), 32);
 		__entry->ino		= inode->i_ino;
 		__entry->state		= inode->i_state;
 		__entry->dirtied_when	= inode->dirtied_when;
@@ -690,7 +687,7 @@ DECLARE_EVENT_CLASS(writeback_single_inode_template,
 
 	TP_fast_assign(
 		strscpy_pad(__entry->name,
-			    dev_name(inode_to_bdi(inode)->dev), 32);
+			    bdi_dev_name(inode_to_bdi(inode)), 32);
 		__entry->ino		= inode->i_ino;
 		__entry->state		= inode->i_state;
 		__entry->dirtied_when	= inode->dirtied_when;
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 07e3b3b8e846..f705c58b320b 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -21,6 +21,7 @@ struct backing_dev_info noop_backing_dev_info = {
 EXPORT_SYMBOL_GPL(noop_backing_dev_info);
 
 static struct class *bdi_class;
+const char *bdi_unknown_name = "(unknown)";
 
 /*
  * bdi_lock protects updates to bdi_list. bdi_list has RCU reader side

From 53bb27aacdff93db148b49376cb551c5422c0694 Mon Sep 17 00:00:00 2001
From: Phillip Lougher <phillip@squashfs.org.uk>
Date: Tue, 9 Feb 2021 13:41:53 -0800
Subject: [PATCH 1493/2658] squashfs: add more sanity checks in id lookup

commit f37aa4c7366e23f91b81d00bafd6a7ab54e4a381 upstream.

Sysbot has reported a number of "slab-out-of-bounds reads" and
"use-after-free read" errors which has been identified as being caused
by a corrupted index value read from the inode.  This could be because
the metadata block is uncompressed, or because the "compression" bit has
been corrupted (turning a compressed block into an uncompressed block).

This patch adds additional sanity checks to detect this, and the
following corruption.

1. It checks against corruption of the ids count.  This can either
   lead to a larger table to be read, or a smaller than expected
   table to be read.

   In the case of a too large ids count, this would often have been
   trapped by the existing sanity checks, but this patch introduces
   a more exact check, which can identify too small values.

2. It checks the contents of the index table for corruption.

Link: https://lkml.kernel.org/r/20210204130249.4495-3-phillip@squashfs.org.uk
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Reported-by: syzbot+b06d57ba83f604522af2@syzkaller.appspotmail.com
Reported-by: syzbot+c021ba012da41ee9807c@syzkaller.appspotmail.com
Reported-by: syzbot+5024636e8b5fd19f0f19@syzkaller.appspotmail.com
Reported-by: syzbot+bcbc661df46657d0fa4f@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/squashfs/id.c             | 40 ++++++++++++++++++++++++++++--------
 fs/squashfs/squashfs_fs_sb.h |  1 +
 fs/squashfs/super.c          |  6 +++---
 fs/squashfs/xattr.h          | 10 ++++++++-
 4 files changed, 45 insertions(+), 12 deletions(-)

diff --git a/fs/squashfs/id.c b/fs/squashfs/id.c
index d38ea3dab951..8ccc0e3f6ea5 100644
--- a/fs/squashfs/id.c
+++ b/fs/squashfs/id.c
@@ -48,10 +48,15 @@ int squashfs_get_id(struct super_block *sb, unsigned int index,
 	struct squashfs_sb_info *msblk = sb->s_fs_info;
 	int block = SQUASHFS_ID_BLOCK(index);
 	int offset = SQUASHFS_ID_BLOCK_OFFSET(index);
-	u64 start_block = le64_to_cpu(msblk->id_table[block]);
+	u64 start_block;
 	__le32 disk_id;
 	int err;
 
+	if (index >= msblk->ids)
+		return -EINVAL;
+
+	start_block = le64_to_cpu(msblk->id_table[block]);
+
 	err = squashfs_read_metadata(sb, &disk_id, &start_block, &offset,
 							sizeof(disk_id));
 	if (err < 0)
@@ -69,7 +74,10 @@ __le64 *squashfs_read_id_index_table(struct super_block *sb,
 		u64 id_table_start, u64 next_table, unsigned short no_ids)
 {
 	unsigned int length = SQUASHFS_ID_BLOCK_BYTES(no_ids);
+	unsigned int indexes = SQUASHFS_ID_BLOCKS(no_ids);
+	int n;
 	__le64 *table;
+	u64 start, end;
 
 	TRACE("In read_id_index_table, length %d\n", length);
 
@@ -80,20 +88,36 @@ __le64 *squashfs_read_id_index_table(struct super_block *sb,
 		return ERR_PTR(-EINVAL);
 
 	/*
-	 * length bytes should not extend into the next table - this check
-	 * also traps instances where id_table_start is incorrectly larger
-	 * than the next table start
+	 * The computed size of the index table (length bytes) should exactly
+	 * match the table start and end points
 	 */
-	if (id_table_start + length > next_table)
+	if (length != (next_table - id_table_start))
 		return ERR_PTR(-EINVAL);
 
 	table = squashfs_read_table(sb, id_table_start, length);
+	if (IS_ERR(table))
+		return table;
 
 	/*
-	 * table[0] points to the first id lookup table metadata block, this
-	 * should be less than id_table_start
+	 * table[0], table[1], ... table[indexes - 1] store the locations
+	 * of the compressed id blocks.   Each entry should be less than
+	 * the next (i.e. table[0] < table[1]), and the difference between them
+	 * should be SQUASHFS_METADATA_SIZE or less.  table[indexes - 1]
+	 * should be less than id_table_start, and again the difference
+	 * should be SQUASHFS_METADATA_SIZE or less
 	 */
-	if (!IS_ERR(table) && le64_to_cpu(table[0]) >= id_table_start) {
+	for (n = 0; n < (indexes - 1); n++) {
+		start = le64_to_cpu(table[n]);
+		end = le64_to_cpu(table[n + 1]);
+
+		if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
+			kfree(table);
+			return ERR_PTR(-EINVAL);
+		}
+	}
+
+	start = le64_to_cpu(table[indexes - 1]);
+	if (start >= id_table_start || (id_table_start - start) > SQUASHFS_METADATA_SIZE) {
 		kfree(table);
 		return ERR_PTR(-EINVAL);
 	}
diff --git a/fs/squashfs/squashfs_fs_sb.h b/fs/squashfs/squashfs_fs_sb.h
index 3b767ce1e46d..9dc66d0003a6 100644
--- a/fs/squashfs/squashfs_fs_sb.h
+++ b/fs/squashfs/squashfs_fs_sb.h
@@ -77,5 +77,6 @@ struct squashfs_sb_info {
 	unsigned int				inodes;
 	unsigned int				fragments;
 	int					xattr_ids;
+	unsigned int				ids;
 };
 #endif
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 4ffbddb688aa..9602ce9ddfc7 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -177,6 +177,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
 	msblk->directory_table = le64_to_cpu(sblk->directory_table_start);
 	msblk->inodes = le32_to_cpu(sblk->inodes);
 	msblk->fragments = le32_to_cpu(sblk->fragments);
+	msblk->ids = le16_to_cpu(sblk->no_ids);
 	flags = le16_to_cpu(sblk->flags);
 
 	TRACE("Found valid superblock on %s\n", bdevname(sb->s_bdev, b));
@@ -188,7 +189,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
 	TRACE("Block size %d\n", msblk->block_size);
 	TRACE("Number of inodes %d\n", msblk->inodes);
 	TRACE("Number of fragments %d\n", msblk->fragments);
-	TRACE("Number of ids %d\n", le16_to_cpu(sblk->no_ids));
+	TRACE("Number of ids %d\n", msblk->ids);
 	TRACE("sblk->inode_table_start %llx\n", msblk->inode_table);
 	TRACE("sblk->directory_table_start %llx\n", msblk->directory_table);
 	TRACE("sblk->fragment_table_start %llx\n",
@@ -245,8 +246,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
 allocate_id_index_table:
 	/* Allocate and read id index table */
 	msblk->id_table = squashfs_read_id_index_table(sb,
-		le64_to_cpu(sblk->id_table_start), next_table,
-		le16_to_cpu(sblk->no_ids));
+		le64_to_cpu(sblk->id_table_start), next_table, msblk->ids);
 	if (IS_ERR(msblk->id_table)) {
 		ERROR("unable to read id index table\n");
 		err = PTR_ERR(msblk->id_table);
diff --git a/fs/squashfs/xattr.h b/fs/squashfs/xattr.h
index c83f5d9ec125..30b3aaa08b62 100644
--- a/fs/squashfs/xattr.h
+++ b/fs/squashfs/xattr.h
@@ -30,8 +30,16 @@ extern int squashfs_xattr_lookup(struct super_block *, unsigned int, int *,
 static inline __le64 *squashfs_read_xattr_id_table(struct super_block *sb,
 		u64 start, u64 *xattr_table_start, int *xattr_ids)
 {
+	struct squashfs_xattr_id_table *id_table;
+
+	id_table = squashfs_read_table(sb, start, sizeof(*id_table));
+	if (IS_ERR(id_table))
+		return (__le64 *) id_table;
+
+	*xattr_table_start = le64_to_cpu(id_table->xattr_table_start);
+	kfree(id_table);
+
 	ERROR("Xattrs in filesystem, these will be ignored\n");
-	*xattr_table_start = start;
 	return ERR_PTR(-ENOTSUPP);
 }
 

From b19a00d31d8499ae9d0450f0e1ae1d4835c1b008 Mon Sep 17 00:00:00 2001
From: Phillip Lougher <phillip@squashfs.org.uk>
Date: Tue, 9 Feb 2021 13:41:56 -0800
Subject: [PATCH 1494/2658] squashfs: add more sanity checks in inode lookup

commit eabac19e40c095543def79cb6ffeb3a8588aaff4 upstream.

Sysbot has reported an "slab-out-of-bounds read" error which has been
identified as being caused by a corrupted "ino_num" value read from the
inode.  This could be because the metadata block is uncompressed, or
because the "compression" bit has been corrupted (turning a compressed
block into an uncompressed block).

This patch adds additional sanity checks to detect this, and the
following corruption.

1. It checks against corruption of the inodes count.  This can either
   lead to a larger table to be read, or a smaller than expected
   table to be read.

   In the case of a too large inodes count, this would often have been
   trapped by the existing sanity checks, but this patch introduces
   a more exact check, which can identify too small values.

2. It checks the contents of the index table for corruption.

[phillip@squashfs.org.uk: fix checkpatch issue]
  Link: https://lkml.kernel.org/r/527909353.754618.1612769948607@webmail.123-reg.co.uk

Link: https://lkml.kernel.org/r/20210204130249.4495-4-phillip@squashfs.org.uk
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Reported-by: syzbot+04419e3ff19d2970ea28@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/squashfs/export.c | 41 +++++++++++++++++++++++++++++++++--------
 1 file changed, 33 insertions(+), 8 deletions(-)

diff --git a/fs/squashfs/export.c b/fs/squashfs/export.c
index 8073b6532cf0..d2a806416c3a 100644
--- a/fs/squashfs/export.c
+++ b/fs/squashfs/export.c
@@ -54,12 +54,17 @@ static long long squashfs_inode_lookup(struct super_block *sb, int ino_num)
 	struct squashfs_sb_info *msblk = sb->s_fs_info;
 	int blk = SQUASHFS_LOOKUP_BLOCK(ino_num - 1);
 	int offset = SQUASHFS_LOOKUP_BLOCK_OFFSET(ino_num - 1);
-	u64 start = le64_to_cpu(msblk->inode_lookup_table[blk]);
+	u64 start;
 	__le64 ino;
 	int err;
 
 	TRACE("Entered squashfs_inode_lookup, inode_number = %d\n", ino_num);
 
+	if (ino_num == 0 || (ino_num - 1) >= msblk->inodes)
+		return -EINVAL;
+
+	start = le64_to_cpu(msblk->inode_lookup_table[blk]);
+
 	err = squashfs_read_metadata(sb, &ino, &start, &offset, sizeof(ino));
 	if (err < 0)
 		return err;
@@ -124,7 +129,10 @@ __le64 *squashfs_read_inode_lookup_table(struct super_block *sb,
 		u64 lookup_table_start, u64 next_table, unsigned int inodes)
 {
 	unsigned int length = SQUASHFS_LOOKUP_BLOCK_BYTES(inodes);
+	unsigned int indexes = SQUASHFS_LOOKUP_BLOCKS(inodes);
+	int n;
 	__le64 *table;
+	u64 start, end;
 
 	TRACE("In read_inode_lookup_table, length %d\n", length);
 
@@ -134,20 +142,37 @@ __le64 *squashfs_read_inode_lookup_table(struct super_block *sb,
 	if (inodes == 0)
 		return ERR_PTR(-EINVAL);
 
-	/* length bytes should not extend into the next table - this check
-	 * also traps instances where lookup_table_start is incorrectly larger
-	 * than the next table start
+	/*
+	 * The computed size of the lookup table (length bytes) should exactly
+	 * match the table start and end points
 	 */
-	if (lookup_table_start + length > next_table)
+	if (length != (next_table - lookup_table_start))
 		return ERR_PTR(-EINVAL);
 
 	table = squashfs_read_table(sb, lookup_table_start, length);
+	if (IS_ERR(table))
+		return table;
 
 	/*
-	 * table[0] points to the first inode lookup table metadata block,
-	 * this should be less than lookup_table_start
+	 * table0], table[1], ... table[indexes - 1] store the locations
+	 * of the compressed inode lookup blocks.  Each entry should be
+	 * less than the next (i.e. table[0] < table[1]), and the difference
+	 * between them should be SQUASHFS_METADATA_SIZE or less.
+	 * table[indexes - 1] should  be less than lookup_table_start, and
+	 * again the difference should be SQUASHFS_METADATA_SIZE or less
 	 */
-	if (!IS_ERR(table) && le64_to_cpu(table[0]) >= lookup_table_start) {
+	for (n = 0; n < (indexes - 1); n++) {
+		start = le64_to_cpu(table[n]);
+		end = le64_to_cpu(table[n + 1]);
+
+		if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
+			kfree(table);
+			return ERR_PTR(-EINVAL);
+		}
+	}
+
+	start = le64_to_cpu(table[indexes - 1]);
+	if (start >= lookup_table_start || (lookup_table_start - start) > SQUASHFS_METADATA_SIZE) {
 		kfree(table);
 		return ERR_PTR(-EINVAL);
 	}

From 1305dfaf59657c87b49205cb994db0348a10ba4e Mon Sep 17 00:00:00 2001
From: Phillip Lougher <phillip@squashfs.org.uk>
Date: Tue, 9 Feb 2021 13:42:00 -0800
Subject: [PATCH 1495/2658] squashfs: add more sanity checks in xattr id lookup

commit 506220d2ba21791314af569211ffd8870b8208fa upstream.

Sysbot has reported a warning where a kmalloc() attempt exceeds the
maximum limit.  This has been identified as corruption of the xattr_ids
count when reading the xattr id lookup table.

This patch adds a number of additional sanity checks to detect this
corruption and others.

1. It checks for a corrupted xattr index read from the inode.  This could
   be because the metadata block is uncompressed, or because the
   "compression" bit has been corrupted (turning a compressed block
   into an uncompressed block).  This would cause an out of bounds read.

2. It checks against corruption of the xattr_ids count.  This can either
   lead to the above kmalloc failure, or a smaller than expected
   table to be read.

3. It checks the contents of the index table for corruption.

[phillip@squashfs.org.uk: fix checkpatch issue]
  Link: https://lkml.kernel.org/r/270245655.754655.1612770082682@webmail.123-reg.co.uk

Link: https://lkml.kernel.org/r/20210204130249.4495-5-phillip@squashfs.org.uk
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Reported-by: syzbot+2ccea6339d368360800d@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/squashfs/xattr_id.c | 66 ++++++++++++++++++++++++++++++++++++------
 1 file changed, 57 insertions(+), 9 deletions(-)

diff --git a/fs/squashfs/xattr_id.c b/fs/squashfs/xattr_id.c
index c89607d690c4..3a655d879600 100644
--- a/fs/squashfs/xattr_id.c
+++ b/fs/squashfs/xattr_id.c
@@ -44,10 +44,15 @@ int squashfs_xattr_lookup(struct super_block *sb, unsigned int index,
 	struct squashfs_sb_info *msblk = sb->s_fs_info;
 	int block = SQUASHFS_XATTR_BLOCK(index);
 	int offset = SQUASHFS_XATTR_BLOCK_OFFSET(index);
-	u64 start_block = le64_to_cpu(msblk->xattr_id_table[block]);
+	u64 start_block;
 	struct squashfs_xattr_id id;
 	int err;
 
+	if (index >= msblk->xattr_ids)
+		return -EINVAL;
+
+	start_block = le64_to_cpu(msblk->xattr_id_table[block]);
+
 	err = squashfs_read_metadata(sb, &id, &start_block, &offset,
 							sizeof(id));
 	if (err < 0)
@@ -63,13 +68,17 @@ int squashfs_xattr_lookup(struct super_block *sb, unsigned int index,
 /*
  * Read uncompressed xattr id lookup table indexes from disk into memory
  */
-__le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 start,
+__le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start,
 		u64 *xattr_table_start, int *xattr_ids)
 {
-	unsigned int len;
+	struct squashfs_sb_info *msblk = sb->s_fs_info;
+	unsigned int len, indexes;
 	struct squashfs_xattr_id_table *id_table;
+	__le64 *table;
+	u64 start, end;
+	int n;
 
-	id_table = squashfs_read_table(sb, start, sizeof(*id_table));
+	id_table = squashfs_read_table(sb, table_start, sizeof(*id_table));
 	if (IS_ERR(id_table))
 		return (__le64 *) id_table;
 
@@ -83,13 +92,52 @@ __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 start,
 	if (*xattr_ids == 0)
 		return ERR_PTR(-EINVAL);
 
-	/* xattr_table should be less than start */
-	if (*xattr_table_start >= start)
+	len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids);
+	indexes = SQUASHFS_XATTR_BLOCKS(*xattr_ids);
+
+	/*
+	 * The computed size of the index table (len bytes) should exactly
+	 * match the table start and end points
+	 */
+	start = table_start + sizeof(*id_table);
+	end = msblk->bytes_used;
+
+	if (len != (end - start))
 		return ERR_PTR(-EINVAL);
 
-	len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids);
+	table = squashfs_read_table(sb, start, len);
+	if (IS_ERR(table))
+		return table;
+
+	/* table[0], table[1], ... table[indexes - 1] store the locations
+	 * of the compressed xattr id blocks.  Each entry should be less than
+	 * the next (i.e. table[0] < table[1]), and the difference between them
+	 * should be SQUASHFS_METADATA_SIZE or less.  table[indexes - 1]
+	 * should be less than table_start, and again the difference
+	 * shouls be SQUASHFS_METADATA_SIZE or less.
+	 *
+	 * Finally xattr_table_start should be less than table[0].
+	 */
+	for (n = 0; n < (indexes - 1); n++) {
+		start = le64_to_cpu(table[n]);
+		end = le64_to_cpu(table[n + 1]);
+
+		if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
+			kfree(table);
+			return ERR_PTR(-EINVAL);
+		}
+	}
+
+	start = le64_to_cpu(table[indexes - 1]);
+	if (start >= table_start || (table_start - start) > SQUASHFS_METADATA_SIZE) {
+		kfree(table);
+		return ERR_PTR(-EINVAL);
+	}
 
-	TRACE("In read_xattr_index_table, length %d\n", len);
+	if (*xattr_table_start >= le64_to_cpu(table[0])) {
+		kfree(table);
+		return ERR_PTR(-EINVAL);
+	}
 
-	return squashfs_read_table(sb, start + sizeof(*id_table), len);
+	return table;
 }

From bded05ebac86de3f5d7c54d1d4e7329d10256b8d Mon Sep 17 00:00:00 2001
From: Roman Gushchin <guro@fb.com>
Date: Thu, 4 Feb 2021 18:32:36 -0800
Subject: [PATCH 1496/2658] memblock: do not start bottom-up allocations with
 kernel_end

[ Upstream commit 2dcb3964544177c51853a210b6ad400de78ef17d ]

With kaslr the kernel image is placed at a random place, so starting the
bottom-up allocation with the kernel_end can result in an allocation
failure and a warning like this one:

  hugetlb_cma: reserve 2048 MiB, up to 2048 MiB per node
  ------------[ cut here ]------------
  memblock: bottom-up allocation failed, memory hotremove may be affected
  WARNING: CPU: 0 PID: 0 at mm/memblock.c:332 memblock_find_in_range_node+0x178/0x25a
  Modules linked in:
  CPU: 0 PID: 0 Comm: swapper Not tainted 5.10.0+ #1169
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014
  RIP: 0010:memblock_find_in_range_node+0x178/0x25a
  Code: e9 6d ff ff ff 48 85 c0 0f 85 da 00 00 00 80 3d 9b 35 df 00 00 75 15 48 c7 c7 c0 75 59 88 c6 05 8b 35 df 00 01 e8 25 8a fa ff <0f> 0b 48 c7 44 24 20 ff ff ff ff 44 89 e6 44 89 ea 48 c7 c1 70 5c
  RSP: 0000:ffffffff88803d18 EFLAGS: 00010086 ORIG_RAX: 0000000000000000
  RAX: 0000000000000000 RBX: 0000000240000000 RCX: 00000000ffffdfff
  RDX: 00000000ffffdfff RSI: 00000000ffffffea RDI: 0000000000000046
  RBP: 0000000100000000 R08: ffffffff88922788 R09: 0000000000009ffb
  R10: 00000000ffffe000 R11: 3fffffffffffffff R12: 0000000000000000
  R13: 0000000000000000 R14: 0000000080000000 R15: 00000001fb42c000
  FS:  0000000000000000(0000) GS:ffffffff88f71000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: ffffa080fb401000 CR3: 00000001fa80a000 CR4: 00000000000406b0
  Call Trace:
    memblock_alloc_range_nid+0x8d/0x11e
    cma_declare_contiguous_nid+0x2c4/0x38c
    hugetlb_cma_reserve+0xdc/0x128
    flush_tlb_one_kernel+0xc/0x20
    native_set_fixmap+0x82/0xd0
    flat_get_apic_id+0x5/0x10
    register_lapic_address+0x8e/0x97
    setup_arch+0x8a5/0xc3f
    start_kernel+0x66/0x547
    load_ucode_bsp+0x4c/0xcd
    secondary_startup_64_no_verify+0xb0/0xbb
  random: get_random_bytes called from __warn+0xab/0x110 with crng_init=0
  ---[ end trace f151227d0b39be70 ]---

At the same time, the kernel image is protected with memblock_reserve(),
so we can just start searching at PAGE_SIZE.  In this case the bottom-up
allocation has the same chances to success as a top-down allocation, so
there is no reason to fallback in the case of a failure.  All together it
simplifies the logic.

Link: https://lkml.kernel.org/r/20201217201214.3414100-2-guro@fb.com
Fixes: 8fabc623238e ("powerpc: Ensure that swiotlb buffer is allocated from low memory")
Signed-off-by: Roman Gushchin <guro@fb.com>
Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Wonhyuk Yang <vvghjk1234@gmail.com>
Cc: Thiago Jung Bauermann <bauerman@linux.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/memblock.c | 49 ++++++-------------------------------------------
 1 file changed, 6 insertions(+), 43 deletions(-)

diff --git a/mm/memblock.c b/mm/memblock.c
index 351a4840a407..cda0d3e5e9c2 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -193,14 +193,6 @@ __memblock_find_range_top_down(phys_addr_t start, phys_addr_t end,
  *
  * Find @size free area aligned to @align in the specified range and node.
  *
- * When allocation direction is bottom-up, the @start should be greater
- * than the end of the kernel image. Otherwise, it will be trimmed. The
- * reason is that we want the bottom-up allocation just near the kernel
- * image so it is highly likely that the allocated memory and the kernel
- * will reside in the same node.
- *
- * If bottom-up allocation failed, will try to allocate memory top-down.
- *
  * RETURNS:
  * Found address on success, 0 on failure.
  */
@@ -208,8 +200,6 @@ phys_addr_t __init_memblock memblock_find_in_range_node(phys_addr_t size,
 					phys_addr_t align, phys_addr_t start,
 					phys_addr_t end, int nid, ulong flags)
 {
-	phys_addr_t kernel_end, ret;
-
 	/* pump up @end */
 	if (end == MEMBLOCK_ALLOC_ACCESSIBLE)
 		end = memblock.current_limit;
@@ -217,40 +207,13 @@ phys_addr_t __init_memblock memblock_find_in_range_node(phys_addr_t size,
 	/* avoid allocating the first page */
 	start = max_t(phys_addr_t, start, PAGE_SIZE);
 	end = max(start, end);
-	kernel_end = __pa_symbol(_end);
-
-	/*
-	 * try bottom-up allocation only when bottom-up mode
-	 * is set and @end is above the kernel image.
-	 */
-	if (memblock_bottom_up() && end > kernel_end) {
-		phys_addr_t bottom_up_start;
-
-		/* make sure we will allocate above the kernel */
-		bottom_up_start = max(start, kernel_end);
 
-		/* ok, try bottom-up allocation first */
-		ret = __memblock_find_range_bottom_up(bottom_up_start, end,
-						      size, align, nid, flags);
-		if (ret)
-			return ret;
-
-		/*
-		 * we always limit bottom-up allocation above the kernel,
-		 * but top-down allocation doesn't have the limit, so
-		 * retrying top-down allocation may succeed when bottom-up
-		 * allocation failed.
-		 *
-		 * bottom-up allocation is expected to be fail very rarely,
-		 * so we use WARN_ONCE() here to see the stack trace if
-		 * fail happens.
-		 */
-		WARN_ONCE(1, "memblock: bottom-up allocation failed, "
-			     "memory hotunplug may be affected\n");
-	}
-
-	return __memblock_find_range_top_down(start, end, size, align, nid,
-					      flags);
+	if (memblock_bottom_up())
+		return __memblock_find_range_bottom_up(start, end, size, align,
+						       nid, flags);
+	else
+		return __memblock_find_range_top_down(start, end, size, align,
+						      nid, flags);
 }
 
 /**

From 8338b38a73b61f95d58c6aa320cbb9c741a8369c Mon Sep 17 00:00:00 2001
From: Jozsef Kadlecsik <kadlec@mail.kfki.hu>
Date: Fri, 29 Jan 2021 20:57:43 +0100
Subject: [PATCH 1497/2658] netfilter: xt_recent: Fix attempt to update deleted
 entry

[ Upstream commit b1bdde33b72366da20d10770ab7a49fe87b5e190 ]

When both --reap and --update flag are specified, there's a code
path at which the entry to be updated is reaped beforehand,
which then leads to kernel crash. Reap only entries which won't be
updated.

Fixes kernel bugzilla #207773.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=207773
Reported-by: Reindl Harald <h.reindl@thelounge.net>
Fixes: 0079c5aee348 ("netfilter: xt_recent: add an entry reaper")
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/xt_recent.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index d0531ddb6ae4..e9f2b1cc0c76 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -156,7 +156,8 @@ static void recent_entry_remove(struct recent_table *t, struct recent_entry *e)
 /*
  * Drop entries with timestamps older then 'time'.
  */
-static void recent_entry_reap(struct recent_table *t, unsigned long time)
+static void recent_entry_reap(struct recent_table *t, unsigned long time,
+			      struct recent_entry *working, bool update)
 {
 	struct recent_entry *e;
 
@@ -165,6 +166,12 @@ static void recent_entry_reap(struct recent_table *t, unsigned long time)
 	 */
 	e = list_entry(t->lru_list.next, struct recent_entry, lru_list);
 
+	/*
+	 * Do not reap the entry which are going to be updated.
+	 */
+	if (e == working && update)
+		return;
+
 	/*
 	 * The last time stamp is the most recent.
 	 */
@@ -307,7 +314,8 @@ recent_mt(const struct sk_buff *skb, struct xt_action_param *par)
 
 		/* info->seconds must be non-zero */
 		if (info->check_set & XT_RECENT_REAP)
-			recent_entry_reap(t, time);
+			recent_entry_reap(t, time, e,
+				info->check_set & XT_RECENT_UPDATE && ret);
 	}
 
 	if (info->check_set & XT_RECENT_SET ||

From 0d17a093222c0af01c3df9774e9080175f489a3c Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Fri, 12 Feb 2021 20:52:54 -0800
Subject: [PATCH 1498/2658] h8300: fix PREEMPTION build, TI_PRE_COUNT undefined

[ Upstream commit ade9679c159d5bbe14fb7e59e97daf6062872e2b ]

Fix a build error for undefined 'TI_PRE_COUNT' by adding it to
asm-offsets.c.

  h8300-linux-ld: arch/h8300/kernel/entry.o: in function `resume_kernel': (.text+0x29a): undefined reference to `TI_PRE_COUNT'

Link: https://lkml.kernel.org/r/20210212021650.22740-1-rdunlap@infradead.org
Fixes: df2078b8daa7 ("h8300: Low level entry")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: kernel test robot <lkp@intel.com>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/h8300/kernel/asm-offsets.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/h8300/kernel/asm-offsets.c b/arch/h8300/kernel/asm-offsets.c
index dc2d16ce8a0d..3e33a9844d99 100644
--- a/arch/h8300/kernel/asm-offsets.c
+++ b/arch/h8300/kernel/asm-offsets.c
@@ -62,6 +62,9 @@ int main(void)
 	OFFSET(TI_FLAGS, thread_info, flags);
 	OFFSET(TI_CPU, thread_info, cpu);
 	OFFSET(TI_PRE, thread_info, preempt_count);
+#ifdef CONFIG_PREEMPTION
+	DEFINE(TI_PRE_COUNT, offsetof(struct thread_info, preempt_count));
+#endif
 
 	return 0;
 }

From 377207d1a05a924a7bc216ad91180b0f1cbd2625 Mon Sep 17 00:00:00 2001
From: Felipe Balbi <balbi@kernel.org>
Date: Thu, 13 Aug 2020 08:30:38 +0300
Subject: [PATCH 1499/2658] usb: dwc3: ulpi: fix checkpatch warning

commit 2a499b45295206e7f3dc76edadde891c06cc4447 upstream

no functional changes.

Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc3/ulpi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/dwc3/ulpi.c b/drivers/usb/dwc3/ulpi.c
index ec004c6d76f2..1f8f6163d47d 100644
--- a/drivers/usb/dwc3/ulpi.c
+++ b/drivers/usb/dwc3/ulpi.c
@@ -22,7 +22,7 @@
 
 static int dwc3_ulpi_busyloop(struct dwc3 *dwc)
 {
-	unsigned count = 1000;
+	unsigned int count = 1000;
 	u32 reg;
 
 	while (count--) {

From 6c4a7f5c3975a72471ecc435e070ccf4b2d7c1ab Mon Sep 17 00:00:00 2001
From: Serge Semin <Sergey.Semin@baikalelectronics.ru>
Date: Thu, 10 Dec 2020 11:50:07 +0300
Subject: [PATCH 1500/2658] usb: dwc3: ulpi: Replace CPU-based busyloop with
 Protocol-based one

commit fca3f138105727c3a22edda32d02f91ce1bf11c9 upstream

Originally the procedure of the ULPI transaction finish detection has been
developed as a simple busy-loop with just decrementing counter and no
delays. It's wrong since on different systems the loop will take a
different time to complete. So if the system bus and CPU are fast enough
to overtake the ULPI bus and the companion PHY reaction, then we'll get to
take a false timeout error. Fix this by converting the busy-loop procedure
to take the standard bus speed, address value and the registers access
mode into account for the busy-loop delay calculation.

Here is the way the fix works. It's known that the ULPI bus is clocked
with 60MHz signal. In accordance with [1] the ULPI bus protocol is created
so to spend 5 and 6 clock periods for immediate register write and read
operations respectively, and 6 and 7 clock periods - for the extended
register writes and reads. Based on that we can easily pre-calculate the
time which will be needed for the controller to perform a requested IO
operation. Note we'll still preserve the attempts counter in case if the
DWC USB3 controller has got some internals delays.

[1] UTMI+ Low Pin Interface (ULPI) Specification, Revision 1.1,
    October 20, 2004, pp. 30 - 36.

Fixes: 88bc9d194ff6 ("usb: dwc3: add ULPI interface support")
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
Link: https://lore.kernel.org/r/20201210085008.13264-3-Sergey.Semin@baikalelectronics.ru
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc3/ulpi.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/dwc3/ulpi.c b/drivers/usb/dwc3/ulpi.c
index 1f8f6163d47d..44f1a496633c 100644
--- a/drivers/usb/dwc3/ulpi.c
+++ b/drivers/usb/dwc3/ulpi.c
@@ -10,6 +10,8 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/delay.h>
+#include <linux/time64.h>
 #include <linux/ulpi/regs.h>
 
 #include "core.h"
@@ -20,12 +22,22 @@
 		DWC3_GUSB2PHYACC_ADDR(ULPI_ACCESS_EXTENDED) | \
 		DWC3_GUSB2PHYACC_EXTEND_ADDR(a) : DWC3_GUSB2PHYACC_ADDR(a))
 
-static int dwc3_ulpi_busyloop(struct dwc3 *dwc)
+#define DWC3_ULPI_BASE_DELAY	DIV_ROUND_UP(NSEC_PER_SEC, 60000000L)
+
+static int dwc3_ulpi_busyloop(struct dwc3 *dwc, u8 addr, bool read)
 {
+	unsigned long ns = 5L * DWC3_ULPI_BASE_DELAY;
 	unsigned int count = 1000;
 	u32 reg;
 
+	if (addr >= ULPI_EXT_VENDOR_SPECIFIC)
+		ns += DWC3_ULPI_BASE_DELAY;
+
+	if (read)
+		ns += DWC3_ULPI_BASE_DELAY;
+
 	while (count--) {
+		ndelay(ns);
 		reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYACC(0));
 		if (!(reg & DWC3_GUSB2PHYACC_BUSY))
 			return 0;
@@ -44,7 +56,7 @@ static int dwc3_ulpi_read(struct ulpi_ops *ops, u8 addr)
 	reg = DWC3_GUSB2PHYACC_NEWREGREQ | DWC3_ULPI_ADDR(addr);
 	dwc3_writel(dwc->regs, DWC3_GUSB2PHYACC(0), reg);
 
-	ret = dwc3_ulpi_busyloop(dwc);
+	ret = dwc3_ulpi_busyloop(dwc, addr, true);
 	if (ret)
 		return ret;
 
@@ -62,7 +74,7 @@ static int dwc3_ulpi_write(struct ulpi_ops *ops, u8 addr, u8 val)
 	reg |= DWC3_GUSB2PHYACC_WRITE | val;
 	dwc3_writel(dwc->regs, DWC3_GUSB2PHYACC(0), reg);
 
-	return dwc3_ulpi_busyloop(dwc);
+	return dwc3_ulpi_busyloop(dwc, addr, false);
 }
 
 static struct ulpi_ops dwc3_ulpi_ops = {

From b0e955449155eb7c1ba3c2a02abaf79e10392558 Mon Sep 17 00:00:00 2001
From: Edwin Peer <edwin.peer@broadcom.com>
Date: Fri, 5 Feb 2021 17:37:32 -0800
Subject: [PATCH 1501/2658] net: watchdog: hold device global xmit lock during
 tx disable

commit 3aa6bce9af0e25b735c9c1263739a5639a336ae8 upstream.

Prevent netif_tx_disable() running concurrently with dev_watchdog() by
taking the device global xmit lock. Otherwise, the recommended:

	netif_carrier_off(dev);
	netif_tx_disable(dev);

driver shutdown sequence can happen after the watchdog has already
checked carrier, resulting in possible false alarms. This is because
netif_tx_lock() only sets the frozen bit without maintaining the locks
on the individual queues.

Fixes: c3f26a269c24 ("netdev: Fix lockdep warnings in multiqueue configurations.")
Signed-off-by: Edwin Peer <edwin.peer@broadcom.com>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/netdevice.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 5faf056cfd9b..0555d5a4448e 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3432,6 +3432,7 @@ static inline void netif_tx_disable(struct net_device *dev)
 
 	local_bh_disable();
 	cpu = smp_processor_id();
+	spin_lock(&dev->tx_global_lock);
 	for (i = 0; i < dev->num_tx_queues; i++) {
 		struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
 
@@ -3439,6 +3440,7 @@ static inline void netif_tx_disable(struct net_device *dev)
 		netif_tx_stop_queue(txq);
 		__netif_tx_unlock(txq);
 	}
+	spin_unlock(&dev->tx_global_lock);
 	local_bh_enable();
 }
 

From abd98d851926219672dbab197cc906a8a4573aad Mon Sep 17 00:00:00 2001
From: Stefano Garzarella <sgarzare@redhat.com>
Date: Tue, 9 Feb 2021 09:52:19 +0100
Subject: [PATCH 1502/2658] vsock: fix locking in vsock_shutdown()

commit 1c5fae9c9a092574398a17facc31c533791ef232 upstream.

In vsock_shutdown() we touched some socket fields without holding the
socket lock, such as 'state' and 'sk_flags'.

Also, after the introduction of multi-transport, we are accessing
'vsk->transport' in vsock_send_shutdown() without holding the lock
and this call can be made while the connection is in progress, so
the transport can change in the meantime.

To avoid issues, we hold the socket lock when we enter in
vsock_shutdown() and release it when we leave.

Among the transports that implement the 'shutdown' callback, only
hyperv_transport acquired the lock. Since the caller now holds it,
we no longer take it.

Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/vmw_vsock/af_vsock.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 07b1a2775210..cdd91a60b89a 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -818,10 +818,12 @@ static int vsock_shutdown(struct socket *sock, int mode)
 	 */
 
 	sk = sock->sk;
+
+	lock_sock(sk);
 	if (sock->state == SS_UNCONNECTED) {
 		err = -ENOTCONN;
 		if (sk->sk_type == SOCK_STREAM)
-			return err;
+			goto out;
 	} else {
 		sock->state = SS_DISCONNECTING;
 		err = 0;
@@ -830,10 +832,8 @@ static int vsock_shutdown(struct socket *sock, int mode)
 	/* Receive and send shutdowns are treated alike. */
 	mode = mode & (RCV_SHUTDOWN | SEND_SHUTDOWN);
 	if (mode) {
-		lock_sock(sk);
 		sk->sk_shutdown |= mode;
 		sk->sk_state_change(sk);
-		release_sock(sk);
 
 		if (sk->sk_type == SOCK_STREAM) {
 			sock_reset_flag(sk, SOCK_DONE);
@@ -841,6 +841,8 @@ static int vsock_shutdown(struct socket *sock, int mode)
 		}
 	}
 
+out:
+	release_sock(sk);
 	return err;
 }
 

From 4158fc297de564f7530c76e3951eed06bbee35ef Mon Sep 17 00:00:00 2001
From: Borislav Petkov <bp@suse.de>
Date: Mon, 8 Feb 2021 16:43:30 +0100
Subject: [PATCH 1503/2658] x86/build: Disable CET instrumentation in the
 kernel for 32-bit too

commit 256b92af784d5043eeb7d559b6d5963dcc2ecb10 upstream.

Commit

  20bf2b378729 ("x86/build: Disable CET instrumentation in the kernel")

disabled CET instrumentation which gets added by default by the Ubuntu
gcc9 and 10 by default, but did that only for 64-bit builds. It would
still fail when building a 32-bit target. So disable CET for all x86
builds.

Fixes: 20bf2b378729 ("x86/build: Disable CET instrumentation in the kernel")
Reported-by: AC <achirvasub@gmail.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
Tested-by: AC <achirvasub@gmail.com>
Link: https://lkml.kernel.org/r/YCCIgMHkzh/xT4ex@arch-chirva.localdomain
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/Makefile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index a3c876d23fce..de3a452906c6 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -61,6 +61,9 @@ endif
 KBUILD_CFLAGS += -mno-sse -mno-mmx -mno-sse2 -mno-3dnow
 KBUILD_CFLAGS += $(call cc-option,-mno-avx,)
 
+# Intel CET isn't enabled in the kernel
+KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
+
 ifeq ($(CONFIG_X86_32),y)
         BITS := 32
         UTS_MACHINE := i386
@@ -139,9 +142,6 @@ else
         KBUILD_CFLAGS += -mno-red-zone
         KBUILD_CFLAGS += -mcmodel=kernel
 
-	# Intel CET isn't enabled in the kernel
-	KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
-
         # -funit-at-a-time shrinks the kernel .text considerably
         # unfortunately it makes reading oopses harder.
         KBUILD_CFLAGS += $(call cc-option,-funit-at-a-time)

From a7347b2891556525b0262467b62c60c3962e7f79 Mon Sep 17 00:00:00 2001
From: Andi Kleen <ak@linux.intel.com>
Date: Mon, 27 Nov 2017 13:34:13 -0800
Subject: [PATCH 1504/2658] trace: Use -mcount-record for dynamic ftrace

commit 96f60dfa5819a065bfdd2f2ba0df7d9cbce7f4dd upstream.

gcc 5 supports a new -mcount-record option to generate ftrace
tables directly. This avoids the need to run record_mcount
manually.

Use this option when available.

So far doesn't use -mcount-nop, which also exists now.

This is needed to make ftrace work with LTO because the
normal record-mcount script doesn't run over the link
time output.

It should also improve build times slightly in the general
case.
Link: http://lkml.kernel.org/r/20171127213423.27218-12-andi@firstfloor.org

Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 scripts/Makefile.build | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index e6441514be23..570e321203c5 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -226,6 +226,11 @@ cmd_modversions_c =								\
 endif
 
 ifdef CONFIG_FTRACE_MCOUNT_RECORD
+# gcc 5 supports generating the mcount tables directly
+ifneq ($(call cc-option,-mrecord-mcount,y),y)
+KBUILD_CFLAGS += -mrecord-mcount
+else
+# else do it all manually
 ifdef BUILD_C_RECORDMCOUNT
 ifeq ("$(origin RECORDMCOUNT_WARN)", "command line")
   RECORDMCOUNT_FLAGS = -w
@@ -255,6 +260,7 @@ cmd_record_mcount =						\
 		$(sub_cmd_record_mcount)			\
 	fi;
 endif
+endif
 
 define rule_cc_o_c
 	$(call echo-cmd,checksrc) $(cmd_checksrc)			  \

From d369483b2471eec66109671252c1adfed5d9d2b8 Mon Sep 17 00:00:00 2001
From: Greg Thelen <gthelen@google.com>
Date: Fri, 8 Jun 2018 14:47:46 -0700
Subject: [PATCH 1505/2658] tracing: Fix SKIP_STACK_VALIDATION=1 build due to
 bad merge with -mrecord-mcount

commit ed7d40bc67b8353c677b38c6cdddcdc310c0f452 upstream.

Non gcc-5 builds with CONFIG_STACK_VALIDATION=y and
SKIP_STACK_VALIDATION=1 fail.
Example output:
  /bin/sh: init/.tmp_main.o: Permission denied

commit 96f60dfa5819 ("trace: Use -mcount-record for dynamic ftrace"),
added a mismatched endif.  This causes cmd_objtool to get mistakenly
set.

Relocate endif to balance the newly added -record-mcount check.

Link: http://lkml.kernel.org/r/20180608214746.136554-1-gthelen@google.com

Fixes: 96f60dfa5819 ("trace: Use -mcount-record for dynamic ftrace")
Acked-by: Andi Kleen <ak@linux.intel.com>
Tested-by: David Rientjes <rientjes@google.com>
Signed-off-by: Greg Thelen <gthelen@google.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 scripts/Makefile.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index 570e321203c5..d164669682ad 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -259,7 +259,7 @@ cmd_record_mcount =						\
 	     "$(CC_FLAGS_FTRACE)" ]; then			\
 		$(sub_cmd_record_mcount)			\
 	fi;
-endif
+endif # -record-mcount
 endif
 
 define rule_cc_o_c

From a991c2ace52d8129807d68f8cc333dbb7becb9c2 Mon Sep 17 00:00:00 2001
From: Vasily Gorbik <gor@linux.ibm.com>
Date: Mon, 6 Aug 2018 15:17:44 +0200
Subject: [PATCH 1506/2658] tracing: Avoid calling cc-option -mrecord-mcount
 for every Makefile

commit 07d0408120216b60625c9a5b8012d1c3a907984d upstream.

Currently if CONFIG_FTRACE_MCOUNT_RECORD is enabled -mrecord-mcount
compiler flag support is tested for every Makefile.

Top 4 cc-option usages:
    511 -mrecord-mcount
     11  -fno-stack-protector
      9 -Wno-override-init
      2 -fsched-pressure

To address that move cc-option from scripts/Makefile.build to top Makefile
and export CC_USING_RECORD_MCOUNT to be used in original place.

While doing that also add -mrecord-mcount to CC_FLAGS_FTRACE (if gcc
actually supports it).

Link: http://lkml.kernel.org/r/patch-2.thread-aa7b8d.git-de935bace15a.your-ad-here.call-01533557518-ext-9465@work.hours

Acked-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile               | 7 +++++++
 scripts/Makefile.build | 9 +++------
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/Makefile b/Makefile
index eb9a1a76ea4c..92357d8c2e4a 100644
--- a/Makefile
+++ b/Makefile
@@ -790,6 +790,13 @@ ifdef CONFIG_FUNCTION_TRACER
 ifndef CC_FLAGS_FTRACE
 CC_FLAGS_FTRACE := -pg
 endif
+ifdef CONFIG_FTRACE_MCOUNT_RECORD
+  # gcc 5 supports generating the mcount tables directly
+  ifeq ($(call cc-option-yn,-mrecord-mcount),y)
+    CC_FLAGS_FTRACE	+= -mrecord-mcount
+    export CC_USING_RECORD_MCOUNT := 1
+  endif
+endif
 export CC_FLAGS_FTRACE
 ifdef CONFIG_HAVE_FENTRY
 CC_USING_FENTRY	:= $(call cc-option, -mfentry -DCC_USING_FENTRY)
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index d164669682ad..726d1b3f6759 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -226,11 +226,8 @@ cmd_modversions_c =								\
 endif
 
 ifdef CONFIG_FTRACE_MCOUNT_RECORD
-# gcc 5 supports generating the mcount tables directly
-ifneq ($(call cc-option,-mrecord-mcount,y),y)
-KBUILD_CFLAGS += -mrecord-mcount
-else
-# else do it all manually
+ifndef CC_USING_RECORD_MCOUNT
+# compiler will not generate __mcount_loc use recordmcount or recordmcount.pl
 ifdef BUILD_C_RECORDMCOUNT
 ifeq ("$(origin RECORDMCOUNT_WARN)", "command line")
   RECORDMCOUNT_FLAGS = -w
@@ -259,7 +256,7 @@ cmd_record_mcount =						\
 	     "$(CC_FLAGS_FTRACE)" ]; then			\
 		$(sub_cmd_record_mcount)			\
 	fi;
-endif # -record-mcount
+endif # CC_USING_RECORD_MCOUNT
 endif
 
 define rule_cc_o_c

From cb33f12a957d1990447cb2f3699094bc2e5aa41d Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Mon, 15 Feb 2021 08:49:34 +0100
Subject: [PATCH 1507/2658] Xen/x86: don't bail early from
 clear_foreign_p2m_mapping()

commit a35f2ef3b7376bfd0a57f7844bd7454389aae1fc upstream.

Its sibling (set_foreign_p2m_mapping()) as well as the sibling of its
only caller (gnttab_map_refs()) don't clean up after themselves in case
of error. Higher level callers are expected to do so. However, in order
for that to really clean up any partially set up state, the operation
should not terminate upon encountering an entry in unexpected state. It
is particularly relevant to notice here that set_foreign_p2m_mapping()
would skip setting up a p2m entry if its grant mapping failed, but it
would continue to set up further p2m entries as long as their mappings
succeeded.

Arguably down the road set_foreign_p2m_mapping() may want its page state
related WARN_ON() also converted to an error return.

This is part of XSA-361.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Cc: stable@vger.kernel.org
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/xen/p2m.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index cab9f766bb06..a28552841949 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -763,17 +763,15 @@ int clear_foreign_p2m_mapping(struct gnttab_unmap_grant_ref *unmap_ops,
 		unsigned long mfn = __pfn_to_mfn(page_to_pfn(pages[i]));
 		unsigned long pfn = page_to_pfn(pages[i]);
 
-		if (mfn == INVALID_P2M_ENTRY || !(mfn & FOREIGN_FRAME_BIT)) {
+		if (mfn != INVALID_P2M_ENTRY && (mfn & FOREIGN_FRAME_BIT))
+			set_phys_to_machine(pfn, INVALID_P2M_ENTRY);
+		else
 			ret = -EINVAL;
-			goto out;
-		}
-
-		set_phys_to_machine(pfn, INVALID_P2M_ENTRY);
 	}
 	if (kunmap_ops)
 		ret = HYPERVISOR_grant_table_op(GNTTABOP_unmap_grant_ref,
-						kunmap_ops, count);
-out:
+						kunmap_ops, count) ?: ret;
+
 	return ret;
 }
 EXPORT_SYMBOL_GPL(clear_foreign_p2m_mapping);

From 2d91b130a593325432df809a6703200d22720930 Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Mon, 15 Feb 2021 08:50:08 +0100
Subject: [PATCH 1508/2658] Xen/x86: also check kernel mapping in
 set_foreign_p2m_mapping()

commit b512e1b077e5ccdbd6e225b15d934ab12453b70a upstream.

We should not set up further state if either mapping failed; paying
attention to just the user mapping's status isn't enough.

Also use GNTST_okay instead of implying its value (zero).

This is part of XSA-361.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Cc: stable@vger.kernel.org
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/xen/p2m.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index a28552841949..8c7c5bb94257 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -725,7 +725,8 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
 		unsigned long mfn, pfn;
 
 		/* Do not add to override if the map failed. */
-		if (map_ops[i].status)
+		if (map_ops[i].status != GNTST_okay ||
+		    (kmap_ops && kmap_ops[i].status != GNTST_okay))
 			continue;
 
 		if (map_ops[i].flags & GNTMAP_contains_pte) {

From b62ef436d1f2b61c1285dad150d820c2a6970553 Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Mon, 15 Feb 2021 08:51:07 +0100
Subject: [PATCH 1509/2658] Xen/gntdev: correct dev_bus_addr handling in
 gntdev_map_grant_pages()

commit dbe5283605b3bc12ca45def09cc721a0a5c853a2 upstream.

We may not skip setting the field in the unmap structure when
GNTMAP_device_map is in use - such an unmap would fail to release the
respective resources (a page ref in the hypervisor). Otoh the field
doesn't need setting at all when GNTMAP_device_map is not in use.

To record the value for unmapping, we also better don't use our local
p2m: In particular after a subsequent change it may not have got updated
for all the batch elements. Instead it can simply be taken from the
respective map's results.

We can additionally avoid playing this game altogether for the kernel
part of the mappings in (x86) PV mode.

This is part of XSA-361.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Cc: stable@vger.kernel.org
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/gntdev.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 1865bcfa869b..c6b29506c907 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -293,18 +293,25 @@ static int map_grant_pages(struct grant_map *map)
 		 * to the kernel linear addresses of the struct pages.
 		 * These ptes are completely different from the user ptes dealt
 		 * with find_grant_ptes.
+		 * Note that GNTMAP_device_map isn't needed here: The
+		 * dev_bus_addr output field gets consumed only from ->map_ops,
+		 * and by not requesting it when mapping we also avoid needing
+		 * to mirror dev_bus_addr into ->unmap_ops (and holding an extra
+		 * reference to the page in the hypervisor).
 		 */
+		unsigned int flags = (map->flags & ~GNTMAP_device_map) |
+				     GNTMAP_host_map;
+
 		for (i = 0; i < map->count; i++) {
 			unsigned long address = (unsigned long)
 				pfn_to_kaddr(page_to_pfn(map->pages[i]));
 			BUG_ON(PageHighMem(map->pages[i]));
 
-			gnttab_set_map_op(&map->kmap_ops[i], address,
-				map->flags | GNTMAP_host_map,
+			gnttab_set_map_op(&map->kmap_ops[i], address, flags,
 				map->grants[i].ref,
 				map->grants[i].domid);
 			gnttab_set_unmap_op(&map->kunmap_ops[i], address,
-				map->flags | GNTMAP_host_map, -1);
+				flags, -1);
 		}
 	}
 
@@ -320,6 +327,9 @@ static int map_grant_pages(struct grant_map *map)
 			continue;
 		}
 
+		if (map->flags & GNTMAP_device_map)
+			map->unmap_ops[i].dev_bus_addr = map->map_ops[i].dev_bus_addr;
+
 		map->unmap_ops[i].handle = map->map_ops[i].handle;
 		if (use_ptemod)
 			map->kunmap_ops[i].handle = map->kmap_ops[i].handle;

From 7da71e638671353d6f6367c22f49dbec03198200 Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Mon, 15 Feb 2021 08:52:27 +0100
Subject: [PATCH 1510/2658] Xen/gntdev: correct error checking in
 gntdev_map_grant_pages()

commit ebee0eab08594b2bd5db716288a4f1ae5936e9bc upstream.

Failure of the kernel part of the mapping operation should also be
indicated as an error to the caller, or else it may assume the
respective kernel VA is okay to access.

Furthermore gnttab_map_refs() failing still requires recording
successfully mapped handles, so they can be unmapped subsequently. This
in turn requires there to be a way to tell full hypercall failure from
partial success - preset map_op status fields such that they won't
"happen" to look as if the operation succeeded.

Also again use GNTST_okay instead of implying its value (zero).

This is part of XSA-361.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Cc: stable@vger.kernel.org
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/gntdev.c      | 17 +++++++++--------
 include/xen/grant_table.h |  1 +
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index c6b29506c907..6f077ae0cf31 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -318,21 +318,22 @@ static int map_grant_pages(struct grant_map *map)
 	pr_debug("map %d+%d\n", map->index, map->count);
 	err = gnttab_map_refs(map->map_ops, use_ptemod ? map->kmap_ops : NULL,
 			map->pages, map->count);
-	if (err)
-		return err;
 
 	for (i = 0; i < map->count; i++) {
-		if (map->map_ops[i].status) {
+		if (map->map_ops[i].status == GNTST_okay)
+			map->unmap_ops[i].handle = map->map_ops[i].handle;
+		else if (!err)
 			err = -EINVAL;
-			continue;
-		}
 
 		if (map->flags & GNTMAP_device_map)
 			map->unmap_ops[i].dev_bus_addr = map->map_ops[i].dev_bus_addr;
 
-		map->unmap_ops[i].handle = map->map_ops[i].handle;
-		if (use_ptemod)
-			map->kunmap_ops[i].handle = map->kmap_ops[i].handle;
+		if (use_ptemod) {
+			if (map->kmap_ops[i].status == GNTST_okay)
+				map->kunmap_ops[i].handle = map->kmap_ops[i].handle;
+			else if (!err)
+				err = -EINVAL;
+		}
 	}
 	return err;
 }
diff --git a/include/xen/grant_table.h b/include/xen/grant_table.h
index 34b1379f9777..f9d8aac170fb 100644
--- a/include/xen/grant_table.h
+++ b/include/xen/grant_table.h
@@ -157,6 +157,7 @@ gnttab_set_map_op(struct gnttab_map_grant_ref *map, phys_addr_t addr,
 	map->flags = flags;
 	map->ref = ref;
 	map->dom = domid;
+	map->status = 1; /* arbitrary positive value */
 }
 
 static inline void

From cf7b3e49f05cad44361a2573a64a6770c0c81589 Mon Sep 17 00:00:00 2001
From: Stefano Stabellini <stefano.stabellini@xilinx.com>
Date: Mon, 15 Feb 2021 08:53:44 +0100
Subject: [PATCH 1511/2658] xen/arm: don't ignore return errors from
 set_phys_to_machine

commit 36bf1dfb8b266e089afa9b7b984217f17027bf35 upstream.

set_phys_to_machine can fail due to lack of memory, see the kzalloc call
in arch/arm/xen/p2m.c:__set_phys_to_machine_multi.

Don't ignore the potential return error in set_foreign_p2m_mapping,
returning it to the caller instead.

This is part of XSA-361.

Signed-off-by: Stefano Stabellini <stefano.stabellini@xilinx.com>
Cc: stable@vger.kernel.org
Reviewed-by: Julien Grall <jgrall@amazon.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/xen/p2m.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/arm/xen/p2m.c b/arch/arm/xen/p2m.c
index 0ed01f2d5ee4..02579e6569f0 100644
--- a/arch/arm/xen/p2m.c
+++ b/arch/arm/xen/p2m.c
@@ -93,8 +93,10 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
 	for (i = 0; i < count; i++) {
 		if (map_ops[i].status)
 			continue;
-		set_phys_to_machine(map_ops[i].host_addr >> XEN_PAGE_SHIFT,
-				    map_ops[i].dev_bus_addr >> XEN_PAGE_SHIFT);
+		if (unlikely(!set_phys_to_machine(map_ops[i].host_addr >> XEN_PAGE_SHIFT,
+				    map_ops[i].dev_bus_addr >> XEN_PAGE_SHIFT))) {
+			return -ENOMEM;
+		}
 	}
 
 	return 0;

From 05a4eebac2c25dd3e494c21a3e1a2aa919a633e3 Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Mon, 15 Feb 2021 08:54:51 +0100
Subject: [PATCH 1512/2658] xen-blkback: don't "handle" error by BUG()

commit 5a264285ed1cd32e26d9de4f3c8c6855e467fd63 upstream.

In particular -ENOMEM may come back here, from set_foreign_p2m_mapping().
Don't make problems worse, the more that handling elsewhere (together
with map's status fields now indicating whether a mapping wasn't even
attempted, and hence has to be considered failed) doesn't require this
odd way of dealing with errors.

This is part of XSA-362.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Cc: stable@vger.kernel.org
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/block/xen-blkback/blkback.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index 8dbdd156e0d3..3e84d59724a2 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -842,10 +842,8 @@ static int xen_blkbk_map(struct xen_blkif *blkif,
 			break;
 	}
 
-	if (segs_to_map) {
+	if (segs_to_map)
 		ret = gnttab_map_refs(map, NULL, pages_to_gnt, segs_to_map);
-		BUG_ON(ret);
-	}
 
 	/*
 	 * Now swizzle the MFN in our domain with the MFN from the other domain
@@ -860,7 +858,7 @@ static int xen_blkbk_map(struct xen_blkif *blkif,
 				pr_debug("invalid buffer -- could not remap it\n");
 				put_free_pages(blkif, &pages[seg_idx]->page, 1);
 				pages[seg_idx]->handle = BLKBACK_INVALID_HANDLE;
-				ret |= 1;
+				ret |= !ret;
 				goto next;
 			}
 			pages[seg_idx]->handle = map[new_map_idx].handle;

From b8ca9c427136aaa5ba23bb9afa4f810f24c17422 Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Mon, 15 Feb 2021 08:55:31 +0100
Subject: [PATCH 1513/2658] xen-netback: don't "handle" error by BUG()

commit 3194a1746e8aabe86075fd3c5e7cf1f4632d7f16 upstream.

In particular -ENOMEM may come back here, from set_foreign_p2m_mapping().
Don't make problems worse, the more that handling elsewhere (together
with map's status fields now indicating whether a mapping wasn't even
attempted, and hence has to be considered failed) doesn't require this
odd way of dealing with errors.

This is part of XSA-362.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Cc: stable@vger.kernel.org
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/xen-netback/netback.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index ee7a800c16d5..9a988ea5d797 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1792,13 +1792,11 @@ int xenvif_tx_action(struct xenvif_queue *queue, int budget)
 		return 0;
 
 	gnttab_batch_copy(queue->tx_copy_ops, nr_cops);
-	if (nr_mops != 0) {
+	if (nr_mops != 0)
 		ret = gnttab_map_refs(queue->tx_map_ops,
 				      NULL,
 				      queue->pages_to_map,
 				      nr_mops);
-		BUG_ON(ret);
-	}
 
 	work_done = xenvif_tx_submit(queue);
 

From 2f13c1da829ee5e319b3171e500e83f99086125e Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Mon, 15 Feb 2021 08:55:57 +0100
Subject: [PATCH 1514/2658] xen-scsiback: don't "handle" error by BUG()

commit 7c77474b2d22176d2bfb592ec74e0f2cb71352c9 upstream.

In particular -ENOMEM may come back here, from set_foreign_p2m_mapping().
Don't make problems worse, the more that handling elsewhere (together
with map's status fields now indicating whether a mapping wasn't even
attempted, and hence has to be considered failed) doesn't require this
odd way of dealing with errors.

This is part of XSA-362.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Cc: stable@vger.kernel.org
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/xen-scsiback.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
index 29a1b8054a4d..7fb5a2e7fa81 100644
--- a/drivers/xen/xen-scsiback.c
+++ b/drivers/xen/xen-scsiback.c
@@ -415,12 +415,12 @@ static int scsiback_gnttab_data_map_batch(struct gnttab_map_grant_ref *map,
 		return 0;
 
 	err = gnttab_map_refs(map, NULL, pg, cnt);
-	BUG_ON(err);
 	for (i = 0; i < cnt; i++) {
 		if (unlikely(map[i].status != GNTST_okay)) {
 			pr_err("invalid buffer -- could not remap it\n");
 			map[i].handle = SCSIBACK_INVALID_HANDLE;
-			err = -ENOMEM;
+			if (!err)
+				err = -ENOMEM;
 		} else {
 			get_page(pg[i]);
 		}

From 8126d4a12e54ff2a8aecc3dee47fa1520f919441 Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Mon, 15 Feb 2021 08:56:44 +0100
Subject: [PATCH 1515/2658] xen-blkback: fix error handling in xen_blkbk_map()

commit 871997bc9e423f05c7da7c9178e62dde5df2a7f8 upstream.

The function uses a goto-based loop, which may lead to an earlier error
getting discarded by a later iteration. Exit this ad-hoc loop when an
error was encountered.

The out-of-memory error path additionally fails to fill a structure
field looked at by xen_blkbk_unmap_prepare() before inspecting the
handle which does get properly set (to BLKBACK_INVALID_HANDLE).

Since the earlier exiting from the ad-hoc loop requires the same field
filling (invalidation) as that on the out-of-memory path, fold both
paths. While doing so, drop the pr_alert(), as extra log messages aren't
going to help the situation (the kernel will log oom conditions already
anyway).

This is XSA-365.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Julien Grall <julien@xen.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/block/xen-blkback/blkback.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index 3e84d59724a2..f9dfcd8872af 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -825,8 +825,11 @@ static int xen_blkbk_map(struct xen_blkif *blkif,
 			pages[i]->page = persistent_gnt->page;
 			pages[i]->persistent_gnt = persistent_gnt;
 		} else {
-			if (get_free_page(blkif, &pages[i]->page))
-				goto out_of_memory;
+			if (get_free_page(blkif, &pages[i]->page)) {
+				put_free_pages(blkif, pages_to_gnt, segs_to_map);
+				ret = -ENOMEM;
+				goto out;
+			}
 			addr = vaddr(pages[i]->page);
 			pages_to_gnt[segs_to_map] = pages[i]->page;
 			pages[i]->persistent_gnt = NULL;
@@ -910,15 +913,18 @@ static int xen_blkbk_map(struct xen_blkif *blkif,
 	}
 	segs_to_map = 0;
 	last_map = map_until;
-	if (map_until != num)
+	if (!ret && map_until != num)
 		goto again;
 
-	return ret;
+out:
+	for (i = last_map; i < num; i++) {
+		/* Don't zap current batch's valid persistent grants. */
+		if(i >= last_map + segs_to_map)
+			pages[i]->persistent_gnt = NULL;
+		pages[i]->handle = BLKBACK_INVALID_HANDLE;
+	}
 
-out_of_memory:
-	pr_alert("%s: out of memory\n", __func__);
-	put_free_pages(blkif, pages_to_gnt, segs_to_map);
-	return -ENOMEM;
+	return ret;
 }
 
 static int xen_blkbk_map_seg(struct pending_req *pending_req)

From 46b9d29c1c20765430a642bb820846a883eb9782 Mon Sep 17 00:00:00 2001
From: Arun Easi <aeasi@marvell.com>
Date: Wed, 2 Dec 2020 05:23:04 -0800
Subject: [PATCH 1516/2658] scsi: qla2xxx: Fix crash during driver load on big
 endian machines

commit 8de309e7299a00b3045fb274f82b326f356404f0 upstream

Crash stack:
	[576544.715489] Unable to handle kernel paging request for data at address 0xd00000000f970000
	[576544.715497] Faulting instruction address: 0xd00000000f880f64
	[576544.715503] Oops: Kernel access of bad area, sig: 11 [#1]
	[576544.715506] SMP NR_CPUS=2048 NUMA pSeries
	:
	[576544.715703] NIP [d00000000f880f64] .qla27xx_fwdt_template_valid+0x94/0x100 [qla2xxx]
	[576544.715722] LR [d00000000f7952dc] .qla24xx_load_risc_flash+0x2fc/0x590 [qla2xxx]
	[576544.715726] Call Trace:
	[576544.715731] [c0000004d0ffb000] [c0000006fe02c350] 0xc0000006fe02c350 (unreliable)
	[576544.715750] [c0000004d0ffb080] [d00000000f7952dc] .qla24xx_load_risc_flash+0x2fc/0x590 [qla2xxx]
	[576544.715770] [c0000004d0ffb170] [d00000000f7aa034] .qla81xx_load_risc+0x84/0x1a0 [qla2xxx]
	[576544.715789] [c0000004d0ffb210] [d00000000f79f7c8] .qla2x00_setup_chip+0xc8/0x910 [qla2xxx]
	[576544.715808] [c0000004d0ffb300] [d00000000f7a631c] .qla2x00_initialize_adapter+0x4dc/0xb00 [qla2xxx]
	[576544.715826] [c0000004d0ffb3e0] [d00000000f78ce28] .qla2x00_probe_one+0xf08/0x2200 [qla2xxx]

Link: https://lore.kernel.org/r/20201202132312.19966-8-njavali@marvell.com
Fixes: f73cb695d3ec ("[SCSI] qla2xxx: Add support for ISP2071.")
Cc: stable@vger.kernel.org
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Arun Easi <aeasi@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/qla2xxx/qla_tmpl.c | 9 +++++----
 drivers/scsi/qla2xxx/qla_tmpl.h | 2 +-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c
index c3e622524604..74372aaf209d 100644
--- a/drivers/scsi/qla2xxx/qla_tmpl.c
+++ b/drivers/scsi/qla2xxx/qla_tmpl.c
@@ -871,7 +871,8 @@ qla27xx_template_checksum(void *p, ulong size)
 static inline int
 qla27xx_verify_template_checksum(struct qla27xx_fwdt_template *tmp)
 {
-	return qla27xx_template_checksum(tmp, tmp->template_size) == 0;
+	return qla27xx_template_checksum(tmp,
+		le32_to_cpu(tmp->template_size)) == 0;
 }
 
 static inline int
@@ -887,7 +888,7 @@ qla27xx_execute_fwdt_template(struct scsi_qla_host *vha)
 	ulong len;
 
 	if (qla27xx_fwdt_template_valid(tmp)) {
-		len = tmp->template_size;
+		len = le32_to_cpu(tmp->template_size);
 		tmp = memcpy(vha->hw->fw_dump, tmp, len);
 		ql27xx_edit_template(vha, tmp);
 		qla27xx_walk_template(vha, tmp, tmp, &len);
@@ -903,7 +904,7 @@ qla27xx_fwdt_calculate_dump_size(struct scsi_qla_host *vha)
 	ulong len = 0;
 
 	if (qla27xx_fwdt_template_valid(tmp)) {
-		len = tmp->template_size;
+		len = le32_to_cpu(tmp->template_size);
 		qla27xx_walk_template(vha, tmp, NULL, &len);
 	}
 
@@ -915,7 +916,7 @@ qla27xx_fwdt_template_size(void *p)
 {
 	struct qla27xx_fwdt_template *tmp = p;
 
-	return tmp->template_size;
+	return le32_to_cpu(tmp->template_size);
 }
 
 ulong
diff --git a/drivers/scsi/qla2xxx/qla_tmpl.h b/drivers/scsi/qla2xxx/qla_tmpl.h
index 141c1c5e73f4..2d3e1a8349b3 100644
--- a/drivers/scsi/qla2xxx/qla_tmpl.h
+++ b/drivers/scsi/qla2xxx/qla_tmpl.h
@@ -13,7 +13,7 @@
 struct __packed qla27xx_fwdt_template {
 	uint32_t template_type;
 	uint32_t entry_offset;
-	uint32_t template_size;
+	__le32 template_size;
 	uint32_t reserved_1;
 
 	uint32_t entry_count;

From c79080b19f05a73c87038dfea192e7ab8d9b5b5f Mon Sep 17 00:00:00 2001
From: Lai Jiangshan <laijs@linux.alibaba.com>
Date: Thu, 17 Dec 2020 23:41:18 +0800
Subject: [PATCH 1517/2658] kvm: check tlbs_dirty directly

commit 88bf56d04bc3564542049ec4ec168a8b60d0b48c upstream

In kvm_mmu_notifier_invalidate_range_start(), tlbs_dirty is used as:
        need_tlb_flush |= kvm->tlbs_dirty;
with need_tlb_flush's type being int and tlbs_dirty's type being long.

It means that tlbs_dirty is always used as int and the higher 32 bits
is useless.  We need to check tlbs_dirty in a correct way and this
change checks it directly without propagating it to need_tlb_flush.

Note: it's _extremely_ unlikely this neglecting of higher 32 bits can
cause problems in practice.  It would require encountering tlbs_dirty
on a 4 billion count boundary, and KVM would need to be using shadow
paging or be running a nested guest.

Cc: stable@vger.kernel.org
Fixes: a4ee1ca4a36e ("KVM: MMU: delay flush all tlbs on sync_page path")
Signed-off-by: Lai Jiangshan <laijs@linux.alibaba.com>
Message-Id: <20201217154118.16497-1-jiangshanlai@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 virt/kvm/kvm_main.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 374e698e0ac1..0cc9629e04f9 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -346,9 +346,8 @@ static void kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn,
 	 */
 	kvm->mmu_notifier_count++;
 	need_tlb_flush = kvm_unmap_hva_range(kvm, start, end);
-	need_tlb_flush |= kvm->tlbs_dirty;
 	/* we've to flush the tlb before the pages can be freed */
-	if (need_tlb_flush)
+	if (need_tlb_flush || kvm->tlbs_dirty)
 		kvm_flush_remote_tlbs(kvm);
 
 	spin_unlock(&kvm->mmu_lock);

From 9066fb094c990be28a52fe5063b93553793fb070 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 23 Feb 2021 13:58:14 +0100
Subject: [PATCH 1518/2658] Linux 4.4.258

Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Link: https://lore.kernel.org/r/20210222121013.581198717@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 92357d8c2e4a..d7d273a3bea4 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 257
+SUBLEVEL = 258
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From cb4d79451b9d4d92be04a9f50dfc554d29c9e965 Mon Sep 17 00:00:00 2001
From: Will McVicker <willmcvicker@google.com>
Date: Sat, 5 Dec 2020 00:48:48 +0000
Subject: [PATCH 1519/2658] HID: make arrays usage and value to be the same

commit ed9be64eefe26d7d8b0b5b9fa3ffdf425d87a01f upstream.

The HID subsystem allows an "HID report field" to have a different
number of "values" and "usages" when it is allocated. When a field
struct is created, the size of the usage array is guaranteed to be at
least as large as the values array, but it may be larger. This leads to
a potential out-of-bounds write in
__hidinput_change_resolution_multipliers() and an out-of-bounds read in
hidinput_count_leds().

To fix this, let's make sure that both the usage and value arrays are
the same size.

Cc: stable@vger.kernel.org
Signed-off-by: Will McVicker <willmcvicker@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-core.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index fe03201d6add..c6f234caba4d 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -91,7 +91,7 @@ EXPORT_SYMBOL_GPL(hid_register_report);
  * Register a new field for this report.
  */
 
-static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages, unsigned values)
+static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages)
 {
 	struct hid_field *field;
 
@@ -102,7 +102,7 @@ static struct hid_field *hid_register_field(struct hid_report *report, unsigned
 
 	field = kzalloc((sizeof(struct hid_field) +
 			 usages * sizeof(struct hid_usage) +
-			 values * sizeof(unsigned)), GFP_KERNEL);
+			 usages * sizeof(unsigned)), GFP_KERNEL);
 	if (!field)
 		return NULL;
 
@@ -281,7 +281,7 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
 	usages = max_t(unsigned, parser->local.usage_index,
 				 parser->global.report_count);
 
-	field = hid_register_field(report, usages, parser->global.report_count);
+	field = hid_register_field(report, usages);
 	if (!field)
 		return 0;
 

From 93d83e5c3103d72e6ab7a8f58cbb20c44a911c1c Mon Sep 17 00:00:00 2001
From: Stefan Ursella <stefan.ursella@wolfvision.net>
Date: Wed, 10 Feb 2021 15:07:11 +0100
Subject: [PATCH 1520/2658] usb: quirks: add quirk to start video capture on
 ELMO L-12F document camera reliable

commit 1ebe718bb48278105816ba03a0408ecc2d6cf47f upstream.

Without this quirk starting a video capture from the device often fails with

kernel: uvcvideo: Failed to set UVC probe control : -110 (exp. 34).

Signed-off-by: Stefan Ursella <stefan.ursella@wolfvision.net>
Link: https://lore.kernel.org/r/20210210140713.18711-1-stefan.ursella@wolfvision.net
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/quirks.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 5d109717ac4e..2fc735efc3dc 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -230,6 +230,9 @@ static const struct usb_device_id usb_quirk_list[] = {
 	/* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */
 	{ USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
 
+	/* ELMO L-12F document camera */
+	{ USB_DEVICE(0x09a1, 0x0028), .driver_info = USB_QUIRK_DELAY_CTRL_MSG },
+
 	/* Broadcom BCM92035DGROM BT dongle */
 	{ USB_DEVICE(0x0a5c, 0x2021), .driver_info = USB_QUIRK_RESET_RESUME },
 

From 9e3748364827422ab2acd936a142e03fd614d8fb Mon Sep 17 00:00:00 2001
From: David Vrabel <david.vrabel@citrix.com>
Date: Fri, 15 Jan 2016 14:55:35 +0000
Subject: [PATCH 1521/2658] xen-netback: delete NAPI instance when queue fails
 to initialize

commit 4a658527271bce43afb1cf4feec89afe6716ca59 upstream.

When xenvif_connect() fails it may leave a stale NAPI instance added to
the device.  Make sure we delete it in the error path.

Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: SeongJae Park <sjpark@amazon.com>
Tested-by: Markus Boehme <markubo@amazon.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/xen-netback/interface.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 66260ea74d7d..f9f4391ecee3 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -662,6 +662,7 @@ int xenvif_connect(struct xenvif_queue *queue, unsigned long tx_ring_ref,
 	queue->tx_irq = 0;
 err_unmap:
 	xenvif_unmap_frontend_rings(queue);
+	netif_napi_del(&queue->napi);
 err:
 	return err;
 }

From 775f53365158e6e161fcaac37f9b5dff56380c5c Mon Sep 17 00:00:00 2001
From: Rustam Kovhaev <rkovhaev@gmail.com>
Date: Wed, 24 Feb 2021 12:00:30 -0800
Subject: [PATCH 1522/2658] ntfs: check for valid standard information
 attribute

commit 4dfe6bd94959222e18d512bdf15f6bf9edb9c27c upstream.

Mounting a corrupted filesystem with NTFS resulted in a kernel crash.

We should check for valid STANDARD_INFORMATION attribute offset and length
before trying to access it

Link: https://lkml.kernel.org/r/20210217155930.1506815-1-rkovhaev@gmail.com
Link: https://syzkaller.appspot.com/bug?extid=c584225dabdea2f71969
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Reported-by: syzbot+c584225dabdea2f71969@syzkaller.appspotmail.com
Tested-by: syzbot+c584225dabdea2f71969@syzkaller.appspotmail.com
Acked-by: Anton Altaparmakov <anton@tuxera.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ntfs/inode.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index 38260c07de8b..3af6fa324afa 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -661,6 +661,12 @@ static int ntfs_read_locked_inode(struct inode *vi)
 	}
 	a = ctx->attr;
 	/* Get the standard information attribute value. */
+	if ((u8 *)a + le16_to_cpu(a->data.resident.value_offset)
+			+ le32_to_cpu(a->data.resident.value_length) >
+			(u8 *)ctx->mrec + vol->mft_record_size) {
+		ntfs_error(vi->i_sb, "Corrupt standard information attribute in inode.");
+		goto unm_err_out;
+	}
 	si = (STANDARD_INFORMATION*)((u8*)a +
 			le16_to_cpu(a->data.resident.value_offset));
 

From fadd91246aa872a5d7ac223f1fb17cf9a0822d47 Mon Sep 17 00:00:00 2001
From: Corinna Vinschen <vinschen@redhat.com>
Date: Fri, 23 Jun 2017 14:26:30 +0200
Subject: [PATCH 1523/2658] igb: Remove incorrect "unexpected SYS WRAP" log
 message

commit 2643e6e90210e16c978919617170089b7c2164f7 upstream.

TSAUXC.DisableSystime is never set, so SYSTIM runs into a SYS WRAP
every 1100 secs on 80580/i350/i354 (40 bit SYSTIM) and every 35000
secs on 80576 (45 bit SYSTIM).

This wrap event sets the TSICR.SysWrap bit unconditionally.

However, checking TSIM at interrupt time shows that this event does not
actually cause the interrupt.  Rather, it's just bycatch while the
actual interrupt is caused by, for instance, TSICR.TXTS.

The conclusion is that the SYS WRAP is actually expected, so the
"unexpected SYS WRAP" message is entirely bogus and just helps to
confuse users.  Drop it.

Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
Acked-by: Jacob Keller <jacob.e.keller@intel.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Cc: Punit Agrawal <punit1.agrawal@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/intel/igb/igb_main.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index a4aa4d10ca70..682f52760898 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -5421,8 +5421,6 @@ static void igb_tsync_interrupt(struct igb_adapter *adapter)
 		event.type = PTP_CLOCK_PPS;
 		if (adapter->ptp_caps.pps)
 			ptp_clock_event(adapter->ptp_clock, &event);
-		else
-			dev_err(&adapter->pdev->dev, "unexpected SYS WRAP");
 		ack |= TSINTR_SYS_WRAP;
 	}
 

From 7eb5fa931256b4ea50c2637c8f274d01b630e979 Mon Sep 17 00:00:00 2001
From: Rong Chen <rong.a.chen@intel.com>
Date: Fri, 12 Feb 2021 20:52:41 -0800
Subject: [PATCH 1524/2658] scripts/recordmcount.pl: support big endian for
 ARCH sh

[ Upstream commit 93ca696376dd3d44b9e5eae835ffbc84772023ec ]

The kernel test robot reported the following issue:

    CC [M]  drivers/soc/litex/litex_soc_ctrl.o
  sh4-linux-objcopy: Unable to change endianness of input file(s)
  sh4-linux-ld: cannot find drivers/soc/litex/.tmp_gl_litex_soc_ctrl.o: No such file or directory
  sh4-linux-objcopy: 'drivers/soc/litex/.tmp_mx_litex_soc_ctrl.o': No such file

The problem is that the format of input file is elf32-shbig-linux, but
sh4-linux-objcopy wants to output a file which format is elf32-sh-linux:

  $ sh4-linux-objdump -d drivers/soc/litex/litex_soc_ctrl.o | grep format
  drivers/soc/litex/litex_soc_ctrl.o:     file format elf32-shbig-linux

Link: https://lkml.kernel.org/r/20210210150435.2171567-1-rong.a.chen@intel.com
Link: https://lore.kernel.org/linux-mm/202101261118.GbbYSlHu-lkp@intel.com
Signed-off-by: Rong Chen <rong.a.chen@intel.com>
Reported-by: kernel test robot <lkp@intel.com>
Cc: Yoshinori Sato <ysato@users.osdn.me>
Cc: Rich Felker <dalias@libc.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/recordmcount.pl | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
index 96e2486a6fc4..ccd6614ea218 100755
--- a/scripts/recordmcount.pl
+++ b/scripts/recordmcount.pl
@@ -259,7 +259,11 @@ sub check_objcopy
 
     # force flags for this arch
     $ld .= " -m shlelf_linux";
-    $objcopy .= " -O elf32-sh-linux";
+    if ($endian eq "big") {
+        $objcopy .= " -O elf32-shbig-linux";
+    } else {
+        $objcopy .= " -O elf32-sh-linux";
+    }
 
 } elsif ($arch eq "powerpc") {
     $local_regex = "^[0-9a-fA-F]+\\s+t\\s+(\\.?\\S+)";

From 197c7cef454711c77b6faae010af712703093efb Mon Sep 17 00:00:00 2001
From: Sumit Garg <sumit.garg@linaro.org>
Date: Fri, 22 Jan 2021 16:35:56 +0530
Subject: [PATCH 1525/2658] kdb: Make memory allocations more robust

commit 93f7a6d818deef69d0ba652d46bae6fbabbf365c upstream.

Currently kdb uses in_interrupt() to determine whether its library
code has been called from the kgdb trap handler or from a saner calling
context such as driver init. This approach is broken because
in_interrupt() alone isn't able to determine kgdb trap handler entry from
normal task context. This can happen during normal use of basic features
such as breakpoints and can also be trivially reproduced using:
echo g > /proc/sysrq-trigger

We can improve this by adding check for in_dbg_master() instead which
explicitly determines if we are running in debugger context.

Cc: stable@vger.kernel.org
Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Link: https://lore.kernel.org/r/1611313556-4004-1-git-send-email-sumit.garg@linaro.org
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/debug/kdb/kdb_private.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/debug/kdb/kdb_private.h b/kernel/debug/kdb/kdb_private.h
index 533e04e75a9c..f51b762d6886 100644
--- a/kernel/debug/kdb/kdb_private.h
+++ b/kernel/debug/kdb/kdb_private.h
@@ -234,7 +234,7 @@ extern struct task_struct *kdb_curr_task(int);
 #define	kdb_do_each_thread(g, p) do_each_thread(g, p)
 #define	kdb_while_each_thread(g, p) while_each_thread(g, p)
 
-#define GFP_KDB (in_interrupt() ? GFP_ATOMIC : GFP_KERNEL)
+#define GFP_KDB (in_dbg_master() ? GFP_ATOMIC : GFP_KERNEL)
 
 extern void *debug_kmalloc(size_t size, gfp_t flags);
 extern void debug_kfree(void *);

From d9655b9548720afb512a1176aa53d015c4fcb848 Mon Sep 17 00:00:00 2001
From: Alexander Lobakin <alobakin@pm.me>
Date: Sun, 10 Jan 2021 11:56:08 +0000
Subject: [PATCH 1526/2658] MIPS: vmlinux.lds.S: add missing
 PAGE_ALIGNED_DATA() section

commit 8ac7c87acdcac156670f9920c8acbd84308ff4b1 upstream.

MIPS uses its own declaration of rwdata, and thus it should be kept
in sync with the asm-generic one. Currently PAGE_ALIGNED_DATA() is
missing from the linker script, which emits the following ld
warnings:

mips-alpine-linux-musl-ld: warning: orphan section
`.data..page_aligned' from `arch/mips/kernel/vdso.o' being placed
in section `.data..page_aligned'
mips-alpine-linux-musl-ld: warning: orphan section
`.data..page_aligned' from `arch/mips/vdso/vdso-image.o' being placed
in section `.data..page_aligned'

Add the necessary declaration, so the mentioned structures will be
placed in vmlinux as intended:

ffffffff80630580 D __end_once
ffffffff80630580 D __start___dyndbg
ffffffff80630580 D __start_once
ffffffff80630580 D __stop___dyndbg
ffffffff80634000 d mips_vdso_data
ffffffff80638000 d vdso_data
ffffffff80638580 D _gp
ffffffff8063c000 T __init_begin
ffffffff8063c000 D _edata
ffffffff8063c000 T _sinittext

->

ffffffff805a4000 D __end_init_task
ffffffff805a4000 D __nosave_begin
ffffffff805a4000 D __nosave_end
ffffffff805a4000 d mips_vdso_data
ffffffff805a8000 d vdso_data
ffffffff805ac000 D mmlist_lock
ffffffff805ac080 D tasklist_lock

Fixes: ebb5e78cc634 ("MIPS: Initial implementation of a VDSO")
Signed-off-by: Alexander Lobakin <alobakin@pm.me>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Cc: stable@vger.kernel.org # 4.4+
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/kernel/vmlinux.lds.S | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
index 261b2ce579bb..6ba3b4bca457 100644
--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -91,6 +91,7 @@ SECTIONS
 
 		INIT_TASK_DATA(THREAD_SIZE)
 		NOSAVE_DATA
+		PAGE_ALIGNED_DATA(PAGE_SIZE)
 		CACHELINE_ALIGNED_DATA(1 << CONFIG_MIPS_L1_CACHE_SHIFT)
 		READ_MOSTLY_DATA(1 << CONFIG_MIPS_L1_CACHE_SHIFT)
 		DATA_DATA

From 1fd43b16ee4e8dc0122ca7df2f4c8da3dc846086 Mon Sep 17 00:00:00 2001
From: Christopher William Snowhill <chris@kode54.net>
Date: Sat, 26 Dec 2020 19:12:32 -0800
Subject: [PATCH 1527/2658] Bluetooth: Fix initializing response id after
 clearing struct

[ Upstream commit a5687c644015a097304a2e47476c0ecab2065734 ]

Looks like this was missed when patching the source to clear the structures
throughout, causing this one instance to clear the struct after the response
id is assigned.

Fixes: eddb7732119d ("Bluetooth: A2MP: Fix not initializing all members")
Signed-off-by: Christopher William Snowhill <chris@kode54.net>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/a2mp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index 8f918155685d..242ef2abd091 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -388,9 +388,9 @@ static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb,
 	hdev = hci_dev_get(req->id);
 	if (!hdev || hdev->amp_type == AMP_TYPE_BREDR || tmp) {
 		struct a2mp_amp_assoc_rsp rsp;
-		rsp.id = req->id;
 
 		memset(&rsp, 0, sizeof(rsp));
+		rsp.id = req->id;
 
 		if (tmp) {
 			rsp.status = A2MP_STATUS_COLLISION_OCCURED;

From 545c955f2de16f78f77fb480b2ece0134c30a187 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Thu, 10 Dec 2020 22:28:58 +0100
Subject: [PATCH 1528/2658] ARM: dts: exynos: correct PMIC interrupt trigger
 level on Spring

[ Upstream commit 77e6a5467cb8657cf8b5e610a30a4c502085e4f9 ]

The Samsung PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU.  Without specifying the
interrupt type in Devicetree, kernel might apply some fixed
configuration, not necessarily working for this hardware.

Fixes: 53dd4138bb0a ("ARM: dts: Add exynos5250-spring device tree")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201210212903.216728-4-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos5250-spring.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos5250-spring.dts b/arch/arm/boot/dts/exynos5250-spring.dts
index c1edd6d038a9..4b3bd43f7721 100644
--- a/arch/arm/boot/dts/exynos5250-spring.dts
+++ b/arch/arm/boot/dts/exynos5250-spring.dts
@@ -112,7 +112,7 @@
 		compatible = "samsung,s5m8767-pmic";
 		reg = <0x66>;
 		interrupt-parent = <&gpx3>;
-		interrupts = <2 IRQ_TYPE_NONE>;
+		interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&s5m8767_irq &s5m8767_dvs &s5m8767_ds>;
 		wakeup-source;

From e34fa30612214b06822138f5348c69189602e308 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Thu, 10 Dec 2020 22:28:59 +0100
Subject: [PATCH 1529/2658] ARM: dts: exynos: correct PMIC interrupt trigger
 level on Arndale Octa

[ Upstream commit 1ac8893c4fa3d4a34915dc5cdab568a39db5086c ]

The Samsung PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU.  The falling edge
interrupt will mostly work but it's not correct.

Fixes: 1fed2252713e ("ARM: dts: fix pinctrl for s2mps11-irq on exynos5420-arndale-octa")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20201210212903.216728-5-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos5420-arndale-octa.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos5420-arndale-octa.dts b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
index b54c0b8a5b34..5cf9bcc91c4a 100644
--- a/arch/arm/boot/dts/exynos5420-arndale-octa.dts
+++ b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
@@ -75,7 +75,7 @@
 		s2mps11,buck4-ramp-enable = <1>;
 
 		interrupt-parent = <&gpx3>;
-		interrupts = <2 IRQ_TYPE_EDGE_FALLING>;
+		interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&s2mps11_irq>;
 

From c3883eabd955ec96eb8a21ae874715e67f0e8a7f Mon Sep 17 00:00:00 2001
From: Pan Bian <bianpan2016@163.com>
Date: Wed, 20 Jan 2021 23:34:19 -0800
Subject: [PATCH 1530/2658] Bluetooth: drop HCI device reference before return

[ Upstream commit 5a3ef03afe7e12982dc3b978f4c5077c907f7501 ]

Call hci_dev_put() to decrement reference count of HCI device hdev if
fails to duplicate memory.

Fixes: 0b26ab9dce74 ("Bluetooth: AMP: Handle Accept phylink command status evt")
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/a2mp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index 242ef2abd091..fcd819ffda10 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -519,6 +519,7 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
 		assoc = kmemdup(req->amp_assoc, assoc_len, GFP_KERNEL);
 		if (!assoc) {
 			amp_ctrl_put(ctrl);
+			hci_dev_put(hdev);
 			return -ENOMEM;
 		}
 

From 71f6a5445b5cb587bb9e21f7f37f80539ac2e03a Mon Sep 17 00:00:00 2001
From: Pan Bian <bianpan2016@163.com>
Date: Thu, 21 Jan 2021 00:10:45 -0800
Subject: [PATCH 1531/2658] Bluetooth: Put HCI device if inquiry procedure
 interrupts

[ Upstream commit 28a758c861ff290e39d4f1ee0aa5df0f0b9a45ee ]

Jump to the label done to decrement the reference count of HCI device
hdev on path that the Inquiry procedure is interrupted.

Fixes: 3e13fa1e1fab ("Bluetooth: Fix hci_inquiry ioctl usage")
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_core.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 599b78ecf3e9..462483c98955 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1372,8 +1372,10 @@ int hci_inquiry(void __user *arg)
 		 * cleared). If it is interrupted by a signal, return -EINTR.
 		 */
 		if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
-				TASK_INTERRUPTIBLE))
-			return -EINTR;
+				TASK_INTERRUPTIBLE)) {
+			err = -EINTR;
+			goto done;
+		}
 	}
 
 	/* for unlimited number of responses we will use buffer with

From 73d9bec22bb3717ab0380b67477e4d4e2522f67d Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Wed, 13 Jan 2021 12:20:50 +0100
Subject: [PATCH 1532/2658] usb: dwc2: Abort transaction after errors with
 unknown reason

[ Upstream commit f74b68c61cbc4b2245022fcce038509333d63f6f ]

In some situations, the following error messages are reported.

dwc2 ff540000.usb: dwc2_hc_chhltd_intr_dma: Channel 1 - ChHltd set, but reason is unknown
dwc2 ff540000.usb: hcint 0x00000002, intsts 0x04000021

This is sometimes followed by:

dwc2 ff540000.usb: dwc2_update_urb_state_abn(): trimming xfer length

and then:

WARNING: CPU: 0 PID: 0 at kernel/v4.19/drivers/usb/dwc2/hcd.c:2913
			dwc2_assign_and_init_hc+0x98c/0x990

The warning suggests that an odd buffer address is to be used for DMA.

After an error is observed, the receive buffer may be full
(urb->actual_length >= urb->length). However, the urb is still left in
the queue unless three errors were observed in a row. When it is queued
again, the dwc2 hcd code translates this into a 1-block transfer.
If urb->actual_length (ie the total expected receive length) is not
DMA-aligned, the buffer pointer programmed into the chip will be
unaligned. This results in the observed warning.

To solve the problem, abort input transactions after an error with
unknown cause if the entire packet was already received. This may be
a bit drastic, but we don't really know why the transfer was aborted
even though the entire packet was received. Aborting the transfer in
this situation is less risky than accepting a potentially corrupted
packet.

With this patch in place, the 'ChHltd set' and 'trimming xfer length'
messages are still observed, but there are no more transfer attempts
with odd buffer addresses.

Fixes: 151d0cbdbe860 ("usb: dwc2: make the scheduler handle excessive NAKs better")
Cc: Boris ARZUR <boris@konbu.org>
Cc: Douglas Anderson <dianders@chromium.org>
Tested-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Link: https://lore.kernel.org/r/20210113112052.17063-3-nsaenzjulienne@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc2/hcd_intr.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
index 51866f3f2052..84487548918f 100644
--- a/drivers/usb/dwc2/hcd_intr.c
+++ b/drivers/usb/dwc2/hcd_intr.c
@@ -1915,6 +1915,18 @@ static void dwc2_hc_chhltd_intr_dma(struct dwc2_hsotg *hsotg,
 		qtd->error_count++;
 		dwc2_update_urb_state_abn(hsotg, chan, chnum, qtd->urb,
 					  qtd, DWC2_HC_XFER_XACT_ERR);
+		/*
+		 * We can get here after a completed transaction
+		 * (urb->actual_length >= urb->length) which was not reported
+		 * as completed. If that is the case, and we do not abort
+		 * the transfer, a transfer of size 0 will be enqueued
+		 * subsequently. If urb->actual_length is not DMA-aligned,
+		 * the buffer will then point to an unaligned address, and
+		 * the resulting behavior is undefined. Bail out in that
+		 * situation.
+		 */
+		if (qtd->urb->actual_length >= qtd->urb->length)
+			qtd->error_count = 3;
 		dwc2_hcd_save_data_toggle(hsotg, chan, chnum, qtd);
 		dwc2_halt_channel(hsotg, chan, qtd, DWC2_HC_XFER_XACT_ERR);
 	}

From bf141684d1dfcb37fabaa1a57e6956696ab864d9 Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Wed, 13 Jan 2021 12:20:51 +0100
Subject: [PATCH 1533/2658] usb: dwc2: Make "trimming xfer length" a debug
 message

[ Upstream commit 1a9e38cabd80356ffb98c2c88fec528ea9644fd5 ]

With some USB network adapters, such as DM96xx, the following message
is seen for each maximum size receive packet.

dwc2 ff540000.usb: dwc2_update_urb_state(): trimming xfer length

This happens because the packet size requested by the driver is 1522
bytes, wMaxPacketSize is 64, the dwc2 driver configures the chip to
receive 24*64 = 1536 bytes, and the chip does indeed send more than
1522 bytes of data. Since the event does not indicate an error condition,
the message is just noise. Demote it to debug level.

Fixes: 7359d482eb4d3 ("staging: HCD files for the DWC2 driver")
Tested-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Link: https://lore.kernel.org/r/20210113112052.17063-4-nsaenzjulienne@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc2/hcd_intr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
index 84487548918f..9c030e0033fe 100644
--- a/drivers/usb/dwc2/hcd_intr.c
+++ b/drivers/usb/dwc2/hcd_intr.c
@@ -461,7 +461,7 @@ static int dwc2_update_urb_state(struct dwc2_hsotg *hsotg,
 						      &short_read);
 
 	if (urb->actual_length + xfer_length > urb->length) {
-		dev_warn(hsotg->dev, "%s(): trimming xfer length\n", __func__);
+		dev_dbg(hsotg->dev, "%s(): trimming xfer length\n", __func__);
 		xfer_length = urb->length - urb->actual_length;
 	}
 

From c27d7544ea38e2303dce6f0d121c953ac8c86b05 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Thu, 4 Feb 2021 17:23:42 +0100
Subject: [PATCH 1534/2658] ARM: s3c: fix fiq for clang IAS

[ Upstream commit 7f9942c61fa60eda7cc8e42f04bd25b7d175876e ]

Building with the clang integrated assembler produces a couple of
errors for the s3c24xx fiq support:

  arch/arm/mach-s3c/irq-s3c24xx-fiq.S:52:2: error: instruction 'subne' can not set flags, but 's' suffix specified
    subnes pc, lr, #4 @@ return, still have work to do

  arch/arm/mach-s3c/irq-s3c24xx-fiq.S:64:1: error: invalid symbol redefinition
    s3c24xx_spi_fiq_txrx:

There are apparently two problems: one with extraneous or duplicate
labels, and one with old-style opcode mnemonics. Stefan Agner has
previously fixed other problems like this, but missed this particular
file.

Fixes: bec0806cfec6 ("spi_s3c24xx: add FIQ pseudo-DMA support")
Cc: Stefan Agner <stefan@agner.ch>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Link: https://lore.kernel.org/r/20210204162416.3030114-1-arnd@kernel.org
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-s3c24xx-fiq.S | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/spi/spi-s3c24xx-fiq.S b/drivers/spi/spi-s3c24xx-fiq.S
index 059f2dc1fda2..1565c792da07 100644
--- a/drivers/spi/spi-s3c24xx-fiq.S
+++ b/drivers/spi/spi-s3c24xx-fiq.S
@@ -36,7 +36,6 @@
 	@ and an offset to the irq acknowledgment word
 
 ENTRY(s3c24xx_spi_fiq_rx)
-s3c24xx_spi_fix_rx:
 	.word	fiq_rx_end - fiq_rx_start
 	.word	fiq_rx_irq_ack - fiq_rx_start
 fiq_rx_start:
@@ -50,7 +49,7 @@ fiq_rx_start:
 	strb	fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
 
 	subs	fiq_rcount, fiq_rcount, #1
-	subnes	pc, lr, #4		@@ return, still have work to do
+	subsne	pc, lr, #4		@@ return, still have work to do
 
 	@@ set IRQ controller so that next op will trigger IRQ
 	mov	fiq_rtmp, #0
@@ -62,7 +61,6 @@ fiq_rx_irq_ack:
 fiq_rx_end:
 
 ENTRY(s3c24xx_spi_fiq_txrx)
-s3c24xx_spi_fiq_txrx:
 	.word	fiq_txrx_end - fiq_txrx_start
 	.word	fiq_txrx_irq_ack - fiq_txrx_start
 fiq_txrx_start:
@@ -77,7 +75,7 @@ fiq_txrx_start:
 	strb	fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
 
 	subs	fiq_rcount, fiq_rcount, #1
-	subnes	pc, lr, #4		@@ return, still have work to do
+	subsne	pc, lr, #4		@@ return, still have work to do
 
 	mov	fiq_rtmp, #0
 	str	fiq_rtmp, [ fiq_rirq, # S3C2410_INTMOD  - S3C24XX_VA_IRQ ]
@@ -89,7 +87,6 @@ fiq_txrx_irq_ack:
 fiq_txrx_end:
 
 ENTRY(s3c24xx_spi_fiq_tx)
-s3c24xx_spi_fix_tx:
 	.word	fiq_tx_end - fiq_tx_start
 	.word	fiq_tx_irq_ack - fiq_tx_start
 fiq_tx_start:
@@ -102,7 +99,7 @@ fiq_tx_start:
 	strb	fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
 
 	subs	fiq_rcount, fiq_rcount, #1
-	subnes	pc, lr, #4		@@ return, still have work to do
+	subsne	pc, lr, #4		@@ return, still have work to do
 
 	mov	fiq_rtmp, #0
 	str	fiq_rtmp, [ fiq_rirq, # S3C2410_INTMOD  - S3C24XX_VA_IRQ ]

From dd2019f05fc4bf5cfcac04331b57efe1d0b4beb2 Mon Sep 17 00:00:00 2001
From: Edwin Peer <edwin.peer@broadcom.com>
Date: Thu, 11 Feb 2021 02:24:23 -0500
Subject: [PATCH 1535/2658] bnxt_en: reverse order of TX disable and carrier
 off

[ Upstream commit 132e0b65dc2b8bfa9721bfce834191f24fd1d7ed ]

A TX queue can potentially immediately timeout after it is stopped
and the last TX timestamp on that queue was more than 5 seconds ago with
carrier still up.  Prevent these intermittent false TX timeouts
by bringing down carrier first before calling netif_tx_disable().

Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
Signed-off-by: Edwin Peer <edwin.peer@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 250ecbcca019..7444f17b9e05 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -4313,9 +4313,10 @@ static void bnxt_tx_disable(struct bnxt *bp)
 			txr->dev_state = BNXT_DEV_STATE_CLOSING;
 		}
 	}
+	/* Drop carrier first to prevent TX timeout */
+	netif_carrier_off(bp->dev);
 	/* Stop all TX queues */
 	netif_tx_disable(bp->dev);
-	netif_carrier_off(bp->dev);
 }
 
 static void bnxt_tx_enable(struct bnxt *bp)

From 5de9215018b8d9e153b33c86a465bf1a614e0e7d Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Thu, 11 Feb 2021 11:16:12 +0100
Subject: [PATCH 1536/2658] xen/netback: fix spurious event detection for
 common event case

[ Upstream commit a3daf3d39132b405781be8d9ede0c449b244b64e ]

In case of a common event for rx and tx queue the event should be
regarded to be spurious if no rx and no tx requests are pending.

Unfortunately the condition for testing that is wrong causing to
decide a event being spurious if no rx OR no tx requests are
pending.

Fix that plus using local variables for rx/tx pending indicators in
order to split function calls and if condition.

Fixes: 23025393dbeb3b ("xen/netback: use lateeoi irq binding")
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Paul Durrant <paul@xen.org>
Reviewed-by: Wei Liu <wl@xen.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/xen-netback/interface.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index f9f4391ecee3..93f7659e7595 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -161,13 +161,15 @@ irqreturn_t xenvif_interrupt(int irq, void *dev_id)
 {
 	struct xenvif_queue *queue = dev_id;
 	int old;
+	bool has_rx, has_tx;
 
 	old = xenvif_atomic_fetch_or(NETBK_COMMON_EOI, &queue->eoi_pending);
 	WARN(old, "Interrupt while EOI pending\n");
 
-	/* Use bitwise or as we need to call both functions. */
-	if ((!xenvif_handle_tx_interrupt(queue) |
-	     !xenvif_handle_rx_interrupt(queue))) {
+	has_tx = xenvif_handle_tx_interrupt(queue);
+	has_rx = xenvif_handle_rx_interrupt(queue);
+
+	if (!has_rx && !has_tx) {
 		atomic_andnot(NETBK_COMMON_EOI, &queue->eoi_pending);
 		xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS);
 	}

From 57a103f975688a94859278622bd96325ae3e04b8 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Mon, 15 Feb 2021 12:05:32 +0000
Subject: [PATCH 1537/2658] b43: N-PHY: Fix the update of coef for the PHY
 revision >= 3case

[ Upstream commit 4773acf3d4b50768bf08e9e97a204819e9ea0895 ]

The documentation for the PHY update [1] states:

Loop 4 times with index i

    If PHY Revision >= 3
        Copy table[i] to coef[i]
    Otherwise
        Set coef[i] to 0

the copy of the table to coef is currently implemented the wrong way
around, table is being updated from uninitialized values in coeff.
Fix this by swapping the assignment around.

[1] https://bcm-v4.sipsolutions.net/802.11/PHY/N/RestoreCal/

Fixes: 2f258b74d13c ("b43: N-PHY: implement restoring general configuration")
Addresses-Coverity: ("Uninitialized scalar variable")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/b43/phy_n.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index 9f0bcf3b8414..fa847ae5b527 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -5320,7 +5320,7 @@ static void b43_nphy_restore_cal(struct b43_wldev *dev)
 
 	for (i = 0; i < 4; i++) {
 		if (dev->phy.rev >= 3)
-			table[i] = coef[i];
+			coef[i] = table[i];
 		else
 			coef[i] = 0;
 	}

From fc8676e80e354c7ed94dbfd328cddbfa3a93124c Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Thu, 26 Nov 2020 19:17:52 -0800
Subject: [PATCH 1538/2658] fbdev: aty: SPARC64 requires FB_ATY_CT

[ Upstream commit c6c90c70db4d9a0989111d6b994d545659410f7a ]

It looks like SPARC64 requires FB_ATY_CT to build without errors,
so have FB_ATY select FB_ATY_CT if both SPARC64 and PCI are enabled
instead of using "default y if SPARC64 && PCI", which is not strong
enough to prevent build errors.

As it currently is, FB_ATY_CT can be disabled, resulting in build
errors:

ERROR: modpost: "aty_postdividers" [drivers/video/fbdev/aty/atyfb.ko] undefined!
ERROR: modpost: "aty_ld_pll_ct" [drivers/video/fbdev/aty/atyfb.ko] undefined!

Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Fixes: f7018c213502 ("video: move fbdev to drivers/video/fbdev")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: sparclinux@vger.kernel.org
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: dri-devel@lists.freedesktop.org
Cc: linux-fbdev@vger.kernel.org
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: David Airlie <airlied@linux.ie>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20201127031752.10371-1-rdunlap@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
index 759aaeb6a196..a6c67e189efa 100644
--- a/drivers/video/fbdev/Kconfig
+++ b/drivers/video/fbdev/Kconfig
@@ -1397,6 +1397,7 @@ config FB_ATY
 	select FB_CFB_IMAGEBLIT
 	select FB_BACKLIGHT if FB_ATY_BACKLIGHT
 	select FB_MACMODES if PPC
+	select FB_ATY_CT if SPARC64 && PCI
 	help
 	  This driver supports graphics boards with the ATI Mach64 chips.
 	  Say Y if you have such a graphics board.
@@ -1407,7 +1408,6 @@ config FB_ATY
 config FB_ATY_CT
 	bool "Mach64 CT/VT/GT/LT (incl. 3D RAGE) support"
 	depends on PCI && FB_ATY
-	default y if SPARC64 && PCI
 	help
 	  Say Y here to support use of ATI's 64-bit Rage boards (or other
 	  boards based on the Mach64 CT, VT, GT, and LT chipsets) as a

From 1549bf53fe722b868029586898cdc7eb9cc703e9 Mon Sep 17 00:00:00 2001
From: Jialin Zhang <zhangjialin11@huawei.com>
Date: Mon, 30 Nov 2020 10:02:16 +0800
Subject: [PATCH 1539/2658] drm/gma500: Fix error return code in
 psb_driver_load()

[ Upstream commit 6926872ae24452d4f2176a3ba2dee659497de2c4 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 5c49fd3aa0ab ("gma500: Add the core DRM files and headers")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20201130020216.1906141-1-zhangjialin11@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/gma500/psb_drv.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
index db98ab5cde3d..15a909efe0c7 100644
--- a/drivers/gpu/drm/gma500/psb_drv.c
+++ b/drivers/gpu/drm/gma500/psb_drv.c
@@ -325,6 +325,8 @@ static int psb_driver_load(struct drm_device *dev, unsigned long flags)
 	if (ret)
 		goto out_err;
 
+	ret = -ENOMEM;
+
 	dev_priv->mmu = psb_mmu_driver_init(dev, 1, 0, 0);
 	if (!dev_priv->mmu)
 		goto out_err;

From d12ec655ab6da23a0ba777ab95312d2e69186ebd Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 3 Dec 2020 11:40:48 +0300
Subject: [PATCH 1540/2658] gma500: clean up error handling in init

[ Upstream commit 15ccc39b3aab667c6fa131206f01f31bfbccdf6a ]

The main problem with this error handling was that it didn't clean up if
i2c_add_numbered_adapter() failed.  This code is pretty old, and doesn't
match with today's checkpatch.pl standards so I took the opportunity to
tidy it up a bit.  I changed the NULL comparison, and removed the
WARNING message if kzalloc() fails and updated the label names.

Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/X8ikkAqZfnDO2lu6@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c b/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c
index e28107061148..fc9a34ed58bd 100644
--- a/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c
+++ b/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c
@@ -279,11 +279,8 @@ int oaktrail_hdmi_i2c_init(struct pci_dev *dev)
 	hdmi_dev = pci_get_drvdata(dev);
 
 	i2c_dev = kzalloc(sizeof(struct hdmi_i2c_dev), GFP_KERNEL);
-	if (i2c_dev == NULL) {
-		DRM_ERROR("Can't allocate interface\n");
-		ret = -ENOMEM;
-		goto exit;
-	}
+	if (!i2c_dev)
+		return -ENOMEM;
 
 	i2c_dev->adap = &oaktrail_hdmi_i2c_adapter;
 	i2c_dev->status = I2C_STAT_INIT;
@@ -300,16 +297,23 @@ int oaktrail_hdmi_i2c_init(struct pci_dev *dev)
 			  oaktrail_hdmi_i2c_adapter.name, hdmi_dev);
 	if (ret) {
 		DRM_ERROR("Failed to request IRQ for I2C controller\n");
-		goto err;
+		goto free_dev;
 	}
 
 	/* Adapter registration */
 	ret = i2c_add_numbered_adapter(&oaktrail_hdmi_i2c_adapter);
-	return ret;
+	if (ret) {
+		DRM_ERROR("Failed to add I2C adapter\n");
+		goto free_irq;
+	}
 
-err:
+	return 0;
+
+free_irq:
+	free_irq(dev->irq, hdmi_dev);
+free_dev:
 	kfree(i2c_dev);
-exit:
+
 	return ret;
 }
 

From 44b8067529d82b4a3c6dd4b8ecab9d025c4d2233 Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <natechancellor@gmail.com>
Date: Tue, 5 Jan 2021 13:34:56 -0700
Subject: [PATCH 1541/2658] MIPS: c-r4k: Fix section mismatch for
 loongson2_sc_init

[ Upstream commit c58734eee6a2151ba033c0dcb31902c89e310374 ]

When building with clang, the following section mismatch warning occurs:

WARNING: modpost: vmlinux.o(.text+0x24490): Section mismatch in
reference from the function r4k_cache_init() to the function
.init.text:loongson2_sc_init()

This should have been fixed with commit ad4fddef5f23 ("mips: fix Section
mismatch in reference") but it was missed. Remove the improper __init
annotation like that commit did.

Fixes: 078a55fc824c ("MIPS: Delete __cpuinit/__CPUINIT usage from MIPS code")
Link: https://github.com/ClangBuiltLinux/linux/issues/787
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Huacai Chen <chenhuacai@kernel.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/mm/c-r4k.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index 6c0147bd8e80..90f8d6d51f31 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -1401,7 +1401,7 @@ static int probe_scache(void)
 	return 1;
 }
 
-static void __init loongson2_sc_init(void)
+static void loongson2_sc_init(void)
 {
 	struct cpuinfo_mips *c = &current_cpu_data;
 

From ba726d9e27470e3e278d34e96b17dffb5f7592e7 Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <natechancellor@gmail.com>
Date: Tue, 5 Jan 2021 13:15:48 -0700
Subject: [PATCH 1542/2658] MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT
 against 0

[ Upstream commit c6f2a9e17b9bef7677caddb1626c2402f3e9d2bd ]

When building xway_defconfig with clang:

arch/mips/lantiq/irq.c:305:48: error: use of logical '&&' with constant
operand [-Werror,-Wconstant-logical-operand]
        if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
                                                      ^ ~~~~~~~~~~~~~~~~~
arch/mips/lantiq/irq.c:305:48: note: use '&' for a bitwise operation
        if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
                                                      ^~
                                                      &
arch/mips/lantiq/irq.c:305:48: note: remove constant to silence this
warning
        if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
                                                     ~^~~~~~~~~~~~~~~~~~~~
1 error generated.

Explicitly compare the constant LTQ_EBU_PCC_ISTAT against 0 to fix the
warning. Additionally, remove the unnecessary parentheses as this is a
simple conditional statement and shorthand '== 0' to '!'.

Fixes: 3645da0276ae ("OF: MIPS: lantiq: implement irq_domain support")
Link: https://github.com/ClangBuiltLinux/linux/issues/807
Reported-by: Dmitry Golovin <dima@golovin.in>
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/lantiq/irq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c
index a7057a06c096..5526b89a21a0 100644
--- a/arch/mips/lantiq/irq.c
+++ b/arch/mips/lantiq/irq.c
@@ -245,7 +245,7 @@ static void ltq_hw_irqdispatch(int module)
 	do_IRQ((int)irq + MIPS_CPU_IRQ_CASCADE + (INT_NUM_IM_OFFSET * module));
 
 	/* if this is a EBU irq, we need to ack it or get a deadlock */
-	if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
+	if (irq == LTQ_ICU_EBU_IRQ && !module && LTQ_EBU_PCC_ISTAT != 0)
 		ltq_ebu_w32(ltq_ebu_r32(LTQ_EBU_PCC_ISTAT) | 0x10,
 			LTQ_EBU_PCC_ISTAT);
 }

From 0dccca35c67548cd4dd9082c2f5a3f23d2c2f771 Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Sat, 2 Jan 2021 07:27:22 +0100
Subject: [PATCH 1543/2658] media: media/pci: Fix memleak in empress_init

[ Upstream commit 15d0c52241ecb1c9d802506bff6f5c3f7872c0df ]

When vb2_queue_init() fails, dev->empress_dev
should be released just like other error handling
paths.

Fixes: 2ada815fc48bb ("[media] saa7134: convert to vb2")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/saa7134/saa7134-empress.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/media/pci/saa7134/saa7134-empress.c b/drivers/media/pci/saa7134/saa7134-empress.c
index 56b932c97196..ae3b96e9cff3 100644
--- a/drivers/media/pci/saa7134/saa7134-empress.c
+++ b/drivers/media/pci/saa7134/saa7134-empress.c
@@ -295,8 +295,11 @@ static int empress_init(struct saa7134_dev *dev)
 	q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
 	q->lock = &dev->lock;
 	err = vb2_queue_init(q);
-	if (err)
+	if (err) {
+		video_device_release(dev->empress_dev);
+		dev->empress_dev = NULL;
 		return err;
+	}
 	dev->empress_dev->queue = q;
 
 	video_set_drvdata(dev->empress_dev, dev);

From 8a8c4a6c1b15c304513b1c93700fa51c09f0ff54 Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Sat, 2 Jan 2021 09:26:37 +0100
Subject: [PATCH 1544/2658] media: tm6000: Fix memleak in tm6000_start_stream

[ Upstream commit 76aaf8a96771c16365b8510f1fb97738dc88026e ]

When usb_clear_halt() fails, dvb->bulk_urb->transfer_buffer
and dvb->bulk_urb should be freed just like when
usb_submit_urb() fails.

Fixes: 3169c9b26fffa ("V4L/DVB (12788): tm6000: Add initial DVB-T support")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/tm6000/tm6000-dvb.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/media/usb/tm6000/tm6000-dvb.c b/drivers/media/usb/tm6000/tm6000-dvb.c
index 87401b18d85a..8afc7de1cf83 100644
--- a/drivers/media/usb/tm6000/tm6000-dvb.c
+++ b/drivers/media/usb/tm6000/tm6000-dvb.c
@@ -158,6 +158,10 @@ static int tm6000_start_stream(struct tm6000_core *dev)
 	if (ret < 0) {
 		printk(KERN_ERR "tm6000: error %i in %s during pipe reset\n",
 							ret, __func__);
+
+		kfree(dvb->bulk_urb->transfer_buffer);
+		usb_free_urb(dvb->bulk_urb);
+		dvb->bulk_urb = NULL;
 		return ret;
 	} else
 		printk(KERN_ERR "tm6000: pipe resetted\n");

From 372d0d9c149d99e59e3f68a8bb93c17cf5f31a66 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 11 Dec 2020 13:07:59 +0300
Subject: [PATCH 1545/2658] ASoC: cs42l56: fix up error handling in probe

[ Upstream commit 856fe64da84c95a1d415564b981ae3908eea2a76 ]

There are two issues with this code.  The first error path forgot to set
the error code and instead returns success.  The second error path
doesn't clean up.

Fixes: 272b5edd3b8f ("ASoC: Add support for CS42L56 CODEC")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X9NE/9nK9/TuxuL+@mwanda
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/cs42l56.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/soc/codecs/cs42l56.c b/sound/soc/codecs/cs42l56.c
index 7cd5f769bb61..a22879ddda47 100644
--- a/sound/soc/codecs/cs42l56.c
+++ b/sound/soc/codecs/cs42l56.c
@@ -1269,6 +1269,7 @@ static int cs42l56_i2c_probe(struct i2c_client *i2c_client,
 		dev_err(&i2c_client->dev,
 			"CS42L56 Device ID (%X). Expected %X\n",
 			devid, CS42L56_DEVID);
+		ret = -EINVAL;
 		goto err_enable;
 	}
 	alpha_rev = reg & CS42L56_AREV_MASK;
@@ -1324,7 +1325,7 @@ static int cs42l56_i2c_probe(struct i2c_client *i2c_client,
 	ret =  snd_soc_register_codec(&i2c_client->dev,
 			&soc_codec_dev_cs42l56, &cs42l56_dai, 1);
 	if (ret < 0)
-		return ret;
+		goto err_enable;
 
 	return 0;
 

From 172e04cbb72c69f7bca844230d8d880d615476e5 Mon Sep 17 00:00:00 2001
From: Joe Perches <joe@perches.com>
Date: Sun, 23 Aug 2020 20:13:31 +0200
Subject: [PATCH 1546/2658] media: lmedm04: Fix misuse of comma

[ Upstream commit 59a3e78f8cc33901fe39035c1ab681374bba95ad ]

There's a comma used instead of a semicolon that causes multiple
statements to be executed after an if instead of just the intended
single statement.

Replace the comma with a semicolon.

Fixes: 15e1ce33182d ("[media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, pipe 1 != type 3 in interrupt urb")
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/dvb-usb-v2/lmedm04.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c
index 09c97847bf95..b586a23ab588 100644
--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
+++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
@@ -445,7 +445,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap)
 	ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe);
 
 	if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
-		lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa),
+		lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa);
 
 	lme_int->lme_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
 

From 7f41e8293ccdcdb0ce0c9d98e4a95a02293006c4 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 16 Jan 2021 22:21:46 +0100
Subject: [PATCH 1547/2658] media: cx25821: Fix a bug when reallocating some
 dma memory

[ Upstream commit b2de3643c5024fc4fd128ba7767c7fb8b714bea7 ]

This function looks like a realloc.

However, if 'risc->cpu != NULL', the memory will be freed, but never
reallocated with the bigger 'size'.
Explicitly set 'risc->cpu' to NULL, so that the reallocation is
correctly performed a few lines below.

[hverkuil: NULL != risc->cpu -> risc->cpu]

Fixes: 5ede94c70553 ("[media] cx25821: remove bogus btcx_risc dependency)
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/cx25821/cx25821-core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c
index 54398d8a4696..b43cf85ed5f0 100644
--- a/drivers/media/pci/cx25821/cx25821-core.c
+++ b/drivers/media/pci/cx25821/cx25821-core.c
@@ -990,8 +990,10 @@ int cx25821_riscmem_alloc(struct pci_dev *pci,
 	__le32 *cpu;
 	dma_addr_t dma = 0;
 
-	if (NULL != risc->cpu && risc->size < size)
+	if (risc->cpu && risc->size < size) {
 		pci_free_consistent(pci, risc->size, risc->cpu, risc->dma);
+		risc->cpu = NULL;
+	}
 	if (NULL == risc->cpu) {
 		cpu = pci_zalloc_consistent(pci, size, &dma);
 		if (NULL == cpu)

From 625c08460bb0eaf56375711a6d3f74967eabd083 Mon Sep 17 00:00:00 2001
From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Date: Sun, 20 Dec 2020 15:11:13 +0100
Subject: [PATCH 1548/2658] media: uvcvideo: Accept invalid bFormatIndex and
 bFrameIndex values
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit dc9455ffae02d7b7fb51ba1e007fffcb9dc5d890 ]

The Renkforce RF AC4K 300 Action Cam 4K reports invalid bFormatIndex and
bFrameIndex values when negotiating the video probe and commit controls.
The UVC descriptors report a single supported format and frame size,
with bFormatIndex and bFrameIndex both equal to 2, but the video probe
and commit controls report bFormatIndex and bFrameIndex set to 1.

The device otherwise operates correctly, but the driver rejects the
values and fails the format try operation. Fix it by ignoring the
invalid indices, and assuming that the format and frame requested by the
driver are accepted by the device.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=210767

Fixes: 8a652a17e3c0 ("media: uvcvideo: Ensure all probed info is returned to v4l2")
Reported-by: Till Dörges <doerges@pre-sense.de>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/uvc/uvc_v4l2.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index a0a544628053..154f5bd45940 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -243,7 +243,9 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
 		goto done;
 
 	/* After the probe, update fmt with the values returned from
-	 * negotiation with the device.
+	 * negotiation with the device. Some devices return invalid bFormatIndex
+	 * and bFrameIndex values, in which case we can only assume they have
+	 * accepted the requested format as-is.
 	 */
 	for (i = 0; i < stream->nformats; ++i) {
 		if (probe->bFormatIndex == stream->format[i].index) {
@@ -252,11 +254,10 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
 		}
 	}
 
-	if (i == stream->nformats) {
-		uvc_trace(UVC_TRACE_FORMAT, "Unknown bFormatIndex %u\n",
+	if (i == stream->nformats)
+		uvc_trace(UVC_TRACE_FORMAT,
+			  "Unknown bFormatIndex %u, using default\n",
 			  probe->bFormatIndex);
-		return -EINVAL;
-	}
 
 	for (i = 0; i < format->nframes; ++i) {
 		if (probe->bFrameIndex == format->frame[i].bFrameIndex) {
@@ -265,11 +266,10 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
 		}
 	}
 
-	if (i == format->nframes) {
-		uvc_trace(UVC_TRACE_FORMAT, "Unknown bFrameIndex %u\n",
+	if (i == format->nframes)
+		uvc_trace(UVC_TRACE_FORMAT,
+			  "Unknown bFrameIndex %u, using default\n",
 			  probe->bFrameIndex);
-		return -EINVAL;
-	}
 
 	fmt->fmt.pix.width = frame->wWidth;
 	fmt->fmt.pix.height = frame->wHeight;

From 8ee9602750ece6a809653e0f06d1a4420f67fbbd Mon Sep 17 00:00:00 2001
From: Zhihao Cheng <chengzhihao1@huawei.com>
Date: Fri, 20 Nov 2020 09:08:04 +0800
Subject: [PATCH 1549/2658] btrfs: clarify error returns values in
 __load_free_space_cache

[ Upstream commit 3cc64e7ebfb0d7faaba2438334c43466955a96e8 ]

Return value in __load_free_space_cache is not properly set after
(unlikely) memory allocation failures and 0 is returned instead.
This is not a problem for the caller load_free_space_cache because only
value 1 is considered as 'cache loaded' but for clarity it's better
to set the errors accordingly.

Fixes: a67509c30079 ("Btrfs: add a io_ctl struct and helpers for dealing with the space cache")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/free-space-cache.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 05b1b0f99f0b..55d8020afc58 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -754,8 +754,10 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
 	while (num_entries) {
 		e = kmem_cache_zalloc(btrfs_free_space_cachep,
 				      GFP_NOFS);
-		if (!e)
+		if (!e) {
+			ret = -ENOMEM;
 			goto free_cache;
+		}
 
 		ret = io_ctl_read_entry(&io_ctl, e, &type);
 		if (ret) {
@@ -764,6 +766,7 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
 		}
 
 		if (!e->bytes) {
+			ret = -1;
 			kmem_cache_free(btrfs_free_space_cachep, e);
 			goto free_cache;
 		}
@@ -783,6 +786,7 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
 			num_bitmaps--;
 			e->bitmap = kzalloc(PAGE_CACHE_SIZE, GFP_NOFS);
 			if (!e->bitmap) {
+				ret = -ENOMEM;
 				kmem_cache_free(
 					btrfs_free_space_cachep, e);
 				goto free_cache;

From b4b624eacbf7b6221f43e04691c6bd8da08aa251 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Thu, 11 Feb 2021 13:01:08 +0000
Subject: [PATCH 1550/2658] fs/jfs: fix potential integer overflow on shift of
 a int

[ Upstream commit 4208c398aae4c2290864ba15c3dab7111f32bec1 ]

The left shift of int 32 bit integer constant 1 is evaluated using 32 bit
arithmetic and then assigned to a signed 64 bit integer. In the case where
l2nb is 32 or more this can lead to an overflow.  Avoid this by shifting
the value 1LL instead.

Addresses-Coverity: ("Uninitentional integer overflow")
Fixes: b40c2e665cd5 ("fs/jfs: TRIM support for JFS Filesystem")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/jfs/jfs_dmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 2d514c7affc2..9ff510a489cb 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -1669,7 +1669,7 @@ s64 dbDiscardAG(struct inode *ip, int agno, s64 minlen)
 		} else if (rc == -ENOSPC) {
 			/* search for next smaller log2 block */
 			l2nb = BLKSTOL2(nblocks) - 1;
-			nblocks = 1 << l2nb;
+			nblocks = 1LL << l2nb;
 		} else {
 			/* Trim any already allocated blocks */
 			jfs_error(bmp->db_ipbmap->i_sb, "-EIO\n");

From f37a1775d4896f0076611c9b020b7a47a6259c4b Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Wed, 30 Dec 2020 06:56:04 -0800
Subject: [PATCH 1551/2658] jffs2: fix use after free in jffs2_sum_write_data()

[ Upstream commit 19646447ad3a680d2ab08c097585b7d96a66126b ]

clang static analysis reports this problem

fs/jffs2/summary.c:794:31: warning: Use of memory after it is freed
                c->summary->sum_list_head = temp->u.next;
                                            ^~~~~~~~~~~~

In jffs2_sum_write_data(), in a loop summary data is handles a node at
a time.  When it has written out the node it is removed the summary list,
and the node is deleted.  In the corner case when a
JFFS2_FEATURE_RWCOMPAT_COPY is seen, a call is made to
jffs2_sum_disable_collecting().  jffs2_sum_disable_collecting() deletes
the whole list which conflicts with the loop's deleting the list by parts.

To preserve the old behavior of stopping the write midway, bail out of
the loop after disabling summary collection.

Fixes: 6171586a7ae5 ("[JFFS2] Correct handling of JFFS2_FEATURE_RWCOMPAT_COPY nodes.")
Signed-off-by: Tom Rix <trix@redhat.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/jffs2/summary.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/jffs2/summary.c b/fs/jffs2/summary.c
index bc5385471a6e..c05d6f5f10ec 100644
--- a/fs/jffs2/summary.c
+++ b/fs/jffs2/summary.c
@@ -783,6 +783,8 @@ static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock
 					dbg_summary("Writing unknown RWCOMPAT_COPY node type %x\n",
 						    je16_to_cpu(temp->u.nodetype));
 					jffs2_sum_disable_collecting(c->summary);
+					/* The above call removes the list, nothing more to do */
+					goto bail_rwcompat;
 				} else {
 					BUG();	/* unknown node in summary information */
 				}
@@ -794,6 +796,7 @@ static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock
 
 		c->summary->sum_num--;
 	}
+ bail_rwcompat:
 
 	jffs2_sum_reset_collected(c->summary);
 

From 94a918d2fb7a33a42117771ecc670b9ca9398361 Mon Sep 17 00:00:00 2001
From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Date: Sat, 26 Dec 2020 13:15:54 +0100
Subject: [PATCH 1552/2658] clk: meson: clk-pll: fix initializing the old rate
 (fallback) for a PLL

[ Upstream commit 2f290b7c67adf6459a17a4c978102af35cd62e4a ]

The "rate" parameter in meson_clk_pll_set_rate() contains the new rate.
Retrieve the old rate with clk_hw_get_rate() so we don't inifinitely try
to switch from the new rate to the same rate again.

Fixes: 7a29a869434e8b ("clk: meson: Add support for Meson clock controller")
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20201226121556.975418-2-martin.blumenstingl@googlemail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/meson/clk-pll.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/meson/clk-pll.c b/drivers/clk/meson/clk-pll.c
index 664edf0708ea..50b1138aaad7 100644
--- a/drivers/clk/meson/clk-pll.c
+++ b/drivers/clk/meson/clk-pll.c
@@ -138,7 +138,7 @@ static int meson_clk_pll_set_rate(struct clk_hw *hw, unsigned long rate,
 	if (parent_rate == 0 || rate == 0)
 		return -EINVAL;
 
-	old_rate = rate;
+	old_rate = clk_hw_get_rate(hw);
 
 	rate_set = meson_clk_get_pll_settings(pll, rate);
 	if (!rate_set)

From 1359372c81744124cab9522993ee4db50865a20b Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Wed, 16 Dec 2020 17:12:21 -0800
Subject: [PATCH 1553/2658] HID: core: detect and skip invalid inputs to
 snto32()

[ Upstream commit a0312af1f94d13800e63a7d0a66e563582e39aec ]

Prevent invalid (0, 0) inputs to hid-core's snto32() function.

Maybe it is just the dummy device here that is causing this, but
there are hundreds of calls to snto32(0, 0). Having n (bits count)
of 0 is causing the current UBSAN trap with a shift value of
0xffffffff (-1, or n - 1 in this function).

Either of the value to shift being 0 or the bits count being 0 can be
handled by just returning 0 to the caller, avoiding the following
complex shift + OR operations:

	return value & (1 << (n - 1)) ? value | (~0U << n) : value;

Fixes: dde5845a529f ("[PATCH] Generic HID layer - code split")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: syzbot+1e911ad71dd4ea72e04a@syzkaller.appspotmail.com
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: linux-input@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index c6f234caba4d..4add5a9440a5 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1109,6 +1109,9 @@ EXPORT_SYMBOL_GPL(hid_open_report);
 
 static s32 snto32(__u32 value, unsigned n)
 {
+	if (!value || !n)
+		return 0;
+
 	switch (n) {
 	case 8:  return ((__s8)value);
 	case 16: return ((__s16)value);

From 38debc2b3fd91c675d7ca7cb466c9d5667c0fc43 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 12 Dec 2020 17:05:16 +0100
Subject: [PATCH 1554/2658] dmaengine: fsldma: Fix a resource leak in the
 remove function

[ Upstream commit cbc0ad004c03ad7971726a5db3ec84dba3dcb857 ]

A 'irq_dispose_mapping()' call is missing in the remove function.
Add it.

This is needed to undo the 'irq_of_parse_and_map() call from the probe
function and already part of the error handling path of the probe function.

It was added in the probe function only in commit d3f620b2c4fe ("fsldma:
simplify IRQ probing and handling")

Fixes: 77cd62e8082b ("fsldma: allow Freescale Elo DMA driver to be compiled as a module")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/20201212160516.92515-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/fsldma.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 2209f75fdf05..1a637104cc08 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -1436,6 +1436,7 @@ static int fsldma_of_remove(struct platform_device *op)
 		if (fdev->chan[i])
 			fsl_dma_chan_remove(fdev->chan[i]);
 	}
+	irq_dispose_mapping(fdev->irq);
 
 	iounmap(fdev->regs);
 	kfree(fdev);

From 7fc23c84ca4595c9226ed9ed809ead40d3921f63 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 12 Dec 2020 17:06:14 +0100
Subject: [PATCH 1555/2658] dmaengine: fsldma: Fix a resource leak in an error
 handling path of the probe function

[ Upstream commit b202d4e82531a62a33a6b14d321dd2aad491578e ]

In case of error, the previous 'fsl_dma_chan_probe()' calls must be undone
by some 'fsl_dma_chan_remove()', as already done in the remove function.

It was added in the remove function in commit 77cd62e8082b ("fsldma: allow
Freescale Elo DMA driver to be compiled as a module")

Fixes: d3f620b2c4fe ("fsldma: simplify IRQ probing and handling")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/20201212160614.92576-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/fsldma.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 1a637104cc08..7c4b4c71d3a0 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -1335,6 +1335,7 @@ static int fsldma_of_probe(struct platform_device *op)
 {
 	struct fsldma_device *fdev;
 	struct device_node *child;
+	unsigned int i;
 	int err;
 
 	fdev = kzalloc(sizeof(*fdev), GFP_KERNEL);
@@ -1416,6 +1417,10 @@ static int fsldma_of_probe(struct platform_device *op)
 	return 0;
 
 out_free_fdev:
+	for (i = 0; i < FSL_DMA_MAX_CHANS_PER_DEVICE; i++) {
+		if (fdev->chan[i])
+			fsl_dma_chan_remove(fdev->chan[i]);
+	}
 	irq_dispose_mapping(fdev->irq);
 	kfree(fdev);
 out_return:

From f553e644bf727608ded4b51c6fc448ac2e7d7ca1 Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Mon, 18 Jan 2021 13:19:55 -0800
Subject: [PATCH 1556/2658] clocksource/drivers/mxs_timer: Add missing
 semicolon when DEBUG is defined
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 7da390694afbaed8e0f05717a541dfaf1077ba51 ]

When DEBUG is defined this error occurs

drivers/clocksource/mxs_timer.c:138:1: error:
  expected ‘;’ before ‘}’ token

The preceding statement needs a semicolon.
Replace pr_info() with pr_debug() and remove the unneeded ifdef.

Fixes: eb8703e2ef7c ("clockevents/drivers/mxs: Migrate to new 'set-state' interface")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20210118211955.763609-1-trix@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/mxs_timer.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/clocksource/mxs_timer.c b/drivers/clocksource/mxs_timer.c
index f5ce2961c0d6..23f125126fa8 100644
--- a/drivers/clocksource/mxs_timer.c
+++ b/drivers/clocksource/mxs_timer.c
@@ -154,10 +154,7 @@ static void mxs_irq_clear(char *state)
 
 	/* Clear pending interrupt */
 	timrot_irq_acknowledge();
-
-#ifdef DEBUG
-	pr_info("%s: changing mode to %s\n", __func__, state)
-#endif /* DEBUG */
+	pr_debug("%s: changing mode to %s\n", __func__, state);
 }
 
 static int mxs_shutdown(struct clock_event_device *evt)

From 690b4111d50f1e486659d58ab4b09b5a496e43b9 Mon Sep 17 00:00:00 2001
From: Pan Bian <bianpan2016@163.com>
Date: Wed, 20 Jan 2021 04:33:13 -0800
Subject: [PATCH 1557/2658] regulator: axp20x: Fix reference cout leak

[ Upstream commit e78bf6be7edaacb39778f3a89416caddfc6c6d70 ]

Decrements the reference count of device node and its child node.

Fixes: dfe7a1b058bb ("regulator: AXP20x: Add support for regulators subsystem")
Signed-off-by: Pan Bian <bianpan2016@163.com>
Link: https://lore.kernel.org/r/20210120123313.107640-1-bianpan2016@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/axp20x-regulator.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c
index 5cf4a97e0304..df235ac1a6b2 100644
--- a/drivers/regulator/axp20x-regulator.c
+++ b/drivers/regulator/axp20x-regulator.c
@@ -279,7 +279,7 @@ static int axp20x_set_dcdc_freq(struct platform_device *pdev, u32 dcdcfreq)
 static int axp20x_regulator_parse_dt(struct platform_device *pdev)
 {
 	struct device_node *np, *regulators;
-	int ret;
+	int ret = 0;
 	u32 dcdcfreq = 0;
 
 	np = of_node_get(pdev->dev.parent->of_node);
@@ -294,13 +294,12 @@ static int axp20x_regulator_parse_dt(struct platform_device *pdev)
 		ret = axp20x_set_dcdc_freq(pdev, dcdcfreq);
 		if (ret < 0) {
 			dev_err(&pdev->dev, "Error setting dcdc frequency: %d\n", ret);
-			return ret;
 		}
-
 		of_node_put(regulators);
 	}
 
-	return 0;
+	of_node_put(np);
+	return ret;
 }
 
 static int axp20x_set_dcdc_workmode(struct regulator_dev *rdev, int id, u32 workmode)

From 877d0f2f5e636f84963e0c54831d20a33ea16401 Mon Sep 17 00:00:00 2001
From: Pan Bian <bianpan2016@163.com>
Date: Mon, 18 Jan 2021 04:04:55 -0800
Subject: [PATCH 1558/2658] isofs: release buffer head before return

[ Upstream commit 0a6dc67a6aa45f19bd4ff89b4f468fc50c4b8daa ]

Release the buffer_head before returning error code in
do_isofs_readdir() and isofs_find_entry().

Fixes: 2deb1acc653c ("isofs: fix access to unallocated memory when reading corrupted filesystem")
Link: https://lore.kernel.org/r/20210118120455.118955-1-bianpan2016@163.com
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/isofs/dir.c   | 1 +
 fs/isofs/namei.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/fs/isofs/dir.c b/fs/isofs/dir.c
index b943cbd963bb..2e7d74c7beed 100644
--- a/fs/isofs/dir.c
+++ b/fs/isofs/dir.c
@@ -151,6 +151,7 @@ static int do_isofs_readdir(struct inode *inode, struct file *file,
 			printk(KERN_NOTICE "iso9660: Corrupted directory entry"
 			       " in block %lu of inode %lu\n", block,
 			       inode->i_ino);
+			brelse(bh);
 			return -EIO;
 		}
 
diff --git a/fs/isofs/namei.c b/fs/isofs/namei.c
index 7b543e6b6526..696f255d1532 100644
--- a/fs/isofs/namei.c
+++ b/fs/isofs/namei.c
@@ -101,6 +101,7 @@ isofs_find_entry(struct inode *dir, struct dentry *dentry,
 			printk(KERN_NOTICE "iso9660: Corrupted directory entry"
 			       " in block %lu of inode %lu\n", block,
 			       dir->i_ino);
+			brelse(bh);
 			return 0;
 		}
 

From ef24d44129350f5a3792d095fabb44264b2c4305 Mon Sep 17 00:00:00 2001
From: Shay Drory <shayd@nvidia.com>
Date: Mon, 25 Jan 2021 14:13:38 +0200
Subject: [PATCH 1559/2658] IB/umad: Return EIO in case of when device
 disassociated

[ Upstream commit 4fc5461823c9cad547a9bdfbf17d13f0da0d6bb5 ]

MAD message received by the user has EINVAL error in all flows
including when the device is disassociated. That makes it impossible
for the applications to treat such flow differently.

Change it to return EIO, so the applications will be able to perform
disassociation recovery.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Link: https://lore.kernel.org/r/20210125121339.837518-2-leon@kernel.org
Signed-off-by: Shay Drory <shayd@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/user_mad.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index e9e75f40714c..27bc51409f55 100644
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -342,6 +342,11 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf,
 
 	mutex_lock(&file->mutex);
 
+	if (file->agents_dead) {
+		mutex_unlock(&file->mutex);
+		return -EIO;
+	}
+
 	while (list_empty(&file->recv_list)) {
 		mutex_unlock(&file->mutex);
 
@@ -484,7 +489,7 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
 
 	agent = __get_agent(file, packet->mad.hdr.id);
 	if (!agent) {
-		ret = -EINVAL;
+		ret = -EIO;
 		goto err_up;
 	}
 

From 53e54952215511597320e2a922bfb68ba195a6b4 Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@csgroup.eu>
Date: Wed, 20 Jan 2021 07:49:13 +0000
Subject: [PATCH 1560/2658] powerpc/47x: Disable 256k page size

[ Upstream commit 910a0cb6d259736a0c86e795d4c2f42af8d0d775 ]

PPC47x_TLBE_SIZE isn't defined for 256k pages, leading to a build
break if 256k pages is selected.

So change the kconfig so that 256k pages can't be selected for 47x.

Fixes: e7f75ad01d59 ("powerpc/47x: Base ppc476 support")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
[mpe: Expand change log to mention build break]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/2fed79b1154c872194f98bac4422c23918325e61.1611128938.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index cb59c1d62280..2e9d6ecd765b 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -578,7 +578,7 @@ config PPC_64K_PAGES
 
 config PPC_256K_PAGES
 	bool "256k page size"
-	depends on 44x && !STDBINUTILS
+	depends on 44x && !STDBINUTILS && !PPC_47x
 	help
 	  Make the page size 256k.
 

From 6c8f5e708b87eaa97b202485c181c6050b34d6cf Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Thu, 17 Dec 2020 22:09:22 +0100
Subject: [PATCH 1561/2658] mmc: usdhi6rol0: Fix a resource leak in the error
 handling path of the probe

[ Upstream commit 6052b3c370fb82dec28bcfff6d7ec0da84ac087a ]

A call to 'ausdhi6_dma_release()' to undo a previous call to
'usdhi6_dma_request()' is missing in the error handling path of the probe
function.

It is already present in the remove function.

Fixes: 75fa9ea6e3c0 ("mmc: add a driver for the Renesas usdhi6rol0 SD/SDIO host controller")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/20201217210922.165340-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/usdhi6rol0.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/host/usdhi6rol0.c b/drivers/mmc/host/usdhi6rol0.c
index b47122d3e8d8..2b6a9c6a6e96 100644
--- a/drivers/mmc/host/usdhi6rol0.c
+++ b/drivers/mmc/host/usdhi6rol0.c
@@ -1808,10 +1808,12 @@ static int usdhi6_probe(struct platform_device *pdev)
 
 	ret = mmc_add_host(mmc);
 	if (ret < 0)
-		goto e_clk_off;
+		goto e_release_dma;
 
 	return 0;
 
+e_release_dma:
+	usdhi6_dma_release(host);
 e_clk_off:
 	clk_disable_unprepare(host->clk);
 e_free_mmc:

From 8a54a68cf52ca56deefabf5c67971035c252b043 Mon Sep 17 00:00:00 2001
From: Vladimir Murzin <vladimir.murzin@arm.com>
Date: Thu, 7 Jan 2021 10:47:24 +0100
Subject: [PATCH 1562/2658] ARM: 9046/1: decompressor: Do not clear
 SCTLR.nTLSMD for ARMv7+ cores

[ Upstream commit 2acb909750431030b65a0a2a17fd8afcbd813a84 ]

It was observed that decompressor running on hardware implementing ARM v8.2
Load/Store Multiple Atomicity and Ordering Control (LSMAOC), say, as guest,
would stuck just after:

Uncompressing Linux... done, booting the kernel.

The reason is that it clears nTLSMD bit when disabling caches:

  nTLSMD, bit [3]

  When ARMv8.2-LSMAOC is implemented:

    No Trap Load Multiple and Store Multiple to
    Device-nGRE/Device-nGnRE/Device-nGnRnE memory.

    0b0 All memory accesses by A32 and T32 Load Multiple and Store
        Multiple at EL1 or EL0 that are marked at stage 1 as
        Device-nGRE/Device-nGnRE/Device-nGnRnE memory are trapped and
        generate a stage 1 Alignment fault.

    0b1 All memory accesses by A32 and T32 Load Multiple and Store
        Multiple at EL1 or EL0 that are marked at stage 1 as
        Device-nGRE/Device-nGnRE/Device-nGnRnE memory are not trapped.

  This bit is permitted to be cached in a TLB.

  This field resets to 1.

  Otherwise:

  Reserved, RES1

So as effect we start getting traps we are not quite ready for.

Looking into history it seems that mask used for SCTLR clear came from
the similar code for ARMv4, where bit[3] is the enable/disable bit for
the write buffer. That not applicable to ARMv7 and onwards, so retire
that bit from the masks.

Fixes: 7d09e85448dfa78e3e58186c934449aaf6d49b50 ("[ARM] 4393/2: ARMv7: Add uncompressing code for the new CPU Id format")
Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/compressed/head.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index d2e43b053d9b..2edb386d3f4b 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -1076,9 +1076,9 @@ __armv4_mmu_cache_off:
 __armv7_mmu_cache_off:
 		mrc	p15, 0, r0, c1, c0
 #ifdef CONFIG_MMU
-		bic	r0, r0, #0x000d
+		bic	r0, r0, #0x0005
 #else
-		bic	r0, r0, #0x000c
+		bic	r0, r0, #0x0004
 #endif
 		mcr	p15, 0, r0, c1, c0	@ turn MMU and cache off
 		mov	r12, lr

From 892d06d019abe01e04d8473acec6bfb030007880 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
Date: Tue, 26 Jan 2021 17:58:31 +0100
Subject: [PATCH 1563/2658] amba: Fix resource leak for drivers without .remove
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit de5d7adb89367bbc87b4e5ce7afe7ae9bd86dc12 ]

Consider an amba driver with a .probe but without a .remove callback (e.g.
pl061_gpio_driver). The function amba_probe() is called to bind a device
and so dev_pm_domain_attach() and others are called. As there is no remove
callback amba_remove() isn't called at unbind time however and so calling
dev_pm_domain_detach() is missed and the pm domain keeps active.

To fix this always use the core driver callbacks and handle missing amba
callbacks there. For probe refuse registration as a driver without probe
doesn't make sense.

Fixes: 7cfe249475fd ("ARM: AMBA: Add pclk support to AMBA bus infrastructure")
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20210126165835.687514-2-u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/amba/bus.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
index 1accc01fb0ca..91c99cce22a4 100644
--- a/drivers/amba/bus.c
+++ b/drivers/amba/bus.c
@@ -275,10 +275,11 @@ static int amba_remove(struct device *dev)
 {
 	struct amba_device *pcdev = to_amba_device(dev);
 	struct amba_driver *drv = to_amba_driver(dev->driver);
-	int ret;
+	int ret = 0;
 
 	pm_runtime_get_sync(dev);
-	ret = drv->remove(pcdev);
+	if (drv->remove)
+		ret = drv->remove(pcdev);
 	pm_runtime_put_noidle(dev);
 
 	/* Undo the runtime PM settings in amba_probe() */
@@ -295,7 +296,9 @@ static int amba_remove(struct device *dev)
 static void amba_shutdown(struct device *dev)
 {
 	struct amba_driver *drv = to_amba_driver(dev->driver);
-	drv->shutdown(to_amba_device(dev));
+
+	if (drv->shutdown)
+		drv->shutdown(to_amba_device(dev));
 }
 
 /**
@@ -308,12 +311,13 @@ static void amba_shutdown(struct device *dev)
  */
 int amba_driver_register(struct amba_driver *drv)
 {
-	drv->drv.bus = &amba_bustype;
+	if (!drv->probe)
+		return -EINVAL;
 
-#define SETFN(fn)	if (drv->fn) drv->drv.fn = amba_##fn
-	SETFN(probe);
-	SETFN(remove);
-	SETFN(shutdown);
+	drv->drv.bus = &amba_bustype;
+	drv->drv.probe = amba_probe;
+	drv->drv.remove = amba_remove;
+	drv->drv.shutdown = amba_shutdown;
 
 	return driver_register(&drv->drv);
 }

From 866210b4755e6afeaaa7fb22d0fc83a6275d2910 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Wed, 18 Nov 2020 09:34:05 -0500
Subject: [PATCH 1564/2658] tracepoint: Do not fail unregistering a probe due
 to memory failure

[ Upstream commit befe6d946551d65cddbd32b9cb0170b0249fd5ed ]

The list of tracepoint callbacks is managed by an array that is protected
by RCU. To update this array, a new array is allocated, the updates are
copied over to the new array, and then the list of functions for the
tracepoint is switched over to the new array. After a completion of an RCU
grace period, the old array is freed.

This process happens for both adding a callback as well as removing one.
But on removing a callback, if the new array fails to be allocated, the
callback is not removed, and may be used after it is freed by the clients
of the tracepoint.

There's really no reason to fail if the allocation for a new array fails
when removing a function. Instead, the function can simply be replaced by a
stub function that could be cleaned up on the next modification of the
array. That is, instead of calling the function registered to the
tracepoint, it would call a stub function in its place.

Link: https://lore.kernel.org/r/20201115055256.65625-1-mmullins@mmlx.us
Link: https://lore.kernel.org/r/20201116175107.02db396d@gandalf.local.home
Link: https://lore.kernel.org/r/20201117211836.54acaef2@oasis.local.home
Link: https://lkml.kernel.org/r/20201118093405.7a6d2290@gandalf.local.home

[ Note, this version does use undefined compiler behavior (assuming that
  a stub function with no parameters or return, can be called by a location
  that thinks it has parameters but still no return value. Static calls
  do the same thing, so this trick is not without precedent.

  There's another solution that uses RCU tricks and is more complex, but
  can be an alternative if this solution becomes an issue.

  Link: https://lore.kernel.org/lkml/20210127170721.58bce7cc@gandalf.local.home/
]

Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Martin KaFai Lau <kafai@fb.com>
Cc: Song Liu <songliubraving@fb.com>
Cc: Yonghong Song <yhs@fb.com>
Cc: Andrii Nakryiko <andriin@fb.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: KP Singh <kpsingh@chromium.org>
Cc: netdev <netdev@vger.kernel.org>
Cc: bpf <bpf@vger.kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Florian Weimer <fw@deneb.enyo.de>
Fixes: 97e1c18e8d17b ("tracing: Kernel Tracepoints")
Reported-by: syzbot+83aa762ef23b6f0d1991@syzkaller.appspotmail.com
Reported-by: syzbot+d29e58bb557324e55e5e@syzkaller.appspotmail.com
Reported-by: Matt Mullins <mmullins@mmlx.us>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Tested-by: Matt Mullins <mmullins@mmlx.us>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/tracepoint.c | 80 ++++++++++++++++++++++++++++++++++++---------
 1 file changed, 64 insertions(+), 16 deletions(-)

diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index eda85bbf1c2e..a1f9be703002 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -59,6 +59,12 @@ struct tp_probes {
 	struct tracepoint_func probes[0];
 };
 
+/* Called in removal of a func but failed to allocate a new tp_funcs */
+static void tp_stub_func(void)
+{
+	return;
+}
+
 static inline void *allocate_probes(int count)
 {
 	struct tp_probes *p  = kmalloc(count * sizeof(struct tracepoint_func)
@@ -97,6 +103,7 @@ func_add(struct tracepoint_func **funcs, struct tracepoint_func *tp_func,
 {
 	struct tracepoint_func *old, *new;
 	int nr_probes = 0;
+	int stub_funcs = 0;
 	int pos = -1;
 
 	if (WARN_ON(!tp_func->func))
@@ -113,14 +120,34 @@ func_add(struct tracepoint_func **funcs, struct tracepoint_func *tp_func,
 			if (old[nr_probes].func == tp_func->func &&
 			    old[nr_probes].data == tp_func->data)
 				return ERR_PTR(-EEXIST);
+			if (old[nr_probes].func == tp_stub_func)
+				stub_funcs++;
 		}
 	}
-	/* + 2 : one for new probe, one for NULL func */
-	new = allocate_probes(nr_probes + 2);
+	/* + 2 : one for new probe, one for NULL func - stub functions */
+	new = allocate_probes(nr_probes + 2 - stub_funcs);
 	if (new == NULL)
 		return ERR_PTR(-ENOMEM);
 	if (old) {
-		if (pos < 0) {
+		if (stub_funcs) {
+			/* Need to copy one at a time to remove stubs */
+			int probes = 0;
+
+			pos = -1;
+			for (nr_probes = 0; old[nr_probes].func; nr_probes++) {
+				if (old[nr_probes].func == tp_stub_func)
+					continue;
+				if (pos < 0 && old[nr_probes].prio < prio)
+					pos = probes++;
+				new[probes++] = old[nr_probes];
+			}
+			nr_probes = probes;
+			if (pos < 0)
+				pos = probes;
+			else
+				nr_probes--; /* Account for insertion */
+
+		} else if (pos < 0) {
 			pos = nr_probes;
 			memcpy(new, old, nr_probes * sizeof(struct tracepoint_func));
 		} else {
@@ -154,8 +181,9 @@ static void *func_remove(struct tracepoint_func **funcs,
 	/* (N -> M), (N > 1, M >= 0) probes */
 	if (tp_func->func) {
 		for (nr_probes = 0; old[nr_probes].func; nr_probes++) {
-			if (old[nr_probes].func == tp_func->func &&
-			     old[nr_probes].data == tp_func->data)
+			if ((old[nr_probes].func == tp_func->func &&
+			     old[nr_probes].data == tp_func->data) ||
+			    old[nr_probes].func == tp_stub_func)
 				nr_del++;
 		}
 	}
@@ -174,14 +202,32 @@ static void *func_remove(struct tracepoint_func **funcs,
 		/* N -> M, (N > 1, M > 0) */
 		/* + 1 for NULL */
 		new = allocate_probes(nr_probes - nr_del + 1);
-		if (new == NULL)
-			return ERR_PTR(-ENOMEM);
-		for (i = 0; old[i].func; i++)
-			if (old[i].func != tp_func->func
-					|| old[i].data != tp_func->data)
-				new[j++] = old[i];
-		new[nr_probes - nr_del].func = NULL;
-		*funcs = new;
+		if (new) {
+			for (i = 0; old[i].func; i++)
+				if ((old[i].func != tp_func->func
+				     || old[i].data != tp_func->data)
+				    && old[i].func != tp_stub_func)
+					new[j++] = old[i];
+			new[nr_probes - nr_del].func = NULL;
+			*funcs = new;
+		} else {
+			/*
+			 * Failed to allocate, replace the old function
+			 * with calls to tp_stub_func.
+			 */
+			for (i = 0; old[i].func; i++)
+				if (old[i].func == tp_func->func &&
+				    old[i].data == tp_func->data) {
+					old[i].func = tp_stub_func;
+					/* Set the prio to the next event. */
+					if (old[i + 1].func)
+						old[i].prio =
+							old[i + 1].prio;
+					else
+						old[i].prio = -1;
+				}
+			*funcs = old;
+		}
 	}
 	debug_print_probes(*funcs);
 	return old;
@@ -234,10 +280,12 @@ static int tracepoint_remove_func(struct tracepoint *tp,
 	tp_funcs = rcu_dereference_protected(tp->funcs,
 			lockdep_is_held(&tracepoints_mutex));
 	old = func_remove(&tp_funcs, func);
-	if (IS_ERR(old)) {
-		WARN_ON_ONCE(PTR_ERR(old) != -ENOMEM);
+	if (WARN_ON_ONCE(IS_ERR(old)))
 		return PTR_ERR(old);
-	}
+
+	if (tp_funcs == old)
+		/* Failed allocating new tp_funcs, replaced func with stub */
+		return 0;
 
 	if (!tp_funcs) {
 		/* Removed last function */

From b50cf9165a6cc384a89070ab4b88ca48780f5be2 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 29 Jan 2021 17:37:24 +0300
Subject: [PATCH 1565/2658] mfd: wm831x-auxadc: Prevent use after free in
 wm831x_auxadc_read_irq()

[ Upstream commit 26783d74cc6a440ee3ef9836a008a697981013d0 ]

The "req" struct is always added to the "wm831x->auxadc_pending" list,
but it's only removed from the list on the success path.  If a failure
occurs then the "req" struct is freed but it's still on the list,
leading to a use after free.

Fixes: 78bb3688ea18 ("mfd: Support multiple active WM831x AUXADC conversions")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/wm831x-auxadc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/mfd/wm831x-auxadc.c b/drivers/mfd/wm831x-auxadc.c
index fd789d2eb0f5..9f7ae1e1ebcd 100644
--- a/drivers/mfd/wm831x-auxadc.c
+++ b/drivers/mfd/wm831x-auxadc.c
@@ -98,11 +98,10 @@ static int wm831x_auxadc_read_irq(struct wm831x *wm831x,
 	wait_for_completion_timeout(&req->done, msecs_to_jiffies(500));
 
 	mutex_lock(&wm831x->auxadc_lock);
-
-	list_del(&req->list);
 	ret = req->val;
 
 out:
+	list_del(&req->list);
 	mutex_unlock(&wm831x->auxadc_lock);
 
 	kfree(req);

From 9650f90c7240e3129c82f2570ee59abb4a6281fc Mon Sep 17 00:00:00 2001
From: Nathan Lynch <nathanl@linux.ibm.com>
Date: Wed, 6 Jan 2021 20:59:00 -0600
Subject: [PATCH 1566/2658] powerpc/pseries/dlpar: handle ibm,
 configure-connector delay status

[ Upstream commit 768d70e19ba525debd571b36e6d0ab19956c63d7 ]

dlpar_configure_connector() has two problems in its handling of
ibm,configure-connector's return status:

1. When the status is -2 (busy, call again), we call
   ibm,configure-connector again immediately without checking whether
   to schedule, which can result in monopolizing the CPU.
2. Extended delay status (9900..9905) goes completely unhandled,
   causing the configuration to unnecessarily terminate.

Fix both of these issues by using rtas_busy_delay().

Fixes: ab519a011caa ("powerpc/pseries: Kernel DLPAR Infrastructure")
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Reviewed-by: Tyrel Datwyler <tyreld@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210107025900.410369-1-nathanl@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/dlpar.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
index 551ba5b35df9..91a667d8b1e9 100644
--- a/arch/powerpc/platforms/pseries/dlpar.c
+++ b/arch/powerpc/platforms/pseries/dlpar.c
@@ -131,7 +131,6 @@ void dlpar_free_cc_nodes(struct device_node *dn)
 #define NEXT_PROPERTY   3
 #define PREV_PARENT     4
 #define MORE_MEMORY     5
-#define CALL_AGAIN	-2
 #define ERR_CFG_USE     -9003
 
 struct device_node *dlpar_configure_connector(__be32 drc_index,
@@ -173,6 +172,9 @@ struct device_node *dlpar_configure_connector(__be32 drc_index,
 
 		spin_unlock(&rtas_data_buf_lock);
 
+		if (rtas_busy_delay(rc))
+			continue;
+
 		switch (rc) {
 		case COMPLETE:
 			break;
@@ -225,9 +227,6 @@ struct device_node *dlpar_configure_connector(__be32 drc_index,
 			parent_path = last_dn->parent->full_name;
 			break;
 
-		case CALL_AGAIN:
-			break;
-
 		case MORE_MEMORY:
 		case ERR_CFG_USE:
 		default:

From 7bbc3ccc05ab4c76a1358efc0ea5b356b07bcfc6 Mon Sep 17 00:00:00 2001
From: Adrian Hunter <adrian.hunter@intel.com>
Date: Fri, 5 Feb 2021 19:53:47 +0200
Subject: [PATCH 1567/2658] perf intel-pt: Fix missing CYC processing in PSB

[ Upstream commit 03fb0f859b45d1eb05c984ab4bd3bef67e45ede2 ]

Add missing CYC packet processing when walking through PSB+. This
improves the accuracy of timestamps that follow PSB+, until the next
MTC.

Fixes: 3d49807870f08 ("perf tools: Add new Intel PT packet definitions")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Andi Kleen <ak@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Link: https://lore.kernel.org/r/20210205175350.23817-2-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
index c1944765533c..28f9e88c65ba 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
@@ -1478,6 +1478,9 @@ static int intel_pt_walk_psbend(struct intel_pt_decoder *decoder)
 			break;
 
 		case INTEL_PT_CYC:
+			intel_pt_calc_cyc_timestamp(decoder);
+			break;
+
 		case INTEL_PT_VMCS:
 		case INTEL_PT_MNT:
 		case INTEL_PT_PAD:

From d1cef549ff3387650200d9e4aad15775550ac0d5 Mon Sep 17 00:00:00 2001
From: Namhyung Kim <namhyung@kernel.org>
Date: Sun, 14 Feb 2021 18:16:38 +0900
Subject: [PATCH 1568/2658] perf test: Fix unaligned access in sample parsing
 test

[ Upstream commit c5c97cadd7ed13381cb6b4bef5c841a66938d350 ]

The ubsan reported the following error.  It was because sample's raw
data missed u32 padding at the end.  So it broke the alignment of the
array after it.

The raw data contains an u32 size prefix so the data size should have
an u32 padding after 8-byte aligned data.

27: Sample parsing  :util/synthetic-events.c:1539:4:
  runtime error: store to misaligned address 0x62100006b9bc for type
  '__u64' (aka 'unsigned long long'), which requires 8 byte alignment
0x62100006b9bc: note: pointer points here
  00 00 00 00 ff ff ff ff  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff
              ^
    #0 0x561532a9fc96 in perf_event__synthesize_sample util/synthetic-events.c:1539:13
    #1 0x5615327f4a4f in do_test tests/sample-parsing.c:284:8
    #2 0x5615327f3f50 in test__sample_parsing tests/sample-parsing.c:381:9
    #3 0x56153279d3a1 in run_test tests/builtin-test.c:424:9
    #4 0x56153279c836 in test_and_print tests/builtin-test.c:454:9
    #5 0x56153279b7eb in __cmd_test tests/builtin-test.c:675:4
    #6 0x56153279abf0 in cmd_test tests/builtin-test.c:821:9
    #7 0x56153264e796 in run_builtin perf.c:312:11
    #8 0x56153264cf03 in handle_internal_command perf.c:364:8
    #9 0x56153264e47d in run_argv perf.c:408:2
    #10 0x56153264c9a9 in main perf.c:538:3
    #11 0x7f137ab6fbbc in __libc_start_main (/lib64/libc.so.6+0x38bbc)
    #12 0x561532596828 in _start ...

SUMMARY: UndefinedBehaviorSanitizer: misaligned-pointer-use
 util/synthetic-events.c:1539:4 in

Fixes: 045f8cd8542d ("perf tests: Add a sample parsing test")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Link: https://lore.kernel.org/r/20210214091638.519643-1-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/tests/sample-parsing.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/tests/sample-parsing.c b/tools/perf/tests/sample-parsing.c
index 30c02181e78b..bdef02599b4e 100644
--- a/tools/perf/tests/sample-parsing.c
+++ b/tools/perf/tests/sample-parsing.c
@@ -167,7 +167,7 @@ static int do_test(u64 sample_type, u64 sample_regs, u64 read_format)
 		.data = {1, 211, 212, 213},
 	};
 	u64 regs[64];
-	const u64 raw_data[] = {0x123456780a0b0c0dULL, 0x1102030405060708ULL};
+	const u32 raw_data[] = {0x12345678, 0x0a0b0c0d, 0x11020304, 0x05060708, 0 };
 	const u64 data[] = {0x2211443366558877ULL, 0, 0xaabbccddeeff4321ULL};
 	struct perf_sample sample = {
 		.ip		= 101,

From 03b304d59c038847e3f14879f3a644b4fdf7fee5 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 16 Feb 2021 20:29:05 -0800
Subject: [PATCH 1569/2658] Input: elo - fix an error code in elo_connect()

[ Upstream commit 0958351e93fa0ac142f6dd8bd844441594f30a57 ]

If elo_setup_10() fails then this should return an error code instead
of success.

Fixes: fae3006e4b42 ("Input: elo - add support for non-pressure-sensitive touchscreens")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YBKFd5CvDu+jVmfW@mwanda
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/touchscreen/elo.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/elo.c b/drivers/input/touchscreen/elo.c
index 8051a4b704ea..e2e31cbd6b2c 100644
--- a/drivers/input/touchscreen/elo.c
+++ b/drivers/input/touchscreen/elo.c
@@ -345,8 +345,10 @@ static int elo_connect(struct serio *serio, struct serio_driver *drv)
 	switch (elo->id) {
 
 	case 0: /* 10-byte protocol */
-		if (elo_setup_10(elo))
+		if (elo_setup_10(elo)) {
+			err = -EIO;
 			goto fail3;
+		}
 
 		break;
 

From 41e20fd5fdb642a11c416269f61abab8ff2be169 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Wed, 25 Nov 2020 16:40:11 -0800
Subject: [PATCH 1570/2658] sparc64: only select COMPAT_BINFMT_ELF if
 BINFMT_ELF is set

[ Upstream commit 80bddf5c93a99e11fc9faf7e4b575d01cecd45d3 ]

Currently COMPAT on SPARC64 selects COMPAT_BINFMT_ELF unconditionally,
even when BINFMT_ELF is not enabled. This causes a kconfig warning.

Instead, just select COMPAT_BINFMT_ELF if BINFMT_ELF is enabled.
This builds cleanly with no kconfig warnings.

WARNING: unmet direct dependencies detected for COMPAT_BINFMT_ELF
  Depends on [n]: COMPAT [=y] && BINFMT_ELF [=n]
  Selected by [y]:
  - COMPAT [=y] && SPARC64 [=y]

Fixes: 26b4c912185a ("sparc,sparc64: unify Kconfig files")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: sparclinux@vger.kernel.org
Cc: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/sparc/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 1cf6a15102d8..cfa1c140b515 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -540,7 +540,7 @@ config COMPAT
 	bool
 	depends on SPARC64
 	default y
-	select COMPAT_BINFMT_ELF
+	select COMPAT_BINFMT_ELF if BINFMT_ELF
 	select HAVE_UID16
 	select ARCH_WANT_OLD_COMPAT_IPC
 	select COMPAT_OLD_SIGACTION

From a75c9210738d378788ebb89028b90a514028e7ab Mon Sep 17 00:00:00 2001
From: Aswath Govindraju <a-govindraju@ti.com>
Date: Thu, 7 Jan 2021 22:09:53 +0530
Subject: [PATCH 1571/2658] misc: eeprom_93xx46: Fix module alias to enable
 module autoprobe

[ Upstream commit 13613a2246bf531f5fc04e8e62e8f21a3d39bf1c ]

Fix module autoprobe by correcting module alias to match the string from
/sys/class/.../spi1.0/modalias content.

Fixes: 06b4501e88ad ("misc/eeprom: add driver for microwire 93xx46 EEPROMs")
Signed-off-by: Aswath Govindraju <a-govindraju@ti.com>
Link: https://lore.kernel.org/r/20210107163957.28664-2-a-govindraju@ti.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/eeprom/eeprom_93xx46.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
index ff63f05edc76..15c7e3574bcb 100644
--- a/drivers/misc/eeprom/eeprom_93xx46.c
+++ b/drivers/misc/eeprom/eeprom_93xx46.c
@@ -380,4 +380,4 @@ module_spi_driver(eeprom_93xx46_driver);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Driver for 93xx46 EEPROMs");
 MODULE_AUTHOR("Anatolij Gustschin <agust@denx.de>");
-MODULE_ALIAS("spi:93xx46");
+MODULE_ALIAS("spi:eeprom-93xx46");

From c648cf7441a672ef6915e46af4b226664953cedf Mon Sep 17 00:00:00 2001
From: Aswath Govindraju <a-govindraju@ti.com>
Date: Wed, 13 Jan 2021 10:42:52 +0530
Subject: [PATCH 1572/2658] misc: eeprom_93xx46: Add module alias to avoid
 breaking support for non device tree users

[ Upstream commit 4540b9fbd8ebb21bb3735796d300a1589ee5fbf2 ]

Module alias "spi:93xx46" is used by non device tree users like
drivers/misc/eeprom/digsy_mtc_eeprom.c  and removing it will
break support for them.

Fix this by adding back the module alias "spi:93xx46".

Fixes: 13613a2246bf ("misc: eeprom_93xx46: Fix module alias to enable module autoprobe")
Signed-off-by: Aswath Govindraju <a-govindraju@ti.com>
Link: https://lore.kernel.org/r/20210113051253.15061-1-a-govindraju@ti.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/eeprom/eeprom_93xx46.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
index 15c7e3574bcb..22c1f06728a9 100644
--- a/drivers/misc/eeprom/eeprom_93xx46.c
+++ b/drivers/misc/eeprom/eeprom_93xx46.c
@@ -380,4 +380,5 @@ module_spi_driver(eeprom_93xx46_driver);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Driver for 93xx46 EEPROMs");
 MODULE_AUTHOR("Anatolij Gustschin <agust@denx.de>");
+MODULE_ALIAS("spi:93xx46");
 MODULE_ALIAS("spi:eeprom-93xx46");

From f0768391f22e6ac6235836a41907a7451ceb77b1 Mon Sep 17 00:00:00 2001
From: Jorgen Hansen <jhansen@vmware.com>
Date: Wed, 20 Jan 2021 08:32:40 -0800
Subject: [PATCH 1573/2658] VMCI: Use set_page_dirty_lock() when unregistering
 guest memory

[ Upstream commit 5a16c535409f8dcb7568e20737309e3027ae3e49 ]

When the VMCI host support releases guest memory in the case where
the VM was killed, the pinned guest pages aren't locked. Use
set_page_dirty_lock() instead of set_page_dirty().

Testing done: Killed VM while having an active VMCI based vSocket
connection and observed warning from ext4. With this fix, no
warning was observed. Ran various vSocket tests without issues.

Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.")
Reviewed-by: Vishnu Dasa <vdasa@vmware.com>
Signed-off-by: Jorgen Hansen <jhansen@vmware.com>
Link: https://lore.kernel.org/r/1611160360-30299-1-git-send-email-jhansen@vmware.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/vmw_vmci/vmci_queue_pair.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
index e57340e980c4..44e29d835e24 100644
--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
@@ -732,7 +732,7 @@ static void qp_release_pages(struct page **pages,
 
 	for (i = 0; i < num_pages; i++) {
 		if (dirty)
-			set_page_dirty(pages[i]);
+			set_page_dirty_lock(pages[i]);
 
 		page_cache_release(pages[i]);
 		pages[i] = NULL;

From 45759d3103722a4a27072cda500375ba2c2eb19d Mon Sep 17 00:00:00 2001
From: Heiner Kallweit <hkallweit1@gmail.com>
Date: Sun, 24 Jan 2021 16:39:32 +0100
Subject: [PATCH 1574/2658] PCI: Align checking of syscall user config
 accessors

[ Upstream commit ef9e4005cbaf022c6251263aa27836acccaef65d ]

After 34e3207205ef ("PCI: handle positive error codes"),
pci_user_read_config_*() and pci_user_write_config_*() return 0 or negative
errno values, not PCIBIOS_* values like PCIBIOS_SUCCESSFUL or
PCIBIOS_BAD_REGISTER_NUMBER.

Remove comparisons with PCIBIOS_SUCCESSFUL and check only for non-zero.  It
happens that PCIBIOS_SUCCESSFUL is zero, so this is not a functional
change, but it aligns this code with the user accessors.

[bhelgaas: commit log]
Fixes: 34e3207205ef ("PCI: handle positive error codes")
Link: https://lore.kernel.org/r/f1220314-e518-1e18-bf94-8e6f8c703758@gmail.com
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/syscall.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c
index b91c4da68365..7958250856d3 100644
--- a/drivers/pci/syscall.c
+++ b/drivers/pci/syscall.c
@@ -21,7 +21,7 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn,
 	u16 word;
 	u32 dword;
 	long err;
-	long cfg_ret;
+	int cfg_ret;
 
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
@@ -47,7 +47,7 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn,
 	}
 
 	err = -EIO;
-	if (cfg_ret != PCIBIOS_SUCCESSFUL)
+	if (cfg_ret)
 		goto error;
 
 	switch (len) {
@@ -105,7 +105,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
 		if (err)
 			break;
 		err = pci_user_write_config_byte(dev, off, byte);
-		if (err != PCIBIOS_SUCCESSFUL)
+		if (err)
 			err = -EIO;
 		break;
 
@@ -114,7 +114,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
 		if (err)
 			break;
 		err = pci_user_write_config_word(dev, off, word);
-		if (err != PCIBIOS_SUCCESSFUL)
+		if (err)
 			err = -EIO;
 		break;
 
@@ -123,7 +123,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
 		if (err)
 			break;
 		err = pci_user_write_config_dword(dev, off, dword);
-		if (err != PCIBIOS_SUCCESSFUL)
+		if (err)
 			err = -EIO;
 		break;
 

From be537e2f7284b920d8e9ad833bd316360f84387c Mon Sep 17 00:00:00 2001
From: Miaohe Lin <linmiaohe@huawei.com>
Date: Wed, 24 Feb 2021 12:04:33 -0800
Subject: [PATCH 1575/2658] mm/memory.c: fix potential pte_unmap_unlock pte
 error

[ Upstream commit 90a3e375d324b2255b83e3dd29e99e2b05d82aaf ]

Since commit 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged
high MMIO PROT_NONE mappings"), when the first pfn modify is not allowed,
we would break the loop with pte unchanged.  Then the wrong pte - 1 would
be passed to pte_unmap_unlock.

Andi said:

 "While the fix is correct, I'm not sure if it actually is a real bug.
  Is there any architecture that would do something else than unlocking
  the underlying page? If it's just the underlying page then it should
  be always the same page, so no bug"

Link: https://lkml.kernel.org/r/20210109080118.20885-1-linmiaohe@huawei.com
Fixes: 42e4089c789 ("x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings")
Signed-off-by: Hongxiang Lou <louhongxiang@huawei.com>
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/memory.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/mm/memory.c b/mm/memory.c
index 5dfc9fac8b74..8e41c675f7af 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1686,11 +1686,11 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd,
 			unsigned long addr, unsigned long end,
 			unsigned long pfn, pgprot_t prot)
 {
-	pte_t *pte;
+	pte_t *pte, *mapped_pte;
 	spinlock_t *ptl;
 	int err = 0;
 
-	pte = pte_alloc_map_lock(mm, pmd, addr, &ptl);
+	mapped_pte = pte = pte_alloc_map_lock(mm, pmd, addr, &ptl);
 	if (!pte)
 		return -ENOMEM;
 	arch_enter_lazy_mmu_mode();
@@ -1704,7 +1704,7 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd,
 		pfn++;
 	} while (pte++, addr += PAGE_SIZE, addr != end);
 	arch_leave_lazy_mmu_mode();
-	pte_unmap_unlock(pte - 1, ptl);
+	pte_unmap_unlock(mapped_pte, ptl);
 	return err;
 }
 

From 44bc23305e0be2e55a5c7ae6c439271fcbb79819 Mon Sep 17 00:00:00 2001
From: Miaohe Lin <linmiaohe@huawei.com>
Date: Wed, 24 Feb 2021 12:06:50 -0800
Subject: [PATCH 1576/2658] mm/hugetlb: fix potential double free in
 hugetlb_register_node() error path

[ Upstream commit cc2205a67dec5a700227a693fc113441e73e4641 ]

In hugetlb_sysfs_add_hstate(), we would do kobject_put() on hstate_kobjs
when failed to create sysfs group but forget to set hstate_kobjs to NULL.
Then in hugetlb_register_node() error path, we may free it again via
hugetlb_unregister_node().

Link: https://lkml.kernel.org/r/20210107123249.36964-1-linmiaohe@huawei.com
Fixes: a3437870160c ("hugetlb: new sysfs interface")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Reviewed-by: Muchun Song <smuchun@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/hugetlb.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index dc877712ef1f..7c3ecac8aeb3 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2485,8 +2485,10 @@ static int hugetlb_sysfs_add_hstate(struct hstate *h, struct kobject *parent,
 		return -ENOMEM;
 
 	retval = sysfs_create_group(hstate_kobjs[hi], hstate_attr_group);
-	if (retval)
+	if (retval) {
 		kobject_put(hstate_kobjs[hi]);
+		hstate_kobjs[hi] = NULL;
+	}
 
 	return retval;
 }

From 52ca09f92bbf232a1f12c6b448513ea2b88219ad Mon Sep 17 00:00:00 2001
From: Maxime Ripard <maxime@cerno.tech>
Date: Thu, 25 Feb 2021 17:11:01 +0100
Subject: [PATCH 1577/2658] i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition

[ Upstream commit a1858ce0cfe31368b23ba55794e409fb57ced4a4 ]

The brcmstb_send_i2c_cmd currently has a condition that is (CMD_RD ||
CMD_WR) which always evaluates to true, while the obvious fix is to test
whether the cmd variable passed as parameter holds one of these two
values.

Fixes: dd1aa2524bc5 ("i2c: brcmstb: Add Broadcom settop SoC i2c controller driver")
Reported-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-brcmstb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-brcmstb.c b/drivers/i2c/busses/i2c-brcmstb.c
index 81115abf3c1f..6e9007adad84 100644
--- a/drivers/i2c/busses/i2c-brcmstb.c
+++ b/drivers/i2c/busses/i2c-brcmstb.c
@@ -304,7 +304,7 @@ static int brcmstb_send_i2c_cmd(struct brcmstb_i2c_dev *dev,
 		goto cmd_out;
 	}
 
-	if ((CMD_RD || CMD_WR) &&
+	if ((cmd == CMD_RD || cmd == CMD_WR) &&
 	    bsc_readl(dev, iic_enable) & BSC_IIC_EN_NOACK_MASK) {
 		rc = -EREMOTEIO;
 		dev_dbg(dev->device, "controller received NOACK intr for %s\n",

From ec9f3a76db29356c2edbe81424f686dbb2a601a1 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Sat, 13 Feb 2021 11:24:28 -0800
Subject: [PATCH 1578/2658] scsi: bnx2fc: Fix Kconfig warning & CNIC build
 errors

[ Upstream commit eefb816acb0162e94a85a857f3a55148f671d5a5 ]

CNIC depends on MMU, but since 'select' does not follow any dependency
chains, SCSI_BNX2X_FCOE also needs to depend on MMU, so that erroneous
configs are not generated, which cause build errors in cnic.

WARNING: unmet direct dependencies detected for CNIC
  Depends on [n]: NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_BROADCOM [=y] && PCI [=y] && (IPV6 [=n] || IPV6 [=n]=n) && MMU [=n]
  Selected by [y]:
  - SCSI_BNX2X_FCOE [=y] && SCSI_LOWLEVEL [=y] && SCSI [=y] && PCI [=y] && (IPV6 [=n] || IPV6 [=n]=n) && LIBFC [=y] && LIBFCOE [=y]

riscv64-linux-ld: drivers/net/ethernet/broadcom/cnic.o: in function `.L154':
cnic.c:(.text+0x1094): undefined reference to `uio_event_notify'
riscv64-linux-ld: cnic.c:(.text+0x10bc): undefined reference to `uio_event_notify'
riscv64-linux-ld: drivers/net/ethernet/broadcom/cnic.o: in function `.L1442':
cnic.c:(.text+0x96a8): undefined reference to `__uio_register_device'
riscv64-linux-ld: drivers/net/ethernet/broadcom/cnic.o: in function `.L0 ':
cnic.c:(.text.unlikely+0x68): undefined reference to `uio_unregister_device'

Link: https://lore.kernel.org/r/20210213192428.22537-1-rdunlap@infradead.org
Fixes: 853e2bd2103a ("[SCSI] bnx2fc: Broadcom FCoE offload driver")
Cc: Saurav Kashyap <skashyap@marvell.com>
Cc: Javed Hasan <jhasan@marvell.com>
Cc: GR-QLogic-Storage-Upstream@marvell.com
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: linux-scsi@vger.kernel.org
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/bnx2fc/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/bnx2fc/Kconfig b/drivers/scsi/bnx2fc/Kconfig
index d401a096dfc7..2eb2476852b1 100644
--- a/drivers/scsi/bnx2fc/Kconfig
+++ b/drivers/scsi/bnx2fc/Kconfig
@@ -4,6 +4,7 @@ config SCSI_BNX2X_FCOE
 	depends on (IPV6 || IPV6=n)
 	depends on LIBFC
 	depends on LIBFCOE
+	depends on MMU
 	select NETDEVICES
 	select ETHERNET
 	select NET_VENDOR_BROADCOM

From a48584da7e84f27ea44a69c3a8ec36d456313f60 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bart.vanassche@wdc.com>
Date: Wed, 14 Mar 2018 15:48:06 -0700
Subject: [PATCH 1579/2658] block: Move SECTOR_SIZE and SECTOR_SHIFT
 definitions into <linux/blkdev.h>

commit 233bde21aa43516baa013ef7ac33f3427056db3e upstream.

It happens often while I'm preparing a patch for a block driver that
I'm wondering: is a definition of SECTOR_SIZE and/or SECTOR_SHIFT
available for this driver? Do I have to introduce definitions of these
constants before I can use these constants? To avoid this confusion,
move the existing definitions of SECTOR_SIZE and SECTOR_SHIFT into the
<linux/blkdev.h> header file such that these become available for all
block drivers. Make the SECTOR_SIZE definition in the uapi msdos_fs.h
header file conditional to avoid that including that header file after
<linux/blkdev.h> causes the compiler to complain about a SECTOR_SIZE
redefinition.

Note: the SECTOR_SIZE / SECTOR_SHIFT / SECTOR_BITS definitions have
not been removed from uapi header files nor from NAND drivers in
which these constants are used for another purpose than converting
block layer offsets and sizes into a number of sectors.

Cc: David S. Miller <davem@davemloft.net>
Cc: Mike Snitzer <snitzer@redhat.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Nitin Gupta <ngupta@vflare.org>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/xtensa/platforms/iss/simdisk.c |  1 -
 drivers/block/brd.c                 |  1 -
 drivers/block/rbd.c                 |  9 -------
 drivers/block/zram/zram_drv.h       |  1 -
 drivers/ide/ide-cd.c                |  8 +++---
 drivers/ide/ide-cd.h                |  6 +----
 drivers/nvdimm/nd.h                 |  1 -
 drivers/scsi/gdth.h                 |  3 ---
 include/linux/blkdev.h              | 42 +++++++++++++++++++++--------
 include/linux/device-mapper.h       |  2 --
 include/linux/ide.h                 |  1 -
 include/uapi/linux/msdos_fs.h       |  2 ++
 12 files changed, 38 insertions(+), 39 deletions(-)

diff --git a/arch/xtensa/platforms/iss/simdisk.c b/arch/xtensa/platforms/iss/simdisk.c
index 3c3ace2c46b6..af7aca70a861 100644
--- a/arch/xtensa/platforms/iss/simdisk.c
+++ b/arch/xtensa/platforms/iss/simdisk.c
@@ -21,7 +21,6 @@
 #include <platform/simcall.h>
 
 #define SIMDISK_MAJOR 240
-#define SECTOR_SHIFT 9
 #define SIMDISK_MINORS 1
 #define MAX_SIMDISK_COUNT 10
 
diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index 58c1138ad5e1..2a1a4ac8933c 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -22,7 +22,6 @@
 
 #include <asm/uaccess.h>
 
-#define SECTOR_SHIFT		9
 #define PAGE_SECTORS_SHIFT	(PAGE_SHIFT - SECTOR_SHIFT)
 #define PAGE_SECTORS		(1 << PAGE_SECTORS_SHIFT)
 
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 445ca973edd6..0b2b47c0988a 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -49,15 +49,6 @@
 
 #define RBD_DEBUG	/* Activate rbd_assert() calls */
 
-/*
- * The basic unit of block I/O is a sector.  It is interpreted in a
- * number of contexts in Linux (blk, bio, genhd), but the default is
- * universally 512 bytes.  These symbols are just slightly more
- * meaningful than the bare numbers they represent.
- */
-#define	SECTOR_SHIFT	9
-#define	SECTOR_SIZE	(1ULL << SECTOR_SHIFT)
-
 /*
  * Increment the given counter and return its updated value.
  * If the counter is already 0 it will not be incremented.
diff --git a/drivers/block/zram/zram_drv.h b/drivers/block/zram/zram_drv.h
index 8e92339686d7..fb036a46195c 100644
--- a/drivers/block/zram/zram_drv.h
+++ b/drivers/block/zram/zram_drv.h
@@ -36,7 +36,6 @@ static const size_t max_zpage_size = PAGE_SIZE / 4 * 3;
 
 /*-- End of configurable params */
 
-#define SECTOR_SHIFT		9
 #define SECTORS_PER_PAGE_SHIFT	(PAGE_SHIFT - SECTOR_SHIFT)
 #define SECTORS_PER_PAGE	(1 << SECTORS_PER_PAGE_SHIFT)
 #define ZRAM_LOGICAL_BLOCK_SHIFT 12
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index 08a21d635d0d..a6cc32a1e644 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -704,7 +704,7 @@ static ide_startstop_t cdrom_start_rw(ide_drive_t *drive, struct request *rq)
 	struct request_queue *q = drive->queue;
 	int write = rq_data_dir(rq) == WRITE;
 	unsigned short sectors_per_frame =
-		queue_logical_block_size(q) >> SECTOR_BITS;
+		queue_logical_block_size(q) >> SECTOR_SHIFT;
 
 	ide_debug_log(IDE_DBG_RQ, "rq->cmd[0]: 0x%x, rq->cmd_flags: 0x%x, "
 				  "secs_per_frame: %u",
@@ -900,7 +900,7 @@ static int cdrom_read_capacity(ide_drive_t *drive, unsigned long *capacity,
 	 * end up being bogus.
 	 */
 	blocklen = be32_to_cpu(capbuf.blocklen);
-	blocklen = (blocklen >> SECTOR_BITS) << SECTOR_BITS;
+	blocklen = (blocklen >> SECTOR_SHIFT) << SECTOR_SHIFT;
 	switch (blocklen) {
 	case 512:
 	case 1024:
@@ -916,7 +916,7 @@ static int cdrom_read_capacity(ide_drive_t *drive, unsigned long *capacity,
 	}
 
 	*capacity = 1 + be32_to_cpu(capbuf.lba);
-	*sectors_per_frame = blocklen >> SECTOR_BITS;
+	*sectors_per_frame = blocklen >> SECTOR_SHIFT;
 
 	ide_debug_log(IDE_DBG_PROBE, "cap: %lu, sectors_per_frame: %lu",
 				     *capacity, *sectors_per_frame);
@@ -993,7 +993,7 @@ int ide_cd_read_toc(ide_drive_t *drive, struct request_sense *sense)
 	drive->probed_capacity = toc->capacity * sectors_per_frame;
 
 	blk_queue_logical_block_size(drive->queue,
-				     sectors_per_frame << SECTOR_BITS);
+				     sectors_per_frame << SECTOR_SHIFT);
 
 	/* first read just the header, so we know how long the TOC is */
 	stat = cdrom_read_tocentry(drive, 0, 1, 0, (char *) &toc->hdr,
diff --git a/drivers/ide/ide-cd.h b/drivers/ide/ide-cd.h
index 1efc936f5b66..7c6d017e84e9 100644
--- a/drivers/ide/ide-cd.h
+++ b/drivers/ide/ide-cd.h
@@ -20,11 +20,7 @@
 
 /************************************************************************/
 
-#define SECTOR_BITS 		9
-#ifndef SECTOR_SIZE
-#define SECTOR_SIZE		(1 << SECTOR_BITS)
-#endif
-#define SECTORS_PER_FRAME	(CD_FRAMESIZE >> SECTOR_BITS)
+#define SECTORS_PER_FRAME	(CD_FRAMESIZE >> SECTOR_SHIFT)
 #define SECTOR_BUFFER_SIZE	(CD_FRAMESIZE * 32)
 
 /* Capabilities Page size including 8 bytes of Mode Page Header */
diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h
index fc870e55bb66..5fab68838651 100644
--- a/drivers/nvdimm/nd.h
+++ b/drivers/nvdimm/nd.h
@@ -27,7 +27,6 @@ enum {
 	 * BTT instance
 	 */
 	ND_MAX_LANES = 256,
-	SECTOR_SHIFT = 9,
 	INT_LBASIZE_ALIGNMENT = 64,
 #if IS_ENABLED(CONFIG_NVDIMM_PFN)
 	ND_PFN_ALIGN = PAGES_PER_SECTION * PAGE_SIZE,
diff --git a/drivers/scsi/gdth.h b/drivers/scsi/gdth.h
index 3fd8b83ffbf9..8039c809cef2 100644
--- a/drivers/scsi/gdth.h
+++ b/drivers/scsi/gdth.h
@@ -177,9 +177,6 @@
 #define MSG_SIZE        34                      /* size of message structure */
 #define MSG_REQUEST     0                       /* async. event: message */
 
-/* cacheservice defines */
-#define SECTOR_SIZE     0x200                   /* always 512 bytes per sec. */
-
 /* DPMEM constants */
 #define DPMEM_MAGIC     0xC0FFEE11
 #define IC_HEADER_BYTES 48
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 6af5d1cc14fd..4ce7ddc28ccc 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -838,6 +838,19 @@ static inline struct request_queue *bdev_get_queue(struct block_device *bdev)
 	return bdev->bd_disk->queue;	/* this is never NULL */
 }
 
+/*
+ * The basic unit of block I/O is a sector. It is used in a number of contexts
+ * in Linux (blk, bio, genhd). The size of one sector is 512 = 2**9
+ * bytes. Variables of type sector_t represent an offset or size that is a
+ * multiple of 512 bytes. Hence these two constants.
+ */
+#ifndef SECTOR_SHIFT
+#define SECTOR_SHIFT 9
+#endif
+#ifndef SECTOR_SIZE
+#define SECTOR_SIZE (1 << SECTOR_SHIFT)
+#endif
+
 /*
  * blk_rq_pos()			: the current sector
  * blk_rq_bytes()		: bytes left in the entire request
@@ -865,19 +878,20 @@ extern unsigned int blk_rq_err_bytes(const struct request *rq);
 
 static inline unsigned int blk_rq_sectors(const struct request *rq)
 {
-	return blk_rq_bytes(rq) >> 9;
+	return blk_rq_bytes(rq) >> SECTOR_SHIFT;
 }
 
 static inline unsigned int blk_rq_cur_sectors(const struct request *rq)
 {
-	return blk_rq_cur_bytes(rq) >> 9;
+	return blk_rq_cur_bytes(rq) >> SECTOR_SHIFT;
 }
 
 static inline unsigned int blk_queue_get_max_sectors(struct request_queue *q,
 						     unsigned int cmd_flags)
 {
 	if (unlikely(cmd_flags & REQ_DISCARD))
-		return min(q->limits.max_discard_sectors, UINT_MAX >> 9);
+		return min(q->limits.max_discard_sectors,
+			   UINT_MAX >> SECTOR_SHIFT);
 
 	if (unlikely(cmd_flags & REQ_WRITE_SAME))
 		return q->limits.max_write_same_sectors;
@@ -1143,16 +1157,21 @@ extern int blkdev_issue_zeroout(struct block_device *bdev, sector_t sector,
 static inline int sb_issue_discard(struct super_block *sb, sector_t block,
 		sector_t nr_blocks, gfp_t gfp_mask, unsigned long flags)
 {
-	return blkdev_issue_discard(sb->s_bdev, block << (sb->s_blocksize_bits - 9),
-				    nr_blocks << (sb->s_blocksize_bits - 9),
+	return blkdev_issue_discard(sb->s_bdev,
+				    block << (sb->s_blocksize_bits -
+					      SECTOR_SHIFT),
+				    nr_blocks << (sb->s_blocksize_bits -
+						  SECTOR_SHIFT),
 				    gfp_mask, flags);
 }
 static inline int sb_issue_zeroout(struct super_block *sb, sector_t block,
 		sector_t nr_blocks, gfp_t gfp_mask)
 {
 	return blkdev_issue_zeroout(sb->s_bdev,
-				    block << (sb->s_blocksize_bits - 9),
-				    nr_blocks << (sb->s_blocksize_bits - 9),
+				    block << (sb->s_blocksize_bits -
+					      SECTOR_SHIFT),
+				    nr_blocks << (sb->s_blocksize_bits -
+						  SECTOR_SHIFT),
 				    gfp_mask, true);
 }
 
@@ -1259,7 +1278,8 @@ static inline int queue_alignment_offset(struct request_queue *q)
 static inline int queue_limit_alignment_offset(struct queue_limits *lim, sector_t sector)
 {
 	unsigned int granularity = max(lim->physical_block_size, lim->io_min);
-	unsigned int alignment = sector_div(sector, granularity >> 9) << 9;
+	unsigned int alignment = sector_div(sector, granularity >> SECTOR_SHIFT)
+		<< SECTOR_SHIFT;
 
 	return (granularity + lim->alignment_offset - alignment) % granularity;
 }
@@ -1293,8 +1313,8 @@ static inline int queue_limit_discard_alignment(struct queue_limits *lim, sector
 		return 0;
 
 	/* Why are these in bytes, not sectors? */
-	alignment = lim->discard_alignment >> 9;
-	granularity = lim->discard_granularity >> 9;
+	alignment = lim->discard_alignment >> SECTOR_SHIFT;
+	granularity = lim->discard_granularity >> SECTOR_SHIFT;
 	if (!granularity)
 		return 0;
 
@@ -1305,7 +1325,7 @@ static inline int queue_limit_discard_alignment(struct queue_limits *lim, sector
 	offset = (granularity + alignment - offset) % granularity;
 
 	/* Turn it back into bytes, gaah */
-	return offset << 9;
+	return offset << SECTOR_SHIFT;
 }
 
 static inline int bdev_discard_alignment(struct block_device *bdev)
diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index b393ab66073a..71a205c5c125 100644
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -556,8 +556,6 @@ extern struct ratelimit_state dm_ratelimit_state;
 #define DMEMIT(x...) sz += ((sz >= maxlen) ? \
 			  0 : scnprintf(result + sz, maxlen - sz, x))
 
-#define SECTOR_SHIFT 9
-
 /*
  * Definitions of return values from target end_io function.
  */
diff --git a/include/linux/ide.h b/include/linux/ide.h
index a633898f36ac..eb2ac48c99db 100644
--- a/include/linux/ide.h
+++ b/include/linux/ide.h
@@ -128,7 +128,6 @@ struct ide_io_ports {
  */
 #define PARTN_BITS	6	/* number of minor dev bits for partitions */
 #define MAX_DRIVES	2	/* per interface; 2 assumed by lots of code */
-#define SECTOR_SIZE	512
 
 /*
  * Timeouts for various operations:
diff --git a/include/uapi/linux/msdos_fs.h b/include/uapi/linux/msdos_fs.h
index e956704f5fb1..95b8a9395ec1 100644
--- a/include/uapi/linux/msdos_fs.h
+++ b/include/uapi/linux/msdos_fs.h
@@ -9,7 +9,9 @@
  * The MS-DOS filesystem constants/structures
  */
 
+#ifndef SECTOR_SIZE
 #define SECTOR_SIZE	512		/* sector size (bytes) */
+#endif
 #define SECTOR_BITS	9		/* log2(SECTOR_SIZE) */
 #define MSDOS_DPB	(MSDOS_DPS)	/* dir entries per block */
 #define MSDOS_DPB_BITS	4		/* log2(MSDOS_DPB) */

From 08a0c98c70fd2a13178a500832111f5001ca5460 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Tue, 23 Feb 2021 19:25:30 -0700
Subject: [PATCH 1580/2658] blk-settings: align max_sectors on
 "logical_block_size" boundary

commit 97f433c3601a24d3513d06f575a389a2ca4e11e4 upstream.

We get I/O errors when we run md-raid1 on the top of dm-integrity on the
top of ramdisk.
device-mapper: integrity: Bio not aligned on 8 sectors: 0xff00, 0xff
device-mapper: integrity: Bio not aligned on 8 sectors: 0xff00, 0xff
device-mapper: integrity: Bio not aligned on 8 sectors: 0xffff, 0x1
device-mapper: integrity: Bio not aligned on 8 sectors: 0xffff, 0x1
device-mapper: integrity: Bio not aligned on 8 sectors: 0x8048, 0xff
device-mapper: integrity: Bio not aligned on 8 sectors: 0x8147, 0xff
device-mapper: integrity: Bio not aligned on 8 sectors: 0x8246, 0xff
device-mapper: integrity: Bio not aligned on 8 sectors: 0x8345, 0xbb

The ramdisk device has logical_block_size 512 and max_sectors 255. The
dm-integrity device uses logical_block_size 4096 and it doesn't affect the
"max_sectors" value - thus, it inherits 255 from the ramdisk. So, we have
a device with max_sectors not aligned on logical_block_size.

The md-raid device sees that the underlying leg has max_sectors 255 and it
will split the bios on 255-sector boundary, making the bios unaligned on
logical_block_size.

In order to fix the bug, we round down max_sectors to logical_block_size.

Cc: stable@vger.kernel.org
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 block/blk-settings.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/block/blk-settings.c b/block/blk-settings.c
index 71e4f074e9a6..511e2f0da858 100644
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -494,6 +494,14 @@ void blk_queue_stack_limits(struct request_queue *t, struct request_queue *b)
 }
 EXPORT_SYMBOL(blk_queue_stack_limits);
 
+static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lbs)
+{
+	sectors = round_down(sectors, lbs >> SECTOR_SHIFT);
+	if (sectors < PAGE_SIZE >> SECTOR_SHIFT)
+		sectors = PAGE_SIZE >> SECTOR_SHIFT;
+	return sectors;
+}
+
 /**
  * blk_stack_limits - adjust queue_limits for stacked devices
  * @t:	the stacking driver limits (top device)
@@ -606,6 +614,10 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
 		ret = -1;
 	}
 
+	t->max_sectors = blk_round_down_sectors(t->max_sectors, t->logical_block_size);
+	t->max_hw_sectors = blk_round_down_sectors(t->max_hw_sectors, t->logical_block_size);
+	t->max_dev_sectors = blk_round_down_sectors(t->max_dev_sectors, t->logical_block_size);
+
 	/* Discard alignment and granularity */
 	if (b->discard_granularity) {
 		alignment = queue_limit_discard_alignment(b, start);

From 2219f8a6eba451a1005d9e8af9aef5f65611bc7e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Olivier=20Cr=C3=AAte?= <olivier.crete@ocrete.ca>
Date: Fri, 5 Feb 2021 11:59:08 -0800
Subject: [PATCH 1581/2658] Input: xpad - add support for PowerA Enhanced Wired
 Controller for Xbox Series X|S
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 42ffcd1dba1796bcda386eb6f260df9fc23c90af upstream.

Signed-off-by: Olivier Crête <olivier.crete@ocrete.ca>
Link: https://lore.kernel.org/r/20210204005318.615647-1-olivier.crete@collabora.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/joystick/xpad.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 815b69d35722..4168ed0ef187 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -322,6 +322,7 @@ static const struct xpad_device {
 	{ 0x1bad, 0xfd00, "Razer Onza TE", 0, XTYPE_XBOX360 },
 	{ 0x1bad, 0xfd01, "Razer Onza", 0, XTYPE_XBOX360 },
 	{ 0x20d6, 0x2001, "BDA Xbox Series X Wired Controller", 0, XTYPE_XBOXONE },
+	{ 0x20d6, 0x2009, "PowerA Enhanced Wired Controller for Xbox Series X|S", 0, XTYPE_XBOXONE },
 	{ 0x20d6, 0x281f, "PowerA Wired Controller For Xbox 360", 0, XTYPE_XBOX360 },
 	{ 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE },
 	{ 0x24c6, 0x5000, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },

From 2b867a0e09db277deeab52ee74e71347d1f284ce Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 17 Feb 2021 12:21:10 -0800
Subject: [PATCH 1582/2658] Input: joydev - prevent potential read overflow in
 ioctl

commit 182d679b2298d62bf42bb14b12a8067b8e17b617 upstream.

The problem here is that "len" might be less than "joydev->nabs" so the
loops which verfy abspam[i] and keypam[] might read beyond the buffer.

Fixes: 999b874f4aa3 ("Input: joydev - validate axis/button maps before clobbering current ones")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YCyzR8WvFRw4HWw6@mwanda
[dtor: additional check for len being even in joydev_handle_JSIOCSBTNMAP]
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/joydev.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 5d11fea3c8ec..83dfe19c1b67 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -448,7 +448,7 @@ static int joydev_handle_JSIOCSAXMAP(struct joydev *joydev,
 	if (IS_ERR(abspam))
 		return PTR_ERR(abspam);
 
-	for (i = 0; i < joydev->nabs; i++) {
+	for (i = 0; i < len && i < joydev->nabs; i++) {
 		if (abspam[i] > ABS_MAX) {
 			retval = -EINVAL;
 			goto out;
@@ -472,6 +472,9 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev,
 	int i;
 	int retval = 0;
 
+	if (len % sizeof(*keypam))
+		return -EINVAL;
+
 	len = min(len, sizeof(joydev->keypam));
 
 	/* Validate the map. */
@@ -479,7 +482,7 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev,
 	if (IS_ERR(keypam))
 		return PTR_ERR(keypam);
 
-	for (i = 0; i < joydev->nkey; i++) {
+	for (i = 0; i < (len / 2) && i < joydev->nkey; i++) {
 		if (keypam[i] > KEY_MAX || keypam[i] < BTN_MISC) {
 			retval = -EINVAL;
 			goto out;

From 509a21ead08426d64840a8072e1988df5ffd83af Mon Sep 17 00:00:00 2001
From: Marcos Paulo de Souza <mpdesouza@suse.com>
Date: Fri, 19 Feb 2021 10:37:13 -0800
Subject: [PATCH 1583/2658] Input: i8042 - add ASUS Zenbook Flip to noselftest
 list

commit b5d6e7ab7fe7d186878142e9fc1a05e4c3b65eb9 upstream.

After commit 77b425399f6d ("Input: i8042 - use chassis info to skip
selftest on Asus laptops"), all modern Asus laptops have the i8042
selftest disabled. It has done by using chassys type "10" (laptop).

The Asus Zenbook Flip suffers from similar suspend/resume issues, but
it _sometimes_ work and sometimes it doesn't. Setting noselftest makes
it work reliably. In this case, we need to add chassis type "31"
(convertible) in order to avoid selftest in this device.

Reported-by: Ludvig Norgren Guldhag <ludvigng@gmail.com>
Signed-off-by: Marcos Paulo de Souza <mpdesouza@suse.com>
Link: https://lore.kernel.org/r/20210219164638.761-1-mpdesouza@suse.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/serio/i8042-x86ia64io.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 2317f8d3fef6..ff0f3c3e2f80 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -579,6 +579,10 @@ static const struct dmi_system_id i8042_dmi_forcemux_table[] __initconst = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "VGN-CS"),
 		},
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /* Convertible Notebook */
+		},
 	},
 	{ }
 };

From 68832e996811b1827b7c201a004fae53b0f5de9f Mon Sep 17 00:00:00 2001
From: Lech Perczak <lech.perczak@gmail.com>
Date: Sun, 7 Feb 2021 01:54:43 +0100
Subject: [PATCH 1584/2658] USB: serial: option: update interface mapping for
 ZTE P685M
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 6420a569504e212d618d4a4736e2c59ed80a8478 upstream.

This patch prepares for qmi_wwan driver support for the device.
Previously "option" driver mapped itself to interfaces 0 and 3 (matching
ff/ff/ff), while interface 3 is in fact a QMI port.
Interfaces 1 and 2 (matching ff/00/00) expose AT commands,
and weren't supported previously at all.
Without this patch, a possible conflict would exist if device ID was
added to qmi_wwan driver for interface 3.

Update and simplify device ID to match interfaces 0-2 directly,
to expose QCDM (0), PCUI (1), and modem (2) ports and avoid conflict
with QMI (3), and ADB (4).

The modem is used inside ZTE MF283+ router and carriers identify it as
such.
Interface mapping is:
0: QCDM, 1: AT (PCUI), 2: AT (Modem), 3: QMI, 4: ADB

T:  Bus=02 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#=  3 Spd=480  MxCh= 0
D:  Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=19d2 ProdID=1275 Rev=f0.00
S:  Manufacturer=ZTE,Incorporated
S:  Product=ZTE Technologies MSM
S:  SerialNumber=P685M510ZTED0000CP&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&0
C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=85(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E:  Ad=87(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E:  Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

Cc: Johan Hovold <johan@kernel.org>
Cc: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://lore.kernel.org/r/20210207005443.12936-1-lech.perczak@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 3c536eed0754..351be7386280 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1551,7 +1551,8 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1274, 0xff, 0xff, 0xff) },
-	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1275, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE(ZTE_VENDOR_ID, 0x1275),	/* ZTE P685M */
+	  .driver_info = RSVD(3) | RSVD(4) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1276, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1277, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1278, 0xff, 0xff, 0xff) },

From 002ccc004a324a954983960e233c05e943f9c566 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 26 Jan 2021 13:26:54 +0300
Subject: [PATCH 1585/2658] USB: serial: mos7840: fix error code in
 mos7840_write()

commit a70aa7dc60099bbdcbd6faca42a915d80f31161e upstream.

This should return -ENOMEM instead of 0 if the kmalloc() fails.

Fixes: 3f5429746d91 ("USB: Moschip 7840 USB-Serial Driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/mos7840.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 4add6bc38d64..7a9b9542882f 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -1362,8 +1362,10 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
 	if (urb->transfer_buffer == NULL) {
 		urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
 					       GFP_ATOMIC);
-		if (!urb->transfer_buffer)
+		if (!urb->transfer_buffer) {
+			bytes_sent = -ENOMEM;
 			goto exit;
+		}
 	}
 	transfer_size = min(count, URB_TRANSFER_BUFFER_SIZE);
 

From 88eebd6bb623fb9ac5f18a453dac255e33a147cb Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 28 Jan 2021 12:35:23 +0300
Subject: [PATCH 1586/2658] USB: serial: mos7720: fix error code in
 mos7720_write()

commit fea7372cbc40869876df0f045e367f6f97a1666c upstream.

This code should return -ENOMEM if the kmalloc() fails but instead
it returns success.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: 0f64478cbc7a ("USB: add USB serial mos7720 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/mos7720.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 1d8a6c17c9eb..7f3af3ed347d 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -1239,8 +1239,10 @@ static int mos7720_write(struct tty_struct *tty, struct usb_serial_port *port,
 	if (urb->transfer_buffer == NULL) {
 		urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
 					       GFP_ATOMIC);
-		if (!urb->transfer_buffer)
+		if (!urb->transfer_buffer) {
+			bytes_sent = -ENOMEM;
 			goto exit;
+		}
 	}
 	transfer_size = min(count, URB_TRANSFER_BUFFER_SIZE);
 

From c37923b2c91dccc45eb0e6a729e4c55eb602f103 Mon Sep 17 00:00:00 2001
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Date: Mon, 8 Feb 2021 13:53:10 -0800
Subject: [PATCH 1587/2658] usb: dwc3: gadget: Fix setting of
 DEPCFG.bInterval_m1

commit a1679af85b2ae35a2b78ad04c18bb069c37330cc upstream.

Valid range for DEPCFG.bInterval_m1 is from 0 to 13, and it must be set
to 0 when the controller operates in full-speed. See the programming
guide for DEPCFG command section 3.2.2.1 (v3.30a).

Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")
Cc: <stable@vger.kernel.org>
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/3f57026f993c0ce71498dbb06e49b3a47c4d0265.1612820995.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc3/gadget.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index c74e858916a5..c29c38f8bc91 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -583,7 +583,17 @@ static int dwc3_gadget_set_ep_config(struct dwc3 *dwc, struct dwc3_ep *dep,
 		params.param0 |= DWC3_DEPCFG_FIFO_NUMBER(dep->number >> 1);
 
 	if (desc->bInterval) {
-		params.param1 |= DWC3_DEPCFG_BINTERVAL_M1(desc->bInterval - 1);
+		u8 bInterval_m1;
+
+		/*
+		 * Valid range for DEPCFG.bInterval_m1 is from 0 to 13, and it
+		 * must be set to 0 when the controller operates in full-speed.
+		 */
+		bInterval_m1 = min_t(u8, desc->bInterval - 1, 13);
+		if (dwc->gadget.speed == USB_SPEED_FULL)
+			bInterval_m1 = 0;
+
+		params.param1 |= DWC3_DEPCFG_BINTERVAL_M1(bInterval_m1);
 		dep->interval = 1 << (desc->bInterval - 1);
 	}
 

From f9b010929f7d94c8a1137a9e0731d0f01781ffc7 Mon Sep 17 00:00:00 2001
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Date: Mon, 8 Feb 2021 13:53:16 -0800
Subject: [PATCH 1588/2658] usb: dwc3: gadget: Fix dep->interval for fullspeed
 interrupt

commit 4b049f55ed95cd889bcdb3034fd75e1f01852b38 upstream.

The dep->interval captures the number of frames/microframes per interval
from bInterval. Fullspeed interrupt endpoint bInterval is the number of
frames per interval and not 2^(bInterval - 1). So fix it here. This
change is only for debugging purpose and should not affect the interrupt
endpoint operation.

Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")
Cc: <stable@vger.kernel.org>
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/1263b563dedc4ab8b0fb854fba06ce4bc56bd495.1612820995.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc3/gadget.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index c29c38f8bc91..865d18f56956 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -593,8 +593,13 @@ static int dwc3_gadget_set_ep_config(struct dwc3 *dwc, struct dwc3_ep *dep,
 		if (dwc->gadget.speed == USB_SPEED_FULL)
 			bInterval_m1 = 0;
 
+		if (usb_endpoint_type(desc) == USB_ENDPOINT_XFER_INT &&
+		    dwc->gadget.speed == USB_SPEED_FULL)
+			dep->interval = desc->bInterval;
+		else
+			dep->interval = 1 << (desc->bInterval - 1);
+
 		params.param1 |= DWC3_DEPCFG_BINTERVAL_M1(bInterval_m1);
-		dep->interval = 1 << (desc->bInterval - 1);
 	}
 
 	return dwc3_send_gadget_ep_cmd(dwc, dep->number,

From c9670c00bb73e85b845bd2dc7534b2b3c1bf754e Mon Sep 17 00:00:00 2001
From: Jarkko Sakkinen <jarkko@kernel.org>
Date: Fri, 29 Jan 2021 01:56:20 +0200
Subject: [PATCH 1589/2658] KEYS: trusted: Fix migratable=1 failing

commit 8da7520c80468c48f981f0b81fc1be6599e3b0ad upstream.

Consider the following transcript:

$ keyctl add trusted kmk "new 32 blobauth=helloworld keyhandle=80000000 migratable=1" @u
add_key: Invalid argument

The documentation has the following description:

  migratable=   0|1 indicating permission to reseal to new PCR values,
                default 1 (resealing allowed)

The consequence is that "migratable=1" should succeed. Fix this by
allowing this condition to pass instead of return -EINVAL.

[*] Documentation/security/keys/trusted-encrypted.rst

Cc: stable@vger.kernel.org
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: Mimi Zohar <zohar@linux.ibm.com>
Cc: David Howells <dhowells@redhat.com>
Fixes: d00a1c72f7f4 ("keys: add new trusted key-type")
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 security/keys/trusted.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 214ae2dc7f64..4b350fec3153 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -778,7 +778,7 @@ static int getoptions(char *c, struct trusted_key_payload *pay,
 		case Opt_migratable:
 			if (*args[0].from == '0')
 				pay->migratable = 0;
-			else
+			else if (*args[0].from != '1')
 				return -EINVAL;
 			break;
 		case Opt_pcrlock:

From 01d41070eefb99a18319b6076beaa23efd541ac7 Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Thu, 14 Jan 2021 14:02:42 -0500
Subject: [PATCH 1590/2658] btrfs: fix reloc root leak with 0 ref reloc roots
 on recovery

commit c78a10aebb275c38d0cfccae129a803fe622e305 upstream.

When recovering a relocation, if we run into a reloc root that has 0
refs we simply add it to the reloc_control->reloc_roots list, and then
clean it up later.  The problem with this is __del_reloc_root() doesn't
do anything if the root isn't in the radix tree, which in this case it
won't be because we never call __add_reloc_root() on the reloc_root.

This exit condition simply isn't correct really.  During normal
operation we can remove ourselves from the rb tree and then we're meant
to clean up later at merge_reloc_roots() time, and this happens
correctly.  During recovery we're depending on free_reloc_roots() to
drop our references, but we're short-circuiting.

Fix this by continuing to check if we're on the list and dropping
ourselves from the reloc_control root list and dropping our reference
appropriately.  Change the corresponding BUG_ON() to an ASSERT() that
does the correct thing if we aren't in the rb tree.

CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/relocation.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index df04309390bb..5681fc3976ad 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1328,9 +1328,7 @@ static void __del_reloc_root(struct btrfs_root *root)
 			RB_CLEAR_NODE(&node->rb_node);
 		}
 		spin_unlock(&rc->reloc_root_tree.lock);
-		if (!node)
-			return;
-		BUG_ON((struct btrfs_root *)node->data != root);
+		ASSERT(!node || (struct btrfs_root *)node->data == root);
 	}
 
 	spin_lock(&root->fs_info->trans_lock);

From 20989d806464f29aab8efac167ce050f351692e3 Mon Sep 17 00:00:00 2001
From: Sabyrzhan Tasbolatov <snovitoll@gmail.com>
Date: Tue, 9 Feb 2021 16:26:12 +0600
Subject: [PATCH 1591/2658] drivers/misc/vmw_vmci: restrict too big queue size
 in qp_host_alloc_queue

commit 2fd10bcf0310b9525b2af9e1f7aa9ddd87c3772e upstream.

syzbot found WARNING in qp_broker_alloc[1] in qp_host_alloc_queue()
when num_pages is 0x100001, giving queue_size + queue_page_size
bigger than KMALLOC_MAX_SIZE for kzalloc(), resulting order >= MAX_ORDER
condition.

queue_size + queue_page_size=0x8000d8, where KMALLOC_MAX_SIZE=0x400000.

[1]
Call Trace:
 alloc_pages include/linux/gfp.h:547 [inline]
 kmalloc_order+0x40/0x130 mm/slab_common.c:837
 kmalloc_order_trace+0x15/0x70 mm/slab_common.c:853
 kmalloc_large include/linux/slab.h:481 [inline]
 __kmalloc+0x257/0x330 mm/slub.c:3959
 kmalloc include/linux/slab.h:557 [inline]
 kzalloc include/linux/slab.h:682 [inline]
 qp_host_alloc_queue drivers/misc/vmw_vmci/vmci_queue_pair.c:540 [inline]
 qp_broker_create drivers/misc/vmw_vmci/vmci_queue_pair.c:1351 [inline]
 qp_broker_alloc+0x936/0x2740 drivers/misc/vmw_vmci/vmci_queue_pair.c:1739

Reported-by: syzbot+15ec7391f3d6a1a7cc7d@syzkaller.appspotmail.com
Signed-off-by: Sabyrzhan Tasbolatov <snovitoll@gmail.com>
Link: https://lore.kernel.org/r/20210209102612.2112247-1-snovitoll@gmail.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/vmw_vmci/vmci_queue_pair.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
index 44e29d835e24..fcc4b4026834 100644
--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
@@ -639,6 +639,9 @@ static struct vmci_queue *qp_host_alloc_queue(u64 size)
 
 	queue_page_size = num_pages * sizeof(*queue->kernel_if->u.h.page);
 
+	if (queue_size + queue_page_size > KMALLOC_MAX_SIZE)
+		return NULL;
+
 	queue = kzalloc(queue_size + queue_page_size, GFP_KERNEL);
 	if (queue) {
 		queue->q_header = NULL;

From 6dfdea41b664613c64d62ef46c501d9f9dcf940b Mon Sep 17 00:00:00 2001
From: Martin Kaiser <martin@kaiser.cx>
Date: Thu, 4 Feb 2021 09:52:17 +0100
Subject: [PATCH 1592/2658] staging: rtl8188eu: Add Edimax EW-7811UN V2 to
 device table

commit 7a8d2f1908a59003e55ef8691d09efb7fbc51625 upstream.

The Edimax EW-7811UN V2 uses an RTL8188EU chipset and works with this
driver.

Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210204085217.9743-1-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index 9e678664d573..27a7d448ff61 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -53,6 +53,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
 	{USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */
 	{USB_DEVICE(0x2C4E, 0x0102)}, /* MERCUSYS MW150US v2 */
 	{USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
+	{USB_DEVICE(0x7392, 0xb811)}, /* Edimax EW-7811UN V2 */
 	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
 	{}	/* Terminating entry */
 };

From b19496b41f9db0641439d61756b406d53e9cd985 Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Wed, 30 Dec 2020 16:26:55 -0800
Subject: [PATCH 1593/2658] x86/reboot: Force all cpus to exit VMX root if VMX
 is supported

commit ed72736183c45a413a8d6974dd04be90f514cb6b upstream.

Force all CPUs to do VMXOFF (via NMI shootdown) during an emergency
reboot if VMX is _supported_, as VMX being off on the current CPU does
not prevent other CPUs from being in VMX root (post-VMXON).  This fixes
a bug where a crash/panic reboot could leave other CPUs in VMX root and
prevent them from being woken via INIT-SIPI-SIPI in the new kernel.

Fixes: d176720d34c7 ("x86: disable VMX on all CPUs on reboot")
Cc: stable@vger.kernel.org
Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: David P. Reed <dpreed@deepplum.com>
[sean: reworked changelog and further tweaked comment]
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20201231002702.2223707-3-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/reboot.c | 29 ++++++++++-------------------
 1 file changed, 10 insertions(+), 19 deletions(-)

diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 877e3cb6edfb..cbe14f7c2826 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -479,29 +479,20 @@ static void emergency_vmx_disable_all(void)
 	local_irq_disable();
 
 	/*
-	 * We need to disable VMX on all CPUs before rebooting, otherwise
-	 * we risk hanging up the machine, because the CPU ignore INIT
-	 * signals when VMX is enabled.
+	 * Disable VMX on all CPUs before rebooting, otherwise we risk hanging
+	 * the machine, because the CPU blocks INIT when it's in VMX root.
 	 *
-	 * We can't take any locks and we may be on an inconsistent
-	 * state, so we use NMIs as IPIs to tell the other CPUs to disable
-	 * VMX and halt.
+	 * We can't take any locks and we may be on an inconsistent state, so
+	 * use NMIs as IPIs to tell the other CPUs to exit VMX root and halt.
 	 *
-	 * For safety, we will avoid running the nmi_shootdown_cpus()
-	 * stuff unnecessarily, but we don't have a way to check
-	 * if other CPUs have VMX enabled. So we will call it only if the
-	 * CPU we are running on has VMX enabled.
-	 *
-	 * We will miss cases where VMX is not enabled on all CPUs. This
-	 * shouldn't do much harm because KVM always enable VMX on all
-	 * CPUs anyway. But we can miss it on the small window where KVM
-	 * is still enabling VMX.
+	 * Do the NMI shootdown even if VMX if off on _this_ CPU, as that
+	 * doesn't prevent a different CPU from being in VMX root operation.
 	 */
-	if (cpu_has_vmx() && cpu_vmx_enabled()) {
-		/* Disable VMX on this CPU. */
-		cpu_vmxoff();
+	if (cpu_has_vmx()) {
+		/* Safely force _this_ CPU out of VMX root operation. */
+		__cpu_emergency_vmxoff();
 
-		/* Halt and disable VMX on the other CPUs */
+		/* Halt and exit VMX root operation on the other CPUs. */
 		nmi_shootdown_cpus(vmxoff_nmi);
 
 	}

From a988f1102a4d38844997d28321e342fcc496b4ca Mon Sep 17 00:00:00 2001
From: Jiri Kosina <jkosina@suse.cz>
Date: Fri, 22 Jan 2021 12:13:20 +0100
Subject: [PATCH 1594/2658] floppy: reintroduce O_NDELAY fix

commit 8a0c014cd20516ade9654fc13b51345ec58e7be8 upstream.

This issue was originally fixed in 09954bad4 ("floppy: refactor open()
flags handling").

The fix as a side-effect, however, introduce issue for open(O_ACCMODE)
that is being used for ioctl-only open. I wrote a fix for that, but
instead of it being merged, full revert of 09954bad4 was performed,
re-introducing the O_NDELAY / O_NONBLOCK issue, and it strikes again.

This is a forward-port of the original fix to current codebase; the
original submission had the changelog below:

====
Commit 09954bad4 ("floppy: refactor open() flags handling"), as a
side-effect, causes open(/dev/fdX, O_ACCMODE) to fail. It turns out that
this is being used setfdprm userspace for ioctl-only open().

Reintroduce back the original behavior wrt !(FMODE_READ|FMODE_WRITE)
modes, while still keeping the original O_NDELAY bug fixed.

Link: https://lore.kernel.org/r/nycvar.YFH.7.76.2101221209060.5622@cbobk.fhfr.pm
Cc: stable@vger.kernel.org
Reported-by: Wim Osterholt <wim@djo.tudelft.nl>
Tested-by: Wim Osterholt <wim@djo.tudelft.nl>
Reported-and-tested-by: Kurt Garloff <kurt@garloff.de>
Fixes: 09954bad4 ("floppy: refactor open() flags handling")
Fixes: f2791e7ead ("Revert "floppy: refactor open() flags handling"")
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Denis Efremov <efremov@linux.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/block/floppy.c | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 58ce577ba6d7..31bbe5410b18 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4066,21 +4066,22 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
 	if (UFDCS->rawcmd == 1)
 		UFDCS->rawcmd = 2;
 
-	if (!(mode & FMODE_NDELAY)) {
-		if (mode & (FMODE_READ|FMODE_WRITE)) {
-			UDRS->last_checked = 0;
-			clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
-			check_disk_change(bdev);
-			if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
-				goto out;
-			if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
-				goto out;
-		}
-		res = -EROFS;
-		if ((mode & FMODE_WRITE) &&
-		    !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
+	if (mode & (FMODE_READ|FMODE_WRITE)) {
+		UDRS->last_checked = 0;
+		clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
+		check_disk_change(bdev);
+		if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
+			goto out;
+		if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
 			goto out;
 	}
+
+	res = -EROFS;
+
+	if ((mode & FMODE_WRITE) &&
+			!test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
+		goto out;
+
 	mutex_unlock(&open_lock);
 	mutex_unlock(&floppy_mutex);
 	return 0;

From 014af48242ef0142be6963fdc17d3a47c9d14093 Mon Sep 17 00:00:00 2001
From: Muchun Song <songmuchun@bytedance.com>
Date: Thu, 4 Feb 2021 18:32:06 -0800
Subject: [PATCH 1595/2658] mm: hugetlb: fix a race between freeing and
 dissolving the page

commit 7ffddd499ba6122b1a07828f023d1d67629aa017 upstream

There is a race condition between __free_huge_page()
and dissolve_free_huge_page().

  CPU0:                         CPU1:

  // page_count(page) == 1
  put_page(page)
    __free_huge_page(page)
                                dissolve_free_huge_page(page)
                                  spin_lock(&hugetlb_lock)
                                  // PageHuge(page) && !page_count(page)
                                  update_and_free_page(page)
                                  // page is freed to the buddy
                                  spin_unlock(&hugetlb_lock)
      spin_lock(&hugetlb_lock)
      clear_page_huge_active(page)
      enqueue_huge_page(page)
      // It is wrong, the page is already freed
      spin_unlock(&hugetlb_lock)

The race window is between put_page() and dissolve_free_huge_page().

We should make sure that the page is already on the free list when it is
dissolved.

As a result __free_huge_page would corrupt page(s) already in the buddy
allocator.

Link: https://lkml.kernel.org/r/20210115124942.46403-4-songmuchun@bytedance.com
Fixes: c8721bbbdd36 ("mm: memory-hotplug: enable memory hotplug to handle hugepage")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Reviewed-by: Oscar Salvador <osalvador@suse.de>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Yang Shi <shy828301@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/hugetlb.c | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 7c3ecac8aeb3..13a4f3fe2d91 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -66,6 +66,21 @@ DEFINE_SPINLOCK(hugetlb_lock);
 static int num_fault_mutexes;
 struct mutex *hugetlb_fault_mutex_table ____cacheline_aligned_in_smp;
 
+static inline bool PageHugeFreed(struct page *head)
+{
+	return page_private(head + 4) == -1UL;
+}
+
+static inline void SetPageHugeFreed(struct page *head)
+{
+	set_page_private(head + 4, -1UL);
+}
+
+static inline void ClearPageHugeFreed(struct page *head)
+{
+	set_page_private(head + 4, 0);
+}
+
 /* Forward declaration */
 static int hugetlb_acct_memory(struct hstate *h, long delta);
 
@@ -841,6 +856,7 @@ static void enqueue_huge_page(struct hstate *h, struct page *page)
 	list_move(&page->lru, &h->hugepage_freelists[nid]);
 	h->free_huge_pages++;
 	h->free_huge_pages_node[nid]++;
+	SetPageHugeFreed(page);
 }
 
 static struct page *dequeue_huge_page_node(struct hstate *h, int nid)
@@ -858,6 +874,7 @@ static struct page *dequeue_huge_page_node(struct hstate *h, int nid)
 		return NULL;
 	list_move(&page->lru, &h->hugepage_activelist);
 	set_page_refcounted(page);
+	ClearPageHugeFreed(page);
 	h->free_huge_pages--;
 	h->free_huge_pages_node[nid]--;
 	return page;
@@ -1266,6 +1283,7 @@ static void prep_new_huge_page(struct hstate *h, struct page *page, int nid)
 	set_hugetlb_cgroup(page, NULL);
 	h->nr_huge_pages++;
 	h->nr_huge_pages_node[nid]++;
+	ClearPageHugeFreed(page);
 	spin_unlock(&hugetlb_lock);
 	put_page(page); /* free it into the hugepage allocator */
 }
@@ -1424,11 +1442,32 @@ static int free_pool_huge_page(struct hstate *h, nodemask_t *nodes_allowed,
  */
 static void dissolve_free_huge_page(struct page *page)
 {
+retry:
 	spin_lock(&hugetlb_lock);
 	if (PageHuge(page) && !page_count(page)) {
 		struct page *head = compound_head(page);
 		struct hstate *h = page_hstate(head);
 		int nid = page_to_nid(head);
+
+		/*
+		 * We should make sure that the page is already on the free list
+		 * when it is dissolved.
+		 */
+		if (unlikely(!PageHugeFreed(head))) {
+			spin_unlock(&hugetlb_lock);
+			cond_resched();
+
+			/*
+			 * Theoretically, we should return -EBUSY when we
+			 * encounter this race. In fact, we have a chance
+			 * to successfully dissolve the page if we do a
+			 * retry. Because the race window is quite small.
+			 * If we seize this opportunity, it is an optimization
+			 * for increasing the success rate of dissolving page.
+			 */
+			goto retry;
+		}
+
 		list_del(&head->lru);
 		h->free_huge_pages--;
 		h->free_huge_pages_node[nid]--;

From f382426e0643b206f3e9f42733107fe2b61a5ed0 Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Date: Mon, 1 Feb 2021 21:47:20 +0900
Subject: [PATCH 1596/2658] usb: renesas_usbhs: Clear pipe running flag in
 usbhs_pkt_pop()

commit 9917f0e3cdba7b9f1a23f70e3f70b1a106be54a8 upstream

Should clear the pipe running flag in usbhs_pkt_pop(). Otherwise,
we cannot use this pipe after dequeue was called while the pipe was
running.

Fixes: 8355b2b3082d ("usb: renesas_usbhs: fix the behavior of some usbhs_pkt_handle")
Reported-by: Tho Vu <tho.vu.wh@renesas.com>
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/1612183640-8898-1-git-send-email-yoshihiro.shimoda.uh@renesas.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/renesas_usbhs/fifo.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index 79efb367e5ce..7d329c6bc65f 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -140,6 +140,8 @@ struct usbhs_pkt *usbhs_pkt_pop(struct usbhs_pipe *pipe, struct usbhs_pkt *pkt)
 			usbhsf_dma_unmap(pkt);
 		}
 
+		usbhs_pipe_running(pipe, 0);
+
 		__usbhsf_pkt_del(pkt);
 	}
 

From 63c39377dcbafd1fbd69b3ce826c24e118efc5fa Mon Sep 17 00:00:00 2001
From: Dan Williams <dan.j.williams@intel.com>
Date: Mon, 1 Feb 2021 16:20:40 -0800
Subject: [PATCH 1597/2658] libnvdimm/dimm: Avoid race between probe and
 available_slots_show()

commit 7018c897c2f243d4b5f1b94bc6b4831a7eab80fb upstream

Richard reports that the following test:

(while true; do
     cat /sys/bus/nd/devices/nmem*/available_slots 2>&1 > /dev/null
 done) &

while true; do
     for i in $(seq 0 4); do
         echo nmem$i > /sys/bus/nd/drivers/nvdimm/bind
     done
     for i in $(seq 0 4); do
         echo nmem$i > /sys/bus/nd/drivers/nvdimm/unbind
     done
 done

...fails with a crash signature like:

    divide error: 0000 [#1] SMP KASAN PTI
    RIP: 0010:nd_label_nfree+0x134/0x1a0 [libnvdimm]
    [..]
    Call Trace:
     available_slots_show+0x4e/0x120 [libnvdimm]
     dev_attr_show+0x42/0x80
     ? memset+0x20/0x40
     sysfs_kf_seq_show+0x218/0x410

The root cause is that available_slots_show() consults driver-data, but
fails to synchronize against device-unbind setting up a TOCTOU race to
access uninitialized memory.

Validate driver-data under the device-lock.

Fixes: 4d88a97aa9e8 ("libnvdimm, nvdimm: dimm driver and base libnvdimm device-driver infrastructure")
Cc: <stable@vger.kernel.org>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Ira Weiny <ira.weiny@intel.com>
Cc: Coly Li <colyli@suse.com>
Reported-by: Richard Palethorpe <rpalethorpe@suse.com>
Acked-by: Richard Palethorpe <rpalethorpe@suse.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
[sudip: use device_lock()]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvdimm/dimm_devs.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c
index 9d5e46d44873..4911f1a23c2c 100644
--- a/drivers/nvdimm/dimm_devs.c
+++ b/drivers/nvdimm/dimm_devs.c
@@ -300,16 +300,16 @@ static ssize_t state_show(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR_RO(state);
 
-static ssize_t available_slots_show(struct device *dev,
-		struct device_attribute *attr, char *buf)
+static ssize_t __available_slots_show(struct nvdimm_drvdata *ndd, char *buf)
 {
-	struct nvdimm_drvdata *ndd = dev_get_drvdata(dev);
+	struct device *dev;
 	ssize_t rc;
 	u32 nfree;
 
 	if (!ndd)
 		return -ENXIO;
 
+	dev = ndd->dev;
 	nvdimm_bus_lock(dev);
 	nfree = nd_label_nfree(ndd);
 	if (nfree - 1 > nfree) {
@@ -321,6 +321,18 @@ static ssize_t available_slots_show(struct device *dev,
 	nvdimm_bus_unlock(dev);
 	return rc;
 }
+
+static ssize_t available_slots_show(struct device *dev,
+				    struct device_attribute *attr, char *buf)
+{
+	ssize_t rc;
+
+	device_lock(dev);
+	rc = __available_slots_show(dev_get_drvdata(dev), buf);
+	device_unlock(dev);
+
+	return rc;
+}
 static DEVICE_ATTR_RO(available_slots);
 
 static struct attribute *nvdimm_attributes[] = {

From c39d67f06e8e3fdb787a558a63b8b2dabf60c93f Mon Sep 17 00:00:00 2001
From: Fangrui Song <maskray@google.com>
Date: Fri, 15 Jan 2021 11:52:22 -0800
Subject: [PATCH 1598/2658] module: Ignore _GLOBAL_OFFSET_TABLE_ when warning
 for undefined symbols

commit ebfac7b778fac8b0e8e92ec91d0b055f046b4604 upstream.

clang-12 -fno-pic (since
https://github.com/llvm/llvm-project/commit/a084c0388e2a59b9556f2de0083333232da3f1d6)
can emit `call __stack_chk_fail@PLT` instead of `call __stack_chk_fail`
on x86.  The two forms should have identical behaviors on x86-64 but the
former causes GNU as<2.37 to produce an unreferenced undefined symbol
_GLOBAL_OFFSET_TABLE_.

(On x86-32, there is an R_386_PC32 vs R_386_PLT32 difference but the
linker behavior is identical as far as Linux kernel is concerned.)

Simply ignore _GLOBAL_OFFSET_TABLE_ for now, like what
scripts/mod/modpost.c:ignore_undef_symbol does. This also fixes the
problem for gcc/clang -fpie and -fpic, which may emit `call foo@PLT` for
external function calls on x86.

Note: ld -z defs and dynamic loaders do not error for unreferenced
undefined symbols so the module loader is reading too much.  If we ever
need to ignore more symbols, the code should be refactored to ignore
unreferenced symbols.

Cc: <stable@vger.kernel.org>
Link: https://github.com/ClangBuiltLinux/linux/issues/1250
Link: https://sourceware.org/bugzilla/show_bug.cgi?id=27178
Reported-by: Marco Elver <elver@google.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Tested-by: Marco Elver <elver@google.com>
Signed-off-by: Fangrui Song <maskray@google.com>
Signed-off-by: Jessica Yu <jeyu@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/module.c | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/kernel/module.c b/kernel/module.c
index 3b3c4723fe68..7ce940ab20dc 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2107,6 +2107,21 @@ static int verify_export_symbols(struct module *mod)
 	return 0;
 }
 
+static bool ignore_undef_symbol(Elf_Half emachine, const char *name)
+{
+	/*
+	 * On x86, PIC code and Clang non-PIC code may have call foo@PLT. GNU as
+	 * before 2.37 produces an unreferenced _GLOBAL_OFFSET_TABLE_ on x86-64.
+	 * i386 has a similar problem but may not deserve a fix.
+	 *
+	 * If we ever have to ignore many symbols, consider refactoring the code to
+	 * only warn if referenced by a relocation.
+	 */
+	if (emachine == EM_386 || emachine == EM_X86_64)
+		return !strcmp(name, "_GLOBAL_OFFSET_TABLE_");
+	return false;
+}
+
 /* Change all symbols so that st_value encodes the pointer directly. */
 static int simplify_symbols(struct module *mod, const struct load_info *info)
 {
@@ -2148,8 +2163,10 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
 				break;
 			}
 
-			/* Ok if weak.  */
-			if (!ksym && ELF_ST_BIND(sym[i].st_info) == STB_WEAK)
+			/* Ok if weak or ignored.  */
+			if (!ksym &&
+			    (ELF_ST_BIND(sym[i].st_info) == STB_WEAK ||
+			     ignore_undef_symbol(info->hdr->e_machine, name)))
 				break;
 
 			pr_warn("%s: Unknown symbol %s (err %li)\n",

From 685b5a497ea5078d89d6a3851b55b87e4e7f401d Mon Sep 17 00:00:00 2001
From: Maxim Kiselev <bigunclemax@gmail.com>
Date: Wed, 17 Feb 2021 14:10:00 +0100
Subject: [PATCH 1599/2658] gpio: pcf857x: Fix missing first interrupt

commit a8002a35935aaefcd6a42ad3289f62bab947f2ca upstream.

If no n_latch value will be provided at driver probe then all pins will
be used as an input:

    gpio->out = ~n_latch;

In that case initial state for all pins is "one":

    gpio->status = gpio->out;

So if pcf857x IRQ happens with change pin value from "zero" to "one"
then we miss it, because of "one" from IRQ and "one" from initial state
leaves corresponding pin unchanged:
change = (gpio->status ^ status) & gpio->irq_enabled;

The right solution will be to read actual state at driver probe.

Cc: stable@vger.kernel.org
Fixes: 6e20a0a429bd ("gpio: pcf857x: enable gpio_to_irq() support")
Signed-off-by: Maxim Kiselev <bigunclemax@gmail.com>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpio/gpio-pcf857x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpio/gpio-pcf857x.c b/drivers/gpio/gpio-pcf857x.c
index 1d4d9bc8b69d..0affb47d028a 100644
--- a/drivers/gpio/gpio-pcf857x.c
+++ b/drivers/gpio/gpio-pcf857x.c
@@ -370,7 +370,7 @@ static int pcf857x_probe(struct i2c_client *client,
 	 * reset state.  Otherwise it flags pins to be driven low.
 	 */
 	gpio->out = ~n_latch;
-	gpio->status = gpio->out;
+	gpio->status = gpio->read(gpio->client);
 
 	status = gpiochip_add(&gpio->chip);
 	if (status < 0)

From c9cbf9f1062bdd665ed6776c8359e3aae0642813 Mon Sep 17 00:00:00 2001
From: Chao Yu <yuchao0@huawei.com>
Date: Wed, 16 Dec 2020 17:15:23 +0800
Subject: [PATCH 1600/2658] f2fs: fix out-of-repair __setattr_copy()

commit 2562515f0ad7342bde6456602c491b64c63fe950 upstream.

__setattr_copy() was copied from setattr_copy() in fs/attr.c, there is
two missing patches doesn't cover this inner function, fix it.

Commit 7fa294c8991c ("userns: Allow chown and setgid preservation")
Commit 23adbe12ef7d ("fs,userns: Change inode_capable to capable_wrt_inode_uidgid")

Fixes: fbfa2cc58d53 ("f2fs: add file operations")
Cc: stable@vger.kernel.org
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/f2fs/file.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index bee3bc7a16ac..09185ce2493c 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -666,7 +666,8 @@ static void __setattr_copy(struct inode *inode, const struct iattr *attr)
 	if (ia_valid & ATTR_MODE) {
 		umode_t mode = attr->ia_mode;
 
-		if (!in_group_p(inode->i_gid) && !capable(CAP_FSETID))
+		if (!in_group_p(inode->i_gid) &&
+			!capable_wrt_inode_uidgid(inode, CAP_FSETID))
 			mode &= ~S_ISGID;
 		set_acl_inode(fi, mode);
 	}

From 3b33bc4ad599eb6e1b7439610fb51517019ce8ff Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Mon, 20 Jul 2020 02:21:51 +0100
Subject: [PATCH 1601/2658] sparc32: fix a user-triggerable oops in
 clear_user()

commit 7780918b36489f0b2f9a3749d7be00c2ceaec513 upstream.

Back in 2.1.29 the clear_user() guts (__bzero()) had been merged
with memset().  Unfortunately, while all exception handlers had been
copied, one of the exception table entries got lost.  As the result,
clear_user() starting at 128*n bytes before the end of page and
spanning between 8 and 127 bytes into the next page would oops when
the second page is unmapped.  It's trivial to reproduce - all
it takes is

main()
{
	int fd = open("/dev/zero", O_RDONLY);
	char *p = mmap(NULL, 16384, PROT_READ|PROT_WRITE,
			MAP_PRIVATE|MAP_ANON, -1, 0);
	munmap(p + 8192, 8192);
	read(fd, p + 8192 - 128, 192);
}

which had been oopsing since March 1997.  Says something about
the quality of test coverage... ;-/  And while today sparc32 port
is nearly dead, back in '97 it had been very much alive; in fact,
sparc64 had only been in mainline for 3 months by that point...

Cc: stable@kernel.org
Fixes: v2.1.29
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/sparc/lib/memset.S | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/sparc/lib/memset.S b/arch/sparc/lib/memset.S
index f75e6906df14..19000777f7c9 100644
--- a/arch/sparc/lib/memset.S
+++ b/arch/sparc/lib/memset.S
@@ -137,6 +137,7 @@ __bzero:
 	ZERO_LAST_BLOCKS(%o0, 0x48, %g2)
 	ZERO_LAST_BLOCKS(%o0, 0x08, %g2)
 13:
+	EXT(12b, 13b, 21f)
 	be	8f
 	 andcc	%o1, 4, %g0
 

From 4226354df9eea85af78b3ba24d37e3f132c0c4e8 Mon Sep 17 00:00:00 2001
From: Bob Peterson <rpeterso@redhat.com>
Date: Fri, 5 Feb 2021 13:50:41 -0500
Subject: [PATCH 1602/2658] gfs2: Don't skip dlm unlock if glock has an lvb

commit 78178ca844f0eb88f21f31c7fde969384be4c901 upstream.

Patch fb6791d100d1 was designed to allow gfs2 to unmount quicker by
skipping the step where it tells dlm to unlock glocks in EX with lvbs.
This was done because when gfs2 unmounts a file system, it destroys the
dlm lockspace shortly after it destroys the glocks so it doesn't need to
unlock them all: the unlock is implied when the lockspace is destroyed
by dlm.

However, that patch introduced a use-after-free in dlm: as part of its
normal dlm_recoverd process, it can call ls_recovery to recover dead
locks. In so doing, it can call recover_rsbs which calls recover_lvb for
any mastered rsbs. Func recover_lvb runs through the list of lkbs queued
to the given rsb (if the glock is cached but unlocked, it will still be
queued to the lkb, but in NL--Unlocked--mode) and if it has an lvb,
copies it to the rsb, thus trying to preserve the lkb. However, when
gfs2 skips the dlm unlock step, it frees the glock and its lvb, which
means dlm's function recover_lvb references the now freed lvb pointer,
copying the freed lvb memory to the rsb.

This patch changes the check in gdlm_put_lock so that it calls
dlm_unlock for all glocks that contain an lvb pointer.

Fixes: fb6791d100d1 ("GFS2: skip dlm_unlock calls in unmount")
Cc: stable@vger.kernel.org # v3.8+
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/gfs2/lock_dlm.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index 3c3d037df824..3cbc9147286d 100644
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -284,7 +284,6 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
 {
 	struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
 	struct lm_lockstruct *ls = &sdp->sd_lockstruct;
-	int lvb_needs_unlock = 0;
 	int error;
 
 	if (gl->gl_lksb.sb_lkid == 0) {
@@ -297,13 +296,10 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
 	gfs2_sbstats_inc(gl, GFS2_LKS_DCOUNT);
 	gfs2_update_request_times(gl);
 
-	/* don't want to skip dlm_unlock writing the lvb when lock is ex */
-
-	if (gl->gl_lksb.sb_lvbptr && (gl->gl_state == LM_ST_EXCLUSIVE))
-		lvb_needs_unlock = 1;
+	/* don't want to skip dlm_unlock writing the lvb when lock has one */
 
 	if (test_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags) &&
-	    !lvb_needs_unlock) {
+	    !gl->gl_lksb.sb_lvbptr) {
 		gfs2_glock_free(gl);
 		return;
 	}

From f76b6d239ae5be5b1a9e9d74dca3d75815f17e46 Mon Sep 17 00:00:00 2001
From: Nikos Tsironis <ntsironis@arrikto.com>
Date: Fri, 22 Jan 2021 17:19:30 +0200
Subject: [PATCH 1603/2658] dm era: Recover committed writeset after crash

commit de89afc1e40fdfa5f8b666e5d07c43d21a1d3be0 upstream.

Following a system crash, dm-era fails to recover the committed writeset
for the current era, leading to lost writes. That is, we lose the
information about what blocks were written during the affected era.

dm-era assumes that the writeset of the current era is archived when the
device is suspended. So, when resuming the device, it just moves on to
the next era, ignoring the committed writeset.

This assumption holds when the device is properly shut down. But, when
the system crashes, the code that suspends the target never runs, so the
writeset for the current era is not archived.

There are three issues that cause the committed writeset to get lost:

1. dm-era doesn't load the committed writeset when opening the metadata
2. The code that resizes the metadata wipes the information about the
   committed writeset (assuming it was loaded at step 1)
3. era_preresume() starts a new era, without taking into account that
   the current era might not have been archived, due to a system crash.

To fix this:

1. Load the committed writeset when opening the metadata
2. Fix the code that resizes the metadata to make sure it doesn't wipe
   the loaded writeset
3. Fix era_preresume() to check for a loaded writeset and archive it,
   before starting a new era.

Fixes: eec40579d84873 ("dm: add era target")
Cc: stable@vger.kernel.org # v3.15+
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-era-target.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c
index 32e76c5ee741..95ac9346540c 100644
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -70,8 +70,6 @@ static size_t bitset_size(unsigned nr_bits)
  */
 static int writeset_alloc(struct writeset *ws, dm_block_t nr_blocks)
 {
-	ws->md.nr_bits = nr_blocks;
-	ws->md.root = INVALID_WRITESET_ROOT;
 	ws->bits = vzalloc(bitset_size(nr_blocks));
 	if (!ws->bits) {
 		DMERR("%s: couldn't allocate in memory bitset", __func__);
@@ -84,12 +82,14 @@ static int writeset_alloc(struct writeset *ws, dm_block_t nr_blocks)
 /*
  * Wipes the in-core bitset, and creates a new on disk bitset.
  */
-static int writeset_init(struct dm_disk_bitset *info, struct writeset *ws)
+static int writeset_init(struct dm_disk_bitset *info, struct writeset *ws,
+			 dm_block_t nr_blocks)
 {
 	int r;
 
-	memset(ws->bits, 0, bitset_size(ws->md.nr_bits));
+	memset(ws->bits, 0, bitset_size(nr_blocks));
 
+	ws->md.nr_bits = nr_blocks;
 	r = setup_on_disk_bitset(info, ws->md.nr_bits, &ws->md.root);
 	if (r) {
 		DMERR("%s: setup_on_disk_bitset failed", __func__);
@@ -579,6 +579,7 @@ static int open_metadata(struct era_metadata *md)
 	md->nr_blocks = le32_to_cpu(disk->nr_blocks);
 	md->current_era = le32_to_cpu(disk->current_era);
 
+	ws_unpack(&disk->current_writeset, &md->current_writeset->md);
 	md->writeset_tree_root = le64_to_cpu(disk->writeset_tree_root);
 	md->era_array_root = le64_to_cpu(disk->era_array_root);
 	md->metadata_snap = le64_to_cpu(disk->metadata_snap);
@@ -871,7 +872,6 @@ static int metadata_era_archive(struct era_metadata *md)
 	}
 
 	ws_pack(&md->current_writeset->md, &value);
-	md->current_writeset->md.root = INVALID_WRITESET_ROOT;
 
 	keys[0] = md->current_era;
 	__dm_bless_for_disk(&value);
@@ -883,6 +883,7 @@ static int metadata_era_archive(struct era_metadata *md)
 		return r;
 	}
 
+	md->current_writeset->md.root = INVALID_WRITESET_ROOT;
 	md->archived_writesets = true;
 
 	return 0;
@@ -899,7 +900,7 @@ static int metadata_new_era(struct era_metadata *md)
 	int r;
 	struct writeset *new_writeset = next_writeset(md);
 
-	r = writeset_init(&md->bitset_info, new_writeset);
+	r = writeset_init(&md->bitset_info, new_writeset, md->nr_blocks);
 	if (r) {
 		DMERR("%s: writeset_init failed", __func__);
 		return r;
@@ -952,7 +953,7 @@ static int metadata_commit(struct era_metadata *md)
 	int r;
 	struct dm_block *sblock;
 
-	if (md->current_writeset->md.root != SUPERBLOCK_LOCATION) {
+	if (md->current_writeset->md.root != INVALID_WRITESET_ROOT) {
 		r = dm_bitset_flush(&md->bitset_info, md->current_writeset->md.root,
 				    &md->current_writeset->md.root);
 		if (r) {
@@ -1582,7 +1583,7 @@ static int era_preresume(struct dm_target *ti)
 
 	start_worker(era);
 
-	r = in_worker0(era, metadata_new_era);
+	r = in_worker0(era, metadata_era_rollover);
 	if (r) {
 		DMERR("%s: metadata_era_rollover failed", __func__);
 		return r;

From 1b913670d312fac2b4222493a69497b7828f7f53 Mon Sep 17 00:00:00 2001
From: Nikos Tsironis <ntsironis@arrikto.com>
Date: Fri, 22 Jan 2021 17:25:53 +0200
Subject: [PATCH 1604/2658] dm era: Verify the data block size hasn't changed

commit c8e846ff93d5eaa5384f6f325a1687ac5921aade upstream.

dm-era doesn't support changing the data block size of existing devices,
so check explicitly that the requested block size for a new target
matches the one stored in the metadata.

Fixes: eec40579d84873 ("dm: add era target")
Cc: stable@vger.kernel.org # v3.15+
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Reviewed-by: Ming-Hung Tsai <mtsai@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-era-target.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c
index 95ac9346540c..2d0e86f40b7e 100644
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -564,6 +564,15 @@ static int open_metadata(struct era_metadata *md)
 	}
 
 	disk = dm_block_data(sblock);
+
+	/* Verify the data block size hasn't changed */
+	if (le32_to_cpu(disk->data_block_size) != md->block_size) {
+		DMERR("changing the data block size (from %u to %llu) is not supported",
+		      le32_to_cpu(disk->data_block_size), md->block_size);
+		r = -EINVAL;
+		goto bad;
+	}
+
 	r = dm_tm_open_with_sm(md->bm, SUPERBLOCK_LOCATION,
 			       disk->metadata_space_map_root,
 			       sizeof(disk->metadata_space_map_root),
@@ -575,7 +584,6 @@ static int open_metadata(struct era_metadata *md)
 
 	setup_infos(md);
 
-	md->block_size = le32_to_cpu(disk->data_block_size);
 	md->nr_blocks = le32_to_cpu(disk->nr_blocks);
 	md->current_era = le32_to_cpu(disk->current_era);
 

From a82ae652cbd42afc96e9938f74786fbbd38358c6 Mon Sep 17 00:00:00 2001
From: Nikos Tsironis <ntsironis@arrikto.com>
Date: Fri, 22 Jan 2021 17:25:54 +0200
Subject: [PATCH 1605/2658] dm era: Fix bitset memory leaks

commit 904e6b266619c2da5c58b5dce14ae30629e39645 upstream.

Deallocate the memory allocated for the in-core bitsets when destroying
the target and in error paths.

Fixes: eec40579d84873 ("dm: add era target")
Cc: stable@vger.kernel.org # v3.15+
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Reviewed-by: Ming-Hung Tsai <mtsai@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-era-target.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c
index 2d0e86f40b7e..a499d6f0e7b9 100644
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -46,6 +46,7 @@ struct writeset {
 static void writeset_free(struct writeset *ws)
 {
 	vfree(ws->bits);
+	ws->bits = NULL;
 }
 
 static int setup_on_disk_bitset(struct dm_disk_bitset *info,
@@ -812,6 +813,8 @@ static struct era_metadata *metadata_open(struct block_device *bdev,
 
 static void metadata_close(struct era_metadata *md)
 {
+	writeset_free(&md->writesets[0]);
+	writeset_free(&md->writesets[1]);
 	destroy_persistent_data_objects(md);
 	kfree(md);
 }
@@ -849,6 +852,7 @@ static int metadata_resize(struct era_metadata *md, void *arg)
 	r = writeset_alloc(&md->writesets[1], *new_size);
 	if (r) {
 		DMERR("%s: writeset_alloc failed for writeset 1", __func__);
+		writeset_free(&md->writesets[0]);
 		return r;
 	}
 
@@ -859,6 +863,8 @@ static int metadata_resize(struct era_metadata *md, void *arg)
 			    &value, &md->era_array_root);
 	if (r) {
 		DMERR("%s: dm_array_resize failed", __func__);
+		writeset_free(&md->writesets[0]);
+		writeset_free(&md->writesets[1]);
 		return r;
 	}
 

From 8ec45d9e54949303f4869bfebf9c2ea3d3eeffc1 Mon Sep 17 00:00:00 2001
From: Nikos Tsironis <ntsironis@arrikto.com>
Date: Fri, 22 Jan 2021 17:25:55 +0200
Subject: [PATCH 1606/2658] dm era: Use correct value size in equality function
 of writeset tree

commit 64f2d15afe7b336aafebdcd14cc835ecf856df4b upstream.

Fix the writeset tree equality test function to use the right value size
when comparing two btree values.

Fixes: eec40579d84873 ("dm: add era target")
Cc: stable@vger.kernel.org # v3.15+
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Reviewed-by: Ming-Hung Tsai <mtsai@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-era-target.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c
index a499d6f0e7b9..1582d5298ae9 100644
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -389,7 +389,7 @@ static void ws_dec(void *context, const void *value)
 
 static int ws_eq(void *context, const void *value1, const void *value2)
 {
-	return !memcmp(value1, value2, sizeof(struct writeset_metadata));
+	return !memcmp(value1, value2, sizeof(struct writeset_disk));
 }
 
 /*----------------------------------------------------------------*/

From 683df5bed773fbd7d227decec6123fba04a38220 Mon Sep 17 00:00:00 2001
From: Nikos Tsironis <ntsironis@arrikto.com>
Date: Fri, 22 Jan 2021 17:22:04 +0200
Subject: [PATCH 1607/2658] dm era: Reinitialize bitset cache before digesting
 a new writeset

commit 2524933307fd0036d5c32357c693c021ab09a0b0 upstream.

In case of devices with at most 64 blocks, the digestion of consecutive
eras uses the writeset of the first era as the writeset of all eras to
digest, leading to lost writes. That is, we lose the information about
what blocks were written during the affected eras.

The digestion code uses a dm_disk_bitset object to access the archived
writesets. This structure includes a one word (64-bit) cache to reduce
the number of array lookups.

This structure is initialized only once, in metadata_digest_start(),
when we kick off digestion.

But, when we insert a new writeset into the writeset tree, before the
digestion of the previous writeset is done, or equivalently when there
are multiple writesets in the writeset tree to digest, then all these
writesets are digested using the same cache and the cache is not
re-initialized when moving from one writeset to the next.

For devices with more than 64 blocks, i.e., the size of the cache, the
cache is indirectly invalidated when we move to a next set of blocks, so
we avoid the bug.

But for devices with at most 64 blocks we end up using the same cached
data for digesting all archived writesets, i.e., the cache is loaded
when digesting the first writeset and it never gets reloaded, until the
digestion is done.

As a result, the writeset of the first era to digest is used as the
writeset of all the following archived eras, leading to lost writes.

Fix this by reinitializing the dm_disk_bitset structure, and thus
invalidating the cache, every time the digestion code starts digesting a
new writeset.

Fixes: eec40579d84873 ("dm: add era target")
Cc: stable@vger.kernel.org # v3.15+
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-era-target.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c
index 1582d5298ae9..f86bfe3ebcbf 100644
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -757,6 +757,12 @@ static int metadata_digest_lookup_writeset(struct era_metadata *md,
 	ws_unpack(&disk, &d->writeset);
 	d->value = cpu_to_le32(key);
 
+	/*
+	 * We initialise another bitset info to avoid any caching side effects
+	 * with the previous one.
+	 */
+	dm_disk_bitset_init(md->tm, &d->info);
+
 	d->nr_bits = min(d->writeset.nr_bits, md->nr_blocks);
 	d->current_bit = 0;
 	d->step = metadata_digest_transcribe_writeset;
@@ -770,12 +776,6 @@ static int metadata_digest_start(struct era_metadata *md, struct digest *d)
 		return 0;
 
 	memset(d, 0, sizeof(*d));
-
-	/*
-	 * We initialise another bitset info to avoid any caching side
-	 * effects with the previous one.
-	 */
-	dm_disk_bitset_init(md->tm, &d->info);
 	d->step = metadata_digest_lookup_writeset;
 
 	return 0;

From ed1892684d89271be0d3d973b21f52f85b22b23a Mon Sep 17 00:00:00 2001
From: Nikos Tsironis <ntsironis@arrikto.com>
Date: Thu, 11 Feb 2021 16:22:43 +0200
Subject: [PATCH 1608/2658] dm era: only resize metadata in preresume

commit cca2c6aebe86f68103a8615074b3578e854b5016 upstream.

Metadata resize shouldn't happen in the ctr. The ctr loads a temporary
(inactive) table that will only become active upon resume. That is why
resize should always be done in terms of resume. Otherwise a load (ctr)
whose inactive table never becomes active will incorrectly resize the
metadata.

Also, perform the resize directly in preresume, instead of using the
worker to do it.

The worker might run other metadata operations, e.g., it could start
digestion, before resizing the metadata. These operations will end up
using the old size.

This could lead to errors, like:

  device-mapper: era: metadata_digest_transcribe_writeset: dm_array_set_value failed
  device-mapper: era: process_old_eras: digest step failed, stopping digestion

The reason of the above error is that the worker started the digestion
of the archived writeset using the old, larger size.

As a result, metadata_digest_transcribe_writeset tried to write beyond
the end of the era array.

Fixes: eec40579d84873 ("dm: add era target")
Cc: stable@vger.kernel.org # v3.15+
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-era-target.c | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c
index f86bfe3ebcbf..e91302079043 100644
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -1502,15 +1502,6 @@ static int era_ctr(struct dm_target *ti, unsigned argc, char **argv)
 	}
 	era->md = md;
 
-	era->nr_blocks = calc_nr_blocks(era);
-
-	r = metadata_resize(era->md, &era->nr_blocks);
-	if (r) {
-		ti->error = "couldn't resize metadata";
-		era_destroy(era);
-		return -ENOMEM;
-	}
-
 	era->wq = alloc_ordered_workqueue("dm-" DM_MSG_PREFIX, WQ_MEM_RECLAIM);
 	if (!era->wq) {
 		ti->error = "could not create workqueue for metadata object";
@@ -1588,9 +1579,17 @@ static int era_preresume(struct dm_target *ti)
 	dm_block_t new_size = calc_nr_blocks(era);
 
 	if (era->nr_blocks != new_size) {
-		r = in_worker1(era, metadata_resize, &new_size);
-		if (r)
+		r = metadata_resize(era->md, &new_size);
+		if (r) {
+			DMERR("%s: metadata_resize failed", __func__);
 			return r;
+		}
+
+		r = metadata_commit(era->md);
+		if (r) {
+			DMERR("%s: metadata_commit failed", __func__);
+			return r;
+		}
 
 		era->nr_blocks = new_size;
 	}

From 1272825e80621cbd0e262e81f0838cbf317d31ad Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Mon, 22 Jan 2018 11:39:47 +0100
Subject: [PATCH 1609/2658] futex: Fix OWNER_DEAD fixup

commit a97cb0e7b3f4c6297fd857055ae8e895f402f501 upstream.

Both Geert and DaveJ reported that the recent futex commit:

  c1e2f0eaf015 ("futex: Avoid violating the 10th rule of futex")

introduced a problem with setting OWNER_DEAD. We set the bit on an
uninitialized variable and then entirely optimize it away as a
dead-store.

Move the setting of the bit to where it is more useful.

Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reported-by: Dave Jones <davej@codemonkey.org.uk>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@us.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: c1e2f0eaf015 ("futex: Avoid violating the 10th rule of futex")
Link: http://lkml.kernel.org/r/20180122103947.GD2228@hirez.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Reviewed-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 4ecf73d2c19a..73b9a8780bfe 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2248,10 +2248,6 @@ static int __fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 
 	oldowner = pi_state->owner;
 
-	/* Owner died? */
-	if (!pi_state->owner)
-		newtid |= FUTEX_OWNER_DIED;
-
 	/*
 	 * We are here because either:
 	 *
@@ -2309,6 +2305,9 @@ static int __fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 	}
 
 	newtid = task_pid_vnr(newowner) | FUTEX_WAITERS;
+	/* Owner died? */
+	if (!pi_state->owner)
+		newtid |= FUTEX_OWNER_DIED;
 
 	if (get_futex_value_locked(&uval, uaddr))
 		goto handle_fault;

From 795ebd321c4dd389be270bf199648252a18fbf41 Mon Sep 17 00:00:00 2001
From: Nikos Tsironis <ntsironis@arrikto.com>
Date: Fri, 22 Jan 2021 17:19:31 +0200
Subject: [PATCH 1610/2658] dm era: Update in-core bitset after committing the
 metadata

commit 2099b145d77c1d53f5711f029c37cc537897cee6 upstream.

In case of a system crash, dm-era might fail to mark blocks as written
in its metadata, although the corresponding writes to these blocks were
passed down to the origin device and completed successfully.

Consider the following sequence of events:

1. We write to a block that has not been yet written in the current era
2. era_map() checks the in-core bitmap for the current era and sees
   that the block is not marked as written.
3. The write is deferred for submission after the metadata have been
   updated and committed.
4. The worker thread processes the deferred write
   (process_deferred_bios()) and marks the block as written in the
   in-core bitmap, **before** committing the metadata.
5. The worker thread starts committing the metadata.
6. We do more writes that map to the same block as the write of step (1)
7. era_map() checks the in-core bitmap and sees that the block is marked
   as written, **although the metadata have not been committed yet**.
8. These writes are passed down to the origin device immediately and the
   device reports them as completed.
9. The system crashes, e.g., power failure, before the commit from step
   (5) finishes.

When the system recovers and we query the dm-era target for the list of
written blocks it doesn't report the aforementioned block as written,
although the writes of step (6) completed successfully.

The issue is that era_map() decides whether to defer or not a write
based on non committed information. The root cause of the bug is that we
update the in-core bitmap, **before** committing the metadata.

Fix this by updating the in-core bitmap **after** successfully
committing the metadata.

Fixes: eec40579d84873 ("dm: add era target")
Cc: stable@vger.kernel.org # v3.15+
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-era-target.c | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c
index e91302079043..b34e0e3b35b6 100644
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -134,7 +134,7 @@ static int writeset_test_and_set(struct dm_disk_bitset *info,
 {
 	int r;
 
-	if (!test_and_set_bit(block, ws->bits)) {
+	if (!test_bit(block, ws->bits)) {
 		r = dm_bitset_set_bit(info, ws->md.root, block, &ws->md.root);
 		if (r) {
 			/* FIXME: fail mode */
@@ -1242,8 +1242,10 @@ static void process_deferred_bios(struct era *era)
 	int r;
 	struct bio_list deferred_bios, marked_bios;
 	struct bio *bio;
+	struct blk_plug plug;
 	bool commit_needed = false;
 	bool failed = false;
+	struct writeset *ws = era->md->current_writeset;
 
 	bio_list_init(&deferred_bios);
 	bio_list_init(&marked_bios);
@@ -1253,9 +1255,11 @@ static void process_deferred_bios(struct era *era)
 	bio_list_init(&era->deferred_bios);
 	spin_unlock(&era->deferred_lock);
 
+	if (bio_list_empty(&deferred_bios))
+		return;
+
 	while ((bio = bio_list_pop(&deferred_bios))) {
-		r = writeset_test_and_set(&era->md->bitset_info,
-					  era->md->current_writeset,
+		r = writeset_test_and_set(&era->md->bitset_info, ws,
 					  get_block(era, bio));
 		if (r < 0) {
 			/*
@@ -1263,7 +1267,6 @@ static void process_deferred_bios(struct era *era)
 			 * FIXME: finish.
 			 */
 			failed = true;
-
 		} else if (r == 0)
 			commit_needed = true;
 
@@ -1279,9 +1282,19 @@ static void process_deferred_bios(struct era *era)
 	if (failed)
 		while ((bio = bio_list_pop(&marked_bios)))
 			bio_io_error(bio);
-	else
-		while ((bio = bio_list_pop(&marked_bios)))
+	else {
+		blk_start_plug(&plug);
+		while ((bio = bio_list_pop(&marked_bios))) {
+			/*
+			 * Only update the in-core writeset if the on-disk one
+			 * was updated too.
+			 */
+			if (commit_needed)
+				set_bit(get_block(era, bio), ws->bits);
 			generic_make_request(bio);
+		}
+		blk_finish_plug(&plug);
+	}
 }
 
 static void process_rpc_calls(struct era *era)

From c708a4d0c1ef730a1fc17767998cff59b08f65cf Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 3 Mar 2021 16:44:24 +0100
Subject: [PATCH 1611/2658] Linux 4.4.259

Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Link: https://lore.kernel.org/r/20210301161006.881950696@linuxfoundation.org
Link: https://lore.kernel.org/r/20210302192525.276142994@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index d7d273a3bea4..8a616e116f8a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 258
+SUBLEVEL = 259
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 3740abd38025f9bab6bdf09d3e36ff7104d525e4 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Wed, 20 Jan 2021 16:00:24 +0100
Subject: [PATCH 1612/2658] futex: Ensure the correct return value from
 futex_lock_pi()

commit 12bb3f7f1b03d5913b3f9d4236a488aa7774dfe9 upstream.

In case that futex_lock_pi() was aborted by a signal or a timeout and the
task returned without acquiring the rtmutex, but is the designated owner of
the futex due to a concurrent futex_unlock_pi() fixup_owner() is invoked to
establish consistent state. In that case it invokes fixup_pi_state_owner()
which in turn tries to acquire the rtmutex again. If that succeeds then it
does not propagate this success to fixup_owner() and futex_lock_pi()
returns -EINTR or -ETIMEOUT despite having the futex locked.

Return success from fixup_pi_state_owner() in all cases where the current
task owns the rtmutex and therefore the futex and propagate it correctly
through fixup_owner(). Fixup the other callsite which does not expect a
positive return value.

Fixes: c1e2f0eaf015 ("futex: Avoid violating the 10th rule of futex")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
[Sharan: Backported patch for kernel 4.4.y. Also folded in is a part
 of the cleanup patch d7c5ed73b19c("futex: Remove needless goto's")]
Signed-off-by: Sharan Turlapati <sturlapati@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 73b9a8780bfe..195d89a64fe5 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2283,7 +2283,7 @@ static int __fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 		}
 
 		if (__rt_mutex_futex_trylock(&pi_state->pi_mutex)) {
-			/* We got the lock after all, nothing to fix. */
+			/* We got the lock. pi_state is correct. Tell caller */
 			return 1;
 		}
 
@@ -2328,7 +2328,7 @@ static int __fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 	 */
 	pi_state_update_owner(pi_state, newowner);
 
-	return 0;
+	return argowner == current;
 
 	/*
 	 * To handle the page fault we need to drop the hash bucket
@@ -2411,8 +2411,6 @@ static long futex_wait_restart(struct restart_block *restart);
  */
 static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
 {
-	int ret = 0;
-
 	if (locked) {
 		/*
 		 * Got the lock. We might not be the anticipated owner if we
@@ -2423,8 +2421,8 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
 		 * stable state, anything else needs more attention.
 		 */
 		if (q->pi_state->owner != current)
-			ret = fixup_pi_state_owner(uaddr, q, current);
-		goto out;
+			return fixup_pi_state_owner(uaddr, q, current);
+		return 1;
 	}
 
 	/*
@@ -2435,10 +2433,8 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
 	 * Another speculative read; pi_state->owner == current is unstable
 	 * but needs our attention.
 	 */
-	if (q->pi_state->owner == current) {
-		ret = fixup_pi_state_owner(uaddr, q, NULL);
-		goto out;
-	}
+	if (q->pi_state->owner == current)
+		return fixup_pi_state_owner(uaddr, q, NULL);
 
 	/*
 	 * Paranoia check. If we did not take the lock, then we should not be
@@ -2447,8 +2443,7 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
 	if (WARN_ON_ONCE(rt_mutex_owner(&q->pi_state->pi_mutex) == current))
 		return fixup_pi_state_owner(uaddr, q, current);
 
-out:
-	return ret ? ret : locked;
+	return 0;
 }
 
 /**
@@ -3070,6 +3065,11 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
 			 */
 			free_pi_state(q.pi_state);
 			spin_unlock(q.lock_ptr);
+			/*
+			 * Adjust the return value. It's either -EFAULT or
+			 * success (1) but the caller expects 0 for success.
+			 */
+			ret = ret < 0 ? ret : 0;
 		}
 	} else {
 		struct rt_mutex *pi_mutex;

From 7066996add4a84a6bf34baaa83943c2c2a86ebcd Mon Sep 17 00:00:00 2001
From: Lech Perczak <lech.perczak@gmail.com>
Date: Tue, 23 Feb 2021 19:34:56 +0100
Subject: [PATCH 1613/2658] net: usb: qmi_wwan: support ZTE P685M modem
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 88eee9b7b42e69fb622ddb3ff6f37e8e4347f5b2 upstream.

Now that interface 3 in "option" driver is no longer mapped, add device
ID matching it to qmi_wwan.

The modem is used inside ZTE MF283+ router and carriers identify it as
such.
Interface mapping is:
0: QCDM, 1: AT (PCUI), 2: AT (Modem), 3: QMI, 4: ADB

T:  Bus=02 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#=  3 Spd=480  MxCh= 0
D:  Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=19d2 ProdID=1275 Rev=f0.00
S:  Manufacturer=ZTE,Incorporated
S:  Product=ZTE Technologies MSM
S:  SerialNumber=P685M510ZTED0000CP&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&0
C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=85(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E:  Ad=87(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E:  Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://lore.kernel.org/r/20210223183456.6377-1-lech.perczak@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/qmi_wwan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 3f18faf99367..943dab8ef1e2 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -877,6 +877,7 @@ static const struct usb_device_id products[] = {
 	{QMI_FIXED_INTF(0x19d2, 0x1255, 4)},
 	{QMI_FIXED_INTF(0x19d2, 0x1256, 4)},
 	{QMI_FIXED_INTF(0x19d2, 0x1270, 5)},	/* ZTE MF667 */
+	{QMI_FIXED_INTF(0x19d2, 0x1275, 3)},	/* ZTE P685M */
 	{QMI_FIXED_INTF(0x19d2, 0x1401, 2)},
 	{QMI_FIXED_INTF(0x19d2, 0x1402, 2)},	/* ZTE MF60 */
 	{QMI_FIXED_INTF(0x19d2, 0x1424, 2)},

From 2168c6185b621ac89719cdaa595d634c0987e9c3 Mon Sep 17 00:00:00 2001
From: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
Date: Wed, 3 Mar 2021 16:57:31 +0900
Subject: [PATCH 1614/2658] iwlwifi: pcie: fix to correct null check

The fixes made in commit: 4ae5798004d8 ("iwlwifi: pcie: add a NULL check in
iwl_pcie_txq_unmap") is not enough in 4.4.y tree.. This still have problems
with null references. This provides the correct fix.
Also, this is a problem only in 4.4.y. This patch has been applied to other
LTS trees, but with the correct fixes.

Fixes: 4ae5798004d8 ("iwlwifi: pcie: add a NULL check in iwl_pcie_txq_unmap")
Cc: stable@vger.kernel.org
Cc: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Cc: Luca Coelho <luciano.coelho@intel.com>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: Sasha Levin <sashal@kernel.org>
Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/iwlwifi/pcie/tx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index cb03c2855019..7584796131fa 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -583,13 +583,15 @@ static void iwl_pcie_txq_unmap(struct iwl_trans *trans, int txq_id)
 {
 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 	struct iwl_txq *txq = &trans_pcie->txq[txq_id];
-	struct iwl_queue *q = &txq->q;
+	struct iwl_queue *q;
 
 	if (!txq) {
 		IWL_ERR(trans, "Trying to free a queue that wasn't allocated?\n");
 		return;
 	}
 
+	q = &txq->q;
+
 	spin_lock_bh(&txq->lock);
 	while (q->write_ptr != q->read_ptr) {
 		IWL_DEBUG_TX_REPLY(trans, "Q %d Free %d\n",

From 16d01a7b0aca86da4236ee32e9e5bc7a90ccdd89 Mon Sep 17 00:00:00 2001
From: Frank Li <Frank.Li@nxp.com>
Date: Wed, 10 Feb 2021 12:19:33 -0600
Subject: [PATCH 1615/2658] mmc: sdhci-esdhc-imx: fix kernel panic when remove
 module

commit a56f44138a2c57047f1ea94ea121af31c595132b upstream.

In sdhci_esdhc_imx_remove() the SDHCI_INT_STATUS in read. Under some
circumstances, this may be done while the device is runtime suspended,
triggering the below splat.

Fix the problem by adding a pm_runtime_get_sync(), before reading the
register, which will turn on clocks etc making the device accessible again.

[ 1811.323148] mmc1: card aaaa removed
[ 1811.347483] Internal error: synchronous external abort: 96000210 [#1] PREEMPT SMP
[ 1811.354988] Modules linked in: sdhci_esdhc_imx(-) sdhci_pltfm sdhci cqhci mmc_block mmc_core [last unloaded: mmc_core]
[ 1811.365726] CPU: 0 PID: 3464 Comm: rmmod Not tainted 5.10.1-sd-99871-g53835a2e8186 #5
[ 1811.373559] Hardware name: Freescale i.MX8DXL EVK (DT)
[ 1811.378705] pstate: 60000005 (nZCv daif -PAN -UAO -TCO BTYPE=--)
[ 1811.384723] pc : sdhci_esdhc_imx_remove+0x28/0x15c [sdhci_esdhc_imx]
[ 1811.391090] lr : platform_drv_remove+0x2c/0x50
[ 1811.395536] sp : ffff800012c7bcb0
[ 1811.398855] x29: ffff800012c7bcb0 x28: ffff00002c72b900
[ 1811.404181] x27: 0000000000000000 x26: 0000000000000000
[ 1811.409497] x25: 0000000000000000 x24: 0000000000000000
[ 1811.414814] x23: ffff0000042b3890 x22: ffff800009127120
[ 1811.420131] x21: ffff00002c4c9580 x20: ffff0000042d0810
[ 1811.425456] x19: ffff0000042d0800 x18: 0000000000000020
[ 1811.430773] x17: 0000000000000000 x16: 0000000000000000
[ 1811.436089] x15: 0000000000000004 x14: ffff000004019c10
[ 1811.441406] x13: 0000000000000000 x12: 0000000000000020
[ 1811.446723] x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
[ 1811.452040] x9 : fefefeff6364626d x8 : 7f7f7f7f7f7f7f7f
[ 1811.457356] x7 : 78725e6473607372 x6 : 0000000080808080
[ 1811.462673] x5 : 0000000000000000 x4 : 0000000000000000
[ 1811.467990] x3 : ffff800011ac1cb0 x2 : 0000000000000000
[ 1811.473307] x1 : ffff8000091214d4 x0 : ffff8000133a0030
[ 1811.478624] Call trace:
[ 1811.481081]  sdhci_esdhc_imx_remove+0x28/0x15c [sdhci_esdhc_imx]
[ 1811.487098]  platform_drv_remove+0x2c/0x50
[ 1811.491198]  __device_release_driver+0x188/0x230
[ 1811.495818]  driver_detach+0xc0/0x14c
[ 1811.499487]  bus_remove_driver+0x5c/0xb0
[ 1811.503413]  driver_unregister+0x30/0x60
[ 1811.507341]  platform_driver_unregister+0x14/0x20
[ 1811.512048]  sdhci_esdhc_imx_driver_exit+0x1c/0x3a8 [sdhci_esdhc_imx]
[ 1811.518495]  __arm64_sys_delete_module+0x19c/0x230
[ 1811.523291]  el0_svc_common.constprop.0+0x78/0x1a0
[ 1811.528086]  do_el0_svc+0x24/0x90
[ 1811.531405]  el0_svc+0x14/0x20
[ 1811.534461]  el0_sync_handler+0x1a4/0x1b0
[ 1811.538474]  el0_sync+0x174/0x180
[ 1811.541801] Code: a9025bf5 f9403e95 f9400ea0 9100c000 (b9400000)
[ 1811.547902] ---[ end trace 3fb1a3bd48ff7be5 ]---

Signed-off-by: Frank Li <Frank.Li@nxp.com>
Cc: stable@vger.kernel.org # v4.0+
Link: https://lore.kernel.org/r/20210210181933.29263-1-Frank.Li@nxp.com
[Ulf: Clarified the commit message a bit]
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
[iwamatsu: adjust context]
Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/sdhci-esdhc-imx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index 8d838779fd1b..b95d911ef497 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -1240,9 +1240,10 @@ static int sdhci_esdhc_imx_remove(struct platform_device *pdev)
 	struct sdhci_host *host = platform_get_drvdata(pdev);
 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
 	struct pltfm_imx_data *imx_data = pltfm_host->priv;
-	int dead = (readl(host->ioaddr + SDHCI_INT_STATUS) == 0xffffffff);
+	int dead;
 
 	pm_runtime_get_sync(&pdev->dev);
+	dead = (readl(host->ioaddr + SDHCI_INT_STATUS) == 0xffffffff);
 	pm_runtime_disable(&pdev->dev);
 	pm_runtime_put_noidle(&pdev->dev);
 

From 01fbc21aaf91e6eef59dbf60bf852b3449a837b2 Mon Sep 17 00:00:00 2001
From: Rolf Eike Beer <eb@emlix.com>
Date: Thu, 4 Mar 2021 08:25:01 +0100
Subject: [PATCH 1616/2658] scripts: use pkg-config to locate libcrypto

commit 2cea4a7a1885bd0c765089afc14f7ff0eb77864e upstream.

Otherwise build fails if the headers are not in the default location. While at
it also ask pkg-config for the libs, with fallback to the existing value.

Signed-off-by: Rolf Eike Beer <eb@emlix.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 scripts/Makefile | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/scripts/Makefile b/scripts/Makefile
index fd0d53d4a234..2efa75f499a0 100644
--- a/scripts/Makefile
+++ b/scripts/Makefile
@@ -11,6 +11,9 @@
 
 HOST_EXTRACFLAGS += -I$(srctree)/tools/include
 
+CRYPTO_LIBS = $(shell pkg-config --libs libcrypto 2> /dev/null || echo -lcrypto)
+CRYPTO_CFLAGS = $(shell pkg-config --cflags libcrypto 2> /dev/null)
+
 hostprogs-$(CONFIG_KALLSYMS)     += kallsyms
 hostprogs-$(CONFIG_LOGO)         += pnmtologo
 hostprogs-$(CONFIG_VT)           += conmakehash
@@ -22,8 +25,9 @@ hostprogs-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += extract-cert
 
 HOSTCFLAGS_sortextable.o = -I$(srctree)/tools/include
 HOSTCFLAGS_asn1_compiler.o = -I$(srctree)/include
-HOSTLOADLIBES_sign-file = -lcrypto
-HOSTLOADLIBES_extract-cert = -lcrypto
+HOSTLOADLIBES_sign-file = $(CRYPTO_LIBS)
+HOSTCFLAGS_extract-cert.o = $(CRYPTO_CFLAGS)
+HOSTLOADLIBES_extract-cert = $(CRYPTO_LIBS)
 
 always		:= $(hostprogs-y) $(hostprogs-m)
 

From c27f39660cf908a8b82625de90c16f3c02f008d5 Mon Sep 17 00:00:00 2001
From: Rolf Eike Beer <eb@emlix.com>
Date: Thu, 4 Mar 2021 08:26:28 +0100
Subject: [PATCH 1617/2658] scripts: set proper OpenSSL include dir also for
 sign-file

commit fe968c41ac4f4ec9ffe3c4cf16b72285f5e9674f upstream.

Fixes: 2cea4a7a1885 ("scripts: use pkg-config to locate libcrypto")
Signed-off-by: Rolf Eike Beer <eb@emlix.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 scripts/Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/Makefile b/scripts/Makefile
index 2efa75f499a0..151cedeeef4c 100644
--- a/scripts/Makefile
+++ b/scripts/Makefile
@@ -25,6 +25,7 @@ hostprogs-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += extract-cert
 
 HOSTCFLAGS_sortextable.o = -I$(srctree)/tools/include
 HOSTCFLAGS_asn1_compiler.o = -I$(srctree)/include
+HOSTCFLAGS_sign-file.o = $(CRYPTO_CFLAGS)
 HOSTLOADLIBES_sign-file = $(CRYPTO_LIBS)
 HOSTCFLAGS_extract-cert.o = $(CRYPTO_CFLAGS)
 HOSTLOADLIBES_extract-cert = $(CRYPTO_LIBS)

From cf38eba18b5b50bc2cd52d478f9862f3ca7962cc Mon Sep 17 00:00:00 2001
From: Mike Kravetz <mike.kravetz@oracle.com>
Date: Wed, 24 Feb 2021 12:07:50 -0800
Subject: [PATCH 1618/2658] hugetlb: fix update_and_free_page contig page
 struct assumption
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit dbfee5aee7e54f83d96ceb8e3e80717fac62ad63 upstream.

page structs are not guaranteed to be contiguous for gigantic pages.  The
routine update_and_free_page can encounter a gigantic page, yet it assumes
page structs are contiguous when setting page flags in subpages.

If update_and_free_page encounters non-contiguous page structs, we can see
“BUG: Bad page state in process …” errors.

Non-contiguous page structs are generally not an issue.  However, they can
exist with a specific kernel configuration and hotplug operations.  For
example: Configure the kernel with CONFIG_SPARSEMEM and
!CONFIG_SPARSEMEM_VMEMMAP.  Then, hotplug add memory for the area where
the gigantic page will be allocated.  Zi Yan outlined steps to reproduce
here [1].

[1] https://lore.kernel.org/linux-mm/16F7C58B-4D79-41C5-9B64-A1A1628F4AF2@nvidia.com/

Link: https://lkml.kernel.org/r/20210217184926.33567-1-mike.kravetz@oracle.com
Fixes: 944d9fec8d7a ("hugetlb: add support for gigantic page allocation at runtime")
Signed-off-by: Zi Yan <ziy@nvidia.com>
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: Davidlohr Bueso <dbueso@suse.de>
Cc: "Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Joao Martins <joao.m.martins@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
---
 mm/hugetlb.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 13a4f3fe2d91..fd8174d492ce 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1159,14 +1159,16 @@ static inline int alloc_fresh_gigantic_page(struct hstate *h,
 static void update_and_free_page(struct hstate *h, struct page *page)
 {
 	int i;
+	struct page *subpage = page;
 
 	if (hstate_is_gigantic(h) && !gigantic_page_supported())
 		return;
 
 	h->nr_huge_pages--;
 	h->nr_huge_pages_node[page_to_nid(page)]--;
-	for (i = 0; i < pages_per_huge_page(h); i++) {
-		page[i].flags &= ~(1 << PG_locked | 1 << PG_error |
+	for (i = 0; i < pages_per_huge_page(h);
+	     i++, subpage = mem_map_next(subpage, page, i)) {
+		subpage->flags &= ~(1 << PG_locked | 1 << PG_error |
 				1 << PG_referenced | 1 << PG_dirty |
 				1 << PG_active | 1 << PG_private |
 				1 << PG_writeback);

From 2999540db4765e7c8a8710ce29de7f2672810b00 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Fri, 18 Dec 2020 12:17:16 -0800
Subject: [PATCH 1619/2658] JFS: more checks for invalid superblock

commit 3bef198f1b17d1bb89260bad947ef084c0a2d1a6 upstream.

syzbot is feeding invalid superblock data to JFS for mount testing.
JFS does not check several of the fields -- just assumes that they
are good since the JFS_MAGIC and version fields are good.

In this case (syzbot reproducer), we have s_l2bsize == 0xda0c,
pad == 0xf045, and s_state == 0x50, all of which are invalid IMO.
Having s_l2bsize == 0xda0c causes this UBSAN warning:
  UBSAN: shift-out-of-bounds in fs/jfs/jfs_mount.c:373:25
  shift exponent -9716 is negative

s_l2bsize can be tested for correctness. pad can be tested for non-0
and punted. s_state can be tested for its valid values and punted.

Do those 3 tests and if any of them fails, report the superblock as
invalid/corrupt and let fsck handle it.

With this patch, chkSuper() says this when JFS_DEBUG is enabled:
  jfs_mount: Mount Failure: superblock is corrupt!
  Mount JFS Failure: -22
  jfs_mount failed w/return code = -22

The obvious problem with this method is that next week there could
be another syzbot test that uses different fields for invalid values,
this making this like a game of whack-a-mole.

syzkaller link: https://syzkaller.appspot.com/bug?extid=36315852ece4132ec193

Reported-by: syzbot+36315852ece4132ec193@syzkaller.appspotmail.com
Reported-by: kernel test robot <lkp@intel.com> # v2
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Cc: jfs-discussion@lists.sourceforge.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/jfs/jfs_filsys.h |  1 +
 fs/jfs/jfs_mount.c  | 10 ++++++++++
 2 files changed, 11 insertions(+)

diff --git a/fs/jfs/jfs_filsys.h b/fs/jfs/jfs_filsys.h
index b67d64671bb4..415bfa90607a 100644
--- a/fs/jfs/jfs_filsys.h
+++ b/fs/jfs/jfs_filsys.h
@@ -281,5 +281,6 @@
 				 * fsck() must be run to repair
 				 */
 #define	FM_EXTENDFS 0x00000008	/* file system extendfs() in progress */
+#define	FM_STATE_MAX 0x0000000f	/* max value of s_state */
 
 #endif				/* _H_JFS_FILSYS */
diff --git a/fs/jfs/jfs_mount.c b/fs/jfs/jfs_mount.c
index 9895595fd2f2..103788ecc28c 100644
--- a/fs/jfs/jfs_mount.c
+++ b/fs/jfs/jfs_mount.c
@@ -49,6 +49,7 @@
 
 #include <linux/fs.h>
 #include <linux/buffer_head.h>
+#include <linux/log2.h>
 
 #include "jfs_incore.h"
 #include "jfs_filsys.h"
@@ -378,6 +379,15 @@ static int chkSuper(struct super_block *sb)
 	sbi->bsize = bsize;
 	sbi->l2bsize = le16_to_cpu(j_sb->s_l2bsize);
 
+	/* check some fields for possible corruption */
+	if (sbi->l2bsize != ilog2((u32)bsize) ||
+	    j_sb->pad != 0 ||
+	    le32_to_cpu(j_sb->s_state) > FM_STATE_MAX) {
+		rc = -EINVAL;
+		jfs_err("jfs_mount: Mount Failure: superblock is corrupt!");
+		goto out;
+	}
+
 	/*
 	 * For now, ignore s_pbsize, l2bfactor.  All I/O going through buffer
 	 * cache.

From b7c54ede22b4d9d4edae5638df55e53d0610664a Mon Sep 17 00:00:00 2001
From: Yumei Huang <yuhuang@redhat.com>
Date: Fri, 22 Jan 2021 16:48:19 -0800
Subject: [PATCH 1620/2658] xfs: Fix assert failure in xfs_setattr_size()

commit 88a9e03beef22cc5fabea344f54b9a0dfe63de08 upstream.

An assert failure is triggered by syzkaller test due to
ATTR_KILL_PRIV is not cleared before xfs_setattr_size.
As ATTR_KILL_PRIV is not checked/used by xfs_setattr_size,
just remove it from the assert.

Signed-off-by: Yumei Huang <yuhuang@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/xfs_iops.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index 245268a0cdf0..d70a004378d8 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -770,7 +770,7 @@ xfs_setattr_size(
 	ASSERT(xfs_isilocked(ip, XFS_MMAPLOCK_EXCL));
 	ASSERT(S_ISREG(ip->i_d.di_mode));
 	ASSERT((iattr->ia_valid & (ATTR_UID|ATTR_GID|ATTR_ATIME|ATTR_ATIME_SET|
-		ATTR_MTIME_SET|ATTR_KILL_PRIV|ATTR_TIMES_SET)) == 0);
+		ATTR_MTIME_SET|ATTR_TIMES_SET)) == 0);
 
 	oldsize = inode->i_size;
 	newsize = iattr->ia_size;

From 1be0343ca3d0620372d51902841a68792360d985 Mon Sep 17 00:00:00 2001
From: Marco Elver <elver@google.com>
Date: Mon, 1 Feb 2021 17:04:20 +0100
Subject: [PATCH 1621/2658] net: fix up truesize of cloned skb in
 skb_prepare_for_shift()

commit 097b9146c0e26aabaa6ff3e5ea536a53f5254a79 upstream.

Avoid the assumption that ksize(kmalloc(S)) == ksize(kmalloc(S)): when
cloning an skb, save and restore truesize after pskb_expand_head(). This
can occur if the allocator decides to service an allocation of the same
size differently (e.g. use a different size class, or pass the
allocation on to KFENCE).

Because truesize is used for bookkeeping (such as sk_wmem_queued), a
modified truesize of a cloned skb may result in corrupt bookkeeping and
relevant warnings (such as in sk_stream_kill_queues()).

Link: https://lkml.kernel.org/r/X9JR/J6dMMOy1obu@elver.google.com
Reported-by: syzbot+7b99aafdcc2eedea6178@syzkaller.appspotmail.com
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20210201160420.2826895-1-elver@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/skbuff.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 8395c6489fca..9b2eb90e0c7f 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2651,7 +2651,19 @@ EXPORT_SYMBOL(skb_split);
  */
 static int skb_prepare_for_shift(struct sk_buff *skb)
 {
-	return skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
+	int ret = 0;
+
+	if (skb_cloned(skb)) {
+		/* Save and restore truesize: pskb_expand_head() may reallocate
+		 * memory where ksize(kmalloc(S)) != ksize(kmalloc(S)), but we
+		 * cannot change truesize at this point.
+		 */
+		unsigned int save_truesize = skb->truesize;
+
+		ret = pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
+		skb->truesize = save_truesize;
+	}
+	return ret;
 }
 
 /**

From 387140f5ef47836f465502b325296521f77e7721 Mon Sep 17 00:00:00 2001
From: Li Xinhai <lixinhai.lxh@gmail.com>
Date: Wed, 24 Feb 2021 12:06:54 -0800
Subject: [PATCH 1622/2658] mm/hugetlb.c: fix unnecessary address expansion of
 pmd sharing

commit a1ba9da8f0f9a37d900ff7eff66482cf7de8015e upstream.

The current code would unnecessarily expand the address range.  Consider
one example, (start, end) = (1G-2M, 3G+2M), and (vm_start, vm_end) =
(1G-4M, 3G+4M), the expected adjustment should be keep (1G-2M, 3G+2M)
without expand.  But the current result will be (1G-4M, 3G+4M).  Actually,
the range (1G-4M, 1G) and (3G, 3G+4M) would never been involved in pmd
sharing.

After this patch, we will check that the vma span at least one PUD aligned
size and the start,end range overlap the aligned range of vma.

With above example, the aligned vma range is (1G, 3G), so if (start, end)
range is within (1G-4M, 1G), or within (3G, 3G+4M), then no adjustment to
both start and end.  Otherwise, we will have chance to adjust start
downwards or end upwards without exceeding (vm_start, vm_end).

Mike:

: The 'adjusted range' is used for calls to mmu notifiers and cache(tlb)
: flushing.  Since the current code unnecessarily expands the range in some
: cases, more entries than necessary would be flushed.  This would/could
: result in performance degradation.  However, this is highly dependent on
: the user runtime.  Is there a combination of vma layout and calls to
: actually hit this issue?  If the issue is hit, will those entries
: unnecessarily flushed be used again and need to be unnecessarily reloaded?

Link: https://lkml.kernel.org/r/20210104081631.2921415-1-lixinhai.lxh@gmail.com
Fixes: 75802ca66354 ("mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible")
Signed-off-by: Li Xinhai <lixinhai.lxh@gmail.com>
Suggested-by: Mike Kravetz <mike.kravetz@oracle.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Peter Xu <peterx@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/hugetlb.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index fd8174d492ce..e933cae307bf 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4322,21 +4322,23 @@ static bool vma_shareable(struct vm_area_struct *vma, unsigned long addr)
 void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
 				unsigned long *start, unsigned long *end)
 {
-	unsigned long a_start, a_end;
+	unsigned long v_start = ALIGN(vma->vm_start, PUD_SIZE),
+		v_end = ALIGN_DOWN(vma->vm_end, PUD_SIZE);
 
-	if (!(vma->vm_flags & VM_MAYSHARE))
+	/*
+	 * vma need span at least one aligned PUD size and the start,end range
+	 * must at least partialy within it.
+	 */
+	if (!(vma->vm_flags & VM_MAYSHARE) || !(v_end > v_start) ||
+		(*end <= v_start) || (*start >= v_end))
 		return;
 
 	/* Extend the range to be PUD aligned for a worst case scenario */
-	a_start = ALIGN_DOWN(*start, PUD_SIZE);
-	a_end = ALIGN(*end, PUD_SIZE);
+	if (*start > v_start)
+		*start = ALIGN_DOWN(*start, PUD_SIZE);
 
-	/*
-	 * Intersect the range with the vma range, since pmd sharing won't be
-	 * across vma after all
-	 */
-	*start = max(vma->vm_start, a_start);
-	*end = min(vma->vm_end, a_end);
+	if (*end < v_end)
+		*end = ALIGN(*end, PUD_SIZE);
 }
 
 /*

From e63b146b5def9384229d3090d7856585890c94c1 Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Mon, 21 Dec 2020 20:24:35 +0800
Subject: [PATCH 1623/2658] staging: fwserial: Fix error handling in
 fwserial_create

[ Upstream commit f31559af97a0eabd467e4719253675b7dccb8a46 ]

When fw_core_add_address_handler() fails, we need to destroy
the port by tty_port_destroy(). Also we need to unregister
the address handler by fw_core_remove_address_handler() on
failure.

Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Link: https://lore.kernel.org/r/20201221122437.10274-1-dinghao.liu@zju.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/fwserial/fwserial.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/staging/fwserial/fwserial.c b/drivers/staging/fwserial/fwserial.c
index b3ea4bb54e2c..68ed97398faf 100644
--- a/drivers/staging/fwserial/fwserial.c
+++ b/drivers/staging/fwserial/fwserial.c
@@ -2255,6 +2255,7 @@ static int fwserial_create(struct fw_unit *unit)
 		err = fw_core_add_address_handler(&port->rx_handler,
 						  &fw_high_memory_region);
 		if (err) {
+			tty_port_destroy(&port->port);
 			kfree(port);
 			goto free_ports;
 		}
@@ -2337,6 +2338,7 @@ static int fwserial_create(struct fw_unit *unit)
 
 free_ports:
 	for (--i; i >= 0; --i) {
+		fw_core_remove_address_handler(&serial->ports[i]->rx_handler);
 		tty_port_destroy(&serial->ports[i]->port);
 		kfree(serial->ports[i]);
 	}

From d88f2d77f9adfb042808c70e96ae54e0b69777ae Mon Sep 17 00:00:00 2001
From: Heiner Kallweit <hkallweit1@gmail.com>
Date: Tue, 1 Dec 2020 12:39:57 +0100
Subject: [PATCH 1624/2658] x86/reboot: Add Zotac ZBOX CI327 nano PCI reboot
 quirk

[ Upstream commit 4b2d8ca9208be636b30e924b1cbcb267b0740c93 ]

On this system the M.2 PCIe WiFi card isn't detected after reboot, only
after cold boot. reboot=pci fixes this behavior. In [0] the same issue
is described, although on another system and with another Intel WiFi
card. In case it's relevant, both systems have Celeron CPUs.

Add a PCI reboot quirk on affected systems until a more generic fix is
available.

[0] https://bugzilla.kernel.org/show_bug.cgi?id=202399

 [ bp: Massage commit message. ]

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/1524eafd-f89c-cfa4-ed70-0bde9e45eec9@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/reboot.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index cbe14f7c2826..1c2451107e49 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -418,6 +418,15 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
 		},
 	},
 
+	{	/* PCIe Wifi card isn't detected after reboot otherwise */
+		.callback = set_pci_reboot,
+		.ident = "Zotac ZBOX CI327 nano",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "NA"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "ZBOX-CI327NANO-GS-01"),
+		},
+	},
+
 	/* Sony */
 	{	/* Handle problems with rebooting on Sony VGN-Z540N */
 		.callback = set_bios_reboot,

From 4530764ca0cb658e9b5f5ea71ec0146f0b61a503 Mon Sep 17 00:00:00 2001
From: Jiri Slaby <jslaby@suse.cz>
Date: Tue, 5 Jan 2021 13:02:34 +0100
Subject: [PATCH 1625/2658] vt/consolemap: do font sum unsigned

[ Upstream commit 9777f8e60e718f7b022a94f2524f967d8def1931 ]

The constant 20 makes the font sum computation signed which can lead to
sign extensions and signed wraps. It's not much of a problem as we build
with -fno-strict-overflow. But if we ever decide not to, be ready, so
switch the constant to unsigned.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Link: https://lore.kernel.org/r/20210105120239.28031-7-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/vt/consolemap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c
index c8c91f0476a2..e8301dcf4c84 100644
--- a/drivers/tty/vt/consolemap.c
+++ b/drivers/tty/vt/consolemap.c
@@ -494,7 +494,7 @@ con_insert_unipair(struct uni_pagedir *p, u_short unicode, u_short fontpos)
 
 	p2[unicode & 0x3f] = fontpos;
 	
-	p->sum += (fontpos << 20) + unicode;
+	p->sum += (fontpos << 20U) + unicode;
 
 	return 0;
 }

From 63a4488757d34cbb96be20eb196572e517ad2fdb Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Fri, 15 Jan 2021 08:56:13 +0200
Subject: [PATCH 1626/2658] wlcore: Fix command execute failure 19 for wl12xx

[ Upstream commit cb88d01b67383a095e3f7caeb4cdade5a6cf0417 ]

We can currently get a "command execute failure 19" error on beacon loss
if the signal is weak:

wlcore: Beacon loss detected. roles:0xff
wlcore: Connection loss work (role_id: 0).
...
wlcore: ERROR command execute failure 19
...
WARNING: CPU: 0 PID: 1552 at drivers/net/wireless/ti/wlcore/main.c:803
...
(wl12xx_queue_recovery_work.part.0 [wlcore])
(wl12xx_cmd_role_start_sta [wlcore])
(wl1271_op_bss_info_changed [wlcore])
(ieee80211_prep_connection [mac80211])

Error 19 is defined as CMD_STATUS_WRONG_NESTING from the wlcore firmware,
and seems to mean that the firmware no longer wants to see the quirk
handling for WLCORE_QUIRK_START_STA_FAILS done.

This quirk got added with commit 18eab430700d ("wlcore: workaround
start_sta problem in wl12xx fw"), and it seems that this already got fixed
in the firmware long time ago back in 2012 as wl18xx never had this quirk
in place to start with.

As we no longer even support firmware that early, to me it seems that it's
safe to just drop WLCORE_QUIRK_START_STA_FAILS to fix the error. Looks
like earlier firmware got disabled back in 2013 with commit 0e284c074ef9
("wl12xx: increase minimum singlerole firmware version required").

If it turns out we still need WLCORE_QUIRK_START_STA_FAILS with any
firmware that the driver works with, we can simply revert this patch and
add extra checks for firmware version used.

With this fix wlcore reconnects properly after a beacon loss.

Cc: Raz Bouganim <r-bouganim@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210115065613.7731-1-tony@atomide.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ti/wl12xx/main.c   |  3 ---
 drivers/net/wireless/ti/wlcore/main.c   | 15 +--------------
 drivers/net/wireless/ti/wlcore/wlcore.h |  3 ---
 3 files changed, 1 insertion(+), 20 deletions(-)

diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
index af0fe2e17151..e4b28d37046a 100644
--- a/drivers/net/wireless/ti/wl12xx/main.c
+++ b/drivers/net/wireless/ti/wl12xx/main.c
@@ -647,7 +647,6 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
 		wl->quirks |= WLCORE_QUIRK_LEGACY_NVS |
 			      WLCORE_QUIRK_DUAL_PROBE_TMPL |
 			      WLCORE_QUIRK_TKIP_HEADER_SPACE |
-			      WLCORE_QUIRK_START_STA_FAILS |
 			      WLCORE_QUIRK_AP_ZERO_SESSION_ID;
 		wl->sr_fw_name = WL127X_FW_NAME_SINGLE;
 		wl->mr_fw_name = WL127X_FW_NAME_MULTI;
@@ -671,7 +670,6 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
 		wl->quirks |= WLCORE_QUIRK_LEGACY_NVS |
 			      WLCORE_QUIRK_DUAL_PROBE_TMPL |
 			      WLCORE_QUIRK_TKIP_HEADER_SPACE |
-			      WLCORE_QUIRK_START_STA_FAILS |
 			      WLCORE_QUIRK_AP_ZERO_SESSION_ID;
 		wl->plt_fw_name = WL127X_PLT_FW_NAME;
 		wl->sr_fw_name = WL127X_FW_NAME_SINGLE;
@@ -700,7 +698,6 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
 		wl->quirks |= WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN |
 			      WLCORE_QUIRK_DUAL_PROBE_TMPL |
 			      WLCORE_QUIRK_TKIP_HEADER_SPACE |
-			      WLCORE_QUIRK_START_STA_FAILS |
 			      WLCORE_QUIRK_AP_ZERO_SESSION_ID;
 
 		wlcore_set_min_fw_ver(wl, WL128X_CHIP_VER,
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index cc10b72607c6..3f61289ce036 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -2889,21 +2889,8 @@ static int wlcore_join(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 
 	if (is_ibss)
 		ret = wl12xx_cmd_role_start_ibss(wl, wlvif);
-	else {
-		if (wl->quirks & WLCORE_QUIRK_START_STA_FAILS) {
-			/*
-			 * TODO: this is an ugly workaround for wl12xx fw
-			 * bug - we are not able to tx/rx after the first
-			 * start_sta, so make dummy start+stop calls,
-			 * and then call start_sta again.
-			 * this should be fixed in the fw.
-			 */
-			wl12xx_cmd_role_start_sta(wl, wlvif);
-			wl12xx_cmd_role_stop_sta(wl, wlvif);
-		}
-
+	else
 		ret = wl12xx_cmd_role_start_sta(wl, wlvif);
-	}
 
 	return ret;
 }
diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
index 906be6aa4eb6..a0647d4384d2 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore.h
@@ -556,9 +556,6 @@ wlcore_set_min_fw_ver(struct wl1271 *wl, unsigned int chip,
 /* Each RX/TX transaction requires an end-of-transaction transfer */
 #define WLCORE_QUIRK_END_OF_TRANSACTION		BIT(0)
 
-/* the first start_role(sta) sometimes doesn't work on wl12xx */
-#define WLCORE_QUIRK_START_STA_FAILS		BIT(1)
-
 /* wl127x and SPI don't support SDIO block size alignment */
 #define WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN		BIT(2)
 

From d621a568b965c4e23199ae00ec7c7ebfdb922590 Mon Sep 17 00:00:00 2001
From: Di Zhu <zhudi21@huawei.com>
Date: Mon, 25 Jan 2021 20:42:29 +0800
Subject: [PATCH 1627/2658] pktgen: fix misuse of BUG_ON() in
 pktgen_thread_worker()

[ Upstream commit 275b1e88cabb34dbcbe99756b67e9939d34a99b6 ]

pktgen create threads for all online cpus and bond these threads to
relevant cpu repecivtily. when this thread firstly be woken up, it
will compare cpu currently running with the cpu specified at the time
of creation and if the two cpus are not equal, BUG_ON() will take effect
causing panic on the system.
Notice that these threads could be migrated to other cpus before start
running because of the cpu hotplug after these threads have created. so the
BUG_ON() used here seems unreasonable and we can replace it with WARN_ON()
to just printf a warning other than panic the system.

Signed-off-by: Di Zhu <zhudi21@huawei.com>
Link: https://lore.kernel.org/r/20210125124229.19334-1-zhudi21@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/pktgen.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 4ea957c1e7ee..5d0759e2102e 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -3519,7 +3519,7 @@ static int pktgen_thread_worker(void *arg)
 	struct pktgen_dev *pkt_dev = NULL;
 	int cpu = t->cpu;
 
-	BUG_ON(smp_processor_id() != cpu);
+	WARN_ON(smp_processor_id() != cpu);
 
 	init_waitqueue_head(&t->queue);
 	complete(&t->start_done);

From aaccdcc019d1a8a6b7fce384951e3ec2bd54ca6a Mon Sep 17 00:00:00 2001
From: Miaoqing Pan <miaoqing@codeaurora.org>
Date: Tue, 22 Dec 2020 14:34:47 +0800
Subject: [PATCH 1628/2658] ath10k: fix wmi mgmt tx queue full due to race
 condition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit b55379e343a3472c35f4a1245906db5158cab453 ]

Failed to transmit wmi management frames:

[84977.840894] ath10k_snoc a000000.wifi: wmi mgmt tx queue is full
[84977.840913] ath10k_snoc a000000.wifi: failed to transmit packet, dropping: -28
[84977.840924] ath10k_snoc a000000.wifi: failed to submit frame: -28
[84977.840932] ath10k_snoc a000000.wifi: failed to transmit frame: -28

This issue is caused by race condition between skb_dequeue and
__skb_queue_tail. The queue of ‘wmi_mgmt_tx_queue’ is protected by a
different lock: ar->data_lock vs list->lock, the result is no protection.
So when ath10k_mgmt_over_wmi_tx_work() and ath10k_mac_tx_wmi_mgmt()
running concurrently on different CPUs, there appear to be a rare corner
cases when the queue length is 1,

  CPUx (skb_deuque)			CPUy (__skb_queue_tail)
					next=list
					prev=list
  struct sk_buff *skb = skb_peek(list);	WRITE_ONCE(newsk->next, next);
  WRITE_ONCE(list->qlen, list->qlen - 1);WRITE_ONCE(newsk->prev, prev);
  next       = skb->next;		WRITE_ONCE(next->prev, newsk);
  prev       = skb->prev;		WRITE_ONCE(prev->next, newsk);
  skb->next  = skb->prev = NULL;	list->qlen++;
  WRITE_ONCE(next->prev, prev);
  WRITE_ONCE(prev->next, next);

If the instruction ‘next = skb->next’ is executed before
‘WRITE_ONCE(prev->next, newsk)’, newsk will be lost, as CPUx get the
old ‘next’ pointer, but the length is still added by one. The final
result is the length of the queue will reach the maximum value but
the queue is empty.

So remove ar->data_lock, and use 'skb_queue_tail' instead of
'__skb_queue_tail' to prevent the potential race condition. Also switch
to use skb_queue_len_lockless, in case we queue a few SKBs simultaneously.

Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.1.c2-00033-QCAHLSWMTPLZ-1

Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1608618887-8857-1-git-send-email-miaoqing@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/mac.c | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 3ea56ad00cf3..a362832a5f13 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -3471,23 +3471,16 @@ bool ath10k_mac_tx_frm_has_freq(struct ath10k *ar)
 static int ath10k_mac_tx_wmi_mgmt(struct ath10k *ar, struct sk_buff *skb)
 {
 	struct sk_buff_head *q = &ar->wmi_mgmt_tx_queue;
-	int ret = 0;
-
-	spin_lock_bh(&ar->data_lock);
 
-	if (skb_queue_len(q) == ATH10K_MAX_NUM_MGMT_PENDING) {
+	if (skb_queue_len_lockless(q) >= ATH10K_MAX_NUM_MGMT_PENDING) {
 		ath10k_warn(ar, "wmi mgmt tx queue is full\n");
-		ret = -ENOSPC;
-		goto unlock;
+		return -ENOSPC;
 	}
 
-	__skb_queue_tail(q, skb);
+	skb_queue_tail(q, skb);
 	ieee80211_queue_work(ar->hw, &ar->wmi_mgmt_tx_work);
 
-unlock:
-	spin_unlock_bh(&ar->data_lock);
-
-	return ret;
+	return 0;
 }
 
 static enum ath10k_mac_tx_path

From 4bbf2cac70013c4116630039607eab1b87797a2d Mon Sep 17 00:00:00 2001
From: Fangrui Song <maskray@google.com>
Date: Wed, 27 Jan 2021 12:56:00 -0800
Subject: [PATCH 1629/2658] x86/build: Treat R_386_PLT32 relocation as
 R_386_PC32

[ Upstream commit bb73d07148c405c293e576b40af37737faf23a6a ]

This is similar to commit

  b21ebf2fb4cd ("x86: Treat R_X86_64_PLT32 as R_X86_64_PC32")

but for i386. As far as the kernel is concerned, R_386_PLT32 can be
treated the same as R_386_PC32.

R_386_PLT32/R_X86_64_PLT32 are PC-relative relocation types which
can only be used by branches. If the referenced symbol is defined
externally, a PLT will be used.

R_386_PC32/R_X86_64_PC32 are PC-relative relocation types which can be
used by address taking operations and branches. If the referenced symbol
is defined externally, a copy relocation/canonical PLT entry will be
created in the executable.

On x86-64, there is no PIC vs non-PIC PLT distinction and an
R_X86_64_PLT32 relocation is produced for both `call/jmp foo` and
`call/jmp foo@PLT` with newer (2018) GNU as/LLVM integrated assembler.
This avoids canonical PLT entries (st_shndx=0, st_value!=0).

On i386, there are 2 types of PLTs, PIC and non-PIC. Currently,
the GCC/GNU as convention is to use R_386_PC32 for non-PIC PLT and
R_386_PLT32 for PIC PLT. Copy relocations/canonical PLT entries
are possible ABI issues but GCC/GNU as will likely keep the status
quo because (1) the ABI is legacy (2) the change will drop a GNU
ld diagnostic for non-default visibility ifunc in shared objects.

clang-12 -fno-pic (since [1]) can emit R_386_PLT32 for compiler
generated function declarations, because preventing canonical PLT
entries is weighed over the rare ifunc diagnostic.

Further info for the more interested:

  https://github.com/ClangBuiltLinux/linux/issues/1210
  https://sourceware.org/bugzilla/show_bug.cgi?id=27169
  https://github.com/llvm/llvm-project/commit/a084c0388e2a59b9556f2de0083333232da3f1d6 [1]

 [ bp: Massage commit message. ]

Reported-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Fangrui Song <maskray@google.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Tested-by: Nathan Chancellor <natechancellor@gmail.com>
Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
Link: https://lkml.kernel.org/r/20210127205600.1227437-1-maskray@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/module.c |  1 +
 arch/x86/tools/relocs.c  | 12 ++++++++----
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
index 94779f66bf49..6f0d340594ca 100644
--- a/arch/x86/kernel/module.c
+++ b/arch/x86/kernel/module.c
@@ -124,6 +124,7 @@ int apply_relocate(Elf32_Shdr *sechdrs,
 			*location += sym->st_value;
 			break;
 		case R_386_PC32:
+		case R_386_PLT32:
 			/* Add the value, subtract its position */
 			*location += sym->st_value - (uint32_t)location;
 			break;
diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
index 5b6c8486a0be..d1c3f82c7882 100644
--- a/arch/x86/tools/relocs.c
+++ b/arch/x86/tools/relocs.c
@@ -839,9 +839,11 @@ static int do_reloc32(struct section *sec, Elf_Rel *rel, Elf_Sym *sym,
 	case R_386_PC32:
 	case R_386_PC16:
 	case R_386_PC8:
+	case R_386_PLT32:
 		/*
-		 * NONE can be ignored and PC relative relocations don't
-		 * need to be adjusted.
+		 * NONE can be ignored and PC relative relocations don't need
+		 * to be adjusted. Because sym must be defined, R_386_PLT32 can
+		 * be treated the same way as R_386_PC32.
 		 */
 		break;
 
@@ -882,9 +884,11 @@ static int do_reloc_real(struct section *sec, Elf_Rel *rel, Elf_Sym *sym,
 	case R_386_PC32:
 	case R_386_PC16:
 	case R_386_PC8:
+	case R_386_PLT32:
 		/*
-		 * NONE can be ignored and PC relative relocations don't
-		 * need to be adjusted.
+		 * NONE can be ignored and PC relative relocations don't need
+		 * to be adjusted. Because sym must be defined, R_386_PLT32 can
+		 * be treated the same way as R_386_PC32.
 		 */
 		break;
 

From 41122635ef25b829f3ed5dbd1f03f69807a08399 Mon Sep 17 00:00:00 2001
From: Gopal Tiwari <gtiwari@redhat.com>
Date: Tue, 2 Feb 2021 15:12:30 +0530
Subject: [PATCH 1630/2658] Bluetooth: Fix null pointer dereference in
 amp_read_loc_assoc_final_data

[ Upstream commit e8bd76ede155fd54d8c41d045dda43cd3174d506 ]

kernel panic trace looks like:

 #5 [ffffb9e08698fc80] do_page_fault at ffffffffb666e0d7
 #6 [ffffb9e08698fcb0] page_fault at ffffffffb70010fe
    [exception RIP: amp_read_loc_assoc_final_data+63]
    RIP: ffffffffc06ab54f  RSP: ffffb9e08698fd68  RFLAGS: 00010246
    RAX: 0000000000000000  RBX: ffff8c8845a5a000  RCX: 0000000000000004
    RDX: 0000000000000000  RSI: ffff8c8b9153d000  RDI: ffff8c8845a5a000
    RBP: ffffb9e08698fe40   R8: 00000000000330e0   R9: ffffffffc0675c94
    R10: ffffb9e08698fe58  R11: 0000000000000001  R12: ffff8c8b9cbf6200
    R13: 0000000000000000  R14: 0000000000000000  R15: ffff8c8b2026da0b
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #7 [ffffb9e08698fda8] hci_event_packet at ffffffffc0676904 [bluetooth]
 #8 [ffffb9e08698fe50] hci_rx_work at ffffffffc06629ac [bluetooth]
 #9 [ffffb9e08698fe98] process_one_work at ffffffffb66f95e7

hcon->amp_mgr seems NULL triggered kernel panic in following line inside
function amp_read_loc_assoc_final_data

        set_bit(READ_LOC_AMP_ASSOC_FINAL, &mgr->state);

Fixed by checking NULL for mgr.

Signed-off-by: Gopal Tiwari <gtiwari@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/amp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/bluetooth/amp.c b/net/bluetooth/amp.c
index e32f34189007..b01b43ab6f83 100644
--- a/net/bluetooth/amp.c
+++ b/net/bluetooth/amp.c
@@ -305,6 +305,9 @@ void amp_read_loc_assoc_final_data(struct hci_dev *hdev,
 	struct hci_request req;
 	int err = 0;
 
+	if (!mgr)
+		return;
+
 	cp.phy_handle = hcon->handle;
 	cp.len_so_far = cpu_to_le16(0);
 	cp.max_len = cpu_to_le16(hdev->amp_assoc_size);

From 09bb6b134ef9541c951e5ec18354ec2042233c8c Mon Sep 17 00:00:00 2001
From: Christian Gromm <christian.gromm@microchip.com>
Date: Tue, 2 Feb 2021 17:21:05 +0100
Subject: [PATCH 1631/2658] staging: most: sound: add sanity check for function
 argument

[ Upstream commit 45b754ae5b82949dca2b6e74fa680313cefdc813 ]

This patch checks the function parameter 'bytes' before doing the
subtraction to prevent memory corruption.

Signed-off-by: Christian Gromm <christian.gromm@microchip.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/1612282865-21846-1-git-send-email-christian.gromm@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/most/aim-sound/sound.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/staging/most/aim-sound/sound.c b/drivers/staging/most/aim-sound/sound.c
index 9c645801cff4..532ec0f7100e 100644
--- a/drivers/staging/most/aim-sound/sound.c
+++ b/drivers/staging/most/aim-sound/sound.c
@@ -92,6 +92,8 @@ static void swap_copy24(u8 *dest, const u8 *source, unsigned int bytes)
 {
 	unsigned int i = 0;
 
+	if (bytes < 2)
+		return;
 	while (i < bytes - 2) {
 		dest[i] = source[i + 2];
 		dest[i + 1] = source[i + 1];

From 0bb0971b95819b39d3daece3c6a51851953f0047 Mon Sep 17 00:00:00 2001
From: Ricardo Ribalda <ribalda@chromium.org>
Date: Wed, 23 Dec 2020 14:35:19 +0100
Subject: [PATCH 1632/2658] media: uvcvideo: Allow entities with no pads

[ Upstream commit 7532dad6634031d083df7af606fac655b8d08b5c ]

Avoid an underflow while calculating the number of inputs for entities
with zero pads.

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/uvc/uvc_driver.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
index fc355c846e4c..79bae5b50580 100644
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -869,7 +869,10 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id,
 	unsigned int i;
 
 	extra_size = roundup(extra_size, sizeof(*entity->pads));
-	num_inputs = (type & UVC_TERM_OUTPUT) ? num_pads : num_pads - 1;
+	if (num_pads)
+		num_inputs = type & UVC_TERM_OUTPUT ? num_pads : num_pads - 1;
+	else
+		num_inputs = 0;
 	size = sizeof(*entity) + extra_size + sizeof(*entity->pads) * num_pads
 	     + num_inputs;
 	entity = kzalloc(size, GFP_KERNEL);
@@ -885,7 +888,7 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id,
 
 	for (i = 0; i < num_inputs; ++i)
 		entity->pads[i].flags = MEDIA_PAD_FL_SINK;
-	if (!UVC_ENTITY_IS_OTERM(entity))
+	if (!UVC_ENTITY_IS_OTERM(entity) && num_pads)
 		entity->pads[num_pads-1].flags = MEDIA_PAD_FL_SOURCE;
 
 	entity->bNrInPins = num_inputs;

From 33bc38f9a0df612920e79cf62b3cb88c9c7c7ab3 Mon Sep 17 00:00:00 2001
From: Lee Duncan <lduncan@suse.com>
Date: Tue, 23 Feb 2021 13:06:24 -0800
Subject: [PATCH 1633/2658] scsi: iscsi: Restrict sessions and handles to admin
 capabilities

commit 688e8128b7a92df982709a4137ea4588d16f24aa upstream.

Protect the iSCSI transport handle, available in sysfs, by requiring
CAP_SYS_ADMIN to read it. Also protect the netlink socket by restricting
reception of messages to ones sent with CAP_SYS_ADMIN. This disables
normal users from being able to end arbitrary iSCSI sessions.

Cc: stable@vger.kernel.org
Reported-by: Adam Nichols <adam@grimm-co.com>
Reviewed-by: Chris Leech <cleech@redhat.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/scsi_transport_iscsi.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 490364031648..69206543c34e 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -119,6 +119,9 @@ show_transport_handle(struct device *dev, struct device_attribute *attr,
 		      char *buf)
 {
 	struct iscsi_internal *priv = dev_to_iscsi_internal(dev);
+
+	if (!capable(CAP_SYS_ADMIN))
+		return -EACCES;
 	return sprintf(buf, "%llu\n", (unsigned long long)iscsi_handle(priv->iscsi_transport));
 }
 static DEVICE_ATTR(handle, S_IRUGO, show_transport_handle, NULL);
@@ -3523,6 +3526,9 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
 	struct iscsi_cls_conn *conn;
 	struct iscsi_endpoint *ep = NULL;
 
+	if (!netlink_capable(skb, CAP_SYS_ADMIN))
+		return -EPERM;
+
 	if (nlh->nlmsg_type == ISCSI_UEVENT_PATH_UPDATE)
 		*group = ISCSI_NL_GRP_UIP;
 	else

From 01a810231efcb4d41f889b19df99b0e701f1bccc Mon Sep 17 00:00:00 2001
From: Joe Perches <joe@perches.com>
Date: Wed, 16 Sep 2020 13:40:38 -0700
Subject: [PATCH 1634/2658] sysfs: Add sysfs_emit and sysfs_emit_at to format
 sysfs output

commit 2efc459d06f1630001e3984854848a5647086232 upstream.

Output defects can exist in sysfs content using sprintf and snprintf.

sprintf does not know the PAGE_SIZE maximum of the temporary buffer
used for outputting sysfs content and it's possible to overrun the
PAGE_SIZE buffer length.

Add a generic sysfs_emit function that knows that the size of the
temporary buffer and ensures that no overrun is done.

Add a generic sysfs_emit_at function that can be used in multiple
call situations that also ensures that no overrun is done.

Validate the output buffer argument to be page aligned.
Validate the offset len argument to be within the PAGE_SIZE buf.

Signed-off-by: Joe Perches <joe@perches.com>
Link: https://lore.kernel.org/r/884235202216d464d61ee975f7465332c86f76b2.1600285923.git.joe@perches.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/filesystems/sysfs.txt |  8 ++---
 fs/sysfs/file.c                     | 55 +++++++++++++++++++++++++++++
 include/linux/sysfs.h               | 16 +++++++++
 3 files changed, 74 insertions(+), 5 deletions(-)

diff --git a/Documentation/filesystems/sysfs.txt b/Documentation/filesystems/sysfs.txt
index 24da7b32c489..1218a5e2975c 100644
--- a/Documentation/filesystems/sysfs.txt
+++ b/Documentation/filesystems/sysfs.txt
@@ -211,12 +211,10 @@ Other notes:
   is 4096. 
 
 - show() methods should return the number of bytes printed into the
-  buffer. This is the return value of scnprintf().
+  buffer.
 
-- show() must not use snprintf() when formatting the value to be
-  returned to user space. If you can guarantee that an overflow
-  will never happen you can use sprintf() otherwise you must use
-  scnprintf().
+- show() should only use sysfs_emit() or sysfs_emit_at() when formatting
+  the value to be returned to user space.
 
 - store() should return the number of bytes used from the buffer. If the
   entire buffer has been used, just return the count argument.
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 666986b95c5d..300cdbdc8494 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -17,6 +17,7 @@
 #include <linux/list.h>
 #include <linux/mutex.h>
 #include <linux/seq_file.h>
+#include <linux/mm.h>
 
 #include "sysfs.h"
 #include "../kernfs/kernfs-internal.h"
@@ -549,3 +550,57 @@ void sysfs_remove_bin_file(struct kobject *kobj,
 	kernfs_remove_by_name(kobj->sd, attr->attr.name);
 }
 EXPORT_SYMBOL_GPL(sysfs_remove_bin_file);
+
+/**
+ *	sysfs_emit - scnprintf equivalent, aware of PAGE_SIZE buffer.
+ *	@buf:	start of PAGE_SIZE buffer.
+ *	@fmt:	format
+ *	@...:	optional arguments to @format
+ *
+ *
+ * Returns number of characters written to @buf.
+ */
+int sysfs_emit(char *buf, const char *fmt, ...)
+{
+	va_list args;
+	int len;
+
+	if (WARN(!buf || offset_in_page(buf),
+		 "invalid sysfs_emit: buf:%p\n", buf))
+		return 0;
+
+	va_start(args, fmt);
+	len = vscnprintf(buf, PAGE_SIZE, fmt, args);
+	va_end(args);
+
+	return len;
+}
+EXPORT_SYMBOL_GPL(sysfs_emit);
+
+/**
+ *	sysfs_emit_at - scnprintf equivalent, aware of PAGE_SIZE buffer.
+ *	@buf:	start of PAGE_SIZE buffer.
+ *	@at:	offset in @buf to start write in bytes
+ *		@at must be >= 0 && < PAGE_SIZE
+ *	@fmt:	format
+ *	@...:	optional arguments to @fmt
+ *
+ *
+ * Returns number of characters written starting at &@buf[@at].
+ */
+int sysfs_emit_at(char *buf, int at, const char *fmt, ...)
+{
+	va_list args;
+	int len;
+
+	if (WARN(!buf || offset_in_page(buf) || at < 0 || at >= PAGE_SIZE,
+		 "invalid sysfs_emit_at: buf:%p at:%d\n", buf, at))
+		return 0;
+
+	va_start(args, fmt);
+	len = vscnprintf(buf + at, PAGE_SIZE - at, fmt, args);
+	va_end(args);
+
+	return len;
+}
+EXPORT_SYMBOL_GPL(sysfs_emit_at);
diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
index d3c19f8c4564..a0cbc4836f36 100644
--- a/include/linux/sysfs.h
+++ b/include/linux/sysfs.h
@@ -300,6 +300,11 @@ static inline void sysfs_enable_ns(struct kernfs_node *kn)
 	return kernfs_enable_ns(kn);
 }
 
+__printf(2, 3)
+int sysfs_emit(char *buf, const char *fmt, ...);
+__printf(3, 4)
+int sysfs_emit_at(char *buf, int at, const char *fmt, ...);
+
 #else /* CONFIG_SYSFS */
 
 static inline int sysfs_create_dir_ns(struct kobject *kobj, const void *ns)
@@ -506,6 +511,17 @@ static inline void sysfs_enable_ns(struct kernfs_node *kn)
 {
 }
 
+__printf(2, 3)
+static inline int sysfs_emit(char *buf, const char *fmt, ...)
+{
+	return 0;
+}
+
+__printf(3, 4)
+static inline int sysfs_emit_at(char *buf, int at, const char *fmt, ...)
+{
+	return 0;
+}
 #endif /* CONFIG_SYSFS */
 
 static inline int __must_check sysfs_create_file(struct kobject *kobj,

From 51f53af4b3d750342510585a68bd25efccbfd66e Mon Sep 17 00:00:00 2001
From: Chris Leech <cleech@redhat.com>
Date: Tue, 23 Feb 2021 18:00:17 -0800
Subject: [PATCH 1635/2658] scsi: iscsi: Ensure sysfs attributes are limited to
 PAGE_SIZE

commit ec98ea7070e94cc25a422ec97d1421e28d97b7ee upstream.

As the iSCSI parameters are exported back through sysfs, it should be
enforcing that they never are more than PAGE_SIZE (which should be more
than enough) before accepting updates through netlink.

Change all iSCSI sysfs attributes to use sysfs_emit().

Cc: stable@vger.kernel.org
Reported-by: Adam Nichols <adam@grimm-co.com>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Chris Leech <cleech@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/libiscsi.c             | 148 ++++++++++++++--------------
 drivers/scsi/scsi_transport_iscsi.c |  23 +++--
 2 files changed, 89 insertions(+), 82 deletions(-)

diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 36e415487fe5..ecf3950c4438 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -3371,125 +3371,125 @@ int iscsi_session_get_param(struct iscsi_cls_session *cls_session,
 
 	switch(param) {
 	case ISCSI_PARAM_FAST_ABORT:
-		len = sprintf(buf, "%d\n", session->fast_abort);
+		len = sysfs_emit(buf, "%d\n", session->fast_abort);
 		break;
 	case ISCSI_PARAM_ABORT_TMO:
-		len = sprintf(buf, "%d\n", session->abort_timeout);
+		len = sysfs_emit(buf, "%d\n", session->abort_timeout);
 		break;
 	case ISCSI_PARAM_LU_RESET_TMO:
-		len = sprintf(buf, "%d\n", session->lu_reset_timeout);
+		len = sysfs_emit(buf, "%d\n", session->lu_reset_timeout);
 		break;
 	case ISCSI_PARAM_TGT_RESET_TMO:
-		len = sprintf(buf, "%d\n", session->tgt_reset_timeout);
+		len = sysfs_emit(buf, "%d\n", session->tgt_reset_timeout);
 		break;
 	case ISCSI_PARAM_INITIAL_R2T_EN:
-		len = sprintf(buf, "%d\n", session->initial_r2t_en);
+		len = sysfs_emit(buf, "%d\n", session->initial_r2t_en);
 		break;
 	case ISCSI_PARAM_MAX_R2T:
-		len = sprintf(buf, "%hu\n", session->max_r2t);
+		len = sysfs_emit(buf, "%hu\n", session->max_r2t);
 		break;
 	case ISCSI_PARAM_IMM_DATA_EN:
-		len = sprintf(buf, "%d\n", session->imm_data_en);
+		len = sysfs_emit(buf, "%d\n", session->imm_data_en);
 		break;
 	case ISCSI_PARAM_FIRST_BURST:
-		len = sprintf(buf, "%u\n", session->first_burst);
+		len = sysfs_emit(buf, "%u\n", session->first_burst);
 		break;
 	case ISCSI_PARAM_MAX_BURST:
-		len = sprintf(buf, "%u\n", session->max_burst);
+		len = sysfs_emit(buf, "%u\n", session->max_burst);
 		break;
 	case ISCSI_PARAM_PDU_INORDER_EN:
-		len = sprintf(buf, "%d\n", session->pdu_inorder_en);
+		len = sysfs_emit(buf, "%d\n", session->pdu_inorder_en);
 		break;
 	case ISCSI_PARAM_DATASEQ_INORDER_EN:
-		len = sprintf(buf, "%d\n", session->dataseq_inorder_en);
+		len = sysfs_emit(buf, "%d\n", session->dataseq_inorder_en);
 		break;
 	case ISCSI_PARAM_DEF_TASKMGMT_TMO:
-		len = sprintf(buf, "%d\n", session->def_taskmgmt_tmo);
+		len = sysfs_emit(buf, "%d\n", session->def_taskmgmt_tmo);
 		break;
 	case ISCSI_PARAM_ERL:
-		len = sprintf(buf, "%d\n", session->erl);
+		len = sysfs_emit(buf, "%d\n", session->erl);
 		break;
 	case ISCSI_PARAM_TARGET_NAME:
-		len = sprintf(buf, "%s\n", session->targetname);
+		len = sysfs_emit(buf, "%s\n", session->targetname);
 		break;
 	case ISCSI_PARAM_TARGET_ALIAS:
-		len = sprintf(buf, "%s\n", session->targetalias);
+		len = sysfs_emit(buf, "%s\n", session->targetalias);
 		break;
 	case ISCSI_PARAM_TPGT:
-		len = sprintf(buf, "%d\n", session->tpgt);
+		len = sysfs_emit(buf, "%d\n", session->tpgt);
 		break;
 	case ISCSI_PARAM_USERNAME:
-		len = sprintf(buf, "%s\n", session->username);
+		len = sysfs_emit(buf, "%s\n", session->username);
 		break;
 	case ISCSI_PARAM_USERNAME_IN:
-		len = sprintf(buf, "%s\n", session->username_in);
+		len = sysfs_emit(buf, "%s\n", session->username_in);
 		break;
 	case ISCSI_PARAM_PASSWORD:
-		len = sprintf(buf, "%s\n", session->password);
+		len = sysfs_emit(buf, "%s\n", session->password);
 		break;
 	case ISCSI_PARAM_PASSWORD_IN:
-		len = sprintf(buf, "%s\n", session->password_in);
+		len = sysfs_emit(buf, "%s\n", session->password_in);
 		break;
 	case ISCSI_PARAM_IFACE_NAME:
-		len = sprintf(buf, "%s\n", session->ifacename);
+		len = sysfs_emit(buf, "%s\n", session->ifacename);
 		break;
 	case ISCSI_PARAM_INITIATOR_NAME:
-		len = sprintf(buf, "%s\n", session->initiatorname);
+		len = sysfs_emit(buf, "%s\n", session->initiatorname);
 		break;
 	case ISCSI_PARAM_BOOT_ROOT:
-		len = sprintf(buf, "%s\n", session->boot_root);
+		len = sysfs_emit(buf, "%s\n", session->boot_root);
 		break;
 	case ISCSI_PARAM_BOOT_NIC:
-		len = sprintf(buf, "%s\n", session->boot_nic);
+		len = sysfs_emit(buf, "%s\n", session->boot_nic);
 		break;
 	case ISCSI_PARAM_BOOT_TARGET:
-		len = sprintf(buf, "%s\n", session->boot_target);
+		len = sysfs_emit(buf, "%s\n", session->boot_target);
 		break;
 	case ISCSI_PARAM_AUTO_SND_TGT_DISABLE:
-		len = sprintf(buf, "%u\n", session->auto_snd_tgt_disable);
+		len = sysfs_emit(buf, "%u\n", session->auto_snd_tgt_disable);
 		break;
 	case ISCSI_PARAM_DISCOVERY_SESS:
-		len = sprintf(buf, "%u\n", session->discovery_sess);
+		len = sysfs_emit(buf, "%u\n", session->discovery_sess);
 		break;
 	case ISCSI_PARAM_PORTAL_TYPE:
-		len = sprintf(buf, "%s\n", session->portal_type);
+		len = sysfs_emit(buf, "%s\n", session->portal_type);
 		break;
 	case ISCSI_PARAM_CHAP_AUTH_EN:
-		len = sprintf(buf, "%u\n", session->chap_auth_en);
+		len = sysfs_emit(buf, "%u\n", session->chap_auth_en);
 		break;
 	case ISCSI_PARAM_DISCOVERY_LOGOUT_EN:
-		len = sprintf(buf, "%u\n", session->discovery_logout_en);
+		len = sysfs_emit(buf, "%u\n", session->discovery_logout_en);
 		break;
 	case ISCSI_PARAM_BIDI_CHAP_EN:
-		len = sprintf(buf, "%u\n", session->bidi_chap_en);
+		len = sysfs_emit(buf, "%u\n", session->bidi_chap_en);
 		break;
 	case ISCSI_PARAM_DISCOVERY_AUTH_OPTIONAL:
-		len = sprintf(buf, "%u\n", session->discovery_auth_optional);
+		len = sysfs_emit(buf, "%u\n", session->discovery_auth_optional);
 		break;
 	case ISCSI_PARAM_DEF_TIME2WAIT:
-		len = sprintf(buf, "%d\n", session->time2wait);
+		len = sysfs_emit(buf, "%d\n", session->time2wait);
 		break;
 	case ISCSI_PARAM_DEF_TIME2RETAIN:
-		len = sprintf(buf, "%d\n", session->time2retain);
+		len = sysfs_emit(buf, "%d\n", session->time2retain);
 		break;
 	case ISCSI_PARAM_TSID:
-		len = sprintf(buf, "%u\n", session->tsid);
+		len = sysfs_emit(buf, "%u\n", session->tsid);
 		break;
 	case ISCSI_PARAM_ISID:
-		len = sprintf(buf, "%02x%02x%02x%02x%02x%02x\n",
+		len = sysfs_emit(buf, "%02x%02x%02x%02x%02x%02x\n",
 			      session->isid[0], session->isid[1],
 			      session->isid[2], session->isid[3],
 			      session->isid[4], session->isid[5]);
 		break;
 	case ISCSI_PARAM_DISCOVERY_PARENT_IDX:
-		len = sprintf(buf, "%u\n", session->discovery_parent_idx);
+		len = sysfs_emit(buf, "%u\n", session->discovery_parent_idx);
 		break;
 	case ISCSI_PARAM_DISCOVERY_PARENT_TYPE:
 		if (session->discovery_parent_type)
-			len = sprintf(buf, "%s\n",
+			len = sysfs_emit(buf, "%s\n",
 				      session->discovery_parent_type);
 		else
-			len = sprintf(buf, "\n");
+			len = sysfs_emit(buf, "\n");
 		break;
 	default:
 		return -ENOSYS;
@@ -3521,16 +3521,16 @@ int iscsi_conn_get_addr_param(struct sockaddr_storage *addr,
 	case ISCSI_PARAM_CONN_ADDRESS:
 	case ISCSI_HOST_PARAM_IPADDRESS:
 		if (sin)
-			len = sprintf(buf, "%pI4\n", &sin->sin_addr.s_addr);
+			len = sysfs_emit(buf, "%pI4\n", &sin->sin_addr.s_addr);
 		else
-			len = sprintf(buf, "%pI6\n", &sin6->sin6_addr);
+			len = sysfs_emit(buf, "%pI6\n", &sin6->sin6_addr);
 		break;
 	case ISCSI_PARAM_CONN_PORT:
 	case ISCSI_PARAM_LOCAL_PORT:
 		if (sin)
-			len = sprintf(buf, "%hu\n", be16_to_cpu(sin->sin_port));
+			len = sysfs_emit(buf, "%hu\n", be16_to_cpu(sin->sin_port));
 		else
-			len = sprintf(buf, "%hu\n",
+			len = sysfs_emit(buf, "%hu\n",
 				      be16_to_cpu(sin6->sin6_port));
 		break;
 	default:
@@ -3549,88 +3549,88 @@ int iscsi_conn_get_param(struct iscsi_cls_conn *cls_conn,
 
 	switch(param) {
 	case ISCSI_PARAM_PING_TMO:
-		len = sprintf(buf, "%u\n", conn->ping_timeout);
+		len = sysfs_emit(buf, "%u\n", conn->ping_timeout);
 		break;
 	case ISCSI_PARAM_RECV_TMO:
-		len = sprintf(buf, "%u\n", conn->recv_timeout);
+		len = sysfs_emit(buf, "%u\n", conn->recv_timeout);
 		break;
 	case ISCSI_PARAM_MAX_RECV_DLENGTH:
-		len = sprintf(buf, "%u\n", conn->max_recv_dlength);
+		len = sysfs_emit(buf, "%u\n", conn->max_recv_dlength);
 		break;
 	case ISCSI_PARAM_MAX_XMIT_DLENGTH:
-		len = sprintf(buf, "%u\n", conn->max_xmit_dlength);
+		len = sysfs_emit(buf, "%u\n", conn->max_xmit_dlength);
 		break;
 	case ISCSI_PARAM_HDRDGST_EN:
-		len = sprintf(buf, "%d\n", conn->hdrdgst_en);
+		len = sysfs_emit(buf, "%d\n", conn->hdrdgst_en);
 		break;
 	case ISCSI_PARAM_DATADGST_EN:
-		len = sprintf(buf, "%d\n", conn->datadgst_en);
+		len = sysfs_emit(buf, "%d\n", conn->datadgst_en);
 		break;
 	case ISCSI_PARAM_IFMARKER_EN:
-		len = sprintf(buf, "%d\n", conn->ifmarker_en);
+		len = sysfs_emit(buf, "%d\n", conn->ifmarker_en);
 		break;
 	case ISCSI_PARAM_OFMARKER_EN:
-		len = sprintf(buf, "%d\n", conn->ofmarker_en);
+		len = sysfs_emit(buf, "%d\n", conn->ofmarker_en);
 		break;
 	case ISCSI_PARAM_EXP_STATSN:
-		len = sprintf(buf, "%u\n", conn->exp_statsn);
+		len = sysfs_emit(buf, "%u\n", conn->exp_statsn);
 		break;
 	case ISCSI_PARAM_PERSISTENT_PORT:
-		len = sprintf(buf, "%d\n", conn->persistent_port);
+		len = sysfs_emit(buf, "%d\n", conn->persistent_port);
 		break;
 	case ISCSI_PARAM_PERSISTENT_ADDRESS:
-		len = sprintf(buf, "%s\n", conn->persistent_address);
+		len = sysfs_emit(buf, "%s\n", conn->persistent_address);
 		break;
 	case ISCSI_PARAM_STATSN:
-		len = sprintf(buf, "%u\n", conn->statsn);
+		len = sysfs_emit(buf, "%u\n", conn->statsn);
 		break;
 	case ISCSI_PARAM_MAX_SEGMENT_SIZE:
-		len = sprintf(buf, "%u\n", conn->max_segment_size);
+		len = sysfs_emit(buf, "%u\n", conn->max_segment_size);
 		break;
 	case ISCSI_PARAM_KEEPALIVE_TMO:
-		len = sprintf(buf, "%u\n", conn->keepalive_tmo);
+		len = sysfs_emit(buf, "%u\n", conn->keepalive_tmo);
 		break;
 	case ISCSI_PARAM_LOCAL_PORT:
-		len = sprintf(buf, "%u\n", conn->local_port);
+		len = sysfs_emit(buf, "%u\n", conn->local_port);
 		break;
 	case ISCSI_PARAM_TCP_TIMESTAMP_STAT:
-		len = sprintf(buf, "%u\n", conn->tcp_timestamp_stat);
+		len = sysfs_emit(buf, "%u\n", conn->tcp_timestamp_stat);
 		break;
 	case ISCSI_PARAM_TCP_NAGLE_DISABLE:
-		len = sprintf(buf, "%u\n", conn->tcp_nagle_disable);
+		len = sysfs_emit(buf, "%u\n", conn->tcp_nagle_disable);
 		break;
 	case ISCSI_PARAM_TCP_WSF_DISABLE:
-		len = sprintf(buf, "%u\n", conn->tcp_wsf_disable);
+		len = sysfs_emit(buf, "%u\n", conn->tcp_wsf_disable);
 		break;
 	case ISCSI_PARAM_TCP_TIMER_SCALE:
-		len = sprintf(buf, "%u\n", conn->tcp_timer_scale);
+		len = sysfs_emit(buf, "%u\n", conn->tcp_timer_scale);
 		break;
 	case ISCSI_PARAM_TCP_TIMESTAMP_EN:
-		len = sprintf(buf, "%u\n", conn->tcp_timestamp_en);
+		len = sysfs_emit(buf, "%u\n", conn->tcp_timestamp_en);
 		break;
 	case ISCSI_PARAM_IP_FRAGMENT_DISABLE:
-		len = sprintf(buf, "%u\n", conn->fragment_disable);
+		len = sysfs_emit(buf, "%u\n", conn->fragment_disable);
 		break;
 	case ISCSI_PARAM_IPV4_TOS:
-		len = sprintf(buf, "%u\n", conn->ipv4_tos);
+		len = sysfs_emit(buf, "%u\n", conn->ipv4_tos);
 		break;
 	case ISCSI_PARAM_IPV6_TC:
-		len = sprintf(buf, "%u\n", conn->ipv6_traffic_class);
+		len = sysfs_emit(buf, "%u\n", conn->ipv6_traffic_class);
 		break;
 	case ISCSI_PARAM_IPV6_FLOW_LABEL:
-		len = sprintf(buf, "%u\n", conn->ipv6_flow_label);
+		len = sysfs_emit(buf, "%u\n", conn->ipv6_flow_label);
 		break;
 	case ISCSI_PARAM_IS_FW_ASSIGNED_IPV6:
-		len = sprintf(buf, "%u\n", conn->is_fw_assigned_ipv6);
+		len = sysfs_emit(buf, "%u\n", conn->is_fw_assigned_ipv6);
 		break;
 	case ISCSI_PARAM_TCP_XMIT_WSF:
-		len = sprintf(buf, "%u\n", conn->tcp_xmit_wsf);
+		len = sysfs_emit(buf, "%u\n", conn->tcp_xmit_wsf);
 		break;
 	case ISCSI_PARAM_TCP_RECV_WSF:
-		len = sprintf(buf, "%u\n", conn->tcp_recv_wsf);
+		len = sysfs_emit(buf, "%u\n", conn->tcp_recv_wsf);
 		break;
 	case ISCSI_PARAM_LOCAL_IPADDR:
-		len = sprintf(buf, "%s\n", conn->local_ipaddr);
+		len = sysfs_emit(buf, "%s\n", conn->local_ipaddr);
 		break;
 	default:
 		return -ENOSYS;
@@ -3648,13 +3648,13 @@ int iscsi_host_get_param(struct Scsi_Host *shost, enum iscsi_host_param param,
 
 	switch (param) {
 	case ISCSI_HOST_PARAM_NETDEV_NAME:
-		len = sprintf(buf, "%s\n", ihost->netdev);
+		len = sysfs_emit(buf, "%s\n", ihost->netdev);
 		break;
 	case ISCSI_HOST_PARAM_HWADDRESS:
-		len = sprintf(buf, "%s\n", ihost->hwaddress);
+		len = sysfs_emit(buf, "%s\n", ihost->hwaddress);
 		break;
 	case ISCSI_HOST_PARAM_INITIATOR_NAME:
-		len = sprintf(buf, "%s\n", ihost->initiatorname);
+		len = sysfs_emit(buf, "%s\n", ihost->initiatorname);
 		break;
 	default:
 		return -ENOSYS;
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 69206543c34e..759ca3dc6a47 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -122,7 +122,8 @@ show_transport_handle(struct device *dev, struct device_attribute *attr,
 
 	if (!capable(CAP_SYS_ADMIN))
 		return -EACCES;
-	return sprintf(buf, "%llu\n", (unsigned long long)iscsi_handle(priv->iscsi_transport));
+	return sysfs_emit(buf, "%llu\n",
+		  (unsigned long long)iscsi_handle(priv->iscsi_transport));
 }
 static DEVICE_ATTR(handle, S_IRUGO, show_transport_handle, NULL);
 
@@ -132,7 +133,7 @@ show_transport_##name(struct device *dev, 				\
 		      struct device_attribute *attr,char *buf)		\
 {									\
 	struct iscsi_internal *priv = dev_to_iscsi_internal(dev);	\
-	return sprintf(buf, format"\n", priv->iscsi_transport->name);	\
+	return sysfs_emit(buf, format"\n", priv->iscsi_transport->name);\
 }									\
 static DEVICE_ATTR(name, S_IRUGO, show_transport_##name, NULL);
 
@@ -173,7 +174,7 @@ static ssize_t
 show_ep_handle(struct device *dev, struct device_attribute *attr, char *buf)
 {
 	struct iscsi_endpoint *ep = iscsi_dev_to_endpoint(dev);
-	return sprintf(buf, "%llu\n", (unsigned long long) ep->id);
+	return sysfs_emit(buf, "%llu\n", (unsigned long long) ep->id);
 }
 static ISCSI_ATTR(ep, handle, S_IRUGO, show_ep_handle, NULL);
 
@@ -2786,6 +2787,9 @@ iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev)
 	struct iscsi_cls_session *session;
 	int err = 0, value = 0;
 
+	if (ev->u.set_param.len > PAGE_SIZE)
+		return -EINVAL;
+
 	session = iscsi_session_lookup(ev->u.set_param.sid);
 	conn = iscsi_conn_lookup(ev->u.set_param.sid, ev->u.set_param.cid);
 	if (!conn || !session)
@@ -2933,6 +2937,9 @@ iscsi_set_host_param(struct iscsi_transport *transport,
 	if (!transport->set_host_param)
 		return -ENOSYS;
 
+	if (ev->u.set_host_param.len > PAGE_SIZE)
+		return -EINVAL;
+
 	shost = scsi_host_lookup(ev->u.set_host_param.host_no);
 	if (!shost) {
 		printk(KERN_ERR "set_host_param could not find host no %u\n",
@@ -4038,7 +4045,7 @@ show_priv_session_state(struct device *dev, struct device_attribute *attr,
 			char *buf)
 {
 	struct iscsi_cls_session *session = iscsi_dev_to_session(dev->parent);
-	return sprintf(buf, "%s\n", iscsi_session_state_name(session->state));
+	return sysfs_emit(buf, "%s\n", iscsi_session_state_name(session->state));
 }
 static ISCSI_CLASS_ATTR(priv_sess, state, S_IRUGO, show_priv_session_state,
 			NULL);
@@ -4047,7 +4054,7 @@ show_priv_session_creator(struct device *dev, struct device_attribute *attr,
 			char *buf)
 {
 	struct iscsi_cls_session *session = iscsi_dev_to_session(dev->parent);
-	return sprintf(buf, "%d\n", session->creator);
+	return sysfs_emit(buf, "%d\n", session->creator);
 }
 static ISCSI_CLASS_ATTR(priv_sess, creator, S_IRUGO, show_priv_session_creator,
 			NULL);
@@ -4056,7 +4063,7 @@ show_priv_session_target_id(struct device *dev, struct device_attribute *attr,
 			    char *buf)
 {
 	struct iscsi_cls_session *session = iscsi_dev_to_session(dev->parent);
-	return sprintf(buf, "%d\n", session->target_id);
+	return sysfs_emit(buf, "%d\n", session->target_id);
 }
 static ISCSI_CLASS_ATTR(priv_sess, target_id, S_IRUGO,
 			show_priv_session_target_id, NULL);
@@ -4069,8 +4076,8 @@ show_priv_session_##field(struct device *dev, 				\
 	struct iscsi_cls_session *session = 				\
 			iscsi_dev_to_session(dev->parent);		\
 	if (session->field == -1)					\
-		return sprintf(buf, "off\n");				\
-	return sprintf(buf, format"\n", session->field);		\
+		return sysfs_emit(buf, "off\n");			\
+	return sysfs_emit(buf, format"\n", session->field);		\
 }
 
 #define iscsi_priv_session_attr_store(field)				\

From ac8bc5531b98c5186cdd7645381d92458cf633b7 Mon Sep 17 00:00:00 2001
From: Chris Leech <cleech@redhat.com>
Date: Tue, 23 Feb 2021 21:39:01 -0800
Subject: [PATCH 1636/2658] scsi: iscsi: Verify lengths on passthrough PDUs

commit f9dbdf97a5bd92b1a49cee3d591b55b11fd7a6d5 upstream.

Open-iSCSI sends passthrough PDUs over netlink, but the kernel should be
verifying that the provided PDU header and data lengths fall within the
netlink message to prevent accessing beyond that in memory.

Cc: stable@vger.kernel.org
Reported-by: Adam Nichols <adam@grimm-co.com>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Chris Leech <cleech@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/scsi_transport_iscsi.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 759ca3dc6a47..42bc4b71b0ba 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -3526,6 +3526,7 @@ static int
 iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
 {
 	int err = 0;
+	u32 pdu_len;
 	struct iscsi_uevent *ev = nlmsg_data(nlh);
 	struct iscsi_transport *transport = NULL;
 	struct iscsi_internal *priv;
@@ -3641,6 +3642,14 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
 			err = -EINVAL;
 		break;
 	case ISCSI_UEVENT_SEND_PDU:
+		pdu_len = nlh->nlmsg_len - sizeof(*nlh) - sizeof(*ev);
+
+		if ((ev->u.send_pdu.hdr_size > pdu_len) ||
+		    (ev->u.send_pdu.data_size > (pdu_len - ev->u.send_pdu.hdr_size))) {
+			err = -EINVAL;
+			break;
+		}
+
 		conn = iscsi_conn_lookup(ev->u.send_pdu.sid, ev->u.send_pdu.cid);
 		if (conn)
 			ev->r.retcode =	transport->send_pdu(conn,

From 51ac66ca0248819de00067f19308b42c703ae4e3 Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Thu, 25 Feb 2021 16:34:43 +0100
Subject: [PATCH 1637/2658] Xen/gnttab: handle p2m update errors on a per-slot
 basis

commit 8310b77b48c5558c140e7a57a702e7819e62f04e upstream.

Bailing immediately from set_foreign_p2m_mapping() upon a p2m updating
error leaves the full batch in an ambiguous state as far as the caller
is concerned. Instead flags respective slots as bad, unmapping what
was mapped there right away.

HYPERVISOR_grant_table_op()'s return value and the individual unmap
slots' status fields get used only for a one-time - there's not much we
can do in case of a failure.

Note that there's no GNTST_enomem or alike, so GNTST_general_error gets
used.

The map ops' handle fields get overwritten just to be on the safe side.

This is part of XSA-367.

Cc: <stable@vger.kernel.org>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/96cccf5d-e756-5f53-b91a-ea269bfb9be0@suse.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/xen/p2m.c | 35 +++++++++++++++++++++++++++++++----
 arch/x86/xen/p2m.c | 44 +++++++++++++++++++++++++++++++++++++++++---
 2 files changed, 72 insertions(+), 7 deletions(-)

diff --git a/arch/arm/xen/p2m.c b/arch/arm/xen/p2m.c
index 02579e6569f0..b4ec8d1b0bef 100644
--- a/arch/arm/xen/p2m.c
+++ b/arch/arm/xen/p2m.c
@@ -91,12 +91,39 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
 	int i;
 
 	for (i = 0; i < count; i++) {
+		struct gnttab_unmap_grant_ref unmap;
+		int rc;
+
 		if (map_ops[i].status)
 			continue;
-		if (unlikely(!set_phys_to_machine(map_ops[i].host_addr >> XEN_PAGE_SHIFT,
-				    map_ops[i].dev_bus_addr >> XEN_PAGE_SHIFT))) {
-			return -ENOMEM;
-		}
+		if (likely(set_phys_to_machine(map_ops[i].host_addr >> XEN_PAGE_SHIFT,
+				    map_ops[i].dev_bus_addr >> XEN_PAGE_SHIFT)))
+			continue;
+
+		/*
+		 * Signal an error for this slot. This in turn requires
+		 * immediate unmapping.
+		 */
+		map_ops[i].status = GNTST_general_error;
+		unmap.host_addr = map_ops[i].host_addr,
+		unmap.handle = map_ops[i].handle;
+		map_ops[i].handle = ~0;
+		if (map_ops[i].flags & GNTMAP_device_map)
+			unmap.dev_bus_addr = map_ops[i].dev_bus_addr;
+		else
+			unmap.dev_bus_addr = 0;
+
+		/*
+		 * Pre-populate the status field, to be recognizable in
+		 * the log message below.
+		 */
+		unmap.status = 1;
+
+		rc = HYPERVISOR_grant_table_op(GNTTABOP_unmap_grant_ref,
+					       &unmap, 1);
+		if (rc || unmap.status != GNTST_okay)
+			pr_err_once("gnttab unmap failed: rc=%d st=%d\n",
+				    rc, unmap.status);
 	}
 
 	return 0;
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index 8c7c5bb94257..86047b18b013 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -723,6 +723,8 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
 
 	for (i = 0; i < count; i++) {
 		unsigned long mfn, pfn;
+		struct gnttab_unmap_grant_ref unmap[2];
+		int rc;
 
 		/* Do not add to override if the map failed. */
 		if (map_ops[i].status != GNTST_okay ||
@@ -740,10 +742,46 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
 
 		WARN(pfn_to_mfn(pfn) != INVALID_P2M_ENTRY, "page must be ballooned");
 
-		if (unlikely(!set_phys_to_machine(pfn, FOREIGN_FRAME(mfn)))) {
-			ret = -ENOMEM;
-			goto out;
+		if (likely(set_phys_to_machine(pfn, FOREIGN_FRAME(mfn))))
+			continue;
+
+		/*
+		 * Signal an error for this slot. This in turn requires
+		 * immediate unmapping.
+		 */
+		map_ops[i].status = GNTST_general_error;
+		unmap[0].host_addr = map_ops[i].host_addr,
+		unmap[0].handle = map_ops[i].handle;
+		map_ops[i].handle = ~0;
+		if (map_ops[i].flags & GNTMAP_device_map)
+			unmap[0].dev_bus_addr = map_ops[i].dev_bus_addr;
+		else
+			unmap[0].dev_bus_addr = 0;
+
+		if (kmap_ops) {
+			kmap_ops[i].status = GNTST_general_error;
+			unmap[1].host_addr = kmap_ops[i].host_addr,
+			unmap[1].handle = kmap_ops[i].handle;
+			kmap_ops[i].handle = ~0;
+			if (kmap_ops[i].flags & GNTMAP_device_map)
+				unmap[1].dev_bus_addr = kmap_ops[i].dev_bus_addr;
+			else
+				unmap[1].dev_bus_addr = 0;
 		}
+
+		/*
+		 * Pre-populate both status fields, to be recognizable in
+		 * the log message below.
+		 */
+		unmap[0].status = 1;
+		unmap[1].status = 1;
+
+		rc = HYPERVISOR_grant_table_op(GNTTABOP_unmap_grant_ref,
+					       unmap, 1 + !!kmap_ops);
+		if (rc || unmap[0].status != GNTST_okay ||
+		    unmap[1].status != GNTST_okay)
+			pr_err_once("gnttab unmap failed: rc=%d st0=%d st1=%d\n",
+				    rc, unmap[0].status, unmap[1].status);
 	}
 
 out:

From 06fc902fc1cde38573123056848452ede536d5d8 Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Thu, 25 Feb 2021 16:35:15 +0100
Subject: [PATCH 1638/2658] xen-netback: respect gnttab_map_refs()'s return
 value

commit 2991397d23ec597405b116d96de3813420bdcbc3 upstream.

Commit 3194a1746e8a ("xen-netback: don't "handle" error by BUG()")
dropped respective a BUG_ON() without noticing that with this the
variable's value wouldn't be consumed anymore. With gnttab_set_map_op()
setting all status fields to a non-zero value, in case of an error no
slot should have a status of GNTST_okay (zero).

This is part of XSA-367.

Cc: <stable@vger.kernel.org>
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/d933f495-619a-0086-5fb4-1ec3cf81a8fc@suse.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/xen-netback/netback.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 9a988ea5d797..c8c6afc0ab51 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1792,11 +1792,21 @@ int xenvif_tx_action(struct xenvif_queue *queue, int budget)
 		return 0;
 
 	gnttab_batch_copy(queue->tx_copy_ops, nr_cops);
-	if (nr_mops != 0)
+	if (nr_mops != 0) {
 		ret = gnttab_map_refs(queue->tx_map_ops,
 				      NULL,
 				      queue->pages_to_map,
 				      nr_mops);
+		if (ret) {
+			unsigned int i;
+
+			netdev_err(queue->vif->dev, "Map fail: nr %u ret %d\n",
+				   nr_mops, ret);
+			for (i = 0; i < nr_mops; ++i)
+				WARN_ON_ONCE(queue->tx_map_ops[i].status ==
+				             GNTST_okay);
+		}
+	}
 
 	work_done = xenvif_tx_submit(queue);
 

From 1aa22950af073f069321471b5716b3d88ef8e8cf Mon Sep 17 00:00:00 2001
From: Rokudo Yan <wu-yan@tcl.com>
Date: Thu, 25 Feb 2021 17:18:31 -0800
Subject: [PATCH 1639/2658] zsmalloc: account the number of compacted pages
 correctly

commit 2395928158059b8f9858365fce7713ce7fef62e4 upstream.

There exists multiple path may do zram compaction concurrently.
1. auto-compaction triggered during memory reclaim
2. userspace utils write zram<id>/compaction node

So, multiple threads may call zs_shrinker_scan/zs_compact concurrently.
But pages_compacted is a per zsmalloc pool variable and modification
of the variable is not serialized(through under class->lock).
There are two issues here:
1. the pages_compacted may not equal to total number of pages
freed(due to concurrently add).
2. zs_shrinker_scan may not return the correct number of pages
freed(issued by current shrinker).

The fix is simple:
1. account the number of pages freed in zs_compact locally.
2. use actomic variable pages_compacted to accumulate total number.

Link: https://lkml.kernel.org/r/20210202122235.26885-1-wu-yan@tcl.com
Fixes: 860c707dca155a56 ("zsmalloc: account the number of compacted pages")
Signed-off-by: Rokudo Yan <wu-yan@tcl.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/block/zram/zram_drv.c |  2 +-
 include/linux/zsmalloc.h      |  2 +-
 mm/zsmalloc.c                 | 27 +++++++++++++++------------
 3 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index c1c12b239140..5b572b5b269d 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -457,7 +457,7 @@ static ssize_t mm_stat_show(struct device *dev,
 			zram->limit_pages << PAGE_SHIFT,
 			max_used << PAGE_SHIFT,
 			(u64)atomic64_read(&zram->stats.zero_pages),
-			pool_stats.pages_compacted);
+			atomic_long_read(&pool_stats.pages_compacted));
 	up_read(&zram->init_lock);
 
 	return ret;
diff --git a/include/linux/zsmalloc.h b/include/linux/zsmalloc.h
index 57a8e98f2708..6c871102c273 100644
--- a/include/linux/zsmalloc.h
+++ b/include/linux/zsmalloc.h
@@ -36,7 +36,7 @@ enum zs_mapmode {
 
 struct zs_pool_stats {
 	/* How many pages were migrated (freed) */
-	unsigned long pages_compacted;
+	atomic_long_t pages_compacted;
 };
 
 struct zs_pool;
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index c33d65891e9d..24df80a89291 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -2261,11 +2261,13 @@ static unsigned long zs_can_compact(struct size_class *class)
 	return obj_wasted * class->pages_per_zspage;
 }
 
-static void __zs_compact(struct zs_pool *pool, struct size_class *class)
+static unsigned long __zs_compact(struct zs_pool *pool,
+				   struct size_class *class)
 {
 	struct zs_compact_control cc;
-	struct zspage *src_zspage;
-	struct zspage *dst_zspage = NULL;
+	struct page *src_page;
+	struct page *dst_page = NULL;
+	unsigned long pages_freed = 0;
 
 	spin_lock(&class->lock);
 	while ((src_zspage = isolate_zspage(class, true))) {
@@ -2292,11 +2294,9 @@ static void __zs_compact(struct zs_pool *pool, struct size_class *class)
 		if (dst_zspage == NULL)
 			break;
 
-		putback_zspage(class, dst_zspage);
-		if (putback_zspage(class, src_zspage) == ZS_EMPTY) {
-			free_zspage(pool, class, src_zspage);
-			pool->stats.pages_compacted += class->pages_per_zspage;
-		}
+		putback_zspage(pool, class, dst_page);
+		if (putback_zspage(pool, class, src_page) == ZS_EMPTY)
+			pages_freed += class->pages_per_zspage;
 		spin_unlock(&class->lock);
 		cond_resched();
 		spin_lock(&class->lock);
@@ -2306,12 +2306,15 @@ static void __zs_compact(struct zs_pool *pool, struct size_class *class)
 		putback_zspage(class, src_zspage);
 
 	spin_unlock(&class->lock);
+
+	return pages_freed;
 }
 
 unsigned long zs_compact(struct zs_pool *pool)
 {
 	int i;
 	struct size_class *class;
+	unsigned long pages_freed = 0;
 
 	for (i = zs_size_classes - 1; i >= 0; i--) {
 		class = pool->size_class[i];
@@ -2319,10 +2322,11 @@ unsigned long zs_compact(struct zs_pool *pool)
 			continue;
 		if (class->index != i)
 			continue;
-		__zs_compact(pool, class);
+		pages_freed += __zs_compact(pool, class);
 	}
+	atomic_long_add(pages_freed, &pool->stats.pages_compacted);
 
-	return pool->stats.pages_compacted;
+	return pages_freed;
 }
 EXPORT_SYMBOL_GPL(zs_compact);
 
@@ -2339,13 +2343,12 @@ static unsigned long zs_shrinker_scan(struct shrinker *shrinker,
 	struct zs_pool *pool = container_of(shrinker, struct zs_pool,
 			shrinker);
 
-	pages_freed = pool->stats.pages_compacted;
 	/*
 	 * Compact classes and calculate compaction delta.
 	 * Can run concurrently with a manually triggered
 	 * (by user) compaction.
 	 */
-	pages_freed = zs_compact(pool) - pages_freed;
+	pages_freed = zs_compact(pool);
 
 	return pages_freed ? pages_freed : SHRINK_STOP;
 }

From 6ce8ea2888ec65e99d0b23a8327f0a3f951f2cea Mon Sep 17 00:00:00 2001
From: Jens Axboe <axboe@kernel.dk>
Date: Tue, 2 Mar 2021 14:53:21 -0700
Subject: [PATCH 1640/2658] swap: fix swapfile read/write offset

commit caf6912f3f4af7232340d500a4a2008f81b93f14 upstream.

We're not factoring in the start of the file for where to write and
read the swapfile, which leads to very unfortunate side effects of
writing where we should not be...

[This issue only affects swapfiles on filesystems on top of blockdevs
that implement rw_page ops (brd, zram, btt, pmem), and not on top of any
other block devices, in contrast to the upstream commit fix.]

Fixes: dd6bd0d9c7db ("swap: use bdev_read_page() / bdev_write_page()")
Cc: stable@vger.kernel.org # 4.4
Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/page_io.c  | 11 +++--------
 mm/swapfile.c |  2 +-
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/mm/page_io.c b/mm/page_io.c
index b995a5ba5e8f..ab92cd559404 100644
--- a/mm/page_io.c
+++ b/mm/page_io.c
@@ -32,7 +32,6 @@ static struct bio *get_swap_bio(gfp_t gfp_flags,
 	bio = bio_alloc(gfp_flags, 1);
 	if (bio) {
 		bio->bi_iter.bi_sector = map_swap_page(page, &bio->bi_bdev);
-		bio->bi_iter.bi_sector <<= PAGE_SHIFT - 9;
 		bio->bi_end_io = end_io;
 
 		bio_add_page(bio, page, PAGE_SIZE, 0);
@@ -244,11 +243,6 @@ int swap_writepage(struct page *page, struct writeback_control *wbc)
 	return ret;
 }
 
-static sector_t swap_page_sector(struct page *page)
-{
-	return (sector_t)__page_file_index(page) << (PAGE_CACHE_SHIFT - 9);
-}
-
 int __swap_writepage(struct page *page, struct writeback_control *wbc,
 		bio_end_io_t end_write_func)
 {
@@ -297,7 +291,8 @@ int __swap_writepage(struct page *page, struct writeback_control *wbc,
 		return ret;
 	}
 
-	ret = bdev_write_page(sis->bdev, swap_page_sector(page), page, wbc);
+	ret = bdev_write_page(sis->bdev, map_swap_page(page, &sis->bdev),
+			      page, wbc);
 	if (!ret) {
 		count_vm_event(PSWPOUT);
 		return 0;
@@ -345,7 +340,7 @@ int swap_readpage(struct page *page)
 		return ret;
 	}
 
-	ret = bdev_read_page(sis->bdev, swap_page_sector(page), page);
+	ret = bdev_read_page(sis->bdev, map_swap_page(page, &sis->bdev), page);
 	if (!ret) {
 		count_vm_event(PSWPIN);
 		return 0;
diff --git a/mm/swapfile.c b/mm/swapfile.c
index dfebc99eefd8..e7461b9b02e6 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -1696,7 +1696,7 @@ sector_t map_swap_page(struct page *page, struct block_device **bdev)
 {
 	swp_entry_t entry;
 	entry.val = page_private(page);
-	return map_swap_entry(entry, bdev);
+	return map_swap_entry(entry, bdev) << (PAGE_SHIFT - 9);
 }
 
 /*

From 2129f08faafd6ae03199e25c71e6da980a72d9f3 Mon Sep 17 00:00:00 2001
From: Sakari Ailus <sakari.ailus@linux.intel.com>
Date: Sat, 19 Dec 2020 23:29:58 +0100
Subject: [PATCH 1641/2658] media: v4l: ioctl: Fix memory leak in
 video_usercopy

commit fb18802a338b36f675a388fc03d2aa504a0d0899 upstream.

When an IOCTL with argument size larger than 128 that also used array
arguments were handled, two memory allocations were made but alas, only
the latter one of them was released. This happened because there was only
a single local variable to hold such a temporary allocation.

Fix this by adding separate variables to hold the pointers to the
temporary allocations.

Reported-by: Arnd Bergmann <arnd@kernel.org>
Reported-by: syzbot+1115e79c8df6472c612b@syzkaller.appspotmail.com
Fixes: d14e6d76ebf7 ("[media] v4l: Add multi-planar ioctl handling code")
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/v4l2-core/v4l2-ioctl.c | 19 +++++++------------
 1 file changed, 7 insertions(+), 12 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index 79829f56a816..59aa45f827f0 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -2798,7 +2798,7 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg,
 	       v4l2_kioctl func)
 {
 	char	sbuf[128];
-	void    *mbuf = NULL;
+	void    *mbuf = NULL, *array_buf = NULL;
 	void	*parg = (void *)arg;
 	long	err  = -EINVAL;
 	bool	has_array_args;
@@ -2853,20 +2853,14 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg,
 	has_array_args = err;
 
 	if (has_array_args) {
-		/*
-		 * When adding new types of array args, make sure that the
-		 * parent argument to ioctl (which contains the pointer to the
-		 * array) fits into sbuf (so that mbuf will still remain
-		 * unused up to here).
-		 */
-		mbuf = kmalloc(array_size, GFP_KERNEL);
+		array_buf = kmalloc(array_size, GFP_KERNEL);
 		err = -ENOMEM;
-		if (NULL == mbuf)
+		if (array_buf == NULL)
 			goto out_array_args;
 		err = -EFAULT;
-		if (copy_from_user(mbuf, user_ptr, array_size))
+		if (copy_from_user(array_buf, user_ptr, array_size))
 			goto out_array_args;
-		*kernel_ptr = mbuf;
+		*kernel_ptr = array_buf;
 	}
 
 	/* Handles IOCTL */
@@ -2885,7 +2879,7 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg,
 
 	if (has_array_args) {
 		*kernel_ptr = (void __force *)user_ptr;
-		if (copy_to_user(user_ptr, mbuf, array_size))
+		if (copy_to_user(user_ptr, array_buf, array_size))
 			err = -EFAULT;
 		goto out_array_args;
 	}
@@ -2905,6 +2899,7 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg,
 	}
 
 out:
+	kfree(array_buf);
 	kfree(mbuf);
 	return err;
 }

From ef25050e6da39ed60c8da8f70e5ec29eba2bb6ca Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sun, 7 Mar 2021 11:24:22 +0100
Subject: [PATCH 1642/2658] Linux 4.4.260

Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20210305120849.381261651@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 8a616e116f8a..a36ec3c543cc 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 259
+SUBLEVEL = 260
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From d148990927d347ba0346008a3beab94a6b01295c Mon Sep 17 00:00:00 2001
From: Thomas Schoebel-Theuer <tst@1und1.de>
Date: Sun, 7 Mar 2021 08:26:29 +0100
Subject: [PATCH 1643/2658] futex: fix irq self-deadlock and satisfy assertion

This patch and problem analysis is specific for 4.4 LTS, due to incomplete
backporting of other fixes. Later LTS series have different backports.

Since v4.4.257 when CONFIG_PROVE_LOCKING=y
the following triggers right after reboot of our pre-life systems
which equal our production setup:

Mar 03 11:27:33 icpu-test-bap10 kernel: =================================
Mar 03 11:27:33 icpu-test-bap10 kernel: [ INFO: inconsistent lock state ]
Mar 03 11:27:33 icpu-test-bap10 kernel: 4.4.259-rc1-grsec+ #730 Not tainted
Mar 03 11:27:33 icpu-test-bap10 kernel: ---------------------------------
Mar 03 11:27:33 icpu-test-bap10 kernel: inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
Mar 03 11:27:33 icpu-test-bap10 kernel: apache2-ssl/9310 [HC0[0]:SC0[0]:HE1:SE1] takes:
Mar 03 11:27:33 icpu-test-bap10 kernel:  (&p->pi_lock){?.-.-.}, at: [<ffffffff810abb68>] pi_state_update_owner+0x51/0xd7
Mar 03 11:27:33 icpu-test-bap10 kernel: {IN-HARDIRQ-W} state was registered at:
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff81088c4a>] __lock_acquire+0x3a7/0xe4a
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff81089b01>] lock_acquire+0x18d/0x1bc
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff8170151c>] _raw_spin_lock_irqsave+0x3e/0x50
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff810719a5>] try_to_wake_up+0x2c/0x210
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff81071bf3>] default_wake_function+0xd/0xf
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff81083588>] autoremove_wake_function+0x11/0x35
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff810830b2>] __wake_up_common+0x48/0x7c
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff8108311a>] __wake_up+0x34/0x46
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff814c2a23>] megasas_complete_int_cmd+0x31/0x33
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff814c60a0>] megasas_complete_cmd+0x570/0x57b
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff814d05bc>] complete_cmd_fusion+0x23e/0x33d
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff814d0768>] megasas_isr_fusion+0x67/0x74
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff81091ae5>] handle_irq_event_percpu+0x134/0x311
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff81091cf5>] handle_irq_event+0x33/0x51
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff810948b9>] handle_edge_irq+0xa3/0xc2
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff81005f7b>] handle_irq+0xf9/0x101
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff81005700>] do_IRQ+0x80/0xf5
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff81702228>] ret_from_intr+0x0/0x20
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff8100cab0>] arch_cpu_idle+0xa/0xc
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff81083a5a>] default_idle_call+0x1e/0x20
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff81083b9d>] cpu_startup_entry+0x141/0x22f
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff816fb853>] rest_init+0x135/0x13b
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff81d5ce99>] start_kernel+0x3fa/0x40a
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff81d5c2af>] x86_64_start_reservations+0x2a/0x2c
Mar 03 11:27:33 icpu-test-bap10 kernel:   [<ffffffff81d5c3d0>] x86_64_start_kernel+0x11f/0x12c
Mar 03 11:27:33 icpu-test-bap10 kernel: irq event stamp: 1457
Mar 03 11:27:33 icpu-test-bap10 kernel: hardirqs last  enabled at (1457): [<ffffffff81042a69>] get_user_pages_fast+0xeb/0x14f
Mar 03 11:27:33 icpu-test-bap10 kernel: hardirqs last disabled at (1456): [<ffffffff810429dd>] get_user_pages_fast+0x5f/0x14f
Mar 03 11:27:33 icpu-test-bap10 kernel: softirqs last  enabled at (1446): [<ffffffff815e127d>] release_sock+0x142/0x14d
Mar 03 11:27:33 icpu-test-bap10 kernel: softirqs last disabled at (1444): [<ffffffff815e116f>] release_sock+0x34/0x14d
Mar 03 11:27:33 icpu-test-bap10 kernel:
                                        other info that might help us debug this:
Mar 03 11:27:33 icpu-test-bap10 kernel:  Possible unsafe locking scenario:
Mar 03 11:27:33 icpu-test-bap10 kernel:        CPU0
Mar 03 11:27:33 icpu-test-bap10 kernel:        ----
Mar 03 11:27:33 icpu-test-bap10 kernel:   lock(&p->pi_lock);
Mar 03 11:27:33 icpu-test-bap10 kernel:   <Interrupt>
Mar 03 11:27:33 icpu-test-bap10 kernel:     lock(&p->pi_lock);
Mar 03 11:27:33 icpu-test-bap10 kernel:
                                         *** DEADLOCK ***
Mar 03 11:27:33 icpu-test-bap10 kernel: 2 locks held by apache2-ssl/9310:
Mar 03 11:27:33 icpu-test-bap10 kernel:  #0:  (&(&(__futex_data.queues)[i].lock)->rlock){+.+...}, at: [<ffffffff810ae4e6>] do
Mar 03 11:27:33 icpu-test-bap10 kernel:  #1:  (&lock->wait_lock){+.+...}, at: [<ffffffff810ae53a>] do_futex+0x639/0x809
Mar 03 11:27:33 icpu-test-bap10 kernel:
                                        stack backtrace:
Mar 03 11:27:33 icpu-test-bap10 kernel: CPU: 13 PID: 9310 UID: 99 Comm: apache2-ssl Not tainted 4.4.259-rc1-grsec+ #730
Mar 03 11:27:33 icpu-test-bap10 kernel: Hardware name: Dell Inc. PowerEdge R630/02C2CP, BIOS 2.11.0 11/02/2019
Mar 03 11:27:33 icpu-test-bap10 kernel:  0000000000000000 ffff883fb79bfc00 ffffffff816f8fc2 ffff883ffa66d300
Mar 03 11:27:33 icpu-test-bap10 kernel:  ffffffff8eaa71f0 ffff883fb79bfc50 ffffffff81088484 0000000000000000
Mar 03 11:27:33 icpu-test-bap10 kernel:  0000000000000001 0000000000000001 0000000000000002 ffff883ffa66db58
Mar 03 11:27:33 icpu-test-bap10 kernel: Call Trace:
Mar 03 11:27:33 icpu-test-bap10 kernel:  [<ffffffff816f8fc2>] dump_stack+0x94/0xca
Mar 03 11:27:33 icpu-test-bap10 kernel:  [<ffffffff81088484>] print_usage_bug+0x1bc/0x1d1
Mar 03 11:27:33 icpu-test-bap10 kernel:  [<ffffffff81087d76>] ? check_usage_forwards+0x98/0x98
Mar 03 11:27:33 icpu-test-bap10 kernel:  [<ffffffff810885a5>] mark_lock+0x10c/0x203
Mar 03 11:27:33 icpu-test-bap10 kernel:  [<ffffffff81088cb9>] __lock_acquire+0x416/0xe4a
Mar 03 11:27:33 icpu-test-bap10 kernel:  [<ffffffff810abb68>] ? pi_state_update_owner+0x51/0xd7
Mar 03 11:27:33 icpu-test-bap10 kernel:  [<ffffffff81089b01>] lock_acquire+0x18d/0x1bc
Mar 03 11:27:33 icpu-test-bap10 kernel:  [<ffffffff81089b01>] ? lock_acquire+0x18d/0x1bc
Mar 03 11:27:33 icpu-test-bap10 kernel:  [<ffffffff810abb68>] ? pi_state_update_owner+0x51/0xd7
Mar 03 11:27:33 icpu-test-bap10 kernel:  [<ffffffff81700d12>] _raw_spin_lock+0x2a/0x39
Mar 03 11:27:33 icpu-test-bap10 kernel:  [<ffffffff810abb68>] ? pi_state_update_owner+0x51/0xd7
Mar 03 11:27:33 icpu-test-bap10 kernel:  [<ffffffff810abb68>] pi_state_update_owner+0x51/0xd7
Mar 03 11:27:33 icpu-test-bap10 kernel:  [<ffffffff810ae5af>] do_futex+0x6ae/0x809
Mar 03 11:27:33 icpu-test-bap10 kernel:  [<ffffffff810ae83d>] SyS_futex+0x133/0x143
Mar 03 11:27:33 icpu-test-bap10 kernel:  [<ffffffff8100158a>] ? syscall_trace_enter_phase2+0x1a2/0x1bb
Mar 03 11:27:33 icpu-test-bap10 kernel:  [<ffffffff81701848>] tracesys_phase2+0x90/0x95

Bisecting detects 47e452fcf2f
in the above specific scenario using apache-ssl,
but apparently the missing *_irq() was introduced in
34c8e1c2c02.

However, just reverting the old _irq() variants to a similar status
than before 34c8e1c2c02,
or using _irqsave() / _irqrestore() as some other backports are doing
in various places, would not really help.

The fundamental problem is the following violation of the assertion
lockdep_assert_held(&pi_state->pi_mutex.wait_lock) in pi_state_update_owner():

Mar 03 12:50:03 icpu-test-bap10 kernel: ------------[ cut here ]------------
Mar 03 12:50:03 icpu-test-bap10 kernel: WARNING: CPU: 37 PID: 8488 at kernel/futex.c:844 pi_state_update_owner+0x3d/0xd7()
Mar 03 12:50:03 icpu-test-bap10 kernel: Modules linked in: xt_time xt_connlimit xt_connmark xt_NFLOG xt_limit xt_hashlimit veth ip_set_bitmap_port xt_DSCP xt_multiport ip_set_hash_ip xt_owner xt_set ip_set_hash_net xt_state xt_conntrack nf_conntrack_ftp mars lz4_decompress lz4_compress ipmi_devintf x86_pkg_temp_thermal coretemp crct10dif_pclmul crc32_pclmul hed ipmi_si ipmi_msghandler processor crc32c_intel ehci_pci ehci_hcd usbcore i40e usb_common
Mar 03 12:50:03 icpu-test-bap10 kernel: CPU: 37 PID: 8488 UID: 99 Comm: apache2-ssl Not tainted 4.4.259-rc1-grsec+ #737
Mar 03 12:50:03 icpu-test-bap10 kernel: Hardware name: Dell Inc. PowerEdge R630/02C2CP, BIOS 2.11.0 11/02/2019
Mar 03 12:50:03 icpu-test-bap10 kernel:  0000000000000000 ffff883f863f7c70 ffffffff816f9002 0000000000000000
Mar 03 12:50:03 icpu-test-bap10 kernel:  0000000000000009 ffff883f863f7ca8 ffffffff8104cda2 ffffffff810abac7
Mar 03 12:50:03 icpu-test-bap10 kernel:  ffff883ffbfe5e80 0000000000000000 ffff883f82ed4bc0 00007fc01c9bf000
Mar 03 12:50:03 icpu-test-bap10 kernel: Call Trace:
Mar 03 12:50:03 icpu-test-bap10 kernel:  [<ffffffff816f9002>] dump_stack+0x94/0xca
Mar 03 12:50:03 icpu-test-bap10 kernel:  [<ffffffff8104cda2>] warn_slowpath_common+0x94/0xad
Mar 03 12:50:03 icpu-test-bap10 kernel:  [<ffffffff810abac7>] ? pi_state_update_owner+0x3d/0xd7
Mar 03 12:50:03 icpu-test-bap10 kernel:  [<ffffffff8104ce5f>] warn_slowpath_null+0x15/0x17
Mar 03 12:50:03 icpu-test-bap10 kernel:  [<ffffffff810abac7>] pi_state_update_owner+0x3d/0xd7
Mar 03 12:50:03 icpu-test-bap10 kernel:  [<ffffffff810abea8>] free_pi_state+0x2d/0x73
Mar 03 12:50:03 icpu-test-bap10 kernel:  [<ffffffff810abf0b>] unqueue_me_pi+0x1d/0x31
Mar 03 12:50:03 icpu-test-bap10 kernel:  [<ffffffff810ad735>] futex_lock_pi+0x27a/0x2e8
Mar 03 12:50:03 icpu-test-bap10 kernel:  [<ffffffff81088bca>] ? __lock_acquire+0x327/0xe4a
Mar 03 12:50:03 icpu-test-bap10 kernel:  [<ffffffff810ae6a9>] do_futex+0x784/0x809
Mar 03 12:50:03 icpu-test-bap10 kernel:  [<ffffffff810cfa9a>] ? seccomp_phase1+0xde/0x1e7
Mar 03 12:50:03 icpu-test-bap10 kernel:  [<ffffffff810a4503>] ? current_kernel_time64+0xb/0x31
Mar 03 12:50:03 icpu-test-bap10 kernel:  [<ffffffff810d23c3>] ? current_kernel_time+0xb/0xf
Mar 03 12:50:03 icpu-test-bap10 kernel:  [<ffffffff810ae861>] SyS_futex+0x133/0x143
Mar 03 12:50:03 icpu-test-bap10 kernel:  [<ffffffff8100158a>] ? syscall_trace_enter_phase2+0x1a2/0x1bb
Mar 03 12:50:03 icpu-test-bap10 kernel:  [<ffffffff81701888>] tracesys_phase2+0x90/0x95
Mar 03 12:50:03 icpu-test-bap10 kernel: ---[ end trace 968f95a458dea951 ]---

In order to both (1) prevent the self-deadlock, and (2) to satisfy the assertion
at pi_state_update_owner(), some locking with irq disable is needed,
at least in the specific call stack.

Interestingly, there existed a suchalike locking just before
f08a4af5ccb.

This is just a quick hotfix, resurrecting some previous
locks at the old places, but now using ->wait_lock in place
of the previous ->pi_lock (which was in place before
f08a4af5ccb).

The ->pi_lock is now also taken, by the new code
which had been introduced in
34c8e1c2c02.

When this patch is applied, both the above splats are
no longer triggering at my prelife machines.

Without this patch, I cannot ensure stable production at
1&1 Ionos.

Hint for further work: I have not yet tested other call paths,
since I am under time pressure for security reasons.

Hint for further hardening of 4.4.y and probably some more LTS series:
Probably some more systematic testing with CONFIG_PROVE_LOCKING
(and probably some more options) should be invested
in order to make the 4.4 LTS series really "stable" again.

Signed-off-by: Thomas Schoebel-Theuer <tst@1und1.de>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Lee Jones <lee.jones@linaro.org>
Fixes: f08a4af5ccb2 ("futex: Use pi_state_update_owner() in put_pi_state()")
Fixes: 34c8e1c2c025 ("futex: Provide and use pi_state_update_owner()")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/futex.c b/kernel/futex.c
index 195d89a64fe5..ceba9d1d99a5 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -874,7 +874,9 @@ static void free_pi_state(struct futex_pi_state *pi_state)
 	 * and has cleaned up the pi_state already
 	 */
 	if (pi_state->owner) {
+		raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
 		pi_state_update_owner(pi_state, NULL);
+		raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
 		rt_mutex_proxy_unlock(&pi_state->pi_mutex);
 	}
 

From 78011289e71c76b177ee32a420aba1f501235c21 Mon Sep 17 00:00:00 2001
From: Thomas Schoebel-Theuer <tst@1und1.de>
Date: Sun, 7 Mar 2021 08:23:22 +0100
Subject: [PATCH 1644/2658] futex: fix spin_lock() / spin_unlock_irq()
 imbalance

This patch and problem analysis is specific for 4.4 LTS, due to incomplete
backporting of other fixes. Later LTS series have different backports.

The following is obviously incorrect:

static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this,
             struct futex_hash_bucket *hb)
{
[...]
	raw_spin_lock(&pi_state->pi_mutex.wait_lock);
[...]
	raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
[...]
}

The 4.4-specific fix should probably go in the direction of
b4abf91047c,
making everything irq-safe.

Probably, backporting of b4abf91047c
to 4.4 LTS could thus be another good idea.

However, this might involve some more 4.4-specific work and
require thorough testing:

> git log --oneline v4.4..b4abf91047c -- kernel/futex.c kernel/locking/rtmutex.c | wc -l
10

So this patch is just an obvious quickfix for now.

Hint: the lock order is documented in 4.9.y and later. A similar
documenting is missing in 4.4.y. Please somebody either backport also,
or write a new description, if there would be some differences I cannot
easily see at the moment. Without reliable docs,
inspection of the locking correctness may become a pain.

Signed-off-by: Thomas Schoebel-Theuer <tst@1und1.de>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Lee Jones <lee.jones@linaro.org>
Fixes: 394fc4981426 ("futex: Rework inconsistent rt_mutex/futex_q state")
Fixes: 6510e4a2d04f ("futex,rt_mutex: Provide futex specific rt_mutex API")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index ceba9d1d99a5..9ef859698fc3 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1408,7 +1408,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this,
 	if (pi_state->owner != current)
 		return -EINVAL;
 
-	raw_spin_lock(&pi_state->pi_mutex.wait_lock);
+	raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
 	new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
 
 	/*

From 5db5bb5fa1658073f68e0fd2dc24fa083a98489f Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Sat, 27 Feb 2021 00:15:27 +0000
Subject: [PATCH 1645/2658] ALSA: ctxfi: cthw20k2: fix mask on conf to allow 4
 bits

[ Upstream commit 26a9630c72ebac7c564db305a6aee54a8edde70e ]

Currently the mask operation on variable conf is just 3 bits so
the switch statement case value of 8 is unreachable dead code.
The function daio_mgr_dao_init can be passed a 4 bit value,
function dao_rsc_init calls it with conf set to:

     conf = (desc->msr & 0x7) | (desc->passthru << 3);

so clearly when desc->passthru is set to 1 then conf can be
at least 8.

Fix this by changing the mask to 0xf.

Fixes: 8cc72361481f ("ALSA: SB X-Fi driver merge")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20210227001527.1077484-1-colin.king@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/ctxfi/cthw20k2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/pci/ctxfi/cthw20k2.c b/sound/pci/ctxfi/cthw20k2.c
index d86678c2a957..5beb4a3d203b 100644
--- a/sound/pci/ctxfi/cthw20k2.c
+++ b/sound/pci/ctxfi/cthw20k2.c
@@ -995,7 +995,7 @@ static int daio_mgr_dao_init(void *blk, unsigned int idx, unsigned int conf)
 
 	if (idx < 4) {
 		/* S/PDIF output */
-		switch ((conf & 0x7)) {
+		switch ((conf & 0xf)) {
 		case 1:
 			set_field(&ctl->txctl[idx], ATXCTL_NUC, 0);
 			break;

From 1a9abf50d0515fc46c4d6a751c558baad2c32166 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 3 Mar 2021 13:59:12 +0300
Subject: [PATCH 1646/2658] rsxx: Return -EFAULT if copy_to_user() fails

[ Upstream commit 77516d25f54912a7baedeeac1b1b828b6f285152 ]

The copy_to_user() function returns the number of bytes remaining but
we want to return -EFAULT to the user if it can't complete the copy.
The "st" variable only holds zero on success or negative error codes on
failure so the type should be int.

Fixes: 36f988e978f8 ("rsxx: Adding in debugfs entries.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/rsxx/core.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c
index 620a3a67cdd5..0d9137408e3c 100644
--- a/drivers/block/rsxx/core.c
+++ b/drivers/block/rsxx/core.c
@@ -180,15 +180,17 @@ static ssize_t rsxx_cram_read(struct file *fp, char __user *ubuf,
 {
 	struct rsxx_cardinfo *card = file_inode(fp)->i_private;
 	char *buf;
-	ssize_t st;
+	int st;
 
 	buf = kzalloc(cnt, GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;
 
 	st = rsxx_creg_read(card, CREG_ADD_CRAM + (u32)*ppos, cnt, buf, 1);
-	if (!st)
-		st = copy_to_user(ubuf, buf, cnt);
+	if (!st) {
+		if (copy_to_user(ubuf, buf, cnt))
+			st = -EFAULT;
+	}
 	kfree(buf);
 	if (st)
 		return st;

From 8764e31adef800c56557509ce9fc3ec16fcade51 Mon Sep 17 00:00:00 2001
From: Jeffle Xu <jefflexu@linux.alibaba.com>
Date: Tue, 9 Mar 2021 11:04:31 +0800
Subject: [PATCH 1647/2658] dm table: fix iterate_devices based device
 capability checks

commit a4c8dd9c2d0987cf542a2a0c42684c9c6d78a04e upstream.

According to the definition of dm_iterate_devices_fn:
 * This function must iterate through each section of device used by the
 * target until it encounters a non-zero return code, which it then returns.
 * Returns zero if no callout returned non-zero.

For some target type (e.g. dm-stripe), one call of iterate_devices() may
iterate multiple underlying devices internally, in which case a non-zero
return code returned by iterate_devices_callout_fn will stop the iteration
in advance. No iterate_devices_callout_fn should return non-zero unless
device iteration should stop.

Rename dm_table_requires_stable_pages() to dm_table_any_dev_attr() and
elevate it for reuse to stop iterating (and return non-zero) on the
first device that causes iterate_devices_callout_fn to return non-zero.
Use dm_table_any_dev_attr() to properly iterate through devices.

Rename device_is_nonrot() to device_is_rotational() and invert logic
accordingly to fix improper disposition.

[jeffle: backport notes]
No stable writes. Also convert the no_sg_merge capability check,
which is introduced by commit 200612ec33e5 ("dm table: propagate
QUEUE_FLAG_NO_SG_MERGE"), and removed since commit 2705c93742e9 ("block:
kill QUEUE_FLAG_NO_SG_MERGE") in v5.1.

Fixes: c3c4555edd10 ("dm table: clear add_random unless all devices have it set")
Fixes: 4693c9668fdc ("dm table: propagate non rotational flag")
Cc: stable@vger.kernel.org
Signed-off-by: Jeffle Xu <jefflexu@linux.alibaba.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-table.c | 83 +++++++++++++++++++++++++++----------------
 1 file changed, 53 insertions(+), 30 deletions(-)

diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 7e5bc6921c1f..bad6eb3413b0 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1211,6 +1211,46 @@ struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector)
 	return &t->targets[(KEYS_PER_NODE * n) + k];
 }
 
+/*
+ * type->iterate_devices() should be called when the sanity check needs to
+ * iterate and check all underlying data devices. iterate_devices() will
+ * iterate all underlying data devices until it encounters a non-zero return
+ * code, returned by whether the input iterate_devices_callout_fn, or
+ * iterate_devices() itself internally.
+ *
+ * For some target type (e.g. dm-stripe), one call of iterate_devices() may
+ * iterate multiple underlying devices internally, in which case a non-zero
+ * return code returned by iterate_devices_callout_fn will stop the iteration
+ * in advance.
+ *
+ * Cases requiring _any_ underlying device supporting some kind of attribute,
+ * should use the iteration structure like dm_table_any_dev_attr(), or call
+ * it directly. @func should handle semantics of positive examples, e.g.
+ * capable of something.
+ *
+ * Cases requiring _all_ underlying devices supporting some kind of attribute,
+ * should use the iteration structure like dm_table_supports_nowait() or
+ * dm_table_supports_discards(). Or introduce dm_table_all_devs_attr() that
+ * uses an @anti_func that handle semantics of counter examples, e.g. not
+ * capable of something. So: return !dm_table_any_dev_attr(t, anti_func);
+ */
+static bool dm_table_any_dev_attr(struct dm_table *t,
+				  iterate_devices_callout_fn func)
+{
+	struct dm_target *ti;
+	unsigned int i;
+
+	for (i = 0; i < dm_table_get_num_targets(t); i++) {
+		ti = dm_table_get_target(t, i);
+
+		if (ti->type->iterate_devices &&
+		    ti->type->iterate_devices(ti, func, NULL))
+			return true;
+        }
+
+	return false;
+}
+
 static int count_device(struct dm_target *ti, struct dm_dev *dev,
 			sector_t start, sector_t len, void *data)
 {
@@ -1381,12 +1421,12 @@ static bool dm_table_discard_zeroes_data(struct dm_table *t)
 	return true;
 }
 
-static int device_is_nonrot(struct dm_target *ti, struct dm_dev *dev,
-			    sector_t start, sector_t len, void *data)
+static int device_is_rotational(struct dm_target *ti, struct dm_dev *dev,
+				sector_t start, sector_t len, void *data)
 {
 	struct request_queue *q = bdev_get_queue(dev->bdev);
 
-	return q && blk_queue_nonrot(q);
+	return q && !blk_queue_nonrot(q);
 }
 
 static int device_is_not_random(struct dm_target *ti, struct dm_dev *dev,
@@ -1397,29 +1437,12 @@ static int device_is_not_random(struct dm_target *ti, struct dm_dev *dev,
 	return q && !blk_queue_add_random(q);
 }
 
-static int queue_supports_sg_merge(struct dm_target *ti, struct dm_dev *dev,
-				   sector_t start, sector_t len, void *data)
+static int queue_no_sg_merge(struct dm_target *ti, struct dm_dev *dev,
+			     sector_t start, sector_t len, void *data)
 {
 	struct request_queue *q = bdev_get_queue(dev->bdev);
 
-	return q && !test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags);
-}
-
-static bool dm_table_all_devices_attribute(struct dm_table *t,
-					   iterate_devices_callout_fn func)
-{
-	struct dm_target *ti;
-	unsigned i = 0;
-
-	while (i < dm_table_get_num_targets(t)) {
-		ti = dm_table_get_target(t, i++);
-
-		if (!ti->type->iterate_devices ||
-		    !ti->type->iterate_devices(ti, func, NULL))
-			return false;
-	}
-
-	return true;
+	return q && test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags);
 }
 
 static int device_not_write_same_capable(struct dm_target *ti, struct dm_dev *dev,
@@ -1512,18 +1535,18 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
 		q->limits.discard_zeroes_data = 0;
 
 	/* Ensure that all underlying devices are non-rotational. */
-	if (dm_table_all_devices_attribute(t, device_is_nonrot))
-		queue_flag_set_unlocked(QUEUE_FLAG_NONROT, q);
-	else
+	if (dm_table_any_dev_attr(t, device_is_rotational))
 		queue_flag_clear_unlocked(QUEUE_FLAG_NONROT, q);
+	else
+		queue_flag_set_unlocked(QUEUE_FLAG_NONROT, q);
 
 	if (!dm_table_supports_write_same(t))
 		q->limits.max_write_same_sectors = 0;
 
-	if (dm_table_all_devices_attribute(t, queue_supports_sg_merge))
-		queue_flag_clear_unlocked(QUEUE_FLAG_NO_SG_MERGE, q);
-	else
+	if (dm_table_any_dev_attr(t, queue_no_sg_merge))
 		queue_flag_set_unlocked(QUEUE_FLAG_NO_SG_MERGE, q);
+	else
+		queue_flag_clear_unlocked(QUEUE_FLAG_NO_SG_MERGE, q);
 
 	dm_table_verify_integrity(t);
 
@@ -1533,7 +1556,7 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
 	 * Clear QUEUE_FLAG_ADD_RANDOM if any underlying device does not
 	 * have it set.
 	 */
-	if (blk_queue_add_random(q) && dm_table_all_devices_attribute(t, device_is_not_random))
+	if (blk_queue_add_random(q) && dm_table_any_dev_attr(t, device_is_not_random))
 		queue_flag_clear_unlocked(QUEUE_FLAG_ADD_RANDOM, q);
 
 	/*

From 260104f773e3eb6ca80869613101f25eb1ebf2f5 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Mon, 19 Oct 2020 20:56:26 +0200
Subject: [PATCH 1648/2658] platform/x86: acer-wmi: Add new force_caps module
 parameter

[ Upstream commit 39aa009bb66f9d5fbd1e58ca4aa03d6e6f2c9915 ]

Add a new force_caps module parameter to allow overriding the drivers
builtin capability detection mechanism.

This can be used to for example:
-Disable rfkill functionality on devices where there is an AA OEM DMI
 record advertising non functional rfkill switches
-Force loading of the driver on devices with a missing AA OEM DMI record

Note that force_caps is -1 when unset, this allows forcing the
capability field to 0, which results in acer-wmi only providing WMI
hotkey handling while disabling all other (led, rfkill, backlight)
functionality.

Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20201019185628.264473-4-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/acer-wmi.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index b336f2620f9d..e4f278fa6d69 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -229,6 +229,7 @@ static int mailled = -1;
 static int brightness = -1;
 static int threeg = -1;
 static int force_series;
+static int force_caps = -1;
 static bool ec_raw_mode;
 static bool has_type_aa;
 static u16 commun_func_bitmap;
@@ -238,11 +239,13 @@ module_param(mailled, int, 0444);
 module_param(brightness, int, 0444);
 module_param(threeg, int, 0444);
 module_param(force_series, int, 0444);
+module_param(force_caps, int, 0444);
 module_param(ec_raw_mode, bool, 0444);
 MODULE_PARM_DESC(mailled, "Set initial state of Mail LED");
 MODULE_PARM_DESC(brightness, "Set initial LCD backlight brightness");
 MODULE_PARM_DESC(threeg, "Set initial state of 3G hardware");
 MODULE_PARM_DESC(force_series, "Force a different laptop series");
+MODULE_PARM_DESC(force_caps, "Force the capability bitmask to this value");
 MODULE_PARM_DESC(ec_raw_mode, "Enable EC raw mode");
 
 struct acer_data {
@@ -2150,7 +2153,7 @@ static int __init acer_wmi_init(void)
 		}
 		/* WMID always provides brightness methods */
 		interface->capability |= ACER_CAP_BRIGHTNESS;
-	} else if (!wmi_has_guid(WMID_GUID2) && interface && !has_type_aa) {
+	} else if (!wmi_has_guid(WMID_GUID2) && interface && !has_type_aa && force_caps == -1) {
 		pr_err("No WMID device detection method found\n");
 		return -ENODEV;
 	}
@@ -2180,6 +2183,9 @@ static int __init acer_wmi_init(void)
 	if (acpi_video_get_backlight_type() != acpi_backlight_vendor)
 		interface->capability &= ~ACER_CAP_BRIGHTNESS;
 
+	if (force_caps != -1)
+		interface->capability = force_caps;
+
 	if (wmi_has_guid(WMID_GUID3)) {
 		if (ec_raw_mode) {
 			if (ACPI_FAILURE(acer_wmi_enable_ec_raw())) {

From 240f7a43cac8aec1236d564acf9c591cc3a3653f Mon Sep 17 00:00:00 2001
From: Bjorn Helgaas <bhelgaas@google.com>
Date: Tue, 10 Nov 2020 16:00:57 -0600
Subject: [PATCH 1649/2658] PCI: Add function 1 DMA alias quirk for Marvell
 9215 SATA controller

[ Upstream commit 059983790a4c963d92943e55a61fca55be427d55 ]

Add function 1 DMA alias quirk for Marvell 88SS9215 PCIe SSD Controller.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=42679#c135
Link: https://lore.kernel.org/r/20201110220516.697934-1-helgaas@kernel.org
Reported-by: John Smith <LK7S2ED64JHGLKj75shg9klejHWG49h5hk@protonmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/quirks.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index bdaeccafa261..bc0aa0849e72 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3649,6 +3649,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x917a,
 /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c46 */
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x91a0,
 			 quirk_dma_func1_alias);
+/* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c135 */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9215,
+			 quirk_dma_func1_alias);
 /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c127 */
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9220,
 			 quirk_dma_func1_alias);

From 615dbffa9cb4430a03d85286a51ea86cf0a13dda Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 11 Mar 2021 13:46:36 +0100
Subject: [PATCH 1650/2658] Linux 4.4.261

Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Link: https://lore.kernel.org/r/20210310132319.155338551@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index a36ec3c543cc..5df806fe1f2f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 260
+SUBLEVEL = 261
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 0425142685cea9218c1880548816d73b009506c5 Mon Sep 17 00:00:00 2001
From: "Dmitry V. Levin" <ldv@altlinux.org>
Date: Mon, 22 Feb 2021 08:00:00 +0000
Subject: [PATCH 1651/2658] uapi: nfnetlink_cthelper.h: fix userspace
 compilation error

commit c33cb0020ee6dd96cc9976d6085a7d8422f6dbed upstream.

Apparently, <linux/netfilter/nfnetlink_cthelper.h> and
<linux/netfilter/nfnetlink_acct.h> could not be included into the same
compilation unit because of a cut-and-paste typo in the former header.

Fixes: 12f7a505331e6 ("netfilter: add user-space connection tracking helper infrastructure")
Cc: <stable@vger.kernel.org> # v3.6
Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/uapi/linux/netfilter/nfnetlink_cthelper.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/uapi/linux/netfilter/nfnetlink_cthelper.h b/include/uapi/linux/netfilter/nfnetlink_cthelper.h
index 33659f6fad3e..30557bade935 100644
--- a/include/uapi/linux/netfilter/nfnetlink_cthelper.h
+++ b/include/uapi/linux/netfilter/nfnetlink_cthelper.h
@@ -4,7 +4,7 @@
 #define NFCT_HELPER_STATUS_DISABLED	0
 #define NFCT_HELPER_STATUS_ENABLED	1
 
-enum nfnl_acct_msg_types {
+enum nfnl_cthelper_msg_types {
 	NFNL_MSG_CTHELPER_NEW,
 	NFNL_MSG_CTHELPER_GET,
 	NFNL_MSG_CTHELPER_DEL,

From 05196c788e0c384d7d971e9a3e4bc8fc16a19c02 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Sun, 14 Feb 2021 19:49:11 +0100
Subject: [PATCH 1652/2658] ath9k: fix transmitting to stations in dynamic SMPS
 mode

commit 3b9ea7206d7e1fdd7419cbd10badd3b2c80d04b4 upstream.

When transmitting to a receiver in dynamic SMPS mode, all transmissions that
use multiple spatial streams need to be sent using CTS-to-self or RTS/CTS to
give the receiver's extra chains some time to wake up.
This fixes the tx rate getting stuck at <= MCS7 for some clients, especially
Intel ones, which make aggressive use of SMPS.

Cc: stable@vger.kernel.org
Reported-by: Martin Kennedy <hurricos@gmail.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210214184911.96702-1-nbd@nbd.name
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath9k/ath9k.h | 3 ++-
 drivers/net/wireless/ath/ath9k/xmit.c  | 6 ++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index a660e40f2df1..70b5dbe9de6a 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -178,7 +178,8 @@ struct ath_frame_info {
 	s8 txq;
 	u8 keyix;
 	u8 rtscts_rate;
-	u8 retries : 7;
+	u8 retries : 6;
+	u8 dyn_smps : 1;
 	u8 baw_tracked : 1;
 	u8 tx_power;
 	enum ath9k_key_type keytype:2;
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 3e3dac3d7060..94fac5dc1b4a 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1228,6 +1228,11 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
 				 is_40, is_sgi, is_sp);
 			if (rix < 8 && (tx_info->flags & IEEE80211_TX_CTL_STBC))
 				info->rates[i].RateFlags |= ATH9K_RATESERIES_STBC;
+			if (rix >= 8 && fi->dyn_smps) {
+				info->rates[i].RateFlags |=
+					ATH9K_RATESERIES_RTS_CTS;
+				info->flags |= ATH9K_TXDESC_CTSENA;
+			}
 
 			info->txpower[i] = ath_get_rate_txpower(sc, bf, rix,
 								is_40, false);
@@ -2114,6 +2119,7 @@ static void setup_frame_info(struct ieee80211_hw *hw,
 		fi->keyix = an->ps_key;
 	else
 		fi->keyix = ATH9K_TXKEYIX_INVALID;
+	fi->dyn_smps = sta && sta->smps_mode == IEEE80211_SMPS_DYNAMIC;
 	fi->keytype = keytype;
 	fi->framelen = framelen;
 	fi->tx_power = txpower;

From ac3f8632ddef60e88dbfa1c49445abc8f5b3c7e1 Mon Sep 17 00:00:00 2001
From: Daniel Borkmann <daniel@iogearbox.net>
Date: Fri, 26 Feb 2021 22:22:48 +0100
Subject: [PATCH 1653/2658] net: Fix gro aggregation for udp encaps with zero
 csum

commit 89e5c58fc1e2857ccdaae506fb8bc5fed57ee063 upstream.

We noticed a GRO issue for UDP-based encaps such as vxlan/geneve when the
csum for the UDP header itself is 0. In that case, GRO aggregation does
not take place on the phys dev, but instead is deferred to the vxlan/geneve
driver (see trace below).

The reason is essentially that GRO aggregation bails out in udp_gro_receive()
for such case when drivers marked the skb with CHECKSUM_UNNECESSARY (ice, i40e,
others) where for non-zero csums 2abb7cdc0dc8 ("udp: Add support for doing
checksum unnecessary conversion") promotes those skbs to CHECKSUM_COMPLETE
and napi context has csum_valid set. This is however not the case for zero
UDP csum (here: csum_cnt is still 0 and csum_valid continues to be false).

At the same time 57c67ff4bd92 ("udp: additional GRO support") added matches
on !uh->check ^ !uh2->check as part to determine candidates for aggregation,
so it certainly is expected to handle zero csums in udp_gro_receive(). The
purpose of the check added via 662880f44203 ("net: Allow GRO to use and set
levels of checksum unnecessary") seems to catch bad csum and stop aggregation
right away.

One way to fix aggregation in the zero case is to only perform the !csum_valid
check in udp_gro_receive() if uh->check is infact non-zero.

Before:

  [...]
  swapper     0 [008]   731.946506: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff966497100400 len=1500   (1)
  swapper     0 [008]   731.946507: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff966497100200 len=1500
  swapper     0 [008]   731.946507: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff966497101100 len=1500
  swapper     0 [008]   731.946508: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff966497101700 len=1500
  swapper     0 [008]   731.946508: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff966497101b00 len=1500
  swapper     0 [008]   731.946508: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff966497100600 len=1500
  swapper     0 [008]   731.946508: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff966497100f00 len=1500
  swapper     0 [008]   731.946509: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff966497100a00 len=1500
  swapper     0 [008]   731.946516: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff966497100500 len=1500
  swapper     0 [008]   731.946516: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff966497100700 len=1500
  swapper     0 [008]   731.946516: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff966497101d00 len=1500   (2)
  swapper     0 [008]   731.946517: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff966497101000 len=1500
  swapper     0 [008]   731.946517: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff966497101c00 len=1500
  swapper     0 [008]   731.946517: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff966497101400 len=1500
  swapper     0 [008]   731.946518: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff966497100e00 len=1500
  swapper     0 [008]   731.946518: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff966497101600 len=1500
  swapper     0 [008]   731.946521: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff966497100800 len=774
  swapper     0 [008]   731.946530: net:netif_receive_skb: dev=test_vxlan skbaddr=0xffff966497100400 len=14032 (1)
  swapper     0 [008]   731.946530: net:netif_receive_skb: dev=test_vxlan skbaddr=0xffff966497101d00 len=9112  (2)
  [...]

  # netperf -H 10.55.10.4 -t TCP_STREAM -l 20
  MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.55.10.4 () port 0 AF_INET : demo
  Recv   Send    Send
  Socket Socket  Message  Elapsed
  Size   Size    Size     Time     Throughput
  bytes  bytes   bytes    secs.    10^6bits/sec

   87380  16384  16384    20.01    13129.24

After:

  [...]
  swapper     0 [026]   521.862641: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff93ab0d479000 len=11286 (1)
  swapper     0 [026]   521.862643: net:netif_receive_skb: dev=test_vxlan skbaddr=0xffff93ab0d479000 len=11236 (1)
  swapper     0 [026]   521.862650: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff93ab0d478500 len=2898  (2)
  swapper     0 [026]   521.862650: net:netif_receive_skb: dev=enp10s0f0  skbaddr=0xffff93ab0d479f00 len=8490  (3)
  swapper     0 [026]   521.862653: net:netif_receive_skb: dev=test_vxlan skbaddr=0xffff93ab0d478500 len=2848  (2)
  swapper     0 [026]   521.862653: net:netif_receive_skb: dev=test_vxlan skbaddr=0xffff93ab0d479f00 len=8440  (3)
  [...]

  # netperf -H 10.55.10.4 -t TCP_STREAM -l 20
  MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.55.10.4 () port 0 AF_INET : demo
  Recv   Send    Send
  Socket Socket  Message  Elapsed
  Size   Size    Size     Time     Throughput
  bytes  bytes   bytes    secs.    10^6bits/sec

   87380  16384  16384    20.01    24576.53

Fixes: 57c67ff4bd92 ("udp: additional GRO support")
Fixes: 662880f44203 ("net: Allow GRO to use and set levels of checksum unnecessary")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jesse Brandeburg <jesse.brandeburg@intel.com>
Cc: Tom Herbert <tom@herbertland.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/r/20210226212248.8300-1-daniel@iogearbox.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/udp_offload.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 6dfc3daf7c21..2a37f367dc04 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -300,7 +300,7 @@ struct sk_buff **udp_gro_receive(struct sk_buff **head, struct sk_buff *skb,
 	int flush = 1;
 
 	if (NAPI_GRO_CB(skb)->encap_mark ||
-	    (skb->ip_summed != CHECKSUM_PARTIAL &&
+	    (uh->check && skb->ip_summed != CHECKSUM_PARTIAL &&
 	     NAPI_GRO_CB(skb)->csum_cnt == 0 &&
 	     !NAPI_GRO_CB(skb)->csum_valid))
 		goto out;

From 9eb907323d3cd6493cd1860cebe7177511e55cb3 Mon Sep 17 00:00:00 2001
From: Oleksij Rempel <o.rempel@pengutronix.de>
Date: Fri, 26 Feb 2021 10:24:56 +0100
Subject: [PATCH 1654/2658] can: skb: can_skb_set_owner(): fix ref counting if
 socket was closed before setting skb ownership

commit e940e0895a82c6fbaa259f2615eb52b57ee91a7e upstream.

There are two ref count variables controlling the free()ing of a socket:
- struct sock::sk_refcnt - which is changed by sock_hold()/sock_put()
- struct sock::sk_wmem_alloc - which accounts the memory allocated by
  the skbs in the send path.

In case there are still TX skbs on the fly and the socket() is closed,
the struct sock::sk_refcnt reaches 0. In the TX-path the CAN stack
clones an "echo" skb, calls sock_hold() on the original socket and
references it. This produces the following back trace:

| WARNING: CPU: 0 PID: 280 at lib/refcount.c:25 refcount_warn_saturate+0x114/0x134
| refcount_t: addition on 0; use-after-free.
| Modules linked in: coda_vpu(E) v4l2_jpeg(E) videobuf2_vmalloc(E) imx_vdoa(E)
| CPU: 0 PID: 280 Comm: test_can.sh Tainted: G            E     5.11.0-04577-gf8ff6603c617 #203
| Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
| Backtrace:
| [<80bafea4>] (dump_backtrace) from [<80bb0280>] (show_stack+0x20/0x24) r7:00000000 r6:600f0113 r5:00000000 r4:81441220
| [<80bb0260>] (show_stack) from [<80bb593c>] (dump_stack+0xa0/0xc8)
| [<80bb589c>] (dump_stack) from [<8012b268>] (__warn+0xd4/0x114) r9:00000019 r8:80f4a8c2 r7:83e4150c r6:00000000 r5:00000009 r4:80528f90
| [<8012b194>] (__warn) from [<80bb09c4>] (warn_slowpath_fmt+0x88/0xc8) r9:83f26400 r8:80f4a8d1 r7:00000009 r6:80528f90 r5:00000019 r4:80f4a8c2
| [<80bb0940>] (warn_slowpath_fmt) from [<80528f90>] (refcount_warn_saturate+0x114/0x134) r8:00000000 r7:00000000 r6:82b44000 r5:834e5600 r4:83f4d540
| [<80528e7c>] (refcount_warn_saturate) from [<8079a4c8>] (__refcount_add.constprop.0+0x4c/0x50)
| [<8079a47c>] (__refcount_add.constprop.0) from [<8079a57c>] (can_put_echo_skb+0xb0/0x13c)
| [<8079a4cc>] (can_put_echo_skb) from [<8079ba98>] (flexcan_start_xmit+0x1c4/0x230) r9:00000010 r8:83f48610 r7:0fdc0000 r6:0c080000 r5:82b44000 r4:834e5600
| [<8079b8d4>] (flexcan_start_xmit) from [<80969078>] (netdev_start_xmit+0x44/0x70) r9:814c0ba0 r8:80c8790c r7:00000000 r6:834e5600 r5:82b44000 r4:82ab1f00
| [<80969034>] (netdev_start_xmit) from [<809725a4>] (dev_hard_start_xmit+0x19c/0x318) r9:814c0ba0 r8:00000000 r7:82ab1f00 r6:82b44000 r5:00000000 r4:834e5600
| [<80972408>] (dev_hard_start_xmit) from [<809c6584>] (sch_direct_xmit+0xcc/0x264) r10:834e5600 r9:00000000 r8:00000000 r7:82b44000 r6:82ab1f00 r5:834e5600 r4:83f27400
| [<809c64b8>] (sch_direct_xmit) from [<809c6c0c>] (__qdisc_run+0x4f0/0x534)

To fix this problem, only set skb ownership to sockets which have still
a ref count > 0.

Fixes: 0ae89beb283a ("can: add destructor for self generated skbs")
Cc: Oliver Hartkopp <socketcan@hartkopp.net>
Cc: Andre Naujoks <nautsch2@gmail.com>
Link: https://lore.kernel.org/r/20210226092456.27126-1-o.rempel@pengutronix.de
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Reviewed-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/can/skb.h | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/include/linux/can/skb.h b/include/linux/can/skb.h
index 1a2111c775ae..0e7350973e0e 100644
--- a/include/linux/can/skb.h
+++ b/include/linux/can/skb.h
@@ -48,8 +48,12 @@ static inline void can_skb_reserve(struct sk_buff *skb)
 
 static inline void can_skb_set_owner(struct sk_buff *skb, struct sock *sk)
 {
-	if (sk) {
-		sock_hold(sk);
+	/* If the socket has already been closed by user space, the
+	 * refcount may already be 0 (and the socket will be freed
+	 * after the last TX skb has been freed). So only increase
+	 * socket refcount if the refcount is > 0.
+	 */
+	if (sk && atomic_inc_not_zero(&sk->sk_refcnt)) {
 		skb->destructor = sock_efree;
 		skb->sk = sk;
 	}

From 6157f398a8d2085313278c1ca7102a31d550ec51 Mon Sep 17 00:00:00 2001
From: Joakim Zhang <qiangqing.zhang@nxp.com>
Date: Thu, 18 Feb 2021 19:00:35 +0800
Subject: [PATCH 1655/2658] can: flexcan: assert FRZ bit in
 flexcan_chip_freeze()

commit 449052cfebf624b670faa040245d3feed770d22f upstream.

Assert HALT bit to enter freeze mode, there is a premise that FRZ bit is
asserted. This patch asserts FRZ bit in flexcan_chip_freeze, although
the reset value is 1b'1. This is a prepare patch, later patch will
invoke flexcan_chip_freeze() to enter freeze mode, which polling freeze
mode acknowledge.

Fixes: b1aa1c7a2165b ("can: flexcan: fix transition from and to freeze mode in chip_{,un}freeze")
Link: https://lore.kernel.org/r/20210218110037.16591-2-qiangqing.zhang@nxp.com
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/flexcan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 6b866d0451b2..66aef0a575ef 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -383,7 +383,7 @@ static int flexcan_chip_freeze(struct flexcan_priv *priv)
 	u32 reg;
 
 	reg = flexcan_read(&regs->mcr);
-	reg |= FLEXCAN_MCR_HALT;
+	reg |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT;
 	flexcan_write(reg, &regs->mcr);
 
 	while (timeout-- && !(flexcan_read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK))

From 06ecd97fa8091dcfe4d9991df608c92c577bb15f Mon Sep 17 00:00:00 2001
From: Joakim Zhang <qiangqing.zhang@nxp.com>
Date: Thu, 18 Feb 2021 19:00:36 +0800
Subject: [PATCH 1656/2658] can: flexcan: enable RX FIFO after FRZ/HALT valid

commit ec15e27cc8904605846a354bb1f808ea1432f853 upstream.

RX FIFO enable failed could happen when do system reboot stress test:

[    0.303958] flexcan 5a8d0000.can: 5a8d0000.can supply xceiver not found, using dummy regulator
[    0.304281] flexcan 5a8d0000.can (unnamed net_device) (uninitialized): Could not enable RX FIFO, unsupported core
[    0.314640] flexcan 5a8d0000.can: registering netdev failed
[    0.320728] flexcan 5a8e0000.can: 5a8e0000.can supply xceiver not found, using dummy regulator
[    0.320991] flexcan 5a8e0000.can (unnamed net_device) (uninitialized): Could not enable RX FIFO, unsupported core
[    0.331360] flexcan 5a8e0000.can: registering netdev failed
[    0.337444] flexcan 5a8f0000.can: 5a8f0000.can supply xceiver not found, using dummy regulator
[    0.337716] flexcan 5a8f0000.can (unnamed net_device) (uninitialized): Could not enable RX FIFO, unsupported core
[    0.348117] flexcan 5a8f0000.can: registering netdev failed

RX FIFO should be enabled after the FRZ/HALT are valid. But the current
code enable RX FIFO and FRZ/HALT at the same time.

Fixes: e955cead03117 ("CAN: Add Flexcan CAN controller driver")
Link: https://lore.kernel.org/r/20210218110037.16591-3-qiangqing.zhang@nxp.com
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/flexcan.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 66aef0a575ef..b18bb0334ded 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1098,10 +1098,14 @@ static int register_flexcandev(struct net_device *dev)
 	if (err)
 		goto out_chip_disable;
 
-	/* set freeze, halt and activate FIFO, restrict register access */
+	/* set freeze, halt */
+	err = flexcan_chip_freeze(priv);
+	if (err)
+		goto out_chip_disable;
+
+	/* activate FIFO, restrict register access */
 	reg = flexcan_read(&regs->mcr);
-	reg |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT |
-		FLEXCAN_MCR_FEN | FLEXCAN_MCR_SUPV;
+	reg |=  FLEXCAN_MCR_FEN | FLEXCAN_MCR_SUPV;
 	flexcan_write(reg, &regs->mcr);
 
 	/* Currently we only support newer versions of this core

From 34ac7f62995c22d74361f729a7def030ebb39a08 Mon Sep 17 00:00:00 2001
From: Vasily Averin <vvs@virtuozzo.com>
Date: Sat, 27 Feb 2021 11:27:45 +0300
Subject: [PATCH 1657/2658] netfilter: x_tables: gpf inside xt_find_revision()

commit 8e24edddad152b998b37a7f583175137ed2e04a5 upstream.

nested target/match_revfn() calls work with xt[NFPROTO_UNSPEC] lists
without taking xt[NFPROTO_UNSPEC].mutex. This can race with module unload
and cause host to crash:

general protection fault: 0000 [#1]
Modules linked in: ... [last unloaded: xt_cluster]
CPU: 0 PID: 542455 Comm: iptables
RIP: 0010:[<ffffffff8ffbd518>]  [<ffffffff8ffbd518>] strcmp+0x18/0x40
RDX: 0000000000000003 RSI: ffff9a5a5d9abe10 RDI: dead000000000111
R13: ffff9a5a5d9abe10 R14: ffff9a5a5d9abd8c R15: dead000000000100
(VvS: %R15 -- &xt_match,  %RDI -- &xt_match.name,
xt_cluster unregister match in xt[NFPROTO_UNSPEC].match list)
Call Trace:
 [<ffffffff902ccf44>] match_revfn+0x54/0xc0
 [<ffffffff902ccf9f>] match_revfn+0xaf/0xc0
 [<ffffffff902cd01e>] xt_find_revision+0x6e/0xf0
 [<ffffffffc05a5be0>] do_ipt_get_ctl+0x100/0x420 [ip_tables]
 [<ffffffff902cc6bf>] nf_getsockopt+0x4f/0x70
 [<ffffffff902dd99e>] ip_getsockopt+0xde/0x100
 [<ffffffff903039b5>] raw_getsockopt+0x25/0x50
 [<ffffffff9026c5da>] sock_common_getsockopt+0x1a/0x20
 [<ffffffff9026b89d>] SyS_getsockopt+0x7d/0xf0
 [<ffffffff903cbf92>] system_call_fastpath+0x25/0x2a

Fixes: 656caff20e1 ("netfilter 04/09: x_tables: fix match/target revision lookup")
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/x_tables.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index b7ecfa734c5f..abd482a98c62 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -272,6 +272,7 @@ static int match_revfn(u8 af, const char *name, u8 revision, int *bestp)
 	const struct xt_match *m;
 	int have_rev = 0;
 
+	mutex_lock(&xt[af].mutex);
 	list_for_each_entry(m, &xt[af].match, list) {
 		if (strcmp(m->name, name) == 0) {
 			if (m->revision > *bestp)
@@ -280,6 +281,7 @@ static int match_revfn(u8 af, const char *name, u8 revision, int *bestp)
 				have_rev = 1;
 		}
 	}
+	mutex_unlock(&xt[af].mutex);
 
 	if (af != NFPROTO_UNSPEC && !have_rev)
 		return match_revfn(NFPROTO_UNSPEC, name, revision, bestp);
@@ -292,6 +294,7 @@ static int target_revfn(u8 af, const char *name, u8 revision, int *bestp)
 	const struct xt_target *t;
 	int have_rev = 0;
 
+	mutex_lock(&xt[af].mutex);
 	list_for_each_entry(t, &xt[af].target, list) {
 		if (strcmp(t->name, name) == 0) {
 			if (t->revision > *bestp)
@@ -300,6 +303,7 @@ static int target_revfn(u8 af, const char *name, u8 revision, int *bestp)
 				have_rev = 1;
 		}
 	}
+	mutex_unlock(&xt[af].mutex);
 
 	if (af != NFPROTO_UNSPEC && !have_rev)
 		return target_revfn(NFPROTO_UNSPEC, name, revision, bestp);
@@ -313,12 +317,10 @@ int xt_find_revision(u8 af, const char *name, u8 revision, int target,
 {
 	int have_rev, best = -1;
 
-	mutex_lock(&xt[af].mutex);
 	if (target == 1)
 		have_rev = target_revfn(af, name, revision, &best);
 	else
 		have_rev = match_revfn(af, name, revision, &best);
-	mutex_unlock(&xt[af].mutex);
 
 	/* Nothing at all?  Return 0 to try loading module. */
 	if (best == -1) {

From e7cc09972fe919983f449ebaebb6a692272240da Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <pc@cjr.nz>
Date: Mon, 8 Mar 2021 12:00:49 -0300
Subject: [PATCH 1658/2658] cifs: return proper error code in statfs(2)

commit 14302ee3301b3a77b331cc14efb95bf7184c73cc upstream.

In cifs_statfs(), if server->ops->queryfs is not NULL, then we should
use its return value rather than always returning 0.  Instead, use rc
variable as it is properly set to 0 in case there is no
server->ops->queryfs.

Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/cifsfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 4f4fc9ff3636..5666eb49bbbd 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -204,7 +204,7 @@ cifs_statfs(struct dentry *dentry, struct kstatfs *buf)
 		rc = server->ops->queryfs(xid, tcon, buf);
 
 	free_xid(xid);
-	return 0;
+	return rc;
 }
 
 static long cifs_fallocate(struct file *file, int mode, loff_t off, loff_t len)

From 0e46667e13320d92620307b294d4800b30c4b5f2 Mon Sep 17 00:00:00 2001
From: Jiri Kosina <jkosina@suse.cz>
Date: Mon, 1 Feb 2016 11:19:17 +0100
Subject: [PATCH 1659/2658] floppy: fix lock_fdc() signal handling

commit a0c80efe5956ccce9fe7ae5c78542578c07bc20a upstream.

floppy_revalidate() doesn't perform any error handling on lock_fdc()
result. lock_fdc() might actually be interrupted by a signal (it waits for
fdc becoming non-busy interruptibly). In such case, floppy_revalidate()
proceeds as if it had claimed the lock, but it fact it doesn't.

In case of multiple threads trying to open("/dev/fdX"), this leads to
serious corruptions all over the place, because all of a sudden there is
no critical section protection (that'd otherwise be guaranteed by locked
fd) whatsoever.

While at this, fix the fact that the 'interruptible' parameter to
lock_fdc() doesn't make any sense whatsoever, because we always wait
interruptibly anyway.

Most of the lock_fdc() callsites do properly handle error (and propagate
EINTR), but floppy_revalidate() and floppy_check_events() don't. Fix this.

Spotted by 'syzkaller' tool.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Cc: Wade Mealing <wmealing@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/block/floppy.c | 35 +++++++++++++++++++----------------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 31bbe5410b18..ae6b798b76bb 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -870,7 +870,7 @@ static void set_fdc(int drive)
 }
 
 /* locks the driver */
-static int lock_fdc(int drive, bool interruptible)
+static int lock_fdc(int drive)
 {
 	if (WARN(atomic_read(&usage_count) == 0,
 		 "Trying to lock fdc while usage count=0\n"))
@@ -2180,7 +2180,7 @@ static int do_format(int drive, struct format_descr *tmp_format_req)
 {
 	int ret;
 
-	if (lock_fdc(drive, true))
+	if (lock_fdc(drive))
 		return -EINTR;
 
 	set_floppy(drive);
@@ -2967,7 +2967,7 @@ static int user_reset_fdc(int drive, int arg, bool interruptible)
 {
 	int ret;
 
-	if (lock_fdc(drive, interruptible))
+	if (lock_fdc(drive))
 		return -EINTR;
 
 	if (arg == FD_RESET_ALWAYS)
@@ -3254,7 +3254,7 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
 		if (!capable(CAP_SYS_ADMIN))
 			return -EPERM;
 		mutex_lock(&open_lock);
-		if (lock_fdc(drive, true)) {
+		if (lock_fdc(drive)) {
 			mutex_unlock(&open_lock);
 			return -EINTR;
 		}
@@ -3274,7 +3274,7 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
 	} else {
 		int oldStretch;
 
-		if (lock_fdc(drive, true))
+		if (lock_fdc(drive))
 			return -EINTR;
 		if (cmd != FDDEFPRM) {
 			/* notice a disk change immediately, else
@@ -3360,7 +3360,7 @@ static int get_floppy_geometry(int drive, int type, struct floppy_struct **g)
 	if (type)
 		*g = &floppy_type[type];
 	else {
-		if (lock_fdc(drive, false))
+		if (lock_fdc(drive))
 			return -EINTR;
 		if (poll_drive(false, 0) == -EINTR)
 			return -EINTR;
@@ -3462,7 +3462,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
 		if (UDRS->fd_ref != 1)
 			/* somebody else has this drive open */
 			return -EBUSY;
-		if (lock_fdc(drive, true))
+		if (lock_fdc(drive))
 			return -EINTR;
 
 		/* do the actual eject. Fails on
@@ -3474,7 +3474,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
 		process_fd_request();
 		return ret;
 	case FDCLRPRM:
-		if (lock_fdc(drive, true))
+		if (lock_fdc(drive))
 			return -EINTR;
 		current_type[drive] = NULL;
 		floppy_sizes[drive] = MAX_DISK_SIZE << 1;
@@ -3499,7 +3499,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
 		UDP->flags &= ~FTD_MSG;
 		return 0;
 	case FDFMTBEG:
-		if (lock_fdc(drive, true))
+		if (lock_fdc(drive))
 			return -EINTR;
 		if (poll_drive(true, FD_RAW_NEED_DISK) == -EINTR)
 			return -EINTR;
@@ -3516,7 +3516,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
 		return do_format(drive, &inparam.f);
 	case FDFMTEND:
 	case FDFLUSH:
-		if (lock_fdc(drive, true))
+		if (lock_fdc(drive))
 			return -EINTR;
 		return invalidate_drive(bdev);
 	case FDSETEMSGTRESH:
@@ -3542,7 +3542,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
 		outparam = UDP;
 		break;
 	case FDPOLLDRVSTAT:
-		if (lock_fdc(drive, true))
+		if (lock_fdc(drive))
 			return -EINTR;
 		if (poll_drive(true, FD_RAW_NEED_DISK) == -EINTR)
 			return -EINTR;
@@ -3565,7 +3565,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
 	case FDRAWCMD:
 		if (type)
 			return -EINVAL;
-		if (lock_fdc(drive, true))
+		if (lock_fdc(drive))
 			return -EINTR;
 		set_floppy(drive);
 		i = raw_cmd_ioctl(cmd, (void __user *)param);
@@ -3574,7 +3574,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
 		process_fd_request();
 		return i;
 	case FDTWADDLE:
-		if (lock_fdc(drive, true))
+		if (lock_fdc(drive))
 			return -EINTR;
 		twaddle();
 		process_fd_request();
@@ -3801,7 +3801,7 @@ static int compat_getdrvstat(int drive, bool poll,
 	mutex_lock(&floppy_mutex);
 
 	if (poll) {
-		if (lock_fdc(drive, true))
+		if (lock_fdc(drive))
 			goto Eintr;
 		if (poll_drive(true, FD_RAW_NEED_DISK) == -EINTR)
 			goto Eintr;
@@ -4109,7 +4109,8 @@ static unsigned int floppy_check_events(struct gendisk *disk,
 		return DISK_EVENT_MEDIA_CHANGE;
 
 	if (time_after(jiffies, UDRS->last_checked + UDP->checkfreq)) {
-		lock_fdc(drive, false);
+		if (lock_fdc(drive))
+			return -EINTR;
 		poll_drive(false, 0);
 		process_fd_request();
 	}
@@ -4208,7 +4209,9 @@ static int floppy_revalidate(struct gendisk *disk)
 			 "VFS: revalidate called on non-open device.\n"))
 			return -EFAULT;
 
-		lock_fdc(drive, false);
+		res = lock_fdc(drive);
+		if (res)
+			return res;
 		cf = (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags) ||
 		      test_bit(FD_VERIFY_BIT, &UDRS->flags));
 		if (!(cf || test_bit(drive, &fake_change) || drive_no_geom(drive))) {

From df91eec31a4f1a6812b7ce49dc3128bd2a8ff440 Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Wed, 10 Mar 2021 10:18:04 -0800
Subject: [PATCH 1660/2658] Revert "mm, slub: consider rest of partial list if
 acquire_slab() fails"

commit 9b1ea29bc0d7b94d420f96a0f4121403efc3dd85 upstream.

This reverts commit 8ff60eb052eeba95cfb3efe16b08c9199f8121cf.

The kernel test robot reports a huge performance regression due to the
commit, and the reason seems fairly straightforward: when there is
contention on the page list (which is what causes acquire_slab() to
fail), we do _not_ want to just loop and try again, because that will
transfer the contention to the 'n->list_lock' spinlock we hold, and
just make things even worse.

This is admittedly likely a problem only on big machines - the kernel
test robot report comes from a 96-thread dual socket Intel Xeon Gold
6252 setup, but the regression there really is quite noticeable:

   -47.9% regression of stress-ng.rawpkt.ops_per_sec

and the commit that was marked as being fixed (7ced37197196: "slub:
Acquire_slab() avoid loop") actually did the loop exit early very
intentionally (the hint being that "avoid loop" part of that commit
message), exactly to avoid this issue.

The correct thing to do may be to pick some kind of reasonable middle
ground: instead of breaking out of the loop on the very first sign of
contention, or trying over and over and over again, the right thing may
be to re-try _once_, and then give up on the second failure (or pick
your favorite value for "once"..).

Reported-by: kernel test robot <oliver.sang@intel.com>
Link: https://lore.kernel.org/lkml/20210301080404.GF12822@xsang-OptiPlex-9020/
Cc: Jann Horn <jannh@google.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Acked-by: Christoph Lameter <cl@linux.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/slub.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/slub.c b/mm/slub.c
index d0e21f0faa69..0f47ad2b4a8b 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1791,7 +1791,7 @@ static void *get_partial_node(struct kmem_cache *s, struct kmem_cache_node *n,
 
 		t = acquire_slab(s, n, page, object == NULL, &objects);
 		if (!t)
-			continue; /* cmpxchg raced */
+			break;
 
 		available += objects;
 		if (!object) {

From 70d97909c5ccefedbb310006985cf679aebdeb81 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Thu, 11 Mar 2021 11:25:58 +0800
Subject: [PATCH 1661/2658] futex: Change locking rules

commit 734009e96d1983ad739e5b656e03430b3660c913 upstream.

This patch comes directly from an origin patch (commit
dc3f2ff11740159080f2e8e359ae0ab57c8e74b6) in v4.9.

Currently futex-pi relies on hb->lock to serialize everything. But hb->lock
creates another set of problems, especially priority inversions on RT where
hb->lock becomes a rt_mutex itself.

The rt_mutex::wait_lock is the most obvious protection for keeping the
futex user space value and the kernel internal pi_state in sync.

Rework and document the locking so rt_mutex::wait_lock is held accross all
operations which modify the user space value and the pi state.

This allows to invoke rt_mutex_unlock() (including deboost) without holding
hb->lock as a next step.

Nothing yet relies on the new locking rules.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: juri.lelli@arm.com
Cc: bigeasy@linutronix.de
Cc: xlpang@redhat.com
Cc: rostedt@goodmis.org
Cc: mathieu.desnoyers@efficios.com
Cc: jdesfossez@efficios.com
Cc: dvhart@infradead.org
Cc: bristot@redhat.com
Link: http://lkml.kernel.org/r/20170322104151.751993333@infradead.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
[Lee: Back-ported in support of a previous futex back-port attempt]
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 138 +++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 112 insertions(+), 26 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 9ef859698fc3..0f0759503f5c 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1016,6 +1016,39 @@ static void exit_pi_state_list(struct task_struct *curr)
  * [10] There is no transient state which leaves owner and user space
  *	TID out of sync. Except one error case where the kernel is denied
  *	write access to the user address, see fixup_pi_state_owner().
+ *
+ *
+ * Serialization and lifetime rules:
+ *
+ * hb->lock:
+ *
+ *	hb -> futex_q, relation
+ *	futex_q -> pi_state, relation
+ *
+ *	(cannot be raw because hb can contain arbitrary amount
+ *	 of futex_q's)
+ *
+ * pi_mutex->wait_lock:
+ *
+ *	{uval, pi_state}
+ *
+ *	(and pi_mutex 'obviously')
+ *
+ * p->pi_lock:
+ *
+ *	p->pi_state_list -> pi_state->list, relation
+ *
+ * pi_state->refcount:
+ *
+ *	pi_state lifetime
+ *
+ *
+ * Lock order:
+ *
+ *   hb->lock
+ *     pi_mutex->wait_lock
+ *       p->pi_lock
+ *
  */
 
 /*
@@ -1023,10 +1056,12 @@ static void exit_pi_state_list(struct task_struct *curr)
  * the pi_state against the user space value. If correct, attach to
  * it.
  */
-static int attach_to_pi_state(u32 uval, struct futex_pi_state *pi_state,
+static int attach_to_pi_state(u32 __user *uaddr, u32 uval,
+			      struct futex_pi_state *pi_state,
 			      struct futex_pi_state **ps)
 {
 	pid_t pid = uval & FUTEX_TID_MASK;
+	int ret, uval2;
 
 	/*
 	 * Userspace might have messed up non-PI and PI futexes [3]
@@ -1034,8 +1069,33 @@ static int attach_to_pi_state(u32 uval, struct futex_pi_state *pi_state,
 	if (unlikely(!pi_state))
 		return -EINVAL;
 
+	/*
+	 * We get here with hb->lock held, and having found a
+	 * futex_top_waiter(). This means that futex_lock_pi() of said futex_q
+	 * has dropped the hb->lock in between queue_me() and unqueue_me_pi(),
+	 * which in turn means that futex_lock_pi() still has a reference on
+	 * our pi_state.
+	 */
 	WARN_ON(!atomic_read(&pi_state->refcount));
 
+	/*
+	 * Now that we have a pi_state, we can acquire wait_lock
+	 * and do the state validation.
+	 */
+	raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
+
+	/*
+	 * Since {uval, pi_state} is serialized by wait_lock, and our current
+	 * uval was read without holding it, it can have changed. Verify it
+	 * still is what we expect it to be, otherwise retry the entire
+	 * operation.
+	 */
+	if (get_futex_value_locked(&uval2, uaddr))
+		goto out_efault;
+
+	if (uval != uval2)
+		goto out_eagain;
+
 	/*
 	 * Handle the owner died case:
 	 */
@@ -1051,11 +1111,11 @@ static int attach_to_pi_state(u32 uval, struct futex_pi_state *pi_state,
 			 * is not 0. Inconsistent state. [5]
 			 */
 			if (pid)
-				return -EINVAL;
+				goto out_einval;
 			/*
 			 * Take a ref on the state and return success. [4]
 			 */
-			goto out_state;
+			goto out_attach;
 		}
 
 		/*
@@ -1067,14 +1127,14 @@ static int attach_to_pi_state(u32 uval, struct futex_pi_state *pi_state,
 		 * Take a ref on the state and return success. [6]
 		 */
 		if (!pid)
-			goto out_state;
+			goto out_attach;
 	} else {
 		/*
 		 * If the owner died bit is not set, then the pi_state
 		 * must have an owner. [7]
 		 */
 		if (!pi_state->owner)
-			return -EINVAL;
+			goto out_einval;
 	}
 
 	/*
@@ -1083,11 +1143,29 @@ static int attach_to_pi_state(u32 uval, struct futex_pi_state *pi_state,
 	 * user space TID. [9/10]
 	 */
 	if (pid != task_pid_vnr(pi_state->owner))
-		return -EINVAL;
-out_state:
+		goto out_einval;
+
+out_attach:
 	atomic_inc(&pi_state->refcount);
+	raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
 	*ps = pi_state;
 	return 0;
+
+out_einval:
+	ret = -EINVAL;
+	goto out_error;
+
+out_eagain:
+	ret = -EAGAIN;
+	goto out_error;
+
+out_efault:
+	ret = -EFAULT;
+	goto out_error;
+
+out_error:
+	raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
+	return ret;
 }
 
 /**
@@ -1180,6 +1258,9 @@ static int attach_to_pi_owner(u32 uval, union futex_key *key,
 
 	/*
 	 * No existing pi state. First waiter. [2]
+	 *
+	 * This creates pi_state, we have hb->lock held, this means nothing can
+	 * observe this state, wait_lock is irrelevant.
 	 */
 	pi_state = alloc_pi_state();
 
@@ -1204,7 +1285,8 @@ static int attach_to_pi_owner(u32 uval, union futex_key *key,
 	return 0;
 }
 
-static int lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
+static int lookup_pi_state(u32 __user *uaddr, u32 uval,
+			   struct futex_hash_bucket *hb,
 			   union futex_key *key, struct futex_pi_state **ps,
 			   struct task_struct **exiting)
 {
@@ -1215,7 +1297,7 @@ static int lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
 	 * attach to the pi_state when the validation succeeds.
 	 */
 	if (match)
-		return attach_to_pi_state(uval, match->pi_state, ps);
+		return attach_to_pi_state(uaddr, uval, match->pi_state, ps);
 
 	/*
 	 * We are the first waiter - try to look up the owner based on
@@ -1234,7 +1316,7 @@ static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval)
 	if (unlikely(cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)))
 		return -EFAULT;
 
-	/*If user space value changed, let the caller retry */
+	/* If user space value changed, let the caller retry */
 	return curval != uval ? -EAGAIN : 0;
 }
 
@@ -1298,7 +1380,7 @@ static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
 	 */
 	match = futex_top_waiter(hb, key);
 	if (match)
-		return attach_to_pi_state(uval, match->pi_state, ps);
+		return attach_to_pi_state(uaddr, uval, match->pi_state, ps);
 
 	/*
 	 * No waiter and user TID is 0. We are here because the
@@ -1438,6 +1520,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this,
 
 	if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) {
 		ret = -EFAULT;
+
 	} else if (curval != uval) {
 		/*
 		 * If a unconditional UNLOCK_PI operation (user space did not
@@ -1971,7 +2054,7 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
 			 * rereading and handing potential crap to
 			 * lookup_pi_state.
 			 */
-			ret = lookup_pi_state(ret, hb2, &key2,
+			ret = lookup_pi_state(uaddr2, ret, hb2, &key2,
 					      &pi_state, &exiting);
 		}
 
@@ -2249,7 +2332,6 @@ static int __fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 	int err = 0;
 
 	oldowner = pi_state->owner;
-
 	/*
 	 * We are here because either:
 	 *
@@ -2268,11 +2350,10 @@ static int __fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 	 * because we can fault here. Imagine swapped out pages or a fork
 	 * that marked all the anonymous memory readonly for cow.
 	 *
-	 * Modifying pi_state _before_ the user space value would
-	 * leave the pi_state in an inconsistent state when we fault
-	 * here, because we need to drop the hash bucket lock to
-	 * handle the fault. This might be observed in the PID check
-	 * in lookup_pi_state.
+	 * Modifying pi_state _before_ the user space value would leave the
+	 * pi_state in an inconsistent state when we fault here, because we
+	 * need to drop the locks to handle the fault. This might be observed
+	 * in the PID check in lookup_pi_state.
 	 */
 retry:
 	if (!argowner) {
@@ -2333,21 +2414,26 @@ static int __fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 	return argowner == current;
 
 	/*
-	 * To handle the page fault we need to drop the hash bucket
-	 * lock here. That gives the other task (either the highest priority
-	 * waiter itself or the task which stole the rtmutex) the
-	 * chance to try the fixup of the pi_state. So once we are
-	 * back from handling the fault we need to check the pi_state
-	 * after reacquiring the hash bucket lock and before trying to
-	 * do another fixup. When the fixup has been done already we
-	 * simply return.
+	 * To handle the page fault we need to drop the locks here. That gives
+	 * the other task (either the highest priority waiter itself or the
+	 * task which stole the rtmutex) the chance to try the fixup of the
+	 * pi_state. So once we are back from handling the fault we need to
+	 * check the pi_state after reacquiring the locks and before trying to
+	 * do another fixup. When the fixup has been done already we simply
+	 * return.
+	 *
+	 * Note: we hold both hb->lock and pi_mutex->wait_lock. We can safely
+	 * drop hb->lock since the caller owns the hb -> futex_q relation.
+	 * Dropping the pi_mutex->wait_lock requires the state revalidate.
 	 */
 handle_fault:
+	raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
 	spin_unlock(q->lock_ptr);
 
 	err = fault_in_user_writeable(uaddr);
 
 	spin_lock(q->lock_ptr);
+	raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
 
 	/*
 	 * Check if someone else fixed it for us:

From 69318c71c84da93a93c7b3265e084d654c1966b0 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Thu, 11 Mar 2021 11:25:59 +0800
Subject: [PATCH 1662/2658] futex: Cure exit race

commit da791a667536bf8322042e38ca85d55a78d3c273 upstream.

This patch comes directly from an origin patch (commit
9c3f3986036760c48a92f04b36774aa9f63673f80) in v4.9.

Stefan reported, that the glibc tst-robustpi4 test case fails
occasionally. That case creates the following race between
sys_exit() and sys_futex_lock_pi():

 CPU0				CPU1

 sys_exit()			sys_futex()
  do_exit()			 futex_lock_pi()
   exit_signals(tsk)		  No waiters:
    tsk->flags |= PF_EXITING;	  *uaddr == 0x00000PID
  mm_release(tsk)		  Set waiter bit
   exit_robust_list(tsk) {	  *uaddr = 0x80000PID;
      Set owner died		  attach_to_pi_owner() {
    *uaddr = 0xC0000000;	   tsk = get_task(PID);
   }				   if (!tsk->flags & PF_EXITING) {
  ...				     attach();
  tsk->flags |= PF_EXITPIDONE;	   } else {
				     if (!(tsk->flags & PF_EXITPIDONE))
				       return -EAGAIN;
				     return -ESRCH; <--- FAIL
				   }

ESRCH is returned all the way to user space, which triggers the glibc test
case assert. Returning ESRCH unconditionally is wrong here because the user
space value has been changed by the exiting task to 0xC0000000, i.e. the
FUTEX_OWNER_DIED bit is set and the futex PID value has been cleared. This
is a valid state and the kernel has to handle it, i.e. taking the futex.

Cure it by rereading the user space value when PF_EXITING and PF_EXITPIDONE
is set in the task which 'owns' the futex. If the value has changed, let
the kernel retry the operation, which includes all regular sanity checks
and correctly handles the FUTEX_OWNER_DIED case.

If it hasn't changed, then return ESRCH as there is no way to distinguish
this case from malfunctioning user space. This happens when the exiting
task did not have a robust list, the robust list was corrupted or the user
space value in the futex was simply bogus.

Reported-by: Stefan Liebler <stli@linux.ibm.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Darren Hart <dvhart@infradead.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Sasha Levin <sashal@kernel.org>
Cc: stable@vger.kernel.org
Link: https://bugzilla.kernel.org/show_bug.cgi?id=200467
Link: https://lkml.kernel.org/r/20181210152311.986181245@linutronix.de
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[Lee: Required to satisfy functional dependency from futex back-port.
 Re-add the missing handle_exit_race() parts from:
 3d4775df0a89 ("futex: Replace PF_EXITPIDONE with a state")]
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 71 +++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 65 insertions(+), 6 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 0f0759503f5c..1fd99362e7b7 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1198,11 +1198,67 @@ static void wait_for_owner_exiting(int ret, struct task_struct *exiting)
 	put_task_struct(exiting);
 }
 
+static int handle_exit_race(u32 __user *uaddr, u32 uval,
+			    struct task_struct *tsk)
+{
+	u32 uval2;
+
+	/*
+	 * If the futex exit state is not yet FUTEX_STATE_DEAD, wait
+	 * for it to finish.
+	 */
+	if (tsk && tsk->futex_state != FUTEX_STATE_DEAD)
+		return -EAGAIN;
+
+	/*
+	 * Reread the user space value to handle the following situation:
+	 *
+	 * CPU0				CPU1
+	 *
+	 * sys_exit()			sys_futex()
+	 *  do_exit()			 futex_lock_pi()
+	 *                                futex_lock_pi_atomic()
+	 *   exit_signals(tsk)		    No waiters:
+	 *    tsk->flags |= PF_EXITING;	    *uaddr == 0x00000PID
+	 *  mm_release(tsk)		    Set waiter bit
+	 *   exit_robust_list(tsk) {	    *uaddr = 0x80000PID;
+	 *      Set owner died		    attach_to_pi_owner() {
+	 *    *uaddr = 0xC0000000;	     tsk = get_task(PID);
+	 *   }				     if (!tsk->flags & PF_EXITING) {
+	 *  ...				       attach();
+	 *  tsk->futex_state =               } else {
+	 *	FUTEX_STATE_DEAD;              if (tsk->futex_state !=
+	 *					  FUTEX_STATE_DEAD)
+	 *				         return -EAGAIN;
+	 *				       return -ESRCH; <--- FAIL
+	 *				     }
+	 *
+	 * Returning ESRCH unconditionally is wrong here because the
+	 * user space value has been changed by the exiting task.
+	 *
+	 * The same logic applies to the case where the exiting task is
+	 * already gone.
+	 */
+	if (get_futex_value_locked(&uval2, uaddr))
+		return -EFAULT;
+
+	/* If the user space value has changed, try again. */
+	if (uval2 != uval)
+		return -EAGAIN;
+
+	/*
+	 * The exiting task did not have a robust list, the robust list was
+	 * corrupted or the user space value in *uaddr is simply bogus.
+	 * Give up and tell user space.
+	 */
+	return -ESRCH;
+}
+
 /*
  * Lookup the task for the TID provided from user space and attach to
  * it after doing proper sanity checks.
  */
-static int attach_to_pi_owner(u32 uval, union futex_key *key,
+static int attach_to_pi_owner(u32 __user *uaddr, u32 uval, union futex_key *key,
 			      struct futex_pi_state **ps,
 			      struct task_struct **exiting)
 {
@@ -1213,12 +1269,15 @@ static int attach_to_pi_owner(u32 uval, union futex_key *key,
 	/*
 	 * We are the first waiter - try to look up the real owner and attach
 	 * the new pi_state to it, but bail out when TID = 0 [1]
+	 *
+	 * The !pid check is paranoid. None of the call sites should end up
+	 * with pid == 0, but better safe than sorry. Let the caller retry
 	 */
 	if (!pid)
-		return -ESRCH;
+		return -EAGAIN;
 	p = futex_find_get_task(pid);
 	if (!p)
-		return -ESRCH;
+		return handle_exit_race(uaddr, uval, NULL);
 
 	if (unlikely(p->flags & PF_KTHREAD)) {
 		put_task_struct(p);
@@ -1237,7 +1296,7 @@ static int attach_to_pi_owner(u32 uval, union futex_key *key,
 		 * FUTEX_STATE_DEAD, we know that the task has finished
 		 * the cleanup:
 		 */
-		int ret = (p->futex_state = FUTEX_STATE_DEAD) ? -ESRCH : -EAGAIN;
+		int ret = handle_exit_race(uaddr, uval, p);
 
 		raw_spin_unlock_irq(&p->pi_lock);
 		/*
@@ -1303,7 +1362,7 @@ static int lookup_pi_state(u32 __user *uaddr, u32 uval,
 	 * We are the first waiter - try to look up the owner based on
 	 * @uval and attach to it.
 	 */
-	return attach_to_pi_owner(uval, key, ps, exiting);
+	return attach_to_pi_owner(uaddr, uval, key, ps, exiting);
 }
 
 static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval)
@@ -1419,7 +1478,7 @@ static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
 	 * attach to the owner. If that fails, no harm done, we only
 	 * set the FUTEX_WAITERS bit in the user space variable.
 	 */
-	return attach_to_pi_owner(uval, key, ps, exiting);
+	return attach_to_pi_owner(uaddr, newval, key, ps, exiting);
 }
 
 /**

From 57f9cf0b622dfa8ea39b96dbb2201551d8e11886 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Thu, 11 Mar 2021 11:26:00 +0800
Subject: [PATCH 1663/2658] futex: fix dead code in attach_to_pi_owner()

This patch comes directly from an origin patch (commit
91509e84949fc97e7424521c32a9e227746e0b85) in v4.9.
And it is part of a full patch which was originally back-ported
to v4.14 as commit e6e00df182908f34360c3c9f2d13cc719362e9c0

The handle_exit_race() function is defined in commit 9c3f39860367
 ("futex: Cure exit race"), which never returns -EBUSY. This results
in a small piece of dead code in the attach_to_pi_owner() function:

	int ret = handle_exit_race(uaddr, uval, p); /* Never return -EBUSY */
	...
	if (ret == -EBUSY)
		*exiting = p; /* dead code */

The return value -EBUSY is added to handle_exit_race() in upsteam
commit ac31c7ff8624409 ("futex: Provide distinct return value when
owner is exiting"). This commit was incorporated into v4.9.255, before
the function handle_exit_race() was introduced, whitout Modify
handle_exit_race().

To fix dead code, extract the change of handle_exit_race() from
commit ac31c7ff8624409 ("futex: Provide distinct return value when owner
 is exiting"), re-incorporated.

Lee writes:

This commit takes the remaining functional snippet of:

 ac31c7ff8624409 ("futex: Provide distinct return value when owner is exiting")

... and is the correct fix for this issue.

Fixes: 9c3f39860367 ("futex: Cure exit race")
Cc: stable@vger.kernel.org # v4.9.258
Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
Reviewed-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 1fd99362e7b7..f26ed0debddd 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1204,11 +1204,11 @@ static int handle_exit_race(u32 __user *uaddr, u32 uval,
 	u32 uval2;
 
 	/*
-	 * If the futex exit state is not yet FUTEX_STATE_DEAD, wait
-	 * for it to finish.
+	 * If the futex exit state is not yet FUTEX_STATE_DEAD, tell the
+	 * caller that the alleged owner is busy.
 	 */
 	if (tsk && tsk->futex_state != FUTEX_STATE_DEAD)
-		return -EAGAIN;
+		return -EBUSY;
 
 	/*
 	 * Reread the user space value to handle the following situation:

From 996ae25801f203fe9fb575178a094f6c4c72eab5 Mon Sep 17 00:00:00 2001
From: "Kevin(Yudong) Yang" <yyd@google.com>
Date: Wed, 3 Mar 2021 09:43:54 -0500
Subject: [PATCH 1664/2658] net/mlx4_en: update moderation when config reset

commit 00ff801bb8ce6711e919af4530b6ffa14a22390a upstream.

This patch fixes a bug that the moderation config will not be
applied when calling mlx4_en_reset_config. For example, when
turning on rx timestamping, mlx4_en_reset_config() will be called,
causing the NIC to forget previous moderation config.

This fix is in phase with a previous fix:
commit 79c54b6bbf06 ("net/mlx4_en: Fix TX moderation info loss
after set_ringparam is called")

Tested: Before this patch, on a host with NIC using mlx4, run
netserver and stream TCP to the host at full utilization.
$ sar -I SUM 1
                 INTR    intr/s
14:03:56          sum  48758.00

After rx hwtstamp is enabled:
$ sar -I SUM 1
14:10:38          sum 317771.00
We see the moderation is not working properly and issued 7x more
interrupts.

After the patch, and turned on rx hwtstamp, the rate of interrupts
is as expected:
$ sar -I SUM 1
14:52:11          sum  49332.00

Fixes: 79c54b6bbf06 ("net/mlx4_en: Fix TX moderation info loss after set_ringparam is called")
Signed-off-by: Kevin(Yudong) Yang <yyd@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Neal Cardwell <ncardwell@google.com>
CC: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 2 +-
 drivers/net/ethernet/mellanox/mlx4/en_netdev.c  | 2 ++
 drivers/net/ethernet/mellanox/mlx4/mlx4_en.h    | 1 +
 3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index b52491f09a4d..14a3e9e601e8 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -47,7 +47,7 @@
 #define EN_ETHTOOL_SHORT_MASK cpu_to_be16(0xffff)
 #define EN_ETHTOOL_WORD_MASK  cpu_to_be32(0xffffffff)
 
-static int mlx4_en_moderation_update(struct mlx4_en_priv *priv)
+int mlx4_en_moderation_update(struct mlx4_en_priv *priv)
 {
 	int i;
 	int err = 0;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index b7bde70a3e95..112ce16717cd 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -3188,6 +3188,8 @@ int mlx4_en_reset_config(struct net_device *dev,
 			en_err(priv, "Failed starting port\n");
 	}
 
+	if (!err)
+		err = mlx4_en_moderation_update(priv);
 out:
 	mutex_unlock(&mdev->state_lock);
 	netdev_features_change(dev);
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 440f1ab6d92e..b6cd733791a8 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -839,6 +839,7 @@ void mlx4_en_ptp_overflow_check(struct mlx4_en_dev *mdev);
 #define DEV_FEATURE_CHANGED(dev, new_features, feature) \
 	((dev->features & feature) ^ (new_features & feature))
 
+int mlx4_en_moderation_update(struct mlx4_en_priv *priv);
 int mlx4_en_reset_config(struct net_device *dev,
 			 struct hwtstamp_config ts_config,
 			 netdev_features_t new_features);

From 5976ab6ea9fc93c1cebcf0549da9366243cd7bcb Mon Sep 17 00:00:00 2001
From: Xie He <xie.he.0141@gmail.com>
Date: Sun, 7 Mar 2021 03:33:07 -0800
Subject: [PATCH 1665/2658] net: lapbether: Remove netif_start_queue /
 netif_stop_queue

commit f7d9d4854519fdf4d45c70a4d953438cd88e7e58 upstream.

For the devices in this driver, the default qdisc is "noqueue",
because their "tx_queue_len" is 0.

In function "__dev_queue_xmit" in "net/core/dev.c", devices with the
"noqueue" qdisc are specially handled. Packets are transmitted without
being queued after a "dev->flags & IFF_UP" check. However, it's possible
that even if this check succeeds, "ops->ndo_stop" may still have already
been called. This is because in "__dev_close_many", "ops->ndo_stop" is
called before clearing the "IFF_UP" flag.

If we call "netif_stop_queue" in "ops->ndo_stop", then it's possible in
"__dev_queue_xmit", it sees the "IFF_UP" flag is present, and then it
checks "netif_xmit_stopped" and finds that the queue is already stopped.
In this case, it will complain that:
"Virtual device ... asks to queue packet!"

To prevent "__dev_queue_xmit" from generating this complaint, we should
not call "netif_stop_queue" in "ops->ndo_stop".

We also don't need to call "netif_start_queue" in "ops->ndo_open",
because after a netdev is allocated and registered, the
"__QUEUE_STATE_DRV_XOFF" flag is initially not set, so there is no need
to call "netif_start_queue" to clear it.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Acked-by: Martin Schiller <ms@dev.tdt.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wan/lapbether.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index ef746ba74ab4..666bbacb8cb4 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -286,7 +286,6 @@ static int lapbeth_open(struct net_device *dev)
 		return -ENODEV;
 	}
 
-	netif_start_queue(dev);
 	return 0;
 }
 
@@ -294,8 +293,6 @@ static int lapbeth_close(struct net_device *dev)
 {
 	int err;
 
-	netif_stop_queue(dev);
-
 	if ((err = lapb_unregister(dev)) != LAPB_OK)
 		pr_err("lapb_unregister error: %d\n", err);
 

From cec1c281b3e635454a211670d77751d7acc713f0 Mon Sep 17 00:00:00 2001
From: Paul Cercueil <paul@crapouillou.net>
Date: Sun, 7 Mar 2021 13:17:47 +0000
Subject: [PATCH 1666/2658] net: davicom: Fix regulator not turned off on
 failed probe

commit ac88c531a5b38877eba2365a3f28f0c8b513dc33 upstream.

When the probe fails or requests to be defered, we must disable the
regulator that was previously enabled.

Fixes: 7994fe55a4a2 ("dm9000: Add regulator and reset support to dm9000")
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/davicom/dm9000.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
index cf94b72dbacd..6653e24c123f 100644
--- a/drivers/net/ethernet/davicom/dm9000.c
+++ b/drivers/net/ethernet/davicom/dm9000.c
@@ -1462,7 +1462,7 @@ dm9000_probe(struct platform_device *pdev)
 		if (ret) {
 			dev_err(dev, "failed to request reset gpio %d: %d\n",
 				reset_gpios, ret);
-			return -ENODEV;
+			goto out_regulator_disable;
 		}
 
 		/* According to manual PWRST# Low Period Min 1ms */
@@ -1474,8 +1474,10 @@ dm9000_probe(struct platform_device *pdev)
 
 	if (!pdata) {
 		pdata = dm9000_parse_dt(&pdev->dev);
-		if (IS_ERR(pdata))
-			return PTR_ERR(pdata);
+		if (IS_ERR(pdata)) {
+			ret = PTR_ERR(pdata);
+			goto out_regulator_disable;
+		}
 	}
 
 	/* Init network device */
@@ -1710,6 +1712,10 @@ dm9000_probe(struct platform_device *pdev)
 	dm9000_release_board(pdev, db);
 	free_netdev(ndev);
 
+out_regulator_disable:
+	if (!IS_ERR(power))
+		regulator_disable(power);
+
 	return ret;
 }
 

From a45f02c1f425327e0a49c7b20c21c7369e323937 Mon Sep 17 00:00:00 2001
From: Paul Cercueil <paul@crapouillou.net>
Date: Sun, 7 Mar 2021 13:17:48 +0000
Subject: [PATCH 1667/2658] net: davicom: Fix regulator not turned off on
 driver removal

commit cf9e60aa69ae6c40d3e3e4c94dd6c8de31674e9b upstream.

We must disable the regulator that was enabled in the probe function.

Fixes: 7994fe55a4a2 ("dm9000: Add regulator and reset support to dm9000")
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/davicom/dm9000.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
index 6653e24c123f..ab06cf36af08 100644
--- a/drivers/net/ethernet/davicom/dm9000.c
+++ b/drivers/net/ethernet/davicom/dm9000.c
@@ -144,6 +144,8 @@ struct board_info {
 	u32		wake_state;
 
 	int		ip_summed;
+
+	struct regulator *power_supply;
 };
 
 /* debug code */
@@ -1494,6 +1496,8 @@ dm9000_probe(struct platform_device *pdev)
 
 	db->dev = &pdev->dev;
 	db->ndev = ndev;
+	if (!IS_ERR(power))
+		db->power_supply = power;
 
 	spin_lock_init(&db->lock);
 	mutex_init(&db->addr_lock);
@@ -1775,10 +1779,13 @@ static int
 dm9000_drv_remove(struct platform_device *pdev)
 {
 	struct net_device *ndev = platform_get_drvdata(pdev);
+	struct board_info *dm = to_dm9000_board(ndev);
 
 	unregister_netdev(ndev);
-	dm9000_release_board(pdev, netdev_priv(ndev));
+	dm9000_release_board(pdev, dm);
 	free_netdev(ndev);		/* free device structure */
+	if (dm->power_supply)
+		regulator_disable(dm->power_supply);
 
 	dev_dbg(&pdev->dev, "released and freed device\n");
 	return 0;

From 6d69f917de482bea2064829798a4a95960c3076d Mon Sep 17 00:00:00 2001
From: Maxim Mikityanskiy <maxtram95@gmail.com>
Date: Fri, 5 Feb 2021 23:51:39 +0100
Subject: [PATCH 1668/2658] media: usbtv: Fix deadlock on suspend

commit 8a7e27fd5cd696ba564a3f62cedef7269cfd0723 upstream.

usbtv doesn't support power management, so on system suspend the
.disconnect callback of the driver is called. The teardown sequence
includes a call to snd_card_free. Its implementation waits until the
refcount of the sound card device drops to zero, however, if its file is
open, snd_card_file_add takes a reference, which can't be dropped during
the suspend, because the userspace processes are already frozen at this
point. snd_card_free waits for completion forever, leading to a hang on
suspend.

This commit fixes this deadlock condition by replacing snd_card_free
with snd_card_free_when_closed, that doesn't wait until all references
are released, allowing suspend to progress.

Fixes: 63ddf68de52e ("[media] usbtv: add audio support")
Signed-off-by: Maxim Mikityanskiy <maxtram95@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/usbtv/usbtv-audio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/usbtv/usbtv-audio.c b/drivers/media/usb/usbtv/usbtv-audio.c
index 5dab02432e82..17128340ea5d 100644
--- a/drivers/media/usb/usbtv/usbtv-audio.c
+++ b/drivers/media/usb/usbtv/usbtv-audio.c
@@ -384,7 +384,7 @@ void usbtv_audio_free(struct usbtv *usbtv)
 	cancel_work_sync(&usbtv->snd_trigger);
 
 	if (usbtv->snd && usbtv->udev) {
-		snd_card_free(usbtv->snd);
+		snd_card_free_when_closed(usbtv->snd);
 		usbtv->snd = NULL;
 	}
 }

From 03c38e7f69dbda396a9b55bd6a5001e07dac2cb2 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Tue, 8 Dec 2020 21:35:27 +0100
Subject: [PATCH 1669/2658] mmc: mxs-mmc: Fix a resource leak in an error
 handling path in 'mxs_mmc_probe()'

[ Upstream commit 0bb7e560f821c7770973a94e346654c4bdccd42c ]

If 'mmc_of_parse()' fails, we must undo the previous 'dma_request_chan()'
call.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/20201208203527.49262-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/mxs-mmc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c
index c8b8ac66ff7e..687fd68fbbcd 100644
--- a/drivers/mmc/host/mxs-mmc.c
+++ b/drivers/mmc/host/mxs-mmc.c
@@ -651,7 +651,7 @@ static int mxs_mmc_probe(struct platform_device *pdev)
 
 	ret = mmc_of_parse(mmc);
 	if (ret)
-		goto out_clk_disable;
+		goto out_free_dma;
 
 	mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
 

From 3be12e37605ae99157a4a4993981af920c2a9f5a Mon Sep 17 00:00:00 2001
From: Chaotian Jing <chaotian.jing@mediatek.com>
Date: Fri, 18 Dec 2020 15:16:11 +0800
Subject: [PATCH 1670/2658] mmc: mediatek: fix race condition between
 msdc_request_timeout and irq

[ Upstream commit 0354ca6edd464a2cf332f390581977b8699ed081 ]

when get request SW timeout, if CMD/DAT xfer done irq coming right now,
then there is race between the msdc_request_timeout work and irq handler,
and the host->cmd and host->data may set to NULL in irq handler. also,
current flow ensure that only one path can go to msdc_request_done(), so
no need check the return value of cancel_delayed_work().

Signed-off-by: Chaotian Jing <chaotian.jing@mediatek.com>
Link: https://lore.kernel.org/r/20201218071611.12276-1-chaotian.jing@mediatek.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/mtk-sd.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
index 5ef25463494f..1770c8df9d1b 100644
--- a/drivers/mmc/host/mtk-sd.c
+++ b/drivers/mmc/host/mtk-sd.c
@@ -720,13 +720,13 @@ static void msdc_track_cmd_data(struct msdc_host *host,
 static void msdc_request_done(struct msdc_host *host, struct mmc_request *mrq)
 {
 	unsigned long flags;
-	bool ret;
 
-	ret = cancel_delayed_work(&host->req_timeout);
-	if (!ret) {
-		/* delay work already running */
-		return;
-	}
+	/*
+	 * No need check the return value of cancel_delayed_work, as only ONE
+	 * path will go here!
+	 */
+	cancel_delayed_work(&host->req_timeout);
+
 	spin_lock_irqsave(&host->lock, flags);
 	host->mrq = NULL;
 	spin_unlock_irqrestore(&host->lock, flags);
@@ -747,7 +747,7 @@ static bool msdc_cmd_done(struct msdc_host *host, int events,
 	bool done = false;
 	bool sbc_error;
 	unsigned long flags;
-	u32 *rsp = cmd->resp;
+	u32 *rsp;
 
 	if (mrq->sbc && cmd == mrq->cmd &&
 	    (events & (MSDC_INT_ACMDRDY | MSDC_INT_ACMDCRCERR
@@ -768,6 +768,7 @@ static bool msdc_cmd_done(struct msdc_host *host, int events,
 
 	if (done)
 		return true;
+	rsp = cmd->resp;
 
 	sdr_clr_bits(host->base + MSDC_INTEN, cmd_ints_mask);
 
@@ -942,7 +943,7 @@ static void msdc_data_xfer_next(struct msdc_host *host,
 static bool msdc_data_xfer_done(struct msdc_host *host, u32 events,
 				struct mmc_request *mrq, struct mmc_data *data)
 {
-	struct mmc_command *stop = data->stop;
+	struct mmc_command *stop;
 	unsigned long flags;
 	bool done;
 	unsigned int check_data = events &
@@ -958,6 +959,7 @@ static bool msdc_data_xfer_done(struct msdc_host *host, u32 events,
 
 	if (done)
 		return true;
+	stop = data->stop;
 
 	if (check_data || (stop && stop->error)) {
 		dev_dbg(host->dev, "DMA status: 0x%8X\n",

From ae152905fcefd3c262d76a7e8dbb8ac187c6ccba Mon Sep 17 00:00:00 2001
From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Date: Fri, 5 Feb 2021 04:14:52 -0500
Subject: [PATCH 1671/2658] powerpc/perf: Record counter overflow always if
 SAMPLE_IP is unset

[ Upstream commit d137845c973147a22622cc76c7b0bc16f6206323 ]

While sampling for marked events, currently we record the sample only
if the SIAR valid bit of Sampled Instruction Event Register (SIER) is
set. SIAR_VALID bit is used for fetching the instruction address from
Sampled Instruction Address Register(SIAR). But there are some
usecases, where the user is interested only in the PMU stats at each
counter overflow and the exact IP of the overflow event is not
required. Dropping SIAR invalid samples will fail to record some of
the counter overflows in such cases.

Example of such usecase is dumping the PMU stats (event counts) after
some regular amount of instructions/events from the userspace (ex: via
ptrace). Here counter overflow is indicated to userspace via signal
handler, and captured by monitoring and enabling I/O signaling on the
event file descriptor. In these cases, we expect to get
sample/overflow indication after each specified sample_period.

Perf event attribute will not have PERF_SAMPLE_IP set in the
sample_type if exact IP of the overflow event is not requested. So
while profiling if SAMPLE_IP is not set, just record the counter
overflow irrespective of SIAR_VALID check.

Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
[mpe: Reflow comment and if formatting]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1612516492-1428-1-git-send-email-atrajeev@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/perf/core-book3s.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index e593e7f856ed..7a80e1cff6e2 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -2008,7 +2008,17 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
 			left += period;
 			if (left <= 0)
 				left = period;
-			record = siar_valid(regs);
+
+			/*
+			 * If address is not requested in the sample via
+			 * PERF_SAMPLE_IP, just record that sample irrespective
+			 * of SIAR valid check.
+			 */
+			if (event->attr.sample_type & PERF_SAMPLE_IP)
+				record = siar_valid(regs);
+			else
+				record = 1;
+
 			event->hw.last_period = event->hw.sample_period;
 		}
 		if (left < 0x80000000LL)
@@ -2026,9 +2036,10 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
 	 * MMCR2. Check attr.exclude_kernel and address to drop the sample in
 	 * these cases.
 	 */
-	if (event->attr.exclude_kernel && record)
-		if (is_kernel_addr(mfspr(SPRN_SIAR)))
-			record = 0;
+	if (event->attr.exclude_kernel &&
+	    (event->attr.sample_type & PERF_SAMPLE_IP) &&
+	    is_kernel_addr(mfspr(SPRN_SIAR)))
+		record = 0;
 
 	/*
 	 * Finally record data if requested.

From 0b05c76cc77875c7f32fa1521cb32428b1bf357b Mon Sep 17 00:00:00 2001
From: Martin Kaiser <martin@kaiser.cx>
Date: Fri, 15 Jan 2021 22:24:35 +0100
Subject: [PATCH 1672/2658] PCI: xgene-msi: Fix race in installing chained irq
 handler

[ Upstream commit a93c00e5f975f23592895b7e83f35de2d36b7633 ]

Fix a race where a pending interrupt could be received and the handler
called before the handler's data has been setup, by converting to
irq_set_chained_handler_and_data().

See also 2cf5a03cb29d ("PCI/keystone: Fix race in installing chained IRQ
handler").

Based on the mail discussion, it seems ok to drop the error handling.

Link: https://lore.kernel.org/r/20210115212435.19940-3-martin@kaiser.cx
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/host/pci-xgene-msi.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/drivers/pci/host/pci-xgene-msi.c b/drivers/pci/host/pci-xgene-msi.c
index a6456b578269..b6a099371ad2 100644
--- a/drivers/pci/host/pci-xgene-msi.c
+++ b/drivers/pci/host/pci-xgene-msi.c
@@ -393,13 +393,9 @@ static int xgene_msi_hwirq_alloc(unsigned int cpu)
 		if (!msi_group->gic_irq)
 			continue;
 
-		irq_set_chained_handler(msi_group->gic_irq,
-					xgene_msi_isr);
-		err = irq_set_handler_data(msi_group->gic_irq, msi_group);
-		if (err) {
-			pr_err("failed to register GIC IRQ handler\n");
-			return -EINVAL;
-		}
+		irq_set_chained_handler_and_data(msi_group->gic_irq,
+			xgene_msi_isr, msi_group);
+
 		/*
 		 * Statically allocate MSI GIC IRQs to each CPU core.
 		 * With 8-core X-Gene v1, 2 MSI GIC IRQs are allocated

From 680a362b95697e9adc57524a0530a5c3b99722e6 Mon Sep 17 00:00:00 2001
From: Heiko Carstens <hca@linux.ibm.com>
Date: Wed, 17 Feb 2021 07:13:02 +0100
Subject: [PATCH 1673/2658] s390/smp: __smp_rescan_cpus() - move cpumask away
 from stack

[ Upstream commit 62c8dca9e194326802b43c60763f856d782b225c ]

Avoid a potentially large stack frame and overflow by making
"cpumask_t avail" a static variable. There is no concurrent
access due to the existing locking.

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/kernel/smp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index f113fcd781d8..486f0d4f9aee 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -738,7 +738,7 @@ static int smp_add_core(struct sclp_core_entry *core, cpumask_t *avail,
 static int __smp_rescan_cpus(struct sclp_core_info *info, bool early)
 {
 	struct sclp_core_entry *core;
-	cpumask_t avail;
+	static cpumask_t avail;
 	bool configured;
 	u16 core_id;
 	int nr, i;

From daab0a73aac4e40cc4e22cbba5707680dba97deb Mon Sep 17 00:00:00 2001
From: Mike Christie <michael.christie@oracle.com>
Date: Sat, 6 Feb 2021 22:46:00 -0600
Subject: [PATCH 1674/2658] scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error
 handling

[ Upstream commit d28d48c699779973ab9a3bd0e5acfa112bd4fdef ]

If iscsi_prep_scsi_cmd_pdu() fails we try to add it back to the cmdqueue,
but we leave it partially setup. We don't have functions that can undo the
pdu and init task setup. We only have cleanup_task which can clean up both
parts. So this has us just fail the cmd and go through the standard cleanup
routine and then have the SCSI midlayer retry it like is done when it fails
in the queuecommand path.

Link: https://lore.kernel.org/r/20210207044608.27585-2-michael.christie@oracle.com
Reviewed-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/libiscsi.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index ecf3950c4438..18b8d86ef74b 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -1568,14 +1568,9 @@ static int iscsi_data_xmit(struct iscsi_conn *conn)
 		}
 		rc = iscsi_prep_scsi_cmd_pdu(conn->task);
 		if (rc) {
-			if (rc == -ENOMEM || rc == -EACCES) {
-				spin_lock_bh(&conn->taskqueuelock);
-				list_add_tail(&conn->task->running,
-					      &conn->cmdqueue);
-				conn->task = NULL;
-				spin_unlock_bh(&conn->taskqueuelock);
-				goto done;
-			} else
+			if (rc == -ENOMEM || rc == -EACCES)
+				fail_scsi_task(conn->task, DID_IMM_RETRY);
+			else
 				fail_scsi_task(conn->task, DID_ABORT);
 			spin_lock_bh(&conn->taskqueuelock);
 			continue;

From e1145655e017df84ff522ef9bf46351dfe283c91 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 10 Mar 2021 12:28:09 +0100
Subject: [PATCH 1675/2658] ALSA: hda/hdmi: Cancel pending works before suspend

commit eea46a0879bcca23e15071f9968c0f6e6596e470 upstream.

The per_pin->work might be still floating at the suspend, and this may
hit the access to the hardware at an unexpected timing.  Cancel the
work properly at the suspend callback for avoiding the buggy access.

Note that the bug doesn't trigger easily in the recent kernels since
the work is queued only when the repoll count is set, and usually it's
only at the resume callback, but it's still possible to hit in
theory.

BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1182377
Reported-and-tested-by: Abhishek Sahu <abhsahu@nvidia.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210310112809.9215-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_hdmi.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index b249b1b85746..785c64b854ec 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -2239,6 +2239,18 @@ static void generic_hdmi_free(struct hda_codec *codec)
 }
 
 #ifdef CONFIG_PM
+static int generic_hdmi_suspend(struct hda_codec *codec)
+{
+	struct hdmi_spec *spec = codec->spec;
+	int pin_idx;
+
+	for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) {
+		struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
+		cancel_delayed_work_sync(&per_pin->work);
+	}
+	return 0;
+}
+
 static int generic_hdmi_resume(struct hda_codec *codec)
 {
 	struct hdmi_spec *spec = codec->spec;
@@ -2262,6 +2274,7 @@ static const struct hda_codec_ops generic_hdmi_patch_ops = {
 	.build_controls		= generic_hdmi_build_controls,
 	.unsol_event		= hdmi_unsol_event,
 #ifdef CONFIG_PM
+	.suspend		= generic_hdmi_suspend,
 	.resume			= generic_hdmi_resume,
 #endif
 };

From de6d0d009260cbf9cc2f71d1d6c537ae903c8d88 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 10 Mar 2021 12:28:08 +0100
Subject: [PATCH 1676/2658] ALSA: hda: Avoid spurious unsol event handling
 during S3/S4

commit 5ff9dde42e8c72ed8102eb8cb62e03f9dc2103ab upstream.

When HD-audio bus receives unsolicited events during its system
suspend/resume (S3 and S4) phase, the controller driver may still try
to process events although the codec chips are already (or yet)
powered down.  This might screw up the codec communication, resulting
in CORB/RIRB errors.  Such events should be rather skipped, as the
codec chip status such as the jack status will be fully refreshed at
the system resume time.

Since we're tracking the system suspend/resume state in codec
power.power_state field, let's add the check in the common unsol event
handler entry point to filter out such events.

BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1182377
Tested-by: Abhishek Sahu <abhsahu@nvidia.com>
Cc: <stable@vger.kernel.org> # 183ab39eb0ea: ALSA: hda: Initialize power_state
Link: https://lore.kernel.org/r/20210310112809.9215-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/hda_bind.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c
index d0d6dfbfcfdf..f25c2c43c562 100644
--- a/sound/pci/hda/hda_bind.c
+++ b/sound/pci/hda/hda_bind.c
@@ -46,6 +46,10 @@ static void hda_codec_unsol_event(struct hdac_device *dev, unsigned int ev)
 	if (codec->bus->shutdown)
 		return;
 
+	/* ignore unsol events during system suspend/resume */
+	if (codec->core.dev.power.power_state.event != PM_EVENT_ON)
+		return;
+
 	if (codec->patch_ops.unsol_event)
 		codec->patch_ops.unsol_event(codec, ev);
 }

From 2b239d09768e2fe4ff4c15d95e2946394a7f03db Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Thu, 4 Mar 2021 09:30:21 +0100
Subject: [PATCH 1677/2658] ALSA: usb-audio: Fix "cannot get freq eq" errors on
 Dell AE515 sound bar

commit fec60c3bc5d1713db2727cdffc638d48f9c07dc3 upstream.

Dell AE515 sound bar (413c:a506) spews the error messages when the
driver tries to read the current sample frequency, hence it needs to
be on the list in snd_usb_get_sample_rate_quirk().

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211551
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210304083021.2152-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/quirks.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 59529a9cab61..79cffe44388f 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1154,6 +1154,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
 	case USB_ID(0x1de7, 0x0114): /* Phoenix Audio MT202pcs */
 	case USB_ID(0x21B4, 0x0081): /* AudioQuest DragonFly */
 	case USB_ID(0x2912, 0x30c8): /* Audioengine D1 */
+	case USB_ID(0x413c, 0xa506): /* Dell AE515 sound bar */
 		return true;
 	}
 	return false;

From 6f4e7540a47aed2cc8ffd92db328b60190feea63 Mon Sep 17 00:00:00 2001
From: Stefan Haberland <sth@linux.ibm.com>
Date: Fri, 5 Mar 2021 13:54:38 +0100
Subject: [PATCH 1678/2658] s390/dasd: fix hanging DASD driver unbind

commit 7d365bd0bff3c0310c39ebaffc9a8458e036d666 upstream.

In case of an unbind of the DASD device driver the function
dasd_generic_remove() is called which shuts down the device.
Among others this functions removes the int_handler from the cdev.
During shutdown the device cancels all outstanding IO requests and waits
for completion of the clear request.
Unfortunately the clear interrupt will never be received when there is no
interrupt handler connected.

Fix by moving the int_handler removal after the call to the state machine
where no request or interrupt is outstanding.

Cc: stable@vger.kernel.org
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Tested-by: Bjoern Walk <bwalk@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/s390/block/dasd.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index b76a85d14ef0..aec25ea99d19 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -3286,8 +3286,6 @@ void dasd_generic_remove(struct ccw_device *cdev)
 	struct dasd_device *device;
 	struct dasd_block *block;
 
-	cdev->handler = NULL;
-
 	device = dasd_device_from_cdev(cdev);
 	if (IS_ERR(device)) {
 		dasd_remove_sysfs_files(cdev);
@@ -3306,6 +3304,7 @@ void dasd_generic_remove(struct ccw_device *cdev)
 	 * no quite down yet.
 	 */
 	dasd_set_target_state(device, DASD_STATE_NEW);
+	cdev->handler = NULL;
 	/* dasd_delete_device destroys the device reference. */
 	block = device->block;
 	dasd_delete_device(device);

From 41c7230e98e8a5554fe9cf6a7e68c2f8804c9454 Mon Sep 17 00:00:00 2001
From: Adrian Hunter <adrian.hunter@intel.com>
Date: Wed, 3 Mar 2021 11:26:14 +0200
Subject: [PATCH 1679/2658] mmc: core: Fix partition switch time for eMMC

commit 66fbacccbab91e6e55d9c8f1fc0910a8eb6c81f7 upstream.

Avoid the following warning by always defining partition switch time:

 [    3.209874] mmc1: unspecified timeout for CMD6 - use generic
 [    3.222780] ------------[ cut here ]------------
 [    3.233363] WARNING: CPU: 1 PID: 111 at drivers/mmc/core/mmc_ops.c:575 __mmc_switch+0x200/0x204

Reported-by: Paul Fertser <fercerpav@gmail.com>
Fixes: 1c447116d017 ("mmc: mmc: Fix partition switch timeout for some eMMCs")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Link: https://lore.kernel.org/r/168bbfd6-0c5b-5ace-ab41-402e7937c46e@intel.com
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/core/mmc.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 6872ba2593b5..113eb70642c2 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -416,10 +416,6 @@ static int mmc_decode_ext_csd(struct mmc_card *card, u8 *ext_csd)
 
 		/* EXT_CSD value is in units of 10ms, but we store in ms */
 		card->ext_csd.part_time = 10 * ext_csd[EXT_CSD_PART_SWITCH_TIME];
-		/* Some eMMC set the value too low so set a minimum */
-		if (card->ext_csd.part_time &&
-		    card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME)
-			card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME;
 
 		/* Sleep / awake timeout in 100ns units */
 		if (sa_shift > 0 && sa_shift <= 0x17)

From 5dcbbcff7fe16fa99e101c0873e9bd96ccac3e7c Mon Sep 17 00:00:00 2001
From: Joe Lawrence <joe.lawrence@redhat.com>
Date: Tue, 20 Nov 2018 15:19:18 -0500
Subject: [PATCH 1680/2658] scripts/recordmcount.{c,pl}: support
 -ffunction-sections .text.* section names

commit 9c8e2f6d3d361439cc6744a094f1c15681b55269 upstream.

When building with -ffunction-sections, the compiler will place each
function into its own ELF section, prefixed with ".text".  For example,
a simple test module with functions test_module_do_work() and
test_module_wq_func():

  % objdump --section-headers test_module.o | awk '/\.text/{print $2}'
  .text
  .text.test_module_do_work
  .text.test_module_wq_func
  .init.text
  .exit.text

Adjust the recordmcount scripts to look for ".text" as a section name
prefix.  This will ensure that those functions will be included in the
__mcount_loc relocations:

  % objdump --reloc --section __mcount_loc test_module.o
  OFFSET           TYPE              VALUE
  0000000000000000 R_X86_64_64       .text.test_module_do_work
  0000000000000008 R_X86_64_64       .text.test_module_wq_func
  0000000000000010 R_X86_64_64       .init.text

Link: http://lkml.kernel.org/r/1542745158-25392-2-git-send-email-joe.lawrence@redhat.com

Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
[Manoj: Resolve conflict on 4.4.y/4.9.y because of missing 42c269c88dc1]
Signed-off-by: Manoj Gupta <manojgupta@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 scripts/recordmcount.c  |  2 +-
 scripts/recordmcount.pl | 13 +++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
index 7250fb38350c..8cba4c44da4c 100644
--- a/scripts/recordmcount.c
+++ b/scripts/recordmcount.c
@@ -362,7 +362,7 @@ static uint32_t (*w2)(uint16_t);
 static int
 is_mcounted_section_name(char const *const txtname)
 {
-	return strcmp(".text",           txtname) == 0 ||
+	return strncmp(".text",          txtname, 5) == 0 ||
 		strcmp(".ref.text",      txtname) == 0 ||
 		strcmp(".sched.text",    txtname) == 0 ||
 		strcmp(".spinlock.text", txtname) == 0 ||
diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
index ccd6614ea218..5ca4ec297019 100755
--- a/scripts/recordmcount.pl
+++ b/scripts/recordmcount.pl
@@ -138,6 +138,11 @@
      ".text.unlikely" => 1,
 );
 
+# Acceptable section-prefixes to record.
+my %text_section_prefixes = (
+     ".text." => 1,
+);
+
 # Note: we are nice to C-programmers here, thus we skip the '||='-idiom.
 $objdump = 'objdump' if (!$objdump);
 $objcopy = 'objcopy' if (!$objcopy);
@@ -503,6 +508,14 @@ sub update_funcs
 
 	# Only record text sections that we know are safe
 	$read_function = defined($text_sections{$1});
+	if (!$read_function) {
+	    foreach my $prefix (keys %text_section_prefixes) {
+	        if (substr($1, 0, length $prefix) eq $prefix) {
+	            $read_function = 1;
+	            last;
+	        }
+	    }
+	}
 	# print out any recorded offsets
 	update_funcs();
 

From bb0f7c0e034ddae63b65c34f4e7d53f38175827c Mon Sep 17 00:00:00 2001
From: Allen Pais <allen.pais@oracle.com>
Date: Wed, 18 Sep 2019 22:05:00 +0530
Subject: [PATCH 1681/2658] libertas: fix a potential NULL pointer dereference

commit 7da413a18583baaf35dd4a8eb414fa410367d7f2 upstream.

alloc_workqueue is not checked for errors and as a result,
a potential NULL dereference could occur.

Signed-off-by: Allen Pais <allen.pais@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
[krzk: backport applied to different path - without marvell subdir]
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/libertas/if_sdio.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index 33ceda296c9c..45d68ee682f6 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -1229,6 +1229,10 @@ static int if_sdio_probe(struct sdio_func *func,
 
 	spin_lock_init(&card->lock);
 	card->workqueue = create_workqueue("libertas_sdio");
+	if (unlikely(!card->workqueue)) {
+		ret = -ENOMEM;
+		goto err_queue;
+	}
 	INIT_WORK(&card->packet_worker, if_sdio_host_to_card_worker);
 	init_waitqueue_head(&card->pwron_waitq);
 
@@ -1282,6 +1286,7 @@ static int if_sdio_probe(struct sdio_func *func,
 	lbs_remove_card(priv);
 free:
 	destroy_workqueue(card->workqueue);
+err_queue:
 	while (card->packets) {
 		packet = card->packets;
 		card->packets = card->packets->next;

From 4300b49be8f08f70bc46e936e4998701802203b4 Mon Sep 17 00:00:00 2001
From: Yorick de Wid <ydewid@gmail.com>
Date: Sat, 13 Feb 2021 15:49:02 +0100
Subject: [PATCH 1682/2658] Goodix Fingerprint device is not a modem

commit 4d8654e81db7346f915eca9f1aff18f385cab621 upstream.

The CDC ACM driver is false matching the Goodix Fingerprint device
against the USB_CDC_ACM_PROTO_AT_V25TER.

The Goodix Fingerprint device is a biometrics sensor that should be
handled in user-space. libfprint has some support for Goodix
fingerprint sensors, although not for this particular one. It is
possible that the vendor allocates a PID per OEM (Lenovo, Dell etc).
If this happens to be the case then more devices from the same vendor
could potentially match the ACM modem module table.

Signed-off-by: Yorick de Wid <ydewid@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210213144901.53199-1-ydewid@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/cdc-acm.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index e5ee349a5382..53d2f02e18a3 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1928,6 +1928,11 @@ static const struct usb_device_id acm_ids[] = {
 	.driver_info = SEND_ZERO_PACKET,
 	},
 
+	/* Exclude Goodix Fingerprint Reader */
+	{ USB_DEVICE(0x27c6, 0x5395),
+	.driver_info = IGNORE_DEVICE,
+	},
+
 	/* control interfaces without any protocol set */
 	{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
 		USB_CDC_PROTO_NONE) },

From 54b596931e2fe1263571c795552da8d4a4917a29 Mon Sep 17 00:00:00 2001
From: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Date: Mon, 1 Mar 2021 13:49:31 +0200
Subject: [PATCH 1683/2658] usb: gadget: f_uac2: always increase endpoint
 max_packet_size by one audio slot

commit 789ea77310f0200c84002884ffd628e2baf3ad8a upstream.

As per UAC2 Audio Data Formats spec (2.3.1.1 USB Packets),
if the sampling rate is a constant, the allowable variation
of number of audio slots per virtual frame is +/- 1 audio slot.

It means that endpoint should be able to accept/send +1 audio
slot.

Previous endpoint max_packet_size calculation code
was adding sometimes +1 audio slot due to DIV_ROUND_UP
behaviour which was rounding up to closest integer.
However this doesn't work if the numbers are divisible.

It had no any impact with Linux hosts which ignore
this issue, but in case of more strict Windows it
caused rejected enumeration

Thus always add +1 audio slot to endpoint's max packet size

Fixes: 913e4a90b6f9 ("usb: gadget: f_uac2: finalize wMaxPacketSize according to bandwidth")
Cc: Peter Chen <peter.chen@freescale.com>
Cc: <stable@vger.kernel.org> #v4.3+
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Link: https://lore.kernel.org/r/1614599375-8803-2-git-send-email-ruslan.bilovol@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/function/f_uac2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 81af315774c6..6903d02a933f 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -997,7 +997,7 @@ static int set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts,
 	}
 
 	max_size_bw = num_channels(chmask) * ssize *
-		DIV_ROUND_UP(srate, factor / (1 << (ep_desc->bInterval - 1)));
+		((srate / (factor / (1 << (ep_desc->bInterval - 1)))) + 1);
 	ep_desc->wMaxPacketSize = cpu_to_le16(min_t(u16, max_size_bw,
 						    max_size_ep));
 

From 0c7715da6e386e5c5ff53849312020a359a72372 Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Date: Mon, 8 Mar 2021 10:55:38 +0900
Subject: [PATCH 1684/2658] usb: renesas_usbhs: Clear PIPECFG for re-enabling
 pipe with other EPNUM

commit b1d25e6ee57c2605845595b6c61340d734253eb3 upstream.

According to the datasheet, this controller has a restriction
which "set an endpoint number so that combinations of the DIR bit and
the EPNUM bits do not overlap.". However, since the udc core driver is
possible to assign a bulk pipe as an interrupt endpoint, an endpoint
number may not match the pipe number. After that, when user rebinds
another gadget driver, this driver broke the restriction because
the driver didn't clear any configuration in usb_ep_disable().

Example:
 # modprobe g_ncm
 Then, EP3 = pipe 3, EP4 = pipe 4, EP5 = pipe 6
 # rmmod g_ncm
 # modprobe g_hid
 Then, EP3 = pipe 6, EP4 = pipe 7.
 So, pipe 3 and pipe 6 are set as EP3.

So, clear PIPECFG register in usbhs_pipe_free().

Fixes: dfb87b8bfe09 ("usb: renesas_usbhs: gadget: fix re-enabling pipe without re-connecting")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/1615168538-26101-1-git-send-email-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/renesas_usbhs/pipe.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/renesas_usbhs/pipe.c b/drivers/usb/renesas_usbhs/pipe.c
index 75fb41d4e9fc..22249e389c3d 100644
--- a/drivers/usb/renesas_usbhs/pipe.c
+++ b/drivers/usb/renesas_usbhs/pipe.c
@@ -805,6 +805,8 @@ struct usbhs_pipe *usbhs_pipe_malloc(struct usbhs_priv *priv,
 
 void usbhs_pipe_free(struct usbhs_pipe *pipe)
 {
+	usbhsp_pipe_select(pipe);
+	usbhsp_pipe_cfg_set(pipe, 0xFFFF, 0);
 	usbhsp_put_pipe(pipe);
 }
 

From e246b0bc6fe56a07d34bfabf35167dd0eed29490 Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Thu, 11 Mar 2021 13:53:51 +0200
Subject: [PATCH 1685/2658] xhci: Improve detection of device initiated wake
 signal.

commit 253f588c70f66184b1f3a9bbb428b49bbda73e80 upstream.

A xHC USB 3 port might miss the first wake signal from a USB 3 device
if the port LFPS reveiver isn't enabled fast enough after xHC resume.

xHC host will anyway be resumed by a PME# signal, but will go back to
suspend if no port activity is seen.
The device resends the U3 LFPS wake signal after a 100ms delay, but
by then host is already suspended, starting all over from the
beginning of this issue.

USB 3 specs say U3 wake LFPS signal is sent for max 10ms, then device
needs to delay 100ms before resending the wake.

Don't suspend immediately if port activity isn't detected in resume.
Instead add a retry. If there is no port activity then delay for 120ms,
and re-check for port activity.

Cc: <stable@vger.kernel.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20210311115353.2137560-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index d0197bd1f567..5ad7e004f861 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1036,6 +1036,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 	struct usb_hcd		*secondary_hcd;
 	int			retval = 0;
 	bool			comp_timer_running = false;
+	bool			pending_portevent = false;
 
 	if (!hcd->state)
 		return 0;
@@ -1169,13 +1170,22 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 
  done:
 	if (retval == 0) {
-		/* Resume root hubs only when have pending events. */
-		if (xhci_pending_portevent(xhci)) {
+		/*
+		 * Resume roothubs only if there are pending events.
+		 * USB 3 devices resend U3 LFPS wake after a 100ms delay if
+		 * the first wake signalling failed, give it that chance.
+		 */
+		pending_portevent = xhci_pending_portevent(xhci);
+		if (!pending_portevent) {
+			msleep(120);
+			pending_portevent = xhci_pending_portevent(xhci);
+		}
+
+		if (pending_portevent) {
 			usb_hcd_resume_root_hub(xhci->shared_hcd);
 			usb_hcd_resume_root_hub(hcd);
 		}
 	}
-
 	/*
 	 * If system is subject to the Quirk, Compliance Mode Timer needs to
 	 * be re-initialized Always after a system resume. Ports are subject

From 7ad9aa596029d52f2e46d9846db7483ad6f59dd6 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Tue, 2 Mar 2021 02:01:52 +0300
Subject: [PATCH 1686/2658] USB: serial: io_edgeport: fix memory leak in
 edge_startup

commit cfdc67acc785e01a8719eeb7012709d245564701 upstream.

sysbot found memory leak in edge_startup().
The problem was that when an error was received from the usb_submit_urb(),
nothing was cleaned up.

Reported-by: syzbot+59f777bdcbdd7eea5305@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Fixes: 6e8cf7751f9f ("USB: add EPIC support to the io_edgeport driver")
Cc: stable@vger.kernel.org	# 2.6.21: c5c0c55598ce
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/io_edgeport.c | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index b639d064e5da..14ab47f88251 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -2966,26 +2966,32 @@ static int edge_startup(struct usb_serial *serial)
 				response = -ENODEV;
 			}
 
-			usb_free_urb(edge_serial->interrupt_read_urb);
-			kfree(edge_serial->interrupt_in_buffer);
-
-			usb_free_urb(edge_serial->read_urb);
-			kfree(edge_serial->bulk_in_buffer);
-
-			kfree(edge_serial);
-
-			return response;
+			goto error;
 		}
 
 		/* start interrupt read for this edgeport this interrupt will
 		 * continue as long as the edgeport is connected */
 		response = usb_submit_urb(edge_serial->interrupt_read_urb,
 								GFP_KERNEL);
-		if (response)
+		if (response) {
 			dev_err(ddev, "%s - Error %d submitting control urb\n",
 				__func__, response);
+
+			goto error;
+		}
 	}
 	return response;
+
+error:
+	usb_free_urb(edge_serial->interrupt_read_urb);
+	kfree(edge_serial->interrupt_in_buffer);
+
+	usb_free_urb(edge_serial->read_urb);
+	kfree(edge_serial->bulk_in_buffer);
+
+	kfree(edge_serial);
+
+	return response;
 }
 
 

From 40a4558fc505108aa30c02bc852dd18b9292e40f Mon Sep 17 00:00:00 2001
From: Niv Sardi <xaiki@evilgiggle.com>
Date: Mon, 1 Mar 2021 17:16:12 -0300
Subject: [PATCH 1687/2658] USB: serial: ch341: add new Product ID

commit 5563b3b6420362c8a1f468ca04afe6d5f0a8d0a3 upstream.

Add PID for CH340 that's found on cheap programmers.

The driver works flawlessly as soon as the new PID (0x9986) is added to it.
These look like ANU232MI but ship with a ch341 inside. They have no special
identifiers (mine only has the string "DB9D20130716" printed on the PCB and
nothing identifiable on the packaging. The merchant i bought it from
doesn't sell these anymore).

the lsusb -v output is:
Bus 001 Device 009: ID 9986:7523
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               1.10
  bDeviceClass          255 Vendor Specific Class
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0         8
  idVendor           0x9986
  idProduct          0x7523
  bcdDevice            2.54
  iManufacturer           0
  iProduct                0
  iSerial                 0
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x0027
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0
    bmAttributes         0x80
      (Bus Powered)
    MaxPower               96mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass      1
      bInterfaceProtocol      2
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0020  1x 32 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0020  1x 32 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0008  1x 8 bytes
        bInterval               1

Signed-off-by: Niv Sardi <xaiki@evilgiggle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/ch341.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index c3d82cabbe65..2cff9c40f28a 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -75,6 +75,7 @@ static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(0x1a86, 0x7522) },
 	{ USB_DEVICE(0x1a86, 0x7523) },
 	{ USB_DEVICE(0x4348, 0x5523) },
+	{ USB_DEVICE(0x9986, 0x7523) },
 	{ },
 };
 MODULE_DEVICE_TABLE(usb, id_table);

From 8d75cdea64e414542b047ca888e2f588182521c0 Mon Sep 17 00:00:00 2001
From: Karan Singhal <karan.singhal@acuitybrands.com>
Date: Tue, 16 Feb 2021 11:03:10 -0500
Subject: [PATCH 1688/2658] USB: serial: cp210x: add ID for Acuity Brands
 nLight Air Adapter

commit ca667a33207daeaf9c62b106815728718def60ec upstream.

IDs of nLight Air Adapter, Acuity Brands, Inc.:
vid: 10c4
pid: 88d8

Signed-off-by: Karan Singhal <karan.singhal@acuitybrands.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/cp210x.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index ded4c8f2bba4..b91e6099ddec 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -142,6 +142,7 @@ static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(0x10C4, 0x8857) },	/* CEL EM357 ZigBee USB Stick */
 	{ USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
 	{ USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
+	{ USB_DEVICE(0x10C4, 0x88D8) }, /* Acuity Brands nLight Air Adapter */
 	{ USB_DEVICE(0x10C4, 0x88FB) }, /* CESINEL MEDCAL STII Network Analyzer */
 	{ USB_DEVICE(0x10C4, 0x8938) }, /* CESINEL MEDCAL S II Network Analyzer */
 	{ USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */

From eb877de65b7c54a6d775f7263088ab7bf175413f Mon Sep 17 00:00:00 2001
From: Sebastian Reichel <sebastian.reichel@collabora.com>
Date: Tue, 23 Feb 2021 17:44:18 +0100
Subject: [PATCH 1689/2658] USB: serial: cp210x: add some more GE USB IDs

commit 42213a0190b535093a604945db05a4225bf43885 upstream.

GE CS1000 has some more custom USB IDs for CP2102N; add them
to the driver to have working auto-probing.

Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/cp210x.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index b91e6099ddec..91462ff9a99d 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -199,6 +199,8 @@ static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(0x1901, 0x0194) },	/* GE Healthcare Remote Alarm Box */
 	{ USB_DEVICE(0x1901, 0x0195) },	/* GE B850/B650/B450 CP2104 DP UART interface */
 	{ USB_DEVICE(0x1901, 0x0196) },	/* GE B850 CP2105 DP UART interface */
+	{ USB_DEVICE(0x1901, 0x0197) }, /* GE CS1000 Display serial interface */
+	{ USB_DEVICE(0x1901, 0x0198) }, /* GE CS1000 M.2 Key E serial interface */
 	{ USB_DEVICE(0x199B, 0xBA30) }, /* LORD WSDA-200-USB */
 	{ USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */
 	{ USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */

From ecde97afa31c11b38f308fbe72febccf344377f9 Mon Sep 17 00:00:00 2001
From: Shuah Khan <skhan@linuxfoundation.org>
Date: Sun, 7 Mar 2021 20:53:26 -0700
Subject: [PATCH 1690/2658] usbip: fix stub_dev to check for stream socket

commit 47ccc8fc2c9c94558b27b6f9e2582df32d29e6e8 upstream.

Fix usbip_sockfd_store() to validate the passed in file descriptor is
a stream socket. If the file descriptor passed was a SOCK_DGRAM socket,
sock_recvmsg() can't detect end of stream.

Cc: stable@vger.kernel.org
Suggested-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/e942d2bd03afb8e8552bd2a5d84e18d17670d521.1615171203.git.skhan@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/usbip/stub_dev.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
index 4aad99a59958..1f2c55588c8d 100644
--- a/drivers/usb/usbip/stub_dev.c
+++ b/drivers/usb/usbip/stub_dev.c
@@ -83,8 +83,16 @@ static ssize_t store_sockfd(struct device *dev, struct device_attribute *attr,
 		}
 
 		socket = sockfd_lookup(sockfd, &err);
-		if (!socket)
+		if (!socket) {
+			dev_err(dev, "failed to lookup sock");
 			goto err;
+		}
+
+		if (socket->type != SOCK_STREAM) {
+			dev_err(dev, "Expecting SOCK_STREAM - found %d",
+				socket->type);
+			goto sock_err;
+		}
 
 		sdev->ud.tcp_socket = socket;
 		sdev->ud.sockfd = sockfd;
@@ -114,6 +122,8 @@ static ssize_t store_sockfd(struct device *dev, struct device_attribute *attr,
 
 	return count;
 
+sock_err:
+	sockfd_put(socket);
 err:
 	spin_unlock_irq(&sdev->ud.lock);
 	return -EINVAL;

From c37157291fb1a2fb00bd82abe42174a114240a96 Mon Sep 17 00:00:00 2001
From: Shuah Khan <skhan@linuxfoundation.org>
Date: Sun, 7 Mar 2021 20:53:27 -0700
Subject: [PATCH 1691/2658] usbip: fix vhci_hcd to check for stream socket

commit f55a0571690c4aae03180e001522538c0927432f upstream.

Fix attach_store() to validate the passed in file descriptor is a
stream socket. If the file descriptor passed was a SOCK_DGRAM socket,
sock_recvmsg() can't detect end of stream.

Cc: stable@vger.kernel.org
Suggested-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/52712aa308915bda02cece1589e04ee8b401d1f3.1615171203.git.skhan@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/usbip/vhci_sysfs.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c
index b9432fdec775..1d681990b398 100644
--- a/drivers/usb/usbip/vhci_sysfs.c
+++ b/drivers/usb/usbip/vhci_sysfs.c
@@ -202,8 +202,16 @@ static ssize_t store_attach(struct device *dev, struct device_attribute *attr,
 
 	/* Extract socket from fd. */
 	socket = sockfd_lookup(sockfd, &err);
-	if (!socket)
+	if (!socket) {
+		dev_err(dev, "failed to lookup sock");
 		return -EINVAL;
+	}
+	if (socket->type != SOCK_STREAM) {
+		dev_err(dev, "Expecting SOCK_STREAM - found %d",
+			socket->type);
+		sockfd_put(socket);
+		return -EINVAL;
+	}
 
 	/* now need lock until setting vdev status as used */
 

From e1759e88e5dc7094524ba29038a90f13e1e8d718 Mon Sep 17 00:00:00 2001
From: Shuah Khan <skhan@linuxfoundation.org>
Date: Sun, 7 Mar 2021 20:53:29 -0700
Subject: [PATCH 1692/2658] usbip: fix stub_dev usbip_sockfd_store() races
 leading to gpf

commit 9380afd6df70e24eacbdbde33afc6a3950965d22 upstream.

usbip_sockfd_store() is invoked when user requests attach (import)
detach (unimport) usb device from usbip host. vhci_hcd sends import
request and usbip_sockfd_store() exports the device if it is free
for export.

Export and unexport are governed by local state and shared state
- Shared state (usbip device status, sockfd) - sockfd and Device
  status are used to determine if stub should be brought up or shut
  down.
- Local state (tcp_socket, rx and tx thread task_struct ptrs)
  A valid tcp_socket controls rx and tx thread operations while the
  device is in exported state.
- While the device is exported, device status is marked used and socket,
  sockfd, and thread pointers are valid.

Export sequence (stub-up) includes validating the socket and creating
receive (rx) and transmit (tx) threads to talk to the client to provide
access to the exported device. rx and tx threads depends on local and
shared state to be correct and in sync.

Unexport (stub-down) sequence shuts the socket down and stops the rx and
tx threads. Stub-down sequence relies on local and shared states to be
in sync.

There are races in updating the local and shared status in the current
stub-up sequence resulting in crashes. These stem from starting rx and
tx threads before local and global state is updated correctly to be in
sync.

1. Doesn't handle kthread_create() error and saves invalid ptr in local
   state that drives rx and tx threads.
2. Updates tcp_socket and sockfd,  starts stub_rx and stub_tx threads
   before updating usbip_device status to SDEV_ST_USED. This opens up a
   race condition between the threads and usbip_sockfd_store() stub up
   and down handling.

Fix the above problems:
- Stop using kthread_get_run() macro to create/start threads.
- Create threads and get task struct reference.
- Add kthread_create() failure handling and bail out.
- Hold usbip_device lock to update local and shared states after
  creating rx and tx threads.
- Update usbip_device status to SDEV_ST_USED.
- Update usbip_device tcp_socket, sockfd, tcp_rx, and tcp_tx
- Start threads after usbip_device (tcp_socket, sockfd, tcp_rx, tcp_tx,
  and status) is complete.

Credit goes to syzbot and Tetsuo Handa for finding and root-causing the
kthread_get_run() improper error handling problem and others. This is a
hard problem to find and debug since the races aren't seen in a normal
case. Fuzzing forces the race window to be small enough for the
kthread_get_run() error path bug and starting threads before updating the
local and shared state bug in the stub-up sequence.

Tested with syzbot reproducer:
- https://syzkaller.appspot.com/text?tag=ReproC&x=14801034d00000

Fixes: 9720b4bc76a83807 ("staging/usbip: convert to kthread")
Cc: stable@vger.kernel.org
Reported-by: syzbot <syzbot+a93fba6d384346a761e3@syzkaller.appspotmail.com>
Reported-by: syzbot <syzbot+bf1a360e305ee719e364@syzkaller.appspotmail.com>
Reported-by: syzbot <syzbot+95ce4b142579611ef0a9@syzkaller.appspotmail.com>
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/268a0668144d5ff36ec7d87fdfa90faf583b7ccc.1615171203.git.skhan@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/usbip/stub_dev.c | 32 +++++++++++++++++++++++++-------
 1 file changed, 25 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
index 1f2c55588c8d..5501eb89f395 100644
--- a/drivers/usb/usbip/stub_dev.c
+++ b/drivers/usb/usbip/stub_dev.c
@@ -60,6 +60,8 @@ static ssize_t store_sockfd(struct device *dev, struct device_attribute *attr,
 	int sockfd = 0;
 	struct socket *socket;
 	int rv;
+	struct task_struct *tcp_rx = NULL;
+	struct task_struct *tcp_tx = NULL;
 
 	if (!sdev) {
 		dev_err(dev, "sdev is null\n");
@@ -94,20 +96,36 @@ static ssize_t store_sockfd(struct device *dev, struct device_attribute *attr,
 			goto sock_err;
 		}
 
-		sdev->ud.tcp_socket = socket;
-		sdev->ud.sockfd = sockfd;
-
+		/* unlock and create threads and get tasks */
 		spin_unlock_irq(&sdev->ud.lock);
+		tcp_rx = kthread_create(stub_rx_loop, &sdev->ud, "stub_rx");
+		if (IS_ERR(tcp_rx)) {
+			sockfd_put(socket);
+			return -EINVAL;
+		}
+		tcp_tx = kthread_create(stub_tx_loop, &sdev->ud, "stub_tx");
+		if (IS_ERR(tcp_tx)) {
+			kthread_stop(tcp_rx);
+			sockfd_put(socket);
+			return -EINVAL;
+		}
 
-		sdev->ud.tcp_rx = kthread_get_run(stub_rx_loop, &sdev->ud,
-						  "stub_rx");
-		sdev->ud.tcp_tx = kthread_get_run(stub_tx_loop, &sdev->ud,
-						  "stub_tx");
+		/* get task structs now */
+		get_task_struct(tcp_rx);
+		get_task_struct(tcp_tx);
 
+		/* lock and update sdev->ud state */
 		spin_lock_irq(&sdev->ud.lock);
+		sdev->ud.tcp_socket = socket;
+		sdev->ud.sockfd = sockfd;
+		sdev->ud.tcp_rx = tcp_rx;
+		sdev->ud.tcp_tx = tcp_tx;
 		sdev->ud.status = SDEV_ST_USED;
 		spin_unlock_irq(&sdev->ud.lock);
 
+		wake_up_process(sdev->ud.tcp_rx);
+		wake_up_process(sdev->ud.tcp_tx);
+
 	} else {
 		dev_info(dev, "stub down\n");
 

From dd1a1c1b19b548092ae88d2086f435326d61867f Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 5 Mar 2021 11:12:49 +0300
Subject: [PATCH 1693/2658] staging: rtl8192u: fix ->ssid overflow in
 r8192_wx_set_scan()

commit 87107518d7a93fec6cdb2559588862afeee800fb upstream.

We need to cap len at IW_ESSID_MAX_SIZE (32) to avoid memory corruption.
This can be controlled by the user via the ioctl.

Fixes: 5f53d8ca3d5d ("Staging: add rtl8192SU wireless usb driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/YEHoAWMOSZBUw91F@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/rtl8192u/r8192U_wx.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/rtl8192u/r8192U_wx.c b/drivers/staging/rtl8192u/r8192U_wx.c
index 4911fef2e2e5..8fb194075149 100644
--- a/drivers/staging/rtl8192u/r8192U_wx.c
+++ b/drivers/staging/rtl8192u/r8192U_wx.c
@@ -341,8 +341,10 @@ static int r8192_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
 		struct iw_scan_req *req = (struct iw_scan_req *)b;
 
 		if (req->essid_len) {
-			ieee->current_network.ssid_len = req->essid_len;
-			memcpy(ieee->current_network.ssid, req->essid, req->essid_len);
+			int len = min_t(int, req->essid_len, IW_ESSID_MAX_SIZE);
+
+			ieee->current_network.ssid_len = len;
+			memcpy(ieee->current_network.ssid, req->essid, len);
 		}
 	}
 

From 5b6c3ee93d61f503344144f7ad4e52e5e0d62e71 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 5 Mar 2021 11:58:03 +0300
Subject: [PATCH 1694/2658] staging: rtl8188eu: prevent ->ssid overflow in
 rtw_wx_set_scan()

commit 74b6b20df8cfe90ada777d621b54c32e69e27cd7 upstream.

This code has a check to prevent read overflow but it needs another
check to prevent writing beyond the end of the ->ssid[] array.

Fixes: a2c60d42d97c ("staging: r8188eu: Add files for new driver - part 16")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/YEHymwsnHewzoam7@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/rtl8188eu/os_dep/ioctl_linux.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
index 2a6192e08b75..c29dc9182470 100644
--- a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
@@ -1174,9 +1174,11 @@ static int rtw_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
 						break;
 					}
 					sec_len = *(pos++); len -= 1;
-					if (sec_len > 0 && sec_len <= len) {
+					if (sec_len > 0 &&
+					    sec_len <= len &&
+					    sec_len <= 32) {
 						ssid[ssid_index].SsidLength = sec_len;
-						memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength);
+						memcpy(ssid[ssid_index].Ssid, pos, sec_len);
 						ssid_index++;
 					}
 					pos += sec_len;

From d5b563613edde02c269bcf06dca1516a3e563182 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 24 Feb 2021 11:45:59 +0300
Subject: [PATCH 1695/2658] staging: rtl8712: unterminated string leads to read
 overflow

commit d660f4f42ccea50262c6ee90c8e7ad19a69fb225 upstream.

The memdup_user() function does not necessarily return a NUL terminated
string so this can lead to a read overflow.  Switch from memdup_user()
to strndup_user() to fix this bug.

Fixes: c6dc001f2add ("staging: r8712u: Merging Realtek's latest (v2.6.6). Various fixes.")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YDYSR+1rj26NRhvb@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/rtl8712/rtl871x_ioctl_linux.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
index 2b348439242f..20052fa2eedf 100644
--- a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
+++ b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
@@ -935,7 +935,7 @@ static int r871x_wx_set_priv(struct net_device *dev,
 	struct iw_point *dwrq = (struct iw_point *)awrq;
 
 	len = dwrq->length;
-	ext = memdup_user(dwrq->pointer, len);
+	ext = strndup_user(dwrq->pointer, len);
 	if (IS_ERR(ext))
 		return PTR_ERR(ext);
 

From b7e41bc41466b32125d507b0f11fca24e252d167 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 5 Mar 2021 11:56:32 +0300
Subject: [PATCH 1696/2658] staging: rtl8188eu: fix potential memory corruption
 in rtw_check_beacon_data()

commit d4ac640322b06095128a5c45ba4a1e80929fe7f3 upstream.

The "ie_len" is a value in the 1-255 range that comes from the user.  We
have to cap it to ensure that it's not too large or it could lead to
memory corruption.

Fixes: 9a7fe54ddc3a ("staging: r8188eu: Add source files for new driver - part 1")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/YEHyQCrFZKTXyT7J@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/rtl8188eu/core/rtw_ap.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/staging/rtl8188eu/core/rtw_ap.c b/drivers/staging/rtl8188eu/core/rtw_ap.c
index f5cedbbc552a..d14a2313fcce 100644
--- a/drivers/staging/rtl8188eu/core/rtw_ap.c
+++ b/drivers/staging/rtl8188eu/core/rtw_ap.c
@@ -921,6 +921,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf,  int len)
 	/* SSID */
 	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _SSID_IE_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_));
 	if (p && ie_len > 0) {
+		ie_len = min_t(int, ie_len, sizeof(pbss_network->Ssid.Ssid));
 		memset(&pbss_network->Ssid, 0, sizeof(struct ndis_802_11_ssid));
 		memcpy(pbss_network->Ssid.Ssid, (p + 2), ie_len);
 		pbss_network->Ssid.SsidLength = ie_len;
@@ -939,6 +940,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf,  int len)
 	/*  get supported rates */
 	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _SUPPORTEDRATES_IE_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_));
 	if (p !=  NULL) {
+		ie_len = min_t(int, ie_len, NDIS_802_11_LENGTH_RATES_EX);
 		memcpy(supportRate, p+2, ie_len);
 		supportRateNum = ie_len;
 	}
@@ -946,6 +948,8 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf,  int len)
 	/* get ext_supported rates */
 	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _EXT_SUPPORTEDRATES_IE_, &ie_len, pbss_network->IELength - _BEACON_IE_OFFSET_);
 	if (p !=  NULL) {
+		ie_len = min_t(int, ie_len,
+			       NDIS_802_11_LENGTH_RATES_EX - supportRateNum);
 		memcpy(supportRate+supportRateNum, p+2, ie_len);
 		supportRateNum += ie_len;
 	}
@@ -1061,6 +1065,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf,  int len)
 			pht_cap->supp_mcs_set[0] = 0xff;
 			pht_cap->supp_mcs_set[1] = 0x0;
 		}
+		ie_len = min_t(int, ie_len, sizeof(pmlmepriv->htpriv.ht_cap));
 		memcpy(&pmlmepriv->htpriv.ht_cap, p+2, ie_len);
 	}
 

From a09686e1cbe343dadacdbbe94ecdbb4317ac753a Mon Sep 17 00:00:00 2001
From: Lee Gibson <leegib@gmail.com>
Date: Mon, 1 Mar 2021 13:26:48 +0000
Subject: [PATCH 1697/2658] staging: rtl8712: Fix possible buffer overflow in
 r8712_sitesurvey_cmd

commit b93c1e3981af19527beee1c10a2bef67a228c48c upstream.

Function r8712_sitesurvey_cmd calls memcpy without checking the length.
A user could control that length and trigger a buffer overflow.
Fix by checking the length is within the maximum allowed size.

Signed-off-by: Lee Gibson <leegib@gmail.com>
Link: https://lore.kernel.org/r/20210301132648.420296-1-leegib@gmail.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/rtl8712/rtl871x_cmd.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/rtl8712/rtl871x_cmd.c b/drivers/staging/rtl8712/rtl871x_cmd.c
index 562a10203127..b4eb6af4e565 100644
--- a/drivers/staging/rtl8712/rtl871x_cmd.c
+++ b/drivers/staging/rtl8712/rtl871x_cmd.c
@@ -242,8 +242,10 @@ u8 r8712_sitesurvey_cmd(struct _adapter *padapter,
 	psurveyPara->ss_ssidlen = 0;
 	memset(psurveyPara->ss_ssid, 0, IW_ESSID_MAX_SIZE + 1);
 	if ((pssid != NULL) && (pssid->SsidLength)) {
-		memcpy(psurveyPara->ss_ssid, pssid->Ssid, pssid->SsidLength);
-		psurveyPara->ss_ssidlen = cpu_to_le32(pssid->SsidLength);
+		int len = min_t(int, pssid->SsidLength, IW_ESSID_MAX_SIZE);
+
+		memcpy(psurveyPara->ss_ssid, pssid->Ssid, len);
+		psurveyPara->ss_ssidlen = cpu_to_le32(len);
 	}
 	set_fwstate(pmlmepriv, _FW_UNDER_SURVEY);
 	r8712_enqueue_cmd(pcmdpriv, ph2c);

From 4f5e154f28c339ac99998f905de4515ff524563b Mon Sep 17 00:00:00 2001
From: Lee Gibson <leegib@gmail.com>
Date: Fri, 26 Feb 2021 14:51:57 +0000
Subject: [PATCH 1698/2658] staging: rtl8192e: Fix possible buffer overflow in
 _rtl92e_wx_set_scan

commit 8687bf9ef9551bcf93897e33364d121667b1aadf upstream.

Function _rtl92e_wx_set_scan calls memcpy without checking the length.
A user could control that length and trigger a buffer overflow.
Fix by checking the length is within the maximum allowed size.

Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lee Gibson <leegib@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210226145157.424065-1-leegib@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/rtl8192e/rtl8192e/rtl_wx.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c b/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c
index 70df6a1485d6..6f0be1db6fb1 100644
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c
@@ -419,9 +419,10 @@ static int _rtl92e_wx_set_scan(struct net_device *dev,
 		struct iw_scan_req *req = (struct iw_scan_req *)b;
 
 		if (req->essid_len) {
-			ieee->current_network.ssid_len = req->essid_len;
-			memcpy(ieee->current_network.ssid, req->essid,
-			       req->essid_len);
+			int len = min_t(int, req->essid_len, IW_ESSID_MAX_SIZE);
+
+			ieee->current_network.ssid_len = len;
+			memcpy(ieee->current_network.ssid, req->essid, len);
 		}
 	}
 

From 1682d16aae999f9e0b3423d89360022337c7f8e5 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Tue, 23 Feb 2021 14:30:42 +0000
Subject: [PATCH 1699/2658] staging: comedi: addi_apci_1032: Fix endian problem
 for COS sample

commit 25317f428a78fde71b2bf3f24d05850f08a73a52 upstream.

The Change-Of-State (COS) subdevice supports Comedi asynchronous
commands to read 16-bit change-of-state values.  However, the interrupt
handler is calling `comedi_buf_write_samples()` with the address of a
32-bit integer `&s->state`.  On bigendian architectures, it will copy 2
bytes from the wrong end of the 32-bit integer.  Fix it by transferring
the value via a 16-bit integer.

Fixes: 6bb45f2b0c86 ("staging: comedi: addi_apci_1032: use comedi_buf_write_samples()")
Cc: <stable@vger.kernel.org> # 3.19+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20210223143055.257402-2-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/addi_apci_1032.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/addi_apci_1032.c b/drivers/staging/comedi/drivers/addi_apci_1032.c
index 536a135cd00b..9058ef473c33 100644
--- a/drivers/staging/comedi/drivers/addi_apci_1032.c
+++ b/drivers/staging/comedi/drivers/addi_apci_1032.c
@@ -269,6 +269,7 @@ static irqreturn_t apci1032_interrupt(int irq, void *d)
 	struct apci1032_private *devpriv = dev->private;
 	struct comedi_subdevice *s = dev->read_subdev;
 	unsigned int ctrl;
+	unsigned short val;
 
 	/* check interrupt is from this device */
 	if ((inl(devpriv->amcc_iobase + AMCC_OP_REG_INTCSR) &
@@ -284,7 +285,8 @@ static irqreturn_t apci1032_interrupt(int irq, void *d)
 	outl(ctrl & ~APCI1032_CTRL_INT_ENA, dev->iobase + APCI1032_CTRL_REG);
 
 	s->state = inl(dev->iobase + APCI1032_STATUS_REG) & 0xffff;
-	comedi_buf_write_samples(s, &s->state, 1);
+	val = s->state;
+	comedi_buf_write_samples(s, &val, 1);
 	comedi_handle_events(dev, s);
 
 	/* enable the interrupt */

From def92a7707631d9f3e8535f85799bc66f65006ac Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Tue, 23 Feb 2021 14:30:43 +0000
Subject: [PATCH 1700/2658] staging: comedi: addi_apci_1500: Fix endian problem
 for command sample

commit ac0bbf55ed3be75fde1f8907e91ecd2fd589bde3 upstream.

The digital input subdevice supports Comedi asynchronous commands that
read interrupt status information.  This uses 16-bit Comedi samples (of
which only the bottom 8 bits contain status information).  However, the
interrupt handler is calling `comedi_buf_write_samples()` with the
address of a 32-bit variable `unsigned int status`.  On a bigendian
machine, this will copy 2 bytes from the wrong end of the variable.  Fix
it by changing the type of the variable to `unsigned short`.

Fixes: a8c66b684efa ("staging: comedi: addi_apci_1500: rewrite the subdevice support functions")
Cc: <stable@vger.kernel.org> #4.0+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20210223143055.257402-3-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../staging/comedi/drivers/addi_apci_1500.c    | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c
index c4e36fb6df9d..1f25f565041c 100644
--- a/drivers/staging/comedi/drivers/addi_apci_1500.c
+++ b/drivers/staging/comedi/drivers/addi_apci_1500.c
@@ -217,7 +217,7 @@ static irqreturn_t apci1500_interrupt(int irq, void *d)
 	struct comedi_device *dev = d;
 	struct apci1500_private *devpriv = dev->private;
 	struct comedi_subdevice *s = dev->read_subdev;
-	unsigned int status = 0;
+	unsigned short status = 0;
 	unsigned int val;
 
 	val = inl(devpriv->amcc + AMCC_OP_REG_INTCSR);
@@ -247,14 +247,14 @@ static irqreturn_t apci1500_interrupt(int irq, void *d)
 	 *
 	 *    Mask     Meaning
 	 * ----------  ------------------------------------------
-	 * 0x00000001  Event 1 has occurred
-	 * 0x00000010  Event 2 has occurred
-	 * 0x00000100  Counter/timer 1 has run down (not implemented)
-	 * 0x00001000  Counter/timer 2 has run down (not implemented)
-	 * 0x00010000  Counter 3 has run down (not implemented)
-	 * 0x00100000  Watchdog has run down (not implemented)
-	 * 0x01000000  Voltage error
-	 * 0x10000000  Short-circuit error
+	 * 0b00000001  Event 1 has occurred
+	 * 0b00000010  Event 2 has occurred
+	 * 0b00000100  Counter/timer 1 has run down (not implemented)
+	 * 0b00001000  Counter/timer 2 has run down (not implemented)
+	 * 0b00010000  Counter 3 has run down (not implemented)
+	 * 0b00100000  Watchdog has run down (not implemented)
+	 * 0b01000000  Voltage error
+	 * 0b10000000  Short-circuit error
 	 */
 	comedi_buf_write_samples(s, &status, 1);
 	comedi_handle_events(dev, s);

From d09af6f44e88d62cdc80aa12c85e4dae1645d110 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Tue, 23 Feb 2021 14:30:44 +0000
Subject: [PATCH 1701/2658] staging: comedi: adv_pci1710: Fix endian problem
 for AI command data

commit b2e78630f733a76508b53ba680528ca39c890e82 upstream.

The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format.  However, the calls to
`comedi_buf_write_samples()` are passing the address of a 32-bit integer
variable.  On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value.  Fix it by changing the type of the variables
holding the sample value to `unsigned short`.  The type of the `val`
parameter of `pci1710_ai_read_sample()` is changed to `unsigned short *`
accordingly.  The type of the `val` variable in `pci1710_ai_insn_read()`
is also changed to `unsigned short` since its address is passed to
`pci1710_ai_read_sample()`.

Fixes: a9c3a015c12f ("staging: comedi: adv_pci1710: use comedi_buf_write_samples()")
Cc: <stable@vger.kernel.org> # 4.0+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20210223143055.257402-4-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/adv_pci1710.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c
index 399c511cfe0a..8599258f8c8d 100644
--- a/drivers/staging/comedi/drivers/adv_pci1710.c
+++ b/drivers/staging/comedi/drivers/adv_pci1710.c
@@ -351,11 +351,11 @@ static int pci171x_ai_eoc(struct comedi_device *dev,
 static int pci171x_ai_read_sample(struct comedi_device *dev,
 				  struct comedi_subdevice *s,
 				  unsigned int cur_chan,
-				  unsigned int *val)
+				  unsigned short *val)
 {
 	const struct boardtype *board = dev->board_ptr;
 	struct pci1710_private *devpriv = dev->private;
-	unsigned int sample;
+	unsigned short sample;
 	unsigned int chan;
 
 	sample = inw(dev->iobase + PCI171X_AD_DATA_REG);
@@ -395,7 +395,7 @@ static int pci171x_ai_insn_read(struct comedi_device *dev,
 	pci171x_ai_setup_chanlist(dev, s, &insn->chanspec, 1, 1);
 
 	for (i = 0; i < insn->n; i++) {
-		unsigned int val;
+		unsigned short val;
 
 		/* start conversion */
 		outw(0, dev->iobase + PCI171X_SOFTTRG_REG);
@@ -516,7 +516,7 @@ static void pci1710_handle_every_sample(struct comedi_device *dev,
 {
 	struct comedi_cmd *cmd = &s->async->cmd;
 	unsigned int status;
-	unsigned int val;
+	unsigned short val;
 	int ret;
 
 	status = inw(dev->iobase + PCI171X_STATUS_REG);
@@ -576,7 +576,7 @@ static void pci1710_handle_fifo(struct comedi_device *dev,
 	}
 
 	for (i = 0; i < devpriv->max_samples; i++) {
-		unsigned int val;
+		unsigned short val;
 		int ret;
 
 		ret = pci171x_ai_read_sample(dev, s, s->async->cur_chan, &val);

From 560ea2f2fbcffa9efdbfbb2c2b62c33ec846f653 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Tue, 23 Feb 2021 14:30:45 +0000
Subject: [PATCH 1702/2658] staging: comedi: das6402: Fix endian problem for AI
 command data

commit 1c0f20b78781b9ca50dc3ecfd396d0db5b141890 upstream.

The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format.  However, the call to
`comedi_buf_write_samples()` is passing the address of a 32-bit integer
variable.  On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value.  Fix it by changing the type of the variable
holding the sample value to `unsigned short`.

Fixes: d1d24cb65ee3 ("staging: comedi: das6402: read analog input samples in interrupt handler")
Cc: <stable@vger.kernel.org> # 3.19+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20210223143055.257402-5-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/das6402.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/das6402.c b/drivers/staging/comedi/drivers/das6402.c
index 1701294b79cd..666d199983ba 100644
--- a/drivers/staging/comedi/drivers/das6402.c
+++ b/drivers/staging/comedi/drivers/das6402.c
@@ -193,7 +193,7 @@ static irqreturn_t das6402_interrupt(int irq, void *d)
 	if (status & DAS6402_STATUS_FFULL) {
 		async->events |= COMEDI_CB_OVERFLOW;
 	} else if (status & DAS6402_STATUS_FFNE) {
-		unsigned int val;
+		unsigned short val;
 
 		val = das6402_ai_read_sample(dev, s);
 		comedi_buf_write_samples(s, &val, 1);

From 9b1e638bce53a35e6911508e77f04c48c243c0c1 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Tue, 23 Feb 2021 14:30:46 +0000
Subject: [PATCH 1703/2658] staging: comedi: das800: Fix endian problem for AI
 command data

commit 459b1e8c8fe97fcba0bd1b623471713dce2c5eaf upstream.

The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format.  However, the call to
`comedi_buf_write_samples()` is passing the address of a 32-bit integer
variable.  On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value.  Fix it by changing the type of the variable
holding the sample value to `unsigned short`.

Fixes: ad9eb43c93d8 ("staging: comedi: das800: use comedi_buf_write_samples()")
Cc: <stable@vger.kernel.org> # 3.19+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20210223143055.257402-6-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/das800.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/das800.c b/drivers/staging/comedi/drivers/das800.c
index b02f12201cf7..91a0c4ec7fdb 100644
--- a/drivers/staging/comedi/drivers/das800.c
+++ b/drivers/staging/comedi/drivers/das800.c
@@ -436,7 +436,7 @@ static irqreturn_t das800_interrupt(int irq, void *d)
 	struct comedi_cmd *cmd;
 	unsigned long irq_flags;
 	unsigned int status;
-	unsigned int val;
+	unsigned short val;
 	bool fifo_empty;
 	bool fifo_overflow;
 	int i;

From 8af675969a28b2bc543c934a1c24164da0100f22 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Tue, 23 Feb 2021 14:30:47 +0000
Subject: [PATCH 1704/2658] staging: comedi: dmm32at: Fix endian problem for AI
 command data

commit 54999c0d94b3c26625f896f8e3460bc029821578 upstream.

The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format.  However, the call to
`comedi_buf_write_samples()` is passing the address of a 32-bit integer
variable.  On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value.  Fix it by changing the type of the variable
holding the sample value to `unsigned short`.

[Note: the bug was introduced in commit 1700529b24cc ("staging: comedi:
dmm32at: use comedi_buf_write_samples()") but the patch applies better
to the later (but in the same kernel release) commit 0c0eadadcbe6e
("staging: comedi: dmm32at: introduce dmm32_ai_get_sample()").]

Fixes: 0c0eadadcbe6e ("staging: comedi: dmm32at: introduce dmm32_ai_get_sample()")
Cc: <stable@vger.kernel.org> # 3.19+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20210223143055.257402-7-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/dmm32at.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/dmm32at.c b/drivers/staging/comedi/drivers/dmm32at.c
index 958c0d4aae5c..48645ecde810 100644
--- a/drivers/staging/comedi/drivers/dmm32at.c
+++ b/drivers/staging/comedi/drivers/dmm32at.c
@@ -411,7 +411,7 @@ static irqreturn_t dmm32at_isr(int irq, void *d)
 {
 	struct comedi_device *dev = d;
 	unsigned char intstat;
-	unsigned int val;
+	unsigned short val;
 	int i;
 
 	if (!dev->attached) {

From 40f3798027d5c82829ed030554b4e21494d14c95 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Tue, 23 Feb 2021 14:30:48 +0000
Subject: [PATCH 1705/2658] staging: comedi: me4000: Fix endian problem for AI
 command data

commit b39dfcced399d31e7c4b7341693b18e01c8f655e upstream.

The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format.  However, the calls to
`comedi_buf_write_samples()` are passing the address of a 32-bit integer
variable.  On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value.  Fix it by changing the type of the variable
holding the sample value to `unsigned short`.

Fixes: de88924f67d1 ("staging: comedi: me4000: use comedi_buf_write_samples()")
Cc: <stable@vger.kernel.org> # 3.19+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20210223143055.257402-8-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/me4000.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/me4000.c b/drivers/staging/comedi/drivers/me4000.c
index 15a53204a36a..4fe856128870 100644
--- a/drivers/staging/comedi/drivers/me4000.c
+++ b/drivers/staging/comedi/drivers/me4000.c
@@ -933,7 +933,7 @@ static irqreturn_t me4000_ai_isr(int irq, void *dev_id)
 	struct comedi_subdevice *s = dev->read_subdev;
 	int i;
 	int c = 0;
-	unsigned int lval;
+	unsigned short lval;
 
 	if (!dev->attached)
 		return IRQ_NONE;

From 9dec719857ddaffbe0133f213e7b5998413ec505 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Tue, 23 Feb 2021 14:30:49 +0000
Subject: [PATCH 1706/2658] staging: comedi: pcl711: Fix endian problem for AI
 command data

commit a084303a645896e834883f2c5170d044410dfdb3 upstream.

The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format.  However, the call to
`comedi_buf_write_samples()` is passing the address of a 32-bit integer
variable.  On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value.  Fix it by changing the type of the variable
holding the sample value to `unsigned short`.

Fixes: 1f44c034de2e ("staging: comedi: pcl711: use comedi_buf_write_samples()")
Cc: <stable@vger.kernel.org> # 3.19+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20210223143055.257402-9-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/pcl711.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/pcl711.c b/drivers/staging/comedi/drivers/pcl711.c
index 3774daa9d661..e1334733abe7 100644
--- a/drivers/staging/comedi/drivers/pcl711.c
+++ b/drivers/staging/comedi/drivers/pcl711.c
@@ -193,7 +193,7 @@ static irqreturn_t pcl711_interrupt(int irq, void *d)
 	struct comedi_device *dev = d;
 	struct comedi_subdevice *s = dev->read_subdev;
 	struct comedi_cmd *cmd = &s->async->cmd;
-	unsigned int data;
+	unsigned short data;
 
 	if (!dev->attached) {
 		dev_err(dev->class_dev, "spurious interrupt\n");

From 1a3f3f965753e2d1e39f2d5e4b6942179aa38425 Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Tue, 23 Feb 2021 14:30:50 +0000
Subject: [PATCH 1707/2658] staging: comedi: pcl818: Fix endian problem for AI
 command data

commit 148e34fd33d53740642db523724226de14ee5281 upstream.

The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format.  However, the call to
`comedi_buf_write_samples()` is passing the address of a 32-bit integer
parameter.  On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value.  Fix it by changing the type of the parameter
holding the sample value to `unsigned short`.

[Note: the bug was introduced in commit edf4537bcbf5 ("staging: comedi:
pcl818: use comedi_buf_write_samples()") but the patch applies better to
commit d615416de615 ("staging: comedi: pcl818: introduce
pcl818_ai_write_sample()").]

Fixes: d615416de615 ("staging: comedi: pcl818: introduce pcl818_ai_write_sample()")
Cc: <stable@vger.kernel.org> # 4.0+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20210223143055.257402-10-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/pcl818.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/pcl818.c b/drivers/staging/comedi/drivers/pcl818.c
index 5aeed44dff70..f06241712308 100644
--- a/drivers/staging/comedi/drivers/pcl818.c
+++ b/drivers/staging/comedi/drivers/pcl818.c
@@ -422,7 +422,7 @@ static int pcl818_ai_eoc(struct comedi_device *dev,
 
 static bool pcl818_ai_write_sample(struct comedi_device *dev,
 				   struct comedi_subdevice *s,
-				   unsigned int chan, unsigned int val)
+				   unsigned int chan, unsigned short val)
 {
 	struct pcl818_private *devpriv = dev->private;
 	struct comedi_cmd *cmd = &s->async->cmd;

From 7095112671b56a48afdce51bfb4027ff9a651d50 Mon Sep 17 00:00:00 2001
From: Ondrej Mosnacek <omosnace@redhat.com>
Date: Fri, 15 Jan 2021 18:43:56 +0100
Subject: [PATCH 1708/2658] NFSv4.2: fix return value of
 _nfs4_get_security_label()

[ Upstream commit 53cb245454df5b13d7063162afd7a785aed6ebf2 ]

An xattr 'get' handler is expected to return the length of the value on
success, yet _nfs4_get_security_label() (and consequently also
nfs4_xattr_get_nfs4_label(), which is used as an xattr handler) returns
just 0 on success.

Fix this by returning label.len instead, which contains the length of
the result.

Fixes: aa9c2669626c ("NFS: Client implementation of Labeled-NFS")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: James Morris <jamorris@linux.microsoft.com>
Reviewed-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs4proc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 3c15291ba1aa..0c9386978d9d 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -4922,7 +4922,7 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf,
 		return ret;
 	if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL))
 		return -ENOENT;
-	return 0;
+	return label.len;
 }
 
 static int nfs4_get_security_label(struct inode *inode, void *buf,

From 15aac40075429e691aad2056a70f1cba67224439 Mon Sep 17 00:00:00 2001
From: Jia-Ju Bai <baijiaju1990@gmail.com>
Date: Tue, 9 Mar 2021 19:30:17 -0800
Subject: [PATCH 1709/2658] block: rsxx: fix error return code of
 rsxx_pci_probe()

[ Upstream commit df66617bfe87487190a60783d26175b65d2502ce ]

When create_singlethread_workqueue returns NULL to card->event_wq, no
error return code of rsxx_pci_probe() is assigned.

To fix this bug, st is assigned with -ENOMEM in this case.

Fixes: 8722ff8cdbfa ("block: IBM RamSan 70/80 device driver")
Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Link: https://lore.kernel.org/r/20210310033017.4023-1-baijiaju1990@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/rsxx/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c
index 0d9137408e3c..a53271acc2a2 100644
--- a/drivers/block/rsxx/core.c
+++ b/drivers/block/rsxx/core.c
@@ -895,6 +895,7 @@ static int rsxx_pci_probe(struct pci_dev *dev,
 	card->event_wq = create_singlethread_workqueue(DRIVER_NAME"_event");
 	if (!card->event_wq) {
 		dev_err(CARD_TO_DEV(card), "Failed card event setup.\n");
+		st = -ENOMEM;
 		goto failed_event_handler;
 	}
 

From 6311278723dca5f600b8633889453dcac87c2a6a Mon Sep 17 00:00:00 2001
From: Masahiro Yamada <yamada.masahiro@socionext.com>
Date: Sun, 11 Sep 2016 16:42:14 +0900
Subject: [PATCH 1710/2658] alpha: add $(src)/ rather than $(obj)/ to make
 source file path

commit 5ed78e5523fd9ba77b8444d380d54da1f88c53fc upstream.

$(ev6-y)divide.S is a source file, not a build-time generated file.
So, it should be prefixed with $(src)/ rather than $(obj)/.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/alpha/lib/Makefile | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/alpha/lib/Makefile b/arch/alpha/lib/Makefile
index 59660743237c..7b694fed382c 100644
--- a/arch/alpha/lib/Makefile
+++ b/arch/alpha/lib/Makefile
@@ -46,11 +46,11 @@ AFLAGS___remqu.o =       -DREM
 AFLAGS___divlu.o = -DDIV       -DINTSIZE
 AFLAGS___remlu.o =       -DREM -DINTSIZE
 
-$(obj)/__divqu.o: $(obj)/$(ev6-y)divide.S
+$(obj)/__divqu.o: $(src)/$(ev6-y)divide.S
 	$(cmd_as_o_S)
-$(obj)/__remqu.o: $(obj)/$(ev6-y)divide.S
+$(obj)/__remqu.o: $(src)/$(ev6-y)divide.S
 	$(cmd_as_o_S)
-$(obj)/__divlu.o: $(obj)/$(ev6-y)divide.S
+$(obj)/__divlu.o: $(src)/$(ev6-y)divide.S
 	$(cmd_as_o_S)
-$(obj)/__remlu.o: $(obj)/$(ev6-y)divide.S
+$(obj)/__remlu.o: $(src)/$(ev6-y)divide.S
 	$(cmd_as_o_S)

From c08604155c66855d841d8590842abc47b3632282 Mon Sep 17 00:00:00 2001
From: Masahiro Yamada <yamada.masahiro@socionext.com>
Date: Sun, 11 Sep 2016 16:42:15 +0900
Subject: [PATCH 1711/2658] alpha: merge build rules of division routines

commit e19a4e3f1bffe45b8e2ea67fcfb0c9c88278c4cc upstream.

These four objects are generated by the same build rule, with
different compile options.  The build rules can be merged.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/alpha/lib/Makefile | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/arch/alpha/lib/Makefile b/arch/alpha/lib/Makefile
index 7b694fed382c..5f12e9dcd623 100644
--- a/arch/alpha/lib/Makefile
+++ b/arch/alpha/lib/Makefile
@@ -46,11 +46,6 @@ AFLAGS___remqu.o =       -DREM
 AFLAGS___divlu.o = -DDIV       -DINTSIZE
 AFLAGS___remlu.o =       -DREM -DINTSIZE
 
-$(obj)/__divqu.o: $(src)/$(ev6-y)divide.S
-	$(cmd_as_o_S)
-$(obj)/__remqu.o: $(src)/$(ev6-y)divide.S
-	$(cmd_as_o_S)
-$(obj)/__divlu.o: $(src)/$(ev6-y)divide.S
-	$(cmd_as_o_S)
-$(obj)/__remlu.o: $(src)/$(ev6-y)divide.S
+$(addprefix $(obj)/,__divqu.o __remqu.o __divlu.o __remlu.o): \
+							$(src)/$(ev6-y)divide.S
 	$(cmd_as_o_S)

From 6cd3b2983b3d64fc01b0572a44419c2ef5ce99e2 Mon Sep 17 00:00:00 2001
From: Masahiro Yamada <yamada.masahiro@socionext.com>
Date: Sun, 11 Sep 2016 16:42:16 +0900
Subject: [PATCH 1712/2658] alpha: make short build log available for division
 routines

commit 3eec0291830e4c28d09f73bab247f3b59172022b upstream.

This enables the Kbuild standard log style as follows:

  AS      arch/alpha/lib/__divlu.o
  AS      arch/alpha/lib/__divqu.o
  AS      arch/alpha/lib/__remlu.o
  AS      arch/alpha/lib/__remqu.o

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/alpha/lib/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/alpha/lib/Makefile b/arch/alpha/lib/Makefile
index 5f12e9dcd623..7083434dd241 100644
--- a/arch/alpha/lib/Makefile
+++ b/arch/alpha/lib/Makefile
@@ -47,5 +47,5 @@ AFLAGS___divlu.o = -DDIV       -DINTSIZE
 AFLAGS___remlu.o =       -DREM -DINTSIZE
 
 $(addprefix $(obj)/,__divqu.o __remqu.o __divlu.o __remlu.o): \
-							$(src)/$(ev6-y)divide.S
-	$(cmd_as_o_S)
+						$(src)/$(ev6-y)divide.S FORCE
+	$(call if_changed_rule,as_o_S)

From 87876a5bcfe6435f12f69342923edb6cf832cca8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <rth@twiddle.net>
Date: Fri, 23 Jun 2017 14:20:00 -0700
Subject: [PATCH 1713/2658] alpha: Package string routines together

commit 4758ce82e66711b1a4557577e30a5f9b88d4a4b5 upstream.

There are direct branches between {str*cpy,str*cat} and stx*cpy.
Ensure the branches are within range by merging these objects.

Signed-off-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/alpha/lib/Makefile | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/arch/alpha/lib/Makefile b/arch/alpha/lib/Makefile
index 7083434dd241..a80815960364 100644
--- a/arch/alpha/lib/Makefile
+++ b/arch/alpha/lib/Makefile
@@ -20,12 +20,8 @@ lib-y =	__divqu.o __remqu.o __divlu.o __remlu.o \
 	checksum.o \
 	csum_partial_copy.o \
 	$(ev67-y)strlen.o \
-	$(ev67-y)strcat.o \
-	strcpy.o \
-	$(ev67-y)strncat.o \
-	strncpy.o \
-	$(ev6-y)stxcpy.o \
-	$(ev6-y)stxncpy.o \
+	stycpy.o \
+	styncpy.o \
 	$(ev67-y)strchr.o \
 	$(ev67-y)strrchr.o \
 	$(ev6-y)memchr.o \
@@ -49,3 +45,17 @@ AFLAGS___remlu.o =       -DREM -DINTSIZE
 $(addprefix $(obj)/,__divqu.o __remqu.o __divlu.o __remlu.o): \
 						$(src)/$(ev6-y)divide.S FORCE
 	$(call if_changed_rule,as_o_S)
+
+# There are direct branches between {str*cpy,str*cat} and stx*cpy.
+# Ensure the branches are within range by merging these objects.
+
+LDFLAGS_stycpy.o := -r
+LDFLAGS_styncpy.o := -r
+
+$(obj)/stycpy.o: $(obj)/strcpy.o $(obj)/$(ev67-y)strcat.o \
+		 $(obj)/$(ev6-y)stxcpy.o FORCE
+	$(call if_changed,ld)
+
+$(obj)/styncpy.o: $(obj)/strncpy.o $(obj)/$(ev67-y)strncat.o \
+		 $(obj)/$(ev6-y)stxncpy.o FORCE
+	$(call if_changed,ld)

From 736b39287c943af626a09e2e1bbdac0f30d010b6 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Mon, 11 Jan 2016 09:51:29 -0500
Subject: [PATCH 1714/2658] alpha: move exports to actual definitions

commit 00fc0e0dda6286407f3854cd71a125f519a5689c upstream.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/alpha/include/asm/Kbuild        |   1 +
 arch/alpha/kernel/Makefile           |   2 +-
 arch/alpha/kernel/alpha_ksyms.c      | 102 ---------------------------
 arch/alpha/kernel/machvec_impl.h     |   6 +-
 arch/alpha/kernel/setup.c            |   1 +
 arch/alpha/lib/callback_srm.S        |   5 ++
 arch/alpha/lib/checksum.c            |   3 +
 arch/alpha/lib/clear_page.S          |   3 +-
 arch/alpha/lib/clear_user.S          |   2 +
 arch/alpha/lib/copy_page.S           |   3 +-
 arch/alpha/lib/copy_user.S           |   3 +
 arch/alpha/lib/csum_ipv6_magic.S     |   2 +
 arch/alpha/lib/csum_partial_copy.c   |   2 +
 arch/alpha/lib/dec_and_lock.c        |   2 +
 arch/alpha/lib/divide.S              |   3 +
 arch/alpha/lib/ev6-clear_page.S      |   3 +-
 arch/alpha/lib/ev6-clear_user.S      |   3 +-
 arch/alpha/lib/ev6-copy_page.S       |   3 +-
 arch/alpha/lib/ev6-copy_user.S       |   3 +-
 arch/alpha/lib/ev6-csum_ipv6_magic.S |   2 +
 arch/alpha/lib/ev6-divide.S          |   3 +
 arch/alpha/lib/ev6-memchr.S          |   3 +-
 arch/alpha/lib/ev6-memcpy.S          |   3 +-
 arch/alpha/lib/ev6-memset.S          |   7 +-
 arch/alpha/lib/ev67-strcat.S         |   3 +-
 arch/alpha/lib/ev67-strchr.S         |   3 +-
 arch/alpha/lib/ev67-strlen.S         |   3 +-
 arch/alpha/lib/ev67-strncat.S        |   3 +-
 arch/alpha/lib/ev67-strrchr.S        |   3 +-
 arch/alpha/lib/fpreg.c               |   7 ++
 arch/alpha/lib/memchr.S              |   3 +-
 arch/alpha/lib/memcpy.c              |   5 +-
 arch/alpha/lib/memmove.S             |   3 +-
 arch/alpha/lib/memset.S              |   7 +-
 arch/alpha/lib/strcat.S              |   2 +
 arch/alpha/lib/strchr.S              |   3 +-
 arch/alpha/lib/strcpy.S              |   3 +-
 arch/alpha/lib/strlen.S              |   3 +-
 arch/alpha/lib/strncat.S             |   3 +-
 arch/alpha/lib/strncpy.S             |   3 +-
 arch/alpha/lib/strrchr.S             |   3 +-
 41 files changed, 99 insertions(+), 131 deletions(-)
 delete mode 100644 arch/alpha/kernel/alpha_ksyms.c

diff --git a/arch/alpha/include/asm/Kbuild b/arch/alpha/include/asm/Kbuild
index 74252220cb46..ce54d4be2528 100644
--- a/arch/alpha/include/asm/Kbuild
+++ b/arch/alpha/include/asm/Kbuild
@@ -4,6 +4,7 @@ generic-y += clkdev.h
 generic-y += cputime.h
 generic-y += exec.h
 generic-y += hash.h
+generic-y += export.h
 generic-y += irq_work.h
 generic-y += mcs_spinlock.h
 generic-y += mm-arch-hooks.h
diff --git a/arch/alpha/kernel/Makefile b/arch/alpha/kernel/Makefile
index 3ecac0106c8a..8ce13d7a2ad3 100644
--- a/arch/alpha/kernel/Makefile
+++ b/arch/alpha/kernel/Makefile
@@ -8,7 +8,7 @@ ccflags-y	:= -Wno-sign-compare
 
 obj-y    := entry.o traps.o process.o osf_sys.o irq.o \
 	    irq_alpha.o signal.o setup.o ptrace.o time.o \
-	    alpha_ksyms.o systbls.o err_common.o io.o
+	    systbls.o err_common.o io.o
 
 obj-$(CONFIG_VGA_HOSE)	+= console.o
 obj-$(CONFIG_SMP)	+= smp.o
diff --git a/arch/alpha/kernel/alpha_ksyms.c b/arch/alpha/kernel/alpha_ksyms.c
deleted file mode 100644
index f4c7ab6f43b0..000000000000
--- a/arch/alpha/kernel/alpha_ksyms.c
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- * linux/arch/alpha/kernel/alpha_ksyms.c
- *
- * Export the alpha-specific functions that are needed for loadable
- * modules.
- */
-
-#include <linux/module.h>
-#include <asm/console.h>
-#include <asm/uaccess.h>
-#include <asm/checksum.h>
-#include <asm/fpu.h>
-#include <asm/machvec.h>
-
-#include <linux/syscalls.h>
-
-/* these are C runtime functions with special calling conventions: */
-extern void __divl (void);
-extern void __reml (void);
-extern void __divq (void);
-extern void __remq (void);
-extern void __divlu (void);
-extern void __remlu (void);
-extern void __divqu (void);
-extern void __remqu (void);
-
-EXPORT_SYMBOL(alpha_mv);
-EXPORT_SYMBOL(callback_getenv);
-EXPORT_SYMBOL(callback_setenv);
-EXPORT_SYMBOL(callback_save_env);
-
-/* platform dependent support */
-EXPORT_SYMBOL(strcat);
-EXPORT_SYMBOL(strcpy);
-EXPORT_SYMBOL(strlen);
-EXPORT_SYMBOL(strncpy);
-EXPORT_SYMBOL(strncat);
-EXPORT_SYMBOL(strchr);
-EXPORT_SYMBOL(strrchr);
-EXPORT_SYMBOL(memmove);
-EXPORT_SYMBOL(__memcpy);
-EXPORT_SYMBOL(__memset);
-EXPORT_SYMBOL(___memset);
-EXPORT_SYMBOL(__memsetw);
-EXPORT_SYMBOL(__constant_c_memset);
-EXPORT_SYMBOL(copy_page);
-EXPORT_SYMBOL(clear_page);
-
-EXPORT_SYMBOL(alpha_read_fp_reg);
-EXPORT_SYMBOL(alpha_read_fp_reg_s);
-EXPORT_SYMBOL(alpha_write_fp_reg);
-EXPORT_SYMBOL(alpha_write_fp_reg_s);
-
-/* Networking helper routines. */
-EXPORT_SYMBOL(csum_tcpudp_magic);
-EXPORT_SYMBOL(ip_compute_csum);
-EXPORT_SYMBOL(ip_fast_csum);
-EXPORT_SYMBOL(csum_partial_copy_nocheck);
-EXPORT_SYMBOL(csum_partial_copy_from_user);
-EXPORT_SYMBOL(csum_ipv6_magic);
-
-#ifdef CONFIG_MATHEMU_MODULE
-extern long (*alpha_fp_emul_imprecise)(struct pt_regs *, unsigned long);
-extern long (*alpha_fp_emul) (unsigned long pc);
-EXPORT_SYMBOL(alpha_fp_emul_imprecise);
-EXPORT_SYMBOL(alpha_fp_emul);
-#endif
-
-/*
- * The following are specially called from the uaccess assembly stubs.
- */
-EXPORT_SYMBOL(__copy_user);
-EXPORT_SYMBOL(__do_clear_user);
-
-/* 
- * SMP-specific symbols.
- */
-
-#ifdef CONFIG_SMP
-EXPORT_SYMBOL(_atomic_dec_and_lock);
-#endif /* CONFIG_SMP */
-
-/*
- * The following are special because they're not called
- * explicitly (the C compiler or assembler generates them in
- * response to division operations).  Fortunately, their
- * interface isn't gonna change any time soon now, so it's OK
- * to leave it out of version control.
- */
-# undef memcpy
-# undef memset
-EXPORT_SYMBOL(__divl);
-EXPORT_SYMBOL(__divlu);
-EXPORT_SYMBOL(__divq);
-EXPORT_SYMBOL(__divqu);
-EXPORT_SYMBOL(__reml);
-EXPORT_SYMBOL(__remlu);
-EXPORT_SYMBOL(__remq);
-EXPORT_SYMBOL(__remqu);
-EXPORT_SYMBOL(memcpy);
-EXPORT_SYMBOL(memset);
-EXPORT_SYMBOL(memchr);
diff --git a/arch/alpha/kernel/machvec_impl.h b/arch/alpha/kernel/machvec_impl.h
index f54bdf658cd0..8c6516025efb 100644
--- a/arch/alpha/kernel/machvec_impl.h
+++ b/arch/alpha/kernel/machvec_impl.h
@@ -144,9 +144,11 @@
    else beforehand.  Fine.  We'll do it ourselves.  */
 #if 0
 #define ALIAS_MV(system) \
-  struct alpha_machine_vector alpha_mv __attribute__((alias(#system "_mv")));
+  struct alpha_machine_vector alpha_mv __attribute__((alias(#system "_mv"))); \
+  EXPORT_SYMBOL(alpha_mv);
 #else
 #define ALIAS_MV(system) \
-  asm(".global alpha_mv\nalpha_mv = " #system "_mv");
+  asm(".global alpha_mv\nalpha_mv = " #system "_mv"); \
+  EXPORT_SYMBOL(alpha_mv);
 #endif
 #endif /* GENERIC */
diff --git a/arch/alpha/kernel/setup.c b/arch/alpha/kernel/setup.c
index b20af76f12c1..4811e54069fc 100644
--- a/arch/alpha/kernel/setup.c
+++ b/arch/alpha/kernel/setup.c
@@ -115,6 +115,7 @@ unsigned long alpha_agpgart_size = DEFAULT_AGP_APER_SIZE;
 
 #ifdef CONFIG_ALPHA_GENERIC
 struct alpha_machine_vector alpha_mv;
+EXPORT_SYMBOL(alpha_mv);
 #endif
 
 #ifndef alpha_using_srm
diff --git a/arch/alpha/lib/callback_srm.S b/arch/alpha/lib/callback_srm.S
index 8804bec2c644..6093addc931a 100644
--- a/arch/alpha/lib/callback_srm.S
+++ b/arch/alpha/lib/callback_srm.S
@@ -3,6 +3,7 @@
  */
 
 #include <asm/console.h>
+#include <asm/export.h>
 
 .text
 #define HWRPB_CRB_OFFSET 0xc0
@@ -92,6 +93,10 @@ CALLBACK(reset_env, CCB_RESET_ENV, 4)
 CALLBACK(save_env, CCB_SAVE_ENV, 1)
 CALLBACK(pswitch, CCB_PSWITCH, 3)
 CALLBACK(bios_emul, CCB_BIOS_EMUL, 5)
+
+EXPORT_SYMBOL(callback_getenv)
+EXPORT_SYMBOL(callback_setenv)
+EXPORT_SYMBOL(callback_save_env)
 	
 .data
 __alpha_using_srm:		# For use by bootpheader
diff --git a/arch/alpha/lib/checksum.c b/arch/alpha/lib/checksum.c
index 199f6efa83fa..65197c3c0845 100644
--- a/arch/alpha/lib/checksum.c
+++ b/arch/alpha/lib/checksum.c
@@ -50,6 +50,7 @@ __sum16 csum_tcpudp_magic(__be32 saddr, __be32 daddr,
 		(__force u64)saddr + (__force u64)daddr +
 		(__force u64)sum + ((len + proto) << 8));
 }
+EXPORT_SYMBOL(csum_tcpudp_magic);
 
 __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr,
 				   unsigned short len,
@@ -148,6 +149,7 @@ __sum16 ip_fast_csum(const void *iph, unsigned int ihl)
 {
 	return (__force __sum16)~do_csum(iph,ihl*4);
 }
+EXPORT_SYMBOL(ip_fast_csum);
 
 /*
  * computes the checksum of a memory block at buff, length len,
@@ -182,3 +184,4 @@ __sum16 ip_compute_csum(const void *buff, int len)
 {
 	return (__force __sum16)~from64to16(do_csum(buff,len));
 }
+EXPORT_SYMBOL(ip_compute_csum);
diff --git a/arch/alpha/lib/clear_page.S b/arch/alpha/lib/clear_page.S
index a221ae266e29..263d7393c0e7 100644
--- a/arch/alpha/lib/clear_page.S
+++ b/arch/alpha/lib/clear_page.S
@@ -3,7 +3,7 @@
  *
  * Zero an entire page.
  */
-
+#include <asm/export.h>
 	.text
 	.align 4
 	.global clear_page
@@ -37,3 +37,4 @@ clear_page:
 	nop
 
 	.end clear_page
+	EXPORT_SYMBOL(clear_page)
diff --git a/arch/alpha/lib/clear_user.S b/arch/alpha/lib/clear_user.S
index 8860316c1957..bf5b931866ba 100644
--- a/arch/alpha/lib/clear_user.S
+++ b/arch/alpha/lib/clear_user.S
@@ -24,6 +24,7 @@
  * Clobbers:
  *	$1,$2,$3,$4,$5,$6
  */
+#include <asm/export.h>
 
 /* Allow an exception for an insn; exit if we get one.  */
 #define EX(x,y...)			\
@@ -111,3 +112,4 @@ $exception:
 	ret	$31, ($28), 1	# .. e1 :
 
 	.end __do_clear_user
+	EXPORT_SYMBOL(__do_clear_user)
diff --git a/arch/alpha/lib/copy_page.S b/arch/alpha/lib/copy_page.S
index 9f3b97459cc6..2ee0bd0508c5 100644
--- a/arch/alpha/lib/copy_page.S
+++ b/arch/alpha/lib/copy_page.S
@@ -3,7 +3,7 @@
  *
  * Copy an entire page.
  */
-
+#include <asm/export.h>
 	.text
 	.align 4
 	.global copy_page
@@ -47,3 +47,4 @@ copy_page:
 	nop
 
 	.end copy_page
+	EXPORT_SYMBOL(copy_page)
diff --git a/arch/alpha/lib/copy_user.S b/arch/alpha/lib/copy_user.S
index 6f3fab9eb434..2238068b1b40 100644
--- a/arch/alpha/lib/copy_user.S
+++ b/arch/alpha/lib/copy_user.S
@@ -26,6 +26,8 @@
  *	$1,$2,$3,$4,$5,$6,$7
  */
 
+#include <asm/export.h>
+
 /* Allow an exception for an insn; exit if we get one.  */
 #define EXI(x,y...)			\
 	99: x,##y;			\
@@ -143,3 +145,4 @@ $101:
 	ret $31,($28),1
 
 	.end __copy_user
+EXPORT_SYMBOL(__copy_user)
diff --git a/arch/alpha/lib/csum_ipv6_magic.S b/arch/alpha/lib/csum_ipv6_magic.S
index 2c2acb96deb6..e74b4544b0cc 100644
--- a/arch/alpha/lib/csum_ipv6_magic.S
+++ b/arch/alpha/lib/csum_ipv6_magic.S
@@ -12,6 +12,7 @@
  * added by Ivan Kokshaysky <ink@jurassic.park.msu.ru>
  */
 
+#include <asm/export.h>
 	.globl csum_ipv6_magic
 	.align 4
 	.ent csum_ipv6_magic
@@ -113,3 +114,4 @@ csum_ipv6_magic:
 	ret			# .. e1 :
 
 	.end csum_ipv6_magic
+	EXPORT_SYMBOL(csum_ipv6_magic)
diff --git a/arch/alpha/lib/csum_partial_copy.c b/arch/alpha/lib/csum_partial_copy.c
index 5675dca8dbb1..b4ff3b683bcd 100644
--- a/arch/alpha/lib/csum_partial_copy.c
+++ b/arch/alpha/lib/csum_partial_copy.c
@@ -374,6 +374,7 @@ csum_partial_copy_from_user(const void __user *src, void *dst, int len,
 	}
 	return (__force __wsum)checksum;
 }
+EXPORT_SYMBOL(csum_partial_copy_from_user);
 
 __wsum
 csum_partial_copy_nocheck(const void *src, void *dst, int len, __wsum sum)
@@ -386,3 +387,4 @@ csum_partial_copy_nocheck(const void *src, void *dst, int len, __wsum sum)
 	set_fs(oldfs);
 	return checksum;
 }
+EXPORT_SYMBOL(csum_partial_copy_nocheck);
diff --git a/arch/alpha/lib/dec_and_lock.c b/arch/alpha/lib/dec_and_lock.c
index f9f5fe830e9f..4221b40167ee 100644
--- a/arch/alpha/lib/dec_and_lock.c
+++ b/arch/alpha/lib/dec_and_lock.c
@@ -7,6 +7,7 @@
 
 #include <linux/spinlock.h>
 #include <linux/atomic.h>
+#include <linux/export.h>
 
   asm (".text					\n\
 	.global _atomic_dec_and_lock		\n\
@@ -39,3 +40,4 @@ static int __used atomic_dec_and_lock_1(atomic_t *atomic, spinlock_t *lock)
 	spin_unlock(lock);
 	return 0;
 }
+EXPORT_SYMBOL(_atomic_dec_and_lock);
diff --git a/arch/alpha/lib/divide.S b/arch/alpha/lib/divide.S
index 2d1a0484a99e..1e33bd127621 100644
--- a/arch/alpha/lib/divide.S
+++ b/arch/alpha/lib/divide.S
@@ -45,6 +45,7 @@
  *	$28 - compare status
  */
 
+#include <asm/export.h>
 #define halt .long 0
 
 /*
@@ -151,6 +152,7 @@ ufunction:
 	addq	$30,STACK,$30
 	ret	$31,($23),1
 	.end	ufunction
+EXPORT_SYMBOL(ufunction)
 
 /*
  * Uhh.. Ugly signed division. I'd rather not have it at all, but
@@ -193,3 +195,4 @@ sfunction:
 	addq	$30,STACK,$30
 	ret	$31,($23),1
 	.end	sfunction
+EXPORT_SYMBOL(sfunction)
diff --git a/arch/alpha/lib/ev6-clear_page.S b/arch/alpha/lib/ev6-clear_page.S
index adf4f7be0e2b..abe99e69a194 100644
--- a/arch/alpha/lib/ev6-clear_page.S
+++ b/arch/alpha/lib/ev6-clear_page.S
@@ -3,7 +3,7 @@
  *
  * Zero an entire page.
  */
-
+#include <asm/export.h>
         .text
         .align 4
         .global clear_page
@@ -52,3 +52,4 @@ clear_page:
 	nop
 
 	.end clear_page
+	EXPORT_SYMBOL(clear_page)
diff --git a/arch/alpha/lib/ev6-clear_user.S b/arch/alpha/lib/ev6-clear_user.S
index 4f42a16b7f53..05bef6b50598 100644
--- a/arch/alpha/lib/ev6-clear_user.S
+++ b/arch/alpha/lib/ev6-clear_user.S
@@ -43,6 +43,7 @@
  *	want to leave a hole (and we also want to avoid repeating lots of work)
  */
 
+#include <asm/export.h>
 /* Allow an exception for an insn; exit if we get one.  */
 #define EX(x,y...)			\
 	99: x,##y;			\
@@ -222,4 +223,4 @@ $exception:			# Destination for exception recovery(?)
 	nop			# .. E  .. ..	:
 	ret	$31, ($28), 1	# L0 .. .. ..	: L U L U
 	.end __do_clear_user
-
+	EXPORT_SYMBOL(__do_clear_user)
diff --git a/arch/alpha/lib/ev6-copy_page.S b/arch/alpha/lib/ev6-copy_page.S
index b789db192754..77935061bddb 100644
--- a/arch/alpha/lib/ev6-copy_page.S
+++ b/arch/alpha/lib/ev6-copy_page.S
@@ -56,7 +56,7 @@
    destination pages are in the dcache, but it is my guess that this is
    less important than the dcache miss case.  */
 
-
+#include <asm/export.h>
 	.text
 	.align 4
 	.global copy_page
@@ -201,3 +201,4 @@ copy_page:
 	nop
 
 	.end copy_page
+	EXPORT_SYMBOL(copy_page)
diff --git a/arch/alpha/lib/ev6-copy_user.S b/arch/alpha/lib/ev6-copy_user.S
index db42ffe9c350..debcc3b6b704 100644
--- a/arch/alpha/lib/ev6-copy_user.S
+++ b/arch/alpha/lib/ev6-copy_user.S
@@ -37,6 +37,7 @@
  *	L	- lower subcluster; L0 - subcluster L0; L1 - subcluster L1
  */
 
+#include <asm/export.h>
 /* Allow an exception for an insn; exit if we get one.  */
 #define EXI(x,y...)			\
 	99: x,##y;			\
@@ -256,4 +257,4 @@ $101:
 	ret $31,($28),1		# L0
 
 	.end __copy_user
-
+	EXPORT_SYMBOL(__copy_user)
diff --git a/arch/alpha/lib/ev6-csum_ipv6_magic.S b/arch/alpha/lib/ev6-csum_ipv6_magic.S
index fc0bc399f872..de62627ac4fe 100644
--- a/arch/alpha/lib/ev6-csum_ipv6_magic.S
+++ b/arch/alpha/lib/ev6-csum_ipv6_magic.S
@@ -52,6 +52,7 @@
  * may cause additional delay in rare cases (load-load replay traps).
  */
 
+#include <asm/export.h>
 	.globl csum_ipv6_magic
 	.align 4
 	.ent csum_ipv6_magic
@@ -148,3 +149,4 @@ csum_ipv6_magic:
 	ret			# L0 : L U L U
 
 	.end csum_ipv6_magic
+	EXPORT_SYMBOL(csum_ipv6_magic)
diff --git a/arch/alpha/lib/ev6-divide.S b/arch/alpha/lib/ev6-divide.S
index 2a82b9be93fa..d18dc0e96e3d 100644
--- a/arch/alpha/lib/ev6-divide.S
+++ b/arch/alpha/lib/ev6-divide.S
@@ -55,6 +55,7 @@
  * Try not to change the actual algorithm if possible for consistency.
  */
 
+#include <asm/export.h>
 #define halt .long 0
 
 /*
@@ -205,6 +206,7 @@ ufunction:
 	addq	$30,STACK,$30		# E :
 	ret	$31,($23),1		# L0 : L U U L
 	.end	ufunction
+EXPORT_SYMBOL(ufunction)
 
 /*
  * Uhh.. Ugly signed division. I'd rather not have it at all, but
@@ -257,3 +259,4 @@ sfunction:
 	addq	$30,STACK,$30		# E :
 	ret	$31,($23),1		# L0 : L U U L
 	.end	sfunction
+EXPORT_SYMBOL(sfunction)
diff --git a/arch/alpha/lib/ev6-memchr.S b/arch/alpha/lib/ev6-memchr.S
index 1a5f71b9d8b1..419adc53ccb4 100644
--- a/arch/alpha/lib/ev6-memchr.S
+++ b/arch/alpha/lib/ev6-memchr.S
@@ -27,7 +27,7 @@
  *	L	- lower subcluster; L0 - subcluster L0; L1 - subcluster L1
  * Try not to change the actual algorithm if possible for consistency.
  */
-
+#include <asm/export.h>
         .set noreorder
         .set noat
 
@@ -189,3 +189,4 @@ $not_found:
 	ret			# L0 :
 
         .end memchr
+	EXPORT_SYMBOL(memchr)
diff --git a/arch/alpha/lib/ev6-memcpy.S b/arch/alpha/lib/ev6-memcpy.S
index 52b37b0f2af5..b19798b2efc0 100644
--- a/arch/alpha/lib/ev6-memcpy.S
+++ b/arch/alpha/lib/ev6-memcpy.S
@@ -19,7 +19,7 @@
  * Temp usage notes:
  *	$1,$2,		- scratch
  */
-
+#include <asm/export.h>
 	.set noreorder
 	.set noat
 
@@ -242,6 +242,7 @@ $nomoredata:
 	nop				# E :
 
 	.end memcpy
+	EXPORT_SYMBOL(memcpy)
 
 /* For backwards module compatibility.  */
 __memcpy = memcpy
diff --git a/arch/alpha/lib/ev6-memset.S b/arch/alpha/lib/ev6-memset.S
index 356bb2fdd705..fed21c6893e8 100644
--- a/arch/alpha/lib/ev6-memset.S
+++ b/arch/alpha/lib/ev6-memset.S
@@ -26,7 +26,7 @@
  * as fixes will need to be made in multiple places.  The performance gain
  * is worth it.
  */
-
+#include <asm/export.h>
 	.set noat
 	.set noreorder
 .text
@@ -229,6 +229,7 @@ end_b:
 	nop
 	ret $31,($26),1		# L0 :
 	.end ___memset
+	EXPORT_SYMBOL(___memset)
 
 	/*
 	 * This is the original body of code, prior to replication and
@@ -406,6 +407,7 @@ end:
 	nop
 	ret $31,($26),1		# L0 :
 	.end __constant_c_memset
+	EXPORT_SYMBOL(__constant_c_memset)
 
 	/*
 	 * This is a replicant of the __constant_c_memset code, rescheduled
@@ -594,6 +596,9 @@ end_w:
 	ret $31,($26),1		# L0 :
 
 	.end __memsetw
+	EXPORT_SYMBOL(__memsetw)
 
 memset = ___memset
 __memset = ___memset
+	EXPORT_SYMBOL(memset)
+	EXPORT_SYMBOL(__memset)
diff --git a/arch/alpha/lib/ev67-strcat.S b/arch/alpha/lib/ev67-strcat.S
index c426fe3ed72f..b69f60419be1 100644
--- a/arch/alpha/lib/ev67-strcat.S
+++ b/arch/alpha/lib/ev67-strcat.S
@@ -19,7 +19,7 @@
  * string once.
  */
 
-
+#include <asm/export.h>
 	.text
 
 	.align 4
@@ -52,3 +52,4 @@ $found:	cttz	$2, $3		# U0 :
 	br	__stxcpy	# L0 :
 
 	.end strcat
+	EXPORT_SYMBOL(strcat)
diff --git a/arch/alpha/lib/ev67-strchr.S b/arch/alpha/lib/ev67-strchr.S
index fbb7b4ffade9..ea8f2f35db9c 100644
--- a/arch/alpha/lib/ev67-strchr.S
+++ b/arch/alpha/lib/ev67-strchr.S
@@ -15,7 +15,7 @@
  *	L	- lower subcluster; L0 - subcluster L0; L1 - subcluster L1
  * Try not to change the actual algorithm if possible for consistency.
  */
-
+#include <asm/export.h>
 #include <asm/regdef.h>
 
 	.set noreorder
@@ -86,3 +86,4 @@ $found:	negq    t0, t1		# E : clear all but least set bit
 	ret			# L0 :
 
 	.end strchr
+	EXPORT_SYMBOL(strchr)
diff --git a/arch/alpha/lib/ev67-strlen.S b/arch/alpha/lib/ev67-strlen.S
index 503928072523..736fd41884a8 100644
--- a/arch/alpha/lib/ev67-strlen.S
+++ b/arch/alpha/lib/ev67-strlen.S
@@ -17,7 +17,7 @@
  *	U	- upper subcluster; U0 - subcluster U0; U1 - subcluster U1
  *	L	- lower subcluster; L0 - subcluster L0; L1 - subcluster L1
  */
-
+#include <asm/export.h>
 	.set noreorder
 	.set noat
 
@@ -47,3 +47,4 @@ $found:
 	ret	$31, ($26)	# L0 :
 
 	.end	strlen
+	EXPORT_SYMBOL(strlen)
diff --git a/arch/alpha/lib/ev67-strncat.S b/arch/alpha/lib/ev67-strncat.S
index 4ae716cd2bfb..cd35cbade73a 100644
--- a/arch/alpha/lib/ev67-strncat.S
+++ b/arch/alpha/lib/ev67-strncat.S
@@ -20,7 +20,7 @@
  * Try not to change the actual algorithm if possible for consistency.
  */
 
-
+#include <asm/export.h>
 	.text
 
 	.align 4
@@ -92,3 +92,4 @@ $zerocount:
 	ret			# L0 :
 
 	.end strncat
+	EXPORT_SYMBOL(strncat)
diff --git a/arch/alpha/lib/ev67-strrchr.S b/arch/alpha/lib/ev67-strrchr.S
index dd0d8c6b9f59..747455f0328c 100644
--- a/arch/alpha/lib/ev67-strrchr.S
+++ b/arch/alpha/lib/ev67-strrchr.S
@@ -18,7 +18,7 @@
  *	L	- lower subcluster; L0 - subcluster L0; L1 - subcluster L1
  */
 
-
+#include <asm/export.h>
 #include <asm/regdef.h>
 
 	.set noreorder
@@ -107,3 +107,4 @@ $eos:
 	nop
 
 	.end strrchr
+	EXPORT_SYMBOL(strrchr)
diff --git a/arch/alpha/lib/fpreg.c b/arch/alpha/lib/fpreg.c
index 05017ba34c3c..4aa6dbfa14ee 100644
--- a/arch/alpha/lib/fpreg.c
+++ b/arch/alpha/lib/fpreg.c
@@ -4,6 +4,9 @@
  * (C) Copyright 1998 Linus Torvalds
  */
 
+#include <linux/compiler.h>
+#include <linux/export.h>
+
 #if defined(CONFIG_ALPHA_EV6) || defined(CONFIG_ALPHA_EV67)
 #define STT(reg,val)  asm volatile ("ftoit $f"#reg",%0" : "=r"(val));
 #else
@@ -52,6 +55,7 @@ alpha_read_fp_reg (unsigned long reg)
 	}
 	return val;
 }
+EXPORT_SYMBOL(alpha_read_fp_reg);
 
 #if defined(CONFIG_ALPHA_EV6) || defined(CONFIG_ALPHA_EV67)
 #define LDT(reg,val)  asm volatile ("itoft %0,$f"#reg : : "r"(val));
@@ -97,6 +101,7 @@ alpha_write_fp_reg (unsigned long reg, unsigned long val)
 	      case 31: LDT(31, val); break;
 	}
 }
+EXPORT_SYMBOL(alpha_write_fp_reg);
 
 #if defined(CONFIG_ALPHA_EV6) || defined(CONFIG_ALPHA_EV67)
 #define STS(reg,val)  asm volatile ("ftois $f"#reg",%0" : "=r"(val));
@@ -146,6 +151,7 @@ alpha_read_fp_reg_s (unsigned long reg)
 	}
 	return val;
 }
+EXPORT_SYMBOL(alpha_read_fp_reg_s);
 
 #if defined(CONFIG_ALPHA_EV6) || defined(CONFIG_ALPHA_EV67)
 #define LDS(reg,val)  asm volatile ("itofs %0,$f"#reg : : "r"(val));
@@ -191,3 +197,4 @@ alpha_write_fp_reg_s (unsigned long reg, unsigned long val)
 	      case 31: LDS(31, val); break;
 	}
 }
+EXPORT_SYMBOL(alpha_write_fp_reg_s);
diff --git a/arch/alpha/lib/memchr.S b/arch/alpha/lib/memchr.S
index 14427eeb555e..c13d3eca2e05 100644
--- a/arch/alpha/lib/memchr.S
+++ b/arch/alpha/lib/memchr.S
@@ -31,7 +31,7 @@ For correctness consider that:
       - only minimum number of quadwords may be accessed
       - the third argument is an unsigned long
 */
-
+#include <asm/export.h>
         .set noreorder
         .set noat
 
@@ -162,3 +162,4 @@ $not_found:
 	ret			# .. e1 :
 
         .end memchr
+	EXPORT_SYMBOL(memchr)
diff --git a/arch/alpha/lib/memcpy.c b/arch/alpha/lib/memcpy.c
index 64083fc73238..57d9291ad172 100644
--- a/arch/alpha/lib/memcpy.c
+++ b/arch/alpha/lib/memcpy.c
@@ -16,6 +16,7 @@
  */
 
 #include <linux/types.h>
+#include <linux/export.h>
 
 /*
  * This should be done in one go with ldq_u*2/mask/stq_u. Do it
@@ -158,6 +159,4 @@ void * memcpy(void * dest, const void *src, size_t n)
 	__memcpy_unaligned_up ((unsigned long) dest, (unsigned long) src, n);
 	return dest;
 }
-
-/* For backward modules compatibility, define __memcpy.  */
-asm("__memcpy = memcpy; .globl __memcpy");
+EXPORT_SYMBOL(memcpy);
diff --git a/arch/alpha/lib/memmove.S b/arch/alpha/lib/memmove.S
index eb3b6e02242f..ff6a39d38385 100644
--- a/arch/alpha/lib/memmove.S
+++ b/arch/alpha/lib/memmove.S
@@ -6,7 +6,7 @@
  * This is hand-massaged output from the original memcpy.c.  We defer to
  * memcpy whenever possible; the backwards copy loops are not unrolled.
  */
-        
+#include <asm/export.h>
 	.set noat
 	.set noreorder
 	.text
@@ -179,3 +179,4 @@ $egress:
 	nop
 
 	.end memmove
+	EXPORT_SYMBOL(memmove)
diff --git a/arch/alpha/lib/memset.S b/arch/alpha/lib/memset.S
index 76ccc6d1f364..89a26f5e89de 100644
--- a/arch/alpha/lib/memset.S
+++ b/arch/alpha/lib/memset.S
@@ -13,7 +13,7 @@
  * The scheduling comments are according to the EV5 documentation (and done by 
  * hand, so they might well be incorrect, please do tell me about it..)
  */
-
+#include <asm/export.h>
 	.set noat
 	.set noreorder
 .text
@@ -106,6 +106,8 @@ within_one_quad:
 end:
 	ret $31,($26),1		/* E1 */
 	.end ___memset
+EXPORT_SYMBOL(___memset)
+EXPORT_SYMBOL(__constant_c_memset)
 
 	.align 5
 	.ent __memsetw
@@ -122,6 +124,9 @@ __memsetw:
 	br __constant_c_memset	/* .. E1 */
 
 	.end __memsetw
+EXPORT_SYMBOL(__memsetw)
 
 memset = ___memset
 __memset = ___memset
+	EXPORT_SYMBOL(memset)
+	EXPORT_SYMBOL(__memset)
diff --git a/arch/alpha/lib/strcat.S b/arch/alpha/lib/strcat.S
index 393f50384878..249837b03d4b 100644
--- a/arch/alpha/lib/strcat.S
+++ b/arch/alpha/lib/strcat.S
@@ -4,6 +4,7 @@
  *
  * Append a null-terminated string from SRC to DST.
  */
+#include <asm/export.h>
 
 	.text
 
@@ -50,3 +51,4 @@ $found:	negq    $2, $3		# clear all but least set bit
 	br	__stxcpy
 
 	.end strcat
+EXPORT_SYMBOL(strcat);
diff --git a/arch/alpha/lib/strchr.S b/arch/alpha/lib/strchr.S
index 011a175e8329..7412a173ea39 100644
--- a/arch/alpha/lib/strchr.S
+++ b/arch/alpha/lib/strchr.S
@@ -5,7 +5,7 @@
  * Return the address of a given character within a null-terminated
  * string, or null if it is not found.
  */
-
+#include <asm/export.h>
 #include <asm/regdef.h>
 
 	.set noreorder
@@ -68,3 +68,4 @@ $retnull:
 	ret			# .. e1 :
 
 	.end strchr
+	EXPORT_SYMBOL(strchr)
diff --git a/arch/alpha/lib/strcpy.S b/arch/alpha/lib/strcpy.S
index e0728e4ad21f..98deae1e4d08 100644
--- a/arch/alpha/lib/strcpy.S
+++ b/arch/alpha/lib/strcpy.S
@@ -5,7 +5,7 @@
  * Copy a null-terminated string from SRC to DST.  Return a pointer
  * to the null-terminator in the source.
  */
-
+#include <asm/export.h>
 	.text
 
 	.align 3
@@ -21,3 +21,4 @@ strcpy:
 	br	__stxcpy	# do the copy
 
 	.end strcpy
+	EXPORT_SYMBOL(strcpy)
diff --git a/arch/alpha/lib/strlen.S b/arch/alpha/lib/strlen.S
index fe63353de152..79c416f71bac 100644
--- a/arch/alpha/lib/strlen.S
+++ b/arch/alpha/lib/strlen.S
@@ -11,7 +11,7 @@
  *	  do this instead of the 9 instructions that
  *	  binary search needs).
  */
-
+#include <asm/export.h>
 	.set noreorder
 	.set noat
 
@@ -55,3 +55,4 @@ done:	subq	$0, $16, $0
 	ret	$31, ($26)
 
 	.end	strlen
+	EXPORT_SYMBOL(strlen)
diff --git a/arch/alpha/lib/strncat.S b/arch/alpha/lib/strncat.S
index a8278163c972..6c29ea60869a 100644
--- a/arch/alpha/lib/strncat.S
+++ b/arch/alpha/lib/strncat.S
@@ -9,7 +9,7 @@
  * past count, whereas libc may write to count+1.  This follows the generic
  * implementation in lib/string.c and is, IMHO, more sensible.
  */
-
+#include <asm/export.h>
 	.text
 
 	.align 3
@@ -82,3 +82,4 @@ $zerocount:
 	ret
 
 	.end strncat
+	EXPORT_SYMBOL(strncat)
diff --git a/arch/alpha/lib/strncpy.S b/arch/alpha/lib/strncpy.S
index a46f7f3ad8c7..e102cf1567dd 100644
--- a/arch/alpha/lib/strncpy.S
+++ b/arch/alpha/lib/strncpy.S
@@ -10,7 +10,7 @@
  * version has cropped that bit o' nastiness as well as assuming that
  * __stxncpy is in range of a branch.
  */
-
+#include <asm/export.h>
 	.set noat
 	.set noreorder
 
@@ -79,3 +79,4 @@ $zerolen:
 	ret
 
 	.end	strncpy
+	EXPORT_SYMBOL(strncpy)
diff --git a/arch/alpha/lib/strrchr.S b/arch/alpha/lib/strrchr.S
index 1970dc07cfd1..4bc6cb4b9812 100644
--- a/arch/alpha/lib/strrchr.S
+++ b/arch/alpha/lib/strrchr.S
@@ -5,7 +5,7 @@
  * Return the address of the last occurrence of a given character
  * within a null-terminated string, or null if it is not found.
  */
-
+#include <asm/export.h>
 #include <asm/regdef.h>
 
 	.set noreorder
@@ -85,3 +85,4 @@ $retnull:
 	ret			# .. e1 :
 
 	.end strrchr
+	EXPORT_SYMBOL(strrchr)

From 2069601c25f2a9286326fa9ba3f13c726d587c74 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Sat, 10 Sep 2016 16:21:34 -0400
Subject: [PATCH 1715/2658] alpha: get rid of tail-zeroing in __copy_user()

commit 085354f907969fb3ee33f236368f6e1dd4c74d62 upstream.

... and adjust copy_from_user() accordingly

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/alpha/include/asm/uaccess.h |  9 +++++----
 arch/alpha/lib/copy_user.S       | 16 +---------------
 arch/alpha/lib/ev6-copy_user.S   | 23 +----------------------
 3 files changed, 7 insertions(+), 41 deletions(-)

diff --git a/arch/alpha/include/asm/uaccess.h b/arch/alpha/include/asm/uaccess.h
index c0ddbbf73400..3a1d903eabc3 100644
--- a/arch/alpha/include/asm/uaccess.h
+++ b/arch/alpha/include/asm/uaccess.h
@@ -396,11 +396,12 @@ copy_to_user(void __user *to, const void *from, long n)
 extern inline long
 copy_from_user(void *to, const void __user *from, long n)
 {
+	long res = n;
 	if (likely(__access_ok((unsigned long)from, n, get_fs())))
-		n = __copy_tofrom_user_nocheck(to, (__force void *)from, n);
-	else
-		memset(to, 0, n);
-	return n;
+		res = __copy_from_user_inatomic(to, from, n);
+	if (unlikely(res))
+		memset(to + (n - res), 0, res);
+	return res;
 }
 
 extern void __do_clear_user(void);
diff --git a/arch/alpha/lib/copy_user.S b/arch/alpha/lib/copy_user.S
index 2238068b1b40..509f62b65311 100644
--- a/arch/alpha/lib/copy_user.S
+++ b/arch/alpha/lib/copy_user.S
@@ -126,22 +126,8 @@ $65:
 	bis $31,$31,$0
 $41:
 $35:
-$exitout:
-	ret $31,($28),1
-
 $exitin:
-	/* A stupid byte-by-byte zeroing of the rest of the output
-	   buffer.  This cures security holes by never leaving 
-	   random kernel data around to be copied elsewhere.  */
-
-	mov $0,$1
-$101:
-	EXO ( ldq_u $2,0($6) )
-	subq $1,1,$1
-	mskbl $2,$6,$2
-	EXO ( stq_u $2,0($6) )
-	addq $6,1,$6
-	bgt $1,$101
+$exitout:
 	ret $31,($28),1
 
 	.end __copy_user
diff --git a/arch/alpha/lib/ev6-copy_user.S b/arch/alpha/lib/ev6-copy_user.S
index debcc3b6b704..be720b518af9 100644
--- a/arch/alpha/lib/ev6-copy_user.S
+++ b/arch/alpha/lib/ev6-copy_user.S
@@ -228,33 +228,12 @@ $dirtyentry:
 	bgt $0,$onebyteloop	# U  .. .. ..	: U L U L
 
 $zerolength:
+$exitin:
 $exitout:			# Destination for exception recovery(?)
 	nop			# .. .. .. E
 	nop			# .. .. E  ..
 	nop			# .. E  .. ..
 	ret $31,($28),1		# L0 .. .. ..	: L U L U
 
-$exitin:
-
-	/* A stupid byte-by-byte zeroing of the rest of the output
-	   buffer.  This cures security holes by never leaving 
-	   random kernel data around to be copied elsewhere.  */
-
-	nop
-	nop
-	nop
-	mov	$0,$1
-
-$101:
-	EXO ( stb $31,0($6) )	# L
-	subq $1,1,$1		# E
-	addq $6,1,$6		# E
-	bgt $1,$101		# U
-
-	nop
-	nop
-	nop
-	ret $31,($28),1		# L0
-
 	.end __copy_user
 	EXPORT_SYMBOL(__copy_user)

From 6c4e9635a1f0e4a8bc7487a115fc3ab487a0890b Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Sat, 24 Dec 2016 20:26:18 -0500
Subject: [PATCH 1716/2658] alpha: switch __copy_user() and __do_clean_user()
 to normal calling conventions

commit 8525023121de4848b5f0a7d867ffeadbc477774d upstream.

They used to need odd calling conventions due to old exception handling
mechanism, the last remnants of which had disappeared back in 2002.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/alpha/include/asm/uaccess.h |  67 ++++----------------
 arch/alpha/lib/clear_user.S      |  66 ++++++++------------
 arch/alpha/lib/copy_user.S       |  82 ++++++++++--------------
 arch/alpha/lib/ev6-clear_user.S  |  84 +++++++++++--------------
 arch/alpha/lib/ev6-copy_user.S   | 104 +++++++++++++------------------
 5 files changed, 151 insertions(+), 252 deletions(-)

diff --git a/arch/alpha/include/asm/uaccess.h b/arch/alpha/include/asm/uaccess.h
index 3a1d903eabc3..89413a29cb07 100644
--- a/arch/alpha/include/asm/uaccess.h
+++ b/arch/alpha/include/asm/uaccess.h
@@ -341,45 +341,17 @@ __asm__ __volatile__("1: stb %r2,%1\n"				\
  * Complex access routines
  */
 
-/* This little bit of silliness is to get the GP loaded for a function
-   that ordinarily wouldn't.  Otherwise we could have it done by the macro
-   directly, which can be optimized the linker.  */
-#ifdef MODULE
-#define __module_address(sym)		"r"(sym),
-#define __module_call(ra, arg, sym)	"jsr $" #ra ",(%" #arg ")," #sym
-#else
-#define __module_address(sym)
-#define __module_call(ra, arg, sym)	"bsr $" #ra "," #sym " !samegp"
-#endif
-
-extern void __copy_user(void);
-
-extern inline long
-__copy_tofrom_user_nocheck(void *to, const void *from, long len)
-{
-	register void * __cu_to __asm__("$6") = to;
-	register const void * __cu_from __asm__("$7") = from;
-	register long __cu_len __asm__("$0") = len;
-
-	__asm__ __volatile__(
-		__module_call(28, 3, __copy_user)
-		: "=r" (__cu_len), "=r" (__cu_from), "=r" (__cu_to)
-		: __module_address(__copy_user)
-		  "0" (__cu_len), "1" (__cu_from), "2" (__cu_to)
-		: "$1", "$2", "$3", "$4", "$5", "$28", "memory");
-
-	return __cu_len;
-}
+extern long __copy_user(void *to, const void *from, long len);
 
-#define __copy_to_user(to, from, n)					\
-({									\
-	__chk_user_ptr(to);						\
-	__copy_tofrom_user_nocheck((__force void *)(to), (from), (n));	\
+#define __copy_to_user(to, from, n)			\
+({							\
+	__chk_user_ptr(to);				\
+	__copy_user((__force void *)(to), (from), (n));	\
 })
-#define __copy_from_user(to, from, n)					\
-({									\
-	__chk_user_ptr(from);						\
-	__copy_tofrom_user_nocheck((to), (__force void *)(from), (n));	\
+#define __copy_from_user(to, from, n)			\
+({							\
+	__chk_user_ptr(from);				\
+	__copy_user((to), (__force void *)(from), (n));	\
 })
 
 #define __copy_to_user_inatomic __copy_to_user
@@ -389,7 +361,7 @@ extern inline long
 copy_to_user(void __user *to, const void *from, long n)
 {
 	if (likely(__access_ok((unsigned long)to, n, get_fs())))
-		n = __copy_tofrom_user_nocheck((__force void *)to, from, n);
+		n = __copy_user((__force void *)to, from, n);
 	return n;
 }
 
@@ -404,21 +376,7 @@ copy_from_user(void *to, const void __user *from, long n)
 	return res;
 }
 
-extern void __do_clear_user(void);
-
-extern inline long
-__clear_user(void __user *to, long len)
-{
-	register void __user * __cl_to __asm__("$6") = to;
-	register long __cl_len __asm__("$0") = len;
-	__asm__ __volatile__(
-		__module_call(28, 2, __do_clear_user)
-		: "=r"(__cl_len), "=r"(__cl_to)
-		: __module_address(__do_clear_user)
-		  "0"(__cl_len), "1"(__cl_to)
-		: "$1", "$2", "$3", "$4", "$5", "$28", "memory");
-	return __cl_len;
-}
+extern long __clear_user(void __user *to, long len);
 
 extern inline long
 clear_user(void __user *to, long len)
@@ -428,9 +386,6 @@ clear_user(void __user *to, long len)
 	return len;
 }
 
-#undef __module_address
-#undef __module_call
-
 #define user_addr_max() \
         (segment_eq(get_fs(), USER_DS) ? TASK_SIZE : ~0UL)
 
diff --git a/arch/alpha/lib/clear_user.S b/arch/alpha/lib/clear_user.S
index bf5b931866ba..006f469fef73 100644
--- a/arch/alpha/lib/clear_user.S
+++ b/arch/alpha/lib/clear_user.S
@@ -8,21 +8,6 @@
  * right "bytes left to zero" value (and that it is updated only _after_
  * a successful copy).  There is also some rather minor exception setup
  * stuff.
- *
- * NOTE! This is not directly C-callable, because the calling semantics
- * are different:
- *
- * Inputs:
- *	length in $0
- *	destination address in $6
- *	exception pointer in $7
- *	return address in $28 (exceptions expect it there)
- *
- * Outputs:
- *	bytes left to copy in $0
- *
- * Clobbers:
- *	$1,$2,$3,$4,$5,$6
  */
 #include <asm/export.h>
 
@@ -38,62 +23,63 @@
 	.set noreorder
 	.align 4
 
-	.globl __do_clear_user
-	.ent __do_clear_user
-	.frame	$30, 0, $28
+	.globl __clear_user
+	.ent __clear_user
+	.frame	$30, 0, $26
 	.prologue 0
 
 $loop:
 	and	$1, 3, $4	# e0    :
 	beq	$4, 1f		# .. e1 :
 
-0:	EX( stq_u $31, 0($6) )	# e0    : zero one word
+0:	EX( stq_u $31, 0($16) )	# e0    : zero one word
 	subq	$0, 8, $0	# .. e1 :
 	subq	$4, 1, $4	# e0    :
-	addq	$6, 8, $6	# .. e1 :
+	addq	$16, 8, $16	# .. e1 :
 	bne	$4, 0b		# e1    :
 	unop			#       :
 
 1:	bic	$1, 3, $1	# e0    :
 	beq	$1, $tail	# .. e1 :
 
-2:	EX( stq_u $31, 0($6) )	# e0    : zero four words
+2:	EX( stq_u $31, 0($16) )	# e0    : zero four words
 	subq	$0, 8, $0	# .. e1 :
-	EX( stq_u $31, 8($6) )	# e0    :
+	EX( stq_u $31, 8($16) )	# e0    :
 	subq	$0, 8, $0	# .. e1 :
-	EX( stq_u $31, 16($6) )	# e0    :
+	EX( stq_u $31, 16($16) )	# e0    :
 	subq	$0, 8, $0	# .. e1 :
-	EX( stq_u $31, 24($6) )	# e0    :
+	EX( stq_u $31, 24($16) )	# e0    :
 	subq	$0, 8, $0	# .. e1 :
 	subq	$1, 4, $1	# e0    :
-	addq	$6, 32, $6	# .. e1 :
+	addq	$16, 32, $16	# .. e1 :
 	bne	$1, 2b		# e1    :
 
 $tail:
 	bne	$2, 1f		# e1    : is there a tail to do?
-	ret	$31, ($28), 1	# .. e1 :
+	ret	$31, ($26), 1	# .. e1 :
 
-1:	EX( ldq_u $5, 0($6) )	# e0    :
+1:	EX( ldq_u $5, 0($16) )	# e0    :
 	clr	$0		# .. e1 :
 	nop			# e1    :
 	mskqh	$5, $0, $5	# e0    :
-	EX( stq_u $5, 0($6) )	# e0    :
-	ret	$31, ($28), 1	# .. e1 :
+	EX( stq_u $5, 0($16) )	# e0    :
+	ret	$31, ($26), 1	# .. e1 :
 
-__do_clear_user:
-	and	$6, 7, $4	# e0    : find dest misalignment
+__clear_user:
+	and	$17, $17, $0
+	and	$16, 7, $4	# e0    : find dest misalignment
 	beq	$0, $zerolength # .. e1 :
 	addq	$0, $4, $1	# e0    : bias counter
 	and	$1, 7, $2	# e1    : number of bytes in tail
 	srl	$1, 3, $1	# e0    :
 	beq	$4, $loop	# .. e1 :
 
-	EX( ldq_u $5, 0($6) )	# e0    : load dst word to mask back in
+	EX( ldq_u $5, 0($16) )	# e0    : load dst word to mask back in
 	beq	$1, $oneword	# .. e1 : sub-word store?
 
-	mskql	$5, $6, $5	# e0    : take care of misaligned head
-	addq	$6, 8, $6	# .. e1 :
-	EX( stq_u $5, -8($6) )	# e0    :
+	mskql	$5, $16, $5	# e0    : take care of misaligned head
+	addq	$16, 8, $16	# .. e1 :
+	EX( stq_u $5, -8($16) )	# e0    :
 	addq	$0, $4, $0	# .. e1 : bytes left -= 8 - misalignment
 	subq	$1, 1, $1	# e0    :
 	subq	$0, 8, $0	# .. e1 :
@@ -101,15 +87,15 @@ __do_clear_user:
 	unop			#       :
 
 $oneword:
-	mskql	$5, $6, $4	# e0    :
+	mskql	$5, $16, $4	# e0    :
 	mskqh	$5, $2, $5	# e0    :
 	or	$5, $4, $5	# e1    :
-	EX( stq_u $5, 0($6) )	# e0    :
+	EX( stq_u $5, 0($16) )	# e0    :
 	clr	$0		# .. e1 :
 
 $zerolength:
 $exception:
-	ret	$31, ($28), 1	# .. e1 :
+	ret	$31, ($26), 1	# .. e1 :
 
-	.end __do_clear_user
-	EXPORT_SYMBOL(__do_clear_user)
+	.end __clear_user
+	EXPORT_SYMBOL(__clear_user)
diff --git a/arch/alpha/lib/copy_user.S b/arch/alpha/lib/copy_user.S
index 509f62b65311..159f1b7e6e49 100644
--- a/arch/alpha/lib/copy_user.S
+++ b/arch/alpha/lib/copy_user.S
@@ -9,21 +9,6 @@
  * contains the right "bytes left to copy" value (and that it is updated
  * only _after_ a successful copy). There is also some rather minor
  * exception setup stuff..
- *
- * NOTE! This is not directly C-callable, because the calling semantics are
- * different:
- *
- * Inputs:
- *	length in $0
- *	destination address in $6
- *	source address in $7
- *	return address in $28
- *
- * Outputs:
- *	bytes left to copy in $0
- *
- * Clobbers:
- *	$1,$2,$3,$4,$5,$6,$7
  */
 
 #include <asm/export.h>
@@ -49,58 +34,59 @@
 	.ent __copy_user
 __copy_user:
 	.prologue 0
-	and $6,7,$3
+	and $18,$18,$0
+	and $16,7,$3
 	beq $0,$35
 	beq $3,$36
 	subq $3,8,$3
 	.align 4
 $37:
-	EXI( ldq_u $1,0($7) )
-	EXO( ldq_u $2,0($6) )
-	extbl $1,$7,$1
-	mskbl $2,$6,$2
-	insbl $1,$6,$1
+	EXI( ldq_u $1,0($17) )
+	EXO( ldq_u $2,0($16) )
+	extbl $1,$17,$1
+	mskbl $2,$16,$2
+	insbl $1,$16,$1
 	addq $3,1,$3
 	bis $1,$2,$1
-	EXO( stq_u $1,0($6) )
+	EXO( stq_u $1,0($16) )
 	subq $0,1,$0
-	addq $6,1,$6
-	addq $7,1,$7
+	addq $16,1,$16
+	addq $17,1,$17
 	beq $0,$41
 	bne $3,$37
 $36:
-	and $7,7,$1
+	and $17,7,$1
 	bic $0,7,$4
 	beq $1,$43
 	beq $4,$48
-	EXI( ldq_u $3,0($7) )
+	EXI( ldq_u $3,0($17) )
 	.align 4
 $50:
-	EXI( ldq_u $2,8($7) )
+	EXI( ldq_u $2,8($17) )
 	subq $4,8,$4
-	extql $3,$7,$3
-	extqh $2,$7,$1
+	extql $3,$17,$3
+	extqh $2,$17,$1
 	bis $3,$1,$1
-	EXO( stq $1,0($6) )
-	addq $7,8,$7
+	EXO( stq $1,0($16) )
+	addq $17,8,$17
 	subq $0,8,$0
-	addq $6,8,$6
+	addq $16,8,$16
 	bis $2,$2,$3
 	bne $4,$50
 $48:
 	beq $0,$41
 	.align 4
 $57:
-	EXI( ldq_u $1,0($7) )
-	EXO( ldq_u $2,0($6) )
-	extbl $1,$7,$1
-	mskbl $2,$6,$2
-	insbl $1,$6,$1
+	EXI( ldq_u $1,0($17) )
+	EXO( ldq_u $2,0($16) )
+	extbl $1,$17,$1
+	mskbl $2,$16,$2
+	insbl $1,$16,$1
 	bis $1,$2,$1
-	EXO( stq_u $1,0($6) )
+	EXO( stq_u $1,0($16) )
 	subq $0,1,$0
-	addq $6,1,$6
-	addq $7,1,$7
+	addq $16,1,$16
+	addq $17,1,$17
 	bne $0,$57
 	br $31,$41
 	.align 4
@@ -108,27 +94,27 @@ $43:
 	beq $4,$65
 	.align 4
 $66:
-	EXI( ldq $1,0($7) )
+	EXI( ldq $1,0($17) )
 	subq $4,8,$4
-	EXO( stq $1,0($6) )
-	addq $7,8,$7
+	EXO( stq $1,0($16) )
+	addq $17,8,$17
 	subq $0,8,$0
-	addq $6,8,$6
+	addq $16,8,$16
 	bne $4,$66
 $65:
 	beq $0,$41
-	EXI( ldq $2,0($7) )
-	EXO( ldq $1,0($6) )
+	EXI( ldq $2,0($17) )
+	EXO( ldq $1,0($16) )
 	mskql $2,$0,$2
 	mskqh $1,$0,$1
 	bis $2,$1,$2
-	EXO( stq $2,0($6) )
+	EXO( stq $2,0($16) )
 	bis $31,$31,$0
 $41:
 $35:
 $exitin:
 $exitout:
-	ret $31,($28),1
+	ret $31,($26),1
 
 	.end __copy_user
 EXPORT_SYMBOL(__copy_user)
diff --git a/arch/alpha/lib/ev6-clear_user.S b/arch/alpha/lib/ev6-clear_user.S
index 05bef6b50598..e179e4757ef8 100644
--- a/arch/alpha/lib/ev6-clear_user.S
+++ b/arch/alpha/lib/ev6-clear_user.S
@@ -9,21 +9,6 @@
  * a successful copy).  There is also some rather minor exception setup
  * stuff.
  *
- * NOTE! This is not directly C-callable, because the calling semantics
- * are different:
- *
- * Inputs:
- *	length in $0
- *	destination address in $6
- *	exception pointer in $7
- *	return address in $28 (exceptions expect it there)
- *
- * Outputs:
- *	bytes left to copy in $0
- *
- * Clobbers:
- *	$1,$2,$3,$4,$5,$6
- *
  * Much of the information about 21264 scheduling/coding comes from:
  *	Compiler Writer's Guide for the Alpha 21264
  *	abbreviated as 'CWG' in other comments here
@@ -56,14 +41,15 @@
 	.set noreorder
 	.align 4
 
-	.globl __do_clear_user
-	.ent __do_clear_user
-	.frame	$30, 0, $28
+	.globl __clear_user
+	.ent __clear_user
+	.frame	$30, 0, $26
 	.prologue 0
 
 				# Pipeline info : Slotting & Comments
-__do_clear_user:
-	and	$6, 7, $4	# .. E  .. ..	: find dest head misalignment
+__clear_user:
+	and	$17, $17, $0
+	and	$16, 7, $4	# .. E  .. ..	: find dest head misalignment
 	beq	$0, $zerolength # U  .. .. ..	:  U L U L
 
 	addq	$0, $4, $1	# .. .. .. E	: bias counter
@@ -75,14 +61,14 @@ __do_clear_user:
 
 /*
  * Head is not aligned.  Write (8 - $4) bytes to head of destination
- * This means $6 is known to be misaligned
+ * This means $16 is known to be misaligned
  */
-	EX( ldq_u $5, 0($6) )	# .. .. .. L	: load dst word to mask back in
+	EX( ldq_u $5, 0($16) )	# .. .. .. L	: load dst word to mask back in
 	beq	$1, $onebyte	# .. .. U  ..	: sub-word store?
-	mskql	$5, $6, $5	# .. U  .. ..	: take care of misaligned head
-	addq	$6, 8, $6	# E  .. .. .. 	: L U U L
+	mskql	$5, $16, $5	# .. U  .. ..	: take care of misaligned head
+	addq	$16, 8, $16	# E  .. .. .. 	: L U U L
 
-	EX( stq_u $5, -8($6) )	# .. .. .. L	:
+	EX( stq_u $5, -8($16) )	# .. .. .. L	:
 	subq	$1, 1, $1	# .. .. E  ..	:
 	addq	$0, $4, $0	# .. E  .. ..	: bytes left -= 8 - misalignment
 	subq	$0, 8, $0	# E  .. .. ..	: U L U L
@@ -93,11 +79,11 @@ __do_clear_user:
  * values upon initial entry to the loop
  * $1 is number of quadwords to clear (zero is a valid value)
  * $2 is number of trailing bytes (0..7) ($2 never used...)
- * $6 is known to be aligned 0mod8
+ * $16 is known to be aligned 0mod8
  */
 $headalign:
 	subq	$1, 16, $4	# .. .. .. E	: If < 16, we can not use the huge loop
-	and	$6, 0x3f, $2	# .. .. E  ..	: Forward work for huge loop
+	and	$16, 0x3f, $2	# .. .. E  ..	: Forward work for huge loop
 	subq	$2, 0x40, $3	# .. E  .. ..	: bias counter (huge loop)
 	blt	$4, $trailquad	# U  .. .. ..	: U L U L
 
@@ -114,21 +100,21 @@ $headalign:
 	beq	$3, $bigalign	# U  .. .. ..	: U L U L : Aligned 0mod64
 
 $alignmod64:
-	EX( stq_u $31, 0($6) )	# .. .. .. L
+	EX( stq_u $31, 0($16) )	# .. .. .. L
 	addq	$3, 8, $3	# .. .. E  ..
 	subq	$0, 8, $0	# .. E  .. ..
 	nop			# E  .. .. ..	: U L U L
 
 	nop			# .. .. .. E
 	subq	$1, 1, $1	# .. .. E  ..
-	addq	$6, 8, $6	# .. E  .. ..
+	addq	$16, 8, $16	# .. E  .. ..
 	blt	$3, $alignmod64	# U  .. .. ..	: U L U L
 
 $bigalign:
 /*
  * $0 is the number of bytes left
  * $1 is the number of quads left
- * $6 is aligned 0mod64
+ * $16 is aligned 0mod64
  * we know that we'll be taking a minimum of one trip through
  * CWG Section 3.7.6: do not expect a sustained store rate of > 1/cycle
  * We are _not_ going to update $0 after every single store.  That
@@ -145,39 +131,39 @@ $bigalign:
 	nop			# E :
 	nop			# E :
 	nop			# E :
-	bis	$6,$6,$3	# E : U L U L : Initial wh64 address is dest
+	bis	$16,$16,$3	# E : U L U L : Initial wh64 address is dest
 	/* This might actually help for the current trip... */
 
 $do_wh64:
 	wh64	($3)		# .. .. .. L1	: memory subsystem hint
 	subq	$1, 16, $4	# .. .. E  ..	: Forward calculation - repeat the loop?
-	EX( stq_u $31, 0($6) )	# .. L  .. ..
+	EX( stq_u $31, 0($16) )	# .. L  .. ..
 	subq	$0, 8, $0	# E  .. .. ..	: U L U L
 
-	addq	$6, 128, $3	# E : Target address of wh64
-	EX( stq_u $31, 8($6) )	# L :
-	EX( stq_u $31, 16($6) )	# L :
+	addq	$16, 128, $3	# E : Target address of wh64
+	EX( stq_u $31, 8($16) )	# L :
+	EX( stq_u $31, 16($16) )	# L :
 	subq	$0, 16, $0	# E : U L L U
 
 	nop			# E :
-	EX( stq_u $31, 24($6) )	# L :
-	EX( stq_u $31, 32($6) )	# L :
+	EX( stq_u $31, 24($16) )	# L :
+	EX( stq_u $31, 32($16) )	# L :
 	subq	$0, 168, $5	# E : U L L U : two trips through the loop left?
 	/* 168 = 192 - 24, since we've already completed some stores */
 
 	subq	$0, 16, $0	# E :
-	EX( stq_u $31, 40($6) )	# L :
-	EX( stq_u $31, 48($6) )	# L :
-	cmovlt	$5, $6, $3	# E : U L L U : Latency 2, extra mapping cycle
+	EX( stq_u $31, 40($16) )	# L :
+	EX( stq_u $31, 48($16) )	# L :
+	cmovlt	$5, $16, $3	# E : U L L U : Latency 2, extra mapping cycle
 
 	subq	$1, 8, $1	# E :
 	subq	$0, 16, $0	# E :
-	EX( stq_u $31, 56($6) )	# L :
+	EX( stq_u $31, 56($16) )	# L :
 	nop			# E : U L U L
 
 	nop			# E :
 	subq	$0, 8, $0	# E :
-	addq	$6, 64, $6	# E :
+	addq	$16, 64, $16	# E :
 	bge	$4, $do_wh64	# U : U L U L
 
 $trailquad:
@@ -190,14 +176,14 @@ $trailquad:
 	beq	$1, $trailbytes	# U  .. .. ..	: U L U L : Only 0..7 bytes to go
 
 $onequad:
-	EX( stq_u $31, 0($6) )	# .. .. .. L
+	EX( stq_u $31, 0($16) )	# .. .. .. L
 	subq	$1, 1, $1	# .. .. E  ..
 	subq	$0, 8, $0	# .. E  .. ..
 	nop			# E  .. .. ..	: U L U L
 
 	nop			# .. .. .. E
 	nop			# .. .. E  ..
-	addq	$6, 8, $6	# .. E  .. ..
+	addq	$16, 8, $16	# .. E  .. ..
 	bgt	$1, $onequad	# U  .. .. ..	: U L U L
 
 	# We have an unknown number of bytes left to go.
@@ -211,9 +197,9 @@ $trailbytes:
 	# so we will use $0 as the loop counter
 	# We know for a fact that $0 > 0 zero due to previous context
 $onebyte:
-	EX( stb $31, 0($6) )	# .. .. .. L
+	EX( stb $31, 0($16) )	# .. .. .. L
 	subq	$0, 1, $0	# .. .. E  ..	:
-	addq	$6, 1, $6	# .. E  .. ..	:
+	addq	$16, 1, $16	# .. E  .. ..	:
 	bgt	$0, $onebyte	# U  .. .. ..	: U L U L
 
 $zerolength:
@@ -221,6 +207,6 @@ $exception:			# Destination for exception recovery(?)
 	nop			# .. .. .. E	:
 	nop			# .. .. E  ..	:
 	nop			# .. E  .. ..	:
-	ret	$31, ($28), 1	# L0 .. .. ..	: L U L U
-	.end __do_clear_user
-	EXPORT_SYMBOL(__do_clear_user)
+	ret	$31, ($26), 1	# L0 .. .. ..	: L U L U
+	.end __clear_user
+	EXPORT_SYMBOL(__clear_user)
diff --git a/arch/alpha/lib/ev6-copy_user.S b/arch/alpha/lib/ev6-copy_user.S
index be720b518af9..35e6710d0700 100644
--- a/arch/alpha/lib/ev6-copy_user.S
+++ b/arch/alpha/lib/ev6-copy_user.S
@@ -12,21 +12,6 @@
  * only _after_ a successful copy). There is also some rather minor
  * exception setup stuff..
  *
- * NOTE! This is not directly C-callable, because the calling semantics are
- * different:
- *
- * Inputs:
- *	length in $0
- *	destination address in $6
- *	source address in $7
- *	return address in $28
- *
- * Outputs:
- *	bytes left to copy in $0
- *
- * Clobbers:
- *	$1,$2,$3,$4,$5,$6,$7
- *
  * Much of the information about 21264 scheduling/coding comes from:
  *	Compiler Writer's Guide for the Alpha 21264
  *	abbreviated as 'CWG' in other comments here
@@ -60,10 +45,11 @@
 				# Pipeline info: Slotting & Comments
 __copy_user:
 	.prologue 0
-	subq $0, 32, $1		# .. E  .. ..	: Is this going to be a small copy?
+	andq $18, $18, $0
+	subq $18, 32, $1	# .. E  .. ..	: Is this going to be a small copy?
 	beq $0, $zerolength	# U  .. .. ..	: U L U L
 
-	and $6,7,$3		# .. .. .. E	: is leading dest misalignment
+	and $16,7,$3		# .. .. .. E	: is leading dest misalignment
 	ble $1, $onebyteloop	# .. .. U  ..	: 1st branch : small amount of data
 	beq $3, $destaligned	# .. U  .. ..	: 2nd (one cycle fetcher stall)
 	subq $3, 8, $3		# E  .. .. ..	: L U U L : trip counter
@@ -73,17 +59,17 @@ __copy_user:
  * We know we have at least one trip through this loop
  */
 $aligndest:
-	EXI( ldbu $1,0($7) )	# .. .. .. L	: Keep loads separate from stores
-	addq $6,1,$6		# .. .. E  ..	: Section 3.8 in the CWG
+	EXI( ldbu $1,0($17) )	# .. .. .. L	: Keep loads separate from stores
+	addq $16,1,$16		# .. .. E  ..	: Section 3.8 in the CWG
 	addq $3,1,$3		# .. E  .. ..	:
 	nop			# E  .. .. ..	: U L U L
 
 /*
- * the -1 is to compensate for the inc($6) done in a previous quadpack
+ * the -1 is to compensate for the inc($16) done in a previous quadpack
  * which allows us zero dependencies within either quadpack in the loop
  */
-	EXO( stb $1,-1($6) )	# .. .. .. L	:
-	addq $7,1,$7		# .. .. E  ..	: Section 3.8 in the CWG
+	EXO( stb $1,-1($16) )	# .. .. .. L	:
+	addq $17,1,$17		# .. .. E  ..	: Section 3.8 in the CWG
 	subq $0,1,$0		# .. E  .. ..	:
 	bne $3, $aligndest	# U  .. .. ..	: U L U L
 
@@ -92,29 +78,29 @@ $aligndest:
  * If we arrived via branch, we have a minimum of 32 bytes
  */
 $destaligned:
-	and $7,7,$1		# .. .. .. E	: Check _current_ source alignment
+	and $17,7,$1		# .. .. .. E	: Check _current_ source alignment
 	bic $0,7,$4		# .. .. E  ..	: number bytes as a quadword loop
-	EXI( ldq_u $3,0($7) )	# .. L  .. ..	: Forward fetch for fallthrough code
+	EXI( ldq_u $3,0($17) )	# .. L  .. ..	: Forward fetch for fallthrough code
 	beq $1,$quadaligned	# U  .. .. ..	: U L U L
 
 /*
- * In the worst case, we've just executed an ldq_u here from 0($7)
+ * In the worst case, we've just executed an ldq_u here from 0($17)
  * and we'll repeat it once if we take the branch
  */
 
 /* Misaligned quadword loop - not unrolled.  Leave it that way. */
 $misquad:
-	EXI( ldq_u $2,8($7) )	# .. .. .. L	:
+	EXI( ldq_u $2,8($17) )	# .. .. .. L	:
 	subq $4,8,$4		# .. .. E  ..	:
-	extql $3,$7,$3		# .. U  .. ..	:
-	extqh $2,$7,$1		# U  .. .. ..	: U U L L
+	extql $3,$17,$3		# .. U  .. ..	:
+	extqh $2,$17,$1		# U  .. .. ..	: U U L L
 
 	bis $3,$1,$1		# .. .. .. E	:
-	EXO( stq $1,0($6) )	# .. .. L  ..	:
-	addq $7,8,$7		# .. E  .. ..	:
+	EXO( stq $1,0($16) )	# .. .. L  ..	:
+	addq $17,8,$17		# .. E  .. ..	:
 	subq $0,8,$0		# E  .. .. ..	: U L L U
 
-	addq $6,8,$6		# .. .. .. E	:
+	addq $16,8,$16		# .. .. .. E	:
 	bis $2,$2,$3		# .. .. E  ..	:
 	nop			# .. E  .. ..	:
 	bne $4,$misquad		# U  .. .. ..	: U L U L
@@ -125,8 +111,8 @@ $misquad:
 	beq $0,$zerolength	# U  .. .. ..	: U L U L
 
 /* We know we have at least one trip through the byte loop */
-	EXI ( ldbu $2,0($7) )	# .. .. .. L	: No loads in the same quad
-	addq $6,1,$6		# .. .. E  ..	: as the store (Section 3.8 in CWG)
+	EXI ( ldbu $2,0($17) )	# .. .. .. L	: No loads in the same quad
+	addq $16,1,$16		# .. .. E  ..	: as the store (Section 3.8 in CWG)
 	nop			# .. E  .. ..	:
 	br $31, $dirtyentry	# L0 .. .. ..	: L U U L
 /* Do the trailing byte loop load, then hop into the store part of the loop */
@@ -136,8 +122,8 @@ $misquad:
  * Based upon the usage context, it's worth the effort to unroll this loop
  * $0 - number of bytes to be moved
  * $4 - number of bytes to move as quadwords
- * $6 is current destination address
- * $7 is current source address
+ * $16 is current destination address
+ * $17 is current source address
  */
 $quadaligned:
 	subq	$4, 32, $2	# .. .. .. E	: do not unroll for small stuff
@@ -155,29 +141,29 @@ $quadaligned:
  * instruction memory hint instruction).
  */
 $unroll4:
-	EXI( ldq $1,0($7) )	# .. .. .. L
-	EXI( ldq $2,8($7) )	# .. .. L  ..
+	EXI( ldq $1,0($17) )	# .. .. .. L
+	EXI( ldq $2,8($17) )	# .. .. L  ..
 	subq	$4,32,$4	# .. E  .. ..
 	nop			# E  .. .. ..	: U U L L
 
-	addq	$7,16,$7	# .. .. .. E
-	EXO( stq $1,0($6) )	# .. .. L  ..
-	EXO( stq $2,8($6) )	# .. L  .. ..
+	addq	$17,16,$17	# .. .. .. E
+	EXO( stq $1,0($16) )	# .. .. L  ..
+	EXO( stq $2,8($16) )	# .. L  .. ..
 	subq	$0,16,$0	# E  .. .. ..	: U L L U
 
-	addq	$6,16,$6	# .. .. .. E
-	EXI( ldq $1,0($7) )	# .. .. L  ..
-	EXI( ldq $2,8($7) )	# .. L  .. ..
+	addq	$16,16,$16	# .. .. .. E
+	EXI( ldq $1,0($17) )	# .. .. L  ..
+	EXI( ldq $2,8($17) )	# .. L  .. ..
 	subq	$4, 32, $3	# E  .. .. ..	: U U L L : is there enough for another trip?
 
-	EXO( stq $1,0($6) )	# .. .. .. L
-	EXO( stq $2,8($6) )	# .. .. L  ..
+	EXO( stq $1,0($16) )	# .. .. .. L
+	EXO( stq $2,8($16) )	# .. .. L  ..
 	subq	$0,16,$0	# .. E  .. ..
-	addq	$7,16,$7	# E  .. .. ..	: U L L U
+	addq	$17,16,$17	# E  .. .. ..	: U L L U
 
 	nop			# .. .. .. E
 	nop			# .. .. E  ..
-	addq	$6,16,$6	# .. E  .. ..
+	addq	$16,16,$16	# .. E  .. ..
 	bgt	$3,$unroll4	# U  .. .. ..	: U L U L
 
 	nop
@@ -186,14 +172,14 @@ $unroll4:
 	beq	$4, $noquads
 
 $onequad:
-	EXI( ldq $1,0($7) )
+	EXI( ldq $1,0($17) )
 	subq	$4,8,$4
-	addq	$7,8,$7
+	addq	$17,8,$17
 	nop
 
-	EXO( stq $1,0($6) )
+	EXO( stq $1,0($16) )
 	subq	$0,8,$0
-	addq	$6,8,$6
+	addq	$16,8,$16
 	bne	$4,$onequad
 
 $noquads:
@@ -207,23 +193,23 @@ $noquads:
  * There's no point in doing a lot of complex alignment calculations to try to
  * to quadword stuff for a small amount of data.
  *	$0 - remaining number of bytes left to copy
- *	$6 - current dest addr
- *	$7 - current source addr
+ *	$16 - current dest addr
+ *	$17 - current source addr
  */
 
 $onebyteloop:
-	EXI ( ldbu $2,0($7) )	# .. .. .. L	: No loads in the same quad
-	addq $6,1,$6		# .. .. E  ..	: as the store (Section 3.8 in CWG)
+	EXI ( ldbu $2,0($17) )	# .. .. .. L	: No loads in the same quad
+	addq $16,1,$16		# .. .. E  ..	: as the store (Section 3.8 in CWG)
 	nop			# .. E  .. ..	:
 	nop			# E  .. .. ..	: U L U L
 
 $dirtyentry:
 /*
- * the -1 is to compensate for the inc($6) done in a previous quadpack
+ * the -1 is to compensate for the inc($16) done in a previous quadpack
  * which allows us zero dependencies within either quadpack in the loop
  */
-	EXO ( stb $2,-1($6) )	# .. .. .. L	:
-	addq $7,1,$7		# .. .. E  ..	: quadpack as the load
+	EXO ( stb $2,-1($16) )	# .. .. .. L	:
+	addq $17,1,$17		# .. .. E  ..	: quadpack as the load
 	subq $0,1,$0		# .. E  .. ..	: change count _after_ copy
 	bgt $0,$onebyteloop	# U  .. .. ..	: U L U L
 
@@ -233,7 +219,7 @@ $exitout:			# Destination for exception recovery(?)
 	nop			# .. .. .. E
 	nop			# .. .. E  ..
 	nop			# .. E  .. ..
-	ret $31,($28),1		# L0 .. .. ..	: L U L U
+	ret $31,($26),1		# L0 .. .. ..	: L U L U
 
 	.end __copy_user
 	EXPORT_SYMBOL(__copy_user)

From aa7dcb81c10195217e7105c5dafa53d3469a62c9 Mon Sep 17 00:00:00 2001
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
Date: Thu, 4 Mar 2021 07:34:11 +0530
Subject: [PATCH 1717/2658] powerpc/64s: Fix instruction encoding for lis in
 ppc_function_entry()

commit cea15316ceee2d4a51dfdecd79e08a438135416c upstream.

'lis r2,N' is 'addis r2,0,N' and the instruction encoding in the macro
LIS_R2 is incorrect (it currently maps to 'addis r0,r2,N'). Fix the
same.

Fixes: c71b7eff426f ("powerpc: Add ABIv2 support to ppc_function_entry")
Cc: stable@vger.kernel.org # v3.16+
Reported-by: Jiri Olsa <jolsa@redhat.com>
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Acked-by: Segher Boessenkool <segher@kernel.crashing.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210304020411.16796-1-naveen.n.rao@linux.vnet.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/include/asm/code-patching.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/include/asm/code-patching.h b/arch/powerpc/include/asm/code-patching.h
index a734b4b34d26..9c7eb907b165 100644
--- a/arch/powerpc/include/asm/code-patching.h
+++ b/arch/powerpc/include/asm/code-patching.h
@@ -45,7 +45,7 @@ void __patch_exception(int exc, unsigned long addr);
 #endif
 
 #define OP_RT_RA_MASK	0xffff0000UL
-#define LIS_R2		0x3c020000UL
+#define LIS_R2		0x3c400000UL
 #define ADDIS_R2_R12	0x3c4c0000UL
 #define ADDI_R2_R2	0x38420000UL
 

From f040f2f5e3b84c4f3cba4414db5d9c09821c160c Mon Sep 17 00:00:00 2001
From: Arvind Yadav <arvind.yadav.cs@gmail.com>
Date: Fri, 22 Sep 2017 09:07:06 -0400
Subject: [PATCH 1718/2658] media: hdpvr: Fix an error handling path in
 hdpvr_probe()

commit c0f71bbb810237a38734607ca4599632f7f5d47f upstream.

Here, hdpvr_register_videodev() is responsible for setup and
register a video device. Also defining and initializing a worker.
hdpvr_register_videodev() is calling by hdpvr_probe at last.
So no need to flush any work here.
Unregister v4l2, free buffers and memory. If hdpvr_probe() will fail.

Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
[krzk: backport to v4.4, still using single thread workqueue which
       is drained/destroyed now in proper step so it cannot be NULL]
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/hdpvr/hdpvr-core.c | 33 ++++++++++++++++------------
 1 file changed, 19 insertions(+), 14 deletions(-)

diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c
index 7b5c493f02b0..9f95b048123d 100644
--- a/drivers/media/usb/hdpvr/hdpvr-core.c
+++ b/drivers/media/usb/hdpvr/hdpvr-core.c
@@ -297,7 +297,7 @@ static int hdpvr_probe(struct usb_interface *interface,
 	/* register v4l2_device early so it can be used for printks */
 	if (v4l2_device_register(&interface->dev, &dev->v4l2_dev)) {
 		dev_err(&interface->dev, "v4l2_device_register failed\n");
-		goto error;
+		goto error_free_dev;
 	}
 
 	mutex_init(&dev->io_mutex);
@@ -306,7 +306,7 @@ static int hdpvr_probe(struct usb_interface *interface,
 	dev->usbc_buf = kmalloc(64, GFP_KERNEL);
 	if (!dev->usbc_buf) {
 		v4l2_err(&dev->v4l2_dev, "Out of memory\n");
-		goto error;
+		goto error_v4l2_unregister;
 	}
 
 	init_waitqueue_head(&dev->wait_buffer);
@@ -314,7 +314,7 @@ static int hdpvr_probe(struct usb_interface *interface,
 
 	dev->workqueue = create_singlethread_workqueue("hdpvr_buffer");
 	if (!dev->workqueue)
-		goto error;
+		goto err_free_usbc;
 
 	dev->options = hdpvr_default_options;
 
@@ -348,13 +348,13 @@ static int hdpvr_probe(struct usb_interface *interface,
 	}
 	if (!dev->bulk_in_endpointAddr) {
 		v4l2_err(&dev->v4l2_dev, "Could not find bulk-in endpoint\n");
-		goto error;
+		goto error_put_usb;
 	}
 
 	/* init the device */
 	if (hdpvr_device_init(dev)) {
 		v4l2_err(&dev->v4l2_dev, "device init failed\n");
-		goto error;
+		goto error_put_usb;
 	}
 
 	mutex_lock(&dev->io_mutex);
@@ -362,7 +362,7 @@ static int hdpvr_probe(struct usb_interface *interface,
 		mutex_unlock(&dev->io_mutex);
 		v4l2_err(&dev->v4l2_dev,
 			 "allocating transfer buffers failed\n");
-		goto error;
+		goto error_put_usb;
 	}
 	mutex_unlock(&dev->io_mutex);
 
@@ -370,7 +370,7 @@ static int hdpvr_probe(struct usb_interface *interface,
 	retval = hdpvr_register_i2c_adapter(dev);
 	if (retval < 0) {
 		v4l2_err(&dev->v4l2_dev, "i2c adapter register failed\n");
-		goto error;
+		goto error_free_buffers;
 	}
 
 	client = hdpvr_register_ir_rx_i2c(dev);
@@ -412,15 +412,20 @@ static int hdpvr_probe(struct usb_interface *interface,
 reg_fail:
 #if IS_ENABLED(CONFIG_I2C)
 	i2c_del_adapter(&dev->i2c_adapter);
+error_free_buffers:
 #endif
+	hdpvr_free_buffers(dev);
+error_put_usb:
+	usb_put_dev(dev->udev);
+	/* Destroy single thread */
+	destroy_workqueue(dev->workqueue);
+err_free_usbc:
+	kfree(dev->usbc_buf);
+error_v4l2_unregister:
+	v4l2_device_unregister(&dev->v4l2_dev);
+error_free_dev:
+	kfree(dev);
 error:
-	if (dev) {
-		/* Destroy single thread */
-		if (dev->workqueue)
-			destroy_workqueue(dev->workqueue);
-		/* this frees allocated memory */
-		hdpvr_delete(dev);
-	}
 	return retval;
 }
 

From ee62938221abc38ee0acb3841b40582d58d25ec2 Mon Sep 17 00:00:00 2001
From: Marc Zyngier <maz@kernel.org>
Date: Mon, 15 Mar 2021 11:46:46 +0000
Subject: [PATCH 1719/2658] KVM: arm64: Fix exclusive limit for IPA size

Commit 262b003d059c6671601a19057e9fe1a5e7f23722 upstream.

When registering a memslot, we check the size and location of that
memslot against the IPA size to ensure that we can provide guest
access to the whole of the memory.

Unfortunately, this check rejects memslot that end-up at the exact
limit of the addressing capability for a given IPA size. For example,
it refuses the creation of a 2GB memslot at 0x8000000 with a 32bit
IPA space.

Fix it by relaxing the check to accept a memslot reaching the
limit of the IPA space.

Fixes: c3058d5da222 ("arm/arm64: KVM: Ensure memslots are within KVM_PHYS_SIZE")
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org # 4.4, 4.9
Reviewed-by: Andrew Jones <drjones@redhat.com>
Link: https://lore.kernel.org/r/20210311100016.3830038-3-maz@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/kvm/mmu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 5979436048d6..4242d8593f81 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -1801,7 +1801,7 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
 	 * Prevent userspace from creating a memory region outside of the IPA
 	 * space addressable by the KVM guest IPA space.
 	 */
-	if (memslot->base_gfn + memslot->npages >=
+	if (memslot->base_gfn + memslot->npages >
 	    (KVM_PHYS_SIZE >> PAGE_SHIFT))
 		return -EFAULT;
 

From 66082d828bbdb3c5ac8985cdf2bd34ad54830073 Mon Sep 17 00:00:00 2001
From: Navid Emamdoost <navid.emamdoost@gmail.com>
Date: Sat, 13 Mar 2021 18:29:49 +0100
Subject: [PATCH 1720/2658] iio: imu: adis16400: release allocated memory on
 failure

commit ab612b1daf415b62c58e130cb3d0f30b255a14d0 upstream.

In adis_update_scan_mode, if allocation for adis->buffer fails,
previously allocated adis->xfer needs to be released.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/imu/adis_buffer.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/imu/adis_buffer.c b/drivers/iio/imu/adis_buffer.c
index 36607d52fee0..9de553e8c214 100644
--- a/drivers/iio/imu/adis_buffer.c
+++ b/drivers/iio/imu/adis_buffer.c
@@ -39,8 +39,11 @@ int adis_update_scan_mode(struct iio_dev *indio_dev,
 		return -ENOMEM;
 
 	adis->buffer = kzalloc(indio_dev->scan_bytes * 2, GFP_KERNEL);
-	if (!adis->buffer)
+	if (!adis->buffer) {
+		kfree(adis->xfer);
+		adis->xfer = NULL;
 		return -ENOMEM;
+	}
 
 	rx = adis->buffer;
 	tx = rx + scan_count;

From 3102cf4bf4ed096f577576b94368e39a7c229332 Mon Sep 17 00:00:00 2001
From: Navid Emamdoost <navid.emamdoost@gmail.com>
Date: Sat, 13 Mar 2021 18:29:50 +0100
Subject: [PATCH 1721/2658] iio: imu: adis16400: fix memory leak

commit 9c0530e898f384c5d279bfcebd8bb17af1105873 upstream.

In adis_update_scan_mode_burst, if adis->buffer allocation fails release
the adis->xfer.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
[krzk: backport applied to adis16400_buffer.c instead of adis_buffer.c]
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/imu/adis16400_buffer.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/imu/adis16400_buffer.c b/drivers/iio/imu/adis16400_buffer.c
index 90c24a23c679..c0eb9dfd1c45 100644
--- a/drivers/iio/imu/adis16400_buffer.c
+++ b/drivers/iio/imu/adis16400_buffer.c
@@ -37,8 +37,11 @@ int adis16400_update_scan_mode(struct iio_dev *indio_dev,
 		return -ENOMEM;
 
 	adis->buffer = kzalloc(burst_length + sizeof(u16), GFP_KERNEL);
-	if (!adis->buffer)
+	if (!adis->buffer) {
+		kfree(adis->xfer);
+		adis->xfer = NULL;
 		return -ENOMEM;
+	}
 
 	tx = adis->buffer + burst_length;
 	tx[0] = ADIS_READ_REG(ADIS16400_GLOB_CMD);

From d0318d6e42b33a88b8853eba513cb64c86a3034f Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Mon, 15 Mar 2021 09:54:02 +0100
Subject: [PATCH 1722/2658] xen/events: reset affinity of 2-level event when
 tearing it down

commit 9e77d96b8e2724ed00380189f7b0ded61113b39f upstream.

When creating a new event channel with 2-level events the affinity
needs to be reset initially in order to avoid using an old affinity
from earlier usage of the event channel port. So when tearing an event
channel down reset all affinity bits.

The same applies to the affinity when onlining a vcpu: all old
affinity settings for this vcpu must be reset. As percpu events get
initialized before the percpu event channel hook is called,
resetting of the affinities happens after offlining a vcpu (this is
working, as initial percpu memory is zeroed out).

Cc: stable@vger.kernel.org
Reported-by: Julien Grall <julien@xen.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
Link: https://lore.kernel.org/r/20210306161833.4552-2-jgross@suse.com
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/events/events_2l.c       | 15 +++++++++++++++
 drivers/xen/events/events_base.c     |  1 +
 drivers/xen/events/events_internal.h |  8 ++++++++
 3 files changed, 24 insertions(+)

diff --git a/drivers/xen/events/events_2l.c b/drivers/xen/events/events_2l.c
index e902512fcfb5..474eefa9eb0f 100644
--- a/drivers/xen/events/events_2l.c
+++ b/drivers/xen/events/events_2l.c
@@ -46,6 +46,11 @@ static unsigned evtchn_2l_max_channels(void)
 	return EVTCHN_2L_NR_CHANNELS;
 }
 
+static void evtchn_2l_remove(evtchn_port_t evtchn, unsigned int cpu)
+{
+	clear_bit(evtchn, BM(per_cpu(cpu_evtchn_mask, cpu)));
+}
+
 static void evtchn_2l_bind_to_cpu(struct irq_info *info, unsigned cpu)
 {
 	clear_bit(info->evtchn, BM(per_cpu(cpu_evtchn_mask, info->cpu)));
@@ -353,9 +358,18 @@ static void evtchn_2l_resume(void)
 				EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD);
 }
 
+static int evtchn_2l_percpu_deinit(unsigned int cpu)
+{
+	memset(per_cpu(cpu_evtchn_mask, cpu), 0, sizeof(xen_ulong_t) *
+			EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD);
+
+	return 0;
+}
+
 static const struct evtchn_ops evtchn_ops_2l = {
 	.max_channels      = evtchn_2l_max_channels,
 	.nr_channels       = evtchn_2l_max_channels,
+	.remove            = evtchn_2l_remove,
 	.bind_to_cpu       = evtchn_2l_bind_to_cpu,
 	.clear_pending     = evtchn_2l_clear_pending,
 	.set_pending       = evtchn_2l_set_pending,
@@ -365,6 +379,7 @@ static const struct evtchn_ops evtchn_ops_2l = {
 	.unmask            = evtchn_2l_unmask,
 	.handle_events     = evtchn_2l_handle_events,
 	.resume	           = evtchn_2l_resume,
+	.percpu_deinit     = evtchn_2l_percpu_deinit,
 };
 
 void __init xen_evtchn_2l_init(void)
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index ec4074c66d9d..470b853a976d 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -286,6 +286,7 @@ static int xen_irq_info_pirq_setup(unsigned irq,
 static void xen_irq_info_cleanup(struct irq_info *info)
 {
 	set_evtchn_to_irq(info->evtchn, -1);
+	xen_evtchn_port_remove(info->evtchn, info->cpu);
 	info->evtchn = 0;
 }
 
diff --git a/drivers/xen/events/events_internal.h b/drivers/xen/events/events_internal.h
index b9b4f5919893..f5fba722432f 100644
--- a/drivers/xen/events/events_internal.h
+++ b/drivers/xen/events/events_internal.h
@@ -67,6 +67,7 @@ struct evtchn_ops {
 	unsigned (*nr_channels)(void);
 
 	int (*setup)(struct irq_info *info);
+	void (*remove)(evtchn_port_t port, unsigned int cpu);
 	void (*bind_to_cpu)(struct irq_info *info, unsigned cpu);
 
 	void (*clear_pending)(unsigned port);
@@ -109,6 +110,13 @@ static inline int xen_evtchn_port_setup(struct irq_info *info)
 	return 0;
 }
 
+static inline void xen_evtchn_port_remove(evtchn_port_t evtchn,
+					  unsigned int cpu)
+{
+	if (evtchn_ops->remove)
+		evtchn_ops->remove(evtchn, cpu);
+}
+
 static inline void xen_evtchn_port_bind_to_cpu(struct irq_info *info,
 					       unsigned cpu)
 {

From 1fb1f3bb0facbeca3f504787675398f7dad95999 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Mon, 15 Mar 2021 09:55:36 +0100
Subject: [PATCH 1723/2658] xen/events: don't unmask an event channel when an
 eoi is pending

commit 25da4618af240fbec6112401498301a6f2bc9702 upstream.

An event channel should be kept masked when an eoi is pending for it.
When being migrated to another cpu it might be unmasked, though.

In order to avoid this keep three different flags for each event channel
to be able to distinguish "normal" masking/unmasking from eoi related
masking/unmasking and temporary masking. The event channel should only
be able to generate an interrupt if all flags are cleared.

Cc: stable@vger.kernel.org
Fixes: 54c9de89895e ("xen/events: add a new "late EOI" evtchn framework")
Reported-by: Julien Grall <julien@xen.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Tested-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Link: https://lore.kernel.org/r/20210306161833.4552-3-jgross@suse.com

[boris -- corrected Fixed tag format]

Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/events/events_2l.c       |   7 --
 drivers/xen/events/events_base.c     | 108 ++++++++++++++++++++-------
 drivers/xen/events/events_fifo.c     |   7 --
 drivers/xen/events/events_internal.h |  13 ++--
 4 files changed, 87 insertions(+), 48 deletions(-)

diff --git a/drivers/xen/events/events_2l.c b/drivers/xen/events/events_2l.c
index 474eefa9eb0f..ca729f19061d 100644
--- a/drivers/xen/events/events_2l.c
+++ b/drivers/xen/events/events_2l.c
@@ -75,12 +75,6 @@ static bool evtchn_2l_is_pending(unsigned port)
 	return sync_test_bit(port, BM(&s->evtchn_pending[0]));
 }
 
-static bool evtchn_2l_test_and_set_mask(unsigned port)
-{
-	struct shared_info *s = HYPERVISOR_shared_info;
-	return sync_test_and_set_bit(port, BM(&s->evtchn_mask[0]));
-}
-
 static void evtchn_2l_mask(unsigned port)
 {
 	struct shared_info *s = HYPERVISOR_shared_info;
@@ -374,7 +368,6 @@ static const struct evtchn_ops evtchn_ops_2l = {
 	.clear_pending     = evtchn_2l_clear_pending,
 	.set_pending       = evtchn_2l_set_pending,
 	.is_pending        = evtchn_2l_is_pending,
-	.test_and_set_mask = evtchn_2l_test_and_set_mask,
 	.mask              = evtchn_2l_mask,
 	.unmask            = evtchn_2l_unmask,
 	.handle_events     = evtchn_2l_handle_events,
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 470b853a976d..acf6dc63a3cd 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -99,6 +99,7 @@ static DEFINE_RWLOCK(evtchn_rwlock);
  *   evtchn_rwlock
  *     IRQ-desc lock
  *       percpu eoi_list_lock
+ *         irq_info->lock
  */
 
 static LIST_HEAD(xen_irq_list_head);
@@ -220,6 +221,8 @@ static int xen_irq_info_common_setup(struct irq_info *info,
 	info->irq = irq;
 	info->evtchn = evtchn;
 	info->cpu = cpu;
+	info->mask_reason = EVT_MASK_REASON_EXPLICIT;
+	spin_lock_init(&info->lock);
 
 	ret = set_evtchn_to_irq(evtchn, irq);
 	if (ret < 0)
@@ -367,6 +370,34 @@ unsigned int cpu_from_evtchn(unsigned int evtchn)
 	return ret;
 }
 
+static void do_mask(struct irq_info *info, u8 reason)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&info->lock, flags);
+
+	if (!info->mask_reason)
+		mask_evtchn(info->evtchn);
+
+	info->mask_reason |= reason;
+
+	spin_unlock_irqrestore(&info->lock, flags);
+}
+
+static void do_unmask(struct irq_info *info, u8 reason)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&info->lock, flags);
+
+	info->mask_reason &= ~reason;
+
+	if (!info->mask_reason)
+		unmask_evtchn(info->evtchn);
+
+	spin_unlock_irqrestore(&info->lock, flags);
+}
+
 #ifdef CONFIG_X86
 static bool pirq_check_eoi_map(unsigned irq)
 {
@@ -502,7 +533,7 @@ static void xen_irq_lateeoi_locked(struct irq_info *info, bool spurious)
 	}
 
 	info->eoi_time = 0;
-	unmask_evtchn(evtchn);
+	do_unmask(info, EVT_MASK_REASON_EOI_PENDING);
 }
 
 static void xen_irq_lateeoi_worker(struct work_struct *work)
@@ -689,7 +720,8 @@ static void pirq_query_unmask(int irq)
 
 static void eoi_pirq(struct irq_data *data)
 {
-	int evtchn = evtchn_from_irq(data->irq);
+	struct irq_info *info = info_for_irq(data->irq);
+	int evtchn = info ? info->evtchn : 0;
 	struct physdev_eoi eoi = { .irq = pirq_from_irq(data->irq) };
 	int rc = 0;
 
@@ -698,14 +730,13 @@ static void eoi_pirq(struct irq_data *data)
 
 	if (unlikely(irqd_is_setaffinity_pending(data)) &&
 	    likely(!irqd_irq_disabled(data))) {
-		int masked = test_and_set_mask(evtchn);
+		do_mask(info, EVT_MASK_REASON_TEMPORARY);
 
 		clear_evtchn(evtchn);
 
 		irq_move_masked_irq(data);
 
-		if (!masked)
-			unmask_evtchn(evtchn);
+		do_unmask(info, EVT_MASK_REASON_TEMPORARY);
 	} else
 		clear_evtchn(evtchn);
 
@@ -758,7 +789,8 @@ static unsigned int __startup_pirq(unsigned int irq)
 		goto err;
 
 out:
-	unmask_evtchn(evtchn);
+	do_unmask(info, EVT_MASK_REASON_EXPLICIT);
+
 	eoi_pirq(irq_get_irq_data(irq));
 
 	return 0;
@@ -785,7 +817,7 @@ static void shutdown_pirq(struct irq_data *data)
 	if (!VALID_EVTCHN(evtchn))
 		return;
 
-	mask_evtchn(evtchn);
+	do_mask(info, EVT_MASK_REASON_EXPLICIT);
 	xen_evtchn_close(evtchn);
 	xen_irq_info_cleanup(info);
 }
@@ -1647,8 +1679,8 @@ void rebind_evtchn_irq(int evtchn, int irq)
 static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
 {
 	struct evtchn_bind_vcpu bind_vcpu;
-	int evtchn = evtchn_from_irq(irq);
-	int masked;
+	struct irq_info *info = info_for_irq(irq);
+	int evtchn = info ? info->evtchn : 0;
 
 	if (!VALID_EVTCHN(evtchn))
 		return -1;
@@ -1664,7 +1696,7 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
 	 * Mask the event while changing the VCPU binding to prevent
 	 * it being delivered on an unexpected VCPU.
 	 */
-	masked = test_and_set_mask(evtchn);
+	do_mask(info, EVT_MASK_REASON_TEMPORARY);
 
 	/*
 	 * If this fails, it usually just indicates that we're dealing with a
@@ -1674,8 +1706,7 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
 	if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0)
 		bind_evtchn_to_cpu(evtchn, tcpu);
 
-	if (!masked)
-		unmask_evtchn(evtchn);
+	do_unmask(info, EVT_MASK_REASON_TEMPORARY);
 
 	return 0;
 }
@@ -1690,37 +1721,39 @@ static int set_affinity_irq(struct irq_data *data, const struct cpumask *dest,
 
 static void enable_dynirq(struct irq_data *data)
 {
-	int evtchn = evtchn_from_irq(data->irq);
+	struct irq_info *info = info_for_irq(data->irq);
+	evtchn_port_t evtchn = info ? info->evtchn : 0;
 
 	if (VALID_EVTCHN(evtchn))
-		unmask_evtchn(evtchn);
+		do_unmask(info, EVT_MASK_REASON_EXPLICIT);
 }
 
 static void disable_dynirq(struct irq_data *data)
 {
-	int evtchn = evtchn_from_irq(data->irq);
+	struct irq_info *info = info_for_irq(data->irq);
+	evtchn_port_t evtchn = info ? info->evtchn : 0;
 
 	if (VALID_EVTCHN(evtchn))
-		mask_evtchn(evtchn);
+		do_mask(info, EVT_MASK_REASON_EXPLICIT);
 }
 
 static void ack_dynirq(struct irq_data *data)
 {
-	int evtchn = evtchn_from_irq(data->irq);
+	struct irq_info *info = info_for_irq(data->irq);
+	evtchn_port_t evtchn = info ? info->evtchn : 0;
 
 	if (!VALID_EVTCHN(evtchn))
 		return;
 
 	if (unlikely(irqd_is_setaffinity_pending(data)) &&
 	    likely(!irqd_irq_disabled(data))) {
-		int masked = test_and_set_mask(evtchn);
+		do_mask(info, EVT_MASK_REASON_TEMPORARY);
 
 		clear_evtchn(evtchn);
 
 		irq_move_masked_irq(data);
 
-		if (!masked)
-			unmask_evtchn(evtchn);
+		do_unmask(info, EVT_MASK_REASON_TEMPORARY);
 	} else
 		clear_evtchn(evtchn);
 }
@@ -1731,18 +1764,39 @@ static void mask_ack_dynirq(struct irq_data *data)
 	ack_dynirq(data);
 }
 
+static void lateeoi_ack_dynirq(struct irq_data *data)
+{
+	struct irq_info *info = info_for_irq(data->irq);
+	evtchn_port_t evtchn = info ? info->evtchn : 0;
+
+	if (VALID_EVTCHN(evtchn)) {
+		do_mask(info, EVT_MASK_REASON_EOI_PENDING);
+		clear_evtchn(evtchn);
+	}
+}
+
+static void lateeoi_mask_ack_dynirq(struct irq_data *data)
+{
+	struct irq_info *info = info_for_irq(data->irq);
+	evtchn_port_t evtchn = info ? info->evtchn : 0;
+
+	if (VALID_EVTCHN(evtchn)) {
+		do_mask(info, EVT_MASK_REASON_EXPLICIT);
+		clear_evtchn(evtchn);
+	}
+}
+
 static int retrigger_dynirq(struct irq_data *data)
 {
-	unsigned int evtchn = evtchn_from_irq(data->irq);
-	int masked;
+	struct irq_info *info = info_for_irq(data->irq);
+	evtchn_port_t evtchn = info ? info->evtchn : 0;
 
 	if (!VALID_EVTCHN(evtchn))
 		return 0;
 
-	masked = test_and_set_mask(evtchn);
+	do_mask(info, EVT_MASK_REASON_TEMPORARY);
 	set_evtchn(evtchn);
-	if (!masked)
-		unmask_evtchn(evtchn);
+	do_unmask(info, EVT_MASK_REASON_TEMPORARY);
 
 	return 1;
 }
@@ -1949,8 +2003,8 @@ static struct irq_chip xen_lateeoi_chip __read_mostly = {
 	.irq_mask		= disable_dynirq,
 	.irq_unmask		= enable_dynirq,
 
-	.irq_ack		= mask_ack_dynirq,
-	.irq_mask_ack		= mask_ack_dynirq,
+	.irq_ack		= lateeoi_ack_dynirq,
+	.irq_mask_ack		= lateeoi_mask_ack_dynirq,
 
 	.irq_set_affinity	= set_affinity_irq,
 	.irq_retrigger		= retrigger_dynirq,
diff --git a/drivers/xen/events/events_fifo.c b/drivers/xen/events/events_fifo.c
index 7addca0d8d26..5e6ff2120132 100644
--- a/drivers/xen/events/events_fifo.c
+++ b/drivers/xen/events/events_fifo.c
@@ -209,12 +209,6 @@ static bool evtchn_fifo_is_pending(unsigned port)
 	return sync_test_bit(EVTCHN_FIFO_BIT(PENDING, word), BM(word));
 }
 
-static bool evtchn_fifo_test_and_set_mask(unsigned port)
-{
-	event_word_t *word = event_word_from_port(port);
-	return sync_test_and_set_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word));
-}
-
 static void evtchn_fifo_mask(unsigned port)
 {
 	event_word_t *word = event_word_from_port(port);
@@ -421,7 +415,6 @@ static const struct evtchn_ops evtchn_ops_fifo = {
 	.clear_pending     = evtchn_fifo_clear_pending,
 	.set_pending       = evtchn_fifo_set_pending,
 	.is_pending        = evtchn_fifo_is_pending,
-	.test_and_set_mask = evtchn_fifo_test_and_set_mask,
 	.mask              = evtchn_fifo_mask,
 	.unmask            = evtchn_fifo_unmask,
 	.handle_events     = evtchn_fifo_handle_events,
diff --git a/drivers/xen/events/events_internal.h b/drivers/xen/events/events_internal.h
index f5fba722432f..65a08c374329 100644
--- a/drivers/xen/events/events_internal.h
+++ b/drivers/xen/events/events_internal.h
@@ -35,13 +35,18 @@ struct irq_info {
 	struct list_head eoi_list;
 	short refcnt;
 	short spurious_cnt;
-	enum xen_irq_type type;	/* type */
+	short type;		/* type */
+	u8 mask_reason;		/* Why is event channel masked */
+#define EVT_MASK_REASON_EXPLICIT	0x01
+#define EVT_MASK_REASON_TEMPORARY	0x02
+#define EVT_MASK_REASON_EOI_PENDING	0x04
 	unsigned irq;
 	unsigned int evtchn;	/* event channel */
 	unsigned short cpu;	/* cpu bound */
 	unsigned short eoi_cpu;	/* EOI must happen on this cpu */
 	unsigned int irq_epoch;	/* If eoi_cpu valid: irq_epoch of event */
 	u64 eoi_time;		/* Time in jiffies when to EOI. */
+	spinlock_t lock;
 
 	union {
 		unsigned short virq;
@@ -73,7 +78,6 @@ struct evtchn_ops {
 	void (*clear_pending)(unsigned port);
 	void (*set_pending)(unsigned port);
 	bool (*is_pending)(unsigned port);
-	bool (*test_and_set_mask)(unsigned port);
 	void (*mask)(unsigned port);
 	void (*unmask)(unsigned port);
 
@@ -138,11 +142,6 @@ static inline bool test_evtchn(unsigned port)
 	return evtchn_ops->is_pending(port);
 }
 
-static inline bool test_and_set_mask(unsigned port)
-{
-	return evtchn_ops->test_and_set_mask(port);
-}
-
 static inline void mask_evtchn(unsigned port)
 {
 	return evtchn_ops->mask(port);

From 6a3e2efa582d95767c727fd410a2db5eb8a0b8ed Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Mon, 15 Mar 2021 10:06:31 +0100
Subject: [PATCH 1724/2658] xen/events: avoid handling the same event on two
 cpus at the same time

commit b6622798bc50b625a1e62f82c7190df40c1f5b21 upstream.

When changing the cpu affinity of an event it can happen today that
(with some unlucky timing) the same event will be handled on the old
and the new cpu at the same time.

Avoid that by adding an "event active" flag to the per-event data and
call the handler only if this flag isn't set.

Cc: stable@vger.kernel.org
Reported-by: Julien Grall <julien@xen.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
Link: https://lore.kernel.org/r/20210306161833.4552-4-jgross@suse.com
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/events/events_base.c     | 25 +++++++++++++++++--------
 drivers/xen/events/events_internal.h |  1 +
 2 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index acf6dc63a3cd..d1e68b483595 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -702,6 +702,12 @@ static void xen_evtchn_close(unsigned int port)
 		BUG();
 }
 
+static void event_handler_exit(struct irq_info *info)
+{
+	smp_store_release(&info->is_active, 0);
+	clear_evtchn(info->evtchn);
+}
+
 static void pirq_query_unmask(int irq)
 {
 	struct physdev_irq_status_query irq_status;
@@ -732,13 +738,13 @@ static void eoi_pirq(struct irq_data *data)
 	    likely(!irqd_irq_disabled(data))) {
 		do_mask(info, EVT_MASK_REASON_TEMPORARY);
 
-		clear_evtchn(evtchn);
+		event_handler_exit(info);
 
 		irq_move_masked_irq(data);
 
 		do_unmask(info, EVT_MASK_REASON_TEMPORARY);
 	} else
-		clear_evtchn(evtchn);
+		event_handler_exit(info);
 
 	if (pirq_needs_eoi(data->irq)) {
 		rc = HYPERVISOR_physdev_op(PHYSDEVOP_eoi, &eoi);
@@ -1573,6 +1579,8 @@ void handle_irq_for_port(evtchn_port_t port, struct evtchn_loop_ctrl *ctrl)
 	}
 
 	info = info_for_irq(irq);
+	if (xchg_acquire(&info->is_active, 1))
+		return;
 
 	if (ctrl->defer_eoi) {
 		info->eoi_cpu = smp_processor_id();
@@ -1749,13 +1757,13 @@ static void ack_dynirq(struct irq_data *data)
 	    likely(!irqd_irq_disabled(data))) {
 		do_mask(info, EVT_MASK_REASON_TEMPORARY);
 
-		clear_evtchn(evtchn);
+		event_handler_exit(info);
 
 		irq_move_masked_irq(data);
 
 		do_unmask(info, EVT_MASK_REASON_TEMPORARY);
 	} else
-		clear_evtchn(evtchn);
+		event_handler_exit(info);
 }
 
 static void mask_ack_dynirq(struct irq_data *data)
@@ -1771,7 +1779,7 @@ static void lateeoi_ack_dynirq(struct irq_data *data)
 
 	if (VALID_EVTCHN(evtchn)) {
 		do_mask(info, EVT_MASK_REASON_EOI_PENDING);
-		clear_evtchn(evtchn);
+		event_handler_exit(info);
 	}
 }
 
@@ -1782,7 +1790,7 @@ static void lateeoi_mask_ack_dynirq(struct irq_data *data)
 
 	if (VALID_EVTCHN(evtchn)) {
 		do_mask(info, EVT_MASK_REASON_EXPLICIT);
-		clear_evtchn(evtchn);
+		event_handler_exit(info);
 	}
 }
 
@@ -1891,10 +1899,11 @@ static void restore_cpu_ipis(unsigned int cpu)
 /* Clear an irq's pending state, in preparation for polling on it */
 void xen_clear_irq_pending(int irq)
 {
-	int evtchn = evtchn_from_irq(irq);
+	struct irq_info *info = info_for_irq(irq);
+	evtchn_port_t evtchn = info ? info->evtchn : 0;
 
 	if (VALID_EVTCHN(evtchn))
-		clear_evtchn(evtchn);
+		event_handler_exit(info);
 }
 EXPORT_SYMBOL(xen_clear_irq_pending);
 void xen_set_irq_pending(int irq)
diff --git a/drivers/xen/events/events_internal.h b/drivers/xen/events/events_internal.h
index 65a08c374329..3df6f28b75e6 100644
--- a/drivers/xen/events/events_internal.h
+++ b/drivers/xen/events/events_internal.h
@@ -40,6 +40,7 @@ struct irq_info {
 #define EVT_MASK_REASON_EXPLICIT	0x01
 #define EVT_MASK_REASON_TEMPORARY	0x02
 #define EVT_MASK_REASON_EOI_PENDING	0x04
+	u8 is_active;		/* Is event just being handled? */
 	unsigned irq;
 	unsigned int evtchn;	/* event channel */
 	unsigned short cpu;	/* cpu bound */

From bae694e11fe618b049ea5c6b70777420a58111be Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 17 Mar 2021 16:07:24 +0100
Subject: [PATCH 1725/2658] Linux 4.4.262

Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Link: https://lore.kernel.org/r/20210315135208.252034256@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 5df806fe1f2f..421b1d31c5a4 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 261
+SUBLEVEL = 262
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 0d323299e6a4f0567833108b2d1804bc5ffb5d23 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Wed, 17 Mar 2021 17:44:12 +0100
Subject: [PATCH 1726/2658] ext4: handle error of ext4_setup_system_zone() on
 remount

commit d176b1f62f242ab259ff665a26fbac69db1aecba upstream.

ext4_setup_system_zone() can fail. Handle the failure in ext4_remount().

Reviewed-by: Lukas Czerner <lczerner@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20200728130437.7804-2-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/super.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index ba0e52fa3e56..69425c02bbb6 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -4961,7 +4961,10 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
 		ext4_register_li_request(sb, first_not_zeroed);
 	}
 
-	ext4_setup_system_zone(sb);
+	err = ext4_setup_system_zone(sb);
+	if (err)
+		goto restore_opts;
+
 	if (sbi->s_journal == NULL && !(old_sb_flags & MS_RDONLY))
 		ext4_commit_super(sb, 1);
 

From d2dba733e61311b36ddc5ba9697c7e25b052d942 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Wed, 17 Mar 2021 17:44:13 +0100
Subject: [PATCH 1727/2658] ext4: don't allow overlapping system zones

commit bf9a379d0980e7413d94cb18dac73db2bfc5f470 upstream.

Currently, add_system_zone() just silently merges two added system zones
that overlap. However the overlap should not happen and it generally
suggests that some unrelated metadata overlap which indicates the fs is
corrupted. We should have caught such problems earlier (e.g. in
ext4_check_descriptors()) but add this check as another line of defense.
In later patch we also use this for stricter checking of journal inode
extent tree.

Reviewed-by: Lukas Czerner <lczerner@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20200728130437.7804-3-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/block_validity.c | 34 ++++++++++++----------------------
 1 file changed, 12 insertions(+), 22 deletions(-)

diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
index d5055b3adccc..ad7a6ed4d3dd 100644
--- a/fs/ext4/block_validity.c
+++ b/fs/ext4/block_validity.c
@@ -57,7 +57,7 @@ static int add_system_zone(struct ext4_sb_info *sbi,
 			   ext4_fsblk_t start_blk,
 			   unsigned int count)
 {
-	struct ext4_system_zone *new_entry = NULL, *entry;
+	struct ext4_system_zone *new_entry, *entry;
 	struct rb_node **n = &sbi->system_blks.rb_node, *node;
 	struct rb_node *parent = NULL, *new_node = NULL;
 
@@ -68,30 +68,20 @@ static int add_system_zone(struct ext4_sb_info *sbi,
 			n = &(*n)->rb_left;
 		else if (start_blk >= (entry->start_blk + entry->count))
 			n = &(*n)->rb_right;
-		else {
-			if (start_blk + count > (entry->start_blk +
-						 entry->count))
-				entry->count = (start_blk + count -
-						entry->start_blk);
-			new_node = *n;
-			new_entry = rb_entry(new_node, struct ext4_system_zone,
-					     node);
-			break;
-		}
+		else	/* Unexpected overlap of system zones. */
+			return -EFSCORRUPTED;
 	}
 
-	if (!new_entry) {
-		new_entry = kmem_cache_alloc(ext4_system_zone_cachep,
-					     GFP_KERNEL);
-		if (!new_entry)
-			return -ENOMEM;
-		new_entry->start_blk = start_blk;
-		new_entry->count = count;
-		new_node = &new_entry->node;
+	new_entry = kmem_cache_alloc(ext4_system_zone_cachep,
+				     GFP_KERNEL);
+	if (!new_entry)
+		return -ENOMEM;
+	new_entry->start_blk = start_blk;
+	new_entry->count = count;
+	new_node = &new_entry->node;
 
-		rb_link_node(new_node, parent, n);
-		rb_insert_color(new_node, &sbi->system_blks);
-	}
+	rb_link_node(new_node, parent, n);
+	rb_insert_color(new_node, &sbi->system_blks);
 
 	/* Can we merge to the left? */
 	node = rb_prev(new_node);

From 9f6e949fac6594c94f14726da05c82848769cd44 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Wed, 17 Mar 2021 17:44:14 +0100
Subject: [PATCH 1728/2658] ext4: check journal inode extents more carefully

commit ce9f24cccdc019229b70a5c15e2b09ad9c0ab5d1 upstream.

Currently, system zones just track ranges of block, that are "important"
fs metadata (bitmaps, group descriptors, journal blocks, etc.). This
however complicates how extent tree (or indirect blocks) can be checked
for inodes that actually track such metadata - currently the journal
inode but arguably we should be treating quota files or resize inode
similarly. We cannot run __ext4_ext_check() on such metadata inodes when
loading their extents as that would immediately trigger the validity
checks and so we just hack around that and special-case the journal
inode. This however leads to a situation that a journal inode which has
extent tree of depth at least one can have invalid extent tree that gets
unnoticed until ext4_cache_extents() crashes.

To overcome this limitation, track inode number each system zone belongs
to (0 is used for zones not belonging to any inode). We can then verify
inode number matches the expected one when verifying extent tree and
thus avoid the false errors. With this there's no need to to
special-case journal inode during extent tree checking anymore so remove
it.

Fixes: 0a944e8a6c66 ("ext4: don't perform block validity checks on the journal inode")
Reported-by: Wolfgang Frisch <wolfgang.frisch@suse.com>
Reviewed-by: Lukas Czerner <lczerner@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20200728130437.7804-4-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/block_validity.c | 37 +++++++++++++++++++++----------------
 fs/ext4/ext4.h           |  6 +++---
 fs/ext4/extents.c        | 16 ++++++----------
 fs/ext4/indirect.c       |  6 ++----
 fs/ext4/inode.c          |  5 ++---
 fs/ext4/mballoc.c        |  4 ++--
 6 files changed, 36 insertions(+), 38 deletions(-)

diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
index ad7a6ed4d3dd..176a8382e372 100644
--- a/fs/ext4/block_validity.c
+++ b/fs/ext4/block_validity.c
@@ -23,6 +23,7 @@ struct ext4_system_zone {
 	struct rb_node	node;
 	ext4_fsblk_t	start_blk;
 	unsigned int	count;
+	u32		ino;
 };
 
 static struct kmem_cache *ext4_system_zone_cachep;
@@ -43,7 +44,8 @@ void ext4_exit_system_zone(void)
 static inline int can_merge(struct ext4_system_zone *entry1,
 		     struct ext4_system_zone *entry2)
 {
-	if ((entry1->start_blk + entry1->count) == entry2->start_blk)
+	if ((entry1->start_blk + entry1->count) == entry2->start_blk &&
+	    entry1->ino == entry2->ino)
 		return 1;
 	return 0;
 }
@@ -55,7 +57,7 @@ static inline int can_merge(struct ext4_system_zone *entry1,
  */
 static int add_system_zone(struct ext4_sb_info *sbi,
 			   ext4_fsblk_t start_blk,
-			   unsigned int count)
+			   unsigned int count, u32 ino)
 {
 	struct ext4_system_zone *new_entry, *entry;
 	struct rb_node **n = &sbi->system_blks.rb_node, *node;
@@ -78,6 +80,7 @@ static int add_system_zone(struct ext4_sb_info *sbi,
 		return -ENOMEM;
 	new_entry->start_blk = start_blk;
 	new_entry->count = count;
+	new_entry->ino = ino;
 	new_node = &new_entry->node;
 
 	rb_link_node(new_node, parent, n);
@@ -153,16 +156,16 @@ static int ext4_protect_reserved_inode(struct super_block *sb, u32 ino)
 		if (n == 0) {
 			i++;
 		} else {
-			if (!ext4_data_block_valid(sbi, map.m_pblk, n)) {
-				ext4_error(sb, "blocks %llu-%llu from inode %u "
+			err = add_system_zone(sbi, map.m_pblk, n, ino);
+			if (err < 0) {
+				if (err == -EFSCORRUPTED) {
+					ext4_error(sb,
+					   "blocks %llu-%llu from inode %u "
 					   "overlap system zone", map.m_pblk,
 					   map.m_pblk + map.m_len - 1, ino);
-				err = -EFSCORRUPTED;
+				}
 				break;
 			}
-			err = add_system_zone(sbi, map.m_pblk, n);
-			if (err < 0)
-				break;
 			i += n;
 		}
 	}
@@ -191,16 +194,16 @@ int ext4_setup_system_zone(struct super_block *sb)
 		if (ext4_bg_has_super(sb, i) &&
 		    ((i < 5) || ((i % flex_size) == 0)))
 			add_system_zone(sbi, ext4_group_first_block_no(sb, i),
-					ext4_bg_num_gdb(sb, i) + 1);
+					ext4_bg_num_gdb(sb, i) + 1, 0);
 		gdp = ext4_get_group_desc(sb, i, NULL);
-		ret = add_system_zone(sbi, ext4_block_bitmap(sb, gdp), 1);
+		ret = add_system_zone(sbi, ext4_block_bitmap(sb, gdp), 1, 0);
 		if (ret)
 			return ret;
-		ret = add_system_zone(sbi, ext4_inode_bitmap(sb, gdp), 1);
+		ret = add_system_zone(sbi, ext4_inode_bitmap(sb, gdp), 1, 0);
 		if (ret)
 			return ret;
 		ret = add_system_zone(sbi, ext4_inode_table(sb, gdp),
-				sbi->s_itb_per_group);
+				sbi->s_itb_per_group, 0);
 		if (ret)
 			return ret;
 	}
@@ -233,10 +236,11 @@ void ext4_release_system_zone(struct super_block *sb)
  * start_blk+count) is valid; 0 if some part of the block region
  * overlaps with filesystem metadata blocks.
  */
-int ext4_data_block_valid(struct ext4_sb_info *sbi, ext4_fsblk_t start_blk,
-			  unsigned int count)
+int ext4_inode_block_valid(struct inode *inode, ext4_fsblk_t start_blk,
+			   unsigned int count)
 {
 	struct ext4_system_zone *entry;
+	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
 	struct rb_node *n = sbi->system_blks.rb_node;
 
 	if ((start_blk <= le32_to_cpu(sbi->s_es->s_first_data_block)) ||
@@ -252,6 +256,8 @@ int ext4_data_block_valid(struct ext4_sb_info *sbi, ext4_fsblk_t start_blk,
 		else if (start_blk >= (entry->start_blk + entry->count))
 			n = n->rb_right;
 		else {
+			if (entry->ino == inode->i_ino)
+				return 1;
 			sbi->s_es->s_last_error_block = cpu_to_le64(start_blk);
 			return 0;
 		}
@@ -274,8 +280,7 @@ int ext4_check_blockref(const char *function, unsigned int line,
 	while (bref < p+max) {
 		blk = le32_to_cpu(*bref++);
 		if (blk &&
-		    unlikely(!ext4_data_block_valid(EXT4_SB(inode->i_sb),
-						    blk, 1))) {
+		    unlikely(!ext4_inode_block_valid(inode, blk, 1))) {
 			es->s_last_error_block = cpu_to_le64(blk);
 			ext4_error_inode(inode, function, line, blk,
 					 "invalid block");
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index dfd9d446ea8b..241c41f9e21b 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -3148,9 +3148,9 @@ extern void ext4_release_system_zone(struct super_block *sb);
 extern int ext4_setup_system_zone(struct super_block *sb);
 extern int __init ext4_init_system_zone(void);
 extern void ext4_exit_system_zone(void);
-extern int ext4_data_block_valid(struct ext4_sb_info *sbi,
-				 ext4_fsblk_t start_blk,
-				 unsigned int count);
+extern int ext4_inode_block_valid(struct inode *inode,
+				  ext4_fsblk_t start_blk,
+				  unsigned int count);
 extern int ext4_check_blockref(const char *, unsigned int,
 			       struct inode *, __le32 *, unsigned int);
 
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index fc2746e14c42..71005a944151 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -384,7 +384,7 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
 	 */
 	if (lblock + len <= lblock)
 		return 0;
-	return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
+	return ext4_inode_block_valid(inode, block, len);
 }
 
 static int ext4_valid_extent_idx(struct inode *inode,
@@ -392,7 +392,7 @@ static int ext4_valid_extent_idx(struct inode *inode,
 {
 	ext4_fsblk_t block = ext4_idx_pblock(ext_idx);
 
-	return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, 1);
+	return ext4_inode_block_valid(inode, block, 1);
 }
 
 static int ext4_valid_extent_entries(struct inode *inode,
@@ -549,14 +549,10 @@ __read_extent_tree_block(const char *function, unsigned int line,
 	}
 	if (buffer_verified(bh) && !(flags & EXT4_EX_FORCE_CACHE))
 		return bh;
-	if (!ext4_has_feature_journal(inode->i_sb) ||
-	    (inode->i_ino !=
-	     le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum))) {
-		err = __ext4_ext_check(function, line, inode,
-				       ext_block_hdr(bh), depth, pblk);
-		if (err)
-			goto errout;
-	}
+	err = __ext4_ext_check(function, line, inode,
+			       ext_block_hdr(bh), depth, pblk);
+	if (err)
+		goto errout;
 	set_buffer_verified(bh);
 	/*
 	 * If this is a leaf block, cache all of its entries
diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
index 08f3a0c0f468..4f610cd8041b 100644
--- a/fs/ext4/indirect.c
+++ b/fs/ext4/indirect.c
@@ -946,8 +946,7 @@ static int ext4_clear_blocks(handle_t *handle, struct inode *inode,
 	else if (ext4_should_journal_data(inode))
 		flags |= EXT4_FREE_BLOCKS_FORGET;
 
-	if (!ext4_data_block_valid(EXT4_SB(inode->i_sb), block_to_free,
-				   count)) {
+	if (!ext4_inode_block_valid(inode, block_to_free, count)) {
 		EXT4_ERROR_INODE(inode, "attempt to clear invalid "
 				 "blocks %llu len %lu",
 				 (unsigned long long) block_to_free, count);
@@ -1109,8 +1108,7 @@ static void ext4_free_branches(handle_t *handle, struct inode *inode,
 			if (!nr)
 				continue;		/* A hole */
 
-			if (!ext4_data_block_valid(EXT4_SB(inode->i_sb),
-						   nr, 1)) {
+			if (!ext4_inode_block_valid(inode, nr, 1)) {
 				EXT4_ERROR_INODE(inode,
 						 "invalid indirect mapped "
 						 "block %lu (level %d)",
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 6c8771820218..51b1446cf4a2 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -383,8 +383,7 @@ static int __check_block_validity(struct inode *inode, const char *func,
 	    (inode->i_ino ==
 	     le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum)))
 		return 0;
-	if (!ext4_data_block_valid(EXT4_SB(inode->i_sb), map->m_pblk,
-				   map->m_len)) {
+	if (!ext4_inode_block_valid(inode, map->m_pblk, map->m_len)) {
 		ext4_error_inode(inode, func, line, map->m_pblk,
 				 "lblock %lu mapped to illegal pblock %llu "
 				 "(length %d)", (unsigned long) map->m_lblk,
@@ -4503,7 +4502,7 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
 
 	ret = 0;
 	if (ei->i_file_acl &&
-	    !ext4_data_block_valid(EXT4_SB(sb), ei->i_file_acl, 1)) {
+	    !ext4_inode_block_valid(inode, ei->i_file_acl, 1)) {
 		ext4_error_inode(inode, function, line, 0,
 				 "iget: bad extended attribute block %llu",
 				 ei->i_file_acl);
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 8075fc8f4e61..b298120ae3b4 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2943,7 +2943,7 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
 	block = ext4_grp_offs_to_block(sb, &ac->ac_b_ex);
 
 	len = EXT4_C2B(sbi, ac->ac_b_ex.fe_len);
-	if (!ext4_data_block_valid(sbi, block, len)) {
+	if (!ext4_inode_block_valid(ac->ac_inode, block, len)) {
 		ext4_error(sb, "Allocating blocks %llu-%llu which overlap "
 			   "fs metadata", block, block+len);
 		/* File system mounted not to panic on error
@@ -4700,7 +4700,7 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode,
 
 	sbi = EXT4_SB(sb);
 	if (!(flags & EXT4_FREE_BLOCKS_VALIDATED) &&
-	    !ext4_data_block_valid(sbi, block, count)) {
+	    !ext4_inode_block_valid(inode, block, count)) {
 		ext4_error(sb, "Freeing blocks not in datazone - "
 			   "block = %llu, count = %lu", block, count);
 		goto error_return;

From d68ccfa652932f092c62241f66f0c176d3e212dd Mon Sep 17 00:00:00 2001
From: Gwendal Grignou <gwendal@chromium.org>
Date: Tue, 8 Mar 2016 09:13:52 -0800
Subject: [PATCH 1729/2658] platform/chrome: cros_ec_dev - Fix security issue

commit 5d749d0bbe811c10d9048cde6dfebc761713abfd upstream.

Prevent memory scribble by checking that ioctl buffer size parameters
are sane.
Without this check, on 32 bits system, if .insize = 0xffffffff - 20 and
.outsize the amount to scribble, we would overflow, allocate a small
amounts and be able to write outside of the malloc'ed area.
Adding a hard limit allows argument checking of the ioctl. With the
current EC, it is expected .insize and .outsize to be at around 512 bytes
or less.

Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/platform/chrome/cros_ec_dev.c   | 4 ++++
 drivers/platform/chrome/cros_ec_proto.c | 4 ++--
 include/linux/mfd/cros_ec.h             | 6 ++++--
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/chrome/cros_ec_dev.c b/drivers/platform/chrome/cros_ec_dev.c
index 2b331d5b9e79..e16d82bb36a9 100644
--- a/drivers/platform/chrome/cros_ec_dev.c
+++ b/drivers/platform/chrome/cros_ec_dev.c
@@ -137,6 +137,10 @@ static long ec_device_ioctl_xcmd(struct cros_ec_dev *ec, void __user *arg)
 	if (copy_from_user(&u_cmd, arg, sizeof(u_cmd)))
 		return -EFAULT;
 
+	if ((u_cmd.outsize > EC_MAX_MSG_BYTES) ||
+	    (u_cmd.insize > EC_MAX_MSG_BYTES))
+		return -EINVAL;
+
 	s_cmd = kmalloc(sizeof(*s_cmd) + max(u_cmd.outsize, u_cmd.insize),
 			GFP_KERNEL);
 	if (!s_cmd)
diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
index 5c285f2b3a65..d20190c8f0c0 100644
--- a/drivers/platform/chrome/cros_ec_proto.c
+++ b/drivers/platform/chrome/cros_ec_proto.c
@@ -311,8 +311,8 @@ int cros_ec_query_all(struct cros_ec_device *ec_dev)
 			ec_dev->max_response = EC_PROTO2_MAX_PARAM_SIZE;
 			ec_dev->max_passthru = 0;
 			ec_dev->pkt_xfer = NULL;
-			ec_dev->din_size = EC_MSG_BYTES;
-			ec_dev->dout_size = EC_MSG_BYTES;
+			ec_dev->din_size = EC_PROTO2_MSG_BYTES;
+			ec_dev->dout_size = EC_PROTO2_MSG_BYTES;
 		} else {
 			/*
 			 * It's possible for a test to occur too early when
diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
index 3ab3cede28ea..93c14e9df630 100644
--- a/include/linux/mfd/cros_ec.h
+++ b/include/linux/mfd/cros_ec.h
@@ -50,9 +50,11 @@ enum {
 					EC_MSG_TX_TRAILER_BYTES,
 	EC_MSG_RX_PROTO_BYTES	= 3,
 
-	/* Max length of messages */
-	EC_MSG_BYTES		= EC_PROTO2_MAX_PARAM_SIZE +
+	/* Max length of messages for proto 2*/
+	EC_PROTO2_MSG_BYTES		= EC_PROTO2_MAX_PARAM_SIZE +
 					EC_MSG_TX_PROTO_BYTES,
+
+	EC_MAX_MSG_BYTES		= 64 * 1024,
 };
 
 /*

From f2bfd48d102d9b893305cd40291bd3420efb363f Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Thu, 11 Mar 2021 14:31:05 +0000
Subject: [PATCH 1730/2658] btrfs: fix race when cloning extent buffer during
 rewind of an old root

commit dbcc7d57bffc0c8cac9dac11bec548597d59a6a5 upstream.

While resolving backreferences, as part of a logical ino ioctl call or
fiemap, we can end up hitting a BUG_ON() when replaying tree mod log
operations of a root, triggering a stack trace like the following:

  ------------[ cut here ]------------
  kernel BUG at fs/btrfs/ctree.c:1210!
  invalid opcode: 0000 [#1] SMP KASAN PTI
  CPU: 1 PID: 19054 Comm: crawl_335 Tainted: G        W         5.11.0-2d11c0084b02-misc-next+ #89
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
  RIP: 0010:__tree_mod_log_rewind+0x3b1/0x3c0
  Code: 05 48 8d 74 10 (...)
  RSP: 0018:ffffc90001eb70b8 EFLAGS: 00010297
  RAX: 0000000000000000 RBX: ffff88812344e400 RCX: ffffffffb28933b6
  RDX: 0000000000000007 RSI: dffffc0000000000 RDI: ffff88812344e42c
  RBP: ffffc90001eb7108 R08: 1ffff11020b60a20 R09: ffffed1020b60a20
  R10: ffff888105b050f9 R11: ffffed1020b60a1f R12: 00000000000000ee
  R13: ffff8880195520c0 R14: ffff8881bc958500 R15: ffff88812344e42c
  FS:  00007fd1955e8700(0000) GS:ffff8881f5600000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00007efdb7928718 CR3: 000000010103a006 CR4: 0000000000170ee0
  Call Trace:
   btrfs_search_old_slot+0x265/0x10d0
   ? lock_acquired+0xbb/0x600
   ? btrfs_search_slot+0x1090/0x1090
   ? free_extent_buffer.part.61+0xd7/0x140
   ? free_extent_buffer+0x13/0x20
   resolve_indirect_refs+0x3e9/0xfc0
   ? lock_downgrade+0x3d0/0x3d0
   ? __kasan_check_read+0x11/0x20
   ? add_prelim_ref.part.11+0x150/0x150
   ? lock_downgrade+0x3d0/0x3d0
   ? __kasan_check_read+0x11/0x20
   ? lock_acquired+0xbb/0x600
   ? __kasan_check_write+0x14/0x20
   ? do_raw_spin_unlock+0xa8/0x140
   ? rb_insert_color+0x30/0x360
   ? prelim_ref_insert+0x12d/0x430
   find_parent_nodes+0x5c3/0x1830
   ? resolve_indirect_refs+0xfc0/0xfc0
   ? lock_release+0xc8/0x620
   ? fs_reclaim_acquire+0x67/0xf0
   ? lock_acquire+0xc7/0x510
   ? lock_downgrade+0x3d0/0x3d0
   ? lockdep_hardirqs_on_prepare+0x160/0x210
   ? lock_release+0xc8/0x620
   ? fs_reclaim_acquire+0x67/0xf0
   ? lock_acquire+0xc7/0x510
   ? poison_range+0x38/0x40
   ? unpoison_range+0x14/0x40
   ? trace_hardirqs_on+0x55/0x120
   btrfs_find_all_roots_safe+0x142/0x1e0
   ? find_parent_nodes+0x1830/0x1830
   ? btrfs_inode_flags_to_xflags+0x50/0x50
   iterate_extent_inodes+0x20e/0x580
   ? tree_backref_for_extent+0x230/0x230
   ? lock_downgrade+0x3d0/0x3d0
   ? read_extent_buffer+0xdd/0x110
   ? lock_downgrade+0x3d0/0x3d0
   ? __kasan_check_read+0x11/0x20
   ? lock_acquired+0xbb/0x600
   ? __kasan_check_write+0x14/0x20
   ? _raw_spin_unlock+0x22/0x30
   ? __kasan_check_write+0x14/0x20
   iterate_inodes_from_logical+0x129/0x170
   ? iterate_inodes_from_logical+0x129/0x170
   ? btrfs_inode_flags_to_xflags+0x50/0x50
   ? iterate_extent_inodes+0x580/0x580
   ? __vmalloc_node+0x92/0xb0
   ? init_data_container+0x34/0xb0
   ? init_data_container+0x34/0xb0
   ? kvmalloc_node+0x60/0x80
   btrfs_ioctl_logical_to_ino+0x158/0x230
   btrfs_ioctl+0x205e/0x4040
   ? __might_sleep+0x71/0xe0
   ? btrfs_ioctl_get_supported_features+0x30/0x30
   ? getrusage+0x4b6/0x9c0
   ? __kasan_check_read+0x11/0x20
   ? lock_release+0xc8/0x620
   ? __might_fault+0x64/0xd0
   ? lock_acquire+0xc7/0x510
   ? lock_downgrade+0x3d0/0x3d0
   ? lockdep_hardirqs_on_prepare+0x210/0x210
   ? lockdep_hardirqs_on_prepare+0x210/0x210
   ? __kasan_check_read+0x11/0x20
   ? do_vfs_ioctl+0xfc/0x9d0
   ? ioctl_file_clone+0xe0/0xe0
   ? lock_downgrade+0x3d0/0x3d0
   ? lockdep_hardirqs_on_prepare+0x210/0x210
   ? __kasan_check_read+0x11/0x20
   ? lock_release+0xc8/0x620
   ? __task_pid_nr_ns+0xd3/0x250
   ? lock_acquire+0xc7/0x510
   ? __fget_files+0x160/0x230
   ? __fget_light+0xf2/0x110
   __x64_sys_ioctl+0xc3/0x100
   do_syscall_64+0x37/0x80
   entry_SYSCALL_64_after_hwframe+0x44/0xa9
  RIP: 0033:0x7fd1976e2427
  Code: 00 00 90 48 8b 05 (...)
  RSP: 002b:00007fd1955e5cf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
  RAX: ffffffffffffffda RBX: 00007fd1955e5f40 RCX: 00007fd1976e2427
  RDX: 00007fd1955e5f48 RSI: 00000000c038943b RDI: 0000000000000004
  RBP: 0000000001000000 R08: 0000000000000000 R09: 00007fd1955e6120
  R10: 0000557835366b00 R11: 0000000000000246 R12: 0000000000000004
  R13: 00007fd1955e5f48 R14: 00007fd1955e5f40 R15: 00007fd1955e5ef8
  Modules linked in:
  ---[ end trace ec8931a1c36e57be ]---

  (gdb) l *(__tree_mod_log_rewind+0x3b1)
  0xffffffff81893521 is in __tree_mod_log_rewind (fs/btrfs/ctree.c:1210).
  1205                     * the modification. as we're going backwards, we do the
  1206                     * opposite of each operation here.
  1207                     */
  1208                    switch (tm->op) {
  1209                    case MOD_LOG_KEY_REMOVE_WHILE_FREEING:
  1210                            BUG_ON(tm->slot < n);
  1211                            fallthrough;
  1212                    case MOD_LOG_KEY_REMOVE_WHILE_MOVING:
  1213                    case MOD_LOG_KEY_REMOVE:
  1214                            btrfs_set_node_key(eb, &tm->key, tm->slot);

Here's what happens to hit that BUG_ON():

1) We have one tree mod log user (through fiemap or the logical ino ioctl),
   with a sequence number of 1, so we have fs_info->tree_mod_seq == 1;

2) Another task is at ctree.c:balance_level() and we have eb X currently as
   the root of the tree, and we promote its single child, eb Y, as the new
   root.

   Then, at ctree.c:balance_level(), we call:

      tree_mod_log_insert_root(eb X, eb Y, 1);

3) At tree_mod_log_insert_root() we create tree mod log elements for each
   slot of eb X, of operation type MOD_LOG_KEY_REMOVE_WHILE_FREEING each
   with a ->logical pointing to ebX->start. These are placed in an array
   named tm_list.
   Lets assume there are N elements (N pointers in eb X);

4) Then, still at tree_mod_log_insert_root(), we create a tree mod log
   element of operation type MOD_LOG_ROOT_REPLACE, ->logical set to
   ebY->start, ->old_root.logical set to ebX->start, ->old_root.level set
   to the level of eb X and ->generation set to the generation of eb X;

5) Then tree_mod_log_insert_root() calls tree_mod_log_free_eb() with
   tm_list as argument. After that, tree_mod_log_free_eb() calls
   __tree_mod_log_insert() for each member of tm_list in reverse order,
   from highest slot in eb X, slot N - 1, to slot 0 of eb X;

6) __tree_mod_log_insert() sets the sequence number of each given tree mod
   log operation - it increments fs_info->tree_mod_seq and sets
   fs_info->tree_mod_seq as the sequence number of the given tree mod log
   operation.

   This means that for the tm_list created at tree_mod_log_insert_root(),
   the element corresponding to slot 0 of eb X has the highest sequence
   number (1 + N), and the element corresponding to the last slot has the
   lowest sequence number (2);

7) Then, after inserting tm_list's elements into the tree mod log rbtree,
   the MOD_LOG_ROOT_REPLACE element is inserted, which gets the highest
   sequence number, which is N + 2;

8) Back to ctree.c:balance_level(), we free eb X by calling
   btrfs_free_tree_block() on it. Because eb X was created in the current
   transaction, has no other references and writeback did not happen for
   it, we add it back to the free space cache/tree;

9) Later some other task T allocates the metadata extent from eb X, since
   it is marked as free space in the space cache/tree, and uses it as a
   node for some other btree;

10) The tree mod log user task calls btrfs_search_old_slot(), which calls
    get_old_root(), and finally that calls __tree_mod_log_oldest_root()
    with time_seq == 1 and eb_root == eb Y;

11) First iteration of the while loop finds the tree mod log element with
    sequence number N + 2, for the logical address of eb Y and of type
    MOD_LOG_ROOT_REPLACE;

12) Because the operation type is MOD_LOG_ROOT_REPLACE, we don't break out
    of the loop, and set root_logical to point to tm->old_root.logical
    which corresponds to the logical address of eb X;

13) On the next iteration of the while loop, the call to
    tree_mod_log_search_oldest() returns the smallest tree mod log element
    for the logical address of eb X, which has a sequence number of 2, an
    operation type of MOD_LOG_KEY_REMOVE_WHILE_FREEING and corresponds to
    the old slot N - 1 of eb X (eb X had N items in it before being freed);

14) We then break out of the while loop and return the tree mod log operation
    of type MOD_LOG_ROOT_REPLACE (eb Y), and not the one for slot N - 1 of
    eb X, to get_old_root();

15) At get_old_root(), we process the MOD_LOG_ROOT_REPLACE operation
    and set "logical" to the logical address of eb X, which was the old
    root. We then call tree_mod_log_search() passing it the logical
    address of eb X and time_seq == 1;

16) Then before calling tree_mod_log_search(), task T adds a key to eb X,
    which results in adding a tree mod log operation of type
    MOD_LOG_KEY_ADD to the tree mod log - this is done at
    ctree.c:insert_ptr() - but after adding the tree mod log operation
    and before updating the number of items in eb X from 0 to 1...

17) The task at get_old_root() calls tree_mod_log_search() and gets the
    tree mod log operation of type MOD_LOG_KEY_ADD just added by task T.
    Then it enters the following if branch:

    if (old_root && tm && tm->op != MOD_LOG_KEY_REMOVE_WHILE_FREEING) {
       (...)
    } (...)

    Calls read_tree_block() for eb X, which gets a reference on eb X but
    does not lock it - task T has it locked.
    Then it clones eb X while it has nritems set to 0 in its header, before
    task T sets nritems to 1 in eb X's header. From hereupon we use the
    clone of eb X which no other task has access to;

18) Then we call __tree_mod_log_rewind(), passing it the MOD_LOG_KEY_ADD
    mod log operation we just got from tree_mod_log_search() in the
    previous step and the cloned version of eb X;

19) At __tree_mod_log_rewind(), we set the local variable "n" to the number
    of items set in eb X's clone, which is 0. Then we enter the while loop,
    and in its first iteration we process the MOD_LOG_KEY_ADD operation,
    which just decrements "n" from 0 to (u32)-1, since "n" is declared with
    a type of u32. At the end of this iteration we call rb_next() to find the
    next tree mod log operation for eb X, that gives us the mod log operation
    of type MOD_LOG_KEY_REMOVE_WHILE_FREEING, for slot 0, with a sequence
    number of N + 1 (steps 3 to 6);

20) Then we go back to the top of the while loop and trigger the following
    BUG_ON():

        (...)
        switch (tm->op) {
        case MOD_LOG_KEY_REMOVE_WHILE_FREEING:
                 BUG_ON(tm->slot < n);
                 fallthrough;
        (...)

    Because "n" has a value of (u32)-1 (4294967295) and tm->slot is 0.

Fix this by taking a read lock on the extent buffer before cloning it at
ctree.c:get_old_root(). This should be done regardless of the extent
buffer having been freed and reused, as a concurrent task might be
modifying it (while holding a write lock on it).

Reported-by: Zygo Blaxell <ce3g8jdj@umail.furryterror.org>
Link: https://lore.kernel.org/linux-btrfs/20210227155037.GN28049@hungrycats.org/
Fixes: 834328a8493079 ("Btrfs: tree mod log's old roots could still be part of the tree")
CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/ctree.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 85b64475d808..fbb4c81f6311 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -1431,7 +1431,9 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
 			btrfs_warn(root->fs_info,
 				"failed to read tree block %llu from get_old_root", logical);
 		} else {
+			btrfs_tree_read_lock(old);
 			eb = btrfs_clone_extent_buffer(old);
+			btrfs_tree_read_unlock(old);
 			free_extent_buffer(old);
 		}
 	} else if (old_root) {

From 489c417b748a885c5fa2120df22d6bda2df4be12 Mon Sep 17 00:00:00 2001
From: Joe Korty <joe.korty@concurrent-rt.com>
Date: Fri, 26 Feb 2021 09:38:20 -0500
Subject: [PATCH 1731/2658] NFSD: Repair misuse of sv_lock in 5.10.16-rt30.

commit c7de87ff9dac5f396f62d584f3908f80ddc0e07b upstream.

[ This problem is in mainline, but only rt has the chops to be
able to detect it. ]

Lockdep reports a circular lock dependency between serv->sv_lock and
softirq_ctl.lock on system shutdown, when using a kernel built with
CONFIG_PREEMPT_RT=y, and a nfs mount exists.

This is due to the definition of spin_lock_bh on rt:

	local_bh_disable();
	rt_spin_lock(lock);

which forces a softirq_ctl.lock -> serv->sv_lock dependency.  This is
not a problem as long as _every_ lock of serv->sv_lock is a:

	spin_lock_bh(&serv->sv_lock);

but there is one of the form:

	spin_lock(&serv->sv_lock);

This is what is causing the circular dependency splat.  The spin_lock()
grabs the lock without first grabbing softirq_ctl.lock via local_bh_disable.
If later on in the critical region,  someone does a local_bh_disable, we
get a serv->sv_lock -> softirq_ctrl.lock dependency established.  Deadlock.

Fix is to make serv->sv_lock be locked with spin_lock_bh everywhere, no
exceptions.

[  OK  ] Stopped target NFS client services.
         Stopping Logout off all iSCSI sessions on shutdown...
         Stopping NFS server and services...
[  109.442380]
[  109.442385] ======================================================
[  109.442386] WARNING: possible circular locking dependency detected
[  109.442387] 5.10.16-rt30 #1 Not tainted
[  109.442389] ------------------------------------------------------
[  109.442390] nfsd/1032 is trying to acquire lock:
[  109.442392] ffff994237617f60 ((softirq_ctrl.lock).lock){+.+.}-{2:2}, at: __local_bh_disable_ip+0xd9/0x270
[  109.442405]
[  109.442405] but task is already holding lock:
[  109.442406] ffff994245cb00b0 (&serv->sv_lock){+.+.}-{0:0}, at: svc_close_list+0x1f/0x90
[  109.442415]
[  109.442415] which lock already depends on the new lock.
[  109.442415]
[  109.442416]
[  109.442416] the existing dependency chain (in reverse order) is:
[  109.442417]
[  109.442417] -> #1 (&serv->sv_lock){+.+.}-{0:0}:
[  109.442421]        rt_spin_lock+0x2b/0xc0
[  109.442428]        svc_add_new_perm_xprt+0x42/0xa0
[  109.442430]        svc_addsock+0x135/0x220
[  109.442434]        write_ports+0x4b3/0x620
[  109.442438]        nfsctl_transaction_write+0x45/0x80
[  109.442440]        vfs_write+0xff/0x420
[  109.442444]        ksys_write+0x4f/0xc0
[  109.442446]        do_syscall_64+0x33/0x40
[  109.442450]        entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  109.442454]
[  109.442454] -> #0 ((softirq_ctrl.lock).lock){+.+.}-{2:2}:
[  109.442457]        __lock_acquire+0x1264/0x20b0
[  109.442463]        lock_acquire+0xc2/0x400
[  109.442466]        rt_spin_lock+0x2b/0xc0
[  109.442469]        __local_bh_disable_ip+0xd9/0x270
[  109.442471]        svc_xprt_do_enqueue+0xc0/0x4d0
[  109.442474]        svc_close_list+0x60/0x90
[  109.442476]        svc_close_net+0x49/0x1a0
[  109.442478]        svc_shutdown_net+0x12/0x40
[  109.442480]        nfsd_destroy+0xc5/0x180
[  109.442482]        nfsd+0x1bc/0x270
[  109.442483]        kthread+0x194/0x1b0
[  109.442487]        ret_from_fork+0x22/0x30
[  109.442492]
[  109.442492] other info that might help us debug this:
[  109.442492]
[  109.442493]  Possible unsafe locking scenario:
[  109.442493]
[  109.442493]        CPU0                    CPU1
[  109.442494]        ----                    ----
[  109.442495]   lock(&serv->sv_lock);
[  109.442496]                                lock((softirq_ctrl.lock).lock);
[  109.442498]                                lock(&serv->sv_lock);
[  109.442499]   lock((softirq_ctrl.lock).lock);
[  109.442501]
[  109.442501]  *** DEADLOCK ***
[  109.442501]
[  109.442501] 3 locks held by nfsd/1032:
[  109.442503]  #0: ffffffff93b49258 (nfsd_mutex){+.+.}-{3:3}, at: nfsd+0x19a/0x270
[  109.442508]  #1: ffff994245cb00b0 (&serv->sv_lock){+.+.}-{0:0}, at: svc_close_list+0x1f/0x90
[  109.442512]  #2: ffffffff93a81b20 (rcu_read_lock){....}-{1:2}, at: rt_spin_lock+0x5/0xc0
[  109.442518]
[  109.442518] stack backtrace:
[  109.442519] CPU: 0 PID: 1032 Comm: nfsd Not tainted 5.10.16-rt30 #1
[  109.442522] Hardware name: Supermicro X9DRL-3F/iF/X9DRL-3F/iF, BIOS 3.2 09/22/2015
[  109.442524] Call Trace:
[  109.442527]  dump_stack+0x77/0x97
[  109.442533]  check_noncircular+0xdc/0xf0
[  109.442546]  __lock_acquire+0x1264/0x20b0
[  109.442553]  lock_acquire+0xc2/0x400
[  109.442564]  rt_spin_lock+0x2b/0xc0
[  109.442570]  __local_bh_disable_ip+0xd9/0x270
[  109.442573]  svc_xprt_do_enqueue+0xc0/0x4d0
[  109.442577]  svc_close_list+0x60/0x90
[  109.442581]  svc_close_net+0x49/0x1a0
[  109.442585]  svc_shutdown_net+0x12/0x40
[  109.442588]  nfsd_destroy+0xc5/0x180
[  109.442590]  nfsd+0x1bc/0x270
[  109.442595]  kthread+0x194/0x1b0
[  109.442600]  ret_from_fork+0x22/0x30
[  109.518225] nfsd: last server has exited, flushing export cache
[  OK  ] Stopped NFSv4 ID-name mapping service.
[  OK  ] Stopped GSSAPI Proxy Daemon.
[  OK  ] Stopped NFS Mount Daemon.
[  OK  ] Stopped NFS status monitor for NFSv2/3 locking..

Fixes: 719f8bcc883e ("svcrpc: fix xpt_list traversal locking on shutdown")
Signed-off-by: Joe Korty <joe.korty@concurrent-rt.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/svc_xprt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index a7cd03165680..7629982040c4 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -1011,7 +1011,7 @@ static int svc_close_list(struct svc_serv *serv, struct list_head *xprt_list, st
 	struct svc_xprt *xprt;
 	int ret = 0;
 
-	spin_lock(&serv->sv_lock);
+	spin_lock_bh(&serv->sv_lock);
 	list_for_each_entry(xprt, xprt_list, xpt_list) {
 		if (xprt->xpt_net != net)
 			continue;
@@ -1019,7 +1019,7 @@ static int svc_close_list(struct svc_serv *serv, struct list_head *xprt_list, st
 		set_bit(XPT_CLOSE, &xprt->xpt_flags);
 		svc_xprt_enqueue(xprt);
 	}
-	spin_unlock(&serv->sv_lock);
+	spin_unlock_bh(&serv->sv_lock);
 	return ret;
 }
 

From fcba6ffc3a78eed2cad5c3fff80dbdb2dc8e63f9 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 12 Mar 2021 10:42:11 +0300
Subject: [PATCH 1732/2658] scsi: lpfc: Fix some error codes in debugfs

commit 19f1bc7edf0f97186810e13a88f5b62069d89097 upstream.

If copy_from_user() or kstrtoull() fail then the correct behavior is to
return a negative error code.

Link: https://lore.kernel.org/r/YEsbU/UxYypVrC7/@mwanda
Fixes: f9bb2da11db8 ("[SCSI] lpfc 8.3.27: T10 additions for SLI4")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/lpfc/lpfc_debugfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index 25aa9b98d53a..034d09f8d341 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -1061,7 +1061,7 @@ lpfc_debugfs_dif_err_write(struct file *file, const char __user *buf,
 	memset(dstbuf, 0, 32);
 	size = (nbytes < 32) ? nbytes : 32;
 	if (copy_from_user(dstbuf, buf, size))
-		return 0;
+		return -EFAULT;
 
 	if (dent == phba->debug_InjErrLBA) {
 		if ((buf[0] == 'o') && (buf[1] == 'f') && (buf[2] == 'f'))
@@ -1069,7 +1069,7 @@ lpfc_debugfs_dif_err_write(struct file *file, const char __user *buf,
 	}
 
 	if ((tmp == 0) && (kstrtoull(dstbuf, 0, &tmp)))
-		return 0;
+		return -EINVAL;
 
 	if (dent == phba->debug_writeGuard)
 		phba->lpfc_injerr_wgrd_cnt = (uint32_t)tmp;

From 597fafaafe60236a07319b780b0ed9a38d07ac55 Mon Sep 17 00:00:00 2001
From: Macpaul Lin <macpaul.lin@mediatek.com>
Date: Thu, 18 Jun 2020 17:13:38 +0800
Subject: [PATCH 1733/2658] USB: replace hardcode maximum usb string length by
 definition

commit 81c7462883b0cc0a4eeef0687f80ad5b5baee5f6 upstream.

Replace hardcoded maximum USB string length (126 bytes) by definition
"USB_MAX_STRING_LEN".

Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/1592471618-29428-1-git-send-email-macpaul.lin@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/composite.c | 4 ++--
 drivers/usb/gadget/usbstring.c | 4 ++--
 include/uapi/linux/usb/ch9.h   | 3 +++
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 3be990b61992..5c6e893f4434 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1065,7 +1065,7 @@ static void collect_langs(struct usb_gadget_strings **sp, __le16 *buf)
 	while (*sp) {
 		s = *sp;
 		language = cpu_to_le16(s->language);
-		for (tmp = buf; *tmp && tmp < &buf[126]; tmp++) {
+		for (tmp = buf; *tmp && tmp < &buf[USB_MAX_STRING_LEN]; tmp++) {
 			if (*tmp == language)
 				goto repeat;
 		}
@@ -1140,7 +1140,7 @@ static int get_string(struct usb_composite_dev *cdev,
 			collect_langs(sp, s->wData);
 		}
 
-		for (len = 0; len <= 126 && s->wData[len]; len++)
+		for (len = 0; len <= USB_MAX_STRING_LEN && s->wData[len]; len++)
 			continue;
 		if (!len)
 			return -EINVAL;
diff --git a/drivers/usb/gadget/usbstring.c b/drivers/usb/gadget/usbstring.c
index 73a4dfba0edb..0173a9969b9a 100644
--- a/drivers/usb/gadget/usbstring.c
+++ b/drivers/usb/gadget/usbstring.c
@@ -59,9 +59,9 @@ usb_gadget_get_string (struct usb_gadget_strings *table, int id, u8 *buf)
 		return -EINVAL;
 
 	/* string descriptors have length, tag, then UTF16-LE text */
-	len = min ((size_t) 126, strlen (s->s));
+	len = min((size_t)USB_MAX_STRING_LEN, strlen(s->s));
 	len = utf8s_to_utf16s(s->s, len, UTF16_LITTLE_ENDIAN,
-			(wchar_t *) &buf[2], 126);
+			(wchar_t *) &buf[2], USB_MAX_STRING_LEN);
 	if (len < 0)
 		return -EINVAL;
 	buf [0] = (len + 1) * 2;
diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h
index 90f8b2ba3f59..d52824d9906e 100644
--- a/include/uapi/linux/usb/ch9.h
+++ b/include/uapi/linux/usb/ch9.h
@@ -333,6 +333,9 @@ struct usb_config_descriptor {
 
 /*-------------------------------------------------------------------------*/
 
+/* USB String descriptors can contain at most 126 characters. */
+#define USB_MAX_STRING_LEN	126
+
 /* USB_DT_STRING: String descriptor */
 struct usb_string_descriptor {
 	__u8  bLength;

From f07a1ab59999b14144f7dfaa83487a0a09d15d12 Mon Sep 17 00:00:00 2001
From: Jim Lin <jilin@nvidia.com>
Date: Thu, 11 Mar 2021 14:42:41 +0800
Subject: [PATCH 1734/2658] usb: gadget: configfs: Fix KASAN use-after-free

commit 98f153a10da403ddd5e9d98a3c8c2bb54bb5a0b6 upstream.

When gadget is disconnected, running sequence is like this.
. composite_disconnect
. Call trace:
  usb_string_copy+0xd0/0x128
  gadget_config_name_configuration_store+0x4
  gadget_config_name_attr_store+0x40/0x50
  configfs_write_file+0x198/0x1f4
  vfs_write+0x100/0x220
  SyS_write+0x58/0xa8
. configfs_composite_unbind
. configfs_composite_bind

In configfs_composite_bind, it has
"cn->strings.s = cn->configuration;"

When usb_string_copy is invoked. it would
allocate memory, copy input string, release previous pointed memory space,
and use new allocated memory.

When gadget is connected, host sends down request to get information.
Call trace:
  usb_gadget_get_string+0xec/0x168
  lookup_string+0x64/0x98
  composite_setup+0xa34/0x1ee8

If gadget is disconnected and connected quickly, in the failed case,
cn->configuration memory has been released by usb_string_copy kfree but
configfs_composite_bind hasn't been run in time to assign new allocated
"cn->configuration" pointer to "cn->strings.s".

When "strlen(s->s) of usb_gadget_get_string is being executed, the dangling
memory is accessed, "BUG: KASAN: use-after-free" error occurs.

Cc: stable@vger.kernel.org
Signed-off-by: Jim Lin <jilin@nvidia.com>
Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Link: https://lore.kernel.org/r/1615444961-13376-1-git-send-email-macpaul.lin@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/configfs.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index d5fcb7037ad2..27e635c8cef0 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -144,8 +144,8 @@ struct gadget_config_name {
 	struct list_head list;
 };
 
-#define MAX_USB_STRING_LEN	126
-#define MAX_USB_STRING_WITH_NULL_LEN	(MAX_USB_STRING_LEN+1)
+#define USB_MAX_STRING_LEN	126
+#define USB_MAX_STRING_WITH_NULL_LEN	(USB_MAX_STRING_LEN+1)
 
 static int usb_string_copy(const char *s, char **s_copy)
 {
@@ -159,11 +159,11 @@ static int usb_string_copy(const char *s, char **s_copy)
 	if (copy) {
 		str = copy;
 	} else {
-		str = kmalloc(MAX_USB_STRING_WITH_NULL_LEN, GFP_KERNEL);
+		str = kmalloc(USB_MAX_STRING_WITH_NULL_LEN, GFP_KERNEL);
 		if (!str)
 			return -ENOMEM;
 	}
-	strlcpy(str, s, MAX_USB_STRING_WITH_NULL_LEN);
+	strcpy(str, s);
 	if (str[ret - 1] == '\n')
 		str[ret - 1] = '\0';
 	*s_copy = str;

From 691e43bdfbc3f601bee9b2a0619eb87f3accb80d Mon Sep 17 00:00:00 2001
From: Tyrel Datwyler <tyreld@linux.ibm.com>
Date: Mon, 15 Mar 2021 15:48:21 -0600
Subject: [PATCH 1735/2658] PCI: rpadlpar: Fix potential drc_name corruption in
 store functions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit cc7a0bb058b85ea03db87169c60c7cfdd5d34678 upstream.

Both add_slot_store() and remove_slot_store() try to fix up the
drc_name copied from the store buffer by placing a NUL terminator at
nbyte + 1 or in place of a '\n' if present. However, the static buffer
that we copy the drc_name data into is not zeroed and can contain
anything past the n-th byte.

This is problematic if a '\n' byte appears in that buffer after nbytes
and the string copied into the store buffer was not NUL terminated to
start with as the strchr() search for a '\n' byte will mark this
incorrectly as the end of the drc_name string resulting in a drc_name
string that contains garbage data after the n-th byte.

Additionally it will cause us to overwrite that '\n' byte on the stack
with NUL, potentially corrupting data on the stack.

The following debugging shows an example of the drmgr utility writing
"PHB 4543" to the add_slot sysfs attribute, but add_slot_store()
logging a corrupted string value.

  drmgr: drmgr: -c phb -a -s PHB 4543 -d 1
  add_slot_store: drc_name = PHB 4543°|<82>!, rc = -19

Fix this by using strscpy() instead of memcpy() to ensure the string
is NUL terminated when copied into the static drc_name buffer.
Further, since the string is now NUL terminated the code only needs to
change '\n' to '\0' when present.

Cc: stable@vger.kernel.org
Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
[mpe: Reformat change log and add mention of possible stack corruption]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210315214821.452959-1-tyreld@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/hotplug/rpadlpar_sysfs.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/drivers/pci/hotplug/rpadlpar_sysfs.c b/drivers/pci/hotplug/rpadlpar_sysfs.c
index a796301ea03f..ca9d832bd9f8 100644
--- a/drivers/pci/hotplug/rpadlpar_sysfs.c
+++ b/drivers/pci/hotplug/rpadlpar_sysfs.c
@@ -39,12 +39,11 @@ static ssize_t add_slot_store(struct kobject *kobj, struct kobj_attribute *attr,
 	if (nbytes >= MAX_DRC_NAME_LEN)
 		return 0;
 
-	memcpy(drc_name, buf, nbytes);
+	strscpy(drc_name, buf, nbytes + 1);
 
 	end = strchr(drc_name, '\n');
-	if (!end)
-		end = &drc_name[nbytes];
-	*end = '\0';
+	if (end)
+		*end = '\0';
 
 	rc = dlpar_add_slot(drc_name);
 	if (rc)
@@ -70,12 +69,11 @@ static ssize_t remove_slot_store(struct kobject *kobj,
 	if (nbytes >= MAX_DRC_NAME_LEN)
 		return 0;
 
-	memcpy(drc_name, buf, nbytes);
+	strscpy(drc_name, buf, nbytes + 1);
 
 	end = strchr(drc_name, '\n');
-	if (!end)
-		end = &drc_name[nbytes];
-	*end = '\0';
+	if (end)
+		*end = '\0';
 
 	rc = dlpar_remove_slot(drc_name);
 	if (rc)

From 3446ac7185636288aaf82d00c79a2c9cc3592f2c Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Thu, 18 Mar 2021 20:26:47 +0100
Subject: [PATCH 1736/2658] x86/ioapic: Ignore IRQ2 again

commit a501b048a95b79e1e34f03cac3c87ff1e9f229ad upstream.

Vitaly ran into an issue with hotplugging CPU0 on an Amazon instance where
the matrix allocator claimed to be out of vectors. He analyzed it down to
the point that IRQ2, the PIC cascade interrupt, which is supposed to be not
ever routed to the IO/APIC ended up having an interrupt vector assigned
which got moved during unplug of CPU0.

The underlying issue is that IRQ2 for various reasons (see commit
af174783b925 ("x86: I/O APIC: Never configure IRQ2" for details) is treated
as a reserved system vector by the vector core code and is not accounted as
a regular vector. The Amazon BIOS has an routing entry of pin2 to IRQ2
which causes the IO/APIC setup to claim that interrupt which is granted by
the vector domain because there is no sanity check. As a consequence the
allocation counter of CPU0 underflows which causes a subsequent unplug to
fail with:

  [ ... ] CPU 0 has 4294967295 vectors, 589 available. Cannot disable CPU

There is another sanity check missing in the matrix allocator, but the
underlying root cause is that the IO/APIC code lost the IRQ2 ignore logic
during the conversion to irqdomains.

For almost 6 years nobody complained about this wreckage, which might
indicate that this requirement could be lifted, but for any system which
actually has a PIC IRQ2 is unusable by design so any routing entry has no
effect and the interrupt cannot be connected to a device anyway.

Due to that and due to history biased paranoia reasons restore the IRQ2
ignore logic and treat it as non existent despite a routing entry claiming
otherwise.

Fixes: d32932d02e18 ("x86/irq: Convert IOAPIC to use hierarchical irqdomain interfaces")
Reported-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210318192819.636943062@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/apic/io_apic.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 5e8fc9809da3..497ad354e123 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1040,6 +1040,16 @@ static int mp_map_pin_to_irq(u32 gsi, int idx, int ioapic, int pin,
 	if (idx >= 0 && test_bit(mp_irqs[idx].srcbus, mp_bus_not_pci)) {
 		irq = mp_irqs[idx].srcbusirq;
 		legacy = mp_is_legacy_irq(irq);
+		/*
+		 * IRQ2 is unusable for historical reasons on systems which
+		 * have a legacy PIC. See the comment vs. IRQ2 further down.
+		 *
+		 * If this gets removed at some point then the related code
+		 * in lapic_assign_system_vectors() needs to be adjusted as
+		 * well.
+		 */
+		if (legacy && irq == PIC_CASCADE_IR)
+			return -EINVAL;
 	}
 
 	mutex_lock(&ioapic_mutex);

From 9373909c5a52f35fa09695aabe8b13dbf4c58143 Mon Sep 17 00:00:00 2001
From: "zhangyi (F)" <yi.zhang@huawei.com>
Date: Wed, 3 Mar 2021 21:17:02 +0800
Subject: [PATCH 1737/2658] ext4: find old entry again if failed to rename
 whiteout

commit b7ff91fd030dc9d72ed91b1aab36e445a003af4f upstream.

If we failed to add new entry on rename whiteout, we cannot reset the
old->de entry directly, because the old->de could have moved from under
us during make indexed dir. So find the old entry again before reset is
needed, otherwise it may corrupt the filesystem as below.

  /dev/sda: Entry '00000001' in ??? (12) has deleted/unused inode 15. CLEARED.
  /dev/sda: Unattached inode 75
  /dev/sda: UNEXPECTED INCONSISTENCY; RUN fsck MANUALLY.

Fixes: 6b4b8e6b4ad ("ext4: fix bug for rename with RENAME_WHITEOUT")
Cc: stable@vger.kernel.org
Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
Link: https://lore.kernel.org/r/20210303131703.330415-1-yi.zhang@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/namei.c | 29 +++++++++++++++++++++++++++--
 1 file changed, 27 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index c261f5983713..809a0f815360 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3372,6 +3372,31 @@ static int ext4_setent(handle_t *handle, struct ext4_renament *ent,
 	return 0;
 }
 
+static void ext4_resetent(handle_t *handle, struct ext4_renament *ent,
+			  unsigned ino, unsigned file_type)
+{
+	struct ext4_renament old = *ent;
+	int retval = 0;
+
+	/*
+	 * old->de could have moved from under us during make indexed dir,
+	 * so the old->de may no longer valid and need to find it again
+	 * before reset old inode info.
+	 */
+	old.bh = ext4_find_entry(old.dir, &old.dentry->d_name, &old.de, NULL);
+	if (IS_ERR(old.bh))
+		retval = PTR_ERR(old.bh);
+	if (!old.bh)
+		retval = -ENOENT;
+	if (retval) {
+		ext4_std_error(old.dir->i_sb, retval);
+		return;
+	}
+
+	ext4_setent(handle, &old, ino, file_type);
+	brelse(old.bh);
+}
+
 static int ext4_find_delete_entry(handle_t *handle, struct inode *dir,
 				  const struct qstr *d_name)
 {
@@ -3671,8 +3696,8 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
 end_rename:
 	if (whiteout) {
 		if (retval) {
-			ext4_setent(handle, &old,
-				old.inode->i_ino, old_file_type);
+			ext4_resetent(handle, &old,
+				      old.inode->i_ino, old_file_type);
 			drop_nlink(whiteout);
 		}
 		unlock_new_inode(whiteout);

From 7c5a0ba7bc66bbd04e82fe11b606885f035afedb Mon Sep 17 00:00:00 2001
From: Shijie Luo <luoshijie1@huawei.com>
Date: Fri, 12 Mar 2021 01:50:51 -0500
Subject: [PATCH 1738/2658] ext4: fix potential error in ext4_do_update_inode

commit 7d8bd3c76da1d94b85e6c9b7007e20e980bfcfe6 upstream.

If set_large_file = 1 and errors occur in ext4_handle_dirty_metadata(),
the error code will be overridden, go to out_brelse to avoid this
situation.

Signed-off-by: Shijie Luo <luoshijie1@huawei.com>
Link: https://lore.kernel.org/r/20210312065051.36314-1-luoshijie1@huawei.com
Cc: stable@kernel.org
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/inode.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 51b1446cf4a2..4fcf84a54e3f 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4692,7 +4692,7 @@ static int ext4_do_update_inode(handle_t *handle,
 	struct ext4_inode_info *ei = EXT4_I(inode);
 	struct buffer_head *bh = iloc->bh;
 	struct super_block *sb = inode->i_sb;
-	int err = 0, rc, block;
+	int err = 0, block;
 	int need_datasync = 0, set_large_file = 0;
 	uid_t i_uid;
 	gid_t i_gid;
@@ -4792,9 +4792,9 @@ static int ext4_do_update_inode(handle_t *handle,
 					      bh->b_data);
 
 	BUFFER_TRACE(bh, "call ext4_handle_dirty_metadata");
-	rc = ext4_handle_dirty_metadata(handle, NULL, bh);
-	if (!err)
-		err = rc;
+	err = ext4_handle_dirty_metadata(handle, NULL, bh);
+	if (err)
+		goto out_brelse;
 	ext4_clear_inode_state(inode, EXT4_STATE_NEW);
 	if (set_large_file) {
 		BUFFER_TRACE(EXT4_SB(sb)->s_sbh, "get write access");

From 9670d14b733bcdf3ecec521d202af0fd03e57c00 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Wed, 17 Mar 2021 15:38:52 +0100
Subject: [PATCH 1739/2658] genirq: Disable interrupts for force threaded
 handlers

commit 81e2073c175b887398e5bca6c004efa89983f58d upstream.

With interrupt force threading all device interrupt handlers are invoked
from kernel threads. Contrary to hard interrupt context the invocation only
disables bottom halfs, but not interrupts. This was an oversight back then
because any code like this will have an issue:

thread(irq_A)
  irq_handler(A)
    spin_lock(&foo->lock);

interrupt(irq_B)
  irq_handler(B)
    spin_lock(&foo->lock);

This has been triggered with networking (NAPI vs. hrtimers) and console
drivers where printk() happens from an interrupt which interrupted the
force threaded handler.

Now people noticed and started to change the spin_lock() in the handler to
spin_lock_irqsave() which affects performance or add IRQF_NOTHREAD to the
interrupt request which in turn breaks RT.

Fix the root cause and not the symptom and disable interrupts before
invoking the force threaded handler which preserves the regular semantics
and the usefulness of the interrupt force threading as a general debugging
tool.

For not RT this is not changing much, except that during the execution of
the threaded handler interrupts are delayed until the handler
returns. Vs. scheduling and softirq processing there is no difference.

For RT kernels there is no issue.

Fixes: 8d32a307e4fa ("genirq: Provide forced interrupt threading")
Reported-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Johan Hovold <johan@kernel.org>
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20210317143859.513307808@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/irq/manage.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 8b93c2ec21aa..53b81b051d87 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -890,11 +890,15 @@ irq_forced_thread_fn(struct irq_desc *desc, struct irqaction *action)
 	irqreturn_t ret;
 
 	local_bh_disable();
+	if (!IS_ENABLED(CONFIG_PREEMPT_RT_BASE))
+		local_irq_disable();
 	ret = action->thread_fn(action->irq, action->dev_id);
 	if (ret == IRQ_HANDLED)
 		atomic_inc(&desc->threads_handled);
 
 	irq_finalize_oneshot(desc, action);
+	if (!IS_ENABLED(CONFIG_PREEMPT_RT_BASE))
+		local_irq_enable();
 	local_bh_enable();
 	return ret;
 }

From 741ea5ba33a5122fb71b96ba515cdeae3799833d Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 24 Mar 2021 10:57:01 +0100
Subject: [PATCH 1740/2658] Linux 4.4.263

Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Link: https://lore.kernel.org/r/20210322121919.202392464@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 421b1d31c5a4..e6f946c45270 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 262
+SUBLEVEL = 263
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From e9fe6951bb4fb39b970f138091ca803b900ae3fa Mon Sep 17 00:00:00 2001
From: Heiko Thiery <heiko.thiery@gmail.com>
Date: Thu, 25 Feb 2021 22:15:16 +0100
Subject: [PATCH 1741/2658] net: fec: ptp: avoid register access when ipg clock
 is disabled

[ Upstream commit 6a4d7234ae9a3bb31181f348ade9bbdb55aeb5c5 ]

When accessing the timecounter register on an i.MX8MQ the kernel hangs.
This is only the case when the interface is down. This can be reproduced
by reading with 'phc_ctrl eth0 get'.

Like described in the change in 91c0d987a9788dcc5fe26baafd73bf9242b68900
the igp clock is disabled when the interface is down and leads to a
system hang.

So we check if the ptp clock status before reading the timecounter
register.

Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Link: https://lore.kernel.org/r/20210225211514.9115-1-heiko.thiery@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/fec_ptp.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
index f9e74461bdc0..123181612595 100644
--- a/drivers/net/ethernet/freescale/fec_ptp.c
+++ b/drivers/net/ethernet/freescale/fec_ptp.c
@@ -396,9 +396,16 @@ static int fec_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts)
 	u64 ns;
 	unsigned long flags;
 
+	mutex_lock(&adapter->ptp_clk_mutex);
+	/* Check the ptp clock */
+	if (!adapter->ptp_clk_on) {
+		mutex_unlock(&adapter->ptp_clk_mutex);
+		return -EINVAL;
+	}
 	spin_lock_irqsave(&adapter->tmreg_lock, flags);
 	ns = timecounter_read(&adapter->tc);
 	spin_unlock_irqrestore(&adapter->tmreg_lock, flags);
+	mutex_unlock(&adapter->ptp_clk_mutex);
 
 	*ts = ns_to_timespec64(ns);
 

From 93fbbe88b3cc0f383fffeede4437fcf849ab842b Mon Sep 17 00:00:00 2001
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Thu, 18 Feb 2021 23:30:58 +1100
Subject: [PATCH 1742/2658] powerpc/4xx: Fix build errors from mfdcr()

[ Upstream commit eead089311f4d935ab5d1d8fbb0c42ad44699ada ]

lkp reported a build error in fsp2.o:

  CC      arch/powerpc/platforms/44x/fsp2.o
  {standard input}:577: Error: unsupported relocation against base

Which comes from:

  pr_err("GESR0: 0x%08x\n", mfdcr(base + PLB4OPB_GESR0));

Where our mfdcr() macro is stringifying "base + PLB4OPB_GESR0", and
passing that to the assembler, which obviously doesn't work.

The mfdcr() macro already checks that the argument is constant using
__builtin_constant_p(), and if not calls the out-of-line version of
mfdcr(). But in this case GCC is smart enough to notice that "base +
PLB4OPB_GESR0" will be constant, even though it's not something we can
immediately stringify into a register number.

Segher pointed out that passing the register number to the inline asm
as a constant would be better, and in fact it fixes the build error,
presumably because it gives GCC a chance to resolve the value.

While we're at it, change mtdcr() similarly.

Reported-by: kernel test robot <lkp@intel.com>
Suggested-by: Segher Boessenkool <segher@kernel.crashing.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Acked-by: Feng Tang <feng.tang@intel.com>
Link: https://lore.kernel.org/r/20210218123058.748882-1-mpe@ellerman.id.au
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/dcr-native.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/powerpc/include/asm/dcr-native.h b/arch/powerpc/include/asm/dcr-native.h
index 4efc11dacb98..4494d5e1932f 100644
--- a/arch/powerpc/include/asm/dcr-native.h
+++ b/arch/powerpc/include/asm/dcr-native.h
@@ -64,8 +64,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val)
 #define mfdcr(rn)						\
 	({unsigned int rval;					\
 	if (__builtin_constant_p(rn) && rn < 1024)		\
-		asm volatile("mfdcr %0," __stringify(rn)	\
-		              : "=r" (rval));			\
+		asm volatile("mfdcr %0, %1" : "=r" (rval)	\
+			      : "n" (rn));			\
 	else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR)))	\
 		rval = mfdcrx(rn);				\
 	else							\
@@ -75,8 +75,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val)
 #define mtdcr(rn, v)						\
 do {								\
 	if (__builtin_constant_p(rn) && rn < 1024)		\
-		asm volatile("mtdcr " __stringify(rn) ",%0"	\
-			      : : "r" (v)); 			\
+		asm volatile("mtdcr %0, %1"			\
+			      : : "n" (rn), "r" (v));		\
 	else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR)))	\
 		mtdcrx(rn, v);					\
 	else							\

From e48f2d5a443b852675b1eba8e9bc62f28f3976c8 Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Sat, 27 Feb 2021 16:15:06 -0500
Subject: [PATCH 1743/2658] atm: eni: dont release is never initialized

[ Upstream commit 4deb550bc3b698a1f03d0332cde3df154d1b6c1e ]

label err_eni_release is reachable when eni_start() fail.
In eni_start() it calls dev->phy->start() in the last step, if start()
fail we don't need to call phy->stop(), if start() is never called, we
neither need to call phy->stop(), otherwise null-ptr-deref will happen.

In order to fix this issue, don't call phy->stop() in label err_eni_release

[    4.875714] ==================================================================
[    4.876091] BUG: KASAN: null-ptr-deref in suni_stop+0x47/0x100 [suni]
[    4.876433] Read of size 8 at addr 0000000000000030 by task modprobe/95
[    4.876778]
[    4.876862] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc7-00090-gdcc0b49040c7 #2
[    4.877290] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd94
[    4.877876] Call Trace:
[    4.878009]  dump_stack+0x7d/0xa3
[    4.878191]  kasan_report.cold+0x10c/0x10e
[    4.878410]  ? __slab_free+0x2f0/0x340
[    4.878612]  ? suni_stop+0x47/0x100 [suni]
[    4.878832]  suni_stop+0x47/0x100 [suni]
[    4.879043]  eni_do_release+0x3b/0x70 [eni]
[    4.879269]  eni_init_one.cold+0x1152/0x1747 [eni]
[    4.879528]  ? _raw_spin_lock_irqsave+0x7b/0xd0
[    4.879768]  ? eni_ioctl+0x270/0x270 [eni]
[    4.879990]  ? __mutex_lock_slowpath+0x10/0x10
[    4.880226]  ? eni_ioctl+0x270/0x270 [eni]
[    4.880448]  local_pci_probe+0x6f/0xb0
[    4.880650]  pci_device_probe+0x171/0x240
[    4.880864]  ? pci_device_remove+0xe0/0xe0
[    4.881086]  ? kernfs_create_link+0xb6/0x110
[    4.881315]  ? sysfs_do_create_link_sd.isra.0+0x76/0xe0
[    4.881594]  really_probe+0x161/0x420
[    4.881791]  driver_probe_device+0x6d/0xd0
[    4.882010]  device_driver_attach+0x82/0x90
[    4.882233]  ? device_driver_attach+0x90/0x90
[    4.882465]  __driver_attach+0x60/0x100
[    4.882671]  ? device_driver_attach+0x90/0x90
[    4.882903]  bus_for_each_dev+0xe1/0x140
[    4.883114]  ? subsys_dev_iter_exit+0x10/0x10
[    4.883346]  ? klist_node_init+0x61/0x80
[    4.883557]  bus_add_driver+0x254/0x2a0
[    4.883764]  driver_register+0xd3/0x150
[    4.883971]  ? 0xffffffffc0038000
[    4.884149]  do_one_initcall+0x84/0x250
[    4.884355]  ? trace_event_raw_event_initcall_finish+0x150/0x150
[    4.884674]  ? unpoison_range+0xf/0x30
[    4.884875]  ? ____kasan_kmalloc.constprop.0+0x84/0xa0
[    4.885150]  ? unpoison_range+0xf/0x30
[    4.885352]  ? unpoison_range+0xf/0x30
[    4.885557]  do_init_module+0xf8/0x350
[    4.885760]  load_module+0x3fe6/0x4340
[    4.885960]  ? vm_unmap_ram+0x1d0/0x1d0
[    4.886166]  ? ____kasan_kmalloc.constprop.0+0x84/0xa0
[    4.886441]  ? module_frob_arch_sections+0x20/0x20
[    4.886697]  ? __do_sys_finit_module+0x108/0x170
[    4.886941]  __do_sys_finit_module+0x108/0x170
[    4.887178]  ? __ia32_sys_init_module+0x40/0x40
[    4.887419]  ? file_open_root+0x200/0x200
[    4.887634]  ? do_sys_open+0x85/0xe0
[    4.887826]  ? filp_open+0x50/0x50
[    4.888009]  ? fpregs_assert_state_consistent+0x4d/0x60
[    4.888287]  ? exit_to_user_mode_prepare+0x2f/0x130
[    4.888547]  do_syscall_64+0x33/0x40
[    4.888739]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[    4.889010] RIP: 0033:0x7ff62fcf1cf7
[    4.889202] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f71
[    4.890172] RSP: 002b:00007ffe6644ade8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[    4.890570] RAX: ffffffffffffffda RBX: 0000000000f2ca70 RCX: 00007ff62fcf1cf7
[    4.890944] RDX: 0000000000000000 RSI: 0000000000f2b9e0 RDI: 0000000000000003
[    4.891318] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001
[    4.891691] R10: 00007ff62fd55300 R11: 0000000000000246 R12: 0000000000f2b9e0
[    4.892064] R13: 0000000000000000 R14: 0000000000f2bdd0 R15: 0000000000000001
[    4.892439] ==================================================================

Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/atm/eni.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
index 340a1ee79d28..3d5ad2bc809b 100644
--- a/drivers/atm/eni.c
+++ b/drivers/atm/eni.c
@@ -2278,7 +2278,8 @@ static int eni_init_one(struct pci_dev *pci_dev,
 	return rc;
 
 err_eni_release:
-	eni_do_release(dev);
+	dev->phy = NULL;
+	iounmap(ENI_DEV(dev)->ioaddr);
 err_unregister:
 	atm_dev_deregister(dev);
 err_free_consistent:

From 28c584bb9022a279e9ced1c1bb8b8e53c995fda7 Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Sat, 27 Feb 2021 22:55:50 -0500
Subject: [PATCH 1744/2658] atm: lanai: dont run lanai_dev_close if not open

[ Upstream commit a2bd45834e83d6c5a04d397bde13d744a4812dfc ]

lanai_dev_open() can fail. When it fail, lanai->base is unmapped and the
pci device is disabled. The caller, lanai_init_one(), then tries to run
atm_dev_deregister(). This will subsequently call lanai_dev_close() and
use the already released MMIO area.

To fix this issue, set the lanai->base to NULL if open fail,
and test the flag in lanai_dev_close().

[    8.324153] lanai: lanai_start() failed, err=19
[    8.324819] lanai(itf 0): shutting down interface
[    8.325211] BUG: unable to handle page fault for address: ffffc90000180024
[    8.325781] #PF: supervisor write access in kernel mode
[    8.326215] #PF: error_code(0x0002) - not-present page
[    8.326641] PGD 100000067 P4D 100000067 PUD 100139067 PMD 10013a067 PTE 0
[    8.327206] Oops: 0002 [#1] SMP KASAN NOPTI
[    8.327557] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc7-00090-gdcc0b49040c7 #12
[    8.328229] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd9c812dda519-4
[    8.329145] RIP: 0010:lanai_dev_close+0x4f/0xe5 [lanai]
[    8.329587] Code: 00 48 c7 c7 00 d3 01 c0 e8 49 4e 0a c2 48 8d bd 08 02 00 00 e8 6e 52 14 c1 48 80
[    8.330917] RSP: 0018:ffff8881029ef680 EFLAGS: 00010246
[    8.331196] RAX: 000000000003fffe RBX: ffff888102fb4800 RCX: ffffffffc001a98a
[    8.331572] RDX: ffffc90000180000 RSI: 0000000000000246 RDI: ffff888102fb4000
[    8.331948] RBP: ffff888102fb4000 R08: ffffffff8115da8a R09: ffffed102053deaa
[    8.332326] R10: 0000000000000003 R11: ffffed102053dea9 R12: ffff888102fb48a4
[    8.332701] R13: ffffffffc00123c0 R14: ffff888102fb4b90 R15: ffff888102fb4b88
[    8.333077] FS:  00007f08eb9056a0(0000) GS:ffff88815b400000(0000) knlGS:0000000000000000
[    8.333502] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    8.333806] CR2: ffffc90000180024 CR3: 0000000102a28000 CR4: 00000000000006f0
[    8.334182] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    8.334557] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[    8.334932] Call Trace:
[    8.335066]  atm_dev_deregister+0x161/0x1a0 [atm]
[    8.335324]  lanai_init_one.cold+0x20c/0x96d [lanai]
[    8.335594]  ? lanai_send+0x2a0/0x2a0 [lanai]
[    8.335831]  local_pci_probe+0x6f/0xb0
[    8.336039]  pci_device_probe+0x171/0x240
[    8.336255]  ? pci_device_remove+0xe0/0xe0
[    8.336475]  ? kernfs_create_link+0xb6/0x110
[    8.336704]  ? sysfs_do_create_link_sd.isra.0+0x76/0xe0
[    8.336983]  really_probe+0x161/0x420
[    8.337181]  driver_probe_device+0x6d/0xd0
[    8.337401]  device_driver_attach+0x82/0x90
[    8.337626]  ? device_driver_attach+0x90/0x90
[    8.337859]  __driver_attach+0x60/0x100
[    8.338065]  ? device_driver_attach+0x90/0x90
[    8.338298]  bus_for_each_dev+0xe1/0x140
[    8.338511]  ? subsys_dev_iter_exit+0x10/0x10
[    8.338745]  ? klist_node_init+0x61/0x80
[    8.338956]  bus_add_driver+0x254/0x2a0
[    8.339164]  driver_register+0xd3/0x150
[    8.339370]  ? 0xffffffffc0028000
[    8.339550]  do_one_initcall+0x84/0x250
[    8.339755]  ? trace_event_raw_event_initcall_finish+0x150/0x150
[    8.340076]  ? free_vmap_area_noflush+0x1a5/0x5c0
[    8.340329]  ? unpoison_range+0xf/0x30
[    8.340532]  ? ____kasan_kmalloc.constprop.0+0x84/0xa0
[    8.340806]  ? unpoison_range+0xf/0x30
[    8.341014]  ? unpoison_range+0xf/0x30
[    8.341217]  do_init_module+0xf8/0x350
[    8.341419]  load_module+0x3fe6/0x4340
[    8.341621]  ? vm_unmap_ram+0x1d0/0x1d0
[    8.341826]  ? ____kasan_kmalloc.constprop.0+0x84/0xa0
[    8.342101]  ? module_frob_arch_sections+0x20/0x20
[    8.342358]  ? __do_sys_finit_module+0x108/0x170
[    8.342604]  __do_sys_finit_module+0x108/0x170
[    8.342841]  ? __ia32_sys_init_module+0x40/0x40
[    8.343083]  ? file_open_root+0x200/0x200
[    8.343298]  ? do_sys_open+0x85/0xe0
[    8.343491]  ? filp_open+0x50/0x50
[    8.343675]  ? exit_to_user_mode_prepare+0xfc/0x130
[    8.343935]  do_syscall_64+0x33/0x40
[    8.344132]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[    8.344401] RIP: 0033:0x7f08eb887cf7
[    8.344594] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f7 48 89 d6 41
[    8.345565] RSP: 002b:00007ffcd5c98ad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[    8.345962] RAX: ffffffffffffffda RBX: 00000000008fea70 RCX: 00007f08eb887cf7
[    8.346336] RDX: 0000000000000000 RSI: 00000000008fd9e0 RDI: 0000000000000003
[    8.346711] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001
[    8.347085] R10: 00007f08eb8eb300 R11: 0000000000000246 R12: 00000000008fd9e0
[    8.347460] R13: 0000000000000000 R14: 00000000008fddd0 R15: 0000000000000001
[    8.347836] Modules linked in: lanai(+) atm
[    8.348065] CR2: ffffc90000180024
[    8.348244] ---[ end trace 7fdc1c668f2003e5 ]---
[    8.348490] RIP: 0010:lanai_dev_close+0x4f/0xe5 [lanai]
[    8.348772] Code: 00 48 c7 c7 00 d3 01 c0 e8 49 4e 0a c2 48 8d bd 08 02 00 00 e8 6e 52 14 c1 48 80
[    8.349745] RSP: 0018:ffff8881029ef680 EFLAGS: 00010246
[    8.350022] RAX: 000000000003fffe RBX: ffff888102fb4800 RCX: ffffffffc001a98a
[    8.350397] RDX: ffffc90000180000 RSI: 0000000000000246 RDI: ffff888102fb4000
[    8.350772] RBP: ffff888102fb4000 R08: ffffffff8115da8a R09: ffffed102053deaa
[    8.351151] R10: 0000000000000003 R11: ffffed102053dea9 R12: ffff888102fb48a4
[    8.351525] R13: ffffffffc00123c0 R14: ffff888102fb4b90 R15: ffff888102fb4b88
[    8.351918] FS:  00007f08eb9056a0(0000) GS:ffff88815b400000(0000) knlGS:0000000000000000
[    8.352343] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    8.352647] CR2: ffffc90000180024 CR3: 0000000102a28000 CR4: 00000000000006f0
[    8.353022] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    8.353397] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[    8.353958] modprobe (95) used greatest stack depth: 26216 bytes left

Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/atm/lanai.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
index ce43ae3e87b3..3002b1177005 100644
--- a/drivers/atm/lanai.c
+++ b/drivers/atm/lanai.c
@@ -2239,6 +2239,7 @@ static int lanai_dev_open(struct atm_dev *atmdev)
 	conf1_write(lanai);
 #endif
 	iounmap(lanai->base);
+	lanai->base = NULL;
     error_pci:
 	pci_disable_device(lanai->pci);
     error:
@@ -2251,6 +2252,8 @@ static int lanai_dev_open(struct atm_dev *atmdev)
 static void lanai_dev_close(struct atm_dev *atmdev)
 {
 	struct lanai_dev *lanai = (struct lanai_dev *) atmdev->dev_data;
+	if (lanai->base==NULL)
+		return;
 	printk(KERN_INFO DEV_LABEL "(itf %d): shutting down interface\n",
 	    lanai->number);
 	lanai_timed_poll_stop(lanai);
@@ -2560,7 +2563,7 @@ static int lanai_init_one(struct pci_dev *pci,
 	struct atm_dev *atmdev;
 	int result;
 
-	lanai = kmalloc(sizeof(*lanai), GFP_KERNEL);
+	lanai = kzalloc(sizeof(*lanai), GFP_KERNEL);
 	if (lanai == NULL) {
 		printk(KERN_ERR DEV_LABEL
 		       ": couldn't allocate dev_data structure!\n");

From 0985e99af797de99007e5ca5146ff104a06015d1 Mon Sep 17 00:00:00 2001
From: Jia-Ju Bai <baijiaju1990@gmail.com>
Date: Thu, 4 Mar 2021 18:06:48 -0800
Subject: [PATCH 1745/2658] net: tehuti: fix error return code in bdx_probe()

[ Upstream commit 38c26ff3048af50eee3fcd591921357ee5bfd9ee ]

When bdx_read_mac() fails, no error return code of bdx_probe()
is assigned.
To fix this bug, err is assigned with -EFAULT as error return code.

Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/tehuti/tehuti.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
index 14c9d1baa85c..19c832aaecf0 100644
--- a/drivers/net/ethernet/tehuti/tehuti.c
+++ b/drivers/net/ethernet/tehuti/tehuti.c
@@ -2068,6 +2068,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 		/*bdx_hw_reset(priv); */
 		if (bdx_read_mac(priv)) {
 			pr_err("load MAC address failed\n");
+			err = -EFAULT;
 			goto err_out_iomap;
 		}
 		SET_NETDEV_DEV(ndev, &pdev->dev);

From 341eb38a341f2152cd5fa8ac0da885ae8488ca5b Mon Sep 17 00:00:00 2001
From: Denis Efremov <efremov@linux.com>
Date: Fri, 5 Mar 2021 20:02:12 +0300
Subject: [PATCH 1746/2658] sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count

[ Upstream commit 155b23e6e53475ca3b8c2a946299b4d4dd6a5a1e ]

RXMAC_BC_FRM_CNT_COUNT added to mp->rx_bcasts twice in a row
in niu_xmac_interrupt(). Remove the second addition.

Signed-off-by: Denis Efremov <efremov@linux.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/sun/niu.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index 85f3a2c0d4dd..cc3b025ab7a7 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -3948,8 +3948,6 @@ static void niu_xmac_interrupt(struct niu *np)
 		mp->rx_mcasts += RXMAC_MC_FRM_CNT_COUNT;
 	if (val & XRXMAC_STATUS_RXBCAST_CNT_EXP)
 		mp->rx_bcasts += RXMAC_BC_FRM_CNT_COUNT;
-	if (val & XRXMAC_STATUS_RXBCAST_CNT_EXP)
-		mp->rx_bcasts += RXMAC_BC_FRM_CNT_COUNT;
 	if (val & XRXMAC_STATUS_RXHIST1_CNT_EXP)
 		mp->rx_hist_cnt1 += RXMAC_HIST_CNT1_COUNT;
 	if (val & XRXMAC_STATUS_RXHIST2_CNT_EXP)

From f72a319e260c2658a82aba2bb69f61630b2b62a0 Mon Sep 17 00:00:00 2001
From: Timo Rothenpieler <timo@rothenpieler.org>
Date: Tue, 23 Feb 2021 15:19:01 +0100
Subject: [PATCH 1747/2658] nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default

[ Upstream commit a0590473c5e6c4ef17c3132ad08fbad170f72d55 ]

This follows what was done in 8c2fabc6542d9d0f8b16bd1045c2eda59bdcde13.
With the default being m, it's impossible to build the module into the
kernel.

Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
index c3428767332c..55ebf9f4a824 100644
--- a/fs/nfs/Kconfig
+++ b/fs/nfs/Kconfig
@@ -132,7 +132,7 @@ config PNFS_OBJLAYOUT
 config PNFS_FLEXFILE_LAYOUT
 	tristate
 	depends on NFS_V4_1 && NFS_V3
-	default m
+	default NFS_V4
 
 config NFS_V4_1_IMPLEMENTATION_ID_DOMAIN
 	string "NFSv4.1 Implementation ID Domain"

From b538b906a3f80eeaa3de6cd670eacdc6731fe6e6 Mon Sep 17 00:00:00 2001
From: Frank Sorenson <sorenson@redhat.com>
Date: Mon, 8 Mar 2021 12:12:13 -0600
Subject: [PATCH 1748/2658] NFS: Correct size calculation for create reply
 length

[ Upstream commit ad3dbe35c833c2d4d0bbf3f04c785d32f931e7c9 ]

CREATE requests return a post_op_fh3, rather than nfs_fh3. The
post_op_fh3 includes an extra word to indicate 'handle_follows'.

Without that additional word, create fails when full 64-byte
filehandles are in use.

Add NFS3_post_op_fh_sz, and correct the size calculation for
NFS3_createres_sz.

Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs3xdr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index 267126d32ec0..4a68837e92ea 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -33,6 +33,7 @@
  */
 #define NFS3_fhandle_sz		(1+16)
 #define NFS3_fh_sz		(NFS3_fhandle_sz)	/* shorthand */
+#define NFS3_post_op_fh_sz	(1+NFS3_fh_sz)
 #define NFS3_sattr_sz		(15)
 #define NFS3_filename_sz	(1+(NFS3_MAXNAMLEN>>2))
 #define NFS3_path_sz		(1+(NFS3_MAXPATHLEN>>2))
@@ -70,7 +71,7 @@
 #define NFS3_readlinkres_sz	(1+NFS3_post_op_attr_sz+1)
 #define NFS3_readres_sz		(1+NFS3_post_op_attr_sz+3)
 #define NFS3_writeres_sz	(1+NFS3_wcc_data_sz+4)
-#define NFS3_createres_sz	(1+NFS3_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)
+#define NFS3_createres_sz	(1+NFS3_post_op_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)
 #define NFS3_renameres_sz	(1+(2 * NFS3_wcc_data_sz))
 #define NFS3_linkres_sz		(1+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)
 #define NFS3_readdirres_sz	(1+NFS3_post_op_attr_sz+2)

From b5dd3abb85ddd3c723c2089f7c8d49b136cc506c Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Sun, 7 Mar 2021 22:25:29 -0500
Subject: [PATCH 1749/2658] atm: uPD98402: fix incorrect allocation

[ Upstream commit 3153724fc084d8ef640c611f269ddfb576d1dcb1 ]

dev->dev_data is set in zatm.c, calling zatm_start() will overwrite this
dev->dev_data in uPD98402_start() and a subsequent PRIV(dev)->lock
(i.e dev->phy_data->lock) will result in a null-ptr-dereference.

I believe this is a typo and what it actually want to do is to allocate
phy_data instead of dev_data.

Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/atm/uPD98402.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/atm/uPD98402.c b/drivers/atm/uPD98402.c
index 5120a96b3a89..b2f4e8df1591 100644
--- a/drivers/atm/uPD98402.c
+++ b/drivers/atm/uPD98402.c
@@ -210,7 +210,7 @@ static void uPD98402_int(struct atm_dev *dev)
 static int uPD98402_start(struct atm_dev *dev)
 {
 	DPRINTK("phy_start\n");
-	if (!(dev->dev_data = kmalloc(sizeof(struct uPD98402_priv),GFP_KERNEL)))
+	if (!(dev->phy_data = kmalloc(sizeof(struct uPD98402_priv),GFP_KERNEL)))
 		return -ENOMEM;
 	spin_lock_init(&PRIV(dev)->lock);
 	memset(&PRIV(dev)->sonet_stats,0,sizeof(struct k_sonet_stats));

From 1c6bb45afea32d7df90c64275b864a247910f553 Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Sun, 7 Mar 2021 22:25:30 -0500
Subject: [PATCH 1750/2658] atm: idt77252: fix null-ptr-dereference

[ Upstream commit 4416e98594dc04590ebc498fc4e530009535c511 ]

this one is similar to the phy_data allocation fix in uPD98402, the
driver allocate the idt77105_priv and store to dev_data but later
dereference using dev->dev_data, which will cause null-ptr-dereference.

fix this issue by changing dev_data to phy_data so that PRIV(dev) can
work correctly.

Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/atm/idt77105.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/atm/idt77105.c b/drivers/atm/idt77105.c
index feb023d7eebd..40644670cff2 100644
--- a/drivers/atm/idt77105.c
+++ b/drivers/atm/idt77105.c
@@ -261,7 +261,7 @@ static int idt77105_start(struct atm_dev *dev)
 {
 	unsigned long flags;
 
-	if (!(dev->dev_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL)))
+	if (!(dev->phy_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL)))
 		return -ENOMEM;
 	PRIV(dev)->dev = dev;
 	spin_lock_irqsave(&idt77105_priv_lock, flags);
@@ -338,7 +338,7 @@ static int idt77105_stop(struct atm_dev *dev)
                 else
                     idt77105_all = walk->next;
 	        dev->phy = NULL;
-                dev->dev_data = NULL;
+                dev->phy_data = NULL;
                 kfree(walk);
                 break;
             }

From b6f9015cb1169d29731ceb9e7a8f4be5695429c6 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Mon, 8 Mar 2021 09:38:12 +0100
Subject: [PATCH 1751/2658] u64_stats,lockdep: Fix u64_stats_init() vs lockdep

[ Upstream commit d5b0e0677bfd5efd17c5bbb00156931f0d41cb85 ]

Jakub reported that:

    static struct net_device *rtl8139_init_board(struct pci_dev *pdev)
    {
	    ...
	    u64_stats_init(&tp->rx_stats.syncp);
	    u64_stats_init(&tp->tx_stats.syncp);
	    ...
    }

results in lockdep getting confused between the RX and TX stats lock.
This is because u64_stats_init() is an inline calling seqcount_init(),
which is a macro using a static variable to generate a lockdep class.

By wrapping that in an inline, we negate the effect of the macro and
fold the static key variable, hence the confusion.

Fix by also making u64_stats_init() a macro for the case where it
matters, leaving the other case an inline for argument validation
etc.

Reported-by: Jakub Kicinski <kuba@kernel.org>
Debugged-by: "Ahmed S. Darwish" <a.darwish@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: "Erhard F." <erhard_f@mailbox.org>
Link: https://lkml.kernel.org/r/YEXicy6+9MksdLZh@hirez.programming.kicks-ass.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/u64_stats_sync.h | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/include/linux/u64_stats_sync.h b/include/linux/u64_stats_sync.h
index df89c9bcba7d..7b38288dc239 100644
--- a/include/linux/u64_stats_sync.h
+++ b/include/linux/u64_stats_sync.h
@@ -68,12 +68,13 @@ struct u64_stats_sync {
 };
 
 
+#if BITS_PER_LONG == 32 && defined(CONFIG_SMP)
+#define u64_stats_init(syncp)	seqcount_init(&(syncp)->seq)
+#else
 static inline void u64_stats_init(struct u64_stats_sync *syncp)
 {
-#if BITS_PER_LONG == 32 && defined(CONFIG_SMP)
-	seqcount_init(&syncp->seq);
-#endif
 }
+#endif
 
 static inline void u64_stats_update_begin(struct u64_stats_sync *syncp)
 {

From c1353ad2ab8656000fababefa7870d1562e74b94 Mon Sep 17 00:00:00 2001
From: "J. Bruce Fields" <bfields@redhat.com>
Date: Thu, 28 Jan 2021 17:36:38 -0500
Subject: [PATCH 1752/2658] nfs: we don't support removing system.nfs4_acl

[ Upstream commit 4f8be1f53bf615102d103c0509ffa9596f65b718 ]

The NFSv4 protocol doesn't have any notion of reomoving an attribute, so
removexattr(path,"system.nfs4_acl") doesn't make sense.

There's no documented return value.  Arguably it could be EOPNOTSUPP but
I'm a little worried an application might take that to mean that we
don't support ACLs or xattrs.  How about EINVAL?

Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs4proc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 0c9386978d9d..92ca753723b5 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -4848,6 +4848,9 @@ static int __nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t bufl
 	unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE);
 	int ret, i;
 
+	/* You can't remove system.nfs4_acl: */
+	if (buflen == 0)
+		return -EINVAL;
 	if (!nfs4_server_supports_acls(server))
 		return -EOPNOTSUPP;
 	if (npages > ARRAY_SIZE(pages))

From 2b7fa8299125a61b60d83993e3193a1bab24e170 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyfox@gentoo.org>
Date: Fri, 12 Mar 2021 21:08:23 -0800
Subject: [PATCH 1753/2658] ia64: fix ia64_syscall_get_set_arguments() for
 break-based syscalls

[ Upstream commit 0ceb1ace4a2778e34a5414e5349712ae4dc41d85 ]

In https://bugs.gentoo.org/769614 Dmitry noticed that
`ptrace(PTRACE_GET_SYSCALL_INFO)` does not work for syscalls called via
glibc's syscall() wrapper.

ia64 has two ways to call syscalls from userspace: via `break` and via
`eps` instructions.

The difference is in stack layout:

1. `eps` creates simple stack frame: no locals, in{0..7} == out{0..8}
2. `break` uses userspace stack frame: may be locals (glibc provides
   one), in{0..7} == out{0..8}.

Both work fine in syscall handling cde itself.

But `ptrace(PTRACE_GET_SYSCALL_INFO)` uses unwind mechanism to
re-extract syscall arguments but it does not account for locals.

The change always skips locals registers. It should not change `eps`
path as kernel's handler already enforces locals=0 and fixes `break`.

Tested on v5.10 on rx3600 machine (ia64 9040 CPU).

Link: https://lkml.kernel.org/r/20210221002554.333076-1-slyfox@gentoo.org
Link: https://bugs.gentoo.org/769614
Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
Reported-by: Dmitry V. Levin <ldv@altlinux.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/ia64/kernel/ptrace.c | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
index 6f54d511cc50..a757b123ebaf 100644
--- a/arch/ia64/kernel/ptrace.c
+++ b/arch/ia64/kernel/ptrace.c
@@ -2140,27 +2140,39 @@ static void syscall_get_set_args_cb(struct unw_frame_info *info, void *data)
 {
 	struct syscall_get_set_args *args = data;
 	struct pt_regs *pt = args->regs;
-	unsigned long *krbs, cfm, ndirty;
+	unsigned long *krbs, cfm, ndirty, nlocals, nouts;
 	int i, count;
 
 	if (unw_unwind_to_user(info) < 0)
 		return;
 
+	/*
+	 * We get here via a few paths:
+	 * - break instruction: cfm is shared with caller.
+	 *   syscall args are in out= regs, locals are non-empty.
+	 * - epsinstruction: cfm is set by br.call
+	 *   locals don't exist.
+	 *
+	 * For both cases argguments are reachable in cfm.sof - cfm.sol.
+	 * CFM: [ ... | sor: 17..14 | sol : 13..7 | sof : 6..0 ]
+	 */
 	cfm = pt->cr_ifs;
+	nlocals = (cfm >> 7) & 0x7f; /* aka sol */
+	nouts = (cfm & 0x7f) - nlocals; /* aka sof - sol */
 	krbs = (unsigned long *)info->task + IA64_RBS_OFFSET/8;
 	ndirty = ia64_rse_num_regs(krbs, krbs + (pt->loadrs >> 19));
 
 	count = 0;
 	if (in_syscall(pt))
-		count = min_t(int, args->n, cfm & 0x7f);
+		count = min_t(int, args->n, nouts);
 
+	/* Iterate over outs. */
 	for (i = 0; i < count; i++) {
+		int j = ndirty + nlocals + i + args->i;
 		if (args->rw)
-			*ia64_rse_skip_regs(krbs, ndirty + i + args->i) =
-				args->args[i];
+			*ia64_rse_skip_regs(krbs, j) = args->args[i];
 		else
-			args->args[i] = *ia64_rse_skip_regs(krbs,
-				ndirty + i + args->i);
+			args->args[i] = *ia64_rse_skip_regs(krbs, j);
 	}
 
 	if (!args->rw) {

From 7ee920053f24c2f46982664d21a5c3c5b6aaeb95 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyfox@gentoo.org>
Date: Fri, 12 Mar 2021 21:08:27 -0800
Subject: [PATCH 1754/2658] ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign

[ Upstream commit 61bf318eac2c13356f7bd1c6a05421ef504ccc8a ]

In https://bugs.gentoo.org/769614 Dmitry noticed that
`ptrace(PTRACE_GET_SYSCALL_INFO)` does not return error sign properly.

The bug is in mismatch between get/set errors:

static inline long syscall_get_error(struct task_struct *task,
                                     struct pt_regs *regs)
{
        return regs->r10 == -1 ? regs->r8:0;
}

static inline long syscall_get_return_value(struct task_struct *task,
                                            struct pt_regs *regs)
{
        return regs->r8;
}

static inline void syscall_set_return_value(struct task_struct *task,
                                            struct pt_regs *regs,
                                            int error, long val)
{
        if (error) {
                /* error < 0, but ia64 uses > 0 return value */
                regs->r8 = -error;
                regs->r10 = -1;
        } else {
                regs->r8 = val;
                regs->r10 = 0;
        }
}

Tested on v5.10 on rx3600 machine (ia64 9040 CPU).

Link: https://lkml.kernel.org/r/20210221002554.333076-2-slyfox@gentoo.org
Link: https://bugs.gentoo.org/769614
Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
Reported-by: Dmitry V. Levin <ldv@altlinux.org>
Reviewed-by: Dmitry V. Levin <ldv@altlinux.org>
Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/ia64/include/asm/syscall.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/ia64/include/asm/syscall.h b/arch/ia64/include/asm/syscall.h
index 1d0b875fec44..ec909eec0b4c 100644
--- a/arch/ia64/include/asm/syscall.h
+++ b/arch/ia64/include/asm/syscall.h
@@ -35,7 +35,7 @@ static inline void syscall_rollback(struct task_struct *task,
 static inline long syscall_get_error(struct task_struct *task,
 				     struct pt_regs *regs)
 {
-	return regs->r10 == -1 ? regs->r8:0;
+	return regs->r10 == -1 ? -regs->r8:0;
 }
 
 static inline long syscall_get_return_value(struct task_struct *task,

From 8a0133f2bdee4ab9f7403b4afa23d3208d8b4dad Mon Sep 17 00:00:00 2001
From: Borislav Petkov <bp@suse.de>
Date: Thu, 25 Mar 2021 11:02:31 +0100
Subject: [PATCH 1755/2658] x86/tlb: Flush global mappings when KAISER is
 disabled

Jim Mattson reported that Debian 9 guests using a 4.9-stable kernel
are exploding during alternatives patching:

  kernel BUG at /build/linux-dqnRSc/linux-4.9.228/arch/x86/kernel/alternative.c:709!
  invalid opcode: 0000 [#1] SMP
  Modules linked in:
  CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.9.0-13-amd64 #1 Debian 4.9.228-1
  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
  Call Trace:
   swap_entry_free
   swap_entry_free
   text_poke_bp
   swap_entry_free
   arch_jump_label_transform
   set_debug_rodata
   __jump_label_update
   static_key_slow_inc
   frontswap_register_ops
   init_zswap
   init_frontswap
   do_one_initcall
   set_debug_rodata
   kernel_init_freeable
   rest_init
   kernel_init
   ret_from_fork

triggering the BUG_ON in text_poke() which verifies whether patched
instruction bytes have actually landed at the destination.

Further debugging showed that the TLB flush before that check is
insufficient because there could be global mappings left in the TLB,
leading to a stale mapping getting used.

I say "global mappings" because the hardware configuration is a new one:
machine is an AMD, which means, KAISER/PTI doesn't need to be enabled
there, which also means there's no user/kernel pagetables split and
therefore the TLB can have global mappings.

And the configuration is new one for a second reason: because that AMD
machine supports PCID and INVPCID, which leads the CPU detection code to
set the synthetic X86_FEATURE_INVPCID_SINGLE flag.

Now, __native_flush_tlb_single() does invalidate global mappings when
X86_FEATURE_INVPCID_SINGLE is *not* set and returns.

When X86_FEATURE_INVPCID_SINGLE is set, however, it invalidates the
requested address from both PCIDs in the KAISER-enabled case. But if
KAISER is not enabled and the machine has global mappings in the TLB,
then those global mappings do not get invalidated, which would lead to
the above mismatch from using a stale TLB entry.

So make sure to flush those global mappings in the KAISER disabled case.

Co-debugged by Babu Moger <babu.moger@amd.com>.

Reported-by: Jim Mattson <jmattson@google.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Hugh Dickins <hughd@google.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Tested-by: Babu Moger <babu.moger@amd.com>
Tested-by: Jim Mattson <jmattson@google.com>
Link: https://lkml.kernel.org/r/CALMp9eRDSW66%2BXvbHVF4ohL7XhThoPoT0BrB0TcS0cgk=dkcBg@mail.gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/tlbflush.h | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
index 8dab88b85785..33a594f728de 100644
--- a/arch/x86/include/asm/tlbflush.h
+++ b/arch/x86/include/asm/tlbflush.h
@@ -245,12 +245,15 @@ static inline void __native_flush_tlb_single(unsigned long addr)
 	 * ASID.  But, userspace flushes are probably much more
 	 * important performance-wise.
 	 *
-	 * Make sure to do only a single invpcid when KAISER is
-	 * disabled and we have only a single ASID.
+	 * In the KAISER disabled case, do an INVLPG to make sure
+	 * the mapping is flushed in case it is a global one.
 	 */
-	if (kaiser_enabled)
+	if (kaiser_enabled) {
 		invpcid_flush_one(X86_CR3_PCID_ASID_USER, addr);
-	invpcid_flush_one(X86_CR3_PCID_ASID_KERN, addr);
+		invpcid_flush_one(X86_CR3_PCID_ASID_KERN, addr);
+	} else {
+		asm volatile("invlpg (%0)" ::"r" (addr) : "memory");
+	}
 }
 
 static inline void __flush_tlb_all(void)

From b42e65209e6c682786a4d75c1715f49b059ae37a Mon Sep 17 00:00:00 2001
From: Sean Nyekjaer <sean@geanix.com>
Date: Wed, 24 Mar 2021 21:37:32 -0700
Subject: [PATCH 1756/2658] squashfs: fix inode lookup sanity checks

commit c1b2028315c6b15e8d6725e0d5884b15887d3daa upstream.

When mouting a squashfs image created without inode compression it fails
with: "unable to read inode lookup table"

It turns out that the BLOCK_OFFSET is missing when checking the
SQUASHFS_METADATA_SIZE agaist the actual size.

Link: https://lkml.kernel.org/r/20210226092903.1473545-1-sean@geanix.com
Fixes: eabac19e40c0 ("squashfs: add more sanity checks in inode lookup")
Signed-off-by: Sean Nyekjaer <sean@geanix.com>
Acked-by: Phillip Lougher <phillip@squashfs.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/squashfs/export.c      | 8 ++++++--
 fs/squashfs/squashfs_fs.h | 1 +
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/fs/squashfs/export.c b/fs/squashfs/export.c
index d2a806416c3a..1d406a2094a5 100644
--- a/fs/squashfs/export.c
+++ b/fs/squashfs/export.c
@@ -165,14 +165,18 @@ __le64 *squashfs_read_inode_lookup_table(struct super_block *sb,
 		start = le64_to_cpu(table[n]);
 		end = le64_to_cpu(table[n + 1]);
 
-		if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
+		if (start >= end
+		    || (end - start) >
+		    (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
 			kfree(table);
 			return ERR_PTR(-EINVAL);
 		}
 	}
 
 	start = le64_to_cpu(table[indexes - 1]);
-	if (start >= lookup_table_start || (lookup_table_start - start) > SQUASHFS_METADATA_SIZE) {
+	if (start >= lookup_table_start ||
+	    (lookup_table_start - start) >
+	    (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
 		kfree(table);
 		return ERR_PTR(-EINVAL);
 	}
diff --git a/fs/squashfs/squashfs_fs.h b/fs/squashfs/squashfs_fs.h
index e66486366f02..2fd1262cc1bd 100644
--- a/fs/squashfs/squashfs_fs.h
+++ b/fs/squashfs/squashfs_fs.h
@@ -30,6 +30,7 @@
 
 /* size of metadata (inode and directory) blocks */
 #define SQUASHFS_METADATA_SIZE		8192
+#define SQUASHFS_BLOCK_OFFSET		2
 
 /* default size of block device I/O */
 #ifdef CONFIG_SQUASHFS_4K_DEVBLK_SIZE

From 4fb41544eb13c3845e22770bbcb784e056487ab5 Mon Sep 17 00:00:00 2001
From: Phillip Lougher <phillip@squashfs.org.uk>
Date: Wed, 24 Mar 2021 21:37:35 -0700
Subject: [PATCH 1757/2658] squashfs: fix xattr id and id lookup sanity checks

commit 8b44ca2b634527151af07447a8090a5f3a043321 upstream.

The checks for maximum metadata block size is missing
SQUASHFS_BLOCK_OFFSET (the two byte length count).

Link: https://lkml.kernel.org/r/2069685113.2081245.1614583677427@webmail.123-reg.co.uk
Fixes: f37aa4c7366e23f ("squashfs: add more sanity checks in id lookup")
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Cc: Sean Nyekjaer <sean@geanix.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/squashfs/id.c       | 6 ++++--
 fs/squashfs/xattr_id.c | 6 ++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/fs/squashfs/id.c b/fs/squashfs/id.c
index 8ccc0e3f6ea5..d2e15baab537 100644
--- a/fs/squashfs/id.c
+++ b/fs/squashfs/id.c
@@ -110,14 +110,16 @@ __le64 *squashfs_read_id_index_table(struct super_block *sb,
 		start = le64_to_cpu(table[n]);
 		end = le64_to_cpu(table[n + 1]);
 
-		if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
+		if (start >= end || (end - start) >
+				(SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
 			kfree(table);
 			return ERR_PTR(-EINVAL);
 		}
 	}
 
 	start = le64_to_cpu(table[indexes - 1]);
-	if (start >= id_table_start || (id_table_start - start) > SQUASHFS_METADATA_SIZE) {
+	if (start >= id_table_start || (id_table_start - start) >
+				(SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
 		kfree(table);
 		return ERR_PTR(-EINVAL);
 	}
diff --git a/fs/squashfs/xattr_id.c b/fs/squashfs/xattr_id.c
index 3a655d879600..7f718d2bf357 100644
--- a/fs/squashfs/xattr_id.c
+++ b/fs/squashfs/xattr_id.c
@@ -122,14 +122,16 @@ __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start,
 		start = le64_to_cpu(table[n]);
 		end = le64_to_cpu(table[n + 1]);
 
-		if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
+		if (start >= end || (end - start) >
+				(SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
 			kfree(table);
 			return ERR_PTR(-EINVAL);
 		}
 	}
 
 	start = le64_to_cpu(table[indexes - 1]);
-	if (start >= table_start || (table_start - start) > SQUASHFS_METADATA_SIZE) {
+	if (start >= table_start || (table_start - start) >
+				(SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
 		kfree(table);
 		return ERR_PTR(-EINVAL);
 	}

From 8664b52901b7a4f4443cbfafb7456eddab2ec3d3 Mon Sep 17 00:00:00 2001
From: Grygorii Strashko <grygorii.strashko@ti.com>
Date: Thu, 28 Jan 2021 21:15:48 +0200
Subject: [PATCH 1758/2658] bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD

[ Upstream commit 7d7275b3e866cf8092bd12553ec53ba26864f7bb ]

The main purpose of l3 IRQs is to catch OCP bus access errors and identify
corresponding code places by showing call stack, so it's important to
handle L3 interconnect errors as fast as possible. On RT these IRQs will
became threaded and will be scheduled much more late from the moment actual
error occurred so showing completely useless information.

Hence, mark l3 IRQs as IRQF_NO_THREAD so they will not be forced threaded
on RT or if force_irqthreads = true.

Fixes: 0ee7261c9212 ("drivers: bus: Move the OMAP interconnect driver to drivers/bus/")
Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bus/omap_l3_noc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/bus/omap_l3_noc.c b/drivers/bus/omap_l3_noc.c
index 5012e3ad1225..624f74d03a83 100644
--- a/drivers/bus/omap_l3_noc.c
+++ b/drivers/bus/omap_l3_noc.c
@@ -285,7 +285,7 @@ static int omap_l3_probe(struct platform_device *pdev)
 	 */
 	l3->debug_irq = platform_get_irq(pdev, 0);
 	ret = devm_request_irq(l3->dev, l3->debug_irq, l3_interrupt_handler,
-			       0x0, "l3-dbg-irq", l3);
+			       IRQF_NO_THREAD, "l3-dbg-irq", l3);
 	if (ret) {
 		dev_err(l3->dev, "request_irq failed for %d\n",
 			l3->debug_irq);
@@ -294,7 +294,7 @@ static int omap_l3_probe(struct platform_device *pdev)
 
 	l3->app_irq = platform_get_irq(pdev, 1);
 	ret = devm_request_irq(l3->dev, l3->app_irq, l3_interrupt_handler,
-			       0x0, "l3-app-irq", l3);
+			       IRQF_NO_THREAD, "l3-app-irq", l3);
 	if (ret)
 		dev_err(l3->dev, "request_irq failed for %d\n", l3->app_irq);
 

From ab83279302d437ea9ae3399f19b912a65e6b3764 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 10 Mar 2021 01:56:36 -0800
Subject: [PATCH 1759/2658] macvlan: macvlan_count_rx() needs to be aware of
 preemption

[ Upstream commit dd4fa1dae9f4847cc1fd78ca468ad69e16e5db3e ]

macvlan_count_rx() can be called from process context, it is thus
necessary to disable preemption before calling u64_stats_update_begin()

syzbot was able to spot this on 32bit arch:

WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert include/linux/seqlock.h:271 [inline]
WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269
Modules linked in:
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 4632 Comm: kworker/1:3 Not tainted 5.12.0-rc2-syzkaller #0
Hardware name: ARM-Versatile Express
Workqueue: events macvlan_process_broadcast
Backtrace:
[<82740468>] (dump_backtrace) from [<827406dc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:252)
 r7:00000080 r6:60000093 r5:00000000 r4:8422a3c4
[<827406c4>] (show_stack) from [<82751b58>] (__dump_stack lib/dump_stack.c:79 [inline])
[<827406c4>] (show_stack) from [<82751b58>] (dump_stack+0xb8/0xe8 lib/dump_stack.c:120)
[<82751aa0>] (dump_stack) from [<82741270>] (panic+0x130/0x378 kernel/panic.c:231)
 r7:830209b4 r6:84069ea4 r5:00000000 r4:844350d0
[<82741140>] (panic) from [<80244924>] (__warn+0xb0/0x164 kernel/panic.c:605)
 r3:8404ec8c r2:00000000 r1:00000000 r0:830209b4
 r7:0000010f
[<80244874>] (__warn) from [<82741520>] (warn_slowpath_fmt+0x68/0xd4 kernel/panic.c:628)
 r7:81363f70 r6:0000010f r5:83018e50 r4:00000000
[<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert include/linux/seqlock.h:271 [inline])
[<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269)
 r8:5a109000 r7:0000000f r6:a568dac0 r5:89802300 r4:00000001
[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (u64_stats_update_begin include/linux/u64_stats_sync.h:128 [inline])
[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_count_rx include/linux/if_macvlan.h:47 [inline])
[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_broadcast+0x154/0x26c drivers/net/macvlan.c:291)
 r5:89802300 r4:8a927740
[<8136499c>] (macvlan_broadcast) from [<81365020>] (macvlan_process_broadcast+0x258/0x2d0 drivers/net/macvlan.c:317)
 r10:81364f78 r9:8a86d000 r8:8a9c7e7c r7:8413aa5c r6:00000000 r5:00000000
 r4:89802840
[<81364dc8>] (macvlan_process_broadcast) from [<802696a4>] (process_one_work+0x2d4/0x998 kernel/workqueue.c:2275)
 r10:00000008 r9:8404ec98 r8:84367a02 r7:ddfe6400 r6:ddfe2d40 r5:898dac80
 r4:8a86d43c
[<802693d0>] (process_one_work) from [<80269dcc>] (worker_thread+0x64/0x54c kernel/workqueue.c:2421)
 r10:00000008 r9:8a9c6000 r8:84006d00 r7:ddfe2d78 r6:898dac94 r5:ddfe2d40
 r4:898dac80
[<80269d68>] (worker_thread) from [<80271f40>] (kthread+0x184/0x1a4 kernel/kthread.c:292)
 r10:85247e64 r9:898dac80 r8:80269d68 r7:00000000 r6:8a9c6000 r5:89a2ee40
 r4:8a97bd00
[<80271dbc>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:158)
Exception stack(0x8a9c7fb0 to 0x8a9c7ff8)

Fixes: 412ca1550cbe ("macvlan: Move broadcasts into a work queue")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/if_macvlan.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h
index a4ccc3122f93..cfcbc49f4ddf 100644
--- a/include/linux/if_macvlan.h
+++ b/include/linux/if_macvlan.h
@@ -70,13 +70,14 @@ static inline void macvlan_count_rx(const struct macvlan_dev *vlan,
 	if (likely(success)) {
 		struct vlan_pcpu_stats *pcpu_stats;
 
-		pcpu_stats = this_cpu_ptr(vlan->pcpu_stats);
+		pcpu_stats = get_cpu_ptr(vlan->pcpu_stats);
 		u64_stats_update_begin(&pcpu_stats->syncp);
 		pcpu_stats->rx_packets++;
 		pcpu_stats->rx_bytes += len;
 		if (multicast)
 			pcpu_stats->rx_multicast++;
 		u64_stats_update_end(&pcpu_stats->syncp);
+		put_cpu_ptr(vlan->pcpu_stats);
 	} else {
 		this_cpu_inc(vlan->pcpu_stats->rx_errors);
 	}

From 6b2b2912d0695e92565cb9f770da82df063acf29 Mon Sep 17 00:00:00 2001
From: Florian Fainelli <f.fainelli@gmail.com>
Date: Wed, 10 Mar 2021 14:17:58 -0800
Subject: [PATCH 1760/2658] net: dsa: bcm_sf2: Qualify phydev->dev_flags based
 on port

[ Upstream commit 47142ed6c34d544ae9f0463e58d482289cbe0d46 ]

Similar to commit 92696286f3bb37ba50e4bd8d1beb24afb759a799 ("net:
bcmgenet: Set phydev->dev_flags only for internal PHYs") we need to
qualify the phydev->dev_flags based on whether the port is connected to
an internal or external PHY otherwise we risk having a flags collision
with a completely different interpretation depending on the driver.

Fixes: aa9aef77c761 ("net: dsa: bcm_sf2: communicate integrated PHY revision to PHY driver")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/bcm_sf2.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index 0864f05633a2..a56f4f3a5872 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -1067,8 +1067,10 @@ static u32 bcm_sf2_sw_get_phy_flags(struct dsa_switch *ds, int port)
 	 * in bits 15:8 and the patch level in bits 7:0 which is exactly what
 	 * the REG_PHY_REVISION register layout is.
 	 */
-
-	return priv->hw_params.gphy_rev;
+	if (priv->int_phy_mask & BIT(port))
+		return priv->hw_params.gphy_rev;
+	else
+		return 0;
 }
 
 static int bcm_sf2_sw_indir_rw(struct dsa_switch *ds, int op, int addr,

From c50fd0ae7ef36dc87cdbca70e816326976b91f21 Mon Sep 17 00:00:00 2001
From: Vitaly Lifshits <vitaly.lifshits@intel.com>
Date: Wed, 21 Oct 2020 14:59:37 +0300
Subject: [PATCH 1761/2658] e1000e: add rtnl_lock() to e1000_reset_task

[ Upstream commit 21f857f0321d0d0ea9b1a758bd55dc63d1cb2437 ]

A possible race condition was found in e1000_reset_task,
after discovering a similar issue in igb driver via
commit 024a8168b749 ("igb: reinit_locked() should be called
with rtnl_lock").

Added rtnl_lock() and rtnl_unlock() to avoid this.

Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver (currently for ICH9 devices only)")
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Vitaly Lifshits <vitaly.lifshits@intel.com>
Tested-by: Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/e1000e/netdev.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 3bd0bdbdfa0e..a8ee20ecb3ad 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -5875,15 +5875,19 @@ static void e1000_reset_task(struct work_struct *work)
 	struct e1000_adapter *adapter;
 	adapter = container_of(work, struct e1000_adapter, reset_task);
 
+	rtnl_lock();
 	/* don't run the task if already down */
-	if (test_bit(__E1000_DOWN, &adapter->state))
+	if (test_bit(__E1000_DOWN, &adapter->state)) {
+		rtnl_unlock();
 		return;
+	}
 
 	if (!(adapter->flags & FLAG_RESTART_NOW)) {
 		e1000e_dump(adapter);
 		e_err("Reset adapter unexpectedly\n");
 	}
 	e1000e_reinit_locked(adapter);
+	rtnl_unlock();
 }
 
 /**

From c6806bd5ab5c369c508536f183f1e6c1bcd5f780 Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Sun, 28 Feb 2021 17:44:23 +0800
Subject: [PATCH 1762/2658] e1000e: Fix error handling in
 e1000_set_d0_lplu_state_82571

[ Upstream commit b52912b8293f2c496f42583e65599aee606a0c18 ]

There is one e1e_wphy() call in e1000_set_d0_lplu_state_82571
that we have caught its return value but lack further handling.
Check and terminate the execution flow just like other e1e_wphy()
in this function.

Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver (currently for ICH9 devices only)")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Acked-by: Sasha Neftin <sasha.neftin@intel.com>
Tested-by: Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/e1000e/82571.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c
index 5f7016442ec4..e486f351a54a 100644
--- a/drivers/net/ethernet/intel/e1000e/82571.c
+++ b/drivers/net/ethernet/intel/e1000e/82571.c
@@ -917,6 +917,8 @@ static s32 e1000_set_d0_lplu_state_82571(struct e1000_hw *hw, bool active)
 	} else {
 		data &= ~IGP02E1000_PM_D0_LPLU;
 		ret_val = e1e_wphy(hw, IGP02E1000_PHY_POWER_MGMT, data);
+		if (ret_val)
+			return ret_val;
 		/* LPLU and SmartSpeed are mutually exclusive.  LPLU is used
 		 * during Dx states where the power conservation is most
 		 * important.  During driver activity we should enable

From c3a15d9c2b990fc8dca1637a3a4252db37415d8e Mon Sep 17 00:00:00 2001
From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Date: Wed, 10 Mar 2021 20:01:40 -0800
Subject: [PATCH 1763/2658] net/qlcnic: Fix a use after free in
 qlcnic_83xx_get_minidump_template

[ Upstream commit db74623a3850db99cb9692fda9e836a56b74198d ]

In qlcnic_83xx_get_minidump_template, fw_dump->tmpl_hdr was freed by
vfree(). But unfortunately, it is used when extended is true.

Fixes: 7061b2bdd620e ("qlogic: Deletion of unnecessary checks before two function calls")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
index 5174e0bd75d1..625336264a44 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
@@ -1426,6 +1426,7 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter)
 
 	if (fw_dump->tmpl_hdr == NULL || current_version > prev_version) {
 		vfree(fw_dump->tmpl_hdr);
+		fw_dump->tmpl_hdr = NULL;
 
 		if (qlcnic_83xx_md_check_extended_dump_capability(adapter))
 			extended = !qlcnic_83xx_extend_md_capab(adapter);
@@ -1444,6 +1445,8 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter)
 			struct qlcnic_83xx_dump_template_hdr *hdr;
 
 			hdr = fw_dump->tmpl_hdr;
+			if (!hdr)
+				return;
 			hdr->drv_cap_mask = 0x1f;
 			fw_dump->cap_mask = 0x1f;
 			dev_info(&pdev->dev,

From 482681f5d193c9e602c66b363e807759ee40055c Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Sun, 28 Feb 2021 21:45:11 -0500
Subject: [PATCH 1764/2658] can: c_can_pci: c_can_pci_remove(): fix
 use-after-free

[ Upstream commit 0429d6d89f97ebff4f17f13f5b5069c66bde8138 ]

There is a UAF in c_can_pci_remove(). dev is released by
free_c_can_dev() and is used by pci_iounmap(pdev, priv->base) later.
To fix this issue, save the mmio address before releasing dev.

Fixes: 5b92da0443c2 ("c_can_pci: generic module for C_CAN/D_CAN on PCI")
Link: https://lore.kernel.org/r/20210301024512.539039-1-ztong0001@gmail.com
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/c_can/c_can_pci.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c
index d065c0e2d18e..f3e0b2124a37 100644
--- a/drivers/net/can/c_can/c_can_pci.c
+++ b/drivers/net/can/c_can/c_can_pci.c
@@ -239,12 +239,13 @@ static void c_can_pci_remove(struct pci_dev *pdev)
 {
 	struct net_device *dev = pci_get_drvdata(pdev);
 	struct c_can_priv *priv = netdev_priv(dev);
+	void __iomem *addr = priv->base;
 
 	unregister_c_can_dev(dev);
 
 	free_c_can_dev(dev);
 
-	pci_iounmap(pdev, priv->base);
+	pci_iounmap(pdev, addr);
 	pci_disable_msi(pdev);
 	pci_clear_master(pdev);
 	pci_release_regions(pdev);

From d373658fb155b5a09f7687cc6226a56abd8fc1eb Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Mon, 1 Mar 2021 21:55:40 -0500
Subject: [PATCH 1765/2658] can: c_can: move runtime PM enable/disable to
 c_can_platform
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 6e2fe01dd6f98da6cae8b07cd5cfa67abc70d97d ]

Currently doing modprobe c_can_pci will make the kernel complain:

    Unbalanced pm_runtime_enable!

this is caused by pm_runtime_enable() called before pm is initialized.

This fix is similar to 227619c3ff7c, move those pm_enable/disable code
to c_can_platform.

Fixes: 4cdd34b26826 ("can: c_can: Add runtime PM support to Bosch C_CAN/D_CAN controller")
Link: http://lore.kernel.org/r/20210302025542.987600-1-ztong0001@gmail.com
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Tested-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/c_can/c_can.c          | 24 +-----------------------
 drivers/net/can/c_can/c_can_platform.c |  6 +++++-
 2 files changed, 6 insertions(+), 24 deletions(-)

diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index 4ead5a18b794..c41ab2cb272e 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -212,18 +212,6 @@ static const struct can_bittiming_const c_can_bittiming_const = {
 	.brp_inc = 1,
 };
 
-static inline void c_can_pm_runtime_enable(const struct c_can_priv *priv)
-{
-	if (priv->device)
-		pm_runtime_enable(priv->device);
-}
-
-static inline void c_can_pm_runtime_disable(const struct c_can_priv *priv)
-{
-	if (priv->device)
-		pm_runtime_disable(priv->device);
-}
-
 static inline void c_can_pm_runtime_get_sync(const struct c_can_priv *priv)
 {
 	if (priv->device)
@@ -1318,7 +1306,6 @@ static const struct net_device_ops c_can_netdev_ops = {
 
 int register_c_can_dev(struct net_device *dev)
 {
-	struct c_can_priv *priv = netdev_priv(dev);
 	int err;
 
 	/* Deactivate pins to prevent DRA7 DCAN IP from being
@@ -1328,28 +1315,19 @@ int register_c_can_dev(struct net_device *dev)
 	 */
 	pinctrl_pm_select_sleep_state(dev->dev.parent);
 
-	c_can_pm_runtime_enable(priv);
-
 	dev->flags |= IFF_ECHO;	/* we support local echo */
 	dev->netdev_ops = &c_can_netdev_ops;
 
 	err = register_candev(dev);
-	if (err)
-		c_can_pm_runtime_disable(priv);
-	else
+	if (!err)
 		devm_can_led_init(dev);
-
 	return err;
 }
 EXPORT_SYMBOL_GPL(register_c_can_dev);
 
 void unregister_c_can_dev(struct net_device *dev)
 {
-	struct c_can_priv *priv = netdev_priv(dev);
-
 	unregister_candev(dev);
-
-	c_can_pm_runtime_disable(priv);
 }
 EXPORT_SYMBOL_GPL(unregister_c_can_dev);
 
diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
index 717530eac70c..c6a03f565e3f 100644
--- a/drivers/net/can/c_can/c_can_platform.c
+++ b/drivers/net/can/c_can/c_can_platform.c
@@ -29,6 +29,7 @@
 #include <linux/list.h>
 #include <linux/io.h>
 #include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
 #include <linux/clk.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
@@ -385,6 +386,7 @@ static int c_can_plat_probe(struct platform_device *pdev)
 	platform_set_drvdata(pdev, dev);
 	SET_NETDEV_DEV(dev, &pdev->dev);
 
+	pm_runtime_enable(priv->device);
 	ret = register_c_can_dev(dev);
 	if (ret) {
 		dev_err(&pdev->dev, "registering %s failed (err=%d)\n",
@@ -397,6 +399,7 @@ static int c_can_plat_probe(struct platform_device *pdev)
 	return 0;
 
 exit_free_device:
+	pm_runtime_disable(priv->device);
 	free_c_can_dev(dev);
 exit:
 	dev_err(&pdev->dev, "probe failed\n");
@@ -407,9 +410,10 @@ static int c_can_plat_probe(struct platform_device *pdev)
 static int c_can_plat_remove(struct platform_device *pdev)
 {
 	struct net_device *dev = platform_get_drvdata(pdev);
+	struct c_can_priv *priv = netdev_priv(dev);
 
 	unregister_c_can_dev(dev);
-
+	pm_runtime_disable(priv->device);
 	free_c_can_dev(dev);
 
 	return 0;

From 7405731f8a15d8b084809c2069f86f57b9e1fad2 Mon Sep 17 00:00:00 2001
From: Torin Cooper-Bennun <torin@maxiluxsystems.com>
Date: Wed, 3 Mar 2021 10:31:52 +0000
Subject: [PATCH 1766/2658] can: m_can: m_can_do_rx_poll(): fix extraneous msg
 loss warning

[ Upstream commit c0e399f3baf42279f48991554240af8c457535d1 ]

Message loss from RX FIFO 0 is already handled in
m_can_handle_lost_msg(), with netdev output included.

Removing this warning also improves driver performance under heavy
load, where m_can_do_rx_poll() may be called many times before this
interrupt is cleared, causing this message to be output many
times (thanks Mariusz Madej for this report).

Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
Link: https://lore.kernel.org/r/20210303103151.3760532-1-torin@maxiluxsystems.com
Reported-by: Mariusz Madej <mariusz.madej@xtrack.com>
Signed-off-by: Torin Cooper-Bennun <torin@maxiluxsystems.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/m_can/m_can.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index 0bd7e7164796..197c27d8f584 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -428,9 +428,6 @@ static int m_can_do_rx_poll(struct net_device *dev, int quota)
 	}
 
 	while ((rxfs & RXFS_FFL_MASK) && (quota > 0)) {
-		if (rxfs & RXFS_RFL)
-			netdev_warn(dev, "Rx FIFO 0 Message Lost\n");
-
 		m_can_read_fifo(dev, rxfs);
 
 		quota--;

From 325bcc215714b25ba64699405881dffbf82f8298 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Fri, 12 Feb 2021 11:22:14 +0100
Subject: [PATCH 1767/2658] mac80211: fix rate mask reset

[ Upstream commit 1944015fe9c1d9fa5e9eb7ffbbb5ef8954d6753b ]

Coverity reported the strange "if (~...)" condition that's
always true. It suggested that ! was intended instead of ~,
but upon further analysis I'm convinced that what really was
intended was a comparison to 0xff/0xffff (in HT/VHT cases
respectively), since this indicates that all of the rates
are enabled.

Change the comparison accordingly.

I'm guessing this never really mattered because a reset to
not having a rate mask is basically equivalent to having a
mask that enables all rates.

Reported-by: Colin Ian King <colin.king@canonical.com>
Fixes: 2ffbe6d33366 ("mac80211: fix and optimize MCS mask handling")
Fixes: b119ad6e726c ("mac80211: add rate mask logic for vht rates")
Reviewed-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20210212112213.36b38078f569.I8546a20c80bc1669058eb453e213630b846e107b@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/cfg.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 8360fda24bca..eac20f4ab924 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2448,14 +2448,14 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
 			continue;
 
 		for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++) {
-			if (~sdata->rc_rateidx_mcs_mask[i][j]) {
+			if (sdata->rc_rateidx_mcs_mask[i][j] != 0xff) {
 				sdata->rc_has_mcs_mask[i] = true;
 				break;
 			}
 		}
 
 		for (j = 0; j < NL80211_VHT_NSS_MAX; j++) {
-			if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) {
+			if (sdata->rc_rateidx_vht_mcs_mask[i][j] != 0xffff) {
 				sdata->rc_has_vht_mcs_mask[i] = true;
 				break;
 			}

From a278ec113a4fc4b5cc90cd7ee6058a1634e645ad Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Thu, 18 Mar 2021 16:57:49 +0100
Subject: [PATCH 1768/2658] net: cdc-phonet: fix data-interface release on
 probe failure

[ Upstream commit c79a707072fe3fea0e3c92edee6ca85c1e53c29f ]

Set the disconnected flag before releasing the data interface in case
netdev registration fails to avoid having the disconnect callback try to
deregister the never registered netdev (and trigger a WARN_ON()).

Fixes: 87cf65601e17 ("USB host CDC Phonet network interface driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/cdc-phonet.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c
index ff2270ead2e6..84e0e7f78029 100644
--- a/drivers/net/usb/cdc-phonet.c
+++ b/drivers/net/usb/cdc-phonet.c
@@ -406,6 +406,8 @@ static int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *i
 
 	err = register_netdev(dev);
 	if (err) {
+		/* Set disconnected flag so that disconnect() returns early. */
+		pnd->disconnected = 1;
 		usb_driver_release_interface(&usbpn_driver, data_intf);
 		goto out;
 	}

From 6a38f246304af6484f825df5deaf3fba5eaed48f Mon Sep 17 00:00:00 2001
From: Potnuri Bharat Teja <bharat@chelsio.com>
Date: Thu, 25 Mar 2021 00:34:53 +0530
Subject: [PATCH 1769/2658] RDMA/cxgb4: Fix adapter LE hash errors while
 destroying ipv6 listening server

[ Upstream commit 3408be145a5d6418ff955fe5badde652be90e700 ]

Not setting the ipv6 bit while destroying ipv6 listening servers may
result in potential fatal adapter errors due to lookup engine memory hash
errors. Therefore always set ipv6 field while destroying ipv6 listening
servers.

Fixes: 830662f6f032 ("RDMA/cxgb4: Add support for active and passive open connection with IPv6 address")
Link: https://lore.kernel.org/r/20210324190453.8171-1-bharat@chelsio.com
Signed-off-by: Potnuri Bharat Teja <bharat@chelsio.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/cxgb4/cm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 54fd4d81a3f1..8d75161854ee 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -3441,13 +3441,13 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id)
 	    ep->com.local_addr.ss_family == AF_INET) {
 		err = cxgb4_remove_server_filter(
 			ep->com.dev->rdev.lldi.ports[0], ep->stid,
-			ep->com.dev->rdev.lldi.rxq_ids[0], 0);
+			ep->com.dev->rdev.lldi.rxq_ids[0], false);
 	} else {
 		struct sockaddr_in6 *sin6;
 		c4iw_init_wr_wait(&ep->com.wr_wait);
 		err = cxgb4_remove_server(
 				ep->com.dev->rdev.lldi.ports[0], ep->stid,
-				ep->com.dev->rdev.lldi.rxq_ids[0], 0);
+				ep->com.dev->rdev.lldi.rxq_ids[0], true);
 		if (err)
 			goto done;
 		err = c4iw_wait_for_reply(&ep->com.dev->rdev, &ep->com.wr_wait,

From 31f1b5a70ac0ee72dc2e911b44da90d64e6920cb Mon Sep 17 00:00:00 2001
From: Adrian Hunter <adrian.hunter@intel.com>
Date: Mon, 8 Mar 2021 17:11:43 +0200
Subject: [PATCH 1770/2658] perf auxtrace: Fix auxtrace queue conflict

[ Upstream commit b410ed2a8572d41c68bd9208555610e4b07d0703 ]

The only requirement of an auxtrace queue is that the buffers are in
time order.  That is achieved by making separate queues for separate
perf buffer or AUX area buffer mmaps.

That generally means a separate queue per cpu for per-cpu contexts, and
a separate queue per thread for per-task contexts.

When buffers are added to a queue, perf checks that the buffer cpu and
thread id (tid) match the queue cpu and thread id.

However, generally, that need not be true, and perf will queue buffers
correctly anyway, so the check is not needed.

In addition, the check gets erroneously hit when using sample mode to
trace multiple threads.

Consequently, fix that case by removing the check.

Fixes: e502789302a6 ("perf auxtrace: Add helpers for queuing AUX area tracing data")
Reported-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Andi Kleen <ak@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Link: http://lore.kernel.org/lkml/20210308151143.18338-1-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/auxtrace.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
index 960de8951884..6a3e53716036 100644
--- a/tools/perf/util/auxtrace.c
+++ b/tools/perf/util/auxtrace.c
@@ -240,10 +240,6 @@ static int auxtrace_queues__add_buffer(struct auxtrace_queues *queues,
 		queue->set = true;
 		queue->tid = buffer->tid;
 		queue->cpu = buffer->cpu;
-	} else if (buffer->cpu != queue->cpu || buffer->tid != queue->tid) {
-		pr_err("auxtrace queue conflict: cpu %d, tid %d vs cpu %d, tid %d\n",
-		       queue->cpu, queue->tid, buffer->cpu, buffer->tid);
-		return -EINVAL;
 	}
 
 	buffer->buffer_nr = queues->next_buffer_nr++;

From 500da597c2e54dbc601d4b0071fb4aeb01aa8c87 Mon Sep 17 00:00:00 2001
From: Martin Willi <martin@strongswan.org>
Date: Tue, 2 Mar 2021 13:24:23 +0100
Subject: [PATCH 1771/2658] can: dev: Move device back to init netns on owning
 netns delete

commit 3a5ca857079ea022e0b1b17fc154f7ad7dbc150f upstream.

When a non-initial netns is destroyed, the usual policy is to delete
all virtual network interfaces contained, but move physical interfaces
back to the initial netns. This keeps the physical interface visible
on the system.

CAN devices are somewhat special, as they define rtnl_link_ops even
if they are physical devices. If a CAN interface is moved into a
non-initial netns, destroying that netns lets the interface vanish
instead of moving it back to the initial netns. default_device_exit()
skips CAN interfaces due to having rtnl_link_ops set. Reproducer:

  ip netns add foo
  ip link set can0 netns foo
  ip netns delete foo

WARNING: CPU: 1 PID: 84 at net/core/dev.c:11030 ops_exit_list+0x38/0x60
CPU: 1 PID: 84 Comm: kworker/u4:2 Not tainted 5.10.19 #1
Workqueue: netns cleanup_net
[<c010e700>] (unwind_backtrace) from [<c010a1d8>] (show_stack+0x10/0x14)
[<c010a1d8>] (show_stack) from [<c086dc10>] (dump_stack+0x94/0xa8)
[<c086dc10>] (dump_stack) from [<c086b938>] (__warn+0xb8/0x114)
[<c086b938>] (__warn) from [<c086ba10>] (warn_slowpath_fmt+0x7c/0xac)
[<c086ba10>] (warn_slowpath_fmt) from [<c0629f20>] (ops_exit_list+0x38/0x60)
[<c0629f20>] (ops_exit_list) from [<c062a5c4>] (cleanup_net+0x230/0x380)
[<c062a5c4>] (cleanup_net) from [<c0142c20>] (process_one_work+0x1d8/0x438)
[<c0142c20>] (process_one_work) from [<c0142ee4>] (worker_thread+0x64/0x5a8)
[<c0142ee4>] (worker_thread) from [<c0148a98>] (kthread+0x148/0x14c)
[<c0148a98>] (kthread) from [<c0100148>] (ret_from_fork+0x14/0x2c)

To properly restore physical CAN devices to the initial netns on owning
netns exit, introduce a flag on rtnl_link_ops that can be set by drivers.
For CAN devices setting this flag, default_device_exit() considers them
non-virtual, applying the usual namespace move.

The issue was introduced in the commit mentioned below, as at that time
CAN devices did not have a dellink() operation.

Fixes: e008b5fc8dc7 ("net: Simplfy default_device_exit and improve batching.")
Link: https://lore.kernel.org/r/20210302122423.872326-1-martin@strongswan.org
Signed-off-by: Martin Willi <martin@strongswan.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/dev.c   | 1 +
 include/net/rtnetlink.h | 2 ++
 net/core/dev.c          | 2 +-
 3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 1a79118b008b..2835aeb11c9f 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -1054,6 +1054,7 @@ static void can_dellink(struct net_device *dev, struct list_head *head)
 
 static struct rtnl_link_ops can_link_ops __read_mostly = {
 	.kind		= "can",
+	.netns_refund	= true,
 	.maxtype	= IFLA_CAN_MAX,
 	.policy		= can_policy,
 	.setup		= can_setup,
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index 2f87c1ba13de..baa977247dc9 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -28,6 +28,7 @@ static inline int rtnl_msg_family(const struct nlmsghdr *nlh)
  *
  *	@list: Used internally
  *	@kind: Identifier
+ *	@netns_refund: Physical device, move to init_net on netns exit
  *	@maxtype: Highest device specific netlink attribute number
  *	@policy: Netlink policy for device specific attribute validation
  *	@validate: Optional validation function for netlink/changelink parameters
@@ -81,6 +82,7 @@ struct rtnl_link_ops {
 	unsigned int		(*get_num_tx_queues)(void);
 	unsigned int		(*get_num_rx_queues)(void);
 
+	bool			netns_refund;
 	int			slave_maxtype;
 	const struct nla_policy	*slave_policy;
 	int			(*slave_validate)(struct nlattr *tb[],
diff --git a/net/core/dev.c b/net/core/dev.c
index 97a9536203bf..6e58278eb63b 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -7816,7 +7816,7 @@ static void __net_exit default_device_exit(struct net *net)
 			continue;
 
 		/* Leave virtual devices for the generic cleanup */
-		if (dev->rtnl_link_ops)
+		if (dev->rtnl_link_ops && !dev->rtnl_link_ops->netns_refund)
 			continue;
 
 		/* Push remaining network devices to init_net */

From 4b03000803f4b3fede34c35cbdb454570284df59 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 10 Mar 2021 08:26:41 -0800
Subject: [PATCH 1772/2658] net: sched: validate stab values

commit e323d865b36134e8c5c82c834df89109a5c60dab upstream.

iproute2 package is well behaved, but malicious user space can
provide illegal shift values and trigger UBSAN reports.

Add stab parameter to red_check_params() to validate user input.

syzbot reported:

UBSAN: shift-out-of-bounds in ./include/net/red.h:312:18
shift exponent 111 is too large for 64-bit type 'long unsigned int'
CPU: 1 PID: 14662 Comm: syz-executor.3 Not tainted 5.12.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x141/0x1d7 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327
 red_calc_qavg_from_idle_time include/net/red.h:312 [inline]
 red_calc_qavg include/net/red.h:353 [inline]
 choke_enqueue.cold+0x18/0x3dd net/sched/sch_choke.c:221
 __dev_xmit_skb net/core/dev.c:3837 [inline]
 __dev_queue_xmit+0x1943/0x2e00 net/core/dev.c:4150
 neigh_hh_output include/net/neighbour.h:499 [inline]
 neigh_output include/net/neighbour.h:508 [inline]
 ip6_finish_output2+0x911/0x1700 net/ipv6/ip6_output.c:117
 __ip6_finish_output net/ipv6/ip6_output.c:182 [inline]
 __ip6_finish_output+0x4c1/0xe10 net/ipv6/ip6_output.c:161
 ip6_finish_output+0x35/0x200 net/ipv6/ip6_output.c:192
 NF_HOOK_COND include/linux/netfilter.h:290 [inline]
 ip6_output+0x1e4/0x530 net/ipv6/ip6_output.c:215
 dst_output include/net/dst.h:448 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 NF_HOOK include/linux/netfilter.h:295 [inline]
 ip6_xmit+0x127e/0x1eb0 net/ipv6/ip6_output.c:320
 inet6_csk_xmit+0x358/0x630 net/ipv6/inet6_connection_sock.c:135
 dccp_transmit_skb+0x973/0x12c0 net/dccp/output.c:138
 dccp_send_reset+0x21b/0x2b0 net/dccp/output.c:535
 dccp_finish_passive_close net/dccp/proto.c:123 [inline]
 dccp_finish_passive_close+0xed/0x140 net/dccp/proto.c:118
 dccp_terminate_connection net/dccp/proto.c:958 [inline]
 dccp_close+0xb3c/0xe60 net/dccp/proto.c:1028
 inet_release+0x12e/0x280 net/ipv4/af_inet.c:431
 inet6_release+0x4c/0x70 net/ipv6/af_inet6.c:478
 __sock_release+0xcd/0x280 net/socket.c:599
 sock_close+0x18/0x20 net/socket.c:1258
 __fput+0x288/0x920 fs/file_table.c:280
 task_work_run+0xdd/0x1a0 kernel/task_work.c:140
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]

Fixes: 8afa10cbe281 ("net_sched: red: Avoid illegal values")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/red.h     | 10 +++++++++-
 net/sched/sch_choke.c |  7 ++++---
 net/sched/sch_gred.c  |  2 +-
 net/sched/sch_red.c   |  7 +++++--
 net/sched/sch_sfq.c   |  2 +-
 5 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/include/net/red.h b/include/net/red.h
index 17821f66de11..b3ab5c6bfa83 100644
--- a/include/net/red.h
+++ b/include/net/red.h
@@ -167,7 +167,8 @@ static inline void red_set_vars(struct red_vars *v)
 	v->qcount	= -1;
 }
 
-static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_log)
+static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog,
+				    u8 Scell_log, u8 *stab)
 {
 	if (fls(qth_min) + Wlog > 32)
 		return false;
@@ -177,6 +178,13 @@ static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_
 		return false;
 	if (qth_max < qth_min)
 		return false;
+	if (stab) {
+		int i;
+
+		for (i = 0; i < RED_STAB_SIZE; i++)
+			if (stab[i] >= 32)
+				return false;
+	}
 	return true;
 }
 
diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
index 8e154e755df6..381c1393e884 100644
--- a/net/sched/sch_choke.c
+++ b/net/sched/sch_choke.c
@@ -423,6 +423,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt)
 	struct sk_buff **old = NULL;
 	unsigned int mask;
 	u32 max_P;
+	u8 *stab;
 
 	if (opt == NULL)
 		return -EINVAL;
@@ -438,8 +439,8 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt)
 	max_P = tb[TCA_CHOKE_MAX_P] ? nla_get_u32(tb[TCA_CHOKE_MAX_P]) : 0;
 
 	ctl = nla_data(tb[TCA_CHOKE_PARMS]);
-
-	if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
+	stab = nla_data(tb[TCA_CHOKE_STAB]);
+	if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab))
 		return -EINVAL;
 
 	if (ctl->limit > CHOKE_MAX_QUEUE)
@@ -489,7 +490,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt)
 
 	red_set_parms(&q->parms, ctl->qth_min, ctl->qth_max, ctl->Wlog,
 		      ctl->Plog, ctl->Scell_log,
-		      nla_data(tb[TCA_CHOKE_STAB]),
+		      stab,
 		      max_P);
 	red_set_vars(&q->vars);
 
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index 7af75caf0703..2f73232031c6 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -389,7 +389,7 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp,
 	struct gred_sched *table = qdisc_priv(sch);
 	struct gred_sched_data *q = table->tab[dp];
 
-	if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
+	if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab))
 		return -EINVAL;
 
 	if (!q) {
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 842e0b103c3e..ac85792038c4 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -188,6 +188,7 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt)
 	struct Qdisc *child = NULL;
 	int err;
 	u32 max_P;
+	u8 *stab;
 
 	if (opt == NULL)
 		return -EINVAL;
@@ -203,7 +204,9 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt)
 	max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0;
 
 	ctl = nla_data(tb[TCA_RED_PARMS]);
-	if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
+	stab = nla_data(tb[TCA_RED_STAB]);
+	if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog,
+			      ctl->Scell_log, stab))
 		return -EINVAL;
 
 	if (ctl->limit > 0) {
@@ -225,7 +228,7 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt)
 	red_set_parms(&q->parms,
 		      ctl->qth_min, ctl->qth_max, ctl->Wlog,
 		      ctl->Plog, ctl->Scell_log,
-		      nla_data(tb[TCA_RED_STAB]),
+		      stab,
 		      max_P);
 	red_set_vars(&q->vars);
 
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index ae51bdeaddfd..467a3ae2fe05 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -645,7 +645,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
 	}
 
 	if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max,
-					ctl_v1->Wlog, ctl_v1->Scell_log))
+					ctl_v1->Wlog, ctl_v1->Scell_log, NULL))
 		return -EINVAL;
 	if (ctl_v1 && ctl_v1->qth_min) {
 		p = kmalloc(sizeof(*p), GFP_KERNEL);

From 4f0489463038901819d8613dd46d15e0efb0130b Mon Sep 17 00:00:00 2001
From: Markus Theil <markus.theil@tu-ilmenau.de>
Date: Sat, 13 Feb 2021 14:36:53 +0100
Subject: [PATCH 1773/2658] mac80211: fix double free in ibss_leave

commit 3bd801b14e0c5d29eeddc7336558beb3344efaa3 upstream.

Clear beacon ie pointer and ie length after free
in order to prevent double free.

==================================================================
BUG: KASAN: double-free or invalid-free \
in ieee80211_ibss_leave+0x83/0xe0 net/mac80211/ibss.c:1876

CPU: 0 PID: 8472 Comm: syz-executor100 Not tainted 5.11.0-rc6-syzkaller #0
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 print_address_description.constprop.0.cold+0x5b/0x2c6 mm/kasan/report.c:230
 kasan_report_invalid_free+0x51/0x80 mm/kasan/report.c:355
 ____kasan_slab_free+0xcc/0xe0 mm/kasan/common.c:341
 kasan_slab_free include/linux/kasan.h:192 [inline]
 __cache_free mm/slab.c:3424 [inline]
 kfree+0xed/0x270 mm/slab.c:3760
 ieee80211_ibss_leave+0x83/0xe0 net/mac80211/ibss.c:1876
 rdev_leave_ibss net/wireless/rdev-ops.h:545 [inline]
 __cfg80211_leave_ibss+0x19a/0x4c0 net/wireless/ibss.c:212
 __cfg80211_leave+0x327/0x430 net/wireless/core.c:1172
 cfg80211_leave net/wireless/core.c:1221 [inline]
 cfg80211_netdev_notifier_call+0x9e8/0x12c0 net/wireless/core.c:1335
 notifier_call_chain+0xb5/0x200 kernel/notifier.c:83
 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2040
 call_netdevice_notifiers_extack net/core/dev.c:2052 [inline]
 call_netdevice_notifiers net/core/dev.c:2066 [inline]
 __dev_close_many+0xee/0x2e0 net/core/dev.c:1586
 __dev_close net/core/dev.c:1624 [inline]
 __dev_change_flags+0x2cb/0x730 net/core/dev.c:8476
 dev_change_flags+0x8a/0x160 net/core/dev.c:8549
 dev_ifsioc+0x210/0xa70 net/core/dev_ioctl.c:265
 dev_ioctl+0x1b1/0xc40 net/core/dev_ioctl.c:511
 sock_do_ioctl+0x148/0x2d0 net/socket.c:1060
 sock_ioctl+0x477/0x6a0 net/socket.c:1177
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl fs/ioctl.c:739 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:739
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported-by: syzbot+93976391bf299d425f44@syzkaller.appspotmail.com
Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
Link: https://lore.kernel.org/r/20210213133653.367130-1-markus.theil@tu-ilmenau.de
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/ibss.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index f2af19673b26..50fa92fe7d24 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -1860,6 +1860,8 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
 
 	/* remove beacon */
 	kfree(sdata->u.ibss.ie);
+	sdata->u.ibss.ie = NULL;
+	sdata->u.ibss.ie_len = 0;
 
 	/* on the next join, re-program HT parameters */
 	memset(&ifibss->ht_capa, 0, sizeof(ifibss->ht_capa));

From d024d7e60f1c7916ddc359f7af88dbf16eef662d Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Fri, 26 Mar 2021 16:28:57 +0100
Subject: [PATCH 1774/2658] xen-blkback: don't leak persistent grants from
 xen_blkbk_map()

commit a846738f8c3788d846ed1f587270d2f2e3d32432 upstream.

The fix for XSA-365 zapped too many of the ->persistent_gnt[] entries.
Ones successfully obtained should not be overwritten, but instead left
for xen_blkbk_unmap_prepare() to pick up and put.

This is XSA-371.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Cc: stable@vger.kernel.org
Reviewed-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Wei Liu <wl@xen.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/block/xen-blkback/blkback.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index f9dfcd8872af..698a52a96d2d 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -919,7 +919,7 @@ static int xen_blkbk_map(struct xen_blkif *blkif,
 out:
 	for (i = last_map; i < num; i++) {
 		/* Don't zap current batch's valid persistent grants. */
-		if(i >= last_map + segs_to_map)
+		if(i >= map_until)
 			pages[i]->persistent_gnt = NULL;
 		pages[i]->handle = BLKBACK_INVALID_HANDLE;
 	}

From e3a5f440fb9fc98e58c4f7bf04247b7c30e5c678 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 30 Mar 2021 14:45:01 +0200
Subject: [PATCH 1775/2658] Linux 4.4.264

Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://lore.kernel.org/r/20210329075605.290845195@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index e6f946c45270..e2feb2e1626e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 263
+SUBLEVEL = 264
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 999b2be4b49752ee7b161f8e5922b7fe683ac76b Mon Sep 17 00:00:00 2001
From: David Brazdil <dbrazdil@google.com>
Date: Mon, 29 Mar 2021 18:24:43 +0000
Subject: [PATCH 1776/2658] selinux: vsock: Set SID for socket returned by
 accept()

[ Upstream commit 1f935e8e72ec28dddb2dc0650b3b6626a293d94b ]

For AF_VSOCK, accept() currently returns sockets that are unlabelled.
Other socket families derive the child's SID from the SID of the parent
and the SID of the incoming packet. This is typically done as the
connected socket is placed in the queue that accept() removes from.

Reuse the existing 'security_sk_clone' hook to copy the SID from the
parent (server) socket to the child. There is no packet SID in this
case.

Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
Signed-off-by: David Brazdil <dbrazdil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/vmw_vsock/af_vsock.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index cdd91a60b89a..8f5fec0956bd 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -632,6 +632,7 @@ struct sock *__vsock_create(struct net *net,
 		vsk->trusted = psk->trusted;
 		vsk->owner = get_cred(psk->owner);
 		vsk->connect_timeout = psk->connect_timeout;
+		security_sk_clone(parent, sk);
 	} else {
 		vsk->trusted = ns_capable_noaudit(&init_user_ns, CAP_NET_ADMIN);
 		vsk->owner = get_current_cred();

From 4ef41d09bd3ac1c3054e9ecb60583c4c747ffa91 Mon Sep 17 00:00:00 2001
From: Jakub Kicinski <kuba@kernel.org>
Date: Wed, 17 Mar 2021 09:55:15 -0700
Subject: [PATCH 1777/2658] ipv6: weaken the v4mapped source check

[ Upstream commit dcc32f4f183ab8479041b23a1525d48233df1d43 ]

This reverts commit 6af1799aaf3f1bc8defedddfa00df3192445bbf3.

Commit 6af1799aaf3f ("ipv6: drop incoming packets having a v4mapped
source address") introduced an input check against v4mapped addresses.
Use of such addresses on the wire is indeed questionable and not
allowed on public Internet. As the commit pointed out

  https://tools.ietf.org/html/draft-itojun-v6ops-v4mapped-harmful-02

lists potential issues.

Unfortunately there are applications which use v4mapped addresses,
and breaking them is a clear regression. For example v4mapped
addresses (or any semi-valid addresses, really) may be used
for uni-direction event streams or packet export.

Since the issue which sparked the addition of the check was with
TCP and request_socks in particular push the check down to TCPv6
and DCCP. This restores the ability to receive UDPv6 packets with
v4mapped address as the source.

Keep using the IPSTATS_MIB_INHDRERRORS statistic to minimize the
user-visible changes.

Fixes: 6af1799aaf3f ("ipv6: drop incoming packets having a v4mapped source address")
Reported-by: Sunyi Shao <sunyishao@fb.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/dccp/ipv6.c      |  5 +++++
 net/ipv6/ip6_input.c | 10 ----------
 net/ipv6/tcp_ipv6.c  |  5 +++++
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 10eabd1a60aa..3e7716f7ff56 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -313,6 +313,11 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 	if (!ipv6_unicast_destination(skb))
 		return 0;	/* discard, don't send a reset here */
 
+	if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) {
+		IP6_INC_STATS_BH(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS);
+		return 0;
+	}
+
 	if (dccp_bad_service_code(sk, service)) {
 		dcb->dccpd_reset_code = DCCP_RESET_CODE_BAD_SERVICE_CODE;
 		goto drop;
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index c83c0faf5ae9..9075acf081dd 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -151,16 +151,6 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
 	if (ipv6_addr_is_multicast(&hdr->saddr))
 		goto err;
 
-	/* While RFC4291 is not explicit about v4mapped addresses
-	 * in IPv6 headers, it seems clear linux dual-stack
-	 * model can not deal properly with these.
-	 * Security models could be fooled by ::ffff:127.0.0.1 for example.
-	 *
-	 * https://tools.ietf.org/html/draft-itojun-v6ops-v4mapped-harmful-02
-	 */
-	if (ipv6_addr_v4mapped(&hdr->saddr))
-		goto err;
-
 	skb->transport_header = skb->network_header + sizeof(*hdr);
 	IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 753d261b4754..f6a4a7ab0fab 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -980,6 +980,11 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 	if (!ipv6_unicast_destination(skb))
 		goto drop;
 
+	if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) {
+		IP6_INC_STATS_BH(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS);
+		return 0;
+	}
+
 	return tcp_conn_request(&tcp6_request_sock_ops,
 				&tcp_request_sock_ipv6_ops, sk, skb);
 

From a6669e164115102bf3a7f9d18cbf5aaefa3bef5c Mon Sep 17 00:00:00 2001
From: Zhaolong Zhang <zhangzl2013@126.com>
Date: Tue, 2 Mar 2021 17:42:31 +0800
Subject: [PATCH 1778/2658] ext4: fix bh ref count on error paths

[ Upstream commit c915fb80eaa6194fa9bd0a4487705cd5b0dda2f1 ]

__ext4_journalled_writepage should drop bhs' ref count on error paths

Signed-off-by: Zhaolong Zhang <zhangzl2013@126.com>
Link: https://lore.kernel.org/r/1614678151-70481-1-git-send-email-zhangzl2013@126.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/inode.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 4fcf84a54e3f..9580e43004d4 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1839,13 +1839,13 @@ static int __ext4_journalled_writepage(struct page *page,
 	if (!ret)
 		ret = err;
 
-	if (!ext4_has_inline_data(inode))
-		ext4_walk_page_buffers(NULL, page_bufs, 0, len,
-				       NULL, bput_one);
 	ext4_set_inode_state(inode, EXT4_STATE_JDATA);
 out:
 	unlock_page(page);
 out_no_pagelock:
+	if (!inline_data && page_bufs)
+		ext4_walk_page_buffers(NULL, page_bufs, 0, len,
+				       NULL, bput_one);
 	brelse(inode_bh);
 	return ret;
 }

From 403bd3a1719276286de0e6bc7f3990605ef465e3 Mon Sep 17 00:00:00 2001
From: "J. Bruce Fields" <bfields@redhat.com>
Date: Tue, 2 Mar 2021 10:48:38 -0500
Subject: [PATCH 1779/2658] rpc: fix NULL dereference on kmalloc failure

[ Upstream commit 0ddc942394013f08992fc379ca04cffacbbe3dae ]

I think this is unlikely but possible:

svc_authenticate sets rq_authop and calls svcauth_gss_accept.  The
kmalloc(sizeof(*svcdata), GFP_KERNEL) fails, leaving rq_auth_data NULL,
and returning SVC_DENIED.

This causes svc_process_common to go to err_bad_auth, and eventually
call svc_authorise.  That calls ->release == svcauth_gss_release, which
tries to dereference rq_auth_data.

Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Link: https://lore.kernel.org/linux-nfs/3F1B347F-B809-478F-A1E9-0BE98E22B0F0@oracle.com/T/#t
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/auth_gss/svcauth_gss.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 91263d6a103b..bb8b0ef5de82 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1697,11 +1697,14 @@ static int
 svcauth_gss_release(struct svc_rqst *rqstp)
 {
 	struct gss_svc_data *gsd = (struct gss_svc_data *)rqstp->rq_auth_data;
-	struct rpc_gss_wire_cred *gc = &gsd->clcred;
+	struct rpc_gss_wire_cred *gc;
 	struct xdr_buf *resbuf = &rqstp->rq_res;
 	int stat = -EINVAL;
 	struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);
 
+	if (!gsd)
+		goto out;
+	gc = &gsd->clcred;
 	if (gc->gc_proc != RPC_GSS_PROC_DATA)
 		goto out;
 	/* Release can be called twice, but we only wrap once. */
@@ -1742,10 +1745,10 @@ svcauth_gss_release(struct svc_rqst *rqstp)
 	if (rqstp->rq_cred.cr_group_info)
 		put_group_info(rqstp->rq_cred.cr_group_info);
 	rqstp->rq_cred.cr_group_info = NULL;
-	if (gsd->rsci)
+	if (gsd && gsd->rsci) {
 		cache_put(&gsd->rsci->h, sn->rsc_cache);
-	gsd->rsci = NULL;
-
+		gsd->rsci = NULL;
+	}
 	return stat;
 }
 

From 0e88934a1cad308210dff8c42f4e685ef711e124 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Fri, 26 Feb 2021 15:38:13 +0100
Subject: [PATCH 1780/2658] ASoC: rt5640: Fix dac- and adc- vol-tlv values
 being off by a factor of 10

[ Upstream commit cfa26ed1f9f885c2fd8f53ca492989d1e16d0199 ]

The adc_vol_tlv volume-control has a range from -17.625 dB to +30 dB,
not -176.25 dB to + 300 dB. This wrong scale is esp. a problem in userspace
apps which translate the dB scale to a linear scale. With the logarithmic
dB scale being of by a factor of 10 we loose all precision in the lower
area of the range when apps translate things to a linear scale.

E.g. the 0 dB default, which corresponds with a value of 47 of the
0 - 127 range for the control, would be shown as 0/100 in alsa-mixer.

Since the centi-dB values used in the TLV struct cannot represent the
0.375 dB step size used by these controls, change the TLV definition
for them to specify a min and max value instead of min + stepsize.

Note this mirrors commit 3f31f7d9b540 ("ASoC: rt5670: Fix dac- and adc-
vol-tlv values being off by a factor of 10") which made the exact same
change to the rt5670 codec driver.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20210226143817.84287-2-hdegoede@redhat.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/rt5640.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
index b1c8bb39cdf1..db7734e45dd1 100644
--- a/sound/soc/codecs/rt5640.c
+++ b/sound/soc/codecs/rt5640.c
@@ -341,9 +341,9 @@ static bool rt5640_readable_register(struct device *dev, unsigned int reg)
 }
 
 static const DECLARE_TLV_DB_SCALE(out_vol_tlv, -4650, 150, 0);
-static const DECLARE_TLV_DB_SCALE(dac_vol_tlv, -65625, 375, 0);
+static const DECLARE_TLV_DB_MINMAX(dac_vol_tlv, -6562, 0);
 static const DECLARE_TLV_DB_SCALE(in_vol_tlv, -3450, 150, 0);
-static const DECLARE_TLV_DB_SCALE(adc_vol_tlv, -17625, 375, 0);
+static const DECLARE_TLV_DB_MINMAX(adc_vol_tlv, -1762, 3000);
 static const DECLARE_TLV_DB_SCALE(adc_bst_tlv, 0, 1200, 0);
 
 /* {0, +20, +24, +30, +35, +40, +44, +50, +52} dB */

From f9f534bcf3ccc4a9d193397250c5c7938c2c3337 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Fri, 26 Feb 2021 15:38:14 +0100
Subject: [PATCH 1781/2658] ASoC: rt5651: Fix dac- and adc- vol-tlv values
 being off by a factor of 10

[ Upstream commit eee51df776bd6cac10a76b2779a9fdee3f622b2b ]

The adc_vol_tlv volume-control has a range from -17.625 dB to +30 dB,
not -176.25 dB to + 300 dB. This wrong scale is esp. a problem in userspace
apps which translate the dB scale to a linear scale. With the logarithmic
dB scale being of by a factor of 10 we loose all precision in the lower
area of the range when apps translate things to a linear scale.

E.g. the 0 dB default, which corresponds with a value of 47 of the
0 - 127 range for the control, would be shown as 0/100 in alsa-mixer.

Since the centi-dB values used in the TLV struct cannot represent the
0.375 dB step size used by these controls, change the TLV definition
for them to specify a min and max value instead of min + stepsize.

Note this mirrors commit 3f31f7d9b540 ("ASoC: rt5670: Fix dac- and adc-
vol-tlv values being off by a factor of 10") which made the exact same
change to the rt5670 codec driver.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20210226143817.84287-3-hdegoede@redhat.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/rt5651.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/rt5651.c b/sound/soc/codecs/rt5651.c
index 1d4031818966..883b93f0bd38 100644
--- a/sound/soc/codecs/rt5651.c
+++ b/sound/soc/codecs/rt5651.c
@@ -286,9 +286,9 @@ static bool rt5651_readable_register(struct device *dev, unsigned int reg)
 }
 
 static const DECLARE_TLV_DB_SCALE(out_vol_tlv, -4650, 150, 0);
-static const DECLARE_TLV_DB_SCALE(dac_vol_tlv, -65625, 375, 0);
+static const DECLARE_TLV_DB_MINMAX(dac_vol_tlv, -6562, 0);
 static const DECLARE_TLV_DB_SCALE(in_vol_tlv, -3450, 150, 0);
-static const DECLARE_TLV_DB_SCALE(adc_vol_tlv, -17625, 375, 0);
+static const DECLARE_TLV_DB_MINMAX(adc_vol_tlv, -1762, 3000);
 static const DECLARE_TLV_DB_SCALE(adc_bst_tlv, 0, 1200, 0);
 
 /* {0, +20, +24, +30, +35, +40, +44, +50, +52} dB */

From f11a5f508a987a0597829a78a84f69b539dcdb04 Mon Sep 17 00:00:00 2001
From: Benjamin Rood <benjaminjrood@gmail.com>
Date: Fri, 19 Feb 2021 13:33:08 -0500
Subject: [PATCH 1782/2658] ASoC: sgtl5000: set DAP_AVC_CTRL register to
 correct default value on probe

[ Upstream commit f86f58e3594fb0ab1993d833d3b9a2496f3c928c ]

According to the SGTL5000 datasheet [1], the DAP_AVC_CTRL register has
the following bit field definitions:

| BITS  | FIELD       | RW | RESET | DEFINITION                        |
| 15    | RSVD        | RO | 0x0   | Reserved                          |
| 14    | RSVD        | RW | 0x1   | Reserved                          |
| 13:12 | MAX_GAIN    | RW | 0x1   | Max Gain of AVC in expander mode  |
| 11:10 | RSVD        | RO | 0x0   | Reserved                          |
| 9:8   | LBI_RESP    | RW | 0x1   | Integrator Response               |
| 7:6   | RSVD        | RO | 0x0   | Reserved                          |
| 5     | HARD_LMT_EN | RW | 0x0   | Enable hard limiter mode          |
| 4:1   | RSVD        | RO | 0x0   | Reserved                          |
| 0     | EN          | RW | 0x0   | Enable/Disable AVC                |

The original default value written to the DAP_AVC_CTRL register during
sgtl5000_i2c_probe() was 0x0510.  This would incorrectly write values to
bits 4 and 10, which are defined as RESERVED.  It would also not set
bits 12 and 14 to their correct RESET values of 0x1, and instead set
them to 0x0.  While the DAP_AVC module is effectively disabled because
the EN bit is 0, this default value is still writing invalid values to
registers that are marked as read-only and RESERVED as well as not
setting bits 12 and 14 to their correct default values as defined by the
datasheet.

The correct value that should be written to the DAP_AVC_CTRL register is
0x5100, which configures the register bits to the default values defined
by the datasheet, and prevents any writes to bits defined as
'read-only'.  Generally speaking, it is best practice to NOT attempt to
write values to registers/bits defined as RESERVED, as it generally
produces unwanted/undefined behavior, or errors.

Also, all credit for this patch should go to my colleague Dan MacDonald
<dmacdonald@curbellmedical.com> for finding this error in the first
place.

[1] https://www.nxp.com/docs/en/data-sheet/SGTL5000.pdf

Signed-off-by: Benjamin Rood <benjaminjrood@gmail.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Link: https://lore.kernel.org/r/20210219183308.GA2117@ubuntu-dev
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/sgtl5000.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index a3dd7030f629..321b1ac52bfd 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -78,7 +78,7 @@ static const struct reg_default sgtl5000_reg_defaults[] = {
 	{ SGTL5000_DAP_EQ_BASS_BAND4,		0x002f },
 	{ SGTL5000_DAP_MAIN_CHAN,		0x8000 },
 	{ SGTL5000_DAP_MIX_CHAN,		0x0000 },
-	{ SGTL5000_DAP_AVC_CTRL,		0x0510 },
+	{ SGTL5000_DAP_AVC_CTRL,		0x5100 },
 	{ SGTL5000_DAP_AVC_THRESHOLD,		0x1473 },
 	{ SGTL5000_DAP_AVC_ATTACK,		0x0028 },
 	{ SGTL5000_DAP_AVC_DECAY,		0x0050 },

From ac73a272756f451015370a541e3342c63586c411 Mon Sep 17 00:00:00 2001
From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Date: Wed, 10 Mar 2021 22:46:36 -0800
Subject: [PATCH 1783/2658] scsi: st: Fix a use after free in st_open()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c8c165dea4c8f5ad67b1240861e4f6c5395fa4ac ]

In st_open(), if STp->in_use is true, STp will be freed by
scsi_tape_put(). However, STp is still used by DEBC_printk() after. It is
better to DEBC_printk() before scsi_tape_put().

Link: https://lore.kernel.org/r/20210311064636.10522-1-lyl2019@mail.ustc.edu.cn
Acked-by: Kai Mäkisara <kai.makisara@kolumbus.fi>
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/st.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 088a68ab4246..3a3876091a9d 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -1267,8 +1267,8 @@ static int st_open(struct inode *inode, struct file *filp)
 	spin_lock(&st_use_lock);
 	if (STp->in_use) {
 		spin_unlock(&st_use_lock);
-		scsi_tape_put(STp);
 		DEBC_printk(STp, "Device already in use.\n");
+		scsi_tape_put(STp);
 		return (-EBUSY);
 	}
 

From 91aa503a1df7283e43185f6530febc859e4b0fce Mon Sep 17 00:00:00 2001
From: Alexey Dobriyan <adobriyan@gmail.com>
Date: Sun, 14 Mar 2021 18:32:46 +0300
Subject: [PATCH 1784/2658] scsi: qla2xxx: Fix broken #endif placement

[ Upstream commit 5999b9e5b1f8a2f5417b755130919b3ac96f5550 ]

Only half of the file is under include guard because terminating #endif
is placed too early.

Link: https://lore.kernel.org/r/YE4snvoW1SuwcXAn@localhost.localdomain
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_target.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index bca584ae45b7..7a6fafa8ba56 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -112,7 +112,6 @@
 	(min(1270, ((ql) > 0) ? (QLA_TGT_DATASEGS_PER_CMD_24XX + \
 		QLA_TGT_DATASEGS_PER_CONT_24XX*((ql) - 1)) : 0))
 #endif
-#endif
 
 #define GET_TARGET_ID(ha, iocb) ((HAS_EXTENDED_IDS(ha))			\
 			 ? le16_to_cpu((iocb)->u.isp2x.target.extended)	\
@@ -323,6 +322,7 @@ struct ctio_to_2xxx {
 #ifndef CTIO_RET_TYPE
 #define CTIO_RET_TYPE	0x17		/* CTIO return entry */
 #define ATIO_TYPE7 0x06 /* Accept target I/O entry for 24xx */
+#endif
 
 struct fcp_hdr {
 	uint8_t  r_ctl;

From bdb0d98b7467919730da8ce042e67437acdd8da8 Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Mon, 15 Mar 2021 15:59:14 -0400
Subject: [PATCH 1785/2658] staging: comedi: cb_pcidas: fix request_irq() warn

[ Upstream commit 2e5848a3d86f03024ae096478bdb892ab3d79131 ]

request_irq() wont accept a name which contains slash so we need to
repalce it with something else -- otherwise it will trigger a warning
and the entry in /proc/irq/ will not be created
since the .name might be used by userspace and we don't want to break
userspace, so we are changing the parameters passed to request_irq()

[    1.630764] name 'pci-das1602/16'
[    1.630950] WARNING: CPU: 0 PID: 181 at fs/proc/generic.c:180 __xlate_proc_name+0x93/0xb0
[    1.634009] RIP: 0010:__xlate_proc_name+0x93/0xb0
[    1.639441] Call Trace:
[    1.639976]  proc_mkdir+0x18/0x20
[    1.641946]  request_threaded_irq+0xfe/0x160
[    1.642186]  cb_pcidas_auto_attach+0xf4/0x610 [cb_pcidas]

Suggested-by: Ian Abbott <abbotti@mev.co.uk>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Link: https://lore.kernel.org/r/20210315195914.4801-1-ztong0001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/comedi/drivers/cb_pcidas.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/cb_pcidas.c b/drivers/staging/comedi/drivers/cb_pcidas.c
index 3ea15bb0e56e..15b9cc8531f0 100644
--- a/drivers/staging/comedi/drivers/cb_pcidas.c
+++ b/drivers/staging/comedi/drivers/cb_pcidas.c
@@ -1290,7 +1290,7 @@ static int cb_pcidas_auto_attach(struct comedi_device *dev,
 	     devpriv->amcc + AMCC_OP_REG_INTCSR);
 
 	ret = request_irq(pcidev->irq, cb_pcidas_interrupt, IRQF_SHARED,
-			  dev->board_name, dev);
+			  "cb_pcidas", dev);
 	if (ret) {
 		dev_dbg(dev->class_dev, "unable to allocate irq %d\n",
 			pcidev->irq);

From 3a2a479db848c14d94a621f10ef02063dbb6f86d Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Mon, 15 Mar 2021 15:58:12 -0400
Subject: [PATCH 1786/2658] staging: comedi: cb_pcidas64: fix request_irq()
 warn

[ Upstream commit d2d106fe3badfc3bf0dd3899d1c3f210c7203eab ]

request_irq() wont accept a name which contains slash so we need to
repalce it with something else -- otherwise it will trigger a warning
and the entry in /proc/irq/ will not be created
since the .name might be used by userspace and we don't want to break
userspace, so we are changing the parameters passed to request_irq()

[    1.565966] name 'pci-das6402/16'
[    1.566149] WARNING: CPU: 0 PID: 184 at fs/proc/generic.c:180 __xlate_proc_name+0x93/0xb0
[    1.568923] RIP: 0010:__xlate_proc_name+0x93/0xb0
[    1.574200] Call Trace:
[    1.574722]  proc_mkdir+0x18/0x20
[    1.576629]  request_threaded_irq+0xfe/0x160
[    1.576859]  auto_attach+0x60a/0xc40 [cb_pcidas64]

Suggested-by: Ian Abbott <abbotti@mev.co.uk>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Link: https://lore.kernel.org/r/20210315195814.4692-1-ztong0001@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/comedi/drivers/cb_pcidas64.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/cb_pcidas64.c b/drivers/staging/comedi/drivers/cb_pcidas64.c
index d33b8fe872a7..93d8c0b06d55 100644
--- a/drivers/staging/comedi/drivers/cb_pcidas64.c
+++ b/drivers/staging/comedi/drivers/cb_pcidas64.c
@@ -4040,7 +4040,7 @@ static int auto_attach(struct comedi_device *dev,
 	init_stc_registers(dev);
 
 	retval = request_irq(pcidev->irq, handle_interrupt, IRQF_SHARED,
-			     dev->board_name, dev);
+			     "cb_pcidas64", dev);
 	if (retval) {
 		dev_dbg(dev->class_dev, "unable to allocate irq %u\n",
 			pcidev->irq);

From ec4bccc4d3b57973fabe2822fb0606c4f8819ee3 Mon Sep 17 00:00:00 2001
From: "zhangyi (F)" <yi.zhang@huawei.com>
Date: Wed, 3 Mar 2021 21:17:03 +0800
Subject: [PATCH 1787/2658] ext4: do not iput inode under running transaction
 in ext4_rename()

[ Upstream commit 5dccdc5a1916d4266edd251f20bbbb113a5c495f ]

In ext4_rename(), when RENAME_WHITEOUT failed to add new entry into
directory, it ends up dropping new created whiteout inode under the
running transaction. After commit <9b88f9fb0d2> ("ext4: Do not iput inode
under running transaction"), we follow the assumptions that evict() does
not get called from a transaction context but in ext4_rename() it breaks
this suggestion. Although it's not a real problem, better to obey it, so
this patch add inode to orphan list and stop transaction before final
iput().

Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
Link: https://lore.kernel.org/r/20210303131703.330415-2-yi.zhang@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/namei.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 809a0f815360..a52c72561483 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3551,7 +3551,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
 	 */
 	retval = -ENOENT;
 	if (!old.bh || le32_to_cpu(old.de->inode) != old.inode->i_ino)
-		goto end_rename;
+		goto release_bh;
 
 	if ((old.dir != new.dir) &&
 	    ext4_encrypted_inode(new.dir) &&
@@ -3566,7 +3566,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
 	if (IS_ERR(new.bh)) {
 		retval = PTR_ERR(new.bh);
 		new.bh = NULL;
-		goto end_rename;
+		goto release_bh;
 	}
 	if (new.bh) {
 		if (!new.inode) {
@@ -3583,15 +3583,13 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
 		handle = ext4_journal_start(old.dir, EXT4_HT_DIR, credits);
 		if (IS_ERR(handle)) {
 			retval = PTR_ERR(handle);
-			handle = NULL;
-			goto end_rename;
+			goto release_bh;
 		}
 	} else {
 		whiteout = ext4_whiteout_for_rename(&old, credits, &handle);
 		if (IS_ERR(whiteout)) {
 			retval = PTR_ERR(whiteout);
-			whiteout = NULL;
-			goto end_rename;
+			goto release_bh;
 		}
 	}
 
@@ -3699,16 +3697,18 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
 			ext4_resetent(handle, &old,
 				      old.inode->i_ino, old_file_type);
 			drop_nlink(whiteout);
+			ext4_orphan_add(handle, whiteout);
 		}
 		unlock_new_inode(whiteout);
+		ext4_journal_stop(handle);
 		iput(whiteout);
-
+	} else {
+		ext4_journal_stop(handle);
 	}
+release_bh:
 	brelse(old.dir_bh);
 	brelse(old.bh);
 	brelse(new.bh);
-	if (handle)
-		ext4_journal_stop(handle);
 	return retval;
 }
 

From a9d269e98fe22ce6a11f1c5151d930de12bab3f2 Mon Sep 17 00:00:00 2001
From: Doug Brown <doug@schmorgal.com>
Date: Thu, 11 Feb 2021 21:27:54 -0800
Subject: [PATCH 1788/2658] appletalk: Fix skb allocation size in loopback case

[ Upstream commit 39935dccb21c60f9bbf1bb72d22ab6fd14ae7705 ]

If a DDP broadcast packet is sent out to a non-gateway target, it is
also looped back. There is a potential for the loopback device to have a
longer hardware header length than the original target route's device,
which can result in the skb not being created with enough room for the
loopback device's hardware header. This patch fixes the issue by
determining that a loopback will be necessary prior to allocating the
skb, and if so, ensuring the skb has enough room.

This was discovered while testing a new driver that creates a LocalTalk
network interface (LTALK_HLEN = 1). It caused an skb_under_panic.

Signed-off-by: Doug Brown <doug@schmorgal.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/appletalk/ddp.c | 33 +++++++++++++++++++++------------
 1 file changed, 21 insertions(+), 12 deletions(-)

diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index ace94170f55e..1048cddcc9a3 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1575,8 +1575,8 @@ static int atalk_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 	struct sk_buff *skb;
 	struct net_device *dev;
 	struct ddpehdr *ddp;
-	int size;
-	struct atalk_route *rt;
+	int size, hard_header_len;
+	struct atalk_route *rt, *rt_lo = NULL;
 	int err;
 
 	if (flags & ~(MSG_DONTWAIT|MSG_CMSG_COMPAT))
@@ -1639,7 +1639,22 @@ static int atalk_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 	SOCK_DEBUG(sk, "SK %p: Size needed %d, device %s\n",
 			sk, size, dev->name);
 
-	size += dev->hard_header_len;
+	hard_header_len = dev->hard_header_len;
+	/* Leave room for loopback hardware header if necessary */
+	if (usat->sat_addr.s_node == ATADDR_BCAST &&
+	    (dev->flags & IFF_LOOPBACK || !(rt->flags & RTF_GATEWAY))) {
+		struct atalk_addr at_lo;
+
+		at_lo.s_node = 0;
+		at_lo.s_net  = 0;
+
+		rt_lo = atrtr_find(&at_lo);
+
+		if (rt_lo && rt_lo->dev->hard_header_len > hard_header_len)
+			hard_header_len = rt_lo->dev->hard_header_len;
+	}
+
+	size += hard_header_len;
 	release_sock(sk);
 	skb = sock_alloc_send_skb(sk, size, (flags & MSG_DONTWAIT), &err);
 	lock_sock(sk);
@@ -1647,7 +1662,7 @@ static int atalk_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 		goto out;
 
 	skb_reserve(skb, ddp_dl->header_length);
-	skb_reserve(skb, dev->hard_header_len);
+	skb_reserve(skb, hard_header_len);
 	skb->dev = dev;
 
 	SOCK_DEBUG(sk, "SK %p: Begin build.\n", sk);
@@ -1698,18 +1713,12 @@ static int atalk_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 		/* loop back */
 		skb_orphan(skb);
 		if (ddp->deh_dnode == ATADDR_BCAST) {
-			struct atalk_addr at_lo;
-
-			at_lo.s_node = 0;
-			at_lo.s_net  = 0;
-
-			rt = atrtr_find(&at_lo);
-			if (!rt) {
+			if (!rt_lo) {
 				kfree_skb(skb);
 				err = -ENETUNREACH;
 				goto out;
 			}
-			dev = rt->dev;
+			dev = rt_lo->dev;
 			skb->dev = dev;
 		}
 		ddp_dl->request(ddp_dl, skb, dev->dev_addr);

From 30b0d1382872ebcd7d806422026d2f0b5c8c6c48 Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Mon, 15 Feb 2021 14:17:56 -0500
Subject: [PATCH 1789/2658] net: wan/lmc: unregister device when no matching
 device is found

[ Upstream commit 62e69bc419772638369eff8ff81340bde8aceb61 ]

lmc set sc->lmc_media pointer when there is a matching device.
However, when no matching device is found, this pointer is NULL
and the following dereference will result in a null-ptr-deref.

To fix this issue, unregister the hdlc device and return an error.

[    4.569359] BUG: KASAN: null-ptr-deref in lmc_init_one.cold+0x2b6/0x55d [lmc]
[    4.569748] Read of size 8 at addr 0000000000000008 by task modprobe/95
[    4.570102]
[    4.570187] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc7 #94
[    4.570527] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd9c812dda519-preb4
[    4.571125] Call Trace:
[    4.571261]  dump_stack+0x7d/0xa3
[    4.571445]  kasan_report.cold+0x10c/0x10e
[    4.571667]  ? lmc_init_one.cold+0x2b6/0x55d [lmc]
[    4.571932]  lmc_init_one.cold+0x2b6/0x55d [lmc]
[    4.572186]  ? lmc_mii_readreg+0xa0/0xa0 [lmc]
[    4.572432]  local_pci_probe+0x6f/0xb0
[    4.572639]  pci_device_probe+0x171/0x240
[    4.572857]  ? pci_device_remove+0xe0/0xe0
[    4.573080]  ? kernfs_create_link+0xb6/0x110
[    4.573315]  ? sysfs_do_create_link_sd.isra.0+0x76/0xe0
[    4.573598]  really_probe+0x161/0x420
[    4.573799]  driver_probe_device+0x6d/0xd0
[    4.574022]  device_driver_attach+0x82/0x90
[    4.574249]  ? device_driver_attach+0x90/0x90
[    4.574485]  __driver_attach+0x60/0x100
[    4.574694]  ? device_driver_attach+0x90/0x90
[    4.574931]  bus_for_each_dev+0xe1/0x140
[    4.575146]  ? subsys_dev_iter_exit+0x10/0x10
[    4.575387]  ? klist_node_init+0x61/0x80
[    4.575602]  bus_add_driver+0x254/0x2a0
[    4.575812]  driver_register+0xd3/0x150
[    4.576021]  ? 0xffffffffc0018000
[    4.576202]  do_one_initcall+0x84/0x250
[    4.576411]  ? trace_event_raw_event_initcall_finish+0x150/0x150
[    4.576733]  ? unpoison_range+0xf/0x30
[    4.576938]  ? ____kasan_kmalloc.constprop.0+0x84/0xa0
[    4.577219]  ? unpoison_range+0xf/0x30
[    4.577423]  ? unpoison_range+0xf/0x30
[    4.577628]  do_init_module+0xf8/0x350
[    4.577833]  load_module+0x3fe6/0x4340
[    4.578038]  ? vm_unmap_ram+0x1d0/0x1d0
[    4.578247]  ? ____kasan_kmalloc.constprop.0+0x84/0xa0
[    4.578526]  ? module_frob_arch_sections+0x20/0x20
[    4.578787]  ? __do_sys_finit_module+0x108/0x170
[    4.579037]  __do_sys_finit_module+0x108/0x170
[    4.579278]  ? __ia32_sys_init_module+0x40/0x40
[    4.579523]  ? file_open_root+0x200/0x200
[    4.579742]  ? do_sys_open+0x85/0xe0
[    4.579938]  ? filp_open+0x50/0x50
[    4.580125]  ? exit_to_user_mode_prepare+0xfc/0x130
[    4.580390]  do_syscall_64+0x33/0x40
[    4.580586]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[    4.580859] RIP: 0033:0x7f1a724c3cf7
[    4.581054] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f7 48 89 d6 48 891
[    4.582043] RSP: 002b:00007fff44941c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[    4.582447] RAX: ffffffffffffffda RBX: 00000000012ada70 RCX: 00007f1a724c3cf7
[    4.582827] RDX: 0000000000000000 RSI: 00000000012ac9e0 RDI: 0000000000000003
[    4.583207] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001
[    4.583587] R10: 00007f1a72527300 R11: 0000000000000246 R12: 00000000012ac9e0
[    4.583968] R13: 0000000000000000 R14: 00000000012acc90 R15: 0000000000000001
[    4.584349] ==================================================================

Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wan/lmc/lmc_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wan/lmc/lmc_main.c b/drivers/net/wan/lmc/lmc_main.c
index c178e1218347..88cf948ce8d4 100644
--- a/drivers/net/wan/lmc/lmc_main.c
+++ b/drivers/net/wan/lmc/lmc_main.c
@@ -926,6 +926,8 @@ static int lmc_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         break;
     default:
 	printk(KERN_WARNING "%s: LMC UNKNOWN CARD!\n", dev->name);
+	unregister_hdlc_device(dev);
+	return -EIO;
         break;
     }
 

From 478af0208460acab8b434bcc706d51c9fc241af0 Mon Sep 17 00:00:00 2001
From: Ikjoon Jang <ikjn@chromium.org>
Date: Wed, 24 Mar 2021 18:51:52 +0800
Subject: [PATCH 1790/2658] ALSA: usb-audio: Apply sample rate quirk to
 Logitech Connect

commit 625bd5a616ceda4840cd28f82e957c8ced394b6a upstream.

Logitech ConferenceCam Connect is a compound USB device with UVC and
UAC. Not 100% reproducible but sometimes it keeps responding STALL to
every control transfer once it receives get_freq request.

This patch adds 046d:0x084c to a snd_usb_get_sample_rate_quirk list.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203419
Signed-off-by: Ikjoon Jang <ikjn@chromium.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210324105153.2322881-1-ikjn@chromium.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/quirks.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 79cffe44388f..cd615514a5ff 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1155,6 +1155,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
 	case USB_ID(0x21B4, 0x0081): /* AudioQuest DragonFly */
 	case USB_ID(0x2912, 0x30c8): /* Audioengine D1 */
 	case USB_ID(0x413c, 0xa506): /* Dell AE515 sound bar */
+	case USB_ID(0x046d, 0x084c): /* Logitech ConferenceCam Connect */
 		return true;
 	}
 	return false;

From efb8c80d9aaedcc0d4d83ac93a586282b855d1d3 Mon Sep 17 00:00:00 2001
From: Hui Wang <hui.wang@canonical.com>
Date: Sat, 20 Mar 2021 17:15:42 +0800
Subject: [PATCH 1791/2658] ALSA: hda/realtek: call alc_update_headset_mode()
 in hp_automute_hook

commit e54f30befa7990b897189b44a56c1138c6bfdbb5 upstream.

We found the alc_update_headset_mode() is not called on some machines
when unplugging the headset, as a result, the mode of the
ALC_HEADSET_MODE_UNPLUGGED can't be set, then the current_headset_type
is not cleared, if users plug a differnt type of headset next time,
the determine_headset_type() will not be called and the audio jack is
set to the headset type of previous time.

On the Dell machines which connect the dmic to the PCH, if we open
the gnome-sound-setting and unplug the headset, this issue will
happen. Those machines disable the auto-mute by ucm and has no
internal mic in the input source, so the update_headset_mode() will
not be called by cap_sync_hook or automute_hook when unplugging, and
because the gnome-sound-setting is opened, the codec will not enter
the runtime_suspend state, so the update_headset_mode() will not be
called by alc_resume when unplugging. In this case the
hp_automute_hook is called when unplugging, so add
update_headset_mode() calling to this function.

Cc: <stable@vger.kernel.org>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Link: https://lore.kernel.org/r/20210320091542.6748-2-hui.wang@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index c7061a5dd809..4bfe06650277 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4294,6 +4294,7 @@ static void alc_update_headset_jack_cb(struct hda_codec *codec,
 	struct alc_spec *spec = codec->spec;
 	spec->current_headset_type = ALC_HEADSET_TYPE_UNKNOWN;
 	snd_hda_gen_hp_automute(codec, jack);
+	alc_update_headset_mode(codec);
 }
 
 static void alc_probe_headset_mode(struct hda_codec *codec)

From dcd1ca4905708f9e732fbd55aa2f6f4c491b18fc Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Thu, 1 Apr 2021 13:54:40 -0400
Subject: [PATCH 1792/2658] tracing: Fix stack trace event size

commit 9deb193af69d3fd6dd8e47f292b67c805a787010 upstream.

Commit cbc3b92ce037 fixed an issue to modify the macros of the stack trace
event so that user space could parse it properly. Originally the stack
trace format to user space showed that the called stack was a dynamic
array. But it is not actually a dynamic array, in the way that other
dynamic event arrays worked, and this broke user space parsing for it. The
update was to make the array look to have 8 entries in it. Helper
functions were added to make it parse it correctly, as the stack was
dynamic, but was determined by the size of the event stored.

Although this fixed user space on how it read the event, it changed the
internal structure used for the stack trace event. It changed the array
size from [0] to [8] (added 8 entries). This increased the size of the
stack trace event by 8 words. The size reserved on the ring buffer was the
size of the stack trace event plus the number of stack entries found in
the stack trace. That commit caused the amount to be 8 more than what was
needed because it did not expect the caller field to have any size. This
produced 8 entries of garbage (and reading random data) from the stack
trace event:

          <idle>-0       [002] d... 1976396.837549: <stack trace>
 => trace_event_raw_event_sched_switch
 => __traceiter_sched_switch
 => __schedule
 => schedule_idle
 => do_idle
 => cpu_startup_entry
 => secondary_startup_64_no_verify
 => 0xc8c5e150ffff93de
 => 0xffff93de
 => 0
 => 0
 => 0xc8c5e17800000000
 => 0x1f30affff93de
 => 0x00000004
 => 0x200000000

Instead, subtract the size of the caller field from the size of the event
to make sure that only the amount needed to store the stack trace is
reserved.

Link: https://lore.kernel.org/lkml/your-ad-here.call-01617191565-ext-9692@work.hours/

Cc: stable@vger.kernel.org
Fixes: cbc3b92ce037 ("tracing: Set kernel_stack's caller size properly")
Reported-by: Vasily Gorbik <gor@linux.ibm.com>
Tested-by: Vasily Gorbik <gor@linux.ibm.com>
Acked-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 67805ed4f870..c96c22f2af8e 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1918,7 +1918,8 @@ static void __ftrace_trace_stack(struct ring_buffer *buffer,
 	size *= sizeof(unsigned long);
 
 	event = trace_buffer_lock_reserve(buffer, TRACE_STACK,
-					  sizeof(*entry) + size, flags, pc);
+				    (sizeof(*entry) - sizeof(entry->caller)) + size,
+				    flags, pc);
 	if (!event)
 		goto out;
 	entry = ring_buffer_event_data(event);

From 4e75f196785d9ce402f23eb379840862b99c86ac Mon Sep 17 00:00:00 2001
From: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
Date: Mon, 29 Mar 2021 21:42:08 -0700
Subject: [PATCH 1793/2658] mm: fix race by making init_zero_pfn()
 early_initcall
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit e720e7d0e983bf05de80b231bccc39f1487f0f16 upstream.

There are code paths that rely on zero_pfn to be fully initialized
before core_initcall.  For example, wq_sysfs_init() is a core_initcall
function that eventually results in a call to kernel_execve, which
causes a page fault with a subsequent mmput.  If zero_pfn is not
initialized by then it may not get cleaned up properly and result in an
error:

  BUG: Bad rss-counter state mm:(ptrval) type:MM_ANONPAGES val:1

Here is an analysis of the race as seen on a MIPS device. On this
particular MT7621 device (Ubiquiti ER-X), zero_pfn is PFN 0 until
initialized, at which point it becomes PFN 5120:

  1. wq_sysfs_init calls into kobject_uevent_env at core_initcall:
       kobject_uevent_env+0x7e4/0x7ec
       kset_register+0x68/0x88
       bus_register+0xdc/0x34c
       subsys_virtual_register+0x34/0x78
       wq_sysfs_init+0x1c/0x4c
       do_one_initcall+0x50/0x1a8
       kernel_init_freeable+0x230/0x2c8
       kernel_init+0x10/0x100
       ret_from_kernel_thread+0x14/0x1c

  2. kobject_uevent_env() calls call_usermodehelper_exec() which executes
     kernel_execve asynchronously.

  3. Memory allocations in kernel_execve cause a page fault, bumping the
     MM reference counter:
       add_mm_counter_fast+0xb4/0xc0
       handle_mm_fault+0x6e4/0xea0
       __get_user_pages.part.78+0x190/0x37c
       __get_user_pages_remote+0x128/0x360
       get_arg_page+0x34/0xa0
       copy_string_kernel+0x194/0x2a4
       kernel_execve+0x11c/0x298
       call_usermodehelper_exec_async+0x114/0x194

  4. In case zero_pfn has not been initialized yet, zap_pte_range does
     not decrement the MM_ANONPAGES RSS counter and the BUG message is
     triggered shortly afterwards when __mmdrop checks the ref counters:
       __mmdrop+0x98/0x1d0
       free_bprm+0x44/0x118
       kernel_execve+0x160/0x1d8
       call_usermodehelper_exec_async+0x114/0x194
       ret_from_kernel_thread+0x14/0x1c

To avoid races such as described above, initialize init_zero_pfn at
early_initcall level.  Depending on the architecture, ZERO_PAGE is
either constant or gets initialized even earlier, at paging_init, so
there is no issue with initializing zero_pfn earlier.

Link: https://lkml.kernel.org/r/CALCv0x2YqOXEAy2Q=hafjhHCtTHVodChv1qpM=niAXOpqEbt7w@mail.gmail.com
Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: stable@vger.kernel.org
Tested-by: 周琰杰 (Zhou Yanjie) <zhouyanjie@wanyeetech.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/memory.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/memory.c b/mm/memory.c
index 8e41c675f7af..2d020726ffa0 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -129,7 +129,7 @@ static int __init init_zero_pfn(void)
 	zero_pfn = page_to_pfn(ZERO_PAGE(0));
 	return 0;
 }
-core_initcall(init_zero_pfn);
+early_initcall(init_zero_pfn);
 
 
 #if defined(SPLIT_RSS_COUNTING)

From 132d91d63874432e686254edc0ff9606c719fd45 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Date: Sun, 21 Mar 2021 23:37:49 +0900
Subject: [PATCH 1794/2658] reiserfs: update reiserfs_xattrs_initialized()
 condition

commit 5e46d1b78a03d52306f21f77a4e4a144b6d31486 upstream.

syzbot is reporting NULL pointer dereference at reiserfs_security_init()
[1], for commit ab17c4f02156c4f7 ("reiserfs: fixup xattr_root caching")
is assuming that REISERFS_SB(s)->xattr_root != NULL in
reiserfs_xattr_jcreate_nblocks() despite that commit made
REISERFS_SB(sb)->priv_root != NULL && REISERFS_SB(s)->xattr_root == NULL
case possible.

I guess that commit 6cb4aff0a77cc0e6 ("reiserfs: fix oops while creating
privroot with selinux enabled") wanted to check xattr_root != NULL
before reiserfs_xattr_jcreate_nblocks(), for the changelog is talking
about the xattr root.

  The issue is that while creating the privroot during mount
  reiserfs_security_init calls reiserfs_xattr_jcreate_nblocks which
  dereferences the xattr root. The xattr root doesn't exist, so we get
  an oops.

Therefore, update reiserfs_xattrs_initialized() to check both the
privroot and the xattr root.

Link: https://syzkaller.appspot.com/bug?id=8abaedbdeb32c861dc5340544284167dd0e46cde # [1]
Reported-and-tested-by: syzbot <syzbot+690cb1e51970435f9775@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 6cb4aff0a77c ("reiserfs: fix oops while creating privroot with selinux enabled")
Acked-by: Jeff Mahoney <jeffm@suse.com>
Acked-by: Jan Kara <jack@suse.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/reiserfs/xattr.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/reiserfs/xattr.h b/fs/reiserfs/xattr.h
index 613ff5aef94e..19ca3745301f 100644
--- a/fs/reiserfs/xattr.h
+++ b/fs/reiserfs/xattr.h
@@ -42,7 +42,7 @@ void reiserfs_security_free(struct reiserfs_security_handle *sec);
 
 static inline int reiserfs_xattrs_initialized(struct super_block *sb)
 {
-	return REISERFS_SB(sb)->priv_root != NULL;
+	return REISERFS_SB(sb)->priv_root && REISERFS_SB(sb)->xattr_root;
 }
 
 #define xattr_size(size) ((size) + sizeof(struct reiserfs_xattr_header))

From f72b62aa843157fe639db4529a8158fe43c0351f Mon Sep 17 00:00:00 2001
From: Wang Panzhenzhuan <randy.wang@rock-chips.com>
Date: Tue, 23 Feb 2021 18:07:25 +0800
Subject: [PATCH 1795/2658] pinctrl: rockchip: fix restore error in resume

commit c971af25cda94afe71617790826a86253e88eab0 upstream.

The restore in resume should match to suspend which only set for RK3288
SoCs pinctrl.

Fixes: 8dca933127024 ("pinctrl: rockchip: save and restore gpio6_c6 pinmux in suspend/resume")
Reviewed-by: Jianqun Xu <jay.xu@rock-chips.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Wang Panzhenzhuan <randy.wang@rock-chips.com>
Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>
Link: https://lore.kernel.org/r/20210223100725.269240-1-jay.xu@rock-chips.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pinctrl/pinctrl-rockchip.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index eba400df8215..59f103c115cc 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -1967,12 +1967,15 @@ static int __maybe_unused rockchip_pinctrl_suspend(struct device *dev)
 static int __maybe_unused rockchip_pinctrl_resume(struct device *dev)
 {
 	struct rockchip_pinctrl *info = dev_get_drvdata(dev);
-	int ret = regmap_write(info->regmap_base, RK3288_GRF_GPIO6C_IOMUX,
-			       rk3288_grf_gpio6c_iomux |
-			       GPIO6C6_SEL_WRITE_ENABLE);
+	int ret;
 
-	if (ret)
-		return ret;
+	if (info->ctrl->type == RK3288) {
+		ret = regmap_write(info->regmap_base, RK3288_GRF_GPIO6C_IOMUX,
+				   rk3288_grf_gpio6c_iomux |
+				   GPIO6C6_SEL_WRITE_ENABLE);
+		if (ret)
+			return ret;
+	}
 
 	return pinctrl_force_default(info->pctl_dev);
 }

From dbd47fa1a411a8f790dd2bf922a4925fe6041bf1 Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Tue, 19 Jan 2021 16:10:55 +0800
Subject: [PATCH 1796/2658] extcon: Fix error handling in extcon_dev_register

[ Upstream commit d3bdd1c3140724967ca4136755538fa7c05c2b4e ]

When devm_kcalloc() fails, we should execute device_unregister()
to unregister edev->dev from system.

Fixes: 046050f6e623e ("extcon: Update the prototype of extcon_register_notifier() with enum extcon")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/extcon/extcon.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
index db8f0eeca7c9..f1eb710cf005 100644
--- a/drivers/extcon/extcon.c
+++ b/drivers/extcon/extcon.c
@@ -938,6 +938,7 @@ int extcon_dev_register(struct extcon_dev *edev)
 			sizeof(*edev->nh) * edev->max_supported, GFP_KERNEL);
 	if (!edev->nh) {
 		ret = -ENOMEM;
+		device_unregister(&edev->dev);
 		goto err_dev;
 	}
 

From ca9f17cac882f9598f85709bf221e93f97a70207 Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Sat, 3 Apr 2021 06:58:36 +0000
Subject: [PATCH 1797/2658] firewire: nosy: Fix a use-after-free bug in
 nosy_ioctl()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 829933ef05a951c8ff140e814656d73e74915faf ]

For each device, the nosy driver allocates a pcilynx structure.
A use-after-free might happen in the following scenario:

 1. Open nosy device for the first time and call ioctl with command
    NOSY_IOC_START, then a new client A will be malloced and added to
    doubly linked list.
 2. Open nosy device for the second time and call ioctl with command
    NOSY_IOC_START, then a new client B will be malloced and added to
    doubly linked list.
 3. Call ioctl with command NOSY_IOC_START for client A, then client A
    will be readded to the doubly linked list. Now the doubly linked
    list is messed up.
 4. Close the first nosy device and nosy_release will be called. In
    nosy_release, client A will be unlinked and freed.
 5. Close the second nosy device, and client A will be referenced,
    resulting in UAF.

The root cause of this bug is that the element in the doubly linked list
is reentered into the list.

Fix this bug by adding a check before inserting a client.  If a client
is already in the linked list, don't insert it.

The following KASAN report reveals it:

   BUG: KASAN: use-after-free in nosy_release+0x1ea/0x210
   Write of size 8 at addr ffff888102ad7360 by task poc
   CPU: 3 PID: 337 Comm: poc Not tainted 5.12.0-rc5+ #6
   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
   Call Trace:
     nosy_release+0x1ea/0x210
     __fput+0x1e2/0x840
     task_work_run+0xe8/0x180
     exit_to_user_mode_prepare+0x114/0x120
     syscall_exit_to_user_mode+0x1d/0x40
     entry_SYSCALL_64_after_hwframe+0x44/0xae

   Allocated by task 337:
     nosy_open+0x154/0x4d0
     misc_open+0x2ec/0x410
     chrdev_open+0x20d/0x5a0
     do_dentry_open+0x40f/0xe80
     path_openat+0x1cf9/0x37b0
     do_filp_open+0x16d/0x390
     do_sys_openat2+0x11d/0x360
     __x64_sys_open+0xfd/0x1a0
     do_syscall_64+0x33/0x40
     entry_SYSCALL_64_after_hwframe+0x44/0xae

   Freed by task 337:
     kfree+0x8f/0x210
     nosy_release+0x158/0x210
     __fput+0x1e2/0x840
     task_work_run+0xe8/0x180
     exit_to_user_mode_prepare+0x114/0x120
     syscall_exit_to_user_mode+0x1d/0x40
     entry_SYSCALL_64_after_hwframe+0x44/0xae

   The buggy address belongs to the object at ffff888102ad7300 which belongs to the cache kmalloc-128 of size 128
   The buggy address is located 96 bytes inside of 128-byte region [ffff888102ad7300, ffff888102ad7380)

[ Modified to use 'list_empty()' inside proper lock  - Linus ]

Link: https://lore.kernel.org/lkml/1617433116-5930-1-git-send-email-zheyuma97@gmail.com/
Reported-and-tested-by: 马哲宇 (Zheyu Ma) <zheyuma97@gmail.com>
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Cc: Greg Kroah-Hartman <greg@kroah.com>
Cc: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firewire/nosy.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/firewire/nosy.c b/drivers/firewire/nosy.c
index 76b2d390f6ec..40ed4d8c61f5 100644
--- a/drivers/firewire/nosy.c
+++ b/drivers/firewire/nosy.c
@@ -358,6 +358,7 @@ nosy_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	struct client *client = file->private_data;
 	spinlock_t *client_list_lock = &client->lynx->client_list_lock;
 	struct nosy_stats stats;
+	int ret;
 
 	switch (cmd) {
 	case NOSY_IOC_GET_STATS:
@@ -372,11 +373,15 @@ nosy_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 			return 0;
 
 	case NOSY_IOC_START:
+		ret = -EBUSY;
 		spin_lock_irq(client_list_lock);
-		list_add_tail(&client->link, &client->lynx->client_list);
+		if (list_empty(&client->link)) {
+			list_add_tail(&client->link, &client->lynx->client_list);
+			ret = 0;
+		}
 		spin_unlock_irq(client_list_lock);
 
-		return 0;
+		return ret;
 
 	case NOSY_IOC_STOP:
 		spin_lock_irq(client_list_lock);

From 3a8c723b128cb3b69e14452203315e3275e0b67a Mon Sep 17 00:00:00 2001
From: Vincent Palatin <vpalatin@chromium.org>
Date: Fri, 19 Mar 2021 13:48:02 +0100
Subject: [PATCH 1798/2658] USB: quirks: ignore remote wake-up on Fibocom
 L850-GL LTE modem

commit 0bd860493f81eb2a46173f6f5e44cc38331c8dbd upstream.

This LTE modem (M.2 card) has a bug in its power management:
there is some kind of race condition for U3 wake-up between the host and
the device. The modem firmware sometimes crashes/locks when both events
happen at the same time and the modem fully drops off the USB bus (and
sometimes re-enumerates, sometimes just gets stuck until the next
reboot).

Tested with the modem wired to the XHCI controller on an AMD 3015Ce
platform. Without the patch, the modem dropped of the USB bus 5 times in
3 days. With the quirk, it stayed connected for a week while the
'runtime_suspended_time' counter incremented as excepted.

Signed-off-by: Vincent Palatin <vpalatin@chromium.org>
Link: https://lore.kernel.org/r/20210319124802.2315195-1-vpalatin@chromium.org
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/quirks.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 2fc735efc3dc..cd43e11d74f3 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -321,6 +321,10 @@ static const struct usb_device_id usb_quirk_list[] = {
 	/* DJI CineSSD */
 	{ USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
 
+	/* Fibocom L850-GL LTE Modem */
+	{ USB_DEVICE(0x2cb7, 0x0007), .driver_info =
+			USB_QUIRK_IGNORE_REMOTE_WAKEUP },
+
 	/* INTEL VALUE SSD */
 	{ USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
 

From a2aee1df329742dcb628127491324b3f186d0545 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Thu, 11 Mar 2021 14:37:14 +0100
Subject: [PATCH 1799/2658] cdc-acm: fix BREAK rx code path adding necessary
 calls

commit 08dff274edda54310d6f1cf27b62fddf0f8d146e upstream.

Counting break events is nice but we should actually report them to
the tty layer.

Fixes: 5a6a62bdb9257 ("cdc-acm: add TIOCMIWAIT")
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Link: https://lore.kernel.org/r/20210311133714.31881-1-oneukum@suse.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/cdc-acm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 53d2f02e18a3..a13b9055a0d3 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -334,8 +334,10 @@ static void acm_ctrl_irq(struct urb *urb)
 			acm->iocount.dsr++;
 		if (difference & ACM_CTRL_DCD)
 			acm->iocount.dcd++;
-		if (newctrl & ACM_CTRL_BRK)
+		if (newctrl & ACM_CTRL_BRK) {
 			acm->iocount.brk++;
+			tty_insert_flip_char(&acm->port, 0, TTY_BREAK);
+		}
 		if (newctrl & ACM_CTRL_RI)
 			acm->iocount.rng++;
 		if (newctrl & ACM_CTRL_FRAMING)

From 34ead8ce20cdf5f9d50493d17f79c54e81322aa5 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Thu, 11 Mar 2021 14:01:26 +0100
Subject: [PATCH 1800/2658] USB: cdc-acm: downgrade message to debug

commit e4c77070ad45fc940af1d7fb1e637c349e848951 upstream.

This failure is so common that logging an error here amounts
to spamming log files.

Reviewed-by: Bruno Thomsen <bruno.thomsen@gmail.com>
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210311130126.15972-2-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/cdc-acm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index a13b9055a0d3..130153392c2c 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -550,7 +550,8 @@ static void acm_port_dtr_rts(struct tty_port *port, int raise)
 
 	res = acm_set_control(acm, val);
 	if (res && (acm->ctrl_caps & USB_CDC_CAP_LINE))
-		dev_err(&acm->control->dev, "failed to set dtr/rts\n");
+		/* This is broken in too many devices to spam the logs */
+		dev_dbg(&acm->control->dev, "failed to set dtr/rts\n");
 }
 
 static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)

From ebae08e0b69c5180624bceeceab83dd429c5d3e8 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 22 Mar 2021 16:53:12 +0100
Subject: [PATCH 1801/2658] USB: cdc-acm: fix use-after-free after probe
 failure

commit 4e49bf376c0451ad2eae2592e093659cde12be9a upstream.

If tty-device registration fails the driver would fail to release the
data interface. When the device is later disconnected, the disconnect
callback would still be called for the data interface and would go about
releasing already freed resources.

Fixes: c93d81955005 ("usb: cdc-acm: fix error handling in acm_probe()")
Cc: stable@vger.kernel.org      # 3.9
Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210322155318.9837-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/cdc-acm.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 130153392c2c..8c476a785360 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1502,6 +1502,11 @@ static int acm_probe(struct usb_interface *intf,
 
 	return 0;
 alloc_fail8:
+	if (!acm->combined_interfaces) {
+		/* Clear driver data so that disconnect() returns early. */
+		usb_set_intfdata(data_interface, NULL);
+		usb_driver_release_interface(&acm_driver, data_interface);
+	}
 	if (acm->country_codes) {
 		device_remove_file(&acm->control->dev,
 				&dev_attr_wCountryCodes);

From 16cb53c87741e91c1b81370e22977bc4b718afcc Mon Sep 17 00:00:00 2001
From: Atul Gopinathan <atulgopinathan@gmail.com>
Date: Tue, 23 Mar 2021 17:04:12 +0530
Subject: [PATCH 1802/2658] staging: rtl8192e: Fix incorrect source in memcpy()

commit 72ad25fbbb78930f892b191637359ab5b94b3190 upstream.

The variable "info_element" is of the following type:

	struct rtllib_info_element *info_element

defined in drivers/staging/rtl8192e/rtllib.h:

	struct rtllib_info_element {
		u8 id;
		u8 len;
		u8 data[];
	} __packed;

The "len" field defines the size of the "data[]" array. The code is
supposed to check if "info_element->len" is greater than 4 and later
equal to 6. If this is satisfied then, the last two bytes (the 4th and
5th element of u8 "data[]" array) are copied into "network->CcxRmState".

Right now the code uses "memcpy()" with the source as "&info_element[4]"
which would copy in wrong and unintended information. The struct
"rtllib_info_element" has a size of 2 bytes for "id" and "len",
therefore indexing will be done in interval of 2 bytes. So,
"info_element[4]" would point to data which is beyond the memory
allocated for this pointer (that is, at x+8, while "info_element" has
been allocated only from x to x+7 (2 + 6 => 8 bytes)).

This patch rectifies this error by using "&info_element->data[4]" which
correctly copies the last two bytes of "data[]".

NOTE: The faulty line of code came from the following commit:

commit ecdfa44610fa ("Staging: add Realtek 8192 PCI wireless driver")

The above commit created the file `rtl8192e/ieee80211/ieee80211_rx.c`
which had the faulty line of code. This file has been deleted (or
possibly renamed) with the contents copied in to a new file
`rtl8192e/rtllib_rx.c` along with additional code in the commit
94a799425eee (tagged in Fixes).

Fixes: 94a799425eee ("From: wlanfae <wlanfae@realtek.com> [PATCH 1/8] rtl8192e: Import new version of driver from realtek")
Cc: stable@vger.kernel.org
Signed-off-by: Atul Gopinathan <atulgopinathan@gmail.com>
Link: https://lore.kernel.org/r/20210323113413.29179-1-atulgopinathan@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/rtl8192e/rtllib_rx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8192e/rtllib_rx.c b/drivers/staging/rtl8192e/rtllib_rx.c
index 37343ec3b484..6921e036a828 100644
--- a/drivers/staging/rtl8192e/rtllib_rx.c
+++ b/drivers/staging/rtl8192e/rtllib_rx.c
@@ -1988,7 +1988,7 @@ static void rtllib_parse_mife_generic(struct rtllib_device *ieee,
 	    info_element->data[2] == 0x96 &&
 	    info_element->data[3] == 0x01) {
 		if (info_element->len == 6) {
-			memcpy(network->CcxRmState, &info_element[4], 2);
+			memcpy(network->CcxRmState, &info_element->data[4], 2);
 			if (network->CcxRmState[0] != 0)
 				network->bCcxRmEnable = true;
 			else

From bcd38569ccf53803a276a22b23b2cb0eb4de286f Mon Sep 17 00:00:00 2001
From: Atul Gopinathan <atulgopinathan@gmail.com>
Date: Tue, 23 Mar 2021 17:04:14 +0530
Subject: [PATCH 1803/2658] staging: rtl8192e: Change state information from
 u16 to u8

commit e78836ae76d20f38eed8c8c67f21db97529949da upstream.

The "u16 CcxRmState[2];" array field in struct "rtllib_network" has 4
bytes in total while the operations performed on this array through-out
the code base are only 2 bytes.

The "CcxRmState" field is fed only 2 bytes of data using memcpy():

(In rtllib_rx.c:1972)
	memcpy(network->CcxRmState, &info_element->data[4], 2)

With "info_element->data[]" being a u8 array, if 2 bytes are written
into "CcxRmState" (whose one element is u16 size), then the 2 u8
elements from "data[]" gets squashed and written into the first element
("CcxRmState[0]") while the second element ("CcxRmState[1]") is never
fed with any data.

Same in file rtllib_rx.c:2522:
	 memcpy(dst->CcxRmState, src->CcxRmState, 2);

The above line duplicates "src" data to "dst" but only writes 2 bytes
(and not 4, which is the actual size). Again, only 1st element gets the
value while the 2nd element remains uninitialized.

This later makes operations done with CcxRmState unpredictable in the
following lines as the 1st element is having a squashed number while the
2nd element is having an uninitialized random number.

rtllib_rx.c:1973:    if (network->CcxRmState[0] != 0)
rtllib_rx.c:1977:    network->MBssidMask = network->CcxRmState[1] & 0x07;

network->MBssidMask is also of type u8 and not u16.

Fix this by changing the type of "CcxRmState" from u16 to u8 so that the
data written into this array and read from it make sense and are not
random values.

NOTE: The wrong initialization of "CcxRmState" can be seen in the
following commit:

commit ecdfa44610fa ("Staging: add Realtek 8192 PCI wireless driver")

The above commit created a file `rtl8192e/ieee80211.h` which used to
have the faulty line. The file has been deleted (or possibly renamed)
with the contents copied in to a new file `rtl8192e/rtllib.h` along with
additional code in the commit 94a799425eee (tagged in Fixes).

Fixes: 94a799425eee ("From: wlanfae <wlanfae@realtek.com> [PATCH 1/8] rtl8192e: Import new version of driver from realtek")
Cc: stable@vger.kernel.org
Signed-off-by: Atul Gopinathan <atulgopinathan@gmail.com>
Link: https://lore.kernel.org/r/20210323113413.29179-2-atulgopinathan@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/rtl8192e/rtllib.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8192e/rtllib.h b/drivers/staging/rtl8192e/rtllib.h
index 563ac12f0b2c..b9e978e895c6 100644
--- a/drivers/staging/rtl8192e/rtllib.h
+++ b/drivers/staging/rtl8192e/rtllib.h
@@ -1160,7 +1160,7 @@ struct rtllib_network {
 	bool	bWithAironetIE;
 	bool	bCkipSupported;
 	bool	bCcxRmEnable;
-	u16	CcxRmState[2];
+	u8	CcxRmState[2];
 	bool	bMBssidValid;
 	u8	MBssidMask;
 	u8	MBssid[ETH_ALEN];

From adf5dbd7e5e986f218760a820d70044dab723f7d Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 7 Apr 2021 12:04:22 +0200
Subject: [PATCH 1804/2658] Linux 4.4.265

Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Link: https://lore.kernel.org/r/20210405085017.012074144@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index e2feb2e1626e..c4e3ad429089 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 264
+SUBLEVEL = 265
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From d265b204ef3c2f6b195bc3e94ef8e23504604437 Mon Sep 17 00:00:00 2001
From: Pavel Andrianov <andrianov@ispras.ru>
Date: Wed, 10 Mar 2021 11:10:46 +0300
Subject: [PATCH 1805/2658] net: pxa168_eth: Fix a potential data race in
 pxa168_eth_remove

[ Upstream commit 0571a753cb07982cc82f4a5115e0b321da89e1f3 ]

pxa168_eth_remove() firstly calls unregister_netdev(),
then cancels a timeout work. unregister_netdev() shuts down a device
interface and removes it from the kernel tables. If the timeout occurs
in parallel, the timeout work (pxa168_eth_tx_timeout_task) performs stop
and open of the device. It may lead to an inconsistent state and memory
leaks.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Pavel Andrianov <andrianov@ispras.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/pxa168_eth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/pxa168_eth.c b/drivers/net/ethernet/marvell/pxa168_eth.c
index 7ace07dad6a3..9986f88618bd 100644
--- a/drivers/net/ethernet/marvell/pxa168_eth.c
+++ b/drivers/net/ethernet/marvell/pxa168_eth.c
@@ -1577,8 +1577,8 @@ static int pxa168_eth_remove(struct platform_device *pdev)
 
 	mdiobus_unregister(pep->smi_bus);
 	mdiobus_free(pep->smi_bus);
-	unregister_netdev(dev);
 	cancel_work_sync(&pep->tx_timeout_task);
+	unregister_netdev(dev);
 	free_netdev(dev);
 	return 0;
 }

From 856d15575be7cf5d300f4df1f556ae7ac0cf189a Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Wed, 10 Mar 2021 23:27:35 -0500
Subject: [PATCH 1806/2658] mISDN: fix crash in fritzpci

[ Upstream commit a9f81244d2e33e6dfcef120fefd30c96b3f7cdb0 ]

setup_fritz() in avmfritz.c might fail with -EIO and in this case the
isac.type and isac.write_reg is not initialized and remains 0(NULL).
A subsequent call to isac_release() will dereference isac->write_reg and
crash.

[    1.737444] BUG: kernel NULL pointer dereference, address: 0000000000000000
[    1.737809] #PF: supervisor instruction fetch in kernel mode
[    1.738106] #PF: error_code(0x0010) - not-present page
[    1.738378] PGD 0 P4D 0
[    1.738515] Oops: 0010 [#1] SMP NOPTI
[    1.738711] CPU: 0 PID: 180 Comm: systemd-udevd Not tainted 5.12.0-rc2+ #78
[    1.739077] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd9c812dda519-p
rebuilt.qemu.org 04/01/2014
[    1.739664] RIP: 0010:0x0
[    1.739807] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
[    1.740200] RSP: 0018:ffffc9000027ba10 EFLAGS: 00010202
[    1.740478] RAX: 0000000000000000 RBX: ffff888102f41840 RCX: 0000000000000027
[    1.740853] RDX: 00000000000000ff RSI: 0000000000000020 RDI: ffff888102f41800
[    1.741226] RBP: ffffc9000027ba20 R08: ffff88817bc18440 R09: ffffc9000027b808
[    1.741600] R10: 0000000000000001 R11: 0000000000000001 R12: ffff888102f41840
[    1.741976] R13: 00000000fffffffb R14: ffff888102f41800 R15: ffff8881008b0000
[    1.742351] FS:  00007fda3a38a8c0(0000) GS:ffff88817bc00000(0000) knlGS:0000000000000000
[    1.742774] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    1.743076] CR2: ffffffffffffffd6 CR3: 00000001021ec000 CR4: 00000000000006f0
[    1.743452] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    1.743828] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[    1.744206] Call Trace:
[    1.744339]  isac_release+0xcc/0xe0 [mISDNipac]
[    1.744582]  fritzpci_probe.cold+0x282/0x739 [avmfritz]
[    1.744861]  local_pci_probe+0x48/0x80
[    1.745063]  pci_device_probe+0x10f/0x1c0
[    1.745278]  really_probe+0xfb/0x420
[    1.745471]  driver_probe_device+0xe9/0x160
[    1.745693]  device_driver_attach+0x5d/0x70
[    1.745917]  __driver_attach+0x8f/0x150
[    1.746123]  ? device_driver_attach+0x70/0x70
[    1.746354]  bus_for_each_dev+0x7e/0xc0
[    1.746560]  driver_attach+0x1e/0x20
[    1.746751]  bus_add_driver+0x152/0x1f0
[    1.746957]  driver_register+0x74/0xd0
[    1.747157]  ? 0xffffffffc00d8000
[    1.747334]  __pci_register_driver+0x54/0x60
[    1.747562]  AVM_init+0x36/0x1000 [avmfritz]
[    1.747791]  do_one_initcall+0x48/0x1d0
[    1.747997]  ? __cond_resched+0x19/0x30
[    1.748206]  ? kmem_cache_alloc_trace+0x390/0x440
[    1.748458]  ? do_init_module+0x28/0x250
[    1.748669]  do_init_module+0x62/0x250
[    1.748870]  load_module+0x23ee/0x26a0
[    1.749073]  __do_sys_finit_module+0xc2/0x120
[    1.749307]  ? __do_sys_finit_module+0xc2/0x120
[    1.749549]  __x64_sys_finit_module+0x1a/0x20
[    1.749782]  do_syscall_64+0x38/0x90

Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/isdn/hardware/mISDN/mISDNipac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/isdn/hardware/mISDN/mISDNipac.c b/drivers/isdn/hardware/mISDN/mISDNipac.c
index cb428b9ee441..b4639b0aab3c 100644
--- a/drivers/isdn/hardware/mISDN/mISDNipac.c
+++ b/drivers/isdn/hardware/mISDN/mISDNipac.c
@@ -709,7 +709,7 @@ isac_release(struct isac_hw *isac)
 {
 	if (isac->type & IPAC_TYPE_ISACX)
 		WriteISAC(isac, ISACX_MASK, 0xff);
-	else
+	else if (isac->type != 0)
 		WriteISAC(isac, ISAC_MASK, 0xff);
 	if (isac->dch.timer.function != NULL) {
 		del_timer(&isac->dch.timer);

From 83ff6248b06146b7fcea64e6a8eb7b6af9b9d6c7 Mon Sep 17 00:00:00 2001
From: Karthikeyan Kathirvel <kathirve@codeaurora.org>
Date: Thu, 11 Mar 2021 10:59:07 +0530
Subject: [PATCH 1807/2658] mac80211: choose first enabled channel for monitor

[ Upstream commit 041c881a0ba8a75f71118bd9766b78f04beed469 ]

Even if the first channel from sband channel list is invalid
or disabled mac80211 ends up choosing it as the default channel
for monitor interfaces, making them not usable.

Fix this by assigning the first available valid or enabled
channel instead.

Signed-off-by: Karthikeyan Kathirvel <kathirve@codeaurora.org>
Link: https://lore.kernel.org/r/1615440547-7661-1-git-send-email-kathirve@codeaurora.org
[reword commit message, comment, code cleanups]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/main.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 15d23aeea634..2357b17254e7 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -889,8 +889,19 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 			continue;
 
 		if (!dflt_chandef.chan) {
+			/*
+			 * Assign the first enabled channel to dflt_chandef
+			 * from the list of channels
+			 */
+			for (i = 0; i < sband->n_channels; i++)
+				if (!(sband->channels[i].flags &
+						IEEE80211_CHAN_DISABLED))
+					break;
+			/* if none found then use the first anyway */
+			if (i == sband->n_channels)
+				i = 0;
 			cfg80211_chandef_create(&dflt_chandef,
-						&sband->channels[0],
+						&sband->channels[i],
 						NL80211_CHAN_NO_HT);
 			/* init channel we're on */
 			if (!local->use_chanctx && !local->_oper_chandef.chan) {

From 6d94e284ba9ac828796f2fbe101069e9f679f22d Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Tue, 23 Mar 2021 13:48:36 +0100
Subject: [PATCH 1808/2658] x86/build: Turn off -fcf-protection for realmode
 targets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 9fcb51c14da2953de585c5c6e50697b8a6e91a7b ]

The new Ubuntu GCC packages turn on -fcf-protection globally,
which causes a build failure in the x86 realmode code:

  cc1: error: ‘-fcf-protection’ is not compatible with this target

Turn it off explicitly on compilers that understand this option.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/20210323124846.1584944-1-arnd@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index de3a452906c6..07673d987c2c 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -34,7 +34,7 @@ REALMODE_CFLAGS	:= $(M16_CFLAGS) -g -Os -D__KERNEL__ \
 		   -DDISABLE_BRANCH_PROFILING \
 		   -Wall -Wstrict-prototypes -march=i386 -mregparm=3 \
 		   -fno-strict-aliasing -fomit-frame-pointer -fno-pic \
-		   -mno-mmx -mno-sse
+		   -mno-mmx -mno-sse $(call cc-option,-fcf-protection=none)
 
 REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -ffreestanding)
 REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -fno-stack-protector)

From bba738f46d2094791be5867396f84f81a27b7c07 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyfox@gentoo.org>
Date: Wed, 24 Mar 2021 21:37:38 -0700
Subject: [PATCH 1809/2658] ia64: mca: allocate early mca with GFP_ATOMIC

[ Upstream commit f2a419cf495f95cac49ea289318b833477e1a0e2 ]

The sleep warning happens at early boot right at secondary CPU
activation bootup:

    smp: Bringing up secondary CPUs ...
    BUG: sleeping function called from invalid context at mm/page_alloc.c:4942
    in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1
    CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.12.0-rc2-00007-g79e228d0b611-dirty #99
    ..
    Call Trace:
      show_stack+0x90/0xc0
      dump_stack+0x150/0x1c0
      ___might_sleep+0x1c0/0x2a0
      __might_sleep+0xa0/0x160
      __alloc_pages_nodemask+0x1a0/0x600
      alloc_page_interleave+0x30/0x1c0
      alloc_pages_current+0x2c0/0x340
      __get_free_pages+0x30/0xa0
      ia64_mca_cpu_init+0x2d0/0x3a0
      cpu_init+0x8b0/0x1440
      start_secondary+0x60/0x700
      start_ap+0x750/0x780
    Fixed BSP b0 value from CPU 1

As I understand interrupts are not enabled yet and system has a lot of
memory.  There is little chance to sleep and switch to GFP_ATOMIC should
be a no-op.

Link: https://lkml.kernel.org/r/20210315085045.204414-1-slyfox@gentoo.org
Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/ia64/kernel/mca.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/ia64/kernel/mca.c b/arch/ia64/kernel/mca.c
index 2889412e03eb..0d5b64ddcdd1 100644
--- a/arch/ia64/kernel/mca.c
+++ b/arch/ia64/kernel/mca.c
@@ -1858,7 +1858,7 @@ ia64_mca_cpu_init(void *cpu_data)
 			data = mca_bootmem();
 			first_time = 0;
 		} else
-			data = (void *)__get_free_pages(GFP_KERNEL,
+			data = (void *)__get_free_pages(GFP_ATOMIC,
 							get_order(sz));
 		if (!data)
 			panic("Could not allocate MCA memory for cpu %d\n",

From e686fc13325f62223482a8bee9e7a006630a11a2 Mon Sep 17 00:00:00 2001
From: Ronnie Sahlberg <lsahlber@redhat.com>
Date: Thu, 25 Mar 2021 16:26:35 +1000
Subject: [PATCH 1810/2658] cifs: revalidate mapping when we open files for
 SMB1 POSIX

[ Upstream commit cee8f4f6fcabfdf229542926128e9874d19016d5 ]

RHBZ: 1933527

Under SMB1 + POSIX, if an inode is reused on a server after we have read and
cached a part of a file, when we then open the new file with the
re-cycled inode there is a chance that we may serve the old data out of cache
to the application.
This only happens for SMB1 (deprecated) and when posix are used.
The simplest solution to avoid this race is to force a revalidate
on smb1-posix open.

Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/file.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index b5a05092f862..5bc617cb7721 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -163,6 +163,7 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
 			goto posix_open_ret;
 		}
 	} else {
+		cifs_revalidate_mapping(*pinode);
 		cifs_fattr_to_inode(*pinode, &fattr);
 	}
 

From b12db858e6c7a5b782221f22d19817ac014432f3 Mon Sep 17 00:00:00 2001
From: Vincent Whitchurch <vincent.whitchurch@axis.com>
Date: Fri, 19 Mar 2021 14:57:11 +0100
Subject: [PATCH 1811/2658] cifs: Silently ignore unknown oplock break handle

[ Upstream commit 219481a8f90ec3a5eed9638fb35609e4b1aeece7 ]

Make SMB2 not print out an error when an oplock break is received for an
unknown handle, similar to SMB1.  The debug message which is printed for
these unknown handles may also be misleading, so fix that too.

The SMB2 lease break path is not affected by this patch.

Without this, a program which writes to a file from one thread, and
opens, reads, and writes the same file from another thread triggers the
below errors several times a minute when run against a Samba server
configured with "smb2 leases = no".

 CIFS: VFS: \\192.168.0.1 No task to wake, unknown frame received! NumMids 2
 00000000: 424d53fe 00000040 00000000 00000012  .SMB@...........
 00000010: 00000001 00000000 ffffffff ffffffff  ................
 00000020: 00000000 00000000 00000000 00000000  ................
 00000030: 00000000 00000000 00000000 00000000  ................

Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
Reviewed-by: Tom Talpey <tom@talpey.com>
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/smb2misc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index 44198b9a5315..19baeb4ca511 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -633,8 +633,8 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
 		}
 	}
 	spin_unlock(&cifs_tcp_ses_lock);
-	cifs_dbg(FYI, "Can not process oplock break for non-existent connection\n");
-	return false;
+	cifs_dbg(FYI, "No file id matched, oplock break ignored\n");
+	return true;
 }
 
 void

From 36104e7e01248ad93fcc8f28ca412a6773d31d1f Mon Sep 17 00:00:00 2001
From: Piotr Krysiuk <piotras@gmail.com>
Date: Mon, 5 Apr 2021 22:52:15 +0100
Subject: [PATCH 1812/2658] bpf, x86: Validate computation of branch
 displacements for x86-64

commit e4d4d456436bfb2fe412ee2cd489f7658449b098 upstream.

The branch displacement logic in the BPF JIT compilers for x86 assumes
that, for any generated branch instruction, the distance cannot
increase between optimization passes.

But this assumption can be violated due to how the distances are
computed. Specifically, whenever a backward branch is processed in
do_jit(), the distance is computed by subtracting the positions in the
machine code from different optimization passes. This is because part
of addrs[] is already updated for the current optimization pass, before
the branch instruction is visited.

And so the optimizer can expand blocks of machine code in some cases.

This can confuse the optimizer logic, where it assumes that a fixed
point has been reached for all machine code blocks once the total
program size stops changing. And then the JIT compiler can output
abnormal machine code containing incorrect branch displacements.

To mitigate this issue, we assert that a fixed point is reached while
populating the output image. This rejects any problematic programs.
The issue affects both x86-32 and x86-64. We mitigate separately to
ease backporting.

Signed-off-by: Piotr Krysiuk <piotras@gmail.com>
Reviewed-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/net/bpf_jit_comp.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index bea13c35979e..82f8cd0a3af9 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -1038,7 +1038,16 @@ xadd:			if (is_imm8(insn->off))
 		}
 
 		if (image) {
-			if (unlikely(proglen + ilen > oldproglen)) {
+			/*
+			 * When populating the image, assert that:
+			 *
+			 *  i) We do not write beyond the allocated space, and
+			 * ii) addrs[i] did not change from the prior run, in order
+			 *     to validate assumptions made for computing branch
+			 *     displacements.
+			 */
+			if (unlikely(proglen + ilen > oldproglen ||
+				     proglen + ilen != addrs[i])) {
 				pr_err("bpf_jit_compile fatal error\n");
 				return -EFAULT;
 			}

From 173963566d0fbefeee99b568ea13f1bc3bd8dc62 Mon Sep 17 00:00:00 2001
From: "Shih-Yuan Lee (FourDollars)" <sylee@canonical.com>
Date: Mon, 14 Aug 2017 18:00:47 +0800
Subject: [PATCH 1813/2658] ALSA: hda/realtek - Fix pincfg for Dell XPS 13 9370

commit 8df4b0031067758d8b0a3bfde7d35e980d0376d5 upstream

The initial pin configs for Dell headset mode of ALC3271 has changed.

/sys/class/sound/hwC0D0/init_pin_configs: (BIOS 0.1.4)
0x12 0xb7a60130
0x13 0xb8a61140
0x14 0x40000000
0x16 0x411111f0
0x17 0x90170110
0x18 0x411111f0
0x19 0x411111f0
0x1a 0x411111f0
0x1b 0x411111f0
0x1d 0x4087992d
0x1e 0x411111f0
0x21 0x04211020

has changed to ...

/sys/class/sound/hwC0D0/init_pin_configs: (BIOS 0.2.0)
0x12 0xb7a60130
0x13 0x40000000
0x14 0x411111f0
0x16 0x411111f0
0x17 0x90170110
0x18 0x411111f0
0x19 0x411111f0
0x1a 0x411111f0
0x1b 0x411111f0
0x1d 0x4067992d
0x1e 0x411111f0
0x21 0x04211020

Fixes: b4576de87243 ("ALSA: hda/realtek - Fix typo of pincfg for Dell quirk")
Signed-off-by: Shih-Yuan Lee (FourDollars) <sylee@canonical.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 4bfe06650277..51163309c875 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6212,7 +6212,6 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
 	SND_HDA_PIN_QUIRK(0x10ec0299, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
 		ALC225_STANDARD_PINS,
 		{0x12, 0xb7a60130},
-		{0x13, 0xb8a61140},
 		{0x17, 0x90170110}),
 	{}
 };

From f18e2e868db188179d4c16affc22fcd48f00fb05 Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Tue, 19 May 2020 15:00:29 +0200
Subject: [PATCH 1814/2658] mtd: rawnand: tmio: Fix the probe error path

commit 75e9a330a9bd48f97a55a08000236084fe3dae56 upstream

nand_release() is supposed be called after MTD device registration.
Here, only nand_scan() happened, so use nand_cleanup() instead.

There is no real Fixes tag applying here as the use of nand_release()
in this driver predates by far the introduction of nand_cleanup() in
commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
which makes this change possible. However, pointing this commit as the
culprit for backporting purposes makes sense even if this commit is not
introducing any bug.

Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-57-miquel.raynal@bootlin.com
[sudip: manual backport to old file]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/tmio_nand.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/tmio_nand.c b/drivers/mtd/nand/tmio_nand.c
index befddf0776e4..d8c6c09917ad 100644
--- a/drivers/mtd/nand/tmio_nand.c
+++ b/drivers/mtd/nand/tmio_nand.c
@@ -445,7 +445,7 @@ static int tmio_probe(struct platform_device *dev)
 	if (!retval)
 		return retval;
 
-	nand_release(mtd);
+	nand_cleanup(nand_chip);
 
 err_irq:
 	tmio_hw_stop(dev, tmio);

From 780f45210fc080eb85da533155b09f22e878d24d Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Tue, 19 May 2020 15:00:23 +0200
Subject: [PATCH 1815/2658] mtd: rawnand: socrates: Fix the probe error path

commit 9c6c2e5cc77119ce0dacb4f9feedb73ce0354421 upstream

nand_release() is supposed be called after MTD device registration.
Here, only nand_scan() happened, so use nand_cleanup() instead.

There is no real Fixes tag applying here as the use of nand_release()
in this driver predates by far the introduction of nand_cleanup() in
commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
which makes this change possible. However, pointing this commit as the
culprit for backporting purposes makes sense even if this commit is not
introducing any bug.

Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-51-miquel.raynal@bootlin.com
[sudip: manual backport to old file]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/socrates_nand.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/socrates_nand.c b/drivers/mtd/nand/socrates_nand.c
index b94f53427f0f..8775111837f4 100644
--- a/drivers/mtd/nand/socrates_nand.c
+++ b/drivers/mtd/nand/socrates_nand.c
@@ -204,7 +204,7 @@ static int socrates_nand_probe(struct platform_device *ofdev)
 	if (!res)
 		return res;
 
-	nand_release(mtd);
+	nand_cleanup(nand_chip);
 
 out:
 	iounmap(host->io_base);

From ccadc6da9e93a311d1bd9cf800496a8b65b3c9f2 Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Tue, 19 May 2020 15:00:21 +0200
Subject: [PATCH 1816/2658] mtd: rawnand: sharpsl: Fix the probe error path

commit 0f44b3275b3798ccb97a2f51ac85871c30d6fbbc upstream

nand_release() is supposed be called after MTD device registration.
Here, only nand_scan() happened, so use nand_cleanup() instead.

There is no Fixes tag applying here as the use of nand_release()
in this driver predates by far the introduction of nand_cleanup() in
commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
which makes this change possible. However, pointing this commit as the
culprit for backporting purposes makes sense.

Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-49-miquel.raynal@bootlin.com
[sudip: manual backport to old file]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/sharpsl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/sharpsl.c b/drivers/mtd/nand/sharpsl.c
index 082b6009736d..42b2a8d90d33 100644
--- a/drivers/mtd/nand/sharpsl.c
+++ b/drivers/mtd/nand/sharpsl.c
@@ -189,7 +189,7 @@ static int sharpsl_nand_probe(struct platform_device *pdev)
 	return 0;
 
 err_add:
-	nand_release(&sharpsl->mtd);
+	nand_cleanup(this);
 
 err_scan:
 	iounmap(sharpsl->io);

From a981c273037f1128e602a57642280a99453aacc6 Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Tue, 19 May 2020 15:00:15 +0200
Subject: [PATCH 1817/2658] mtd: rawnand: plat_nand: Fix the probe error path

commit 5284024b4dac5e94f7f374ca905c7580dbc455e9 upstream

nand_release() is supposed be called after MTD device registration.
Here, only nand_scan() happened, so use nand_cleanup() instead.

There is no real Fixes tag applying here as the use of nand_release()
in this driver predates by far the introduction of nand_cleanup() in
commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
which makes this change possible, hence pointing it as the commit to
fix for backporting purposes, even if this commit is not introducing
any bug.

Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-43-miquel.raynal@bootlin.com
[sudip: manual backport to old file]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/plat_nand.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/plat_nand.c b/drivers/mtd/nand/plat_nand.c
index 65b9dbbe6d6a..89c4a19b1740 100644
--- a/drivers/mtd/nand/plat_nand.c
+++ b/drivers/mtd/nand/plat_nand.c
@@ -102,7 +102,7 @@ static int plat_nand_probe(struct platform_device *pdev)
 	if (!err)
 		return err;
 
-	nand_release(&data->mtd);
+	nand_cleanup(&data->chip);
 out:
 	if (pdata->ctrl.remove)
 		pdata->ctrl.remove(pdev);

From 5c824ba36a10420e6f515aa7a0dacd47ad4981e9 Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Tue, 19 May 2020 15:00:13 +0200
Subject: [PATCH 1818/2658] mtd: rawnand: pasemi: Fix the probe error path

commit f51466901c07e6930435d30b02a21f0841174f61 upstream

nand_cleanup() is supposed to be called on error after a successful
call to nand_scan() to free all NAND resources.

There is no real Fixes tag applying here as the use of nand_release()
in this driver predates by far the introduction of nand_cleanup() in
commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
which makes this change possible, hence pointing it as the commit to
fix for backporting purposes, even if this commit is not introducing
any bug.

Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-41-miquel.raynal@bootlin.com
[sudip: manual backport to old file]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/pasemi_nand.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/pasemi_nand.c b/drivers/mtd/nand/pasemi_nand.c
index 83cf021b9651..8d289a882ca7 100644
--- a/drivers/mtd/nand/pasemi_nand.c
+++ b/drivers/mtd/nand/pasemi_nand.c
@@ -167,7 +167,7 @@ static int pasemi_nand_probe(struct platform_device *ofdev)
 	if (mtd_device_register(pasemi_nand_mtd, NULL, 0)) {
 		printk(KERN_ERR "pasemi_nand: Unable to register MTD device\n");
 		err = -ENODEV;
-		goto out_lpc;
+		goto out_cleanup_nand;
 	}
 
 	printk(KERN_INFO "PA Semi NAND flash at %08llx, control at I/O %x\n",
@@ -175,6 +175,8 @@ static int pasemi_nand_probe(struct platform_device *ofdev)
 
 	return 0;
 
+ out_cleanup_nand:
+	nand_cleanup(chip);
  out_lpc:
 	release_region(lpcctl, 4);
  out_ior:

From a63acad46443380fe12f1695623b9c1f7abcb9ea Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Tue, 19 May 2020 15:00:06 +0200
Subject: [PATCH 1819/2658] mtd: rawnand: orion: Fix the probe error path

commit be238fbf78e4c7c586dac235ab967d3e565a4d1a upstream

nand_release() is supposed be called after MTD device registration.
Here, only nand_scan() happened, so use nand_cleanup() instead.

There is no real Fixes tag applying here as the use of nand_release()
in this driver predates by far the introduction of nand_cleanup() in
commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
which makes this change possible. However, pointing this commit as the
culprit for backporting purposes makes sense even if this commit is not
introducing any bug.

Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-34-miquel.raynal@bootlin.com
[sudip: manual backport to old file]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/orion_nand.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/orion_nand.c b/drivers/mtd/nand/orion_nand.c
index ee83749fb1d3..7b4278d50b45 100644
--- a/drivers/mtd/nand/orion_nand.c
+++ b/drivers/mtd/nand/orion_nand.c
@@ -165,7 +165,7 @@ static int __init orion_nand_probe(struct platform_device *pdev)
 	ret = mtd_device_parse_register(mtd, NULL, &ppdata,
 			board->parts, board->nr_parts);
 	if (ret) {
-		nand_release(mtd);
+		nand_cleanup(nc);
 		goto no_dev;
 	}
 

From a0ad588d4a89d1e4231837ad34dc2c6500b459b3 Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Tue, 19 May 2020 14:59:45 +0200
Subject: [PATCH 1820/2658] mtd: rawnand: diskonchip: Fix the probe error path

commit c5be12e45940f1aa1b5dfa04db5d15ad24f7c896 upstream

Not sure nand_cleanup() is the right function to call here but in any
case it is not nand_release(). Indeed, even a comment says that
calling nand_release() is a bit of a hack as there is no MTD device to
unregister. So switch to nand_cleanup() for now and drop this
comment.

There is no Fixes tag applying here as the use of nand_release()
in this driver predates by far the introduction of nand_cleanup() in
commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
which makes this change possible. However, pointing this commit as the
culprit for backporting purposes makes sense even if it did not intruce
any bug.

Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-13-miquel.raynal@bootlin.com
[sudip: manual backport to old file]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/diskonchip.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/mtd/nand/diskonchip.c b/drivers/mtd/nand/diskonchip.c
index 0802158a3f75..557fcf1c21fe 100644
--- a/drivers/mtd/nand/diskonchip.c
+++ b/drivers/mtd/nand/diskonchip.c
@@ -1608,13 +1608,10 @@ static int __init doc_probe(unsigned long physadr)
 		numchips = doc2001_init(mtd);
 
 	if ((ret = nand_scan(mtd, numchips)) || (ret = doc->late_init(mtd))) {
-		/* DBB note: i believe nand_release is necessary here, as
+		/* DBB note: i believe nand_cleanup is necessary here, as
 		   buffers may have been allocated in nand_base.  Check with
 		   Thomas. FIX ME! */
-		/* nand_release will call mtd_device_unregister, but we
-		   haven't yet added it.  This is handled without incident by
-		   mtd_device_unregister, as far as I can tell. */
-		nand_release(mtd);
+		nand_cleanup(nand);
 		kfree(mtd);
 		goto fail;
 	}

From fa0235daab9e55652a6785fdcabb7d3e7ed03212 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Wed, 6 May 2020 10:36:18 -0400
Subject: [PATCH 1821/2658] tracing: Add a vmalloc_sync_mappings() for safe
 measure

commit 11f5efc3ab66284f7aaacc926e9351d658e2577b upstream

x86_64 lazily maps in the vmalloc pages, and the way this works with per_cpu
areas can be complex, to say the least. Mappings may happen at boot up, and
if nothing synchronizes the page tables, those page mappings may not be
synced till they are used. This causes issues for anything that might touch
one of those mappings in the path of the page fault handler. When one of
those unmapped mappings is touched in the page fault handler, it will cause
another page fault, which in turn will cause a page fault, and leave us in
a loop of page faults.

Commit 763802b53a42 ("x86/mm: split vmalloc_sync_all()") split
vmalloc_sync_all() into vmalloc_sync_unmappings() and
vmalloc_sync_mappings(), as on system exit, it did not need to do a full
sync on x86_64 (although it still needed to be done on x86_32). By chance,
the vmalloc_sync_all() would synchronize the page mappings done at boot up
and prevent the per cpu area from being a problem for tracing in the page
fault handler. But when that synchronization in the exit of a task became a
nop, it caused the problem to appear.

Link: https://lore.kernel.org/r/20200429054857.66e8e333@oasis.local.home

Cc: stable@vger.kernel.org
Fixes: 737223fbca3b1 ("tracing: Consolidate buffer allocation code")
Reported-by: "Tzvetomir Stoyanov (VMware)" <tz.stoyanov@gmail.com>
Suggested-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
[sudip: add header]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index c96c22f2af8e..62e1befbad7f 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -26,6 +26,7 @@
 #include <linux/linkage.h>
 #include <linux/uaccess.h>
 #include <linux/kprobes.h>
+#include <linux/vmalloc.h>
 #include <linux/ftrace.h>
 #include <linux/module.h>
 #include <linux/percpu.h>
@@ -6787,6 +6788,19 @@ static int allocate_trace_buffers(struct trace_array *tr, int size)
 	 */
 	allocate_snapshot = false;
 #endif
+
+	/*
+	 * Because of some magic with the way alloc_percpu() works on
+	 * x86_64, we need to synchronize the pgd of all the tables,
+	 * otherwise the trace events that happen in x86_64 page fault
+	 * handlers can't cope with accessing the chance that a
+	 * alloc_percpu()'d memory might be touched in the page fault trace
+	 * event. Oh, and we need to audit all other alloc_percpu() and vmalloc()
+	 * calls in tracing, because something might get triggered within a
+	 * page fault trace event!
+	 */
+	vmalloc_sync_mappings();
+
 	return 0;
 }
 

From f26f7037b612345c2aa8925a19c534465cd25595 Mon Sep 17 00:00:00 2001
From: Richard Weinberger <richard@nod.at>
Date: Tue, 2 Aug 2016 14:03:27 -0700
Subject: [PATCH 1822/2658] init/Kconfig: make COMPILE_TEST depend on !UML

commit bc083a64b6c035135c0f80718f9e9192cc0867c6 upstream.

UML is a bit special since it does not have iomem nor dma.  That means a
lot of drivers will not build if they miss a dependency on HAS_IOMEM.
s390 used to have the same issues but since it gained PCI support UML is
the only stranger.

We are tired of patching dozens of new drivers after every merge window
just to un-break allmod/yesconfig UML builds.  One could argue that a
decent driver has to know on what it depends and therefore a missing
HAS_IOMEM dependency is a clear driver bug.  But the dependency not
obvious and not everyone does UML builds with COMPILE_TEST enabled when
developing a device driver.

A possible solution to make these builds succeed on UML would be
providing stub functions for ioremap() and friends which fail upon
runtime.  Another one is simply disabling COMPILE_TEST for UML.  Since
it is the least hassle and does not force use to fake iomem support
let's do the latter.

Link: http://lkml.kernel.org/r/1466152995-28367-1-git-send-email-richard@nod.at
Signed-off-by: Richard Weinberger <richard@nod.at>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 init/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/init/Kconfig b/init/Kconfig
index ebb210b400d1..a35ebe175720 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -65,6 +65,7 @@ config CROSS_COMPILE
 
 config COMPILE_TEST
 	bool "Compile also drivers which will not load"
+	depends on !UML
 	default n
 	help
 	  Some drivers can be compiled on a different platform than they are

From ce09a8049e0ae1225b7e653f9f85d00e5a893812 Mon Sep 17 00:00:00 2001
From: Heiko Carstens <hca@linux.ibm.com>
Date: Wed, 18 Nov 2020 21:32:33 +0100
Subject: [PATCH 1823/2658] init/Kconfig: make COMPILE_TEST depend on !S390

commit 334ef6ed06fa1a54e35296b77b693bcf6d63ee9e upstream.

While allmodconfig and allyesconfig build for s390 there are also
various bots running compile tests with randconfig, where PCI is
disabled. This reveals that a lot of drivers should actually depend on
HAS_IOMEM.
Adding this to each device driver would be a never ending story,
therefore just disable COMPILE_TEST for s390.

The reasoning is more or less the same as described in
commit bc083a64b6c0 ("init/Kconfig: make COMPILE_TEST depend on !UML").

Reported-by: kernel test robot <lkp@intel.com>
Suggested-by: Arnd Bergmann <arnd@kernel.org>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 init/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/init/Kconfig b/init/Kconfig
index a35ebe175720..90e706d02855 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -65,7 +65,7 @@ config CROSS_COMPILE
 
 config COMPILE_TEST
 	bool "Compile also drivers which will not load"
-	depends on !UML
+	depends on !UML && !S390
 	default n
 	help
 	  Some drivers can be compiled on a different platform than they are

From 190c8c8d9b3a6bac8c877e71fb53098ebf1cecf8 Mon Sep 17 00:00:00 2001
From: Masahiro Yamada <masahiroy@kernel.org>
Date: Fri, 12 Mar 2021 21:07:08 -0800
Subject: [PATCH 1824/2658] init/Kconfig: make COMPILE_TEST depend on HAS_IOMEM

commit ea29b20a828511de3348334e529a3d046a180416 upstream.

I read the commit log of the following two:

- bc083a64b6c0 ("init/Kconfig: make COMPILE_TEST depend on !UML")
- 334ef6ed06fa ("init/Kconfig: make COMPILE_TEST depend on !S390")

Both are talking about HAS_IOMEM dependency missing in many drivers.

So, 'depends on HAS_IOMEM' seems the direct, sensible solution to me.

This does not change the behavior of UML. UML still cannot enable
COMPILE_TEST because it does not provide HAS_IOMEM.

The current dependency for S390 is too strong. Under the condition of
CONFIG_PCI=y, S390 provides HAS_IOMEM, hence can enable COMPILE_TEST.

I also removed the meaningless 'default n'.

Link: https://lkml.kernel.org/r/20210224140809.1067582-1-masahiroy@kernel.org
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Arnd Bergmann <arnd@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: KP Singh <kpsingh@google.com>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Nick Terrell <terrelln@fb.com>
Cc: Quentin Perret <qperret@google.com>
Cc: Valentin Schneider <valentin.schneider@arm.com>
Cc: "Enrico Weigelt, metux IT consult" <lkml@metux.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 init/Kconfig | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/init/Kconfig b/init/Kconfig
index 90e706d02855..3ceb88305d52 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -65,8 +65,7 @@ config CROSS_COMPILE
 
 config COMPILE_TEST
 	bool "Compile also drivers which will not load"
-	depends on !UML && !S390
-	default n
+	depends on HAS_IOMEM
 	help
 	  Some drivers can be compiled on a different platform than they are
 	  intended to be run on. Despite they cannot be loaded there (or even

From 68118e2c06826122d9cf090ad7fec1cdacb927d8 Mon Sep 17 00:00:00 2001
From: Angelo Dureghello <angelo@kernel-space.org>
Date: Tue, 16 Mar 2021 00:15:10 +0100
Subject: [PATCH 1825/2658] can: flexcan: flexcan_chip_freeze(): fix chip
 freeze for missing bitrate

commit 47c5e474bc1e1061fb037d13b5000b38967eb070 upstream.

For cases when flexcan is built-in, bitrate is still not set at
registering. So flexcan_chip_freeze() generates:

[    1.860000] *** ZERO DIVIDE ***   FORMAT=4
[    1.860000] Current process id is 1
[    1.860000] BAD KERNEL TRAP: 00000000
[    1.860000] PC: [<402e70c8>] flexcan_chip_freeze+0x1a/0xa8

To allow chip freeze, using an hardcoded timeout when bitrate is still
not set.

Fixes: ec15e27cc890 ("can: flexcan: enable RX FIFO after FRZ/HALT valid")
Link: https://lore.kernel.org/r/20210315231510.650593-1-angelo@kernel-space.org
Signed-off-by: Angelo Dureghello <angelo@kernel-space.org>
[mkl: use if instead of ? operator]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Cc: Koen Vandeputte <koen.vandeputte@citymesh.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/flexcan.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index b18bb0334ded..dcad5213eb34 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -379,9 +379,15 @@ static int flexcan_chip_disable(struct flexcan_priv *priv)
 static int flexcan_chip_freeze(struct flexcan_priv *priv)
 {
 	struct flexcan_regs __iomem *regs = priv->regs;
-	unsigned int timeout = 1000 * 1000 * 10 / priv->can.bittiming.bitrate;
+	unsigned int timeout;
+	u32 bitrate = priv->can.bittiming.bitrate;
 	u32 reg;
 
+	if (bitrate)
+		timeout = 1000 * 1000 * 10 / bitrate;
+	else
+		timeout = FLEXCAN_TIMEOUT_US / 10;
+
 	reg = flexcan_read(&regs->mcr);
 	reg |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT;
 	flexcan_write(reg, &regs->mcr);

From 081f7bd9c392450d93a24491cddfedde3afec47e Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sat, 10 Apr 2021 13:01:58 +0200
Subject: [PATCH 1826/2658] Linux 4.4.266

Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Link: https://lore.kernel.org/r/20210409095259.957388690@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index c4e3ad429089..ff87b3b36125 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 265
+SUBLEVEL = 266
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 04cfcb12cbbca85f2902c6251f28a2a5f799919c Mon Sep 17 00:00:00 2001
From: Ye Xiang <xiang.ye@intel.com>
Date: Sat, 30 Jan 2021 18:25:30 +0800
Subject: [PATCH 1827/2658] iio: hid-sensor-prox: Fix scale not correct issue

commit d68c592e02f6f49a88e705f13dfc1883432cf300 upstream

Currently, the proxy sensor scale is zero because it just return the
exponent directly. To fix this issue, this patch use
hid_sensor_format_scale to process the scale first then return the
output.

Fixes: 39a3a0138f61 ("iio: hid-sensors: Added Proximity Sensor Driver")
Signed-off-by: Ye Xiang <xiang.ye@intel.com>
Link: https://lore.kernel.org/r/20210130102530.31064-1-xiang.ye@intel.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/light/hid-sensor-prox.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/light/hid-sensor-prox.c b/drivers/iio/light/hid-sensor-prox.c
index 45ca056f019e..63041dcec7af 100644
--- a/drivers/iio/light/hid-sensor-prox.c
+++ b/drivers/iio/light/hid-sensor-prox.c
@@ -37,6 +37,9 @@ struct prox_state {
 	struct hid_sensor_common common_attributes;
 	struct hid_sensor_hub_attribute_info prox_attr;
 	u32 human_presence;
+	int scale_pre_decml;
+	int scale_post_decml;
+	int scale_precision;
 };
 
 /* Channel definitions */
@@ -105,8 +108,9 @@ static int prox_read_raw(struct iio_dev *indio_dev,
 		ret_type = IIO_VAL_INT;
 		break;
 	case IIO_CHAN_INFO_SCALE:
-		*val = prox_state->prox_attr.units;
-		ret_type = IIO_VAL_INT;
+		*val = prox_state->scale_pre_decml;
+		*val2 = prox_state->scale_post_decml;
+		ret_type = prox_state->scale_precision;
 		break;
 	case IIO_CHAN_INFO_OFFSET:
 		*val = hid_sensor_convert_exponent(
@@ -240,6 +244,12 @@ static int prox_parse_report(struct platform_device *pdev,
 			st->common_attributes.sensitivity.index,
 			st->common_attributes.sensitivity.report_id);
 	}
+
+	st->scale_precision = hid_sensor_format_scale(
+				hsdev->usage,
+				&st->prox_attr,
+				&st->scale_pre_decml, &st->scale_post_decml);
+
 	return ret;
 }
 

From 406bdc1dde5cb3b3cdbe3760f5d5629f35592f07 Mon Sep 17 00:00:00 2001
From: Jonas Holmberg <jonashg@axis.com>
Date: Wed, 7 Apr 2021 09:54:28 +0200
Subject: [PATCH 1828/2658] ALSA: aloop: Fix initialization of controls

commit 168632a495f49f33a18c2d502fc249d7610375e9 upstream.

Add a control to the card before copying the id so that the numid field
is initialized in the copy. Otherwise the numid field of active_id,
format_id, rate_id and channels_id will be the same (0) and
snd_ctl_notify() will not queue the events properly.

Signed-off-by: Jonas Holmberg <jonashg@axis.com>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210407075428.2666787-1-jonashg@axis.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/drivers/aloop.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
index 847f70348d4d..cc600aa0f6c7 100644
--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -1062,6 +1062,14 @@ static int loopback_mixer_new(struct loopback *loopback, int notify)
 					return -ENOMEM;
 				kctl->id.device = dev;
 				kctl->id.subdevice = substr;
+
+				/* Add the control before copying the id so that
+				 * the numid field of the id is set in the copy.
+				 */
+				err = snd_ctl_add(card, kctl);
+				if (err < 0)
+					return err;
+
 				switch (idx) {
 				case ACTIVE_IDX:
 					setup->active_id = kctl->id;
@@ -1078,9 +1086,6 @@ static int loopback_mixer_new(struct loopback *loopback, int notify)
 				default:
 					break;
 				}
-				err = snd_ctl_add(card, kctl);
-				if (err < 0)
-					return err;
 			}
 		}
 	}

From ac6005374d8a236f1903dd04bbcb12bb1352bb0c Mon Sep 17 00:00:00 2001
From: Xiaoming Ni <nixiaoming@huawei.com>
Date: Thu, 25 Mar 2021 11:51:10 +0800
Subject: [PATCH 1829/2658] nfc: fix refcount leak in llcp_sock_bind()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit c33b1cc62ac05c1dbb1cdafe2eb66da01c76ca8d upstream.

nfc_llcp_local_get() is invoked in llcp_sock_bind(),
but nfc_llcp_local_put() is not invoked in subsequent failure branches.
As a result, refcount leakage occurs.
To fix it, add calling nfc_llcp_local_put().

fix CVE-2020-25670
Fixes: c7aa12252f51 ("NFC: Take a reference on the LLCP local pointer when creating a socket")
Reported-by: "kiyin(尹亮)" <kiyin@tencent.com>
Link: https://www.openwall.com/lists/oss-security/2020/11/01/1
Cc: <stable@vger.kernel.org> #v3.6
Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/nfc/llcp_sock.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index 44d6b8355eab..2c5dbb797c77 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -119,11 +119,13 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
 					  llcp_sock->service_name_len,
 					  GFP_KERNEL);
 	if (!llcp_sock->service_name) {
+		nfc_llcp_local_put(llcp_sock->local);
 		ret = -ENOMEM;
 		goto put_dev;
 	}
 	llcp_sock->ssap = nfc_llcp_get_sdp_ssap(local, llcp_sock);
 	if (llcp_sock->ssap == LLCP_SAP_MAX) {
+		nfc_llcp_local_put(llcp_sock->local);
 		kfree(llcp_sock->service_name);
 		llcp_sock->service_name = NULL;
 		ret = -EADDRINUSE;

From 0c2ab2c85fdd268926ea663e85b49e1d1f7332df Mon Sep 17 00:00:00 2001
From: Xiaoming Ni <nixiaoming@huawei.com>
Date: Thu, 25 Mar 2021 11:51:11 +0800
Subject: [PATCH 1830/2658] nfc: fix refcount leak in llcp_sock_connect()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 8a4cd82d62b5ec7e5482333a72b58a4eea4979f0 upstream.

nfc_llcp_local_get() is invoked in llcp_sock_connect(),
but nfc_llcp_local_put() is not invoked in subsequent failure branches.
As a result, refcount leakage occurs.
To fix it, add calling nfc_llcp_local_put().

fix CVE-2020-25671
Fixes: c7aa12252f51 ("NFC: Take a reference on the LLCP local pointer when creating a socket")
Reported-by: "kiyin(尹亮)" <kiyin@tencent.com>
Link: https://www.openwall.com/lists/oss-security/2020/11/01/1
Cc: <stable@vger.kernel.org> #v3.6
Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/nfc/llcp_sock.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index 2c5dbb797c77..79ca5e60dc94 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -710,6 +710,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
 	llcp_sock->local = nfc_llcp_local_get(local);
 	llcp_sock->ssap = nfc_llcp_get_local_ssap(local);
 	if (llcp_sock->ssap == LLCP_SAP_MAX) {
+		nfc_llcp_local_put(llcp_sock->local);
 		ret = -ENOMEM;
 		goto put_dev;
 	}
@@ -747,6 +748,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
 
 sock_unlink:
 	nfc_llcp_put_ssap(local, llcp_sock->ssap);
+	nfc_llcp_local_put(llcp_sock->local);
 
 	nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
 

From de188202a9a6c2cba5f30935506776301194f82d Mon Sep 17 00:00:00 2001
From: Xiaoming Ni <nixiaoming@huawei.com>
Date: Thu, 25 Mar 2021 11:51:12 +0800
Subject: [PATCH 1831/2658] nfc: fix memory leak in llcp_sock_connect()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 7574fcdbdcb335763b6b322f6928dc0fd5730451 upstream.

In llcp_sock_connect(), use kmemdup to allocate memory for
 "llcp_sock->service_name". The memory is not released in the sock_unlink
label of the subsequent failure branch.
As a result, memory leakage occurs.

fix CVE-2020-25672

Fixes: d646960f7986 ("NFC: Initial LLCP support")
Reported-by: "kiyin(尹亮)" <kiyin@tencent.com>
Link: https://www.openwall.com/lists/oss-security/2020/11/01/1
Cc: <stable@vger.kernel.org> #v3.3
Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/nfc/llcp_sock.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index 79ca5e60dc94..763259397544 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -751,6 +751,8 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
 	nfc_llcp_local_put(llcp_sock->local);
 
 	nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
+	kfree(llcp_sock->service_name);
+	llcp_sock->service_name = NULL;
 
 put_dev:
 	nfc_put_device(dev);

From 49df7b72843dc7eefc2e866b5aa4997ed138a77b Mon Sep 17 00:00:00 2001
From: Xiaoming Ni <nixiaoming@huawei.com>
Date: Thu, 25 Mar 2021 11:51:13 +0800
Subject: [PATCH 1832/2658] nfc: Avoid endless loops caused by repeated
 llcp_sock_connect()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 4b5db93e7f2afbdfe3b78e37879a85290187e6f1 upstream.

When sock_wait_state() returns -EINPROGRESS, "sk->sk_state" is
 LLCP_CONNECTING. In this case, llcp_sock_connect() is repeatedly invoked,
 nfc_llcp_sock_link() will add sk to local->connecting_sockets twice.
 sk->sk_node->next will point to itself, that will make an endless loop
 and hang-up the system.
To fix it, check whether sk->sk_state is LLCP_CONNECTING in
 llcp_sock_connect() to avoid repeated invoking.

Fixes: b4011239a08e ("NFC: llcp: Fix non blocking sockets connections")
Reported-by: "kiyin(尹亮)" <kiyin@tencent.com>
Link: https://www.openwall.com/lists/oss-security/2020/11/01/1
Cc: <stable@vger.kernel.org> #v3.11
Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/nfc/llcp_sock.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index 763259397544..2f8d38d0802a 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -679,6 +679,10 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
 		ret = -EISCONN;
 		goto error;
 	}
+	if (sk->sk_state == LLCP_CONNECTING) {
+		ret = -EINPROGRESS;
+		goto error;
+	}
 
 	dev = nfc_get_device(addr->dev_idx);
 	if (dev == NULL) {

From 7fb42009075d4361110c81b5a5177169280fdedd Mon Sep 17 00:00:00 2001
From: Luca Fancellu <luca.fancellu@arm.com>
Date: Tue, 6 Apr 2021 11:51:04 +0100
Subject: [PATCH 1833/2658] xen/evtchn: Change irq_info lock to raw_spinlock_t

commit d120198bd5ff1d41808b6914e1eb89aff937415c upstream.

Unmask operation must be called with interrupt disabled,
on preempt_rt spin_lock_irqsave/spin_unlock_irqrestore
don't disable/enable interrupts, so use raw_* implementation
and change lock variable in struct irq_info from spinlock_t
to raw_spinlock_t

Cc: stable@vger.kernel.org
Fixes: 25da4618af24 ("xen/events: don't unmask an event channel when an eoi is pending")
Signed-off-by: Luca Fancellu <luca.fancellu@arm.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
Reviewed-by: Wei Liu <wei.liu@kernel.org>
Link: https://lore.kernel.org/r/20210406105105.10141-1-luca.fancellu@arm.com
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/events/events_base.c     | 10 +++++-----
 drivers/xen/events/events_internal.h |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index d1e68b483595..f38eccb94fb7 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -222,7 +222,7 @@ static int xen_irq_info_common_setup(struct irq_info *info,
 	info->evtchn = evtchn;
 	info->cpu = cpu;
 	info->mask_reason = EVT_MASK_REASON_EXPLICIT;
-	spin_lock_init(&info->lock);
+	raw_spin_lock_init(&info->lock);
 
 	ret = set_evtchn_to_irq(evtchn, irq);
 	if (ret < 0)
@@ -374,28 +374,28 @@ static void do_mask(struct irq_info *info, u8 reason)
 {
 	unsigned long flags;
 
-	spin_lock_irqsave(&info->lock, flags);
+	raw_spin_lock_irqsave(&info->lock, flags);
 
 	if (!info->mask_reason)
 		mask_evtchn(info->evtchn);
 
 	info->mask_reason |= reason;
 
-	spin_unlock_irqrestore(&info->lock, flags);
+	raw_spin_unlock_irqrestore(&info->lock, flags);
 }
 
 static void do_unmask(struct irq_info *info, u8 reason)
 {
 	unsigned long flags;
 
-	spin_lock_irqsave(&info->lock, flags);
+	raw_spin_lock_irqsave(&info->lock, flags);
 
 	info->mask_reason &= ~reason;
 
 	if (!info->mask_reason)
 		unmask_evtchn(info->evtchn);
 
-	spin_unlock_irqrestore(&info->lock, flags);
+	raw_spin_unlock_irqrestore(&info->lock, flags);
 }
 
 #ifdef CONFIG_X86
diff --git a/drivers/xen/events/events_internal.h b/drivers/xen/events/events_internal.h
index 3df6f28b75e6..cc37b711491c 100644
--- a/drivers/xen/events/events_internal.h
+++ b/drivers/xen/events/events_internal.h
@@ -47,7 +47,7 @@ struct irq_info {
 	unsigned short eoi_cpu;	/* EOI must happen on this cpu */
 	unsigned int irq_epoch;	/* If eoi_cpu valid: irq_epoch of event */
 	u64 eoi_time;		/* Time in jiffies when to EOI. */
-	spinlock_t lock;
+	raw_spinlock_t lock;
 
 	union {
 		unsigned short virq;

From 7264a90c13ce352baec81ba987f3207578591f2f Mon Sep 17 00:00:00 2001
From: Muhammad Usama Anjum <musamaanjum@gmail.com>
Date: Fri, 9 Apr 2021 03:01:29 +0500
Subject: [PATCH 1834/2658] net: ipv6: check for validity before dereferencing
 cfg->fc_nlinfo.nlh

commit 864db232dc7036aa2de19749c3d5be0143b24f8f upstream.

nlh is being checked for validtity two times when it is dereferenced in
this function. Check for validity again when updating the flags through
nlh pointer to make the dereferencing safe.

CC: <stable@vger.kernel.org>
Addresses-Coverity: ("NULL pointer dereference")
Signed-off-by: Muhammad Usama Anjum <musamaanjum@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/route.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 37a00550c618..456fbc98320c 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2941,9 +2941,11 @@ static int ip6_route_multipath_add(struct fib6_config *cfg)
 		 * nexthops have been replaced by first new, the rest should
 		 * be added to it.
 		 */
-		cfg->fc_nlinfo.nlh->nlmsg_flags &= ~(NLM_F_EXCL |
-						     NLM_F_REPLACE);
-		cfg->fc_nlinfo.nlh->nlmsg_flags |= NLM_F_CREATE;
+		if (cfg->fc_nlinfo.nlh) {
+			cfg->fc_nlinfo.nlh->nlmsg_flags &= ~(NLM_F_EXCL |
+							     NLM_F_REPLACE);
+			cfg->fc_nlinfo.nlh->nlmsg_flags |= NLM_F_CREATE;
+		}
 		nhn++;
 	}
 

From dbb218c04e34935ae22672ab102d00eea6a193d2 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyfox@gentoo.org>
Date: Fri, 9 Apr 2021 13:27:32 -0700
Subject: [PATCH 1835/2658] ia64: fix user_stack_pointer() for ptrace()

commit 7ad1e366167837daeb93d0bacb57dee820b0b898 upstream.

ia64 has two stacks:

 - memory stack (or stack), pointed at by by r12

 - register backing store (register stack), pointed at by
   ar.bsp/ar.bspstore with complications around dirty
   register frame on CPU.

In [1] Dmitry noticed that PTRACE_GET_SYSCALL_INFO returns the register
stack instead memory stack.

The bug comes from the fact that user_stack_pointer() and
current_user_stack_pointer() don't return the same register:

  ulong user_stack_pointer(struct pt_regs *regs) { return regs->ar_bspstore; }
  #define current_user_stack_pointer() (current_pt_regs()->r12)

The change gets both back in sync.

I think ptrace(PTRACE_GET_SYSCALL_INFO) is the only affected user by
this bug on ia64.

The change fixes 'rt_sigreturn.gen.test' strace test where it was
observed initially.

Link: https://bugs.gentoo.org/769614 [1]
Link: https://lkml.kernel.org/r/20210331084447.2561532-1-slyfox@gentoo.org
Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
Reported-by: Dmitry V. Levin <ldv@altlinux.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/ia64/include/asm/ptrace.h | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/arch/ia64/include/asm/ptrace.h b/arch/ia64/include/asm/ptrace.h
index 845143990a1d..9d3d4fb87a7a 100644
--- a/arch/ia64/include/asm/ptrace.h
+++ b/arch/ia64/include/asm/ptrace.h
@@ -53,8 +53,7 @@
 
 static inline unsigned long user_stack_pointer(struct pt_regs *regs)
 {
-	/* FIXME: should this be bspstore + nr_dirty regs? */
-	return regs->ar_bspstore;
+	return regs->r12;
 }
 
 static inline int is_syscall_success(struct pt_regs *regs)
@@ -78,11 +77,6 @@ static inline long regs_return_value(struct pt_regs *regs)
 	unsigned long __ip = instruction_pointer(regs);			\
 	(__ip & ~3UL) + ((__ip & 3UL) << 2);				\
 })
-/*
- * Why not default?  Because user_stack_pointer() on ia64 gives register
- * stack backing store instead...
- */
-#define current_user_stack_pointer() (current_pt_regs()->r12)
 
   /* given a pointer to a task_struct, return the user's pt_regs */
 # define task_pt_regs(t)		(((struct pt_regs *) ((char *) (t) + IA64_STK_OFFSET)) - 1)

From 22b377a08e14739a11d353e14ed4dc4888e94b77 Mon Sep 17 00:00:00 2001
From: Jack Qiu <jack.qiu@huawei.com>
Date: Fri, 9 Apr 2021 13:27:35 -0700
Subject: [PATCH 1836/2658] fs: direct-io: fix missing sdio->boundary

commit df41872b68601059dd4a84858952dcae58acd331 upstream.

I encountered a hung task issue, but not a performance one.  I run DIO
on a device (need lba continuous, for example open channel ssd), maybe
hungtask in below case:

  DIO:						Checkpoint:
  get addr A(at boundary), merge into BIO,
  no submit because boundary missing
						flush dirty data(get addr A+1), wait IO(A+1)
						writeback timeout, because DIO(A) didn't submit
  get addr A+2 fail, because checkpoint is doing

dio_send_cur_page() may clear sdio->boundary, so prevent it from missing
a boundary.

Link: https://lkml.kernel.org/r/20210322042253.38312-1-jack.qiu@huawei.com
Fixes: b1058b981272 ("direct-io: submit bio after boundary buffer is added to it")
Signed-off-by: Jack Qiu <jack.qiu@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/direct-io.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/direct-io.c b/fs/direct-io.c
index da574a74a467..5afb6e260c84 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -794,6 +794,7 @@ submit_page_section(struct dio *dio, struct dio_submit *sdio, struct page *page,
 		    struct buffer_head *map_bh)
 {
 	int ret = 0;
+	int boundary = sdio->boundary;	/* dio_send_cur_page may clear it */
 
 	if (dio->rw & WRITE) {
 		/*
@@ -832,10 +833,10 @@ submit_page_section(struct dio *dio, struct dio_submit *sdio, struct page *page,
 	sdio->cur_page_fs_offset = sdio->block_in_file << sdio->blkbits;
 out:
 	/*
-	 * If sdio->boundary then we want to schedule the IO now to
+	 * If boundary then we want to schedule the IO now to
 	 * avoid metadata seeks.
 	 */
-	if (sdio->boundary) {
+	if (boundary) {
 		ret = dio_send_cur_page(dio, sdio, map_bh);
 		if (sdio->bio)
 			dio_bio_submit(dio, sdio);

From 88db587bdb2fd492e059b8f7a3b75678ffce0ed0 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Tue, 6 Apr 2021 11:32:52 +0200
Subject: [PATCH 1837/2658] parisc: parisc-agp requires SBA IOMMU driver

commit 9054284e8846b0105aad43a4e7174ca29fffbc44 upstream.

Add a dependency to the SBA IOMMU driver to avoid:
ERROR: modpost: "sba_list" [drivers/char/agp/parisc-agp.ko] undefined!

Reported-by: kernel test robot <lkp@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/char/agp/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/char/agp/Kconfig b/drivers/char/agp/Kconfig
index c528f96ee204..07de755ca30c 100644
--- a/drivers/char/agp/Kconfig
+++ b/drivers/char/agp/Kconfig
@@ -124,7 +124,7 @@ config AGP_HP_ZX1
 
 config AGP_PARISC
 	tristate "HP Quicksilver AGP support"
-	depends on AGP && PARISC && 64BIT
+	depends on AGP && PARISC && 64BIT && IOMMU_SBA
 	help
 	  This option gives you AGP GART support for the HP Quicksilver
 	  AGP bus adapter on HP PA-RISC machines (Ok, just on the C8000

From c17de7f0eea501ceab047dcd90b97f05c4f13659 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date: Mon, 5 Apr 2021 19:16:50 +0900
Subject: [PATCH 1838/2658] batman-adv: initialize "struct
 batadv_tvlv_tt_vlan_data"->reserved field

commit 08c27f3322fec11950b8f1384aa0f3b11d028528 upstream.

KMSAN found uninitialized value at batadv_tt_prepare_tvlv_local_data()
[1], for commit ced72933a5e8ab52 ("batman-adv: use CRC32C instead of CRC16
in TT code") inserted 'reserved' field into "struct batadv_tvlv_tt_data"
and commit 7ea7b4a142758dea ("batman-adv: make the TT CRC logic VLAN
specific") moved that field to "struct batadv_tvlv_tt_vlan_data" but left
that field uninitialized.

[1] https://syzkaller.appspot.com/bug?id=07f3e6dba96f0eb3cabab986adcd8a58b9bdbe9d

Reported-by: syzbot <syzbot+50ee810676e6a089487b@syzkaller.appspotmail.com>
Tested-by: syzbot <syzbot+50ee810676e6a089487b@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: ced72933a5e8ab52 ("batman-adv: use CRC32C instead of CRC16 in TT code")
Fixes: 7ea7b4a142758dea ("batman-adv: make the TT CRC logic VLAN specific")
Acked-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/batman-adv/translation-table.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 06f366d234ff..5f976485e8c6 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -871,6 +871,7 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv,
 
 		tt_vlan->vid = htons(vlan->vid);
 		tt_vlan->crc = htonl(vlan->tt.crc);
+		tt_vlan->reserved = 0;
 
 		tt_vlan++;
 	}

From 6412e7017558068594a8d5d233cddf5bb70e7da9 Mon Sep 17 00:00:00 2001
From: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Date: Thu, 8 Apr 2021 18:14:31 +0300
Subject: [PATCH 1839/2658] net: sched: sch_teql: fix null-pointer dereference

commit 1ffbc7ea91606e4abd10eb60de5367f1c86daf5e upstream.

Reproduce:

  modprobe sch_teql
  tc qdisc add dev teql0 root teql0

This leads to (for instance in Centos 7 VM) OOPS:

[  532.366633] BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8
[  532.366733] IP: [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql]
[  532.366825] PGD 80000001376d5067 PUD 137e37067 PMD 0
[  532.366906] Oops: 0000 [#1] SMP
[  532.366987] Modules linked in: sch_teql ...
[  532.367945] CPU: 1 PID: 3026 Comm: tc Kdump: loaded Tainted: G               ------------ T 3.10.0-1062.7.1.el7.x86_64 #1
[  532.368041] Hardware name: Virtuozzo KVM, BIOS 1.11.0-2.vz7.2 04/01/2014
[  532.368125] task: ffff8b7d37d31070 ti: ffff8b7c9fdbc000 task.ti: ffff8b7c9fdbc000
[  532.368224] RIP: 0010:[<ffffffffc06124a8>]  [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql]
[  532.368320] RSP: 0018:ffff8b7c9fdbf8e0  EFLAGS: 00010286
[  532.368394] RAX: ffffffffc0612490 RBX: ffff8b7cb1565e00 RCX: ffff8b7d35ba2000
[  532.368476] RDX: ffff8b7d35ba2000 RSI: 0000000000000000 RDI: ffff8b7cb1565e00
[  532.368557] RBP: ffff8b7c9fdbf8f8 R08: ffff8b7d3fd1f140 R09: ffff8b7d3b001600
[  532.368638] R10: ffff8b7d3b001600 R11: ffffffff84c7d65b R12: 00000000ffffffd8
[  532.368719] R13: 0000000000008000 R14: ffff8b7d35ba2000 R15: ffff8b7c9fdbf9a8
[  532.368800] FS:  00007f6a4e872740(0000) GS:ffff8b7d3fd00000(0000) knlGS:0000000000000000
[  532.368885] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  532.368961] CR2: 00000000000000a8 CR3: 00000001396ee000 CR4: 00000000000206e0
[  532.369046] Call Trace:
[  532.369159]  [<ffffffff84c8192e>] qdisc_create+0x36e/0x450
[  532.369268]  [<ffffffff846a9b49>] ? ns_capable+0x29/0x50
[  532.369366]  [<ffffffff849afde2>] ? nla_parse+0x32/0x120
[  532.369442]  [<ffffffff84c81b4c>] tc_modify_qdisc+0x13c/0x610
[  532.371508]  [<ffffffff84c693e7>] rtnetlink_rcv_msg+0xa7/0x260
[  532.372668]  [<ffffffff84907b65>] ? sock_has_perm+0x75/0x90
[  532.373790]  [<ffffffff84c69340>] ? rtnl_newlink+0x890/0x890
[  532.374914]  [<ffffffff84c8da7b>] netlink_rcv_skb+0xab/0xc0
[  532.376055]  [<ffffffff84c63708>] rtnetlink_rcv+0x28/0x30
[  532.377204]  [<ffffffff84c8d400>] netlink_unicast+0x170/0x210
[  532.378333]  [<ffffffff84c8d7a8>] netlink_sendmsg+0x308/0x420
[  532.379465]  [<ffffffff84c2f3a6>] sock_sendmsg+0xb6/0xf0
[  532.380710]  [<ffffffffc034a56e>] ? __xfs_filemap_fault+0x8e/0x1d0 [xfs]
[  532.381868]  [<ffffffffc034a75c>] ? xfs_filemap_fault+0x2c/0x30 [xfs]
[  532.383037]  [<ffffffff847ec23a>] ? __do_fault.isra.61+0x8a/0x100
[  532.384144]  [<ffffffff84c30269>] ___sys_sendmsg+0x3e9/0x400
[  532.385268]  [<ffffffff847f3fad>] ? handle_mm_fault+0x39d/0x9b0
[  532.386387]  [<ffffffff84d88678>] ? __do_page_fault+0x238/0x500
[  532.387472]  [<ffffffff84c31921>] __sys_sendmsg+0x51/0x90
[  532.388560]  [<ffffffff84c31972>] SyS_sendmsg+0x12/0x20
[  532.389636]  [<ffffffff84d8dede>] system_call_fastpath+0x25/0x2a
[  532.390704]  [<ffffffff84d8de21>] ? system_call_after_swapgs+0xae/0x146
[  532.391753] Code: 00 00 00 00 00 00 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 41 55 41 54 53 48 8b b7 48 01 00 00 48 89 fb <48> 8b 8e a8 00 00 00 48 85 c9 74 43 48 89 ca eb 0f 0f 1f 80 00
[  532.394036] RIP  [<ffffffffc06124a8>] teql_destroy+0x18/0x100 [sch_teql]
[  532.395127]  RSP <ffff8b7c9fdbf8e0>
[  532.396179] CR2: 00000000000000a8

Null pointer dereference happens on master->slaves dereference in
teql_destroy() as master is null-pointer.

When qdisc_create() calls teql_qdisc_init() it imediately fails after
check "if (m->dev == dev)" because both devices are teql0, and it does
not set qdisc_priv(sch)->m leaving it zero on error path, then
qdisc_create() imediately calls teql_destroy() which does not expect
zero master pointer and we get OOPS.

Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation")
Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/sch_teql.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index e02687185a59..a7ecf626e998 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -138,6 +138,9 @@ teql_destroy(struct Qdisc *sch)
 	struct teql_sched_data *dat = qdisc_priv(sch);
 	struct teql_master *master = dat->m;
 
+	if (!master)
+		return;
+
 	prev = master->slaves;
 	if (prev) {
 		do {

From ddc697a9ca9de6492b72e82837d25c198ef24dc0 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 25 Mar 2021 11:14:53 -0700
Subject: [PATCH 1840/2658] sch_red: fix off-by-one checks in
 red_check_params()

[ Upstream commit 3a87571f0ffc51ba3bf3ecdb6032861d0154b164 ]

This fixes following syzbot report:

UBSAN: shift-out-of-bounds in ./include/net/red.h:237:23
shift exponent 32 is too large for 32-bit type 'unsigned int'
CPU: 1 PID: 8418 Comm: syz-executor170 Not tainted 5.12.0-rc4-next-20210324-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x141/0x1d7 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327
 red_set_parms include/net/red.h:237 [inline]
 choke_change.cold+0x3c/0xc8 net/sched/sch_choke.c:414
 qdisc_create+0x475/0x12f0 net/sched/sch_api.c:1247
 tc_modify_qdisc+0x4c8/0x1a50 net/sched/sch_api.c:1663
 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5553
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502
 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:674
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x43f039
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdfa725168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000400488 RCX: 000000000043f039
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004
RBP: 0000000000403020 R08: 0000000000400488 R09: 0000000000400488
R10: 0000000000400488 R11: 0000000000000246 R12: 00000000004030b0
R13: 0000000000000000 R14: 00000000004ac018 R15: 0000000000400488

Fixes: 8afa10cbe281 ("net_sched: red: Avoid illegal values")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/red.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/net/red.h b/include/net/red.h
index b3ab5c6bfa83..117a3654d319 100644
--- a/include/net/red.h
+++ b/include/net/red.h
@@ -170,9 +170,9 @@ static inline void red_set_vars(struct red_vars *v)
 static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog,
 				    u8 Scell_log, u8 *stab)
 {
-	if (fls(qth_min) + Wlog > 32)
+	if (fls(qth_min) + Wlog >= 32)
 		return false;
-	if (fls(qth_max) + Wlog > 32)
+	if (fls(qth_max) + Wlog >= 32)
 		return false;
 	if (Scell_log >= 32)
 		return false;

From 9892532be63cd33758d97a7f60a0e1f52c04d129 Mon Sep 17 00:00:00 2001
From: Claudiu Manoil <claudiu.manoil@nxp.com>
Date: Mon, 29 Mar 2021 17:08:47 +0300
Subject: [PATCH 1841/2658] gianfar: Handle error code at MAC address change

[ Upstream commit bff5b62585123823842833ab20b1c0a7fa437f8c ]

Handle return error code of eth_mac_addr();

Fixes: 3d23a05c75c7 ("gianfar: Enable changing mac addr when if up")
Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/gianfar.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index bc00fa5e864f..fb135797688a 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -485,7 +485,11 @@ static struct net_device_stats *gfar_get_stats(struct net_device *dev)
 
 static int gfar_set_mac_addr(struct net_device *dev, void *p)
 {
-	eth_mac_addr(dev, p);
+	int ret;
+
+	ret = eth_mac_addr(dev, p);
+	if (ret)
+		return ret;
 
 	gfar_set_mac_for_addr(dev, 0, dev->dev_addr);
 

From 3ce435f29609298b141e91a45a58aa6b7695bb5c Mon Sep 17 00:00:00 2001
From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Date: Sun, 28 Mar 2021 00:30:29 -0700
Subject: [PATCH 1842/2658] net:tipc: Fix a double free in tipc_sk_mcast_rcv

[ Upstream commit 6bf24dc0cc0cc43b29ba344b66d78590e687e046 ]

In the if(skb_peek(arrvq) == skb) branch, it calls __skb_dequeue(arrvq) to get
the skb by skb = skb_peek(arrvq). Then __skb_dequeue() unlinks the skb from arrvq
and returns the skb which equals to skb_peek(arrvq). After __skb_dequeue(arrvq)
finished, the skb is freed by kfree_skb(__skb_dequeue(arrvq)) in the first time.

Unfortunately, the same skb is freed in the second time by kfree_skb(skb) after
the branch completed.

My patch removes kfree_skb() in the if(skb_peek(arrvq) == skb) branch, because
this skb will be freed by kfree_skb(skb) finally.

Fixes: cb1b728096f54 ("tipc: eliminate race condition at multicast reception")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tipc/socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 65171f8e8c45..0e5bb03c6425 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -763,7 +763,7 @@ void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq,
 		spin_lock_bh(&inputq->lock);
 		if (skb_peek(arrvq) == skb) {
 			skb_queue_splice_tail_init(&tmpq, inputq);
-			kfree_skb(__skb_dequeue(arrvq));
+			__skb_dequeue(arrvq);
 		}
 		spin_unlock_bh(&inputq->lock);
 		__skb_queue_purge(&tmpq);

From 9cb54d24770d9822dfd3cd360f8131880440cf57 Mon Sep 17 00:00:00 2001
From: Lukasz Bartosik <lb@semihalf.com>
Date: Fri, 2 Apr 2021 00:51:49 +0200
Subject: [PATCH 1843/2658] clk: fix invalid usage of list cursor in unregister

[ Upstream commit 7045465500e465b09f09d6e5bdc260a9f1aab97b ]

Fix invalid usage of a list_for_each_entry cursor in
clk_notifier_unregister(). When list is empty or if the list
is completely traversed (without breaking from the loop on one
of the entries) then the list cursor does not point to a valid
entry and therefore should not be used. The patch fixes a logical
bug that hasn't been seen in pratice however it is analogus
to the bug fixed in clk_notifier_register().

The issue was dicovered when running 5.12-rc1 kernel on x86_64
with KASAN enabled:
BUG: KASAN: global-out-of-bounds in clk_notifier_register+0xab/0x230
Read of size 8 at addr ffffffffa0d10588 by task swapper/0/1

CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1 #1
Hardware name: Google Caroline/Caroline,
BIOS Google_Caroline.7820.430.0 07/20/2018
Call Trace:
 dump_stack+0xee/0x15c
 print_address_description+0x1e/0x2dc
 kasan_report+0x188/0x1ce
 ? clk_notifier_register+0xab/0x230
 ? clk_prepare_lock+0x15/0x7b
 ? clk_notifier_register+0xab/0x230
 clk_notifier_register+0xab/0x230
 dw8250_probe+0xc01/0x10d4
 ...
 Memory state around the buggy address:
  ffffffffa0d10480: 00 00 00 00 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00
  ffffffffa0d10500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9
 >ffffffffa0d10580: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
                          ^
  ffffffffa0d10600: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00
  ffffffffa0d10680: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
  ==================================================================

Fixes: b2476490ef11 ("clk: introduce the common clock framework")
Reported-by: Lukasz Majczak <lma@semihalf.com>
Signed-off-by: Lukasz Bartosik <lb@semihalf.com>
Link: https://lore.kernel.org/r/20210401225149.18826-2-lb@semihalf.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/clk.c | 30 +++++++++++++-----------------
 1 file changed, 13 insertions(+), 17 deletions(-)

diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index d859b34d2b60..02fbf3483173 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -3716,32 +3716,28 @@ EXPORT_SYMBOL_GPL(clk_notifier_register);
  */
 int clk_notifier_unregister(struct clk *clk, struct notifier_block *nb)
 {
-	struct clk_notifier *cn = NULL;
-	int ret = -EINVAL;
+	struct clk_notifier *cn;
+	int ret = -ENOENT;
 
 	if (!clk || !nb)
 		return -EINVAL;
 
 	clk_prepare_lock();
 
-	list_for_each_entry(cn, &clk_notifier_list, node)
-		if (cn->clk == clk)
-			break;
-
-	if (cn->clk == clk) {
-		ret = srcu_notifier_chain_unregister(&cn->notifier_head, nb);
+	list_for_each_entry(cn, &clk_notifier_list, node) {
+		if (cn->clk == clk) {
+			ret = srcu_notifier_chain_unregister(&cn->notifier_head, nb);
 
-		clk->core->notifier_count--;
+			clk->core->notifier_count--;
 
-		/* XXX the notifier code should handle this better */
-		if (!cn->notifier_head.head) {
-			srcu_cleanup_notifier_head(&cn->notifier_head);
-			list_del(&cn->node);
-			kfree(cn);
+			/* XXX the notifier code should handle this better */
+			if (!cn->notifier_head.head) {
+				srcu_cleanup_notifier_head(&cn->notifier_head);
+				list_del(&cn->node);
+				kfree(cn);
+			}
+			break;
 		}
-
-	} else {
-		ret = -ENOENT;
 	}
 
 	clk_prepare_unlock();

From 6ba98a78f1c3f30a407c5e8871ab815ebf377494 Mon Sep 17 00:00:00 2001
From: Zqiang <qiang.zhang@windriver.com>
Date: Thu, 18 Feb 2021 11:16:49 +0800
Subject: [PATCH 1844/2658] workqueue: Move the position of
 debug_work_activate() in __queue_work()

[ Upstream commit 0687c66b5f666b5ad433f4e94251590d9bc9d10e ]

The debug_work_activate() is called on the premise that
the work can be inserted, because if wq be in WQ_DRAINING
status, insert work may be failed.

Fixes: e41e704bc4f4 ("workqueue: improve destroy_workqueue() debuggability")
Signed-off-by: Zqiang <qiang.zhang@windriver.com>
Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/workqueue.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index ba6c2aa5bcc0..1c970232ea8b 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1363,7 +1363,6 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
 	 */
 	WARN_ON_ONCE(!irqs_disabled());
 
-	debug_work_activate(work);
 
 	/* if draining, only works from the same workqueue are allowed */
 	if (unlikely(wq->flags & __WQ_DRAINING) &&
@@ -1444,6 +1443,7 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
 		worklist = &pwq->delayed_works;
 	}
 
+	debug_work_activate(work);
 	insert_work(pwq, work, worklist, work_flags);
 
 	spin_unlock(&pwq->pool->lock);

From 4847324d98bff4c1c5193772c019ba1b3ea0aed3 Mon Sep 17 00:00:00 2001
From: Alexander Gordeev <agordeev@linux.ibm.com>
Date: Mon, 29 Mar 2021 18:35:07 +0200
Subject: [PATCH 1845/2658] s390/cpcmd: fix inline assembly register clobbering

[ Upstream commit 7a2f91441b2c1d81b77c1cd816a4659f4abc9cbe ]

Register variables initialized using arithmetic. That leads to
kasan instrumentaton code corrupting the registers contents.
Follow GCC guidlines and use temporary variables for assigning
init values to register variables.

Fixes: 94c12cc7d196 ("[S390] Inline assembly cleanup.")
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Link: https://gcc.gnu.org/onlinedocs/gcc-10.2.0/gcc/Local-Register-Variables.html
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/kernel/cpcmd.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/s390/kernel/cpcmd.c b/arch/s390/kernel/cpcmd.c
index 7f768914fb4f..c15546c6fb66 100644
--- a/arch/s390/kernel/cpcmd.c
+++ b/arch/s390/kernel/cpcmd.c
@@ -37,10 +37,12 @@ static int diag8_noresponse(int cmdlen)
 
 static int diag8_response(int cmdlen, char *response, int *rlen)
 {
+	unsigned long _cmdlen = cmdlen | 0x40000000L;
+	unsigned long _rlen = *rlen;
 	register unsigned long reg2 asm ("2") = (addr_t) cpcmd_buf;
 	register unsigned long reg3 asm ("3") = (addr_t) response;
-	register unsigned long reg4 asm ("4") = cmdlen | 0x40000000L;
-	register unsigned long reg5 asm ("5") = *rlen;
+	register unsigned long reg4 asm ("4") = _cmdlen;
+	register unsigned long reg5 asm ("5") = _rlen;
 
 	asm volatile(
 		"	sam31\n"

From 3d50f63323c28ae3076f63d5f7a6ec7bd01f721f Mon Sep 17 00:00:00 2001
From: Potnuri Bharat Teja <bharat@chelsio.com>
Date: Wed, 31 Mar 2021 19:27:15 +0530
Subject: [PATCH 1846/2658] RDMA/cxgb4: check for ipv6 address properly while
 destroying listener

[ Upstream commit 603c4690b01aaffe3a6c3605a429f6dac39852ae ]

ipv6 bit is wrongly set by the below which causes fatal adapter lookup
engine errors for ipv4 connections while destroying a listener.  Fix it to
properly check the local address for ipv6.

Fixes: 3408be145a5d ("RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server")
Link: https://lore.kernel.org/r/20210331135715.30072-1-bharat@chelsio.com
Signed-off-by: Potnuri Bharat Teja <bharat@chelsio.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/cxgb4/cm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 8d75161854ee..f422a8a2528b 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -3447,7 +3447,8 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id)
 		c4iw_init_wr_wait(&ep->com.wr_wait);
 		err = cxgb4_remove_server(
 				ep->com.dev->rdev.lldi.ports[0], ep->stid,
-				ep->com.dev->rdev.lldi.rxq_ids[0], true);
+				ep->com.dev->rdev.lldi.rxq_ids[0],
+				ep->com.local_addr.ss_family == AF_INET6);
 		if (err)
 			goto done;
 		err = c4iw_wait_for_reply(&ep->com.dev->rdev, &ep->com.wr_wait,

From 701d6f6f17bec78fe61c3f6aca3040e25e4fc872 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Date: Sun, 14 Mar 2021 12:07:09 +0100
Subject: [PATCH 1847/2658] clk: socfpga: fix iomem pointer cast on 64-bit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 2867b9746cef78745c594894aece6f8ef826e0b4 upstream.

Pointers should be cast with uintptr_t instead of integer.  This fixes
warning when compile testing on ARM64:

  drivers/clk/socfpga/clk-gate.c: In function ‘socfpga_clk_recalc_rate’:
  drivers/clk/socfpga/clk-gate.c:102:7: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]

Fixes: b7cec13f082f ("clk: socfpga: Look for the GPIO_DB_CLK by its offset")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Acked-by: Dinh Nguyen <dinguyen@kernel.org>
Link: https://lore.kernel.org/r/20210314110709.32599-1-krzysztof.kozlowski@canonical.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/clk/socfpga/clk-gate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/socfpga/clk-gate.c b/drivers/clk/socfpga/clk-gate.c
index aa7a6e6a15b6..14918896811d 100644
--- a/drivers/clk/socfpga/clk-gate.c
+++ b/drivers/clk/socfpga/clk-gate.c
@@ -107,7 +107,7 @@ static unsigned long socfpga_clk_recalc_rate(struct clk_hw *hwclk,
 		val = readl(socfpgaclk->div_reg) >> socfpgaclk->shift;
 		val &= GENMASK(socfpgaclk->width - 1, 0);
 		/* Check for GPIO_DB_CLK by its offset */
-		if ((int) socfpgaclk->div_reg & SOCFPGA_GPIO_DB_CLK_OFFSET)
+		if ((uintptr_t) socfpgaclk->div_reg & SOCFPGA_GPIO_DB_CLK_OFFSET)
 			div = val + 1;
 		else
 			div = (1 << val);

From 6bcc59943581e29042fc3ad20fb31dbca2a7eaa9 Mon Sep 17 00:00:00 2001
From: Du Cheng <ducheng2@gmail.com>
Date: Thu, 8 Apr 2021 00:27:56 +0800
Subject: [PATCH 1848/2658] cfg80211: remove WARN_ON() in cfg80211_sme_connect

commit 1b5ab825d9acc0f27d2f25c6252f3526832a9626 upstream.

A WARN_ON(wdev->conn) would trigger in cfg80211_sme_connect(), if multiple
send_msg(NL80211_CMD_CONNECT) system calls are made from the userland, which
should be anticipated and handled by the wireless driver. Remove this WARN_ON()
to prevent kernel panic if kernel is configured to "panic_on_warn".

Bug reported by syzbot.

Reported-by: syzbot+5f9392825de654244975@syzkaller.appspotmail.com
Signed-off-by: Du Cheng <ducheng2@gmail.com>
Link: https://lore.kernel.org/r/20210407162756.6101-1-ducheng2@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/wireless/sme.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 85c12c7d0ed1..5d06a2f49747 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -546,7 +546,7 @@ static int cfg80211_sme_connect(struct wireless_dev *wdev,
 	if (wdev->current_bss)
 		return -EALREADY;
 
-	if (WARN_ON(wdev->conn))
+	if (wdev->conn)
 		return -EINPROGRESS;
 
 	wdev->conn = kzalloc(sizeof(*wdev->conn), GFP_KERNEL);

From a2aa6e3d84a5d6ee955dde8a576f63cf5e1e2f72 Mon Sep 17 00:00:00 2001
From: Phillip Potter <phil@philpotter.co.uk>
Date: Tue, 6 Apr 2021 18:45:54 +0100
Subject: [PATCH 1849/2658] net: tun: set tun->dev->addr_len during TUNSETLINK
 processing

commit cca8ea3b05c972ffb5295367e6c544369b45fbdd upstream.

When changing type with TUNSETLINK ioctl command, set tun->dev->addr_len
to match the appropriate type, using new tun_get_addr_len utility function
which returns appropriate address length for given type. Fixes a
KMSAN-found uninit-value bug reported by syzbot at:
https://syzkaller.appspot.com/bug?id=0766d38c656abeace60621896d705743aeefed51

Reported-by: syzbot+001516d86dbe88862cec@syzkaller.appspotmail.com
Diagnosed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/tun.c | 48 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 93c7024fcc67..dda1bed0c7c9 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -71,6 +71,14 @@
 #include <net/sock.h>
 #include <linux/seq_file.h>
 #include <linux/uio.h>
+#include <linux/ieee802154.h>
+#include <linux/if_ltalk.h>
+#include <uapi/linux/if_fddi.h>
+#include <uapi/linux/if_hippi.h>
+#include <uapi/linux/if_fc.h>
+#include <net/ax25.h>
+#include <net/rose.h>
+#include <net/6lowpan.h>
 
 #include <asm/uaccess.h>
 
@@ -1889,6 +1897,45 @@ static int tun_set_queue(struct file *file, struct ifreq *ifr)
 	return ret;
 }
 
+/* Return correct value for tun->dev->addr_len based on tun->dev->type. */
+static unsigned char tun_get_addr_len(unsigned short type)
+{
+	switch (type) {
+	case ARPHRD_IP6GRE:
+	case ARPHRD_TUNNEL6:
+		return sizeof(struct in6_addr);
+	case ARPHRD_IPGRE:
+	case ARPHRD_TUNNEL:
+	case ARPHRD_SIT:
+		return 4;
+	case ARPHRD_ETHER:
+		return ETH_ALEN;
+	case ARPHRD_IEEE802154:
+	case ARPHRD_IEEE802154_MONITOR:
+		return IEEE802154_EXTENDED_ADDR_LEN;
+	case ARPHRD_PHONET_PIPE:
+	case ARPHRD_PPP:
+	case ARPHRD_NONE:
+		return 0;
+	case ARPHRD_6LOWPAN:
+		return EUI64_ADDR_LEN;
+	case ARPHRD_FDDI:
+		return FDDI_K_ALEN;
+	case ARPHRD_HIPPI:
+		return HIPPI_ALEN;
+	case ARPHRD_IEEE802:
+		return FC_ALEN;
+	case ARPHRD_ROSE:
+		return ROSE_ADDR_LEN;
+	case ARPHRD_NETROM:
+		return AX25_ADDR_LEN;
+	case ARPHRD_LOCALTLK:
+		return LTALK_ALEN;
+	default:
+		return 0;
+	}
+}
+
 static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
 			    unsigned long arg, int ifreq_len)
 {
@@ -2033,6 +2080,7 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
 			ret = -EBUSY;
 		} else {
 			tun->dev->type = (int) arg;
+			tun->dev->addr_len = tun_get_addr_len(tun->dev->type);
 			tun_debug(KERN_INFO, tun, "linktype set to %d\n",
 				  tun->dev->type);
 			ret = 0;

From 4992e844bfd6a012bdc0e15fa65d0272bc3af797 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Thu, 1 Apr 2021 07:46:24 +0300
Subject: [PATCH 1850/2658] drivers: net: fix memory leak in atusb_probe

commit 6b9fbe16955152626557ec6f439f3407b7769941 upstream.

syzbot reported memory leak in atusb_probe()[1].
The problem was in atusb_alloc_urbs().
Since urb is anchored, we need to release the reference
to correctly free the urb

backtrace:
    [<ffffffff82ba0466>] kmalloc include/linux/slab.h:559 [inline]
    [<ffffffff82ba0466>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74
    [<ffffffff82ad3888>] atusb_alloc_urbs drivers/net/ieee802154/atusb.c:362 [inline][2]
    [<ffffffff82ad3888>] atusb_probe+0x158/0x820 drivers/net/ieee802154/atusb.c:1038 [1]

Reported-by: syzbot+28a246747e0a465127f3@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ieee802154/atusb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c
index d5e0e2aedc55..9b3ab60c3556 100644
--- a/drivers/net/ieee802154/atusb.c
+++ b/drivers/net/ieee802154/atusb.c
@@ -340,6 +340,7 @@ static int atusb_alloc_urbs(struct atusb *atusb, int n)
 			return -ENOMEM;
 		}
 		usb_anchor_urb(urb, &atusb->idle_urbs);
+		usb_free_urb(urb);
 		n--;
 	}
 	return 0;

From d95ac616eea5c51c242bff61396db7a7413aae84 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Thu, 1 Apr 2021 16:27:52 +0300
Subject: [PATCH 1851/2658] drivers: net: fix memory leak in
 peak_usb_create_dev

commit a0b96b4a62745397aee662670cfc2157bac03f55 upstream.

syzbot reported memory leak in peak_usb.
The problem was in case of failure after calling
->dev_init()[2] in peak_usb_create_dev()[1]. The data
allocated int dev_init() wasn't freed, so simple
->dev_free() call fix this problem.

backtrace:
    [<0000000079d6542a>] kmalloc include/linux/slab.h:552 [inline]
    [<0000000079d6542a>] kzalloc include/linux/slab.h:682 [inline]
    [<0000000079d6542a>] pcan_usb_fd_init+0x156/0x210 drivers/net/can/usb/peak_usb/pcan_usb_fd.c:868   [2]
    [<00000000c09f9057>] peak_usb_create_dev drivers/net/can/usb/peak_usb/pcan_usb_core.c:851 [inline] [1]
    [<00000000c09f9057>] peak_usb_probe+0x389/0x490 drivers/net/can/usb/peak_usb/pcan_usb_core.c:949

Reported-by: syzbot+91adee8d9ebb9193d22d@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/usb/peak_usb/pcan_usb_core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index 7b148174eb76..620db93ab9a3 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -882,7 +882,7 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter,
 	if (dev->adapter->dev_set_bus) {
 		err = dev->adapter->dev_set_bus(dev, 0);
 		if (err)
-			goto lbl_unregister_candev;
+			goto adap_dev_free;
 	}
 
 	/* get device number early */
@@ -894,6 +894,10 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter,
 
 	return 0;
 
+adap_dev_free:
+	if (dev->adapter->dev_free)
+		dev->adapter->dev_free(dev);
+
 lbl_unregister_candev:
 	unregister_candev(netdev);
 

From e574c5ae259e3627cfbf0dfb5cf9c1b3467e066e Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Thu, 4 Mar 2021 18:21:25 +0300
Subject: [PATCH 1852/2658] net: mac802154: Fix general protection fault

commit 1165affd484889d4986cf3b724318935a0b120d8 upstream.

syzbot found general protection fault in crypto_destroy_tfm()[1].
It was caused by wrong clean up loop in llsec_key_alloc().
If one of the tfm array members is in IS_ERR() range it will
cause general protection fault in clean up function [1].

Call Trace:
 crypto_free_aead include/crypto/aead.h:191 [inline] [1]
 llsec_key_alloc net/mac802154/llsec.c:156 [inline]
 mac802154_llsec_key_add+0x9e0/0xcc0 net/mac802154/llsec.c:249
 ieee802154_add_llsec_key+0x56/0x80 net/mac802154/cfg.c:338
 rdev_add_llsec_key net/ieee802154/rdev-ops.h:260 [inline]
 nl802154_add_llsec_key+0x3d3/0x560 net/ieee802154/nl802154.c:1584
 genl_family_rcv_msg_doit+0x228/0x320 net/netlink/genetlink.c:739
 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
 genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:800
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:674
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Reported-by: syzbot+9ec037722d2603a9f52e@syzkaller.appspotmail.com
Acked-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210304152125.1052825-1-paskripkin@gmail.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac802154/llsec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac802154/llsec.c b/net/mac802154/llsec.c
index a13d02b7cee4..55ed8a97b33f 100644
--- a/net/mac802154/llsec.c
+++ b/net/mac802154/llsec.c
@@ -158,7 +158,7 @@ llsec_key_alloc(const struct ieee802154_llsec_key *template)
 	crypto_free_blkcipher(key->tfm0);
 err_tfm:
 	for (i = 0; i < ARRAY_SIZE(key->tfm); i++)
-		if (key->tfm[i])
+		if (!IS_ERR_OR_NULL(key->tfm[i]))
 			crypto_free_aead(key->tfm[i]);
 
 	kzfree(key);

From f59a1ba1b30ee3020524009cbf9265126bbb5ed4 Mon Sep 17 00:00:00 2001
From: Alexander Aring <aahringo@redhat.com>
Date: Sun, 28 Feb 2021 10:18:03 -0500
Subject: [PATCH 1853/2658] net: ieee802154: nl-mac: fix check on panid

commit 6f7f657f24405f426212c09260bf7fe8a52cef33 upstream.

This patch fixes a null pointer derefence for panid handle by move the
check for the netlink variable directly before accessing them.

Reported-by: syzbot+d4c07de0144f6f63be3a@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210228151817.95700-4-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ieee802154/nl-mac.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/ieee802154/nl-mac.c b/net/ieee802154/nl-mac.c
index 3503c38954f9..76691a07a2e0 100644
--- a/net/ieee802154/nl-mac.c
+++ b/net/ieee802154/nl-mac.c
@@ -557,9 +557,7 @@ ieee802154_llsec_parse_key_id(struct genl_info *info,
 	desc->mode = nla_get_u8(info->attrs[IEEE802154_ATTR_LLSEC_KEY_MODE]);
 
 	if (desc->mode == IEEE802154_SCF_KEY_IMPLICIT) {
-		if (!info->attrs[IEEE802154_ATTR_PAN_ID] &&
-		    !(info->attrs[IEEE802154_ATTR_SHORT_ADDR] ||
-		      info->attrs[IEEE802154_ATTR_HW_ADDR]))
+		if (!info->attrs[IEEE802154_ATTR_PAN_ID])
 			return -EINVAL;
 
 		desc->device_addr.pan_id = nla_get_shortaddr(info->attrs[IEEE802154_ATTR_PAN_ID]);
@@ -568,6 +566,9 @@ ieee802154_llsec_parse_key_id(struct genl_info *info,
 			desc->device_addr.mode = IEEE802154_ADDR_SHORT;
 			desc->device_addr.short_addr = nla_get_shortaddr(info->attrs[IEEE802154_ATTR_SHORT_ADDR]);
 		} else {
+			if (!info->attrs[IEEE802154_ATTR_HW_ADDR])
+				return -EINVAL;
+
 			desc->device_addr.mode = IEEE802154_ADDR_LONG;
 			desc->device_addr.extended_addr = nla_get_hwaddr(info->attrs[IEEE802154_ATTR_HW_ADDR]);
 		}

From 88b93febc1f5e9d333148e36e16388190db21b29 Mon Sep 17 00:00:00 2001
From: Alexander Aring <aahringo@redhat.com>
Date: Sun, 21 Feb 2021 12:43:18 -0500
Subject: [PATCH 1854/2658] net: ieee802154: fix nl802154 del llsec key

commit 37feaaf5ceb2245e474369312bb7b922ce7bce69 upstream.

This patch fixes a nullpointer dereference if NL802154_ATTR_SEC_KEY is
not set by the user. If this is the case nl802154 will return -EINVAL.

Reported-by: syzbot+ac5c11d2959a8b3c4806@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210221174321.14210-1-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ieee802154/nl802154.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index 16ef0d9f566e..6962ef1297c3 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1577,7 +1577,8 @@ static int nl802154_del_llsec_key(struct sk_buff *skb, struct genl_info *info)
 	struct nlattr *attrs[NL802154_KEY_ATTR_MAX + 1];
 	struct ieee802154_llsec_key_id id;
 
-	if (nla_parse_nested(attrs, NL802154_KEY_ATTR_MAX,
+	if (!info->attrs[NL802154_ATTR_SEC_KEY] ||
+	    nla_parse_nested(attrs, NL802154_KEY_ATTR_MAX,
 			     info->attrs[NL802154_ATTR_SEC_KEY],
 			     nl802154_key_policy))
 		return -EINVAL;

From 1426c267bcf418e3e0014bf9982743072d82ee52 Mon Sep 17 00:00:00 2001
From: Alexander Aring <aahringo@redhat.com>
Date: Sun, 21 Feb 2021 12:43:19 -0500
Subject: [PATCH 1855/2658] net: ieee802154: fix nl802154 del llsec dev

commit 3d1eac2f45585690d942cf47fd7fbd04093ebd1b upstream.

This patch fixes a nullpointer dereference if NL802154_ATTR_SEC_DEVICE is
not set by the user. If this is the case nl802154 will return -EINVAL.

Reported-by: syzbot+d946223c2e751d136c94@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210221174321.14210-2-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ieee802154/nl802154.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index 6962ef1297c3..d07b6d1b0e32 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1746,7 +1746,8 @@ static int nl802154_del_llsec_dev(struct sk_buff *skb, struct genl_info *info)
 	struct nlattr *attrs[NL802154_DEV_ATTR_MAX + 1];
 	__le64 extended_addr;
 
-	if (nla_parse_nested(attrs, NL802154_DEV_ATTR_MAX,
+	if (!info->attrs[NL802154_ATTR_SEC_DEVICE] ||
+	    nla_parse_nested(attrs, NL802154_DEV_ATTR_MAX,
 			     info->attrs[NL802154_ATTR_SEC_DEVICE],
 			     nl802154_dev_policy))
 		return -EINVAL;

From aee10198d6b6947532c9c4a9cac8fd43f61d6628 Mon Sep 17 00:00:00 2001
From: Alexander Aring <aahringo@redhat.com>
Date: Sun, 21 Feb 2021 12:43:20 -0500
Subject: [PATCH 1856/2658] net: ieee802154: fix nl802154 add llsec key

commit 20d5fe2d7103f5c43ad11a3d6d259e9d61165c35 upstream.

This patch fixes a nullpointer dereference if NL802154_ATTR_SEC_KEY is
not set by the user. If this is the case nl802154 will return -EINVAL.

Reported-by: syzbot+ce4e062c2d51977ddc50@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210221174321.14210-3-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ieee802154/nl802154.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index d07b6d1b0e32..50e5468fdcc4 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1527,7 +1527,8 @@ static int nl802154_add_llsec_key(struct sk_buff *skb, struct genl_info *info)
 	struct ieee802154_llsec_key_id id = { };
 	u32 commands[NL802154_CMD_FRAME_NR_IDS / 32] = { };
 
-	if (nla_parse_nested(attrs, NL802154_KEY_ATTR_MAX,
+	if (!info->attrs[NL802154_ATTR_SEC_KEY] ||
+	    nla_parse_nested(attrs, NL802154_KEY_ATTR_MAX,
 			     info->attrs[NL802154_ATTR_SEC_KEY],
 			     nl802154_key_policy))
 		return -EINVAL;

From 4f37ba56ddb60cbe1c485370986080c7857a32b8 Mon Sep 17 00:00:00 2001
From: Alexander Aring <aahringo@redhat.com>
Date: Sun, 21 Feb 2021 12:43:21 -0500
Subject: [PATCH 1857/2658] net: ieee802154: fix nl802154 del llsec devkey

commit 27c746869e1a135dffc2f2a80715bb7aa00445b4 upstream.

This patch fixes a nullpointer dereference if NL802154_ATTR_SEC_DEVKEY is
not set by the user. If this is the case nl802154 will return -EINVAL.

Reported-by: syzbot+368672e0da240db53b5f@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210221174321.14210-4-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ieee802154/nl802154.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index 50e5468fdcc4..b8c0c64e935c 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1908,7 +1908,8 @@ static int nl802154_del_llsec_devkey(struct sk_buff *skb, struct genl_info *info
 	struct ieee802154_llsec_device_key key;
 	__le64 extended_addr;
 
-	if (nla_parse_nested(attrs, NL802154_DEVKEY_ATTR_MAX,
+	if (!info->attrs[NL802154_ATTR_SEC_DEVKEY] ||
+	    nla_parse_nested(attrs, NL802154_DEVKEY_ATTR_MAX,
 			     info->attrs[NL802154_ATTR_SEC_DEVKEY],
 			     nl802154_devkey_policy))
 		return -EINVAL;

From b63c7cc735e47440fe7d5a5ddd464c9210729121 Mon Sep 17 00:00:00 2001
From: Alexander Aring <aahringo@redhat.com>
Date: Sun, 4 Apr 2021 20:30:41 -0400
Subject: [PATCH 1858/2658] net: ieee802154: forbid monitor for set llsec
 params

commit 88c17855ac4291fb462e13a86b7516773b6c932e upstream.

This patch forbids to set llsec params for monitor interfaces which we
don't support yet.

Reported-by: syzbot+8b6719da8a04beeafcc3@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-3-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ieee802154/nl802154.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index b8c0c64e935c..447acb40400f 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1367,6 +1367,9 @@ static int nl802154_set_llsec_params(struct sk_buff *skb,
 	u32 changed = 0;
 	int ret;
 
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
+		return -EOPNOTSUPP;
+
 	if (info->attrs[NL802154_ATTR_SEC_ENABLED]) {
 		u8 enabled;
 

From 0a9017629ed18e4135913c7002392cabd05565a5 Mon Sep 17 00:00:00 2001
From: Alexander Aring <aahringo@redhat.com>
Date: Sun, 4 Apr 2021 20:30:53 -0400
Subject: [PATCH 1859/2658] net: ieee802154: forbid monitor for del llsec
 seclevel

commit 9dde130937e95b72adfae64ab21d6e7e707e2dac upstream.

This patch forbids to del llsec seclevel for monitor interfaces which we
don't support yet. Otherwise we will access llsec mib which isn't
initialized for monitors.

Reported-by: syzbot+fbf4fc11a819824e027b@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-15-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ieee802154/nl802154.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index 447acb40400f..edde0e461ff1 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -2087,6 +2087,9 @@ static int nl802154_del_llsec_seclevel(struct sk_buff *skb,
 	struct wpan_dev *wpan_dev = dev->ieee802154_ptr;
 	struct ieee802154_llsec_seclevel sl;
 
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
+		return -EOPNOTSUPP;
+
 	if (!info->attrs[NL802154_ATTR_SEC_LEVEL] ||
 	    llsec_parse_seclevel(info->attrs[NL802154_ATTR_SEC_LEVEL],
 				 &sl) < 0)

From 9560c9f991af3515590119ac6c3f56ea8cd372fb Mon Sep 17 00:00:00 2001
From: Alexander Aring <aahringo@redhat.com>
Date: Sun, 4 Apr 2021 20:30:54 -0400
Subject: [PATCH 1860/2658] net: ieee802154: stop dump llsec params for
 monitors

commit 1534efc7bbc1121e92c86c2dabebaf2c9dcece19 upstream.

This patch stops dumping llsec params for monitors which we don't support
yet. Otherwise we will access llsec mib which isn't initialized for
monitors.

Reported-by: syzbot+cde43a581a8e5f317bc2@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-16-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ieee802154/nl802154.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index edde0e461ff1..c23c08f49c3c 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -843,8 +843,13 @@ nl802154_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
 		goto nla_put_failure;
 
 #ifdef CONFIG_IEEE802154_NL802154_EXPERIMENTAL
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
+		goto out;
+
 	if (nl802154_get_llsec_params(msg, rdev, wpan_dev) < 0)
 		goto nla_put_failure;
+
+out:
 #endif /* CONFIG_IEEE802154_NL802154_EXPERIMENTAL */
 
 	genlmsg_end(msg, hdr);

From 37c52055470bb66b49ce4f10474b7e0107ab808d Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Wed, 24 Mar 2021 17:47:41 +0100
Subject: [PATCH 1861/2658] drm/imx: imx-ldb: fix out of bounds array access
 warning

[ Upstream commit 33ce7f2f95cabb5834cf0906308a5cb6103976da ]

When CONFIG_OF is disabled, building with 'make W=1' produces warnings
about out of bounds array access:

drivers/gpu/drm/imx/imx-ldb.c: In function 'imx_ldb_set_clock.constprop':
drivers/gpu/drm/imx/imx-ldb.c:186:8: error: array subscript -22 is below array bounds of 'struct clk *[4]' [-Werror=array-bounds]

Add an error check before the index is used, which helps with the
warning, as well as any possible other error condition that may be
triggered at runtime.

The warning could be fixed by adding a Kconfig depedency on CONFIG_OF,
but Liu Ying points out that the driver may hit the out-of-bounds
problem at runtime anyway.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Liu Ying <victor.liu@nxp.com>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/imx/imx-ldb.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
index b9dc2ef64ed8..74585ba16501 100644
--- a/drivers/gpu/drm/imx/imx-ldb.c
+++ b/drivers/gpu/drm/imx/imx-ldb.c
@@ -217,6 +217,11 @@ static void imx_ldb_encoder_commit(struct drm_encoder *encoder)
 	int dual = ldb->ldb_ctrl & LDB_SPLIT_MODE_EN;
 	int mux = imx_drm_encoder_get_mux_id(imx_ldb_ch->child, encoder);
 
+	if (mux < 0 || mux >= ARRAY_SIZE(ldb->clk_sel)) {
+		dev_warn(ldb->dev, "%s: invalid mux %d\n", __func__, mux);
+		return;
+	}
+
 	drm_panel_prepare(imx_ldb_ch->panel);
 
 	if (dual) {
@@ -267,6 +272,11 @@ static void imx_ldb_encoder_mode_set(struct drm_encoder *encoder,
 	unsigned long di_clk = mode->clock * 1000;
 	int mux = imx_drm_encoder_get_mux_id(imx_ldb_ch->child, encoder);
 
+	if (mux < 0 || mux >= ARRAY_SIZE(ldb->clk_sel)) {
+		dev_warn(ldb->dev, "%s: invalid mux %d\n", __func__, mux);
+		return;
+	}
+
 	if (mode->clock > 170000) {
 		dev_warn(ldb->dev,
 			 "%s: mode exceeds 170 MHz pixel clock\n", __func__);

From e44c57e961f15711a6a3d973d47502cab1907b1d Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Wed, 7 Apr 2021 21:38:57 +0200
Subject: [PATCH 1862/2658] netfilter: x_tables: fix compat match/target pad
 out-of-bound write

commit b29c457a6511435960115c0f548c4360d5f4801d upstream.

xt_compat_match/target_from_user doesn't check that zeroing the area
to start of next rule won't write past end of allocated ruleset blob.

Remove this code and zero the entire blob beforehand.

Reported-by: syzbot+cfc0247ac173f597aaaa@syzkaller.appspotmail.com
Reported-by: Andy Nguyen <theflow@google.com>
Fixes: 9fa492cdc160c ("[NETFILTER]: x_tables: simplify compat API")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/netfilter/arp_tables.c |  2 ++
 net/ipv4/netfilter/ip_tables.c  |  2 ++
 net/ipv6/netfilter/ip6_tables.c |  2 ++
 net/netfilter/x_tables.c        | 10 ++--------
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index f62ab3a9ddab..444af06730b1 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1353,6 +1353,8 @@ static int translate_compat_table(struct net *net,
 	if (!newinfo)
 		goto out_unlock;
 
+	memset(newinfo->entries, 0, size);
+
 	newinfo->number = compatr->num_entries;
 	for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
 		newinfo->hook_entry[i] = compatr->hook_entry[i];
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 54a2ddaedebf..ae994dab45a0 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1614,6 +1614,8 @@ translate_compat_table(struct net *net,
 	if (!newinfo)
 		goto out_unlock;
 
+	memset(newinfo->entries, 0, size);
+
 	newinfo->number = compatr->num_entries;
 	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 		newinfo->hook_entry[i] = compatr->hook_entry[i];
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 02ed321ef847..d0ae733fbe92 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1625,6 +1625,8 @@ translate_compat_table(struct net *net,
 	if (!newinfo)
 		goto out_unlock;
 
+	memset(newinfo->entries, 0, size);
+
 	newinfo->number = compatr->num_entries;
 	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 		newinfo->hook_entry[i] = compatr->hook_entry[i];
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index abd482a98c62..dfce6a8f0a38 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -587,7 +587,7 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
 {
 	const struct xt_match *match = m->u.kernel.match;
 	struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m;
-	int pad, off = xt_compat_match_offset(match);
+	int off = xt_compat_match_offset(match);
 	u_int16_t msize = cm->u.user.match_size;
 	char name[sizeof(m->u.user.name)];
 
@@ -597,9 +597,6 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
 		match->compat_from_user(m->data, cm->data);
 	else
 		memcpy(m->data, cm->data, msize - sizeof(*cm));
-	pad = XT_ALIGN(match->matchsize) - match->matchsize;
-	if (pad > 0)
-		memset(m->data + match->matchsize, 0, pad);
 
 	msize += off;
 	m->u.user.match_size = msize;
@@ -939,7 +936,7 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
 {
 	const struct xt_target *target = t->u.kernel.target;
 	struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;
-	int pad, off = xt_compat_target_offset(target);
+	int off = xt_compat_target_offset(target);
 	u_int16_t tsize = ct->u.user.target_size;
 	char name[sizeof(t->u.user.name)];
 
@@ -949,9 +946,6 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
 		target->compat_from_user(t->data, ct->data);
 	else
 		memcpy(t->data, ct->data, tsize - sizeof(*ct));
-	pad = XT_ALIGN(target->targetsize) - target->targetsize;
-	if (pad > 0)
-		memset(t->data + target->targetsize, 0, pad);
 
 	tsize += off;
 	t->u.user.target_size = tsize;

From 09748582dd6433e87aecca78c4395fb714183247 Mon Sep 17 00:00:00 2001
From: Arnaldo Carvalho de Melo <acme@redhat.com>
Date: Fri, 5 Mar 2021 10:02:09 -0300
Subject: [PATCH 1863/2658] perf map: Tighten snprintf() string precision to
 pass gcc check on some 32-bit arches

commit 77d02bd00cea9f1a87afe58113fa75b983d6c23a upstream.

Noticed on a debian:experimental mips and mipsel cross build build
environment:

  perfbuilder@ec265a086e9b:~$ mips-linux-gnu-gcc --version | head -1
  mips-linux-gnu-gcc (Debian 10.2.1-3) 10.2.1 20201224
  perfbuilder@ec265a086e9b:~$

    CC       /tmp/build/perf/util/map.o
  util/map.c: In function 'map__new':
  util/map.c:109:5: error: '%s' directive output may be truncated writing between 1 and 2147483645 bytes into a region of size 4096 [-Werror=format-truncation=]
    109 |    "%s/platforms/%s/arch-%s/usr/lib/%s",
        |     ^~
  In file included from /usr/mips-linux-gnu/include/stdio.h:867,
                   from util/symbol.h:11,
                   from util/map.c:2:
  /usr/mips-linux-gnu/include/bits/stdio2.h:67:10: note: '__builtin___snprintf_chk' output 32 or more bytes (assuming 4294967321) into a destination of size 4096
     67 |   return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1,
        |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     68 |        __bos (__s), __fmt, __va_arg_pack ());
        |        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  cc1: all warnings being treated as errors

Since we have the lenghts for what lands in that place, use it to give
the compiler more info and make it happy.

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/util/map.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
index 2a51212d5e49..e86fd1b38448 100644
--- a/tools/perf/util/map.c
+++ b/tools/perf/util/map.c
@@ -88,8 +88,7 @@ static inline bool replace_android_lib(const char *filename, char *newfilename)
 	if (!strncmp(filename, "/system/lib/", 12)) {
 		char *ndk, *app;
 		const char *arch;
-		size_t ndk_length;
-		size_t app_length;
+		int ndk_length, app_length;
 
 		ndk = getenv("NDK_ROOT");
 		app = getenv("APP_PLATFORM");
@@ -117,8 +116,8 @@ static inline bool replace_android_lib(const char *filename, char *newfilename)
 		if (new_length > PATH_MAX)
 			return false;
 		snprintf(newfilename, new_length,
-			"%s/platforms/%s/arch-%s/usr/lib/%s",
-			ndk, app, arch, libname);
+			"%.*s/platforms/%.*s/arch-%s/usr/lib/%s",
+			ndk_length, ndk, app_length, app, arch, libname);
 
 		return true;
 	}

From a80a07d42c929a4392ba6b0869315fac0a713983 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Mon, 12 Apr 2021 08:28:45 +0200
Subject: [PATCH 1864/2658] xen/events: fix setting irq affinity

The backport of upstream patch 25da4618af240fbec61 ("xen/events: don't
unmask an event channel when an eoi is pending") introduced a
regression for stable kernels 5.10 and older: setting IRQ affinity for
IRQs related to interdomain events would no longer work, as moving the
IRQ to its new cpu was not included in the irq_ack callback for those
events.

Fix that by adding the needed call.

Note that kernels 5.11 and later don't need the explicit moving of the
IRQ to the target cpu in the irq_ack callback, due to a rework of the
affinity setting in kernel 5.11.

Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/events/events_base.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index f38eccb94fb7..56bf952de411 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -1779,7 +1779,7 @@ static void lateeoi_ack_dynirq(struct irq_data *data)
 
 	if (VALID_EVTCHN(evtchn)) {
 		do_mask(info, EVT_MASK_REASON_EOI_PENDING);
-		event_handler_exit(info);
+		ack_dynirq(data);
 	}
 }
 
@@ -1790,7 +1790,7 @@ static void lateeoi_mask_ack_dynirq(struct irq_data *data)
 
 	if (VALID_EVTCHN(evtchn)) {
 		do_mask(info, EVT_MASK_REASON_EXPLICIT);
-		event_handler_exit(info);
+		ack_dynirq(data);
 	}
 }
 

From 323d7ec12a71a6c1aa8ae09ecf837ea6ee56b071 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 16 Apr 2021 12:00:23 +0200
Subject: [PATCH 1865/2658] Linux 4.4.267

Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://lore.kernel.org/r/20210415144413.352638802@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index ff87b3b36125..0b937d865b62 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 266
+SUBLEVEL = 267
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From e2ae044ac99ed11bdbb7440aa948f247d93bbd1f Mon Sep 17 00:00:00 2001
From: Or Cohen <orcohen@paloaltonetworks.com>
Date: Tue, 13 Apr 2021 21:10:31 +0300
Subject: [PATCH 1866/2658] net/sctp: fix race condition in sctp_destroy_sock

commit b166a20b07382b8bc1dcee2a448715c9c2c81b5b upstream.

If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock
held and sp->do_auto_asconf is true, then an element is removed
from the auto_asconf_splist without any proper locking.

This can happen in the following functions:
1. In sctp_accept, if sctp_sock_migrate fails.
2. In inet_create or inet6_create, if there is a bpf program
   attached to BPF_CGROUP_INET_SOCK_CREATE which denies
   creation of the sctp socket.

The bug is fixed by acquiring addr_wq_lock in sctp_destroy_sock
instead of sctp_close.

This addresses CVE-2021-23133.

Reported-by: Or Cohen <orcohen@paloaltonetworks.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Fixes: 610236587600 ("bpf: Add new cgroup attach type to enable sock modifications")
Signed-off-by: Or Cohen <orcohen@paloaltonetworks.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/socket.c | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 62ba9a49c126..405dc1863b30 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1567,11 +1567,9 @@ static void sctp_close(struct sock *sk, long timeout)
 
 	/* Supposedly, no process has access to the socket, but
 	 * the net layers still may.
-	 * Also, sctp_destroy_sock() needs to be called with addr_wq_lock
-	 * held and that should be grabbed before socket lock.
 	 */
-	spin_lock_bh(&net->sctp.addr_wq_lock);
-	bh_lock_sock_nested(sk);
+	local_bh_disable();
+	bh_lock_sock(sk);
 
 	/* Hold the sock, since sk_common_release() will put sock_put()
 	 * and we have just a little more cleanup.
@@ -1580,7 +1578,7 @@ static void sctp_close(struct sock *sk, long timeout)
 	sk_common_release(sk);
 
 	bh_unlock_sock(sk);
-	spin_unlock_bh(&net->sctp.addr_wq_lock);
+	local_bh_enable();
 
 	sock_put(sk);
 
@@ -4161,9 +4159,6 @@ static int sctp_init_sock(struct sock *sk)
 	sk_sockets_allocated_inc(sk);
 	sock_prot_inuse_add(net, sk->sk_prot, 1);
 
-	/* Nothing can fail after this block, otherwise
-	 * sctp_destroy_sock() will be called without addr_wq_lock held
-	 */
 	if (net->sctp.default_auto_asconf) {
 		spin_lock(&sock_net(sk)->sctp.addr_wq_lock);
 		list_add_tail(&sp->auto_asconf_list,
@@ -4198,7 +4193,9 @@ static void sctp_destroy_sock(struct sock *sk)
 
 	if (sp->do_auto_asconf) {
 		sp->do_auto_asconf = 0;
+		spin_lock_bh(&sock_net(sk)->sctp.addr_wq_lock);
 		list_del(&sp->auto_asconf_list);
+		spin_unlock_bh(&sock_net(sk)->sctp.addr_wq_lock);
 	}
 	sctp_endpoint_free(sp->ep);
 	local_bh_disable();

From 844d69a0ff458706445c067f6cc25ce2882c8cde Mon Sep 17 00:00:00 2001
From: Fabian Vogt <fabian@ritter-vogt.de>
Date: Tue, 23 Mar 2021 10:45:55 -0700
Subject: [PATCH 1867/2658] Input: nspire-keypad - enable interrupts only when
 opened

[ Upstream commit 69d5ff3e9e51e23d5d81bf48480aa5671be67a71 ]

The driver registers an interrupt handler in _probe, but didn't configure
them until later when the _open function is called. In between, the keypad
can fire an IRQ due to touchpad activity, which the handler ignores. This
causes the kernel to disable the interrupt, blocking the keypad from
working.

Fix this by disabling interrupts before registering the handler.
Additionally, disable them in _close, so that they're only enabled while
open.

Fixes: fc4f31461892 ("Input: add TI-Nspire keypad support")
Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
Link: https://lore.kernel.org/r/3383725.iizBOSrK1V@linux-e202.suse.de
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/keyboard/nspire-keypad.c | 56 ++++++++++++++------------
 1 file changed, 31 insertions(+), 25 deletions(-)

diff --git a/drivers/input/keyboard/nspire-keypad.c b/drivers/input/keyboard/nspire-keypad.c
index 7abfd34eb87e..bcec72367c1d 100644
--- a/drivers/input/keyboard/nspire-keypad.c
+++ b/drivers/input/keyboard/nspire-keypad.c
@@ -96,9 +96,15 @@ static irqreturn_t nspire_keypad_irq(int irq, void *dev_id)
 	return IRQ_HANDLED;
 }
 
-static int nspire_keypad_chip_init(struct nspire_keypad *keypad)
+static int nspire_keypad_open(struct input_dev *input)
 {
+	struct nspire_keypad *keypad = input_get_drvdata(input);
 	unsigned long val = 0, cycles_per_us, delay_cycles, row_delay_cycles;
+	int error;
+
+	error = clk_prepare_enable(keypad->clk);
+	if (error)
+		return error;
 
 	cycles_per_us = (clk_get_rate(keypad->clk) / 1000000);
 	if (cycles_per_us == 0)
@@ -124,30 +130,6 @@ static int nspire_keypad_chip_init(struct nspire_keypad *keypad)
 	keypad->int_mask = 1 << 1;
 	writel(keypad->int_mask, keypad->reg_base + KEYPAD_INTMSK);
 
-	/* Disable GPIO interrupts to prevent hanging on touchpad */
-	/* Possibly used to detect touchpad events */
-	writel(0, keypad->reg_base + KEYPAD_UNKNOWN_INT);
-	/* Acknowledge existing interrupts */
-	writel(~0, keypad->reg_base + KEYPAD_UNKNOWN_INT_STS);
-
-	return 0;
-}
-
-static int nspire_keypad_open(struct input_dev *input)
-{
-	struct nspire_keypad *keypad = input_get_drvdata(input);
-	int error;
-
-	error = clk_prepare_enable(keypad->clk);
-	if (error)
-		return error;
-
-	error = nspire_keypad_chip_init(keypad);
-	if (error) {
-		clk_disable_unprepare(keypad->clk);
-		return error;
-	}
-
 	return 0;
 }
 
@@ -155,6 +137,11 @@ static void nspire_keypad_close(struct input_dev *input)
 {
 	struct nspire_keypad *keypad = input_get_drvdata(input);
 
+	/* Disable interrupts */
+	writel(0, keypad->reg_base + KEYPAD_INTMSK);
+	/* Acknowledge existing interrupts */
+	writel(~0, keypad->reg_base + KEYPAD_INT);
+
 	clk_disable_unprepare(keypad->clk);
 }
 
@@ -215,6 +202,25 @@ static int nspire_keypad_probe(struct platform_device *pdev)
 		return -ENOMEM;
 	}
 
+	error = clk_prepare_enable(keypad->clk);
+	if (error) {
+		dev_err(&pdev->dev, "failed to enable clock\n");
+		return error;
+	}
+
+	/* Disable interrupts */
+	writel(0, keypad->reg_base + KEYPAD_INTMSK);
+	/* Acknowledge existing interrupts */
+	writel(~0, keypad->reg_base + KEYPAD_INT);
+
+	/* Disable GPIO interrupts to prevent hanging on touchpad */
+	/* Possibly used to detect touchpad events */
+	writel(0, keypad->reg_base + KEYPAD_UNKNOWN_INT);
+	/* Acknowledge existing GPIO interrupts */
+	writel(~0, keypad->reg_base + KEYPAD_UNKNOWN_INT_STS);
+
+	clk_disable_unprepare(keypad->clk);
+
 	input_set_drvdata(input, keypad);
 
 	input->id.bustype = BUS_HOST;

From d3a4f254173ee92bdc380ff315e41f6b577bf62e Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Wed, 24 Mar 2021 16:17:57 +0200
Subject: [PATCH 1868/2658] dmaengine: dw: Make it dependent to HAS_IOMEM

[ Upstream commit 88cd1d6191b13689094310c2405394e4ce36d061 ]

Some architectures do not provide devm_*() APIs. Hence make the driver
dependent on HAVE_IOMEM.

Fixes: dbde5c2934d1 ("dw_dmac: use devm_* functions to simplify code")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Link: https://lore.kernel.org/r/20210324141757.24710-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/dw/Kconfig | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/dma/dw/Kconfig b/drivers/dma/dw/Kconfig
index e00c9b022964..6ea3e95c287b 100644
--- a/drivers/dma/dw/Kconfig
+++ b/drivers/dma/dw/Kconfig
@@ -11,6 +11,7 @@ config DW_DMAC_BIG_ENDIAN_IO
 
 config DW_DMAC
 	tristate "Synopsys DesignWare AHB DMA platform driver"
+	depends on HAS_IOMEM
 	select DW_DMAC_CORE
 	select DW_DMAC_BIG_ENDIAN_IO if AVR32
 	default y if CPU_AT32AP7000
@@ -21,6 +22,7 @@ config DW_DMAC
 config DW_DMAC_PCI
 	tristate "Synopsys DesignWare AHB DMA PCI driver"
 	depends on PCI
+	depends on HAS_IOMEM
 	select DW_DMAC_CORE
 	help
 	  Support the Synopsys DesignWare AHB DMA controller on the

From 10f250591ead947ef7b705700213999d218b5f14 Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Mon, 8 Mar 2021 11:30:45 +0200
Subject: [PATCH 1869/2658] ARM: dts: Fix moving mmc devices with aliases for
 omap4 & 5

[ Upstream commit 77335a040178a0456d4eabc8bf17a7ca3ee4a327 ]

Fix moving mmc devices with dts aliases as discussed on the lists.
Without this we now have internal eMMC mmc1 show up as mmc2 compared
to the earlier order of devices.

Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/omap4.dtsi | 5 +++++
 arch/arm/boot/dts/omap5.dtsi | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi
index 8a5628c4b135..656e35ec037d 100644
--- a/arch/arm/boot/dts/omap4.dtsi
+++ b/arch/arm/boot/dts/omap4.dtsi
@@ -21,6 +21,11 @@
 		i2c1 = &i2c2;
 		i2c2 = &i2c3;
 		i2c3 = &i2c4;
+		mmc0 = &mmc1;
+		mmc1 = &mmc2;
+		mmc2 = &mmc3;
+		mmc3 = &mmc4;
+		mmc4 = &mmc5;
 		serial0 = &uart1;
 		serial1 = &uart2;
 		serial2 = &uart3;
diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
index 4c04389dab32..b61ea6ca59b3 100644
--- a/arch/arm/boot/dts/omap5.dtsi
+++ b/arch/arm/boot/dts/omap5.dtsi
@@ -26,6 +26,11 @@
 		i2c2 = &i2c3;
 		i2c3 = &i2c4;
 		i2c4 = &i2c5;
+		mmc0 = &mmc1;
+		mmc1 = &mmc2;
+		mmc2 = &mmc3;
+		mmc3 = &mmc4;
+		mmc4 = &mmc5;
 		serial0 = &uart1;
 		serial1 = &uart2;
 		serial2 = &uart3;

From b234b89113d4a33bc2cca7022ae6896406d8cd3c Mon Sep 17 00:00:00 2001
From: Wang Qing <wangqing@vivo.com>
Date: Mon, 1 Mar 2021 20:05:48 +0800
Subject: [PATCH 1870/2658] arc: kernel: Return -EFAULT if copy_to_user() fails

[ Upstream commit 46e152186cd89d940b26726fff11eb3f4935b45a ]

The copy_to_user() function returns the number of bytes remaining to be
copied, but we want to return -EFAULT if the copy doesn't complete.

Signed-off-by: Wang Qing <wangqing@vivo.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arc/kernel/signal.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c
index 257b8699efde..639f39f39917 100644
--- a/arch/arc/kernel/signal.c
+++ b/arch/arc/kernel/signal.c
@@ -97,7 +97,7 @@ stash_usr_regs(struct rt_sigframe __user *sf, struct pt_regs *regs,
 			     sizeof(sf->uc.uc_mcontext.regs.scratch));
 	err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(sigset_t));
 
-	return err;
+	return err ? -EFAULT : 0;
 }
 
 static int restore_usr_regs(struct pt_regs *regs, struct rt_sigframe __user *sf)
@@ -111,7 +111,7 @@ static int restore_usr_regs(struct pt_regs *regs, struct rt_sigframe __user *sf)
 				&(sf->uc.uc_mcontext.regs.scratch),
 				sizeof(sf->uc.uc_mcontext.regs.scratch));
 	if (err)
-		return err;
+		return -EFAULT;
 
 	set_current_blocked(&set);
 	regs->bta	= uregs.scratch.bta;

From c3639b460e6215fae9a5fad592cf74456e062b21 Mon Sep 17 00:00:00 2001
From: Tong Zhu <zhutong@amazon.com>
Date: Fri, 19 Mar 2021 14:33:37 -0400
Subject: [PATCH 1871/2658] neighbour: Disregard DEAD dst in neigh_update

[ Upstream commit d47ec7a0a7271dda08932d6208e4ab65ab0c987c ]

After a short network outage, the dst_entry is timed out and put
in DST_OBSOLETE_DEAD. We are in this code because arp reply comes
from this neighbour after network recovers. There is a potential
race condition that dst_entry is still in DST_OBSOLETE_DEAD.
With that, another neighbour lookup causes more harm than good.

In best case all packets in arp_queue are lost. This is
counterproductive to the original goal of finding a better path
for those packets.

I observed a worst case with 4.x kernel where a dst_entry in
DST_OBSOLETE_DEAD state is associated with loopback net_device.
It leads to an ethernet header with all zero addresses.
A packet with all zero source MAC address is quite deadly with
mac80211, ath9k and 802.11 block ack.  It fails
ieee80211_find_sta_by_ifaddr in ath9k (xmit.c). Ath9k flushes tx
queue (ath_tx_complete_aggr). BAW (block ack window) is not
updated. BAW logic is damaged and ath9k transmission is disabled.

Signed-off-by: Tong Zhu <zhutong@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/neighbour.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 7044c2636985..a924c2367dba 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1234,7 +1234,7 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
 			 * we can reinject the packet there.
 			 */
 			n2 = NULL;
-			if (dst) {
+			if (dst && dst->obsolete != DST_OBSOLETE_DEAD) {
 				n2 = dst_neigh_lookup_skb(dst, skb);
 				if (n2)
 					n1 = n2;

From 0eadec2dad8ba975ab9718fe7e3a774eb1aeaa3a Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Tue, 23 Mar 2021 14:18:05 +0100
Subject: [PATCH 1872/2658] ARM: keystone: fix integer overflow warning

[ Upstream commit 844b85dda2f569943e1e018fdd63b6f7d1d6f08e ]

clang warns about an impossible condition when building with 32-bit
phys_addr_t:

arch/arm/mach-keystone/keystone.c:79:16: error: result of comparison of constant 51539607551 with expression of type 'phys_addr_t' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare]
            mem_end   > KEYSTONE_HIGH_PHYS_END) {
            ~~~~~~~   ^ ~~~~~~~~~~~~~~~~~~~~~~
arch/arm/mach-keystone/keystone.c:78:16: error: result of comparison of constant 34359738368 with expression of type 'phys_addr_t' (aka 'unsigned int') is always true [-Werror,-Wtautological-constant-out-of-range-compare]
        if (mem_start < KEYSTONE_HIGH_PHYS_START ||
            ~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~

Change the temporary variable to a fixed-size u64 to avoid the warning.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Santosh Shilimkar <ssantosh@kernel.org>
Link: https://lore.kernel.org/r/20210323131814.2751750-1-arnd@kernel.org'
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-keystone/keystone.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-keystone/keystone.c b/arch/arm/mach-keystone/keystone.c
index c279293f084c..0f1f5c4141d5 100644
--- a/arch/arm/mach-keystone/keystone.c
+++ b/arch/arm/mach-keystone/keystone.c
@@ -71,7 +71,7 @@ static phys_addr_t keystone_virt_to_idmap(unsigned long x)
 static long long __init keystone_pv_fixup(void)
 {
 	long long offset;
-	phys_addr_t mem_start, mem_end;
+	u64 mem_start, mem_end;
 
 	mem_start = memblock_start_of_DRAM();
 	mem_end = memblock_end_of_DRAM();
@@ -84,7 +84,7 @@ static long long __init keystone_pv_fixup(void)
 	if (mem_start < KEYSTONE_HIGH_PHYS_START ||
 	    mem_end   > KEYSTONE_HIGH_PHYS_END) {
 		pr_crit("Invalid address space for memory (%08llx-%08llx)\n",
-		        (u64)mem_start, (u64)mem_end);
+		        mem_start, mem_end);
 		return 0;
 	}
 

From 5d8872a48c6b0df2ef3ed836686ed07dfbfd4b7b Mon Sep 17 00:00:00 2001
From: Alexander Shiyan <shc_work@mail.ru>
Date: Fri, 2 Apr 2021 11:14:05 +0300
Subject: [PATCH 1873/2658] ASoC: fsl_esai: Fix TDM slot setup for I2S mode

[ Upstream commit e7a48c710defa0e0fef54d42b7d9e4ab596e2761 ]

When using the driver in I2S TDM mode, the fsl_esai_startup()
function rewrites the number of slots previously set by the
fsl_esai_set_dai_tdm_slot() function to 2.
To fix this, let's use the saved slot count value or, if TDM
is not used and the number of slots is not set, the driver will use
the default value (2), which is set by fsl_esai_probe().

Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
Link: https://lore.kernel.org/r/20210402081405.9892-1-shc_work@mail.ru
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/fsl/fsl_esai.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
index 40075b9afb79..fad711a3f4b4 100644
--- a/sound/soc/fsl/fsl_esai.c
+++ b/sound/soc/fsl/fsl_esai.c
@@ -488,11 +488,13 @@ static int fsl_esai_startup(struct snd_pcm_substream *substream,
 				   ESAI_SAICR_SYNC, esai_priv->synchronous ?
 				   ESAI_SAICR_SYNC : 0);
 
-		/* Set a default slot number -- 2 */
+		/* Set slots count */
 		regmap_update_bits(esai_priv->regmap, REG_ESAI_TCCR,
-				   ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(2));
+				   ESAI_xCCR_xDC_MASK,
+				   ESAI_xCCR_xDC(esai_priv->slots));
 		regmap_update_bits(esai_priv->regmap, REG_ESAI_RCCR,
-				   ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(2));
+				   ESAI_xCCR_xDC_MASK,
+				   ESAI_xCCR_xDC(esai_priv->slots));
 	}
 
 	return 0;

From 4d4a3d106ae9ffb106d9e0aba7ceb89bb5ff9033 Mon Sep 17 00:00:00 2001
From: Alexander Aring <aahringo@redhat.com>
Date: Sun, 4 Apr 2021 20:30:42 -0400
Subject: [PATCH 1874/2658] net: ieee802154: stop dump llsec keys for monitors

[ Upstream commit fb3c5cdf88cd504ef11d59e8d656f4bc896c6922 ]

This patch stops dumping llsec keys for monitors which we don't support
yet. Otherwise we will access llsec mib which isn't initialized for
monitors.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-4-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl802154.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index c23c08f49c3c..78a0edf26854 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1481,6 +1481,11 @@ nl802154_dump_llsec_key(struct sk_buff *skb, struct netlink_callback *cb)
 	if (err)
 		return err;
 
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR) {
+		err = skb->len;
+		goto out_err;
+	}
+
 	if (!wpan_dev->netdev) {
 		err = -EINVAL;
 		goto out_err;

From 343a87b09cf0f08f1673ac0548df4d3967a05883 Mon Sep 17 00:00:00 2001
From: Alexander Aring <aahringo@redhat.com>
Date: Sun, 4 Apr 2021 20:30:45 -0400
Subject: [PATCH 1875/2658] net: ieee802154: stop dump llsec devs for monitors

[ Upstream commit 5582d641e6740839c9b83efd1fbf9bcd00b6f5fc ]

This patch stops dumping llsec devs for monitors which we don't support
yet. Otherwise we will access llsec mib which isn't initialized for
monitors.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-7-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl802154.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index 78a0edf26854..e4ba6764c4a3 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1658,6 +1658,11 @@ nl802154_dump_llsec_dev(struct sk_buff *skb, struct netlink_callback *cb)
 	if (err)
 		return err;
 
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR) {
+		err = skb->len;
+		goto out_err;
+	}
+
 	if (!wpan_dev->netdev) {
 		err = -EINVAL;
 		goto out_err;

From 6cb77a76a178d5e53c4793f58b81828cbe092a4f Mon Sep 17 00:00:00 2001
From: Alexander Aring <aahringo@redhat.com>
Date: Sun, 4 Apr 2021 20:30:46 -0400
Subject: [PATCH 1876/2658] net: ieee802154: forbid monitor for add llsec dev

[ Upstream commit 5303f956b05a2886ff42890908156afaec0f95ac ]

This patch forbids to add llsec dev for monitor interfaces which we
don't support yet. Otherwise we will access llsec mib which isn't
initialized for monitors.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-8-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl802154.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index e4ba6764c4a3..a602fd45e384 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1750,6 +1750,9 @@ static int nl802154_add_llsec_dev(struct sk_buff *skb, struct genl_info *info)
 	struct wpan_dev *wpan_dev = dev->ieee802154_ptr;
 	struct ieee802154_llsec_device dev_desc;
 
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
+		return -EOPNOTSUPP;
+
 	if (ieee802154_llsec_parse_device(info->attrs[NL802154_ATTR_SEC_DEVICE],
 					  &dev_desc) < 0)
 		return -EINVAL;

From 689ee221879ecf59ac9fed7dd5748a05283f04df Mon Sep 17 00:00:00 2001
From: Alexander Aring <aahringo@redhat.com>
Date: Sun, 4 Apr 2021 20:30:48 -0400
Subject: [PATCH 1877/2658] net: ieee802154: stop dump llsec devkeys for
 monitors

[ Upstream commit 080d1a57a94d93e70f84b7a360baa351388c574f ]

This patch stops dumping llsec devkeys for monitors which we don't support
yet. Otherwise we will access llsec mib which isn't initialized for
monitors.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-10-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl802154.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index a602fd45e384..19d0d22ff625 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1839,6 +1839,11 @@ nl802154_dump_llsec_devkey(struct sk_buff *skb, struct netlink_callback *cb)
 	if (err)
 		return err;
 
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR) {
+		err = skb->len;
+		goto out_err;
+	}
+
 	if (!wpan_dev->netdev) {
 		err = -EINVAL;
 		goto out_err;

From 6996bfcaace06a936f679c08fbc109e9c8b2bf5e Mon Sep 17 00:00:00 2001
From: Alexander Aring <aahringo@redhat.com>
Date: Sun, 4 Apr 2021 20:30:49 -0400
Subject: [PATCH 1878/2658] net: ieee802154: forbid monitor for add llsec
 devkey

[ Upstream commit a347b3b394868fef15b16f143719df56184be81d ]

This patch forbids to add llsec devkey for monitor interfaces which we
don't support yet. Otherwise we will access llsec mib which isn't
initialized for monitors.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-11-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl802154.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index 19d0d22ff625..4ee080f3a41d 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1901,6 +1901,9 @@ static int nl802154_add_llsec_devkey(struct sk_buff *skb, struct genl_info *info
 	struct ieee802154_llsec_device_key key;
 	__le64 extended_addr;
 
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
+		return -EOPNOTSUPP;
+
 	if (!info->attrs[NL802154_ATTR_SEC_DEVKEY] ||
 	    nla_parse_nested(attrs, NL802154_DEVKEY_ATTR_MAX,
 			     info->attrs[NL802154_ATTR_SEC_DEVKEY],

From a409b146da4022f22a2185be0b853233ca5302a6 Mon Sep 17 00:00:00 2001
From: Alexander Aring <aahringo@redhat.com>
Date: Sun, 4 Apr 2021 20:30:51 -0400
Subject: [PATCH 1879/2658] net: ieee802154: stop dump llsec seclevels for
 monitors

[ Upstream commit 4c9b4f55ad1f5a4b6206ac4ea58f273126d21925 ]

This patch stops dumping llsec seclevels for monitors which we don't
support yet. Otherwise we will access llsec mib which isn't initialized
for monitors.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-13-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl802154.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index 4ee080f3a41d..f07a3027d66c 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -2013,6 +2013,11 @@ nl802154_dump_llsec_seclevel(struct sk_buff *skb, struct netlink_callback *cb)
 	if (err)
 		return err;
 
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR) {
+		err = skb->len;
+		goto out_err;
+	}
+
 	if (!wpan_dev->netdev) {
 		err = -EINVAL;
 		goto out_err;

From 766b99e2d5d4c84fb83a746978eb3f289f6d960d Mon Sep 17 00:00:00 2001
From: Alexander Aring <aahringo@redhat.com>
Date: Sun, 4 Apr 2021 20:30:52 -0400
Subject: [PATCH 1880/2658] net: ieee802154: forbid monitor for add llsec
 seclevel

[ Upstream commit 9ec87e322428d4734ac647d1a8e507434086993d ]

This patch forbids to add llsec seclevel for monitor interfaces which we
don't support yet. Otherwise we will access llsec mib which isn't
initialized for monitors.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-14-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl802154.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index f07a3027d66c..b2ff2f7329c3 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -2103,6 +2103,9 @@ static int nl802154_add_llsec_seclevel(struct sk_buff *skb,
 	struct wpan_dev *wpan_dev = dev->ieee802154_ptr;
 	struct ieee802154_llsec_seclevel sl;
 
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
+		return -EOPNOTSUPP;
+
 	if (llsec_parse_seclevel(info->attrs[NL802154_ATTR_SEC_LEVEL],
 				 &sl) < 0)
 		return -EINVAL;

From 9c9a808aa13acb935c6020e35fea774b60b246ff Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Mon, 5 Apr 2021 21:29:22 -0700
Subject: [PATCH 1881/2658] pcnet32: Use pci_resource_len to validate PCI
 resource

[ Upstream commit 66c3f05ddc538ee796321210c906b6ae6fc0792a ]

pci_resource_start() is not a good indicator to determine if a PCI
resource exists or not, since the resource may start at address 0.
This is seen when trying to instantiate the driver in qemu for riscv32
or riscv64.

pci 0000:00:01.0: reg 0x10: [io  0x0000-0x001f]
pci 0000:00:01.0: reg 0x14: [mem 0x00000000-0x0000001f]
...
pcnet32: card has no PCI IO resources, aborting

Use pci_resouce_len() instead.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amd/pcnet32.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
index 7ccebae9cb48..b305903c91c4 100644
--- a/drivers/net/ethernet/amd/pcnet32.c
+++ b/drivers/net/ethernet/amd/pcnet32.c
@@ -1493,8 +1493,7 @@ pcnet32_probe_pci(struct pci_dev *pdev, const struct pci_device_id *ent)
 	}
 	pci_set_master(pdev);
 
-	ioaddr = pci_resource_start(pdev, 0);
-	if (!ioaddr) {
+	if (!pci_resource_len(pdev, 0)) {
 		if (pcnet32_debug & NETIF_MSG_PROBE)
 			pr_err("card has no PCI IO resources, aborting\n");
 		return -ENODEV;
@@ -1506,6 +1505,8 @@ pcnet32_probe_pci(struct pci_dev *pdev, const struct pci_device_id *ent)
 			pr_err("architecture does not support 32bit PCI busmaster DMA\n");
 		return err;
 	}
+
+	ioaddr = pci_resource_start(pdev, 0);
 	if (!request_region(ioaddr, PCNET32_TOTAL_SIZE, "pcnet32_probe_pci")) {
 		if (pcnet32_debug & NETIF_MSG_PROBE)
 			pr_err("io address range already allocated\n");

From 22aaaff7c287db566231e1d057a059b500ec91f9 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Tue, 23 Mar 2021 09:56:34 -0700
Subject: [PATCH 1882/2658] Input: i8042 - fix Pegatron C15B ID entry

commit daa58c8eec0a65ac8e2e77ff3ea8a233d8eec954 upstream.

The Zenbook Flip entry that was added overwrites a previous one
because of a typo:

In file included from drivers/input/serio/i8042.h:23,
                 from drivers/input/serio/i8042.c:131:
drivers/input/serio/i8042-x86ia64io.h:591:28: error: initialized field overwritten [-Werror=override-init]
  591 |                 .matches = {
      |                            ^
drivers/input/serio/i8042-x86ia64io.h:591:28: note: (near initialization for 'i8042_dmi_noselftest_table[0].matches')

Add the missing separator between the two.

Fixes: b5d6e7ab7fe7 ("Input: i8042 - add ASUS Zenbook Flip to noselftest list")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Marcos Paulo de Souza <mpdesouza@suse.com>
Link: https://lore.kernel.org/r/20210323130623.2302402-1-arnd@kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/serio/i8042-x86ia64io.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index ff0f3c3e2f80..3049bccf2422 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -579,6 +579,7 @@ static const struct dmi_system_id i8042_dmi_forcemux_table[] __initconst = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "VGN-CS"),
 		},
+	}, {
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
 			DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /* Convertible Notebook */

From 8bff903987ecf394f04c17593ab6913f87002021 Mon Sep 17 00:00:00 2001
From: Jolly Shah <jollys@google.com>
Date: Thu, 18 Mar 2021 15:56:32 -0700
Subject: [PATCH 1883/2658] scsi: libsas: Reset num_scatter if libata marks qc
 as NODATA

commit 176ddd89171ddcf661862d90c5d257877f7326d6 upstream.

When the cache_type for the SCSI device is changed, the SCSI layer issues a
MODE_SELECT command. The caching mode details are communicated via a
request buffer associated with the SCSI command with data direction set as
DMA_TO_DEVICE (scsi_mode_select()). When this command reaches the libata
layer, as a part of generic initial setup, libata layer sets up the
scatterlist for the command using the SCSI command (ata_scsi_qc_new()).
This command is then translated by the libata layer into
ATA_CMD_SET_FEATURES (ata_scsi_mode_select_xlat()). The libata layer treats
this as a non-data command (ata_mselect_caching()), since it only needs an
ATA taskfile to pass the caching on/off information to the device. It does
not need the scatterlist that has been setup, so it does not perform
dma_map_sg() on the scatterlist (ata_qc_issue()). Unfortunately, when this
command reaches the libsas layer (sas_ata_qc_issue()), libsas layer sees it
as a non-data command with a scatterlist. It cannot extract the correct DMA
length since the scatterlist has not been mapped with dma_map_sg() for a
DMA operation. When this partially constructed SAS task reaches pm80xx
LLDD, it results in the following warning:

"pm80xx_chip_sata_req 6058: The sg list address
start_addr=0x0000000000000000 data_len=0x0end_addr_high=0xffffffff
end_addr_low=0xffffffff has crossed 4G boundary"

Update libsas to handle ATA non-data commands separately so num_scatter and
total_xfer_len remain 0.

Link: https://lore.kernel.org/r/20210318225632.2481291-1-jollys@google.com
Fixes: 53de092f47ff ("scsi: libsas: Set data_dir as DMA_NONE if libata marks qc as NODATA")
Tested-by: Luo Jiaxing <luojiaxing@huawei.com>
Reviewed-by: John Garry <john.garry@huawei.com>
Signed-off-by: Jolly Shah <jollys@google.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/libsas/sas_ata.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 68b33abeaa5f..eba0d4ef546d 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -216,18 +216,17 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc)
 		memcpy(task->ata_task.atapi_packet, qc->cdb, qc->dev->cdb_len);
 		task->total_xfer_len = qc->nbytes;
 		task->num_scatter = qc->n_elem;
+		task->data_dir = qc->dma_dir;
+	} else if (qc->tf.protocol == ATA_PROT_NODATA) {
+		task->data_dir = DMA_NONE;
 	} else {
 		for_each_sg(qc->sg, sg, qc->n_elem, si)
 			xfer += sg_dma_len(sg);
 
 		task->total_xfer_len = xfer;
 		task->num_scatter = si;
-	}
-
-	if (qc->tf.protocol == ATA_PROT_NODATA)
-		task->data_dir = DMA_NONE;
-	else
 		task->data_dir = qc->dma_dir;
+	}
 	task->scatter = qc->sg;
 	task->ata_task.retry_count = 1;
 	task->task_state_flags = SAS_TASK_STATE_PENDING;

From 4c4c2bd1ee8d58f93001becb202c5543db11a3ab Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sun, 11 Apr 2021 11:02:08 +0200
Subject: [PATCH 1884/2658] net: davicom: Fix regulator not turned off on
 failed probe

commit 31457db3750c0b0ed229d836f2609fdb8a5b790e upstream.

When the probe fails, we must disable the regulator that was previously
enabled.

This patch is a follow-up to commit ac88c531a5b3
("net: davicom: Fix regulator not turned off on failed probe") which missed
one case.

Fixes: 7994fe55a4a2 ("dm9000: Add regulator and reset support to dm9000")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/davicom/dm9000.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
index ab06cf36af08..b8d82f32b2db 100644
--- a/drivers/net/ethernet/davicom/dm9000.c
+++ b/drivers/net/ethernet/davicom/dm9000.c
@@ -1484,8 +1484,10 @@ dm9000_probe(struct platform_device *pdev)
 
 	/* Init network device */
 	ndev = alloc_etherdev(sizeof(struct board_info));
-	if (!ndev)
-		return -ENOMEM;
+	if (!ndev) {
+		ret = -ENOMEM;
+		goto out_regulator_disable;
+	}
 
 	SET_NETDEV_DEV(ndev, &pdev->dev);
 

From 8a00ae8a6fb013c9cc3783095cc5c777b2abcb86 Mon Sep 17 00:00:00 2001
From: Jason Xing <xingwanli@kuaishou.com>
Date: Wed, 14 Apr 2021 10:34:28 +0800
Subject: [PATCH 1885/2658] i40e: fix the panic when running bpf in xdpdrv mode

commit 4e39a072a6a0fc422ba7da5e4336bdc295d70211 upstream.

Fix this panic by adding more rules to calculate the value of @rss_size_max
which could be used in allocating the queues when bpf is loaded, which,
however, could cause the failure and then trigger the NULL pointer of
vsi->rx_rings. Prio to this fix, the machine doesn't care about how many
cpus are online and then allocates 256 queues on the machine with 32 cpus
online actually.

Once the load of bpf begins, the log will go like this "failed to get
tracking for 256 queues for VSI 0 err -12" and this "setup of MAIN VSI
failed".

Thus, I attach the key information of the crash-log here.

BUG: unable to handle kernel NULL pointer dereference at
0000000000000000
RIP: 0010:i40e_xdp+0xdd/0x1b0 [i40e]
Call Trace:
[2160294.717292]  ? i40e_reconfig_rss_queues+0x170/0x170 [i40e]
[2160294.717666]  dev_xdp_install+0x4f/0x70
[2160294.718036]  dev_change_xdp_fd+0x11f/0x230
[2160294.718380]  ? dev_disable_lro+0xe0/0xe0
[2160294.718705]  do_setlink+0xac7/0xe70
[2160294.719035]  ? __nla_parse+0xed/0x120
[2160294.719365]  rtnl_newlink+0x73b/0x860

Fixes: 41c445ff0f48 ("i40e: main driver core")
Co-developed-by: Shujin Li <lishujin@kuaishou.com>
Signed-off-by: Shujin Li <lishujin@kuaishou.com>
Signed-off-by: Jason Xing <xingwanli@kuaishou.com>
Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/intel/i40e/i40e_main.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 756c4ea17655..8bdc17658f3f 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -8148,6 +8148,7 @@ static int i40e_sw_init(struct i40e_pf *pf)
 {
 	int err = 0;
 	int size;
+	u16 pow;
 
 	pf->msg_enable = netif_msg_init(I40E_DEFAULT_MSG_ENABLE,
 				(NETIF_MSG_DRV|NETIF_MSG_PROBE|NETIF_MSG_LINK));
@@ -8182,6 +8183,11 @@ static int i40e_sw_init(struct i40e_pf *pf)
 	pf->rss_table_size = pf->hw.func_caps.rss_table_size;
 	pf->rss_size_max = min_t(int, pf->rss_size_max,
 				 pf->hw.func_caps.num_tx_qp);
+
+	/* find the next higher power-of-2 of num cpus */
+	pow = roundup_pow_of_two(num_online_cpus());
+	pf->rss_size_max = min_t(int, pf->rss_size_max, pow);
+
 	if (pf->hw.func_caps.rss) {
 		pf->flags |= I40E_FLAG_RSS_ENABLED;
 		pf->rss_size = min_t(int, pf->rss_size_max, num_online_cpus());

From c724bee418b189be66b2e1fad5e49ede8f081f09 Mon Sep 17 00:00:00 2001
From: Fredrik Strupe <fredrik@strupe.net>
Date: Mon, 5 Apr 2021 21:52:05 +0100
Subject: [PATCH 1886/2658] ARM: 9071/1: uprobes: Don't hook on thumb
 instructions

commit d2f7eca60b29006285d57c7035539e33300e89e5 upstream.

Since uprobes is not supported for thumb, check that the thumb bit is
not set when matching the uprobes instruction hooks.

The Arm UDF instructions used for uprobes triggering
(UPROBE_SWBP_ARM_INSN and UPROBE_SS_ARM_INSN) coincidentally share the
same encoding as a pair of unallocated 32-bit thumb instructions (not
UDF) when the condition code is 0b1111 (0xf). This in effect makes it
possible to trigger the uprobes functionality from thumb, and at that
using two unallocated instructions which are not permanently undefined.

Signed-off-by: Fredrik Strupe <fredrik@strupe.net>
Cc: stable@vger.kernel.org
Fixes: c7edc9e326d5 ("ARM: add uprobes support")
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/probes/uprobes/core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/probes/uprobes/core.c b/arch/arm/probes/uprobes/core.c
index d1329f1ba4e4..b97230704b74 100644
--- a/arch/arm/probes/uprobes/core.c
+++ b/arch/arm/probes/uprobes/core.c
@@ -207,7 +207,7 @@ unsigned long uprobe_get_swbp_addr(struct pt_regs *regs)
 static struct undef_hook uprobes_arm_break_hook = {
 	.instr_mask	= 0x0fffffff,
 	.instr_val	= (UPROBE_SWBP_ARM_INSN & 0x0fffffff),
-	.cpsr_mask	= MODE_MASK,
+	.cpsr_mask	= (PSR_T_BIT | MODE_MASK),
 	.cpsr_val	= USR_MODE,
 	.fn		= uprobe_trap_handler,
 };
@@ -215,7 +215,7 @@ static struct undef_hook uprobes_arm_break_hook = {
 static struct undef_hook uprobes_arm_ss_hook = {
 	.instr_mask	= 0x0fffffff,
 	.instr_val	= (UPROBE_SS_ARM_INSN & 0x0fffffff),
-	.cpsr_mask	= MODE_MASK,
+	.cpsr_mask	= (PSR_T_BIT | MODE_MASK),
 	.cpsr_val	= USR_MODE,
 	.fn		= uprobe_trap_handler,
 };

From c8177ad2173ae61d68bda03c43ba0f874163721d Mon Sep 17 00:00:00 2001
From: Anirudh Rayabharam <mail@anirudhrb.com>
Date: Wed, 7 Apr 2021 22:57:22 +0530
Subject: [PATCH 1887/2658] net: hso: fix null-ptr-deref during tty device
 unregistration

commit 8a12f8836145ffe37e9c8733dce18c22fb668b66 upstream

Multiple ttys try to claim the same the minor number causing a double
unregistration of the same device. The first unregistration succeeds
but the next one results in a null-ptr-deref.

The get_free_serial_index() function returns an available minor number
but doesn't assign it immediately. The assignment is done by the caller
later. But before this assignment, calls to get_free_serial_index()
would return the same minor number.

Fix this by modifying get_free_serial_index to assign the minor number
immediately after one is found to be and rename it to obtain_minor()
to better reflect what it does. Similary, rename set_serial_by_index()
to release_minor() and modify it to free up the minor number of the
given hso_serial. Every obtain_minor() should have corresponding
release_minor() call.

Fixes: 72dc1c096c705 ("HSO: add option hso driver")
Reported-by: syzbot+c49fe6089f295a05e6f8@syzkaller.appspotmail.com
Tested-by: syzbot+c49fe6089f295a05e6f8@syzkaller.appspotmail.com
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/hso.c | 33 ++++++++++++---------------------
 1 file changed, 12 insertions(+), 21 deletions(-)

diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index efd4bf06f6ad..c0779fbc045d 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -635,7 +635,7 @@ static struct hso_serial *get_serial_by_index(unsigned index)
 	return serial;
 }
 
-static int get_free_serial_index(void)
+static int obtain_minor(struct hso_serial *serial)
 {
 	int index;
 	unsigned long flags;
@@ -643,8 +643,10 @@ static int get_free_serial_index(void)
 	spin_lock_irqsave(&serial_table_lock, flags);
 	for (index = 0; index < HSO_SERIAL_TTY_MINORS; index++) {
 		if (serial_table[index] == NULL) {
+			serial_table[index] = serial->parent;
+			serial->minor = index;
 			spin_unlock_irqrestore(&serial_table_lock, flags);
-			return index;
+			return 0;
 		}
 	}
 	spin_unlock_irqrestore(&serial_table_lock, flags);
@@ -653,15 +655,12 @@ static int get_free_serial_index(void)
 	return -1;
 }
 
-static void set_serial_by_index(unsigned index, struct hso_serial *serial)
+static void release_minor(struct hso_serial *serial)
 {
 	unsigned long flags;
 
 	spin_lock_irqsave(&serial_table_lock, flags);
-	if (serial)
-		serial_table[index] = serial->parent;
-	else
-		serial_table[index] = NULL;
+	serial_table[serial->minor] = NULL;
 	spin_unlock_irqrestore(&serial_table_lock, flags);
 }
 
@@ -2249,6 +2248,7 @@ static int hso_stop_serial_device(struct hso_device *hso_dev)
 static void hso_serial_tty_unregister(struct hso_serial *serial)
 {
 	tty_unregister_device(tty_drv, serial->minor);
+	release_minor(serial);
 }
 
 static void hso_serial_common_free(struct hso_serial *serial)
@@ -2273,25 +2273,23 @@ static int hso_serial_common_create(struct hso_serial *serial, int num_urbs,
 				    int rx_size, int tx_size)
 {
 	struct device *dev;
-	int minor;
 	int i;
 
 	tty_port_init(&serial->port);
 
-	minor = get_free_serial_index();
-	if (minor < 0)
+	if (obtain_minor(serial))
 		goto exit2;
 
 	/* register our minor number */
 	serial->parent->dev = tty_port_register_device_attr(&serial->port,
-			tty_drv, minor, &serial->parent->interface->dev,
+			tty_drv, serial->minor, &serial->parent->interface->dev,
 			serial->parent, hso_serial_dev_groups);
-	if (IS_ERR(serial->parent->dev))
+	if (IS_ERR(serial->parent->dev)) {
+		release_minor(serial);
 		goto exit2;
+	}
 	dev = serial->parent->dev;
 
-	/* fill in specific data for later use */
-	serial->minor = minor;
 	serial->magic = HSO_SERIAL_MAGIC;
 	spin_lock_init(&serial->serial_lock);
 	serial->num_rx_urbs = num_urbs;
@@ -2692,9 +2690,6 @@ static struct hso_device *hso_create_bulk_serial_device(
 
 	serial->write_data = hso_std_serial_write_data;
 
-	/* and record this serial */
-	set_serial_by_index(serial->minor, serial);
-
 	/* setup the proc dirs and files if needed */
 	hso_log_port(hso_dev);
 
@@ -2751,9 +2746,6 @@ struct hso_device *hso_create_mux_serial_device(struct usb_interface *interface,
 	serial->shared_int->ref_count++;
 	mutex_unlock(&serial->shared_int->shared_int_lock);
 
-	/* and record this serial */
-	set_serial_by_index(serial->minor, serial);
-
 	/* setup the proc dirs and files if needed */
 	hso_log_port(hso_dev);
 
@@ -3140,7 +3132,6 @@ static void hso_free_interface(struct usb_interface *interface)
 			cancel_work_sync(&serial_table[i]->async_get_intf);
 			hso_serial_tty_unregister(serial);
 			kref_put(&serial_table[i]->ref, hso_serial_ref_free);
-			set_serial_by_index(i, NULL);
 		}
 	}
 

From 8729b156fd19cca16cf3f311eb92af6435647fae Mon Sep 17 00:00:00 2001
From: Zhang Yi <yi.zhang@huawei.com>
Date: Fri, 23 Apr 2021 20:35:07 +0800
Subject: [PATCH 1888/2658] ext4: correct error label in ext4_rename()

The backport of upstream patch 5dccdc5a1916 ("ext4: do not iput inode
under running transaction in ext4_rename()") introduced a regression on
the stable kernels 4.14 and older. One of the end_rename error label was
forgetting to change to release_bh, which may trigger below bug.

 ------------[ cut here ]------------
 kernel BUG at /home/zhangyi/hulk-4.4/fs/ext4/ext4_jbd2.c:30!
 ...
 Call Trace:
  [<ffffffff8b4207b2>] ext4_rename+0x9e2/0x10c0
  [<ffffffff8b331324>] ? unlazy_walk+0x124/0x2a0
  [<ffffffff8b420eb5>] ext4_rename2+0x25/0x60
  [<ffffffff8b335104>] vfs_rename+0x3a4/0xed0
  [<ffffffff8b33a7ad>] SYSC_renameat2+0x57d/0x7f0
  [<ffffffff8b33c119>] SyS_renameat+0x19/0x30
  [<ffffffff8bc57bb8>] entry_SYSCALL_64_fastpath+0x18/0x78
 ...
 ---[ end trace 75346ce7c76b9f06 ]---

Fixes: 2fc8ce56985d ("ext4: do not iput inode under running transaction in ext4_rename()")
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/namei.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index a52c72561483..d0a25c2da754 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3558,7 +3558,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
 	    !ext4_is_child_context_consistent_with_parent(new.dir,
 							  old.inode)) {
 		retval = -EXDEV;
-		goto end_rename;
+		goto release_bh;
 	}
 
 	new.bh = ext4_find_entry(new.dir, &new.dentry->d_name,

From 89a330a82c91cdc57a54cea6d89ac88c172215c7 Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Wed, 24 Mar 2021 15:10:32 +0200
Subject: [PATCH 1889/2658] ARM: dts: Fix swapped mmc order for omap3

[ Upstream commit a1ebdb3741993f853865d1bd8f77881916ad53a7 ]

Also some omap3 devices like n900 seem to have eMMC and micro-sd swapped
around with commit 21b2cec61c04 ("mmc: Set PROBE_PREFER_ASYNCHRONOUS for
drivers that existed in v4.4").

Let's fix the issue with aliases as discussed on the mailing lists. While
the mmc aliases should be board specific, let's first fix the issue with
minimal changes.

Cc: Aaro Koskinen <aaro.koskinen@iki.fi>
Cc: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/omap3.dtsi | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arm/boot/dts/omap3.dtsi b/arch/arm/boot/dts/omap3.dtsi
index 8a2b25332b8c..a2e41d79e829 100644
--- a/arch/arm/boot/dts/omap3.dtsi
+++ b/arch/arm/boot/dts/omap3.dtsi
@@ -22,6 +22,9 @@
 		i2c0 = &i2c1;
 		i2c1 = &i2c2;
 		i2c2 = &i2c3;
+		mmc0 = &mmc1;
+		mmc1 = &mmc2;
+		mmc2 = &mmc3;
 		serial0 = &uart1;
 		serial1 = &uart2;
 		serial2 = &uart3;

From d9734b7856160834ed624740825be0d080c5defd Mon Sep 17 00:00:00 2001
From: Vasily Gorbik <gor@linux.ibm.com>
Date: Fri, 9 Apr 2021 00:15:21 +0200
Subject: [PATCH 1890/2658] s390/entry: save the caller of psw_idle

[ Upstream commit a994eddb947ea9ebb7b14d9a1267001699f0a136 ]

Currently psw_idle does not allocate a stack frame and does not
save its r14 and r15 into the save area. Even though this is valid from
call ABI point of view, because psw_idle does not make any calls
explicitly, in reality psw_idle is an entry point for controlled
transition into serving interrupts. So, in practice, psw_idle stack
frame is analyzed during stack unwinding. Depending on build options
that r14 slot in the save area of psw_idle might either contain a value
saved by previous sibling call or complete garbage.

  [task    0000038000003c28] do_ext_irq+0xd6/0x160
  [task    0000038000003c78] ext_int_handler+0xba/0xe8
  [task   *0000038000003dd8] psw_idle_exit+0x0/0x8 <-- pt_regs
 ([task    0000038000003dd8] 0x0)
  [task    0000038000003e10] default_idle_call+0x42/0x148
  [task    0000038000003e30] do_idle+0xce/0x160
  [task    0000038000003e70] cpu_startup_entry+0x36/0x40
  [task    0000038000003ea0] arch_call_rest_init+0x76/0x80

So, to make a stacktrace nicer and actually point for the real caller of
psw_idle in this frequently occurring case, make psw_idle save its r14.

  [task    0000038000003c28] do_ext_irq+0xd6/0x160
  [task    0000038000003c78] ext_int_handler+0xba/0xe8
  [task   *0000038000003dd8] psw_idle_exit+0x0/0x6 <-- pt_regs
 ([task    0000038000003dd8] arch_cpu_idle+0x3c/0xd0)
  [task    0000038000003e10] default_idle_call+0x42/0x148
  [task    0000038000003e30] do_idle+0xce/0x160
  [task    0000038000003e70] cpu_startup_entry+0x36/0x40
  [task    0000038000003ea0] arch_call_rest_init+0x76/0x80

Reviewed-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/kernel/entry.S | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 4cad1adff16b..d43f18b3d42c 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -889,6 +889,7 @@ ENTRY(ext_int_handler)
  * Load idle PSW. The second "half" of this function is in .Lcleanup_idle.
  */
 ENTRY(psw_idle)
+	stg	%r14,(__SF_GPRS+8*8)(%r15)
 	stg	%r3,__SF_EMPTY(%r15)
 	larl	%r1,.Lpsw_idle_lpsw+4
 	stg	%r1,__SF_EMPTY+8(%r15)

From 915a1be00f804d15cd706d4a07bf199b6fc20573 Mon Sep 17 00:00:00 2001
From: Michael Brown <mbrown@fensystems.co.uk>
Date: Tue, 13 Apr 2021 16:25:12 +0100
Subject: [PATCH 1891/2658] xen-netback: Check for hotplug-status existence
 before watching

[ Upstream commit 2afeec08ab5c86ae21952151f726bfe184f6b23d ]

The logic in connect() is currently written with the assumption that
xenbus_watch_pathfmt() will return an error for a node that does not
exist.  This assumption is incorrect: xenstore does allow a watch to
be registered for a nonexistent node (and will send notifications
should the node be subsequently created).

As of commit 1f2565780 ("xen-netback: remove 'hotplug-status' once it
has served its purpose"), this leads to a failure when a domU
transitions into XenbusStateConnected more than once.  On the first
domU transition into Connected state, the "hotplug-status" node will
be deleted by the hotplug_status_changed() callback in dom0.  On the
second or subsequent domU transition into Connected state, the
hotplug_status_changed() callback will therefore never be invoked, and
so the backend will remain stuck in InitWait.

This failure prevents scenarios such as reloading the xen-netfront
module within a domU, or booting a domU via iPXE.  There is
unfortunately no way for the domU to work around this dom0 bug.

Fix by explicitly checking for existence of the "hotplug-status" node,
thereby creating the behaviour that was previously assumed to exist.

Signed-off-by: Michael Brown <mbrown@fensystems.co.uk>
Reviewed-by: Paul Durrant <paul@xen.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/xen-netback/xenbus.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 21c8e2720b40..683fd8560f2b 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -849,11 +849,15 @@ static void connect(struct backend_info *be)
 	xenvif_carrier_on(be->vif);
 
 	unregister_hotplug_status_watch(be);
-	err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch, NULL,
-				   hotplug_status_changed,
-				   "%s/%s", dev->nodename, "hotplug-status");
-	if (!err)
+	if (xenbus_exists(XBT_NIL, dev->nodename, "hotplug-status")) {
+		err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch,
+					   NULL, hotplug_status_changed,
+					   "%s/%s", dev->nodename,
+					   "hotplug-status");
+		if (err)
+			goto err;
 		be->have_hotplug_status_watch = 1;
+	}
 
 	netif_tx_wake_all_queues(be->vif->dev);
 

From 830335139d394bdb6e303e2b80cc3d17a3059045 Mon Sep 17 00:00:00 2001
From: Wan Jiabing <wanjiabing@vivo.com>
Date: Wed, 14 Apr 2021 19:31:48 +0800
Subject: [PATCH 1892/2658] cavium/liquidio: Fix duplicate argument

[ Upstream commit 416dcc5ce9d2a810477171c62ffa061a98f87367 ]

Fix the following coccicheck warning:

./drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h:413:6-28:
duplicated argument to & or |

The CN6XXX_INTR_M1UPB0_ERR here is duplicate.
Here should be CN6XXX_INTR_M1UNB0_ERR.

Signed-off-by: Wan Jiabing <wanjiabing@vivo.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h b/drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h
index 5e3aff242ad3..3ab84d18ad3a 100644
--- a/drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h
+++ b/drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h
@@ -417,7 +417,7 @@
 	   | CN6XXX_INTR_M0UNWI_ERR             \
 	   | CN6XXX_INTR_M1UPB0_ERR             \
 	   | CN6XXX_INTR_M1UPWI_ERR             \
-	   | CN6XXX_INTR_M1UPB0_ERR             \
+	   | CN6XXX_INTR_M1UNB0_ERR             \
 	   | CN6XXX_INTR_M1UNWI_ERR             \
 	   | CN6XXX_INTR_INSTR_DB_OF_ERR        \
 	   | CN6XXX_INTR_SLIST_DB_OF_ERR        \

From 9cfe11f6b225861ef5e6614f7f9842a1163553a5 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Fri, 16 Apr 2021 15:46:09 -0700
Subject: [PATCH 1893/2658] ia64: fix discontig.c section mismatches

[ Upstream commit e2af9da4f867a1a54f1252bf3abc1a5c63951778 ]

Fix IA64 discontig.c Section mismatch warnings.

When CONFIG_SPARSEMEM=y and CONFIG_MEMORY_HOTPLUG=y, the functions
computer_pernodesize() and scatter_node_data() should not be marked as
__meminit because they are needed after init, on any memory hotplug
event.  Also, early_nr_cpus_node() is called by compute_pernodesize(),
so early_nr_cpus_node() cannot be __meminit either.

  WARNING: modpost: vmlinux.o(.text.unlikely+0x1612): Section mismatch in reference from the function arch_alloc_nodedata() to the function .meminit.text:compute_pernodesize()
  The function arch_alloc_nodedata() references the function __meminit compute_pernodesize().
  This is often because arch_alloc_nodedata lacks a __meminit annotation or the annotation of compute_pernodesize is wrong.

  WARNING: modpost: vmlinux.o(.text.unlikely+0x1692): Section mismatch in reference from the function arch_refresh_nodedata() to the function .meminit.text:scatter_node_data()
  The function arch_refresh_nodedata() references the function __meminit scatter_node_data().
  This is often because arch_refresh_nodedata lacks a __meminit annotation or the annotation of scatter_node_data is wrong.

  WARNING: modpost: vmlinux.o(.text.unlikely+0x1502): Section mismatch in reference from the function compute_pernodesize() to the function .meminit.text:early_nr_cpus_node()
  The function compute_pernodesize() references the function __meminit early_nr_cpus_node().
  This is often because compute_pernodesize lacks a __meminit annotation or the annotation of early_nr_cpus_node is wrong.

Link: https://lkml.kernel.org/r/20210411001201.3069-1-rdunlap@infradead.org
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Mike Rapoport <rppt@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/ia64/mm/discontig.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/ia64/mm/discontig.c b/arch/ia64/mm/discontig.c
index 878626805369..3b0c892953ab 100644
--- a/arch/ia64/mm/discontig.c
+++ b/arch/ia64/mm/discontig.c
@@ -99,7 +99,7 @@ static int __init build_node_maps(unsigned long start, unsigned long len,
  * acpi_boot_init() (which builds the node_to_cpu_mask array) hasn't been
  * called yet.  Note that node 0 will also count all non-existent cpus.
  */
-static int __meminit early_nr_cpus_node(int node)
+static int early_nr_cpus_node(int node)
 {
 	int cpu, n = 0;
 
@@ -114,7 +114,7 @@ static int __meminit early_nr_cpus_node(int node)
  * compute_pernodesize - compute size of pernode data
  * @node: the node id.
  */
-static unsigned long __meminit compute_pernodesize(int node)
+static unsigned long compute_pernodesize(int node)
 {
 	unsigned long pernodesize = 0, cpus;
 
@@ -411,7 +411,7 @@ static void __init reserve_pernode_space(void)
 	}
 }
 
-static void __meminit scatter_node_data(void)
+static void scatter_node_data(void)
 {
 	pg_data_t **dst;
 	int node;

From d93f38244457e217ffa7d924aec7a57e1fe588d3 Mon Sep 17 00:00:00 2001
From: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Date: Fri, 16 Apr 2021 15:46:15 -0700
Subject: [PATCH 1894/2658] ia64: tools: remove duplicate definition of
 ia64_mf() on ia64

[ Upstream commit f4bf09dc3aaa4b07cd15630f2023f68cb2668809 ]

The ia64_mf() macro defined in tools/arch/ia64/include/asm/barrier.h is
already defined in <asm/gcc_intrin.h> on ia64 which causes libbpf
failing to build:

    CC       /usr/src/linux/tools/bpf/bpftool//libbpf/staticobjs/libbpf.o
  In file included from /usr/src/linux/tools/include/asm/barrier.h:24,
                   from /usr/src/linux/tools/include/linux/ring_buffer.h:4,
                   from libbpf.c:37:
  /usr/src/linux/tools/include/asm/../../arch/ia64/include/asm/barrier.h:43: error: "ia64_mf" redefined [-Werror]
     43 | #define ia64_mf()       asm volatile ("mf" ::: "memory")
        |
  In file included from /usr/include/ia64-linux-gnu/asm/intrinsics.h:20,
                   from /usr/include/ia64-linux-gnu/asm/swab.h:11,
                   from /usr/include/linux/swab.h:8,
                   from /usr/include/linux/byteorder/little_endian.h:13,
                   from /usr/include/ia64-linux-gnu/asm/byteorder.h:5,
                   from /usr/src/linux/tools/include/uapi/linux/perf_event.h:20,
                   from libbpf.c:36:
  /usr/include/ia64-linux-gnu/asm/gcc_intrin.h:382: note: this is the location of the previous definition
    382 | #define ia64_mf() __asm__ volatile ("mf" ::: "memory")
        |
  cc1: all warnings being treated as errors

Thus, remove the definition from tools/arch/ia64/include/asm/barrier.h.

Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/arch/ia64/include/asm/barrier.h | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/tools/arch/ia64/include/asm/barrier.h b/tools/arch/ia64/include/asm/barrier.h
index e4422b4b634e..94ae4a333a35 100644
--- a/tools/arch/ia64/include/asm/barrier.h
+++ b/tools/arch/ia64/include/asm/barrier.h
@@ -38,9 +38,6 @@
  * sequential memory pages only.
  */
 
-/* XXX From arch/ia64/include/uapi/asm/gcc_intrin.h */
-#define ia64_mf()       asm volatile ("mf" ::: "memory")
-
 #define mb()		ia64_mf()
 #define rmb()		mb()
 #define wmb()		mb()

From cb946a21e5931047973b9e997adee3631a3e8ab2 Mon Sep 17 00:00:00 2001
From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Date: Tue, 8 May 2018 00:36:27 +0200
Subject: [PATCH 1895/2658] compiler.h: enable builtin overflow checkers and
 add fallback code

commit f0907827a8a9152aedac2833ed1b674a7b2a44f2 upstream.

This adds wrappers for the __builtin overflow checkers present in gcc
5.1+ as well as fallback implementations for earlier compilers. It's not
that easy to implement the fully generic __builtin_X_overflow(T1 a, T2
b, T3 *d) in macros, so the fallback code assumes that T1, T2 and T3 are
the same. We obviously don't want the wrappers to have different
semantics depending on $GCC_VERSION, so we also insist on that even when
using the builtins.

There are a few problems with the 'a+b < a' idiom for checking for
overflow: For signed types, it relies on undefined behaviour and is
not actually complete (it doesn't check underflow;
e.g. INT_MIN+INT_MIN == 0 isn't caught). Due to type promotion it
is wrong for all types (signed and unsigned) narrower than
int. Similarly, when a and b does not have the same type, there are
subtle cases like

  u32 a;

  if (a + sizeof(foo) < a)
    return -EOVERFLOW;
  a += sizeof(foo);

where the test is always false on 64 bit platforms. Add to that that it
is not always possible to determine the types involved at a glance.

The new overflow.h is somewhat bulky, but that's mostly a result of
trying to be type-generic, complete (e.g. catching not only overflow
but also signed underflow) and not relying on undefined behaviour.

Linus is of course right [1] that for unsigned subtraction a-b, the
right way to check for overflow (underflow) is "b > a" and not
"__builtin_sub_overflow(a, b, &d)", but that's just one out of six cases
covered here, and included mostly for completeness.

So is it worth it? I think it is, if nothing else for the documentation
value of seeing

  if (check_add_overflow(a, b, &d))
    return -EGOAWAY;
  do_stuff_with(d);

instead of the open-coded (and possibly wrong and/or incomplete and/or
UBsan-tickling)

  if (a+b < a)
    return -EGOAWAY;
  do_stuff_with(a+b);

While gcc does recognize the 'a+b < a' idiom for testing unsigned add
overflow, it doesn't do nearly as good for unsigned multiplication
(there's also no single well-established idiom). So using
check_mul_overflow in kcalloc and friends may also make gcc generate
slightly better code.

[1] https://lkml.org/lkml/2015/11/2/658

Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/boot/dts/qcom/Makefile             |  307 ++
 .../boot/dts/qcom/apq8016-sbc-pmic-pins.dtsi  |   40 +
 .../boot/dts/qcom/apq8016-sbc-soc-pins.dtsi   |   13 +
 arch/arm64/boot/dts/qcom/apq8016-sbc.dts      |   21 +
 arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi     |  117 +
 .../dts/qcom/apq8096-auto-dragonboard.dtsi    | 1009 ++++
 arch/arm64/boot/dts/qcom/apq8096-ba.dtsi      |   18 +
 .../apq8096-camera-sensor-dragonboard.dtsi    |  258 ++
 .../dts/qcom/apq8096-camera-sensor-sbc.dtsi   |  240 +
 .../boot/dts/qcom/apq8096-dragonboard.dtsi    |  849 ++++
 arch/arm64/boot/dts/qcom/apq8096-sbc.dtsi     |  798 ++++
 .../dts/qcom/apq8096-v2-auto-dragonboard.dts  |   36 +
 .../boot/dts/qcom/apq8096-v2-dragonboard.dts  |   29 +
 .../arm64/boot/dts/qcom/apq8096-v2-liquid.dts |   23 +
 .../boot/dts/qcom/apq8096-v2-pmi8994-cdp.dts  |   23 +
 .../boot/dts/qcom/apq8096-v2-pmi8994-mtp.dts  |   23 +
 .../qcom/apq8096-v2-pmi8994-pm8004-cdp.dts    |   23 +
 .../apq8096-v2-pmi8994-pm8004-pmk8001-cdp.dts |   23 +
 .../qcom/apq8096-v2-pmi8994-pmk8001-cdp.dts   |   23 +
 arch/arm64/boot/dts/qcom/apq8096-v2.dtsi      |   34 +
 .../boot/dts/qcom/apq8096-v3-auto-adp.dts     |  161 +
 .../boot/dts/qcom/apq8096-v3-auto-cdp.dts     |   44 +
 .../dts/qcom/apq8096-v3-auto-dragonboard.dts  |   36 +
 .../boot/dts/qcom/apq8096-v3-dragonboard.dts  |   31 +
 .../arm64/boot/dts/qcom/apq8096-v3-liquid.dts |   23 +
 .../boot/dts/qcom/apq8096-v3-pmi8994-cdp.dts  |   23 +
 .../apq8096-v3-pmi8994-mdm9x55-i2s-cdp.dts    |  112 +
 .../apq8096-v3-pmi8994-mdm9x55-i2s-mtp.dts    |  111 +
 ...apq8096-v3-pmi8994-mdm9x55-slimbus-mtp.dts |  113 +
 .../boot/dts/qcom/apq8096-v3-pmi8994-mtp.dts  |   23 +
 .../qcom/apq8096-v3-pmi8994-pm8004-cdp.dts    |   23 +
 ...8096-v3-pmi8994-pm8004-mdm9x55-i2s-cdp.dts |  113 +
 .../apq8096-v3-pmi8994-pm8004-pmk8001-cdp.dts |   23 +
 ...pmi8994-pm8004-pmk8001-mdm9x55-i2s-cdp.dts |  113 +
 .../qcom/apq8096-v3-pmi8994-pmk8001-cdp.dts   |   23 +
 ...096-v3-pmi8994-pmk8001-mdm9x55-i2s-cdp.dts |  113 +
 .../boot/dts/qcom/apq8096-v3-pmi8996-cdp.dts  |   24 +
 .../qcom/apq8096-v3-pmi8996-dragonboard.dts   |   28 +
 .../apq8096-v3-pmi8996-mdm9x55-i2s-cdp.dts    |  113 +
 .../apq8096-v3-pmi8996-mdm9x55-i2s-mtp.dts    |  113 +
 ...apq8096-v3-pmi8996-mdm9x55-slimbus-mtp.dts |  114 +
 .../boot/dts/qcom/apq8096-v3-pmi8996-mtp.dts  |   24 +
 arch/arm64/boot/dts/qcom/apq8096-v3-sbc.dts   |   26 +
 .../dts/qcom/apq8096-v3.0-dragonboard.dts     |   26 +
 .../boot/dts/qcom/apq8096-v3.0-liquid.dts     |   23 +
 .../dts/qcom/apq8096-v3.0-pmi8994-cdp.dts     |   23 +
 .../dts/qcom/apq8096-v3.0-pmi8994-mtp.dts     |   23 +
 .../qcom/apq8096-v3.0-pmi8994-pm8004-cdp.dts  |   23 +
 ...pq8096-v3.0-pmi8994-pm8004-pmk8001-cdp.dts |   23 +
 .../qcom/apq8096-v3.0-pmi8994-pmk8001-cdp.dts |   23 +
 .../dts/qcom/apq8096-v3.0-pmi8996-cdp.dts     |   24 +
 .../dts/qcom/apq8096-v3.0-pmi8996-mtp.dts     |   24 +
 arch/arm64/boot/dts/qcom/apq8096-v3.0.dtsi    |   34 +
 arch/arm64/boot/dts/qcom/apq8096-v3.dtsi      |   34 +
 .../boot/dts/qcom/apq8096pro-auto-cdp.dts     |   44 +
 .../arm64/boot/dts/qcom/apq8096pro-liquid.dts |   23 +
 .../qcom/apq8096pro-v1.1-auto-adp-lite.dts    |   95 +
 .../dts/qcom/apq8096pro-v1.1-auto-adp.dts     |   88 +
 .../dts/qcom/apq8096pro-v1.1-auto-cdp.dts     |   37 +
 arch/arm64/boot/dts/qcom/apq8096pro-v1.1.dtsi |   34 +
 arch/arm64/boot/dts/qcom/apq8096pro.dtsi      |   34 +
 arch/arm64/boot/dts/qcom/apq8098-cdp.dts      |   23 +
 arch/arm64/boot/dts/qcom/apq8098-mtp.dts      |   23 +
 arch/arm64/boot/dts/qcom/apq8098-v2-cdp.dts   |   23 +
 arch/arm64/boot/dts/qcom/apq8098-v2-mtp.dts   |   23 +
 .../boot/dts/qcom/apq8098-v2-qrd-skuk-hdk.dts |   24 +
 arch/arm64/boot/dts/qcom/apq8098-v2-qrd.dts   |   23 +
 arch/arm64/boot/dts/qcom/apq8098-v2.1-cdp.dts |   23 +
 .../boot/dts/qcom/apq8098-v2.1-mediabox.dts   |  121 +
 arch/arm64/boot/dts/qcom/apq8098-v2.1-mtp.dts |   23 +
 arch/arm64/boot/dts/qcom/apq8098-v2.1-qrd.dts |   23 +
 .../boot/dts/qcom/apq8098-v2.1-svr20.dts      |   22 +
 arch/arm64/boot/dts/qcom/apq8098-v2.1.dtsi    |   28 +
 arch/arm64/boot/dts/qcom/apq8098-v2.dtsi      |   28 +
 arch/arm64/boot/dts/qcom/apq8098.dtsi         |   28 +
 .../dts/qcom/batterydata-ascent-3450mAh.dtsi  |   60 +
 .../batterydata-itech-3000mah-4200mv.dtsi     |   56 +
 .../dts/qcom/batterydata-itech-3000mah.dtsi   |   59 +
 .../qcom/batterydata-liquid-7650-sanyo.dtsi   |   62 +
 .../dts/qcom/batterydata-mtp-3000mah.dtsi     |  118 +
 .../boot/dts/qcom/batterydata-palladium.dtsi  |  121 +
 .../dts/qcom/batterydata-qrd-4v2-1300mah.dtsi |  106 +
 .../dts/qcom/batterydata-qrd-4v2-1800mah.dtsi |  106 +
 .../dts/qcom/batterydata-qrd-4v2-2000mah.dtsi |  106 +
 .../dts/qcom/batterydata-qrd-4v2-2200mah.dtsi |  106 +
 .../qcom/batterydata-qrd-4v35-2000mah.dtsi    |  110 +
 .../qcom/batterydata-qrd-4v35-2500mah.dtsi    |  106 +
 .../batterydata-qrd-sku1-4v4-2800mah.dtsi     |   62 +
 .../batterydata-qrd-skua-4v35-2000mah.dtsi    |  122 +
 .../batterydata-qrd-skuh-4v35-2000mah.dtsi    |  115 +
 .../batterydata-qrd-skuic-4v35-1850mah.dtsi   |  121 +
 .../batterydata-qrd-skul-4v4-2920mah.dtsi     |  120 +
 .../batterydata-qrd-skum-4v4-2920mah.dtsi     |   61 +
 .../boot/dts/qcom/dsi-adv7533-1024-600p.dtsi  |   75 +
 .../boot/dts/qcom/dsi-adv7533-1080p.dtsi      |   75 +
 .../arm64/boot/dts/qcom/dsi-adv7533-720p.dtsi |   74 +
 .../dsi-panel-hx8379a-truly-fwvga-video.dtsi  |  138 +
 .../qcom/dsi-panel-hx8394f-720p-video.dtsi    |  122 +
 .../dts/qcom/dsi-panel-jdi-1080p-video.dtsi   |   76 +
 ...dsi-panel-jdi-4k-dualmipi-video-nofbc.dtsi |   68 +
 .../qcom/dsi-panel-jdi-4k-dualmipi-video.dtsi |   88 +
 .../dsi-panel-jdi-a407-dualmipi-wqhd-cmd.dtsi |   95 +
 .../dts/qcom/dsi-panel-jdi-dualmipi-cmd.dtsi  |  136 +
 .../qcom/dsi-panel-jdi-dualmipi-video.dtsi    |  125 +
 .../dts/qcom/dsi-panel-jdi-fhd-video.dtsi     |   83 +
 .../qcom/dsi-panel-nt35597-dsc-wqxga-cmd.dtsi |  136 +
 .../dsi-panel-nt35597-dsc-wqxga-video.dtsi    |  125 +
 .../dsi-panel-nt35597-dualmipi-wqxga-cmd.dtsi |  105 +
 ...si-panel-nt35597-dualmipi-wqxga-video.dtsi |   94 +
 ...dsi-panel-nt35597-truly-dsc-wqxga-cmd.dtsi |  267 ++
 ...i-panel-nt35597-truly-dsc-wqxga-video.dtsi |  253 +
 ...anel-nt35597-truly-dualmipi-wqxga-cmd.dtsi |  228 +
 ...el-nt35597-truly-dualmipi-wqxga-video.dtsi |  215 +
 .../dsi-panel-nt35695b-truly-fhd-cmd.dtsi     |  190 +
 .../dsi-panel-nt35695b-truly-fhd-video.dtsi   |  184 +
 .../qcom/dsi-panel-nt35950-dsc-4k-cmd.dtsi    |  284 ++
 ...panel-nt36850-truly-dualmipi-wqhd-cmd.dtsi |  416 ++
 .../qcom/dsi-panel-otm1906c-1080p-cmd.dtsi    |  380 ++
 .../dts/qcom/dsi-panel-r69006-1080p-cmd.dtsi  |  153 +
 .../qcom/dsi-panel-r69006-1080p-video.dtsi    |  129 +
 .../dsi-panel-r69007-dualdsi-wqxga-cmd.dtsi   |  107 +
 .../dsi-panel-rm67195-amoled-fhd-cmd.dtsi     |  131 +
 ...anel-s6e3ha3-amoled-dualmipi-wqhd-cmd.dtsi |  145 +
 .../dts/qcom/dsi-panel-sharp-1080p-cmd.dtsi   |   81 +
 .../dts/qcom/dsi-panel-sharp-dsc-4k-cmd.dtsi  |  100 +
 .../qcom/dsi-panel-sharp-dsc-4k-video.dtsi    |   92 +
 .../dsi-panel-sharp-dualmipi-1080p-120hz.dtsi |  636 +++
 .../dsi-panel-sharp-dualmipi-wqxga-video.dtsi |   78 +
 ...si-panel-sharp-split-link-wuxga-video.dtsi |   68 +
 .../boot/dts/qcom/dsi-panel-sim-cmd.dtsi      |  109 +
 .../dts/qcom/dsi-panel-sim-dualmipi-cmd.dtsi  |   92 +
 .../qcom/dsi-panel-sim-dualmipi-video.dtsi    |   59 +
 .../boot/dts/qcom/dsi-panel-sim-video.dtsi    |   56 +
 .../qcom/dsi-panel-toshiba-720p-video.dtsi    |  100 +
 .../dts/qcom/dsi-panel-truly-1080p-cmd.dtsi   |   95 +
 .../dts/qcom/dsi-panel-truly-1080p-video.dtsi |   89 +
 .../arm64/boot/dts/qcom/external-mdm9640.dtsi |   52 +
 arch/arm64/boot/dts/qcom/external-soc.dtsi    |   37 +
 .../fg-gen3-batterydata-ascent-2800mah.dtsi   |   81 +
 .../fg-gen3-batterydata-ascent-3450mah.dtsi   |   81 +
 .../fg-gen3-batterydata-demo-6000mah.dtsi     |   78 +
 .../fg-gen3-batterydata-itech-3000mah.dtsi    |   81 +
 ...gen3-batterydata-qrd-skuk-4v4-3000mah.dtsi |   81 +
 .../fg-gen3-batterydata-svr-v2-3200mah.dtsi   |   84 +
 .../arm64/boot/dts/qcom/msm-arm-smmu-630.dtsi |   45 +
 .../arm64/boot/dts/qcom/msm-arm-smmu-660.dtsi |  213 +
 .../boot/dts/qcom/msm-arm-smmu-8996.dtsi      |  266 ++
 .../boot/dts/qcom/msm-arm-smmu-8998.dtsi      |  192 +
 .../dts/qcom/msm-arm-smmu-impl-defs-660.dtsi  |  409 ++
 .../qcom/msm-arm-smmu-impl-defs-8996-v2.dtsi  |  643 +++
 .../qcom/msm-arm-smmu-impl-defs-8996-v3.dtsi  |  646 +++
 .../dts/qcom/msm-arm-smmu-impl-defs-8998.dtsi |  565 +++
 arch/arm64/boot/dts/qcom/msm-arm-smmu.dtsi    |   99 +
 arch/arm64/boot/dts/qcom/msm-audio-lpass.dtsi |  529 +++
 arch/arm64/boot/dts/qcom/msm-audio.dtsi       |  964 ++++
 arch/arm64/boot/dts/qcom/msm-gdsc-660.dtsi    |  159 +
 arch/arm64/boot/dts/qcom/msm-gdsc-8996.dtsi   |  214 +
 arch/arm64/boot/dts/qcom/msm-gdsc-8998.dtsi   |  146 +
 .../dts/qcom/msm-pm660-rpm-regulator.dtsi     |  298 ++
 arch/arm64/boot/dts/qcom/msm-pm660.dtsi       |  657 +++
 arch/arm64/boot/dts/qcom/msm-pm660a.dtsi      |   29 +
 .../dts/qcom/msm-pm660l-rpm-regulator.dtsi    |  238 +
 arch/arm64/boot/dts/qcom/msm-pm660l.dtsi      |  469 ++
 arch/arm64/boot/dts/qcom/msm-pm8004.dtsi      |   86 +
 arch/arm64/boot/dts/qcom/msm-pm8005.dtsi      |  103 +
 .../dts/qcom/msm-pm8994-rpm-regulator.dtsi    |  658 +++
 arch/arm64/boot/dts/qcom/msm-pm8994.dtsi      |  431 ++
 .../dts/qcom/msm-pm8998-rpm-regulator.dtsi    |  600 +++
 arch/arm64/boot/dts/qcom/msm-pm8998.dtsi      |  329 ++
 arch/arm64/boot/dts/qcom/msm-pmi8994.dtsi     |  699 +++
 arch/arm64/boot/dts/qcom/msm-pmi8996.dtsi     |   37 +
 arch/arm64/boot/dts/qcom/msm-pmi8998.dtsi     |  777 ++++
 arch/arm64/boot/dts/qcom/msm-pmk8001.dtsi     |   89 +
 arch/arm64/boot/dts/qcom/msm-rdbg.dtsi        |  106 +
 arch/arm64/boot/dts/qcom/msm-smb138x.dtsi     |  137 +
 arch/arm64/boot/dts/qcom/msm8916-mtp.dts      |   22 +
 arch/arm64/boot/dts/qcom/msm8916-mtp.dtsi     |   34 +
 arch/arm64/boot/dts/qcom/msm8916-pins.dtsi    |  502 ++
 arch/arm64/boot/dts/qcom/msm8916.dtsi         |  443 ++
 .../boot/dts/qcom/msm8996-agave-adp.dtsi      | 1467 ++++++
 .../arm64/boot/dts/qcom/msm8996-auto-cdp.dtsi | 1242 +++++
 arch/arm64/boot/dts/qcom/msm8996-blsp.dtsi    |  174 +
 arch/arm64/boot/dts/qcom/msm8996-bus.dtsi     | 1813 ++++++++
 .../dts/qcom/msm8996-camera-sensor-adp.dtsi   |  238 +
 .../dts/qcom/msm8996-camera-sensor-cdp.dtsi   |  248 +
 .../dts/qcom/msm8996-camera-sensor-dtp.dtsi   |  238 +
 .../qcom/msm8996-camera-sensor-liquid.dtsi    |  249 +
 .../dts/qcom/msm8996-camera-sensor-mtp.dtsi   |  251 +
 arch/arm64/boot/dts/qcom/msm8996-camera.dtsi  |  850 ++++
 arch/arm64/boot/dts/qcom/msm8996-cdp.dtsi     |  852 ++++
 .../boot/dts/qcom/msm8996-coresight-v2.dtsi   | 1127 +++++
 .../boot/dts/qcom/msm8996-coresight-v3.dtsi   | 1385 ++++++
 arch/arm64/boot/dts/qcom/msm8996-dtp.dtsi     |  683 +++
 arch/arm64/boot/dts/qcom/msm8996-fluid.dtsi   |  664 +++
 arch/arm64/boot/dts/qcom/msm8996-gpu.dtsi     |  262 ++
 arch/arm64/boot/dts/qcom/msm8996-ion.dtsi     |   47 +
 .../boot/dts/qcom/msm8996-ipcrouter.dtsi      |   58 +
 arch/arm64/boot/dts/qcom/msm8996-liquid.dtsi  |  651 +++
 .../boot/dts/qcom/msm8996-mdss-panels.dtsi    |  274 ++
 .../arm64/boot/dts/qcom/msm8996-mdss-pll.dtsi |  138 +
 arch/arm64/boot/dts/qcom/msm8996-mdss.dtsi    |  569 +++
 .../arm64/boot/dts/qcom/msm8996-mmxf-adp.dtsi |  907 ++++
 arch/arm64/boot/dts/qcom/msm8996-mtp.dtsi     |  961 ++++
 arch/arm64/boot/dts/qcom/msm8996-pinctrl.dtsi | 2735 +++++++++++
 arch/arm64/boot/dts/qcom/msm8996-pm.dtsi      |  596 +++
 .../qcom/msm8996-pm8994-pm8004-pmk8001.dtsi   |   31 +
 .../boot/dts/qcom/msm8996-pm8994-pm8004.dtsi  |   33 +
 ...msm8996-pm8994-pmi8994-pm8004-pmk8001.dtsi |   31 +
 .../qcom/msm8996-pm8994-pmi8994-pm8004.dtsi   |   38 +
 .../qcom/msm8996-pm8994-pmi8994-pmk8001.dtsi  |   30 +
 .../qcom/msm8996-pm8994-pmi8996-pmk8001.dtsi  |   31 +
 arch/arm64/boot/dts/qcom/msm8996-pm8994.dtsi  |   35 +
 .../boot/dts/qcom/msm8996-regulator.dtsi      | 1990 ++++++++
 .../boot/dts/qcom/msm8996-sde-display.dtsi    |  411 ++
 arch/arm64/boot/dts/qcom/msm8996-sde.dtsi     |  520 +++
 arch/arm64/boot/dts/qcom/msm8996-sim.dtsi     |  102 +
 arch/arm64/boot/dts/qcom/msm8996-smp2p.dtsi   |  247 +
 arch/arm64/boot/dts/qcom/msm8996-v2-dtp.dts   |   22 +
 arch/arm64/boot/dts/qcom/msm8996-v2-fluid.dts |   23 +
 .../arm64/boot/dts/qcom/msm8996-v2-liquid.dts |   23 +
 .../boot/dts/qcom/msm8996-v2-pmi8994-cdp.dts  |   23 +
 .../boot/dts/qcom/msm8996-v2-pmi8994-mtp.dts  |   61 +
 .../qcom/msm8996-v2-pmi8994-pm8004-cdp.dts    |   23 +
 .../qcom/msm8996-v2-pmi8994-pm8004-mtp.dts    |   23 +
 .../msm8996-v2-pmi8994-pm8004-pmk8001-cdp.dts |   23 +
 .../msm8996-v2-pmi8994-pm8004-pmk8001-mtp.dts |   23 +
 .../qcom/msm8996-v2-pmi8994-pmk8001-cdp.dts   |   23 +
 .../qcom/msm8996-v2-pmi8994-pmk8001-mtp.dts   |   23 +
 arch/arm64/boot/dts/qcom/msm8996-v2.dtsi      |  792 ++++
 .../boot/dts/qcom/msm8996-v3-auto-adp.dts     |   83 +
 .../boot/dts/qcom/msm8996-v3-auto-cdp.dts     |   49 +
 arch/arm64/boot/dts/qcom/msm8996-v3-dtp.dts   |   22 +
 arch/arm64/boot/dts/qcom/msm8996-v3-fluid.dts |   23 +
 .../arm64/boot/dts/qcom/msm8996-v3-liquid.dts |   23 +
 .../qcom/msm8996-v3-pm8004-agave-adp-lite.dts |   27 +
 .../dts/qcom/msm8996-v3-pm8004-agave-adp.dts  |   34 +
 .../dts/qcom/msm8996-v3-pm8004-mmxf-adp.dts   |   23 +
 .../boot/dts/qcom/msm8996-v3-pmi8994-cdp.dts  |   23 +
 .../boot/dts/qcom/msm8996-v3-pmi8994-mtp.dts  |   23 +
 .../qcom/msm8996-v3-pmi8994-pm8004-cdp.dts    |   23 +
 .../qcom/msm8996-v3-pmi8994-pm8004-mtp.dts    |   23 +
 .../msm8996-v3-pmi8994-pm8004-pmk8001-cdp.dts |   23 +
 .../msm8996-v3-pmi8994-pm8004-pmk8001-mtp.dts |   23 +
 .../qcom/msm8996-v3-pmi8994-pmk8001-cdp.dts   |   23 +
 .../qcom/msm8996-v3-pmi8994-pmk8001-mtp.dts   |   23 +
 .../boot/dts/qcom/msm8996-v3-pmi8996-cdp.dts  |   24 +
 .../boot/dts/qcom/msm8996-v3-pmi8996-mtp.dts  |   24 +
 .../qcom/msm8996-v3-pmi8996-pmk8001-cdp.dts   |   23 +
 .../qcom/msm8996-v3-pmi8996-pmk8001-mtp.dts   |   23 +
 arch/arm64/boot/dts/qcom/msm8996-v3.0-dtp.dts |   23 +
 .../boot/dts/qcom/msm8996-v3.0-fluid.dts      |   23 +
 .../boot/dts/qcom/msm8996-v3.0-liquid.dts     |   23 +
 .../dts/qcom/msm8996-v3.0-pmi8994-cdp.dts     |   23 +
 .../dts/qcom/msm8996-v3.0-pmi8994-mtp.dts     |   23 +
 .../qcom/msm8996-v3.0-pmi8994-pm8004-cdp.dts  |   23 +
 .../qcom/msm8996-v3.0-pmi8994-pm8004-mtp.dts  |   23 +
 ...sm8996-v3.0-pmi8994-pm8004-pmk8001-cdp.dts |   23 +
 .../qcom/msm8996-v3.0-pmi8994-pmk8001-cdp.dts |   23 +
 .../dts/qcom/msm8996-v3.0-pmi8996-cdp.dts     |   24 +
 .../dts/qcom/msm8996-v3.0-pmi8996-mtp.dts     |   24 +
 arch/arm64/boot/dts/qcom/msm8996-v3.0.dtsi    |  131 +
 arch/arm64/boot/dts/qcom/msm8996-v3.dtsi      |  746 +++
 arch/arm64/boot/dts/qcom/msm8996-vidc.dtsi    |  240 +
 arch/arm64/boot/dts/qcom/msm8996-wsa881x.dtsi |   45 +
 arch/arm64/boot/dts/qcom/msm8996.dtsi         | 4096 +++++++++++++++++
 .../dts/qcom/msm8996pro-auto-adp-lite.dts     |   94 +
 .../boot/dts/qcom/msm8996pro-auto-adp.dts     |   88 +
 .../boot/dts/qcom/msm8996pro-auto-cdp.dts     |   49 +
 arch/arm64/boot/dts/qcom/msm8996pro-auto.dtsi |  470 ++
 .../boot/dts/qcom/msm8996pro-pmi8994-cdp.dts  |   23 +
 .../boot/dts/qcom/msm8996pro-pmi8994-mtp.dts  |   23 +
 .../qcom/msm8996pro-pmi8994-pm8004-cdp.dts    |   23 +
 .../qcom/msm8996pro-pmi8994-pm8004-mtp.dts    |   23 +
 .../msm8996pro-pmi8994-pm8004-pmk8001-cdp.dts |   23 +
 .../msm8996pro-pmi8994-pm8004-pmk8001-mtp.dts |   23 +
 .../qcom/msm8996pro-pmi8994-pmk8001-cdp.dts   |   23 +
 .../qcom/msm8996pro-pmi8994-pmk8001-mtp.dts   |   23 +
 .../boot/dts/qcom/msm8996pro-pmi8996-cdp.dts  |   24 +
 .../boot/dts/qcom/msm8996pro-pmi8996-mtp.dts  |   24 +
 .../qcom/msm8996pro-pmi8996-pmk8001-cdp.dts   |   23 +
 .../qcom/msm8996pro-pmi8996-pmk8001-mtp.dts   |   23 +
 .../dts/qcom/msm8996pro-v1.1-auto-cdp.dts     |   42 +
 .../dts/qcom/msm8996pro-v1.1-pmi8994-cdp.dts  |   23 +
 .../dts/qcom/msm8996pro-v1.1-pmi8994-mtp.dts  |   23 +
 .../msm8996pro-v1.1-pmi8994-pm8004-cdp.dts    |   24 +
 .../msm8996pro-v1.1-pmi8994-pm8004-mtp.dts    |   24 +
 ...996pro-v1.1-pmi8994-pm8004-pmk8001-cdp.dts |   24 +
 ...996pro-v1.1-pmi8994-pm8004-pmk8001-mtp.dts |   24 +
 .../msm8996pro-v1.1-pmi8994-pmk8001-cdp.dts   |   24 +
 .../msm8996pro-v1.1-pmi8994-pmk8001-mtp.dts   |   24 +
 .../dts/qcom/msm8996pro-v1.1-pmi8996-cdp.dts  |   24 +
 .../dts/qcom/msm8996pro-v1.1-pmi8996-mtp.dts  |   24 +
 .../msm8996pro-v1.1-pmi8996-pmk8001-cdp.dts   |   24 +
 .../msm8996pro-v1.1-pmi8996-pmk8001-mtp.dts   |   24 +
 arch/arm64/boot/dts/qcom/msm8996pro-v1.1.dtsi |   23 +
 arch/arm64/boot/dts/qcom/msm8996pro.dtsi      | 1570 +++++++
 arch/arm64/boot/dts/qcom/msm8996v3-auto.dtsi  |  206 +
 arch/arm64/boot/dts/qcom/msm8998-9x55-cdp.dts |   24 +
 arch/arm64/boot/dts/qcom/msm8998-9x55-mtp.dts |   24 +
 arch/arm64/boot/dts/qcom/msm8998-9x55-rcm.dts |   24 +
 arch/arm64/boot/dts/qcom/msm8998-9x55.dtsi    |   25 +
 arch/arm64/boot/dts/qcom/msm8998-audio.dtsi   |  490 ++
 arch/arm64/boot/dts/qcom/msm8998-blsp.dtsi    |  863 ++++
 arch/arm64/boot/dts/qcom/msm8998-bus.dtsi     | 1467 ++++++
 .../dts/qcom/msm8998-camera-sensor-cdp.dtsi   |  380 ++
 .../dts/qcom/msm8998-camera-sensor-mtp.dtsi   |  422 ++
 .../qcom/msm8998-camera-sensor-qrd-vr1.dtsi   |  424 ++
 .../dts/qcom/msm8998-camera-sensor-qrd.dtsi   |  356 ++
 .../qcom/msm8998-camera-sensor-skuk-evt3.dtsi |  454 ++
 .../qcom/msm8998-camera-sensor-skuk-hdk.dtsi  |   61 +
 .../dts/qcom/msm8998-camera-sensor-skuk.dtsi  |  441 ++
 .../dts/qcom/msm8998-camera-sensor-svr20.dtsi |  399 ++
 arch/arm64/boot/dts/qcom/msm8998-camera.dtsi  |  909 ++++
 .../boot/dts/qcom/msm8998-cdp-overlay.dts     |   29 +
 arch/arm64/boot/dts/qcom/msm8998-cdp.dts      |   39 +
 arch/arm64/boot/dts/qcom/msm8998-cdp.dtsi     |  577 +++
 .../boot/dts/qcom/msm8998-coresight.dtsi      | 1601 +++++++
 arch/arm64/boot/dts/qcom/msm8998-gpu.dtsi     |  277 ++
 .../msm8998-interposer-camera-sensor-cdp.dtsi |  445 ++
 .../msm8998-interposer-camera-sensor-mtp.dtsi |  449 ++
 .../msm8998-interposer-camera-sensor-qrd.dtsi |  519 +++
 .../dts/qcom/msm8998-interposer-pm660.dtsi    |  264 ++
 .../qcom/msm8998-interposer-sdm660-audio.dtsi |   70 +
 .../qcom/msm8998-interposer-sdm660-cdp.dtsi   |  512 +++
 .../qcom/msm8998-interposer-sdm660-mtp.dtsi   |  505 ++
 .../dts/qcom/msm8998-interposer-sdm660.dtsi   | 3155 +++++++++++++
 arch/arm64/boot/dts/qcom/msm8998-ion.dtsi     |   53 +
 .../boot/dts/qcom/msm8998-mdss-panels.dtsi    |  229 +
 .../arm64/boot/dts/qcom/msm8998-mdss-pll.dtsi |  173 +
 arch/arm64/boot/dts/qcom/msm8998-mdss.dtsi    |  668 +++
 .../boot/dts/qcom/msm8998-mtp-overlay.dts     |   29 +
 arch/arm64/boot/dts/qcom/msm8998-mtp.dts      |   39 +
 arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi     |  615 +++
 arch/arm64/boot/dts/qcom/msm8998-pinctrl.dtsi | 3363 ++++++++++++++
 arch/arm64/boot/dts/qcom/msm8998-pm.dtsi      |  807 ++++
 .../boot/dts/qcom/msm8998-qrd-overlay.dts     |   28 +
 .../boot/dts/qcom/msm8998-qrd-skuk-hdk.dtsi   |  162 +
 .../dts/qcom/msm8998-qrd-skuk-overlay.dts     |   27 +
 arch/arm64/boot/dts/qcom/msm8998-qrd-skuk.dts |   25 +
 .../arm64/boot/dts/qcom/msm8998-qrd-skuk.dtsi |  499 ++
 .../boot/dts/qcom/msm8998-qrd-vr1-overlay.dts |   27 +
 arch/arm64/boot/dts/qcom/msm8998-qrd-vr1.dts  |   24 +
 arch/arm64/boot/dts/qcom/msm8998-qrd-vr1.dtsi |  473 ++
 arch/arm64/boot/dts/qcom/msm8998-qrd.dts      |   24 +
 arch/arm64/boot/dts/qcom/msm8998-qrd.dtsi     |  636 +++
 .../boot/dts/qcom/msm8998-regulator.dtsi      | 1145 +++++
 arch/arm64/boot/dts/qcom/msm8998-rumi.dts     |  108 +
 arch/arm64/boot/dts/qcom/msm8998-rumi.dtsi    |  287 ++
 .../boot/dts/qcom/msm8998-sde-display.dtsi    |   75 +
 arch/arm64/boot/dts/qcom/msm8998-sde.dtsi     |  222 +
 arch/arm64/boot/dts/qcom/msm8998-sim.dts      |   42 +
 arch/arm64/boot/dts/qcom/msm8998-sim.dtsi     |  124 +
 arch/arm64/boot/dts/qcom/msm8998-smp2p.dtsi   |  267 ++
 .../boot/dts/qcom/msm8998-svr20-pinctrl.dtsi  | 3386 ++++++++++++++
 arch/arm64/boot/dts/qcom/msm8998-svr20.dtsi   |  409 ++
 .../boot/dts/qcom/msm8998-v2-camera.dtsi      |  192 +
 .../boot/dts/qcom/msm8998-v2-cdp-overlay.dts  |   29 +
 arch/arm64/boot/dts/qcom/msm8998-v2-cdp.dts   |   24 +
 .../qcom/msm8998-v2-interposer-sdm660.dtsi    |  851 ++++
 .../boot/dts/qcom/msm8998-v2-mtp-overlay.dts  |   29 +
 arch/arm64/boot/dts/qcom/msm8998-v2-mtp.dts   |   24 +
 .../dts/qcom/msm8998-v2-qrd-skuk-evt3.dts     |   25 +
 .../boot/dts/qcom/msm8998-v2-qrd-skuk-hdk.dts |   23 +
 .../boot/dts/qcom/msm8998-v2-qrd-skuk.dts     |   25 +
 .../boot/dts/qcom/msm8998-v2-qrd-vr1.dts      |   24 +
 arch/arm64/boot/dts/qcom/msm8998-v2-qrd.dts   |   23 +
 arch/arm64/boot/dts/qcom/msm8998-v2-rumi.dts  |   29 +
 arch/arm64/boot/dts/qcom/msm8998-v2-sim.dts   |   29 +
 .../dts/qcom/msm8998-v2.1-cdp-overlay.dts     |   29 +
 arch/arm64/boot/dts/qcom/msm8998-v2.1-cdp.dts |   24 +
 .../msm8998-v2.1-interposer-sdm660-cdp.dts    |  156 +
 .../msm8998-v2.1-interposer-sdm660-mtp.dts    |  185 +
 .../msm8998-v2.1-interposer-sdm660-qrd.dts    |  219 +
 .../msm8998-v2.1-interposer-sdm660-qrd.dtsi   |  175 +
 .../qcom/msm8998-v2.1-interposer-sdm660.dtsi  |   18 +
 .../dts/qcom/msm8998-v2.1-mtp-4k-display.dts  |   52 +
 .../dts/qcom/msm8998-v2.1-mtp-overlay.dts     |   29 +
 arch/arm64/boot/dts/qcom/msm8998-v2.1-mtp.dts |   24 +
 arch/arm64/boot/dts/qcom/msm8998-v2.1-qrd.dts |   24 +
 arch/arm64/boot/dts/qcom/msm8998-v2.1.dts     |   23 +
 arch/arm64/boot/dts/qcom/msm8998-v2.1.dtsi    |   18 +
 arch/arm64/boot/dts/qcom/msm8998-v2.dts       |   23 +
 arch/arm64/boot/dts/qcom/msm8998-v2.dtsi      | 1319 ++++++
 arch/arm64/boot/dts/qcom/msm8998-vidc.dtsi    |  251 +
 arch/arm64/boot/dts/qcom/msm8998-wcd.dtsi     |  183 +
 arch/arm64/boot/dts/qcom/msm8998-wsa881x.dtsi |   78 +
 arch/arm64/boot/dts/qcom/msm8998.dts          |   23 +
 arch/arm64/boot/dts/qcom/msm8998.dtsi         | 3362 ++++++++++++++
 arch/arm64/boot/dts/qcom/msmhamster-cdp.dts   |   23 +
 arch/arm64/boot/dts/qcom/msmhamster-mtp.dts   |   23 +
 .../boot/dts/qcom/msmhamster-pinctrl.dtsi     |   36 +
 arch/arm64/boot/dts/qcom/msmhamster-rumi.dts  |   43 +
 arch/arm64/boot/dts/qcom/msmhamster.dtsi      |   76 +
 arch/arm64/boot/dts/qcom/pm8916.dtsi          |   99 +
 arch/arm64/boot/dts/qcom/sda630-cdp.dts       |   36 +
 arch/arm64/boot/dts/qcom/sda630-mtp.dts       |   30 +
 .../arm64/boot/dts/qcom/sda630-pm660a-cdp.dts |   36 +
 .../arm64/boot/dts/qcom/sda630-pm660a-mtp.dts |   30 +
 .../boot/dts/qcom/sda630-pm660a-qrd-hdk.dts   |   98 +
 .../arm64/boot/dts/qcom/sda630-pm660a-rcm.dts |   36 +
 arch/arm64/boot/dts/qcom/sda630-rcm.dts       |   35 +
 arch/arm64/boot/dts/qcom/sda630.dtsi          |   29 +
 arch/arm64/boot/dts/qcom/sda636-cdp.dts       |   36 +
 arch/arm64/boot/dts/qcom/sda636-mtp.dts       |   30 +
 .../arm64/boot/dts/qcom/sda636-pm660a-cdp.dts |   36 +
 .../arm64/boot/dts/qcom/sda636-pm660a-mtp.dts |   30 +
 .../boot/dts/qcom/sda636-pm660a-qrd-hdk.dts   |  240 +
 .../arm64/boot/dts/qcom/sda636-pm660a-rcm.dts |   36 +
 arch/arm64/boot/dts/qcom/sda636-rcm.dts       |   36 +
 arch/arm64/boot/dts/qcom/sda636.dtsi          |   29 +
 arch/arm64/boot/dts/qcom/sda658-cdp.dts       |   25 +
 arch/arm64/boot/dts/qcom/sda658-mtp.dts       |   25 +
 .../arm64/boot/dts/qcom/sda658-pm660a-cdp.dts |   25 +
 .../arm64/boot/dts/qcom/sda658-pm660a-mtp.dts |   25 +
 .../arm64/boot/dts/qcom/sda658-pm660a-rcm.dts |   25 +
 arch/arm64/boot/dts/qcom/sda658-rcm.dts       |   25 +
 arch/arm64/boot/dts/qcom/sda658.dtsi          |   29 +
 arch/arm64/boot/dts/qcom/sda660-cdp.dts       |   36 +
 arch/arm64/boot/dts/qcom/sda660-mtp.dts       |   30 +
 .../arm64/boot/dts/qcom/sda660-pm660a-cdp.dts |   36 +
 .../arm64/boot/dts/qcom/sda660-pm660a-mtp.dts |   30 +
 .../boot/dts/qcom/sda660-pm660a-qrd-hdk.dts   |  240 +
 .../arm64/boot/dts/qcom/sda660-pm660a-rcm.dts |   36 +
 arch/arm64/boot/dts/qcom/sda660-rcm.dts       |   36 +
 arch/arm64/boot/dts/qcom/sda660.dtsi          |   29 +
 .../dts/qcom/sdm630-camera-sensor-cdp.dtsi    |  370 ++
 .../dts/qcom/sdm630-camera-sensor-mtp.dtsi    |  427 ++
 .../dts/qcom/sdm630-camera-sensor-qrd.dtsi    |  428 ++
 arch/arm64/boot/dts/qcom/sdm630-camera.dtsi   |  870 ++++
 arch/arm64/boot/dts/qcom/sdm630-cdp.dts       |   36 +
 arch/arm64/boot/dts/qcom/sdm630-cdp.dtsi      |  221 +
 .../arm64/boot/dts/qcom/sdm630-coresight.dtsi |   79 +
 arch/arm64/boot/dts/qcom/sdm630-gpu.dtsi      |  535 +++
 .../qcom/sdm630-headset-jacktype-no-cdp.dts   |   26 +
 .../qcom/sdm630-headset-jacktype-no-rcm.dts   |   26 +
 .../dts/qcom/sdm630-internal-codec-cdp.dts    |   26 +
 .../dts/qcom/sdm630-internal-codec-mtp.dts    |   30 +
 .../qcom/sdm630-internal-codec-pm660a-cdp.dts |   26 +
 .../qcom/sdm630-internal-codec-pm660a-mtp.dts |   30 +
 .../qcom/sdm630-internal-codec-pm660a-rcm.dts |   26 +
 .../dts/qcom/sdm630-internal-codec-rcm.dts    |   26 +
 arch/arm64/boot/dts/qcom/sdm630-ion.dtsi      |   47 +
 .../boot/dts/qcom/sdm630-mdss-panels.dtsi     |  245 +
 arch/arm64/boot/dts/qcom/sdm630-mdss-pll.dtsi |   82 +
 arch/arm64/boot/dts/qcom/sdm630-mdss.dtsi     |  557 +++
 arch/arm64/boot/dts/qcom/sdm630-mtp.dts       |   30 +
 arch/arm64/boot/dts/qcom/sdm630-mtp.dtsi      |  208 +
 arch/arm64/boot/dts/qcom/sdm630-pm.dtsi       |  774 ++++
 .../arm64/boot/dts/qcom/sdm630-pm660a-cdp.dts |   43 +
 .../sdm630-pm660a-headset-jacktype-no-cdp.dts |   26 +
 .../sdm630-pm660a-headset-jacktype-no-rcm.dts |   26 +
 .../arm64/boot/dts/qcom/sdm630-pm660a-mtp.dts |   37 +
 .../arm64/boot/dts/qcom/sdm630-pm660a-qrd.dts |   85 +
 .../arm64/boot/dts/qcom/sdm630-pm660a-rcm.dts |   36 +
 .../boot/dts/qcom/sdm630-pm660a-rumi.dts      |   88 +
 arch/arm64/boot/dts/qcom/sdm630-qrd.dtsi      |  411 ++
 arch/arm64/boot/dts/qcom/sdm630-rcm.dts       |   36 +
 .../arm64/boot/dts/qcom/sdm630-regulator.dtsi |  906 ++++
 arch/arm64/boot/dts/qcom/sdm630-rumi.dts      |  158 +
 arch/arm64/boot/dts/qcom/sdm630-smp2p.dtsi    |  182 +
 .../boot/dts/qcom/sdm630-usbc-audio-mtp.dts   |   31 +
 .../boot/dts/qcom/sdm630-usbc-audio-rcm.dts   |   30 +
 arch/arm64/boot/dts/qcom/sdm630.dtsi          | 2290 +++++++++
 .../dts/qcom/sdm636-camera-sensor-mtp.dtsi    |   50 +
 arch/arm64/boot/dts/qcom/sdm636-cdp.dts       |   36 +
 arch/arm64/boot/dts/qcom/sdm636-cdp.dtsi      |   27 +
 .../qcom/sdm636-headset-jacktype-no-cdp.dts   |   26 +
 .../qcom/sdm636-headset-jacktype-no-rcm.dts   |   26 +
 .../dts/qcom/sdm636-internal-codec-cdp.dts    |   26 +
 .../dts/qcom/sdm636-internal-codec-mtp.dts    |   30 +
 .../qcom/sdm636-internal-codec-pm660a-cdp.dts |   26 +
 .../qcom/sdm636-internal-codec-pm660a-mtp.dts |   31 +
 .../qcom/sdm636-internal-codec-pm660a-rcm.dts |   26 +
 .../dts/qcom/sdm636-internal-codec-rcm.dts    |   26 +
 arch/arm64/boot/dts/qcom/sdm636-mtp.dts       |   30 +
 arch/arm64/boot/dts/qcom/sdm636-mtp.dtsi      |   28 +
 .../arm64/boot/dts/qcom/sdm636-pm660a-cdp.dts |   54 +
 .../sdm636-pm660a-headset-jacktype-no-cdp.dts |   38 +
 .../sdm636-pm660a-headset-jacktype-no-rcm.dts |   26 +
 .../arm64/boot/dts/qcom/sdm636-pm660a-mtp.dts |   48 +
 .../arm64/boot/dts/qcom/sdm636-pm660a-qrd.dts |   56 +
 .../arm64/boot/dts/qcom/sdm636-pm660a-rcm.dts |   36 +
 arch/arm64/boot/dts/qcom/sdm636-qrd.dts       |   87 +
 arch/arm64/boot/dts/qcom/sdm636-qrd.dtsi      |   16 +
 arch/arm64/boot/dts/qcom/sdm636-rcm.dts       |   36 +
 .../boot/dts/qcom/sdm636-usbc-audio-mtp.dts   |   31 +
 .../boot/dts/qcom/sdm636-usbc-audio-rcm.dts   |   30 +
 arch/arm64/boot/dts/qcom/sdm636.dtsi          |   46 +
 arch/arm64/boot/dts/qcom/sdm658-cdp.dts       |   25 +
 .../dts/qcom/sdm658-internal-codec-cdp.dts    |   73 +
 .../dts/qcom/sdm658-internal-codec-mtp.dts    |   74 +
 .../qcom/sdm658-internal-codec-pm660a-cdp.dts |   25 +
 .../qcom/sdm658-internal-codec-pm660a-mtp.dts |   25 +
 .../qcom/sdm658-internal-codec-pm660a-rcm.dts |   25 +
 .../dts/qcom/sdm658-internal-codec-rcm.dts    |   73 +
 arch/arm64/boot/dts/qcom/sdm658-mtp.dts       |   25 +
 .../arm64/boot/dts/qcom/sdm658-pm660a-cdp.dts |   25 +
 .../arm64/boot/dts/qcom/sdm658-pm660a-mtp.dts |   25 +
 .../arm64/boot/dts/qcom/sdm658-pm660a-qrd.dts |   25 +
 .../arm64/boot/dts/qcom/sdm658-pm660a-rcm.dts |   25 +
 arch/arm64/boot/dts/qcom/sdm658-qrd.dts       |   25 +
 arch/arm64/boot/dts/qcom/sdm658-rcm.dts       |   25 +
 arch/arm64/boot/dts/qcom/sdm658.dtsi          |   82 +
 arch/arm64/boot/dts/qcom/sdm660-audio.dtsi    |  280 ++
 arch/arm64/boot/dts/qcom/sdm660-blsp.dtsi     |  570 +++
 arch/arm64/boot/dts/qcom/sdm660-bus.dtsi      | 1293 ++++++
 .../dts/qcom/sdm660-camera-sensor-cdp.dtsi    |  402 ++
 .../dts/qcom/sdm660-camera-sensor-mtp.dtsi    |  438 ++
 .../dts/qcom/sdm660-camera-sensor-qrd.dtsi    |  427 ++
 arch/arm64/boot/dts/qcom/sdm660-camera.dtsi   |  876 ++++
 arch/arm64/boot/dts/qcom/sdm660-cdp.dts       |   36 +
 arch/arm64/boot/dts/qcom/sdm660-cdp.dtsi      |  263 ++
 arch/arm64/boot/dts/qcom/sdm660-common.dtsi   |  680 +++
 .../arm64/boot/dts/qcom/sdm660-coresight.dtsi | 1684 +++++++
 .../boot/dts/qcom/sdm660-external-codec.dtsi  |   35 +
 arch/arm64/boot/dts/qcom/sdm660-gpu.dtsi      |  586 +++
 .../qcom/sdm660-headset-jacktype-no-cdp.dts   |   26 +
 .../qcom/sdm660-headset-jacktype-no-rcm.dts   |   26 +
 .../dts/qcom/sdm660-internal-codec-cdp.dts    |   26 +
 .../dts/qcom/sdm660-internal-codec-mtp.dts    |   30 +
 .../qcom/sdm660-internal-codec-pm660a-cdp.dts |   26 +
 .../qcom/sdm660-internal-codec-pm660a-mtp.dts |   31 +
 .../qcom/sdm660-internal-codec-pm660a-rcm.dts |   26 +
 .../dts/qcom/sdm660-internal-codec-rcm.dts    |   26 +
 .../boot/dts/qcom/sdm660-internal-codec.dtsi  |   83 +
 arch/arm64/boot/dts/qcom/sdm660-ion.dtsi      |   47 +
 arch/arm64/boot/dts/qcom/sdm660-lpi.dtsi      |  212 +
 .../boot/dts/qcom/sdm660-mdss-panels.dtsi     |  327 ++
 arch/arm64/boot/dts/qcom/sdm660-mdss-pll.dtsi |  117 +
 arch/arm64/boot/dts/qcom/sdm660-mdss.dtsi     |  623 +++
 arch/arm64/boot/dts/qcom/sdm660-mtp.dts       |   30 +
 arch/arm64/boot/dts/qcom/sdm660-mtp.dtsi      |  264 ++
 arch/arm64/boot/dts/qcom/sdm660-pinctrl.dtsi  | 1696 +++++++
 arch/arm64/boot/dts/qcom/sdm660-pm.dtsi       |  823 ++++
 .../arm64/boot/dts/qcom/sdm660-pm660a-cdp.dts |   54 +
 .../sdm660-pm660a-headset-jacktype-no-cdp.dts |   38 +
 .../sdm660-pm660a-headset-jacktype-no-rcm.dts |   26 +
 .../arm64/boot/dts/qcom/sdm660-pm660a-mtp.dts |   48 +
 .../arm64/boot/dts/qcom/sdm660-pm660a-qrd.dts |   56 +
 .../arm64/boot/dts/qcom/sdm660-pm660a-rcm.dts |   36 +
 .../boot/dts/qcom/sdm660-pm660a-rumi.dts      |  146 +
 .../arm64/boot/dts/qcom/sdm660-pm660a-sim.dts |  111 +
 arch/arm64/boot/dts/qcom/sdm660-qrd.dts       |   87 +
 arch/arm64/boot/dts/qcom/sdm660-qrd.dtsi      |  290 ++
 arch/arm64/boot/dts/qcom/sdm660-rcm.dts       |   36 +
 .../arm64/boot/dts/qcom/sdm660-regulator.dtsi |  929 ++++
 arch/arm64/boot/dts/qcom/sdm660-rumi.dts      |  179 +
 arch/arm64/boot/dts/qcom/sdm660-sim.dts       |  144 +
 arch/arm64/boot/dts/qcom/sdm660-smp2p.dtsi    |  244 +
 .../boot/dts/qcom/sdm660-usbc-audio-mtp.dts   |   31 +
 .../boot/dts/qcom/sdm660-usbc-audio-rcm.dts   |   30 +
 arch/arm64/boot/dts/qcom/sdm660-vidc.dtsi     |  267 ++
 arch/arm64/boot/dts/qcom/sdm660-wcd.dtsi      |  197 +
 arch/arm64/boot/dts/qcom/sdm660-wsa881x.dtsi  |   79 +
 arch/arm64/boot/dts/qcom/sdm660.dtsi          | 2662 +++++++++++
 arch/arm64/boot/dts/qcom/skeleton64.dtsi      |   15 +
 .../boot/dts/qcom/vplatform-lfv-ion.dtsi      |   31 +
 .../boot/dts/qcom/vplatform-lfv-msm8996.dts   |  514 +++
 arch/arm64/kernel/head.S                      |   42 +-
 drivers/android/binder.c                      |   42 +-
 drivers/md/dm-req-crypt.c                     |    2 +
 drivers/platform/msm/ipa/ipa_common           |  Bin 878352 -> 877632 bytes
 drivers/usb/gadget/configfs.c                 |    2 +-
 drivers/usb/host/xhci-plat.c                  |   28 +-
 fs/eventpoll.c                                |    6 +-
 include/linux/compiler-clang.h                |   14 +
 include/linux/compiler-gcc.h                  |    4 +
 include/linux/compiler-intel.h                |    4 +
 include/linux/overflow.h                      |  205 +
 mm/zsmalloc.c                                 |   12 +-
 570 files changed, 127435 insertions(+), 55 deletions(-)
 create mode 100644 arch/arm64/boot/dts/qcom/Makefile
 create mode 100644 arch/arm64/boot/dts/qcom/apq8016-sbc-pmic-pins.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/apq8016-sbc-soc-pins.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/apq8016-sbc.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-auto-dragonboard.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-ba.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-camera-sensor-dragonboard.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-camera-sensor-sbc.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-dragonboard.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-sbc.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v2-auto-dragonboard.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v2-dragonboard.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v2-liquid.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-pm8004-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-pm8004-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v2.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-auto-adp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-auto-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-auto-dragonboard.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-dragonboard.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-liquid.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-mdm9x55-i2s-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-mdm9x55-i2s-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-mdm9x55-slimbus-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pm8004-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pm8004-mdm9x55-i2s-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pm8004-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pm8004-pmk8001-mdm9x55-i2s-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pmk8001-mdm9x55-i2s-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-dragonboard.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-mdm9x55-i2s-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-mdm9x55-i2s-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-mdm9x55-slimbus-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3-sbc.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3.0-dragonboard.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3.0-liquid.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-pm8004-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-pm8004-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8996-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8996-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3.0.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096-v3.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096pro-auto-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096pro-liquid.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096pro-v1.1-auto-adp-lite.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096pro-v1.1-auto-adp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096pro-v1.1-auto-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096pro-v1.1.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/apq8096pro.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/apq8098-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8098-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8098-v2-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8098-v2-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8098-v2-qrd-skuk-hdk.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8098-v2-qrd.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8098-v2.1-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8098-v2.1-mediabox.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8098-v2.1-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8098-v2.1-qrd.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8098-v2.1-svr20.dts
 create mode 100644 arch/arm64/boot/dts/qcom/apq8098-v2.1.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/apq8098-v2.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/apq8098.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/batterydata-ascent-3450mAh.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/batterydata-itech-3000mah-4200mv.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/batterydata-itech-3000mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/batterydata-liquid-7650-sanyo.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/batterydata-mtp-3000mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/batterydata-palladium.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/batterydata-qrd-4v2-1300mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/batterydata-qrd-4v2-1800mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/batterydata-qrd-4v2-2000mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/batterydata-qrd-4v2-2200mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/batterydata-qrd-4v35-2000mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/batterydata-qrd-4v35-2500mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/batterydata-qrd-sku1-4v4-2800mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/batterydata-qrd-skua-4v35-2000mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/batterydata-qrd-skuh-4v35-2000mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/batterydata-qrd-skuic-4v35-1850mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/batterydata-qrd-skul-4v4-2920mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/batterydata-qrd-skum-4v4-2920mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-adv7533-1024-600p.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-adv7533-1080p.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-adv7533-720p.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-hx8379a-truly-fwvga-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-hx8394f-720p-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-jdi-1080p-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-jdi-4k-dualmipi-video-nofbc.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-jdi-4k-dualmipi-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-jdi-a407-dualmipi-wqhd-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-jdi-dualmipi-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-jdi-dualmipi-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-jdi-fhd-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-nt35597-dsc-wqxga-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-nt35597-dsc-wqxga-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-nt35597-dualmipi-wqxga-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-nt35597-dualmipi-wqxga-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-nt35597-truly-dsc-wqxga-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-nt35597-truly-dsc-wqxga-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-nt35597-truly-dualmipi-wqxga-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-nt35597-truly-dualmipi-wqxga-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-nt35695b-truly-fhd-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-nt35695b-truly-fhd-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-nt35950-dsc-4k-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-nt36850-truly-dualmipi-wqhd-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-otm1906c-1080p-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-r69006-1080p-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-r69006-1080p-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-r69007-dualdsi-wqxga-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-rm67195-amoled-fhd-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-s6e3ha3-amoled-dualmipi-wqhd-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-sharp-1080p-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-sharp-dsc-4k-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-sharp-dsc-4k-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-sharp-dualmipi-1080p-120hz.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-sharp-dualmipi-wqxga-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-sharp-split-link-wuxga-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-sim-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-sim-dualmipi-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-sim-dualmipi-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-sim-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-toshiba-720p-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-truly-1080p-cmd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/dsi-panel-truly-1080p-video.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/external-mdm9640.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/external-soc.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/fg-gen3-batterydata-ascent-2800mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/fg-gen3-batterydata-ascent-3450mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/fg-gen3-batterydata-demo-6000mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/fg-gen3-batterydata-itech-3000mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/fg-gen3-batterydata-qrd-skuk-4v4-3000mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/fg-gen3-batterydata-svr-v2-3200mah.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-arm-smmu-630.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-arm-smmu-660.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-arm-smmu-8996.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-arm-smmu-8998.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-arm-smmu-impl-defs-660.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-arm-smmu-impl-defs-8996-v2.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-arm-smmu-impl-defs-8996-v3.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-arm-smmu-impl-defs-8998.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-arm-smmu.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-audio-lpass.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-audio.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-gdsc-660.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-gdsc-8996.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-gdsc-8998.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-pm660-rpm-regulator.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-pm660.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-pm660a.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-pm660l-rpm-regulator.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-pm660l.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-pm8004.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-pm8005.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-pm8994-rpm-regulator.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-pm8994.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-pm8998-rpm-regulator.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-pm8998.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-pmi8994.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-pmi8996.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-pmi8998.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-pmk8001.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-rdbg.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm-smb138x.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8916-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8916-mtp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8916.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-agave-adp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-auto-cdp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-blsp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-bus.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-camera-sensor-adp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-camera-sensor-cdp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-camera-sensor-dtp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-camera-sensor-liquid.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-camera-sensor-mtp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-camera.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-cdp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-coresight-v2.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-coresight-v3.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-dtp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-fluid.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-gpu.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-ion.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-ipcrouter.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-liquid.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-mdss-panels.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-mdss-pll.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-mdss.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-mmxf-adp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-mtp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-pinctrl.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-pm.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-pm8994-pm8004-pmk8001.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-pm8994-pm8004.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-pm8994-pmi8994-pm8004-pmk8001.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-pm8994-pmi8994-pm8004.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-pm8994-pmi8994-pmk8001.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-pm8994-pmi8996-pmk8001.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-pm8994.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-regulator.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-sde-display.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-sde.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-sim.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-smp2p.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v2-dtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v2-fluid.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v2-liquid.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pm8004-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pm8004-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pm8004-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pm8004-pmk8001-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pmk8001-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v2.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-auto-adp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-auto-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-dtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-fluid.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-liquid.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-pm8004-agave-adp-lite.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-pm8004-agave-adp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-pm8004-mmxf-adp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pm8004-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pm8004-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pm8004-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pm8004-pmk8001-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pmk8001-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-pmi8996-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-pmi8996-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-pmi8996-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3-pmi8996-pmk8001-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3.0-dtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3.0-fluid.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3.0-liquid.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-pm8004-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-pm8004-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-pm8004-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8996-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8996-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3.0.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-v3.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-vidc.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996-wsa881x.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-auto-adp-lite.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-auto-adp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-auto-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-auto.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pm8004-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pm8004-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pm8004-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pm8004-pmk8001-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pmk8001-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-pmi8996-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-pmi8996-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-pmi8996-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-pmi8996-pmk8001-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-v1.1-auto-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pm8004-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pm8004-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pm8004-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pm8004-pmk8001-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pmk8001-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8996-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8996-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8996-pmk8001-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8996-pmk8001-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro-v1.1.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996pro.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8996v3-auto.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-9x55-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-9x55-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-9x55-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-9x55.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-audio.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-blsp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-bus.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-camera-sensor-cdp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-camera-sensor-mtp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-camera-sensor-qrd-vr1.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-camera-sensor-qrd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-camera-sensor-skuk-evt3.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-camera-sensor-skuk-hdk.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-camera-sensor-skuk.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-camera-sensor-svr20.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-camera.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-cdp-overlay.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-cdp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-coresight.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-gpu.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-interposer-camera-sensor-cdp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-interposer-camera-sensor-mtp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-interposer-camera-sensor-qrd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-interposer-pm660.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-interposer-sdm660-audio.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-interposer-sdm660-cdp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-interposer-sdm660-mtp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-interposer-sdm660.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-ion.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-mdss-panels.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-mdss-pll.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-mdss.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-mtp-overlay.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-pinctrl.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-pm.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-qrd-overlay.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-qrd-skuk-hdk.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-qrd-skuk-overlay.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-qrd-skuk.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-qrd-skuk.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-qrd-vr1-overlay.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-qrd-vr1.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-qrd-vr1.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-qrd.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-qrd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-regulator.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-rumi.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-rumi.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-sde-display.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-sde.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-sim.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-sim.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-smp2p.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-svr20-pinctrl.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-svr20.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2-camera.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2-cdp-overlay.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2-interposer-sdm660.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2-mtp-overlay.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2-qrd-skuk-evt3.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2-qrd-skuk-hdk.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2-qrd-skuk.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2-qrd-vr1.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2-qrd.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2-rumi.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2-sim.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2.1-cdp-overlay.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2.1-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660-qrd.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660-qrd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2.1-mtp-4k-display.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2.1-mtp-overlay.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2.1-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2.1-qrd.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2.1.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2.1.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-v2.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-vidc.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-wcd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998-wsa881x.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msm8998.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msmhamster-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msmhamster-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msmhamster-pinctrl.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/msmhamster-rumi.dts
 create mode 100644 arch/arm64/boot/dts/qcom/msmhamster.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/pm8916.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sda630-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda630-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda630-pm660a-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda630-pm660a-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda630-pm660a-qrd-hdk.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda630-pm660a-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda630-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda630.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sda636-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda636-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda636-pm660a-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda636-pm660a-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda636-pm660a-qrd-hdk.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda636-pm660a-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda636-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda636.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sda658-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda658-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda658-pm660a-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda658-pm660a-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda658-pm660a-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda658-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda658.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sda660-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda660-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda660-pm660a-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda660-pm660a-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda660-pm660a-qrd-hdk.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda660-pm660a-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda660-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sda660.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-camera-sensor-cdp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-camera-sensor-mtp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-camera-sensor-qrd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-camera.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-cdp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-coresight.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-gpu.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-headset-jacktype-no-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-headset-jacktype-no-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-internal-codec-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-internal-codec-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-internal-codec-pm660a-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-internal-codec-pm660a-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-internal-codec-pm660a-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-internal-codec-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-ion.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-mdss-panels.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-mdss-pll.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-mdss.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-mtp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-pm.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-pm660a-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-pm660a-headset-jacktype-no-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-pm660a-headset-jacktype-no-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-pm660a-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-pm660a-qrd.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-pm660a-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-pm660a-rumi.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-qrd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-regulator.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-rumi.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-smp2p.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-usbc-audio-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630-usbc-audio-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm630.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-camera-sensor-mtp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-cdp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-headset-jacktype-no-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-headset-jacktype-no-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-internal-codec-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-internal-codec-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-internal-codec-pm660a-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-internal-codec-pm660a-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-internal-codec-pm660a-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-internal-codec-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-mtp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-pm660a-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-pm660a-headset-jacktype-no-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-pm660a-headset-jacktype-no-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-pm660a-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-pm660a-qrd.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-pm660a-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-qrd.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-qrd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-usbc-audio-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636-usbc-audio-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm636.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm658-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm658-internal-codec-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm658-internal-codec-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm658-internal-codec-pm660a-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm658-internal-codec-pm660a-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm658-internal-codec-pm660a-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm658-internal-codec-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm658-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm658-pm660a-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm658-pm660a-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm658-pm660a-qrd.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm658-pm660a-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm658-qrd.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm658-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm658.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-audio.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-blsp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-bus.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-camera-sensor-cdp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-camera-sensor-mtp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-camera-sensor-qrd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-camera.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-cdp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-common.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-coresight.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-external-codec.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-gpu.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-headset-jacktype-no-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-headset-jacktype-no-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-internal-codec-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-internal-codec-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-internal-codec-pm660a-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-internal-codec-pm660a-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-internal-codec-pm660a-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-internal-codec-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-internal-codec.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-ion.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-lpi.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-mdss-panels.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-mdss-pll.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-mdss.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-mtp.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-pinctrl.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-pm.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-pm660a-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-pm660a-headset-jacktype-no-cdp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-pm660a-headset-jacktype-no-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-pm660a-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-pm660a-qrd.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-pm660a-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-pm660a-rumi.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-pm660a-sim.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-qrd.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-qrd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-regulator.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-rumi.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-sim.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-smp2p.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-usbc-audio-mtp.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-usbc-audio-rcm.dts
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-vidc.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-wcd.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660-wsa881x.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/sdm660.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/skeleton64.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/vplatform-lfv-ion.dtsi
 create mode 100644 arch/arm64/boot/dts/qcom/vplatform-lfv-msm8996.dts
 create mode 100644 include/linux/overflow.h

diff --git a/arch/arm64/boot/dts/qcom/Makefile b/arch/arm64/boot/dts/qcom/Makefile
new file mode 100644
index 000000000000..5978afcafe6d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/Makefile
@@ -0,0 +1,307 @@
+dtb-$(CONFIG_ARCH_MSM8996) += msm8996-v2-pmi8994-cdp.dtb \
+	msm8996-v2-pmi8994-mtp.dtb \
+	msm8996-v2-pmi8994-pmk8001-cdp.dtb \
+	msm8996-v2-pmi8994-pmk8001-mtp.dtb \
+	msm8996-v2-pmi8994-pm8004-cdp.dtb \
+	msm8996-v2-pmi8994-pm8004-mtp.dtb \
+	msm8996-v2-pmi8994-pm8004-pmk8001-cdp.dtb \
+	msm8996-v2-pmi8994-pm8004-pmk8001-mtp.dtb \
+	msm8996-v2-fluid.dtb \
+	msm8996-v2-liquid.dtb \
+	msm8996-v2-dtp.dtb \
+	msm8996-v3-auto-cdp.dtb \
+	msm8996-v3-auto-adp.dtb \
+	msm8996-v3-pmi8994-cdp.dtb \
+	msm8996-v3-pmi8994-mtp.dtb \
+	msm8996-v3-pmi8994-pmk8001-cdp.dtb \
+	msm8996-v3-pmi8994-pmk8001-mtp.dtb \
+	msm8996-v3-pmi8994-pm8004-cdp.dtb \
+	msm8996-v3-pmi8994-pm8004-mtp.dtb \
+	msm8996-v3-pmi8994-pm8004-pmk8001-cdp.dtb \
+	msm8996-v3-pmi8994-pm8004-pmk8001-mtp.dtb \
+	msm8996-v3-pmi8996-cdp.dtb \
+	msm8996-v3-pmi8996-mtp.dtb \
+	msm8996-v3-pmi8996-pmk8001-cdp.dtb \
+	msm8996-v3-pmi8996-pmk8001-mtp.dtb \
+	msm8996-v3-fluid.dtb \
+	msm8996-v3-liquid.dtb \
+	msm8996-v3-dtp.dtb \
+	msm8996-v3-pm8004-mmxf-adp.dtb \
+	msm8996-v3-pm8004-agave-adp.dtb \
+	msm8996-v3-pm8004-agave-adp-lite.dtb \
+	msm8996pro-auto-adp.dtb \
+	msm8996pro-auto-adp-lite.dtb \
+	msm8996pro-auto-cdp.dtb \
+	msm8996pro-pmi8994-cdp.dtb \
+	msm8996pro-pmi8994-mtp.dtb \
+	msm8996pro-pmi8994-pmk8001-cdp.dtb \
+	msm8996pro-pmi8994-pmk8001-mtp.dtb \
+	msm8996pro-pmi8994-pm8004-cdp.dtb \
+	msm8996pro-pmi8994-pm8004-mtp.dtb \
+	msm8996pro-pmi8994-pm8004-pmk8001-cdp.dtb \
+	msm8996pro-pmi8994-pm8004-pmk8001-mtp.dtb \
+	msm8996pro-pmi8996-cdp.dtb \
+	msm8996pro-pmi8996-mtp.dtb \
+	msm8996pro-pmi8996-pmk8001-cdp.dtb \
+	msm8996pro-pmi8996-pmk8001-mtp.dtb \
+	msm8996pro-v1.1-auto-cdp.dtb \
+	msm8996pro-v1.1-pmi8994-cdp.dtb \
+	msm8996pro-v1.1-pmi8994-mtp.dtb \
+	msm8996pro-v1.1-pmi8994-pmk8001-cdp.dtb \
+	msm8996pro-v1.1-pmi8994-pmk8001-mtp.dtb \
+	msm8996pro-v1.1-pmi8994-pm8004-cdp.dtb \
+	msm8996pro-v1.1-pmi8994-pm8004-mtp.dtb \
+	msm8996pro-v1.1-pmi8994-pm8004-pmk8001-cdp.dtb \
+	msm8996pro-v1.1-pmi8994-pm8004-pmk8001-mtp.dtb \
+	msm8996pro-v1.1-pmi8996-cdp.dtb \
+	msm8996pro-v1.1-pmi8996-mtp.dtb \
+	msm8996pro-v1.1-pmi8996-pmk8001-cdp.dtb \
+	msm8996pro-v1.1-pmi8996-pmk8001-mtp.dtb \
+	apq8096pro-auto-cdp.dtb \
+	apq8096pro-v1.1-auto-adp.dtb \
+	apq8096pro-v1.1-auto-adp-lite.dtb \
+	apq8096pro-liquid.dtb \
+	apq8096pro-v1.1-auto-cdp.dtb \
+	msm8996-v3.0-pmi8994-cdp.dtb \
+	msm8996-v3.0-pmi8994-mtp.dtb \
+	msm8996-v3.0-pmi8994-pm8004-cdp.dtb \
+	msm8996-v3.0-pmi8994-pm8004-mtp.dtb \
+	msm8996-v3.0-pmi8994-pm8004-pmk8001-cdp.dtb \
+	msm8996-v3.0-pmi8994-pmk8001-cdp.dtb \
+	msm8996-v3.0-pmi8996-cdp.dtb \
+	msm8996-v3.0-pmi8996-mtp.dtb \
+	msm8996-v3.0-fluid.dtb \
+	msm8996-v3.0-liquid.dtb \
+	msm8996-v3.0-dtp.dtb \
+	apq8096-v2-pmi8994-cdp.dtb \
+	apq8096-v2-pmi8994-mtp.dtb \
+	apq8096-v2-pmi8994-pmk8001-cdp.dtb \
+	apq8096-v2-pmi8994-pm8004-cdp.dtb \
+	apq8096-v2-pmi8994-pm8004-pmk8001-cdp.dtb \
+	apq8096-v2-liquid.dtb \
+	apq8096-v2-dragonboard.dtb \
+	apq8096-v2-auto-dragonboard.dtb \
+	apq8096-v3-pmi8994-cdp.dtb \
+	apq8096-v3-pmi8994-mtp.dtb \
+	apq8096-v3-pmi8994-pmk8001-cdp.dtb \
+	apq8096-v3-pmi8994-pm8004-cdp.dtb \
+	apq8096-v3-pmi8994-pm8004-pmk8001-cdp.dtb \
+	apq8096-v3-pmi8996-cdp.dtb \
+	apq8096-v3-pmi8996-mtp.dtb \
+	apq8096-v3-liquid.dtb \
+	apq8096-v3-dragonboard.dtb \
+	apq8096-v3-sbc.dtb \
+	apq8096-v3-auto-dragonboard.dtb \
+	apq8096-v3-auto-adp.dtb \
+	apq8096-v3-auto-cdp.dtb \
+	apq8096-v3.0-pmi8994-cdp.dtb \
+	apq8096-v3.0-pmi8994-mtp.dtb \
+	apq8096-v3.0-pmi8994-pm8004-cdp.dtb \
+	apq8096-v3.0-pmi8994-pm8004-pmk8001-cdp.dtb \
+	apq8096-v3.0-pmi8994-pmk8001-cdp.dtb \
+	apq8096-v3.0-pmi8996-cdp.dtb \
+	apq8096-v3.0-pmi8996-mtp.dtb \
+	apq8096-v3.0-liquid.dtb \
+	apq8096-v3.0-dragonboard.dtb \
+	apq8096-v3-pmi8994-mdm9x55-i2s-cdp.dtb \
+	apq8096-v3-pmi8994-pm8004-mdm9x55-i2s-cdp.dtb \
+	apq8096-v3-pmi8994-pm8004-pmk8001-mdm9x55-i2s-cdp.dtb \
+	apq8096-v3-pmi8994-pmk8001-mdm9x55-i2s-cdp.dtb \
+	apq8096-v3-pmi8996-mdm9x55-i2s-cdp.dtb \
+	apq8096-v3-pmi8994-mdm9x55-i2s-mtp.dtb \
+	apq8096-v3-pmi8994-mdm9x55-slimbus-mtp.dtb \
+	apq8096-v3-pmi8996-mdm9x55-i2s-mtp.dtb \
+	apq8096-v3-pmi8996-mdm9x55-slimbus-mtp.dtb \
+	apq8096-v3-pmi8996-dragonboard.dtb
+
+dtb-$(CONFIG_MSM_GVM_QUIN) += vplatform-lfv-msm8996.dtb
+
+ifeq ($(CONFIG_BOARD_MATA),n)
+
+ifeq ($(CONFIG_BUILD_ARM64_DT_OVERLAY),y)
+dtbo-$(CONFIG_ARCH_MSM8998) += \
+	msm8998-cdp-overlay.dtbo \
+	msm8998-mtp-overlay.dtbo \
+	msm8998-v2-cdp-overlay.dtbo \
+	msm8998-v2-mtp-overlay.dtbo \
+	msm8998-v2.1-cdp-overlay.dtbo \
+	msm8998-v2.1-mtp-overlay.dtbo \
+	msm8998-qrd-overlay.dtbo \
+	msm8998-qrd-vr1-overlay.dtbo \
+	msm8998-qrd-skuk-overlay.dtbo
+
+msm8998-cdp-overlay.dtbo-base :=  msm8998.dtb
+msm8998-mtp-overlay.dtbo-base :=  msm8998.dtb
+msm8998-v2-cdp-overlay.dtbo-base :=  msm8998-v2.dtb
+msm8998-v2-mtp-overlay.dtbo-base :=  msm8998-v2.dtb
+msm8998-v2.1-cdp-overlay.dtbo-base :=  msm8998-v2.1.dtb
+msm8998-v2.1-mtp-overlay.dtbo-base :=  msm8998-v2.1.dtb
+msm8998-qrd-overlay.dtbo-base :=  msm8998-qrd.dtb
+msm8998-qrd-vr1-overlay.dtbo-base :=  msm8998-qrd-vr1.dtb
+msm8998-qrd-skuk-overlay.dtbo-base :=  msm8998-qrd-skuk.dtb
+else
+dtb-$(CONFIG_ARCH_MSM8998) += msm8998-sim.dtb \
+	msm8998-rumi.dtb \
+	msm8998-cdp.dtb \
+	msm8998-mtp.dtb \
+	msm8998-qrd.dtb \
+	msm8998-v2-sim.dtb \
+	msm8998-v2-rumi.dtb \
+	msm8998-v2-mtp.dtb \
+	msm8998-v2-cdp.dtb \
+	msm8998-v2-qrd.dtb \
+	msm8998-qrd-skuk.dtb \
+	msm8998-v2-qrd-skuk.dtb \
+	msm8998-qrd-vr1.dtb \
+	msm8998-v2-qrd-vr1.dtb \
+	msm8998-v2-qrd-skuk-evt3.dtb \
+	msm8998-v2-qrd-skuk-hdk.dtb \
+	apq8098-mtp.dtb \
+	apq8098-cdp.dtb \
+	apq8098-v2-mtp.dtb \
+	apq8098-v2-cdp.dtb \
+	apq8098-v2-qrd.dtb \
+	apq8098-v2-qrd-skuk-hdk.dtb \
+	msm8998-v2.1-mtp.dtb \
+	msm8998-v2.1-mtp-4k-display.dtb \
+	msm8998-v2.1-cdp.dtb \
+	msm8998-v2.1-qrd.dtb \
+	apq8098-v2.1-mtp.dtb \
+	apq8098-v2.1-cdp.dtb \
+	apq8098-v2.1-qrd.dtb \
+	apq8098-v2.1-mediabox.dtb \
+	apq8098-v2.1-svr20.dtb \
+	msm8998-v2.1-interposer-sdm660-cdp.dtb \
+	msm8998-v2.1-interposer-sdm660-mtp.dtb \
+	msm8998-v2.1-interposer-sdm660-qrd.dtb \
+	msm8998-9x55-rcm.dtb \
+	msm8998-9x55-cdp.dtb \
+	msm8998-9x55-mtp.dtb
+endif
+
+endif
+
+dtb-$(CONFIG_ARCH_MSMHAMSTER) += msmhamster-rumi.dtb
+
+dtb-$(CONFIG_ARCH_SDM660) += sdm660-sim.dtb \
+	sdm660-internal-codec-cdp.dtb \
+	sdm660-internal-codec-mtp.dtb \
+	sdm660-internal-codec-rcm.dtb \
+	sdm660-cdp.dtb \
+	sdm660-mtp.dtb \
+	sdm660-qrd.dtb \
+	sdm660-rcm.dtb \
+	sdm660-rumi.dtb \
+	sdm660-pm660a-cdp.dtb \
+	sdm660-pm660a-mtp.dtb \
+	sdm660-pm660a-qrd.dtb \
+	sdm660-pm660a-rcm.dtb \
+	sdm660-pm660a-rumi.dtb \
+	sdm660-internal-codec-pm660a-cdp.dtb \
+	sdm660-internal-codec-pm660a-mtp.dtb \
+	sdm660-internal-codec-pm660a-rcm.dtb \
+	sdm660-pm660a-sim.dtb \
+	sda660-cdp.dtb \
+	sda660-mtp.dtb \
+	sda660-rcm.dtb \
+	sda660-pm660a-cdp.dtb \
+	sda660-pm660a-mtp.dtb \
+	sda660-pm660a-rcm.dtb \
+	sda660-pm660a-qrd-hdk.dtb \
+	sdm660-headset-jacktype-no-cdp.dtb \
+	sdm660-headset-jacktype-no-rcm.dtb \
+	sdm660-pm660a-headset-jacktype-no-cdp.dtb \
+	sdm660-pm660a-headset-jacktype-no-rcm.dtb \
+	sdm660-usbc-audio-mtp.dtb \
+	sdm660-usbc-audio-rcm.dtb \
+	sdm658-mtp.dtb \
+	sdm658-cdp.dtb \
+	sdm658-rcm.dtb \
+	sdm658-qrd.dtb \
+	sdm658-pm660a-mtp.dtb \
+	sdm658-pm660a-cdp.dtb \
+	sdm658-pm660a-rcm.dtb \
+	sdm658-pm660a-qrd.dtb \
+	sdm658-internal-codec-mtp.dtb \
+	sdm658-internal-codec-cdp.dtb \
+	sdm658-internal-codec-rcm.dtb \
+	sdm658-internal-codec-pm660a-mtp.dtb \
+	sdm658-internal-codec-pm660a-cdp.dtb \
+	sdm658-internal-codec-pm660a-rcm.dtb \
+	sda658-cdp.dtb \
+	sda658-mtp.dtb \
+	sda658-rcm.dtb \
+	sda658-pm660a-mtp.dtb \
+	sda658-pm660a-cdp.dtb \
+	sda658-pm660a-rcm.dtb \
+	sdm636-cdp.dtb \
+	sdm636-mtp.dtb \
+	sdm636-qrd.dtb \
+	sdm636-rcm.dtb \
+	sdm636-headset-jacktype-no-cdp.dtb \
+	sdm636-headset-jacktype-no-rcm.dtb \
+	sdm636-internal-codec-cdp.dtb \
+	sdm636-internal-codec-mtp.dtb \
+	sdm636-internal-codec-pm660a-cdp.dtb \
+	sdm636-internal-codec-pm660a-mtp.dtb \
+	sdm636-internal-codec-pm660a-rcm.dtb \
+	sdm636-internal-codec-rcm.dtb \
+	sdm636-pm660a-headset-jacktype-no-cdp.dtb \
+	sdm636-pm660a-headset-jacktype-no-rcm.dtb \
+	sdm636-pm660a-cdp.dtb \
+	sdm636-pm660a-mtp.dtb \
+	sdm636-pm660a-qrd.dtb \
+	sdm636-pm660a-rcm.dtb \
+	sdm636-usbc-audio-mtp.dtb \
+	sdm636-usbc-audio-rcm.dtb \
+	sda636-cdp.dtb \
+	sda636-mtp.dtb \
+	sda636-rcm.dtb \
+	sda636-pm660a-cdp.dtb \
+	sda636-pm660a-mtp.dtb \
+	sda636-pm660a-qrd-hdk.dtb \
+	sda636-pm660a-rcm.dtb
+
+dtb-$(CONFIG_ARCH_SDM630) += sdm630-rumi.dtb \
+	sdm630-pm660a-rumi.dtb \
+	sdm630-mtp.dtb \
+	sdm630-usbc-audio-mtp.dtb \
+	sdm630-usbc-audio-rcm.dtb \
+	sdm630-cdp.dtb \
+	sdm630-rcm.dtb \
+	sdm630-internal-codec-mtp.dtb \
+	sdm630-internal-codec-cdp.dtb \
+	sdm630-internal-codec-rcm.dtb \
+	sdm630-pm660a-cdp.dtb \
+	sdm630-pm660a-mtp.dtb \
+	sdm630-pm660a-rcm.dtb \
+	sdm630-pm660a-qrd.dtb \
+	sdm630-internal-codec-pm660a-cdp.dtb \
+	sdm630-internal-codec-pm660a-mtp.dtb \
+	sdm630-internal-codec-pm660a-rcm.dtb \
+	sda630-mtp.dtb \
+	sda630-cdp.dtb \
+	sda630-rcm.dtb \
+	sda630-pm660a-mtp.dtb \
+	sda630-pm660a-cdp.dtb \
+	sda630-pm660a-rcm.dtb \
+	sda630-pm660a-qrd-hdk.dtb \
+	sdm630-headset-jacktype-no-cdp.dtb \
+	sdm630-headset-jacktype-no-rcm.dtb \
+	sdm630-pm660a-headset-jacktype-no-cdp.dtb \
+	sdm630-pm660a-headset-jacktype-no-rcm.dtb
+
+ifeq ($(CONFIG_ARM64),y)
+always          := $(dtb-y)
+always          += $(dtbo-y)
+subdir-y        := $(dts-dirs)
+else
+targets += dtbs
+targets += $(addprefix ../, $(dtb-y))
+
+$(obj)/../%.dtb: $(src)/%.dts FORCE
+	$(call if_changed_dep,dtc)
+
+dtbs: $(addprefix $(obj)/../,$(dtb-y))
+endif
+clean-files := *.dtbo *.dtb
diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc-pmic-pins.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc-pmic-pins.dtsi
new file mode 100644
index 000000000000..e03c11d9d834
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8016-sbc-pmic-pins.dtsi
@@ -0,0 +1,40 @@
+#include <dt-bindings/pinctrl/qcom,pmic-gpio.h>
+
+&pm8916_gpios {
+
+	usb_hub_reset_pm: usb_hub_reset_pm {
+		pinconf {
+			pins = "gpio3";
+			function = PMIC_GPIO_FUNC_NORMAL;
+			output-low;
+		};
+	};
+
+	usb_sw_sel_pm: usb_sw_sel_pm {
+		pinconf {
+			pins = "gpio4";
+			function = PMIC_GPIO_FUNC_NORMAL;
+			power-source = <PM8916_GPIO_VPH>;
+			input-disable;
+		};
+	};
+
+	pm8916_gpios_leds: pm8916_gpios_leds {
+		pinconf {
+			pins = "gpio1", "gpio2";
+			function = PMIC_GPIO_FUNC_NORMAL;
+			output-low;
+		};
+	};
+};
+
+&pm8916_mpps {
+
+	pm8916_mpps_leds: pm8916_mpps_leds {
+		pinconf {
+			pins = "mpp2", "mpp3";
+			function = PMIC_GPIO_FUNC_NORMAL;
+			output-low;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc-soc-pins.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc-soc-pins.dtsi
new file mode 100644
index 000000000000..cbeee0bcdf52
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8016-sbc-soc-pins.dtsi
@@ -0,0 +1,13 @@
+
+#include <dt-bindings/gpio/gpio.h>
+
+&msmgpio {
+
+	msmgpio_leds: msmgpio_leds {
+		pinconf {
+			pins = "gpio21", "gpio120";
+			function = "gpio";
+			output-low;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dts b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts
new file mode 100644
index 000000000000..825f489a2af7
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dts
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8016-sbc.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8016 SBC";
+	compatible = "qcom,apq8016-sbc", "qcom,apq8016", "qcom,sbc";
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
new file mode 100644
index 000000000000..3011c88bd2f3
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
@@ -0,0 +1,117 @@
+/*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8916.dtsi"
+#include "pm8916.dtsi"
+#include "apq8016-sbc-soc-pins.dtsi"
+#include "apq8016-sbc-pmic-pins.dtsi"
+
+/ {
+	aliases {
+		serial0 = &blsp1_uart2;
+		serial1 = &blsp1_uart1;
+	};
+
+	chosen {
+		stdout-path = "serial0";
+	};
+
+	soc {
+		serial@78b0000 {
+			status = "okay";
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&blsp1_uart2_default>;
+			pinctrl-1 = <&blsp1_uart2_sleep>;
+		};
+
+		i2c@78b6000 {
+		/* On Low speed expansion */
+			status = "okay";
+		};
+
+		i2c@78b8000 {
+		/* On High speed expansion */
+			status = "okay";
+		};
+
+		i2c@78ba000 {
+		/* On Low speed expansion */
+			status = "okay";
+		};
+
+		spi@78b7000 {
+		/* On High speed expansion */
+			status = "okay";
+		};
+
+		spi@78b9000 {
+		/* On Low speed expansion */
+			status = "okay";
+		};
+
+		leds {
+			pinctrl-names = "default";
+			pinctrl-0 = <&msmgpio_leds>,
+				    <&pm8916_gpios_leds>,
+				    <&pm8916_mpps_leds>;
+
+			compatible = "gpio-leds";
+
+			led@1 {
+				label = "apq8016-sbc:green:user1";
+				gpios = <&msmgpio 21 GPIO_ACTIVE_HIGH>;
+				linux,default-trigger = "heartbeat";
+				default-state = "off";
+			};
+
+			led@2 {
+				label = "apq8016-sbc:green:user2";
+				gpios = <&msmgpio 120 GPIO_ACTIVE_HIGH>;
+				linux,default-trigger = "mmc0";
+				default-state = "off";
+			};
+
+			led@3 {
+				label = "apq8016-sbc:green:user3";
+				gpios = <&pm8916_gpios 1 GPIO_ACTIVE_HIGH>;
+				linux,default-trigger = "mmc1";
+				default-state = "off";
+			};
+
+			led@4 {
+				label = "apq8016-sbc:green:user4";
+				gpios = <&pm8916_gpios 2 GPIO_ACTIVE_HIGH>;
+				linux,default-trigger = "none";
+				default-state = "off";
+			};
+
+			led@5 {
+				label = "apq8016-sbc:yellow:wlan";
+				gpios = <&pm8916_mpps 2 GPIO_ACTIVE_HIGH>;
+				linux,default-trigger = "wlan";
+				default-state = "off";
+			};
+
+			led@6 {
+				label = "apq8016-sbc:blue:bt";
+				gpios = <&pm8916_mpps 3 GPIO_ACTIVE_HIGH>;
+				linux,default-trigger = "bluetooth-power";
+				default-state = "off";
+			};
+		};
+	};
+};
+
+&sdhc_1 {
+	status = "okay";
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-auto-dragonboard.dtsi b/arch/arm64/boot/dts/qcom/apq8096-auto-dragonboard.dtsi
new file mode 100644
index 000000000000..db33594d3827
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-auto-dragonboard.dtsi
@@ -0,0 +1,1009 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8996-pinctrl.dtsi"
+#include "apq8096-camera-sensor-dragonboard.dtsi"
+
+/ {
+	bluetooth: bt_qca6174 {
+		compatible = "qca,qca6174";
+		qca,bt-reset-gpio = <&pm8994_gpios 19 0>; /* BT_EN */
+		qca,bt-vdd-core-supply = <&vph_pwr_vreg>;
+		qca,bt-vdd-pa-supply = <&vph_pwr_vreg>;
+		qca,bt-vdd-io-supply = <&pm8994_s4>;
+		qca,bt-vdd-xtal-supply = <&vph_pwr_vreg>;
+		qca,bt-chip-pwd-voltage-level = <1300000 1300000>;
+		qca,bt-vdd-io-voltage-level = <1800000 1800000>;
+		qca,bt-vdd-xtal-voltage-level = <1800000 1800000>;
+	};
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&sdcc1_ice {
+	status = "ok";
+};
+
+&ufsphy1 {
+	status = "ok";
+};
+
+&ufs1 {
+	status = "ok";
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&sdhc_1 {
+	vdd-supply = <&pm8994_l20>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	vdd-io-supply = <&pm8994_s4>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <110 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000
+				96000000 192000000 384000000>;
+	qcom,ice-clk-rates = <300000000 150000000>;
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8994_l21>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8994_l13>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000
+				100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x1>;
+
+	status = "ok";
+};
+
+&pm8994_vadc {
+	chan@5 {
+		label = "vcoin";
+		reg = <5>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7 {
+		label = "vph_pwr";
+		reg = <7>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8994_adc_tm {
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x48>;
+		qcom,thermal-node;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x80>;
+		qcom,thermal-node;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x88>;
+		qcom,thermal-node;
+	};
+};
+
+&mdss_hdmi_tx {
+	pinctrl-names = "hdmi_hpd_active", "hdmi_ddc_active", "hdmi_cec_active",
+				"hdmi_active", "hdmi_sleep";
+	pinctrl-0 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_suspend
+						&mdss_hdmi_cec_suspend>;
+	pinctrl-1 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+						&mdss_hdmi_cec_suspend>;
+	pinctrl-2 = <&mdss_hdmi_hpd_active &mdss_hdmi_cec_active
+						&mdss_hdmi_ddc_suspend>;
+	pinctrl-3 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+						&mdss_hdmi_cec_active>;
+	pinctrl-4 = <&mdss_hdmi_hpd_suspend &mdss_hdmi_ddc_suspend
+						&mdss_hdmi_cec_suspend>;
+};
+
+&pmi8994_vadc {
+	chan@0 {
+		label = "usbin";
+		reg = <0>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <4>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@1 {
+		label = "dcin";
+		reg = <1>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <4>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@43 {
+		label = "usb_dp";
+		reg = <0x43>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@44 {
+		label = "usb_dm";
+		reg = <0x44>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+#include "msm8996-sde-display.dtsi"
+
+&dsi_hx8379a_fwvga_truly_vid {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <255>;
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <50>;
+	qcom,mdss-dsi-bl-pmic-bank-select = <0>;
+	qcom,mdss-dsi-pwm-gpio = <&pm8994_gpios 5 0>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+	qcom,sde-plane-id-map {
+		qcom,sde-plane-id@0 {
+			reg = <0x0>;
+			qcom,display-type = "primary";
+			qcom,plane-name = "rgb0", "rgb1";
+			qcom,plane-type = "primary";
+		};
+
+		qcom,sde-plane-id@1 {
+			reg = <0x1>;
+			qcom,display-type = "primary";
+			qcom,plane-name = "vig0", "vig1";
+			qcom,plane-type = "overlay";
+		};
+
+		qcom,sde-plane-id@2 {
+			reg = <0x2>;
+			qcom,display-type = "primary";
+			qcom,plane-name = "cursor0";
+			qcom,plane-type = "cursor";
+		};
+
+		qcom,sde-plane-id@3 {
+			reg = <0x3>;
+			qcom,display-type = "secondary";
+			qcom,plane-name = "rgb2";
+			qcom,plane-type = "primary";
+		};
+
+		qcom,sde-plane-id@4 {
+			reg = <0x4>;
+			qcom,display-type = "secondary";
+			qcom,plane-name = "vig2";
+			qcom,plane-type = "overlay";
+		};
+
+		qcom,sde-plane-id@5 {
+			reg = <0x5>;
+			qcom,display-type = "secondary";
+			qcom,plane-name = "dma0";
+			qcom,plane-type = "overlay";
+		};
+
+		qcom,sde-plane-id@6 {
+			reg = <0x6>;
+			qcom,display-type = "secondary";
+			qcom,plane-name = "cursor1";
+			qcom,plane-type = "cursor";
+		};
+
+		qcom,sde-plane-id@7 {
+			reg = <0x7>;
+			qcom,display-type = "tertiary";
+			qcom,plane-name = "rgb3";
+			qcom,plane-type = "primary";
+		};
+
+		qcom,sde-plane-id@8 {
+			reg = <0x8>;
+			qcom,display-type = "tertiary";
+			qcom,plane-name = "vig3";
+			qcom,plane-type = "overlay";
+		};
+
+		qcom,sde-plane-id@9 {
+			reg = <0x9>;
+			qcom,display-type = "tertiary";
+			qcom,plane-name = "dma1";
+			qcom,plane-type = "overlay";
+		};
+	};
+};
+
+&mdss_dsi {
+	hw-config = "single_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_hx8379a_fwvga_truly_vid>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active &mdss_disp_bkl_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend &mdss_disp_bkl_suspend>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+	qcom,platform-bklight-en-gpio = <&tlmm 135 0>;
+};
+
+&mdss_dsi1 {
+	status = "disabled";
+};
+
+&labibb {
+	status = "ok";
+	qcom,qpnp-labibb-mode = "lcd";
+};
+
+&ibb_regulator {
+	qcom,qpnp-ibb-discharge-resistor = <32>;
+};
+
+&rpm_bus {
+	rpm-regulator-bstb {
+		status = "disabled";
+		regulator-bst {
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa22 {
+		pm8994_l22: regulator-l22 {
+			regulator-min-microvolt = <3000000>;
+			regulator-max-microvolt = <3000000>;
+			qcom,init-voltage = <3000000>;
+		};
+	};
+};
+
+&pmi8994_charger {
+	/delete-property/ otg-parent-supply;
+	qcom,charging-disabled;
+	smbcharger_charger_otg {
+		parent-supply = <&pmi8994_boost_5v>;
+	};
+};
+
+&pmi8994_fg {
+	status = "disabled";
+};
+
+&pmi8994_charger {
+	status = "disabled";
+};
+
+&usb_otg_switch {
+	gpio = <&pm8994_gpios 11 0>;
+	enable-active-high;
+	status = "ok";
+};
+
+&usb3 {
+	qcom,charging-disabled;
+	vbus_dwc3-supply = <&usb_otg_switch>;
+};
+
+&usb2s {
+	status = "ok";
+	pinctrl-0 = <&usb_hub_reset_active>;
+	pinctrl-1 = <&usb_hub_reset_suspend>;
+	qcom,ext-hub-reset-gpio =  <&tlmm 103 0>;
+	qcom,disable-host-mode-pm;
+	dwc3@7600000 {
+		dr_mode = "host";
+	};
+};
+
+&usb_nop_phy {
+	status = "ok";
+};
+
+&qusb_phy1 {
+	status = "ok";
+};
+
+&rome_vreg {
+	status = "disabled";
+};
+
+&pm8994_mpps {
+	mpp@a100 { /* MPP 2 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <0>;
+		status = "okay";
+	};
+
+	mpp@a200 { /* MPP 3 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <0>;
+		status = "okay";
+	};
+
+	mpp@a300 { /* MPP 4 */
+		/* HDMI_5v_vreg regulator enable */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <0>;
+		status = "okay";
+	};
+
+	mpp@a500 { /* MPP 6 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <0>;
+		status = "okay";
+	};
+};
+
+
+&pmi8994_gpios {
+	gpio@c100 {	/* GPIO 2  SPKR_SD_N */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c200 {	/* GPIO 3 SPKR_SD_N */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c300 {	/* GPIO 4 USB2_ID */
+		qcom,mode = <0>;	/* DIGITAL INPUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c500 {	/* GPIO 6 USB2_VBUS_DET*/
+		qcom,mode = <0>;	/* DIGITAL INPUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+};
+
+&pmi8994_mpps {
+	mpp@a300 { /* MPP 4 */
+		/* WLED FET */
+		qcom,mode = <1>;        /* DIGITAL OUT */
+		qcom,vin-sel = <0>;     /* VIN0 */
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&soc {
+	qcom,ntn_avb {
+		compatible = "qcom,ntn_avb";
+
+		ntn-rst-gpio = <&pm8994_gpios 13 0>;
+
+		vdd-ntn-hsic-supply = <&pm8994_l25>;
+		vdd-ntn-pci-supply = <&pm8994_s4>;
+		vdd-ntn-io-supply = <&pm8994_s4>;
+
+		qcom,ntn-rst-delay-msec = <100>;
+		qcom,ntn-rc-num = <1>;
+	};
+
+	qcom,cnss {
+		wlan-bootstrap-gpio = <&tlmm 46 0>;
+		wlan-en-gpio = <&pm8994_gpios 8 0>;
+		vdd-wlan-io-supply = <&pm8994_s4>;
+		/* removing unneeded regulators */
+		/delete-property/ vdd-wlan-supply;
+		/delete-property/ vdd-wlan-xtal-supply;
+		/delete-property/ vdd-wlan-core-supply;
+	};
+
+	i2c@75ba000 {
+		synaptics@20 {
+			compatible = "synaptics,dsx";
+			reg = <0x20>;
+			interrupt-parent = <&tlmm>;
+			interrupts = <125 0x2008>;
+			vdd-supply = <&pm8994_l14>;
+			avdd-supply = <&pm8994_l22>;
+			pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+			pinctrl-0 = <&ts_active>;
+			pinctrl-1 = <&ts_suspend>;
+			synaptics,display-coords = <0 0 480 854>;
+			synaptics,panel-coords = <0 0 480 854>;
+			synaptics,reset-gpio = <&tlmm 89 0x00>;
+			synaptics,irq-gpio = <&tlmm 125 0x2008>;
+			synaptics,button-map = <139 102 158>;
+			synaptics,disable-gpios;
+			/* Underlying clocks used by secure touch */
+			clock-names = "iface_clk", "core_clk";
+			clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+				 <&clock_gcc clk_gcc_blsp2_qup6_i2c_apps_clk>;
+		};
+	};
+
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8994_gpios 2 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+
+		gp_switch_gpio {
+			label = "gp_switch_gpio";
+			pinctrl-0 = <&gp_switch_active>;
+			pinctrl-1 = <&gp_switch_suspend>;
+			gpios = <&tlmm 127 0x1>;
+			linux,input-type = <1>;
+			linux,code = <158>; /* By default mapped to BACK */
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+
+	/*
+	* vph_pwr_vreg represents the unregulated battery voltage supply
+	* VPH_PWR that is present whenever the device is powered on.
+	*/
+	vph_pwr_vreg: vph_pwr_vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "vph_pwr";
+		status = "ok";
+		regulator-always-on;
+	};
+
+
+	sound {
+		status = "disabled";
+	};
+
+	sound-9335 {
+		status = "disabled";
+	};
+
+	sound-auto {
+		compatible = "qcom,apq8096-asoc-snd-auto";
+		qcom,model = "apq8096-auto-snd-card";
+
+		asoc-platform = <&pcm0>, <&pcm1>, <&pcm2>, <&voip>, <&voice>,
+				<&loopback>, <&compress>, <&hostless>,
+				<&afe>, <&lsm>, <&routing>, <&pcmnoirq>,
+				<&loopback1>;
+		asoc-platform-names = "msm-pcm-dsp.0", "msm-pcm-dsp.1",
+				"msm-pcm-dsp.2", "msm-voip-dsp",
+				"msm-pcm-voice", "msm-pcm-loopback",
+				"msm-compress-dsp", "msm-pcm-hostless",
+				"msm-pcm-afe", "msm-lsm-client",
+				"msm-pcm-routing", "msm-pcm-dsp-noirq",
+				"msm-pcm-loopback.1";
+		asoc-cpu = <&dai_pri_auxpcm>, <&dai_sec_auxpcm>, <&dai_hdmi>,
+				<&dai_mi2s_sec>, <&dai_mi2s>, <&dai_mi2s_quat>,
+				<&afe_pcm_rx>, <&afe_pcm_tx>,
+				<&afe_proxy_rx>, <&afe_proxy_tx>,
+				<&incall_record_rx>, <&incall_record_tx>,
+				<&incall_music_rx>, <&incall_music2_rx>,
+				<&dai_pri_tdm_tx_0>, <&dai_pri_tdm_tx_1>,
+				<&dai_pri_tdm_tx_2>, <&dai_pri_tdm_tx_3>,
+				<&dai_pri_tdm_rx_0>, <&dai_pri_tdm_rx_1>,
+				<&dai_pri_tdm_rx_2>, <&dai_pri_tdm_rx_3>,
+				<&dai_sec_tdm_tx_0>, <&dai_sec_tdm_tx_1>,
+				<&dai_sec_tdm_tx_2>, <&dai_sec_tdm_tx_3>,
+				<&dai_tert_tdm_rx_0>, <&dai_tert_tdm_rx_1>,
+				<&dai_tert_tdm_rx_2>, <&dai_tert_tdm_rx_3>,
+				<&dai_tert_tdm_rx_4>, <&dai_tert_tdm_tx_0>,
+				<&dai_tert_tdm_tx_1>, <&dai_tert_tdm_tx_2>,
+				<&dai_tert_tdm_tx_3>, <&dai_quat_tdm_rx_0>,
+				<&dai_quat_tdm_rx_1>, <&dai_quat_tdm_rx_2>,
+				<&dai_quat_tdm_rx_3>, <&dai_quat_tdm_tx_0>,
+				<&dai_quat_tdm_tx_1>, <&dai_quat_tdm_tx_2>,
+				<&dai_quat_tdm_tx_3>;
+		asoc-cpu-names = "msm-dai-q6-auxpcm.1", "msm-dai-q6-auxpcm.2",
+				"msm-dai-q6-hdmi.8", "msm-dai-q6-mi2s.1",
+				"msm-dai-q6-mi2s.2", "msm-dai-q6-mi2s.3",
+				"msm-dai-q6-dev.224", "msm-dai-q6-dev.225",
+				"msm-dai-q6-dev.241", "msm-dai-q6-dev.240",
+				"msm-dai-q6-dev.32771", "msm-dai-q6-dev.32772",
+				"msm-dai-q6-dev.32773", "msm-dai-q6-dev.32770",
+				"msm-dai-q6-tdm.36865", "msm-dai-q6-tdm.36867",
+				"msm-dai-q6-tdm.36869", "msm-dai-q6-tdm.36871",
+				"msm-dai-q6-tdm.36864", "msm-dai-q6-tdm.36866",
+				"msm-dai-q6-tdm.36868", "msm-dai-q6-tdm.36870",
+				"msm-dai-q6-tdm.36881", "msm-dai-q6-tdm.36883",
+				"msm-dai-q6-tdm.36885", "msm-dai-q6-tdm.36887",
+				"msm-dai-q6-tdm.36896", "msm-dai-q6-tdm.36898",
+				"msm-dai-q6-tdm.36900", "msm-dai-q6-tdm.36902",
+				"msm-dai-q6-tdm.36904", "msm-dai-q6-tdm.36897",
+				"msm-dai-q6-tdm.36899", "msm-dai-q6-tdm.36901",
+				"msm-dai-q6-tdm.36903", "msm-dai-q6-tdm.36912",
+				"msm-dai-q6-tdm.36914", "msm-dai-q6-tdm.36916",
+				"msm-dai-q6-tdm.36918", "msm-dai-q6-tdm.36913",
+				"msm-dai-q6-tdm.36915", "msm-dai-q6-tdm.36917",
+				"msm-dai-q6-tdm.36919";
+		asoc-codec = <&stub_codec>;
+		asoc-codec-names = "msm-stub-codec.1";
+	};
+
+	usb_detect {
+		compatible = "qcom,gpio-usbdetect";
+		qcom,gpio-vbus-det = <&pm8994_gpios 22 0>;
+		vin-supply = <&vph_pwr_vreg>;
+	};
+
+	loopback1: qcom,msm-pcm-loopback-low-latency {
+		compatible = "qcom,msm-pcm-loopback";
+		qcom,msm-pcm-loopback-low-latency;
+	};
+
+	qcom,msm-dai-mi2s {
+		dai_mi2s_sec: qcom,msm-dai-q6-mi2s-sec {
+			qcom,msm-mi2s-rx-lines = <2>;
+			qcom,msm-mi2s-tx-lines = <1>;
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&sec_mi2s_active &sec_mi2s_sd0_active
+				&sec_mi2s_sd1_active>;
+			pinctrl-1 = <&sec_mi2s_sleep &sec_mi2s_sd0_sleep
+				&sec_mi2s_sd1_sleep>;
+		};
+
+		dai_mi2s_quat: qcom,msm-dai-q6-mi2s-quat {
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&quat_mi2s_active &quat_mi2s_sd0_active>;
+			pinctrl-1 = <&quat_mi2s_sleep &quat_mi2s_sd0_sleep>;
+		};
+	};
+
+	qcom,msm-dai-tdm-tert-rx {
+		pinctrl-names = "default", "sleep";
+		pinctrl-0 = <&tert_tdm_dout_active>;
+		pinctrl-1 = <&tert_tdm_dout_sleep>;
+	};
+
+	qcom,msm-dai-tdm-quat-rx {
+		pinctrl-names = "default", "sleep";
+		pinctrl-0 = <&quat_tdm_dout_active>;
+		pinctrl-1 = <&quat_tdm_dout_sleep>;
+	};
+};
+
+&spmi_bus {
+	qcom,pm8994@1 {
+		pwm@b100 {
+			qcom,dtest-line = <4>;
+			qcom,dtest-output = <1>;
+			status = "okay";
+		};
+	};
+};
+
+&pm8994_gpios {
+	gpio@c100 { /* GPIO 2 - KYPD_VOLP_N */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c300 { /* GPIO 4 - BL1_PWM */
+		qcom,mode = <1>;
+		qcom,pull = <1>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <4>;
+		status = "okay";
+	};
+
+	gpio@c400 { /* GPIO 5 - BL0_PWM */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <1>;	/* PULL DOWN */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <7>;	/* LPG4 */
+		qcom,master-en = <1>;   /* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@c600 { /* GPIO 7 */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c700 { /* GPIO 8 - WLAN_EN */
+		qcom,mode = <1>;	/* Digital output*/
+		qcom,out-strength = <2>;/* QPNP_PIN_OUT_STRENGTH_MED */
+		qcom,pull = <4>;	/* Pulldown 10uA */
+		qcom,vin-sel = <2>;	/* VIN2 */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,invert = <0>;	/* Invert */
+		qcom,master-en = <1>;	/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@c900 { /* GPIO 10 */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@ca00 { /* GPIO 11 - USB enb1 (otg switch) */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <1>;	/* PULL DOWN */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,master-en = <1>;	/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@cc00 { /* GPIO 13 - NTN_RST */
+		qcom,mode = <1>; /* DIGITAL OUT */
+		qcom,output-type = <0>; /* CMOS logic */
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>; /* 1.8 */
+		qcom,out-strength = <1>;
+		qcom,src-sel = <0>; /* GPIO */
+		qcom,master-en = <0>; /* Disable GPIO */
+		status = "okay";
+	};
+
+	gpio@ce00 { /* GPIO 15 - DIVCLK1 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@cf00 { /* GPIO 16 - DIVCLK2 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@d000 { /* GPIO 17 - DIVCLK3 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@d100 { /* GPIO 18 - Rome Sleep Clock */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <0>;		/* Output low initially */
+		qcom,vin-sel = <2>;		/* VIN 2 */
+		qcom,src-sel = <3>;		/* Function 2 */
+		qcom,out-strength = <2>;	/* Medium */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@d200 { /* GPIO 19 - Rome BT Reset */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,out-strength = <2>;	/* QPNP_PIN_OUT_STRENGTH_MED */
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@d500 { /* GPIO 22 - USB1 VBUS detect  */
+		qcom,mode = <0>;		/* Digital Input*/
+		qcom,pull = <5>;		/* No pull */
+		qcom,vin-sel = <2>;		/* 1.8 V */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&pmi8994_haptics {
+	status = "okay";
+};
+
+&blsp1_uart2 {
+	status = "ok";
+};
+
+&slim_msm {
+	tasha_codec {
+		qcom,cdc-micbias2-headset-only;
+		qcom,cdc-micbias1-ext-cap;
+		qcom,cdc-micbias2-ext-cap;
+		qcom,cdc-micbias3-ext-cap;
+		qcom,cdc-micbias4-ext-cap;
+	};
+};
+
+&cam_sensor_mclk0_active { /* MCLK0 */
+	config {
+		drive-strength = <8>; /* 8 MA */
+	};
+};
+
+&cam_sensor_mclk0_suspend { /* MCLK0 */
+	config {
+		drive-strength = <8>; /* 8 MA */
+	};
+};
+
+&cam_sensor_mclk1_active { /* MCLK1 */
+	config {
+		drive-strength = <8>; /* 8 MA */
+	};
+};
+
+&cam_sensor_mclk1_suspend { /* MCLK1 */
+	config {
+		drive-strength = <8>; /* 8 MA */
+	};
+};
+
+&cam_sensor_mclk2_active { /* MCLK2 */
+	config {
+		drive-strength = <8>; /* 8 MA */
+	};
+};
+
+&cam_sensor_mclk2_suspend { /* MCLK2 */
+	config {
+		drive-strength = <8>; /* 8 MA */
+	};
+};
+
+&spi_0 {
+	spi_codec@0 {
+		compatible = "qcom,spi-msm-codec-slave";
+		reg = <0>;
+		spi-max-frequency = <2000000>;
+		spi-cpha;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-ba.dtsi b/arch/arm64/boot/dts/qcom/apq8096-ba.dtsi
new file mode 100644
index 000000000000..e6524593e502
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-ba.dtsi
@@ -0,0 +1,18 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	msm_ba: qcom,ba {
+		compatible = "qcom,msm-ba";
+		status = "ok";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-camera-sensor-dragonboard.dtsi b/arch/arm64/boot/dts/qcom/apq8096-camera-sensor-dragonboard.dtsi
new file mode 100644
index 000000000000..5aabb8d15a9f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-camera-sensor-dragonboard.dtsi
@@ -0,0 +1,258 @@
+/*
+ * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * Note: default configuration is for the camera modules to be powered
+ * by the PMIC from the CSI connector. Alternative configuration is for
+ * self-powered camera modules.
+ */
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&pm8994_l23>;
+		/* cam_vaf-supply = <&vph_pwr_vreg>; */
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&pm8994_l23>;
+		/* cam_vaf-supply = <&vph_pwr_vreg>; */
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		qcom,eeprom-name = "onsemi_cat24c32";
+		compatible = "qcom,eeprom";
+		qcom,slave-addr = <0xa0>;
+		qcom,cci-master = <0>;
+		qcom,num-blocks = <1>;
+		qcom,page0 = <0 0 0 0 0 0>;
+		qcom,poll0 = <0 0 0 0 0 0>;
+		qcom,saddr0 = <0xa0>;
+		qcom,mem0 = <2245 0x00 2 0 1 0>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		/* cam_vio-supply = <&vph_pwr_vreg>; */
+		qcom,cam-vreg-name = "cam_vio";
+		qcom,cam-vreg-min-voltage = <0>;
+		qcom,cam-vreg-max-voltage = <0>;
+		qcom,cam-vreg-op-mode = <0>;
+		qcom,cam-power-seq-type = "sensor_vreg";
+		qcom,cam-power-seq-val = "cam_vio";
+		qcom,cam-power-seq-cfg-val = <1>;
+		qcom,cam-power-seq-delay = <1>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		qcom,eeprom-name = "onsemi_cat24c16";
+		compatible = "qcom,eeprom";
+		qcom,slave-addr = <0xa0>;
+		qcom,cci-master = <1>;
+		qcom,num-blocks = <7>;
+
+		qcom,page0 = <0 0 0 0 0 0>;
+		qcom,poll0 = <0 0 0 0 0 0>;
+		qcom,saddr0 = <0xa0>;
+		qcom,mem0 = <256 0x00 1 0 1 0>;
+
+		qcom,page1 = <0 0 0 0 0 0>;
+		qcom,poll1 = <0 0 0 0 0 0>;
+		qcom,saddr1 = <0xa2>;
+		qcom,mem1 = <256 0x00 1 0 1 0>;
+
+		qcom,page2 = <0 0 0 0 0 0>;
+		qcom,poll2 = <0 0 0 0 0 0>;
+		qcom,saddr2 = <0xa4>;
+		qcom,mem2 = <256 0x00 1 0 1 0>;
+
+		qcom,page3 = <0 0 0 0 0 0>;
+		qcom,poll3 = <0 0 0 0 0 0>;
+		qcom,saddr3 = <0xa6>;
+		qcom,mem3 = <256 0x00 1 0 1 0>;
+
+		qcom,page4 = <0 0 0 0 0 0>;
+		qcom,poll4 = <0 0 0 0 0 0>;
+		qcom,saddr4 = <0xa8>;
+		qcom,mem4 = <256 0x00 1 0 1 0>;
+
+		qcom,page5 = <0 0 0 0 0 0>;
+		qcom,poll5 = <0 0 0 0 0 0>;
+		qcom,saddr5 = <0xaa>;
+		qcom,mem5 = <256 0x00 1 0 1 0>;
+
+		qcom,page6 = <0 0 0 0 0 0>;
+		qcom,poll6 = <0 0 0 0 0 0>;
+		qcom,saddr6 = <0xac>;
+		qcom,mem6 = <254 0x00 1 0 1 0>;
+
+		cam_vio-supply = <&pm8994_lvs1>;
+		/* cam_vio-supply = <&vph_pwr_vreg>; */
+		qcom,cam-vreg-name = "cam_vio";
+		qcom,cam-vreg-min-voltage = <0>;
+		qcom,cam-vreg-max-voltage = <0>;
+		qcom,cam-vreg-op-mode = <0>;
+		qcom,cam-power-seq-type = "sensor_vreg";
+		qcom,cam-power-seq-val = "cam_vio";
+		qcom,cam-power-seq-cfg-val = <1>;
+		qcom,cam-power-seq-delay = <1>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vdig-supply = <&vph_pwr_vreg>;
+		/* Cameras powered by PMIC: */
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l17>;
+		/* Self-powered cameras: */
+		/* cam_vio-supply = <&vph_pwr_vreg>; */
+		/* cam_vana-supply = <&vph_pwr_vreg>; */
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1300000 0 2500000>;
+		qcom,cam-vreg-max-voltage = <1300000 0 2500000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active &cam_csi0_sensor_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_csi0_sensor_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 25 0>,
+			<&tlmm 26 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					  "CAM_RESET0",
+					  "CAM_STANDBY0";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <0>;
+		cam_vdig-supply = <&vph_pwr_vreg>;
+		/* Cameras powered by PMIC: */
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l18>;
+		/* Self-powered cameras: */
+		/* cam_vio-supply = <&vph_pwr_vreg>; */
+		/* cam_vana-supply = <&vph_pwr_vreg>; */
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1000000 0 3150000>;
+		qcom,cam-vreg-max-voltage = <1000000 0 3600000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active &cam_csi1_sensor_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				&cam_csi1_sensor_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 104 0>,
+			<&tlmm 98 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_STANDBY1";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <0>;
+		qcom,eeprom-src = <&eeprom1>;
+		qcom,actuator-src = <&actuator1>;
+		/* Cameras powered by PMIC: */
+		cam_vdig-supply = <&vph_pwr_vreg>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l29>;
+		/* Self-powered cameras: */
+		/* cam_vio-supply = <&vph_pwr_vreg>; */
+		/* cam_vana-supply = <&vph_pwr_vreg>; */
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1000000 0 2800000>;
+		qcom,cam-vreg-max-voltage = <1000000 0 2800000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active &cam_csi2_sensor_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				&cam_csi2_sensor_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 23 0>,
+			<&tlmm 133 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					  "CAM_RESET2",
+					  "CAM_STANDBY2";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-camera-sensor-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8096-camera-sensor-sbc.dtsi
new file mode 100644
index 000000000000..2bfb6501160e
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-camera-sensor-sbc.dtsi
@@ -0,0 +1,240 @@
+/*
+ * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * Note: default configuration is for self-powered camera modules.
+ */
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&vph_pwr_vreg>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&vph_pwr_vreg>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		qcom,eeprom-name = "onsemi_cat24c32";
+		compatible = "qcom,eeprom";
+		qcom,slave-addr = <0xa0>;
+		qcom,cci-master = <0>;
+		qcom,num-blocks = <1>;
+		qcom,page0 = <0 0 0 0 0 0>;
+		qcom,poll0 = <0 0 0 0 0 0>;
+		qcom,saddr0 = <0xa0>;
+		qcom,mem0 = <2245 0x00 2 0 1 0>;
+		cam_vio-supply = <&vph_pwr_vreg>;
+		qcom,cam-vreg-name = "cam_vio";
+		qcom,cam-vreg-min-voltage = <0>;
+		qcom,cam-vreg-max-voltage = <0>;
+		qcom,cam-vreg-op-mode = <0>;
+		qcom,cam-power-seq-type = "sensor_vreg";
+		qcom,cam-power-seq-val = "cam_vio";
+		qcom,cam-power-seq-cfg-val = <1>;
+		qcom,cam-power-seq-delay = <1>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		qcom,eeprom-name = "onsemi_cat24c16";
+		compatible = "qcom,eeprom";
+		qcom,slave-addr = <0xa0>;
+		qcom,cci-master = <1>;
+		qcom,num-blocks = <7>;
+
+		qcom,page0 = <0 0 0 0 0 0>;
+		qcom,poll0 = <0 0 0 0 0 0>;
+		qcom,saddr0 = <0xa0>;
+		qcom,mem0 = <256 0x00 1 0 1 0>;
+
+		qcom,page1 = <0 0 0 0 0 0>;
+		qcom,poll1 = <0 0 0 0 0 0>;
+		qcom,saddr1 = <0xa2>;
+		qcom,mem1 = <256 0x00 1 0 1 0>;
+
+		qcom,page2 = <0 0 0 0 0 0>;
+		qcom,poll2 = <0 0 0 0 0 0>;
+		qcom,saddr2 = <0xa4>;
+		qcom,mem2 = <256 0x00 1 0 1 0>;
+
+		qcom,page3 = <0 0 0 0 0 0>;
+		qcom,poll3 = <0 0 0 0 0 0>;
+		qcom,saddr3 = <0xa6>;
+		qcom,mem3 = <256 0x00 1 0 1 0>;
+
+		qcom,page4 = <0 0 0 0 0 0>;
+		qcom,poll4 = <0 0 0 0 0 0>;
+		qcom,saddr4 = <0xa8>;
+		qcom,mem4 = <256 0x00 1 0 1 0>;
+
+		qcom,page5 = <0 0 0 0 0 0>;
+		qcom,poll5 = <0 0 0 0 0 0>;
+		qcom,saddr5 = <0xaa>;
+		qcom,mem5 = <256 0x00 1 0 1 0>;
+
+		qcom,page6 = <0 0 0 0 0 0>;
+		qcom,poll6 = <0 0 0 0 0 0>;
+		qcom,saddr6 = <0xac>;
+		qcom,mem6 = <254 0x00 1 0 1 0>;
+
+		cam_vio-supply = <&vph_pwr_vreg>;
+		qcom,cam-vreg-name = "cam_vio";
+		qcom,cam-vreg-min-voltage = <0>;
+		qcom,cam-vreg-max-voltage = <0>;
+		qcom,cam-vreg-op-mode = <0>;
+		qcom,cam-power-seq-type = "sensor_vreg";
+		qcom,cam-power-seq-val = "cam_vio";
+		qcom,cam-power-seq-cfg-val = <1>;
+		qcom,cam-power-seq-delay = <1>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vdig-supply = <&vph_pwr_vreg>;
+		cam_vio-supply = <&vph_pwr_vreg>;
+		cam_vana-supply = <&vph_pwr_vreg>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1300000 0 2500000>;
+		qcom,cam-vreg-max-voltage = <1300000 0 2500000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active &cam_csi0_sensor_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_csi0_sensor_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 25 0>,
+			<&tlmm 26 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					  "CAM_RESET0",
+					  "CAM_STANDBY0";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <0>;
+		cam_vdig-supply = <&vph_pwr_vreg>;
+		cam_vio-supply = <&vph_pwr_vreg>;
+		cam_vana-supply = <&vph_pwr_vreg>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1000000 0 3150000>;
+		qcom,cam-vreg-max-voltage = <1000000 0 3600000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active &cam_csi1_sensor_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				&cam_csi1_sensor_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 104 0>,
+			<&tlmm 98 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_STANDBY1";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <0>;
+		qcom,eeprom-src = <&eeprom1>;
+		qcom,actuator-src = <&actuator1>;
+		cam_vdig-supply = <&vph_pwr_vreg>;
+		cam_vio-supply = <&vph_pwr_vreg>;
+		cam_vana-supply = <&vph_pwr_vreg>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1000000 0 2800000>;
+		qcom,cam-vreg-max-voltage = <1000000 0 2800000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active &cam_csi2_sensor_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				&cam_csi2_sensor_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 23 0>,
+			<&tlmm 133 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					  "CAM_RESET2",
+					  "CAM_STANDBY2";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-dragonboard.dtsi b/arch/arm64/boot/dts/qcom/apq8096-dragonboard.dtsi
new file mode 100644
index 000000000000..e731c7edd518
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-dragonboard.dtsi
@@ -0,0 +1,849 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8996-pinctrl.dtsi"
+#include "apq8096-camera-sensor-dragonboard.dtsi"
+#include "apq8096-ba.dtsi"
+
+/ {
+	bluetooth: bt_qca6174 {
+		compatible = "qca,qca6174";
+		qca,bt-reset-gpio = <&pm8994_gpios 19 0>; /* BT_EN */
+		qca,bt-vdd-core-supply = <&vph_pwr_vreg>;
+		qca,bt-vdd-pa-supply = <&vph_pwr_vreg>;
+		qca,bt-vdd-io-supply = <&pm8994_s4>;
+		qca,bt-vdd-xtal-supply = <&vph_pwr_vreg>;
+		qca,bt-chip-pwd-voltage-level = <1300000 1300000>;
+		qca,bt-vdd-io-voltage-level = <1800000 1800000>;
+		qca,bt-vdd-xtal-voltage-level = <1800000 1800000>;
+	};
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&sdcc1_ice {
+	status = "ok";
+};
+
+&ufsphy1 {
+	status = "ok";
+};
+
+&ufs1 {
+	status = "ok";
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&sdhc_1 {
+	vdd-supply = <&pm8994_l20>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	vdd-io-supply = <&pm8994_s4>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <110 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000
+				96000000 192000000 384000000>;
+	qcom,ice-clk-rates = <300000000 150000000>;
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8994_l21>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8994_l13>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000
+				100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x1>;
+
+	status = "ok";
+};
+
+&pm8994_vadc {
+	chan@5 {
+		label = "vcoin";
+		reg = <5>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7 {
+		label = "vph_pwr";
+		reg = <7>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8994_adc_tm {
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x48>;
+		qcom,thermal-node;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x80>;
+		qcom,thermal-node;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x88>;
+		qcom,thermal-node;
+	};
+};
+
+&mdss_hdmi_tx {
+	pinctrl-names = "hdmi_hpd_active", "hdmi_ddc_active", "hdmi_cec_active",
+				"hdmi_active", "hdmi_sleep";
+	pinctrl-0 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_suspend
+						&mdss_hdmi_cec_suspend>;
+	pinctrl-1 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+						&mdss_hdmi_cec_suspend>;
+	pinctrl-2 = <&mdss_hdmi_hpd_active &mdss_hdmi_cec_active
+						&mdss_hdmi_ddc_suspend>;
+	pinctrl-3 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+						&mdss_hdmi_cec_active>;
+	pinctrl-4 = <&mdss_hdmi_hpd_suspend &mdss_hdmi_ddc_suspend
+						&mdss_hdmi_cec_suspend>;
+};
+
+&pmi8994_vadc {
+	chan@0 {
+		label = "usbin";
+		reg = <0>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <4>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@1 {
+		label = "dcin";
+		reg = <1>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <4>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@43 {
+		label = "usb_dp";
+		reg = <0x43>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@44 {
+		label = "usb_dm";
+		reg = <0x44>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+#include "msm8996-sde-display.dtsi"
+
+&dsi_hx8379a_fwvga_truly_vid {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <255>;
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <50>;
+	qcom,mdss-dsi-bl-pmic-bank-select = <0>;
+	qcom,mdss-dsi-pwm-gpio = <&pm8994_gpios 5 0>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_hx8379a_fwvga_truly_vid>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active &mdss_disp_bkl_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend &mdss_disp_bkl_suspend>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+	qcom,platform-bklight-en-gpio = <&tlmm 135 0>;
+};
+
+&mdss_dsi1 {
+	status = "disabled";
+};
+
+&labibb {
+	status = "ok";
+	qcom,qpnp-labibb-mode = "lcd";
+};
+
+&rpm_bus {
+	rpm-regulator-bstb {
+		status = "disabled";
+		regulator-bst {
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa22 {
+		pm8994_l22: regulator-l22 {
+			regulator-min-microvolt = <3000000>;
+			regulator-max-microvolt = <3000000>;
+			qcom,init-voltage = <3000000>;
+		};
+	};
+};
+
+&pmi8994_charger {
+	/delete-property/ otg-parent-supply;
+	qcom,charging-disabled;
+	smbcharger_charger_otg {
+		parent-supply = <&pmi8994_boost_5v>;
+	};
+};
+
+&usb_otg_switch {
+	/delete-property/ vin-supply;
+	gpio = <&pm8994_gpios 11 0>;
+	enable-active-high;
+	status = "ok";
+};
+
+&usb3 {
+	qcom,charging-disabled;
+	vbus_dwc3-supply = <&usb_otg_switch>;
+};
+
+&usb2s {
+	status = "ok";
+	pinctrl-0 = <&usb_hub_reset_active>;
+	pinctrl-1 = <&usb_hub_reset_suspend>;
+	qcom,ext-hub-reset-gpio =  <&tlmm 103 0>;
+	qcom,disable-host-mode-pm;
+	dwc3@7600000 {
+		dr_mode = "host";
+	};
+};
+
+&usb_nop_phy {
+	status = "ok";
+};
+
+&qusb_phy1 {
+	status = "ok";
+};
+
+&rome_vreg {
+	status = "disabled";
+};
+
+&pm8994_l16 { /* GPS ELNA */
+	status = "okay";
+	regulator-always-on;
+};
+
+&pm8994_mpps {
+	mpp@a100 { /* MPP 2 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <0>;
+		status = "okay";
+	};
+
+	mpp@a200 { /* MPP 3 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <0>;
+		status = "okay";
+	};
+
+	mpp@a300 { /* MPP 4 */
+		/* HDMI_5v_vreg regulator enable */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <0>;
+		status = "okay";
+	};
+
+	mpp@a500 { /* MPP 6 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <0>;
+		status = "okay";
+	};
+};
+
+
+&pmi8994_gpios {
+	gpio@c100 {	/* GPIO 2  SPKR_SD_N */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c200 {	/* GPIO 3 SPKR_SD_N */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c300 {	/* GPIO 4 USB2_ID */
+		qcom,mode = <0>;	/* DIGITAL INPUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c500 {	/* GPIO 6 USB2_VBUS_DET*/
+		qcom,mode = <0>;	/* DIGITAL INPUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+};
+
+&pmi8994_mpps {
+	mpp@a300 { /* MPP 4 */
+		/* WLED FET */
+		qcom,mode = <1>;        /* DIGITAL OUT */
+		qcom,vin-sel = <0>;     /* VIN0 */
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&soc {
+	qcom,cnss {
+		wlan-bootstrap-gpio = <&tlmm 46 0>;
+		wlan-en-gpio = <&pm8994_gpios 8 0>;
+		vdd-wlan-io-supply = <&pm8994_s4>;
+		// removing unneeded regulators
+		/delete-property/ vdd-wlan-supply;
+		/delete-property/ vdd-wlan-xtal-supply;
+		/delete-property/ vdd-wlan-core-supply;
+	};
+
+	i2c@75ba000 {
+		synaptics@20 {
+			compatible = "synaptics,dsx";
+			reg = <0x20>;
+			interrupt-parent = <&tlmm>;
+			interrupts = <125 0x2008>;
+			vdd-supply = <&pm8994_l14>;
+			avdd-supply = <&pm8994_l22>;
+			pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+			pinctrl-0 = <&ts_active>;
+			pinctrl-1 = <&ts_suspend>;
+			synaptics,display-coords = <0 0 480 854>;
+			synaptics,panel-coords = <0 0 480 854>;
+			synaptics,reset-gpio = <&tlmm 89 0x00>;
+			synaptics,irq-gpio = <&tlmm 125 0x2008>;
+			synaptics,button-map = <139 102 158>;
+			synaptics,disable-gpios;
+			/* Underlying clocks used by secure touch */
+			clock-names = "iface_clk", "core_clk";
+			clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+				 <&clock_gcc clk_gcc_blsp2_qup6_i2c_apps_clk>;
+		};
+	};
+
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8994_gpios 2 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+
+		gp_switch_gpio {
+			label = "gp_switch_gpio";
+			pinctrl-0 = <&gp_switch_active>;
+			pinctrl-1 = <&gp_switch_suspend>;
+			gpios = <&tlmm 127 0x1>;
+			linux,input-type = <1>;
+			linux,code = <158>; /* By default mapped to BACK */
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+
+	/*
+	* vph_pwr_vreg represents the unregulated battery voltage supply
+	* VPH_PWR that is present whenever the device is powered on.
+	*/
+	vph_pwr_vreg: vph_pwr_vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "vph_pwr";
+		status = "ok";
+		regulator-always-on;
+	};
+
+
+	sound {
+		status = "disabled";
+	};
+
+	sound-9335 {
+		qcom,model = "msm8996-tasha-db-snd-card";
+
+		qcom,audio-routing =
+			"RX_BIAS", "MCLK",
+			"AMIC1", "MIC BIAS3",
+			"MIC BIAS3", "Analog Mic4",
+			"AMIC2", "MIC BIAS2",
+			"MIC BIAS2", "Headset Mic",
+			"AMIC3", "MIC BIAS2",
+			"MIC BIAS2", "ANCLeft Headset Mic",
+			"AMIC4", "MIC BIAS2",
+			"MIC BIAS2", "ANCRight Headset Mic",
+			"AMIC5", "MIC BIAS3",
+			"MIC BIAS3", "Analog Mic6",
+			"AMIC6", "MIC BIAS4",
+			"MIC BIAS4", "Analog Mic7",
+			"DMIC0", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic0",
+			"DMIC1", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic1",
+			"DMIC2", "MIC BIAS4",
+			"MIC BIAS4", "Digital Mic2",
+			"DMIC3", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic3",
+			"DMIC4", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic4",
+			"DMIC5", "MIC BIAS4",
+			"MIC BIAS4", "Digital Mic5";
+
+		qcom,hdmi-audio-rx;
+		asoc-codec = <&stub_codec>, <&hdmi_audio>;
+		asoc-codec-names = "msm-stub-codec.1",
+					"msm-hdmi-audio-codec-rx";
+	};
+
+	usb_detect {
+		compatible = "qcom,gpio-usbdetect";
+		gpio,vbus-det-gpio = <&pm8994_gpios 22 0>;
+		vin-supply = <&vph_pwr_vreg>;
+	};
+
+	spi@7575000 { /* BLSP1 QUP1 */
+		status = "disabled";
+	};
+};
+
+&spmi_bus {
+	qcom,pm8994@1 {
+		pwm@b100 {
+			qcom,dtest-line = <4>;
+			qcom,dtest-output = <1>;
+			status = "okay";
+		};
+	};
+};
+
+&pm8994_gpios {
+	gpio@c100 { /* GPIO 2 - KYPD_VOLP_N */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c300 { /* GPIO 4 - BL1_PWM */
+		qcom,mode = <1>;
+		qcom,pull = <1>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <4>;
+		status = "okay";
+	};
+
+	gpio@c400 { /* GPIO 5 - BL0_PWM */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <1>;	/* PULL DOWN */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <7>;	/* LPG4 */
+		qcom,master-en = <1>;   /* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@c600 { /* GPIO 7 */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c700 { /* GPIO 8 - WLAN_EN */
+		qcom,mode = <1>;	/* Digital output*/
+		qcom,out-strength = <2>;/* QPNP_PIN_OUT_STRENGTH_MED */
+		qcom,pull = <4>;	/* Pulldown 10uA */
+		qcom,vin-sel = <2>;	/* VIN2 */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,invert = <0>;	/* Invert */
+		qcom,master-en = <1>;	/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@c900 { /* GPIO 10 */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@ca00 { /* GPIO 11 - USB enb1 (otg switch) */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <1>;	/* PULL DOWN */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,master-en = <1>;	/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@cc00 { /* GPIO 13 */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,master-en = <1>;	/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@ce00 { /* GPIO 15 - DIVCLK1 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@cf00 { /* GPIO 16 - DIVCLK2 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@d000 { /* GPIO 17 - DIVCLK3 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@d100 { /* GPIO 18 - Rome Sleep Clock */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <0>;		/* Output low initially */
+		qcom,vin-sel = <2>;		/* VIN 2 */
+		qcom,src-sel = <3>;		/* Function 2 */
+		qcom,out-strength = <2>;	/* Medium */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@d200 { /* GPIO 19 - Rome BT Reset */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,out-strength = <2>;	/* QPNP_PIN_OUT_STRENGTH_MED */
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@d500 { /* GPIO 22 - USB1 VBUS detect  */
+		qcom,mode = <0>;		/* Digital Input*/
+		qcom,pull = <5>;		/* No pull */
+		qcom,vin-sel = <2>;		/* 1.8 V */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&pmi8994_haptics {
+	status = "okay";
+};
+
+&blsp1_uart2 {
+	status = "ok";
+};
+
+&slim_msm {
+	tasha_codec {
+		qcom,cdc-micbias2-headset-only;
+		qcom,cdc-micbias1-ext-cap;
+		qcom,cdc-micbias2-ext-cap;
+		qcom,cdc-micbias3-ext-cap;
+		qcom,cdc-micbias4-ext-cap;
+	};
+};
+
+&cam_sensor_mclk0_active { /* MCLK0 */
+	config {
+		drive-strength = <8>; /* 8 MA */
+	};
+};
+
+&cam_sensor_mclk0_suspend { /* MCLK0 */
+	config {
+		drive-strength = <8>; /* 8 MA */
+	};
+};
+
+&cam_sensor_mclk1_active { /* MCLK1 */
+	config {
+		drive-strength = <8>; /* 8 MA */
+	};
+};
+
+&cam_sensor_mclk1_suspend { /* MCLK1 */
+	config {
+		drive-strength = <8>; /* 8 MA */
+	};
+};
+
+&cam_sensor_mclk2_active { /* MCLK2 */
+	config {
+		drive-strength = <8>; /* 8 MA */
+	};
+};
+
+&cam_sensor_mclk2_suspend { /* MCLK2 */
+	config {
+		drive-strength = <8>; /* 8 MA */
+	};
+};
+
+&wil6210 {
+	status = "ok";
+	/delete-property/ qcom,wigig-en;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8096-sbc.dtsi
new file mode 100644
index 000000000000..0ee28c2c427e
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-sbc.dtsi
@@ -0,0 +1,798 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8996-pinctrl.dtsi"
+#include "apq8096-camera-sensor-sbc.dtsi"
+
+/ {
+	bluetooth: bt_qca6174 {
+		compatible = "qca,qca6174";
+		qca,bt-reset-gpio = <&pm8994_gpios 19 0>; /* BT_EN */
+		qca,bt-vdd-core-supply = <&vph_pwr_vreg>;
+		qca,bt-vdd-pa-supply = <&vph_pwr_vreg>;
+		qca,bt-vdd-io-supply = <&pm8994_s4>;
+		qca,bt-vdd-xtal-supply = <&vph_pwr_vreg>;
+		qca,bt-chip-pwd-voltage-level = <1300000 1300000>;
+		qca,bt-vdd-io-voltage-level = <1800000 1800000>;
+		qca,bt-vdd-xtal-voltage-level = <1800000 1800000>;
+	};
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&ufsphy1 {
+	status = "ok";
+};
+
+&ufs1 {
+	status = "ok";
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&sdhc_1 {
+	vdd-supply = <&pm8994_l20>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	vdd-io-supply = <&pm8994_s4>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <110 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000
+				96000000 192000000 384000000>;
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8994_l21>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8994_l13>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on
+							&sdc2_cd_on_sbc>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off
+							&sdc2_cd_off_sbc>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000
+				100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 38 0x1>;
+
+	status = "ok";
+};
+
+&pm8994_vadc {
+	chan@5 {
+		label = "vcoin";
+		reg = <5>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7 {
+		label = "vph_pwr";
+		reg = <7>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8994_adc_tm {
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x48>;
+		qcom,thermal-node;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x80>;
+		qcom,thermal-node;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x88>;
+		qcom,thermal-node;
+	};
+};
+
+&mdss_hdmi_tx {
+	pinctrl-names = "hdmi_hpd_active", "hdmi_ddc_active", "hdmi_cec_active",
+				"hdmi_active", "hdmi_sleep";
+	pinctrl-0 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_suspend
+						&mdss_hdmi_cec_suspend>;
+	pinctrl-1 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+						&mdss_hdmi_cec_suspend>;
+	pinctrl-2 = <&mdss_hdmi_hpd_active &mdss_hdmi_cec_active
+						&mdss_hdmi_ddc_suspend>;
+	pinctrl-3 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+						&mdss_hdmi_cec_active>;
+	pinctrl-4 = <&mdss_hdmi_hpd_suspend &mdss_hdmi_ddc_suspend
+						&mdss_hdmi_cec_suspend>;
+};
+
+&pmi8994_vadc {
+	chan@0 {
+		label = "usbin";
+		reg = <0>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <4>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@1 {
+		label = "dcin";
+		reg = <1>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <4>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@43 {
+		label = "usb_dp";
+		reg = <0x43>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@44 {
+		label = "usb_dm";
+		reg = <0x44>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+#include "msm8996-mdss-panels.dtsi"
+
+&dsi_dual_sharp_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <50>;
+	qcom,mdss-dsi-bl-pmic-bank-select = <0>;
+	qcom,mdss-dsi-pwm-gpio = <&pm8994_gpios 6 0>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "hdmi";
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_sharp_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+	qcom,platform-bklight-en-gpio = <&pm8994_gpios 6 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_sharp_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+	qcom,platform-bklight-en-gpio = <&pm8994_gpios 6 0>;
+};
+
+&labibb {
+	status = "ok";
+	qcom,qpnp-labibb-mode = "lcd";
+};
+
+&ibb_regulator {
+	qcom,qpnp-ibb-discharge-resistor = <32>;
+};
+
+&rpm_bus {
+	rpm-regulator-bstb {
+		status = "disabled";
+		regulator-bst {
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa22 {
+		pm8994_l22: regulator-l22 {
+			regulator-min-microvolt = <3000000>;
+			regulator-max-microvolt = <3000000>;
+			qcom,init-voltage = <3000000>;
+		};
+	};
+};
+
+&pmi8994_charger {
+	/delete-property/ otg-parent-supply;
+	qcom,charging-disabled;
+	smbcharger_charger_otg {
+		parent-supply = <&pmi8994_boost_5v>;
+	};
+};
+
+&pmi8994_fg {
+	status = "disabled";
+};
+
+&pmi8994_charger {
+	status = "disabled";
+};
+
+&usb_otg_switch {
+	gpio = <&pm8994_gpios 11 0>;
+	enable-active-high;
+	status = "ok";
+};
+
+&usb3 {
+	status = "disabled";
+	qcom,charging-disabled;
+	vbus_dwc3-supply = <&usb_otg_switch>;
+	qcom,ext-hub-reset-gpio =  <&tlmm 103 0>;
+	qcom,disable-host-mode-pm;
+	dwc3@6a00000{
+		dr_mode = "host";
+	};
+};
+
+&usb2s {
+	status = "ok";
+	qcom,charging-disabled;
+	vbus_dwc3-supply = <&vph_pwr_vreg>;
+	qcom,usbin-vadc = <&pmi8994_vadc>;
+	vdda33-supply = <&pm8994_l24>;
+};
+
+&usb_nop_phy {
+	status = "ok";
+};
+
+&qusb_phy1 {
+	status = "ok";
+};
+
+&rome_vreg {
+	status = "disabled";
+};
+
+&pm8994_mpps {
+	mpp@a100 { /* MPP 2 */
+		qcom,mode = <0>;		/* DIGITAL INPUT */
+		qcom,vin-sel = <0>;		/* VPH_PWR */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <0>;
+		status = "okay";
+	};
+
+	mpp@a300 { /* MPP 4 */
+		qcom,mode = <0>;		/* DIGITAL INPUT */
+		qcom,vin-sel = <0>;		/* VPH_PWR */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <0>;
+		status = "okay";
+	};
+};
+
+&pmi8994_gpios {
+	gpio@c100 {	/* GPIO 2  SPKR_SD_N */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c200 {	/* GPIO 3 SPKR_SD_N */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c500 {	/* GPIO 6 USB2_VBUS_DET*/
+		qcom,mode = <0>;	/* DIGITAL INPUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+};
+
+&pmi8994_mpps {
+	mpp@a100 { /* MPP 2 */
+		/* USER LED4 */
+		qcom,mode = <0>;		/* DIGITAL INPUT */
+		qcom,vin-sel = <0>;		/* VPH_PWR */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&soc {
+	qcom,cnss {
+		wlan-bootstrap-gpio = <&tlmm 46 0>;
+		wlan-en-gpio = <&pm8994_gpios 8 0>;
+		vdd-wlan-io-supply = <&pm8994_s4>;
+		// removing unneeded regulators
+		/delete-property/ vdd-wlan-supply;
+		/delete-property/ vdd-wlan-xtal-supply;
+		/delete-property/ vdd-wlan-core-supply;
+	};
+
+	i2c@75b6000 {
+		synaptics@20 {
+			compatible = "synaptics,dsx";
+			reg = <0x20>;
+			interrupt-parent = <&tlmm>;
+			interrupts = <125 0x2008>;
+			vdd-supply = <&vph_pwr_vreg>;
+			avdd-supply = <&vph_pwr_vreg>;
+			pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+			pinctrl-0 = <&ts_active_sbc>;
+			pinctrl-1 = <&ts_suspend_sbc>;
+			synaptics,display-coords = <0 0 1599 2559>;
+			synaptics,panel-coords = <0 0 1599 2703>;
+			synaptics,reset-gpio = <&tlmm 29 0x00>;
+			synaptics,irq-gpio = <&tlmm 125 0x2008>;
+			synaptics,disable-gpios;
+			synaptics,fw-name = "PR1702898-s3528t_00350002.img";
+			/* Underlying clocks used by secure touch */
+			clock-names = "iface_clk", "core_clk";
+			clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+				 <&clock_gcc clk_gcc_blsp2_qup2_i2c_apps_clk>;
+		};
+	};
+
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8994_gpios 2 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+
+	/*
+	* vph_pwr_vreg represents the unregulated battery voltage supply
+	* VPH_PWR that is present whenever the device is powered on.
+	*/
+	vph_pwr_vreg: vph_pwr_vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "vph_pwr";
+		status = "ok";
+		regulator-always-on;
+	};
+
+
+	sound {
+		status = "disabled";
+	};
+
+	sound-9335 {
+		qcom,model = "msm8996-tasha-db-snd-card";
+
+		qcom,audio-routing =
+			"RX_BIAS", "MCLK",
+			"AMIC1", "MIC BIAS3",
+			"MIC BIAS3", "Analog Mic4",
+			"AMIC2", "MIC BIAS2",
+			"MIC BIAS2", "Headset Mic",
+			"AMIC3", "MIC BIAS2",
+			"MIC BIAS2", "ANCLeft Headset Mic",
+			"AMIC4", "MIC BIAS2",
+			"MIC BIAS2", "ANCRight Headset Mic",
+			"AMIC5", "MIC BIAS3",
+			"MIC BIAS3", "Analog Mic6",
+			"AMIC6", "MIC BIAS4",
+			"MIC BIAS4", "Analog Mic7",
+			"DMIC0", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic0",
+			"DMIC1", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic1",
+			"DMIC2", "MIC BIAS4",
+			"MIC BIAS4", "Digital Mic2",
+			"DMIC3", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic3",
+			"DMIC4", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic4",
+			"DMIC5", "MIC BIAS4",
+			"MIC BIAS4", "Digital Mic5";
+
+		qcom,hdmi-audio-rx;
+		asoc-codec = <&stub_codec>, <&hdmi_audio>;
+		asoc-codec-names = "msm-stub-codec.1",
+					"msm-hdmi-audio-codec-rx";
+	};
+
+	usb_detect {
+		compatible = "qcom,gpio-usbdetect";
+		qcom,vbus-det-irq = <&pmi8994_gpios 6 0>;
+		vin-supply = <&vph_pwr_vreg>;
+	};
+
+	spi@7575000 { /* BLSP1 QUP1 */
+		status = "disabled";
+	};
+};
+
+&spmi_bus {
+	qcom,pm8994@1 {
+		pwm@b100 {
+			qcom,dtest-line = <4>;
+			qcom,dtest-output = <1>;
+			status = "okay";
+		};
+	};
+};
+
+&pm8994_gpios {
+	gpio@c100 { /* GPIO 2 - KYPD_VOLP_N */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c300 { /* GPIO 4 - BL1_PWM */
+		qcom,mode = <1>;
+		qcom,pull = <1>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <4>;
+		status = "okay";
+	};
+
+	gpio@c400 { /* GPIO 5 - BL0_PWM */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <1>;	/* PULL DOWN */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <7>;	/* LPG4 */
+		qcom,master-en = <1>;   /* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@c500 { /* GPIO 6 - lcd_bklt_reg_en */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,output-type = <0>;	/* CMOS logic */
+		qcom,invert = <1>;	/* output hight initially */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,out-strength = <1>;/* Low drive strength */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c700 { /* GPIO 8 - WLAN_EN */
+		qcom,mode = <1>;	/* Digital output*/
+		qcom,pull = <4>;	/* Pulldown 10uA */
+		qcom,vin-sel = <2>;	/* VIN2 */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,invert = <0>;	/* Invert */
+		qcom,master-en = <1>;	/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@ca00 { /* GPIO 11 - USB enb1 (otg switch) */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <1>;	/* PULL DOWN */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,master-en = <1>;	/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@ce00 { /* GPIO 15 - DIVCLK1 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@cf00 { /* GPIO 16 - DIVCLK2 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@d000 { /* GPIO 17 - DIVCLK3 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@d100 { /* GPIO 18 - Rome Sleep Clock */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <0>;		/* Output low initially */
+		qcom,vin-sel = <2>;		/* VIN 2 */
+		qcom,src-sel = <3>;		/* Function 2 */
+		qcom,out-strength = <2>;	/* Medium */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@d200 { /* GPIO 19 - Rome BT Reset */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@d500 { /* GPIO 22 - USB1 VBUS detect  */
+		qcom,mode = <0>;		/* Digital Input*/
+		qcom,pull = <5>;		/* No pull */
+		qcom,vin-sel = <2>;		/* 1.8 V */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&pmi8994_haptics {
+	status = "okay";
+};
+
+&blsp1_uart2 {
+	status = "ok";
+};
+
+&slim_msm {
+	tasha_codec {
+		qcom,cdc-micbias2-headset-only;
+		qcom,cdc-micbias1-ext-cap;
+		qcom,cdc-micbias2-ext-cap;
+		qcom,cdc-micbias3-ext-cap;
+		qcom,cdc-micbias4-ext-cap;
+	};
+};
+
+&cam_sensor_mclk0_active { /* MCLK0 */
+	config {
+		drive-strength = <8>; /* 8 MA */
+	};
+};
+
+&cam_sensor_mclk0_suspend { /* MCLK0 */
+	config {
+		drive-strength = <8>; /* 8 MA */
+	};
+};
+
+&cam_sensor_mclk1_active { /* MCLK1 */
+	config {
+		drive-strength = <8>; /* 8 MA */
+	};
+};
+
+&cam_sensor_mclk1_suspend { /* MCLK1 */
+	config {
+		drive-strength = <8>; /* 8 MA */
+	};
+};
+
+&cam_sensor_mclk2_active { /* MCLK2 */
+	config {
+		drive-strength = <8>; /* 8 MA */
+	};
+};
+
+&cam_sensor_mclk2_suspend { /* MCLK2 */
+	config {
+		drive-strength = <8>; /* 8 MA */
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v2-auto-dragonboard.dts b/arch/arm64/boot/dts/qcom/apq8096-v2-auto-dragonboard.dts
new file mode 100644
index 000000000000..d200bf718de2
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v2-auto-dragonboard.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v2.dtsi"
+#include "apq8096-auto-dragonboard.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ8096v2.1 + PMI8994 DragonBoard";
+	compatible = "qcom,apq8096-dragonboard", "qcom,msm8996",
+			"qcom,apq8096", "qcom,dragonboard";
+	qcom,msm-id = <246 0x20001>, <291 0x20001>;
+	qcom,board-id = <10 1>;
+};
+
+&spi_9 {
+	status = "ok";
+	can-controller@0 {
+		compatible = "renesas,rh850";
+		reg = <0>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <127 0>;
+		spi-max-frequency = <5000000>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v2-dragonboard.dts b/arch/arm64/boot/dts/qcom/apq8096-v2-dragonboard.dts
new file mode 100644
index 000000000000..b515e0599e02
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v2-dragonboard.dts
@@ -0,0 +1,29 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v2.dtsi"
+#include "apq8096-dragonboard.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ8096v2.1 + PMI8994 DragonBoard";
+	compatible = "qcom,apq8096-dragonboard", "qcom,msm8996",
+			"qcom,apq8096", "qcom,dragonboard";
+	qcom,msm-id = <246 0x20001>, <291 0x20001>;
+	qcom,board-id = <10 0>;
+};
+
+&spi_9 {
+	status = "ok";
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v2-liquid.dts b/arch/arm64/boot/dts/qcom/apq8096-v2-liquid.dts
new file mode 100644
index 000000000000..b6eddb01ee3e
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v2-liquid.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v2.dtsi"
+#include "msm8996-liquid.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v2 LiQUID";
+	compatible = "qcom,apq8096-liquid", "qcom,apq8096", "qcom,liquid";
+	qcom,board-id = <9 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-cdp.dts
new file mode 100644
index 000000000000..1277731b07a9
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v2.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v2 + PMI8994 CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-mtp.dts b/arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-mtp.dts
new file mode 100644
index 000000000000..1d85af130f48
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v2.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v2 + PMI8994 MTP";
+	compatible = "qcom,apq8096-mtp", "qcom,apq8096", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-pm8004-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-pm8004-cdp.dts
new file mode 100644
index 000000000000..e956240cc963
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-pm8004-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8096-v2.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v2 + PMI8994 + PM8004 CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-pm8004-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-pm8004-pmk8001-cdp.dts
new file mode 100644
index 000000000000..113aa0873923
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-pm8004-pmk8001-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8096-v2.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v2 + PMI8994 + PM8004 + PMK8001 CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-pmk8001-cdp.dts
new file mode 100644
index 000000000000..c291921d46e8
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v2-pmi8994-pmk8001-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+*
+* This program is free software; you can redistribute it and/or modify
+* it under the terms of the GNU General Public License version 2 and
+* only version 2 as published by the Free Software Foundation.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+*/
+
+/dts-v1/;
+
+#include "apq8096-v2.dtsi"
+#include "msm8996-pm8994-pmi8994-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v2 + PMI8994 + PMK8001 CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v2.dtsi b/arch/arm64/boot/dts/qcom/apq8096-v2.dtsi
new file mode 100644
index 000000000000..a2b9b4d62d27
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v2.dtsi
@@ -0,0 +1,34 @@
+/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only version-specific property overrides should be placed
+ * inside this file. Common device definitions should be placed inside the
+ * msm8996.dtsi file.
+ */
+
+#include "msm8996-v2.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v2";
+	qcom,msm-id = <291 0x20001>;
+};
+
+&soc {
+	qcom,rmnet-ipa {
+		status = "disabled";
+	};
+};
+
+&ipa_hw {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-auto-adp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-auto-adp.dts
new file mode 100644
index 000000000000..a91ec5eeb2e7
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-auto-adp.dts
@@ -0,0 +1,161 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include "apq8096-v3.dtsi"
+#include "msm8996-pm8994.dtsi"
+#include "msm8996-agave-adp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 AUTO ADP";
+	compatible = "qcom,apq8096-adp", "qcom,apq8096", "qcom,adp";
+	qcom,msm-id = <311 0x30001>;
+	qcom,board-id = <0x02010019 0>;
+};
+
+&spi_9 {
+	status = "ok";
+	can-controller@0 {
+		compatible = "renesas,rh850";
+		reg = <0>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <122 0>;
+		spi-max-frequency = <5000000>;
+	};
+};
+
+&soc {
+	qcom,msm-ssc-sensors {
+		status = "disabled";
+	};
+
+	qcom,msm-thermal {
+		qcom,hotplug-temp = <115>;
+		qcom,hotplug-temp-hysteresis = <25>;
+		qcom,therm-reset-temp = <119>;
+	};
+};
+
+&slim_msm {
+	status = "disabled";
+};
+
+&pm8994_mpps {
+	mpp@a500 { /* MPP 6 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&hl7509_en_vreg {
+	status = "ok";
+};
+
+&hl7509_vreg {
+	status = "ok";
+};
+
+&sdhc_2 {
+	cd-gpios = <&tlmm 38 GPIO_ACTIVE_LOW>;
+	pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on_sbc>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off
+			&sdc2_cd_on_sbc>;
+};
+
+&i2c_7 {
+	silabs4705@11 { /* SiLabs FM chip, slave id 0x11*/
+		status = "disabled";
+	};
+};
+
+&gfx_cpr {
+	vdd-supply = <&hl7509_vreg>;
+	qcom,cpr-step-quot-init-min = <20>;
+	qcom,cpr-step-quot-init-max = <26>;
+	qcom,voltage-step = <10000>;
+	/delete-property/ qcom,cpr-enable;
+};
+
+&gfx_vreg {
+	qcom,cpr-voltage-ceiling =
+		<600000  670000  670000  750000  830000
+		 910000  960000 1020000>;
+	qcom,cpr-voltage-floor =
+		<600000  600000  600000  600000  600000
+		 600000  600000  600000>;
+};
+
+&pm8994_l3 {
+	regulator-min-microvolt = <875000>;
+	regulator-max-microvolt = <875000>;
+	qcom,init-voltage = <875000>;
+};
+
+&pm8994_l11 {
+	regulator-min-microvolt = <850000>;
+	regulator-max-microvolt = <850000>;
+	qcom,init-voltage = <850000>;
+};
+
+&pm8994_l17 {
+	regulator-min-microvolt = <1800000>;
+	regulator-max-microvolt = <1800000>;
+	qcom,init-voltage = <1800000>;
+};
+
+&pm8994_l23 {
+	regulator-min-microvolt = <1100000>;
+	regulator-max-microvolt = <1100000>;
+	qcom,init-voltage = <1100000>;
+};
+
+&pm8994_l27 {
+	regulator-min-microvolt = <800000>;
+	regulator-max-microvolt = <800000>;
+	qcom,init-voltage = <800000>;
+};
+
+&pm8994_l29 {
+	regulator-min-microvolt = <2500000>;
+	regulator-max-microvolt = <2500000>;
+	qcom,init-voltage = <2500000>;
+};
+
+&rpm_bus {
+	rpm-regulator-ldoa26 {
+		/delete-node/ pm8994_l26_corner;
+		/delete-node/ pm8994_l26_floor_corner;
+
+		pm8994_l26: regulator-l26 {
+			regulator-min-microvolt = <1100000>;
+			regulator-max-microvolt = <1100000>;
+			qcom,init-voltage = <1100000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa31 {
+		status = "okay";
+		pm8994_l31: regulator-l31 {
+			regulator-min-microvolt = <1100000>;
+			regulator-max-microvolt = <1100000>;
+			qcom,init-voltage = <1100000>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-auto-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-auto-cdp.dts
new file mode 100644
index 000000000000..e59003f2d316
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-auto-cdp.dts
@@ -0,0 +1,44 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm8996-pm8994.dtsi"
+#include "msm8996-auto-cdp.dtsi"
+#include "msm8996v3-auto.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 AUTO CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,msm-id = <311 0x30001>;
+	qcom,board-id = <0x03010001 0>;
+};
+
+&soc {
+	qcom,msm-thermal {
+		qcom,hotplug-temp = <115>;
+		qcom,hotplug-temp-hysteresis = <25>;
+		qcom,therm-reset-temp = <119>;
+	};
+};
+
+&spi_9 {
+	status = "ok";
+	can-controller@0 {
+		compatible = "renesas,rh850";
+		reg = <0>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <127 0>;
+		spi-max-frequency = <5000000>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-auto-dragonboard.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-auto-dragonboard.dts
new file mode 100644
index 000000000000..0f8e148ec3ab
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-auto-dragonboard.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "apq8096-auto-dragonboard.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ8096v3 + PMI8994 DragonBoard";
+	compatible = "qcom,apq8096-dragonboard", "qcom,msm8996",
+			"qcom,apq8096", "qcom,dragonboard";
+	qcom,msm-id = <246 0x30000>, <291 0x30000>;
+	qcom,board-id = <10 1>;
+};
+
+&spi_9 {
+	status = "ok";
+	can-controller@0 {
+		compatible = "renesas,rh850";
+		reg = <0>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <127 0>;
+		spi-max-frequency = <5000000>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-dragonboard.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-dragonboard.dts
new file mode 100644
index 000000000000..014f7c02fe54
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-dragonboard.dts
@@ -0,0 +1,31 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "apq8096-dragonboard.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ8096v3 + PMI8994 DragonBoard";
+	compatible = "qcom,apq8096-dragonboard", "qcom,msm8996",
+			"qcom,apq8096", "qcom,dragonboard";
+	qcom,msm-id = <246 0x30000>, <291 0x30000>,
+			<246 0x30001>, <291 0x30001>;
+	qcom,board-id = <10 0>;
+};
+
+&spi_9 {
+	status = "ok";
+};
+
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-liquid.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-liquid.dts
new file mode 100644
index 000000000000..6f175fffb005
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-liquid.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm8996-liquid.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 LiQUID";
+	compatible = "qcom,apq8096-liquid", "qcom,apq8096", "qcom,liquid";
+	qcom,board-id = <9 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-cdp.dts
new file mode 100644
index 000000000000..bb1962c46f08
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 + PMI8994 CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-mdm9x55-i2s-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-mdm9x55-i2s-cdp.dts
new file mode 100644
index 000000000000..5e2886f7e615
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-mdm9x55-i2s-cdp.dts
@@ -0,0 +1,112 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm8996-cdp.dtsi"
+#include "external-soc.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 + PMI8994, MDM9x55 I2S CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 2>;
+};
+
+&pil_modem {
+	status = "disabled";
+};
+
+&pm8994_l9 {
+	regulator-always-on;
+};
+
+&pm8994_l10 {
+	regulator-always-on;
+};
+
+&mdm3 {
+	pinctrl-names = "mdm_active", "mdm_suspend";
+	pinctrl-0 = <&ap2mdm_active &mdm2ap_active>;
+	pinctrl-1 = <&ap2mdm_sleep &mdm2ap_sleep>;
+	interrupt-map = <0 &tlmm 108 0x3
+			1 &tlmm 107 0x3
+			2 &tlmm 112 0x3>;
+	qcom,mdm2ap-errfatal-gpio = <&tlmm 108 0x00>;
+	qcom,ap2mdm-errfatal-gpio = <&tlmm 109 0x00>;
+	qcom,mdm2ap-status-gpio   = <&tlmm 106 0x00>;
+	qcom,ap2mdm-status-gpio   = <&tlmm 107 0x00>;
+	qcom,ap2mdm-soft-reset-gpio = <&pm8994_mpps 2 0>;
+	qcom,ap2mdm-vddmin-gpio = <&tlmm 111 0x00>;
+	qcom,mdm2ap-vddmin-gpio = <&tlmm 112 0x00>;
+	status = "ok";
+};
+
+&mhi {
+	esoc-names = "mdm";
+	esoc-0 = <&mdm3>;
+	qcom,msm-bus,name = "mhi";
+	qcom,msm-bus,num-cases = <2>;
+	qcom,msm-bus,num-paths = <1>;
+	qcom,msm-bus,vectors-KBps =
+		<100 512 0 0>,
+		<100 512 1200000000 650000000>;
+	mhi-chan-cfg-0 = <0x0 0x80 0x2 0x92>;
+	mhi-chan-cfg-1 = <0x1 0x80 0x2 0xa2>;
+	mhi-chan-cfg-2 = <0x2 0x80 0x1 0x91>;
+	mhi-chan-cfg-3 = <0x3 0x80 0x1 0xa1>;
+	mhi-chan-cfg-4 = <0x4 0x80 0x2 0x92>;
+	mhi-chan-cfg-5 = <0x5 0x80 0x2 0xa2>;
+	mhi-chan-cfg-6 = <0x6 0xa 0x0 0x92>;
+	mhi-chan-cfg-7 = <0x7 0xa 0x0 0xa2>;
+	mhi-chan-cfg-10 = <0xa 0x80 0x1 0x92>;
+	mhi-chan-cfg-11 = <0xb 0x80 0x1 0xa2>;
+	mhi-chan-cfg-14 = <0xe 0x40 0x1 0x92>;
+	mhi-chan-cfg-15 = <0xf 0x40 0x1 0xa2>;
+	mhi-chan-cfg-16 = <0x10 0x40 0x1 0x92>;
+	mhi-chan-cfg-17 = <0x11 0x40 0x1 0xa2>;
+	mhi-chan-cfg-18 = <0x12 0x40 0x1 0x92>;
+	mhi-chan-cfg-19 = <0x13 0x40 0x1 0xa2>;
+	mhi-chan-cfg-20 = <0x14 0xa 0x0 0x92>;
+	mhi-chan-cfg-21 = <0x15 0xa 0x0 0xa2>;
+	mhi-chan-cfg-22 = <0x16 0x40 0x2 0x92>;
+	mhi-chan-cfg-23 = <0x17 0x40 0x2 0xa2>;
+	mhi-chan-cfg-24 = <0x18 0xa 0x0 0x91>;
+	mhi-chan-cfg-25 = <0x19 0xa 0x0 0xa1>;
+	mhi-chan-cfg-32 = <0x20 0x80 0x2 0x92>;
+	mhi-chan-cfg-33 = <0x21 0x80 0x2 0xa2>;
+	mhi-chan-cfg-34 = <0x22 0x80 0x2 0x92>;
+	mhi-chan-cfg-35 = <0x23 0x80 0x2 0xa2>;
+	mhi-chan-cfg-100 = <0x64 0x80 0x3 0x52>;
+	mhi-chan-cfg-101 = <0x65 0x80 0x4 0x62>;
+	mhi-event-rings = <5>;
+	mhi-event-cfg-0 = <0x80 0x0 0x1 0x11>;
+	mhi-event-cfg-1 = <0x80 0x1 0x1 0x11>;
+	mhi-event-cfg-2 = <0x80 0x2 0x5 0x11>;
+	mhi-event-cfg-3 = <0x100 0x3 0x1 0x9>;
+	mhi-event-cfg-4 = <0x100 0x4 0x1 0x8>;
+	mhi-dev-address-win-size = <0x10 0x00000000>;
+};
+
+&pm8994_mpps {
+	mpp@a100 { /* MPP 2*/
+		/* MDM PON conrol*/
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <1>;
+		status = "okay";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-mdm9x55-i2s-mtp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-mdm9x55-i2s-mtp.dts
new file mode 100644
index 000000000000..2ff517a2521b
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-mdm9x55-i2s-mtp.dts
@@ -0,0 +1,111 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm8996-mtp.dtsi"
+#include "external-soc.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 + PMI8994, MDM9x55 I2S MTP";
+	compatible = "qcom,apq8096-mtp", "qcom,apq8096", "qcom,mtp";
+	qcom,board-id = <8 1>;
+};
+
+&pil_modem {
+	status = "disabled";
+};
+
+&pm8994_l9 {
+	regulator-always-on;
+};
+
+&pm8994_l10 {
+	regulator-always-on;
+};
+&mdm3 {
+	pinctrl-names = "mdm_active", "mdm_suspend";
+	pinctrl-0 = <&ap2mdm_active &mdm2ap_active>;
+	pinctrl-1 = <&ap2mdm_sleep &mdm2ap_sleep>;
+	interrupt-map = <0 &tlmm 108 0x3
+			1 &tlmm 107 0x3
+			2 &tlmm 112 0x3>;
+	qcom,mdm2ap-errfatal-gpio = <&tlmm 108 0x00>;
+	qcom,ap2mdm-errfatal-gpio = <&tlmm 109 0x00>;
+	qcom,mdm2ap-status-gpio   = <&tlmm 106 0x00>;
+	qcom,ap2mdm-status-gpio   = <&tlmm 107 0x00>;
+	qcom,ap2mdm-soft-reset-gpio = <&pm8994_mpps 2 0>;
+	qcom,ap2mdm-vddmin-gpio = <&tlmm 111 0x00>;
+	qcom,mdm2ap-vddmin-gpio = <&tlmm 112 0x00>;
+	status = "ok";
+};
+
+&mhi {
+	esoc-names = "mdm";
+	esoc-0 = <&mdm3>;
+	qcom,msm-bus,name = "mhi";
+	qcom,msm-bus,num-cases = <2>;
+	qcom,msm-bus,num-paths = <1>;
+	qcom,msm-bus,vectors-KBps =
+		<100 512 0 0>,
+		<100 512 1200000000 650000000>;
+	mhi-chan-cfg-0 = <0x0 0x80 0x2 0x92>;
+	mhi-chan-cfg-1 = <0x1 0x80 0x2 0xa2>;
+	mhi-chan-cfg-2 = <0x2 0x80 0x1 0x91>;
+	mhi-chan-cfg-3 = <0x3 0x80 0x1 0xa1>;
+	mhi-chan-cfg-4 = <0x4 0x80 0x2 0x92>;
+	mhi-chan-cfg-5 = <0x5 0x80 0x2 0xa2>;
+	mhi-chan-cfg-6 = <0x6 0xa 0x0 0x92>;
+	mhi-chan-cfg-7 = <0x7 0xa 0x0 0xa2>;
+	mhi-chan-cfg-10 = <0xa 0x80 0x1 0x92>;
+	mhi-chan-cfg-11 = <0xb 0x80 0x1 0xa2>;
+	mhi-chan-cfg-14 = <0xe 0x40 0x1 0x92>;
+	mhi-chan-cfg-15 = <0xf 0x40 0x1 0xa2>;
+	mhi-chan-cfg-16 = <0x10 0x40 0x1 0x92>;
+	mhi-chan-cfg-17 = <0x11 0x40 0x1 0xa2>;
+	mhi-chan-cfg-18 = <0x12 0x40 0x1 0x92>;
+	mhi-chan-cfg-19 = <0x13 0x40 0x1 0xa2>;
+	mhi-chan-cfg-20 = <0x14 0xa 0x0 0x92>;
+	mhi-chan-cfg-21 = <0x15 0xa 0x0 0xa2>;
+	mhi-chan-cfg-22 = <0x16 0x40 0x2 0x92>;
+	mhi-chan-cfg-23 = <0x17 0x40 0x2 0xa2>;
+	mhi-chan-cfg-24 = <0x18 0xa 0x0 0x91>;
+	mhi-chan-cfg-25 = <0x19 0xa 0x0 0xa1>;
+	mhi-chan-cfg-32 = <0x20 0x80 0x2 0x92>;
+	mhi-chan-cfg-33 = <0x21 0x80 0x2 0xa2>;
+	mhi-chan-cfg-34 = <0x22 0x80 0x2 0x92>;
+	mhi-chan-cfg-35 = <0x23 0x80 0x2 0xa2>;
+	mhi-chan-cfg-100 = <0x64 0x80 0x3 0x52>;
+	mhi-chan-cfg-101 = <0x65 0x80 0x4 0x62>;
+	mhi-event-rings = <5>;
+	mhi-event-cfg-0 = <0x80 0x0 0x1 0x11>;
+	mhi-event-cfg-1 = <0x80 0x1 0x1 0x11>;
+	mhi-event-cfg-2 = <0x80 0x2 0x5 0x11>;
+	mhi-event-cfg-3 = <0x100 0x3 0x1 0x9>;
+	mhi-event-cfg-4 = <0x100 0x4 0x1 0x8>;
+	mhi-dev-address-win-size = <0x10 0x00000000>;
+};
+
+&pm8994_mpps {
+	mpp@a100 { /* MPP 2*/
+		/* MDM PON conrol*/
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <1>;
+		status = "okay";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-mdm9x55-slimbus-mtp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-mdm9x55-slimbus-mtp.dts
new file mode 100644
index 000000000000..0b74b1b2ca6c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-mdm9x55-slimbus-mtp.dts
@@ -0,0 +1,113 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm8996-mtp.dtsi"
+#include "external-soc.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 + PMI8994, MDM9x55 Slimbus MTP";
+	compatible = "qcom,apq8096-mtp", "qcom,apq8096", "qcom,mtp";
+	qcom,board-id = <8 2>;
+};
+
+&pil_modem {
+	status = "disabled";
+};
+
+&pm8994_l9 {
+	regulator-always-on;
+};
+
+&pm8994_l10 {
+	regulator-always-on;
+};
+
+&mdm3 {
+	pinctrl-names = "mdm_active", "mdm_suspend";
+	pinctrl-0 = <&ap2mdm_active &mdm2ap_active>;
+	pinctrl-1 = <&ap2mdm_sleep &mdm2ap_sleep>;
+	interrupt-map = <0 &tlmm 108 0x3
+			1 &tlmm 107 0x3
+			2 &tlmm 112 0x3>;
+	qcom,mdm2ap-errfatal-gpio = <&tlmm 108 0x00>;
+	qcom,ap2mdm-errfatal-gpio = <&tlmm 109 0x00>;
+	qcom,mdm2ap-status-gpio   = <&tlmm 106 0x00>;
+	qcom,ap2mdm-status-gpio   = <&tlmm 107 0x00>;
+	qcom,ap2mdm-soft-reset-gpio = <&pm8994_mpps 2 0>;
+	qcom,ap2mdm-vddmin-gpio = <&tlmm 111 0x00>;
+	qcom,mdm2ap-vddmin-gpio = <&tlmm 112 0x00>;
+	status = "ok";
+};
+
+&mhi {
+	esoc-names = "mdm";
+	esoc-0 = <&mdm3>;
+	qcom,msm-bus,name = "mhi";
+	qcom,msm-bus,num-cases = <2>;
+	qcom,msm-bus,num-paths = <1>;
+	qcom,msm-bus,vectors-KBps =
+		<100 512 0 0>,
+		<100 512 1200000000 650000000>;
+	mhi-chan-cfg-0 = <0x0 0x80 0x2 0x92>;
+	mhi-chan-cfg-1 = <0x1 0x80 0x2 0xa2>;
+	mhi-chan-cfg-2 = <0x2 0x80 0x1 0x91>;
+	mhi-chan-cfg-3 = <0x3 0x80 0x1 0xa1>;
+	mhi-chan-cfg-4 = <0x4 0x80 0x2 0x92>;
+	mhi-chan-cfg-5 = <0x5 0x80 0x2 0xa2>;
+	mhi-chan-cfg-6 = <0x6 0xa 0x0 0x92>;
+	mhi-chan-cfg-7 = <0x7 0xa 0x0 0xa2>;
+	mhi-chan-cfg-10 = <0xa 0x80 0x1 0x92>;
+	mhi-chan-cfg-11 = <0xb 0x80 0x1 0xa2>;
+	mhi-chan-cfg-14 = <0xe 0x40 0x1 0x92>;
+	mhi-chan-cfg-15 = <0xf 0x40 0x1 0xa2>;
+	mhi-chan-cfg-16 = <0x10 0x40 0x1 0x92>;
+	mhi-chan-cfg-17 = <0x11 0x40 0x1 0xa2>;
+	mhi-chan-cfg-18 = <0x12 0x40 0x1 0x92>;
+	mhi-chan-cfg-19 = <0x13 0x40 0x1 0xa2>;
+	mhi-chan-cfg-20 = <0x14 0xa 0x0 0x92>;
+	mhi-chan-cfg-21 = <0x15 0xa 0x0 0xa2>;
+	mhi-chan-cfg-22 = <0x16 0x40 0x2 0x92>;
+	mhi-chan-cfg-23 = <0x17 0x40 0x2 0xa2>;
+	mhi-chan-cfg-24 = <0x18 0xa 0x0 0x91>;
+	mhi-chan-cfg-25 = <0x19 0xa 0x0 0xa1>;
+	mhi-chan-cfg-32 = <0x20 0x80 0x2 0x92>;
+	mhi-chan-cfg-33 = <0x21 0x80 0x2 0xa2>;
+	mhi-chan-cfg-34 = <0x22 0x80 0x2 0x92>;
+	mhi-chan-cfg-35 = <0x23 0x80 0x2 0xa2>;
+	mhi-chan-cfg-100 = <0x64 0x80 0x3 0x52>;
+	mhi-chan-cfg-101 = <0x65 0x80 0x4 0x62>;
+	mhi-event-rings = <5>;
+	mhi-event-cfg-0 = <0x80 0x0 0x1 0x11>;
+	mhi-event-cfg-1 = <0x80 0x1 0x1 0x11>;
+	mhi-event-cfg-2 = <0x80 0x2 0x5 0x11>;
+	mhi-event-cfg-3 = <0x100 0x3 0x1 0x9>;
+	mhi-event-cfg-4 = <0x100 0x4 0x1 0x8>;
+	mhi-dev-address-win-size = <0x10 0x00000000>;
+};
+
+&pm8994_mpps {
+	mpp@a100 { /* MPP 2*/
+		/* MDM PON conrol*/
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <1>;
+		status = "okay";
+	};
+};
+
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-mtp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-mtp.dts
new file mode 100644
index 000000000000..0417c5bc1ef4
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 + PMI8994 MTP";
+	compatible = "qcom,apq8096-mtp", "qcom,apq8096", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pm8004-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pm8004-cdp.dts
new file mode 100644
index 000000000000..f08e5b675e27
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pm8004-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 + PMI8994 + PM8004 CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pm8004-mdm9x55-i2s-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pm8004-mdm9x55-i2s-cdp.dts
new file mode 100644
index 000000000000..1c9d4ea56d47
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pm8004-mdm9x55-i2s-cdp.dts
@@ -0,0 +1,113 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004.dtsi"
+#include "msm8996-cdp.dtsi"
+#include "external-soc.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 + PMI8994 + PM8004, MDM9x55 I2S CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 2>;
+};
+
+&pil_modem {
+	status = "disabled";
+};
+
+&pm8994_l9 {
+	regulator-always-on;
+};
+
+&pm8994_l10 {
+	regulator-always-on;
+};
+
+&mdm3 {
+	pinctrl-names = "mdm_active", "mdm_suspend";
+	pinctrl-0 = <&ap2mdm_active &mdm2ap_active>;
+	pinctrl-1 = <&ap2mdm_sleep &mdm2ap_sleep>;
+	interrupt-map = <0 &tlmm 108 0x3
+			1 &tlmm 107 0x3
+			2 &tlmm 112 0x3>;
+	qcom,mdm2ap-errfatal-gpio = <&tlmm 108 0x00>;
+	qcom,ap2mdm-errfatal-gpio = <&tlmm 109 0x00>;
+	qcom,mdm2ap-status-gpio   = <&tlmm 106 0x00>;
+	qcom,ap2mdm-status-gpio   = <&tlmm 107 0x00>;
+	qcom,ap2mdm-soft-reset-gpio = <&pm8994_mpps 2 0>;
+	qcom,ap2mdm-vddmin-gpio = <&tlmm 111 0x00>;
+	qcom,mdm2ap-vddmin-gpio = <&tlmm 112 0x00>;
+	status = "ok";
+};
+
+&mhi {
+	esoc-names = "mdm";
+	esoc-0 = <&mdm3>;
+	qcom,msm-bus,name = "mhi";
+	qcom,msm-bus,num-cases = <2>;
+	qcom,msm-bus,num-paths = <1>;
+	qcom,msm-bus,vectors-KBps =
+		<100 512 0 0>,
+		<100 512 1200000000 650000000>;
+	mhi-chan-cfg-0 = <0x0 0x80 0x2 0x92>;
+	mhi-chan-cfg-1 = <0x1 0x80 0x2 0xa2>;
+	mhi-chan-cfg-2 = <0x2 0x80 0x1 0x91>;
+	mhi-chan-cfg-3 = <0x3 0x80 0x1 0xa1>;
+	mhi-chan-cfg-4 = <0x4 0x80 0x2 0x92>;
+	mhi-chan-cfg-5 = <0x5 0x80 0x2 0xa2>;
+	mhi-chan-cfg-6 = <0x6 0xa 0x0 0x92>;
+	mhi-chan-cfg-7 = <0x7 0xa 0x0 0xa2>;
+	mhi-chan-cfg-10 = <0xa 0x80 0x1 0x92>;
+	mhi-chan-cfg-11 = <0xb 0x80 0x1 0xa2>;
+	mhi-chan-cfg-14 = <0xe 0x40 0x1 0x92>;
+	mhi-chan-cfg-15 = <0xf 0x40 0x1 0xa2>;
+	mhi-chan-cfg-16 = <0x10 0x40 0x1 0x92>;
+	mhi-chan-cfg-17 = <0x11 0x40 0x1 0xa2>;
+	mhi-chan-cfg-18 = <0x12 0x40 0x1 0x92>;
+	mhi-chan-cfg-19 = <0x13 0x40 0x1 0xa2>;
+	mhi-chan-cfg-20 = <0x14 0xa 0x0 0x92>;
+	mhi-chan-cfg-21 = <0x15 0xa 0x0 0xa2>;
+	mhi-chan-cfg-22 = <0x16 0x40 0x2 0x92>;
+	mhi-chan-cfg-23 = <0x17 0x40 0x2 0xa2>;
+	mhi-chan-cfg-24 = <0x18 0xa 0x0 0x91>;
+	mhi-chan-cfg-25 = <0x19 0xa 0x0 0xa1>;
+	mhi-chan-cfg-32 = <0x20 0x80 0x2 0x92>;
+	mhi-chan-cfg-33 = <0x21 0x80 0x2 0xa2>;
+	mhi-chan-cfg-34 = <0x22 0x80 0x2 0x92>;
+	mhi-chan-cfg-35 = <0x23 0x80 0x2 0xa2>;
+	mhi-chan-cfg-100 = <0x64 0x80 0x3 0x52>;
+	mhi-chan-cfg-101 = <0x65 0x80 0x4 0x62>;
+	mhi-event-rings = <5>;
+	mhi-event-cfg-0 = <0x80 0x0 0x1 0x11>;
+	mhi-event-cfg-1 = <0x80 0x1 0x1 0x11>;
+	mhi-event-cfg-2 = <0x80 0x2 0x5 0x11>;
+	mhi-event-cfg-3 = <0x100 0x3 0x1 0x9>;
+	mhi-event-cfg-4 = <0x100 0x4 0x1 0x8>;
+	mhi-dev-address-win-size = <0x10 0x00000000>;
+};
+
+&pm8994_mpps {
+	mpp@a100 { /* MPP 2*/
+		/* MDM PON conrol*/
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <1>;
+		status = "okay";
+	};
+};
+
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pm8004-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pm8004-pmk8001-cdp.dts
new file mode 100644
index 000000000000..639b073820a0
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pm8004-pmk8001-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 + PMI8994 + PM8004 + PMK8001 CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pm8004-pmk8001-mdm9x55-i2s-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pm8004-pmk8001-mdm9x55-i2s-cdp.dts
new file mode 100644
index 000000000000..b3ebfc1092c8
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pm8004-pmk8001-mdm9x55-i2s-cdp.dts
@@ -0,0 +1,113 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+#include "external-soc.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 + PMI8994 + PM8004 + PMK8001, MDM9x55 I2S CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 2>;
+};
+
+&pil_modem {
+	status = "disabled";
+};
+
+&pm8994_l9 {
+	regulator-always-on;
+};
+
+&pm8994_l10 {
+	regulator-always-on;
+};
+
+&mdm3 {
+	pinctrl-names = "mdm_active", "mdm_suspend";
+	pinctrl-0 = <&ap2mdm_active &mdm2ap_active>;
+	pinctrl-1 = <&ap2mdm_sleep &mdm2ap_sleep>;
+	interrupt-map = <0 &tlmm 108 0x3
+			1 &tlmm 107 0x3
+			2 &tlmm 112 0x3>;
+	qcom,mdm2ap-errfatal-gpio = <&tlmm 108 0x00>;
+	qcom,ap2mdm-errfatal-gpio = <&tlmm 109 0x00>;
+	qcom,mdm2ap-status-gpio   = <&tlmm 106 0x00>;
+	qcom,ap2mdm-status-gpio   = <&tlmm 107 0x00>;
+	qcom,ap2mdm-soft-reset-gpio = <&pm8994_mpps 2 0>;
+	qcom,ap2mdm-vddmin-gpio = <&tlmm 111 0x00>;
+	qcom,mdm2ap-vddmin-gpio = <&tlmm 112 0x00>;
+	status = "ok";
+};
+
+&mhi {
+	esoc-names = "mdm";
+	esoc-0 = <&mdm3>;
+	qcom,msm-bus,name = "mhi";
+	qcom,msm-bus,num-cases = <2>;
+	qcom,msm-bus,num-paths = <1>;
+	qcom,msm-bus,vectors-KBps =
+		<100 512 0 0>,
+		<100 512 1200000000 650000000>;
+	mhi-chan-cfg-0 = <0x0 0x80 0x2 0x92>;
+	mhi-chan-cfg-1 = <0x1 0x80 0x2 0xa2>;
+	mhi-chan-cfg-2 = <0x2 0x80 0x1 0x91>;
+	mhi-chan-cfg-3 = <0x3 0x80 0x1 0xa1>;
+	mhi-chan-cfg-4 = <0x4 0x80 0x2 0x92>;
+	mhi-chan-cfg-5 = <0x5 0x80 0x2 0xa2>;
+	mhi-chan-cfg-6 = <0x6 0xa 0x0 0x92>;
+	mhi-chan-cfg-7 = <0x7 0xa 0x0 0xa2>;
+	mhi-chan-cfg-10 = <0xa 0x80 0x1 0x92>;
+	mhi-chan-cfg-11 = <0xb 0x80 0x1 0xa2>;
+	mhi-chan-cfg-14 = <0xe 0x40 0x1 0x92>;
+	mhi-chan-cfg-15 = <0xf 0x40 0x1 0xa2>;
+	mhi-chan-cfg-16 = <0x10 0x40 0x1 0x92>;
+	mhi-chan-cfg-17 = <0x11 0x40 0x1 0xa2>;
+	mhi-chan-cfg-18 = <0x12 0x40 0x1 0x92>;
+	mhi-chan-cfg-19 = <0x13 0x40 0x1 0xa2>;
+	mhi-chan-cfg-20 = <0x14 0xa 0x0 0x92>;
+	mhi-chan-cfg-21 = <0x15 0xa 0x0 0xa2>;
+	mhi-chan-cfg-22 = <0x16 0xa 0x0 0x92>;
+	mhi-chan-cfg-23 = <0x17 0xa 0x0 0xa2>;
+	mhi-chan-cfg-24 = <0x18 0xa 0x0 0x91>;
+	mhi-chan-cfg-25 = <0x19 0xa 0x0 0xa1>;
+	mhi-chan-cfg-32 = <0x20 0x80 0x2 0x92>;
+	mhi-chan-cfg-33 = <0x21 0x80 0x2 0xa2>;
+	mhi-chan-cfg-34 = <0x22 0x80 0x2 0x92>;
+	mhi-chan-cfg-35 = <0x23 0x80 0x2 0xa2>;
+	mhi-chan-cfg-100 = <0x64 0x80 0x3 0x52>;
+	mhi-chan-cfg-101 = <0x65 0x80 0x4 0x62>;
+	mhi-event-rings = <5>;
+	mhi-event-cfg-0 = <0x80 0x0 0x1 0x11>;
+	mhi-event-cfg-1 = <0x80 0x1 0x1 0x11>;
+	mhi-event-cfg-2 = <0x80 0x2 0x5 0x11>;
+	mhi-event-cfg-3 = <0x100 0x3 0x1 0x9>;
+	mhi-event-cfg-4 = <0x100 0x4 0x1 0x8>;
+	mhi-dev-address-win-size = <0x10 0x00000000>;
+};
+
+&pm8994_mpps {
+	mpp@a100 { /* MPP 2*/
+		/* MDM PON conrol*/
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <1>;
+		status = "okay";
+	};
+};
+
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pmk8001-cdp.dts
new file mode 100644
index 000000000000..ef8b5f17ba6e
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pmk8001-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+*
+* This program is free software; you can redistribute it and/or modify
+* it under the terms of the GNU General Public License version 2 and
+* only version 2 as published by the Free Software Foundation.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+*/
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm8996-pm8994-pmi8994-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 + PMI8994 + PMK8001 CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pmk8001-mdm9x55-i2s-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pmk8001-mdm9x55-i2s-cdp.dts
new file mode 100644
index 000000000000..7c58c05f5c61
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8994-pmk8001-mdm9x55-i2s-cdp.dts
@@ -0,0 +1,113 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+*
+* This program is free software; you can redistribute it and/or modify
+* it under the terms of the GNU General Public License version 2 and
+* only version 2 as published by the Free Software Foundation.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+*/
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm8996-pm8994-pmi8994-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+#include "external-soc.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 + PMI8994 + PMK8001, MDM9x55 I2S CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 2>;
+};
+
+&pil_modem {
+	status = "disabled";
+};
+
+&pm8994_l9 {
+	regulator-always-on;
+};
+
+&pm8994_l10 {
+	regulator-always-on;
+};
+
+&mdm3 {
+	pinctrl-names = "mdm_active", "mdm_suspend";
+	pinctrl-0 = <&ap2mdm_active &mdm2ap_active>;
+	pinctrl-1 = <&ap2mdm_sleep &mdm2ap_sleep>;
+	interrupt-map = <0 &tlmm 108 0x3
+			1 &tlmm 107 0x3
+			2 &tlmm 112 0x3>;
+	qcom,mdm2ap-errfatal-gpio = <&tlmm 108 0x00>;
+	qcom,ap2mdm-errfatal-gpio = <&tlmm 109 0x00>;
+	qcom,mdm2ap-status-gpio   = <&tlmm 106 0x00>;
+	qcom,ap2mdm-status-gpio   = <&tlmm 107 0x00>;
+	qcom,ap2mdm-soft-reset-gpio = <&pm8994_mpps 2 0>;
+	qcom,ap2mdm-vddmin-gpio = <&tlmm 111 0x00>;
+	qcom,mdm2ap-vddmin-gpio = <&tlmm 112 0x00>;
+	status = "ok";
+};
+
+&mhi {
+	esoc-names = "mdm";
+	esoc-0 = <&mdm3>;
+	qcom,msm-bus,name = "mhi";
+	qcom,msm-bus,num-cases = <2>;
+	qcom,msm-bus,num-paths = <1>;
+	qcom,msm-bus,vectors-KBps =
+		<100 512 0 0>,
+		<100 512 1200000000 650000000>;
+	mhi-chan-cfg-0 = <0x0 0x80 0x2 0x92>;
+	mhi-chan-cfg-1 = <0x1 0x80 0x2 0xa2>;
+	mhi-chan-cfg-2 = <0x2 0x80 0x1 0x91>;
+	mhi-chan-cfg-3 = <0x3 0x80 0x1 0xa1>;
+	mhi-chan-cfg-4 = <0x4 0x80 0x2 0x92>;
+	mhi-chan-cfg-5 = <0x5 0x80 0x2 0xa2>;
+	mhi-chan-cfg-6 = <0x6 0xa 0x0 0x92>;
+	mhi-chan-cfg-7 = <0x7 0xa 0x0 0xa2>;
+	mhi-chan-cfg-10 = <0xa 0x80 0x1 0x92>;
+	mhi-chan-cfg-11 = <0xb 0x80 0x1 0xa2>;
+	mhi-chan-cfg-14 = <0xe 0x40 0x1 0x92>;
+	mhi-chan-cfg-15 = <0xf 0x40 0x1 0xa2>;
+	mhi-chan-cfg-16 = <0x10 0x40 0x1 0x92>;
+	mhi-chan-cfg-17 = <0x11 0x40 0x1 0xa2>;
+	mhi-chan-cfg-18 = <0x12 0x40 0x1 0x92>;
+	mhi-chan-cfg-19 = <0x13 0x40 0x1 0xa2>;
+	mhi-chan-cfg-20 = <0x14 0xa 0x0 0x92>;
+	mhi-chan-cfg-21 = <0x15 0xa 0x0 0xa2>;
+	mhi-chan-cfg-22 = <0x16 0x40 0x2 0x92>;
+	mhi-chan-cfg-23 = <0x17 0x40 0x2 0xa2>;
+	mhi-chan-cfg-24 = <0x18 0xa 0x0 0x91>;
+	mhi-chan-cfg-25 = <0x19 0xa 0x0 0xa1>;
+	mhi-chan-cfg-32 = <0x20 0x80 0x2 0x92>;
+	mhi-chan-cfg-33 = <0x21 0x80 0x2 0xa2>;
+	mhi-chan-cfg-34 = <0x22 0x80 0x2 0x92>;
+	mhi-chan-cfg-35 = <0x23 0x80 0x2 0xa2>;
+	mhi-chan-cfg-100 = <0x64 0x80 0x3 0x52>;
+	mhi-chan-cfg-101 = <0x65 0x80 0x4 0x62>;
+	mhi-event-rings = <5>;
+	mhi-event-cfg-0 = <0x80 0x0 0x1 0x11>;
+	mhi-event-cfg-1 = <0x80 0x1 0x1 0x11>;
+	mhi-event-cfg-2 = <0x80 0x2 0x5 0x11>;
+	mhi-event-cfg-3 = <0x100 0x3 0x1 0x9>;
+	mhi-event-cfg-4 = <0x100 0x4 0x1 0x8>;
+	mhi-dev-address-win-size = <0x10 0x00000000>;
+};
+
+&pm8994_mpps {
+	mpp@a100 { /* MPP 2*/
+		/* MDM PON conrol*/
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <1>;
+		status = "okay";
+	};
+};
+
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-cdp.dts
new file mode 100644
index 000000000000..923fa1573a5b
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-cdp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm-pmi8996.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 + PMI8996 CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-dragonboard.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-dragonboard.dts
new file mode 100644
index 000000000000..da45de0cc1ec
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-dragonboard.dts
@@ -0,0 +1,28 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm-pmi8996.dtsi"
+#include "apq8096-dragonboard.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ8096v3 + PMI8996 DragonBoard";
+	compatible = "qcom,apq8096-dragonboard", "qcom,msm8996",
+			"qcom,apq8096", "qcom,dragonboard";
+	qcom,msm-id = <246 0x30000>, <291 0x30000>,
+			<246 0x30001>, <291 0x30001>;
+	qcom,board-id = <10 0>;
+};
+
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-mdm9x55-i2s-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-mdm9x55-i2s-cdp.dts
new file mode 100644
index 000000000000..71ef7617b47f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-mdm9x55-i2s-cdp.dts
@@ -0,0 +1,113 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm-pmi8996.dtsi"
+#include "msm8996-cdp.dtsi"
+#include "external-soc.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 + PMI8996, MDM9x55 I2S CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 2>;
+};
+
+&pil_modem {
+	status = "disabled";
+};
+
+&pm8994_l9 {
+	regulator-always-on;
+};
+
+&pm8994_l10 {
+	regulator-always-on;
+};
+
+&mdm3 {
+	pinctrl-names = "mdm_active", "mdm_suspend";
+	pinctrl-0 = <&ap2mdm_active &mdm2ap_active>;
+	pinctrl-1 = <&ap2mdm_sleep &mdm2ap_sleep>;
+	interrupt-map = <0 &tlmm 108 0x3
+			1 &tlmm 107 0x3
+			2 &tlmm 112 0x3>;
+	qcom,mdm2ap-errfatal-gpio = <&tlmm 108 0x00>;
+	qcom,ap2mdm-errfatal-gpio = <&tlmm 109 0x00>;
+	qcom,mdm2ap-status-gpio   = <&tlmm 106 0x00>;
+	qcom,ap2mdm-status-gpio   = <&tlmm 107 0x00>;
+	qcom,ap2mdm-soft-reset-gpio = <&pm8994_mpps 2 0>;
+	qcom,ap2mdm-vddmin-gpio = <&tlmm 111 0x00>;
+	qcom,mdm2ap-vddmin-gpio = <&tlmm 112 0x00>;
+	status = "ok";
+};
+
+&mhi {
+	esoc-names = "mdm";
+	esoc-0 = <&mdm3>;
+	qcom,msm-bus,name = "mhi";
+	qcom,msm-bus,num-cases = <2>;
+	qcom,msm-bus,num-paths = <1>;
+	qcom,msm-bus,vectors-KBps =
+		<100 512 0 0>,
+		<100 512 1200000000 650000000>;
+	mhi-chan-cfg-0 = <0x0 0x80 0x2 0x92>;
+	mhi-chan-cfg-1 = <0x1 0x80 0x2 0xa2>;
+	mhi-chan-cfg-2 = <0x2 0x80 0x1 0x91>;
+	mhi-chan-cfg-3 = <0x3 0x80 0x1 0xa1>;
+	mhi-chan-cfg-4 = <0x4 0x80 0x2 0x92>;
+	mhi-chan-cfg-5 = <0x5 0x80 0x2 0xa2>;
+	mhi-chan-cfg-6 = <0x6 0xa 0x0 0x92>;
+	mhi-chan-cfg-7 = <0x7 0xa 0x0 0xa2>;
+	mhi-chan-cfg-10 = <0xa 0x80 0x1 0x92>;
+	mhi-chan-cfg-11 = <0xb 0x80 0x1 0xa2>;
+	mhi-chan-cfg-14 = <0xe 0x40 0x1 0x92>;
+	mhi-chan-cfg-15 = <0xf 0x40 0x1 0xa2>;
+	mhi-chan-cfg-16 = <0x10 0x40 0x1 0x92>;
+	mhi-chan-cfg-17 = <0x11 0x40 0x1 0xa2>;
+	mhi-chan-cfg-18 = <0x12 0x40 0x1 0x92>;
+	mhi-chan-cfg-19 = <0x13 0x40 0x1 0xa2>;
+	mhi-chan-cfg-20 = <0x14 0xa 0x0 0x92>;
+	mhi-chan-cfg-21 = <0x15 0xa 0x0 0xa2>;
+	mhi-chan-cfg-22 = <0x16 0x40 0x2 0x92>;
+	mhi-chan-cfg-23 = <0x17 0x40 0x2 0xa2>;
+	mhi-chan-cfg-24 = <0x18 0xa 0x0 0x91>;
+	mhi-chan-cfg-25 = <0x19 0xa 0x0 0xa1>;
+	mhi-chan-cfg-32 = <0x20 0x80 0x2 0x92>;
+	mhi-chan-cfg-33 = <0x21 0x80 0x2 0xa2>;
+	mhi-chan-cfg-34 = <0x22 0x80 0x2 0x92>;
+	mhi-chan-cfg-35 = <0x23 0x80 0x2 0xa2>;
+	mhi-chan-cfg-100 = <0x64 0x80 0x3 0x52>;
+	mhi-chan-cfg-101 = <0x65 0x80 0x4 0x62>;
+	mhi-event-rings = <5>;
+	mhi-event-cfg-0 = <0x80 0x0 0x1 0x11>;
+	mhi-event-cfg-1 = <0x80 0x1 0x1 0x11>;
+	mhi-event-cfg-2 = <0x80 0x2 0x5 0x11>;
+	mhi-event-cfg-3 = <0x100 0x3 0x1 0x9>;
+	mhi-event-cfg-4 = <0x100 0x4 0x1 0x8>;
+	mhi-dev-address-win-size = <0x10 0x00000000>;
+};
+
+&pm8994_mpps {
+	mpp@a100 { /* MPP 2*/
+		/* MDM PON conrol*/
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <1>;
+		status = "okay";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-mdm9x55-i2s-mtp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-mdm9x55-i2s-mtp.dts
new file mode 100644
index 000000000000..4d136091806a
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-mdm9x55-i2s-mtp.dts
@@ -0,0 +1,113 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm-pmi8996.dtsi"
+#include "msm8996-mtp.dtsi"
+#include "external-soc.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 + PMI8996, MDM9x55 I2S MTP";
+	compatible = "qcom,apq8096-mtp", "qcom,apq8096", "qcom,mtp";
+	qcom,board-id = <8 1>;
+};
+
+&pil_modem {
+	status = "disabled";
+};
+
+&pm8994_l9 {
+	regulator-always-on;
+};
+
+&pm8994_l10 {
+	regulator-always-on;
+};
+
+&mdm3 {
+	pinctrl-names = "mdm_active", "mdm_suspend";
+	pinctrl-0 = <&ap2mdm_active &mdm2ap_active>;
+	pinctrl-1 = <&ap2mdm_sleep &mdm2ap_sleep>;
+	interrupt-map = <0 &tlmm 108 0x3
+			1 &tlmm 107 0x3
+			2 &tlmm 112 0x3>;
+	qcom,mdm2ap-errfatal-gpio = <&tlmm 108 0x00>;
+	qcom,ap2mdm-errfatal-gpio = <&tlmm 109 0x00>;
+	qcom,mdm2ap-status-gpio   = <&tlmm 106 0x00>;
+	qcom,ap2mdm-status-gpio   = <&tlmm 107 0x00>;
+	qcom,ap2mdm-soft-reset-gpio = <&pm8994_mpps 2 0>;
+	qcom,ap2mdm-vddmin-gpio = <&tlmm 111 0x00>;
+	qcom,mdm2ap-vddmin-gpio = <&tlmm 112 0x00>;
+	status = "ok";
+};
+
+&mhi {
+	esoc-names = "mdm";
+	esoc-0 = <&mdm3>;
+	qcom,msm-bus,name = "mhi";
+	qcom,msm-bus,num-cases = <2>;
+	qcom,msm-bus,num-paths = <1>;
+	qcom,msm-bus,vectors-KBps =
+		<100 512 0 0>,
+		<100 512 1200000000 650000000>;
+	mhi-chan-cfg-0 = <0x0 0x80 0x2 0x92>;
+	mhi-chan-cfg-1 = <0x1 0x80 0x2 0xa2>;
+	mhi-chan-cfg-2 = <0x2 0x80 0x1 0x91>;
+	mhi-chan-cfg-3 = <0x3 0x80 0x1 0xa1>;
+	mhi-chan-cfg-4 = <0x4 0x80 0x2 0x92>;
+	mhi-chan-cfg-5 = <0x5 0x80 0x2 0xa2>;
+	mhi-chan-cfg-6 = <0x6 0xa 0x0 0x92>;
+	mhi-chan-cfg-7 = <0x7 0xa 0x0 0xa2>;
+	mhi-chan-cfg-10 = <0xa 0x80 0x1 0x92>;
+	mhi-chan-cfg-11 = <0xb 0x80 0x1 0xa2>;
+	mhi-chan-cfg-14 = <0xe 0x40 0x1 0x92>;
+	mhi-chan-cfg-15 = <0xf 0x40 0x1 0xa2>;
+	mhi-chan-cfg-16 = <0x10 0x40 0x1 0x92>;
+	mhi-chan-cfg-17 = <0x11 0x40 0x1 0xa2>;
+	mhi-chan-cfg-18 = <0x12 0x40 0x1 0x92>;
+	mhi-chan-cfg-19 = <0x13 0x40 0x1 0xa2>;
+	mhi-chan-cfg-20 = <0x14 0xa 0x0 0x92>;
+	mhi-chan-cfg-21 = <0x15 0xa 0x0 0xa2>;
+	mhi-chan-cfg-22 = <0x16 0x40 0x2 0x92>;
+	mhi-chan-cfg-23 = <0x17 0x40 0x2 0xa2>;
+	mhi-chan-cfg-24 = <0x18 0xa 0x0 0x91>;
+	mhi-chan-cfg-25 = <0x19 0xa 0x0 0xa1>;
+	mhi-chan-cfg-32 = <0x20 0x80 0x2 0x92>;
+	mhi-chan-cfg-33 = <0x21 0x80 0x2 0xa2>;
+	mhi-chan-cfg-34 = <0x22 0x80 0x2 0x92>;
+	mhi-chan-cfg-35 = <0x23 0x80 0x2 0xa2>;
+	mhi-chan-cfg-100 = <0x64 0x80 0x3 0x52>;
+	mhi-chan-cfg-101 = <0x65 0x80 0x4 0x62>;
+	mhi-event-rings = <5>;
+	mhi-event-cfg-0 = <0x80 0x0 0x1 0x11>;
+	mhi-event-cfg-1 = <0x80 0x1 0x1 0x11>;
+	mhi-event-cfg-2 = <0x80 0x2 0x5 0x11>;
+	mhi-event-cfg-3 = <0x100 0x3 0x1 0x9>;
+	mhi-event-cfg-4 = <0x100 0x4 0x1 0x8>;
+	mhi-dev-address-win-size = <0x10 0x00000000>;
+};
+
+&pm8994_mpps {
+	mpp@a100 { /* MPP 2*/
+		/* MDM PON conrol*/
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <1>;
+		status = "okay";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-mdm9x55-slimbus-mtp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-mdm9x55-slimbus-mtp.dts
new file mode 100644
index 000000000000..8fda04fbfe92
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-mdm9x55-slimbus-mtp.dts
@@ -0,0 +1,114 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm-pmi8996.dtsi"
+#include "msm8996-mtp.dtsi"
+#include "external-soc.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 + PMI8996, MDM9x55 Slimbus MTP";
+	compatible = "qcom,apq8096-mtp", "qcom,apq8096", "qcom,mtp";
+	qcom,board-id = <8 2>;
+};
+
+&pil_modem {
+	status = "disabled";
+};
+
+&pm8994_l9 {
+	regulator-always-on;
+};
+
+&pm8994_l10 {
+	regulator-always-on;
+};
+
+&mdm3 {
+	pinctrl-names = "mdm_active", "mdm_suspend";
+	pinctrl-0 = <&ap2mdm_active &mdm2ap_active>;
+	pinctrl-1 = <&ap2mdm_sleep &mdm2ap_sleep>;
+	interrupt-map = <0 &tlmm 108 0x3
+			1 &tlmm 107 0x3
+			2 &tlmm 112 0x3>;
+	qcom,mdm2ap-errfatal-gpio = <&tlmm 108 0x00>;
+	qcom,ap2mdm-errfatal-gpio = <&tlmm 109 0x00>;
+	qcom,mdm2ap-status-gpio   = <&tlmm 106 0x00>;
+	qcom,ap2mdm-status-gpio   = <&tlmm 107 0x00>;
+	qcom,ap2mdm-soft-reset-gpio = <&pm8994_mpps 2 0>;
+	qcom,ap2mdm-vddmin-gpio = <&tlmm 111 0x00>;
+	qcom,mdm2ap-vddmin-gpio = <&tlmm 112 0x00>;
+	status = "ok";
+};
+
+&mhi {
+	esoc-names = "mdm";
+	esoc-0 = <&mdm3>;
+	qcom,msm-bus,name = "mhi";
+	qcom,msm-bus,num-cases = <2>;
+	qcom,msm-bus,num-paths = <1>;
+	qcom,msm-bus,vectors-KBps =
+		<100 512 0 0>,
+		<100 512 1200000000 650000000>;
+	mhi-chan-cfg-0 = <0x0 0x80 0x2 0x92>;
+	mhi-chan-cfg-1 = <0x1 0x80 0x2 0xa2>;
+	mhi-chan-cfg-2 = <0x2 0x80 0x1 0x91>;
+	mhi-chan-cfg-3 = <0x3 0x80 0x1 0xa1>;
+	mhi-chan-cfg-4 = <0x4 0x80 0x2 0x92>;
+	mhi-chan-cfg-5 = <0x5 0x80 0x2 0xa2>;
+	mhi-chan-cfg-6 = <0x6 0xa 0x0 0x92>;
+	mhi-chan-cfg-7 = <0x7 0xa 0x0 0xa2>;
+	mhi-chan-cfg-10 = <0xa 0x80 0x1 0x92>;
+	mhi-chan-cfg-11 = <0xb 0x80 0x1 0xa2>;
+	mhi-chan-cfg-14 = <0xe 0x40 0x1 0x92>;
+	mhi-chan-cfg-15 = <0xf 0x40 0x1 0xa2>;
+	mhi-chan-cfg-16 = <0x10 0x40 0x1 0x92>;
+	mhi-chan-cfg-17 = <0x11 0x40 0x1 0xa2>;
+	mhi-chan-cfg-18 = <0x12 0x40 0x1 0x92>;
+	mhi-chan-cfg-19 = <0x13 0x40 0x1 0xa2>;
+	mhi-chan-cfg-20 = <0x14 0xa 0x0 0x92>;
+	mhi-chan-cfg-21 = <0x15 0xa 0x0 0xa2>;
+	mhi-chan-cfg-22 = <0x16 0x40 0x2 0x92>;
+	mhi-chan-cfg-23 = <0x17 0x40 0x2 0xa2>;
+	mhi-chan-cfg-24 = <0x18 0xa 0x0 0x91>;
+	mhi-chan-cfg-25 = <0x19 0xa 0x0 0xa1>;
+	mhi-chan-cfg-32 = <0x20 0x80 0x2 0x92>;
+	mhi-chan-cfg-33 = <0x21 0x80 0x2 0xa2>;
+	mhi-chan-cfg-34 = <0x22 0x80 0x2 0x92>;
+	mhi-chan-cfg-35 = <0x23 0x80 0x2 0xa2>;
+	mhi-chan-cfg-100 = <0x64 0x80 0x3 0x52>;
+	mhi-chan-cfg-101 = <0x65 0x80 0x4 0x62>;
+	mhi-event-rings = <5>;
+	mhi-event-cfg-0 = <0x80 0x0 0x1 0x11>;
+	mhi-event-cfg-1 = <0x80 0x1 0x1 0x11>;
+	mhi-event-cfg-2 = <0x80 0x2 0x5 0x11>;
+	mhi-event-cfg-3 = <0x100 0x3 0x1 0x9>;
+	mhi-event-cfg-4 = <0x100 0x4 0x1 0x8>;
+	mhi-dev-address-win-size = <0x10 0x00000000>;
+};
+
+&pm8994_mpps {
+	mpp@a100 { /* MPP 2*/
+		/* MDM PON conrol*/
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <1>;
+		status = "okay";
+	};
+};
+
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-mtp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-mtp.dts
new file mode 100644
index 000000000000..712eedeae08e
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-pmi8996-mtp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm-pmi8996.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3 + PMI8996 MTP";
+	compatible = "qcom,apq8096-mtp", "qcom,apq8096", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3-sbc.dts b/arch/arm64/boot/dts/qcom/apq8096-v3-sbc.dts
new file mode 100644
index 000000000000..c37ebb8bc08e
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3-sbc.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.dtsi"
+#include "msm-pmi8996.dtsi"
+#include "apq8096-sbc.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ8096v3";
+	compatible = "qcom,apq8096-sbc", "qcom,msm8996",
+			"qcom,apq8096", "qcom,sbc";
+	qcom,board-id = <24 0>;
+};
+
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3.0-dragonboard.dts b/arch/arm64/boot/dts/qcom/apq8096-v3.0-dragonboard.dts
new file mode 100644
index 000000000000..9484d04d01e7
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3.0-dragonboard.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.0.dtsi"
+#include "apq8096-dragonboard.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ8096v3.0 + PMI8994 DragonBoard";
+	compatible = "qcom,apq8096-dragonboard", "qcom,msm8996",
+			"qcom,apq8096", "qcom,dragonboard";
+	qcom,msm-id = <246 0x30000>, <291 0x30000>;
+	qcom,board-id = <10 0>;
+};
+
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3.0-liquid.dts b/arch/arm64/boot/dts/qcom/apq8096-v3.0-liquid.dts
new file mode 100644
index 000000000000..bddd7de04646
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3.0-liquid.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.0.dtsi"
+#include "msm8996-liquid.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3.0 LiQUID";
+	compatible = "qcom,apq8096-liquid", "qcom,apq8096", "qcom,liquid";
+	qcom,board-id = <9 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-cdp.dts
new file mode 100644
index 000000000000..a812b98d01f6
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.0.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3.0 + PMI8994 CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-mtp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-mtp.dts
new file mode 100644
index 000000000000..91705183b023
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.0.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3.0 + PMI8994 MTP";
+	compatible = "qcom,apq8096-mtp", "qcom,apq8096", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-pm8004-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-pm8004-cdp.dts
new file mode 100644
index 000000000000..5d6e6ab74df4
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-pm8004-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8096-v3.0.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3.0 + PMI8994 + PM8004 CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-pm8004-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-pm8004-pmk8001-cdp.dts
new file mode 100644
index 000000000000..0414b24a4dd5
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-pm8004-pmk8001-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8096-v3.0.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3.0 + PMI8994 + PM8004 + PMK8001 CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-pmk8001-cdp.dts
new file mode 100644
index 000000000000..e1b385873f9c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8994-pmk8001-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+*
+* This program is free software; you can redistribute it and/or modify
+* it under the terms of the GNU General Public License version 2 and
+* only version 2 as published by the Free Software Foundation.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+*/
+
+/dts-v1/;
+
+#include "apq8096-v3.0.dtsi"
+#include "msm8996-pm8994-pmi8994-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3.0 + PMI8994 + PMK8001 CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8996-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8996-cdp.dts
new file mode 100644
index 000000000000..ce04cc836354
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8996-cdp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.0.dtsi"
+#include "msm-pmi8996.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3.0 + PMI8996 CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8996-mtp.dts b/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8996-mtp.dts
new file mode 100644
index 000000000000..ac0a96bc2404
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3.0-pmi8996-mtp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096-v3.0.dtsi"
+#include "msm-pmi8996.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3.0 + PMI8996 MTP";
+	compatible = "qcom,apq8096-mtp", "qcom,apq8096", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3.0.dtsi b/arch/arm64/boot/dts/qcom/apq8096-v3.0.dtsi
new file mode 100644
index 000000000000..f79119c22823
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3.0.dtsi
@@ -0,0 +1,34 @@
+/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only version-specific property overrides should be placed
+ * inside this file. Common device definitions should be placed inside the
+ * msm8996.dtsi file.
+ */
+
+#include "msm8996-v3.0.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3.0";
+	qcom,msm-id = <291 0x30000>;
+};
+
+&soc {
+	qcom,rmnet-ipa {
+		status = "disabled";
+	};
+};
+
+&ipa_hw {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096-v3.dtsi b/arch/arm64/boot/dts/qcom/apq8096-v3.dtsi
new file mode 100644
index 000000000000..fdf9e997db28
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096-v3.dtsi
@@ -0,0 +1,34 @@
+/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only version-specific property overrides should be placed
+ * inside this file. Common device definitions should be placed inside the
+ * msm8996.dtsi file.
+ */
+
+#include "msm8996-v3.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 v3";
+	qcom,msm-id = <291 0x30001>;
+};
+
+&soc {
+	qcom,rmnet-ipa {
+		status = "disabled";
+	};
+};
+
+&ipa_hw {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096pro-auto-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096pro-auto-cdp.dts
new file mode 100644
index 000000000000..d438bbe828ed
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096pro-auto-cdp.dts
@@ -0,0 +1,44 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8096pro.dtsi"
+#include "msm8996-pm8994.dtsi"
+#include "msm8996-auto-cdp.dtsi"
+#include "msm8996pro-auto.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 pro AUTO CDP";
+	compatible = "qcom,apq8096-cdp", "qcom,apq8096", "qcom,cdp";
+	qcom,msm-id = <316 0x10000>;
+	qcom,board-id = <0x03010001 0>;
+};
+
+&spi_9 {
+	status = "ok";
+	can-controller@0 {
+		compatible = "renesas,rh850";
+		reg = <0>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <127 0>;
+		spi-max-frequency = <5000000>;
+	};
+};
+
+&soc {
+	qcom,msm-thermal {
+		qcom,hotplug-temp = <115>;
+		qcom,hotplug-temp-hysteresis = <25>;
+		qcom,therm-reset-temp = <119>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096pro-liquid.dts b/arch/arm64/boot/dts/qcom/apq8096pro-liquid.dts
new file mode 100644
index 000000000000..e4329c2320f9
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096pro-liquid.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8096pro.dtsi"
+#include "msm8996-liquid.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 pro LiQUID";
+	compatible = "qcom,apq8096-liquid", "qcom,apq8096", "qcom,liquid";
+	qcom,board-id = <9 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096pro-v1.1-auto-adp-lite.dts b/arch/arm64/boot/dts/qcom/apq8096pro-v1.1-auto-adp-lite.dts
new file mode 100644
index 000000000000..9f8d432a3112
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096pro-v1.1-auto-adp-lite.dts
@@ -0,0 +1,95 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include "apq8096pro.dtsi"
+#include "msm8996-pm8994.dtsi"
+#include "msm8996-agave-adp.dtsi"
+#include "msm8996pro-auto.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096pro V1.1 AUTO ADP LITE";
+	compatible = "qcom,apq8096-adp", "qcom,msm8996", "qcom,adp";
+	qcom,msm-id = <316 0x10001>;
+	qcom,board-id = <0x03010019 0>;
+};
+
+&spi_9 {
+	status = "disabled";
+};
+
+&soc {
+	qcom,msm-ssc-sensors {
+		status = "disabled";
+	};
+
+	qcom,msm-thermal {
+		qcom,hotplug-temp = <115>;
+		qcom,hotplug-temp-hysteresis = <25>;
+		qcom,therm-reset-temp = <119>;
+	};
+
+	i2c@75b6000 { /* BLSP8 */
+		/* ADV7533 HDMI Bridge Chip removed on ADP Lite */
+		adv7533@39 {
+			status = "disabled";
+		};
+	};
+
+	qcom,adv7481@70 {
+		status = "disabled";
+	};
+
+	qcom,msm-ba {
+		status = "disabled";
+	};
+};
+
+&dsi_adv_7533_2 {
+	/delete-property/ qcom,dsi-display-active;
+};
+
+&pil_modem {
+	pinctrl-names = "default";
+	pinctrl-0 = <&modem_mux>;
+};
+
+&slim_msm {
+	status = "disabled";
+};
+
+&pm8994_mpps {
+	mpp@a500 { /* MPP 6 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&sdhc_2 {
+	cd-gpios = <&tlmm 38 GPIO_ACTIVE_LOW>;
+	pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on_sbc>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off
+			&sdc2_cd_on_sbc>;
+};
+
+&i2c_7 {
+	silabs4705@11 { /* SiLabs FM chip, slave id 0x11*/
+		status = "disabled";
+	};
+};
+
diff --git a/arch/arm64/boot/dts/qcom/apq8096pro-v1.1-auto-adp.dts b/arch/arm64/boot/dts/qcom/apq8096pro-v1.1-auto-adp.dts
new file mode 100644
index 000000000000..840d82fa9084
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096pro-v1.1-auto-adp.dts
@@ -0,0 +1,88 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include "apq8096pro-v1.1.dtsi"
+#include "msm8996-pm8994.dtsi"
+#include "msm8996-agave-adp.dtsi"
+#include "msm8996pro-auto.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro AUTO ADP";
+	compatible = "qcom,apq8096-adp", "qcom,msm8996", "qcom,adp";
+	qcom,msm-id = <316 0x10001>;
+	qcom,board-id = <0x02010019 0>, <0x00010001 0>;
+};
+
+&spi_9 {
+	status = "ok";
+	can-controller@0 {
+		compatible = "renesas,rh850";
+		reg = <0>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <122 0>;
+		spi-max-frequency = <5000000>;
+	};
+};
+
+&soc {
+	qcom,msm-ssc-sensors {
+		status = "disabled";
+	};
+
+	qcom,msm-thermal {
+		qcom,hotplug-temp = <115>;
+		qcom,hotplug-temp-hysteresis = <25>;
+		qcom,therm-reset-temp = <119>;
+	};
+
+	qcom,adv7481@70 {
+		qcom,cam-vreg-min-voltage = <1300000 0 1800000>;
+		qcom,cam-vreg-max-voltage = <1300000 0 1800000>;
+	};
+};
+
+&pil_modem {
+	pinctrl-names = "default";
+	pinctrl-0 = <&modem_mux>;
+};
+
+&slim_msm {
+	status = "disabled";
+};
+
+&pm8994_mpps {
+	mpp@a500 { /* MPP 6 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&sdhc_2 {
+	cd-gpios = <&tlmm 38 GPIO_ACTIVE_LOW>;
+	pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on_sbc>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off
+			&sdc2_cd_on_sbc>;
+};
+
+&i2c_7 {
+	silabs4705@11 { /* SiLabs FM chip, slave id 0x11*/
+		status = "disabled";
+	};
+};
+
diff --git a/arch/arm64/boot/dts/qcom/apq8096pro-v1.1-auto-cdp.dts b/arch/arm64/boot/dts/qcom/apq8096pro-v1.1-auto-cdp.dts
new file mode 100644
index 000000000000..ecde7c667f9a
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096pro-v1.1-auto-cdp.dts
@@ -0,0 +1,37 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8096pro-v1.1.dtsi"
+#include "msm8996-pm8994.dtsi"
+#include "msm8996-auto-cdp.dtsi"
+#include "msm8996pro-auto.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 pro v1.1 AUTO CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,msm-id = <316 0x10001>;
+	qcom,board-id = <0x03010001 0>, <0x00010001 0>;
+};
+
+&spi_9 {
+	status = "ok";
+	can-controller@0 {
+		compatible = "renesas,rh850";
+		reg = <0>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <127 0>;
+		spi-max-frequency = <5000000>;
+	};
+};
+
diff --git a/arch/arm64/boot/dts/qcom/apq8096pro-v1.1.dtsi b/arch/arm64/boot/dts/qcom/apq8096pro-v1.1.dtsi
new file mode 100644
index 000000000000..043309f47bc6
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096pro-v1.1.dtsi
@@ -0,0 +1,34 @@
+/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only version-specific property overrides should be placed
+ * inside this file. Common device definitions should be placed inside the
+ * msm8996.dtsi file.
+ */
+
+#include "msm8996pro-v1.1.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 pro v1.1";
+	qcom,msm-id = <312 0x10001>;
+};
+
+&soc {
+	qcom,rmnet-ipa {
+		status = "disabled";
+	};
+};
+
+&ipa_hw {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8096pro.dtsi b/arch/arm64/boot/dts/qcom/apq8096pro.dtsi
new file mode 100644
index 000000000000..7a70c51ec0e4
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8096pro.dtsi
@@ -0,0 +1,34 @@
+/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only version-specific property overrides should be placed
+ * inside this file. Common device definitions should be placed inside the
+ * msm8996.dtsi file.
+ */
+
+#include "msm8996pro.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8096 pro";
+	qcom,msm-id = <312 0x20000>;
+};
+
+&soc {
+	qcom,rmnet-ipa {
+		status = "disabled";
+	};
+};
+
+&ipa_hw {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8098-cdp.dts b/arch/arm64/boot/dts/qcom/apq8098-cdp.dts
new file mode 100644
index 000000000000..54a41ab04498
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8098-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8098.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8098 CDP";
+	compatible = "qcom,apq8098-cdp", "qcom,apq8098", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8098-mtp.dts b/arch/arm64/boot/dts/qcom/apq8098-mtp.dts
new file mode 100644
index 000000000000..afb0f7b3fb91
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8098-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8098.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8098 MTP";
+	compatible = "qcom,apq8098-mtp", "qcom,apq8098", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8098-v2-cdp.dts b/arch/arm64/boot/dts/qcom/apq8098-v2-cdp.dts
new file mode 100644
index 000000000000..764847846a5b
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8098-v2-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8098-v2.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8098 V2 CDP";
+	compatible = "qcom,apq8098-cdp", "qcom,apq8098", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8098-v2-mtp.dts b/arch/arm64/boot/dts/qcom/apq8098-v2-mtp.dts
new file mode 100644
index 000000000000..77bae625e241
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8098-v2-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8098-v2.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8098 V2 MTP";
+	compatible = "qcom,apq8098-mtp", "qcom,apq8098", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8098-v2-qrd-skuk-hdk.dts b/arch/arm64/boot/dts/qcom/apq8098-v2-qrd-skuk-hdk.dts
new file mode 100644
index 000000000000..2207ab694917
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8098-v2-qrd-skuk-hdk.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "apq8098-v2.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-qrd-skuk-hdk.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8098 SKUK HDK";
+	compatible = "qcom,msm8998-qrd", "qcom,msm8998", "qcom,qrd";
+	qcom,board-id = <0x06000b 0x10>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8098-v2-qrd.dts b/arch/arm64/boot/dts/qcom/apq8098-v2-qrd.dts
new file mode 100644
index 000000000000..9e7b88a2d78c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8098-v2-qrd.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8098-v2.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-qrd.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8098 V2 QRD";
+	compatible = "qcom,apq8098-qrd", "qcom,apq8098", "qcom,qrd";
+	qcom,board-id = <11 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8098-v2.1-cdp.dts b/arch/arm64/boot/dts/qcom/apq8098-v2.1-cdp.dts
new file mode 100644
index 000000000000..a24835e59249
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8098-v2.1-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8098-v2.1.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8098 V2.1 CDP";
+	compatible = "qcom,apq8098-cdp", "qcom,apq8098", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8098-v2.1-mediabox.dts b/arch/arm64/boot/dts/qcom/apq8098-v2.1-mediabox.dts
new file mode 100644
index 000000000000..bd29c0307576
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8098-v2.1-mediabox.dts
@@ -0,0 +1,121 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8098-v2.1.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8098 V2.1 mediabox";
+	compatible = "qcom,apq8098-cdp", "qcom,apq8098", "qcom,cdp";
+	qcom,board-id = <8 1>;
+};
+
+&spi_10 {
+	status = "disabled";
+};
+
+&msm_ath10k_wlan {
+	status = "ok";
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "hdmi";
+};
+
+&sde_hdmi {
+	qcom,display-type = "primary";
+};
+
+&slim_aud {
+	tasha_codec {
+		wsa_spkr_sd1: msm_cdc_pinctrll {
+		      compatible = "qcom,msm-cdc-pinctrl";
+		      pinctrl-names = "aud_active", "aud_sleep";
+		      pinctrl-0 = <&spkr_1_sd_active_mediabox>;
+		      pinctrl-1 = <&spkr_1_sd_sleep_mediabox>;
+		};
+
+		wsa_spkr_sd2: msm_cdc_pinctrlr {
+		      compatible = "qcom,msm-cdc-pinctrl";
+		      pinctrl-names = "aud_active", "aud_sleep";
+		      pinctrl-0 = <&spkr_2_sd_active_mediabox>;
+		      pinctrl-1 = <&spkr_2_sd_sleep_mediabox>;
+		};
+	};
+};
+
+&mdss_dsi {
+	status = "disabled";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8998_l21>;
+	qcom,vdd-voltage-level = <2950000 2960000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8998_l13>;
+	qcom,vdd-io-voltage-level = <1808000 2960000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on
+			&sdc2_cd_on_mediabox>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off
+			&sdc2_cd_off_mediabox>;
+
+	qcom,clk-rates = <400000 20000000 25000000
+				50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 86 0x1>;
+
+	status = "ok";
+};
+
+&tspp {
+	qcom,lpass-timer-tts = <1>;
+};
+
+&snd_9335 {
+	qcom,msm-mi2s-master = <1>, <1>, <1>, <0>;
+	qcom,msm-mbhc-hphl-swh = <1>;
+};
+
+&wcd_usbc_analog_en1_gpio {
+	status = "disabled";
+};
+
+&wcd_usbc_analog_en2n_gpio {
+	status = "disabled";
+};
+
+&soc {
+	qcom,msm-dai-mi2s {
+		dai_mi2s3: qcom,msm-dai-q6-mi2s-quat {
+			/* SD0 (1 << 0) | SD1 (1 << 1) | SD2 (1 << 2) */
+			qcom,msm-mi2s-rx-lines = <0>;
+			qcom,msm-mi2s-tx-lines = <15>; /* SD3 (1 << 3) */
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&quat_mi2s_active &quat_mi2s_sd0_active
+					&quat_mi2s_sd1_active
+					&quat_mi2s_sd2_active
+					&quat_mi2s_sd3_active>;
+			pinctrl-1 = <&quat_mi2s_sleep &quat_mi2s_sd0_sleep
+					&quat_mi2s_sd1_sleep
+					&quat_mi2s_sd2_sleep
+					&quat_mi2s_sd3_sleep>;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8098-v2.1-mtp.dts b/arch/arm64/boot/dts/qcom/apq8098-v2.1-mtp.dts
new file mode 100644
index 000000000000..93887a39eecf
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8098-v2.1-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8098-v2.1.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8098 V2.1 MTP";
+	compatible = "qcom,apq8098-mtp", "qcom,apq8098", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8098-v2.1-qrd.dts b/arch/arm64/boot/dts/qcom/apq8098-v2.1-qrd.dts
new file mode 100644
index 000000000000..fb5e4579abb6
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8098-v2.1-qrd.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8098-v2.1.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-qrd.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8098 V2.1 QRD";
+	compatible = "qcom,apq8098-qrd", "qcom,apq8098", "qcom,qrd";
+	qcom,board-id = <11 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8098-v2.1-svr20.dts b/arch/arm64/boot/dts/qcom/apq8098-v2.1-svr20.dts
new file mode 100644
index 000000000000..4359a3f38ade
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8098-v2.1-svr20.dts
@@ -0,0 +1,22 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "apq8098-v2.1.dtsi"
+#include "msm8998-svr20.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8098 V2.1 SVR V2.0 Board";
+	compatible = "qcom,apq8098-svr", "qcom,apq8098", "qcom,svr";
+	qcom,board-id = <0x03020008 3>;
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8098-v2.1.dtsi b/arch/arm64/boot/dts/qcom/apq8098-v2.1.dtsi
new file mode 100644
index 000000000000..ef85584c9984
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8098-v2.1.dtsi
@@ -0,0 +1,28 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8998-v2.1.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8098 V2.1";
+	qcom,msm-id = <319 0x20001>;
+};
+
+&soc {
+	qcom,rmnet-ipa {
+		status = "disabled";
+	};
+};
+
+&ipa_hw {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8098-v2.dtsi b/arch/arm64/boot/dts/qcom/apq8098-v2.dtsi
new file mode 100644
index 000000000000..022921abcc58
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8098-v2.dtsi
@@ -0,0 +1,28 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8998-v2.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8098 V2";
+	qcom,msm-id = <319 0x20000>;
+};
+
+&soc {
+	qcom,rmnet-ipa {
+		status = "disabled";
+	};
+};
+
+&ipa_hw {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8098.dtsi b/arch/arm64/boot/dts/qcom/apq8098.dtsi
new file mode 100644
index 000000000000..8cb0c6b17689
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/apq8098.dtsi
@@ -0,0 +1,28 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8998.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. APQ 8098";
+	qcom,msm-id = <319 0x10000>;
+};
+
+&soc {
+	qcom,rmnet-ipa {
+		status = "disabled";
+	};
+};
+
+&ipa_hw {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/batterydata-ascent-3450mAh.dtsi b/arch/arm64/boot/dts/qcom/batterydata-ascent-3450mAh.dtsi
new file mode 100644
index 000000000000..3eed42aca5bf
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/batterydata-ascent-3450mAh.dtsi
@@ -0,0 +1,60 @@
+/*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,ascent-3450mah {
+	/* #Ascent_860_82209_0000_3450mAh_averaged_MasterSlave_Sept28th2015*/
+	qcom,max-voltage-uv = <4350000>;
+	qcom,nom-batt-capacity-mah = <3450>;
+	qcom,batt-id-kohm = <60>;
+	qcom,battery-beta = <3435>;
+	qcom,battery-type = "ascent_3450mah";
+	qcom,chg-rslow-comp-c1 = <6834679>;
+	qcom,chg-rslow-comp-c2 = <20647220>;
+	qcom,chg-rs-to-rslow = <915002>;
+	qcom,chg-rslow-comp-thr = <0xD5>;
+	qcom,checksum = <0xE50C>;
+	qcom,fg-profile-data = [
+		 C5 83 25 77
+		 AB 7B CA 74
+		 4C 83 7F 5B
+		 EB 80 ED 8C
+		 EA 81 61 9B
+		 A6 BE 2B D0
+		 55 0E D6 83
+		 09 77 25 7B
+		 03 74 49 83
+		 CC 70 0C 70
+		 0C 85 67 82
+		 E6 93 27 B5
+		 61 C0 58 10
+		 23 0D 50 59
+		 CE 6E 71 FD
+		 CD 15 CC 3F
+		 1D 36 00 00
+		 B9 47 29 3B
+		 1D 2E 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 D8 6A E7 69
+		 B3 7C 4E 7A
+		 7E 77 77 70
+		 40 77 0D 73
+		 22 76 96 6A
+		 71 65 20 B0
+		 2C 97 63 12
+		 64 A0 71 0C
+		 28 00 FF 36
+		 F0 11 30 03
+		 00 00 00 0C
+	];
+};
diff --git a/arch/arm64/boot/dts/qcom/batterydata-itech-3000mah-4200mv.dtsi b/arch/arm64/boot/dts/qcom/batterydata-itech-3000mah-4200mv.dtsi
new file mode 100644
index 000000000000..374c5abfca66
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/batterydata-itech-3000mah-4200mv.dtsi
@@ -0,0 +1,56 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,itech-3000mah-4200mv {
+	/* #Itech_B00761LF_3000mAh_averaged_MasterSlave_Feb27th2015*/
+	qcom,max-voltage-uv = <4200000>;
+	qcom,v-cutoff-uv = <3400000>;
+	qcom,chg-term-ua = <100000>;
+	qcom,batt-id-kohm = <150>;
+	qcom,battery-beta = <3500>;
+	qcom,battery-type = "itech_3000mah_4200mv";
+	qcom,checksum = <0x5194>;
+	qcom,fg-profile-data = [
+		 CD 83 23 77
+		 F1 7A 88 74
+		 78 83 DB 7C
+		 10 90 29 96
+		 29 82 9B 98
+		 DF B5 FF C0
+		 58 18 F5 83
+		 5F 7C C3 7B
+		 1A 75 57 83
+		 B3 61 0A 80
+		 0B 8C 85 82
+		 98 93 8A B5
+		 6C C1 5E 11
+		 D5 0B B3 58
+		 FB 6A 71 FD
+		 27 46 A8 37
+		 AF 41 00 00
+		 5F 46 E4 2B
+		 5E 34 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 AF 71 DA 70
+		 0B 76 8E 78
+		 A4 76 8B 69
+		 9F 6C 14 78
+		 77 75 60 63
+		 E2 75 4F C3
+		 0F 66 58 13
+		 54 A0 71 0C
+		 28 00 FF 36
+		 F0 11 30 03
+		 00 00 00 00
+	];
+};
diff --git a/arch/arm64/boot/dts/qcom/batterydata-itech-3000mah.dtsi b/arch/arm64/boot/dts/qcom/batterydata-itech-3000mah.dtsi
new file mode 100644
index 000000000000..1e2df9cff6b7
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/batterydata-itech-3000mah.dtsi
@@ -0,0 +1,59 @@
+/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,itech-3000mah {
+	/* #Itech_B00826LF_3000mAh_Feb24th_Averaged*/
+	qcom,max-voltage-uv = <4350000>;
+	qcom,v-cutoff-uv = <3400000>;
+	qcom,chg-term-ua = <100000>;
+	qcom,batt-id-kohm = <100>;
+	qcom,battery-type = "itech_3000mah";
+	qcom,chg-rslow-comp-c1 = <4365000>;
+	qcom,chg-rslow-comp-c2 = <8609000>;
+	qcom,chg-rslow-comp-thr = <0xBE>;
+	qcom,chg-rs-to-rslow = <761000>;
+	qcom,checksum = <0x0B7C>;
+	qcom,fg-profile-data = [
+		F0 83 6B 7D
+		66 81 EC 77
+		43 83 E3 5A
+		7C 81 33 8D
+		E1 81 EC 98
+		7B B5 F8 BB
+		5B 12 E2 83
+		4A 7C 63 80
+		CF 75 50 83
+		FD 5A 83 82
+		E6 8E 12 82
+		B6 9A 1A BE
+		BE CB 55 0E
+		96 0B E0 5A
+		CE 6E 71 FD
+		2A 31 7E 47
+		CF 40 00 00
+		DB 45 0F 32
+		AF 31 00 00
+		00 00 00 00
+		00 00 00 00
+		E3 6A 60 69
+		9E 6D 47 83
+		13 7C 23 70
+		0B 74 8F 80
+		DB 75 17 68
+		BA 75 BF B3
+		21 5B 69 B5
+		6C A0 71 0C
+		28 00 FF 36
+		F0 11 30 03
+		00 00 00 0E
+	];
+};
diff --git a/arch/arm64/boot/dts/qcom/batterydata-liquid-7650-sanyo.dtsi b/arch/arm64/boot/dts/qcom/batterydata-liquid-7650-sanyo.dtsi
new file mode 100644
index 000000000000..fc4e0907f750
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/batterydata-liquid-7650-sanyo.dtsi
@@ -0,0 +1,62 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,liquid8996_sanyo {
+	/* #Liquid8996_860_79873_ES00_7560mAh_averaged_MasterSlave_June4th2015*/
+	qcom,max-voltage-uv = <4350000>;
+	qcom,v-cutoff-uv = <3400000>;
+	qcom,chg-term-ua = <100000>;
+	qcom,nom-batt-capacity-mah = <7560>;
+	qcom,batt-id-kohm = <50>;
+	qcom,battery-beta = <3380>;
+	qcom,battery-type = "liquid8996_860_79873_es00_7560mah";
+	qcom,chg-rslow-comp-c1 = <5647648>;
+	qcom,chg-rslow-comp-c2 = <14300640>;
+	qcom,chg-rs-to-rslow = <785202>;
+	qcom,chg-rslow-comp-thr = <0xCD>;
+	qcom,checksum = <0xE5C0>;
+	qcom,gui-version = "PMI8994GUI - 2.1.6.5";
+	qcom,fg-profile-data = [
+		 EA 83 27 7D
+		 03 81 EE 76
+		 3E 83 93 59
+		 06 82 AD 8D
+		 F1 81 36 93
+		 6F AD 00 AB
+		 5C 14 2F 83
+		 EE 6B 8C 5D
+		 5B 69 14 83
+		 8B 7B CC 8C
+		 94 88 0F 82
+		 C4 99 8F BC
+		 00 C9 77 14
+		 8C 1D E8 58
+		 CE 6E E1 FA
+		 F5 2A 8B 4D
+		 CA 49 00 00
+		 21 46 A3 33
+		 55 3E 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 5A 6A D2 69
+		 7B 66 29 89
+		 60 7D B9 71
+		 55 74 33 83
+		 EC 7C A8 70
+		 4B 68 22 B8
+		 29 C8 60 B8
+		 5D A0 71 0C
+		 28 00 FF 36
+		 F0 11 30 03
+		 00 00 00 0C
+	];
+};
diff --git a/arch/arm64/boot/dts/qcom/batterydata-mtp-3000mah.dtsi b/arch/arm64/boot/dts/qcom/batterydata-mtp-3000mah.dtsi
new file mode 100644
index 000000000000..198fbea2ef0a
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/batterydata-mtp-3000mah.dtsi
@@ -0,0 +1,118 @@
+/* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,mtp-3000mah {
+	qcom,fcc-mah = <3000>;
+	qcom,default-rbatt-mohm = <113>;
+	qcom,max-voltage-uv = <4200000>;
+	qcom,rbatt-capacitive-mohm = <50>;
+	qcom,v-cutoff-uv = <3400000>;
+	qcom,chg-term-ua = <200000>;
+	qcom,batt-id-kohm = <300>;
+	qcom,battery-type = "mtp_3000mah";
+
+	qcom,fcc-temp-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-data = <3030 3033 3037 3035 3031>;
+	};
+
+	qcom,pc-temp-ocv-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+				<75 70 65 60 55>,
+				<50 45 40 35 30>,
+				<25 20 16 13 11>,
+				<10 9 8 7 6>,
+				<5 4 3 2 1>,
+				<0>;
+		qcom,lut-data = <4191 4188 4183 4179 4174>,
+				<4106 4125 4127 4125 4121>,
+				<4046 4082 4082 4080 4077>,
+				<3966 4038 4044 4040 4035>,
+				<3922 3983 3994 3998 3997>,
+				<3886 3949 3966 3966 3962>,
+				<3856 3908 3937 3935 3931>,
+				<3832 3875 3908 3907 3903>,
+				<3814 3847 3874 3878 3875>,
+				<3799 3826 3831 3832 3830>,
+				<3787 3807 3811 3811 3809>,
+				<3775 3793 3795 3795 3793>,
+				<3764 3782 3783 3783 3781>,
+				<3752 3775 3773 3772 3769>,
+				<3739 3768 3766 3762 3755>,
+				<3725 3756 3756 3747 3733>,
+				<3710 3732 3734 3725 3711>,
+				<3696 3707 3705 3697 3684>,
+				<3681 3695 3686 3678 3667>,
+				<3667 3690 3684 3676 3665>,
+				<3658 3688 3683 3675 3664>,
+				<3646 3685 3681 3674 3663>,
+				<3631 3682 3679 3673 3660>,
+				<3612 3677 3676 3669 3655>,
+				<3589 3667 3666 3660 3639>,
+				<3560 3643 3636 3630 3599>,
+				<3523 3600 3586 3581 3546>,
+				<3474 3537 3518 3516 3477>,
+				<3394 3446 3425 3427 3379>,
+				<3257 3306 3273 3283 3213>,
+				<3000 3000 3000 3000 3000>;
+	};
+
+	qcom,rbatt-sf-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+				<75 70 65 60 55>,
+				<50 45 40 35 30>,
+				<25 20 16 13 11>,
+				<10 9 8 7 6>,
+				<5 4 3 2 1>;
+		qcom,lut-data = <1025 208 100 85 80>,
+				<1025 208 100 85 80>,
+				<1032 225 103 87 81>,
+				<959 249 107 91 82>,
+				<954 249 109 92 84>,
+				<953 255 117 94 84>,
+				<957 230 123 98 87>,
+				<968 216 134 102 91>,
+				<983 212 138 112 95>,
+				<1002 213 103 89 82>,
+				<1030 215 100 86 81>,
+				<1066 219 101 89 83>,
+				<1115 224 104 92 85>,
+				<1182 234 106 94 86>,
+				<1263 246 108 92 84>,
+				<1357 257 107 87 81>,
+				<1464 261 102 85 80>,
+				<1564 256 101 84 80>,
+				<1637 268 100 84 80>,
+				<1580 276 102 87 81>,
+				<1617 285 104 87 82>,
+				<1670 298 107 91 82>,
+				<1725 315 108 92 83>,
+				<1785 338 112 92 83>,
+				<1850 361 111 91 82>,
+				<1921 378 108 89 84>,
+				<2000 394 112 92 87>,
+				<2119 430 121 99 94>,
+				<2795 497 144 114 104>,
+				<8769 1035 672 322 234>;
+	};
+
+	qcom,ibat-acc-lut {
+		qcom,lut-col-legend = <(-20) 0 25>;
+		qcom,lut-row-legend = <0 250 500 1000>;
+		qcom,lut-data = <3030 3033 3037>,
+				<1898 2943 2960>,
+				<1184 2855 2948>,
+				<209 2464 2921>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/batterydata-palladium.dtsi b/arch/arm64/boot/dts/qcom/batterydata-palladium.dtsi
new file mode 100644
index 000000000000..4c4435189256
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/batterydata-palladium.dtsi
@@ -0,0 +1,121 @@
+/* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,palladium-batterydata {
+	qcom,fcc-mah = <1500>;
+	qcom,default-rbatt-mohm = <210>;
+	qcom,rbatt-capacitive-mohm = <50>;
+	qcom,flat-ocv-threshold-uv = <3800000>;
+	qcom,max-voltage-uv = <4200000>;
+	qcom,v-cutoff-uv = <3400000>;
+	qcom,chg-term-ua = <100000>;
+	qcom,batt-id-kohm = <75>;
+	qcom,battery-type = "palladium_1500mah";
+
+	qcom,fcc-temp-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-data = <1467 1470 1473 1473 1470>;
+	};
+
+	qcom,pc-temp-ocv-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+				<75 70 65 60 55>,
+				<50 45 40 35 30>,
+				<25 20 16 13 11>,
+				<10 9 8 7 6>,
+				<5 4 3 2 1>,
+				<0>;
+		qcom,lut-data = <4175 4173 4167 4162 4157>,
+				<4097 4111 4112 4110 4107>,
+				<4039 4075 4072 4068 4064>,
+				<3963 4017 4025 4026 4025>,
+				<3920 3969 3984 3989 3988>,
+				<3887 3932 3957 3958 3955>,
+				<3856 3898 3929 3928 3925>,
+				<3830 3868 3900 3901 3898>,
+				<3808 3843 3858 3863 3862>,
+				<3793 3821 3827 3827 3827>,
+				<3779 3803 3807 3808 3807>,
+				<3768 3788 3792 3793 3792>,
+				<3757 3779 3780 3780 3779>,
+				<3746 3771 3772 3768 3768>,
+				<3734 3762 3765 3759 3749>,
+				<3722 3747 3753 3744 3730>,
+				<3707 3721 3731 3722 3709>,
+				<3693 3705 3704 3696 3683>,
+				<3678 3698 3687 3678 3667>,
+				<3664 3693 3683 3676 3665>,
+				<3656 3690 3682 3675 3664>,
+				<3646 3687 3681 3674 3662>,
+				<3634 3683 3680 3672 3661>,
+				<3618 3677 3676 3668 3656>,
+				<3599 3667 3667 3655 3639>,
+				<3573 3645 3638 3623 3603>,
+				<3541 3607 3591 3575 3554>,
+				<3496 3550 3528 3511 3490>,
+				<3428 3469 3445 3423 3400>,
+				<3312 3342 3308 3280 3250>,
+				<3000 3000 3000 3000 3000>;
+	};
+
+	qcom,rbatt-sf-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+				<75 70 65 60 55>,
+				<50 45 40 35 30>,
+				<25 20 16 13 11>,
+				<10 9 8 7 6>,
+				<5 4 3 2 1>,
+				<0>;
+		qcom,lut-data = <909 216 100 85 84>,
+				<859 238 106 88 86>,
+				<860 237 105 88 86>,
+				<808 239 107 90 88>,
+				<801 234 111 94 90>,
+				<801 230 118 97 92>,
+				<801 224 123 100 95>,
+				<807 221 128 106 99>,
+				<818 221 111 101 97>,
+				<841 225 101 88 87>,
+				<870 229 101 88 87>,
+				<906 235 103 91 90>,
+				<950 243 106 93 93>,
+				<998 253 110 93 96>,
+				<1051 263 113 94 90>,
+				<1116 272 113 91 88>,
+				<1200 275 111 91 88>,
+				<1312 298 108 90 87>,
+				<1430 329 104 88 87>,
+				<1484 351 107 91 89>,
+				<1446 345 110 93 90>,
+				<1398 344 112 94 90>,
+				<1466 358 115 96 91>,
+				<1490 357 117 96 90>,
+				<1589 365 117 94 89>,
+				<1828 379 111 91 88>,
+				<2151 399 111 93 91>,
+				<2621 436 117 98 95>,
+				<3404 496 130 106 100>,
+				<8212 616 150 1906 134>,
+				<135251 124940 59087 49820 29672>;
+	};
+
+	qcom,ibat-acc-lut {
+		qcom,lut-col-legend = <(-20) 0 25>;
+		qcom,lut-row-legend = <0 250 500 1000>;
+		qcom,lut-data = <1470 1470 1473>,
+				<601 1406 1430>,
+				<89 1247 1414>,
+				<8 764 1338>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/batterydata-qrd-4v2-1300mah.dtsi b/arch/arm64/boot/dts/qcom/batterydata-qrd-4v2-1300mah.dtsi
new file mode 100644
index 000000000000..23ca26c9e970
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/batterydata-qrd-4v2-1300mah.dtsi
@@ -0,0 +1,106 @@
+/* Copyright (c) 2013, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,qrd-4v2-1300mah-data {
+	qcom,fcc-mah = <1300>;
+	qcom,default-rbatt-mohm = <172>;
+	qcom,rbatt-capacitive-mohm = <0>;
+	qcom,flat-ocv-threshold-uv = <3800000>;
+	qcom,max-voltage-uv = <4200000>;
+	qcom,v-cutoff-uv = <3400000>;
+	qcom,chg-term-ua = <100000>;
+	qcom,batt-id-kohm = <100>;
+	qcom,battery-type = "qrd_4v2_1300mah";
+
+	qcom,rbatt-sf-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+				<75 70 65 60 55>,
+				<50 45 40 35 30>,
+				<25 20 15 10 9>,
+				<8 7 6 5 4>,
+				<3 2 1 0>;
+		qcom,lut-data = <604 192 100 79 71>,
+				<605 192 100 79 71>,
+				<641 205 103 81 72>,
+				<641 221 108 84 75>,
+				<622 238 115 87 77>,
+				<612 254 123 92 79>,
+				<605 252 137 96 83>,
+				<607 219 154 104 87>,
+				<613 202 135 109 89>,
+				<626 200 106 90 77>,
+				<656 201 101 82 75>,
+				<684 204 100 84 77>,
+				<710 211 100 85 79>,
+				<747 224 106 89 82>,
+				<806 241 116 90 80>,
+				<905 260 119 87 77>,
+				<1046 291 113 87 77>,
+				<1309 329 116 90 79>,
+				<1476 300 126 97 83>,
+				<1598 311 127 98 84>,
+				<1771 323 130 99 85>,
+				<1984 342 136 101 86>,
+				<2438 368 140 101 86>,
+				<3381 388 137 100 84>,
+				<4913 414 141 99 86>,
+				<6979 468 155 104 90>,
+				<9968 565 192 113 98>,
+				<16163 833 350 140 120>,
+				<36511 6483 4872 472 1095>;
+	};
+
+	qcom,fcc-temp-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-data = <1343 1353 1408 1345 1342>;
+	};
+
+	qcom,pc-temp-ocv-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+				<75 70 65 60 55>,
+				<50 45 40 35 30>,
+				<25 20 15 10 9>,
+				<8 7 6 5 4>,
+				<3 2 1 0>;
+		qcom,lut-data = <4177 4174 4199 4167 4162>,
+				<4107 4112 4141 4109 4106>,
+				<4058 4064 4091 4061 4059>,
+				<3996 4015 4044 4017 4015>,
+				<3947 3975 4001 3978 3976>,
+				<3909 3939 3962 3943 3940>,
+				<3874 3901 3926 3911 3907>,
+				<3845 3858 3892 3882 3878>,
+				<3821 3826 3851 3849 3846>,
+				<3801 3804 3815 3810 3808>,
+				<3788 3789 3793 3789 3787>,
+				<3778 3780 3778 3776 3773>,
+				<3769 3776 3770 3767 3764>,
+				<3757 3772 3766 3762 3757>,
+				<3740 3765 3762 3754 3744>,
+				<3714 3747 3750 3739 3724>,
+				<3668 3706 3717 3710 3697>,
+				<3602 3644 3662 3662 3654>,
+				<3533 3571 3601 3607 3605>,
+				<3518 3557 3583 3592 3590>,
+				<3500 3543 3565 3576 3574>,
+				<3478 3528 3546 3559 3557>,
+				<3451 3506 3521 3538 3534>,
+				<3417 3473 3481 3505 3496>,
+				<3377 3423 3424 3454 3444>,
+				<3327 3361 3351 3391 3380>,
+				<3261 3279 3258 3310 3297>,
+				<3165 3165 3138 3198 3182>,
+				<3000 3000 3000 3000 3000>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/batterydata-qrd-4v2-1800mah.dtsi b/arch/arm64/boot/dts/qcom/batterydata-qrd-4v2-1800mah.dtsi
new file mode 100644
index 000000000000..4cd4b2cb7400
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/batterydata-qrd-4v2-1800mah.dtsi
@@ -0,0 +1,106 @@
+/* Copyright (c) 2013, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,qrd-4v2-1800mah-data {
+	qcom,fcc-mah = <1800>;
+	qcom,default-rbatt-mohm = <146>;
+	qcom,rbatt-capacitive-mohm = <0>;
+	qcom,flat-ocv-threshold-uv = <3800000>;
+	qcom,max-voltage-uv = <4200000>;
+	qcom,v-cutoff-uv = <3400000>;
+	qcom,chg-term-ua = <100000>;
+	qcom,batt-id-kohm = <47>;
+	qcom,battery-type = "qrd_4v2_1800mah";
+
+	qcom,rbatt-sf-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+				<75 70 65 60 55>,
+				<50 45 40 35 30>,
+				<25 20 15 10 9>,
+				<8 7 6 5 4>,
+				<3 2 1 0>;
+		qcom,lut-data = <904 234 100 85 80>,
+				<905 234 100 85 80>,
+				<934 244 102 86 81>,
+				<928 254 105 87 82>,
+				<933 268 109 89 84>,
+				<924 280 114 91 85>,
+				<913 283 123 96 88>,
+				<916 267 135 103 91>,
+				<930 252 137 110 95>,
+				<954 247 117 106 95>,
+				<990 247 103 88 85>,
+				<1036 253 104 86 84>,
+				<1101 264 108 89 85>,
+				<1211 286 112 93 88>,
+				<1366 340 120 95 87>,
+				<1601 394 128 95 87>,
+				<2178 402 128 97 89>,
+				<5419 423 126 97 89>,
+				<10789 528 128 97 91>,
+				<13463 589 132 100 91>,
+				<17695 678 137 102 92>,
+				<23046 814 145 104 93>,
+				<30725 1019 153 106 93>,
+				<41382 1359 156 106 93>,
+				<56311 1959 165 108 95>,
+				<77209 3523 189 117 99>,
+				<104609 6039 235 127 105>,
+				<138858 9711 352 141 112>,
+				<165825 15373 1069 246 226>;
+	};
+
+	qcom,fcc-temp-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-data = <1859 1868 1873 1861 1859>;
+	};
+
+	qcom,pc-temp-ocv-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+				<75 70 65 60 55>,
+				<50 45 40 35 30>,
+				<25 20 15 10 9>,
+				<8 7 6 5 4>,
+				<3 2 1 0>;
+		qcom,lut-data = <4178 4176 4174 4169 4163>,
+				<4090 4100 4105 4101 4099>,
+				<4029 4049 4053 4050 4048>,
+				<3973 3998 4006 4004 4002>,
+				<3932 3959 3965 3962 3960>,
+				<3891 3920 3928 3925 3922>,
+				<3855 3882 3894 3891 3889>,
+				<3825 3844 3862 3862 3859>,
+				<3803 3813 3829 3834 3831>,
+				<3788 3792 3797 3802 3800>,
+				<3777 3780 3778 3776 3773>,
+				<3764 3775 3771 3767 3763>,
+				<3749 3769 3766 3763 3757>,
+				<3725 3756 3758 3755 3750>,
+				<3687 3727 3736 3735 3729>,
+				<3631 3675 3698 3698 3691>,
+				<3571 3607 3637 3642 3637>,
+				<3514 3548 3568 3572 3570>,
+				<3458 3506 3519 3522 3522>,
+				<3444 3498 3511 3516 3515>,
+				<3430 3489 3503 3509 3508>,
+				<3413 3477 3493 3500 3500>,
+				<3395 3461 3478 3488 3486>,
+				<3373 3433 3446 3463 3456>,
+				<3346 3394 3397 3418 3410>,
+				<3307 3341 3334 3361 3352>,
+				<3251 3270 3254 3287 3277>,
+				<3160 3167 3152 3183 3172>,
+				<3000 3000 3000 3000 3000>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/batterydata-qrd-4v2-2000mah.dtsi b/arch/arm64/boot/dts/qcom/batterydata-qrd-4v2-2000mah.dtsi
new file mode 100644
index 000000000000..0919060ca610
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/batterydata-qrd-4v2-2000mah.dtsi
@@ -0,0 +1,106 @@
+/* Copyright (c) 2013, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,qrd-4v2-2000mah-data {
+	qcom,fcc-mah = <2000>;
+	qcom,default-rbatt-mohm = <138>;
+	qcom,rbatt-capacitive-mohm = <0>;
+	qcom,flat-ocv-threshold-uv = <3800000>;
+	qcom,max-voltage-uv = <4200000>;
+	qcom,v-cutoff-uv = <3400000>;
+	qcom,chg-term-ua = <100000>;
+	qcom,batt-id-kohm = <130 115>;
+	qcom,battery-type = "qrd_4v2_2000mah";
+
+	qcom,rbatt-sf-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+				<75 70 65 60 55>,
+				<50 45 40 35 30>,
+				<25 20 15 10 9>,
+				<8 7 6 5 4>,
+				<3 2 1 0>;
+		qcom,lut-data = <1191 250 100 78 69>,
+				<1192 250 100 78 69>,
+				<1242 263 102 80 70>,
+				<1192 277 105 81 71>,
+				<1202 294 108 83 72>,
+				<1205 308 113 86 73>,
+				<1234 313 118 90 76>,
+				<1255 294 131 96 80>,
+				<1284 276 139 103 84>,
+				<1321 271 115 89 74>,
+				<1363 273 104 81 72>,
+				<1400 283 103 79 71>,
+				<1404 295 105 81 71>,
+				<1428 313 108 84 73>,
+				<1489 341 112 87 74>,
+				<1615 374 115 84 73>,
+				<1813 404 117 85 73>,
+				<2121 387 127 89 76>,
+				<2310 366 115 88 77>,
+				<2543 386 116 89 77>,
+				<2879 415 118 92 78>,
+				<3633 457 122 93 78>,
+				<5901 507 128 94 79>,
+				<9939 561 131 93 79>,
+				<16631 634 129 94 78>,
+				<26968 794 134 97 81>,
+				<42610 1203 145 102 85>,
+				<64024 2628 174 115 94>,
+				<115224 17430 577 620 4155>;
+	};
+
+	qcom,fcc-temp-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-data = <2024 2033 2035 2031 2027>;
+	};
+
+	qcom,pc-temp-ocv-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+				<75 70 65 60 55>,
+				<50 45 40 35 30>,
+				<25 20 15 10 9>,
+				<8 7 6 5 4>,
+				<3 2 1 0>;
+		qcom,lut-data = <4179 4177 4173 4170 4164>,
+				<4097 4107 4108 4106 4104>,
+				<4040 4060 4059 4057 4054>,
+				<3974 4007 4012 4012 4009>,
+				<3929 3968 3972 3972 3969>,
+				<3889 3933 3937 3935 3933>,
+				<3852 3896 3905 3904 3900>,
+				<3822 3859 3876 3875 3872>,
+				<3797 3827 3846 3847 3844>,
+				<3777 3803 3809 3809 3806>,
+				<3758 3787 3788 3786 3784>,
+				<3740 3779 3777 3774 3771>,
+				<3717 3774 3771 3768 3763>,
+				<3685 3767 3767 3764 3758>,
+				<3649 3757 3761 3756 3749>,
+				<3613 3734 3747 3738 3724>,
+				<3578 3689 3711 3706 3694>,
+				<3538 3615 3649 3648 3643>,
+				<3483 3543 3564 3568 3567>,
+				<3470 3533 3553 3556 3556>,
+				<3453 3522 3542 3545 3545>,
+				<3434 3509 3531 3534 3533>,
+				<3414 3492 3519 3521 3519>,
+				<3388 3467 3498 3499 3492>,
+				<3358 3428 3457 3459 3447>,
+				<3321 3374 3397 3400 3387>,
+				<3268 3300 3318 3323 3307>,
+				<3182 3188 3207 3213 3191>,
+				<3000 3000 3000 3000 3000>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/batterydata-qrd-4v2-2200mah.dtsi b/arch/arm64/boot/dts/qcom/batterydata-qrd-4v2-2200mah.dtsi
new file mode 100644
index 000000000000..92ea7d8306cd
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/batterydata-qrd-4v2-2200mah.dtsi
@@ -0,0 +1,106 @@
+/* Copyright (c) 2013, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,qrd-4v2-2200mah-data {
+	qcom,default-rbatt-mohm = <163>;
+	qcom,max-voltage-uv = <4200>;
+	qcom,fcc-mah = <2200>;
+	qcom,rbatt-capacitive-mohm = <0>;
+	qcom,v-cutoff-uv = <3400000>;
+	qcom,chg-term-ua = <100000>;
+	qcom,batt-id-kohm = <10>;
+	qcom,flat-ocv-threshold-uv = <3800000>;
+	qcom,battery-type = "qrd_4v2_2200mah";
+
+	qcom,fcc-temp-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-data = <2167 2179 2234 2178 2164>;
+	};
+
+	qcom,pc-temp-ocv-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+				<75 70 65 60 55>,
+				<50 45 40 35 30>,
+				<25 20 15 10 9>,
+				<8 7 6 5 4>,
+				<3 2 1 0>;
+		qcom,lut-data = <4188 4184 4199 4176 4170>,
+				<4109 4124 4145 4124 4118>,
+				<4051 4082 4097 4077 4072>,
+				<3963 4024 4055 4034 4029>,
+				<3920 3971 4002 3993 3989>,
+				<3880 3932 3963 3957 3952>,
+				<3846 3892 3920 3913 3910>,
+				<3822 3859 3881 3873 3871>,
+				<3805 3834 3851 3845 3844>,
+				<3790 3813 3828 3823 3822>,
+				<3777 3796 3808 3805 3803>,
+				<3764 3784 3792 3790 3788>,
+				<3750 3775 3778 3777 3774>,
+				<3736 3766 3766 3761 3751>,
+				<3721 3752 3755 3745 3732>,
+				<3704 3733 3737 3729 3716>,
+				<3684 3707 3713 3707 3694>,
+				<3655 3686 3688 3682 3672>,
+				<3598 3661 3677 3671 3659>,
+				<3585 3655 3673 3669 3656>,
+				<3571 3644 3664 3663 3650>,
+				<3551 3626 3643 3648 3631>,
+				<3523 3598 3609 3618 3600>,
+				<3489 3561 3565 3578 3561>,
+				<3445 3514 3510 3529 3512>,
+				<3389 3453 3440 3468 3450>,
+				<3313 3372 3345 3386 3366>,
+				<3207 3252 3209 3262 3239>,
+				<3000 3000 3000 3000 3000>;
+	};
+
+	qcom,rbatt-sf-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+				<75 70 65 60 55>,
+				<50 45 40 35 30>,
+				<25 20 15 10 9>,
+				<8 7 6 5 4>,
+				<3 2 1 0>;
+		qcom,lut-data = <1371 224 100 79 74>,
+				<1358 242 100 80 74>,
+				<1358 242 103 80 74>,
+				<1195 257 107 82 75>,
+				<1171 256 112 84 77>,
+				<1149 250 119 89 79>,
+				<1144 232 114 90 79>,
+				<1150 225 101 83 76>,
+				<1175 227 98 81 76>,
+				<1210 232 98 82 76>,
+				<1260 236 98 82 77>,
+				<1329 242 100 84 77>,
+				<1421 251 100 86 79>,
+				<1536 263 101 81 76>,
+				<1671 280 100 80 74>,
+				<1830 304 100 81 75>,
+				<2036 338 101 82 76>,
+				<2326 443 103 82 76>,
+				<2788 708 112 88 79>,
+				<2890 747 115 90 80>,
+				<2755 676 117 89 79>,
+				<2750 716 118 87 78>,
+				<2916 765 119 87 79>,
+				<3336 833 123 89 80>,
+				<4214 920 133 92 81>,
+				<5615 1031 151 96 83>,
+				<7923 1188 192 104 89>,
+				<13252 1886 585 137 122>,
+				<43764 20050 47711 3680 16847>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/batterydata-qrd-4v35-2000mah.dtsi b/arch/arm64/boot/dts/qcom/batterydata-qrd-4v35-2000mah.dtsi
new file mode 100644
index 000000000000..53739fe58336
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/batterydata-qrd-4v35-2000mah.dtsi
@@ -0,0 +1,110 @@
+/* Copyright (c) 2013, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,qrd-4v35-2000mAh-data {
+	qcom,fcc-mah = <2000>;
+	qcom,default-rbatt-mohm = <172>;
+	qcom,rbatt-capacitive-mohm = <0>;
+	qcom,flat-ocv-threshold-uv = <3800000>;
+	qcom,max-voltage-uv = <4350000>;
+	qcom,v-cutoff-uv = <3400000>;
+	qcom,chg-term-ua = <100000>;
+	qcom,batt-id-kohm = <200>;
+	qcom,battery-type = "qrd_4v35_2000mah";
+
+	qcom,rbatt-sf-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+				<75 70 65 60 55>,
+				<50 45 40 35 30>,
+				<25 20 16 13 11>,
+				<10 9 8 7 6>,
+				<5 4 3 2 1>;
+		qcom,lut-data = <2422 324 100 79 72>,
+				<2417 325 100 79 71>,
+				<2344 327 100 80 72>,
+				<2416 336 102 81 73>,
+				<2072 354 107 82 73>,
+				<1961 372 113 84 75>,
+				<1929 341 118 87 77>,
+				<1929 321 130 93 80>,
+				<2041 306 140 104 85>,
+				<2202 292 119 96 83>,
+				<2374 290 98 80 73>,
+				<2550 292 98 79 72>,
+				<2727 294 99 81 73>,
+				<2904 303 100 82 75>,
+				<3091 323 100 81 73>,
+				<3278 348 100 80 73>,
+				<3470 376 99 79 72>,
+				<3627 386 100 79 72>,
+				<3672 398 100 80 71>,
+				<3812 424 100 80 73>,
+				<3895 443 101 80 73>,
+				<3985 465 102 82 75>,
+				<4094 497 105 83 76>,
+				<4211 533 109 85 79>,
+				<4335 579 113 87 80>,
+				<4505 612 113 85 76>,
+				<4693 643 113 86 77>,
+				<4930 712 120 90 81>,
+				<5283 835 145 111 107>,
+				<10293 15765 5566 6904 2547>;
+	};
+
+	qcom,fcc-temp-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-data = <2096 2124 2121 2118 2103>;
+	};
+
+	qcom,pc-temp-ocv-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+				<75 70 65 60 55>,
+				<50 45 40 35 30>,
+				<25 20 16 13 11>,
+				<10 9 8 7 6>,
+				<5 4 3 2 1>,
+				<0>;
+		qcom,lut-data = <4340 4340 4335 4330 4323>,
+				<4217 4260 4265 4263 4258>,
+				<4135 4203 4207 4205 4201>,
+				<4084 4150 4152 4150 4146>,
+				<3992 4101 4101 4097 4093>,
+				<3934 4049 4051 4046 4044>,
+				<3889 3974 3995 3998 3999>,
+				<3852 3926 3958 3961 3959>,
+				<3832 3892 3921 3923 3921>,
+				<3819 3859 3874 3877 3877>,
+				<3807 3831 3838 3838 3838>,
+				<3796 3809 3815 3815 3814>,
+				<3784 3792 3797 3797 3796>,
+				<3770 3780 3783 3782 3781>,
+				<3754 3770 3772 3769 3764>,
+				<3737 3758 3763 3754 3742>,
+				<3717 3737 3744 3735 3720>,
+				<3700 3713 3718 3710 3696>,
+				<3687 3701 3692 3683 3671>,
+				<3674 3695 3689 3681 3669>,
+				<3667 3692 3688 3680 3669>,
+				<3659 3690 3687 3680 3668>,
+				<3649 3687 3685 3678 3667>,
+				<3636 3683 3683 3676 3664>,
+				<3618 3674 3679 3671 3658>,
+				<3596 3652 3663 3652 3632>,
+				<3566 3611 3620 3606 3584>,
+				<3522 3547 3555 3540 3517>,
+				<3460 3449 3461 3446 3424>,
+				<3356 3282 3312 3299 3273>,
+				<3000 3000 3000 3000 3000>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/batterydata-qrd-4v35-2500mah.dtsi b/arch/arm64/boot/dts/qcom/batterydata-qrd-4v35-2500mah.dtsi
new file mode 100644
index 000000000000..1f55a8851b37
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/batterydata-qrd-4v35-2500mah.dtsi
@@ -0,0 +1,106 @@
+/* Copyright (c) 2013, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,qrd-4v35-2500mAh-data {
+	qcom,fcc-mah = <2500>;
+	qcom,default-rbatt-mohm = <198>;
+	qcom,rbatt-capacitive-mohm = <0>;
+	qcom,flat-ocv-threshold-uv = <3800000>;
+	qcom,max-voltage-uv = <4350000>;
+	qcom,v-cutoff-uv = <3400000>;
+	qcom,chg-term-ua = <100000>;
+	qcom,batt-id-kohm = <470>;
+	qcom,battery-type = "qrd_4v35_2500mah";
+
+	qcom,rbatt-sf-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+				<75 70 65 60 55>,
+				<50 45 40 35 30>,
+				<25 20 15 10 9>,
+				<8 7 6 5 4>,
+				<3 2 1 0>;
+		qcom,lut-data = <1809 428 100 64 57>,
+				<1805 428 100 64 57>,
+				<1674 443 103 65 57>,
+				<1611 447 108 66 58>,
+				<1407 474 113 69 59>,
+				<1379 462 122 74 61>,
+				<1335 381 124 74 63>,
+				<1346 388 135 79 66>,
+				<1410 382 123 82 68>,
+				<1479 372 101 68 60>,
+				<1542 363 100 66 59>,
+				<1605 368 101 66 60>,
+				<1665 406 102 68 61>,
+				<1722 460 103 70 61>,
+				<1779 525 103 68 61>,
+				<1840 593 104 66 59>,
+				<1914 669 104 65 58>,
+				<2016 779 104 65 59>,
+				<1955 827 107 67 60>,
+				<2006 855 112 69 61>,
+				<2057 882 116 71 63>,
+				<2103 925 123 72 66>,
+				<2162 955 128 73 62>,
+				<2218 991 123 69 61>,
+				<2286 1035 122 69 62>,
+				<2382 1083 130 72 65>,
+				<2780 1158 153 83 81>,
+				<5073 1464 724 393 147>,
+				<46882 49515 42109 55595 11697>;
+	};
+
+	qcom,fcc-temp-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-data = <2578 2580 2590 2584 2573>;
+	};
+
+	qcom,pc-temp-ocv-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+				<75 70 65 60 55>,
+				<50 45 40 35 30>,
+				<25 20 15 10 9>,
+				<8 7 6 5 4>,
+				<3 2 1 0>;
+		qcom,lut-data = <4326 4323 4321 4319 4311>,
+				<4192 4235 4253 4254 4249>,
+				<4110 4175 4198 4199 4194>,
+				<4058 4121 4146 4146 4141>,
+				<3952 4076 4096 4096 4091>,
+				<3906 4017 4052 4048 4043>,
+				<3859 3942 3990 3997 3999>,
+				<3828 3905 3954 3962 3959>,
+				<3813 3869 3911 3918 3916>,
+				<3799 3836 3866 3870 3868>,
+				<3786 3808 3837 3840 3840>,
+				<3772 3788 3815 3818 3817>,
+				<3758 3777 3796 3799 3798>,
+				<3743 3765 3780 3783 3781>,
+				<3726 3751 3767 3767 3761>,
+				<3707 3733 3753 3749 3736>,
+				<3684 3713 3731 3727 3713>,
+				<3654 3697 3699 3697 3685>,
+				<3616 3678 3683 3680 3669>,
+				<3605 3673 3682 3679 3667>,
+				<3594 3667 3680 3678 3666>,
+				<3578 3660 3676 3675 3662>,
+				<3561 3647 3666 3667 3647>,
+				<3541 3628 3637 3640 3610>,
+				<3514 3598 3586 3590 3556>,
+				<3478 3550 3515 3523 3485>,
+				<3425 3476 3414 3429 3387>,
+				<3330 3350 3272 3276 3222>,
+				<3000 3000 3000 3000 3000>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/batterydata-qrd-sku1-4v4-2800mah.dtsi b/arch/arm64/boot/dts/qcom/batterydata-qrd-sku1-4v4-2800mah.dtsi
new file mode 100644
index 000000000000..0b5072209c8f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/batterydata-qrd-sku1-4v4-2800mah.dtsi
@@ -0,0 +1,62 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,qrd_msm8937_sku1_2920mah {
+	/* #QRD8937_2800mAh_China_data_averaged_MasterSlave_Oct30th2015*/
+	qcom,max-voltage-uv = <4400000>;
+	qcom,nom-batt-capacity-mah = <2800>;
+	qcom,batt-id-kohm = <90>;
+	qcom,battery-beta = <3380>;
+	qcom,battery-type = "qrd_msm8937_sku1_2800mah";
+	qcom,fastchg-current-ma = <3000>;
+	qcom,fg-cc-cv-threshold-mv = <4390>;
+	qcom,chg-rslow-comp-c1 = <6733839>;
+	qcom,chg-rslow-comp-c2 = <23336040>;
+	qcom,chg-rs-to-rslow = <1049243>;
+	qcom,chg-rslow-comp-thr = <0xDB>;
+	qcom,checksum = <0x7E2A>;
+	qcom,gui-version = "PMI8950GUI - 2.0.0.14";
+	qcom,fg-profile-data = [
+		C6 83 8A 77
+		3E 80 84 75
+		72 83 A1 7C
+		A0 90 FC 97
+		3F 82 09 99
+		92 B7 97 C3
+		4C 14 EB 83
+		A7 7C CE 80
+		79 76 60 83
+		3B 64 34 88
+		19 94 49 82
+		07 9A 7F BD
+		BF CA 53 0D
+		32 0B 68 59
+		14 70 71 FD
+		8C 28 9C 45
+		3F 21 00 00
+		B6 47 FE 30
+		0B 40 00 00
+		00 00 00 00
+		00 00 00 00
+		3A 70 78 6B
+		F7 77 7F 88
+		32 7C F2 70
+		64 75 0B 79
+		2B 77 F3 6B
+		CA 70 7D B1
+		21 57 6B 6B
+		6D A0 71 0C
+		28 00 FF 36
+		F0 11 30 03
+		00 00 00 0C
+	];
+};
diff --git a/arch/arm64/boot/dts/qcom/batterydata-qrd-skua-4v35-2000mah.dtsi b/arch/arm64/boot/dts/qcom/batterydata-qrd-skua-4v35-2000mah.dtsi
new file mode 100644
index 000000000000..6013efec43fd
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/batterydata-qrd-skua-4v35-2000mah.dtsi
@@ -0,0 +1,122 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,qrd-skua-4v35-2000mAh-data {
+	qcom,battery-type = "qrd_skua_4v35_2000mAh";
+	qcom,batt-id-kohm = <200>;
+	qcom,chg-term-ua = <100000>;
+	qcom,default-rbatt-mohm = <146>;
+	qcom,fcc-mah = <2000>;
+	qcom,max-voltage-uv = <4350000>;
+	qcom,rbatt-capacitive-mohm = <50>;
+	qcom,v-cutoff-uv = <3400000>;
+	qcom,flat-ocv-threshold-uv = <3800000>;
+
+	qcom,fcc-temp-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-data = <2064 2067 2067 2066 2063>;
+	};
+
+	qcom,ibat-acc-lut {
+		qcom,lut-col-legend = <(-20) 0 25>;
+		qcom,lut-row-legend = <0 250 500 1000>;
+		qcom,lut-data = <2022 2046 2046>,
+				<1151 1962 2024>,
+				<680 1864 2008>,
+				<51 1548 1970>;
+	};
+
+	qcom,rbatt-sf-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+					<75 70 65 60 55>,
+					<50 45 40 35 30>,
+					<25 20 16 13 11>,
+					<10 9 8 7 6>,
+					<5 4 3 2 1>,
+					<0>;
+		qcom,lut-data = <1355 273 100 81 74>,
+				<1352 273 100 81 74>,
+				<1268 280 102 83 75>,
+				<1197 286 106 85 76>,
+				<1143 285 110 87 78>,
+				<1109 281 116 90 79>,
+				<1090 272 124 94 82>,
+				<1080 269 134 100 85>,
+				<1077 267 133 108 91>,
+				<1079 266 111 100 90>,
+				<1090 266 101 83 76>,
+				<1116 267 101 84 77>,
+				<1156 268 103 86 79>,
+				<1205 270 103 88 83>,
+				<1266 274 106 88 82>,
+				<1337 276 108 87 78>,
+				<1431 276 107 85 79>,
+				<1560 284 104 84 78>,
+				<1680 293 99 81 75>,
+				<2078 306 99 81 77>,
+				<2438 318 100 83 78>,
+				<2875 333 102 85 80>,
+				<3411 354 104 87 81>,
+				<4092 392 108 89 84>,
+				<5118 448 116 92 86>,
+				<6939 551 121 95 85>,
+				<10433 791 120 90 81>,
+				<17054 1280 121 93 84>,
+				<29375 2077 133 101 92>,
+				<52518 3457 173 135 133>,
+				<230352 176376 150360 117059 92159>;
+	};
+
+	qcom,pc-temp-ocv-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+					<75 70 65 60 55>,
+					<50 45 40 35 30>,
+					<25 20 16 13 11>,
+					<10 9 8 7 6>,
+					<5 4 3 2 1>,
+					<0>;
+		qcom,lut-data = <4328 4328 4322 4318 4310>,
+				<4234 4252 4252 4250 4245>,
+				<4164 4191 4193 4191 4186>,
+				<4098 4132 4137 4135 4131>,
+				<4036 4074 4084 4082 4078>,
+				<3980 4019 4035 4033 4029>,
+				<3932 3967 3990 3989 3985>,
+				<3891 3923 3950 3950 3945>,
+				<3856 3886 3909 3912 3909>,
+				<3825 3855 3862 3868 3867>,
+				<3800 3828 3829 3829 3826>,
+				<3782 3805 3807 3806 3804>,
+				<3768 3786 3789 3789 3786>,
+				<3753 3770 3775 3774 3772>,
+				<3737 3757 3764 3761 3755>,
+				<3718 3740 3753 3746 3734>,
+				<3695 3719 3733 3725 3712>,
+				<3671 3702 3705 3698 3684>,
+				<3650 3691 3677 3668 3656>,
+				<3630 3681 3670 3662 3651>,
+				<3619 3676 3668 3660 3649>,
+				<3605 3670 3665 3658 3647>,
+				<3590 3664 3662 3655 3644>,
+				<3573 3655 3658 3651 3641>,
+				<3553 3643 3652 3647 3635>,
+				<3529 3622 3639 3632 3618>,
+				<3498 3590 3605 3595 3576>,
+				<3460 3543 3547 3535 3519>,
+				<3401 3476 3467 3455 3443>,
+				<3306 3368 3347 3336 3313>,
+				<3000 3000 3000 3000 3000>;
+	};
+};
+
diff --git a/arch/arm64/boot/dts/qcom/batterydata-qrd-skuh-4v35-2000mah.dtsi b/arch/arm64/boot/dts/qcom/batterydata-qrd-skuh-4v35-2000mah.dtsi
new file mode 100644
index 000000000000..9be634b713bd
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/batterydata-qrd-skuh-4v35-2000mah.dtsi
@@ -0,0 +1,115 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,qrd-skuh-4v35-2000mah-data {
+	qcom,default-rbatt-mohm = <188>;
+	qcom,max-voltage-uv = <4350000>;
+	qcom,fcc-mah = <2000>;
+	qcom,rbatt-capacitive-mohm = <50>;
+	qcom,v-cutoff-uv = <3400000>;
+	qcom,chg-term-ua = <100000>;
+	qcom,batt-id-kohm = <110>;
+	qcom,flat-ocv-threshold-uv = <3800000>;
+	qcom,battery-type = "qrd_skuh_4v35_2000mah";
+
+	qcom,fcc-temp-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-data = <1985 2000 2008 1983 1968>;
+	};
+
+	qcom,pc-temp-ocv-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+				<75 70 65 60 55>,
+				<50 45 40 35 30>,
+				<25 20 15 10 9>,
+				<8 7 6 5 4>,
+				<3 2 1 0>;
+		qcom,lut-data = <4328 4324 4319 4314 4307>,
+				<4226 4246 4249 4249 4245>,
+				<4156 4187 4193 4194 4191>,
+				<4095 4133 4140 4143 4140>,
+				<4037 4080 4089 4093 4091>,
+				<3985 4028 4041 4046 4044>,
+				<3936 3976 3997 4002 4002>,
+				<3895 3932 3952 3960 3960>,
+				<3856 3893 3906 3913 3914>,
+				<3822 3861 3869 3875 3876>,
+				<3793 3831 3841 3847 3848>,
+				<3768 3808 3819 3824 3824>,
+				<3747 3787 3799 3805 3805>,
+				<3727 3772 3783 3788 3787>,
+				<3709 3759 3766 3765 3757>,
+				<3693 3744 3746 3740 3730>,
+				<3674 3724 3727 3720 3708>,
+				<3651 3691 3700 3692 3680>,
+				<3610 3659 3673 3672 3660>,
+				<3601 3654 3670 3668 3657>,
+				<3589 3648 3664 3663 3651>,
+				<3572 3638 3654 3650 3635>,
+				<3549 3619 3631 3623 3605>,
+				<3520 3585 3592 3582 3564>,
+				<3482 3537 3540 3531 3512>,
+				<3429 3473 3473 3464 3445>,
+				<3355 3388 3381 3373 3353>,
+				<3239 3259 3231 3235 3216>,
+				<3000 3000 3000 3000 3000>;
+	};
+
+	qcom,rbatt-sf-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+				<75 70 65 60 55>,
+				<50 45 40 35 30>,
+				<25 20 15 10 9>,
+				<8 7 6 5 4>,
+				<3 2 1 0>;
+		qcom,lut-data = <1002 268 100 87 81>,
+				<999 271 100 88 82>,
+				<999 271 102 88 82>,
+				<988 274 106 91 84>,
+				<975 275 110 94 85>,
+				<967 271 115 97 86>,
+				<969 261 121 101 89>,
+				<974 256 120 105 91>,
+				<978 254 107 96 86>,
+				<988 257 101 89 83>,
+				<1017 260 102 89 82>,
+				<1046 267 105 92 83>,
+				<1085 275 108 94 85>,
+				<1128 286 112 97 87>,
+				<1187 298 112 94 84>,
+				<1268 310 108 90 83>,
+				<1359 322 109 92 83>,
+				<1505 328 110 91 82>,
+				<1785 371 111 94 84>,
+				<1651 331 112 94 84>,
+				<1305 342 113 93 84>,
+				<1366 351 114 93 83>,
+				<1450 364 113 92 82>,
+				<1582 373 112 92 84>,
+				<1900 398 113 94 85>,
+				<2611 443 117 95 86>,
+				<4080 519 123 102 93>,
+				<8074 696 153 171 149>,
+				<30656 4547 9542 7331 6138>;
+	};
+
+	qcom,ibat-acc-lut {
+		qcom,lut-col-legend = <(-20) 0 25>;
+		qcom,lut-row-legend = <0 250 500 1000>;
+		qcom,lut-data = <1937 1937 1933>,
+				<600 1866 1920>,
+				<107 1602 1898>,
+				<11 878 1841>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/batterydata-qrd-skuic-4v35-1850mah.dtsi b/arch/arm64/boot/dts/qcom/batterydata-qrd-skuic-4v35-1850mah.dtsi
new file mode 100644
index 000000000000..a71fd40255d6
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/batterydata-qrd-skuic-4v35-1850mah.dtsi
@@ -0,0 +1,121 @@
+/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,qrd-skuic-4v35-1850mah-data {
+	qcom,battery-type = "qrd-skuic-4v35-1850mah";
+	qcom,batt-id-kohm = <105>;
+	qcom,chg-term-ua = <100000>;
+	qcom,default-rbatt-mohm = <191>;
+	qcom,fcc-mah = <1850>;
+	qcom,max-voltage-uv = <4350000>;
+	qcom,rbatt-capacitive-mohm = <50>;
+	qcom,v-cutoff-uv = <3400000>;
+	qcom,flat-ocv-threshold-uv = <3800000>;
+
+	qcom,fcc-temp-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-data = <1832 1824 1823 1820 1809>;
+	};
+
+	qcom,ibat-acc-lut {
+		qcom,lut-col-legend = <(-20) 0 25>;
+		qcom,lut-row-legend = <0 250 500 1000>;
+		qcom,lut-data = <1795 1787 1786>,
+				<1275 1752 1761>,
+				<590 1628 1743>,
+				<45 968 1661>;
+	};
+
+	qcom,pc-temp-ocv-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+					<75 70 65 60 55>,
+					<50 45 40 35 30>,
+					<25 20 16 13 11>,
+					<10 9 8 7 6>,
+					<5 4 3 2 1>,
+					<0>;
+		qcom,lut-data = <4324 4320 4316 4313 4306>,
+				<4239 4247 4247 4246 4242>,
+				<4177 4191 4191 4190 4187>,
+				<4115 4139 4139 4137 4134>,
+				<4070 4093 4089 4087 4085>,
+				<3993 4040 4043 4042 4038>,
+				<3930 3966 3990 3995 3995>,
+				<3899 3927 3957 3958 3956>,
+				<3868 3892 3917 3921 3920>,
+				<3838 3860 3869 3872 3873>,
+				<3808 3834 3837 3838 3839>,
+				<3787 3812 3814 3815 3815>,
+				<3771 3793 3796 3797 3796>,
+				<3759 3781 3781 3780 3781>,
+				<3748 3774 3772 3767 3760>,
+				<3738 3764 3760 3752 3739>,
+				<3726 3742 3739 3730 3716>,
+				<3715 3717 3709 3700 3688>,
+				<3702 3704 3692 3683 3670>,
+				<3691 3699 3687 3678 3667>,
+				<3685 3697 3686 3677 3666>,
+				<3675 3695 3684 3676 3665>,
+				<3664 3692 3683 3675 3663>,
+				<3645 3686 3679 3670 3658>,
+				<3619 3670 3664 3653 3638>,
+				<3584 3637 3631 3618 3601>,
+				<3535 3586 3580 3567 3551>,
+				<3467 3520 3514 3500 3486>,
+				<3368 3429 3424 3409 3398>,
+				<3231 3299 3287 3265 3263>,
+				<3005 3000 3000 3000 3000>;
+	};
+
+	qcom,rbatt-sf-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+					<75 70 65 60 55>,
+					<50 45 40 35 30>,
+					<25 20 16 13 11>,
+					<10 9 8 7 6>,
+					<5 4 3 2 1>,
+					<0>;
+		qcom,lut-data = <714 184 100 85 77>,
+				<714 184 100 85 77>,
+				<707 193 104 88 79>,
+				<674 202 110 91 81>,
+				<670 209 114 95 84>,
+				<623 219 121 100 87>,
+				<588 194 124 104 90>,
+				<593 189 131 108 94>,
+				<591 183 127 112 98>,
+				<590 178 106 95 87>,
+				<587 178 100 88 81>,
+				<605 179 103 91 83>,
+				<644 181 106 94 87>,
+				<704 186 108 95 91>,
+				<790 198 111 95 86>,
+				<898 208 112 92 82>,
+				<1012 206 111 92 83>,
+				<1095 198 107 91 81>,
+				<1133 206 106 91 81>,
+				<1100 218 110 94 85>,
+				<1036 225 114 97 86>,
+				<789 216 114 98 88>,
+				<823 214 116 99 88>,
+				<865 221 118 100 88>,
+				<922 223 116 97 85>,
+				<991 222 111 94 84>,
+				<1069 229 111 95 86>,
+				<1212 249 116 99 90>,
+				<1665 284 128 108 96>,
+				<4956 452 178 153 109>,
+				<52816 21422 16264 30119 400>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/batterydata-qrd-skul-4v4-2920mah.dtsi b/arch/arm64/boot/dts/qcom/batterydata-qrd-skul-4v4-2920mah.dtsi
new file mode 100644
index 000000000000..969bed48e996
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/batterydata-qrd-skul-4v4-2920mah.dtsi
@@ -0,0 +1,120 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,qrd-skul-4v4-2920mah-batterydata {
+	qcom,battery-type = "qrd-skul-4v4-2920mah";
+	qcom,batt-id-kohm = <1000>;
+	qcom,chg-term-ua = <100000>;
+	qcom,default-rbatt-mohm = <183>;
+	qcom,fcc-mah = <2920>;
+	qcom,max-voltage-uv = <4400000>;
+	qcom,rbatt-capacitive-mohm = <50>;
+	qcom,v-cutoff-uv = <3400000>;
+
+	qcom,fcc-temp-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-data = <2965 2985 2985 2981 2960>;
+	};
+
+	qcom,ibat-acc-lut {
+		qcom,lut-col-legend = <(-20) 0 25>;
+		qcom,lut-row-legend = <0 250 500 1000>;
+		qcom,lut-data = <2906 2925 2925>,
+				<1429 2837 2914>,
+				<782 2530 2887>,
+				<79 1818 2814>;
+	};
+
+	qcom,pc-temp-ocv-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+					<75 70 65 60 55>,
+					<50 45 40 35 30>,
+					<25 20 16 13 11>,
+					<10 9 8 7 6>,
+					<5 4 3 2 1>,
+					<0>;
+		qcom,lut-data = <4382 4379 4372 4366 4358>,
+				<4247 4287 4296 4295 4288>,
+				<4161 4224 4234 4232 4227>,
+				<4092 4166 4175 4174 4169>,
+				<4044 4111 4120 4118 4113>,
+				<3946 4059 4066 4065 4061>,
+				<3903 3987 4016 4016 4013>,
+				<3858 3933 3969 3971 3968>,
+				<3825 3895 3920 3924 3924>,
+				<3807 3860 3875 3878 3879>,
+				<3793 3831 3842 3843 3843>,
+				<3779 3806 3818 3819 3818>,
+				<3764 3788 3798 3799 3798>,
+				<3749 3776 3782 3783 3781>,
+				<3734 3765 3769 3767 3763>,
+				<3719 3749 3757 3750 3737>,
+				<3702 3727 3738 3729 3716>,
+				<3685 3707 3714 3707 3694>,
+				<3667 3695 3690 3683 3674>,
+				<3652 3689 3685 3680 3669>,
+				<3642 3686 3685 3679 3668>,
+				<3630 3683 3683 3677 3667>,
+				<3615 3679 3681 3676 3665>,
+				<3598 3673 3678 3673 3662>,
+				<3578 3663 3673 3666 3652>,
+				<3553 3637 3648 3640 3625>,
+				<3516 3594 3601 3592 3578>,
+				<3464 3532 3538 3530 3516>,
+				<3382 3440 3450 3447 3432>,
+				<3251 3295 3315 3325 3301>,
+				<3000 3000 3000 3052 3000>;
+	};
+
+	qcom,rbatt-sf-lut {
+		qcom,lut-col-legend = <(-20) 0 25 40 60>;
+		qcom,lut-row-legend = <100 95 90 85 80>,
+					<75 70 65 60 55>,
+					<50 45 40 35 30>,
+					<25 20 16 13 11>,
+					<10 9 8 7 6>,
+					<5 4 3 2 1>,
+					<0>;
+		qcom,lut-data = <1029 231 100 86 81>,
+				<1029 231 100 86 81>,
+				<956 233 100 87 82>,
+				<899 236 101 88 82>,
+				<873 238 104 89 83>,
+				<773 241 107 90 84>,
+				<762 217 113 93 85>,
+				<743 200 118 97 88>,
+				<739 198 112 99 89>,
+				<761 195 101 92 87>,
+				<797 196 98 87 82>,
+				<844 196 98 87 82>,
+				<896 199 99 88 83>,
+				<955 209 100 90 85>,
+				<1017 227 100 89 85>,
+				<1089 252 100 87 82>,
+				<1172 278 101 87 82>,
+				<1253 301 103 88 82>,
+				<1306 323 101 87 82>,
+				<1246 323 101 88 82>,
+				<1298 339 104 88 83>,
+				<1351 357 105 90 84>,
+				<1451 377 108 91 85>,
+				<1637 402 111 93 87>,
+				<1855 431 115 95 87>,
+				<2128 459 115 92 85>,
+				<2562 493 117 93 85>,
+				<3249 556 124 96 87>,
+				<4616 660 138 101 92>,
+				<10855 3698 256 124 113>,
+				<142404 102851 83715 2038 57906>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/batterydata-qrd-skum-4v4-2920mah.dtsi b/arch/arm64/boot/dts/qcom/batterydata-qrd-skum-4v4-2920mah.dtsi
new file mode 100644
index 000000000000..e19a45fa115b
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/batterydata-qrd-skum-4v4-2920mah.dtsi
@@ -0,0 +1,61 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,qrd_msm8952_skum_2920mah {
+	qcom,max-voltage-uv = <4400000>;
+	qcom,nom-batt-capacity-mah = <2920>;
+	qcom,batt-id-kohm = <50 90>;
+	qcom,battery-beta = <0>;
+	qcom,battery-type = "qrd_msm8952_skum_2920mah";
+	qcom,fastchg-current-ma = <3000>;
+	qcom,fg-cc-cv-threshold-mv = <4390>;
+	qcom,chg-rslow-comp-c1 = <4847657>;
+	qcom,chg-rslow-comp-c2 = <11109950>;
+	qcom,chg-rs-to-rslow = <819081>;
+	qcom,chg-rslow-comp-thr = <0xC7>;
+	qcom,checksum = <0x13EE>;
+	qcom,gui-version = "PMI8950GUI - 0.0.0.32";
+	qcom,fg-profile-data = [
+		C7 83 0E 77
+		EE 7A 0A 6E
+		3A 83 D3 70
+		5B 71 3F 86
+		B0 81 82 A0
+		3E C4 77 D1
+		54 0D D4 83
+		8A 76 4C 7A
+		D0 6C 4F 83
+		77 6B 2E 79
+		05 8C 20 82
+		70 9A 79 BD
+		3C CA 54 0D
+		D3 0B A0 62
+		14 70 71 FD
+		35 2F CD 35
+		FE 1A 00 00
+		9C 4D 14 3B
+		FE 3A 00 00
+		00 00 00 00
+		00 00 00 00
+		0D 6B A9 69
+		A2 76 CE 81
+		8B 7D A0 72
+		95 6F 64 78
+		46 7C 34 70
+		9B 49 85 93
+		50 4B 61 22
+		5E A0 71 0C
+		28 00 FF 36
+		F0 11 30 03
+		00 00 00 00
+	];
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-adv7533-1024-600p.dtsi b/arch/arm64/boot/dts/qcom/dsi-adv7533-1024-600p.dtsi
new file mode 100644
index 000000000000..5e382f307530
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-adv7533-1024-600p.dtsi
@@ -0,0 +1,75 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+
+dsi_adv7533_1024_600p: qcom,mdss_dsi_adv7533_1024_600p {
+		label = "adv7533 1024x600p video mode dsi panel";
+		qcom,mdss-dsi-panel-name = "dsi_adv7533_1024_600p";
+		qcom,mdss-dsi-panel-controller = <&mdss_dsi0>;
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-destination = "display_1";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1024>;
+		qcom,mdss-dsi-panel-height = <600>;
+		qcom,mdss-dsi-h-front-porch = <110>;
+		qcom,mdss-dsi-h-back-porch = <220>;
+		qcom,mdss-dsi-h-pulse-width = <40>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <20>;
+		qcom,mdss-dsi-v-front-porch = <5>;
+		qcom,mdss-dsi-v-pulse-width = <5>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [
+				05 01 00 00 c8 00 02 11 00
+				05 01 00 00 0a 00 02 29 00];
+		qcom,mdss-dsi-off-command = [05 01 00 00 00 00 02 28 00
+				05 01 00 00 00 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <1>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_pulse";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-panel-timings = [
+				AB 1A 10 00 3E 43 16 1E 15 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x03>;
+		qcom,mdss-dsi-t-clk-pre = <0x20>;
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-reset-sequence = <1 20>, <0 1>, <1 20>;
+		qcom,mdss-pan-physical-width-dimension = <160>;
+		qcom,mdss-pan-physical-height-dimension = <90>;
+		qcom,mdss-dsi-force-clock-lane-hs;
+		qcom,mdss-dsi-always-on;
+		qcom,mdss-dsi-panel-timings-phy-v2 = [1c 19 02 03 01 03 04 a0
+			1c 19 02 03 01 03 04 a0
+			1c 19 02 03 01 03 04 a0
+			1c 19 02 03 01 03 04 a0
+			1c 08 02 03 01 03 04 a0];
+		qcom,dba-panel;
+		qcom,bridge-name = "adv7533";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-adv7533-1080p.dtsi b/arch/arm64/boot/dts/qcom/dsi-adv7533-1080p.dtsi
new file mode 100644
index 000000000000..7994285f13f1
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-adv7533-1080p.dtsi
@@ -0,0 +1,75 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+		dsi_adv7533_1080p: qcom,mdss_dsi_adv7533_1080p {
+		label = "adv7533 1080p video mode dsi panel";
+		qcom,mdss-dsi-panel-name = "dsi_adv7533_1080p";
+		qcom,mdss-dsi-panel-controller = <&mdss_dsi0>;
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-destination = "display_1";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1920>;
+		qcom,mdss-dsi-panel-height = <1080>;
+		qcom,mdss-dsi-h-front-porch = <88>;
+		qcom,mdss-dsi-h-back-porch = <148>;
+		qcom,mdss-dsi-h-pulse-width = <44>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <36>;
+		qcom,mdss-dsi-v-front-porch = <4>;
+		qcom,mdss-dsi-v-pulse-width = <5>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [
+				05 01 00 00 c8 00 02 11 00
+				05 01 00 00 0a 00 02 29 00];
+		qcom,mdss-dsi-off-command = [05 01 00 00 00 00 02 28 00
+				05 01 00 00 00 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <1>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_pulse";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [
+				E6 38 26 00 68 6C 2A 3A 2C 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x02>;
+		qcom,mdss-dsi-t-clk-pre = <0x2B>;
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-reset-sequence = <1 20>, <0 1>, <1 20>;
+		qcom,mdss-pan-physical-width-dimension = <160>;
+		qcom,mdss-pan-physical-height-dimension = <90>;
+		qcom,mdss-dsi-force-clock-lane-hs;
+		qcom,mdss-dsi-always-on;
+		qcom,mdss-dsi-panel-timings-phy-v2 = [1d 1a 03 05 01 03 04 a0
+			1d 1a 03 05 01 03 04 a0
+			1d 1a 03 05 01 03 04 a0
+			1d 1a 03 05 01 03 04 a0
+			1d 1a 03 05 01 03 04 a0];
+		qcom,dba-panel;
+		qcom,bridge-name = "adv7533";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-adv7533-720p.dtsi b/arch/arm64/boot/dts/qcom/dsi-adv7533-720p.dtsi
new file mode 100644
index 000000000000..b84488c0cef3
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-adv7533-720p.dtsi
@@ -0,0 +1,74 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+dsi_adv7533_720p: qcom,mdss_dsi_adv7533_720p {
+		label = "adv7533 720p video mode dsi panel";
+		qcom,mdss-dsi-panel-name = "dsi_adv7533_720p";
+		qcom,mdss-dsi-panel-controller = <&mdss_dsi0>;
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-destination = "display_1";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1280>;
+		qcom,mdss-dsi-panel-height = <720>;
+		qcom,mdss-dsi-h-front-porch = <110>;
+		qcom,mdss-dsi-h-back-porch = <220>;
+		qcom,mdss-dsi-h-pulse-width = <40>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <20>;
+		qcom,mdss-dsi-v-front-porch = <5>;
+		qcom,mdss-dsi-v-pulse-width = <5>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [
+				05 01 00 00 c8 00 02 11 00
+				05 01 00 00 0a 00 02 29 00];
+		qcom,mdss-dsi-off-command = [05 01 00 00 00 00 02 28 00
+				05 01 00 00 00 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <1>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_pulse";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-panel-timings = [
+				A4 24 18 00 4E 52 1C 28 1C 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x03>;
+		qcom,mdss-dsi-t-clk-pre = <0x20>;
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-reset-sequence = <1 20>, <0 1>, <1 20>;
+		qcom,mdss-pan-physical-width-dimension = <160>;
+		qcom,mdss-pan-physical-height-dimension = <90>;
+		qcom,mdss-dsi-force-clock-lane-hs;
+		qcom,mdss-dsi-always-on;
+		qcom,mdss-dsi-panel-timings-phy-v2 = [1c 19 02 03 01 03 04 a0
+			1c 19 02 03 01 03 04 a0
+			1c 19 02 03 01 03 04 a0
+			1c 19 02 03 01 03 04 a0
+			1c 08 02 03 01 03 04 a0];
+		qcom,dba-panel;
+		qcom,bridge-name = "adv7533";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-hx8379a-truly-fwvga-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-hx8379a-truly-fwvga-video.dtsi
new file mode 100644
index 000000000000..772bb8350311
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-hx8379a-truly-fwvga-video.dtsi
@@ -0,0 +1,138 @@
+/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_hx8379a_fwvga_truly_vid: qcom,mdss_dsi_hx8379a_fwvga_truly_vid {
+		qcom,mdss-dsi-panel-name = "HX8379A fwvga video mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <480>;
+		qcom,mdss-dsi-panel-height = <854>;
+		qcom,mdss-dsi-h-front-porch = <100>;
+		qcom,mdss-dsi-h-back-porch = <94>;
+		qcom,mdss-dsi-h-pulse-width = <40>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <4>;
+		qcom,mdss-dsi-v-front-porch = <6>;
+		qcom,mdss-dsi-v-pulse-width = <6>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-color-order = "rgb_swap_rgb";
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [
+			39 01 00 00 00 00 04
+				B9 FF 83 79
+			39 01 00 00 00 00 15
+				B1 44 18 18
+				31 51 90 D0
+				EE D4 80 38
+				38 F8 44 44
+				42 00 80 30
+				00
+			39 01 00 00 00 00 0A
+				B2 80 FE 0A
+				03 30 50 11
+				42 1D
+			39 01 00 00 00 00 0E
+				B4 01 28 00
+				34 00 34 17
+				3A 17 3A B0
+				00 FF
+			23 01 00 00 00 00 02
+				cc 02
+			39 01 00 00 00 00 02
+				D2 33
+			39 01 00 00 00 00 1E
+				D3 00 07 00
+				00 00 06 06
+				32 10 03 00
+				03 03 5F 03
+				5F 00 08 00
+				08 35 33 07
+				07 37 07 07
+				37 07
+			39 01 00 00 00 00 21
+				D5 18 18 19
+				19 18 18 20
+				21 24 25 18
+				18 18 18 00
+				01 04 05 02
+				03 06 07 18
+				18 18 18 18
+				18 18 18 18
+				18
+			39 01 00 00 00 00 21
+				D6 18 18 18
+				18 19 19 25
+				24 21 20 18
+				18 18 18 05
+				04 01 00 03
+				02 07 06 18
+				18 18 18 18
+				18 18 18 18
+				18
+			39 01 00 00 00 00 2B
+				E0 00 05 09
+				26 26 3E 1E
+				45 08 0C 0D
+				17 0E 12 15
+				13 14 12 1F
+				1F 1F 00 05
+				09 26 26 3E
+				1E 45 08 0C
+				0D 17 0E 12
+				15 13 14 12
+				1F 1F 1F
+			39 01 00 00 00 00 03
+				B6 54 54
+			39 01 00 00 00 00 02
+				35 00
+			39 01 00 00 00 00 02
+				51 ff
+			39 01 00 00 00 00 02
+				53 2c
+			39 01 00 00 00 00 02
+				55 01
+			05 01 00 00 96 00 02
+				11 00
+			05 01 00 00 78 00 02
+				29 00
+			];
+		qcom,mdss-dsi-off-command = [
+			05 01 00 00 32 00 02
+				28 00
+			05 01 00 00 78 00 02
+				10 00
+			];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-panel-timings =
+					[8B 1f 14 00 45 4A 19 23 23 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x04>;
+		qcom,mdss-dsi-t-clk-pre = <0x1D>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-reset-sequence = <1 20>, <0 2>, <1 20>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-hx8394f-720p-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-hx8394f-720p-video.dtsi
new file mode 100644
index 000000000000..9f4f91c388aa
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-hx8394f-720p-video.dtsi
@@ -0,0 +1,122 @@
+/*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*---------------------------------------------------------------------------
+ * This file is autogenerated file using gcdb parser. Please do not edit it.
+ * Update input XML file to add a new entry or update variable in this file
+ * VERSION = "1.0"
+ *---------------------------------------------------------------------------*/
+&mdss_mdp {
+	dsi_hx8394f_720p_video: qcom,mdss_dsi_hx8394f_720p_video {
+		qcom,mdss-dsi-panel-name = "hx8394f 720p video mode dsi panel";
+		qcom,mdss-dsi-panel-controller = <&mdss_dsi0>;
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-destination = "display_1";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <720>;
+		qcom,mdss-dsi-panel-height = <1280>;
+		qcom,mdss-dsi-h-front-porch = <16>;
+		qcom,mdss-dsi-h-back-porch = <16>;
+		qcom,mdss-dsi-h-pulse-width = <10>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <12>;
+		qcom,mdss-dsi-v-front-porch = <15>;
+		qcom,mdss-dsi-v-pulse-width = <4>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [39 01 00 00 00 00 04 B9 FF 83 94
+				39 01 00 00 00 00 07
+					BA 63 03 68 6B B2 C0
+				39 01 00 00 00 00 0B
+					B1 50 12 72 09 33 54 B1 31 6B 2F
+				39 01 00 00 00 00 07
+					B2 00 80 64 0E 0D 2F
+				39 01 00 00 00 00 16
+					B4 73 74 73 74 73 74 01 0C 86 75
+					00 3F 73 74 73 74 73 74 01 0C 86
+				39 01 00 00 00 00 22
+					D3 00 00 07 07 40 07 10 00 08 10
+					08 00 08 54 15 0E 05 0E 02 15 06
+					05 06 47 44 0A 0A 4B 10 07 07 0E
+					40
+				39 01 00 00 00 00 2D
+					D5 1A 1A 1B 1B 00 01 02 03 04 05
+					06 07 08 09 0A 0B 24 25 18 18 26
+					27 18 18 18 18 18 18 18 18 18 18
+					18 18 18 18 18 18 20 21 18 18 18
+					18
+				39 01 00 00 00 00 2D
+					D6 1A 1A 1B 1B 0B 0A 09 08 07 06
+					05 04 03 02 01 00 21 20 18 18 27
+					26 18 18 18 18 18 18 18 18 18 18
+					18 18 18 18 18 18 25 24 18 18 18
+					18
+				39 01 00 00 00 00 3B
+					E0 00 0C 19 20 23 26 29 28 51 61
+					70 6F 76 86 89 8D 99 9A 95 A1 B0
+					57 55 58 5C 5e 64 6B 7F 00 0C 19
+					20 23 26 29 28 51 61 70 6F 76 86
+					89 8D 99 9A 95 A1 B0 57 55 58 5C
+					5E 64 6B 7F
+				39 01 00 00 00 00 03 C0 1F 31
+				15 01 00 00 00 00 02 CC 0B
+				15 01 00 00 00 00 02 D4 02
+				15 01 00 00 00 00 02 BD 02
+				39 01 00 00 00 00 0D
+					D8 FF FF FF FF FF FF FF FF FF FF
+					FF FF
+				15 01 00 00 00 00 02 BD 00
+				15 01 00 00 00 00 02 BD 01
+				15 01 00 00 00 00 02 B1 00
+				15 01 00 00 00 00 02 BD 00
+				39 01 00 00 00 00 08
+					BF 40 81 50 00 1A FC 01
+				39 01 00 00 00 00 03 B6 7D 7D
+				05 01 00 00 78 00 02 11 00
+				39 01 00 00 00 00 0D
+					B2 00 80 64 0E 0D 2F 00 00 00 00
+					C0 18
+				05 01 00 00 14 00 02 29 00];
+
+		qcom,mdss-dsi-off-command = [05 01 00 00 78 00 02 28 00
+				05 01 00 00 96 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <1>;
+		qcom,mdss-dsi-traffic-mode = "burst_mode";
+		qcom,mdss-dsi-lane-map = "lane_map_0123";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings
+			= [72 16 0e 00 38 3c 12 1a 10 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x04>;
+		qcom,mdss-dsi-t-clk-pre = <0x18>;
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+		qcom,mdss-dsi-reset-sequence = <1 20>, <0 2>, <1 20>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-jdi-1080p-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-jdi-1080p-video.dtsi
new file mode 100644
index 000000000000..6f3f63d27d70
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-jdi-1080p-video.dtsi
@@ -0,0 +1,76 @@
+/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*---------------------------------------------------------------------------
+ * This file is autogenerated file using gcdb parser. Please do not edit it.
+ * Update input XML file to add a new entry or update variable in this file
+ * VERSION = "1.0"
+ *---------------------------------------------------------------------------
+ */
+&mdss_mdp {
+	dsi_jdi_1080p_video: qcom,mdss_dsi_jdi_1080p_video {
+		qcom,mdss-dsi-panel-name = "jdi 1080p video mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1080>;
+		qcom,mdss-dsi-panel-height = <1920>;
+		qcom,mdss-dsi-h-front-porch = <96>;
+		qcom,mdss-dsi-h-back-porch = <64>;
+		qcom,mdss-dsi-h-pulse-width = <16>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <16>;
+		qcom,mdss-dsi-v-front-porch = <4>;
+		qcom,mdss-dsi-v-pulse-width = <1>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-color-order = "rgb_swap_rgb";
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [15 01 00 00 00 00 02 55 00
+				15 01 00 00 00 00 02 53 2C
+				15 01 00 00 00 00 02 35 00
+				05 01 00 00 78 00 02 29 00
+				05 01 00 00 78 00 02 11 00];
+		qcom,mdss-dsi-off-command = [05 01 00 00 02 00 02 28 00
+				 05 01 00 00 79 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "burst_mode";
+		qcom,mdss-dsi-lane-map = "lane_map_0123";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings =
+					[ce 2e 1e 00 5a 5c 24 30 24 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x0d>;
+		qcom,mdss-dsi-t-clk-pre = <0x2f>;
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+		qcom,mdss-pan-physical-width-dimension = <61>;
+		qcom,mdss-pan-physical-heigth-dimenstion = <110>;
+		qcom,mdss-dsi-tx-eot-append;
+		qcom,ulps-enabled;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-jdi-4k-dualmipi-video-nofbc.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-jdi-4k-dualmipi-video-nofbc.dtsi
new file mode 100644
index 000000000000..6db2e51208de
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-jdi-4k-dualmipi-video-nofbc.dtsi
@@ -0,0 +1,68 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_dual_jdi_4k_nofbc_video: qcom,dsi_jdi_4k_nofbc_video {
+		qcom,mdss-dsi-panel-name = "JDI 4K no FBC Dual video mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-framerate = <40>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1920>;
+		qcom,mdss-dsi-panel-height = <2160>;
+		qcom,mdss-dsi-h-front-porch = <100>;
+		qcom,mdss-dsi-h-back-porch = <80>;
+		qcom,mdss-dsi-h-pulse-width = <12>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <16>;
+		qcom,mdss-dsi-v-front-porch = <16>;
+		qcom,mdss-dsi-v-pulse-width = <4>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0x1eaaaa>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,cmd-sync-wait-broadcast;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [3e 38 26 00 68 6e 2a 3c 2c 03
+									04 00];
+		qcom,mdss-dsi-t-clk-post = <0x12>;
+		qcom,mdss-dsi-t-clk-pre = <0x34>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+
+		qcom,mdss-dsi-on-command = [15 01 00 00 0a 00 02 51 FF
+				15 01 00 00 0a 00 02 53 24
+				05 01 00 00 c9 00 01 11
+				23 01 00 00 0a 00 02 b0 04
+				29 01 00 00 0a 00 08 b3 14 08 00 00 00 00 00
+				23 01 00 00 0a 00 02 d6 01
+				05 01 00 00 50 00 01 29];
+
+		qcom,mdss-dsi-on-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-off-command = [05 01 00 00 32 00 02 28 00
+					05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-reset-sequence = <1 200>, <0 200>, <1 200>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-jdi-4k-dualmipi-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-jdi-4k-dualmipi-video.dtsi
new file mode 100644
index 000000000000..655913226db5
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-jdi-4k-dualmipi-video.dtsi
@@ -0,0 +1,88 @@
+/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_dual_jdi_4k_video: qcom,dsi_jdi_4k_video {
+		qcom,mdss-dsi-panel-name = "JDI 4K Dual video mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-panel-clockrate = <849520000>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1920>;
+		qcom,mdss-dsi-panel-height = <2160>;
+		qcom,mdss-dsi-h-front-porch = <100>;
+		qcom,mdss-dsi-h-back-porch = <80>;
+		qcom,mdss-dsi-h-pulse-width = <12>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <16>;
+		qcom,mdss-dsi-v-front-porch = <16>;
+		qcom,mdss-dsi-v-pulse-width = <4>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0x1eaaaa>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,cmd-sync-wait-broadcast;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [3e 38 26 00 68 6e 2a 3c 2c 03
+									04 00];
+		qcom,mdss-dsi-t-clk-post = <0x03>;
+		qcom,mdss-dsi-t-clk-pre = <0x27>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+		qcom,mdss-dsi-on-command = [15 01 00 00 0a 00 02 51 FF
+					15 01 00 00 0a 00 02 53 24
+					05 01 00 00 78 00 01 11
+					/* beginning of additional sequence */
+					/* Manufacturer Command Access Protect */
+					23 01 00 00 50 00 02 B0 04
+					/* Qualcomm's IP control */
+					29 01 00 00 0a 00 07 ED 80 00 34 5B 04 B0
+					/* Manufacturer Command Access Protect */
+					23 01 00 00 50 00 02 B0 03
+					05 01 00 00 10 00 01 29];
+					/* Set display on, wait 16ms */
+		qcom,mdss-dsi-on-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-off-command = [05 01 00 00 32 00 02 28 00
+					05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-reset-sequence = <1 200>, <0 200>, <1 200>;
+
+		qcom,mdss-dsi-fbc-enable;
+		qcom,mdss-dsi-fbc-bpp = <12>;
+		qcom,mdss-dsi-fbc-packing = <1>;
+		qcom,mdss-dsi-fbc-quant-error;
+		qcom,mdss-dsi-fbc-bias = <2>;
+		qcom,mdss-dsi-fbc-vlc-mode;
+		qcom,mdss-dsi-fbc-bflc-mode;
+		qcom,mdss-dsi-fbc-lossy-mode-idx = <3>;
+		qcom,mdss-dsi-fbc-pat-mode;
+		qcom,mdss-dsi-fbc-budget-ctrl = <5>;
+		qcom,mdss-dsi-fbc-block-budget = <91>;
+		qcom,mdss-dsi-fbc-h-line-budget = <1200>;
+		qcom,mdss-dsi-fbc-lossless-threshold = <0x200>;
+		qcom,mdss-dsi-fbc-lossy-threshold = <192>;
+		qcom,mdss-dsi-fbc-rgb-threshold = <0>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-jdi-a407-dualmipi-wqhd-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-jdi-a407-dualmipi-wqhd-cmd.dtsi
new file mode 100644
index 000000000000..0ff02042600d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-jdi-a407-dualmipi-wqhd-cmd.dtsi
@@ -0,0 +1,95 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_dual_jdi_a407_cmd: qcom,mdss_dsi_jdi_a407_wqhd_cmd {
+		qcom,mdss-dsi-panel-name = "JDI a407 wqhd cmd mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-panel-clockrate = <838600000>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <720>;
+		qcom,mdss-dsi-panel-height = <2560>;
+		qcom,mdss-dsi-h-front-porch = <16>;
+		qcom,mdss-dsi-h-back-porch = <40>;
+		qcom,mdss-dsi-h-pulse-width = <4>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <20>;
+		qcom,mdss-dsi-v-front-porch = <7>;
+		qcom,mdss-dsi-v-pulse-width = <1>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-color-order = "rgb_swap_rgb";
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [
+			29 01 00 00 01 00 02 00 00
+			29 01 00 00 01 00 04 FF 25 03 01
+			29 01 00 00 01 00 02 00 80
+			29 01 00 00 01 00 03 FF 25 03
+			29 01 00 00 01 00 02 00 80
+			29 01 00 00 01 00 10
+				A7 27 00 FF 01 15 11 02
+				98 0F 07 70 69 14 00 00
+			29 01 00 00 01 00 02 00 C0
+			29 01 00 00 01 00 10
+				A7 13 00 FF 01 FF 10 02
+				08 0F 07 74 69 14 00 00
+			15 01 00 00 00 00 02 35 00
+			05 01 00 00 78 00 02 11 00
+			05 01 00 00 32 00 02 29 00];
+		qcom,mdss-dsi-off-command = [
+			05 01 00 00 32 00 02 28 00
+			05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-traffic-mode = "burst_mode";
+		qcom,mdss-dsi-lane-map = "lane_map_0123";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+
+		qcom,mdss-dsi-te-using-te-pin;
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-te-v-sync-rd-ptr-irq-line = <0x2c>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+
+		qcom,mdss-dsi-lp11-init;
+		qcom,adjust-timer-wakeup-ms = <1>;
+		qcom,mdss-dsi-reset-sequence = <1 20>, <0 10>, <1 20>;
+
+		qcom,dcs-cmd-by-left;
+
+		qcom,config-select = <&dsi_dual_jdi_a407_cmd_config0>;
+
+		dsi_dual_jdi_a407_cmd_config0: config0 {
+			qcom,split-mode = "dualctl-split";
+		};
+
+		dsi_dual_jdi_a407_cmd_config1: config1 {
+			qcom,split-mode = "pingpong-split";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-jdi-dualmipi-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-jdi-dualmipi-cmd.dtsi
new file mode 100644
index 000000000000..50c4c728fd4a
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-jdi-dualmipi-cmd.dtsi
@@ -0,0 +1,136 @@
+/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_dual_jdi_cmd: qcom,mdss_dsi_jdi_qhd_dualmipi_cmd{
+		qcom,mdss-dsi-panel-name = "Dual cmd mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1280>;
+		qcom,mdss-dsi-panel-height = <1440>;
+		qcom,mdss-dsi-h-front-porch = <120>;
+		qcom,mdss-dsi-h-back-porch = <44>;
+		qcom,mdss-dsi-h-pulse-width = <16>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <4>;
+		qcom,mdss-dsi-v-front-porch = <8>;
+		qcom,mdss-dsi-v-pulse-width = <4>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-color-order = "rgb_swap_rgb";
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,cmd-sync-wait-broadcast;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-hor-line-idle = 	<0 40 256>,
+						<40 120 128>,
+						<120 240 64>;
+		qcom,mdss-dsi-panel-timings = [cd 32 22 00 60 64 26 34 29 03
+									04 00];
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+		qcom,mdss-dsi-t-clk-post = <0x03>;
+		qcom,mdss-dsi-t-clk-pre = <0x27>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-wr-mem-start = <0x2c>;
+		qcom,mdss-dsi-wr-mem-continue = <0x3c>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+		qcom,ulps-enabled;
+		qcom,mdss-dsi-on-command = [29 01 00 00 00 00 02 b0 03
+			05 01 00 00 0a 00 01 00
+			/* Soft reset, wait 10ms */
+			15 01 00 00 0a 00 02 3a 77
+			/* Set Pixel format (24 bpp) */
+			39 01 00 00 0a 00 05 2a 00 00 04 ff
+			/* Set Column address */
+			39 01 00 00 0a 00 05 2b 00 00 05 9f
+			/* Set page address */
+			15 01 00 00 0a 00 02 35 00
+			/* Set tear on */
+			39 01 00 00 0a 00 03 44 00 00
+			/* Set tear scan line */
+			15 01 00 00 0a 00 02 51 ff
+			/* write display brightness */
+			15 01 00 00 0a 00 02 53 24
+			 /* write control brightness */
+			15 01 00 00 0a 00 02 55 00
+			/* CABC brightness */
+			05 01 00 00 78 00 01 11
+			/* exit sleep mode, wait 120ms */
+			05 01 00 00 10 00 01 29];
+			/* Set display on, wait 16ms */
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-post-mode-switch-on-command =
+					[05 01 00 00 0a 00 01 00
+						/* Soft reset, wait 10ms */
+					15 01 00 00 0a 00 02 3a 77
+						/* Set Pixel format (24 bpp) */
+					39 01 00 00 0a 00 05 2a 00 00 04 ff
+						/* Set Column address */
+					39 01 00 00 0a 00 05 2b 00 00 05 9f
+						/* Set page address */
+					15 01 00 00 0a 00 02 35 00
+						/* Set tear on */
+					39 01 00 00 0a 00 03 44 00 00
+						/* Set tear scan line */
+					15 01 00 00 0a 00 02 51 ff
+						/* write display brightness */
+					15 01 00 00 0a 00 02 53 24
+						/* write control brightness */
+					15 01 00 00 0a 00 02 55 00
+						/* CABC brightness */
+					05 01 00 00 78 00 01 11
+					/* exit sleep mode, wait 120ms */
+					23 01 00 00 0a 00 02 b0 00
+						/* MCAP */
+					29 01 00 00 0a 00 02 b3 14
+						/* Interface setting */
+					29 01 00 00 0a 00 14 ce 7d 40 48 56 67
+					78 88 98 a7 b5 c3 d1 de e9 f2 fa ff 04
+					00    /* Backlight control 4 */
+					23 01 00 00 0a 00 02 b0 03
+						/* MCAP */
+					05 01 00 00 10 00 01 29];
+					/* Set display on, wait 16ms */
+		qcom,mdss-dsi-post-mode-switch-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command =[05 01 00 00 32 00 02 28 00
+					05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,dynamic-mode-switch-enabled;
+		qcom,dynamic-mode-switch-type = "dynamic-switch-immediate";
+		qcom,mode-switch-commands-state = "dsi_hs_mode";
+		qcom,video-to-cmd-mode-switch-commands =
+			[23 00 00 00 00 00 02 b0 00
+			29 00 00 00 00 00 02 b3 0c
+			23 01 00 00 00 00 02 b0 03];
+		qcom,cmd-to-video-mode-switch-commands =
+			[23 00 00 00 00 00 02 b0 00
+			29 00 00 00 00 00 02 b3 1c
+			23 01 00 00 00 00 02 b0 03];
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-jdi-dualmipi-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-jdi-dualmipi-video.dtsi
new file mode 100644
index 000000000000..10a61a4aa2d0
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-jdi-dualmipi-video.dtsi
@@ -0,0 +1,125 @@
+/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_dual_jdi_video: qcom,dsi_jdi_qhd_video {
+		qcom,mdss-dsi-panel-name = "Dual JDI video mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1280>;
+		qcom,mdss-dsi-panel-height = <1440>;
+		qcom,mdss-dsi-h-front-porch = <120>;
+		qcom,mdss-dsi-h-back-porch = <44>;
+		qcom,mdss-dsi-h-pulse-width = <16>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <4>;
+		qcom,mdss-dsi-v-front-porch = <8>;
+		qcom,mdss-dsi-v-pulse-width = <4>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,cmd-sync-wait-broadcast;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [cd 32 22 00 60 64 26 34 29 03
+									04 00];
+		qcom,mdss-dsi-t-clk-post = <0x03>;
+		qcom,mdss-dsi-t-clk-pre = <0x27>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+		qcom,mdss-dsi-on-command = [05 01 00 00 0a 00 01 00
+						/* Soft reset, wait 10ms */
+					15 01 00 00 0a 00 02 3a 77
+						/* Set Pixel format (24 bpp) */
+					39 01 00 00 0a 00 05 2a 00 00 04 ff
+						/* Set Column address */
+					39 01 00 00 0a 00 05 2b 00 00 05 9f
+						/* Set page address */
+					15 01 00 00 0a 00 02 35 00
+						/* Set tear on */
+					39 01 00 00 0a 00 03 44 00 00
+						/* Set tear scan line */
+					15 01 00 00 0a 00 02 51 ff
+						/* write display brightness */
+					15 01 00 00 0a 00 02 53 24
+						/* write control brightness */
+					15 01 00 00 0a 00 02 55 00
+						/* CABC brightness */
+					05 01 00 00 78 00 01 11
+					/* exit sleep mode, wait 120ms */
+					23 01 00 00 0a 00 02 b0 00
+						/* MCAP */
+					29 01 00 00 0a 00 02 b3 14
+						/* Interface setting */
+					29 01 00 00 0a 00 14 ce 7d 40 48 56 67
+					78 88 98 a7 b5 c3 d1 de e9 f2 fa ff 04
+					00    /* Backlight control 4 */
+					23 01 00 00 0a 00 02 b0 03
+						/* MCAP */
+					05 01 00 00 10 00 01 29];
+					/* Set display on, wait 16ms */
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-post-mode-switch-on-command =
+			[29 01 00 00 00 00 02 b0 03
+			05 01 00 00 0a 00 01 00
+			/* Soft reset, wait 10ms */
+			15 01 00 00 0a 00 02 3a 77
+			/* Set Pixel format (24 bpp) */
+			39 01 00 00 0a 00 05 2a 00 00 04 ff
+			/* Set Column address */
+			39 01 00 00 0a 00 05 2b 00 00 05 9f
+			/* Set page address */
+			15 01 00 00 0a 00 02 35 00
+			/* Set tear on */
+			39 01 00 00 0a 00 03 44 00 00
+			/* Set tear scan line */
+			15 01 00 00 0a 00 02 51 ff
+			/* write display brightness */
+			15 01 00 00 0a 00 02 53 24
+			 /* write control brightness */
+			15 01 00 00 0a 00 02 55 00
+			/* CABC brightness */
+			05 01 00 00 78 00 01 11
+			/* exit sleep mode, wait 120ms */
+			05 01 00 00 10 00 01 29];
+			/* Set display on, wait 16ms */
+		qcom,mdss-dsi-post-mode-switch-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command = [05 01 00 00 32 00 02 28 00
+					05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+		qcom,dynamic-mode-switch-enabled;
+		qcom,dynamic-mode-switch-type = "dynamic-switch-immediate";
+		qcom,video-to-cmd-mode-switch-commands =
+			[23 00 00 00 00 00 02 b0 00
+			29 00 00 00 00 00 02 b3 0c
+			23 01 00 00 00 00 02 b0 03];
+		qcom,cmd-to-video-mode-switch-commands =
+			[23 00 00 00 00 00 02 b0 00
+			29 00 00 00 00 00 02 b3 1c
+			23 01 00 00 00 00 02 b0 03];
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-jdi-fhd-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-jdi-fhd-video.dtsi
new file mode 100644
index 000000000000..b0757c75865c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-jdi-fhd-video.dtsi
@@ -0,0 +1,83 @@
+/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*---------------------------------------------------------------------------
+ * This file is autogenerated file using gcdb parser. Please do not edit it.
+ * Update input XML file to add a new entry or update variable in this file
+ * VERSION = "1.0"
+ *---------------------------------------------------------------------------*/
+&mdss_mdp {
+	dsi_jdi_fhd_video: qcom,mdss_dsi_jdi_fhd_video {
+		qcom,mdss-dsi-panel-name =
+				"jdi fhd 6inch A155A video mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1080>;
+		qcom,mdss-dsi-panel-height = <1920>;
+		qcom,mdss-dsi-h-front-porch = <12>;
+		qcom,mdss-dsi-h-back-porch = <28>;
+		qcom,mdss-dsi-h-pulse-width = <4>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <3>;
+		qcom,mdss-dsi-v-front-porch = <18>;
+		qcom,mdss-dsi-v-pulse-width = <1>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-color-order = "rgb_swap_rgb";
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-panel-operating-mode = <1>;
+		qcom,mdss-dsi-on-command = [13 01 00 00 0a 00 02 FF F0
+				13 01 00 00 0a 00 02 DD 02
+				13 01 00 00 0a 00 02 E3 00
+				13 01 00 00 0a 00 02 FB 01
+				13 01 00 00 0a 00 02 FF 00
+				15 01 00 00 0a 00 02 35 00
+				15 01 00 00 0a 00 02 51 FF
+				15 01 00 00 0a 00 02 53 2C
+				13 01 00 00 0a 00 02 FF 26
+				13 01 00 00 0a 00 02 02 FF
+				13 01 00 00 0a 00 02 FF 10
+				13 01 00 00 0a 00 02 BB 13
+				13 01 00 00 0a 00 02 FF 00
+				05 01 00 00 C8 00 01 11
+				05 01 00 00 28 00 01 29];
+		qcom,mdss-dsi-off-command = [05 01 00 00 32 00 02 28 00
+				 05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "burst_mode";
+		qcom,mdss-dsi-lane-map = "lane_map_0123";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings =
+					[ce 2e 1e 00 5a 5c 24 30 24 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x0a>;
+		qcom,mdss-dsi-t-clk-pre = <0x2c>;
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+		qcom,mdss-dsi-reset-sequence = <1 20>, <0 200>, <1 20>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-dsc-wqxga-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-dsc-wqxga-cmd.dtsi
new file mode 100644
index 000000000000..c80259bae5c0
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-dsc-wqxga-cmd.dtsi
@@ -0,0 +1,136 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_nt35597_dsc_cmd: qcom,mdss_dsi_nt35597_dsc_wqxga_cmd {
+		qcom,mdss-dsi-panel-name = "NT35597 cmd mode dsc dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1440>;
+		qcom,mdss-dsi-panel-height = <2560>;
+		qcom,mdss-dsi-h-front-porch = <100>;
+		qcom,mdss-dsi-h-back-porch = <32>;
+		qcom,mdss-dsi-h-pulse-width = <16>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <7>;
+		qcom,mdss-dsi-v-front-porch = <8>;
+		qcom,mdss-dsi-v-pulse-width = <1>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [e2 36 24 00 66 6a 28 38 2a 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0xb>;
+		qcom,mdss-dsi-t-clk-pre = <0x24>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+		qcom,mdss-pan-physical-width-dimension = <74>;
+		qcom,mdss-pan-physical-height-dimension = <131>;
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-wr-mem-start = <0x2c>;
+		qcom,mdss-dsi-wr-mem-continue = <0x3c>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+		qcom,ulps-enabled;
+		qcom,mdss-dsi-panel-hdr-enabled;
+		qcom,mdss-dsi-panel-hdr-color-primaries = <14500 15500 32000
+			17000 15500 30000 8000 3000>;
+		qcom,mdss-dsi-panel-peak-brightness = <4200000>;
+		qcom,mdss-dsi-panel-blackness-level = <3230>;
+		qcom,adjust-timer-wakeup-ms = <1>;
+		qcom,mdss-dsi-on-command = [15 01 00 00 00 00 02 ff 10
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 ba 03
+			15 01 00 00 00 00 02 e5 01
+			15 01 00 00 00 00 02 b0 03
+			15 01 00 00 00 00 02 ff 28
+			15 01 00 00 00 00 02 7a 02
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 ff 10
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 c0 03
+			15 01 00 00 00 00 02 bb 10
+			15 01 00 00 00 00 02 ff e0
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 6b 3d
+			15 01 00 00 00 00 02 6c 3d
+			15 01 00 00 00 00 02 6d 3d
+			15 01 00 00 00 00 02 6e 3d
+			15 01 00 00 00 00 02 6f 3d
+			15 01 00 00 00 00 02 35 02
+			15 01 00 00 00 00 02 36 72
+			15 01 00 00 00 00 02 37 10
+			15 01 00 00 00 00 02 08 c0
+			15 01 00 00 00 00 02 ff 24
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 c6 06
+			15 01 00 00 00 00 02 ff 10
+			05 01 00 00 a0 00 01 11
+			05 01 00 00 00 00 01 29
+			07 01 00 00 0a 00 02 01 00];
+
+		qcom,mdss-dsi-post-panel-on-command = [05 01 00 00 a0 00 01 29];
+
+		qcom,mdss-dsi-off-command = [05 01 00 00 0a 00 02 28 00
+				 05 01 00 00 0a 00 02 10 00];
+
+		qcom,compression-mode = "dsc";
+		qcom,config-select = <&dsi_nt35597_dsc_cmd_config2>;
+
+		dsi_nt35597_dsc_cmd_config0: config0 {
+			qcom,mdss-dsc-encoders = <1>;
+			qcom,mdss-dsc-slice-height = <16>;
+			qcom,mdss-dsc-slice-width = <720>;
+			qcom,mdss-dsc-slice-per-pkt = <2>;
+
+			qcom,mdss-dsc-bit-per-component = <8>;
+			qcom,mdss-dsc-bit-per-pixel = <8>;
+			qcom,mdss-dsc-block-prediction-enable;
+		};
+
+		dsi_nt35597_dsc_cmd_config1: config1 {
+			qcom,lm-split = <720 720>;
+			qcom,mdss-dsc-encoders = <1>; /* 3D Mux */
+			qcom,mdss-dsc-slice-height = <16>;
+			qcom,mdss-dsc-slice-width = <720>;
+			qcom,mdss-dsc-slice-per-pkt = <2>;
+
+			qcom,mdss-dsc-bit-per-component = <8>;
+			qcom,mdss-dsc-bit-per-pixel = <8>;
+			qcom,mdss-dsc-block-prediction-enable;
+		};
+
+		dsi_nt35597_dsc_cmd_config2: config2 {
+			qcom,lm-split = <720 720>;
+			qcom,mdss-dsc-encoders = <2>; /* DSC Merge */
+			qcom,mdss-dsc-slice-height = <16>;
+			qcom,mdss-dsc-slice-width = <720>;
+			qcom,mdss-dsc-slice-per-pkt = <2>;
+
+			qcom,mdss-dsc-bit-per-component = <8>;
+			qcom,mdss-dsc-bit-per-pixel = <8>;
+			qcom,mdss-dsc-block-prediction-enable;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-dsc-wqxga-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-dsc-wqxga-video.dtsi
new file mode 100644
index 000000000000..10713dd2490c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-dsc-wqxga-video.dtsi
@@ -0,0 +1,125 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_nt35597_dsc_video: qcom,mdss_dsi_nt35597_dsc_wqxga_video {
+		qcom,mdss-dsi-panel-name = "NT35597 video mode dsc dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1440>;
+		qcom,mdss-dsi-panel-height = <2560>;
+		qcom,mdss-dsi-h-front-porch = <100>;
+		qcom,mdss-dsi-h-back-porch = <32>;
+		qcom,mdss-dsi-h-pulse-width = <16>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <7>;
+		qcom,mdss-dsi-v-front-porch = <8>;
+		qcom,mdss-dsi-v-pulse-width = <1>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-panel-hdr-enabled;
+		qcom,mdss-dsi-panel-hdr-color-primaries = <14500 15500 32000
+			17000 15500 30000 8000 3000>;
+		qcom,mdss-dsi-panel-peak-brightness = <4200000>;
+		qcom,mdss-dsi-panel-blackness-level = <3230>;
+		qcom,mdss-dsi-on-command = [15 01 00 00 00 00 02 ff 10
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 ba 03
+			15 01 00 00 00 00 02 e5 01
+			15 01 00 00 00 00 02 b0 03
+			39 01 00 00 00 00 06 3B 03 08 08 2e 64
+			15 01 00 00 00 00 02 ff 28
+			15 01 00 00 00 00 02 7a 02
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 ff 10
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 c0 03
+			15 01 00 00 00 00 02 bb 03
+			15 01 00 00 00 00 02 ff e0
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 6b 3d
+			15 01 00 00 00 00 02 6c 3d
+			15 01 00 00 00 00 02 6d 3d
+			15 01 00 00 00 00 02 6e 3d
+			15 01 00 00 00 00 02 6f 3d
+			15 01 00 00 00 00 02 35 02
+			15 01 00 00 00 00 02 36 72
+			15 01 00 00 00 00 02 37 10
+			15 01 00 00 00 00 02 08 c0
+			15 01 00 00 00 00 02 ff 10
+			05 01 00 00 a0 00 01 11
+			05 01 00 00 00 00 01 29
+			07 01 00 00 0a 00 01 01];
+
+		qcom,mdss-dsi-off-command = [05 01 00 00 0a 00 02 28 00
+				 05 01 00 00 0a 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [e2 36 24 00 66 6a 28 38 2a 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0xb>;
+		qcom,mdss-dsi-t-clk-pre = <0x24>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+		qcom,mdss-pan-physical-width-dimension = <74>;
+		qcom,mdss-pan-physical-height-dimension = <131>;
+
+		qcom,compression-mode = "dsc";
+		qcom,config-select = <&dsi_nt35597_dsc_video_config0>;
+
+		dsi_nt35597_dsc_video_config0: config0 {
+			qcom,mdss-dsc-encoders = <1>;
+			qcom,mdss-dsc-slice-height = <16>;
+			qcom,mdss-dsc-slice-width = <720>;
+			qcom,mdss-dsc-slice-per-pkt = <2>;
+
+			qcom,mdss-dsc-bit-per-component = <8>;
+			qcom,mdss-dsc-bit-per-pixel = <8>;
+			qcom,mdss-dsc-block-prediction-enable;
+		};
+
+		dsi_nt35597_dsc_video_config1: config1 {
+			qcom,lm-split = <720 720>;
+			qcom,mdss-dsc-encoders = <1>; /* 3D Mux */
+			qcom,mdss-dsc-slice-height = <16>;
+			qcom,mdss-dsc-slice-width = <720>;
+			qcom,mdss-dsc-slice-per-pkt = <2>;
+
+			qcom,mdss-dsc-bit-per-component = <8>;
+			qcom,mdss-dsc-bit-per-pixel = <8>;
+			qcom,mdss-dsc-block-prediction-enable;
+		};
+
+		dsi_nt35597_dsc_video_config2: config2 {
+			qcom,lm-split = <720 720>;
+			qcom,mdss-dsc-encoders = <2>; /* DSC Merge */
+			qcom,mdss-dsc-slice-height = <16>;
+			qcom,mdss-dsc-slice-width = <720>;
+			qcom,mdss-dsc-slice-per-pkt = <2>;
+
+			qcom,mdss-dsc-bit-per-component = <8>;
+			qcom,mdss-dsc-bit-per-pixel = <8>;
+			qcom,mdss-dsc-block-prediction-enable;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-dualmipi-wqxga-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-dualmipi-wqxga-cmd.dtsi
new file mode 100644
index 000000000000..f4829eb7f799
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-dualmipi-wqxga-cmd.dtsi
@@ -0,0 +1,105 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_dual_nt35597_cmd: qcom,mdss_dsi_nt35597_wqxga_cmd{
+		qcom,mdss-dsi-panel-name =
+			"Dual nt35597 cmd mode dsi panel without DSC";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <720>;
+		qcom,mdss-dsi-panel-height = <2560>;
+		qcom,mdss-dsi-h-front-porch = <100>;
+		qcom,mdss-dsi-h-back-porch = <32>;
+		qcom,mdss-dsi-h-pulse-width = <16>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <7>;
+		qcom,mdss-dsi-v-front-porch = <8>;
+		qcom,mdss-dsi-v-pulse-width = <1>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-color-order = "rgb_swap_rgb";
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [cd 32 22 00 60 64 26 34 29 03
+									04 00];
+		qcom,adjust-timer-wakeup-ms = <1>;
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+		qcom,mdss-pan-physical-width-dimension = <74>;
+		qcom,mdss-pan-physical-height-dimension = <131>;
+		qcom,mdss-dsi-t-clk-post = <0x0d>;
+		qcom,mdss-dsi-t-clk-pre = <0x2d>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-wr-mem-start = <0x2c>;
+		qcom,mdss-dsi-wr-mem-continue = <0x3c>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+		qcom,ulps-enabled;
+		qcom,mdss-dsi-on-command = [15 01 00 00 10 00 02 ff 10
+			15 01 00 00 10 00 02 fb 01
+			15 01 00 00 10 00 02 ba 03
+			15 01 00 00 10 00 02 e5 01
+			15 01 00 00 10 00 02 35 00
+			15 01 00 00 10 00 02 bb 10
+			15 01 00 00 10 00 02 b0 03
+			15 01 00 00 10 00 02 ff e0
+			15 01 00 00 10 00 02 fb 01
+			15 01 00 00 10 00 02 6b 3d
+			15 01 00 00 10 00 02 6c 3d
+			15 01 00 00 10 00 02 6d 3d
+			15 01 00 00 10 00 02 6e 3d
+			15 01 00 00 10 00 02 6f 3d
+			15 01 00 00 10 00 02 35 02
+			15 01 00 00 10 00 02 36 72
+			15 01 00 00 10 00 02 37 10
+			15 01 00 00 10 00 02 08 c0
+			15 01 00 00 10 00 02 ff 24
+			15 01 00 00 10 00 02 fb 01
+			15 01 00 00 10 00 02 c6 06
+			15 01 00 00 10 00 02 ff 10
+			05 01 00 00 a0 00 02 11 00
+			05 01 00 00 a0 00 02 29 00];
+
+		qcom,mdss-dsi-off-command = [05 01 00 00 0a 00 02 28 00
+			05 01 00 00 3c 00 02 10 00];
+
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+
+		qcom,config-select = <&dsi_dual_nt35597_cmd_config0>;
+
+		dsi_dual_nt35597_cmd_config0: config0 {
+			qcom,split-mode = "dualctl-split";
+		};
+
+		dsi_dual_nt35597_cmd_config1: config1 {
+			qcom,split-mode = "pingpong-split";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-dualmipi-wqxga-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-dualmipi-wqxga-video.dtsi
new file mode 100644
index 000000000000..aa627b3e7c63
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-dualmipi-wqxga-video.dtsi
@@ -0,0 +1,94 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_dual_nt35597_video: qcom,mdss_dsi_nt35597_wqxga_video {
+		qcom,mdss-dsi-panel-name = "Dual nt35597 video mode dsi panel without DSC";
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <720>;
+		qcom,mdss-dsi-panel-height = <2560>;
+		qcom,mdss-dsi-h-front-porch = <100>;
+		qcom,mdss-dsi-h-back-porch = <32>;
+		qcom,mdss-dsi-h-pulse-width = <16>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <7>;
+		qcom,mdss-dsi-v-front-porch = <8>;
+		qcom,mdss-dsi-v-pulse-width = <1>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0x3ff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-panel-hdr-enabled;
+		qcom,mdss-dsi-panel-hdr-color-primaries = <14500 15500 32000
+			17000 15500 30000 8000 3000>;
+		qcom,mdss-dsi-panel-peak-brightness = <4200000>;
+		qcom,mdss-dsi-panel-blackness-level = <3230>;
+		qcom,mdss-dsi-on-command = [15 01 00 00 00 00 02 ff 10
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 ba 03
+			15 01 00 00 00 00 02 e5 01
+			15 01 00 00 00 00 02 35 00
+			15 01 00 00 00 00 02 bb 03
+			15 01 00 00 00 00 02 b0 03
+			39 01 00 00 00 00 06 3b 03 08 08 64 9a
+			15 01 00 00 00 00 02 ff e0
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 6b 3d
+			15 01 00 00 00 00 02 6c 3d
+			15 01 00 00 00 00 02 6d 3d
+			15 01 00 00 00 00 02 6e 3d
+			15 01 00 00 00 00 02 6f 3d
+			15 01 00 00 00 00 02 35 02
+			15 01 00 00 00 00 02 36 72
+			15 01 00 00 00 00 02 37 10
+			15 01 00 00 00 00 02 08 c0
+			15 01 00 00 00 00 02 ff 10
+			05 01 00 00 78 00 02 11 00
+			05 01 00 00 32 00 02 29 00];
+		qcom,mdss-dsi-off-command = [05 01 00 00 0a 00 02 28 00
+				 05 01 00 00 3c 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [e2 36 24 00 66 6a 28 38 2a 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x0d>;
+		qcom,mdss-dsi-t-clk-pre = <0x2d>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+		qcom,mdss-pan-physical-width-dimension = <74>;
+		qcom,mdss-pan-physical-height-dimension = <131>;
+		qcom,mdss-dsi-min-refresh-rate = <55>;
+		qcom,mdss-dsi-max-refresh-rate = <60>;
+		qcom,mdss-dsi-pan-enable-dynamic-fps;
+		qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
+
+		qcom,config-select = <&dsi_dual_nt35597_video_config0>;
+
+		dsi_dual_nt35597_video_config0: config0 {
+			qcom,split-mode = "dualctl-split";
+		};
+
+		dsi_dual_nt35597_video_config1: config1 {
+			qcom,split-mode = "pingpong-split";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-truly-dsc-wqxga-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-truly-dsc-wqxga-cmd.dtsi
new file mode 100644
index 000000000000..615118f5413d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-truly-dsc-wqxga-cmd.dtsi
@@ -0,0 +1,267 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_nt35597_truly_dsc_cmd: qcom,mdss_dsi_nt35597_dsc_cmd_truly {
+		qcom,mdss-dsi-panel-name =
+			"nt35597 cmd mode dsi truly panel with DSC";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1440>;
+		qcom,mdss-dsi-panel-height = <2560>;
+		qcom,mdss-dsi-h-front-porch = <100>;
+		qcom,mdss-dsi-h-back-porch = <32>;
+		qcom,mdss-dsi-h-pulse-width = <16>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <8>;
+		qcom,mdss-dsi-v-front-porch = <10>;
+		qcom,mdss-dsi-v-pulse-width = <2>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-color-order = "rgb_swap_rgb";
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [
+			/* CMD2_P0 */
+			15 01 00 00 00 00 02 ff 20
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 00 01
+			15 01 00 00 00 00 02 01 55
+			15 01 00 00 00 00 02 02 45
+			15 01 00 00 00 00 02 05 40
+			15 01 00 00 00 00 02 06 19
+			15 01 00 00 00 00 02 07 1e
+			15 01 00 00 00 00 02 0b 73
+			15 01 00 00 00 00 02 0c 73
+			15 01 00 00 00 00 02 0e b0
+			15 01 00 00 00 00 02 0f ae
+			15 01 00 00 00 00 02 11 b8
+			15 01 00 00 00 00 02 13 00
+			15 01 00 00 00 00 02 58 80
+			15 01 00 00 00 00 02 59 01
+			15 01 00 00 00 00 02 5a 00
+			15 01 00 00 00 00 02 5b 01
+			15 01 00 00 00 00 02 5c 80
+			15 01 00 00 00 00 02 5d 81
+			15 01 00 00 00 00 02 5e 00
+			15 01 00 00 00 00 02 5f 01
+			15 01 00 00 00 00 02 72 11
+			15 01 00 00 00 00 02 68 03
+			/* CMD2_P4 */
+			15 01 00 00 00 00 02 ff 24
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 00 1c
+			15 01 00 00 00 00 02 01 0b
+			15 01 00 00 00 00 02 02 0c
+			15 01 00 00 00 00 02 03 01
+			15 01 00 00 00 00 02 04 0f
+			15 01 00 00 00 00 02 05 10
+			15 01 00 00 00 00 02 06 10
+			15 01 00 00 00 00 02 07 10
+			15 01 00 00 00 00 02 08 89
+			15 01 00 00 00 00 02 09 8a
+			15 01 00 00 00 00 02 0a 13
+			15 01 00 00 00 00 02 0b 13
+			15 01 00 00 00 00 02 0c 15
+			15 01 00 00 00 00 02 0d 15
+			15 01 00 00 00 00 02 0e 17
+			15 01 00 00 00 00 02 0f 17
+			15 01 00 00 00 00 02 10 1c
+			15 01 00 00 00 00 02 11 0b
+			15 01 00 00 00 00 02 12 0c
+			15 01 00 00 00 00 02 13 01
+			15 01 00 00 00 00 02 14 0f
+			15 01 00 00 00 00 02 15 10
+			15 01 00 00 00 00 02 16 10
+			15 01 00 00 00 00 02 17 10
+			15 01 00 00 00 00 02 18 89
+			15 01 00 00 00 00 02 19 8a
+			15 01 00 00 00 00 02 1a 13
+			15 01 00 00 00 00 02 1b 13
+			15 01 00 00 00 00 02 1c 15
+			15 01 00 00 00 00 02 1d 15
+			15 01 00 00 00 00 02 1e 17
+			15 01 00 00 00 00 02 1f 17
+			/* STV */
+			15 01 00 00 00 00 02 20 40
+			15 01 00 00 00 00 02 21 01
+			15 01 00 00 00 00 02 22 00
+			15 01 00 00 00 00 02 23 40
+			15 01 00 00 00 00 02 24 40
+			15 01 00 00 00 00 02 25 6d
+			15 01 00 00 00 00 02 26 40
+			15 01 00 00 00 00 02 27 40
+			/* Vend */
+			15 01 00 00 00 00 02 e0 00
+			15 01 00 00 00 00 02 dc 21
+			15 01 00 00 00 00 02 dd 22
+			15 01 00 00 00 00 02 de 07
+			15 01 00 00 00 00 02 df 07
+			15 01 00 00 00 00 02 e3 6D
+			15 01 00 00 00 00 02 e1 07
+			15 01 00 00 00 00 02 e2 07
+			/* UD */
+			15 01 00 00 00 00 02 29 d8
+			15 01 00 00 00 00 02 2a 2a
+			/* CLK */
+			15 01 00 00 00 00 02 4b 03
+			15 01 00 00 00 00 02 4c 11
+			15 01 00 00 00 00 02 4d 10
+			15 01 00 00 00 00 02 4e 01
+			15 01 00 00 00 00 02 4f 01
+			15 01 00 00 00 00 02 50 10
+			15 01 00 00 00 00 02 51 00
+			15 01 00 00 00 00 02 52 80
+			15 01 00 00 00 00 02 53 00
+			15 01 00 00 00 00 02 56 00
+			15 01 00 00 00 00 02 54 07
+			15 01 00 00 00 00 02 58 07
+			15 01 00 00 00 00 02 55 25
+			/* Reset XDONB */
+			15 01 00 00 00 00 02 5b 43
+			15 01 00 00 00 00 02 5c 00
+			15 01 00 00 00 00 02 5f 73
+			15 01 00 00 00 00 02 60 73
+			15 01 00 00 00 00 02 63 22
+			15 01 00 00 00 00 02 64 00
+			15 01 00 00 00 00 02 67 08
+			15 01 00 00 00 00 02 68 04
+			/* Resolution:1440x2560*/
+			15 01 00 00 00 00 02 72 02
+			/* mux */
+			15 01 00 00 00 00 02 7a 80
+			15 01 00 00 00 00 02 7b 91
+			15 01 00 00 00 00 02 7c D8
+			15 01 00 00 00 00 02 7d 60
+			15 01 00 00 00 00 02 7f 15
+			15 01 00 00 00 00 02 75 15
+			/* ABOFF */
+			15 01 00 00 00 00 02 b3 C0
+			15 01 00 00 00 00 02 b4 00
+			15 01 00 00 00 00 02 b5 00
+			/* Source EQ */
+			15 01 00 00 00 00 02 78 00
+			15 01 00 00 00 00 02 79 00
+			15 01 00 00 00 00 02 80 00
+			15 01 00 00 00 00 02 83 00
+			/* FP BP */
+			15 01 00 00 00 00 02 93 0a
+			15 01 00 00 00 00 02 94 0a
+			/* Inversion Type */
+			15 01 00 00 00 00 02 8a 00
+			15 01 00 00 00 00 02 9b ff
+			/* IMGSWAP =1 @PortSwap=1 */
+			15 01 00 00 00 00 02 9d b0
+			15 01 00 00 00 00 02 9f 63
+			15 01 00 00 00 00 02 98 10
+			/* FRM */
+			15 01 00 00 00 00 02 ec 00
+			/* CMD1 */
+			15 01 00 00 00 00 02 ff 10
+			/* VESA DSC PPS settings(1440x2560 slide 16H) */
+			39 01 00 00 00 00 11 c1 09 20 00 10 02 00 02 68
+					01 bb 00 0a 06 67 04 c5
+			39 01 00 00 00 00 03 c2 10 f0
+			/* C0h = 0x0(2 Port SDC)0x01(1 PortA FBC)
+			 * 0x02(MTK) 0x03(1 PortA VESA)
+			 */
+			15 01 00 00 00 00 02 c0 03
+			/* VBP+VSA=,VFP = 10H */
+			15 01 00 00 00 00 04 3b 03 0a 0a
+			/* FTE on */
+			15 01 00 00 00 00 02 35 00
+			/* EN_BK =1(auto black) */
+			15 01 00 00 00 00 02 e5 01
+			/* CMD mode(10) VDO mode(03) */
+			15 01 00 00 00 00 02 bb 10
+			/* Non Reload MTP */
+			15 01 00 00 00 00 02 fb 01
+			/* SlpOut + DispOn */
+			05 01 00 00 78 00 02 11 00
+			05 01 00 00 78 00 02 29 00
+			];
+		qcom,mdss-dsi-off-command = [05 01 00 00 78 00 02 28 00
+			05 01 00 00 78 00 02 10 00];
+
+		qcom,mdss-dsi-on-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [cd 32 22 00 60 64 26 34 29 03
+								04 00];
+		qcom,mdss-dsi-t-clk-post = <0x0b>;
+		qcom,mdss-dsi-t-clk-pre = <0x23>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+		qcom,mdss-dsi-tx-eot-append;
+
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,adjust-timer-wakeup-ms = <1>;
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-wr-mem-start = <0x2c>;
+		qcom,mdss-dsi-wr-mem-continue = <0x3c>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+		qcom,ulps-enabled;
+
+		qcom,compression-mode = "dsc";
+		qcom,config-select = <&dsi_nt35597_truly_dsc_cmd_config0>;
+
+		dsi_nt35597_truly_dsc_cmd_config0: config0 {
+			qcom,mdss-dsc-encoders = <1>;
+			qcom,mdss-dsc-slice-height = <16>;
+			qcom,mdss-dsc-slice-width = <720>;
+			qcom,mdss-dsc-slice-per-pkt = <2>;
+
+			qcom,mdss-dsc-bit-per-component = <8>;
+			qcom,mdss-dsc-bit-per-pixel = <8>;
+			qcom,mdss-dsc-block-prediction-enable;
+		};
+
+		dsi_nt35597_truly_dsc_cmd_config1: config1 {
+			qcom,lm-split = <720 720>;
+			qcom,mdss-dsc-encoders = <1>; /* 3D Mux */
+			qcom,mdss-dsc-slice-height = <16>;
+			qcom,mdss-dsc-slice-width = <720>;
+			qcom,mdss-dsc-slice-per-pkt = <2>;
+
+			qcom,mdss-dsc-bit-per-component = <8>;
+			qcom,mdss-dsc-bit-per-pixel = <8>;
+			qcom,mdss-dsc-block-prediction-enable;
+		};
+
+		dsi_nt35597_truly_dsc_cmd_config2: config2 {
+			qcom,lm-split = <720 720>;
+			qcom,mdss-dsc-encoders = <2>; /* DSC Merge */
+			qcom,mdss-dsc-slice-height = <16>;
+			qcom,mdss-dsc-slice-width = <720>;
+			qcom,mdss-dsc-slice-per-pkt = <2>;
+
+			qcom,mdss-dsc-bit-per-component = <8>;
+			qcom,mdss-dsc-bit-per-pixel = <8>;
+			qcom,mdss-dsc-block-prediction-enable;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-truly-dsc-wqxga-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-truly-dsc-wqxga-video.dtsi
new file mode 100644
index 000000000000..0a9ef5ee14b6
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-truly-dsc-wqxga-video.dtsi
@@ -0,0 +1,253 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_nt35597_truly_dsc_video: qcom,mdss_dsi_nt35597_dsc_video_truly {
+		qcom,mdss-dsi-panel-name =
+			"nt35597 video mode dsi truly panel with DSC";
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1440>;
+		qcom,mdss-dsi-panel-height = <2560>;
+		qcom,mdss-dsi-h-front-porch = <100>;
+		qcom,mdss-dsi-h-back-porch = <32>;
+		qcom,mdss-dsi-h-pulse-width = <16>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <8>;
+		qcom,mdss-dsi-v-front-porch = <10>;
+		qcom,mdss-dsi-v-pulse-width = <2>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [
+			/* CMD2_P0 */
+			15 01 00 00 00 00 02 ff 20
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 00 01
+			15 01 00 00 00 00 02 01 55
+			15 01 00 00 00 00 02 02 45
+			15 01 00 00 00 00 02 05 40
+			15 01 00 00 00 00 02 06 19
+			15 01 00 00 00 00 02 07 1e
+			15 01 00 00 00 00 02 0b 73
+			15 01 00 00 00 00 02 0c 73
+			15 01 00 00 00 00 02 0e b0
+			15 01 00 00 00 00 02 0f aE
+			15 01 00 00 00 00 02 11 b8
+			15 01 00 00 00 00 02 13 00
+			15 01 00 00 00 00 02 58 80
+			15 01 00 00 00 00 02 59 01
+			15 01 00 00 00 00 02 5a 00
+			15 01 00 00 00 00 02 5b 01
+			15 01 00 00 00 00 02 5c 80
+			15 01 00 00 00 00 02 5d 81
+			15 01 00 00 00 00 02 5e 00
+			15 01 00 00 00 00 02 5f 01
+			15 01 00 00 00 00 02 72 11
+			15 01 00 00 00 00 02 68 03
+			/* CMD2_P4 */
+			15 01 00 00 00 00 02 ff 24
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 00 1c
+			15 01 00 00 00 00 02 01 0b
+			15 01 00 00 00 00 02 02 0c
+			15 01 00 00 00 00 02 03 01
+			15 01 00 00 00 00 02 04 0f
+			15 01 00 00 00 00 02 05 10
+			15 01 00 00 00 00 02 06 10
+			15 01 00 00 00 00 02 07 10
+			15 01 00 00 00 00 02 08 89
+			15 01 00 00 00 00 02 09 8a
+			15 01 00 00 00 00 02 0a 13
+			15 01 00 00 00 00 02 0b 13
+			15 01 00 00 00 00 02 0c 15
+			15 01 00 00 00 00 02 0d 15
+			15 01 00 00 00 00 02 0e 17
+			15 01 00 00 00 00 02 0f 17
+			15 01 00 00 00 00 02 10 1c
+			15 01 00 00 00 00 02 11 0b
+			15 01 00 00 00 00 02 12 0c
+			15 01 00 00 00 00 02 13 01
+			15 01 00 00 00 00 02 14 0f
+			15 01 00 00 00 00 02 15 10
+			15 01 00 00 00 00 02 16 10
+			15 01 00 00 00 00 02 17 10
+			15 01 00 00 00 00 02 18 89
+			15 01 00 00 00 00 02 19 8a
+			15 01 00 00 00 00 02 1a 13
+			15 01 00 00 00 00 02 1b 13
+			15 01 00 00 00 00 02 1c 15
+			15 01 00 00 00 00 02 1d 15
+			15 01 00 00 00 00 02 1e 17
+			15 01 00 00 00 00 02 1f 17
+			/* STV */
+			15 01 00 00 00 00 02 20 40
+			15 01 00 00 00 00 02 21 01
+			15 01 00 00 00 00 02 22 00
+			15 01 00 00 00 00 02 23 40
+			15 01 00 00 00 00 02 24 40
+			15 01 00 00 00 00 02 25 6d
+			15 01 00 00 00 00 02 26 40
+			15 01 00 00 00 00 02 27 40
+			/* Vend */
+			15 01 00 00 00 00 02 e0 00
+			15 01 00 00 00 00 02 dc 21
+			15 01 00 00 00 00 02 dd 22
+			15 01 00 00 00 00 02 de 07
+			15 01 00 00 00 00 02 df 07
+			15 01 00 00 00 00 02 e3 6d
+			15 01 00 00 00 00 02 e1 07
+			15 01 00 00 00 00 02 e2 07
+			/* UD */
+			15 01 00 00 00 00 02 29 d8
+			15 01 00 00 00 00 02 2a 2a
+			/* CLK */
+			15 01 00 00 00 00 02 4b 03
+			15 01 00 00 00 00 02 4c 11
+			15 01 00 00 00 00 02 4d 10
+			15 01 00 00 00 00 02 4e 01
+			15 01 00 00 00 00 02 4f 01
+			15 01 00 00 00 00 02 50 10
+			15 01 00 00 00 00 02 51 00
+			15 01 00 00 00 00 02 52 80
+			15 01 00 00 00 00 02 53 00
+			15 01 00 00 00 00 02 56 00
+			15 01 00 00 00 00 02 54 07
+			15 01 00 00 00 00 02 58 07
+			15 01 00 00 00 00 02 55 25
+			/* Reset XDONB */
+			15 01 00 00 00 00 02 5b 43
+			15 01 00 00 00 00 02 5c 00
+			15 01 00 00 00 00 02 5f 73
+			15 01 00 00 00 00 02 60 73
+			15 01 00 00 00 00 02 63 22
+			15 01 00 00 00 00 02 64 00
+			15 01 00 00 00 00 02 67 08
+			15 01 00 00 00 00 02 68 04
+			/* Resolution:1440x2560*/
+			15 01 00 00 00 00 02 72 02
+			/* mux */
+			15 01 00 00 00 00 02 7a 80
+			15 01 00 00 00 00 02 7b 91
+			15 01 00 00 00 00 02 7c d8
+			15 01 00 00 00 00 02 7d 60
+			15 01 00 00 00 00 02 7f 15
+			15 01 00 00 00 00 02 75 15
+			/* ABOFF */
+			15 01 00 00 00 00 02 b3 c0
+			15 01 00 00 00 00 02 b4 00
+			15 01 00 00 00 00 02 b5 00
+			/* Source EQ */
+			15 01 00 00 00 00 02 78 00
+			15 01 00 00 00 00 02 79 00
+			15 01 00 00 00 00 02 80 00
+			15 01 00 00 00 00 02 83 00
+			/* FP BP */
+			15 01 00 00 00 00 02 93 0a
+			15 01 00 00 00 00 02 94 0a
+			/* Inversion Type */
+			15 01 00 00 00 00 02 8a 00
+			15 01 00 00 00 00 02 9b ff
+			/* IMGSWAP =1 @PortSwap=1 */
+			15 01 00 00 00 00 02 9d b0
+			15 01 00 00 00 00 02 9f 63
+			15 01 00 00 00 00 02 98 10
+			/* FRM */
+			15 01 00 00 00 00 02 ec 00
+			/* CMD1 */
+			15 01 00 00 00 00 02 ff 10
+			/* VESA DSC PPS settings(1440x2560 slide 16H) */
+			39 01 00 00 00 00 11 c1 09 20 00 10 02 00 02 68 01
+				bb 00 0a 06 67 04 c5
+			39 01 00 00 00 00 03 c2 10 f0
+			/* C0h = 0x00(2 Port SDC); 0x01(1 PortA FBC);
+			 * 0x02(MTK); 0x03(1 PortA VESA)
+			 */
+			15 01 00 00 00 00 02 c0 03
+			/* VBP+VSA=,VFP = 10H */
+			39 01 00 00 00 00 04 3b 03 0a 0a
+			/* FTE on */
+			15 01 00 00 00 00 02 35 00
+			/* EN_BK =1(auto black) */
+			15 01 00 00 00 00 02 e5 01
+			/* CMD mode(10) VDO mode(03) */
+			15 01 00 00 00 00 02 bb 03
+			/* Non Reload MTP */
+			15 01 00 00 00 00 02 fb 01
+			/* SlpOut + DispOn */
+			05 01 00 00 78 00 02 11 00
+			05 01 00 00 78 00 02 29 00
+			];
+		qcom,mdss-dsi-off-command = [05 01 00 00 78 00 02 28 00
+				 05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [00 11 04 04 07 0c 04 04 03 03
+								04 00];
+		qcom,mdss-dsi-t-clk-post = <0xb>;
+		qcom,mdss-dsi-t-clk-pre = <0x23>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+		qcom,mdss-dsi-tx-eot-append;
+		qcom,mdss-pan-physical-width-dimension = <74>;
+		qcom,mdss-pan-physical-height-dimension = <131>;
+
+		qcom,compression-mode = "dsc";
+		qcom,config-select = <&dsi_nt35597_truly_dsc_video_config0>;
+
+		dsi_nt35597_truly_dsc_video_config0: config0 {
+			qcom,mdss-dsc-encoders = <1>;
+			qcom,mdss-dsc-slice-height = <16>;
+			qcom,mdss-dsc-slice-width = <720>;
+			qcom,mdss-dsc-slice-per-pkt = <2>;
+
+			qcom,mdss-dsc-bit-per-component = <8>;
+			qcom,mdss-dsc-bit-per-pixel = <8>;
+			qcom,mdss-dsc-block-prediction-enable;
+		};
+
+		dsi_nt35597_truly_dsc_video_config1: config1 {
+			qcom,lm-split = <720 720>;
+			qcom,mdss-dsc-encoders = <1>; /* 3D Mux */
+			qcom,mdss-dsc-slice-height = <16>;
+			qcom,mdss-dsc-slice-width = <720>;
+			qcom,mdss-dsc-slice-per-pkt = <2>;
+
+			qcom,mdss-dsc-bit-per-component = <8>;
+			qcom,mdss-dsc-bit-per-pixel = <8>;
+			qcom,mdss-dsc-block-prediction-enable;
+		};
+
+		dsi_nt35597_truly_dsc_video_config2: config2 {
+			qcom,lm-split = <720 720>;
+			qcom,mdss-dsc-encoders = <2>; /* DSC Merge */
+			qcom,mdss-dsc-slice-height = <16>;
+			qcom,mdss-dsc-slice-width = <720>;
+			qcom,mdss-dsc-slice-per-pkt = <2>;
+
+			qcom,mdss-dsc-bit-per-component = <8>;
+			qcom,mdss-dsc-bit-per-pixel = <8>;
+			qcom,mdss-dsc-block-prediction-enable;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-truly-dualmipi-wqxga-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-truly-dualmipi-wqxga-cmd.dtsi
new file mode 100644
index 000000000000..8d867bb697be
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-truly-dualmipi-wqxga-cmd.dtsi
@@ -0,0 +1,228 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_dual_nt35597_truly_cmd: qcom,mdss_dsi_nt35597_truly_wqxga_cmd{
+		qcom,mdss-dsi-panel-name =
+			"Dual nt35597 cmd mode dsi truly panel without DSC";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <720>;
+		qcom,mdss-dsi-panel-height = <2560>;
+		qcom,mdss-dsi-h-front-porch = <100>;
+		qcom,mdss-dsi-h-back-porch = <32>;
+		qcom,mdss-dsi-h-pulse-width = <16>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <7>;
+		qcom,mdss-dsi-v-front-porch = <8>;
+		qcom,mdss-dsi-v-pulse-width = <1>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-color-order = "rgb_swap_rgb";
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [cd 32 22 00 60 64 26 34 29 03
+									04 00];
+		qcom,adjust-timer-wakeup-ms = <1>;
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+		qcom,mdss-dsi-tx-eot-append;
+		qcom,mdss-dsi-t-clk-post = <0x0d>;
+		qcom,mdss-dsi-t-clk-pre = <0x2d>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-wr-mem-start = <0x2c>;
+		qcom,mdss-dsi-wr-mem-continue = <0x3c>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+		qcom,ulps-enabled;
+		qcom,mdss-dsi-on-command = [
+			/* CMD2_P0 */
+			15 01 00 00 00 00 02 FF 20
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 00 01
+			15 01 00 00 00 00 02 01 55
+			15 01 00 00 00 00 02 02 45
+			15 01 00 00 00 00 02 05 40
+			15 01 00 00 00 00 02 06 19
+			15 01 00 00 00 00 02 07 1E
+			15 01 00 00 00 00 02 0B 73
+			15 01 00 00 00 00 02 0C 73
+			15 01 00 00 00 00 02 0E B0
+			15 01 00 00 00 00 02 0F AE
+			15 01 00 00 00 00 02 11 B8
+			15 01 00 00 00 00 02 13 00
+			15 01 00 00 00 00 02 58 80
+			15 01 00 00 00 00 02 59 01
+			15 01 00 00 00 00 02 5A 00
+			15 01 00 00 00 00 02 5B 01
+			15 01 00 00 00 00 02 5C 80
+			15 01 00 00 00 00 02 5D 81
+			15 01 00 00 00 00 02 5E 00
+			15 01 00 00 00 00 02 5F 01
+			15 01 00 00 00 00 02 72 11
+			15 01 00 00 00 00 02 68 03
+			/* CMD2_P4 */
+			15 01 00 00 00 00 02 ff 24
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 00 1C
+			15 01 00 00 00 00 02 01 0B
+			15 01 00 00 00 00 02 02 0C
+			15 01 00 00 00 00 02 03 01
+			15 01 00 00 00 00 02 04 0F
+			15 01 00 00 00 00 02 05 10
+			15 01 00 00 00 00 02 06 10
+			15 01 00 00 00 00 02 07 10
+			15 01 00 00 00 00 02 08 89
+			15 01 00 00 00 00 02 09 8A
+			15 01 00 00 00 00 02 0A 13
+			15 01 00 00 00 00 02 0B 13
+			15 01 00 00 00 00 02 0C 15
+			15 01 00 00 00 00 02 0D 15
+			15 01 00 00 00 00 02 0E 17
+			15 01 00 00 00 00 02 0F 17
+			15 01 00 00 00 00 02 10 1C
+			15 01 00 00 00 00 02 11 0B
+			15 01 00 00 00 00 02 12 0C
+			15 01 00 00 00 00 02 13 01
+			15 01 00 00 00 00 02 14 0F
+			15 01 00 00 00 00 02 15 10
+			15 01 00 00 00 00 02 16 10
+			15 01 00 00 00 00 02 17 10
+			15 01 00 00 00 00 02 18 89
+			15 01 00 00 00 00 02 19 8A
+			15 01 00 00 00 00 02 1A 13
+			15 01 00 00 00 00 02 1B 13
+			15 01 00 00 00 00 02 1C 15
+			15 01 00 00 00 00 02 1D 15
+			15 01 00 00 00 00 02 1E 17
+			15 01 00 00 00 00 02 1F 17
+			/* STV */
+			15 01 00 00 00 00 02 20 40
+			15 01 00 00 00 00 02 21 01
+			15 01 00 00 00 00 02 22 00
+			15 01 00 00 00 00 02 23 40
+			15 01 00 00 00 00 02 24 40
+			15 01 00 00 00 00 02 25 6D
+			15 01 00 00 00 00 02 26 40
+			15 01 00 00 00 00 02 27 40
+			/* Vend */
+			15 01 00 00 00 00 02 E0 00
+			15 01 00 00 00 00 02 DC 21
+			15 01 00 00 00 00 02 DD 22
+			15 01 00 00 00 00 02 DE 07
+			15 01 00 00 00 00 02 DF 07
+			15 01 00 00 00 00 02 E3 6D
+			15 01 00 00 00 00 02 E1 07
+			15 01 00 00 00 00 02 E2 07
+			/* UD */
+			15 01 00 00 00 00 02 29 D8
+			15 01 00 00 00 00 02 2A 2A
+			/* CLK */
+			15 01 00 00 00 00 02 4B 03
+			15 01 00 00 00 00 02 4C 11
+			15 01 00 00 00 00 02 4D 10
+			15 01 00 00 00 00 02 4E 01
+			15 01 00 00 00 00 02 4F 01
+			15 01 00 00 00 00 02 50 10
+			15 01 00 00 00 00 02 51 00
+			15 01 00 00 00 00 02 52 80
+			15 01 00 00 00 00 02 53 00
+			15 01 00 00 00 00 02 56 00
+			15 01 00 00 00 00 02 54 07
+			15 01 00 00 00 00 02 58 07
+			15 01 00 00 00 00 02 55 25
+			/* Reset XDONB */
+			15 01 00 00 00 00 02 5B 43
+			15 01 00 00 00 00 02 5C 00
+			15 01 00 00 00 00 02 5F 73
+			15 01 00 00 00 00 02 60 73
+			15 01 00 00 00 00 02 63 22
+			15 01 00 00 00 00 02 64 00
+			15 01 00 00 00 00 02 67 08
+			15 01 00 00 00 00 02 68 04
+			/* Resolution:1440x2560*/
+			15 01 00 00 00 00 02 72 02
+			/* mux */
+			15 01 00 00 00 00 02 7A 80
+			15 01 00 00 00 00 02 7B 91
+			15 01 00 00 00 00 02 7C D8
+			15 01 00 00 00 00 02 7D 60
+			15 01 00 00 00 00 02 7F 15
+			15 01 00 00 00 00 02 75 15
+			/* ABOFF */
+			15 01 00 00 00 00 02 B3 C0
+			15 01 00 00 00 00 02 B4 00
+			15 01 00 00 00 00 02 B5 00
+			/* Source EQ */
+			15 01 00 00 00 00 02 78 00
+			15 01 00 00 00 00 02 79 00
+			15 01 00 00 00 00 02 80 00
+			15 01 00 00 00 00 02 83 00
+			/* FP BP */
+			15 01 00 00 00 00 02 93 0A
+			15 01 00 00 00 00 02 94 0A
+			/* Inversion Type */
+			15 01 00 00 00 00 02 8A 00
+			15 01 00 00 00 00 02 9B FF
+			/* IMGSWAP =1 @PortSwap=1 */
+			15 01 00 00 00 00 02 9D B0
+			15 01 00 00 00 00 02 9F 63
+			15 01 00 00 00 00 02 98 10
+			/* FRM */
+			15 01 00 00 00 00 02 EC 00
+			/* CMD1 */
+			15 01 00 00 00 00 02 ff 10
+			/* VBP+VSA=,VFP = 10H */
+			15 01 00 00 00 00 04 3B 03 0A 0A
+			/* FTE on */
+			15 01 00 00 00 00 02 35 00
+			/* EN_BK =1(auto black) */
+			15 01 00 00 00 00 02 E5 01
+			/* CMD mode(10) VDO mode(03) */
+			15 01 00 00 00 00 02 BB 10
+			/* Non Reload MTP */
+			15 01 00 00 00 00 02 FB 01
+			/* SlpOut + DispOn */
+			05 01 00 00 78 00 02 11 00
+			05 01 00 00 78 00 02 29 00
+			];
+		qcom,mdss-dsi-off-command = [05 01 00 00 78 00 02 28 00
+			05 01 00 00 78 00 02 10 00];
+
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-pan-physical-width-dimension = <74>;
+		qcom,mdss-pan-physical-height-dimension = <131>;
+
+		qcom,config-select = <&dsi_dual_nt35597_truly_cmd_config0>;
+
+		dsi_dual_nt35597_truly_cmd_config0: config0 {
+			qcom,split-mode = "dualctl-split";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-truly-dualmipi-wqxga-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-truly-dualmipi-wqxga-video.dtsi
new file mode 100644
index 000000000000..339d87f66d2f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-nt35597-truly-dualmipi-wqxga-video.dtsi
@@ -0,0 +1,215 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_dual_nt35597_truly_video: qcom,mdss_dsi_nt35597_wqxga_video_truly {
+		qcom,mdss-dsi-panel-name =
+			"Dual nt35597 video mode dsi truly panel without DSC";
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <720>;
+		qcom,mdss-dsi-panel-height = <2560>;
+		qcom,mdss-dsi-h-front-porch = <100>;
+		qcom,mdss-dsi-h-back-porch = <32>;
+		qcom,mdss-dsi-h-pulse-width = <16>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <7>;
+		qcom,mdss-dsi-v-front-porch = <8>;
+		qcom,mdss-dsi-v-pulse-width = <1>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0x3ff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [
+			/* CMD2_P0 */
+			15 01 00 00 00 00 02 FF 20
+			15 01 00 00 00 00 02 FB 01
+			15 01 00 00 00 00 02 00 01
+			15 01 00 00 00 00 02 01 55
+			15 01 00 00 00 00 02 02 45
+			15 01 00 00 00 00 02 05 40
+			15 01 00 00 00 00 02 06 19
+			15 01 00 00 00 00 02 07 1E
+			15 01 00 00 00 00 02 0B 73
+			15 01 00 00 00 00 02 0C 73
+			15 01 00 00 00 00 02 0E B0
+			15 01 00 00 00 00 02 0F AE
+			15 01 00 00 00 00 02 11 B8
+			15 01 00 00 00 00 02 13 00
+			15 01 00 00 00 00 02 58 80
+			15 01 00 00 00 00 02 59 01
+			15 01 00 00 00 00 02 5A 00
+			15 01 00 00 00 00 02 5B 01
+			15 01 00 00 00 00 02 5C 80
+			15 01 00 00 00 00 02 5D 81
+			15 01 00 00 00 00 02 5E 00
+			15 01 00 00 00 00 02 5F 01
+			15 01 00 00 00 00 02 72 11
+			15 01 00 00 00 00 02 68 03
+			/* CMD2_P4 */
+			15 01 00 00 00 00 02 FF 24
+			15 01 00 00 00 00 02 FB 01
+			15 01 00 00 00 00 02 00 1C
+			15 01 00 00 00 00 02 01 0B
+			15 01 00 00 00 00 02 02 0C
+			15 01 00 00 00 00 02 03 01
+			15 01 00 00 00 00 02 04 0F
+			15 01 00 00 00 00 02 05 10
+			15 01 00 00 00 00 02 06 10
+			15 01 00 00 00 00 02 07 10
+			15 01 00 00 00 00 02 08 89
+			15 01 00 00 00 00 02 09 8A
+			15 01 00 00 00 00 02 0A 13
+			15 01 00 00 00 00 02 0B 13
+			15 01 00 00 00 00 02 0C 15
+			15 01 00 00 00 00 02 0D 15
+			15 01 00 00 00 00 02 0E 17
+			15 01 00 00 00 00 02 0F 17
+			15 01 00 00 00 00 02 10 1C
+			15 01 00 00 00 00 02 11 0B
+			15 01 00 00 00 00 02 12 0C
+			15 01 00 00 00 00 02 13 01
+			15 01 00 00 00 00 02 14 0F
+			15 01 00 00 00 00 02 15 10
+			15 01 00 00 00 00 02 16 10
+			15 01 00 00 00 00 02 17 10
+			15 01 00 00 00 00 02 18 89
+			15 01 00 00 00 00 02 19 8A
+			15 01 00 00 00 00 02 1A 13
+			15 01 00 00 00 00 02 1B 13
+			15 01 00 00 00 00 02 1C 15
+			15 01 00 00 00 00 02 1D 15
+			15 01 00 00 00 00 02 1E 17
+			15 01 00 00 00 00 02 1F 17
+			/* STV */
+			15 01 00 00 00 00 02 20 40
+			15 01 00 00 00 00 02 21 01
+			15 01 00 00 00 00 02 22 00
+			15 01 00 00 00 00 02 23 40
+			15 01 00 00 00 00 02 24 40
+			15 01 00 00 00 00 02 25 6D
+			15 01 00 00 00 00 02 26 40
+			15 01 00 00 00 00 02 27 40
+			/* Vend */
+			15 01 00 00 00 00 02 E0 00
+			15 01 00 00 00 00 02 DC 21
+			15 01 00 00 00 00 02 DD 22
+			15 01 00 00 00 00 02 DE 07
+			15 01 00 00 00 00 02 DF 07
+			15 01 00 00 00 00 02 E3 6D
+			15 01 00 00 00 00 02 E1 07
+			15 01 00 00 00 00 02 E2 07
+			/* UD */
+			15 01 00 00 00 00 02 29 D8
+			15 01 00 00 00 00 02 2A 2A
+			/* CLK */
+			15 01 00 00 00 00 02 4B 03
+			15 01 00 00 00 00 02 4C 11
+			15 01 00 00 00 00 02 4D 10
+			15 01 00 00 00 00 02 4E 01
+			15 01 00 00 00 00 02 4F 01
+			15 01 00 00 00 00 02 50 10
+			15 01 00 00 00 00 02 51 00
+			15 01 00 00 00 00 02 52 80
+			15 01 00 00 00 00 02 53 00
+			15 01 00 00 00 00 02 56 00
+			15 01 00 00 00 00 02 54 07
+			15 01 00 00 00 00 02 58 07
+			15 01 00 00 00 00 02 55 25
+			/* Reset XDONB */
+			15 01 00 00 00 00 02 5B 43
+			15 01 00 00 00 00 02 5C 00
+			15 01 00 00 00 00 02 5F 73
+			15 01 00 00 00 00 02 60 73
+			15 01 00 00 00 00 02 63 22
+			15 01 00 00 00 00 02 64 00
+			15 01 00 00 00 00 02 67 08
+			15 01 00 00 00 00 02 68 04
+			/* Resolution:1440x2560*/
+			15 01 00 00 00 00 02 72 02
+			/* mux */
+			15 01 00 00 00 00 02 7A 80
+			15 01 00 00 00 00 02 7B 91
+			15 01 00 00 00 00 02 7C D8
+			15 01 00 00 00 00 02 7D 60
+			15 01 00 00 00 00 02 7F 15
+			15 01 00 00 00 00 02 75 15
+			/* ABOFF */
+			15 01 00 00 00 00 02 B3 C0
+			15 01 00 00 00 00 02 B4 00
+			15 01 00 00 00 00 02 B5 00
+			/* Source EQ */
+			15 01 00 00 00 00 02 78 00
+			15 01 00 00 00 00 02 79 00
+			15 01 00 00 00 00 02 80 00
+			15 01 00 00 00 00 02 83 00
+			/* FP BP */
+			15 01 00 00 00 00 02 93 0A
+			15 01 00 00 00 00 02 94 0A
+			/* Inversion Type */
+			15 01 00 00 00 00 02 8A 00
+			15 01 00 00 00 00 02 9B FF
+			/* IMGSWAP =1 @PortSwap=1 */
+			15 01 00 00 00 00 02 9D B0
+			15 01 00 00 00 00 02 9F 63
+			15 01 00 00 00 00 02 98 10
+			/* FRM */
+			15 01 00 00 00 00 02 EC 00
+			/* CMD1 */
+			15 01 00 00 00 00 02 FF 10
+			/* VBP+VSA=,VFP = 10H */
+			15 01 00 00 00 00 04 3B 03 0A 0A
+			/* FTE on */
+			15 01 00 00 00 00 02 35 00
+			/* EN_BK =1(auto black) */
+			15 01 00 00 00 00 02 E5 01
+			/* CMD mode(10) VDO mode(03) */
+			15 01 00 00 00 00 02 BB 03
+			/* Non Reload MTP */
+			15 01 00 00 00 00 02 FB 01
+			/* SlpOut + DispOn */
+			05 01 00 00 78 00 02 11 00
+			05 01 00 00 78 00 02 29 00
+			];
+		qcom,mdss-dsi-off-command = [05 01 00 00 78 00 02 28 00
+				 05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [e2 36 24 00 66 6a 28 38 2a 03
+				04 00];
+		qcom,mdss-dsi-t-clk-post = <0x0d>;
+		qcom,mdss-dsi-t-clk-pre = <0x2d>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-reset-sequence = <1 20>, <0 20>, <1 50>;
+		qcom,mdss-dsi-tx-eot-append;
+		qcom,mdss-pan-physical-width-dimension = <74>;
+		qcom,mdss-pan-physical-height-dimension = <131>;
+
+		qcom,config-select = <&dsi_dual_nt35597_truly_video_config0>;
+
+		dsi_dual_nt35597_truly_video_config0: config0 {
+			qcom,split-mode = "dualctl-split";
+		};
+
+
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-nt35695b-truly-fhd-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-nt35695b-truly-fhd-cmd.dtsi
new file mode 100644
index 000000000000..60f0811ce987
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-nt35695b-truly-fhd-cmd.dtsi
@@ -0,0 +1,190 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_nt35695b_truly_fhd_cmd: qcom,mdss_dsi_nt35695b_truly_fhd_cmd {
+		qcom,mdss-dsi-panel-name =
+				"nt35695b truly fhd command mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1080>;
+		qcom,mdss-dsi-panel-height = <1920>;
+		qcom,mdss-dsi-h-front-porch = <120>;
+		qcom,mdss-dsi-h-back-porch = <60>;
+		qcom,mdss-dsi-h-pulse-width = <12>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <2>;
+		qcom,mdss-dsi-v-front-porch = <12>;
+		qcom,mdss-dsi-v-pulse-width = <2>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "burst_mode";
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [e6 38 26 00 68 6e 2a
+				3c 44 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x0d>;
+		qcom,mdss-dsi-t-clk-pre = <0x2f>;
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-on-command = [15 01 00 00 10 00 02 ff 20
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 00 01
+			15 01 00 00 00 00 02 01 55
+			15 01 00 00 00 00 02 02 45
+			15 01 00 00 00 00 02 03 55
+			15 01 00 00 00 00 02 05 50
+			15 01 00 00 00 00 02 06 a8
+			15 01 00 00 00 00 02 07 ad
+			15 01 00 00 00 00 02 08 0c
+			15 01 00 00 00 00 02 0b aa
+			15 01 00 00 00 00 02 0c aa
+			15 01 00 00 00 00 02 0e b0
+			15 01 00 00 00 00 02 0f b3
+			15 01 00 00 00 00 02 11 28
+			15 01 00 00 00 00 02 12 10
+			15 01 00 00 00 00 02 13 01
+			15 01 00 00 00 00 02 14 4a
+			15 01 00 00 00 00 02 15 12
+			15 01 00 00 00 00 02 16 12
+			15 01 00 00 00 00 02 30 01
+			15 01 00 00 00 00 02 72 11
+			15 01 00 00 00 00 02 58 82
+			15 01 00 00 00 00 02 59 00
+			15 01 00 00 00 00 02 5a 02
+			15 01 00 00 00 00 02 5b 00
+			15 01 00 00 00 00 02 5c 82
+			15 01 00 00 00 00 02 5d 80
+			15 01 00 00 00 00 02 5e 02
+			15 01 00 00 00 00 02 5f 00
+			15 01 00 00 00 00 02 ff 24
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 00 01
+			15 01 00 00 00 00 02 01 0b
+			15 01 00 00 00 00 02 02 0c
+			15 01 00 00 00 00 02 03 89
+			15 01 00 00 00 00 02 04 8a
+			15 01 00 00 00 00 02 05 0f
+			15 01 00 00 00 00 02 06 10
+			15 01 00 00 00 00 02 07 10
+			15 01 00 00 00 00 02 08 1c
+			15 01 00 00 00 00 02 09 00
+			15 01 00 00 00 00 02 0a 00
+			15 01 00 00 00 00 02 0b 00
+			15 01 00 00 00 00 02 0c 00
+			15 01 00 00 00 00 02 0d 13
+			15 01 00 00 00 00 02 0e 15
+			15 01 00 00 00 00 02 0f 17
+			15 01 00 00 00 00 02 10 01
+			15 01 00 00 00 00 02 11 0b
+			15 01 00 00 00 00 02 12 0c
+			15 01 00 00 00 00 02 13 89
+			15 01 00 00 00 00 02 14 8a
+			15 01 00 00 00 00 02 15 0f
+			15 01 00 00 00 00 02 16 10
+			15 01 00 00 00 00 02 17 10
+			15 01 00 00 00 00 02 18 1c
+			15 01 00 00 00 00 02 19 00
+			15 01 00 00 00 00 02 1a 00
+			15 01 00 00 00 00 02 1b 00
+			15 01 00 00 00 00 02 1c 00
+			15 01 00 00 00 00 02 1d 13
+			15 01 00 00 00 00 02 1e 15
+			15 01 00 00 00 00 02 1f 17
+			15 01 00 00 00 00 02 20 00
+			15 01 00 00 00 00 02 21 01
+			15 01 00 00 00 00 02 22 00
+			15 01 00 00 00 00 02 23 40
+			15 01 00 00 00 00 02 24 40
+			15 01 00 00 00 00 02 25 6d
+			15 01 00 00 00 00 02 26 40
+			15 01 00 00 00 00 02 27 40
+			15 01 00 00 00 00 02 29 d8
+			15 01 00 00 00 00 02 2a 2a
+			15 01 00 00 00 00 02 4b 03
+			15 01 00 00 00 00 02 4c 11
+			15 01 00 00 00 00 02 4d 10
+			15 01 00 00 00 00 02 4e 01
+			15 01 00 00 00 00 02 4f 01
+			15 01 00 00 00 00 02 50 10
+			15 01 00 00 00 00 02 51 00
+			15 01 00 00 00 00 02 52 80
+			15 01 00 00 00 00 02 53 00
+			15 01 00 00 00 00 02 54 07
+			15 01 00 00 00 00 02 55 25
+			15 01 00 00 00 00 02 56 00
+			15 01 00 00 00 00 02 58 07
+			15 01 00 00 00 00 02 5b 43
+			15 01 00 00 00 00 02 5c 00
+			15 01 00 00 00 00 02 5f 73
+			15 01 00 00 00 00 02 60 73
+			15 01 00 00 00 00 02 63 22
+			15 01 00 00 00 00 02 64 00
+			15 01 00 00 00 00 02 67 08
+			15 01 00 00 00 00 02 68 04
+			15 01 00 00 00 00 02 7a 80
+			15 01 00 00 00 00 02 7b 91
+			15 01 00 00 00 00 02 7c d8
+			15 01 00 00 00 00 02 7d 60
+			15 01 00 00 00 00 02 93 06
+			15 01 00 00 00 00 02 94 06
+			15 01 00 00 00 00 02 8a 00
+			15 01 00 00 00 00 02 9b 0f
+			15 01 00 00 00 00 02 b3 c0
+			15 01 00 00 00 00 02 b4 00
+			15 01 00 00 00 00 02 b5 00
+			15 01 00 00 00 00 02 b6 21
+			15 01 00 00 00 00 02 b7 22
+			15 01 00 00 00 00 02 b8 07
+			15 01 00 00 00 00 02 b9 07
+			15 01 00 00 00 00 02 ba 22
+			15 01 00 00 00 00 02 bd 20
+			15 01 00 00 00 00 02 be 07
+			15 01 00 00 00 00 02 bf 07
+			15 01 00 00 00 00 02 c1 6d
+			15 01 00 00 00 00 02 c4 24
+			15 01 00 00 00 00 02 e3 00
+			15 01 00 00 00 00 02 ec 00
+			15 01 00 00 00 00 02 ff 10
+			15 01 00 00 00 00 02 bb 10
+			15 01 00 00 00 00 02 35 02
+			05 01 00 00 78 00 02 11 00
+			05 01 00 00 78 00 02 29 00];
+		qcom,mdss-dsi-off-command = [05 01 00 00 14 00 02 28 00
+				 05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+		qcom,mdss-dsi-tx-eot-append;
+		qcom,mdss-dsi-post-init-delay = <1>;
+		qcom,ulps-enabled;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-nt35695b-truly-fhd-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-nt35695b-truly-fhd-video.dtsi
new file mode 100644
index 000000000000..7e83d25e9e43
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-nt35695b-truly-fhd-video.dtsi
@@ -0,0 +1,184 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_nt35695b_truly_fhd_video: qcom,mdss_dsi_nt35695b_truly_fhd_video {
+		qcom,mdss-dsi-panel-name =
+				"nt35695b truly fhd video mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1080>;
+		qcom,mdss-dsi-panel-height = <1920>;
+		qcom,mdss-dsi-h-front-porch = <120>;
+		qcom,mdss-dsi-h-back-porch = <60>;
+		qcom,mdss-dsi-h-pulse-width = <12>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <2>;
+		qcom,mdss-dsi-v-front-porch = <12>;
+		qcom,mdss-dsi-v-pulse-width = <2>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "burst_mode";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [e6 38 26 00 68 6e 2a
+				3c 44 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x0d>;
+		qcom,mdss-dsi-t-clk-pre = <0x2f>;
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-on-command = [15 01 00 00 10 00 02 ff 20
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 00 01
+			15 01 00 00 00 00 02 01 55
+			15 01 00 00 00 00 02 02 45
+			15 01 00 00 00 00 02 03 55
+			15 01 00 00 00 00 02 05 50
+			15 01 00 00 00 00 02 06 a8
+			15 01 00 00 00 00 02 07 ad
+			15 01 00 00 00 00 02 08 0c
+			15 01 00 00 00 00 02 0b aa
+			15 01 00 00 00 00 02 0c aa
+			15 01 00 00 00 00 02 0e b0
+			15 01 00 00 00 00 02 0f b3
+			15 01 00 00 00 00 02 11 28
+			15 01 00 00 00 00 02 12 10
+			15 01 00 00 00 00 02 13 01
+			15 01 00 00 00 00 02 14 4a
+			15 01 00 00 00 00 02 15 12
+			15 01 00 00 00 00 02 16 12
+			15 01 00 00 00 00 02 30 01
+			15 01 00 00 00 00 02 72 11
+			15 01 00 00 00 00 02 58 82
+			15 01 00 00 00 00 02 59 00
+			15 01 00 00 00 00 02 5a 02
+			15 01 00 00 00 00 02 5b 00
+			15 01 00 00 00 00 02 5c 82
+			15 01 00 00 00 00 02 5d 80
+			15 01 00 00 00 00 02 5e 02
+			15 01 00 00 00 00 02 5f 00
+			15 01 00 00 00 00 02 ff 24
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 00 01
+			15 01 00 00 00 00 02 01 0b
+			15 01 00 00 00 00 02 02 0c
+			15 01 00 00 00 00 02 03 89
+			15 01 00 00 00 00 02 04 8a
+			15 01 00 00 00 00 02 05 0f
+			15 01 00 00 00 00 02 06 10
+			15 01 00 00 00 00 02 07 10
+			15 01 00 00 00 00 02 08 1c
+			15 01 00 00 00 00 02 09 00
+			15 01 00 00 00 00 02 0a 00
+			15 01 00 00 00 00 02 0b 00
+			15 01 00 00 00 00 02 0c 00
+			15 01 00 00 00 00 02 0d 13
+			15 01 00 00 00 00 02 0e 15
+			15 01 00 00 00 00 02 0f 17
+			15 01 00 00 00 00 02 10 01
+			15 01 00 00 00 00 02 11 0b
+			15 01 00 00 00 00 02 12 0c
+			15 01 00 00 00 00 02 13 89
+			15 01 00 00 00 00 02 14 8a
+			15 01 00 00 00 00 02 15 0f
+			15 01 00 00 00 00 02 16 10
+			15 01 00 00 00 00 02 17 10
+			15 01 00 00 00 00 02 18 1c
+			15 01 00 00 00 00 02 19 00
+			15 01 00 00 00 00 02 1a 00
+			15 01 00 00 00 00 02 1b 00
+			15 01 00 00 00 00 02 1c 00
+			15 01 00 00 00 00 02 1d 13
+			15 01 00 00 00 00 02 1e 15
+			15 01 00 00 00 00 02 1f 17
+			15 01 00 00 00 00 02 20 00
+			15 01 00 00 00 00 02 21 01
+			15 01 00 00 00 00 02 22 00
+			15 01 00 00 00 00 02 23 40
+			15 01 00 00 00 00 02 24 40
+			15 01 00 00 00 00 02 25 6d
+			15 01 00 00 00 00 02 26 40
+			15 01 00 00 00 00 02 27 40
+			15 01 00 00 00 00 02 29 d8
+			15 01 00 00 00 00 02 2a 2a
+			15 01 00 00 00 00 02 4b 03
+			15 01 00 00 00 00 02 4c 11
+			15 01 00 00 00 00 02 4d 10
+			15 01 00 00 00 00 02 4e 01
+			15 01 00 00 00 00 02 4f 01
+			15 01 00 00 00 00 02 50 10
+			15 01 00 00 00 00 02 51 00
+			15 01 00 00 00 00 02 52 80
+			15 01 00 00 00 00 02 53 00
+			15 01 00 00 00 00 02 54 07
+			15 01 00 00 00 00 02 55 25
+			15 01 00 00 00 00 02 56 00
+			15 01 00 00 00 00 02 58 07
+			15 01 00 00 00 00 02 5b 43
+			15 01 00 00 00 00 02 5c 00
+			15 01 00 00 00 00 02 5f 73
+			15 01 00 00 00 00 02 60 73
+			15 01 00 00 00 00 02 63 22
+			15 01 00 00 00 00 02 64 00
+			15 01 00 00 00 00 02 67 08
+			15 01 00 00 00 00 02 68 04
+			15 01 00 00 00 00 02 7a 80
+			15 01 00 00 00 00 02 7b 91
+			15 01 00 00 00 00 02 7c d8
+			15 01 00 00 00 00 02 7d 60
+			15 01 00 00 00 00 02 93 06
+			15 01 00 00 00 00 02 94 06
+			15 01 00 00 00 00 02 8a 00
+			15 01 00 00 00 00 02 9b 0f
+			15 01 00 00 00 00 02 b3 c0
+			15 01 00 00 00 00 02 b4 00
+			15 01 00 00 00 00 02 b5 00
+			15 01 00 00 00 00 02 b6 21
+			15 01 00 00 00 00 02 b7 22
+			15 01 00 00 00 00 02 b8 07
+			15 01 00 00 00 00 02 b9 07
+			15 01 00 00 00 00 02 ba 22
+			15 01 00 00 00 00 02 bd 20
+			15 01 00 00 00 00 02 be 07
+			15 01 00 00 00 00 02 bf 07
+			15 01 00 00 00 00 02 c1 6d
+			15 01 00 00 00 00 02 c4 24
+			15 01 00 00 00 00 02 e3 00
+			15 01 00 00 00 00 02 ec 00
+			15 01 00 00 00 00 02 ff 10
+			15 01 00 00 00 00 02 bb 03
+			05 01 00 00 78 00 02 11 00
+			05 01 00 00 78 00 02 29 00];
+		qcom,mdss-dsi-off-command = [05 01 00 00 14 00 02 28 00
+				 05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+		qcom,mdss-dsi-tx-eot-append;
+		qcom,mdss-dsi-post-init-delay = <1>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-nt35950-dsc-4k-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-nt35950-dsc-4k-cmd.dtsi
new file mode 100644
index 000000000000..f52d3a09cd5f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-nt35950-dsc-4k-cmd.dtsi
@@ -0,0 +1,284 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_nt35950_4k_dsc_cmd: qcom,mdss_dsi_nt35950_4k_dsc_cmd {
+		qcom,mdss-dsi-panel-name = "NT35950 4k cmd mode dsc dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1080>;
+		qcom,mdss-dsi-panel-height = <3840>;
+		qcom,mdss-dsi-h-front-porch = <30>;
+		qcom,mdss-dsi-h-back-porch = <100>;
+		qcom,mdss-dsi-h-pulse-width = <4>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <7>;
+		qcom,mdss-dsi-v-front-porch = <8>;
+		qcom,mdss-dsi-v-pulse-width = <1>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "burst_mode";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [d9 6a 48 00 b0 b0 52 6c 57 03 04
+			00];
+		qcom,mdss-dsi-t-clk-post = <0xc>;
+		qcom,mdss-dsi-t-clk-pre = <0x28>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-reset-sequence = <1 20>, <0 20>, <1 20>;
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-wr-mem-start = <0x2c>;
+		qcom,mdss-dsi-wr-mem-continue = <0x3c>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+		qcom,ulps-enabled;
+		qcom,dcs-cmd-by-left;
+		qcom,mdss-dsi-tx-eot-append;
+
+		qcom,adjust-timer-wakeup-ms = <1>;
+		qcom,mdss-dsi-on-command = [
+			/* cmd3 */
+			39 01 00 00 00 00 05 ff aa 55 a5 80
+			15 01 00 00 00 00 02 6f 18
+			15 01 00 00 00 00 02 f7 06
+			/* cmd2 page 0 */
+			39 01 00 00 00 00 06 f0 55 aa 52 08 00
+			39 01 00 00 00 00 04 b1 01 12 0d
+			39 01 00 00 00 00 07 b9 00 00 38 00 d0 00
+			15 01 00 00 00 00 02 b4 01 /* 11 : mipi video mode with
+						      sram , 01 : command mode
+						    */
+			15 01 00 00 00 00 02 c9 00
+			15 01 00 00 00 00 02 c8 84
+			39 01 00 00 00 00 04 c0 0e 02 11
+			/* cmd2 page 1 */
+			39 01 00 00 00 00 06 f0 55 aa 52 08 01 /* vgmp voltage =
+								  b4h 5.3v */
+			39 01 00 00 00 00 03 bc b4 b4
+			39 01 00 00 00 00 05 be 01 2d 01 2d
+			39 01 00 00 00 00 03 bd b4 b4 /* vgmn voltage = b4h
+							 -5.3v */
+			39 01 00 00 00 00 04 b3 19 19 19 /* vgh */
+			39 01 00 00 00 00 04 c2 32 32 32 /* vrgh */
+			39 01 00 00 00 00 04 b4 0f 0f 0f /* vglx */
+			39 01 00 00 00 00 04 c3 1a 1a 1a /* vgl_reg */
+			/* cmd2 page 2 */
+			39 01 00 00 00 00 06 f0 55 aa 52 08 02
+			/* red positive */
+			39 01 00 00 00 00 11 b0 00 00 00 11 00 33 00 51 00 6b 00
+			81 00 95 00 a7
+			39 01 00 00 00 00 11 b1 00 b8 00 ee 01 18 01 58 01 88 01
+			d0 02 09 02 0b
+			39 01 00 00 00 00 11 b2 02 40 02 7f 02 aa 02 ec 03 22 03
+			5e 03 6a 03 77
+			39 01 00 00 00 00 0d b3 03 86 03 9a 03 b1 03 d0 03 ef 03
+			fe
+			/* green positive */
+			39 01 00 00 00 00 11 b4 00 00 00 11 00 33 00 51 00 6b 00
+			81 00 95 00 a7
+			39 01 00 00 00 00 11 b5 00 b8 00 ee 01 18 01 58 01 88 01
+			d0 02 09 02 0b
+			39 01 00 00 00 00 11 b6 02 40 02 7f 02 aa 02 ec 03 22 03
+			5e 03 6a 03 77
+			39 01 00 00 00 00 0d b7 03 86 03 9a 03 b1 03 d0 03 ef 03
+			fe
+			/* blue positive */
+			39 01 00 00 00 00 11 b8 00 00 00 11 00 33 00 51 00 6b 00
+			81 00 95 00 a7
+			39 01 00 00 00 00 11 b9 00 b8 00 ee 01 18 01 58 01 88 01
+			d0 02 09 02 0b
+			39 01 00 00 00 00 11 ba 02 40 02 7f 02 aa 02 ec 03 22 03
+			5e 03 6a 03 77
+			39 01 00 00 00 00 0d bb 03 86 03 9a 03 b1 03 d0 03 ef 03
+			fe
+			/* red negative */
+			39 01 00 00 00 00 11 bc 00 00 00 11 00 33 00 51 00 6b 00
+			81 00 95 00 a7
+			39 01 00 00 00 00 11 bd 00 b8 00 ee 01 18 01 58 01 88 01
+			d0 02 09 02 0b
+			39 01 00 00 00 00 11 be 02 40 02 7f 02 aa 02 ec 03 22 03
+			5e 03 6a 03 77
+			39 01 00 00 00 00 0d bf 03 86 03 9a 03 b1 03 d0 03 ef 03
+			fe
+			/* green negative */
+			39 01 00 00 00 00 11 c0 00 00 00 11 00 33 00 51 00 6b 00
+			81 00 95 00 a7
+			39 01 00 00 00 00 11 c1 00 b8 00 ee 01 18 01 58 01 88 01
+			d0 02 09 02 0b
+			39 01 00 00 00 00 11 c2 02 40 02 7f 02 aa 02 ec 03 22 03
+			5e 03 6a 03 77
+			39 01 00 00 00 00 0d c3 03 86 03 9a 03 b1 03 d0 03 ef 03
+			fe
+			/* blue negative */
+			39 01 00 00 00 00 11 c4 00 00 00 11 00 33 00 51 00 6b 00
+			81 00 95 00 a7
+			39 01 00 00 00 00 11 c5 00 b8 00 ee 01 18 01 58 01 88 01
+			d0 02 09 02 0b
+			39 01 00 00 00 00 11 c6 02 40 02 7f 02 aa 02 ec 03 22 03
+			5e 03 6a 03 77
+			39 01 00 00 00 00 0d c7 03 86 03 9a 03 b1 03 d0 03 ef 03
+			fe
+			/* white positive */
+			39 01 00 00 00 00 11 c8 00 00 00 11 00 33 00 51 00 6b 00
+			81 00 95 00 a7
+			39 01 00 00 00 00 11 c9 00 b8 00 ee 01 18 01 58 01 88 01
+			d0 02 09 02 0b
+			39 01 00 00 00 00 11 ca 02 40 02 7f 02 aa 02 ec 03 22 03
+			5e 03 6a 03 77
+			39 01 00 00 00 00 0d cb 03 86 03 9a 03 b1 03 d0 03 ef 03
+			fe
+			/* white negative */
+			39 01 00 00 00 00 11 cc 00 00 00 11 00 33 00 51 00 6b 00
+			81 00 95 00 a7
+			39 01 00 00 00 00 11 cd 00 b8 00 ee 01 18 01 58 01 88 01
+			d0 02 09 02 0b
+			39 01 00 00 00 00 11 ce 02 40 02 7f 02 aa 02 ec 03 22 03
+			5e 03 6a 03 77
+			39 01 00 00 00 00 0d cf 03 86 03 9a 03 b1 03 d0 03 ef 03
+			fe
+			/* cmd2 page 3 _overlap 2h */
+			39 01 00 00 00 00 06 f0 55 aa 52 08 03
+			39 01 00 00 00 00 08 b2 00 00 00 00 00 03 01 /* gvst
+									stv01
+									modify
+								      */
+			39 01 00 00 00 00 06 ba 35 10 00 00 00 /* clk clk01
+								  modify */
+			39 01 00 00 00 00 06 bb 35 10 00 00 00 /* clk clk02
+								  modify */
+			39 01 00 00 00 00 06 b5 25 35 35 07 07 /* mux muxtimectr
+								  */
+			/* cmd2 page 5 */
+			39 01 00 00 00 00 06 f0 55 aa 52 08 05
+			39 01 00 00 00 00 03 b2 05 00 /* mux */
+			39 01 00 00 00 00 04 b3 00 20 00 /* vcom */
+			15 01 00 00 00 00 02 b4 05 /* gvst stv01 */
+			39 01 00 00 00 00 04 b5 05 00 00 /* clk clk01 */
+			39 01 00 00 00 00 04 b6 05 00 00 /* clk clk02 */
+			39 01 00 00 00 00 08 ba 06 00 00 10 00 00 00 /* d2u
+									vdc01 */
+			39 01 00 00 00 00 08 bb 8e 00 00 10 00 00 00 /* d2u
+									vdc02 */
+			39 01 00 00 00 00 08 bc 06 00 00 10 00 00 00 /* d2u
+									vdc03 */
+			39 01 00 00 00 00 07 cd ff ff aa ff ff ff /* abnormal
+								     aboffvdclv
+								     */
+			39 01 00 00 00 00 03 c5 22 22 /* abnormal aboffmuxlv */
+			15 01 00 00 00 00 02 c6 00 /* abnormal aboffstvlv */
+			39 01 00 00 00 00 07 c7 00 00 00 00 00 00 /* abnormal
+								     abnormal
+								     aboffclklv
+								     */
+			39 01 00 00 00 00 03 c8 02 20 /* clk01 clk01timectr2
+							 modify    _overlap 2h
+						       */
+			39 01 00 00 00 00 03 c9 03 20 /* clk02 clk02timectr2
+							 modify    _overlap 2h
+						       */
+			39 01 00 00 00 00 06 d0 00 1f 08 00 00 /* clk01 porch
+								  mode */
+			39 01 00 00 00 00 06 d1 00 1f 09 00 00 /* clk02 porch
+								  mode */
+			15 01 00 00 00 00 02 ec 00 /* discharge */
+			39 01 00 00 00 00 03 ee 03 01 /* on/off clear frame
+							 2f,1f */
+			/* cmd2 page 6 */
+			39 01 00 00 00 00 06 f0 55 aa 52 08 06
+			/* forward scan */
+			39 01 00 00 00 00 06 b0 24 24 24 24 24 /* l 1~5 */
+			39 01 00 00 00 00 06 b1 24 24 24 24 24 /* l 6~10 */
+			39 01 00 00 00 00 06 b2 24 24 12 13 1b /* l 11~15 */
+			39 01 00 00 00 00 06 b3 19 13 11 12 04 /* l 16~20 */
+			39 01 00 00 00 00 06 b4 07 06 05 00 24 /* l 21~25 */
+			39 01 00 00 00 00 04 b5 24 24 24 /* l 26~28 */
+			39 01 00 00 00 00 06 b6 24 24 24 24 24 /* r 1~5 */
+			39 01 00 00 00 00 06 b7 24 24 24 24 24 /* r 6~10 */
+			39 01 00 00 00 00 06 b8 24 24 12 13 1b /* r 11~15 */
+			39 01 00 00 00 00 06 b9 19 13 11 12 08 /* r 16~20 */
+			39 01 00 00 00 00 06 ba 0b 0a 09 01 24 /* r 21~25 */
+			39 01 00 00 00 00 04 bb 24 24 24 /* r 26~28 */
+			/* backward scan */
+			39 01 00 00 00 00 06 c0 24 24 24 24 24 /* l 1~5 */
+			39 01 00 00 00 00 06 c1 24 24 24 24 24 /* l 6~10 */
+			39 01 00 00 00 00 06 c2 24 24 12 13 1b /* l 11~15 */
+			39 01 00 00 00 00 06 c3 19 13 12 11 09 /* l 16~20 */
+			39 01 00 00 00 00 06 c4 0a 0b 08 01 24 /* l 21~25 */
+			39 01 00 00 00 00 04 c5 24 24 24 /* l 26~28 */
+			39 01 00 00 00 00 06 c6 24 24 24 24 24 /* r 1~5 */
+			39 01 00 00 00 00 06 c7 24 24 24 24 24 /* r 6~10 */
+			39 01 00 00 00 00 06 c8 24 24 12 13 1b /* r 11~15 */
+			39 01 00 00 00 00 06 c9 19 13 12 11 05 /* r 16~20 */
+			39 01 00 00 00 00 06 ca 06 07 04 00 24 /* r 21~25 */
+			39 01 00 00 00 00 04 cb 24 24 24 /* r 26~28 */
+			/* cmd2 page 4 */
+			39 01 00 00 00 00 06 f0 55 aa 52 08 04
+			15 01 00 00 00 00 02 c0 03
+			39 01 00 00 00 00 0a b0 0e a4 2c 86 dd dd 34 12 65
+			/* cmd2 page 7 - mplus part */
+			39 01 00 00 00 00 06 f0 55 aa 52 08 07
+			15 01 00 00 00 00 02 ef 03
+			39 01 00 00 00 00 03 ea 1b 12 /* u2d color order and
+							 mode (2nd 2para) */
+			15 01 00 00 00 00 02 6f 00
+			39 01 00 00 00 00 09 eb e2 13 0e 45 0e 45 0e 45
+			15 01 00 00 00 00 02 6f 08
+			39 01 00 00 00 00 09 eb 11 bb 11 f0 11 f0 11 f0
+			15 01 00 00 00 00 02 6f 00
+			39 01 00 00 00 00 09 ec 0e 71 13 d9 13 d9 00 00
+			15 01 00 00 00 00 02 6f 08
+			39 01 00 00 00 00 09 ec 13 d9 03 00 26 80 40 13
+			15 01 00 00 00 00 02 6f 00
+			39 01 00 00 00 00 09 ed ae 13 ae 13 ae 13 ae 10
+			15 01 00 00 00 00 02 6f 08
+			39 01 00 00 00 00 09 ed 00 07 25 40 10 00 10 00
+			15 01 00 00 00 00 02 6f 00
+			39 01 00 00 00 00 04 ee 22 08 08
+			/* data compression method selection: dsc */
+			15 01 00 00 00 00 02 90 03
+			15 01 00 00 00 00 02 03 01 /* dsc enable */
+			/* enable pwm function */
+			15 01 00 00 00 00 02 53 2c
+			15 01 00 00 78 00 02 51 ff
+			05 01 00 00 78 00 01 11 /* sleep out + delay 120ms */
+			05 01 00 00 78 00 01 29 /* display on + delay 120ms */
+			];
+
+		qcom,mdss-dsi-off-command = [05 01 00 00 78 00 02 28 00
+				 05 01 00 00 78 00 02 10 00];
+
+		qcom,compression-mode = "dsc";
+		qcom,config-select = <&dsi_nt35950_dsc_cmd_config0>;
+
+		dsi_nt35950_dsc_cmd_config0: config0 {
+			qcom,mdss-dsc-encoders = <1>;
+			qcom,mdss-dsc-slice-height = <32>;
+			qcom,mdss-dsc-slice-width = <1080>;
+			qcom,mdss-dsc-slice-per-pkt = <1>;
+
+			qcom,mdss-dsc-bit-per-component = <8>;
+			qcom,mdss-dsc-bit-per-pixel = <8>;
+			qcom,mdss-dsc-block-prediction-enable;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-nt36850-truly-dualmipi-wqhd-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-nt36850-truly-dualmipi-wqhd-cmd.dtsi
new file mode 100644
index 000000000000..1d7836ca4759
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-nt36850-truly-dualmipi-wqhd-cmd.dtsi
@@ -0,0 +1,416 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_dual_nt36850_truly_cmd: qcom,mdss_dsi_nt36850_truly_wqhd_cmd{
+		qcom,mdss-dsi-panel-name =
+			"Dual nt36850 cmd mode dsi truly panel without DSC";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <720>;
+		qcom,mdss-dsi-panel-height = <2560>;
+		qcom,mdss-dsi-h-front-porch = <120>;
+		qcom,mdss-dsi-h-back-porch = <140>;
+		qcom,mdss-dsi-h-pulse-width = <20>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <20>;
+		qcom,mdss-dsi-v-front-porch = <8>;
+		qcom,mdss-dsi-v-pulse-width = <4>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-color-order = "rgb_swap_rgb";
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [
+				15 01 00 00 00 00 02 ff 24
+				15 01 00 00 00 00 02 fb 01
+				15 01 00 00 00 00 02 00 19
+				15 01 00 00 00 00 02 01 03
+				15 01 00 00 00 00 02 02 04
+				15 01 00 00 00 00 02 03 1b
+				15 01 00 00 00 00 02 04 1d
+				15 01 00 00 00 00 02 05 01
+				15 01 00 00 00 00 02 06 0c
+				15 01 00 00 00 00 02 07 0f
+				15 01 00 00 00 00 02 08 1f
+				15 01 00 00 00 00 02 09 00
+				15 01 00 00 00 00 02 0a 00
+				15 01 00 00 00 00 02 0b 13
+				15 01 00 00 00 00 02 0c 16
+				15 01 00 00 00 00 02 0d 14
+				15 01 00 00 00 00 02 0e 15
+				15 01 00 00 00 00 02 0f 00
+				15 01 00 00 00 00 02 10 19
+				15 01 00 00 00 00 02 11 03
+				15 01 00 00 00 00 02 12 04
+				15 01 00 00 00 00 02 13 1b
+				15 01 00 00 00 00 02 14 1d
+				15 01 00 00 00 00 02 15 01
+				15 01 00 00 00 00 02 16 0c
+				15 01 00 00 00 00 02 17 0f
+				15 01 00 00 00 00 02 18 1f
+				15 01 00 00 00 00 02 19 00
+				15 01 00 00 00 00 02 1a 00
+				15 01 00 00 00 00 02 1b 13
+				15 01 00 00 00 00 02 1c 16
+				15 01 00 00 00 00 02 1d 14
+				15 01 00 00 00 00 02 1e 15
+				15 01 00 00 00 00 02 1f 00
+				15 01 00 00 00 00 02 21 01
+				15 01 00 00 00 00 02 22 10
+				15 01 00 00 00 00 02 23 28
+				15 01 00 00 00 00 02 24 28
+				15 01 00 00 00 00 02 25 5d
+				15 01 00 00 00 00 02 26 28
+				15 01 00 00 00 00 02 27 28
+				15 01 00 00 00 00 02 29 d8
+				15 01 00 00 00 00 02 2a 15
+				15 01 00 00 00 00 02 2b 00
+				15 01 00 00 00 00 02 2d 00
+				15 01 00 00 00 00 02 2f 02
+				15 01 00 00 00 00 02 30 02
+				15 01 00 00 00 00 02 31 00
+				15 01 00 00 00 00 02 32 23
+				15 01 00 00 00 00 02 33 01
+				15 01 00 00 00 00 02 34 03
+				15 01 00 00 00 00 02 35 49
+				15 01 00 00 00 00 02 36 00
+				15 01 00 00 00 00 02 37 1d
+				15 01 00 00 00 00 02 38 08
+				15 01 00 00 00 00 02 39 03
+				15 01 00 00 00 00 02 3a 49
+				15 01 00 00 00 00 02 42 01
+				15 01 00 00 00 00 02 43 8c
+				15 01 00 00 00 00 02 44 a3
+				15 01 00 00 00 00 02 48 8c
+				15 01 00 00 00 00 02 49 a3
+				15 01 00 00 00 00 02 5b 00
+				15 01 00 00 00 00 02 5f 4d
+				15 01 00 00 00 00 02 63 00
+				15 01 00 00 00 00 02 67 04
+				15 01 00 00 00 00 02 6e 10
+				15 01 00 00 00 00 02 72 02
+				15 01 00 00 00 00 02 73 00
+				15 01 00 00 00 00 02 74 04
+				15 01 00 00 00 00 02 75 1b
+				15 01 00 00 00 00 02 76 05
+				15 01 00 00 00 00 02 77 01
+				15 01 00 00 00 00 02 78 00
+				15 01 00 00 00 00 02 79 00
+				15 01 00 00 00 00 02 7a 00
+				15 01 00 00 00 00 02 7b 91
+				15 01 00 00 00 00 02 7c da
+				15 01 00 00 00 00 02 7d 10
+				15 01 00 00 00 00 02 7e 04
+				15 01 00 00 00 00 02 7f 1b
+				15 01 00 00 00 00 02 80 00
+				15 01 00 00 00 00 02 81 05
+				15 01 00 00 00 00 02 82 01
+				15 01 00 00 00 00 02 83 00
+				15 01 00 00 00 00 02 84 05
+				15 01 00 00 00 00 02 85 05
+				15 01 00 00 00 00 02 86 1b
+				15 01 00 00 00 00 02 87 1b
+				15 01 00 00 00 00 02 88 1b
+				15 01 00 00 00 00 02 89 1b
+				15 01 00 00 00 00 02 8a 00
+				15 01 00 00 00 00 02 8b f0
+				15 01 00 00 00 00 02 8c 00
+				15 01 00 00 00 00 02 8f 63
+				15 01 00 00 00 00 02 90 51
+				15 01 00 00 00 00 02 91 40
+				15 01 00 00 00 00 02 92 51
+				15 01 00 00 00 00 02 93 08
+				15 01 00 00 00 00 02 94 08
+				15 01 00 00 00 00 02 95 51
+				15 01 00 00 00 00 02 96 51
+				15 01 00 00 00 00 02 97 00
+				15 01 00 00 00 00 02 98 00
+				15 01 00 00 00 00 02 99 33
+				15 01 00 00 00 00 02 9b ff
+				15 01 00 00 00 00 02 9c 01
+				15 01 00 00 00 00 02 9d 30
+				15 01 00 00 00 00 02 a5 10
+				15 01 00 00 00 00 02 a6 01
+				15 01 00 00 00 00 02 a9 21
+				15 01 00 00 00 00 02 b3 2a
+				15 01 00 00 00 00 02 b4 da
+				15 01 00 00 00 00 02 ba 83
+				15 01 00 00 00 00 02 c4 24
+				15 01 00 00 00 00 02 c5 aa
+				15 01 00 00 00 00 02 c6 09
+				15 01 00 00 00 00 02 c7 00
+				15 01 00 00 00 00 02 c9 c0
+				15 01 00 00 00 00 02 ca 04
+				15 01 00 00 00 00 02 d5 3f
+				15 01 00 00 00 00 02 d6 10
+				15 01 00 00 00 00 02 d7 3f
+				15 01 00 00 00 00 02 d8 10
+				15 01 00 00 00 00 02 d9 ee
+				15 01 00 00 00 00 02 da 49
+				15 01 00 00 00 00 02 db 94
+				15 01 00 00 00 00 02 e9 33
+				15 01 00 00 00 00 02 eb 28
+				15 01 00 00 00 00 02 ec 00
+				15 01 00 00 00 00 02 ee 00
+				15 01 00 00 00 00 02 ef 06
+				15 01 00 00 00 00 02 f0 01
+				15 01 00 00 00 00 02 f1 01
+				15 01 00 00 00 00 02 f2 0d
+				15 01 00 00 00 00 02 f3 48
+				15 01 00 00 00 00 02 f6 00
+				15 01 00 00 00 00 02 f7 00
+				15 01 00 00 00 00 02 f8 00
+				15 01 00 00 00 00 02 f9 00
+				15 01 00 00 00 00 02 ff 26
+				15 01 00 00 00 00 02 fb 01
+				15 01 00 00 00 00 02 00 ab
+				15 01 00 00 00 00 02 01 00
+				15 01 00 00 00 00 02 02 80
+				15 01 00 00 00 00 02 03 08
+				15 01 00 00 00 00 02 04 01
+				15 01 00 00 00 00 02 05 32
+				15 01 00 00 00 00 02 06 4c
+				15 01 00 00 00 00 02 07 26
+				15 01 00 00 00 00 02 08 09
+				15 01 00 00 00 00 02 09 02
+				15 01 00 00 00 00 02 0a 32
+				15 01 00 00 00 00 02 0b 55
+				15 01 00 00 00 00 02 0c 14
+				15 01 00 00 00 00 02 0d 28
+				15 01 00 00 00 00 02 0e 40
+				15 01 00 00 00 00 02 0f 80
+				15 01 00 00 00 00 02 10 00
+				15 01 00 00 00 00 02 11 22
+				15 01 00 00 00 00 02 12 0a
+				15 01 00 00 00 00 02 13 20
+				15 01 00 00 00 00 02 14 06
+				15 01 00 00 00 00 02 15 00
+				15 01 00 00 00 00 02 16 40
+				15 01 00 00 00 00 02 19 43
+				15 01 00 00 00 00 02 1a 03
+				15 01 00 00 00 00 02 1b 25
+				15 01 00 00 00 00 02 1c 11
+				15 01 00 00 00 00 02 1d 00
+				15 01 00 00 00 00 02 1e 80
+				15 01 00 00 00 00 02 1f 00
+				15 01 00 00 00 00 02 20 03
+				15 01 00 00 00 00 02 21 03
+				15 01 00 00 00 00 02 22 25
+				15 01 00 00 00 00 02 23 25
+				15 01 00 00 00 00 02 24 00
+				15 01 00 00 00 00 02 25 a7
+				15 01 00 00 00 00 02 26 80
+				15 01 00 00 00 00 02 27 a5
+				15 01 00 00 00 00 02 28 06
+				15 01 00 00 00 00 02 29 85
+				15 01 00 00 00 00 02 2a 30
+				15 01 00 00 00 00 02 2b 97
+				15 01 00 00 00 00 02 2f 25
+				15 01 00 00 00 00 02 30 26
+				15 01 00 00 00 00 02 31 41
+				15 01 00 00 00 00 02 32 04
+				15 01 00 00 00 00 02 33 04
+				15 01 00 00 00 00 02 34 2b
+				15 01 00 00 00 00 02 35 00
+				15 01 00 00 00 00 02 36 00
+				15 01 00 00 00 00 02 37 c8
+				15 01 00 00 00 00 02 38 26
+				15 01 00 00 00 00 02 39 25
+				15 01 00 00 00 00 02 3a 26
+				15 01 00 00 00 00 02 3f eb
+				15 01 00 00 00 00 02 41 21
+				15 01 00 00 00 00 02 42 03
+				15 01 00 00 00 00 02 43 00
+				15 01 00 00 00 00 02 44 11
+				15 01 00 00 00 00 02 45 00
+				15 01 00 00 00 00 02 46 00
+				15 01 00 00 00 00 02 47 00
+				15 01 00 00 00 00 02 48 03
+				15 01 00 00 00 00 02 49 03
+				15 01 00 00 00 00 02 4a 00
+				15 01 00 00 00 00 02 4b 00
+				15 01 00 00 00 00 02 4c 01
+				15 01 00 00 00 00 02 4d 4e
+				15 01 00 00 00 00 02 4e 01
+				15 01 00 00 00 00 02 4f 4c
+				15 01 00 00 00 00 02 50 0d
+				15 01 00 00 00 00 02 51 0e
+				15 01 00 00 00 00 02 52 20
+				15 01 00 00 00 00 02 53 97
+				15 01 00 00 00 00 02 54 4b
+				15 01 00 00 00 00 02 55 4c
+				15 01 00 00 00 00 02 56 20
+				15 01 00 00 00 00 02 58 04
+				15 01 00 00 00 00 02 59 04
+				15 01 00 00 00 00 02 5a 09
+				15 01 00 00 00 00 02 5b 00
+				15 01 00 00 00 00 02 5c 00
+				15 01 00 00 00 00 02 5d c8
+				15 01 00 00 00 00 02 5e 4c
+				15 01 00 00 00 00 02 5f 4b
+				15 01 00 00 00 00 02 60 00
+				15 01 00 00 00 00 02 80 2b
+				15 01 00 00 00 00 02 81 43
+				15 01 00 00 00 00 02 82 03
+				15 01 00 00 00 00 02 83 25
+				15 01 00 00 00 00 02 84 11
+				15 01 00 00 00 00 02 85 00
+				15 01 00 00 00 00 02 86 80
+				15 01 00 00 00 00 02 87 00
+				15 01 00 00 00 00 02 88 00
+				15 01 00 00 00 00 02 89 03
+				15 01 00 00 00 00 02 8a 22
+				15 01 00 00 00 00 02 8b 25
+				15 01 00 00 00 00 02 8c 00
+				15 01 00 00 00 00 02 8d a4
+				15 01 00 00 00 00 02 8e 00
+				15 01 00 00 00 00 02 8f a2
+				15 01 00 00 00 00 02 90 06
+				15 01 00 00 00 00 02 91 63
+				15 01 00 00 00 00 02 92 30
+				15 01 00 00 00 00 02 93 97
+				15 01 00 00 00 00 02 94 25
+				15 01 00 00 00 00 02 95 26
+				15 01 00 00 00 00 02 96 41
+				15 01 00 00 00 00 02 97 04
+				15 01 00 00 00 00 02 98 04
+				15 01 00 00 00 00 02 99 f0
+				15 01 00 00 00 00 02 9a 00
+				15 01 00 00 00 00 02 9b 00
+				15 01 00 00 00 00 02 9c c8
+				15 01 00 00 00 00 02 9d 50
+				15 01 00 00 00 00 02 9e 26
+				15 01 00 00 00 00 02 9f 25
+				15 01 00 00 00 00 02 a0 26
+				15 01 00 00 00 00 02 a2 00
+				15 01 00 00 00 00 02 a3 33
+				15 01 00 00 00 00 02 a5 40
+				15 01 00 00 00 00 02 a6 40
+				15 01 00 00 00 00 02 ac 91
+				15 01 00 00 00 00 02 ad 66
+				15 01 00 00 00 00 02 ae 66
+				15 01 00 00 00 00 02 b1 40
+				15 01 00 00 00 00 02 b2 40
+				15 01 00 00 00 00 02 b4 40
+				15 01 00 00 00 00 02 b5 40
+				15 01 00 00 00 00 02 b7 40
+				15 01 00 00 00 00 02 b8 40
+				15 01 00 00 00 00 02 ba 22
+				15 01 00 00 00 00 02 bb 00
+				15 01 00 00 00 00 02 c2 01
+				15 01 00 00 00 00 02 c3 01
+				15 01 00 00 00 00 02 c4 01
+				15 01 00 00 00 00 02 c5 01
+				15 01 00 00 00 00 02 c6 01
+				15 01 00 00 00 00 02 c8 00
+				15 01 00 00 00 00 02 c9 00
+				15 01 00 00 00 00 02 ca 00
+				15 01 00 00 00 00 02 cd 00
+				15 01 00 00 00 00 02 ce 00
+				15 01 00 00 00 00 02 d6 04
+				15 01 00 00 00 00 02 d7 00
+				15 01 00 00 00 00 02 d8 0d
+				15 01 00 00 00 00 02 d9 00
+				15 01 00 00 00 00 02 da 00
+				15 01 00 00 00 00 02 db 00
+				15 01 00 00 00 00 02 dc 00
+				15 01 00 00 00 00 02 dd 00
+				15 01 00 00 00 00 02 de 00
+				15 01 00 00 00 00 02 df 01
+				15 01 00 00 00 00 02 e0 00
+				15 01 00 00 00 00 02 e1 00
+				15 01 00 00 00 00 02 e2 19
+				15 01 00 00 00 00 02 e3 04
+				15 01 00 00 00 00 02 e4 00
+				15 01 00 00 00 00 02 e5 04
+				15 01 00 00 00 00 02 e6 00
+				15 01 00 00 00 00 02 e7 12
+				15 01 00 00 00 00 02 e8 00
+				15 01 00 00 00 00 02 e9 50
+				15 01 00 00 00 00 02 ea 10
+				15 01 00 00 00 00 02 eb 02
+				15 01 00 00 00 00 02 ff 27
+				15 01 00 00 00 00 02 fb 01
+				15 01 00 00 00 00 02 ff 28
+				15 01 00 00 00 00 02 fb 01
+				15 01 00 00 00 00 02 60 0a
+				15 01 00 00 00 00 02 63 32
+				15 01 00 00 00 00 02 64 01
+				15 01 00 00 00 00 02 68 da
+				15 01 00 00 00 00 02 69 00
+				15 01 00 00 00 00 02 ff 29
+				15 01 00 00 00 00 02 fb 01
+				15 01 00 00 00 00 02 60 0a
+				15 01 00 00 00 00 02 63 32
+				15 01 00 00 00 00 02 64 01
+				15 01 00 00 00 00 02 68 da
+				15 01 00 00 00 00 02 69 00
+				15 01 00 00 00 00 02 ff e0
+				15 01 00 00 00 00 02 fb 01
+				15 01 00 00 00 00 02 35 40
+				15 01 00 00 00 00 02 36 40
+				15 01 00 00 00 00 02 37 00
+				15 01 00 00 00 00 02 89 c6
+				15 01 00 00 00 00 02 ff f0
+				15 01 00 00 00 00 02 fb 01
+				15 01 00 00 00 00 02 ea 40
+				15 01 00 00 00 00 02 ff 10
+				15 01 00 00 00 00 02 36 00
+				15 01 00 00 00 00 02 35 00
+				39 01 00 00 00 00 03 44 03 e8
+				15 01 00 00 00 00 02 51 ff
+				15 01 00 00 00 00 02 53 2c
+				15 01 00 00 00 00 02 55 01
+				05 01 00 00 0a 00 02 20 00
+				15 01 00 00 00 00 02 bb 10
+				05 01 00 00 78 00 02 11 00
+				05 01 00 00 14 00 02 29 00];
+		qcom,mdss-dsi-off-command = [05 01 00 00 14 00 02 28 00
+				05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-lane-map = "lane_map_0123";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-tx-eot-append;
+		qcom,cmd-sync-wait-broadcast;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-wr-mem-start = <0x2c>;
+		qcom,mdss-dsi-wr-mem-continue = <0x3c>;
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+		qcom,mdss-dsi-panel-timings =
+			[da 34 24 00 64 68 28 38 2a 03 04 00];
+		qcom,mdss-dsi-t-clk-pre = <0x29>;
+		qcom,mdss-dsi-t-clk-post = <0x03>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-lp11-init;
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-otm1906c-1080p-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-otm1906c-1080p-cmd.dtsi
new file mode 100644
index 000000000000..07a3b4766433
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-otm1906c-1080p-cmd.dtsi
@@ -0,0 +1,380 @@
+/*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*---------------------------------------------------------------------------
+ * This file is autogenerated file using gcdb parser. Please do not edit it.
+ * Update input XML file to add a new entry or update variable in this file
+ * VERSION = "1.0"
+ *---------------------------------------------------------------------------*/
+&mdss_mdp {
+	dsi_otm1906c_1080p_cmd: qcom,mdss_dsi_otm1906c_1080p_cmd {
+		qcom,mdss-dsi-panel-name = "otm1906c 1080p cmd mode dsi panel";
+		qcom,mdss-dsi-panel-controller = <&mdss_dsi0>;
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-destination = "display_1";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1080>;
+		qcom,mdss-dsi-panel-height = <1920>;
+		qcom,mdss-dsi-h-front-porch = <45>;
+		qcom,mdss-dsi-h-back-porch = <45>;
+		qcom,mdss-dsi-h-pulse-width = <8>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <16>;
+		qcom,mdss-dsi-v-front-porch = <16>;
+		qcom,mdss-dsi-v-pulse-width = <4>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [29 01 00 00 00 00 02 00 00
+				29 01 00 00 00 00 04 FF 19 06 01
+				29 01 00 00 00 00 02 00 80
+				29 01 00 00 00 00 03 FF 19 06
+				29 01 00 00 00 00 02 00 A0
+				29 01 00 00 00 00 04 C1 00 C0 10
+				29 01 00 00 00 00 02 00 91
+				29 01 00 00 00 00 03 C5 14 28
+				29 01 00 00 00 00 02 00 95
+				29 01 00 00 00 00 02 C5 11
+				29 01 00 00 00 00 02 00 00
+				29 01 00 00 00 00 02 D9 00
+				29 01 00 00 00 00 02 00 01
+				29 01 00 00 00 00 02 D9 b4
+				29 01 00 00 00 00 02 00 02
+				29 01 00 00 00 00 02 D9 00
+				29 01 00 00 00 00 02 00 03
+				29 01 00 00 00 00 02 D9 cd
+				29 01 00 00 00 00 02 00 04
+				29 01 00 00 00 00 02 D9 00
+				29 01 00 00 00 00 02 00 05
+				29 01 00 00 00 00 02 D9 cd
+				29 01 00 00 00 00 02 00 06
+				29 01 00 00 00 00 02 D9 00
+				29 01 00 00 00 00 02 00 07
+				29 01 00 00 00 00 02 D9 cd
+				29 01 00 00 00 00 02 00 81
+				29 01 00 00 00 00 02 A5 01
+				29 01 00 00 00 00 02 00 A5
+				29 01 00 00 00 00 02 C5 11
+				29 01 00 00 00 00 02 00 90
+				29 01 00 00 00 00 05 F5 09 16 09 16
+				29 01 00 00 00 00 02 00 A7
+				29 01 00 00 00 00 02 F5 1A
+				29 01 00 00 00 00 02 00 9D
+				29 01 00 00 00 00 02 F5 1A
+				29 01 00 00 00 00 02 00 A5
+				29 01 00 00 00 00 02 F5 16
+				29 01 00 00 00 00 02 00 8D
+				29 01 00 00 00 00 02 F5 17
+				29 01 00 00 00 00 02 00 E3
+				29 01 00 00 00 00 02 F5 11
+				29 01 00 00 00 00 02 00 ED
+				29 01 00 00 00 00 02 F5 16
+				29 01 00 00 00 00 02 00 E5
+				29 01 00 00 00 00 02 F5 16
+				29 01 00 00 00 00 02 00 81
+				29 01 00 00 00 00 02 F5 16
+				29 01 00 00 00 00 02 00 83
+				29 01 00 00 00 00 02 F5 16
+				29 01 00 00 00 00 02 00 E1
+				29 01 00 00 00 00 02 F5 16
+				29 01 00 00 00 00 02 00 C0
+				29 01 00 00 00 00 10 CC 0c 0c 00 00 0c 0c 0c 0c
+					00 00 00 00 00 00 00
+				29 01 00 00 00 00 02 00 D0
+				29 01 00 00 00 00 10 CC 00 00 00 00 00 00 00 00
+					00 00 00 33 33 33 33
+				29 01 00 00 00 00 02 00 E0
+				29 01 00 00 00 00 10 CC 33 33 00 00 00 00 00 00
+					00 00 00 00 00 00 00
+				29 01 00 00 00 00 02 00 80
+				29 01 00 00 00 00 03 C1 55 55
+				29 01 00 00 00 00 02 00 94
+				29 01 00 00 00 00 02 C5 88
+				29 01 00 00 00 00 02 00 A4
+				29 01 00 00 00 00 02 C5 88
+				29 01 00 00 00 00 02 00 C1
+				29 01 00 00 00 00 02 C5 f5
+				29 01 00 00 00 00 02 00 B3
+				29 01 00 00 00 00 02 C0 88
+				29 01 00 00 00 00 02 00 B4
+				29 01 00 00 00 00 02 C0 50
+				29 01 00 00 00 00 02 00 E0
+				29 01 00 00 00 00 02 C5 01
+				29 01 00 00 00 00 02 00 00
+				29 01 00 00 00 00 03 D8 23 23
+				29 01 00 00 00 00 02 00 80
+				29 01 00 00 00 00 02 C4 81
+				29 01 00 00 00 00 02 00 A0
+				29 01 00 00 00 00 02 B3 33
+				29 01 00 00 00 00 02 00 A6
+				29 01 00 00 00 00 02 B3 30
+				29 01 00 00 00 00 02 00 E0
+				29 01 00 00 00 00 0b B4 1C 19 3F 01 64 5C 01 A0
+					5F A0
+				29 01 00 00 00 00 02 00 F0
+				29 01 00 00 00 00 02 B4 64
+				29 01 00 00 00 00 02 00 80
+				29 01 00 00 00 00 0f C0 00 70 00 1A 16 00 70 1A
+					16 00 70 00 1A 16
+				29 01 00 00 00 00 02 00 90
+				29 01 00 00 00 00 07 C0 00 00 00 02 00 04
+				29 01 00 00 00 00 02 00 A0
+				29 01 00 00 00 00 10 C0 00 00 02 00 04 15 04 00
+					00 00 00 00 00 00 00
+				29 01 00 00 00 00 02 00 D0
+				29 01 00 00 00 00 10 C0 00 00 02 00 04 15 04 00
+					00 00 00 00 00 00 00
+				29 01 00 00 00 00 02 00 80
+				29 01 00 00 00 00 0d C2 83 01 00 00 82 01 00 00
+					00 00 00 00
+				29 01 00 00 00 00 02 00 90
+				29 01 00 00 00 00 0d C2 00 00 00 00 00 00 00 00
+					00 00 00 00
+				29 01 00 00 00 00 02 00 A0
+				29 01 00 00 00 00 0e C2 00 00 00 00 00 00 00 00
+					00 00 00 00 00
+				29 01 00 00 00 00 02 00 B0
+				29 01 00 00 00 00 10 C2 82 02 00 00 88 81 02 00
+					00 88 00 02 00 00 88
+				29 01 00 00 00 00 02 00 C0
+				29 01 00 00 00 00 10 C2 01 02 00 00 88 00 00 00
+					00 00 00 00 00 00 00
+				29 01 00 00 00 00 02 00 D0
+				29 01 00 00 00 00 10 C2 00 00 00 00 00 00 00 00
+					00 00 33 33 33 33 00
+				29 01 00 00 00 00 02 00 80
+				29 01 00 00 00 00 10 C3 00 00 00 00 00 00 00 00
+					00 00 00 00 00 00 00
+				29 01 00 00 00 00 02 00 A0
+				29 01 00 00 00 00 0d C3 83 01 00 00 82 01 00 00
+					00 00 00 00
+				29 01 00 00 00 00 02 00 B0
+				29 01 00 00 00 00 0f C3 00 00 00 00 82 02 00 00
+					88 81 02 00 00 88
+				29 01 00 00 00 00 02 00 C0
+				29 01 00 00 00 00 10 C3 00 02 00 00 88 01 02 00
+					00 88 00 00 00 00 00
+				29 01 00 00 00 00 02 00 D0
+				29 01 00 00 00 00 10 C3 00 00 00 00 00 00 00 00
+					00 00 00 00 00 00 00
+				29 01 00 00 00 00 02 00 E0
+				29 01 00 00 00 00 06 C3 33 33 33 33 00
+				29 01 00 00 00 00 02 00 80
+				29 01 00 00 00 00 0C CB 00 00 00 00 30 00 03 00
+					00 00 70
+				29 01 00 00 00 00 02 00 90
+				29 01 00 00 00 00 10 CB 00 00 00 00 00 00 00 00
+					00 00 00 00 00 00 00
+				29 01 00 00 00 00 02 00 A0
+				29 01 00 00 00 00 10 CB 00 00 00 BF 00 00 00 00
+					00 FF 00 00 00 00 00
+				29 01 00 00 00 00 02 00 B0
+				29 01 00 00 00 00 0d CB 00 00 00 00 00 00 00 00
+					00 00 77 77
+				29 01 00 00 00 00 02 00 C0
+				29 01 00 00 00 00 10 CB 01 01 01 01 01 01 01 01
+					01 01 01 01 01 01 01
+				29 01 00 00 00 00 02 00 D0
+				29 01 00 00 00 00 10 CB 01 01 01 F3 01 01 01 01
+					00 F3 00 00 01 00 01
+				29 01 00 00 00 00 02 00 E0
+				29 01 00 00 00 00 0d CB 00 01 00 01 00 01 00 01
+					00 00 77 07
+				29 01 00 00 00 00 02 00 F0
+				29 01 00 00 00 00 0c CB FF FF FF FF FF FF 03 33
+					03 00 70
+				29 01 00 00 00 00 02 00 80
+				29 01 00 00 00 00 0d CC 08 09 18 19 0C 0D 0E 0F
+					07 07 07 07
+				29 01 00 00 00 00 02 00 90
+				29 01 00 00 00 00 0d CC 09 08 19 18 0F 0E 0D 0C
+					07 07 07 07
+				29 01 00 00 00 00 02 00 A0
+				29 01 00 00 00 00 10 CC 14 15 16 17 1C 1D 1E 1F
+					01 04 20 07 07 07 00
+				29 01 00 00 00 00 02 00 B0
+				29 01 00 00 00 00 0a CC 01 02 03 04 05 06 07
+					07 00
+				29 01 00 00 00 00 02 00 80
+				29 01 00 00 00 00 10 CD 1A 01 11 12 1A 05 18 07
+					1A 1A 23 23 23 1F 1E
+				29 01 00 00 00 00 02 00 90
+				29 01 00 00 00 00 04 CD 1D 23 23
+				29 01 00 00 00 00 02 00 A0
+				29 01 00 00 00 00 10 CD 1A 02 11 12 1A 06 18 08
+					1A 1A 23 23 23 1F 1E
+				29 01 00 00 00 00 02 00 B0
+				29 01 00 00 00 00 04 CD 1D 23 23
+				29 01 00 00 00 00 02 00 80
+				29 01 00 00 00 00 0b A4 AF 00 20 04 00 17 15 03
+					60 00
+				29 01 00 00 00 00 02 00 90
+				29 01 00 00 00 00 04 A4 00 00 00
+				29 01 00 00 00 00 02 00 80
+				29 01 00 00 00 00 0d A7 FF 0F 1E 00 20 00 01 98
+					00 00 00 00
+				29 01 00 00 00 00 02 00 90
+				29 01 00 00 00 00 0b A7 1D 20 3D 00 00 BE 80 BE
+					05 F0
+				29 01 00 00 00 00 02 00 A0
+				29 01 00 00 00 00 02 A7 30
+				29 01 00 00 00 00 02 00 B0
+				29 01 00 00 00 00 06 A7 00 1E 1E 00 00
+				29 01 00 00 00 00 02 00 C0
+				29 01 00 00 00 00 0d A7 FF 3A 49 00 1E 00 01 00
+					00 00 00 00
+				29 01 00 00 00 00 02 00 D0
+				29 01 00 00 00 00 0b A7 FF FF 1D 00 01 7C 81 7C
+					0B E0
+				29 01 00 00 00 00 02 00 E0
+				29 01 00 00 00 00 02 A7 30
+				29 01 00 00 00 00 02 00 F0
+				29 01 00 00 00 00 06 A7 00 3C 3C 00 00
+				29 01 00 00 00 00 02 00 80
+				29 01 00 00 00 00 0d A9 00 00 00 00 00 00 00 00
+					00 00 00 00
+				29 01 00 00 00 00 02 00 90
+				29 01 00 00 00 00 0b A9 00 00 00 00 00 00 00 00
+					00 00
+				29 01 00 00 00 00 02 00 A0
+				29 01 00 00 00 00 02 A9 00
+				29 01 00 00 00 00 02 00 B0
+				29 01 00 00 00 00 06 A9 00 00 00 00 00
+				29 01 00 00 00 00 02 00 C0
+				29 01 00 00 00 00 0f A9 FF 3A 49 00 1E 00 01 00
+					00 00 00 00 00 77
+				29 01 00 00 00 00 02 00 D0
+				29 01 00 00 00 00 0B A9 FF FF 1D 00 01 7C 81 7C
+					0B E0
+				29 01 00 00 00 00 02 00 E0
+				29 01 00 00 00 00 02 A9 30
+				29 01 00 00 00 00 02 00 F0
+				29 01 00 00 00 00 06 A9 00 3C 3C 00 00
+				29 01 00 00 00 00 02 00 B0
+				29 01 00 00 00 00 09 A4 05 F0 0B E0 00 00 0B E0
+				29 01 00 00 00 00 02 00 80
+				29 01 00 00 00 00 10 AB 05 14 00 00 FF 6A 00 00
+					00 00 00 00 00 00 00
+				29 01 00 00 00 00 02 00 A0
+				29 01 00 00 00 00 10 AB 00 00 00 00 00 00 00 01
+					00 00 00 00 01 00 00
+				29 01 00 00 00 00 02 00 B0
+				29 01 00 00 00 00 0D AB 00 00 08 0A 00 00 44 04
+					00 00 00 00
+				29 01 00 00 00 00 02 00 93
+				29 01 00 00 00 00 02 B3 01
+				29 01 00 00 00 00 02 00 80
+				29 01 00 00 00 00 08 CE 00 00 00 00 00 00 00
+				29 01 00 00 00 00 02 00 87
+				29 01 00 00 00 00 08 CE 00 00 33 00 33 00 00
+				29 01 00 00 00 00 02 00 F0
+				29 01 00 00 00 00 05 CE 00 00 00 00
+				29 01 00 00 00 00 02 00 90
+				29 01 00 00 00 00 10 CE 00 00 00 F0 00 00 00 00
+					FC 00 FC 00 00 00 00
+				29 01 00 00 00 00 02 00 A0
+				29 01 00 00 00 00 08 CE 00 00 40 40 40 00 00
+				29 01 00 00 00 00 02 00 B0
+				29 01 00 00 00 00 10 CE 01 01 01 01 01 01 01 01
+					F1 01 F1 01 01 01 01
+				29 01 00 00 00 00 02 00 C0
+				29 01 00 00 00 00 08 CE 01 01 01 01 01 01 01
+				29 01 00 00 00 00 02 00 D0
+				29 01 00 00 00 00 10 CE 04 04 04 04 04 04 04 04
+					F7 04 F7 04 04 00 00
+				29 01 00 00 00 00 02 00 E0
+				29 01 00 00 00 00 08 CE 00 00 15 15 15 04 04
+				29 01 00 00 00 00 02 00 F4
+				29 01 00 00 00 00 02 CE 25
+				29 01 00 00 00 00 02 00 A0
+				29 01 00 00 00 00 0d D6 00 00 00 00 00 00 00 00
+					00 00 00 00
+				29 01 00 00 00 00 02 00 B0
+				29 01 00 00 00 00 0d D6 fd fd fd fd fd fd fd fd
+					fd fd fd fd
+				29 01 00 00 00 00 02 00 C0
+				29 01 00 00 00 00 0d D6 a9 a9 a9 a9 a9 a9 a9 a9
+					a9 a9 a9 a9
+				29 01 00 00 00 00 02 00 D0
+				29 01 00 00 00 00 0d D6 54 54 54 54 54 54 54 54
+					54 54 54 54
+				29 01 00 00 00 00 02 00 00
+				29 01 00 00 00 00 19 e1 00 06 0B 15 1d 25 32 47
+					54 67 73 7C 7C 74 6B 5A 47 34 28 21 18
+					09 05 00
+				29 01 00 00 00 00 02 00 00
+				29 01 00 00 00 00 19 e2 00 06 0B 15 1d 25 32 47
+					54 67 73 7C 7C 74 6B 5A 47 34 28 21 18
+					09 05 00
+				29 01 00 00 00 00 02 00 00
+				29 01 00 00 00 00 19 e3 00 06 0B 15 1d 25 32 47
+					54 67 73 7C 7C 74 6B 5A 47 34 28 21 18
+					09 05 00
+				29 01 00 00 00 00 02 00 00
+				29 01 00 00 00 00 19 e4 00 06 0B 15 1d 25 32 47
+					54 67 73 7C 7C 74 6B 5A 47 34 28 21 18
+					09 05 00
+				29 01 00 00 00 00 02 00 00
+				29 01 00 00 00 00 19 e5 00 06 0B 15 1d 25 32 47
+					54 67 73 7C 7C 74 6B 5A 47 34 28 21 18
+					09 05 00
+				29 01 00 00 00 00 02 00 00
+				29 01 00 00 00 00 19 e6 00 06 0B 15 1d 25 32 47
+					54 67 73 7C 7C 74 6B 5A 47 34 28 21 18
+					09 05 00
+				29 01 00 00 00 00 02 00 80
+				29 01 00 00 00 00 03 FF 00 00
+				29 01 00 00 00 00 02 00 00
+				29 01 00 00 00 00 04 FF 00 00 00
+				29 01 00 00 78 00 02 11 00
+				29 01 00 00 05 00 02 29 00];
+
+		qcom,mdss-dsi-off-command = [05 01 00 00 00 00 02 28 00
+					05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <1>;
+		qcom,mdss-dsi-traffic-mode = "burst_mode";
+		qcom,mdss-dsi-lane-map = "lane_map_0123";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lp11-init;
+		qcom,mdss-dsi-init-delay-us = <5>;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-wr-mem-start = <0x2c>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+		qcom,mdss-dsi-panel-timings = [6E 3F 36 00 5A 4F 38 41 54 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x1E>;
+		qcom,mdss-dsi-t-clk-pre = <0x30>;
+		qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+		qcom,mdss-dsi-bl-pmic-bank-select = <0>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-reset-sequence = <1 1>, <0 1>, <1 5>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-r69006-1080p-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-r69006-1080p-cmd.dtsi
new file mode 100644
index 000000000000..1d5ae2d84271
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-r69006-1080p-cmd.dtsi
@@ -0,0 +1,153 @@
+/*
+ * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*---------------------------------------------------------------------------
+ * This file is autogenerated file using gcdb parser. Please do not edit it.
+ * Update input XML file to add a new entry or update variable in this file
+ * VERSION = "1.0"
+ *---------------------------------------------------------------------------*/
+&mdss_mdp {
+	dsi_r69006_1080p_cmd: qcom,mdss_dsi_r69006_1080p_cmd {
+		qcom,mdss-dsi-panel-name = "r69006 1080p cmd mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1080>;
+		qcom,mdss-dsi-panel-height = <1920>;
+		qcom,mdss-dsi-h-front-porch = <100>;
+		qcom,mdss-dsi-h-back-porch = <82>;
+		qcom,mdss-dsi-h-pulse-width = <20>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <9>;
+		qcom,mdss-dsi-v-front-porch = <3>;
+		qcom,mdss-dsi-v-pulse-width = <15>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [23 01 00 00 00 00 02 B0 00
+			29 01 00 00 00 00 06
+				B3 04 10 00 00 00
+			29 01 00 00 00 00 03 B4 0c 00
+			29 01 00 00 00 00 04 B6 3b c3 00
+			23 01 00 00 00 00 02 C0 00
+			15 01 00 00 00 00 02 36 98
+			23 01 00 00 00 00 02 CC 04
+			29 01 00 00 00 00 20
+				C1 84 00 10 EF 8B
+				F1 FF FF DF 9C C5
+				9A 73 8D AD 63 FE
+				FF FF CB F8 01 00
+				AA 40 00 C2 01 08
+				00 01
+			29 01 00 00 00 00 0A
+				CB 0D FE 1F 2C 00
+				00 00 00 00
+			29 01 00 00 00 00 0B
+				C2 01 F7 80 04 63
+				00 60 00 01 30
+			29 01 00 00 00 00 07
+				C3 55 01 00 01 00
+				00
+			29 01 00 00 00 00 12
+				C4 70 00 00 00 00
+				00 00 00 00 02 01
+				00 05 01 00 00 00
+			29 01 00 00 00 00 0F
+				C6 59 07 4a 07 4a
+				01 0E 01 02 01 02
+				09 15 07
+			29 01 00 00 00 00 1F
+				C7 00 06 0C 16 27 35 3F
+				4D 33 3C 49 5B 64 66 67
+				00 06 0C 16 27 35 3F 4D
+				33 3C 49 5B 64 66 67
+			29 01 00 00 00 00 14
+				C8 00 00 00 00 00
+				FC 00 00 00 00 00
+				FC 00 00 00 00 00
+				FC 00
+			29 01 00 00 00 00 09
+				C9 1F 68 1F 68 4C
+				4C C4 11
+			29 01 00 00 00 00 11
+				D0 11 01 91 0B D9 19 19
+				00 00 00 19 99 00 00 00
+				00
+			29 01 00 00 00 00 1D
+				D3 1B 3B BB AD A5 33 33
+				33 00 80 AD A8 37 33 33
+				33 33 F7 F2 1F 7D 7C FF
+				0F 99 00 FF FF
+			29 01 00 00 00 00 04
+				D4 57 33 03
+			29 01 00 00 00 00 0C
+				D5 66 00 00 01 32 01 32
+				00 0b 00 0b
+			29 01 00 00 00 00 02 BE 04
+			29 01 00 00 00 00 11
+				CF 40 10 00 00 00 00 32
+				00 00 00 00 00 00 00 00
+				00
+			29 01 00 00 00 00 06
+				DE 00 00 3F FF 10
+			29 01 00 00 00 00 02 E9 00
+			29 01 00 00 00 00 02 F2 00
+			23 01 00 00 00 00 02 D6 01
+			39 01 00 00 00 00 02 35 00
+			39 01 00 00 00 00 02 51 FF
+			39 01 00 00 00 00 02 53 2C
+			39 01 00 00 14 00 02 55 00
+			05 01 00 00 14 00 02 29 00
+			05 01 00 00 78 00 02 11 00];
+		qcom,mdss-dsi-off-command = [05 01 00 00 32 00 02 28 00
+			05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-traffic-mode = "burst_mode";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-wr-mem-start = <0x2c>;
+		qcom,mdss-dsi-wr-mem-continue = <0x3c>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+		qcom,mdss-dsi-panel-timings = [6E 3F 36 00 5A 4F
+			38 41 54 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x1e>;
+		qcom,mdss-dsi-t-clk-pre = <0x30>;
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+		qcom,mdss-dsi-reset-sequence = <1 20>, <0 2>, <1 20>;
+		qcom,mdss-dsi-panel-status-command = [06 01 00 01 05 00 01 0A];
+		qcom,mdss-dsi-panel-status-command-mode = "dsi_lp_mode";
+		qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+		qcom,mdss-dsi-panel-status-read-length = <1>;
+		qcom,mdss-dsi-panel-status-value = <0x1C>;
+		qcom,mdss-dsi-panel-max-error-count = <3>;
+		qcom,mdss-dsi-rx-eot-ignore;
+		qcom,mdss-dsi-tx-eot-append;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-r69006-1080p-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-r69006-1080p-video.dtsi
new file mode 100644
index 000000000000..692f5e09b83f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-r69006-1080p-video.dtsi
@@ -0,0 +1,129 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*---------------------------------------------------------------------------
+ * This file is autogenerated file using gcdb parser. Please do not edit it.
+ * Update input XML file to add a new entry or update variable in this file
+ * VERSION = "1.0"
+ *---------------------------------------------------------------------------*/
+&mdss_mdp {
+	dsi_r69006_1080p_video: qcom,mdss_dsi_r69006_1080p_video {
+		qcom,mdss-dsi-panel-name = "r69006 1080p video mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1080>;
+		qcom,mdss-dsi-panel-height = <1920>;
+		qcom,mdss-dsi-h-front-porch = <100>;
+		qcom,mdss-dsi-h-back-porch = <82>;
+		qcom,mdss-dsi-h-pulse-width = <20>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <9>;
+		qcom,mdss-dsi-v-front-porch = <3>;
+		qcom,mdss-dsi-v-pulse-width = <15>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [23 01 00 00 00 00 02 B0 00
+			29 01 00 00 00 00 06
+				B3 05 10 00 00 00
+			29 01 00 00 00 00 03 B4 0c 00
+			29 01 00 00 00 00 04 B6 3b c3 00
+			23 01 00 00 00 00 02 C0 00
+			15 01 00 00 00 00 02 36 98
+			23 01 00 00 00 00 02 CC 04
+			29 01 00 00 00 00 20
+				C1 84 00 10 EF 8B
+				F1 FF FF DF 9C C5
+				9A 73 8D AD 63 FE
+				FF FF CB F8 01 00
+				AA 40 00 C2 01 08
+				00 01
+			29 01 00 00 00 00 0A
+				CB 0D FE 1F 2C 00
+				00 00 00 00
+			29 01 00 00 00 00 0B
+				C2 01 F7 80 04 63
+				00 60 00 01 30
+			29 01 00 00 00 00 07
+				C3 55 01 00 01 00
+				00
+			29 01 00 00 00 00 12
+				C4 70 00 00 00 00
+				00 00 00 00 02 01
+				00 05 01 00 00 00
+			29 01 00 00 00 00 0F
+				C6 59 07 4a 07 4a
+				01 0E 01 02 01 02
+				09 15 07
+			29 01 00 00 00 00 1F
+				C7 00 30 32 34 42
+				4E 56 62 44 4A 54
+				62 6B 73 7F 08 30
+				32 34 42 4E 56 62
+				44 4A 54 62 6B 73
+				7F
+			29 01 00 00 00 00 14
+				C8 00 00 00 00 00
+				FC 00 00 00 00 00
+				FC 00 00 00 00 00
+				FC 00
+			29 01 00 00 00 00 09
+				C9 1F 68 1F 68 4C
+				4C C4 11
+			29 01 00 00 00 00 11
+				D0 33 01 91 0B D9
+				19 19 00 00 00 19
+				99 00 00 00 00
+			29 01 00 00 00 00 1D
+				D3 1B 3B BB AD A5
+				33 33 33 00 80 AD
+				A8 6f 6f 33 33 33
+				F7 F2 1F 7D 7C FF
+				0F 99 00 FF FF
+			29 01 00 00 00 00 04
+				D4 57 33 03
+			29 01 00 00 00 00 0C
+				D5 66 00 00 01 27
+				01 27 00 6D 00 6D
+			23 01 00 00 00 00 02 D6 81
+			05 01 00 00 78 00 02 11 00
+			05 01 00 00 78 00 02 29 00];
+		qcom,mdss-dsi-off-command = [05 01 00 00 78 00 02 28 00
+			05 01 00 00 96 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <1>;
+		qcom,mdss-dsi-traffic-mode = "burst_mode";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [7d 25 1d 00 37 33
+			22 27 1e 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x20>;
+		qcom,mdss-dsi-t-clk-pre = <0x2c>;
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+		qcom,mdss-dsi-reset-sequence = <1 20>, <0 2>, <1 20>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-r69007-dualdsi-wqxga-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-r69007-dualdsi-wqxga-cmd.dtsi
new file mode 100644
index 000000000000..abe823b149a1
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-r69007-dualdsi-wqxga-cmd.dtsi
@@ -0,0 +1,107 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*---------------------------------------------------------------------------
+ * This file is autogenerated file using gcdb parser. Please do not edit it.
+ * Update input XML file to add a new entry or update variable in this file
+ * VERSION = "1.0"
+ *---------------------------------------------------------------------------*/
+&mdss_mdp {
+	dsi_r69007_wqxga_cmd: qcom,mdss_dsi_r69007_wqxga_cmd{
+		qcom,mdss-dsi-panel-name = "r69007 command mode dual dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <720>;
+		qcom,mdss-dsi-panel-height = <2560>;
+		qcom,mdss-dsi-h-front-porch = <112>;
+		qcom,mdss-dsi-h-back-porch = <70>;
+		qcom,mdss-dsi-h-pulse-width = <10>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <8>;
+		qcom,mdss-dsi-v-front-porch = <9>;
+		qcom,mdss-dsi-v-pulse-width = <1>;
+
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-color-order = "rgb_swap_rgb";
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [29 01 00 00 00 00 02 b0 00
+				29 01 00 00 00 00 04 b3 04 00 00
+				29 01 00 00 00 00 04 b6 3b d3 00
+				29 01 00 00 00 00 28 c1 80 08 11 1f fc f2 c9 1f 5f 98 b3 fe ff f7 fe ff d7 31 f1 cb 3f 3f fd ef 03 24 69 18 aa 40 01 42 02 08 00 01 00 01 00
+				29 01 00 00 00 00 0f c2 01 fa 00 04 64 08 00 60 00 38 70 00 00 00
+				29 01 00 00 00 00 09 c3 07 01 08 01 00 00 00 00
+				29 01 00 00 00 00 12 c4 70 00 00 00 02 00 00 00 00 02 01 00 01 01 00 00 00
+				29 01 00 00 00 00 11 c6 3c 00 3c 02 37 01 0e 01 02 01 02 03 0f 04 3c 46
+				29 01 00 00 00 00 1f c7 00 11 1c 28 37 44 4e 5b 3e 46 52 5f 68 72 78 00 11 1c 28 37 44 4e 5b 3e 46 52 5f 68 72 78
+				29 01 00 00 00 00 14 c8 00 00 00 00 00 fc 00 00 00 00 00 fc 00 00 00 00 00 fc 00
+				29 01 00 00 00 00 14 c9 00 00 00 00 00 fc 00 00 00 00 00 fc 00 00 00 00 00 fc 00
+				29 01 00 00 00 00 14 cb aa 1e e3 55 f1 ff 00 00 00 00 00 00 00 00 00 00 00 00 00
+				29 01 00 00 00 00 02 cc 07
+				29 01 00 00 00 00 0b cd 3a 86 3a 86 8d 8d 04 04 00 00
+				29 01 00 00 00 00 11 d0 19 01 91 6a dc 59 19 00 00 00 19 99 04 00 00 00
+				29 01 00 00 00 00 21 d3 1b 3b bb 77 77 77 bb b3 33 00 80 a7 af 5b 5b 33 33 33 c0 00 f2 0f 7d 7c ff 0f 99 00 33 00 ff ff
+				29 01 00 00 00 00 06 d4 57 33 07 00 f4
+				29 01 00 00 00 00 0c d5 66 00 00 01 3d 01 3d 00 38 00 38
+				29 01 00 00 00 00 22 d7 04 ff 23 15 75 a4 c3 1f c3 1f d9 07 1c 1f 30 8e 87 c7 e3 f1 cc f0 1f f0 0d 70 00 2a 00 7e 1d 07 00
+				29 01 00 00 00 00 05 de 00 3f ff 10
+				29 01 00 00 00 00 02 d6 01
+				39 01 00 00 00 00 02 35 00
+				39 01 00 00 00 00 05 2a 00 00 05 9f
+				39 01 00 00 00 00 05 2b 00 00 09 ff
+				39 01 00 00 00 00 02 2c 00
+				39 01 00 00 00 00 02 36 40
+				05 01 00 00 78 00 02 29 00
+				05 01 00 00 40 00 02 11 00];
+		qcom,mdss-dsi-off-command = [05 01 00 00 00 00 02 28 00
+				05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <1>;
+		qcom,mdss-dsi-traffic-mode = "burst_mode";
+		qcom,mdss-dsi-lane-map = "lane_map_0123";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [da 34 24 00 64 68 28 38 2a 03 04 00];
+
+		qcom,mdss-dsi-t-clk-pre = <0x29>;
+		qcom,mdss-dsi-t-clk-post = <0x03>;
+
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-te-v-sync-rd-ptr-irq-line = <0x2c>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-using-te-pin;
+
+		qcom,mdss-tear-check-sync-cfg-height = <2589>;
+		qcom,mdss-tear-check-frame-rate = <6000>;
+
+		qcom,esd-check-enabled;
+		qcom,mdss-dsi-panel-status-check-mode = "te_signal_check";
+		qcom,mdss-dsi-reset-sequence = <1 1>, <0 1>, <1 5>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-rm67195-amoled-fhd-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-rm67195-amoled-fhd-cmd.dtsi
new file mode 100644
index 000000000000..6ed6a1b3da6c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-rm67195-amoled-fhd-cmd.dtsi
@@ -0,0 +1,131 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_rm67195_amoled_fhd_cmd: qcom,mdss_dsi_rm67195_amoled_fhd_cmd{
+		qcom,mdss-dsi-panel-name =
+			"rm67195 amoled fhd cmd mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1080>;
+		qcom,mdss-dsi-panel-height = <1920>;
+		qcom,mdss-dsi-h-front-porch = <120>;
+		qcom,mdss-dsi-h-back-porch = <60>;
+		qcom,mdss-dsi-h-pulse-width = <12>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <12>;
+		qcom,mdss-dsi-v-front-porch = <8>;
+		qcom,mdss-dsi-v-pulse-width = <4>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-color-order = "rgb_swap_rgb";
+		qcom,mdss-dsi-on-command = [
+				15 01 00 00 00 00 02 fe 0d
+				15 01 00 00 00 00 02 0b c0
+				15 01 00 00 00 00 02 42 00
+				15 01 00 00 00 00 02 18 08
+				15 01 00 00 00 00 02 08 41
+				15 01 00 00 00 00 02 46 02
+				15 01 00 00 00 00 02 1e 04
+				15 01 00 00 02 00 02 1e 00
+				15 01 00 00 00 00 02 fe 0a
+				15 01 00 00 00 00 02 24 17
+				15 01 00 00 00 00 02 04 07
+				15 01 00 00 00 00 02 1a 0c
+				15 01 00 00 02 00 02 0f 44
+				15 01 00 00 00 00 02 fe 0b
+				15 01 00 00 00 00 02 28 40
+				15 01 00 00 02 00 02 29 4f
+				15 01 00 00 00 00 02 fe 04
+				15 01 00 00 00 00 02 0a d8
+				15 01 00 00 00 00 02 0c e6
+				15 01 00 00 00 00 02 4e 20
+				15 01 00 00 00 00 02 4f 1b
+				15 01 00 00 00 00 02 50 2f
+				15 01 00 00 02 00 02 51 08
+				15 01 00 00 00 00 02 fe 09
+				15 01 00 00 00 00 02 00 08
+				15 01 00 00 00 00 02 01 08
+				15 01 00 00 00 00 02 02 00
+				15 01 00 00 00 00 02 03 00
+				15 01 00 00 00 00 02 04 10
+				15 01 00 00 00 00 02 05 00
+				15 01 00 00 00 00 02 06 08
+				15 01 00 00 00 00 02 07 08
+				15 01 00 00 00 00 02 08 00
+				15 01 00 00 00 00 02 12 24
+				15 01 00 00 00 00 02 13 49
+				15 01 00 00 00 00 02 14 92
+				15 01 00 00 00 00 02 15 49
+				15 01 00 00 00 00 02 16 92
+				15 01 00 00 00 00 02 17 24
+				15 01 00 00 00 00 02 18 24
+				15 01 00 00 00 00 02 19 49
+				15 01 00 00 00 00 02 1a 92
+				15 01 00 00 00 00 02 1b 49
+				15 01 00 00 00 00 02 1c 92
+				15 01 00 00 00 00 02 1d 24
+				15 01 00 00 00 00 02 1e 24
+				15 01 00 00 00 00 02 1f 49
+				15 01 00 00 00 00 02 20 92
+				15 01 00 00 00 00 02 21 49
+				15 01 00 00 00 00 02 22 92
+				15 01 00 00 00 00 02 23 24
+				15 01 00 00 00 00 02 9b 07
+				15 01 00 00 02 00 02 9c a5
+				15 01 00 00 00 00 02 fe 00
+				15 01 00 00 00 00 02 c2 08
+				15 01 00 00 02 00 02 35 00
+				39 01 00 00 00 00 03 44 03 e8
+				05 01 00 00 82 00 02 11 00
+				05 01 00 00 14 00 02 29 00];
+
+		qcom,mdss-dsi-off-command = [05 01 00 00 14 00 02 28 00
+				05 01 00 00 82 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_pulse";
+		qcom,mdss-dsi-lane-map = "lane_map_0123";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-t-clk-post = <0x0d>;
+		qcom,mdss-dsi-t-clk-pre = <0x2f>;
+		qcom,mdss-dsi-wr-mem-start = <0x2c>;
+		qcom,mdss-dsi-wr-mem-continue = <0x3c>;
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-lp11-init;
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_dcs";
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <255>;
+		qcom,mdss-pan-physical-width-dimension = <70>;
+		qcom,mdss-pan-physical-height-dimension = <125>;
+		qcom,mdss-dsi-reset-sequence = <1 20>, <0 20>, <1 20>;
+		qcom,mdss-dsi-panel-orientation = "180";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-s6e3ha3-amoled-dualmipi-wqhd-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-s6e3ha3-amoled-dualmipi-wqhd-cmd.dtsi
new file mode 100644
index 000000000000..5aa2e1ee8316
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-s6e3ha3-amoled-dualmipi-wqhd-cmd.dtsi
@@ -0,0 +1,145 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_dual_s6e3ha3_amoled_cmd: qcom,mdss_dsi_s6e3ha3_amoled_wqhd_cmd{
+		qcom,mdss-dsi-panel-name =
+			"Dual s6e3ha3 amoled cmd mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <720>;
+		qcom,mdss-dsi-panel-height = <2560>;
+		qcom,mdss-dsi-h-front-porch = <100>;
+		qcom,mdss-dsi-h-back-porch = <100>;
+		qcom,mdss-dsi-h-pulse-width = <40>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <31>;
+		qcom,mdss-dsi-v-front-porch = <30>;
+		qcom,mdss-dsi-v-pulse-width = <8>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-color-order = "rgb_swap_rgb";
+		qcom,mdss-dsi-on-command = [05 01 00 00 05 00 02 11 00
+					39 01 00 00 00 00 05 2a 00 00 05 9f
+					39 01 00 00 00 00 05 2b 00 00 09 ff
+					39 01 00 00 00 00 03 f0 5a 5a
+					39 01 00 00 00 00 02 b0 10
+					39 01 00 00 00 00 02 b5 a0
+					39 01 00 00 00 00 02 c4 03
+					39 01 00 00 00 00 0a
+						f6 42 57 37 00 aa cc d0 00 00
+					39 01 00 00 00 00 02 f9 03
+					39 01 00 00 00 00 14
+						c2 00 00 d8 d8 00 80 2b 05 08
+						0e 07 0b 05 0d 0a 15 13 20 1e
+					39 01 00 00 78 00 03 f0 a5 a5
+					39 01 00 00 00 00 02 35 00
+					39 01 00 00 00 00 02 53 20
+					05 01 00 00 05 00 02 29 00];
+		qcom,mdss-dsi-off-command = [05 01 00 00 3c 00 02 28 00
+					05 01 00 00 b4 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-lp-mode-on = [39 00 00 00 05 00 03 f0 5a 5a
+					39 00 00 00 05 00 03 f1 5a 5a
+					39 00 00 00 05 00 03 fc 5a 5a
+					39 00 00 00 05 00 02 b0 17
+					39 00 00 00 05 00 02 cb 10
+					39 00 00 00 05 00 02 b0 2d
+					39 00 00 00 05 00 02 cb cd
+					39 00 00 00 05 00 02 b0 0e
+					39 00 00 00 05 00 02 cb 02
+					39 00 00 00 05 00 02 b0 0f
+					39 00 00 00 05 00 02 cb 09
+					39 00 00 00 05 00 02 b0 02
+					39 00 00 00 05 00 02 f2 c9
+					39 00 00 00 05 00 02 b0 03
+					39 00 00 00 05 00 02 f2 c0
+					39 00 00 00 05 00 02 b0 03
+					39 00 00 00 05 00 02 f4 aa
+					39 00 00 00 05 00 02 b0 08
+					39 00 00 00 05 00 02 b1 30
+					39 00 00 00 05 00 02 b0 09
+					39 00 00 00 05 00 02 b1 0a
+					39 00 00 00 05 00 02 b0 0d
+					39 00 00 00 05 00 02 b1 10
+					39 00 00 00 05 00 02 b0 00
+					39 00 00 00 05 00 02 f7 03
+					39 00 00 00 05 00 02 fe 30
+					39 01 00 00 05 00 02 fe b0];
+		qcom,mdss-dsi-lp-mode-off = [39 00 00 00 05 00 03 f0 5a 5a
+					39 00 00 00 05 00 03 f1 5a 5a
+					39 00 00 00 05 00 03 fc 5a 5a
+					39 00 00 00 05 00 02 b0 2d
+					39 00 00 00 05 00 02 cb 4d
+					39 00 00 00 05 00 02 b0 17
+					39 00 00 00 05 00 02 cb 04
+					39 00 00 00 05 00 02 b0 0e
+					39 00 00 00 05 00 02 cb 06
+					39 00 00 00 05 00 02 b0 0f
+					39 00 00 00 05 00 02 cb 05
+					39 00 00 00 05 00 02 b0 02
+					39 00 00 00 05 00 02 f2 b8
+					39 00 00 00 05 00 02 b0 03
+					39 00 00 00 05 00 02 f2 80
+					39 00 00 00 05 00 02 b0 03
+					39 00 00 00 05 00 02 f4 8a
+					39 00 00 00 05 00 02 b0 08
+					39 00 00 00 05 00 02 b1 10
+					39 00 00 00 05 00 02 b0 09
+					39 00 00 00 05 00 02 b1 0a
+					39 00 00 00 05 00 02 b0 0d
+					39 00 00 00 05 00 02 b1 80
+					39 00 00 00 05 00 02 b0 00
+					39 00 00 00 05 00 02 f7 03
+					39 00 00 00 05 00 02 fe 30
+					39 01 00 00 05 00 02 fe b0];
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-lane-map = "lane_map_0123";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-tx-eot-append;
+		qcom,dcs-cmd-by-left;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-wr-mem-start = <0x2c>;
+		qcom,mdss-dsi-wr-mem-continue = <0x3c>;
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+		qcom,mdss-dsi-panel-timings =
+			[eb 38 26 00 6a 66 32 3c 2f 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x2c>;
+		qcom,mdss-dsi-t-clk-pre = <0x1c>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-lp11-init;
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_dcs";
+		qcom,mdss-dsi-bl-dcs-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <255>;
+		qcom,mdss-pan-physical-width-dimension = <68>;
+		qcom,mdss-pan-physical-height-dimension = <122>;
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-sharp-1080p-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-sharp-1080p-cmd.dtsi
new file mode 100644
index 000000000000..401cb21b4ada
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-sharp-1080p-cmd.dtsi
@@ -0,0 +1,81 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_sharp_1080_cmd: qcom,mdss_dsi_sharp_1080p_cmd {
+		qcom,mdss-dsi-panel-name = "sharp 1080p cmd mode dsi panel";
+		qcom,mdss-dsi-panel-controller = <&mdss_dsi0>;
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-destination = "display_1";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-panel-clockrate = <850000000>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1080>;
+		qcom,mdss-dsi-panel-height = <1920>;
+		qcom,mdss-dsi-h-front-porch = <0>;
+		qcom,mdss-dsi-h-back-porch = <0>;
+		qcom,mdss-dsi-h-pulse-width = <0>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <0>;
+		qcom,mdss-dsi-v-front-porch = <0>;
+		qcom,mdss-dsi-v-pulse-width = <0>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+		qcom,mdss-dsi-on-command = [
+			15 01 00 00 00 00 02 bb 10
+			15 01 00 00 00 00 02 b0 03
+			05 01 00 00 78 00 01 11
+			15 01 00 00 00 00 02 51 ff
+			15 01 00 00 00 00 02 53 24
+			15 01 00 00 00 00 02 ff 23
+			15 01 00 00 00 00 02 08 05
+			15 01 00 00 00 00 02 46 90
+			15 01 00 00 00 00 02 ff 10
+			15 01 00 00 00 00 02 ff f0
+			15 01 00 00 00 00 02 92 01
+			15 01 00 00 00 00 02 ff 10
+			05 01 00 00 28 00 01 29];
+		qcom,mdss-dsi-off-command = [
+			05 01 00 00 10 00 01 28
+			05 01 00 00 40 00 01 10];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "burst_mode";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [e7 36 24 00 66 6a 2a 3a 2d 03 04
+			00];
+		qcom,mdss-dsi-t-clk-post = <0x0d>;
+		qcom,mdss-dsi-t-clk-pre = <0x2e>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-wr-mem-start = <0x2c>;
+		qcom,mdss-dsi-wr-mem-continue = <0x3c>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-sharp-dsc-4k-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-sharp-dsc-4k-cmd.dtsi
new file mode 100644
index 000000000000..ff3b7b80c449
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-sharp-dsc-4k-cmd.dtsi
@@ -0,0 +1,100 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_sharp_4k_dsc_cmd: qcom,mdss_dsi_sharp_4k_dsc_cmd {
+		qcom,mdss-dsi-panel-name = "Sharp 4k cmd mode dsc dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1080>;
+		qcom,mdss-dsi-panel-height = <3840>;
+		qcom,mdss-dsi-h-front-porch = <30>;
+		qcom,mdss-dsi-h-back-porch = <100>;
+		qcom,mdss-dsi-h-pulse-width = <4>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <7>;
+		qcom,mdss-dsi-v-front-porch = <8>;
+		qcom,mdss-dsi-v-pulse-width = <1>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "burst_mode";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [d9 6a 48 00 b0 b0 52 6c 57 03 04
+			00];
+		qcom,mdss-dsi-t-clk-post = <0xc>;
+		qcom,mdss-dsi-t-clk-pre = <0x28>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-reset-sequence = <1 20>, <0 20>, <1 20>;
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-wr-mem-start = <0x2c>;
+		qcom,mdss-dsi-wr-mem-continue = <0x3c>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+		qcom,ulps-enabled;
+		qcom,dcs-cmd-by-left;
+		qcom,mdss-dsi-tx-eot-append;
+		qcom,mdss-pan-physical-width-dimension = <68>;
+		qcom,mdss-pan-physical-height-dimension = <121>;
+
+		qcom,adjust-timer-wakeup-ms = <1>;
+		qcom,mdss-dsi-on-command = [
+			39 01 00 00 00 00 11 91 09 20 00 20 02 00 03 1c 04 21 00
+			0f 03 19 01 97
+			39 01 00 00 00 00 03 92 10 f0
+			15 01 00 00 00 00 02 90 03
+			15 01 00 00 00 00 02 03 01
+			39 01 00 00 00 00 06 f0 55 aa 52 08 04
+			15 01 00 00 00 00 02 c0 03
+			39 01 00 00 00 00 06 f0 55 aa 52 08 07
+			15 01 00 00 00 00 02 ef 01
+			39 01 00 00 00 00 06 f0 55 aa 52 08 00
+			15 01 00 00 00 00 02 b4 01
+			15 01 00 00 00 00 02 35 00
+			39 01 00 00 00 00 06 f0 55 aa 52 08 01
+			39 01 00 00 00 00 05 ff aa 55 a5 80
+			15 01 00 00 00 00 02 6f 01
+			15 01 00 00 00 00 02 f3 10
+			39 01 00 00 00 00 05 ff aa 55 a5 00
+			05 01 00 00 78 00 01 11 /* sleep out + delay 120ms */
+			05 01 00 00 78 00 01 29 /* display on + delay 120ms */
+			];
+
+		qcom,mdss-dsi-off-command = [05 01 00 00 78 00 02 28 00
+				 05 01 00 00 78 00 02 10 00];
+
+		qcom,compression-mode = "dsc";
+		qcom,config-select = <&dsi_sharp_dsc_cmd_config0>;
+
+		dsi_sharp_dsc_cmd_config0: config0 {
+			qcom,mdss-dsc-encoders = <1>;
+			qcom,mdss-dsc-slice-height = <32>;
+			qcom,mdss-dsc-slice-width = <1080>;
+			qcom,mdss-dsc-slice-per-pkt = <1>;
+
+			qcom,mdss-dsc-bit-per-component = <8>;
+			qcom,mdss-dsc-bit-per-pixel = <8>;
+			qcom,mdss-dsc-block-prediction-enable;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-sharp-dsc-4k-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-sharp-dsc-4k-video.dtsi
new file mode 100644
index 000000000000..933746b8abe7
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-sharp-dsc-4k-video.dtsi
@@ -0,0 +1,92 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_sharp_4k_dsc_video: qcom,mdss_dsi_sharp_4k_dsc_video {
+		qcom,mdss-dsi-panel-name = "Sharp 4k video mode dsc dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1080>;
+		qcom,mdss-dsi-panel-height = <3840>;
+		qcom,mdss-dsi-h-front-porch = <30>;
+		qcom,mdss-dsi-h-back-porch = <100>;
+		qcom,mdss-dsi-h-pulse-width = <4>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <7>;
+		qcom,mdss-dsi-v-front-porch = <8>;
+		qcom,mdss-dsi-v-pulse-width = <1>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "burst_mode";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [d9 6a 48 00 b0 b0 52 6c 57 03 04
+			00];
+		qcom,mdss-dsi-t-clk-post = <0xc>;
+		qcom,mdss-dsi-t-clk-pre = <0x28>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-reset-sequence = <1 20>, <0 20>, <1 20>;
+		qcom,mdss-dsi-tx-eot-append;
+		qcom,mdss-pan-physical-width-dimension = <68>;
+		qcom,mdss-pan-physical-height-dimension = <121>;
+
+		qcom,adjust-timer-wakeup-ms = <1>;
+		qcom,mdss-dsi-on-command = [
+			39 01 00 00 00 00 11 91 09 20 00 20 02 00 03 1c 04 21 00
+			0f 03 19 01 97
+			39 01 00 00 00 00 03 92 10 f0
+			15 01 00 00 00 00 02 90 03
+			15 01 00 00 00 00 02 03 01
+			39 01 00 00 00 00 06 f0 55 aa 52 08 04
+			15 01 00 00 00 00 02 c0 03
+			39 01 00 00 00 00 06 f0 55 aa 52 08 07
+			15 01 00 00 00 00 02 ef 01
+			39 01 00 00 00 00 06 f0 55 aa 52 08 00
+			15 01 00 00 00 00 02 b4 10
+			15 01 00 00 00 00 02 35 00
+			39 01 00 00 00 00 06 f0 55 aa 52 08 01
+			39 01 00 00 00 00 05 ff aa 55 a5 80
+			15 01 00 00 00 00 02 6f 01
+			15 01 00 00 00 00 02 f3 10
+			39 01 00 00 00 00 05 ff aa 55 a5 00
+			05 01 00 00 78 00 01 11 /* sleep out + delay 120ms */
+			05 01 00 00 78 00 01 29 /* display on + delay 120ms */
+			];
+
+		qcom,mdss-dsi-off-command = [05 01 00 00 78 00 02 28 00
+				 05 01 00 00 78 00 02 10 00];
+
+		qcom,compression-mode = "dsc";
+		qcom,config-select = <&dsi_sharp_dsc_video_config0>;
+
+		dsi_sharp_dsc_video_config0: config0 {
+			qcom,mdss-dsc-encoders = <1>;
+			qcom,mdss-dsc-slice-height = <32>;
+			qcom,mdss-dsc-slice-width = <1080>;
+			qcom,mdss-dsc-slice-per-pkt = <1>;
+
+			qcom,mdss-dsc-bit-per-component = <8>;
+			qcom,mdss-dsc-bit-per-pixel = <8>;
+			qcom,mdss-dsc-block-prediction-enable;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-sharp-dualmipi-1080p-120hz.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-sharp-dualmipi-1080p-120hz.dtsi
new file mode 100644
index 000000000000..a7861e96d3e2
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-sharp-dualmipi-1080p-120hz.dtsi
@@ -0,0 +1,636 @@
+/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_dual_sharp_1080_120hz_cmd: qcom,mdss_dual_sharp_1080p_120hz_cmd {
+		qcom,mdss-dsi-panel-name =
+			"sharp 1080p 120hz dual dsi cmd mode panel";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-framerate = <120>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <540>;
+		qcom,mdss-dsi-panel-height = <1920>;
+		qcom,mdss-dsi-h-front-porch = <28>;
+		qcom,mdss-dsi-h-back-porch = <4>;
+		qcom,mdss-dsi-h-pulse-width = <4>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <12>;
+		qcom,mdss-dsi-v-front-porch = <12>;
+		qcom,mdss-dsi-v-pulse-width = <2>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-reset-sequence = <1 20>, <0 1>, <1 10>;
+		qcom,mdss-dsi-on-command = [15 01 00 00 00 00 02 ff 10
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 ba 07
+			15 01 00 00 00 00 02 c0 00
+			15 01 00 00 00 00 02 bb 10
+			15 01 00 00 00 00 02 d9 00
+			15 01 00 00 00 00 02 ef 70
+			15 01 00 00 00 00 02 f7 80
+			39 01 00 00 00 00 06 3b 03 0e 0c 08 1c
+			15 01 00 00 00 00 02 e9 0e
+			15 01 00 00 00 00 02 ea 0c
+			15 01 00 00 00 00 02 35 00
+			15 01 00 00 00 00 02 c0 00
+			15 01 00 00 00 00 02 ff 20
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 59 6a
+			15 01 00 00 00 00 02 0b 1b
+			15 01 00 00 00 00 02 61 f7
+			15 01 00 00 00 00 02 62 6c
+			15 01 00 00 00 00 02 00 01
+			15 01 00 00 00 00 02 01 55
+			15 01 00 00 00 00 02 04 c8
+			15 01 00 00 00 00 02 05 1a
+			15 01 00 00 00 00 02 0d 93
+			15 01 00 00 00 00 02 0e 93
+			15 01 00 00 00 00 02 0f 7e
+			15 01 00 00 00 00 02 06 69
+			15 01 00 00 00 00 02 07 bc
+			15 01 00 00 00 00 02 10 03
+			15 01 00 00 00 00 02 11 64
+			15 01 00 00 00 00 02 12 5a
+			15 01 00 00 00 00 02 13 40
+			15 01 00 00 00 00 02 14 40
+			15 01 00 00 00 00 02 15 00
+			15 01 00 00 00 00 02 33 13
+			15 01 00 00 00 00 02 5a 40
+			15 01 00 00 00 00 02 5b 40
+			15 01 00 00 00 00 02 5e 80
+			15 01 00 00 00 00 02 ff 24
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 00 80
+			15 01 00 00 00 00 02 14 80
+			15 01 00 00 00 00 02 01 80
+			15 01 00 00 00 00 02 15 80
+			15 01 00 00 00 00 02 02 80
+			15 01 00 00 00 00 02 16 80
+			15 01 00 00 00 00 02 03 0a
+			15 01 00 00 00 00 02 17 0c
+			15 01 00 00 00 00 02 04 06
+			15 01 00 00 00 00 02 18 08
+			15 01 00 00 00 00 02 05 80
+			15 01 00 00 00 00 02 19 80
+			15 01 00 00 00 00 02 06 80
+			15 01 00 00 00 00 02 1a 80
+			15 01 00 00 00 00 02 07 80
+			15 01 00 00 00 00 02 1b 80
+			15 01 00 00 00 00 02 08 80
+			15 01 00 00 00 00 02 1c 80
+			15 01 00 00 00 00 02 09 80
+			15 01 00 00 00 00 02 1d 80
+			15 01 00 00 00 00 02 0a 80
+			15 01 00 00 00 00 02 1e 80
+			15 01 00 00 00 00 02 0b 1a
+			15 01 00 00 00 00 02 1f 1b
+			15 01 00 00 00 00 02 0c 16
+			15 01 00 00 00 00 02 20 17
+			15 01 00 00 00 00 02 0d 1c
+			15 01 00 00 00 00 02 21 1d
+			15 01 00 00 00 00 02 0e 18
+			15 01 00 00 00 00 02 22 19
+			15 01 00 00 00 00 02 0f 0e
+			15 01 00 00 00 00 02 23 10
+			15 01 00 00 00 00 02 10 80
+			15 01 00 00 00 00 02 24 80
+			15 01 00 00 00 00 02 11 80
+			15 01 00 00 00 00 02 25 80
+			15 01 00 00 00 00 02 12 80
+			15 01 00 00 00 00 02 26 80
+			15 01 00 00 00 00 02 13 80
+			15 01 00 00 00 00 02 27 80
+			15 01 00 00 00 00 02 74 ff
+			15 01 00 00 00 00 02 75 ff
+			15 01 00 00 00 00 02 8d 00
+			15 01 00 00 00 00 02 8e 00
+			15 01 00 00 00 00 02 8f 9c
+			15 01 00 00 00 00 02 90 0c
+			15 01 00 00 00 00 02 91 0e
+			15 01 00 00 00 00 02 d6 00
+			15 01 00 00 00 00 02 d7 20
+			15 01 00 00 00 00 02 d8 00
+			15 01 00 00 00 00 02 d9 88
+			15 01 00 00 00 00 02 e5 05
+			15 01 00 00 00 00 02 e6 10
+			15 01 00 00 00 00 02 54 06
+			15 01 00 00 00 00 02 55 05
+			15 01 00 00 00 00 02 56 04
+			15 01 00 00 00 00 02 58 03
+			15 01 00 00 00 00 02 59 33
+			15 01 00 00 00 00 02 5a 33
+			15 01 00 00 00 00 02 5b 01
+			15 01 00 00 00 00 02 5c 00
+			15 01 00 00 00 00 02 5d 01
+			15 01 00 00 00 00 02 5e 0a
+			15 01 00 00 00 00 02 5f 0a
+			15 01 00 00 00 00 02 60 0a
+			15 01 00 00 00 00 02 61 0a
+			15 01 00 00 00 00 02 62 10
+			15 01 00 00 00 00 02 63 01
+			15 01 00 00 00 00 02 64 00
+			15 01 00 00 00 00 02 65 00
+			15 01 00 00 00 00 02 ef 00
+			15 01 00 00 00 00 02 f0 00
+			15 01 00 00 00 00 02 6d 20
+			15 01 00 00 00 00 02 66 44
+			15 01 00 00 00 00 02 68 01
+			15 01 00 00 00 00 02 69 00
+			15 01 00 00 00 00 02 67 11
+			15 01 00 00 00 00 02 6a 06
+			15 01 00 00 00 00 02 6b 31
+			15 01 00 00 00 00 02 6c 90
+			15 01 00 00 00 00 02 ab c3
+			15 01 00 00 00 00 02 b1 49
+			15 01 00 00 00 00 02 aa 80
+			15 01 00 00 00 00 02 b0 90
+			15 01 00 00 00 00 02 b2 a4
+			15 01 00 00 00 00 02 b3 00
+			15 01 00 00 00 00 02 b4 23
+			15 01 00 00 00 00 02 b5 00
+			15 01 00 00 00 00 02 b6 00
+			15 01 00 00 00 00 02 b7 00
+			15 01 00 00 00 00 02 b8 00
+			15 01 00 00 00 00 02 b9 00
+			15 01 00 00 00 00 02 ba 00
+			15 01 00 00 00 00 02 bb 00
+			15 01 00 00 00 00 02 bc 00
+			15 01 00 00 00 00 02 bd 00
+			15 01 00 00 00 00 02 be 00
+			15 01 00 00 00 00 02 bf 00
+			15 01 00 00 00 00 02 c0 00
+			15 01 00 00 00 00 02 c7 40
+			15 01 00 00 00 00 02 c9 00
+			15 01 00 00 00 00 02 c1 2a
+			15 01 00 00 00 00 02 c2 2a
+			15 01 00 00 00 00 02 c3 00
+			15 01 00 00 00 00 02 c4 00
+			15 01 00 00 00 00 02 c5 00
+			15 01 00 00 00 00 02 c6 00
+			15 01 00 00 00 00 02 c8 ab
+			15 01 00 00 00 00 02 ca 00
+			15 01 00 00 00 00 02 cb 00
+			15 01 00 00 00 00 02 cc 20
+			15 01 00 00 00 00 02 cd 40
+			15 01 00 00 00 00 02 ce a8
+			15 01 00 00 00 00 02 cf a8
+			15 01 00 00 00 00 02 d0 00
+			15 01 00 00 00 00 02 d1 00
+			15 01 00 00 00 00 02 d2 00
+			15 01 00 00 00 00 02 d3 00
+			15 01 00 00 00 00 02 af 01
+			15 01 00 00 00 00 02 a4 1e
+			15 01 00 00 00 00 02 95 41
+			15 01 00 00 00 00 02 96 03
+			15 01 00 00 00 00 02 98 00
+			15 01 00 00 00 00 02 9a 9a
+			15 01 00 00 00 00 02 9b 03
+			15 01 00 00 00 00 02 9d 80
+			15 01 00 00 00 00 02 ff 26
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 fa d0
+			15 01 00 00 00 00 02 6b 80
+			15 01 00 00 00 00 02 6c 5c
+			15 01 00 00 00 00 02 6d 0c
+			15 01 00 00 00 00 02 6e 0e
+			15 01 00 00 00 00 02 58 01
+			15 01 00 00 00 00 02 59 15
+			15 01 00 00 00 00 02 5a 01
+			15 01 00 00 00 00 02 5b 00
+			15 01 00 00 00 00 02 5c 01
+			15 01 00 00 00 00 02 5d 2b
+			15 01 00 00 00 00 02 74 00
+			15 01 00 00 00 00 02 75 ba
+			15 01 00 00 00 00 02 81 0a
+			15 01 00 00 00 00 02 4e 81
+			15 01 00 00 00 00 02 4f 83
+			15 01 00 00 00 00 02 51 00
+			15 01 00 00 00 00 02 53 4d
+			15 01 00 00 00 00 02 54 03
+			15 01 00 00 00 00 02 ff e0
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 b2 81
+			15 01 00 00 00 00 02 62 28
+			15 01 00 00 00 00 02 a2 09
+			15 01 00 00 00 00 02 b3 01
+			15 01 00 00 00 00 02 ed 00
+			15 01 00 00 00 00 02 ff 10
+			05 01 00 00 78 00 01 11
+			15 01 00 00 00 00 02 ff 20
+			15 01 00 00 00 00 02 75 00
+			15 01 00 00 00 00 02 76 71
+			15 01 00 00 00 00 02 77 00
+			15 01 00 00 00 00 02 78 84
+			15 01 00 00 00 00 02 79 00
+			15 01 00 00 00 00 02 7a a5
+			15 01 00 00 00 00 02 7b 00
+			15 01 00 00 00 00 02 7c bb
+			15 01 00 00 00 00 02 7d 00
+			15 01 00 00 00 00 02 7e ce
+			15 01 00 00 00 00 02 7f 00
+			15 01 00 00 00 00 02 80 e0
+			15 01 00 00 00 00 02 81 00
+			15 01 00 00 00 00 02 82 ef
+			15 01 00 00 00 00 02 83 00
+			15 01 00 00 00 00 02 84 ff
+			15 01 00 00 00 00 02 85 01
+			15 01 00 00 00 00 02 86 0b
+			15 01 00 00 00 00 02 87 01
+			15 01 00 00 00 00 02 88 38
+			15 01 00 00 00 00 02 89 01
+			15 01 00 00 00 00 02 8a 5b
+			15 01 00 00 00 00 02 8b 01
+			15 01 00 00 00 00 02 8c 95
+			15 01 00 00 00 00 02 8d 01
+			15 01 00 00 00 00 02 8e c4
+			15 01 00 00 00 00 02 8f 02
+			15 01 00 00 00 00 02 90 0d
+			15 01 00 00 00 00 02 91 02
+			15 01 00 00 00 00 02 92 4a
+			15 01 00 00 00 00 02 93 02
+			15 01 00 00 00 00 02 94 4c
+			15 01 00 00 00 00 02 95 02
+			15 01 00 00 00 00 02 96 85
+			15 01 00 00 00 00 02 97 02
+			15 01 00 00 00 00 02 98 c3
+			15 01 00 00 00 00 02 99 02
+			15 01 00 00 00 00 02 9a e9
+			15 01 00 00 00 00 02 9b 03
+			15 01 00 00 00 00 02 9c 16
+			15 01 00 00 00 00 02 9d 03
+			15 01 00 00 00 00 02 9e 34
+			15 01 00 00 00 00 02 9f 03
+			15 01 00 00 00 00 02 a0 56
+			15 01 00 00 00 00 02 a2 03
+			15 01 00 00 00 00 02 a3 62
+			15 01 00 00 00 00 02 a4 03
+			15 01 00 00 00 00 02 a5 6c
+			15 01 00 00 00 00 02 a6 03
+			15 01 00 00 00 00 02 a7 74
+			15 01 00 00 00 00 02 a9 03
+			15 01 00 00 00 00 02 aa 80
+			15 01 00 00 00 00 02 ab 03
+			15 01 00 00 00 00 02 ac 89
+			15 01 00 00 00 00 02 ad 03
+			15 01 00 00 00 00 02 ae 8b
+			15 01 00 00 00 00 02 af 03
+			15 01 00 00 00 00 02 b0 8d
+			15 01 00 00 00 00 02 b1 03
+			15 01 00 00 00 00 02 b2 8e
+			15 01 00 00 00 00 02 b3 00
+			15 01 00 00 00 00 02 b4 71
+			15 01 00 00 00 00 02 b5 00
+			15 01 00 00 00 00 02 b6 84
+			15 01 00 00 00 00 02 b7 00
+			15 01 00 00 00 00 02 b8 a5
+			15 01 00 00 00 00 02 b9 00
+			15 01 00 00 00 00 02 ba bb
+			15 01 00 00 00 00 02 bb 00
+			15 01 00 00 00 00 02 bc ce
+			15 01 00 00 00 00 02 bd 00
+			15 01 00 00 00 00 02 be e0
+			15 01 00 00 00 00 02 bf 00
+			15 01 00 00 00 00 02 c0 ef
+			15 01 00 00 00 00 02 c1 00
+			15 01 00 00 00 00 02 c2 ff
+			15 01 00 00 00 00 02 c3 01
+			15 01 00 00 00 00 02 c4 0b
+			15 01 00 00 00 00 02 c5 01
+			15 01 00 00 00 00 02 c6 38
+			15 01 00 00 00 00 02 c7 01
+			15 01 00 00 00 00 02 c8 5b
+			15 01 00 00 00 00 02 c9 01
+			15 01 00 00 00 00 02 ca 95
+			15 01 00 00 00 00 02 cb 01
+			15 01 00 00 00 00 02 cc c4
+			15 01 00 00 00 00 02 cd 02
+			15 01 00 00 00 00 02 ce 0d
+			15 01 00 00 00 00 02 cf 02
+			15 01 00 00 00 00 02 d0 4a
+			15 01 00 00 00 00 02 d1 02
+			15 01 00 00 00 00 02 d2 4c
+			15 01 00 00 00 00 02 d3 02
+			15 01 00 00 00 00 02 d4 85
+			15 01 00 00 00 00 02 d5 02
+			15 01 00 00 00 00 02 d6 c3
+			15 01 00 00 00 00 02 d7 02
+			15 01 00 00 00 00 02 d8 e9
+			15 01 00 00 00 00 02 d9 03
+			15 01 00 00 00 00 02 da 16
+			15 01 00 00 00 00 02 db 03
+			15 01 00 00 00 00 02 dc 34
+			15 01 00 00 00 00 02 dd 03
+			15 01 00 00 00 00 02 de 56
+			15 01 00 00 00 00 02 df 03
+			15 01 00 00 00 00 02 e0 62
+			15 01 00 00 00 00 02 e1 03
+			15 01 00 00 00 00 02 e2 6c
+			15 01 00 00 00 00 02 e3 03
+			15 01 00 00 00 00 02 e4 74
+			15 01 00 00 00 00 02 e5 03
+			15 01 00 00 00 00 02 e6 80
+			15 01 00 00 00 00 02 e7 03
+			15 01 00 00 00 00 02 e8 89
+			15 01 00 00 00 00 02 e9 03
+			15 01 00 00 00 00 02 ea 8b
+			15 01 00 00 00 00 02 eb 03
+			15 01 00 00 00 00 02 ec 8d
+			15 01 00 00 00 00 02 ed 03
+			15 01 00 00 00 00 02 ee 8e
+			15 01 00 00 00 00 02 ef 00
+			15 01 00 00 00 00 02 f0 71
+			15 01 00 00 00 00 02 f1 00
+			15 01 00 00 00 00 02 f2 84
+			15 01 00 00 00 00 02 f3 00
+			15 01 00 00 00 00 02 f4 a5
+			15 01 00 00 00 00 02 f5 00
+			15 01 00 00 00 00 02 f6 bb
+			15 01 00 00 00 00 02 f7 00
+			15 01 00 00 00 00 02 f8 ce
+			15 01 00 00 00 00 02 f9 00
+			15 01 00 00 00 00 02 fa e0
+			15 01 00 00 00 00 02 ff 21
+			15 01 00 00 00 00 02 fb 01
+			15 01 00 00 00 00 02 00 00
+			15 01 00 00 00 00 02 01 ef
+			15 01 00 00 00 00 02 02 00
+			15 01 00 00 00 00 02 03 ff
+			15 01 00 00 00 00 02 04 01
+			15 01 00 00 00 00 02 05 0b
+			15 01 00 00 00 00 02 06 01
+			15 01 00 00 00 00 02 07 38
+			15 01 00 00 00 00 02 08 01
+			15 01 00 00 00 00 02 09 5b
+			15 01 00 00 00 00 02 0a 01
+			15 01 00 00 00 00 02 0b 95
+			15 01 00 00 00 00 02 0c 01
+			15 01 00 00 00 00 02 0d c4
+			15 01 00 00 00 00 02 0e 02
+			15 01 00 00 00 00 02 0f 0d
+			15 01 00 00 00 00 02 10 02
+			15 01 00 00 00 00 02 11 4a
+			15 01 00 00 00 00 02 12 02
+			15 01 00 00 00 00 02 13 4c
+			15 01 00 00 00 00 02 14 02
+			15 01 00 00 00 00 02 15 85
+			15 01 00 00 00 00 02 16 02
+			15 01 00 00 00 00 02 17 c3
+			15 01 00 00 00 00 02 18 02
+			15 01 00 00 00 00 02 19 e9
+			15 01 00 00 00 00 02 1a 03
+			15 01 00 00 00 00 02 1b 16
+			15 01 00 00 00 00 02 1c 03
+			15 01 00 00 00 00 02 1d 34
+			15 01 00 00 00 00 02 1e 03
+			15 01 00 00 00 00 02 1f 56
+			15 01 00 00 00 00 02 20 03
+			15 01 00 00 00 00 02 21 62
+			15 01 00 00 00 00 02 22 03
+			15 01 00 00 00 00 02 23 6c
+			15 01 00 00 00 00 02 24 03
+			15 01 00 00 00 00 02 25 74
+			15 01 00 00 00 00 02 26 03
+			15 01 00 00 00 00 02 27 80
+			15 01 00 00 00 00 02 28 03
+			15 01 00 00 00 00 02 29 89
+			15 01 00 00 00 00 02 2a 03
+			15 01 00 00 00 00 02 2b 8b
+			15 01 00 00 00 00 02 2d 03
+			15 01 00 00 00 00 02 2f 8d
+			15 01 00 00 00 00 02 30 03
+			15 01 00 00 00 00 02 31 8e
+			15 01 00 00 00 00 02 32 00
+			15 01 00 00 00 00 02 33 71
+			15 01 00 00 00 00 02 34 00
+			15 01 00 00 00 00 02 35 84
+			15 01 00 00 00 00 02 36 00
+			15 01 00 00 00 00 02 37 a5
+			15 01 00 00 00 00 02 38 00
+			15 01 00 00 00 00 02 39 bb
+			15 01 00 00 00 00 02 3a 00
+			15 01 00 00 00 00 02 3b ce
+			15 01 00 00 00 00 02 3d 00
+			15 01 00 00 00 00 02 3f e0
+			15 01 00 00 00 00 02 40 00
+			15 01 00 00 00 00 02 41 ef
+			15 01 00 00 00 00 02 42 00
+			15 01 00 00 00 00 02 43 ff
+			15 01 00 00 00 00 02 44 01
+			15 01 00 00 00 00 02 45 0b
+			15 01 00 00 00 00 02 46 01
+			15 01 00 00 00 00 02 47 38
+			15 01 00 00 00 00 02 48 01
+			15 01 00 00 00 00 02 49 5b
+			15 01 00 00 00 00 02 4a 01
+			15 01 00 00 00 00 02 4b 95
+			15 01 00 00 00 00 02 4c 01
+			15 01 00 00 00 00 02 4d c4
+			15 01 00 00 00 00 02 4e 02
+			15 01 00 00 00 00 02 4f 0d
+			15 01 00 00 00 00 02 50 02
+			15 01 00 00 00 00 02 51 4a
+			15 01 00 00 00 00 02 52 02
+			15 01 00 00 00 00 02 53 4c
+			15 01 00 00 00 00 02 54 02
+			15 01 00 00 00 00 02 55 85
+			15 01 00 00 00 00 02 56 02
+			15 01 00 00 00 00 02 58 c3
+			15 01 00 00 00 00 02 59 02
+			15 01 00 00 00 00 02 5a e9
+			15 01 00 00 00 00 02 5b 03
+			15 01 00 00 00 00 02 5c 16
+			15 01 00 00 00 00 02 5d 03
+			15 01 00 00 00 00 02 5e 34
+			15 01 00 00 00 00 02 5f 03
+			15 01 00 00 00 00 02 60 56
+			15 01 00 00 00 00 02 61 03
+			15 01 00 00 00 00 02 62 62
+			15 01 00 00 00 00 02 63 03
+			15 01 00 00 00 00 02 64 6c
+			15 01 00 00 00 00 02 65 03
+			15 01 00 00 00 00 02 66 74
+			15 01 00 00 00 00 02 67 03
+			15 01 00 00 00 00 02 68 80
+			15 01 00 00 00 00 02 69 03
+			15 01 00 00 00 00 02 6a 89
+			15 01 00 00 00 00 02 6b 03
+			15 01 00 00 00 00 02 6c 8b
+			15 01 00 00 00 00 02 6d 03
+			15 01 00 00 00 00 02 6e 8d
+			15 01 00 00 00 00 02 6f 03
+			15 01 00 00 00 00 02 70 8e
+			15 01 00 00 00 00 02 71 00
+			15 01 00 00 00 00 02 72 71
+			15 01 00 00 00 00 02 73 00
+			15 01 00 00 00 00 02 74 84
+			15 01 00 00 00 00 02 75 00
+			15 01 00 00 00 00 02 76 a5
+			15 01 00 00 00 00 02 77 00
+			15 01 00 00 00 00 02 78 bb
+			15 01 00 00 00 00 02 79 00
+			15 01 00 00 00 00 02 7a ce
+			15 01 00 00 00 00 02 7b 00
+			15 01 00 00 00 00 02 7c e0
+			15 01 00 00 00 00 02 7d 00
+			15 01 00 00 00 00 02 7e ef
+			15 01 00 00 00 00 02 7f 00
+			15 01 00 00 00 00 02 80 ff
+			15 01 00 00 00 00 02 81 01
+			15 01 00 00 00 00 02 82 0b
+			15 01 00 00 00 00 02 83 01
+			15 01 00 00 00 00 02 84 38
+			15 01 00 00 00 00 02 85 01
+			15 01 00 00 00 00 02 86 5b
+			15 01 00 00 00 00 02 87 01
+			15 01 00 00 00 00 02 88 95
+			15 01 00 00 00 00 02 89 01
+			15 01 00 00 00 00 02 8a c4
+			15 01 00 00 00 00 02 8b 02
+			15 01 00 00 00 00 02 8c 0d
+			15 01 00 00 00 00 02 8d 02
+			15 01 00 00 00 00 02 8e 4a
+			15 01 00 00 00 00 02 8f 02
+			15 01 00 00 00 00 02 90 4c
+			15 01 00 00 00 00 02 91 02
+			15 01 00 00 00 00 02 92 85
+			15 01 00 00 00 00 02 93 02
+			15 01 00 00 00 00 02 94 c3
+			15 01 00 00 00 00 02 95 02
+			15 01 00 00 00 00 02 96 e9
+			15 01 00 00 00 00 02 97 03
+			15 01 00 00 00 00 02 98 16
+			15 01 00 00 00 00 02 99 03
+			15 01 00 00 00 00 02 9a 34
+			15 01 00 00 00 00 02 9b 03
+			15 01 00 00 00 00 02 9c 56
+			15 01 00 00 00 00 02 9d 03
+			15 01 00 00 00 00 02 9e 62
+			15 01 00 00 00 00 02 9f 03
+			15 01 00 00 00 00 02 a0 6c
+			15 01 00 00 00 00 02 a2 03
+			15 01 00 00 00 00 02 a3 74
+			15 01 00 00 00 00 02 a4 03
+			15 01 00 00 00 00 02 a5 80
+			15 01 00 00 00 00 02 a6 03
+			15 01 00 00 00 00 02 a7 89
+			15 01 00 00 00 00 02 a9 03
+			15 01 00 00 00 00 02 aa 8b
+			15 01 00 00 00 00 02 ab 03
+			15 01 00 00 00 00 02 ac 8d
+			15 01 00 00 00 00 02 ad 03
+			15 01 00 00 00 00 02 ae 8e
+			15 01 00 00 00 00 02 af 00
+			15 01 00 00 00 00 02 b0 71
+			15 01 00 00 00 00 02 b1 00
+			15 01 00 00 00 00 02 b2 84
+			15 01 00 00 00 00 02 b3 00
+			15 01 00 00 00 00 02 b4 a5
+			15 01 00 00 00 00 02 b5 00
+			15 01 00 00 00 00 02 b6 bb
+			15 01 00 00 00 00 02 b7 00
+			15 01 00 00 00 00 02 b8 ce
+			15 01 00 00 00 00 02 b9 00
+			15 01 00 00 00 00 02 ba e0
+			15 01 00 00 00 00 02 bb 00
+			15 01 00 00 00 00 02 bc ef
+			15 01 00 00 00 00 02 bd 00
+			15 01 00 00 00 00 02 be ff
+			15 01 00 00 00 00 02 bf 01
+			15 01 00 00 00 00 02 c0 0b
+			15 01 00 00 00 00 02 c1 01
+			15 01 00 00 00 00 02 c2 38
+			15 01 00 00 00 00 02 c3 01
+			15 01 00 00 00 00 02 c4 5b
+			15 01 00 00 00 00 02 c5 01
+			15 01 00 00 00 00 02 c6 95
+			15 01 00 00 00 00 02 c7 01
+			15 01 00 00 00 00 02 c8 c4
+			15 01 00 00 00 00 02 c9 02
+			15 01 00 00 00 00 02 ca 0d
+			15 01 00 00 00 00 02 cb 02
+			15 01 00 00 00 00 02 cc 4a
+			15 01 00 00 00 00 02 cd 02
+			15 01 00 00 00 00 02 ce 4c
+			15 01 00 00 00 00 02 cf 02
+			15 01 00 00 00 00 02 d0 85
+			15 01 00 00 00 00 02 d1 02
+			15 01 00 00 00 00 02 d2 c3
+			15 01 00 00 00 00 02 d3 02
+			15 01 00 00 00 00 02 d4 e9
+			15 01 00 00 00 00 02 d5 03
+			15 01 00 00 00 00 02 d6 16
+			15 01 00 00 00 00 02 d7 03
+			15 01 00 00 00 00 02 d8 34
+			15 01 00 00 00 00 02 d9 03
+			15 01 00 00 00 00 02 da 56
+			15 01 00 00 00 00 02 db 03
+			15 01 00 00 00 00 02 dc 62
+			15 01 00 00 00 00 02 dd 03
+			15 01 00 00 00 00 02 de 6c
+			15 01 00 00 00 00 02 df 03
+			15 01 00 00 00 00 02 e0 74
+			15 01 00 00 00 00 02 e1 03
+			15 01 00 00 00 00 02 e2 80
+			15 01 00 00 00 00 02 e3 03
+			15 01 00 00 00 00 02 e4 89
+			15 01 00 00 00 00 02 e5 03
+			15 01 00 00 00 00 02 e6 8b
+			15 01 00 00 00 00 02 e7 03
+			15 01 00 00 00 00 02 e8 8d
+			15 01 00 00 00 00 02 e9 03
+			15 01 00 00 00 00 02 ea 8e
+			15 01 00 00 00 00 02 FF 10
+			05 01 00 00 00 00 01 29];
+		qcom,mdss-dsi-off-command = [15 01 00 00 00 00 02 ff 10
+			05 01 00 00 10 00 01 28
+			15 01 00 00 00 00 02 b0 00
+			05 01 00 00 40 00 01 10
+			15 01 00 00 00 00 02 4f 01];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "burst_mode";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,cmd-sync-wait-broadcast;
+		qcom,cmd-sync-wait-trigger;
+		qcom,mdss-tear-check-frame-rate = <12000>;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [d6 32 22 00 60 66 26 36 28 03 04
+			00];
+		qcom,mdss-dsi-t-clk-post = <0x04>;
+		qcom,mdss-dsi-t-clk-pre = <0x1b>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-wr-mem-start = <0x2c>;
+		qcom,mdss-dsi-wr-mem-continue = <0x3c>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+
+		qcom,config-select = <&dsi_dual_sharp_cmd_config0>;
+
+		dsi_dual_sharp_cmd_config0: config0 {
+			qcom,split-mode = "dualctl-split";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-sharp-dualmipi-wqxga-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-sharp-dualmipi-wqxga-video.dtsi
new file mode 100644
index 000000000000..94620f007dd9
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-sharp-dualmipi-wqxga-video.dtsi
@@ -0,0 +1,78 @@
+/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_dual_sharp_video: qcom,mdss_dsi_sharp_wqxga_video {
+		qcom,mdss-dsi-panel-name = "Dual SHARP video mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <800>;
+		qcom,mdss-dsi-panel-height = <2560>;
+		qcom,mdss-dsi-h-front-porch = <76>;
+		qcom,mdss-dsi-h-back-porch = <32>;
+		qcom,mdss-dsi-h-pulse-width = <16>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <11>;
+		qcom,mdss-dsi-v-front-porch = <2>;
+		qcom,mdss-dsi-v-pulse-width = <1>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [05 01 00 00 a0 00 02 11 00
+			05 01 00 00 02 00 02 29 00];
+		qcom,mdss-dsi-pre-off-command = [05 01 00 00 02 00 02 28 00
+				 05 01 00 00 a0 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,cmd-sync-wait-broadcast;
+		qcom,mdss-dsi-panel-timings = [e2 36 24 00 66 6a 28 38 2a 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x02>;
+		qcom,mdss-dsi-t-clk-pre = <0x2a>;
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+		qcom,mdss-dsi-bl-pmic-pwm-frequency = <50>;
+		qcom,mdss-dsi-bl-pmic-bank-select = <2>;
+		qcom,mdss-dsi-reset-sequence = <1 2>, <0 5>, <1 120>;
+		qcom,mdss-pan-physical-width-dimension = <83>;
+		qcom,mdss-pan-physical-height-dimension = <133>;
+		qcom,mdss-dsi-min-refresh-rate = <53>;
+		qcom,mdss-dsi-max-refresh-rate = <60>;
+		qcom,mdss-dsi-pan-enable-dynamic-fps;
+		qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
+		qcom,mdss-dsi-panel-status-check-mode = "bta_check";
+		qcom,mdss-dsi-tx-eot-append;
+		qcom,esd-check-enabled;
+
+		qcom,config-select = <&dsi_dual_sharp_video_config0>;
+
+		dsi_dual_sharp_video_config0: config0 {
+			qcom,split-mode = "dualctl-split";
+		};
+
+		dsi_dual_sharp_video_config1: config1 {
+			qcom,split-mode = "pingpong-split";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-sharp-split-link-wuxga-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-sharp-split-link-wuxga-video.dtsi
new file mode 100644
index 000000000000..143b0152dcf4
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-sharp-split-link-wuxga-video.dtsi
@@ -0,0 +1,68 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_sharp_split_link_wuxga_video:
+	qcom,mdss_dsi_sharp_split_link_wuxga_video {
+		qcom,mdss-dsi-panel-name =
+			"SHARP split DSI video mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <600>;
+		qcom,mdss-dsi-panel-height = <1920>;
+		qcom,mdss-dsi-h-front-porch = <54>;
+		qcom,mdss-dsi-h-back-porch = <4>;
+		qcom,mdss-dsi-h-pulse-width = <6>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <6>;
+		qcom,mdss-dsi-v-front-porch = <12>;
+		qcom,mdss-dsi-v-pulse-width = <2>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0x654321>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [05 01 00 00 a0 00 02 11 00];
+		qcom,mdss-dsi-pre-off-command = [05 01 00 00 02 00 02 28 00
+						 05 01 00 00 a0 00 02 10 00];
+		qcom,mdss-dsi-post-panel-on-command =
+						[05 01 00 00 a0 00 02 29 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings =
+				[00 24 07 08 0e 14 07 09 07 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x0e>;
+		qcom,mdss-dsi-t-clk-pre = <0x35>;
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+		qcom,mdss-dsi-bl-pmic-pwm-frequency = <50>;
+		qcom,mdss-dsi-bl-pmic-bank-select = <2>;
+		qcom,mdss-dsi-reset-sequence = <1 2>, <0 5>, <1 120>;
+		qcom,mdss-pan-physical-width-dimension = <83>;
+		qcom,mdss-pan-physical-height-dimension = <133>;
+		qcom,mdss-dsi-tx-eot-append;
+		qcom,split-link-enabled = <1>;
+		qcom,sublinks-count = <2>;
+		qcom,lanes-per-sublink = <2>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-sim-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-sim-cmd.dtsi
new file mode 100644
index 000000000000..b64c20f24a06
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-sim-cmd.dtsi
@@ -0,0 +1,109 @@
+/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_sim_cmd: qcom,mdss_dsi_sim_cmd{
+		qcom,mdss-dsi-panel-name = "Simulator cmd mode dsi DSC panel";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1440>;
+		qcom,mdss-dsi-panel-height = <2560>;
+		qcom,mdss-dsi-h-front-porch = <152>;
+		qcom,mdss-dsi-h-back-porch = <156>;
+		qcom,mdss-dsi-h-pulse-width = <52>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <160>;
+		qcom,mdss-dsi-v-front-porch = <150>;
+		qcom,mdss-dsi-v-pulse-width = <100>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-color-order = "rgb_swap_rgb";
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-hor-line-idle = 	<0 40 256>,
+						<40 120 128>,
+						<120 240 64>;
+		qcom,mdss-dsi-panel-timings = [cd 32 22 00 60 64 26 34 29 03
+									04 00];
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+		qcom,mdss-dsi-t-clk-post = <0x03>;
+		qcom,mdss-dsi-t-clk-pre = <0x27>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-wr-mem-start = <0x2c>;
+		qcom,mdss-dsi-wr-mem-continue = <0x3c>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+		qcom,mdss-dsi-on-command = [29 01 00 00 00 00 02 b0 03
+			05 01 00 00 0a 00 01 00
+			/* Soft reset, wait 10ms */
+			15 01 00 00 0a 00 02 3a 77
+			/* Set Pixel format (24 bpp) */
+			39 01 00 00 0a 00 05 2a 00 00 04 ff
+			/* Set Column address */
+			39 01 00 00 0a 00 05 2b 00 00 05 9f
+			/* Set page address */
+			15 01 00 00 0a 00 02 35 00
+			/* Set tear on */
+			39 01 00 00 0a 00 03 44 00 00
+			/* Set tear scan line */
+			15 01 00 00 0a 00 02 51 ff
+			/* write display brightness */
+			15 01 00 00 0a 00 02 53 24
+			 /* write control brightness */
+			15 01 00 00 0a 00 02 55 00
+			/* CABC brightness */
+			05 01 00 00 78 00 01 11
+			/* exit sleep mode, wait 120ms */
+			05 01 00 00 10 00 01 29];
+			/* Set display on, wait 16ms */
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command = [05 01 00 00 32 00 02 28 00
+					05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,panel-ack-disabled;
+
+		qcom,ulps-enabled;
+
+		qcom,partial-update-enabled = "single_roi";
+		qcom,panel-roi-alignment=<720 32 720 32 720 32>;
+
+		qcom,compression-mode = "dsc";
+		qcom,config-select = <&dsi_sim_single_dsi_dsc_cmd_config0>;
+		dsi_sim_single_dsi_dsc_cmd_config0: config0 {
+			qcom,lm-split = <720 720>;
+			qcom,mdss-dsc-encoders = <2>;
+			qcom,mdss-dsc-slice-height = <32>;
+			qcom,mdss-dsc-slice-width = <720>;
+			qcom,mdss-dsc-slice-per-pkt = <1>;
+			qcom,mdss-dsc-bit-per-component = <8>;
+			qcom,mdss-dsc-bit-per-pixel = <8>;
+			qcom,mdss-dsc-block-prediction-enable;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-sim-dualmipi-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-sim-dualmipi-cmd.dtsi
new file mode 100644
index 000000000000..080b6e283928
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-sim-dualmipi-cmd.dtsi
@@ -0,0 +1,92 @@
+/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_dual_sim_cmd: qcom,mdss_dsi_dual_sim_cmd {
+		qcom,mdss-dsi-panel-name = "Sim dual cmd mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1280>;
+		qcom,mdss-dsi-panel-height = <1440>;
+		qcom,mdss-dsi-h-front-porch = <120>;
+		qcom,mdss-dsi-h-back-porch = <44>;
+		qcom,mdss-dsi-h-pulse-width = <16>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <4>;
+		qcom,mdss-dsi-v-front-porch = <8>;
+		qcom,mdss-dsi-v-pulse-width = <4>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-color-order = "rgb_swap_rgb";
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,cmd-sync-wait-broadcast;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-hor-line-idle = 	<0 40 256>,
+						<40 120 128>,
+						<120 240 64>;
+		qcom,mdss-dsi-panel-timings = [cd 32 22 00 60 64 26 34 29 03
+									04 00];
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+		qcom,mdss-dsi-t-clk-post = <0x03>;
+		qcom,mdss-dsi-t-clk-pre = <0x27>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-wr-mem-start = <0x2c>;
+		qcom,mdss-dsi-wr-mem-continue = <0x3c>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+		qcom,mdss-dsi-on-command = [29 01 00 00 00 00 02 b0 03
+			05 01 00 00 0a 00 01 00
+			/* Soft reset, wait 10ms */
+			15 01 00 00 0a 00 02 3a 77
+			/* Set Pixel format (24 bpp) */
+			39 01 00 00 0a 00 05 2a 00 00 04 ff
+			/* Set Column address */
+			39 01 00 00 0a 00 05 2b 00 00 05 9f
+			/* Set page address */
+			15 01 00 00 0a 00 02 35 00
+			/* Set tear on */
+			39 01 00 00 0a 00 03 44 00 00
+			/* Set tear scan line */
+			15 01 00 00 0a 00 02 51 ff
+			/* write display brightness */
+			15 01 00 00 0a 00 02 53 24
+			 /* write control brightness */
+			15 01 00 00 0a 00 02 55 00
+			/* CABC brightness */
+			05 01 00 00 78 00 01 11
+			/* exit sleep mode, wait 120ms */
+			05 01 00 00 10 00 01 29];
+			/* Set display on, wait 16ms */
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command = [05 01 00 00 32 00 02 28 00
+					05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,panel-ack-disabled;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-sim-dualmipi-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-sim-dualmipi-video.dtsi
new file mode 100644
index 000000000000..31ebdb6f3293
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-sim-dualmipi-video.dtsi
@@ -0,0 +1,59 @@
+/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_dual_sim_vid: qcom,mdss_dsi_dual_sim_video {
+		qcom,mdss-dsi-panel-name = "Sim dual video mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1280>;
+		qcom,mdss-dsi-panel-height = <1440>;
+		qcom,mdss-dsi-h-front-porch = <120>;
+		qcom,mdss-dsi-h-back-porch = <44>;
+		qcom,mdss-dsi-h-pulse-width = <16>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <4>;
+		qcom,mdss-dsi-v-front-porch = <8>;
+		qcom,mdss-dsi-v-pulse-width = <4>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-panel-broadcast-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [cd 32 22 00 60 64 26 34 29 03
+									04 00];
+		qcom,mdss-dsi-t-clk-post = <0x03>;
+		qcom,mdss-dsi-t-clk-pre = <0x27>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command = [05 01 00 00 32 00 02 28 00
+					05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-reset-sequence = <1 20>, <0 200>, <1 20>;
+		qcom,panel-ack-disabled;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-sim-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-sim-video.dtsi
new file mode 100644
index 000000000000..e5a5ee8f08d9
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-sim-video.dtsi
@@ -0,0 +1,56 @@
+/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_sim_vid: qcom,mdss_dsi_sim_video {
+		qcom,mdss-dsi-panel-name = "Simulator video mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <640>;
+		qcom,mdss-dsi-panel-height = <480>;
+		qcom,mdss-dsi-h-front-porch = <8>;
+		qcom,mdss-dsi-h-back-porch = <8>;
+		qcom,mdss-dsi-h-pulse-width = <8>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <6>;
+		qcom,mdss-dsi-v-front-porch = <6>;
+		qcom,mdss-dsi-v-pulse-width = <2>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [32 01 00 00 00 00 02 00 00];
+		qcom,mdss-dsi-off-command = [22 01 00 00 00 00 02 00 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [00 00 00 00 00 00 00 00 00 00 00 00];
+		qcom,mdss-dsi-t-clk-post = <0x04>;
+		qcom,mdss-dsi-t-clk-pre = <0x1b>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-reset-sequence = <1 0>, <0 0>, <1 0>;
+		qcom,panel-ack-disabled;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-toshiba-720p-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-toshiba-720p-video.dtsi
new file mode 100644
index 000000000000..191a3fba8ce6
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-toshiba-720p-video.dtsi
@@ -0,0 +1,100 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_tosh_720_vid: qcom,mdss_dsi_toshiba_720p_video {
+		qcom,mdss-dsi-panel-name = "toshiba 720p video mode dsi panel";
+		qcom,mdss-dsi-panel-controller = <&mdss_dsi0>;
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-destination = "display_1";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <720>;
+		qcom,mdss-dsi-panel-height = <1280>;
+		qcom,mdss-dsi-h-front-porch = <144>;
+		qcom,mdss-dsi-h-back-porch = <32>;
+		qcom,mdss-dsi-h-pulse-width = <12>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <3>;
+		qcom,mdss-dsi-v-front-porch = <9>;
+		qcom,mdss-dsi-v-pulse-width = <4>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-on-command = [23 01 00 00 0a 00 02 b0 00
+				23 01 00 00 0a 00 02 b2 00
+				23 01 00 00 0a 00 02 b3 0c
+				23 01 00 00 0a 00 02 b4 02
+				29 01 00 00 00 00 06 c0 40 02 7f c8 08
+				29 01 00 00 00 00 10 c1 00 a8 00 00 00
+					00 00 9d 08 27 00 00 00 00 00
+				29 01 00 00 00 00 06 c2 00 00 09 00 00
+				23 01 00 00 0a 00 02 c3 04
+				29 01 00 00 00 00 04 c4 4d 83 00
+				29 01 00 00 00 00 0b c6 12 00 08 71 00
+					00 00 80 00 04
+				23 01 00 00 0a 00 02 c7 22
+				29 01 00 00 00 00 05 c8 4c 0c 0c 0c
+				29 01 00 00 00 00 0e c9 00 40 00 16 32
+					2e 3a 43 3e 3c 45 79 3f
+				29 01 00 00 00 00 0e ca 00 46 1a 23 21
+					1c 25 31 2d 49 5f 7f 3f
+				29 01 00 00 00 00 0e cb 00 4c 20 3a 42
+					40 47 4b 42 3e 46 7e 3f
+				29 01 00 00 00 00 0e cc 00 41 19 21 1d
+					14 18 1f 1d 25 3f 73 3f
+				29 01 00 00 00 00 0e cd 23 79 5a 5f 57
+					4c 51 51 45 3f 4b 7f 3f
+				29 01 00 00 00 00 0e ce 00 40 14 20 1a
+					0e 0e 13 08 00 05 46 1c
+				29 01 00 00 00 00 04 d0 6a 64 01
+				29 01 00 00 00 00 03 d1 77 d4
+				23 01 00 00 0a 00 02 d3 33
+				29 01 00 00 00 00 03 d5 0f 0f
+				29 01 00 00 00 00 07 d8 34 64 23 25 62 32
+				29 01 00 00 00 00 0c de 10 7b 11 0a 00
+					00 00 00 00 00 00
+				29 01 00 00 00 00 09 fd 04 55 53 00 70 ff 10 73
+				23 01 00 00 0a 00 02 e2 00
+				05 01 00 00 78 00 02 11 00
+				05 01 00 00 32 00 02 29 00];
+		qcom,mdss-dsi-off-command = [05 01 00 00 32 00 02 28 00
+				 05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_hs_mode";
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "non_burst_sync_event";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [b0 23 1b 00 94 93 1e 25
+						15 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x04>;
+		qcom,mdss-dsi-t-clk-pre = <0x1b>;
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+		qcom,mdss-dsi-pan-enable-dynamic-fps;
+		qcom,mdss-dsi-pan-fps-update = "dfps_suspend_resume_mode";
+		qcom,mdss-dsi-reset-sequence = <1 20>, <0 200>, <1 20>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-truly-1080p-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-truly-1080p-cmd.dtsi
new file mode 100644
index 000000000000..42e44cf838ab
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-truly-1080p-cmd.dtsi
@@ -0,0 +1,95 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_truly_1080_cmd: qcom,mdss_dsi_truly_1080p_cmd {
+		qcom,mdss-dsi-panel-name = "truly 1080p cmd mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1080>;
+		qcom,mdss-dsi-panel-height = <1920>;
+		qcom,mdss-dsi-h-front-porch = <96>;
+		qcom,mdss-dsi-h-back-porch = <64>;
+		qcom,mdss-dsi-h-pulse-width = <16>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <16>;
+		qcom,mdss-dsi-v-front-porch = <4>;
+		qcom,mdss-dsi-v-pulse-width = <1>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "burst_mode";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [e6 38 26 00 68 6e 2a 3c 44 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x02>;
+		qcom,mdss-dsi-t-clk-pre = <0x2d>;
+		qcom,mdss-dsi-tx-eot-append;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-on-command = [23 01 00 00 00 00 02 d6 01
+			15 01 00 00 00 00 02 35 00
+			15 01 00 00 00 00 02 51 ff
+			15 01 00 00 00 00 02 53 2c
+			15 01 00 00 00 00 02 55 00
+			05 01 00 00 78 00 02 11 00
+			23 01 00 00 00 00 02 b0 04
+			29 01 00 00 00 00 07 b3 04 00 00 00 00 00
+			29 01 00 00 00 00 03 b6 3a d3
+			29 01 00 00 00 00 03 c0 00 00
+			29 01 00 00 00 00 23 c1 84 60 10 eb ff 6f ce ff ff 17 02
+				58 73 ae b1 20 c6 ff ff 1f f3 ff 5f 10 10 10 10 00 02 01
+				22 22 00 01
+			29 01 00 00 00 00 08 c2 31 f7 80 06 08 00 00
+			29 01 00 00 00 00 17 c4 70 00 00 00 00 04 00 00 00 0c 06
+				00 00 00 00 00 04 00 00 00 0c 06
+			29 01 00 00 00 00 29 c6 78 69 00 69 00 69 00 00 00 00 00
+				69 00 69 00 69 10 19 07 00 78 00 69 00 69 00 69 00 00 00
+				00 00 69 00 69 00 69 10 19 07
+			29 01 00 00 00 00 0a cb 31 fc 3f 8c 00 00 00 00 c0
+			23 01 00 00 00 00 02 cc 0b
+			29 01 00 00 00 00 0b d0 11 81 bb 1e 1e 4c 19 19 0c 00
+			29 01 00 00 00 00 1a d3 1b 33 bb bb b3 33 33 33 00 01 00
+				a0 d8 a0 0d 4e 4e 33 3b 22 72 07 3d bf 33
+			29 01 00 00 00 00 08 d5 06 00 00 01 51 01 32
+			29 01 00 00 00 00 1f c7 01 0a 11 18 26 33 3e 50 38 42 52
+				60 67 6e 77 01 0a 11 18 26 33 3e 50 38 42 52 60 67 6e 77
+			29 01 00 00 14 00 14 c8 01 00 00 00 00 fc 00 00 00 00
+				00 fc 00 00 00 00 00 fc 00
+			05 01 00 00 14 00 02 29 00];
+		qcom,mdss-dsi-off-command = [05 01 00 00 14 00 02 28 00
+				 05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+		qcom,mdss-dsi-post-init-delay = <1>;
+		qcom,ulps-enabled;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-truly-1080p-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-truly-1080p-video.dtsi
new file mode 100644
index 000000000000..86da03fcf599
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-truly-1080p-video.dtsi
@@ -0,0 +1,89 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_truly_1080_vid: qcom,mdss_dsi_truly_1080p_video {
+		qcom,mdss-dsi-panel-name = "truly 1080p video mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_video_mode";
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-panel-width = <1080>;
+		qcom,mdss-dsi-panel-height = <1920>;
+		qcom,mdss-dsi-h-front-porch = <96>;
+		qcom,mdss-dsi-h-back-porch = <64>;
+		qcom,mdss-dsi-h-pulse-width = <16>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <16>;
+		qcom,mdss-dsi-v-front-porch = <4>;
+		qcom,mdss-dsi-v-pulse-width = <1>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-traffic-mode = "burst_mode";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-panel-timings = [e6 38 26 00 68 6e 2a 3c 44 03 04 00];
+		qcom,mdss-dsi-t-clk-post = <0x02>;
+		qcom,mdss-dsi-t-clk-pre = <0x2d>;
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-mdp-trigger = "none";
+		qcom,mdss-dsi-on-command = [15 01 00 00 00 00 02 35 00
+			15 01 00 00 00 00 02 51 ff
+			15 01 00 00 00 00 02 53 2c
+			15 01 00 00 00 00 02 55 00
+			05 01 00 00 78 00 02 11 00
+			23 01 00 00 00 00 02 b0 00
+			29 01 00 00 00 00 07 b3 14 00 00 00 00 00
+			29 01 00 00 00 00 03 b6 3a d3
+			29 01 00 00 00 00 03 c0 00 00
+			29 01 00 00 00 00 23 c1 84 60 10 eb ff 6f ce ff ff 17 02
+				58 73 ae b1 20 c6 ff ff 1f f3 ff 5f 10 10 10 10 00 02 01
+				22 22 00 01
+			29 01 00 00 00 00 08 c2 31 f7 80 06 08 00 00
+			29 01 00 00 00 00 17 c4 70 00 00 00 00 04 00 00 00 0c 06
+				00 00 00 00 00 04 00 00 00 0c 06
+			29 01 00 00 00 00 29 c6 00 69 00 69 00 69 00 00 00 00 00
+				69 00 69 00 69 10 19 07 00 01 00 69 00 69 00 69 00 00 00
+				00 00 69 00 69 00 69 10 19 07
+			29 01 00 00 00 00 0a cb 31 fc 3f 8c 00 00 00 00 c0
+			23 01 00 00 00 00 02 cc 0b
+			29 01 00 00 00 00 0b d0 11 81 bb 1e 1e 4c 19 19 0c 00
+			29 01 00 00 00 00 1a d3 1b 33 bb bb b3 33 33 33 00 01 00
+				a0 d8 a0 0d 4e 4e 33 3b 22 72 07 3d bf 33
+			29 01 00 00 00 00 08 d5 06 00 00 01 51 01 32
+			29 01 00 00 00 00 1f c7 01 0a 11 18 26 33 3e 50 38 42 52
+				60 67 6e 77 01 0a 11 18 26 33 3e 50 38 42 52 60 67 6e 77
+			29 01 00 00 14 00 14 c8 01 00 00 00 00 fc 00 00 00 00
+				00 fc 00 00 00 00 00 fc 00
+			05 01 00 00 14 00 02 29 00];
+		qcom,mdss-dsi-off-command = [05 01 00 00 14 00 02 28 00
+				 05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+		qcom,mdss-dsi-tx-eot-append;
+		qcom,mdss-dsi-post-init-delay = <1>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/external-mdm9640.dtsi b/arch/arm64/boot/dts/qcom/external-mdm9640.dtsi
new file mode 100644
index 000000000000..4c0170a70bf5
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/external-mdm9640.dtsi
@@ -0,0 +1,52 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	mdm0: qcom,mdm0 {
+		compatible = "qcom,ext-mdm9x45";
+		cell-index = <0>;
+		#address-cells = <0>;
+		interrupt-parent = <&mdm0>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-names =
+			"err_fatal_irq",
+			"status_irq";
+		status = "disabled";
+	};
+
+	mdm1: qcom,mdm1 {
+		compatible = "qcom,ext-mdm9x45";
+		cell-index = <0>;
+		#address-cells = <0>;
+		interrupt-parent = <&mdm1>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-names =
+			"err_fatal_irq",
+			"status_irq";
+		status = "disabled";
+	};
+
+	mdm2: qcom,mdm2 {
+		compatible = "qcom,ext-mdm9x45";
+		cell-index = <0>;
+		#address-cells = <0>;
+		interrupt-parent = <&mdm2>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-names =
+			"err_fatal_irq",
+			"status_irq";
+		status = "disabled";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/external-soc.dtsi b/arch/arm64/boot/dts/qcom/external-soc.dtsi
new file mode 100644
index 000000000000..6a96d0ea01f5
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/external-soc.dtsi
@@ -0,0 +1,37 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	mdm3: qcom,mdm3 {
+		compatible = "qcom,ext-mdm9x55";
+		cell-index = <0>;
+		#address-cells = <0>;
+		interrupt-parent = <&mdm3>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-names =
+			"err_fatal_irq",
+			"status_irq",
+			"mdm2ap_vddmin_irq";
+		/* modem attributes */
+		qcom,ramdump-delays-ms = <2000>;
+		qcom,ramdump-timeout-ms = <120000>;
+		qcom,vddmin-modes = "normal";
+		qcom,vddmin-drive-strength = <8>;
+		qcom,sfr-query;
+		qcom,sysmon-id = <20>;
+		qcom,ssctl-instance-id = <0x10>;
+		qcom,support-shutdown;
+		qcom,pil-force-shutdown;
+		status = "disabled";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/fg-gen3-batterydata-ascent-2800mah.dtsi b/arch/arm64/boot/dts/qcom/fg-gen3-batterydata-ascent-2800mah.dtsi
new file mode 100644
index 000000000000..a83d860cd697
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/fg-gen3-batterydata-ascent-2800mah.dtsi
@@ -0,0 +1,81 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,ascent_2800mah {
+	/* #Ascent_860_82912_0000_2800mAh_averaged_MasterSlave_Jan11th2017*/
+	qcom,max-voltage-uv = <4350000>;
+	qcom,fg-cc-cv-threshold-mv = <4340>;
+	qcom,fastchg-current-ma = <2800>;
+	qcom,batt-id-kohm = <20>;
+	qcom,battery-beta = <3450>;
+	qcom,battery-type = "ascent_2800mah_averaged_masterslave_jan11th2017";
+	qcom,checksum = <0x0110>;
+	qcom,gui-version = "PMI8998GUI - 2.0.0.54";
+	qcom,fg-profile-data = [
+		 21 21 F5 0D
+		 82 0B 6E 05
+		 0C 1D 5F FA
+		 74 06 97 01
+		 0E 18 F7 22
+		 A8 45 B1 52
+		 76 00 00 00
+		 0E 00 00 00
+		 00 00 3D C4
+		 6E CD 2A CB
+		 21 00 08 00
+		 28 D3 2E E5
+		 0E 06 BA F3
+		 59 E3 22 12
+		 08 E5 54 32
+		 22 06 09 20
+		 27 00 14 00
+		 4B 20 F6 04
+		 CF 0A 04 06
+		 25 1D B7 FA
+		 DD F4 BB 06
+		 FE 18 E1 22
+		 73 45 32 53
+		 5F 00 00 00
+		 0E 00 00 00
+		 00 00 D5 D5
+		 9C CC 8E D3
+		 1A 00 00 00
+		 6E EA 2E E5
+		 6E 06 A9 00
+		 6D F5 73 0B
+		 2A 02 61 1B
+		 B1 33 CC FF
+		 07 10 00 00
+		 14 0B 99 45
+		 1A 00 40 00
+		 7D 01 0A FA
+		 FF 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+	];
+};
diff --git a/arch/arm64/boot/dts/qcom/fg-gen3-batterydata-ascent-3450mah.dtsi b/arch/arm64/boot/dts/qcom/fg-gen3-batterydata-ascent-3450mah.dtsi
new file mode 100644
index 000000000000..c7cecbca3929
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/fg-gen3-batterydata-ascent-3450mah.dtsi
@@ -0,0 +1,81 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,ascent_3450mah {
+	/* Ascent_with_connector_3450mAh_averaged_MasterSlave_Jan6th2017 */
+	qcom,max-voltage-uv = <4350000>;
+	qcom,fg-cc-cv-threshold-mv = <4340>;
+	qcom,fastchg-current-ma = <3450>;
+	qcom,batt-id-kohm = <60>;
+	qcom,battery-beta = <3435>;
+	qcom,battery-type = "ascent_3450mah_averaged_masterslave_jan6th2017";
+	qcom,checksum = <0x96AC>;
+	qcom,gui-version = "PMI8998GUI - 2.0.0.54";
+	qcom,fg-profile-data = [
+		 9C 1F 85 05
+		 82 0A 73 FC
+		 2B 1D 72 EA
+		 EE 03 66 0C
+		 C8 17 F4 22
+		 E0 45 1F 52
+		 5C 00 00 00
+		 10 00 00 00
+		 00 00 4A C4
+		 C7 BC 48 C2
+		 0F 00 08 00
+		 E1 DA 5D ED
+		 8D FD B2 F3
+		 96 E2 A7 12
+		 7E F4 0E 3B
+		 24 06 09 20
+		 27 00 14 00
+		 83 1F EE 05
+		 1F 0A 45 FD
+		 6B 1D 53 E5
+		 EC 0B 31 14
+		 44 18 49 23
+		 18 45 A6 53
+		 55 00 00 00
+		 0E 00 00 00
+		 00 00 61 CC
+		 B7 C3 0F BC
+		 0F 00 00 00
+		 92 00 5D ED
+		 E3 06 E0 00
+		 75 FD 9C 03
+		 47 DB B3 22
+		 CB 33 CC FF
+		 07 10 00 00
+		 99 0D 99 45
+		 0F 00 40 00
+		 AB 01 0A FA
+		 FF 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+	];
+};
diff --git a/arch/arm64/boot/dts/qcom/fg-gen3-batterydata-demo-6000mah.dtsi b/arch/arm64/boot/dts/qcom/fg-gen3-batterydata-demo-6000mah.dtsi
new file mode 100644
index 000000000000..bc43fb0549cb
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/fg-gen3-batterydata-demo-6000mah.dtsi
@@ -0,0 +1,78 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,demo_6000mah {
+	qcom,max-voltage-uv = <4350000>;
+	qcom,fg-cc-cv-threshold-mv = <4340>;
+	qcom,fastchg-current-ma = <6000>;
+	qcom,batt-id-kohm = <75>;
+	qcom,battery-beta = <3435>;
+	qcom,battery-type = "Demo_battery_6000mah";
+	qcom,fg-profile-data = [
+		 2C 1F 3F FC
+		 E9 03 A1 FD
+		 58 1D FD F5
+		 27 12 2C 14
+		 3F 18 FF 22
+		 9B 45 A3 52
+		 55 00 00 00
+		 0E 00 00 00
+		 00 00 1C AC
+		 F7 CD 71 B5
+		 1A 00 0C 00
+		 3C EB 54 E4
+		 EC 05 7F FA
+		 76 05 F5 02
+		 CA F3 82 3A
+		 2A 09 40 40
+		 07 00 05 00
+		 58 1F 42 06
+		 85 03 35 F4
+		 4D 1D 37 F2
+		 23 0A 79 15
+		 B7 18 32 23
+		 26 45 72 53
+		 55 00 00 00
+		 0D 00 00 00
+		 00 00 13 CC
+		 03 00 98 BD
+		 16 00 00 00
+		 3C EB 54 E4
+		 9F FC A3 F3
+		 0F FC DF FA
+		 FF E5 A9 23
+		 CB 33 08 33
+		 07 10 00 00
+		 81 0D 99 45
+		 16 00 19 00
+		 75 01 0A FA
+		 FF 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+	];
+};
diff --git a/arch/arm64/boot/dts/qcom/fg-gen3-batterydata-itech-3000mah.dtsi b/arch/arm64/boot/dts/qcom/fg-gen3-batterydata-itech-3000mah.dtsi
new file mode 100644
index 000000000000..3888047b9f8c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/fg-gen3-batterydata-itech-3000mah.dtsi
@@ -0,0 +1,81 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,itech_3000mah {
+	/* #Itech_B00826LF_3000mAh_ver1660_averaged_MasterSlave_Jan10th2017*/
+	qcom,max-voltage-uv = <4350000>;
+	qcom,fg-cc-cv-threshold-mv = <4340>;
+	qcom,fastchg-current-ma = <2000>;
+	qcom,batt-id-kohm = <100>;
+	qcom,battery-beta = <3435>;
+	qcom,battery-type = "itech_b00826lf_3000mah_ver1660_jan10th2017";
+	qcom,checksum = <0xFB8F>;
+	qcom,gui-version = "PMI8998GUI - 2.0.0.54";
+	qcom,fg-profile-data = [
+		 A4 1F 6E 05
+		 9C 0A 2B FC
+		 32 1D 23 E5
+		 60 0B 1B 15
+		 AD 17 8C 22
+		 EA 3C 89 4A
+		 5B 00 00 00
+		 12 00 00 00
+		 00 00 62 C2
+		 0C CD D8 C2
+		 19 00 08 00
+		 85 EA C7 EC
+		 E2 05 2F 01
+		 9B F5 12 12
+		 5E 05 88 3B
+		 22 06 09 20
+		 27 00 14 00
+		 7D 1F DD 05
+		 3F 0A E5 FC
+		 72 1D E3 F5
+		 6F 12 C0 1D
+		 88 18 FB 22
+		 8D 45 C6 52
+		 54 00 00 00
+		 0F 00 00 00
+		 00 00 BD CD
+		 55 C2 5D C5
+		 14 00 00 00
+		 7E 00 C7 EC
+		 60 06 BB 00
+		 59 06 61 03
+		 D9 FC 75 1B
+		 B3 33 CC FF
+		 07 10 00 00
+		 3E 0B 99 45
+		 14 00 40 00
+		 AE 01 0A FA
+		 FF 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+	];
+};
diff --git a/arch/arm64/boot/dts/qcom/fg-gen3-batterydata-qrd-skuk-4v4-3000mah.dtsi b/arch/arm64/boot/dts/qcom/fg-gen3-batterydata-qrd-skuk-4v4-3000mah.dtsi
new file mode 100644
index 000000000000..11600ef2bfd3
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/fg-gen3-batterydata-qrd-skuk-4v4-3000mah.dtsi
@@ -0,0 +1,81 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,qrd_msm8998_skuk_3000mah {
+	/* QRD8997_ST1031GA_3000mAh_averaged_MasterSlave_Jan10th2017 */
+	qcom,max-voltage-uv = <4400000>;
+	qcom,fg-cc-cv-threshold-mv = <4390>;
+	qcom,fastchg-current-ma = <3000>;
+	qcom,batt-id-kohm = <68>;
+	qcom,battery-beta = <3380>;
+	qcom,battery-type = "qrd8997_st1031ga_3000mah";
+	qcom,checksum = <0xD299>;
+	qcom,gui-version = "PMI8998GUI - 2.0.0.54";
+	qcom,fg-profile-data = [
+		 70 1F B1 05
+		 6F 0A A1 FC
+		 8C 1D D7 FD
+		 C4 12 AC 1D
+		 7E 18 01 23
+		 8C 45 B6 52
+		 55 00 00 00
+		 0F 00 00 00
+		 00 00 92 C5
+		 95 CD A0 CA
+		 1F 00 08 00
+		 9F E3 C3 EC
+		 F7 FC 25 F3
+		 02 01 FF 12
+		 29 DC 1D 3A
+		 1C 06 09 20
+		 27 00 14 00
+		 AC 1F B4 05
+		 57 0A EF FC
+		 6A 1D E9 E2
+		 11 0B BB 14
+		 40 19 DC 22
+		 79 45 03 53
+		 53 00 00 00
+		 0E 00 00 00
+		 00 00 05 CC
+		 3A BB 24 CA
+		 1C 00 00 00
+		 56 F2 C3 EC
+		 A6 06 A2 F2
+		 9A 06 CC 01
+		 8C EA CF 1A
+		 BA 33 CC FF
+		 07 10 00 00
+		 3A 0C 66 46
+		 1C 00 40 00
+		 98 01 0A FA
+		 FF 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+	];
+};
diff --git a/arch/arm64/boot/dts/qcom/fg-gen3-batterydata-svr-v2-3200mah.dtsi b/arch/arm64/boot/dts/qcom/fg-gen3-batterydata-svr-v2-3200mah.dtsi
new file mode 100644
index 000000000000..048897b084ec
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/fg-gen3-batterydata-svr-v2-3200mah.dtsi
@@ -0,0 +1,84 @@
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+qcom,svr835v2_3200mah {
+	/*3003021_TC_MLP603170_3200mAh_averaged_MasterSlave_Jun292017*/
+	qcom, = <24>;
+	qcom,max-voltage-uv = <4200000>;
+	qcom,fg-cc-cv-threshold-mv = <4190>;
+	qcom,fastchg-current-ma = <3200>;
+	qcom,nom-batt-capacity-mah = <3200>;
+	qcom,batt-id-kohm = <0>;
+	qcom,battery-beta = <3435>;
+	qcom,battery-type = "svr835v2_3200mah";
+	qcom,checksum = <0xB7B0>;
+	qcom,gui-version = "PMI8998GUI - 2.0.0.58";
+	qcom,fg-profile-data = [
+		 87 16 AB 0B
+		 BE 15 3A 0A
+		 8B 1C 6D 02
+		 76 0D 1F 0A
+		 50 18 ED 22
+		 98 45 CA 52
+		 83 00 00 00
+		 0D 00 00 00
+		 00 00 37 B4
+		 78 C5 9D BA
+		 29 00 08 00
+		 3E CA 11 E5
+		 D4 06 B7 EA
+		 51 07 0F 02
+		 82 DD 22 3B
+		 1C 06 09 20
+		 27 00 14 00
+		 1C 19 82 0A
+		 E9 0C 49 03
+		 84 1C 5C 03
+		 D0 15 0D 12
+		 91 19 0C 22
+		 F0 3C 35 4B
+		 7D 00 00 00
+		 12 00 00 00
+		 00 00 F3 D4
+		 9F B4 AF D3
+		 22 00 00 00
+		 CC EA 11 E5
+		 2D F4 35 E3
+		 A5 F3 49 0B
+		 8F EA 5A 1A
+		 9B 33 CC FF
+		 07 10 00 00
+		 21 0D 33 43
+		 22 00 40 00
+		 07 01 0A FA
+		 FF 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+		 00 00 00 00
+	];
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-arm-smmu-630.dtsi b/arch/arm64/boot/dts/qcom/msm-arm-smmu-630.dtsi
new file mode 100644
index 000000000000..4ab200d6b89d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-arm-smmu-630.dtsi
@@ -0,0 +1,45 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+*
+* This program is free software; you can redistribute it and/or modify
+* it under the terms of the GNU General Public License version 2 and
+* only version 2 as published by the Free Software Foundation.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+*/
+
+#include "msm-arm-smmu-660.dtsi"
+#include "msm-arm-smmu-impl-defs-660.dtsi"
+
+&soc {
+	/delete-node/ arm,smmu-turing_q6@5180000;
+};
+
+&mmss_bimc_smmu {
+	attach-impl-defs = <0x6000 0x2378>,
+			<0x6060	0x1055>,
+			<0x678c	0x28>,
+			<0x6794	0xe0>,
+			<0x6800	0x6>,
+			<0x6900	0x3ff>,
+			<0x6924	0x204>,
+			<0x6928	0x11002>,
+			<0x6930	0x800>,
+			<0x6960	0xffffffff>,
+			<0x6964	0xffffffff>,
+			<0x6968	0xffffffff>,
+			<0x696c	0xffffffff>,
+			<0x6b48	0x330330>,
+			<0x6b4c	0x81>,
+			<0x6b50	0x3333>,
+			<0x6b54	0x3333>,
+			<0x6b64	0x1a5555>,
+			<0x6b68	0xbaaa892a>,
+			<0x6b70	0x0c0c0202>,
+			<0x6b74	0x0e0e0202>,
+			<0x6b78	0x0e0e0000>,
+			<0x6b80	0x20042004>,
+			<0x6b84	0x20042004>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-arm-smmu-660.dtsi b/arch/arm64/boot/dts/qcom/msm-arm-smmu-660.dtsi
new file mode 100644
index 000000000000..06935e80e07b
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-arm-smmu-660.dtsi
@@ -0,0 +1,213 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/clock/qcom,gcc-sdm660.h>
+#include <dt-bindings/clock/qcom,mmcc-sdm660.h>
+#include <dt-bindings/msm/msm-bus-ids.h>
+#include <dt-bindings/clock/qcom,rpmcc.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+&soc {
+	anoc2_smmu: arm,smmu-anoc2@16c0000 {
+		compatible = "qcom,smmu-v2";
+		reg = <0x16c0000 0x40000>;
+		#iommu-cells = <1>;
+		qcom,register-save;
+		qcom,skip-init;
+		#global-interrupts = <2>;
+		interrupts = <GIC_SPI 229 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 231 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 373 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 374 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_SPI 375 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_SPI 376 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_SPI 377 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_SPI 378 IRQ_TYPE_LEVEL_LOW>,
+			     <GIC_SPI 462 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 463 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 464 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 465 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 466 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 467 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 359 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 442 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 443 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 444 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 447 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 468 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 469 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 472 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 473 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 474 IRQ_TYPE_LEVEL_HIGH>;
+		clocks = <&clock_rpmcc AGGR2_NOC_SMMU_CLK>;
+		clock-names = "smmu_aggr2_noc_clk";
+		#clock-cells = <1>;
+	};
+
+	lpass_q6_smmu: arm,smmu-lpass_q6@5100000 {
+		compatible = "qcom,smmu-v2";
+		reg = <0x5100000 0x40000>;
+		#iommu-cells = <1>;
+		qcom,register-save;
+		qcom,skip-init;
+		#global-interrupts = <2>;
+		interrupts = <GIC_SPI 229 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 231 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 226 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 393 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 394 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 395 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 396 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 397 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 398 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 399 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 400 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 401 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 402 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 403 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 224 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 225 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 310 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 404 IRQ_TYPE_LEVEL_HIGH>;
+		vdd-supply = <&gdsc_hlos1_vote_lpass_adsp>;
+		clocks = <&clock_gcc HLOS1_VOTE_LPASS_ADSP_SMMU_CLK>;
+		clock-names = "lpass_q6_smmu_clk";
+		#clock-cells = <1>;
+	};
+
+	mmss_bimc_smmu: arm,smmu-mmss@cd00000 {
+		compatible = "qcom,smmu-v2";
+		reg = <0xcd00000 0x40000>;
+		#iommu-cells = <1>;
+		qcom,register-save;
+		qcom,no-smr-check;
+		qcom,skip-init;
+		#global-interrupts = <2>;
+		interrupts = <GIC_SPI 229 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 231 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 263 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 266 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 267 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 268 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 244 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 245 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 247 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 248 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 249 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 250 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 251 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 252 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 253 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 254 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 255 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 256 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 260 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 261 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 262 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 272 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 273 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 274 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 275 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 276 IRQ_TYPE_LEVEL_HIGH>;
+		vdd-supply = <&gdsc_bimc_smmu>;
+		clocks = <&clock_mmss MMSS_MNOC_AHB_CLK>,
+			 <&clock_rpmcc  MMSSNOC_AXI_CLK>,
+			 <&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			 <&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>;
+		clock-names = "mmss_mnoc_ahb_clk",
+			      "mmssnoc_axi_clk",
+			      "mmss_bimc_smmu_ahb_clk",
+			      "mmss_bimc_smmu_axi_clk";
+		#clock-cells = <1>;
+		qcom,bus-master-id = <MSM_BUS_MNOC_BIMC_MAS>;
+	};
+
+	kgsl_smmu: arm,smmu-kgsl@5040000 {
+		compatible = "qcom,smmu-v2";
+		reg = <0x5040000 0x10000>;
+		#iommu-cells = <1>;
+		qcom,dynamic;
+		qcom,register-save;
+		qcom,skip-init;
+		#global-interrupts = <2>;
+		interrupts = <GIC_SPI 229 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 231 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 332 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 349 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 350 IRQ_TYPE_LEVEL_HIGH>;
+		qcom,deferred-regulator-disable-delay = <80>;
+		vdd-supply = <&gdsc_gpu_cx>;
+		clocks = <&clock_gcc GCC_GPU_CFG_AHB_CLK>,
+			 <&clock_gcc GCC_BIMC_GFX_CLK>,
+			 <&clock_gcc GCC_GPU_BIMC_GFX_CLK>;
+		clock-names = "gcc_gpu_cfg_ahb_clk",
+			      "gcc_bimc_gfx_clk",
+			      "gcc_gpu_bimc_gfx_clk";
+		#clock-cells = <1>;
+	};
+
+	turing_q6_smmu: arm,smmu-turing_q6@5180000 {
+		compatible = "qcom,smmu-v2";
+		reg = <0x5180000 0x40000>;
+		#iommu-cells = <1>;
+		qcom,register-save;
+		qcom,skip-init;
+		#global-interrupts = <2>;
+		interrupts = <GIC_SPI 229 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 231 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 533 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 534 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 535 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 536 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 537 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 538 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 539 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 540 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 541 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 542 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 543 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 544 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 545 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 546 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 547 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 548 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 549 IRQ_TYPE_LEVEL_HIGH>;
+		vdd-supply = <&gdsc_hlos1_vote_turing_adsp>;
+		clocks = <&clock_gcc HLOS1_VOTE_TURING_ADSP_SMMU_CLK>;
+		clock-names = "turing_q6_smmu_clk";
+		#clock-cells = <1>;
+	};
+
+	iommu_test_device {
+		compatible = "iommu-debug-test";
+		/*
+		 * 42 shouldn't be used by anyone on the mmss_smmu.  We just
+		 * need _something_ here to get this node recognized by the
+		 * SMMU driver. Our test uses ATOS, which doesn't use SIDs
+		 * anyways, so using a dummy value is ok.
+		 */
+		iommus = <&mmss_bimc_smmu 42>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-arm-smmu-8996.dtsi b/arch/arm64/boot/dts/qcom/msm-arm-smmu-8996.dtsi
new file mode 100644
index 000000000000..cbe65e266968
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-arm-smmu-8996.dtsi
@@ -0,0 +1,266 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm-arm-smmu.dtsi"
+#include <dt-bindings/msm/msm-bus-ids.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+&anoc0_smmu {
+	status = "ok";
+	qcom,register-save;
+	qcom,skip-init;
+	#global-interrupts = <1>;
+	interrupts = <GIC_SPI 362 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 359 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 468 IRQ_TYPE_LEVEL_HIGH>;
+	vdd-supply = <&gdsc_aggre0_noc>;
+	clocks = <&clock_gcc clk_gcc_smmu_aggre0_axi_clk>,
+		<&clock_gcc clk_gcc_smmu_aggre0_ahb_clk>;
+	clock-names = "smmu_aggre0_axi_clk", "smmu_aggre0_ahb_clk";
+	#clock-cells = <1>;
+	#iommu-cells = <0>;
+};
+
+&anoc1_smmu {
+	status = "ok";
+	qcom,register-save;
+	qcom,skip-init;
+	#global-interrupts = <1>;
+	interrupts = <GIC_SPI 371 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 364 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 365 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 366 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 367 IRQ_TYPE_LEVEL_HIGH>;
+	#iommu-cells = <1>;
+	clocks = <&clock_gcc clk_aggre1_noc_clk>;
+	clock-names = "smmu_aggre1_noc_clk";
+	#clock-cells = <1>;
+};
+
+&anoc2_smmu {
+	status = "ok";
+	qcom,register-save;
+	qcom,skip-init;
+	#global-interrupts = <1>;
+	interrupts = <GIC_SPI 381 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 373 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 374 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 375 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 376 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 377 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 378 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 462 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 463 IRQ_TYPE_LEVEL_HIGH>;
+	#iommu-cells = <1>;
+	clocks = <&clock_gcc clk_aggre2_noc_clk>;
+	clock-names = "smmu_aggre2_noc_clk";
+	#clock-cells = <1>;
+};
+
+&lpass_q6_smmu {
+	status = "ok";
+	qcom,register-save;
+	qcom,skip-init;
+	#global-interrupts = <1>;
+	interrupts = <GIC_SPI 404 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 226 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 393 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 394 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 395 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 396 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 397 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 398 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 399 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 400 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 401 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 402 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 403 IRQ_TYPE_LEVEL_HIGH>;
+	vdd-supply = <&gdsc_hlos1_vote_lpass_adsp>;
+	clocks = <&clock_gcc clk_hlos1_vote_lpass_adsp_smmu_clk>;
+	clock-names = "lpass_q6_smmu_clocks";
+	#clock-cells = <1>;
+};
+
+&jpeg_smmu {
+	status = "ok";
+	qcom,register-save;
+	qcom,skip-init;
+	qcom,fatal-asf;
+	#global-interrupts = <1>;
+	interrupts = <GIC_SPI 67 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 69 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 70 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 71 IRQ_TYPE_LEVEL_HIGH>;
+	vdd-supply = <&gdsc_mmagic_camss>;
+	clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+		<&clock_mmss clk_mmss_mmagic_cfg_ahb_clk>,
+		<&clock_mmss clk_smmu_jpeg_ahb_clk>,
+		<&clock_mmss clk_smmu_jpeg_axi_clk>,
+		<&clock_mmss clk_mmagic_camss_axi_clk>;
+	clock-names = "mmagic_ahb_clk", "mmagic_cfg_ahb_clk",
+		"jpeg_ahb_clk", "jpeg_axi_clk",
+		"mmagic_camss_axi_clk";
+	#clock-cells = <1>;
+	qcom,bus-master-id = <MSM_BUS_MASTER_JPEG>;
+};
+
+&vfe_smmu {
+	status = "ok";
+	qcom,register-save;
+	qcom,skip-init;
+	qcom,fatal-asf;
+	#global-interrupts = <1>;
+	interrupts = <GIC_SPI 76 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 343 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 344 IRQ_TYPE_LEVEL_HIGH>;
+	vdd-supply = <&gdsc_mmagic_camss>;
+	clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+		<&clock_mmss clk_mmss_mmagic_cfg_ahb_clk>,
+		<&clock_mmss clk_smmu_vfe_ahb_clk>,
+		<&clock_mmss clk_smmu_vfe_axi_clk>,
+		<&clock_mmss clk_mmagic_camss_axi_clk>;
+	clock-names = "mmagic_ahb_clk", "mmagic_cfg_ahb_clk",
+		"vfe_ahb_clk", "vfe_axi_clk",
+		"mmagic_camss_axi_clk";
+	#clock-cells = <1>;
+	qcom,bus-master-id = <MSM_BUS_MASTER_VFE>;
+};
+
+&cpp_fd_smmu {
+	status = "ok";
+	qcom,register-save;
+	qcom,skip-init;
+	qcom,fatal-asf;
+	#global-interrupts = <1>;
+	interrupts = <GIC_SPI 264 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 263 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 266 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 267 IRQ_TYPE_LEVEL_HIGH>;
+	vdd-supply = <&gdsc_mmagic_camss>;
+	clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+		<&clock_mmss clk_mmss_mmagic_cfg_ahb_clk>,
+		<&clock_mmss clk_smmu_cpp_ahb_clk>,
+		<&clock_mmss clk_smmu_cpp_axi_clk>,
+		<&clock_mmss clk_mmagic_camss_axi_clk>;
+	clock-names = "mmagic_ahb_clk", "mmagic_cfg_ahb_clk",
+		"cpp_ahb_clk", "cpp_axi_clk",
+		"mmagic_camss_axi_clk";
+	#clock-cells = <1>;
+	qcom,bus-master-id = <MSM_BUS_MASTER_CPP>;
+};
+
+&venus_smmu {
+	status = "ok";
+	qcom,register-save;
+	qcom,skip-init;
+	#global-interrupts = <1>;
+	interrupts = <GIC_SPI 286 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 336 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 337 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 338 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 339 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 340 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 341 IRQ_TYPE_LEVEL_HIGH>;
+	vdd-supply = <&gdsc_mmagic_video>;
+	clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+		<&clock_mmss clk_mmss_mmagic_cfg_ahb_clk>,
+		<&clock_mmss clk_smmu_video_ahb_clk>,
+		<&clock_mmss clk_smmu_video_axi_clk>,
+		<&clock_mmss clk_mmagic_video_axi_clk>;
+	clock-names = "mmagic_ahb_clk", "mmagic_cfg_ahb_clk",
+		"video_ahb_clk", "video_axi_clk",
+		"mmagic_video_axi_clk";
+	#clock-cells = <1>;
+	qcom,bus-master-id = <MSM_BUS_MASTER_VIDEO_P0>;
+};
+
+&mdp_smmu {
+	status = "ok";
+	qcom,register-save;
+	qcom,skip-init;
+	qcom,no-smr-check;
+	#global-interrupts = <1>;
+	interrupts = <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 320 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>;
+	vdd-supply = <&gdsc_mmagic_mdss>;
+	clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+		<&clock_mmss clk_mmss_mmagic_cfg_ahb_clk>,
+		<&clock_mmss clk_smmu_mdp_ahb_clk>,
+		<&clock_mmss clk_smmu_mdp_axi_clk>,
+		<&clock_mmss clk_mmagic_mdss_axi_clk>;
+	clock-names = "mmagic_ahb_clk", "mmagic_cfg_ahb_clk",
+		"mdp_ahb_clk", "mdp_axi_clk",
+		"mmagic_mdss_axi_clk";
+	#clock-cells = <1>;
+	qcom,bus-master-id = <MSM_BUS_MASTER_MDP_PORT0>;
+};
+
+&rot_smmu {
+	status = "ok";
+	qcom,register-save;
+	qcom,skip-init;
+	#global-interrupts = <1>;
+	interrupts = <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 348 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 349 IRQ_TYPE_LEVEL_HIGH>;
+	vdd-supply = <&gdsc_mmagic_mdss>;
+	clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+		<&clock_mmss clk_mmss_mmagic_cfg_ahb_clk>,
+		<&clock_mmss clk_smmu_rot_ahb_clk>,
+		<&clock_mmss clk_smmu_rot_axi_clk>,
+		<&clock_mmss clk_mmagic_mdss_axi_clk>;
+	clock-names = "mmagic_ahb_clk", "mmagic_cfg_ahb_clk",
+		"rot_ahb_clk", "rot_axi_clk",
+		"mmagic_mdss_axi_clk";
+	#clock-cells = <1>;
+	qcom,bus-master-id = <MSM_BUS_MASTER_ROTATOR>;
+};
+
+&kgsl_smmu {
+	status = "ok";
+	qcom,register-save;
+	qcom,skip-init;
+	qcom,dynamic;
+	#global-interrupts = <1>;
+	interrupts = <GIC_SPI 334 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>,
+		<GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>;
+	vdd-supply = <&gdsc_gpu>;
+	clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+		<&clock_mmss clk_mmss_mmagic_cfg_ahb_clk>,
+		<&clock_gpu clk_gpu_ahb_clk>,
+		<&clock_gcc clk_gcc_mmss_bimc_gfx_clk>,
+		<&clock_gcc clk_gcc_bimc_gfx_clk>;
+	clock-names = "mmagic_ahb_clk", "mmagic_cfg_ahb_clk", "gpu_ahb_clk",
+		"gcc_mmss_bimc_gfx_clk", "gcc_bimc_gfx_clk";
+	#clock-cells = <1>;
+};
+
+&soc {
+	iommu_test_device {
+		compatible = "iommu-debug-test";
+		/*
+		 * 42 shouldn't be used by anyone on the cpp_fd_smmu.  We just
+		 * need _something_ here to get this node recognized by the
+		 * SMMU driver. Our test uses ATOS, which doesn't use SIDs
+		 * anyways, so using a dummy value is ok.
+		 */
+		iommus = <&cpp_fd_smmu 42>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-arm-smmu-8998.dtsi b/arch/arm64/boot/dts/qcom/msm-arm-smmu-8998.dtsi
new file mode 100644
index 000000000000..e4e488597efd
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-arm-smmu-8998.dtsi
@@ -0,0 +1,192 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/clock/msm-clocks-8998.h>
+#include <dt-bindings/msm/msm-bus-ids.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+&soc {
+	anoc1_smmu: arm,smmu-anoc1@1680000 {
+		status = "ok";
+		compatible = "qcom,smmu-v2";
+		reg = <0x1680000 0x10000>;
+		#iommu-cells = <0>;
+		qcom,register-save;
+		qcom,skip-init;
+		#global-interrupts = <0>;
+		interrupts = <GIC_SPI 364 IRQ_TYPE_EDGE_RISING>,
+			   <GIC_SPI 365 IRQ_TYPE_EDGE_RISING>,
+			   <GIC_SPI 366 IRQ_TYPE_EDGE_RISING>,
+			   <GIC_SPI 367 IRQ_TYPE_EDGE_RISING>,
+			   <GIC_SPI 368 IRQ_TYPE_EDGE_RISING>,
+			   <GIC_SPI 369 IRQ_TYPE_EDGE_RISING>;
+		qcom,msm-bus,name = "smmu-bus-client-anoc1";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,active-only;
+		qcom,msm-bus,num-paths = <1>;
+		/* aggre1_noc_clk */
+		qcom,msm-bus,vectors-KBps =
+				<84 10062 0 0>,
+				<84 10062 0 1000>;
+	};
+
+	anoc2_smmu: arm,smmu-anoc2@16c0000 {
+		status = "ok";
+		compatible = "qcom,smmu-v2";
+		reg = <0x16c0000 0x40000>;
+		#iommu-cells = <1>;
+		qcom,register-save;
+		qcom,skip-init;
+		#global-interrupts = <0>;
+		interrupts = <GIC_SPI 373 IRQ_TYPE_EDGE_RISING>,
+			   <GIC_SPI 374 IRQ_TYPE_EDGE_RISING>,
+			   <GIC_SPI 375 IRQ_TYPE_EDGE_RISING>,
+			   <GIC_SPI 376 IRQ_TYPE_EDGE_RISING>,
+			   <GIC_SPI 377 IRQ_TYPE_EDGE_RISING>,
+			   <GIC_SPI 378 IRQ_TYPE_EDGE_RISING>,
+			   <GIC_SPI 462 IRQ_TYPE_EDGE_RISING>,
+			   <GIC_SPI 463 IRQ_TYPE_EDGE_RISING>,
+			   <GIC_SPI 464 IRQ_TYPE_EDGE_RISING>,
+			   <GIC_SPI 465 IRQ_TYPE_EDGE_RISING>;
+		qcom,msm-bus,name = "smmu-bus-client-anoc2";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,active-only;
+		qcom,msm-bus,num-paths = <1>;
+		/* aggre2_noc_clk */
+		qcom,msm-bus,vectors-KBps =
+				<117 10065 0 0>,
+				<117 10065 0 1000>;
+	};
+
+	lpass_q6_smmu: arm,smmu-lpass_q6@5100000 {
+		status = "ok";
+		compatible = "qcom,smmu-v2";
+		reg = <0x5100000 0x40000>;
+		#iommu-cells = <1>;
+		qcom,tz-device-id = "LPASS";
+		qcom,register-save;
+		qcom,skip-init;
+		#global-interrupts = <0>;
+		interrupts = <GIC_SPI 226 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 393 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 394 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 395 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 396 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 397 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 398 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 399 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 400 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 401 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 402 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 403 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>;
+		vdd-supply = <&gdsc_hlos1_vote_lpass_adsp>;
+		clocks = <&clock_gcc clk_hlos1_vote_lpass_adsp_smmu_clk>;
+		clock-names = "lpass_q6_smmu_clk";
+		#clock-cells = <1>;
+	};
+
+	mmss_smmu: arm,smmu-mmss@cd00000 {
+		status = "ok";
+		compatible = "qcom,smmu-v2";
+		reg = <0xcd00000 0x40000>;
+		#iommu-cells = <1>;
+		qcom,register-save;
+		qcom,no-smr-check;
+		qcom,skip-init;
+		#global-interrupts = <0>;
+		interrupts = <GIC_SPI 263 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 266 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 267 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 268 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 244 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 245 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 247 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 248 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 249 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 250 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 251 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 252 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 253 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 254 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 255 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 256 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 260 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 261 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 262 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 272 IRQ_TYPE_LEVEL_HIGH>;
+		vdd-supply = <&gdsc_bimc_smmu>;
+		clocks = <&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>;
+		clock-names = "mmss_mnoc_ahb_clk",
+			"mmss_bimc_smmu_ahb_clk",
+			"mmss_bimc_smmu_axi_clk";
+		#clock-cells = <1>;
+		qcom,msm-bus,name = "smmu-bus-client-mmss";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,active-only;
+		qcom,msm-bus,num-paths = <2>;
+		/* ahb_clk_src, mmssnoc_axi_clk */
+		qcom,msm-bus,vectors-KBps =
+				<102 722 0 0>, <29 512 0 0>,
+				<102 722 0 1000>, <29 512 0 1000>;
+	};
+
+	kgsl_smmu: arm,smmu-kgsl@5040000 {
+		status = "ok";
+		compatible = "qcom,smmu-v2";
+		reg = <0x5040000 0x10000>;
+		#iommu-cells = <1>;
+		qcom-tz-device-id = "GPU";
+		qcom,dynamic;
+		qcom,register-save;
+		qcom,skip-init;
+		#global-interrupts = <0>;
+		interrupts = <GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>,
+			   <GIC_SPI 331 IRQ_TYPE_EDGE_RISING>;
+		qcom,deferred-regulator-disable-delay = <80>;
+		vdd-supply = <&gdsc_gpu_cx>;
+		clocks = <&clock_gcc clk_gcc_gpu_cfg_ahb_clk>,
+			<&clock_gcc clk_gcc_bimc_gfx_clk>,
+			<&clock_gcc clk_gcc_gpu_bimc_gfx_clk>;
+
+		clock-names = "gcc_gpu_cfg_ahb_clk",
+			"gcc_bimc_gfx_clk",
+			"gcc_gpu_bimc_gfx_clk";
+		#clock-cells = <1>;
+	};
+
+	iommu_test_device {
+		compatible = "iommu-debug-test";
+		/*
+		 * 42 shouldn't be used by anyone on the mmss_smmu.  We just
+		 * need _something_ here to get this node recognized by the
+		 * SMMU driver. Our test uses ATOS, which doesn't use SIDs
+		 * anyways, so using a dummy value is ok.
+		 */
+		iommus = <&mmss_smmu 42>;
+	};
+
+	iommu_coherent_test_device {
+		compatible = "iommu-debug-test";
+		/*
+		 * 43 shouldn't be used by anyone on the mmss_smmu.  We just
+		 * need _something_ here to get this node recognized by the
+		 * SMMU driver. Our test uses ATOS, which doesn't use SIDs
+		 * anyways, so using a dummy value is ok.
+		 */
+		iommus = <&mmss_smmu 43>;
+		dma-coherent;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-arm-smmu-impl-defs-660.dtsi b/arch/arm64/boot/dts/qcom/msm-arm-smmu-impl-defs-660.dtsi
new file mode 100644
index 000000000000..f060f2d7008c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-arm-smmu-impl-defs-660.dtsi
@@ -0,0 +1,409 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&kgsl_smmu {
+	attach-impl-defs = <0x6000 0x2378>,
+			   <0x6060 0x1055>,
+			   <0x678c 0x8>,
+			   <0x6794 0x28>,
+			   <0x6800 0x6>,
+			   <0x6900 0x3ff>,
+			   <0x6924 0x204>,
+			   <0x6928 0x11000>,
+			   <0x6930 0x800>,
+			   <0x6960 0xffffffff>,
+			   <0x6b64 0x1a5551>,
+			   <0x6b68 0x9a82a382>;
+};
+
+&lpass_q6_smmu {
+	attach-impl-defs = <0x6000 0x2378>,
+			   <0x6060 0x1055>,
+			   <0x6070 0xe0>,
+			   <0x6074 0xe0>,
+			   <0x6078 0xe0>,
+			   <0x607c 0xe0>,
+			   <0x60f0 0xc0>,
+			   <0x60f4 0xc8>,
+			   <0x60f8 0xd0>,
+			   <0x60fc 0xd8>,
+			   <0x6170 0x0>,
+			   <0x6174 0x30>,
+			   <0x6178 0x60>,
+			   <0x617c 0x90>,
+			   <0x6270 0x0>,
+			   <0x6274 0x2>,
+			   <0x6278 0x4>,
+			   <0x627c 0x6>,
+			   <0x62f0 0x8>,
+			   <0x62f4 0xe>,
+			   <0x62f8 0x14>,
+			   <0x62fc 0x1a>,
+			   <0x6370 0x20>,
+			   <0x6374 0x40>,
+			   <0x6378 0x60>,
+			   <0x637c 0x80>,
+			   <0x6784 0x0>,
+			   <0x678c 0x10>,
+			   <0x67a0 0x0>,
+			   <0x67a4 0x0>,
+			   <0x67a8 0x20>,
+			   <0x67b0 0x0>,
+			   <0x67b4 0x8>,
+			   <0x67b8 0xc8>,
+			   <0x67d0 0x4>,
+			   <0x67dc 0x8>,
+			   <0x67e0 0x8>,
+			   <0x6800 0x6>,
+			   <0x6900 0x3ff>,
+			   <0x6924 0x202>,
+			   <0x6928 0x10a00>,
+			   <0x6930 0x500>,
+			   <0x6960 0xffffffff>,
+			   <0x6b64 0x121151>,
+			   <0x6b68 0xea800080>,
+			   <0x6c00 0x0>,
+			   <0x6c04 0x0>,
+			   <0x6c08 0x0>,
+			   <0x6c0c 0x0>,
+			   <0x6c10 0x1>,
+			   <0x6c14 0x1>,
+			   <0x6c18 0x1>,
+			   <0x6c1c 0x1>,
+			   <0x6c20 0x2>,
+			   <0x6c24 0x2>,
+			   <0x6c28 0x2>,
+			   <0x6c2c 0x2>,
+			   <0x6c30 0x3>,
+			   <0x6c34 0x3>,
+			   <0x6c38 0x3>,
+			   <0x6c3c 0x3>;
+};
+
+&turing_q6_smmu {
+	attach-impl-defs = <0x6000 0x2378>,
+			   <0x6060 0x1055>,
+			   <0x6070 0xe0>,
+			   <0x6074 0xe0>,
+			   <0x6078 0xe0>,
+			   <0x607c 0xe0>,
+			   <0x60f0 0xc0>,
+			   <0x60f4 0xc8>,
+			   <0x60f8 0xd0>,
+			   <0x60fc 0xd8>,
+			   <0x6170 0x0>,
+			   <0x6174 0x30>,
+			   <0x6178 0x60>,
+			   <0x617c 0x90>,
+			   <0x6270 0x0>,
+			   <0x6274 0x2>,
+			   <0x6278 0x4>,
+			   <0x627c 0x6>,
+			   <0x62f0 0x8>,
+			   <0x62f4 0xe>,
+			   <0x62f8 0x14>,
+			   <0x62fc 0x1a>,
+			   <0x6370 0x20>,
+			   <0x6374 0x40>,
+			   <0x6378 0x60>,
+			   <0x637c 0x80>,
+			   <0x6784 0x0>,
+			   <0x678c 0x10>,
+			   <0x67a0 0x0>,
+			   <0x67a4 0x0>,
+			   <0x67a8 0x20>,
+			   <0x67b0 0x0>,
+			   <0x67b4 0x8>,
+			   <0x67b8 0xc8>,
+			   <0x67d0 0x4>,
+			   <0x67dc 0x8>,
+			   <0x67e0 0x8>,
+			   <0x6800 0x6>,
+			   <0x6900 0x3ff>,
+			   <0x6924 0x202>,
+			   <0x6928 0x10a00>,
+			   <0x6930 0x500>,
+			   <0x6960 0xffffffff>,
+			   <0x6b64 0x121151>,
+			   <0x6b68 0xea800080>,
+			   <0x6c00 0x0>,
+			   <0x6c04 0x0>,
+			   <0x6c08 0x0>,
+			   <0x6c0c 0x0>,
+			   <0x6c10 0x1>,
+			   <0x6c14 0x1>,
+			   <0x6c18 0x1>,
+			   <0x6c1c 0x1>,
+			   <0x6c20 0x2>,
+			   <0x6c24 0x2>,
+			   <0x6c28 0x2>,
+			   <0x6c2c 0x2>,
+			   <0x6c30 0x3>,
+			   <0x6c34 0x3>,
+			   <0x6c38 0x3>,
+			   <0x6c3c 0x3>;
+};
+
+&mmss_bimc_smmu {
+	attach-impl-defs = <0x6000 0x2378>,
+			   <0x6060 0x1055>,
+			   <0x678c 0x28>,
+			   <0x6794 0xe0>,
+			   <0x6800 0x6>,
+			   <0x6900 0x3ff>,
+			   <0x6924 0x204>,
+			   <0x6928 0x11002>,
+			   <0x6930 0x800>,
+			   <0x6960 0xffffffff>,
+			   <0x6964 0xffffffff>,
+			   <0x6968 0xffffffff>,
+			   <0x696c 0xffffffff>,
+			   <0x6b48 0x330330>,
+			   <0x6b4c 0x81>,
+			   <0x6b50 0x3333>,
+			   <0x6b54 0x3333>,
+			   <0x6b64 0x1a5555>,
+			   <0x6b68 0xbaaa892a>,
+			   <0x6b70 0x10100202>,
+			   <0x6b74 0x10100202>,
+			   <0x6b78 0x10100000>,
+			   <0x6b80 0x20042004>,
+			   <0x6b84 0x20042004>;
+};
+
+&anoc2_smmu {
+	attach-impl-defs = <0x6000 0x2378>,
+			   <0x6060 0x1055>,
+			   <0x6070 0xf>,
+			   <0x6074 0x23>,
+			   <0x6078 0x37>,
+			   <0x607c 0x39>,
+			   <0x6080 0x3f>,
+			   <0x6084 0x6f>,
+			   <0x6088 0x74>,
+			   <0x608c 0x92>,
+			   <0x6090 0xb0>,
+			   <0x6094 0xf0>,
+			   <0x6098 0xf0>,
+			   <0x609c 0xf0>,
+			   <0x60f0 0x0>,
+			   <0x60f4 0x1>,
+			   <0x60f8 0x3>,
+			   <0x60fc 0x4>,
+			   <0x6100 0x6>,
+			   <0x6104 0x8>,
+			   <0x6108 0x9>,
+			   <0x610c 0xb>,
+			   <0x6110 0xd>,
+			   <0x6114 0xf>,
+			   <0x6118 0xf>,
+			   <0x611c 0xf>,
+			   <0x6170 0x0>,
+			   <0x6174 0x0>,
+			   <0x6178 0x0>,
+			   <0x617c 0x0>,
+			   <0x6180 0x0>,
+			   <0x6184 0x0>,
+			   <0x6188 0x0>,
+			   <0x618c 0x0>,
+			   <0x6190 0x0>,
+			   <0x6194 0x0>,
+			   <0x6198 0x0>,
+			   <0x619c 0x0>,
+			   <0x6270 0x0>,
+			   <0x6274 0x1>,
+			   <0x6278 0x2>,
+			   <0x627c 0x4>,
+			   <0x6280 0x4>,
+			   <0x6284 0x6>,
+			   <0x6288 0x6>,
+			   <0x628c 0xa>,
+			   <0x6290 0xc>,
+			   <0x6294 0xc>,
+			   <0x6298 0xc>,
+			   <0x629c 0xc>,
+			   <0x62f0 0xc>,
+			   <0x62f4 0x12>,
+			   <0x62f8 0x18>,
+			   <0x62fc 0x1a>,
+			   <0x6300 0x1d>,
+			   <0x6304 0x23>,
+			   <0x6308 0x24>,
+			   <0x630c 0x28>,
+			   <0x6310 0x2c>,
+			   <0x6314 0x30>,
+			   <0x6318 0x30>,
+			   <0x631c 0x30>,
+			   <0x6370 0x30>,
+			   <0x6374 0x35>,
+			   <0x6378 0x3a>,
+			   <0x637c 0x3e>,
+			   <0x6380 0x46>,
+			   <0x6384 0x50>,
+			   <0x6388 0x55>,
+			   <0x638c 0x5d>,
+			   <0x6390 0x67>,
+			   <0x6394 0x80>,
+			   <0x6398 0x80>,
+			   <0x639c 0x80>,
+			   <0x678c 0x12>,
+			   <0x6794 0x32>,
+			   <0x67a0 0x0>,
+			   <0x67a4 0xe1>,
+			   <0x67a8 0xf0>,
+			   <0x67b0 0x0>,
+			   <0x67b4 0xc>,
+			   <0x67b8 0x9c>,
+			   <0x67d0 0x0>,
+			   <0x67dc 0x4>,
+			   <0x67e0 0x8>,
+			   <0x6800 0x6>,
+			   <0x6900 0x3ff>,
+			   <0x6b48 0x330330>,
+			   <0x6b4c 0x81>,
+			   <0x6b50 0x1313>,
+			   <0x6b64 0x121155>,
+			   <0x6b68 0xcaa84920>,
+			   <0x6b70 0xc0c0000>,
+			   <0x6b74 0x8080000>,
+			   <0x6b78 0x8080000>,
+			   <0x6b80 0x20002000>,
+			   <0x6b84 0x20002000>,
+			   <0x6c00 0x5>,
+			   <0x6c04 0x0>,
+			   <0x6c08 0x5>,
+			   <0x6c0c 0x0>,
+			   <0x6c10 0x5>,
+			   <0x6c14 0x0>,
+			   <0x6c18 0x5>,
+			   <0x6c1c 0x0>,
+			   <0x6c20 0x5>,
+			   <0x6c24 0x0>,
+			   <0x6c28 0x0>,
+			   <0x6c2c 0x0>,
+			   <0x6c30 0x0>,
+			   <0x6c34 0x0>,
+			   <0x6c38 0x0>,
+			   <0x6c3c 0x0>,
+			   <0x6c40 0x0>,
+			   <0x6c44 0x0>,
+			   <0x6c48 0x0>,
+			   <0x6c4c 0x0>,
+			   <0x6c50 0x0>,
+			   <0x6c54 0x0>,
+			   <0x6c58 0x0>,
+			   <0x6c5c 0x0>,
+			   <0x6c60 0x0>,
+			   <0x6c64 0x0>,
+			   <0x6c68 0x0>,
+			   <0x6c6c 0x0>,
+			   <0x6c70 0x0>,
+			   <0x6c74 0x0>,
+			   <0x6c78 0x0>,
+			   <0x6c7c 0x0>,
+			   <0x6c80 0x0>,
+			   <0x6c84 0x0>,
+			   <0x6c88 0x0>,
+			   <0x6c8c 0x0>,
+			   <0x6c90 0x0>,
+			   <0x6c94 0x0>,
+			   <0x6c98 0x0>,
+			   <0x6c9c 0x0>,
+			   <0x6ca0 0x0>,
+			   <0x6ca4 0x0>,
+			   <0x6ca8 0x0>,
+			   <0x6cac 0x0>,
+			   <0x6cb0 0x0>,
+			   <0x6cb4 0x0>,
+			   <0x6cb8 0x0>,
+			   <0x6cbc 0x0>,
+			   <0x6cc0 0x0>,
+			   <0x6cc4 0x0>,
+			   <0x6cc8 0x0>,
+			   <0x6ccc 0x0>,
+			   <0x6cd0 0x0>,
+			   <0x6cd4 0x0>,
+			   <0x6cd8 0x0>,
+			   <0x6cdc 0x0>,
+			   <0x6ce0 0x0>,
+			   <0x6ce4 0x0>,
+			   <0x6ce8 0x0>,
+			   <0x6cec 0x0>,
+			   <0x6cf0 0x0>,
+			   <0x6cf4 0x0>,
+			   <0x6cf8 0x0>,
+			   <0x6cfc 0x0>,
+			   <0x6d00 0x3>,
+			   <0x6d04 0x4>,
+			   <0x6d08 0x4>,
+			   <0x6d0c 0x0>,
+			   <0x6d10 0x8>,
+			   <0x6d14 0x8>,
+			   <0x6d18 0x3>,
+			   <0x6d1c 0x2>,
+			   <0x6d20 0x4>,
+			   <0x6d24 0x0>,
+			   <0x6d28 0x4>,
+			   <0x6d2c 0x0>,
+			   <0x6d30 0x7>,
+			   <0x6d34 0x0>,
+			   <0x6d38 0x6>,
+			   <0x6d3c 0x0>,
+			   <0x6d40 0x0>,
+			   <0x6d44 0x1>,
+			   <0x6d48 0x4>,
+			   <0x6d4c 0x0>,
+			   <0x6d50 0x4>,
+			   <0x6d54 0x0>,
+			   <0x6d58 0x4>,
+			   <0x6d5c 0x0>,
+			   <0x6d60 0x0>,
+			   <0x6d64 0x0>,
+			   <0x6d68 0x0>,
+			   <0x6d6c 0x0>,
+			   <0x6d70 0x0>,
+			   <0x6d74 0x0>,
+			   <0x6d78 0x0>,
+			   <0x6d7c 0x0>,
+			   <0x6d80 0x0>,
+			   <0x6d84 0x0>,
+			   <0x6d88 0x0>,
+			   <0x6d8c 0x0>,
+			   <0x6d90 0x0>,
+			   <0x6d94 0x0>,
+			   <0x6d98 0x0>,
+			   <0x6d9c 0x0>,
+			   <0x6da0 0x0>,
+			   <0x6da4 0x0>,
+			   <0x6da8 0x0>,
+			   <0x6dac 0x0>,
+			   <0x6db0 0x0>,
+			   <0x6db4 0x0>,
+			   <0x6db8 0x0>,
+			   <0x6dbc 0x0>,
+			   <0x6dc0 0x0>,
+			   <0x6dc4 0x0>,
+			   <0x6dc8 0x0>,
+			   <0x6dcc 0x0>,
+			   <0x6dd0 0x0>,
+			   <0x6dd4 0x0>,
+			   <0x6dd8 0x0>,
+			   <0x6ddc 0x0>,
+			   <0x6de0 0x0>,
+			   <0x6de4 0x0>,
+			   <0x6de8 0x0>,
+			   <0x6dec 0x0>,
+			   <0x6df0 0x0>,
+			   <0x6df4 0x0>,
+			   <0x6df8 0x0>,
+			   <0x6dfc 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-arm-smmu-impl-defs-8996-v2.dtsi b/arch/arm64/boot/dts/qcom/msm-arm-smmu-impl-defs-8996-v2.dtsi
new file mode 100644
index 000000000000..4a8fa08df531
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-arm-smmu-impl-defs-8996-v2.dtsi
@@ -0,0 +1,643 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+&jpeg_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6070 0x30>,
+		<0x6074 0x30>,
+		<0x6078 0x30>,
+		<0x607c 0x30>,
+		<0x6080 0x30>,
+		<0x6084 0x30>,
+		<0x6088 0x30>,
+		<0x608c 0x30>,
+		<0x6170 0x24>,
+		<0x6174 0x26>,
+		<0x6178 0x28>,
+		<0x617c 0x2a>,
+		<0x6180 0x2c>,
+		<0x6184 0x2d>,
+		<0x6188 0x2e>,
+		<0x618c 0x2f>,
+		<0x6270 0x0>,
+		<0x6274 0x4>,
+		<0x6278 0xc>,
+		<0x627c 0xe>,
+		<0x6280 0x12>,
+		<0x6284 0x16>,
+		<0x6288 0x18>,
+		<0x628c 0x1c>,
+		<0x6470 0x0>,
+		<0x6474 0x1>,
+		<0x6478 0x1>,
+		<0x647c 0x1>,
+		<0x6480 0x2>,
+		<0x6484 0x2>,
+		<0x6488 0x3>,
+		<0x648c 0x3>,
+		<0x6570 0x3>,
+		<0x6574 0x5>,
+		<0x6578 0x7>,
+		<0x657c 0x9>,
+		<0x6580 0xb>,
+		<0x6584 0xd>,
+		<0x6588 0xf>,
+		<0x658c 0x11>,
+		<0x6670 0x13>,
+		<0x6674 0x16>,
+		<0x6678 0x1c>,
+		<0x667c 0x1e>,
+		<0x6680 0x21>,
+		<0x6684 0x24>,
+		<0x6688 0x26>,
+		<0x668c 0x2a>,
+		<0x67a0 0x0>,
+		<0x67a4 0x0>,
+		<0x67a8 0xc>,
+		<0x67b0 0x0>,
+		<0x67b4 0x3>,
+		<0x67b8 0x83>,
+		<0x67d0 0x10>,
+		<0x67dc 0x8>,
+		<0x67e0 0x10>,
+		<0x6800 0x0>,
+		<0x6804 0x1>,
+		<0x6808 0x2>,
+		<0x680c 0x3>,
+		<0x6810 0x4>,
+		<0x6814 0x5>,
+		<0x6818 0x6>,
+		<0x681c 0x7>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x6b18 0xff>,
+		<0x6b24 0x204>,
+		<0x6b28 0x10800>,
+		<0x6b30 0x400>,
+		<0x678c 0x6>,
+		<0x6794 0x24>;
+};
+
+&kgsl_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x6b18 0x3>,
+		<0x6b24 0x204>,
+		<0x6b28 0x11000>,
+		<0x6b30 0x800>,
+		<0x678c 0x8>,
+		<0x6794 0x28>;
+};
+
+&vfe_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6070 0x50>,
+		<0x6074 0x50>,
+		<0x6078 0x50>,
+		<0x607c 0x50>,
+		<0x6080 0x50>,
+		<0x6084 0x50>,
+		<0x6088 0x50>,
+		<0x608c 0x50>,
+		<0x6090 0x50>,
+		<0x6094 0x50>,
+		<0x6098 0x50>,
+		<0x609c 0x50>,
+		<0x60a0 0x50>,
+		<0x60a4 0x50>,
+		<0x60a8 0x50>,
+		<0x60ac 0x50>,
+		<0x6170 0x44>,
+		<0x6174 0x45>,
+		<0x6178 0x46>,
+		<0x617c 0x47>,
+		<0x6180 0x48>,
+		<0x6184 0x49>,
+		<0x6188 0x4a>,
+		<0x618c 0x4b>,
+		<0x6190 0x4c>,
+		<0x6194 0x4d>,
+		<0x6198 0x4e>,
+		<0x619c 0x4f>,
+		<0x61a0 0x50>,
+		<0x61a4 0x50>,
+		<0x61a8 0x50>,
+		<0x61ac 0x50>,
+		<0x6270 0x0>,
+		<0x6274 0x14>,
+		<0x6278 0x16>,
+		<0x627c 0x18>,
+		<0x6280 0x1a>,
+		<0x6284 0x1c>,
+		<0x6288 0x1e>,
+		<0x628c 0x20>,
+		<0x6290 0x22>,
+		<0x6294 0x36>,
+		<0x6298 0x38>,
+		<0x629c 0x3a>,
+		<0x62a0 0x3c>,
+		<0x62a4 0x3e>,
+		<0x62a8 0x40>,
+		<0x62ac 0x42>,
+		<0x6470 0x0>,
+		<0x6474 0x1>,
+		<0x6478 0x2>,
+		<0x647c 0x3>,
+		<0x6480 0x4>,
+		<0x6484 0x4>,
+		<0x6488 0x4>,
+		<0x648c 0x4>,
+		<0x6490 0x4>,
+		<0x6494 0x5>,
+		<0x6498 0x6>,
+		<0x649c 0x7>,
+		<0x64a0 0x8>,
+		<0x64a4 0x8>,
+		<0x64a8 0x8>,
+		<0x64ac 0x8>,
+		<0x6570 0x8>,
+		<0x6574 0xb>,
+		<0x6578 0xe>,
+		<0x657c 0x11>,
+		<0x6580 0x13>,
+		<0x6584 0x15>,
+		<0x6588 0x17>,
+		<0x658c 0x19>,
+		<0x6590 0x1b>,
+		<0x6594 0x1e>,
+		<0x6598 0x21>,
+		<0x659c 0x24>,
+		<0x65a0 0x26>,
+		<0x65a4 0x28>,
+		<0x65a8 0x2a>,
+		<0x65ac 0x2c>,
+		<0x6670 0x2e>,
+		<0x6674 0x38>,
+		<0x6678 0x39>,
+		<0x667c 0x3a>,
+		<0x6680 0x3b>,
+		<0x6684 0x3c>,
+		<0x6688 0x3d>,
+		<0x668c 0x3e>,
+		<0x6690 0x3f>,
+		<0x6694 0x49>,
+		<0x6698 0x4a>,
+		<0x669c 0x4b>,
+		<0x66a0 0x4c>,
+		<0x66a4 0x4d>,
+		<0x66a8 0x4e>,
+		<0x66ac 0x4f>,
+		<0x67a0 0x0>,
+		<0x67a4 0x0>,
+		<0x67a8 0xc>,
+		<0x67b0 0x0>,
+		<0x67b4 0x8>,
+		<0x67b8 0x138>,
+		<0x67d0 0x10>,
+		<0x67dc 0x8>,
+		<0x67e0 0x10>,
+		<0x6800 0x0>,
+		<0x6804 0x1>,
+		<0x6808 0x2>,
+		<0x680c 0x3>,
+		<0x6810 0x4>,
+		<0x6814 0x5>,
+		<0x6818 0x6>,
+		<0x681c 0x7>,
+		<0x6820 0x8>,
+		<0x6824 0x9>,
+		<0x6828 0xa>,
+		<0x682c 0xb>,
+		<0x6830 0xc>,
+		<0x6834 0xd>,
+		<0x6838 0xe>,
+		<0x683c 0xf>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x6b18 0xffff>,
+		<0x6b24 0x204>,
+		<0x6b28 0x10a00>,
+		<0x6b30 0x500>,
+		<0x678c 0xb>,
+		<0x6794 0x2f>;
+};
+
+&venus_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6070 0x110>,
+		<0x6074 0x110>,
+		<0x6078 0x110>,
+		<0x607c 0x110>,
+		<0x6080 0x110>,
+		<0x6084 0x110>,
+		<0x6088 0x110>,
+		<0x608c 0x110>,
+		<0x6170 0xe1>,
+		<0x6174 0xe5>,
+		<0x6178 0xfc>,
+		<0x617c 0x100>,
+		<0x6180 0x104>,
+		<0x6184 0x108>,
+		<0x6188 0x10c>,
+		<0x618c 0x10e>,
+		<0x6270 0x0>,
+		<0x6274 0x8>,
+		<0x6278 0x28>,
+		<0x627c 0x69>,
+		<0x6280 0x8d>,
+		<0x6284 0xa5>,
+		<0x6288 0xc9>,
+		<0x628c 0xd9>,
+		<0x6470 0x0>,
+		<0x6474 0x0>,
+		<0x6478 0x0>,
+		<0x647c 0x0>,
+		<0x6480 0x0>,
+		<0x6484 0x0>,
+		<0x6488 0x0>,
+		<0x648c 0x0>,
+		<0x6570 0x0>,
+		<0x6574 0x4>,
+		<0x6578 0x1c>,
+		<0x657c 0x21>,
+		<0x6580 0x26>,
+		<0x6584 0x2a>,
+		<0x6588 0x2e>,
+		<0x658c 0x30>,
+		<0x6670 0x32>,
+		<0x6674 0x36>,
+		<0x6678 0x46>,
+		<0x667c 0x58>,
+		<0x6680 0x62>,
+		<0x6684 0x6d>,
+		<0x6688 0x75>,
+		<0x668c 0x7d>,
+		<0x67a0 0x0>,
+		<0x67a4 0x0>,
+		<0x67a8 0x2f>,
+		<0x67b0 0x0>,
+		<0x67b4 0x0>,
+		<0x67b8 0x190>,
+		<0x67d0 0x8>,
+		<0x67dc 0x8>,
+		<0x67e0 0x8>,
+		<0x6800 0x0>,
+		<0x6804 0x1>,
+		<0x6808 0x2>,
+		<0x680c 0x3>,
+		<0x6810 0x4>,
+		<0x6814 0x5>,
+		<0x6818 0x6>,
+		<0x681c 0x7>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x6b18 0xff>,
+		<0x6b24 0x203>,
+		<0x6b28 0x10a00>,
+		<0x6b30 0x500>,
+		<0x678c 0x18>,
+		<0x6794 0x43>;
+};
+
+&mdp_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6070 0x70>,
+		<0x6074 0x70>,
+		<0x6170 0x52>,
+		<0x6174 0x68>,
+		<0x6270 0x0>,
+		<0x6274 0x3e>,
+		<0x6470 0x0>,
+		<0x6474 0x8>,
+		<0x6570 0x8>,
+		<0x6574 0x13>,
+		<0x6670 0x1e>,
+		<0x6674 0x5c>,
+		<0x67a0 0x0>,
+		<0x67a4 0x0>,
+		<0x67a8 0x1e>,
+		<0x67b0 0x0>,
+		<0x67b4 0x8>,
+		<0x67b8 0xb8>,
+		<0x67d0 0x10>,
+		<0x67dc 0x8>,
+		<0x67e0 0x10>,
+		<0x6800 0x0>,
+		<0x6804 0x1>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x678c 0x8>,
+		<0x6794 0x24>;
+};
+
+&rot_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6070 0xc0>,
+		<0x6074 0xc0>,
+		<0x6078 0xc0>,
+		<0x6170 0xae>,
+		<0x6174 0xb6>,
+		<0x6178 0xbe>,
+		<0x6270 0x0>,
+		<0x6274 0x52>,
+		<0x6278 0xa6>,
+		<0x6470 0x0>,
+		<0x6474 0x2>,
+		<0x6478 0x4>,
+		<0x6570 0x4>,
+		<0x6574 0xc>,
+		<0x6578 0x15>,
+		<0x6670 0x19>,
+		<0x6674 0x42>,
+		<0x6678 0x6c>,
+		<0x67a0 0x0>,
+		<0x67a4 0x0>,
+		<0x67a8 0x12>,
+		<0x67b0 0x0>,
+		<0x67b4 0x4>,
+		<0x67b8 0xac>,
+		<0x67d0 0x10>,
+		<0x67dc 0x8>,
+		<0x67e0 0x10>,
+		<0x6800 0x0>,
+		<0x6804 0x2>,
+		<0x6808 0x1>,
+		<0x680c 0x2>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x6b18 0xf>,
+		<0x6b24 0x204>,
+		<0x6b28 0x10a00>,
+		<0x6b30 0x500>,
+		<0x678c 0xc>,
+		<0x6794 0x44>;
+};
+
+&cpp_fd_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6070 0xa0>,
+		<0x6074 0xa0>,
+		<0x6078 0xa0>,
+		<0x607c 0xa0>,
+		<0x6080 0xa0>,
+		<0x6084 0xa0>,
+		<0x6170 0x8a>,
+		<0x6174 0x8e>,
+		<0x6178 0x92>,
+		<0x617c 0x96>,
+		<0x6180 0x9a>,
+		<0x6184 0x9d>,
+		<0x6270 0x0>,
+		<0x6274 0x18>,
+		<0x6278 0x24>,
+		<0x627c 0x30>,
+		<0x6280 0x3c>,
+		<0x6284 0x54>,
+		<0x6470 0x0>,
+		<0x6474 0x0>,
+		<0x6478 0x1>,
+		<0x647c 0x2>,
+		<0x6480 0x2>,
+		<0x6484 0x2>,
+		<0x6570 0x3>,
+		<0x6574 0x12>,
+		<0x6578 0x1a>,
+		<0x657c 0x22>,
+		<0x6580 0x2a>,
+		<0x6584 0x39>,
+		<0x6670 0x3b>,
+		<0x6674 0x47>,
+		<0x6678 0x4d>,
+		<0x667c 0x53>,
+		<0x6680 0x59>,
+		<0x6684 0x65>,
+		<0x67a0 0x0>,
+		<0x67a4 0x0>,
+		<0x67a8 0x16>,
+		<0x67b0 0x0>,
+		<0x67b4 0x3>,
+		<0x67b8 0x1c3>,
+		<0x67d0 0x10>,
+		<0x67dc 0x8>,
+		<0x67e0 0x10>,
+		<0x6800 0x0>,
+		<0x6804 0x1>,
+		<0x6808 0x2>,
+		<0x680c 0x3>,
+		<0x6810 0x4>,
+		<0x6814 0x5>,
+		<0x6818 0x0>,
+		<0x681c 0x0>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x6b18 0xff>,
+		<0x6b24 0x204>,
+		<0x6b28 0x10a00>,
+		<0x6b30 0x500>,
+		<0x678c 0x8>,
+		<0x6794 0x2f>;
+};
+
+&lpass_q6_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x67a0 0x0>,
+		<0x67a4 0x0>,
+		<0x67a8 0x20>,
+		<0x67b0 0x0>,
+		<0x67b4 0x8>,
+		<0x67b8 0xc8>,
+		<0x67d0 0x4>,
+		<0x67dc 0x8>,
+		<0x67e0 0x8>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x6b18 0xffff>,
+		<0x6b24 0x202>,
+		<0x6b28 0x10a00>,
+		<0x6b30 0x500>,
+		<0x6784 0x0>,
+		<0x678c 0x10>;
+};
+
+&anoc0_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6070 0x8>,
+		<0x6074 0x30>,
+		<0x6078 0x40>,
+		<0x6170 0x0>,
+		<0x6174 0x3>,
+		<0x6178 0x5>,
+		<0x6270 0x0>,
+		<0x6274 0x0>,
+		<0x6278 0x0>,
+		<0x6470 0x0>,
+		<0x6474 0x2>,
+		<0x6478 0x4>,
+		<0x6570 0x6>,
+		<0x6574 0x12>,
+		<0x6578 0x1c>,
+		<0x6670 0x26>,
+		<0x6674 0x30>,
+		<0x6678 0x40>,
+		<0x67a0 0x0>,
+		<0x67a4 0x58>,
+		<0x67a8 0x60>,
+		<0x67b0 0x0>,
+		<0x67b4 0x6>,
+		<0x67b8 0x86>,
+		<0x67d0 0x0>,
+		<0x67dc 0x4>,
+		<0x67e0 0x4>,
+		<0x6800 0x0>,
+		<0x6804 0x1>,
+		<0x6808 0x2>,
+		<0x680c 0x0>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x6784 0x0>,
+		<0x678c 0x10>;
+};
+
+&anoc1_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6070 0x6>,
+		<0x6074 0x8>,
+		<0x6078 0xb>,
+		<0x607c 0x4b>,
+		<0x6170 0x0>,
+		<0x6174 0x1>,
+		<0x6178 0x2>,
+		<0x617c 0x5>,
+		<0x6270 0x0>,
+		<0x6274 0x0>,
+		<0x6278 0x0>,
+		<0x627c 0x0>,
+		<0x6470 0x0>,
+		<0x6474 0x2>,
+		<0x6478 0x2>,
+		<0x647c 0x4>,
+		<0x6570 0x4>,
+		<0x6574 0x6>,
+		<0x6578 0x7>,
+		<0x657c 0xd>,
+		<0x6670 0xe>,
+		<0x6674 0x12>,
+		<0x6678 0x15>,
+		<0x667c 0x1f>,
+		<0x67a0 0x0>,
+		<0x67a4 0x4a>,
+		<0x67a8 0x50>,
+		<0x67b0 0x0>,
+		<0x67b4 0x4>,
+		<0x67b8 0x2c>,
+		<0x67d0 0x0>,
+		<0x67dc 0x4>,
+		<0x67e0 0x8>,
+		<0x6800 0x2>,
+		<0x6804 0x2>,
+		<0x6808 0x0>,
+		<0x680c 0x0>,
+		<0x6810 0x3>,
+		<0x6814 0x3>,
+		<0x6818 0x1>,
+		<0x681c 0x0>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>;
+};
+
+&anoc2_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6070 0x13>,
+		<0x6074 0x1b>,
+		<0x6078 0x1f>,
+		<0x607c 0x55>,
+		<0x6080 0x58>,
+		<0x6084 0x78>,
+		<0x6088 0x80>,
+		<0x6170 0x0>,
+		<0x6174 0x0>,
+		<0x6178 0x0>,
+		<0x617c 0xe>,
+		<0x6180 0xf>,
+		<0x6184 0x10>,
+		<0x6188 0x11>,
+		<0x6270 0x0>,
+		<0x6274 0x0>,
+		<0x6278 0x0>,
+		<0x627c 0x0>,
+		<0x6280 0x0>,
+		<0x6284 0x0>,
+		<0x6288 0x0>,
+		<0x6470 0x0>,
+		<0x6474 0x2>,
+		<0x6478 0x2>,
+		<0x647c 0x6>,
+		<0x6480 0x6>,
+		<0x6484 0x8>,
+		<0x6488 0x8>,
+		<0x6570 0xc>,
+		<0x6574 0xe>,
+		<0x6578 0x16>,
+		<0x657c 0x1a>,
+		<0x6580 0x1d>,
+		<0x6584 0x21>,
+		<0x6588 0x23>,
+		<0x6670 0x27>,
+		<0x6674 0x2f>,
+		<0x6678 0x3f>,
+		<0x667c 0x47>,
+		<0x6680 0x4c>,
+		<0x6684 0x54>,
+		<0x6688 0x58>,
+		<0x67a0 0x0>,
+		<0x67a4 0x8d>,
+		<0x67a8 0xa0>,
+		<0x67b0 0x0>,
+		<0x67b4 0xc>,
+		<0x67b8 0x78>,
+		<0x67d0 0x0>,
+		<0x67dc 0x4>,
+		<0x67e0 0x8>,
+		<0x6800 0x0>,
+		<0x6804 0x0>,
+		<0x6808 0x1>,
+		<0x680c 0x1>,
+		<0x6810 0x0>,
+		<0x6814 0x0>,
+		<0x6818 0x1>,
+		<0x681c 0x1>,
+		<0x6820 0x3>,
+		<0x6824 0x2>,
+		<0x6828 0x5>,
+		<0x682c 0x4>,
+		<0x6830 0x6>,
+		<0x6834 0x6>,
+		<0x6838 0x0>,
+		<0x683c 0x0>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x678c 0xa>,
+		<0x6794 0x1a>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-arm-smmu-impl-defs-8996-v3.dtsi b/arch/arm64/boot/dts/qcom/msm-arm-smmu-impl-defs-8996-v3.dtsi
new file mode 100644
index 000000000000..d310f65f33c7
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-arm-smmu-impl-defs-8996-v3.dtsi
@@ -0,0 +1,646 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+&jpeg_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6070 0x30>,
+		<0x6074 0x30>,
+		<0x6078 0x30>,
+		<0x607c 0x30>,
+		<0x6080 0x30>,
+		<0x6084 0x30>,
+		<0x6088 0x30>,
+		<0x608c 0x30>,
+		<0x6170 0x24>,
+		<0x6174 0x26>,
+		<0x6178 0x28>,
+		<0x617c 0x2a>,
+		<0x6180 0x2c>,
+		<0x6184 0x2d>,
+		<0x6188 0x2e>,
+		<0x618c 0x2f>,
+		<0x6270 0x0>,
+		<0x6274 0x4>,
+		<0x6278 0xc>,
+		<0x627c 0xe>,
+		<0x6280 0x12>,
+		<0x6284 0x16>,
+		<0x6288 0x18>,
+		<0x628c 0x1c>,
+		<0x6470 0x0>,
+		<0x6474 0x1>,
+		<0x6478 0x1>,
+		<0x647c 0x1>,
+		<0x6480 0x2>,
+		<0x6484 0x2>,
+		<0x6488 0x3>,
+		<0x648c 0x3>,
+		<0x6570 0x3>,
+		<0x6574 0x5>,
+		<0x6578 0x7>,
+		<0x657c 0x9>,
+		<0x6580 0xb>,
+		<0x6584 0xd>,
+		<0x6588 0xf>,
+		<0x658c 0x11>,
+		<0x6670 0x13>,
+		<0x6674 0x16>,
+		<0x6678 0x1c>,
+		<0x667c 0x1e>,
+		<0x6680 0x21>,
+		<0x6684 0x24>,
+		<0x6688 0x26>,
+		<0x668c 0x2a>,
+		<0x67a0 0x0>,
+		<0x67a4 0x0>,
+		<0x67a8 0xc>,
+		<0x67b0 0x0>,
+		<0x67b4 0x3>,
+		<0x67b8 0x83>,
+		<0x67d0 0x10>,
+		<0x67dc 0x8>,
+		<0x67e0 0x10>,
+		<0x6800 0x0>,
+		<0x6804 0x1>,
+		<0x6808 0x2>,
+		<0x680c 0x3>,
+		<0x6810 0x4>,
+		<0x6814 0x5>,
+		<0x6818 0x6>,
+		<0x681c 0x7>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x6b18 0xff>,
+		<0x6b24 0x204>,
+		<0x6b28 0x10800>,
+		<0x6b30 0x400>,
+		<0x678c 0x6>,
+		<0x6794 0x24>;
+};
+
+&kgsl_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x6b18 0x3>,
+		<0x6b24 0x204>,
+		<0x6b28 0x11000>,
+		<0x6b30 0x800>,
+		<0x678c 0x8>,
+		<0x6794 0x28>;
+};
+
+&vfe_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6070 0x50>,
+		<0x6074 0x50>,
+		<0x6078 0x50>,
+		<0x607c 0x50>,
+		<0x6080 0x50>,
+		<0x6084 0x50>,
+		<0x6088 0x50>,
+		<0x608c 0x50>,
+		<0x6090 0x50>,
+		<0x6094 0x50>,
+		<0x6098 0x50>,
+		<0x609c 0x50>,
+		<0x60a0 0x50>,
+		<0x60a4 0x50>,
+		<0x60a8 0x50>,
+		<0x60ac 0x50>,
+		<0x6170 0x44>,
+		<0x6174 0x45>,
+		<0x6178 0x46>,
+		<0x617c 0x47>,
+		<0x6180 0x48>,
+		<0x6184 0x49>,
+		<0x6188 0x4a>,
+		<0x618c 0x4b>,
+		<0x6190 0x4c>,
+		<0x6194 0x4d>,
+		<0x6198 0x4e>,
+		<0x619c 0x4f>,
+		<0x61a0 0x50>,
+		<0x61a4 0x50>,
+		<0x61a8 0x50>,
+		<0x61ac 0x50>,
+		<0x6270 0x0>,
+		<0x6274 0x14>,
+		<0x6278 0x16>,
+		<0x627c 0x18>,
+		<0x6280 0x1a>,
+		<0x6284 0x1c>,
+		<0x6288 0x1e>,
+		<0x628c 0x20>,
+		<0x6290 0x22>,
+		<0x6294 0x36>,
+		<0x6298 0x38>,
+		<0x629c 0x3a>,
+		<0x62a0 0x3c>,
+		<0x62a4 0x3e>,
+		<0x62a8 0x40>,
+		<0x62ac 0x42>,
+		<0x6470 0x0>,
+		<0x6474 0x1>,
+		<0x6478 0x2>,
+		<0x647c 0x3>,
+		<0x6480 0x4>,
+		<0x6484 0x4>,
+		<0x6488 0x4>,
+		<0x648c 0x4>,
+		<0x6490 0x4>,
+		<0x6494 0x5>,
+		<0x6498 0x6>,
+		<0x649c 0x7>,
+		<0x64a0 0x8>,
+		<0x64a4 0x8>,
+		<0x64a8 0x8>,
+		<0x64ac 0x8>,
+		<0x6570 0x8>,
+		<0x6574 0xb>,
+		<0x6578 0xe>,
+		<0x657c 0x11>,
+		<0x6580 0x13>,
+		<0x6584 0x15>,
+		<0x6588 0x17>,
+		<0x658c 0x19>,
+		<0x6590 0x1b>,
+		<0x6594 0x1e>,
+		<0x6598 0x21>,
+		<0x659c 0x24>,
+		<0x65a0 0x26>,
+		<0x65a4 0x28>,
+		<0x65a8 0x2a>,
+		<0x65ac 0x2c>,
+		<0x6670 0x2e>,
+		<0x6674 0x38>,
+		<0x6678 0x39>,
+		<0x667c 0x3a>,
+		<0x6680 0x3b>,
+		<0x6684 0x3c>,
+		<0x6688 0x3d>,
+		<0x668c 0x3e>,
+		<0x6690 0x3f>,
+		<0x6694 0x49>,
+		<0x6698 0x4a>,
+		<0x669c 0x4b>,
+		<0x66a0 0x4c>,
+		<0x66a4 0x4d>,
+		<0x66a8 0x4e>,
+		<0x66ac 0x4f>,
+		<0x67a0 0x0>,
+		<0x67a4 0x0>,
+		<0x67a8 0xc>,
+		<0x67b0 0x0>,
+		<0x67b4 0x8>,
+		<0x67b8 0x138>,
+		<0x67d0 0x10>,
+		<0x67dc 0x8>,
+		<0x67e0 0x10>,
+		<0x6800 0x0>,
+		<0x6804 0x1>,
+		<0x6808 0x2>,
+		<0x680c 0x3>,
+		<0x6810 0x4>,
+		<0x6814 0x5>,
+		<0x6818 0x6>,
+		<0x681c 0x7>,
+		<0x6820 0x8>,
+		<0x6824 0x9>,
+		<0x6828 0xa>,
+		<0x682c 0xb>,
+		<0x6830 0xc>,
+		<0x6834 0xd>,
+		<0x6838 0xe>,
+		<0x683c 0xf>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x6b18 0xffff>,
+		<0x6b24 0x204>,
+		<0x6b28 0x10a00>,
+		<0x6b30 0x500>,
+		<0x678c 0xb>,
+		<0x6794 0x2f>;
+};
+
+&venus_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6070 0x110>,
+		<0x6074 0x110>,
+		<0x6078 0x110>,
+		<0x607c 0x110>,
+		<0x6080 0x110>,
+		<0x6084 0x110>,
+		<0x6088 0x110>,
+		<0x608c 0x110>,
+		<0x6170 0xe1>,
+		<0x6174 0xe5>,
+		<0x6178 0xfc>,
+		<0x617c 0x100>,
+		<0x6180 0x104>,
+		<0x6184 0x108>,
+		<0x6188 0x10c>,
+		<0x618c 0x10e>,
+		<0x6270 0x0>,
+		<0x6274 0x8>,
+		<0x6278 0x28>,
+		<0x627c 0x69>,
+		<0x6280 0x8d>,
+		<0x6284 0xa5>,
+		<0x6288 0xc9>,
+		<0x628c 0xd9>,
+		<0x6470 0x0>,
+		<0x6474 0x0>,
+		<0x6478 0x0>,
+		<0x647c 0x0>,
+		<0x6480 0x0>,
+		<0x6484 0x0>,
+		<0x6488 0x0>,
+		<0x648c 0x0>,
+		<0x6570 0x0>,
+		<0x6574 0x4>,
+		<0x6578 0x1c>,
+		<0x657c 0x21>,
+		<0x6580 0x26>,
+		<0x6584 0x2a>,
+		<0x6588 0x2e>,
+		<0x658c 0x30>,
+		<0x6670 0x32>,
+		<0x6674 0x36>,
+		<0x6678 0x46>,
+		<0x667c 0x58>,
+		<0x6680 0x62>,
+		<0x6684 0x6d>,
+		<0x6688 0x75>,
+		<0x668c 0x7d>,
+		<0x67a0 0x0>,
+		<0x67a4 0x0>,
+		<0x67a8 0x2f>,
+		<0x67b0 0x0>,
+		<0x67b4 0x0>,
+		<0x67b8 0x190>,
+		<0x67d0 0x8>,
+		<0x67dc 0x8>,
+		<0x67e0 0x8>,
+		<0x6800 0x0>,
+		<0x6804 0x1>,
+		<0x6808 0x2>,
+		<0x680c 0x3>,
+		<0x6810 0x4>,
+		<0x6814 0x5>,
+		<0x6818 0x6>,
+		<0x681c 0x7>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x6b18 0xff>,
+		<0x6b24 0x203>,
+		<0x6b28 0x10a00>,
+		<0x6b30 0x500>,
+		<0x678c 0x18>,
+		<0x6794 0x43>;
+};
+
+&mdp_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6070 0x70>,
+		<0x6074 0x70>,
+		<0x6170 0x52>,
+		<0x6174 0x68>,
+		<0x6270 0x0>,
+		<0x6274 0x3e>,
+		<0x6470 0x0>,
+		<0x6474 0x8>,
+		<0x6570 0x8>,
+		<0x6574 0x13>,
+		<0x6670 0x1e>,
+		<0x6674 0x5c>,
+		<0x67a0 0x0>,
+		<0x67a4 0x0>,
+		<0x67a8 0x1e>,
+		<0x67b0 0x0>,
+		<0x67b4 0x8>,
+		<0x67b8 0xb8>,
+		<0x67d0 0x10>,
+		<0x67dc 0x8>,
+		<0x67e0 0x10>,
+		<0x6800 0x0>,
+		<0x6804 0x1>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x678c 0x8>,
+		<0x6794 0x24>;
+};
+
+&rot_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6070 0xc0>,
+		<0x6074 0xc0>,
+		<0x6078 0xc0>,
+		<0x6170 0xae>,
+		<0x6174 0xb6>,
+		<0x6178 0xbe>,
+		<0x6270 0x0>,
+		<0x6274 0x52>,
+		<0x6278 0xa6>,
+		<0x6470 0x0>,
+		<0x6474 0x2>,
+		<0x6478 0x4>,
+		<0x6570 0x4>,
+		<0x6574 0xc>,
+		<0x6578 0x15>,
+		<0x6670 0x19>,
+		<0x6674 0x42>,
+		<0x6678 0x6c>,
+		<0x67a0 0x0>,
+		<0x67a4 0x0>,
+		<0x67a8 0x12>,
+		<0x67b0 0x0>,
+		<0x67b4 0x4>,
+		<0x67b8 0xac>,
+		<0x67d0 0x10>,
+		<0x67dc 0x8>,
+		<0x67e0 0x10>,
+		<0x6800 0x0>,
+		<0x6804 0x2>,
+		<0x6808 0x1>,
+		<0x680c 0x2>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x6b18 0xf>,
+		<0x6b24 0x204>,
+		<0x6b28 0x10a00>,
+		<0x6b30 0x500>,
+		<0x678c 0xc>,
+		<0x6794 0x44>;
+};
+
+&cpp_fd_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6070 0xa0>,
+		<0x6074 0xa0>,
+		<0x6078 0xa0>,
+		<0x607c 0xa0>,
+		<0x6080 0xa0>,
+		<0x6084 0xa0>,
+		<0x6170 0x8a>,
+		<0x6174 0x8e>,
+		<0x6178 0x92>,
+		<0x617c 0x96>,
+		<0x6180 0x9a>,
+		<0x6184 0x9d>,
+		<0x6270 0x0>,
+		<0x6274 0x18>,
+		<0x6278 0x24>,
+		<0x627c 0x30>,
+		<0x6280 0x3c>,
+		<0x6284 0x54>,
+		<0x6470 0x0>,
+		<0x6474 0x0>,
+		<0x6478 0x1>,
+		<0x647c 0x2>,
+		<0x6480 0x2>,
+		<0x6484 0x2>,
+		<0x6570 0x3>,
+		<0x6574 0x12>,
+		<0x6578 0x1a>,
+		<0x657c 0x22>,
+		<0x6580 0x2a>,
+		<0x6584 0x39>,
+		<0x6670 0x3b>,
+		<0x6674 0x47>,
+		<0x6678 0x4d>,
+		<0x667c 0x53>,
+		<0x6680 0x59>,
+		<0x6684 0x65>,
+		<0x67a0 0x0>,
+		<0x67a4 0x0>,
+		<0x67a8 0x16>,
+		<0x67b0 0x0>,
+		<0x67b4 0x3>,
+		<0x67b8 0x1c3>,
+		<0x67d0 0x10>,
+		<0x67dc 0x8>,
+		<0x67e0 0x10>,
+		<0x6800 0x0>,
+		<0x6804 0x1>,
+		<0x6808 0x2>,
+		<0x680c 0x3>,
+		<0x6810 0x4>,
+		<0x6814 0x5>,
+		<0x6818 0x0>,
+		<0x681c 0x0>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x6b18 0xff>,
+		<0x6b24 0x204>,
+		<0x6b28 0x10a00>,
+		<0x6b30 0x500>,
+		<0x678c 0x8>,
+		<0x6794 0x2f>;
+};
+
+&lpass_q6_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x67a0 0x0>,
+		<0x67a4 0x0>,
+		<0x67a8 0x20>,
+		<0x67b0 0x0>,
+		<0x67b4 0x8>,
+		<0x67b8 0xc8>,
+		<0x67d0 0x4>,
+		<0x67dc 0x8>,
+		<0x67e0 0x8>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x6b18 0xffff>,
+		<0x6b24 0x202>,
+		<0x6b28 0x10a00>,
+		<0x6b30 0x500>,
+		<0x6784 0x0>,
+		<0x678c 0x10>;
+};
+
+&anoc0_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6070 0x8>,
+		<0x6074 0x30>,
+		<0x6078 0x40>,
+		<0x6170 0x0>,
+		<0x6174 0x3>,
+		<0x6178 0x5>,
+		<0x6270 0x0>,
+		<0x6274 0x0>,
+		<0x6278 0x0>,
+		<0x6470 0x0>,
+		<0x6474 0x2>,
+		<0x6478 0x4>,
+		<0x6570 0x6>,
+		<0x6574 0x12>,
+		<0x6578 0x1c>,
+		<0x6670 0x26>,
+		<0x6674 0x30>,
+		<0x6678 0x40>,
+		<0x67a0 0x0>,
+		<0x67a4 0x58>,
+		<0x67a8 0x60>,
+		<0x67b0 0x0>,
+		<0x67b4 0x6>,
+		<0x67b8 0x86>,
+		<0x67d0 0x0>,
+		<0x67dc 0x4>,
+		<0x67e0 0x4>,
+		<0x6800 0x0>,
+		<0x6804 0x1>,
+		<0x6808 0x2>,
+		<0x680c 0x0>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x6d30 0x41bd>,
+		<0x6784 0x0>,
+		<0x678c 0x10>;
+};
+
+&anoc1_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6070 0x6>,
+		<0x6074 0x8>,
+		<0x6078 0xb>,
+		<0x607c 0x4b>,
+		<0x6170 0x0>,
+		<0x6174 0x1>,
+		<0x6178 0x2>,
+		<0x617c 0x5>,
+		<0x6270 0x0>,
+		<0x6274 0x0>,
+		<0x6278 0x0>,
+		<0x627c 0x0>,
+		<0x6470 0x0>,
+		<0x6474 0x2>,
+		<0x6478 0x2>,
+		<0x647c 0x4>,
+		<0x6570 0x4>,
+		<0x6574 0x6>,
+		<0x6578 0x7>,
+		<0x657c 0xd>,
+		<0x6670 0xe>,
+		<0x6674 0x12>,
+		<0x6678 0x15>,
+		<0x667c 0x1f>,
+		<0x67a0 0x0>,
+		<0x67a4 0x4a>,
+		<0x67a8 0x50>,
+		<0x67b0 0x0>,
+		<0x67b4 0x4>,
+		<0x67b8 0x2c>,
+		<0x67d0 0x0>,
+		<0x67dc 0x4>,
+		<0x67e0 0x8>,
+		<0x6800 0x2>,
+		<0x6804 0x2>,
+		<0x6808 0x0>,
+		<0x680c 0x0>,
+		<0x6810 0x3>,
+		<0x6814 0x3>,
+		<0x6818 0x1>,
+		<0x681c 0x0>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x6d30 0x41bd>;
+};
+
+&anoc2_smmu {
+	attach-impl-defs = <0x6000 0x70>,
+		<0x6060 0x1055>,
+		<0x6070 0x13>,
+		<0x6074 0x1b>,
+		<0x6078 0x1f>,
+		<0x607c 0x55>,
+		<0x6080 0x58>,
+		<0x6084 0x78>,
+		<0x6088 0x80>,
+		<0x6170 0x0>,
+		<0x6174 0x0>,
+		<0x6178 0x0>,
+		<0x617c 0xe>,
+		<0x6180 0xf>,
+		<0x6184 0x10>,
+		<0x6188 0x11>,
+		<0x6270 0x0>,
+		<0x6274 0x0>,
+		<0x6278 0x0>,
+		<0x627c 0x0>,
+		<0x6280 0x0>,
+		<0x6284 0x0>,
+		<0x6288 0x0>,
+		<0x6470 0x0>,
+		<0x6474 0x2>,
+		<0x6478 0x2>,
+		<0x647c 0x6>,
+		<0x6480 0x6>,
+		<0x6484 0x8>,
+		<0x6488 0x8>,
+		<0x6570 0xc>,
+		<0x6574 0xe>,
+		<0x6578 0x16>,
+		<0x657c 0x1a>,
+		<0x6580 0x1d>,
+		<0x6584 0x21>,
+		<0x6588 0x23>,
+		<0x6670 0x27>,
+		<0x6674 0x2f>,
+		<0x6678 0x3f>,
+		<0x667c 0x47>,
+		<0x6680 0x4c>,
+		<0x6684 0x54>,
+		<0x6688 0x58>,
+		<0x67a0 0x0>,
+		<0x67a4 0x8d>,
+		<0x67a8 0xa0>,
+		<0x67b0 0x0>,
+		<0x67b4 0xc>,
+		<0x67b8 0x78>,
+		<0x67d0 0x0>,
+		<0x67dc 0x4>,
+		<0x67e0 0x8>,
+		<0x6800 0x0>,
+		<0x6804 0x0>,
+		<0x6808 0x1>,
+		<0x680c 0x1>,
+		<0x6810 0x0>,
+		<0x6814 0x0>,
+		<0x6818 0x1>,
+		<0x681c 0x1>,
+		<0x6820 0x3>,
+		<0x6824 0x2>,
+		<0x6828 0x5>,
+		<0x682c 0x4>,
+		<0x6830 0x6>,
+		<0x6834 0x6>,
+		<0x6838 0x0>,
+		<0x683c 0x0>,
+		<0x6a00 0x6>,
+		<0x6b00 0x3ff>,
+		<0x6d30 0x41bd>,
+		<0x678c 0xa>,
+		<0x6794 0x1a>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-arm-smmu-impl-defs-8998.dtsi b/arch/arm64/boot/dts/qcom/msm-arm-smmu-impl-defs-8998.dtsi
new file mode 100644
index 000000000000..4fbf1e126842
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-arm-smmu-impl-defs-8998.dtsi
@@ -0,0 +1,565 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+&kgsl_smmu {
+	attach-impl-defs = <0x6000 0x2378>,
+		<0x6060 0x1055>,
+		<0x6470 0x110011>,
+		<0x6478 0x0>,
+		<0x647c 0x1000100>,
+		<0x6480 0x81108110>,
+		<0x6484 0x81108110>,
+		<0x6488 0x3e003e0>,
+		<0x648c 0x3e003e0>,
+		<0x6490 0x80008010>,
+		<0x6494 0x8020>,
+		<0x649c 0x6>,
+		<0x6800 0x6>,
+		<0x6900 0x3ff>,
+		<0x6924 0x604>,
+		<0x6928 0x11000>,
+		<0x6930 0x800>,
+		<0x6960 0x3>,
+		<0x6b64 0x1a5551>,
+		<0x6b68 0x2aaa2f82>;
+};
+
+&lpass_q6_smmu {
+	attach-impl-defs = <0x6000 0x3270>,
+		<0x6060 0x1055>,
+		<0x6070 0xe0>,
+		<0x6074 0xe0>,
+		<0x6078 0xe0>,
+		<0x607c 0xe0>,
+		<0x60f0 0xc0>,
+		<0x60f4 0xc8>,
+		<0x60f8 0xd0>,
+		<0x60fc 0xd8>,
+		<0x6170 0x0>,
+		<0x6174 0x30>,
+		<0x6178 0x60>,
+		<0x617c 0x90>,
+		<0x6270 0x0>,
+		<0x6274 0x2>,
+		<0x6278 0x4>,
+		<0x627c 0x6>,
+		<0x62f0 0x8>,
+		<0x62f4 0xe>,
+		<0x62f8 0x14>,
+		<0x62fc 0x1a>,
+		<0x6370 0x20>,
+		<0x6374 0x40>,
+		<0x6378 0x60>,
+		<0x637c 0x80>,
+		<0x67a0 0x0>,
+		<0x67a4 0x0>,
+		<0x67a8 0x20>,
+		<0x67b0 0x0>,
+		<0x67b4 0x8>,
+		<0x67b8 0xc8>,
+		<0x67d0 0x4>,
+		<0x67dc 0x8>,
+		<0x67e0 0x8>,
+		<0x6800 0x6>,
+		<0x6900 0x3ff>,
+		<0x6924 0x202>,
+		<0x6928 0x10a00>,
+		<0x6930 0x500>,
+		<0x6b64 0x121151>,
+		<0x6b68 0x8a840080>,
+		<0x6c00 0x0>,
+		<0x6c04 0x0>,
+		<0x6c08 0x0>,
+		<0x6c0c 0x0>,
+		<0x6c10 0x1>,
+		<0x6c14 0x1>,
+		<0x6c18 0x1>,
+		<0x6c1c 0x1>,
+		<0x6c20 0x2>,
+		<0x6c24 0x2>,
+		<0x6c28 0x2>,
+		<0x6c2c 0x2>,
+		<0x6c30 0x3>,
+		<0x6c34 0x3>,
+		<0x6c38 0x3>,
+		<0x6c3c 0x3>;
+};
+
+&mmss_smmu {
+	attach-impl-defs = <0x6000 0x3270>,
+		<0x6060 0x1055>,
+		<0x6800 0x6>,
+		<0x6900 0x3ff>,
+		<0x6924 0x204>,
+		<0x6928 0x11002>,
+		<0x6930 0x800>,
+		<0x6960 0xffffffff>,
+		<0x6964 0xffffffff>,
+		<0x6968 0xffffffff>,
+		<0x696c 0xffffffff>,
+		<0x6b48 0x330330>,
+		<0x6b4c 0x81>,
+		<0x6b50 0x3333>,
+		<0x6b54 0x3333>,
+		<0x6b64 0x1a5555>,
+		<0x6b68 0x9aaa892a>,
+		<0x6b70 0x10100002>,
+		<0x6b74 0x10100002>,
+		<0x6b78 0x10100002>,
+		<0x6b80 0x20042004>,
+		<0x6b84 0x20042004>;
+};
+
+&anoc1_smmu {
+	attach-impl-defs = <0x6000 0x3270>,
+		<0x6060 0x1055>,
+		<0x6070 0x19>,
+		<0x6074 0x39>,
+		<0x6078 0x41>,
+		<0x607c 0x59>,
+		<0x6080 0x95>,
+		<0x6084 0x98>,
+		<0x6088 0xc0>,
+		<0x608c 0xc0>,
+		<0x60f0 0x0>,
+		<0x60f4 0x2>,
+		<0x60f8 0x5>,
+		<0x60fc 0x8>,
+		<0x6100 0x16>,
+		<0x6104 0x17>,
+		<0x6108 0x19>,
+		<0x610c 0x19>,
+		<0x6170 0x0>,
+		<0x6174 0x0>,
+		<0x6178 0x0>,
+		<0x617c 0x0>,
+		<0x6180 0x0>,
+		<0x6184 0x0>,
+		<0x6188 0x0>,
+		<0x618c 0x0>,
+		<0x6270 0x0>,
+		<0x6274 0xd>,
+		<0x6278 0xe>,
+		<0x627c 0x12>,
+		<0x6280 0x16>,
+		<0x6284 0x16>,
+		<0x6288 0x18>,
+		<0x628c 0x18>,
+		<0x62f0 0x18>,
+		<0x62f4 0x1b>,
+		<0x62f8 0x1c>,
+		<0x62fc 0x24>,
+		<0x6300 0x28>,
+		<0x6304 0x2b>,
+		<0x6308 0x31>,
+		<0x630c 0x31>,
+		<0x6370 0x31>,
+		<0x6374 0x34>,
+		<0x6378 0x35>,
+		<0x637c 0x47>,
+		<0x6380 0x4f>,
+		<0x6384 0x54>,
+		<0x6388 0x60>,
+		<0x638c 0x60>,
+		<0x67a0 0x0>,
+		<0x67a4 0xa7>,
+		<0x67a8 0xc0>,
+		<0x67b0 0x0>,
+		<0x67b4 0x18>,
+		<0x67b8 0x7c>,
+		<0x67d0 0x0>,
+		<0x67dc 0x4>,
+		<0x67e0 0x8>,
+		<0x6800 0x6>,
+		<0x6900 0x3ff>,
+		<0x6b64 0x121151>,
+		<0x6b68 0xbb804080>,
+		<0x6c00 0x0>,
+		<0x6c04 0x0>,
+		<0x6c08 0x0>,
+		<0x6c0c 0x0>,
+		<0x6c10 0x0>,
+		<0x6c14 0x0>,
+		<0x6c18 0x0>,
+		<0x6c1c 0x0>,
+		<0x6c20 0x0>,
+		<0x6c24 0x0>,
+		<0x6c28 0x0>,
+		<0x6c2c 0x0>,
+		<0x6c30 0x0>,
+		<0x6c34 0x0>,
+		<0x6c38 0x0>,
+		<0x6c3c 0x0>,
+		<0x6c40 0x0>,
+		<0x6c44 0x0>,
+		<0x6c48 0x0>,
+		<0x6c4c 0x0>,
+		<0x6c50 0x0>,
+		<0x6c54 0x0>,
+		<0x6c58 0x0>,
+		<0x6c5c 0x0>,
+		<0x6c60 0x0>,
+		<0x6c64 0x0>,
+		<0x6c68 0x0>,
+		<0x6c6c 0x0>,
+		<0x6c70 0x0>,
+		<0x6c74 0x0>,
+		<0x6c78 0x0>,
+		<0x6c7c 0x0>,
+		<0x6c80 0x0>,
+		<0x6c84 0x1>,
+		<0x6c88 0x0>,
+		<0x6c8c 0x0>,
+		<0x6c90 0x4>,
+		<0x6c94 0x3>,
+		<0x6c98 0x2>,
+		<0x6c9c 0x0>,
+		<0x6ca0 0x5>,
+		<0x6ca4 0x5>,
+		<0x6ca8 0x0>,
+		<0x6cac 0x0>,
+		<0x6cb0 0x0>,
+		<0x6cb4 0x0>,
+		<0x6cb8 0x0>,
+		<0x6cbc 0x0>,
+		<0x6cc0 0x0>,
+		<0x6cc4 0x0>,
+		<0x6cc8 0x0>,
+		<0x6ccc 0x0>,
+		<0x6cd0 0x0>,
+		<0x6cd4 0x0>,
+		<0x6cd8 0x0>,
+		<0x6cdc 0x0>,
+		<0x6ce0 0x0>,
+		<0x6ce4 0x0>,
+		<0x6ce8 0x0>,
+		<0x6cec 0x0>,
+		<0x6cf0 0x0>,
+		<0x6cf4 0x0>,
+		<0x6cf8 0x0>,
+		<0x6cfc 0x0>,
+		<0x6d00 0x0>,
+		<0x6d04 0x0>,
+		<0x6d08 0x0>,
+		<0x6d0c 0x0>,
+		<0x6d10 0x0>,
+		<0x6d14 0x0>,
+		<0x6d18 0x0>,
+		<0x6d1c 0x0>,
+		<0x6d20 0x0>,
+		<0x6d24 0x0>,
+		<0x6d28 0x0>,
+		<0x6d2c 0x0>,
+		<0x6d30 0x0>,
+		<0x6d34 0x0>,
+		<0x6d38 0x0>,
+		<0x6d3c 0x0>,
+		<0x6d40 0x0>,
+		<0x6d44 0x0>,
+		<0x6d48 0x0>,
+		<0x6d4c 0x0>,
+		<0x6d50 0x0>,
+		<0x6d54 0x0>,
+		<0x6d58 0x0>,
+		<0x6d5c 0x0>,
+		<0x6d60 0x0>,
+		<0x6d64 0x0>,
+		<0x6d68 0x0>,
+		<0x6d6c 0x0>,
+		<0x6d70 0x0>,
+		<0x6d74 0x0>,
+		<0x6d78 0x0>,
+		<0x6d7c 0x0>,
+		<0x6d80 0x0>,
+		<0x6d84 0x0>,
+		<0x6d88 0x0>,
+		<0x6d8c 0x0>,
+		<0x6d90 0x0>,
+		<0x6d94 0x0>,
+		<0x6d98 0x0>,
+		<0x6d9c 0x0>,
+		<0x6da0 0x0>,
+		<0x6da4 0x0>,
+		<0x6da8 0x0>,
+		<0x6dac 0x0>,
+		<0x6db0 0x0>,
+		<0x6db4 0x0>,
+		<0x6db8 0x0>,
+		<0x6dbc 0x0>,
+		<0x6dc0 0x0>,
+		<0x6dc4 0x0>,
+		<0x6dc8 0x0>,
+		<0x6dcc 0x0>,
+		<0x6dd0 0x0>,
+		<0x6dd4 0x0>,
+		<0x6dd8 0x0>,
+		<0x6ddc 0x0>,
+		<0x6de0 0x0>,
+		<0x6de4 0x0>,
+		<0x6de8 0x0>,
+		<0x6dec 0x0>,
+		<0x6df0 0x0>,
+		<0x6df4 0x0>,
+		<0x6df8 0x0>,
+		<0x6dfc 0x0>;
+};
+
+&anoc2_smmu {
+	attach-impl-defs = <0x6000 0x3270>,
+		<0x6060 0x1055>,
+		<0x6070 0x12>,
+		<0x6074 0x26>,
+		<0x6078 0x3a>,
+		<0x607c 0x3c>,
+		<0x6080 0x3f>,
+		<0x6084 0x67>,
+		<0x6088 0x6c>,
+		<0x608c 0x74>,
+		<0x6090 0x7c>,
+		<0x6094 0x80>,
+		<0x6098 0xa0>,
+		<0x609c 0xa0>,
+		<0x60a0 0xa0>,
+		<0x60a4 0xa0>,
+		<0x60a8 0xa0>,
+		<0x60ac 0xa0>,
+		<0x60f0 0x0>,
+		<0x60f4 0x1>,
+		<0x60f8 0x3>,
+		<0x60fc 0x4>,
+		<0x6100 0x5>,
+		<0x6104 0x7>,
+		<0x6108 0x8>,
+		<0x610c 0x10>,
+		<0x6110 0x10>,
+		<0x6114 0x10>,
+		<0x6118 0x12>,
+		<0x611c 0x12>,
+		<0x6120 0x12>,
+		<0x6124 0x12>,
+		<0x6128 0x12>,
+		<0x612c 0x12>,
+		<0x6170 0x0>,
+		<0x6174 0x0>,
+		<0x6178 0x0>,
+		<0x617c 0x0>,
+		<0x6180 0x0>,
+		<0x6184 0x0>,
+		<0x6188 0x0>,
+		<0x618c 0x0>,
+		<0x6190 0x0>,
+		<0x6194 0x0>,
+		<0x6198 0x0>,
+		<0x619c 0x0>,
+		<0x61a0 0x0>,
+		<0x61a4 0x0>,
+		<0x61a8 0x0>,
+		<0x61ac 0x0>,
+		<0x6270 0x0>,
+		<0x6274 0x1>,
+		<0x6278 0x2>,
+		<0x627c 0x4>,
+		<0x6280 0x4>,
+		<0x6284 0x6>,
+		<0x6288 0x6>,
+		<0x628c 0x18>,
+		<0x6290 0x1a>,
+		<0x6294 0x1a>,
+		<0x6298 0x1e>,
+		<0x629c 0x1e>,
+		<0x62a0 0x1e>,
+		<0x62a4 0x1e>,
+		<0x62a8 0x1e>,
+		<0x62ac 0x1e>,
+		<0x62f0 0x1e>,
+		<0x62f4 0x24>,
+		<0x62f8 0x2a>,
+		<0x62fc 0x2c>,
+		<0x6300 0x2d>,
+		<0x6304 0x33>,
+		<0x6308 0x34>,
+		<0x630c 0x3a>,
+		<0x6310 0x3c>,
+		<0x6314 0x44>,
+		<0x6318 0x48>,
+		<0x631c 0x48>,
+		<0x6320 0x48>,
+		<0x6324 0x48>,
+		<0x6328 0x48>,
+		<0x632c 0x48>,
+		<0x6370 0x48>,
+		<0x6374 0x4d>,
+		<0x6378 0x52>,
+		<0x637c 0x56>,
+		<0x6380 0x59>,
+		<0x6384 0x63>,
+		<0x6388 0x68>,
+		<0x638c 0x70>,
+		<0x6390 0x78>,
+		<0x6394 0x88>,
+		<0x6398 0x90>,
+		<0x639c 0x90>,
+		<0x63a0 0x90>,
+		<0x63a4 0x90>,
+		<0x63a8 0x90>,
+		<0x63ac 0x90>,
+		<0x67a0 0x0>,
+		<0x67a4 0x8e>,
+		<0x67a8 0xa0>,
+		<0x67b0 0x0>,
+		<0x67b4 0x1e>,
+		<0x67b8 0xc6>,
+		<0x67d0 0x0>,
+		<0x67dc 0x4>,
+		<0x67e0 0x8>,
+		<0x6800 0x6>,
+		<0x6900 0x3ff>,
+		<0x6b48 0x330331>,
+		<0x6b4c 0x81>,
+		<0x6b50 0x1313>,
+		<0x6b64 0x121155>,
+		<0x6b68 0xea880920>,
+		<0x6b70 0x10100101>,
+		<0x6b74 0xc0c0000>,
+		<0x6b78 0xc0c0000>,
+		<0x6b80 0x20012001>,
+		<0x6b84 0x20012001>,
+		<0x6c00 0x5>,
+		<0x6c04 0x0>,
+		<0x6c08 0x5>,
+		<0x6c0c 0x0>,
+		<0x6c10 0x5>,
+		<0x6c14 0x0>,
+		<0x6c18 0x5>,
+		<0x6c1c 0x0>,
+		<0x6c20 0x5>,
+		<0x6c24 0x0>,
+		<0x6c28 0x0>,
+		<0x6c2c 0x0>,
+		<0x6c30 0x0>,
+		<0x6c34 0x0>,
+		<0x6c38 0x0>,
+		<0x6c3c 0x0>,
+		<0x6c40 0x0>,
+		<0x6c44 0x0>,
+		<0x6c48 0x0>,
+		<0x6c4c 0x0>,
+		<0x6c50 0x0>,
+		<0x6c54 0x0>,
+		<0x6c58 0x0>,
+		<0x6c5c 0x0>,
+		<0x6c60 0x0>,
+		<0x6c64 0x0>,
+		<0x6c68 0x0>,
+		<0x6c6c 0x0>,
+		<0x6c70 0x0>,
+		<0x6c74 0x0>,
+		<0x6c78 0x0>,
+		<0x6c7c 0x0>,
+		<0x6c80 0x0>,
+		<0x6c84 0x0>,
+		<0x6c88 0x0>,
+		<0x6c8c 0x0>,
+		<0x6c90 0x0>,
+		<0x6c94 0x0>,
+		<0x6c98 0x0>,
+		<0x6c9c 0x0>,
+		<0x6ca0 0x0>,
+		<0x6ca4 0x0>,
+		<0x6ca8 0x0>,
+		<0x6cac 0x0>,
+		<0x6cb0 0x0>,
+		<0x6cb4 0x0>,
+		<0x6cb8 0x0>,
+		<0x6cbc 0x0>,
+		<0x6cc0 0x0>,
+		<0x6cc4 0x0>,
+		<0x6cc8 0x0>,
+		<0x6ccc 0x0>,
+		<0x6cd0 0x0>,
+		<0x6cd4 0x0>,
+		<0x6cd8 0x0>,
+		<0x6cdc 0x0>,
+		<0x6ce0 0x0>,
+		<0x6ce4 0x0>,
+		<0x6ce8 0x0>,
+		<0x6cec 0x0>,
+		<0x6cf0 0x0>,
+		<0x6cf4 0x0>,
+		<0x6cf8 0x0>,
+		<0x6cfc 0x0>,
+		<0x6d00 0x8>,
+		<0x6d04 0x0>,
+		<0x6d08 0x8>,
+		<0x6d0c 0x0>,
+		<0x6d10 0x7>,
+		<0x6d14 0x0>,
+		<0x6d18 0x3>,
+		<0x6d1c 0x2>,
+		<0x6d20 0x4>,
+		<0x6d24 0x0>,
+		<0x6d28 0x4>,
+		<0x6d2c 0x0>,
+		<0x6d30 0x6>,
+		<0x6d34 0x0>,
+		<0x6d38 0x9>,
+		<0x6d3c 0x0>,
+		<0x6d40 0x0>,
+		<0x6d44 0x1>,
+		<0x6d48 0x4>,
+		<0x6d4c 0x0>,
+		<0x6d50 0x4>,
+		<0x6d54 0x0>,
+		<0x6d58 0x0>,
+		<0x6d5c 0x0>,
+		<0x6d60 0x0>,
+		<0x6d64 0x0>,
+		<0x6d68 0x0>,
+		<0x6d6c 0x0>,
+		<0x6d70 0x0>,
+		<0x6d74 0x0>,
+		<0x6d78 0x0>,
+		<0x6d7c 0x0>,
+		<0x6d80 0x0>,
+		<0x6d84 0x0>,
+		<0x6d88 0x0>,
+		<0x6d8c 0x0>,
+		<0x6d90 0x0>,
+		<0x6d94 0x0>,
+		<0x6d98 0x0>,
+		<0x6d9c 0x0>,
+		<0x6da0 0x0>,
+		<0x6da4 0x0>,
+		<0x6da8 0x0>,
+		<0x6dac 0x0>,
+		<0x6db0 0x0>,
+		<0x6db4 0x0>,
+		<0x6db8 0x0>,
+		<0x6dbc 0x0>,
+		<0x6dc0 0x0>,
+		<0x6dc4 0x0>,
+		<0x6dc8 0x0>,
+		<0x6dcc 0x0>,
+		<0x6dd0 0x0>,
+		<0x6dd4 0x0>,
+		<0x6dd8 0x0>,
+		<0x6ddc 0x0>,
+		<0x6de0 0x0>,
+		<0x6de4 0x0>,
+		<0x6de8 0x0>,
+		<0x6dec 0x0>,
+		<0x6df0 0x0>,
+		<0x6df4 0x0>,
+		<0x6df8 0x0>,
+		<0x6dfc 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-arm-smmu.dtsi b/arch/arm64/boot/dts/qcom/msm-arm-smmu.dtsi
new file mode 100644
index 000000000000..7c1cd3d26112
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-arm-smmu.dtsi
@@ -0,0 +1,99 @@
+/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	jpeg_smmu: arm,smmu-jpeg@d80000 {
+		status = "disabled";
+		compatible = "qcom,smmu-v2";
+		qcom,tz-device-id = "JPEG";
+		reg = <0xd80000 0x10000>;
+		#iommu-cells = <1>;
+	};
+
+	kgsl_smmu: arm,smmu-kgsl@b40000 {
+		status = "disabled";
+		compatible = "qcom,smmu-v2";
+		qcom,tz-device-id = "GPU";
+		qcom,dynamic;
+		reg = <0xb40000 0x10000>;
+		#iommu-cells = <1>;
+	};
+
+	vfe_smmu: arm,smmu-vfe@da0000 {
+		status = "disabled";
+		compatible = "qcom,smmu-v2";
+		qcom,tz-device-id = "VFE";
+		reg = <0xda0000 0x10000>;
+		#iommu-cells = <1>;
+	};
+
+	venus_smmu: arm,smmu-venus@d40000 {
+		status = "disabled";
+		compatible = "qcom,smmu-v2";
+		qcom,tz-device-id = "VIDEO";
+		reg = <0xd40000 0x20000>;
+		#iommu-cells = <1>;
+	};
+
+	mdp_smmu: arm,smmu-mdp@d00000 {
+		status = "disabled";
+		compatible = "qcom,smmu-v2";
+		qcom,tz-device-id = "MDSS";
+		reg = <0xd00000 0x10000>;
+		#iommu-cells = <1>;
+	};
+
+	rot_smmu: arm,smmu-rot@d20000 {
+		status = "disabled";
+		compatible = "qcom,smmu-v2";
+		qcom,tz-device-id = "ROT";
+		reg = <0xd20000 0x10000>;
+		#iommu-cells = <1>;
+	};
+
+	cpp_fd_smmu: arm,smmu-cpp_fd@d60000 {
+		status = "disabled";
+		compatible = "qcom,smmu-v2";
+		qcom,tz-device-id = "CPP";
+		reg = <0xd60000 0x10000>;
+		#iommu-cells = <1>;
+	};
+
+	lpass_q6_smmu: arm,smmu-lpass_q6@1600000 {
+		status = "disabled";
+		compatible = "qcom,smmu-v2";
+		qcom,tz-device-id = "LPASS";
+		reg = <0x1600000 0x20000>;
+		#iommu-cells = <1>;
+	};
+
+	anoc0_smmu: arm,smmu-anoc0@1640000 {
+		status = "disabled";
+		compatible = "qcom,smmu-v2";
+		reg = <0x1640000 0x10000>;
+		#iommu-cells = <1>;
+	};
+
+	anoc1_smmu: arm,smmu-anoc1@1660000 {
+		status = "disabled";
+		compatible = "qcom,smmu-v2";
+		reg = <0x1660000 0x10000>;
+		#iommu-cells = <1>;
+	};
+
+	anoc2_smmu: arm,smmu-anoc2@1680000 {
+		status = "disabled";
+		compatible = "qcom,smmu-v2";
+		reg = <0x1680000 0x20000>;
+		#iommu-cells = <1>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-audio-lpass.dtsi b/arch/arm64/boot/dts/qcom/msm-audio-lpass.dtsi
new file mode 100644
index 000000000000..7fce7606720c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-audio-lpass.dtsi
@@ -0,0 +1,529 @@
+/*
+ * Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+
+	pcm0: qcom,msm-pcm {
+		compatible = "qcom,msm-pcm-dsp";
+		qcom,msm-pcm-dsp-id = <0>;
+	};
+
+	routing: qcom,msm-pcm-routing {
+		compatible = "qcom,msm-pcm-routing";
+	};
+
+	compr: qcom,msm-compr-dsp {
+		compatible = "qcom,msm-compr-dsp";
+	};
+
+	pcm1: qcom,msm-pcm-low-latency {
+		compatible = "qcom,msm-pcm-dsp";
+		qcom,msm-pcm-dsp-id = <1>;
+		qcom,msm-pcm-low-latency;
+		qcom,latency-level = "regular";
+	};
+
+	pcm2: qcom,msm-ultra-low-latency {
+		compatible = "qcom,msm-pcm-dsp";
+		qcom,msm-pcm-dsp-id = <2>;
+		qcom,msm-pcm-low-latency;
+		qcom,latency-level = "ultra";
+	};
+
+	pcm_noirq: qcom,msm-pcm-dsp-noirq {
+		compatible = "qcom,msm-pcm-dsp-noirq";
+		qcom,msm-pcm-low-latency;
+		qcom,latency-level = "ultra";
+	};
+
+	compress: qcom,msm-compress-dsp {
+		compatible = "qcom,msm-compress-dsp";
+	};
+
+	voip: qcom,msm-voip-dsp {
+		compatible = "qcom,msm-voip-dsp";
+	};
+
+	voice: qcom,msm-pcm-voice {
+		compatible = "qcom,msm-pcm-voice";
+		qcom,destroy-cvd;
+	};
+
+	stub_codec: qcom,msm-stub-codec {
+		compatible = "qcom,msm-stub-codec";
+	};
+
+	qcom,msm-dai-fe {
+		compatible = "qcom,msm-dai-fe";
+	};
+
+	afe: qcom,msm-pcm-afe {
+		compatible = "qcom,msm-pcm-afe";
+	};
+
+	dai_hdmi: qcom,msm-dai-q6-hdmi {
+		compatible = "qcom,msm-dai-q6-hdmi";
+		qcom,msm-dai-q6-dev-id = <8>;
+	};
+
+	dai_dp: qcom,msm-dai-q6-dp {
+		compatible = "qcom,msm-dai-q6-hdmi";
+		qcom,msm-dai-q6-dev-id = <24608>;
+	};
+
+	loopback: qcom,msm-pcm-loopback {
+		compatible = "qcom,msm-pcm-loopback";
+	};
+
+	trans_loopback: qcom,msm-transcode-loopback {
+		compatible = "qcom,msm-transcode-loopback";
+	};
+
+	qcom,msm-dai-mi2s {
+		compatible = "qcom,msm-dai-mi2s";
+		dai_mi2s0: qcom,msm-dai-q6-mi2s-prim {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <0>;
+			qcom,msm-mi2s-rx-lines = <3>;
+			qcom,msm-mi2s-tx-lines = <0>;
+		};
+
+		dai_mi2s1: qcom,msm-dai-q6-mi2s-sec {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <1>;
+			qcom,msm-mi2s-rx-lines = <1>;
+			qcom,msm-mi2s-tx-lines = <0>;
+		};
+
+		dai_mi2s2: qcom,msm-dai-q6-mi2s-tert {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <2>;
+			qcom,msm-mi2s-rx-lines = <0>;
+			qcom,msm-mi2s-tx-lines = <3>;
+		};
+
+		dai_mi2s3: qcom,msm-dai-q6-mi2s-quat {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <3>;
+			qcom,msm-mi2s-rx-lines = <1>;
+			qcom,msm-mi2s-tx-lines = <2>;
+		};
+
+		dai_mi2s4: qcom,msm-dai-q6-mi2s-quin {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <5>;
+			qcom,msm-mi2s-rx-lines = <1>;
+			qcom,msm-mi2s-tx-lines = <2>;
+		};
+
+		dai_mi2s5: qcom,msm-dai-q6-mi2s-senary {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <6>;
+			qcom,msm-mi2s-rx-lines = <0>;
+			qcom,msm-mi2s-tx-lines = <3>;
+		};
+	};
+
+	lsm: qcom,msm-lsm-client {
+		compatible = "qcom,msm-lsm-client";
+	};
+
+	qcom,msm-dai-q6 {
+		compatible = "qcom,msm-dai-q6";
+		sb_0_rx: qcom,msm-dai-q6-sb-0-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16384>;
+		};
+
+		sb_0_tx: qcom,msm-dai-q6-sb-0-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16385>;
+		};
+
+		sb_1_rx: qcom,msm-dai-q6-sb-1-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16386>;
+		};
+
+		sb_1_tx: qcom,msm-dai-q6-sb-1-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16387>;
+		};
+
+		sb_2_rx: qcom,msm-dai-q6-sb-2-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16388>;
+		};
+
+		sb_2_tx: qcom,msm-dai-q6-sb-2-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16389>;
+		};
+
+
+		sb_3_rx: qcom,msm-dai-q6-sb-3-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16390>;
+		};
+
+		sb_3_tx: qcom,msm-dai-q6-sb-3-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16391>;
+		};
+
+		sb_4_rx: qcom,msm-dai-q6-sb-4-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16392>;
+		};
+
+		sb_4_tx: qcom,msm-dai-q6-sb-4-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16393>;
+		};
+
+		sb_5_tx: qcom,msm-dai-q6-sb-5-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16395>;
+		};
+
+		sb_5_rx: qcom,msm-dai-q6-sb-5-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16394>;
+		};
+
+		sb_6_rx: qcom,msm-dai-q6-sb-6-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16396>;
+		};
+
+		sb_7_rx: qcom,msm-dai-q6-sb-7-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16398>;
+		};
+
+		sb_7_tx: qcom,msm-dai-q6-sb-7-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16399>;
+		};
+
+		sb_8_rx: qcom,msm-dai-q6-sb-8-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16400>;
+		};
+
+		sb_8_tx: qcom,msm-dai-q6-sb-8-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16401>;
+		};
+
+		bt_sco_rx: qcom,msm-dai-q6-bt-sco-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <12288>;
+		};
+
+		bt_sco_tx: qcom,msm-dai-q6-bt-sco-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <12289>;
+		};
+
+		int_fm_rx: qcom,msm-dai-q6-int-fm-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <12292>;
+		};
+
+		int_fm_tx: qcom,msm-dai-q6-int-fm-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <12293>;
+		};
+
+		afe_pcm_rx: qcom,msm-dai-q6-be-afe-pcm-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <224>;
+		};
+
+		afe_pcm_tx: qcom,msm-dai-q6-be-afe-pcm-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <225>;
+		};
+
+		afe_proxy_rx: qcom,msm-dai-q6-afe-proxy-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <241>;
+		};
+
+		afe_proxy_tx: qcom,msm-dai-q6-afe-proxy-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <240>;
+		};
+
+		incall_record_rx: qcom,msm-dai-q6-incall-record-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <32771>;
+		};
+
+		incall_record_tx: qcom,msm-dai-q6-incall-record-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <32772>;
+		};
+
+		incall_music_rx: qcom,msm-dai-q6-incall-music-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <32773>;
+		};
+
+		incall_music_2_rx: qcom,msm-dai-q6-incall-music-2-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <32770>;
+		};
+
+		usb_audio_rx: qcom,msm-dai-q6-usb-audio-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <28672>;
+		};
+
+		usb_audio_tx: qcom,msm-dai-q6-usb-audio-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <28673>;
+		};
+	};
+
+	hostless: qcom,msm-pcm-hostless {
+		compatible = "qcom,msm-pcm-hostless";
+	};
+
+	dai_pri_auxpcm: qcom,msm-pri-auxpcm {
+		compatible = "qcom,msm-auxpcm-dev";
+		qcom,msm-cpudai-auxpcm-mode = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-sync = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-frame = <5>, <4>;
+		qcom,msm-cpudai-auxpcm-quant = <2>, <2>;
+		qcom,msm-cpudai-auxpcm-num-slots = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-slot-mapping = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-data = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-pcm-clk-rate = <2048000>, <2048000>;
+		qcom,msm-auxpcm-interface = "primary";
+		qcom,msm-cpudai-afe-clk-ver = <2>;
+	};
+
+	dai_sec_auxpcm: qcom,msm-sec-auxpcm {
+		compatible = "qcom,msm-auxpcm-dev";
+		qcom,msm-cpudai-auxpcm-mode = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-sync = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-frame = <5>, <4>;
+		qcom,msm-cpudai-auxpcm-quant = <2>, <2>;
+		qcom,msm-cpudai-auxpcm-num-slots = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-slot-mapping = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-data = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-pcm-clk-rate = <2048000>, <2048000>;
+		qcom,msm-auxpcm-interface = "secondary";
+		qcom,msm-cpudai-afe-clk-ver = <2>;
+	};
+
+	dai_tert_auxpcm: qcom,msm-tert-auxpcm {
+		compatible = "qcom,msm-auxpcm-dev";
+		qcom,msm-cpudai-auxpcm-mode = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-sync = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-frame = <5>, <4>;
+		qcom,msm-cpudai-auxpcm-quant = <2>, <2>;
+		qcom,msm-cpudai-auxpcm-num-slots = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-slot-mapping = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-data = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-pcm-clk-rate = <2048000>, <2048000>;
+		qcom,msm-auxpcm-interface = "tertiary";
+		qcom,msm-cpudai-afe-clk-ver = <2>;
+	};
+
+	dai_quat_auxpcm: qcom,msm-quat-auxpcm {
+		compatible = "qcom,msm-auxpcm-dev";
+		qcom,msm-cpudai-auxpcm-mode = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-sync = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-frame = <5>, <4>;
+		qcom,msm-cpudai-auxpcm-quant = <2>, <2>;
+		qcom,msm-cpudai-auxpcm-num-slots = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-slot-mapping = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-data = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-pcm-clk-rate = <2048000>, <2048000>;
+		qcom,msm-auxpcm-interface = "quaternary";
+		qcom,msm-cpudai-afe-clk-ver = <2>;
+	};
+
+	hdmi_dba: qcom,msm-hdmi-dba-codec-rx {
+		compatible = "qcom,msm-hdmi-dba-codec-rx";
+		qcom,dba-bridge-chip = "adv7533";
+	};
+
+	msm_audio_ion: qcom,msm-audio-ion {
+		compatible = "qcom,msm-audio-ion";
+		qcom,smmu-version = <1>;
+		qcom,smmu-enabled;
+		iommus = <&adsp_io 1>;
+	};
+
+	qcom,msm-adsp-loader {
+		status = "ok";
+		compatible = "qcom,adsp-loader";
+		qcom,adsp-state = <0>;
+	};
+
+	qcom,msm-dai-tdm-pri-rx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37120>;
+		qcom,msm-cpudai-tdm-group-num-ports = <1>;
+		qcom,msm-cpudai-tdm-group-port-id = <36864>;
+		qcom,msm-cpudai-tdm-clk-rate = <1536000>;
+		qcom,msm-cpudai-tdm-clk-internal = <1>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <1>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <1>;
+		qcom,msm-cpudai-tdm-data-delay = <1>;
+		dai_pri_tdm_rx_0: qcom,msm-dai-q6-tdm-pri-rx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36864>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-pri-tx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37121>;
+		qcom,msm-cpudai-tdm-group-num-ports = <1>;
+		qcom,msm-cpudai-tdm-group-port-id = <36865>;
+		qcom,msm-cpudai-tdm-clk-rate = <1536000>;
+		qcom,msm-cpudai-tdm-clk-internal = <1>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <1>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <1>;
+		qcom,msm-cpudai-tdm-data-delay = <1>;
+		dai_pri_tdm_tx_0: qcom,msm-dai-q6-tdm-pri-tx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36865>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-sec-rx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37136>;
+		qcom,msm-cpudai-tdm-group-num-ports = <1>;
+		qcom,msm-cpudai-tdm-group-port-id = <36880>;
+		qcom,msm-cpudai-tdm-clk-rate = <1536000>;
+		qcom,msm-cpudai-tdm-clk-internal = <1>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <1>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <1>;
+		qcom,msm-cpudai-tdm-data-delay = <1>;
+		dai_sec_tdm_rx_0: qcom,msm-dai-q6-tdm-sec-rx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36880>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-sec-tx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37137>;
+		qcom,msm-cpudai-tdm-group-num-ports = <1>;
+		qcom,msm-cpudai-tdm-group-port-id = <36881>;
+		qcom,msm-cpudai-tdm-clk-rate = <1536000>;
+		qcom,msm-cpudai-tdm-clk-internal = <1>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <1>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <1>;
+		qcom,msm-cpudai-tdm-data-delay = <1>;
+		dai_sec_tdm_tx_0: qcom,msm-dai-q6-tdm-sec-tx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36881>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-tert-rx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37152>;
+		qcom,msm-cpudai-tdm-group-num-ports = <1>;
+		qcom,msm-cpudai-tdm-group-port-id = <36896>;
+		qcom,msm-cpudai-tdm-clk-rate = <1536000>;
+		qcom,msm-cpudai-tdm-clk-internal = <1>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <1>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <1>;
+		qcom,msm-cpudai-tdm-data-delay = <1>;
+		dai_tert_tdm_rx_0: qcom,msm-dai-q6-tdm-tert-rx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36896>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-tert-tx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37153>;
+		qcom,msm-cpudai-tdm-group-num-ports = <1>;
+		qcom,msm-cpudai-tdm-group-port-id = <36897 >;
+		qcom,msm-cpudai-tdm-clk-rate = <1536000>;
+		qcom,msm-cpudai-tdm-clk-internal = <1>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <1>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <1>;
+		qcom,msm-cpudai-tdm-data-delay = <1>;
+		dai_tert_tdm_tx_0: qcom,msm-dai-q6-tdm-tert-tx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36897 >;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-quat-rx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37168>;
+		qcom,msm-cpudai-tdm-group-num-ports = <1>;
+		qcom,msm-cpudai-tdm-group-port-id = <36912>;
+		qcom,msm-cpudai-tdm-clk-rate = <1536000>;
+		qcom,msm-cpudai-tdm-clk-internal = <1>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <1>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <1>;
+		qcom,msm-cpudai-tdm-data-delay = <1>;
+		dai_quat_tdm_rx_0: qcom,msm-dai-q6-tdm-quat-rx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36912>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-quat-tx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37169>;
+		qcom,msm-cpudai-tdm-group-num-ports = <1>;
+		qcom,msm-cpudai-tdm-group-port-id = <36913 >;
+		qcom,msm-cpudai-tdm-clk-rate = <1536000>;
+		qcom,msm-cpudai-tdm-clk-internal = <1>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <1>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <1>;
+		qcom,msm-cpudai-tdm-data-delay = <1>;
+		dai_quat_tdm_tx_0: qcom,msm-dai-q6-tdm-quat-tx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36913 >;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-audio.dtsi b/arch/arm64/boot/dts/qcom/msm-audio.dtsi
new file mode 100644
index 000000000000..3a7514397139
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-audio.dtsi
@@ -0,0 +1,964 @@
+/*
+ * Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&spi_7 {
+	status = "okay";
+};
+
+&soc {
+	pcm0: qcom,msm-pcm {
+		compatible = "qcom,msm-pcm-dsp";
+		qcom,msm-pcm-dsp-id = <0>;
+	};
+
+	routing: qcom,msm-pcm-routing {
+		compatible = "qcom,msm-pcm-routing";
+	};
+
+	compr: qcom,msm-compr-dsp {
+		compatible = "qcom,msm-compr-dsp";
+	};
+
+	pcm2: qcom,msm-ultra-low-latency {
+		compatible = "qcom,msm-pcm-dsp";
+		qcom,msm-pcm-dsp-id = <2>;
+		qcom,msm-pcm-low-latency;
+		qcom,latency-level = "ultra";
+	};
+
+	pcm1: qcom,msm-pcm-low-latency {
+		compatible = "qcom,msm-pcm-dsp";
+		qcom,msm-pcm-dsp-id = <1>;
+		qcom,msm-pcm-low-latency;
+		qcom,latency-level = "regular";
+	};
+
+	pcm2: qcom,msm-ultra-low-latency {
+		compatible = "qcom,msm-pcm-dsp";
+		qcom,msm-pcm-dsp-id = <2>;
+		qcom,msm-pcm-low-latency;
+		qcom,latency-level = "ultra";
+	};
+
+	pcm_noirq: qcom,msm-pcm-dsp-noirq {
+		compatible = "qcom,msm-pcm-dsp-noirq";
+		qcom,msm-pcm-low-latency;
+		qcom,latency-level = "ultra";
+	};
+
+	cpe: qcom,msm-cpe-lsm {
+		compatible = "qcom,msm-cpe-lsm";
+	};
+
+	cpe3: qcom,msm-cpe-lsm@3 {
+		compatible = "qcom,msm-cpe-lsm";
+		qcom,msm-cpe-lsm-id = <3>;
+	};
+
+	wdsp_mgr: qcom,wcd-dsp-mgr {
+		compatible = "qcom,wcd-dsp-mgr";
+		qcom,wdsp-components = <&wcd934x_cdc 0>,
+				       <&wcd_spi_0 1>,
+				       <&glink_spi_xprt_wdsp 2>;
+		qcom,img-filename = "cpe_9340";
+	};
+
+	wdsp_glink: qcom,wcd-dsp-glink {
+		compatible = "qcom,wcd-dsp-glink";
+	};
+
+	compress: qcom,msm-compress-dsp {
+		compatible = "qcom,msm-compress-dsp";
+	};
+
+	voip: qcom,msm-voip-dsp {
+		compatible = "qcom,msm-voip-dsp";
+	};
+
+	voice: qcom,msm-pcm-voice {
+		compatible = "qcom,msm-pcm-voice";
+		qcom,destroy-cvd;
+	};
+
+	stub_codec: qcom,msm-stub-codec {
+		compatible = "qcom,msm-stub-codec";
+	};
+
+	qcom,msm-dai-fe {
+		compatible = "qcom,msm-dai-fe";
+	};
+
+	afe: qcom,msm-pcm-afe {
+		compatible = "qcom,msm-pcm-afe";
+	};
+
+	dai_dp: qcom,msm-dai-q6-dp {
+		compatible = "qcom,msm-dai-q6-hdmi";
+		qcom,msm-dai-q6-dev-id = <24608>;
+	};
+
+	loopback: qcom,msm-pcm-loopback {
+		compatible = "qcom,msm-pcm-loopback";
+	};
+
+	qcom,msm-dai-mi2s {
+		compatible = "qcom,msm-dai-mi2s";
+		dai_mi2s0: qcom,msm-dai-q6-mi2s-prim {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <0>;
+			qcom,msm-mi2s-rx-lines = <3>;
+			qcom,msm-mi2s-tx-lines = <0>;
+		};
+
+		dai_mi2s1: qcom,msm-dai-q6-mi2s-sec {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <1>;
+			qcom,msm-mi2s-rx-lines = <1>;
+			qcom,msm-mi2s-tx-lines = <0>;
+		};
+
+		dai_mi2s3: qcom,msm-dai-q6-mi2s-quat {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <3>;
+			qcom,msm-mi2s-rx-lines = <1>;
+			qcom,msm-mi2s-tx-lines = <2>;
+		};
+
+		dai_mi2s2: qcom,msm-dai-q6-mi2s-tert {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <2>;
+			qcom,msm-mi2s-rx-lines = <0>;
+			qcom,msm-mi2s-tx-lines = <3>;
+		};
+
+		dai_mi2s5: qcom,msm-dai-q6-mi2s-quin {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <5>;
+			qcom,msm-mi2s-rx-lines = <1>;
+			qcom,msm-mi2s-tx-lines = <2>;
+		};
+
+		dai_mi2s6: qcom,msm-dai-q6-mi2s-senary {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <6>;
+			qcom,msm-mi2s-rx-lines = <0>;
+			qcom,msm-mi2s-tx-lines = <3>;
+		};
+
+		dai_int_mi2s0: qcom,msm-dai-q6-int-mi2s0 {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <7>;
+			qcom,msm-mi2s-rx-lines = <3>;
+			qcom,msm-mi2s-tx-lines = <0>;
+		};
+
+		dai_int_mi2s1: qcom,msm-dai-q6-int-mi2s1 {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <8>;
+			qcom,msm-mi2s-rx-lines = <3>;
+			qcom,msm-mi2s-tx-lines = <0>;
+		};
+
+		dai_int_mi2s2: qcom,msm-dai-q6-int-mi2s2 {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <9>;
+			qcom,msm-mi2s-rx-lines = <0>;
+			qcom,msm-mi2s-tx-lines = <3>;
+		};
+
+		dai_int_mi2s3: qcom,msm-dai-q6-int-mi2s3 {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <10>;
+			qcom,msm-mi2s-rx-lines = <0>;
+			qcom,msm-mi2s-tx-lines = <3>;
+		};
+
+		dai_int_mi2s4: qcom,msm-dai-q6-int-mi2s4 {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <11>;
+			qcom,msm-mi2s-rx-lines = <3>;
+			qcom,msm-mi2s-tx-lines = <0>;
+		};
+
+		dai_int_mi2s5: qcom,msm-dai-q6-int-mi2s5 {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <12>;
+			qcom,msm-mi2s-rx-lines = <0>;
+			qcom,msm-mi2s-tx-lines = <3>;
+		};
+
+		dai_int_mi2s6: qcom,msm-dai-q6-int-mi2s6 {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <13>;
+			qcom,msm-mi2s-rx-lines = <0>;
+			qcom,msm-mi2s-tx-lines = <3>;
+		};
+	};
+
+	lsm: qcom,msm-lsm-client {
+		compatible = "qcom,msm-lsm-client";
+	};
+
+	qcom,msm-dai-q6 {
+		compatible = "qcom,msm-dai-q6";
+		sb_0_rx: qcom,msm-dai-q6-sb-0-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16384>;
+		};
+
+		sb_0_tx: qcom,msm-dai-q6-sb-0-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16385>;
+		};
+
+		sb_1_rx: qcom,msm-dai-q6-sb-1-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16386>;
+		};
+
+		sb_1_tx: qcom,msm-dai-q6-sb-1-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16387>;
+		};
+
+		sb_2_rx: qcom,msm-dai-q6-sb-2-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16388>;
+		};
+
+		sb_2_tx: qcom,msm-dai-q6-sb-2-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16389>;
+		};
+
+
+		sb_3_rx: qcom,msm-dai-q6-sb-3-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16390>;
+		};
+
+		sb_3_tx: qcom,msm-dai-q6-sb-3-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16391>;
+		};
+
+		sb_4_rx: qcom,msm-dai-q6-sb-4-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16392>;
+		};
+
+		sb_4_tx: qcom,msm-dai-q6-sb-4-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16393>;
+		};
+
+		sb_5_tx: qcom,msm-dai-q6-sb-5-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16395>;
+		};
+
+		sb_5_rx: qcom,msm-dai-q6-sb-5-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16394>;
+		};
+
+		sb_6_rx: qcom,msm-dai-q6-sb-6-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16396>;
+		};
+
+		sb_7_tx: qcom,msm-dai-q6-sb-7-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16399>;
+		};
+
+		sb_7_rx: qcom,msm-dai-q6-sb-7-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16398>;
+		};
+
+		sb_8_tx: qcom,msm-dai-q6-sb-8-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16401>;
+		};
+
+		sb_8_rx: qcom,msm-dai-q6-sb-8-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16400>;
+		};
+
+		bt_sco_rx: qcom,msm-dai-q6-bt-sco-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <12288>;
+		};
+
+		bt_sco_tx: qcom,msm-dai-q6-bt-sco-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <12289>;
+		};
+
+		int_fm_rx: qcom,msm-dai-q6-int-fm-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <12292>;
+		};
+
+		int_fm_tx: qcom,msm-dai-q6-int-fm-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <12293>;
+		};
+
+		afe_pcm_rx: qcom,msm-dai-q6-be-afe-pcm-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <224>;
+		};
+
+		afe_pcm_tx: qcom,msm-dai-q6-be-afe-pcm-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <225>;
+		};
+
+		afe_proxy_rx: qcom,msm-dai-q6-afe-proxy-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <241>;
+		};
+
+		afe_proxy_tx: qcom,msm-dai-q6-afe-proxy-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <240>;
+		};
+
+		incall_record_rx: qcom,msm-dai-q6-incall-record-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <32771>;
+		};
+
+		incall_record_tx: qcom,msm-dai-q6-incall-record-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <32772>;
+		};
+
+		incall_music_rx: qcom,msm-dai-q6-incall-music-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <32773>;
+		};
+
+		incall_music_2_rx: qcom,msm-dai-q6-incall-music-2-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <32770>;
+		};
+
+		usb_audio_rx: qcom,msm-dai-q6-usb-audio-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <28672>;
+		};
+
+		usb_audio_tx: qcom,msm-dai-q6-usb-audio-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <28673>;
+		};
+	};
+
+	hostless: qcom,msm-pcm-hostless {
+		compatible = "qcom,msm-pcm-hostless";
+	};
+
+	dai_pri_auxpcm: qcom,msm-pri-auxpcm {
+		compatible = "qcom,msm-auxpcm-dev";
+		qcom,msm-cpudai-auxpcm-mode = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-sync = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-frame = <5>, <4>;
+		qcom,msm-cpudai-auxpcm-quant = <2>, <2>;
+		qcom,msm-cpudai-auxpcm-num-slots = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-slot-mapping = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-data = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-pcm-clk-rate = <2048000>, <2048000>;
+		qcom,msm-auxpcm-interface = "primary";
+	};
+
+	dai_sec_auxpcm: qcom,msm-sec-auxpcm {
+		compatible = "qcom,msm-auxpcm-dev";
+		qcom,msm-cpudai-auxpcm-mode = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-sync = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-frame = <5>, <4>;
+		qcom,msm-cpudai-auxpcm-quant = <2>, <2>;
+		qcom,msm-cpudai-auxpcm-num-slots = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-slot-mapping = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-data = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-pcm-clk-rate = <2048000>, <2048000>;
+		qcom,msm-auxpcm-interface = "secondary";
+		qcom,msm-cpudai-afe-clk-ver = <2>;
+	};
+
+	dai_tert_auxpcm: qcom,msm-tert-auxpcm {
+		compatible = "qcom,msm-auxpcm-dev";
+		qcom,msm-cpudai-auxpcm-mode = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-sync = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-frame = <5>, <4>;
+		qcom,msm-cpudai-auxpcm-quant = <2>, <2>;
+		qcom,msm-cpudai-auxpcm-num-slots = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-slot-mapping = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-data = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-pcm-clk-rate = <2048000>, <2048000>;
+		qcom,msm-auxpcm-interface = "tertiary";
+		qcom,msm-cpudai-afe-clk-ver = <2>;
+	};
+
+	dai_quat_auxpcm: qcom,msm-quat-auxpcm {
+		compatible = "qcom,msm-auxpcm-dev";
+		qcom,msm-cpudai-auxpcm-mode = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-sync = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-frame = <5>, <4>;
+		qcom,msm-cpudai-auxpcm-quant = <2>, <2>;
+		qcom,msm-cpudai-auxpcm-num-slots = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-slot-mapping = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-data = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-pcm-clk-rate = <2048000>, <2048000>;
+		qcom,msm-auxpcm-interface = "quaternary";
+		qcom,msm-cpudai-afe-clk-ver = <2>;
+	};
+
+	qcom,msm-audio-ion {
+		compatible = "qcom,msm-audio-ion";
+		qcom,smmu-version = <2>;
+		qcom,smmu-enabled;
+		iommus = <&lpass_q6_smmu 1>;
+	};
+
+	qcom,msm-adsp-loader {
+		compatible = "qcom,adsp-loader";
+		qcom,adsp-state = <0>;
+	};
+
+	qcom,msm-dai-tdm-pri-rx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37120>;
+		qcom,msm-cpudai-tdm-group-num-ports = <1>;
+		qcom,msm-cpudai-tdm-group-port-id = <36864>;
+		qcom,msm-cpudai-tdm-clk-rate = <1536000>;
+		qcom,msm-cpudai-tdm-clk-internal = <1>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <1>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <1>;
+		qcom,msm-cpudai-tdm-data-delay = <1>;
+		dai_pri_tdm_rx_0: qcom,msm-dai-q6-tdm-pri-rx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36864>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-pri-tx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37121>;
+		qcom,msm-cpudai-tdm-group-num-ports = <1>;
+		qcom,msm-cpudai-tdm-group-port-id = <36865>;
+		qcom,msm-cpudai-tdm-clk-rate = <1536000>;
+		qcom,msm-cpudai-tdm-clk-internal = <1>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <1>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <1>;
+		qcom,msm-cpudai-tdm-data-delay = <1>;
+		dai_pri_tdm_tx_0: qcom,msm-dai-q6-tdm-pri-tx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36865>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-sec-rx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37136>;
+		qcom,msm-cpudai-tdm-group-num-ports = <1>;
+		qcom,msm-cpudai-tdm-group-port-id = <36880>;
+		qcom,msm-cpudai-tdm-clk-rate = <1536000>;
+		qcom,msm-cpudai-tdm-clk-internal = <1>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <1>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <1>;
+		qcom,msm-cpudai-tdm-data-delay = <1>;
+		dai_sec_tdm_rx_0: qcom,msm-dai-q6-tdm-sec-rx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36880>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-sec-tx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37137>;
+		qcom,msm-cpudai-tdm-group-num-ports = <1>;
+		qcom,msm-cpudai-tdm-group-port-id = <36881>;
+		qcom,msm-cpudai-tdm-clk-rate = <1536000>;
+		qcom,msm-cpudai-tdm-clk-internal = <1>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <1>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <1>;
+		qcom,msm-cpudai-tdm-data-delay = <1>;
+		dai_sec_tdm_tx_0: qcom,msm-dai-q6-tdm-sec-tx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36881>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-tert-rx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37152>;
+		qcom,msm-cpudai-tdm-group-num-ports = <1>;
+		qcom,msm-cpudai-tdm-group-port-id = <36896>;
+		qcom,msm-cpudai-tdm-clk-rate = <1536000>;
+		qcom,msm-cpudai-tdm-clk-internal = <1>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <1>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <1>;
+		qcom,msm-cpudai-tdm-data-delay = <1>;
+		dai_tert_tdm_rx_0: qcom,msm-dai-q6-tdm-tert-rx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36896>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-tert-tx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37153>;
+		qcom,msm-cpudai-tdm-group-num-ports = <1>;
+		qcom,msm-cpudai-tdm-group-port-id = <36897 >;
+		qcom,msm-cpudai-tdm-clk-rate = <1536000>;
+		qcom,msm-cpudai-tdm-clk-internal = <1>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <1>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <1>;
+		qcom,msm-cpudai-tdm-data-delay = <1>;
+		dai_tert_tdm_tx_0: qcom,msm-dai-q6-tdm-tert-tx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36897 >;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-quat-rx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37168>;
+		qcom,msm-cpudai-tdm-group-num-ports = <1>;
+		qcom,msm-cpudai-tdm-group-port-id = <36912>;
+		qcom,msm-cpudai-tdm-clk-rate = <1536000>;
+		qcom,msm-cpudai-tdm-clk-internal = <1>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <1>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <1>;
+		qcom,msm-cpudai-tdm-data-delay = <1>;
+		dai_quat_tdm_rx_0: qcom,msm-dai-q6-tdm-quat-rx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36912>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-quat-tx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37169>;
+		qcom,msm-cpudai-tdm-group-num-ports = <1>;
+		qcom,msm-cpudai-tdm-group-port-id = <36913 >;
+		qcom,msm-cpudai-tdm-clk-rate = <1536000>;
+		qcom,msm-cpudai-tdm-clk-internal = <1>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <1>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <1>;
+		qcom,msm-cpudai-tdm-data-delay = <1>;
+		dai_quat_tdm_tx_0: qcom,msm-dai-q6-tdm-quat-tx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36913 >;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,avtimer@150f700c {
+		compatible = "qcom,avtimer";
+		reg = <0x150f700c 0x4>,
+			<0x150f7010 0x4>;
+		reg-names = "avtimer_lsb_addr", "avtimer_msb_addr";
+		qcom,clk-div = <27>;
+	};
+
+	tasha_snd: sound-9335 {
+		compatible = "qcom,sdm660-asoc-snd-tasha";
+		qcom,model = "sdm660-tasha-snd-card";
+		qcom,wcn-btfm;
+		qcom,mi2s-audio-intf;
+		qcom,auxpcm-audio-intf;
+		qcom,ext-disp-audio-rx;
+		qcom,msm-mi2s-master = <1>, <1>, <1>, <1>;
+		qcom,audio-routing =
+			"AIF4 VI", "MCLK",
+			"RX_BIAS", "MCLK",
+			"MADINPUT", "MCLK",
+			"AMIC2", "MIC BIAS2",
+			"MIC BIAS2", "Headset Mic",
+			"AMIC3", "MIC BIAS2",
+			"MIC BIAS2", "ANCRight Headset Mic",
+			"AMIC4", "MIC BIAS2",
+			"MIC BIAS2", "ANCLeft Headset Mic",
+			"AMIC5", "MIC BIAS3",
+			"MIC BIAS3", "Handset Mic",
+			"AMIC6", "MIC BIAS4",
+			"MIC BIAS4", "Analog Mic6",
+			"DMIC0", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic0",
+			"DMIC1", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic1",
+			"DMIC2", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic2",
+			"DMIC3", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic3",
+			"DMIC4", "MIC BIAS4",
+			"MIC BIAS4", "Digital Mic4",
+			"DMIC5", "MIC BIAS4",
+			"MIC BIAS4", "Digital Mic5",
+			"SpkrLeft IN", "SPK1 OUT",
+			"SpkrRight IN", "SPK2 OUT";
+
+		qcom,msm-mbhc-hphl-swh = <1>;
+		qcom,msm-mbhc-gnd-swh = <1>;
+		qcom,us-euro-gpios = <&us_euro_gpio>;
+		qcom,hph-en0-gpio = <&tasha_hph_en0>;
+		qcom,hph-en1-gpio = <&tasha_hph_en1>;
+		qcom,msm-mclk-freq = <9600000>;
+		asoc-platform = <&pcm0>, <&pcm1>, <&pcm2>, <&voip>, <&voice>,
+				<&loopback>, <&compress>, <&hostless>,
+				<&afe>, <&lsm>, <&routing>, <&cpe>, <&compr>,
+				<&pcm_noirq>, <&cpe3>;
+		asoc-platform-names = "msm-pcm-dsp.0", "msm-pcm-dsp.1",
+				      "msm-pcm-dsp.2", "msm-voip-dsp",
+				      "msm-pcm-voice", "msm-pcm-loopback",
+				      "msm-compress-dsp", "msm-pcm-hostless",
+				      "msm-pcm-afe", "msm-lsm-client",
+				      "msm-pcm-routing", "msm-cpe-lsm",
+				      "msm-compr-dsp", "msm-pcm-dsp-noirq",
+				      "msm-cpe-lsm.3";
+		asoc-cpu = <&dai_dp>, <&dai_mi2s0>,
+				<&dai_mi2s1>,
+				<&dai_mi2s2>, <&dai_mi2s3>,
+				<&dai_pri_auxpcm>, <&dai_sec_auxpcm>,
+				<&dai_tert_auxpcm>, <&dai_quat_auxpcm>,
+				<&sb_0_rx>, <&sb_0_tx>, <&sb_1_rx>, <&sb_1_tx>,
+				<&sb_2_rx>, <&sb_2_tx>, <&sb_3_rx>, <&sb_3_tx>,
+				<&sb_4_rx>, <&sb_4_tx>, <&sb_5_tx>,
+				<&afe_pcm_rx>, <&afe_pcm_tx>, <&afe_proxy_rx>,
+				<&afe_proxy_tx>, <&incall_record_rx>,
+				<&incall_record_tx>, <&incall_music_rx>,
+				<&incall_music_2_rx>, <&sb_5_rx>, <&sb_6_rx>,
+				<&sb_7_rx>, <&sb_7_tx>, <&sb_8_tx>, <&sb_8_rx>,
+				<&usb_audio_rx>, <&usb_audio_tx>,
+				<&dai_pri_tdm_rx_0>, <&dai_pri_tdm_tx_0>,
+				<&dai_sec_tdm_rx_0>, <&dai_sec_tdm_tx_0>,
+				<&dai_tert_tdm_rx_0>, <&dai_tert_tdm_tx_0>,
+				<&dai_quat_tdm_rx_0>, <&dai_quat_tdm_tx_0>;
+		asoc-cpu-names = "msm-dai-q6-dp.24608", "msm-dai-q6-mi2s.0",
+				"msm-dai-q6-mi2s.1",
+				"msm-dai-q6-mi2s.2", "msm-dai-q6-mi2s.3",
+				"msm-dai-q6-auxpcm.1", "msm-dai-q6-auxpcm.2",
+				"msm-dai-q6-auxpcm.3", "msm-dai-q6-auxpcm.4",
+				"msm-dai-q6-dev.16384", "msm-dai-q6-dev.16385",
+				"msm-dai-q6-dev.16386", "msm-dai-q6-dev.16387",
+				"msm-dai-q6-dev.16388", "msm-dai-q6-dev.16389",
+				"msm-dai-q6-dev.16390", "msm-dai-q6-dev.16391",
+				"msm-dai-q6-dev.16392", "msm-dai-q6-dev.16393",
+				"msm-dai-q6-dev.16395", "msm-dai-q6-dev.224",
+				"msm-dai-q6-dev.225", "msm-dai-q6-dev.241",
+				"msm-dai-q6-dev.240", "msm-dai-q6-dev.32771",
+				"msm-dai-q6-dev.32772", "msm-dai-q6-dev.32773",
+				"msm-dai-q6-dev.32770", "msm-dai-q6-dev.16394",
+				"msm-dai-q6-dev.16396", "msm-dai-q6-dev.16398",
+				"msm-dai-q6-dev.16399", "msm-dai-q6-dev.16401",
+				"msm-dai-q6-dev.16400", "msm-dai-q6-dev.28672",
+				"msm-dai-q6-dev.28673", "msm-dai-q6-tdm.36864",
+				"msm-dai-q6-tdm.36865", "msm-dai-q6-tdm.36880",
+				"msm-dai-q6-tdm.36881", "msm-dai-q6-tdm.36896",
+				"msm-dai-q6-tdm.36897", "msm-dai-q6-tdm.36912",
+				"msm-dai-q6-tdm.36913";
+		asoc-codec = <&stub_codec>, <&ext_disp_audio_codec>;
+		asoc-codec-names = "msm-stub-codec.1",
+					"msm-ext-disp-audio-codec-rx";
+		qcom,wsa-max-devs = <2>;
+		qcom,wsa-devs = <&wsa881x_211>, <&wsa881x_212>,
+				<&wsa881x_213>, <&wsa881x_214>;
+		qcom,wsa-aux-dev-prefix = "SpkrLeft", "SpkrRight",
+					  "SpkrLeft", "SpkrRight";
+	};
+
+	tavil_snd: sound-tavil {
+		compatible = "qcom,sdm660-asoc-snd-tavil";
+		qcom,model = "sdm660-tavil-snd-card";
+		qcom,wcn-btfm;
+		qcom,mi2s-audio-intf;
+		qcom,auxpcm-audio-intf;
+		qcom,ext-disp-audio-rx;
+		qcom,msm-mi2s-master = <1>, <1>, <1>, <1>;
+		qcom,audio-routing =
+			"AIF4 VI", "MCLK",
+			"RX_BIAS", "MCLK",
+			"MADINPUT", "MCLK",
+			"AMIC2", "MIC BIAS2",
+			"MIC BIAS2", "Headset Mic",
+			"AMIC3", "MIC BIAS2",
+			"MIC BIAS2", "ANCRight Headset Mic",
+			"AMIC4", "MIC BIAS2",
+			"MIC BIAS2", "ANCLeft Headset Mic",
+			"AMIC5", "MIC BIAS3",
+			"MIC BIAS3", "Handset Mic",
+			"DMIC0", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic0",
+			"DMIC1", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic1",
+			"DMIC2", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic2",
+			"DMIC3", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic3",
+			"DMIC4", "MIC BIAS4",
+			"MIC BIAS4", "Digital Mic4",
+			"DMIC5", "MIC BIAS4",
+			"MIC BIAS4", "Digital Mic5",
+			"SpkrLeft IN", "SPK1 OUT",
+			"SpkrRight IN", "SPK2 OUT";
+
+		qcom,msm-mbhc-hphl-swh = <1>;
+		qcom,msm-mbhc-gnd-swh = <1>;
+		qcom,us-euro-gpios = <&tavil_us_euro_sw>;
+		qcom,hph-en0-gpio = <&tavil_hph_en0>;
+		qcom,hph-en1-gpio = <&tavil_hph_en1>;
+		qcom,msm-mclk-freq = <9600000>;
+		qcom,usbc-analog-en1_gpio = <&wcd_usbc_analog_en1_gpio>;
+		qcom,usbc-analog-en2_n_gpio = <&wcd_usbc_analog_en2n_gpio>;
+		asoc-platform = <&pcm0>, <&pcm1>, <&pcm2>, <&voip>, <&voice>,
+				<&loopback>, <&compress>, <&hostless>,
+				<&afe>, <&lsm>, <&routing>, <&cpe>, <&compr>,
+				<&pcm_noirq>;
+		asoc-platform-names = "msm-pcm-dsp.0", "msm-pcm-dsp.1",
+				"msm-pcm-dsp.2", "msm-voip-dsp",
+				"msm-pcm-voice", "msm-pcm-loopback",
+				"msm-compress-dsp", "msm-pcm-hostless",
+				"msm-pcm-afe", "msm-lsm-client",
+				"msm-pcm-routing", "msm-cpe-lsm",
+				"msm-compr-dsp", "msm-pcm-dsp-noirq";
+		asoc-cpu = <&dai_dp>, <&dai_mi2s0>,
+				<&dai_mi2s1>,
+				<&dai_mi2s2>, <&dai_mi2s3>,
+				<&dai_pri_auxpcm>, <&dai_sec_auxpcm>,
+				<&dai_tert_auxpcm>, <&dai_quat_auxpcm>,
+				<&sb_0_rx>, <&sb_0_tx>, <&sb_1_rx>, <&sb_1_tx>,
+				<&sb_2_rx>, <&sb_2_tx>, <&sb_3_rx>, <&sb_3_tx>,
+				<&sb_4_rx>, <&sb_4_tx>, <&sb_5_tx>,
+				<&afe_pcm_rx>, <&afe_pcm_tx>, <&afe_proxy_rx>,
+				<&afe_proxy_tx>, <&incall_record_rx>,
+				<&incall_record_tx>, <&incall_music_rx>,
+				<&incall_music_2_rx>, <&sb_5_rx>, <&sb_6_rx>,
+				<&sb_7_rx>, <&sb_7_tx>, <&sb_8_tx>, <&sb_8_rx>,
+				<&usb_audio_rx>, <&usb_audio_tx>,
+				<&dai_pri_tdm_rx_0>, <&dai_pri_tdm_tx_0>,
+				<&dai_sec_tdm_rx_0>, <&dai_sec_tdm_tx_0>,
+				<&dai_tert_tdm_rx_0>, <&dai_tert_tdm_tx_0>,
+				<&dai_quat_tdm_rx_0>, <&dai_quat_tdm_tx_0>;
+		asoc-cpu-names = "msm-dai-q6-dp.24608", "msm-dai-q6-mi2s.0",
+				"msm-dai-q6-mi2s.1",
+				"msm-dai-q6-mi2s.2", "msm-dai-q6-mi2s.3",
+				"msm-dai-q6-auxpcm.1", "msm-dai-q6-auxpcm.2",
+				"msm-dai-q6-auxpcm.3", "msm-dai-q6-auxpcm.4",
+				"msm-dai-q6-dev.16384", "msm-dai-q6-dev.16385",
+				"msm-dai-q6-dev.16386", "msm-dai-q6-dev.16387",
+				"msm-dai-q6-dev.16388", "msm-dai-q6-dev.16389",
+				"msm-dai-q6-dev.16390", "msm-dai-q6-dev.16391",
+				"msm-dai-q6-dev.16392", "msm-dai-q6-dev.16393",
+				"msm-dai-q6-dev.16395", "msm-dai-q6-dev.224",
+				"msm-dai-q6-dev.225", "msm-dai-q6-dev.241",
+				"msm-dai-q6-dev.240", "msm-dai-q6-dev.32771",
+				"msm-dai-q6-dev.32772", "msm-dai-q6-dev.32773",
+				"msm-dai-q6-dev.32770", "msm-dai-q6-dev.16394",
+				"msm-dai-q6-dev.16396", "msm-dai-q6-dev.16398",
+				"msm-dai-q6-dev.16399", "msm-dai-q6-dev.16401",
+				"msm-dai-q6-dev.16400", "msm-dai-q6-dev.28672",
+				"msm-dai-q6-dev.28673", "msm-dai-q6-tdm.36864",
+				"msm-dai-q6-tdm.36865", "msm-dai-q6-tdm.36880",
+				"msm-dai-q6-tdm.36881", "msm-dai-q6-tdm.36896",
+				"msm-dai-q6-tdm.36897", "msm-dai-q6-tdm.36912",
+				"msm-dai-q6-tdm.36913";
+		asoc-codec = <&stub_codec>, <&ext_disp_audio_codec>;
+		asoc-codec-names = "msm-stub-codec.1",
+					"msm-ext-disp-audio-codec-rx";
+		qcom,wsa-max-devs = <2>;
+		qcom,wsa-devs = <&wsa881x_0211>, <&wsa881x_0212>,
+				<&wsa881x_0213>, <&wsa881x_0214>;
+		qcom,wsa-aux-dev-prefix = "SpkrLeft", "SpkrRight",
+					  "SpkrLeft", "SpkrRight";
+	};
+
+	int_codec: sound {
+		status = "disabled";
+		compatible = "qcom,sdm660-asoc-snd";
+		qcom,model = "sdm660-snd-card";
+		qcom,wcn-btfm;
+		qcom,mi2s-audio-intf;
+		qcom,auxpcm-audio-intf;
+		qcom,ext-disp-audio-rx;
+		qcom,msm-mi2s-master = <1>, <1>, <1>, <1>;
+		qcom,msm-mclk-freq = <9600000>;
+		qcom,msm-mbhc-hphl-swh = <1>;
+		qcom,msm-mbhc-gnd-swh = <1>;
+		qcom,msm-micbias2-ext-cap;
+		qcom,msm-hs-micbias-type = "external";
+		qcom,us-euro-gpios = <&us_euro_gpio>;
+		qcom,cdc-pdm-gpios = <&cdc_pdm_gpios>;
+		qcom,cdc-comp-gpios = <&cdc_comp_gpios>;
+		qcom,cdc-dmic-gpios = <&cdc_dmic_gpios>;
+		qcom,audio-routing =
+			"RX_BIAS", "INT_MCLK0",
+			"SPK_RX_BIAS", "INT_MCLK0",
+			"INT_LDO_H", "INT_MCLK0",
+			"MIC BIAS External", "Handset Mic",
+			"MIC BIAS External2", "Headset Mic",
+			"MIC BIAS External", "Secondary Mic",
+			"AMIC1", "MIC BIAS External",
+			"AMIC2", "MIC BIAS External2",
+			"AMIC3", "MIC BIAS External",
+			"DMIC1", "MIC BIAS External",
+			"MIC BIAS External", "Digital Mic1",
+			"DMIC2", "MIC BIAS External",
+			"MIC BIAS External", "Digital Mic2",
+			"DMIC3", "MIC BIAS External",
+			"MIC BIAS External", "Digital Mic3",
+			"DMIC4", "MIC BIAS External",
+			"MIC BIAS External", "Digital Mic4",
+			"SpkrLeft IN", "SPK1 OUT",
+			"SpkrRight IN", "SPK2 OUT",
+			"PDM_IN_RX1", "PDM_OUT_RX1",
+			"PDM_IN_RX2", "PDM_OUT_RX2",
+			"PDM_IN_RX3", "PDM_OUT_RX3",
+			"ADC1_IN", "ADC1_OUT",
+			"ADC2_IN", "ADC2_OUT",
+			"ADC3_IN", "ADC3_OUT";
+
+		asoc-platform = <&pcm0>, <&pcm1>, <&pcm2>, <&voip>, <&voice>,
+				<&loopback>, <&compress>, <&hostless>,
+				<&afe>, <&lsm>, <&routing>, <&compr>,
+				<&pcm_noirq>;
+		asoc-platform-names = "msm-pcm-dsp.0", "msm-pcm-dsp.1",
+				"msm-pcm-dsp.2", "msm-voip-dsp",
+				"msm-pcm-voice", "msm-pcm-loopback",
+				"msm-compress-dsp", "msm-pcm-hostless",
+				"msm-pcm-afe", "msm-lsm-client",
+				"msm-pcm-routing", "msm-compr-dsp",
+				"msm-pcm-dsp-noirq";
+		asoc-cpu = <&dai_dp>, <&dai_mi2s0>,
+				<&dai_mi2s1>,
+				<&dai_mi2s2>, <&dai_mi2s3>,
+				<&dai_int_mi2s0>, <&dai_int_mi2s1>,
+				<&dai_int_mi2s2>, <&dai_int_mi2s3>,
+				<&dai_int_mi2s4>, <&dai_int_mi2s5>,
+				<&dai_pri_auxpcm>, <&dai_sec_auxpcm>,
+				<&dai_tert_auxpcm>, <&dai_quat_auxpcm>,
+				<&afe_pcm_rx>, <&afe_pcm_tx>, <&afe_proxy_rx>,
+				<&afe_proxy_tx>, <&incall_record_rx>,
+				<&incall_record_tx>, <&incall_music_rx>,
+				<&incall_music_2_rx>, <&sb_7_rx>, <&sb_7_tx>,
+				<&sb_8_tx>, <&sb_8_rx>,
+				<&usb_audio_rx>, <&usb_audio_tx>,
+				<&dai_pri_tdm_rx_0>, <&dai_pri_tdm_tx_0>,
+				<&dai_sec_tdm_rx_0>, <&dai_sec_tdm_tx_0>,
+				<&dai_tert_tdm_rx_0>, <&dai_tert_tdm_tx_0>,
+				<&dai_quat_tdm_rx_0>, <&dai_quat_tdm_tx_0>;
+		asoc-cpu-names = "msm-dai-q6-dp.24608", "msm-dai-q6-mi2s.0",
+				"msm-dai-q6-mi2s.1",
+				"msm-dai-q6-mi2s.2", "msm-dai-q6-mi2s.3",
+				"msm-dai-q6-mi2s.7", "msm-dai-q6-mi2s.8",
+				"msm-dai-q6-mi2s.9", "msm-dai-q6-mi2s.10",
+				"msm-dai-q6-mi2s.11", "msm-dai-q6-mi2s.12",
+				"msm-dai-q6-auxpcm.1", "msm-dai-q6-auxpcm.2",
+				"msm-dai-q6-auxpcm.3", "msm-dai-q6-auxpcm.4",
+				"msm-dai-q6-dev.224", "msm-dai-q6-dev.225",
+				"msm-dai-q6-dev.241", "msm-dai-q6-dev.240",
+				"msm-dai-q6-dev.32771", "msm-dai-q6-dev.32772",
+				"msm-dai-q6-dev.32773", "msm-dai-q6-dev.32770",
+				"msm-dai-q6-dev.16398", "msm-dai-q6-dev.16399",
+				"msm-dai-q6-dev.16401", "msm-dai-q6-dev.16400",
+				"msm-dai-q6-dev.28672", "msm-dai-q6-dev.28673",
+				"msm-dai-q6-tdm.36864", "msm-dai-q6-tdm.36865",
+				"msm-dai-q6-tdm.36880", "msm-dai-q6-tdm.36881",
+				"msm-dai-q6-tdm.36896", "msm-dai-q6-tdm.36897",
+				"msm-dai-q6-tdm.36912", "msm-dai-q6-tdm.36913";
+		asoc-codec = <&stub_codec>, <&msm_digital_codec>,
+				<&pmic_analog_codec>, <&msm_sdw_codec>,
+				<&ext_disp_audio_codec>;
+		asoc-codec-names = "msm-stub-codec.1", "msm-dig-codec",
+					"analog-codec", "msm_sdw_codec",
+					"msm-ext-disp-audio-codec-rx";
+
+		qcom,wsa-max-devs = <2>;
+		qcom,wsa-devs = <&wsa881x_211_en>, <&wsa881x_212_en>,
+				<&wsa881x_213_en>, <&wsa881x_214_en>;
+		qcom,wsa-aux-dev-prefix = "SpkrLeft", "SpkrRight",
+					  "SpkrLeft", "SpkrRight";
+	};
+
+	us_euro_gpio: msm_cdc_pinctrl@75 {
+		compatible = "qcom,msm-cdc-pinctrl";
+		pinctrl-names = "aud_active", "aud_sleep";
+		pinctrl-0 = <&wcd_gnd_mic_swap_active>;
+		pinctrl-1 = <&wcd_gnd_mic_swap_idle>;
+	};
+
+	wcd9xxx_intc: wcd9xxx-irq {
+		compatible = "qcom,wcd9xxx-irq";
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupts = <0 177 0>;
+		interrupt-names = "wcd_irq";
+	};
+
+	clock_audio: audio_ext_clk {
+		compatible = "qcom,audio-ref-clk";
+		qcom,audio-ref-clk-gpio = <&pm660_gpios 3 0>;
+		clock-names = "osr_clk";
+		clocks = <&clock_rpmcc RPM_DIV_CLK1>;
+		qcom,node_has_rpm_clock;
+		#clock-cells = <1>;
+		qcom,codec-mclk-clk-freq = <11289600>;
+		qcom,mclk-clk-reg = <0x15020018 0x0>;
+		pinctrl-names = "sleep", "active";
+		pinctrl-0 = <&lpi_mclk0_sleep>;
+		pinctrl-1 = <&lpi_mclk0_active>;
+	};
+
+	clock_audio_lnbb: audio_ext_clk_lnbb {
+		compatible = "qcom,audio-ref-clk";
+		clock-names = "osr_clk";
+		clocks = <&clock_rpmcc RPM_LN_BB_CLK2>;
+		qcom,node_has_rpm_clock;
+		#clock-cells = <1>;
+	};
+
+	wcd_rst_gpio: msm_cdc_pinctrl@64 {
+		compatible = "qcom,msm-cdc-pinctrl";
+		pinctrl-names = "aud_active", "aud_sleep";
+		pinctrl-0 = <&lpi_cdc_reset_active>;
+		pinctrl-1 = <&lpi_cdc_reset_sleep>;
+		qcom,lpi-gpios;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-gdsc-660.dtsi b/arch/arm64/boot/dts/qcom/msm-gdsc-660.dtsi
new file mode 100644
index 000000000000..6550ddcad86c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-gdsc-660.dtsi
@@ -0,0 +1,159 @@
+/*
+ * Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	/* GCC GDSCs */
+	gdsc_usb30: qcom,gdsc@10f004 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_usb30";
+		reg = <0x10f004 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_ufs: qcom,gdsc@175004 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_ufs";
+		reg = <0x175004 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_hlos1_vote_lpass_adsp: qcom,gdsc@17d034 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_hlos1_vote_lpass_adsp";
+		reg = <0x17d034 0x4>;
+		qcom,no-status-check-on-disable;
+		qcom,gds-timeout = <500>;
+		status = "disabled";
+	};
+
+	gdsc_hlos1_vote_turing_adsp: qcom,gdsc@17d04c {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_hlos1_vote_turing_adsp";
+		reg = <0x17d04c 0x4>;
+		qcom,no-status-check-on-disable;
+		qcom,gds-timeout = <500>;
+		status = "disabled";
+	};
+
+	gdsc_hlos2_vote_turing_adsp: qcom,gdsc@17e04c {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_hlos2_vote_turing_adsp";
+		reg = <0x17e04c 0x4>;
+		qcom,no-status-check-on-disable;
+		qcom,gds-timeout = <500>;
+		status = "disabled";
+	};
+
+	/* MMSS GDSCs */
+	bimc_smmu_hw_ctrl: syscon@c8ce024 {
+	      compatible = "syscon";
+	      reg = <0xc8ce024 0x4>;
+	};
+
+	gdsc_bimc_smmu: qcom,gdsc@c8ce020 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_bimc_smmu";
+		reg = <0xc8ce020 0x4>;
+		hw-ctrl-addr = <&bimc_smmu_hw_ctrl>;
+		qcom,no-status-check-on-disable;
+		qcom,gds-timeout = <500>;
+		status = "disabled";
+	};
+
+	gdsc_venus: qcom,gdsc@c8c1024 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_venus";
+		reg = <0xc8c1024 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_venus_core0: qcom,gdsc@c8c1040 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_venus_core0";
+		reg = <0xc8c1040 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_camss_top: qcom,gdsc@c8c34a0 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_camss_top";
+		reg = <0xc8c34a0 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_vfe0: qcom,gdsc@c8c3664 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_vfe0";
+		reg = <0xc8c3664 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_vfe1: qcom,gdsc@c8c3674 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_vfe1";
+		reg = <0xc8c3674 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_cpp: qcom,gdsc@c8c36d4 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_cpp";
+		reg = <0xc8c36d4 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_mdss: qcom,gdsc@c8c2304 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_mdss";
+		reg = <0xc8c2304 0x4>;
+		status = "disabled";
+	};
+
+	/* GPU GDSCs */
+	gpu_cx_hw_ctrl: syscon@5066008 {
+		compatible = "syscon";
+		reg = <0x5066008 0x4>;
+	};
+
+	gdsc_gpu_cx: qcom,gdsc@5066004 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_gpu_cx";
+		reg = <0x5066004 0x4>;
+		hw-ctrl-addr = <&gpu_cx_hw_ctrl>;
+		qcom,no-status-check-on-disable;
+		qcom,gds-timeout = <2000>;
+		status = "disabled";
+	};
+
+	/* GPU GX GDSCs */
+	gpu_gx_domain_addr: syscon@5065130 {
+		compatible = "syscon";
+		reg = <0x5065130 0x4>;
+	};
+
+	gpu_gx_sw_reset: syscon@5066090 {
+		compatible = "syscon";
+		reg = <0x5066090 0x4>;
+	};
+
+	gdsc_gpu_gx: qcom,gdsc@5066094 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_gpu_gx";
+		reg = <0x5066094 0x4>;
+		domain-addr = <&gpu_gx_domain_addr>;
+		sw-reset = <&gpu_gx_sw_reset>;
+		qcom,retain-periph;
+		qcom,reset-aon-logic;
+		status = "disabled";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-gdsc-8996.dtsi b/arch/arm64/boot/dts/qcom/msm-gdsc-8996.dtsi
new file mode 100644
index 000000000000..2f0f4695a5c9
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-gdsc-8996.dtsi
@@ -0,0 +1,214 @@
+/*
+ * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	gdsc_mmagic_bimc: qcom,gdsc@8c529c {
+		compatible = "regulator-fixed";
+		regulator-name = "gdsc_mmagic_bimc";
+		reg = <0x8c529c 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_mmagic_video: qcom,gdsc@8c119c {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_mmagic_video";
+		reg = <0x8c119c 0x4>,
+		      <0x8c120c 0x4>;
+		reg-names = "base", "hw_ctrl_addr";
+		qcom,no-status-check-on-disable;
+		qcom,gds-timeout = <500>;
+		status = "disabled";
+	};
+
+	gdsc_mmagic_mdss: qcom,gdsc@8c247c {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_mmagic_mdss";
+		reg = <0x8c247c 0x4>,
+		      <0x8c2480 0x4>;
+		reg-names = "base", "hw_ctrl_addr";
+		qcom,no-status-check-on-disable;
+		qcom,gds-timeout = <500>;
+		status = "disabled";
+	};
+
+	gdsc_mmagic_camss: qcom,gdsc@8c3c4c {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_mmagic_camss";
+		reg = <0x8c3c4c 0x4>,
+		      <0x8c3c50 0x4>;
+		reg-names = "base", "hw_ctrl_addr";
+		qcom,no-status-check-on-disable;
+		qcom,gds-timeout = <500>;
+		status = "disabled";
+	};
+
+	gdsc_venus: qcom,gdsc@8c1024 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_venus";
+		reg = <0x8c1024 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_venus_core0: qcom,gdsc@8c1040 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_venus_core0";
+		reg = <0x8c1040 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_venus_core1: qcom,gdsc@8c1044 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_venus_core1";
+		reg = <0x8c1044 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_camss_top: qcom,gdsc@8c34a0 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_camss_top";
+		reg = <0x8c34a0 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_vfe0: qcom,gdsc@8c3664 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_vfe0";
+		reg = <0x8c3664 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_vfe1: qcom,gdsc@8c3674 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_vfe1";
+		reg = <0x8c3674 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_mdss: qcom,gdsc@8c2304 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_mdss";
+		reg = <0x8c2304 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_jpeg: qcom,gdsc@8c35a4 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_jpeg";
+		reg = <0x8c35a4 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_cpp: qcom,gdsc@8c36d4 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_cpp";
+		reg = <0x8c36d4 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_pcie_0: qcom,gdsc@36b004 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_pcie_0";
+		reg = <0x36b004 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_pcie_1: qcom,gdsc@36d004 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_pcie_1";
+		reg = <0x36d004 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_pcie_2: qcom,gdsc@36e004 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_pcie_2";
+		reg = <0x36e004 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_usb30: qcom,gdsc@30f004 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_usb30";
+		reg = <0x30f004 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_ufs: qcom,gdsc@375004 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_ufs";
+		reg = <0x375004 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_fd: qcom,gdsc@8c3b64 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_fd";
+		reg = <0x8c3b64 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_gpu: qcom,gdsc@8c4034 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_gpu";
+		reg = <0x8c4034 0x4>,
+		      <0x8c4038 0x4>;
+		reg-names = "base", "hw_ctrl_addr";
+		qcom,no-status-check-on-disable;
+		qcom,gds-timeout = <500>;
+		status = "disabled";
+	};
+
+	gdsc_gpu_gx: qcom,gdsc@8c4024 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_gpu_gx";
+		reg = <0x8c4024 0x4>,
+		      <0x8c4300 0x4>;
+		reg-names = "base", "domain_addr";
+		status = "disabled";
+	};
+
+	gdsc_hlos1_vote_aggre0_noc: qcom,gdsc@37d024 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_hlos1_vote_aggre0_noc";
+		reg = <0x37d024 0x4>;
+		qcom,no-status-check-on-disable;
+		status = "disabled";
+	};
+
+	gdsc_hlos1_vote_lpass_adsp: qcom,gdsc@37d034 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_hlos1_vote_lpass_adsp";
+		reg = <0x37d034 0x4>;
+		qcom,no-status-check-on-disable;
+		status = "disabled";
+	};
+
+	gdsc_hlos1_vote_lpass_core: qcom,gdsc@37d038 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_hlos1_vote_lpass_core";
+		reg = <0x37d038 0x4>;
+		qcom,no-status-check-on-disable;
+		status = "disabled";
+	};
+
+	gdsc_aggre0_noc: qcom,gdsc@381004 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_aggre0_noc";
+		reg = <0x381004 0x4>,
+		      <0x381028 0x4>;
+		reg-names = "base", "hw_ctrl_addr";
+		qcom,no-status-check-on-disable;
+		qcom,gds-timeout = <500>;
+		status = "disabled";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-gdsc-8998.dtsi b/arch/arm64/boot/dts/qcom/msm-gdsc-8998.dtsi
new file mode 100644
index 000000000000..c86351e48d5f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-gdsc-8998.dtsi
@@ -0,0 +1,146 @@
+/*
+ * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	/* GCC GDSCs */
+	gdsc_usb30: qcom,gdsc@10f004 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_usb30";
+		reg = <0x10f004 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_pcie_0: qcom,gdsc@16b004 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_pcie_0";
+		reg = <0x16b004 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_ufs: qcom,gdsc@175004 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_ufs";
+		reg = <0x175004 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_hlos1_vote_lpass_adsp: qcom,gdsc@17d034 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_hlos1_vote_lpass_adsp";
+		reg = <0x17d034 0x4>;
+		qcom,no-status-check-on-disable;
+		qcom,gds-timeout = <500>;
+		status = "disabled";
+	};
+
+	gdsc_hlos1_vote_lpass_core: qcom,gdsc@17d038 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_hlos1_vote_lpass_core";
+		reg = <0x17d038 0x4>;
+		qcom,no-status-check-on-disable;
+		qcom,gds-timeout = <500>;
+		status = "disabled";
+	};
+
+	/* MMSS GDSCs */
+	gdsc_bimc_smmu: qcom,gdsc@c8ce020 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_bimc_smmu";
+		reg = <0xc8ce020 0x4>,
+		      <0xc8ce024 0x4>;
+		reg-names = "base", "hw_ctrl_addr";
+		qcom,no-status-check-on-disable;
+		qcom,gds-timeout = <500>;
+		status = "disabled";
+	};
+
+	gdsc_venus: qcom,gdsc@c8c1024 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_venus";
+		reg = <0xc8c1024 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_venus_core0: qcom,gdsc@c8c1040 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_venus_core0";
+		reg = <0xc8c1040 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_venus_core1: qcom,gdsc@c8c1044 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_venus_core1";
+		reg = <0xc8c1044 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_camss_top: qcom,gdsc@c8c34a0 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_camss_top";
+		reg = <0xc8c34a0 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_vfe0: qcom,gdsc@c8c3664 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_vfe0";
+		reg = <0xc8c3664 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_vfe1: qcom,gdsc@c8c3674 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_vfe1";
+		reg = <0xc8c3674 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_cpp: qcom,gdsc@c8c36d4 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_cpp";
+		reg = <0xc8c36d4 0x4>;
+		status = "disabled";
+	};
+
+	gdsc_mdss: qcom,gdsc@c8c2304 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_mdss";
+		reg = <0xc8c2304 0x4>;
+		status = "disabled";
+	};
+
+	/* GPU GDSCs */
+	gdsc_gpu_cx: qcom,gdsc@5066004 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_gpu_cx";
+		reg = <0x5066004 0x4>,
+		      <0x5066008 0x4>;
+		reg-names = "base", "hw_ctrl_addr";
+		qcom,no-status-check-on-disable;
+		qcom,gds-timeout = <500>;
+		status = "disabled";
+	};
+
+	gdsc_gpu_gx: qcom,gdsc@5066094 {
+		compatible = "qcom,gdsc";
+		regulator-name = "gdsc_gpu_gx";
+		reg = <0x5066094 0x4>,
+		      <0x5065130 0x4>,
+		      <0x5066090 0x4>;
+		reg-names = "base", "domain_addr", "sw_reset";
+		qcom,retain-periph;
+		qcom,reset-aon-logic;
+		status = "disabled";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-pm660-rpm-regulator.dtsi b/arch/arm64/boot/dts/qcom/msm-pm660-rpm-regulator.dtsi
new file mode 100644
index 000000000000..0f87d1390d5c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-pm660-rpm-regulator.dtsi
@@ -0,0 +1,298 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&rpm_bus {
+	rpm-regulator-smpa4 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpa";
+		qcom,resource-id = <4>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s4 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_s4";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpa5 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpa";
+		qcom,resource-id = <5>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s5 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_s5";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpa6 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpa";
+		qcom,resource-id = <6>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s6 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_s6";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa1 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <1>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l1 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l1";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa2 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <2>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l2 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l2";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa3 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <3>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l3 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l3";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa5 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <5>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l5 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l5";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa6 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <6>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l6 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l6";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa7 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <7>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l7 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l7";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa8 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <8>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l8 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l8";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa9 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <9>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l9 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l9";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa10 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <10>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l10 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l10";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa11 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <11>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l11 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l11";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa12 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <12>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l12 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l12";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa13 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <13>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l13 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l13";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa14 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <14>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l14 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l14";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa15 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <15>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l15 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l15";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa17 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <17>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l17 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l17";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa19 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <19>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l19 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l19";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-pm660.dtsi b/arch/arm64/boot/dts/qcom/msm-pm660.dtsi
new file mode 100644
index 000000000000..460e7e76ac4d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-pm660.dtsi
@@ -0,0 +1,657 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/spmi/spmi.h>
+#include <dt-bindings/interrupt-controller/irq.h>
+
+&spmi_bus {
+	qcom,pm660@0 {
+		compatible ="qcom,spmi-pmic";
+		reg = <0x0 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		pm660_revid: qcom,revid@100 {
+			compatible = "qcom,qpnp-revid";
+			reg = <0x100 0x100>;
+			qcom,fab-id-valid;
+			qcom,tp-rev-valid;
+		};
+
+		pm660_misc: qcom,misc@900 {
+			compatible = "qcom,qpnp-misc";
+			reg = <0x900 0x100>;
+		};
+
+		qcom,power-on@800 {
+			compatible = "qcom,qpnp-power-on";
+			reg = <0x800 0x100>;
+			interrupts = <0x0 0x8 0x0 IRQ_TYPE_NONE>,
+				     <0x0 0x8 0x1 IRQ_TYPE_NONE>,
+				     <0x0 0x8 0x4 IRQ_TYPE_NONE>,
+				     <0x0 0x8 0x5 IRQ_TYPE_NONE>;
+			interrupt-names = "kpdpwr", "resin",
+					"resin-bark", "kpdpwr-resin-bark";
+			qcom,pon-dbc-delay = <15625>;
+			qcom,kpdpwr-sw-debounce;
+			qcom,system-reset;
+			qcom,store-hard-reset-reason;
+
+			qcom,pon_1 {
+				qcom,pon-type = <0>;
+				qcom,pull-up = <1>;
+				linux,code = <116>;
+			};
+
+			qcom,pon_2 {
+				qcom,pon-type = <1>;
+				qcom,pull-up = <1>;
+				linux,code = <114>;
+			};
+		};
+
+		qcom,temp-alarm@2400 {
+			compatible = "qcom,qpnp-temp-alarm";
+			reg = <0x2400 0x100>;
+			interrupts = <0x0 0x24 0x0 IRQ_TYPE_EDGE_RISING>;
+			label = "pm660_tz";
+			qcom,channel-num = <6>;
+			qcom,temp_alarm-vadc = <&pm660_vadc>;
+		};
+
+		pm660_gpios: gpios {
+			compatible = "qcom,qpnp-pin";
+			gpio-controller;
+			#gpio-cells = <2>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			label = "pm660-gpio";
+
+			gpio@c000 {
+				reg = <0xc000 0x100>;
+				qcom,pin-num = <1>;
+				status = "disabled";
+			};
+
+			gpio@c100 {
+				reg = <0xc100 0x100>;
+				qcom,pin-num = <2>;
+				status = "disabled";
+			};
+
+			gpio@c200 {
+				reg = <0xc200 0x100>;
+				qcom,pin-num = <3>;
+				status = "disabled";
+			};
+
+			gpio@c300 {
+				reg = <0xc300 0x100>;
+				qcom,pin-num = <4>;
+				status = "disabled";
+			};
+
+			gpio@c400 {
+				reg = <0xc400 0x100>;
+				qcom,pin-num = <5>;
+				status = "disabled";
+			};
+
+			gpio@c500 {
+				reg = <0xc500 0x100>;
+				qcom,pin-num = <6>;
+				status = "disabled";
+			};
+
+			gpio@c600 {
+				reg = <0xc600 0x100>;
+				qcom,pin-num = <7>;
+				status = "disabled";
+			};
+
+			gpio@c700 {
+				reg = <0xc700 0x100>;
+				qcom,pin-num = <8>;
+				status = "disabled";
+			};
+
+			gpio@c800 {
+				reg = <0xc800 0x100>;
+				qcom,pin-num = <9>;
+				status = "disabled";
+			};
+
+			gpio@c900 {
+				reg = <0xc900 0x100>;
+				qcom,pin-num = <10>;
+				status = "disabled";
+			};
+
+			gpio@ca00 {
+				reg = <0xca00 0x100>;
+				qcom,pin-num = <11>;
+				status = "disabled";
+			};
+
+			gpio@cb00 {
+				reg = <0xcb00 0x100>;
+				qcom,pin-num = <12>;
+				status = "disabled";
+			};
+
+			gpio@cc00 {
+				reg = <0xcc00 0x100>;
+				qcom,pin-num = <13>;
+				status = "disabled";
+			};
+		};
+
+		pm660_coincell: qcom,coincell@2800 {
+			compatible = "qcom,qpnp-coincell";
+			reg = <0x2800 0x100>;
+		};
+
+		pm660_rtc: qcom,pm660_rtc {
+			compatible = "qcom,qpnp-rtc";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			qcom,qpnp-rtc-write = <0>;
+			qcom,qpnp-rtc-alarm-pwrup = <0>;
+
+			qcom,pm660_rtc_rw@6000 {
+				reg = <0x6000 0x100>;
+			};
+			qcom,pm660_rtc_alarm@6100 {
+				reg = <0x6100 0x100>;
+				interrupts = <0x0 0x61 0x1 IRQ_TYPE_NONE>;
+			};
+		};
+
+		pm660_vadc: vadc@3100 {
+			compatible = "qcom,qpnp-vadc-hc";
+			reg = <0x3100 0x100>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts = <0x0 0x31 0x0 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "eoc-int-en-set";
+			qcom,adc-bit-resolution = <15>;
+			qcom,adc-vdd-reference = <1875>;
+
+			chan@6 {
+				label = "die_temp";
+				reg = <6>;
+				qcom,decimation = <2>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "absolute";
+				qcom,scale-function = <3>;
+				qcom,hw-settle-time = <0>;
+				qcom,fast-avg-setup = <0>;
+				qcom,cal-val = <0>;
+			};
+
+			chan@0 {
+				label = "ref_gnd";
+				reg = <0>;
+				qcom,decimation = <2>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "absolute";
+				qcom,scale-function = <0>;
+				qcom,hw-settle-time = <0>;
+				qcom,fast-avg-setup = <0>;
+				qcom,cal-val = <0>;
+			};
+
+			chan@1 {
+				label = "ref_1250v";
+				reg = <1>;
+				qcom,decimation = <2>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "absolute";
+				qcom,scale-function = <0>;
+				qcom,hw-settle-time = <0>;
+				qcom,fast-avg-setup = <0>;
+				qcom,cal-val = <0>;
+			};
+
+			chan@83 {
+				label = "vph_pwr";
+				reg = <0x83>;
+				qcom,decimation = <2>;
+				qcom,pre-div-channel-scaling = <1>;
+				qcom,calibration-type = "absolute";
+				qcom,scale-function = <0>;
+				qcom,hw-settle-time = <0>;
+				qcom,fast-avg-setup = <0>;
+			};
+
+			chan@85 {
+				label = "vcoin";
+				reg = <0x85>;
+				qcom,decimation = <2>;
+				qcom,pre-div-channel-scaling = <1>;
+				qcom,calibration-type = "absolute";
+				qcom,scale-function = <0>;
+				qcom,hw-settle-time = <0>;
+				qcom,fast-avg-setup = <0>;
+			};
+
+			chan@4c {
+				label = "xo_therm";
+				reg = <0x4c>;
+				qcom,decimation = <2>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "ratiometric";
+				qcom,scale-function = <4>;
+				qcom,hw-settle-time = <2>;
+				qcom,fast-avg-setup = <0>;
+			};
+
+			chan@4d {
+				label = "msm_therm";
+				reg = <0x4d>;
+				qcom,decimation = <2>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "ratiometric";
+				qcom,scale-function = <2>;
+				qcom,hw-settle-time = <2>;
+				qcom,fast-avg-setup = <0>;
+			};
+
+			chan@51 {
+				label = "quiet_therm";
+				reg = <0x51>;
+				qcom,decimation = <2>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "ratiometric";
+				qcom,scale-function = <2>;
+				qcom,hw-settle-time = <2>;
+				qcom,fast-avg-setup = <0>;
+			};
+
+			chan@4e {
+				label = "emmc_therm";
+				reg = <0x4e>;
+				qcom,decimation = <2>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "ratiometric";
+				qcom,scale-function = <2>;
+				qcom,hw-settle-time = <2>;
+				qcom,fast-avg-setup = <0>;
+				qcom,vadc-thermal-node;
+			};
+
+			chan@4f {
+				label = "pa_therm0";
+				reg = <0x4f>;
+				qcom,decimation = <2>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "ratiometric";
+				qcom,scale-function = <2>;
+				qcom,hw-settle-time = <2>;
+				qcom,fast-avg-setup = <0>;
+				qcom,vadc-thermal-node;
+			};
+
+			chan@1d {
+				label = "drax_temp";
+				reg = <0x1d>;
+				qcom,decimation = <2>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "absolute";
+				qcom,scale-function = <3>;
+				qcom,hw-settle-time = <0>;
+				qcom,fast-avg-setup = <0>;
+				qcom,cal-val = <0>;
+			};
+		};
+
+		pm660_charger: qcom,qpnp-smb2 {
+			compatible = "qcom,qpnp-smb2";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			qcom,pmic-revid = <&pm660_revid>;
+
+			io-channels = <&pm660_rradc 8>,
+				      <&pm660_rradc 10>,
+				      <&pm660_rradc 3>,
+				      <&pm660_rradc 4>;
+			io-channel-names = "charger_temp",
+					   "charger_temp_max",
+					   "usbin_i",
+					   "usbin_v";
+
+			qcom,wipower-max-uw = <5000000>;
+			dpdm-supply = <&qusb_phy0>;
+
+			qcom,thermal-mitigation
+					= <3000000 2500000 2000000 1500000
+						1000000 500000>;
+
+			qcom,chgr@1000 {
+				reg = <0x1000 0x100>;
+				interrupts =
+					<0x0 0x10 0x0 IRQ_TYPE_EDGE_RISING>,
+					<0x0 0x10 0x1 IRQ_TYPE_EDGE_RISING>,
+					<0x0 0x10 0x2 IRQ_TYPE_EDGE_RISING>,
+					<0x0 0x10 0x3 IRQ_TYPE_EDGE_RISING>,
+					<0x0 0x10 0x4 IRQ_TYPE_EDGE_RISING>;
+
+				interrupt-names = "chg-error",
+						  "chg-state-change",
+						  "step-chg-state-change",
+						  "step-chg-soc-update-fail",
+						  "step-chg-soc-update-request";
+			};
+
+			qcom,otg@1100 {
+				reg = <0x1100 0x100>;
+				interrupts = <0x0 0x11 0x0 IRQ_TYPE_EDGE_BOTH>,
+					     <0x0 0x11 0x1 IRQ_TYPE_EDGE_BOTH>,
+					     <0x0 0x11 0x2 IRQ_TYPE_EDGE_BOTH>,
+					     <0x0 0x11 0x3 IRQ_TYPE_EDGE_BOTH>;
+
+				interrupt-names = "otg-fail",
+						  "otg-overcurrent",
+						  "otg-oc-dis-sw-sts",
+						  "testmode-change-detect";
+			};
+
+			qcom,bat-if@1200 {
+				reg = <0x1200 0x100>;
+				interrupts =
+					<0x0 0x12 0x0 IRQ_TYPE_EDGE_RISING>,
+					<0x0 0x12 0x1 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x12 0x2 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x12 0x3 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x12 0x4 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x12 0x5 IRQ_TYPE_EDGE_BOTH>;
+
+				interrupt-names = "bat-temp",
+						  "bat-ocp",
+						  "bat-ov",
+						  "bat-low",
+						  "bat-therm-or-id-missing",
+						  "bat-terminal-missing";
+			};
+
+			qcom,usb-chgpth@1300 {
+				reg = <0x1300 0x100>;
+				interrupts =
+					<0x0 0x13 0x0 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x13 0x1 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x13 0x2 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x13 0x3 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x13 0x4 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x13 0x5 IRQ_TYPE_EDGE_RISING>,
+					<0x0 0x13 0x6 IRQ_TYPE_EDGE_RISING>,
+					<0x0 0x13 0x7 IRQ_TYPE_EDGE_RISING>;
+
+				interrupt-names = "usbin-collapse",
+						  "usbin-lt-3p6v",
+						  "usbin-uv",
+						  "usbin-ov",
+						  "usbin-plugin",
+						  "usbin-src-change",
+						  "usbin-icl-change",
+						  "type-c-change";
+			};
+
+			qcom,dc-chgpth@1400 {
+				reg = <0x1400 0x100>;
+				interrupts =
+					<0x0 0x14 0x0 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x14 0x1 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x14 0x2 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x14 0x3 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x14 0x4 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x14 0x5 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x14 0x6 IRQ_TYPE_EDGE_RISING>;
+
+				interrupt-names = "dcin-collapse",
+						  "dcin-lt-3p6v",
+						  "dcin-uv",
+						  "dcin-ov",
+						  "dcin-plugin",
+						  "div2-en-dg",
+						  "dcin-icl-change";
+			};
+
+			qcom,chgr-misc@1600 {
+				reg = <0x1600 0x100>;
+				interrupts =
+					<0x0 0x16 0x0 IRQ_TYPE_EDGE_RISING>,
+					<0x0 0x16 0x1 IRQ_TYPE_EDGE_RISING>,
+					<0x0 0x16 0x2 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x16 0x3 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x16 0x4 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x16 0x5 IRQ_TYPE_EDGE_BOTH>,
+					<0x0 0x16 0x6 IRQ_TYPE_EDGE_FALLING>,
+					<0x0 0x16 0x7 IRQ_TYPE_EDGE_BOTH>;
+
+				interrupt-names = "wdog-snarl",
+						  "wdog-bark",
+						  "aicl-fail",
+						  "aicl-done",
+						  "high-duty-cycle",
+						  "input-current-limiting",
+						  "temperature-change",
+						  "switcher-power-ok";
+			};
+		};
+
+		pm660_pdphy: qcom,usb-pdphy@1700 {
+			compatible = "qcom,qpnp-pdphy";
+			reg = <0x1700 0x100>;
+			vdd-pdphy-supply = <&pm660l_l7>;
+			vbus-supply = <&smb2_vbus>;
+			vconn-supply = <&smb2_vconn>;
+			interrupts = <0x0 0x17 0x0 IRQ_TYPE_EDGE_RISING>,
+				     <0x0 0x17 0x1 IRQ_TYPE_EDGE_RISING>,
+				     <0x0 0x17 0x2 IRQ_TYPE_EDGE_RISING>,
+				     <0x0 0x17 0x3 IRQ_TYPE_EDGE_RISING>,
+				     <0x0 0x17 0x4 IRQ_TYPE_EDGE_RISING>,
+				     <0x0 0x17 0x5 IRQ_TYPE_EDGE_RISING>,
+				     <0x0 0x17 0x6 IRQ_TYPE_EDGE_RISING>;
+
+			interrupt-names = "sig-tx",
+					  "sig-rx",
+					  "msg-tx",
+					  "msg-rx",
+					  "msg-tx-failed",
+					  "msg-tx-discarded",
+					  "msg-rx-discarded";
+
+			qcom,default-sink-caps = <5000 3000>, /* 5V @ 3A */
+						 <9000 3000>; /* 9V @ 3A */
+		};
+
+		pm660_adc_tm: vadc@3400 {
+			compatible = "qcom,qpnp-adc-tm-hc";
+			reg = <0x3400 0x100>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts = <0x0 0x34 0x0 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "eoc-int-en-set";
+			qcom,adc-bit-resolution = <15>;
+			qcom,adc-vdd-reference = <1875>;
+			qcom,adc_tm-vadc = <&pm660_vadc>;
+			qcom,decimation = <0>;
+			qcom,fast-avg-setup = <0>;
+
+			chan@83 {
+				label = "vph_pwr";
+				reg = <0x83>;
+				qcom,pre-div-channel-scaling = <1>;
+				qcom,calibration-type = "absolute";
+				qcom,scale-function = <0>;
+				qcom,hw-settle-time = <0>;
+				qcom,btm-channel-number = <0x60>;
+			};
+
+			chan@4d {
+				label = "msm_therm";
+				reg = <0x4d>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "ratiometric";
+				qcom,scale-function = <2>;
+				qcom,hw-settle-time = <2>;
+				qcom,btm-channel-number = <0x68>;
+				qcom,thermal-node;
+			};
+
+			chan@51 {
+				label = "quiet_therm";
+				reg = <0x51>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "ratiometric";
+				qcom,scale-function = <2>;
+				qcom,hw-settle-time = <2>;
+				qcom,btm-channel-number = <0x70>;
+				qcom,thermal-node;
+			};
+
+			chan@4c {
+				label = "xo_therm";
+				reg = <0x4c>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "ratiometric";
+				qcom,scale-function = <4>;
+				qcom,hw-settle-time = <2>;
+				qcom,btm-channel-number = <0x78>;
+				qcom,thermal-node;
+			};
+		};
+
+		pm660_rradc: rradc@4500 {
+			compatible = "qcom,rradc";
+			reg = <0x4500 0x100>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			#io-channel-cells = <1>;
+			qcom,pmic-revid = <&pm660_revid>;
+		};
+
+		pm660_fg: qpnp,fg {
+			compatible = "qcom,fg-gen3";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			qcom,pmic-revid = <&pm660_revid>;
+			io-channels = <&pm660_rradc 0>,
+				      <&pm660_rradc 7>;
+			io-channel-names = "rradc_batt_id",
+					   "rradc_die_temp";
+			qcom,rradc-base = <0x4500>;
+			qcom,fg-esr-timer-awake = <96 96>;
+			qcom,fg-esr-timer-asleep = <256 256>;
+			qcom,fg-esr-timer-charging = <0 96>;
+			qcom,cycle-counter-en;
+			status = "okay";
+
+			qcom,fg-batt-soc@4000 {
+				status = "okay";
+				reg = <0x4000 0x100>;
+				interrupts = <0x0 0x40 0x0 IRQ_TYPE_EDGE_BOTH>,
+					     <0x0 0x40 0x1 IRQ_TYPE_EDGE_BOTH>,
+					     <0x0 0x40 0x2
+							IRQ_TYPE_EDGE_RISING>,
+					     <0x0 0x40 0x3
+							IRQ_TYPE_EDGE_RISING>,
+					     <0x0 0x40 0x4 IRQ_TYPE_EDGE_BOTH>,
+					     <0x0 0x40 0x5
+							IRQ_TYPE_EDGE_RISING>,
+					     <0x0 0x40 0x6 IRQ_TYPE_EDGE_BOTH>,
+					     <0x0 0x40 0x7 IRQ_TYPE_EDGE_BOTH>;
+				interrupt-names = "soc-update",
+						  "soc-ready",
+						  "bsoc-delta",
+						  "msoc-delta",
+						  "msoc-low",
+						  "msoc-empty",
+						  "msoc-high",
+						  "msoc-full";
+			};
+
+			qcom,fg-batt-info@4100 {
+				status = "okay";
+				reg = <0x4100 0x100>;
+				interrupts = <0x0 0x41 0x0 IRQ_TYPE_EDGE_BOTH>,
+					     <0x0 0x41 0x1 IRQ_TYPE_EDGE_BOTH>,
+					     <0x0 0x41 0x2 IRQ_TYPE_EDGE_BOTH>,
+					     <0x0 0x41 0x3 IRQ_TYPE_EDGE_BOTH>,
+					     <0x0 0x41 0x6 IRQ_TYPE_EDGE_BOTH>;
+				interrupt-names = "vbatt-pred-delta",
+						  "vbatt-low",
+						  "esr-delta",
+						  "batt-missing",
+						  "batt-temp-delta";
+			};
+
+			qcom,fg-memif@4400 {
+				status = "okay";
+				reg = <0x4400 0x100>;
+				interrupts = <0x0 0x44 0x0 IRQ_TYPE_EDGE_BOTH>,
+					     <0x0 0x44 0x1 IRQ_TYPE_EDGE_BOTH>,
+					     <0x0 0x44 0x2 IRQ_TYPE_EDGE_BOTH>;
+				interrupt-names = "ima-rdy",
+						  "mem-xcp",
+						  "dma-grant";
+			};
+		};
+
+		bcl@4200 {
+			compatible = "qcom,msm-bcl-lmh";
+			reg = <0x4200 0xff>,
+				<0x4300 0xff>;
+			reg-names = "fg_user_adc",
+					"fg_lmh";
+			interrupts = <0x0 0x42 0x0 IRQ_TYPE_NONE>,
+					<0x0 0x42 0x2 IRQ_TYPE_NONE>;
+			interrupt-names = "bcl-high-ibat-int",
+					"bcl-low-vbat-int";
+			qcom,vbat-polling-delay-ms = <100>;
+			qcom,ibat-polling-delay-ms = <100>;
+		};
+	};
+
+	qcom,pm660@1 {
+		compatible ="qcom,spmi-pmic";
+		reg = <0x1 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		pm660_haptics: qcom,haptic@c000 {
+			compatible = "qcom,qpnp-haptic";
+			reg = <0xc000 0x100>;
+			interrupts = <0x1 0xc0 0x0 IRQ_TYPE_EDGE_BOTH>,
+				     <0x1 0xc0 0x1 IRQ_TYPE_EDGE_BOTH>;
+			interrupt-names = "sc-irq", "play-irq";
+			qcom,pmic-revid = <&pm660_revid>;
+			qcom,pmic-misc = <&pm660_misc>;
+			qcom,misc-clk-trim-error-reg = <0xf3>;
+			qcom,actuator-type = "lra";
+			qcom,play-mode = "direct";
+			qcom,vmax-mv = <3200>;
+			qcom,ilim-ma = <800>;
+			qcom,wave-shape = "square";
+			qcom,wave-play-rate-us = <6667>;
+			qcom,int-pwm-freq-khz = <505>;
+			qcom,sc-deb-cycles = <8>;
+			qcom,en-brake;
+			qcom,brake-pattern = [03 03 00 00];
+			qcom,lra-high-z = "opt0";
+			qcom,lra-auto-res-mode = "qwd";
+			qcom,lra-calibrate-at-eop = <0>;
+			qcom,correct-lra-drive-freq;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-pm660a.dtsi b/arch/arm64/boot/dts/qcom/msm-pm660a.dtsi
new file mode 100644
index 000000000000..bfe1b5aa831b
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-pm660a.dtsi
@@ -0,0 +1,29 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/* Disable WLED */
+&pm660l_wled {
+	status = "disabled";
+};
+
+/* disable LCDB */
+&pm660l_lcdb {
+	status = "disabled";
+};
+
+&pm660a_oledb {
+	status = "okay";
+};
+
+&pm660a_labibb {
+	status = "okay";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-pm660l-rpm-regulator.dtsi b/arch/arm64/boot/dts/qcom/msm-pm660l-rpm-regulator.dtsi
new file mode 100644
index 000000000000..57b62489e502
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-pm660l-rpm-regulator.dtsi
@@ -0,0 +1,238 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&rpm_bus {
+	rpm-regulator-smpb1 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpb";
+		qcom,resource-id = <1>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s1 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_s1";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpb2 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpb";
+		qcom,resource-id = <2>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s2 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_s2";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpb3 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "rwcx";
+		qcom,resource-id = <0>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s3 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_s3";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpb5 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "rwmx";
+		qcom,resource-id = <0>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s5 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_s5";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldob1 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldob";
+		qcom,resource-id = <1>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l1 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_l1";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldob2 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldob";
+		qcom,resource-id = <2>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l2 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_l2";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldob3 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldob";
+		qcom,resource-id = <3>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l3 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_l3";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldob4 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldob";
+		qcom,resource-id = <4>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l4 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_l4";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldob5 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldob";
+		qcom,resource-id = <5>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l5 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_l5";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldob6 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldob";
+		qcom,resource-id = <6>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l6 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_l6";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldob7 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldob";
+		qcom,resource-id = <7>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l7 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_l7";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldob8 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldob";
+		qcom,resource-id = <8>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l8 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_l8";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldob9 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "rwlc";
+		qcom,resource-id = <0>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l9 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_l9";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldob10 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "rwlm";
+		qcom,resource-id = <0>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l10 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_l10";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-bobb {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "bobb";
+		qcom,resource-id = <1>;
+		qcom,regulator-type = <4>;
+		status = "disabled";
+
+		regulator-bob {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_bob";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-pm660l.dtsi b/arch/arm64/boot/dts/qcom/msm-pm660l.dtsi
new file mode 100644
index 000000000000..075eaef21254
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-pm660l.dtsi
@@ -0,0 +1,469 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/irq.h>
+#include <dt-bindings/spmi/spmi.h>
+#include <dt-bindings/msm/power-on.h>
+
+&spmi_bus {
+	qcom,pm660l@2 {
+		compatible = "qcom,spmi-pmic";
+		reg = <0x2 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		pm660l_revid: qcom,revid@100 {
+			compatible = "qcom,qpnp-revid";
+			reg = <0x100 0x100>;
+		};
+
+		pm660l_pbs: qcom,pbs@7300 {
+			compatible = "qcom,qpnp-pbs";
+			reg = <0x7300 0x100>;
+		};
+
+		qcom,power-on@800 {
+			compatible = "qcom,qpnp-power-on";
+			reg = <0x800 0x100>;
+			qcom,secondary-pon-reset;
+			qcom,hard-reset-poweroff-type =
+				<PON_POWER_OFF_SHUTDOWN>;
+		};
+
+		qcom,temp-alarm@2400 {
+			compatible = "qcom,qpnp-temp-alarm";
+			reg = <0x2400 0x100>;
+			interrupts = <0x2 0x24 0x0 IRQ_TYPE_EDGE_RISING>;
+			label = "pm660l_tz";
+		};
+
+		pm660l_gpios: gpios {
+			compatible = "qcom,qpnp-pin";
+			gpio-controller;
+			#gpio-cells = <2>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			label = "pm660l-gpio";
+
+			gpio@c000 {
+				reg = <0xc000 0x100>;
+				qcom,pin-num = <1>;
+				status = "disabled";
+			};
+
+			gpio@c100 {
+				reg = <0xc100 0x100>;
+				qcom,pin-num = <2>;
+				status = "disabled";
+			};
+
+			gpio@c200 {
+				reg = <0xc200 0x100>;
+				qcom,pin-num = <3>;
+				status = "disabled";
+			};
+
+			gpio@c300 {
+				reg = <0xc300 0x100>;
+				qcom,pin-num = <4>;
+				status = "disabled";
+			};
+
+			gpio@c400 {
+				reg = <0xc400 0x100>;
+				qcom,pin-num = <5>;
+				status = "disabled";
+			};
+
+			gpio@c500 {
+				reg = <0xc500 0x100>;
+				qcom,pin-num = <6>;
+				status = "disabled";
+			};
+
+			gpio@c600 {
+				reg = <0xc600 0x100>;
+				qcom,pin-num = <7>;
+				status = "disabled";
+			};
+
+			gpio@c700 {
+				reg = <0xc700 0x100>;
+				qcom,pin-num = <8>;
+				status = "disabled";
+			};
+
+			gpio@c800 {
+				reg = <0xc800 0x100>;
+				qcom,pin-num = <9>;
+				status = "disabled";
+			};
+
+			gpio@c900 {
+				reg = <0xc900 0x100>;
+				qcom,pin-num = <10>;
+				status = "disabled";
+			};
+
+			gpio@ca00 {
+				reg = <0xca00 0x100>;
+				qcom,pin-num = <11>;
+				status = "disabled";
+			};
+
+			gpio@cb00 {
+				reg = <0xcb00 0x100>;
+				qcom,pin-num = <12>;
+				status = "disabled";
+			};
+
+		};
+	};
+
+	pm660l_3: qcom,pm660l@3 {
+		compatible ="qcom,spmi-pmic";
+		reg = <0x3 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		pm660l_pwm_1: pwm@b100 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb100 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base",
+					"qpnp-lpg-lut-base";
+			qcom,channel-id = <1>;
+			qcom,lpg-lut-size = <0x7e>;
+			qcom,supported-sizes = <6>, <9>;
+			qcom,ramp-index = <0>;
+			#pwm-cells = <2>;
+		};
+
+		pm660l_pwm_2: pwm@b200 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb200 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base",
+					 "qpnp-lpg-lut-base";
+			qcom,channel-id = <2>;
+			qcom,lpg-lut-size = <0x7e>;
+			qcom,supported-sizes = <6>, <9>;
+			qcom,ramp-index = <1>;
+			#pwm-cells = <2>;
+		};
+
+		pm660l_pwm_3: pwm@b300 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb300 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base",
+					 "qpnp-lpg-lut-base";
+			qcom,channel-id = <3>;
+			qcom,lpg-lut-size = <0x7e>;
+			qcom,supported-sizes = <6>, <9>;
+			qcom,ramp-index = <2>;
+			#pwm-cells = <2>;
+			qcom,period = <6000000>;
+
+			qcom,lpg {
+				label = "lpg";
+				cell-index = <0>;
+				qcom,duty-percents =
+					<0x01 0x0a 0x14 0x1e 0x28 0x32 0x3c
+					0x46 0x50 0x5a 0x64
+					0x64 0x5a 0x50 0x46 0x3c 0x32 0x28 0x1e
+					0x14 0x0a 0x01>;
+			};
+		};
+
+		pm660l_pwm_4: pwm@b400 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb400 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base",
+					 "qpnp-lpg-lut-base";
+			qcom,channel-id = <4>;
+			qcom,lpg-lut-size = <0x7e>;
+			qcom,supported-sizes = <6>, <9>;
+			qcom,ramp-index = <3>;
+			#pwm-cells = <2>;
+			status = "disabled";
+		};
+
+		qcom,leds@d000 {
+			compatible = "qcom,leds-qpnp";
+			reg = <0xd000 0x100>;
+			label = "rgb";
+
+			red_led: qcom,rgb_0 {
+				label = "rgb";
+				qcom,id = <3>;
+				qcom,mode = "pwm";
+				pwms = <&pm660l_pwm_3 0 0>;
+				qcom,pwm-us = <1000>;
+				qcom,max-current = <12>;
+				qcom,default-state = "off";
+				linux,name = "red";
+				qcom,start-idx = <0>;
+				qcom,idx-len = <22>;
+				qcom,duty-pcts =
+					[01 0a 14 1e 28 32 3c 46 50 5a 64
+					64 5a 50 46 3c 32 28 1e 14 0a 01];
+				qcom,use-blink;
+			};
+
+			green_led: qcom,rgb_1 {
+				label = "rgb";
+				qcom,id = <4>;
+				qcom,mode = "pwm";
+				pwms = <&pm660l_pwm_2 0 0>;
+				qcom,pwm-us = <1000>;
+				qcom,max-current = <12>;
+				qcom,default-state = "off";
+				linux,name = "green";
+			};
+
+			blue_led: qcom,rgb_2 {
+				label = "rgb";
+				qcom,id = <5>;
+				qcom,mode = "pwm";
+				pwms = <&pm660l_pwm_1 0 0>;
+				qcom,pwm-us = <1000>;
+				qcom,max-current = <12>;
+				qcom,default-state = "off";
+				linux,name = "blue";
+			};
+		};
+
+		pm660l_wled: qcom,leds@d800 {
+			compatible = "qcom,qpnp-wled";
+			reg = <0xd800 0x100>,
+				<0xd900 0x100>;
+			reg-names = "qpnp-wled-ctrl-base",
+					"qpnp-wled-sink-base";
+			interrupts = <0x3 0xd8 0x1 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "ovp-irq";
+			linux,name = "wled";
+			linux,default-trigger = "bkl-trigger";
+			qcom,fdbk-output = "auto";
+			qcom,vref-uv = <127500>;
+			qcom,switch-freq-khz = <800>;
+			qcom,ovp-mv = <29600>;
+			qcom,ilim-ma = <970>;
+			qcom,boost-duty-ns = <26>;
+			qcom,mod-freq-khz = <9600>;
+			qcom,dim-mode = "hybrid";
+			qcom,hyb-thres = <625>;
+			qcom,sync-dly-us = <800>;
+			qcom,fs-curr-ua = <25000>;
+			qcom,cons-sync-write-delay-us = <1000>;
+			qcom,led-strings-list = [00 01 02];
+			qcom,loop-auto-gm-en;
+			qcom,pmic-revid = <&pm660l_revid>;
+			qcom,auto-calibration-enable;
+			status = "ok";
+		};
+
+		flash_led: qcom,leds@d300 {
+			compatible = "qcom,qpnp-flash-led-v2";
+			reg = <0xd300 0x100>;
+			label = "flash";
+			interrupts = <0x3 0xd3 0x0 IRQ_TYPE_EDGE_RISING>,
+					<0x3 0xd3 0x3 IRQ_TYPE_EDGE_RISING>,
+					<0x3 0xd3 0x4 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "led-fault-irq",
+					"all-ramp-down-done-irq",
+					"all-ramp-up-done-irq";
+			qcom,hdrm-auto-mode;
+			qcom,short-circuit-det;
+			qcom,open-circuit-det;
+			qcom,vph-droop-det;
+			qcom,thermal-derate-en;
+			qcom,thermal-derate-current = <200 500 1000>;
+			qcom,isc-delay = <192>;
+			qcom,pmic-revid = <&pm660l_revid>;
+
+			pm660l_flash0: qcom,flash_0 {
+				label = "flash";
+				qcom,led-name = "led:flash_0";
+				qcom,max-current = <1500>;
+				qcom,default-led-trigger = "flash0_trigger";
+				qcom,id = <0>;
+				qcom,current-ma = <1000>;
+				qcom,duration-ms = <1280>;
+				qcom,ires-ua = <12500>;
+				qcom,hdrm-voltage-mv = <325>;
+				qcom,hdrm-vol-hi-lo-win-mv = <100>;
+			};
+
+			pm660l_flash1: qcom,flash_1 {
+				label = "flash";
+				qcom,led-name = "led:flash_1";
+				qcom,max-current = <1500>;
+				qcom,default-led-trigger = "flash1_trigger";
+				qcom,id = <1>;
+				qcom,current-ma = <1000>;
+				qcom,duration-ms = <1280>;
+				qcom,ires-ua = <12500>;
+				qcom,hdrm-voltage-mv = <325>;
+				qcom,hdrm-vol-hi-lo-win-mv = <100>;
+			};
+
+			pm660l_flash2: qcom,flash_2 {
+				label = "flash";
+				qcom,led-name = "led:flash_2";
+				qcom,max-current = <750>;
+				qcom,default-led-trigger = "flash2_trigger";
+				qcom,id = <2>;
+				qcom,current-ma = <500>;
+				qcom,duration-ms = <1280>;
+				qcom,ires-ua = <12500>;
+				qcom,hdrm-voltage-mv = <325>;
+				qcom,hdrm-vol-hi-lo-win-mv = <100>;
+			};
+
+			pm660l_torch0: qcom,torch_0 {
+				label = "torch";
+				qcom,led-name = "led:torch_0";
+				qcom,max-current = <500>;
+				qcom,default-led-trigger = "torch0_trigger";
+				qcom,id = <0>;
+				qcom,current-ma = <300>;
+				qcom,ires-ua = <12500>;
+				qcom,hdrm-voltage-mv = <325>;
+				qcom,hdrm-vol-hi-lo-win-mv = <100>;
+			};
+
+			pm660l_torch1: qcom,torch_1 {
+				label = "torch";
+				qcom,led-name = "led:torch_1";
+				qcom,max-current = <500>;
+				qcom,default-led-trigger = "torch1_trigger";
+				qcom,id = <1>;
+				qcom,current-ma = <300>;
+				qcom,ires-ua = <12500>;
+				qcom,hdrm-voltage-mv = <325>;
+				qcom,hdrm-vol-hi-lo-win-mv = <100>;
+			};
+
+			pm660l_torch2: qcom,torch_2 {
+				label = "torch";
+				qcom,led-name = "led:torch_2";
+				qcom,max-current = <500>;
+				qcom,default-led-trigger = "torch2_trigger";
+				qcom,id = <2>;
+				qcom,current-ma = <300>;
+				qcom,ires-ua = <12500>;
+				qcom,hdrm-voltage-mv = <325>;
+				qcom,hdrm-vol-hi-lo-win-mv = <100>;
+			};
+
+			pm660l_switch0: qcom,led_switch_0 {
+				label = "switch";
+				qcom,led-name = "led:switch_0";
+				qcom,led-mask = <3>;
+				qcom,default-led-trigger = "switch0_trigger";
+			};
+
+			pm660l_switch1: qcom,led_switch_1 {
+				label = "switch";
+				qcom,led-name = "led:switch_1";
+				qcom,led-mask = <4>;
+				qcom,default-led-trigger = "switch1_trigger";
+			};
+		};
+
+		pm660l_lcdb: qpnp-lcdb@ec00 {
+			compatible = "qcom,qpnp-lcdb-regulator";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			reg = <0xec00 0x100>;
+			interrupts = <0x3 0xec 0x1 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "sc-irq";
+
+			qcom,pmic-revid = <&pm660l_revid>;
+
+			lcdb_ldo_vreg: ldo {
+				label = "ldo";
+				regulator-name = "lcdb_ldo";
+				regulator-min-microvolt = <4000000>;
+				regulator-max-microvolt = <6000000>;
+			};
+
+			lcdb_ncp_vreg: ncp {
+				label = "ncp";
+				regulator-name = "lcdb_ncp";
+				regulator-min-microvolt = <4000000>;
+				regulator-max-microvolt = <6000000>;
+			};
+		};
+
+		pm660a_oledb: qpnp-oledb@e000 {
+		       compatible = "qcom,qpnp-oledb-regulator";
+		       #address-cells = <1>;
+		       #size-cells = <1>;
+		       qcom,pmic-revid = <&pm660l_revid>;
+		       reg = <0xe000 0x100>;
+		       qcom,pbs-client = <&pm660l_pbs>;
+
+		       label = "oledb";
+		       regulator-name = "regulator-oledb";
+		       regulator-min-microvolt = <5000000>;
+		       regulator-max-microvolt = <8100000>;
+
+		       qcom,swire-control;
+		       qcom,ext-pin-control;
+		       status = "disabled";
+		};
+
+		pm660a_labibb: qpnp-labibb-regulator {
+			compatible = "qcom,qpnp-labibb-regulator";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			qcom,pmic-revid = <&pm660l_revid>;
+			qcom,swire-control;
+			status = "disabled";
+
+			ibb_regulator: qcom,ibb@dc00 {
+				reg = <0xdc00 0x100>;
+				reg-names = "ibb_reg";
+				regulator-name = "ibb_reg";
+
+				regulator-min-microvolt = <4000000>;
+				regulator-max-microvolt = <6300000>;
+
+				qcom,qpnp-ibb-min-voltage = <1400000>;
+				qcom,qpnp-ibb-step-size = <100000>;
+				qcom,qpnp-ibb-slew-rate = <2000000>;
+				qcom,qpnp-ibb-init-voltage = <4000000>;
+				qcom,qpnp-ibb-init-amoled-voltage = <4000000>;
+			};
+
+			lab_regulator: qcom,lab@de00 {
+				reg = <0xde00 0x100>;
+				reg-names = "lab";
+				regulator-name = "lab_reg";
+
+				regulator-min-microvolt = <4600000>;
+				regulator-max-microvolt = <6100000>;
+
+				qcom,qpnp-lab-min-voltage = <4600000>;
+				qcom,qpnp-lab-step-size = <100000>;
+				qcom,qpnp-lab-slew-rate = <5000>;
+				qcom,qpnp-lab-init-voltage = <4600000>;
+				qcom,qpnp-lab-init-amoled-voltage = <4600000>;
+
+				qcom,notify-lab-vreg-ok-sts;
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-pm8004.dtsi b/arch/arm64/boot/dts/qcom/msm-pm8004.dtsi
new file mode 100644
index 000000000000..accce1363020
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-pm8004.dtsi
@@ -0,0 +1,86 @@
+/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/spmi/spmi.h>
+#include <dt-bindings/interrupt-controller/irq.h>
+
+&spmi_bus {
+	qcom,pm8004@4 {
+		compatible = "qcom,spmi-pmic";
+		reg = <0x4 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		pm8004_revid: qcom,revid@100 {
+			compatible = "qcom,qpnp-revid";
+			reg = <0x100 0x100>;
+		};
+
+		qcom,power-on@800 {
+			compatible = "qcom,qpnp-power-on";
+			reg = <0x800 0x100>;
+			qcom,secondary-pon-reset;
+			qcom,s3-debounce = <32>;
+			qcom,s3-src = "kpdpwr-and-resin";
+			status = "disabled";
+		};
+
+		qcom,temp-alarm@2400 {
+			compatible = "qcom,qpnp-temp-alarm";
+			reg = <0x2400 0x100>;
+			interrupts = <0x4 0x24 0x0 IRQ_TYPE_NONE>;
+			label = "pm8004_tz";
+			qcom,threshold-set = <0>;
+			qcom,default-temp = <37000>;
+		};
+
+		pm8004_mpps: mpps {
+			compatible = "qcom,qpnp-pin";
+			gpio-controller;
+			#gpio-cells = <2>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			label = "pm8004-mpp";
+
+			mpp@a000 {
+				reg = <0xa000 0x100>;
+				qcom,pin-num = <1>;
+				status = "disabled";
+			};
+
+			mpp@a100 {
+				reg = <0xa100 0x100>;
+				qcom,pin-num = <2>;
+				status = "disabled";
+			};
+
+			mpp@a200 {
+				reg = <0xa200 0x100>;
+				qcom,pin-num = <3>;
+				status = "disabled";
+			};
+
+			mpp@a300 {
+				reg = <0xa300 0x100>;
+				qcom,pin-num = <4>;
+				status = "disabled";
+			};
+		};
+	};
+
+	qcom,pm8004@5 {
+		compatible ="qcom,spmi-pmic";
+		reg = <0x5 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-pm8005.dtsi b/arch/arm64/boot/dts/qcom/msm-pm8005.dtsi
new file mode 100644
index 000000000000..e9ef73c43610
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-pm8005.dtsi
@@ -0,0 +1,103 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/spmi/spmi.h>
+#include <dt-bindings/interrupt-controller/irq.h>
+
+&spmi_bus {
+	qcom,pm8005@4 {
+		compatible = "qcom,spmi-pmic";
+		reg = <0x4 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		pm8005_revid: qcom,revid@100 {
+			compatible = "qcom,qpnp-revid";
+			reg = <0x100 0x100>;
+		};
+
+		qcom,temp-alarm@2400 {
+			compatible = "qcom,qpnp-temp-alarm";
+			reg = <0x2400 0x100>;
+			interrupts = <0x4 0x24 0x0 IRQ_TYPE_EDGE_RISING>;
+			label = "pm8005_tz";
+		};
+
+		pm8005_gpios: gpios {
+			compatible = "qcom,qpnp-pin";
+			gpio-controller;
+			#gpio-cells = <2>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			label = "pm8005-gpio";
+
+			gpio@c000 {
+				reg = <0xc000 0x100>;
+				qcom,pin-num = <1>;
+				status = "disabled";
+			};
+
+			gpio@c100 {
+				reg = <0xc100 0x100>;
+				qcom,pin-num = <2>;
+				status = "disabled";
+			};
+
+			gpio@c200 {
+				reg = <0xc200 0x100>;
+				qcom,pin-num = <3>;
+				status = "disabled";
+			};
+
+			gpio@c300 {
+				reg = <0xc300 0x100>;
+				qcom,pin-num = <4>;
+				status = "disabled";
+			};
+		};
+	};
+
+	qcom,pm8005@5 {
+		compatible ="qcom,spmi-pmic";
+		reg = <0x5 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		regulator@1400 {
+			compatible = "qcom,qpnp-regulator";
+			reg = <0x1400 0x100>;
+			regulator-name = "pm8005_s1";
+			status = "disabled";
+		};
+
+		regulator@1700 {
+			compatible = "qcom,qpnp-regulator";
+			reg = <0x1700 0x100>;
+			regulator-name = "pm8005_s2";
+			status = "disabled";
+		};
+
+		regulator@1a00 {
+			compatible = "qcom,qpnp-regulator";
+			reg = <0x1a00 0x100>;
+			regulator-name = "pm8005_s3";
+			status = "disabled";
+		};
+
+		regulator@1d00 {
+			compatible = "qcom,qpnp-regulator";
+			reg = <0x1d00 0x100>;
+			regulator-name = "pm8005_s4";
+			status = "disabled";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-pm8994-rpm-regulator.dtsi b/arch/arm64/boot/dts/qcom/msm-pm8994-rpm-regulator.dtsi
new file mode 100644
index 000000000000..711ff81d1c3b
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-pm8994-rpm-regulator.dtsi
@@ -0,0 +1,658 @@
+/* Copyright (c) 2014, 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&rpm_bus {
+	rpm-regulator-smpa1 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpa";
+		qcom,resource-id = <1>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s1 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_s1";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpa2 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpa";
+		qcom,resource-id = <2>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s2 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_s2";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpa3 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpa";
+		qcom,resource-id = <3>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s3 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_s3";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpa4 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpa";
+		qcom,resource-id = <4>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s4 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_s4";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpa5 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpa";
+		qcom,resource-id = <5>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s5 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_s5";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpa7 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpa";
+		qcom,resource-id = <7>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s7 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_s7";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa1 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <1>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l1 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l1";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa2 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <2>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l2 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l2";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa3 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <3>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l3 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l3";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa4 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <4>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l4 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l4";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa6 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <6>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l6 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l6";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa8 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <8>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l8 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l8";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa9 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <9>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l9 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l9";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa10 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <10>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l10 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l10";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa11 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <11>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l11 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l11";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa12 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <12>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l12 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l12";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa13 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <13>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l13 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l13";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa14 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <14>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l14 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l14";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa15 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <15>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l15 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l15";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa16 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <16>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l16 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l16";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa17 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <17>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l17 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l17";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa18 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <18>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l18 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l18";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa19 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <19>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l19 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l19";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa20 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <20>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l20 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l20";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa21 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <21>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l21 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l21";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa22 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <22>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l22 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l22";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa23 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <23>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l23 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l23";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa24 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <24>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l24 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l24";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa25 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <25>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l25 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l25";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa26 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <26>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l26 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l26";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa27 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <27>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l27 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l27";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa28 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <28>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l28 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l28";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa29 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <29>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l29 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l29";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa30 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <30>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l30 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l30";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa31 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <31>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l31 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l31";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa32 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <32>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l32 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l32";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-vsa1 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "vsa";
+		qcom,resource-id = <1>;
+		qcom,regulator-type = <2>;
+		status = "disabled";
+
+		regulator-lvs1 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_lvs1";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-vsa2 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "vsa";
+		qcom,resource-id = <2>;
+		qcom,regulator-type = <2>;
+		status = "disabled";
+
+		regulator-lvs2 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_lvs2";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpb1 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpb";
+		qcom,resource-id = <1>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s1 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pmi8994_s1";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpb2 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpb";
+		qcom,resource-id = <2>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s2 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pmi8994_s2";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-bstb {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "bstb";
+		qcom,resource-id = <1>;
+		qcom,regulator-type = <2>;
+		status = "disabled";
+
+		regulator-bst {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pmi8994_boost";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-bbyb {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "bbyb";
+		qcom,resource-id = <1>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-bby {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pmi8994_boostbypass";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpc2 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpc";
+		qcom,resource-id = <2>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s2 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8004_s2";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-pm8994.dtsi b/arch/arm64/boot/dts/qcom/msm-pm8994.dtsi
new file mode 100644
index 000000000000..525852ce1f76
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-pm8994.dtsi
@@ -0,0 +1,431 @@
+/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/spmi/spmi.h>
+#include <dt-bindings/interrupt-controller/irq.h>
+
+&spmi_bus {
+	qcom,pm8994@0 {
+		compatible ="qcom,spmi-pmic";
+		reg = <0x0 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		pm8994_revid: qcom,revid@100 {
+			compatible = "qcom,qpnp-revid";
+			reg = <0x100 0x100>;
+		};
+
+		qcom,temp-alarm@2400 {
+			compatible = "qcom,qpnp-temp-alarm";
+			reg = <0x2400 0x100>;
+			interrupts = <0x0 0x24 0x0 IRQ_TYPE_NONE>;
+			label = "pm8994_tz";
+			qcom,channel-num = <8>;
+			qcom,threshold-set = <0>;
+			qcom,temp_alarm-vadc = <&pm8994_vadc>;
+		};
+
+		qcom,power-on@800 {
+			compatible = "qcom,qpnp-power-on";
+			reg = <0x800 0x100>;
+			interrupts = <0x0 0x8 0x0 IRQ_TYPE_NONE>,
+				     <0x0 0x8 0x1 IRQ_TYPE_NONE>,
+				     <0x0 0x8 0x4 IRQ_TYPE_NONE>,
+				     <0x0 0x8 0x5 IRQ_TYPE_NONE>;
+			interrupt-names = "kpdpwr", "resin",
+					"resin-bark", "kpdpwr-resin-bark";
+			qcom,pon-dbc-delay = <15625>;
+			qcom,system-reset;
+			qcom,store-hard-reset-reason;
+
+			qcom,pon_1 {
+				qcom,pon-type = <0>;
+				qcom,pull-up = <1>;
+				linux,code = <116>;
+				qcom,support-reset = <1>;
+				qcom,s1-timer = <10256>;
+				qcom,s2-timer = <2000>;
+				qcom,s2-type = <1>;
+			};
+
+			qcom,pon_2 {
+				qcom,pon-type = <1>;
+				qcom,pull-up = <1>;
+				linux,code = <114>;
+			};
+
+			qcom,pon_3 {
+				qcom,pon-type = <3>;
+				qcom,support-reset = <1>;
+				qcom,pull-up = <1>;
+				qcom,s1-timer = <6720>;
+				qcom,s2-timer = <2000>;
+				qcom,s2-type = <7>;
+				qcom,use-bark;
+			};
+		};
+
+		pm8994_gpios: gpios {
+			compatible = "qcom,qpnp-pin";
+			gpio-controller;
+			#gpio-cells = <2>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			label = "pm8994-gpio";
+
+			gpio@c000 {
+				reg = <0xc000 0x100>;
+				qcom,pin-num = <1>;
+				status = "disabled";
+			};
+
+			gpio@c100 {
+				reg = <0xc100 0x100>;
+				qcom,pin-num = <2>;
+				status = "disabled";
+			};
+
+			gpio@c200 {
+				reg = <0xc200 0x100>;
+				qcom,pin-num = <3>;
+				status = "disabled";
+			};
+
+			gpio@c300 {
+				reg = <0xc300 0x100>;
+				qcom,pin-num = <4>;
+				status = "disabled";
+			};
+
+			gpio@c400 {
+				reg = <0xc400 0x100>;
+				qcom,pin-num = <5>;
+				status = "disabled";
+			};
+
+			gpio@c500 {
+				reg = <0xc500 0x100>;
+				qcom,pin-num = <6>;
+				status = "disabled";
+			};
+
+			gpio@c600 {
+				reg = <0xc600 0x100>;
+				qcom,pin-num = <7>;
+				status = "disabled";
+			};
+
+			gpio@c700 {
+				reg = <0xc700 0x100>;
+				qcom,pin-num = <8>;
+				status = "disabled";
+			};
+
+			gpio@c800 {
+				reg = <0xc800 0x100>;
+				qcom,pin-num = <9>;
+				status = "disabled";
+			};
+
+			gpio@c900 {
+				reg = <0xc900 0x100>;
+				qcom,pin-num = <10>;
+				status = "disabled";
+			};
+
+			gpio@ca00 {
+				reg = <0xca00 0x100>;
+				qcom,pin-num = <11>;
+				status = "disabled";
+			};
+
+			gpio@cb00 {
+				reg = <0xcb00 0x100>;
+				qcom,pin-num = <12>;
+				status = "disabled";
+			};
+
+			gpio@cc00 {
+				reg = <0xcc00 0x100>;
+				qcom,pin-num = <13>;
+				status = "disabled";
+			};
+
+			gpio@cd00 {
+				reg = <0xcd00 0x100>;
+				qcom,pin-num = <14>;
+				status = "disabled";
+			};
+
+			gpio@ce00 {
+				reg = <0xce00 0x100>;
+				qcom,pin-num = <15>;
+				status = "disabled";
+			};
+
+			gpio@cf00 {
+				reg = <0xcf00 0x100>;
+				qcom,pin-num = <16>;
+				status = "disabled";
+			};
+
+			gpio@d000 {
+				reg = <0xd000 0x100>;
+				qcom,pin-num = <17>;
+				status = "disabled";
+			};
+
+			gpio@d100 {
+				reg = <0xd100 0x100>;
+				qcom,pin-num = <18>;
+				status = "disabled";
+			};
+
+			gpio@d200 {
+				reg = <0xd200 0x100>;
+				qcom,pin-num = <19>;
+				status = "disabled";
+			};
+
+			gpio@d300 {
+				reg = <0xd300 0x100>;
+				qcom,pin-num = <20>;
+				status = "disabled";
+			};
+
+			gpio@d500 {
+				reg = <0xd500 0x100>;
+				qcom,pin-num = <22>;
+				status = "disabled";
+			};
+		};
+
+		pm8994_mpps: mpps {
+			compatible = "qcom,qpnp-pin";
+			gpio-controller;
+			#gpio-cells = <2>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			label = "pm8994-mpp";
+
+			mpp@a000 {
+				reg = <0xa000 0x100>;
+				qcom,pin-num = <1>;
+				status = "disabled";
+			};
+
+			mpp@a100 {
+				reg = <0xa100 0x100>;
+				qcom,pin-num = <2>;
+				status = "disabled";
+			};
+
+			mpp@a200 {
+				reg = <0xa200 0x100>;
+				qcom,pin-num = <3>;
+				status = "disabled";
+			};
+
+			mpp@a300 {
+				reg = <0xa300 0x100>;
+				qcom,pin-num = <4>;
+				status = "disabled";
+			};
+
+			mpp@a400 {
+				reg = <0xa400 0x100>;
+				qcom,pin-num = <5>;
+				status = "disabled";
+			};
+
+			mpp@a500 {
+				reg = <0xa500 0x100>;
+				qcom,pin-num = <6>;
+				status = "disabled";
+			};
+
+			mpp@a600 {
+				reg = <0xa600 0x100>;
+				qcom,pin-num = <7>;
+				status = "disabled";
+			};
+
+			mpp@a700 {
+				reg = <0xa700 0x100>;
+				qcom,pin-num = <8>;
+				status = "disabled";
+			};
+		};
+
+		pm8994_vadc: vadc@3100 {
+			compatible = "qcom,qpnp-vadc";
+			reg = <0x3100 0x100>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts = <0x0 0x31 0x0 IRQ_TYPE_NONE>;
+			interrupt-names = "eoc-int-en-set";
+			qcom,adc-bit-resolution = <15>;
+			qcom,adc-vdd-reference = <1800>;
+			qcom,vadc-poll-eoc;
+
+			chan@8 {
+				label = "die_temp";
+				reg = <8>;
+				qcom,decimation = <0>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "absolute";
+				qcom,scale-function = <3>;
+				qcom,hw-settle-time = <0>;
+				qcom,fast-avg-setup = <0>;
+			};
+
+			chan@9 {
+				label = "ref_625mv";
+				reg = <9>;
+				qcom,decimation = <0>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "absolute";
+				qcom,scale-function = <0>;
+				qcom,hw-settle-time = <0>;
+				qcom,fast-avg-setup = <0>;
+			};
+
+			chan@a {
+				label = "ref_1250v";
+				reg = <0xa>;
+				qcom,decimation = <0>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "absolute";
+				qcom,scale-function = <0>;
+				qcom,hw-settle-time = <0>;
+				qcom,fast-avg-setup = <0>;
+			};
+		};
+
+		pm8994_adc_tm: vadc@3400 {
+			compatible = "qcom,qpnp-adc-tm";
+			reg = <0x3400 0x100>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts =	<0x0 0x34 0x0 IRQ_TYPE_NONE>,
+					<0x0 0x34 0x3 IRQ_TYPE_NONE>,
+				     <0x0 0x34 0x4 IRQ_TYPE_NONE>;
+			interrupt-names =	"eoc-int-en-set",
+						"high-thr-en-set",
+						"low-thr-en-set";
+			qcom,adc-bit-resolution = <15>;
+			qcom,adc-vdd-reference = <1800>;
+			qcom,adc_tm-vadc = <&pm8994_vadc>;
+		};
+
+		pm8994_coincell: qcom,coincell@2800 {
+			compatible = "qcom,qpnp-coincell";
+			reg = <0x2800 0x100>;
+		};
+
+		pm8994_rtc: qcom,pm8994_rtc {
+			compatible = "qcom,qpnp-rtc";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			qcom,qpnp-rtc-write = <0>;
+			qcom,qpnp-rtc-alarm-pwrup = <0>;
+
+			qcom,pm8994_rtc_rw@6000 {
+				reg = <0x6000 0x100>;
+			};
+			qcom,pm8994_rtc_alarm@6100 {
+				reg = <0x6100 0x100>;
+				interrupts = <0x0 0x61 0x1 IRQ_TYPE_NONE>;
+			};
+		};
+	};
+
+	qcom,pm8994@1 {
+		compatible ="qcom,spmi-pmic";
+		reg = <0x1 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		pwm@b100 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb100 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base", "qpnp-lpg-lut-base";
+			qcom,channel-id = <0>;
+			qcom,supported-sizes = <6>, <7>, <9>;
+			qcom,ramp-index = <0>;
+			#pwm-cells = <2>;
+			status = "disabled";
+		};
+
+		pwm@b200 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb200 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base", "qpnp-lpg-lut-base";
+			qcom,channel-id = <1>;
+			qcom,supported-sizes = <6>, <7>, <9>;
+			qcom,ramp-index = <1>;
+			#pwm-cells = <2>;
+			status = "disabled";
+		};
+
+		pwm@b300 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb300 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base", "qpnp-lpg-lut-base";
+			qcom,channel-id = <2>;
+			qcom,supported-sizes = <6>, <7>, <9>;
+			qcom,ramp-index = <2>;
+			#pwm-cells = <2>;
+			status = "disabled";
+		};
+
+		pwm@b400 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb400 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base", "qpnp-lpg-lut-base";
+			qcom,channel-id = <3>;
+			qcom,supported-sizes = <6>, <7>, <9>;
+			qcom,ramp-index = <3>;
+			#pwm-cells = <2>;
+			status = "disabled";
+		};
+
+		pwm@b500 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb500 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base", "qpnp-lpg-lut-base";
+			qcom,channel-id = <4>;
+			qcom,supported-sizes = <6>, <7>, <9>;
+			qcom,ramp-index = <4>;
+			#pwm-cells = <2>;
+			status = "disabled";
+		};
+
+		pwm@b600 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb600 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base", "qpnp-lpg-lut-base";
+			qcom,channel-id = <5>;
+			qcom,supported-sizes = <6>, <7>, <9>;
+			qcom,ramp-index = <5>;
+			#pwm-cells = <2>;
+			status = "disabled";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-pm8998-rpm-regulator.dtsi b/arch/arm64/boot/dts/qcom/msm-pm8998-rpm-regulator.dtsi
new file mode 100644
index 000000000000..5ad84dbfcff6
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-pm8998-rpm-regulator.dtsi
@@ -0,0 +1,600 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&rpm_bus {
+	/* PM8998 S1 + S6 = VDD_CX supply */
+	rpm-regulator-smpa1 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "rwcx";
+		qcom,resource-id = <0>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s1 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_s1";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpa2 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpa";
+		qcom,resource-id = <2>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s2 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_s2";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpa3 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpa";
+		qcom,resource-id = <3>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s3 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_s3";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpa4 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpa";
+		qcom,resource-id = <4>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s4 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_s4";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpa5 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpa";
+		qcom,resource-id = <5>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s5 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_s5";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpa7 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpa";
+		qcom,resource-id = <7>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s7 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_s7";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-smpa8 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "smpa";
+		qcom,resource-id = <8>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s8 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_s8";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	/* PM8998 S9 = VDD_MX supply */
+	rpm-regulator-smpa9 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "rwmx";
+		qcom,resource-id = <0>;
+		qcom,regulator-type = <1>;
+		status = "disabled";
+
+		regulator-s9 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_s9";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa1 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <1>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l1 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l1";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa2 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <2>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l2 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l2";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa3 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <3>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l3 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l3";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa4 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "rwsm";
+		qcom,resource-id = <0>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l4 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l4";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa5 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <5>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l5 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l5";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa6 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <6>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l6 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l6";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa7 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <7>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l7 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l7";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa8 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <8>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l8 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l8";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa9 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <9>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l9 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l9";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa10 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <10>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l10 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l10";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa11 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <11>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l11 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l11";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa12 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <12>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l12 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l12";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa13 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <13>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l13 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l13";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa14 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <14>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l14 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l14";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa15 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <15>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l15 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l15";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa16 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <16>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l16 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l16";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa17 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <17>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l17 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l17";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa18 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <18>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l18 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l18";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa19 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <19>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l19 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l19";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa20 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <20>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l20 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l20";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa21 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <21>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l21 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l21";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa22 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <22>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l22 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l22";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa23 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <23>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l23 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l23";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa24 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <24>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l24 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l24";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa25 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <25>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l25 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l25";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa26 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <26>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l26 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l26";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa27 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "rwsc";
+		qcom,resource-id = <0>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l27 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l27";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-ldoa28 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "ldoa";
+		qcom,resource-id = <28>;
+		qcom,regulator-type = <0>;
+		status = "disabled";
+
+		regulator-l28 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l28";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-vsa1 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "vsa";
+		qcom,resource-id = <1>;
+		qcom,regulator-type = <2>;
+		status = "disabled";
+
+		regulator-lvs1 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_lvs1";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-vsa2 {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "vsa";
+		qcom,resource-id = <2>;
+		qcom,regulator-type = <2>;
+		status = "disabled";
+
+		regulator-lvs2 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_lvs2";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+
+	rpm-regulator-bobb {
+		compatible = "qcom,rpm-smd-regulator-resource";
+		qcom,resource-name = "bobb";
+		qcom,resource-id = <1>;
+		qcom,regulator-type = <4>;
+		status = "disabled";
+
+		regulator-bob {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_bob";
+			qcom,set = <3>;
+			status = "disabled";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-pm8998.dtsi b/arch/arm64/boot/dts/qcom/msm-pm8998.dtsi
new file mode 100644
index 000000000000..961ef2bf1320
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-pm8998.dtsi
@@ -0,0 +1,329 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/spmi/spmi.h>
+#include <dt-bindings/interrupt-controller/irq.h>
+#include <dt-bindings/msm/power-on.h>
+
+&spmi_bus {
+	qcom,pm8998@0 {
+		compatible ="qcom,spmi-pmic";
+		reg = <0x0 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		pm8998_revid: qcom,revid@100 {
+			compatible = "qcom,qpnp-revid";
+			reg = <0x100 0x100>;
+		};
+
+		qcom,power-on@800 {
+			compatible = "qcom,qpnp-power-on";
+			reg = <0x800 0x100>;
+			interrupts = <0x0 0x8 0x0 IRQ_TYPE_NONE>,
+				     <0x0 0x8 0x1 IRQ_TYPE_NONE>,
+				     <0x0 0x8 0x4 IRQ_TYPE_NONE>,
+				     <0x0 0x8 0x5 IRQ_TYPE_NONE>;
+			interrupt-names = "kpdpwr", "resin",
+					"resin-bark", "kpdpwr-resin-bark";
+			qcom,pon-dbc-delay = <15625>;
+			qcom,system-reset;
+			qcom,store-hard-reset-reason;
+			qcom,kpdpwr-sw-debounce;
+
+			qcom,pon_1 {
+				qcom,pon-type = <0>;
+				qcom,pull-up = <1>;
+				linux,code = <116>;
+			};
+
+			qcom,pon_2 {
+				qcom,pon-type = <1>;
+				qcom,pull-up = <1>;
+				linux,code = <114>;
+			};
+
+			qcom,pon_3 {
+				qcom,pon-type = <3>;
+				qcom,support-reset = <1>;
+				qcom,pull-up = <1>;
+				qcom,s1-timer = <6720>;
+				qcom,s2-timer = <2000>;
+				qcom,s2-type = <PON_POWER_OFF_DVDD_HARD_RESET>;
+				qcom,use-bark;
+			};
+		};
+
+		qcom,temp-alarm@2400 {
+			compatible = "qcom,qpnp-temp-alarm";
+			reg = <0x2400 0x100>;
+			interrupts = <0x0 0x24 0x0 IRQ_TYPE_EDGE_RISING>;
+			label = "pm8998_tz";
+			qcom,channel-num = <6>;
+			qcom,temp_alarm-vadc = <&pm8998_vadc>;
+		};
+
+		pm8998_gpios: gpios {
+			compatible = "qcom,qpnp-pin";
+			gpio-controller;
+			#gpio-cells = <2>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			label = "pm8998-gpio";
+
+			gpio@c000 {
+				reg = <0xc000 0x100>;
+				qcom,pin-num = <1>;
+				status = "disabled";
+			};
+
+			gpio@c100 {
+				reg = <0xc100 0x100>;
+				qcom,pin-num = <2>;
+				status = "disabled";
+			};
+
+			gpio@c200 {
+				reg = <0xc200 0x100>;
+				qcom,pin-num = <3>;
+				status = "disabled";
+			};
+
+			gpio@c300 {
+				reg = <0xc300 0x100>;
+				qcom,pin-num = <4>;
+				status = "disabled";
+			};
+
+			gpio@c400 {
+				reg = <0xc400 0x100>;
+				qcom,pin-num = <5>;
+				status = "disabled";
+			};
+
+			gpio@c500 {
+				reg = <0xc500 0x100>;
+				qcom,pin-num = <6>;
+				status = "disabled";
+			};
+
+			gpio@c600 {
+				reg = <0xc600 0x100>;
+				qcom,pin-num = <7>;
+				status = "disabled";
+			};
+
+			gpio@c700 {
+				reg = <0xc700 0x100>;
+				qcom,pin-num = <8>;
+				status = "disabled";
+			};
+
+			gpio@c800 {
+				reg = <0xc800 0x100>;
+				qcom,pin-num = <9>;
+				status = "disabled";
+			};
+
+			gpio@c900 {
+				reg = <0xc900 0x100>;
+				qcom,pin-num = <10>;
+				status = "disabled";
+			};
+
+			gpio@ca00 {
+				reg = <0xca00 0x100>;
+				qcom,pin-num = <11>;
+				status = "disabled";
+			};
+
+			gpio@cb00 {
+				reg = <0xcb00 0x100>;
+				qcom,pin-num = <12>;
+				status = "disabled";
+			};
+
+			gpio@cc00 {
+				reg = <0xcc00 0x100>;
+				qcom,pin-num = <13>;
+				status = "disabled";
+			};
+
+			gpio@cd00 {
+				reg = <0xcd00 0x100>;
+				qcom,pin-num = <14>;
+				status = "disabled";
+			};
+
+			gpio@ce00 {
+				reg = <0xce00 0x100>;
+				qcom,pin-num = <15>;
+				status = "disabled";
+			};
+
+			gpio@cf00 {
+				reg = <0xcf00 0x100>;
+				qcom,pin-num = <16>;
+				status = "disabled";
+			};
+
+			gpio@d000 {
+				reg = <0xd000 0x100>;
+				qcom,pin-num = <17>;
+				status = "disabled";
+			};
+
+			gpio@d100 {
+				reg = <0xd100 0x100>;
+				qcom,pin-num = <18>;
+				status = "disabled";
+			};
+
+			gpio@d200 {
+				reg = <0xd200 0x100>;
+				qcom,pin-num = <19>;
+				status = "disabled";
+			};
+
+			gpio@d300 {
+				reg = <0xd300 0x100>;
+				qcom,pin-num = <20>;
+				status = "disabled";
+			};
+
+			gpio@d400 {
+				reg = <0xd400 0x100>;
+				qcom,pin-num = <21>;
+				status = "disabled";
+			};
+
+			gpio@d500 {
+				reg = <0xd500 0x100>;
+				qcom,pin-num = <22>;
+				status = "disabled";
+			};
+
+			gpio@d600 {
+				reg = <0xd600 0x100>;
+				qcom,pin-num = <23>;
+				status = "disabled";
+			};
+
+			gpio@d700 {
+				reg = <0xd700 0x100>;
+				qcom,pin-num = <24>;
+				status = "disabled";
+			};
+
+			gpio@d800 {
+				reg = <0xd800 0x100>;
+				qcom,pin-num = <25>;
+				status = "disabled";
+			};
+
+			gpio@d900 {
+				reg = <0xd900 0x100>;
+				qcom,pin-num = <26>;
+				status = "disabled";
+			};
+		};
+
+		pm8998_coincell: qcom,coincell@2800 {
+			compatible = "qcom,qpnp-coincell";
+			reg = <0x2800 0x100>;
+		};
+
+		pm8998_rtc: qcom,pm8998_rtc {
+			compatible = "qcom,qpnp-rtc";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			qcom,qpnp-rtc-write = <0>;
+			qcom,qpnp-rtc-alarm-pwrup = <0>;
+
+			qcom,pm8998_rtc_rw@6000 {
+				reg = <0x6000 0x100>;
+			};
+			qcom,pm8998_rtc_alarm@6100 {
+				reg = <0x6100 0x100>;
+				interrupts = <0x0 0x61 0x1 IRQ_TYPE_NONE>;
+			};
+		};
+
+		pm8998_vadc: vadc@3100 {
+			compatible = "qcom,qpnp-vadc-hc";
+			reg = <0x3100 0x100>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts = <0x0 0x31 0x0 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "eoc-int-en-set";
+			qcom,adc-bit-resolution = <15>;
+			qcom,adc-vdd-reference = <1875>;
+
+			chan@6 {
+				label = "die_temp";
+				reg = <6>;
+				qcom,decimation = <2>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "absolute";
+				qcom,scale-function = <3>;
+				qcom,hw-settle-time = <0>;
+				qcom,fast-avg-setup = <0>;
+				qcom,cal-val = <0>;
+			};
+
+			chan@0 {
+				label = "ref_gnd";
+				reg = <0>;
+				qcom,decimation = <2>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "absolute";
+				qcom,scale-function = <0>;
+				qcom,hw-settle-time = <0>;
+				qcom,fast-avg-setup = <0>;
+				qcom,cal-val = <0>;
+			};
+
+			chan@1 {
+				label = "ref_1250v";
+				reg = <1>;
+				qcom,decimation = <2>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "absolute";
+				qcom,scale-function = <0>;
+				qcom,hw-settle-time = <0>;
+				qcom,fast-avg-setup = <0>;
+				qcom,cal-val = <0>;
+			};
+		};
+
+		pm8998_adc_tm: vadc@3400 {
+			compatible = "qcom,qpnp-adc-tm-hc";
+			reg = <0x3400 0x100>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts = <0x0 0x34 0x0 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "eoc-int-en-set";
+			qcom,adc-bit-resolution = <15>;
+			qcom,adc-vdd-reference = <1875>;
+			qcom,adc_tm-vadc = <&pm8998_vadc>;
+			qcom,decimation = <0>;
+			qcom,fast-avg-setup = <0>;
+		};
+	};
+
+	qcom,pm8998@1 {
+		compatible ="qcom,spmi-pmic";
+		reg = <0x1 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-pmi8994.dtsi b/arch/arm64/boot/dts/qcom/msm-pmi8994.dtsi
new file mode 100644
index 000000000000..73ea5fae041e
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-pmi8994.dtsi
@@ -0,0 +1,699 @@
+/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/irq.h>
+#include <dt-bindings/spmi/spmi.h>
+
+&spmi_bus {
+	qcom,pmi8994@2 {
+		compatible = "qcom,spmi-pmic";
+		reg = <0x2 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		pmi8994_revid: qcom,revid@100 {
+			compatible = "qcom,qpnp-revid";
+			reg = <0x100 0x100>;
+		};
+
+		qcom,power-on@800 {
+			compatible = "qcom,qpnp-power-on";
+			reg = <0x800 0x100>;
+			qcom,secondary-pon-reset;
+			pon_perph_reg: qcom,pon_perph_reg {
+				regulator-name = "pon_spare_reg";
+				qcom,pon-spare-reg-addr = <0x8c>;
+				qcom,pon-spare-reg-bit = <1>;
+			};
+		};
+
+		pmi8994_gpios: gpios {
+			compatible = "qcom,qpnp-pin";
+			gpio-controller;
+			#gpio-cells = <2>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			label = "pmi8994-gpio";
+
+			gpio@c000 {
+				reg = <0xc000 0x100>;
+				qcom,pin-num = <1>;
+				status = "disabled";
+			};
+
+			gpio@c100 {
+				reg = <0xc100 0x100>;
+				qcom,pin-num = <2>;
+				status = "disabled";
+			};
+
+			gpio@c200 {
+				reg = <0xc200 0x100>;
+				qcom,pin-num = <3>;
+				status = "disabled";
+			};
+
+			gpio@c300 {
+				reg = <0xc300 0x100>;
+				qcom,pin-num = <4>;
+				status = "disabled";
+			};
+
+			gpio@c400 {
+				reg = <0xc400 0x100>;
+				qcom,pin-num = <5>;
+				status = "disabled";
+			};
+
+			gpio@c500 {
+				reg = <0xc500 0x100>;
+				qcom,pin-num = <6>;
+				status = "disabled";
+			};
+
+			gpio@c600 {
+				reg = <0xc600 0x100>;
+				qcom,pin-num = <7>;
+				status = "disabled";
+			};
+
+			gpio@c700 {
+				reg = <0xc700 0x100>;
+				qcom,pin-num = <8>;
+				status = "disabled";
+			};
+
+			gpio@c800 {
+				reg = <0xc800 0x100>;
+				qcom,pin-num = <9>;
+				status = "disabled";
+			};
+
+			gpio@c900 {
+				reg = <0xc900 0x100>;
+				qcom,pin-num = <10>;
+				status = "disabled";
+			};
+		};
+
+		pmi8994_mpps: mpps {
+			compatible = "qcom,qpnp-pin";
+			gpio-controller;
+			#gpio-cells = <2>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			label = "pmi8994-mpp";
+
+			mpp@a000 {
+				reg = <0xa000 0x100>;
+				qcom,pin-num = <1>;
+				status = "disabled";
+			};
+
+			mpp@a100 {
+				reg = <0xa100 0x100>;
+				qcom,pin-num = <2>;
+				status = "disabled";
+			};
+
+			mpp@a200 {
+				reg = <0xa200 0x100>;
+				qcom,pin-num = <3>;
+				status = "disabled";
+			};
+
+			mpp@a300 {
+				reg = <0xa300 0x100>;
+				qcom,pin-num = <4>;
+				status = "disabled";
+			};
+		};
+
+		bcl@4200 {
+			compatible = "qcom,msm-bcl";
+			reg = <0x4200 0xFF 0x88E 0x2>;
+			reg-names = "fg_user_adc", "pon_spare";
+			interrupts = <0x2 0x42 0x0 IRQ_TYPE_NONE>,
+					<0x2 0x42 0x1 IRQ_TYPE_NONE>;
+			interrupt-names = "bcl-high-ibat-int",
+					"bcl-low-vbat-int";
+			qcom,vbat-scaling-factor = <39000>;
+			qcom,vbat-gain-numerator = <1>;
+			qcom,vbat-gain-denominator = <128>;
+			qcom,vbat-polling-delay-ms = <100>;
+			qcom,ibat-scaling-factor = <39000>;
+			qcom,ibat-gain-numerator = <1>;
+			qcom,ibat-gain-denominator = <128>;
+			qcom,ibat-offset-numerator = <1200>;
+			qcom,ibat-offset-denominator = <1>;
+			qcom,ibat-polling-delay-ms = <100>;
+			qcom,inhibit-derating-ua = <550000>;
+		};
+
+		pmi8994_vadc: vadc@3100 {
+			compatible = "qcom,qpnp-vadc";
+			reg = <0x3100 0x100>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			interrupts = <0x2 0x31 0x0 IRQ_TYPE_NONE>,
+					<0x2 0x31 0x3 IRQ_TYPE_NONE>,
+				     <0x2 0x31 0x4 IRQ_TYPE_NONE>;
+			interrupt-names =	"eoc-int-en-set",
+						"high-thr-en-set",
+						"low-thr-en-set";
+			qcom,adc-bit-resolution = <15>;
+			qcom,adc-vdd-reference = <1800>;
+			qcom,vadc-poll-eoc;
+			qcom,vadc-meas-int-mode;
+			qcom,pmic-revid = <&pmi8994_revid>;
+
+			chan@d {
+				label = "chg_temp";
+				reg = <0xd>;
+				qcom,decimation = <0>;
+				qcom,pre-div-channel-scaling = <0>;
+				qcom,calibration-type = "absolute";
+				qcom,scale-function = <16>;
+				qcom,hw-settle-time = <0>;
+				qcom,fast-avg-setup = <0>;
+			};
+		};
+
+		pmi8994_charger: qcom,qpnp-smbcharger {
+			compatible = "qcom,qpnp-smbcharger";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			qcom,iterm-ma = <100>;
+			qcom,fastchg-current-ma = <2000>;
+			qcom,float-voltage-mv = <4350>;
+			qcom,resume-delta-mv = <200>;
+			qcom,chg-inhibit-fg;
+			qcom,dc-psy-type = "Mains";
+			qcom,dc-psy-ma = <1500>;
+			qcom,rparasitic-uohm = <100000>;
+			qcom,bms-psy-name = "bms";
+			qcom,thermal-mitigation = <1500 700 600 0>;
+			qcom,parallel-usb-min-current-ma = <1400>;
+			qcom,parallel-usb-9v-min-current-ma = <900>;
+			qcom,parallel-allowed-lowering-ma = <500>;
+			qcom,autoadjust-vfloat;
+			qcom,pmic-revid = <&pmi8994_revid>;
+			qcom,force-aicl-rerun;
+			qcom,aicl-rerun-period-s = <180>;
+
+			qcom,chgr@1000 {
+				reg = <0x1000 0x100>;
+				interrupts =	<0x2 0x10 0x0 IRQ_TYPE_NONE>,
+						<0x2 0x10 0x1 IRQ_TYPE_NONE>,
+						<0x2 0x10 0x2 IRQ_TYPE_NONE>,
+						<0x2 0x10 0x3 IRQ_TYPE_NONE>,
+						<0x2 0x10 0x4 IRQ_TYPE_NONE>,
+						<0x2 0x10 0x5 IRQ_TYPE_NONE>,
+						<0x2 0x10 0x6 IRQ_TYPE_NONE>,
+						<0x2 0x10 0x7 IRQ_TYPE_NONE>;
+
+				interrupt-names =	"chg-error",
+							"chg-inhibit",
+							"chg-prechg-sft",
+							"chg-complete-chg-sft",
+							"chg-p2f-thr",
+							"chg-rechg-thr",
+							"chg-taper-thr",
+							"chg-tcc-thr";
+			};
+
+			qcom,otg@1100 {
+				reg = <0x1100 0x100>;
+			};
+
+			qcom,bat-if@1200 {
+				reg = <0x1200 0x100>;
+				interrupts =	<0x2 0x12 0x0 IRQ_TYPE_NONE>,
+						<0x2 0x12 0x1 IRQ_TYPE_NONE>,
+						<0x2 0x12 0x2 IRQ_TYPE_NONE>,
+						<0x2 0x12 0x3 IRQ_TYPE_NONE>,
+						<0x2 0x12 0x4 IRQ_TYPE_NONE>,
+						<0x2 0x12 0x5 IRQ_TYPE_NONE>,
+						<0x2 0x12 0x6 IRQ_TYPE_NONE>,
+						<0x2 0x12 0x7 IRQ_TYPE_NONE>;
+
+				interrupt-names =	"batt-hot",
+							"batt-warm",
+							"batt-cold",
+							"batt-cool",
+							"batt-ov",
+							"batt-low",
+							"batt-missing",
+							"batt-term-missing";
+			};
+
+			qcom,usb-chgpth@1300 {
+				reg = <0x1300 0x100>;
+				interrupts =	<0x2 0x13 0x0 IRQ_TYPE_NONE>,
+						<0x2 0x13 0x1 IRQ_TYPE_NONE>,
+						<0x2 0x13 0x2 IRQ_TYPE_NONE>,
+						<0x2 0x13 0x3 IRQ_TYPE_NONE>,
+						<0x2 0x13 0x4 IRQ_TYPE_NONE>,
+						<0x2 0x13 0x5 IRQ_TYPE_NONE>,
+						<0x2 0x13 0x6 IRQ_TYPE_NONE>;
+
+				interrupt-names =	"usbin-uv",
+							"usbin-ov",
+							"usbin-src-det",
+							"otg-fail",
+							"otg-oc",
+							"aicl-done",
+							"usbid-change";
+			};
+
+			qcom,dc-chgpth@1400 {
+				reg = <0x1400 0x100>;
+				interrupts =	<0x2 0x14 0x0 IRQ_TYPE_NONE>,
+						<0x2 0x14 0x1 IRQ_TYPE_NONE>;
+
+				interrupt-names =	"dcin-uv",
+							"dcin-ov";
+			};
+
+			qcom,chgr-misc@1600 {
+				reg = <0x1600 0x100>;
+				interrupts =	<0x2 0x16 0x0 IRQ_TYPE_NONE>,
+						<0x2 0x16 0x1 IRQ_TYPE_NONE>,
+						<0x2 0x16 0x2 IRQ_TYPE_NONE>,
+						<0x2 0x16 0x3 IRQ_TYPE_NONE>,
+						<0x2 0x16 0x4 IRQ_TYPE_NONE>,
+						<0x2 0x16 0x5 IRQ_TYPE_NONE>;
+
+				interrupt-names =	"power-ok",
+							"temp-shutdown",
+							"wdog-timeout",
+							"flash-fail",
+							"otst2",
+							"otst3";
+			};
+		};
+
+		pmi8994_fg: qcom,fg {
+			compatible = "qcom,qpnp-fg";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			qcom,resume-soc = <95>;
+			status = "okay";
+			qcom,bcl-lm-threshold-ma = <127>;
+			qcom,bcl-mh-threshold-ma = <405>;
+			qcom,fg-iterm-ma = <125>;
+			qcom,fg-chg-iterm-ma = <100>;
+			qcom,cycle-counter-en;
+			qcom,capacity-learning-on;
+			qcom,fg-cc-cv-threshold-mv = <4340>;
+			qcom,pmic-revid = <&pmi8994_revid>;
+			qcom,capacity-learning-feedback;
+
+			qcom,fg-soc@4000 {
+				status = "okay";
+				reg = <0x4000 0x100>;
+				interrupts =	<0x2 0x40 0x0 IRQ_TYPE_NONE>,
+						<0x2 0x40 0x1 IRQ_TYPE_NONE>,
+						<0x2 0x40 0x2 IRQ_TYPE_NONE>,
+						<0x2 0x40 0x3 IRQ_TYPE_NONE>,
+						<0x2 0x40 0x4 IRQ_TYPE_NONE>,
+						<0x2 0x40 0x5 IRQ_TYPE_NONE>,
+						<0x2 0x40 0x6 IRQ_TYPE_NONE>,
+						<0x2 0x40 0x7 IRQ_TYPE_NONE>;
+
+				interrupt-names =	"high-soc",
+							"low-soc",
+							"full-soc",
+							"empty-soc",
+							"delta-soc",
+							"first-est-done",
+							"sw-fallbk-ocv",
+							"sw-fallbk-new-batt";
+			};
+
+			qcom,fg-batt@4100 {
+				reg = <0x4100 0x100>;
+				interrupts =	<0x2 0x41 0x0 IRQ_TYPE_NONE>,
+						<0x2 0x41 0x1 IRQ_TYPE_NONE>,
+						<0x2 0x41 0x2 IRQ_TYPE_NONE>,
+						<0x2 0x41 0x3 IRQ_TYPE_NONE>,
+						<0x2 0x41 0x4 IRQ_TYPE_NONE>,
+						<0x2 0x41 0x5 IRQ_TYPE_NONE>,
+						<0x2 0x41 0x6 IRQ_TYPE_NONE>,
+						<0x2 0x41 0x7 IRQ_TYPE_NONE>;
+
+				interrupt-names =	"soft-cold",
+							"soft-hot",
+							"vbatt-low",
+							"batt-ided",
+							"batt-id-req",
+							"batt-unknown",
+							"batt-missing",
+							"batt-match";
+			};
+
+			qcom,fg-adc-vbat@4254 {
+				reg = <0x4254 0x1>;
+			};
+
+			qcom,fg-adc-ibat@4255 {
+				reg = <0x4255 0x1>;
+			};
+
+			qcom,revid-tp-rev@1f1 {
+				reg = <0x1f1 0x1>;
+			};
+
+			qcom,fg-memif@4400 {
+				status = "okay";
+				reg = <0x4400 0x100>;
+				interrupts =	<0x2 0x44 0x0 IRQ_TYPE_NONE>,
+						<0x2 0x44 0x1 IRQ_TYPE_NONE>;
+
+				interrupt-names =	"mem-avail",
+							"data-rcvry-sug";
+			};
+		};
+	};
+
+	qcom,pmi8994@3 {
+		compatible ="qcom,spmi-pmic";
+		reg = <0x3 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		pmi8994_pwm_1: pwm@b100 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb100 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base", "qpnp-lpg-lut-base";
+			qcom,channel-id = <0>;
+			qcom,supported-sizes = <6>, <9>;
+			qcom,ramp-index = <0>;
+			#pwm-cells = <2>;
+		};
+
+		pmi8994_pwm_2: pwm@b200 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb200 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base", "qpnp-lpg-lut-base";
+			qcom,channel-id = <1>;
+			qcom,supported-sizes = <6>, <9>;
+			qcom,ramp-index = <1>;
+			#pwm-cells = <2>;
+		};
+
+		pmi8994_pwm_3: pwm@b300 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb300 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base", "qpnp-lpg-lut-base";
+			qcom,channel-id = <2>;
+			qcom,supported-sizes = <6>, <9>;
+			qcom,ramp-index = <2>;
+			#pwm-cells = <2>;
+		};
+
+		pmi8994_pwm_4: pwm@b400 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb400 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base", "qpnp-lpg-lut-base";
+			qcom,channel-id = <3>;
+			qcom,supported-sizes = <6>, <9>;
+			qcom,ramp-index = <3>;
+			#pwm-cells = <2>;
+		};
+
+		labibb: qpnp-labibb-regulator {
+			status = "disabled";
+			compatible = "qcom,qpnp-labibb-regulator";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			qcom,pmic-revid = <&pmi8994_revid>;
+
+			ibb_regulator: qcom,ibb@dc00 {
+				reg = <0xdc00 0x100>;
+				reg-names = "ibb_reg";
+				regulator-name = "ibb_reg";
+
+				regulator-min-microvolt = <4600000>;
+				regulator-max-microvolt = <6000000>;
+
+				qcom,qpnp-ibb-min-voltage = <1400000>;
+				qcom,qpnp-ibb-step-size = <100000>;
+				qcom,qpnp-ibb-slew-rate = <2000000>;
+				qcom,qpnp-ibb-use-default-voltage;
+				qcom,qpnp-ibb-init-voltage = <5500000>;
+				qcom,qpnp-ibb-init-amoled-voltage = <4000000>;
+				qcom,qpnp-ibb-init-lcd-voltage = <5500000>;
+
+				qcom,qpnp-ibb-soft-start = <1000>;
+
+				qcom,qpnp-ibb-discharge-resistor = <32>;
+				qcom,qpnp-ibb-lab-pwrup-delay = <8000>;
+				qcom,qpnp-ibb-lab-pwrdn-delay = <8000>;
+				qcom,qpnp-ibb-en-discharge;
+
+				qcom,qpnp-ibb-full-pull-down;
+				qcom,qpnp-ibb-pull-down-enable;
+				qcom,qpnp-ibb-switching-clock-frequency = <1480>;
+				qcom,qpnp-ibb-limit-maximum-current = <1550>;
+				qcom,qpnp-ibb-debounce-cycle = <16>;
+				qcom,qpnp-ibb-limit-max-current-enable;
+				qcom,qpnp-ibb-ps-enable;
+			};
+
+			lab_regulator: qcom,lab@de00 {
+				reg = <0xde00 0x100>;
+				reg-names = "lab";
+				regulator-name = "lab_reg";
+
+				regulator-min-microvolt = <4600000>;
+				regulator-max-microvolt = <6000000>;
+
+				qcom,qpnp-lab-min-voltage = <4600000>;
+				qcom,qpnp-lab-step-size = <100000>;
+				qcom,qpnp-lab-slew-rate = <5000>;
+				qcom,qpnp-lab-use-default-voltage;
+				qcom,qpnp-lab-init-voltage = <5500000>;
+				qcom,qpnp-lab-init-amoled-voltage = <4600000>;
+				qcom,qpnp-lab-init-lcd-voltage = <5500000>;
+
+				qcom,qpnp-lab-soft-start = <800>;
+
+				qcom,qpnp-lab-full-pull-down;
+				qcom,qpnp-lab-pull-down-enable;
+				qcom,qpnp-lab-switching-clock-frequency =
+									<1600>;
+				qcom,qpnp-lab-limit-maximum-current = <1600>;
+				qcom,qpnp-lab-limit-max-current-enable;
+				qcom,qpnp-lab-ps-threshold = <20>;
+				qcom,qpnp-lab-ps-enable;
+				qcom,qpnp-lab-nfet-size = <100>;
+				qcom,qpnp-lab-pfet-size = <100>;
+				qcom,qpnp-lab-max-precharge-time = <500>;
+			};
+		};
+
+		pmi8994_wled: qcom,leds@d800 {
+			compatible = "qcom,qpnp-wled";
+			reg = <0xd800 0x100>,
+				<0xd900 0x100>,
+				<0xdc00 0x100>,
+				<0xde00 0x100>;
+			reg-names = "qpnp-wled-ctrl-base",
+					"qpnp-wled-sink-base",
+					"qpnp-wled-ibb-base",
+					"qpnp-wled-lab-base";
+			interrupts = <0x3 0xd8 0x2 IRQ_TYPE_NONE>;
+			interrupt-names = "sc-irq";
+			status = "okay";
+			linux,name = "wled";
+			linux,default-trigger = "bkl-trigger";
+			qcom,fdbk-output = "auto";
+			qcom,vref-uv = <350000>;
+			qcom,switch-freq-khz = <800>;
+			qcom,ovp-mv = <29500>;
+			qcom,ilim-ma = <980>;
+			qcom,boost-duty-ns = <26>;
+			qcom,mod-freq-khz = <9600>;
+			qcom,dim-mode = "hybrid";
+			qcom,hyb-thres = <625>;
+			qcom,sync-dly-us = <800>;
+			qcom,fs-curr-ua = <25000>;
+			qcom,cons-sync-write-delay-us = <1000>;
+			qcom,en-phase-stag;
+			qcom,led-strings-list = [00 01 02 03];
+			qcom,en-ext-pfet-sc-pro;
+			qcom,pmic-revid = <&pmi8994_revid>;
+		};
+
+		pmi8994_haptics: qcom,haptic@c000 {
+			status = "disabled";
+			compatible = "qcom,qpnp-haptic";
+			reg = <0xc000 0x100>;
+			interrupts = <0x3 0xc0 0x0 IRQ_TYPE_EDGE_BOTH>,
+				     <0x3 0xc0 0x1 IRQ_TYPE_EDGE_BOTH>;
+			interrupt-names = "sc-irq", "play-irq";
+			vcc_pon-supply = <&pon_perph_reg>;
+			qcom,play-mode = "direct";
+			qcom,wave-play-rate-us = <5263>;
+			qcom,actuator-type = "lra";
+			qcom,wave-shape = "square";
+			qcom,vmax-mv = <2000>;
+			qcom,ilim-ma = <800>;
+			qcom,sc-deb-cycles = <8>;
+			qcom,int-pwm-freq-khz = <505>;
+			qcom,en-brake;
+			qcom,brake-pattern = [03 03 00 00];
+			qcom,wave-samples = [3e 3e 3e 3e 3e 3e 3e 3e];
+			qcom,wave-rep-cnt = <1>;
+			qcom,wave-samp-rep-cnt = <1>;
+			qcom,lra-high-z = "opt1";
+			qcom,lra-auto-res-mode = "qwd";
+			qcom,lra-res-cal-period = <4>;
+		};
+
+		qcom,leds@d000 {
+			compatible = "qcom,leds-qpnp";
+			reg = <0xd000 0x100>;
+			label = "rgb";
+			status = "okay";
+
+			red_led: qcom,rgb_0 {
+				label = "rgb";
+				qcom,id = <3>;
+				qcom,mode = "pwm";
+				pwms = <&pmi8994_pwm_3 0 0>;
+				qcom,pwm-us = <1000>;
+				qcom,max-current = <12>;
+				qcom,default-state = "off";
+				linux,name = "red";
+				linux,default-trigger =
+					"battery-charging";
+			};
+
+			green_led: qcom,rgb_1 {
+				label = "rgb";
+				qcom,id = <4>;
+				qcom,mode = "pwm";
+				pwms = <&pmi8994_pwm_2 0 0>;
+				qcom,pwm-us = <1000>;
+				qcom,max-current = <12>;
+				qcom,default-state = "off";
+				linux,name = "green";
+				linux,default-trigger = "battery-full";
+			};
+
+			blue_led: qcom,rgb_2 {
+				label = "rgb";
+				qcom,id = <5>;
+				qcom,mode = "pwm";
+				pwms = <&pmi8994_pwm_1 0 0>;
+				qcom,pwm-us = <1000>;
+				qcom,max-current = <12>;
+				qcom,default-state = "off";
+				linux,name = "blue";
+				linux,default-trigger = "boot-indication";
+			};
+		};
+
+		flash_led: qcom,leds@d300 {
+			compatible = "qcom,qpnp-flash-led";
+			status = "okay";
+			reg = <0xd300 0x100>;
+			label = "flash";
+			qcom,headroom = <500>;
+			qcom,startup-dly = <128>;
+			qcom,clamp-curr = <200>;
+			qcom,pmic-charger-support;
+			qcom,self-check-enabled;
+			qcom,thermal-derate-enabled;
+			qcom,thermal-derate-threshold = <105>;
+			qcom,thermal-derate-rate = "5_PERCENT";
+			qcom,current-ramp-enabled;
+			qcom,ramp_up_step = "6P7_US";
+			qcom,ramp_dn_step = "6P7_US";
+			qcom,vph-pwr-droop-enabled;
+			qcom,vph-pwr-droop-threshold = <3000>;
+			qcom,vph-pwr-droop-debounce-time = <10>;
+			qcom,headroom-sense-ch0-enabled;
+			qcom,headroom-sense-ch1-enabled;
+			qcom,power-detect-enabled;
+			qcom,pmic-revid = <&pmi8994_revid>;
+
+			pmi8994_flash0: qcom,flash_0 {
+				label = "flash";
+				qcom,led-name = "led:flash_0";
+				qcom,default-led-trigger =
+						"flash0_trigger";
+				qcom,id = <0>;
+				qcom,duration = <1280>;
+				qcom,current = <625>;
+				qcom,max-current = <1000>;
+			};
+
+			pmi8994_flash1: qcom,flash_1 {
+				label = "flash";
+				qcom,led-name = "led:flash_1";
+				qcom,default-led-trigger =
+						"flash1_trigger";
+				qcom,id = <1>;
+				qcom,duration = <1280>;
+				qcom,current = <625>;
+				qcom,max-current = <1000>;
+			};
+
+			pmi8994_torch0: qcom,torch_0 {
+				label = "torch";
+				qcom,led-name = "led:torch_0";
+				qcom,default-led-trigger =
+						"torch0_trigger";
+				qcom,id = <0>;
+				qcom,current = <120>;
+				qcom,max-current = <200>;
+			};
+
+			pmi8994_torch1: qcom,torch_1 {
+				label = "torch";
+				qcom,led-name = "led:torch_1";
+				qcom,default-led-trigger =
+						"torch1_trigger";
+				qcom,id = <1>;
+				qcom,current = <120>;
+				qcom,max-current = <200>;
+			};
+
+			pmi8994_switch: qcom,switch {
+				label = "switch";
+				qcom,led-name = "led:switch";
+				qcom,default-led-trigger =
+						"switch_trigger";
+				qcom,id = <2>;
+				qcom,current = <625>;
+				qcom,max-current = <1000>;
+				qcom,duration = <1280>;
+				reg0 {
+					regulator-name =
+						"pmi8994_boostbypass";
+					max-voltage = <3600000>;
+				};
+				reg1 {
+					regulator-name = "pon_spare_reg";
+				};
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-pmi8996.dtsi b/arch/arm64/boot/dts/qcom/msm-pmi8996.dtsi
new file mode 100644
index 000000000000..7984f214aa23
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-pmi8996.dtsi
@@ -0,0 +1,37 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only properties which override PMI8994 should be placed
+ * inside this file.
+ */
+
+/ {
+	qcom,pmic-id = <0x20009 0x10013 0x0 0x0>;
+};
+
+&ibb_regulator {
+	qcom,qpnp-ibb-discharge-resistor = <300>;
+};
+
+&spmi_bus {
+	qcom,pmi8994@2 {
+		bcl@4200 {
+			qcom,inhibit-derating-ua = <0>;
+		};
+	};
+};
+
+&flash_led {
+	qcom,ramp_up_step = "27_US";
+	qcom,ramp_dn_step = "27_US";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-pmi8998.dtsi b/arch/arm64/boot/dts/qcom/msm-pmi8998.dtsi
new file mode 100644
index 000000000000..147b537eba33
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-pmi8998.dtsi
@@ -0,0 +1,777 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/irq.h>
+#include <dt-bindings/spmi/spmi.h>
+
+&spmi_bus {
+	qcom,pmi8998@2 {
+		compatible = "qcom,spmi-pmic";
+		reg = <0x2 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		pmi8998_revid: qcom,revid@100 {
+			compatible = "qcom,qpnp-revid";
+			reg = <0x100 0x100>;
+			qcom,fab-id-valid;
+		};
+
+		qcom,power-on@800 {
+			compatible = "qcom,qpnp-power-on";
+			reg = <0x800 0x100>;
+		};
+
+		pmi8998_misc: qcom,misc@900 {
+			compatible = "qcom,qpnp-misc";
+			reg = <0x900 0x100>;
+		};
+
+		qcom,temp-alarm@2400 {
+			compatible = "qcom,qpnp-temp-alarm";
+			reg = <0x2400 0x100>;
+			interrupts = <0x2 0x24 0x0 IRQ_TYPE_EDGE_RISING>;
+			label = "pmi8998_tz";
+		};
+
+		pmi8998_gpios: gpios {
+			compatible = "qcom,qpnp-pin";
+			gpio-controller;
+			#gpio-cells = <2>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			label = "pmi8998-gpio";
+
+			gpio@c000 {
+				reg = <0xc000 0x100>;
+				qcom,pin-num = <1>;
+				status = "disabled";
+			};
+
+			gpio@c100 {
+				reg = <0xc100 0x100>;
+				qcom,pin-num = <2>;
+				status = "disabled";
+			};
+
+			gpio@c200 {
+				reg = <0xc200 0x100>;
+				qcom,pin-num = <3>;
+				status = "disabled";
+			};
+
+			gpio@c300 {
+				reg = <0xc300 0x100>;
+				qcom,pin-num = <4>;
+				status = "disabled";
+			};
+
+			gpio@c400 {
+				reg = <0xc400 0x100>;
+				qcom,pin-num = <5>;
+				status = "disabled";
+			};
+
+			gpio@c500 {
+				reg = <0xc500 0x100>;
+				qcom,pin-num = <6>;
+				status = "disabled";
+			};
+
+			gpio@c600 {
+				reg = <0xc600 0x100>;
+				qcom,pin-num = <7>;
+				status = "disabled";
+			};
+
+			gpio@c700 {
+				reg = <0xc700 0x100>;
+				qcom,pin-num = <8>;
+				status = "disabled";
+			};
+
+			gpio@c800 {
+				reg = <0xc800 0x100>;
+				qcom,pin-num = <9>;
+				status = "disabled";
+			};
+
+			gpio@c900 {
+				reg = <0xc900 0x100>;
+				qcom,pin-num = <10>;
+				status = "disabled";
+			};
+
+			gpio@ca00 {
+				reg = <0xca00 0x100>;
+				qcom,pin-num = <11>;
+				status = "disabled";
+			};
+
+			gpio@cb00 {
+				reg = <0xcb00 0x100>;
+				qcom,pin-num = <12>;
+				status = "disabled";
+			};
+
+			gpio@cc00 {
+				reg = <0xcc00 0x100>;
+				qcom,pin-num = <13>;
+				status = "disabled";
+			};
+
+			gpio@cd00 {
+				reg = <0xcd00 0x100>;
+				qcom,pin-num = <14>;
+				status = "disabled";
+			};
+		};
+
+		qcom,qpnp-qnovo@1500 {
+			compatible = "qcom,qpnp-qnovo";
+			reg = <0x1500 0x100>;
+			interrupts = <0x2 0x15 0x0 IRQ_TYPE_NONE>;
+			interrupt-names = "ptrain-done";
+			qcom,pmic-revid = <&pmi8998_revid>;
+		};
+
+		pmi8998_charger: qcom,qpnp-smb2 {
+			compatible = "qcom,qpnp-smb2";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			qcom,pmic-revid = <&pmi8998_revid>;
+
+			io-channels = <&pmi8998_rradc 8>,
+				      <&pmi8998_rradc 10>,
+				      <&pmi8998_rradc 3>,
+				      <&pmi8998_rradc 4>;
+			io-channel-names = "charger_temp",
+					   "charger_temp_max",
+					   "usbin_i",
+					   "usbin_v";
+
+			qcom,boost-threshold-ua = <100000>;
+			qcom,wipower-max-uw = <5000000>;
+			dpdm-supply = <&qusb_phy0>;
+
+			qcom,thermal-mitigation
+					= <3000000 1500000 1000000 500000>;
+
+			qcom,chgr@1000 {
+				reg = <0x1000 0x100>;
+				interrupts =
+					<0x2 0x10 0x0 IRQ_TYPE_EDGE_RISING>,
+					<0x2 0x10 0x1 IRQ_TYPE_EDGE_RISING>,
+					<0x2 0x10 0x2 IRQ_TYPE_EDGE_RISING>,
+					<0x2 0x10 0x3 IRQ_TYPE_EDGE_RISING>,
+					<0x2 0x10 0x4 IRQ_TYPE_EDGE_RISING>;
+
+				interrupt-names = "chg-error",
+						  "chg-state-change",
+						  "step-chg-state-change",
+						  "step-chg-soc-update-fail",
+						  "step-chg-soc-update-request";
+			};
+
+			qcom,otg@1100 {
+				reg = <0x1100 0x100>;
+				interrupts = <0x2 0x11 0x0 IRQ_TYPE_EDGE_BOTH>,
+					     <0x2 0x11 0x1 IRQ_TYPE_EDGE_BOTH>,
+					     <0x2 0x11 0x2 IRQ_TYPE_EDGE_BOTH>,
+					     <0x2 0x11 0x3 IRQ_TYPE_EDGE_BOTH>;
+
+				interrupt-names = "otg-fail",
+						  "otg-overcurrent",
+						  "otg-oc-dis-sw-sts",
+						  "testmode-change-detect";
+			};
+
+			qcom,bat-if@1200 {
+				reg = <0x1200 0x100>;
+				interrupts =
+					<0x2 0x12 0x0 IRQ_TYPE_EDGE_RISING>,
+					<0x2 0x12 0x1 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x12 0x2 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x12 0x3 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x12 0x4 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x12 0x5 IRQ_TYPE_EDGE_BOTH>;
+
+				interrupt-names = "bat-temp",
+						  "bat-ocp",
+						  "bat-ov",
+						  "bat-low",
+						  "bat-therm-or-id-missing",
+						  "bat-terminal-missing";
+			};
+
+			qcom,usb-chgpth@1300 {
+				reg = <0x1300 0x100>;
+				interrupts =
+					<0x2 0x13 0x0 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x13 0x1 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x13 0x2 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x13 0x3 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x13 0x4 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x13 0x5 IRQ_TYPE_EDGE_RISING>,
+					<0x2 0x13 0x6 IRQ_TYPE_EDGE_RISING>,
+					<0x2 0x13 0x7 IRQ_TYPE_EDGE_RISING>;
+
+				interrupt-names = "usbin-collapse",
+						  "usbin-lt-3p6v",
+						  "usbin-uv",
+						  "usbin-ov",
+						  "usbin-plugin",
+						  "usbin-src-change",
+						  "usbin-icl-change",
+						  "type-c-change";
+			};
+
+			qcom,dc-chgpth@1400 {
+				reg = <0x1400 0x100>;
+				interrupts =
+					<0x2 0x14 0x0 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x14 0x1 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x14 0x2 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x14 0x3 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x14 0x4 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x14 0x5 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x14 0x6 IRQ_TYPE_EDGE_RISING>;
+
+				interrupt-names = "dcin-collapse",
+						  "dcin-lt-3p6v",
+						  "dcin-uv",
+						  "dcin-ov",
+						  "dcin-plugin",
+						  "div2-en-dg",
+						  "dcin-icl-change";
+			};
+
+			qcom,chgr-misc@1600 {
+				reg = <0x1600 0x100>;
+				interrupts =
+					<0x2 0x16 0x0 IRQ_TYPE_EDGE_RISING>,
+					<0x2 0x16 0x1 IRQ_TYPE_EDGE_RISING>,
+					<0x2 0x16 0x2 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x16 0x3 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x16 0x4 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x16 0x5 IRQ_TYPE_EDGE_BOTH>,
+					<0x2 0x16 0x6 IRQ_TYPE_EDGE_FALLING>,
+					<0x2 0x16 0x7 IRQ_TYPE_EDGE_BOTH>;
+
+				interrupt-names = "wdog-snarl",
+						  "wdog-bark",
+						  "aicl-fail",
+						  "aicl-done",
+						  "high-duty-cycle",
+						  "input-current-limiting",
+						  "temperature-change",
+						  "switcher-power-ok";
+			};
+		};
+
+		pmi8998_pdphy: qcom,usb-pdphy@1700 {
+			compatible = "qcom,qpnp-pdphy";
+			reg = <0x1700 0x100>;
+			vdd-pdphy-supply = <&pm8998_l24>;
+			vbus-supply = <&smb2_vbus>;
+			vconn-supply = <&smb2_vconn>;
+			interrupts = <0x2 0x17 0x0 IRQ_TYPE_EDGE_RISING>,
+				     <0x2 0x17 0x1 IRQ_TYPE_EDGE_RISING>,
+				     <0x2 0x17 0x2 IRQ_TYPE_EDGE_RISING>,
+				     <0x2 0x17 0x3 IRQ_TYPE_EDGE_RISING>,
+				     <0x2 0x17 0x4 IRQ_TYPE_EDGE_RISING>,
+				     <0x2 0x17 0x5 IRQ_TYPE_EDGE_RISING>,
+				     <0x2 0x17 0x6 IRQ_TYPE_EDGE_RISING>;
+
+			interrupt-names = "sig-tx",
+					  "sig-rx",
+					  "msg-tx",
+					  "msg-rx",
+					  "msg-tx-failed",
+					  "msg-tx-discarded",
+					  "msg-rx-discarded";
+
+			qcom,default-sink-caps = <5000 3000>, /* 5V @ 3A */
+						 <9000 3000>, /* 9V @ 3A */
+						 <12000 2250>; /* 12V @ 2.25A */
+		};
+
+		bcl@4200 {
+			compatible = "qcom,msm-bcl-lmh";
+			reg = <0x4200 0xff>,
+				<0x4300 0xff>;
+			reg-names = "fg_user_adc",
+					"fg_lmh";
+			interrupts = <0x2 0x42 0x0 IRQ_TYPE_NONE>,
+					<0x2 0x42 0x2 IRQ_TYPE_NONE>;
+			interrupt-names = "bcl-high-ibat-int",
+					"bcl-low-vbat-int";
+			qcom,vbat-polling-delay-ms = <100>;
+			qcom,ibat-polling-delay-ms = <100>;
+		};
+
+		pmi8998_rradc: rradc@4500 {
+			compatible = "qcom,rradc";
+			reg = <0x4500 0x100>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			#io-channel-cells = <1>;
+			qcom,pmic-revid = <&pmi8998_revid>;
+		};
+
+		pmi8998_fg: qpnp,fg {
+			compatible = "qcom,fg-gen3";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			qcom,pmic-revid = <&pmi8998_revid>;
+			io-channels = <&pmi8998_rradc 0>;
+			io-channel-names = "rradc_batt_id";
+			qcom,rradc-base = <0x4500>;
+			qcom,fg-esr-timer-awake = <96 96>;
+			qcom,fg-esr-timer-asleep = <256 256>;
+			qcom,fg-esr-timer-charging = <0 96>;
+			qcom,cycle-counter-en;
+			status = "okay";
+
+			qcom,fg-batt-soc@4000 {
+				status = "okay";
+				reg = <0x4000 0x100>;
+				interrupts = <0x2 0x40 0x0 IRQ_TYPE_EDGE_BOTH>,
+					     <0x2 0x40 0x1 IRQ_TYPE_EDGE_BOTH>,
+					     <0x2 0x40 0x2
+							IRQ_TYPE_EDGE_RISING>,
+					     <0x2 0x40 0x3
+							IRQ_TYPE_EDGE_RISING>,
+					     <0x2 0x40 0x4 IRQ_TYPE_EDGE_BOTH>,
+					     <0x2 0x40 0x5
+							IRQ_TYPE_EDGE_RISING>,
+					     <0x2 0x40 0x6 IRQ_TYPE_EDGE_BOTH>,
+					     <0x2 0x40 0x7 IRQ_TYPE_EDGE_BOTH>;
+				interrupt-names = "soc-update",
+						  "soc-ready",
+						  "bsoc-delta",
+						  "msoc-delta",
+						  "msoc-low",
+						  "msoc-empty",
+						  "msoc-high",
+						  "msoc-full";
+			};
+
+			qcom,fg-batt-info@4100 {
+				status = "okay";
+				reg = <0x4100 0x100>;
+				interrupts = <0x2 0x41 0x0 IRQ_TYPE_EDGE_BOTH>,
+					     <0x2 0x41 0x1 IRQ_TYPE_EDGE_BOTH>,
+					     <0x2 0x41 0x2 IRQ_TYPE_EDGE_BOTH>,
+					     <0x2 0x41 0x3 IRQ_TYPE_EDGE_BOTH>,
+					     <0x2 0x41 0x6 IRQ_TYPE_EDGE_BOTH>;
+				interrupt-names = "vbatt-pred-delta",
+						  "vbatt-low",
+						  "esr-delta",
+						  "batt-missing",
+						  "batt-temp-delta";
+			};
+
+			qcom,fg-memif@4400 {
+				status = "okay";
+				reg = <0x4400 0x100>;
+				interrupts = <0x2 0x44 0x0 IRQ_TYPE_EDGE_BOTH>,
+					     <0x2 0x44 0x1 IRQ_TYPE_EDGE_BOTH>,
+					     <0x2 0x44 0x2 IRQ_TYPE_EDGE_BOTH>;
+				interrupt-names = "ima-rdy",
+						  "mem-xcp",
+						  "dma-grant";
+			};
+		};
+	};
+
+	qcom,pmi8998@3 {
+		compatible ="qcom,spmi-pmic";
+		reg = <0x3 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		pmi8998_pwm_1: pwm@b100 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb100 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base",
+					"qpnp-lpg-lut-base";
+			qcom,lpg-lut-size = <0x7e>;
+			qcom,channel-id = <1>;
+			qcom,supported-sizes = <6>, <9>;
+			qcom,ramp-index = <0>;
+			#pwm-cells = <2>;
+			status = "disabled";
+		};
+
+		pmi8998_pwm_2: pwm@b200 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb200 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base",
+					 "qpnp-lpg-lut-base";
+			qcom,lpg-lut-size = <0x7e>;
+			qcom,channel-id = <2>;
+			qcom,supported-sizes = <6>, <9>;
+			qcom,ramp-index = <1>;
+			#pwm-cells = <2>;
+			status = "disabled";
+		};
+
+		pmi8998_pwm_3: pwm@b300 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb300 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base",
+					 "qpnp-lpg-lut-base";
+			qcom,lpg-lut-size = <0x7e>;
+			qcom,channel-id = <3>;
+			qcom,supported-sizes = <6>, <9>;
+			qcom,ramp-index = <2>;
+			#pwm-cells = <2>;
+		};
+
+		pmi8998_pwm_4: pwm@b400 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb400 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base",
+					 "qpnp-lpg-lut-base";
+			qcom,lpg-lut-size = <0x7e>;
+			qcom,channel-id = <4>;
+			qcom,supported-sizes = <6>, <9>;
+			qcom,ramp-index = <3>;
+			#pwm-cells = <2>;
+		};
+
+		pmi8998_pwm_5: pwm@b500 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb500 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base",
+					 "qpnp-lpg-lut-base";
+			qcom,lpg-lut-size = <0x7e>;
+			qcom,channel-id = <5>;
+			qcom,supported-sizes = <6>, <9>;
+			qcom,ramp-index = <4>;
+			#pwm-cells = <2>;
+		};
+
+		pmi8998_pwm_6: pwm@b600 {
+			compatible = "qcom,qpnp-pwm";
+			reg = <0xb600 0x100>,
+			      <0xb042 0x7e>;
+			reg-names = "qpnp-lpg-channel-base",
+					 "qpnp-lpg-lut-base";
+			qcom,lpg-lut-size = <0x7e>;
+			qcom,channel-id = <6>;
+			qcom,supported-sizes = <6>, <9>;
+			qcom,ramp-index = <5>;
+			#pwm-cells = <2>;
+			status = "disabled";
+		};
+
+		qcom,leds@d000 {
+			compatible = "qcom,leds-qpnp";
+			reg = <0xd000 0x100>;
+			label = "rgb";
+			status = "okay";
+
+			red_led: qcom,rgb_0 {
+				label = "rgb";
+				qcom,id = <3>;
+				qcom,mode = "pwm";
+				pwms = <&pmi8998_pwm_5 0 0>;
+				qcom,pwm-us = <1000>;
+				qcom,max-current = <12>;
+				qcom,default-state = "off";
+				linux,name = "red";
+				linux,default-trigger =
+					"battery-charging";
+			};
+
+			green_led: qcom,rgb_1 {
+				label = "rgb";
+				qcom,id = <4>;
+				qcom,mode = "pwm";
+				pwms = <&pmi8998_pwm_4 0 0>;
+				qcom,pwm-us = <1000>;
+				qcom,max-current = <12>;
+				qcom,default-state = "off";
+				linux,name = "green";
+				linux,default-trigger = "battery-full";
+			};
+
+			blue_led: qcom,rgb_2 {
+				label = "rgb";
+				qcom,id = <5>;
+				qcom,mode = "pwm";
+				pwms = <&pmi8998_pwm_3 0 0>;
+				qcom,pwm-us = <1000>;
+				qcom,max-current = <12>;
+				qcom,default-state = "off";
+				linux,name = "blue";
+				linux,default-trigger = "boot-indication";
+			};
+		};
+
+		labibb: qpnp-labibb-regulator {
+			compatible = "qcom,qpnp-labibb-regulator";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			qcom,pmic-revid = <&pmi8998_revid>;
+			status = "disabled";
+
+			ibb_regulator: qcom,ibb@dc00 {
+				reg = <0xdc00 0x100>;
+				reg-names = "ibb_reg";
+				regulator-name = "ibb_reg";
+
+				regulator-min-microvolt = <4600000>;
+				regulator-max-microvolt = <6000000>;
+
+				interrupts = <0x3 0xdc 0x2
+						IRQ_TYPE_EDGE_RISING>;
+				interrupt-names = "ibb-sc-err";
+
+				qcom,qpnp-ibb-min-voltage = <1400000>;
+				qcom,qpnp-ibb-step-size = <100000>;
+				qcom,qpnp-ibb-slew-rate = <2000000>;
+				qcom,qpnp-ibb-use-default-voltage;
+				qcom,qpnp-ibb-init-voltage = <5500000>;
+				qcom,qpnp-ibb-init-amoled-voltage = <4000000>;
+				qcom,qpnp-ibb-init-lcd-voltage = <5500000>;
+
+				qcom,qpnp-ibb-soft-start = <1000>;
+
+				qcom,qpnp-ibb-lab-pwrup-delay = <8000>;
+				qcom,qpnp-ibb-lab-pwrdn-delay = <8000>;
+				qcom,qpnp-ibb-en-discharge;
+
+				qcom,qpnp-ibb-full-pull-down;
+				qcom,qpnp-ibb-pull-down-enable;
+				qcom,qpnp-ibb-switching-clock-frequency =
+									<1480>;
+				qcom,qpnp-ibb-limit-maximum-current = <1550>;
+				qcom,qpnp-ibb-debounce-cycle = <16>;
+				qcom,qpnp-ibb-limit-max-current-enable;
+				qcom,qpnp-ibb-ps-enable;
+			};
+
+			lab_regulator: qcom,lab@de00 {
+				reg = <0xde00 0x100>;
+				reg-names = "lab";
+				regulator-name = "lab_reg";
+
+				regulator-min-microvolt = <4600000>;
+				regulator-max-microvolt = <6000000>;
+
+				interrupts = <0x3 0xde 0x0
+						IRQ_TYPE_EDGE_RISING>,
+					     <0x3 0xde 0x1
+						IRQ_TYPE_EDGE_RISING>;
+				interrupt-names = "lab-vreg-ok", "lab-sc-err";
+
+				qcom,qpnp-lab-min-voltage = <4600000>;
+				qcom,qpnp-lab-step-size = <100000>;
+				qcom,qpnp-lab-slew-rate = <5000>;
+				qcom,qpnp-lab-use-default-voltage;
+				qcom,qpnp-lab-init-voltage = <5500000>;
+				qcom,qpnp-lab-init-amoled-voltage = <4600000>;
+				qcom,qpnp-lab-init-lcd-voltage = <5500000>;
+
+				qcom,qpnp-lab-soft-start = <800>;
+
+				qcom,qpnp-lab-full-pull-down;
+				qcom,qpnp-lab-pull-down-enable;
+				qcom,qpnp-lab-switching-clock-frequency =
+									<1600>;
+				qcom,qpnp-lab-limit-maximum-current = <1600>;
+				qcom,qpnp-lab-limit-max-current-enable;
+				qcom,qpnp-lab-ps-threshold = <20>;
+				qcom,qpnp-lab-ps-enable;
+				qcom,qpnp-lab-nfet-size = <100>;
+				qcom,qpnp-lab-pfet-size = <100>;
+				qcom,qpnp-lab-max-precharge-time = <500>;
+			};
+		};
+
+		pmi8998_wled: qcom,leds@d800 {
+			compatible = "qcom,qpnp-wled";
+			reg = <0xd800 0x100>,
+				<0xd900 0x100>;
+			reg-names = "qpnp-wled-ctrl-base",
+					"qpnp-wled-sink-base";
+			interrupts = <0x3 0xd8 0x1 IRQ_TYPE_EDGE_RISING>,
+					<0x3 0xd8 0x2 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "ovp-irq", "sc-irq";
+			linux,name = "wled";
+			linux,default-trigger = "bkl-trigger";
+			qcom,fdbk-output = "auto";
+			qcom,vref-uv = <127500>;
+			qcom,switch-freq-khz = <800>;
+			qcom,ovp-mv = <29600>;
+			qcom,ilim-ma = <970>;
+			qcom,boost-duty-ns = <26>;
+			qcom,mod-freq-khz = <9600>;
+			qcom,dim-mode = "hybrid";
+			qcom,hyb-thres = <625>;
+			qcom,sync-dly-us = <800>;
+			qcom,fs-curr-ua = <25000>;
+			qcom,cons-sync-write-delay-us = <1000>;
+			qcom,led-strings-list = [00 01 02 03];
+			qcom,en-ext-pfet-sc-pro;
+			qcom,pmic-revid = <&pmi8998_revid>;
+			qcom,loop-auto-gm-en;
+			qcom,auto-calibration-enable;
+			status = "okay";
+		};
+
+		pmi8998_haptics: qcom,haptic@c000 {
+			status = "disabled";
+			compatible = "qcom,qpnp-haptic";
+			reg = <0xc000 0x100>;
+			interrupts = <0x3 0xc0 0x0 IRQ_TYPE_EDGE_BOTH>,
+				     <0x3 0xc0 0x1 IRQ_TYPE_EDGE_BOTH>;
+			interrupt-names = "sc-irq", "play-irq";
+			qcom,pmic-revid = <&pmi8998_revid>;
+			qcom,pmic-misc = <&pmi8998_misc>;
+			qcom,misc-clk-trim-error-reg = <0xf3>;
+			qcom,actuator-type = "lra";
+			qcom,play-mode = "direct";
+			qcom,vmax-mv = <3200>;
+			qcom,ilim-ma = <800>;
+			qcom,wave-shape = "square";
+			qcom,wave-play-rate-us = <6667>;
+			qcom,int-pwm-freq-khz = <505>;
+			qcom,sc-deb-cycles = <8>;
+			qcom,en-brake;
+			qcom,brake-pattern = [03 03 00 00];
+			qcom,lra-high-z = "opt1";
+			qcom,lra-auto-res-mode = "qwd";
+			qcom,lra-res-cal-period = <4>;
+			qcom,correct-lra-drive-freq;
+		};
+
+		flash_led: qcom,leds@d300 {
+			compatible = "qcom,qpnp-flash-led-v2";
+			status = "okay";
+			reg = <0xd300 0x100>;
+			label = "flash";
+			interrupts = <0x3 0xd3 0x0 IRQ_TYPE_EDGE_RISING>,
+					<0x3 0xd3 0x3 IRQ_TYPE_EDGE_RISING>,
+					<0x3 0xd3 0x4 IRQ_TYPE_EDGE_RISING>;
+			interrupt-names = "led-fault-irq",
+					"all-ramp-down-done-irq",
+					"all-ramp-up-done-irq";
+			qcom,hdrm-auto-mode;
+			qcom,short-circuit-det;
+			qcom,open-circuit-det;
+			qcom,vph-droop-det;
+			qcom,thermal-derate-en;
+			qcom,thermal-derate-current = <200 500 1000>;
+			qcom,isc-delay = <192>;
+			qcom,pmic-revid = <&pmi8998_revid>;
+
+			pmi8998_flash0: qcom,flash_0 {
+				label = "flash";
+				qcom,led-name = "led:flash_0";
+				qcom,max-current = <1500>;
+				qcom,default-led-trigger = "flash0_trigger";
+				qcom,id = <0>;
+				qcom,current-ma = <1000>;
+				qcom,duration-ms = <1280>;
+				qcom,ires-ua = <12500>;
+				qcom,hdrm-voltage-mv = <325>;
+				qcom,hdrm-vol-hi-lo-win-mv = <100>;
+			};
+
+			pmi8998_flash1: qcom,flash_1 {
+				label = "flash";
+				qcom,led-name = "led:flash_1";
+				qcom,max-current = <1500>;
+				qcom,default-led-trigger = "flash1_trigger";
+				qcom,id = <1>;
+				qcom,current-ma = <1000>;
+				qcom,duration-ms = <1280>;
+				qcom,ires-ua = <12500>;
+				qcom,hdrm-voltage-mv = <325>;
+				qcom,hdrm-vol-hi-lo-win-mv = <100>;
+			};
+
+			pmi8998_flash2: qcom,flash_2 {
+				label = "flash";
+				qcom,led-name = "led:flash_2";
+				qcom,max-current = <750>;
+				qcom,default-led-trigger = "flash2_trigger";
+				qcom,id = <2>;
+				qcom,current-ma = <500>;
+				qcom,duration-ms = <1280>;
+				qcom,ires-ua = <12500>;
+				qcom,hdrm-voltage-mv = <325>;
+				qcom,hdrm-vol-hi-lo-win-mv = <100>;
+			};
+
+			pmi8998_torch0: qcom,torch_0 {
+				label = "torch";
+				qcom,led-name = "led:torch_0";
+				qcom,max-current = <500>;
+				qcom,default-led-trigger = "torch0_trigger";
+				qcom,id = <0>;
+				qcom,current-ma = <300>;
+				qcom,ires-ua = <12500>;
+				qcom,hdrm-voltage-mv = <325>;
+				qcom,hdrm-vol-hi-lo-win-mv = <100>;
+			};
+
+			pmi8998_torch1: qcom,torch_1 {
+				label = "torch";
+				qcom,led-name = "led:torch_1";
+				qcom,max-current = <500>;
+				qcom,default-led-trigger = "torch1_trigger";
+				qcom,id = <1>;
+				qcom,current-ma = <300>;
+				qcom,ires-ua = <12500>;
+				qcom,hdrm-voltage-mv = <325>;
+				qcom,hdrm-vol-hi-lo-win-mv = <100>;
+			};
+
+			pmi8998_torch2: qcom,torch_2 {
+				label = "torch";
+				qcom,led-name = "led:torch_2";
+				qcom,max-current = <500>;
+				qcom,default-led-trigger = "torch2_trigger";
+				qcom,id = <2>;
+				qcom,current-ma = <300>;
+				qcom,ires-ua = <12500>;
+				qcom,hdrm-voltage-mv = <325>;
+				qcom,hdrm-vol-hi-lo-win-mv = <100>;
+			};
+
+			pmi8998_switch0: qcom,led_switch_0 {
+				label = "switch";
+				qcom,led-name = "led:switch_0";
+				qcom,led-mask = <3>;
+				qcom,default-led-trigger = "switch0_trigger";
+			};
+
+			pmi8998_switch1: qcom,led_switch_1 {
+				label = "switch";
+				qcom,led-name = "led:switch_1";
+				qcom,led-mask = <4>;
+				qcom,default-led-trigger = "switch1_trigger";
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-pmk8001.dtsi b/arch/arm64/boot/dts/qcom/msm-pmk8001.dtsi
new file mode 100644
index 000000000000..eea34c5f6a14
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-pmk8001.dtsi
@@ -0,0 +1,89 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/irq.h>
+#include <dt-bindings/spmi/spmi.h>
+&spmi_bus {
+	qcom,pmk8001@6 {
+		compatible ="qcom,spmi-pmic";
+		reg = <0x6 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		pmk8001_revid: qcom,revid@100 {
+			compatible = "qcom,qpnp-revid";
+			reg = <0x100 0x100>;
+		};
+
+		qcom,power-on@800 {
+			compatible = "qcom,qpnp-power-on";
+			reg = <0x800 0x100>;
+			qcom,secondary-pon-reset;
+		};
+
+		pmk8001_gpios: gpios {
+			compatible = "qcom,qpnp-pin";
+			gpio-controller;
+			#gpio-cells = <2>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			label = "pmk8001-gpio";
+
+			gpio@c000 {
+				reg = <0xc000 0x100>;
+				qcom,pin-num = <1>;
+				status = "disabled";
+			};
+
+			gpio@c100 {
+				reg = <0xc100 0x100>;
+				qcom,pin-num = <2>;
+				status = "disabled";
+			};
+
+			gpio@c200 {
+				reg = <0xc200 0x100>;
+				qcom,pin-num = <3>;
+				status = "disabled";
+			};
+
+			gpio@c300 {
+				reg = <0xc300 0x100>;
+				qcom,pin-num = <4>;
+				status = "disabled";
+			};
+		};
+
+		qcom,pmk8001_rtc {
+			compatible = "qcom,qpnp-rtc";
+			#address-cells = <1>;
+			#size-cells = <1>;
+			qcom,qpnp-rtc-write = <0>;
+			qcom,qpnp-rtc-alarm-pwrup = <0>;
+
+			qcom,pmk8001_rtc_rw@6000 {
+				reg = <0x6000 0x100>;
+			};
+			qcom,pmk8001_rtc_alarm@6100 {
+				reg = <0x6100 0x100>;
+				interrupts = <0x6 0x61 0x1 IRQ_TYPE_NONE>;
+			};
+		};
+	};
+
+	qcom,pmk8001@7 {
+		compatible ="qcom,spmi-pmic";
+		reg = <0x7 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-rdbg.dtsi b/arch/arm64/boot/dts/qcom/msm-rdbg.dtsi
new file mode 100644
index 000000000000..6de1a8e2fb7e
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-rdbg.dtsi
@@ -0,0 +1,106 @@
+/* Copyright (c) 2015, 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	smp2pgpio_rdbg_2_in: qcom,smp2pgpio-rdbg-2-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "rdbg";
+		qcom,remote-pid = <2>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_client_rdbg_2_in {
+		compatible = "qcom,smp2pgpio_client_rdbg_2_in";
+		gpios = <&smp2pgpio_rdbg_2_in 0 0>;
+	};
+
+	smp2pgpio_rdbg_2_out: qcom,smp2pgpio-rdbg-2-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "rdbg";
+		qcom,remote-pid = <2>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_client_rdbg_2_out {
+		compatible = "qcom,smp2pgpio_client_rdbg_2_out";
+		gpios = <&smp2pgpio_rdbg_2_out 0 0>;
+	};
+
+	smp2pgpio_rdbg_1_in: qcom,smp2pgpio-rdbg-1-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "rdbg";
+		qcom,remote-pid = <1>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_client_rdbg_1_in {
+		compatible = "qcom,smp2pgpio_client_rdbg_1_in";
+		gpios = <&smp2pgpio_rdbg_1_in 0 0>;
+	};
+
+	smp2pgpio_rdbg_1_out: qcom,smp2pgpio-rdbg-1-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "rdbg";
+		qcom,remote-pid = <1>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_client_rdbg_1_out {
+		compatible = "qcom,smp2pgpio_client_rdbg_1_out";
+		gpios = <&smp2pgpio_rdbg_1_out 0 0>;
+	};
+
+	smp2pgpio_rdbg_5_in: qcom,smp2pgpio-rdbg-5-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "rdbg";
+		qcom,remote-pid = <5>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_client_rdbg_5_in {
+		compatible = "qcom,smp2pgpio_client_rdbg_5_in";
+		gpios = <&smp2pgpio_rdbg_5_in 0 0>;
+	};
+
+	smp2pgpio_rdbg_5_out: qcom,smp2pgpio-rdbg-5-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "rdbg";
+		qcom,remote-pid = <5>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_client_rdbg_5_out {
+		compatible = "qcom,smp2pgpio_client_rdbg_5_out";
+		gpios = <&smp2pgpio_rdbg_5_out 0 0>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm-smb138x.dtsi b/arch/arm64/boot/dts/qcom/msm-smb138x.dtsi
new file mode 100644
index 000000000000..c156e91dfcf9
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm-smb138x.dtsi
@@ -0,0 +1,137 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/irq.h>
+
+&i2c_7 {
+	status = "okay";
+	smb138x: qcom,smb138x@8 {
+		compatible = "qcom,i2c-pmic";
+		reg = <0x8>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+		interrupt-parent = <&spmi_bus>;
+		interrupts = <0x0 0xd1 0x0 IRQ_TYPE_LEVEL_LOW>;
+		interrupt_names = "smb138x";
+		interrupt-controller;
+		#interrupt-cells = <3>;
+		qcom,periph-map = <0x10 0x11 0x12 0x13 0x14 0x16 0x36>;
+
+		smb138x_revid: qcom,revid@100 {
+			compatible = "qcom,qpnp-revid";
+			reg = <0x100 0x100>;
+		};
+
+		smb138x_tadc: qcom,tadc@3600 {
+			compatible = "qcom,tadc";
+			reg = <0x3600 0x100>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			#io-channel-cells = <1>;
+			interrupt-parent = <&smb138x>;
+			interrupts = <0x36 0x0 IRQ_TYPE_EDGE_BOTH>;
+			interrupt-names = "eoc";
+
+			batt_temp@0 {
+				reg = <0>;
+				qcom,rbias = <68100>;
+				qcom,rtherm-at-25degc = <68000>;
+				qcom,beta-coefficient = <3450>;
+			};
+
+			skin_temp@1 {
+				reg = <1>;
+				qcom,rbias = <33000>;
+				qcom,rtherm-at-25degc = <68000>;
+				qcom,beta-coefficient = <3450>;
+			};
+
+			die_temp@2 {
+				reg = <2>;
+				qcom,scale = <(-1306)>;
+				qcom,offset = <397904>;
+			};
+
+			batt_i@3 {
+				reg = <3>;
+				qcom,channel = <3>;
+				qcom,scale = <(-20000000)>;
+			};
+
+			batt_v@4 {
+				reg = <4>;
+				qcom,scale = <5000000>;
+			};
+
+			input_i@5 {
+				reg = <5>;
+				qcom,scale = <14285714>;
+			};
+
+			input_v@6 {
+				reg = <6>;
+				qcom,scale = <25000000>;
+			};
+
+			otg_i@7 {
+				reg = <7>;
+				qcom,scale = <5714286>;
+			};
+		};
+
+		smb138x_parallel_slave: qcom,smb138x-parallel-slave@1000 {
+			compatible = "qcom,smb138x-parallel-slave";
+			qcom,pmic-revid = <&smb138x_revid>;
+			reg = <0x1000 0x700>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			interrupt-parent = <&smb138x>;
+			io-channels =
+				<&smb138x_tadc 1>,
+				<&smb138x_tadc 2>,
+				<&smb138x_tadc 3>,
+				<&smb138x_tadc 14>,
+				<&smb138x_tadc 15>,
+				<&smb138x_tadc 16>,
+				<&smb138x_tadc 17>;
+			io-channel-names =
+				"connector_temp",
+				"charger_temp",
+				"batt_i",
+				"connector_temp_thr1",
+				"connector_temp_thr2",
+				"connector_temp_thr3",
+				"charger_temp_max";
+
+			qcom,chgr@1000 {
+				reg = <0x1000 0x100>;
+				interrupts = <0x10 0x1 IRQ_TYPE_EDGE_RISING>;
+				interrupt-names = "chg-state-change";
+			};
+
+			qcom,chgr-misc@1600 {
+				reg = <0x1600 0x100>;
+				interrupts = <0x16 0x1 IRQ_TYPE_EDGE_RISING>,
+					     <0x16 0x6 IRQ_TYPE_EDGE_RISING>;
+				interrupt-names = "wdog-bark",
+						  "temperature-change";
+			};
+		};
+	};
+};
+
+&smb138x_parallel_slave {
+	smb138x_vbus: qcom,smb138x-vbus {
+		status = "disabled";
+		regulator-name = "smb138x-vbus";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8916-mtp.dts b/arch/arm64/boot/dts/qcom/msm8916-mtp.dts
new file mode 100644
index 000000000000..fced77f0fd3a
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8916-mtp.dts
@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8916-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8916 MTP";
+	compatible = "qcom,msm8916-mtp", "qcom,msm8916-mtp-smb1360",
+			"qcom,msm8916", "qcom,mtp";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8916-mtp.dtsi b/arch/arm64/boot/dts/qcom/msm8916-mtp.dtsi
new file mode 100644
index 000000000000..a1aa0b201e92
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8916-mtp.dtsi
@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8916.dtsi"
+#include "pm8916.dtsi"
+
+/ {
+	aliases {
+		serial0 = &blsp1_uart2;
+	};
+
+	chosen {
+		stdout-path = "serial0";
+	};
+
+	soc {
+		serial@78b0000 {
+			status = "okay";
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&blsp1_uart2_default>;
+			pinctrl-1 = <&blsp1_uart2_sleep>;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
new file mode 100644
index 000000000000..49ec55a37614
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
@@ -0,0 +1,502 @@
+/*
+ * Copyright (c) 2013-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&msmgpio {
+
+	blsp1_uart1_default: blsp1_uart1_default {
+		pinmux {
+			function = "blsp_uart1";
+			pins = "gpio0", "gpio1";
+		};
+		pinconf {
+			pins = "gpio0", "gpio1";
+			drive-strength = <16>;
+			bias-disable;
+		};
+	};
+
+	blsp1_uart1_sleep: blsp1_uart1_sleep {
+		pinmux {
+			function = "gpio";
+			pins = "gpio0", "gpio1";
+		};
+		pinconf {
+			pins = "gpio0", "gpio1";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+	};
+
+	blsp1_uart2_default: blsp1_uart2_default {
+		pinmux {
+			function = "blsp_uart2";
+			pins = "gpio4", "gpio5";
+		};
+		pinconf {
+			pins = "gpio4", "gpio5";
+			drive-strength = <16>;
+			bias-disable;
+		};
+	};
+
+	blsp1_uart2_sleep: blsp1_uart2_sleep {
+		pinmux {
+			function = "gpio";
+			pins = "gpio4", "gpio5";
+		};
+		pinconf {
+			pins = "gpio4", "gpio5";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+	};
+
+	spi1_default: spi1_default {
+		pinmux {
+			function = "blsp_spi1";
+			pins = "gpio0", "gpio1", "gpio3";
+		};
+		pinmux_cs {
+			function = "gpio";
+			pins = "gpio2";
+		};
+		pinconf {
+			pins = "gpio0", "gpio1", "gpio3";
+			drive-strength = <12>;
+			bias-disable;
+		};
+		pinconf_cs {
+			pins = "gpio2";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+
+	spi1_sleep: spi1_sleep {
+		pinmux {
+			function = "gpio";
+			pins = "gpio0", "gpio1", "gpio2", "gpio3";
+		};
+		pinconf {
+			pins = "gpio0", "gpio1", "gpio2", "gpio3";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+	};
+
+	spi2_default: spi2_default {
+		pinmux {
+			function = "blsp_spi2";
+			pins = "gpio4", "gpio5", "gpio7";
+		};
+		pinmux_cs {
+			function = "gpio";
+			pins = "gpio6";
+		};
+		pinconf {
+			pins = "gpio4", "gpio5", "gpio6", "gpio7";
+			drive-strength = <12>;
+			bias-disable;
+		};
+		pinconf_cs {
+			pins = "gpio6";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+
+	spi2_sleep: spi2_sleep {
+		pinmux {
+			function = "gpio";
+			pins = "gpio4", "gpio5", "gpio6", "gpio7";
+		};
+		pinconf {
+			pins = "gpio4", "gpio5", "gpio6", "gpio7";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+	};
+
+	spi3_default: spi3_default {
+		pinmux {
+			function = "blsp_spi3";
+			pins = "gpio8", "gpio9", "gpio11";
+		};
+		pinmux_cs {
+			function = "gpio";
+			pins = "gpio10";
+		};
+		pinconf {
+			pins = "gpio8", "gpio9", "gpio10", "gpio11";
+			drive-strength = <12>;
+			bias-disable;
+		};
+		pinconf_cs {
+			pins = "gpio10";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+
+	spi3_sleep: spi3_sleep {
+		pinmux {
+			function = "gpio";
+			pins = "gpio8", "gpio9", "gpio10", "gpio11";
+		};
+		pinconf {
+			pins = "gpio8", "gpio9", "gpio10", "gpio11";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+	};
+
+	spi4_default: spi4_default {
+		pinmux {
+			function = "blsp_spi4";
+			pins = "gpio12", "gpio13", "gpio15";
+		};
+		pinmux_cs {
+			function = "gpio";
+			pins = "gpio14";
+		};
+		pinconf {
+			pins = "gpio12", "gpio13", "gpio14", "gpio15";
+			drive-strength = <12>;
+			bias-disable;
+		};
+		pinconf_cs {
+			pins = "gpio14";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+
+	spi4_sleep: spi4_sleep {
+		pinmux {
+			function = "gpio";
+			pins = "gpio12", "gpio13", "gpio14", "gpio15";
+		};
+		pinconf {
+			pins = "gpio12", "gpio13", "gpio14", "gpio15";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+	};
+
+	spi5_default: spi5_default {
+		pinmux {
+			function = "blsp_spi5";
+			pins = "gpio16", "gpio17", "gpio19";
+		};
+		pinmux_cs {
+			function = "gpio";
+			pins = "gpio18";
+		};
+		pinconf {
+			pins = "gpio16", "gpio17", "gpio18", "gpio19";
+			drive-strength = <12>;
+			bias-disable;
+		};
+		pinconf_cs {
+			pins = "gpio18";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+
+	spi5_sleep: spi5_sleep {
+		pinmux {
+			function = "gpio";
+			pins = "gpio16", "gpio17", "gpio18", "gpio19";
+		};
+		pinconf {
+			pins = "gpio16", "gpio17", "gpio18", "gpio19";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+	};
+
+	spi6_default: spi6_default {
+		pinmux {
+			function = "blsp_spi6";
+			pins = "gpio20", "gpio21", "gpio23";
+		};
+		pinmux_cs {
+			function = "gpio";
+			pins = "gpio22";
+		};
+		pinconf {
+			pins = "gpio20", "gpio21", "gpio22", "gpio23";
+			drive-strength = <12>;
+			bias-disable;
+		};
+		pinconf_cs {
+			pins = "gpio22";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+
+	spi6_sleep: spi6_sleep {
+		pinmux {
+			function = "gpio";
+			pins = "gpio20", "gpio21", "gpio22", "gpio23";
+		};
+		pinconf {
+			pins = "gpio20", "gpio21", "gpio22", "gpio23";
+			drive-strength = <2>;
+			bias-pull-down;
+		};
+	};
+
+	i2c2_default: i2c2_default {
+		pinmux {
+			function = "blsp_i2c2";
+			pins = "gpio6", "gpio7";
+		};
+		pinconf {
+			pins = "gpio6", "gpio7";
+			drive-strength = <2>;
+			bias-disable = <0>;
+		};
+	};
+
+	i2c2_sleep: i2c2_sleep {
+		pinmux {
+			function = "gpio";
+			pins = "gpio6", "gpio7";
+		};
+		pinconf {
+			pins = "gpio6", "gpio7";
+			drive-strength = <2>;
+			bias-disable = <0>;
+		};
+	};
+
+	i2c4_default: i2c4_default {
+		pinmux {
+			function = "blsp_i2c4";
+			pins = "gpio14", "gpio15";
+		};
+		pinconf {
+			pins = "gpio14", "gpio15";
+			drive-strength = <2>;
+			bias-disable = <0>;
+		};
+	};
+
+	i2c4_sleep: i2c4_sleep {
+		pinmux {
+			function = "gpio";
+			pins = "gpio14", "gpio15";
+		};
+		pinconf {
+			pins = "gpio14", "gpio15";
+			drive-strength = <2>;
+			bias-disable = <0>;
+		};
+	};
+
+	i2c6_default: i2c6_default {
+		pinmux {
+			function = "blsp_i2c6";
+			pins = "gpio22", "gpio23";
+		};
+		pinconf {
+			pins = "gpio22", "gpio23";
+			drive-strength = <2>;
+			bias-disable = <0>;
+		};
+	};
+
+	i2c6_sleep: i2c6_sleep {
+		pinmux {
+			function = "gpio";
+			pins = "gpio22", "gpio23";
+		};
+		pinconf {
+			pins = "gpio22", "gpio23";
+			drive-strength = <2>;
+			bias-disable = <0>;
+		};
+	};
+
+	sdhc2_cd_pin {
+		sdc2_cd_on: cd_on {
+			pinmux {
+				function = "gpio";
+				pins = "gpio38";
+			};
+			pinconf {
+				pins = "gpio38";
+				drive-strength = <2>;
+				bias-pull-up;
+			};
+		};
+		sdc2_cd_off: cd_off {
+			pinmux {
+				function = "gpio";
+				pins = "gpio38";
+			};
+			pinconf {
+				pins = "gpio38";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+	};
+
+	pmx_sdc1_clk {
+		sdc1_clk_on: clk_on {
+			pinmux {
+				pins = "sdc1_clk";
+			};
+			pinconf {
+				pins = "sdc1_clk";
+				bias-disable;
+				drive-strength = <16>;
+			};
+		};
+		sdc1_clk_off: clk_off {
+			pinmux {
+				pins = "sdc1_clk";
+			};
+			pinconf {
+				pins = "sdc1_clk";
+				bias-disable;
+				drive-strength = <2>;
+			};
+		};
+	};
+
+	pmx_sdc1_cmd {
+		sdc1_cmd_on: cmd_on {
+			pinmux {
+				pins = "sdc1_cmd";
+			};
+			pinconf {
+				pins = "sdc1_cmd";
+				bias-pull-up;
+				drive-strength = <10>;
+			};
+		};
+		sdc1_cmd_off: cmd_off {
+			pinmux {
+				pins = "sdc1_cmd";
+			};
+			pinconf {
+				pins = "sdc1_cmd";
+				bias-pull-up;
+				drive-strength = <2>;
+			};
+		};
+	};
+
+	pmx_sdc1_data {
+		sdc1_data_on: data_on {
+			pinmux {
+				pins = "sdc1_data";
+			};
+			pinconf {
+				pins = "sdc1_data";
+				bias-pull-up;
+				drive-strength = <10>;
+			};
+		};
+		sdc1_data_off: data_off {
+			pinmux {
+				pins = "sdc1_data";
+			};
+			pinconf {
+				pins = "sdc1_data";
+				bias-pull-up;
+				drive-strength = <2>;
+			};
+		};
+	};
+
+	pmx_sdc2_clk {
+		sdc2_clk_on: clk_on {
+			pinmux {
+				pins = "sdc2_clk";
+			};
+			pinconf {
+				pins = "sdc2_clk";
+				bias-disable;
+				drive-strength = <16>;
+			};
+		};
+		sdc2_clk_off: clk_off {
+			pinmux {
+				pins = "sdc2_clk";
+			};
+			pinconf {
+				pins = "sdc2_clk";
+				bias-disable;
+				drive-strength = <2>;
+			};
+		};
+	};
+
+	pmx_sdc2_cmd {
+		sdc2_cmd_on: cmd_on {
+			pinmux {
+				pins = "sdc2_cmd";
+			};
+			pinconf {
+				pins = "sdc2_cmd";
+				bias-pull-up;
+				drive-strength = <10>;
+			};
+		};
+		sdc2_cmd_off: cmd_off {
+			pinmux {
+				pins = "sdc2_cmd";
+			};
+			pinconf {
+				pins = "sdc2_cmd";
+				bias-pull-up;
+				drive-strength = <2>;
+			};
+		};
+	};
+
+	pmx_sdc2_data {
+		sdc2_data_on: data_on {
+			pinmux {
+				pins = "sdc2_data";
+			};
+			pinconf {
+				pins = "sdc2_data";
+				bias-pull-up;
+				drive-strength = <10>;
+			};
+		};
+		sdc2_data_off: data_off {
+			pinmux {
+				pins = "sdc2_data";
+			};
+			pinconf {
+				pins = "sdc2_data";
+				bias-pull-up;
+				drive-strength = <2>;
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
new file mode 100644
index 000000000000..8d184ff19642
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
@@ -0,0 +1,443 @@
+/*
+ * Copyright (c) 2013-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/clock/qcom,gcc-msm8916.h>
+#include <dt-bindings/reset/qcom,gcc-msm8916.h>
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM8916";
+	compatible = "qcom,msm8916";
+
+	interrupt-parent = <&intc>;
+
+	#address-cells = <2>;
+	#size-cells = <2>;
+
+	aliases {
+		sdhc1 = &sdhc_1; /* SDC1 eMMC slot */
+		sdhc2 = &sdhc_2; /* SDC2 SD card slot */
+	};
+
+	chosen { };
+
+	memory {
+		device_type = "memory";
+		/* We expect the bootloader to fill in the reg */
+		reg = <0 0 0 0>;
+	};
+
+	cpus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		CPU0: cpu@0 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a53", "arm,armv8";
+			reg = <0x0>;
+		};
+
+		CPU1: cpu@1 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a53", "arm,armv8";
+			reg = <0x1>;
+		};
+
+		CPU2: cpu@2 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a53", "arm,armv8";
+			reg = <0x2>;
+		};
+
+		CPU3: cpu@3 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a53", "arm,armv8";
+			reg = <0x3>;
+		};
+	};
+
+	timer {
+		compatible = "arm,armv8-timer";
+		interrupts = <GIC_PPI 2 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+			     <GIC_PPI 3 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+			     <GIC_PPI 4 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+			     <GIC_PPI 1 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>;
+	};
+
+	soc: soc {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges = <0 0 0 0xffffffff>;
+		compatible = "simple-bus";
+
+		restart@4ab000 {
+			compatible = "qcom,pshold";
+			reg = <0x4ab000 0x4>;
+		};
+
+		msmgpio: pinctrl@1000000 {
+			compatible = "qcom,msm8916-pinctrl";
+			reg = <0x1000000 0x300000>;
+			interrupts = <GIC_SPI 208 IRQ_TYPE_LEVEL_HIGH>;
+			gpio-controller;
+			#gpio-cells = <2>;
+			interrupt-controller;
+			#interrupt-cells = <2>;
+		};
+
+		gcc: qcom,gcc@1800000 {
+			compatible = "qcom,gcc-msm8916";
+			#clock-cells = <1>;
+			#reset-cells = <1>;
+			#power-domain-cells = <1>;
+			reg = <0x1800000 0x80000>;
+		};
+
+		blsp1_uart1: serial@78af000 {
+			compatible = "qcom,msm-uartdm-v1.4", "qcom,msm-uartdm";
+			reg = <0x78af000 0x200>;
+			interrupts = <GIC_SPI 107 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&gcc GCC_BLSP1_UART1_APPS_CLK>, <&gcc GCC_BLSP1_AHB_CLK>;
+			clock-names = "core", "iface";
+			status = "disabled";
+		};
+
+		blsp1_uart2: serial@78b0000 {
+			compatible = "qcom,msm-uartdm-v1.4", "qcom,msm-uartdm";
+			reg = <0x78b0000 0x200>;
+			interrupts = <GIC_SPI 108 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&gcc GCC_BLSP1_UART2_APPS_CLK>, <&gcc GCC_BLSP1_AHB_CLK>;
+			clock-names = "core", "iface";
+			status = "disabled";
+		};
+
+		blsp_dma: dma@7884000 {
+			compatible = "qcom,bam-v1.7.0";
+			reg = <0x07884000 0x23000>;
+			interrupts = <GIC_SPI 238 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&gcc GCC_BLSP1_AHB_CLK>;
+			clock-names = "bam_clk";
+			#dma-cells = <1>;
+			qcom,ee = <0>;
+			status = "disabled";
+		};
+
+		blsp_spi1: spi@78b5000 {
+			compatible = "qcom,spi-qup-v2.2.1";
+			reg = <0x078b5000 0x600>;
+			interrupts = <GIC_SPI 95 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&gcc GCC_BLSP1_QUP1_SPI_APPS_CLK>,
+				 <&gcc GCC_BLSP1_AHB_CLK>;
+			clock-names = "core", "iface";
+			dmas = <&blsp_dma 5>, <&blsp_dma 4>;
+			dma-names = "rx", "tx";
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&spi1_default>;
+			pinctrl-1 = <&spi1_sleep>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		blsp_spi2: spi@78b6000 {
+			compatible = "qcom,spi-qup-v2.2.1";
+			reg = <0x078b6000 0x600>;
+			interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&gcc GCC_BLSP1_QUP2_SPI_APPS_CLK>,
+				 <&gcc GCC_BLSP1_AHB_CLK>;
+			clock-names = "core", "iface";
+			dmas = <&blsp_dma 7>, <&blsp_dma 6>;
+			dma-names = "rx", "tx";
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&spi2_default>;
+			pinctrl-1 = <&spi2_sleep>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		blsp_spi3: spi@78b7000 {
+			compatible = "qcom,spi-qup-v2.2.1";
+			reg = <0x078b7000 0x600>;
+			interrupts = <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&gcc GCC_BLSP1_QUP3_SPI_APPS_CLK>,
+				 <&gcc GCC_BLSP1_AHB_CLK>;
+			clock-names = "core", "iface";
+			dmas = <&blsp_dma 9>, <&blsp_dma 8>;
+			dma-names = "rx", "tx";
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&spi3_default>;
+			pinctrl-1 = <&spi3_sleep>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		blsp_spi4: spi@78b8000 {
+			compatible = "qcom,spi-qup-v2.2.1";
+			reg = <0x078b8000 0x600>;
+			interrupts = <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&gcc GCC_BLSP1_QUP4_SPI_APPS_CLK>,
+				 <&gcc GCC_BLSP1_AHB_CLK>;
+			clock-names = "core", "iface";
+			dmas = <&blsp_dma 11>, <&blsp_dma 10>;
+			dma-names = "rx", "tx";
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&spi4_default>;
+			pinctrl-1 = <&spi4_sleep>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		blsp_spi5: spi@78b9000 {
+			compatible = "qcom,spi-qup-v2.2.1";
+			reg = <0x078b9000 0x600>;
+			interrupts = <GIC_SPI 99 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&gcc GCC_BLSP1_QUP5_SPI_APPS_CLK>,
+				 <&gcc GCC_BLSP1_AHB_CLK>;
+			clock-names = "core", "iface";
+			dmas = <&blsp_dma 13>, <&blsp_dma 12>;
+			dma-names = "rx", "tx";
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&spi5_default>;
+			pinctrl-1 = <&spi5_sleep>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		blsp_spi6: spi@78ba000 {
+			compatible = "qcom,spi-qup-v2.2.1";
+			reg = <0x078ba000 0x600>;
+			interrupts = <GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&gcc GCC_BLSP1_QUP6_SPI_APPS_CLK>,
+				 <&gcc GCC_BLSP1_AHB_CLK>;
+			clock-names = "core", "iface";
+			dmas = <&blsp_dma 15>, <&blsp_dma 14>;
+			dma-names = "rx", "tx";
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&spi6_default>;
+			pinctrl-1 = <&spi6_sleep>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		blsp_i2c2: i2c@78b6000 {
+			compatible = "qcom,i2c-qup-v2.2.1";
+			reg = <0x78b6000 0x1000>;
+			interrupts = <GIC_SPI 96 0>;
+			clocks = <&gcc GCC_BLSP1_AHB_CLK>,
+				<&gcc GCC_BLSP1_QUP2_I2C_APPS_CLK>;
+			clock-names = "iface", "core";
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&i2c2_default>;
+			pinctrl-1 = <&i2c2_sleep>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		blsp_i2c4: i2c@78b8000 {
+			compatible = "qcom,i2c-qup-v2.2.1";
+			reg = <0x78b8000 0x1000>;
+			interrupts = <GIC_SPI 98 0>;
+			clocks = <&gcc GCC_BLSP1_AHB_CLK>,
+				<&gcc GCC_BLSP1_QUP4_I2C_APPS_CLK>;
+			clock-names = "iface", "core";
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&i2c4_default>;
+			pinctrl-1 = <&i2c4_sleep>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		blsp_i2c6: i2c@78ba000 {
+			compatible = "qcom,i2c-qup-v2.2.1";
+			reg = <0x78ba000 0x1000>;
+			interrupts = <GIC_SPI 100 0>;
+			clocks = <&gcc GCC_BLSP1_AHB_CLK>,
+				<&gcc GCC_BLSP1_QUP6_I2C_APPS_CLK>;
+			clock-names = "iface", "core";
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&i2c6_default>;
+			pinctrl-1 = <&i2c6_sleep>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		sdhc_1: sdhci@07824000 {
+			compatible = "qcom,sdhci-msm-v4";
+			reg = <0x07824900 0x11c>, <0x07824000 0x800>;
+			reg-names = "hc_mem", "core_mem";
+
+			interrupts = <0 123 0>, <0 138 0>;
+			interrupt-names = "hc_irq", "pwr_irq";
+			clocks = <&gcc GCC_SDCC1_APPS_CLK>,
+				 <&gcc GCC_SDCC1_AHB_CLK>;
+			clock-names = "core", "iface";
+			bus-width = <8>;
+			non-removable;
+			status = "disabled";
+		};
+
+		sdhc_2: sdhci@07864000 {
+			compatible = "qcom,sdhci-msm-v4";
+			reg = <0x07864900 0x11c>, <0x07864000 0x800>;
+			reg-names = "hc_mem", "core_mem";
+
+			interrupts = <0 125 0>, <0 221 0>;
+			interrupt-names = "hc_irq", "pwr_irq";
+			clocks = <&gcc GCC_SDCC2_APPS_CLK>,
+				 <&gcc GCC_SDCC2_AHB_CLK>;
+			clock-names = "core", "iface";
+			bus-width = <4>;
+			status = "disabled";
+		};
+
+		usb_dev: usb@78d9000 {
+			compatible = "qcom,ci-hdrc";
+			reg = <0x78d9000 0x400>;
+			dr_mode = "peripheral";
+			interrupts = <GIC_SPI 134 IRQ_TYPE_NONE>;
+			usb-phy = <&usb_otg>;
+			status = "disabled";
+		};
+
+		usb_host: ehci@78d9000 {
+			compatible = "qcom,ehci-host";
+			reg = <0x78d9000 0x400>;
+			interrupts = <GIC_SPI 134 IRQ_TYPE_NONE>;
+			usb-phy = <&usb_otg>;
+			status = "disabled";
+		};
+
+		usb_otg: phy@78d9000 {
+			compatible = "qcom,usb-otg-snps";
+			reg = <0x78d9000 0x400>;
+			interrupts = <GIC_SPI 134 IRQ_TYPE_EDGE_BOTH>,
+				     <GIC_SPI 140 IRQ_TYPE_EDGE_RISING>;
+
+			qcom,vdd-levels = <1 5 7>;
+			qcom,phy-init-sequence = <0x44 0x6B 0x24 0x13>;
+			dr_mode = "peripheral";
+			qcom,otg-control = <2>; // PMIC
+
+			clocks = <&gcc GCC_USB_HS_AHB_CLK>,
+				 <&gcc GCC_USB_HS_SYSTEM_CLK>,
+				 <&gcc GCC_USB2A_PHY_SLEEP_CLK>;
+			clock-names = "iface", "core", "sleep";
+
+			resets = <&gcc GCC_USB2A_PHY_BCR>,
+				 <&gcc GCC_USB_HS_BCR>;
+			reset-names = "phy", "link";
+			status = "disabled";
+		};
+
+		intc: interrupt-controller@b000000 {
+			compatible = "qcom,msm-qgic2";
+			interrupt-controller;
+			#interrupt-cells = <3>;
+			reg = <0x0b000000 0x1000>, <0x0b002000 0x1000>;
+		};
+
+		timer@b020000 {
+			#address-cells = <1>;
+			#size-cells = <1>;
+			ranges;
+			compatible = "arm,armv7-timer-mem";
+			reg = <0xb020000 0x1000>;
+			clock-frequency = <19200000>;
+
+			frame@b021000 {
+				frame-number = <0>;
+				interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>,
+					     <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>;
+				reg = <0xb021000 0x1000>,
+				      <0xb022000 0x1000>;
+			};
+
+			frame@b023000 {
+				frame-number = <1>;
+				interrupts = <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>;
+				reg = <0xb023000 0x1000>;
+				status = "disabled";
+			};
+
+			frame@b024000 {
+				frame-number = <2>;
+				interrupts = <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>;
+				reg = <0xb024000 0x1000>;
+				status = "disabled";
+			};
+
+			frame@b025000 {
+				frame-number = <3>;
+				interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>;
+				reg = <0xb025000 0x1000>;
+				status = "disabled";
+			};
+
+			frame@b026000 {
+				frame-number = <4>;
+				interrupts = <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>;
+				reg = <0xb026000 0x1000>;
+				status = "disabled";
+			};
+
+			frame@b027000 {
+				frame-number = <5>;
+				interrupts = <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>;
+				reg = <0xb027000 0x1000>;
+				status = "disabled";
+			};
+
+			frame@b028000 {
+				frame-number = <6>;
+				interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
+				reg = <0xb028000 0x1000>;
+				status = "disabled";
+			};
+		};
+
+		spmi_bus: spmi@200f000 {
+			compatible = "qcom,spmi-pmic-arb";
+			reg = <0x200f000 0x001000>,
+			      <0x2400000 0x400000>,
+			      <0x2c00000 0x400000>,
+			      <0x3800000 0x200000>,
+			      <0x200a000 0x002100>;
+			reg-names = "core", "chnls", "obsrvr", "intr", "cnfg";
+			interrupt-names = "periph_irq";
+			interrupts = <GIC_SPI 190 IRQ_TYPE_NONE>;
+			qcom,ee = <0>;
+			qcom,channel = <0>;
+			#address-cells = <2>;
+			#size-cells = <0>;
+			interrupt-controller;
+			#interrupt-cells = <4>;
+		};
+
+		rng@22000 {
+			compatible = "qcom,prng";
+			reg = <0x00022000 0x200>;
+			clocks = <&gcc GCC_PRNG_AHB_CLK>;
+			clock-names = "core";
+		};
+	};
+};
+
+#include "msm8916-pins.dtsi"
diff --git a/arch/arm64/boot/dts/qcom/msm8996-agave-adp.dtsi b/arch/arm64/boot/dts/qcom/msm8996-agave-adp.dtsi
new file mode 100644
index 000000000000..2dc5c919190c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-agave-adp.dtsi
@@ -0,0 +1,1467 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8996-pinctrl.dtsi"
+#include "msm8996-camera-sensor-adp.dtsi"
+#include "msm8996-wsa881x.dtsi"
+
+/ {
+	bluetooth: bt_qca6174 {
+		compatible = "qca,qca6174";
+		qca,bt-reset-gpio = <&pm8994_gpios 19 0>; /* BT_EN */
+		qca,bt-vdd-core-supply = <&pm8994_s3>;
+		qca,bt-vdd-pa-supply = <&rome_vreg>;
+		qca,bt-vdd-io-supply = <&pm8994_s4>;
+		qca,bt-vdd-xtal-supply = <&pm8994_l30>;
+		qca,bt-chip-pwd-voltage-level = <1300000 1300000>;
+		qca,bt-vdd-io-voltage-level = <1800000 1800000>;
+		qca,bt-vdd-xtal-voltage-level = <1800000 1800000>;
+	};
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&sdcc1_ice {
+	status = "ok";
+};
+
+&ufsphy1 {
+	status = "ok";
+};
+
+&ufs1 {
+	status = "ok";
+};
+
+&pcie0 {
+	qcom,phy-sequence = <0x404 0x01 0x00
+				0x034 0x1c 0x00
+				0x038 0x10 0x00
+				0x174 0x33 0x00
+				0x194 0x06 0x00
+				0x0c8 0x42 0x00
+				0x128 0x00 0x00
+				0x144 0xff 0x00
+				0x148 0x1f 0x00
+				0x178 0x01 0x00
+				0x19c 0x01 0x00
+				0x18c 0x00 0x00
+				0x184 0x0a 0x00
+				0x00c 0x09 0x00
+				0x0d0 0x82 0x00
+				0x0e4 0x03 0x00
+				0x0e0 0x55 0x00
+				0x0dc 0x55 0x00
+				0x054 0x00 0x00
+				0x050 0x1a 0x00
+				0x04c 0x0a 0x00
+				0x174 0x33 0x00
+				0x03c 0x02 0x00
+				0x040 0x1f 0x00
+				0x0ac 0x04 0x00
+				0x078 0x0b 0x00
+				0x084 0x16 0x00
+				0x090 0x28 0x00
+				0x10c 0x00 0x00
+				0x108 0x80 0x00
+				0x010 0x01 0x00
+				0x01c 0x31 0x00
+				0x020 0x01 0x00
+				0x014 0x02 0x00
+				0x018 0x00 0x00
+				0x024 0x2f 0x00
+				0x028 0x19 0x00
+				0x0c4 0x15 0x00
+				0x070 0x0f 0x00
+				0x048 0x0f 0x00
+				0x074 0x19 0x00
+				0x038 0x10 0x00
+				0x178 0x00 0x00
+				0x0c4 0x40 0x00
+				0x400 0x00 0x00
+				0x408 0x03 0x00>;
+
+	qcom,port-phy-sequence = <0x1068 0x45 0x00
+				0x1094 0x06 0x00
+				0x1310 0x1c 0x00
+				0x1318 0x17 0x00
+				0x12d8 0x01 0x00
+				0x12dc 0x00 0x00
+				0x12e0 0xdb 0x00
+				0x1320 0x18 0x00
+				0x121c 0x04 0x00
+				0x1210 0x04 0x00
+				0x1458 0x4c 0x00
+				0x14a0 0x00 0x00
+				0x14a4 0x01 0x00
+				0x14a8 0x05 0x00
+				0x1248 0x4b 0x00
+				0x131c 0x14 0x00
+				0x1454 0x05 0x00
+				0x1404 0x02 0x00
+				0x146c 0x00 0x00
+				0x1460 0xa3 0x00
+				0x1318 0x19 0x00
+				0x1428 0x0e 0x00
+				0x1054 0x08 0x00
+				0x14f8 0x04 0x00
+				0x14ec 0x06 0x00
+				0x104c 0x2e 0x00
+				0x1404 0x03 0x0a
+				0x1400 0x00 0x00
+				0x1408 0x0a 0x00>;
+
+	/delete-property/ qcom,l1-supported;
+	/delete-property/ qcom,l1ss-supported;
+	/delete-property/ qcom,aux-clk-sync;
+};
+
+&pcie1 {
+	qcom,phy-sequence = <0x404 0x01 0x00
+				0x034 0x1c 0x00
+				0x038 0x10 0x00
+				0x174 0x33 0x00
+				0x194 0x06 0x00
+				0x0c8 0x42 0x00
+				0x128 0x00 0x00
+				0x144 0xff 0x00
+				0x148 0x1f 0x00
+				0x178 0x01 0x00
+				0x19c 0x01 0x00
+				0x18c 0x00 0x00
+				0x184 0x0a 0x00
+				0x00c 0x09 0x00
+				0x0d0 0x82 0x00
+				0x0e4 0x03 0x00
+				0x0e0 0x55 0x00
+				0x0dc 0x55 0x00
+				0x054 0x00 0x00
+				0x050 0x1a 0x00
+				0x04c 0x0a 0x00
+				0x174 0x33 0x00
+				0x03c 0x02 0x00
+				0x040 0x1f 0x00
+				0x0ac 0x04 0x00
+				0x078 0x0b 0x00
+				0x084 0x16 0x00
+				0x090 0x28 0x00
+				0x10c 0x00 0x00
+				0x108 0x80 0x00
+				0x010 0x01 0x00
+				0x01c 0x31 0x00
+				0x020 0x01 0x00
+				0x014 0x02 0x00
+				0x018 0x00 0x00
+				0x024 0x2f 0x00
+				0x028 0x19 0x00
+				0x0c4 0x15 0x00
+				0x070 0x0f 0x00
+				0x048 0x0f 0x00
+				0x074 0x19 0x00
+				0x038 0x10 0x00
+				0x178 0x00 0x00
+				0x0c4 0x40 0x00
+				0x400 0x00 0x00
+				0x408 0x03 0x00>;
+
+	qcom,port-phy-sequence = <0x2068 0x45 0x00
+				0x2094 0x06 0x00
+				0x2310 0x1c 0x00
+				0x2318 0x17 0x00
+				0x22d8 0x01 0x00
+				0x22dc 0x00 0x00
+				0x22e0 0xdb 0x00
+				0x2320 0x18 0x00
+				0x221c 0x04 0x00
+				0x2210 0x04 0x00
+				0x2458 0x4c 0x00
+				0x24a0 0x00 0x00
+				0x24a4 0x01 0x00
+				0x24a8 0x05 0x00
+				0x2248 0x4b 0x00
+				0x231c 0x14 0x00
+				0x2454 0x05 0x00
+				0x2404 0x02 0x00
+				0x246c 0x00 0x00
+				0x2460 0xa3 0x00
+				0x2318 0x19 0x00
+				0x2428 0x0e 0x00
+				0x2054 0x08 0x00
+				0x24f8 0x04 0x00
+				0x24ec 0x06 0x00
+				0x204c 0x2e 0x00
+				0x2404 0x03 0x0a
+				0x2400 0x00 0x00
+				0x2408 0x0a 0x00>;
+
+	qcom,msi-gicm-addr = <0x09BD0040>;
+	qcom,msi-gicm-base = <0x240>;
+
+	/delete-property/ qcom,l1-supported;
+	/delete-property/ qcom,l1ss-supported;
+	/delete-property/ qcom,aux-clk-sync;
+};
+
+&pcie2 {
+	qcom,phy-sequence = <0x404 0x01 0x00
+				0x034 0x1c 0x00
+				0x038 0x10 0x00
+				0x174 0x33 0x00
+				0x194 0x06 0x00
+				0x0c8 0x42 0x00
+				0x128 0x00 0x00
+				0x144 0xff 0x00
+				0x148 0x1f 0x00
+				0x178 0x01 0x00
+				0x19c 0x01 0x00
+				0x18c 0x00 0x00
+				0x184 0x0a 0x00
+				0x00c 0x09 0x00
+				0x0d0 0x82 0x00
+				0x0e4 0x03 0x00
+				0x0e0 0x55 0x00
+				0x0dc 0x55 0x00
+				0x054 0x00 0x00
+				0x050 0x1a 0x00
+				0x04c 0x0a 0x00
+				0x174 0x33 0x00
+				0x03c 0x02 0x00
+				0x040 0x1f 0x00
+				0x0ac 0x04 0x00
+				0x078 0x0b 0x00
+				0x084 0x16 0x00
+				0x090 0x28 0x00
+				0x10c 0x00 0x00
+				0x108 0x80 0x00
+				0x010 0x01 0x00
+				0x01c 0x31 0x00
+				0x020 0x01 0x00
+				0x014 0x02 0x00
+				0x018 0x00 0x00
+				0x024 0x2f 0x00
+				0x028 0x19 0x00
+				0x0c4 0x15 0x00
+				0x070 0x0f 0x00
+				0x048 0x0f 0x00
+				0x074 0x19 0x00
+				0x038 0x10 0x00
+				0x178 0x00 0x00
+				0x0c4 0x40 0x00
+				0x400 0x00 0x00
+				0x408 0x03 0x00>;
+
+	qcom,port-phy-sequence = <0x3068 0x45 0x00
+				0x3094 0x06 0x00
+				0x3310 0x1c 0x00
+				0x3318 0x17 0x00
+				0x32d8 0x01 0x00
+				0x32dc 0x00 0x00
+				0x32e0 0xdb 0x00
+				0x3320 0x18 0x00
+				0x321c 0x04 0x00
+				0x3210 0x04 0x00
+				0x3458 0x4c 0x00
+				0x34a0 0x00 0x00
+				0x34a4 0x01 0x00
+				0x34a8 0x05 0x00
+				0x3248 0x4b 0x00
+				0x331c 0x14 0x00
+				0x3454 0x05 0x00
+				0x3404 0x02 0x00
+				0x346c 0x00 0x00
+				0x3460 0xa3 0x00
+				0x3318 0x19 0x00
+				0x3428 0x0e 0x00
+				0x3054 0x08 0x00
+				0x34f8 0x04 0x00
+				0x34ec 0x06 0x00
+				0x304c 0x2e 0x00
+				0x3404 0x03 0x0a
+				0x3400 0x00 0x00
+				0x3408 0x0a 0x00>;
+
+	/delete-property/ qcom,l1-supported;
+	/delete-property/ qcom,l1ss-supported;
+	/delete-property/ qcom,aux-clk-sync;
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&sdhc_1 {
+	vdd-supply = <&pm8994_l20>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	vdd-io-supply = <&pm8994_s4>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <110 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000
+				96000000 192000000 384000000>;
+	qcom,ice-clk-rates = <300000000 150000000>;
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8994_l21>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8994_l13>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000
+				50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x1>;
+
+	status = "ok";
+};
+
+&pm8994_vadc {
+	chan@5 {
+		label = "vcoin";
+		reg = <5>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7 {
+		label = "vph_pwr";
+		reg = <7>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8994_adc_tm {
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x48>;
+		qcom,thermal-node;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x80>;
+		qcom,thermal-node;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x88>;
+		qcom,thermal-node;
+	};
+};
+
+&mdss_hdmi_tx {
+	qcom,display-id = "secondary";
+	pinctrl-names = "hdmi_hpd_active", "hdmi_ddc_active", "hdmi_cec_active",
+				"hdmi_active", "hdmi_sleep";
+	pinctrl-0 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_suspend
+						&mdss_hdmi_cec_suspend>;
+	pinctrl-1 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+						&mdss_hdmi_cec_suspend>;
+	pinctrl-2 = <&mdss_hdmi_hpd_active &mdss_hdmi_cec_active
+						&mdss_hdmi_ddc_suspend>;
+	pinctrl-3 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+						&mdss_hdmi_cec_active>;
+	pinctrl-4 = <&mdss_hdmi_hpd_suspend &mdss_hdmi_ddc_suspend
+						&mdss_hdmi_cec_suspend>;
+	/delete-property/ qcom,pluggable;
+};
+
+#include "msm8996-sde-display.dtsi"
+
+&sde_kms {
+	qcom,mdss-pref-prim-intf = "dsi";
+	qcom,sde-plane-id-map {
+		qcom,sde-plane-id@0 {
+			reg = <0x0>;
+			qcom,display-type = "primary";
+			qcom,plane-name = "rgb0", "rgb1";
+			qcom,plane-type = "primary";
+		};
+
+		qcom,sde-plane-id@1 {
+			reg = <0x1>;
+			qcom,display-type = "primary";
+			qcom,plane-name = "vig0", "vig1";
+			qcom,plane-type = "overlay";
+		};
+
+		qcom,sde-plane-id@2 {
+			reg = <0x2>;
+			qcom,display-type = "primary";
+			qcom,plane-name = "cursor0";
+			qcom,plane-type = "cursor";
+		};
+
+		qcom,sde-plane-id@3 {
+			reg = <0x3>;
+			qcom,display-type = "secondary";
+			qcom,plane-name = "rgb2";
+			qcom,plane-type = "primary";
+		};
+
+		qcom,sde-plane-id@4 {
+			reg = <0x4>;
+			qcom,display-type = "secondary";
+			qcom,plane-name = "vig2";
+			qcom,plane-type = "overlay";
+		};
+
+		qcom,sde-plane-id@5 {
+			reg = <0x5>;
+			qcom,display-type = "secondary";
+			qcom,plane-name = "dma0";
+			qcom,plane-type = "overlay";
+		};
+
+		qcom,sde-plane-id@6 {
+			reg = <0x6>;
+			qcom,display-type = "secondary";
+			qcom,plane-name = "cursor1";
+			qcom,plane-type = "cursor";
+		};
+
+		qcom,sde-plane-id@7 {
+			reg = <0x7>;
+			qcom,display-type = "tertiary";
+			qcom,plane-name = "rgb3";
+			qcom,plane-type = "primary";
+		};
+
+		qcom,sde-plane-id@8 {
+			reg = <0x8>;
+			qcom,display-type = "tertiary";
+			qcom,plane-name = "vig3";
+			qcom,plane-type = "overlay";
+		};
+
+		qcom,sde-plane-id@9 {
+			reg = <0x9>;
+			qcom,display-type = "tertiary";
+			qcom,plane-name = "dma1";
+			qcom,plane-type = "overlay";
+		};
+	};
+};
+
+&dsi_adv_7533_1 {
+	qcom,dsi-display-active;
+	qcom,dsi-panel = <&dsi_adv7533_1080p>;
+
+	qcom,panel-supply-entries {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "vdd";
+			qcom,supply-min-voltage = <3300000>;
+			qcom,supply-max-voltage = <3300000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+
+		qcom,panel-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "vddio";
+			qcom,supply-min-voltage = <1800000>;
+			qcom,supply-max-voltage = <1800000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+	};
+};
+
+&dsi_adv_7533_2 {
+	qcom,dsi-display-active;
+	qcom,dsi-panel = <&dsi_adv7533_1080p>;
+
+	qcom,panel-supply-entries {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "vdd";
+			qcom,supply-min-voltage = <3300000>;
+			qcom,supply-max-voltage = <3300000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+
+		qcom,panel-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "vddio";
+			qcom,supply-min-voltage = <1800000>;
+			qcom,supply-max-voltage = <1800000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+	};
+};
+
+&mdss_dsi {
+	hw-config = "dual_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_adv7533_720p>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,display-id = "primary";
+	qcom,bridge-index = <0>;
+
+	qcom,panel-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,panel-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vdd";
+				qcom,supply-min-voltage = <3300000>;
+				qcom,supply-max-voltage = <3300000>;
+				qcom,supply-enable-load = <100000>;
+				qcom,supply-disable-load = <100>;
+			};
+
+			qcom,panel-supply-entry@1 {
+				reg = <1>;
+				qcom,supply-name = "vddio";
+				qcom,supply-min-voltage = <1800000>;
+				qcom,supply-max-voltage = <1800000>;
+				qcom,supply-enable-load = <100000>;
+				qcom,supply-disable-load = <100>;
+			};
+	};
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_adv7533_720p>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,display-id = "tertiary";
+	qcom,bridge-index = <1>;
+
+	qcom,panel-supply-entries {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+			qcom,panel-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vdd";
+				qcom,supply-min-voltage = <3300000>;
+				qcom,supply-max-voltage = <3300000>;
+				qcom,supply-enable-load = <100000>;
+				qcom,supply-disable-load = <100>;
+			};
+
+			qcom,panel-supply-entry@1 {
+				reg = <1>;
+				qcom,supply-name = "vddio";
+				qcom,supply-min-voltage = <1800000>;
+				qcom,supply-max-voltage = <1800000>;
+				qcom,supply-enable-load = <100000>;
+				qcom,supply-disable-load = <100>;
+			};
+	};
+};
+
+&dsi_dual_sharp_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled = "single_roi";
+	qcom,panel-roi-alignment = <720 128 720 64 720 64>;
+};
+
+&dsi_nt35597_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35597_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_jdi_video {
+	pwms = <&pmi8994_pwm_4 0 0>;
+	pwm-names = "backlight";
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-pwm-pmi;
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,5v-boost-gpio = <&pmi8994_gpios 8 0>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_jdi_cmd {
+	pwms = <&pmi8994_pwm_4 0 0>;
+	pwm-names = "backlight";
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-pwm-pmi;
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,5v-boost-gpio = <&pmi8994_gpios 8 0>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled = "single_roi";
+	qcom,panel-roi-alignment = <4 4 2 2 20 20>;
+};
+
+&dsi_dual_jdi_4k_nofbc_video {
+	pwms = <&pmi8994_pwm_4 0 0>;
+	pwm-names = "backlight";
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-pwm-pmi;
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+/{
+	mtp_batterydata: qcom,battery-data {
+		qcom,batt-id-range-pct = <15>;
+		#include "batterydata-itech-3000mah.dtsi"
+	};
+};
+
+&pm8994_mpps {
+	mpp@a100 { /* MPP 2 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	mpp@a300 { /* MPP 4 */
+		/* HDMI_5v_vreg regulator enable */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <0>;
+		status = "okay";
+	};
+};
+
+&soc {
+	qcom,ntn_avb {
+		compatible = "qcom,ntn_avb";
+
+		ntn-rst-gpio = <&pm8994_gpios 13 0>;
+
+		vdd-ntn-hsic-supply = <&pm8994_l25>;
+		vdd-ntn-pci-supply = <&pm8994_s4>;
+		vdd-ntn-io-supply = <&pm8994_s4>;
+
+		qcom,ntn-rst-delay-msec = <100>;
+		qcom,ntn-rc-num = <1>;
+		qcom,ntn-bus-num = <1>;
+		qcom,ntn-mdio-bus-id = <1>;
+		qcom,ntn-phy-addr = <7>;
+
+		qcom,msm-bus,name = "ntn";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<100 512 0 0>,
+				<100 512 207108 14432000>;
+	};
+
+	i2c@75ba000 {
+		synaptics@20 {
+			compatible = "synaptics,dsx";
+			reg = <0x20>;
+			interrupt-parent = <&tlmm>;
+			interrupts = <125 0x2008>;
+			vdd-supply = <&pm8994_l14>;
+			avdd-supply = <&pm8994_l22>;
+			pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+			pinctrl-0 = <&ts_active>;
+			pinctrl-1 = <&ts_suspend>;
+			synaptics,display-coords = <0 0 1599 2559>;
+			synaptics,panel-coords = <0 0 1599 2703>;
+			synaptics,reset-gpio = <&tlmm 89 0x00>;
+			synaptics,irq-gpio = <&tlmm 125 0x2008>;
+			synaptics,disable-gpios;
+			synaptics,fw-name = "PR1702898-s3528t_00350002.img";
+			/* Underlying clocks used by secure touch */
+			clock-names = "iface_clk", "core_clk";
+			clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+				 <&clock_gcc clk_gcc_blsp2_qup6_i2c_apps_clk>;
+			status = "disabled";
+		};
+	};
+
+	i2c@75b6000 { /* BLSP8 */
+		/* ADV7533 configuration */
+		adv7533@3d {
+			compatible = "adv7533";
+			instance_id = <0>;
+			reg = <0x3d>;
+			adi,video-mode = <3>; /* 3 = 1080p */
+			adi,main-addr = <0x3D>;
+			adi,cec-dsi-addr = <0x3E>;
+			adi,enable-audio;
+			pinctrl-names = "pmx_adv7533_active",
+				"pmx_adv7533_suspend";
+			pinctrl-0 = <&adv7533_0_int_active
+				&adv7533_0_hpd_int_active
+				&adv7533_0_switch_active>;
+			pinctrl-1 = <&adv7533_0_int_suspend
+				&adv7533_0_hpd_int_suspend
+				&adv7533_0_switch_suspend>;
+			adi,irq-gpio = <&tlmm 106 0x2002>;
+			adi,switch-gpio = <&tlmm 105 0x1>;
+		};
+
+		adv7533@39 {
+			compatible = "adv7533";
+			instance_id = <1>;
+			reg = <0x39>;
+			adi,video-mode = <3>; /* 3 = 1080p */
+			adi,main-addr = <0x39>;
+			adi,cec-dsi-addr = <0x3C>;
+			adi,enable-audio;
+			pinctrl-names = "pmx_adv7533_active",
+				"pmx_adv7533_suspend";
+			pinctrl-0 = <&adv7533_1_int_active
+				&adv7533_1_hpd_int_active
+				&adv7533_1_switch_active>;
+			pinctrl-1 = <&adv7533_1_int_suspend
+				&adv7533_1_hpd_int_suspend
+				&adv7533_1_switch_suspend>;
+			adi,irq-gpio = <&tlmm 108 0x2002>;
+			adi,switch-gpio = <&tlmm 107 0x0>;
+		};
+	};
+
+	gen-vkeys {
+		compatible = "qcom,gen-vkeys";
+		label = "synaptics_dsx";
+		qcom,disp-maxx = <1599>;
+		qcom,disp-maxy = <2559>;
+		qcom,panel-maxx = <1599>;
+		qcom,panel-maxy = <2703>;
+		qcom,key-codes = <158 139 102 217>;
+	};
+
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8994_gpios 2 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_snapshot {
+			label = "cam_snapshot";
+			gpios = <&pm8994_gpios 4 0x1>;
+			linux,input-type = <1>;
+			linux,code = <766>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_focus {
+			label = "cam_focus";
+			gpios = <&pm8994_gpios 5 0x1>;
+			linux,input-type = <1>;
+			linux,code = <528>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+
+	sound-9335 {
+		status = "disabled";
+	};
+
+	sound-adp-agave {
+		compatible = "qcom,apq8096-asoc-snd-adp-agave";
+		qcom,model = "apq8096-adp-agave-snd-card";
+
+		asoc-platform = <&pcm0>, <&pcm1>, <&pcm2>, <&voip>, <&voice>,
+				<&loopback>, <&compress>, <&hostless>,
+				<&afe>, <&lsm>, <&routing>, <&pcmnoirq>,
+				<&loopback1>;
+		asoc-platform-names = "msm-pcm-dsp.0", "msm-pcm-dsp.1",
+				"msm-pcm-dsp.2", "msm-voip-dsp",
+				"msm-pcm-voice", "msm-pcm-loopback",
+				"msm-compress-dsp", "msm-pcm-hostless",
+				"msm-pcm-afe", "msm-lsm-client",
+				"msm-pcm-routing", "msm-pcm-dsp-noirq",
+				"msm-pcm-loopback.1";
+		asoc-cpu = <&dai_pri_auxpcm>, <&dai_sec_auxpcm>, <&dai_hdmi>,
+				<&dai_mi2s_sec>, <&dai_mi2s>, <&dai_mi2s_quat>,
+				<&afe_pcm_rx>, <&afe_pcm_tx>,
+				<&afe_proxy_rx>, <&afe_proxy_tx>,
+				<&incall_record_rx>, <&incall_record_tx>,
+				<&incall_music_rx>, <&incall_music2_rx>,
+				<&dai_pri_tdm_tx_0>, <&dai_pri_tdm_tx_1>,
+				<&dai_pri_tdm_tx_2>, <&dai_pri_tdm_tx_3>,
+				<&dai_pri_tdm_rx_0>, <&dai_pri_tdm_rx_1>,
+				<&dai_pri_tdm_rx_2>, <&dai_pri_tdm_rx_3>,
+				<&dai_sec_tdm_tx_0>, <&dai_sec_tdm_tx_1>,
+				<&dai_sec_tdm_tx_2>, <&dai_sec_tdm_tx_3>,
+				<&dai_tert_tdm_rx_0>, <&dai_tert_tdm_rx_1>,
+				<&dai_tert_tdm_rx_2>, <&dai_tert_tdm_rx_3>,
+				<&dai_tert_tdm_rx_4>, <&dai_tert_tdm_tx_0>,
+				<&dai_tert_tdm_tx_1>, <&dai_tert_tdm_tx_2>,
+				<&dai_tert_tdm_tx_3>, <&dai_quat_tdm_rx_0>,
+				<&dai_quat_tdm_rx_1>, <&dai_quat_tdm_rx_2>,
+				<&dai_quat_tdm_rx_3>, <&dai_quat_tdm_tx_0>,
+				<&dai_quat_tdm_tx_1>, <&dai_quat_tdm_tx_2>,
+				<&dai_quat_tdm_tx_3>;
+		asoc-cpu-names = "msm-dai-q6-auxpcm.1", "msm-dai-q6-auxpcm.2",
+				"msm-dai-q6-hdmi.8", "msm-dai-q6-mi2s.1",
+				"msm-dai-q6-mi2s.2", "msm-dai-q6-mi2s.3",
+				"msm-dai-q6-dev.224", "msm-dai-q6-dev.225",
+				"msm-dai-q6-dev.241", "msm-dai-q6-dev.240",
+				"msm-dai-q6-dev.32771", "msm-dai-q6-dev.32772",
+				"msm-dai-q6-dev.32773", "msm-dai-q6-dev.32770",
+				"msm-dai-q6-tdm.36865", "msm-dai-q6-tdm.36867",
+				"msm-dai-q6-tdm.36869", "msm-dai-q6-tdm.36871",
+				"msm-dai-q6-tdm.36864", "msm-dai-q6-tdm.36866",
+				"msm-dai-q6-tdm.36868", "msm-dai-q6-tdm.36870",
+				"msm-dai-q6-tdm.36881", "msm-dai-q6-tdm.36883",
+				"msm-dai-q6-tdm.36885", "msm-dai-q6-tdm.36887",
+				"msm-dai-q6-tdm.36896", "msm-dai-q6-tdm.36898",
+				"msm-dai-q6-tdm.36900", "msm-dai-q6-tdm.36902",
+				"msm-dai-q6-tdm.36904", "msm-dai-q6-tdm.36897",
+				"msm-dai-q6-tdm.36899", "msm-dai-q6-tdm.36901",
+				"msm-dai-q6-tdm.36903", "msm-dai-q6-tdm.36912",
+				"msm-dai-q6-tdm.36914", "msm-dai-q6-tdm.36916",
+				"msm-dai-q6-tdm.36918", "msm-dai-q6-tdm.36913",
+				"msm-dai-q6-tdm.36915", "msm-dai-q6-tdm.36917",
+				"msm-dai-q6-tdm.36919";
+		asoc-codec = <&stub_codec>;
+		asoc-codec-names = "msm-stub-codec.1";
+	};
+
+	usb_detect: usb_detect {
+		compatible = "qcom,gpio-usbdetect";
+		qcom,vbus-det-gpio = <&pm8994_gpios 17 0>;
+		interrupt-parent = <&spmi_bus>;
+		interrupts = <0x0 0x9 0x0 IRQ_TYPE_NONE>;
+		interrupt-names ="pmic_id_irq";
+	};
+
+	loopback1: qcom,msm-pcm-loopback-low-latency {
+		compatible = "qcom,msm-pcm-loopback";
+		qcom,msm-pcm-loopback-low-latency;
+	};
+
+	loopback1: qcom,msm-pcm-loopback-low-latency {
+		compatible = "qcom,msm-pcm-loopback";
+		qcom,msm-pcm-loopback-low-latency;
+	};
+
+	qcom,msm-dai-mi2s {
+		dai_mi2s_sec: qcom,msm-dai-q6-mi2s-sec {
+			qcom,msm-mi2s-rx-lines = <2>;
+			qcom,msm-mi2s-tx-lines = <1>;
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&sec_mi2s_active &sec_mi2s_sd0_active
+				&sec_mi2s_sd1_active>;
+			pinctrl-1 = <&sec_mi2s_sleep &sec_mi2s_sd0_sleep
+				&sec_mi2s_sd1_sleep>;
+		};
+
+		dai_mi2s: qcom,msm-dai-q6-mi2s-tert {
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&tert_mi2s_active &tert_mi2s_sd0_active>;
+			pinctrl-1 = <&tert_mi2s_sleep &tert_mi2s_sd0_sleep>;
+		};
+
+		dai_mi2s_quat: qcom,msm-dai-q6-mi2s-quat {
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&quat_mi2s_active &quat_mi2s_sd0_active>;
+			pinctrl-1 = <&quat_mi2s_sleep &quat_mi2s_sd0_sleep>;
+		};
+	};
+
+	qcom,msm-dai-tdm-tert-rx {
+		pinctrl-names = "default", "sleep";
+		pinctrl-0 = <&tert_tdm_dout_active>;
+		pinctrl-1 = <&tert_tdm_dout_sleep>;
+	};
+
+	qcom,msm-dai-tdm-quat-rx {
+		pinctrl-names = "default", "sleep";
+		pinctrl-0 = <&quat_tdm_dout_active>;
+		pinctrl-1 = <&quat_tdm_dout_sleep>;
+	};
+
+	qcom,adv7481@70 {
+		compatible = "qcom,adv7481";
+		reg = <0x70 0xff>;
+		cam_vdig-supply = <&pm8994_s3>;
+		/* Cameras powered by PMIC: */
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l17>;
+		/* Self-powered cameras: */
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1300000 0 2500000>;
+		qcom,cam-vreg-max-voltage = <1300000 0 2500000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 17 0>,          /* I2C SDA */
+			<&tlmm 18 0>,          /* I2C SCL */
+			<&pm8994_gpios 4 0>,   /* RST     */
+			<&pm8994_gpios 5 0>,   /* INT1    */
+			<&pm8994_gpios 6 0>,   /* INT2    */
+			<&pm8994_gpios 7 0>;   /* INT3    */
+	};
+
+	qcom,msm-ba {
+		compatible = "qcom,msm-ba";
+		qcom,ba-input-profile-0 {
+			qcom,type = <4>;          /* input type   */
+			qcom,name = "HDMI-1";     /* input name   */
+			qcom,ba-input = <13>;     /* ba input id  */
+			qcom,ba-output = <0>;     /* ba output id */
+			qcom,sd-name = "adv7481"; /* sd name      */
+			qcom,ba-node = <0>;       /* ba node      */
+			qcom,user-type = <1>;     /* user type    */
+		};
+
+		qcom,ba-input-profile-1 {
+			qcom,type = <0>;          /* input type   */
+			qcom,name = "CVBS-0";     /* input name   */
+			qcom,ba-input = <0>;      /* ba input id  */
+			qcom,ba-output = <0>;     /* ba output id */
+			qcom,sd-name = "adv7481"; /* sd name      */
+			qcom,ba-node = <1>;       /* ba node      */
+			qcom,user-type = <1>;     /* user type    */
+		};
+	};
+};
+
+&pm8994_gpios {
+	gpio@c600 { /* GPIO 7 - adv7481 INT3 */
+		qcom,mode = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c700 { /* GPIO 8 - WLAN_EN */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@c800 { /* GPIO 9 - Rome 3.3V control */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* MOS logic */
+		qcom,invert = <1>;		/* Output high */
+		qcom,vin-sel = <0>;		/* VPH_PWR */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,out-strength = <1>;	/* High drive strength */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@c900 { /* GPIO 10 - NFC CLK _REQ*/
+		qcom,mode = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@cd00 { /* GPIO 14 - lcd_bklt_reg_en */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <1>;	/* output hight initially */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,out-strength = <1>;	/* Low drive strength */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+	gpio@c100 { /* GPIO 2 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c300 { /* GPIO 4 - adv7481 RST */
+		qcom,mode = <1>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c400 { /* GPIO 5 - adv7481 INT1 */
+		qcom,mode = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c500 { /* GPIO 6 - adv7481 INT2*/
+		qcom,mode = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@ca00 { /* GPIO 11 - USB enb1 (otg switch) */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,master-en = <1>;	/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@cc00 { /* GPIO 13 - NTN_RST */
+		qcom,mode = <1>; /* DIGITAL OUT */
+		qcom,output-type = <0>; /* CMOS logic */
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>; /* 1.8 */
+		qcom,out-strength = <1>;
+		qcom,src-sel = <0>; /* GPIO */
+		qcom,master-en = <1>; /* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@ce00 { /* GPIO 15 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@d000 { /* GPIO 17 - USB1 VBUS detect */
+		qcom,mode = <0>;	/* Digital Input*/
+		qcom,pull = <5>;	/* No pull */
+		qcom,vin-sel = <2>;	/* 1.8 V */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,master-en = <1>;	/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@d100 { /* GPIO 18 - Rome Sleep Clock */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <0>;		/* Output low initially */
+		qcom,vin-sel = <2>;		/* VIN 2 */
+		qcom,src-sel = <3>;		/* Function 2 */
+		qcom,out-strength = <2>;	/* Medium */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@d200 { /* GPIO 19 - Rome BT Reset */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&usb2s {
+	status = "ok";
+};
+
+&usb3 {
+	extcon = <&usb_detect>;
+	vbus_dwc3-supply = <&usb_otg_switch>;
+	vdda33-supply = <&pm8994_l24>;
+	vdda18-supply = <&pm8994_l12>;
+};
+
+&blsp1_uart2 {
+	status = "ok";
+};
+
+&i2c_6 {
+	at24@51 {
+		compatible = "atmel,24c32";
+		reg = <0x51>;
+	};
+};
+
+&i2c_7 {
+	silabs4705@11 { /* SiLabs FM chip, slave id 0x11*/
+		status = "ok";
+		compatible = "silabs,si4705";
+		reg = <0x11>;
+		vdd-supply = <&pm8994_s4>;
+		silabs,vdd-supply-voltage = <1800000 1800000>;
+		va-supply = <&rome_vreg>;
+		silabs,va-supply-voltage = <3300000 3300000>;
+		pinctrl-names = "pmx_fm_active","pmx_fm_suspend";
+		pinctrl-0 = <&fm_int_active &fm_status_int_active
+						 &fm_rst_active>;
+		pinctrl-1 = <&fm_int_suspend &fm_status_int_suspend
+						&fm_rst_suspend>;
+		silabs,reset-gpio = <&tlmm 39 0>;
+		silabs,int-gpio = <&tlmm 38 0>;
+		silabs,status-gpio = <&tlmm 78 0>;
+		#address-cells = <0>;
+		interrupts = <0 1>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-map = <
+				  0 &tlmm 38 2
+				  1 &tlmm 78 1
+				>;
+		interrupt-names = "silabs_fm_int", "silabs_fm_status_int";
+	};
+};
+
+&i2c_8 { /* BLSP2 QUP2 */
+	nq@28 {
+		compatible = "qcom,nq-nci";
+		reg = <0x28>;
+		qcom,nq-irq = <&tlmm 9 0x00>;
+		qcom,nq-ven = <&tlmm 12 0x00>;
+		qcom,nq-firm = <&pm8994_gpios 7 0x00>;
+		qcom,nq-clkreq = <&pm8994_gpios 10 0x00>;
+		interrupt-parent = <&tlmm>;
+		qcom,clk-src = "BBCLK2";
+		interrupts = <9 0>;
+		interrupt-names = "nfc_irq";
+		pinctrl-names = "nfc_active", "nfc_suspend";
+		pinctrl-0 = <&nfc_int_active &nfc_disable_active>;
+		pinctrl-1 = <&nfc_int_suspend &nfc_disable_suspend>;
+		clocks = <&clock_gcc clk_bb_clk2_pin>;
+		clock-names = "ref_clk";
+		status = "disabled";
+	};
+};
+
+&dsi_dual_jdi_video {
+	/delete-property/ pwms;
+	/delete-property/ qcom,5v-boost-gpio;
+};
+
+&dsi_dual_jdi_cmd {
+	/delete-property/ pwms;
+	/delete-property/ qcom,5v-boost-gpio;
+};
+
+&dsi_dual_jdi_4k_nofbc_video {
+	/delete-property/ pwms;
+};
+
+&soc {
+	sound-9335 {
+		/delete-property/ qcom,hph-en1-gpio;
+	};
+};
+
+&slim_msm {
+	status = "disabled";
+};
+
+/delete-node/  &led_flash0;
+
+&mdss_dsi0 {
+	/delete-property/ lab-supply;
+	/delete-property/ ibb-supply;
+};
+
+&mdss_dsi1 {
+	/delete-property/ lab-supply;
+	/delete-property/ ibb-supply;
+};
+
+&cci {
+	qcom,camera@0 {
+		/delete-property/ qcom,led-flash-src;
+	};
+
+	qcom,camera@1 {
+		/delete-property/ cam_vana-supply;
+	};
+};
+
+&usb_otg_switch {
+	gpio = <&pm8994_gpios 11 0>;
+	enable-active-high;
+	status = "ok";
+	/delete-property/ vin-supply;
+};
+
+&wsa881x_211 {
+	/delete-property/ qcom,spkr-sd-n-gpio;
+};
+
+&wsa881x_212 {
+	/delete-property/ qcom,spkr-sd-n-gpio;
+};
+
+&wsa881x_213 {
+	/delete-property/ qcom,spkr-sd-n-gpio;
+};
+
+&wsa881x_214 {
+	/delete-property/ qcom,spkr-sd-n-gpio;
+};
+
+&spi_9 {
+	status = "ok";
+};
+
+&spi_10 {
+	status = "ok";
+};
+
+&blsp1_uart2 {
+	status = "ok";
+};
+
+&spi_0 {
+	spi_codec@0 {
+		compatible = "qcom,spi-msm-codec-slave";
+		reg = <0>;
+		spi-max-frequency = <2000000>;
+		spi-cpha;
+	};
+};
+
+/ {
+	reserved-memory {
+		lk_mem: lk_pool@91600000 {
+			reg = <0x0 0x91600000 0x0 0x600000>;
+			label = "lk_pool";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-auto-cdp.dtsi b/arch/arm64/boot/dts/qcom/msm8996-auto-cdp.dtsi
new file mode 100644
index 000000000000..1d5e3035afd0
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-auto-cdp.dtsi
@@ -0,0 +1,1242 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8996-pinctrl.dtsi"
+#include "msm8996-camera-sensor-adp.dtsi"
+#include "msm8996-wsa881x.dtsi"
+
+/ {
+	bluetooth: bt_qca6174 {
+		compatible = "qca,qca6174";
+		qca,bt-reset-gpio = <&pm8994_gpios 19 0>; /* BT_EN */
+		qca,bt-vdd-core-supply = <&pm8994_s3>;
+		qca,bt-vdd-pa-supply = <&rome_vreg>;
+		qca,bt-vdd-io-supply = <&pm8994_s4>;
+		qca,bt-vdd-xtal-supply = <&pm8994_l30>;
+		qca,bt-chip-pwd-voltage-level = <1300000 1300000>;
+		qca,bt-vdd-io-voltage-level = <1800000 1800000>;
+		qca,bt-vdd-xtal-voltage-level = <1800000 1800000>;
+	};
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&sdcc1_ice {
+	status = "ok";
+};
+
+&ufsphy1 {
+	status = "ok";
+};
+
+&ufs1 {
+	status = "ok";
+};
+
+&spi_0 {
+	spi_codec@0 {
+		compatible = "qcom,spi-msm-codec-slave";
+		reg = <0>;
+		spi-max-frequency = <2000000>;
+		spi-cpha;
+	};
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&sdhc_1 {
+	vdd-supply = <&pm8994_l20>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	vdd-io-supply = <&pm8994_s4>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <110 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000
+				96000000 192000000 384000000>;
+	qcom,ice-clk-rates = <300000000 150000000>;
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8994_l21>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8994_l13>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on
+		     &sdc2_cd_on_sbc>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off
+		     &sdc2_cd_on_sbc>;
+
+	qcom,clk-rates = <400000 20000000 25000000
+				50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 38 0x1>;
+
+	status = "ok";
+};
+
+&pm8994_vadc {
+	chan@5 {
+		label = "vcoin";
+		reg = <5>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7 {
+		label = "vph_pwr";
+		reg = <7>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8994_adc_tm {
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x48>;
+		qcom,thermal-node;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x80>;
+		qcom,thermal-node;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x88>;
+		qcom,thermal-node;
+	};
+};
+
+&mdss_hdmi_tx {
+	pinctrl-names = "hdmi_hpd_active", "hdmi_ddc_active", "hdmi_cec_active",
+				"hdmi_active", "hdmi_sleep";
+	pinctrl-0 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_suspend
+						&mdss_hdmi_cec_suspend>;
+	pinctrl-1 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+						&mdss_hdmi_cec_suspend>;
+	pinctrl-2 = <&mdss_hdmi_hpd_active &mdss_hdmi_cec_active
+						&mdss_hdmi_ddc_suspend>;
+	pinctrl-3 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+						&mdss_hdmi_cec_active>;
+	pinctrl-4 = <&mdss_hdmi_hpd_suspend &mdss_hdmi_ddc_suspend
+						&mdss_hdmi_cec_suspend>;
+};
+
+#include "msm8996-sde-display.dtsi"
+
+&pmx_mdss {
+	mdss_dsi_active: mdss_dsi_active {
+		mux {
+			pins = "gpio8",  "gpio70";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio8",  "gpio70";
+			drive-strength = <8>; /* 8 mA */
+			bias-disable = <0>; /* no pull */
+			output-high;
+		};
+	};
+
+	mdss_dsi_suspend: mdss_dsi_suspend {
+		mux {
+			pins = "gpio8",  "gpio70";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio8",  "gpio70";
+			drive-strength = <2>; /* 2 mA */
+			bias-pull-down; /* pull down */
+		};
+	};
+};
+
+&sde_kms {
+	qcom,mdss-pref-prim-intf = "dsi";
+	qcom,sde-plane-id-map {
+		qcom,sde-plane-id@0 {
+			reg = <0x0>;
+			qcom,display-type = "primary";
+			qcom,plane-name = "rgb0", "rgb1";
+			qcom,plane-type = "primary";
+		};
+
+		qcom,sde-plane-id@1 {
+			reg = <0x1>;
+			qcom,display-type = "primary";
+			qcom,plane-name = "vig0", "vig1";
+			qcom,plane-type = "overlay";
+		};
+
+		qcom,sde-plane-id@2 {
+			reg = <0x2>;
+			qcom,display-type = "primary";
+			qcom,plane-name = "cursor0";
+			qcom,plane-type = "cursor";
+		};
+
+		qcom,sde-plane-id@3 {
+			reg = <0x3>;
+			qcom,display-type = "secondary";
+			qcom,plane-name = "rgb2";
+			qcom,plane-type = "primary";
+		};
+
+		qcom,sde-plane-id@4 {
+			reg = <0x4>;
+			qcom,display-type = "secondary";
+			qcom,plane-name = "vig2";
+			qcom,plane-type = "overlay";
+		};
+
+		qcom,sde-plane-id@5 {
+			reg = <0x5>;
+			qcom,display-type = "secondary";
+			qcom,plane-name = "dma0";
+			qcom,plane-type = "overlay";
+		};
+
+		qcom,sde-plane-id@6 {
+			reg = <0x6>;
+			qcom,display-type = "secondary";
+			qcom,plane-name = "cursor1";
+			qcom,plane-type = "cursor";
+		};
+
+		qcom,sde-plane-id@7 {
+			reg = <0x7>;
+			qcom,display-type = "tertiary";
+			qcom,plane-name = "rgb3";
+			qcom,plane-type = "primary";
+		};
+
+		qcom,sde-plane-id@8 {
+			reg = <0x8>;
+			qcom,display-type = "tertiary";
+			qcom,plane-name = "vig3";
+			qcom,plane-type = "overlay";
+		};
+
+		qcom,sde-plane-id@9 {
+			reg = <0x9>;
+			qcom,display-type = "tertiary";
+			qcom,plane-name = "dma1";
+			qcom,plane-type = "overlay";
+		};
+	};
+};
+
+&dsi_adv_7533_1 {
+	qcom,dsi-display-active;
+	qcom,dsi-panel = <&dsi_adv7533_1080p>;
+
+	qcom,panel-supply-entries {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "vdd";
+			qcom,supply-min-voltage = <3300000>;
+			qcom,supply-max-voltage = <3300000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+
+		qcom,panel-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "vddio";
+			qcom,supply-min-voltage = <1800000>;
+			qcom,supply-max-voltage = <1800000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+	};
+};
+
+&dsi_adv_7533_2 {
+	qcom,dsi-display-active;
+	qcom,dsi-panel = <&dsi_adv7533_1080p>;
+
+	qcom,panel-supply-entries {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "vdd";
+			qcom,supply-min-voltage = <3300000>;
+			qcom,supply-max-voltage = <3300000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+
+		qcom,panel-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "vddio";
+			qcom,supply-min-voltage = <1800000>;
+			qcom,supply-max-voltage = <1800000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+	};
+};
+
+&mdss_dsi {
+	hw-config = "dual_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_adv7533_1080p>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,display-id = "primary";
+	qcom,bridge-index = <0>;
+
+	qcom,panel-supply-entries {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "vdd";
+			qcom,supply-min-voltage = <3300000>;
+			qcom,supply-max-voltage = <3300000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+
+		qcom,panel-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "vddio";
+			qcom,supply-min-voltage = <1800000>;
+			qcom,supply-max-voltage = <1800000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+	};
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_adv7533_1080p>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,display-id = "tertiary";
+	qcom,bridge-index = <1>;
+
+	qcom,panel-supply-entries {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "vdd";
+			qcom,supply-min-voltage = <3300000>;
+			qcom,supply-max-voltage = <3300000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+
+		qcom,panel-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "vddio";
+			qcom,supply-min-voltage = <1800000>;
+			qcom,supply-max-voltage = <1800000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+	};
+};
+
+&dsi_dual_sharp_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled = "single_roi";
+	qcom,panel-roi-alignment = <720 128 720 64 720 64>;
+};
+
+&dsi_nt35597_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35597_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+/{
+	mtp_batterydata: qcom,battery-data {
+		qcom,batt-id-range-pct = <15>;
+		#include "batterydata-itech-3000mah.dtsi"
+	};
+};
+
+&pm8994_mpps {
+	mpp@a100 { /* MPP 2 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	mpp@a300 { /* MPP 4 */
+		/* HDMI_5v_vreg regulator enable */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <0>;
+		status = "okay";
+	};
+
+	mpp@a500 { /* MPP 6 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	mpp@a700 { /* MPP 8 */
+		/* USB 5V regulator enable */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&soc {
+	ntn1: ntn_avb@1 { /* Neutrno device on RC1*/
+		compatible = "qcom,ntn_avb";
+
+		ntn-rst-gpio = <&pm8994_gpios 13 0>;
+
+		vdd-ntn-hsic-supply = <&pm8994_l25>;
+		vdd-ntn-pci-supply = <&pm8994_s4>;
+		vdd-ntn-io-supply = <&pm8994_s4>;
+
+		qcom,ntn-rst-delay-msec = <100>;
+		qcom,ntn-rc-num = <1>;
+		qcom,ntn-bus-num = <1>;
+		qcom,ntn-mdio-bus-id = <1>;
+		qcom,ntn-phy-addr = <7>;
+
+		qcom,msm-bus,name = "ntn";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<100 512 0 0>,
+				<100 512 207108 14432000>;
+	};
+
+	ntn2: ntn_avb@2 { /*Neutrino device on RC2*/
+		compatible = "qcom,ntn_avb";
+		qcom,ntn-rst-delay-msec = <100>;
+		qcom,ntn-rc-num = <2>;
+		qcom,ntn-bus-num = <1>;
+		qcom,ntn-mdio-bus-id = <2>;
+
+		qcom,msm-bus,name = "ntn";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<108 512 0 0>,
+				<108 512 207108 14432000>;
+	};
+
+	i2c@75ba000 {
+		synaptics@20 {
+			compatible = "synaptics,dsx";
+			reg = <0x20>;
+			interrupt-parent = <&tlmm>;
+			interrupts = <125 0x2008>;
+			vdd-supply = <&pm8994_l14>;
+			avdd-supply = <&pm8994_l22>;
+			pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+			pinctrl-0 = <&ts_active>;
+			pinctrl-1 = <&ts_suspend>;
+			synaptics,display-coords = <0 0 1599 2559>;
+			synaptics,panel-coords = <0 0 1599 2703>;
+			synaptics,reset-gpio = <&tlmm 89 0x00>;
+			synaptics,irq-gpio = <&tlmm 125 0x2008>;
+			synaptics,disable-gpios;
+			synaptics,fw-name = "PR1702898-s3528t_00350002.img";
+			/* Underlying clocks used by secure touch */
+			clock-names = "iface_clk", "core_clk";
+			clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+				 <&clock_gcc clk_gcc_blsp2_qup6_i2c_apps_clk>;
+		};
+	};
+
+	i2c@75b6000 { /* BLSP8 */
+		/* ADV7533 configuration */
+		adv7533@3d {
+			compatible = "adv7533";
+			instance_id = <0>;
+			reg = <0x3d>;
+			adi,video-mode = <3>; /* 3 = 1080p */
+			adi,main-addr = <0x3D>;
+			adi,cec-dsi-addr = <0x3E>;
+			adi,enable-audio;
+			pinctrl-names = "pmx_adv7533_active",
+				"pmx_adv7533_suspend";
+			pinctrl-0 = <&adv7533_0_int_active
+				&adv7533_0_hpd_int_active
+				&adv7533_0_switch_active>;
+			pinctrl-1 = <&adv7533_0_int_suspend
+				&adv7533_0_hpd_int_suspend
+				&adv7533_0_switch_suspend>;
+			adi,irq-gpio = <&tlmm 71 0x2002>;
+			adi,switch-gpio = <&tlmm 72 0x1>;
+		};
+
+		adv7533@39 {
+			compatible = "adv7533";
+			instance_id = <1>;
+			reg = <0x39>;
+			adi,video-mode = <3>; /* 3 = 1080p */
+			adi,main-addr = <0x39>;
+			adi,cec-dsi-addr = <0x3C>;
+			adi,enable-audio;
+			pinctrl-names = "pmx_adv7533_active",
+				"pmx_adv7533_suspend";
+			pinctrl-0 = <&adv7533_1_int_active
+				&adv7533_1_hpd_int_active
+				&adv7533_1_switch_active>;
+			pinctrl-1 = <&adv7533_1_int_suspend
+				&adv7533_1_hpd_int_suspend
+				&adv7533_1_switch_suspend>;
+			adi,irq-gpio = <&tlmm 73 0x2002>;
+			adi,switch-gpio = <&tlmm 74 0x0>;
+		};
+	};
+
+	pinctrl@01010000 {
+		pcie2 {
+			pcie2_perst_default: pcie2_perst_default {
+				mux {
+					pins = "gpio90";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio90";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+
+			pcie2_wake_default: pcie2_wake_default {
+				mux {
+					pins = "gpio54";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio54";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+
+			pcie2_wake_sleep: pcie2_wake_sleep {
+				mux {
+					pins = "gpio54";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio54";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+		};
+	};
+
+	gen-vkeys {
+		compatible = "qcom,gen-vkeys";
+		label = "synaptics_dsx";
+		qcom,disp-maxx = <1599>;
+		qcom,disp-maxy = <2559>;
+		qcom,panel-maxx = <1599>;
+		qcom,panel-maxy = <2703>;
+		qcom,key-codes = <158 139 102 217>;
+	};
+
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8994_gpios 2 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_snapshot {
+			label = "cam_snapshot";
+			gpios = <&pm8994_gpios 4 0x1>;
+			linux,input-type = <1>;
+			linux,code = <766>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_focus {
+			label = "cam_focus";
+			gpios = <&pm8994_gpios 5 0x1>;
+			linux,input-type = <1>;
+			linux,code = <528>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+
+	sound-9335 {
+		status = "disabled";
+	};
+
+	sound-adp-agave {
+		compatible = "qcom,apq8096-asoc-snd-adp-agave";
+		qcom,model = "apq8096-adp-agave-snd-card";
+
+		asoc-platform = <&pcm0>, <&pcm1>, <&pcm2>, <&voip>, <&voice>,
+				<&loopback>, <&compress>, <&hostless>,
+				<&afe>, <&lsm>, <&routing>, <&pcmnoirq>,
+				<&loopback1>;
+		asoc-platform-names = "msm-pcm-dsp.0", "msm-pcm-dsp.1",
+				"msm-pcm-dsp.2", "msm-voip-dsp",
+				"msm-pcm-voice", "msm-pcm-loopback",
+				"msm-compress-dsp", "msm-pcm-hostless",
+				"msm-pcm-afe", "msm-lsm-client",
+				"msm-pcm-routing", "msm-pcm-dsp-noirq",
+				"msm-pcm-loopback.1";
+		asoc-cpu = <&dai_pri_auxpcm>, <&dai_sec_auxpcm>, <&dai_hdmi>,
+				<&dai_mi2s_sec>, <&dai_mi2s>, <&dai_mi2s_quat>,
+				<&afe_pcm_rx>, <&afe_pcm_tx>,
+				<&afe_proxy_rx>, <&afe_proxy_tx>,
+				<&incall_record_rx>, <&incall_record_tx>,
+				<&incall_music_rx>, <&incall_music2_rx>,
+				<&dai_pri_tdm_tx_0>, <&dai_pri_tdm_tx_1>,
+				<&dai_pri_tdm_tx_2>, <&dai_pri_tdm_tx_3>,
+				<&dai_pri_tdm_rx_0>, <&dai_pri_tdm_rx_1>,
+				<&dai_pri_tdm_rx_2>, <&dai_pri_tdm_rx_3>,
+				<&dai_sec_tdm_tx_0>, <&dai_sec_tdm_tx_1>,
+				<&dai_sec_tdm_tx_2>, <&dai_sec_tdm_tx_3>,
+				<&dai_tert_tdm_rx_0>, <&dai_tert_tdm_rx_1>,
+				<&dai_tert_tdm_rx_2>, <&dai_tert_tdm_rx_3>,
+				<&dai_tert_tdm_rx_4>, <&dai_tert_tdm_tx_0>,
+				<&dai_tert_tdm_tx_1>, <&dai_tert_tdm_tx_2>,
+				<&dai_tert_tdm_tx_3>, <&dai_quat_tdm_rx_0>,
+				<&dai_quat_tdm_rx_1>, <&dai_quat_tdm_rx_2>,
+				<&dai_quat_tdm_rx_3>, <&dai_quat_tdm_tx_0>,
+				<&dai_quat_tdm_tx_1>, <&dai_quat_tdm_tx_2>,
+				<&dai_quat_tdm_tx_3>;
+		asoc-cpu-names = "msm-dai-q6-auxpcm.1", "msm-dai-q6-auxpcm.2",
+				"msm-dai-q6-hdmi.8", "msm-dai-q6-mi2s.1",
+				"msm-dai-q6-mi2s.2", "msm-dai-q6-mi2s.3",
+				"msm-dai-q6-dev.224", "msm-dai-q6-dev.225",
+				"msm-dai-q6-dev.241", "msm-dai-q6-dev.240",
+				"msm-dai-q6-dev.32771", "msm-dai-q6-dev.32772",
+				"msm-dai-q6-dev.32773", "msm-dai-q6-dev.32770",
+				"msm-dai-q6-tdm.36865", "msm-dai-q6-tdm.36867",
+				"msm-dai-q6-tdm.36869", "msm-dai-q6-tdm.36871",
+				"msm-dai-q6-tdm.36864", "msm-dai-q6-tdm.36866",
+				"msm-dai-q6-tdm.36868", "msm-dai-q6-tdm.36870",
+				"msm-dai-q6-tdm.36881", "msm-dai-q6-tdm.36883",
+				"msm-dai-q6-tdm.36885", "msm-dai-q6-tdm.36887",
+				"msm-dai-q6-tdm.36896", "msm-dai-q6-tdm.36898",
+				"msm-dai-q6-tdm.36900", "msm-dai-q6-tdm.36902",
+				"msm-dai-q6-tdm.36904", "msm-dai-q6-tdm.36897",
+				"msm-dai-q6-tdm.36899", "msm-dai-q6-tdm.36901",
+				"msm-dai-q6-tdm.36903", "msm-dai-q6-tdm.36912",
+				"msm-dai-q6-tdm.36914", "msm-dai-q6-tdm.36916",
+				"msm-dai-q6-tdm.36918", "msm-dai-q6-tdm.36913",
+				"msm-dai-q6-tdm.36915", "msm-dai-q6-tdm.36917",
+				"msm-dai-q6-tdm.36919";
+		asoc-codec = <&stub_codec>;
+		asoc-codec-names = "msm-stub-codec.1";
+	};
+
+	usb_detect: usb_detect {
+		compatible = "qcom,gpio-usbdetect";
+		qcom,vbus-det-gpio = <&pm8994_gpios 17 0>;
+		interrupt-parent = <&spmi_bus>;
+		interrupts = <0x0 0x9 0x0 IRQ_TYPE_NONE>;
+		interrupt-names ="pmic_id_irq";
+	};
+
+	loopback1: qcom,msm-pcm-loopback-low-latency {
+		compatible = "qcom,msm-pcm-loopback";
+		qcom,msm-pcm-loopback-low-latency;
+	};
+
+	usb_vbus_vreg: usb_vbus_vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "usb_vbus_vreg";
+		gpio = <&pm8994_mpps 8 0>;
+		enable-active-high;
+	};
+
+	usb2_otg_switch: usb2_otg_switch {
+		compatible = "regulator-fixed";
+		vin-supply = <&usb_vbus_vreg>;
+		regulator-name = "usb2_otg_vreg";
+		gpio = <&pm8994_gpios 12 0>;
+		enable-active-high;
+	};
+
+	qcom,msm-dai-mi2s {
+		dai_mi2s_sec: qcom,msm-dai-q6-mi2s-sec {
+			qcom,msm-mi2s-rx-lines = <2>;
+			qcom,msm-mi2s-tx-lines = <1>;
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&sec_mi2s_active &sec_mi2s_sd0_active
+				&sec_mi2s_sd1_active>;
+			pinctrl-1 = <&sec_mi2s_sleep &sec_mi2s_sd0_sleep
+				&sec_mi2s_sd1_sleep>;
+		};
+
+		dai_mi2s_quat: qcom,msm-dai-q6-mi2s-quat {
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&quat_mi2s_active &quat_mi2s_sd0_active>;
+			pinctrl-1 = <&quat_mi2s_sleep &quat_mi2s_sd0_sleep>;
+		};
+	};
+
+	qcom,msm-dai-tdm-tert-rx {
+		pinctrl-names = "default", "sleep";
+		pinctrl-0 = <&tert_tdm_dout_active>;
+		pinctrl-1 = <&tert_tdm_dout_sleep>;
+	};
+
+	qcom,msm-dai-tdm-quat-rx {
+		pinctrl-names = "default", "sleep";
+		pinctrl-0 = <&quat_tdm_dout_active>;
+		pinctrl-1 = <&quat_tdm_dout_sleep>;
+	};
+};
+
+&pm8994_gpios {
+	gpio@c600 { /* GPIO 7 - NFC DWL REQ */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <3>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@c700 { /* GPIO 8 - WLAN_EN */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@c800 { /* GPIO 9 - Rome 3.3V control */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* MOS logic */
+		qcom,invert = <1>;		/* Output high */
+		qcom,vin-sel = <0>;		/* VPH_PWR */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,out-strength = <1>;	/* High drive strength */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@c900 { /* GPIO 10 - lcd_bklt_reg_en */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <1>;	/* output hight initially */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,out-strength = <1>;	/* Low drive strength */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+	gpio@c100 { /* GPIO 2 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c300 { /* GPIO 4 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c400 { /* GPIO 5 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@ca00 { /* GPIO 11 - USB enb1 (otg switch) */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,master-en = <1>;	/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@cb00 { /* GPIO 12 - USB enb2 (otg switch) */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,master-en = <1>;	/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@cc00 { /* GPIO 13 - NTN_RST */
+		qcom,mode = <1>; /* DIGITAL OUT */
+		qcom,output-type = <0>; /* CMOS logic */
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>; /* 1.8 */
+		qcom,out-strength = <1>;
+		qcom,src-sel = <0>; /* GPIO */
+		qcom,master-en = <0>; /* Disable GPIO */
+		status = "okay";
+	};
+
+	gpio@ce00 { /* GPIO 15 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@d000 { /* GPIO 17 - USB1 VBUS detect */
+		qcom,mode = <0>;	/* Digital Input*/
+		qcom,pull = <5>;	/* No pull */
+		qcom,vin-sel = <2>;	/* 1.8 V */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,master-en = <1>;	/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@d100 { /* GPIO 18 - Rome Sleep Clock */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <0>;		/* Output low initially */
+		qcom,vin-sel = <2>;		/* VIN 2 */
+		qcom,src-sel = <3>;		/* Function 2 */
+		qcom,out-strength = <2>;	/* Medium */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@d200 { /* GPIO 19 - Rome BT Reset */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&usb2s {
+	status = "ok";
+	vbus_dwc3-supply = <&usb2_otg_switch>;
+	dwc3@7600000 {
+		dr_mode = "host";
+	};
+};
+
+&usb3 {
+	extcon = <&usb_detect>;
+	vbus_dwc3-supply = <&usb_otg_switch>;
+	vdda33-supply = <&pm8994_l24>;
+	vdda18-supply = <&pm8994_l12>;
+};
+
+&blsp1_uart2 {
+	status = "ok";
+};
+
+&i2c_6 {
+	at24@51 {
+		compatible = "atmel,24c32";
+		reg = <0x51>;
+	};
+};
+
+&i2c_7 {
+	silabs4705@11 { /* SiLabs FM chip, slave id 0x11*/
+		status = "disabled";
+		compatible = "silabs,si4705";
+		reg = <0x11>;
+		vdd-supply = <&pm8994_s4>;
+		silabs,vdd-supply-voltage = <1800000 1800000>;
+		va-supply = <&rome_vreg>;
+		silabs,va-supply-voltage = <3300000 3300000>;
+		pinctrl-names = "pmx_fm_active","pmx_fm_suspend";
+		pinctrl-0 = <&fm_int_active &fm_status_int_active
+						 &fm_rst_active>;
+		pinctrl-1 = <&fm_int_suspend &fm_status_int_suspend
+						&fm_rst_suspend>;
+		silabs,reset-gpio = <&tlmm 39 0>;
+		silabs,int-gpio = <&tlmm 38 0>;
+		silabs,status-gpio = <&tlmm 78 0>;
+		#address-cells = <0>;
+		interrupts = <0 1>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-map = <
+				  0 &tlmm 38 2
+				  1 &tlmm 78 1
+				>;
+		interrupt-names = "silabs_fm_int", "silabs_fm_status_int";
+	};
+};
+
+&i2c_8 { /* BLSP2 QUP2 */
+	nq@28 {
+		compatible = "qcom,nq-nci";
+		reg = <0x28>;
+		qcom,nq-irq = <&tlmm 9 0x00>;
+		qcom,nq-ven = <&tlmm 12 0x00>;
+		qcom,nq-firm = <&pm8994_gpios 7 0x00>;
+		interrupt-parent = <&tlmm>;
+		qcom,clk-src = "BBCLK2";
+		interrupts = <9 0>;
+		interrupt-names = "nfc_irq";
+		pinctrl-names = "nfc_active", "nfc_suspend";
+		pinctrl-0 = <&nfc_int_active &nfc_disable_active>;
+		pinctrl-1 = <&nfc_int_suspend &nfc_disable_suspend>;
+		clocks = <&clock_gcc clk_bb_clk2_pin>;
+		clock-names = "ref_clk";
+	};
+};
+
+&soc {
+	sound-9335 {
+		/delete-property/ qcom,hph-en1-gpio;
+	};
+};
+
+&slim_msm {
+	status = "disabled";
+};
+
+/delete-node/  &led_flash0;
+
+&mdss_dsi0 {
+	/delete-property/ lab-supply;
+	/delete-property/ ibb-supply;
+};
+
+&mdss_dsi1 {
+	/delete-property/ lab-supply;
+	/delete-property/ ibb-supply;
+};
+
+&cci {
+	qcom,camera@0 {
+		/delete-property/ qcom,led-flash-src;
+	};
+
+	qcom,camera@1 {
+		/delete-property/ cam_vana-supply;
+	};
+};
+
+&usb_otg_switch {
+	gpio = <&pm8994_gpios 11 0>;
+	enable-active-high;
+	status = "ok";
+	/delete-property/ vin-supply;
+};
+
+&pcie0 {
+	/delete-property/ qcom,l1-supported;
+	/delete-property/ qcom,l1ss-supported;
+	/delete-property/ qcom,aux-clk-sync;
+};
+
+&pcie1 {
+	qcom,msi-gicm-addr = <0x09BD0040>;
+	qcom,msi-gicm-base = <0x240>;
+
+	/delete-property/ qcom,boot-option;
+	/delete-property/ qcom,l1-supported;
+	/delete-property/ qcom,l1ss-supported;
+	/delete-property/ qcom,aux-clk-sync;
+	/delete-property/ qcom,ep-wakeirq;
+};
+
+&pcie2 {
+	perst-gpio = <&tlmm 90 0>;
+	wake-gpio = <&tlmm 54 0>;
+
+	/delete-property/ qcom,boot-option;
+	/delete-property/ qcom,l1-supported;
+	/delete-property/ qcom,l1ss-supported;
+	/delete-property/ qcom,aux-clk-sync;
+	/delete-property/ qcom,ep-wakeirq;
+};
+
+&wsa881x_211 {
+	/delete-property/ qcom,spkr-sd-n-gpio;
+};
+
+&wsa881x_212 {
+	/delete-property/ qcom,spkr-sd-n-gpio;
+};
+
+&wsa881x_213 {
+	/delete-property/ qcom,spkr-sd-n-gpio;
+};
+
+&wsa881x_214 {
+	/delete-property/ qcom,spkr-sd-n-gpio;
+};
+
+/ {
+	reserved-memory {
+		lk_mem: lk_pool@91600000 {
+			reg = <0x0 0x91600000 0x0 0x600000>;
+			label = "lk_pool";
+		};
+	};
+};
+
diff --git a/arch/arm64/boot/dts/qcom/msm8996-blsp.dtsi b/arch/arm64/boot/dts/qcom/msm8996-blsp.dtsi
new file mode 100644
index 000000000000..a6bf6b5189fe
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-blsp.dtsi
@@ -0,0 +1,174 @@
+/*
+ * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+/ {
+	aliases {
+		spi9 = &spi_9;
+		spi10 = &spi_10;
+		spi12 = &spi_12;
+	};
+};
+
+&soc {
+	blsp1_uart3: uart@7571000 { /* BLSP1 UART3 */
+		compatible = "qcom,msm-hsuart-v14";
+		reg = <0x7571000 0x200>,
+		    <0x7544000 0x2b000>;
+		reg-names = "core_mem", "bam_mem";
+		interrupt-names = "core_irq", "bam_irq", "wakeup_irq";
+		#address-cells = <0>;
+		interrupt-parent = <&blsp1_uart3>;
+		interrupts = <0 1 2>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-map = <0 &intc 0 109 0
+			    1 &intc 0 238 0
+			    2 &tlmm 42 0>;
+
+		qcom,inject-rx-on-wakeup;
+		qcom,rx-char-to-inject = <0xFD>;
+
+		qcom,bam-tx-ep-pipe-index = <4>;
+		qcom,bam-rx-ep-pipe-index = <5>;
+		qcom,master-id = <86>;
+		clock-names = "core_clk", "iface_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_uart3_apps_clk>,
+		    <&clock_gcc clk_gcc_blsp1_ahb_clk>;
+		pinctrl-names = "sleep", "default";
+		pinctrl-0 = <&blsp1_uart3_sleep>;
+		pinctrl-1 = <&blsp1_uart3_active>;
+
+		qcom,msm-bus,name = "buart3";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			    <86 512 0 0>,
+			    <86 512 500 800>;
+		status = "disabled";
+	};
+
+
+	blsp1_uart6: uart@7574000 { /* BLSP1 UART6 */
+		compatible = "qcom,msm-hsuart-v14";
+		reg = <0x7574000 0x200>,
+		    <0x7544000 0x2b000>;
+		reg-names = "core_mem", "bam_mem";
+		interrupt-names = "core_irq", "bam_irq", "wakeup_irq";
+		#address-cells = <0>;
+		interrupt-parent = <&blsp1_uart6>;
+		interrupts = <0 1 2>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-map = <0 &intc 0 112 0
+			    1 &intc 0 238 0
+			    2 &tlmm 42 0>;
+
+		qcom,inject-rx-on-wakeup;
+		qcom,rx-char-to-inject = <0xFD>;
+
+		qcom,bam-tx-ep-pipe-index = <10>;
+		qcom,bam-rx-ep-pipe-index = <11>;
+		qcom,master-id = <86>;
+		clock-names = "core_clk", "iface_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_uart6_apps_clk>,
+		    <&clock_gcc clk_gcc_blsp1_ahb_clk>;
+		pinctrl-names = "sleep", "default";
+		pinctrl-0 = <&blsp1_uart6_sleep>;
+		pinctrl-1 = <&blsp1_uart6_active>;
+
+		qcom,msm-bus,name = "buart6";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			    <86 512 0 0>,
+			    <86 512 500 800>;
+		status = "disabled";
+	};
+
+	spi_9: spi@75B7000 { /* BLSP2 QUP3 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0x075B7000 0x600>,
+		      <0x07584000 0x2b000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 103 0>, <0 239 0>;
+		spi-max-frequency = <19200000>;
+		qcom,infinite-mode = <0>;
+		qcom,ver-reg-exists;
+
+		qcom,bam-consumer-pipe-index = <16>;
+		qcom,bam-producer-pipe-index = <17>;
+		qcom,master-id = <84>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_9_active>;
+		pinctrl-1 = <&spi_9_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp2_qup3_spi_apps_clk>;
+		status = "disabled";
+	};
+
+	spi_10: spi@75B8000 { /* BLSP2 QUP4 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0x075B8000 0x600>,
+		      <0x07584000 0x2b000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 104 0>, <0 239 0>;
+		spi-max-frequency = <19200000>;
+		qcom,infinite-mode = <0>;
+		qcom,ver-reg-exists;
+
+		qcom,bam-consumer-pipe-index = <18>;
+		qcom,bam-producer-pipe-index = <19>;
+		qcom,master-id = <84>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_10_active>;
+		pinctrl-1 = <&spi_10_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp2_qup4_spi_apps_clk>;
+		status = "disabled";
+	};
+
+	spi_12: spi@75BA000 { /* BLSP2 QUP6 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0x075BA000 0x600>,
+		      <0x07584000 0x2b000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 106 0>, <0 239 0>;
+		spi-max-frequency = <19200000>;
+		qcom,infinite-mode = <0>;
+		qcom,ver-reg-exists;
+
+		qcom,bam-consumer-pipe-index = <22>;
+		qcom,bam-producer-pipe-index = <23>;
+		qcom,master-id = <84>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_12_active>;
+		pinctrl-1 = <&spi_12_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp2_qup6_spi_apps_clk>;
+		status = "disabled";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-bus.dtsi b/arch/arm64/boot/dts/qcom/msm8996-bus.dtsi
new file mode 100644
index 000000000000..a93d3aa2c06f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-bus.dtsi
@@ -0,0 +1,1813 @@
+/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is Mree software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/msm/msm-bus-ids.h>
+
+&soc {
+	ad_hoc_bus: ad-hoc-bus {
+		/* Version = 16 */
+		compatible = "qcom,msm-bus-device";
+		reg = <0x520000 0x40000>,
+			<0x400000 0x62000>,
+			<0x5C0000 0x3000>,
+			<0x500000 0x1000>,
+			<0x5A0000 0x40000>,
+			<0x5A0000 0x40000>,
+			<0x540000 0x9000>,
+			<0x560000 0x7000>,
+			<0x580000 0xA000>;
+		reg-names = "snoc-base", "bimc-base", "pnoc-base", "cnoc-base",
+			"mmnoc-base", "mmnoc-ahb-base", "a0noc-base",
+			"a1noc-base", "a2noc-base";
+
+		/*Buses*/
+		fab_a0noc: fab-a0noc {
+			cell-id = <MSM_BUS_FAB_A0_NOC>;
+			label = "fab-a0noc";
+			qcom,fab-dev;
+			qcom,base-name = "a0noc-base";
+			qcom,bus-type = <1>;
+			qcom,qos-off = <4096>;
+			qcom,base-offset = <12288>;
+			qcom,enable-only-clk;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_gcc clk_gcc_aggre0_snoc_axi_clk>,
+			     <&clock_gcc clk_gcc_aggre0_snoc_axi_clk>;
+			bus-gdsc-supply = <&gdsc_aggre0_noc>;
+			bus-a-gdsc-supply = <&gdsc_aggre0_noc>;
+
+			coresight-id = <206>;
+			coresight-name = "coresight-a0noc";
+			coresight-nr-inports = <0>;
+			coresight-outports = <0>;
+			coresight-child-list = <&funnel_in1>;
+			coresight-child-ports = <7>;
+			aggre0-snoc-axi-no-rate-supply =<&gdsc_aggre0_noc>;
+			qcom,node-qos-clks {
+				clock-names = "aggre0-snoc-axi-no-rate",
+				"aggre0-cnoc-ahb-no-rate",
+				"aggre0-noc-mpu-cfg-no-rate";
+				clocks =
+				<&clock_gcc clk_gcc_aggre0_snoc_axi_clk>,
+				<&clock_gcc clk_gcc_aggre0_cnoc_ahb_clk>,
+				<&clock_gcc clk_gcc_aggre0_noc_mpu_cfg_ahb_clk>;
+			};
+		};
+
+		fab_a1noc: fab-a1noc {
+			cell-id = <MSM_BUS_FAB_A1_NOC>;
+			label = "fab-a1noc";
+			qcom,fab-dev;
+			qcom,base-name = "a1noc-base";
+			qcom,bus-type = <1>;
+			qcom,qos-off = <4096>;
+			qcom,base-offset = <8192>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_gcc  clk_aggre1_noc_clk>,
+			     <&clock_gcc  clk_aggre1_noc_a_clk>;
+			coresight-id = <205>;
+			coresight-name = "coresight-a1noc";
+			coresight-nr-inports = <0>;
+			coresight-outports = <0>;
+			coresight-child-list = <&funnel_in0>;
+			coresight-child-ports = <6>;
+		};
+
+		fab_a2noc: fab-a2noc {
+			cell-id = <MSM_BUS_FAB_A2_NOC>;
+			label = "fab-a2noc";
+			qcom,fab-dev;
+			qcom,base-name = "a2noc-base";
+			qcom,bus-type = <1>;
+			qcom,qos-off = <4096>;
+			qcom,base-offset = <12288>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_gcc  clk_aggre2_noc_clk>,
+			     <&clock_gcc  clk_aggre2_noc_a_clk>;
+			coresight-id = <204>;
+			coresight-name = "coresight-a2noc";
+			coresight-nr-inports = <0>;
+			coresight-outports = <0>;
+			coresight-child-list = <&funnel_in1>;
+			coresight-child-ports = <5>;
+			qcom,node-qos-clks {
+				clock-names = "clk-aggre2-noc-clk-no-rate",
+				"clk-gcc-ufs-axi-clk",
+				"clk-aggre2-ufs-axi-clk-no-rate";
+				clocks = <&clock_gcc clk_aggre2_noc_clk>,
+				<&clock_gcc clk_gcc_ufs_axi_clk>,
+				<&clock_gcc clk_gcc_aggre2_ufs_axi_clk>;
+			};
+		};
+
+		fab_bimc: fab-bimc {
+			cell-id = <MSM_BUS_FAB_BIMC>;
+			label = "fab-bimc";
+			qcom,fab-dev;
+			qcom,base-name = "bimc-base";
+			qcom,base-offset = <0x8000>;
+			qcom,qos-off = <0x4000>;
+			qcom,util-fact = <154>;
+			qcom,bus-type = <2>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_gcc  clk_bimc_msmbus_clk>,
+			     <&clock_gcc  clk_bimc_msmbus_a_clk>;
+			coresight-id = <203>;
+			coresight-name = "coresight-bimc";
+			coresight-nr-inports = <0>;
+			coresight-outports = <0>;
+			coresight-child-list = <&funnel_in1>;
+			coresight-child-ports = <4>;
+		};
+
+		fab_cnoc: fab-cnoc {
+			cell-id = <MSM_BUS_FAB_CONFIG_NOC>;
+			label = "fab-cnoc";
+			qcom,fab-dev;
+			qcom,base-name = "cnoc-base";
+			qcom,bypass-qos-prg;
+			qcom,bus-type = <1>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_gcc clk_cnoc_msmbus_clk>,
+			     <&clock_gcc clk_cnoc_msmbus_a_clk>;
+		};
+
+		fab_mnoc: fab-mnoc {
+			cell-id = <MSM_BUS_FAB_MMSS_NOC>;
+			label = "fab-mnoc";
+			qcom,fab-dev;
+			qcom,base-name = "mmnoc-base";
+			qcom,qos-off = <4096>;
+			qcom,base-offset = <16384>;
+			qcom,bus-type = <1>;
+			qcom,util-fact = <154>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+				 <&clock_gcc clk_mmssnoc_axi_a_clk>;
+			coresight-id = <202>;
+			coresight-name = "coresight-mnoc";
+			coresight-nr-inports = <0>;
+			coresight-outports = <0>;
+			coresight-child-list = <&funnel_in1>;
+			coresight-child-ports = <0>;
+			mmagic-ahb-no-rate-supply = <&gdsc_mmagic_bimc>;
+			mmagic-mdss-axi-no-rate-supply =
+						<&gdsc_mmagic_mdss>;
+			mmagic-camss-axi-no-rate-supply =
+						<&gdsc_mmagic_camss>;
+			mmagic-video-axi-no-rate-supply =
+						<&gdsc_mmagic_video>;
+			qcom,node-qos-clks {
+				clock-names = "mmagic-ahb-no-rate",
+				"mmagic-cfg-ahb-no-rate",
+				"mmagic-mdss-axi-no-rate",
+				"mmagic-mdss-cfg-noc-ahb-no-rate",
+				"mmagic-camss-axi-no-rate",
+				"mmagic-camss-cfg-noc-ahb-no-rate",
+				"mmagic-video-axi-no-rate",
+				"mmagic-video-cfg-noc-ahb-no-rate";
+				clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			     <&clock_mmss clk_mmss_mmagic_cfg_ahb_clk>,
+			     <&clock_mmss clk_mmagic_mdss_axi_clk>,
+			     <&clock_mmss clk_mmagic_mdss_noc_cfg_ahb_clk>,
+			     <&clock_mmss clk_mmagic_camss_axi_clk>,
+			     <&clock_mmss clk_mmagic_camss_noc_cfg_ahb_clk>,
+			     <&clock_mmss clk_mmagic_video_axi_clk>,
+			     <&clock_mmss clk_mmagic_video_noc_cfg_ahb_clk>;
+			};
+		};
+
+		fab_mnoc_ahb: fab-mnoc-ahb {
+			cell-id = <MSM_BUS_FAB_MMSS_AHB>;
+			label = "fab-mnoc-ahb";
+			qcom,fab-dev;
+			qcom,base-name = "mmnoc-ahb-base";
+			qcom,bypass-qos-prg;
+			qcom,setrate-only-clk;
+			qcom,bus-type = <1>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_mmss clk_ahb_clk_src>,
+			     <&clock_mmss clk_ahb_clk_src>;
+			bus-gdsc-supply = <&gdsc_mmagic_bimc>;
+			bus-a-gdsc-supply = <&gdsc_mmagic_bimc>;
+		};
+
+		fab_pnoc: fab-pnoc {
+			cell-id = <MSM_BUS_FAB_PERIPH_NOC>;
+			label = "fab-pnoc";
+			qcom,fab-dev;
+			qcom,base-name = "pnoc-base";
+			qcom,bypass-qos-prg;
+			qcom,bus-type = <1>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_gcc  clk_pnoc_msmbus_clk>,
+			     <&clock_gcc  clk_pnoc_msmbus_a_clk>;
+			coresight-id = <201>;
+			coresight-name = "coresight-pnoc";
+			coresight-nr-inports = <0>;
+			coresight-outports = <0>;
+			coresight-child-list = <&funnel_in1>;
+			coresight-child-ports = <2>;
+		};
+
+		fab_snoc: fab-snoc {
+			cell-id = <MSM_BUS_FAB_SYS_NOC>;
+			label = "fab-snoc";
+			qcom,fab-dev;
+			qcom,base-name = "snoc-base";
+			qcom,bus-type = <1>;
+			qcom,qos-off = <4096>;
+			qcom,base-offset = <16384>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_gcc  clk_snoc_msmbus_clk>,
+			     <&clock_gcc  clk_snoc_msmbus_a_clk>;
+			coresight-id = <200>;
+			coresight-name = "coresight-snoc";
+			coresight-nr-inports = <0>;
+			coresight-outports = <0>;
+			coresight-child-list = <&funnel_in0>;
+			coresight-child-ports = <5>;
+		};
+
+		/*Masters*/
+
+		mas_pcie_0: mas-pcie-0 {
+			cell-id = <MSM_BUS_MASTER_PCIE>;
+			label = "mas-pcie-0";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <0>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a0noc_snoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_a0noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCIE_0>;
+		};
+
+		mas_pcie_1: mas-pcie-1 {
+			cell-id = <MSM_BUS_MASTER_PCIE_1>;
+			label = "mas-pcie-1";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <1>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a0noc_snoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_a0noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCIE_1>;
+		};
+
+		mas_pcie_2: mas-pcie-2 {
+			cell-id = <MSM_BUS_MASTER_PCIE_2>;
+			label = "mas-pcie-2";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <2>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a0noc_snoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_a0noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCIE_2>;
+		};
+
+		mas_cnoc_a1noc: mas-cnoc-a1noc {
+			cell-id = <MSM_BUS_CNOC_A1NOC_MAS>;
+			label = "mas-cnoc-a1noc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_a1noc_snoc>;
+			qcom,bus-dev = <&fab_a1noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_CNOC_A1NOC>;
+		};
+
+		mas_crypto_c0: mas-crypto-c0 {
+			cell-id = <MSM_BUS_MASTER_CRYPTO_CORE0>;
+			label = "mas-crypto-c0";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <0>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a1noc_snoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_a1noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_CRYPTO_CORE0>;
+		};
+
+		mas_pnoc_a1noc: mas-pnoc-a1noc {
+			cell-id = <MSM_BUS_PNOC_A1NOC_MAS>;
+			label = "mas-pnoc-a1noc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,qport = <1>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a1noc_snoc>;
+			qcom,bus-dev = <&fab_a1noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PNOC_A1NOC>;
+		};
+
+		mas_usb3: mas-usb3 {
+			cell-id = <MSM_BUS_MASTER_USB3>;
+			label = "mas-usb3";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <3>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_USB3_0>;
+		};
+
+		mas_ipa: mas-ipa {
+			cell-id = <MSM_BUS_MASTER_IPA>;
+			label = "mas-ipa";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_IPA>;
+		};
+
+		mas_ufs: mas-ufs {
+			cell-id = <MSM_BUS_MASTER_UFS>;
+			label = "mas-ufs";
+			qcom,buswidth = <8>;
+			qcom,qport = <2>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_UFS>;
+		};
+
+		mas_apps_proc: mas-apps-proc {
+			cell-id = <MSM_BUS_MASTER_AMPSS_M0>;
+			label = "mas-apps-proc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <2>;
+			qcom,ap-owned;
+			qcom,qport = <0>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = < &slv_bimc_snoc_1&slv_ebi &slv_bimc_snoc_0>;
+			qcom,prio-lvl = <0>;
+			qcom,prio-rd = <0>;
+			qcom,prio-wr = <0>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_APPSS_PROC>;
+		};
+
+		mas_oxili: mas-oxili {
+			cell-id = <MSM_BUS_MASTER_GRAPHICS_3D>;
+			label = "mas-oxili";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <2>;
+			qcom,ap-owned;
+			qcom,qport = <1>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = < &slv_bimc_snoc_1 &slv_hmss_l3&slv_ebi
+				 &slv_bimc_snoc_0>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_GFX3D>;
+		};
+
+		mas_mnoc_bimc: mas-mnoc-bimc {
+			cell-id = <MSM_BUS_MNOC_BIMC_MAS>;
+			label = "mas-mnoc-bimc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <2>;
+			qcom,ap-owned;
+			qcom,qport = <2>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = < &slv_bimc_snoc_1 &slv_hmss_l3&slv_ebi
+				 &slv_bimc_snoc_0>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_MNOC_BIMC>;
+		};
+
+		mas_snoc_bimc: mas-snoc-bimc {
+			cell-id = <MSM_BUS_SNOC_BIMC_MAS>;
+			label = "mas-snoc-bimc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <2>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = < &slv_hmss_l3&slv_ebi>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SNOC_BIMC>;
+		};
+
+		mas_snoc_cnoc: mas-snoc-cnoc {
+			cell-id = <MSM_BUS_SNOC_CNOC_MAS>;
+			label = "mas-snoc-cnoc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,connections = <&slv_clk_ctl &slv_rbcpr_cx &slv_a2noc_smmu_cfg
+				 &slv_a0noc_mpu_cfg &slv_message_ram
+				 &slv_cnoc_mnoc_mmss_cfg &slv_pcie_0_cfg
+				 &slv_tlmm &slv_mpm
+				 &slv_a0noc_smmu_cfg &slv_ebi1_phy_cfg
+				 &slv_bimc_cfg &slv_pimem_cfg
+				 &slv_rbcpr_mx &slv_prng
+				 &slv_pcie20_ahb2phy &slv_a2noc_mpu_cfg
+				 &slv_qdss_cfg &slv_a2noc_cfg
+				 &slv_a0noc_cfg &slv_ufs_cfg
+				 &slv_crypto0_cfg &slv_pcie_1_cfg
+				 &slv_snoc_cfg &slv_snoc_mpu_cfg
+				 &slv_a1noc_mpu_cfg &slv_a1noc_smmu_cfg
+				 &slv_pcie_2_cfg &slv_cnoc_mnoc_cfg
+				 &slv_cpr_apu_cfg &slv_pmic_arb
+				 &slv_imem_cfg &slv_a1noc_cfg
+				 &slv_ssc_cfg &slv_tcsr
+				 &slv_lpass_smmu_cfg &slv_dcc_cfg>;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SNOC_CNOC>;
+		};
+
+		mas_qdss_dap: mas-qdss-dap {
+			cell-id = <MSM_BUS_MASTER_QDSS_DAP>;
+			label = "mas-qdss-dap";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = < &slv_cpr_apu_cfg &slv_rbcpr_cx &slv_a2noc_smmu_cfg
+				 &slv_a0noc_mpu_cfg &slv_message_ram
+				 &slv_pcie_0_cfg &slv_tlmm
+				 &slv_mpm &slv_a0noc_smmu_cfg
+				 &slv_ebi1_phy_cfg &slv_bimc_cfg
+				 &slv_pimem_cfg &slv_rbcpr_mx
+				 &slv_clk_ctl &slv_prng
+				 &slv_pcie20_ahb2phy &slv_a2noc_mpu_cfg
+				 &slv_qdss_cfg &slv_a2noc_cfg
+				 &slv_a0noc_cfg &slv_ufs_cfg
+				 &slv_crypto0_cfg&slv_cnoc_a1noc
+				 &slv_pcie_1_cfg &slv_snoc_cfg
+				 &slv_snoc_mpu_cfg &slv_a1noc_mpu_cfg
+				 &slv_a1noc_smmu_cfg &slv_pcie_2_cfg
+				 &slv_cnoc_mnoc_cfg &slv_cnoc_mnoc_mmss_cfg
+				 &slv_pmic_arb &slv_imem_cfg
+				 &slv_a1noc_cfg &slv_ssc_cfg
+				 &slv_tcsr &slv_lpass_smmu_cfg
+				 &slv_dcc_cfg>;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_QDSS_DAP>;
+		};
+
+		mas_cnoc_mnoc_mmss_cfg: mas-cnoc-mnoc-mmss-cfg {
+			cell-id = <MSM_BUS_MASTER_CNOC_MNOC_MMSS_CFG>;
+			label = "mas-cnoc-mnoc-mmss-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_mmagic_cfg &slv_dsa_mpu_cfg &slv_mnoc_clocks_cfg
+				 &slv_camera_throttle_cfg &slv_venus_cfg
+				 &slv_smmu_vfe_cfg &slv_misc_cfg
+				 &slv_smmu_cpp_cfg &slv_oxili_cfg
+				 &slv_display_throttle_cfg &slv_venus_throttle_cfg
+				 &slv_camera_cfg &slv_display_cfg
+				 &slv_cpr_cfg &slv_smmu_rot_cfg
+				 &slv_dsa_cfg &slv_smmu_venus_cfg
+				 &slv_vmem_cfg &slv_smmu_jpeg_cfg
+				 &slv_smmu_mdp_cfg &slv_mnoc_mpu_cfg>;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,mas-rpm-id = <ICBID_MASTER_CNOC_MNOC_MMSS_CFG>;
+		};
+
+		mas_cnoc_mnoc_cfg: mas-cnoc-mnoc-cfg {
+			cell-id = <MSM_BUS_MASTER_CNOC_MNOC_CFG>;
+			label = "mas-cnoc-mnoc-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_srvc_mnoc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_CNOC_MNOC_CFG>;
+		};
+
+		mas_cpp: mas-cpp {
+			cell-id = <MSM_BUS_MASTER_CPP>;
+			label = "mas-cpp";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <5>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_CPP>;
+		};
+
+		mas_jpeg: mas-jpeg {
+			cell-id = <MSM_BUS_MASTER_JPEG>;
+			label = "mas-jpeg";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <7>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_JPEG>;
+		};
+
+		mas_mdp_p0: mas-mdp-p0 {
+			cell-id = <MSM_BUS_MASTER_MDP_PORT0>;
+			label = "mas-mdp-p0";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <1>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,vrail-comp = <25>;
+			qcom,mas-rpm-id = <ICBID_MASTER_MDP0>;
+		};
+
+		mas_mdp_p1: mas-mdp-p1 {
+			cell-id = <MSM_BUS_MASTER_MDP_PORT1>;
+			label = "mas-mdp-p1";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <2>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,vrail-comp = <25>;
+			qcom,mas-rpm-id = <ICBID_MASTER_MDP1>;
+		};
+
+		mas_rotator: mas-rotator {
+			cell-id = <MSM_BUS_MASTER_ROTATOR>;
+			label = "mas-rotator";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <0>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_ROTATOR>;
+		};
+
+		mas_venus: mas-venus {
+			cell-id = <MSM_BUS_MASTER_VIDEO_P0>;
+			label = "mas-venus";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <2>;
+			qcom,ap-owned;
+			qcom,qport = <3 4>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_VIDEO>;
+		};
+
+		mas_vfe: mas-vfe {
+			cell-id = <MSM_BUS_MASTER_VFE>;
+			label = "mas-vfe";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <6>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_VFE>;
+		};
+
+		mas_snoc_vmem: mas-snoc-vmem {
+			cell-id = <MSM_BUS_MASTER_SNOC_VMEM>;
+			label = "mas-snoc-vmem";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_vmem>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SNOC_VMEM>;
+		};
+
+		mas_venus_vmem: mas-venus-vmem {
+			cell-id = <MSM_BUS_MASTER_VIDEO_P0_OCMEM>;
+			label = "mas-venus-vmem";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_vmem>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_VENUS_VMEM>;
+		};
+
+		mas_snoc_pnoc: mas-snoc-pnoc {
+			cell-id = <MSM_BUS_SNOC_PNOC_MAS>;
+			label = "mas-snoc-pnoc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,connections = < &slv_blsp_1 &slv_blsp_2&slv_usb_hs
+				 &slv_sdcc_1 &slv_sdcc_2
+				 &slv_sdcc_4 &slv_tsif
+				 &slv_pdm &slv_ahb2phy>;
+			qcom,bus-dev = <&fab_pnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SNOC_PNOC>;
+		};
+
+		mas_sdcc_1: mas-sdcc-1 {
+			cell-id = <MSM_BUS_MASTER_SDCC_1>;
+			label = "mas-sdcc-1";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,connections = <&slv_pnoc_a1noc>;
+			qcom,bus-dev = <&fab_pnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SDCC_1>;
+		};
+
+		mas_sdcc_2: mas-sdcc-2 {
+			cell-id = <MSM_BUS_MASTER_SDCC_2>;
+			label = "mas-sdcc-2";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,connections = <&slv_pnoc_a1noc>;
+			qcom,bus-dev = <&fab_pnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SDCC_2>;
+		};
+
+		mas_sdcc_4: mas-sdcc-4 {
+			cell-id = <MSM_BUS_MASTER_SDCC_4>;
+			label = "mas-sdcc-4";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,connections = <&slv_pnoc_a1noc>;
+			qcom,bus-dev = <&fab_pnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SDCC_4>;
+		};
+
+		mas_usb_hs: mas-usb-hs {
+			cell-id = <MSM_BUS_MASTER_USB_HS>;
+			label = "mas-usb-hs";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,connections = <&slv_pnoc_a1noc>;
+			qcom,bus-dev = <&fab_pnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_USB_HS>;
+		};
+
+		mas_blsp_1: mas-blsp-1 {
+			cell-id = <MSM_BUS_MASTER_BLSP_1>;
+			label = "mas-blsp-1";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,connections = <&slv_pnoc_a1noc>;
+			qcom,bus-dev = <&fab_pnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_BLSP_1>;
+		};
+
+		mas_blsp_2: mas-blsp-2 {
+			cell-id = <MSM_BUS_MASTER_BLSP_2>;
+			label = "mas-blsp-2";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,connections = <&slv_pnoc_a1noc>;
+			qcom,bus-dev = <&fab_pnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_BLSP_2>;
+		};
+
+		mas_tsif: mas-tsif {
+			cell-id = <MSM_BUS_MASTER_TSIF>;
+			label = "mas-tsif";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,connections = <&slv_pnoc_a1noc>;
+			qcom,bus-dev = <&fab_pnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_TSIF>;
+		};
+
+		mas_hmss: mas-hmss {
+			cell-id = <MSM_BUS_MASTER_HMSS>;
+			label = "mas-hmss";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <4>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = < &slv_pimem &slv_imem&slv_snoc_bimc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_HMSS>;
+		};
+
+		mas_qdss_bam: mas-qdss-bam {
+			cell-id = <MSM_BUS_MASTER_QDSS_BAM>;
+			label = "mas-qdss-bam";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <2>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = < &slv_pimem&slv_usb3 &slv_imem
+				 &slv_snoc_bimc &slv_snoc_pnoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_QDSS_BAM>;
+		};
+
+		mas_snoc_cfg: mas-snoc-cfg {
+			cell-id = <MSM_BUS_MASTER_SNOC_CFG>;
+			label = "mas-snoc-cfg";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_srvc_snoc>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SNOC_CFG>;
+		};
+
+		mas_bimc_snoc_0: mas-bimc-snoc-0 {
+			cell-id = <MSM_BUS_BIMC_SNOC_MAS>;
+			label = "mas-bimc-snoc-0";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,connections = < &slv_snoc_vmem &slv_usb3 &slv_pimem
+				 &slv_lpass &slv_hmss
+				 &slv_snoc_cnoc &slv_snoc_pnoc
+				 &slv_imem &slv_qdss_stm>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,ap-owned;
+			qcom,mas-rpm-id = <ICBID_MASTER_BIMC_SNOC>;
+		};
+
+		mas_bimc_snoc_1: mas-bimc-snoc-1 {
+			cell-id = <MSM_BUS_BIMC_SNOC_1_MAS>;
+			label = "mas-bimc-snoc-1";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = < &slv_pcie_2 &slv_pcie_1&slv_pcie_0>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_BIMC_SNOC_1>;
+		};
+
+		mas_a0noc_snoc: mas-a0noc-snoc {
+			cell-id = <MSM_BUS_A0NOC_SNOC_MAS>;
+			label = "mas-a0noc-snoc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = < &slv_snoc_pnoc &slv_imem&slv_hmss
+				 &slv_snoc_bimc &slv_pimem>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_A0NOC_SNOC>;
+		};
+
+		mas_a1noc_snoc: mas-a1noc-snoc {
+			cell-id = <MSM_BUS_A1NOC_SNOC_MAS>;
+			label = "mas-a1noc-snoc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,connections = < &slv_snoc_vmem &slv_usb3 &slv_pcie_0
+				 &slv_pimem &slv_pcie_2
+				 &slv_lpass &slv_pcie_1
+				&slv_hmss &slv_snoc_bimc
+				 &slv_snoc_cnoc &slv_snoc_pnoc
+				 &slv_imem &slv_qdss_stm>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_A1NOC_SNOC>;
+		};
+
+		mas_a2noc_snoc: mas-a2noc-snoc {
+			cell-id = <MSM_BUS_A2NOC_SNOC_MAS>;
+			label = "mas-a2noc-snoc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,connections = < &slv_snoc_vmem &slv_usb3 &slv_pcie_1
+				 &slv_pimem &slv_pcie_2
+				 &slv_qdss_stm&slv_lpass
+				 &slv_snoc_bimc &slv_snoc_cnoc
+				 &slv_snoc_pnoc &slv_imem
+				 &slv_pcie_0>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_A2NOC_SNOC>;
+		};
+
+		mas_qdss_etr: mas-qdss-etr {
+			cell-id = <MSM_BUS_MASTER_QDSS_ETR>;
+			label = "mas-qdss-etr";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <3>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = < &slv_pimem&slv_usb3 &slv_imem
+				 &slv_snoc_bimc &slv_snoc_pnoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_QDSS_ETR>;
+		};
+
+		/*Internal nodes*/
+
+		/*Slaves*/
+
+		slv_a0noc_snoc: slv-a0noc-snoc {
+			cell-id = <MSM_BUS_A0NOC_SNOC_SLV>;
+			label = "slv-a0noc-snoc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,connections = <&mas_a0noc_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A0NOC_SNOC>;
+			qcom,enable-only-clk;
+			clock-names = "node_clk";
+			clocks = <&clock_gcc clk_gcc_aggre0_cnoc_ahb_clk>;
+		};
+
+		slv_a1noc_snoc: slv-a1noc-snoc {
+			cell-id = <MSM_BUS_A1NOC_SNOC_SLV>;
+			label = "slv-a1noc-snoc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,connections = <&mas_a1noc_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A1NOC_SNOC>;
+		};
+
+		slv_a2noc_snoc: slv-a2noc-snoc {
+			cell-id = <MSM_BUS_A2NOC_SNOC_SLV>;
+			label = "slv-a2noc-snoc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,connections = <&mas_a2noc_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A2NOC_SNOC>;
+		};
+
+		slv_ebi: slv-ebi {
+			cell-id = <MSM_BUS_SLAVE_EBI_CH0>;
+			label = "slv-ebi";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <2>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_EBI1>;
+		};
+
+		slv_hmss_l3: slv-hmss-l3 {
+			cell-id = <MSM_BUS_SLAVE_HMSS_L3>;
+			label = "slv-hmss-l3";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_HMSS_L3>;
+		};
+
+		slv_bimc_snoc_0: slv-bimc-snoc-0 {
+			cell-id = <MSM_BUS_BIMC_SNOC_SLV>;
+			label = "slv-bimc-snoc-0";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,ap-owned;
+			qcom,connections = <&mas_bimc_snoc_0>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_BIMC_SNOC>;
+		};
+
+		slv_bimc_snoc_1: slv-bimc-snoc-1 {
+			cell-id = <MSM_BUS_BIMC_SNOC_1_SLV>;
+			label = "slv-bimc-snoc-1";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,connections = <&mas_bimc_snoc_1>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_BIMC_SNOC_1>;
+		};
+
+		slv_cnoc_a1noc: slv-cnoc-a1noc {
+			cell-id = <MSM_BUS_CNOC_SNOC_SLV>;
+			label = "slv-cnoc-a1noc";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,connections = <&mas_cnoc_a1noc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CNOC_SNOC>;
+		};
+
+		slv_clk_ctl: slv-clk-ctl {
+			cell-id = <MSM_BUS_SLAVE_CLK_CTL>;
+			label = "slv-clk-ctl";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CLK_CTL>;
+		};
+
+		slv_tcsr: slv-tcsr {
+			cell-id = <MSM_BUS_SLAVE_TCSR>;
+			label = "slv-tcsr";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_TCSR>;
+		};
+
+		slv_tlmm: slv-tlmm {
+			cell-id = <MSM_BUS_SLAVE_TLMM>;
+			label = "slv-tlmm";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_TLMM>;
+		};
+
+		slv_crypto0_cfg:slv-crypto0-cfg {
+			cell-id = <MSM_BUS_SLAVE_CRYPTO_0_CFG>;
+			label = "slv-crypto0-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CRYPTO_0_CFG>;
+		};
+
+		slv_mpm: slv-mpm {
+			cell-id = <MSM_BUS_SLAVE_MPM>;
+			label = "slv-mpm";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MPM>;
+		};
+
+		slv_pimem_cfg: slv-pimem-cfg {
+			cell-id = <MSM_BUS_SLAVE_PIMEM_CFG>;
+			label = "slv-pimem-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PIMEM_CFG>;
+		};
+
+		slv_imem_cfg: slv-imem-cfg {
+			cell-id = <MSM_BUS_SLAVE_IMEM_CFG>;
+			label = "slv-imem-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_IMEM_CFG>;
+		};
+
+		slv_message_ram: slv-message-ram {
+			cell-id = <MSM_BUS_SLAVE_MESSAGE_RAM>;
+			label = "slv-message-ram";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MESSAGE_RAM>;
+		};
+
+		slv_bimc_cfg: slv-bimc-cfg {
+			cell-id = <MSM_BUS_SLAVE_BIMC_CFG>;
+			label = "slv-bimc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_BIMC_CFG>;
+		};
+
+		slv_pmic_arb: slv-pmic-arb {
+			cell-id = <MSM_BUS_SLAVE_PMIC_ARB>;
+			label = "slv-pmic-arb";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PMIC_ARB>;
+		};
+
+		slv_prng: slv-prng {
+			cell-id = <MSM_BUS_SLAVE_PRNG>;
+			label = "slv-prng";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PRNG>;
+		};
+
+		slv_dcc_cfg:slv-dcc-cfg {
+			cell-id = <MSM_BUS_SLAVE_DCC_CFG>;
+			label = "slv-dcc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_DCC_CFG>;
+		};
+
+		slv_rbcpr_mx: slv-rbcpr-mx {
+			cell-id = <MSM_BUS_SLAVE_RBCPR_MX>;
+			label = "slv-rbcpr-mx";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_RBCPR_MX>;
+		};
+
+		slv_qdss_cfg: slv-qdss-cfg {
+			cell-id = <MSM_BUS_SLAVE_QDSS_CFG>;
+			label = "slv-qdss-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_QDSS_CFG>;
+		};
+
+		slv_rbcpr_cx: slv-rbcpr-cx {
+			cell-id = <MSM_BUS_SLAVE_RBCPR_CX>;
+			label = "slv-rbcpr-cx";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_RBCPR_CX>;
+		};
+
+		slv_cpr_apu_cfg:slv-cpr-apu-cfg {
+			cell-id = <MSM_BUS_SLAVE_QDSS_RBCPR_APU_CFG>;
+			label = "slv-cpr-apu-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_QDSS_RBCPR_APU_CFG>;
+		};
+
+		slv_cnoc_mnoc_cfg: slv-cnoc-mnoc-cfg {
+			cell-id = <MSM_BUS_SLAVE_CNOC_MNOC_CFG>;
+			label = "slv-cnoc-mnoc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,connections = <&mas_cnoc_mnoc_cfg>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CNOC_MNOC_CFG>;
+		};
+
+		slv_snoc_cfg: slv-snoc-cfg {
+			cell-id = <MSM_BUS_SLAVE_SNOC_CFG>;
+			label = "slv-snoc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SNOC_CFG>;
+		};
+
+		slv_snoc_mpu_cfg: slv-snoc-mpu-cfg {
+			cell-id = <MSM_BUS_SLAVE_SNOC_MPU_CFG>;
+			label = "slv-snoc-mpu-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SNOC_MPU_CFG>;
+		};
+
+		slv_ebi1_phy_cfg: slv-ebi1-phy-cfg {
+			cell-id = <MSM_BUS_SLAVE_EBI1_PHY_CFG>;
+			label = "slv-ebi1-phy-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_EBI1_PHY_CFG>;
+		};
+
+		slv_a0noc_cfg: slv-a0noc-cfg {
+			cell-id = <MSM_BUS_SLAVE_A0NOC_CFG>;
+			label = "slv-a0noc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A0NOC_CFG>;
+		};
+
+		slv_pcie_1_cfg: slv-pcie-1-cfg {
+			cell-id = <MSM_BUS_SLAVE_PCIE_1_CFG>;
+			label = "slv-pcie-1-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCIE_1_CFG>;
+		};
+
+		slv_pcie_2_cfg: slv-pcie-2-cfg {
+			cell-id = <MSM_BUS_SLAVE_PCIE_2_CFG>;
+			label = "slv-pcie-2-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCIE_2_CFG>;
+		};
+
+		slv_pcie_0_cfg: slv-pcie-0-cfg {
+			cell-id = <MSM_BUS_SLAVE_PCIE_0_CFG>;
+			label = "slv-pcie-0-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCIE_0_CFG>;
+		};
+
+		slv_pcie20_ahb2phy: slv-pcie20-ahb2phy {
+			cell-id = <MSM_BUS_SLAVE_PCIE20_AHB2PHY>;
+			label = "slv-pcie20-ahb2phy";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCIE20_AHB2PHY>;
+		};
+
+		slv_a0noc_mpu_cfg: slv-a0noc-mpu-cfg {
+			cell-id = <MSM_BUS_SLAVE_A0NOC_MPU_CFG>;
+			label = "slv-a0noc-mpu-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A0NOC_MPU_CFG>;
+		};
+
+		slv_ufs_cfg: slv-ufs-cfg {
+			cell-id = <MSM_BUS_SLAVE_UFS_CFG>;
+			label = "slv-ufs-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_UFS_CFG>;
+		};
+
+		slv_a1noc_cfg: slv-a1noc-cfg {
+			cell-id = <MSM_BUS_SLAVE_A1NOC_CFG>;
+			label = "slv-a1noc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A1NOC_CFG>;
+		};
+
+		slv_a1noc_mpu_cfg: slv-a1noc-mpu-cfg {
+			cell-id = <MSM_BUS_SLAVE_A1NOC_MPU_CFG>;
+			label = "slv-a1noc-mpu-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A1NOC_MPU_CFG>;
+		};
+
+		slv_a2noc_cfg: slv-a2noc-cfg {
+			cell-id = <MSM_BUS_SLAVE_A2NOC_CFG>;
+			label = "slv-a2noc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A2NOC_CFG>;
+		};
+
+		slv_a2noc_mpu_cfg: slv-a2noc-mpu-cfg {
+			cell-id = <MSM_BUS_SLAVE_A2NOC_MPU_CFG>;
+			label = "slv-a2noc-mpu-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A2NOC_MPU_CFG>;
+		};
+
+		slv_ssc_cfg: slv-ssc-cfg {
+			cell-id = <MSM_BUS_SLAVE_SSC_CFG>;
+			label = "slv-ssc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SSC_CFG>;
+		};
+
+		slv_a0noc_smmu_cfg: slv-a0noc-smmu-cfg {
+			cell-id = <MSM_BUS_SLAVE_A0NOC_SMMU_CFG>;
+			label = "slv-a0noc-smmu-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A0NOC_SMMU_CFG>;
+		};
+
+		slv_a1noc_smmu_cfg: slv-a1noc-smmu-cfg {
+			cell-id = <MSM_BUS_SLAVE_A1NOC_SMMU_CFG>;
+			label = "slv-a1noc-smmu-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A1NOC_SMMU_CFG>;
+		};
+
+		slv_a2noc_smmu_cfg: slv-a2noc-smmu-cfg {
+			cell-id = <MSM_BUS_SLAVE_A2NOC_SMMU_CFG>;
+			label = "slv-a2noc-smmu-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A2NOC_SMMU_CFG>;
+		};
+
+		slv_lpass_smmu_cfg: slv-lpass-smmu-cfg {
+			cell-id = <MSM_BUS_SLAVE_LPASS_SMMU_CFG>;
+			label = "slv-lpass-smmu-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_LPASS_SMMU_CFG>;
+		};
+
+		slv_cnoc_mnoc_mmss_cfg: slv-cnoc-mnoc-mmss-cfg {
+			cell-id = <MSM_BUS_SLAVE_CNOC_MNOC_MMSS_CFG>;
+			label = "slv-cnoc-mnoc-mmss-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,connections = <&mas_cnoc_mnoc_mmss_cfg>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CNOC_MNOC_MMSS_CFG>;
+		};
+
+		slv_mmagic_cfg: slv-mmagic-cfg {
+			cell-id = <MSM_BUS_SLAVE_MMAGIC_CFG>;
+			label = "slv-mmagic-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MMAGIC_CFG>;
+		};
+
+		slv_cpr_cfg: slv-cpr-cfg {
+			cell-id = <MSM_BUS_SLAVE_CPR_CFG>;
+			label = "slv-cpr-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CPR_CFG>;
+		};
+
+		slv_misc_cfg: slv-misc-cfg {
+			cell-id = <MSM_BUS_SLAVE_MISC_CFG>;
+			label = "slv-misc-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MISC_CFG>;
+		};
+
+		slv_venus_throttle_cfg: slv-venus-throttle-cfg {
+			cell-id = <MSM_BUS_SLAVE_VENUS_THROTTLE_CFG>;
+			label = "slv-venus-throttle-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_VENUS_THROTTLE_CFG>;
+		};
+
+		slv_venus_cfg: slv-venus-cfg {
+			cell-id = <MSM_BUS_SLAVE_VENUS_CFG>;
+			label = "slv-venus-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_VENUS_CFG>;
+		};
+
+		slv_vmem_cfg: slv-vmem-cfg {
+			cell-id = <MSM_BUS_SLAVE_VMEM_CFG>;
+			label = "slv-vmem-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_VMEM_CFG>;
+			qcom,enable-only-clk;
+			clock-names = "node_clk";
+			clocks = <&clock_mmss clk_mmss_mmagic_maxi_clk>;
+			node-gdsc-supply = <&gdsc_mmagic_video>;
+		};
+
+		slv_dsa_cfg: slv-dsa-cfg {
+			cell-id = <MSM_BUS_SLAVE_DSA_CFG>;
+			label = "slv-dsa-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_DSA_CFG>;
+		};
+
+		slv_mnoc_clocks_cfg: slv-mnoc-clocks-cfg {
+			cell-id = <MSM_BUS_SLAVE_MMSS_CLK_CFG>;
+			label = "slv-mnoc-clocks-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MMSS_CLK_CFG>;
+		};
+
+		slv_dsa_mpu_cfg: slv-dsa-mpu-cfg {
+			cell-id = <MSM_BUS_SLAVE_DSA_MPU_CFG>;
+			label = "slv-dsa-mpu-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_DSA_MPU_CFG>;
+		};
+
+		slv_mnoc_mpu_cfg: slv-mnoc-mpu-cfg {
+			cell-id = <MSM_BUS_SLAVE_MNOC_MPU_CFG>;
+			label = "slv-mnoc-mpu-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MNOC_MPU_CFG>;
+		};
+
+		slv_display_cfg: slv-display-cfg {
+			cell-id = <MSM_BUS_SLAVE_DISPLAY_CFG>;
+			label = "slv-display-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_DISPLAY_CFG>;
+		};
+
+		slv_display_throttle_cfg: slv-display-throttle-cfg {
+			cell-id = <MSM_BUS_SLAVE_DISPLAY_THROTTLE_CFG>;
+			label = "slv-display-throttle-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_DISPLAY_THROTTLE_CFG>;
+		};
+
+		slv_camera_cfg: slv-camera-cfg {
+			cell-id = <MSM_BUS_SLAVE_CAMERA_CFG>;
+			label = "slv-camera-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CAMERA_CFG>;
+		};
+
+		slv_camera_throttle_cfg: slv-camera-throttle-cfg {
+			cell-id = <MSM_BUS_SLAVE_CAMERA_THROTTLE_CFG>;
+			label = "slv-camera-throttle-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CAMERA_THROTTLE_CFG>;
+		};
+
+		slv_oxili_cfg: slv-oxili-cfg {
+			cell-id = <MSM_BUS_SLAVE_GRAPHICS_3D_CFG>;
+			label = "slv-oxili-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_GFX3D_CFG>;
+		};
+
+		slv_smmu_mdp_cfg: slv-smmu-mdp-cfg {
+			cell-id = <MSM_BUS_SLAVE_SMMU_MDP_CFG>;
+			label = "slv-smmu-mdp-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SMMU_MDP_CFG>;
+		};
+
+		slv_smmu_rot_cfg: slv-smmu-rot-cfg {
+			cell-id = <MSM_BUS_SLAVE_SMMU_ROTATOR_CFG>;
+			label = "slv-smmu-rot-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SMMU_ROTATOR_CFG>;
+		};
+
+		slv_smmu_venus_cfg: slv-smmu-venus-cfg {
+			cell-id = <MSM_BUS_SLAVE_SMMU_VENUS_CFG>;
+			label = "slv-smmu-venus-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SMMU_VENUS_CFG>;
+		};
+
+		slv_smmu_cpp_cfg: slv-smmu-cpp-cfg {
+			cell-id = <MSM_BUS_SLAVE_SMMU_CPP_CFG>;
+			label = "slv-smmu-cpp-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SMMU_CPP_CFG>;
+		};
+
+		slv_smmu_jpeg_cfg: slv-smmu-jpeg-cfg {
+			cell-id = <MSM_BUS_SLAVE_SMMU_JPEG_CFG>;
+			label = "slv-smmu-jpeg-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SMMU_JPEG_CFG>;
+		};
+
+		slv_smmu_vfe_cfg: slv-smmu-vfe-cfg {
+			cell-id = <MSM_BUS_SLAVE_SMMU_VFE_CFG>;
+			label = "slv-smmu-vfe-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SMMU_VFE_CFG>;
+		};
+
+		slv_mnoc_bimc: slv-mnoc-bimc {
+			cell-id = <MSM_BUS_MNOC_BIMC_SLV>;
+			label = "slv-mnoc-bimc";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <2>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,connections = <&mas_mnoc_bimc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MNOC_BIMC>;
+			qcom,enable-only-clk;
+			clock-names = "node_clk";
+			clocks = <&clock_gcc clk_mmssnoc_axi_clk>;
+		};
+
+		slv_vmem: slv-vmem {
+			cell-id = <MSM_BUS_SLAVE_VMEM>;
+			label = "slv-vmem";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_VMEM>;
+			clock-names = "node_clk";
+			clocks = <&clock_mmss clk_mmss_mmagic_maxi_clk>;
+			node-gdsc-supply = <&gdsc_mmagic_video>;
+		};
+
+		slv_srvc_mnoc: slv-srvc-mnoc {
+			cell-id = <MSM_BUS_SLAVE_SERVICE_MNOC>;
+			label = "slv-srvc-mnoc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SERVICE_MNOC>;
+		};
+
+		slv_pnoc_a1noc: slv-pnoc-a1noc {
+			cell-id = <MSM_BUS_PNOC_A1NOC_SLV>;
+			label = "slv-pnoc-a1noc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_pnoc>;
+			qcom,connections = <&mas_pnoc_a1noc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PNOC_A1NOC>;
+		};
+
+		slv_usb_hs: slv-usb-hs {
+			cell-id = <MSM_BUS_SLAVE_USB_HS>;
+			label = "slv-usb-hs";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_pnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_USB_HS>;
+		};
+
+		slv_sdcc_2: slv-sdcc-2 {
+			cell-id = <MSM_BUS_SLAVE_SDCC_2>;
+			label = "slv-sdcc-2";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_pnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SDCC_2>;
+		};
+
+		slv_sdcc_4: slv-sdcc-4 {
+			cell-id = <MSM_BUS_SLAVE_SDCC_4>;
+			label = "slv-sdcc-4";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_pnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SDCC_4>;
+		};
+
+		slv_tsif: slv-tsif {
+			cell-id = <MSM_BUS_SLAVE_TSIF>;
+			label = "slv-tsif";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_pnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_TSIF>;
+		};
+
+		slv_blsp_2: slv-blsp-2 {
+			cell-id = <MSM_BUS_SLAVE_BLSP_2>;
+			label = "slv-blsp-2";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_pnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_BLSP_2>;
+		};
+
+		slv_sdcc_1:slv-sdcc-1 {
+			cell-id = <MSM_BUS_SLAVE_SDCC_1>;
+			label = "slv-sdcc-1";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_pnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SDCC_1>;
+		};
+
+		slv_blsp_1: slv-blsp-1 {
+			cell-id = <MSM_BUS_SLAVE_BLSP_1>;
+			label = "slv-blsp-1";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_pnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_BLSP_1>;
+		};
+
+		slv_pdm: slv-pdm {
+			cell-id = <MSM_BUS_SLAVE_PDM>;
+			label = "slv-pdm";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_pnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PDM>;
+		};
+
+		slv_ahb2phy: slv-ahb2phy {
+			cell-id = <MSM_BUS_SLAVE_AHB2PHY>;
+			label = "slv-ahb2phy";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_pnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_AHB2PHY>;
+		};
+
+		slv_hmss: slv-hmss {
+			cell-id = <MSM_BUS_SLAVE_APPSS>;
+			label = "slv-hmss";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_APPSS>;
+		};
+
+		slv_lpass: slv-lpass {
+			cell-id = <MSM_BUS_SLAVE_LPASS>;
+			label = "slv-lpass";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_LPASS>;
+		};
+
+		slv_usb3: slv-usb3 {
+			cell-id = <MSM_BUS_SLAVE_USB3>;
+			label = "slv-usb3";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_USB3_0>;
+		};
+
+		slv_snoc_bimc: slv-snoc-bimc {
+			cell-id = <MSM_BUS_SNOC_BIMC_SLV>;
+			label = "slv-snoc-bimc";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <2>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,connections = <&mas_snoc_bimc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SNOC_BIMC>;
+		};
+
+		slv_snoc_cnoc: slv-snoc-cnoc {
+			cell-id = <MSM_BUS_SNOC_CNOC_SLV>;
+			label = "slv-snoc-cnoc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,connections = <&mas_snoc_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SNOC_CNOC>;
+		};
+
+		slv_imem: slv-imem {
+			cell-id = <MSM_BUS_SLAVE_OCIMEM>;
+			label = "slv-imem";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_IMEM>;
+		};
+
+		slv_pimem: slv-pimem {
+			cell-id = <MSM_BUS_SLAVE_PIMEM>;
+			label = "slv-pimem";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PIMEM>;
+		};
+
+		slv_snoc_vmem: slv-snoc-vmem {
+			cell-id = <MSM_BUS_SLAVE_SNOC_VMEM>;
+			label = "slv-snoc-vmem";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,connections = <&mas_snoc_vmem>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SNOC_VMEM>;
+		};
+
+		slv_snoc_pnoc: slv-snoc-pnoc {
+			cell-id = <MSM_BUS_SNOC_PNOC_SLV>;
+			label = "slv-snoc-pnoc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,connections = <&mas_snoc_pnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SNOC_PNOC>;
+		};
+
+		slv_qdss_stm: slv-qdss-stm {
+			cell-id = <MSM_BUS_SLAVE_QDSS_STM>;
+			label = "slv-qdss-stm";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_QDSS_STM>;
+		};
+
+		slv_pcie_0: slv-pcie-0 {
+			cell-id = <MSM_BUS_SLAVE_PCIE_0>;
+			label = "slv-pcie-0";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCIE_0>;
+		};
+
+		slv_pcie_1: slv-pcie-1 {
+			cell-id = <MSM_BUS_SLAVE_PCIE_1>;
+			label = "slv-pcie-1";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCIE_1>;
+		};
+
+		slv_pcie_2: slv-pcie-2 {
+			cell-id = <MSM_BUS_SLAVE_PCIE_2>;
+			label = "slv-pcie-2";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCIE_2>;
+		};
+
+		slv_srvc_snoc: slv-srvc-snoc {
+			cell-id = <MSM_BUS_SLAVE_SERVICE_SNOC>;
+			label = "slv-srvc-snoc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SERVICE_SNOC>;
+		};
+	};
+
+	devfreq_spdm_cpu {
+		compatible = "qcom,devfreq_spdm";
+		qcom,msm-bus,name = "devfreq_spdm";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<1 512 0 0>,
+				<1 512 0 0>;
+		qcom,msm-bus,active-only;
+		qcom,spdm-client = <0>;
+
+		clock-names = "cci_clk";
+		clocks = <&clock_cpu clk_cbf_clk>;
+
+		qcom,bw-upstep = <1000>;
+		qcom,bw-dwnstep = <1000>;
+		qcom,max-vote = <10000>;
+		qcom,up-step-multp = <2>;
+		qcom,spdm-interval = <100>;
+
+		qcom,ports = <24>;
+		qcom,alpha-up = <12>;
+		qcom,alpha-down = <15>;
+		qcom,bucket-size = <8>;
+
+		/*max pl1 freq, max pl2 freq*/
+		qcom,pl-freqs = <260000 770000>;
+
+		/* pl1 low, pl1 high, pl2 low, pl2 high, pl3 low, pl3 high */
+		qcom,reject-rate = <5000 5000 5000 5000 5000 5000>;
+		/* pl1 low, pl1 high, pl2 low, pl2 high, pl3 low, pl3 high */
+		qcom,response-time-us = <10000 10000 10000 10000 10000 10000>;
+		/* pl1 low, pl1 high, pl2 low, pl2 high, pl3 low, pl3 high */
+		qcom,cci-response-time-us = <10000 10000 10000 10000 10000 10000>;
+		qcom,max-cci-freq = <1036800> ;
+	};
+
+	devfreq_spdm_gov {
+		compatible = "qcom,gov_spdm_hyp";
+		interrupt-names = "spdm-irq";
+		interrupts = <0 192 0>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-camera-sensor-adp.dtsi b/arch/arm64/boot/dts/qcom/msm8996-camera-sensor-adp.dtsi
new file mode 100644
index 000000000000..31139c0fbb6d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-camera-sensor-adp.dtsi
@@ -0,0 +1,238 @@
+/*
+ * Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	led_flash0: qcom,camera-flash {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8994_flash0 &pmi8994_flash1>;
+		qcom,torch-source = <&pmi8994_torch0 &pmi8994_torch1>;
+		qcom,switch-source = <&pmi8994_switch>;
+	};
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&pm8994_l23>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&pm8994_l23>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		qcom,cci-master = <0>;
+		cam_vdig-supply = <&pm8994_s3>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l17>;
+		cam_vaf-supply = <&pm8994_l23>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana",
+			"cam_vaf";
+		qcom,cam-vreg-min-voltage = <1300000 0 2500000 2800000>;
+		qcom,cam-vreg-max-voltage = <1300000 0 2500000 2800000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000 100000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+			&cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					  "CAM_RESET0",
+					  "CAM_STANDBY0";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <19200000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		qcom,cci-master = <1>;
+		cam_vdig-supply = <&pm8994_l27>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l29>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1000000 0 2800000>;
+		qcom,cam-vreg-max-voltage = <1000000 0 2800000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+			&cam_sensor_front_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 23 0>,
+			<&tlmm 26 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					  "CAM_RESET2",
+					  "CAM_STANDBY2";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <19200000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <90>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vdig-supply = <&pm8994_s3>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l17>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1300000 0 1800000>;
+		qcom,cam-vreg-max-voltage = <1300000 0 1800000>;
+		qcom,cam-vreg-op-mode = <1300000 0 1800000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					  "CAM_RESET0",
+					  "CAM_STANDBY0";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <90>;
+		cam_vdig-supply = <&pm8994_l27>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pmi8994_boostbypass>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <800000 0 3150000>;
+		qcom,cam-vreg-max-voltage = <800000 0 3600000>;
+		qcom,cam-vreg-op-mode = <800000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				&cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 63 0>,
+			<&tlmm 62 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_STANDBY1";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,eeprom-src = <&eeprom1>;
+		qcom,actuator-src = <&actuator1>;
+		cam_vdig-supply = <&pm8994_l27>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l29>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <800000 0 2500000>;
+		qcom,cam-vreg-max-voltage = <800000 0 2500000>;
+		qcom,cam-vreg-op-mode = <800000 0 2500000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				&cam_sensor_front_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 23 0>,
+			<&tlmm 26 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					  "CAM_RESET2",
+					  "CAM_STANDBY2";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-camera-sensor-cdp.dtsi b/arch/arm64/boot/dts/qcom/msm8996-camera-sensor-cdp.dtsi
new file mode 100644
index 000000000000..c20ac822a3c7
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-camera-sensor-cdp.dtsi
@@ -0,0 +1,248 @@
+/*
+ * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	led_flash0: qcom,camera-flash {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8994_flash0 &pmi8994_flash1>;
+		qcom,torch-source = <&pmi8994_torch0 &pmi8994_torch1>;
+		qcom,switch-source = <&pmi8994_switch>;
+	};
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&pm8994_l23>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&pm8994_l23>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	ois0: qcom,ois@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,ois";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&pm8994_l23>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		qcom,cci-master = <0>;
+		cam_vdig-supply = <&pm8994_s3>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l17>;
+		cam_vaf-supply = <&pm8994_l23>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana",
+			"cam_vaf";
+		qcom,cam-vreg-min-voltage = <1300000 0 2500000 2800000>;
+		qcom,cam-vreg-max-voltage = <1300000 0 2500000 2800000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000 100000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+			&cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					  "CAM_RESET0",
+					  "CAM_STANDBY0";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+			<&clock_mmss clk_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <19200000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		qcom,cci-master = <1>;
+		cam_vdig-supply = <&pm8994_l27>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l29>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1000000 0 2800000>;
+		qcom,cam-vreg-max-voltage = <1000000 0 2800000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+			&cam_sensor_front_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 23 0>,
+			<&tlmm 26 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					  "CAM_RESET2",
+					  "CAM_STANDBY2";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <19200000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <0>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,ois-src = <&ois0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vdig-supply = <&pm8994_s3>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l17>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1300000 0 2500000>;
+		qcom,cam-vreg-max-voltage = <1300000 0 2500000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend &cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					  "CAM_RESET0",
+					  "CAM_STANDBY0";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <90>;
+		cam_vdig-supply = <&pm8994_l27>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pmi8994_boostbypass>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1000000 0 3150000>;
+		qcom,cam-vreg-max-voltage = <1000000 0 3600000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 63 0>,
+			<&tlmm 62 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_STANDBY1";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,eeprom-src = <&eeprom1>;
+		qcom,actuator-src = <&actuator1>;
+		cam_vdig-supply = <&pm8994_l27>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l29>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1000000 0 2800000>;
+		qcom,cam-vreg-max-voltage = <1000000 0 2800000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend &cam_sensor_front_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 23 0>,
+			<&tlmm 26 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					  "CAM_RESET2",
+					  "CAM_STANDBY2";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-camera-sensor-dtp.dtsi b/arch/arm64/boot/dts/qcom/msm8996-camera-sensor-dtp.dtsi
new file mode 100644
index 000000000000..52638fe8e170
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-camera-sensor-dtp.dtsi
@@ -0,0 +1,238 @@
+/*
+ * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	led_flash0: qcom,camera-flash {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8994_flash0 &pmi8994_flash1>;
+		qcom,torch-source = <&pmi8994_torch0 &pmi8994_torch1>;
+		qcom,switch-source = <&pmi8994_switch>;
+	};
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&pm8994_l23>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&pm8994_l23>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		qcom,cci-master = <0>;
+		cam_vdig-supply = <&pm8994_s3>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l17>;
+		cam_vaf-supply = <&pm8994_l23>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana",
+			"cam_vaf";
+		qcom,cam-vreg-min-voltage = <1300000 0 2500000 2800000>;
+		qcom,cam-vreg-max-voltage = <1300000 0 2500000 2800000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000 100000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+			&cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					  "CAM_RESET0",
+					  "CAM_STANDBY0";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <19200000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		qcom,cci-master = <1>;
+		cam_vdig-supply = <&pm8994_l27>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l29>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1200000 0 2800000>;
+		qcom,cam-vreg-max-voltage = <1200000 0 2800000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+			&cam_sensor_front_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 23 0>,
+			<&tlmm 26 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					  "CAM_RESET2",
+					  "CAM_STANDBY2";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <19200000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <90>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vdig-supply = <&pm8994_s3>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l17>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1300000 0 2500000>;
+		qcom,cam-vreg-max-voltage = <1300000 0 2500000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+						&cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+						&cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>;
+		qcom,gpio-standby = <1>;
+		qcom,gpio-req-tbl-num = <0 1>;
+		qcom,gpio-req-tbl-flags = <1 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					  "CAM_STANDBY0";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <90>;
+		cam_vdig-supply = <&pm8994_l27>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pmi8994_boostbypass>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1000000 0 3150000>;
+		qcom,cam-vreg-max-voltage = <1000000 0 3600000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+						&cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+						&cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 63 0>,
+			<&tlmm 62 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_STANDBY1";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <270>;
+		qcom,eeprom-src = <&eeprom1>;
+		qcom,actuator-src = <&actuator1>;
+		cam_vdig-supply = <&pm8994_l27>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l29>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1200000 0 2800000>;
+		qcom,cam-vreg-max-voltage = <1200000 0 2800000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+						&cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+						&cam_sensor_front_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 23 0>,
+			<&tlmm 26 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					  "CAM_RESET2",
+					  "CAM_STANDBY2";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-camera-sensor-liquid.dtsi b/arch/arm64/boot/dts/qcom/msm8996-camera-sensor-liquid.dtsi
new file mode 100644
index 000000000000..e041921e7154
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-camera-sensor-liquid.dtsi
@@ -0,0 +1,249 @@
+/*
+ * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	led_flash0: qcom,camera-flash {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8994_flash0 &pmi8994_flash1>;
+		qcom,torch-source = <&pmi8994_torch0 &pmi8994_torch1>;
+		qcom,switch-source = <&pmi8994_switch>;
+	};
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&pm8994_l23>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&pm8994_l23>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	ois0: qcom,ois@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,ois";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&pm8994_l23>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		qcom,cci-master = <0>;
+		cam_vdig-supply = <&pm8994_s3>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l17>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1300000 0 2500000>;
+		qcom,cam-vreg-max-voltage = <1300000 0 2500000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+			&cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					  "CAM_RESET0",
+					  "CAM_STANDBY0";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <19200000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		qcom,cci-master = <1>;
+		cam_vdig-supply = <&pm8994_l27>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l29>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1000000 0 2800000>;
+		qcom,cam-vreg-max-voltage = <1000000 0 2800000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+			&cam_sensor_front_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 23 0>,
+			<&tlmm 26 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					  "CAM_RESET2",
+					  "CAM_STANDBY2";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <19200000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <180>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,ois-src = <&ois0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vdig-supply = <&pm8994_s3>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l17>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1300000 0 2500000>;
+		qcom,cam-vreg-max-voltage = <1300000 0 2500000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+			&cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					  "CAM_RESET0",
+					  "CAM_STANDBY0";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <90>;
+		cam_vdig-supply = <&pm8994_l27>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pmi8994_boostbypass>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1000000 0 3150000>;
+		qcom,cam-vreg-max-voltage = <1000000 0 3600000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+			&cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 63 0>,
+			<&tlmm 62 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_STANDBY1";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <360>;
+		qcom,eeprom-src = <&eeprom1>;
+		qcom,actuator-src = <&actuator1>;
+		cam_vdig-supply = <&pm8994_l27>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l29>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1000000 0 2800000>;
+		qcom,cam-vreg-max-voltage = <1000000 0 2800000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+			&cam_sensor_front_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 23 0>,
+			<&tlmm 26 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					  "CAM_RESET2",
+					  "CAM_STANDBY2";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-camera-sensor-mtp.dtsi b/arch/arm64/boot/dts/qcom/msm8996-camera-sensor-mtp.dtsi
new file mode 100644
index 000000000000..b70781f8f893
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-camera-sensor-mtp.dtsi
@@ -0,0 +1,251 @@
+/*
+ * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	led_flash0: qcom,camera-flash {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8994_flash0 &pmi8994_flash1>;
+		qcom,torch-source = <&pmi8994_torch0 &pmi8994_torch1>;
+		qcom,switch-source = <&pmi8994_switch>;
+	};
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&pm8994_l23>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&pm8994_l23>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	ois0: qcom,ois@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,ois";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&pm8994_l23>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		qcom,cci-master = <0>;
+		cam_vdig-supply = <&pm8994_s3>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l17>;
+		cam_vaf-supply = <&pm8994_l23>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana",
+			"cam_vaf";
+		qcom,cam-vreg-min-voltage = <1300000 0 2500000 2800000>;
+		qcom,cam-vreg-max-voltage = <1300000 0 2500000 2800000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000 100000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+			&cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					  "CAM_RESET0",
+					  "CAM_STANDBY0";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <19200000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		qcom,cci-master = <1>;
+		cam_vdig-supply = <&pm8994_l27>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l29>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1000000 0 2800000>;
+		qcom,cam-vreg-max-voltage = <1000000 0 2800000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+			&cam_sensor_front_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 23 0>,
+			<&tlmm 26 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					  "CAM_RESET2",
+					  "CAM_STANDBY2";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <19200000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <90>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,ois-src = <&ois0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vdig-supply = <&pm8994_s3>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l17>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1300000 0 2500000>;
+		qcom,cam-vreg-max-voltage = <1300000 0 2500000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend &cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					  "CAM_RESET0",
+					  "CAM_STANDBY0";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <90>;
+		qcom,eeprom-src = <&eeprom1>;
+		qcom,actuator-src = <&actuator1>;
+		cam_vdig-supply = <&pm8994_s3>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l17>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1300000 0 2500000>;
+		qcom,cam-vreg-max-voltage = <1300000 0 2500000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+			&cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					  "CAM_RESET0",
+					  "CAM_STANDBY0";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+			<&clock_mmss clk_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,eeprom-src = <&eeprom1>;
+		qcom,actuator-src = <&actuator1>;
+		cam_vdig-supply = <&pm8994_l27>;
+		cam_vio-supply = <&pm8994_lvs1>;
+		cam_vana-supply = <&pm8994_l29>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <1000000 0 2800000>;
+		qcom,cam-vreg-max-voltage = <1000000 0 2800000>;
+		qcom,cam-vreg-op-mode = <105000 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend &cam_sensor_front_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 23 0>,
+			<&tlmm 26 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-standby = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					  "CAM_RESET2",
+					  "CAM_STANDBY2";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-camera.dtsi b/arch/arm64/boot/dts/qcom/msm8996-camera.dtsi
new file mode 100644
index 000000000000..f3838785b38c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-camera.dtsi
@@ -0,0 +1,850 @@
+/*
+ * Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	qcom,msm-cam@8c0000 {
+		compatible = "qcom,msm-cam";
+		reg = <0x8c0000 0x40000>;
+		reg-names = "msm-cam";
+		status = "ok";
+		bus-vectors = "suspend", "svs", "nominal", "turbo";
+		qcom,bus-votes = <0 300000000 640000000 640000000>;
+	};
+
+	qcom,csiphy@a34000 {
+		cell-index = <0>;
+		compatible = "qcom,csiphy-v3.5", "qcom,csiphy";
+		reg = <0xa34000 0x1000>, <0xA00030 0x4>;
+		reg-names = "csiphy", "csiphy_clk_mux";
+		interrupts = <0 78 0>;
+		interrupt-names = "csiphy";
+		qcom,csi-vdd-voltage = <1250000>;
+		qcom,mipi-csi-vdd-supply = <&pm8994_l2>;
+		mmagic-supply = <&gdsc_mmagic_camss>;
+		gdscr-supply = <&gdsc_camss_top>;
+		qcom,cam-vreg-name = "mmagic", "gdscr";
+		clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			<&clock_mmss clk_camss_top_ahb_clk>,
+			<&clock_mmss clk_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csi0phytimer_clk_src>,
+			<&clock_mmss clk_camss_csi0phytimer_clk>,
+			<&clock_mmss clk_camss_ahb_clk>,
+			<&clock_mmss clk_csiphy0_3p_clk_src>,
+			<&clock_mmss clk_camss_csiphy0_3p_clk>;
+		clock-names = "mmagic_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csiphy_timer_src_clk",
+			"csiphy_timer_clk", "camss_ahb_clk",
+			"csiphy_3p_clk_src", "csi_phy_3p_clk";
+		qcom,clock-rates = <0 0 0 200000000 0 0 100000000 0>;
+	};
+
+	qcom,csiphy@a35000 {
+		cell-index = <1>;
+		compatible = "qcom,csiphy-v3.5", "qcom,csiphy";
+		reg = <0xa35000 0x1000>, <0xA00038 0x4>;
+		reg-names = "csiphy", "csiphy_clk_mux";
+		interrupts = <0 79 0>;
+		interrupt-names = "csiphy";
+		qcom,csi-vdd-voltage = <1250000>;
+		qcom,mipi-csi-vdd-supply = <&pm8994_l2>;
+		mmagic-supply = <&gdsc_mmagic_camss>;
+		gdscr-supply = <&gdsc_camss_top>;
+		qcom,cam-vreg-name = "mmagic", "gdscr";
+		clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			<&clock_mmss clk_camss_top_ahb_clk>,
+			<&clock_mmss clk_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csi1phytimer_clk_src>,
+			<&clock_mmss clk_camss_csi1phytimer_clk>,
+			<&clock_mmss clk_camss_ahb_clk>,
+			<&clock_mmss clk_csiphy1_3p_clk_src>,
+			<&clock_mmss clk_camss_csiphy1_3p_clk>;
+		clock-names = "mmagic_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csiphy_timer_src_clk",
+			"csiphy_timer_clk", "camss_ahb_clk",
+			"csiphy_3p_clk_src", "csi_phy_3p_clk";
+		qcom,clock-rates = <0 0 0 200000000 0 0 100000000 0>;
+	};
+
+	qcom,csiphy@a36000 {
+		cell-index = <2>;
+		compatible = "qcom,csiphy-v3.5", "qcom,csiphy";
+		reg = <0xa36000 0x1000>, <0xA00040 0x4>;
+		reg-names = "csiphy", "csiphy_clk_mux";
+		interrupts = <0 80 0>;
+		interrupt-names = "csiphy";
+		qcom,csi-vdd-voltage = <1250000>;
+		qcom,mipi-csi-vdd-supply = <&pm8994_l2>;
+		mmagic-supply = <&gdsc_mmagic_camss>;
+		gdscr-supply = <&gdsc_camss_top>;
+		qcom,cam-vreg-name = "mmagic", "gdscr";
+		clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			<&clock_mmss clk_camss_top_ahb_clk>,
+			<&clock_mmss clk_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csi2phytimer_clk_src>,
+			<&clock_mmss clk_camss_csi2phytimer_clk>,
+			<&clock_mmss clk_camss_ahb_clk>,
+			<&clock_mmss clk_csiphy2_3p_clk_src>,
+			<&clock_mmss clk_camss_csiphy2_3p_clk>;
+		clock-names = "mmagic_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csiphy_timer_src_clk",
+			"csiphy_timer_clk", "camss_ahb_clk",
+			"csiphy_3p_clk_src", "csi_phy_3p_clk";
+		qcom,clock-rates = <0 0 0 200000000 0 0 100000000 0>;
+	};
+
+	qcom,csid@a30000  {
+		cell-index = <0>;
+		compatible = "qcom,csid-v3.5", "qcom,csid";
+		reg = <0xa30000 0x400>;
+		reg-names = "csid";
+		interrupts = <0 296 0>;
+		interrupt-names = "csid";
+		qcom,csi-vdd-voltage = <1250000>;
+		qcom,mipi-csi-vdd-supply = <&pm8994_l2>;
+		mmagic-supply = <&gdsc_mmagic_camss>;
+		gdscr-supply = <&gdsc_camss_top>;
+		qcom,cam-vreg-name = "mmagic", "gdscr";
+		clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			<&clock_mmss clk_camss_top_ahb_clk>,
+			<&clock_mmss clk_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csi0_clk_src>,
+			<&clock_mmss clk_camss_csi0_clk>,
+			<&clock_mmss clk_camss_csi0phy_clk>,
+			<&clock_mmss clk_camss_csi0_ahb_clk>,
+			<&clock_mmss clk_camss_csi0rdi_clk>,
+			<&clock_mmss clk_camss_csi0pix_clk>,
+			<&clock_mmss clk_camss_ahb_clk>;
+		clock-names = "mmagic_camss_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csi_src_clk", "csi_clk",
+			"csi_phy_clk", "csi_ahb_clk", "csi_rdi_clk",
+			"csi_pix_clk", "camss_ahb_clk";
+		qcom,clock-rates = <0 0 0 200000000 0 0 0 0 0 0>;
+		status = "ok";
+	};
+
+	qcom,csid@a30400 {
+		cell-index = <1>;
+		compatible = "qcom,csid-v3.5", "qcom,csid";
+		reg = <0xa30400 0x400>;
+		reg-names = "csid";
+		interrupts = <0 297 0>;
+		interrupt-names = "csid";
+		qcom,csi-vdd-voltage = <1250000>;
+		qcom,mipi-csi-vdd-supply = <&pm8994_l2>;
+		mmagic-supply = <&gdsc_mmagic_camss>;
+		gdscr-supply = <&gdsc_camss_top>;
+		qcom,cam-vreg-name = "mmagic", "gdscr";
+		clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			<&clock_mmss clk_camss_top_ahb_clk>,
+			<&clock_mmss clk_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csi1_clk_src>,
+			<&clock_mmss clk_camss_csi1_clk>,
+			<&clock_mmss clk_camss_csi1phy_clk>,
+			<&clock_mmss clk_camss_csi1_ahb_clk>,
+			<&clock_mmss clk_camss_csi1rdi_clk>,
+			<&clock_mmss clk_camss_csi1pix_clk>,
+			<&clock_mmss clk_camss_ahb_clk>;
+		clock-names = "mmagic_camss_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csi_src_clk", "csi_clk",
+			"csi_phy_clk", "csi_ahb_clk", "csi_rdi_clk",
+			"csi_pix_clk", "camss_ahb_clk";
+		qcom,clock-rates = <0 0 0 200000000 0 0 0 0 0 0>;
+	};
+
+	qcom,csid@a30800 {
+		cell-index = <2>;
+		compatible = "qcom,csid-v3.5", "qcom,csid";
+		reg = <0xa30800 0x400>;
+		reg-names = "csid";
+		interrupts = <0 298 0>;
+		interrupt-names = "csid";
+		qcom,csi-vdd-voltage = <1250000>;
+		qcom,mipi-csi-vdd-supply = <&pm8994_l2>;
+		mmagic-supply = <&gdsc_mmagic_camss>;
+		gdscr-supply = <&gdsc_camss_top>;
+		qcom,cam-vreg-name = "mmagic", "gdscr";
+		clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			<&clock_mmss clk_camss_top_ahb_clk>,
+			<&clock_mmss clk_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csi2_clk_src>,
+			<&clock_mmss clk_camss_csi2_clk>,
+			<&clock_mmss clk_camss_csi2phy_clk>,
+			<&clock_mmss clk_camss_csi2_ahb_clk>,
+			<&clock_mmss clk_camss_csi2rdi_clk>,
+			<&clock_mmss clk_camss_csi2pix_clk>,
+			<&clock_mmss clk_camss_ahb_clk>;
+		clock-names = "mmagic_camss_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csi_src_clk", "csi_clk",
+			"csi_phy_clk", "csi_ahb_clk", "csi_rdi_clk",
+			"csi_pix_clk", "camss_ahb_clk";
+		qcom,clock-rates = <0 0 0 200000000 0 0 0 0 0 0>;
+	};
+
+	qcom,csid@a30c00 {
+		cell-index = <3>;
+		compatible = "qcom,csid-v3.5", "qcom,csid";
+		reg = <0xa30c00 0x400>;
+		reg-names = "csid";
+		interrupts = <0 299 0>;
+		interrupt-names = "csid";
+		qcom,csi-vdd-voltage = <1250000>;
+		qcom,mipi-csi-vdd-supply = <&pm8994_l2>;
+		mmagic-supply = <&gdsc_mmagic_camss>;
+		gdscr-supply = <&gdsc_camss_top>;
+		qcom,cam-vreg-name = "mmagic", "gdscr";
+		clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			<&clock_mmss clk_camss_top_ahb_clk>,
+			<&clock_mmss clk_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csi3_clk_src>,
+			<&clock_mmss clk_camss_csi3_clk>,
+			<&clock_mmss clk_camss_csi3phy_clk>,
+			<&clock_mmss clk_camss_csi3_ahb_clk>,
+			<&clock_mmss clk_camss_csi3rdi_clk>,
+			<&clock_mmss clk_camss_csi3pix_clk>,
+			<&clock_mmss clk_camss_ahb_clk>;
+		clock-names = "mmagic_camss_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csi_src_clk", "csi_clk",
+			"csi_phy_clk", "csi_ahb_clk", "csi_rdi_clk",
+			"csi_pix_clk", "camss_ahb_clk";
+		qcom,clock-rates = <0 0 0 200000000 0 0 0 0 0 0>;
+	};
+
+	qcom,ispif@a31000 {
+		cell-index = <0>;
+		compatible = "qcom,ispif-v3.0", "qcom,ispif";
+		reg = <0xa31000 0xc00>,
+			<0xa00020 0x4>;
+		reg-names = "ispif", "csi_clk_mux";
+		interrupts = <0 309 0>;
+		interrupt-names = "ispif";
+		qcom,num-isps = <0x2>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		mmagic-vdd-supply = <&gdsc_mmagic_camss>;
+		vfe0-vdd-supply = <&gdsc_vfe0>;
+		vfe1-vdd-supply = <&gdsc_vfe1>;
+		qcom,vdd-names = "camss-vdd", "mmagic-vdd", "vfe0-vdd",
+				"vfe1-vdd";
+		clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			<&clock_mmss clk_camss_top_ahb_clk>,
+			<&clock_mmss clk_camss_ahb_clk>,
+			<&clock_mmss clk_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csi0_clk_src>,
+			<&clock_mmss clk_camss_csi0_clk>,
+			<&clock_mmss clk_camss_csi0rdi_clk>,
+			<&clock_mmss clk_camss_csi0pix_clk>,
+			<&clock_mmss clk_csi1_clk_src>,
+			<&clock_mmss clk_camss_csi1_clk>,
+			<&clock_mmss clk_camss_csi1rdi_clk>,
+			<&clock_mmss clk_camss_csi1pix_clk>,
+			<&clock_mmss clk_csi2_clk_src>,
+			<&clock_mmss clk_camss_csi2_clk>,
+			<&clock_mmss clk_camss_csi2rdi_clk>,
+			<&clock_mmss clk_camss_csi2pix_clk>,
+			<&clock_mmss clk_csi3_clk_src>,
+			<&clock_mmss clk_camss_csi3_clk>,
+			<&clock_mmss clk_camss_csi3rdi_clk>,
+			<&clock_mmss clk_camss_csi3pix_clk>,
+			<&clock_mmss clk_vfe0_clk_src>,
+			<&clock_mmss clk_camss_vfe0_clk>,
+			<&clock_mmss clk_camss_csi_vfe0_clk>,
+			<&clock_mmss clk_vfe1_clk_src>,
+			<&clock_mmss clk_camss_vfe1_clk>,
+			<&clock_mmss clk_camss_csi_vfe1_clk>;
+		clock-names = "mmagic_camss_ahb_clk",
+			"camss_top_ahb_clk",
+			"camss_ahb_clk", "ispif_ahb_clk",
+			"csi0_src_clk", "csi0_clk",
+			"csi0_pix_clk", "csi0_rdi_clk",
+			"csi1_src_clk", "csi1_clk",
+			"csi1_pix_clk", "csi1_rdi_clk",
+			"csi2_src_clk", "csi2_clk",
+			"csi2_pix_clk", "csi2_rdi_clk",
+			"csi3_src_clk", "csi3_clk",
+			"csi3_pix_clk", "csi3_rdi_clk",
+			"vfe0_clk_src", "camss_vfe_vfe0_clk", "camss_csi_vfe0_clk",
+			"vfe1_clk_src", "camss_vfe_vfe1_clk", "camss_csi_vfe1_clk";
+		qcom,clock-rates = <0 0 0 0
+			0 0 0 0
+			0 0 0 0
+			0 0 0 0
+			0 0 0 0
+			0 0 0
+			0 0 0>;
+		qcom,clock-cntl-support;
+		qcom,clock-control = "NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"INIT_RATE",
+			"NO_SET_RATE", "NO_SET_RATE", "NO_SET_RATE",
+			"INIT_RATE",
+			"NO_SET_RATE", "NO_SET_RATE", "NO_SET_RATE",
+			"INIT_RATE",
+			"NO_SET_RATE", "NO_SET_RATE", "NO_SET_RATE",
+			"INIT_RATE",
+			"NO_SET_RATE", "NO_SET_RATE", "NO_SET_RATE",
+			"INIT_RATE", "NO_SET_RATE", "NO_SET_RATE",
+			"INIT_RATE", "NO_SET_RATE", "NO_SET_RATE";
+		status = "ok";
+	};
+
+	vfe0: qcom,vfe0@a10000 {
+		cell-index = <0>;
+		compatible = "qcom,vfe47";
+		reg = <0xa10000 0x4000>,
+			<0xa40000 0x3000>;
+		reg-names = "vfe", "vfe_vbif";
+		interrupts = <0 314 0>;
+		interrupt-names = "vfe";
+		vdd-supply = <&gdsc_vfe0>;
+		mmagic-vdd-supply = <&gdsc_mmagic_camss>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			<&clock_mmss clk_mmagic_camss_axi_clk>,
+			<&clock_mmss clk_camss_top_ahb_clk>,
+			<&clock_mmss clk_camss_ahb_clk>,
+			<&clock_mmss clk_vfe0_clk_src>,
+			<&clock_mmss clk_camss_vfe0_clk>,
+			<&clock_mmss clk_camss_csi_vfe0_clk>,
+			<&clock_mmss clk_camss_vfe_ahb_clk>,
+			<&clock_mmss clk_camss_vfe0_ahb_clk>,
+			<&clock_mmss clk_camss_vfe_axi_clk>,
+			<&clock_mmss clk_camss_vfe0_stream_clk>,
+			<&clock_mmss clk_smmu_vfe_axi_clk>;
+		clock-names = "mmagic_ahb_clk",
+			"camss_axi_clk",
+			"camss_top_ahb_clk" , "camss_ahb_clk",
+			"vfe_clk_src", "camss_vfe_clk",
+			"camss_csi_vfe_clk",
+			"vfe_vbif_ahb_clk", "vfe_ahb_clk",
+			"bus_clk", "vfe_stream_clk", "smmu_vfe_axi_clk";
+		qcom,clock-rates = <0 0 0 0 320000000 0 0 0 0 0 0 0>;
+		status = "ok";
+		qos-entries = <8>;
+		qos-regs = <0x404 0x408 0x40c 0x410 0x414 0x418
+			0x41c 0x420>;
+		qos-settings = <0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0x0001aaa9>;
+		vbif-entries = <1>;
+		vbif-regs = <0x124>;
+		vbif-settings = <0x3>;
+		ds-entries = <17>;
+		ds-regs = <0x424 0x428 0x42c 0x430 0x434
+			0x438 0x43c 0x440 0x444 0x448 0x44c
+			0x450 0x454 0x458 0x45c 0x460 0x464>;
+		ds-settings = <0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0x40000103>;
+		max-clk-svs = <300000000>;
+		max-clk-nominal = <480000000>;
+		max-clk-turbo = <600000000>;
+	};
+
+	vfe1: qcom,vfe1@a14000 {
+		cell-index = <1>;
+		compatible = "qcom,vfe47";
+		reg = <0xa14000 0x4000>,
+			<0xa40000 0x3000>;
+		reg-names = "vfe", "vfe_vbif";
+		interrupts = <0 315 0>;
+		interrupt-names = "vfe";
+		vdd-supply = <&gdsc_vfe1>;
+		mmagic-vdd-supply = <&gdsc_mmagic_camss>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			<&clock_mmss clk_mmagic_camss_axi_clk>,
+			<&clock_mmss clk_camss_top_ahb_clk>,
+			<&clock_mmss clk_camss_ahb_clk>,
+			<&clock_mmss clk_vfe1_clk_src>,
+			<&clock_mmss clk_camss_vfe1_clk>,
+			<&clock_mmss clk_camss_csi_vfe1_clk>,
+			<&clock_mmss clk_camss_vfe_ahb_clk>,
+			<&clock_mmss clk_camss_vfe1_ahb_clk>,
+			<&clock_mmss clk_camss_vfe_axi_clk>,
+			<&clock_mmss clk_camss_vfe1_stream_clk>,
+			<&clock_mmss clk_smmu_vfe_axi_clk>;
+		clock-names = "mmagic_ahb_clk",
+			"camss_axi_clk",
+			"camss_top_ahb_clk" , "camss_ahb_clk",
+			"vfe_clk_src", "camss_vfe_clk",
+			"camss_csi_vfe_clk",
+			"vfe_vbif_ahb_clk", "vfe_ahb_clk",
+			"bus_clk", "vfe_stream_clk", "smmu_vfe_axi_clk";
+		qcom,clock-rates = <0 0 0 0 320000000 0 0 0 0 0 0 0>;
+		status = "ok";
+		qos-entries = <8>;
+		qos-regs = <0x404 0x408 0x40c 0x410 0x414 0x418
+			0x41c 0x420>;
+		qos-settings = <0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0x0001aaa9>;
+		vbif-entries = <1>;
+		vbif-regs = <0x124>;
+		vbif-settings = <0x3>;
+		ds-entries = <17>;
+		ds-regs = <0x424 0x428 0x42c 0x430 0x434
+			0x438 0x43c 0x440 0x444 0x448 0x44c
+			0x450 0x454 0x458 0x45c 0x460 0x464>;
+		ds-settings = <0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0x40000103>;
+		max-clk-svs = <300000000>;
+		max-clk-nominal = <480000000>;
+		max-clk-turbo = <600000000>;
+	};
+
+	qcom,vfe {
+		compatible = "qcom,vfe";
+		num_child = <2>;
+	};
+
+	qcom,cam_smmu {
+		compatible = "qcom,msm-cam-smmu";
+
+		msm_cam_smmu_cb1 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&vfe_smmu 0>,
+					<&vfe_smmu 1>,
+					<&vfe_smmu 2>,
+					<&vfe_smmu 3>;
+			label = "vfe";
+			qcom,scratch-buf-support;
+		};
+
+		msm_cam_smmu_cb3 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&cpp_fd_smmu 0>;
+			label = "cpp";
+		};
+
+		msm_cam_smmu_cb4 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&cpp_fd_smmu 1>;
+			label = "camera_fd";
+		};
+
+		msm_cam_smmu_cb5 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&jpeg_smmu 0>;
+			label = "jpeg_enc0";
+		};
+
+		msm_cam_smmu_cb6 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&jpeg_smmu 1>;
+			label = "jpeg_dma";
+		};
+
+		msm_cam_smmu_cb7 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&jpeg_smmu 2>;
+			label = "jpeg_dec";
+		};
+	};
+
+	qcom,jpeg@a1c000 {
+		cell-index = <0>;
+		compatible = "qcom,jpeg";
+		reg = <0xa1c000 0x4000>,
+			<0xa60000 0x3000>;
+		reg-names = "jpeg_hw", "jpeg_vbif";
+		interrupts = <0 316 0>;
+		interrupt-names = "jpeg";
+		mmagic-vdd-supply = <&gdsc_mmagic_camss>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		vdd-supply = <&gdsc_jpeg>;
+		qcom,vdd-names = "mmagic-vdd", "camss-vdd", "vdd";
+		clock-names = "mmss_mmagic_ahb_clk",
+			      "core_clk", "iface_clk", "bus_clk0",
+			      "camss_top_ahb_clk", "camss_ahb_clk",
+			      "smmu_jpeg_axi_clk", "mmagic_camss_axi_clk";
+		clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			<&clock_mmss clk_camss_jpeg0_clk>,
+			<&clock_mmss clk_camss_jpeg_ahb_clk>,
+			<&clock_mmss clk_camss_jpeg_axi_clk>,
+			<&clock_mmss clk_camss_top_ahb_clk>,
+			<&clock_mmss clk_camss_ahb_clk>,
+			<&clock_mmss clk_smmu_jpeg_axi_clk>,
+			<&clock_mmss clk_mmagic_camss_axi_clk>;
+		qcom,clock-rates = <0 320000000 0 0 0 0 0 0>;
+		qcom,vbif-reg-settings = <0x4 0x1>;
+		qcom,prefetch-reg-settings = <0x30c 0x1111>,
+			<0x318 0x31>,
+			<0x324 0x31>,
+			<0x330 0x31>,
+			<0x33c 0x0>;
+		qcom,msm-bus,name = "msm_camera_jpeg0";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps = <62 512 0 0>,
+			<62 512 666675 666675>;
+		status = "ok";
+	};
+
+	qcom,jpeg@a24000 {
+		cell-index = <2>;
+		compatible = "qcom,jpeg";
+		reg = <0xa24000 0x4000>,
+			<0xa60000 0x3000>;
+		reg-names = "jpeg_hw", "jpeg_vbif";
+		interrupts = <0 318 0>;
+		interrupt-names = "jpeg";
+		mmagic-vdd-supply = <&gdsc_mmagic_camss>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		vdd-supply = <&gdsc_jpeg>;
+		qcom,vdd-names = "mmagic-vdd", "camss-vdd", "vdd";
+		clock-names =  "mmss_mmagic_ahb_clk",
+				"core_clk", "iface_clk", "bus_clk0",
+				"camss_top_ahb_clk", "camss_ahb_clk",
+				"smmu_jpeg_axi_clk", "mmagic_camss_axi_clk";
+		clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			<&clock_mmss clk_camss_jpeg2_clk>,
+			<&clock_mmss clk_camss_jpeg_ahb_clk>,
+			<&clock_mmss clk_camss_jpeg_axi_clk>,
+			<&clock_mmss clk_camss_top_ahb_clk>,
+			<&clock_mmss clk_camss_ahb_clk>,
+			<&clock_mmss clk_smmu_jpeg_axi_clk>,
+			<&clock_mmss clk_mmagic_camss_axi_clk>;
+		qcom,clock-rates = <0 266670000 0 0 0 0 0 0>;
+		qcom,vbif-reg-settings = <0x4 0x1>;
+		qcom,prefetch-reg-settings = <0x30c 0x1111>,
+			<0x318 0x0>,
+			<0x324 0x31>,
+			<0x330 0x31>,
+			<0x33c 0x31>;
+		qcom,msm-bus,name = "msm_camera_jpeg2";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps = <62 512 0 0>,
+			<62 512 666675 666675>;
+		status = "ok";
+	};
+
+	qcom,jpeg@aa0000 {
+		cell-index = <3>;
+		compatible = "qcom,jpeg_dma";
+		reg = <0xaa0000 0x4000>,
+			<0xa60000 0x3000>;
+		reg-names = "jpeg_hw", "jpeg_vbif";
+		interrupts = <0 304 0>;
+		interrupt-names = "jpeg";
+		mmagic-vdd-supply = <&gdsc_mmagic_camss>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		vdd-supply = <&gdsc_jpeg>;
+		qcom,vdd-names = "mmagic-vdd", "camss-vdd", "vdd";
+		clock-names =  "mmss_mmagic_ahb_clk",
+				"core_clk", "iface_clk", "bus_clk0",
+				"camss_top_ahb_clk", "camss_ahb_clk",
+				"smmu_jpeg_axi_clk", "mmagic_camss_axi_clk";
+		clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			<&clock_mmss clk_camss_jpeg_dma_clk>,
+			<&clock_mmss clk_camss_jpeg_ahb_clk>,
+			<&clock_mmss clk_camss_jpeg_axi_clk>,
+			<&clock_mmss clk_camss_top_ahb_clk>,
+			<&clock_mmss clk_camss_ahb_clk>,
+			<&clock_mmss clk_smmu_jpeg_axi_clk>,
+			<&clock_mmss clk_mmagic_camss_axi_clk>;
+		qcom,clock-rates = <0 266670000 0 0 0 0 0 0>;
+		qcom,vbif-reg-settings = <0x4 0x1>;
+		qcom,prefetch-reg-settings = <0x18c 0x11>,
+			<0x1a0 0x31>,
+			<0x1b0 0x31>;
+		qcom,msm-bus,name = "msm_camera_jpeg_dma";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps = <62 512 0 0>,
+			<62 512 666675 666675>;
+		status = "ok";
+	};
+
+	qcom,irqrouter@a00000 {
+		cell-index = <0>;
+		compatible = "qcom,irqrouter";
+		reg = <0xa00000 0x4000>;
+		reg-names = "irqrouter";
+	};
+
+	cpp: qcom,cpp@a04000 {
+		cell-index = <0>;
+		compatible = "qcom,cpp";
+		reg = <0xa04000 0x100>,
+			<0xa80000 0x3000>,
+			<0xa18000 0x3000>,
+			<0x8c36D4 0x4>;
+		reg-names = "cpp", "cpp_vbif", "cpp_hw", "camss_cpp";
+		interrupts = <0 294 0>;
+		interrupt-names = "cpp";
+		mmagic-vdd-supply = <&gdsc_mmagic_camss>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		vdd-supply = <&gdsc_cpp>;
+		qcom,vdd-names = "mmagic-vdd", "camss-vdd", "vdd";
+		clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			<&clock_mmss clk_mmagic_camss_axi_clk>,
+			<&clock_mmss clk_camss_top_ahb_clk>,
+			<&clock_mmss clk_cpp_clk_src>,
+			<&clock_mmss clk_camss_cpp_ahb_clk>,
+			<&clock_mmss clk_camss_cpp_axi_clk>,
+			<&clock_mmss clk_camss_cpp_clk>,
+			<&clock_mmss clk_camss_micro_ahb_clk>,
+			<&clock_mmss clk_camss_ahb_clk>,
+			<&clock_mmss clk_smmu_cpp_axi_clk>,
+			<&clock_mmss clk_camss_cpp_vbif_ahb_clk>;
+		clock-names = "mmss_mmagic_ahb_clk",
+			"mmagic_camss_axi_clk", "camss_top_ahb_clk",
+			"cpp_core_clk",	"camss_cpp_ahb_clk",
+			"camss_cpp_axi_clk", "camss_cpp_clk",
+			"micro_iface_clk", "camss_ahb_clk",
+			"smmu_cpp_axi_clk", "cpp_vbif_ahb_clk";
+
+		resets = <&clock_mmss CAMSS_MICRO_BCR>;
+		reset-names = "micro_iface_reset";
+
+		qcom,clock-rates = <0 0 0 480000000 0 0 480000000 0 0 0 0>;
+		qcom,min-clock-rate = <200000000>;
+		qcom,bus-master = <1>;
+		qcom,vbif-qos-setting = <0x20 0x10000000>,
+			<0x24 0x10000000>,
+			<0x28 0x10000000>,
+			<0x2C 0x10000000>;
+		status = "ok";
+		qcom,msm-bus,name = "msm_camera_cpp";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<106 512 0 0>,
+			<106 512 0 0>;
+		qcom,msm-bus-vector-dyn-vote;
+		qcom,src-clock-rates = <100000000 200000000 320000000
+			480000000 640000000>;
+		qcom,micro-reset;
+		qcom,cpp-fw-payload-info {
+			qcom,stripe-base = <553>;
+			qcom,plane-base = <481>;
+			qcom,stripe-size = <61>;
+			qcom,plane-size = <24>;
+			qcom,fe-ptr-off = <11>;
+			qcom,we-ptr-off = <23>;
+			qcom,ref-fe-ptr-off = <17>;
+			qcom,ref-we-ptr-off = <36>;
+			qcom,we-meta-ptr-off = <42>;
+			qcom,fe-mmu-pf-ptr-off = <6>;
+			qcom,ref-fe-mmu-pf-ptr-off = <9>;
+			qcom,we-mmu-pf-ptr-off = <12>;
+			qcom,dup-we-mmu-pf-ptr-off = <17>;
+			qcom,ref-we-mmu-pf-ptr-off = <22>;
+			qcom,set-group-buffer-len = <135>;
+			qcom,dup-frame-indicator-off = <70>;
+		};
+	};
+
+	qcom,fd@aa4000 {
+		cell-index = <0>;
+		compatible = "qcom,face-detection";
+		reg = <0xaa4000 0x800>,
+			<0xaa5000 0x400>,
+			<0xa80000 0x3000>;
+		reg-names = "fd_core", "fd_misc", "fd_vbif";
+		interrupts = <0 293 0>;
+		interrupt-names = "fd";
+		mmagic-vdd-supply = <&gdsc_mmagic_camss>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		vdd-supply = <&gdsc_fd>;
+		qcom,vdd-names = "mmagic-vdd", "camss-vdd", "vdd";
+		clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			<&clock_mmss clk_mmagic_camss_axi_clk>,
+			<&clock_mmss clk_camss_top_ahb_clk>,
+			<&clock_mmss clk_fd_core_clk_src>,
+			<&clock_mmss clk_fd_core_clk>,
+			<&clock_mmss clk_fd_core_uar_clk>,
+			<&clock_mmss clk_fd_ahb_clk>,
+			<&clock_mmss clk_smmu_cpp_axi_clk>,
+			<&clock_mmss clk_camss_ahb_clk>,
+			<&clock_mmss clk_camss_cpp_axi_clk>,
+			<&clock_mmss clk_camss_cpp_vbif_ahb_clk>,
+			<&clock_mmss clk_smmu_cpp_ahb_clk>;
+		clock-names = "mmss_mmagic_ahb_clk",
+			"mmagic_camss_axi_clk", "camss_top_ahb_clk",
+			"fd_core_clk_src", "fd_core_clk",
+			"fd_core_uar_clk", "fd_ahb_clk",
+			"smmu_cpp_axi_clk", "camss_ahb_clk",
+			"camss_cpp_axi_clk", "cpp_vbif_ahb_clk",
+			"smmu_cpp_ahb_clk";
+		qcom,clock-rates =
+			<0 0 0 400000000 400000000 0 0 0 0 0 0 0>,
+			<0 0 0 400000000 400000000 0 0 0 0 0 0 0>,
+			<0 0 0 200000000 200000000 0 0 0 0 0 0 0>,
+			<0 0 0 100000000 100000000 0 0 0 0 0 0 0>;
+		qcom,msm-bus,name = "msm_camera_fd";
+		qcom,msm-bus,num-cases = <4>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps = <106 512 0 0>,
+			<106 512 13000 13000>,
+			<106 512 13000 13000>,
+			<106 512 13000 13000>;
+		qcom,fd-vbif-reg-settings = <0x20 0x10000000 0x30000000>,
+			<0x24 0x10000000 0x30000000>,
+			<0x28 0x10000000 0x30000000>,
+			<0x2c 0x10000000 0x30000000>;
+		qcom,fd-misc-reg-settings = <0x20 0x2 0x3>,
+			<0x24 0x2 0x3>;
+		status = "ok";
+	};
+
+	cci: qcom,cci@a0c000 {
+		cell-index = <0>;
+		compatible = "qcom,cci";
+		reg = <0xa0c000 0x4000>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "cci";
+		interrupts = <0 295 0>;
+		interrupt-names = "cci";
+		status = "ok";
+		mmagic-supply = <&gdsc_mmagic_camss>;
+		gdscr-supply = <&gdsc_camss_top>;
+		qcom,cam-vreg-name = "mmagic", "gdscr";
+		clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			<&clock_mmss clk_camss_top_ahb_clk>,
+			<&clock_mmss clk_cci_clk_src>,
+			<&clock_mmss clk_camss_cci_ahb_clk>,
+			<&clock_mmss clk_camss_cci_clk>,
+			<&clock_mmss clk_camss_ahb_clk>;
+		clock-names = "mmagic_camss_ahb_clk", "camss_top_ahb_clk",
+                        "cci_src_clk", "cci_ahb_clk", "camss_cci_clk",
+			"camss_ahb_clk";
+		qcom,clock-rates = <0 0 19200000 0 0 0>,
+			<0 0 37500000 0 0 0>;
+		pinctrl-names = "cci_default", "cci_suspend";
+			pinctrl-0 = <&cci0_active &cci1_active>;
+			pinctrl-1 = <&cci0_suspend &cci1_suspend>;
+		gpios = <&tlmm 17 0>,
+			<&tlmm 18 0>,
+			<&tlmm 19 0>,
+			<&tlmm 20 0>;
+		qcom,gpio-tbl-num = <0 1 2 3>;
+		qcom,gpio-tbl-flags = <1 1 1 1>;
+		qcom,gpio-tbl-label = "CCI_I2C_DATA0",
+				      "CCI_I2C_CLK0",
+				      "CCI_I2C_DATA1",
+				      "CCI_I2C_CLK1";
+		i2c_freq_100Khz: qcom,i2c_standard_mode {
+			status = "disabled";
+		};
+		i2c_freq_400Khz: qcom,i2c_fast_mode {
+			status = "disabled";
+		};
+		i2c_freq_custom: qcom,i2c_custom_mode {
+			status = "disabled";
+		};
+		i2c_freq_1Mhz: qcom,i2c_fast_plus_mode {
+			status = "disabled";
+		};
+	};
+};
+
+&i2c_freq_100Khz {
+	qcom,hw-thigh = <201>;
+	qcom,hw-tlow = <174>;
+	qcom,hw-tsu-sto = <204>;
+	qcom,hw-tsu-sta = <231>;
+	qcom,hw-thd-dat = <22>;
+	qcom,hw-thd-sta = <162>;
+	qcom,hw-tbuf = <227>;
+	qcom,hw-scl-stretch-en = <0>;
+	qcom,hw-trdhld = <6>;
+	qcom,hw-tsp = <3>;
+	qcom,cci-clk-src = <37500000>;
+	status = "ok";
+};
+
+&i2c_freq_400Khz {
+	qcom,hw-thigh = <38>;
+	qcom,hw-tlow = <56>;
+	qcom,hw-tsu-sto = <40>;
+	qcom,hw-tsu-sta = <40>;
+	qcom,hw-thd-dat = <22>;
+	qcom,hw-thd-sta = <35>;
+	qcom,hw-tbuf = <62>;
+	qcom,hw-scl-stretch-en = <0>;
+	qcom,hw-trdhld = <6>;
+	qcom,hw-tsp = <3>;
+	qcom,cci-clk-src = <37500000>;
+	status = "ok";
+};
+
+&i2c_freq_custom {
+	qcom,hw-thigh = <38>;
+	qcom,hw-tlow = <56>;
+	qcom,hw-tsu-sto = <40>;
+	qcom,hw-tsu-sta = <40>;
+	qcom,hw-thd-dat = <22>;
+	qcom,hw-thd-sta = <35>;
+	qcom,hw-tbuf = <62>;
+	qcom,hw-scl-stretch-en = <1>;
+	qcom,hw-trdhld = <6>;
+	qcom,hw-tsp = <3>;
+	qcom,cci-clk-src = <37500000>;
+	status = "ok";
+};
+
+&i2c_freq_1Mhz {
+	qcom,hw-thigh = <16>;
+	qcom,hw-tlow = <22>;
+	qcom,hw-tsu-sto = <17>;
+	qcom,hw-tsu-sta = <18>;
+	qcom,hw-thd-dat = <16>;
+	qcom,hw-thd-sta = <15>;
+	qcom,hw-tbuf = <24>;
+	qcom,hw-scl-stretch-en = <0>;
+	qcom,hw-trdhld = <3>;
+	qcom,hw-tsp = <3>;
+	qcom,cci-clk-src = <37500000>;
+	status = "ok";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-cdp.dtsi b/arch/arm64/boot/dts/qcom/msm8996-cdp.dtsi
new file mode 100644
index 000000000000..6fafb8b38d06
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-cdp.dtsi
@@ -0,0 +1,852 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8996-pinctrl.dtsi"
+#include "msm8996-camera-sensor-cdp.dtsi"
+#include "msm8996-wsa881x.dtsi"
+
+/ {
+	bluetooth: bt_qca6174 {
+		compatible = "qca,qca6174";
+		qca,bt-reset-gpio = <&pm8994_gpios 19 0>; /* BT_EN */
+		qca,bt-vdd-core-supply = <&pm8994_s3>;
+		qca,bt-vdd-pa-supply = <&rome_vreg>;
+		qca,bt-vdd-io-supply = <&pm8994_s4>;
+		qca,bt-vdd-xtal-supply = <&pm8994_l30>;
+		qca,bt-vdd-core-voltage-level = <1300000 1800000>;
+		qca,bt-vdd-io-voltage-level = <1800000 1800000>;
+		qca,bt-vdd-xtal-voltage-level = <1800000 1800000>;
+	};
+};
+
+&spi_eth_vreg {
+	status = "ok";
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&sdcc1_ice {
+	status = "ok";
+};
+
+&ufsphy1 {
+	status = "ok";
+};
+
+&ufs1 {
+	status = "ok";
+};
+
+&sdhc_1 {
+	vdd-supply = <&pm8994_l20>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	vdd-io-supply = <&pm8994_s4>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <110 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 96000000 192000000 384000000>;
+	qcom,ice-clk-rates = <300000000 150000000>;
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8994_l21>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8994_l13>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x1>;
+
+	status = "ok";
+};
+
+/* CoreSight */
+&tpiu {
+	pinctrl-names = "seta-pctrl", "setb-pctrl";
+	pinctrl-0 = <&seta_1 &seta_2 &seta_3 &seta_4 &seta_5 &seta_6 &seta_7
+		     &seta_8 &seta_9 &seta_10 &seta_11 &seta_12 &seta_13
+		     &seta_14 &seta_15 &seta_16 &seta_17 &seta_18>;
+	pinctrl-1 = <&setb_1 &setb_2 &setb_3 &setb_4 &setb_5 &setb_6 &setb_7
+		     &setb_8 &setb_9 &setb_10 &setb_11 &setb_12 &setb_13
+		     &setb_14 &setb_15 &setb_16 &setb_17 &setb_18>;
+};
+
+&pmi8994_charger {
+	qcom,charging-disabled;
+	dpdm-supply = <&qusb_phy0>;
+};
+
+&pm8994_vadc {
+	chan@5 {
+		label = "vcoin";
+		reg = <5>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7 {
+		label = "vph_pwr";
+		reg = <7>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8994_adc_tm {
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x48>;
+		qcom,thermal-node;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x80>;
+		qcom,thermal-node;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x88>;
+		qcom,thermal-node;
+	};
+};
+
+&pmi8994_vadc {
+	chan@0 {
+		label = "usbin";
+		reg = <0>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <4>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@1 {
+		label = "dcin";
+		reg = <1>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <4>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@43 {
+		label = "usb_dp";
+		reg = <0x43>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@44 {
+		label = "usb_dm";
+		reg = <0x44>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+#include "msm8996-sde-display.dtsi"
+#include "msm8996-mdss-panels.dtsi"
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+};
+
+&mdss_hdmi_tx {
+	pinctrl-names = "hdmi_hpd_active", "hdmi_ddc_active", "hdmi_cec_active",
+				"hdmi_active", "hdmi_sleep";
+	pinctrl-0 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_suspend
+						&mdss_hdmi_cec_suspend>;
+	pinctrl-1 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+						&mdss_hdmi_cec_suspend>;
+	pinctrl-2 = <&mdss_hdmi_hpd_active &mdss_hdmi_cec_active
+						&mdss_hdmi_ddc_suspend>;
+	pinctrl-3 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+						&mdss_hdmi_cec_active>;
+	pinctrl-4 = <&mdss_hdmi_hpd_suspend &mdss_hdmi_ddc_suspend
+						&mdss_hdmi_cec_suspend>;
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_sharp_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+	qcom,platform-bklight-en-gpio = <&pm8994_gpios 14 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_sharp_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+	qcom,platform-bklight-en-gpio = <&pm8994_gpios 14 0>;
+};
+
+&ibb_regulator {
+	qcom,qpnp-ibb-discharge-resistor = <32>;
+};
+
+&labibb {
+	status = "ok";
+	qcom,qpnp-labibb-mode = "lcd";
+};
+
+&dsi_tosh_720_vid {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_vdd_no_labibb>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+	qcom,platform-bklight-en-gpio = <&pm8994_gpios 14 0>;
+	qcom,5v-boost-gpio = <&pmi8994_gpios 8 0>;
+};
+
+&dsi_dual_sharp_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+	qcom,platform-bklight-en-gpio = <&pm8994_gpios 14 0>;
+};
+
+&dsi_dual_nt35597_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+};
+
+&dsi_dual_nt35597_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled = "single_roi";
+	qcom,panel-roi-alignment = <720 128 720 64 720 64>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+};
+
+&dsi_nt35950_4k_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_4k_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_4k_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled = "single_roi";
+	/* panel supports slice height of 8/16/32/48/3840 */
+	qcom,panel-roi-alignment = <1080 8 1080 8 1080 8>;
+};
+
+&dsi_nt35597_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35597_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_sharp_1080_120hz_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_jdi_video {
+	pwms = <&pmi8994_pwm_4 0 0>;
+	pwm-names = "backlight";
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-pwm-pmi;
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,5v-boost-gpio = <&pmi8994_gpios 8 0>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_jdi_cmd {
+	pwms = <&pmi8994_pwm_4 0 0>;
+	pwm-names = "backlight";
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-pwm-pmi;
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,5v-boost-gpio = <&pmi8994_gpios 8 0>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled = "single_roi";
+	qcom,panel-roi-alignment = <4 2 4 2 20 20>;
+};
+
+&dsi_dual_jdi_4k_nofbc_video {
+	pwms = <&pmi8994_pwm_4 0 0>;
+	pwm-names = "backlight";
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-pwm-pmi;
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_1080_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_jdi_1080p_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_no_labibb>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+	qcom,platform-bklight-en-gpio = <&pm8994_gpios 14 0>;
+	qcom,5v-boost-gpio = <&pmi8994_gpios 8 0>;
+};
+
+&pm8994_gpios {
+	gpio@c700 { /* GPIO 8 - WLAN_EN */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@c800 { /* GPIO 9 - Rome 3.3V control */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <1>;		/* Output high */
+		qcom,vin-sel = <0>;		/* VPH_PWR */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,out-strength = <1>;	/* High drive strength */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@c100 { /* GPIO 2 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c300 { /* GPIO 4 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c400 { /* GPIO 5 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@cd00 { /* GPIO 14 - lcd_bklt_reg_en */
+		qcom,mode = <1>;		/* DIGITAL OUT */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <1>; 		/* output hight initially */
+		qcom,vin-sel = <2>;		/* 1.8 */
+		qcom,src-sel = <0>;		/* CONSTANT */
+		qcom,out-strength = <1>;	/* Low drive strength */
+		qcom,master-en = <1>;		/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@ce00 { /* GPIO 15 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@d100 { /* GPIO 18 - Rome sleep clock */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <0>;		/* Output low initially */
+		qcom,vin-sel = <2>;		/* VIN 2 */
+		qcom,src-sel = <3>;		/* Function 2 */
+		qcom,out-strength = <2>;	/* Medium */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@d200 { /* GPIO 19 - Rome BT Reset */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&soc {
+	i2c@75ba000 {
+		synaptics@20 {
+			compatible = "synaptics,dsx";
+			reg = <0x20>;
+			interrupt-parent = <&tlmm>;
+			interrupts = <125 0x2008>;
+			vdd-supply = <&pm8994_l14>;
+			avdd-supply = <&pm8994_l22>;
+			synaptics,vdd-voltage = <1800000 1800000>;
+			synaptics,avdd-voltage = <3300000 3300000>;
+			synaptics,vdd-current = <40000>;
+			synaptics,avdd-current = <20000>;
+			pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+			pinctrl-0 = <&ts_active>;
+			pinctrl-1 = <&ts_suspend>;
+			synaptics,display-coords = <0 0 1599 2559>;
+			synaptics,panel-coords = <0 0 1599 2703>;
+			synaptics,reset-gpio = <&tlmm 89 0x00>;
+			synaptics,irq-gpio = <&tlmm 125 0x2008>;
+			synaptics,disable-gpios;
+			synaptics,fw-name = "PR1702898-s3528t_00350002.img";
+		};
+	};
+
+	gen-vkeys {
+		compatible = "qcom,gen-vkeys";
+		label = "synaptics_dsx";
+		qcom,disp-maxx = <1599>;
+		qcom,disp-maxy = <2559>;
+		qcom,panel-maxx = <1599>;
+		qcom,panel-maxy = <2703>;
+		qcom,key-codes = <158 139 102 217>;
+	};
+
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8994_gpios 2 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_snapshot {
+			label = "cam_snapshot";
+			gpios = <&pm8994_gpios 4 0x1>;
+			linux,input-type = <1>;
+			linux,code = <766>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_focus {
+			label = "cam_focus";
+			gpios = <&pm8994_gpios 5 0x1>;
+			linux,input-type = <1>;
+			linux,code = <528>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+
+	sound-9335 {
+		qcom,model = "msm8996-tasha-cdp-snd-card";
+		qcom,hdmi-audio-rx;
+		asoc-codec = <&stub_codec>, <&hdmi_audio>;
+		asoc-codec-names = "msm-stub-codec.1", "msm-hdmi-audio-codec-rx";
+		qcom,us-euro-gpios = <&pm8994_mpps 2 0>;
+		qcom,wsa-max-devs = <2>;
+		qcom,wsa-devs = <&wsa881x_211>, <&wsa881x_212>,
+				<&wsa881x_213>, <&wsa881x_214>;
+		qcom,wsa-aux-dev-prefix = "SpkrLeft", "SpkrRight",
+					  "SpkrLeft", "SpkrRight";
+	};
+};
+
+&pm8994_mpps {
+	mpp@a100 { /* MPP 2 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	mpp@a300 { /* MPP 4 */
+		/* HDMI_5v_vreg regulator enable */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <1>;
+		status = "okay";
+	};
+
+	mpp@a400 { /* MPP 5 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&pmi8994_gpios {
+	gpio@c700 {	/* GPIO 8, lcd_reg_en, 5V boost  */
+		qcom,mode = <1>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		qcom,invert = <1>;   /* need invert = 0 */
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@c100 {	/* GPIO 2  SPKR_SD_N */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c200 {	/* GPIO 3 SPKR_SD_N */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+};
+
+&pmi8994_pwm_4 {
+	qcom,channel-owner = "lcd_bl";
+	qcom,dtest-line = <4>;
+	qcom,dtest-output = <1>;
+	status = "okay";
+};
+
+&pmi8994_mpps {
+	mpp@a000 { /* MPP 1 */
+		qcom,mode = <1>;                /* Digital output */
+		qcom,output-type = <0>;         /* CMOS logic */
+		qcom,vin-sel = <2>;             /* S4 1.8V */
+		qcom,src-sel = <7>;             /* DTEST4 */
+		qcom,master-en = <1>;           /* Enable MPP */
+		status = "okay";
+	};
+	mpp@a300 { /* MPP 4 */
+		/* WLED FET */
+		qcom,mode = <1>;        /* DIGITAL OUT */
+		qcom,vin-sel = <0>;     /* VIN0 */
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&pmi8994_haptics {
+	status = "okay";
+};
+
+&blsp1_uart2 {
+	status = "ok";
+};
+
+&usb3 {
+	extcon = <&pmi8994_charger>;
+};
+
+&usb2s {
+	status = "disabled";
+	dwc3@7600000 {
+		dr_mode = "host";
+	};
+};
+
+&i2c_7 {
+	silabs4705@11 { /* SiLabs FM chip, slave id 0x11*/
+		status = "ok";
+		compatible = "silabs,si4705";
+		reg = <0x11>;
+		vdd-supply = <&pm8994_s4>;
+		silabs,vdd-supply-voltage = <1800000 1800000>;
+		va-supply = <&rome_vreg>;
+		silabs,va-supply-voltage = <3300000 3300000>;
+		pinctrl-names = "pmx_fm_active","pmx_fm_suspend";
+		pinctrl-0 = <&fm_int_active &fm_status_int_active &fm_rst_active>;
+		pinctrl-1 = <&fm_int_suspend &fm_status_int_suspend &fm_rst_suspend>;
+		silabs,reset-gpio = <&tlmm 39 0>;
+		silabs,int-gpio = <&tlmm 38 0>;
+		silabs,status-gpio = <&tlmm 78 0>;
+		#address-cells = <0>;
+		interrupts = <0 1>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-map = <
+			  0 &tlmm 38 2
+			  1 &tlmm 78 1
+		>;
+		interrupt-names = "silabs_fm_int", "silabs_fm_status_int";
+	};
+};
+
+&spi_0 {
+	ethernet@2 {
+		compatible = "micrel,ks8851";
+		reg = <2>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <11 0>;
+		spi-max-frequency = <960000>;
+		vdd-supply = <&spi_eth_vreg>;
+		reset-gpios = <&tlmm 79 0>;
+	};
+};
+
+&wil6210 {
+	status = "ok";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-coresight-v2.dtsi b/arch/arm64/boot/dts/qcom/msm8996-coresight-v2.dtsi
new file mode 100644
index 000000000000..379ce1b0ce6a
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-coresight-v2.dtsi
@@ -0,0 +1,1127 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+&soc {
+	tmc_etr: tmc@3028000 {
+		compatible = "arm,coresight-tmc";
+		reg = <0x3028000 0x1000>,
+		      <0x3084000 0x15000>;
+		reg-names = "tmc-base", "bam-base";
+		interrupts = <GIC_SPI 270 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "byte-cntr-irq";
+
+		qcom,memory-size = <0x400000>;
+		qcom,tmc-flush-powerdown;
+		qcom,sg-enable;
+		qcom,force-reg-dump;
+
+		coresight-id = <0>;
+		coresight-name = "coresight-tmc-etr";
+		coresight-nr-inports = <1>;
+		coresight-ctis = <&cti0 &cti8>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	tpiu: tpiu@3020000 {
+		compatible = "arm,coresight-tpiu";
+		reg = <0x3020000 0x1000>;
+		reg-names = "tpiu-base";
+
+		coresight-id = <1>;
+		coresight-name = "coresight-tpiu";
+		coresight-nr-inports = <1>;
+
+		vdd-supply = <&pm8994_l21>;
+		qcom,vdd-voltage-level = <2950000 2950000>;
+		qcom,vdd-current-level = <200 800000>;
+
+		vdd-io-supply = <&pm8994_l13>;
+		qcom,vdd-io-voltage-level = <2950000 2950000>;
+		qcom,vdd-io-current-level = <200 22000>;
+
+		qcom,nidntsw;
+		qcom,nidnt-swduart;
+		qcom,nidnt-swdtrc;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	replicator: replicator@3026000 {
+		compatible = "qcom,coresight-replicator";
+		reg = <0x3026000 0x1000>;
+		reg-names = "replicator-base";
+
+		coresight-id = <2>;
+		coresight-name = "coresight-replicator";
+		coresight-nr-inports = <1>;
+		coresight-outports = <0 1>;
+		coresight-child-list = <&tmc_etr &tpiu>;
+		coresight-child-ports = <0 0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	tmc_etf: tmc@3027000 {
+		compatible = "arm,coresight-tmc";
+		reg = <0x3027000 0x1000>;
+		reg-names = "tmc-base";
+
+		coresight-id = <3>;
+		coresight-name = "coresight-tmc-etf";
+		coresight-nr-inports = <1>;
+		coresight-outports = <0>;
+		coresight-child-list = <&replicator>;
+		coresight-child-ports = <0>;
+		coresight-default-sink;
+		coresight-ctis = <&cti0 &cti8>;
+
+		qcom,tmc-flush-powerdown;
+		qcom,force-reg-dump;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	funnel_merg: funnel@3025000 {
+		compatible = "arm,coresight-funnel";
+		reg = <0x3025000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-id = <4>;
+		coresight-name = "coresight-funnel-merg";
+		coresight-nr-inports = <2>;
+		coresight-outports = <0>;
+		coresight-child-list = <&tmc_etf>;
+		coresight-child-ports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	funnel_in0: funnel@3021000 {
+		compatible = "arm,coresight-funnel";
+		reg = <0x3021000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-id = <5>;
+		coresight-name = "coresight-funnel-in0";
+		coresight-nr-inports = <8>;
+		coresight-outports = <0>;
+		coresight-child-list = <&funnel_merg>;
+		coresight-child-ports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	funnel_in1: funnel@3022000 {
+		compatible = "arm,coresight-funnel";
+		reg = <0x3022000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-id = <6>;
+		coresight-name = "coresight-funnel-in1";
+		coresight-nr-inports = <8>;
+		coresight-outports = <0>;
+		coresight-child-list = <&funnel_merg>;
+		coresight-child-ports = <1>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	funnel_in2: funnel@3023000 {
+		compatible = "arm,coresight-funnel";
+		reg = <0x3023000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-id = <7>;
+		coresight-name = "coresight-funnel-in2";
+		coresight-nr-inports = <8>;
+		coresight-outports = <0>;
+		coresight-child-list = <&funnel_merg>;
+		coresight-child-ports = <2>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	funnel_apss_merge: funnel@3bc0000 {
+		compatible = "arm,coresight-funnel";
+		reg = <0x3bc0000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-id = <8>;
+		coresight-name = "coresight-funnel-apss-merge";
+		coresight-nr-inports = <4>;
+		coresight-outports = <0>;
+		coresight-child-list = <&funnel_in1>;
+		coresight-child-ports = <6>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	funnel_apss0: funnel@39b0000 {
+		compatible = "arm,coresight-funnel";
+		reg = <0x39b0000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-id = <9>;
+		coresight-name = "coresight-funnel-apss0";
+		coresight-nr-inports = <2>;
+		coresight-outports = <0>;
+		coresight-child-list = <&funnel_apss_merge>;
+		coresight-child-ports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	funnel_apss1: funnel@3bb0000 {
+		compatible = "arm,coresight-funnel";
+		reg = <0x3bb0000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-id = <10>;
+		coresight-name = "coresight-funnel-apss1";
+		coresight-nr-inports = <2>;
+		coresight-outports = <0>;
+		coresight-child-list = <&funnel_apss_merge>;
+		coresight-child-ports = <1>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	funnel_mmss: funnel@3184000 {
+		compatible = "arm,coresight-funnel";
+		reg = <0x3184000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-id = <11>;
+		coresight-name = "coresight-funnel-mmss";
+		coresight-nr-inports = <8>;
+		coresight-outports = <0>;
+		coresight-child-list = <&funnel_in0>;
+		coresight-child-ports = <1>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	tpda: tpda@3003000 {
+		compatible = "qcom,coresight-tpda";
+		reg = <0x3003000 0x1000>;
+		reg-names = "tpda-base";
+
+		coresight-id = <13>;
+		coresight-name = "coresight-tpda";
+		coresight-nr-inports = <32>;
+		coresight-outports = <0>;
+		coresight-child-list = <&funnel_in0>;
+		coresight-child-ports = <3>;
+
+		qcom,tpda-atid = <65>;
+		qcom,bc-elem-size = <3 32>,
+				    <6 32>;
+		qcom,tc-elem-size = <3 32>,
+				    <6 32>;
+		qcom,dsb-elem-size = <3 32>,
+				     <6 32>,
+				     <7 32>;
+		qcom,cmb-elem-size = <0 32>,
+				     <1 32>,
+				     <2 32>,
+				     <6 64>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	tpda_apss: tpda@39E0000 {
+		compatible = "qcom,coresight-tpda";
+		reg = <0x39E0000 0x1000>;
+		reg-names = "tpda-base";
+
+		coresight-id = <14>;
+		coresight-name = "coresight-tpda-apss";
+		coresight-nr-inports = <32>;
+		coresight-outports = <0>;
+		coresight-child-list = <&funnel_apss_merge>;
+		coresight-child-ports = <2>;
+
+		qcom,tpda-atid = <66>;
+		qcom,bc-elem-size = <0 32>,
+				    <1 32>;
+		qcom,tc-elem-size = <0 32>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	tpdm_vsense: tpdm@3038000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x3038000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-id = <15>;
+		coresight-name = "coresight-tpdm-vsense";
+		coresight-nr-inports = <0>;
+		coresight-outports = <0>;
+		coresight-child-list = <&tpda>;
+		coresight-child-ports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	tpdm_dcc: tpdm@3054000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x3054000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-id = <16>;
+		coresight-name = "coresight-tpdm-dcc";
+		coresight-nr-inports = <0>;
+		coresight-outports = <0>;
+		coresight-child-list = <&tpda>;
+		coresight-child-ports = <1>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	tpdm_prng: tpdm@304c000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x304c000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-id = <17>;
+		coresight-name = "coresight-tpdm-prng";
+		coresight-nr-inports = <0>;
+		coresight-outports = <0>;
+		coresight-child-list = <&tpda>;
+		coresight-child-ports = <2>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	tpdm_dsat: tpdm@3185000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x3185000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-id = <18>;
+		coresight-name = "coresight-tpdm-dsat";
+		coresight-nr-inports = <0>;
+		coresight-outports = <0>;
+		coresight-child-list = <&tpda>;
+		coresight-child-ports = <3>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	tpdm_pimem: tpdm@3050000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x3050000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-id = <19>;
+		coresight-name = "coresight-tpdm-pimem";
+		coresight-nr-inports = <0>;
+		coresight-outports = <0>;
+		coresight-child-list = <&tpda>;
+		coresight-child-ports = <6>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	tpdm_hwevents: tpdm@3004000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x3004000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-id = <20>;
+		coresight-name = "coresight-tpdm-hwevents";
+		coresight-nr-inports = <0>;
+		coresight-outports = <0>;
+		coresight-child-list = <&tpda>;
+		coresight-child-ports = <7>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	tpdm_m4m: tpdm@38e0000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x38e0000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-id = <21>;
+		coresight-name = "coresight-tpdm-m4m";
+		coresight-nr-inports = <0>;
+		coresight-outports = <0>;
+		coresight-child-list = <&tpda_apss>;
+		coresight-child-ports = <0>;
+
+		qcom,clk-enable;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	tpdm_l3pmu: tpdm@3aec000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x3aec000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-id = <22>;
+		coresight-name = "coresight-tpdm-l3pmu";
+		coresight-nr-inports = <0>;
+		coresight-outports = <0>;
+		coresight-child-list = <&tpda_apss>;
+		coresight-child-ports = <1>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	stm: stm@3002000 {
+		compatible = "arm,coresight-stm";
+		reg = <0x3002000 0x1000>,
+		      <0x8280000 0x180000>;
+		reg-names = "stm-base", "stm-data-base";
+
+		coresight-id = <23>;
+		coresight-name = "coresight-stm";
+		coresight-nr-inports = <0>;
+		coresight-outports = <0>;
+		coresight-child-list = <&funnel_in0>;
+		coresight-child-ports = <7>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	etm0: etm@3840000 {
+		compatible = "arm,coresight-etmv4";
+		reg = <0x3840000 0x1000>;
+		reg-names = "etm-base";
+
+		coresight-id = <24>;
+		coresight-name = "coresight-etm0";
+		coresight-nr-inports = <0>;
+		coresight-outports = <0>;
+		coresight-child-list = <&funnel_apss0>;
+		coresight-child-ports = <0>;
+		coresight-etm-cpu = <&CPU0>;
+
+		qcom,noovrflw-enable;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	etm1: etm@3940000 {
+		compatible = "arm,coresight-etmv4";
+		reg = <0x3940000 0x1000>;
+		reg-names = "etm-base";
+
+		coresight-id = <25>;
+		coresight-name = "coresight-etm1";
+		coresight-nr-inports = <0>;
+		coresight-outports = <0>;
+		coresight-child-list = <&funnel_apss0>;
+		coresight-child-ports = <1>;
+		coresight-etm-cpu = <&CPU1>;
+
+		qcom,noovrflw-enable;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	etm2: etm@3a40000 {
+		compatible = "arm,coresight-etmv4";
+		reg = <0x3a40000 0x1000>;
+		reg-names = "etm-base";
+
+		coresight-id = <26>;
+		coresight-name = "coresight-etm2";
+		coresight-nr-inports = <0>;
+		coresight-outports = <0>;
+		coresight-child-list = <&funnel_apss1>;
+		coresight-child-ports = <0>;
+		coresight-etm-cpu = <&CPU2>;
+
+		qcom,noovrflw-enable;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	etm3: etm@3b40000 {
+		compatible = "arm,coresight-etmv4";
+		reg = <0x3b40000 0x1000>;
+		reg-names = "etm-base";
+
+		coresight-id = <27>;
+		coresight-name = "coresight-etm3";
+		coresight-nr-inports = <0>;
+		coresight-outports = <0>;
+		coresight-child-list = <&funnel_apss1>;
+		coresight-child-ports = <1>;
+		coresight-etm-cpu = <&CPU3>;
+
+		qcom,noovrflw-enable;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	audio_etm0 {
+		compatible = "qcom,coresight-remote-etm";
+
+		coresight-id = <28>;
+		coresight-name = "coresight-audio-etm0";
+		coresight-nr-inports = <0>;
+		coresight-outports = <0>;
+		coresight-child-list = <&funnel_in0>;
+		coresight-child-ports = <2>;
+
+		qcom,inst-id = <5>;
+	};
+
+	rpm_etm0 {
+		compatible = "qcom,coresight-remote-etm";
+
+		coresight-id = <29>;
+		coresight-name = "coresight-rpm-etm0";
+		coresight-nr-inports = <0>;
+		coresight-outports = <0>;
+		coresight-child-list = <&funnel_in0>;
+		coresight-child-ports = <0>;
+
+		qcom,inst-id = <4>;
+	};
+
+	modem_etm0 {
+		compatible = "qcom,coresight-remote-etm";
+
+		coresight-id = <30>;
+		coresight-name = "coresight-modem-etm0";
+		coresight-nr-inports = <0>;
+		coresight-outports = <0>;
+		coresight-child-list = <&funnel_in2>;
+		coresight-child-ports = <0>;
+
+		qcom,inst-id = <2>;
+	};
+
+	csr: csr@3001000 {
+		compatible = "qcom,coresight-csr";
+		reg = <0x3001000 0x1000>;
+		reg-names = "csr-base";
+
+		coresight-id = <31>;
+		coresight-name = "coresight-csr";
+		coresight-nr-inports = <0>;
+
+		qcom,blk-size = <1>;
+	};
+
+	cti0: cti@3010000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3010000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <32>;
+		coresight-name = "coresight-cti0";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti1: cti@3011000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3011000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <33>;
+		coresight-name = "coresight-cti1";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti2: cti@3012000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3012000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <34>;
+		coresight-name = "coresight-cti2";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti3: cti@3013000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3013000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <35>;
+		coresight-name = "coresight-cti3";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti4: cti@3014000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3014000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <36>;
+		coresight-name = "coresight-cti4";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti5: cti@3015000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3015000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <37>;
+		coresight-name = "coresight-cti5";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti6: cti@3016000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3016000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <38>;
+		coresight-name = "coresight-cti6";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,cti-gpio-trigout = <2>;
+		pinctrl-names = "cti-trigout-pctrl";
+		pinctrl-0 = <&trigout_a>;
+	};
+
+	cti7: cti@3017000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3017000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <39>;
+		coresight-name = "coresight-cti7";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti8: cti@3018000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3018000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <40>;
+		coresight-name = "coresight-cti8";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti9: cti@3019000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3019000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <41>;
+		coresight-name = "coresight-cti9";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti10: cti@301a000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x301a000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <42>;
+		coresight-name = "coresight-cti10";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti11: cti@301b000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x301b000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <43>;
+		coresight-name = "coresight-cti11";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti12: cti@301c000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x301c000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <44>;
+		coresight-name = "coresight-cti12";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti13: cti@301d000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x301d000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <45>;
+		coresight-name = "coresight-cti13";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti14: cti@301e000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x301e000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <46>;
+		coresight-name = "coresight-cti14";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu0: cti@3820000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3820000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <47>;
+		coresight-name = "coresight-cti-cpu0";
+		coresight-nr-inports = <0>;
+		coresight-cti-cpu = <&CPU0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu1: cti@3920000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3920000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <48>;
+		coresight-name = "coresight-cti-cpu1";
+		coresight-nr-inports = <0>;
+		coresight-cti-cpu = <&CPU1>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu2: cti@3a20000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3a20000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <49>;
+		coresight-name = "coresight-cti-cpu2";
+		coresight-nr-inports = <0>;
+		coresight-cti-cpu = <&CPU2>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu3: cti@3b20000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3b20000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <50>;
+		coresight-name = "coresight-cti-cpu3";
+		coresight-nr-inports = <0>;
+		coresight-cti-cpu = <&CPU3>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_pmu_cpu0: cti@38a0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x38a0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <51>;
+		coresight-name = "coresight-cti-pmu-cpu0";
+		coresight-nr-inports = <0>;
+		coresight-cti-cpu = <&CPU0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_pmu_cpu1: cti@39a0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x39a0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <52>;
+		coresight-name = "coresight-cti-pmu-cpu1";
+		coresight-nr-inports = <0>;
+		coresight-cti-cpu = <&CPU1>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_pmu_cpu2: cti@3aa0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3aa0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <53>;
+		coresight-name = "coresight-cti-pmu-cpu2";
+		coresight-nr-inports = <0>;
+		coresight-cti-cpu = <&CPU2>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_pmu_cpu3: cti@3ba0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3ba0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <54>;
+		coresight-name = "coresight-cti-pmu-cpu3";
+		coresight-nr-inports = <0>;
+		coresight-cti-cpu = <&CPU3>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_l2pmu_cluster0: cti@38b0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x38b0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <55>;
+		coresight-name = "coresight-cti-l2pmu-cluster0";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_l2pmu_cluster1: cti@3ab0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3ab0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <56>;
+		coresight-name = "coresight-cti-l2pmu-cluster1";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_l3: cti@3ad0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3ad0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <57>;
+		coresight-name = "coresight-cti-l3";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_lm_cluster0: cti@39c0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x39c0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <58>;
+		coresight-name = "coresight-cti-lm-cluster0";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_lm_cluster1: cti@39d0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x39d0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <59>;
+		coresight-name = "coresight-cti-lm-cluster1";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_m4m: cti@38d0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x38d0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <60>;
+		coresight-name = "coresight-cti-m4m";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_tpda_apss: cti@39f0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x39f0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <61>;
+		coresight-name = "coresight-cti-tpda-apss";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_venus_cpu0: cti@3180000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3180000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <64>;
+		coresight-name = "coresight-cti-venus-cpu0";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_audio_cpu0: cti@3044000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3044000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <65>;
+		coresight-name = "coresight-cti-audio-cpu0";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_rpm_cpu0: cti@3048000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3048000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <66>;
+		coresight-name = "coresight-cti-rpm-cpu0";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_modem_cpu0: cti@3040000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3040000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-id = <67>;
+		coresight-name = "coresight-cti-modem-cpu0";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	hwevent: hwevent@98200c0 {
+		compatible = "qcom,coresight-hwevent";
+		reg = <0x98200c0 0x100>,
+		      <0x828018 0x80>,
+		      <0x8b5260 0x80>,
+		      <0x90137c 0x4>,
+		      <0x7ab160 0x80>,
+		      <0x358000 0x40>,
+		      <0x359000 0x40>,
+		      <0x600058 0x80>,
+		      <0x608058 0x80>,
+		      <0x610058 0x80>,
+		      <0x7ab360 0x80>,
+		      <0x7ab760 0x80>,
+		      <0x7abf60 0x80>;
+		reg-names = "hmss-mux", "mmss-mux", "dsa-stm", "mdss-mdp",
+			    "phss-hwev", "gcc-eve1", "gcc-eve2", "pcie0-hwev",
+			    "pcie1-hwev", "pcie2-hwev", "tcsr-mux", "mss-mux0",
+			    "mss-mux1";
+
+		coresight-id = <70>;
+		coresight-name = "coresight-hwevent";
+		coresight-nr-inports = <0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>,
+			 <&clock_mmss clk_mmss_misc_ahb_clk>;
+		clock-names = "core_clk", "core_a_clk", "core_mmss_clk";
+
+		qcom,hwevent-clks = "core_mmss_clk";
+	};
+
+	fuse: fuse@7602c {
+		compatible = "arm,coresight-fuse-v3";
+		reg = <0x7602c 0xc>,
+		      <0x76014 0x4>;
+		reg-names = "fuse-base", "qpdi-fuse-base";
+
+		coresight-id = <71>;
+		coresight-name = "coresight-fuse";
+		coresight-nr-inports = <0>;
+	};
+
+	qpdi: qpdi@7a1000 {
+		compatible = "qcom,coresight-qpdi";
+		reg = <0x7a1000 0x4>;
+		reg-names = "qpdi-base";
+
+		coresight-id = <72>;
+		coresight-name = "coresight-qpdi";
+		coresight-nr-inports = <0>;
+
+		vdd-supply = <&pm8994_l21>;
+		qcom,vdd-voltage-level = <2950000 2950000>;
+		qcom,vdd-current-level = <200 800000>;
+
+		vdd-io-supply = <&pm8994_l13>;
+		qcom,vdd-io-voltage-level = <2950000 2950000>;
+		qcom,vdd-io-current-level = <200 22000>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-coresight-v3.dtsi b/arch/arm64/boot/dts/qcom/msm8996-coresight-v3.dtsi
new file mode 100644
index 000000000000..b5f6232badfe
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-coresight-v3.dtsi
@@ -0,0 +1,1385 @@
+/* Copyright (c) 2015,2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	tmc_etr: tmc@3028000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b961>;
+
+		reg = <0x3028000 0x1000>,
+		      <0x3084000 0x15000>;
+		reg-names = "tmc-base", "bam-base";
+
+		interrupts = <0 270 0>;
+		interrupt-names = "byte-cntr-irq";
+
+		arm,buffer-size = <0x400000>;
+		arm,sg-enable;
+
+		coresight-ctis = <&cti0 &cti8>;
+
+		coresight-name = "coresight-tmc-etr";
+		coresight-nr-inports = <1>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			tmc_etr_in_replicator: endpoint {
+				slave-mode;
+				remote-endpoint = <&replicator_out_tmc_etr>;
+			};
+		};
+	};
+
+	tpiu: tpiu@3020000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b912>;
+
+		reg = <0x3020000 0x1000>;
+		reg-names = "tpiu-base";
+
+		coresight-name = "coresight-tpiu";
+
+		vdd-supply = <&pm8994_l21>;
+		qcom,vdd-voltage-level = <2950000 2950000>;
+		qcom,vdd-current-level = <200 800000>;
+
+		vdd-io-supply = <&pm8994_l13>;
+		qcom,vdd-io-voltage-level = <2950000 2950000>;
+		qcom,vdd-io-current-level = <200 22000>;
+
+		qcom,nidntsw;
+		qcom,nidnt-swduart;
+		qcom,nidnt-swdtrc;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			tpiu_in_replicator: endpoint {
+				slave-mode;
+				remote-endpoint = <&replicator_out_tpiu>;
+			};
+		};
+	};
+
+	replicator: replicator@3026000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b909>;
+
+		reg = <0x3026000 0x1000>;
+		reg-names = "replicator-base";
+
+		coresight-name = "coresight-replicator";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports{
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				replicator_out_tmc_etr:endpoint {
+					remote-endpoint =
+						<&tmc_etr_in_replicator>;
+				};
+			};
+			port@1 {
+				reg = <1>;
+				replicator_out_tpiu:endpoint {
+					remote-endpoint =
+						<&tpiu_in_replicator>;
+				};
+			};
+			port@2 {
+				reg = <0>;
+				replicator_in_tmc_etf:endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tmc_etf_out_replicator>;
+				};
+			};
+		};
+	};
+
+	tmc_etf: tmc@3027000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b961>;
+
+		reg = <0x3027000 0x1000>;
+		reg-names = "tmc-base";
+
+		coresight-ctis = <&cti0 &cti8>;
+
+		coresight-name = "coresight-tmc-etf";
+
+		arm,default-sink;
+
+		qcom,tmc-flush-powerdown;
+		qcom,force-reg-dump;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports{
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				tmc_etf_out_replicator:endpoint {
+					remote-endpoint =
+						<&replicator_in_tmc_etf>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				tmc_etf_in_funnel_merg:endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&funnel_merg_out_tmc_etf>;
+				};
+			};
+		};
+	};
+
+	funnel_merg: funnel@3025000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x3025000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-merg";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_merg_out_tmc_etf:endpoint {
+					remote-endpoint =
+						<&tmc_etf_in_funnel_merg>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				funnel_merg_in_funnel_in0:endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&funnel_in0_out_funnel_merg>;
+				};
+			};
+			port@2 {
+				reg = <1>;
+				funnel_merg_in_funnel_in1:endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&funnel_in1_out_funnel_merg>;
+				};
+			};
+			port@3 {
+				reg = <2>;
+				funnel_merg_in_funnel_in2:endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&funnel_in2_out_funnel_merg>;
+				};
+			};
+		};
+	};
+
+	funnel_in0: funnel@3021000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x3021000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-in0";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_in0_out_funnel_merg: endpoint {
+					remote-endpoint =
+						<&funnel_merg_in_funnel_in0>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				funnel_in0_in_rpm_etm0: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&rpm_etm0_out_funnel_in0>;
+				};
+			};
+			port@2 {
+				reg = <1>;
+				funnel_in0_in_funnel_mmss: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&funnel_mmss_out_funnel_in0>;
+				};
+			};
+			port@3 {
+				reg = <2>;
+				funnel_in0_in_audio_etm0: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&audio_etm0_out_funnel_in0>;
+				};
+			};
+			port@4 {
+				reg = <3>;
+				funnel_in0_in_tpda: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpda_out_funnel_in0>;
+				};
+			};
+			port@5 {
+				reg = <7>;
+				funnel_in0_in_stm: endpoint {
+					slave-mode;
+					remote-endpoint = <&stm_out_funnel_in0>;
+				};
+			};
+		};
+	};
+
+	funnel_in1: funnel@3022000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x3022000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-in1";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_in1_out_funnel_merg: endpoint {
+					remote-endpoint =
+						<&funnel_merg_in_funnel_in1>;
+				};
+			};
+			port@1 {
+				reg = <6>;
+				funnel_in1_in_funnel_apss_merg: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&funnel_apss_merg_out_funnel_in1>;
+				};
+			};
+		};
+	};
+
+	funnel_in2: funnel@3023000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x3023000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-in2";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_in2_out_funnel_merg: endpoint {
+					remote-endpoint =
+						<&funnel_merg_in_funnel_in2>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				funnel_in2_in_modem_etm0: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&modem_etm0_out_funnel_in2>;
+				};
+			};
+		};
+
+	};
+
+	funnel_apss_merge: funnel@3bc0000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x3bc0000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-apss-merge";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_apss_merg_out_funnel_in1: endpoint {
+					remote-endpoint =
+					    <&funnel_in1_in_funnel_apss_merg>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				funnel_apss_merg_in_funnel_apss0: endpoint {
+					slave-mode;
+					remote-endpoint =
+					  <&funnel_apss0_out_funnel_apss_merg>;
+				};
+			};
+			port@2 {
+				reg = <1>;
+				funnel_apss_merg_in_funnel_apss1: endpoint {
+					slave-mode;
+					remote-endpoint =
+					  <&funnel_apss1_out_funnel_apss_merg>;
+				};
+			};
+			port@3 {
+				reg = <2>;
+				funnel_apss_merg_in_tpda_apss: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&tpda_apss_out_funnel_apss_merg>;
+				};
+			};
+		};
+	};
+
+	funnel_apss0: funnel@39b0000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x39b0000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-apss0";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_apss0_out_funnel_apss_merg: endpoint {
+					remote-endpoint =
+					    <&funnel_apss_merg_in_funnel_apss0>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				funnel_apss0_in_etm0: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm0_out_funnel_apss0>;
+				};
+			};
+			port@2 {
+				reg = <1>;
+				funnel_apss0_in_etm1: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm1_out_funnel_apss0>;
+				};
+			};
+		};
+	};
+
+	funnel_apss1: funnel@3bb0000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x3bb0000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-apss1";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_apss1_out_funnel_apss_merg: endpoint {
+					remote-endpoint =
+					    <&funnel_apss_merg_in_funnel_apss1>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				funnel_apss1_in_etm2: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm2_out_funnel_apss1>;
+				};
+			};
+			port@2 {
+				reg = <1>;
+				funnel_apss1_in_etm3: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm3_out_funnel_apss1>;
+				};
+			};
+		};
+	};
+
+	funnel_mmss: funnel@3184000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x3184000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-mmss";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			funnel_mmss_out_funnel_in0: endpoint {
+				remote-endpoint = <&funnel_in0_in_funnel_mmss>;
+			};
+		};
+	};
+
+	tpda: tpda@3003000 {
+		compatible = "qcom,coresight-tpda";
+		reg = <0x3003000 0x1000>;
+		reg-names = "tpda-base";
+
+		coresight-name = "coresight-tpda";
+
+		qcom,tpda-atid = <65>;
+		qcom,bc-elem-size = <3 32>,
+				    <6 32>;
+		qcom,tc-elem-size = <3 32>,
+				    <6 32>;
+		qcom,dsb-elem-size = <3 32>,
+				     <6 32>,
+				     <7 32>;
+		qcom,cmb-elem-size = <0 32>,
+				     <1 32>,
+				     <2 32>,
+				     <6 64>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			port@0 {
+				reg = <0>;
+				tpda_out_funnel_in0: endpoint {
+					remote-endpoint =
+						<&funnel_in0_in_tpda>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				tpda_in_tpdm_vsense: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_vsense_out_tpda>;
+				};
+			};
+			port@2 {
+				reg = <1>;
+				tpda_in_tpdm_dcc: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_dcc_out_tpda>;
+				};
+			};
+			port@3 {
+				reg = <2>;
+				tpda_in_tpdm_prng: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_prng_out_tpda>;
+				};
+			};
+			port@4 {
+				reg = <3>;
+				tpda_in_tpdm_dsat: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_dsat_out_tpda>;
+				};
+			};
+			port@5 {
+				reg = <6>;
+				tpda_in_tpdm_pimem: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_pimem_out_tpda>;
+				};
+			};
+			port@6 {
+				reg = <7>;
+				tpda_in_tpdm_hwevents: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_hwevents_out_tpda>;
+				};
+			};
+		};
+	};
+
+	tpda_apss: tpda@39e0000 {
+		compatible = "qcom,coresight-tpda";
+		reg = <0x39e0000 0x1000>;
+		reg-names = "tpda-base";
+
+		coresight-name = "coresight-tpda-apss";
+
+		qcom,tpda-atid = <66>;
+		qcom,bc-elem-size = <0 32>,
+				    <1 32>;
+		qcom,tc-elem-size = <0 32>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			port@0 {
+				reg = <0>;
+				tpda_apss_out_funnel_apss_merg: endpoint {
+					remote-endpoint =
+					       <&funnel_apss_merg_in_tpda_apss>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				tpda_apss_in_tpdm_m4m: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_m4m_out_tpda_apss>;
+				};
+			};
+		};
+	};
+
+	tpdm_vsense: tpdm@3038000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x3038000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-vsense";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_vsense_out_tpda: endpoint {
+				remote-endpoint = <&tpda_in_tpdm_vsense>;
+			};
+		};
+	};
+
+	tpdm_dcc: tpdm@3054000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x3054000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-dcc";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_dcc_out_tpda: endpoint {
+				remote-endpoint = <&tpda_in_tpdm_dcc>;
+			};
+		};
+	};
+
+	tpdm_prng: tpdm@304c000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x304c000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-prng";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_prng_out_tpda: endpoint {
+				remote-endpoint = <&tpda_in_tpdm_prng>;
+			};
+		};
+	};
+
+	tpdm_dsat: tpdm@3185000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x3185000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-dsat";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_dsat_out_tpda: endpoint {
+				remote-endpoint = <&tpda_in_tpdm_dsat>;
+			};
+		};
+	};
+
+	tpdm_pimem: tpdm@3050000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x3050000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-pimem";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_pimem_out_tpda: endpoint {
+				remote-endpoint = <&tpda_in_tpdm_pimem>;
+			};
+		};
+	};
+
+	tpdm_hwevents: tpdm@3004000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x3004000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-hwevents";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_hwevents_out_tpda: endpoint {
+				remote-endpoint = <&tpda_in_tpdm_hwevents>;
+			};
+		};
+	};
+
+	tpdm_m4m: tpdm@38e0000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x38e0000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-m4m";
+
+		qcom,clk-enable;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_m4m_out_tpda_apss: endpoint {
+				remote-endpoint = <&tpda_apss_in_tpdm_m4m>;
+			};
+		};
+	};
+
+	stm: stm@3002000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b962>;
+
+		reg = <0x3002000 0x1000>,
+		      <0x8280000 0x180000>;
+		reg-names = "stm-base", "stm-data-base";
+
+		coresight-name = "coresight-stm";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			stm_out_funnel_in0: endpoint {
+				remote-endpoint = <&funnel_in0_in_stm>;
+			};
+		};
+	};
+
+	etm0: etm@3840000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x3840000 0x1000>;
+		cpu = <&CPU0>;
+
+		coresight-name = "coresight-etm0";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm0_out_funnel_apss0: endpoint {
+				remote-endpoint = <&funnel_apss0_in_etm0>;
+			};
+		};
+	};
+
+	etm1: etm@3940000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x3940000 0x1000>;
+		cpu = <&CPU1>;
+
+		coresight-name = "coresight-etm1";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm1_out_funnel_apss0: endpoint {
+				remote-endpoint = <&funnel_apss0_in_etm1>;
+			};
+		};
+	};
+
+	etm2: etm@3a40000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x3a40000 0x1000>;
+		cpu = <&CPU2>;
+
+		coresight-name = "coresight-etm2";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm2_out_funnel_apss1: endpoint {
+				remote-endpoint = <&funnel_apss1_in_etm2>;
+			};
+		};
+	};
+
+	etm3: etm@3b40000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x3b40000 0x1000>;
+		cpu = <&CPU3>;
+
+		coresight-name = "coresight-etm3";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm3_out_funnel_apss1: endpoint {
+				remote-endpoint = <&funnel_apss1_in_etm3>;
+			};
+		};
+	};
+
+	audio_etm0 {
+		compatible = "qcom,coresight-remote-etm";
+
+		coresight-name = "coresight-audio-etm0";
+
+		qcom,inst-id = <5>;
+
+		port{
+			audio_etm0_out_funnel_in0: endpoint {
+				remote-endpoint = <&funnel_in0_in_audio_etm0>;
+			};
+		};
+
+	};
+
+	rpm_etm0 {
+		compatible = "qcom,coresight-remote-etm";
+
+		coresight-name = "coresight-rpm-etm0";
+
+		qcom,inst-id = <4>;
+
+		port{
+			rpm_etm0_out_funnel_in0: endpoint {
+				remote-endpoint = <&funnel_in0_in_rpm_etm0>;
+			};
+		};
+	};
+
+	modem_etm0 {
+		compatible = "qcom,coresight-remote-etm";
+
+		coresight-name = "coresight-modem-etm0";
+
+		qcom,inst-id = <2>;
+
+		port{
+			modem_etm0_out_funnel_in2: endpoint {
+				remote-endpoint = <&funnel_in2_in_modem_etm0>;
+			};
+		};
+	};
+
+	csr: csr@3001000 {
+		compatible = "qcom,coresight-csr";
+		reg = <0x3001000 0x1000>;
+		reg-names = "csr-base";
+
+		coresight-name = "coresight-csr";
+
+		qcom,blk-size = <1>;
+	};
+
+	cti0: cti@3010000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3010000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti0";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti1: cti@3011000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3011000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti1";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti2: cti@3012000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3012000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti2";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti3: cti@3013000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3013000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti3";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti4: cti@3014000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3014000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti4";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti5: cti@3015000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3015000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti5";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti6: cti@3016000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3016000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti6";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,cti-gpio-trigout = <2>;
+		pinctrl-names = "cti-trigout-pctrl";
+		pinctrl-0 = <&trigout_a>;
+	};
+
+	cti7: cti@3017000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3017000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti7";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti8: cti@3018000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3018000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti8";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti9: cti@3019000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3019000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti9";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti10: cti@301a000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x301a000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti10";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti11: cti@301b000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x301b000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti11";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti12: cti@301c000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x301c000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti12";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti13: cti@301d000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x301d000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti13";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti14: cti@301e000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x301e000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti14";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu0: cti@3820000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3820000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu0";
+		cpu = <&CPU0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu1: cti@3920000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3920000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu1";
+		cpu = <&CPU1>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu2: cti@3a20000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3a20000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu2";
+		cpu = <&CPU2>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu3: cti@3b20000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3b20000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu3";
+		cpu = <&CPU3>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_pmu_cpu0: cti@38a0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x38a0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-pmu-cpu0";
+		cpu = <&CPU0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_pmu_cpu1: cti@39a0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x39a0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-pmu-cpu1";
+		cpu = <&CPU1>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_pmu_cpu2: cti@3aa0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3aa0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-pmu-cpu2";
+		cpu = <&CPU2>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_pmu_cpu3: cti@3ba0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3ba0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-pmu-cpu3";
+		cpu = <&CPU3>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_l2pmu_cluster0: cti@38b0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x38b0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-l2pmu-cluster0";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_l2pmu_cluster1: cti@3ab0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3ab0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-l2pmu-cluster1";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_l3: cti@3ad0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3ad0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-l3";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_lm_cluster0: cti@39c0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x39c0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-lm-cluster0";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_lm_cluster1: cti@39d0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x39d0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-lm-cluster1";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_m4m: cti@38d0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x38d0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-m4m";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_tpda_apss: cti@39f0000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x39f0000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-tpda-apss";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_venus_cpu0: cti@3180000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3180000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-venus-cpu0";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_audio_cpu0: cti@3044000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3044000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-audio-cpu0";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_rpm_cpu0: cti@3048000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3048000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-rpm-cpu0";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_modem_cpu0: cti@3040000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x3040000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-modem-cpu0";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	hwevent: hwevent@98200c0 {
+		compatible = "qcom,coresight-hwevent";
+		reg = <0x98200c0 0x100>,
+		      <0x828018 0x80>,
+		      <0x8b5260 0x80>,
+		      <0x90137c 0x4>,
+		      <0x7ab160 0x80>,
+		      <0x358000 0x40>,
+		      <0x359000 0x40>,
+		      <0x600058 0x80>,
+		      <0x608058 0x80>,
+		      <0x610058 0x80>,
+		      <0x7ab360 0x80>,
+		      <0x7ab760 0x80>,
+		      <0x7abf60 0x80>;
+		reg-names = "hmss-mux", "mmss-mux", "dsa-stm", "mdss-mdp",
+			    "phss-hwev", "gcc-eve1", "gcc-eve2", "pcie0-hwev",
+			    "pcie1-hwev", "pcie2-hwev", "tcsr-mux", "mss-mux0",
+			    "mss-mux1";
+
+		coresight-name = "coresight-hwevent";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>,
+			 <&clock_mmss clk_mmss_misc_ahb_clk>;
+		clock-names = "core_clk", "core_a_clk", "core_mmss_clk";
+
+		qcom,hwevent-clks = "core_mmss_clk";
+	};
+
+	fuse: fuse@7602c {
+		compatible = "arm,coresight-fuse-v3";
+		reg = <0x7602c 0xc>,
+		      <0x76014 0x4>;
+		reg-names = "fuse-base", "qpdi-fuse-base";
+
+		coresight-name = "coresight-fuse";
+	};
+
+	qpdi: qpdi@7a1000 {
+		compatible = "qcom,coresight-qpdi";
+		reg = <0x7a1000 0x4>;
+		reg-names = "qpdi-base";
+
+		coresight-name = "coresight-qpdi";
+
+		vdd-supply = <&pm8994_l21>;
+		qcom,vdd-voltage-level = <2950000 2950000>;
+		qcom,vdd-current-level = <200 800000>;
+
+		vdd-io-supply = <&pm8994_l13>;
+		qcom,vdd-io-voltage-level = <2950000 2950000>;
+		qcom,vdd-io-current-level = <200 22000>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-dtp.dtsi b/arch/arm64/boot/dts/qcom/msm8996-dtp.dtsi
new file mode 100644
index 000000000000..c2667b49fedb
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-dtp.dtsi
@@ -0,0 +1,683 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8996-pinctrl.dtsi"
+#include "msm8996-sde-display.dtsi"
+#include "msm8996-camera-sensor-dtp.dtsi"
+#include "msm8996-wsa881x.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM8996 DTP";
+	compatible = "qcom,msm8996-dtp", "qcom,msm8996", "qcom,qrd";
+
+	bluetooth: bt_qca6174 {
+		compatible = "qca,qca6174";
+		qca,bt-reset-gpio = <&pm8994_gpios 19 0>; /* BT_EN */
+		qca,bt-vdd-core-supply = <&pm8994_s3>;
+		qca,bt-vdd-pa-supply = <&rome_vreg>;
+		qca,bt-vdd-io-supply = <&pm8994_s4>;
+		qca,bt-vdd-xtal-supply = <&pm8994_l30>;
+		qca,bt-chip-pwd-voltage-level = <1300000 1300000>;
+		qca,bt-vdd-io-voltage-level = <1800000 1800000>;
+		qca,bt-vdd-xtal-voltage-level = <1800000 1800000>;
+	};
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&blsp1_uart2 {
+	status = "ok";
+};
+
+&i2c_6 {
+	status = "disabled";
+};
+
+&i2c_7 {
+	smb1351-charger@1d {
+		compatible = "qcom,smb1351-charger";
+		reg = <0x1d>;
+		qcom,parallel-charger;
+		qcom,float-voltage-mv = <4450>;
+		qcom,recharge-mv = <100>;
+	};
+};
+
+/ {
+	qrd_batterydata: qcom,battery-data {
+		qcom,batt-id-range-pct = <15>;
+		#include "batterydata-qrd-skum-4v4-2920mah.dtsi"
+	};
+};
+
+&pmi8994_charger {
+	qcom,battery-data = <&qrd_batterydata>;
+};
+
+&pmi8994_fg {
+	qcom,battery-data = <&qrd_batterydata>;
+	qcom,ext-sense-type;
+	qcom,hold-soc-while-full;
+};
+
+&pmi8994_gpios {
+	gpio@c700 {	/* GPIO 8, lcd_reg_en, 5V boost  */
+		qcom,mode = <1>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		qcom,invert = <1>;   /* need invert = 0 */
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@c100 {	/* GPIO 2  SPKR_SD_N */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c400 { /* GPIO 5 - USB3 OTG SWITCH EN */
+		qcom,mode = <1>;	/* Digital output */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,master-en = <1>;	/* Enable GPIO */
+		qcom,invert = <0>;	/* Output low initially */
+		status = "okay";
+	};
+
+};
+
+&pmi8994_mpps {
+	mpp@a000 { /* MPP 1 */
+		qcom,mode = <1>;                /* Digital output */
+		qcom,output-type = <0>;         /* CMOS logic */
+		qcom,vin-sel = <2>;             /* S4 1.8V */
+		qcom,src-sel = <7>;             /* DTEST4 */
+		qcom,master-en = <1>;           /* Enable MPP */
+		status = "okay";
+	};
+
+	mpp@a300 { /* MPP 4 */
+		/* WLED FET */
+		qcom,mode = <1>;        /* DIGITAL OUT */
+		qcom,vin-sel = <0>;     /* VIN0 */
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&pm8994_gpios {
+	gpio@c700 { /* GPIO 8 - WLAN_EN */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@c800 { /* GPIO 9 - Rome 3.3V control */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* MOS logic */
+		qcom,invert = <1>;		/* Output high */
+		qcom,vin-sel = <0>;		/* VPH_PWR */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,out-strength = <1>;	/* High drive strength */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@cd00 { /* GPIO 14 - lcd_bklt_reg_en */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <1>;	/* output hight initially */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,out-strength = <1>;	/* Low drive strength */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c100 { /* GPIO 2 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c300 { /* GPIO 4 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c400 { /* GPIO 5 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@ce00 { /* GPIO 15 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@d100 { /* GPIO 18 - Rome Sleep Clock */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <0>;		/* Output low initially */
+		qcom,vin-sel = <2>;		/* VIN 2 */
+		qcom,src-sel = <3>;		/* Function 2 */
+		qcom,out-strength = <2>;	/* Medium */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@d200 { /* GPIO 19 - Rome BT Reset */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&pm8994_mpps {
+	mpp@a100 { /* MPP 2 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	mpp@a300 { /* MPP 4 */
+		/* HDMI_5v_vreg regulator enable */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <0>;
+		status = "okay";
+	};
+};
+
+&pmi8994_vadc {
+	chan@0 {
+		label = "usbin";
+		reg = <0>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <4>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@1 {
+		label = "dcin";
+		reg = <1>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <4>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@43 {
+		label = "usb_dp";
+		reg = <0x43>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@44 {
+		label = "usb_dm";
+		reg = <0x44>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8994_vadc {
+	chan@5 {
+		label = "vcoin";
+		reg = <5>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7 {
+		label = "vph_pwr";
+		reg = <7>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8994_adc_tm {
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x48>;
+		qcom,thermal-node;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x80>;
+		qcom,thermal-node;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x88>;
+		qcom,thermal-node;
+	};
+};
+
+&labibb {
+	status = "ok";
+	qcom,qpnp-labibb-mode = "lcd";
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_fb2 {
+	status = "disabled";
+};
+
+&mdss_hdmi_tx {
+	status = "disabled";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_r69007_wqxga_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_r69007_wqxga_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&sdcc1_ice {
+	status = "ok";
+};
+
+&ufsphy1 {
+	status = "ok";
+};
+
+&ufs1 {
+	status = "ok";
+};
+
+&sdhc_1 {
+	vdd-supply = <&pm8994_l20>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	vdd-io-supply = <&pm8994_s4>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <110 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 96000000 192000000
+			384000000>;
+	qcom,ice-clk-rates = <300000000>;
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&dsi_r69007_wqxga_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,dcs-cmd-by-left;
+};
+
+&sdhc_2 {
+	status = "disabled";
+};
+
+&pm8994_gpios {
+	gpio@c100 { /* GPIO 2 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+};
+
+&soc {
+	i2c@75ba000 {
+		synaptics@20 {
+			compatible = "synaptics,dsx";
+			reg = <0x20>;
+			interrupt-parent = <&tlmm>;
+			interrupts = <125 0x2008>;
+			vdd-supply = <&pm8994_l14>;
+			avdd-supply = <&pm8994_l22>;
+			pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+			pinctrl-0 = <&ts_active>;
+			pinctrl-1 = <&ts_suspend>;
+			synaptics,display-coords = <0 0 1439 2559>;
+			synaptics,panel-coords = <0 0 1439 2559>;
+			synaptics,reset-gpio = <&tlmm 89 0x00>;
+			synaptics,irq-gpio = <&tlmm 125 0x2008>;
+			synaptics,disable-gpios;
+			synaptics,button-map = <139 158 102>;
+			synaptics,resume-in-workqueue;
+		};
+	};
+
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8994_gpios 2 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+
+	sound {
+		status="disabled";
+	};
+
+	sound-9335 {
+		qcom,model = "msm8996-dtp-tasha-snd-card";
+
+		qcom,audio-routing =
+			"AIF4 VI", "MCLK",
+			"RX_BIAS", "MCLK",
+			"AMIC2", "MIC BIAS2",
+			"MIC BIAS2", "Headset Mic",
+			"DMIC0", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic0",
+			"DMIC2", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic2",
+			"DMIC3", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic3",
+			"SpkrLeft IN", "SPK1 OUT";
+
+		qcom,msm-mbhc-hphl-swh = <1>;
+		qcom,msm-mbhc-gnd-swh = <0>;
+
+		asoc-codec = <&stub_codec>;
+		asoc-codec-names = "msm-stub-codec.1";
+		qcom,wsa-max-devs = <1>;
+		qcom,wsa-devs = <&wsa881x_211>, <&wsa881x_213>;
+		qcom,wsa-aux-dev-prefix = "SpkrLeft", "SpkrLeft";
+	};
+};
+
+&qusb_phy0 {
+	qcom,qusb-phy-init-seq = <0xF8 0x80
+				0x53 0x84
+				0x83 0x88
+				0xC5 0x8C
+				0x30 0x08
+				0x79 0x0C
+				0x21 0x10
+				0x14 0x9C
+				0x80 0x04
+				0x9F 0x1C
+				0x00 0x18>;
+};
+
+&pmi8994_haptics {
+	status = "okay";
+	qcom,vmax-mv = <3000>;
+	qcom,actuator-type = "erm";
+};
+
+&red_led {
+	/delete-property/ linux,default-trigger;
+	qcom,start-idx = <1>;
+	qcom,idx-len = <10>;
+	qcom,duty-pcts = [00 19 32 4B 64
+			64 4B 32 19 00];
+	qcom,lut-flags = <3>;
+	qcom,pause-lo = <0>;
+	qcom,pause-hi = <0>;
+	qcom,ramp-step-ms = <255>;
+	qcom,use-blink;
+};
+
+&green_led {
+	/delete-property/ linux,default-trigger;
+	qcom,start-idx = <1>;
+	qcom,idx-len = <10>;
+	qcom,duty-pcts = [00 19 32 4B 64
+			64 4B 32 19 00];
+	qcom,lut-flags = <3>;
+	qcom,pause-lo = <0>;
+	qcom,pause-hi = <0>;
+	qcom,ramp-step-ms = <255>;
+	qcom,use-blink;
+};
+
+&blue_led {
+	/delete-property/ linux,default-trigger;
+	qcom,start-idx = <1>;
+	qcom,idx-len = <10>;
+	qcom,duty-pcts = [00 19 32 4B 64
+			64 4B 32 19 00];
+	qcom,lut-flags = <3>;
+	qcom,pause-lo = <0>;
+	qcom,pause-hi = <0>;
+	qcom,ramp-step-ms = <255>;
+	qcom,use-blink;
+};
+
+&pmi8994_wled {
+	qcom,led-strings-list = [00 01];
+};
+
+&pm8994_l27{
+	regulator-min-microvolt = <1200000>;
+	regulator-max-microvolt = <1200000>;
+	qcom,init-voltage = <1200000>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-fluid.dtsi b/arch/arm64/boot/dts/qcom/msm8996-fluid.dtsi
new file mode 100644
index 000000000000..86bc8099c4d6
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-fluid.dtsi
@@ -0,0 +1,664 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+#include "msm8996-pinctrl.dtsi"
+#include "msm8996-camera-sensor-mtp.dtsi"
+#include "msm8996-wsa881x.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 FLUID";
+	compatible = "qcom,msm8996-fluid", "qcom,msm8996", "qcom,fluid";
+	qcom,board-id = <3 0>;
+
+	bluetooth: bt_qca6174 {
+		compatible = "qca,qca6174";
+		qca,bt-reset-gpio = <&pm8994_gpios 19 0>; /* BT_EN */
+		qca,bt-vdd-core-supply = <&pm8994_s3>;
+		qca,bt-vdd-pa-supply = <&rome_vreg>;
+		qca,bt-vdd-io-supply = <&pm8994_s4>;
+		qca,bt-vdd-xtal-supply = <&pm8994_l30>;
+		qca,bt-vdd-core-voltage-level = <1300000 1800000>;
+		qca,bt-vdd-io-voltage-level = <1800000 1800000>;
+		qca,bt-vdd-xtal-voltage-level = <1800000 1800000>;
+	};
+};
+
+&i2c_7 {
+	smb1351-charger@1d {
+		compatible = "qcom,smb1351-charger";
+		reg = <0x1d>;
+		qcom,parallel-charger;
+		qcom,float-voltage-mv = <4400>;
+		qcom,recharge-mv = <100>;
+	};
+
+	ina231@40 {
+		compatible = "ina231";
+		reg = <0x40>;
+		shunt-resistor = <5000>;
+	};
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&ufsphy1 {
+	status = "ok";
+};
+
+&ufs1 {
+	status = "ok";
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+
+&sdhc_1 {
+	vdd-supply = <&pm8994_l20>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	vdd-io-supply = <&pm8994_s4>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <110 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 96000000 192000000 384000000>;
+	qcom,ice-clk-rates = <300000000 150000000>;
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8994_l21>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8994_l13>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x1>;
+
+	status = "ok";
+};
+
+&pm8994_vadc {
+	chan@5 {
+		label = "vcoin";
+		reg = <5>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7 {
+		label = "vph_pwr";
+		reg = <7>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8994_adc_tm {
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x48>;
+		qcom,thermal-node;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x80>;
+		qcom,thermal-node;
+	};
+};
+
+&mdss_hdmi_tx {
+	pinctrl-names = "hdmi_hpd_active", "hdmi_ddc_active", "hdmi_cec_active",
+		"hdmi_active", "hdmi_sleep";
+	pinctrl-0 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_suspend
+		&mdss_hdmi_cec_suspend>;
+	pinctrl-1 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+		&mdss_hdmi_cec_suspend>;
+	pinctrl-2 = <&mdss_hdmi_hpd_active &mdss_hdmi_cec_active
+		&mdss_hdmi_ddc_suspend>;
+	pinctrl-3 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+		&mdss_hdmi_cec_active>;
+	pinctrl-4 = <&mdss_hdmi_hpd_suspend &mdss_hdmi_ddc_suspend
+		&mdss_hdmi_cec_suspend>;
+};
+
+&pmi8994_charger {
+	qcom,dc-psy-type = "Wipower";
+	qcom,dcin-vadc = <&pmi8994_vadc>;
+	qcom,wipower-default-ilim-map = <4000000 20000000 550 700 300>;
+	qcom,wipower-pt-ilim-map = <4000000 7140000 550 700 300>,
+					<7140000 8140000 550 700 300>,
+					<8140000 9140000 500 700 300>,
+					<9140000 9950000 500 700 300>;
+	qcom,wipower-div2-ilim-map = <4000000 4820000 550 700 300>,
+					<4820000 5820000 550 700 300>,
+					<5820000 6820000 550 650 650>,
+					<6820000 7820000 550 700 600>,
+					<7820000 8500000 550 700 550>;
+};
+
+&pmi8994_vadc {
+	chan@0 {
+		label = "usbin";
+		reg = <0>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <4>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@1 {
+		label = "dcin";
+		reg = <1>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <4>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@43 {
+		label = "usb_dp";
+		reg = <0x43>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@44 {
+		label = "usb_dm";
+		reg = <0x44>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+/{
+	mtp_batterydata: qcom,battery-data {
+		qcom,batt-id-range-pct = <15>;
+		#include "batterydata-itech-3000mah.dtsi"
+	};
+};
+
+&pmi8994_fg {
+	qcom,battery-data = <&mtp_batterydata>;
+	qcom,ext-sense-type;
+	qcom,fg-vbatt-low-threshold = <3700>;
+};
+
+&usb_otg_switch {
+	status = "okay";
+};
+
+&pm8994_mpps {
+	mpp@a300 { /* MPP 4 */
+		/* HDMI_5v_vreg regulator enable */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <0>;
+		status = "okay";
+	};
+};
+
+&pmi8994_gpios {
+	gpio@c100 {	/* GPIO 2  SPKR_SD_N */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c200 {	/* GPIO 3 SPKR_SD_N */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c400 { /* GPIO 5 - USB3 OTG SWITCH EN */
+		qcom,mode = <1>;	/* Digital output */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,master-en = <1>;	/* Enable GPIO */
+		qcom,invert = <0>;	/* Output low initially */
+		status = "okay";
+	};
+};
+
+&soc {
+	i2c@75ba000 {
+		synaptics@20 {
+			compatible = "synaptics,dsx";
+			reg = <0x20>;
+			interrupt-parent = <&tlmm>;
+			interrupts = <125 0x2008>;
+			vdd-supply = <&pm8994_l14>;
+			avdd-supply = <&pm8994_l22>;
+			pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+			pinctrl-0 = <&ts_active>;
+			pinctrl-1 = <&ts_suspend>;
+			synaptics,display-coords = <0 0 1599 2559>;
+			synaptics,panel-coords = <0 0 1599 2703>;
+			synaptics,reset-gpio = <&tlmm 89 0x00>;
+			synaptics,irq-gpio = <&tlmm 125 0x2008>;
+			synaptics,disable-gpios;
+		};
+	};
+
+	gen-vkeys {
+		compatible = "qcom,gen-vkeys";
+		label = "synaptics_dsx";
+		qcom,disp-maxx = <1599>;
+		qcom,disp-maxy = <2559>;
+		qcom,panel-maxx = <1599>;
+		qcom,panel-maxy = <2703>;
+		qcom,key-codes = <158 139 102 217>;
+	};
+
+
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+
+		home {
+			label = "home";
+			gpios = <&pm8994_gpios 1 0x1>;
+			linux,input-type = <1>;
+			linux,code = <102>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8994_gpios 2 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_snapshot {
+			label = "cam_snapshot";
+			gpios = <&pm8994_gpios 4 0x1>;
+			linux,input-type = <1>;
+			linux,code = <766>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_focus {
+			label = "cam_focus";
+			gpios = <&pm8994_gpios 5 0x1>;
+			linux,input-type = <1>;
+			linux,code = <528>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+
+	sound-9335 {
+		qcom,model = "msm8996-tasha-fluid-snd-card";
+		qcom,hdmi-audio-rx;
+		asoc-codec = <&stub_codec>, <&hdmi_audio>;
+		asoc-codec-names = "msm-stub-codec.1",
+				"msm-hdmi-audio-codec-rx";
+		qcom,wsa-max-devs = <1>;
+		qcom,wsa-devs = <&wsa881x_211>, <&wsa881x_213>;
+		qcom,wsa-aux-dev-prefix = "SpkrLeft", "SpkrLeft";
+	};
+
+};
+
+&pm8994_gpios {
+	gpio@c700 { /* GPIO 8 - WLAN_EN */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@c800 { /* GPIO 9 - Rome 3.3V control */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* MOS logic */
+		qcom,invert = <1>;		/* Output high */
+		qcom,vin-sel = <0>;		/* VPH_PWR */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,out-strength = <1>;	/* High drive strength */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@cd00 { /* GPIO 14 - lcd_bklt_reg_en */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,output-type = <0>;	/* CMOS logic */
+		qcom,invert = <1>;	/* output hight initially */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,out-strength = <1>;	/* Low drive strength */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c000 { /* GPIO 1 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c100 { /* GPIO 2 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c300 { /* GPIO 4 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c400 { /* GPIO 5 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@ce00 { /* GPIO 15 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@d100 { /* GPIO 18 - Rome Sleep Clock */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <0>;		/* Output low initially */
+		qcom,vin-sel = <2>;		/* VIN 2 */
+		qcom,src-sel = <3>;		/* Function 2 */
+		qcom,out-strength = <2>;	/* Medium */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@d200 { /* GPIO 19 - Rome BT Reset */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&pmi8994_haptics {
+	status = "okay";
+};
+
+&flash_led {
+	qcom,follow-otst2-rb-disabled;
+};
+
+&blsp1_uart2 {
+	status = "ok";
+};
+
+#include "msm8996-sde-display.dtsi"
+#include "msm8996-mdss-panels.dtsi"
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_sharp_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,dsi-panel-bias-vreg;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_sharp_video>;
+};
+
+&dsi_dual_sharp_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_4k_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_4k_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled = "single_roi";
+	/* panel supports slice height of 8/16/32/48/3840 */
+	qcom,panel-roi-alignment = <1080 8 1080 8 1080 8>;
+};
+
+&labibb {
+	status = "ok";
+	qcom,qpnp-labibb-mode = "lcd";
+};
+
+&pmi8994_mpps {
+	mpp@a000 { /* MPP 1 */
+		qcom,mode = <1>;                /* Digital output */
+		qcom,output-type = <0>;         /* CMOS logic */
+		qcom,vin-sel = <0>;             /* S4 1.8V */
+		qcom,src-sel = <7>;             /* DTEST4 */
+		qcom,master-en = <1>;           /* Enable MPP */
+		status = "okay";
+	};
+
+	mpp@a300 { /* MPP 4 */
+		/* WLED FET */
+		qcom,mode = <1>;        /* DIGITAL OUT */
+		qcom,vin-sel = <0>;     /* VIN0 */
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&wil6210 {
+	status = "ok";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-gpu.dtsi b/arch/arm64/boot/dts/qcom/msm8996-gpu.dtsi
new file mode 100644
index 000000000000..27f692bb14af
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-gpu.dtsi
@@ -0,0 +1,262 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+
+	pil_gpu: qcom,kgsl-hyp {
+		compatible = "qcom,pil-tz-generic";
+		qcom,pas-id = <13>;
+		qcom,firmware-name = "a530_zap";
+		memory-region = <&peripheral_mem>;
+	};
+
+	msm_bus: qcom,kgsl-busmon{
+		label = "kgsl-busmon";
+		compatible = "qcom,kgsl-busmon";
+	};
+
+	gpubw: qcom,gpubw {
+		compatible = "qcom,devbw";
+		governor = "bw_vbif";
+		qcom,src-dst-ports = <26 512>;
+		/*
+		 * active-only flag is used while registering the bus
+		 * governor.It helps release the bus vote when the CPU
+		 * subsystem is inactiv3
+		 */
+		qcom,active-only;
+		qcom,bw-tbl =
+			<     0 /*  off     */ >,
+			<   762 /*  100 MHz */ >,
+			<  1144 /*  150 MHz */ >,
+			<  1525 /*  200 MHz */ >,
+			<  2288 /*  300 MHz */ >,
+			<  3143 /*  412 MHz */ >,
+			<  4173 /*  547 MHz */ >,
+			<  5195 /*  681 MHz */ >,
+			<  5859 /*  768 MHz */ >,
+			<  7759 /*  1017 MHz */ >,
+			<  9887 /*  1296 MHz */ >,
+			<  11863 /*  1555 MHz */ >,
+			<  13763 /*  1804 MHz */ >;
+	};
+
+	msm_gpu: qcom,kgsl-3d0@b00000 {
+		label = "kgsl-3d0";
+		compatible = "qcom,kgsl-3d0", "qcom,kgsl-3d";
+		status = "ok";
+		reg = <0xb00000 0x3f000
+		       0x070000 0x04720>;
+		reg-names = "kgsl_3d0_reg_memory", "qfprom_memory";
+		interrupts = <0 300 0>;
+		interrupt-names = "kgsl_3d0_irq";
+		qcom,id = <0>;
+
+		qcom,chipid = <0x05030000>;
+		qcom,base-leakage-coefficient = <34>;
+		qcom,lm-limit = <6000>;
+
+		qcom,initial-pwrlevel = <2>;
+
+		qcom,idle-timeout = <80>; //msecs
+		/*
+		 * Timeout to enter deeper power saving state
+		 * from NAP.
+		 */
+		qcom,deep-nap-timeout = <20>; //msecs
+		qcom,strtstp-sleepwake;
+
+		qcom,highest-bank-bit = <15>;
+
+		qcom,snapshot-size = <1048576>; //bytes
+
+		qcom,gpu-qdss-stm = <0x081c0000 0x40000>; // base addr, size
+
+		/* Trace bus */
+		coresight-id = <300>;
+		coresight-name = "coresight-gfx";
+		coresight-nr-inports = <0>;
+		coresight-outports = <0>;
+		coresight-child-list = <&funnel_in0>;
+		coresight-child-ports = <4>;
+
+		/* DRM settings */
+		qcom,gpmu-tsens = <0x00060007>;
+		qcom,lm-max-power = <5448>;
+		qcom,gpmu-firmware = "a530v3_gpmu.fw2";
+		qcom,gpmu-version = <1 0>;
+		qcom,zap-shader = "a530_zap";
+
+		clocks = <&clock_gpu clk_gpu_gx_gfx3d_clk>,
+			<&clock_gpu clk_gpu_ahb_clk>,
+			<&clock_gpu clk_gpu_gx_rbbmtimer_clk>,
+			<&clock_gcc clk_gcc_bimc_gfx_clk>,
+			<&clock_gcc clk_gcc_mmss_bimc_gfx_clk>,
+			<&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			<&clock_gpu clk_gpu_mx_clk>;
+
+		clock-names = "core_clk", "iface_clk", "rbbmtimer_clk",
+			"mem_clk", "mem_iface_clk", "alt_mem_iface_clk",
+			"mx_clk";
+
+		/* Bus Scale Settings */
+		qcom,gpubw-dev = <&gpubw>;
+		qcom,bus-control;
+		qcom,msm-bus,name = "grp3d";
+		qcom,msm-bus,num-cases = <13>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<26 512 0 0>,
+
+				<26 512 0 800000>,      // 1 bus=100
+				<26 512 0 1200000>,     // 2 bus=150
+				<26 512 0 1600000>,     // 3 bus=200
+				<26 512 0 2400000>,     // 4 bus=300
+				<26 512 0 3296000>,     // 5 bus=412
+				<26 512 0 4376000>,     // 6 bus=547
+				<26 512 0 5448000>,     // 7 bus=681
+				<26 512 0 6144000>,     // 8 bus=768
+				<26 512 0 8136000>,     // 9 bus=1017
+				<26 512 0 10368000>,    // 10 bus=1296
+				<26 512 0 12440000>,    // 11 bus=1555
+				<26 512 0 14432000>;    // 12 bus=1804
+
+		/* GDSC regulator names */
+		regulator-names = "vddcx", "vdd";
+		/* GDSC oxili regulators */
+		vddcx-supply = <&gdsc_gpu>;
+		vdd-supply = <&gdsc_gpu_gx>;
+
+		/* GPU Mempools */
+		qcom,gpu-mempools {
+			#address-cells= <1>;
+			#size-cells = <0>;
+			compatible = "qcom,gpu-mempools";
+
+			/* 4K Page Pool configuration */
+			qcom,gpu-mempool@0 {
+				reg = <0>;
+				qcom,mempool-page-size = <4096>;
+				qcom,mempool-reserved = <2048>;
+				qcom,mempool-allocate;
+			};
+			/* 8K Page Pool configuration */
+			qcom,gpu-mempool@1 {
+				reg = <1>;
+				qcom,mempool-page-size  = <8192>;
+				qcom,mempool-reserved = <1024>;
+				qcom,mempool-allocate;
+			};
+			/* 64K Page Pool configuration */
+			qcom,gpu-mempool@2 {
+				reg = <2>;
+				qcom,mempool-page-size  = <65536>;
+				qcom,mempool-reserved = <256>;
+			};
+			/* 1M Page Pool configuration */
+			qcom,gpu-mempool@3 {
+				reg = <3>;
+				qcom,mempool-page-size  = <1048576>;
+				qcom,mempool-reserved = <32>;
+			};
+		};
+
+		/* Power levels */
+		qcom,gpu-pwrlevels {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			compatible = "qcom,gpu-pwrlevels";
+
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <480000000>;
+				qcom,bus-freq = <11>;
+				qcom,bus-min = <10>;
+				qcom,bus-max = <11>;
+			};
+
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <360000000>;
+				qcom,bus-freq = <10>;
+				qcom,bus-min = <9>;
+				qcom,bus-max = <11>;
+			};
+
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <205000000>;
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <8>;
+			};
+
+			qcom,gpu-pwrlevel@3 {
+				reg = <3>;
+				qcom,gpu-freq = <120000000>;
+				qcom,bus-freq = <4>;
+				qcom,bus-min = <3>;
+				qcom,bus-max = <5>;
+			};
+
+			qcom,gpu-pwrlevel@4 {
+				reg = <4>;
+				qcom,gpu-freq = <60000000>;
+				qcom,bus-freq = <2>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <3>;
+			};
+
+			qcom,gpu-pwrlevel@5 {
+				reg = <5>;
+				qcom,gpu-freq = <27000000>;
+				qcom,bus-freq = <0>;
+				qcom,bus-min = <0>;
+				qcom,bus-max = <0>;
+			};
+		};
+
+	};
+
+	kgsl_msm_iommu: qcom,kgsl-iommu {
+		compatible = "qcom,kgsl-smmu-v2";
+
+		reg = <0xb40000 0x20000>;
+		qcom,protect = <0x40000 0x20000>;
+		qcom,micro-mmu-control = <0x6000>;
+
+		clocks = <&clock_mmss clk_mmss_mmagic_ahb_clk>,
+			<&clock_mmss clk_mmss_mmagic_cfg_ahb_clk>,
+			<&clock_gpu clk_gpu_ahb_clk>,
+			<&clock_gcc clk_gcc_mmss_bimc_gfx_clk>,
+			<&clock_gcc clk_gcc_bimc_gfx_clk>;
+		clock-names = "mmagic_ahb_clk", "mmagic_cfg_ahb_clk", "gpu_ahb_clk",
+			"gcc_mmss_bimc_gfx_clk", "gcc_bimc_gfx_clk";
+
+		qcom,secure_align_mask = <0xfff>;
+		qcom,retention;
+		qcom,hyp_secure_alloc;
+
+		gfx3d_user: gfx3d_user {
+			compatible = "qcom,smmu-kgsl-cb";
+			label = "gfx3d_user";
+			iommus = <&kgsl_smmu 0>;
+			qcom,gpu-offset = <0x48000>;
+		};
+
+		gfx3d_secure: gfx3d_secure {
+			compatible = "qcom,smmu-kgsl-cb";
+			iommus = <&kgsl_smmu 2>;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-ion.dtsi b/arch/arm64/boot/dts/qcom/msm8996-ion.dtsi
new file mode 100644
index 000000000000..9b287e3f23c5
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-ion.dtsi
@@ -0,0 +1,47 @@
+/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	qcom,ion {
+		compatible = "qcom,msm-ion";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		system_heap: qcom,ion-heap@25 {
+			reg = <25>;
+			qcom,ion-heap-type = "SYSTEM";
+		};
+
+		qcom,ion-heap@22 { /* ADSP HEAP */
+			reg = <22>;
+			memory-region = <&adsp_mem>;
+			qcom,ion-heap-type = "DMA";
+		};
+
+		qcom,ion-heap@27 { /* QSEECOM HEAP */
+			reg = <27>;
+			memory-region = <&qseecom_mem>;
+			qcom,ion-heap-type = "DMA";
+		};
+
+		qcom,ion-heap@10 { /* SECURE DISPLAY HEAP */
+			reg = <10>;
+			memory-region = <&secure_display_memory>;
+			qcom,ion-heap-type = "HYP_CMA";
+		};
+
+		qcom,ion-heap@9 {
+			reg = <9>;
+			qcom,ion-heap-type = "SYSTEM_SECURE";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-ipcrouter.dtsi b/arch/arm64/boot/dts/qcom/msm8996-ipcrouter.dtsi
new file mode 100644
index 000000000000..a034754f8719
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-ipcrouter.dtsi
@@ -0,0 +1,58 @@
+/* Copyright (c) 2014,2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	qcom,ipc_router {
+		compatible = "qcom,ipc_router";
+		qcom,node-id = <1>;
+	};
+
+	qcom,ipc_router_modem_xprt {
+		compatible = "qcom,ipc_router_glink_xprt";
+		qcom,ch-name = "IPCRTR";
+		qcom,xprt-remote = "mpss";
+		qcom,glink-xprt = "smd_trans";
+		qcom,xprt-linkid = <1>;
+		qcom,xprt-version = <1>;
+		qcom,fragmented-data;
+	};
+
+	qcom,ipc_router_q6_xprt {
+		compatible = "qcom,ipc_router_glink_xprt";
+		qcom,ch-name = "IPCRTR";
+		qcom,xprt-remote = "lpass";
+		qcom,glink-xprt = "smd_trans";
+		qcom,xprt-linkid = <1>;
+		qcom,xprt-version = <1>;
+		qcom,fragmented-data;
+	};
+
+	qcom,ipc_router_dsps_xprt {
+		compatible = "qcom,ipc_router_glink_xprt";
+		qcom,ch-name = "IPCRTR";
+		qcom,xprt-remote = "dsps";
+		qcom,glink-xprt = "smd_trans";
+		qcom,xprt-linkid = <1>;
+		qcom,xprt-version = <1>;
+		qcom,fragmented-data;
+	};
+
+	qcom,ipc_router_external_modem_xprt2 {
+		compatible = "qcom,ipc_router_mhi_xprt";
+		qcom,ch-name = "IPCRTR";
+		qcom,out-chan-id = <34>;
+		qcom,in-chan-id = <35>;
+		qcom,xprt-remote = "external-modem";
+		qcom,xprt-linkid = <1>;
+		qcom,xprt-version = <3>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-liquid.dtsi b/arch/arm64/boot/dts/qcom/msm8996-liquid.dtsi
new file mode 100644
index 000000000000..571e67a7dd93
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-liquid.dtsi
@@ -0,0 +1,651 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8996-pinctrl.dtsi"
+#include "msm8996-camera-sensor-liquid.dtsi"
+#include "msm8996-wsa881x.dtsi"
+
+/ {
+	bluetooth: bt_qca6174 {
+		compatible = "qca,qca6174";
+		qca,bt-reset-gpio = <&pm8994_gpios 19 0>; /* BT_EN */
+		qca,bt-vdd-core-supply = <&pm8994_s3>;
+		qca,bt-vdd-pa-supply = <&rome_vreg>;
+		qca,bt-vdd-io-supply = <&pm8994_s4>;
+		qca,bt-vdd-xtal-supply = <&pm8994_l30>;
+		qca,bt-vdd-core-voltage-level = <1300000 1800000>;
+		qca,bt-vdd-io-voltage-level = <1800000 1800000>;
+		qca,bt-vdd-xtal-voltage-level = <1800000 1800000>;
+	};
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&ufsphy1 {
+	status = "ok";
+};
+
+&ufs1 {
+	status = "ok";
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&sdhc_1 {
+	vdd-supply = <&pm8994_l20>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	vdd-io-supply = <&pm8994_s4>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <110 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 96000000 192000000 384000000>;
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8994_l21>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8994_l13>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x1>;
+	status = "ok";
+};
+
+&pm8994_vadc {
+	chan@5 {
+		label = "vcoin";
+		reg = <5>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7 {
+		label = "vph_pwr";
+		reg = <7>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8994_adc_tm {
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x48>;
+		qcom,thermal-node;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x80>;
+		qcom,thermal-node;
+	};
+};
+
+&mdss_hdmi_tx {
+	pinctrl-names = "hdmi_hpd_active", "hdmi_ddc_active", "hdmi_cec_active",
+				"hdmi_active", "hdmi_sleep";
+	pinctrl-0 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_suspend
+						&mdss_hdmi_cec_suspend>;
+	pinctrl-1 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+						&mdss_hdmi_cec_suspend>;
+	pinctrl-2 = <&mdss_hdmi_hpd_active &mdss_hdmi_cec_active
+						&mdss_hdmi_ddc_suspend>;
+	pinctrl-3 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+						&mdss_hdmi_cec_active>;
+	pinctrl-4 = <&mdss_hdmi_hpd_suspend &mdss_hdmi_ddc_suspend
+						&mdss_hdmi_cec_suspend>;
+};
+
+&pmi8994_vadc {
+	chan@0 {
+		label = "usbin";
+		reg = <0>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <4>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@1 {
+		label = "dcin";
+		reg = <1>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <4>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@43 {
+		label = "usb_dp";
+		reg = <0x43>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@44 {
+		label = "usb_dm";
+		reg = <0x44>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+#include "msm8996-sde-display.dtsi"
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_jdi_4k_nofbc_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+	qcom,platform-bklight-en-gpio = <&pm8994_gpios 14 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_jdi_4k_nofbc_video>;
+};
+
+&labibb {
+	status = "ok";
+	qcom,qpnp-labibb-mode = "lcd";
+};
+
+&dsi_dual_jdi_4k_nofbc_video {
+	pwms = <&pmi8994_pwm_4 0 0>;
+	pwm-names = "backlight";
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-pwm-pmi;
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&pmi8994_pwm_4 {
+	qcom,channel-owner = "lcd_bl";
+	qcom,dtest-line = <4>;
+	qcom,dtest-output = <1>;
+	status = "okay";
+};
+
+/{
+	mtp_batterydata: qcom,battery-data {
+		qcom,batt-id-range-pct = <15>;
+		#include "batterydata-liquid-7650-sanyo.dtsi"
+	};
+};
+
+&pmi8994_charger {
+	qcom,dc-psy-type = "Wipower";
+	qcom,dcin-vadc = <&pmi8994_vadc>;
+	qcom,wipower-default-ilim-map = <4000000 20000000 550 700 300>;
+	qcom,wipower-pt-ilim-map = <4000000 7140000 550 700 300>,
+					<7140000 8140000 550 700 300>,
+					<8140000 9140000 500 700 300>,
+					<9140000 9950000 500 700 300>;
+	qcom,wipower-div2-ilim-map = <4000000 4820000 550 700 300>,
+					<4820000 5820000 550 700 300>,
+					<5820000 6820000 550 650 650>,
+					<6820000 7820000 550 700 600>,
+					<7820000 8500000 550 700 550>;
+};
+
+&pmi8994_fg {
+	qcom,battery-data = <&mtp_batterydata>;
+	qcom,ext-sense-type;
+};
+
+&usb_otg_switch {
+	status = "okay";
+};
+
+&usb3 {
+	vbus_dwc3-supply = <&usb_otg_switch>;
+};
+
+&pm8994_mpps {
+	mpp@a300 { /* MPP 4 */
+		/* HDMI_5v_vreg regulator enable */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <0>;
+		status = "okay";
+	};
+};
+
+&pmi8994_gpios {
+	gpio@c400 { /* GPIO 5 - USB3 OTG SWITCH EN */
+		qcom,mode = <1>;	/* Digital output */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,master-en = <1>;	/* Enable GPIO */
+		qcom,invert = <0>;	/* Output low initially */
+		status = "okay";
+	};
+};
+
+&pmi8994_gpios {
+	gpio@c100 {	/* GPIO 2  SPKR_SD_N */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c200 {	/* GPIO 3 SPKR_SD_N */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+};
+
+&pmi8994_mpps {
+	mpp@a000 { /* MPP 1 */
+		qcom,mode = <1>;                /* Digital output */
+		qcom,output-type = <0>;         /* CMOS logic */
+		qcom,vin-sel = <0>;             /* S4 1.8V */
+		qcom,src-sel = <7>;             /* DTEST4 */
+		qcom,master-en = <1>;           /* Enable MPP */
+		status = "okay";
+	};
+
+	mpp@a300 { /* MPP 4 */
+		/* WLED FET */
+		qcom,mode = <1>;        /* DIGITAL OUT */
+		qcom,vin-sel = <0>;     /* VIN0 */
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&soc {
+	drv2667_vreg: drv2667_vdd_vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "vdd_drv2667";
+	};
+
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+
+		home {
+			label = "home";
+			gpios = <&pm8994_gpios 1 0x1>;
+			linux,input-type = <1>;
+			linux,code = <102>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8994_gpios 2 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+
+	ts_xvdd_vreg: ts_xvdd_vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "ts_xvdd_vreg";
+		startup-delay-us = <4000>;
+		enable-active-high;
+		gpio = <&pm8994_gpios 3 0>;
+		status = "ok";
+	};
+
+	sound-9335 {
+		qcom,model = "msm8996-tasha-mtp-snd-card";
+		qcom,hdmi-audio-rx;
+		asoc-codec = <&stub_codec>, <&hdmi_audio>;
+		asoc-codec-names = "msm-stub-codec.1", "msm-hdmi-audio-codec-rx";
+		qcom,wsa-max-devs = <2>;
+		qcom,wsa-devs = <&wsa881x_211>, <&wsa881x_212>,
+				<&wsa881x_213>, <&wsa881x_214>;
+		qcom,wsa-aux-dev-prefix = "SpkrLeft", "SpkrRight",
+					  "SpkrLeft", "SpkrRight";
+	};
+};
+
+&pm8994_gpios {
+	gpio@c700 { /* GPIO 8 - WLAN_EN */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@c800 { /* GPIO 9 - Rome 3.3V control */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* MOS logic */
+		qcom,invert = <1>;		/* Output high */
+		qcom,vin-sel = <0>;		/* VPH_PWR */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,out-strength = <1>;	/* High drive strength */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@cd00 { /* GPIO 14 - lcd_bklt_reg_en */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <1>; 	/* output hight initially */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,out-strength = <1>;	/* Low drive strength */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c000 { /* GPIO 1 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c100 { /* GPIO 2 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c200 { /* GPIO 3 - TS_XVDD_EN */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,output-type = <0>;         /* CMOS logic */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+
+	gpio@ce00 { /* GPIO 15 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@d100 { /* GPIO 18 - Rome Sleep Clock */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <0>;		/* Output low initially */
+		qcom,vin-sel = <2>;		/* VIN 2 */
+		qcom,src-sel = <3>;		/* Function 2 */
+		qcom,out-strength = <2>;	/* Medium */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@d200 { /* GPIO 19 - Rome BT Reset */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&pmi8994_haptics {
+	status = "okay";
+};
+
+&flash_led {
+	qcom,follow-otst2-rb-disabled;
+};
+
+&blsp1_uart2 {
+	status = "ok";
+};
+
+&i2c_7 {
+	ti-drv2667@59 {
+		compatible = "ti,drv2667";
+		reg = <0x59>;
+		vdd-supply = <&drv2667_vreg>;
+		vdd-i2c-supply = <&pm8994_s4>;
+		ti,label = "vibrator";
+		ti,gain = <2>;
+		ti,idle-timeout-ms = <20>;
+		ti,max-runtime-ms = <15000>;
+		ti,mode = <2>;
+		ti,wav-seq = [
+			/* wave form id */
+			01
+			/* header size, start and stop bytes */
+			05 80 06 00 09
+			/* repeat, amp, freq, duration, envelope */
+			01 ff 19 02 00];
+	};
+};
+
+&i2c_12 {
+	atmel_maxtouch_ts@4a {
+		compatible = "atmel,maxtouch-ts";
+		reg = <0x4a>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <125 0x2008>;
+		vdd-supply = <&pm8994_l14>;
+		avdd-supply = <&pm8994_l22>;
+		xvdd-supply = <&ts_xvdd_vreg>;
+		pinctrl-names = "pmx_ts_active","pmx_ts_suspend";
+		pinctrl-0 = <&ts_active>;
+		pinctrl-1 = <&ts_suspend>;
+		atmel,panel-coords = <0 0 3839 2159>;
+		atmel,display-coords = <0 0 3839 2159>;
+		atmel,irq-gpio = <&tlmm 125 0x2008>;
+		atmel,reset-gpio = <&tlmm 89 0x00>;
+		atmel,i2cmode-gpio = <&tlmm 86 0x00>;
+		atmel,ignore-crc;
+		/* Underlying clocks used by secure touch */
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp2_qup6_i2c_apps_clk>;
+		atmel,cfg-name = "maxtouch_8996_liquid_cfg.raw";
+		atmel,cfg_1 {
+			atmel,version = <0x10>;
+			atmel,build = <0xaa>;
+			atmel,fw-name = "maxtouch_8996_liquid_v1_1_AB.fw";
+		};
+		atmel,cfg_2 {
+			atmel,version = <0x11>;
+			atmel,build = <0xab>;
+		};
+	};
+};
+
+&wil6210 {
+	status = "ok";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-mdss-panels.dtsi b/arch/arm64/boot/dts/qcom/msm8996-mdss-panels.dtsi
new file mode 100644
index 000000000000..94be1082c2be
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-mdss-panels.dtsi
@@ -0,0 +1,274 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "dsi-panel-sharp-dualmipi-wqxga-video.dtsi"
+#include "dsi-panel-nt35597-dualmipi-wqxga-video.dtsi"
+#include "dsi-panel-nt35597-dualmipi-wqxga-cmd.dtsi"
+#include "dsi-panel-nt35597-dsc-wqxga-video.dtsi"
+#include "dsi-panel-jdi-dualmipi-video.dtsi"
+#include "dsi-panel-jdi-dualmipi-cmd.dtsi"
+#include "dsi-panel-jdi-4k-dualmipi-video-nofbc.dtsi"
+#include "dsi-panel-sim-video.dtsi"
+#include "dsi-panel-sim-dualmipi-video.dtsi"
+#include "dsi-panel-sim-cmd.dtsi"
+#include "dsi-panel-sim-dualmipi-cmd.dtsi"
+#include "dsi-panel-nt35597-dsc-wqxga-cmd.dtsi"
+#include "dsi-panel-hx8379a-truly-fwvga-video.dtsi"
+#include "dsi-panel-r69007-dualdsi-wqxga-cmd.dtsi"
+#include "dsi-adv7533-1024-600p.dtsi"
+#include "dsi-adv7533-720p.dtsi"
+#include "dsi-adv7533-1080p.dtsi"
+#include "dsi-panel-nt35950-dsc-4k-cmd.dtsi"
+#include "dsi-panel-sharp-dualmipi-1080p-120hz.dtsi"
+#include "dsi-panel-sharp-1080p-cmd.dtsi"
+#include "dsi-panel-sharp-dsc-4k-video.dtsi"
+#include "dsi-panel-toshiba-720p-video.dtsi"
+#include "dsi-panel-sharp-dsc-4k-cmd.dtsi"
+#include "dsi-panel-jdi-1080p-video.dtsi"
+
+&soc {
+	dsi_panel_pwr_supply: dsi_panel_pwr_supply {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "vddio";
+			qcom,supply-min-voltage = <1800000>;
+			qcom,supply-max-voltage = <1800000>;
+			qcom,supply-enable-load = <62000>;
+			qcom,supply-disable-load = <80>;
+		};
+
+		qcom,panel-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "lab";
+			qcom,supply-min-voltage = <4600000>;
+			qcom,supply-max-voltage = <6000000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+
+		qcom,panel-supply-entry@2 {
+			reg = <2>;
+			qcom,supply-name = "ibb";
+			qcom,supply-min-voltage = <4600000>;
+			qcom,supply-max-voltage = <6000000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+			qcom,supply-post-on-sleep = <10>;
+		};
+	};
+};
+
+&soc {
+	dsi_panel_pwr_supply_amoled: dsi_panel_pwr_supply_amoled {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "vddio";
+			qcom,supply-min-voltage = <1800000>;
+			qcom,supply-max-voltage = <1800000>;
+			qcom,supply-enable-load = <62000>;
+			qcom,supply-disable-load = <80>;
+			qcom,supply-post-on-sleep = <20>;
+		};
+
+		qcom,panel-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "lab";
+			qcom,supply-min-voltage = <4600000>;
+			qcom,supply-max-voltage = <6000000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+
+		qcom,panel-supply-entry@2 {
+			reg = <2>;
+			qcom,supply-name = "ibb";
+			qcom,supply-min-voltage = <4600000>;
+			qcom,supply-max-voltage = <6000000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+			qcom,supply-post-on-sleep = <20>;
+		};
+
+		qcom,panel-supply-entry@3 {
+			reg = <3>;
+			qcom,supply-name = "oled-vdda";
+			qcom,supply-min-voltage = <3000000>;
+			qcom,supply-max-voltage = <3000000>;
+			qcom,supply-enable-load = <857000>;
+			qcom,supply-disable-load = <0>;
+			qcom,supply-post-on-sleep = <0>;
+		};
+	};
+};
+
+&soc {
+	dsi_panel_pwr_supply_no_labibb: dsi_panel_pwr_supply_no_labibb {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "vddio";
+			qcom,supply-min-voltage = <1800000>;
+			qcom,supply-max-voltage = <1800000>;
+			qcom,supply-enable-load = <62000>;
+			qcom,supply-disable-load = <80>;
+			qcom,supply-post-on-sleep = <20>;
+		};
+
+		qcom,panel-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "vdd";
+			qcom,supply-min-voltage = <3000000>;
+			qcom,supply-max-voltage = <3000000>;
+			qcom,supply-enable-load = <857000>;
+			qcom,supply-disable-load = <0>;
+			qcom,supply-post-on-sleep = <0>;
+		};
+	};
+};
+
+&dsi_nt35950_4k_dsc_cmd {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [21 1e 06 08 04 03 04 a0
+		21 1e 06 08 04 03 04 a0
+		21 1e 06 08 04 03 04 a0
+		21 1e 06 08 04 03 04 a0
+		21 15 06 07 04 03 04 a0];
+};
+
+&dsi_sharp_4k_dsc_video {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [21 1e 06 08 04 03 04 a0
+		21 1e 06 08 04 03 04 a0
+		21 1e 06 08 04 03 04 a0
+		21 1e 06 08 04 03 04 a0
+		21 15 06 07 04 03 04 a0];
+};
+
+&dsi_sharp_4k_dsc_cmd {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [21 1e 06 08 04 03 04 a0
+		21 1e 06 08 04 03 04 a0
+		21 1e 06 08 04 03 04 a0
+		21 1e 06 08 04 03 04 a0
+		21 15 06 07 04 03 04 a0];
+};
+
+&dsi_dual_sharp_video {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [23 20 06 09 05 03 04 a0
+			23 20 06 09 05 03 04 a0
+			23 20 06 09 05 03 04 a0
+			23 20 06 09 05 03 04 a0
+			23 2e 06 08 05 03 04 a0];
+};
+
+&dsi_dual_jdi_cmd {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [22 1e 06 08 04 03 04 a0
+			22 1e 06 08 04 03 04 a0
+			22 1e 06 08 04 03 04 a0
+			22 1e 06 08 04 03 04 a0
+			22 2c 05 08 04 03 04 a0];
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "te_signal_check";
+};
+
+&dsi_dual_jdi_video {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [22 1e 06 08 04 03 04 a0
+			22 1e 06 08 04 03 04 a0
+			22 1e 06 08 04 03 04 a0
+			22 1e 06 08 04 03 04 a0
+			22 2c 05 08 04 03 04 a0];
+};
+
+&dsi_dual_sharp_1080_120hz_cmd {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [23 1e 07 08 05 03 04 a0
+			23 1e 07 08 05 03 04 a0
+			23 1e 07 08 05 03 04 a0
+			23 1e 07 08 05 03 04 a0
+			23 18 07 08 05 03 04 a0];
+};
+
+&dsi_dual_nt35597_video {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 18 07 08 04 03 04 a0];
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "bta_check";
+};
+
+&dsi_dual_nt35597_cmd {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 18 07 08 04 03 04 a0];
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "bta_check";
+};
+
+&dsi_nt35597_dsc_video {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [20 1d 05 07 03 03 04 a0
+		20 1d 05 07 03 03 04 a0
+		20 1d 05 07 03 03 04 a0
+		20 1d 05 07 03 03 04 a0
+		20 12 05 06 03 13 04 a0];
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "bta_check";
+};
+
+&dsi_nt35597_dsc_cmd {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [20 1d 05 07 03 03 04 a0
+		20 1d 05 07 03 03 04 a0
+		20 1d 05 07 03 03 04 a0
+		20 1d 05 07 03 03 04 a0
+		20 12 05 06 03 13 04 a0];
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "bta_check";
+};
+
+&dsi_dual_jdi_4k_nofbc_video {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [
+		2c 27 0e 10 0a 03 04 a0
+		2c 27 0e 10 0a 03 04 a0
+		2c 27 0e 10 0a 03 04 a0
+		2c 27 0e 10 0a 03 04 a0
+		2c 32 0e 0f 0a 03 04 a0];
+};
+
+&dsi_hx8379a_fwvga_truly_vid {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [23 20 06 09 05 03 04 a0
+		23 20 06 09 05 03 04 a0
+		23 20 06 09 05 03 04 a0
+		23 20 06 09 05 03 04 a0
+		23 2e 06 08 05 03 04 a0];
+};
+&dsi_r69007_wqxga_cmd {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [23 1f 07 09 05 03 04 a0
+		23 1f 07 09 05 03 04 a0
+		23 1f 07 09 05 03 04 a0
+		23 1f 07 09 05 03 04 a0
+		23 19 08 08 05 03 04 a0];
+};
+
+&dsi_sharp_1080_cmd {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [23 1f 07 09 05 03 04 a0
+		23 1f 07 09 05 03 04 a0
+		23 1f 07 09 05 03 04 a0
+		23 1f 07 09 05 03 04 a0
+		23 19 08 08 05 03 04 a0];
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-mdss-pll.dtsi b/arch/arm64/boot/dts/qcom/msm8996-mdss-pll.dtsi
new file mode 100644
index 000000000000..53d47b16e821
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-mdss-pll.dtsi
@@ -0,0 +1,138 @@
+/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	mdss_dsi0_pll: qcom,mdss_dsi_pll@994400 {
+		compatible = "qcom,mdss_dsi_pll_8996_v2";
+		label = "MDSS DSI 0 PLL";
+		cell-index = <0>;
+		#clock-cells = <1>;
+
+		reg = <0x00994400 0x588>,
+		      <0x008C2300 0x8>,
+		      <0x00994200 0x98>;
+		reg-names = "pll_base", "gdsc_base", "dynamic_pll_base";
+
+		gdsc-supply = <&gdsc_mdss>;
+
+		clocks = <&clock_mmss clk_mdss_ahb_clk>;
+		clock-names = "iface_clk";
+		clock-rate = <0>;
+		qcom,dsi-pll-ssc-en;
+		qcom,dsi-pll-ssc-mode = "down-spread";
+
+		/* Memory region for passing dynamic refresh pll codes */
+		memory-region = <&dfps_data_mem>;
+
+		qcom,platform-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,platform-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+
+		};
+	};
+
+	mdss_dsi1_pll: qcom,mdss_dsi_pll@996400 {
+		compatible = "qcom,mdss_dsi_pll_8996_v2";
+		label = "MDSS DSI 1 PLL";
+		cell-index = <1>;
+		#clock-cells = <1>;
+
+		reg = <0x00996400 0x588>,
+		      <0x008C2300 0x8>,
+		      <0x00996200 0x98>;
+		reg-names = "pll_base", "gdsc_base", "dynamic_pll_base";
+
+		gdsc-supply = <&gdsc_mdss>;
+
+		clocks = <&clock_mmss clk_mdss_ahb_clk>;
+		clock-names = "iface_clk";
+		clock-rate = <0>;
+		qcom,dsi-pll-ssc-en;
+		qcom,dsi-pll-ssc-mode = "down-spread";
+
+		qcom,platform-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,platform-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+	};
+
+	mdss_hdmi_pll: qcom,mdss_hdmi_pll@0x9a0600 {
+		compatible = "qcom,mdss_hdmi_pll_8996";
+		label = "MDSS HDMI PLL";
+		#clock-cells = <1>;
+
+		reg = <0x9a0600 0xb10>,
+		      <0x9a1200 0x0c8>,
+		      <0x8C2300 0x8>;
+		reg-names = "pll_base", "phy_base", "gdsc_base";
+
+		gdsc-supply = <&gdsc_mdss>;
+		vddio-supply = <&pm8994_l12>;
+		vcca-supply = <&pm8994_l28>;
+
+		clocks = <&clock_mmss clk_mdss_ahb_clk>,
+			 <&clock_gcc clk_gcc_hdmi_clkref_clk>,
+			 <&clock_gcc clk_ln_bb_clk>;
+		clock-names = "iface_clk", "ref_clk", "ref_clk_src";
+		clock-rate = <0>;
+
+		qcom,platform-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,platform-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+
+			qcom,platform-supply-entry@1 {
+				reg = <1>;
+				qcom,supply-name = "vddio";
+				qcom,supply-min-voltage = <1800000>;
+				qcom,supply-max-voltage = <1800000>;
+				qcom,supply-enable-load = <100000>;
+				qcom,supply-disable-load = <100>;
+			};
+
+			qcom,platform-supply-entry@2 {
+				reg = <2>;
+				qcom,supply-name = "vcca";
+				qcom,supply-min-voltage = <925000>;
+				qcom,supply-max-voltage = <925000>;
+				qcom,supply-enable-load = <10000>;
+				qcom,supply-disable-load = <100>;
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-mdss.dtsi b/arch/arm64/boot/dts/qcom/msm8996-mdss.dtsi
new file mode 100644
index 000000000000..12fa68fac0fb
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-mdss.dtsi
@@ -0,0 +1,569 @@
+/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	mdss_mdp: qcom,mdss_mdp@900000 {
+		compatible = "qcom,mdss_mdp";
+		reg = <0x00900000 0x90000>,
+		      <0x009b0000 0x1040>;
+		reg-names = "mdp_phys", "vbif_phys";
+		interrupts = <0 83 0>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		vdd-supply = <&gdsc_mdss>;
+
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		/* Bus Scale Settings */
+		qcom,msm-bus,name = "mdss_mdp";
+		qcom,msm-bus,num-cases = <3>;
+		qcom,msm-bus,num-paths = <3>;
+		qcom,msm-bus,vectors-KBps =
+			<22 512 0 0>, <23 512 0 0>, <25 512 0 0>,
+			<22 512 0 6400000>, <23 512 0 6400000>, <25 512 0 6400000>,
+			<22 512 0 6400000>, <23 512 0 6400000>, <25 512 0 6400000>;
+
+		qcom,mdss-num-nrt-paths = <1>;
+
+		/* Fudge factors */
+		qcom,mdss-ab-factor = <1 1>;		/* 1 time  */
+		qcom,mdss-ib-factor = <1 1>;		/* 1 time  */
+		qcom,mdss-clk-factor = <105 100>;	/* 1.05 times */
+
+		qcom,max-mixer-width = <2560>;
+		qcom,max-pipe-width = <2560>;
+
+		/* VBIF QoS remapper settings*/
+		qcom,mdss-vbif-qos-rt-setting = <1 2 2 2>;
+		qcom,mdss-vbif-qos-nrt-setting = <1 1 1 1>;
+
+		qcom,mdss-has-panic-ctrl;
+		qcom,mdss-per-pipe-panic-luts = <0x000f>,
+						<0xffff>,
+						<0xfffc>,
+						<0xff00>;
+
+		qcom,mdss-mdp-reg-offset = <0x00001000>;
+		qcom,max-bandwidth-low-kbps = <9600000>;
+		qcom,max-bandwidth-high-kbps = <9600000>;
+		qcom,max-bandwidth-per-pipe-kbps = <4500000>;
+		qcom,max-clk-rate = <412500000>;
+		qcom,mdss-default-ot-rd-limit = <32>;
+		qcom,mdss-default-ot-wr-limit = <16>;
+		qcom,mdss-dram-channels = <2>;
+
+		qcom,mdss-pipe-vig-off = <0x00005000 0x00007000
+					  0x00009000 0x0000B000>;
+		qcom,mdss-pipe-rgb-off = <0x00015000 0x00017000
+					  0x00019000 0x0001B000>;
+		qcom,mdss-pipe-cursor-off = <0x00035000 0x00037000>;
+
+		qcom,mdss-pipe-vig-xin-id = <0 4 8 12>;
+		qcom,mdss-pipe-rgb-xin-id = <1 5 9 13>;
+		qcom,mdss-pipe-cursor-xin-id = <7 7>;
+
+		/* These Offsets are relative to "mdp_phys + mdp-reg-offset" address */
+		qcom,mdss-pipe-vig-clk-ctrl-offsets = <0x2AC 0 0>,
+						      <0x2B4 0 0>,
+						      <0x2BC 0 0>,
+						      <0x2C4 0 0>;
+		qcom,mdss-pipe-rgb-clk-ctrl-offsets = <0x2AC 4 8>,
+						      <0x2B4 4 8>,
+						      <0x2BC 4 8>,
+						      <0x2C4 4 8>;
+		qcom,mdss-pipe-cursor-clk-ctrl-offsets = <0x3A8 16 15>,
+							 <0x3B0 16 15>;
+
+
+		qcom,mdss-ctl-off = <0x00002000 0x00002200 0x00002400
+				     0x00002600>;
+		qcom,mdss-mixer-intf-off = <0x00045000 0x00046000
+					0x00047000 0x0004A000>;
+		qcom,mdss-dspp-off = <0x00055000 0x00057000>;
+		qcom,mdss-wb-off = <0x00066000>;
+		qcom,mdss-intf-off = <0x0006B000 0x0006B800
+					0x0006C000 0x0006C800>;
+		qcom,mdss-pingpong-off = <0x00071000 0x00071800
+					  0x00072000 0x00072800>;
+		qcom,mdss-slave-pingpong-off = <0x00073000>;
+		qcom,mdss-ppb-ctl-off = <0x00000330 0x00000338>;
+		qcom,mdss-ppb-cfg-off = <0x00000334 0x0000033C>;
+		qcom,mdss-has-pingpong-split;
+		qcom,mdss-has-separate-rotator;
+
+		qcom,mdss-ad-off = <0x0079000 0x00079800 0x0007a000>;
+		qcom,mdss-cdm-off = <0x0007a200>;
+		qcom,mdss-dsc-off = <0x00081000 0x00081400>;
+		qcom,mdss-wfd-mode = "intf";
+		qcom,mdss-has-source-split;
+		qcom,mdss-highest-bank-bit = <0x2>;
+		qcom,mdss-has-decimation;
+		qcom,mdss-idle-power-collapse-enabled;
+		clocks = <&clock_mmss clk_mdss_ahb_clk>,
+			 <&clock_mmss clk_mdss_axi_clk>,
+			 <&clock_mmss clk_mdp_clk_src>,
+			 <&clock_mmss clk_mdss_mdp_vote_clk>,
+			 <&clock_mmss clk_mdss_vsync_clk>;
+		clock-names = "iface_clk", "bus_clk", "core_clk_src",
+				"core_clk", "vsync_clk";
+
+		qcom,mdp-settings = <0x01190 0x00000000>,
+				    <0x012ac 0xc0000ccc>,
+				    <0x012b4 0xc0000ccc>,
+				    <0x012bc 0x00cccccc>,
+				    <0x012c4 0x000000cc>,
+				    <0x013a8 0x0cccc0c0>,
+				    <0x013b0 0xccccc0c0>,
+				    <0x013b8 0xcccc0000>,
+				    <0x013d0 0x00cc0000>,
+				    <0x0506c 0x00000000>,
+				    <0x0706c 0x00000000>,
+				    <0x0906c 0x00000000>,
+				    <0x0b06c 0x00000000>,
+				    <0x1506c 0x00000000>,
+				    <0x1706c 0x00000000>,
+				    <0x1906c 0x00000000>,
+				    <0x1b06c 0x00000000>,
+				    <0x2506c 0x00000000>,
+				    <0x2706c 0x00000000>;
+
+		qcom,regs-dump-mdp = <0x01000 0x01454>,
+				     <0x02000 0x02064>,
+				     <0x02200 0x02264>,
+				     <0x02400 0x02464>,
+				     <0x02600 0x02664>,
+				     <0x02800 0x02864>,
+				     <0x05000 0x05150>,
+				     <0x05200 0x05230>,
+				     <0x07000 0x07150>,
+				     <0x07200 0x07230>,
+				     <0x09000 0x09150>,
+				     <0x09200 0x09230>,
+				     <0x0b000 0x0b150>,
+				     <0x0b200 0x0b230>,
+				     <0x15000 0x15150>,
+				     <0x15200 0x15230>,
+				     <0x17000 0x17150>,
+				     <0x17200 0x17230>,
+				     <0x19000 0x19150>,
+				     <0x19200 0x19230>,
+				     <0x1b000 0x1b150>,
+				     <0x1b200 0x1b230>,
+				     <0x25000 0x25150>,
+				     <0x27000 0x27150>,
+				     <0x35000 0x35150>,
+				     <0x37000 0x37150>,
+				     <0x45000 0x452bc>,
+				     <0x46000 0x462bc>,
+				     <0x47000 0x472bc>,
+				     <0x48000 0x482bc>,
+				     <0x49000 0x492bc>,
+				     <0x4a000 0x4a2bc>,
+				     <0x55000 0x5522c>,
+				     <0x57000 0x5722c>,
+				     <0x65000 0x652c0>,
+				     <0x65800 0x65ac0>,
+				     <0x66000 0x662c0>,
+				     <0x6b800 0x6ba68>,
+				     <0x6c000 0x6c268>,
+				     <0x6c800 0x6ca68>,
+				     <0x71000 0x710d4>,
+				     <0x71800 0x718d4>,
+				     <0x73000 0x730d4>,
+				     <0x81000 0x81140>,
+				     <0x81400 0x81540>;
+
+		qcom,regs-dump-names-mdp = "MDP",
+			"CTL_0",    "CTL_1", "CTL_2",   "CTL_3", "CTL_4",
+			"VIG0_SSPP", "VIG0",  "VIG1_SSPP", "VIG1",
+			"VIG2_SSPP", "VIG2",  "VIG3_SSPP", "VIG3",
+			"RGB0_SSPP", "RGB0",  "RGB1_SSPP", "RGB1",
+			"RGB2_SSPP", "RGB2",  "RGB3_SSPP", "RGB3",
+			"DMA0_SSPP", "DMA1_SSPP",
+			"CURSOR0_SSPP", "CURSOR1_SSPP",
+			"LAYER_0", "LAYER_1", "LAYER_2",
+			"LAYER_3", "LAYER_4", "LAYER_5",
+			"DSPP_0",  "DSPP_1",
+			"WB_0",    "WB_1",    "WB_2",
+			"INTF_1",  "INTF_2", "INTF_3",
+			"PP_0",    "PP_1", "PP_4",
+			"DSC_0",    "DSC_1";
+
+		qcom,regs-dump-xin-id-mdp = <0xff
+			0xff 0xff 0xff 0xff 0xff
+			0x0 0x0 0x4 0x4
+			0x8 0x8 0xc 0xc
+			0x1 0x1 0x5 0x5
+			0x9 0x9 0xd 0xd
+			0x2 0xa
+			0x7 0x7
+			0xff 0xff 0xff
+			0xff 0xff 0xff
+			0xff 0xff
+			0x3 0xb 0x6>;
+
+		/* buffer parameters to calculate prefill bandwidth */
+		qcom,mdss-prefill-outstanding-buffer-bytes = <0>;
+		qcom,mdss-prefill-y-buffer-bytes = <0>;
+		qcom,mdss-prefill-scaler-buffer-lines-bilinear = <2>;
+		qcom,mdss-prefill-scaler-buffer-lines-caf = <4>;
+		qcom,mdss-prefill-post-scaler-buffer-pixels = <2560>;
+		qcom,mdss-prefill-pingpong-buffer-pixels = <5120>;
+
+		qcom,mdss-pp-offsets {
+			qcom,mdss-sspp-mdss-igc-lut-off = <0x2000>;
+			qcom,mdss-sspp-vig-pcc-off = <0x1780>;
+			qcom,mdss-sspp-rgb-pcc-off = <0x380>;
+			qcom,mdss-sspp-dma-pcc-off = <0x380>;
+			qcom,mdss-lm-pgc-off = <0x3C0>;
+			qcom,mdss-dspp-gamut-off = <0x1600>;
+			qcom,mdss-dspp-pcc-off = <0x1700>;
+			qcom,mdss-dspp-pgc-off = <0x17C0>;
+		};
+
+		smmu_mdp_unsec: qcom,smmu_mdp_unsec_cb {
+			compatible = "qcom,smmu_mdp_unsec";
+			iommus = <&mdp_smmu 0>;
+			reg = <0x00d08000 0xd00>;
+			reg-names = "mmu_cb";
+			gdsc-mmagic-mdss-supply = <&gdsc_mmagic_mdss>;
+			clocks = <&clock_mmss clk_smmu_mdp_ahb_clk>,
+				<&clock_mmss clk_mmagic_mdss_axi_clk>,
+				<&clock_mmss clk_smmu_mdp_axi_clk>;
+			clock-names = "mdp_ahb_clk", "mmagic_mdss_axi_clk",
+				"mdp_axi_clk";
+		};
+
+		smmu_mdp_sec: qcom,smmu_mdp_sec_cb {
+			compatible = "qcom,smmu_mdp_sec";
+			iommus = <&mdp_smmu 1>;
+			reg = <0x00d0a000 0xd00>;
+			reg-names = "mmu_cb";
+			gdsc-mmagic-mdss-supply = <&gdsc_mmagic_mdss>;
+			clocks = <&clock_mmss clk_smmu_mdp_ahb_clk>,
+				<&clock_mmss clk_mmagic_mdss_axi_clk>,
+				<&clock_mmss clk_smmu_mdp_axi_clk>;
+			clock-names = "mdp_ahb_clk", "mmagic_mdss_axi_clk",
+				"mdp_axi_clk";
+		};
+
+		mdss_fb0: qcom,mdss_fb_primary {
+			cell-index = <0>;
+			compatible = "qcom,mdss-fb";
+			qcom,cont-splash-memory {
+				linux,contiguous-region = <&cont_splash_mem>;
+			};
+		};
+
+		mdss_fb2: qcom,mdss_fb_hdmi {
+			cell-index = <2>;
+			compatible = "qcom,mdss-fb";
+			qcom,cont-splash-memory {
+				linux,contiguous-region =
+				<&cont_splash_mem_hdmi>;
+			};
+		};
+
+		mdss_fb3: qcom,mdss_fb_secondary {
+			cell-index = <3>;
+			compatible = "qcom,mdss-fb";
+		};
+	};
+
+	mdss_dsi: qcom,mdss_dsi@0 {
+		compatible = "qcom,mdss-dsi";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		gdsc-supply = <&gdsc_mdss>;
+		vdda-supply = <&pm8994_l2>;
+		vcca-supply = <&pm8994_l28>;
+		ranges = <0x994000 0x994000 0x400
+			0x994400 0x994400 0x558
+			0x828000 0x828000 0x108
+			0x996000 0x996000 0x400
+			0x996400 0x996400 0x558
+			0x828000 0x828000 0x108>;
+
+		/* Bus Scale Settings */
+		qcom,msm-bus,name = "mdss_dsi";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<22 512 0 0>,
+			<22 512 0 1000>;
+
+		qcom,mmss-ulp-clamp-ctrl-offset = <0x14>;
+
+		qcom,mdss-fb-map-prim = <&mdss_fb0>;
+		qcom,mdss-fb-map-sec = <&mdss_fb3>;
+
+		clocks = <&clock_mmss clk_mdss_mdp_vote_clk>,
+			 <&clock_mmss clk_mdss_ahb_clk>,
+			 <&clock_mmss clk_mmss_misc_ahb_clk>,
+			 <&clock_mmss clk_mdss_axi_clk>,
+			 <&clock_mmss clk_ext_byte0_clk_src>,
+			 <&clock_mmss clk_ext_byte1_clk_src>,
+			 <&clock_mmss clk_ext_pclk0_clk_src>,
+			 <&clock_mmss clk_ext_pclk1_clk_src>;
+		clock-names = "mdp_core_clk", "iface_clk",
+			"core_mmss_clk", "bus_clk",
+			"ext_byte0_clk", "ext_byte1_clk",
+			"ext_pixel0_clk", "ext_pixel1_clk";
+
+		qcom,core-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,core-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+
+		qcom,ctrl-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,ctrl-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vdda";
+				qcom,supply-min-voltage = <1250000>;
+				qcom,supply-max-voltage = <1250000>;
+				qcom,supply-enable-load = <18160>;
+				qcom,supply-disable-load = <1>;
+			};
+		};
+
+		qcom,phy-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,phy-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vcca";
+				qcom,supply-min-voltage = <925000>;
+				qcom,supply-max-voltage = <925000>;
+				qcom,supply-enable-load = <17000>;
+				qcom,supply-disable-load = <32>;
+			};
+		};
+
+		mdss_dsi0: qcom,mdss_dsi_ctrl0@994000 {
+			compatible = "qcom,mdss-dsi-ctrl";
+			label = "MDSS DSI CTRL->0";
+			cell-index = <0>;
+			reg = 	<0x994000 0x400>,
+				<0x994400 0x588>,
+				<0x828000 0x108>;
+			reg-names = "dsi_ctrl", "dsi_phy", "mmss_misc_phys";
+
+			qcom,timing-db-mode;
+			oled-vdda-supply = <&pm8994_l19>;
+			vddio-supply = <&pm8994_l14>;
+			lab-supply = <&lab_regulator>;
+			ibb-supply = <&ibb_regulator>;
+			qcom,mdss-mdp = <&mdss_mdp>;
+
+			clocks = <&clock_mmss clk_mdss_byte0_clk>,
+				 <&clock_mmss clk_mdss_pclk0_clk>,
+				 <&clock_mmss clk_mdss_esc0_clk>,
+				 <&clock_mmss clk_byte0_clk_src>,
+				 <&clock_mmss clk_pclk0_clk_src>,
+				 <&mdss_dsi0_pll clk_dsi0pll_byte_clk_mux>,
+				 <&mdss_dsi0_pll clk_dsi0pll_pixel_clk_mux>,
+				 <&mdss_dsi0_pll clk_dsi0pll_byte_clk_src>,
+				 <&mdss_dsi0_pll clk_dsi0pll_pixel_clk_src>;
+			clock-names = "byte_clk", "pixel_clk", "core_clk",
+				"byte_clk_rcg", "pixel_clk_rcg",
+				"pll_byte_clk_mux", "pll_pixel_clk_mux",
+				"pll_byte_clk_src", "pll_pixel_clk_src";
+
+			qcom,null-insertion-enabled;
+			qcom,platform-strength-ctrl = [ff 06
+							ff 06
+							ff 06
+							ff 06
+							ff 00];
+			qcom,platform-regulator-settings = [1d
+							1d 1d 1d 1d];
+			qcom,platform-lane-config = [00 00 10 0f
+						00 00 10 0f
+						00 00 10 0f
+						00 00 10 0f
+						00 00 10 8f];
+		};
+
+		mdss_dsi1: qcom,mdss_dsi_ctrl1@996000 {
+			compatible = "qcom,mdss-dsi-ctrl";
+			label = "MDSS DSI CTRL->1";
+			cell-index = <1>;
+			reg = 	<0x996000 0x400>,
+				<0x996400 0x558>,
+				<0x828000 0x108>;
+			reg-names = "dsi_ctrl", "dsi_phy", "mmss_misc_phys";
+
+			qcom,timing-db-mode;
+			oled-vdda-supply = <&pm8994_l19>;
+			vddio-supply = <&pm8994_l14>;
+			lab-supply = <&lab_regulator>;
+			ibb-supply = <&ibb_regulator>;
+			qcom,mdss-mdp = <&mdss_mdp>;
+
+			clocks = <&clock_mmss clk_mdss_byte1_clk>,
+				 <&clock_mmss clk_mdss_pclk1_clk>,
+				 <&clock_mmss clk_mdss_esc1_clk>,
+				 <&clock_mmss clk_byte1_clk_src>,
+				 <&clock_mmss clk_pclk1_clk_src>,
+				 <&mdss_dsi0_pll clk_dsi0pll_byte_clk_mux>,
+				 <&mdss_dsi0_pll clk_dsi0pll_pixel_clk_mux>,
+				 <&mdss_dsi0_pll clk_dsi0pll_byte_clk_src>,
+				 <&mdss_dsi0_pll clk_dsi0pll_pixel_clk_src>;
+			clock-names = "byte_clk", "pixel_clk", "core_clk",
+				"byte_clk_rcg", "pixel_clk_rcg",
+				"pll_byte_clk_mux", "pll_pixel_clk_mux",
+				"pll_byte_clk_src", "pll_pixel_clk_src";
+
+			qcom,null-insertion-enabled;
+			qcom,platform-strength-ctrl = [ff 06
+							ff 06
+							ff 06
+							ff 06
+							ff 00];
+			qcom,platform-regulator-settings = [1d
+							1d 1d 1d 1d];
+			qcom,platform-lane-config = [00 00 10 0f
+						00 00 10 0f
+						00 00 10 0f
+						00 00 10 0f
+						00 00 10 8f];
+		};
+	};
+
+	qcom,mdss_wb_panel {
+		compatible = "qcom,mdss_wb";
+		qcom,mdss_pan_res = <640 480>;
+		qcom,mdss_pan_bpp = <24>;
+	};
+
+	msm_ext_disp: qcom,msm_ext_disp {
+		compatible = "qcom,msm-ext-disp";
+
+		ext_disp_audio_codec: qcom,msm-ext-disp-audio-codec-rx {
+			compatible = "qcom,msm-ext-disp-audio-codec-rx";
+			qcom,msm_ext_disp = <&msm_ext_disp>;
+		};
+	};
+
+	mdss_hdmi_tx: qcom,hdmi_tx@9a0000 {
+		cell-index = <0>;
+		compatible = "qcom,hdmi-tx";
+
+		reg =	<0x9a0000 0x50c>,
+			<0x70000 0x6158>,
+			<0x9e0000 0xFFF>;
+		reg-names = "core_physical", "qfprom_physical", "hdcp_physical";
+
+		hpd-gdsc-supply = <&gdsc_mdss>;
+
+		qcom,supply-names = "hpd-gdsc";
+		qcom,min-voltage-level = <0>;
+		qcom,max-voltage-level = <0>;
+		qcom,enable-load = <0>;
+		qcom,disable-load = <0>;
+
+		qcom,msm_ext_disp = <&msm_ext_disp>;
+		clocks = <&clock_mmss clk_mdss_mdp_vote_clk>,
+			 <&clock_mmss clk_mdss_ahb_clk>,
+			 <&clock_mmss clk_mdss_hdmi_clk>,
+			 <&clock_mmss clk_mdss_hdmi_ahb_clk>,
+			 <&clock_mmss clk_mdss_extpclk_clk>;
+		clock-names = "hpd_mdp_core_clk", "hpd_iface_clk",
+			"hpd_core_clk", "hpd_alt_iface_clk", "core_extp_clk";
+
+		qcom,hdmi-tx-hpd = <&pm8994_mpps 4 0>;
+		qcom,mdss-fb-map = <&mdss_fb2>;
+		qcom,pluggable;
+
+		hdmi_audio: qcom,msm-hdmi-audio-rx {
+			compatible = "qcom,msm-hdmi-audio-codec-rx";
+		};
+	};
+
+	mdss_rotator: qcom,mdss_rotator {
+		compatible = "qcom,sde_rotator";
+		reg = <0x00900000 0x90000>,
+		      <0x009b8000 0x1040>;
+		reg-names = "mdp_phys",
+			"rot_vbif_phys";
+		qcom,mdss-wb-count = <1>;
+		qcom,mdss-wb-id = <0>;
+		qcom,mdss-ctl-id = <4>;
+		qcom,mdss-highest-bank-bit = <0x2>;
+		/* Bus Scale Settings */
+		qcom,msm-bus,name = "mdss_rotator";
+		qcom,msm-bus,num-cases = <3>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<25 512 0 0>,
+			<25 512 0 6400000>,
+			<25 512 0 6400000>;
+
+		rot-vdd-supply = <&gdsc_mdss>;
+		rot-mmagic-mdss-gdsc-supply = <&gdsc_mmagic_mdss>;
+
+		qcom,supply-names = "rot-mmagic-mdss-gdsc", "rot-vdd";
+
+		clocks = <&clock_mmss clk_mmss_misc_ahb_clk>,
+			<&clock_mmss clk_mdss_rotator_vote_clk>,
+			<&clock_mmss clk_mdss_ahb_clk>,
+			<&clock_mmss clk_mdss_axi_clk>,
+			<&clock_mmss clk_mdp_clk_src>;
+		clock-names = "iface_clk", "rot_core_clk",
+			"mdss_ahb_clk", "mdss_axi_clk", "mdp_clk_src";
+
+		interrupt-parent = <&mdss_mdp>;
+		interrupts = <32 0>;
+
+		/* VBIF QoS remapper settings*/
+		qcom,mdss-rot-vbif-qos-setting = <1 1 1 1>;
+
+		qcom,mdss-default-ot-rd-limit = <32>;
+		qcom,mdss-default-ot-wr-limit = <16>;
+
+		smmu_rot_unsecure: qcom,smmu_rot_unsec_cb {
+			compatible = "qcom,smmu_sde_rot_unsec";
+			iommus = <&rot_smmu 0>;
+			gdsc-mdss-supply = <&gdsc_mmagic_mdss>;
+			clocks = <&clock_mmss clk_smmu_rot_ahb_clk>,
+				<&clock_mmss clk_mmagic_mdss_axi_clk>,
+				<&clock_mmss clk_smmu_rot_axi_clk>;
+			clock-names = "rot_ahb_clk", "mmagic_mdss_axi_clk",
+				"rot_axi_clk";
+		};
+
+		smmu_rot_secure: qcom,smmu_rot_sec_cb {
+			compatible = "qcom,smmu_sde_rot_sec";
+			iommus = <&rot_smmu 1>;
+			gdsc-mdss-supply = <&gdsc_mmagic_mdss>;
+			clocks = <&clock_mmss clk_smmu_rot_ahb_clk>,
+				<&clock_mmss clk_mmagic_mdss_axi_clk>,
+				<&clock_mmss clk_smmu_rot_axi_clk>;
+			clock-names = "rot_ahb_clk", "mmagic_mdss_axi_clk",
+				"rot_axi_clk";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-mmxf-adp.dtsi b/arch/arm64/boot/dts/qcom/msm8996-mmxf-adp.dtsi
new file mode 100644
index 000000000000..c8898ec01992
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-mmxf-adp.dtsi
@@ -0,0 +1,907 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8996-pinctrl.dtsi"
+#include "msm8996-camera-sensor-adp.dtsi"
+#include "msm8996-wsa881x.dtsi"
+
+/ {
+	bluetooth: bt_qca6174 {
+		compatible = "qca,qca6174";
+		qca,bt-reset-gpio = <&pm8994_gpios 19 0>; /* BT_EN */
+		qca,bt-vdd-core-supply = <&pm8994_s3>;
+		qca,bt-vdd-pa-supply = <&rome_vreg>;
+		qca,bt-vdd-io-supply = <&pm8994_s4>;
+		qca,bt-vdd-xtal-supply = <&pm8994_l30>;
+		qca,bt-chip-pwd-voltage-level = <1300000 1300000>;
+		qca,bt-vdd-io-voltage-level = <1800000 1800000>;
+		qca,bt-vdd-xtal-voltage-level = <1800000 1800000>;
+	};
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&sdcc1_ice {
+	status = "ok";
+};
+
+&ufsphy1 {
+	status = "ok";
+};
+
+&ufs1 {
+	status = "ok";
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&sdhc_1 {
+	vdd-supply = <&pm8994_l20>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	vdd-io-supply = <&pm8994_s4>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <110 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000
+				96000000 192000000 384000000>;
+	qcom,ice-clk-rates = <300000000 150000000>;
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8994_l21>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8994_l13>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000
+				50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x1>;
+
+	status = "ok";
+};
+
+&pm8994_vadc {
+	chan@5 {
+		label = "vcoin";
+		reg = <5>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7 {
+		label = "vph_pwr";
+		reg = <7>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8994_adc_tm {
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x48>;
+		qcom,thermal-node;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x80>;
+		qcom,thermal-node;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x88>;
+		qcom,thermal-node;
+	};
+};
+
+&mdss_hdmi_tx {
+	pinctrl-names = "hdmi_hpd_active", "hdmi_ddc_active", "hdmi_cec_active",
+				"hdmi_active", "hdmi_sleep";
+	pinctrl-0 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_suspend
+						&mdss_hdmi_cec_suspend>;
+	pinctrl-1 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+						&mdss_hdmi_cec_suspend>;
+	pinctrl-2 = <&mdss_hdmi_hpd_active &mdss_hdmi_cec_active
+						&mdss_hdmi_ddc_suspend>;
+	pinctrl-3 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+						&mdss_hdmi_cec_active>;
+	pinctrl-4 = <&mdss_hdmi_hpd_suspend &mdss_hdmi_ddc_suspend
+						&mdss_hdmi_cec_suspend>;
+};
+
+#include "msm8996-mdss-panels.dtsi"
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_sharp_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+	qcom,platform-bklight-en-gpio = <&pm8994_gpios 14 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_sharp_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+	qcom,platform-bklight-en-gpio = <&pm8994_gpios 14 0>;
+};
+
+&dsi_dual_sharp_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled = "single_roi";
+	qcom,panel-roi-alignment = <720 128 720 64 720 64>;
+};
+
+&dsi_nt35597_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35597_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_jdi_video {
+	pwms = <&pmi8994_pwm_4 0 0>;
+	pwm-names = "backlight";
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-pwm-pmi;
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,5v-boost-gpio = <&pmi8994_gpios 8 0>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_jdi_cmd {
+	pwms = <&pmi8994_pwm_4 0 0>;
+	pwm-names = "backlight";
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-pwm-pmi;
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,5v-boost-gpio = <&pmi8994_gpios 8 0>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled = "single_roi";
+	qcom,panel-roi-alignment = <4 4 2 2 20 20>;
+};
+
+&dsi_dual_jdi_4k_nofbc_video {
+	pwms = <&pmi8994_pwm_4 0 0>;
+	pwm-names = "backlight";
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-pwm-pmi;
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+/{
+	mtp_batterydata: qcom,battery-data {
+		qcom,batt-id-range-pct = <15>;
+		#include "batterydata-itech-3000mah.dtsi"
+	};
+};
+
+&i2c_7 {
+	smb1351-charger@1d {
+		compatible = "qcom,smb1351-charger";
+		reg = <0x1d>;
+		qcom,parallel-charger;
+		qcom,float-voltage-mv = <4400>;
+		qcom,recharge-mv = <100>;
+	};
+};
+
+&usb_otg_switch {
+	status = "disabled";
+};
+
+&pm8994_mpps {
+	mpp@a100 { /* MPP 2 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	mpp@a300 { /* MPP 4 */
+		/* HDMI_5v_vreg regulator enable */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <0>;
+		status = "okay";
+	};
+};
+
+&soc {
+	i2c@75ba000 {
+		synaptics@20 {
+			compatible = "synaptics,dsx";
+			reg = <0x20>;
+			interrupt-parent = <&tlmm>;
+			interrupts = <125 0x2008>;
+			vdd-supply = <&pm8994_l14>;
+			avdd-supply = <&pm8994_l22>;
+			pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+			pinctrl-0 = <&ts_active>;
+			pinctrl-1 = <&ts_suspend>;
+			synaptics,display-coords = <0 0 1599 2559>;
+			synaptics,panel-coords = <0 0 1599 2703>;
+			synaptics,reset-gpio = <&tlmm 89 0x00>;
+			synaptics,irq-gpio = <&tlmm 125 0x2008>;
+			synaptics,disable-gpios;
+			synaptics,fw-name = "PR1702898-s3528t_00350002.img";
+			/* Underlying clocks used by secure touch */
+			clock-names = "iface_clk", "core_clk";
+			clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+				 <&clock_gcc clk_gcc_blsp2_qup6_i2c_apps_clk>;
+		};
+	};
+
+	gen-vkeys {
+		compatible = "qcom,gen-vkeys";
+		label = "synaptics_dsx";
+		qcom,disp-maxx = <1599>;
+		qcom,disp-maxy = <2559>;
+		qcom,panel-maxx = <1599>;
+		qcom,panel-maxy = <2703>;
+		qcom,key-codes = <158 139 102 217>;
+	};
+
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8994_gpios 2 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_snapshot {
+			label = "cam_snapshot";
+			gpios = <&pm8994_gpios 4 0x1>;
+			linux,input-type = <1>;
+			linux,code = <766>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_focus {
+			label = "cam_focus";
+			gpios = <&pm8994_gpios 5 0x1>;
+			linux,input-type = <1>;
+			linux,code = <528>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+
+	sound-9335 {
+		status = "disabled";
+	};
+
+	sound-adp-mmxf {
+		compatible = "qcom,apq8096-asoc-snd-adp-mmxf";
+		qcom,model = "apq8096-adp-mmxf-snd-card";
+
+		asoc-platform = <&pcm0>, <&pcm1>, <&pcm2>, <&voip>, <&voice>,
+				<&loopback>, <&compress>, <&hostless>,
+				<&afe>, <&lsm>, <&routing>, <&pcmnoirq>,
+				<&loopback1>;
+		asoc-platform-names = "msm-pcm-dsp.0", "msm-pcm-dsp.1",
+				"msm-pcm-dsp.2", "msm-voip-dsp",
+				"msm-pcm-voice", "msm-pcm-loopback",
+				"msm-compress-dsp", "msm-pcm-hostless",
+				"msm-pcm-afe", "msm-lsm-client",
+				"msm-pcm-routing", "msm-pcm-dsp-noirq",
+				"msm-pcm-loopback.1";
+		asoc-cpu = <&dai_pri_auxpcm>, <&dai_sec_auxpcm>, <&dai_hdmi>,
+				<&dai_mi2s_sec>, <&dai_mi2s>, <&dai_mi2s_quat>,
+				<&afe_pcm_rx>, <&afe_pcm_tx>,
+				<&afe_proxy_rx>, <&afe_proxy_tx>,
+				<&incall_record_rx>, <&incall_record_tx>,
+				<&incall_music_rx>, <&incall_music2_rx>,
+				<&dai_pri_tdm_tx_0>, <&dai_pri_tdm_tx_1>,
+				<&dai_pri_tdm_tx_2>, <&dai_pri_tdm_tx_3>,
+				<&dai_pri_tdm_rx_0>, <&dai_pri_tdm_rx_1>,
+				<&dai_pri_tdm_rx_2>, <&dai_pri_tdm_rx_3>,
+				<&dai_sec_tdm_tx_0>, <&dai_sec_tdm_tx_1>,
+				<&dai_sec_tdm_tx_2>, <&dai_sec_tdm_tx_3>,
+				<&dai_tert_tdm_rx_0>, <&dai_tert_tdm_rx_1>,
+				<&dai_tert_tdm_rx_2>, <&dai_tert_tdm_rx_3>,
+				<&dai_tert_tdm_rx_4>, <&dai_tert_tdm_tx_0>,
+				<&dai_tert_tdm_tx_1>, <&dai_tert_tdm_tx_2>,
+				<&dai_tert_tdm_tx_3>, <&dai_quat_tdm_rx_0>,
+				<&dai_quat_tdm_rx_1>, <&dai_quat_tdm_rx_2>,
+				<&dai_quat_tdm_rx_3>, <&dai_quat_tdm_tx_0>,
+				<&dai_quat_tdm_tx_1>, <&dai_quat_tdm_tx_2>,
+				<&dai_quat_tdm_tx_3>;
+		asoc-cpu-names = "msm-dai-q6-auxpcm.1", "msm-dai-q6-auxpcm.2",
+				"msm-dai-q6-hdmi.8", "msm-dai-q6-mi2s.1",
+				"msm-dai-q6-mi2s.2", "msm-dai-q6-mi2s.3",
+				"msm-dai-q6-dev.224", "msm-dai-q6-dev.225",
+				"msm-dai-q6-dev.241", "msm-dai-q6-dev.240",
+				"msm-dai-q6-dev.32771", "msm-dai-q6-dev.32772",
+				"msm-dai-q6-dev.32773", "msm-dai-q6-dev.32770",
+				"msm-dai-q6-tdm.36865", "msm-dai-q6-tdm.36867",
+				"msm-dai-q6-tdm.36869", "msm-dai-q6-tdm.36871",
+				"msm-dai-q6-tdm.36864", "msm-dai-q6-tdm.36866",
+				"msm-dai-q6-tdm.36868", "msm-dai-q6-tdm.36870",
+				"msm-dai-q6-tdm.36881", "msm-dai-q6-tdm.36883",
+				"msm-dai-q6-tdm.36885", "msm-dai-q6-tdm.36887",
+				"msm-dai-q6-tdm.36896", "msm-dai-q6-tdm.36898",
+				"msm-dai-q6-tdm.36900", "msm-dai-q6-tdm.36902",
+				"msm-dai-q6-tdm.36904", "msm-dai-q6-tdm.36897",
+				"msm-dai-q6-tdm.36899", "msm-dai-q6-tdm.36901",
+				"msm-dai-q6-tdm.36903", "msm-dai-q6-tdm.36912",
+				"msm-dai-q6-tdm.36914", "msm-dai-q6-tdm.36916",
+				"msm-dai-q6-tdm.36918", "msm-dai-q6-tdm.36913",
+				"msm-dai-q6-tdm.36915", "msm-dai-q6-tdm.36917",
+				"msm-dai-q6-tdm.36919";
+		asoc-codec = <&stub_codec>;
+		asoc-codec-names = "msm-stub-codec.1";
+	};
+
+	loopback1: qcom,msm-pcm-loopback-low-latency {
+		compatible = "qcom,msm-pcm-loopback";
+		qcom,msm-pcm-loopback-low-latency;
+	};
+
+	qcom,msm-dai-mi2s {
+		dai_mi2s_sec: qcom,msm-dai-q6-mi2s-sec {
+			qcom,msm-mi2s-rx-lines = <2>;
+			qcom,msm-mi2s-tx-lines = <1>;
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&sec_mi2s_active &sec_mi2s_sd0_active
+				&sec_mi2s_sd1_active>;
+			pinctrl-1 = <&sec_mi2s_sleep &sec_mi2s_sd0_sleep
+				&sec_mi2s_sd1_sleep>;
+		};
+
+		dai_mi2s_quat: qcom,msm-dai-q6-mi2s-quat {
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&quat_mi2s_active &quat_mi2s_sd0_active>;
+			pinctrl-1 = <&quat_mi2s_sleep &quat_mi2s_sd0_sleep>;
+		};
+	};
+
+	qcom,msm-dai-tdm-tert-rx {
+		pinctrl-names = "default", "sleep";
+		pinctrl-0 = <&tert_tdm_dout_active>;
+		pinctrl-1 = <&tert_tdm_dout_sleep>;
+	};
+
+	qcom,msm-dai-tdm-quat-rx {
+		pinctrl-names = "default", "sleep";
+		pinctrl-0 = <&quat_tdm_dout_active>;
+		pinctrl-1 = <&quat_tdm_dout_sleep>;
+		dai_quat_tdm_rx_0: qcom,msm-dai-q6-tdm-quat-rx-0 {
+			qcom,msm-cpudai-tdm-header-start-offset = <0>;
+			qcom,msm-cpudai-tdm-header-width = <2>;
+			qcom,msm-cpudai-tdm-header-num-frame-repeat = <8>;
+		};
+
+		dai_quat_tdm_rx_1: qcom,msm-dai-q6-tdm-quat-rx-1 {
+			qcom,msm-cpudai-tdm-header-start-offset = <0>;
+			qcom,msm-cpudai-tdm-header-width = <2>;
+			qcom,msm-cpudai-tdm-header-num-frame-repeat = <8>;
+		};
+
+		dai_quat_tdm_rx_2: qcom,msm-dai-q6-tdm-quat-rx-2 {
+			qcom,msm-cpudai-tdm-header-start-offset = <0>;
+			qcom,msm-cpudai-tdm-header-width = <2>;
+			qcom,msm-cpudai-tdm-header-num-frame-repeat = <8>;
+		};
+
+		dai_quat_tdm_rx_3: qcom,msm-dai-q6-tdm-quat-rx-3 {
+			qcom,msm-cpudai-tdm-header-start-offset = <0>;
+			qcom,msm-cpudai-tdm-header-width = <2>;
+			qcom,msm-cpudai-tdm-header-num-frame-repeat = <8>;
+		};
+	};
+};
+
+&pm8994_gpios {
+	gpio@c600 { /* GPIO 7 - NFC DWL REQ */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <3>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@c700 { /* GPIO 8 - WLAN_EN */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@c800 { /* GPIO 9 - Rome 3.3V control */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* MOS logic */
+		qcom,invert = <1>;		/* Output high */
+		qcom,vin-sel = <0>;		/* VPH_PWR */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,out-strength = <1>;	/* High drive strength */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@c900 { /* GPIO 10 - NFC CLK _REQ*/
+		qcom,mode = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@cd00 { /* GPIO 14 - lcd_bklt_reg_en */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <1>;	/* output hight initially */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,out-strength = <1>;	/* Low drive strength */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+	gpio@c100 { /* GPIO 2 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c300 { /* GPIO 4 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c400 { /* GPIO 5 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@cc00 { /* GPIO 13 - HPH_EN0 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@ce00 { /* GPIO 15 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@d100 { /* GPIO 18 - Rome Sleep Clock */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <0>;		/* Output low initially */
+		qcom,vin-sel = <2>;		/* VIN 2 */
+		qcom,src-sel = <3>;		/* Function 2 */
+		qcom,out-strength = <2>;	/* Medium */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@d200 { /* GPIO 19 - Rome BT Reset */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&blsp1_uart2 {
+	status = "ok";
+};
+
+&i2c_6 {
+	at24@51 {
+		compatible = "atmel,24c32";
+		reg = <0x51>;
+	};
+};
+
+&i2c_7 {
+	silabs4705@11 { /* SiLabs FM chip, slave id 0x11*/
+		status = "ok";
+		compatible = "silabs,si4705";
+		reg = <0x11>;
+		vdd-supply = <&pm8994_s4>;
+		silabs,vdd-supply-voltage = <1800000 1800000>;
+		va-supply = <&rome_vreg>;
+		silabs,va-supply-voltage = <3300000 3300000>;
+		pinctrl-names = "pmx_fm_active","pmx_fm_suspend";
+		pinctrl-0 = <&fm_int_active &fm_status_int_active
+						&fm_rst_active>;
+		pinctrl-1 = <&fm_int_suspend &fm_status_int_suspend
+						&fm_rst_suspend>;
+		silabs,reset-gpio = <&tlmm 39 0>;
+		silabs,int-gpio = <&tlmm 38 0>;
+		silabs,status-gpio = <&tlmm 78 0>;
+		#address-cells = <0>;
+		interrupts = <0 1>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-map = <
+				  0 &tlmm 38 2
+				  1 &tlmm 78 1
+				>;
+		interrupt-names = "silabs_fm_int", "silabs_fm_status_int";
+	};
+};
+
+&i2c_8 { /* BLSP2 QUP2 */
+	nq@28 {
+		compatible = "qcom,nq-nci";
+		reg = <0x28>;
+		qcom,nq-irq = <&tlmm 9 0x00>;
+		qcom,nq-ven = <&tlmm 12 0x00>;
+		qcom,nq-firm = <&pm8994_gpios 7 0x00>;
+		qcom,nq-clkreq = <&pm8994_gpios 10 0x00>;
+		interrupt-parent = <&tlmm>;
+		qcom,clk-src = "BBCLK2";
+		interrupts = <9 0>;
+		interrupt-names = "nfc_irq";
+		pinctrl-names = "nfc_active", "nfc_suspend";
+		pinctrl-0 = <&nfc_int_active &nfc_disable_active>;
+		pinctrl-1 = <&nfc_int_suspend &nfc_disable_suspend>;
+		clocks = <&clock_gcc clk_bb_clk2_pin>;
+		clock-names = "ref_clk";
+	};
+};
+
+&usb3 {
+	vdda33-supply = <&pm8994_l24>;
+	vdda18-supply = <&pm8994_l12>;
+};
+
+&dsi_dual_jdi_video {
+	/delete-property/ pwms;
+	/delete-property/ qcom,5v-boost-gpio;
+};
+
+&dsi_dual_jdi_cmd {
+	/delete-property/ pwms;
+	/delete-property/ qcom,5v-boost-gpio;
+};
+
+&dsi_dual_jdi_4k_nofbc_video {
+	/delete-property/ pwms;
+};
+
+&soc {
+	sound-9335 {
+	/delete-property/ qcom,hph-en1-gpio;
+	};
+};
+
+&slim_msm {
+	status = "disabled";
+};
+
+/delete-node/  &led_flash0;
+
+&mdss_dsi0 {
+	/delete-property/ lab-supply;
+	/delete-property/ ibb-supply;
+};
+
+&mdss_dsi1 {
+	/delete-property/ lab-supply;
+	/delete-property/ ibb-supply;
+};
+
+&usb3 {
+	/delete-property/ vbus_dwc3-supply;
+};
+
+&cci {
+	qcom,camera@0 {
+		/delete-property/ qcom,led-flash-src;
+	};
+
+	qcom,camera@1 {
+		/delete-property/ cam_vana-supply;
+	};
+};
+
+&usb_otg_switch {
+	/delete-property/ gpio;
+	/delete-property/ vin-supply;
+};
+
+&wsa881x_211 {
+	status = "disabled";
+	/delete-property/ qcom,spkr-sd-n-gpio;
+};
+
+&wsa881x_212 {
+	status = "disabled";
+	/delete-property/ qcom,spkr-sd-n-gpio;
+};
+
+&wsa881x_213 {
+	status = "disabled";
+	/delete-property/ qcom,spkr-sd-n-gpio;
+};
+
+&wsa881x_214 {
+	status = "disabled";
+	/delete-property/ qcom,spkr-sd-n-gpio;
+};
+
+&spi_0 {
+	spi_codec@0 {
+		compatible = "qcom,spi-msm-codec-slave";
+		reg = <0>;
+		spi-max-frequency = <2000000>;
+		spi-cpha;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-mtp.dtsi b/arch/arm64/boot/dts/qcom/msm8996-mtp.dtsi
new file mode 100644
index 000000000000..0bd9b02f3d2e
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-mtp.dtsi
@@ -0,0 +1,961 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8996-pinctrl.dtsi"
+#include "msm8996-camera-sensor-mtp.dtsi"
+#include "msm8996-wsa881x.dtsi"
+
+/ {
+	bluetooth: bt_qca6174 {
+		compatible = "qca,qca6174";
+		qca,bt-reset-gpio = <&pm8994_gpios 19 0>; /* BT_EN */
+		qca,bt-vdd-core-supply = <&pm8994_s3>;
+		qca,bt-vdd-pa-supply = <&rome_vreg>;
+		qca,bt-vdd-io-supply = <&pm8994_s4>;
+		qca,bt-vdd-xtal-supply = <&pm8994_l30>;
+		qca,bt-chip-pwd-voltage-level = <1300000 1300000>;
+		qca,bt-vdd-io-voltage-level = <1800000 1800000>;
+		qca,bt-vdd-xtal-voltage-level = <1800000 1800000>;
+	};
+};
+
+&ufs_ice {
+        status = "ok";
+};
+
+&sdcc1_ice {
+        status = "ok";
+};
+
+&ufsphy1 {
+	status = "ok";
+};
+
+&ufs1 {
+	status = "ok";
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+
+};
+
+&sdhc_1 {
+	vdd-supply = <&pm8994_l20>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	vdd-io-supply = <&pm8994_s4>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <110 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 96000000 192000000 384000000>;
+	qcom,ice-clk-rates = <300000000 150000000>;
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8994_l21>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8994_l13>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x1>;
+
+	status = "ok";
+};
+
+&pm8994_vadc {
+	chan@5 {
+		label = "vcoin";
+		reg = <5>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7 {
+		label = "vph_pwr";
+		reg = <7>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8994_adc_tm {
+	chan@73 {
+		label = "msm_therm";
+		reg = <0x73>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x48>;
+		qcom,thermal-node;
+	};
+
+	chan@74 {
+		label = "emmc_therm";
+		reg = <0x74>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@75 {
+		label = "pa_therm0";
+		reg = <0x75>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@77 {
+		label = "pa_therm1";
+		reg = <0x77>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+
+	chan@78 {
+		label = "quiet_therm";
+		reg = <0x78>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x80>;
+		qcom,thermal-node;
+	};
+
+	chan@7c {
+		label = "xo_therm_buf";
+		reg = <0x7c>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+		qcom,btm-channel-number = <0x88>;
+		qcom,thermal-node;
+	};
+};
+
+&mdss_hdmi_tx {
+	pinctrl-names = "hdmi_hpd_active", "hdmi_ddc_active", "hdmi_cec_active",
+				"hdmi_active", "hdmi_sleep";
+	pinctrl-0 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_suspend
+						&mdss_hdmi_cec_suspend>;
+	pinctrl-1 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+						&mdss_hdmi_cec_suspend>;
+	pinctrl-2 = <&mdss_hdmi_hpd_active &mdss_hdmi_cec_active
+						&mdss_hdmi_ddc_suspend>;
+	pinctrl-3 = <&mdss_hdmi_hpd_active &mdss_hdmi_ddc_active
+						&mdss_hdmi_cec_active>;
+	pinctrl-4 = <&mdss_hdmi_hpd_suspend &mdss_hdmi_ddc_suspend
+						&mdss_hdmi_cec_suspend>;
+};
+
+&pmi8994_vadc {
+	chan@0 {
+		label = "usbin";
+		reg = <0>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <4>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@1 {
+		label = "dcin";
+		reg = <1>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <4>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@43 {
+		label = "usb_dp";
+		reg = <0x43>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@44 {
+		label = "usb_dm";
+		reg = <0x44>;
+		qcom,decimation = <0>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+#include "msm8996-sde-display.dtsi"
+#include "msm8996-mdss-panels.dtsi"
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&sde_hdmi {
+	status = "ok";
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_sharp_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+	qcom,platform-bklight-en-gpio = <&pm8994_gpios 14 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_sharp_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+	qcom,platform-bklight-en-gpio = <&pm8994_gpios 14 0>;
+};
+
+&ibb_regulator {
+	qcom,qpnp-ibb-discharge-resistor = <32>;
+};
+
+&labibb {
+	status = "ok";
+	qcom,qpnp-labibb-mode = "lcd";
+};
+
+&dsi_tosh_720_vid {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_vdd_no_labibb>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+	qcom,platform-bklight-en-gpio = <&pm8994_gpios 14 0>;
+	qcom,5v-boost-gpio = <&pmi8994_gpios 8 0>;
+};
+
+&dsi_dual_sharp_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+	qcom,platform-bklight-en-gpio = <&pm8994_gpios 14 0>;
+};
+
+&dsi_sharp_1080_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+	qcom,platform-bklight-en-gpio = <&pm8994_gpios 14 0>;
+	qcom,5v-boost-gpio = <&pmi8994_gpios 8 0>;
+};
+
+&dsi_dual_nt35597_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+};
+
+&dsi_dual_nt35597_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled = "single_roi";
+	qcom,panel-roi-alignment = <720 128 720 64 720 64>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+};
+
+&dsi_nt35950_4k_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_4k_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_4k_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled = "single_roi";
+	/* panel supports slice height of 8/16/32/48/3840 */
+	qcom,panel-roi-alignment = <1080 8 1080 8 1080 8>;
+};
+
+&dsi_nt35597_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35597_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_sharp_1080_120hz_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_jdi_video {
+	pwms = <&pmi8994_pwm_4 0 0>;
+	pwm-names = "backlight";
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-pwm-pmi;
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,5v-boost-gpio = <&pmi8994_gpios 8 0>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_jdi_cmd {
+	pwms = <&pmi8994_pwm_4 0 0>;
+	pwm-names = "backlight";
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-pwm-pmi;
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,5v-boost-gpio = <&pmi8994_gpios 8 0>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled = "single_roi";
+	qcom,panel-roi-alignment = <4 4 2 2 20 20>;
+};
+
+&dsi_dual_jdi_4k_nofbc_video {
+	pwms = <&pmi8994_pwm_4 0 0>;
+	pwm-names = "backlight";
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-pwm-pmi;
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_jdi_1080p_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,cont-splash-enabled;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_no_labibb>;
+	qcom,platform-reset-gpio = <&tlmm 8 0>;
+	qcom,platform-bklight-en-gpio = <&pm8994_gpios 14 0>;
+	qcom,5v-boost-gpio = <&pmi8994_gpios 8 0>;
+};
+
+/{
+	mtp_batterydata: qcom,battery-data {
+		qcom,batt-id-range-pct = <15>;
+		#include "batterydata-itech-3000mah.dtsi"
+	};
+};
+
+&usb3 {
+	extcon = <&pmi8994_charger>;
+};
+
+&i2c_7 {
+	smb1351-charger@1d {
+		compatible = "qcom,smb1351-charger";
+		reg = <0x1d>;
+		qcom,parallel-charger;
+		qcom,float-voltage-mv = <4400>;
+		qcom,recharge-mv = <100>;
+	};
+};
+
+&pmi8994_charger {
+	dpdm-supply = <&qusb_phy0>;
+};
+
+&pmi8994_fg {
+	qcom,battery-data = <&mtp_batterydata>;
+	qcom,ext-sense-type;
+};
+
+&usb_otg_switch {
+	status = "okay";
+};
+
+&pm8994_mpps {
+	mpp@a100 { /* MPP 2 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	mpp@a300 { /* MPP 4 */
+		/* HDMI_5v_vreg regulator enable */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		qcom,invert = <1>;
+		status = "okay";
+	};
+};
+
+&pmi8994_gpios {
+	gpio@c400 { /* GPIO 5 - USB3 OTG SWITCH EN */
+		qcom,mode = <1>;	/* Digital output */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* GPIO */
+		qcom,master-en = <1>;	/* Enable GPIO */
+		qcom,invert = <0>;	/* Output low initially */
+		status = "okay";
+	};
+};
+
+&pmi8994_gpios {
+	gpio@c700 {	/* GPIO 8, lcd_reg_en, 5V boost  */
+		qcom,mode = <1>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		qcom,invert = <1>;   /* need invert = 0 */
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@c100 {	/* GPIO 2  SPKR_SD_N */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c200 {	/* GPIO 3 SPKR_SD_N */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,pull = <5>;	/* No Pull */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+
+	gpio@c900 { /* GPIO 10 - HPH_EN1 */
+		qcom,mode = <1>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&pmi8994_pwm_4 {
+	qcom,channel-owner = "lcd_bl";
+	qcom,dtest-line = <4>;
+	qcom,dtest-output = <1>;
+	status = "okay";
+};
+
+&pmi8994_mpps {
+	mpp@a000 { /* MPP 1 */
+		qcom,mode = <1>;                /* Digital output */
+		qcom,output-type = <0>;         /* CMOS logic */
+		qcom,vin-sel = <2>;             /* S4 1.8V */
+		qcom,src-sel = <7>;             /* DTEST4 */
+		qcom,master-en = <1>;           /* Enable MPP */
+		status = "okay";
+	};
+
+	mpp@a300 { /* MPP 4 */
+		/* WLED FET */
+		qcom,mode = <1>;        /* DIGITAL OUT */
+		qcom,vin-sel = <0>;     /* VIN0 */
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&soc {
+	i2c@75ba000 {
+		synaptics@20 {
+			compatible = "synaptics,dsx";
+			reg = <0x20>;
+			interrupt-parent = <&tlmm>;
+			interrupts = <125 0x2008>;
+			vdd-supply = <&pm8994_l14>;
+			avdd-supply = <&pm8994_l22>;
+			synaptics,vdd-voltage = <1800000 1800000>;
+			synaptics,avdd-voltage = <3300000 3300000>;
+			synaptics,vdd-current = <40000>;
+			synaptics,avdd-current = <20000>;
+			pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+			pinctrl-0 = <&ts_active>;
+			pinctrl-1 = <&ts_suspend>;
+			synaptics,display-coords = <0 0 1599 2559>;
+			synaptics,panel-coords = <0 0 1599 2703>;
+			synaptics,reset-gpio = <&tlmm 89 0x00>;
+			synaptics,irq-gpio = <&tlmm 125 0x2008>;
+			synaptics,disable-gpios;
+			synaptics,fw-name = "PR1702898-s3528t_00350002.img";
+			/* Underlying clocks used by secure touch */
+			clock-names = "iface_clk", "core_clk";
+			clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+				 <&clock_gcc clk_gcc_blsp2_qup6_i2c_apps_clk>;
+		};
+	};
+
+	gen-vkeys {
+		compatible = "qcom,gen-vkeys";
+		label = "synaptics_dsx";
+		qcom,disp-maxx = <1599>;
+		qcom,disp-maxy = <2559>;
+		qcom,panel-maxx = <1599>;
+		qcom,panel-maxy = <2703>;
+		qcom,key-codes = <158 139 102 217>;
+	};
+
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8994_gpios 2 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_snapshot {
+			label = "cam_snapshot";
+			gpios = <&pm8994_gpios 4 0x1>;
+			linux,input-type = <1>;
+			linux,code = <766>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_focus {
+			label = "cam_focus";
+			gpios = <&pm8994_gpios 5 0x1>;
+			linux,input-type = <1>;
+			linux,code = <528>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+
+	sound-9335 {
+		qcom,model = "msm8996-tasha-mtp-snd-card";
+
+		qcom,audio-routing =
+			"AIF4 VI", "MCLK",
+			"RX_BIAS", "MCLK",
+			"MADINPUT", "MCLK",
+			"hifi amp", "LINEOUT1",
+			"hifi amp", "LINEOUT2",
+			"AMIC2", "MIC BIAS2",
+			"MIC BIAS2", "Headset Mic",
+			"AMIC3", "MIC BIAS2",
+			"MIC BIAS2", "ANCRight Headset Mic",
+			"AMIC4", "MIC BIAS2",
+			"MIC BIAS2", "ANCLeft Headset Mic",
+			"AMIC5", "MIC BIAS3",
+			"MIC BIAS3", "Handset Mic",
+			"AMIC6", "MIC BIAS4",
+			"MIC BIAS4", "Analog Mic6",
+			"DMIC0", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic0",
+			"DMIC1", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic1",
+			"DMIC2", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic2",
+			"DMIC3", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic3",
+			"DMIC4", "MIC BIAS4",
+			"MIC BIAS4", "Digital Mic4",
+			"DMIC5", "MIC BIAS4",
+			"MIC BIAS4", "Digital Mic5",
+			"SpkrLeft IN", "SPK1 OUT",
+			"SpkrRight IN", "SPK2 OUT";
+
+		asoc-codec = <&stub_codec>, <&hdmi_audio>;
+		asoc-codec-names = "msm-stub-codec.1", "msm-hdmi-audio-codec-rx";
+		qcom,hph-en1-gpio = <&pmi8994_gpios 10 0>;
+		qcom,hph-en0-gpio = <&pm8994_gpios 13 0>;
+		qcom,us-euro-gpios = <&pm8994_mpps 2 0>;
+		qcom,wsa-max-devs = <2>;
+		qcom,wsa-devs = <&wsa881x_211>, <&wsa881x_212>,
+				<&wsa881x_213>, <&wsa881x_214>;
+		qcom,wsa-aux-dev-prefix = "SpkrLeft", "SpkrRight",
+					  "SpkrLeft", "SpkrRight";
+	};
+};
+
+&pm8994_gpios {
+	gpio@c600 { /* GPIO 7 - NFC DWL REQ */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <3>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@c700 { /* GPIO 8 - WLAN_EN */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@c800 { /* GPIO 9 - Rome 3.3V control */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* MOS logic */
+		qcom,invert = <1>;		/* Output high */
+		qcom,vin-sel = <0>;		/* VPH_PWR */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,out-strength = <1>;	/* High drive strength */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@c900 { /* GPIO 10 - NFC CLK _REQ*/
+		qcom,mode = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@cd00 { /* GPIO 14 - lcd_bklt_reg_en */
+		qcom,mode = <1>;	/* DIGITAL OUT */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <1>; 	/* output hight initially */
+		qcom,vin-sel = <2>;	/* 1.8 */
+		qcom,src-sel = <0>;	/* CONSTANT */
+		qcom,out-strength = <1>;	/* Low drive strength */
+		qcom,master-en = <1>;	/* ENABLE GPIO */
+		status = "okay";
+	};
+	gpio@c100 { /* GPIO 2 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c300 { /* GPIO 4 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@c400 { /* GPIO 5 */
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <2>;
+		qcom,src-sel = <0>;
+		status = "okay";
+	};
+
+	gpio@cc00 { /* GPIO 13 - HPH_EN0 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@ce00 { /* GPIO 15 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@d100 { /* GPIO 18 - Rome Sleep Clock */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,invert = <0>;		/* Output low initially */
+		qcom,vin-sel = <2>;		/* VIN 2 */
+		qcom,src-sel = <3>;		/* Function 2 */
+		qcom,out-strength = <2>;	/* Medium */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	gpio@d200 { /* GPIO 19 - Rome BT Reset */
+		qcom,mode = <1>;		/* Digital output*/
+		qcom,pull = <4>;		/* Pulldown 10uA */
+		qcom,vin-sel = <2>;		/* VIN2 */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&pmi8994_haptics {
+	status = "okay";
+};
+
+&flash_led {
+	qcom,follow-otst2-rb-disabled;
+};
+
+&blsp1_uart2 {
+	status = "ok";
+};
+
+&i2c_6 {
+	at24@51 {
+		compatible = "atmel,24c32";
+		reg = <0x51>;
+	};
+};
+
+&i2c_7 {
+	silabs4705@11 { /* SiLabs FM chip, slave id 0x11*/
+		status = "ok";
+		compatible = "silabs,si4705";
+		reg = <0x11>;
+		vdd-supply = <&pm8994_s4>;
+		silabs,vdd-supply-voltage = <1800000 1800000>;
+		va-supply = <&rome_vreg>;
+		silabs,va-supply-voltage = <3300000 3300000>;
+		pinctrl-names = "pmx_fm_active","pmx_fm_suspend";
+		pinctrl-0 = <&fm_int_active &fm_status_int_active &fm_rst_active>;
+		pinctrl-1 = <&fm_int_suspend &fm_status_int_suspend &fm_rst_suspend>;
+		silabs,reset-gpio = <&tlmm 39 0>;
+		silabs,int-gpio = <&tlmm 38 0>;
+		silabs,status-gpio = <&tlmm 78 0>;
+		#address-cells = <0>;
+		interrupts = <0 1>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-map = <
+				  0 &tlmm 38 2
+				  1 &tlmm 78 1
+				>;
+		interrupt-names = "silabs_fm_int", "silabs_fm_status_int";
+	};
+};
+
+&i2c_8 { /* BLSP2 QUP2 */
+	nq@28 {
+		compatible = "qcom,nq-nci";
+		reg = <0x28>;
+		qcom,nq-irq = <&tlmm 9 0x00>;
+		qcom,nq-ven = <&tlmm 12 0x00>;
+		qcom,nq-firm = <&pm8994_gpios 7 0x00>;
+		qcom,nq-clkreq = <&pm8994_gpios 10 0x00>;
+		interrupt-parent = <&tlmm>;
+		qcom,clk-src = "BBCLK2";
+		interrupts = <9 0>;
+		interrupt-names = "nfc_irq";
+		pinctrl-names = "nfc_active", "nfc_suspend";
+		pinctrl-0 = <&nfc_int_active &nfc_disable_active>;
+		pinctrl-1 = <&nfc_int_suspend &nfc_disable_suspend>;
+		clocks = <&clock_gcc clk_bb_clk2_pin>;
+		clock-names = "ref_clk";
+	};
+};
+
+&wil6210 {
+	status = "ok";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-pinctrl.dtsi b/arch/arm64/boot/dts/qcom/msm8996-pinctrl.dtsi
new file mode 100644
index 000000000000..316859a65801
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-pinctrl.dtsi
@@ -0,0 +1,2735 @@
+/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	tlmm: pinctrl@01010000 {
+		compatible = "qcom,msm8996-pinctrl";
+		reg = <0x01010000 0x300000>;
+		interrupts = <0 208 0>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+
+		/* pin governing mux between QSPI and modem on auto boards */
+		modem_mux: mdm_mux {
+			mux {
+				pins = "gpio121";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio121";
+				drive-strength = <2>;
+				bias-pull-up;
+				output-high;
+			};
+		};
+		/* add pingrp for adv7533 */
+		pmx_adv7533: pmx_adv7533 {
+			adv7533_0_int_active: adv7533_0_int_active {
+				mux {
+					pins = "gpio106";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio106";
+					drive-strength = <16>; /* 16 mA */
+					bias-pull-down; /* pull down */
+				};
+			};
+
+			adv7533_0_int_suspend: adv7533_0_int_suspend {
+				mux {
+					pins = "gpio106";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio106";
+					drive-strength = <16>; /* 16 mA */
+					bias-pull-down; /* pull down */
+				};
+			};
+
+			adv7533_0_hpd_int_active: adv7533_0_hpd_int_active {
+				mux {
+					pins = "gpio104";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio104";
+					drive-strength = <16>; /* 16 mA */
+					bias-pull-down; /* pull down */
+				};
+			};
+
+			adv7533_0_hpd_int_suspend: adv7533_0_hpd_int_suspend {
+				mux {
+					pins = "gpio104";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio104";
+					drive-strength = <16>; /* 16 mA */
+					bias-pull-down; /* pull down */
+				};
+			};
+
+			adv7533_0_switch_active: adv7533_0_switch_active {
+				mux {
+					pins = "gpio105";
+					function = "gpio";
+					bias-pull-down; /* pull down */
+				};
+
+				config {
+					pins = "gpio105";
+					drive-strength = <16>; /* 16 mA */
+					bias-pull-down; /* pull down */
+				};
+			};
+
+			adv7533_0_switch_suspend: adv7533_0_switch_suspend {
+				mux {
+					pins = "gpio105";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio105";
+					drive-strength = <16>; /* 16 mA */
+				};
+			};
+			adv7533_1_int_active: adv7533_1_int_active {
+				mux {
+					pins = "gpio108";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio108";
+					drive-strength = <16>; /* 16 mA */
+					bias-pull-down; /* pull down */
+				};
+			};
+
+			adv7533_1_int_suspend: adv7533_1_int_suspend {
+				mux {
+					pins = "gpio108";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio108";
+					drive-strength = <16>; /* 16 mA */
+					bias-pull-down; /* pull down */
+				};
+			};
+
+			adv7533_1_hpd_int_active: adv7533_1_hpd_int_active {
+				mux {
+					pins = "gpio103";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio103";
+					drive-strength = <16>; /* 16 mA */
+					bias-pull-down; /* pull down */
+				};
+			};
+
+			adv7533_1_hpd_int_suspend: adv7533_1_hpd_int_suspend {
+				mux {
+					pins = "gpio103";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio103";
+					drive-strength = <16>; /* 16 mA */
+					bias-pull-down; /* pull down */
+				};
+			};
+
+			adv7533_1_switch_active: adv7533_1_switch_active {
+				mux {
+					pins = "gpio107";
+					function = "gpio";
+					bias-pull-down; /* pull down */
+				};
+
+				config {
+					pins = "gpio107";
+					drive-strength = <16>; /* 16 mA */
+					bias-pull-down; /* pull down */
+				};
+			};
+
+			adv7533_1_switch_suspend: adv7533_1_switch_suspend {
+				mux {
+					pins = "gpio107";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio107";
+					drive-strength = <16>; /* 16 mA */
+				};
+			};
+		};
+
+		uart_console_active: uart_console_active {
+			mux {
+				pins = "gpio4", "gpio5";
+				function = "blsp_uart8";
+			};
+
+			config {
+				pins = "gpio4", "gpio5";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp1_uart2_active: blsp1_uart2_active {
+			mux {
+				pins = "gpio41", "gpio42", "gpio43", "gpio44";
+				function = "blsp_uart2";
+			};
+
+			config {
+				pins = "gpio41", "gpio42", "gpio43", "gpio44";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp1_uart2_sleep: blsp1_uart2_sleep {
+			mux {
+				pins = "gpio41", "gpio42", "gpio43", "gpio44";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio41", "gpio42", "gpio43", "gpio44";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+
+		blsp1_uart3_active: blsp1_uart3_active {
+			mux {
+				pins = "gpio45", "gpio46", "gpio47", "gpio48";
+				function = "blsp_uart3";
+			};
+
+			config {
+				pins = "gpio45", "gpio46", "gpio47", "gpio48";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp1_uart3_sleep: blsp1_uart3_sleep {
+			mux {
+				pins = "gpio45", "gpio46", "gpio47", "gpio48";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio45", "gpio46", "gpio47", "gpio48";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+
+		blsp1_uart6_active: blsp1_uart6_active {
+			mux {
+				pins = "gpio25", "gpio26", "gpio27", "gpio28";
+				function = "blsp_uart6";
+			};
+
+			config {
+				pins = "gpio25", "gpio26", "gpio27", "gpio28";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp1_uart6_sleep: blsp1_uart6_sleep {
+			mux {
+				pins = "gpio25", "gpio26", "gpio27", "gpio28";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio25", "gpio26", "gpio27", "gpio28";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+
+		pmx_mdss: pmx_mdss {
+			mdss_dsi_active: mdss_dsi_active {
+				mux {
+					pins = "gpio8";
+					function = "gpio";
+				};
+
+				pmx_mdss {
+					pins = "gpio8";
+					drive-strength = <8>; /* 8 mA */
+					bias-disable = <0>; /* no pull */
+				};
+			};
+			mdss_dsi_suspend: mdss_dsi_suspend {
+				mux {
+					pins = "gpio8";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio8";
+					drive-strength = <2>; /* 2 mA */
+					bias-pull-down; /* pull down */
+				};
+			};
+		};
+
+		mdss_te_active: mdss_te_active {
+			mux {
+				pins = "gpio10";
+				function = "mdp_vsync";
+			};
+			config {
+				pins = "gpio10";
+				drive-strength = <2>; /* 8 mA */
+				bias-pull-down; /* pull down*/
+			};
+		};
+
+
+		mdss_te_suspend: mdss_te_suspend {
+			mux {
+				pins = "gpio10";
+				function = "mdp_vsync";
+			};
+			config {
+				pins = "gpio10";
+				drive-strength = <2>; /* 2 mA */
+				bias-pull-down; /* pull down */
+			};
+		};
+
+		mdss_disp_bkl_active: mdss_disp_bkl_active {
+			config {
+				pins = "gpio135";
+				drive-strength = <8>; /* 8 mA */
+				bias-disable; /* no pull */
+				output-high;
+			};
+		};
+
+		mdss_disp_bkl_suspend: mdss_disp_bkl_suspend {
+			config {
+				pins = "gpio135";
+				drive-strength = <2>; /* 2 mA */
+				bias-pull-down; /* pull down */
+			};
+		};
+
+		mdss_hdmi_hpd_active: mdss_hdmi_hpd_active {
+			mux {
+				pins = "gpio34";
+				function = "hdmi_hot";
+			};
+
+			config {
+				pins = "gpio34";
+				bias-pull-down;
+				drive-strength = <16>;
+			};
+		};
+
+		mdss_hdmi_hpd_suspend: mdss_hdmi_hpd_suspend {
+			mux {
+				pins = "gpio34";
+				function = "hdmi_hot";
+			};
+
+			config {
+				pins = "gpio34";
+				bias-pull-down;
+				drive-strength = <2>;
+			};
+		};
+
+		mdss_hdmi_ddc_active: mdss_hdmi_ddc_active {
+			mux {
+				pins = "gpio32", "gpio33";
+				function = "hdmi_ddc";
+			};
+
+			config {
+				pins = "gpio32", "gpio33";
+				drive-strength = <2>;
+				bias-pull-up;
+			};
+		};
+
+		mdss_hdmi_ddc_suspend: mdss_hdmi_ddc_suspend {
+			mux {
+				pins = "gpio32", "gpio33";
+				function = "hdmi_ddc";
+			};
+
+			config {
+				pins = "gpio32", "gpio33";
+				drive-strength = <2>;
+				bias-pull-up;
+			};
+		};
+
+		mdss_hdmi_cec_active: mdss_hdmi_cec_active {
+			mux {
+				pins = "gpio31";
+				function = "hdmi_cec";
+			};
+
+			config {
+				pins = "gpio31";
+				drive-strength = <2>;
+				bias-pull-up;
+			};
+		};
+
+		mdss_hdmi_cec_suspend: mdss_hdmi_cec_suspend {
+			mux {
+				pins = "gpio31";
+				function = "hdmi_cec";
+			};
+
+			config {
+				pins = "gpio31";
+				drive-strength = <2>;
+				bias-pull-up;
+			};
+		};
+
+		usb_hub_reset_active: usb_hub_reset_active {
+			usb_hub_reset_active {
+				pins = "gpio103";
+				drive-strength = <8>; /* 8 mA */
+				bias-pull-up;  /* pull up */
+				output-high;
+			};
+		};
+
+		usb_hub_reset_suspend: usb_hub_reset_suspend {
+			usb_hub_reset_suspend {
+				pins = "gpio103";
+				drive-strength = <2>; /* 2 mA */
+				bias-disable= <0>; /* no pull */
+			};
+		};
+
+
+		gp_switch_active: gp_switch_active {
+			gp_switch_active {
+				pins = "gpio127";
+				drive-strength = <8>; /* 8 mA */
+				bias-pull-up;  /* pull up */
+				output-low;
+			};
+		};
+
+		gp_switch_suspend: gp_switch_suspend {
+			gp_switch_suspend {
+				pins = "gpio127";
+				drive-strength = <2>; /* 2 mA */
+				bias-disable= <0>; /* no pull */
+			};
+		};
+
+
+		sdc1_clk_on: sdc1_clk_on {
+			config {
+				pins = "sdc1_clk";
+				bias-disable;		/* NO pull */
+				drive-strength = <16>;	/* 16 MA */
+			};
+		};
+
+		sdc1_clk_off: sdc1_clk_off {
+			config {
+				pins = "sdc1_clk";
+				bias-disable;		/* NO pull */
+				drive-strength = <2>;	/* 2 MA */
+			};
+		};
+
+		sdc1_cmd_on: sdc1_cmd_on {
+			config {
+				pins = "sdc1_cmd";
+				bias-pull-up;		/* pull up */
+				drive-strength = <10>;	/* 10 MA */
+			};
+		};
+
+		sdc1_cmd_off: sdc1_cmd_off {
+			config {
+				pins = "sdc1_cmd";
+				num-grp-pins = <1>;
+				bias-pull-up;		/* pull up */
+				drive-strength = <2>;	/* 2 MA */
+			};
+		};
+
+		sdc1_data_on: sdc1_data_on {
+			config {
+				pins = "sdc1_data";
+				bias-pull-up;		/* pull up */
+				drive-strength = <10>;	/* 10 MA */
+			};
+		};
+
+		sdc1_data_off: sdc1_data_off {
+			config {
+				pins = "sdc1_data";
+				bias-pull-up;		/* pull up */
+				drive-strength = <2>;	/* 2 MA */
+			};
+		};
+
+		sdc1_rclk_on: sdc1_rclk_on {
+			config {
+				pins = "sdc1_rclk";
+				bias-pull-down;		/* pull down */
+			};
+		};
+
+		sdc1_rclk_off: sdc1_rclk_off {
+			config {
+				pins = "sdc1_rclk";
+				bias-pull-down;		/* pull down */
+			};
+		};
+
+		sdc2_clk_on: sdc2_clk_on {
+			config {
+				pins = "sdc2_clk";
+				bias-disable;		/* NO pull */
+				drive-strength = <16>;	/* 16 MA */
+			};
+		};
+
+		sdc2_clk_off: sdc2_clk_off {
+			config {
+				pins = "sdc2_clk";
+				bias-disable;		/* NO pull */
+				drive-strength = <2>;	/* 2 MA */
+			};
+		};
+
+		sdc2_cmd_on: sdc2_cmd_on {
+			config {
+				pins = "sdc2_cmd";
+				bias-pull-up;		/* pull up */
+				drive-strength = <10>;	/* 10 MA */
+			};
+		};
+
+		sdc2_cmd_off: sdc2_cmd_off {
+			config {
+				pins = "sdc2_cmd";
+				bias-pull-up;		/* pull up */
+				drive-strength = <2>;	/* 2 MA */
+			};
+		};
+
+		sdc2_data_on: sdc2_data_on {
+			config {
+				pins = "sdc2_data";
+				bias-pull-up;		/* pull up */
+				drive-strength = <10>;	/* 10 MA */
+			};
+		};
+
+		sdc2_data_off: sdc2_data_off {
+			config {
+				pins = "sdc2_data";
+				bias-pull-up;		/* pull up */
+				drive-strength = <2>;	/* 2 MA */
+			};
+		};
+
+		sdc2_cd_on: sdc2_cd_on {
+			mux {
+				pins = "gpio95";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio95";
+				bias-pull-up;		/* pull up */
+				drive-strength = <16>;	/* 16 MA */
+			};
+		};
+
+		sdc2_cd_off: sdc2_cd_off {
+			mux {
+				pins = "gpio95";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio95";
+				bias-pull-up;		/* pull up */
+				drive-strength = <2>;	/* 2 MA */
+			};
+		};
+
+		sdc2_cd_on_sbc: sdc2_cd_on_sbc {
+			mux {
+				pins = "gpio38";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio38";
+				bias-pull-up;		/* pull up */
+				drive-strength = <16>;	/* 16 MA */
+			};
+		};
+
+		sdc2_cd_off_sbc: sdc2_cd_off_sbc {
+			mux {
+				pins = "gpio38";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio38";
+				bias-pull-up;		/* pull up */
+				drive-strength = <2>;	/* 2 MA */
+			};
+		};
+
+		ts_mux {
+			ts_active: ts_active {
+				mux {
+					pins = "gpio89", "gpio125";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio89", "gpio125";
+					drive-strength = <16>;
+					bias-pull-up;
+				};
+			};
+
+			ts_suspend: ts_suspend {
+				mux {
+					pins = "gpio89", "gpio125";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio89", "gpio125";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+		};
+
+		ts_mux_sbc {
+			ts_active_sbc: ts_active_sbc {
+				mux {
+					pins = "gpio29", "gpio125";
+					function = "gpio";
+				};
+
+				config_sbc {
+					pins = "gpio29", "gpio125";
+					drive-strength = <16>;
+					bias-pull-up;
+				};
+		};
+
+			ts_suspend_sbc: ts_suspend_sbc {
+				mux {
+					pins = "gpio29", "gpio125";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio29", "gpio125";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+		};
+		i2c_12 {
+                        i2c_12_active: i2c_12_active {
+				mux {
+					pins = "gpio87", "gpio88";
+					function = "blsp_i2c12";
+				};
+
+				config {
+					pins = "gpio87", "gpio88";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_12_sleep: i2c_12_sleep {
+				mux {
+					pins = "gpio87", "gpio88";
+					function = "blsp_i2c12";
+				};
+
+				config {
+					pins = "gpio87", "gpio88";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+		};
+
+		i2c_6 {
+			i2c_6_active: i2c_6_active {
+				mux {
+					pins = "gpio27", "gpio28";
+					function = "blsp_i2c6";
+				};
+
+				config {
+					pins = "gpio27", "gpio28";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_6_sleep: i2c_6_sleep {
+				mux {
+					pins = "gpio27", "gpio28";
+					function = "blsp_i2c6";
+				};
+
+				config {
+					pins = "gpio27", "gpio28";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_7 {
+			i2c_7_active: i2c_7_active {
+				mux {
+					pins = "gpio55", "gpio56";
+					function = "blsp_i2c7";
+				};
+
+				config {
+					pins = "gpio55", "gpio56";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_7_sleep: i2c_7_sleep {
+				mux {
+					pins = "gpio55", "gpio56";
+					function = "blsp_i2c7";
+				};
+
+				config {
+					pins = "gpio55", "gpio56";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_8 {
+			i2c_8_active: i2c_8_active {
+				mux {
+					pins = "gpio6", "gpio7";
+					function = "blsp_i2c8";
+				};
+
+				config {
+					pins = "gpio6", "gpio7";
+					drive-strength = <4>;
+					bias-disable;
+				};
+			};
+
+			i2c_8_sleep: i2c_8_sleep {
+				mux {
+					pins = "gpio6", "gpio7";
+					function = "blsp_i2c8";
+				};
+
+				config {
+					pins = "gpio6", "gpio7";
+					drive-strength = <4>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		pmx_fm_int {
+			fm_int_active: fm_int_active {
+				mux {
+					pins = "gpio38";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio38";
+					drive-strength = <16>;
+					bias-pull-up;
+				};
+			};
+
+		fm_int_suspend: fm_int_suspend {
+				mux {
+					pins = "gpio38";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio38";
+					drive-strength = <16>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		pmx_fm_status {
+			fm_status_int_active: fm_status_int_active {
+				mux {
+					pins = "gpio78";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio78";
+					drive-strength = <16>;
+					bias-pull-up;
+				};
+			};
+
+			fm_status_int_suspend: fm_status_int_suspend {
+				mux {
+					pins = "gpio78";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio78";
+					drive-strength = <16>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		pmx_fm_rst {
+			fm_rst_active: fm_rst_active {
+				mux {
+					pins = "gpio39";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio39";
+					drive-strength = <16>;
+					bias-pull-down;
+				};
+			};
+
+			fm_rst_suspend: fm_rst_suspend {
+				mux {
+					pins = "gpio39";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio39";
+					drive-strength = <16>;
+					bias-pull-down;
+				};
+			};
+		};
+
+		pmx_rd_nfc_int {
+			nfc_int_active: active {
+				mux {
+					pins = "gpio9";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio9";
+					drive-strength = <6>;
+					bias-pull-up;
+				};
+			};
+
+			nfc_int_suspend: suspend {
+				mux {
+					pins = "gpio9";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio9";
+					drive-strength = <6>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		pmx_nfc_reset {
+			nfc_disable_active: active {
+				mux {
+					pins = "gpio12";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio12";
+					drive-strength = <6>;
+					bias-pull-up;
+				};
+			};
+
+			nfc_disable_suspend: suspend {
+				mux {
+					pins = "gpio12";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio12";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_0 {
+			spi_0_active: spi_0_active {
+				mux {
+					pins = "gpio0", "gpio1",
+						"gpio2", "gpio3";
+					function = "blsp_spi1";
+				};
+
+				config {
+					pins = "gpio0", "gpio1",
+						"gpio2", "gpio3";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_0_sleep: spi_0_sleep {
+				mux {
+					pins = "gpio0", "gpio1",
+						"gpio2", "gpio3";
+					function = "blsp_spi1";
+				};
+
+				config {
+					pins = "gpio0", "gpio1",
+						"gpio2", "gpio3";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_0_cs {
+			spi_0_cs_active: spi_0_cs_active {
+				mux {
+					pins = "gpio24", "gpio90";
+					function = "blsp1_spi";
+				};
+
+				config {
+					pins = "gpio24", "gpio90";
+					drive-strength = <6>;
+					bias-pull-up;
+				};
+			};
+
+			spi_0_cs_sleep: spi_0_cs_sleep {
+				mux {
+					pins = "gpio24", "gpio90";
+					function = "blsp1_spi";
+				};
+
+				config {
+					pins = "gpio24", "gpio90";
+					drive-strength = <6>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		spi_9 {
+			spi_9_active: spi_9_active {
+				mux {
+					pins = "gpio49", "gpio50", "gpio51",
+								"gpio52";
+					function = "blsp_spi9";
+				};
+
+				config {
+					pins = "gpio49", "gpio50", "gpio51",
+								"gpio52";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_9_sleep: spi_9_sleep {
+				mux {
+					pins = "gpio49", "gpio50", "gpio51",
+								"gpio52";
+					function = "blsp_spi9";
+				};
+
+				config {
+					pins = "gpio49", "gpio50", "gpio51",
+								"gpio52";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_10 {
+			spi_10_active: spi_10_active {
+				mux {
+					pins = "gpio8", "gpio9", "gpio10",
+								"gpio11";
+					function = "blsp_spi10";
+				};
+
+				config {
+					pins = "gpio8", "gpio9", "gpio10",
+								"gpio11";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_10_sleep: spi_10_sleep {
+				mux {
+					pins = "gpio8", "gpio9", "gpio10",
+								"gpio11";
+					function = "blsp_spi10";
+				};
+
+				config {
+					pins = "gpio8", "gpio9", "gpio10",
+								"gpio11";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_12 {
+			spi_12_active: spi_12_active {
+				mux {
+					pins = "gpio85", "gpio86", "gpio87",
+								"gpio88";
+					function = "blsp_spi12";
+				};
+
+				config {
+					pins = "gpio85", "gpio86", "gpio87",
+								"gpio88";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_12_sleep: spi_12_sleep {
+				mux {
+					pins = "gpio85", "gpio86", "gpio87",
+								"gpio88";
+					function = "blsp_spi12";
+				};
+
+				config {
+					pins = "gpio85", "gpio86", "gpio87",
+								"gpio88";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		pcie0 {
+			pcie0_clkreq_default: pcie0_clkreq_default {
+				mux {
+					pins = "gpio36";
+					function = "pci_e0";
+				};
+
+				config {
+					pins = "gpio36";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+
+			pcie0_perst_default: pcie0_perst_default {
+				mux {
+					pins = "gpio35";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio35";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+
+			pcie0_wake_default: pcie0_wake_default {
+				mux {
+					pins = "gpio37";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio37";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+
+			pcie0_clkreq_sleep: pcie0_clkreq_sleep {
+				mux {
+					pins = "gpio36";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio36";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			pcie0_wake_sleep: pcie0_wake_sleep {
+				mux {
+					pins = "gpio37";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio37";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+		};
+
+		pcie1 {
+			pcie1_clkreq_default: pcie1_clkreq_default {
+				mux {
+					pins = "gpio131";
+					function = "pci_e1";
+				};
+
+				config {
+					pins = "gpio131";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+
+			pcie1_perst_default: pcie1_perst_default {
+				mux {
+					pins = "gpio130";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio130";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+
+			pcie1_wake_default: pcie1_wake_default {
+				mux {
+					pins = "gpio132";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio132";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+
+			pcie1_clkreq_sleep: pcie1_clkreq_sleep {
+				mux {
+					pins = "gpio131";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio131";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			pcie1_wake_sleep: pcie1_wake_sleep {
+				mux {
+					pins = "gpio132";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio132";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+		};
+
+		pcie2 {
+			pcie2_clkreq_default: pcie2_clkreq_default {
+				mux {
+					pins = "gpio115";
+					function = "pci_e2";
+				};
+
+				config {
+					pins = "gpio115";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+
+			pcie2_perst_default: pcie2_perst_default {
+				mux {
+					pins = "gpio114";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio114";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+
+			pcie2_wake_default: pcie2_wake_default {
+				mux {
+					pins = "gpio116";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio116";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+
+			pcie2_clkreq_sleep: pcie2_clkreq_sleep {
+				mux {
+					pins = "gpio115";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio115";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			pcie2_wake_sleep: pcie2_wake_sleep {
+				mux {
+					pins = "gpio116";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio116";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+		};
+
+		wcd9xxx_intr {
+			wcd_intr_default: wcd_intr_default{
+				mux {
+					pins = "gpio54";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio54";
+					drive-strength = <2>; /* 2 mA */
+					bias-pull-down; /* pull down */
+					input-enable;
+				};
+			};
+		};
+
+		cdc_reset_ctrl {
+			cdc_reset_sleep: cdc_reset_sleep {
+				mux {
+					pins = "gpio64";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio64";
+					drive-strength = <16>;
+					bias-disable;
+					output-low;
+				};
+			};
+			cdc_reset_active:cdc_reset_active {
+				mux {
+					pins = "gpio64";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio64";
+					drive-strength = <16>;
+					bias-pull-down;
+					output-high;
+				};
+			};
+		};
+
+		pri_aux_pcm {
+			pri_aux_pcm_sleep: pri_aux_pcm_sleep {
+				mux {
+					pins = "gpio65", "gpio66";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio65", "gpio66";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+				};
+			};
+			pri_aux_pcm_active: pri_aux_pcm_active {
+				mux {
+					pins = "gpio65", "gpio66";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio65", "gpio66";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		pri_aux_pcm_din {
+			pri_aux_pcm_din_sleep: pri_aux_pcm_din_sleep {
+				mux {
+					pins = "gpio67";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio67";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+				};
+			};
+			pri_aux_pcm_din_active: pri_aux_pcm_din_active {
+				mux {
+					pins = "gpio67";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio67";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		pri_aux_pcm_dout {
+			pri_aux_pcm_dout_sleep: pri_aux_pcm_dout_sleep {
+				mux {
+					pins = "gpio68";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio68";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+				};
+			};
+			pri_aux_pcm_dout_active: pri_aux_pcm_dout_active {
+				mux {
+					pins = "gpio68";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio68";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		spkr_i2s_clk_pin {
+			spkr_i2s_clk_sleep: spkr_i2s_clk_sleep {
+				mux {
+					pins = "gpio69";
+					function = "spkr_i2s";
+				};
+
+				config {
+					pins = "gpio69";
+					drive-strength = <2>; /* 2 mA */
+					bias-pull-down;       /* PULL DOWN */
+				};
+			};
+			spkr_i2s_clk_active: spkr_i2s_clk_active {
+				mux {
+					pins = "gpio69";
+					function = "spkr_i2s";
+				};
+
+				config {
+					pins = "gpio69";
+					drive-strength = <8>; /* 8 mA */
+					bias-disable;         /* NO PULL */
+				};
+			};
+		};
+
+		cnss_pins {
+			cnss_bootstrap_active: cnss_bootstrap_active {
+				mux {
+					pins = "gpio46";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio46";
+					drive-strength = <16>;
+					output-high;
+					bias-pull-up;
+				};
+			};
+			cnss_bootstrap_sleep: cnss_bootstrap_sleep {
+				mux {
+					pins = "gpio46";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio46";
+					drive-strength = <2>;
+					output-low;
+					bias-pull-down;
+				};
+			};
+		};
+
+		sec_mi2s {
+			sec_mi2s_sleep: sec_mi2s_sleep {
+				mux {
+					pins = "gpio80", "gpio81";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio80", "gpio81";
+					drive-strength = <2>;   /* 2 mA */
+					bias-disable;         /* NO PULL */
+				};
+			};
+			sec_mi2s_active: sec_mi2s_active {
+				mux {
+					pins = "gpio80", "gpio81";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio80", "gpio81";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		sec_mi2s_sd0 {
+			sec_mi2s_sd0_sleep: sec_mi2s_sd0_sleep {
+				mux {
+					pins = "gpio82";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio82";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+				};
+			};
+			sec_mi2s_sd0_active: sec_mi2s_sd0_active {
+				mux {
+					pins = "gpio82";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio82";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		sec_mi2s_sd1 {
+			sec_mi2s_sd1_sleep: sec_mi2s_sd1_sleep {
+				mux {
+					pins = "gpio83";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio83";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+				};
+			};
+			sec_mi2s_sd1_active: sec_mi2s_sd1_active {
+				mux {
+					pins = "gpio83";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio83";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		tert_mi2s {
+			tert_mi2s_sleep: tert_mi2s_sleep {
+				mux {
+					pins = "gpio75", "gpio76";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio75", "gpio76";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+				};
+			};
+			tert_mi2s_active: tert_mi2s_active {
+				mux {
+					pins = "gpio75", "gpio76";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio75", "gpio76";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		tert_mi2s_sd0 {
+			tert_mi2s_sd0_sleep: tert_mi2s_sd0_sleep {
+				mux {
+					pins = "gpio77";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio77";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+				};
+			};
+			tert_mi2s_sd0_active: tert_mi2s_sd0_active {
+				mux {
+					pins = "gpio77";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio77";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		quat_mi2s {
+			quat_mi2s_sleep: quat_mi2s_sleep {
+				mux {
+					pins = "gpio58", "gpio59";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio58", "gpio59";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+				};
+			};
+			quat_mi2s_active: quat_mi2s_active {
+				mux {
+					pins = "gpio58", "gpio59";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio58", "gpio59";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		quat_mi2s_sd0 {
+			quat_mi2s_sd0_sleep: quat_mi2s_sd0_sleep {
+				mux {
+					pins = "gpio60";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio60";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+				};
+			};
+			quat_mi2s_sd0_active: quat_mi2s_sd0_active {
+				mux {
+					pins = "gpio60";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio60";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		tert_tdm {
+			tert_tdm_sleep: tert_tdm_sleep {
+				mux {
+					pins = "gpio75", "gpio76";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio75", "gpio76";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+				};
+			};
+			tert_tdm_active: tert_tdm_active {
+				mux {
+					pins = "gpio75", "gpio76";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio75", "gpio76";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		tert_tdm_din {
+			tert_tdm_din_sleep: tert_tdm_din_sleep {
+				mux {
+					pins = "gpio77";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio77";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+				};
+			};
+			tert_tdm_din_active: tert_tdm_din_active {
+				mux {
+					pins = "gpio77";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio77";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		tert_tdm_dout {
+			tert_tdm_dout_sleep: tert_tdm_dout_sleep {
+				mux {
+					pins = "gpio78";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio78";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+				};
+			};
+			tert_tdm_dout_active: tert_tdm_dout_active {
+				mux {
+					pins = "gpio78";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio78";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		quat_tdm {
+			quat_tdm_sleep: quat_tdm_sleep {
+				mux {
+					pins = "gpio58", "gpio59";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio58", "gpio59";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+				};
+			};
+			quat_tdm_active: quat_tdm_active {
+				mux {
+					pins = "gpio58", "gpio59";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio58", "gpio59";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		quat_tdm_din {
+			quat_tdm_din_sleep: quat_tdm_din_sleep {
+				mux {
+					pins = "gpio60";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio60";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+				};
+			};
+			quat_tdm_din_active: quat_tdm_din_active {
+				mux {
+					pins = "gpio60";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio60";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		quat_tdm_dout {
+			quat_tdm_dout_sleep: quat_tdm_dout_sleep {
+				mux {
+					pins = "gpio61";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio61";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+				};
+			};
+			quat_tdm_dout_active: quat_tdm_dout_active {
+				mux {
+					pins = "gpio61";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio61";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		cci0_active: cci0_active {
+			mux {
+				/* CLK, DATA */
+				pins = "gpio17","gpio18"; // Only 2
+				function = "cci_i2c";
+			};
+
+			config {
+				pins = "gpio17","gpio18";
+				bias-pull-up; /* PULL UP*/
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cci0_suspend: cci0_suspend {
+			mux {
+				/* CLK, DATA */
+				pins = "gpio17","gpio18";
+				function = "cci_i2c";
+			};
+
+			config {
+				pins = "gpio17","gpio18";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cci1_active: cci1_active {
+			mux {
+				/* CLK, DATA */
+				pins = "gpio19","gpio20";
+				function = "cci_i2c";
+			};
+
+			config {
+				pins = "gpio19","gpio20";
+				bias-pull-up; /* PULL UP*/
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cci1_suspend: cci1_suspend {
+			mux {
+				/* CLK, DATA */
+				pins = "gpio19","gpio20";
+				function = "cci_i2c";
+			};
+
+			config {
+				pins = "gpio19","gpio20";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk0_active: cam_sensor_mclk0_active {
+			/* MCLK0 */
+			mux {
+				/* CLK, DATA */
+				pins = "gpio13";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio13";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk0_suspend: cam_sensor_mclk0_suspend {
+			/* MCLK0 */
+			mux {
+				/* CLK, DATA */
+				pins = "gpio13";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio13";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_rear_active: cam_sensor_rear_active {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio30";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio30","gpio29";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_rear_suspend: cam_sensor_rear_suspend{
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio30","gpio29";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio30","gpio29";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_csi0_sensor_active: cam_csi0_sensor_active {
+			/* RESET, STANDBY */
+			cam_rear_active_cfg {
+				pins = "gpio25","gpio26";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_csi0_sensor_suspend: cam_csi0_sensor_suspend{
+			/* RESET, STANDBY */
+			cam_rear_suspend_cfg {
+				pins = "gpio25","gpio26";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_csi2_sensor_active: cam_csi2_sensor_active {
+			/* RESET, STANDBY */
+			cam_rear_active_cfg {
+				pins = "gpio23","gpio133";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_csi1_sensor_active: cam_csi1_sensor_active {
+			/* RESET, STANDBY */
+			cam_rear_active_cfg {
+				pins = "gpio104","gpio98";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_csi1_sensor_suspend: cam_csi1_sensor_suspend {
+			/* RESET, STANDBY */
+			cam_rear_suspend_cfg {
+				pins = "gpio104","gpio98";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_csi2_sensor_suspend: cam_csi2_sensor_suspend{
+			/* RESET, STANDBY */
+			cam_rear_suspend_cfg {
+				pins = "gpio23","gpio133";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk1_active: cam_sensor_mclk1_active{
+			/* MCLK1 */
+			mux {
+				/* CLK, DATA */
+				pins = "gpio14";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio14";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk1_suspend: cam_sensor_mclk1_suspend {
+			/* MCLK1 */
+			mux {
+				/* CLK, DATA */
+				pins = "gpio14";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio14";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_rear2_active: cam_sensor_rear2_active {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio63","gpio62";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio63","gpio62";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_rear2_sus {
+			cam_sensor_rear2_suspend: cam_sensor_rear2_suspend{
+				/* RESET, STANDBY */
+				mux {
+					pins = "gpio63","gpio62";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio63","gpio62";
+					bias-disable; /* No PULL */
+					drive-strength = <2>; /* 2 MA */
+				};
+			};
+		};
+
+		cam_sensor_mclk2_active: cam_sensor_mclk2_active {
+			/* MCLK1 */
+			mux {
+				/* CLK, DATA */
+				pins = "gpio15";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio15";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk2_suspend: cam_sensor_mclk2_suspend{
+			/* MCLK1 */
+			mux {
+				/* CLK, DATA */
+				pins = "gpio15";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio15";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_front_active: cam_sensor_front_active{
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio23","gpio26";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio23","gpio26";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_front_suspend: cam_sensor_front_suspend{
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio23","gpio26";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio23","gpio26";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		/* CoreSight */
+		seta_1: seta_1 {
+			mux {
+				pins = "gpio27";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio27";
+				function = "qdss_tracectl_a";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		seta_2: seta_2 {
+			mux {
+				pins = "gpio28";
+				function = "qdss_tracectl_a";
+			};
+
+			config {
+				pins = "gpio28";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		seta_3: seta_3 {
+			mux {
+				pins = "gpio53";
+				function = "qdss_tracedata_a";
+			};
+
+			config {
+				pins = "gpio53";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		seta_4: seta_4 {
+			mux {
+				pins = "gpio54";
+				function = "qdss_tracedata_a";
+			};
+
+			config {
+				pins = "gpio54";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		seta_5: seta_5 {
+			mux {
+				pins = "gpio63";
+				function = "qdss_tracedata_a";
+			};
+
+			config {
+				pins = "gpio63";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		seta_6: seta_6 {
+			mux {
+				pins = "gpio64";
+				function = "qdss_tracedata_a";
+			};
+
+			config {
+				pins = "gpio64";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		seta_7: seta_7 {
+			mux {
+				pins = "gpio65";
+				function = "qdss_tracedata_a";
+			};
+
+			config {
+				pins = "gpio65";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		seta_8: seta_8 {
+			mux {
+				pins = "gpio66";
+				function = "qdss_tracedata_a";
+			};
+
+			config {
+				pins = "gpio66";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		seta_9: seta_9 {
+			mux {
+				pins = "gpio67";
+				function = "qdss_tracedata_a";
+			};
+
+			config {
+				pins = "gpio67";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		seta_10: seta_10 {
+			mux {
+				pins = "gpio74";
+				function = "qdss_tracedata_a";
+			};
+
+			config {
+				pins = "gpio74";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		seta_11: seta_11 {
+			mux {
+				pins = "gpio75";
+				function = "qdss_tracedata_a";
+			};
+
+			config {
+				pins = "gpio75";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		seta_12: seta_12 {
+			mux {
+				pins = "gpio76";
+				function = "qdss_tracedata_a";
+			};
+
+			config {
+				pins = "gpio76";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		seta_13: seta_13 {
+			mux {
+				pins = "gpio77";
+				function = "qdss_tracedata_a";
+			};
+
+			config {
+				pins = "gpio77";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		seta_14: seta_14 {
+			mux {
+				pins = "gpio85";
+				function = "qdss_tracedata_a";
+			};
+
+			config {
+				pins = "gpio85";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		seta_15: seta_15 {
+			mux {
+				pins = "gpio86";
+				function = "qdss_tracedata_a";
+			};
+
+			config {
+				pins = "gpio86";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		seta_16: seta_16 {
+			mux {
+				pins = "gpio87";
+				function = "qdss_tracedata_a";
+			};
+
+			config {
+				pins = "gpio87";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		seta_17: seta_17 {
+			mux {
+				pins = "gpio89";
+				function = "qdss_tracedata_a";
+			};
+
+			config {
+				pins = "gpio89";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		seta_18: seta_18 {
+			mux {
+				pins = "gpio90";
+				function = "qdss_tracedata_a";
+			};
+
+			config {
+				pins = "gpio90";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		setb_1: setb_1 {
+			mux {
+				pins = "gpio13";
+				function = "qdss_tracedata_b";
+			};
+
+			config {
+				pins = "gpio13";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		setb_2: setb_2 {
+			mux {
+				pins = "gpio14";
+				function = "qdss_tracedata_b";
+			};
+
+			config {
+				pins = "gpio14";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		setb_3: setb_3 {
+			mux {
+				pins = "gpio15";
+				function = "qdss_tracedata_b";
+			};
+
+			config {
+				pins = "gpio15";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		setb_4: setb_4 {
+			mux {
+				pins = "gpio16";
+				function = "qdss_tracedata_b";
+			};
+
+			config {
+				pins = "gpio16";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		setb_5: setb_5 {
+			mux {
+				pins = "gpio17";
+				function = "qdss_tracedata_b";
+			};
+
+			config {
+				pins = "gpio17";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		setb_6: setb_6 {
+			mux {
+				pins = "gpio18";
+				function = "qdss_tracedata_b";
+			};
+
+			config {
+				pins = "gpio18";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		setb_7: setb_7 {
+			mux {
+				pins = "gpio19";
+				function = "qdss_tracedata_b";
+			};
+
+			config {
+				pins = "gpio19";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		setb_8: setb_8 {
+			mux {
+				pins = "gpio21";
+				function = "qdss_tracedata_b";
+			};
+
+			config {
+				pins = "gpio21";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		setb_9: setb_9 {
+			mux {
+				pins = "gpio22";
+				function = "qdss_tracedata_b";
+			};
+
+			config {
+				pins = "gpio22";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		setb_10: setb_10 {
+			mux {
+				pins = "gpio23";
+				function = "qdss_tracedata_b";
+			};
+
+			config {
+				pins = "gpio23";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		setb_11: setb_11 {
+			mux {
+				pins = "gpio26";
+				function = "qdss_tracedata_b";
+			};
+
+			config {
+				pins = "gpio26";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		setb_12: setb_12 {
+			mux {
+				pins = "gpio29";
+				function = "qdss_tracedata_b";
+			};
+
+			config {
+				pins = "gpio29";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		setb_13: setb_13 {
+			mux {
+				pins = "gpio57";
+				function = "qdss_tracedata_b";
+			};
+
+			config {
+				pins = "gpio57";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		setb_14: setb_14 {
+			mux {
+				pins = "gpio58";
+				function = "qdss_tracedata_b";
+			};
+
+			config {
+				pins = "gpio58";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		setb_15: setb_15 {
+			mux {
+				pins = "gpio91";
+				function = "qdss_traceclk_b";
+			};
+
+			config {
+				pins = "gpio91";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		setb_16: setb_16 {
+			mux {
+				pins = "gpio92";
+				function = "qdss_tracedata_b";
+			};
+
+			config {
+				pins = "gpio92";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		setb_17: setb_17 {
+			mux {
+				pins = "gpio93";
+				function = "qdss_tracedata_b";
+			};
+
+			config {
+				pins = "gpio93";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		setb_18: setb_18 {
+			mux {
+				pins = "gpio94";
+				function = "qdss_tracectl_b";
+			};
+
+			config {
+				pins = "gpio94";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+
+		trigout_a: trigout_a {
+			mux {
+				pins = "gpio25";
+				function = "qdss_cti_trig_out_a";
+			};
+
+			config {
+				pins = "gpio25";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		tsif0_signals_active: tsif0_signals_active {
+			tsif1_clk {
+				pins = "gpio89"; /* TSIF0 CLK */
+				function = "tsif1_clk";
+			};
+			tsif1_en {
+				pins = "gpio90"; /* TSIF0 Enable */
+				function = "tsif1_en";
+			};
+			tsif1_data {
+				pins = "gpio91"; /* TSIF0 DATA */
+				function = "tsif1_data";
+			};
+			signals_cfg {
+				pins = "gpio89", "gpio90", "gpio91";
+				drive_strength = <2>;	/* 2 mA */
+				bias-pull-down;		/* pull down */
+			};
+		};
+
+		/* sync signal is only used if configured to mode-2 */
+		tsif0_sync_active: tsif0_sync_active {
+			tsif1_sync {
+				pins = "gpio39";	/* TSIF0 SYNC */
+				function = "tsif1_sync";
+				drive_strength = <2>;	/* 2 mA */
+				bias-pull-down;		/* pull down */
+			};
+		};
+
+		tsif1_signals_active: tsif1_signals_active {
+			tsif2_clk {
+				pins = "gpio93"; /* TSIF1 CLK */
+				function = "tsif2_clk";
+			};
+			tsif2_en {
+				pins = "gpio94"; /* TSIF1 Enable */
+				function = "tsif2_en";
+			};
+			tsif2_data {
+				pins = "gpio95"; /* TSIF1 DATA */
+				function = "tsif2_data";
+			};
+			signals_cfg {
+				pins = "gpio93", "gpio94", "gpio95";
+				drive_strength = <2>;	/* 2 mA */
+				bias-pull-down;		/* pull down */
+			};
+		};
+
+		/* sync signal is only used if configured to mode-2 */
+		tsif1_sync_active: tsif1_sync_active {
+			tsif2_sync {
+				pins = "gpio96";	/* TSIF1 SYNC */
+				function = "tsif2_sync";
+				drive_strength = <2>;	/* 2 mA */
+				bias-pull-down;		/* pull down */
+			};
+		};
+
+		ap2mdm {
+			ap2mdm_active: ap2mdm_active {
+				mux {
+					/* ap2mdm-status
+					 * ap2mdm-errfatal
+					 * ap2mdm-vddmin
+					 */
+					pins = "gpio107", "gpio109", "gpio111";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio107", "gpio109", "gpio111";
+					drive-strength = <16>;
+					bias-disable;
+				};
+			};
+			ap2mdm_sleep: ap2mdm_sleep {
+				mux {
+					/* ap2mdm-status
+					 * ap2mdm-errfatal
+					 * ap2mdm-vddmin
+					 */
+					pins = "gpio107", "gpio109", "gpio111";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio107", "gpio109", "gpio111";
+					drive-strength = <8>;
+					bias-disable;
+				};
+
+			};
+		};
+
+		mdm2ap {
+			mdm2ap_active: mdm2ap_active {
+				mux {
+				/* mdm2ap-status
+				 * mdm2ap-errfatal
+				 * mdm2ap-vddmin
+				 */
+					pins = "gpio106", "gpio108", "gpio112";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio106", "gpio108", "gpio112";
+					drive-strength = <8>;
+					bias-disable;
+				};
+			};
+			mdm2ap_sleep: mdm2ap_sleep {
+				mux {
+					/* mdm2ap-status
+					 * mdm2ap-errfatal
+					 * mdm2ap-vddmin
+					 */
+					pins = "gpio106", "gpio108", "gpio112";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio106", "gpio108", "gpio112";
+					drive-strength = <8>;
+					bias-disable;
+				};
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-pm.dtsi b/arch/arm64/boot/dts/qcom/msm8996-pm.dtsi
new file mode 100644
index 000000000000..74c964bc466d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-pm.dtsi
@@ -0,0 +1,596 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/msm/pm.h>
+
+&soc {
+	qcom,spm@9A10000 {
+		compatible = "qcom,spm-v2";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0x9A10000 0x1000>;
+		qcom,name = "system-cbf"; /* CBF SAW */
+		qcom,saw2-ver-reg = <0xFD0>;
+		qcom,cpu-vctl-list = <&CPU0 &CPU1 &CPU2 &CPU3>;
+		qcom,vctl-timeout-us = <500>;
+		qcom,vctl-port = <0x0>;
+		qcom,phase-port = <0x1>;
+		qcom,saw2-avs-ctl = <0x1100>;
+		qcom,pfm-port = <0x2>;
+	};
+
+	qcom,lpm-levels {
+		compatible = "qcom,lpm-levels";
+		qcom,use-psci;
+		#address-cells = <1>;
+		#size-cells = <0>;
+		qcom,pm-cluster@0 {
+			reg = <0>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			label = "system";
+			qcom,spm-device-names = "cbf", "l3";
+			qcom,default-level = <0>;
+			qcom,psci-mode-shift = <8>;
+			qcom,psci-mode-mask = <0xff>;
+
+			qcom,pm-cluster-level@0{
+				reg = <0>;
+				label = "system-wfi";
+				qcom,psci-mode = <0>;
+				qcom,latency-us = <100>;
+				qcom,ss-power = <192>;
+				qcom,energy-overhead = <60000>;
+				qcom,time-overhead = <120>;
+			};
+			qcom,pm-cluster-level@1{ /* E3-M2 */
+				reg = <1>;
+				label = "system-ret";
+				qcom,spm-cbf-mode = "fpc";
+				qcom,spm-l3-mode = "fpc";
+				qcom,psci-mode = <0x23>;
+				qcom,latency-us = <350>;
+				qcom,ss-power = <160>;
+				qcom,energy-overhead = <69000>;
+				qcom,time-overhead = <150>;
+				qcom,min-child-idx = <1>;
+				qcom,reset-level = <LPM_RESET_LVL_RET>;
+			};
+			qcom,pm-cluster-level@2{ /* E4-M3 */
+				reg = <1>;
+				label = "system-fpc";
+				qcom,spm-cbf-mode = "fpc";
+				qcom,spm-l3-mode = "fpc";
+				qcom,psci-mode = <0x34>;
+				qcom,latency-us = <11000>;
+				qcom,ss-power = <72>;
+				qcom,energy-overhead = <1380000>;
+				qcom,time-overhead = <1200>;
+				qcom,min-child-idx = <2>;
+				qcom,notify-rpm;
+				qcom,is-reset;
+				qcom,reset-level = <LPM_RESET_LVL_PC>;
+			};
+
+			qcom,pm-cluster@0{
+				reg = <0>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				label = "pwr";
+				qcom,spm-device-names = "l2";
+				qcom,default-level=<0>;
+				qcom,cpu = <&CPU0 &CPU1>;
+				qcom,psci-mode-shift = <4>;
+				qcom,psci-mode-mask = <0xf>;
+
+				qcom,pm-cluster-level@0{ /* D1 */
+					reg = <0>;
+					label = "pwr-l2-wfi";
+					qcom,psci-mode = <1>;
+					qcom,latency-us = <40>;
+					qcom,ss-power = <195>;
+					qcom,energy-overhead = <65000>;
+					qcom,time-overhead = <85>;
+				};
+
+				qcom,pm-cluster-level@1{ /* D3 */
+					reg = <1>;
+					label = "pwr-l2-gdhs";
+					qcom,psci-mode = <3>;
+					qcom,latency-us = <90>;
+					qcom,ss-power = <180>;
+					qcom,energy-overhead = <89070>;
+					qcom,time-overhead = <180>;
+					qcom,min-child-idx = <2>;
+					qcom,reset-level = <LPM_RESET_LVL_GDHS>;
+				};
+
+				qcom,pm-cluster-level@2{ /* D4 */
+					reg = <2>;
+					label = "pwr-l2-fpc";
+					qcom,psci-mode = <4>;
+					qcom,latency-us = <700>;
+					qcom,ss-power = <160>;
+					qcom,energy-overhead = <441000>;
+					qcom,time-overhead = <1000>;
+					qcom,min-child-idx = <2>;
+					qcom,is-reset;
+					qcom,reset-level = <LPM_RESET_LVL_PC>;
+				};
+
+				qcom,pm-cpu {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					qcom,psci-mode-shift = <0>;
+					qcom,psci-mode-mask = <0xf>;
+
+					qcom,pm-cpu-level@0 { /* C1 */
+						reg = <0>;
+						qcom,psci-cpu-mode = <1>;
+						qcom,spm-cpu-mode = "wfi";
+						qcom,latency-us = <20>;
+						qcom,ss-power = <200>;
+						qcom,energy-overhead = <9000>;
+						qcom,time-overhead = <60>;
+					};
+
+					qcom,pm-cpu-level@1 {  /* C4 */
+						reg = <1>;
+						qcom,spm-cpu-mode = "fpc-def";
+						qcom,psci-cpu-mode = <4>;
+						qcom,latency-us = <40>;
+						qcom,ss-power = <198>;
+						qcom,energy-overhead = <21850>;
+						qcom,time-overhead = <120>;
+						qcom,hyp-psci;
+					};
+
+					qcom,pm-cpu-level@2 {  /* C4 */
+						reg = <2>;
+						qcom,spm-cpu-mode = "fpc";
+						qcom,psci-cpu-mode = <4>;
+						qcom,latency-us = <80>;
+						qcom,ss-power = <196>;
+						qcom,energy-overhead = <62248>;
+						qcom,time-overhead = <210>;
+						qcom,reset-level =
+							<LPM_RESET_LVL_PC>;
+					};
+				};
+			};
+
+			qcom,pm-cluster@1{
+				reg = <1>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				label = "perf";
+				qcom,spm-device-names = "l2";
+				qcom,default-level=<0>;
+				qcom,cpu = <&CPU2 &CPU3>;
+				qcom,psci-mode-shift = <4>;
+				qcom,psci-mode-mask = <0xf>;
+
+				qcom,pm-cluster-level@0{  /* D1 */
+					reg = <0>;
+					label = "perf-l2-wfi";
+					qcom,psci-mode = <1>;
+					qcom,latency-us = <40>;
+					qcom,ss-power = <195>;
+					qcom,energy-overhead = <65000>;
+					qcom,time-overhead = <85>;
+				};
+
+				qcom,pm-cluster-level@1{ /* D3 */
+					reg = <1>;
+					label = "perf-l2-gdhs";
+					qcom,psci-mode = <3>;
+					qcom,latency-us = <80>;
+					qcom,ss-power = <180>;
+					qcom,energy-overhead = <83500>;
+					qcom,time-overhead = <180>;
+					qcom,min-child-idx = <2>;
+					qcom,reset-level =
+						<LPM_RESET_LVL_GDHS>;
+				};
+
+				qcom,pm-cluster-level@2{ /* D4 */
+					reg = <2>;
+					label = "perf-l2-fpc";
+					qcom,psci-mode = <4>;
+					qcom,latency-us = <800>;
+					qcom,ss-power = <160>;
+					qcom,energy-overhead = <441000>;
+					qcom,time-overhead = <1000>;
+					qcom,min-child-idx = <2>;
+					qcom,is-reset;
+					qcom,reset-level =
+						<LPM_RESET_LVL_PC>;
+				};
+
+				qcom,pm-cpu {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					qcom,psci-mode-shift = <0>;
+					qcom,psci-mode-mask = <0xf>;
+
+					qcom,pm-cpu-level@0 { /* C1 */
+						reg = <0>;
+						qcom,psci-cpu-mode = <1>;
+						qcom,spm-cpu-mode = "wfi";
+						qcom,latency-us = <25>;
+						qcom,ss-power = <200>;
+						qcom,energy-overhead = <9000>;
+						qcom,time-overhead = <60>;
+					};
+
+					qcom,pm-cpu-level@1 {  /* C4 */
+						reg = <1>;
+						qcom,spm-cpu-mode = "fpc-def";
+						qcom,psci-cpu-mode = <4>;
+						qcom,latency-us = <40>;
+						qcom,ss-power = <198>;
+						qcom,energy-overhead = <21850>;
+						qcom,time-overhead = <120>;
+						qcom,hyp-psci;
+					};
+
+					qcom,pm-cpu-level@2 {  /* C4 */
+						reg = <2>;
+						qcom,spm-cpu-mode = "fpc";
+						qcom,psci-cpu-mode = <4>;
+						qcom,latency-us = <80>;
+						qcom,ss-power = <196>;
+						qcom,energy-overhead = <62248>;
+						qcom,time-overhead = <210>;
+						qcom,reset-level =
+							<LPM_RESET_LVL_PC>;
+					};
+				};
+			};
+		};
+	};
+
+	qcom,mpm@681b8 {
+		compatible = "qcom,mpm-v2";
+		reg = <0x681B8 0x1000>, /* MSM_RPM_MPM_BASE 4K */
+		    <0x9820010 0x4>;   /* MSM_APCS_GCC_BASE 4K */
+		reg-names = "vmpm", "ipc";
+		interrupts = <GIC_SPI 171 IRQ_TYPE_EDGE_RISING>;
+		clocks = <&clock_gcc clk_cxo_lpm_clk>;
+		clock-names = "xo";
+		qcom,num-mpm-irqs = <96>;
+
+		qcom,ipc-bit-offset = <1>;
+
+		qcom,gic-parent = <&intc>;
+		qcom,gic-map = <2 216>, /* tsens_upper_lower_int */
+			<79 379>,   /* qusb2phy_dmse_hv_prim */
+			<80 384>,   /* qusb2phy_dmse_hv_sec */
+			<81 379>,   /* qusb2phy_dpse_hv_prim */
+			<82 384>,   /* qusb2phy_dpse_hv_sec */
+			<52 275>,   /* qmp_usb3_lfps_rxterm_irq */
+			<87 358>,   /* ee0_krait_hlos_spmi_periph_irq */
+			<0xff 16>,  /* APCj_qgicdrCpu0HwFaultIrptReq */
+			<0xff 23>,  /* APCj_qgicdrCpu0PerfMonIrptReq */
+			<0xff 27>,  /* APCj_qgicdrCpu0QTmrVirtIrptReq */
+			<0xff 32>,  /* APCj_qgicdrL2PerfMonIrptReq */
+			<0xff 33>,  /* APCC_qgicL2PerfMonIrptReq */
+			<0xff 34>,  /* APCC_qgicL2ErrorIrptReq */
+			<0xff 35>,  /* WDT_barkInt */
+			<0xff 40>,  /* qtimer_phy_irq */
+			<0xff 41>,  /* APCj_qgicdrL2HwFaultNonFatalIrptReq */
+			<0xff 42>,  /* APCj_qgicdrL2HwFaultFatalIrptReq */
+			<0xff 49>,  /* L3UX_qgicL3ErrorIrptReq */
+			<0xff 54>,  /* M4M_sysErrorInterrupt */
+			<0xff 55>,  /* M4M_sysDlmInterrupt */
+			<0xff 57>,  /* mss_to_apps_irq(0) */
+			<0xff 58>,  /* mss_to_apps_irq(1) */
+			<0xff 59>,  /* mss_to_apps_irq(2) */
+			<0xff 60>,  /* mss_to_apps_irq(3) */
+			<0xff 61>,  /* mss_a2_bam_irq */
+			<0xff 62>,  /* QTMR_qgicFrm0VirtIrq */
+			<0xff 63>,  /* QTMR_qgicFrm1PhysIrq */
+			<0xff 64>,  /* QTMR_qgicFrm2PhysIrq */
+			<0xff 65>,  /* QTMR_qgicFrm3PhysIrq */
+			<0xff 66>,  /* QTMR_qgicFrm4PhysIrq */
+			<0xff 67>,  /* QTMR_qgicFrm5PhysIrq */
+			<0xff 68>,  /* QTMR_qgicFrm6PhysIrq */
+			<0xff 69>,  /* QTMR_qgicFrm7PhysIrq */
+			<0xff 70>,  /* iommu_pmon_nonsecure_irq */
+			<0xff 74>,  /* osmmu_CIrpt[1] */
+			<0xff 75>,  /* osmmu_CIrpt[0] */
+			<0xff 77>,  /* osmmu_CIrpt[0] */
+			<0xff 78>,  /* osmmu_CIrpt[0] */
+			<0xff 79>,  /* osmmu_CIrpt[0] */
+			<0xff 80>,  /* CPR3_irq */
+			<0xff 94>,  /* osmmu_CIrpt[0] */
+			<0xff 97>,  /* iommu_nonsecure_irq */
+			<0xff 99>,  /* msm_iommu_pmon_nonsecure_irq */
+			<0xff 101>, /* camss_jpeg_mmu_cirpt */
+			<0xff 102>, /* osmmu_CIrpt[1] */
+			<0xff 105>, /* iommu_pmon_nonsecure_irq */
+			<0xff 108>, /* osmmu_PMIrpt */
+			<0xff 109>, /* ocmem_dm_nonsec_irq */
+			<0xff 110>, /* csiphy_0_irq */
+			<0xff 111>, /* csiphy_1_irq */
+			<0xff 112>, /* csiphy_2_irq */
+			<0xff 115>, /* mdss_irq */
+			<0xff 126>, /* bam_irq[0] */
+			<0xff 127>, /* blsp1_qup_irq(0) */
+			<0xff 132>, /* blsp1_qup_irq(5) */
+			<0xff 133>, /* blsp2_qup_irq(0) */
+			<0xff 134>, /* blsp2_qup_irq(1) */
+			<0xff 135>, /* blsp2_qup_irq(2) */
+			<0xff 138>, /* blsp2_qup_irq(5) */
+			<0xff 140>, /* blsp1_uart_irq(1) */
+			<0xff 146>, /* blsp2_uart_irq(1) */
+			<0xff 155>, /* sdcc_irq[0] */
+			<0xff 157>, /* sdc2_irq[0] */
+			<0xff 163>, /* usb30_ee1_irq */
+			<0xff 164>, /* usb30_bam_irq(0) */
+			<0xff 165>, /* usb30_hs_phy_irq */
+			<0xff 166>, /* sdc1_pwr_cmd_irq */
+			<0xff 170>, /* sdcc_pwr_cmd_irq */
+			<0xff 171>, /* usb20_hs_phy_irq */
+			<0xff 172>, /* usb20_power_event_irq */
+			<0xff 173>, /* sdc1_irq[0] */
+			<0xff 174>, /* o_wcss_apss_smd_med */
+			<0xff 175>, /* o_wcss_apss_smd_low */
+			<0xff 176>, /* o_wcss_apss_smsm_irq */
+			<0xff 177>, /* o_wcss_apss_wlan_data_xfer_done */
+			<0xff 178>, /* o_wcss_apss_wlan_rx_data_avail */
+			<0xff 179>, /* o_wcss_apss_asic_intr */
+			<0xff 180>, /* pcie20_2_int_pls_err */
+			<0xff 181>, /* wcnss watchdog */
+			<0xff 188>, /* lpass_irq_out_apcs(0) */
+			<0xff 189>, /* lpass_irq_out_apcs(1) */
+			<0xff 190>, /* lpass_irq_out_apcs(2) */
+			<0xff 191>, /* lpass_irq_out_apcs(3) */
+			<0xff 192>, /* lpass_irq_out_apcs(4) */
+			<0xff 193>, /* lpass_irq_out_apcs(5) */
+			<0xff 194>, /* lpass_irq_out_apcs(6) */
+			<0xff 195>, /* lpass_irq_out_apcs(7) */
+			<0xff 196>, /* lpass_irq_out_apcs(8) */
+			<0xff 197>, /* lpass_irq_out_apcs(9) */
+			<0xff 198>, /* coresight-tmc-etr interrupt */
+			<0xff 200>, /* rpm_ipc(4) */
+			<0xff 201>, /* rpm_ipc(5) */
+			<0xff 202>, /* rpm_ipc(6) */
+			<0xff 203>, /* rpm_ipc(7) */
+			<0xff 204>, /* rpm_ipc(24) */
+			<0xff 205>, /* rpm_ipc(25) */
+			<0xff 206>, /* rpm_ipc(26) */
+			<0xff 207>, /* rpm_ipc(27) */
+			<0xff 208>,
+			<0xff 210>,
+			<0xff 211>, /* usb_dwc3_otg */
+			<0xff 212>, /* usb30_power_event_irq */
+			<0xff 215>, /* o_bimc_intr(0) */
+			<0xff 224>, /* spdm_realtime_irq[1] */
+			<0xff 238>, /* crypto_bam_irq[0] */
+			<0xff 240>, /* summary_irq_kpss */
+			<0xff 253>, /* sdc2_pwr_cmd_irq */
+			<0xff 258>, /* lpass_irq_out_apcs[21] */
+			<0xff 268>, /* bam_irq[1] */
+			<0xff 270>, /* bam_irq[0] */
+			<0xff 271>, /* bam_irq[0] */
+			<0xff 276>, /* wlan_pci */
+			<0xff 283>, /* pcie20_0_int_pls_err */
+			<0xff 284>, /* pcie20_0_int_aer_legacy */
+			<0xff 286>, /* pcie20_0_int_pls_link_down */
+			<0xff 290>, /* ufs_ice_nonsec_level_irq */
+			<0xff 293>, /* pcie20_2_int_pls_link_down */
+			<0xff 295>, /* camss_cpp_mmu_cirpt[0] */
+			<0xff 296>, /* camss_cpp_mmu_pmirpt */
+			<0xff 297>, /* ufs_intrq */
+			<0xff 298>, /* camss_cpp_mmu_cirpt */
+			<0xff 302>, /* qdss_etrbytecnt_irq */
+			<0xff 310>, /* pcie20_1_int_pls_err */
+			<0xff 311>, /* pcie20_1_int_aer_legacy */
+			<0xff 313>, /* pcie20_1_int_pls_link_down */
+			<0xff 318>, /* venus0_mmu_pmirpt */
+			<0xff 319>, /* venus0_irq */
+			<0xff 325>, /* camss_irq18 */
+			<0xff 326>, /* camss_irq0 */
+			<0xff 327>, /* camss_irq1 */
+			<0xff 328>, /* camss_irq2 */
+			<0xff 329>, /* camss_irq3 */
+			<0xff 330>, /* camss_irq4 */
+			<0xff 331>, /* camss_irq5 */
+			<0xff 332>, /* sps */
+			<0xff 341>, /* camss_irq6 */
+			<0xff 346>, /* camss_irq8 */
+			<0xff 347>, /* camss_irq9 */
+			<0xff 352>, /* mdss_mmu_cirpt[0] */
+			<0xff 353>, /* mdss_mmu_cirpt[1] */
+			<0xff 361>, /* ogpu_mmu_cirpt[0] */
+			<0xff 362>, /* ogpu_mmu_cirpt[1] */
+			<0xff 365>, /* ipa_irq[0] */
+			<0xff 366>, /* ogpu_mmu_pmirpt */
+			<0xff 367>, /* venus0_mmu_cirpt[0] */
+			<0xff 368>, /* venus0_mmu_cirpt[1] */
+			<0xff 369>, /* venus0_mmu_cirpt[2] */
+			<0xff 370>, /* venus0_mmu_cirpt[3] */
+			<0xff 375>, /* camss_vfe_mmu_cirpt[0] */
+			<0xff 376>, /* camss_vfe_mmu_cirpt[1] */
+			<0xff 380>, /* mdss_dma_mmu_cirpt[0] */
+			<0xff 381>, /* mdss_dma_mmu_cirpt[1] */
+			<0xff 385>, /* mdss_dma_mmu_pmirpt */
+			<0xff 387>, /* osmmu_CIrpt[0] */
+			<0xff 394>, /* osmmu_PMIrpt */
+			<0xff 403>, /* osmmu_PMIrpt */
+			<0xff 405>, /* osmmu_CIrpt[0] */
+			<0xff 413>, /* osmmu_PMIrpt */
+			<0xff 422>, /* ssc_irq_out_apcs[5] */
+			<0xff 424>, /* ipa_irq[2] */
+			<0xff 425>, /* lpass_irq_out_apcs[22] */
+			<0xff 426>, /* lpass_irq_out_apcs[23] */
+			<0xff 427>, /* lpass_irq_out_apcs[24] */
+			<0xff 428>, /* lpass_irq_out_apcs[25] */
+			<0xff 429>, /* lpass_irq_out_apcs[26] */
+			<0xff 430>, /* lpass_irq_out_apcs[27] */
+			<0xff 431>, /* lpass_irq_out_apcs[28] */
+			<0xff 432>, /* lpass_irq_out_apcs[29] */
+			<0xff 436>, /* lpass_irq_out_apcs[37] */
+			<0xff 437>, /* pcie20_0_int_msi_dev0 */
+			<0xff 445>, /* pcie20_1_int_msi_dev0 */
+			<0xff 453>, /* pcie20_2_int_msi_dev0 */
+			<0xff 461>, /* o_vmem_nonsec_irq */
+			<0xff 462>, /* tsens1_tsens_critical_int */
+			<0xff 464>, /* ipa_bam_irq[0] */
+			<0xff 465>, /* ipa_bam_irq[2] */
+			<0xff 477>, /* tsens0_tsens_critical_int */
+			<0xff 480>, /* q6_wdog_expired_irq */
+			<0xff 481>, /* mss_ipc_out_irq(4) */
+			<0xff 483>, /* mss_ipc_out_irq(6) */
+			<0xff 484>, /* mss_ipc_out_irq(7) */
+			<0xff 487>, /* mss_ipc_out_irq(30) */
+			<0xff 490>, /* tsens0_tsens_upper_lower_int */
+			<0xff 493>; /* sdc1_ice_nonsec_level_irq */
+
+		qcom,gpio-parent = <&tlmm>;
+		qcom,gpio-map = <3  1>,
+			<4  5>,
+			<5  9>,
+			<6  11>,
+			<7  66>,
+			<8  22>,
+			<9  24>,
+			<10  26>,
+			<11  34>,
+			<12  36>,
+			<13  37>, /* PCIe0 */
+			<14  38>,
+			<15  40>,
+			<16  42>,
+			<17  46>,
+			<18  50>,
+			<19  53>,
+			<20  54>,
+			<21  56>,
+			<22  57>,
+			<23  58>,
+			<24  59>,
+			<25  60>,
+			<26  61>,
+			<27  62>,
+			<28  63>,
+			<29  64>,
+			<30  71>,
+			<31  73>,
+			<32  77>,
+			<33  78>,
+			<34  79>,
+			<35  80>,
+			<36  82>,
+			<37  86>,
+			<38  91>,
+			<39  92>,
+			<40  95>,
+			<41  97>,
+			<42  101>,
+			<43  104>,
+			<44  106>,
+			<45  108>,
+			<46  112>,
+			<47  113>,
+			<48  110>,
+			<50  127>,
+			<51  115>,
+			<54  116>, /* PCIe2 */
+			<55  117>,
+			<56  118>,
+			<57  119>,
+			<58  120>,
+			<59  121>,
+			<60  122>,
+			<61  123>,
+			<62  124>,
+			<63  125>,
+			<64  126>,
+			<65  129>,
+			<66  131>,
+			<67  132>, /* PCIe1 */
+			<68  133>,
+			<69  145>;
+	};
+
+	rpm_msg_ram: memory@0x200000 {
+		compatible = "qcom,rpm-msg-ram";
+		reg = <0x200000 0x1000>,
+			<0x290000 0x1000>;
+	};
+
+	rpm_code_ram: rpm-memory@0x68000 {
+		compatible = "qcom,rpm-code-ram";
+		reg = <0x68000 0x5000>;
+	};
+
+	qcom,rpm-stats@200000 {
+		compatible = "qcom,rpm-stats";
+		reg = <0x200000 0x1000>,
+			<0x290014 0x4>,
+			<0x29001c 0x4>;
+		reg-names = "phys_addr_base",
+			    "offset_addr",
+			    "heap_phys_addrbase";
+		qcom,sleep-stats-version = <2>;
+	};
+
+	qcom,system-stats@68140 {
+		compatible = "qcom,system-stats";
+		qcom,rpm-msg-ram = <&rpm_msg_ram>;
+		qcom,rpm-code-ram = <&rpm_code_ram>;
+		qcom,masters = "APSS", "MPSS", "ADSP", "SLPI";
+	};
+
+	qcom,pm-snoc-client {
+		compatible = "qcom,pm-snoc-client";
+		qcom,msm-bus,name = "ocimem_snoc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,active-only;
+		qcom,msm-bus,vectors-KBps =
+			<MSM_BUS_MASTER_AMPSS_M0 MSM_BUS_SLAVE_OCIMEM 0 0>,
+			<MSM_BUS_MASTER_AMPSS_M0 MSM_BUS_SLAVE_OCIMEM 0 800000>;
+	};
+
+	qcom,rpm-rail-stats@200000 {
+		compatible = "qcom,rpm-rail-stats";
+		reg = <0x200000 0x100>,
+			<0x29000c 0x4>;
+		reg-names = "phys_addr_base",
+			    "offset_addr";
+	};
+
+	qcom,rpm-log@200000 {
+		compatible = "qcom,rpm-log";
+		reg = <0x200000 0x4000>,
+			<0x290018 0x4>;
+		qcom,rpm-addr-phys = <0x200000>;
+		qcom,offset-version = <4>;
+		qcom,offset-page-buffer-addr = <36>;
+		qcom,offset-log-len = <40>;
+		qcom,offset-log-len-mask = <44>;
+		qcom,offset-page-indices = <56>;
+	};
+
+	qcom,rpm-master-stats@60150 {
+		compatible = "qcom,rpm-master-stats";
+		reg = <0x68150 0x5000>;
+		qcom,masters = "APSS", "MPSS", "ADSP", "SLPI";
+		qcom,master-stats-version = <2>;
+		qcom,master-offset = <4096>;
+	};
+
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-pm8994-pm8004-pmk8001.dtsi b/arch/arm64/boot/dts/qcom/msm8996-pm8994-pm8004-pmk8001.dtsi
new file mode 100644
index 000000000000..afbf082a327e
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-pm8994-pm8004-pmk8001.dtsi
@@ -0,0 +1,31 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only chipset-specific property overrides should be placed
+ * inside this file.
+ */
+
+#include "msm8996-pm8994-pm8004.dtsi"
+#include "msm-pmk8001.dtsi"
+
+/ {
+	qcom,pmic-id = <0x20009 0x1000C 0x10012 0x0>;
+};
+
+/*
+ * Override PM8994 resources with proper PMK8001 resources for MSM8996 with
+ * PMK8001.
+ */
+&pm8994_rtc {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-pm8994-pm8004.dtsi b/arch/arm64/boot/dts/qcom/msm8996-pm8994-pm8004.dtsi
new file mode 100644
index 000000000000..05b5de612d7f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-pm8994-pm8004.dtsi
@@ -0,0 +1,33 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only chipset-specific property overrides should be placed
+ * inside this file.
+ */
+
+#include "msm8996-pm8994-pmi8994-pm8004.dtsi"
+
+/ {
+	qcom,pmic-id = <0x20009 0x1000C 0x0 0x0>;
+};
+
+&rpm_bus {
+	/delete-node/ rpm-regulator-bstb;
+	/delete-node/ rpm-regulator-bbyb;
+	/delete-node/ rpm-regulator-smpb1;
+};
+
+&spmi_bus {
+	/delete-node/ qcom,pmi8994@2;
+	/delete-node/ qcom,pmi8994@3;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-pm8994-pmi8994-pm8004-pmk8001.dtsi b/arch/arm64/boot/dts/qcom/msm8996-pm8994-pmi8994-pm8004-pmk8001.dtsi
new file mode 100644
index 000000000000..2294ee41975f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-pm8994-pmi8994-pm8004-pmk8001.dtsi
@@ -0,0 +1,31 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only chipset-specific property overrides should be placed
+ * inside this file.
+ */
+
+#include "msm8996-pm8994-pmi8994-pm8004.dtsi"
+#include "msm-pmk8001.dtsi"
+
+/ {
+	qcom,pmic-id = <0x20009 0x2000A 0x1000C 0x10012>;
+};
+
+/*
+ * Override PM8994 resources with proper PMK8001 resources for MSM8996 with
+ * PMK8001.
+ */
+&pm8994_rtc {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-pm8994-pmi8994-pm8004.dtsi b/arch/arm64/boot/dts/qcom/msm8996-pm8994-pmi8994-pm8004.dtsi
new file mode 100644
index 000000000000..f3ef9be36cd7
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-pm8994-pmi8994-pm8004.dtsi
@@ -0,0 +1,38 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only chipset-specific property overrides should be placed
+ * inside this file.
+ */
+
+#include "msm-pm8004.dtsi"
+
+/ {
+	qcom,pmic-id = <0x20009 0x2000A 0x1000C 0x0>;
+};
+
+/*
+ * Override PMI8994 resources with proper PM8004 resources for MSM8996 with
+ * PM8004.
+ */
+&pmi8994_s2 {
+	status = "disabled";
+};
+
+&pm8004_s2 {
+	status = "ok";
+};
+
+&gfx_cpr {
+	vdd-supply = <&pm8004_s2>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-pm8994-pmi8994-pmk8001.dtsi b/arch/arm64/boot/dts/qcom/msm8996-pm8994-pmi8994-pmk8001.dtsi
new file mode 100644
index 000000000000..b7d8c458267a
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-pm8994-pmi8994-pmk8001.dtsi
@@ -0,0 +1,30 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only chipset-specific property overrides should be placed
+ * inside this file.
+ */
+
+#include "msm-pmk8001.dtsi"
+
+/ {
+	qcom,pmic-id = <0x20009 0x2000A 0x10012 0x0>;
+};
+
+/*
+ * Override PM8994 resources with proper PMK8001 resources for MSM8996 with
+ * PMK8001.
+ */
+&pm8994_rtc {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-pm8994-pmi8996-pmk8001.dtsi b/arch/arm64/boot/dts/qcom/msm8996-pm8994-pmi8996-pmk8001.dtsi
new file mode 100644
index 000000000000..8a78d0c71abd
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-pm8994-pmi8996-pmk8001.dtsi
@@ -0,0 +1,31 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only chipset-specific property overrides should be placed
+ * inside this file.
+ */
+
+#include "msm-pmi8996.dtsi"
+#include "msm-pmk8001.dtsi"
+
+/ {
+	qcom,pmic-id = <0x20009 0x10013 0x10012 0x0>;
+};
+
+/*
+ * Override PM8994 resources with proper PMK8001 resources for MSM8996 with
+ * PMK8001.
+ */
+&pm8994_rtc {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-pm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8996-pm8994.dtsi
new file mode 100644
index 000000000000..4730ee7cc1ce
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-pm8994.dtsi
@@ -0,0 +1,35 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only chipset-specific property overrides should be placed
+ * inside this file.
+ */
+
+#include "msm8996-pm8994-pm8004.dtsi"
+
+/ {
+	qcom,pmic-id = <0x20009 0x0 0x0 0x0>;
+};
+
+&pm8004_s2 {
+	status = "disabled";
+};
+
+&spmi_bus {
+	/delete-node/ qcom,pm8004@4;
+	/delete-node/ qcom,pm8004@5;
+};
+
+&gfx_cpr {
+	/delete-property/ vdd-supply;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-regulator.dtsi b/arch/arm64/boot/dts/qcom/msm8996-regulator.dtsi
new file mode 100644
index 000000000000..936dfd4d1cb2
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-regulator.dtsi
@@ -0,0 +1,1990 @@
+/* Copyright (c) 2014-2016, 2017 The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/spmi/spmi.h>
+#include <dt-bindings/regulator/max20010.h>
+
+&rpm_bus {
+	/* PM8994 S1 + S6 = 2 phase VDD_CX supply */
+	rpm-regulator-smpa1 {
+		status = "okay";
+		pm8994_s1_corner: regulator-s1-corner {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_s1_corner";
+			qcom,set = <3>;
+			regulator-min-microvolt = <1>;
+			regulator-max-microvolt = <7>;
+			qcom,use-voltage-corner;
+		};
+
+		pm8994_s1_floor_corner: regulator-s1-floor-corner {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_s1_floor_corner";
+			qcom,set = <3>;
+			regulator-min-microvolt = <1>;
+			regulator-max-microvolt = <7>;
+			qcom,use-voltage-floor-corner;
+			qcom,always-send-voltage;
+		};
+
+		pm8994_s1_corner_ao: regulator-s1-corner-ao {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_s1_corner_ao";
+			qcom,set = <1>;
+			regulator-min-microvolt = <1>;
+			regulator-max-microvolt = <7>;
+			qcom,use-voltage-corner;
+		};
+	};
+
+	/* PM8994 S2 + S12 = 2 phase VDD_MX supply */
+	rpm-regulator-smpa2 {
+		status = "okay";
+		pm8994_s2_corner: regulator-s2-corner {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_s2_corner";
+			qcom,set = <3>;
+			regulator-min-microvolt = <1>;
+			regulator-max-microvolt = <7>;
+			qcom,use-voltage-corner;
+		};
+
+		pm8994_s2_corner_ao: regulator-s2-corner-ao {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_s2_corner_ao";
+			qcom,set = <1>;
+			regulator-min-microvolt = <1>;
+			regulator-max-microvolt = <7>;
+			qcom,use-voltage-corner;
+		};
+	};
+
+	rpm-regulator-smpa3 {
+		status = "okay";
+		pm8994_s3: regulator-s3 {
+			regulator-min-microvolt = <1300000>;
+			regulator-max-microvolt = <1300000>;
+			qcom,init-voltage = <1300000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-smpa4 {
+		status = "okay";
+		pm8994_s4: regulator-s4 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			qcom,init-voltage = <1800000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-smpa5 {
+		status = "okay";
+		pm8994_s5: regulator-s5 {
+			regulator-min-microvolt = <2150000>;
+			regulator-max-microvolt = <2150000>;
+			qcom,init-voltage = <2150000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-smpa7 {
+		status = "okay";
+		pm8994_s7: regulator-s7 {
+			regulator-min-microvolt = <800000>;
+			regulator-max-microvolt = <800000>;
+			qcom,init-voltage = <800000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa1 {
+		status = "okay";
+		pm8994_l1: regulator-l1 {
+			regulator-min-microvolt = <1000000>;
+			regulator-max-microvolt = <1000000>;
+			qcom,init-voltage = <1000000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa2 {
+		status = "okay";
+		pm8994_l2: regulator-l2 {
+			regulator-min-microvolt = <1250000>;
+			regulator-max-microvolt = <1250000>;
+			qcom,init-voltage = <1250000>;
+			proxy-supply = <&pm8994_l2>;
+			qcom,proxy-consumer-enable;
+			qcom,proxy-consumer-current = <10000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa3 {
+		status = "okay";
+		pm8994_l3: regulator-l3 {
+			regulator-min-microvolt = <850000>;
+			regulator-max-microvolt = <850000>;
+			qcom,init-voltage = <850000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa4 {
+		status = "okay";
+		pm8994_l4: regulator-l4 {
+			regulator-min-microvolt = <1225000>;
+			regulator-max-microvolt = <1225000>;
+			qcom,init-voltage = <1225000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa6 {
+		status = "okay";
+		pm8994_l6: regulator-l6 {
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			qcom,init-voltage = <1200000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa8 {
+		status = "okay";
+		pm8994_l8: regulator-l8 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			qcom,init-voltage = <1800000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa9 {
+		status = "okay";
+		pm8994_l9: regulator-l9 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			qcom,init-voltage = <1800000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa10 {
+		status = "okay";
+		pm8994_l10: regulator-l10 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			qcom,init-voltage = <1800000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa11 {
+		status = "okay";
+		pm8994_l11: regulator-l11 {
+			regulator-min-microvolt = <1150000>;
+			regulator-max-microvolt = <1150000>;
+			qcom,init-voltage = <1150000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa12 {
+		status = "okay";
+		pm8994_l12: regulator-l12 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			qcom,init-voltage = <1800000>;
+			proxy-supply = <&pm8994_l12>;
+			qcom,proxy-consumer-enable;
+			qcom,proxy-consumer-current = <10000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa13 {
+		status = "okay";
+		pm8994_l13: regulator-l13 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <2950000>;
+			qcom,init-voltage = <2950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa14 {
+		status = "okay";
+		pm8994_l14: regulator-l14 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			qcom,init-voltage = <1800000>;
+			proxy-supply = <&pm8994_l14>;
+			qcom,proxy-consumer-enable;
+			qcom,proxy-consumer-current = <10000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa15 {
+		status = "okay";
+		pm8994_l15: regulator-l15 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			qcom,init-voltage = <1800000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa16 {
+		status = "okay";
+		pm8994_l16: regulator-l16 {
+			regulator-min-microvolt = <2700000>;
+			regulator-max-microvolt = <2700000>;
+			qcom,init-voltage = <2700000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa17 {
+		status = "okay";
+		pm8994_l17: regulator-l17 {
+			regulator-min-microvolt = <2500000>;
+			regulator-max-microvolt = <2500000>;
+			qcom,init-voltage = <2500000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa18 {
+		status = "okay";
+		pm8994_l18: regulator-l18 {
+			regulator-min-microvolt = <2700000>;
+			regulator-max-microvolt = <2900000>;
+			qcom,init-voltage = <2700000>;
+			status = "okay";
+		};
+
+		pm8994_l18_pin_ctrl: regulator-l18-pin-ctrl {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l18_pin_ctrl";
+			qcom,set = <3>;
+			regulator-min-microvolt = <2700000>;
+			regulator-max-microvolt = <2900000>;
+			qcom,init-voltage = <2700000>;
+			/*
+			 * LDO 18 output is enabled when PM8994 GPIO 11 (HW_EN2)
+			 * is driven high.
+			 */
+			qcom,enable-with-pin-ctrl = <0 4>;
+		};
+	};
+
+	rpm-regulator-ldoa19 {
+		status = "okay";
+		pm8994_l19: regulator-l19 {
+			regulator-min-microvolt = <3000000>;
+			regulator-max-microvolt = <3000000>;
+			qcom,init-voltage = <3000000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa20 {
+		status = "okay";
+		pm8994_l20: regulator-l20 {
+			regulator-min-microvolt = <2950000>;
+			regulator-max-microvolt = <2950000>;
+			qcom,init-voltage = <2950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa21 {
+		status = "okay";
+		pm8994_l21: regulator-l21 {
+			regulator-min-microvolt = <2950000>;
+			regulator-max-microvolt = <2950000>;
+			qcom,init-voltage = <2950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa22 {
+		status = "okay";
+		pm8994_l22: regulator-l22 {
+			regulator-min-microvolt = <3300000>;
+			regulator-max-microvolt = <3300000>;
+			qcom,init-voltage = <3300000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa23 {
+		status = "okay";
+		pm8994_l23: regulator-l23 {
+			regulator-min-microvolt = <2800000>;
+			regulator-max-microvolt = <2800000>;
+			qcom,init-voltage = <2800000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa24 {
+		status = "okay";
+		pm8994_l24: regulator-l24 {
+			regulator-min-microvolt = <3075000>;
+			regulator-max-microvolt = <3075000>;
+			qcom,init-voltage = <3075000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa25 {
+		status = "okay";
+		pm8994_l25: regulator-l25 {
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			qcom,init-voltage = <1200000>;
+			proxy-supply = <&pm8994_l25>;
+			qcom,proxy-consumer-enable;
+			qcom,proxy-consumer-current = <10000>;
+			status = "okay";
+		};
+	};
+
+	/* PM8994 LDO26 = VDD_SS_CX supply */
+	rpm-regulator-ldoa26 {
+		status = "okay";
+		pm8994_l26_corner: regulator-l26-corner {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l26_corner";
+			qcom,set = <3>;
+			regulator-min-microvolt = <1>;
+			regulator-max-microvolt = <7>;
+			qcom,use-voltage-corner;
+		};
+
+		pm8994_l26_floor_corner: regulator-l26-floor-corner {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8994_l26_floor_corner";
+			qcom,set = <3>;
+			regulator-min-microvolt = <1>;
+			regulator-max-microvolt = <7>;
+			qcom,use-voltage-floor-corner;
+			qcom,always-send-voltage;
+		};
+	};
+
+	rpm-regulator-ldoa27 {
+		status = "okay";
+		pm8994_l27: regulator-l27 {
+			regulator-min-microvolt = <1000000>;
+			regulator-max-microvolt = <1000000>;
+			qcom,init-voltage = <1000000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa28 {
+		status = "okay";
+		pm8994_l28: regulator-l28 {
+			regulator-min-microvolt = <925000>;
+			regulator-max-microvolt = <925000>;
+			qcom,init-voltage = <925000>;
+			proxy-supply = <&pm8994_l28>;
+			qcom,proxy-consumer-enable;
+			qcom,proxy-consumer-current = <10000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa29 {
+		status = "okay";
+		pm8994_l29: regulator-l29 {
+			regulator-min-microvolt = <2800000>;
+			regulator-max-microvolt = <2800000>;
+			qcom,init-voltage = <2800000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa30 {
+		status = "okay";
+		pm8994_l30: regulator-l30 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			qcom,init-voltage = <1800000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa32 {
+		status = "okay";
+		pm8994_l32: regulator-l32 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			qcom,init-voltage = <1800000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-vsa1 {
+		status = "okay";
+		pm8994_lvs1: regulator-lvs1 {
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-vsa2 {
+		status = "okay";
+		pm8994_lvs2: regulator-lvs2 {
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-smpb1 {
+		status = "okay";
+		pmi8994_s1: regulator-s1 {
+			regulator-min-microvolt = <1025000>;
+			regulator-max-microvolt = <1025000>;
+			qcom,init-voltage = <1025000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-bstb {
+		status = "okay";
+		pmi8994_boost_5v: regulator-bst {
+			/*
+			 * When enabled, the PMI8994 Boost regulator always
+			 * outputs 5V.  This takes precedence over the pin
+			 * control boost regulator request.
+			 */
+			regulator-name = "pmi8994_boost_5v";
+			parent-supply = <&pon_perph_reg>;
+			status = "okay";
+		};
+		pmi8994_boost_pin_ctrl: regulator-bst-pin-ctrl {
+			/*
+			 * When enabled, the output voltage of the PMI8994
+			 * boost regulator is determined by the state of the
+			 * REQ_5V_BST pin.  If the pin signal is high, then the
+			 * regulator outputs 5V.  If the pin signal is low, then
+			 * the regulator outputs VPH_PWR voltage.
+			 */
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pmi8994_boost_pin_ctrl";
+			parent-supply = <&pon_perph_reg>;
+			qcom,set = <3>;
+			qcom,enable-with-pin-ctrl = <0 1>;
+		};
+	};
+
+	rpm-regulator-bbyb {
+		status = "okay";
+		pmi8994_boostbypass: regulator-bby {
+			status = "okay";
+			regulator-min-microvolt = <3150000>;
+			regulator-max-microvolt = <3600000>;
+			qcom,init-voltage = <3150000>;
+		};
+	};
+};
+
+/* SPM controlled regulators: */
+&spmi_bus {
+	qcom,pm8994@1 {
+		/*
+		 * PM8994 S8 + S9 + S10 + S11 = 4 phase VDD_APCC supply
+		 * S11 is the gang leader.
+		 */
+		pm8994_s11: spm-regulator@3200 {
+			compatible = "qcom,spm-regulator";
+			reg = <0x3200 0x100>;
+			regulator-name = "pm8994_s11";
+			regulator-min-microvolt = <470000>;
+			regulator-max-microvolt = <1140000>;
+			qcom,max-voltage-step = <150000>;
+			qcom,cpu-num = <0>;
+			qcom,recal-mask = <3>;
+
+			pm8994_s11_limit: avs-limit-regulator {
+				regulator-name = "pm8994_s11_avs_limit";
+				regulator-min-microvolt = <470000>;
+				regulator-max-microvolt = <1140000>;
+			};
+		};
+	};
+};
+
+/* SPMI controlled regulators: */
+&spmi_bus {
+	qcom,pmi8994@3 {
+		/* PMI8994 S2 + S3 = 2 phase VDD_GFX supply */
+		pmi8994_s2: regulator@1700 {
+			compatible = "qcom,qpnp-regulator";
+			reg = <0x1700 0x100>;
+			regulator-name = "pmi8994_s2";
+			regulator-min-microvolt = <400000>;
+			regulator-max-microvolt = <1015000>;
+			qcom,enable-time = <500>;
+		};
+	};
+
+	qcom,pm8004@5 {
+		compatible ="qcom,spmi-pmic";
+		reg = <0x5 SPMI_USID>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+		/*
+		 * PM8004 S2 + S4 = 2 phase VDD_GFX supply when PM8004 is
+		 * present on the board.
+		 */
+		pm8004_s2: regulator@1700 {
+			compatible = "qcom,qpnp-regulator";
+			reg = <0x1700 0x100>;
+			regulator-name = "pm8004_s2";
+			regulator-min-microvolt = <400000>;
+			regulator-max-microvolt = <1015000>;
+			qcom,enable-time = <500>;
+			status = "disabled";
+		};
+	};
+};
+
+&soc {
+/* CPR controlled regulators */
+	apcc_cpr: cpr3-ctrl@99e8000 {
+		compatible = "qcom,cpr3-msm8996-hmss-regulator";
+		reg = <0x099e8000 0x4000>, <0x00074000 0x1000>;
+		reg-names = "cpr_ctrl", "fuse_base";
+		clocks = <&clock_gcc clk_gcc_hmss_rbcpr_clk>;
+		clock-names = "core_clk";
+		interrupts = <GIC_SPI 48 IRQ_TYPE_EDGE_RISING>,
+			<GIC_SPI 47 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "cpr", "ceiling";
+		qcom,cpr-ctrl-name = "apcc";
+
+		qcom,cpr-sensor-time = <1000>;
+		qcom,cpr-loop-time = <5000000>;
+		qcom,cpr-idle-cycles = <15>;
+		qcom,cpr-up-down-delay-time = <3000>;
+		qcom,cpr-step-quot-init-min = <11>;
+		qcom,cpr-step-quot-init-max = <13>;
+		qcom,cpr-count-mode = <0>;		/* All-at-once min */
+		qcom,cpr-count-repeat = <25>;
+
+		qcom,apm-ctrl = <&apc_apm>;
+		qcom,apm-threshold-voltage = <850000>;
+		qcom,apm-hysteresis-voltage = <5000>;
+		qcom,system-supply-max-voltage = <1015000>;
+		qcom,mem-acc-supply-threshold-voltage = <700000>;
+		qcom,mem-acc-supply-corner-map = <1 2>;
+
+		vdd-supply = <&pm8994_s11>;
+		qcom,voltage-step = <5000>;
+		vdd-limit-supply = <&pm8994_s11_limit>;
+		mem-acc-thread0-supply = <&apc0_pwrcl_mem_acc_vreg>;
+		mem-acc-thread1-supply = <&apc1_perfcl_mem_acc_vreg>;
+		mem-acc-supply = <&apcc_l3_mem_acc_vreg>;
+		vdd-thread0-ldo-supply = <&kryo0_vreg>;
+		vdd-thread1-ldo-supply = <&kryo1_vreg>;
+		vdd-thread0-ldo-ret-supply = <&kryo0_retention_vreg>;
+		vdd-thread1-ldo-ret-supply = <&kryo1_retention_vreg>;
+		proxy-supply = <&apc0_cbf_vreg>;
+
+		qcom,cpr-enable;
+		qcom,cpr-clock-throttling = <0x20>;
+
+		qcom,cpr-aging-ref-voltage = <905000>;
+
+		thread@0 {
+			qcom,cpr-thread-id = <0>;
+			qcom,cpr-consecutive-up = <0>;
+			qcom,cpr-consecutive-down = <3>;
+			qcom,cpr-up-threshold = <2>;
+			qcom,cpr-down-threshold = <2>;
+
+			apc0_pwrcl_vreg: regulator-pwrcl {
+				regulator-name = "apc0_pwrcl_corner";
+				regulator-min-microvolt = <1>;
+				regulator-max-microvolt = <16>;
+
+				qcom,cpr-pd-bypass-mask = <0x07>;
+				qcom,cpr-fuse-corners = <5>;
+				qcom,cpr-fuse-combos = <24>;
+				qcom,cpr-speed-bins = <3>;
+				qcom,cpr-speed-bin-corners = <16 13 16>;
+				qcom,cpr-corners =
+					/* Speed bin 0 */
+					<16 16 16 16 16 16 16 16>,
+
+					/* Speed bin 1 */
+					<13 13 13 13 13 13 13 13>,
+
+					/* Speed bin 2 */
+					<16 16 16 16 16 16 16 16>;
+
+				qcom,ldo-min-headroom-voltage = <150000>;
+				qcom,ldo-max-headroom-voltage = <470000>;
+				qcom,ldo-max-voltage = <890000>;
+				qcom,uses-mem-acc;
+
+				qcom,cpr-corner-fmax-map =
+					/* Speed bin 0 */
+					<1 2 7 12 16>,
+
+					/* Speed bin 1 */
+					<1 2 7 12 13>,
+
+					/* Speed bin 2 */
+					<1 2 7 12 16>;
+
+				qcom,cpr-voltage-ceiling =
+					/* Speed bin 0 */
+					<670000  670000  745000  745000  745000
+					 745000  745000  905000  905000  905000
+					 905000  905000 1140000 1140000 1140000
+					1140000>,
+
+					/* Speed bin 1 */
+					<670000  670000  745000  745000  745000
+					 745000  745000  905000  905000  905000
+					 905000  905000 1140000>,
+
+					/* Speed bin 2 */
+					<670000  670000  745000  745000  745000
+					 745000  745000  905000  905000  905000
+					 905000  905000 1140000 1140000 1140000
+					1140000>;
+
+				qcom,cpr-voltage-floor =
+					/* Speed bin 0 */
+					<625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000>,
+					<625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000>,
+					<625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000>,
+					<625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000>,
+					<625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000>,
+					<625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000>,
+					<470000  470000  470000  470000  470000
+					 470000  470000  470000  470000  470000
+					 470000  470000  470000  470000  470000
+					 470000>,
+					<470000  470000  470000  470000  470000
+					 470000  470000  470000  470000  470000
+					 470000  470000  470000  470000  470000
+					 470000>,
+
+					/* Speed bin 1 */
+					<625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000  625000  625000>,
+					<625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000  625000  625000>,
+					<625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000  625000  625000>,
+					<625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000  625000  625000>,
+					<625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000  625000  625000>,
+					<625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000  625000  625000>,
+					<470000  470000  470000  470000  470000
+					 470000  470000  470000  470000  470000
+					 470000  470000  470000>,
+					<470000  470000  470000  470000  470000
+					 470000  470000  470000  470000  470000
+					 470000  470000  470000>,
+
+					/* Speed bin 2 */
+					<625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000>,
+					<625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000>,
+					<625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000>,
+					<625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000>,
+					<625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000>,
+					<625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000  625000  625000  625000  625000
+					 625000>,
+					<470000  470000  470000  470000  470000
+					 470000  470000  470000  470000  470000
+					 470000  470000  470000  470000  470000
+					 470000>,
+					<470000  470000  470000  470000  470000
+					 470000  470000  470000  470000  470000
+					 470000  470000  470000  470000  470000
+					 470000>;
+
+				qcom,cpr-floor-to-ceiling-max-range =
+					/* Speed bin 0 */
+					 <50000   50000   80000   80000   80000
+					  80000   80000   80000   80000   80000
+					  80000   80000   80000   80000   80000
+					  80000>,
+
+					/* Speed bin 1 */
+					 <50000   50000   80000   80000   80000
+					  80000   80000   80000   80000   80000
+					  80000   80000   80000>,
+
+					/* Speed bin 2 */
+					 <50000   50000   80000   80000   80000
+					  80000   80000   80000   80000   80000
+					  80000   80000   80000   80000   80000
+					  80000>;
+
+				qcom,corner-frequencies =
+					/* Speed bin 0 */
+					<307200000  422400000  480000000
+					 556800000  652800000  729600000
+					 844800000  960000000 1036800000
+					1113600000 1190400000 1228800000
+					1324800000 1401600000 1478400000
+					1593600000>,
+
+					/* Speed bin 1 */
+					<307200000  422400000  480000000
+					 556800000  652800000  729600000
+					 844800000  960000000 1036800000
+					1113600000 1190400000 1228800000
+					1363200000>,
+
+					/* Speed bin 2 */
+					<307200000  422400000  480000000
+					 556800000  652800000  729600000
+					 844800000  960000000 1036800000
+					1113600000 1190400000 1228800000
+					1324800000 1401600000 1478400000
+					1593600000>;
+
+				qcom,cpr-ro-scaling-factor =
+				      <   0    0 3112 2666 2947 2543 2271 1979
+				       2623 2317 2772 2450    0    0    0    0>,
+				      <   0    0 3112 2666 2947 2543 2271 1979
+				       2623 2317 2772 2450    0    0    0    0>,
+				      <   0    0 3112 2666 2947 2543 2271 1979
+				       2623 2317 2772 2450    0    0    0    0>,
+				      <   0    0 3112 2666 2947 2543 2271 1979
+				       2623 2317 2772 2450    0    0    0    0>,
+				      <   0    0 2889 2528 2740 2426 2310 2040
+				       2519 2257 2668 2372    0    0    0    0>;
+
+				qcom,cpr-open-loop-voltage-fuse-adjustment =
+					/* Speed bin 0 */
+					<20000     0 25000 (-5000) (-10000)>,
+					<20000     0 25000 (-5000) (-10000)>,
+					<20000     0 25000 (-5000) (-10000)>,
+					<35000     0 40000  10000     5000>,
+					<35000     0 40000  10000     5000>,
+					<35000     0 40000  10000     5000>,
+					<35000     0 40000  10000     5000>,
+					<35000     0 40000  10000     5000>,
+
+					/* Speed bin 1 */
+					<20000     0 25000 (-5000) (-10000)>,
+					<20000     0 25000 (-5000) (-10000)>,
+					<20000     0 25000 (-5000) (-10000)>,
+					<35000     0 40000  10000     5000>,
+					<35000     0 40000  10000     5000>,
+					<35000     0 40000  10000     5000>,
+					<35000     0 40000  10000     5000>,
+					<35000     0 40000  10000     5000>,
+
+					/* Speed bin 2 */
+					<20000     0 25000 (-5000) (-10000)>,
+					<20000     0 25000 (-5000) (-10000)>,
+					<20000     0 25000 (-5000) (-10000)>,
+					<35000     0 40000  10000     5000>,
+					<35000     0 40000  10000     5000>,
+					<35000     0 40000  10000     5000>,
+					<35000     0 40000  10000     5000>,
+					<35000     0 40000  10000     5000>;
+
+				qcom,cpr-closed-loop-voltage-fuse-adjustment =
+					/* Speed bin 0 */
+					<35000 35000 40000  40000   40000>,
+					<20000 10000  5000 (-5000) (-5000)>,
+					<20000 10000  5000 (-5000) (-5000)>,
+					<20000 10000  5000 (-5000) (-5000)>,
+					<20000 10000  5000 (-5000) (-5000)>,
+					<20000 10000  5000 (-5000) (-5000)>,
+					<20000 10000  5000 (-5000) (-5000)>,
+					<20000 10000  5000 (-5000) (-5000)>,
+
+					/* Speed bin 1 */
+					<35000 35000 40000  40000   40000>,
+					<20000 10000  5000 (-5000) (-5000)>,
+					<20000 10000  5000 (-5000) (-5000)>,
+					<20000 10000  5000 (-5000) (-5000)>,
+					<20000 10000  5000 (-5000) (-5000)>,
+					<20000 10000  5000 (-5000) (-5000)>,
+					<20000 10000  5000 (-5000) (-5000)>,
+					<20000 10000  5000 (-5000) (-5000)>,
+
+					/* Speed bin 2 */
+					<35000 35000 40000  40000   40000>,
+					<20000 10000  5000 (-5000) (-5000)>,
+					<20000 10000  5000 (-5000) (-5000)>,
+					<20000 10000  5000 (-5000) (-5000)>,
+					<20000 10000  5000 (-5000) (-5000)>,
+					<20000 10000  5000 (-5000) (-5000)>,
+					<20000 10000  5000 (-5000) (-5000)>,
+					<20000 10000  5000 (-5000) (-5000)>;
+
+				qcom,cpr-open-loop-voltage-adjustment =
+					/* Speed bin 0 */
+					<(-15000) (-15000) (-15000) (-15000)
+					 (-13000) (-14000) (-15000) (-18000)
+					 (-20000) (-22000) (-24000) (-25000)
+					 (-26000) (-27000) (-28000) (-30000)>,
+
+					/* Speed bin 1 */
+					<(-15000) (-15000) (-15000) (-15000)
+					 (-13000) (-14000) (-15000) (-18000)
+					 (-20000) (-22000) (-24000) (-25000)
+					 (-26000)>,
+
+					/* Speed bin 2 */
+					<(-15000) (-15000) (-15000) (-15000)
+					 (-13000) (-14000) (-15000) (-18000)
+					 (-20000) (-22000) (-24000) (-25000)
+					 (-26000) (-27000) (-28000) (-30000)>;
+
+				qcom,cpr-open-loop-voltage-min-diff =
+					/* Speed bin 0 */
+				       <0 0 0 0 (-50000) 0 0 0 0 0 0 0 0 0 0 0>,
+
+					/* Speed bin 1 */
+				       <0 0 0 0 (-50000) 0 0 0 0 0 0 0 0>,
+
+					/* Speed bin 2 */
+				       <0 0 0 0 (-50000) 0 0 0 0 0 0 0 0 0 0 0>;
+
+				qcom,cpr-closed-loop-voltage-adjustment =
+					/* Speed bin 0 */
+					<(-15000) (-15000) (-15000) (-15000)
+					 (-13000) (-14000) (-15000) (-18000)
+					 (-20000) (-22000) (-24000) (-25000)
+					 (-26000) (-27000) (-28000) (-30000)>,
+
+					/* Speed bin 1 */
+					<(-15000) (-15000) (-15000) (-15000)
+					 (-13000) (-14000) (-15000) (-18000)
+					 (-20000) (-22000) (-24000) (-25000)
+					 (-26000)>,
+
+					/* Speed bin 2 */
+					<(-15000) (-15000) (-15000) (-15000)
+					 (-13000) (-14000) (-15000) (-18000)
+					 (-20000) (-22000) (-24000) (-25000)
+					 (-26000) (-27000) (-28000) (-30000)>;
+
+				qcom,allow-voltage-interpolation;
+				qcom,allow-quotient-interpolation;
+				qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+
+				qcom,cpr-aging-max-voltage-adjustment = <15000>;
+				qcom,cpr-aging-ref-corner = <12 12 12>;
+				qcom,cpr-aging-ro-scaling-factor = <3200>;
+				qcom,allow-aging-voltage-adjustment =
+					/* Speed bin 0 */
+					<0 0 0 1 1 1 1 1>,
+
+					/* Speed bin 1 */
+					<0 0 0 1 1 1 1 1>,
+
+					/* Speed bin 2 */
+					<0 0 0 1 1 1 1 1>;
+			};
+
+			apc0_cbf_vreg: regulator-cbf {
+				regulator-name = "apc0_cbf_corner";
+				regulator-min-microvolt = <1>;
+				regulator-max-microvolt = <19>;
+
+				qcom,proxy-consumer-enable;
+				qcom,proxy-consumer-voltage = <13 19>;
+
+				qcom,cpr-pd-bypass-mask = <0x18>;
+				qcom,cpr-fuse-corners = <5>;
+				qcom,cpr-fuse-combos = <24>;
+				qcom,cpr-speed-bins = <3>;
+				qcom,cpr-speed-bin-corners = <19 15 19>;
+				qcom,cpr-corners =
+					/* Speed bin 0 */
+					<19 19 19 19 19 19 19 19>,
+
+					/* Speed bin 1 */
+					<15 15 15 15 15 15 15 15>,
+
+					/* Speed bin 2 */
+					<19 19 19 19 19 19 19 19>;
+
+				qcom,cpr-corner-fmax-map =
+					/* Speed bin 0 */
+					<1 2 5 13 19>,
+
+					/* Speed bin 1 */
+					<1 2 5 13 15>,
+
+					/* Speed bin 2 */
+					<1 2 5 13 19>;
+
+				qcom,cpr-voltage-ceiling =
+				       /* Speed bin 0 */
+				       <670000  670000  745000  745000  745000
+					905000  905000  905000  905000  905000
+					905000  905000  905000 1140000 1140000
+				       1140000 1140000 1140000 1140000>,
+
+				       /* Speed bin 1 */
+				       <670000  670000  745000  745000  745000
+					905000  905000  905000  905000  905000
+					905000  905000  905000 1140000 1140000>,
+
+				       /* Speed bin 2 */
+				       <670000  670000  745000  745000  745000
+					905000  905000  905000  905000  905000
+					905000  905000  905000 1140000 1140000
+				       1140000 1140000 1140000 1140000>;
+
+				qcom,cpr-voltage-floor =
+				       /* Speed bin 0 */
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000>,
+				       <470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000>,
+				       <470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000>,
+
+				       /* Speed bin 1 */
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000>,
+				       <470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000>,
+				       <470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000>,
+
+				       /* Speed bin 2 */
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000>,
+				       <470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000>,
+				       <470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000>;
+
+				qcom,cpr-floor-to-ceiling-max-range =
+					/* Speed bin 0 */
+					<50000   50000   80000   80000   80000
+					 80000   80000   80000   80000   80000
+					 80000   80000   80000   80000   80000
+					 80000   80000   80000   80000>,
+
+					/* Speed bin 1 */
+					<50000   50000   80000   80000   80000
+					 80000   80000   80000   80000   80000
+					 80000   80000   80000   80000   80000>,
+
+					/* Speed bin 2 */
+					<50000   50000   80000   80000   80000
+					 80000   80000   80000   80000   80000
+					 80000   80000   80000   80000   80000
+					 80000   80000   80000   80000>;
+
+				qcom,corner-frequencies =
+					/* Speed bin 0 */
+					<307200000  384000000  460800000
+					 537600000  595200000  672000000
+					 748800000  825600000  902400000
+					 979200000 1056000000 1132800000
+					1190400000 1228800000 1305600000
+					1382400000 1459200000 1536000000
+					1593600000>,
+
+					/* Speed bin 1 */
+					<307200000  384000000  460800000
+					 537600000  595200000  672000000
+					 748800000  825600000  902400000
+					 979200000 1056000000 1132800000
+					1190400000 1228800000 1305600000>,
+
+					/* Speed bin 2 */
+					<307200000  384000000  460800000
+					 537600000  595200000  672000000
+					 748800000  825600000  902400000
+					 979200000 1056000000 1132800000
+					1190400000 1228800000 1305600000
+					1382400000 1459200000 1536000000
+					1593600000>;
+
+				qcom,cpr-ro-scaling-factor =
+				      <   0    0 3112 2666 2947 2543 2271 1979
+				       2623 2317 2772 2450    0    0    0    0>,
+				      <   0    0 3112 2666 2947 2543 2271 1979
+				       2623 2317 2772 2450    0    0    0    0>,
+				      <   0    0 3112 2666 2947 2543 2271 1979
+				       2623 2317 2772 2450    0    0    0    0>,
+				      <   0    0 3112 2666 2947 2543 2271 1979
+				       2623 2317 2772 2450    0    0    0    0>,
+				      <   0    0 2889 2528 2740 2426 2310 2040
+				       2519 2257 2668 2372    0    0    0    0>;
+
+				qcom,cpr-open-loop-voltage-fuse-adjustment =
+					/* Speed bin 0 */
+					<30000    0 (-10000) (-10000) (-40000)>,
+					<30000    0 (-10000) (-10000) (-40000)>,
+					<30000    0 (-10000) (-10000) (-40000)>,
+					<45000    0    5000     5000  (-25000)>,
+					<45000    0    5000     5000  (-25000)>,
+					<45000    0    5000     5000  (-25000)>,
+					<45000    0    5000     5000  (-25000)>,
+					<45000    0    5000     5000  (-25000)>,
+
+					/* Speed bin 1 */
+					<30000    0 (-10000) (-10000) (-40000)>,
+					<30000    0 (-10000) (-10000) (-40000)>,
+					<30000    0 (-10000) (-10000) (-40000)>,
+					<45000    0    5000     5000  (-25000)>,
+					<45000    0    5000     5000  (-25000)>,
+					<45000    0    5000     5000  (-25000)>,
+					<45000    0    5000     5000  (-25000)>,
+					<45000    0    5000     5000  (-25000)>,
+
+					/* Speed bin 2 */
+					<30000    0 (-10000) (-10000) (-40000)>,
+					<30000    0 (-10000) (-10000) (-40000)>,
+					<30000    0 (-10000) (-10000) (-40000)>,
+					<45000    0    5000     5000  (-25000)>,
+					<45000    0    5000     5000  (-25000)>,
+					<45000    0    5000     5000  (-25000)>,
+					<45000    0    5000     5000  (-25000)>,
+					<45000    0    5000     5000  (-25000)>;
+
+				qcom,cpr-closed-loop-voltage-fuse-adjustment =
+					/* Speed bin 0 */
+					<10000 5000        0        0        0>,
+					<10000 5000 (-20000)        0 (-35000)>,
+					<10000 5000 (-20000)        0 (-35000)>,
+					<10000 5000 (-20000)        0 (-35000)>,
+					<10000 5000 (-20000)        0 (-35000)>,
+					<10000 5000 (-20000)        0 (-35000)>,
+					<10000 5000 (-20000)        0 (-35000)>,
+					<10000 5000 (-20000)        0 (-35000)>,
+
+					/* Speed bin 1 */
+					<10000 5000        0        0        0>,
+					<10000 5000 (-20000)        0 (-35000)>,
+					<10000 5000 (-20000)        0 (-35000)>,
+					<10000 5000 (-20000)        0 (-35000)>,
+					<10000 5000 (-20000)        0 (-35000)>,
+					<10000 5000 (-20000)        0 (-35000)>,
+					<10000 5000 (-20000)        0 (-35000)>,
+					<10000 5000 (-20000)        0 (-35000)>,
+
+					/* Speed bin 2 */
+					<10000 5000        0        0        0>,
+					<10000 5000 (-20000)        0 (-35000)>,
+					<10000 5000 (-20000)        0 (-35000)>,
+					<10000 5000 (-20000)        0 (-35000)>,
+					<10000 5000 (-20000)        0 (-35000)>,
+					<10000 5000 (-20000)        0 (-35000)>,
+					<10000 5000 (-20000)        0 (-35000)>,
+					<10000 5000 (-20000)        0 (-35000)>;
+
+				qcom,allow-voltage-interpolation;
+				qcom,allow-quotient-interpolation;
+				qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+
+				qcom,cpr-aging-max-voltage-adjustment = <15000>;
+				qcom,cpr-aging-ref-corner = <13 13 13>;
+				qcom,cpr-aging-ro-scaling-factor = <3200>;
+				qcom,allow-aging-voltage-adjustment =
+					/* Speed bin 0 */
+					<0 0 0 1 1 1 1 1>,
+
+					/* Speed bin 1 */
+					<0 0 0 1 1 1 1 1>,
+
+					/* Speed bin 2 */
+					<0 0 0 1 1 1 1 1>;
+			};
+		};
+
+		thread@1 {
+			qcom,cpr-thread-id = <1>;
+			qcom,cpr-consecutive-up = <0>;
+			qcom,cpr-consecutive-down = <3>;
+			qcom,cpr-up-threshold = <2>;
+			qcom,cpr-down-threshold = <2>;
+
+			apc1_vreg: regulator {
+				regulator-name = "apc1_corner";
+				regulator-min-microvolt = <1>;
+				regulator-max-microvolt = <25>;
+
+				qcom,cpr-pd-bypass-mask = <0xe0>;
+				qcom,cpr-fuse-corners = <5>;
+				qcom,cpr-fuse-combos = <24>;
+				qcom,cpr-speed-bins = <3>;
+				qcom,cpr-speed-bin-corners = <25 21 25>;
+				qcom,cpr-corners =
+					/* Speed bin 0 */
+					<25 25 25 25 25 25 25 25>,
+
+					/* Speed bin 1 */
+					<21 21 21 21 21 21 21 21>,
+
+					/* Speed bin 0 */
+					<25 25 25 25 25 25 25 25>;
+
+				qcom,ldo-min-headroom-voltage = <150000>;
+				qcom,ldo-max-headroom-voltage = <470000>;
+				qcom,ldo-max-voltage = <890000>;
+				qcom,uses-mem-acc;
+
+				qcom,cpr-corner-fmax-map =
+					/* Speed bin 0 */
+					<1 4 9 13 25>,
+
+					/* Speed bin 1 */
+					<1 4 9 13 21>,
+
+					/* Speed bin 2 */
+					<1 4 9 13 25>;
+
+				qcom,cpr-voltage-ceiling =
+				       /* Speed bin 0 */
+				       <670000  670000  670000  670000  745000
+					745000  745000  745000  745000  905000
+					905000  905000  905000 1140000 1140000
+				       1140000 1140000 1140000 1140000 1140000
+				       1140000 1140000 1140000 1140000 1140000>,
+
+				       /* Speed bin 1 */
+				       <670000  670000  670000  670000  745000
+					745000  745000  745000  745000  905000
+					905000  905000  905000 1140000 1140000
+				       1140000 1140000 1140000 1140000 1140000
+				       1140000>,
+
+				       /* Speed bin 2 */
+				       <670000  670000  670000  670000  745000
+					745000  745000  745000  745000  905000
+					905000  905000  905000 1140000 1140000
+				       1140000 1140000 1140000 1140000 1140000
+				       1140000 1140000 1140000 1140000 1140000>;
+
+
+				qcom,cpr-voltage-floor =
+				       /* Speed bin 0 */
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000>,
+				       <470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000>,
+				       <470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000>,
+
+				       /* Speed bin 1 */
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000>,
+				       <470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000>,
+				       <470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000>,
+
+				       /* Speed bin 2 */
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000>,
+				       <625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000
+					625000  625000  625000  625000  625000>,
+				       <470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000>,
+				       <470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000
+					470000  470000  470000  470000  470000>;
+
+				qcom,cpr-floor-to-ceiling-max-range =
+					/* Speed bin 0 */
+					<50000   50000   50000   50000   80000
+					 80000   80000   80000   80000   80000
+					 80000   80000   80000   80000   80000
+					 80000   80000   80000   80000   80000
+					 80000   80000   80000   80000   80000>,
+
+					/* Speed bin 1 */
+					<50000   50000   50000   50000   80000
+					 80000   80000   80000   80000   80000
+					 80000   80000   80000   80000   80000
+					 80000   80000   80000   80000   80000
+					 80000>,
+
+					/* Speed bin 2 */
+					<50000   50000   50000   50000   80000
+					 80000   80000   80000   80000   80000
+					 80000   80000   80000   80000   80000
+					 80000   80000   80000   80000   80000
+					 80000   80000   80000   80000   80000>;
+
+				qcom,corner-frequencies =
+					/* Speed bin 0 */
+					<307200000  403200000  480000000
+					 556800000  652800000  729600000
+					 806400000  883200000  940800000
+					1036800000 1113600000 1190400000
+					1248000000 1324800000 1401600000
+					1478400000 1555200000 1632000000
+					1708800000 1785600000 1824000000
+					1920000000 1996800000 2073600000
+					2150400000>,
+
+					/* Speed bin 1 */
+					<307200000  403200000  480000000
+					 556800000  652800000  729600000
+					 806400000  883200000  940800000
+					1036800000 1113600000 1190400000
+					1248000000 1324800000 1401600000
+					1478400000 1555200000 1632000000
+					1708800000 1785600000 1804800000>,
+
+					/* Speed bin 2 */
+					<307200000  403200000  480000000
+					 556800000  652800000  729600000
+					 806400000  883200000  940800000
+					1036800000 1113600000 1190400000
+					1248000000 1324800000 1401600000
+					1478400000 1555200000 1632000000
+					1708800000 1785600000 1824000000
+					1920000000 1996800000 2073600000
+					2150400000>;
+
+				qcom,cpr-ro-scaling-factor =
+				      <   0    0 3112 2666 2947 2543 2271 1979
+				       2623 2317 2772 2450    0    0    0    0>,
+				      <   0    0 3112 2666 2947 2543 2271 1979
+				       2623 2317 2772 2450    0    0    0    0>,
+				      <   0    0 3112 2666 2947 2543 2271 1979
+				       2623 2317 2772 2450    0    0    0    0>,
+				      <   0    0 3112 2666 2947 2543 2271 1979
+				       2623 2317 2772 2450    0    0    0    0>,
+				      <   0    0 2889 2528 2740 2426 2310 2040
+				       2519 2257 2668 2372    0    0    0    0>;
+
+				qcom,cpr-open-loop-voltage-fuse-adjustment =
+					/* Speed bin 0 */
+					<20000     0 15000 (-55000)     0>,
+					<20000     0 15000 (-55000)     0>,
+					<20000     0 15000       0      0>,
+					<35000     0 30000   15000  15000>,
+					<35000     0 30000   15000  15000>,
+					<35000     0 30000   15000  15000>,
+					<35000     0 30000   15000  15000>,
+					<35000     0 30000   15000  15000>,
+
+					/* Speed bin 1 */
+					<20000     0 15000 (-55000)     0>,
+					<20000     0 15000 (-55000)     0>,
+					<20000     0 15000       0      0>,
+					<35000     0 30000   15000  15000>,
+					<35000     0 30000   15000  15000>,
+					<35000     0 30000   15000  15000>,
+					<35000     0 30000   15000  15000>,
+					<35000     0 30000   15000  15000>,
+
+					/* Speed bin 2 */
+					<20000     0 15000 (-55000)     0>,
+					<20000     0 15000 (-55000)     0>,
+					<20000     0 15000       0      0>,
+					<35000     0 30000   15000  15000>,
+					<35000     0 30000   15000  15000>,
+					<35000     0 30000   15000  15000>,
+					<35000     0 30000   15000  15000>,
+					<35000     0 30000   15000  15000>;
+
+				qcom,cpr-closed-loop-voltage-fuse-adjustment =
+					/* Speed bin 0 */
+					<35000 35000 40000 (-30000) 40000>,
+					<    0     0     0 (-70000)     0>,
+					<    0     0     0        0     0>,
+					<    0     0     0        0     0>,
+					<    0     0     0        0     0>,
+					<    0     0     0        0     0>,
+					<    0     0     0        0     0>,
+					<    0     0     0        0     0>,
+
+					/* Speed bin 1 */
+					<35000 35000 40000 (-30000) 40000>,
+					<    0     0     0 (-70000)     0>,
+					<    0     0     0        0     0>,
+					<    0     0     0        0     0>,
+					<    0     0     0        0     0>,
+					<    0     0     0        0     0>,
+					<    0     0     0        0     0>,
+					<    0     0     0        0     0>,
+
+					/* Speed bin 2 */
+					<35000 35000 40000 (-30000) 40000>,
+					<    0     0     0 (-70000)     0>,
+					<    0     0     0        0     0>,
+					<    0     0     0        0     0>,
+					<    0     0     0        0     0>,
+					<    0     0     0        0     0>,
+					<    0     0     0        0     0>,
+					<    0     0     0        0     0>;
+
+				qcom,cpr-open-loop-voltage-adjustment =
+					/* Speed bin 0 */
+					<(-15000) (-15000) (-15000) (-15000)
+					 (-11000) (-12000) (-13000) (-14000)
+					 (-15000) (-18000) (-21000) (-23000)
+					 (-25000) (-25000) (-26000) (-26000)
+					 (-27000) (-27000) (-28000) (-28000)
+					 (-28000) (-29000) (-29000) (-30000)
+					 (-30000)>,
+
+					/* Speed bin 1 */
+					<(-15000) (-15000) (-15000) (-15000)
+					 (-11000) (-12000) (-13000) (-14000)
+					 (-15000) (-18000) (-21000) (-23000)
+					 (-25000) (-25000) (-26000) (-26000)
+					 (-27000) (-27000) (-28000) (-28000)
+					 (-28000)>,
+
+					/* Speed bin 2 */
+					<(-15000) (-15000) (-15000) (-15000)
+					 (-11000) (-12000) (-13000) (-14000)
+					 (-15000) (-18000) (-21000) (-23000)
+					 (-25000) (-25000) (-26000) (-26000)
+					 (-27000) (-27000) (-28000) (-28000)
+					 (-28000) (-29000) (-29000) (-30000)
+					 (-30000)>;
+
+				qcom,cpr-open-loop-voltage-min-diff =
+					/* Speed bin 0 */
+					<0 0 0 0 (-50000) 0 0 0 0 0 0 0 0 0 0 0
+					 0 0 0 0 0 0 0 0 0>,
+
+					/* Speed bin 1 */
+					<0 0 0 0 (-50000) 0 0 0 0 0 0 0 0 0 0 0
+					 0 0 0 0 0>,
+
+					/* Speed bin 2 */
+					<0 0 0 0 (-50000) 0 0 0 0 0 0 0 0 0 0 0
+					 0 0 0 0 0 0 0 0 0>;
+
+				qcom,cpr-closed-loop-voltage-adjustment =
+					/* Speed bin 0 */
+					<(-15000) (-15000) (-15000) (-15000)
+					 (-11000) (-12000) (-13000) (-14000)
+					 (-15000) (-18000) (-21000) (-23000)
+					 (-25000) (-25000) (-26000) (-26000)
+					 (-27000) (-27000) (-28000) (-28000)
+					 (-28000) (-29000) (-29000) (-30000)
+					 (-30000)>,
+
+					/* Speed bin 1 */
+					<(-15000) (-15000) (-15000) (-15000)
+					 (-11000) (-12000) (-13000) (-14000)
+					 (-15000) (-18000) (-21000) (-23000)
+					 (-25000) (-25000) (-26000) (-26000)
+					 (-27000) (-27000) (-28000) (-28000)
+					 (-28000)>,
+
+					/* Speed bin 2 */
+					<(-15000) (-15000) (-15000) (-15000)
+					 (-11000) (-12000) (-13000) (-14000)
+					 (-15000) (-18000) (-21000) (-23000)
+					 (-25000) (-25000) (-26000) (-26000)
+					 (-27000) (-27000) (-28000) (-28000)
+					 (-28000) (-29000) (-29000) (-30000)
+					 (-30000)>;
+
+				qcom,allow-voltage-interpolation;
+				qcom,allow-quotient-interpolation;
+				qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+
+				qcom,cpr-aging-max-voltage-adjustment = <15000>;
+				qcom,cpr-aging-ref-corner = <13 13 13>;
+				qcom,cpr-aging-ro-scaling-factor = <3200>;
+				qcom,allow-aging-voltage-adjustment =
+					/* Speed bin 0 */
+					<0 0 0 1 1 1 1 1>,
+
+					/* Speed bin 1 */
+					<0 0 0 1 1 1 1 1>,
+
+					/* Speed bin 2 */
+					<0 0 0 1 1 1 1 1>;
+
+				qcom,cpr-dynamic-floor-corner = <1>;
+			};
+		};
+	};
+
+	gfx_cpr: cpr3-ctrl@838000 {
+		compatible = "qcom,cpr3-msm8996-mmss-regulator";
+		reg = <0x00838000 0x4000>, <0x00074000 0x1000>;
+		reg-names = "cpr_ctrl", "fuse_base";
+		clocks = <&clock_mmss clk_mmss_rbcpr_clk>,
+			 <&clock_mmss clk_mmss_rbcpr_ahb_clk>,
+			 <&clock_mmss clk_mmss_mmagic_ahb_clk>;
+		clock-names = "core_clk", "iface_clk", "bus_clk";
+		interrupts = <GIC_SPI 166 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "cpr";
+		qcom,cpr-ctrl-name = "gfx";
+
+		qcom,cpr-sensor-time = <1000>;
+		qcom,cpr-loop-time = <5000000>;
+		qcom,cpr-idle-cycles = <15>;
+		qcom,cpr-step-quot-init-min = <10>;
+		qcom,cpr-step-quot-init-max = <13>;
+		qcom,cpr-count-mode = <2>;		/* Staggered */
+
+		vdd-supply = <&pmi8994_s2>;
+		mem-acc-supply = <&gfx_mem_acc_vreg>;
+
+		qcom,voltage-step = <5000>;
+
+		qcom,cpr-enable;
+
+		qcom,cpr-aging-ref-voltage = <905000>;
+
+		thread@0 {
+			qcom,cpr-thread-id = <0>;
+			qcom,cpr-consecutive-up = <0>;
+			qcom,cpr-consecutive-down = <2>;
+			qcom,cpr-up-threshold = <0>;
+			qcom,cpr-down-threshold = <2>;
+
+			gfx_vreg: regulator {
+				regulator-name = "gfx_corner";
+				regulator-min-microvolt = <2>;
+				regulator-max-microvolt = <8>;
+
+				qcom,cpr-fuse-corners = <4>;
+				qcom,cpr-fuse-combos = <8>;
+				qcom,cpr-corners = <8>;
+
+				qcom,cpr-corner-fmax-map = <2 4 6 8>;
+
+				qcom,cpr-voltage-ceiling =
+					<400000  670000  670000  745000  825000
+					 905000  960000 1015000>;
+				qcom,cpr-voltage-floor =
+					<400000  520000  520000  520000  520000
+					 520000  520000  520000>;
+
+				qcom,mem-acc-voltage = <1 1 1 1 2 2 2 2>;
+
+				qcom,corner-frequencies =
+					<0 133000000 214000000 315000000
+					 401800000 510000000 560000000
+					 624000000>;
+
+				qcom,cpr-target-quotients =
+				      <   0    0    0    0    0    0    0    0
+					  0    0    0    0    0    0    0    0>,
+				      <   0    0    0    0    0    0  185  179
+					291  299  304  319    0    0    0    0>,
+				      <   0    0    0    0    0    0  287  273
+					425  426  443  453    0    0    0    0>,
+				      <   0    0    0    0    0    0  414  392
+					584  576  608  612    0    0    0    0>,
+				      <   0    0    0    0    0    0  459  431
+					684  644  692  679    0    0    0    0>,
+				      <   0    0    0    0    0    0  577  543
+					798  768  823  810    0    0    0    0>,
+				      <   0    0    0    0    0    0  669  629
+					886  864  924  911    0    0    0    0>,
+				      <   0    0    0    0    0    0  771  725
+					984  970 1036 1024    0    0    0    0>;
+
+				qcom,cpr-ro-scaling-factor =
+				      <   0    0    0    0    0    0 2035 1917
+				       1959 2131 2246 2253    0    0    0    0>,
+				      <   0    0    0    0    0    0 2035 1917
+				       1959 2131 2246 2253    0    0    0    0>,
+				      <   0    0    0    0    0    0 2035 1917
+				       1959 2131 2246 2253    0    0    0    0>,
+				      <   0    0    0    0    0    0 2035 1917
+				       1959 2131 2246 2253    0    0    0    0>,
+				      <   0    0    0    0    0    0 2035 1917
+				       1959 2131 2246 2253    0    0    0    0>,
+				      <   0    0    0    0    0    0 2035 1917
+				       1959 2131 2246 2253    0    0    0    0>,
+				      <   0    0    0    0    0    0 2035 1917
+				       1959 2131 2246 2253    0    0    0    0>,
+				      <   0    0    0    0    0    0 2035 1917
+				       1959 2131 2246 2253    0    0    0    0>;
+
+				qcom,cpr-open-loop-voltage-fuse-adjustment =
+					<       0        0    30000 (-10000)>,
+					<(-30000) (-30000)        0 (-10000)>,
+					<(-30000) (-30000)        0 (-10000)>,
+					<(-70000)        0        0        0>,
+					<(-70000)        0        0        0>,
+					<(-70000)        0        0        0>,
+					<(-70000)        0        0        0>,
+					<(-70000)        0        0        0>;
+				qcom,cpr-closed-loop-voltage-adjustment =
+					<    0 45000 (-5000) 20000 20000 30000
+					 10000 (-5000)>,
+					<    0 45000 (-5000) 20000 20000 30000
+					 10000 (-5000)>,
+					<    0 30000  60000  40000 40000 45000
+					 25000 35000>,
+					<    0     0  30000  10000 10000 45000
+					 25000 25000>,
+					<    0     0  30000  10000 10000 45000
+					 25000 25000>,
+					<    0     0  30000  10000 10000 45000
+					 25000 25000>,
+					<    0     0  30000  10000 10000 45000
+					 25000 25000>,
+					<    0     0  30000  10000 10000 45000
+					 25000 25000>;
+				qcom,cpr-floor-to-ceiling-max-range =
+				       <0 70000 70000 75000 80000 90000 95000
+					100000>;
+
+			     qcom,cpr-fused-closed-loop-voltage-adjustment-map =
+					<0 0 0 0 0 0 0 0>,
+					<0 0 0 0 0 0 0 0>,
+					<0 0 0 0 0 0 0 0>,
+					<0 0 0 0 0 0 0 0>,
+					<0 2 2 2 2 0 0 4>,
+					<0 2 2 2 2 0 0 4>,
+					<0 2 2 2 2 0 0 4>,
+					<0 2 2 2 2 0 0 4>;
+
+				qcom,allow-voltage-interpolation;
+				qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+
+				qcom,cpr-aging-max-voltage-adjustment = <15000>;
+				qcom,cpr-aging-ref-corner = <6>;
+				qcom,cpr-aging-ro-scaling-factor = <2950>;
+				qcom,allow-aging-voltage-adjustment =
+					<0 0 0 1 1 1 1 1>;
+			};
+		};
+	};
+/* Memory accelerator regulators */
+	apc0_pwrcl_mem_acc_vreg: apc0-pwrcl-mem-acc-regulator {
+		compatible = "qcom,mem-acc-regulator";
+		reg = <0x099e00c0 0x4>;
+		reg-names = "acc-sel-l1";
+		regulator-name = "apc0_pwrcl_mem_acc_corner";
+		regulator-min-microvolt = <1>;
+		regulator-max-microvolt = <2>;
+		qcom,corner-acc-map = <0x2 0x0>;
+
+		qcom,acc-sel-l1-bit-pos = <0>;
+		qcom,acc-sel-l1-bit-size = <2>;
+	};
+
+	apc1_perfcl_mem_acc_vreg: apc1-perfcl-mem-acc-regulator {
+		compatible = "qcom,mem-acc-regulator";
+		reg = <0x099e00c0 0x4>;
+		reg-names = "acc-sel-l1";
+		regulator-name = "apc1_perfcl_mem_acc_corner";
+		regulator-min-microvolt = <1>;
+		regulator-max-microvolt = <2>;
+		qcom,corner-acc-map = <0x2 0x0>;
+
+		qcom,acc-sel-l1-bit-pos = <2>;
+		qcom,acc-sel-l1-bit-size = <2>;
+	};
+
+	apcc_l3_mem_acc_vreg: apcc-l3-mem-acc-regulator {
+		compatible = "qcom,mem-acc-regulator";
+		reg = <0x099e00c0 0x4>;
+		reg-names = "acc-sel-l1";
+		regulator-name = "apcc_l3_mem_acc_corner";
+		regulator-min-microvolt = <1>;
+		regulator-max-microvolt = <2>;
+		qcom,corner-acc-map = <0x1 0x0>;
+
+		qcom,acc-sel-l1-bit-pos = <4>;
+		qcom,acc-sel-l1-bit-size = <1>;
+	};
+
+	gfx_mem_acc_vreg: regulator@007af004 {
+		compatible = "qcom,mem-acc-regulator";
+		reg = <0x007af004 0x4>;
+		reg-names = "acc-sel-l1";
+		regulator-name = "gfx_mem_acc_corner";
+		regulator-min-microvolt = <1>;
+		regulator-max-microvolt = <2>;
+
+		qcom,corner-acc-map = <0x1 0x0>;
+		qcom,acc-sel-l1-bit-pos = <0>;
+		qcom,acc-sel-l1-bit-size = <1>;
+	};
+
+/* Kryo regulators */
+	kryo0_vreg: regulator@99a2000 {
+		compatible = "qcom,kryo-regulator";
+		regulator-name = "kryo0";
+		reg = <0x99a2000 0x1000>, <0x99e0000 0x1000>,
+		      <0x9820000 0x1000>;
+		reg-names = "pm-apc", "pm-apcc", "apcs-csr";
+		regulator-min-microvolt = <468197>;
+		regulator-max-microvolt = <892467>;
+		qcom,ldo-default-voltage = <750000>;
+		qcom,retention-voltage = <520000>;
+		qcom,ldo-headroom-voltage = <150000>;
+		qcom,vref-functional-step-voltage = <4466>;
+		qcom,vref-functional-min-voltage = <325285>;
+		qcom,vref-retention-step-voltage = <4466>;
+		qcom,vref-retention-min-voltage = <325285>;
+		qcom,ldo-config-init = <0xf1f0e471>;
+		qcom,apm-config-init = <0x0>;
+		qcom,cluster-num = <0>;
+		kryo0_retention_vreg: regulator {
+			regulator-name = "kryo0-retention";
+			regulator-min-microvolt = <468197>;
+			regulator-max-microvolt = <892467>;
+		};
+	};
+
+	kryo1_vreg: regulator@99d2000 {
+		compatible = "qcom,kryo-regulator";
+		regulator-name = "kryo1";
+		reg = <0x99d2000 0x1000>, <0x99e0000 0x1000>,
+		      <0x9820000 0x1000>;
+		reg-names = "pm-apc", "pm-apcc", "apcs-csr";
+		regulator-min-microvolt = <468197>;
+		regulator-max-microvolt = <892467>;
+		qcom,ldo-default-voltage = <750000>;
+		qcom,retention-voltage = <520000>;
+		qcom,ldo-headroom-voltage = <150000>;
+		qcom,vref-functional-step-voltage = <4466>;
+		qcom,vref-functional-min-voltage = <325285>;
+		qcom,vref-retention-step-voltage = <4466>;
+		qcom,vref-retention-min-voltage = <325285>;
+		qcom,cluster-num = <1>;
+		qcom,ldo-config-init = <0xf1f0e471>;
+		qcom,apm-config-init = <0x0>;
+		kryo1_retention_vreg: regulator {
+			regulator-name = "kryo1-retention";
+			regulator-min-microvolt = <468197>;
+			regulator-max-microvolt = <892467>;
+		};
+	};
+
+/* Miscellaneous regulators */
+	spi_eth_vreg: spi_eth_phy_vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "ethernet_phy";
+		gpio = <&pm8994_mpps 5 0>;
+		enable-active-high;
+		status = "disabled";
+	};
+
+	usb_otg_switch: usb-otg-switch {
+		compatible = "regulator-fixed";
+		regulator-name = "usb_otg_vreg";
+		vin-supply = <&smbcharger_external_otg>;
+		enable-active-high;
+		gpio = <&pmi8994_gpios 5 0>;
+		status = "disabled";
+	};
+
+	/* Rome 3.3V supply */
+	rome_vreg: rome_vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "rome_vreg";
+		startup-delay-us = <4000>;
+		enable-active-high;
+		gpio = <&pm8994_gpios 9 0>;
+	};
+
+	wlan_en_vreg: wlan_en_vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "wlan_en_vreg";
+		enable-active-high;
+		gpio = <&pm8994_gpios 8 0>;
+	};
+
+	hl7509_en_vreg: hl7509_en_vreg {
+		compatible = "regulator-fixed";
+		regulator-name = "hl7509_en_vreg";
+		gpio = <&pm8994_mpps 6 0>;
+		enable-active-high;
+		status = "disabled";
+	};
+};
+
+&pmi8994_charger {
+	otg-parent-supply = <&pmi8994_boost_5v>;
+	smbcharger_charger_otg: qcom,smbcharger-boost-otg {
+		regulator-name = "smbcharger_charger_otg";
+	};
+
+	smbcharger_external_otg: qcom,smbcharger-external-otg {
+		regulator-name = "smbcharger_external_otg";
+	};
+};
+
+/* Halo HL7509 external buck that powers VDD_GFX supply on 8996AU boards */
+&i2c_7 {
+	hl7509_vreg: hl7509-regulator@68 {
+		compatible = "halo,hl7509";
+		reg = <0x68>;
+		vin-supply = <&hl7509_en_vreg>;
+		fcs,disable-suspend;
+		fcs,suspend-voltage-selector = <1>;
+		regulator-min-microvolt = <600000>;
+		regulator-max-microvolt = <1230000>;
+		regulator-ramp-delay = <500>;
+		status = "disabled";
+	};
+
+	ncp6335d_vreg: ncp6335d-regulator@68 {
+		compatible = "onnn,ncp6335d-regulator";
+		reg = <0x68>;
+		vin-supply = <&hl7509_en_vreg>;
+		onnn,vsel = <0>;
+		onnn,slew-ns = <2666>;
+		onnn,step-size = <6250>;
+		onnn,min-slew-ns = <333>;
+		onnn,max-slew-ns = <2666>;
+		regulator-min-microvolt = <600000>;
+		regulator-max-microvolt = <1143750>;
+		onnn,min-setpoint = <600000>;
+		onnn,discharge-enable;
+		onnn,restore-reg;
+		status = "disabled";
+	  };
+
+	max20010_vreg: max20010-regulator@38 {
+		compatible = "maxim,max20010";
+		reg = <0x38>;
+		vin-supply = <&hl7509_en_vreg>;
+		regulator-min-microvolt = <600000>;
+		regulator-max-microvolt = <1270000>;
+		regulator-initial-mode = <MAX20010_OPMODE_SYNC>;
+		maxim,vrange-sel = <0>;
+		maxim,soft-start-slew-rate = <5500>;
+		maxim,dvs-slew-rate = <5500>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-sde-display.dtsi b/arch/arm64/boot/dts/qcom/msm8996-sde-display.dtsi
new file mode 100644
index 000000000000..1c81bc433374
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-sde-display.dtsi
@@ -0,0 +1,411 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8996-mdss-panels.dtsi"
+#include "dsi-panel-jdi-1080p-video.dtsi"
+#include "dsi-panel-sharp-1080p-cmd.dtsi"
+
+&soc {
+	dsi_panel_pwr_supply: dsi_panel_pwr_supply {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "vddio";
+			qcom,supply-min-voltage = <1800000>;
+			qcom,supply-max-voltage = <1800000>;
+			qcom,supply-enable-load = <62000>;
+			qcom,supply-disable-load = <80>;
+			qcom,supply-post-on-sleep = <20>;
+		};
+
+		qcom,panel-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "lab";
+			qcom,supply-min-voltage = <4600000>;
+			qcom,supply-max-voltage = <6000000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+
+		qcom,panel-supply-entry@2 {
+			reg = <2>;
+			qcom,supply-name = "ibb";
+			qcom,supply-min-voltage = <4600000>;
+			qcom,supply-max-voltage = <6000000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+			qcom,supply-post-on-sleep = <20>;
+		};
+	};
+
+	dsi_panel_pwr_supply_no_labibb: dsi_panel_pwr_supply_no_labibb {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "vddio";
+			qcom,supply-min-voltage = <1800000>;
+			qcom,supply-max-voltage = <1800000>;
+			qcom,supply-enable-load = <62000>;
+			qcom,supply-disable-load = <80>;
+			qcom,supply-post-on-sleep = <20>;
+		};
+	};
+
+	dsi_panel_pwr_supply_vdd_no_labibb: dsi_panel_pwr_supply_vdd_no_labibb {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "vddio";
+			qcom,supply-min-voltage = <1800000>;
+			qcom,supply-max-voltage = <1800000>;
+			qcom,supply-enable-load = <62000>;
+			qcom,supply-disable-load = <80>;
+			qcom,supply-post-on-sleep = <20>;
+		};
+
+		qcom,panel-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "vdd";
+			qcom,supply-min-voltage = <3000000>;
+			qcom,supply-max-voltage = <3000000>;
+			qcom,supply-enable-load = <857000>;
+			qcom,supply-disable-load = <0>;
+			qcom,supply-post-on-sleep = <0>;
+		};
+	};
+
+	dsi_dual_sharp_video_1: qcom,dsi-display@0 {
+		compatible = "qcom,dsi-display";
+		label = "dsi_dual_sharp_video";
+		qcom,display-type = "primary";
+
+		qcom,dsi-ctrl = <&sde_dsi0 &sde_dsi1>;
+		qcom,dsi-phy = <&sde_dsi_phy0 &sde_dsi_phy1>;
+		clocks = <&clock_mmss clk_ext_byte0_clk_src>,
+			 <&clock_mmss clk_ext_pclk0_clk_src>;
+		clock-names = "src_byte_clk", "src_pixel_clk";
+
+		pinctrl-names = "panel_active", "panel_suspend";
+		pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+		pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+		qcom,platform-te-gpio = <&tlmm 10 0>;
+		qcom,platform-reset-gpio = <&tlmm 8 0>;
+
+		qcom,dsi-panel = <&dsi_dual_sharp_video>;
+		vddio-supply = <&pm8994_l14>;
+		/delete-property/ lab-supply;
+		/delete-property/ ibb-supply;
+		/delete-property/ qcom,dsi-display-active;
+	};
+
+	single_dsi_sim_vid: qcom,dsi-display@1 {
+		compatible = "qcom,dsi-display";
+		label = "single_dsi_sim";
+		qcom,display-type = "primary";
+
+		qcom,dsi-ctrl = <&sde_dsi0>;
+		qcom,dsi-phy = <&sde_dsi_phy0>;
+		clocks = <&clock_mmss clk_ext_byte0_clk_src>,
+			 <&clock_mmss clk_ext_pclk0_clk_src>;
+		clock-names = "src_byte_clk", "src_pixel_clk";
+
+		pinctrl-names = "panel_active", "panel_suspend";
+		pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+		pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+		qcom,platform-te-gpio = <&tlmm 10 0>;
+
+		qcom,dsi-panel = <&dsi_sim_vid>;
+		vddio-supply = <&pm8994_l14>;
+		/delete-property/ lab-supply;
+		/delete-property/ ibb-supply;
+	};
+
+	dsi_toshiba_720p_vid: qcom,dsi-display@2 {
+		compatible = "qcom,dsi-display";
+		label = "single_dsi_toshiba_720p";
+		qcom,display-type = "primary";
+
+		qcom,dsi-ctrl = <&sde_dsi0>;
+		qcom,dsi-phy = <&sde_dsi_phy0>;
+		clocks = <&clock_mmss clk_ext_byte0_clk_src>,
+			 <&clock_mmss clk_ext_pclk0_clk_src>;
+		clock-names = "src_byte_clk", "src_pixel_clk";
+
+		pinctrl-names = "panel_active", "panel_suspend";
+		pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+		pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+		qcom,platform-te-gpio = <&tlmm 10 0>;
+
+		qcom,dsi-panel = <&dsi_tosh_720_vid>;
+		vddio-supply = <&pm8994_l14>;
+		vdd-supply = <&pm8994_l19>;
+	};
+
+	dsi_jdi_1080p_vid: qcom,dsi-display@3 {
+		compatible = "qcom,dsi-display";
+		label = "single_dsi_jdi_1080p";
+		qcom,display-type = "primary";
+
+		qcom,dsi-ctrl = <&sde_dsi0>;
+		qcom,dsi-phy = <&sde_dsi_phy0>;
+		clocks = <&clock_mmss clk_ext_byte0_clk_src>,
+			 <&clock_mmss clk_ext_pclk0_clk_src>;
+		clock-names = "src_byte_clk", "src_pixel_clk";
+
+		pinctrl-names = "panel_active", "panel_suspend";
+		pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+		pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+
+		qcom,dsi-panel = <&dsi_jdi_1080p_video>;
+		vddio-supply = <&pm8994_l14>;
+	};
+
+	dsi_sharp_fhd_cmd: qcom,dsi-display@4 {
+		compatible = "qcom,dsi-display";
+		label = "single_dsi_sharp_1080p";
+		qcom,display-type = "primary";
+
+		qcom,dsi-ctrl = <&sde_dsi0>;
+		qcom,dsi-phy = <&sde_dsi_phy0>;
+		clocks = <&clock_mmss clk_ext_byte0_clk_src>,
+			 <&clock_mmss clk_ext_pclk0_clk_src>;
+		clock-names = "src_byte_clk", "src_pixel_clk";
+
+		pinctrl-names = "panel_active", "panel_suspend";
+		pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+		pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+
+		qcom,dsi-panel = <&dsi_sharp_1080_cmd>;
+		vddio-supply = <&pm8994_l14>;
+		vdd-supply = <&pm8994_l19>;
+		/delete-property/ lab-supply;
+		/delete-property/ ibb-supply;
+	};
+
+	sde_wb: qcom,wb-display@0 {
+		compatible = "qcom,wb-display";
+		cell-index = <0>;
+		label = "wb_display";
+	};
+
+	dsi_dual_nt35597_cmd_1: qcom,dsi-display@5 {
+		compatible = "qcom,dsi-display";
+		label = "dsi_dual_nt35597_cmd";
+		qcom,display-type = "primary";
+
+		/* dsi1/dsi0 swapped due to IMGSWAP */
+		qcom,dsi-ctrl = <&sde_dsi1 &sde_dsi0>;
+		qcom,dsi-phy = <&sde_dsi_phy0 &sde_dsi_phy1>;
+		clocks = <&clock_mmss clk_ext_byte0_clk_src>,
+			 <&clock_mmss clk_ext_pclk0_clk_src>;
+		clock-names = "src_byte_clk", "src_pixel_clk";
+
+		pinctrl-names = "panel_active", "panel_suspend";
+		pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+		pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+		qcom,platform-te-gpio = <&tlmm 10 0>;
+
+		qcom,dsi-panel = <&dsi_dual_nt35597_cmd>;
+		vddio-supply = <&pm8994_l14>;
+		/delete-property/ lab-supply;
+		/delete-property/ ibb-supply;
+	};
+
+	dsi_dual_nt35597_video_1: qcom,dsi-display@6 {
+		compatible = "qcom,dsi-display";
+		label = "dsi_dual_nt35597_video";
+		qcom,display-type = "primary";
+
+		qcom,dsi-ctrl = <&sde_dsi0 &sde_dsi1>;
+		qcom,dsi-phy = <&sde_dsi_phy0 &sde_dsi_phy1>;
+		clocks = <&clock_mmss clk_ext_byte0_clk_src>,
+			 <&clock_mmss clk_ext_pclk0_clk_src>;
+		clock-names = "src_byte_clk", "src_pixel_clk";
+
+		pinctrl-names = "panel_active", "panel_suspend";
+		pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+		pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+		qcom,platform-te-gpio = <&tlmm 10 0>;
+
+		qcom,dsi-panel = <&dsi_dual_nt35597_video>;
+		vddio-supply = <&pm8994_l14>;
+		/delete-property/ lab-supply;
+		/delete-property/ ibb-supply;
+	};
+
+	dsi_adv_7533_1: qcom,dsi-display@7 {
+		compatible = "qcom,dsi-display";
+		label = "dsi_adv_7533_1";
+		qcom,display-type = "secondary";
+
+		qcom,dsi-ctrl = <&sde_dsi0>;
+		qcom,dsi-phy = <&sde_dsi_phy0>;
+		clocks = <&clock_mmss clk_ext_byte0_clk_src>,
+			<&clock_mmss clk_ext_pclk0_clk_src>;
+		clock-names = "src_byte_clk", "src_pixel_clk";
+
+		qcom,dsi-panel = <&dsi_adv7533_720p>;
+		vddio-supply = <&pm8994_l14>;
+		qcom,bridge-index = <0>;
+	};
+
+	dsi_adv_7533_2: qcom,dsi-display@8 {
+		compatible = "qcom,dsi-display";
+		label = "dsi_adv_7533_2";
+		qcom,display-type = "tertiary";
+
+		qcom,dsi-ctrl = <&sde_dsi1>;
+		qcom,dsi-phy = <&sde_dsi_phy1>;
+		clocks = <&clock_mmss clk_ext_byte1_clk_src>,
+			<&clock_mmss clk_ext_pclk1_clk_src>;
+		clock-names = "src_byte_clk", "src_pixel_clk";
+
+		qcom,dsi-panel = <&dsi_adv7533_720p>;
+		vddio-supply = <&pm8994_l14>;
+		qcom,bridge-index = <1>;
+	};
+
+	msm_ext_disp: qcom,msm_ext_disp {
+		compatible = "qcom,msm-ext-disp";
+
+		ext_disp_audio_codec: qcom,msm-ext-disp-audio-codec-rx {
+			compatible = "qcom,msm-ext-disp-audio-codec-rx";
+			qcom,msm_ext_disp = <&msm_ext_disp>;
+		};
+	};
+
+	sde_hdmi: qcom,hdmi-display {
+		compatible = "qcom,hdmi-display";
+		label = "sde_hdmi";
+		qcom,display-type = "primary";
+		qcom,msm_ext_disp = <&msm_ext_disp>;
+	};
+};
+
+&sde_kms {
+	connectors = <&sde_hdmi_tx &sde_hdmi &dsi_adv_7533_1 &dsi_adv_7533_2>;
+};
+
+&dsi_dual_sharp_video {
+	qcom,mdss-dsi-panel-timings-8996 = [23 20 06 09 05 03 04 a0
+			23 20 06 09 05 03 04 a0
+			23 20 06 09 05 03 04 a0
+			23 20 06 09 05 03 04 a0
+			23 2e 06 08 05 03 04 a0];
+};
+
+&dsi_dual_jdi_cmd {
+	qcom,mdss-dsi-panel-timings-8996 = [22 1e 06 08 04 03 04 a0
+			22 1e 06 08 04 03 04 a0
+			22 1e 06 08 04 03 04 a0
+			22 1e 06 08 04 03 04 a0
+			22 2c 05 08 04 03 04 a0];
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "te_signal_check";
+};
+
+&dsi_dual_jdi_video {
+	qcom,mdss-dsi-panel-timings-8996 = [22 1e 06 08 04 03 04 a0
+			22 1e 06 08 04 03 04 a0
+			22 1e 06 08 04 03 04 a0
+			22 1e 06 08 04 03 04 a0
+			22 2c 05 08 04 03 04 a0];
+};
+
+&dsi_dual_nt35597_video {
+	qcom,mdss-dsi-panel-timings-8996 = [23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 18 07 08 04 03 04 a0];
+};
+
+&dsi_dual_nt35597_cmd {
+	qcom,mdss-dsi-panel-timings-8996 = [23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 18 07 08 04 03 04 a0];
+
+	qcom,mdss-dsi-on-command = [15 01 00 00 10 00 02 ff 10
+		15 01 00 00 10 00 02 fb 01
+		15 01 00 00 10 00 02 ba 03
+		15 01 00 00 10 00 02 e5 01
+		15 01 00 00 10 00 02 35 00
+		15 01 00 00 10 00 02 bb 10
+		15 01 00 00 10 00 02 b0 03
+		15 01 00 00 10 00 02 ff e0
+		15 01 00 00 10 00 02 fb 01
+		15 01 00 00 10 00 02 6b 3d
+		15 01 00 00 10 00 02 6c 3d
+		15 01 00 00 10 00 02 6d 3d
+		15 01 00 00 10 00 02 6e 3d
+		15 01 00 00 10 00 02 6f 3d
+		15 01 00 00 10 00 02 35 02
+		15 01 00 00 10 00 02 36 72
+		15 01 00 00 10 00 02 37 10
+		15 01 00 00 10 00 02 08 c0
+		15 01 00 00 10 00 02 ff 24
+		15 01 00 00 10 00 02 fb 01
+		15 01 00 00 10 00 02 c6 06
+		15 01 00 00 10 00 02 9d 30 /* Enable IMGSWAP */
+		15 01 00 00 10 00 02 ff 10
+		05 01 00 00 a0 00 02 11 00
+		05 01 00 00 a0 00 02 29 00];
+};
+
+&dsi_nt35597_dsc_video {
+	qcom,mdss-dsi-panel-timings-8996 = [20 1d 05 07 03 03 04 a0
+		20 1d 05 07 03 03 04 a0
+		20 1d 05 07 03 03 04 a0
+		20 1d 05 07 03 03 04 a0
+		20 12 05 06 03 13 04 a0];
+};
+
+&dsi_nt35597_dsc_cmd {
+	qcom,mdss-dsi-panel-timings-8996 = [20 1d 05 07 03 03 04 a0
+		20 1d 05 07 03 03 04 a0
+		20 1d 05 07 03 03 04 a0
+		20 1d 05 07 03 03 04 a0
+		20 12 05 06 03 13 04 a0];
+};
+
+&dsi_dual_jdi_4k_nofbc_video {
+	qcom,mdss-dsi-panel-timings-8996 = [
+		2c 27 0e 10 0a 03 04 a0
+		2c 27 0e 10 0a 03 04 a0
+		2c 27 0e 10 0a 03 04 a0
+		2c 27 0e 10 0a 03 04 a0
+		2c 32 0e 0f 0a 03 04 a0];
+};
+
+&dsi_hx8379a_fwvga_truly_vid {
+	qcom,mdss-dsi-panel-timings-8996 = [23 20 06 09 05 03 04 a0
+		23 20 06 09 05 03 04 a0
+		23 20 06 09 05 03 04 a0
+		23 20 06 09 05 03 04 a0
+		23 2e 06 08 05 03 04 a0];
+};
+
+&dsi_r69007_wqxga_cmd {
+	qcom,mdss-dsi-panel-timings-8996 = [23 1f 07 09 05 03 04 a0
+		23 1f 07 09 05 03 04 a0
+		23 1f 07 09 05 03 04 a0
+		23 1f 07 09 05 03 04 a0
+		23 19 08 08 05 03 04 a0];
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-sde.dtsi b/arch/arm64/boot/dts/qcom/msm8996-sde.dtsi
new file mode 100644
index 000000000000..b0688668e667
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-sde.dtsi
@@ -0,0 +1,520 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	sde_kms: qcom,sde_kms@900000 {
+		compatible = "qcom,sde-kms";
+		reg = <0x00900000 0x90000>,
+		      <0x009b0000 0x1040>,
+		      <0x009b8000 0x1040>;
+		reg-names = "mdp_phys",
+			"vbif_phys",
+			"vbif_nrt_phys";
+
+		contiguous-region = <&cont_splash_mem &cont_splash_mem_hdmi>;
+
+		/* clock and supply entries */
+		clocks = <&clock_mmss clk_mdss_ahb_clk>,
+			 <&clock_mmss clk_mdss_axi_clk>,
+			 <&clock_mmss clk_mdp_clk_src>,
+			 <&clock_mmss clk_mdss_mdp_vote_clk>,
+			 <&clock_mmss clk_smmu_mdp_axi_clk>,
+			 <&clock_mmss clk_smmu_mdp_ahb_clk>,
+			 <&clock_mmss clk_smmu_rot_axi_clk>,
+			 <&clock_mmss clk_smmu_rot_ahb_clk>,
+			 <&clock_mmss clk_mmagic_mdss_axi_clk>,
+			 <&clock_mmss clk_mdss_vsync_clk>;
+		clock-names = "iface_clk",
+			"bus_clk",
+			"core_clk_src",
+			"core_clk",
+			"iommu_mdp_axi_clk",
+			"iommu_mdp_ahb_clk",
+			"iommu_rot_axi_clk",
+			"iommu_rot_ahb_clk",
+			"mmagic_clk",
+			"vsync_clk";
+		clock-rate = <0 0 412500000 412500000 0 0 0 0>;
+		clock-max-rate = <0 0 412500000 412500000 0 0 0 0>;
+
+		/* interrupt config */
+		interrupt-parent = <&intc>;
+		interrupts = <0 83 0>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		iommus = <&mdp_smmu 0>;
+
+		gpus = <&msm_gpu>;
+
+		/* hw blocks */
+		qcom,sde-off = <0x1000>;
+		qcom,sde-ctl-off = <0x2000 0x2200 0x2400
+				     0x2600 0x2800>;
+		qcom,sde-mixer-off = <0x45000 0x46000 0x47000
+				      0x48000 0x49000 0x4a000>;
+		qcom,sde-dspp-off = <0x55000 0x57000>;
+		qcom,sde-dspp-ad-off = <0x24000 0x22800>;
+		qcom,sde-dspp-ad-version = <0x00030000>;
+		qcom,sde-wb-off = <0x66000>;
+		qcom,sde-wb-id = <2>;
+		qcom,sde-wb-xin-id = <6>;
+		qcom,sde-wb-clk-ctrl = <0x2bc 16>;
+		qcom,sde-intf-off = <0x6b000 0x6b800
+					0x6c000 0x6c800>;
+		qcom,sde-intf-type = "none", "dsi", "dsi", "hdmi";
+		qcom,sde-pp-off = <0x71000 0x71800
+					  0x72000 0x72800 0x73000>;
+		qcom,sde-pp-slave = <0x0 0x0 0x0 0x0 0x1>;
+		qcom,sde-te2-off = <0x2000 0x2000 0x0 0x0 0x0>;
+		qcom,sde-cdm-off = <0x7a200>;
+		qcom,sde-dsc-off = <0x10000 0x10000 0x0 0x0 0x0>;
+		qcom,sde-intf-max-prefetch-lines = <0x15 0x15 0x15 0x15>;
+
+		qcom,sde-sspp-type = "vig", "vig", "vig",
+				      "vig", "rgb", "rgb",
+				      "rgb", "rgb", "dma",
+				      "dma", "cursor", "cursor";
+
+		qcom,sde-sspp-off = <0x5000 0x7000 0x9000
+				      0xb000 0x15000 0x17000
+				      0x19000 0x1b000 0x25000
+				      0x27000 0x35000 0x37000>;
+
+		qcom,sde-sspp-xin-id = <0 4 8
+					12 1 5
+					9 13 2
+					10 7 7>;
+
+		/* offsets are relative to "mdp_phys + qcom,sde-off */
+		qcom,sde-sspp-clk-ctrl = <0x2ac 0>, <0x2b4 0>, <0x2bc 0>,
+				  <0x2c4 0>, <0x2ac 4>, <0x2b4 4>, <0x2bc 4>,
+				  <0x2c4 4>, <0x2ac 8>, <0x2b4 8>, <0x3a8 16>,
+				  <0x3b0 16>;
+		qcom,sde-qseed-type = "qseedv2";
+		qcom,sde-csc-type = "csc";
+		qcom,sde-mixer-linewidth = <2560>;
+		qcom,sde-sspp-linewidth = <2560>;
+		qcom,sde-mixer-blendstages = <0x7>;
+		qcom,sde-highest-bank-bit = <0x2>;
+		qcom,sde-panic-per-pipe;
+		qcom,sde-has-cdp;
+		qcom,sde-has-src-split;
+		qcom,sde-max-bw-low-kbps = <9600000>;
+		qcom,sde-max-bw-high-kbps = <9600000>;
+		qcom,sde-dram-channels = <2>;
+		qcom,sde-num-nrt-paths = <1>;
+
+		qcom,sde-sspp-danger-lut = <0x000f 0xffff 0x0000>;
+		qcom,sde-sspp-safe-lut = <0xfffc 0xff00 0xffff>;
+
+		qcom,sde-vbif-off = <0 0>;
+		qcom,sde-vbif-size = <0x1040>;
+		qcom,sde-vbif-id = <0 1>;
+		qcom,sde-vbif-default-ot-rd-limit = <32>;
+		qcom,sde-vbif-default-ot-wr-limit = <16>;
+		qcom,sde-vbif-dynamic-ot-rd-limit = <62208000 2>,
+			<124416000 4>, <248832000 16>;
+		qcom,sde-vbif-dynamic-ot-wr-limit = <62208000 2>,
+			<124416000 4>, <248832000 16>;
+
+		mmagic-supply = <&gdsc_mmagic_mdss>;
+		vdd-supply = <&gdsc_mdss>;
+
+		qcom,sde-sspp-vig-blocks {
+			qcom,sde-vig-csc-off = <0x320>;
+			qcom,sde-vig-qseed-off = <0x200>;
+			/* Offset from vig top, version of HSIC */
+			qcom,sde-vig-hsic = <0x200 0x00010007>;
+			qcom,sde-vig-memcolor = <0x200 0x00010007>;
+			qcom,sde-vig-pcc = <0x1780 0x00010007>;
+		};
+
+		qcom,sde-sspp-rgb-blocks {
+			qcom,sde-rgb-scaler-off = <0x200>;
+			qcom,sde-rgb-pcc = <0x380 0x00010007>;
+		};
+
+		qcom,sde-dspp-blocks {
+			qcom,sde-dspp-pcc = <0x1700 0x00010007>;
+			qcom,sde-dspp-gc = <0x17c0 0x00010007>;
+			qcom,sde-dspp-hsic = <0x0 0x00010007>;
+			qcom,sde-dspp-memcolor = <0x0 0x00010007>;
+			qcom,sde-dspp-sixzone = <0x0 0x00010007>;
+			qcom,sde-dspp-gamut = <0x1600 0x00010007>;
+			qcom,sde-dspp-dither = <0x0 0x00010007>;
+			qcom,sde-dspp-hist = <0x0 0x00010007>;
+			qcom,sde-dspp-vlut = <0x0 0x00010007>;
+		};
+
+		qcom,sde-mixer-blocks {
+			qcom,sde-mixer-gc = <0x3c0 0x00010007>;
+		};
+
+		qcom,platform-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,platform-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "mmagic";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+
+			qcom,platform-supply-entry@1 {
+				reg = <1>;
+				qcom,supply-name = "vdd";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+
+		smmu_kms_unsec: qcom,smmu_kms_unsec_cb {
+			compatible = "qcom,smmu_kms_unsec";
+			iommus = <&mdp_smmu 0>;
+		};
+
+		/* data and reg bus scale settings */
+		qcom,sde-data-bus {
+			qcom,msm-bus,name = "mdss_sde";
+			qcom,msm-bus,num-cases = <3>;
+			qcom,msm-bus,num-paths = <3>;
+			qcom,msm-bus,vectors-KBps =
+				<22 512 0 0>, <23 512 0 0>, <25 512 0 0>,
+				<22 512 0 6400000>, <23 512 0 6400000>,
+					<25 512 0 6400000>,
+				<22 512 0 6400000>, <23 512 0 6400000>,
+					<25 512 0 6400000>;
+		};
+
+		qcom,sde-reg-bus {
+			qcom,msm-bus,name = "mdss_reg";
+			qcom,msm-bus,num-cases = <4>;
+			qcom,msm-bus,num-paths = <1>;
+			qcom,msm-bus,active-only;
+			qcom,msm-bus,vectors-KBps =
+				<1 590 0 0>,
+				<1 590 0 76800>,
+				<1 590 0 160000>,
+				<1 590 0 320000>;
+		};
+	};
+
+	sde_dsi0: qcom,sde_dsi_ctrl0@994000 {
+		compatible = "qcom,dsi-ctrl-hw-v1.4";
+		label = "dsi-ctrl-0";
+		cell-index = <0>;
+		reg =   <0x994000 0x400>,
+			<0x828000 0x108>;
+		reg-names = "dsi_ctrl", "mmss_misc";
+
+		gdsc-supply = <&gdsc_mdss>;
+		vdda-supply = <&pm8994_l2>;
+		vcca-supply = <&pm8994_l28>;
+
+		clocks = <&clock_mmss clk_mdss_mdp_vote_clk>,
+			 <&clock_mmss clk_mdss_ahb_clk>,
+			 <&clock_mmss clk_mmss_misc_ahb_clk>,
+			 <&clock_mmss clk_mdss_axi_clk>,
+			 <&clock_mmss clk_mdss_byte0_clk>,
+			 <&clock_mmss clk_mdss_pclk0_clk>,
+			 <&clock_mmss clk_mdss_esc0_clk>,
+			 <&clock_mmss clk_byte0_clk_src>,
+			 <&clock_mmss clk_pclk0_clk_src>;
+
+		clock-names = "mdp_core_clk", "iface_clk",
+			"core_mmss_clk", "bus_clk",
+			"byte_clk", "pixel_clk", "core_clk",
+			"byte_clk_rcg", "pixel_clk_rcg";
+
+		/* axi bus scale settings */
+		qcom,msm-bus,name = "mdss_dsi0";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<22 512 0 0>,
+			<22 512 0 1000>;
+
+		interrupt-parent = <&sde_kms>;
+		interrupts = <4 0>;
+		qcom,core-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,core-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+
+		qcom,ctrl-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,ctrl-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vcca";
+				qcom,supply-min-voltage = <925000>;
+				qcom,supply-max-voltage = <925000>;
+				qcom,supply-enable-load = <17000>;
+				qcom,supply-disable-load = <32>;
+			};
+
+			qcom,ctrl-supply-entry@1 {
+				reg = <0>;
+				qcom,supply-name = "vdda";
+				qcom,supply-min-voltage = <1250000>;
+				qcom,supply-max-voltage = <1250000>;
+				qcom,supply-enable-load = <18160>;
+				qcom,supply-disable-load = <1>;
+			};
+
+		};
+	};
+
+	sde_dsi1: qcom,sde_dsi_ctrl1@996000 {
+		compatible = "qcom,dsi-ctrl-hw-v1.4";
+		label = "dsi-ctrl-1";
+		cell-index = <1>;
+		reg =   <0x996000 0x400>,
+			<0x828000 0x108>;
+		reg-names = "dsi_ctrl", "mmss_misc";
+
+		gdsc-supply = <&gdsc_mdss>;
+		vdda-supply = <&pm8994_l2>;
+		vcca-supply = <&pm8994_l28>;
+
+		clocks = <&clock_mmss clk_mdss_mdp_vote_clk>,
+			 <&clock_mmss clk_mdss_ahb_clk>,
+			 <&clock_mmss clk_mmss_misc_ahb_clk>,
+			 <&clock_mmss clk_mdss_axi_clk>,
+			 <&clock_mmss clk_mdss_byte1_clk>,
+			 <&clock_mmss clk_mdss_pclk1_clk>,
+			 <&clock_mmss clk_mdss_esc1_clk>,
+			 <&clock_mmss clk_byte1_clk_src>,
+			 <&clock_mmss clk_pclk1_clk_src>;
+		clock-names = "mdp_core_clk", "iface_clk",
+			"core_mmss_clk", "bus_clk",
+			"byte_clk", "pixel_clk", "core_clk",
+			"byte_clk_rcg", "pixel_clk_rcg";
+
+		/* axi bus scale settings */
+		qcom,msm-bus,name = "mdss_dsi1";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<22 512 0 0>,
+			<22 512 0 1000>;
+
+		interrupt-parent = <&sde_kms>;
+		interrupts = <5 0>;
+		qcom,core-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,core-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+
+		qcom,ctrl-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,ctrl-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vdda";
+				qcom,supply-min-voltage = <1250000>;
+				qcom,supply-max-voltage = <1250000>;
+				qcom,supply-enable-load = <18160>;
+				qcom,supply-disable-load = <1>;
+			};
+
+			qcom,ctrl-supply-entry@1 {
+				reg = <0>;
+				qcom,supply-name = "vcca";
+				qcom,supply-min-voltage = <925000>;
+				qcom,supply-max-voltage = <925000>;
+				qcom,supply-enable-load = <18050>;
+				qcom,supply-disable-load = <32>;
+			};
+		};
+	};
+
+	sde_dsi_phy0: qcom,sde_dsi_phy0@994400 {
+		compatible = "qcom,dsi-phy-v4.0";
+		label = "dsi-phy-0";
+		cell-index = <0>;
+		reg = <0x994400 0x588>;
+		reg-names = "dsi_phy";
+
+		gdsc-supply = <&gdsc_mdss>;
+		vdda-supply = <&pm8994_l2>;
+
+		clocks = <&clock_mmss clk_mdss_mdp_vote_clk>,
+			 <&clock_mmss clk_mdss_ahb_clk>,
+			 <&clock_mmss clk_mmss_misc_ahb_clk>,
+			 <&clock_mmss clk_mdss_axi_clk>;
+		clock-names = "mdp_core_clk", "iface_clk",
+			"core_mmss_clk", "bus_clk";
+
+		qcom,platform-strength-ctrl = [ff 06
+						ff 06
+						ff 06
+						ff 06
+						ff 00];
+		qcom,platform-regulator-settings = [1d
+						1d 1d 1d 1d];
+		qcom,platform-lane-config = [00 00 10 0f
+					00 00 10 0f
+					00 00 10 0f
+					00 00 10 0f
+					00 00 10 8f];
+
+		qcom,core-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,core-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+
+		qcom,phy-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,phy-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vdda";
+				qcom,supply-min-voltage = <1250000>;
+				qcom,supply-max-voltage = <1250000>;
+				qcom,supply-enable-load = <2500>;
+				qcom,supply-disable-load = <1>;
+			};
+		};
+	};
+
+	sde_dsi_phy1: qcom,sde_dsi_phy1@996400 {
+		compatible = "qcom,dsi-phy-v4.0";
+		label = "dsi-phy-1";
+		cell-index = <1>;
+		reg = <0x996400 0x588>;
+		reg-names = "dsi_phy";
+
+		gdsc-supply = <&gdsc_mdss>;
+		vdda-supply = <&pm8994_l2>;
+
+		clocks = <&clock_mmss clk_mdss_mdp_vote_clk>,
+			 <&clock_mmss clk_mdss_ahb_clk>,
+			 <&clock_mmss clk_mmss_misc_ahb_clk>,
+			 <&clock_mmss clk_mdss_axi_clk>;
+		clock-names = "mdp_core_clk", "iface_clk",
+			"core_mmss_clk", "bus_clk";
+
+		qcom,platform-strength-ctrl = [ff 06
+						ff 06
+						ff 06
+						ff 06
+						ff 00];
+		qcom,platform-regulator-settings = [1d
+						1d 1d 1d 1d];
+		qcom,platform-lane-config = [00 00 10 0f
+					00 00 10 0f
+					00 00 10 0f
+					00 00 10 0f
+					00 00 10 8f];
+
+		qcom,core-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,core-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+
+		qcom,phy-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,phy-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vdda";
+				qcom,supply-min-voltage = <1250000>;
+				qcom,supply-max-voltage = <1250000>;
+				qcom,supply-enable-load = <2500>;
+				qcom,supply-disable-load = <1>;
+			};
+		};
+	};
+
+	sde_hdmi_tx: qcom,hdmi_tx_8996@9a0000 {
+		compatible = "qcom,hdmi-tx-8996";
+
+		reg =	<0x009a0000 0x50c>,
+			<0x00070000 0x6158>,
+			<0x009e0000 0xfff>;
+		reg-names = "core_physical",
+			"qfprom_physical",
+			"hdcp_physical";
+		clocks = <&clock_mmss clk_mdss_mdp_vote_clk>,
+			 <&clock_mmss clk_mdss_ahb_clk>,
+			 <&clock_mmss clk_mdss_hdmi_clk>,
+			 <&clock_mmss clk_mdss_hdmi_ahb_clk>,
+			 <&clock_mmss clk_mdss_extpclk_clk>;
+		clock-names =
+			"mdp_core_clk",
+			"iface_clk",
+			"core_clk",
+			"alt_iface_clk",
+			"extp_clk";
+		interrupt-parent = <&sde_kms>;
+		interrupts = <8 0>;
+		hpd-gdsc-supply = <&gdsc_mdss>;
+		qcom,hdmi-tx-hpd-gpio = <&pm8994_mpps 4 0>;
+		pinctrl-names = "default", "sleep";
+		pinctrl-0 = <&mdss_hdmi_hpd_active
+			     &mdss_hdmi_ddc_active
+			     &mdss_hdmi_cec_active>;
+		pinctrl-1 = <&mdss_hdmi_hpd_suspend
+			     &mdss_hdmi_ddc_suspend
+			     &mdss_hdmi_cec_suspend>;
+
+		sde_hdmi_audio: qcom,sde-hdmi-audio-rx {
+			compatible = "qcom,msm-hdmi-audio-codec-rx";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-sim.dtsi b/arch/arm64/boot/dts/qcom/msm8996-sim.dtsi
new file mode 100644
index 000000000000..a88bd7554d5d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-sim.dtsi
@@ -0,0 +1,102 @@
+/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8996-pinctrl.dtsi"
+#include "dsi-panel-sim-video.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 SIM";
+	compatible = "qcom,msm8996-sim", "qcom,msm8996", "qcom,sim";
+	qcom,board-id = <16 0>;
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&blsp1_uart2 {
+	status = "ok";
+};
+
+&sdhc_1 {
+	vdd-supply = <&pm8994_l20>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	vdd-io-supply = <&pm8994_s4>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <110 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 96000000 192000000 384000000>;
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8994_l21>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8994_l13>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	status = "ok";
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_sim_vid>;
+};
+
+&ufsphy1 {
+	status = "ok";
+};
+
+&ufs1 {
+	status = "ok";
+};
+
+&usb3 {
+	qcom,skip-charger-detection;
+	qcom,vbus-present;
+	dwc3@6a00000 {
+		maximum-speed = "high-speed";
+	};
+};
+
+&ssphy {
+	qcom,emulation;
+};
+
+&cpp {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-smp2p.dtsi b/arch/arm64/boot/dts/qcom/msm8996-smp2p.dtsi
new file mode 100644
index 000000000000..35ec2d23e8cf
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-smp2p.dtsi
@@ -0,0 +1,247 @@
+/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+&soc {
+	qcom,smp2p-modem@9820010 {
+		compatible = "qcom,smp2p";
+		reg = <0x9820010 0x4>;
+		qcom,remote-pid = <1>;
+		qcom,irq-bitmask = <0x4000>;
+		interrupts = <GIC_SPI 451 IRQ_TYPE_EDGE_RISING>;
+	};
+
+	qcom,smp2p-adsp@9820010 {
+		compatible = "qcom,smp2p";
+		reg = <0x9820010 0x4>;
+		qcom,remote-pid = <2>;
+		qcom,irq-bitmask = <0x400>;
+		interrupts = <GIC_SPI 158 IRQ_TYPE_EDGE_RISING>;
+	};
+
+	qcom,smp2p-dsps@9820010 {
+		compatible = "qcom,smp2p";
+		reg = <0x9820010 0x4>;
+		qcom,remote-pid = <3>;
+		qcom,irq-bitmask = <0x4000000>;
+		interrupts = <GIC_SPI 178 IRQ_TYPE_EDGE_RISING>;
+	};
+
+	smp2pgpio_smp2p_15_in: qcom,smp2pgpio-smp2p-15-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <15>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_15_in {
+		compatible = "qcom,smp2pgpio_test_smp2p_15_in";
+		gpios = <&smp2pgpio_smp2p_15_in 0 0>;
+	};
+
+	smp2pgpio_smp2p_15_out: qcom,smp2pgpio-smp2p-15-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <15>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_15_out {
+		compatible = "qcom,smp2pgpio_test_smp2p_15_out";
+		gpios = <&smp2pgpio_smp2p_15_out 0 0>;
+	};
+
+	smp2pgpio_smp2p_1_in: qcom,smp2pgpio-smp2p-1-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <1>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_1_in {
+		compatible = "qcom,smp2pgpio_test_smp2p_1_in";
+		gpios = <&smp2pgpio_smp2p_1_in 0 0>;
+	};
+
+	smp2pgpio_smp2p_1_out: qcom,smp2pgpio-smp2p-1-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <1>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_1_out {
+		compatible = "qcom,smp2pgpio_test_smp2p_1_out";
+		gpios = <&smp2pgpio_smp2p_1_out 0 0>;
+	};
+
+	smp2pgpio_smp2p_2_in: qcom,smp2pgpio-smp2p-2-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <2>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_2_in {
+		compatible = "qcom,smp2pgpio_test_smp2p_2_in";
+		gpios = <&smp2pgpio_smp2p_2_in 0 0>;
+	};
+
+	smp2pgpio_smp2p_2_out: qcom,smp2pgpio-smp2p-2-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <2>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_2_out {
+		compatible = "qcom,smp2pgpio_test_smp2p_2_out";
+		gpios = <&smp2pgpio_smp2p_2_out 0 0>;
+	};
+
+	smp2pgpio_smp2p_3_in: qcom,smp2pgpio-smp2p-3-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <3>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_3_in {
+		compatible = "qcom,smp2pgpio_test_smp2p_3_in";
+		gpios = <&smp2pgpio_smp2p_3_in 0 0>;
+	};
+
+	smp2pgpio_smp2p_3_out: qcom,smp2pgpio-smp2p-3-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <3>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_3_out {
+		compatible = "qcom,smp2pgpio_test_smp2p_3_out";
+		gpios = <&smp2pgpio_smp2p_3_out 0 0>;
+	};
+
+	smp2pgpio_sleepstate_3_out: qcom,smp2pgpio-sleepstate-gpio-3-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "sleepstate";
+		qcom,remote-pid = <3>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio-sleepstate-3-out {
+		compatible = "qcom,smp2pgpio_sleepstate_3_out";
+		gpios = <&smp2pgpio_sleepstate_3_out 0 0>;
+	};
+
+	/* ssr - inbound entry from mss */
+	smp2pgpio_ssr_smp2p_1_in: qcom,smp2pgpio-ssr-smp2p-1-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "slave-kernel";
+		qcom,remote-pid = <1>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - outbound entry to mss */
+	smp2pgpio_ssr_smp2p_1_out: qcom,smp2pgpio-ssr-smp2p-1-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "master-kernel";
+		qcom,remote-pid = <1>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - inbound entry from lpass */
+	smp2pgpio_ssr_smp2p_2_in: qcom,smp2pgpio-ssr-smp2p-2-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "slave-kernel";
+		qcom,remote-pid = <2>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - outbound entry to lpass */
+	smp2pgpio_ssr_smp2p_2_out: qcom,smp2pgpio-ssr-smp2p-2-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "master-kernel";
+		qcom,remote-pid = <2>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - inbound entry from ssc */
+	smp2pgpio_ssr_smp2p_3_in: qcom,smp2pgpio-ssr-smp2p-3-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "slave-kernel";
+		qcom,remote-pid = <3>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - outbound entry to ssc */
+	smp2pgpio_ssr_smp2p_3_out: qcom,smp2pgpio-ssr-smp2p-3-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "master-kernel";
+		qcom,remote-pid = <3>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v2-dtp.dts b/arch/arm64/boot/dts/qcom/msm8996-v2-dtp.dts
new file mode 100644
index 000000000000..4fce8ef672bd
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v2-dtp.dts
@@ -0,0 +1,22 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v2.dtsi"
+#include "msm8996-dtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM8996 V2 DTP";
+	compatible = "qcom,msm8996-dtp", "qcom,msm8996", "qcom,qrd";
+	qcom,board-id= <0x1000b 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v2-fluid.dts b/arch/arm64/boot/dts/qcom/msm8996-v2-fluid.dts
new file mode 100644
index 000000000000..c104c86ba3a5
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v2-fluid.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996-v2.dtsi"
+#include "msm8996-fluid.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v2 FLUID";
+	compatible = "qcom,msm8996-fluid", "qcom,msm8996", "qcom,fluid";
+	qcom,board-id = <3 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v2-liquid.dts b/arch/arm64/boot/dts/qcom/msm8996-v2-liquid.dts
new file mode 100644
index 000000000000..a5aaee474836
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v2-liquid.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996-v2.dtsi"
+#include "msm8996-liquid.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v2 LiQUID";
+	compatible = "qcom,msm8996-liquid", "qcom,msm8996", "qcom,liquid";
+	qcom,board-id = <9 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-cdp.dts
new file mode 100644
index 000000000000..a8adcdc07b89
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996-v2.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v2 + PMI8994 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-mtp.dts
new file mode 100644
index 000000000000..164e89c0631c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-mtp.dts
@@ -0,0 +1,61 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996-v2.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v2 + PMI8994 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
+
+&mhi {
+	esoc-names = "mdm";
+	qcom,msm-bus,name = "mhi";
+	qcom,msm-bus,num-cases = <2>;
+	qcom,msm-bus,num-paths = <1>;
+	qcom,msm-bus,vectors-KBps =
+			<100 512 0 0>,
+			<100 512 1200000000 650000000>;
+	mhi-chan-cfg-0 = <0x0 0x80 0x2 0x92>;
+	mhi-chan-cfg-1 = <0x1 0x80 0x2 0xa2>;
+	mhi-chan-cfg-2 = <0x2 0x80 0x1 0x91>;
+	mhi-chan-cfg-3 = <0x3 0x80 0x1 0xa1>;
+	mhi-chan-cfg-4 = <0x4 0x80 0x2 0x92>;
+	mhi-chan-cfg-5 = <0x5 0x80 0x2 0xa2>;
+	mhi-chan-cfg-6 = <0x6 0xa 0x0 0x92>;
+	mhi-chan-cfg-7 = <0x7 0xa 0x0 0xa2>;
+	mhi-chan-cfg-10 = <0xa 0x80 0x1 0x92>;
+	mhi-chan-cfg-11 = <0xb 0x80 0x1 0xa2>;
+	mhi-chan-cfg-14 = <0xe 0x40 0x1 0x92>;
+	mhi-chan-cfg-15 = <0xf 0x40 0x1 0xa2>;
+	mhi-chan-cfg-16 = <0x10 0x40 0x1 0x92>;
+	mhi-chan-cfg-17 = <0x11 0x40 0x1 0xa2>;
+	mhi-chan-cfg-18 = <0x12 0x40 0x1 0x92>;
+	mhi-chan-cfg-19 = <0x13 0x40 0x1 0xa2>;
+	mhi-chan-cfg-20 = <0x14 0xa 0x0 0x92>;
+	mhi-chan-cfg-21 = <0x15 0xa 0x0 0xa2>;
+	mhi-chan-cfg-32 = <0x20 0x80 0x2 0x92>;
+	mhi-chan-cfg-33 = <0x21 0x80 0x2 0xa2>;
+	mhi-chan-cfg-100 = <0x64 0x80 0x3 0x52>;
+	mhi-chan-cfg-101 = <0x65 0x80 0x4 0x62>;
+	mhi-event-rings = <5>;
+	mhi-event-cfg-0 = <0x80 0x0 0x1 0x11>;
+	mhi-event-cfg-1 = <0x80 0x1 0x1 0x11>;
+	mhi-event-cfg-2 = <0x80 0x2 0x5 0x11>;
+	mhi-event-cfg-3 = <0x100 0x3 0x1 0x9>;
+	mhi-event-cfg-4 = <0x100 0x4 0x1 0x8>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pm8004-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pm8004-cdp.dts
new file mode 100644
index 000000000000..f5cf0f62ce45
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pm8004-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v2.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v2 + PMI8994 + PM8004 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pm8004-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pm8004-mtp.dts
new file mode 100644
index 000000000000..97909c3ef16a
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pm8004-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v2.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v2 + PMI8994 + PM8004 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pm8004-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pm8004-pmk8001-cdp.dts
new file mode 100644
index 000000000000..080efc93abe1
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pm8004-pmk8001-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v2.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v2 + PMI8994 + PM8004 + PMK8001 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pm8004-pmk8001-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pm8004-pmk8001-mtp.dts
new file mode 100644
index 000000000000..0b958073840b
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pm8004-pmk8001-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v2.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004-pmk8001.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v2 + PMI8994 + PM8004 + PMK8001 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pmk8001-cdp.dts
new file mode 100644
index 000000000000..7c6a7dd36258
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pmk8001-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+*
+* This program is free software; you can redistribute it and/or modify
+* it under the terms of the GNU General Public License version 2 and
+* only version 2 as published by the Free Software Foundation.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+*/
+
+/dts-v1/;
+
+#include "msm8996-v2.dtsi"
+#include "msm8996-pm8994-pmi8994-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v2 + PMI8994 + PMK8001 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pmk8001-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pmk8001-mtp.dts
new file mode 100644
index 000000000000..673fd2264007
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v2-pmi8994-pmk8001-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+*
+* This program is free software; you can redistribute it and/or modify
+* it under the terms of the GNU General Public License version 2 and
+* only version 2 as published by the Free Software Foundation.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+*/
+
+/dts-v1/;
+
+#include "msm8996-v2.dtsi"
+#include "msm8996-pm8994-pmi8994-pmk8001.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v2 + PMI8994 + PMK8001 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v2.dtsi b/arch/arm64/boot/dts/qcom/msm8996-v2.dtsi
new file mode 100644
index 000000000000..698c0193a164
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v2.dtsi
@@ -0,0 +1,792 @@
+/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only version-specific property overrides should be placed
+ * inside this file. Common device definitions should be placed inside the
+ * msm8996.dtsi file.
+ */
+
+#include "msm8996.dtsi"
+#include "msm8996-coresight-v2.dtsi"
+#include "msm-arm-smmu-impl-defs-8996-v2.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v2";
+	qcom,msm-id = <246 0x20001>;
+};
+
+&clock_gcc {
+	compatible = "qcom,gcc-8996-v2";
+};
+
+&clock_debug {
+	compatible = "qcom,cc-debug-8996-v2";
+};
+
+&clock_mmss {
+	compatible = "qcom,mmsscc-8996-v2";
+};
+
+&clock_gpu {
+	compatible = "qcom,gpucc-8996-v2";
+	qcom,gfx3d_clk_src_v2-opp-handle = <&msm_gpu>;
+	qcom,gfxfreq-speedbin0 =
+		<	   0  0  0 >,
+		<  125000000  3  4 >,
+		<  210000000  3  4 >,
+		<  300000000  3  4 >,
+		<  500000000  4  5 >,
+		<  604800000  5  7 >;
+	qcom,gfxfreq-mx-speedbin0 =
+		<	   0  0 >,
+		<  125000000  4 >,
+		<  210000000  4 >,
+		<  300000000  4 >,
+		<  500000000  5 >,
+		<  604800000  7 >;
+};
+
+&gdsc_gpu_gx {
+	clock-names = "core_clk", "core_root_clk";
+	clocks = <&clock_gpu clk_gpu_gx_gfx3d_clk>,
+		 <&clock_gpu clk_gfx3d_clk_src_v2>;
+};
+
+&pm8994_s11 {
+	regulator-max-microvolt = <1015000>;
+	/delete-property/ qcom,recal-mask;
+};
+
+&pm8994_s11_limit {
+	regulator-max-microvolt = <1015000>;
+};
+
+&apc_apm {
+	 /delete-property/ qcom,clock-source-override;
+};
+
+&apcc_cpr {
+	compatible = "qcom,cpr3-msm8996-v2-hmss-regulator";
+
+	qcom,cpr-count-mode = <2>;		/* Staggered */
+	/delete-property/ qcom,cpr-count-repeat;
+	/delete-property/ mem-acc-thread0-supply;
+	/delete-property/ mem-acc-thread1-supply;
+	/delete-property/ mem-acc-supply;
+
+	qcom,apm-ctrl = <&apc_apm>;
+	qcom,apm-threshold-voltage = <850000>;
+	qcom,apm-hysteresis-voltage = <5000>;
+
+	qcom,cpr-enable;
+	qcom,cpr-hw-closed-loop;
+
+	/delete-property/ qcom,cpr-aging-ref-voltage;
+	/delete-property/ proxy-supply;
+
+	thread@0 {
+		qcom,cpr-consecutive-down = <2>;
+		qcom,cpr-up-threshold = <0>;
+	};
+
+	thread@1 {
+		qcom,cpr-consecutive-down = <2>;
+		qcom,cpr-up-threshold = <0>;
+	};
+};
+
+&apc0_pwrcl_vreg {
+	regulator-min-microvolt = <1>;
+	regulator-max-microvolt = <19>;
+
+	qcom,cpr-fuse-corners = <5>;
+	qcom,cpr-fuse-combos = <4>;
+	/delete-property/ qcom,cpr-speed-bins;
+	/delete-property/ qcom,cpr-speed-bin-corners;
+	/delete-property/ qcom,uses-mem-acc;
+	qcom,cpr-corners = <19>;
+
+	qcom,ldo-max-voltage = <805000>;
+
+	qcom,cpr-corner-fmax-map = <1 2 6 11 19>;
+
+	qcom,cpr-voltage-ceiling =
+		<670000  670000  745000  745000  745000  745000  905000  905000
+		 905000  905000  905000 1015000 1015000 1015000 1015000 1015000
+		1015000 1015000 1015000>;
+	qcom,cpr-voltage-floor =
+		<470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000>;
+	qcom,cpr-floor-to-ceiling-max-range =
+		 <80000   80000   80000   80000   80000   80000   80000   80000
+		  80000   80000   80000   80000   80000   80000   80000   80000
+		  80000   80000   80000>;
+
+	qcom,corner-frequencies =
+		<192000000  268800000  307200000  345600000  403200000
+		 480000000  576000000  633600000  729600000  806400000
+		 883200000  960000000 1017600000 1113600000 1190400000
+		1267200000 1344000000 1420800000 1459200000>;
+
+	qcom,cpr-ro-scaling-factor =
+	      <   0    0    0    0 2222 2275 2506 2491 2649 2640 2886 2866    0
+		  0    0    0>,
+	      <   0    0    0    0 2222 2275 2506 2491 2649 2640 2886 2866    0
+		  0    0    0>,
+	      <   0    0    0    0 2222 2275 2506 2491 2649 2640 2886 2866    0
+		  0    0    0>,
+	      <   0    0    0    0 2147 2226 2310 2312 2450 2447 2603 2600    0
+		  0    0    0>,
+	      <   0    0    0    0 1989 2079 2066 2083 2193 2201 2283 2296    0
+		  0    0    0>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		<0 0 0 0 0>,
+		<0 0 0 0 0>,
+		<0 0 0 0 0>,
+		<0 0 0 0 0>;
+	qcom,cpr-closed-loop-voltage-fuse-adjustment =
+		<0 0 0 0 0>,
+		<0 0 0 0 0>,
+		<0 0 0 0 0>,
+		<0 0 0 0 0>;
+
+	/delete-property/ qcom,cpr-open-loop-voltage-adjustment;
+	/delete-property/ qcom,cpr-open-loop-voltage-min-diff;
+	/delete-property/ qcom,cpr-closed-loop-voltage-adjustment;
+
+	/delete-property/ qcom,cpr-aging-max-voltage-adjustment;
+	/delete-property/ qcom,cpr-aging-ref-corner;
+	/delete-property/ qcom,cpr-aging-ro-scaling-factor;
+	/delete-property/ qcom,allow-aging-voltage-adjustment;
+};
+
+&apc0_cbf_vreg {
+	regulator-min-microvolt = <1>;
+	regulator-max-microvolt = <10>;
+
+	qcom,cpr-fuse-corners = <5>;
+	qcom,cpr-fuse-combos = <4>;
+	/delete-property/ qcom,cpr-speed-bins;
+	/delete-property/ qcom,cpr-speed-bin-corners;
+	qcom,cpr-corners = <10>;
+
+	qcom,cpr-corner-fmax-map = <1 2 5 9 10>;
+
+	qcom,cpr-voltage-ceiling =
+	       <605000  670000  745000  745000  745000  905000  905000  905000
+		905000 1015000>;
+	qcom,cpr-voltage-floor =
+	       <470000  470000  470000  470000  470000  470000  470000  470000
+		470000  470000>;
+	qcom,cpr-floor-to-ceiling-max-range =
+		<80000   80000   80000   80000   80000   80000   80000   80000
+		 80000   80000>;
+
+	qcom,corner-frequencies =
+		<150000000  307200000  384000000  499200000  595200000
+		 691200000  787200000  883200000  960000000 1036800000>;
+
+	qcom,cpr-ro-scaling-factor =
+	      <   0    0    0    0 2222 2275 2506 2491 2649 2640 2886 2866    0
+		  0    0    0>,
+	      <   0    0    0    0 2222 2275 2506 2491 2649 2640 2886 2866    0
+		  0    0    0>,
+	      <   0    0    0    0 2222 2275 2506 2491 2649 2640 2886 2866    0
+		  0    0    0>,
+	      <   0    0    0    0 2147 2226 2310 2312 2450 2447 2603 2600    0
+		  0    0    0>,
+	      <   0    0    0    0 1989 2079 2066 2083 2193 2201 2283 2296    0
+		  0    0    0>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		<0 0 0 0 0>,
+		<0 0 0 0 0>,
+		<0 0 0 0 (-130000)>,
+		<0 0 0 0 (-130000)>;
+	qcom,cpr-closed-loop-voltage-fuse-adjustment =
+		<0 0 0 0 0>,
+		<0 0 0 0 0>,
+		<0 0 0 0 (-115000)>,
+		<0 0 0 0 (-115000)>;
+
+	/delete-property/ qcom,cpr-aging-max-voltage-adjustment;
+	/delete-property/ qcom,cpr-aging-ref-corner;
+	/delete-property/ qcom,cpr-aging-ro-scaling-factor;
+	/delete-property/ qcom,allow-aging-voltage-adjustment;
+	/delete-property/ qcom,proxy-consumer-enable;
+	/delete-property/ qcom,proxy-consumer-voltage;
+};
+
+&apc1_vreg {
+	regulator-min-microvolt = <1>;
+	regulator-max-microvolt = <18>;
+
+	qcom,cpr-fuse-corners = <5>;
+	qcom,cpr-fuse-combos = <4>;
+	/delete-property/ qcom,cpr-speed-bins;
+	/delete-property/ qcom,cpr-speed-bin-corners;
+	/delete-property/ qcom,uses-mem-acc;
+	qcom,cpr-corners = <18>;
+
+	qcom,ldo-max-voltage = <805000>;
+
+	qcom,cpr-corner-fmax-map = <1 3 5 11 18>;
+
+	qcom,cpr-voltage-ceiling =
+		<670000  670000  670000  745000  745000  905000  905000  905000
+		 905000  905000  905000 1015000 1015000 1015000 1015000 1015000
+		 1015000 1015000>;
+	qcom,cpr-voltage-floor =
+		<470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000>;
+	qcom,cpr-floor-to-ceiling-max-range =
+		 <80000   80000   80000   80000   80000   80000   80000   80000
+		  80000   80000   80000   80000   80000   80000   80000   80000
+		  80000   80000>;
+
+	qcom,corner-frequencies =
+		<307200000  345600000  403200000  480000000  576000000
+		 633600000  729600000  806400000  883200000  960000000
+		1017600000 1113600000 1190400000 1267200000 1344000000
+		1420800000 1497600000 1593600000>;
+
+	qcom,cpr-ro-scaling-factor =
+	      <   0    0    0    0 2212 2273 2517 2506 2663 2650 2908 2891    0
+		  0    0    0>,
+	      <   0    0    0    0 2212 2273 2517 2506 2663 2650 2908 2891    0
+		  0    0    0>,
+	      <   0    0    0    0 2212 2273 2517 2506 2663 2650 2908 2891    0
+		  0    0    0>,
+	      <   0    0    0    0 2152 2237 2321 2337 2475 2469 2636 2612    0
+		  0    0    0>,
+	      <   0    0    0    0 2001 2102 2092 2090 2203 2210 2297 2297    0
+		  0    0    0>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		<0 0 0 5000 0>,
+		<0 0 0 5000 0>,
+		<0 0 0 0 0>,
+		<0 0 0 0 0>;
+	qcom,cpr-closed-loop-voltage-fuse-adjustment =
+		<0 0 0 20000 0>,
+		<0 0 0 20000 0>,
+		<0 0 0 0 0>,
+		<0 0 0 0 0>;
+
+	/delete-property/ qcom,cpr-open-loop-voltage-adjustment;
+	/delete-property/ qcom,cpr-open-loop-voltage-min-diff;
+	/delete-property/ qcom,cpr-closed-loop-voltage-adjustment;
+
+	/delete-property/ qcom,cpr-aging-max-voltage-adjustment;
+	/delete-property/ qcom,cpr-aging-ref-corner;
+	/delete-property/ qcom,cpr-aging-ro-scaling-factor;
+	/delete-property/ qcom,allow-aging-voltage-adjustment;
+
+	/delete-property/ qcom,cpr-dynamic-floor-corner;
+};
+
+&gfx_cpr {
+	system-supply = <&pm8994_s1_corner>;
+	qcom,cpr-enable;
+
+	/delete-property/ qcom,cpr-aging-ref-voltage;
+};
+
+&gfx_vreg {
+	regulator-min-microvolt = <2>;
+	regulator-max-microvolt = <5>;
+
+	qcom,cpr-fuse-corners = <4>;
+	qcom,cpr-fuse-combos = <8>;
+	qcom,cpr-corners = <5>;
+
+	qcom,cpr-corner-fmax-map = <2 3 4 5>;
+
+	qcom,cpr-voltage-ceiling =
+		<400000 670000  745000  905000 1015000>;
+	qcom,cpr-voltage-floor =
+		<400000 520000  520000  520000  520000>;
+
+	qcom,system-voltage = <2 2 2 2 4>;
+	qcom,mem-acc-voltage = <1 1 1 2 2>;
+
+	qcom,corner-frequencies =
+		<0 210000000 300000000 500000000 604800000>;
+
+	qcom,cpr-target-quotients =
+	      <   0    0    0    0  249  232    0  394    0  422    0    0    0
+		  0    0    0>,
+	      <   0    0    0    0  249  232    0  394    0  422    0    0    0
+		  0    0    0>,
+	      <   0    0    0    0  400  363    0  565    0  603    0    0    0
+		  0    0    0>,
+	      <   0    0    0    0  669  601    0  851    0  905    0    0    0
+		  0    0    0>,
+	      <   0    0    0    0  899  806    0 1084    0 1149    0    0    0
+		  0    0    0>;
+
+	qcom,cpr-ro-scaling-factor =
+	      <   0    0    0    0 2268 2004    0 2408    0 2539    0    0    0
+		  0    0    0>,
+	      <   0    0    0    0 2268 2004    0 2408    0 2539    0    0    0
+		  0    0    0>,
+	      <   0    0    0    0 2268 2004    0 2408    0 2539    0    0    0
+		  0    0    0>,
+	      <   0    0    0    0 2268 2004    0 2408    0 2539    0    0    0
+		  0    0    0>,
+	      <   0    0    0    0 2268 2004    0 2408    0 2539    0    0    0
+		  0    0    0>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		<0 (-5000) (-30000) (-115000)>;
+	qcom,cpr-closed-loop-voltage-adjustment =
+		<0 0 0 (-10000) (-65000)>;
+	qcom,cpr-floor-to-ceiling-max-range =
+		<0 130000 40000 85000 85000>;
+
+	/delete-property/ qcom,cpr-fused-closed-loop-voltage-adjustment-map;
+
+	/delete-property/ qcom,cpr-aging-max-voltage-adjustment;
+	/delete-property/ qcom,cpr-aging-ref-corner;
+	/delete-property/ qcom,cpr-aging-ro-scaling-factor;
+	/delete-property/ qcom,allow-aging-voltage-adjustment;
+};
+
+&kryo0_vreg {
+	regulator-min-microvolt = <468864>;
+	regulator-max-microvolt = <808896>;
+	qcom,vref-functional-step-voltage = <4048>;
+	qcom,vref-functional-min-voltage = <294800>;
+	qcom,vref-retention-step-voltage = <4462>;
+	qcom,vref-retention-min-voltage = <324950>;
+	qcom,ldo-config-init = <0x31f0e471>;
+};
+
+&kryo0_retention_vreg {
+	regulator-min-microvolt = <467734>;
+	regulator-max-microvolt = <891624>;
+};
+
+&kryo1_vreg {
+	regulator-min-microvolt = <468864>;
+	regulator-max-microvolt = <808896>;
+	qcom,vref-functional-step-voltage = <4048>;
+	qcom,vref-functional-min-voltage = <294800>;
+	qcom,vref-retention-step-voltage = <4462>;
+	qcom,vref-retention-min-voltage = <324950>;
+	qcom,ldo-config-init = <0x31f0e471>;
+};
+
+&kryo1_retention_vreg {
+	regulator-min-microvolt = <467734>;
+	regulator-max-microvolt = <891624>;
+};
+
+&apc0_pwrcl_mem_acc_vreg {
+	status = "disabled";
+};
+
+&apc1_perfcl_mem_acc_vreg {
+	status = "disabled";
+};
+
+&apcc_l3_mem_acc_vreg {
+	status = "disabled";
+};
+
+/* GPU overrides */
+&msm_gpu {
+	/* Updated chip ID */
+	qcom,chipid = <0x05030001>;
+
+	qcom,initial-pwrlevel = <3>;
+	qcom,bus-width = <32>;
+
+	/* Quirks */
+	qcom,gpu-quirk-two-pass-use-wfi;
+	qcom,gpu-quirk-iommu-sync;
+	qcom,gpu-quirk-fault-detect-mask;
+
+	/* Power levels */
+	qcom,gpu-pwrlevels {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		compatible = "qcom,gpu-pwrlevels";
+
+		qcom,gpu-pwrlevel@0 {
+			reg = <0>;
+			qcom,gpu-freq = <604800000>;
+			qcom,bus-freq = <11>;
+			qcom,bus-min = <10>;
+			qcom,bus-max = <11>;
+		};
+
+		qcom,gpu-pwrlevel@1 {
+			reg = <1>;
+			qcom,gpu-freq = <500000000>;
+			qcom,bus-freq = <9>;
+			qcom,bus-min = <8>;
+			qcom,bus-max = <10>;
+		};
+
+		qcom,gpu-pwrlevel@2 {
+			reg = <2>;
+			qcom,gpu-freq = <300000000>;
+			qcom,bus-freq = <6>;
+			qcom,bus-min = <5>;
+			qcom,bus-max = <7>;
+		};
+
+		qcom,gpu-pwrlevel@3 {
+			reg = <3>;
+			qcom,gpu-freq = <210000000>;
+			qcom,bus-freq = <4>;
+			qcom,bus-min = <3>;
+			qcom,bus-max = <5>;
+		};
+
+		qcom,gpu-pwrlevel@4 {
+			reg = <4>;
+			qcom,gpu-freq = <125000000>;
+			qcom,bus-freq = <2>;
+			qcom,bus-min = <1>;
+			qcom,bus-max = <3>;
+		};
+		qcom,gpu-pwrlevel@5 {
+			reg = <5>;
+			qcom,gpu-freq = <27000000>;
+			qcom,bus-freq = <0>;
+			qcom,bus-min = <0>;
+			qcom,bus-max = <0>;
+		};
+	};
+};
+
+&mdss_mdp {
+	gdsc-venus-supply = <&gdsc_venus>;
+};
+
+&sde_hdmi_tx {
+	hpd-gdsc-venus-supply = <&gdsc_venus>;
+};
+
+&mdss_dsi0 {
+	gdsc-venus-supply = <&gdsc_venus>;
+	qcom,core-supply-entries {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,core-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "gdsc-venus";
+			qcom,supply-min-voltage = <0>;
+			qcom,supply-max-voltage = <0>;
+			qcom,supply-enable-load = <0>;
+			qcom,supply-disable-load = <0>;
+		};
+
+		qcom,core-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "gdsc";
+			qcom,supply-min-voltage = <0>;
+			qcom,supply-max-voltage = <0>;
+			qcom,supply-enable-load = <0>;
+			qcom,supply-disable-load = <0>;
+		};
+	};
+};
+
+&mdss_hdmi_tx {
+	hpd-gdsc-venus-supply = <&gdsc_venus>;
+	qcom,supply-names = "hpd-gdsc-venus", "hpd-gdsc";
+	qcom,min-voltage-level = <0 0>;
+	qcom,max-voltage-level = <0 0>;
+	qcom,enable-load = <0 0>;
+	qcom,disable-load = <0 0>;
+};
+
+&mdss_dsi0_pll {
+	gdsc-venus-supply = <&gdsc_venus>;
+	qcom,platform-supply-entries {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,platform-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "gdsc-venus";
+			qcom,supply-min-voltage = <0>;
+			qcom,supply-max-voltage = <0>;
+			qcom,supply-enable-load = <0>;
+			qcom,supply-disable-load = <0>;
+		};
+
+		qcom,platform-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "gdsc";
+			qcom,supply-min-voltage = <0>;
+			qcom,supply-max-voltage = <0>;
+			qcom,supply-enable-load = <0>;
+			qcom,supply-disable-load = <0>;
+		};
+	};
+};
+
+&mdss_dsi1_pll {
+	gdsc-venus-supply = <&gdsc_venus>;
+	qcom,platform-supply-entries {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,platform-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "gdsc-venus";
+			qcom,supply-min-voltage = <0>;
+			qcom,supply-max-voltage = <0>;
+			qcom,supply-enable-load = <0>;
+			qcom,supply-disable-load = <0>;
+		};
+
+		qcom,platform-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "gdsc";
+			qcom,supply-min-voltage = <0>;
+			qcom,supply-max-voltage = <0>;
+			qcom,supply-enable-load = <0>;
+			qcom,supply-disable-load = <0>;
+		};
+	};
+};
+
+&mdss_hdmi_pll {
+	gdsc-venus-supply = <&gdsc_venus>;
+	qcom,platform-supply-entries {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,platform-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "gdsc-venus";
+			qcom,supply-min-voltage = <0>;
+			qcom,supply-max-voltage = <0>;
+			qcom,supply-enable-load = <0>;
+			qcom,supply-disable-load = <0>;
+		};
+
+		qcom,platform-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "gdsc";
+			qcom,supply-min-voltage = <0>;
+			qcom,supply-max-voltage = <0>;
+			qcom,supply-enable-load = <0>;
+			qcom,supply-disable-load = <0>;
+		};
+
+		qcom,platform-supply-entry@2 {
+			reg = <2>;
+			qcom,supply-name = "vddio";
+			qcom,supply-min-voltage = <1800000>;
+			qcom,supply-max-voltage = <1800000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+
+		qcom,platform-supply-entry@3 {
+			reg = <3>;
+			qcom,supply-name = "vcca";
+			qcom,supply-min-voltage = <925000>;
+			qcom,supply-max-voltage = <925000>;
+			qcom,supply-enable-load = <10000>;
+			qcom,supply-disable-load = <100>;
+		};
+	};
+};
+
+&gdsc_venus {
+	proxy-supply = <&gdsc_venus>;
+	qcom,proxy-consumer-enable;
+};
+
+&soc {
+	tsens1: tsens@4ad000 {
+		compatible = "qcom,msm8996-tsens";
+		reg = <0x4ac000 0x2000>,
+			<0x75230 0x1000>;
+		reg-names = "tsens_physical", "tsens_eeprom_physical";
+		interrupts = <0 184 0>, <0 430 0>;
+		interrupt-names = "tsens-upper-lower", "tsens-critical";
+		qcom,client-id = <13 14 15 16 17 18 19 20>;
+		qcom,sensor-id = <1 6 7 0 2 3 4 5>;
+		qcom,sensors = <8>;
+		qcom,slope = <2901 2846 3200 3200 3200 3200 3200 3200>;
+	};
+
+	ipa_hw: qcom,ipa@680000 {
+		compatible = "qcom,ipa";
+		reg = <0x680000 0x4effc>,
+			<0x684000 0x26934>;
+		reg-names = "ipa-base", "bam-base";
+		interrupts = <0 333 0>,
+					<0 432 0>;
+		interrupt-names = "ipa-irq", "bam-irq";
+		qcom,ipa-hw-ver = <5>; /* IPA core version = IPAv2.5 */
+		qcom,ipa-hw-mode = <0>;
+		qcom,ee = <0>;
+		qcom,use-ipa-tethering-bridge;
+		qcom,ipa-bam-remote-mode;
+		qcom,modem-cfg-emb-pipe-flt;
+		clocks = <&clock_gcc clk_ipa_clk>;
+		clock-names = "core_clk";
+		qcom,use-dma-zone;
+	};
+
+	qcom,msm-thermal{
+		qcom,vdd-gfx-rstr{
+			qcom,levels = <4 5 5>; /* Nominal, Turbo, Turbo */
+		};
+	};
+
+	jtag_mm0: jtagmm@3840000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x3840000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU0>;
+		qcom,si-enable;
+		qcom,save-restore-disable;
+	};
+
+	jtag_mm1: jtagmm@3940000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x3940000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU1>;
+		qcom,si-enable;
+		qcom,save-restore-disable;
+	};
+
+	jtag_mm2: jtagmm@3a40000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x3a40000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU2>;
+		qcom,si-enable;
+		qcom,save-restore-disable;
+	};
+
+	jtag_mm3: jtagmm@3b40000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x3b40000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU3>;
+		qcom,si-enable;
+		qcom,save-restore-disable;
+	};
+};
+
+&tsens0 {
+	interrupts = <0 458 0>, <0 445 0>;
+	qcom,sensors = <13>;
+	qcom,slope = <2901 2846 3200 3200 3200 3200 3200 3200 3200 3200 3200 3200 3200>;
+};
+
+&mdss_hdmi_pll {
+	compatible = "qcom,mdss_hdmi_pll_8996_v2";
+};
+
+&mdss_hdmi_tx {
+	status = "ok";
+};
+
+&ssphy {
+	qcom,qmp-phy-init-seq =
+		/* <reg_offset, value, delay> */
+			<0xac  0x14 0x00 /* common block settings */
+			 0x34  0x08 0x00
+			 0x174 0x30 0x00
+			 0x194 0x06 0x00
+			 0x19c 0x01 0x00
+			 0x178 0x01 0x00 /* change */
+			 0x70  0x0f 0x00
+			 0x48  0x0f 0x00
+			 0x3c  0x04 0x00
+			 0xd0  0x82 0x00 /* pll and loop filter settings*/
+			 0xdc  0x55 0x00
+			 0xe0  0x55 0x00
+			 0xe4  0x03 0x00
+			 0x78  0x0b 0x00
+			 0x84  0x16 0x00
+			 0x90  0x28 0x00
+			 0x108 0x80 0x00
+			 0x124 0x00 0x00
+			 0x4c  0x15 0x00
+			 0x50  0x34 0x00
+			 0x18c 0x00 0x00
+			 0xcc  0x00 0x00
+			 0x128 0x00 0x00
+			 0x0c  0x0a 0x00
+			 0x10  0x01 0x00 /* ssc settings */
+			 0x1c  0x31 0x00
+			 0x20  0x01 0x00
+			 0x14  0x00 0x00
+			 0x18  0x00 0x00
+			 0x24  0xde 0x00
+			 0x28  0x07 0x00
+			 0x440 0x0b 0x00 /* Rx settings */
+			 0x41c 0x04 0x00
+			 0x4d8 0x02 0x00
+			 0x4dc 0x4c 0x00
+			 0x4e0 0xbb 0x00
+			 0x508 0x77 0x00
+			 0x50c 0x80 0x00
+			 0x514 0x03 0x00
+			 0x518 0x1b 0x00 /* change */
+			 0x51c 0x16 0x00
+			 0x268 0x45 0x00 /* Tx settings */
+			 0x2ac 0x12 0x00
+			 0x294 0x06 0x00
+			 0x6c4 0x03 0x00 /* FLL settings */
+			 0x6c0 0x02 0x00
+			 0x6c8 0x09 0x00
+			 0x6cc 0x42 0x00
+			 0x6d0 0x85 0x00
+			 0x680 0xd1 0x00 /* Lock Det settings */
+			 0x684 0x1f 0x00
+			 0x688 0x47 0x00
+			 0x664 0x08 0x00
+			 0xc4  0x15 0x00 /* res_code settings */
+			 0x1b8 0x1f 0x00
+			 0xffffffff 0xffffffff 0x00>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-auto-adp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-auto-adp.dts
new file mode 100644
index 000000000000..68956d71b74d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-auto-adp.dts
@@ -0,0 +1,83 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include "msm8996-v3.dtsi"
+#include "msm8996-pm8994.dtsi"
+#include "msm8996-agave-adp.dtsi"
+#include "msm8996v3-auto.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 AUTO ADP";
+	compatible = "qcom,msm8996-adp", "qcom,msm8996", "qcom,adp";
+	qcom,msm-id = <310 0x30001>;
+	qcom,board-id = <0x02010019 0>;
+};
+
+&spi_9 {
+	status = "ok";
+	can-controller@0 {
+		compatible = "renesas,rh850";
+		reg = <0>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <122 0>;
+		spi-max-frequency = <5000000>;
+	};
+};
+
+&soc {
+	qcom,msm-ssc-sensors {
+		status = "disabled";
+	};
+
+	qcom,msm-thermal {
+		qcom,hotplug-temp = <115>;
+		qcom,hotplug-temp-hysteresis = <25>;
+		qcom,therm-reset-temp = <119>;
+	};
+};
+
+&pil_modem {
+	pinctrl-names = "default";
+	pinctrl-0 = <&modem_mux>;
+};
+
+&slim_msm {
+	status = "disabled";
+};
+
+&pm8994_mpps {
+	mpp@a500 { /* MPP 6 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&sdhc_2 {
+	cd-gpios = <&tlmm 38 GPIO_ACTIVE_LOW>;
+	pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on_sbc>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off
+			&sdc2_cd_on_sbc>;
+};
+
+&i2c_7 {
+	silabs4705@11 { /* SiLabs FM chip, slave id 0x11*/
+		status = "disabled";
+	};
+};
+
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-auto-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-auto-cdp.dts
new file mode 100644
index 000000000000..8ca2b30b3779
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-auto-cdp.dts
@@ -0,0 +1,49 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm8996-pm8994.dtsi"
+#include "msm8996-auto-cdp.dtsi"
+#include "msm8996v3-auto.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 AUTO CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,msm-id = <310 0x30001>;
+	qcom,board-id = <0x03010001 0>;
+};
+
+&soc {
+	qcom,msm-thermal {
+		qcom,hotplug-temp = <115>;
+		qcom,hotplug-temp-hysteresis = <25>;
+		qcom,therm-reset-temp = <119>;
+	};
+};
+
+&pil_modem {
+	pinctrl-names = "default";
+	pinctrl-0 = <&modem_mux>;
+};
+
+&spi_9 {
+	status = "ok";
+	can-controller@0 {
+		compatible = "renesas,rh850";
+		reg = <0>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <127 0>;
+		spi-max-frequency = <5000000>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-dtp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-dtp.dts
new file mode 100644
index 000000000000..a9a80a49d7fe
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-dtp.dts
@@ -0,0 +1,22 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm8996-dtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM8996 V3 DTP";
+	compatible = "qcom,msm8996-dtp", "qcom,msm8996", "qcom,qrd";
+	qcom,board-id= <0x3000b 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-fluid.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-fluid.dts
new file mode 100644
index 000000000000..f9d89e9c8962
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-fluid.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm8996-fluid.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 FLUID";
+	compatible = "qcom,msm8996-fluid", "qcom,msm8996", "qcom,fluid";
+	qcom,board-id = <3 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-liquid.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-liquid.dts
new file mode 100644
index 000000000000..0910ef7e92df
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-liquid.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm8996-liquid.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 LiQUID";
+	compatible = "qcom,msm8996-liquid", "qcom,msm8996", "qcom,liquid";
+	qcom,board-id = <9 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-pm8004-agave-adp-lite.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-pm8004-agave-adp-lite.dts
new file mode 100644
index 000000000000..eb8591b4ded7
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-pm8004-agave-adp-lite.dts
@@ -0,0 +1,27 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm8996-pm8994-pm8004.dtsi"
+#include "msm8996-agave-adp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 + PM8004 ADP LITE";
+	compatible = "qcom,msm8996-adp", "qcom,msm8996", "qcom,adp";
+	qcom,board-id = <0x03010019 0>;
+};
+
+&spi_9 {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-pm8004-agave-adp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-pm8004-agave-adp.dts
new file mode 100644
index 000000000000..d6819c4fefc7
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-pm8004-agave-adp.dts
@@ -0,0 +1,34 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm8996-pm8994-pm8004.dtsi"
+#include "msm8996-agave-adp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 + PM8004 ADP";
+	compatible = "qcom,msm8996-adp", "qcom,msm8996", "qcom,adp";
+	qcom,board-id = <0x00010019 0>;
+};
+
+&spi_9 {
+	status = "ok";
+	can-controller@0 {
+		compatible = "renesas,rh850";
+		reg = <0>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <122 0>;
+		spi-max-frequency = <5000000>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-pm8004-mmxf-adp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-pm8004-mmxf-adp.dts
new file mode 100644
index 000000000000..57ed8aa47fd3
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-pm8004-mmxf-adp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm8996-pm8994-pm8004.dtsi"
+#include "msm8996-mmxf-adp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 + PM8004 ADP";
+	compatible = "qcom,msm8996-adp", "qcom,msm8996", "qcom,adp";
+	qcom,board-id = <0x01010019 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-cdp.dts
new file mode 100644
index 000000000000..bcd162c3538a
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 + PMI8994 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-mtp.dts
new file mode 100644
index 000000000000..182bd247ec84
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 + PMI8994 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pm8004-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pm8004-cdp.dts
new file mode 100644
index 000000000000..294555bf0ea7
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pm8004-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 + PMI8994 + PM8004 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pm8004-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pm8004-mtp.dts
new file mode 100644
index 000000000000..eaa769336e40
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pm8004-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 + PMI8994 + PM8004 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pm8004-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pm8004-pmk8001-cdp.dts
new file mode 100644
index 000000000000..8b6091ac2b44
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pm8004-pmk8001-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 + PMI8994 + PM8004 + PMK8001 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pm8004-pmk8001-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pm8004-pmk8001-mtp.dts
new file mode 100644
index 000000000000..8e2dbb9edbc5
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pm8004-pmk8001-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004-pmk8001.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 + PMI8994 + PM8004 + PMK8001 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pmk8001-cdp.dts
new file mode 100644
index 000000000000..68b5a23401e8
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pmk8001-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+*
+* This program is free software; you can redistribute it and/or modify
+* it under the terms of the GNU General Public License version 2 and
+* only version 2 as published by the Free Software Foundation.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+*/
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm8996-pm8994-pmi8994-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 + PMI8994 + PMK8001 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pmk8001-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pmk8001-mtp.dts
new file mode 100644
index 000000000000..a607a11490bc
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8994-pmk8001-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+*
+* This program is free software; you can redistribute it and/or modify
+* it under the terms of the GNU General Public License version 2 and
+* only version 2 as published by the Free Software Foundation.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+*/
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm8996-pm8994-pmi8994-pmk8001.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 + PMI8994 + PMK8001 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8996-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8996-cdp.dts
new file mode 100644
index 000000000000..3188c8718997
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8996-cdp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm-pmi8996.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 + PMI8996 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8996-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8996-mtp.dts
new file mode 100644
index 000000000000..04ac37d5f131
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8996-mtp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm-pmi8996.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 + PMI8996 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8996-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8996-pmk8001-cdp.dts
new file mode 100644
index 000000000000..f772261e6180
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8996-pmk8001-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm8996-pm8994-pmi8996-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 + PM8994 + PMI8996 + PMK8001 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8996-pmk8001-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8996-pmk8001-mtp.dts
new file mode 100644
index 000000000000..16d9af7b5322
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3-pmi8996-pmk8001-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v3.dtsi"
+#include "msm8996-pm8994-pmi8996-pmk8001.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3 + PM8994 + PMI8996 + PMK8001 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3.0-dtp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3.0-dtp.dts
new file mode 100644
index 000000000000..e93baa99c5bd
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3.0-dtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v3.0.dtsi"
+#include "msm8996-dtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM8996 V3.0 DTP";
+	compatible = "qcom,msm8996-dtp", "qcom,msm8996", "qcom,qrd";
+	qcom,board-id= <0x2000b 0>;
+};
+
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3.0-fluid.dts b/arch/arm64/boot/dts/qcom/msm8996-v3.0-fluid.dts
new file mode 100644
index 000000000000..70662b5caea9
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3.0-fluid.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996-v3.0.dtsi"
+#include "msm8996-fluid.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3.0 FLUID";
+	compatible = "qcom,msm8996-fluid", "qcom,msm8996", "qcom,fluid";
+	qcom,board-id = <3 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3.0-liquid.dts b/arch/arm64/boot/dts/qcom/msm8996-v3.0-liquid.dts
new file mode 100644
index 000000000000..2ff6a3c81af6
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3.0-liquid.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996-v3.0.dtsi"
+#include "msm8996-liquid.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3.0 LiQUID";
+	compatible = "qcom,msm8996-liquid", "qcom,msm8996", "qcom,liquid";
+	qcom,board-id = <9 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-cdp.dts
new file mode 100644
index 000000000000..8a28d3b73b49
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996-v3.0.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3.0 + PMI8994 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-mtp.dts
new file mode 100644
index 000000000000..016bd01a0a10
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996-v3.0.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3.0 + PMI8994 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-pm8004-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-pm8004-cdp.dts
new file mode 100644
index 000000000000..3c85372a5371
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-pm8004-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v3.0.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3.0 + PMI8994 + PM8004 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-pm8004-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-pm8004-mtp.dts
new file mode 100644
index 000000000000..b0c5710dda16
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-pm8004-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v3.0.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3.0 + PMI8994 + PM8004 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-pm8004-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-pm8004-pmk8001-cdp.dts
new file mode 100644
index 000000000000..e1800bf79875
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-pm8004-pmk8001-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996-v3.0.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3.0 + PMI8994 + PM8004 + PMK8001 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-pmk8001-cdp.dts
new file mode 100644
index 000000000000..028bab2a5c1a
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8994-pmk8001-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+*
+* This program is free software; you can redistribute it and/or modify
+* it under the terms of the GNU General Public License version 2 and
+* only version 2 as published by the Free Software Foundation.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+*/
+
+/dts-v1/;
+
+#include "msm8996-v3.0.dtsi"
+#include "msm8996-pm8994-pmi8994-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3.0 + PMI8994 + PMK8001 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8996-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8996-cdp.dts
new file mode 100644
index 000000000000..84debfaeed85
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8996-cdp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996-v3.0.dtsi"
+#include "msm-pmi8996.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3.0 + PMI8996 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8996-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8996-mtp.dts
new file mode 100644
index 000000000000..b07aa6163871
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3.0-pmi8996-mtp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996-v3.0.dtsi"
+#include "msm-pmi8996.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3.0 + PMI8996 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3.0.dtsi b/arch/arm64/boot/dts/qcom/msm8996-v3.0.dtsi
new file mode 100644
index 000000000000..99d3c8dcaf48
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3.0.dtsi
@@ -0,0 +1,131 @@
+/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * This file includes msm8996-v3.dtsi and therefore should only contain
+ * overrides on top of that which are specific to 8996v3.0.
+ */
+#include "msm8996-v3.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3.0";
+	qcom,msm-id = <246 0x30000>;
+};
+
+&gfx_cpr {
+	system-supply = <&pm8994_s1_corner>;
+	qcom,cpr-enable;
+
+	/delete-property/ qcom,cpr-aging-ref-voltage;
+};
+
+&gfx_vreg {
+	regulator-min-microvolt = <2>;
+	regulator-max-microvolt = <7>;
+
+	qcom,cpr-fuse-corners = <4>;
+	qcom,cpr-fuse-combos = <8>;
+	qcom,cpr-corners = <7>;
+
+	qcom,cpr-corner-fmax-map = <2 3 5 7>;
+
+	qcom,cpr-voltage-ceiling =
+		<400000  670000  745000  825000  905000
+		 960000 1015000>;
+	qcom,cpr-voltage-floor =
+		<400000  520000  520000  520000  520000
+		 520000  520000>;
+
+	qcom,system-voltage = <2 2 2 2 2 4 4>;
+	qcom,mem-acc-voltage = <1 1 1 2 2 2 2>;
+
+	qcom,corner-frequencies =
+		<0 214000000 315000000 401800000
+		 510000000 560000000 624000000>;
+
+	qcom,cpr-target-quotients =
+	      <   0    0    0    0    0    0    0    0
+		  0    0    0    0    0    0    0    0>,
+	      <   0    0    0    0    0    0  287  273
+		425  426  443  453    0    0    0    0>,
+	      <   0    0    0    0    0    0  414  392
+		584  576  608  612    0    0    0    0>,
+	      <   0    0    0    0    0    0  459  431
+		684  644  692  679    0    0    0    0>,
+	      <   0    0    0    0    0    0  577  543
+		798  768  823  810    0    0    0    0>,
+	      <   0    0    0    0    0    0  669  629
+		886  864  924  911    0    0    0    0>,
+	      <   0    0    0    0    0    0  771  725
+		984  970 1036 1024    0    0    0    0>;
+
+	qcom,cpr-ro-scaling-factor =
+	      <   0    0    0    0    0    0 2035 1917
+	       1959 2131 2246 2253    0    0    0    0>,
+	      <   0    0    0    0    0    0 2035 1917
+	       1959 2131 2246 2253    0    0    0    0>,
+	      <   0    0    0    0    0    0 2035 1917
+	       1959 2131 2246 2253    0    0    0    0>,
+	      <   0    0    0    0    0    0 2035 1917
+	       1959 2131 2246 2253    0    0    0    0>,
+	      <   0    0    0    0    0    0 2035 1917
+	       1959 2131 2246 2253    0    0    0    0>,
+	      <   0    0    0    0    0    0 2035 1917
+	       1959 2131 2246 2253    0    0    0    0>,
+	      <   0    0    0    0    0    0 2035 1917
+	       1959 2131 2246 2253    0    0    0    0>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		<       0        0    30000 (-10000)>,
+		<(-30000) (-30000)        0 (-10000)>,
+		<(-30000) (-30000)        0 (-10000)>,
+		<       0        0        0        0>,
+		<       0        0        0        0>,
+		<       0        0        0        0>,
+		<       0        0        0        0>,
+		<       0        0        0        0>;
+	qcom,cpr-closed-loop-voltage-adjustment =
+		<    0 (-5000) 20000 20000 30000 10000 (-5000)>,
+		<    0 (-5000) 20000 20000 30000 10000 (-5000)>,
+		<    0  60000  40000 40000 45000 25000  35000>,
+		<    0  30000  10000 10000 45000 25000  25000>,
+		<    0  30000  10000 10000 45000 25000  25000>,
+		<    0  30000  10000 10000 45000 25000  25000>,
+		<    0  30000  10000 10000 45000 25000  25000>,
+		<    0  30000  10000 10000 45000 25000  25000>;
+	qcom,cpr-floor-to-ceiling-max-range =
+	       <0 70000 75000 80000 90000 95000 100000>;
+
+	/delete-property/ qcom,cpr-fused-closed-loop-voltage-adjustment-map;
+
+	qcom,allow-voltage-interpolation;
+	qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+
+	/delete-property/ qcom,cpr-aging-max-voltage-adjustment;
+	/delete-property/ qcom,cpr-aging-ref-corner;
+	/delete-property/ qcom,cpr-aging-ro-scaling-factor;
+	/delete-property/ qcom,allow-aging-voltage-adjustment;
+};
+
+&clock_gpu {
+	compatible = "qcom,gpucc-8996-v3.0";
+	qcom,gfx3d_clk_src_v2-opp-handle = <&msm_gpu>;
+	qcom,gfxfreq-speedbin0 =
+		<	   0  0  0 >,
+		<  133000000  3  4 >,
+		<  214000000  3  4 >,
+		<  315000000  3  4 >,
+		<  401800000  4  5 >,
+		<  510000000  5  5 >,
+		<  560000000  6  7 >,
+		<  624000000  7  7 >;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-v3.dtsi b/arch/arm64/boot/dts/qcom/msm8996-v3.dtsi
new file mode 100644
index 000000000000..7e5fa8a495c9
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-v3.dtsi
@@ -0,0 +1,746 @@
+/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only version-specific property overrides should be placed
+ * inside this file. Common device definitions should be placed inside the
+ * msm8996.dtsi file.
+ */
+
+#include "msm8996.dtsi"
+#include "msm8996-coresight-v3.dtsi"
+#include "msm-arm-smmu-impl-defs-8996-v3.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996 v3";
+	qcom,msm-id = <246 0x30001>;
+};
+
+&clock_gcc {
+	compatible = "qcom,gcc-8996-v3";
+};
+
+&clock_debug {
+	compatible = "qcom,cc-debug-8996-v3";
+};
+
+&clock_mmss {
+	compatible = "qcom,mmsscc-8996-v3";
+};
+
+&clock_gpu {
+	compatible = "qcom,gpucc-8996-v3";
+	qcom,gfx3d_clk_src_v2-opp-handle = <&msm_gpu>;
+	qcom,gfxfreq-speedbin0 =
+		<	   0  0  0 >,
+		<  133000000  2  4 >,
+		<  214000000  3  4 >,
+		<  315000000  4  4 >,
+		<  401800000  5  5 >,
+		<  510000000  6  5 >,
+		<  560000000  7  7 >,
+		<  624000000  8  7 >;
+	qcom,gfxfreq-mx-speedbin0 =
+		<	   0  0 >,
+		<  133000000  4 >,
+		<  214000000  4 >,
+		<  315000000  4 >,
+		<  401800000  5 >,
+		<  510000000  5 >,
+		<  560000000  7 >,
+		<  624000000  7 >;
+
+	qcom,gfxfreq-speedbin1 =
+		<	   0  0  0 >,
+		<  133000000  2  4 >,
+		<  214000000  3  4 >,
+		<  315000000  4  4 >,
+		<  401800000  5  5 >,
+		<  510000000  6  5 >;
+	qcom,gfxfreq-mx-speedbin1 =
+		<	   0  0 >,
+		<  133000000  4 >,
+		<  214000000  4 >,
+		<  315000000  4 >,
+		<  401800000  5 >,
+		<  510000000  5 >;
+
+	qcom,gfxfreq-speedbin2 =
+		<          0  0  0 >,
+		<  133000000  2  4 >,
+		<  214000000  3  4 >,
+		<  315000000  4  4 >,
+		<  401800000  5  5 >,
+		<  510000000  6  5 >,
+		<  560000000  7  7 >;
+	qcom,gfxfreq-mx-speedbin2 =
+		<          0  0 >,
+		<  133000000  4 >,
+		<  214000000  4 >,
+		<  315000000  4 >,
+		<  401800000  5 >,
+		<  510000000  5 >,
+		<  560000000  7 >;
+};
+
+&gdsc_gpu_gx {
+	clock-names = "core_clk", "core_root_clk";
+	clocks = <&clock_gpu clk_gpu_gx_gfx3d_clk>,
+		 <&clock_gpu clk_gfx3d_clk_src_v2>;
+};
+
+&pcie0 {
+	qcom,pcie-phy-ver = <3>;
+};
+
+&pcie1 {
+	qcom,pcie-phy-ver = <3>;
+};
+
+&pcie2 {
+	qcom,pcie-phy-ver = <3>;
+};
+
+/* GPU overrides */
+&msm_gpu {
+	/* Updated chip ID */
+	qcom,chipid = <0x05030002>;
+
+	qcom,bus-width = <32>;
+	qcom,gpu-speed-bin = <0x4130 0xe0000000 29>;
+
+	/* Quirks */
+	qcom,gpu-quirk-two-pass-use-wfi;
+	qcom,gpu-quirk-critical-packets;
+	qcom,gpu-quirk-fault-detect-mask;
+
+	qcom,gpu-pwrlevel-bins {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		compatible="qcom,gpu-pwrlevel-bins";
+
+		qcom,gpu-pwrlevels-0 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,speed-bin = <0>;
+
+			qcom,initial-pwrlevel = <5>;
+
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <624000000>;
+				qcom,bus-freq = <12>;
+				qcom,bus-min = <11>;
+				qcom,bus-max = <12>;
+			};
+
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <560000000>;
+				qcom,bus-freq = <11>;
+				qcom,bus-min = <9>;
+				qcom,bus-max = <12>;
+			};
+
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <510000000>;
+				qcom,bus-freq = <9>;
+				qcom,bus-min = <8>;
+				qcom,bus-max = <11>;
+			};
+
+			qcom,gpu-pwrlevel@3 {
+				reg = <3>;
+				qcom,gpu-freq = <401800000>;
+				qcom,bus-freq = <8>;
+				qcom,bus-min = <7>;
+				qcom,bus-max = <9>;
+			};
+
+			qcom,gpu-pwrlevel@4 {
+				reg = <4>;
+				qcom,gpu-freq = <315000000>;
+				qcom,bus-freq = <6>;
+				qcom,bus-min = <5>;
+				qcom,bus-max = <7>;
+			};
+
+			qcom,gpu-pwrlevel@5 {
+				reg = <5>;
+				qcom,gpu-freq = <214000000>;
+				qcom,bus-freq = <4>;
+				qcom,bus-min = <3>;
+				qcom,bus-max = <5>;
+			};
+
+			qcom,gpu-pwrlevel@6 {
+				reg = <6>;
+				qcom,gpu-freq = <133000000>;
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <2>;
+				qcom,bus-max = <4>;
+			};
+
+			qcom,gpu-pwrlevel@7 {
+				reg = <7>;
+				qcom,gpu-freq = <27000000>;
+				qcom,bus-freq = <0>;
+				qcom,bus-min = <0>;
+				qcom,bus-max = <0>;
+			};
+		};
+
+		qcom,gpu-pwrlevels-1 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,speed-bin = <1>;
+
+			qcom,initial-pwrlevel = <3>;
+
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <510000000>;
+				qcom,bus-freq = <9>;
+				qcom,bus-min = <8>;
+				qcom,bus-max = <10>;
+			};
+
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <401800000>;
+				qcom,bus-freq = <8>;
+				qcom,bus-min = <7>;
+				qcom,bus-max = <9>;
+			};
+
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <315000000>;
+				qcom,bus-freq = <6>;
+				qcom,bus-min = <5>;
+				qcom,bus-max = <7>;
+			};
+
+			qcom,gpu-pwrlevel@3 {
+				reg = <3>;
+				qcom,gpu-freq = <214000000>;
+				qcom,bus-freq = <4>;
+				qcom,bus-min = <3>;
+				qcom,bus-max = <5>;
+			};
+
+			qcom,gpu-pwrlevel@4 {
+				reg = <4>;
+				qcom,gpu-freq = <133000000>;
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <2>;
+				qcom,bus-max = <4>;
+			};
+
+			qcom,gpu-pwrlevel@5 {
+				reg = <5>;
+				qcom,gpu-freq = <27000000>;
+				qcom,bus-freq = <0>;
+				qcom,bus-min = <0>;
+				qcom,bus-max = <0>;
+			};
+		};
+
+	};
+};
+
+&soc {
+	l2-pmu {
+		compatible = "qcom,qcom-l2cache-pmu";
+		interrupts = <0 0 1>, <0 8 1>;
+		qcom,cpu-affinity = <0>, <2>;
+	};
+};
+
+&soc {
+	jtag_mm0: jtagmm@3840000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x3840000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU0>;
+	};
+
+	jtag_mm1: jtagmm@3940000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x3940000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU1>;
+	};
+
+	jtag_mm2: jtagmm@3a40000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x3a40000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU2>;
+	};
+
+	jtag_mm3: jtagmm@3b40000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x3b40000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU3>;
+	};
+};
+
+&mdss_hdmi_pll {
+	compatible = "qcom,mdss_hdmi_pll_8996_v3";
+};
+
+&msm_vidc {
+	/* Table lists <video_core_freq imem_ab> pairs.
+	 * imem_ab value determines the imem clock frequency for the
+	 * corresponding video core frequency.
+	 */
+	qcom,imem-ab-tbl =
+		<75000000  1500000>, /* imem @ svs2 freq 75 Mhz */
+		<150000000 1500000>, /* imem @ svs2 freq 75 Mhz */
+		<346666667 2500000>, /* imem @ svs freq 171 Mhz */
+		<520000000 6000000>; /* imem @ noimal freq 320 Mhz */
+
+	qcom,load-freq-tbl =
+			/* Encoders */
+			<972000 520000000 0x55555555>, /* 4k UHD @ 30 */
+			<489600 346666667 0x55555555>, /* 1080p @ 60 */
+			<244800 150000000 0x55555555>, /* 1080p @ 30 */
+			<108000  75000000 0x55555555>, /* 720p @ 30 */
+
+			/* Decoders */
+			<1944000 520000000 0xffffffff>, /* 4k UHD @ 60 */
+			< 972000 346666667 0xffffffff>, /* 4k UHD @ 30 */
+			< 489600 150000000 0xffffffff>, /* 1080p @ 60 */
+			< 244800  75000000 0xffffffff>; /* 1080p @ 30 */
+	qcom,pm-qos-latency-us = <501>;
+};
+
+&gdsc_venus_core0 {
+	qcom,support-hw-trigger;
+};
+
+&gdsc_venus_core1 {
+	qcom,support-hw-trigger;
+};
+
+&soc {
+	ipa_hw: qcom,ipa@680000 {
+		compatible = "qcom,ipa";
+		reg = <0x680000 0x4effc>,
+			<0x684000 0x26934>;
+		reg-names = "ipa-base", "bam-base";
+		interrupts = <0 333 0>,
+					<0 432 0>;
+		interrupt-names = "ipa-irq", "bam-irq";
+		qcom,ipa-hw-ver = <5>; /* IPA core version = IPAv2.5 */
+		qcom,ipa-hw-mode = <0>;
+		qcom,ee = <0>;
+		qcom,use-ipa-tethering-bridge;
+		qcom,ipa-bam-remote-mode;
+		qcom,modem-cfg-emb-pipe-flt;
+		clocks = <&clock_gcc clk_ipa_clk>;
+		clock-names = "core_clk";
+		qcom,use-dma-zone;
+		qcom,msm-bus,name = "ipa";
+		qcom,msm-bus,num-cases = <3>;
+		qcom,msm-bus,num-paths = <2>;
+		qcom,msm-bus,vectors-KBps =
+		<90 512 0 0>, <90 585 0 0>,         /* No vote */
+		<90 512 80000 640000>, <90 585 80000 640000>,    /* SVS */
+		<90 512 206000 960000>, <90 585 206000 960000>;    /* PERF */
+		qcom,bus-vector-names = "MIN", "SVS", "PERF";
+	};
+
+	qcom,m4m-hwmon@6530000 {
+		compatible = "qcom,m4m-hwmon";
+		reg = <0x6530000 0x160>;
+		interrupts = <0 19 4>;
+		qcom,counter-event-sel = <4 0x8000>,
+					 <5 0x4000>;
+		qcom,target-dev = <&m4m_cache>;
+	};
+
+};
+
+&clock_cpu {
+		compatible = "qcom,cpu-clock-8996-v3";
+		/* Nominal FMAXes only until characterization completes. */
+		qcom,pwrcl-speedbin0-v0 =
+			<          0  0 >,
+			<  307200000  1 >,
+			<  422400000  2 >,
+			<  480000000  3 >,
+			<  556800000  4 >,
+			<  652800000  5 >,
+			<  729600000  6 >,
+			<  844800000  7 >,
+			<  960000000  8 >,
+			< 1036800000  9 >,
+			< 1113600000 10 >,
+			< 1190400000 11 >,
+			< 1228800000 12 >,
+			< 1324800000 13 >,
+			< 1401600000 14 >,
+			< 1478400000 15 >,
+			< 1593600000 16 >;
+		qcom,pwrcl-speedbin1-v0 =
+			<          0  0 >,
+			<  307200000  1 >,
+			<  422400000  2 >,
+			<  480000000  3 >,
+			<  556800000  4 >,
+			<  652800000  5 >,
+			<  729600000  6 >,
+			<  844800000  7 >,
+			<  960000000  8 >,
+			< 1036800000  9 >,
+			< 1113600000 10 >,
+			< 1190400000 11 >,
+			< 1228800000 12 >,
+			< 1363200000 13 >;
+		qcom,pwrcl-speedbin2-v0 =
+			<          0  0 >,
+			<  307200000  1 >,
+			<  422400000  2 >,
+			<  480000000  3 >,
+			<  556800000  4 >,
+			<  652800000  5 >,
+			<  729600000  6 >,
+			<  844800000  7 >,
+			<  960000000  8 >,
+			< 1036800000  9 >,
+			< 1113600000 10 >,
+			< 1190400000 11 >,
+			< 1228800000 12 >,
+			< 1324800000 13 >,
+			< 1401600000 14 >,
+			< 1497600000 15 >;
+		qcom,perfcl-speedbin0-v0 =
+			<          0  0 >,
+			<  307200000  1 >,
+			<  403200000  2 >,
+			<  480000000  3 >,
+			<  556800000  4 >,
+			<  652800000  5 >,
+			<  729600000  6 >,
+			<  806400000  7 >,
+			<  883200000  8 >,
+			<  940800000  9 >,
+			< 1036800000 10 >,
+			< 1113600000 11 >,
+			< 1190400000 12 >,
+			< 1248000000 13 >,
+			< 1324800000 14 >,
+			< 1401600000 15 >,
+			< 1478400000 16 >,
+			< 1555200000 17 >,
+			< 1632000000 18 >,
+			< 1708800000 19 >,
+			< 1785600000 20 >,
+			< 1824000000 21 >,
+			< 1920000000 22 >,
+			< 1996800000 23 >,
+			< 2073600000 24 >,
+			< 2150400000 25 >;
+		qcom,perfcl-speedbin1-v0 =
+			<          0  0 >,
+			<  307200000  1 >,
+			<  403200000  2 >,
+			<  480000000  3 >,
+			<  556800000  4 >,
+			<  652800000  5 >,
+			<  729600000  6 >,
+			<  806400000  7 >,
+			<  883200000  8 >,
+			<  940800000  9 >,
+			< 1036800000 10 >,
+			< 1113600000 11 >,
+			< 1190400000 12 >,
+			< 1248000000 13 >,
+			< 1324800000 14 >,
+			< 1401600000 15 >,
+			< 1478400000 16 >,
+			< 1555200000 17 >,
+			< 1632000000 18 >,
+			< 1708800000 19 >,
+			< 1785600000 20 >,
+			< 1804800000 21 >;
+		qcom,perfcl-speedbin2-v0 =
+			<          0  0 >,
+			<  307200000  1 >,
+			<  403200000  2 >,
+			<  480000000  3 >,
+			<  556800000  4 >,
+			<  652800000  5 >,
+			<  729600000  6 >,
+			<  806400000  7 >,
+			<  883200000  8 >,
+			<  940800000  9 >,
+			< 1036800000 10 >,
+			< 1113600000 11 >,
+			< 1190400000 12 >,
+			< 1248000000 13 >,
+			< 1324800000 14 >,
+			< 1401600000 15 >,
+			< 1478400000 16 >,
+			< 1555200000 17 >,
+			< 1632000000 18 >,
+			< 1708800000 19 >,
+			< 1785600000 20 >,
+			< 1804800000 21 >,
+			< 1900800000 22 >;
+		qcom,cbf-speedbin0-v0 =
+			<	   0  0 >,
+			<  307200000  1 >,
+			<  384000000  2 >,
+			<  460800000  3 >,
+			<  537600000  4 >,
+			<  595200000  5 >,
+			<  672000000  6 >,
+			<  748800000  7 >,
+			<  825600000  8 >,
+			<  902400000  9 >,
+			<  979200000 10 >,
+			< 1056000000 11 >,
+			< 1132800000 12 >,
+			< 1190400000 13 >,
+			< 1228800000 14 >,
+			< 1305600000 15 >,
+			< 1382400000 16 >,
+			< 1459200000 17 >,
+			< 1536000000 18 >,
+			< 1593600000 19 >;
+		qcom,cbf-speedbin1-v0 =
+			<	   0  0 >,
+			<  307200000  1 >,
+			<  384000000  2 >,
+			<  460800000  3 >,
+			<  537600000  4 >,
+			<  595200000  5 >,
+			<  672000000  6 >,
+			<  748800000  7 >,
+			<  825600000  8 >,
+			<  902400000  9 >,
+			<  979200000 10 >,
+			< 1056000000 11 >,
+			< 1132800000 12 >,
+			< 1190400000 13 >,
+			< 1228800000 14 >,
+			< 1305600000 15 >;
+		qcom,cbf-speedbin2-v0 =
+			<          0  0 >,
+			<  307200000  1 >,
+			<  384000000  2 >,
+			<  460800000  3 >,
+			<  537600000  4 >,
+			<  595200000  5 >,
+			<  672000000  6 >,
+			<  748800000  7 >,
+			<  825600000  8 >,
+			<  902400000  9 >,
+			<  979200000 10 >,
+			< 1056000000 11 >,
+			< 1132800000 12 >,
+			< 1190400000 13 >,
+			< 1228800000 14 >,
+			< 1305600000 15 >;
+};
+
+&msm_cpufreq {
+	qcom,cpufreq-table-0 =
+		<  307200 >,
+		<  422400 >,
+		<  480000 >,
+		<  556800 >,
+		<  652800 >,
+		<  729600 >,
+		<  844800 >,
+		<  960000 >,
+		< 1036800 >,
+		< 1113600 >,
+		< 1190400 >,
+		< 1228800 >,
+		< 1324800 >,
+		< 1401600 >,
+		< 1478400 >,
+		< 1593600 >;
+	qcom,cpufreq-table-2 =
+		<  307200 >,
+		<  403200 >,
+		<  480000 >,
+		<  556800 >,
+		<  652800 >,
+		<  729600 >,
+		<  806400 >,
+		<  883200 >,
+		<  940800 >,
+		< 1036800 >,
+		< 1113600 >,
+		< 1190400 >,
+		< 1248000 >,
+		< 1324800 >,
+		< 1401600 >,
+		< 1478400 >,
+		< 1555200 >,
+		< 1632000 >,
+		< 1708800 >,
+		< 1785600 >,
+		< 1824000 >,
+		< 1920000 >,
+		< 1996800 >,
+		< 2073600 >,
+		< 2150400 >;
+};
+
+&m4m_cache {
+	freq-tbl-khz =
+		<  307200 >,
+		<  384000 >,
+		<  460800 >,
+		<  537600 >,
+		<  595200 >,
+		<  672000 >,
+		<  748800 >,
+		<  825600 >,
+		<  902400 >,
+		<  979200 >,
+		< 1056000 >,
+		< 1132800 >,
+		< 1190400 >,
+		< 1228800 >,
+		< 1305600 >,
+		< 1382400 >,
+		< 1459200 >,
+		< 1536000 >,
+		< 1593600 >;
+};
+
+&devfreq_cpufreq {
+	m4m-cpufreq {
+		cpu-to-dev-map-0 =
+			<  307200   307200 >,
+			<  422400   307200 >,
+			<  480000   307200 >,
+			<  556800   307200 >,
+			<  652800   384000 >,
+			<  729600   460800 >,
+			<  844800   537600 >,
+			<  960000   672000 >,
+			< 1036800   672000 >,
+			< 1113600   825600 >,
+			< 1190400   825600 >,
+			< 1228800   902400 >,
+			< 1324800  1056000 >,
+			< 1401600  1132800 >,
+			< 1478400  1190400 >,
+			< 1593600  1382400 >;
+		cpu-to-dev-map-2 =
+			<  480000  307200 >,
+			<  556800  307200 >,
+			<  652800  307200 >,
+			<  729600  307200 >,
+			<  806400  384000 >,
+			<  883200  460800 >,
+			<  940800  537600 >,
+			< 1036800  595200 >,
+			< 1113600  672000 >,
+			< 1190400  672000 >,
+			< 1248000  748800 >,
+			< 1324800  825600 >,
+			< 1401600  902400 >,
+			< 1478400  979200 >,
+			< 1555200 1056000 >,
+			< 1632000 1190400 >,
+			< 1708800 1228800 >,
+			< 1785600 1305600 >,
+			< 1824000 1382400 >,
+			< 1920000 1459200 >,
+			< 1996800 1593600 >,
+			< 2073600 1593600 >,
+			< 2150400 1593600 >;
+	};
+
+	mincpubw-cpufreq {
+		cpu-to-dev-map-0 =
+			< 1593600 1525 >;
+		cpu-to-dev-map-2 =
+			< 2073600 1525 >,
+			< 2150400 5195 >;
+	};
+};
+
+&soc {
+	tsens1: tsens@4ad000 {
+		compatible = "qcom,msm8996-tsens";
+		reg = <0x4ac000 0x2000>,
+			<0x75230 0x1000>;
+		reg-names = "tsens_physical", "tsens_eeprom_physical";
+		interrupts = <0 184 0>, <0 430 0>;
+		interrupt-names = "tsens-upper-lower", "tsens-critical";
+		qcom,client-id = <13 14 15 16 17 18 19 20>;
+		qcom,sensor-id = <1 6 7 0 2 3 4 5>;
+		qcom,sensors = <8>;
+		qcom,slope = <2901 2846 3200 3200 3200 3200 3200 3200>;
+	};
+	lmh: qcom,lmh {
+		vdd-apss-supply = <&pm8994_s11>;
+		qcom,lmh-odcm-disable-threshold-mA = <850>;
+	};
+	qcom,msm-thermal {
+		msm_thermal_freq: qcom,vdd-apps-rstr{
+			qcom,max-freq-level = <1190400>;
+			qcom,levels = <1036800 1555200 1555200>;
+		};
+		qcom,vdd-gfx-rstr{
+			qcom,levels = <6 8 8>; /* Nominal, Turbo, Turbo */
+		};
+	};
+
+};
+
+&tsens0 {
+	interrupts = <0 458 0>, <0 445 0>;
+	qcom,sensors = <13>;
+	qcom,slope = <2901 2846 3200 3200 3200 3200 3200 3200 3200
+						3200 3200 3200 3200>;
+};
+
+/* cpu pmu override */
+&cpu_pmu {
+	compatible = "qcom,kryo-pmuv3";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-vidc.dtsi b/arch/arm64/boot/dts/qcom/msm8996-vidc.dtsi
new file mode 100644
index 000000000000..21aa1db446e2
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-vidc.dtsi
@@ -0,0 +1,240 @@
+/* Copyright (c) 2014-2015, 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+&soc {
+	msm_vidc: qcom,vidc@c00000 {
+		compatible = "qcom,msm-vidc";
+		status = "ok";
+		reg = <0xC00000 0xff000>;
+		interrupts = <GIC_SPI 287 IRQ_TYPE_LEVEL_HIGH>;
+		qcom,hfi = "venus";
+		qcom,hfi-version = "3xx";
+		qcom,reg-presets = <0x80010 0xffffffff>,
+			<0x80018 0x00001556>,
+			<0x8001C 0x00001556>;
+		qcom,qdss-presets = <0x08180000 0x2000>,
+			<0x08182000 0x2000>,
+			<0x08184000 0x2000>,
+			<0x08186000 0x2000>,
+			<0x08188000 0x2000>,
+			<0x0818A000 0x2000>,
+			<0x0818C000 0x2000>,
+			<0x0818E000 0x2000>;
+		qcom,max-hw-load = <2563200>; /* Full 4k @ 60 + 1080p @ 60 */
+		qcom,power-conf = <8294400>; /* WxH - 3840*2160 */
+		qcom,firmware-name = "venus";
+		qcom,imem-size = <524288>; /* 512 kB */
+		qcom,never-unload-fw;
+		qcom,sw-power-collapse;
+		qcom,max-secure-instances = <5>;
+		qcom,load-freq-tbl =
+			/* Encoders */
+			<972000 490000000 0x55555555>, /* 4k UHD @ 30 */
+			<489600 320000000 0x55555555>, /* 1080p @ 60 */
+			<244800 150000000 0x55555555>, /* 1080p @ 30 */
+			<108000  75000000 0x55555555>, /* 720p @ 30 */
+
+			/* Decoders */
+			<1944000 490000000 0xffffffff>, /* 4k UHD @ 60 */
+			< 972000 320000000 0xffffffff>, /* 4k UHD @ 30 */
+			< 489600 150000000 0xffffffff>, /* 1080p @ 60 */
+			< 244800  75000000 0xffffffff>; /* 1080p @ 30 */
+
+		qcom,dcvs-tbl =
+			<972000 972000 19944000 0x3f00000c>, /* UHD 30 */
+			<489600 489600   972000 0x3f00000c>, /* 1080p 60 */
+			<244800 244800   489600 0x3f00000c>, /* 1080p 30 */
+			<829440 489600   972000 0x04000004>; /* DCI 24 */
+
+		qcom,dcvs-limit =
+			<32400 30>, /* Encoder UHD */
+			<14400 30>; /* Decoder WQHD */
+
+		/* Table lists <video_core_freq imem_ab> pairs.
+		 * imem_ab value determines the imem clock frequency for the
+		 * corresponding video core frequency.
+		 */
+		qcom,imem-ab-tbl =
+			<75000000  1500000>, /* imem @ svs2 freq 75 Mhz */
+			<150000000 1500000>, /* imem @ svs2 freq 75 Mhz */
+			<320000000 2500000>, /* imem @ svs freq 171 Mhz */
+			<490000000 6000000>; /* imem @ noimal freq 320 Mhz */
+
+		/* Regulators */
+		/* Note: don't change the order of the regulators below as they
+		 * correspond to the order in which the driver enables them.
+		 */
+		mmagic-venus-supply = <&gdsc_mmagic_video>;
+		venus-supply = <&gdsc_venus>;
+		venus-core0-supply = <&gdsc_venus_core0>;
+		venus-core1-supply = <&gdsc_venus_core1>;
+
+		/* Clocks */
+		clock-names = "smmu_ahb_clk", "smmu_axi_clk",
+			"mmagic_video_axi", "core_clk", "iface_clk",
+			"bus_clk", "maxi_clk", "core0_clk", "core1_clk";
+		clocks = <&clock_mmss clk_smmu_video_ahb_clk>,
+		       <&clock_mmss clk_smmu_video_axi_clk>,
+		       <&clock_mmss clk_mmagic_video_axi_clk>,
+		       <&clock_mmss clk_video_core_clk>,
+		       <&clock_mmss clk_video_ahb_clk>,
+		       <&clock_mmss clk_video_axi_clk>,
+		       <&clock_mmss clk_video_maxi_clk>,
+		       <&clock_mmss clk_video_subcore0_clk>,
+		       <&clock_mmss clk_video_subcore1_clk>;
+		qcom,clock-configs = <0x0 0x0 0x0 0x1 0x0 0x0 0x0 0x1 0x1>;
+
+		/* Buses */
+		bus_cnoc {
+			compatible = "qcom,msm-vidc,bus";
+			label = "cnoc";
+			qcom,bus-master = <MSM_BUS_MASTER_AMPSS_M0>;
+			qcom,bus-slave = <MSM_BUS_SLAVE_VENUS_CFG>;
+			qcom,bus-governor = "performance";
+			qcom,bus-range-kbps = <1 1>;
+		};
+
+		venus_bus_ddr {
+			compatible = "qcom,msm-vidc,bus";
+			label = "venus-ddr";
+			qcom,bus-master = <MSM_BUS_MASTER_VIDEO_P0>;
+			qcom,bus-slave = <MSM_BUS_SLAVE_EBI_CH0>;
+			qcom,bus-governor = "msm-vidc-ddr";
+			qcom,bus-range-kbps = <1000 3388000>;
+		};
+
+		venus_bus_vmem {
+			compatible = "qcom,msm-vidc,bus";
+			label = "venus-vmem";
+			qcom,bus-master = <MSM_BUS_MASTER_VIDEO_P0_OCMEM>;
+			qcom,bus-slave = <MSM_BUS_SLAVE_VMEM>;
+			qcom,bus-governor = "msm-vidc-vmem+";
+			qcom,bus-range-kbps = <1000 6776000>;
+		};
+
+		arm9_bus_ddr {
+			compatible = "qcom,msm-vidc,bus";
+			label = "venus-arm9-ddr";
+			qcom,bus-master = <MSM_BUS_MASTER_VIDEO_P0>;
+			qcom,bus-slave = <MSM_BUS_SLAVE_EBI_CH0>;
+			qcom,bus-governor = "performance";
+			qcom,bus-range-kbps = <1 1>;
+		};
+
+		/* MMUs */
+		non_secure_cb {
+			compatible = "qcom,msm-vidc,context-bank";
+			label = "venus_ns";
+			iommus = <&venus_smmu 0x00>,
+				<&venus_smmu 0x01>,
+				<&venus_smmu 0x0a>,
+				<&venus_smmu 0x07>,
+				<&venus_smmu 0x0e>,
+				<&venus_smmu 0x0f>,
+				<&venus_smmu 0x08>,
+				<&venus_smmu 0x09>,
+				<&venus_smmu 0x0b>,
+				<&venus_smmu 0x0c>,
+				<&venus_smmu 0x0d>,
+				<&venus_smmu 0x10>,
+				<&venus_smmu 0x11>,
+				<&venus_smmu 0x21>,
+				<&venus_smmu 0x28>,
+				<&venus_smmu 0x29>,
+				<&venus_smmu 0x2b>,
+				<&venus_smmu 0x2c>,
+				<&venus_smmu 0x2d>,
+				<&venus_smmu 0x31>;
+			buffer-types = <0xfff>;
+			virtual-addr-pool = <0x70800000 0x8F800000>;
+		};
+
+		firmware_cb {
+			compatible = "qcom,msm-vidc,context-bank";
+			qcom,fw-context-bank;
+			iommus = <&venus_smmu 0x180>,
+				<&venus_smmu 0x186>;
+		};
+
+		secure_bitstream_cb {
+			compatible = "qcom,msm-vidc,context-bank";
+			label = "venus_sec_bitstream";
+			iommus = <&venus_smmu 0x100>,
+				<&venus_smmu 0x102>,
+				<&venus_smmu 0x109>,
+				<&venus_smmu 0x10a>,
+				<&venus_smmu 0x10b>,
+				<&venus_smmu 0x10e>,
+				<&venus_smmu 0x126>,
+				<&venus_smmu 0x129>,
+				<&venus_smmu 0x12b>;
+			buffer-types = <0x241>;
+			virtual-addr-pool = <0x4b000000 0x25800000>;
+			qcom,secure-context-bank;
+		};
+
+		venus_secure_pixel_cb: secure_pixel_cb {
+			compatible = "qcom,msm-vidc,context-bank";
+			label = "venus_sec_pixel";
+			iommus = <&venus_smmu 0x104>,
+				<&venus_smmu 0x10c>,
+				<&venus_smmu 0x110>,
+				<&venus_smmu 0x12c>;
+			buffer-types = <0x106>;
+			virtual-addr-pool = <0x25800000 0x25800000>;
+			qcom,secure-context-bank;
+		};
+
+		venus_secure_non_pixel_cb: secure_non_pixel_cb {
+			compatible = "qcom,msm-vidc,context-bank";
+			label = "venus_sec_non_pixel";
+			iommus = <&venus_smmu 0x105>,
+				<&venus_smmu 0x107>,
+				<&venus_smmu 0x108>,
+				<&venus_smmu 0x10d>,
+				<&venus_smmu 0x10f>,
+				<&venus_smmu 0x125>,
+				<&venus_smmu 0x128>,
+				<&venus_smmu 0x12d>,
+				<&venus_smmu 0x140>;
+			buffer-types = <0x480>;
+			virtual-addr-pool = <0x1000000 0x24800000>;
+			qcom,secure-context-bank;
+		};
+	};
+
+	vmem: qcom,vmem@880000 {
+		compatible = "qcom,msm-vmem";
+		interrupts = <GIC_SPI 429 IRQ_TYPE_LEVEL_HIGH>;
+
+		reg = <0x880000 0x800>,
+		    <0x6800000 0x80000>;
+		reg-names = "reg-base", "mem-base";
+
+		vdd-supply = <&gdsc_mmagic_video>;
+		clocks = <&clock_mmss clk_vmem_ahb_clk>,
+		       <&clock_mmss clk_vmem_maxi_clk>;
+		clock-names = "ahb", "maxi";
+		clock-config = <0x0 0x0 0x0 0x1>;
+
+		qcom,msm-bus,name = "vmem";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+		<MSM_BUS_MASTER_AMPSS_M0 MSM_BUS_SLAVE_VMEM_CFG   0   0>,
+		<MSM_BUS_MASTER_AMPSS_M0 MSM_BUS_SLAVE_VMEM_CFG 500 800>;
+
+		qcom,bank-size = <131072>; /* 128 kB */
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996-wsa881x.dtsi b/arch/arm64/boot/dts/qcom/msm8996-wsa881x.dtsi
new file mode 100644
index 000000000000..6a800f853d2c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996-wsa881x.dtsi
@@ -0,0 +1,45 @@
+/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&slim_msm {
+	tasha_codec {
+		swr_master {
+			compatible = "qcom,swr-wcd";
+			#address-cells = <2>;
+			#size-cells = <0>;
+
+			wsa881x_211: wsa881x@20170211 {
+				compatible = "qcom,wsa881x";
+				reg = <0x00 0x20170211>;
+				qcom,spkr-sd-n-gpio = <&pmi8994_gpios 2 0>;
+			};
+
+			wsa881x_212: wsa881x@20170212 {
+				compatible = "qcom,wsa881x";
+				reg = <0x00 0x20170212>;
+				qcom,spkr-sd-n-gpio = <&pmi8994_gpios 3 0>;
+			};
+
+			wsa881x_213: wsa881x@21170213 {
+				compatible = "qcom,wsa881x";
+				reg = <0x00 0x21170213>;
+				qcom,spkr-sd-n-gpio = <&pmi8994_gpios 2 0>;
+			};
+
+			wsa881x_214: wsa881x@21170214 {
+				compatible = "qcom,wsa881x";
+				reg = <0x00 0x21170214>;
+				qcom,spkr-sd-n-gpio = <&pmi8994_gpios 3 0>;
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
new file mode 100644
index 000000000000..f5e059484c95
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
@@ -0,0 +1,4096 @@
+/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "skeleton64.dtsi"
+#include <dt-bindings/clock/msm-clocks-8996.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996";
+	compatible = "qcom,msm8996";
+	qcom,msm-id = <246 0x0>;
+	qcom,pmic-id = <0x20009 0x2000A 0x0 0x0>;
+	interrupt-parent = <&intc>;
+
+	chosen {
+		bootargs = "fpsimd.fpsimd_settings=1 app_setting.use_app_setting=1 app_setting.use_32bit_app_setting=1";
+	};
+
+	aliases {
+		sdhc1 = &sdhc_1; /* SDC1 eMMC slot */
+		sdhc2 = &sdhc_2; /* SDC2 SD card slot */
+		smd7 = &smdtty_data1;
+		smd8 = &smdtty_data4;
+		smd11 = &smdtty_data11;
+		smd21 = &smdtty_data21;
+		smd36 = &smdtty_loopback;
+		pci-domain0 = &pcie0;
+		pci-domain1 = &pcie1;
+		pci-domain2 = &pcie2;
+		i2c6 = &i2c_6;
+		i2c7 = &i2c_7;
+		i2c8 = &i2c_8;
+		i2c12 = &i2c_12;
+		spi0 = &spi_0;
+		serial0 = &uartblsp2dm1;
+	};
+
+	chosen {
+		stdout-path = "serial0";
+		bootargs = "sched_enable_hmp=1 sched_enable_power_aware=1 rcupdate.rcu_expedited=1";
+	};
+
+	psci {
+		compatible = "arm,psci-1.0";
+		method = "smc";
+	};
+
+	cpus {
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		CPU0: cpu@0 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x0>;
+			qcom,limits-info = <&mitigation_profile0>;
+			enable-method = "psci";
+			qcom,ea = <&ea0>;
+			next-level-cache = <&L2_0>;
+			L2_0: l2-cache {
+			      compatible = "cache";
+			      cache-level = <2>;
+			      qcom,dump-size = <0x88000>;
+			};
+			L1_D_0: l1-dcache {
+				compatible = "cache";
+				qcom,dump-size = <0x7800>;
+			};
+			L1_TLB_0: l1-tlb {
+				qcom,dump-size = <0x2800>;
+			};
+		};
+
+		CPU1: cpu@1 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x1>;
+			qcom,limits-info = <&mitigation_profile1>;
+			enable-method = "psci";
+			qcom,ea = <&ea1>;
+			next-level-cache = <&L2_0>;
+			L1_D_1: l1-dcache {
+				compatible = "cache";
+				qcom,dump-size = <0x7800>;
+			};
+			L1_TLB_1: l1-tlb {
+				qcom,dump-size = <0x2800>;
+			};
+		};
+
+		CPU2: cpu@100 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x100>;
+			qcom,limits-info = <&mitigation_profile2>;
+			enable-method = "psci";
+			qcom,ea = <&ea2>;
+			next-level-cache = <&L2_1>;
+			L2_1: l2-cache {
+			      compatible = "cache";
+			      cache-level = <2>;
+			      qcom,dump-size = <0x110000>;
+			};
+			L1_D_100: l1-dcache {
+				compatible = "cache";
+				qcom,dump-size = <0x7800>;
+			};
+			L1_TLB_100: l1-tlb {
+				qcom,dump-size = <0x2800>;
+			};
+		};
+
+		CPU3: cpu@101 {
+			device_type = "cpu";
+			compatible = "qcom,kryo";
+			reg = <0x0 0x101>;
+			enable-method = "psci";
+			qcom,limits-info = <&mitigation_profile3>;
+			qcom,ea = <&ea3>;
+			next-level-cache = <&L2_1>;
+			L1_D_101: l1-dcache {
+				compatible = "cache";
+				qcom,dump-size = <0x7800>;
+			};
+			L1_TLB_101: l1-tlb {
+				qcom,dump-size = <0x2800>;
+			};
+		};
+
+		cpu-map {
+			cluster0 {
+				core0 {
+					cpu = <&CPU0>;
+				};
+
+				core1 {
+					cpu = <&CPU1>;
+				};
+			};
+
+			cluster1 {
+				core0 {
+					cpu = <&CPU2>;
+				};
+
+				core1 {
+					cpu = <&CPU3>;
+				};
+			};
+		};
+	};
+
+       clocks {
+               xo_board {
+                       compatible = "fixed-clock";
+                       #clock-cells = <0>;
+                       clock-frequency = <19200000>;
+                       clock-output-names = "xo_board";
+		};
+               sleep_clk {
+                       compatible = "fixed-clock";
+                       #clock-cells = <0>;
+                       clock-frequency = <32764>;
+                       clock-output-names = "sleep_clk";
+		};
+	};
+
+	soc: soc { };
+
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		removed_regions: removed_regions@85800000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0 0x85800000 0 0x3000000>;
+		};
+
+		peripheral_mem: peripheral_region@8ea00000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0 0x8ea00000 0 0x2b00000>;
+		};
+
+		adsp_mem: adsp_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0 0x00000000 0 0xffffffff>;
+			reusable;
+			alignment = <0 0x100000>;
+			size = <0 0x400000>;
+		};
+
+		qseecom_mem: qseecom_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0 0x00000000 0 0xffffffff>;
+			reusable;
+			alignment = <0 0x400000>;
+			size = <0 0x1400000>;
+		};
+
+		secure_display_memory: secure_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0 0x00000000 0 0xffffffff>;
+			reusable;
+			alignment = <0 0x200000>;
+			size = <0 0x5c00000>;
+		};
+
+		modem_mem: modem_region@88800000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0 0x88800000 0 0x6200000>;
+		};
+
+		dfps_data_mem: dfps_data_mem@83400000 {
+		       reg = <0 0x83400000 0 0x1000>;
+		       label = "dfps_data_mem";
+		};
+
+		cont_splash_mem: cont_splash_mem@83401000 {
+			reg = <0 0x83401000 0 0x23FF000>;
+			label = "cont_splash_mem";
+		};
+
+		cont_splash_mem_hdmi: cont_splash_mem_hdmi@b1c00000 {
+			reg = <0 0xb1c00000 0 0x23ff000>;
+			label = "cont_splash_mem_hdmi";
+		};
+	};
+};
+
+#include "msm8996-ion.dtsi"
+#include "msm8996-sde.dtsi"
+#include "msm8996-mdss.dtsi"
+#include "msm8996-mdss-pll.dtsi"
+#include "msm8996-smp2p.dtsi"
+#include "msm8996-ipcrouter.dtsi"
+#include "msm-gdsc-8996.dtsi"
+#include "msm8996-bus.dtsi"
+#include "msm-rdbg.dtsi"
+#include "msm8996-blsp.dtsi"
+
+&soc {
+	#address-cells = <1>;
+	#size-cells = <1>;
+	ranges = <0 0 0 0xffffffff>;
+	compatible = "simple-bus";
+
+        spmi_bus: qcom,spmi@400f000 {
+                compatible = "qcom,spmi-pmic-arb";
+                reg = <0x400f000 0xc00>,
+                      <0x4400000 0x800000>,
+                      <0x4c00000 0x800000>,
+                      <0x5800000 0x200000>,
+                      <0x400a000 0x002100>;
+                reg-names = "core", "chnls", "obsrvr", "intr", "cnfg";
+                interrupt-names = "periph_irq";
+                interrupts = <GIC_SPI 326 IRQ_TYPE_NONE>;
+                qcom,ee = <0>;
+                qcom,channel = <0>;
+                #address-cells = <2>;
+                #size-cells = <0>;
+                interrupt-controller;
+                #interrupt-cells = <4>;
+		cell-index = <0>;
+        };
+
+	apc_apm: apm@099e0000 {
+		compatible = "qcom,msm-apm";
+		reg = <0x099e0000 0x1000>,
+			<0x09820000 0x10000>,
+			<0x06400050 0x8>,
+			<0x06480050 0x8>,
+			<0x09981068 0x8>,
+			<0x09991068 0x8>,
+			<0x099b1068 0x8>,
+			<0x099c1068 0x8>,
+			<0x099a1068 0x8>,
+			<0x099d1068 0x8>;
+		reg-names = "pm-apcc-glb",
+				"apcs-csr",
+				"apc0-pll-ctl",
+				"apc1-pll-ctl",
+				"apc0-cpu0-spm",
+				"apc0-cpu1-spm",
+				"apc1-cpu0-spm",
+				"apc1-cpu1-spm",
+				"apc0-l2-spm",
+				"apc1-l2-spm";
+		qcom,clock-source-override;
+	};
+
+	intc: interrupt-controller@09bc0000 {
+		compatible = "arm,gic-v3";
+		reg = <0x9bc0000 0x10000>,       /* GICD */
+		      <0x9c00000 0x100000>;      /* GICR * 4 */
+		#interrupt-cells = <3>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		interrupt-controller;
+		#redistributor-regions = <1>;
+		redistributor-stride = <0x0 0x40000>;
+
+		interrupts = <1 9 4>;
+
+		gic-its@09BE0000 {
+			compatible = "arm,gic-v3-its";
+			msi-contoller;
+			reg = <0x9be0000 0x20000>;
+		};
+	};
+
+	timer {
+		compatible = "arm,armv8-timer";
+	        interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+				<GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+				<GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+				<GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>;
+		clock-frequency = <19200000>;
+	};
+
+	restart@4ab000 {
+		compatible = "qcom,pshold";
+		reg = <0x4ab000 0x4>,
+		      <0x7b3000 0x4>;
+		reg-names = "pshold-base", "tcsr-boot-misc-detect";
+	};
+
+	qcom,sps {
+		compatible = "qcom,msm_sps_4k";
+		qcom,device-type = <3>;
+		qcom,pipe-attr-ee;
+	};
+
+	uartblsp2dm1: serial@075b0000 {
+		compatible = "qcom,msm-uartdm-v1.4", "qcom,msm-uartdm";
+		reg = <0x75b0000 0x1000>;
+		interrupts = <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>;
+		clocks = <&clock_gcc clk_gcc_blsp2_uart2_apps_clk>,
+			 <&clock_gcc clk_gcc_blsp2_ahb_clk>;
+		clock-names = "core", "iface";
+	};
+
+	uartblsp1dm1: serial@07570000 {
+		compatible = "qcom,msm-lsuart-v14";
+		reg = <0x7570000 0x1000>;
+		interrupts = <0 108 0>;
+		status = "disabled";
+		clocks = <&clock_gcc clk_gcc_blsp1_uart2_apps_clk>,
+			 <&clock_gcc clk_gcc_blsp1_ahb_clk>;
+		clock-names = "core_clk", "iface_clk";
+	};
+
+	i2c_12: i2c@75ba000 {
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "qup_phys_addr";
+		reg = <0x75ba000 0x1000>;
+		interrupt-names = "qup_irq";
+		interrupts = <0 106 0>;
+		dmas = <&dma_blsp2 22 64 0x20000020 0x20>,
+			<&dma_blsp2 23 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <84>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp2_qup6_i2c_apps_clk>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_12_active>;
+		pinctrl-1 = <&i2c_12_sleep>;
+	};
+
+
+	dma_blsp1: qcom,sps-dma@0x7544000{ /* BLSP1 */
+		#dma-cells = <4>;
+		compatible = "qcom,sps-dma";
+		reg = <0x7544000 0x2b000>;
+		interrupts = <0 238 0>;
+		qcom,summing-threshold = <0x10>;
+	};
+
+	dma_blsp2: qcom,sps-dma@0x7584000{ /* BLSP2 */
+		#dma-cells = <4>;
+		compatible = "qcom,sps-dma";
+		reg = <0x7584000 0x2b000>;
+		interrupts = <0 239 0>;
+		qcom,summing-threshold = <0x10>;
+	};
+
+	i2c_6: i2c@757a000 { /* BLSP1 QUP6 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0x757a000  0x1000>;
+		reg-names = "qup_phys_addr";
+		interrupt-names = "qup_irq";
+		interrupts = <0 100 0>;
+		dmas = <&dma_blsp1 22 64 0x20000020 0x20>,
+			<&dma_blsp1 23 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <86>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp1_qup6_i2c_apps_clk>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_6_active>;
+		pinctrl-1 = <&i2c_6_sleep>;
+	};
+
+	i2c_7: i2c@75b5000 { /* BLSP2 QUP1 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "qup_phys_addr";
+		reg = <0x75b5000 0x1000>;
+		interrupt-names = "qup_irq";
+		interrupts = <0 101 0>;
+		dmas = <&dma_blsp2 12 32 0x20000020 0x20>,
+			<&dma_blsp2 13 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <84>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp2_qup1_i2c_apps_clk>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_7_active>;
+		pinctrl-1 = <&i2c_7_sleep>;
+	};
+
+	i2c_8: i2c@75b6000 { /* BLSP2 QUP2 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "qup_phys_addr";
+		reg = <0x75b6000 0x1000>;
+		interrupt-names = "qup_irq";
+		interrupts = <0 102 0>;
+		dmas = <&dma_blsp2 14 32 0x20000020 0x20>,
+			<&dma_blsp2 15 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <84>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			<&clock_gcc clk_gcc_blsp2_qup2_i2c_apps_clk>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_8_active>;
+		pinctrl-1 = <&i2c_8_sleep>;
+	};
+
+	blsp1_uart2: uart@07570000 { /* BLSP1 UART2 */
+		compatible = "qcom,msm-hsuart-v14";
+		reg = <0x07570000 0x1000>,
+		    <0x7544000 0x2b000>;
+		status = "disabled";
+		reg-names = "core_mem", "bam_mem";
+		interrupt-names = "core_irq", "bam_irq", "wakeup_irq";
+		#address-cells = <0>;
+		interrupt-parent = <&blsp1_uart2>;
+		interrupts = <0 1 2>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-map = <0 &intc 0 0 108 0
+			    1 &intc 0 0 238 0
+			    2 &tlmm 42 0>;
+
+		qcom,inject-rx-on-wakeup;
+		qcom,rx-char-to-inject = <0xFD>;
+
+		qcom,bam-tx-ep-pipe-index = <2>;
+		qcom,bam-rx-ep-pipe-index = <3>;
+		qcom,master-id = <86>;
+		clock-names = "core_clk", "iface_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_uart2_apps_clk>,
+		    <&clock_gcc clk_gcc_blsp1_ahb_clk>;
+		pinctrl-names = "sleep", "default";
+		pinctrl-0 = <&blsp1_uart2_sleep>;
+		pinctrl-1 = <&blsp1_uart2_active>;
+
+		qcom,msm-bus,name = "buart2";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			    <86 512 0 0>,
+			    <86 512 500 800>;
+	};
+
+	m4m_cache: qcom,m4m {
+		compatible = "devfreq-simple-dev";
+		clock-names = "devfreq_clk";
+		clocks = <&clock_cpu clk_cbf_clk>;
+		governor = "cpufreq";
+		freq-tbl-khz =
+			<  150000 >,
+			<  307200 >,
+			<  384000 >,
+			<  499200 >,
+			<  595200 >,
+			<  691200 >,
+			<  787200 >,
+			<  883200 >,
+			<  960000 >,
+			< 1036800 >;
+	};
+
+	cpubw: qcom,cpubw {
+		compatible = "qcom,devbw";
+		governor = "performance";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		qcom,bw-tbl =
+			<   762 /*  100 MHz */ >,
+			<  1144 /*  150 MHz */ >,
+			<  1525 /*  200 MHz */ >,
+			<  2288 /*  300 MHz */ >,
+			<  3143 /*  412 MHz */ >,
+			<  4173 /*  547 MHz */ >,
+			<  5195 /*  681 MHz */ >,
+			<  5859 /*  768 MHz */ >,
+			<  7759 /* 1017 MHz */ >,
+			<  9887 /* 1296 MHz */ >,
+			< 11863 /* 1555 MHz */ >,
+			< 13763 /* 1804 MHz */ >;
+	};
+
+	qcom,cpu-bwmon {
+		compatible = "qcom,bimc-bwmon3";
+		reg = <0x00408000 0x300>, <0x00401000 0x200>;
+		reg-names = "base", "global_base";
+		interrupts = <0 183 4>;
+		qcom,mport = <0>;
+		qcom,target-dev = <&cpubw>;
+	};
+
+	mincpubw: qcom,mincpubw {
+		compatible = "qcom,devbw";
+		governor = "powersave";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		qcom,bw-tbl =
+			<   762 /*  100 MHz */ >,
+			<  1144 /*  150 MHz */ >,
+			<  1525 /*  200 MHz */ >,
+			<  2288 /*  300 MHz */ >,
+			<  3143 /*  412 MHz */ >,
+			<  4173 /*  547 MHz */ >,
+			<  5195 /*  681 MHz */ >,
+			<  5859 /*  768 MHz */ >,
+			<  7759 /* 1017 MHz */ >,
+			<  9887 /* 1296 MHz */ >,
+			< 11863 /* 1555 MHz */ >,
+			< 13763 /* 1804 MHz */ >;
+	};
+
+	memlat_cpu0: qcom,memlat-cpu0 {
+		compatible = "qcom,devbw";
+		governor = "powersave";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		qcom,bw-tbl =
+			<  1525 /* 200 MHz */ >,
+			<  2288 /* 300 MHz */ >,
+			<  3509 /* 460 MHz */ >,
+			<  4066 /* 533 MHz */ >,
+			<  5126 /* 672 MHz */ >,
+			<  5928 /* 777 MHz */ >,
+			<  7904 /* 1036 MHz */ >,
+			<  9887 /* 1296 MHz */ >,
+			< 11863 /* 1555 MHz */ >,
+			< 13763 /* 1804 MHz */ >;
+	};
+
+	memlat_cpu2: qcom,memlat-cpu2 {
+		compatible = "qcom,devbw";
+		governor = "powersave";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		qcom,bw-tbl =
+			<  1525 /* 200 MHz */ >,
+			<  2288 /* 300 MHz */ >,
+			<  3509 /* 460 MHz */ >,
+			<  4066 /* 533 MHz */ >,
+			<  5126 /* 672 MHz */ >,
+			<  5928 /* 777 MHz */ >,
+			<  7904 /* 1036 MHz */ >,
+			<  9887 /* 1296 MHz */ >,
+			< 11863 /* 1555 MHz */ >,
+			< 13763 /* 1804 MHz */ >;
+	};
+
+	qcom,arm-memlat-mon-0 {
+		compatible = "qcom,arm-memlat-mon";
+		qcom,cpulist =	<&CPU0 &CPU1>;
+		qcom,target-dev = <&memlat_cpu0>;
+		status = "disabled";
+	};
+
+	qcom,arm-memlat-mon-2 {
+		compatible = "qcom,arm-memlat-mon";
+		qcom,cpulist =	<&CPU2 &CPU3>;
+		qcom,target-dev = <&memlat_cpu2>;
+		status = "disabled";
+	};
+
+	devfreq_cpufreq: devfreq-cpufreq {
+		cpubw-cpufreq {
+			target-dev = <&cpubw>;
+			cpu-to-dev-map-0 =
+				< 1459200 1525 >;
+			cpu-to-dev-map-2 =
+				< 1593600 1525 >;
+		};
+
+		m4m-cpufreq {
+			target-dev = <&m4m_cache>;
+			cpu-to-dev-map-0 =
+				<  345600  307200 >,
+				<  403200  384000 >,
+				<  576000  499200 >,
+				<  633600  595200 >,
+				<  729600  691200 >,
+				<  806400  787200 >,
+				<  883200  883200 >,
+				<  960000  960000 >,
+				< 1459200 1036000 >;
+			cpu-to-dev-map-2 =
+				<  345600  307200 >,
+				<  403200  384000 >,
+				<  576000  499200 >,
+				<  633600  595200 >,
+				<  729600  691200 >,
+				<  806400  787200 >,
+				<  883200  883200 >,
+				<  960000  960000 >,
+				< 1593600 1036000 >;
+		};
+
+		mincpubw-cpufreq {
+			target-dev = <&mincpubw>;
+			cpu-to-dev-map-0 =
+				< 1420800 1525 >;
+			cpu-to-dev-map-2 =
+				< 1420800 1525 >,
+				< 1593600 5195 >;
+		};
+	};
+
+	msm_cpufreq: qcom,msm-cpufreq {
+		compatible = "qcom,msm-cpufreq";
+		clock-names = "l2_clk", "cpu0_clk", "cpu1_clk", "cpu2_clk",
+				"cpu3_clk";
+		clocks = <&clock_cpu clk_cbf_clk>,
+			 <&clock_cpu clk_pwrcl_clk>,
+			 <&clock_cpu clk_pwrcl_clk>,
+			 <&clock_cpu clk_perfcl_clk>,
+			 <&clock_cpu clk_perfcl_clk>;
+
+		qcom,governor-per-policy;
+
+		qcom,cpufreq-table-0 =
+			<  307200 >,
+			<  345600 >,
+			<  403200 >,
+			<  480000 >,
+			<  576000 >,
+			<  633600 >,
+			<  729600 >,
+			<  806400 >,
+			<  883200 >,
+			<  960000 >,
+			< 1017600 >,
+			< 1113600 >,
+			< 1190400 >,
+			< 1267200 >,
+			< 1344000 >,
+			< 1420800 >,
+			< 1459200 >;
+
+		qcom,cpufreq-table-2 =
+			<  307200 >,
+			<  345600 >,
+			<  403200 >,
+			<  480000 >,
+			<  576000 >,
+			<  633600 >,
+			<  729600 >,
+			<  806400 >,
+			<  883200 >,
+			<  960000 >,
+			< 1017600 >,
+			< 1113600 >,
+			< 1190400 >,
+			< 1267200 >,
+			< 1344000 >,
+			< 1420800 >,
+			< 1497600 >,
+			< 1593600 >;
+	};
+
+	clock_cpu: qcom,cpu-clock-8996@ {
+		compatible = "qcom,cpu-clock-8996";
+		reg = <0x06400000 0x1000>,
+		      <0x06480000 0x1000>,
+		      <0x09A20000 0x1000>,
+		      <0x06400000 0x1000>,
+		      <0x06480000 0x1000>,
+		      <0x09A11000 0x1000>,
+		      <0x00074130    0x8>,
+		      <0x09820000 0x1000>;
+		reg-names = "pwrcl_pll", "perfcl_pll", "cbf_pll", "pwrcl_mux", "perfcl_mux", "cbf_mux", "efuse", "debug";
+		vdd-pwrcl-supply = <&apc0_pwrcl_vreg>;
+		vdd-perfcl-supply = <&apc1_vreg>;
+		vdd-cbf-supply = <&apc0_cbf_vreg>;
+		vdd-dig-supply = <&pm8994_s2_corner_ao>;
+		cbf-dev = <&m4m_cache>;
+		/* please look at msm8996-v3.dtsi for the v3 plan */
+		qcom,pwrcl-speedbin0-v0 =
+			<          0  0 >,
+			<  307200000  3 >,
+			<  345600000  4 >,
+			<  403200000  5 >,
+			<  480000000  6 >,
+			<  576000000  7 >,
+			<  633600000  8 >,
+			<  729600000  9 >,
+			<  806400000 10 >,
+			<  883200000 11 >,
+			<  960000000 12 >,
+			< 1017600000 13 >,
+			< 1113600000 14 >,
+			< 1190400000 15 >,
+			< 1267200000 16 >,
+			< 1344000000 17 >,
+			< 1420800000 18 >,
+			< 1459200000 19 >;
+		qcom,perfcl-speedbin0-v0 =
+			<          0  0 >,
+			<  307200000  1 >,
+			<  345600000  2 >,
+			<  403200000  3 >,
+			<  480000000  4 >,
+			<  576000000  5 >,
+			<  633600000  6 >,
+			<  729600000  7 >,
+			<  806400000  8 >,
+			<  883200000  9 >,
+			<  960000000 10 >,
+			< 1017600000 11 >,
+			< 1113600000 12 >,
+			< 1190400000 13 >,
+			< 1267200000 14 >,
+			< 1344000000 15 >,
+			< 1420800000 16 >,
+			< 1497600000 17 >,
+			< 1593600000 18 >;
+		qcom,cbf-speedbin0-v0 =
+			<	   0  0 >,
+			<  307200000  2 >,
+			<  384000000  3 >,
+			<  499200000  4 >,
+			<  595200000  5 >,
+			<  691200000  6 >,
+			<  787200000  7 >,
+			<  883200000  8 >,
+			<  960000000  9 >,
+			< 1036800000 10 >;
+		clock-names = "xo_ao", "aux_clk";
+		clocks = <&clock_gcc clk_cxo_clk_src_ao>,
+			 <&clock_gcc clk_gpll0_ao>;
+		#clock-cells = <1>;
+	};
+
+	clock_gcc: qcom,gcc@300000 {
+		compatible = "qcom,gcc-8996";
+		reg = <0x300000 0x8f014>;
+		reg-names = "cc_base";
+		vdd_dig-supply = <&pm8994_s1_corner>;
+		#clock-cells = <1>;
+		#reset-cells = <1>;
+	};
+
+	clock_mmss: qcom,mmsscc@8c0000 {
+		compatible = "qcom,mmsscc-8996";
+		reg = <0x8c0000 0xb00c>,
+			<0x74130 0x8>;
+		reg-names = "cc_base", "efuse";
+		vdd_dig-supply = <&pm8994_s1_corner>;
+		mmpll4_dig-supply = <&pm8994_s1_corner>;
+		mmpll4_analog-supply = <&pm8994_l12>;
+		qcom,vfe0_clk_src-opp-store-vcorner = <&vfe0>;
+		qcom,vfe1_clk_src-opp-store-vcorner = <&vfe1>;
+		qcom,cpp_clk_src-opp-store-vcorner = <&cpp>;
+		clock-names = "xo", "gpll0", "gpll0_div",
+				"pclk0_src", "pclk1_src",
+				"byte0_src", "byte1_src",
+				"extpclk_src";
+		clocks = <&clock_gcc clk_cxo_clk_src>,
+			 <&clock_gcc clk_gpll0_out_main>,
+			 <&clock_gcc clk_gcc_mmss_gpll0_div_clk>,
+			 <&mdss_dsi0_pll clk_dsi0pll_pixel_clk_mux>,
+			 <&mdss_dsi1_pll clk_dsi1pll_pixel_clk_mux>,
+			 <&mdss_dsi0_pll clk_dsi0pll_byte_clk_mux>,
+			 <&mdss_dsi1_pll clk_dsi1pll_byte_clk_mux>,
+			<&mdss_hdmi_pll clk_hdmi_vco_clk>;
+		#clock-cells = <1>;
+		#reset-cells = <1>;
+	};
+
+	clock_gpu: qcom,gpucc@8c0000 {
+		compatible = "qcom,gpucc-8996";
+		reg = <0x8c0000 0xb00c>;
+		reg-names = "cc_base";
+		vdd_gfx-supply = <&gfx_vreg>;
+		qcom,gfx3d_clk_src-opp-handle = <&msm_gpu>;
+		vdd_mx-supply = <&pm8994_s2_corner>;
+		vdd_gpu_mx-supply = <&pm8994_s2_corner>;
+		qcom,gfxfreq-speedbin0 =
+			<	   0  0  0 >,
+			<   19200000  3  4 >,
+			<   60000000  3  4 >,
+			<  120000000  3  4 >,
+			<  205000000  3  4 >,
+			<  360000000  4  5 >,
+			<  480000000  5  7 >;
+		qcom,gfxfreq-mx-speedbin0 =
+			<	   0  0 >,
+			<   19200000  4 >,
+			<   60000000  4 >,
+			<  120000000  4 >,
+			<  205000000  4 >,
+			<  360000000  5 >,
+			<  480000000  7 >;
+		#clock-cells = <1>;
+	};
+
+	clock_debug: qcom,cc-debug@362000 {
+		compatible = "qcom,cc-debug-8996";
+		reg = <0x362000 0x4>;
+		reg-names = "cc_base";
+		clock-names = "debug_mmss_clk", "debug_gpu_clk", "debug_cpu_clk";
+		clocks = <&clock_mmss clk_mmss_gcc_dbg_clk>,
+			 <&clock_gpu clk_gpu_gcc_dbg_clk>,
+			 <&clock_cpu clk_cpu_debug_mux>;
+		#clock-cells = <1>;
+	};
+
+	qcom,rmtfs_sharedmem@0 {
+		compatible = "qcom,sharedmem-uio";
+		reg = <0x0 0x00200000>;
+		reg-names = "rmtfs";
+		qcom,client-id = <0x00000001>;
+	};
+
+	wcd9xxx_intc: wcd9xxx-irq {
+		compatible = "qcom,wcd9xxx-irq";
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&tlmm>;
+		qcom,gpio-connect = <&tlmm 54 0>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&wcd_intr_default>;
+	};
+
+	clock_audio: audio_ext_clk {
+		compatible = "qcom,audio-ref-clk";
+		qcom,audio-ref-clk-gpio = <&pm8994_gpios 15 0>;
+		clock-names = "osr_clk";
+		clocks = <&clock_gcc clk_div_clk1>;
+		qcom,node_has_rpm_clock;
+		#clock-cells = <1>;
+		pinctrl-names = "sleep", "active";
+		pinctrl-0 = <&spkr_i2s_clk_sleep>;
+		pinctrl-1 = <&spkr_i2s_clk_active>;
+	};
+
+	tspp: msm_tspp@075e7000 {
+		compatible = "qcom,msm_tspp";
+		reg = <0x075e7000 0x1000>, /* MSM_TSIF0_PHYS */
+		      <0x075e8000 0x1000>, /* MSM_TSIF1_PHYS */
+		      <0x075e9000 0x1000>, /* MSM_TSPP_PHYS  */
+		      <0x075c4000 0x23000>; /* MSM_TSPP_BAM_PHYS */
+		reg-names = "MSM_TSIF0_PHYS",
+			"MSM_TSIF1_PHYS",
+			"MSM_TSPP_PHYS",
+			"MSM_TSPP_BAM_PHYS";
+		interrupts = <0 121 0>, /* TSIF_TSPP_IRQ */
+			<0 119 0>, /* TSIF0_IRQ */
+			<0 120 0>, /* TSIF1_IRQ */
+			<0 122 0>; /* TSIF_BAM_IRQ */
+		interrupt-names = "TSIF_TSPP_IRQ",
+			"TSIF0_IRQ",
+			"TSIF1_IRQ",
+			"TSIF_BAM_IRQ";
+
+		clock-names = "iface_clk", "ref_clk";
+		clocks = <&clock_gcc clk_gcc_tsif_ahb_clk>,
+			<&clock_gcc clk_gcc_tsif_ref_clk>;
+
+		qcom,msm-bus,name = "tsif";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<82 512 0 0>, /* No vote */
+				<82 512 12288 24576>; /* Max. bandwidth, 2xTSIF, each max of 96Mbps */
+
+		pinctrl-names = "disabled",
+			"tsif0-mode1", "tsif0-mode2",
+			"tsif1-mode1", "tsif1-mode2",
+			"dual-tsif-mode1", "dual-tsif-mode2";
+
+		pinctrl-0 = <>;				/* disabled */
+		pinctrl-1 = <&tsif0_signals_active>;	/* tsif0-mode1 */
+		pinctrl-2 = <&tsif0_signals_active
+			&tsif0_sync_active>;		/* tsif0-mode2 */
+		pinctrl-3 = <&tsif1_signals_active>;	/* tsif1-mode1 */
+		pinctrl-4 = <&tsif1_signals_active
+			&tsif1_sync_active>;		/* tsif1-mode2 */
+		pinctrl-5 = <&tsif0_signals_active
+			&tsif1_signals_active>;		/* dual-tsif-mode1 */
+		pinctrl-6 = <&tsif0_signals_active
+			&tsif0_sync_active
+			&tsif1_signals_active
+			&tsif1_sync_active>;		/* dual-tsif-mode2 */
+	};
+
+	wcd_rst_gpio: msm_cdc_pinctrl@64 {
+		compatible = "qcom,msm-cdc-pinctrl";
+		qcom,cdc-rst-n-gpio = <&tlmm 64 0>;
+		pinctrl-names = "aud_active", "aud_sleep";
+		pinctrl-0 = <&cdc_reset_active>;
+		pinctrl-1 = <&cdc_reset_sleep>;
+	};
+
+	slim_msm: slim@91c0000 {
+		cell-index = <1>;
+		compatible = "qcom,slim-ngd";
+		reg = <0x91c0000 0x2C000>,
+			<0x9184000 0x32000>;
+		reg-names = "slimbus_physical", "slimbus_bam_physical";
+		interrupts = <0 163 0>, <0 164 0>;
+		interrupt-names = "slimbus_irq", "slimbus_bam_irq";
+		qcom,apps-ch-pipes = <0x60000000>;
+		qcom,ea-pc = <0x160>;
+
+		msm_dai_slim {
+			compatible = "qcom,msm-dai-slim";
+			elemental-addr = [ff ff ff fe 17 02];
+		};
+
+		tasha_codec {
+			compatible = "qcom,tasha-slim-pgd";
+			elemental-addr = [00 01 A0 01 17 02];
+
+			interrupt-parent = <&wcd9xxx_intc>;
+			interrupts = <0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
+				      17 18 19 20 21 22 23 24 25 26 27 28 29
+				      30>;
+
+			qcom,wcd-rst-gpio-node = <&wcd_rst_gpio>;
+
+			clock-names = "wcd_clk", "wcd_native_clk";
+			clocks = <&clock_audio clk_audio_pmi_clk>,
+				 <&clock_audio clk_audio_ap_clk2>;
+
+			cdc-vdd-buck-supply = <&pm8994_s4>;
+			qcom,cdc-vdd-buck-voltage = <1800000 1800000>;
+			qcom,cdc-vdd-buck-current = <650000>;
+
+			cdc-buck-sido-supply = <&pm8994_s4>;
+			qcom,cdc-buck-sido-voltage = <1800000 1800000>;
+			qcom,cdc-buck-sido-current = <250000>;
+
+			cdc-vdd-tx-h-supply = <&pm8994_s4>;
+			qcom,cdc-vdd-tx-h-voltage = <1800000 1800000>;
+			qcom,cdc-vdd-tx-h-current = <25000>;
+
+			cdc-vdd-rx-h-supply = <&pm8994_s4>;
+			qcom,cdc-vdd-rx-h-voltage = <1800000 1800000>;
+			qcom,cdc-vdd-rx-h-current = <25000>;
+
+			cdc-vddpx-1-supply = <&pm8994_s4>;
+			qcom,cdc-vddpx-1-voltage = <1800000 1800000>;
+			qcom,cdc-vddpx-1-current = <10000>;
+
+			qcom,cdc-static-supplies = "cdc-vdd-buck",
+						   "cdc-buck-sido",
+						   "cdc-vdd-tx-h",
+						   "cdc-vdd-rx-h",
+						   "cdc-vddpx-1";
+
+			qcom,cdc-micbias1-mv = <1800>;
+			qcom,cdc-micbias2-mv = <1800>;
+			qcom,cdc-micbias3-mv = <1800>;
+			qcom,cdc-micbias4-mv = <1800>;
+
+			qcom,cdc-mclk-clk-rate = <9600000>;
+			qcom,cdc-slim-ifd = "tasha-slim-ifd";
+			qcom,cdc-slim-ifd-elemental-addr = [00 00 A0 01 17 02];
+			qcom,cdc-dmic-sample-rate = <4800000>;
+			qcom,cdc-mad-dmic-rate = <600000>;
+			qcom,cdc-ecpp-dmic-rate = <1200000>;
+			qcom,cdc-dmic-clk-drv-strength = <2>;
+		};
+	};
+
+	sdhc_1: sdhci@7464900 {
+		compatible = "qcom,sdhci-msm";
+		reg = <0x7464900 0x500>, <0x7464000 0x800>, <0x7464E00 0x19C>;
+		reg-names = "hc_mem", "core_mem", "cmdq_mem";
+
+		interrupts = <0 141 0>, <0 134 0>;
+		interrupt-names = "hc_irq", "pwr_irq";
+
+		clock-names = "iface_clk", "core_clk", "ice_core_clk";
+		clocks = <&clock_gcc clk_gcc_sdcc1_ahb_clk>,
+			 <&clock_gcc clk_gcc_sdcc1_apps_clk>,
+			 <&clock_gcc clk_gcc_sdcc1_ice_core_clk>;
+
+		sdhc-msm-crypto = <&sdcc1_ice>;
+		qcom,large-address-bus;
+		qcom,bus-width = <8>;
+
+		qcom,devfreq,freq-table = <20000000 200000000>;
+
+		qcom,msm-bus,name = "sdhc1";
+		qcom,msm-bus,num-cases = <9>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps = <78 512 0 0>, /* No vote */
+			<78 512 1600 3200>,       /* 400 KB/s*/
+			<78 512 80000 160000>,    /* 20 MB/s */
+			<78 512 100000 200000>,   /* 25 MB/s */
+			<78 512 200000 400000>,   /* 50 MB/s */
+			<78 512 400000 800000>,   /* 100 MB/s */
+			<78 512 400000 800000>,   /* 200 MB/s */
+			<78 512 400000 800000>,   /* 400 MB/s */
+			<78 512 2048000 4096000>; /* Max. bandwidth */
+		qcom,bus-bw-vectors-bps = <0 400000 20000000 25000000 50000000
+						100000000 200000000 400000000
+						4294967295>;
+
+		qcom,pm-qos-cpu-groups = <0x03 0x0c>;
+		qcom,pm-qos-cmdq-latency-us = <70 70>, <70 70>;
+		qcom,pm-qos-legacy-latency-us = <70 70>, <70 70>;
+		qcom,pm-qos-irq-type = "affine_cores";
+		qcom,pm-qos-irq-cpu = <0>;
+		qcom,pm-qos-irq-latency = <70 70>;
+
+		non-removable;
+		status = "disabled";
+	};
+
+	sdhc_2: sdhci@74A4900 {
+		compatible = "qcom,sdhci-msm";
+		reg = <0x74A4900 0x314>, <0x74A4000 0x800>;
+		reg-names = "hc_mem", "core_mem";
+
+		interrupts = <0 125 0>, <0 221 0>;
+		interrupt-names = "hc_irq", "pwr_irq";
+
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_sdcc2_ahb_clk>,
+			 <&clock_gcc clk_gcc_sdcc2_apps_clk>;
+
+		qcom,large-address-bus;
+		qcom,bus-width = <4>;
+
+		qcom,devfreq,freq-table = <20000000 200000000>;
+
+		qcom,msm-bus,name = "sdhc2";
+		qcom,msm-bus,num-cases = <8>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps = <81 512 0 0>, /* No vote */
+				<81 512 1600 3200>,    /* 400 KB/s*/
+				<81 512 80000 160000>, /* 20 MB/s */
+				<81 512 100000 200000>, /* 25 MB/s */
+				<81 512 200000 400000>, /* 50 MB/s */
+				<81 512 400000 800000>, /* 100 MB/s */
+				<81 512 800000 800000>, /* 200 MB/s */
+				<81 512 2048000 4096000>; /* Max. bandwidth */
+		qcom,bus-bw-vectors-bps = <0 400000 20000000 25000000 50000000
+						100000000 200000000 4294967295>;
+
+		qcom,pm-qos-cpu-groups = <0x03 0x0c>;
+		qcom,pm-qos-legacy-latency-us = <70 70>, <70 70>;
+		qcom,pm-qos-irq-type = "affine_cores";
+		qcom,pm-qos-irq-cpu = <0>;
+		qcom,pm-qos-irq-latency = <70 70>;
+
+		status = "disabled";
+	};
+
+	ufs_ice: ufsice@630000 {
+		compatible = "qcom,ice";
+		reg = <0x630000 0x8000>;
+		interrupt-names = "ufs_ice_nonsec_level_irq";
+		interrupts = <0 258 0>;
+		qcom,enable-ice-clk;
+		clock-names =   "ufs_core_clk_src",
+				"ufs_core_clk",
+				"bus_clk",
+				"iface_clk",
+				"ice_core_clk_src",
+				"ice_core_clk";
+		clocks = <&clock_gcc clk_ufs_axi_clk_src>,
+			 <&clock_gcc clk_gcc_ufs_axi_clk>,
+			 <&clock_gcc clk_gcc_sys_noc_ufs_axi_clk>,
+			 <&clock_gcc clk_gcc_ufs_ahb_clk>,
+			 <&clock_gcc clk_ufs_ice_core_clk_src>,
+			 <&clock_gcc clk_gcc_ufs_ice_core_clk>;
+		qcom,op-freq-hz = <0>, <0>, <0>,<0>,
+				 <300000000>, <0>;
+		vdd-hba-supply = <&gdsc_ufs>;
+		qcom,msm-bus,name = "ufs_ice_noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<1 650 0 0>,    /* No vote */
+				<1 650 1000 0>; /* Max. bandwidth */
+		qcom,bus-vector-names = "MIN",
+					"MAX";
+		qcom,instance-type = "ufs";
+		status = "disabled";
+	};
+
+	sdcc1_ice: sdcc1ice@7443000 {
+		compatible = "qcom,ice";
+		reg = <0x7443000 0x8000>;
+		interrupt-names = "sdcc_ice_nonsec_level_irq";
+		interrupts = <0 461 0>;
+		qcom,enable-ice-clk;
+		clock-names = "ice_core_clk_src", "ice_core_clk",
+				"bus_clk", "iface_clk";
+		clocks = <&clock_gcc clk_sdcc1_ice_core_clk_src>,
+			 <&clock_gcc clk_gcc_sdcc1_ice_core_clk>,
+			 <&clock_gcc clk_gcc_sdcc1_apps_clk>,
+			 <&clock_gcc clk_gcc_sdcc1_ahb_clk>;
+		qcom,op-freq-hz = <300000000>, <0>, <0>, <0>;
+		qcom,msm-bus,name = "sdcc_ice_noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<78 512 0 0>,    /* No vote */
+			<78 512 1000 0>; /* Max. bandwidth */
+		qcom,bus-vector-names = "MIN",
+					"MAX";
+		qcom,instance-type = "sdcc";
+		status = "disabled";
+	};
+
+	ufsphy1: ufsphy@627000 {
+		compatible = "qcom,ufs-phy-qmp-14nm";
+		reg = <0x627000 0xda8>;
+		reg-names = "phy_mem";
+		#phy-cells = <0>;
+		vdda-phy-supply = <&pm8994_l28>;
+		vdda-pll-supply = <&pm8994_l12>;
+		vdda-phy-max-microamp = <18380>;
+		vdda-pll-max-microamp = <9440>;
+		vddp-ref-clk-supply = <&pm8994_l25>;
+		vddp-ref-clk-max-microamp = <100>;
+		vddp-ref-clk-always-on;
+		clock-names = "ref_clk_src",
+			"ref_clk";
+		clocks = <&clock_gcc clk_ln_bb_clk>,
+			<&clock_gcc clk_gcc_ufs_clkref_clk>;
+		status = "disabled";
+	};
+
+	ufs1: ufshc@624000 {
+		compatible = "qcom,ufshc";
+		reg = <0x624000 0x2500>;
+		interrupts = <0 265 0>;
+		phys = <&ufsphy1>;
+		phy-names = "ufsphy";
+		ufs-qcom-crypto = <&ufs_ice>;
+		vdd-hba-supply = <&gdsc_ufs>;
+		vdd-hba-fixed-regulator;
+		vcc-supply = <&pm8994_l20>;
+		vccq-supply = <&pm8994_l25>;
+		vccq2-supply = <&pm8994_s4>;
+		vcc-max-microamp = <600000>;
+		vccq-max-microamp = <450000>;
+		vccq2-max-microamp = <450000>;
+
+		clock-names =
+			"core_clk_src",
+			"core_clk",
+			"bus_clk",
+			"bus_aggr_clk",
+			"iface_clk",
+			"core_clk_unipro_src",
+			"core_clk_unipro",
+			"core_clk_ice",
+			"ref_clk",
+			"tx_lane0_sync_clk",
+			"rx_lane0_sync_clk";
+		clocks =
+			<&clock_gcc clk_ufs_axi_clk_src>,
+			<&clock_gcc clk_gcc_ufs_axi_clk>,
+			<&clock_gcc clk_gcc_sys_noc_ufs_axi_clk>,
+			<&clock_gcc clk_gcc_aggre2_ufs_axi_clk>,
+			<&clock_gcc clk_gcc_ufs_ahb_clk>,
+			<&clock_gcc clk_ufs_ice_core_clk_src>,
+			<&clock_gcc clk_gcc_ufs_unipro_core_clk>,
+			<&clock_gcc clk_gcc_ufs_ice_core_clk>,
+			<&clock_gcc clk_ln_bb_clk>,
+			<&clock_gcc clk_gcc_ufs_tx_symbol_0_clk>,
+			<&clock_gcc clk_gcc_ufs_rx_symbol_0_clk>;
+		freq-table-hz =
+			<100000000 200000000>,
+			<0 0>,
+			<0 0>,
+			<0 0>,
+			<0 0>,
+			<150000000 300000000>,
+			<0 0>,
+			<0 0>,
+			<0 0>,
+			<0 0>,
+			<0 0>;
+
+		lanes-per-direction = <1>;
+		qcom,msm-bus,name = "ufs1";
+		qcom,msm-bus,num-cases = <12>;
+		qcom,msm-bus,num-paths = <2>;
+		qcom,msm-bus,vectors-KBps =
+		<95 512 0 0>, <1 650 0 0>,          /* No vote */
+		<95 512 922 0>, <1 650 1000 0>,     /* PWM G1 */
+		<95 512 1844 0>, <1 650 1000 0>,    /* PWM G2 */
+		<95 512 3688 0>, <1 650 1000 0>,    /* PWM G3 */
+		<95 512 7376 0>, <1 650 1000 0>,    /* PWM G4 */
+		<95 512 127796 0>, <1 650 1000 0>,  /* HS G1 RA */
+		<95 512 255591 0>, <1 650 1000 0>,  /* HS G2 RA */
+		<95 512 511181 0>, <1 650 1000 0>,  /* HS G3 RA */
+		<95 512 149422 0>, <1 650 1000 0>,  /* HS G1 RB */
+		<95 512 298189 0>, <1 650 1000 0>,  /* HS G2 RB */
+		<95 512 596378 0>, <1 650 1000 0>,  /* HS G3 RB */
+		<95 512 4096000 0>, <1 650 1000 0>; /* Max. bandwidth */
+		qcom,bus-vector-names = "MIN",
+		"PWM_G1_L1", "PWM_G2_L1", "PWM_G3_L1", "PWM_G4_L1",
+		"HS_RA_G1_L1", "HS_RA_G2_L1", "HS_RA_G3_L1",
+		"HS_RB_G1_L1", "HS_RB_G2_L1", "HS_RB_G3_L1",
+		"MAX";
+
+		resets = <&clock_gcc UFS_BCR>;
+		reset-names = "core_reset";
+
+		/* PM QoS */
+		qcom,pm-qos-cpu-groups = <0x03 0x0C>;
+		qcom,pm-qos-cpu-group-latency-us = <70 70>;
+		qcom,pm-qos-default-cpu = <0>;
+
+		non-removable;
+		status = "disabled";
+	};
+
+	pcie0: qcom,pcie@00600000 {
+		compatible = "qcom,pci-msm";
+		cell-index = <0>;
+
+		reg = <0x00600000 0x2000>,
+		      <0x00034000 0x4000>,
+		      <0x0c000000 0xf1d>,
+		      <0x0c000f20 0xa8>,
+		      <0x0c100000 0x100000>,
+		      <0x0c200000 0x100000>,
+		      <0x0c300000 0xd00000>;
+
+		reg-names = "parf", "phy", "dm_core", "elbi",
+				"conf", "io", "bars";
+
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges = <0x01000000 0x0 0x0c200000 0x0c200000 0x0 0x100000>,
+			<0x02000000 0x0 0x0c300000 0x0c300000 0x0 0xd00000>;
+		interrupt-parent = <&pcie0>;
+		interrupts = 	<0 1 2 3 4 5 6 7 8 9 10 11
+				12 13 14 15 16 17 18 19 20
+				21 22 23 24 25 26 27 28 29
+				30 31 32 33 34 35 36 37 38
+				39 40 41 42 43>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0x0 0x0 0x0 0xffffffff>;
+		interrupt-map = <0x0 0x0 0x0 0 &intc 0 0 405 0
+				0x0 0x0 0x0 1 &intc 0 0 244 0
+				0x0 0x0 0x0 2 &intc 0 0 245 0
+				0x0 0x0 0x0 3 &intc 0 0 247 0
+				0x0 0x0 0x0 4 &intc 0 0 248 0
+				0x0 0x0 0x0 5 &intc 0 0 249 0
+				0x0 0x0 0x0 6 &intc 0 0 250 0
+				0x0 0x0 0x0 7 &intc 0 0 251 0
+				0x0 0x0 0x0 8 &intc 0 0 252 0
+				0x0 0x0 0x0 9 &intc 0 0 253 0
+				0x0 0x0 0x0 10 &intc 0 0 254 0
+				0x0 0x0 0x0 11 &intc 0 0 255 0
+				0x0 0x0 0x0 12 &intc 0 0 512 0
+				0x0 0x0 0x0 13 &intc 0 0 513 0
+				0x0 0x0 0x0 14 &intc 0 0 514 0
+				0x0 0x0 0x0 15 &intc 0 0 515 0
+				0x0 0x0 0x0 16 &intc 0 0 516 0
+				0x0 0x0 0x0 17 &intc 0 0 517 0
+				0x0 0x0 0x0 18 &intc 0 0 518 0
+				0x0 0x0 0x0 19 &intc 0 0 519 0
+				0x0 0x0 0x0 20 &intc 0 0 520 0
+				0x0 0x0 0x0 21 &intc 0 0 521 0
+				0x0 0x0 0x0 22 &intc 0 0 522 0
+				0x0 0x0 0x0 23 &intc 0 0 523 0
+				0x0 0x0 0x0 24 &intc 0 0 524 0
+				0x0 0x0 0x0 25 &intc 0 0 525 0
+				0x0 0x0 0x0 26 &intc 0 0 526 0
+				0x0 0x0 0x0 27 &intc 0 0 527 0
+				0x0 0x0 0x0 28 &intc 0 0 528 0
+				0x0 0x0 0x0 29 &intc 0 0 529 0
+				0x0 0x0 0x0 30 &intc 0 0 530 0
+				0x0 0x0 0x0 31 &intc 0 0 531 0
+				0x0 0x0 0x0 32 &intc 0 0 532 0
+				0x0 0x0 0x0 33 &intc 0 0 533 0
+				0x0 0x0 0x0 34 &intc 0 0 534 0
+				0x0 0x0 0x0 35 &intc 0 0 535 0
+				0x0 0x0 0x0 36 &intc 0 0 536 0
+				0x0 0x0 0x0 37 &intc 0 0 537 0
+				0x0 0x0 0x0 38 &intc 0 0 538 0
+				0x0 0x0 0x0 39 &intc 0 0 539 0
+				0x0 0x0 0x0 40 &intc 0 0 540 0
+				0x0 0x0 0x0 41 &intc 0 0 541 0
+				0x0 0x0 0x0 42 &intc 0 0 542 0
+				0x0 0x0 0x0 43 &intc 0 0 543 0>;
+
+		interrupt-names = "int_msi", "int_a", "int_b", "int_c", "int_d",
+				"int_pls_pme", "int_pme_legacy", "int_pls_err",
+				"int_aer_legacy", "int_pls_link_up",
+				"int_pls_link_down", "int_bridge_flush_n",
+				"msi_0", "msi_1", "msi_2", "msi_3",
+				"msi_4", "msi_5", "msi_6", "msi_7",
+				"msi_8", "msi_9", "msi_10", "msi_11",
+				"msi_12", "msi_13", "msi_14", "msi_15",
+				"msi_16", "msi_17", "msi_18", "msi_19",
+				"msi_20", "msi_21", "msi_22", "msi_23",
+				"msi_24", "msi_25", "msi_26", "msi_27",
+				"msi_28", "msi_29", "msi_30", "msi_31";
+
+		pinctrl-names = "default", "sleep";
+		pinctrl-0 = <&pcie0_clkreq_default &pcie0_perst_default &pcie0_wake_default>;
+		pinctrl-1 = <&pcie0_clkreq_sleep
+			&pcie0_perst_default
+			&pcie0_wake_sleep>;
+
+		perst-gpio = <&tlmm 35 0>;
+		wake-gpio = <&tlmm 37 0>;
+
+		gdsc-smmu-supply = <&gdsc_aggre0_noc>;
+		gdsc-vdd-supply = <&gdsc_pcie_0>;
+		vreg-1.8-supply = <&pm8994_l12>;
+		vreg-0.9-supply = <&pm8994_l28>;
+		vreg-cx-supply = <&pm8994_s1_corner>;
+
+		qcom,vreg-0.9-voltage-level = <925000 925000 24000>;
+		qcom,vreg-cx-voltage-level = <7 4 0>;
+
+		qcom,l1-supported;
+		qcom,l1ss-supported;
+		qcom,aux-clk-sync;
+
+		qcom,ep-latency = <10>;
+
+		qcom,common-phy;
+		qcom,smmu-exist;
+
+		iommus = <&anoc0_smmu>;
+
+		qcom,boot-option = <0x1>;
+
+		linux,pci-domain = <0>;
+
+		qcom,msi-gicm-addr = <0x09BD0040>;
+		qcom,msi-gicm-base = <0x220>;
+
+		qcom,msm-bus,name = "pcie0";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<45 512 0 0>,
+				<45 512 500 800>;
+
+		clocks = <&clock_gcc clk_gcc_pcie_0_pipe_clk>,
+			<&clock_gcc clk_ln_bb_clk>,
+			<&clock_gcc clk_gcc_pcie_0_aux_clk>,
+			<&clock_gcc clk_gcc_pcie_0_cfg_ahb_clk>,
+			<&clock_gcc clk_gcc_pcie_0_mstr_axi_clk>,
+			<&clock_gcc clk_gcc_pcie_0_slv_axi_clk>,
+			<&clock_gcc clk_gcc_pcie_clkref_clk>,
+			<&clock_gcc clk_gcc_smmu_aggre0_axi_clk>,
+			<&clock_gcc clk_gcc_pcie_phy_cfg_ahb_clk>,
+			<&clock_gcc clk_gcc_pcie_phy_aux_clk>;
+
+		clock-names =  "pcie_0_pipe_clk", "pcie_0_ref_clk_src", "pcie_0_aux_clk",
+			"pcie_0_cfg_ahb_clk", "pcie_0_mstr_axi_clk",
+			"pcie_0_slv_axi_clk", "pcie_0_ldo", "pcie_0_smmu_clk",
+			"pcie_phy_cfg_ahb_clk", "pcie_phy_aux_clk";
+
+		resets = <&clock_gcc PCIE_PHY_BCR>,
+			<&clock_gcc PCIE_PHY_COM_BCR>,
+			<&clock_gcc PCIE_PHY_NOCSR_COM_PHY_BCR>,
+			<&clock_gcc PCIE_0_PHY_BCR>;
+
+		reset-names = "pcie_phy_reset", "pcie_phy_com_reset",
+			"pcie_phy_nocsr_com_phy_reset","pcie_0_phy_reset";
+
+		max-clock-frequency-hz = <0>, <0>, <1010526>, <0>, <0>, <0>, <0>,
+					 <0>, <0>, <0>, <0>, <0>, <0>, <0>;
+	};
+
+	pcie1: qcom,pcie@00608000 {
+		compatible = "qcom,pci-msm";
+		cell-index = <1>;
+
+		reg = <0x00608000 0x2000>,
+		      <0x00034000 0x4000>,
+		      <0x0d000000 0xf1d>,
+		      <0x0d000f20 0xa8>,
+		      <0x0d100000 0x100000>,
+		      <0x0d200000 0x100000>,
+		      <0x0d300000 0xd00000>;
+
+		reg-names = "parf", "phy", "dm_core", "elbi",
+				"conf", "io", "bars";
+
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges = <0x01000000 0x0 0x0d200000 0x0d200000 0x0 0x100000>,
+			<0x02000000 0x0 0x0d300000 0x0d300000 0x0 0xd00000>;
+		interrupt-parent = <&pcie1>;
+		interrupts = 	<0 1 2 3 4 5 6 7 8 9 10 11
+				12 13 14 15 16 17 18 19 20
+				21 22 23 24 25 26 27 28 29
+				30 31 32 33 34 35 36 37 38
+				39 40 41 42 43>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0x0 0x0 0x0 0xffffffff>;
+		interrupt-map = <0x0 0x0 0x0 0 &intc 0 0 413 0
+				0x0 0x0 0x0 1 &intc 0 0 272 0
+				0x0 0x0 0x0 2 &intc 0 0 273 0
+				0x0 0x0 0x0 3 &intc 0 0 274 0
+				0x0 0x0 0x0 4 &intc 0 0 275 0
+				0x0 0x0 0x0 5 &intc 0 0 276 0
+				0x0 0x0 0x0 6 &intc 0 0 277 0
+				0x0 0x0 0x0 7 &intc 0 0 278 0
+				0x0 0x0 0x0 8 &intc 0 0 279 0
+				0x0 0x0 0x0 9 &intc 0 0 280 0
+				0x0 0x0 0x0 10 &intc 0 0 281 0
+				0x0 0x0 0x0 11 &intc 0 0 282 0
+				0x0 0x0 0x0 12 &intc 0 0 544 0
+				0x0 0x0 0x0 13 &intc 0 0 545 0
+				0x0 0x0 0x0 14 &intc 0 0 546 0
+				0x0 0x0 0x0 15 &intc 0 0 547 0
+				0x0 0x0 0x0 16 &intc 0 0 548 0
+				0x0 0x0 0x0 17 &intc 0 0 549 0
+				0x0 0x0 0x0 18 &intc 0 0 550 0
+				0x0 0x0 0x0 19 &intc 0 0 551 0
+				0x0 0x0 0x0 20 &intc 0 0 552 0
+				0x0 0x0 0x0 21 &intc 0 0 553 0
+				0x0 0x0 0x0 22 &intc 0 0 554 0
+				0x0 0x0 0x0 23 &intc 0 0 555 0
+				0x0 0x0 0x0 24 &intc 0 0 556 0
+				0x0 0x0 0x0 25 &intc 0 0 557 0
+				0x0 0x0 0x0 26 &intc 0 0 558 0
+				0x0 0x0 0x0 27 &intc 0 0 559 0
+				0x0 0x0 0x0 28 &intc 0 0 560 0
+				0x0 0x0 0x0 29 &intc 0 0 561 0
+				0x0 0x0 0x0 30 &intc 0 0 562 0
+				0x0 0x0 0x0 31 &intc 0 0 563 0
+				0x0 0x0 0x0 32 &intc 0 0 564 0
+				0x0 0x0 0x0 33 &intc 0 0 565 0
+				0x0 0x0 0x0 34 &intc 0 0 566 0
+				0x0 0x0 0x0 35 &intc 0 0 567 0
+				0x0 0x0 0x0 36 &intc 0 0 568 0
+				0x0 0x0 0x0 37 &intc 0 0 569 0
+				0x0 0x0 0x0 38 &intc 0 0 570 0
+				0x0 0x0 0x0 39 &intc 0 0 571 0
+				0x0 0x0 0x0 40 &intc 0 0 572 0
+				0x0 0x0 0x0 41 &intc 0 0 573 0
+				0x0 0x0 0x0 42 &intc 0 0 574 0
+				0x0 0x0 0x0 43 &intc 0 0 575 0>;
+
+		interrupt-names = "int_msi", "int_a", "int_b", "int_c", "int_d",
+				"int_pls_pme", "int_pme_legacy", "int_pls_err",
+				"int_aer_legacy", "int_pls_link_up",
+				"int_pls_link_down", "int_bridge_flush_n",
+				"msi_0", "msi_1", "msi_2", "msi_3",
+				"msi_4", "msi_5", "msi_6", "msi_7",
+				"msi_8", "msi_9", "msi_10", "msi_11",
+				"msi_12", "msi_13", "msi_14", "msi_15",
+				"msi_16", "msi_17", "msi_18", "msi_19",
+				"msi_20", "msi_21", "msi_22", "msi_23",
+				"msi_24", "msi_25", "msi_26", "msi_27",
+				"msi_28", "msi_29", "msi_30", "msi_31";
+
+		pinctrl-names = "default", "sleep";
+		pinctrl-0 = <&pcie1_clkreq_default &pcie1_perst_default &pcie1_wake_default>;
+		pinctrl-1 = <&pcie1_clkreq_sleep
+			&pcie1_perst_default
+			&pcie1_wake_sleep>;
+
+		perst-gpio = <&tlmm 130 0>;
+
+		gdsc-smmu-supply = <&gdsc_aggre0_noc>;
+		gdsc-vdd-supply = <&gdsc_pcie_1>;
+		vreg-1.8-supply = <&pm8994_l12>;
+		vreg-0.9-supply = <&pm8994_l28>;
+		vreg-cx-supply = <&pm8994_s1_corner>;
+
+		qcom,vreg-0.9-voltage-level = <925000 925000 24000>;
+		qcom,vreg-cx-voltage-level = <7 5 0>;
+
+		qcom,l1-supported;
+		qcom,l1ss-supported;
+		qcom,aux-clk-sync;
+
+		qcom,common-phy;
+		qcom,smmu-exist;
+
+		iommus = <&anoc0_smmu>;
+
+		qcom,boot-option = <0x1>;
+
+		qcom,ep-latency = <10>;
+
+		linux,pci-domain = <1>;
+
+		qcom,msm-bus,name = "pcie1";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<100 512 0 0>,
+				<100 512 500 800>;
+
+		clocks = <&clock_gcc clk_gcc_pcie_1_pipe_clk>,
+			<&clock_gcc clk_ln_bb_clk>,
+			<&clock_gcc clk_gcc_pcie_1_aux_clk>,
+			<&clock_gcc clk_gcc_pcie_1_cfg_ahb_clk>,
+			<&clock_gcc clk_gcc_pcie_1_mstr_axi_clk>,
+			<&clock_gcc clk_gcc_pcie_1_slv_axi_clk>,
+			<&clock_gcc clk_gcc_pcie_clkref_clk>,
+			<&clock_gcc clk_gcc_smmu_aggre0_axi_clk>,
+			<&clock_gcc clk_gcc_pcie_phy_cfg_ahb_clk>,
+			<&clock_gcc clk_gcc_pcie_phy_aux_clk>;
+
+		clock-names =  "pcie_1_pipe_clk", "pcie_1_ref_clk_src", "pcie_1_aux_clk",
+			"pcie_1_cfg_ahb_clk", "pcie_1_mstr_axi_clk",
+			"pcie_1_slv_axi_clk", "pcie_1_ldo", "pcie_1_smmu_clk",
+			"pcie_phy_cfg_ahb_clk", "pcie_phy_aux_clk";
+
+		resets = <&clock_gcc PCIE_PHY_BCR>,
+			<&clock_gcc PCIE_PHY_COM_BCR>,
+			<&clock_gcc PCIE_PHY_NOCSR_COM_PHY_BCR>,
+			<&clock_gcc PCIE_1_PHY_BCR>;
+
+		reset-names = "pcie_phy_reset", "pcie_phy_com_reset",
+			"pcie_phy_nocsr_com_phy_reset","pcie_1_phy_reset";
+
+		max-clock-frequency-hz = <0>, <0>, <1010526>, <0>, <0>, <0>, <0>,
+					 <0>, <0>, <0>, <0>, <0>, <0>, <0>;
+	};
+
+	pcie2: qcom,pcie@00610000 {
+		compatible = "qcom,pci-msm";
+		cell-index = <2>;
+
+		reg = <0x00610000 0x2000>,
+		      <0x00034000 0x4000>,
+		      <0x0e000000 0xf1d>,
+		      <0x0e000f20 0xa8>,
+		      <0x0e100000 0x100000>,
+		      <0x0e200000 0x100000>,
+		      <0x0e300000 0x1d00000>;
+
+		reg-names = "parf", "phy", "dm_core", "elbi",
+				"conf", "io", "bars";
+
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges = <0x01000000 0x0 0x0e200000 0x0e200000 0x0 0x100000>,
+			<0x02000000 0x0 0x0e300000 0x0e300000 0x0 0x1d00000>;
+		interrupt-parent = <&pcie2>;
+		interrupts = 	<0 1 2 3 4 5 6 7 8 9 10 11
+				12 13 14 15 16 17 18 19 20
+				21 22 23 24 25 26 27 28 29
+				30 31 32 33 34 35 36 37 38
+				39 40 41 42 43>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0x0 0x0 0x0 0xffffffff>;
+		interrupt-map = <0x0 0x0 0x0 0 &intc 0 0 421 0
+				0x0 0x0 0x0 1 &intc 0 0 142 0
+				0x0 0x0 0x0 2 &intc 0 0 143 0
+				0x0 0x0 0x0 3 &intc 0 0 144 0
+				0x0 0x0 0x0 4 &intc 0 0 145 0
+				0x0 0x0 0x0 5 &intc 0 0 146 0
+				0x0 0x0 0x0 6 &intc 0 0 147 0
+				0x0 0x0 0x0 7 &intc 0 0 148 0
+				0x0 0x0 0x0 8 &intc 0 0 149 0
+				0x0 0x0 0x0 9 &intc 0 0 260 0
+				0x0 0x0 0x0 10 &intc 0 0 261 0
+				0x0 0x0 0x0 11 &intc 0 0 262 0
+				0x0 0x0 0x0 12 &intc 0 0 576 0
+				0x0 0x0 0x0 13 &intc 0 0 577 0
+				0x0 0x0 0x0 14 &intc 0 0 578 0
+				0x0 0x0 0x0 15 &intc 0 0 579 0
+				0x0 0x0 0x0 16 &intc 0 0 580 0
+				0x0 0x0 0x0 17 &intc 0 0 581 0
+				0x0 0x0 0x0 18 &intc 0 0 582 0
+				0x0 0x0 0x0 19 &intc 0 0 583 0
+				0x0 0x0 0x0 20 &intc 0 0 584 0
+				0x0 0x0 0x0 21 &intc 0 0 585 0
+				0x0 0x0 0x0 22 &intc 0 0 586 0
+				0x0 0x0 0x0 23 &intc 0 0 587 0
+				0x0 0x0 0x0 24 &intc 0 0 588 0
+				0x0 0x0 0x0 25 &intc 0 0 589 0
+				0x0 0x0 0x0 26 &intc 0 0 590 0
+				0x0 0x0 0x0 27 &intc 0 0 591 0
+				0x0 0x0 0x0 28 &intc 0 0 592 0
+				0x0 0x0 0x0 29 &intc 0 0 593 0
+				0x0 0x0 0x0 30 &intc 0 0 594 0
+				0x0 0x0 0x0 31 &intc 0 0 595 0
+				0x0 0x0 0x0 32 &intc 0 0 596 0
+				0x0 0x0 0x0 33 &intc 0 0 597 0
+				0x0 0x0 0x0 34 &intc 0 0 598 0
+				0x0 0x0 0x0 35 &intc 0 0 599 0
+				0x0 0x0 0x0 36 &intc 0 0 600 0
+				0x0 0x0 0x0 37 &intc 0 0 601 0
+				0x0 0x0 0x0 38 &intc 0 0 602 0
+				0x0 0x0 0x0 39 &intc 0 0 603 0
+				0x0 0x0 0x0 40 &intc 0 0 604 0
+				0x0 0x0 0x0 41 &intc 0 0 605 0
+				0x0 0x0 0x0 42 &intc 0 0 606 0
+				0x0 0x0 0x0 43 &intc 0 0 607 0>;
+
+		interrupt-names = "int_msi", "int_a", "int_b", "int_c", "int_d",
+				"int_pls_pme", "int_pme_legacy", "int_pls_err",
+				"int_aer_legacy", "int_pls_link_up",
+				"int_pls_link_down", "int_bridge_flush_n",
+				"msi_0", "msi_1", "msi_2", "msi_3",
+				"msi_4", "msi_5", "msi_6", "msi_7",
+				"msi_8", "msi_9", "msi_10", "msi_11",
+				"msi_12", "msi_13", "msi_14", "msi_15",
+				"msi_16", "msi_17", "msi_18", "msi_19",
+				"msi_20", "msi_21", "msi_22", "msi_23",
+				"msi_24", "msi_25", "msi_26", "msi_27",
+				"msi_28", "msi_29", "msi_30", "msi_31";
+
+		pinctrl-names = "default", "sleep";
+		pinctrl-0 = <&pcie2_clkreq_default &pcie2_perst_default &pcie2_wake_default>;
+		pinctrl-1 = <&pcie2_clkreq_sleep
+			&pcie2_perst_default
+			&pcie2_wake_sleep>;
+
+		perst-gpio = <&tlmm 114 0>;
+		wake-gpio = <&tlmm 116 0>;
+
+		gdsc-smmu-supply = <&gdsc_aggre0_noc>;
+		gdsc-vdd-supply = <&gdsc_pcie_2>;
+		vreg-1.8-supply = <&pm8994_l12>;
+		vreg-0.9-supply = <&pm8994_l28>;
+		vreg-cx-supply = <&pm8994_s1_corner>;
+
+		qcom,vreg-0.9-voltage-level = <925000 925000 24000>;
+		qcom,vreg-cx-voltage-level = <7 5 0>;
+
+		qcom,l1-supported;
+		qcom,l1ss-supported;
+		qcom,aux-clk-sync;
+
+		qcom,common-phy;
+		qcom,smmu-exist;
+
+		iommus = <&anoc0_smmu>;
+
+		qcom,boot-option = <0x1>;
+
+		qcom,ep-latency = <10>;
+
+		linux,pci-domain = <2>;
+
+		qcom,msi-gicm-addr = <0x09BD0040>;
+		qcom,msi-gicm-base = <0x260>;
+
+		qcom,msm-bus,name = "pcie2";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<108 512 0 0>,
+				<108 512 500 800>;
+
+		clocks = <&clock_gcc clk_gcc_pcie_2_pipe_clk>,
+			<&clock_gcc clk_ln_bb_clk>,
+			<&clock_gcc clk_gcc_pcie_2_aux_clk>,
+			<&clock_gcc clk_gcc_pcie_2_cfg_ahb_clk>,
+			<&clock_gcc clk_gcc_pcie_2_mstr_axi_clk>,
+			<&clock_gcc clk_gcc_pcie_2_slv_axi_clk>,
+			<&clock_gcc clk_gcc_pcie_clkref_clk>,
+			<&clock_gcc clk_gcc_smmu_aggre0_axi_clk>,
+			<&clock_gcc clk_gcc_pcie_phy_cfg_ahb_clk>,
+			<&clock_gcc clk_gcc_pcie_phy_aux_clk>;
+
+		clock-names =  "pcie_2_pipe_clk", "pcie_2_ref_clk_src", "pcie_2_aux_clk",
+			"pcie_2_cfg_ahb_clk", "pcie_2_mstr_axi_clk",
+			"pcie_2_slv_axi_clk", "pcie_2_ldo", "pcie_2_smmu_clk",
+			"pcie_phy_cfg_ahb_clk", "pcie_phy_aux_clk";
+
+		resets = <&clock_gcc PCIE_PHY_BCR>,
+			<&clock_gcc PCIE_PHY_COM_BCR>,
+			<&clock_gcc PCIE_PHY_NOCSR_COM_PHY_BCR>,
+			<&clock_gcc PCIE_2_PHY_BCR>;
+
+		reset-names = "pcie_phy_reset", "pcie_phy_com_reset",
+			"pcie_phy_nocsr_com_phy_reset","pcie_2_phy_reset";
+
+		max-clock-frequency-hz = <0>, <0>, <1010526>, <0>, <0>, <0>, <0>,
+					 <0>, <0>, <0>, <0>, <0>, <0>, <0>;
+	};
+
+	mhi: qcom,mhi {
+		compatible = "qcom,mhi";
+		status = "disabled";
+	};
+
+        qcom,ipc-spinlock@740000 {
+                compatible = "qcom,ipc-spinlock-sfpb";
+                reg = <0x740000 0x8000>;
+                qcom,num-locks = <8>;
+        };
+
+	qcom,smem@86000000 {
+		compatible = "qcom,smem";
+		reg = <0x86000000 0x200000>,
+			<0x9820010 0x4>,
+			<0x68000 0x8000>,
+			<0x7b4000 0x8>;
+		reg-names = "smem", "irq-reg-base", "aux-mem1",
+			"smem_targ_info_reg";
+		qcom,mpu-enabled;
+
+		qcom,smd-modem {
+			compatible = "qcom,smd";
+			qcom,smd-edge = <0>;
+			qcom,smd-irq-offset = <0x0>;
+			qcom,smd-irq-bitmask = <0x1000>;
+			interrupts = <0 449 1>;
+			label = "modem";
+			qcom,not-loadable;
+		};
+
+		qcom,smd-adsp {
+			compatible = "qcom,smd";
+			qcom,smd-edge = <1>;
+			qcom,smd-irq-offset = <0x0>;
+			qcom,smd-irq-bitmask = <0x100>;
+			interrupts = <0 156 1>;
+			label = "adsp";
+		};
+
+		qcom,smd-dsps {
+			compatible = "qcom,smd";
+			qcom,smd-edge = <3>;
+			qcom,smd-irq-offset = <0x0>;
+			qcom,smd-irq-bitmask = <0x2000000>;
+			interrupts = <0 176 1>;
+			label = "dsps";
+		};
+
+		qcom,smd-rpm {
+			compatible = "qcom,smd";
+			qcom,smd-edge = <15>;
+			qcom,smd-irq-offset = <0x0>;
+			qcom,smd-irq-bitmask = <0x1>;
+			interrupts = <0 168 1>;
+			label = "rpm";
+			qcom,irq-no-suspend;
+			qcom,not-loadable;
+		};
+	};
+
+	wdog: qcom,wdt@9830000 {
+		compatible = "qcom,msm-watchdog";
+		reg = <0x9830000 0x1000>;
+		reg-names = "wdt-base";
+		interrupts = <0 28 0>, <0 29 0>;
+		qcom,bark-time = <11000>;
+		qcom,pet-time = <10000>;
+		qcom,ipi-ping;
+		qcom,wakeup-enable;
+	};
+
+	qcom,msm-rtb {
+		compatible = "qcom,msm-rtb";
+		qcom,rtb-size = <0x100000>;
+	};
+
+	qcom,mpm2-sleep-counter@4a3000 {
+		compatible = "qcom,mpm2-sleep-counter";
+		reg = <0x004a3000 0x1000>;
+		clock-frequency = <32768>;
+	};
+
+	qcom,msm-imem@66bf000 {
+		compatible = "qcom,msm-imem";
+		reg = <0x66bf000 0x1000>; /* Address and size of IMEM */
+		ranges = <0x0 0x66bf000 0x1000>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		mem_dump_table@10 {
+			compatible = "qcom,msm-imem-mem_dump_table";
+			reg = <0x10 8>;
+		};
+
+		dload_type@18 {
+			compatible = "qcom,msm-imem-dload-type";
+			reg = <0x18 4>;
+		};
+
+		restart_reason@65c {
+			compatible = "qcom,msm-imem-restart_reason";
+			reg = <0x65c 4>;
+		};
+
+		boot_stats@6b0 {
+			compatible = "qcom,msm-imem-boot_stats";
+			reg = <0x6b0 32>;
+		};
+
+		pil@94c {
+			compatible = "qcom,msm-imem-pil";
+			reg = <0x94c 200>;
+		};
+	};
+
+	jtag_fuse: jtagfuse@7602c {
+		compatible = "qcom,jtag-fuse-v3";
+		reg = <0x7602c 0xc>;
+		reg-names = "fuse-base";
+	};
+
+	rpm_bus: qcom,rpm-smd {
+		 compatible = "qcom,rpm-glink";
+		 qcom,glink-edge = "rpm";
+		 rpm-channel-name = "rpm_requests";
+	 };
+
+	qcom,smdpkt {
+		compatible = "qcom,smdpkt";
+
+		qcom,smdpkt-data5-cntl {
+			qcom,smdpkt-remote = "modem";
+			qcom,smdpkt-port-name = "DATA5_CNTL";
+			qcom,smdpkt-dev-name = "smdcntl0";
+		};
+
+		qcom,smdpkt-data22 {
+			qcom,smdpkt-remote = "modem";
+			qcom,smdpkt-port-name = "DATA22";
+			qcom,smdpkt-dev-name = "smd22";
+		};
+
+		qcom,smdpkt-data40-cntl {
+			qcom,smdpkt-remote = "modem";
+			qcom,smdpkt-port-name = "DATA40_CNTL";
+			qcom,smdpkt-dev-name = "smdcntl8";
+		};
+
+		qcom,smdpkt-apr-apps2 {
+			qcom,smdpkt-remote = "adsp";
+			qcom,smdpkt-port-name = "apr_apps2";
+			qcom,smdpkt-dev-name = "apr_apps2";
+		};
+
+		qcom,smdpkt-loopback {
+			qcom,smdpkt-remote = "modem";
+			qcom,smdpkt-port-name = "LOOPBACK";
+			qcom,smdpkt-dev-name = "smd_pkt_loopback";
+		};
+	};
+
+	qcom,smdtty {
+		compatible = "qcom,smdtty";
+
+		smdtty_data1: qcom,smdtty-data1 {
+			qcom,smdtty-remote = "modem";
+			qcom,smdtty-port-name = "DATA1";
+		};
+
+		smdtty_data4: qcom,smdtty-data4 {
+			qcom,smdtty-remote = "modem";
+			qcom,smdtty-port-name = "DATA4";
+		};
+
+		smdtty_data11: qcom,smdtty-data11 {
+			qcom,smdtty-remote = "modem";
+			qcom,smdtty-port-name = "DATA11";
+		};
+
+		smdtty_data21: qcom,smdtty-data21 {
+			qcom,smdtty-remote = "modem";
+			qcom,smdtty-port-name = "DATA21";
+		};
+
+		smdtty_loopback: smdtty-loopback {
+			qcom,smdtty-remote = "modem";
+			qcom,smdtty-port-name = "LOOPBACK";
+			qcom,smdtty-dev-name = "LOOPBACK_TTY";
+		};
+	};
+
+	usb3: ssusb@6a00000{
+		compatible = "qcom,dwc-usb3-msm";
+		reg = <0x06a00000 0xfc000>,
+			<0x7416000 0x400>;
+		reg-names = "core_base",
+			"ahb2phy_base";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+
+		interrupts = <0 347 0>, <0 243 0>, <0 180 0>;
+		interrupt-names = "hs_phy_irq", "ss_phy_irq", "pwr_event_irq";
+
+		USB3_GDSC-supply = <&gdsc_usb30>;
+		vbus_dwc3-supply = <&smbcharger_charger_otg>;
+		qcom,usb-dbm = <&dbm_1p5>;
+		qcom,msm-bus,name = "usb3";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+					<61 512 0 0>,
+					<61 512 240000 800000>;
+
+		qcom,dwc-usb3-msm-tx-fifo-size = <21288>;
+
+		clocks = <&clock_gcc clk_gcc_usb30_master_clk>,
+			<&clock_gcc clk_gcc_sys_noc_usb3_axi_clk>,
+			<&clock_gcc clk_gcc_aggre2_usb3_axi_clk>,
+			<&clock_gcc clk_gcc_usb30_mock_utmi_clk>,
+			<&clock_gcc clk_gcc_usb30_sleep_clk>,
+			<&clock_gcc clk_cxo_dwc3_clk>,
+			<&clock_gcc clk_gcc_usb_phy_cfg_ahb2phy_clk>;
+
+		clock-names = "core_clk", "iface_clk", "bus_aggr_clk", "utmi_clk",
+				"sleep_clk", "xo", "cfg_ahb_clk";
+
+		qcom,core-clk-rate = <120000000>;
+
+		resets = <&clock_gcc USB_30_BCR>;
+		reset-names = "core_reset";
+
+		dwc3@6a00000 {
+			compatible = "snps,dwc3";
+			reg = <0x06a00000 0xc8d0>;
+			interrupt-parent = <&intc>;
+			interrupts = <0 131 0>;
+			usb-phy = <&qusb_phy0>, <&ssphy>;
+			tx-fifo-resize;
+			snps,usb3-u1u2-disable;
+			snps,nominal-elastic-buffer;
+			snps,is-utmi-l1-suspend;
+			snps,hird-threshold = /bits/ 8 <0x0>;
+		};
+
+		qcom,usbbam@6b04000 {
+			compatible = "qcom,usb-bam-msm";
+			reg = <0x06b04000 0x1a934>;
+			interrupt-parent = <&intc>;
+			interrupts = <0 132 0>;
+
+			qcom,bam-type = <0>;
+			qcom,usb-bam-fifo-baseaddr = <0x066bb000>;
+			qcom,usb-bam-num-pipes = <8>;
+			qcom,ignore-core-reset-ack;
+			qcom,disable-clk-gating;
+			qcom,usb-bam-override-threshold = <0x4001>;
+			qcom,usb-bam-max-mbps-highspeed = <400>;
+			qcom,usb-bam-max-mbps-superspeed = <3600>;
+			qcom,reset-bam-on-connect;
+
+			qcom,pipe0 {
+				label = "ssusb-ipa-out-0";
+				qcom,usb-bam-mem-type = <1>;
+				qcom,dir = <0>;
+				qcom,pipe-num = <0>;
+				qcom,peer-bam = <1>;
+				qcom,src-bam-pipe-index = <1>;
+				qcom,data-fifo-size = <0x8000>;
+				qcom,descriptor-fifo-size = <0x2000>;
+			};
+			qcom,pipe1 {
+				label = "ssusb-ipa-in-0";
+				qcom,usb-bam-mem-type = <1>;
+				qcom,dir = <1>;
+				qcom,pipe-num = <0>;
+				qcom,peer-bam = <1>;
+				qcom,dst-bam-pipe-index = <0>;
+				qcom,data-fifo-size = <0x8000>;
+				qcom,descriptor-fifo-size = <0x2000>;
+			};
+			qcom,pipe2 {
+				label = "ssusb-qdss-in-0";
+				qcom,usb-bam-mem-type = <2>;
+				qcom,dir = <1>;
+				qcom,pipe-num = <0>;
+				qcom,peer-bam = <0>;
+				qcom,peer-bam-physical-address = <0x03084000>;
+				qcom,src-bam-pipe-index = <0>;
+				qcom,dst-bam-pipe-index = <2>;
+				qcom,data-fifo-offset = <0x0>;
+				qcom,data-fifo-size = <0x1800>;
+				qcom,descriptor-fifo-offset = <0x1800>;
+				qcom,descriptor-fifo-size = <0x800>;
+			};
+			qcom,pipe3 {
+				label = "ssusb-dpl-ipa-in-1";
+				qcom,usb-bam-mem-type = <1>;
+				qcom,dir = <1>;
+				qcom,pipe-num = <1>;
+				qcom,peer-bam = <1>;
+				qcom,dst-bam-pipe-index = <2>;
+				qcom,data-fifo-size = <0x8000>;
+				qcom,descriptor-fifo-size = <0x2000>;
+			};
+		};
+	};
+
+	usb2s: hsusb@7600000 {
+		compatible = "qcom,dwc-usb3-msm";
+		reg = <0x07600000 0xfc000>,
+			<0x7416000 0x400>;
+		reg-names = "core_base",
+			"ahb2phy_base";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		status = "disabled";
+
+		interrupts = <0 352 0>, <0 140 0>;
+		interrupt-names = "hs_phy_irq", "pwr_event_irq";
+
+		qcom,msm-bus,name = "usb-hs";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+					<87 512 0 0>,
+					<87 512 60000 960000>;
+
+		clocks = <&clock_gcc clk_gcc_usb20_master_clk>,
+			 <&clock_gcc clk_gcc_periph_noc_usb20_ahb_clk>,
+			 <&clock_gcc clk_gcc_usb20_mock_utmi_clk>,
+			 <&clock_gcc clk_gcc_usb20_sleep_clk>,
+			 <&clock_gcc clk_cxo_dwc3_clk>,
+			 <&clock_gcc clk_gcc_usb_phy_cfg_ahb2phy_clk>;
+		clock-names = "core_clk", "iface_clk", "utmi_clk", "sleep_clk",
+				"xo", "cfg_ahb_clk";
+		qcom,core-clk-rate = <60000000>;
+		resets = <&clock_gcc USB_20_BCR>;
+		reset-names = "core_reset";
+
+		dwc3@7600000 {
+			compatible = "snps,dwc3";
+			reg = <0x07600000 0xc8d0>;
+			interrupt-parent = <&intc>;
+			interrupts = <0 138 0>;
+			usb-phy = <&qusb_phy1>, <&usb_nop_phy>;
+			maximum-speed = "high-speed";
+			snps,nominal-elastic-buffer;
+			snps,is-utmi-l1-suspend;
+			snps,hird-threshold = /bits/ 8 <0x0>;
+		};
+	};
+
+	android_usb@66bf0c8 {
+		compatible = "qcom,android-usb";
+		reg = <0x066bf0c8 0xc8>;
+		qcom,pm-qos-latency = <301 701 801>;
+	};
+
+	qusb_phy0: qusb@7411000 {
+		compatible = "qcom,qusb2phy";
+		reg = <0x07411000 0x180>,
+			<0x0007024c 0x4>,
+			<0x00388018 0x4>;
+		reg-names = "qusb_phy_base",
+			"tune2_efuse_addr",
+			"ref_clk_addr";
+		vdd-supply = <&pm8994_s2_corner>;
+		vdda18-supply = <&pm8994_l12>;
+		vdda33-supply = <&pm8994_l24>;
+		qcom,vdd-voltage-level = <1 5 7>;
+		qcom,tune2-efuse-bit-pos = <21>;
+		qcom,tune2-efuse-num-bits = <4>;
+		qcom,qusb-phy-init-seq = <0xF8 0x80
+					0xB3 0x84
+					0x83 0x88
+					0xC0 0x8C
+					0x30 0x08
+					0x79 0x0C
+					0x21 0x10
+					0x14 0x9C
+					0x9F 0x1C
+					0x00 0x18>;
+		phy_type= "utmi";
+		qcom,phy-clk-scheme = "cmos";
+		qcom,major-rev = <1>;
+
+		clocks = <&clock_gcc clk_gcc_usb_phy_cfg_ahb2phy_clk>,
+			 <&clock_gcc clk_ln_bb_clk>;
+		clock-names = "cfg_ahb_clk", "ref_clk_src";
+
+		resets = <&clock_gcc QUSB2PHY_PRIM_BCR>;
+		reset-names = "phy_reset";
+	};
+
+	qusb_phy1: qusb@7412000 {
+		compatible = "qcom,qusb2phy";
+		reg = <0x07412000 0x180>,
+			<0x0007024c 0x4>,
+			<0x00388014 0x4>;
+		reg-names = "qusb_phy_base",
+			"tune2_efuse_addr",
+			"ref_clk_addr";
+		vdd-supply = <&pm8994_s2_corner>;
+		vdda18-supply = <&pm8994_l12>;
+		vdda33-supply = <&pm8994_l24>;
+		qcom,vdd-voltage-level = <1 5 7>;
+		qcom,tune2-efuse-bit-pos = <25>;
+		qcom,tune2-efuse-num-bits = <4>;
+		qcom,qusb-phy-init-seq = <0xF8 0x80
+					0xB3 0x84
+					0x83 0x88
+					0xC0 0x8C
+					0x30 0x08
+					0x79 0x0C
+					0x21 0x10
+					0x14 0x9C
+					0x9F 0x1C
+					0x00 0x18>;
+		phy_type = "utmi";
+		qcom,phy-clk-scheme = "cmos";
+		qcom,major-rev = <1>;
+		qcom,hold-reset;
+
+		clocks = <&clock_gcc clk_gcc_usb_phy_cfg_ahb2phy_clk>,
+			<&clock_gcc clk_ln_bb_clk>;
+		clock-names = "cfg_ahb_clk", "ref_clk_src";
+
+		resets = <&clock_gcc QUSB2PHY_SEC_BCR>;
+		reset-names = "phy_reset";
+	};
+
+	ssphy: ssphy@7410000 {
+		compatible = "qcom,usb-ssphy-qmp-v2";
+		reg = <0x7410000 0x7a8>,
+		      <0x007ab244 0x4>;
+		reg-names = "qmp_phy_base",
+			    "vls_clamp_reg";
+		vdd-supply = <&pm8994_l28>;
+		core-supply = <&pm8994_l12>;
+		qcom,core-voltage-level = <0 1800000 1800000>;
+		qcom,vdd-voltage-level = <0 925000 925000>;
+		qcom,vbus-valid-override;
+		qcom,qmp-phy-init-seq =
+			/* <reg_offset, value, delay> */
+				<0xac  0x14 0x00 /* common block settings */
+				 0x34  0x08 0x00
+				 0x174 0x30 0x00
+				 0x194 0x06 0x00
+				 0x19c 0x01 0x00
+				 0x178 0x00 0x00
+				 0x70  0x0f 0x00
+				 0x48  0x0f 0x00
+				 0x3c  0x04 0x00
+				 0xd0  0x82 0x00 /* pll and loop filter settings*/
+				 0xdc  0x55 0x00
+				 0xe0  0x55 0x00
+				 0xe4  0x03 0x00
+				 0x78  0x0b 0x00
+				 0x84  0x16 0x00
+				 0x90  0x28 0x00
+				 0x108 0x80 0x00
+				 0x124 0x00 0x00
+				 0x4c  0x15 0x00
+				 0x50  0x34 0x00
+				 0x18c 0x00 0x00
+				 0xcc  0x00 0x00
+				 0x128 0x00 0x00
+				 0x0c  0x0a 0x00
+				 0x10  0x01 0x00 /* ssc settings */
+				 0x1c  0x31 0x00
+				 0x20  0x01 0x00
+				 0x14  0x00 0x00
+				 0x18  0x00 0x00
+				 0x24  0xde 0x00
+				 0x28  0x07 0x00
+				 0x440 0x0b 0x00 /* Rx settings */
+				 0x41c 0x04 0x00
+				 0x4d8 0x02 0x00
+				 0x4dc 0x4c 0x00
+				 0x4e0 0xbb 0x00
+				 0x508 0x77 0x00
+				 0x50c 0x80 0x00
+				 0x514 0x03 0x00
+				 0x518 0x18 0x00
+				 0x51c 0x16 0x00
+				 0x268 0x45 0x00 /* Tx settings */
+				 0x2ac 0x12 0x00
+				 0x294 0x06 0x00
+				 0x6c4 0x03 0x00 /* FLL settings */
+				 0x6c0 0x02 0x00
+				 0x6c8 0x09 0x00
+				 0x6cc 0x42 0x00
+				 0x6d0 0x85 0x00
+				 0x680 0xd1 0x00 /* Lock Det settings */
+				 0x684 0x1f 0x00
+				 0x688 0x47 0x00
+				 0x664 0x08 0x00
+				 0xffffffff 0xffffffff 0x00>;
+
+		qcom,qmp-phy-reg-offset =
+				<0x77c /* USB3_PHY_PCS_STATUS */
+				 0x6d4 /* USB3_PHY_AUTONOMOUS_MODE_CTRL */
+				 0x6d8 /* USB3_PHY_LFPS_RXTERM_IRQ_CLEAR */
+				 0x604 /* USB3_PHY_POWER_DOWN_CONTROL */
+				 0x600 /* USB3_PHY_SW_RESET */
+				 0x608>; /* USB3_PHY_START */
+
+		clocks = <&clock_gcc clk_gcc_usb3_phy_aux_clk>,
+			 <&clock_gcc clk_gcc_usb3_phy_pipe_clk>,
+			 <&clock_gcc clk_gcc_usb_phy_cfg_ahb2phy_clk>,
+			 <&clock_gcc clk_ln_bb_clk>,
+			 <&clock_gcc clk_gcc_usb3_clkref_clk>;
+
+		clock-names = "aux_clk", "pipe_clk", "cfg_ahb_clk",
+				"ref_clk_src", "ref_clk";
+
+		resets = <&clock_gcc USB3_PHY_BCR>,
+			 <&clock_gcc USB3PHY_PHY_BCR>;
+		reset-names = "phy_reset", "phy_phy_reset";
+	};
+
+	usb_nop_phy: usb_nop_phy {
+		compatible = "usb-nop-xceiv";
+	};
+
+	dbm_1p5: dbm@6af8000 {
+		compatible = "qcom,usb-dbm-1p5";
+		reg = <0x06af8000 0x300>;
+		qcom,reset-ep-after-lpm-resume;
+	};
+
+	qcom,lpass@9300000 {
+		compatible = "qcom,pil-tz-generic";
+		reg = <0x9300000 0x00100>;
+		interrupts = <0 162 1>;
+
+		vdd_cx-supply = <&pm8994_s1_corner>;
+		qcom,proxy-reg-names = "vdd_cx";
+		qcom,vdd_cx-uV-uA = <7 100000>;
+
+		clocks = <&clock_gcc clk_cxo_pil_lpass_clk>;
+		clock-names = "xo";
+		qcom,proxy-clock-names = "xo";
+
+		qcom,pas-id = <1>;
+		qcom,proxy-timeout-ms = <10000>;
+		qcom,smem-id = <423>;
+		qcom,sysmon-id = <1>;
+		qcom,ssctl-instance-id = <0x14>;
+		qcom,firmware-name = "adsp";
+		qcom,edge = "lpass";
+		memory-region = <&peripheral_mem>;
+
+		/* GPIO inputs from lpass */
+		qcom,gpio-err-fatal = <&smp2pgpio_ssr_smp2p_2_in 0 0>;
+		qcom,gpio-proxy-unvote = <&smp2pgpio_ssr_smp2p_2_in 2 0>;
+		qcom,gpio-err-ready = <&smp2pgpio_ssr_smp2p_2_in 1 0>;
+		qcom,gpio-stop-ack = <&smp2pgpio_ssr_smp2p_2_in 3 0>;
+
+		/* GPIO output to lpass */
+		qcom,gpio-force-stop = <&smp2pgpio_ssr_smp2p_2_out 0 0>;
+	};
+
+	qcom,venus@ce0000 {
+		compatible = "qcom,pil-tz-generic";
+		reg = <0xce0000 0x4000>;
+
+		vdd-supply = <&gdsc_venus>;
+		qcom,proxy-reg-names = "vdd";
+
+		clocks = <&clock_mmss clk_video_core_clk>,
+			<&clock_mmss clk_video_ahb_clk>,
+			<&clock_mmss clk_video_axi_clk>,
+			<&clock_mmss clk_video_maxi_clk>;
+		clock-names = "core_clk", "iface_clk",
+				"bus_clk", "maxi_clk";
+		qcom,proxy-clock-names = "core_clk", "iface_clk",
+				"bus_clk", "maxi_clk";
+
+		qcom,msm-bus,name = "pil-venus";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<63 512 0 0>,
+				<63 512 0 304000>;
+		qcom,pas-id = <9>;
+		qcom,proxy-timeout-ms = <100>;
+		qcom,firmware-name = "venus";
+		memory-region = <&peripheral_mem>;
+	};
+
+	qcom,cnss {
+		compatible = "qcom,cnss";
+		wlan-bootstrap-gpio = <&tlmm 46 0>;
+		vdd-wlan-en-supply = <&wlan_en_vreg>;
+		vdd-wlan-supply = <&rome_vreg>;
+		vdd-wlan-io-supply = <&pm8994_s4>;
+		vdd-wlan-xtal-supply = <&pm8994_l30>;
+		vdd-wlan-core-supply = <&pm8994_s3>;
+		wlan-ant-switch-supply = <&pm8994_l18_pin_ctrl>;
+		qcom,wlan-en-vreg-support;
+		qcom,notify-modem-status;
+		pinctrl-names = "bootstrap_active", "bootstrap_sleep";
+		pinctrl-0 = <&cnss_bootstrap_active>;
+		pinctrl-1 = <&cnss_bootstrap_sleep>;
+		qcom,wlan-rc-num = <0>;
+		qcom,wlan-ramdump-dynamic = <0x200000>;
+
+		qcom,msm-bus,name = "msm-cnss";
+		qcom,msm-bus,num-cases = <4>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+					/* No vote */
+					<45 512 0 0>,
+					/* Up to 200 Mbps */
+					<45 512 41421 1520000>,
+					/* Up to 400 Mbps */
+					<45 512 96650 1520000>,
+					/* Up to 800 Mbps */
+					<45 512 207108 14432000>;
+	};
+
+	wil6210: qcom,wil6210 {
+		compatible = "qcom,wil6210";
+		qcom,pcie-parent = <&pcie1>;
+		qcom,wigig-en = <&tlmm 94 0>;
+		qcom,sleep-clk-en = <&pm8994_gpios 18 0>;
+		qcom,msm-bus,name = "wil6210";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<100 512 0 0>,
+			<100 512 600000 800000>; /* ~4.6Gbps (MCS12) */
+		status = "disabled";
+	};
+
+	qcom,ssc@1c00000 {
+		compatible = "qcom,pil-tz-generic";
+		reg = <0x1c00000 0x4000>;
+		interrupts = <0 390 1>;
+
+		vdd_cx-supply = <&pm8994_l26_corner>;
+		vdd_px-supply = <&pm8994_lvs2>;
+		qcom,vdd_cx-uV-uA = <5 0>;
+		qcom,proxy-reg-names = "vdd_cx", "vdd_px";
+		qcom,keep-proxy-regs-on;
+
+		clocks = <&clock_gcc clk_cxo_pil_ssc_clk>,
+			 <&clock_gcc clk_aggre2_noc_clk>;
+		clock-names = "xo", "aggre2";
+		qcom,proxy-clock-names = "xo", "aggre2";
+
+		qcom,pas-id = <12>;
+		qcom,proxy-timeout-ms = <10000>;
+		qcom,smem-id = <424>;
+		qcom,sysmon-id = <3>;
+		qcom,ssctl-instance-id = <0x16>;
+		qcom,firmware-name = "slpi";
+		qcom,edge = "dsps";
+		memory-region = <&peripheral_mem>;
+
+		/* GPIO inputs from ssc */
+		qcom,gpio-err-fatal = <&smp2pgpio_ssr_smp2p_3_in 0 0>;
+		qcom,gpio-proxy-unvote = <&smp2pgpio_ssr_smp2p_3_in 2 0>;
+		qcom,gpio-err-ready = <&smp2pgpio_ssr_smp2p_3_in 1 0>;
+		qcom,gpio-stop-ack = <&smp2pgpio_ssr_smp2p_3_in 3 0>;
+
+		/* GPIO output to ssc */
+		qcom,gpio-force-stop = <&smp2pgpio_ssr_smp2p_3_out 0 0>;
+	};
+
+       pil_modem: qcom,mss@2080000 {
+                compatible = "qcom,pil-q6v55-mss";
+                reg = <0x2080000 0x100>,
+		      <0x0763000 0x008>,
+		      <0x0765000 0x008>,
+		      <0x0764000 0x008>,
+		      <0x2180000 0x020>,
+		      <0x038f008 0x004>;
+		reg-names = "qdsp6_base", "halt_q6", "halt_modem",
+			"halt_nc", "rmb_base", "restart_reg";
+
+		clocks = <&clock_gcc clk_cxo_clk_src>,
+			 <&clock_gcc clk_gcc_mss_cfg_ahb_clk>,
+			 <&clock_gcc clk_pnoc_clk>,
+			 <&clock_gcc clk_gcc_mss_q6_bimc_axi_clk>,
+			 <&clock_gcc clk_gcc_boot_rom_ahb_clk>,
+			 <&clock_gcc clk_gpll0_out_msscc>,
+			 <&clock_gcc clk_gcc_mss_snoc_axi_clk>,
+			 <&clock_gcc clk_gcc_mss_mnoc_bimc_axi_clk>,
+			 <&clock_gcc clk_qdss_clk>;
+		clock-names = "xo", "iface_clk", "pnoc_clk", "bus_clk",
+			      "mem_clk", "gpll0_mss_clk", "snoc_axi_clk",
+			      "mnoc_axi_clk", "qdss_clk";
+		qcom,proxy-clock-names = "xo", "pnoc_clk", "qdss_clk";
+		qcom,active-clock-names = "iface_clk", "bus_clk", "mem_clk",
+					  "gpll0_mss_clk", "snoc_axi_clk",
+					  "mnoc_axi_clk";
+
+		interrupts = <0 448 1>;
+		vdd_cx-supply = <&pm8994_s1_corner>;
+		vdd_cx-voltage = <7>;
+		vdd_mx-supply = <&pm8994_s2_corner>;
+		vdd_mx-uV = <6>;
+		vdd_pll-supply = <&pm8994_l12>;
+		qcom,vdd_pll = <1800000>;
+		qcom,firmware-name = "modem";
+		qcom,pil-self-auth;
+		qcom,sysmon-id = <0>;
+		qcom,ssctl-instance-id = <0x12>;
+		qcom,override-acc;
+		qcom,ahb-clk-vote;
+		qcom,pnoc-clk-vote;
+		qcom,qdsp6v56-1-5;
+		qcom,mx-spike-wa;
+		memory-region = <&modem_mem>;
+		qcom,mem-protect-id = <0xF>;
+
+		/* GPIO inputs from mss */
+		qcom,gpio-err-fatal = <&smp2pgpio_ssr_smp2p_1_in 0 0>;
+		qcom,gpio-err-ready = <&smp2pgpio_ssr_smp2p_1_in 1 0>;
+		qcom,gpio-proxy-unvote = <&smp2pgpio_ssr_smp2p_1_in 2 0>;
+		qcom,gpio-stop-ack = <&smp2pgpio_ssr_smp2p_1_in 3 0>;
+		qcom,gpio-shutdown-ack = <&smp2pgpio_ssr_smp2p_1_in 7 0>;
+
+		/* GPIO output to mss */
+		qcom,gpio-force-stop = <&smp2pgpio_ssr_smp2p_1_out 0 0>;
+		status = "ok";
+	};
+
+	tsens0: tsens@4a9000 {
+		compatible = "qcom,msm8996-tsens";
+		reg = <0x4a8000 0x2000>,
+			<0x74230 0x1000>;
+		reg-names = "tsens_physical", "tsens_eeprom_physical";
+		interrupts = <0 184 0>, <0 430 0>;
+		interrupt-names = "tsens-upper-lower", "tsens-critical";
+		qcom,sensors = <16>;
+		qcom,slope = <2901 2846 3200 3200 3200 3200 3200 3200 3200 3200 3200 3200 3200 3200 3200 3200>;
+	};
+
+	spi_0: spi@7575000 { /* BLSP1 QUP1 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0x07575000 0x600>,
+		      <0x07544000 0x2b000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 95 0>, <0 238 0>;
+		spi-max-frequency = <19200000>;
+
+		qcom,infinite-mode = <0>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <12>;
+		qcom,bam-producer-pipe-index = <13>;
+		qcom,master-id = <86>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_0_active &spi_0_cs_active>;
+		pinctrl-1 = <&spi_0_sleep &spi_0_cs_sleep>;
+
+		clock-names = "iface_clk", "core_clk";
+
+		clocks = <&clock_gcc clk_gcc_blsp1_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp1_qup1_spi_apps_clk>;
+	};
+
+	qcom,rmnet-ipa {
+		compatible = "qcom,rmnet-ipa";
+		qcom,rmnet-ipa-ssr;
+		qcom,ipa-loaduC;
+		qcom,ipa-advertise-sg-support;
+	};
+
+	qcom_rng: qrng@83000 {
+		compatible = "qcom,msm-rng";
+		reg = <0x83000 0x1000>;
+		qcom,msm-rng-iface-clk;
+		qcom,no-qrng-config;
+		qcom,msm-bus,name = "msm-rng-noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<1 618 0 0>,		/* No vote */
+				<1 618 0 800>;		/* 100 MB/s */
+		clocks = <&clock_gcc clk_gcc_prng_ahb_clk>;
+		clock-names = "iface_clk";
+	};
+
+	qcom_crypto: qcrypto@660000 {
+		compatible = "qcom,qcrypto";
+		reg = <0x660000 0x20000>,
+		      <0x644000 0x24000>;
+		reg-names = "crypto-base","crypto-bam-base";
+		interrupts = <0 206 0>;
+		qcom,bam-pipe-pair = <2>;
+		qcom,ce-hw-instance = <0>;
+		qcom,ce-device = <0>;
+		qcom,bam-ee = <0>;
+		qcom,ce-hw-shared;
+		qcom,clk-mgmt-sus-res;
+		qcom,msm-bus,name = "qcrypto-noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<55 512 0 0>,
+				<55 512 3936000 393600>;
+		clock-names = "core_clk_src", "core_clk",
+				"iface_clk", "bus_clk";
+		clocks = <&clock_gcc clk_qcrypto_ce1_clk>,
+			 <&clock_gcc clk_qcrypto_ce1_clk>,
+			 <&clock_gcc clk_gcc_ce1_ahb_m_clk>,
+			 <&clock_gcc clk_gcc_ce1_axi_m_clk>;
+		qcom,ce-opp-freq = <171430000>;
+		qcom,use-sw-aes-cbc-ecb-ctr-algo;
+		qcom,use-sw-aes-xts-algo;
+		qcom,use-sw-aes-ccm-algo;
+		qcom,use-sw-ahash-algo;
+		qcom,use-sw-hmac-algo;
+		qcom,use-sw-aead-algo;
+	};
+
+	qcom_cedev: qcedev@660000 {
+		compatible = "qcom,qcedev";
+		reg = <0x660000 0x20000>,
+		      <0x644000 0x24000>;
+		reg-names = "crypto-base","crypto-bam-base";
+		interrupts = <0 206 0>;
+		qcom,bam-pipe-pair = <1>;
+		qcom,ce-hw-instance = <0>;
+		qcom,ce-device = <0>;
+		qcom,ce-hw-shared;
+		qcom,bam-ee = <0>;
+		qcom,msm-bus,name = "qcedev-noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<55 512 0 0>,
+				<55 512 3936000 393600>;
+		clock-names = "core_clk_src", "core_clk",
+				"iface_clk", "bus_clk";
+		clocks = <&clock_gcc clk_qcedev_ce1_clk>,
+			 <&clock_gcc clk_qcedev_ce1_clk>,
+			 <&clock_gcc clk_gcc_ce1_ahb_m_clk>,
+			 <&clock_gcc clk_gcc_ce1_axi_m_clk>;
+		qcom,ce-opp-freq = <171430000>;
+	};
+
+	qcom_seecom: qseecom@86600000 {
+		compatible = "qcom,qseecom";
+		reg = <0x86600000 0x2200000>;
+		reg-names = "secapp-region";
+		qcom,hlos-num-ce-hw-instances = <1>;
+		qcom,hlos-ce-hw-instance = <0>;
+		qcom,qsee-ce-hw-instance = <0>;
+		qcom,disk-encrypt-pipe-pair = <2>;
+		qcom,support-fde;
+		qcom,no-clock-support;
+		qcom,appsbl-qseecom-support;
+		qcom,msm-bus,name = "qseecom-noc";
+		qcom,msm-bus,num-cases = <4>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<55 512 0 0>,
+				<55 512 0 0>,
+				<55 512 120000 1200000>,
+				<55 512 393600 3936000>;
+		clock-names = "core_clk_src", "core_clk",
+				"iface_clk", "bus_clk";
+		clocks = <&clock_gcc clk_ce1_clk>,
+			 <&clock_gcc clk_qseecom_ce1_clk>,
+			 <&clock_gcc clk_gcc_ce1_ahb_m_clk>,
+			 <&clock_gcc clk_gcc_ce1_axi_m_clk>;
+		qcom,ce-opp-freq = <171430000>;
+		qcom,qsee-reentrancy-support = <2>;
+	};
+
+	qcom,qbt1000 {
+		compatible = "qcom,qbt1000";
+		qcom,fingerprint-sensor-ssc-spi-conn {
+			qcom,spi-port-id = <2>;
+			qcom,spi-port-slave-index = <0>;
+			qcom,tz-subsys-id = <1>;
+			qcom,ssc-subsys-id = <5>;
+			clock-frequency = <15000000>;
+		};
+	};
+
+	qcom,sensor-information {
+		compatible = "qcom,sensor-information";
+		sensor_information0: qcom,sensor-information-0 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor0";
+			qcom,scaling-factor = <10>;
+		};
+
+		sensor_information1: qcom,sensor-information-1 {
+			qcom,sensor-type =  "tsens";
+			qcom,sensor-name = "tsens_tz_sensor1";
+			qcom,alias-name = "pop_mem";
+			qcom,scaling-factor = <10>;
+		};
+
+		sensor_information2: qcom,sensor-information-2 {
+			qcom,sensor-type =  "tsens";
+			qcom,sensor-name = "tsens_tz_sensor2";
+			qcom,scaling-factor = <10>;
+		};
+
+		sensor_information3: qcom,sensor-information-3 {
+			qcom,sensor-type =  "tsens";
+			qcom,sensor-name = "tsens_tz_sensor3";
+			qcom,scaling-factor = <10>;
+		};
+
+		sensor_information4: qcom,sensor-information-4 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor4";
+			qcom,scaling-factor = <10>;
+		};
+
+		sensor_information5: qcom,sensor-information-5 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor5";
+			qcom,scaling-factor = <10>;
+		};
+
+		sensor_information6: qcom,sensor-information-6 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor6";
+			qcom,scaling-factor = <10>;
+		};
+
+		sensor_information7: qcom,sensor-information-7 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor7";
+			qcom,scaling-factor = <10>;
+		};
+
+		sensor_information8: qcom,sensor-information-8 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor8";
+			qcom,scaling-factor = <10>;
+		};
+
+		sensor_information9: qcom,sensor-information-9 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor9";
+			qcom,scaling-factor = <10>;
+		};
+
+		sensor_information10: qcom,sensor-information-10 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor10";
+			qcom,scaling-factor = <10>;
+		};
+
+		sensor_information11: qcom,sensor-information-11 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor11";
+			qcom,scaling-factor = <10>;
+		};
+
+		sensor_information12: qcom,sensor-information-12 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor12";
+			qcom,scaling-factor = <10>;
+		};
+
+		sensor_information13: qcom,sensor-information-13 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor13";
+			qcom,scaling-factor = <10>;
+		};
+
+		sensor_information14: qcom,sensor-information-14 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor14";
+			qcom,scaling-factor = <10>;
+		};
+
+		sensor_information15: qcom,sensor-information-15 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor15";
+			qcom,alias-name = "gpu";
+			qcom,scaling-factor = <10>;
+		};
+
+		sensor_information16: qcom,sensor-information-16 {
+			qcom,sensor-type =  "alarm";
+			qcom,sensor-name = "pm8994_tz";
+			qcom,scaling-factor = <1000>;
+		};
+
+		sensor_information17: qcom,sensor-information-17 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "msm_therm";
+		};
+
+		sensor_information18: qcom,sensor-information-18 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "emmc_therm";
+		};
+
+		sensor_information19: qcom,sensor-information-19 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "pa_therm0";
+		};
+
+		sensor_information20: qcom,sensor-information-20 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "pa_therm1";
+		};
+
+		sensor_information21: qcom,sensor-information-21 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "quiet_therm";
+		};
+		sensor_information22: qcom,sensor-information-22 {
+			qcom,sensor-type =  "llm";
+			qcom,sensor-name = "DLMt_APC1";
+		};
+		sensor_information23: qcom,sensor-information-23 {
+			qcom,sensor-type =  "llm";
+			qcom,sensor-name = "LLM_m4m0";
+		};
+		sensor_information24: qcom,sensor-information-24 {
+			qcom,sensor-type =  "llm";
+			qcom,sensor-name = "LLM_cp10";
+		};
+		sensor_information25: qcom,sensor-information-25 {
+			qcom,sensor-type =  "llm";
+			qcom,sensor-name = "LLM_l3--";
+		};
+		sensor_information26: qcom,sensor-information-26 {
+			qcom,sensor-type =  "llm";
+			qcom,sensor-name = "LLM_cp01";
+		};
+		sensor_information27: qcom,sensor-information-27 {
+			qcom,sensor-type =  "llm";
+			qcom,sensor-name = "LLM_cp00";
+		};
+		sensor_information28: qcom,sensor-information-28 {
+			qcom,sensor-type =  "llm";
+			qcom,sensor-name = "LLM_l21-";
+		};
+		sensor_information29: qcom,sensor-information-29 {
+			qcom,sensor-type =  "llm";
+			qcom,sensor-name = "LLM_cp11";
+		};
+		sensor_information30: qcom,sensor-information-30 {
+			qcom,sensor-type =  "llm";
+			qcom,sensor-name = "LLM_l20-";
+		};
+		sensor_information31: qcom,sensor-information-31 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor16";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information32: qcom,sensor-information-32 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor17";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information33: qcom,sensor-information-33 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor18";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information34: qcom,sensor-information-34 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor19";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information35: qcom,sensor-information-35 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor20";
+			qcom,scaling-factor = <10>;
+		};
+	};
+
+	mitigation_profile0: qcom,limit_info-0 {
+		qcom,temperature-sensor = <&sensor_information4>;
+		qcom,boot-frequency-mitigate;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile1: qcom,limit_info-1 {
+		qcom,temperature-sensor = <&sensor_information6>;
+		qcom,boot-frequency-mitigate;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile2: qcom,limit_info-2 {
+		qcom,temperature-sensor = <&sensor_information9>;
+		qcom,boot-frequency-mitigate;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile3: qcom,limit_info-3 {
+		qcom,temperature-sensor = <&sensor_information11>;
+		qcom,boot-frequency-mitigate;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	qcom,msm-thermal {
+		compatible = "qcom,msm-thermal";
+		reg = <0x70000 0x1000>;
+		qcom,sensor-id = <11>;
+		qcom,poll-ms = <100>;
+		qcom,limit-temp = <60>;
+		qcom,temp-hysteresis = <10>;
+		qcom,therm-reset-temp = <115>;
+		qcom,freq-step = <4>;
+		qcom,core-limit-temp = <70>;
+		qcom,core-temp-hysteresis = <10>;
+		qcom,hotplug-temp = <105>;
+		qcom,hotplug-temp-hysteresis = <40>;
+		qcom,freq-mitigation-temp = <90>;
+		qcom,freq-mitigation-temp-hysteresis = <40>;
+		qcom,freq-mitigation-value = <576000>;
+		qcom,online-hotplug-core;
+		qcom,synchronous-cluster-id = <0 1>;
+		qcom,synchronous-cluster-map = <0 2 &CPU0 &CPU1>,
+			<1 2 &CPU2 &CPU3>;
+
+		qcom,vdd-restriction-temp = <5>;
+		qcom,vdd-restriction-temp-hysteresis = <10>;
+
+		vdd-dig-supply = <&pm8994_s1_floor_corner>;
+		vdd-gfx-supply = <&gfx_vreg>;
+
+		qcom,vdd-dig-rstr{
+			qcom,vdd-rstr-reg = "vdd-dig";
+			qcom,levels = <5 7 7>; /* Nominal, Super Turbo, Super Turbo */
+			qcom,min-level = <1>; /* No Request */
+		};
+
+		qcom,vdd-gfx-rstr{
+			qcom,vdd-rstr-reg = "vdd-gfx";
+			qcom,levels = <4 7 7>; /* Nominal, Turbo, Turbo */
+			qcom,min-level = <1>; /* No Request */
+		};
+
+		msm_thermal_freq: qcom,vdd-apps-rstr{
+			qcom,vdd-rstr-reg = "vdd-apps";
+			qcom,levels = <576000 600000 600000>;
+			qcom,freq-req;
+		};
+	};
+
+	qcom,bcl {
+		compatible = "qcom,bcl";
+		qcom,bcl-enable;
+		qcom,bcl-framework-interface;
+		qcom,bcl-freq-control-list = <&CPU2 &CPU3>;
+		qcom,bcl-hotplug-list = <&CPU2 &CPU3>;
+		qcom,bcl-soc-hotplug-list = <&CPU2 &CPU3>;
+		qcom,ibat-monitor {
+			qcom,low-threshold-uamp = <3400000>;
+			qcom,high-threshold-uamp = <4200000>;
+			qcom,mitigation-freq-khz = <576000>;
+			qcom,vph-high-threshold-uv = <3500000>;
+			qcom,vph-low-threshold-uv = <3300000>;
+			qcom,soc-low-threshold = <10>;
+			qcom,thermal-handle = <&msm_thermal_freq>;
+		};
+	};
+
+	qcom,memshare {
+		compatible = "qcom,memshare";
+
+		qcom,client_1 {
+			compatible = "qcom,memshare-peripheral";
+			qcom,peripheral-size = <0x200000>;
+			qcom,client-id = <0>;
+			label = "modem";
+		};
+
+		qcom,client_2 {
+			compatible = "qcom,memshare-peripheral";
+			qcom,peripheral-size = <0x300000>;
+			qcom,client-id = <2>;
+			label = "modem";
+		};
+
+		qcom,client_3 {
+			compatible = "qcom,memshare-peripheral";
+			qcom,peripheral-size = <0x0>;
+			qcom,client-id = <1>;
+			label = "modem";
+		};
+	};
+
+	qcom,msm-core@70000 {
+		compatible = "qcom,apss-core-ea";
+		reg = <0x70000 0x1000>;
+		qcom,low-hyst-temp = <10>;
+		qcom,high-hyst-temp = <5>;
+		qcom,polling-interval = <50>;
+
+		ea0: ea0 {
+			sensor = <&sensor_information4>;
+		};
+
+		ea1: ea1 {
+			sensor = <&sensor_information6>;
+		};
+
+		ea2: ea2 {
+			sensor = <&sensor_information9>;
+		};
+
+		ea3: ea3 {
+			sensor = <&sensor_information11>;
+		};
+	};
+
+	cpuss_dump {
+		compatible = "qcom,cpuss-dump";
+		qcom,l2_dump0 {
+			qcom,dump-node = <&L2_0>;
+			qcom,dump-id = <0xC0>;
+		};
+		qcom,l2_dump1 {
+			qcom,dump-node = <&L2_1>;
+			qcom,dump-id = <0xC1>;
+		};
+		qcom,l1_d_dump0 {
+			qcom,dump-node = <&L1_D_0>;
+			qcom,dump-id = <0x80>;
+		};
+		qcom,l1_d_dump1 {
+			qcom,dump-node = <&L1_D_1>;
+			qcom,dump-id = <0x81>;
+		};
+		qcom,l1_d_dump100 {
+			qcom,dump-node = <&L1_D_100>;
+			qcom,dump-id = <0x82>;
+		};
+		qcom,l1_d_dump101 {
+			qcom,dump-node = <&L1_D_101>;
+			qcom,dump-id = <0x83>;
+		};
+		qcom,l1_tlb_dump0 {
+			qcom,dump-node = <&L1_TLB_0>;
+			qcom,dump-id = <0x20>;
+		};
+		qcom,l1_tlb_dump1 {
+			qcom,dump-node = <&L1_TLB_1>;
+			qcom,dump-id = <0x21>;
+		};
+		qcom,l1_tlb_dump100 {
+			qcom,dump-node = <&L1_TLB_100>;
+			qcom,dump-id = <0x22>;
+		};
+		qcom,l1_tlb_dump101 {
+			qcom,dump-node = <&L1_TLB_101>;
+			qcom,dump-id = <0x23>;
+		};
+	};
+
+	qcom_tzlog: tz-log@66bf720 {
+		compatible = "qcom,tz-log";
+		reg = <0x066bf720 0x2000>;
+		qcom,hyplog-enabled;
+		hyplog-address-offset = <0x410>; /* 0x066BFB30 */
+		hyplog-size-offset = <0x414>;    /* 0x066BFB34 */
+	};
+
+	sound-9335 {
+		compatible = "qcom,msm8996-asoc-snd-tasha";
+		qcom,model = "msm8996-tasha-snd-card";
+
+		qcom,audio-routing =
+			"AIF4 VI", "MCLK",
+			"RX_BIAS", "MCLK",
+			"MADINPUT", "MCLK",
+			"AMIC2", "MIC BIAS2",
+			"MIC BIAS2", "Headset Mic",
+			"AMIC3", "MIC BIAS2",
+			"MIC BIAS2", "ANCRight Headset Mic",
+			"AMIC4", "MIC BIAS2",
+			"MIC BIAS2", "ANCLeft Headset Mic",
+			"AMIC5", "MIC BIAS3",
+			"MIC BIAS3", "Handset Mic",
+			"AMIC6", "MIC BIAS4",
+			"MIC BIAS4", "Analog Mic6",
+			"DMIC0", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic0",
+			"DMIC1", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic1",
+			"DMIC2", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic2",
+			"DMIC3", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic3",
+			"DMIC4", "MIC BIAS4",
+			"MIC BIAS4", "Digital Mic4",
+			"DMIC5", "MIC BIAS4",
+			"MIC BIAS4", "Digital Mic5",
+			"SpkrLeft IN", "SPK1 OUT",
+			"SpkrRight IN", "SPK2 OUT";
+
+		qcom,msm-mbhc-hphl-swh = <0>;
+		qcom,msm-mbhc-gnd-swh = <0>;
+		qcom,tasha-mclk-clk-freq = <9600000>;
+		asoc-platform = <&pcm0>, <&pcm1>, <&pcm2>, <&voip>, <&voice>,
+				<&loopback>, <&compress>, <&hostless>,
+				<&afe>, <&lsm>, <&routing>, <&cpe>,
+				<&compr>, <&pcmnoirq>, <&cpe3>;
+		asoc-platform-names = "msm-pcm-dsp.0", "msm-pcm-dsp.1", "msm-pcm-dsp.2",
+				"msm-voip-dsp", "msm-pcm-voice", "msm-pcm-loopback",
+				"msm-compress-dsp", "msm-pcm-hostless", "msm-pcm-afe",
+				"msm-lsm-client", "msm-pcm-routing", "msm-cpe-lsm",
+				"msm-compr-dsp", "msm-pcm-dsp-noirq",
+				"msm-cpe-lsm.3";
+		asoc-cpu = <&dai_pri_auxpcm>, <&dai_sec_auxpcm>, <&dai_hdmi>, <&dai_mi2s>,
+				<&sb_0_rx>, <&sb_0_tx>, <&sb_1_rx>, <&sb_1_tx>,
+				<&sb_2_rx>, <&sb_2_tx>, <&sb_3_rx>, <&sb_3_tx>,
+				<&sb_4_rx>, <&sb_4_tx>, <&sb_5_tx>, <&afe_pcm_rx>,
+				<&afe_pcm_tx>, <&afe_proxy_rx>, <&afe_proxy_tx>,
+				<&incall_record_rx>, <&incall_record_tx>,
+				<&incall_music_rx>, <&incall_music2_rx>,
+				<&sb_5_rx>, <&sb_6_rx>;
+		asoc-cpu-names = "msm-dai-q6-auxpcm.1", "msm-dai-q6-auxpcm.2",
+				"msm-dai-q6-hdmi.8", "msm-dai-q6-mi2s.2",
+				"msm-dai-q6-dev.16384", "msm-dai-q6-dev.16385",
+				"msm-dai-q6-dev.16386", "msm-dai-q6-dev.16387",
+				"msm-dai-q6-dev.16388", "msm-dai-q6-dev.16389",
+				"msm-dai-q6-dev.16390", "msm-dai-q6-dev.16391",
+				"msm-dai-q6-dev.16392", "msm-dai-q6-dev.16393",
+				"msm-dai-q6-dev.16395", "msm-dai-q6-dev.224",
+				"msm-dai-q6-dev.225", "msm-dai-q6-dev.241",
+				"msm-dai-q6-dev.240", "msm-dai-q6-dev.32771",
+				"msm-dai-q6-dev.32772", "msm-dai-q6-dev.32773",
+				"msm-dai-q6-dev.32770", "msm-dai-q6-dev.16394",
+				"msm-dai-q6-dev.16396";
+		asoc-codec = <&stub_codec>;
+		asoc-codec-names = "msm-stub-codec.1";
+	};
+
+	qcom,msm-adsp-loader {
+		status = "ok";
+		compatible = "qcom,adsp-loader";
+		qcom,adsp-state = <0>;
+	};
+
+	qcom,msm-audio-ion {
+		compatible = "qcom,msm-audio-ion";
+		qcom,smmu-version = <2>;
+		qcom,smmu-enabled;
+		iommus = <&lpass_q6_smmu 1>;
+	};
+
+	pcm0: qcom,msm-pcm {
+		compatible = "qcom,msm-pcm-dsp";
+		qcom,msm-pcm-dsp-id = <0>;
+	};
+
+	pcm1: qcom,msm-pcm-low-latency {
+		compatible = "qcom,msm-pcm-dsp";
+		qcom,msm-pcm-dsp-id = <1>;
+		qcom,msm-pcm-low-latency;
+		qcom,latency-level = "regular";
+	};
+
+	pcm2: qcom,msm-ultra-low-latency {
+		compatible = "qcom,msm-pcm-dsp";
+		qcom,msm-pcm-dsp-id = <2>;
+		qcom,msm-pcm-low-latency;
+		qcom,latency-level = "ultra";
+	};
+
+	routing: qcom,msm-pcm-routing {
+		compatible = "qcom,msm-pcm-routing";
+	};
+
+	compr: qcom,msm-compr-dsp {
+		compatible = "qcom,msm-compr-dsp";
+	};
+
+	compress: qcom,msm-compress-dsp {
+		compatible = "qcom,msm-compress-dsp";
+	};
+
+	pcmnoirq: qcom,msm-pcm-dsp-noirq {
+		compatible = "qcom,msm-pcm-dsp-noirq";
+		qcom,msm-pcm-low-latency;
+		qcom,latency-level = "ultra";
+	};
+
+	voip: qcom,msm-voip-dsp {
+		compatible = "qcom,msm-voip-dsp";
+	};
+
+	voice: qcom,msm-pcm-voice {
+		compatible = "qcom,msm-pcm-voice";
+		qcom,destroy-cvd;
+	};
+
+	stub_codec: qcom,msm-stub-codec {
+		compatible = "qcom,msm-stub-codec";
+	};
+
+	qcom,msm-dai-fe {
+		compatible = "qcom,msm-dai-fe";
+	};
+
+	afe: qcom,msm-pcm-afe {
+		compatible = "qcom,msm-pcm-afe";
+	};
+
+	dai_hdmi: qcom,msm-dai-q6-hdmi {
+		compatible = "qcom,msm-dai-q6-hdmi";
+		qcom,msm-dai-q6-dev-id = <8>;
+	};
+
+	lsm: qcom,msm-lsm-client {
+		compatible = "qcom,msm-lsm-client";
+	};
+
+	loopback: qcom,msm-pcm-loopback {
+		compatible = "qcom,msm-pcm-loopback";
+	};
+
+	cpe: qcom,msm-cpe-lsm {
+		compatible = "qcom,msm-cpe-lsm";
+		qcom,msm-cpe-lsm-id = <1>;
+	};
+
+	cpe3: qcom,msm-cpe-lsm@3 {
+		compatible = "qcom,msm-cpe-lsm";
+		qcom,msm-cpe-lsm-id = <3>;
+	};
+
+	qcom,msm-dai-q6 {
+		compatible = "qcom,msm-dai-q6";
+		sb_0_rx: qcom,msm-dai-q6-sb-0-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16384>;
+		};
+
+		sb_0_tx: qcom,msm-dai-q6-sb-0-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16385>;
+		};
+
+		sb_1_rx: qcom,msm-dai-q6-sb-1-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16386>;
+		};
+
+		sb_1_tx: qcom,msm-dai-q6-sb-1-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16387>;
+		};
+
+		sb_2_rx: qcom,msm-dai-q6-sb-2-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16388>;
+		};
+
+		sb_2_tx: qcom,msm-dai-q6-sb-2-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16389>;
+		};
+
+		sb_3_rx: qcom,msm-dai-q6-sb-3-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16390>;
+		};
+
+		sb_3_tx: qcom,msm-dai-q6-sb-3-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16391>;
+		};
+
+		sb_4_rx: qcom,msm-dai-q6-sb-4-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16392>;
+		};
+
+		sb_4_tx: qcom,msm-dai-q6-sb-4-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16393>;
+		};
+
+		sb_5_tx: qcom,msm-dai-q6-sb-5-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16395>;
+		};
+
+		bt_sco_rx: qcom,msm-dai-q6-bt-sco-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <12288>;
+		};
+
+		bt_sco_tx: qcom,msm-dai-q6-bt-sco-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <12289>;
+		};
+
+		afe_pcm_rx: qcom,msm-dai-q6-be-afe-pcm-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <224>;
+		};
+
+		afe_pcm_tx: qcom,msm-dai-q6-be-afe-pcm-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <225>;
+		};
+
+		afe_proxy_rx: com,msm-dai-q6-afe-proxy-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <241>;
+		};
+
+		afe_proxy_tx: qcom,msm-dai-q6-afe-proxy-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <240>;
+		};
+
+		incall_record_rx: qcom,msm-dai-q6-incall-record-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <32771>;
+		};
+
+		incall_record_tx: qcom,msm-dai-q6-incall-record-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <32772>;
+		};
+
+		incall_music_rx: qcom,msm-dai-q6-incall-music-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <32773>;
+		};
+
+		incall_music2_rx: qcom,msm-dai-q6-incall-music-2-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <32770>;
+		};
+
+		sb_5_rx: qcom,msm-dai-q6-sb-5-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16394>;
+		};
+
+		sb_6_rx: qcom,msm-dai-q6-sb-6-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <16396>;
+		};
+
+	};
+
+	dai_pri_auxpcm: qcom,msm-pri-auxpcm {
+		compatible = "qcom,msm-auxpcm-dev";
+		qcom,msm-cpudai-auxpcm-mode = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-sync = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-frame = <5>, <4>;
+		qcom,msm-cpudai-auxpcm-quant = <2>, <2>;
+		qcom,msm-cpudai-auxpcm-num-slots = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-slot-mapping = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-data = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-pcm-clk-rate = <2048000>, <2048000>;
+		qcom,msm-auxpcm-interface = "primary";
+		qcom,msm-cpudai-afe-clk-ver = <2>;
+		pinctrl-names = "default", "sleep";
+		pinctrl-0 = <&pri_aux_pcm_active &pri_aux_pcm_din_active
+			     &pri_aux_pcm_dout_active>;
+		pinctrl-1 = <&pri_aux_pcm_sleep &pri_aux_pcm_din_sleep
+			     &pri_aux_pcm_dout_sleep>;
+	};
+
+	dai_sec_auxpcm: qcom,msm-sec-auxpcm {
+		compatible = "qcom,msm-auxpcm-dev";
+		qcom,msm-cpudai-auxpcm-mode = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-sync = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-frame = <5>, <4>;
+		qcom,msm-cpudai-auxpcm-quant = <2>, <2>;
+		qcom,msm-cpudai-auxpcm-num-slots = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-slot-mapping = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-data = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-pcm-clk-rate = <2048000>, <2048000>;
+		qcom,msm-auxpcm-interface = "secondary";
+		qcom,msm-cpudai-afe-clk-ver = <2>;
+	};
+
+	qcom,msm-dai-mi2s {
+		compatible = "qcom,msm-dai-mi2s";
+		dai_mi2s_sec: qcom,msm-dai-q6-mi2s-sec {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <1>;
+			qcom,msm-mi2s-rx-lines = <1>;
+			qcom,msm-mi2s-tx-lines = <0>;
+		};
+
+		dai_mi2s: qcom,msm-dai-q6-mi2s-tert {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <2>;
+			qcom,msm-mi2s-rx-lines = <2>;
+			qcom,msm-mi2s-tx-lines = <1>;
+			pinctrl-names = "default", "sleep";
+			pinctrl-0 = <&tert_mi2s_active &tert_mi2s_sd0_active>;
+			pinctrl-1 = <&tert_mi2s_sleep &tert_mi2s_sd0_sleep>;
+		};
+
+		dai_mi2s_quat: qcom,msm-dai-q6-mi2s-quat {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <3>;
+			qcom,msm-mi2s-rx-lines = <1>;
+			qcom,msm-mi2s-tx-lines = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-pri-rx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37120>;
+		qcom,msm-cpudai-tdm-group-num-ports = <4>;
+		qcom,msm-cpudai-tdm-group-port-id = <36864 36866 36868 36870>;
+		qcom,msm-cpudai-tdm-clk-rate = <12288000>;
+		qcom,msm-cpudai-tdm-clk-internal = <1>;
+		qcom,msm-cpudai-tdm-sync-mode = <0>;
+		qcom,msm-cpudai-tdm-sync-src = <1>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <0>;
+		qcom,msm-cpudai-tdm-data-delay = <1>;
+		qcom,msm-cpudai-tdm-clk-attribute = /bits/ 16 <1>;
+		dai_pri_tdm_rx_0: qcom,msm-dai-q6-tdm-pri-rx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36864>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_pri_tdm_rx_1: qcom,msm-dai-q6-tdm-pri-rx-1 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36866>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_pri_tdm_rx_2: qcom,msm-dai-q6-tdm-pri-rx-2 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36868>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_pri_tdm_rx_3: qcom,msm-dai-q6-tdm-pri-rx-3 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36870>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-pri-tx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37121>;
+		qcom,msm-cpudai-tdm-group-num-ports = <4>;
+		qcom,msm-cpudai-tdm-group-port-id = <36865 36867 36869 36871>;
+		qcom,msm-cpudai-tdm-clk-rate = <12288000>;
+		qcom,msm-cpudai-tdm-clk-internal = <1>;
+		qcom,msm-cpudai-tdm-sync-mode = <0>;
+		qcom,msm-cpudai-tdm-sync-src = <1>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <0>;
+		qcom,msm-cpudai-tdm-data-delay = <1>;
+		qcom,msm-cpudai-tdm-clk-attribute = /bits/ 16 <1>;
+		dai_pri_tdm_tx_0: qcom,msm-dai-q6-tdm-pri-tx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36865>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_pri_tdm_tx_1: qcom,msm-dai-q6-tdm-pri-tx-1 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36867>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_pri_tdm_tx_2: qcom,msm-dai-q6-tdm-pri-tx-2 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36869>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_pri_tdm_tx_3: qcom,msm-dai-q6-tdm-pri-tx-3 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36871>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-sec-tx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37137>;
+		qcom,msm-cpudai-tdm-group-num-ports = <4>;
+		qcom,msm-cpudai-tdm-group-port-id = <36881 36883 36885 36887>;
+		qcom,msm-cpudai-tdm-clk-rate = <12288000>;
+		qcom,msm-cpudai-tdm-clk-internal = <0>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <0>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <0>;
+		qcom,msm-cpudai-tdm-data-delay = <0>;
+		dai_sec_tdm_tx_0: qcom,msm-dai-q6-tdm-sec-tx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36881>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_sec_tdm_tx_1: qcom,msm-dai-q6-tdm-sec-tx-1 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36883>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_sec_tdm_tx_2: qcom,msm-dai-q6-tdm-sec-tx-2 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36885>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_sec_tdm_tx_3: qcom,msm-dai-q6-tdm-sec-tx-3 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36887>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-tert-rx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37152>;
+		qcom,msm-cpudai-tdm-group-num-ports = <5>;
+		qcom,msm-cpudai-tdm-group-port-id = <36896 36898 36900
+							36902 36904>;
+		qcom,msm-cpudai-tdm-clk-rate = <12288000>;
+		qcom,msm-cpudai-tdm-clk-internal = <0>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <0>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <0>;
+		qcom,msm-cpudai-tdm-data-delay = <0>;
+		dai_tert_tdm_rx_0: qcom,msm-dai-q6-tdm-tert-rx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36896>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_tert_tdm_rx_1: qcom,msm-dai-q6-tdm-tert-rx-1 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36898>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_tert_tdm_rx_2: qcom,msm-dai-q6-tdm-tert-rx-2 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36900>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_tert_tdm_rx_3: qcom,msm-dai-q6-tdm-tert-rx-3 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36902>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_tert_tdm_rx_4: qcom,msm-dai-q6-tdm-tert-rx-4 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36904>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-tert-tx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37153>;
+		qcom,msm-cpudai-tdm-group-num-ports = <4>;
+		qcom,msm-cpudai-tdm-group-port-id = <36897 36899 36901 36903>;
+		qcom,msm-cpudai-tdm-clk-rate = <12288000>;
+		qcom,msm-cpudai-tdm-clk-internal = <0>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <0>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <0>;
+		qcom,msm-cpudai-tdm-data-delay = <0>;
+		dai_tert_tdm_tx_0: qcom,msm-dai-q6-tdm-tert-tx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36897>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_tert_tdm_tx_1: qcom,msm-dai-q6-tdm-tert-tx-1 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36899>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_tert_tdm_tx_2: qcom,msm-dai-q6-tdm-tert-tx-2 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36901>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_tert_tdm_tx_3: qcom,msm-dai-q6-tdm-tert-tx-3 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36903>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-quat-rx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37168>;
+		qcom,msm-cpudai-tdm-group-num-ports = <4>;
+		qcom,msm-cpudai-tdm-group-port-id = <36912 36914 36916 36918>;
+		qcom,msm-cpudai-tdm-clk-rate = <12288000>;
+		qcom,msm-cpudai-tdm-clk-internal = <0>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <0>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <0>;
+		qcom,msm-cpudai-tdm-data-delay = <0>;
+		dai_quat_tdm_rx_0: qcom,msm-dai-q6-tdm-quat-rx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36912>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_quat_tdm_rx_1: qcom,msm-dai-q6-tdm-quat-rx-1 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36914>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_quat_tdm_rx_2: qcom,msm-dai-q6-tdm-quat-rx-2 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36916>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_quat_tdm_rx_3: qcom,msm-dai-q6-tdm-quat-rx-3 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36918>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-quat-tx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37169>;
+		qcom,msm-cpudai-tdm-group-num-ports = <4>;
+		qcom,msm-cpudai-tdm-group-port-id = <36913 36915 36917 36919>;
+		qcom,msm-cpudai-tdm-clk-rate = <12288000>;
+		qcom,msm-cpudai-tdm-clk-internal = <0>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <0>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <0>;
+		qcom,msm-cpudai-tdm-data-delay = <0>;
+		dai_quat_tdm_tx_0: qcom,msm-dai-q6-tdm-quat-tx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36913>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_quat_tdm_tx_1: qcom,msm-dai-q6-tdm-quat-tx-1 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36915>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_quat_tdm_tx_2: qcom,msm-dai-q6-tdm-quat-tx-2 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36917>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_quat_tdm_tx_3: qcom,msm-dai-q6-tdm-quat-tx-3 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36919>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	hostless: qcom,msm-pcm-hostless {
+		compatible = "qcom,msm-pcm-hostless";
+	};
+
+	qcom,msm-ssc-sensors {
+		compatible = "qcom,msm-ssc-sensors";
+		status = "ok";
+	};
+
+	qcom,msm-pacman {
+		compatible = "qcom,msm-pacman";
+	};
+
+	qcom,msm-adsprpc-mem {
+		compatible = "qcom,msm-adsprpc-mem-region";
+		memory-region = <&adsp_mem>;
+	};
+
+	qcom,msm_fastrpc {
+		compatible = "qcom,msm-fastrpc-adsp";
+
+		qcom,msm_fastrpc_compute_cb1 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 8>;
+		};
+		qcom,msm_fastrpc_compute_cb2 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 9>;
+		};
+		qcom,msm_fastrpc_compute_cb3 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 10>;
+		};
+		qcom,msm_fastrpc_compute_cb4 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 11>;
+		};
+		qcom,msm_fastrpc_compute_cb5 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 12>;
+		};
+		qcom,msm_fastrpc_compute_cb6 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 5>;
+		};
+		qcom,msm_fastrpc_compute_cb7 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 6>;
+		};
+		qcom,msm_fastrpc_compute_cb8 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 7>;
+		};
+	};
+
+	cpu_pmu: cpu-pmu {
+		compatible = "arm,armv8-pmuv3";
+		qcom,irq-is-percpu;
+		interrupts = <1 7 4>;
+	};
+
+	qcom,glink-smem-native-xprt-modem@86000000 {
+		compatible = "qcom,glink-smem-native-xprt";
+		reg = <0x86000000 0x200000>,
+			<0x9820010 0x4>;
+		reg-names = "smem", "irq-reg-base";
+		qcom,irq-mask = <0x8000>;
+		interrupts = <0 452 1>;
+		label = "mpss";
+	};
+
+	qcom,glink-smem-native-xprt-adsp@86000000 {
+		compatible = "qcom,glink-smem-native-xprt";
+		reg = <0x86000000 0x200000>,
+			<0x9820010 0x4>;
+		reg-names = "smem", "irq-reg-base";
+		qcom,irq-mask = <0x200>;
+		interrupts = <0 157 1>;
+		label = "lpass";
+		qcom,qos-config = <&glink_qos_adsp>;
+		qcom,ramp-time = <0xaf>;
+	};
+
+	glink_qos_adsp: qcom,glink-qos-config-adsp {
+		compatible = "qcom,glink-qos-config";
+		qcom,flow-info = <0x3c 0x0>,
+				<0x3c 0x0>,
+				<0x3c 0x0>,
+				<0x3c 0x0>;
+		qcom,mtu-size = <0x800>;
+		qcom,tput-stats-cycle = <0xa>;
+	};
+
+	qcom,glink-smem-native-xprt-dsps@86000000 {
+		compatible = "qcom,glink-smem-native-xprt";
+		reg = <0x86000000 0x200000>,
+			<0x9820010 0x4>;
+		reg-names = "smem", "irq-reg-base";
+		qcom,irq-mask = <0x8000000>;
+		interrupts = <0 179 1>;
+		label = "dsps";
+	};
+
+	qcom,glink-smem-native-xprt-rpm@68000 {
+		compatible = "qcom,glink-rpm-native-xprt";
+		reg = <0x68000 0x6000>,
+			<0x9820010 0x4>;
+		reg-names = "msgram", "irq-reg-base";
+		qcom,irq-mask = <0x1>;
+		interrupts = <0 168 1>;
+		label = "rpm";
+	};
+
+	glink_mpss: qcom,glink-ssr-modem {
+		compatible = "qcom,glink_ssr";
+		label = "modem";
+		qcom,edge = "mpss";
+		qcom,notify-edges = <&glink_lpass>, <&glink_dsps>, <&glink_rpm>;
+		qcom,xprt = "smem";
+	};
+
+	glink_lpass: qcom,glink-ssr-adsp {
+		compatible = "qcom,glink_ssr";
+		label = "adsp";
+		qcom,edge = "lpass";
+		qcom,notify-edges = <&glink_mpss>, <&glink_dsps>, <&glink_rpm>;
+		qcom,xprt = "smem";
+	};
+
+	glink_dsps: qcom,glink-ssr-dsps {
+		compatible = "qcom,glink_ssr";
+		label = "slpi";
+		qcom,edge = "dsps";
+		qcom,notify-edges = <&glink_mpss>, <&glink_lpass>, <&glink_rpm>;
+		qcom,xprt = "smem";
+	};
+
+	glink_rpm: qcom,glink-ssr-rpm {
+		compatible = "qcom,glink_ssr";
+		label = "rpm";
+		qcom,edge = "rpm";
+		qcom,notify-edges = <&glink_lpass>, <&glink_mpss>, <&glink_dsps>;
+		qcom,xprt = "smem";
+	};
+
+         qcom,glink_pkt {
+                 compatible = "qcom,glinkpkt";
+
+                 qcom,glinkpkt-at-mdm0 {
+                         qcom,glinkpkt-transport = "smd_trans";
+                         qcom,glinkpkt-edge = "mpss";
+                         qcom,glinkpkt-ch-name = "DS";
+                         qcom,glinkpkt-dev-name = "at_mdm0";
+                 };
+
+                 qcom,glinkpkt-loopback_cntl {
+                         qcom,glinkpkt-transport = "lloop";
+                         qcom,glinkpkt-edge = "local";
+                         qcom,glinkpkt-ch-name = "LOCAL_LOOPBACK_CLNT";
+                         qcom,glinkpkt-dev-name = "glink_pkt_loopback_ctrl";
+                 };
+
+                 qcom,glinkpkt-loopback_data {
+                         qcom,glinkpkt-transport = "lloop";
+                         qcom,glinkpkt-edge = "local";
+                         qcom,glinkpkt-ch-name = "glink_pkt_lloop_CLNT";
+                         qcom,glinkpkt-dev-name = "glink_pkt_loopback";
+                 };
+         };
+
+	qcom,cache_erp64@6500000 {
+		compatible = "qcom,kryo_cache_erp64";
+		reg = <0x6500000 0x4000>;
+		/*
+		 * PPI 0  for L0/L1
+		 * SPI 1  for Cluster 1 L2 Info
+		 * SPI 9  for Cluster 2 L2 Info
+		 * SPI 2  for Cluster 1 L2 Error
+		 * SPI 10 for Cluster 2 L2 Error
+		 * SPI 17 for L3 error
+		 */
+		interrupts = <1 0 0>, <0 1 0>, <0 9 0>, <0 2 0>, <0 10 0>,
+			     <0 17 0>;
+		interrupt-names = "l1_irq", "l2_irq_info_0", "l2_irq_info_1",
+				  "l2_irq_err_0", "l2_irq_err_1", "l3_irq";
+	};
+
+	qcom,m4m_erp64@9A40000 {
+		compatible = "qcom,m4m_erp";
+		reg = <0x9A40000 0x40000>;
+		interrupts = <0 22 0>;
+		interrupt-names = "m4m_irq";
+	};
+
+	lmh: qcom,lmh {
+		compatible = "qcom,lmh_v1";
+		interrupts = <0 23 4>;
+	};
+
+	timer@09840000 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		compatible = "arm,armv7-timer-mem";
+		reg = <0x09840000 0x1000>;
+		clock-frequency = <19200000>;
+
+		frame@09850000 {
+			frame-number = <0>;
+			interrupts = <0 31 0x4>,
+				     <0 30 0x4>;
+			reg = <0x09850000 0x1000>,
+			      <0x09860000 0x1000>;
+		};
+
+		frame@09870000 {
+			frame-number = <1>;
+			interrupts = <0 32 0x4>;
+			reg = <0x09870000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@09880000 {
+			frame-number = <2>;
+			interrupts = <0 33 0x4>;
+			reg = <0x09880000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@09890000 {
+			frame-number = <3>;
+			interrupts = <0 34 0x4>;
+			reg = <0x09890000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@098a0000 {
+			frame-number = <4>;
+			interrupts = <0 35 0x4>;
+			reg = <0x098a0000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@098b0000 {
+			frame-number = <5>;
+			interrupts = <0 36 0x4>;
+			reg = <0x098b0000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@098c0000 {
+			frame-number = <6>;
+			interrupts = <0 37 0x4>;
+			reg = <0x098c0000 0x1000>;
+			status = "disabled";
+		};
+	};
+
+	qcom,avtimer@90f7000 {
+		compatible = "qcom,avtimer";
+		reg = <0x90f700c 0x4>,
+		      <0x90f7010 0x4>;
+		reg-names = "avtimer_lsb_addr", "avtimer_msb_addr";
+		qcom,clk-div = <27>;
+	};
+
+	mcd {
+		compatible = "qcom,mcd";
+		qcom,ce-hw-instance = <0>;
+		qcom,ce-device = <0>;
+		interrupts = <0 248 0>;
+		interrupt-names = "mcd_irq";
+		clock-names = "core_clk_src", "core_clk",
+			"iface_clk", "bus_clk";
+		clocks = <&clock_gcc clk_ce1_clk>,
+			<&clock_gcc clk_qseecom_ce1_clk>,
+			<&clock_gcc clk_gcc_ce1_ahb_m_clk>,
+			<&clock_gcc clk_gcc_ce1_axi_m_clk>;
+			qcom,ce-opp-freq = <171430000>;
+	};
+
+	dcc: dcc@4b3000 {
+		compatible = "qcom,dcc";
+		reg = <0x4b3000 0x1000>,
+		      <0x4b4000 0x2000>,
+		      <0x4b0000 0x4>;
+		reg-names = "dcc-base", "dcc-ram-base", "dcc-xpu-base";
+
+		clocks = <&clock_gcc clk_gcc_dcc_ahb_clk>;
+		clock-names = "dcc_clk";
+
+		qcom,save-reg;
+	};
+};
+
+&gdsc_venus {
+	clock-names = "bus_clk", "maxi_clk", "core_clk";
+	clocks = <&clock_mmss clk_video_axi_clk>,
+		 <&clock_mmss clk_video_maxi_clk>,
+		 <&clock_mmss clk_video_core_clk>;
+	parent-supply = <&gdsc_mmagic_video>;
+	status = "ok";
+};
+
+&gdsc_venus_core0 {
+	clock-names = "core0_clk";
+	clocks = <&clock_mmss clk_video_subcore0_clk>;
+	status = "ok";
+};
+
+&gdsc_venus_core1 {
+	clock-names = "core1_clk";
+	clocks = <&clock_mmss clk_video_subcore1_clk>;
+	status = "ok";
+};
+
+&gdsc_camss_top {
+	clock-names = "bus_clk", "vfe_axi";
+	clocks = <&clock_mmss clk_camss_cpp_axi_clk>,
+		 <&clock_mmss clk_camss_vfe_axi_clk>;
+	parent-supply = <&gdsc_mmagic_camss>;
+	status = "ok";
+};
+
+&gdsc_vfe0 {
+	clock-names = "core0_clk";
+	clocks = <&clock_mmss clk_camss_vfe0_clk>;
+	parent-supply = <&gdsc_camss_top>;
+	status = "ok";
+};
+
+&gdsc_vfe1 {
+	clock-names = "core1_clk";
+	clocks = <&clock_mmss clk_camss_vfe1_clk>;
+	parent-supply = <&gdsc_camss_top>;
+	status = "ok";
+};
+
+&gdsc_jpeg {
+	clock-names = "bus_clk", "dma_clk", "core0_clk", "core2_clk";
+	clocks = <&clock_mmss clk_camss_jpeg_axi_clk>,
+		 <&clock_mmss clk_camss_jpeg_dma_clk>,
+		 <&clock_mmss clk_camss_jpeg0_clk>,
+		 <&clock_mmss clk_camss_jpeg2_clk>;
+	parent-supply = <&gdsc_camss_top>;
+	status = "ok";
+};
+
+&gdsc_cpp {
+	clock-names = "core_clk";
+	clocks = <&clock_mmss clk_camss_cpp_clk>;
+	parent-supply = <&gdsc_camss_top>;
+	qcom,support-hw-trigger;
+	status = "ok";
+};
+
+&gdsc_fd {
+	clock-names = "core_clk", "core_uar_clk";
+	clocks = <&clock_mmss clk_fd_core_clk>,
+		 <&clock_mmss clk_fd_core_uar_clk>;
+	parent-supply = <&gdsc_camss_top>;
+	status = "ok";
+};
+
+&gdsc_mdss {
+	clock-names = "bus_clk";
+	clocks = <&clock_mmss clk_mdss_axi_clk>;
+	parent-supply = <&gdsc_mmagic_mdss>;
+	proxy-supply = <&gdsc_mdss>;
+	qcom,proxy-consumer-enable;
+	status = "ok";
+};
+
+&gdsc_pcie_0 {
+	status = "ok";
+};
+
+&gdsc_pcie_1 {
+	status = "ok";
+};
+
+&gdsc_pcie_2 {
+	status = "ok";
+};
+
+&gdsc_usb30 {
+	reg = <0x30f004 0x4>;
+	status = "ok";
+};
+
+&gdsc_ufs {
+	status = "ok";
+};
+
+&gdsc_gpu {
+	status = "ok";
+};
+
+&gdsc_gpu_gx {
+	clock-names = "core_clk", "core_root_clk";
+	clocks = <&clock_gpu clk_gpu_gx_gfx3d_clk>,
+		 <&clock_gpu clk_gfx3d_clk_src>;
+	qcom,force-enable-root-clk;
+	parent-supply = <&gfx_vreg>;
+	status = "ok";
+};
+
+&gdsc_hlos1_vote_aggre0_noc {
+	status = "ok";
+};
+
+&gdsc_hlos1_vote_lpass_adsp {
+	status = "ok";
+};
+
+&gdsc_hlos1_vote_lpass_core {
+	status = "ok";
+};
+
+&gdsc_aggre0_noc {
+	status = "ok";
+};
+
+&gdsc_mmagic_bimc {
+	status = "ok";
+};
+
+&gdsc_mmagic_video {
+	clock-names = "core_root_clk";
+	/* RPM enables the mmagic bimc GDSC when this clk node is voted for. */
+	clocks = <&clock_gcc clk_mmssnoc_gds_clk>;
+	qcom,enable-root-clk;
+	status = "ok";
+};
+
+&gdsc_mmagic_mdss {
+	clock-names = "core_root_clk";
+	/* RPM enables the mmagic bimc GDSC when this clk node is voted for. */
+	clocks = <&clock_gcc clk_mmssnoc_gds_clk>;
+	qcom,enable-root-clk;
+	status = "ok";
+};
+
+&gdsc_mmagic_camss {
+	clock-names = "core_root_clk";
+	/* RPM enables the mmagic bimc GDSC when this clk node is voted for. */
+	clocks = <&clock_gcc clk_mmssnoc_gds_clk>;
+	qcom,enable-root-clk;
+	status = "ok";
+};
+
+#include "msm-pm8994-rpm-regulator.dtsi"
+#include "msm-pm8994.dtsi"
+#include "msm-pmi8994.dtsi"
+#include "msm8996-regulator.dtsi"
+#include "msm8996-camera.dtsi"
+#include "msm8996-gpu.dtsi"
+#include "msm8996-pm.dtsi"
+#include "msm-arm-smmu-8996.dtsi"
+#include "msm8996-vidc.dtsi"
+#include "msm8996-bus.dtsi"
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-auto-adp-lite.dts b/arch/arm64/boot/dts/qcom/msm8996pro-auto-adp-lite.dts
new file mode 100644
index 000000000000..f5c33063643d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-auto-adp-lite.dts
@@ -0,0 +1,94 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include "msm8996pro.dtsi"
+#include "msm8996-pm8994.dtsi"
+#include "msm8996-agave-adp.dtsi"
+#include "msm8996pro-auto.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro AUTO ADP LITE";
+	compatible = "qcom,msm8996-adp", "qcom,msm8996", "qcom,adp";
+	qcom,msm-id = <315 0x10000>;
+	qcom,board-id = <0x03010019 0>;
+};
+
+&spi_9 {
+	status = "disabled";
+};
+
+&soc {
+	qcom,msm-ssc-sensors {
+		status = "disabled";
+	};
+
+	qcom,msm-thermal {
+		qcom,hotplug-temp = <115>;
+		qcom,hotplug-temp-hysteresis = <25>;
+		qcom,therm-reset-temp = <119>;
+	};
+
+	i2c@75b6000 { /* BLSP8 */
+		/* ADV7533 HDMI Bridge Chip removed on ADP Lite */
+		adv7533@3d {
+			status = "disabled";
+		};
+		adv7533@39 {
+			status = "disabled";
+		};
+	};
+
+	qcom,adv7481@70 {
+		status = "disabled";
+	};
+
+	qcom,msm-ba {
+		status = "disabled";
+	};
+};
+
+&pil_modem {
+	pinctrl-names = "default";
+	pinctrl-0 = <&modem_mux>;
+};
+
+&slim_msm {
+	status = "disabled";
+};
+
+&pm8994_mpps {
+	mpp@a500 { /* MPP 6 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&sdhc_2 {
+	cd-gpios = <&tlmm 38 GPIO_ACTIVE_LOW>;
+	pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on_sbc>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off
+			&sdc2_cd_on_sbc>;
+};
+
+&i2c_7 {
+	silabs4705@11 { /* SiLabs FM chip, slave id 0x11*/
+		status = "disabled";
+	};
+};
+
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-auto-adp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-auto-adp.dts
new file mode 100644
index 000000000000..d2aa5c854c83
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-auto-adp.dts
@@ -0,0 +1,88 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include "msm8996pro.dtsi"
+#include "msm8996-pm8994.dtsi"
+#include "msm8996-agave-adp.dtsi"
+#include "msm8996pro-auto.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro AUTO ADP";
+	compatible = "qcom,msm8996-adp", "qcom,msm8996", "qcom,adp";
+	qcom,msm-id = <315 0x10000>;
+	qcom,board-id = <0x02010019 0>, <0x00010001 0>;
+};
+
+&spi_9 {
+	status = "ok";
+	can-controller@0 {
+		compatible = "renesas,rh850";
+		reg = <0>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <122 0>;
+		spi-max-frequency = <5000000>;
+	};
+};
+
+&soc {
+	qcom,msm-ssc-sensors {
+		status = "disabled";
+	};
+
+	qcom,msm-thermal {
+		qcom,hotplug-temp = <115>;
+		qcom,hotplug-temp-hysteresis = <25>;
+		qcom,therm-reset-temp = <119>;
+	};
+
+	qcom,adv7481@70 {
+		qcom,cam-vreg-min-voltage = <1300000 0 1800000>;
+		qcom,cam-vreg-max-voltage = <1300000 0 1800000>;
+	};
+};
+
+&pil_modem {
+	pinctrl-names = "default";
+	pinctrl-0 = <&modem_mux>;
+};
+
+&slim_msm {
+	status = "disabled";
+};
+
+&pm8994_mpps {
+	mpp@a500 { /* MPP 6 */
+		qcom,mode = <1>;		/* Digital output */
+		qcom,output-type = <0>;		/* CMOS logic */
+		qcom,vin-sel = <2>;		/* S4 1.8V */
+		qcom,src-sel = <0>;		/* Constant */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+};
+
+&sdhc_2 {
+	cd-gpios = <&tlmm 38 GPIO_ACTIVE_LOW>;
+	pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on_sbc>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off
+			&sdc2_cd_on_sbc>;
+};
+
+&i2c_7 {
+	silabs4705@11 { /* SiLabs FM chip, slave id 0x11*/
+		status = "disabled";
+	};
+};
+
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-auto-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-auto-cdp.dts
new file mode 100644
index 000000000000..e104be7c2742
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-auto-cdp.dts
@@ -0,0 +1,49 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996pro.dtsi"
+#include "msm8996-pm8994.dtsi"
+#include "msm8996-auto-cdp.dtsi"
+#include "msm8996pro-auto.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro AUTO CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,msm-id = <315 0x10000>;
+	qcom,board-id = <0x03010001 0>;
+};
+
+&spi_9 {
+	status = "ok";
+	can-controller@0 {
+		compatible = "renesas,rh850";
+		reg = <0>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <127 0>;
+		spi-max-frequency = <5000000>;
+	};
+};
+
+&pil_modem {
+	pinctrl-names = "default";
+	pinctrl-0 = <&modem_mux>;
+};
+
+&soc {
+	qcom,msm-thermal {
+		qcom,hotplug-temp = <115>;
+		qcom,hotplug-temp-hysteresis = <25>;
+		qcom,therm-reset-temp = <119>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-auto.dtsi b/arch/arm64/boot/dts/qcom/msm8996pro-auto.dtsi
new file mode 100644
index 000000000000..15295639e361
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-auto.dtsi
@@ -0,0 +1,470 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8996v3-auto.dtsi"
+
+&gfx_vreg {
+	qcom,cpr-fuse-combos = <24>;
+	qcom,cpr-speed-bins = <3>;
+	qcom,cpr-speed-bin-corners = <8 8 8>;
+	qcom,cpr-corners = <8>;
+
+	qcom,cpr-corner-fmax-map =
+		<2 4 6 8>;
+
+	qcom,cpr-voltage-ceiling =
+		<600000  670000  670000  750000  830000  910000  960000
+		1020000>;
+
+	qcom,cpr-voltage-floor =
+		<600000  600000  600000  600000  600000  600000  600000
+		600000>;
+
+	qcom,mem-acc-voltage =
+		<1 1 1 1 2 2 2 2>;
+
+	qcom,corner-frequencies =
+		<0 133000000 214000000 315000000 401800000 510000000 560000000
+		   624000000>;
+
+	qcom,cpr-target-quotients =
+		<0 0 0 0 0 0    0    0    0    0    0    0 0 0 0 0>,
+		<0 0 0 0 0 0  185  179  291  299  304  319 0 0 0 0>,
+		<0 0 0 0 0 0  287  273  425  426  443  453 0 0 0 0>,
+		<0 0 0 0 0 0  414  392  584  576  608  612 0 0 0 0>,
+		<0 0 0 0 0 0  459  431  684  644  692  679 0 0 0 0>,
+		<0 0 0 0 0 0  577  543  798  768  823  810 0 0 0 0>,
+		<0 0 0 0 0 0  669  629  886  864  924  911 0 0 0 0>,
+		<0 0 0 0 0 0  771  725  984  970 1036 1024 0 0 0 0>;
+
+	qcom,cpr-ro-scaling-factor =
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		<0 (-20000) (-20000) (-40000)>;
+
+	qcom,cpr-closed-loop-voltage-adjustment =
+		<0 0 30000 10000 10000 45000 25000 25000>;
+
+	qcom,cpr-floor-to-ceiling-max-range =
+		<0 70000 70000 75000 80000 90000 95000 100000>;
+
+	qcom,cpr-fused-closed-loop-voltage-adjustment-map =
+		<0 2 2 2 2 0 0 4>;
+};
+
+&apcc_cpr {
+	/delete-property/ qcom,cpr-enable;
+};
+
+&apc0_pwrcl_vreg {
+	regulator-max-microvolt = <19>;
+	qcom,cpr-fuse-combos = <24>;
+	qcom,cpr-speed-bins = <3>;
+	qcom,cpr-speed-bin-corners = <19 19 19>;
+	qcom,cpr-corners = <19>;
+
+	qcom,cpr-corner-fmax-map =
+		<3 6 9 14 19>;
+
+	qcom,cpr-voltage-ceiling =
+		<670000  670000  670000  670000  670000  670000  745000  745000
+		 745000  905000  905000  905000  905000  905000 1140000 1140000
+		1140000 1140000 1140000>;
+
+	qcom,cpr-voltage-floor =
+		<470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000>;
+
+	qcom,cpr-floor-to-ceiling-max-range =
+		 <0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0>;
+
+	qcom,corner-frequencies =
+		<307200000  384000000  460800000  537600000  614400000
+		 691200000  768000000  844800000  902400000  979200000
+		1056000000 1132800000 1209600000 1286400000 1363200000
+		1440000000 1516800000 1593600000 1785600000>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		<0        0        0        0        0 >;
+
+	qcom,cpr-closed-loop-voltage-fuse-adjustment =
+		<0        0        0        0        0 >;
+
+	qcom,cpr-open-loop-voltage-adjustment =
+		<0 0 0 0 0 0 0 0 0 (-2000) (-4000) (-6000) (-8000) (-10000)
+		 (-11000) (-12000) (-12000) (-13000) (-15000)>;
+
+	qcom,cpr-open-loop-voltage-min-diff =
+		<0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0>;
+
+	qcom,cpr-closed-loop-voltage-adjustment =
+		<0 0 0 0 0 0 0 0 0 (-2000) (-4000) (-6000) (-8000) (-10000)
+		 (-11000) (-12000) (-12000) (-13000) (-15000)>;
+
+	qcom,allow-aging-voltage-adjustment = <0>;
+	qcom,allow-aging-open-loop-voltage-adjustment = <0>;
+};
+
+&apc0_cbf_vreg {
+	qcom,cpr-fuse-combos = <24>;
+	qcom,cpr-speed-bins = <3>;
+	qcom,cpr-speed-bin-corners = <19 19 19>;
+	qcom,cpr-corners = <19>;
+
+	qcom,cpr-corner-fmax-map =
+		<1 4 7 14 19>;
+
+	qcom,cpr-voltage-ceiling =
+		<670000  670000  670000  670000  745000  745000  745000  905000
+		 905000  905000  905000  905000  905000  905000 1140000 1140000
+		1140000 1140000 1140000>;
+
+	qcom,cpr-voltage-floor =
+		<470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000>;
+
+	qcom,cpr-floor-to-ceiling-max-range =
+		 <0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0>;
+
+	qcom,corner-frequencies =
+		<192000000  307200000  384000000  441600000  537600000
+		 614400000  691200000  768000000  844800000  902400000
+		 979200000 1056000000 1132800000 1190400000 1286400000
+		1363200000 1440000000 1516800000 1593600000>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		<0        0        0    15000        0 >;
+
+	qcom,cpr-closed-loop-voltage-fuse-adjustment =
+		<0        0        0        0        0 >;
+
+	qcom,allow-aging-voltage-adjustment = <0>;
+	qcom,allow-aging-open-loop-voltage-adjustment = <0>;
+};
+
+&apc1_vreg {
+	qcom,cpr-fuse-combos = <24>;
+	qcom,cpr-speed-bins = <3>;
+	qcom,cpr-speed-bin-corners = <25 25 25>;
+	qcom,cpr-corners = <25>;
+
+	qcom,cpr-corner-fmax-map =
+		<4 7 10 15 25>;
+
+	qcom,cpr-voltage-ceiling =
+		<670000  670000  670000  670000  670000  670000  670000  745000
+		 745000  745000  905000  905000  905000  905000  905000 1140000
+		1140000 1140000 1140000 1140000 1140000 1140000 1140000 1140000
+		1140000>;
+
+	qcom,cpr-voltage-floor =
+		<470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000  470000  470000  470000  470000
+		 470000>;
+
+	qcom,cpr-floor-to-ceiling-max-range =
+		 <0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0>;
+
+	qcom,corner-frequencies =
+		<307200000  384000000  460800000  537600000  614400000
+		 691200000  748800000  825600000  902400000  979200000
+		1056000000 1132800000 1209600000 1286400000 1363200000
+		1440000000 1516800000 1593600000 1670400000 1747200000
+		1824000000 1900800000 1977600000 2054400000 2150400000>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		<0        0        0        0        0 >;
+
+	qcom,cpr-closed-loop-voltage-fuse-adjustment =
+		<0        0        0        0        0 >;
+
+	qcom,cpr-open-loop-voltage-adjustment =
+		 <0 0 0 0 0 0 0 0 0 0 (-2000) (-4000) (-6000) (-8000) (-10000)
+		  (-10000) (-11000) (-11000) (-12000) (-12000) (-13000) (-13000)
+		  (-14000) (-14000) (-15000)>;
+
+	qcom,cpr-open-loop-voltage-min-diff =
+		 <0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0>;
+
+	qcom,cpr-closed-loop-voltage-adjustment =
+		 <0 0 0 0 0 0 0 0 0 0 (-2000) (-4000) (-6000) (-8000) (-10000)
+		  (-10000) (-11000) (-11000) (-12000) (-12000) (-13000) (-13000)
+		  (-14000) (-14000) (-15000)>;
+
+	qcom,allow-aging-voltage-adjustment = <0>;
+	qcom,allow-aging-open-loop-voltage-adjustment = <0>;
+};
+
+&clock_cpu {
+	compatible = "qcom,cpu-clock-8996-auto";
+	qcom,pwrcl-early-boot-freq = < 1286400000 >;
+	qcom,perfcl-early-boot-freq = < 1363200000 >;
+
+	qcom,pwrcl-speedbin0-v0 =
+		<          0  0 >,
+		<  768000000  7 >,
+		<  844800000  8 >,
+		<  902400000  9 >,
+		<  979200000 10 >,
+		< 1056000000 11 >,
+		< 1132800000 12 >,
+		< 1209600000 13 >,
+		< 1286400000 14 >,
+		< 1363200000 15 >,
+		< 1440000000 16 >,
+		< 1516800000 17 >,
+		< 1593600000 18 >;
+
+	qcom,pwrcl-speedbin1-v0 =
+		<          0  0 >,
+		<  768000000  7 >,
+		<  844800000  8 >,
+		<  902400000  9 >,
+		<  979200000 10 >,
+		< 1056000000 11 >,
+		< 1132800000 12 >,
+		< 1209600000 13 >,
+		< 1286400000 14 >,
+		< 1363200000 15 >,
+		< 1440000000 16 >,
+		< 1516800000 17 >,
+		< 1593600000 18 >;
+
+	qcom,pwrcl-speedbin2-v0 =
+		<          0  0 >,
+		<  768000000  7 >,
+		<  844800000  8 >,
+		<  902400000  9 >,
+		<  979200000 10 >,
+		< 1056000000 11 >,
+		< 1132800000 12 >,
+		< 1209600000 13 >,
+		< 1286400000 14 >;
+
+	qcom,perfcl-speedbin0-v0 =
+		<          0  0 >,
+		<  825600000  8 >,
+		<  902400000  9 >,
+		<  979200000 10 >,
+		< 1056000000 11 >,
+		< 1132800000 12 >,
+		< 1209600000 13 >,
+		< 1286400000 14 >,
+		< 1363200000 15 >,
+		< 1440000000 16 >,
+		< 1516800000 17 >,
+		< 1593600000 18 >,
+		< 1670400000 19 >,
+		< 1747200000 20 >,
+		< 1824000000 21 >,
+		< 1900800000 22 >,
+		< 1977600000 23 >,
+		< 2054400000 24 >;
+
+	qcom,perfcl-speedbin1-v0 =
+		<          0  0 >,
+		<  825600000  8 >,
+		<  902400000  9 >,
+		<  979200000 10 >,
+		< 1056000000 11 >,
+		< 1132800000 12 >,
+		< 1209600000 13 >,
+		< 1286400000 14 >,
+		< 1363200000 15 >,
+		< 1440000000 16 >,
+		< 1516800000 17 >,
+		< 1593600000 18 >,
+		< 1670400000 19 >;
+
+	qcom,perfcl-speedbin2-v0 =
+		<          0  0 >,
+		<  825600000  8 >,
+		<  902400000  9 >,
+		<  979200000 10 >,
+		< 1056000000 11 >,
+		< 1132800000 12 >,
+		< 1209600000 13 >,
+		< 1286400000 14 >,
+		< 1363200000 15 >,
+		< 1440000000 16 >,
+		< 1516800000 17 >;
+
+	qcom,cbf-speedbin0-v0 =
+		<	   0  0 >,
+		<  537600000  5 >,
+		<  614400000  6 >,
+		<  691200000  7 >,
+		<  768000000  8 >,
+		<  844800000  9 >,
+		<  902400000 10 >,
+		<  979200000 11 >,
+		< 1056000000 12 >,
+		< 1132800000 13 >,
+		< 1190400000 14 >,
+		< 1286400000 15 >,
+		< 1363200000 16 >,
+		< 1440000000 17 >,
+		< 1516800000 18 >,
+		< 1593600000 19 >;
+
+	qcom,cbf-speedbin1-v0 =
+		<	   0  0 >,
+		<  537600000  5 >,
+		<  614400000  6 >,
+		<  691200000  7 >,
+		<  768000000  8 >,
+		<  844800000  9 >,
+		<  902400000 10 >,
+		<  979200000 11 >,
+		< 1056000000 12 >,
+		< 1132800000 13 >,
+		< 1190400000 14 >,
+		< 1286400000 15 >,
+		< 1363200000 16 >,
+		< 1440000000 17 >,
+		< 1516800000 18 >,
+		< 1593600000 19 >;
+
+	qcom,cbf-speedbin2-v0 =
+		<	   0  0 >,
+		<  537600000  5 >,
+		<  614400000  6 >,
+		<  691200000  7 >,
+		<  768000000  8 >,
+		<  844800000  9 >,
+		<  902400000 10 >,
+		<  979200000 11 >,
+		< 1056000000 12 >,
+		< 1132800000 13 >,
+		< 1190400000 14 >;
+};
+
+&msm_cpufreq {
+	qcom,cpufreq-table-0 =
+		<  768000 >,
+		<  844800 >,
+		<  902400 >,
+		<  979200 >,
+		< 1056000 >,
+		< 1132800 >,
+		< 1209600 >,
+		< 1286400 >,
+		< 1363200 >,
+		< 1440000 >,
+		< 1516800 >,
+		< 1593600 >;
+	qcom,cpufreq-table-2 =
+		<  825600 >,
+		<  902400 >,
+		<  979200 >,
+		< 1056000 >,
+		< 1132800 >,
+		< 1209600 >,
+		< 1286400 >,
+		< 1363200 >,
+		< 1440000 >,
+		< 1516800 >,
+		< 1593600 >,
+		< 1670400 >,
+		< 1747200 >,
+		< 1824000 >,
+		< 1900800 >,
+		< 1977600 >,
+		< 2054400 >;
+};
+
+&m4m_cache {
+	freq-tbl-khz =
+		<  537600 >,
+		<  614400 >,
+		<  691200 >,
+		<  768000 >,
+		<  844800 >,
+		<  902400 >,
+		<  979200 >,
+		< 1056000 >,
+		< 1132800 >,
+		< 1190400 >,
+		< 1286400 >,
+		< 1363200 >,
+		< 1440000 >,
+		< 1516800 >,
+		< 1593600 >;
+};
+
+&devfreq_cpufreq {
+	mincpubw-cpufreq {
+		cpu-to-dev-map-0 =
+			< 1593600 1525 >;
+		cpu-to-dev-map-2 =
+			< 1977600 1525 >,
+			< 2054400 5195 >;
+	};
+};
+
+&clock_gpu {
+	qcom,gfxfreq-speedbin0 =
+		<          0  0  0 >,
+		<  315000000  4  4 >,
+		<  401800000  5  5 >,
+		<  510000000  6  5 >,
+		<  560000000  7  7 >,
+		<  624000000  8  7 >;
+
+	qcom,gfxfreq-mx-speedbin0 =
+		<          0  0 >,
+		<  315000000  4 >,
+		<  401800000  5 >,
+		<  510000000  5 >,
+		<  560000000  7 >,
+		<  624000000  7 >;
+
+	qcom,gfxfreq-speedbin1 =
+		<          0  0  0 >,
+		<  315000000  4  4 >,
+		<  401800000  5  5 >,
+		<  510000000  6  5 >;
+
+	qcom,gfxfreq-mx-speedbin1 =
+		<          0  0 >,
+		<  315000000  4 >,
+		<  401800000  5 >,
+		<  510000000  5 >;
+
+	qcom,gfxfreq-speedbin2 =
+		<          0  0  0 >,
+		<  315000000  4  4 >;
+
+	qcom,gfxfreq-mx-speedbin2 =
+		<          0  0 >,
+		<  315000000  4 >;
+};
+
+/* GPU overrides for auto */
+&msm_gpu {
+	qcom,gpu-pwrlevel-bins {
+		qcom,gpu-pwrlevels-0 {
+			qcom,initial-pwrlevel = <1>;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-cdp.dts
new file mode 100644
index 000000000000..f178aad48b96
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996pro.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro + PMI8994 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-mtp.dts
new file mode 100644
index 000000000000..8b5b98b2ff61
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996pro.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro + PMI8994 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pm8004-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pm8004-cdp.dts
new file mode 100644
index 000000000000..6e3aa371c744
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pm8004-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996pro.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro + PMI8994 + PM8004 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pm8004-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pm8004-mtp.dts
new file mode 100644
index 000000000000..b4919ee400f2
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pm8004-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996pro.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro + PMI8994 + PM8004 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pm8004-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pm8004-pmk8001-cdp.dts
new file mode 100644
index 000000000000..9fb0648c0db4
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pm8004-pmk8001-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996pro.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro + PMI8994 + PM8004 + PMK8001 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pm8004-pmk8001-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pm8004-pmk8001-mtp.dts
new file mode 100644
index 000000000000..ce9da52f0808
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pm8004-pmk8001-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996pro.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004-pmk8001.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro + PMI8994 + PM8004 + PMK8001 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pmk8001-cdp.dts
new file mode 100644
index 000000000000..15b4899b3306
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pmk8001-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+*
+* This program is free software; you can redistribute it and/or modify
+* it under the terms of the GNU General Public License version 2 and
+* only version 2 as published by the Free Software Foundation.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+*/
+
+/dts-v1/;
+
+#include "msm8996pro.dtsi"
+#include "msm8996-pm8994-pmi8994-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro + PMI8994 + PMK8001 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pmk8001-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pmk8001-mtp.dts
new file mode 100644
index 000000000000..997cfc9599de
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8994-pmk8001-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+*
+* This program is free software; you can redistribute it and/or modify
+* it under the terms of the GNU General Public License version 2 and
+* only version 2 as published by the Free Software Foundation.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+*/
+
+/dts-v1/;
+
+#include "msm8996pro.dtsi"
+#include "msm8996-pm8994-pmi8994-pmk8001.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro + PMI8994 + PMK8001 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-pmi8996-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8996-cdp.dts
new file mode 100644
index 000000000000..090071488d58
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8996-cdp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996pro.dtsi"
+#include "msm-pmi8996.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro + PMI8996 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-pmi8996-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8996-mtp.dts
new file mode 100644
index 000000000000..26e774fe4913
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8996-mtp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996pro.dtsi"
+#include "msm-pmi8996.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro + PMI8996 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-pmi8996-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8996-pmk8001-cdp.dts
new file mode 100644
index 000000000000..7416be9fef06
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8996-pmk8001-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996pro.dtsi"
+#include "msm8996-pm8994-pmi8996-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro + PM8994 + PMI8996 + PMK8001 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-pmi8996-pmk8001-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8996-pmk8001-mtp.dts
new file mode 100644
index 000000000000..17037e1755d6
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-pmi8996-pmk8001-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996pro.dtsi"
+#include "msm8996-pm8994-pmi8996-pmk8001.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro + PM8994 + PMI8996 + PMK8001 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-auto-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-auto-cdp.dts
new file mode 100644
index 000000000000..06d040aa6bcb
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-auto-cdp.dts
@@ -0,0 +1,42 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996pro-v1.1.dtsi"
+#include "msm8996-pm8994.dtsi"
+#include "msm8996-auto-cdp.dtsi"
+#include "msm8996pro-auto.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro v1.1 AUTO CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,msm-id = <315 0x10001>;
+	qcom,board-id = <0x03010001 0>;
+};
+
+&spi_9 {
+	status = "ok";
+	can-controller@0 {
+		compatible = "renesas,rh850";
+		reg = <0>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <127 0>;
+		spi-max-frequency = <5000000>;
+	};
+};
+
+&pil_modem {
+	pinctrl-names = "default";
+	pinctrl-0 = <&modem_mux>;
+};
+
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-cdp.dts
new file mode 100644
index 000000000000..70263bc3ffc3
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996pro-v1.1.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro v1.1 + PMI8994 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-mtp.dts
new file mode 100644
index 000000000000..ae176160ced9
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996pro-v1.1.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro v1.1 + PMI8994 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pm8004-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pm8004-cdp.dts
new file mode 100644
index 000000000000..625fe40d98cb
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pm8004-cdp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996pro-v1.1.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro v1.1 \
+					+ PMI8994 + PM8004 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pm8004-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pm8004-mtp.dts
new file mode 100644
index 000000000000..fa8a4210d5bd
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pm8004-mtp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996pro-v1.1.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro v1.1 \
+					+ PMI8994 + PM8004 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pm8004-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pm8004-pmk8001-cdp.dts
new file mode 100644
index 000000000000..51eebb1edeee
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pm8004-pmk8001-cdp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996pro-v1.1.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro v1.1 \
+					+ PMI8994 + PM8004 + PMK8001 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pm8004-pmk8001-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pm8004-pmk8001-mtp.dts
new file mode 100644
index 000000000000..a9f2684e1425
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pm8004-pmk8001-mtp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996pro-v1.1.dtsi"
+#include "msm8996-pm8994-pmi8994-pm8004-pmk8001.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro v1.1 \
+					+ PMI8994 + PM8004 + PMK8001 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pmk8001-cdp.dts
new file mode 100644
index 000000000000..485725d8c61b
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pmk8001-cdp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+*
+* This program is free software; you can redistribute it and/or modify
+* it under the terms of the GNU General Public License version 2 and
+* only version 2 as published by the Free Software Foundation.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+*/
+
+/dts-v1/;
+
+#include "msm8996pro-v1.1.dtsi"
+#include "msm8996-pm8994-pmi8994-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro v1.1 \
+					+ PMI8994 + PMK8001 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pmk8001-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pmk8001-mtp.dts
new file mode 100644
index 000000000000..bade1e4ba97c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8994-pmk8001-mtp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+*
+* This program is free software; you can redistribute it and/or modify
+* it under the terms of the GNU General Public License version 2 and
+* only version 2 as published by the Free Software Foundation.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+*/
+
+/dts-v1/;
+
+#include "msm8996pro-v1.1.dtsi"
+#include "msm8996-pm8994-pmi8994-pmk8001.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro v1.1 \
+					+ PMI8994 + PMK8001 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8996-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8996-cdp.dts
new file mode 100644
index 000000000000..78cac1282534
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8996-cdp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996pro-v1.1.dtsi"
+#include "msm-pmi8996.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro v1.1 + PMI8996 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>, <0x01000001 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8996-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8996-mtp.dts
new file mode 100644
index 000000000000..37a488df06c2
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8996-mtp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8996pro-v1.1.dtsi"
+#include "msm-pmi8996.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro v1.1 + PMI8996 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8996-pmk8001-cdp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8996-pmk8001-cdp.dts
new file mode 100644
index 000000000000..eb5c7405621a
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8996-pmk8001-cdp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996pro-v1.1.dtsi"
+#include "msm8996-pm8994-pmi8996-pmk8001.dtsi"
+#include "msm8996-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro v1.1 \
+					+ PM8994 + PMI8996 + PMK8001 CDP";
+	compatible = "qcom,msm8996-cdp", "qcom,msm8996", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8996-pmk8001-mtp.dts b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8996-pmk8001-mtp.dts
new file mode 100644
index 000000000000..1cc481c9b30e
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1-pmi8996-pmk8001-mtp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8996pro-v1.1.dtsi"
+#include "msm8996-pm8994-pmi8996-pmk8001.dtsi"
+#include "msm8996-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro v1.1 \
+					+ PM8994 + PMI8996 + PMK8001 MTP";
+	compatible = "qcom,msm8996-mtp", "qcom,msm8996", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro-v1.1.dtsi b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1.dtsi
new file mode 100644
index 000000000000..8babf6010a70
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro-v1.1.dtsi
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only version-specific property overrides should be placed
+ * inside this file. Common device definitions should be placed inside the
+ * msm8996.dtsi file.
+ */
+
+#include "msm8996pro.dtsi"
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro v1.1";
+	qcom,msm-id = <305 0x10001>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996pro.dtsi b/arch/arm64/boot/dts/qcom/msm8996pro.dtsi
new file mode 100644
index 000000000000..b9a2ccb973f2
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996pro.dtsi
@@ -0,0 +1,1570 @@
+/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only version-specific property overrides should be placed
+ * inside this file. Common device definitions should be placed inside the
+ * msm8996.dtsi file.
+ */
+
+#include "msm8996-v3.dtsi"
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996pro";
+	qcom,msm-id = <305 0x10000>;
+
+	chosen {
+		bootargs = "lpm_levels.sleep_disabled=1 fpsimd.fpsimd_settings=1 app_setting.use_app_setting=0 app_setting.use_32bit_app_setting_pro=1";
+	};
+};
+
+&apc_apm {
+	compatible = "qcom,msm8996pro-apm";
+	/delete-property/ qcom,clock-source-override;
+};
+
+&pm8994_s11 {
+	/delete-property/ qcom,recal-mask;
+};
+
+&apcc_cpr {
+	compatible = "qcom,cpr3-msm8996pro-hmss-regulator";
+	qcom,cpr-interrupt-affinity = <&CPU0 &CPU1>;
+};
+
+&apc0_pwrcl_vreg {
+	regulator-min-microvolt = <1>;
+	regulator-max-microvolt = <20>;
+
+	qcom,cpr-fuse-corners = <5>;
+	qcom,cpr-fuse-combos = <24>;
+	qcom,cpr-speed-bins = <3>;
+	qcom,cpr-speed-bin-corners = <20 20 19>;
+	qcom,cpr-corners =
+		/* Speed bin 0 */
+		<20 20 20 20 20 20 20 20>,
+
+		/* Speed bin 1 */
+		<20 20 20 20 20 20 20 20>,
+
+		/* Speed bin 2 */
+		<19 19 19 19 19 19 19 19>;
+
+	qcom,cpr-corner-fmax-map =
+		/* Speed bin 0 */
+		<1 6 9 14 19>,
+		<1 6 9 14 19>,
+		<3 6 9 14 19>,
+		<3 6 9 14 19>,
+		<3 6 9 14 19>,
+		<3 6 9 14 19>,
+		<3 6 9 14 19>,
+		<3 6 9 14 19>,
+
+		/* Speed bin 1 */
+		<1 6 9 14 19>,
+		<1 6 9 14 19>,
+		<3 6 9 14 19>,
+		<3 6 9 14 19>,
+		<3 6 9 14 19>,
+		<3 6 9 14 19>,
+		<3 6 9 14 19>,
+		<3 6 9 14 19>,
+
+		/* Speed bin 2 */
+		<1 6 9 14 19>,
+		<1 6 9 14 19>,
+		<3 6 9 14 19>,
+		<3 6 9 14 19>,
+		<3 6 9 14 19>,
+		<3 6 9 14 19>,
+		<3 6 9 14 19>,
+		<3 6 9 14 19>;
+
+	qcom,cpr-voltage-ceiling =
+		/* Speed bin 0 */
+		<670000  670000  670000  670000  670000  670000  745000  745000
+		 745000  905000  905000  905000  905000  905000 1140000 1140000
+		1140000 1140000 1140000 1140000>,
+
+		/* Speed bin 1 */
+		<670000  670000  670000  670000  670000  670000  745000  745000
+		 745000  905000  905000  905000  905000  905000 1140000 1140000
+		1140000 1140000 1140000 1140000>,
+
+		/* Speed bin 2 */
+		<670000  670000  670000  670000  670000  670000  745000  745000
+		 745000  905000  905000  905000  905000  905000 1140000 1140000
+		1140000 1140000 1140000>;
+
+	qcom,cpr-voltage-floor =
+		/* Speed bin 0 */
+		<470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000>,
+
+		/* Speed bin 1 */
+		<470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000>,
+
+		/* Speed bin 2 */
+		<470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000>;
+
+	qcom,cpr-floor-to-ceiling-max-range =
+		/* Speed bin 0 */
+		<80000   80000   80000   80000   80000   80000   80000   80000
+		 80000   80000   80000   80000   80000   80000   80000   80000
+		 80000   80000   80000   80000>,
+
+		/* Speed bin 1 */
+		<80000   80000   80000   80000   80000   80000   80000   80000
+		 80000   80000   80000   80000   80000   80000   80000   80000
+		 80000   80000   80000   80000>,
+
+		/* Speed bin 2 */
+		<80000   80000   80000   80000   80000   80000   80000   80000
+		 80000   80000   80000   80000   80000   80000   80000   80000
+		 80000   80000   80000>;
+
+	qcom,corner-frequencies =
+		/* Speed bin 0 */
+		<307200000  384000000  460800000  537600000  614400000
+		 691200000  768000000  844800000  902400000  979200000
+		1056000000 1132800000 1209600000 1286400000 1363200000
+		1440000000 1516800000 1593600000 1785600000 2188800000>,
+
+		/* Speed bin 1 */
+		<307200000  384000000  460800000  537600000  614400000
+		 691200000  768000000  844800000  902400000  979200000
+		1056000000 1132800000 1209600000 1286400000 1363200000
+		1440000000 1516800000 1593600000 1785600000 1996800000>,
+
+		/* Speed bin 2 */
+		<307200000  384000000  460800000  537600000  614400000
+		 691200000  768000000  844800000  902400000  979200000
+		1056000000 1132800000 1209600000 1286400000 1363200000
+		1440000000 1516800000 1593600000 1785600000>;
+
+	qcom,cpr-ro-scaling-factor =
+		<0 0 3112 2666 2947 2543 2271 1979 2623 2317 2772 2450 0 0 0 0>,
+		<0 0 3112 2666 2947 2543 2271 1979 2623 2317 2772 2450 0 0 0 0>,
+		<0 0 3112 2666 2947 2543 2271 1979 2623 2317 2772 2450 0 0 0 0>,
+		<0 0 3112 2666 2947 2543 2271 1979 2623 2317 2772 2450 0 0 0 0>,
+		<0 0 2889 2528 2740 2426 2310 2040 2519 2257 2668 2372 0 0 0 0>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		/* Speed bin 0 */
+		<(-45000)       0        0  (-25000)       0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+
+		/* Speed bin 1 */
+		<(-45000)       0        0  (-25000)       0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+
+		/* Speed bin 2 */
+		<(-45000)       0        0  (-25000)       0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >;
+
+	qcom,cpr-closed-loop-voltage-fuse-adjustment =
+		/* Speed bin 0 */
+		<(-55000) (-25000)  (-5000) (-20000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+
+		/* Speed bin 1 */
+		<(-55000) (-25000)  (-5000) (-20000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+
+		/* Speed bin 2 */
+		<(-55000) (-25000)  (-5000) (-20000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>,
+		<      0  (-15000) (-15000) (-15000) (-15000)>;
+
+	qcom,cpr-open-loop-voltage-adjustment =
+		/* Speed bin 0 */
+		<(-15000) (-15000) (-15000) (-15000) (-15000) (-15000) (-15000)
+		 (-15000) (-15000) (-17000) (-19000) (-21000) (-23000) (-25000)
+		 (-26000) (-27000) (-27000) (-28000) (-30000)  120000>,
+
+		/* Speed bin 1 */
+		<(-15000) (-15000) (-15000) (-15000) (-15000) (-15000) (-15000)
+		 (-15000) (-15000) (-17000) (-19000) (-21000) (-23000) (-25000)
+		 (-26000) (-27000) (-27000) (-28000) (-30000)   70000>,
+
+		/* Speed bin 2 */
+		<(-15000) (-15000) (-15000) (-15000) (-15000) (-15000) (-15000)
+		 (-15000) (-15000) (-17000) (-19000) (-21000) (-23000) (-25000)
+		 (-26000) (-27000) (-27000) (-28000) (-30000)>;
+
+	qcom,cpr-open-loop-voltage-min-diff =
+		/* Speed bin 0 */
+	       <0 0 0 0 (-50000) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0>,
+
+		/* Speed bin 1 */
+	       <0 0 0 0 (-50000) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0>,
+
+		/* Speed bin 2 */
+	       <0 0 0 0 (-50000) 0 0 0 0 0 0 0 0 0 0 0 0 0 0>;
+
+	qcom,cpr-closed-loop-voltage-adjustment =
+		/* Speed bin 0 */
+		<(-15000) (-15000) (-15000) (-15000) (-15000) (-15000) (-15000)
+		 (-15000) (-15000) (-17000) (-19000) (-21000) (-23000) (-25000)
+		 (-26000) (-27000) (-27000) (-28000) (-30000)  110000>,
+
+		/* Speed bin 1 */
+		<(-15000) (-15000) (-15000) (-15000) (-15000) (-15000) (-15000)
+		 (-15000) (-15000) (-17000) (-19000) (-21000) (-23000) (-25000)
+		 (-26000) (-27000) (-27000) (-28000) (-30000)   60000>,
+
+		/* Speed bin 2 */
+		<(-15000) (-15000) (-15000) (-15000) (-15000) (-15000) (-15000)
+		 (-15000) (-15000) (-17000) (-19000) (-21000) (-23000) (-25000)
+		 (-26000) (-27000) (-27000) (-28000) (-30000)>;
+
+	qcom,cpr-aging-max-voltage-adjustment = <15000>;
+	qcom,cpr-aging-ref-corner = <14 14 14>;
+	qcom,cpr-aging-ro-scaling-factor = <3200>;
+	qcom,allow-aging-voltage-adjustment = <1>;
+	qcom,allow-aging-open-loop-voltage-adjustment = <1>;
+
+	qcom,ldo-min-headroom-voltage = <80000>;
+};
+
+&apc0_cbf_vreg {
+	regulator-min-microvolt = <1>;
+	regulator-max-microvolt = <19>;
+	qcom,is-cbf-regulator;
+
+	qcom,proxy-consumer-voltage = <14 19>;
+
+	qcom,cpr-fuse-corners = <5>;
+	qcom,cpr-fuse-combos = <24>;
+	qcom,cpr-speed-bins = <3>;
+	qcom,cpr-speed-bin-corners = <19 19 19>;
+	qcom,cpr-corners =
+		/* Speed bin 0 */
+		<19 19 19 19 19 19 19 19>,
+
+		/* Speed bin 1 */
+		<19 19 19 19 19 19 19 19>,
+
+		/* Speed bin 2 */
+		<19 19 19 19 19 19 19 19>;
+
+	qcom,cpr-corner-fmax-map =
+		/* Speed bin 0 */
+		<1 4 7 14 19>,
+
+		/* Speed bin 1 */
+		<1 4 7 14 19>,
+
+		/* Speed bin 2 */
+		<1 4 7 14 19>;
+
+	qcom,cpr-voltage-ceiling =
+		/* Speed bin 0 */
+		<670000  670000  670000  670000  745000  745000  745000  905000
+		 905000  905000  905000  905000  905000  905000 1140000 1140000
+		1140000 1140000 1140000>,
+
+		/* Speed bin 1 */
+		<670000  670000  670000  670000  745000  745000  745000  905000
+		 905000  905000  905000  905000  905000  905000 1140000 1140000
+		1140000 1140000 1140000>,
+
+		/* Speed bin 2 */
+		<670000  670000  670000  670000  745000  745000  745000  905000
+		 905000  905000  905000  905000  905000  905000 1140000 1140000
+		1140000 1140000 1140000>;
+
+	qcom,cpr-voltage-floor =
+		/* Speed bin 0 */
+		<470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000>,
+
+		/* Speed bin 1 */
+		<470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000>,
+
+		/* Speed bin 2 */
+		<470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000>;
+
+	qcom,cpr-floor-to-ceiling-max-range =
+		 /* Speed bin 0 */
+		 <80000   80000   80000   80000   80000   80000   80000   80000
+		  80000   80000   80000   80000   80000   80000   80000   80000
+		  80000   80000   80000>,
+
+		/* Speed bin 1 */
+		 <80000   80000   80000   80000   80000   80000   80000   80000
+		  80000   80000   80000   80000   80000   80000   80000   80000
+		  80000   80000   80000>,
+
+		/* Speed bin 2 */
+		 <80000   80000   80000   80000   80000   80000   80000   80000
+		  80000   80000   80000   80000   80000   80000   80000   80000
+		  80000   80000   80000>;
+
+	qcom,corner-frequencies =
+		/* Speed bin 0 */
+		<192000000  307200000  384000000  441600000  537600000
+		 614400000  691200000  768000000  844800000  902400000
+		 979200000 1056000000 1132800000 1190400000 1286400000
+		1363200000 1440000000 1516800000 1593600000>,
+
+		/* Speed bin 1 */
+		<192000000  307200000  384000000  441600000  537600000
+		 614400000  691200000  768000000  844800000  902400000
+		 979200000 1056000000 1132800000 1190400000 1286400000
+		1363200000 1440000000 1516800000 1593600000>,
+
+		/* Speed bin 2 */
+		<192000000  307200000  384000000  441600000  537600000
+		 614400000  691200000  768000000  844800000  902400000
+		 979200000 1056000000 1132800000 1190400000 1286400000
+		1363200000 1440000000 1516800000 1593600000>;
+
+	qcom,cpr-ro-scaling-factor =
+		<0 0 3112 2666 2947 2543 2271 1979 2623 2317 2772 2450 0 0 0 0>,
+		<0 0 3112 2666 2947 2543 2271 1979 2623 2317 2772 2450 0 0 0 0>,
+		<0 0 3112 2666 2947 2543 2271 1979 2623 2317 2772 2450 0 0 0 0>,
+		<0 0 3112 2666 2947 2543 2271 1979 2623 2317 2772 2450 0 0 0 0>,
+		<0 0 2889 2528 2740 2426 2310 2040 2519 2257 2668 2372 0 0 0 0>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		/* Speed bin 0 */
+		<(-40000)       0        0  (-10000) (-50000)>,
+		<      0        0        0    15000        0 >,
+		<      0        0        0    15000        0 >,
+		<      0        0        0    15000        0 >,
+		<      0        0        0    15000        0 >,
+		<      0        0        0    15000        0 >,
+		<      0        0        0    15000        0 >,
+		<      0        0        0    15000        0 >,
+
+		/* Speed bin 1 */
+		<(-40000)       0        0  (-10000) (-50000)>,
+		<      0        0        0    15000        0 >,
+		<      0        0        0    15000        0 >,
+		<      0        0        0    15000        0 >,
+		<      0        0        0    15000        0 >,
+		<      0        0        0    15000        0 >,
+		<      0        0        0    15000        0 >,
+		<      0        0        0    15000        0 >,
+
+		/* Speed bin 2 */
+		<(-40000)       0        0  (-10000) (-50000)>,
+		<      0        0        0    15000        0 >,
+		<      0        0        0    15000        0 >,
+		<      0        0        0    15000        0 >,
+		<      0        0        0    15000        0 >,
+		<      0        0        0    15000        0 >,
+		<      0        0        0    15000        0 >,
+		<      0        0        0    15000        0 >;
+
+	qcom,cpr-closed-loop-voltage-fuse-adjustment =
+		/* Speed bin 0 */
+		<(-45000) (-25000)   10000  (-10000) (-40000)>,
+		<(-15000) (-10000)    5000    20000        0 >,
+		<(-15000) (-10000)    5000    20000        0 >,
+		<(-15000) (-10000)    5000    20000        0 >,
+		<(-15000) (-10000)    5000    20000        0 >,
+		<(-15000) (-10000)    5000    20000        0 >,
+		<(-15000) (-10000)    5000    20000        0 >,
+		<(-15000) (-10000)    5000    20000        0 >,
+
+		/* Speed bin 1 */
+		<(-45000) (-25000)   10000  (-10000) (-40000)>,
+		<(-15000) (-10000)    5000    20000        0 >,
+		<(-15000) (-10000)    5000    20000        0 >,
+		<(-15000) (-10000)    5000    20000        0 >,
+		<(-15000) (-10000)    5000    20000        0 >,
+		<(-15000) (-10000)    5000    20000        0 >,
+		<(-15000) (-10000)    5000    20000        0 >,
+		<(-15000) (-10000)    5000    20000        0 >,
+
+		/* Speed bin 2 */
+		<(-45000) (-25000)   10000  (-10000) (-40000)>,
+		<(-15000) (-10000)    5000    20000        0 >,
+		<(-15000) (-10000)    5000    20000        0 >,
+		<(-15000) (-10000)    5000    20000        0 >,
+		<(-15000) (-10000)    5000    20000        0 >,
+		<(-15000) (-10000)    5000    20000        0 >,
+		<(-15000) (-10000)    5000    20000        0 >,
+		<(-15000) (-10000)    5000    20000        0 >;
+
+	qcom,cpr-aging-max-voltage-adjustment = <15000>;
+	qcom,cpr-aging-ref-corner = <14 14 14>;
+	qcom,cpr-aging-ro-scaling-factor = <3200>;
+	qcom,allow-aging-voltage-adjustment = <1>;
+	qcom,allow-aging-open-loop-voltage-adjustment = <1>;
+};
+
+&apc1_vreg {
+	regulator-min-microvolt = <1>;
+	regulator-max-microvolt = <27>;
+
+	qcom,cpr-fuse-corners = <5>;
+	qcom,cpr-fuse-combos = <24>;
+	qcom,cpr-speed-bins = <3>;
+	qcom,cpr-speed-bin-corners = <27 25 25>;
+	qcom,cpr-corners =
+		/* Speed bin 0 */
+		<27 27 27 27 27 27 27 27>,
+
+		/* Speed bin 1 */
+		<25 25 25 25 25 25 25 25>,
+
+		/* Speed bin 2 */
+		<25 25 25 25 25 25 25 25>;
+
+	qcom,cpr-corner-fmax-map =
+		/* Speed bin 0 */
+		<1 7 10 15 27>,
+		<1 7 10 15 27>,
+		<4 7 10 15 27>,
+		<4 7 10 15 27>,
+		<4 7 10 15 27>,
+		<4 7 10 15 27>,
+		<4 7 10 15 27>,
+		<4 7 10 15 27>,
+
+		/* Speed bin 1 */
+		<1 7 10 15 25>,
+		<1 7 10 15 25>,
+		<4 7 10 15 25>,
+		<4 7 10 15 25>,
+		<4 7 10 15 25>,
+		<4 7 10 15 25>,
+		<4 7 10 15 25>,
+		<4 7 10 15 25>,
+
+		/* Speed bin 2 */
+		<1 7 10 15 25>,
+		<1 7 10 15 25>,
+		<4 7 10 15 25>,
+		<4 7 10 15 25>,
+		<4 7 10 15 25>,
+		<4 7 10 15 25>,
+		<4 7 10 15 25>,
+		<4 7 10 15 25>;
+
+	qcom,cpr-voltage-ceiling =
+		/* Speed bin 0 */
+		<670000  670000  670000  670000  670000  670000  670000  745000
+		 745000  745000  905000  905000  905000  905000  905000 1140000
+		1140000 1140000 1140000 1140000 1140000 1140000 1140000 1140000
+		1140000 1140000 1140000>,
+
+		/* Speed bin 1 */
+		<670000  670000  670000  670000  670000  670000  670000  745000
+		 745000  745000  905000  905000  905000  905000  905000 1140000
+		1140000 1140000 1140000 1140000 1140000 1140000 1140000 1140000
+		1140000>,
+
+		/* Speed bin 2 */
+		<670000  670000  670000  670000  670000  670000  670000  745000
+		 745000  745000  905000  905000  905000  905000  905000 1140000
+		1140000 1140000 1140000 1140000 1140000 1140000 1140000 1140000
+		1140000>;
+
+	qcom,cpr-voltage-floor =
+		/* Speed bin 0 */
+		<470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000>,
+
+		/* Speed bin 1 */
+		<470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000  470000  470000  470000  470000
+		 470000>,
+
+		/* Speed bin 2 */
+		<470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000  470000  470000  470000  470000
+		 470000  470000  470000  470000  470000  470000  470000  470000
+		 470000>;
+
+	qcom,cpr-floor-to-ceiling-max-range =
+		 /* Speed bin 0 */
+		 <80000   80000   80000   80000   80000   80000   80000   80000
+		  80000   80000   80000   80000   80000   80000   80000   80000
+		  80000   80000   80000   80000   80000   80000   80000   80000
+		  80000   80000   80000>,
+
+		 /* Speed bin 1 */
+		 <80000   80000   80000   80000   80000   80000   80000   80000
+		  80000   80000   80000   80000   80000   80000   80000   80000
+		  80000   80000   80000   80000   80000   80000   80000   80000
+		  80000>,
+
+		 /* Speed bin 2 */
+		 <80000   80000   80000   80000   80000   80000   80000   80000
+		  80000   80000   80000   80000   80000   80000   80000   80000
+		  80000   80000   80000   80000   80000   80000   80000   80000
+		  80000>;
+
+	qcom,corner-frequencies =
+		/* Speed bin 0 */
+		<307200000  384000000  460800000  537600000  614400000
+		 691200000  748800000  825600000  902400000  979200000
+		1056000000 1132800000 1209600000 1286400000 1363200000
+		1440000000 1516800000 1593600000 1670400000 1747200000
+		1824000000 1900800000 1977600000 2054400000 2150400000
+		2246400000 2342400000>,
+
+		/* Speed bin 1 */
+		<307200000  384000000  460800000  537600000  614400000
+		 691200000  748800000  825600000  902400000  979200000
+		1056000000 1132800000 1209600000 1286400000 1363200000
+		1440000000 1516800000 1593600000 1670400000 1747200000
+		1824000000 1900800000 1977600000 2054400000 2150400000>,
+
+		/* Speed bin 2 */
+		<307200000  384000000  460800000  537600000  614400000
+		 691200000  748800000  825600000  902400000  979200000
+		1056000000 1132800000 1209600000 1286400000 1363200000
+		1440000000 1516800000 1593600000 1670400000 1747200000
+		1824000000 1900800000 1977600000 2054400000 2150400000>;
+
+	qcom,cpr-ro-scaling-factor =
+		<0 0 3112 2666 2947 2543 2271 1979 2623 2317 2772 2450 0 0 0 0>,
+		<0 0 3112 2666 2947 2543 2271 1979 2623 2317 2772 2450 0 0 0 0>,
+		<0 0 3112 2666 2947 2543 2271 1979 2623 2317 2772 2450 0 0 0 0>,
+		<0 0 3112 2666 2947 2543 2271 1979 2623 2317 2772 2450 0 0 0 0>,
+		<0 0 2889 2528 2740 2426 2310 2040 2519 2257 2668 2372 0 0 0 0>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		/* Speed bin 0 */
+		<(-45000)       0    15000  (-20000)       0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+
+		/* Speed bin 1 */
+		<(-45000)       0    15000  (-20000)       0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+
+		/* Speed bin 2 */
+		<(-45000)       0    15000  (-20000)       0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >,
+		<      0        0        0        0        0 >;
+
+	qcom,cpr-closed-loop-voltage-fuse-adjustment =
+		/* Speed bin 0 */
+		<(-55000) (-20000)   15000  (-15000) (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+
+		/* Speed bin 1 */
+		<(-55000) (-20000)   15000  (-15000) (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+
+		/* Speed bin 2 */
+		<(-55000) (-20000)   15000  (-15000) (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>,
+		<      0  (-10000) (-15000)       0  (-10000)>;
+
+	qcom,cpr-open-loop-voltage-adjustment =
+		/* Speed bin 0 */
+		<(-15000) (-15000) (-15000) (-15000) (-15000) (-15000) (-15000)
+		 (-15000) (-15000) (-15000) (-17000) (-19000) (-21000) (-23000)
+		 (-25000) (-25000) (-26000) (-26000) (-27000) (-27000) (-28000)
+		 (-28000) (-29000) (-29000) (-30000) (-30000) (-30000)>,
+
+		/* Speed bin 1 */
+		<(-15000) (-15000) (-15000) (-15000) (-15000) (-15000) (-15000)
+		 (-15000) (-15000) (-15000) (-17000) (-19000) (-21000) (-23000)
+		 (-25000) (-25000) (-26000) (-26000) (-27000) (-27000) (-28000)
+		 (-28000) (-29000) (-29000) (-30000)>,
+
+		/* Speed bin 2 */
+		<(-15000) (-15000) (-15000) (-15000) (-15000) (-15000) (-15000)
+		 (-15000) (-15000) (-15000) (-17000) (-19000) (-21000) (-23000)
+		 (-25000) (-25000) (-26000) (-26000) (-27000) (-27000) (-28000)
+		 (-28000) (-29000) (-29000) (-30000)>;
+
+	qcom,cpr-open-loop-voltage-min-diff =
+		/* Speed bin 0 */
+		<0 0 0 0 (-50000) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0>,
+
+		/* Speed bin 1 */
+		<0 0 0 0 (-50000) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0>,
+
+		/* Speed bin 2 */
+		<0 0 0 0 (-50000) 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0>;
+
+	qcom,cpr-closed-loop-voltage-adjustment =
+		/* Speed bin 0 */
+		<(-15000) (-15000) (-15000) (-15000) (-15000) (-15000) (-15000)
+		 (-15000) (-15000) (-15000) (-17000) (-19000) (-21000) (-23000)
+		 (-25000) (-25000) (-26000) (-26000) (-27000) (-27000) (-28000)
+		 (-28000) (-29000) (-29000) (-30000) (-30000) (-30000)>,
+
+		/* Speed bin 1 */
+		<(-15000) (-15000) (-15000) (-15000) (-15000) (-15000) (-15000)
+		 (-15000) (-15000) (-15000) (-17000) (-19000) (-21000) (-23000)
+		 (-25000) (-25000) (-26000) (-26000) (-27000) (-27000) (-28000)
+		 (-28000) (-29000) (-29000) (-30000)>,
+
+		/* Speed bin 1 */
+		<(-15000) (-15000) (-15000) (-15000) (-15000) (-15000) (-15000)
+		 (-15000) (-15000) (-15000) (-17000) (-19000) (-21000) (-23000)
+		 (-25000) (-25000) (-26000) (-26000) (-27000) (-27000) (-28000)
+		 (-28000) (-29000) (-29000) (-30000)>;
+
+	qcom,cpr-aging-max-voltage-adjustment = <15000>;
+	qcom,cpr-aging-ref-corner = <15 15 15>;
+	qcom,cpr-aging-ro-scaling-factor = <3200>;
+	qcom,allow-aging-voltage-adjustment = <1>;
+	qcom,allow-aging-open-loop-voltage-adjustment = <1>;
+
+	qcom,cpr-dynamic-floor-corner = <1>;
+	qcom,ldo-min-headroom-voltage = <130000>;
+};
+
+&pmi8994_s2 {
+	regulator-max-microvolt = <1065000>;
+};
+
+&pm8004_s2 {
+	regulator-max-microvolt = <1065000>;
+};
+
+&gfx_cpr {
+	compatible = "qcom,cpr3-msm8996pro-mmss-regulator";
+};
+
+&gfx_vreg {
+	regulator-min-microvolt = <2>;
+	regulator-max-microvolt = <9>;
+
+	qcom,cpr-fuse-corners = <4>;
+	qcom,cpr-fuse-combos = <24>;
+	qcom,cpr-speed-bins = <3>;
+	qcom,cpr-speed-bin-corners = <9 9 9>;
+	qcom,cpr-corners =
+		/* Speed bin 0 */
+		<9 9 9 9 9 9 9 9>,
+
+		/* Speed bin 1 */
+		<9 9 9 9 9 9 9 9>,
+
+		/* Speed bin 2 */
+		<9 9 9 9 9 9 9 9>;
+
+	qcom,cpr-corner-fmax-map =
+		/* Speed bin 0 */
+		<2 4 6 9>,
+
+		/* Speed bin 1 */
+		<2 4 6 9>,
+
+		/* Speed bin 2 */
+		<2 4 6 9>;
+
+	qcom,cpr-voltage-ceiling =
+		/* Speed bin 0 */
+		<400000  670000  670000  745000  825000  905000  960000 1015000
+		1065000>,
+
+		/* Speed bin 1 */
+		<400000  670000  670000  745000  825000  905000  960000 1015000
+		1065000>,
+
+		/* Speed bin 2 */
+		<400000  670000  670000  745000  825000  905000  960000 1015000
+		1065000>;
+
+	qcom,cpr-voltage-floor =
+		/* Speed bin 0 */
+		<400000  520000  520000  520000  520000  520000  520000  520000
+		 520000>,
+
+		/* Speed bin 1 */
+		<400000  520000  520000  520000  520000  520000  520000  520000
+		 520000>,
+
+		/* Speed bin 2 */
+		<400000  520000  520000  520000  520000  520000  520000  520000
+		 520000>;
+
+	qcom,mem-acc-voltage =
+		/* Speed bin 0 */
+		<1 1 1 1 2 2 2 2 2>,
+
+		/* Speed bin 1 */
+		<1 1 1 1 2 2 2 2 2>,
+
+		/* Speed bin 2 */
+		<1 1 1 1 2 2 2 2 2>;
+
+	qcom,corner-frequencies =
+		/* Speed bin 0 */
+		<0 133000000 214000000 315000000 401800000 510000000 560000000
+		   624000000 652800000>,
+
+		/* Speed bin 1 */
+		<0 133000000 214000000 315000000 401800000 510000000 560000000
+		   624000000 652800000>,
+
+		/* Speed bin 2 */
+		<0 133000000 214000000 315000000 401800000 510000000 560000000
+		   624000000 652800000>;
+
+	qcom,cpr-target-quotients =
+		/* Speed bin 0 */
+		<0 0 0 0 0 0    0    0    0    0    0    0 0 0 0 0>,
+		<0 0 0 0 0 0  185  179  291  299  304  319 0 0 0 0>,
+		<0 0 0 0 0 0  287  273  425  426  443  453 0 0 0 0>,
+		<0 0 0 0 0 0  414  392  584  576  608  612 0 0 0 0>,
+		<0 0 0 0 0 0  459  431  684  644  692  679 0 0 0 0>,
+		<0 0 0 0 0 0  577  543  798  768  823  810 0 0 0 0>,
+		<0 0 0 0 0 0  669  629  886  864  924  911 0 0 0 0>,
+		<0 0 0 0 0 0  771  725  984  970 1036 1024 0 0 0 0>,
+		<0 0 0 0 0 0  908  868 1118 1106 1179 1174 0 0 0 0>,
+
+		/* Speed bin 1 */
+		<0 0 0 0 0 0    0    0    0    0    0    0 0 0 0 0>,
+		<0 0 0 0 0 0  185  179  291  299  304  319 0 0 0 0>,
+		<0 0 0 0 0 0  287  273  425  426  443  453 0 0 0 0>,
+		<0 0 0 0 0 0  414  392  584  576  608  612 0 0 0 0>,
+		<0 0 0 0 0 0  459  431  684  644  692  679 0 0 0 0>,
+		<0 0 0 0 0 0  577  543  798  768  823  810 0 0 0 0>,
+		<0 0 0 0 0 0  669  629  886  864  924  911 0 0 0 0>,
+		<0 0 0 0 0 0  771  725  984  970 1036 1024 0 0 0 0>,
+		<0 0 0 0 0 0  908  868 1118 1106 1179 1174 0 0 0 0>,
+
+		/* Speed bin 2 */
+		<0 0 0 0 0 0    0    0    0    0    0    0 0 0 0 0>,
+		<0 0 0 0 0 0  185  179  291  299  304  319 0 0 0 0>,
+		<0 0 0 0 0 0  287  273  425  426  443  453 0 0 0 0>,
+		<0 0 0 0 0 0  414  392  584  576  608  612 0 0 0 0>,
+		<0 0 0 0 0 0  459  431  684  644  692  679 0 0 0 0>,
+		<0 0 0 0 0 0  577  543  798  768  823  810 0 0 0 0>,
+		<0 0 0 0 0 0  669  629  886  864  924  911 0 0 0 0>,
+		<0 0 0 0 0 0  771  725  984  970 1036 1024 0 0 0 0>,
+		<0 0 0 0 0 0  908  868 1118 1106 1179 1174 0 0 0 0>;
+
+	qcom,cpr-ro-scaling-factor =
+		/* Speed bin 0 */
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+
+		/* Speed bin 1 */
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+
+		/* Speed bin 2 */
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>,
+		<0 0 0 0 0 0 2035 1917 1959 2131 2246 2253 0 0 0 0>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		/* Speed bin 0 */
+		<(-85000) (-15000) (-15000) (-40000)>,
+
+		/* Speed bin 1 */
+		<(-85000) (-15000) (-15000) (-40000)>,
+
+		/* Speed bin 2 */
+		<(-85000) (-15000) (-15000) (-40000)>;
+
+	qcom,cpr-closed-loop-voltage-adjustment =
+		/* Speed bin 0 */
+		<0 0 30000 10000 10000 45000 25000 25000 (-35000)>,
+
+		/* Speed bin 1 */
+		<0 0 30000 10000 10000 45000 25000 25000 (-35000)>,
+
+		/* Speed bin 2 */
+		<0 0 30000 10000 10000 45000 25000 25000 (-35000)>;
+
+	qcom,cpr-floor-to-ceiling-max-range =
+		/* Speed bin 0 */
+		<0 70000 70000 75000 80000 90000 95000 100000 100000>,
+
+		/* Speed bin 1 */
+		<0 70000 70000 75000 80000 90000 95000 100000 100000>,
+
+		/* Speed bin 2 */
+		<0 70000 70000 75000 80000 90000 95000 100000 100000>;
+
+	qcom,cpr-fused-closed-loop-voltage-adjustment-map =
+		/* Speed bin 0 */
+		<0 2 2 2 2 0 0 4 4>,
+
+		/* Speed bin 1 */
+		<0 2 2 2 2 0 0 4 4>,
+
+		/* Speed bin 2 */
+		<0 2 2 2 2 0 0 4 4>;
+
+	qcom,cpr-aging-max-voltage-adjustment = <15000>;
+	qcom,cpr-aging-ref-corner = <6>;
+	qcom,cpr-aging-ro-scaling-factor = <2950>;
+	qcom,allow-aging-voltage-adjustment = <1>;
+	qcom,allow-aging-open-loop-voltage-adjustment = <1>;
+};
+
+&kryo0_vreg {
+	qcom,ldo-headroom-voltage = <80000>;
+};
+
+&kryo1_vreg {
+	qcom,ldo-headroom-voltage = <130000>;
+};
+
+&clock_cpu {
+	compatible = "qcom,cpu-clock-8996-pro";
+	qcom,pwrcl-speedbin0-v0 =
+		<          0  0 >,
+		<  307200000  1 >,
+		<  384000000  2 >,
+		<  460800000  3 >,
+		<  537600000  4 >,
+		<  614400000  5 >,
+		<  691200000  6 >,
+		<  768000000  7 >,
+		<  844800000  8 >,
+		<  902400000  9 >,
+		<  979200000 10 >,
+		< 1056000000 11 >,
+		< 1132800000 12 >,
+		< 1209600000 13 >,
+		< 1286400000 14 >,
+		< 1363200000 15 >,
+		< 1440000000 16 >,
+		< 1516800000 17 >,
+		< 1593600000 18 >,
+		< 2188800000 20 >;
+	qcom,pwrcl-speedbin1-v0 =
+		<          0  0 >,
+		<  307200000  1 >,
+		<  384000000  2 >,
+		<  460800000  3 >,
+		<  537600000  4 >,
+		<  614400000  5 >,
+		<  691200000  6 >,
+		<  768000000  7 >,
+		<  844800000  8 >,
+		<  902400000  9 >,
+		<  979200000 10 >,
+		< 1056000000 11 >,
+		< 1132800000 12 >,
+		< 1209600000 13 >,
+		< 1286400000 14 >,
+		< 1363200000 15 >,
+		< 1440000000 16 >,
+		< 1516800000 17 >,
+		< 1593600000 18 >,
+		< 1996800000 20 >;
+	qcom,pwrcl-speedbin2-v0 =
+		<          0  0 >,
+		<  307200000  1 >,
+		<  384000000  2 >,
+		<  460800000  3 >,
+		<  537600000  4 >,
+		<  614400000  5 >,
+		<  691200000  6 >,
+		<  768000000  7 >,
+		<  844800000  8 >,
+		<  902400000  9 >,
+		<  979200000 10 >,
+		< 1056000000 11 >,
+		< 1132800000 12 >,
+		< 1209600000 13 >,
+		< 1286400000 14 >,
+		< 1363200000 15 >,
+		< 1440000000 16 >,
+		< 1516800000 17 >,
+		< 1593600000 18 >;
+	qcom,perfcl-speedbin0-v0 =
+		<          0  0 >,
+		<  307200000  1 >,
+		<  384000000  2 >,
+		<  460800000  3 >,
+		<  537600000  4 >,
+		<  614400000  5 >,
+		<  691200000  6 >,
+		<  748800000  7 >,
+		<  825600000  8 >,
+		<  902400000  9 >,
+		<  979200000 10 >,
+		< 1056000000 11 >,
+		< 1132800000 12 >,
+		< 1209600000 13 >,
+		< 1286400000 14 >,
+		< 1363200000 15 >,
+		< 1440000000 16 >,
+		< 1516800000 17 >,
+		< 1593600000 18 >,
+		< 1670400000 19 >,
+		< 1747200000 20 >,
+		< 1824000000 21 >,
+		< 1900800000 22 >,
+		< 1977600000 23 >,
+		< 2054400000 24 >,
+		< 2150400000 25 >,
+		< 2246400000 26 >,
+		< 2342400000 27 >;
+	qcom,perfcl-speedbin1-v0 =
+		<          0  0 >,
+		<  307200000  1 >,
+		<  384000000  2 >,
+		<  460800000  3 >,
+		<  537600000  4 >,
+		<  614400000  5 >,
+		<  691200000  6 >,
+		<  748800000  7 >,
+		<  825600000  8 >,
+		<  902400000  9 >,
+		<  979200000 10 >,
+		< 1056000000 11 >,
+		< 1132800000 12 >,
+		< 1209600000 13 >,
+		< 1286400000 14 >,
+		< 1363200000 15 >,
+		< 1440000000 16 >,
+		< 1516800000 17 >,
+		< 1593600000 18 >,
+		< 1670400000 19 >,
+		< 1747200000 20 >,
+		< 1824000000 21 >,
+		< 1900800000 22 >,
+		< 1977600000 23 >,
+		< 2054400000 24 >,
+		< 2150400000 25 >;
+	qcom,perfcl-speedbin2-v0 =
+		<          0  0 >,
+		<  307200000  1 >,
+		<  384000000  2 >,
+		<  460800000  3 >,
+		<  537600000  4 >,
+		<  614400000  5 >,
+		<  691200000  6 >,
+		<  748800000  7 >,
+		<  825600000  8 >,
+		<  902400000  9 >,
+		<  979200000 10 >,
+		< 1056000000 11 >,
+		< 1132800000 12 >,
+		< 1209600000 13 >,
+		< 1286400000 14 >,
+		< 1363200000 15 >,
+		< 1440000000 16 >,
+		< 1516800000 17 >,
+		< 1593600000 18 >,
+		< 1670400000 19 >,
+		< 1747200000 20 >,
+		< 1824000000 21 >,
+		< 1900800000 22 >;
+	qcom,cbf-speedbin0-v0 =
+		<	   0  0 >,
+		<  192000000  1 >,
+		<  307200000  2 >,
+		<  384000000  3 >,
+		<  441600000  4 >,
+		<  537600000  5 >,
+		<  614400000  6 >,
+		<  691200000  7 >,
+		<  768000000  8 >,
+		<  844800000  9 >,
+		<  902400000 10 >,
+		<  979200000 11 >,
+		< 1056000000 12 >,
+		< 1132800000 13 >,
+		< 1190400000 14 >,
+		< 1286400000 15 >,
+		< 1363200000 16 >,
+		< 1440000000 17 >,
+		< 1516800000 18 >,
+		< 1593600000 19 >;
+	qcom,cbf-speedbin1-v0 =
+		<	   0  0 >,
+		<  192000000  1 >,
+		<  307200000  2 >,
+		<  384000000  3 >,
+		<  441600000  4 >,
+		<  537600000  5 >,
+		<  614400000  6 >,
+		<  691200000  7 >,
+		<  768000000  8 >,
+		<  844800000  9 >,
+		<  902400000 10 >,
+		<  979200000 11 >,
+		< 1056000000 12 >,
+		< 1132800000 13 >,
+		< 1190400000 14 >,
+		< 1286400000 15 >,
+		< 1363200000 16 >,
+		< 1440000000 17 >,
+		< 1516800000 18 >,
+		< 1593600000 19 >;
+	qcom,cbf-speedbin2-v0 =
+		<          0  0 >,
+		<  192000000  1 >,
+		<  307200000  2 >,
+		<  384000000  3 >,
+		<  441600000  4 >,
+		<  537600000  5 >,
+		<  614400000  6 >,
+		<  691200000  7 >,
+		<  768000000  8 >,
+		<  844800000  9 >,
+		<  902400000 10 >,
+		<  979200000 11 >,
+		< 1056000000 12 >,
+		< 1132800000 13 >,
+		< 1190400000 14 >,
+		< 1286400000 15 >,
+		< 1363200000 16 >,
+		< 1440000000 17 >,
+		< 1516800000 18 >,
+		< 1593600000 19 >;
+};
+
+&clock_mmss {
+	compatible = "qcom,mmsscc-8996-pro";
+	reg = <0x8c0000 0xb00c>,
+	      < 0x7013c 0x8 >;
+	reg-names = "cc_base", "efuse";
+};
+
+&clock_gpu {
+	compatible = "qcom,gpucc-8996-pro";
+	qcom,gfxfreq-speedbin0 =
+		<	   0  0  0 >,
+		<  133000000  2  4 >,
+		<  214000000  3  4 >,
+		<  315000000  4  4 >,
+		<  401800000  5  5 >,
+		<  510000000  6  5 >,
+		<  560000000  7  7 >,
+		<  624000000  8  7 >,
+		<  652800000  9  7 >;
+	qcom,gfxfreq-mx-speedbin0 =
+		<	   0  0 >,
+		<  133000000  4 >,
+		<  214000000  4 >,
+		<  315000000  4 >,
+		<  401800000  5 >,
+		<  510000000  5 >,
+		<  560000000  7 >,
+		<  624000000  7 >,
+		<  652800000  7 >;
+
+	qcom,gfxfreq-speedbin1 =
+		<	   0  0  0 >,
+		<  133000000  2  4 >,
+		<  214000000  3  4 >,
+		<  315000000  4  4 >,
+		<  401800000  5  5 >,
+		<  510000000  6  5 >,
+		<  560000000  7  7 >,
+		<  624000000  8  7 >;
+	qcom,gfxfreq-mx-speedbin1 =
+		<	   0  0 >,
+		<  133000000  4 >,
+		<  214000000  4 >,
+		<  315000000  4 >,
+		<  401800000  5 >,
+		<  510000000  5 >,
+		<  560000000  7 >,
+		<  624000000  7 >;
+	qcom,gfxfreq-speedbin2 =
+		<          0  0  0 >,
+		<  133000000  2  4 >,
+		<  214000000  3  4 >,
+		<  315000000  4  4 >,
+		<  401800000  5  5 >,
+		<  510000000  6  5 >;
+	qcom,gfxfreq-mx-speedbin2 =
+		<          0  0 >,
+		<  133000000  4 >,
+		<  214000000  4 >,
+		<  315000000  4 >,
+		<  401800000  5 >,
+		<  510000000  5 >;
+};
+
+&msm_cpufreq {
+	qcom,cpufreq-table-0 =
+		<  307200 >,
+		<  384000 >,
+		<  460800 >,
+		<  537600 >,
+		<  614400 >,
+		<  691200 >,
+		<  768000 >,
+		<  844800 >,
+		<  902400 >,
+		<  979200 >,
+		< 1056000 >,
+		< 1132800 >,
+		< 1209600 >,
+		< 1286400 >,
+		< 1363200 >,
+		< 1440000 >,
+		< 1516800 >,
+		< 1593600 >,
+		< 2188800 >;
+	qcom,cpufreq-table-2 =
+		<  307200 >,
+		<  384000 >,
+		<  460800 >,
+		<  537600 >,
+		<  614400 >,
+		<  691200 >,
+		<  748800 >,
+		<  825600 >,
+		<  902400 >,
+		<  979200 >,
+		< 1056000 >,
+		< 1132800 >,
+		< 1209600 >,
+		< 1286400 >,
+		< 1363200 >,
+		< 1440000 >,
+		< 1516800 >,
+		< 1593600 >,
+		< 1670400 >,
+		< 1747200 >,
+		< 1824000 >,
+		< 1900800 >,
+		< 1977600 >,
+		< 2054400 >,
+		< 2150400 >,
+		< 2246400 >,
+		< 2342400 >;
+};
+
+&m4m_cache {
+	freq-tbl-khz =
+		<  192000 >,
+		<  307200 >,
+		<  384000 >,
+		<  441600 >,
+		<  537600 >,
+		<  614400 >,
+		<  691200 >,
+		<  768000 >,
+		<  844800 >,
+		<  902400 >,
+		<  979200 >,
+		< 1056000 >,
+		< 1132800 >,
+		< 1190400 >,
+		< 1286400 >,
+		< 1363200 >,
+		< 1440000 >,
+		< 1516800 >,
+		< 1593600 >;
+};
+
+&devfreq_cpufreq {
+	m4m-cpufreq {
+		cpu-to-dev-map-0 =
+			<  307200  192000 >,
+			<  384000  192000 >,
+			<  460800  192000 >,
+			<  537600  192000 >,
+			<  614400  307200 >,
+			<  691200  307200 >,
+			<  768000  384000 >,
+			<  844800  441600 >,
+			<  902400  537600 >,
+			<  979200  614400 >,
+			< 1056000  691200 >,
+			< 1132800  768000 >,
+			< 1209600  844800 >,
+			< 1286400  902400 >,
+			< 1363200 1056000 >,
+			< 1440000 1132800 >,
+			< 1516800 1190400 >,
+			< 1593600 1286400 >,
+			< 2188800 1593600 >;
+		cpu-to-dev-map-2 =
+			<  307200  192000 >,
+			<  384000  192000 >,
+			<  460800  192000 >,
+			<  537600  192000 >,
+			<  614400  192000 >,
+			<  691200  307200 >,
+			<  748800  307200 >,
+			<  825600  384000 >,
+			<  902400  441600 >,
+			<  979200  537600 >,
+			< 1056000  614400 >,
+			< 1132800  691200 >,
+			< 1209600  768000 >,
+			< 1286400  844800 >,
+			< 1363200  902400 >,
+			< 1440000  979200 >,
+			< 1516800 1056000 >,
+			< 1593600 1190400 >,
+			< 1670400 1286400 >,
+			< 1747200 1363200 >,
+			< 1824000 1440000 >,
+			< 1900800 1516800 >,
+			< 1977600 1593600 >,
+			< 2054400 1593600 >,
+			< 2150400 1593600 >,
+			< 2246400 1593600 >,
+			< 2342400 1593600 >;
+	};
+
+	mincpubw-cpufreq {
+		cpu-to-dev-map-0 =
+			< 1593600 1525 >;
+		cpu-to-dev-map-2 =
+			< 2054400 1525 >,
+			< 2150400 5195 >;
+	};
+};
+
+&soc {
+	qcom,msm-thermal {
+		qcom,poll-ms = <50>;
+		qcom,limit-temp = <80>;
+		qcom,core-limit-temp = <90>;
+		msm_thermal_freq: qcom,vdd-apps-rstr {
+			qcom,max-freq-level = <1209600>;
+			qcom,levels = <1056000 1516800 1516800>;
+		};
+		qcom,vdd-gfx-rstr{
+			qcom,levels = <6 8 9>; /* Nominal, Turbo, Turbo_L1 */
+		};
+	};
+};
+
+/* GPU overrides */
+&msm_gpu {
+	/* Updated chip ID */
+	qcom,chipid = <0x05030004>;
+
+	/delete-property/ qcom,gpu-quirk-critical-packets;
+
+	qcom,gpu-speed-bin = <0x413c 0x30000000 28>;
+
+	qcom,gpu-pwrlevel-bins {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		compatible="qcom,gpu-pwrlevel-bins";
+
+		qcom,gpu-pwrlevels-0 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,speed-bin = <0>;
+
+			qcom,initial-pwrlevel = <6>;
+
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <652800000>;
+				qcom,bus-freq = <12>;
+				qcom,bus-min = <12>;
+				qcom,bus-max = <12>;
+			};
+
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <624000000>;
+				qcom,bus-freq = <12>;
+				qcom,bus-min = <11>;
+				qcom,bus-max = <12>;
+			};
+
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <560000000>;
+				qcom,bus-freq = <11>;
+				qcom,bus-min = <9>;
+				qcom,bus-max = <12>;
+			};
+
+			qcom,gpu-pwrlevel@3 {
+				reg = <3>;
+				qcom,gpu-freq = <510000000>;
+				qcom,bus-freq = <9>;
+				qcom,bus-min = <8>;
+				qcom,bus-max = <11>;
+			};
+
+			qcom,gpu-pwrlevel@4 {
+				reg = <4>;
+				qcom,gpu-freq = <401800000>;
+				qcom,bus-freq = <8>;
+				qcom,bus-min = <7>;
+				qcom,bus-max = <9>;
+			};
+
+			qcom,gpu-pwrlevel@5 {
+				reg = <5>;
+				qcom,gpu-freq = <315000000>;
+				qcom,bus-freq = <6>;
+				qcom,bus-min = <5>;
+				qcom,bus-max = <7>;
+			};
+
+			qcom,gpu-pwrlevel@6 {
+				reg = <6>;
+				qcom,gpu-freq = <214000000>;
+				qcom,bus-freq = <4>;
+				qcom,bus-min = <3>;
+				qcom,bus-max = <5>;
+			};
+
+			qcom,gpu-pwrlevel@7 {
+				reg = <7>;
+				qcom,gpu-freq = <133000000>;
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <2>;
+				qcom,bus-max = <4>;
+			};
+
+			qcom,gpu-pwrlevel@8 {
+				reg = <8>;
+				qcom,gpu-freq = <27000000>;
+				qcom,bus-freq = <0>;
+				qcom,bus-min = <0>;
+				qcom,bus-max = <0>;
+			};
+		};
+
+		qcom,gpu-pwrlevels-1 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,speed-bin = <1>;
+
+			qcom,initial-pwrlevel = <5>;
+
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <624000000>;
+				qcom,bus-freq = <12>;
+				qcom,bus-min = <11>;
+				qcom,bus-max = <12>;
+			};
+
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <560000000>;
+				qcom,bus-freq = <11>;
+				qcom,bus-min = <9>;
+				qcom,bus-max = <12>;
+			};
+
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <510000000>;
+				qcom,bus-freq = <9>;
+				qcom,bus-min = <8>;
+				qcom,bus-max = <11>;
+			};
+
+			qcom,gpu-pwrlevel@3 {
+				reg = <3>;
+				qcom,gpu-freq = <401800000>;
+				qcom,bus-freq = <8>;
+				qcom,bus-min = <7>;
+				qcom,bus-max = <9>;
+			};
+
+			qcom,gpu-pwrlevel@4 {
+				reg = <4>;
+				qcom,gpu-freq = <315000000>;
+				qcom,bus-freq = <6>;
+				qcom,bus-min = <5>;
+				qcom,bus-max = <7>;
+			};
+
+			qcom,gpu-pwrlevel@5 {
+				reg = <5>;
+				qcom,gpu-freq = <214000000>;
+				qcom,bus-freq = <4>;
+				qcom,bus-min = <3>;
+				qcom,bus-max = <5>;
+			};
+
+			qcom,gpu-pwrlevel@6 {
+				reg = <6>;
+				qcom,gpu-freq = <133000000>;
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <2>;
+				qcom,bus-max = <4>;
+			};
+
+			qcom,gpu-pwrlevel@7 {
+				reg = <7>;
+				qcom,gpu-freq = <27000000>;
+				qcom,bus-freq = <0>;
+				qcom,bus-min = <0>;
+				qcom,bus-max = <0>;
+			};
+		};
+
+		qcom,gpu-pwrlevels-2 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,speed-bin = <2>;
+
+			qcom,initial-pwrlevel = <3>;
+
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <510000000>;
+				qcom,bus-freq = <11>;
+				qcom,bus-min = <11>;
+				qcom,bus-max = <11>;
+			};
+
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <401800000>;
+				qcom,bus-freq = <8>;
+				qcom,bus-min = <7>;
+				qcom,bus-max = <9>;
+			};
+
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <315000000>;
+				qcom,bus-freq = <6>;
+				qcom,bus-min = <5>;
+				qcom,bus-max = <7>;
+			};
+
+			qcom,gpu-pwrlevel@3 {
+				reg = <3>;
+				qcom,gpu-freq = <214000000>;
+				qcom,bus-freq = <4>;
+				qcom,bus-min = <3>;
+				qcom,bus-max = <5>;
+			};
+
+			qcom,gpu-pwrlevel@4 {
+				reg = <4>;
+				qcom,gpu-freq = <133000000>;
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <2>;
+				qcom,bus-max = <4>;
+			};
+
+			qcom,gpu-pwrlevel@5 {
+				reg = <5>;
+				qcom,gpu-freq = <27000000>;
+				qcom,bus-freq = <0>;
+				qcom,bus-min = <0>;
+				qcom,bus-max = <0>;
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8996v3-auto.dtsi b/arch/arm64/boot/dts/qcom/msm8996v3-auto.dtsi
new file mode 100644
index 000000000000..355062adf7ef
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8996v3-auto.dtsi
@@ -0,0 +1,206 @@
+/* Copyright (c) 2016 - 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&hl7509_en_vreg {
+	status = "ok";
+};
+
+&hl7509_vreg {
+	status = "ok";
+};
+
+&gfx_cpr {
+	vdd-supply = <&hl7509_vreg>;
+	qcom,cpr-step-quot-init-min = <20>;
+	qcom,cpr-step-quot-init-max = <26>;
+	qcom,voltage-step = <10000>;
+	/delete-property/ qcom,cpr-enable;
+};
+
+&gfx_vreg {
+	qcom,cpr-voltage-ceiling =
+		<600000  670000  670000  750000  830000
+		 910000  960000 1020000>;
+	qcom,cpr-voltage-floor =
+		<600000  600000  600000  600000  600000
+		 600000  600000  600000>;
+};
+
+&pm8994_l3 {
+	regulator-min-microvolt = <875000>;
+	regulator-max-microvolt = <875000>;
+	qcom,init-voltage = <875000>;
+};
+
+&pm8994_l11 {
+	regulator-min-microvolt = <850000>;
+	regulator-max-microvolt = <850000>;
+	qcom,init-voltage = <850000>;
+};
+
+&pm8994_l17 {
+	regulator-min-microvolt = <1800000>;
+	regulator-max-microvolt = <1800000>;
+	qcom,init-voltage = <1800000>;
+};
+
+&pm8994_l23 {
+	regulator-min-microvolt = <1100000>;
+	regulator-max-microvolt = <1100000>;
+	qcom,init-voltage = <1100000>;
+};
+
+&pm8994_l27 {
+	regulator-min-microvolt = <800000>;
+	regulator-max-microvolt = <800000>;
+	qcom,init-voltage = <800000>;
+};
+
+&pm8994_l29 {
+	regulator-min-microvolt = <2500000>;
+	regulator-max-microvolt = <2500000>;
+	qcom,init-voltage = <2500000>;
+};
+
+&rpm_bus {
+	rpm-regulator-ldoa26 {
+		/delete-node/ pm8994_l26_corner;
+		/delete-node/ pm8994_l26_floor_corner;
+
+		pm8994_l26: regulator-l26 {
+			regulator-min-microvolt = <1100000>;
+			regulator-max-microvolt = <1100000>;
+			qcom,init-voltage = <1100000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa31 {
+		status = "okay";
+		pm8994_l31: regulator-l31 {
+			regulator-min-microvolt = <1100000>;
+			regulator-max-microvolt = <1100000>;
+			qcom,init-voltage = <1100000>;
+			status = "okay";
+		};
+	};
+};
+
+&clock_cpu {
+	qcom,pwrcl-speedbin0-v0 =
+		<          0  0 >,
+		<  768000000  7 >,
+		<  844800000  8 >,
+		<  902400000  9 >,
+		<  979200000 10 >,
+		< 1056000000 11 >,
+		< 1132800000 12 >,
+		< 1209600000 13 >,
+		< 1286400000 14 >,
+		< 1363200000 15 >,
+		< 1440000000 16 >,
+		< 1516800000 17 >,
+		< 1593600000 18 >;
+
+	qcom,perfcl-speedbin0-v0 =
+		<          0  0 >,
+		<  825600000  8 >,
+		<  902400000  9 >,
+		<  979200000 10 >,
+		< 1056000000 11 >,
+		< 1132800000 12 >,
+		< 1209600000 13 >,
+		< 1286400000 14 >,
+		< 1363200000 15 >,
+		< 1440000000 16 >,
+		< 1516800000 17 >,
+		< 1593600000 18 >,
+		< 1670400000 19 >,
+		< 1747200000 20 >,
+		< 1824000000 21 >,
+		< 1900800000 22 >,
+		< 1977600000 23 >,
+		< 2054400000 24 >;
+
+	qcom,cbf-speedbin0-v0 =
+		<	   0  0 >,
+		<  537600000  5 >,
+		<  614400000  6 >,
+		<  691200000  7 >,
+		<  768000000  8 >,
+		<  844800000  9 >,
+		<  902400000 10 >,
+		<  979200000 11 >,
+		< 1056000000 12 >,
+		< 1132800000 13 >,
+		< 1190400000 14 >,
+		< 1286400000 15 >,
+		< 1363200000 16 >,
+		< 1440000000 17 >,
+		< 1516800000 18 >,
+		< 1593600000 19 >;
+};
+
+&clock_gpu {
+	qcom,gfxfreq-speedbin0 =
+		<          0  0  0 >,
+		<  315000000  4  4 >,
+		<  401800000  5  5 >,
+		<  510000000  6  5 >,
+		<  560000000  7  7 >,
+		<  624000000  8  7 >;
+
+	qcom,gfxfreq-mx-speedbin0 =
+		<          0  0 >,
+		<  315000000  4 >,
+		<  401800000  5 >,
+		<  510000000  5 >,
+		<  560000000  7 >,
+		<  624000000  7 >;
+};
+
+&soc {
+	ipa_hw: qcom,ipa@680000 {
+		compatible = "qcom,ipa";
+		reg = <0x680000 0x4effc>,
+			<0x684000 0x26934>;
+		reg-names = "ipa-base", "bam-base";
+		interrupts = <0 333 0>,
+			     <0 432 0>;
+		interrupt-names = "ipa-irq", "bam-irq";
+		qcom,ipa-hw-ver = <5>; /* IPA core version = IPAv2.5 */
+		qcom,ipa-hw-mode = <0>;
+		qcom,ee = <0>;
+		qcom,use-ipa-tethering-bridge;
+		qcom,ipa-bam-remote-mode;
+		qcom,modem-cfg-emb-pipe-flt;
+		clocks = <&clock_gcc clk_ipa_clk>;
+		clock-names = "core_clk";
+		qcom,use-dma-zone;
+		qcom,msm-bus,name = "ipa";
+		qcom,msm-bus,num-cases = <3>;
+		qcom,msm-bus,num-paths = <2>;
+		qcom,msm-bus,vectors-KBps =
+		<90 512 0 0>, <90 585 0 0>,         /* No vote */
+		<90 512 80000 640000>, <90 585 80000 640000>,    /* SVS */
+		<90 512 206000 960000>, <90 585 206000 960000>;    /* PERF */
+		qcom,bus-vector-names = "MIN", "SVS", "PERF";
+	};
+
+	qcom,rmnet-ipa {
+		compatible = "qcom,rmnet-ipa";
+		qcom,rmnet-ipa-ssr;
+		qcom,ipa-loaduC;
+		qcom,ipa-advertise-sg-support;
+	};
+};
+
diff --git a/arch/arm64/boot/dts/qcom/msm8998-9x55-cdp.dts b/arch/arm64/boot/dts/qcom/msm8998-9x55-cdp.dts
new file mode 100644
index 000000000000..cf167897bb89
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-9x55-cdp.dts
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8998-9x55.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM8998-9x55 CDP";
+	compatible = "qcom,msm8998-9x55-cdp", "qcom,msm8998-9x55", "qcom,cdp";
+	qcom,board-id= <1 2>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-9x55-mtp.dts b/arch/arm64/boot/dts/qcom/msm8998-9x55-mtp.dts
new file mode 100644
index 000000000000..a95e9e4f272f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-9x55-mtp.dts
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8998-9x55.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM8998-9x55 MTP";
+	compatible = "qcom,msm8998-9x55-mtp", "qcom,msm8998-9x55", "qcom,mtp";
+	qcom,board-id= <8 6>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-9x55-rcm.dts b/arch/arm64/boot/dts/qcom/msm8998-9x55-rcm.dts
new file mode 100644
index 000000000000..094ecbc50061
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-9x55-rcm.dts
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8998-9x55.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM8998-9x55 RCM";
+	compatible = "qcom,msm8998-9x55-cdp", "qcom,msm8998-9x55", "qcom,cdp";
+	qcom,board-id= <0x21 2>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-9x55.dtsi b/arch/arm64/boot/dts/qcom/msm8998-9x55.dtsi
new file mode 100644
index 000000000000..be947507e398
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-9x55.dtsi
@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+#include "skeleton64.dtsi"
+#include "msm8998-v2.1.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM8998-9x55";
+	compatible = "qcom,msm8998-9x55";
+	qcom,msm-id = <292 0x0>;
+	interrupt-parent = <&intc>;
+
+	soc: soc { };
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-audio.dtsi b/arch/arm64/boot/dts/qcom/msm8998-audio.dtsi
new file mode 100644
index 000000000000..9a263510b27d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-audio.dtsi
@@ -0,0 +1,490 @@
+/*
+ * Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8998-wsa881x.dtsi"
+
+&msm_audio_ion {
+	qcom,smmu-version = <2>;
+	iommus = <&lpass_q6_smmu 1>;
+};
+
+&spi_10 {
+	status = "ok";
+};
+
+&soc {
+	qcom,avtimer@170f7000 {
+		compatible = "qcom,avtimer";
+		reg = <0x170f700c 0x4>,
+		      <0x170f7010 0x4>;
+		reg-names = "avtimer_lsb_addr", "avtimer_msb_addr";
+		qcom,clk-div = <27>;
+	};
+
+	snd_9335: sound-9335 {
+		compatible = "qcom,msm8998-asoc-snd-tasha";
+		qcom,model = "msm8998-tasha-snd-card";
+		qcom,ext-disp-audio-rx;
+		qcom,wcn-btfm;
+		qcom,mi2s-audio-intf;
+		qcom,auxpcm-audio-intf;
+		qcom,msm-mi2s-master = <1>, <1>, <1>, <1>;
+
+		reg = <0x1711a000 0x4>,
+		      <0x1711b000 0x4>,
+		      <0x1711c000 0x4>,
+		      <0x1711d000 0x4>;
+		reg-names = "lpaif_pri_mode_muxsel",
+			    "lpaif_sec_mode_muxsel",
+			    "lpaif_tert_mode_muxsel",
+			    "lpaif_quat_mode_muxsel";
+
+		qcom,audio-routing =
+			"AIF4 VI", "MCLK",
+			"RX_BIAS", "MCLK",
+			"MADINPUT", "MCLK",
+			"hifi amp", "LINEOUT1",
+			"hifi amp", "LINEOUT2",
+			"AMIC2", "MIC BIAS2",
+			"MIC BIAS2", "Headset Mic",
+			"AMIC3", "MIC BIAS2",
+			"MIC BIAS2", "ANCRight Headset Mic",
+			"AMIC4", "MIC BIAS2",
+			"MIC BIAS2", "ANCLeft Headset Mic",
+			"AMIC5", "MIC BIAS3",
+			"MIC BIAS3", "Handset Mic",
+			"AMIC6", "MIC BIAS4",
+			"MIC BIAS4", "Analog Mic6",
+			"DMIC0", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic0",
+			"DMIC1", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic1",
+			"DMIC2", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic2",
+			"DMIC3", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic3",
+			"DMIC4", "MIC BIAS4",
+			"MIC BIAS4", "Digital Mic4",
+			"DMIC5", "MIC BIAS4",
+			"MIC BIAS4", "Digital Mic5",
+			"SpkrLeft IN", "SPK1 OUT",
+			"SpkrRight IN", "SPK2 OUT";
+
+		qcom,msm-mbhc-hphl-swh = <0>;
+		qcom,msm-mbhc-gnd-swh = <0>;
+		qcom,us-euro-gpios = <&wcd_us_euro_gpio>;
+		qcom,hph-en0-gpio = <&hph_en0_gpio>;
+		qcom,hph-en1-gpio = <&hph_en1_gpio>;
+		qcom,tasha-mclk-clk-freq = <9600000>;
+		asoc-platform = <&pcm0>, <&pcm1>, <&pcm2>, <&voip>, <&voice>,
+				<&loopback>, <&compress>, <&hostless>,
+				<&afe>, <&lsm>, <&routing>, <&cpe>, <&compr>,
+				<&pcm_noirq>, <&cpe3>, <&trans_loopback>;
+		asoc-platform-names = "msm-pcm-dsp.0", "msm-pcm-dsp.1",
+				"msm-pcm-dsp.2", "msm-voip-dsp",
+				"msm-pcm-voice", "msm-pcm-loopback",
+				"msm-compress-dsp", "msm-pcm-hostless",
+				"msm-pcm-afe", "msm-lsm-client",
+				"msm-pcm-routing", "msm-cpe-lsm",
+				"msm-compr-dsp", "msm-pcm-dsp-noirq",
+				"msm-cpe-lsm.3", "msm-transcode-loopback";
+		asoc-cpu = <&dai_hdmi>, <&dai_dp>,
+				<&dai_mi2s0>, <&dai_mi2s1>,
+				<&dai_mi2s2>, <&dai_mi2s3>,
+				<&dai_pri_auxpcm>, <&dai_sec_auxpcm>,
+				<&dai_tert_auxpcm>, <&dai_quat_auxpcm>,
+				<&sb_0_rx>, <&sb_0_tx>, <&sb_1_rx>, <&sb_1_tx>,
+				<&sb_2_rx>, <&sb_2_tx>, <&sb_3_rx>, <&sb_3_tx>,
+				<&sb_4_rx>, <&sb_4_tx>, <&sb_5_tx>,
+				<&afe_pcm_rx>, <&afe_pcm_tx>, <&afe_proxy_rx>,
+				<&afe_proxy_tx>, <&incall_record_rx>,
+				<&incall_record_tx>, <&incall_music_rx>,
+				<&incall_music_2_rx>, <&sb_5_rx>, <&sb_6_rx>,
+				<&sb_7_rx>, <&sb_7_tx>, <&sb_8_tx>,
+				<&usb_audio_rx>, <&usb_audio_tx>,
+				<&dai_pri_tdm_rx_0>, <&dai_pri_tdm_tx_0>,
+				<&dai_sec_tdm_rx_0>, <&dai_sec_tdm_tx_0>,
+				<&dai_tert_tdm_rx_0>, <&dai_tert_tdm_tx_0>,
+				<&dai_quat_tdm_rx_0>, <&dai_quat_tdm_tx_0>;
+		asoc-cpu-names = "msm-dai-q6-hdmi.8", "msm-dai-q6-dp.24608",
+				"msm-dai-q6-mi2s.0", "msm-dai-q6-mi2s.1",
+				"msm-dai-q6-mi2s.2", "msm-dai-q6-mi2s.3",
+				"msm-dai-q6-auxpcm.1", "msm-dai-q6-auxpcm.2",
+				"msm-dai-q6-auxpcm.3", "msm-dai-q6-auxpcm.4",
+				"msm-dai-q6-dev.16384", "msm-dai-q6-dev.16385",
+				"msm-dai-q6-dev.16386", "msm-dai-q6-dev.16387",
+				"msm-dai-q6-dev.16388", "msm-dai-q6-dev.16389",
+				"msm-dai-q6-dev.16390", "msm-dai-q6-dev.16391",
+				"msm-dai-q6-dev.16392", "msm-dai-q6-dev.16393",
+				"msm-dai-q6-dev.16395", "msm-dai-q6-dev.224",
+				"msm-dai-q6-dev.225", "msm-dai-q6-dev.241",
+				"msm-dai-q6-dev.240", "msm-dai-q6-dev.32771",
+				"msm-dai-q6-dev.32772", "msm-dai-q6-dev.32773",
+				"msm-dai-q6-dev.32770", "msm-dai-q6-dev.16394",
+				"msm-dai-q6-dev.16396", "msm-dai-q6-dev.16398",
+				"msm-dai-q6-dev.16399", "msm-dai-q6-dev.16401",
+				"msm-dai-q6-dev.28672", "msm-dai-q6-dev.28673",
+				"msm-dai-q6-tdm.36864", "msm-dai-q6-tdm.36865",
+				"msm-dai-q6-tdm.36880", "msm-dai-q6-tdm.36881",
+				"msm-dai-q6-tdm.36896", "msm-dai-q6-tdm.36897",
+				"msm-dai-q6-tdm.36912", "msm-dai-q6-tdm.36913";
+		asoc-codec = <&stub_codec>, <&ext_disp_audio_codec>;
+		asoc-codec-names = "msm-stub-codec.1",
+				   "msm-ext-disp-audio-codec-rx";
+		qcom,wsa-max-devs = <2>;
+		qcom,wsa-devs = <&wsa881x_211>, <&wsa881x_212>,
+				<&wsa881x_213>, <&wsa881x_214>;
+		qcom,wsa-aux-dev-prefix = "SpkrLeft", "SpkrRight",
+					  "SpkrLeft", "SpkrRight";
+
+		hph_en0_gpio: msm_cdc_pinctrl@67 {
+			compatible = "qcom,msm-cdc-pinctrl";
+			pinctrl-names = "aud_active", "aud_sleep";
+			pinctrl-0 = <&hph_en0_active>;
+			pinctrl-1 = <&hph_en0_idle>;
+		};
+
+		hph_en1_gpio: msm_cdc_pinctrl@68 {
+			compatible = "qcom,msm-cdc-pinctrl";
+			pinctrl-names = "aud_active", "aud_sleep";
+			pinctrl-0 = <&hph_en1_active>;
+			pinctrl-1 = <&hph_en1_idle>;
+		};
+	};
+
+	snd_934x: sound-tavil {
+		compatible = "qcom,msm8998-asoc-snd-tavil";
+		qcom,model = "msm8998-tavil-snd-card";
+		qcom,ext-disp-audio-rx;
+		qcom,wcn-btfm;
+		qcom,mi2s-audio-intf;
+		qcom,auxpcm-audio-intf;
+		qcom,msm-mi2s-master = <1>, <1>, <1>, <1>;
+
+		reg = <0x1711a000 0x4>,
+		      <0x1711b000 0x4>,
+		      <0x1711c000 0x4>,
+		      <0x1711d000 0x4>;
+		reg-names = "lpaif_pri_mode_muxsel",
+			    "lpaif_sec_mode_muxsel",
+			    "lpaif_tert_mode_muxsel",
+			    "lpaif_quat_mode_muxsel";
+
+		qcom,audio-routing =
+			"AIF4 VI", "MCLK",
+			"RX_BIAS", "MCLK",
+			"MADINPUT", "MCLK",
+			"hifi amp", "LINEOUT1",
+			"hifi amp", "LINEOUT2",
+			"AMIC2", "MIC BIAS2",
+			"MIC BIAS2", "Headset Mic",
+			"AMIC3", "MIC BIAS2",
+			"MIC BIAS2", "ANCRight Headset Mic",
+			"AMIC4", "MIC BIAS2",
+			"MIC BIAS2", "ANCLeft Headset Mic",
+			"AMIC5", "MIC BIAS3",
+			"MIC BIAS3", "Handset Mic",
+			"DMIC0", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic0",
+			"DMIC1", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic1",
+			"DMIC2", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic2",
+			"DMIC3", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic3",
+			"DMIC4", "MIC BIAS4",
+			"MIC BIAS4", "Digital Mic4",
+			"DMIC5", "MIC BIAS4",
+			"MIC BIAS4", "Digital Mic5",
+			"SpkrLeft IN", "SPK1 OUT",
+			"SpkrRight IN", "SPK2 OUT";
+
+		qcom,msm-mbhc-hphl-swh = <0>;
+		qcom,msm-mbhc-gnd-swh = <0>;
+		qcom,us-euro-gpios = <&tavil_us_euro_sw>;
+		qcom,hph-en0-gpio = <&tavil_hph_en0>;
+		qcom,hph-en1-gpio = <&tavil_hph_en1>;
+		qcom,tavil-mclk-clk-freq = <9600000>;
+
+		qcom,usbc-analog-en1_gpio = <&wcd_usbc_analog_en1_gpio>;
+		qcom,usbc-analog-en2_n_gpio = <&wcd_usbc_analog_en2n_gpio>;
+
+		asoc-platform = <&pcm0>, <&pcm1>, <&pcm2>, <&voip>, <&voice>,
+				<&loopback>, <&compress>, <&hostless>,
+				<&afe>, <&lsm>, <&routing>, <&cpe>, <&compr>,
+				<&pcm_noirq>, <&trans_loopback>;
+		asoc-platform-names = "msm-pcm-dsp.0", "msm-pcm-dsp.1",
+				"msm-pcm-dsp.2", "msm-voip-dsp",
+				"msm-pcm-voice", "msm-pcm-loopback",
+				"msm-compress-dsp", "msm-pcm-hostless",
+				"msm-pcm-afe", "msm-lsm-client",
+				"msm-pcm-routing", "msm-cpe-lsm",
+				"msm-compr-dsp", "msm-pcm-dsp-noirq",
+				"msm-transcode-loopback";
+		asoc-cpu = <&dai_hdmi>, <&dai_dp>,
+				<&dai_mi2s0>, <&dai_mi2s1>,
+				<&dai_mi2s2>, <&dai_mi2s3>,
+				<&dai_pri_auxpcm>, <&dai_sec_auxpcm>,
+				<&dai_tert_auxpcm>, <&dai_quat_auxpcm>,
+				<&sb_0_rx>, <&sb_0_tx>, <&sb_1_rx>, <&sb_1_tx>,
+				<&sb_2_rx>, <&sb_2_tx>, <&sb_3_rx>, <&sb_3_tx>,
+				<&sb_4_rx>, <&sb_4_tx>, <&sb_5_tx>,
+				<&afe_pcm_rx>, <&afe_pcm_tx>, <&afe_proxy_rx>,
+				<&afe_proxy_tx>, <&incall_record_rx>,
+				<&incall_record_tx>, <&incall_music_rx>,
+				<&incall_music_2_rx>, <&sb_5_rx>, <&sb_6_rx>,
+				<&sb_7_rx>, <&sb_7_tx>, <&sb_8_tx>,
+				<&usb_audio_rx>, <&usb_audio_tx>,
+				<&dai_pri_tdm_rx_0>, <&dai_pri_tdm_tx_0>,
+				<&dai_sec_tdm_rx_0>, <&dai_sec_tdm_tx_0>,
+				<&dai_tert_tdm_rx_0>, <&dai_tert_tdm_tx_0>,
+				<&dai_quat_tdm_rx_0>, <&dai_quat_tdm_tx_0>;
+		asoc-cpu-names = "msm-dai-q6-hdmi.8",  "msm-dai-q6-dp.24608",
+				"msm-dai-q6-mi2s.0", "msm-dai-q6-mi2s.1",
+				"msm-dai-q6-mi2s.2", "msm-dai-q6-mi2s.3",
+				"msm-dai-q6-auxpcm.1", "msm-dai-q6-auxpcm.2",
+				"msm-dai-q6-auxpcm.3", "msm-dai-q6-auxpcm.4",
+				"msm-dai-q6-dev.16384", "msm-dai-q6-dev.16385",
+				"msm-dai-q6-dev.16386", "msm-dai-q6-dev.16387",
+				"msm-dai-q6-dev.16388", "msm-dai-q6-dev.16389",
+				"msm-dai-q6-dev.16390", "msm-dai-q6-dev.16391",
+				"msm-dai-q6-dev.16392", "msm-dai-q6-dev.16393",
+				"msm-dai-q6-dev.16395", "msm-dai-q6-dev.224",
+				"msm-dai-q6-dev.225", "msm-dai-q6-dev.241",
+				"msm-dai-q6-dev.240", "msm-dai-q6-dev.32771",
+				"msm-dai-q6-dev.32772", "msm-dai-q6-dev.32773",
+				"msm-dai-q6-dev.32770", "msm-dai-q6-dev.16394",
+				"msm-dai-q6-dev.16396", "msm-dai-q6-dev.16398",
+				"msm-dai-q6-dev.16399", "msm-dai-q6-dev.16401",
+				"msm-dai-q6-dev.28672", "msm-dai-q6-dev.28673",
+				"msm-dai-q6-tdm.36864", "msm-dai-q6-tdm.36865",
+				"msm-dai-q6-tdm.36880", "msm-dai-q6-tdm.36881",
+				"msm-dai-q6-tdm.36896", "msm-dai-q6-tdm.36897",
+				"msm-dai-q6-tdm.36912", "msm-dai-q6-tdm.36913";
+		asoc-codec = <&stub_codec>, <&ext_disp_audio_codec>;
+		asoc-codec-names = "msm-stub-codec.1",
+				   "msm-ext-disp-audio-codec-rx";
+		qcom,wsa-max-devs = <2>;
+		qcom,wsa-devs = <&wsa881x_0211>, <&wsa881x_0212>,
+				<&wsa881x_0213>, <&wsa881x_0214>;
+		qcom,wsa-aux-dev-prefix = "SpkrLeft", "SpkrRight",
+					  "SpkrLeft", "SpkrRight";
+	};
+
+	cpe: qcom,msm-cpe-lsm {
+		compatible = "qcom,msm-cpe-lsm";
+		qcom,msm-cpe-lsm-id = <1>;
+	};
+
+	cpe3: qcom,msm-cpe-lsm@3 {
+		compatible = "qcom,msm-cpe-lsm";
+		qcom,msm-cpe-lsm-id = <3>;
+	};
+
+	qcom,wcd-dsp-mgr {
+		compatible = "qcom,wcd-dsp-mgr";
+		qcom,wdsp-components = <&wcd934x_cdc 0>,
+				       <&wcd_spi_0 1>,
+				       <&glink_spi_xprt_wdsp 2>;
+		qcom,img-filename = "cpe_9340";
+	};
+
+	wcd_us_euro_gpio: msm_cdc_pinctrl@75 {
+		compatible = "qcom,msm-cdc-pinctrl";
+		pinctrl-names = "aud_active", "aud_sleep";
+		pinctrl-0 = <&wcd_gnd_mic_swap_active>;
+		pinctrl-1 = <&wcd_gnd_mic_swap_idle>;
+	};
+
+	wcd_usbc_analog_en1_gpio: msm_cdc_pinctrl@59 {
+		compatible = "qcom,msm-cdc-pinctrl";
+		pinctrl-names = "aud_active", "aud_sleep";
+		pinctrl-0 = <&wcd_usbc_analog_en1_active>;
+		pinctrl-1 = <&wcd_usbc_analog_en1_idle>;
+	};
+
+	wcd_usbc_analog_en2n_gpio: msm_cdc_pinctrl@60 {
+		compatible = "qcom,msm-cdc-pinctrl";
+		pinctrl-names = "aud_active", "aud_sleep";
+		pinctrl-0 = <&wcd_usbc_analog_en2n_active>;
+		pinctrl-1 = <&wcd_usbc_analog_en2n_idle>;
+	};
+
+	wcd9xxx_intc: wcd9xxx-irq {
+		status = "ok";
+		compatible = "qcom,wcd9xxx-irq";
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&tlmm>;
+		qcom,gpio-connect = <&tlmm 54 0>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&wcd_intr_default>;
+	};
+
+	clock_audio: audio_ext_clk {
+		status = "ok";
+		compatible = "qcom,audio-ref-clk";
+		qcom,audio-ref-clk-gpio = <&pm8998_gpios 13 0>;
+		clock-names = "osr_clk";
+		clocks = <&clock_gcc clk_div_clk1>;
+		qcom,node_has_rpm_clock;
+		#clock-cells = <1>;
+		pinctrl-names = "sleep", "active";
+		pinctrl-0 = <&spkr_i2s_clk_sleep>;
+		pinctrl-1 = <&spkr_i2s_clk_active>;
+	};
+
+	clock_audio_lnbb: audio_ext_clk_lnbb {
+		status = "ok";
+		compatible = "qcom,audio-ref-clk";
+		clock-names = "osr_clk";
+		clocks = <&clock_gcc clk_ln_bb_clk2>;
+		qcom,node_has_rpm_clock;
+		#clock-cells = <1>;
+	};
+
+	wcd_rst_gpio: msm_cdc_pinctrl@64 {
+		compatible = "qcom,msm-cdc-pinctrl";
+		qcom,cdc-rst-n-gpio = <&tlmm 64 0>;
+		pinctrl-names = "aud_active", "aud_sleep";
+		pinctrl-0 = <&cdc_reset_active>;
+		pinctrl-1 = <&cdc_reset_sleep>;
+	};
+
+	qocm,wcd-dsp-glink {
+		compatible = "qcom,wcd-dsp-glink";
+	};
+};
+
+&slim_aud {
+	msm_dai_slim {
+		compatible = "qcom,msm-dai-slim";
+		elemental-addr = [ff ff ff fe 17 02];
+	};
+
+	tasha_codec {
+		compatible = "qcom,tasha-slim-pgd";
+		elemental-addr = [00 01 A0 01 17 02];
+
+		interrupt-parent = <&wcd9xxx_intc>;
+		interrupts = <0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
+			      17 18 19 20 21 22 23 24 25 26 27 28 29
+			      30>;
+
+		qcom,wcd-rst-gpio-node = <&wcd_rst_gpio>;
+
+		clock-names = "wcd_clk", "wcd_native_clk";
+		clocks = <&clock_audio clk_audio_pmi_clk>,
+			 <&clock_audio clk_audio_ap_clk2>;
+
+		cdc-vdd-buck-supply = <&pm8998_s4>;
+		qcom,cdc-vdd-buck-voltage = <1800000 1800000>;
+		qcom,cdc-vdd-buck-current = <650000>;
+
+		cdc-buck-sido-supply = <&pm8998_s4>;
+		qcom,cdc-buck-sido-voltage = <1800000 1800000>;
+		qcom,cdc-buck-sido-current = <250000>;
+
+		cdc-vdd-tx-h-supply = <&pm8998_s4>;
+		qcom,cdc-vdd-tx-h-voltage = <1800000 1800000>;
+		qcom,cdc-vdd-tx-h-current = <25000>;
+
+		cdc-vdd-rx-h-supply = <&pm8998_s4>;
+		qcom,cdc-vdd-rx-h-voltage = <1800000 1800000>;
+		qcom,cdc-vdd-rx-h-current = <25000>;
+
+		cdc-vddpx-1-supply = <&pm8998_s4>;
+		qcom,cdc-vddpx-1-voltage = <1800000 1800000>;
+		qcom,cdc-vddpx-1-current = <10000>;
+
+		qcom,cdc-static-supplies = "cdc-vdd-buck",
+					   "cdc-buck-sido",
+					   "cdc-vdd-tx-h",
+					   "cdc-vdd-rx-h",
+					   "cdc-vddpx-1";
+
+		qcom,cdc-micbias1-mv = <1800>;
+		qcom,cdc-micbias2-mv = <1800>;
+		qcom,cdc-micbias3-mv = <1800>;
+		qcom,cdc-micbias4-mv = <1800>;
+
+		qcom,cdc-mclk-clk-rate = <9600000>;
+		qcom,cdc-slim-ifd = "tasha-slim-ifd";
+		qcom,cdc-slim-ifd-elemental-addr = [00 00 A0 01 17 02];
+		qcom,cdc-dmic-sample-rate = <4800000>;
+		qcom,cdc-mad-dmic-rate = <600000>;
+		qcom,cdc-ecpp-dmic-rate = <1200000>;
+	};
+
+	wcd934x_cdc: tavil_codec {
+		compatible = "qcom,tavil-slim-pgd";
+		elemental-addr = [00 01 50 02 17 02];
+
+		interrupt-parent = <&wcd9xxx_intc>;
+		interrupts = <0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
+			      17 18 19 20 21 22 23 24 25 26 27 28 29
+			      30 31>;
+
+		qcom,wcd-rst-gpio-node = <&wcd_rst_gpio>;
+
+		clock-names = "wcd_clk";
+		clocks = <&clock_audio_lnbb clk_audio_pmi_lnbb_clk>;
+
+		cdc-vdd-buck-supply = <&pm8998_s4>;
+		qcom,cdc-vdd-buck-voltage = <1800000 1800000>;
+		qcom,cdc-vdd-buck-current = <650000>;
+
+		cdc-buck-sido-supply = <&pm8998_s4>;
+		qcom,cdc-buck-sido-voltage = <1800000 1800000>;
+		qcom,cdc-buck-sido-current = <250000>;
+
+		cdc-vdd-tx-h-supply = <&pm8998_s4>;
+		qcom,cdc-vdd-tx-h-voltage = <1800000 1800000>;
+		qcom,cdc-vdd-tx-h-current = <25000>;
+
+		cdc-vdd-rx-h-supply = <&pm8998_s4>;
+		qcom,cdc-vdd-rx-h-voltage = <1800000 1800000>;
+		qcom,cdc-vdd-rx-h-current = <25000>;
+
+		cdc-vddpx-1-supply = <&pm8998_s4>;
+		qcom,cdc-vddpx-1-voltage = <1800000 1800000>;
+		qcom,cdc-vddpx-1-current = <10000>;
+
+		qcom,cdc-static-supplies = "cdc-vdd-buck",
+					   "cdc-buck-sido",
+					   "cdc-vdd-tx-h",
+					   "cdc-vdd-rx-h",
+					   "cdc-vddpx-1";
+
+		qcom,cdc-micbias1-mv = <1800>;
+		qcom,cdc-micbias2-mv = <1800>;
+		qcom,cdc-micbias3-mv = <1800>;
+		qcom,cdc-micbias4-mv = <1800>;
+
+		qcom,cdc-mclk-clk-rate = <9600000>;
+		qcom,cdc-slim-ifd = "tavil-slim-ifd";
+		qcom,cdc-slim-ifd-elemental-addr = [00 00 50 02 17 02];
+		qcom,cdc-dmic-sample-rate = <4800000>;
+		qcom,cdc-mad-dmic-rate = <600000>;
+
+		qcom,wdsp-cmpnt-dev-name = "tavil_codec";
+
+		wcd_spi_0: wcd_spi {
+			compatible = "qcom,wcd-spi-v2";
+			qcom,master-bus-num = <10>;
+			qcom,chip-select = <0>;
+			qcom,max-frequency = <24000000>;
+			qcom,mem-base-addr = <0x100000>;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-blsp.dtsi b/arch/arm64/boot/dts/qcom/msm8998-blsp.dtsi
new file mode 100644
index 000000000000..b9e323d894c3
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-blsp.dtsi
@@ -0,0 +1,863 @@
+/*
+ * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+/ {
+	aliases {
+		i2c1 = &i2c_1;
+		i2c2 = &i2c_2;
+		i2c3 = &i2c_3;
+		i2c4 = &i2c_4;
+		i2c5 = &i2c_5;
+		i2c6 = &i2c_6;
+		i2c7 = &i2c_7;
+		i2c8 = &i2c_8;
+		i2c9 = &i2c_9;
+		i2c10 = &i2c_10;
+		i2c11 = &i2c_11;
+		i2c12 = &i2c_12;
+		spi1 = &spi_1;
+		spi2 = &spi_2;
+		spi3 = &spi_3;
+		spi4 = &spi_4;
+		spi5 = &spi_5;
+		spi6 = &spi_6;
+		spi7 = &spi_7;
+		spi8 = &spi_8;
+		spi9 = &spi_9;
+		spi10 = &spi_10;
+		spi11 = &spi_11;
+		spi12 = &spi_12;
+	};
+};
+
+#include "msm8998-pinctrl.dtsi"
+
+&soc {
+	dma_blsp1: qcom,sps-dma@0xc144000 { /* BLSP1 */
+		#dma-cells = <4>;
+		compatible = "qcom,sps-dma";
+		reg = <0xc144000 0x25000>;
+		interrupts = <0 238 0>;
+		qcom,summing-threshold = <0x10>;
+	};
+
+	dma_blsp2: qcom,sps-dma@0xc184000 { /* BLSP2 */
+		#dma-cells = <4>;
+		compatible = "qcom,sps-dma";
+		reg = <0xc184000 0x25000>;
+		interrupts = <0 239 0>;
+		qcom,summing-threshold = <0x10>;
+	};
+
+	i2c_1: i2c@c175000 { /* BLSP1 QUP1 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "qup_phys_addr";
+		reg = <0xC175000 0x600>;
+		interrupt-names = "qup_irq";
+		interrupts = <0 95 0>;
+		dmas = <&dma_blsp1 6 64 0x20000020 0x20>,
+			<&dma_blsp1 7 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <86>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp1_qup1_i2c_apps_clk>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_1_active>;
+		pinctrl-1 = <&i2c_1_sleep>;
+		status = "disabled";
+	};
+
+	i2c_2: i2c@c176000 { /* BLSP1 QUP2 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "qup_phys_addr";
+		reg = <0xC176000 0x600>;
+		interrupt-names = "qup_irq";
+		interrupts = <0 96 0>;
+		dmas = <&dma_blsp1 8 64 0x20000020 0x20>,
+			<&dma_blsp1 9 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <86>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp1_qup2_i2c_apps_clk>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_2_active>;
+		pinctrl-1 = <&i2c_2_sleep>;
+		status = "disabled";
+	};
+
+	i2c_3: i2c@c177000 { /* BLSP1 QUP3 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "qup_phys_addr";
+		reg = <0xC177000 0x600>;
+		interrupt-names = "qup_irq";
+		interrupts = <0 97 0>;
+		dmas = <&dma_blsp1 10 64 0x20000020 0x20>,
+			<&dma_blsp1 11 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <86>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp1_qup3_i2c_apps_clk>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_3_active>;
+		pinctrl-1 = <&i2c_3_sleep>;
+		status = "disabled";
+	};
+
+	i2c_4: i2c@c178000 { /* BLSP1 QUP4 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "qup_phys_addr";
+		reg = <0xC178000 0x600>;
+		interrupt-names = "qup_irq";
+		interrupts = <0 98 0>;
+		dmas = <&dma_blsp1 12 64 0x20000020 0x20>,
+			<&dma_blsp1 13 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <86>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp1_qup4_i2c_apps_clk>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_4_active>;
+		pinctrl-1 = <&i2c_4_sleep>;
+		status = "disabled";
+	};
+
+	i2c_5: i2c@c179000 { /* BLSP1 QUP5 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "qup_phys_addr";
+		reg = <0xC179000 0x600>;
+		interrupt-names = "qup_irq";
+		interrupts = <0 99 0>;
+		dmas = <&dma_blsp1 14 64 0x20000020 0x20>,
+			<&dma_blsp1 15 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <86>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp1_qup5_i2c_apps_clk>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_5_active>;
+		pinctrl-1 = <&i2c_5_sleep>;
+		status = "disabled";
+	};
+
+	i2c_6: i2c@c17a000 { /* BLSP1 QUP6 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "qup_phys_addr";
+		reg = <0xC17A000 0x600>;
+		interrupt-names = "qup_irq";
+		interrupts = <0 100 0>;
+		dmas = <&dma_blsp1 16 64 0x20000020 0x20>,
+			<&dma_blsp1 17 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <86>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp1_qup6_i2c_apps_clk>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_6_active>;
+		pinctrl-1 = <&i2c_6_sleep>;
+		status = "disabled";
+	};
+
+	i2c_7: i2c@c1b5000 { /* BLSP2 QUP1 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "qup_phys_addr";
+		reg = <0xC1B5000 0x600>;
+		interrupt-names = "qup_irq";
+		interrupts = <0 101 0>;
+		dmas = <&dma_blsp2 6 64 0x20000020 0x20>,
+			<&dma_blsp2 7 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <84>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp2_qup1_i2c_apps_clk>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_7_active>;
+		pinctrl-1 = <&i2c_7_sleep>;
+		status = "disabled";
+	};
+
+	i2c_8: i2c@c1b6000 { /* BLSP2 QUP2 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "qup_phys_addr";
+		reg = <0xC1B6000 0x600>;
+		interrupt-names = "qup_irq";
+		interrupts = <0 102 0>;
+		dmas = <&dma_blsp2 8 64 0x20000020 0x20>,
+			<&dma_blsp2 9 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <84>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp2_qup2_i2c_apps_clk>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_8_active>;
+		pinctrl-1 = <&i2c_8_sleep>;
+		status = "disabled";
+	};
+
+	i2c_9: i2c@c1b7000 { /* BLSP2 QUP3 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "qup_phys_addr";
+		reg = <0xC1B7000 0x600>;
+		interrupt-names = "qup_irq";
+		interrupts = <0 103 0>;
+		dmas = <&dma_blsp2 10 64 0x20000020 0x20>,
+			<&dma_blsp2 11 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <84>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp2_qup3_i2c_apps_clk>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_9_active>;
+		pinctrl-1 = <&i2c_9_sleep>;
+		status = "disabled";
+	};
+
+	i2c_10: i2c@c1b8000 { /* BLSP2 QUP4 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "qup_phys_addr";
+		reg = <0xC1B8000 0x600>;
+		interrupt-names = "qup_irq";
+		interrupts = <0 104 0>;
+		dmas = <&dma_blsp2 12 64 0x20000020 0x20>,
+			<&dma_blsp2 13 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <84>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp2_qup4_i2c_apps_clk>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_10_active>;
+		pinctrl-1 = <&i2c_10_sleep>;
+		status = "disabled";
+	};
+
+	i2c_11: i2c@c1b9000 { /* BLSP2 QUP5 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "qup_phys_addr";
+		reg = <0xC1B9000 0x600>;
+		interrupt-names = "qup_irq";
+		interrupts = <0 105 0>;
+		dmas = <&dma_blsp2 14 64 0x20000020 0x20>,
+			<&dma_blsp2 15 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <84>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp2_qup5_i2c_apps_clk>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_11_active>;
+		pinctrl-1 = <&i2c_11_sleep>;
+		status = "disabled";
+	};
+
+	i2c_12: i2c@c1ba000 { /* BLSP2 QUP6 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "qup_phys_addr";
+		reg = <0xC1BA000 0x600>;
+		interrupt-names = "qup_irq";
+		interrupts = <0 106 0>;
+		dmas = <&dma_blsp2 16 64 0x20000020 0x20>,
+			<&dma_blsp2 17 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <84>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp2_qup6_i2c_apps_clk>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_12_active>;
+		pinctrl-1 = <&i2c_12_sleep>;
+		status = "disabled";
+	};
+
+	spi_1: spi@c175000 { /* BLSP1 QUP1 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xC175000 0x600>,
+		      <0xC144000 0x25000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 95 0>, <0 238 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <6>;
+		qcom,bam-producer-pipe-index = <7>;
+		qcom,master-id = <86>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_1_active>;
+		pinctrl-1 = <&spi_1_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp1_qup1_spi_apps_clk>;
+		status = "disabled";
+	};
+
+	spi_2: spi@c176000 { /* BLSP1 QUP2 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xC176000 0x600>,
+		      <0xC144000 0x25000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 96 0>, <0 238 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <8>;
+		qcom,bam-producer-pipe-index = <9>;
+		qcom,master-id = <86>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_2_active>;
+		pinctrl-1 = <&spi_2_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp1_qup2_spi_apps_clk>;
+		status = "disabled";
+	};
+
+	spi_3: spi@c177000 { /* BLSP1 QUP3 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xC177000 0x600>,
+		      <0xC144000 0x25000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 97 0>, <0 238 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <10>;
+		qcom,bam-producer-pipe-index = <11>;
+		qcom,master-id = <86>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_3_active>;
+		pinctrl-1 = <&spi_3_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp1_qup3_spi_apps_clk>;
+		status = "disabled";
+	};
+
+	spi_4: spi@c178000 { /* BLSP1 QUP4 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xC178000 0x600>,
+		      <0xC144000 0x25000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 98 0>, <0 238 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <12>;
+		qcom,bam-producer-pipe-index = <13>;
+		qcom,master-id = <86>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_4_active>;
+		pinctrl-1 = <&spi_4_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp1_qup4_spi_apps_clk>;
+		status = "disabled";
+	};
+
+	spi_5: spi@c179000 { /* BLSP1 QUP5 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xC179000 0x600>,
+		      <0xC144000 0x25000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 99 0>, <0 238 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <14>;
+		qcom,bam-producer-pipe-index = <15>;
+		qcom,master-id = <86>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_5_active>;
+		pinctrl-1 = <&spi_5_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp1_qup5_spi_apps_clk>;
+		status = "disabled";
+	};
+
+	spi_6: spi@c17a000 { /* BLSP1 QUP6 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xC17A000 0x600>,
+		      <0xC144000 0x25000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 100 0>, <0 238 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <16>;
+		qcom,bam-producer-pipe-index = <17>;
+		qcom,master-id = <86>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_6_active>;
+		pinctrl-1 = <&spi_6_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp1_qup6_spi_apps_clk>;
+		status = "disabled";
+	};
+
+
+	spi_7: spi@c1b5000 { /* BLSP2 QUP1 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xC1B5000 0x600>,
+		      <0xC184000 0x25000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 101 0>, <0 239 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <6>;
+		qcom,bam-producer-pipe-index = <7>;
+		qcom,master-id = <84>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_7_active>;
+		pinctrl-1 = <&spi_7_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp2_qup1_spi_apps_clk>;
+		status = "disabled";
+	};
+
+	spi_8: spi@c1b6000 { /* BLSP2 QUP2 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xC1B6000 0x600>,
+		      <0xC184000 0x25000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 102 0>, <0 239 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <8>;
+		qcom,bam-producer-pipe-index = <9>;
+		qcom,master-id = <84>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_8_active>;
+		pinctrl-1 = <&spi_8_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp2_qup2_spi_apps_clk>;
+		status = "disabled";
+	};
+
+	spi_9: spi@c1b7000 { /* BLSP2 QUP3 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xC1B7000 0x600>,
+		      <0xC184000 0x25000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 103 0>, <0 239 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <10>;
+		qcom,bam-producer-pipe-index = <11>;
+		qcom,master-id = <84>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_9_active>;
+		pinctrl-1 = <&spi_9_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp2_qup3_spi_apps_clk>;
+		status = "disabled";
+	};
+
+	spi_10: spi@c1b8000 { /* BLSP2 QUP4 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xC1B8000 0x600>,
+		      <0xC184000 0x25000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 104 0>, <0 239 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <12>;
+		qcom,bam-producer-pipe-index = <13>;
+		qcom,master-id = <84>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_10_active>;
+		pinctrl-1 = <&spi_10_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp2_qup4_spi_apps_clk>;
+		status = "disabled";
+	};
+
+	spi_11: spi@c1b9000 { /* BLSP2 QUP5 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xC1B9000 0x600>,
+		      <0xC184000 0x25000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 105 0>, <0 239 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+
+		qcom,bam-consumer-pipe-index = <14>;
+		qcom,bam-producer-pipe-index = <15>;
+		qcom,master-id = <84>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_11_active>;
+		pinctrl-1 = <&spi_11_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp2_qup5_spi_apps_clk>;
+		status = "disabled";
+	};
+
+	spi_12: spi@c1ba000 { /* BLSP2 QUP6 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xC1BA000 0x600>,
+		      <0xC184000 0x25000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 106 0>, <0 239 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <16>;
+		qcom,bam-producer-pipe-index = <17>;
+		qcom,master-id = <84>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_12_active>;
+		pinctrl-1 = <&spi_12_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_ahb_clk>,
+			 <&clock_gcc clk_gcc_blsp2_qup6_spi_apps_clk>;
+		status = "disabled";
+	};
+
+
+	blsp1_uart1_hs: uart@c16f000 { /* BLSP1 UART1 */
+		compatible = "qcom,msm-hsuart-v14";
+		reg = <0xC16F000 0x200>,
+		    <0xC144000 0x25000>;
+		reg-names = "core_mem", "bam_mem";
+		interrupt-names = "core_irq", "bam_irq", "wakeup_irq";
+		#address-cells = <0>;
+		interrupt-parent = <&blsp1_uart1_hs>;
+		interrupts = <0 1 2>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-map = <0 &intc 0 0 107 0
+			    1 &intc 0 0 238 0
+			    2 &tlmm 1 0>;
+
+		qcom,inject-rx-on-wakeup;
+		qcom,rx-char-to-inject = <0xFD>;
+
+		qcom,bam-tx-ep-pipe-index = <0>;
+		qcom,bam-rx-ep-pipe-index = <1>;
+		qcom,master-id = <86>;
+		clock-names = "core_clk", "iface_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_uart1_apps_clk>,
+		    <&clock_gcc clk_gcc_blsp1_ahb_clk>;
+		pinctrl-names = "sleep", "default";
+		pinctrl-0 = <&blsp1_uart1_sleep>;
+		pinctrl-1 = <&blsp1_uart1_active>;
+
+		qcom,msm-bus,name = "buart1";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			    <86 512 0 0>,
+			    <86 512 500 800>;
+		status = "disabled";
+	};
+
+	blsp1_uart2_hs: uart@c170000 { /* BLSP1 UART2 */
+		compatible = "qcom,msm-hsuart-v14";
+		reg = <0xC170000 0x200>,
+		    <0xC144000 0x25000>;
+		reg-names = "core_mem", "bam_mem";
+		interrupt-names = "core_irq", "bam_irq", "wakeup_irq";
+		#address-cells = <0>;
+		interrupt-parent = <&blsp1_uart2_hs>;
+		interrupts = <0 1 2>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-map = <0 &intc 0 0 108 0
+			    1 &intc 0 0 238 0
+			    2 &tlmm 34 0>;
+
+		qcom,inject-rx-on-wakeup;
+		qcom,rx-char-to-inject = <0xFD>;
+
+		qcom,bam-tx-ep-pipe-index = <2>;
+		qcom,bam-rx-ep-pipe-index = <3>;
+		qcom,master-id = <86>;
+		clock-names = "core_clk", "iface_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_uart2_apps_clk>,
+		    <&clock_gcc clk_gcc_blsp1_ahb_clk>;
+		pinctrl-names = "sleep", "default";
+		pinctrl-0 = <&blsp1_uart2_sleep>;
+		pinctrl-1 = <&blsp1_uart2_active>;
+
+		qcom,msm-bus,name = "buart2";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			    <86 512 0 0>,
+			    <86 512 500 800>;
+		status = "disabled";
+	};
+
+	blsp1_uart3_hs: uart@c171000 { /* BLSP1 UART3 */
+		compatible = "qcom,msm-hsuart-v14";
+		reg = <0xC171000 0x200>,
+		    <0xC144000 0x25000>;
+		reg-names = "core_mem", "bam_mem";
+		interrupt-names = "core_irq", "bam_irq", "wakeup_irq";
+		#address-cells = <0>;
+		interrupt-parent = <&blsp1_uart3_hs>;
+		interrupts = <0 1 2>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-map = <0 &intc 0 0 109 0
+			    1 &intc 0 0 238 0
+			    2 &tlmm 46 0>;
+
+		qcom,inject-rx-on-wakeup;
+		qcom,rx-char-to-inject = <0xFD>;
+
+		qcom,bam-tx-ep-pipe-index = <4>;
+		qcom,bam-rx-ep-pipe-index = <5>;
+		qcom,master-id = <86>;
+		clock-names = "core_clk", "iface_clk";
+		clocks = <&clock_gcc clk_gcc_blsp1_uart3_apps_clk>,
+		    <&clock_gcc clk_gcc_blsp1_ahb_clk>;
+		pinctrl-names = "sleep", "default";
+		pinctrl-0 = <&blsp1_uart3_tx_sleep>, <&blsp1_uart3_rxcts_sleep>,
+					<&blsp1_uart3_rfr_sleep>;
+		pinctrl-1 = <&blsp1_uart3_tx_active>,
+			<&blsp1_uart3_rxcts_active>, <&blsp1_uart3_rfr_active>;
+
+		qcom,msm-bus,name = "buart3";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			    <86 512 0 0>,
+			    <86 512 500 800>;
+		status = "disabled";
+	};
+
+	blsp2_uart1_hs: uart@c1af000 { /* BLSP2 UART1 */
+		compatible = "qcom,msm-hsuart-v14";
+		reg = <0xC1AF000 0x200>,
+		    <0xC184000 0x25000>;
+		reg-names = "core_mem", "bam_mem";
+		interrupt-names = "core_irq", "bam_irq", "wakeup_irq";
+		#address-cells = <0>;
+		interrupt-parent = <&blsp2_uart1_hs>;
+		interrupts = <0 1 2>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-map = <0 &intc 0 0 113 0
+			    1 &intc 0 0 239 0
+			    2 &tlmm 54 0>;
+
+		qcom,inject-rx-on-wakeup;
+		qcom,rx-char-to-inject = <0xFD>;
+
+		qcom,bam-tx-ep-pipe-index = <0>;
+		qcom,bam-rx-ep-pipe-index = <1>;
+		qcom,master-id = <84>;
+		clock-names = "core_clk", "iface_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_uart1_apps_clk>,
+		    <&clock_gcc clk_gcc_blsp2_ahb_clk>;
+		pinctrl-names = "sleep", "default";
+		pinctrl-0 = <&blsp2_uart1_sleep>;
+		pinctrl-1 = <&blsp2_uart1_active>;
+
+		qcom,msm-bus,name = "buart1";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			    <86 512 0 0>,
+			    <86 512 500 800>;
+		status = "disabled";
+	};
+
+	blsp2_uart2_hs: uart@c1b0000 { /* BLSP2 UART2 */
+		compatible = "qcom,msm-hsuart-v14";
+		reg = <0xC1B0000 0x200>,
+		    <0xC184000 0x25000>;
+		reg-names = "core_mem", "bam_mem";
+		interrupt-names = "core_irq", "bam_irq", "wakeup_irq";
+		#address-cells = <0>;
+		interrupt-parent = <&blsp2_uart2_hs>;
+		interrupts = <0 1 2>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-map = <0 &intc 0 0 114 0
+			    1 &intc 0 0 239 0
+			    2 &tlmm 5 0>;
+
+		qcom,inject-rx-on-wakeup;
+		qcom,rx-char-to-inject = <0xFD>;
+
+		qcom,bam-tx-ep-pipe-index = <2>;
+		qcom,bam-rx-ep-pipe-index = <3>;
+		qcom,master-id = <84>;
+		clock-names = "core_clk", "iface_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_uart2_apps_clk>,
+		    <&clock_gcc clk_gcc_blsp2_ahb_clk>;
+		pinctrl-names = "sleep", "default";
+		pinctrl-0 = <&blsp2_uart2_sleep>;
+		pinctrl-1 = <&blsp2_uart2_active>;
+
+		qcom,msm-bus,name = "buart2";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			    <86 512 0 0>,
+			    <86 512 500 800>;
+		status = "disabled";
+	};
+
+	blsp2_uart3_hs: uart@c1b1000 { /* BLSP2 UART3 */
+		compatible = "qcom,msm-hsuart-v14";
+		reg = <0xC1B1000 0x200>,
+		    <0xC184000 0x25000>;
+		reg-names = "core_mem", "bam_mem";
+		interrupt-names = "core_irq", "bam_irq", "wakeup_irq";
+		#address-cells = <0>;
+		interrupt-parent = <&blsp2_uart3_hs>;
+		interrupts = <0 1 2>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-map = <0 &intc 0 0 115 0
+			    1 &intc 0 0 239 0
+			    2 &tlmm 50 0>;
+
+		qcom,inject-rx-on-wakeup;
+		qcom,rx-char-to-inject = <0xFD>;
+
+		qcom,bam-tx-ep-pipe-index = <4>;
+		qcom,bam-rx-ep-pipe-index = <5>;
+		qcom,master-id = <84>;
+		clock-names = "core_clk", "iface_clk";
+		clocks = <&clock_gcc clk_gcc_blsp2_uart3_apps_clk>,
+		    <&clock_gcc clk_gcc_blsp2_ahb_clk>;
+		pinctrl-names = "sleep", "default";
+		pinctrl-0 = <&blsp2_uart3_sleep>;
+		pinctrl-1 = <&blsp2_uart3_active>;
+
+		qcom,msm-bus,name = "buart3";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			    <86 512 0 0>,
+			    <86 512 500 800>;
+		status = "disabled";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-bus.dtsi b/arch/arm64/boot/dts/qcom/msm8998-bus.dtsi
new file mode 100644
index 000000000000..edf7e7b9cbb0
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-bus.dtsi
@@ -0,0 +1,1467 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is Mree software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/msm/msm-bus-ids.h>
+
+&soc {
+	ad_hoc_bus: ad-hoc-bus {
+		/*Version = 4 */
+		compatible = "qcom,msm-bus-device";
+		reg = <0x1620000 0x40000>,
+			<0x1000000 0x80000>,
+			<0x1500000 0x10000>,
+			<0x1660000 0x60000>,
+			<0x1700000 0x60000>,
+			<0x17900000 0x10000>,
+			<0x1740000 0x10000>,
+			<0x1740000 0x10000>;
+
+		reg-names = "snoc-base", "bimc-base", "cnoc-base",
+			"a1noc-base", "a2noc-base", "gnoc-base",
+			"mmnoc-ahb-base", "mnoc-base";
+
+		/*Buses*/
+		fab_a1noc: fab-a1noc {
+			cell-id = <MSM_BUS_FAB_A1_NOC>;
+			label = "fab-a1noc";
+			qcom,fab-dev;
+			qcom,base-name = "a1noc-base";
+			qcom,bus-type = <1>;
+			qcom,qos-off = <4096>;
+			qcom,base-offset = <36864>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_gcc clk_aggre1_noc_clk>,
+				<&clock_gcc clk_aggre1_noc_a_clk>;
+			qcom,node-qos-clks {
+				clock-names =
+				"clk-ufs-axi-clk",
+				"clk-aggre1-ufs-axi-no-rate",
+				"clk-aggre1-usb3-axi-cfg-no-rate",
+				"clk-blsp2-ahb-no-rate";
+				clocks =
+				<&clock_gcc clk_gcc_ufs_axi_clk>,
+				<&clock_gcc clk_gcc_aggre1_ufs_axi_clk>,
+				<&clock_gcc clk_gcc_aggre1_usb3_axi_clk>,
+				<&clock_gcc clk_gcc_blsp2_ahb_clk>;
+			};
+		};
+
+		fab_a2noc: fab-a2noc {
+			cell-id = <MSM_BUS_FAB_A2_NOC>;
+			label = "fab-a2noc";
+			qcom,fab-dev;
+			qcom,base-name = "a2noc-base";
+			qcom,bus-type = <1>;
+			qcom,qos-off = <4096>;
+			qcom,base-offset = <20480>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_gcc clk_aggre2_noc_clk>,
+				<&clock_gcc clk_aggre2_noc_a_clk>;
+			qcom,node-qos-clks {
+				clock-names =
+				"clk-ipa-clk",
+				"clk-sdcc2-ahb-no-rate",
+				"clk-sdcc4-ahb-no-rate",
+				"clk-blsp1-ahb-no-rate";
+				clocks =
+				<&clock_gcc clk_ipa_clk>,
+				<&clock_gcc clk_gcc_sdcc2_ahb_clk>,
+				<&clock_gcc clk_gcc_sdcc4_ahb_clk>,
+				<&clock_gcc clk_gcc_blsp1_ahb_clk>;
+			};
+		};
+
+		fab_bimc: fab-bimc {
+			cell-id = <MSM_BUS_FAB_BIMC>;
+			label = "fab-bimc";
+			qcom,fab-dev;
+			qcom,base-name = "bimc-base";
+			qcom,bus-type = <2>;
+			qcom,util-fact = <153>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_gcc clk_bimc_msmbus_clk>,
+				<&clock_gcc clk_bimc_msmbus_a_clk>;
+		};
+
+		fab_cnoc: fab-cnoc {
+			cell-id = <MSM_BUS_FAB_CONFIG_NOC>;
+			label = "fab-cnoc";
+			qcom,fab-dev;
+			qcom,base-name = "cnoc-base";
+			qcom,bus-type = <1>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_gcc clk_cnoc_clk>,
+				<&clock_gcc clk_cnoc_a_clk>;
+		};
+
+		fab_cr_virt: fab-cr_virt {
+			cell-id = <MSM_BUS_FAB_CR_VIRT>;
+			label = "fab-cr_virt";
+			qcom,virt-dev;
+			qcom,base-name = "cr_virt-base";
+			qcom,bypass-qos-prg;
+		};
+
+		fab_gnoc: fab-gnoc {
+			cell-id = <MSM_BUS_FAB_GNOC>;
+			label = "fab-gnoc";
+			qcom,virt-dev;
+			qcom,base-name = "gnoc-base";
+			qcom,bypass-qos-prg;
+		};
+
+		fab_mnoc: fab-mnoc {
+			cell-id = <MSM_BUS_FAB_MMSS_NOC>;
+			label = "fab-mnoc";
+			qcom,fab-dev;
+			qcom,base-name = "mnoc-base";
+			qcom,bus-type = <1>;
+			qcom,qos-off = <4096>;
+			qcom,base-offset = <16384>;
+			qcom,util-fact = <153>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+				<&clock_gcc clk_mmssnoc_axi_a_clk>;
+			clk-camss-ahb-no-rate-supply =
+					<&gdsc_camss_top>;
+			clk-video-ahb-no-rate-supply =
+					<&gdsc_venus>;
+			clk-video-axi-no-rate-supply =
+					<&gdsc_venus>;
+			qcom,node-qos-clks {
+				clock-names =
+				"clk-noc-cfg-ahb-no-rate",
+				"clk-mnoc-ahb-no-rate",
+				"clk-camss-ahb-no-rate",
+				"clk-video-ahb-no-rate",
+				"clk-video-axi-no-rate";
+				clocks =
+				<&clock_gcc clk_mmssnoc_axi_clk>,
+				<&clock_gcc clk_gcc_mmss_noc_cfg_ahb_clk>,
+				<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+				<&clock_mmss clk_mmss_camss_ahb_clk>,
+				<&clock_mmss clk_mmss_video_ahb_clk>,
+				<&clock_mmss clk_mmss_video_axi_clk>;
+			};
+
+		};
+
+		fab_snoc: fab-snoc {
+			cell-id = <MSM_BUS_FAB_SYS_NOC>;
+			label = "fab-snoc";
+			qcom,fab-dev;
+			qcom,base-name = "snoc-base";
+			qcom,bus-type = <1>;
+			qcom,qos-off = <4096>;
+			qcom,base-offset = <20480>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_gcc clk_snoc_clk>,
+				<&clock_gcc clk_snoc_a_clk>;
+		};
+
+		fab_mnoc_ahb: fab-mnoc-ahb {
+			cell-id = <MSM_BUS_FAB_MMSS_AHB>;
+			label = "fab-mnoc-ahb";
+			qcom,fab-dev;
+			qcom,base-name = "mmnoc-ahb-base";
+			qcom,bypass-qos-prg;
+			qcom,setrate-only-clk;
+			qcom,bus-type = <1>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_mmss clk_ahb_clk_src>,
+			     <&clock_mmss clk_ahb_clk_src>;
+		};
+
+
+		/*Masters*/
+
+		mas_pcie_0: mas-pcie-0 {
+			cell-id = <MSM_BUS_MASTER_PCIE>;
+			label = "mas-pcie-0";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <1>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a1noc_snoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_a1noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PCIE_0>;
+		};
+
+		mas_usb3: mas-usb3 {
+			cell-id = <MSM_BUS_MASTER_USB3>;
+			label = "mas-usb3";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <2>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a1noc_snoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_a1noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_USB3>;
+		};
+
+		mas_ufs: mas-ufs {
+			cell-id = <MSM_BUS_MASTER_UFS>;
+			label = "mas-ufs";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <0>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a1noc_snoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_a1noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_UFS>;
+		};
+
+		mas_blsp_2: mas-blsp-2 {
+			cell-id = <MSM_BUS_MASTER_BLSP_2>;
+			label = "mas-blsp-2";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,qport = <4>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a1noc_snoc>;
+			qcom,bus-dev = <&fab_a1noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_BLSP_2>;
+		};
+
+		mas_cnoc_a2noc: mas-cnoc-a2noc {
+			cell-id = <0>;
+			label = "mas-cnoc-a2noc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_CNOC_A2NOC>;
+		};
+
+		mas_ipa: mas-ipa {
+			cell-id = <MSM_BUS_MASTER_IPA>;
+			label = "mas-ipa";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <1>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_IPA>;
+		};
+
+		mas_sdcc_2: mas-sdcc-2 {
+			cell-id = <MSM_BUS_MASTER_SDCC_2>;
+			label = "mas-sdcc-2";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,qport = <6>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SDCC_2>;
+		};
+
+		mas_sdcc_4: mas-sdcc-4 {
+			cell-id = <MSM_BUS_MASTER_SDCC_4>;
+			label = "mas-sdcc-4";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,qport = <7>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SDCC_4>;
+		};
+
+		mas_tsif: mas-tsif {
+			cell-id = <MSM_BUS_MASTER_TSIF>;
+			label = "mas-tsif";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_TSIF>;
+		};
+
+		mas_blsp_1: mas-blsp-1 {
+			cell-id = <MSM_BUS_MASTER_BLSP_1>;
+			label = "mas-blsp-1";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,qport = <8>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_BLSP_1>;
+		};
+
+		mas_cr_virt_a2noc: mas-cr-virt-a2noc {
+			cell-id = <MSM_BUS_MASTER_CRVIRT_A2NOC>;
+			label = "mas-cr-virt-a2noc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,qport = <9>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_CRVIRT_A2NOC>;
+		};
+
+		mas_gnoc_bimc: mas-gnoc-bimc {
+			cell-id = <MSM_BUS_MASTER_GNOC_BIMC>;
+			label = "mas-gnoc-bimc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <2>;
+			qcom,ap-owned;
+			qcom,qport = <0>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_ebi &slv_bimc_snoc_0>;
+			qcom,prio-lvl = <0>;
+			qcom,prio-rd = <0>;
+			qcom,prio-wr = <0>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_GNOC_BIMC>;
+		};
+
+		mas_oxili: mas-oxili {
+			cell-id = <MSM_BUS_MASTER_GRAPHICS_3D>;
+			label = "mas-oxili";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <2>;
+			qcom,ap-owned;
+			qcom,qport = <1>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = < &slv_bimc_snoc_1
+				&slv_hmss_l3&slv_ebi &slv_bimc_snoc_0>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_GFX3D>;
+		};
+
+		mas_mnoc_bimc: mas-mnoc-bimc {
+			cell-id = <MSM_BUS_MNOC_BIMC_MAS>;
+			label = "mas-mnoc-bimc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <2>;
+			qcom,ap-owned;
+			qcom,qport = <2>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = < &slv_bimc_snoc_1
+				&slv_hmss_l3&slv_ebi &slv_bimc_snoc_0>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_MNOC_BIMC>;
+		};
+
+		mas_snoc_bimc: mas-snoc-bimc {
+			cell-id = <MSM_BUS_SNOC_BIMC_MAS>;
+			label = "mas-snoc-bimc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <2>;
+			qcom,qport = <3>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = < &slv_hmss_l3&slv_ebi>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SNOC_BIMC>;
+		};
+
+		mas_snoc_cnoc: mas-snoc-cnoc {
+			cell-id = <MSM_BUS_SNOC_CNOC_MAS>;
+			label = "mas-snoc-cnoc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = < &slv_skl &slv_blsp_2
+				&slv_message_ram
+				&slv_tlmm_west &slv_tsif
+				&slv_mpm &slv_bimc_cfg
+				&slv_tlmm_east &slv_spdm
+				&slv_pimem_cfg &slv_a1noc_smmu_cfg
+				&slv_blsp_1 &slv_clk_ctl
+				&slv_prng &slv_usb3_0
+				&slv_qdss_cfg &slv_qm_cfg
+				&slv_a2noc_cfg &slv_pmic_arb
+				&slv_ufs_cfg &slv_srvc_cnoc
+				&slv_ahb2phy &slv_ipa
+				&slv_glm &slv_snoc_cfg
+				&slv_ssc_cfg &slv_sdcc_2
+				&slv_sdcc_4 &slv_pdm
+				&slv_cnoc_mnoc_mmss_cfg &slv_cnoc_mnoc_cfg
+				&slv_mss_cfg &slv_imem_cfg
+				&slv_a1noc_cfg &slv_gpuss_cfg
+				&slv_tcsr &slv_tlmm_north>;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SNOC_CNOC>;
+		};
+
+		mas_qdss_dap: mas-qdss-dap {
+			cell-id = <MSM_BUS_MASTER_QDSS_DAP>;
+			label = "mas-qdss-dap";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = < &slv_skl &slv_blsp_2
+				&slv_message_ram
+				&slv_tlmm_west &slv_tsif
+				&slv_mpm &slv_bimc_cfg
+				&slv_tlmm_east &slv_spdm
+				&slv_pimem_cfg &slv_a1noc_smmu_cfg
+				&slv_blsp_1 &slv_clk_ctl
+				&slv_prng &slv_usb3_0
+				&slv_qdss_cfg &slv_qm_cfg
+				&slv_a2noc_cfg &slv_pmic_arb
+				&slv_ufs_cfg &slv_srvc_cnoc
+				&slv_ahb2phy &slv_ipa
+				&slv_glm &slv_snoc_cfg
+				&slv_sdcc_2 &slv_sdcc_4
+				&slv_pdm &slv_cnoc_mnoc_mmss_cfg
+				&slv_cnoc_mnoc_cfg &slv_mss_cfg
+				&slv_imem_cfg &slv_a1noc_cfg
+				&slv_gpuss_cfg &slv_ssc_cfg
+				&slv_tcsr &slv_tlmm_north
+				&slv_cnoc_a2noc>;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_QDSS_DAP>;
+		};
+
+		mas_crypto_c0: mas-crypto-c0 {
+			cell-id = <MSM_BUS_MASTER_CRYPTO_CORE0>;
+			label = "mas-crypto-c0";
+			qcom,buswidth = <650>;
+			qcom,agg-ports = <1>;
+			qcom,connections = <&slv_cr_virt_a2noc>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_CRYPTO_CORE0>;
+		};
+
+		mas_apps_proc: mas-apps-proc {
+			cell-id = <MSM_BUS_MASTER_AMPSS_M0>;
+			label = "mas-apps-proc";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_gnoc_bimc>;
+			qcom,bus-dev = <&fab_gnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_APPSS_PROC>;
+		};
+
+		mas_cnoc_mnoc_mmss_cfg: mas-cnoc-mnoc-mmss-cfg {
+			cell-id = <MSM_BUS_MASTER_CNOC_MNOC_MMSS_CFG>;
+			label = "mas-cnoc-mnoc-mmss-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = < &slv_camera_throttle_cfg
+				&slv_venus_cfg &slv_misc_cfg
+				&slv_camera_cfg &slv_display_throttle_cfg
+				&slv_venus_throttle_cfg &slv_display_cfg
+				&slv_mmss_clk_cfg &slv_vmem_cfg
+				&slv_mmss_clk_xpu_cfg &slv_smmu_cfg>;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,mas-rpm-id = <ICBID_MASTER_CNOC_MNOC_MMSS_CFG>;
+		};
+
+		mas_cnoc_mnoc_cfg: mas-cnoc-mnoc-cfg {
+			cell-id = <MSM_BUS_MASTER_CNOC_MNOC_CFG>;
+			label = "mas-cnoc-mnoc-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_srvc_mnoc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_CNOC_MNOC_CFG>;
+		};
+
+		mas_cpp: mas-cpp {
+			cell-id = <MSM_BUS_MASTER_CPP>;
+			label = "mas-cpp";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <5>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_CPP>;
+		};
+
+		mas_jpeg: mas-jpeg {
+			cell-id = <MSM_BUS_MASTER_JPEG>;
+			label = "mas-jpeg";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <7>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_JPEG>;
+		};
+
+		mas_mdp_p0: mas-mdp-p0 {
+			cell-id = <MSM_BUS_MASTER_MDP_PORT0>;
+			label = "mas-mdp-p0";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <1>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,vrail-comp = <25>;
+			qcom,mas-rpm-id = <ICBID_MASTER_MDP0>;
+			clk-mdss-axi-no-rate-supply =
+					<&gdsc_mdss>;
+			clk-mdss-ahb-no-rate-supply =
+					<&gdsc_mdss>;
+			qcom,node-qos-clks {
+				clock-names =
+				"clk-mdss-ahb-no-rate",
+				"clk-mdss-axi-no-rate";
+				clocks =
+				<&clock_mmss clk_mmss_mdss_ahb_clk>,
+				<&clock_mmss clk_mmss_mdss_axi_clk>;
+			};
+
+		};
+
+		mas_mdp_p1: mas-mdp-p1 {
+			cell-id = <MSM_BUS_MASTER_MDP_PORT1>;
+			label = "mas-mdp-p1";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <2>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,vrail-comp = <25>;
+			qcom,mas-rpm-id = <ICBID_MASTER_MDP1>;
+		};
+
+		mas_rotator: mas-rotator {
+			cell-id = <MSM_BUS_MASTER_ROTATOR>;
+			label = "mas-rotator";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <0>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_ROTATOR>;
+		};
+
+		mas_venus: mas-venus {
+			cell-id = <MSM_BUS_MASTER_VIDEO_P0>;
+			label = "mas-venus";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <2>;
+			qcom,ap-owned;
+			qcom,qport = <3 4>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_VIDEO>;
+		};
+
+		mas_vfe: mas-vfe {
+			cell-id = <MSM_BUS_MASTER_VFE>;
+			label = "mas-vfe";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <6>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_VFE>;
+		};
+
+		mas_venus_vmem: mas-venus-vmem {
+			cell-id = <MSM_BUS_MASTER_VIDEO_P0_OCMEM>;
+			label = "mas-venus-vmem";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_vmem>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_VENUS_VMEM>;
+		};
+
+		mas_hmss: mas-hmss {
+			cell-id = <MSM_BUS_MASTER_HMSS>;
+			label = "mas-hmss";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <3>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = < &slv_pimem &slv_imem
+				&slv_snoc_bimc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_HMSS>;
+		};
+
+		mas_qdss_bam: mas-qdss-bam {
+			cell-id = <MSM_BUS_MASTER_QDSS_BAM>;
+			label = "mas-qdss-bam";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <1>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = < &slv_imem &slv_pimem &slv_snoc_cnoc
+				&slv_snoc_bimc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_QDSS_BAM>;
+		};
+
+		mas_snoc_cfg: mas-snoc-cfg {
+			cell-id = <MSM_BUS_MASTER_SNOC_CFG>;
+			label = "mas-snoc-cfg";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,connections = <&slv_srvc_snoc>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SNOC_CFG>;
+		};
+
+		mas_bimc_snoc_0: mas-bimc-snoc-0 {
+			cell-id = <MSM_BUS_BIMC_SNOC_MAS>;
+			label = "mas-bimc-snoc-0";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,connections = < &slv_pimem &slv_lpass&slv_hmss
+				 &slv_wlan &slv_snoc_cnoc
+				 &slv_imem &slv_qdss_stm>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_BIMC_SNOC_0>;
+		};
+
+		mas_bimc_snoc_1: mas-bimc-snoc-1 {
+			cell-id = <MSM_BUS_BIMC_SNOC_1_MAS>;
+			label = "mas-bimc-snoc-1";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_pcie_0>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_BIMC_SNOC_1>;
+		};
+
+		mas_a1noc_snoc: mas-a1noc-snoc {
+			cell-id = <MSM_BUS_A1NOC_SNOC_MAS>;
+			label = "mas-a1noc-snoc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,connections = < &slv_pimem &slv_pcie_0 &slv_lpass
+				&slv_hmss &slv_snoc_bimc
+				 &slv_snoc_cnoc &slv_imem
+				 &slv_qdss_stm>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_A1NOC_SNOC>;
+		};
+
+		mas_a2noc_snoc: mas-a2noc-snoc {
+			cell-id = <MSM_BUS_A2NOC_SNOC_MAS>;
+			label = "mas-a2noc-snoc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,connections = < &slv_pimem &slv_pcie_0 &slv_lpass
+				&slv_hmss &slv_snoc_bimc
+				 &slv_wlan &slv_snoc_cnoc
+				 &slv_imem &slv_qdss_stm>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_A2NOC_SNOC>;
+		};
+
+		mas_qdss_etr: mas-qdss-etr {
+			cell-id = <MSM_BUS_MASTER_QDSS_ETR>;
+			label = "mas-qdss-etr";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <2>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = < &slv_imem &slv_pimem &slv_snoc_cnoc
+				&slv_snoc_bimc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_QDSS_ETR>;
+		};
+
+		/*Internal nodes*/
+
+		/*Slaves*/
+
+		slv_a1noc_snoc:slv-a1noc-snoc {
+			cell-id = <MSM_BUS_A1NOC_SNOC_SLV>;
+			label = "slv-a1noc-snoc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_a1noc>;
+			qcom,connections = <&mas_a1noc_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A1NOC_SNOC>;
+		};
+
+		slv_a2noc_snoc:slv-a2noc-snoc {
+			cell-id = <MSM_BUS_A2NOC_SNOC_SLV>;
+			label = "slv-a2noc-snoc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,connections = <&mas_a2noc_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A2NOC_SNOC>;
+		};
+
+		slv_ebi:slv-ebi {
+			cell-id = <MSM_BUS_SLAVE_EBI_CH0>;
+			label = "slv-ebi";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <2>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_EBI1>;
+		};
+
+		slv_hmss_l3:slv-hmss-l3 {
+			cell-id = <MSM_BUS_SLAVE_HMSS_L3>;
+			label = "slv-hmss-l3";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_HMSS_L3>;
+		};
+
+		slv_bimc_snoc_0:slv-bimc-snoc-0 {
+			cell-id = <MSM_BUS_BIMC_SNOC_SLV>;
+			label = "slv-bimc-snoc-0";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,connections = <&mas_bimc_snoc_0>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_BIMC_SNOC_0>;
+		};
+
+		slv_bimc_snoc_1:slv-bimc-snoc-1 {
+			cell-id = <MSM_BUS_BIMC_SNOC_1_SLV>;
+			label = "slv-bimc-snoc-1";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,connections = <&mas_bimc_snoc_1>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_BIMC_SNOC_1>;
+		};
+
+		slv_cnoc_a2noc:slv-cnoc-a2noc {
+			cell-id = <MSM_BUS_CNOC_SNOC_SLV>;
+			label = "slv-cnoc-a2noc";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,connections = <&mas_cnoc_a2noc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CNOC_A2NOC>;
+		};
+
+		slv_ssc_cfg:slv-ssc-cfg {
+			cell-id = <MSM_BUS_SLAVE_SSC_CFG>;
+			label = "slv-ssc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SSC_CFG>;
+		};
+
+		slv_mpm:slv-mpm {
+			cell-id = <MSM_BUS_SLAVE_MPM>;
+			label = "slv-mpm";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MPM>;
+		};
+
+		slv_pmic_arb:slv-pmic-arb {
+			cell-id = <MSM_BUS_SLAVE_PMIC_ARB>;
+			label = "slv-pmic-arb";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PMIC_ARB>;
+		};
+		slv_tlmm_north:slv-tlmm-north {
+			cell-id = <MSM_BUS_SLAVE_TLMM_NORTH>;
+			label = "slv-tlmm-north";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_TLMM_NORTH>;
+		};
+		slv_pimem_cfg:slv-pimem-cfg {
+			cell-id = <MSM_BUS_SLAVE_PIMEM_CFG>;
+			label = "slv-pimem-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PIMEM_CFG>;
+		};
+
+		slv_imem_cfg:slv-imem-cfg {
+			cell-id = <MSM_BUS_SLAVE_IMEM_CFG>;
+			label = "slv-imem-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_IMEM_CFG>;
+		};
+
+		slv_message_ram:slv-message-ram {
+			cell-id = <MSM_BUS_SLAVE_MESSAGE_RAM>;
+			label = "slv-message-ram";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MESSAGE_RAM>;
+		};
+
+		slv_skl:slv-skl {
+			cell-id = <MSM_BUS_SLAVE_SKL>;
+			label = "slv-skl";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SKL>;
+		};
+
+		slv_bimc_cfg:slv-bimc-cfg {
+			cell-id = <MSM_BUS_SLAVE_BIMC_CFG>;
+			label = "slv-bimc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_BIMC_CFG>;
+		};
+
+		slv_prng:slv-prng {
+			cell-id = <MSM_BUS_SLAVE_PRNG>;
+			label = "slv-prng";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PRNG>;
+		};
+
+		slv_a2noc_cfg:slv-a2noc-cfg {
+			cell-id = <MSM_BUS_SLAVE_A2NOC_CFG>;
+			label = "slv-a2noc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A2NOC_CFG>;
+		};
+
+		slv_ipa:slv-ipa {
+			cell-id = <MSM_BUS_SLAVE_IPA_CFG>;
+			label = "slv-ipa";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_IPA_CFG>;
+		};
+
+		slv_tcsr:slv-tcsr {
+			cell-id = <MSM_BUS_SLAVE_TCSR>;
+			label = "slv-tcsr";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_TCSR>;
+		};
+
+		slv_snoc_cfg:slv-snoc-cfg {
+			cell-id = <MSM_BUS_SLAVE_SNOC_CFG>;
+			label = "slv-snoc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SNOC_CFG>;
+		};
+
+		slv_clk_ctl:slv-clk-ctl {
+			cell-id = <MSM_BUS_SLAVE_CLK_CTL>;
+			label = "slv-clk-ctl";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CLK_CTL>;
+		};
+
+		slv_glm:slv-glm {
+			cell-id = <MSM_BUS_SLAVE_GLM>;
+			label = "slv-glm";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_GLM>;
+		};
+
+		slv_spdm:slv-spdm {
+			cell-id = <MSM_BUS_SLAVE_SPDM_WRAPPER>;
+			label = "slv-spdm";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SPDM_WRAPPER>;
+		};
+
+		slv_gpuss_cfg:slv-gpuss-cfg {
+			cell-id = <MSM_BUS_SLAVE_GRAPHICS_3D_CFG>;
+			label = "slv-gpuss-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_GFX3D_CFG>;
+		};
+
+		slv_cnoc_mnoc_cfg:slv-cnoc-mnoc-cfg {
+			cell-id = <MSM_BUS_SLAVE_CNOC_MNOC_CFG>;
+			label = "slv-cnoc-mnoc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,connections = <&mas_cnoc_mnoc_cfg>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CNOC_MNOC_CFG>;
+		};
+
+		slv_qm_cfg:slv-qm-cfg {
+			cell-id = <MSM_BUS_SLAVE_QM_CFG>;
+			label = "slv-qm-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_QM_CFG>;
+		};
+
+		slv_mss_cfg:slv-mss-cfg {
+			cell-id = <MSM_BUS_SLAVE_CNOC_MSS>;
+			label = "slv-mss-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CNOC_MSS>;
+		};
+
+		slv_ufs_cfg:slv-ufs-cfg {
+			cell-id = <MSM_BUS_SLAVE_UFS_CFG>;
+			label = "slv-ufs-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_UFS_CFG>;
+		};
+
+		slv_tlmm_west:slv-tlmm-west {
+			cell-id = <MSM_BUS_SLAVE_TLMM_WEST>;
+			label = "slv-tlmm-west";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_TLMM_WEST>;
+		};
+
+		slv_a1noc_cfg:slv-a1noc-cfg {
+			cell-id = <MSM_BUS_SLAVE_A1NOC_CFG>;
+			label = "slv-a1noc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A1NOC_CFG>;
+		};
+
+		slv_ahb2phy:slv-ahb2phy {
+			cell-id = <MSM_BUS_SLAVE_PCIE20_AHB2PHY>;
+			label = "slv-ahb2phy";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCIE20_AHB2PHY>;
+		};
+
+		slv_blsp_2:slv-blsp-2 {
+			cell-id = <MSM_BUS_SLAVE_BLSP_2>;
+			label = "slv-blsp-2";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_BLSP_2>;
+		};
+
+		slv_pdm:slv-pdm {
+			cell-id = <MSM_BUS_SLAVE_PDM>;
+			label = "slv-pdm";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PDM>;
+		};
+
+		slv_usb3_0:slv-usb3-0 {
+			cell-id = <MSM_BUS_SLAVE_USB3>;
+			label = "slv-usb3-0";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_USB3_0>;
+		};
+
+		slv_a1noc_smmu_cfg:slv-a1noc-smmu-cfg {
+			cell-id = <MSM_BUS_SLAVE_A1NOC_SMMU_CFG>;
+			label = "slv-a1noc-smmu-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A1NOC_SMMU_CFG>;
+		};
+
+		slv_blsp_1:slv-blsp-1 {
+			cell-id = <MSM_BUS_SLAVE_BLSP_1>;
+			label = "slv-blsp-1";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_BLSP_1>;
+		};
+
+		slv_sdcc_2:slv-sdcc-2 {
+			cell-id = <MSM_BUS_SLAVE_SDCC_2>;
+			label = "slv-sdcc-2";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SDCC_2>;
+		};
+
+		slv_sdcc_4:slv-sdcc-4 {
+			cell-id = <MSM_BUS_SLAVE_SDCC_4>;
+			label = "slv-sdcc-4";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SDCC_4>;
+		};
+
+		slv_tsif:slv-tsif {
+			cell-id = <MSM_BUS_SLAVE_TSIF>;
+			label = "slv-tsif";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_TSIF>;
+		};
+
+		slv_qdss_cfg:slv-qdss-cfg {
+			cell-id = <MSM_BUS_SLAVE_QDSS_CFG>;
+			label = "slv-qdss-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_QDSS_CFG>;
+		};
+
+		slv_tlmm_east:slv-tlmm-east {
+			cell-id = <MSM_BUS_SLAVE_TLMM_EAST>;
+			label = "slv-tlmm-east";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_TLMM_EAST>;
+		};
+
+		slv_cnoc_mnoc_mmss_cfg:slv-cnoc-mnoc-mmss-cfg {
+			cell-id = <MSM_BUS_SLAVE_CNOC_MNOC_MMSS_CFG>;
+			label = "slv-cnoc-mnoc-mmss-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,connections = <&mas_cnoc_mnoc_mmss_cfg>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CNOC_MNOC_MMSS_CFG>;
+		};
+
+		slv_srvc_cnoc:slv-srvc-cnoc {
+			cell-id = <MSM_BUS_SLAVE_SERVICE_CNOC>;
+			label = "slv-srvc-cnoc";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SERVICE_CNOC>;
+		};
+
+		slv_cr_virt_a2noc:slv-cr-virt-a2noc {
+			cell-id = <MSM_BUS_SLAVE_CRVIRT_A2NOC>;
+			label = "slv-cr-virt-a2noc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,connections = <&mas_cr_virt_a2noc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CRVIRT_A2NOC>;
+		};
+
+		slv_gnoc_bimc:slv-gnoc-bimc {
+			cell-id = <MSM_BUS_SLAVE_GNOC_BIMC>;
+			label = "slv-gnoc-bimc";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_gnoc>;
+			qcom,connections = <&mas_gnoc_bimc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_GNOC_BIMC>;
+		};
+
+		slv_camera_cfg:slv-camera-cfg {
+			cell-id = <MSM_BUS_SLAVE_CAMERA_CFG>;
+			label = "slv-camera-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CAMERA_CFG>;
+		};
+
+		slv_camera_throttle_cfg:slv-camera-throttle-cfg {
+			cell-id = <MSM_BUS_SLAVE_CAMERA_THROTTLE_CFG>;
+			label = "slv-camera-throttle-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CAMERA_THROTTLE_CFG>;
+		};
+
+		slv_misc_cfg:slv-misc-cfg {
+			cell-id = <MSM_BUS_SLAVE_MISC_CFG>;
+			label = "slv-misc-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MISC_CFG>;
+		};
+
+		slv_venus_throttle_cfg:slv-venus-throttle-cfg {
+			cell-id = <MSM_BUS_SLAVE_VENUS_THROTTLE_CFG>;
+			label = "slv-venus-throttle-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_VENUS_THROTTLE_CFG>;
+		};
+
+		slv_venus_cfg:slv-venus-cfg {
+			cell-id = <MSM_BUS_SLAVE_VENUS_CFG>;
+			label = "slv-venus-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_VENUS_CFG>;
+		};
+
+		slv_vmem_cfg:slv-vmem-cfg {
+			cell-id = <MSM_BUS_SLAVE_VMEM_CFG>;
+			label = "slv-vmem-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_VMEM_CFG>;
+			qcom,enable-only-clk;
+			clock-names = "node_clk";
+			clocks = <&clock_mmss clk_mmss_mnoc_maxi_clk>;
+		};
+
+		slv_mmss_clk_xpu_cfg:slv-mmss-clk-xpu-cfg {
+			cell-id = <MSM_BUS_SLAVE_MMSS_CLK_XPU_CFG>;
+			label = "slv-mmss-clk-xpu-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MMSS_CLK_XPU_CFG>;
+		};
+
+		slv_mmss_clk_cfg:slv-mmss-clk-cfg {
+			cell-id = <MSM_BUS_SLAVE_MMSS_CLK_CFG>;
+			label = "slv-mmss-clk-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MMSS_CLK_CFG>;
+		};
+
+		slv_display_cfg:slv-display-cfg {
+			cell-id = <MSM_BUS_SLAVE_DISPLAY_CFG>;
+			label = "slv-display-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_DISPLAY_CFG>;
+		};
+
+		slv_display_throttle_cfg:slv-display-throttle-cfg {
+			cell-id = <MSM_BUS_SLAVE_DISPLAY_THROTTLE_CFG>;
+			label = "slv-display-throttle-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_DISPLAY_THROTTLE_CFG>;
+		};
+
+		slv_smmu_cfg:slv-smmu-cfg {
+			cell-id = <MSM_BUS_SLAVE_MMSS_SMMU_CFG>;
+			label = "slv-smmu-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MMSS_SMMU_CFG>;
+		};
+
+		slv_mnoc_bimc:slv-mnoc-bimc {
+			cell-id = <MSM_BUS_MNOC_BIMC_SLV>;
+			label = "slv-mnoc-bimc";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <2>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,connections = <&mas_mnoc_bimc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MNOC_BIMC>;
+			qcom,enable-only-clk;
+			clock-names = "node_clk";
+			clocks = <&clock_gcc clk_mmssnoc_axi_clk>;
+		};
+
+		slv_vmem: slv-vmem {
+			cell-id = <MSM_BUS_SLAVE_VMEM>;
+			label = "slv-vmem";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_VMEM>;
+			clock-names = "node_clk";
+			clocks = <&clock_mmss clk_mmss_mnoc_maxi_clk>;
+		};
+
+		slv_srvc_mnoc:slv-srvc-mnoc {
+			cell-id = <MSM_BUS_SLAVE_SERVICE_MNOC>;
+			label = "slv-srvc-mnoc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SERVICE_MNOC>;
+		};
+
+		slv_hmss:slv-hmss {
+			cell-id = <MSM_BUS_SLAVE_APPSS>;
+			label = "slv-hmss";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_APPSS>;
+		};
+
+		slv_lpass:slv-lpass {
+			cell-id = <MSM_BUS_SLAVE_LPASS>;
+			label = "slv-lpass";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_LPASS>;
+		};
+
+		slv_wlan:slv-wlan {
+			cell-id = <MSM_BUS_SLAVE_WLAN>;
+			label = "slv-wlan";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_WLAN>;
+		};
+
+		slv_snoc_bimc:slv-snoc-bimc {
+			cell-id = <MSM_BUS_SNOC_BIMC_SLV>;
+			label = "slv-snoc-bimc";
+			qcom,buswidth = <32>;
+			qcom,agg-ports = <2>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,connections = <&mas_snoc_bimc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SNOC_BIMC>;
+		};
+
+		slv_snoc_cnoc:slv-snoc-cnoc {
+			cell-id = <MSM_BUS_SNOC_CNOC_SLV>;
+			label = "slv-snoc-cnoc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,connections = <&mas_snoc_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SNOC_CNOC>;
+		};
+
+		slv_imem:slv-imem {
+			cell-id = <MSM_BUS_SLAVE_OCIMEM>;
+			label = "slv-imem";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_IMEM>;
+		};
+
+		slv_pimem:slv-pimem {
+			cell-id = <MSM_BUS_SLAVE_PIMEM>;
+			label = "slv-pimem";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PIMEM>;
+		};
+
+		slv_qdss_stm:slv-qdss-stm {
+			cell-id = <MSM_BUS_SLAVE_QDSS_STM>;
+			label = "slv-qdss-stm";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_QDSS_STM>;
+		};
+
+		slv_pcie_0:slv-pcie-0 {
+			cell-id = <MSM_BUS_SLAVE_PCIE_0>;
+			label = "slv-pcie-0";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCIE_0>;
+		};
+
+		slv_srvc_snoc:slv-srvc-snoc {
+			cell-id = <MSM_BUS_SLAVE_SERVICE_SNOC>;
+			label = "slv-srvc-snoc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SERVICE_SNOC>;
+		};
+	};
+
+	devfreq_spdm_cpu {
+		compatible = "qcom,devfreq_spdm";
+		qcom,msm-bus,name = "devfreq_spdm";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<1 512 0 0>,
+				<1 512 0 0>;
+		qcom,msm-bus,active-only;
+		qcom,spdm-client = <0>;
+
+		qcom,bw-upstep = <1000>;
+		qcom,bw-dwnstep = <1000>;
+		qcom,max-vote = <10000>;
+		qcom,up-step-multp = <2>;
+		qcom,spdm-interval = <100>;
+
+		qcom,ports = <24>;
+		qcom,alpha-up = <12>;
+		qcom,alpha-down = <15>;
+		qcom,bucket-size = <8>;
+
+		/*max pl1 freq, max pl2 freq*/
+		qcom,pl-freqs = <260000 770000>;
+
+		/* pl1 low, pl1 high, pl2 low, pl2 high, pl3 low, pl3 high */
+		qcom,reject-rate = <5000 5000 5000 5000 5000 5000>;
+		/* pl1 low, pl1 high, pl2 low, pl2 high, pl3 low, pl3 high */
+		qcom,response-time-us = <10000 10000 10000 10000 10000 10000>;
+		/* pl1 low, pl1 high, pl2 low, pl2 high, pl3 low, pl3 high */
+		qcom,cci-response-time-us = <10000 10000 10000
+						10000 10000 10000>;
+		qcom,max-cci-freq = <1036800>;
+	};
+
+	devfreq_spdm_gov {
+		compatible = "qcom,gov_spdm_hyp";
+		interrupt-names = "spdm-irq";
+		interrupts = <0 192 IRQ_TYPE_EDGE_RISING>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-cdp.dtsi b/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-cdp.dtsi
new file mode 100644
index 000000000000..d5c8900f6e67
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-cdp.dtsi
@@ -0,0 +1,380 @@
+/*
+ * Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	led_flash0: qcom,camera-flash@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8998_flash0 &pmi8998_flash1>;
+		qcom,torch-source = <&pmi8998_torch0 &pmi8998_torch1>;
+		qcom,switch-source = <&pmi8998_switch0>;
+		status = "ok";
+	};
+
+	led_flash1: qcom,camera-flash@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8998_flash2>;
+		qcom,torch-source = <&pmi8998_torch2>;
+		qcom,switch-source = <&pmi8998_switch1>;
+		status = "ok";
+	};
+
+	actuator_regulator: gpio-regulator@0 {
+		compatible = "regulator-fixed";
+		regulator-name = "rear_vana_regulator";
+		regulator-min-microvolt = <2800000>;
+		regulator-max-microvolt = <2800000>;
+		enable-active-high;
+		gpio = <&tlmm 27 0>;
+		vin-supply = <&pmi8998_bob>;
+	};
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&actuator_regulator>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <0>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&actuator_regulator>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <0>;
+	};
+
+	ois0: qcom,ois@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,ois";
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+		status = "disabled";
+	};
+
+	tof0: qcom,tof@0 {
+		cell-index = <0>;
+		reg = <0x29>;
+		compatible = "st,stmvl53l0";
+		qcom,cci-master = <0>;
+		cam_cci-supply = <&pm8998_lvs1>;
+		cam_laser-supply = <&actuator_regulator>;
+		qcom,cam-vreg-name = "cam_cci", "cam_laser";
+		qcom,cam-vreg-min-voltage = <0 0>;
+		qcom,cam-vreg-max-voltage = <0 2800000>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_tof_active>;
+		pinctrl-1 = <&cam_tof_suspend>;
+		stm,irq-gpio = <&tlmm 26 0x2008>;
+		gpios = <&tlmm 126 0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_CE";
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 3312000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 3600000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				&cam_sensor_rear_active
+				&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_sensor_rear_suspend
+				&cam_actuator_vaf_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&pm8998_gpios 20 0>,
+			<&tlmm 29 0>,
+			<&tlmm 27 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-vaf = <4>;
+		qcom,gpio-req-tbl-num = <0 1 2 3 4>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA",
+					"CAM_VAF";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		cam_vdig-supply = <&pm8998_lvs1>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <0 0 3312000>;
+		qcom,cam-vreg-max-voltage = <0 0 3600000>;
+		qcom,cam-vreg-op-mode = <0 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 9 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vana = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_VANA1";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom2: qcom,eeprom@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pm8998_l22>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-max-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 28 0>,
+			<&pm8998_gpios 9 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <90>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,ois-src = <&ois0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 3312000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 3600000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				 &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				 &cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&pm8998_gpios 20 0>,
+			<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <90>;
+		qcom,eeprom-src = <&eeprom1>;
+		qcom,actuator-src = <&actuator1>;
+		cam_vdig-supply = <&pm8998_lvs1>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <0 0 3312000>;
+		qcom,cam-vreg-max-voltage = <0 0 3600000>;
+		qcom,cam-vreg-op-mode = <0 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 9 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vana = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_VANA1";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,eeprom-src = <&eeprom2>;
+		qcom,led-flash-src = <&led_flash1>;
+		qcom,actuator-src = <&actuator1>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pm8998_l22>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-max-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 28 0>,
+			<&pm8998_gpios 9 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
+&pm8998_gpios {
+	gpio@c800 { /* GPIO 9 - CAMERA SENSOR 2 VDIG */
+		qcom,mode = <1>;		/* Output */
+		qcom,pull = <5>;		/* No Pull */
+		qcom,vin-sel = <0>;		/* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "ok";
+	};
+
+	gpio@d300 { /* GPIO 20 - CAMERA SENSOR 0 VDIG */
+		qcom,mode = <1>;		/* Output */
+		qcom,pull = <5>;		/* No Pull */
+		qcom,vin-sel = <1>;		/* VIN1 GPIO_MV */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "ok";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-mtp.dtsi b/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-mtp.dtsi
new file mode 100644
index 000000000000..2095b4e07069
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-mtp.dtsi
@@ -0,0 +1,422 @@
+/*
+ * Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	led_flash0: qcom,camera-flash@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8998_flash0 &pmi8998_flash1>;
+		qcom,torch-source = <&pmi8998_torch0 &pmi8998_torch1>;
+		qcom,switch-source = <&pmi8998_switch0>;
+		status = "ok";
+	};
+
+	led_flash1: qcom,camera-flash@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8998_flash2>;
+		qcom,torch-source = <&pmi8998_torch2>;
+		qcom,switch-source = <&pmi8998_switch1>;
+		status = "ok";
+	};
+
+	actuator_regulator: gpio-regulator@0 {
+		compatible = "regulator-fixed";
+		regulator-name = "rear_vana_regulator";
+		regulator-min-microvolt = <2800000>;
+		regulator-max-microvolt = <2800000>;
+		enable-active-high;
+		gpio = <&tlmm 27 0>;
+		vin-supply = <&pmi8998_bob>;
+	};
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&actuator_regulator>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <0>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&actuator_regulator>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <0>;
+	};
+
+	tof0: qcom,tof@0 {
+		cell-index = <0>;
+		reg = <0x29>;
+		compatible = "st,stmvl53l0";
+		qcom,cci-master = <0>;
+		cam_cci-supply = <&pm8998_lvs1>;
+		cam_laser-supply = <&actuator_regulator>;
+		qcom,cam-vreg-name = "cam_cci", "cam_laser";
+		qcom,cam-vreg-min-voltage = <0 0>;
+		qcom,cam-vreg-max-voltage = <0 2800000>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_tof_active>;
+		pinctrl-1 = <&cam_tof_suspend>;
+		stm,irq-gpio = <&tlmm 26 0x2008>;
+		gpios = <&tlmm 126 0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_CE";
+	};
+
+	ois0: qcom,ois@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,ois";
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 3312000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 3600000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				&cam_sensor_rear_active
+				&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_sensor_rear_suspend
+				&cam_actuator_vaf_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&pm8998_gpios 20 0>,
+			<&tlmm 29 0>,
+			<&tlmm 27 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-vaf = <4>;
+		qcom,gpio-req-tbl-num = <0 1 2 3 4>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA",
+					"CAM_VAF";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		cam_vdig-supply = <&pm8998_lvs1>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <0 0 3312000>;
+		qcom,cam-vreg-max-voltage = <0 0 3600000>;
+		qcom,cam-vreg-op-mode = <0 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 9 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vana = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_VANA1";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom2: qcom,eeprom@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pm8998_l22>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-max-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 28 0>,
+			<&pm8998_gpios 9 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <270>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,ois-src = <&ois0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 3312000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 3600000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				 &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				 &cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&pm8998_gpios 20 0>,
+			<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <90>;
+		qcom,eeprom-src = <&eeprom1>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator1>;
+		cam_vdig-supply = <&pm8998_lvs1>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <0 0 3312000>;
+		qcom,cam-vreg-max-voltage = <0 0 3600000>;
+		qcom,cam-vreg-op-mode = <0 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 9 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vana = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_VANA1";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,eeprom-src = <&eeprom2>;
+		qcom,led-flash-src = <&led_flash1>;
+		qcom,actuator-src = <&actuator1>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pm8998_l22>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-max-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active &led_enable>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend &led_disable>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 28 0>,
+			<&pm8998_gpios 9 0>,
+			<&tlmm 21 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-flash-en = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG",
+					"FLASH_EN";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@3 {
+		cell-index = <3>;
+		compatible = "qcom,camera";
+		reg = <0x03>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <270>;
+		qcom,led-flash-src = <&led_flash1>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pm8998_l22>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-max-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk3_active
+				 &cam_sensor_front_iris_active>;
+		pinctrl-1 = <&cam_sensor_mclk3_suspend
+				 &cam_sensor_front_iris_suspend>;
+		gpios = <&tlmm 16 0>,
+			<&tlmm 23 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-req-tbl-num = <0 1>;
+		qcom,gpio-req-tbl-flags = <1 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK3",
+					"CAM_RESET3";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		clocks = <&clock_mmss clk_mclk3_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk3_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
+&pm8998_gpios {
+	gpio@c800 { /* GPIO 9 - CAMERA SENSOR 2 VDIG */
+		qcom,mode = <1>;		/* Output */
+		qcom,pull = <5>;		/* No Pull */
+		qcom,vin-sel = <0>;		/* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "ok";
+	};
+
+	gpio@d300 { /* GPIO 20 - CAMERA SENSOR 0 VDIG */
+		qcom,mode = <1>;		/* Output */
+		qcom,pull = <5>;		/* No Pull */
+		qcom,vin-sel = <1>;		/* VIN1 GPIO_MV */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "ok";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-qrd-vr1.dtsi b/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-qrd-vr1.dtsi
new file mode 100644
index 000000000000..2af3bf277096
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-qrd-vr1.dtsi
@@ -0,0 +1,424 @@
+/*
+ * Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	led_flash0: qcom,camera-flash@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8998_flash0 &pmi8998_flash1>;
+		qcom,switch-source = <&pmi8998_switch0>;
+		status = "ok";
+	};
+
+	led_flash1: qcom,camera-flash@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8998_flash2>;
+		qcom,switch-source = <&pmi8998_switch1>;
+		status = "ok";
+	};
+};
+
+&tlmm{
+	cam_sensor_front_active: cam_sensor_front_active {
+		/* RESET */
+		mux {
+			pins = "gpio9";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio9";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_front_suspend: cam_sensor_front_suspend {
+		/* RESET */
+		mux {
+			pins = "gpio9";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio9";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_rear2_active: cam_sensor_rear2_active {
+		/* RESET, STANDBY */
+		mux {
+			pins = "gpio27","gpio8";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio27","gpio8";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_rear2_suspend: cam_sensor_rear2_suspend {
+		/* RESET, STANDBY */
+		mux {
+			pins = "gpio27","gpio8";
+			function = "gpio";
+		};
+		config {
+			pins = "gpio27","gpio8";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+};
+
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 3312000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 3600000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+						&cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+						&cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+				<&tlmm 30 0>,
+				<&pm8998_gpios 20 0>,
+				<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		cam_vdig-supply = <&pm8998_lvs1>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <0 0 3312000>;
+		qcom,cam-vreg-max-voltage = <0 0 3600000>;
+		qcom,cam-vreg-op-mode = <0 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+						&cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+						&cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 14 0>,
+				<&tlmm 27 0>,
+				<&tlmm 8 0>;
+		qcom,gpio-standby = <1>;
+		qcom,gpio-vana = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_STANDBY1",
+					  "CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom2: qcom,eeprom@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pm8998_l22>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 2864000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 2864000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+						&cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_active
+						&cam_sensor_front_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 9 0>,
+			<&pm8998_gpios 9 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,special-support-sensors = "imx362_gt24c64a";
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <270>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 3312000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 3600000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+						&cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+						&cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&pm8998_gpios 20 0>,
+			<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <90>;
+		qcom,eeprom-src = <&eeprom1>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <0 3312000>;
+		qcom,cam-vreg-max-voltage = <0 3600000>;
+		qcom,cam-vreg-op-mode = <0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+						&cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+						&cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 14 0>,
+				<&tlmm 27 0>,
+				<&tlmm 8 0>;
+		qcom,gpio-standby = <1>;
+		qcom,gpio-vana = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_STANDBY1",
+					  "CAM_VANA1";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,eeprom-src = <&eeprom2>;
+		qcom,led-flash-src = <&led_flash1>;
+		qcom,actuator-src = <&actuator1>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pm8998_l22>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 2864000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 2864000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+						&cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+						&cam_sensor_front_suspend>;
+		gpios = <&tlmm 15 0>,
+				<&tlmm 9 0>,
+				<&pm8998_gpios 9 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	/* ToF Camera*/
+	qcom,camera@3 {
+		cell-index = <3>;
+		compatible = "qcom,camera";
+		reg = <0x3>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <3>;
+		qcom,mount-angle = <90>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		qcom,cam-vreg-name = "cam_vio";
+		qcom,cam-vreg-min-voltage = <1800000>;
+		qcom,cam-vreg-max-voltage = <1800000>;
+		qcom,cam-vreg-op-mode = <80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk3_active
+			&cam_sensor_depth_v1_active
+			&cam_sensor_depth_v2_active
+			&cam_sensor_depth_default>;
+		pinctrl-1 = <&cam_sensor_mclk3_suspend
+			&cam_sensor_depth_v1_sleep
+			&cam_sensor_depth_v2_sleep
+			&cam_sensor_depth_sleep>;
+		gpios = <&tlmm 16 0>,
+			<&tlmm 24 0>,
+			<&tlmm 21 0>,
+			<&tlmm 28 0>,
+			<&tlmm 23 0>,
+			<&tlmm 7 0>;
+		qcom,gpio-vana = <1>;
+		qcom,gpio-custom2 = <2>;
+		qcom,gpio-reset = <3>;
+		qcom,gpio-custom3 = <4>;
+		qcom,gpio-custom1 = <5>;
+		qcom,gpio-req-tbl-num = <0 1 2 3 4 5>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0 1 1>;
+		qcom,gpio-req-tbl-label =
+			"CAMIF_MCLK3",
+			"CAM_VANA",
+			"CAM_CUSTOM2",
+			"CAM_RESET1",
+			"CAM_CUSTOM3",
+			"CAM_CUSTOM1";
+		qcom,sensor-position = <1>; /* 0 rear */
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>; /* I2C 1 */
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk3_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk3_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+};
+
+&pm8998_gpios {
+	gpio@c800 { /* GPIO 9 - CAMERA SENSOR 2 VDIG */
+		qcom,mode = <1>;		/* Output */
+		qcom,pull = <5>;		/* No Pull */
+		qcom,vin-sel = <0>;		/* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "ok";
+	};
+
+	gpio@d300 { /* GPIO 20 - CAMERA SENSOR 0 VDIG */
+		qcom,mode = <1>;		/* Output */
+		qcom,pull = <5>;		/* No Pull */
+		qcom,vin-sel = <1>;		/* VIN1 GPIO_MV */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "ok";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-qrd.dtsi b/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-qrd.dtsi
new file mode 100644
index 000000000000..8c51aa643382
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-qrd.dtsi
@@ -0,0 +1,356 @@
+
+/*
+ * Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	led_flash0: qcom,camera-flash@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8998_flash0 &pmi8998_flash1>;
+		qcom,torch-source = <&pmi8998_torch0 &pmi8998_torch1>;
+		qcom,switch-source = <&pmi8998_switch0>;
+		status = "ok";
+	};
+
+	led_flash1: qcom,camera-flash@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8998_flash2>;
+		qcom,torch-source = <&pmi8998_torch2>;
+		qcom,switch-source = <&pmi8998_switch1>;
+		status = "ok";
+	};
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+	};
+
+	ois0: qcom,ois@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,ois";
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+		status = "disabled";
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 3312000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 3312000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				&cam_sensor_rear_active
+				&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_sensor_rear_suspend
+				&cam_actuator_vaf_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&pm8998_gpios 20 0>,
+			<&tlmm 29 0>,
+			<&tlmm 27 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-vaf = <4>;
+		qcom,gpio-req-tbl-num = <0 1 2 3 4>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA",
+					"CAM_VAF";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		cam_vdig-supply = <&pm8998_lvs1>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <0 0 3312000>;
+		qcom,cam-vreg-max-voltage = <0 0 3312000>;
+		qcom,cam-vreg-op-mode = <0 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 9 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vana = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_VANA1";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom2: qcom,eeprom@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pm8998_l22>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-max-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 28 0>,
+			<&pm8998_gpios 9 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <270>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,ois-src = <&ois0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 3312000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 3312000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				 &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				 &cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&pm8998_gpios 20 0>,
+			<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <90>;
+		qcom,eeprom-src = <&eeprom1>;
+		cam_vdig-supply = <&pm8998_lvs1>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <0 0 3312000>;
+		qcom,cam-vreg-max-voltage = <0 0 3312000>;
+		qcom,cam-vreg-op-mode = <0 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 9 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vana = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_VANA1";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,eeprom-src = <&eeprom2>;
+		qcom,led-flash-src = <&led_flash1>;
+		qcom,actuator-src = <&actuator1>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pm8998_l22>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-max-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 28 0>,
+			<&pm8998_gpios 9 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
+&pm8998_gpios {
+	gpio@c800 { /* GPIO 9 - CAMERA SENSOR 2 VDIG */
+		qcom,mode = <1>;		/* Output */
+		qcom,pull = <5>;		/* No Pull */
+		qcom,vin-sel = <0>;		/* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "ok";
+	};
+
+	gpio@d300 { /* GPIO 20 - CAMERA SENSOR 0 VDIG */
+		qcom,mode = <1>;		/* Output */
+		qcom,pull = <5>;		/* No Pull */
+		qcom,vin-sel = <1>;		/* VIN1 GPIO_MV */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "ok";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-skuk-evt3.dtsi b/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-skuk-evt3.dtsi
new file mode 100644
index 000000000000..7e52b0258f1f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-skuk-evt3.dtsi
@@ -0,0 +1,454 @@
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	led_flash0: qcom,camera-flash@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8998_flash0 &pmi8998_flash1>;
+		qcom,torch-source = <&pmi8998_torch0 &pmi8998_torch1>;
+		qcom,switch-source = <&pmi8998_switch0>;
+		status = "ok";
+	};
+
+	led_flash1: qcom,camera-flash@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8998_flash2>;
+		qcom,torch-source = <&pmi8998_torch2>;
+		qcom,switch-source = <&pmi8998_switch1>;
+		status = "ok";
+	};
+
+	rear_vana_regulator:fixed_regulator@0 {
+		compatible = "regulator-fixed";
+		regulator-name = "rear_vana_regulator";
+		regulator-min-microvolt = <2800000>;
+		regulator-max-microvolt = <2800000>;
+		enable-active-high;
+		gpio = <&tlmm 27 0>;
+		vin-supply = <&pmi8998_bob>;
+	};
+
+	vaf1_gpio_supply:fixed_regulator@1 {
+		compatible = "regulator-fixed";
+		regulator-name = "vaf1_gpio_supply";
+		regulator-min-microvolt = <2800000>;
+		regulator-max-microvolt = <2800000>;
+		enable-active-high;
+		gpio = <&tlmm 29 0>;
+		vin-supply = <&pmi8998_bob>;
+	};
+
+	vaf2_gpio_supply:fixed_regulator@2 {
+		compatible = "regulator-fixed";
+		regulator-name = "vaf2_gpio_supply";
+		regulator-min-microvolt = <2800000>;
+		regulator-max-microvolt = <2800000>;
+		enable-active-high;
+		gpio = <&tlmm 27 0>;
+		vin-supply = <&pmi8998_bob>;
+	};
+};
+
+&tlmm{
+	cam_sensor_front_active: cam_sensor_front_active {
+		/* RESET */
+		mux {
+			pins = "gpio9";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio9";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_front_suspend: cam_sensor_front_suspend {
+		/* RESET */
+		mux {
+			pins = "gpio9";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio9";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_rear2_active: cam_sensor_rear2_active {
+		/* RESET, STANDBY */
+		mux {
+			pins = "gpio28";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio28";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_rear2_suspend: cam_sensor_rear2_suspend {
+		/* RESET, STANDBY */
+		mux {
+			pins = "gpio28";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio28";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_rear_active: cam_sensor_rear_active {
+		/* RESET, STANDBY */
+		mux {
+			pins = "gpio30";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio30";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_rear_suspend: cam_sensor_rear_suspend {
+		/* RESET, STANDBY */
+		mux {
+			pins = "gpio30";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio30";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&vaf1_gpio_supply>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <0>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&vaf2_gpio_supply>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <0>;
+	};
+
+	ois0: qcom,ois@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,ois";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&vaf2_gpio_supply>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <0>;
+		status = "disabled";
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&rear_vana_regulator>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 2800000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 2800000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				 &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				 &cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&pm8998_gpios 20 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&rear_vana_regulator>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 2800000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 2800000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+						&cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+						&cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 14 0>,
+				<&tlmm 28 0>,
+				<&pm8998_gpios 20 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_VDIG";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom2: qcom,eeprom@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pm8998_l22>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-max-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 9 0>,
+			<&pm8998_gpios 9 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,special-support-sensors = "imx362_gt24c64a",
+					"s5k3m3sm", "s5k2l7sx";
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <270>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&rear_vana_regulator>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 2800000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 2800000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				 &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				 &cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&pm8998_gpios 20 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <90>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator1>;
+		qcom,eeprom-src = <&eeprom1>;
+		qcom,ois-src = <&ois0>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&rear_vana_regulator>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 2800000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 2800000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+						&cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+						&cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 14 0>,
+				<&tlmm 28 0>,
+				<&pm8998_gpios 20 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_VDIG";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,eeprom-src = <&eeprom2>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pm8998_l22>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-max-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+						&cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+						&cam_sensor_front_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 9 0>,
+			<&pm8998_gpios 9 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
+
+&pm8998_gpios {
+	gpio@c800 { /* GPIO 9 - CAMERA SENSOR 2 VDIG */
+		qcom,mode = <1>;		/* Output */
+		qcom,pull = <5>;		/* No Pull */
+		qcom,vin-sel = <0>;		/* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "ok";
+	};
+
+	gpio@d300 { /* GPIO 20 - CAMERA SENSOR 0/1 VDIG */
+		qcom,mode = <1>;		/* Output */
+		qcom,pull = <5>;		/* No Pull */
+		qcom,vin-sel = <1>;		/* VIN1 GPIO_MV */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "ok";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-skuk-hdk.dtsi b/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-skuk-hdk.dtsi
new file mode 100644
index 000000000000..0c6985a46b81
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-skuk-hdk.dtsi
@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8998-camera-sensor-skuk-evt3.dtsi"
+
+&tlmm{
+	cam_sensor_mclk1_active: cam_sensor_mclk1_active {
+		/* MCLK1 */
+		mux {
+			/* CLK, DATA */
+			pins = "gpio14";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio14";
+			bias-disable; /* No PULL */
+			drive-strength = <8>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk2_active: cam_sensor_mclk2_active {
+		/* MCLK1 */
+		mux {
+			/* CLK, DATA */
+			pins = "gpio15";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio15";
+			bias-disable; /* No PULL */
+			drive-strength = <8>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_mclk0_active: cam_sensor_mclk0_active {
+		/* MCLK1 */
+		mux {
+			/* CLK, DATA */
+			pins = "gpio13";
+			function = "cam_mclk";
+		};
+
+		config {
+			pins = "gpio13";
+			bias-disable; /* No PULL */
+			drive-strength = <8>; /* 2 MA */
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-skuk.dtsi b/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-skuk.dtsi
new file mode 100644
index 000000000000..3e7b5614bc55
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-skuk.dtsi
@@ -0,0 +1,441 @@
+/*
+ * Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	led_flash0: qcom,camera-flash@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8998_flash0 &pmi8998_flash1>;
+		qcom,torch-source = <&pmi8998_torch0 &pmi8998_torch1>;
+		qcom,switch-source = <&pmi8998_switch0>;
+		status = "ok";
+	};
+
+	led_flash1: qcom,camera-flash@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8998_flash2>;
+		qcom,torch-source = <&pmi8998_torch2>;
+		qcom,switch-source = <&pmi8998_switch1>;
+		status = "ok";
+	};
+};
+
+&tlmm{
+	cam_sensor_front_active: cam_sensor_front_active {
+		/* RESET */
+		mux {
+			pins = "gpio9";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio9";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_front_suspend: cam_sensor_front_suspend {
+		/* RESET */
+		mux {
+			pins = "gpio9";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio9";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_rear2_active: cam_sensor_rear2_active {
+		/* RESET, STANDBY */
+		mux {
+			pins = "gpio28","gpio27";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio28","gpio27";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_rear2_suspend: cam_sensor_rear2_suspend {
+		/* RESET, STANDBY */
+		mux {
+			pins = "gpio28","gpio27";
+			function = "gpio";
+		};
+		config {
+			pins = "gpio28","gpio27";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_rear_active: cam_sensor_rear_active {
+		/* RESET, STANDBY */
+		mux {
+			pins = "gpio30","gpio29";
+			function = "gpio";
+		};
+		config {
+			pins = "gpio30","gpio29";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_rear_suspend: cam_sensor_rear_suspend {
+		/* RESET, STANDBY */
+		mux {
+			pins = "gpio30","gpio29";
+			function = "gpio";
+		};
+		config {
+			pins = "gpio30","gpio29";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 29 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+	};
+
+	ois0: qcom,ois@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,ois";
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+		status = "disabled";
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 3312000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 3600000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				 &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				 &cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&pm8998_gpios 20 0>,
+			<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 3312000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 3600000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+						&cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+						&cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 14 0>,
+				<&tlmm 28 0>,
+				<&pm8998_gpios 20 0>,
+				<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_VDIG",
+					  "CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom2: qcom,eeprom@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pm8998_l22>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-max-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 9 0>,
+			<&pm8998_gpios 9 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,special-support-sensors = "imx362_gt24c64a",
+					"s5k3m3sm", "s5k2l7sx";
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <270>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 3312000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 3600000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				 &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				 &cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&pm8998_gpios 20 0>,
+			<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <90>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator1>;
+		qcom,eeprom-src = <&eeprom1>;
+		qcom,ois-src = <&ois0>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 3312000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 3600000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+						&cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+						&cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 14 0>,
+				<&tlmm 28 0>,
+				<&pm8998_gpios 20 0>,
+				<&tlmm 29 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_VDIG",
+					  "CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,eeprom-src = <&eeprom2>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pm8998_l22>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-max-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+						&cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+						&cam_sensor_front_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 9 0>,
+			<&pm8998_gpios 9 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
+&pm8998_gpios {
+	gpio@c800 { /* GPIO 9 - CAMERA SENSOR 2 VDIG */
+		qcom,mode = <1>;		/* Output */
+		qcom,pull = <5>;		/* No Pull */
+		qcom,vin-sel = <0>;		/* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "ok";
+	};
+
+	gpio@d300 { /* GPIO 20 - CAMERA SENSOR 0 VDIG */
+		qcom,mode = <1>;		/* Output */
+		qcom,pull = <5>;		/* No Pull */
+		qcom,vin-sel = <1>;		/* VIN1 GPIO_MV */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "ok";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-svr20.dtsi b/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-svr20.dtsi
new file mode 100644
index 000000000000..9d408ee5f3a7
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-camera-sensor-svr20.dtsi
@@ -0,0 +1,399 @@
+/*
+ * Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	led_flash0: qcom,camera-flash@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8998_flash0 &pmi8998_flash1>;
+		qcom,torch-source = <&pmi8998_torch0 &pmi8998_torch1>;
+		qcom,switch-source = <&pmi8998_switch0>;
+		status = "ok";
+	};
+
+	led_flash1: qcom,camera-flash@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pmi8998_flash2>;
+		qcom,torch-source = <&pmi8998_torch2>;
+		qcom,switch-source = <&pmi8998_switch1>;
+		status = "ok";
+	};
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+	};
+
+	ois0: qcom,ois@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,ois";
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+		status = "disabled";
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <0 3312000 1352000>;
+		qcom,cam-vreg-max-voltage = <0 3600000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				&cam_sensor_rear_active
+				&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_sensor_rear_suspend
+				&cam_actuator_vaf_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&pm8998_gpios 20 0>,
+			<&tlmm 29 0>,
+			<&tlmm 27 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-vaf = <4>;
+		qcom,gpio-req-tbl-num = <0 1 2 3 4>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA",
+					"CAM_VAF";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		cam_vdig-supply = <&pm8998_lvs1>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <0 0 3312000>;
+		qcom,cam-vreg-max-voltage = <0 0 3600000>;
+		qcom,cam-vreg-op-mode = <0 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 9 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vana = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_VANA1";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom2: qcom,eeprom@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm8998_lvs1>;
+		/*cam_vana-supply = <&pm8998_l22>;*/
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-max-voltage =
+			<0 2864000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 28 0>,
+			<&pm8998_gpios 9 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <270>;
+		cam_vio-supply = <&pm8998_l8>;
+		cam_vana-supply = <&pmi8998_bob>;
+		cam_vdig-supply = <&pm8998_l9>;
+		cam_v_custom1-supply = <&pm8998_lvs1>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vana",
+					"cam_vio", "cam_v_custom1";
+		qcom,cam-vreg-min-voltage = <1808000 3312000 1200000 0>;
+		qcom,cam-vreg-max-voltage = <2960000 3600000 1200000 0>;
+		qcom,cam-vreg-op-mode = <0 80000 105000 0>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				 &cam_sensor_6dofl_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				 &cam_sensor_6dofl_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 148 0>,
+			<&tlmm 93 0>,
+			<&tlmm 52 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vana = <2>;
+		qcom,gpio-vdig = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VANA",
+					"CAM_VDIG";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <1>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <90>;
+		qcom,eeprom-src = <&eeprom1>;
+		qcom,actuator-src = <&actuator1>;
+		cam_vdig-supply = <&pm8998_lvs1>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vio", "cam_vana";
+		qcom,cam-vreg-min-voltage = <0 0 3312000>;
+		qcom,cam-vreg-max-voltage = <0 0 3600000>;
+		qcom,cam-vreg-op-mode = <0 0 80000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 9 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vana = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_VANA1";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,eeprom-src = <&eeprom2>;
+		qcom,led-flash-src = <&led_flash1>;
+		qcom,actuator-src = <&actuator1>;
+		cam_vio-supply = <&pm8998_lvs1>;
+		cam_vana-supply = <&pmi8998_bob>;
+		cam_vdig-supply = <&pm8998_s3>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage =
+			<0 3312000 1352000>;
+		qcom,cam-vreg-max-voltage =
+			<0 3600000 1352000>;
+		qcom,cam-vreg-op-mode = <0 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 28 0>,
+			<&pm8998_gpios 9 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "disabled";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+	qcom,camera@3 {
+		cell-index = <3>;
+		compatible = "qcom,camera";
+		reg = <0x3>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <270>;
+		cam_vio-supply = <&pm8998_l8>;
+		cam_vana-supply = <&pmi8998_bob>;
+		cam_vdig-supply = <&pm8998_l9>;
+		cam_v_custom1-supply = <&pm8998_lvs1>;
+		qcom,cam-vreg-name = "cam_vdig", "cam_vana",
+					"cam_vio", "cam_v_custom1";
+		qcom,cam-vreg-min-voltage = <1808000 3312000 1200000 0>;
+		qcom,cam-vreg-max-voltage = <2960000 3600000 1200000 0>;
+		qcom,cam-vreg-op-mode = <0 80000 105000 0>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				 &cam_sensor_6dofr_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				 &cam_sensor_6dofr_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 149 0>,
+			<&tlmm 93 0>,
+			<&tlmm 52 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vana = <2>;
+		qcom,gpio-vdig = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					  "CAM_RESET1",
+					  "CAM_VANA1",
+					  "CAM_VDIG1";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <1>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+};
+
+&pm8998_gpios {
+	gpio@c800 { /* GPIO 9 - CAMERA SENSOR 2 VDIG */
+		qcom,mode = <1>;		/* Output */
+		qcom,pull = <5>;		/* No Pull */
+		qcom,vin-sel = <0>;		/* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "ok";
+	};
+
+	gpio@d300 { /* GPIO 20 - CAMERA SENSOR 0 VDIG */
+		qcom,mode = <1>;		/* Output */
+		qcom,pull = <5>;		/* No Pull */
+		qcom,vin-sel = <1>;		/* VIN1 GPIO_MV */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "ok";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-camera.dtsi b/arch/arm64/boot/dts/qcom/msm8998-camera.dtsi
new file mode 100644
index 000000000000..f87444465a68
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-camera.dtsi
@@ -0,0 +1,909 @@
+/*
+ * Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	qcom,msm-cam@8c0000 {
+		compatible = "qcom,msm-cam";
+		reg = <0x8c0000 0x40000>;
+		reg-names = "msm-cam";
+		status = "ok";
+		bus-vectors = "suspend", "svs", "nominal", "turbo";
+		qcom,bus-votes = <0 300000000 640000000 640000000>;
+	};
+
+	qcom,csiphy@ca34000 {
+		cell-index = <0>;
+		compatible = "qcom,csiphy-v5.0", "qcom,csiphy";
+		reg = <0xca34000 0x1000>;
+		reg-names = "csiphy";
+		interrupts = <0 78 0>;
+		interrupt-names = "csiphy";
+		gdscr-supply = <&gdsc_camss_top>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "gdscr", "bimc_smmu";
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_csi0_clk_src>,
+			<&clock_mmss clk_mmss_camss_csi0_clk>,
+			<&clock_mmss clk_mmss_camss_cphy_csid0_clk>,
+			<&clock_mmss clk_csi0phytimer_clk_src>,
+			<&clock_mmss clk_mmss_camss_csi0phytimer_clk>,
+			<&clock_mmss clk_mmss_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csiphy_clk_src>,
+			<&clock_mmss clk_mmss_camss_csiphy0_clk>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"csi_src_clk", "csi_clk", "cphy_csid_clk",
+			"csiphy_timer_src_clk", "csiphy_timer_clk",
+			"camss_ispif_ahb_clk", "csiphy_clk_src", "csiphy_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 274290000 0 0 200000000 0
+			0 274290000 0>;
+		status = "ok";
+	};
+
+	qcom,csiphy@ca35000 {
+		cell-index = <1>;
+		compatible = "qcom,csiphy-v5.0", "qcom,csiphy";
+		reg = <0xca35000 0x1000>;
+		reg-names = "csiphy";
+		interrupts = <0 79 0>;
+		interrupt-names = "csiphy";
+		gdscr-supply = <&gdsc_camss_top>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "gdscr", "bimc_smmu";
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_csi1_clk_src>,
+			<&clock_mmss clk_mmss_camss_csi1_clk>,
+			<&clock_mmss clk_mmss_camss_cphy_csid1_clk>,
+			<&clock_mmss clk_csi1phytimer_clk_src>,
+			<&clock_mmss clk_mmss_camss_csi1phytimer_clk>,
+			<&clock_mmss clk_mmss_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csiphy_clk_src>,
+			<&clock_mmss clk_mmss_camss_csiphy1_clk>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"csi_src_clk", "csi_clk", "cphy_csid_clk",
+			"csiphy_timer_src_clk", "csiphy_timer_clk",
+			"camss_ispif_ahb_clk", "csiphy_clk_src", "csiphy_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 274290000 0 0 200000000 0
+			0 274290000 0>;
+		status = "ok";
+	};
+
+	qcom,csiphy@ca36000 {
+		cell-index = <2>;
+		compatible = "qcom,csiphy-v5.0", "qcom,csiphy";
+		reg = <0xca36000 0x1000>;
+		reg-names = "csiphy";
+		interrupts = <0 80 0>;
+		interrupt-names = "csiphy";
+		gdscr-supply = <&gdsc_camss_top>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "gdscr", "bimc_smmu";
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_csi2_clk_src>,
+			<&clock_mmss clk_mmss_camss_csi2_clk>,
+			<&clock_mmss clk_mmss_camss_cphy_csid2_clk>,
+			<&clock_mmss clk_csi2phytimer_clk_src>,
+			<&clock_mmss clk_mmss_camss_csi2phytimer_clk>,
+			<&clock_mmss clk_mmss_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csiphy_clk_src>,
+			<&clock_mmss clk_mmss_camss_csiphy2_clk>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"csi_src_clk", "csi_clk", "cphy_csid_clk",
+			"csiphy_timer_src_clk", "csiphy_timer_clk",
+			"camss_ispif_ahb_clk", "csiphy_clk_src", "csiphy_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 274290000 0 0 200000000 0
+			0 274290000 0>;
+		status = "ok";
+	};
+
+	qcom,csid@ca30000  {
+		cell-index = <0>;
+		compatible = "qcom,csid-v5.0", "qcom,csid";
+		reg = <0xca30000 0x400>;
+		reg-names = "csid";
+		interrupts = <0 296 0>;
+		interrupt-names = "csid";
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm8998_l2>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm8998_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csi0_clk_src>,
+			<&clock_mmss clk_csiphy_clk_src>,
+			<&clock_mmss clk_mmss_camss_csi0_clk>,
+			<&clock_mmss clk_mmss_camss_csi0_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_csi0rdi_clk>,
+			<&clock_mmss clk_mmss_camss_csi0pix_clk>,
+			<&clock_mmss clk_mmss_camss_cphy_csid0_clk>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csi_src_clk", "csiphy_clk_src",
+			"csi_clk", "csi_ahb_clk", "csi_rdi_clk",
+			"csi_pix_clk", "cphy_csid_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 0 274290000 274290000
+			0 0 0 0 0>;
+		status = "ok";
+	};
+
+	qcom,csid@ca30400 {
+		cell-index = <1>;
+		compatible = "qcom,csid-v5.0", "qcom,csid";
+		reg = <0xca30400 0x400>;
+		reg-names = "csid";
+		interrupts = <0 297 0>;
+		interrupt-names = "csid";
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm8998_l2>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm8998_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csi1_clk_src>,
+			<&clock_mmss clk_csiphy_clk_src>,
+			<&clock_mmss clk_mmss_camss_csi1_clk>,
+			<&clock_mmss clk_mmss_camss_csi1_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_csi1rdi_clk>,
+			<&clock_mmss clk_mmss_camss_csi1pix_clk>,
+			<&clock_mmss clk_mmss_camss_cphy_csid1_clk>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csi_src_clk", "csiphy_clk_src",
+			"csi_clk", "csi_ahb_clk", "csi_rdi_clk",
+			"csi_pix_clk", "cphy_csid_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 0 274290000 274290000
+			 0 0 0 0 0>;
+		status = "ok";
+	};
+
+	qcom,csid@ca30800 {
+		cell-index = <2>;
+		compatible = "qcom,csid-v5.0", "qcom,csid";
+		reg = <0xca30800 0x400>;
+		reg-names = "csid";
+		interrupts = <0 298 0>;
+		interrupt-names = "csid";
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm8998_l2>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm8998_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csi2_clk_src>,
+			<&clock_mmss clk_csiphy_clk_src>,
+			<&clock_mmss clk_mmss_camss_csi2_clk>,
+			<&clock_mmss clk_mmss_camss_csi2_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_csi2rdi_clk>,
+			<&clock_mmss clk_mmss_camss_csi2pix_clk>,
+			<&clock_mmss clk_mmss_camss_cphy_csid2_clk>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csi_src_clk", "csiphy_clk_src",
+			"csi_clk", "csi_ahb_clk", "csi_rdi_clk",
+			"csi_pix_clk", "cphy_csid_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 0 274290000 274290000
+			 0 0 0 0 0>;
+		status = "ok";
+	};
+
+	qcom,csid@ca30c00 {
+		cell-index = <3>;
+		compatible = "qcom,csid-v5.0", "qcom,csid";
+		reg = <0xca30c00 0x400>;
+		reg-names = "csid";
+		interrupts = <0 299 0>;
+		interrupt-names = "csid";
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm8998_l2>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm8998_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csi3_clk_src>,
+			<&clock_mmss clk_csiphy_clk_src>,
+			<&clock_mmss clk_mmss_camss_csi3_clk>,
+			<&clock_mmss clk_mmss_camss_csi3_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_csi3rdi_clk>,
+			<&clock_mmss clk_mmss_camss_csi3pix_clk>,
+			<&clock_mmss clk_mmss_camss_cphy_csid3_clk>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csi_src_clk", "csiphy_clk_src",
+			"csi_clk", "csi_ahb_clk", "csi_rdi_clk",
+			"csi_pix_clk", "cphy_csid_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 0 274290000 274290000
+			 0 0 0 0 0>;
+		status = "ok";
+	};
+
+	qcom,cam_smmu {
+		compatible = "qcom,msm-cam-smmu";
+		status = "ok";
+
+		msm_cam_smmu_cb1 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&mmss_smmu 0xc00>,
+					<&mmss_smmu 0xc01>,
+					<&mmss_smmu 0xc02>,
+					<&mmss_smmu 0xc03>;
+			label = "vfe";
+			qcom,scratch-buf-support;
+		};
+
+		msm_cam_smmu_cb2 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&mmss_smmu 0xa00>;
+			label = "cpp";
+		};
+
+		msm_cam_smmu_cb3 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&mmss_smmu 0xa01>;
+			label = "camera_fd";
+		};
+
+		msm_cam_smmu_cb4 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&mmss_smmu 0x800>;
+			label = "jpeg_enc0";
+		};
+
+		msm_cam_smmu_cb5 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&mmss_smmu 0x801>;
+			label = "jpeg_dma";
+		};
+	};
+
+	qcom,fd@caa4000 {
+		cell-index = <0>;
+		compatible = "qcom,face-detection";
+		reg = <0xcaa4000 0x800>,
+			<0xcaa5000 0x400>,
+			<0xca80000 0x3000>;
+		reg-names = "fd_core", "fd_misc", "fd_vbif";
+		interrupts = <0 293 0>;
+		interrupt-names = "fd";
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		vdd-supply = <&gdsc_cpp>;
+		qcom,vdd-names = "smmu-vdd", "camss-vdd", "vdd";
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_mmss_fd_core_clk>,
+			<&clock_mmss clk_mmss_fd_core_uar_clk>,
+			<&clock_mmss clk_mmss_fd_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_cpp_axi_clk>,
+			<&clock_mmss clk_mmss_camss_cpp_vbif_ahb_clk>;
+		clock-names = "mmssnoc_axi",
+			"mmss_mnoc_ahb_clk",
+			"mmss_bimc_smmu_ahb_clk",
+			"mmss_bimc_smmu_axi_clk",
+			"mmss_camss_ahb_clk",
+			"mmss_camss_top_ahb_clk",
+			"mmss_fd_core_clk",
+			"mmss_fd_core_uar_clk",
+			"mmss_fd_ahb_clk",
+			"mmss_camss_cpp_axi_clk",
+			"mmss_camss_cpp_vbif_ahb_clk";
+		qcom,clock-rates =
+			<0 0 0 0 0 0 404000000 0 0 0 0>,
+			<0 0 0 0 0 0 100000000 0 0 0 0>,
+			<0 0 0 0 0 0 404000000 0 0 0 0>,
+			<0 0 0 0 0 0 404000000 0 0 0 0>;
+		qcom,msm-bus,name = "msm_camera_fd";
+		qcom,msm-bus,num-cases = <4>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps = <106 512 0 0>,
+			<106 512 1625 0>,
+			<106 512 2995 0>,
+			<106 512 7200 0>;
+		qcom,fd-vbif-reg-settings = <0x20 0x10000000 0x30000000>,
+			<0x24 0x10000000 0x30000000>,
+			<0x28 0x10000000 0x30000000>,
+			<0x2c 0x10000000 0x30000000>;
+		qcom,fd-misc-reg-settings = <0x20 0x2 0x3>,
+			<0x24 0x2 0x3>;
+		status = "ok";
+	};
+
+	qcom,cpp@ca04000 {
+		cell-index = <0>;
+		compatible = "qcom,cpp";
+		reg = <0xca04000 0x100>,
+			<0xca80000 0x3000>,
+			<0xca18000 0x3000>,
+			<0xc8c36D4 0x4>;
+		reg-names = "cpp", "cpp_vbif", "cpp_hw", "camss_cpp";
+		interrupts = <0 294 0>;
+		interrupt-names = "cpp";
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		vdd-supply = <&gdsc_cpp>;
+		qcom,vdd-names = "smmu-vdd", "camss-vdd", "vdd";
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_cpp_clk_src>,
+			<&clock_mmss clk_mmss_camss_cpp_clk>,
+			<&clock_mmss clk_mmss_camss_cpp_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_cpp_axi_clk>,
+			<&clock_mmss clk_mmss_camss_micro_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_camss_cpp_vbif_ahb_clk>;
+		clock-names = "mmssnoc_axi_clk",
+			"mnoc_ahb_clk",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"cpp_src_clk",
+			"cpp_core_clk", "camss_cpp_ahb_clk",
+			"camss_cpp_axi_clk", "micro_iface_clk",
+			"mmss_smmu_axi_clk", "cpp_vbif_ahb_clk";
+		qcom,clock-rates = <0 0 0 0 200000000 200000000 0 0 0 0 0>;
+		qcom,min-clock-rate = <200000000>;
+		qcom,bus-master = <1>;
+		qcom,vbif-qos-setting = <0x550 0x33333333>,
+			<0x554 0x03333333>,
+			<0x558 0x33333333>,
+			<0x55c 0x03333333>,
+			<0x560 0x33333333>,
+			<0x564 0x03333333>,
+			<0x568 0x33333333>,
+			<0x56c 0x03333333>,
+			<0x570 0x33333333>,
+			<0x574 0x03333333>,
+			<0x578 0x33333333>,
+			<0x57c 0x03333333>,
+			<0x580 0x33333333>,
+			<0x584 0x03333333>,
+			<0x588 0x33333333>,
+			<0x58c 0x03333333>;
+		status = "ok";
+		qcom,msm-bus,name = "msm_camera_cpp";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<106 512 0 0>,
+			<106 512 0 0>;
+		qcom,msm-bus-vector-dyn-vote;
+		resets = <&clock_mmss CAMSS_MICRO_BCR>;
+		reset-names = "micro_iface_reset";
+		qcom,src-clock-rates = <100000000 200000000 576000000
+			600000000>;
+		qcom,micro-reset;
+		qcom,cpp-fw-payload-info {
+			qcom,stripe-base = <790>;
+			qcom,plane-base = <715>;
+			qcom,stripe-size = <63>;
+			qcom,plane-size = <25>;
+			qcom,fe-ptr-off = <11>;
+			qcom,we-ptr-off = <23>;
+			qcom,ref-fe-ptr-off = <17>;
+			qcom,ref-we-ptr-off = <36>;
+			qcom,we-meta-ptr-off = <42>;
+			qcom,fe-mmu-pf-ptr-off = <7>;
+			qcom,ref-fe-mmu-pf-ptr-off = <10>;
+			qcom,we-mmu-pf-ptr-off = <13>;
+			qcom,dup-we-mmu-pf-ptr-off = <18>;
+			qcom,ref-we-mmu-pf-ptr-off = <23>;
+			qcom,set-group-buffer-len = <135>;
+			qcom,dup-frame-indicator-off = <70>;
+		};
+	};
+
+	qcom,ispif@ca31000 {
+		cell-index = <0>;
+		compatible = "qcom,ispif-v3.0", "qcom,ispif";
+		reg = <0xca31000 0xc00>,
+			<0xca00020 0x4>;
+		reg-names = "ispif", "csi_clk_mux";
+		interrupts = <0 309 0>;
+		interrupt-names = "ispif";
+		qcom,num-isps = <0x2>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		vfe0-vdd-supply = <&gdsc_vfe0>;
+		vfe1-vdd-supply = <&gdsc_vfe1>;
+		qcom,vdd-names = "camss-vdd", "vfe0-vdd",
+				"vfe1-vdd";
+		qcom,clock-cntl-support;
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csi0_clk_src>,
+			<&clock_mmss clk_csi1_clk_src>,
+			<&clock_mmss clk_csi2_clk_src>,
+			<&clock_mmss clk_csi3_clk_src>,
+			<&clock_mmss clk_mmss_camss_csi0rdi_clk>,
+			<&clock_mmss clk_mmss_camss_csi1rdi_clk>,
+			<&clock_mmss clk_mmss_camss_csi2rdi_clk>,
+			<&clock_mmss clk_mmss_camss_csi3rdi_clk>,
+			<&clock_mmss clk_mmss_camss_csi0pix_clk>,
+			<&clock_mmss clk_mmss_camss_csi1pix_clk>,
+			<&clock_mmss clk_mmss_camss_csi2pix_clk>,
+			<&clock_mmss clk_mmss_camss_csi3pix_clk>,
+			<&clock_mmss clk_mmss_camss_csi0_clk>,
+			<&clock_mmss clk_mmss_camss_csi1_clk>,
+			<&clock_mmss clk_mmss_camss_csi2_clk>,
+			<&clock_mmss clk_mmss_camss_csi3_clk>,
+			<&clock_mmss clk_vfe0_clk_src>,
+			<&clock_mmss clk_mmss_camss_vfe0_clk>,
+			<&clock_mmss clk_mmss_camss_csi_vfe0_clk>,
+			<&clock_mmss clk_vfe1_clk_src>,
+			<&clock_mmss clk_mmss_camss_vfe1_clk>,
+			<&clock_mmss clk_mmss_camss_csi_vfe1_clk>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb_clk",
+			"camss_ahb_clk",
+			"camss_top_ahb_clk", "ispif_ahb_clk",
+			"csi0_src_clk", "csi1_src_clk",
+			"csi2_src_clk", "csi3_src_clk",
+			"csi0_rdi_clk", "csi1_rdi_clk",
+			"csi2_rdi_clk", "csi3_rdi_clk",
+			"csi0_pix_clk", "csi1_pix_clk",
+			"csi2_pix_clk", "csi3_pix_clk",
+			"camss_csi0_clk", "camss_csi1_clk",
+			"camss_csi2_clk", "camss_csi3_clk",
+			"vfe0_clk_src",
+			"camss_vfe_vfe0_clk",
+			"camss_csi_vfe0_clk",
+			"vfe1_clk_src",
+			"camss_vfe_vfe1_clk",
+			"camss_csi_vfe1_clk";
+		qcom,clock-rates = <0 0 0 0 0
+			0 0 0 0
+			0 0 0 0
+			0 0 0 0
+			0 0 0 0
+			0 0 0
+			0 0 0>;
+		qcom,clock-control = "INIT_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE",
+			"INIT_RATE", "INIT_RATE",
+			"INIT_RATE", "INIT_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"INIT_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"INIT_RATE",
+			"NO_SET_RATE", "NO_SET_RATE";
+		status = "ok";
+	};
+
+	vfe0: qcom,vfe0@ca10000 {
+		cell-index = <0>;
+		compatible = "qcom,vfe48";
+		reg = <0xca10000 0x4000>,
+			<0xca40000 0x3000>;
+		reg-names = "vfe", "vfe_vbif";
+		interrupts = <0 314 0>;
+		interrupt-names = "vfe";
+		vdd-supply = <&gdsc_vfe0>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		qcom,vdd-names = "vdd", "camss-vdd", "smmu-vdd";
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_vfe0_clk_src>,
+			<&clock_mmss clk_mmss_camss_vfe0_clk>,
+			<&clock_mmss clk_mmss_camss_vfe0_stream_clk>,
+			<&clock_mmss clk_mmss_camss_vfe0_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_vfe_vbif_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_vfe_vbif_axi_clk>,
+			<&clock_mmss clk_mmss_camss_csi_vfe0_clk>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb_clk",
+			"bimc_smmu_ahb_clk", "bimc_smmu_axi_clk",
+			"camss_ahb_clk", "camss_top_ahb_clk", "vfe_clk_src",
+			"camss_vfe_clk", "camss_vfe_stream_clk",
+			"camss_vfe_ahb_clk", "camss_vfe_vbif_ahb_clk",
+			"camss_vfe_vbif_axi_clk",
+			"camss_csi_vfe_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 480000000 0 0 0 0 0 0
+					0 0 0 0 0 0 576000000 0 0 0 0 0 0
+					0 0 0 0 0 0 600000000 0 0 0 0 0 0>;
+		status = "ok";
+		qos-entries = <8>;
+		qos-regs = <0x404 0x408 0x40c 0x410 0x414 0x418
+			0x41c 0x420>;
+		qos-settings = <0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9>;
+		vbif-entries = <1>;
+		vbif-regs = <0x124>;
+		vbif-settings = <0x3>;
+		ds-entries = <17>;
+		ds-regs = <0x424 0x428 0x42c 0x430 0x434
+			0x438 0x43c 0x440 0x444 0x448 0x44c
+			0x450 0x454 0x458 0x45c 0x460 0x464>;
+		ds-settings = <0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0x40000103>;
+		qcom,msm-bus,name = "msm_camera_vfe";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<29 512 0 0>,
+			<29 512 100000000 100000000>;
+		qcom,msm-bus-vector-dyn-vote;
+	};
+
+	vfe1: qcom,vfe1@ca14000 {
+		cell-index = <1>;
+		compatible = "qcom,vfe48";
+		reg = <0xca14000 0x4000>,
+			<0xca40000 0x3000>;
+		reg-names = "vfe", "vfe_vbif";
+		interrupts = <0 315 0>;
+		interrupt-names = "vfe";
+		vdd-supply = <&gdsc_vfe1>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		qcom,vdd-names = "vdd", "camss-vdd", "smmu-vdd";
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_vfe1_clk_src>,
+			<&clock_mmss clk_mmss_camss_vfe1_clk>,
+			<&clock_mmss clk_mmss_camss_vfe1_stream_clk>,
+			<&clock_mmss clk_mmss_camss_vfe1_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_vfe_vbif_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_vfe_vbif_axi_clk>,
+			<&clock_mmss clk_mmss_camss_csi_vfe1_clk>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb_clk",
+			"bimc_smmu_ahb_clk", "bimc_smmu_axi_clk",
+			"camss_ahb_clk", "camss_top_ahb_clk", "vfe_clk_src",
+			"camss_vfe_clk", "camss_vfe_stream_clk",
+			"camss_vfe_ahb_clk", "camss_vfe_vbif_ahb_clk",
+			"camss_vfe_vbif_axi_clk",
+			"camss_csi_vfe_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 480000000 0 0 0 0 0 0
+					0 0 0 0 0 0 576000000 0 0 0 0 0 0
+					0 0 0 0 0 0 600000000 0 0 0 0 0 0>;
+		status = "ok";
+		qos-entries = <8>;
+		qos-regs = <0x404 0x408 0x40c 0x410 0x414 0x418
+			0x41c 0x420>;
+		qos-settings = <0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9
+			0xaaa9aaa9>;
+		vbif-entries = <1>;
+		vbif-regs = <0x124>;
+		vbif-settings = <0x3>;
+		ds-entries = <17>;
+		ds-regs = <0x424 0x428 0x42c 0x430 0x434
+			0x438 0x43c 0x440 0x444 0x448 0x44c
+			0x450 0x454 0x458 0x45c 0x460 0x464>;
+		ds-settings = <0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0xcccc0011
+			0x40000103>;
+		qcom,msm-bus,name = "msm_camera_vfe";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<29 512 0 0>,
+			<29 512 100000000 100000000>;
+		qcom,msm-bus-vector-dyn-vote;
+	};
+
+	qcom,vfe {
+		compatible = "qcom,vfe";
+		num_child = <2>;
+	};
+
+	cci: qcom,cci@ca0c000 {
+		cell-index = <0>;
+		compatible = "qcom,cci";
+		reg = <0xca0c000 0x4000>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "cci";
+		interrupts = <0 295 0>;
+		interrupt-names = "cci";
+		status = "ok";
+		mmagic-supply = <&gdsc_bimc_smmu>;
+		gdscr-supply = <&gdsc_camss_top>;
+		qcom,cam-vreg-name = "mmagic", "gdscr";
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_cci_clk_src>,
+			<&clock_mmss clk_mmss_camss_cci_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_cci_clk>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb", "smmu_ahb", "smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"cci_src_clk", "cci_ahb_clk", "camss_cci_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 19200000 0 0>,
+			<0 0 0 0 0 0 37500000 0 0>;
+		pinctrl-names = "cci_default", "cci_suspend";
+			pinctrl-0 = <&cci0_active &cci1_active>;
+			pinctrl-1 = <&cci0_suspend &cci1_suspend>;
+		gpios = <&tlmm 17 0>,
+			<&tlmm 18 0>,
+			<&tlmm 19 0>,
+			<&tlmm 20 0>;
+		qcom,gpio-tbl-num = <0 1 2 3>;
+		qcom,gpio-tbl-flags = <1 1 1 1>;
+		qcom,gpio-tbl-label = "CCI_I2C_DATA0",
+				      "CCI_I2C_CLK0",
+				      "CCI_I2C_DATA1",
+				      "CCI_I2C_CLK1";
+		i2c_freq_100Khz: qcom,i2c_standard_mode {
+			status = "disabled";
+		};
+		i2c_freq_400Khz: qcom,i2c_fast_mode {
+			status = "disabled";
+		};
+		i2c_freq_custom: qcom,i2c_custom_mode {
+			status = "disabled";
+		};
+		i2c_freq_1Mhz: qcom,i2c_fast_plus_mode {
+			status = "disabled";
+		};
+	};
+
+	qcom,jpeg@ca1c000 {
+		cell-index = <0>;
+		compatible = "qcom,jpeg";
+		reg = <0xca1c000 0x4000>,
+			<0xca60000 0x3000>;
+		reg-names = "jpeg_hw", "jpeg_vbif";
+		interrupts = <0 316 0>;
+		interrupt-names = "jpeg";
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		qcom,vdd-names = "smmu-vdd", "camss-vdd";
+		clock-names = "mmssnoc_axi",
+			"mmss_mnoc_ahb_clk",
+			"mmss_bimc_smmu_ahb_clk",
+			"mmss_bimc_smmu_axi_clk",
+			"mmss_camss_ahb_clk",
+			"mmss_camss_top_ahb_clk",
+			"core_clk",
+			"mmss_camss_jpeg_ahb_clk",
+			"mmss_camss_jpeg_axi_clk";
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_jpeg0_vote_clk>,
+			<&clock_mmss clk_mmss_camss_jpeg_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_jpeg_axi_clk>;
+		qcom,clock-rates = <0 0 0 0 0 0 480000000 0 0>;
+		qcom,vbif-reg-settings = <0x4 0x1>;
+		qcom,prefetch-reg-settings = <0x30c 0x1111>,
+			<0x318 0x31>,
+			<0x324 0x31>,
+			<0x330 0x31>,
+			<0x33c 0x0>;
+		qcom,msm-bus,name = "msm_camera_jpeg0";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps = <62 512 0 0>,
+			<62 512 1920000 2880000>;
+		status = "ok";
+	};
+
+	qcom,jpeg@caa0000 {
+		cell-index = <3>;
+		compatible = "qcom,jpegdma";
+		reg = <0xcaa0000 0x4000>,
+			<0xca60000 0x3000>;
+		reg-names = "jpeg_hw", "jpeg_vbif";
+		interrupts = <0 304 0>;
+		interrupt-names = "jpeg";
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		qcom,vdd-names = "smmu-vdd", "camss-vdd";
+		clock-names = "mmssnoc_axi",
+			"mmss_mnoc_ahb_clk",
+			"mmss_bimc_smmu_ahb_clk",
+			"mmss_bimc_smmu_axi_clk",
+			"mmss_camss_ahb_clk",
+			"mmss_camss_top_ahb_clk",
+			"core_clk",
+			"mmss_camss_jpeg_ahb_clk",
+			"mmss_camss_jpeg_axi_clk";
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_jpeg0_dma_vote_clk>,
+			<&clock_mmss clk_mmss_camss_jpeg_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_jpeg_axi_clk>;
+		qcom,clock-rates = <0 0 0 0 0 0 480000000 0 0>;
+		qcom,vbif-reg-settings = <0x4 0x1>;
+		qcom,prefetch-reg-settings = <0x18c 0x11>,
+			<0x1a0 0x31>,
+			<0x1b0 0x31>;
+		qcom,msm-bus,name = "msm_camera_jpeg_dma";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps = <62 512 0 0>,
+			<62 512 1920000 2880000>;
+		qcom,max-ds-factor = <128>;
+		status = "ok";
+	};
+};
+
+&i2c_freq_100Khz {
+	qcom,hw-thigh = <201>;
+	qcom,hw-tlow = <174>;
+	qcom,hw-tsu-sto = <204>;
+	qcom,hw-tsu-sta = <231>;
+	qcom,hw-thd-dat = <22>;
+	qcom,hw-thd-sta = <162>;
+	qcom,hw-tbuf = <227>;
+	qcom,hw-scl-stretch-en = <0>;
+	qcom,hw-trdhld = <6>;
+	qcom,hw-tsp = <3>;
+	qcom,cci-clk-src = <37500000>;
+	status = "ok";
+};
+
+&i2c_freq_400Khz {
+	qcom,hw-thigh = <38>;
+	qcom,hw-tlow = <56>;
+	qcom,hw-tsu-sto = <40>;
+	qcom,hw-tsu-sta = <40>;
+	qcom,hw-thd-dat = <22>;
+	qcom,hw-thd-sta = <35>;
+	qcom,hw-tbuf = <62>;
+	qcom,hw-scl-stretch-en = <0>;
+	qcom,hw-trdhld = <6>;
+	qcom,hw-tsp = <3>;
+	qcom,cci-clk-src = <37500000>;
+	status = "ok";
+};
+
+&i2c_freq_custom {
+	qcom,hw-thigh = <38>;
+	qcom,hw-tlow = <56>;
+	qcom,hw-tsu-sto = <40>;
+	qcom,hw-tsu-sta = <40>;
+	qcom,hw-thd-dat = <22>;
+	qcom,hw-thd-sta = <35>;
+	qcom,hw-tbuf = <62>;
+	qcom,hw-scl-stretch-en = <1>;
+	qcom,hw-trdhld = <6>;
+	qcom,hw-tsp = <3>;
+	qcom,cci-clk-src = <37500000>;
+	status = "ok";
+};
+
+&i2c_freq_1Mhz {
+	qcom,hw-thigh = <16>;
+	qcom,hw-tlow = <22>;
+	qcom,hw-tsu-sto = <17>;
+	qcom,hw-tsu-sta = <18>;
+	qcom,hw-thd-dat = <16>;
+	qcom,hw-thd-sta = <15>;
+	qcom,hw-tbuf = <24>;
+	qcom,hw-scl-stretch-en = <0>;
+	qcom,hw-trdhld = <3>;
+	qcom,hw-tsp = <3>;
+	qcom,cci-clk-src = <37500000>;
+	status = "ok";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-cdp-overlay.dts b/arch/arm64/boot/dts/qcom/msm8998-cdp-overlay.dts
new file mode 100644
index 000000000000..9cf94012695e
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-cdp-overlay.dts
@@ -0,0 +1,29 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/msm-clocks-8998.h>
+#include <dt-bindings/regulator/qcom,rpm-smd-regulator.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v1 CDP";
+	compatible = "qcom,msm8998-cdp", "qcom,msm8998", "qcom,cdp";
+	qcom,msm-id = <292 0x0>;
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-cdp.dts b/arch/arm64/boot/dts/qcom/msm8998-cdp.dts
new file mode 100644
index 000000000000..3d8ccbd39c95
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-cdp.dts
@@ -0,0 +1,39 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8998.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v1 CDP";
+	compatible = "qcom,msm8998-cdp", "qcom,msm8998", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
+
+&qusb_phy0 {
+	qcom,qusb-phy-host-init-seq =
+			/* value reg_offsets> */
+				<0x63 0x210
+				0x13 0x04
+				0x7c 0x18c
+				0x80 0x2c
+				0x0a 0x184
+				0x8c 0x21c
+				0x05 0x23c
+				0x03 0x240
+				0xff 0x218
+				0x62 0x210>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-cdp.dtsi b/arch/arm64/boot/dts/qcom/msm8998-cdp.dtsi
new file mode 100644
index 000000000000..0859fd638a00
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-cdp.dtsi
@@ -0,0 +1,577 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8998-camera-sensor-cdp.dtsi"
+&vendor {
+	bluetooth: bt_wcn3990 {
+		compatible = "qca,wcn3990";
+		qca,bt-vdd-io-supply = <&pm8998_s3>;
+		qca,bt-vdd-xtal-supply = <&pm8998_s5>;
+		qca,bt-vdd-core-supply = <&pm8998_l7>;
+		qca,bt-vdd-pa-supply = <&pm8998_l17>;
+		qca,bt-vdd-ldo-supply = <&pm8998_l25>;
+		qca,bt-chip-pwd-supply = <&pmi8998_bob_pin1>;
+		clocks = <&clock_gcc clk_rf_clk2_pin>;
+		clock-names = "rf_clk2";
+
+		qca,bt-vdd-io-voltage-level = <1352000 1352000>;
+		qca,bt-vdd-xtal-voltage-level = <2040000 2040000>;
+		qca,bt-vdd-core-voltage-level = <1800000 1800000>;
+		qca,bt-vdd-pa-voltage-level = <1304000 1304000>;
+		qca,bt-vdd-ldo-voltage-level = <3312000 3312000>;
+		qca,bt-chip-pwd-voltage-level = <3600000 3600000>;
+
+		qca,bt-vdd-io-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-xtal-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-core-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-pa-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-ldo-current-level = <1>; /* LPM/PFM */
+	};
+};
+
+&blsp1_uart3_hs {
+	status = "ok";
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm8998_l1>;
+	vdda-pll-supply = <&pm8998_l2>;
+	vddp-ref-clk-supply = <&pm8998_l26>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14600>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm8998_l20>;
+	vccq-supply = <&pm8998_l26>;
+	vccq2-supply = <&pm8998_s4>;
+	vcc-max-microamp = <750000>;
+	vccq-max-microamp = <560000>;
+	vccq2-max-microamp = <750000>;
+	status = "ok";
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8998_l21>;
+	qcom,vdd-voltage-level = <2950000 2960000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8998_l13>;
+	qcom,vdd-io-voltage-level = <1808000 2960000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000
+				50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x1>;
+
+	status = "ok";
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&pm8998_gpios {
+	/* GPIO 5 for Home Key */
+	gpio@c400 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 6 for Vol+ Key */
+	gpio@c500 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 7 for Snapshot Key */
+	gpio@c600 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 8 for Focus Key */
+	gpio@c700 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	gpio@cc00 { /* GPIO 13 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <0>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <3>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@d200 { /* GPIO 19 - wil6210 refclk3_en */
+		qcom,mode = <0>;		/* Input */
+		qcom,pull = <5>;		/* No Pull */
+		qcom,vin-sel = <1>;		/* VIN1 GPIO_MV */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	/* GPIO 21 (NFC_CLK_REQ) */
+	gpio@d400 {
+		qcom,mode = <0>;
+		qcom,vin-sel = <1>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&i2c_5 {
+	status = "okay";
+	synaptics@20 {
+		compatible = "synaptics,dsx";
+		reg = <0x20>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <125 0x2008>;
+		vdd-supply = <&pm8998_l6>;
+		avdd-supply = <&pm8998_l28>;
+		synaptics,vdd-voltage = <1808000 1808000>;
+		synaptics,avdd-voltage = <3008000 3008000>;
+		synaptics,vdd-current = <40000>;
+		synaptics,avdd-current = <20000>;
+		pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+		pinctrl-0 = <&ts_active>;
+		pinctrl-1 = <&ts_int_suspend &ts_reset_suspend>;
+		synaptics,display-coords = <0 0 1439 2559>;
+		synaptics,panel-coords = <0 0 1439 2559>;
+		synaptics,reset-gpio = <&tlmm 89 0x00>;
+		synaptics,irq-gpio = <&tlmm 125 0x2008>;
+		synaptics,disable-gpios;
+		synaptics,fw-name = "PR1702898-s3528t_60QHD_00400001.img";
+	};
+};
+
+&i2c_6 { /* BLSP1 QUP6 (NFC) */
+	status = "okay";
+	nq@28 {
+		compatible = "qcom,nq-nci";
+		reg = <0x28>;
+		qcom,nq-irq = <&tlmm 92 0x00>;
+		qcom,nq-ven = <&tlmm 12 0x00>;
+		qcom,nq-firm = <&tlmm 93 0x00>;
+		qcom,nq-clkreq = <&pm8998_gpios 21 0x00>;
+		qcom,nq-esepwr = <&tlmm 116 0x00>;
+		interrupt-parent = <&tlmm>;
+		qcom,clk-src = "BBCLK3";
+		interrupts = <92 0>;
+		interrupt-names = "nfc_irq";
+		pinctrl-names = "nfc_active", "nfc_suspend";
+		pinctrl-0 = <&nfc_int_active &nfc_enable_active>;
+		pinctrl-1 = <&nfc_int_suspend &nfc_enable_suspend>;
+		clocks = <&clock_gcc clk_ln_bb_clk3_pin>;
+		clock-names = "ref_clk";
+	};
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,panel-mode-gpio = <&tlmm 91 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,panel-mode-gpio = <&tlmm 91 0>;
+};
+
+&labibb {
+	status = "ok";
+	qcom,qpnp-labibb-mode = "lcd";
+};
+
+&pmi8998_wled {
+	qcom,led-strings-list = [00 01];
+};
+
+&dsi_dual_nt35597_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled = "single_roi";
+	qcom,panel-roi-alignment = <720 256 720 256 1440 256>;
+};
+
+&dsi_dual_nt35597_truly_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_truly_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35597_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "single_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35597_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "single_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_4k_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_4k_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_jdi_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,5v-boost-gpio = <&tlmm 51 0>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_jdi_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,5v-boost-gpio = <&tlmm 51 0>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled = "single_roi";
+	qcom,panel-roi-alignment = <4 2 4 2 20 20>;
+};
+
+&dsi_sharp_1080_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_jdi_1080p_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_no_labibb>;
+	qcom,5v-boost-gpio = <&tlmm 51 0>;
+};
+
+&dsi_dual_sharp_1080_120hz_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sim_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sim_vid {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_sim_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_sim_vid {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&mdss_hdmi_tx {
+	pinctrl-names = "hdmi_hpd_active", "hdmi_ddc_active", "hdmi_cec_active",
+				"hdmi_active", "hdmi_sleep";
+	pinctrl-0 = <&mdss_hdmi_5v_active  &mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_suspend &mdss_hdmi_cec_suspend>;
+	pinctrl-1 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_active &mdss_hdmi_cec_suspend>;
+	pinctrl-2 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+			&mdss_hdmi_cec_active &mdss_hdmi_ddc_suspend>;
+	pinctrl-3 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_active &mdss_hdmi_cec_active>;
+	pinctrl-4 = <&mdss_hdmi_5v_suspend &mdss_hdmi_hpd_suspend
+			&mdss_hdmi_ddc_suspend &mdss_hdmi_cec_suspend>;
+};
+
+&mdss_dp_ctrl {
+	pinctrl-names = "mdss_dp_active", "mdss_dp_sleep";
+	pinctrl-0 = <&mdss_dp_aux_active &mdss_dp_usbplug_cc_active>;
+	pinctrl-1 = <&mdss_dp_aux_suspend &mdss_dp_usbplug_cc_suspend>;
+	qcom,aux-en-gpio = <&tlmm 77 0>;
+	qcom,aux-sel-gpio = <&tlmm 78 0>;
+	qcom,usbplug-cc-gpio = <&tlmm 38 0>;
+};
+
+&pmi8998_charger {
+	qcom,batteryless-platform;
+};
+
+&pmi8998_haptics {
+	status = "okay";
+};
+
+&pm8998_vadc {
+	chan@83 {
+		label = "vph_pwr";
+		reg = <0x83>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@85 {
+		label = "vcoin";
+		reg = <0x85>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@4c {
+		label = "xo_therm";
+		reg = <0x4c>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@4d {
+		label = "msm_therm";
+		reg = <0x4d>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@51 {
+		label = "quiet_therm";
+		reg = <0x51>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8998_adc_tm {
+	chan@83 {
+		label = "vph_pwr";
+		reg = <0x83>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,btm-channel-number = <0x60>;
+	};
+
+	chan@4d {
+		label = "msm_therm";
+		reg = <0x4d>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@51 {
+		label = "quiet_therm";
+		reg = <0x51>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@4c {
+		label = "xo_therm";
+		reg = <0x4c>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+};
+
+&wil6210 {
+	status = "ok";
+};
+
+&snd_9335 {
+	qcom,mbhc-audio-jack-type = "6-pole-jack";
+};
+
+&snd_934x {
+	qcom,mbhc-audio-jack-type = "6-pole-jack";
+};
+
+&soc {
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+		status = "okay";
+
+		home {
+			label = "home";
+			gpios = <&pm8998_gpios 5 0x1>;
+			linux,input-type = <1>;
+			linux,code = <102>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+
+		};
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8998_gpios 6 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_snapshot {
+			label = "cam_snapshot";
+			gpios = <&pm8998_gpios 7 0x1>;
+			linux,input-type = <1>;
+			linux,code = <766>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_focus {
+			label = "cam_focus";
+			gpios = <&pm8998_gpios 8 0x1>;
+			linux,input-type = <1>;
+			linux,code = <528>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-coresight.dtsi b/arch/arm64/boot/dts/qcom/msm8998-coresight.dtsi
new file mode 100644
index 000000000000..4b81d2754255
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-coresight.dtsi
@@ -0,0 +1,1601 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	tmc_etr: tmc@6048000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b961>;
+
+		reg = <0x6048000 0x1000>,
+		      <0x6064000 0x15000>;
+		reg-names = "tmc-base", "bam-base";
+
+		arm,buffer-size = <0x400000>;
+		arm,sg-enable;
+
+		coresight-ctis = <&cti0 &cti8>;
+
+		coresight-name = "coresight-tmc-etr";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			tmc_etr_in_replicator: endpoint {
+				slave-mode;
+				remote-endpoint = <&replicator_out_tmc_etr>;
+			};
+		};
+	};
+
+	replicator: replicator@6046000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b909>;
+
+		reg = <0x6046000 0x1000>;
+		reg-names = "replicator-base";
+
+		coresight-name = "coresight-replicator";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports{
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				replicator_out_tmc_etr:endpoint {
+					remote-endpoint =
+						<&tmc_etr_in_replicator>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				replicator_in_tmc_etf:endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tmc_etf_out_replicator>;
+				};
+			};
+		};
+	};
+
+	tmc_etf: tmc@6047000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b961>;
+
+		reg = <0x6047000 0x1000>;
+		reg-names = "tmc-base";
+
+		coresight-ctis = <&cti0 &cti8>;
+
+		coresight-name = "coresight-tmc-etf";
+
+		arm,default-sink;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports{
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				tmc_etf_out_replicator:endpoint {
+					remote-endpoint =
+						<&replicator_in_tmc_etf>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				tmc_etf_in_funnel_merg:endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&funnel_merg_out_tmc_etf>;
+				};
+			};
+		};
+	};
+
+	funnel_merg: funnel@6045000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x6045000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-merg";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_merg_out_tmc_etf:endpoint {
+					remote-endpoint =
+						<&tmc_etf_in_funnel_merg>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				funnel_merg_in_funnel_in0:endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&funnel_in0_out_funnel_merg>;
+				};
+			};
+			port@2 {
+				reg = <1>;
+				funnel_merg_in_funnel_in1:endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&funnel_in1_out_funnel_merg>;
+				};
+			};
+		};
+	};
+
+	funnel_in0: funnel@6041000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x6041000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-in0";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_in0_out_funnel_merg: endpoint {
+					remote-endpoint =
+						<&funnel_merg_in_funnel_in0>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				funnel_in0_in_rpm_etm0: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&rpm_etm0_out_funnel_in0>;
+				};
+			};
+			port@2 {
+				reg = <3>;
+				funnel_in0_in_funnel_spss: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&funnel_spss_out_funnel_in0>;
+				};
+			};
+			port@3 {
+				reg = <6>;
+				funnel_in0_in_funnel_qatb: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&funnel_qatb_out_funnel_in0>;
+				};
+			};
+			port@4 {
+				reg = <7>;
+				funnel_in0_in_stm: endpoint {
+					slave-mode;
+					remote-endpoint = <&stm_out_funnel_in0>;
+				};
+			};
+		};
+	};
+
+	funnel_in1: funnel@6042000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x6042000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-in1";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_in1_out_funnel_merg: endpoint {
+					remote-endpoint =
+						<&funnel_merg_in_funnel_in1>;
+				};
+			};
+			port@1 {
+				reg = <2>;
+				funnel_in1_in_tpda_nav: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&tpda_nav_out_funnel_in1>;
+				};
+			};
+			port@2 {
+				reg = <3>;
+				funnel_in1_in_tpda_mss: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&tpda_mss_out_funnel_in1>;
+				};
+			};
+			port@3 {
+				reg = <4>;
+				funnel_in1_in_audio_etm0: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&audio_etm0_out_funnel_in1>;
+				};
+			};
+			port@4 {
+				reg = <5>;
+				funnel_in1_in_modem_etm0: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&modem_etm0_out_funnel_in1>;
+				};
+			};
+			port@5 {
+				reg = <6>;
+				funnel_in1_in_funnel_apss_merg: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&funnel_apss_merg_out_funnel_in1>;
+				};
+			};
+			port@6 {
+				reg = <7>;
+				funnel_in1_in_gfx: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&gfx_out_funnel_in1>;
+				};
+			};
+		};
+	};
+
+	funnel_apss_merg: funnel@7b70000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x7b70000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-apss-merg";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_apss_merg_out_funnel_in1: endpoint {
+					remote-endpoint =
+					    <&funnel_in1_in_funnel_apss_merg>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				funnel_apss_merg_in_funnel_apss: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&funnel_apss_out_funnel_apss_merg>;
+				};
+			};
+			port@2 {
+				reg = <1>;
+				funnel_apss_merg_in_tpda_olc: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&tpda_olc_out_funnel_apss_merg>;
+				};
+			};
+			port@3 {
+				reg = <3>;
+				funnel_apss_merg_in_tpda_apss: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&tpda_apss_out_funnel_apss_merg>;
+				};
+			};
+		};
+	};
+
+	funnel_apss: funnel@7b60000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x7b60000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-apss";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_apss_out_funnel_apss_merg: endpoint {
+					remote-endpoint =
+					    <&funnel_apss_merg_in_funnel_apss>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				funnel_apss_in_etm0: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm0_out_funnel_apss>;
+				};
+			};
+			port@2 {
+				reg = <1>;
+				funnel_apss_in_etm1: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm1_out_funnel_apss>;
+				};
+			};
+			port@3 {
+				reg = <2>;
+				funnel_apss_in_etm2: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm2_out_funnel_apss>;
+				};
+			};
+			port@4 {
+				reg = <3>;
+				funnel_apss_in_etm3: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm3_out_funnel_apss>;
+				};
+			};
+			port@5 {
+				reg = <4>;
+				funnel_apss_in_etm4: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm4_out_funnel_apss>;
+				};
+			};
+			port@6 {
+				reg = <5>;
+				funnel_apss_in_etm5: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm5_out_funnel_apss>;
+				};
+			};
+			port@7 {
+				reg = <6>;
+				funnel_apss_in_etm6: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm6_out_funnel_apss>;
+				};
+			};
+			port@8 {
+				reg = <7>;
+				funnel_apss_in_etm7: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm7_out_funnel_apss>;
+				};
+			};
+		};
+	};
+
+	stm: stm@6002000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b962>;
+
+		reg = <0x6002000 0x1000>,
+		      <0x16280000 0x180000>;
+		reg-names = "stm-base", "stm-data-base";
+
+		coresight-name = "coresight-stm";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			stm_out_funnel_in0: endpoint {
+				remote-endpoint = <&funnel_in0_in_stm>;
+			};
+		};
+	};
+
+	etm0: etm@7840000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x7840000 0x1000>;
+		cpu = <&CPU0>;
+
+		coresight-name = "coresight-etm0";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm0_out_funnel_apss: endpoint {
+				remote-endpoint = <&funnel_apss_in_etm0>;
+			};
+		};
+	};
+
+	etm1: etm@7940000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x7940000 0x1000>;
+		cpu = <&CPU1>;
+
+		coresight-name = "coresight-etm1";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm1_out_funnel_apss: endpoint {
+				remote-endpoint = <&funnel_apss_in_etm1>;
+			};
+		};
+	};
+
+	etm2: etm@7A40000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x7A40000 0x1000>;
+		cpu = <&CPU2>;
+
+		coresight-name = "coresight-etm2";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm2_out_funnel_apss: endpoint {
+				remote-endpoint = <&funnel_apss_in_etm2>;
+			};
+		};
+	};
+
+	etm3: etm@7B40000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x7B40000 0x1000>;
+		cpu = <&CPU3>;
+
+		coresight-name = "coresight-etm3";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm3_out_funnel_apss: endpoint {
+				remote-endpoint = <&funnel_apss_in_etm3>;
+			};
+		};
+	};
+
+	etm4: etm@7C40000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x7C40000 0x1000>;
+		cpu = <&CPU4>;
+
+		coresight-name = "coresight-etm4";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm4_out_funnel_apss: endpoint {
+				remote-endpoint = <&funnel_apss_in_etm4>;
+			};
+		};
+	};
+
+	etm5: etm@7D40000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x7D40000 0x1000>;
+		cpu = <&CPU5>;
+
+		coresight-name = "coresight-etm5";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm5_out_funnel_apss: endpoint {
+				remote-endpoint = <&funnel_apss_in_etm5>;
+			};
+		};
+	};
+
+	etm6: etm@7E40000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x7E40000 0x1000>;
+		cpu = <&CPU6>;
+
+		coresight-name = "coresight-etm6";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm6_out_funnel_apss: endpoint {
+				remote-endpoint = <&funnel_apss_in_etm6>;
+			};
+		};
+	};
+
+	etm7: etm@7F40000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x7F40000 0x1000>;
+		cpu = <&CPU7>;
+
+		coresight-name = "coresight-etm7";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm7_out_funnel_apss: endpoint {
+				remote-endpoint = <&funnel_apss_in_etm7>;
+			};
+		};
+	};
+
+	cti0: cti@6010000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6010000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti0";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti1: cti@6011000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6011000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti1";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti2: cti@6012000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6012000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti2";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,cti-gpio-trigout = <4>;
+		pinctrl-names = "cti-trigout-pctrl";
+		pinctrl-0 = <&trigout_a>;
+	};
+
+	cti3: cti@6013000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6013000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti3";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti4: cti@6014000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6014000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti4";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti5: cti@6015000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6015000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti5";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti6: cti@6016000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6016000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti6";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti7: cti@6017000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6017000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti7";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti8: cti@6018000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6018000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti8";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti9: cti@6019000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6019000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti9";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti10: cti@601a000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x601a000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti10";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti11: cti@601b000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x601b000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti11";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti12: cti@601c000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x601c000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti12";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti13: cti@601d000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x601d000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti13";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti14: cti@601e000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x601e000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti14";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti15: cti@601f000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x601f000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti15";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu0: cti@7820000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7820000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu0";
+		cpu = <&CPU0>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu1: cti@7920000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7920000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu1";
+		cpu = <&CPU1>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu2: cti@7a20000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7a20000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu2";
+		cpu = <&CPU2>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu3: cti@7b20000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7b20000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu3";
+		cpu = <&CPU3>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu4: cti@7c20000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7c20000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu4";
+		cpu = <&CPU4>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu5: cti@7d20000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7d20000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu5";
+		cpu = <&CPU5>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu6: cti@7e20000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7e20000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu6";
+		cpu = <&CPU6>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu7: cti@7f20000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7f20000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu7";
+		cpu = <&CPU7>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_apss: cti@7b80000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7b80000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-apss";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_apss_dl: cti@7bc1000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7bc1000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-apss-dl";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_olc: cti@7b91000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7b91000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-olc";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	funnel_qatb: funnel@6005000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x6005000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-qatb";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_qatb_out_funnel_in0: endpoint {
+					remote-endpoint =
+					    <&funnel_in0_in_funnel_qatb>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				funnel_qatb_in_tpda: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpda_out_funnel_qatb>;
+				};
+			};
+			port@2 {
+				reg = <3>;
+				funnel_qatb_in_funnel_dlet_qatb: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&funnel_dlet_qatb_out_funnel_qatb>;
+				};
+			};
+		};
+	};
+
+	tpda: tpda@6004000 {
+		compatible = "qcom,coresight-tpda";
+		reg = <0x6004000 0x1000>;
+		reg-names = "tpda-base";
+
+		coresight-name = "coresight-tpda";
+
+		qcom,tpda-atid = <65>;
+		qcom,bc-elem-size = <7 32>,
+				    <9 32>;
+		qcom,tc-elem-size = <3 32>,
+				    <6 32>,
+				    <9 32>;
+		qcom,dsb-elem-size = <7 32>,
+				     <9 32>;
+		qcom,cmb-elem-size = <3 32>,
+				     <4 32>,
+				     <5 32>,
+				     <9 64>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			port@0 {
+				reg = <0>;
+				tpda_out_funnel_qatb: endpoint {
+					remote-endpoint =
+						<&funnel_qatb_in_tpda>;
+				};
+			};
+			port@1 {
+				reg = <3>;
+				tpda_in_tpdm_vsense: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_vsense_out_tpda>;
+				};
+			};
+			port@2 {
+				reg = <4>;
+				tpda_in_tpdm_dcc: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_dcc_out_tpda>;
+				};
+			};
+			port@3 {
+				reg = <5>;
+				tpda_in_tpdm_prng: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_prng_out_tpda>;
+				};
+			};
+			port@4 {
+				reg = <7>;
+				tpda_in_tpdm_qm: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_qm_out_tpda>;
+				};
+			};
+			port@5 {
+				reg = <9>;
+				tpda_in_tpdm_pimem: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_pimem_out_tpda>;
+				};
+			};
+		};
+	};
+
+	tpdm_vsense: tpdm@7038000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x7038000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-vsense";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_vsense_out_tpda: endpoint {
+				remote-endpoint = <&tpda_in_tpdm_vsense>;
+			};
+		};
+	};
+
+	tpdm_dcc: tpdm@7054000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x7054000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-dcc";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_dcc_out_tpda: endpoint {
+				remote-endpoint = <&tpda_in_tpdm_dcc>;
+			};
+		};
+	};
+
+	tpdm_prng: tpdm@704c000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x704c000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-prng";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_prng_out_tpda: endpoint {
+				remote-endpoint = <&tpda_in_tpdm_prng>;
+			};
+		};
+	};
+
+	tpdm_qm: tpdm@71d0000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x71d0000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-qm";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,msr-fix-req;
+
+		port{
+			tpdm_qm_out_tpda: endpoint {
+				remote-endpoint = <&tpda_in_tpdm_qm>;
+			};
+		};
+
+	};
+
+	tpdm_pimem: tpdm@7050000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x7050000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-pimem";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,msr-fix-req;
+
+		port{
+			tpdm_pimem_out_tpda: endpoint {
+				remote-endpoint = <&tpda_in_tpdm_pimem>;
+			};
+		};
+
+	};
+
+	tpda_apss: tpda@7bc2000 {
+		compatible = "qcom,coresight-tpda";
+		reg = <0x7bc2000 0x1000>;
+		reg-names = "tpda-base";
+
+		coresight-name = "coresight-tpda-apss";
+
+		qcom,tpda-atid = <66>;
+		qcom,dsb-elem-size = <0 32>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			port@0 {
+				reg = <0>;
+				tpda_apss_out_funnel_apss_merg: endpoint {
+					remote-endpoint =
+					       <&funnel_apss_merg_in_tpda_apss>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				tpda_apss_in_tpdm_apss: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_apss_out_tpda_apss>;
+				};
+			};
+		};
+	};
+
+	tpdm_apss: tpdm@7bc0000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x7bc0000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-apss";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,msr-fix-req;
+
+		port{
+			tpdm_apss_out_tpda_apss: endpoint {
+				remote-endpoint = <&tpda_apss_in_tpdm_apss>;
+			};
+		};
+	};
+
+	tpda_mss: tpda@7043000 {
+		compatible = "qcom,coresight-tpda";
+		reg = <0x7043000 0x1000>;
+		reg-names = "tpda-base";
+
+		coresight-name = "coresight-tpda-mss";
+
+		qcom,tpda-atid = <67>;
+		qcom,dsb-elem-size = <0 32>;
+		qcom,cmb-elem-size = <0 32>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			port@0 {
+				reg = <0>;
+				tpda_mss_out_funnel_in1: endpoint {
+					remote-endpoint =
+						<&funnel_in1_in_tpda_mss>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				tpda_mss_in_tpdm_mss: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_mss_out_tpda_mss>;
+				};
+			};
+		};
+	};
+
+	tpdm_mss: tpdm@7042000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x7042000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-mss";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,msr-fix-req;
+
+		port{
+			tpdm_mss_out_tpda_mss: endpoint {
+				remote-endpoint = <&tpda_mss_in_tpdm_mss>;
+			};
+		};
+	};
+
+	tpda_nav: tpda@7191000 {
+		compatible = "qcom,coresight-tpda";
+		reg = <0x7191000 0x1000>;
+		reg-names = "tpda-base";
+
+		coresight-name = "coresight-tpda-nav";
+
+		qcom,tpda-atid = <68>;
+		qcom,cmb-elem-size = <0 32>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			port@0 {
+				reg = <0>;
+				tpda_nav_out_funnel_in1: endpoint {
+					remote-endpoint =
+						<&funnel_in1_in_tpda_nav>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				tpda_nav_in_tpdm_nav: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_nav_out_tpda_nav>;
+				};
+			};
+		};
+	};
+
+	tpdm_nav: tpdm@7190000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x7190000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-nav";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_nav_out_tpda_nav: endpoint {
+				remote-endpoint = <&tpda_nav_in_tpdm_nav>;
+			};
+		};
+	};
+
+	tpda_olc: tpda@7b92000 {
+		compatible = "qcom,coresight-tpda";
+		reg = <0x7b92000 0x1000>;
+		reg-names = "tpda-base";
+
+		coresight-name = "coresight-tpda-olc";
+
+		qcom,tpda-atid = <69>;
+		qcom,cmb-elem-size = <0 64>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			port@0 {
+				reg = <0>;
+				tpda_olc_out_funnel_apss_merg: endpoint {
+					remote-endpoint =
+						<&funnel_apss_merg_in_tpda_olc>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				tpda_olc_in_tpdm_olc: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_olc_out_tpda_olc>;
+				};
+			};
+		};
+	};
+
+	tpdm_olc: tpdm@7b90000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x7b90000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-olc";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_olc_out_tpda_olc: endpoint {
+				remote-endpoint = <&tpda_olc_in_tpdm_olc>;
+			};
+		};
+	};
+
+	funnel_spss: funnel@7083000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x7083000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-spss";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_spss_out_funnel_in0: endpoint {
+					remote-endpoint =
+					    <&funnel_in0_in_funnel_spss>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				funnel_spss_in_tpda_spss: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpda_spss_out_funnel_spss>;
+				};
+			};
+		};
+	};
+
+	tpda_spss: tpda@7082000 {
+		compatible = "qcom,coresight-tpda";
+		reg = <0x7082000 0x1000>;
+		reg-names = "tpda-base";
+
+		coresight-name = "coresight-tpda-spss";
+
+		qcom,tpda-atid = <70>;
+		qcom,dsb-elem-size = <0 32>;
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			port@0 {
+				reg = <0>;
+				tpda_spss_out_funnel_spss: endpoint {
+					remote-endpoint =
+						<&funnel_spss_in_tpda_spss>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				tpda_spss_in_tpdm_spss: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_spss_out_tpda_spss>;
+				};
+			};
+		};
+	};
+
+	tpdm_spss: tpdm@7080000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x7080000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-spss";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,msr-fix-req;
+
+		port{
+			tpdm_spss_out_tpda_spss: endpoint {
+				remote-endpoint = <&tpda_spss_in_tpdm_spss>;
+			};
+		};
+	};
+
+	hwevent: hwevent@158000 {
+		compatible = "qcom,coresight-hwevent";
+		reg = <0x158000 0x80>,
+		      <0x17091000 0x80>,
+		      <0x1730200c 0x4>,
+		      <0xc90137c 0x4>,
+		      <0xc828018 0x80>,
+		      <0x1c00058 0x80>,
+		      <0x5e02038 0x4>,
+		      <0x5e02028 0x10>,
+		      <0x1fcb360 0x80>,
+		      <0x1fcb760 0x80>,
+		      <0x1fcbf60 0x80>,
+		      <0xa8f8860 0x4>,
+		      <0x500c260 0x4>,
+		      <0x500d040 0x4>,
+		      <0x1da6400 0x80>;
+		reg-names = "gcc-ctrl", "lpass-stm", "lpass-qdsp", "mdss-mdp",
+			    "mdss-misc", "pcie0-hwev", "ssc-en", "ssc-hwev",
+			    "tcsr-qdss", "tcsr-mss0", "tcsr-mss1", "usb-ctrl",
+			    "vbif-stm", "vbif-stm-en", "ufs-mux";
+
+		coresight-name = "coresight-hwevent";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>,
+			 <&clock_mmss clk_mmss_misc_ahb_clk>;
+		clock-names = "core_clk", "core_a_clk", "core_mmss_clk";
+
+		qcom,hwevent-clks = "core_mmss_clk";
+	};
+
+	csr: csr@6001000 {
+		compatible = "qcom,coresight-csr";
+		reg = <0x6001000 0x1000>;
+		reg-names = "csr-base";
+
+		coresight-name = "coresight-csr";
+
+		qcom,blk-size = <1>;
+	};
+
+	modem_etm0 {
+		compatible = "qcom,coresight-remote-etm";
+
+		coresight-name = "coresight-modem-etm0";
+		qcom,inst-id = <2>;
+
+		port{
+			modem_etm0_out_funnel_in1: endpoint {
+				remote-endpoint = <&funnel_in1_in_modem_etm0>;
+			};
+		};
+	};
+
+	audio_etm0 {
+		compatible = "qcom,coresight-remote-etm";
+
+		coresight-name = "coresight-audio-etm0";
+		qcom,inst-id = <5>;
+
+		port{
+			audio_etm0_out_funnel_in1: endpoint {
+				remote-endpoint = <&funnel_in1_in_audio_etm0>;
+			};
+		};
+	};
+
+	rpm_etm0 {
+		compatible = "qcom,coresight-remote-etm";
+
+		coresight-name = "coresight-rpm-etm0";
+		qcom,inst-id = <4>;
+
+		port{
+			rpm_etm0_out_funnel_in0: endpoint {
+				remote-endpoint = <&funnel_in0_in_rpm_etm0>;
+			};
+		};
+	};
+
+	funnel_dlet_qatb: funnel@7225000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x7225000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-dlet-qatb";
+
+		clocks = <&clock_gcc clk_qdss_clk>,
+			 <&clock_gcc clk_qdss_a_clk>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_dlet_qatb_out_funnel_qatb: endpoint {
+					remote-endpoint =
+					    <&funnel_qatb_in_funnel_dlet_qatb>;
+				};
+			};
+			port@1 {
+				reg = <1>;
+				funnel_dlet_qatb_in_tpdm_wcss: endpoint {
+					slave-mode;
+					remote-endpoint =
+					      <&tpdm_wcss_out_funnel_dlet_qatb>;
+				};
+			};
+		};
+	};
+
+	dummy-tpdm-wcss {
+		compatible = "qcom,coresight-dummy";
+
+		coresight-name = "coresight-tpdm-wcss";
+
+		port{
+			tpdm_wcss_out_funnel_dlet_qatb: endpoint {
+				remote-endpoint =
+					<&funnel_dlet_qatb_in_tpdm_wcss>;
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-gpu.dtsi b/arch/arm64/boot/dts/qcom/msm8998-gpu.dtsi
new file mode 100644
index 000000000000..3c5de162620c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-gpu.dtsi
@@ -0,0 +1,277 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+
+	pil_gpu: qcom,kgsl-hyp {
+		compatible = "qcom,pil-tz-generic";
+		qcom,pas-id = <13>;
+		qcom,firmware-name = "a540_zap";
+	};
+
+	msm_bus: qcom,kgsl-busmon{
+		label = "kgsl-busmon";
+		compatible = "qcom,kgsl-busmon";
+	};
+
+	gpubw: qcom,gpubw {
+		compatible = "qcom,devbw";
+		governor = "bw_vbif";
+		qcom,src-dst-ports = <26 512>;
+		/*
+		 * active-only flag is used while registering the bus
+		 * governor.It helps release the bus vote when the CPU
+		 * subsystem is inactiv3
+		 */
+		qcom,active-only;
+		qcom,bw-tbl =
+			<     0 /*  off     */ >,
+			<   762 /*  100 MHz */ >,
+			<  1144 /*  150 MHz */ >,
+			<  1525 /*  200 MHz */ >,
+			<  2288 /*  300 MHz */ >,
+			<  3143 /*  412 MHz */ >,
+			<  4173 /*  547 MHz */ >,
+			<  5195 /*  681 MHz */ >,
+			<  5859 /*  768 MHz */ >,
+			<  7759 /*  1017 MHz */ >,
+			<  9887 /*  1296 MHz */ >,
+			<  11863 /*  1555 MHz */ >,
+			<  13763 /*  1804 MHz */ >;
+	};
+
+	msm_gpu: qcom,kgsl-3d0@5000000 {
+		label = "kgsl-3d0";
+		compatible = "qcom,kgsl-3d0", "qcom,kgsl-3d";
+		status = "ok";
+		reg = <0x5000000 0x40000>;
+		reg-names = "kgsl_3d0_reg_memory";
+		interrupts = <0 300 0>;
+		interrupt-names = "kgsl_3d0_irq";
+		qcom,id = <0>;
+
+		qcom,chipid = <0x05040000>;
+		qcom,gpu-efuse-leakage = <0x00070130 24>;
+		qcom,base-leakage-coefficient = <34>;
+		qcom,lm-limit = <6000>;
+
+		qcom,initial-pwrlevel = <4>;
+
+		qcom,idle-timeout = <80>; //<HZ/12>
+		qcom,no-nap;
+
+		qcom,highest-bank-bit = <15>;
+
+		qcom,snapshot-size = <1048576>; //bytes
+
+		qcom,gpu-qdss-stm = <0x161c0000 0x40000>; // base addr, size
+
+		qcom,gpu-qtimer = <0x17921000 0x1000>; // base addr, size
+
+		qcom,tsens-name = "tsens_tz_sensor12";
+
+		/* Avoid L2PC on big cluster CPUs (CPU 4,5,6,7) */
+		qcom,l2pc-cpu-mask = <0x000000f0>;
+
+		/* Quirks */
+		qcom,gpu-quirk-lmloadkill-disable;
+
+		/* DRM settings */
+		qcom,gpmu-tsens = <0x000c000d>;
+		qcom,max-power = <5448>;
+		qcom,gpmu-firmware = "a540_gpmu.fw2";
+		qcom,gpmu-version = <3 0>;
+		qcom,zap-shader = "a540_zap";
+
+		clocks = <&clock_gfx clk_gpucc_gfx3d_clk>,
+			<&clock_gcc clk_gcc_gpu_cfg_ahb_clk>,
+			<&clock_gpu clk_gpucc_rbbmtimer_clk>,
+			<&clock_gcc clk_gcc_bimc_gfx_clk>,
+			<&clock_gcc clk_gcc_gpu_bimc_gfx_clk>,
+			<&clock_gpu clk_gpucc_gfx3d_isense_clk>,
+			<&clock_gpu clk_gpucc_rbcpr_clk>,
+			<&clock_gcc clk_gcc_gpu_iref_clk>;
+
+		clock-names = "core_clk", "iface_clk", "rbbmtimer_clk",
+			"mem_clk", "mem_iface_clk", "isense_clk", "rbcpr_clk",
+			"iref_clk";
+
+		qcom,isense-clk-on-level = <1>;
+		/* Bus Scale Settings */
+		qcom,gpubw-dev = <&gpubw>;
+		qcom,bus-control;
+		qcom,msm-bus,name = "grp3d";
+		qcom,bus-width = <32>;
+		qcom,msm-bus,num-cases = <13>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<26 512 0 0>,
+
+				<26 512 0 800000>,      // 1 bus=100
+				<26 512 0 1200000>,     // 2 bus=150
+				<26 512 0 1600000>,     // 3 bus=200
+				<26 512 0 2400000>,     // 4 bus=300
+				<26 512 0 3296000>,     // 5 bus=412
+				<26 512 0 4376000>,     // 6 bus=547
+				<26 512 0 5448000>,     // 7 bus=681
+				<26 512 0 6144000>,     // 8 bus=768
+				<26 512 0 8136000>,     // 9 bus=1017
+				<26 512 0 10368000>,    // 10 bus=1296
+				<26 512 0 12440000>,    // 11 bus=1555
+				<26 512 0 14432000>;    // 12 bus=1804
+
+		/* GDSC regulator names */
+		regulator-names = "vddcx", "vdd";
+		/* GDSC oxili regulators */
+		vddcx-supply = <&gdsc_gpu_cx>;
+		vdd-supply = <&gdsc_gpu_gx>;
+
+		/* Trace bus */
+		coresight-name = "coresight-gfx";
+		coresight-atid = <3>;
+		port {
+			gfx_out_funnel_in1: endpoint {
+				remote-endpoint = <&funnel_in1_in_gfx>;
+			};
+		};
+
+		/* GPU Mempools */
+		qcom,gpu-mempools {
+			#address-cells= <1>;
+			#size-cells = <0>;
+			compatible = "qcom,gpu-mempools";
+
+			/* 4K Page Pool configuration */
+			qcom,gpu-mempool@0 {
+				reg = <0>;
+				qcom,mempool-page-size = <4096>;
+				qcom,mempool-reserved = <2048>;
+				qcom,mempool-allocate;
+			};
+			/* 8K Page Pool configuration */
+			qcom,gpu-mempool@1 {
+				reg = <1>;
+				qcom,mempool-page-size  = <8192>;
+				qcom,mempool-reserved = <1024>;
+				qcom,mempool-allocate;
+			};
+			/* 64K Page Pool configuration */
+			qcom,gpu-mempool@2 {
+				reg = <2>;
+				qcom,mempool-page-size  = <65536>;
+				qcom,mempool-reserved = <256>;
+			};
+			/* 1M Page Pool configuration */
+			qcom,gpu-mempool@3 {
+				reg = <3>;
+				qcom,mempool-page-size  = <1048576>;
+				qcom,mempool-reserved = <32>;
+			};
+		};
+
+		/* Power levels */
+		qcom,gpu-pwrlevels {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			compatible = "qcom,gpu-pwrlevels";
+
+			qcom,gpu-pwrlevel@0 {
+				reg = <0>;
+				qcom,gpu-freq = <650000000>;
+				qcom,bus-freq = <12>;
+				qcom,bus-min = <11>;
+				qcom,bus-max = <12>;
+			};
+
+
+			qcom,gpu-pwrlevel@1 {
+				reg = <1>;
+				qcom,gpu-freq = <504000000>;
+				qcom,bus-freq = <11>;
+				qcom,bus-min = <10>;
+				qcom,bus-max = <12>;
+			};
+
+			qcom,gpu-pwrlevel@2 {
+				reg = <2>;
+				qcom,gpu-freq = <403000000>;
+				qcom,bus-freq = <10>;
+				qcom,bus-min = <9>;
+				qcom,bus-max = <11>;
+			};
+
+			qcom,gpu-pwrlevel@3 {
+				reg = <3>;
+				qcom,gpu-freq = <332000000>;
+				qcom,bus-freq = <7>;
+				qcom,bus-min = <6>;
+				qcom,bus-max = <8>;
+			};
+
+			qcom,gpu-pwrlevel@4 {
+				reg = <4>;
+				qcom,gpu-freq = <251000000>;
+				qcom,bus-freq = <4>;
+				qcom,bus-min = <3>;
+				qcom,bus-max = <5>;
+			};
+
+			qcom,gpu-pwrlevel@5 {
+				reg = <5>;
+				qcom,gpu-freq = <171000000>;
+				qcom,bus-freq = <3>;
+				qcom,bus-min = <1>;
+				qcom,bus-max = <4>;
+			};
+
+			qcom,gpu-pwrlevel@6 {
+				reg = <6>;
+				qcom,gpu-freq = <27000000>;
+				qcom,bus-freq = <0>;
+				qcom,bus-min = <0>;
+				qcom,bus-max = <0>;
+			};
+		};
+
+	};
+
+	kgsl_msm_iommu: qcom,kgsl-iommu {
+		compatible = "qcom,kgsl-smmu-v2";
+
+		reg = <0x05040000 0x10000>;
+		qcom,protect = <0x40000 0x10000>;
+		qcom,micro-mmu-control = <0x6000>;
+
+		clocks =<&clock_gcc clk_gcc_gpu_cfg_ahb_clk>,
+			<&clock_gcc clk_gcc_bimc_gfx_clk>,
+			<&clock_gcc clk_gcc_gpu_bimc_gfx_clk>;
+
+		clock-names = "iface_clk", "mem_clk", "mem_iface_clk";
+
+		qcom,secure_align_mask = <0xfff>;
+		qcom,retention;
+		qcom,hyp_secure_alloc;
+
+		gfx3d_user: gfx3d_user {
+			compatible = "qcom,smmu-kgsl-cb";
+			label = "gfx3d_user";
+			iommus = <&kgsl_smmu 0>;
+			qcom,gpu-offset = <0x48000>;
+		};
+
+		gfx3d_secure: gfx3d_secure {
+			compatible = "qcom,smmu-kgsl-cb";
+			iommus = <&kgsl_smmu 2>;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-interposer-camera-sensor-cdp.dtsi b/arch/arm64/boot/dts/qcom/msm8998-interposer-camera-sensor-cdp.dtsi
new file mode 100644
index 000000000000..41e783e6bf1f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-interposer-camera-sensor-cdp.dtsi
@@ -0,0 +1,445 @@
+/*
+ * Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	tlmm: pinctrl@03400000 {
+		cam_sensor_rear_active: cam_sensor_rear_active {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio30", "gpio8";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio30", "gpio8";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_rear_suspend: cam_sensor_rear_suspend {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio30", "gpio8";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio30", "gpio8";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+	};
+
+	led_flash0: qcom,camera-flash@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pm660l_flash0 &pm660l_flash1>;
+		qcom,torch-source = <&pm660l_torch0 &pm660l_torch1>;
+		qcom,switch-source = <&pm660l_switch0>;
+		status = "ok";
+	};
+
+	led_flash1: qcom,camera-flash@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pm660l_flash2>;
+		qcom,torch-source = <&pm660l_torch2>;
+		qcom,switch-source = <&pm660l_switch1>;
+		status = "ok";
+	};
+
+	qcom,csiphy@ca34000 {
+		qcom,clock-rates = <0 0 0 0 0 0 384000000 0 0 269333333 0
+			0 384000000 0>;
+	};
+
+	qcom,csiphy@ca35000 {
+		qcom,clock-rates = <0 0 0 0 0 0 384000000 0 0 269333333 0
+			0 384000000 0>;
+	};
+
+	qcom,csiphy@ca36000 {
+		qcom,clock-rates = <0 0 0 0 0 0 384000000 0 0 269333333 0
+			0 384000000 0>;
+	};
+
+	qcom,csid@ca30000  {
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		qcom,clock-rates = <0 0 0 0 0 0 0 384000000 384000000
+			0 0 0 0 0>;
+	};
+
+	qcom,csid@ca30400 {
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		qcom,clock-rates = <0 0 0 0 0 0 0 384000000 384000000
+			0 0 0 0 0>;
+	};
+
+	qcom,csid@ca30800 {
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		qcom,clock-rates = <0 0 0 0 0 0 0 384000000 384000000
+			0 0 0 0 0>;
+	};
+
+	qcom,csid@ca30c00 {
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		qcom,clock-rates = <0 0 0 0 0 0 0 384000000 384000000
+			0 0 0 0 0>;
+	};
+};
+
+&cci {
+	/delete-node/qcom,camera@0;
+	/delete-node/qcom,camera@1;
+	/delete-node/qcom,camera@2;
+	/delete-node/qcom,eeprom@0;
+	/delete-node/qcom,eeprom@1;
+	/delete-node/qcom,eeprom@2;
+	/delete-node/qcom,actuator@0;
+	/delete-node/qcom,actuator@1;
+	/delete-node/qcom,ois@0;
+};
+
+&soc {
+	/delete-node/gpio-regulator@0;
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+	};
+
+	ois0: qcom,ois@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,ois";
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+		status = "disabled";
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				&cam_sensor_rear_active
+				&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_sensor_rear_suspend
+				&cam_actuator_vaf_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&pm660l_gpios 4 0>,
+			<&tlmm 8 0>,
+			<&tlmm 27 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-vaf = <4>;
+		qcom,gpio-req-tbl-num = <0 1 2 3 4>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA",
+					"CAM_VAF";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom2: qcom,eeprom@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active
+				&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend
+				&cam_actuator_vaf_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 28 0>,
+			<&pm660_gpios 3 0>,
+			<&tlmm 29 0>,
+			<&tlmm 27 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-vaf = <4>;
+		qcom,gpio-req-tbl-num = <0 1 2 3 4>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG",
+					"CAM_VANA",
+					"CAM_VAF";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <270>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,ois-src = <&ois0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				 &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				 &cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&pm660l_gpios 4 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 9 0>,
+			<&pm660l_gpios 3 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK",
+					  "CAM_RESET",
+					  "CAM_VDIG",
+					  "CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,actuator-src = <&actuator1>;
+		qcom,led-flash-src = <&led_flash1>;
+		qcom,eeprom-src = <&eeprom2>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 28 0>,
+			<&pm660l_gpios 3 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
+
+&pm660l_gpios {
+	gpio@c300 { /* GPIO4 -CAMERA SENSOR 0 VDIG*/
+		qcom,mode = <1>;                /* Output */
+		qcom,pull = <5>;                /* No Pull */
+		qcom,vin-sel = <0>;             /* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;             /* GPIO */
+		qcom,invert = <0>;              /* Invert */
+		qcom,master-en = <1>;           /* Enable GPIO */
+		status = "ok";
+	};
+
+	gpio@c200 { /* GPIO3 -CAMERA SENSOR 2 VDIG*/
+		qcom,mode = <1>;                /* Output */
+		qcom,pull = <5>;                /* No Pull */
+		qcom,vin-sel = <0>;             /* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;             /* GPIO */
+		qcom,invert = <0>;              /* Invert */
+		qcom,master-en = <1>;           /* Enable GPIO */
+		status = "ok";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-interposer-camera-sensor-mtp.dtsi b/arch/arm64/boot/dts/qcom/msm8998-interposer-camera-sensor-mtp.dtsi
new file mode 100644
index 000000000000..d00ae0f3730c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-interposer-camera-sensor-mtp.dtsi
@@ -0,0 +1,449 @@
+/*
+ * Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	/delete-node/qcom,camera-flash@0;
+	/delete-node/qcom,camera-flash@1;
+	/delete-node/gpio-regulator@0;
+};
+
+&soc {
+	tlmm: pinctrl@03400000 {
+		cam_sensor_rear_active: cam_sensor_rear_active {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio30", "gpio8";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio30", "gpio8";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_rear_suspend: cam_sensor_rear_suspend {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio30", "gpio8";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio30", "gpio8";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+	};
+
+	led_flash0: qcom,camera-flash@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pm660l_flash0 &pm660l_flash1>;
+		qcom,torch-source = <&pm660l_torch0 &pm660l_torch1>;
+		qcom,switch-source = <&pm660l_switch0>;
+		status = "ok";
+	};
+
+	led_flash1: qcom,camera-flash@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pm660l_flash2>;
+		qcom,torch-source = <&pm660l_torch2>;
+		qcom,switch-source = <&pm660l_switch1>;
+		status = "ok";
+	};
+
+	qcom,csiphy@ca34000 {
+		qcom,clock-rates = <0 0 0 0 0 0 384000000 0 0 269333333 0
+			0 384000000 0>;
+	};
+
+	qcom,csiphy@ca35000 {
+		qcom,clock-rates = <0 0 0 0 0 0 384000000 0 0 269333333 0
+			0 384000000 0>;
+	};
+
+	qcom,csiphy@ca36000 {
+		qcom,clock-rates = <0 0 0 0 0 0 384000000 0 0 269333333 0
+			0 384000000 0>;
+	};
+
+	qcom,csid@ca30000  {
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		qcom,clock-rates = <0 0 0 0 0 0 0 384000000 384000000
+			0 0 0 0 0>;
+	};
+
+	qcom,csid@ca30400 {
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		qcom,clock-rates = <0 0 0 0 0 0 0 384000000 384000000
+			0 0 0 0 0>;
+	};
+
+	qcom,csid@ca30800 {
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		qcom,clock-rates = <0 0 0 0 0 0 0 384000000 384000000
+			0 0 0 0 0>;
+	};
+
+	qcom,csid@ca30c00 {
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		qcom,clock-rates = <0 0 0 0 0 0 0 384000000 384000000
+			0 0 0 0 0>;
+	};
+};
+
+&cci {
+	/delete-node/qcom,camera@0;
+	/delete-node/qcom,camera@1;
+	/delete-node/qcom,camera@2;
+	/delete-node/qcom,camera@3;
+	/delete-node/qcom,eeprom@0;
+	/delete-node/qcom,eeprom@1;
+	/delete-node/qcom,eeprom@2;
+	/delete-node/qcom,actuator@0;
+	/delete-node/qcom,actuator@1;
+	/delete-node/qcom,tof@0;
+	/delete-node/qcom,ois@0;
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+	};
+
+	ois0: qcom,ois@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,ois";
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+		status = "disabled";
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				&cam_sensor_rear_active
+				&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_sensor_rear_suspend
+				&cam_actuator_vaf_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&pm660l_gpios 4 0>,
+			<&tlmm 8 0>,
+			<&tlmm 27 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-vaf = <4>;
+		qcom,gpio-req-tbl-num = <0 1 2 3 4>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA",
+					"CAM_VAF";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom2: qcom,eeprom@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active
+				&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend
+				&cam_actuator_vaf_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 28 0>,
+			<&pm660_gpios 3 0>,
+			<&tlmm 29 0>,
+			<&tlmm 27 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-vaf = <4>;
+		qcom,gpio-req-tbl-num = <0 1 2 3 4>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG",
+					"CAM_VANA",
+					"CAM_VAF";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <270>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,ois-src = <&ois0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				 &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				 &cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 30 0>,
+			<&pm660l_gpios 4 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 9 0>,
+			<&pm660l_gpios 3 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK",
+					  "CAM_RESET",
+					  "CAM_VDIG",
+					  "CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,actuator-src = <&actuator1>;
+		qcom,led-flash-src = <&led_flash1>;
+		qcom,eeprom-src = <&eeprom2>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 28 0>,
+			<&pm660l_gpios 3 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
+
+&pm660l_gpios {
+	gpio@c300 { /* GPIO4 -CAMERA SENSOR 0 VDIG*/
+		qcom,mode = <1>;                /* Output */
+		qcom,pull = <5>;                /* No Pull */
+		qcom,vin-sel = <0>;             /* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;             /* GPIO */
+		qcom,invert = <0>;              /* Invert */
+		qcom,master-en = <1>;           /* Enable GPIO */
+		status = "ok";
+	};
+
+	gpio@c200 { /* GPIO3 -CAMERA SENSOR 2 VDIG*/
+		qcom,mode = <1>;                /* Output */
+		qcom,pull = <5>;                /* No Pull */
+		qcom,vin-sel = <0>;             /* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;             /* GPIO */
+		qcom,invert = <0>;              /* Invert */
+		qcom,master-en = <1>;           /* Enable GPIO */
+		status = "ok";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-interposer-camera-sensor-qrd.dtsi b/arch/arm64/boot/dts/qcom/msm8998-interposer-camera-sensor-qrd.dtsi
new file mode 100644
index 000000000000..42414db3cc48
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-interposer-camera-sensor-qrd.dtsi
@@ -0,0 +1,519 @@
+/*
+ * Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	/delete-node/qcom,camera-flash@0;
+	/delete-node/qcom,camera-flash@1;
+	/delete-node/gpio-regulator@0;
+};
+
+&soc {
+	tlmm: pinctrl@03400000 {
+		cam_sensor_rear_active: cam_sensor_rear_active {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio9", "gpio8";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio9", "gpio8";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_rear_suspend: cam_sensor_rear_suspend {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio9", "gpio8";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio9", "gpio8";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_rear2_active: cam_sensor_rear2_active {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio30", "gpio8";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio30", "gpio8";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_rear2_suspend: cam_sensor_rear2_suspend {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio30", "gpio8";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio30", "gpio8";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_front_active: cam_sensor_front_active {
+			/* RESET */
+			mux {
+				pins = "gpio28","gpio8";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio28","gpio8";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+		cam_sensor_front_suspend: cam_sensor_front_suspend {
+			/* RESET */
+			mux {
+				pins = "gpio28","gpio8";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio28","gpio8";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+	};
+
+	qcom,csiphy@ca34000 {
+		qcom,clock-rates = <0 0 0 0 0 0 384000000 0 0 269333333 0
+			0 384000000 0>;
+	};
+
+	qcom,csiphy@ca35000 {
+		qcom,clock-rates = <0 0 0 0 0 0 384000000 0 0 269333333 0
+			0 384000000 0>;
+	};
+
+	qcom,csiphy@ca36000 {
+		qcom,clock-rates = <0 0 0 0 0 0 384000000 0 0 269333333 0
+			0 384000000 0>;
+	};
+
+	qcom,csid@ca30000  {
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		qcom,clock-rates = <0 0 0 0 0 0 0 384000000 384000000
+			0 0 0 0 0>;
+	};
+
+	qcom,csid@ca30400 {
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		qcom,clock-rates = <0 0 0 0 0 0 0 384000000 384000000
+			0 0 0 0 0>;
+	};
+
+	qcom,csid@ca30800 {
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		qcom,clock-rates = <0 0 0 0 0 0 0 384000000 384000000
+			0 0 0 0 0>;
+	};
+
+	qcom,csid@ca30c00 {
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		qcom,clock-rates = <0 0 0 0 0 0 0 384000000 384000000
+			0 0 0 0 0>;
+	};
+};
+
+&cci {
+	/delete-node/qcom,camera@0;
+	/delete-node/qcom,camera@1;
+	/delete-node/qcom,camera@2;
+	/delete-node/qcom,camera@3;
+	/delete-node/qcom,eeprom@0;
+	/delete-node/qcom,eeprom@1;
+	/delete-node/qcom,eeprom@2;
+	/delete-node/qcom,actuator@0;
+	/delete-node/qcom,actuator@1;
+	/delete-node/qcom,tof@0;
+	/delete-node/qcom,ois@0;
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+	};
+
+	ois0: qcom,ois@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,ois";
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 27 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+		status = "disabled";
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1750000 3300000 1352000>;
+		qcom,cam-vreg-max-voltage = <1980000 3600000 1352000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				&cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 9 0>,
+			<&pm660l_gpios 4 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1750000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1980000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 30 0>,
+			<&pm660l_gpios 4 0>,
+			<&tlmm 8 0>,
+			<&tlmm 27 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-vaf = <4>;
+		qcom,gpio-req-tbl-num = <0 1 2 3 4>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_VDIG1",
+					  "CAM_VANA1",
+					  "CAM_VAF";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom2: qcom,eeprom@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 33000000 1352000>;
+		qcom,cam-vreg-max-voltage = <1950000 36000000 1352000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 28 0>,
+			<&pm660l_gpios 3 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <90>;
+		qcom,actuator-src = <&actuator0>;
+		/*qcom,ois-src = <&ois0>;*/
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				 &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				 &cam_sensor_rear_suspend>;
+		gpios = <&tlmm 13 0>,
+			<&tlmm 9 0>,
+			<&pm660l_gpios 4 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk0_clk_src>,
+				<&clock_mmss clk_mmss_camss_mclk0_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <90>;
+		qcom,actuator-src = <&actuator1>;
+		qcom,eeprom-src = <&eeprom1>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 15 0>,
+			<&tlmm 30 0>,
+			<&pm660l_gpios 4 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_VDIG1",
+					  "CAM_VANA1";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk2_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk2_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <270>;
+		/*qcom,eeprom-src = <&eeprom2>;*/
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 14 0>,
+			<&tlmm 28 0>,
+			<&pm660l_gpios 3 0>,
+			<&tlmm 8 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss clk_mclk1_clk_src>,
+			<&clock_mmss clk_mmss_camss_mclk1_clk>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
+
+&pm660l_gpios {
+	gpio@c300 { /* GPIO4 -CAMERA SENSOR 0 VDIG*/
+		qcom,mode = <1>;                /* Output */
+		qcom,pull = <5>;                /* No Pull */
+		qcom,vin-sel = <0>;             /* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;             /* GPIO */
+		qcom,invert = <0>;              /* Invert */
+		qcom,master-en = <1>;           /* Enable GPIO */
+		status = "ok";
+	};
+
+	gpio@c200 { /* GPIO3 -CAMERA SENSOR 2 VDIG*/
+		qcom,mode = <1>;                /* Output */
+		qcom,pull = <5>;                /* No Pull */
+		qcom,vin-sel = <0>;             /* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;             /* GPIO */
+		qcom,invert = <0>;              /* Invert */
+		qcom,master-en = <1>;           /* Enable GPIO */
+		status = "ok";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-interposer-pm660.dtsi b/arch/arm64/boot/dts/qcom/msm8998-interposer-pm660.dtsi
new file mode 100644
index 000000000000..f4ff7c401a98
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-interposer-pm660.dtsi
@@ -0,0 +1,264 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&slim_aud {
+	tasha_codec {
+		/delete-property/cdc-vdd-buck-supply;
+		/delete-property/cdc-buck-sido-supply;
+		/delete-property/cdc-vdd-tx-h-supply;
+		/delete-property/cdc-vdd-rx-h-supply;
+		/delete-property/cdc-vddpx-1-supply;
+	};
+
+	tavil_codec {
+		/delete-property/cdc-vdd-buck-supply;
+		/delete-property/cdc-buck-sido-supply;
+		/delete-property/cdc-vdd-tx-h-supply;
+		/delete-property/cdc-vdd-rx-h-supply;
+		/delete-property/cdc-vddpx-1-supply;
+	};
+};
+
+
+&led_flash0 {
+	/delete-property/qcom,flash-source;
+	/delete-property/qcom,torch-source;
+	/delete-property/qcom,switch-source;
+};
+
+&led_flash1 {
+	/delete-property/qcom,flash-source;
+	/delete-property/qcom,torch-source;
+	/delete-property/qcom,switch-source;
+};
+
+
+&eeprom1 {
+	/delete-property/cam_vio-supply;
+	/delete-property/cam_vana-supply;
+	/delete-property/cam_vdig-supply;
+};
+
+&eeprom2 {
+	/delete-property/cam_vio-supply;
+	/delete-property/cam_vana-supply;
+	/delete-property/cam_vdig-supply;
+	/delete-property/gpios;
+};
+
+&tof0 {
+	/delete-property/cam_cci-supply;
+	/delete-property/cam_laser-supply;
+	/delete-property/gpios;
+};
+
+
+&cci {
+	/delete-node/qcom,camera@1;
+	/delete-node/qcom,camera@2;
+
+};
+
+&sdhc_2 {
+	/delete-property/vdd-supply;
+	/delete-property/vdd-io-supply;
+};
+
+&i2c_5 {
+	/delete-node/synaptics@20;
+};
+
+&i2c_6 {
+	/delete-node/nq@28;
+};
+
+&i2c_7 {
+	/delete-node/qcom,smb138x@8;
+};
+
+&clock_gcc {
+	/delete-property/vdd_dig-supply;
+	/delete-property/vdd_dig_ao-supply;
+};
+
+&clock_mmss {
+	/delete-property/vdd_dig-supply;
+	/delete-property/vdd_mmsscc_mx-supply;
+};
+
+&clock_gpu {
+	/delete-property/vdd_dig-supply;
+};
+
+&clock_gfx {
+	/delete-property/vdd_mx-supply;
+	/delete-property/vdd_gpu_mx-supply;
+};
+
+&pcie0 {
+	/delete-property/vreg-1.8-supply;
+	/delete-property/vreg-0.9-supply;
+	/delete-property/vreg-cx-supply;
+};
+
+&qusb_phy0 {
+	/delete-property/vdd-supply;
+	/delete-property/vdda18-supply;
+	/delete-property/vdda33-supply;
+};
+
+&ssphy {
+	/delete-property/vdd-supply;
+	/delete-property/core-supply;
+};
+
+&usb3 {
+	/delete-property/extcon;
+};
+
+&mdss_dsi {
+	/delete-property/vdda-1p2-supply;
+	/delete-property/vdda-0p9-supply;
+};
+
+&mdss_dsi0 {
+	/delete-property/wqhd-vddio-supply;
+	/delete-property/lab-supply;
+	/delete-property/ibb-supply;
+};
+
+&mdss_dsi1 {
+	/delete-property/wqhd-vddio-supply;
+	/delete-property/lab-supply;
+	/delete-property/ibb-supply;
+};
+
+&mdss_dp_ctrl {
+	/delete-property/vdda-1p2-supply;
+	/delete-property/vdda-0p9-supply;
+	/delete-property/qcom,dp-usbpd-detection;
+};
+
+&mdss_hdmi_pll {
+	/delete-property/vdda-pll-supply;
+	/delete-property/vdda-phy-supply;
+};
+
+&apc0_cpr {
+	 /* disable aging and closed-loop */
+	/delete-property/vdd-supply;
+	/delete-property/qcom,cpr-enable;
+	/delete-property/qcom,cpr-hw-closed-loop;
+	/delete-property/qcom,cpr-aging-ref-voltage;
+};
+
+&apc0_pwrcl_vreg {
+	/delete-property/qcom,cpr-aging-max-voltage-adjustment;
+	/delete-property/qcom,cpr-aging-ref-corner;
+	/delete-property/qcom,cpr-aging-ro-scaling-factor;
+	/delete-property/qcom,allow-aging-voltage-adjustment;
+	/delete-property/qcom,allow-aging-open-loop-voltage-adjustment;
+};
+
+&apc1_cpr {
+	/* disable aging and closed-loop */
+	/delete-property/vdd-supply;
+	/delete-property/qcom,cpr-enable;
+	/delete-property/qcom,cpr-hw-closed-loop;
+	/delete-property/qcom,cpr-aging-ref-voltage;
+};
+
+&apc1_perfcl_vreg {
+	/delete-property/qcom,cpr-aging-max-voltage-adjustment;
+	/delete-property/qcom,cpr-aging-ref-corner;
+	/delete-property/qcom,cpr-aging-ro-scaling-factor;
+	/delete-property/qcom,allow-aging-voltage-adjustment;
+	/delete-property/qcom,allow-aging-open-loop-voltage-adjustment;
+};
+
+&gfx_cpr {
+	status = "disabled";
+
+	/* disable aging and closed-loop */
+	/delete-property/vdd-supply;
+	/delete-property/qcom,cpr-enable;
+	/delete-property/qcom,cpr-aging-ref-voltage;
+	/delete-property/qcom,cpr-aging-allowed-reg-mask;
+	/delete-property/qcom,cpr-aging-allowed-reg-value;
+};
+
+&gfx_vreg {
+	status = "disabled";
+
+	/delete-property/qcom,cpr-aging-max-voltage-adjustment;
+	/delete-property/qcom,cpr-aging-ref-corner;
+	/delete-property/qcom,cpr-aging-ro-scaling-factor;
+	/delete-property/qcom,allow-aging-voltage-adjustment;
+	/delete-property/qcom,allow-aging-open-loop-voltage-adjustment;
+};
+
+&soc {
+	/delete-node/gpio_keys;
+	/delete-node/qcom,bcl;
+	/delete-node/qcom,msm-thermal;
+	/delete-node/qcom,spss@1d00000;
+	/delete-node/qcom,wil6210;
+	/delete-node/qcom,rpm-smd;
+	/delete-node/qcom,spmi@800f000;
+
+	rpm_bus: qcom,rpm-smd {
+		compatible = "qcom,rpm-glink";
+		qcom,glink-edge = "rpm";
+		rpm-channel-name = "rpm_requests";
+	};
+
+	spmi_bus: qcom,spmi@800f000 {
+		compatible = "qcom,spmi-pmic-arb";
+		reg =	<0x800f000 0x1000>,
+			<0x8400000 0x1000000>,
+			<0x9400000 0x1000000>,
+			<0xa400000 0x220000>,
+			<0x800a000 0x3000>;
+		reg-names = "core", "chnls", "obsrvr", "intr", "cnfg";
+		interrupt-names = "periph_irq";
+		interrupts = <GIC_SPI 326 IRQ_TYPE_NONE>;
+		qcom,ee = <0>;
+		qcom,channel = <0>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+		interrupt-controller;
+		#interrupt-cells = <4>;
+		cell-index = <0>;
+	};
+};
+
+#include "msm-pm660.dtsi"
+#include "msm-pm660l.dtsi"
+#include "msm-pm660-rpm-regulator.dtsi"
+#include "msm-pm660l-rpm-regulator.dtsi"
+#include "sdm660-regulator.dtsi"
+
+&soc {
+	/* remove sdm660 MMSS CPR Controller node */
+	/delete-node/cpr4-ctrl@05061000;
+	/delete-node/regulator@01fcf004;
+};
+
+&rpm_bus {
+	rpm-regulator-ldob9 {
+		qcom,resource-name = "rwsc";
+	};
+
+	rpm-regulator-ldob10 {
+		qcom,resource-name = "rwsm";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-interposer-sdm660-audio.dtsi b/arch/arm64/boot/dts/qcom/msm8998-interposer-sdm660-audio.dtsi
new file mode 100644
index 000000000000..f5ab8078ec13
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-interposer-sdm660-audio.dtsi
@@ -0,0 +1,70 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm-audio.dtsi"
+#include "sdm660-audio.dtsi"
+
+&pm660l_3 {
+	/delete-node/analog-codec;
+};
+
+&soc {
+	/delete-node/msm-sdw-codec@152c1000;
+	/delete-node/sound;
+	/delete-node/sdw_clk_data_pinctrl;
+};
+
+&slim_aud {
+	tasha_codec {
+		clocks = <&clock_audio clk_audio_pmi_clk>,
+			<&clock_audio clk_audio_ap_clk2>;
+	};
+	tavil_codec {
+		clocks = <&clock_audio_lnbb clk_audio_pmi_lnbb_clk>;
+	};
+};
+
+&tasha_hph_en0 {
+	/delete-property/pinctrl-0;
+	/delete-property/pinctrl-1;
+};
+
+&tasha_hph_en1 {
+	/delete-property/pinctrl-0;
+	/delete-property/pinctrl-1;
+};
+
+&clock_audio {
+	qcom,audio-ref-clk-gpio = <&pm660_gpios 3 0>;
+	clocks = <&clock_gcc clk_div_clk1>;
+	pinctrl-0 = <&spkr_i2s_clk_sleep>;
+	pinctrl-1 = <&spkr_i2s_clk_active>;
+};
+
+&clock_audio_lnbb {
+	clocks = <&clock_gcc clk_ln_bb_clk2>;
+};
+
+&wcd_rst_gpio {
+	qcom,cdc-rst-n-gpio = <&tlmm 64 0>;
+	pinctrl-0 = <&cdc_reset_active>;
+	pinctrl-1 = <&cdc_reset_sleep>;
+};
+
+&wcd9xxx_intc {
+	interrupt-parent = <&tlmm>;
+	qcom,gpio-connect = <&tlmm 54 0>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&wcd_intr_default>;
+	/delete-property/interrupts;
+	/delete-property/interrupt-names;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-interposer-sdm660-cdp.dtsi b/arch/arm64/boot/dts/qcom/msm8998-interposer-sdm660-cdp.dtsi
new file mode 100644
index 000000000000..40bb8727cc30
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-interposer-sdm660-cdp.dtsi
@@ -0,0 +1,512 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8998-pinctrl.dtsi"
+#include "msm8998-camera-sensor-cdp.dtsi"
+
+&blsp1_uart3_hs {
+	status = "ok";
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm660l_l1>;
+	vdda-pll-supply = <&pm660_l1>;
+	vddp-ref-clk-supply = <&pm660_l1>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14600>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm660l_l4>;
+	vccq2-supply = <&pm660_l8>;
+	vcc-max-microamp = <500000>;
+	vccq2-max-microamp = <600000>;
+	status = "ok";
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm660l_l5>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm660l_l2>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000
+				50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x1>;
+
+	status = "ok";
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&pm8998_gpios {
+	/* GPIO 5 for Home Key */
+	gpio@c400 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 6 for Vol+ Key */
+	gpio@c500 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 7 for Snapshot Key */
+	gpio@c600 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 8 for Focus Key */
+	gpio@c700 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	gpio@cc00 { /* GPIO 13 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <0>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <3>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	/* GPIO 21 (NFC_CLK_REQ) */
+	gpio@d400 {
+		qcom,mode = <0>;
+		qcom,vin-sel = <1>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&i2c_5 {
+	status = "okay";
+	synaptics@20 {
+		compatible = "synaptics,dsx";
+		reg = <0x20>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <125 0x2008>;
+		vdd-supply = <&pm8998_l6>;
+		avdd-supply = <&pm8998_l28>;
+		synaptics,vdd-voltage = <1808000 1808000>;
+		synaptics,avdd-voltage = <3008000 3008000>;
+		synaptics,vdd-current = <40000>;
+		synaptics,avdd-current = <20000>;
+		pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+		pinctrl-0 = <&ts_active>;
+		pinctrl-1 = <&ts_int_suspend &ts_reset_suspend>;
+		synaptics,display-coords = <0 0 1439 2559>;
+		synaptics,panel-coords = <0 0 1439 2559>;
+		synaptics,reset-gpio = <&tlmm 89 0x00>;
+		synaptics,irq-gpio = <&tlmm 125 0x2008>;
+		synaptics,disable-gpios;
+		synaptics,fw-name = "PR1702898-s3528t_60QHD_00400001.img";
+	};
+};
+
+&i2c_6 { /* BLSP1 QUP6 (NFC) */
+	status = "okay";
+	nq@28 {
+		compatible = "qcom,nq-nci";
+		reg = <0x28>;
+		qcom,nq-irq = <&tlmm 92 0x00>;
+		qcom,nq-ven = <&tlmm 12 0x00>;
+		qcom,nq-firm = <&tlmm 93 0x00>;
+		qcom,nq-clkreq = <&pm8998_gpios 21 0x00>;
+		qcom,nq-esepwr = <&tlmm 116 0x00>;
+		interrupt-parent = <&tlmm>;
+		qcom,clk-src = "BBCLK3";
+		interrupts = <92 0>;
+		interrupt-names = "nfc_irq";
+		pinctrl-names = "nfc_active", "nfc_suspend";
+		pinctrl-0 = <&nfc_int_active &nfc_enable_active>;
+		pinctrl-1 = <&nfc_int_suspend &nfc_enable_suspend>;
+		clocks = <&clock_gcc clk_ln_bb_clk3_pin>;
+		clock-names = "ref_clk";
+	};
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+	vdda-1p2-supply = <&pm660_l1>;
+	vdda-0p9-supply = <&pm660l_l1>;
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_truly_video>;
+	wqhd-vddio-supply = <&pm660_l11>;
+	lab-supply = <&lcdb_ldo_vreg>;
+	ibb-supply = <&lcdb_ncp_vreg>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,panel-mode-gpio = <&tlmm 91 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_truly_video>;
+	wqhd-vddio-supply = <&pm660_l11>;
+	lab-supply = <&lcdb_ldo_vreg>;
+	ibb-supply = <&lcdb_ncp_vreg>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,panel-mode-gpio = <&tlmm 91 0>;
+};
+
+&labibb {
+	status = "ok";
+	qpnp,qpnp-labibb-mode = "lcd";
+};
+
+&pmi8998_wled {
+	qcom,led-strings-list = [00 01];
+};
+
+&dsi_dual_nt35597_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_truly_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_truly_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35597_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "single_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35597_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "single_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_4k_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_4k_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_jdi_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,5v-boost-gpio = <&tlmm 51 0>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_jdi_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,5v-boost-gpio = <&tlmm 51 0>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled;
+	qcom,panel-roi-alignment = <4 2 4 2 20 20>;
+};
+
+&dsi_sharp_1080_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_jdi_1080p_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_no_labibb>;
+	qcom,5v-boost-gpio = <&tlmm 51 0>;
+};
+
+&dsi_dual_sharp_1080_120hz_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&mdss_hdmi_tx {
+	pinctrl-names = "hdmi_hpd_active", "hdmi_ddc_active", "hdmi_cec_active",
+				"hdmi_active", "hdmi_sleep";
+	pinctrl-0 = <&mdss_hdmi_5v_active  &mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_suspend &mdss_hdmi_cec_suspend>;
+	pinctrl-1 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_active &mdss_hdmi_cec_suspend>;
+	pinctrl-2 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+			&mdss_hdmi_cec_active &mdss_hdmi_ddc_suspend>;
+	pinctrl-3 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_active &mdss_hdmi_cec_active>;
+	pinctrl-4 = <&mdss_hdmi_5v_suspend &mdss_hdmi_hpd_suspend
+			&mdss_hdmi_ddc_suspend &mdss_hdmi_cec_suspend>;
+};
+
+&mdss_dp_ctrl {
+	vdda-1p2-supply = <&pm660_l1>;
+	vdda-0p9-supply = <&pm660l_l1>;
+	pinctrl-names = "mdss_dp_active", "mdss_dp_sleep";
+	pinctrl-0 = <&mdss_dp_aux_active &mdss_dp_usbplug_cc_active>;
+	pinctrl-1 = <&mdss_dp_aux_suspend &mdss_dp_usbplug_cc_suspend>;
+	qcom,aux-en-gpio = <&tlmm 77 0>;
+	qcom,aux-sel-gpio = <&tlmm 78 0>;
+	qcom,usbplug-cc-gpio = <&tlmm 38 0>;
+};
+
+&pmi8998_charger {
+	qcom,batteryless-platform;
+};
+
+&pmi8998_haptics {
+	status = "okay";
+};
+
+&pm8998_vadc {
+	chan@83 {
+		label = "vph_pwr";
+		reg = <0x83>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@85 {
+		label = "vcoin";
+		reg = <0x85>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@4c {
+		label = "xo_therm";
+		reg = <0x4c>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@4d {
+		label = "msm_therm";
+		reg = <0x4d>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@51 {
+		label = "quiet_therm";
+		reg = <0x51>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8998_adc_tm {
+	chan@83 {
+		label = "vph_pwr";
+		reg = <0x83>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,btm-channel-number = <0x60>;
+	};
+
+	chan@4d {
+		label = "msm_therm";
+		reg = <0x4d>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@51 {
+		label = "quiet_therm";
+		reg = <0x51>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@4c {
+		label = "xo_therm";
+		reg = <0x4c>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+};
+
+&wil6210 {
+	status = "ok";
+};
+
+&soc {
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+		status = "okay";
+
+		home {
+			label = "home";
+			gpios = <&pm8998_gpios 5 0x1>;
+			linux,input-type = <1>;
+			linux,code = <102>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+
+		};
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8998_gpios 6 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_snapshot {
+			label = "cam_snapshot";
+			gpios = <&pm8998_gpios 7 0x1>;
+			linux,input-type = <1>;
+			linux,code = <766>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_focus {
+			label = "cam_focus";
+			gpios = <&pm8998_gpios 8 0x1>;
+			linux,input-type = <1>;
+			linux,code = <528>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-interposer-sdm660-mtp.dtsi b/arch/arm64/boot/dts/qcom/msm8998-interposer-sdm660-mtp.dtsi
new file mode 100644
index 000000000000..d652b456cb1c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-interposer-sdm660-mtp.dtsi
@@ -0,0 +1,505 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/irq.h>
+#include "msm8998-pinctrl.dtsi"
+#include "msm8998-camera-sensor-mtp.dtsi"
+
+&blsp1_uart3_hs {
+	status = "ok";
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm660l_l1>;
+	vdda-pll-supply = <&pm660_l1>;
+	vddp-ref-clk-supply = <&pm660_l1>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14600>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm660l_l4>;
+	vccq2-supply = <&pm660_l8>;
+	vcc-max-microamp = <500000>;
+	vccq2-max-microamp = <600000>;
+	status = "ok";
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm660l_l5>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm660l_l2>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000
+				50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x1>;
+
+	status = "ok";
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&pm8998_gpios {
+	/* GPIO 6 for Vol+ Key */
+	gpio@c500 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 7 for Snapshot Key */
+	gpio@c600 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 8 for Focus Key */
+	gpio@c700 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	gpio@cc00 { /* GPIO 13 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <0>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <3>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	/* GPIO 21 (NFC_CLK_REQ) */
+	gpio@d400 {
+		qcom,mode = <0>;
+		qcom,vin-sel = <1>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	/* GPIO 18 SMB138X */
+	gpio@d100 {
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&i2c_5 {
+	status = "okay";
+	synaptics@20 {
+		compatible = "synaptics,dsx";
+		reg = <0x20>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <125 0x2008>;
+		vdd-supply = <&pm8998_l6>;
+		avdd-supply = <&pm8998_l28>;
+		synaptics,vdd-voltage = <1808000 1808000>;
+		synaptics,avdd-voltage = <3008000 3008000>;
+		synaptics,vdd-current = <40000>;
+		synaptics,avdd-current = <20000>;
+		pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+		pinctrl-0 = <&ts_active>;
+		pinctrl-1 = <&ts_int_suspend &ts_reset_suspend>;
+		synaptics,display-coords = <0 0 1439 2559>;
+		synaptics,panel-coords = <0 0 1439 2559>;
+		synaptics,reset-gpio = <&tlmm 89 0x00>;
+		synaptics,irq-gpio = <&tlmm 125 0x2008>;
+		synaptics,disable-gpios;
+		synaptics,fw-name = "PR1702898-s3528t_60QHD_00400001.img";
+	};
+};
+
+&i2c_6 { /* BLSP1 QUP6 (NFC) */
+	status = "okay";
+	nq@28 {
+		compatible = "qcom,nq-nci";
+		reg = <0x28>;
+		qcom,nq-irq = <&tlmm 92 0x00>;
+		qcom,nq-ven = <&tlmm 12 0x00>;
+		qcom,nq-firm = <&tlmm 93 0x00>;
+		qcom,nq-clkreq = <&pm8998_gpios 21 0x00>;
+		qcom,nq-esepwr = <&tlmm 116 0x00>;
+		interrupt-parent = <&tlmm>;
+		qcom,clk-src = "BBCLK3";
+		interrupts = <92 0>;
+		interrupt-names = "nfc_irq";
+		pinctrl-names = "nfc_active", "nfc_suspend";
+		pinctrl-0 = <&nfc_int_active &nfc_enable_active>;
+		pinctrl-1 = <&nfc_int_suspend &nfc_enable_suspend>;
+		clocks = <&clock_gcc clk_ln_bb_clk3_pin>;
+		clock-names = "ref_clk";
+	};
+};
+
+&mdss_hdmi_tx {
+	pinctrl-names = "hdmi_hpd_active", "hdmi_ddc_active", "hdmi_cec_active",
+				"hdmi_active", "hdmi_sleep";
+	pinctrl-0 = <&mdss_hdmi_5v_active  &mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_suspend &mdss_hdmi_cec_suspend>;
+	pinctrl-1 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_active &mdss_hdmi_cec_suspend>;
+	pinctrl-2 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+			&mdss_hdmi_cec_active &mdss_hdmi_ddc_suspend>;
+	pinctrl-3 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_active &mdss_hdmi_cec_active>;
+	pinctrl-4 = <&mdss_hdmi_5v_suspend &mdss_hdmi_hpd_suspend
+			&mdss_hdmi_ddc_suspend &mdss_hdmi_cec_suspend>;
+};
+
+&mdss_dp_ctrl {
+	vdda-1p2-supply = <&pm660_l1>;
+	vdda-0p9-supply = <&pm660l_l1>;
+	pinctrl-names = "mdss_dp_active", "mdss_dp_sleep";
+	pinctrl-0 = <&mdss_dp_aux_active &mdss_dp_usbplug_cc_active>;
+	pinctrl-1 = <&mdss_dp_aux_suspend &mdss_dp_usbplug_cc_suspend>;
+	qcom,aux-en-gpio = <&tlmm 77 0>;
+	qcom,aux-sel-gpio = <&tlmm 78 0>;
+	qcom,usbplug-cc-gpio = <&tlmm 38 0>;
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+	vdda-1p2-supply = <&pm660_l1>;
+	vdda-0p9-supply = <&pm660l_l1>;
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_truly_video>;
+	wqhd-vddio-supply = <&pm660_l11>;
+	lab-supply = <&lcdb_ldo_vreg>;
+	ibb-supply = <&lcdb_ncp_vreg>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,panel-mode-gpio = <&tlmm 91 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_truly_video>;
+	wqhd-vddio-supply = <&pm660_l11>;
+	lab-supply = <&lcdb_ldo_vreg>;
+	ibb-supply = <&lcdb_ncp_vreg>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,panel-mode-gpio = <&tlmm 91 0>;
+};
+
+&labibb {
+	status = "ok";
+	qpnp,qpnp-labibb-mode = "lcd";
+};
+
+&pmi8998_wled {
+	qcom,led-strings-list = [00 01];
+};
+
+&dsi_dual_nt35597_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_truly_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_truly_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35597_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "single_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35597_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "single_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_4k_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_4k_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_jdi_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,5v-boost-gpio = <&tlmm 51 0>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_jdi_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,5v-boost-gpio = <&tlmm 51 0>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_1080_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_jdi_1080p_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_no_labibb>;
+	qcom,5v-boost-gpio = <&tlmm 51 0>;
+};
+
+&dsi_dual_sharp_1080_120hz_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&pmi8998_haptics {
+	status = "okay";
+};
+
+&pm8998_vadc {
+	chan@83 {
+		label = "vph_pwr";
+		reg = <0x83>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@85 {
+		label = "vcoin";
+		reg = <0x85>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@4c {
+		label = "xo_therm";
+		reg = <0x4c>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@4d {
+		label = "msm_therm";
+		reg = <0x4d>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@51 {
+		label = "quiet_therm";
+		reg = <0x51>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8998_adc_tm {
+	chan@83 {
+		label = "vph_pwr";
+		reg = <0x83>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,btm-channel-number = <0x60>;
+	};
+
+	chan@4d {
+		label = "msm_therm";
+		reg = <0x4d>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@51 {
+		label = "quiet_therm";
+		reg = <0x51>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@4c {
+		label = "xo_therm";
+		reg = <0x4c>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+};
+
+&wil6210 {
+	status = "ok";
+};
+
+&soc {
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+		status = "okay";
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8998_gpios 6 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_snapshot {
+			label = "cam_snapshot";
+			gpios = <&pm8998_gpios 7 0x1>;
+			linux,input-type = <1>;
+			linux,code = <766>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_focus {
+			label = "cam_focus";
+			gpios = <&pm8998_gpios 8 0x1>;
+			linux,input-type = <1>;
+			linux,code = <528>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+};
+
+/{
+	mtp_batterydata: qcom,battery-data {
+		qcom,batt-id-range-pct = <15>;
+		#include "fg-gen3-batterydata-itech-3000mah.dtsi"
+		#include "fg-gen3-batterydata-ascent-3450mah.dtsi"
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-interposer-sdm660.dtsi b/arch/arm64/boot/dts/qcom/msm8998-interposer-sdm660.dtsi
new file mode 100644
index 000000000000..4a47942ce5dd
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-interposer-sdm660.dtsi
@@ -0,0 +1,3155 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "skeleton64.dtsi"
+#include <dt-bindings/clock/msm-clocks-8998.h>
+#include <dt-bindings/regulator/qcom,rpm-smd-regulator.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998";
+	compatible = "qcom,msm8998";
+	qcom,msm-id = <292 0x0>;
+	interrupt-parent = <&intc>;
+
+	aliases {
+		serial0 = &uartblsp2dm1;
+		pci-domain0 = &pcie0;
+		sdhc2 = &sdhc_2; /* SDC2 SD card slot */
+	};
+
+	psci {
+		compatible = "arm,psci-1.0";
+		method = "smc";
+	};
+
+	chosen {
+		stdout-path = "serial0";
+		bootargs = "rcupdate.rcu_expedited=1";
+	};
+
+	cpus {
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		CPU0: cpu@0 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x0>;
+			qcom,limits-info = <&mitigation_profile0>;
+			qcom,lmh-dcvs = <&lmh_dcvs0>;
+			enable-method = "psci";
+			efficiency = <1024>;
+			next-level-cache = <&L2_0>;
+			qcom,ea = <&ea0>;
+			L2_0: l2-cache {
+				compatible = "arm,arch-cache";
+				cache-level = <2>;
+				/* A53 L2 dump not supported */
+				qcom,dump-size = <0x0>;
+			};
+			L1_I_0: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_0: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+		};
+
+		CPU1: cpu@1 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x1>;
+			qcom,limits-info = <&mitigation_profile1>;
+			qcom,lmh-dcvs = <&lmh_dcvs0>;
+			enable-method = "psci";
+			efficiency = <1024>;
+			next-level-cache = <&L2_0>;
+			qcom,ea = <&ea1>;
+			L1_I_1: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_1: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+		};
+
+		CPU2: cpu@2 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x2>;
+			qcom,limits-info = <&mitigation_profile2>;
+			qcom,lmh-dcvs = <&lmh_dcvs0>;
+			enable-method = "psci";
+			efficiency = <1024>;
+			next-level-cache = <&L2_0>;
+			qcom,ea = <&ea2>;
+			L1_I_2: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_2: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+		};
+
+		CPU3: cpu@3 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x3>;
+			qcom,limits-info = <&mitigation_profile3>;
+			qcom,lmh-dcvs = <&lmh_dcvs0>;
+			enable-method = "psci";
+			efficiency = <1024>;
+			next-level-cache = <&L2_0>;
+			qcom,ea = <&ea3>;
+			L1_I_3: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_3: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+		};
+
+		CPU4: cpu@100 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x100>;
+			qcom,limits-info = <&mitigation_profile4>;
+			qcom,lmh-dcvs = <&lmh_dcvs1>;
+			enable-method = "psci";
+			efficiency = <1536>;
+			next-level-cache = <&L2_1>;
+			qcom,ea = <&ea4>;
+			L2_1: l2-cache {
+				compatible = "arm,arch-cache";
+				cache-level = <2>;
+			};
+			L1_I_100: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_D_100: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+		};
+
+		CPU5: cpu@101 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x101>;
+			qcom,limits-info = <&mitigation_profile5>;
+			qcom,lmh-dcvs = <&lmh_dcvs1>;
+			enable-method = "psci";
+			efficiency = <1536>;
+			next-level-cache = <&L2_1>;
+			qcom,ea = <&ea5>;
+			L1_I_101: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_D_101: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+		};
+
+		CPU6: cpu@102 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x102>;
+			qcom,limits-info = <&mitigation_profile6>;
+			qcom,lmh-dcvs = <&lmh_dcvs1>;
+			enable-method = "psci";
+			efficiency = <1536>;
+			next-level-cache = <&L2_1>;
+			qcom,ea = <&ea6>;
+			L1_I_102: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_D_102: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+		};
+
+		CPU7: cpu@103 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x103>;
+			qcom,limits-info = <&mitigation_profile7>;
+			qcom,lmh-dcvs = <&lmh_dcvs1>;
+			enable-method = "psci";
+			efficiency = <1536>;
+			next-level-cache = <&L2_1>;
+			qcom,ea = <&ea7>;
+			L1_I_103: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_D_103: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+		};
+
+		cpu-map {
+			cluster0 {
+				core0 {
+					cpu = <&CPU0>;
+				};
+
+				core1 {
+					cpu = <&CPU1>;
+				};
+
+				core2 {
+					cpu = <&CPU2>;
+				};
+
+				core3 {
+					cpu = <&CPU3>;
+				};
+			};
+
+			cluster1 {
+				core0 {
+					cpu = <&CPU4>;
+				};
+
+				core1 {
+					cpu = <&CPU5>;
+				};
+
+				core2 {
+					cpu = <&CPU6>;
+				};
+
+				core3 {
+					cpu = <&CPU7>;
+				};
+			};
+		};
+	};
+
+	soc: soc { };
+
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		removed_regions: removed_regions@85800000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0 0x85800000 0 0x3700000>;
+		};
+
+		pil_slpi_mem: pil_slpi_region@93800000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0 0x93800000 0 0xf00000>;
+		};
+
+		pil_video_mem: pil_video_region@93300000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0 0x93300000 0 0x500000>;
+		};
+
+		pil_adsp_mem: pil_adsp_region@91900000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0 0x91900000 0 0x1a00000>;
+		};
+
+		modem_mem: modem_region@8ac00000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0 0x8ac00000 0 0x6d00000>;
+		};
+
+		spss_mem: spss_region@8ab00000 { /* for SPSS-PIL */
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0 0x8ab00000 0 0x100000>;
+		};
+
+		adsp_mem: adsp_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0 0x00000000 0 0xffffffff>;
+			reusable;
+			alignment = <0 0x400000>;
+			size = <0 0x800000>;
+		};
+
+		qseecom_mem: qseecom_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0 0x00000000 0 0xffffffff>;
+			reusable;
+			alignment = <0 0x400000>;
+			size = <0 0x1400000>;
+		};
+
+		sp_mem: sp_region {  /* SPSS-HLOS ION shared mem */
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0 0x00000000 0 0xffffffff>; /* 32-bit */
+			reusable;
+			alignment = <0 0x100000>;
+			size = <0 0x800000>;
+		};
+
+		secure_display_memory: secure_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0 0x00000000 0 0xffffffff>;
+			reusable;
+			alignment = <0 0x200000>;
+			size = <0 0x5c00000>;
+		};
+
+		/* global autoconfigured region for contiguous allocations */
+		linux,cma {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0 0x00000000 0 0xffffffff>;
+			reusable;
+			alignment = <0 0x400000>;
+			size = <0 0x2000000>;
+			linux,cma-default;
+		};
+
+		cont_splash_mem: splash_region@9d600000 {
+			reg = <0x0 0x9d600000 0x0 0x02400000>;
+			label = "cont_splash_mem";
+		};
+	};
+
+	bluetooth: bt_wcn3990 {
+		compatible = "qca,wcn3990";
+		qca,bt-vdd-core-supply = <&pm660_l9_pin_ctrl>;
+		qca,bt-vdd-pa-supply = <&pm660_l6_pin_ctrl>;
+		qca,bt-vdd-ldo-supply = <&pm660_l19_pin_ctrl>;
+		qca,bt-chip-pwd-supply = <&pm660l_bob_pin1>;
+		clocks = <&clock_gcc clk_rf_clk1>;
+		clock-names = "rf_clk1";
+
+		qca,bt-vdd-core-voltage-level = <1800000 1900000>;
+		qca,bt-vdd-pa-voltage-level = <1304000 1370000>;
+		qca,bt-vdd-ldo-voltage-level = <3312000 3400000>;
+		qca,bt-chip-pwd-voltage-level = <3600000 3600000>;
+
+		qca,bt-vdd-core-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-pa-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-ldo-current-level = <1>; /* LPM/PFM */
+	};
+};
+
+#include "msm8998-smp2p.dtsi"
+#include "msm-gdsc-8998.dtsi"
+
+&soc {
+	#address-cells = <1>;
+	#size-cells = <1>;
+	ranges = <0 0 0 0xffffffff>;
+	compatible = "simple-bus";
+
+	intc: interrupt-controller@17a00000 {
+		compatible = "arm,gic-v3";
+		reg = <0x17a00000 0x10000>,       /* GICD */
+		      <0x17b00000 0x100000>;      /* GICR * 8 */
+		#interrupt-cells = <3>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		interrupt-controller;
+		#redistributor-regions = <1>;
+		redistributor-stride = <0x0 0x20000>;
+		interrupts = <1 9 4>;
+
+		gic-its@0x17a20000{
+			compatible = "arm,gic-v3-its";
+			msi-contoller;
+			reg = <0x17a20000 0x20000>;
+		};
+	};
+
+	timer {
+		compatible = "arm,armv8-timer";
+		interrupts = <1 1 0xf08>,
+			     <1 2 0xf08>,
+			     <1 3 0xf08>,
+			     <1 0 0xf08>;
+		clock-frequency = <19200000>;
+	};
+
+	restart@10ac000 {
+		compatible = "qcom,pshold";
+		reg = <0x10ac000 0x4>,
+		      <0x1fd3000 0x4>;
+		reg-names = "pshold-base", "tcsr-boot-misc-detect";
+	};
+
+	spmi_bus: qcom,spmi@800f000 {
+		compatible = "qcom,spmi-pmic-arb";
+		reg =	<0x800f000 0x1000>,
+			<0x8400000 0x1000000>,
+			<0x9400000 0x1000000>,
+			<0xa400000 0x220000>,
+			<0x800a000 0x3000>;
+		reg-names = "core", "chnls", "obsrvr", "intr", "cnfg";
+		interrupt-names = "periph_irq";
+		interrupts = <GIC_SPI 326 IRQ_TYPE_NONE>;
+		qcom,ee = <0>;
+		qcom,channel = <0>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+		interrupt-controller;
+		#interrupt-cells = <4>;
+		cell-index = <0>;
+	};
+
+	qcom,sps {
+		compatible = "qcom,msm_sps_4k";
+		qcom,device-type = <3>;
+		qcom,pipe-attr-ee;
+	};
+
+	uartblsp1dm1: serial@0c170000 {
+		compatible = "qcom,msm-uartdm-v1.4", "qcom,msm-uartdm";
+		reg = <0xc170000 0x1000>;
+		interrupts = <0 108 0>;
+		status = "disabled";
+		clocks = <&clock_gcc clk_gcc_blsp1_uart2_apps_clk>,
+			 <&clock_gcc clk_gcc_blsp1_ahb_clk>;
+		clock-names = "core", "iface";
+	};
+
+	uartblsp2dm1: serial@0c1b0000 {
+		compatible = "qcom,msm-uartdm-v1.4", "qcom,msm-uartdm";
+		reg = <0xc1b0000 0x1000>;
+		interrupts = <0 114 0>;
+		status = "disabled";
+		clocks = <&clock_gcc clk_gcc_blsp2_uart2_apps_clk>,
+			 <&clock_gcc clk_gcc_blsp2_ahb_clk>;
+		clock-names = "core", "iface";
+	};
+
+	slim_aud: slim@171c0000 {
+		cell-index = <1>;
+		compatible = "qcom,slim-ngd";
+		reg = <0x171c0000 0x2C000>,
+			<0x17184000 0x32000>;
+		reg-names = "slimbus_physical", "slimbus_bam_physical";
+		interrupts = <0 163 0>, <0 164 0>;
+		interrupt-names = "slimbus_irq", "slimbus_bam_irq";
+		qcom,apps-ch-pipes = <0x00001f80>;
+		qcom,ea-pc = <0x210>;
+	};
+
+	slim_qca: slim@17240000 {
+		status = "ok";
+		cell-index = <3>;
+		compatible = "qcom,slim-ngd";
+		reg = <0x17240000 0x2C000>,
+			<0x17204000 0x26000>;
+		reg-names = "slimbus_physical", "slimbus_bam_physical";
+		interrupts = <0 291 0>, <0 292 0>;
+		interrupt-names = "slimbus_irq", "slimbus_bam_irq";
+
+		/* Slimbus Slave DT for WCN3990 */
+		btfmslim_codec: wcn3990 {
+			compatible = "qcom,btfmslim_slave";
+			elemental-addr = [00 01 20 02 17 02];
+			qcom,btfm-slim-ifd = "btfmslim_slave_ifd";
+			qcom,btfm-slim-ifd-elemental-addr = [00 00 20 02 17 02];
+		};
+	};
+
+	timer@17920000 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		compatible = "arm,armv7-timer-mem";
+		reg = <0x17920000 0x1000>;
+		clock-frequency = <19200000>;
+
+		frame@17921000 {
+			frame-number = <0>;
+			interrupts = <0 8 0x4>,
+				     <0 7 0x4>;
+			reg = <0x17921000 0x1000>,
+			      <0x17922000 0x1000>;
+		};
+
+		frame@17923000 {
+			frame-number = <1>;
+			interrupts = <0 9 0x4>;
+			reg = <0x17923000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17924000 {
+			frame-number = <2>;
+			interrupts = <0 10 0x4>;
+			reg = <0x17924000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17925000 {
+			frame-number = <3>;
+			interrupts = <0 11 0x4>;
+			reg = <0x17925000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17926000 {
+			frame-number = <4>;
+			interrupts = <0 12 0x4>;
+			reg = <0x17926000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17927000 {
+			frame-number = <5>;
+			interrupts = <0 13 0x4>;
+			reg = <0x17927000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17928000 {
+			frame-number = <6>;
+			interrupts = <0 14 0x4>;
+			reg = <0x17928000 0x1000>;
+			status = "disabled";
+		};
+	};
+
+	cpubw: qcom,cpubw {
+		compatible = "qcom,devbw";
+		governor = "performance";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		qcom,bw-tbl =
+			<   762 /*  100 MHz */ >,
+			<  1144 /*  150 MHz */ >,
+			<  1525 /*  200 MHz */ >,
+			<  2288 /*  300 MHz */ >,
+			<  3143 /*  412 MHz */ >,
+			<  4173 /*  547 MHz */ >,
+			<  5195 /*  681 MHz */ >,
+			<  5859 /*  768 MHz */ >,
+			<  7759 /* 1017 MHz */ >,
+			<  9887 /* 1296 MHz */ >,
+			< 11863 /* 1555 MHz */ >,
+			< 13763 /* 1804 MHz */ >;
+	};
+
+	bwmon: qcom,cpu-bwmon {
+		compatible = "qcom,bimc-bwmon3";
+		reg = <0x01008000 0x300>, <0x01001000 0x200>;
+		reg-names = "base", "global_base";
+		interrupts = <0 183 4>;
+		qcom,mport = <0>;
+		qcom,target-dev = <&cpubw>;
+	};
+
+	mincpubw: qcom,mincpubw {
+		compatible = "qcom,devbw";
+		governor = "powersave";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		qcom,bw-tbl =
+			<   762 /*  100 MHz */ >,
+			<  1144 /*  150 MHz */ >,
+			<  1525 /*  200 MHz */ >,
+			<  2288 /*  300 MHz */ >,
+			<  3143 /*  412 MHz */ >,
+			<  4173 /*  547 MHz */ >,
+			<  5195 /*  681 MHz */ >,
+			<  5859 /*  768 MHz */ >,
+			<  7759 /* 1017 MHz */ >,
+			<  9887 /* 1296 MHz */ >,
+			< 11863 /* 1555 MHz */ >,
+			< 13763 /* 1804 MHz */ >;
+	};
+
+	memlat_cpu0: qcom,memlat-cpu0 {
+		compatible = "qcom,devbw";
+		governor = "powersave";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		qcom,bw-tbl =
+			<   762 /*  100 MHz */ >,
+			<  1144 /*  150 MHz */ >,
+			<  1525 /*  200 MHz */ >,
+			<  2288 /*  300 MHz */ >,
+			<  3143 /*  412 MHz */ >,
+			<  4173 /*  547 MHz */ >,
+			<  5195 /*  681 MHz */ >,
+			<  5859 /*  768 MHz */ >,
+			<  7759 /* 1017 MHz */ >,
+			<  9887 /* 1296 MHz */ >,
+			< 11863 /* 1555 MHz */ >,
+			< 13763 /* 1804 MHz */ >;
+	};
+
+	memlat_cpu4: qcom,memlat-cpu4 {
+		compatible = "qcom,devbw";
+		governor = "powersave";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		status = "ok";
+		qcom,bw-tbl =
+			<   762 /*  100 MHz */ >,
+			<  1144 /*  150 MHz */ >,
+			<  1525 /*  200 MHz */ >,
+			<  2288 /*  300 MHz */ >,
+			<  3143 /*  412 MHz */ >,
+			<  4173 /*  547 MHz */ >,
+			<  5195 /*  681 MHz */ >,
+			<  5859 /*  768 MHz */ >,
+			<  7759 /* 1017 MHz */ >,
+			<  9887 /* 1296 MHz */ >,
+			< 11863 /* 1555 MHz */ >,
+			< 13763 /* 1804 MHz */ >;
+	};
+
+	qcom,arm-memlat-mon-0 {
+		compatible = "qcom,arm-memlat-mon";
+		qcom,cpulist =	<&CPU0 &CPU1 &CPU2 &CPU3>;
+		qcom,target-dev = <&memlat_cpu0>;
+		qcom,core-dev-table =
+			<  300000 1525 >,
+			<  499200 3143 >,
+			< 1113600 4173 >,
+			< 1881600 5859 >;
+	};
+
+	qcom,arm-memlat-mon-4 {
+		compatible = "qcom,arm-memlat-mon";
+		qcom,cpulist =	<&CPU4 &CPU5 &CPU6 &CPU7>;
+		qcom,target-dev = <&memlat_cpu4>;
+		qcom,core-dev-table =
+			<  300000  1525 >,
+			<  480000  3143 >,
+			<  900000  4173 >,
+			< 1017000  7759 >,
+			< 1296000  9887 >,
+			< 1555000 11863 >,
+			< 1804000 13763 >;
+	};
+
+	devfreq_cpufreq: devfreq-cpufreq {
+		mincpubw-cpufreq {
+			target-dev = <&mincpubw>;
+			cpu-to-dev-map-0 =
+				< 1881600 1525 >;
+			cpu-to-dev-map-4 =
+				< 2016000 1525 >,
+				< 2092800 5195 >;
+		};
+	};
+
+	msm_cpufreq: qcom,msm-cpufreq {
+		compatible = "qcom,msm-cpufreq";
+		clock-names = "cpu0_clk", "cpu1_clk", "cpu2_clk",
+				"cpu3_clk", "cpu4_clk", "cpu5_clk",
+				"cpu6_clk", "cpu7_clk";
+		clocks = <&clock_cpu clk_pwrcl_clk>,
+			 <&clock_cpu clk_pwrcl_clk>,
+			 <&clock_cpu clk_pwrcl_clk>,
+			 <&clock_cpu clk_pwrcl_clk>,
+			 <&clock_cpu clk_perfcl_clk>,
+			 <&clock_cpu clk_perfcl_clk>,
+			 <&clock_cpu clk_perfcl_clk>,
+			 <&clock_cpu clk_perfcl_clk>;
+
+		qcom,governor-per-policy;
+
+		qcom,cpufreq-table-0 =
+			<  300000 >,
+			<  345600 >,
+			<  422400 >,
+			<  499200 >,
+			<  576000 >,
+			<  633600 >,
+			<  710400 >,
+			<  806400 >,
+			<  883200 >,
+			<  960000 >,
+			< 1036800 >,
+			< 1113600 >,
+			< 1190400 >,
+			< 1248000 >,
+			< 1324800 >,
+			< 1401600 >,
+			< 1478400 >,
+			< 1574400 >,
+			< 1651200 >,
+			< 1728000 >,
+			< 1804800 >,
+			< 1881600 >;
+
+		qcom,cpufreq-table-4 =
+			<  300000 >,
+			<  345600 >,
+			<  422400 >,
+			<  480000 >,
+			<  556800 >,
+			<  633600 >,
+			<  710400 >,
+			<  787200 >,
+			<  844800 >,
+			<  902400 >,
+			<  979200 >,
+			< 1056000 >,
+			< 1171200 >,
+			< 1248000 >,
+			< 1324800 >,
+			< 1401600 >,
+			< 1478400 >,
+			< 1536000 >,
+			< 1632000 >,
+			< 1708800 >,
+			< 1785600 >,
+			< 1862400 >,
+			< 1939200 >,
+			< 2016000 >,
+			< 2092800 >;
+	};
+
+	arm64-cpu-erp {
+		compatible = "arm,arm64-cpu-erp";
+		interrupts = <0 43 4>,
+			     <0 44 4>,
+			     <0 41 4>,
+			     <0 42 4>;
+
+		interrupt-names = "pri-dbe-irq",
+				  "sec-dbe-irq",
+				  "pri-ext-irq",
+				  "sec-ext-irq";
+
+		poll-delay-ms = <5000>;
+	};
+
+	clock_gcc: qcom,gcc@100000 {
+		compatible = "qcom,gcc-8998";
+		reg = <0x100000 0xb0000>;
+		reg-names = "cc_base";
+		vdd_dig-supply = <&pm8998_s1_level>;
+		vdd_dig_ao-supply = <&pm8998_s1_level_ao>;
+		#clock-cells = <1>;
+		#reset-cells = <1>;
+	};
+
+	clock_mmss: qcom,mmsscc@c8c0000 {
+		compatible = "qcom,mmsscc-8998";
+		reg = <0xc8c0000 0x40000>;
+		reg-names = "cc_base";
+		vdd_dig-supply = <&pm8998_s1_level>;
+		vdd_mmsscc_mx-supply = <&pm8998_s9_level>;
+		clock-names = "xo", "gpll0", "gpll0_div",
+				"pclk0_src", "pclk1_src",
+				"byte0_src", "byte1_src",
+				"dp_link_src", "dp_vco_div",
+				"extpclk_src";
+		clocks = <&clock_gcc clk_cxo_clk_src>,
+			 <&clock_gcc clk_gcc_mmss_gpll0_clk>,
+			 <&clock_gcc clk_gcc_mmss_gpll0_div_clk>,
+			 <&mdss_dsi0_pll clk_dsi0pll_pclk_mux>,
+			 <&mdss_dsi1_pll clk_dsi1pll_pclk_mux>,
+			 <&mdss_dsi0_pll clk_dsi0pll_byteclk_mux>,
+			 <&mdss_dsi1_pll clk_dsi1pll_byteclk_mux>,
+			 <&mdss_dp_pll clk_dp_link_2x_clk_divsel_five>,
+			 <&mdss_dp_pll clk_vco_divided_clk_src_mux>,
+			 <&mdss_hdmi_pll clk_hdmi_vco_clk>;
+		#clock-cells = <1>;
+		#reset-cells = <1>;
+	};
+
+	clock_gpu: qcom,gpucc@5065000 {
+		compatible = "qcom,gpucc-8998";
+		reg = <0x5065000 0x9000>;
+		reg-names = "cc_base";
+		vdd_dig-supply = <&pm8998_s1_level>;
+		clock-names = "xo_ao", "gpll0";
+		clocks = <&clock_gcc clk_cxo_clk_src_ao>,
+			<&clock_gcc clk_gcc_gpu_gpll0_clk>;
+		#clock-cells = <1>;
+	};
+
+	clock_gfx: qcom,gfxcc@5065000 {
+		compatible = "qcom,gfxcc-8998";
+		reg = <0x5065000 0x9000>;
+		reg-names = "cc_base";
+		vdd_gpucc-supply = <&gfx_vreg>;
+		vdd_mx-supply = <&pm8998_s9_level>;
+		vdd_gpu_mx-supply = <&pm8998_s9_level>;
+		qcom,gfx3d_clk_src-opp-handle = <&msm_gpu>;
+		qcom,gfxfreq-speedbin0 =
+			<	  0 0				0 >,
+			< 171000000 1 RPM_SMD_REGULATOR_LEVEL_SVS >,
+			< 251000000 2 RPM_SMD_REGULATOR_LEVEL_SVS >,
+			< 332000000 3 RPM_SMD_REGULATOR_LEVEL_SVS >,
+			< 403000000 4 RPM_SMD_REGULATOR_LEVEL_SVS >,
+			< 504000000 5 RPM_SMD_REGULATOR_LEVEL_NOM >,
+			< 650000000 6 RPM_SMD_REGULATOR_LEVEL_TURBO >;
+		qcom,gfxfreq-mx-speedbin0 =
+			<         0			      0 >,
+			< 171000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+			< 251000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+			< 332000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+			< 403000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+			< 504000000 RPM_SMD_REGULATOR_LEVEL_NOM >,
+			< 650000000 RPM_SMD_REGULATOR_LEVEL_TURBO >;
+		#clock-cells = <1>;
+	};
+
+	clock_cpu: qcom,cpu-clock-8998@179c0000 {
+		compatible = "qcom,cpu-clock-osm-msm8998-v1";
+		reg = <0x179c0000 0x4000>,
+		      <0x17916000 0x1000>,
+		      <0x17816000 0x1000>,
+		      <0x179d1000 0x1000>,
+		      <0x00784130 0x8>,
+		      <0x1791101c 0x8>;
+		reg-names = "osm", "pwrcl_pll", "perfcl_pll",
+			    "apcs_common", "perfcl_efuse", "debug";
+
+		vdd-pwrcl-supply = <&apc0_pwrcl_vreg>;
+		vdd-perfcl-supply = <&apc1_perfcl_vreg>;
+
+		interrupts = <GIC_SPI 35 IRQ_TYPE_EDGE_RISING>,
+			     <GIC_SPI 36 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "pwrcl-irq", "perfcl-irq";
+
+		qcom,pwrcl-speedbin0-v0 =
+			<   300000000 0x0004000f 0x01200020 0x1 1 >,
+			<   345600000 0x05040012 0x02200020 0x1 2 >,
+			<   422400000 0x05040016 0x02200020 0x1 3 >,
+			<   499200000 0x0504001a 0x02200020 0x1 4 >,
+			<   576000000 0x0504001e 0x03200020 0x1 5 >,
+			<   633600000 0x05040021 0x03200020 0x1 6 >,
+			<   710400000 0x05040025 0x03200020 0x1 7 >,
+			<   806400000 0x0504002a 0x04200020 0x1 8 >,
+			<   883200000 0x0404002e 0x04250025 0x1 9 >,
+			<   960000000 0x04040032 0x05280028 0x1 10 >,
+			<  1036800000 0x04040036 0x052b002b 0x2 11 >,
+			<  1113600000 0x0404003a 0x052e002e 0x2 12 >,
+			<  1190400000 0x0404003e 0x06320032 0x2 13 >,
+			<  1248000000 0x04040041 0x06340034 0x2 14 >,
+			<  1324800000 0x04040045 0x06370037 0x2 15 >,
+			<  1401600000 0x04040049 0x073a003a 0x2 16 >,
+			<  1478400000 0x0404004d 0x073e003e 0x2 17 >,
+			<  1574400000 0x04040052 0x08420042 0x2 18 >,
+			<  1651200000 0x04040056 0x08450045 0x2 19 >,
+			<  1728000000 0x0404005a 0x08480048 0x2 20 >,
+			<  1804800000 0x0404005e 0x094b004b 0x3 21 >,
+			<  1881600000 0x04040062 0x094e004e 0x3 22 >;
+
+		qcom,perfcl-speedbin0-v0 =
+			<   300000000 0x0004000f 0x01200020 0x1 1 >,
+			<   345600000 0x05040012 0x02200020 0x1 2 >,
+			<   422400000 0x05040016 0x02200020 0x1 3 >,
+			<   480000000 0x05040019 0x02200020 0x1 4 >,
+			<   556800000 0x0504001d 0x03200020 0x1 5 >,
+			<   633600000 0x05040021 0x03200020 0x1 6 >,
+			<   710400000 0x05040025 0x03200020 0x1 7 >,
+			<   787200000 0x05040029 0x04200020 0x1 8 >,
+			<   844800000 0x0404002c 0x04230023 0x1 9 >,
+			<   902400000 0x0404002f 0x04260026 0x1 10 >,
+			<   979200000 0x04040033 0x05290029 0x1 11 >,
+			<  1056000000 0x04040037 0x052c002c 0x1 12 >,
+			<  1171200000 0x0404003d 0x06310031 0x2 13 >,
+			<  1248000000 0x04040041 0x06340034 0x2 14 >,
+			<  1324800000 0x04040045 0x06370037 0x2 15 >,
+			<  1401600000 0x04040049 0x073a003a 0x2 16 >,
+			<  1478400000 0x0404004d 0x073e003e 0x2 17 >,
+			<  1536000000 0x04040050 0x07400040 0x2 18 >,
+			<  1632000000 0x04040055 0x08440044 0x2 19 >,
+			<  1708800000 0x04040059 0x08470047 0x2 20 >,
+			<  1785600000 0x0404005d 0x094a004a 0x2 21 >,
+			<  1862400000 0x04040061 0x094e004e 0x2 22 >,
+			<  1939200000 0x04040065 0x09510051 0x3 23 >,
+			<  2016000000 0x04040069 0x0a540054 0x3 24 >,
+			<  2092800000 0x0404006d 0x0a570057 0x3 25 >;
+
+		qcom,up-timer =
+			<1000 1000>;
+		qcom,down-timer =
+			<1000 1000>;
+		qcom,pc-override-index =
+			<0 0>;
+		qcom,set-ret-inactive;
+		qcom,enable-llm-freq-vote;
+		qcom,llm-freq-up-timer =
+			<327675 327675>;
+		qcom,llm-freq-down-timer =
+			<327675 327675>;
+		qcom,enable-llm-volt-vote;
+		qcom,llm-volt-up-timer =
+			<327675 327675>;
+		qcom,llm-volt-down-timer =
+			<327675 327675>;
+		qcom,cc-reads = <10>;
+		qcom,cc-delay = <5>;
+		qcom,cc-factor = <100>;
+		qcom,osm-clk-rate = <200000000>;
+		qcom,xo-clk-rate = <19200000>;
+
+		qcom,l-val-base =
+			<0x17916004 0x17816004>;
+		qcom,apcs-itm-present =
+			<0x179d143c 0x179d143c>;
+		qcom,apcs-pll-user-ctl =
+			<0x1791600c 0x1781600c>;
+		qcom,apcs-cfg-rcgr =
+			<0x17911054 0x17811054>;
+		qcom,apcs-cmd-rcgr =
+			<0x17911050 0x17811050>;
+		qcom,apm-mode-ctl =
+			<0x179d0004 0x179d0010>;
+		qcom,apm-ctrl-status =
+			<0x179d000c 0x179d0018>;
+		qcom,llm-sw-overr=
+			<0x8fff0036 0x8fff003a 0x0fff0036>,
+			<0x8fff003d 0x8fff0041 0x0fff003d>;
+
+		qcom,apm-threshold-voltage = <832000>;
+		qcom,boost-fsm-en;
+		qcom,safe-fsm-en;
+		qcom,ps-fsm-en;
+		qcom,droop-fsm-en;
+		qcom,wfx-fsm-en;
+		qcom,pc-fsm-en;
+
+		qcom,pwrcl-apcs-mem-acc-cfg =
+			<0x179d1360 0x179d1364 0x179d1364>;
+		qcom,perfcl-apcs-mem-acc-cfg =
+			<0x179d1368 0x179d136C 0x179d1370>;
+		qcom,pwrcl-apcs-mem-acc-val =
+			<0x00000000 0x80000000 0x80000000>,
+			<0x00000000 0x00000000 0x00000000>,
+			<0x00000000 0x00000001 0x00000001>;
+		qcom,perfcl-apcs-mem-acc-val =
+			<0x00000000 0x00000000 0x80000000>,
+			<0x00000000 0x00000000 0x00000000>,
+			<0x00000000 0x00000000 0x00000001>;
+
+		clock-names = "aux_clk", "xo_ao";
+		clocks = <&clock_gcc clk_hmss_gpll0_clk_src>,
+			<&clock_gcc clk_cxo_clk_src_ao>;
+		#clock-cells = <1>;
+	};
+
+	clock_debug: qcom,debugcc@162000 {
+		compatible = "qcom,cc-debug-8998";
+		reg = <0x162000 0x4>;
+		reg-names = "cc_base";
+		clock-names = "debug_gpu_clk", "debug_gfx_clk",
+				"debug_mmss_clk", "debug_cpu_clk";
+		clocks = <&clock_gpu clk_gpucc_gcc_dbg_clk>,
+			 <&clock_gfx clk_gfxcc_dbg_clk>,
+			 <&clock_mmss clk_mmss_debug_mux>,
+			 <&clock_cpu clk_cpu_debug_mux>;
+		#clock-cells = <1>;
+	};
+
+	qcom,rmtfs_sharedmem@0 {
+		compatible = "qcom,sharedmem-uio";
+		reg = <0x0 0x00200000>;
+		reg-names = "rmtfs";
+		qcom,client-id = <0x00000001>;
+	};
+
+	qcom,msm_gsi {
+		compatible = "qcom,msm_gsi";
+	};
+
+	qcom,rmnet-ipa {
+		compatible = "qcom,rmnet-ipa3";
+		qcom,rmnet-ipa-ssr;
+		qcom,ipa-loaduC;
+		qcom,ipa-advertise-sg-support;
+	};
+
+	ipa_hw: qcom,ipa@01e00000 {
+		compatible = "qcom,ipa";
+		reg = <0x01e00000 0x34000>,
+			<0x01e84000 0x31fff>,
+			<0x01e04000 0x2c000>;
+		reg-names = "ipa-base", "bam-base", "gsi-base";
+		interrupts =
+			<0 333 0>,
+			<0 432 0>,
+			<0 432 0>;
+		interrupt-names = "ipa-irq", "bam-irq", "gsi-irq";
+		qcom,ipa-hw-ver = <11>; /* IPA core version = IPAv3.1 */
+		qcom,ipa-hw-mode = <0>; /* IPA hw type = Normal */
+		qcom,ee = <0>;
+		qcom,use-gsi;
+		qcom,use-ipa-tethering-bridge;
+		qcom,modem-cfg-emb-pipe-flt;
+		qcom,do-not-use-ch-gsi-20;
+		qcom,ipa-wdi2;
+		qcom,use-64-bit-dma-mask;
+		clocks = <&clock_gcc clk_ipa_clk>;
+		clock-names = "core_clk";
+		qcom,arm-smmu;
+		qcom,smmu-disable-htw;
+		qcom,smmu-s1-bypass;
+		qcom,msm-bus,name = "ipa";
+		qcom,msm-bus,num-cases = <4>;
+		qcom,msm-bus,num-paths = <4>;
+		qcom,msm-bus,vectors-KBps =
+		/* No vote */
+			<90 512 0 0>,
+			<90 585 0 0>,
+			<1 676 0 0>,
+			 /* SMMU smmu_aggre2_noc_clk */
+			<81 10065 0 0>,
+		/* SVS */
+			<90 512 80000 640000>,
+			<90 585 80000 640000>,
+			<1 676 80000 80000>,
+			/* SMMU smmu_aggre2_noc_clk */
+			<81 10065 0 16000>,
+		/* NOMINAL */
+			<90 512 206000 960000>,
+			<90 585 206000 960000>,
+			<1 676 206000 160000>,
+			/* SMMU smmu_aggre2_noc_clk */
+			<81 10065 0 16000>,
+		/* TURBO */
+			<90 512 206000 3600000>,
+			<90 585 206000 3600000>,
+			<1 676 206000 300000>,
+			/* SMMU smmu_aggre2_noc_clk */
+			<81 10065 0 16000>;
+		qcom,bus-vector-names = "MIN", "SVS", "NOMINAL", "TURBO";
+
+		/* IPA RAM mmap */
+		qcom,ipa-ram-mmap = <
+				0x280	/* ofst_start; */
+				0x0	/* nat_ofst; */
+				0x0	/* nat_size; */
+				0x288	/* v4_flt_hash_ofst; */
+				0x78	/* v4_flt_hash_size; */
+				0x4000	/* v4_flt_hash_size_ddr; */
+				0x308	/* v4_flt_nhash_ofst; */
+				0x78	/* v4_flt_nhash_size; */
+				0x4000	/* v4_flt_nhash_size_ddr; */
+				0x388	/* v6_flt_hash_ofst; */
+				0x78	/* v6_flt_hash_size; */
+				0x4000	/* v6_flt_hash_size_ddr; */
+				0x408	/* v6_flt_nhash_ofst; */
+				0x78	/* v6_flt_nhash_size; */
+				0x4000	/* v6_flt_nhash_size_ddr; */
+				0xf	/* v4_rt_num_index; */
+				0x0	/* v4_modem_rt_index_lo; */
+				0x7	/* v4_modem_rt_index_hi; */
+				0x8	/* v4_apps_rt_index_lo; */
+				0xe	/* v4_apps_rt_index_hi; */
+				0x488	/* v4_rt_hash_ofst; */
+				0x78	/* v4_rt_hash_size; */
+				0x4000	/* v4_rt_hash_size_ddr; */
+				0x508	/* v4_rt_nhash_ofst; */
+				0x78	/* v4_rt_nhash_size; */
+				0x4000	/* v4_rt_nhash_size_ddr; */
+				0xf	/* v6_rt_num_index; */
+				0x0	/* v6_modem_rt_index_lo; */
+				0x7	/* v6_modem_rt_index_hi; */
+				0x8	/* v6_apps_rt_index_lo; */
+				0xe	/* v6_apps_rt_index_hi; */
+				0x588	/* v6_rt_hash_ofst; */
+				0x78	/* v6_rt_hash_size; */
+				0x4000	/* v6_rt_hash_size_ddr; */
+				0x608	/* v6_rt_nhash_ofst; */
+				0x78	/* v6_rt_nhash_size; */
+				0x4000	/* v6_rt_nhash_size_ddr; */
+				0x688	/* modem_hdr_ofst; */
+				0x140	/* modem_hdr_size; */
+				0x7c8	/* apps_hdr_ofst; */
+				0x0	/* apps_hdr_size; */
+				0x800	/* apps_hdr_size_ddr; */
+				0x7d0	/* modem_hdr_proc_ctx_ofst; */
+				0x200	/* modem_hdr_proc_ctx_size; */
+				0x9d0	/* apps_hdr_proc_ctx_ofst; */
+				0x200	/* apps_hdr_proc_ctx_size; */
+				0x0	/* apps_hdr_proc_ctx_size_ddr; */
+				0x0	/* modem_comp_decomp_ofst; diff */
+				0x0	/* modem_comp_decomp_size; diff */
+				0xbd8	/* modem_ofst; */
+				0x1424	/* modem_size; */
+				0x1ffc	/* apps_v4_flt_hash_ofst; */
+				0x0	/* apps_v4_flt_hash_size; */
+				0x1ffc	/* apps_v4_flt_nhash_ofst; */
+				0x0	/* apps_v4_flt_nhash_size; */
+				0x1ffc	/* apps_v6_flt_hash_ofst; */
+				0x0	/* apps_v6_flt_hash_size; */
+				0x1ffc	/* apps_v6_flt_nhash_ofst; */
+				0x0	/* apps_v6_flt_nhash_size; */
+				0x80	/* uc_info_ofst; */
+				0x200	/* uc_info_size; */
+				0x2000	/* end_ofst; */
+				0x1ffc	/* apps_v4_rt_hash_ofst; */
+				0x0	/* apps_v4_rt_hash_size; */
+				0x1ffc	/* apps_v4_rt_nhash_ofst; */
+				0x0	/* apps_v4_rt_nhash_size; */
+				0x1ffc	/* apps_v6_rt_hash_ofst; */
+				0x0	/* apps_v6_rt_hash_size; */
+				0x1ffc	/* apps_v6_rt_nhash_ofst; */
+				0x0	/* apps_v6_rt_nhash_size; */
+				>;
+
+		/* smp2p gpio information */
+		qcom,smp2pgpio_map_ipa_1_out {
+			compatible = "qcom,smp2pgpio-map-ipa-1-out";
+			gpios = <&smp2pgpio_ipa_1_out 0 0>;
+		};
+
+		qcom,smp2pgpio_map_ipa_1_in {
+			compatible = "qcom,smp2pgpio-map-ipa-1-in";
+			gpios = <&smp2pgpio_ipa_1_in 0 0>;
+		};
+
+		ipa_smmu_ap: ipa_smmu_ap {
+			compatible = "qcom,ipa-smmu-ap-cb";
+			iommus = <&anoc2_smmu 0x18e0>;
+			qcom,iova-mapping = <0x10000000 0x40000000>;
+		};
+
+		ipa_smmu_wlan: ipa_smmu_wlan {
+			compatible = "qcom,ipa-smmu-wlan-cb";
+			iommus = <&anoc2_smmu 0x18e1>;
+		};
+
+		ipa_smmu_uc: ipa_smmu_uc {
+			compatible = "qcom,ipa-smmu-uc-cb";
+			iommus = <&anoc2_smmu 0x18e2>;
+			qcom,iova-mapping = <0x40000000 0x20000000>;
+		};
+	};
+
+	qcom,ipa_fws@1e08000 {
+		compatible = "qcom,pil-tz-generic";
+		qcom,pas-id = <0xF>;
+		qcom,firmware-name = "ipa_fws";
+	};
+
+	qcom,chd_silver {
+		compatible = "qcom,core-hang-detect";
+		label = "silver";
+		qcom,threshold-arr = <0x179880b0 0x179980b0
+		0x179a80b0 0x179b80b0>;
+		qcom,config-arr = <0x179880b8 0x179980b8
+		0x179a80b8 0x179b80b8>;
+	};
+
+	qcom,chd_gold {
+		compatible = "qcom,core-hang-detect";
+		label = "gold";
+		qcom,threshold-arr = <0x178880b0 0x178980b0
+		0x178a80b0 0x178b80b0>;
+		qcom,config-arr = <0x178880b8 0x178980b8
+		0x178a80b8 0x178b80b8>;
+	};
+
+	qcom,ipc-spinlock@1f40000 {
+		compatible = "qcom,ipc-spinlock-sfpb";
+		reg = <0x1f40000 0x8000>;
+		qcom,num-locks = <8>;
+	};
+
+	qcom,ghd {
+		compatible = "qcom,gladiator-hang-detect";
+		qcom,threshold-arr = <0x179d141c 0x179d1420
+		0x179d1424 0x179d1428 0x179d142c 0x179d1430>;
+		qcom,config-reg = <0x179d1434>;
+	};
+
+	qcom,msm-gladiator-v2@17900000 {
+		compatible = "qcom,msm-gladiator-v2";
+		reg = <0x17900000 0xe000>;
+		reg-names = "gladiator_base";
+		interrupts = <0 22 0>;
+		clock-names = "atb_clk";
+		clocks = <&clock_gcc clk_qdss_clk>;
+	};
+
+	qcom,smem@86000000 {
+		compatible = "qcom,smem";
+		reg = <0x86000000 0x200000>,
+			<0x17911008 0x4>,
+			<0x778000 0x7000>,
+			<0x1fd4000 0x8>;
+		reg-names = "smem", "irq-reg-base", "aux-mem1",
+			"smem_targ_info_reg";
+		qcom,mpu-enabled;
+	};
+
+	qcom,msm-adsprpc-mem {
+		compatible = "qcom,msm-adsprpc-mem-region";
+		memory-region = <&adsp_mem>;
+	};
+
+	qcom,msm_fastrpc {
+		compatible = "qcom,msm-fastrpc-adsp";
+		qcom,fastrpc-glink;
+
+		qcom,msm_fastrpc_cpz_cb1 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 2>;
+			qcom,secure-context-bank;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb1 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 8>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb2 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 9>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb3 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 10>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb4 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 11>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb6 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 5>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb7 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 6>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb8 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 7>;
+			dma-coherent;
+		};
+	};
+
+	rpm_bus: qcom,rpm-smd {
+		compatible = "qcom,rpm-glink";
+		qcom,glink-edge = "rpm";
+		rpm-channel-name = "rpm_requests";
+	};
+
+	glink_mpss: qcom,glink-ssr-modem {
+		compatible = "qcom,glink_ssr";
+		label = "modem";
+		qcom,edge = "mpss";
+		qcom,notify-edges = <&glink_lpass>, <&glink_dsps>, <&glink_rpm>,
+					<&glink_spss>;
+		qcom,xprt = "smem";
+	};
+
+	glink_lpass: qcom,glink-ssr-adsp {
+		compatible = "qcom,glink_ssr";
+		label = "adsp";
+		qcom,edge = "lpass";
+		qcom,notify-edges = <&glink_mpss>, <&glink_dsps>, <&glink_rpm>,
+					<&glink_spss>;
+		qcom,xprt = "smem";
+	};
+
+	glink_dsps: qcom,glink-ssr-dsps {
+		compatible = "qcom,glink_ssr";
+		label = "slpi";
+		qcom,edge = "dsps";
+		qcom,notify-edges = <&glink_mpss>, <&glink_lpass>, <&glink_rpm>,
+					<&glink_spss>;
+		qcom,xprt = "smem";
+	};
+
+	glink_rpm: qcom,glink-ssr-rpm {
+		compatible = "qcom,glink_ssr";
+		label = "rpm";
+		qcom,edge = "rpm";
+		qcom,notify-edges = <&glink_lpass>, <&glink_mpss>,
+					<&glink_dsps>, <&glink_spss>;
+		qcom,xprt = "smem";
+	};
+
+	glink_spss: qcom,glink-ssr-spss {
+		compatible = "qcom,glink_ssr";
+		label = "spss";
+		qcom,edge = "spss";
+		qcom,notify-edges = <&glink_mpss>, <&glink_lpass>,
+				<&glink_dsps>, <&glink_rpm>;
+		qcom,xprt = "mailbox";
+	};
+
+	qcom,glink-smem-native-xprt-modem@86000000 {
+		compatible = "qcom,glink-smem-native-xprt";
+		reg = <0x86000000 0x200000>,
+			<0x17911008 0x4>;
+		reg-names = "smem", "irq-reg-base";
+		qcom,irq-mask = <0x8000>;
+		interrupts = <0 452 1>;
+		label = "mpss";
+	};
+
+	qcom,glink-smem-native-xprt-adsp@86000000 {
+		compatible = "qcom,glink-smem-native-xprt";
+		reg = <0x86000000 0x200000>,
+			<0x17911008 0x4>;
+		reg-names = "smem", "irq-reg-base";
+		qcom,irq-mask = <0x200>;
+		interrupts = <0 157 1>;
+		label = "lpass";
+	};
+
+	qcom,glink-smem-native-xprt-dsps@86000000 {
+		compatible = "qcom,glink-smem-native-xprt";
+		reg = <0x86000000 0x200000>,
+			<0x17911008 0x4>;
+		reg-names = "smem", "irq-reg-base";
+		qcom,irq-mask = <0x8000000>;
+		interrupts = <0 179 1>;
+		label = "dsps";
+	};
+
+	qcom,glink-smem-native-xprt-rpm@778000 {
+		compatible = "qcom,glink-rpm-native-xprt";
+		reg = <0x778000 0x7000>,
+			<0x17911008 0x4>;
+		reg-names = "msgram", "irq-reg-base";
+		qcom,irq-mask = <0x1>;
+		interrupts = <0 168 1>;
+		label = "rpm";
+	};
+
+	qcom,glink-mailbox-xprt-spss@1d05008 {
+		compatible = "qcom,glink-mailbox-xprt";
+		reg = <0x1d05008 0x8>,
+			<0x1d05010 0x4>,
+			<0x1d0501c 0x4>,
+			<0x1d06008 0x4>;
+		reg-names = "mbox-loc-addr", "mbox-loc-size", "irq-reg-base",
+			"irq-rx-reset";
+		qcom,irq-mask = <0x1>;
+		interrupts = <0 348 4>;
+		label = "spss";
+		qcom,tx-ring-size = <0x800>;
+		qcom,rx-ring-size = <0x800>;
+	};
+
+	glink_spi_xprt_wdsp: qcom,glink-spi-xprt-wdsp {
+		compatible = "qcom,glink-spi-xprt";
+		label = "wdsp";
+		qcom,remote-fifo-config = <&glink_fifo_wdsp>;
+		qcom,qos-config = <&glink_qos_wdsp>;
+		qcom,ramp-time = <0x10>,
+				     <0x20>,
+				     <0x30>,
+				     <0x40>;
+	};
+
+	glink_fifo_wdsp: qcom,glink-fifo-config-wdsp {
+		compatible = "qcom,glink-fifo-config";
+		qcom,out-read-idx-reg = <0x12000>;
+		qcom,out-write-idx-reg = <0x12004>;
+		qcom,in-read-idx-reg = <0x1200C>;
+		qcom,in-write-idx-reg = <0x12010>;
+	};
+
+	glink_qos_wdsp: qcom,glink-qos-config-wdsp {
+		compatible = "qcom,glink-qos-config";
+		qcom,flow-info = <0x80 0x0>,
+				 <0x70 0x1>,
+				 <0x60 0x2>,
+				 <0x50 0x3>;
+		qcom,mtu-size = <0x800>;
+		qcom,tput-stats-cycle = <0xa>;
+	};
+
+	qcom,glink_pkt {
+		compatible = "qcom,glinkpkt";
+
+		qcom,glinkpkt-at-mdm0 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DS";
+			qcom,glinkpkt-dev-name = "at_mdm0";
+		};
+
+		qcom,glinkpkt-loopback_cntl {
+			qcom,glinkpkt-transport = "lloop";
+			qcom,glinkpkt-edge = "local";
+			qcom,glinkpkt-ch-name = "LOCAL_LOOPBACK_CLNT";
+			qcom,glinkpkt-dev-name = "glink_pkt_loopback_ctrl";
+		};
+
+		qcom,glinkpkt-loopback_data {
+			qcom,glinkpkt-transport = "lloop";
+			qcom,glinkpkt-edge = "local";
+			qcom,glinkpkt-ch-name = "glink_pkt_lloop_CLNT";
+			qcom,glinkpkt-dev-name = "glink_pkt_loopback";
+		};
+
+		qcom,glinkpkt-apr-apps2 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "adsp";
+			qcom,glinkpkt-ch-name = "apr_apps2";
+			qcom,glinkpkt-dev-name = "apr_apps2";
+		};
+
+		qcom,glinkpkt-data40-cntl {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DATA40_CNTL";
+			qcom,glinkpkt-dev-name = "smdcntl8";
+		};
+
+		qcom,glinkpkt-data1 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DATA1";
+			qcom,glinkpkt-dev-name = "smd7";
+		};
+
+		qcom,glinkpkt-data4 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DATA4";
+			qcom,glinkpkt-dev-name = "smd8";
+		};
+
+		qcom,glinkpkt-data11 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DATA11";
+			qcom,glinkpkt-dev-name = "smd11";
+		};
+	};
+
+	pcie0: qcom,pcie@01c00000 {
+		compatible = "qcom,pci-msm";
+		cell-index = <0>;
+
+		reg = <0x1c00000 0x2000>,
+		      <0x1c06000 0x1000>,
+		      <0x1b000000 0xf1d>,
+		      <0x1b000f20 0xa8>,
+		      <0x1b100000 0x100000>,
+		      <0x1b200000 0x100000>,
+		      <0x1b300000 0xd00000>;
+
+		reg-names = "parf", "phy", "dm_core", "elbi",
+				"conf", "io", "bars";
+
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges = <0x01000000 0x0 0x1b200000 0x1b200000 0x0 0x100000>,
+			<0x02000000 0x0 0x1b300000 0x1b300000 0x0 0xd00000>;
+		interrupt-parent = <&pcie0>;
+		interrupts = <0 1 2 3 4 5>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0 0 0 0xffffffff>;
+		interrupt-map = <0 0 0 0 &intc 0 0 405 0
+				0 0 0 1 &intc 0 0 135 0
+				0 0 0 2 &intc 0 0 136 0
+				0 0 0 3 &intc 0 0 138 0
+				0 0 0 4 &intc 0 0 139 0
+				0 0 0 5 &intc 0 0 278 0>;
+
+		interrupt-names = "int_msi", "int_a", "int_b", "int_c",
+				"int_d", "int_global_int";
+
+		qcom,phy-sequence = <0x804 0x01 0x00
+					0x034 0x14 0x00
+					0x138 0x30 0x00
+					0x048 0x0f 0x00
+					0x15c 0x06 0x00
+					0x090 0x01 0x00
+					0x088 0x20 0x00
+					0x0f0 0x00 0x00
+					0x0f8 0x01 0x00
+					0x0f4 0xc9 0x00
+					0x11c 0xff 0x00
+					0x120 0x3f 0x00
+					0x164 0x01 0x00
+					0x154 0x00 0x00
+					0x148 0x0a 0x00
+					0x05C 0x19 0x00
+					0x038 0x90 0x00
+					0x0b0 0x82 0x00
+					0x0c0 0x03 0x00
+					0x0bc 0x55 0x00
+					0x0b8 0x55 0x00
+					0x0a0 0x00 0x00
+					0x09c 0x0d 0x00
+					0x098 0x04 0x00
+					0x13c 0x00 0x00
+					0x060 0x08 0x00
+					0x068 0x16 0x00
+					0x070 0x34 0x00
+					0x15c 0x06 0x00
+					0x138 0x33 0x00
+					0x03c 0x02 0x00
+					0x040 0x0e 0x00
+					0x080 0x04 0x00
+					0x0dc 0x00 0x00
+					0x0d8 0x3f 0x00
+					0x00c 0x09 0x00
+					0x010 0x01 0x00
+					0x01c 0x40 0x00
+					0x020 0x01 0x00
+					0x014 0x02 0x00
+					0x018 0x00 0x00
+					0x024 0x7e 0x00
+					0x028 0x15 0x00
+					0x244 0x02 0x00
+					0x2a4 0x12 0x00
+					0x260 0x10 0x00
+					0x28c 0x06 0x00
+					0x504 0x03 0x00
+					0x500 0x1c 0x00
+					0x50c 0x14 0x00
+					0x4d4 0x0a 0x00
+					0x4d8 0x04 0x00
+					0x4dc 0x1a 0x00
+					0x434 0x4b 0x00
+					0x414 0x04 0x00
+					0x40c 0x04 0x00
+					0x4f8 0x00 0x00
+					0x4fc 0x80 0x00
+					0x51c 0x40 0x00
+					0x444 0x71 0x00
+					0x43c 0x40 0x00
+					0x854 0x04 0x00
+					0x62c 0x52 0x00
+					0x9ac 0x00 0x00
+					0x8a0 0x01 0x00
+					0x9e0 0x00 0x00
+					0x9dc 0x01 0x00
+					0x9a8 0x00 0x00
+					0x8a4 0x01 0x00
+					0x8a8 0x73 0x00
+					0x9d8 0x99 0x00
+					0x9b0 0x03 0x00
+					0x804 0x03 0x00
+					0x800 0x00 0x00
+					0x808 0x03 0x00>;
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&pcie0_clkreq_default
+			&pcie0_perst_default
+			&pcie0_wake_default>;
+
+		perst-gpio = <&tlmm 35 0>;
+		wake-gpio = <&tlmm 37 0>;
+
+		gdsc-vdd-supply = <&gdsc_pcie_0>;
+		vreg-1.8-supply = <&pm8998_l2>;
+		vreg-0.9-supply = <&pm8998_l1>;
+		vreg-cx-supply = <&pm8998_s1_level>;
+
+		qcom,vreg-1.8-voltage-level = <1200000 1200000 24000>;
+		qcom,vreg-0.9-voltage-level = <880000 880000 24000>;
+		qcom,vreg-cx-voltage-level = <RPM_SMD_REGULATOR_LEVEL_BINNING
+						RPM_SMD_REGULATOR_LEVEL_SVS 0>;
+
+		qcom,ep-latency = <10>;
+
+		qcom,boot-option = <0x1>;
+
+		linux,pci-domain = <0>;
+
+		qcom,pcie-phy-ver = <0x20>;
+		qcom,use-19p2mhz-aux-clk;
+
+		iommus = <&anoc1_smmu>;
+		qcom,smmu-exist;
+		qcom,smmu-sid-base = <0x1480>;
+
+		qcom,msm-bus,name = "pcie0";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<45 512 0 0>,
+				<45 512 500 800>;
+
+		clocks = <&clock_gcc clk_gcc_pcie_0_pipe_clk>,
+			<&clock_gcc clk_ln_bb_clk1>,
+			<&clock_gcc clk_gcc_pcie_0_aux_clk>,
+			<&clock_gcc clk_gcc_pcie_0_cfg_ahb_clk>,
+			<&clock_gcc clk_gcc_pcie_0_mstr_axi_clk>,
+			<&clock_gcc clk_gcc_pcie_0_slv_axi_clk>,
+			<&clock_gcc clk_gcc_pcie_clkref_clk>;
+
+		clock-names = "pcie_0_pipe_clk", "pcie_0_ref_clk_src",
+				"pcie_0_aux_clk", "pcie_0_cfg_ahb_clk",
+				"pcie_0_mstr_axi_clk", "pcie_0_slv_axi_clk",
+				"pcie_0_ldo";
+
+		max-clock-frequency-hz = <0>, <0>, <19200000>,
+					<0>, <0>, <0>, <0>, <0>, <0>,
+					<0>, <0>, <0>, <0>, <0>, <0>,
+					<0>, <0>;
+
+		resets = <&clock_gcc PCIE_PHY_BCR>,
+			 <&clock_gcc PCIE_0_PHY_BCR>,
+			 <&clock_gcc PCIE_0_PHY_BCR>;
+
+		reset-names = "pcie_phy_reset",
+				"pcie_0_phy_reset",
+				"pcie_0_phy_pipe_reset";
+	};
+
+	qcom,ipc_router {
+		compatible = "qcom,ipc_router";
+		qcom,node-id = <1>;
+	};
+
+	qcom,ipc_router_modem_xprt {
+		compatible = "qcom,ipc_router_glink_xprt";
+		qcom,ch-name = "IPCRTR";
+		qcom,xprt-remote = "mpss";
+		qcom,glink-xprt = "smem";
+		qcom,xprt-linkid = <1>;
+		qcom,xprt-version = <1>;
+		qcom,fragmented-data;
+	};
+
+	qcom,ipc_router_q6_xprt {
+		compatible = "qcom,ipc_router_glink_xprt";
+		qcom,ch-name = "IPCRTR";
+		qcom,xprt-remote = "lpass";
+		qcom,glink-xprt = "smem";
+		qcom,xprt-linkid = <1>;
+		qcom,xprt-version = <1>;
+		qcom,fragmented-data;
+	};
+
+	qcom,ipc_router_dsps_xprt {
+		compatible = "qcom,ipc_router_glink_xprt";
+		qcom,ch-name = "IPCRTR";
+		qcom,xprt-remote = "dsps";
+		qcom,glink-xprt = "smem";
+		qcom,xprt-linkid = <1>;
+		qcom,xprt-version = <1>;
+		qcom,fragmented-data;
+	};
+
+	qcom,spcom {
+		compatible = "qcom,spcom";
+
+		/* predefined channels, remote side is server */
+		qcom,spcom-ch-names = "sp_kernel" , "sp_ssr";
+		status = "ok";
+	};
+
+	spss_utils: qcom,spss_utils {
+		compatible = "qcom,spss-utils";
+		/* spss test fuse physical address */
+		qcom,spss-fuse-addr = <0x007841c4 0x4>;
+		qcom,spss-fuse-bit = <27>;
+		qcom,spss-test-firmware-name = "spss";    /* default name */
+		qcom,spss-prod-firmware-name = "spss1p";  /* 8 chars max */
+		status = "ok";
+	};
+
+	sdhc_2: sdhci@c0a4900 {
+		compatible = "qcom,sdhci-msm";
+		reg = <0xc0a4900 0x314>, <0xc0a4000 0x800>;
+		reg-names = "hc_mem", "core_mem";
+
+		interrupts = <0 125 0>, <0 221 0>;
+		interrupt-names = "hc_irq", "pwr_irq";
+
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_sdcc2_ahb_clk>,
+			 <&clock_gcc clk_gcc_sdcc2_apps_clk>;
+
+		qcom,large-address-bus;
+		qcom,bus-width = <4>;
+		qcom,cpu-dma-latency-us = <701>;
+
+		qcom,devfreq,freq-table = <52000000 200000000>;
+
+		qcom,msm-bus,name = "sdhc2";
+		qcom,msm-bus,num-cases = <8>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps = <81 512 0 0>, /* No vote */
+				<81 512 1600 3200>,    /* 400 KB/s*/
+				<81 512 80000 160000>, /* 20 MB/s */
+				<81 512 100000 200000>, /* 25 MB/s */
+				<81 512 200000 400000>, /* 50 MB/s */
+				<81 512 400000 800000>, /* 100 MB/s */
+				<81 512 800000 800000>, /* 200 MB/s */
+				<81 512 2048000 4096000>; /* Max. bandwidth */
+		qcom,bus-bw-vectors-bps = <0 400000 20000000 25000000 50000000
+						100000000 200000000 4294967295>;
+
+		status = "disabled";
+	};
+
+	ufsphy1: ufsphy@1da7000 {
+		compatible = "qcom,ufs-phy-qmp-v3";
+		reg = <0x1da7000 0xda8>;
+		reg-names = "phy_mem";
+		#phy-cells = <0>;
+		clock-names = "ref_clk_src",
+			"ref_clk",
+			"ref_aux_clk";
+		clocks = <&clock_gcc clk_ln_bb_clk1>,
+			<&clock_gcc clk_gcc_ufs_clkref_clk>,
+			<&clock_gcc clk_gcc_ufs_phy_aux_hw_ctl_clk>;
+		status = "disabled";
+	};
+
+	ufs_ice: ufsice@1db0000 {
+		compatible = "qcom,ice";
+		reg = <0x1db0000 0x8000>;
+		qcom,enable-ice-clk;
+		clock-names =   "ufs_core_clk",
+				"bus_clk",
+				"iface_clk",
+				"ice_core_clk";
+		clocks = <&clock_gcc clk_gcc_ufs_axi_clk>,
+			 <&clock_gcc clk_gcc_aggre1_ufs_axi_clk>,
+			 <&clock_gcc clk_gcc_ufs_ahb_clk>,
+			 <&clock_gcc clk_gcc_ufs_ice_core_clk>;
+		qcom,op-freq-hz =	<0>,
+					<0>,
+					<0>,
+					<300000000>;
+		vdd-hba-supply = <&gdsc_ufs>;
+		qcom,msm-bus,name = "ufs_ice_noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<1 650 0 0>,    /* No vote */
+				<1 650 1000 0>; /* Max. bandwidth */
+		qcom,bus-vector-names = "MIN",
+					"MAX";
+		qcom,instance-type = "ufs";
+		status = "disabled";
+	};
+
+	ufs1: ufshc@1da4000 {
+		compatible = "qcom,ufshc";
+		reg = <0x1da4000 0x2500>;
+		interrupts = <0 265 0>;
+		phys = <&ufsphy1>;
+		phy-names = "ufsphy";
+		ufs-qcom-crypto = <&ufs_ice>;
+
+		clock-names =
+			"core_clk",
+			"bus_aggr_clk",
+			"iface_clk",
+			"core_clk_unipro",
+			"core_clk_ice",
+			"ref_clk",
+			"tx_lane0_sync_clk",
+			"rx_lane0_sync_clk";
+		clocks =
+			<&clock_gcc clk_gcc_ufs_axi_hw_ctl_clk>,
+			<&clock_gcc clk_gcc_aggre1_ufs_axi_hw_ctl_clk>,
+			<&clock_gcc clk_gcc_ufs_ahb_clk>,
+			<&clock_gcc clk_gcc_ufs_unipro_core_hw_ctl_clk>,
+			<&clock_gcc clk_gcc_ufs_ice_core_hw_ctl_clk>,
+			<&clock_gcc clk_ln_bb_clk1>,
+			<&clock_gcc clk_gcc_ufs_tx_symbol_0_clk>,
+			<&clock_gcc clk_gcc_ufs_rx_symbol_0_clk>;
+		freq-table-hz =
+			<50000000 200000000>,
+			<0 0>,
+			<0 0>,
+			<37500000 150000000>,
+			<75000000 300000000>,
+			<0 0>,
+			<0 0>,
+			<0 0>;
+
+		lanes-per-direction = <1>;
+
+		qcom,msm-bus,name = "ufs1";
+		qcom,msm-bus,num-cases = <22>;
+		qcom,msm-bus,num-paths = <2>;
+		qcom,msm-bus,vectors-KBps =
+		<95 512 0 0>, <1 650 0 0>,          /* No vote */
+		<95 512 922 0>, <1 650 1000 0>,     /* PWM G1 */
+		<95 512 1844 0>, <1 650 1000 0>,    /* PWM G2 */
+		<95 512 3688 0>, <1 650 1000 0>,    /* PWM G3 */
+		<95 512 7376 0>, <1 650 1000 0>,    /* PWM G4 */
+		<95 512 1844 0>, <1 650 1000 0>,    /* PWM G1 L2 */
+		<95 512 3688 0>, <1 650 1000 0>,    /* PWM G2 L2 */
+		<95 512 7376 0>, <1 650 1000 0>,    /* PWM G3 L2 */
+		<95 512 14752 0>, <1 650 1000 0>,   /* PWM G4 L2 */
+		<95 512 127796 0>, <1 650 1000 0>,  /* HS G1 RA */
+		<95 512 255591 0>, <1 650 1000 0>,  /* HS G2 RA */
+		<95 512 511181 0>, <1 650 1000 0>,  /* HS G3 RA */
+		<95 512 255591 0>, <1 650 1000 0>,  /* HS G1 RA L2 */
+		<95 512 511181 0>, <1 650 1000 0>,  /* HS G2 RA L2 */
+		<95 512 1022362 0>, <1 650 1000 0>, /* HS G3 RA L2 */
+		<95 512 149422 0>, <1 650 1000 0>,  /* HS G1 RB */
+		<95 512 298189 0>, <1 650 1000 0>,  /* HS G2 RB */
+		<95 512 596378 0>, <1 650 1000 0>,  /* HS G3 RB */
+		<95 512 298189 0>, <1 650 1000 0>,  /* HS G1 RB L2 */
+		<95 512 596378 0>, <1 650 1000 0>,  /* HS G2 RB L2 */
+		<95 512 1192756 0>, <1 650 1000 0>, /* HS G3 RB L2 */
+		<95 512 4096000 0>, <1 650 1000 0>; /* Max. bandwidth */
+		qcom,bus-vector-names = "MIN",
+		"PWM_G1_L1", "PWM_G2_L1", "PWM_G3_L1", "PWM_G4_L1",
+		"PWM_G1_L2", "PWM_G2_L2", "PWM_G3_L2", "PWM_G4_L2",
+		"HS_RA_G1_L1", "HS_RA_G2_L1", "HS_RA_G3_L1",
+		"HS_RA_G1_L2", "HS_RA_G2_L2", "HS_RA_G3_L2",
+		"HS_RB_G1_L1", "HS_RB_G2_L1", "HS_RB_G3_L1",
+		"HS_RB_G1_L2", "HS_RB_G2_L2", "HS_RB_G3_L2",
+		"MAX";
+
+		/* PM QoS */
+		qcom,pm-qos-cpu-groups = <0x0F 0xF0>;
+		qcom,pm-qos-cpu-group-latency-us = <70 70>;
+		qcom,pm-qos-default-cpu = <0>;
+
+		resets = <&clock_gcc UFS_BCR>;
+		reset-names = "core_reset";
+
+		status = "disabled";
+	};
+
+	usb3: ssusb@a800000 {
+		compatible = "qcom,dwc-usb3-msm";
+		reg = <0x0a800000 0xf8c00>,
+		      <0x0c016000 0x400>;
+		reg-names = "core_base", "ahb2phy_base";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+
+		interrupts = <0 347 0>, <0 243 0>,  <0 180 0>;
+		interrupt-names = "hs_phy_irq", "ss_phy_irq", "pwr_event_irq";
+
+		USB3_GDSC-supply = <&gdsc_usb30>;
+		qcom,usb-dbm = <&dbm_1p5>;
+		qcom,msm-bus,name = "usb3";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+					<61 512 0 0>,
+					<61 512 240000 800000>;
+
+		qcom,dwc-usb3-msm-tx-fifo-size = <21288>;
+		extcon = <&pm660_pdphy>;
+
+		clocks = <&clock_gcc clk_gcc_usb30_master_clk>,
+			<&clock_gcc clk_gcc_cfg_noc_usb3_axi_clk>,
+			<&clock_gcc clk_gcc_aggre1_usb3_axi_clk>,
+			<&clock_gcc clk_gcc_usb30_mock_utmi_clk>,
+			<&clock_gcc clk_gcc_usb30_sleep_clk>,
+			<&clock_gcc clk_cxo_dwc3_clk>;
+
+		clock-names = "core_clk", "iface_clk", "bus_aggr_clk",
+				"utmi_clk", "sleep_clk", "xo";
+
+		qcom,core-clk-rate = <120000000>;
+
+		resets = <&clock_gcc USB_30_BCR>;
+		reset-names = "core_reset";
+
+		dwc3@a800000 {
+			compatible = "snps,dwc3";
+			reg = <0x0a800000 0xcd00>;
+			interrupt-parent = <&intc>;
+			interrupts = <0 131 0>;
+			usb-phy = <&qusb_phy0>, <&ssphy>;
+			tx-fifo-resize;
+			snps,nominal-elastic-buffer;
+			snps,hird_thresh = <0x10>;
+			snps,num-gsi-evt-buffs = <0x3>;
+		};
+
+		qcom,usbbam@a904000 {
+			compatible = "qcom,usb-bam-msm";
+			reg = <0xa904000 0x17000>;
+			interrupt-parent = <&intc>;
+			interrupts = <0 132 0>;
+
+			qcom,bam-type = <0>;
+			qcom,usb-bam-fifo-baseaddr = <0x146bb000>;
+			qcom,usb-bam-num-pipes = <8>;
+			qcom,ignore-core-reset-ack;
+			qcom,disable-clk-gating;
+			qcom,usb-bam-override-threshold = <0x4001>;
+			qcom,usb-bam-max-mbps-highspeed = <400>;
+			qcom,usb-bam-max-mbps-superspeed = <3600>;
+			qcom,reset-bam-on-connect;
+
+			qcom,pipe0 {
+				label = "ssusb-qdss-in-0";
+				qcom,usb-bam-mem-type = <2>;
+				qcom,dir = <1>;
+				qcom,pipe-num = <0>;
+				qcom,peer-bam = <0>;
+				qcom,peer-bam-physical-address = <0x6064000>;
+				qcom,src-bam-pipe-index = <0>;
+				qcom,dst-bam-pipe-index = <0>;
+				qcom,data-fifo-offset = <0x0>;
+				qcom,data-fifo-size = <0x1800>;
+				qcom,descriptor-fifo-offset = <0x1800>;
+				qcom,descriptor-fifo-size = <0x800>;
+			};
+		};
+	};
+
+	qusb_phy0: qusb@c012000 {
+		compatible = "qcom,qusb2phy-v2";
+		reg = <0x0c012000 0x2a8>,
+		      <0x01fcb24c 0x4>;
+		reg-names = "qusb_phy_base",
+				"tcsr_clamp_dig_n_1p8";
+		vdd-supply = <&pm660l_l1>;
+		vdda18-supply = <&pm660l_l10>;
+		vdda33-supply = <&pm660l_l7>;
+		qcom,vdd-voltage-level = <0 880000 880000>;
+		qcom,qusb-phy-init-seq =
+				/* <value reg_offset> */
+					<0x80 0x0
+					0x13 0x04
+					0x7c 0x18c
+					0x80 0x2c
+					0x0a 0x184
+					0x00 0x240>;
+		phy_type= "utmi";
+
+		clocks = <&clock_gcc clk_ln_bb_clk1>,
+			 <&clock_gcc clk_gcc_rx1_usb2_clkref_clk>;
+		clock-names = "ref_clk_src", "ref_clk";
+
+		resets = <&clock_gcc QUSB2PHY_PRIM_BCR>;
+		reset-names = "phy_reset";
+	};
+
+	ssphy: ssphy@c010000 {
+		compatible = "qcom,usb-ssphy-qmp-v2";
+		reg = <0x0c010000 0xe0c>,
+		      <0x01fcb244 0x4>,
+		      <0x01fcb248 0x4>;
+		reg-names = "qmp_phy_base",
+			    "vls_clamp_reg",
+			    "tcsr_usb3_dp_phymode";
+		vdd-supply = <&pm660l_l1>;
+		core-supply = <&pm660_l1>;
+		qcom,vdd-voltage-level = <0 880000 880000>;
+		qcom,vbus-valid-override;
+		qcom,qmp-phy-init-seq =
+			/* <reg_offset, value, delay> */
+			<0x138 0x30 0x00
+			 0x034 0x04 0x01
+			 0x080 0x14 0x00
+			 0x03c 0x06 0x00
+			 0x08c 0x08 0x00
+			 0x15c 0x06 0x00
+			 0x164 0x01 0x00
+			 0x13c 0x80 0x00
+			 0x0b0 0x82 0x00
+			 0x0b8 0xab 0x00
+			 0x0bc 0xea 0x00
+			 0x0c0 0x02 0x00
+			 0x060 0x06 0x00
+			 0x068 0x16 0x00
+			 0x070 0x36 0x00
+			 0x0dc 0x00 0x00
+			 0x0d8 0x3f 0x00
+			 0x0f8 0x01 0x00
+			 0x0f4 0xc9 0x00
+			 0x148 0x0a 0x00
+			 0x0a0 0x00 0x00
+			 0x09c 0x34 0x00
+			 0x098 0x15 0x00
+			 0x090 0x04 0x00
+			 0x154 0x00 0x00
+			 0x094 0x00 0x00
+			 0x0f0 0x00 0x00
+			 0x00c 0x0a 0x00
+			 0x048 0x07 0x00
+			 0x0d0 0x80 0x00
+			 0x184 0x01 0x00
+			 0x010 0x01 0x00
+			 0x01c 0x31 0x00
+			 0x020 0x01 0x00
+			 0x014 0x00 0x00
+			 0x018 0x00 0x00
+			 0x024 0x85 0x00
+			 0x028 0x07 0x00
+			 0x430 0x0b 0x00
+			 0x4d4 0x0f 0x00
+			 0x4d8 0x4e 0x00
+			 0x4dc 0x18 0x00
+			 0x4f8 0x07 0x00
+			 0x4fc 0x80 0x00
+			 0x504 0x43 0x00
+			 0x50c 0x1c 0x00
+			 0x434 0x75 0x00
+			 0x43c 0x00 0x00
+			 0x440 0x00 0x00
+			 0x444 0x80 0x00
+			 0x408 0x0a 0x00
+			 0x414 0x06 0x00
+			 0x500 0x00 0x00
+			 0x4c0 0x03 0x00
+			 0x564 0x05 0x00
+			 0x830 0x0b 0x00
+			 0x8d4 0x0f 0x00
+			 0x8d8 0x4e 0x00
+			 0x8dc 0x18 0x00
+			 0x8f8 0x07 0x00
+			 0x8fc 0x80 0x00
+			 0x904 0x43 0x00
+			 0x90c 0x1c 0x00
+			 0x834 0x75 0x00
+			 0x83c 0x00 0x00
+			 0x840 0x00 0x00
+			 0x844 0x80 0x00
+			 0x808 0x0a 0x00
+			 0x814 0x06 0x00
+			 0x900 0x00 0x00
+			 0x8c0 0x03 0x00
+			 0x964 0x05 0x00
+			 0x260 0x10 0x00
+			 0x2a4 0x12 0x00
+			 0x28c 0x16 0x00
+			 0x244 0x00 0x00
+			 0x660 0x10 0x00
+			 0x6a4 0x12 0x00
+			 0x68c 0x16 0x00
+			 0x644 0x00 0x00
+			 0xcc8 0x83 0x00
+			 0xccc 0x09 0x00
+			 0xcd0 0xa2 0x00
+			 0xcd4 0x40 0x00
+			 0xcc4 0x02 0x00
+			 0xc80 0xd1 0x00
+			 0xc84 0x1f 0x00
+			 0xc88 0x47 0x00
+			 0xc64 0x1b 0x00
+			 0xc0c 0x9f 0x00
+			 0xc10 0x9f 0x00
+			 0xc14 0xb7 0x00
+			 0xc18 0x4e 0x00
+			 0xc1c 0x65 0x00
+			 0xc20 0x6b 0x00
+			 0xc24 0x15 0x00
+			 0xc28 0x0d 0x00
+			 0xc2c 0x15 0x00
+			 0xc30 0x0d 0x00
+			 0xc34 0x15 0x00
+			 0xc38 0x0d 0x00
+			 0xc3c 0x15 0x00
+			 0xc40 0x0d 0x00
+			 0xc44 0x15 0x00
+			 0xc48 0x0d 0x00
+			 0xc4c 0x15 0x00
+			 0xc50 0x0d 0x00
+			 0xc5c 0x02 0x00
+			 0xca0 0x04 0x00
+			 0xc8c 0x44 0x00
+			 0xc70 0xe7 0x00
+			 0xc74 0x03 0x00
+			 0xc78 0x40 0x00
+			 0xc7c 0x00 0x00
+			 0xdd8 0x8a 0x00
+			 0xcb8 0x75 0x00
+			 0xcb0 0x86 0x00
+			 0xcbc 0x13 0x00
+			 0xffffffff 0xffffffff 0x00>;
+
+		qcom,qmp-phy-reg-offset =
+				<0xd74 /* USB3_PHY_PCS_STATUS */
+				 0xcd8 /* USB3_PHY_AUTONOMOUS_MODE_CTRL */
+				 0xcdc /* USB3_PHY_LFPS_RXTERM_IRQ_CLEAR */
+				 0xc04 /* USB3_PHY_POWER_DOWN_CONTROL */
+				 0xc00 /* USB3_PHY_SW_RESET */
+				 0xc08 /* USB3_PHY_START */
+				 0xa00>; /* USB3PHY_PCS_MISC_TYPEC_CTRL */
+
+		clocks = <&clock_gcc clk_gcc_usb3_phy_aux_clk>,
+			 <&clock_gcc clk_gcc_usb3_phy_pipe_clk>,
+			 <&clock_gcc clk_ln_bb_clk1>,
+			 <&clock_gcc clk_gcc_usb3_clkref_clk>;
+
+		clock-names = "aux_clk", "pipe_clk", "ref_clk_src",
+				"ref_clk";
+
+		resets = <&clock_gcc USB3_PHY_BCR>,
+			 <&clock_gcc USB3PHY_PHY_BCR>;
+		reset-names = "phy_reset", "phy_phy_reset";
+	};
+
+	usb_audio_qmi_dev {
+		compatible = "qcom,usb-audio-qmi-dev";
+		iommus = <&lpass_q6_smmu 12>;
+		qcom,usb-audio-stream-id = <12>;
+		qcom,usb-audio-intr-num = <2>;
+	};
+
+	dbm_1p5: dbm@a8f8000 {
+		compatible = "qcom,usb-dbm-1p5";
+		reg = <0xa8f8000 0x300>;
+		qcom,reset-ep-after-lpm-resume;
+	};
+
+	usb_nop_phy: usb_nop_phy {
+		compatible = "usb-nop-xceiv";
+	};
+
+	qcom,lpass@17300000 {
+		compatible = "qcom,pil-tz-generic";
+		reg = <0x17300000 0x00100>;
+		interrupts = <0 162 1>;
+
+		vdd_cx-supply = <&pm660l_s3_level>;
+		qcom,proxy-reg-names = "vdd_cx";
+		qcom,vdd_cx-uV-uA = <RPM_SMD_REGULATOR_LEVEL_TURBO 100000>;
+
+		clocks = <&clock_gcc clk_cxo_pil_lpass_clk>;
+		clock-names = "xo";
+		qcom,proxy-clock-names = "xo";
+
+		qcom,pas-id = <1>;
+		qcom,proxy-timeout-ms = <10000>;
+		qcom,smem-id = <423>;
+		qcom,sysmon-id = <1>;
+		status = "ok";
+		qcom,ssctl-instance-id = <0x14>;
+		qcom,firmware-name = "adsp";
+		memory-region = <&pil_adsp_mem>;
+
+		/* GPIO inputs from lpass */
+		qcom,gpio-err-fatal = <&smp2pgpio_ssr_smp2p_2_in 0 0>;
+		qcom,gpio-proxy-unvote = <&smp2pgpio_ssr_smp2p_2_in 2 0>;
+		qcom,gpio-err-ready = <&smp2pgpio_ssr_smp2p_2_in 1 0>;
+		qcom,gpio-stop-ack = <&smp2pgpio_ssr_smp2p_2_in 3 0>;
+
+		/* GPIO output to lpass */
+		qcom,gpio-force-stop = <&smp2pgpio_ssr_smp2p_2_out 0 0>;
+	};
+
+	pil_modem: qcom,mss@4080000 {
+		compatible = "qcom,pil-q6v55-mss";
+		reg = <0x4080000 0x100>,
+		      <0x1f63000 0x008>,
+		      <0x1f65000 0x008>,
+		      <0x1f64000 0x008>,
+		      <0x4180000 0x020>,
+		      <0x00179000 0x004>;
+		reg-names = "qdsp6_base", "halt_q6", "halt_modem",
+			    "halt_nc", "rmb_base", "restart_reg";
+
+		clocks = <&clock_gcc clk_cxo_clk_src>,
+			 <&clock_gcc clk_gcc_mss_cfg_ahb_clk>,
+			 <&clock_gcc clk_gcc_bimc_mss_q6_axi_clk>,
+			 <&clock_gcc clk_gcc_boot_rom_ahb_clk>,
+			 <&clock_gcc clk_gpll0_out_msscc>,
+			 <&clock_gcc clk_gcc_mss_snoc_axi_clk>,
+			 <&clock_gcc clk_gcc_mss_mnoc_bimc_axi_clk>,
+			 <&clock_gcc clk_qdss_clk>;
+		clock-names = "xo", "iface_clk", "bus_clk",
+			      "mem_clk", "gpll0_mss_clk", "snoc_axi_clk",
+			      "mnoc_axi_clk", "qdss_clk";
+		qcom,proxy-clock-names = "xo", "qdss_clk";
+		qcom,active-clock-names = "iface_clk", "bus_clk", "mem_clk",
+					  "gpll0_mss_clk", "snoc_axi_clk",
+					  "mnoc_axi_clk";
+
+		interrupts = <0 448 1>;
+		vdd_cx-supply = <&pm660l_s3_level>;
+		vdd_cx-voltage = <RPM_SMD_REGULATOR_LEVEL_TURBO>;
+		vdd_mx-supply = <&pm660l_s5_level>;
+		vdd_mx-uV = <RPM_SMD_REGULATOR_LEVEL_TURBO>;
+		qcom,firmware-name = "modem";
+		qcom,pil-self-auth;
+		qcom,sysmon-id = <0>;
+		qcom,ssctl-instance-id = <0x12>;
+		qcom,override-acc;
+		qcom,qdsp6v62-1-2;
+		status = "ok";
+		memory-region = <&modem_mem>;
+		qcom,mem-protect-id = <0xF>;
+
+		/* GPIO inputs from mss */
+		qcom,gpio-err-fatal = <&smp2pgpio_ssr_smp2p_1_in 0 0>;
+		qcom,gpio-err-ready = <&smp2pgpio_ssr_smp2p_1_in 1 0>;
+		qcom,gpio-proxy-unvote = <&smp2pgpio_ssr_smp2p_1_in 2 0>;
+		qcom,gpio-stop-ack = <&smp2pgpio_ssr_smp2p_1_in 3 0>;
+		qcom,gpio-shutdown-ack = <&smp2pgpio_ssr_smp2p_1_in 7 0>;
+
+		/* GPIO output to mss */
+		qcom,gpio-force-stop = <&smp2pgpio_ssr_smp2p_1_out 0 0>;
+	};
+
+	tsens0: tsens@10aa000 {
+		compatible = "qcom,msm8998-tsens";
+		reg = <0x10aa000 0x2000>;
+		reg-names = "tsens_physical";
+		interrupts = <0 458 0>, <0 445 0>;
+		interrupt-names = "tsens-upper-lower", "tsens-critical";
+		qcom,client-id = <0 1 2 3 4 7 8 9 10 11 12 13>;
+		qcom,sensor-id = <0 1 2 3 4 7 8 9 10 11 12 13>;
+		qcom,sensors = <12>;
+	};
+
+	tsens1: tsens@10ad000 {
+		compatible = "qcom,msm8998-tsens";
+		reg = <0x10ad000 0x2000>;
+		reg-names = "tsens_physical";
+		interrupts = <0 184 0>, <0 430 0>;
+		interrupt-names = "tsens-upper-lower", "tsens-critical";
+		qcom,client-id = <14 15 16 17 18 19 20 21>;
+		qcom,sensor-id = <0 1 3 4 5 6 7 2>;
+		qcom,sensors = <8>;
+	};
+
+	qcom,sensor-information {
+		compatible = "qcom,sensor-information";
+		sensor_information0: qcom,sensor-information-0 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor0";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information1: qcom,sensor-information-1 {
+			qcom,sensor-type =  "tsens";
+			qcom,sensor-name = "tsens_tz_sensor1";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information2: qcom,sensor-information-2 {
+			qcom,sensor-type =  "tsens";
+			qcom,sensor-name = "tsens_tz_sensor2";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information3: qcom,sensor-information-3 {
+			qcom,sensor-type =  "tsens";
+			qcom,sensor-name = "tsens_tz_sensor3";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information4: qcom,sensor-information-4 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor4";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information7: qcom,sensor-information-7 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor7";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information8: qcom,sensor-information-8 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor8";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information9: qcom,sensor-information-9 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor9";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information10: qcom,sensor-information-10 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor10";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information11: qcom,sensor-information-11 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor11";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information12: qcom,sensor-information-12 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor12";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information13: qcom,sensor-information-13 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor13";
+			qcom,scaling-factor = <10>;
+			qcom,alias-name = "gpu";
+		};
+		sensor_information14: qcom,sensor-information-14 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor14";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information15: qcom,sensor-information-15 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor15";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information16: qcom,sensor-information-16 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor16";
+			qcom,alias-name = "pop_mem";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information17: qcom,sensor-information-17 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor17";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information18: qcom,sensor-information-18 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor18";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information19: qcom,sensor-information-19 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor19";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information20: qcom,sensor-information-20 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor20";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information21: qcom,sensor-information-21 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor21";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information22: qcom,sensor-information-22 {
+			qcom,sensor-type =  "alarm";
+			qcom,sensor-name = "pm8994_tz";
+			qcom,scaling-factor = <1000>;
+		};
+		sensor_information23: qcom,sensor-information-23 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "msm_therm";
+		};
+		sensor_information24: qcom,sensor-information-24 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "emmc_therm";
+		};
+		sensor_information25: qcom,sensor-information-25 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "pa_therm0";
+		};
+		sensor_information26: qcom,sensor-information-26 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "pa_therm1";
+		};
+		sensor_information27: qcom,sensor-information-27 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "quiet_therm";
+		};
+		sensor_information28: qcom,sensor-information-28 {
+			qcom,sensor-type = "llm";
+			qcom,sensor-name = "limits_sensor-01";
+		};
+		sensor_information29: qcom,sensor-information-29 {
+			qcom,sensor-type = "llm";
+			qcom,sensor-name = "limits_sensor-02";
+		};
+	};
+
+	qcom_seecom: qseecom@86600000 {
+		compatible = "qcom,qseecom";
+		reg = <0x86600000 0x2200000>;
+		reg-names = "secapp-region";
+		qcom,hlos-num-ce-hw-instances = <1>;
+		qcom,hlos-ce-hw-instance = <0>;
+		qcom,qsee-ce-hw-instance = <0>;
+		qcom,disk-encrypt-pipe-pair = <2>;
+		qcom,support-fde;
+		qcom,no-clock-support;
+		qcom,appsbl-qseecom-support;
+		qcom,commonlib64-loaded-by-uefi;
+		qcom,msm-bus,name = "qseecom-noc";
+		qcom,msm-bus,num-cases = <4>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<55 512 0 0>,
+				<55 512 0 0>,
+				<55 512 120000 1200000>,
+				<55 512 393600 3936000>;
+		clock-names = "core_clk_src", "core_clk",
+				"iface_clk", "bus_clk";
+		clocks = <&clock_gcc clk_ce1_clk>,
+			 <&clock_gcc clk_qseecom_ce1_clk>,
+			 <&clock_gcc clk_gcc_ce1_ahb_m_clk>,
+			 <&clock_gcc clk_gcc_ce1_axi_m_clk>;
+		qcom,ce-opp-freq = <171430000>;
+		qcom,qsee-reentrancy-support = <2>;
+	};
+
+	qcom_tzlog: tz-log@146BF720 {
+		compatible = "qcom,tz-log";
+		reg = <0x146BF720 0x3000>;
+		qcom,hyplog-enabled;
+		hyplog-address-offset = <0x410>; /* 0x066BFB30 */
+		hyplog-size-offset = <0x414>;    /* 0x066BFB34 */
+	};
+
+	qcom_crypto: qcrypto@1DE0000 {
+		compatible = "qcom,qcrypto";
+		reg = <0x1DE0000 0x20000>,
+		      <0x1DC4000 0x24000>;
+		reg-names = "crypto-base","crypto-bam-base";
+		interrupts = <0 206 0>;
+		qcom,bam-pipe-pair = <2>;
+		qcom,ce-hw-instance = <0>;
+		qcom,ce-device = <0>;
+		qcom,bam-ee = <0>;
+		qcom,ce-hw-shared;
+		qcom,clk-mgmt-sus-res;
+		qcom,msm-bus,name = "qcrypto-noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<55 512 0 0>,
+				<55 512 3936000 393600>;
+		clock-names = "core_clk_src", "core_clk",
+				"iface_clk", "bus_clk";
+		clocks = <&clock_gcc clk_qcrypto_ce1_clk>,
+			 <&clock_gcc clk_qcrypto_ce1_clk>,
+			 <&clock_gcc clk_gcc_ce1_ahb_m_clk>,
+			 <&clock_gcc clk_gcc_ce1_axi_m_clk>;
+		qcom,ce-opp-freq = <171430000>;
+		qcom,use-sw-aes-cbc-ecb-ctr-algo;
+		qcom,use-sw-aes-xts-algo;
+		qcom,use-sw-aes-ccm-algo;
+		qcom,use-sw-ahash-algo;
+		qcom,use-sw-aead-algo;
+		qcom,use-sw-hmac-algo;
+	};
+
+	qcom_cedev: qcedev@1DE0000{
+		compatible = "qcom,qcedev";
+		reg = <0x1DE0000 0x20000>,
+		      <0x1DC4000 0x24000>;
+		reg-names = "crypto-base","crypto-bam-base";
+		interrupts = <0 206 0>;
+		qcom,bam-pipe-pair = <1>;
+		qcom,ce-hw-instance = <0>;
+		qcom,ce-device = <0>;
+		qcom,ce-hw-shared;
+		qcom,bam-ee = <0>;
+		qcom,msm-bus,name = "qcedev-noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<55 512 0 0>,
+				<55 512 3936000 393600>;
+		clock-names = "core_clk_src", "core_clk",
+				"iface_clk", "bus_clk";
+		clocks = <&clock_gcc clk_qcedev_ce1_clk>,
+			 <&clock_gcc clk_qcedev_ce1_clk>,
+			 <&clock_gcc clk_gcc_ce1_ahb_m_clk>,
+			 <&clock_gcc clk_gcc_ce1_axi_m_clk>;
+		qcom,ce-opp-freq = <171430000>;
+	};
+
+	qcom_rng: qrng@793000 {
+		compatible = "qcom,msm-rng";
+		reg = <0x793000 0x1000>;
+		qcom,msm-rng-iface-clk;
+		qcom,no-qrng-config;
+		qcom,msm-bus,name = "msm-rng-noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<1 618 0 0>,	/* No vote */
+			<1 618 0 800>;	/* 100 MB/s */
+		clocks = <&clock_gcc clk_gcc_prng_ahb_clk>;
+		clock-names = "iface_clk";
+	};
+
+	mitigation_profile0: qcom,limit_info-0 {
+		qcom,temperature-sensor = <&sensor_information1>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile1: qcom,limit_info-1 {
+		qcom,temperature-sensor = <&sensor_information2>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile2: qcom,limit_info-2 {
+		qcom,temperature-sensor = <&sensor_information3>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile3: qcom,limit_info-3 {
+		qcom,temperature-sensor = <&sensor_information4>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile4: qcom,limit_info-4 {
+		qcom,temperature-sensor = <&sensor_information7>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile5: qcom,limit_info-5 {
+		qcom,temperature-sensor = <&sensor_information8>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile6: qcom,limit_info-6 {
+		qcom,temperature-sensor = <&sensor_information9>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile7: qcom,limit_info-7 {
+		qcom,temperature-sensor = <&sensor_information10>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	qcom,lmh {
+		compatible = "qcom,lmh_v1";
+		interrupts = <GIC_SPI 134 IRQ_TYPE_LEVEL_HIGH>;
+	};
+
+	qcom,msm-thermal {
+		compatible = "qcom,msm-thermal";
+		qcom,sensor-id = <1>;
+		qcom,poll-ms = <100>;
+		qcom,therm-reset-temp = <115>;
+		qcom,core-limit-temp = <70>;
+		qcom,core-temp-hysteresis = <10>;
+		qcom,hotplug-temp = <105>;
+		qcom,hotplug-temp-hysteresis = <20>;
+		qcom,online-hotplug-core;
+		qcom,synchronous-cluster-id = <0 1>;
+		qcom,synchronous-cluster-map = <0 4 &CPU0 &CPU1 &CPU2 &CPU3>,
+						<1 4 &CPU4 &CPU5 &CPU6 &CPU7>;
+		clock-names = "osm";
+		clocks = <&clock_cpu clk_pwrcl_clk>;
+
+		qcom,vdd-restriction-temp = <5>;
+		qcom,vdd-restriction-temp-hysteresis = <10>;
+
+		vdd-dig-supply = <&pm8998_s1_floor_level>;
+		vdd-gfx-supply = <&gfx_vreg>;
+
+		qcom,vdd-dig-rstr{
+			qcom,vdd-rstr-reg = "vdd-dig";
+			qcom,levels = <RPM_SMD_REGULATOR_LEVEL_NOM
+					RPM_SMD_REGULATOR_LEVEL_TURBO
+					RPM_SMD_REGULATOR_LEVEL_TURBO>;
+				/* Nominal, Super Turbo, Super Turbo */
+			qcom,min-level = <RPM_SMD_REGULATOR_LEVEL_NONE>;
+				/* No Request */
+		};
+
+		qcom,vdd-gfx-rstr{
+			qcom,vdd-rstr-reg = "vdd-gfx";
+			qcom,levels = <5 6 6>; /* Nominal, Turbo, Turbo */
+			qcom,min-level = <1>; /* No Request */
+		};
+
+		msm_thermal_freq: qcom,vdd-apps-rstr{
+			qcom,vdd-rstr-reg = "vdd-apps";
+			qcom,levels = <1248000>;
+			qcom,freq-req;
+		};
+	};
+
+	qcom,bcl {
+		compatible = "qcom,bcl";
+		qcom,bcl-enable;
+		qcom,bcl-framework-interface;
+		qcom,bcl-freq-control-list = <&CPU4 &CPU5 &CPU6 &CPU7>;
+		qcom,bcl-hotplug-list = <&CPU4 &CPU5 &CPU6 &CPU7>;
+		qcom,bcl-soc-hotplug-list = <&CPU4 &CPU5 &CPU6 &CPU7>;
+		qcom,ibat-monitor {
+			qcom,low-threshold-uamp = <3400000>;
+			qcom,high-threshold-uamp = <4200000>;
+			qcom,mitigation-freq-khz = <576000>;
+			qcom,vph-high-threshold-uv = <3500000>;
+			qcom,vph-low-threshold-uv = <3300000>;
+			qcom,soc-low-threshold = <10>;
+			qcom,thermal-handle = <&msm_thermal_freq>;
+		};
+	};
+
+	qcom,ssc@5c00000 {
+		compatible = "qcom,pil-tz-generic";
+		reg = <0x5c00000 0x4000>;
+		interrupts = <0 390 1>;
+
+		vdd_cx-supply = <&pm660l_l9_level>;
+		qcom,vdd_cx-uV-uA = <RPM_SMD_REGULATOR_LEVEL_TURBO 0>;
+		qcom,proxy-reg-names = "vdd_cx";
+		qcom,keep-proxy-regs-on;
+
+		clocks = <&clock_gcc clk_cxo_pil_ssc_clk>,
+			 <&clock_gcc clk_aggre2_noc_clk>;
+		clock-names = "xo", "aggre2";
+		qcom,proxy-clock-names = "xo", "aggre2";
+
+		qcom,pas-id = <12>;
+		qcom,proxy-timeout-ms = <10000>;
+		qcom,smem-id = <424>;
+		qcom,sysmon-id = <3>;
+		qcom,ssctl-instance-id = <0x16>;
+		qcom,firmware-name = "slpi";
+		status = "ok";
+		memory-region = <&pil_slpi_mem>;
+
+		/* GPIO inputs from ssc */
+		qcom,gpio-err-fatal = <&smp2pgpio_ssr_smp2p_3_in 0 0>;
+		qcom,gpio-proxy-unvote = <&smp2pgpio_ssr_smp2p_3_in 2 0>;
+		qcom,gpio-err-ready = <&smp2pgpio_ssr_smp2p_3_in 1 0>;
+		qcom,gpio-stop-ack = <&smp2pgpio_ssr_smp2p_3_in 3 0>;
+
+		/* GPIO output to ssc */
+		qcom,gpio-force-stop = <&smp2pgpio_ssr_smp2p_3_out 0 0>;
+	};
+
+	qcom,venus@cce0000 {
+		compatible = "qcom,pil-tz-generic";
+		reg = <0xcce0000 0x4000>;
+
+		vdd-supply = <&gdsc_venus>;
+		qcom,proxy-reg-names = "vdd";
+
+		clocks = <&clock_mmss clk_mmss_video_core_clk>,
+			 <&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			 <&clock_mmss clk_mmss_video_ahb_clk>,
+			 <&clock_gcc clk_mmssnoc_axi_clk>,
+			 <&clock_mmss clk_mmss_video_axi_clk>,
+			 <&clock_mmss clk_mmss_video_maxi_clk>;
+		clock-names = "core_clk", "mnoc_ahb_clk", "iface_clk",
+			      "noc_axi_clk", "bus_clk", "maxi_clk";
+		qcom,proxy-clock-names = "core_clk","mnoc_ahb_clk",
+		 "iface_clk", "noc_axi_clk", "bus_clk", "maxi_clk";
+
+		qcom,pas-id = <9>;
+		qcom,msm-bus,name = "pil-venus";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<63 512 0 0>,
+			<63 512 0 304000>;
+		qcom,proxy-timeout-ms = <100>;
+		qcom,firmware-name = "venus";
+		memory-region = <&pil_video_mem>;
+		status = "ok";
+	};
+
+	wdog: qcom,wdt@17817000 {
+		compatible = "qcom,msm-watchdog";
+		reg = <0x17817000 0x1000>;
+		reg-names = "wdt-base";
+		interrupts = <0 3 0>, <0 4 0>;
+		qcom,bark-time = <11000>;
+		qcom,pet-time = <10000>;
+		qcom,ipi-ping;
+		qcom,wakeup-enable;
+		qcom,scandump-size = <0x40000>;
+	};
+
+	qcom,spss@1d00000 {
+		compatible = "qcom,pil-tz-generic";
+		reg = <0x1d0101c 0x4>,
+		      <0x1d01024 0x4>,
+		      <0x1d01028 0x4>,
+		      <0x1d0103c 0x4>,
+		      <0x1d02030 0x4>;
+		reg-names = "sp2soc_irq_status", "sp2soc_irq_clr",
+			    "sp2soc_irq_mask", "rmb_err", "rmb_err_spare2";
+		interrupts = <0 352 1>;
+
+		vdd_cx-supply = <&pm8998_s1_level>;
+		qcom,proxy-reg-names = "vdd_cx";
+		qcom,vdd_cx-uV-uA = <RPM_SMD_REGULATOR_LEVEL_TURBO 100000>;
+
+		clocks = <&clock_gcc clk_cxo_pil_spss_clk>;
+		clock-names = "xo";
+		qcom,proxy-clock-names = "xo";
+		qcom,pil-generic-irq-handler;
+		status = "ok";
+
+		qcom,pas-id = <14>;
+		qcom,proxy-timeout-ms = <10000>;
+		qcom,firmware-name = "spss";
+		memory-region = <&spss_mem>;
+		qcom,spss-scsr-bits = <24 25>;
+	};
+
+	qcom,msm-rtb {
+		compatible = "qcom,msm-rtb";
+		qcom,rtb-size = <0x100000>;
+	};
+
+	qcom,mpm2-sleep-counter@10a3000 {
+		compatible = "qcom,mpm2-sleep-counter";
+		reg = <0x010a3000 0x1000>;
+		clock-frequency = <32768>;
+	};
+
+	qcom,msm-imem@146bf000 {
+		compatible = "qcom,msm-imem";
+		reg = <0x146bf000 0x1000>;
+		ranges = <0x0 0x146bf000 0x1000>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		mem_dump_table@10 {
+			compatible = "qcom,msm-imem-mem_dump_table";
+			reg = <0x10 8>;
+		};
+
+		dload_type@18 {
+			compatible = "qcom,msm-imem-dload-type";
+			reg = <0x18 4>;
+		};
+
+		restart_reason@65c {
+			compatible = "qcom,msm-imem-restart_reason";
+			reg = <0x65c 4>;
+		};
+
+		boot_stats@6b0 {
+			compatible = "qcom,msm-imem-boot_stats";
+			reg = <0x6b0 32>;
+		};
+
+		pil@94c {
+			compatible = "qcom,msm-imem-pil";
+			reg = <0x94c 200>;
+		};
+
+		diag_dload@c8 {
+			compatible = "qcom,msm-imem-diag-dload";
+			reg = <0xc8 200>;
+		};
+	};
+
+	cpu_pmu: cpu-pmu {
+		compatible = "arm,armv8-pmuv3";
+		qcom,irq-is-percpu;
+		interrupts = <1 6 4>;
+	};
+
+	cpuss_dump {
+		compatible = "qcom,cpuss-dump";
+		qcom,l1_i_cache0 {
+			qcom,dump-node = <&L1_I_0>;
+			qcom,dump-id = <0x60>;
+		};
+		qcom,l1_i_cache1 {
+			qcom,dump-node = <&L1_I_1>;
+			qcom,dump-id = <0x61>;
+		};
+		qcom,l1_i_cache2 {
+			qcom,dump-node = <&L1_I_2>;
+			qcom,dump-id = <0x62>;
+		};
+		qcom,l1_i_cache3 {
+			qcom,dump-node = <&L1_I_3>;
+			qcom,dump-id = <0x63>;
+		};
+		qcom,l1_i_cache100 {
+			qcom,dump-node = <&L1_I_100>;
+			qcom,dump-id = <0x64>;
+		};
+		qcom,l1_i_cache101 {
+			qcom,dump-node = <&L1_I_101>;
+			qcom,dump-id = <0x65>;
+		};
+		qcom,l1_i_cache102 {
+			qcom,dump-node = <&L1_I_102>;
+			qcom,dump-id = <0x66>;
+		};
+		qcom,l1_i_cache103 {
+			qcom,dump-node = <&L1_I_103>;
+			qcom,dump-id = <0x67>;
+		};
+		qcom,l1_d_cache0 {
+			qcom,dump-node = <&L1_D_0>;
+			qcom,dump-id = <0x80>;
+		};
+		qcom,l1_d_cache1 {
+			qcom,dump-node = <&L1_D_1>;
+			qcom,dump-id = <0x81>;
+		};
+		qcom,l1_d_cache2 {
+			qcom,dump-node = <&L1_D_2>;
+			qcom,dump-id = <0x82>;
+		};
+		qcom,l1_d_cache3 {
+			qcom,dump-node = <&L1_D_3>;
+			qcom,dump-id = <0x83>;
+		};
+		qcom,l1_d_cache100 {
+			qcom,dump-node = <&L1_D_100>;
+			qcom,dump-id = <0x84>;
+		};
+		qcom,l1_d_cache101 {
+			qcom,dump-node = <&L1_D_101>;
+			qcom,dump-id = <0x85>;
+		};
+		qcom,l1_d_cache102 {
+			qcom,dump-node = <&L1_D_102>;
+			qcom,dump-id = <0x86>;
+		};
+		qcom,l1_d_cache103 {
+			qcom,dump-node = <&L1_D_103>;
+			qcom,dump-id = <0x87>;
+		};
+	};
+
+	qcom,msm-ssc-sensors {
+		compatible = "qcom,msm-ssc-sensors";
+		status = "ok";
+	};
+
+	dcc: dcc@10b3000 {
+		compatible = "qcom,dcc";
+		reg = <0x10b3000 0x1000>,
+		      <0x10b4000 0x2000>;
+		reg-names = "dcc-base", "dcc-ram-base";
+
+		clocks = <&clock_gcc clk_gcc_dcc_ahb_clk>;
+		clock-names = "dcc_clk";
+	};
+
+	qcom,msm-core@780000 {
+		compatible = "qcom,apss-core-ea";
+		reg = <0x780000 0x1000>;
+		qcom,low-hyst-temp = <10>;
+		qcom,high-hyst-temp = <5>;
+		qcom,polling-interval = <50>;
+
+		ea0: ea0 {
+			sensor = <&sensor_information1>;
+		};
+
+		ea1: ea1 {
+			sensor = <&sensor_information2>;
+		};
+
+		ea2: ea2 {
+			sensor = <&sensor_information3>;
+		};
+
+		ea3: ea3 {
+			sensor = <&sensor_information4>;
+		};
+
+		ea4: ea4 {
+			sensor = <&sensor_information7>;
+		};
+
+		ea5: ea5 {
+			sensor = <&sensor_information8>;
+		};
+
+		ea6: ea6 {
+			sensor = <&sensor_information9>;
+		};
+
+		ea7: ea7 {
+			sensor = <&sensor_information10>;
+		};
+
+	};
+
+	 qcom,icnss@18800000 {
+		compatible = "qcom,icnss";
+		reg = <0x18800000 0x800000>,
+		      <0x10AC000 0x20>,
+		      <0xa0000000 0x10000000>,
+		      <0xb0000000 0x10000>;
+		reg-names = "membase", "mpm_config",
+			    "smmu_iova_base", "smmu_iova_ipa";
+		iommus = <&anoc2_smmu 0x1900>,
+			<&anoc2_smmu 0x1901>;
+		interrupts = <0 413 0 /* CE0 */ >,
+			     <0 414 0 /* CE1 */ >,
+			     <0 415 0 /* CE2 */ >,
+			     <0 416 0 /* CE3 */ >,
+			     <0 417 0 /* CE4 */ >,
+			     <0 418 0 /* CE5 */ >,
+			     <0 420 0 /* CE6 */ >,
+			     <0 421 0 /* CE7 */ >,
+			     <0 422 0 /* CE8 */ >,
+			     <0 423 0 /* CE9 */ >,
+			     <0 424 0 /* CE10 */ >,
+			     <0 425 0 /* CE11 */ >;
+		qcom,wlan-msa-memory = <0x100000>;
+		qcom,icnss-vadc = <&pm660_vadc>;
+		qcom,icnss-adc_tm = <&pm660_adc_tm>;
+	};
+
+	tspp: msm_tspp@0c1e7000 {
+		compatible = "qcom,msm_tspp";
+		reg = <0x0c1e7000 0x200>, /* MSM_TSIF0_PHYS */
+		      <0x0c1e8000 0x200>, /* MSM_TSIF1_PHYS */
+		      <0x0c1e9000 0x1000>, /* MSM_TSPP_PHYS  */
+		      <0x0c1c4000 0x23000>; /* MSM_TSPP_BAM_PHYS */
+		reg-names = "MSM_TSIF0_PHYS",
+			"MSM_TSIF1_PHYS",
+			"MSM_TSPP_PHYS",
+			"MSM_TSPP_BAM_PHYS";
+		interrupts = <0 121 0>, /* TSIF_TSPP_IRQ */
+			<0 119 0>, /* TSIF0_IRQ */
+			<0 120 0>, /* TSIF1_IRQ */
+			<0 122 0>; /* TSIF_BAM_IRQ */
+		interrupt-names = "TSIF_TSPP_IRQ",
+			"TSIF0_IRQ",
+			"TSIF1_IRQ",
+			"TSIF_BAM_IRQ";
+
+		clock-names = "iface_clk", "ref_clk";
+		clocks = <&clock_gcc clk_gcc_tsif_ahb_clk>,
+			<&clock_gcc clk_gcc_tsif_ref_clk>;
+
+		qcom,msm-bus,name = "tsif";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<82 512 0 0>, /* No vote */
+				<82 512 12288 24576>;
+				/* Max. bandwidth, 2xTSIF, each max of 96Mbps */
+
+		pinctrl-names = "disabled",
+			"tsif0-mode1", "tsif0-mode2",
+			"tsif1-mode1", "tsif1-mode2",
+			"dual-tsif-mode1", "dual-tsif-mode2";
+
+		pinctrl-0 = <>;				/* disabled */
+		pinctrl-1 = <&tsif0_signals_active>;	/* tsif0-mode1 */
+		pinctrl-2 = <&tsif0_signals_active
+			&tsif0_sync_active>;		/* tsif0-mode2 */
+		pinctrl-3 = <&tsif1_signals_active>;	/* tsif1-mode1 */
+		pinctrl-4 = <&tsif1_signals_active
+			&tsif1_sync_active>;		/* tsif1-mode2 */
+		pinctrl-5 = <&tsif0_signals_active
+			&tsif1_signals_active>;		/* dual-tsif-mode1 */
+		pinctrl-6 = <&tsif0_signals_active
+			&tsif0_sync_active
+			&tsif1_signals_active
+			&tsif1_sync_active>;		/* dual-tsif-mode2 */
+	};
+
+	wil6210: qcom,wil6210 {
+		compatible = "qcom,wil6210";
+		qcom,pcie-parent = <&pcie0>;
+		qcom,wigig-en = <&tlmm 80 0>;
+		qcom,msm-bus,name = "wil6210";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<45 512 0 0>,
+			<45 512 600000 800000>; /* ~4.6Gbps (MCS12) */
+		qcom,use-ext-supply;
+		vdd-supply= <&pm8998_s7>;
+		vddio-supply= <&pm8998_s5>;
+		qcom,use-ext-clocks;
+		clocks = <&clock_gcc clk_rf_clk3>,
+			 <&clock_gcc clk_rf_clk3_pin>;
+		clock-names = "rf_clk3_clk", "rf_clk3_pin_clk";
+		qcom,smmu-support;
+		status = "disabled";
+	};
+
+	qcom,qsee_ipc_irq_bridge {
+		compatible = "qcom,qsee-ipc-irq-bridge";
+
+		qcom,qsee-ipc-irq-spss {
+			qcom,rx-irq-clr = <0x1d08008 0x4>;
+			qcom,rx-irq-clr-mask = <0x1>;
+			qcom,dev-name = "qsee_ipc_irq_spss";
+			interrupts = <0 349 4>;
+			label = "spss";
+		};
+	};
+};
+
+&clock_cpu {
+	lmh_dcvs0: qcom,limits-dcvs@0 {
+		compatible = "qcom,msm-hw-limits";
+		interrupts = <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>;
+	};
+
+	lmh_dcvs1: qcom,limits-dcvs@1 {
+		compatible = "qcom,msm-hw-limits";
+		interrupts = <GIC_SPI 38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&gdsc_usb30 {
+	status = "ok";
+};
+
+&gdsc_pcie_0 {
+	status = "ok";
+};
+
+&gdsc_ufs {
+	status = "ok";
+};
+
+&gdsc_bimc_smmu {
+	clock-names = "bus_clk";
+	clocks = <&clock_mmss clk_mmss_bimc_smmu_axi_clk>;
+	proxy-supply = <&gdsc_bimc_smmu>;
+	qcom,proxy-consumer-enable;
+	status = "ok";
+};
+
+&gdsc_hlos1_vote_lpass_adsp {
+	status = "ok";
+};
+
+&gdsc_hlos1_vote_lpass_core {
+	status = "ok";
+};
+
+&gdsc_venus {
+	status = "ok";
+};
+
+&gdsc_venus_core0 {
+	status = "ok";
+	qcom,support-hw-trigger;
+};
+
+&gdsc_venus_core1 {
+	status = "ok";
+	qcom,support-hw-trigger;
+};
+
+&gdsc_camss_top {
+	status = "ok";
+};
+
+&gdsc_vfe0 {
+	parent-supply = <&gdsc_camss_top>;
+	status = "ok";
+};
+
+&gdsc_vfe1 {
+	parent-supply = <&gdsc_camss_top>;
+	status = "ok";
+};
+
+&gdsc_cpp {
+	parent-supply = <&gdsc_camss_top>;
+	qcom,support-hw-trigger;
+	status = "ok";
+};
+
+&gdsc_mdss {
+	proxy-supply = <&gdsc_mdss>;
+	qcom,proxy-consumer-enable;
+	status = "ok";
+};
+
+&gdsc_gpu_gx {
+	clock-names = "core_root_clk";
+	clocks = <&clock_gfx clk_gfx3d_clk_src>;
+	qcom,force-enable-root-clk;
+	parent-supply = <&gfx_vreg>;
+	status = "ok";
+};
+
+&gdsc_gpu_cx {
+	status = "ok";
+};
+
+#include "msm-pm8998.dtsi"
+#include "msm-pmi8998.dtsi"
+#include "msm-pm8005.dtsi"
+#include "msm-pm8998-rpm-regulator.dtsi"
+#include "msm8998-regulator.dtsi"
+
+#include "msm8998-pm.dtsi"
+#include "msm-arm-smmu-8998.dtsi"
+#include "msm-arm-smmu-impl-defs-8998.dtsi"
+#include "msm8998-ion.dtsi"
+#include "msm8998-camera.dtsi"
+#include "msm8998-vidc.dtsi"
+#include "msm8998-coresight.dtsi"
+#include "msm8998-bus.dtsi"
+#include "msm8998-gpu.dtsi"
+#include "msm8998-pinctrl.dtsi"
+#include "msm8998-mdss.dtsi"
+#include "msm8998-mdss-pll.dtsi"
+#include "msm8998-blsp.dtsi"
+#include "msm-smb138x.dtsi"
+
+/* GPU overrides */
+&msm_gpu {
+	qcom,initial-pwrlevel = <0>;
+
+	qcom,gpu-pwrlevels {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		compatible = "qcom,gpu-pwrlevels";
+		qcom,gpu-pwrlevel@0 {
+			reg = <0>;
+			qcom,gpu-freq = <332000000>;
+			qcom,bus-freq = <7>;
+			qcom,bus-min = <6>;
+			qcom,bus-max = <8>;
+		};
+
+		qcom,gpu-pwrlevel@1 {
+			reg = <1>;
+			qcom,gpu-freq = <251000000>;
+			qcom,bus-freq = <4>;
+			qcom,bus-min = <3>;
+			qcom,bus-max = <5>;
+		};
+
+		qcom,gpu-pwrlevel@2 {
+			reg = <2>;
+			qcom,gpu-freq = <171000000>;
+			qcom,bus-freq = <3>;
+			qcom,bus-min = <1>;
+			qcom,bus-max = <4>;
+		};
+
+		qcom,gpu-pwrlevel@3 {
+			reg = <3>;
+			qcom,gpu-freq = <27000000>;
+			qcom,bus-freq = <0>;
+			qcom,bus-min = <0>;
+			qcom,bus-max = <0>;
+		};
+	};
+
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-ion.dtsi b/arch/arm64/boot/dts/qcom/msm8998-ion.dtsi
new file mode 100644
index 000000000000..7b15fd81c710
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-ion.dtsi
@@ -0,0 +1,53 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	qcom,ion {
+		compatible = "qcom,msm-ion";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		system_heap: qcom,ion-heap@25 {
+			reg = <25>;
+			qcom,ion-heap-type = "SYSTEM";
+		};
+
+		qcom,ion-heap@22 { /* ADSP HEAP */
+			reg = <22>;
+			memory-region = <&adsp_mem>;
+			qcom,ion-heap-type = "DMA";
+		};
+
+		qcom,ion-heap@27 { /* QSEECOM HEAP */
+			reg = <27>;
+			memory-region = <&qseecom_mem>;
+			qcom,ion-heap-type = "DMA";
+		};
+
+		qcom,ion-heap@13 { /* SPSS HEAP */
+			reg = <13>;
+			memory-region = <&sp_mem>;
+			qcom,ion-heap-type = "DMA";
+		};
+
+		qcom,ion-heap@10 { /* SECURE DISPLAY HEAP */
+			reg = <10>;
+			memory-region = <&secure_display_memory>;
+			qcom,ion-heap-type = "HYP_CMA";
+		};
+
+		qcom,ion-heap@9 {
+			reg = <9>;
+			qcom,ion-heap-type = "SYSTEM_SECURE";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-mdss-panels.dtsi b/arch/arm64/boot/dts/qcom/msm8998-mdss-panels.dtsi
new file mode 100644
index 000000000000..897ab12fe0a7
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-mdss-panels.dtsi
@@ -0,0 +1,229 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "dsi-panel-nt35597-dualmipi-wqxga-video.dtsi"
+#include "dsi-panel-nt35597-dualmipi-wqxga-cmd.dtsi"
+#include "dsi-panel-nt35597-truly-dualmipi-wqxga-video.dtsi"
+#include "dsi-panel-nt35597-truly-dualmipi-wqxga-cmd.dtsi"
+#include "dsi-panel-nt35597-dsc-wqxga-video.dtsi"
+#include "dsi-panel-nt35597-dsc-wqxga-cmd.dtsi"
+#include "dsi-panel-sharp-dsc-4k-video.dtsi"
+#include "dsi-panel-sharp-dsc-4k-cmd.dtsi"
+#include "dsi-panel-jdi-dualmipi-video.dtsi"
+#include "dsi-panel-jdi-dualmipi-cmd.dtsi"
+#include "dsi-panel-sharp-1080p-cmd.dtsi"
+#include "dsi-panel-jdi-1080p-video.dtsi"
+#include "dsi-panel-sharp-dualmipi-1080p-120hz.dtsi"
+#include "dsi-panel-jdi-a407-dualmipi-wqhd-cmd.dtsi"
+#include "dsi-panel-sim-video.dtsi"
+#include "dsi-panel-sim-cmd.dtsi"
+#include "dsi-panel-sim-dualmipi-video.dtsi"
+#include "dsi-panel-sim-dualmipi-cmd.dtsi"
+#include "dsi-panel-s6e3ha3-amoled-dualmipi-wqhd-cmd.dtsi"
+#include "dsi-panel-nt36850-truly-dualmipi-wqhd-cmd.dtsi"
+
+&soc {
+	dsi_panel_pwr_supply: dsi_panel_pwr_supply {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "wqhd-vddio";
+			qcom,supply-min-voltage = <1880000>;
+			qcom,supply-max-voltage = <1880000>;
+			qcom,supply-enable-load = <32000>;
+			qcom,supply-disable-load = <80>;
+		};
+
+		qcom,panel-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "lab";
+			qcom,supply-min-voltage = <4600000>;
+			qcom,supply-max-voltage = <6000000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+
+		qcom,panel-supply-entry@2 {
+			reg = <2>;
+			qcom,supply-name = "ibb";
+			qcom,supply-min-voltage = <4600000>;
+			qcom,supply-max-voltage = <6000000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+			qcom,supply-post-on-sleep = <10>;
+		};
+	};
+};
+
+&soc {
+	dsi_panel_pwr_supply_no_labibb: dsi_panel_pwr_supply_no_labibb {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "wqhd-vddio";
+			qcom,supply-min-voltage = <1880000>;
+			qcom,supply-max-voltage = <1880000>;
+			qcom,supply-enable-load = <32000>;
+			qcom,supply-disable-load = <80>;
+		};
+	};
+};
+
+&dsi_dual_nt35597_video {
+	qcom,mdss-dsi-panel-timings = [00 1a 04 06 0a 0a 05 06 05 03 04 00];
+	qcom,mdss-dsi-t-clk-post = <0x07>;
+	qcom,mdss-dsi-t-clk-pre = <0x25>;
+	qcom,mdss-dsi-tx-eot-append;
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-min-refresh-rate = <55>;
+	qcom,mdss-dsi-max-refresh-rate = <60>;
+	qcom,mdss-dsi-pan-enable-dynamic-fps;
+	qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x9c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x9c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-panel-max-error-count = <3>;
+};
+
+&dsi_dual_nt35597_cmd {
+	qcom,mdss-dsi-panel-timings = [00 1c 08 07 23 22 07 07 05 03 04 00];
+	qcom,mdss-dsi-t-clk-post = <0x0d>;
+	qcom,mdss-dsi-t-clk-pre = <0x2d>;
+	qcom,mdss-dsi-tx-eot-append;
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x9c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x9c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-panel-max-error-count = <3>;
+};
+
+&dsi_dual_nt35597_truly_video {
+	qcom,mdss-dsi-panel-timings = [00 19 05 06 0a 0f 05 06 05 03 04 00];
+	qcom,mdss-dsi-t-clk-post = <0x07>;
+	qcom,mdss-dsi-t-clk-pre = <0x26>;
+};
+
+&dsi_dual_nt35597_truly_cmd {
+	qcom,mdss-dsi-panel-timings = [00 19 05 06 0a 0f 05 06 05 03 04 00];
+	qcom,mdss-dsi-t-clk-post = <0x07>;
+	qcom,mdss-dsi-t-clk-pre = <0x26>;
+};
+
+&dsi_nt35597_dsc_video {
+	qcom,mdss-dsi-panel-timings = [00 11 04 04 07 0c 04 04 03 03 04 00];
+	qcom,mdss-dsi-t-clk-post = <0x05>;
+	qcom,mdss-dsi-t-clk-pre = <0x1b>;
+	qcom,mdss-dsi-tx-eot-append;
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x9c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x9c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-panel-max-error-count = <3>;
+	qcom,mdss-dsi-min-refresh-rate = <55>;
+	qcom,mdss-dsi-max-refresh-rate = <60>;
+	qcom,mdss-dsi-pan-enable-dynamic-fps;
+	qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
+};
+
+&dsi_nt35597_dsc_cmd {
+	qcom,mdss-dsi-panel-timings = [00 11 04 04 07 0c 04 04 03 03 04 00];
+	qcom,mdss-dsi-t-clk-post = <0x05>;
+	qcom,mdss-dsi-t-clk-pre = <0x1b>;
+	qcom,mdss-dsi-tx-eot-append;
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x9c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x9c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-panel-max-error-count = <3>;
+};
+
+&dsi_sharp_4k_dsc_video {
+	qcom,mdss-dsi-panel-timings = [00 35 0a 0c 15 1b 09 0d 0a 03 04 00];
+	qcom,mdss-dsi-t-clk-post = <0x0d>;
+	qcom,mdss-dsi-t-clk-pre = <0x26>;
+	qcom,mdss-dsi-min-refresh-rate = <55>;
+	qcom,mdss-dsi-max-refresh-rate = <60>;
+	qcom,mdss-dsi-pan-enable-dynamic-fps;
+	qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
+};
+
+&dsi_sharp_4k_dsc_cmd {
+	qcom,mdss-dsi-panel-timings = [00 35 0a 0c 15 1b 09 0d 0a 03 04 00];
+	qcom,mdss-dsi-t-clk-post = <0x0d>;
+	qcom,mdss-dsi-t-clk-pre = <0x26>;
+};
+
+&dsi_dual_jdi_video {
+	qcom,mdss-dsi-panel-timings = [00 17 05 05 09 0f 05 06 04 03 04 00];
+	qcom,mdss-dsi-t-clk-post = <0x06>;
+	qcom,mdss-dsi-t-clk-pre = <0x23>;
+};
+
+&dsi_dual_jdi_cmd {
+	qcom,mdss-dsi-panel-timings = [00 17 05 05 09 0f 05 06 04 03 04 00];
+	qcom,mdss-dsi-t-clk-post = <0x06>;
+	qcom,mdss-dsi-t-clk-pre = <0x23>;
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "te_signal_check";
+};
+
+&dsi_sharp_1080_cmd {
+	qcom,mdss-dsi-panel-timings = [00 16 05 05 09 0e 05 06 04 03 04 00];
+	qcom,mdss-dsi-t-clk-post = <0x06>;
+	qcom,mdss-dsi-t-clk-pre = <0x22>;
+};
+
+&dsi_jdi_1080p_video {
+	qcom,mdss-dsi-panel-timings = [00 1a 06 06 0a 11 05 07 05 03 04 00];
+	qcom,mdss-dsi-t-clk-post = <0x07>;
+	qcom,mdss-dsi-t-clk-pre = <0x28>;
+};
+
+&dsi_dual_sharp_1080_120hz_cmd {
+	qcom,mdss-dsi-panel-timings = [00 19 05 06 0a 0f 05 06 05 03 04 00];
+	qcom,mdss-dsi-t-clk-post = <0x7>;
+	qcom,mdss-dsi-t-clk-pre = <0x26>;
+};
+
+&dsi_dual_jdi_a407_cmd {
+	qcom,mdss-dsi-panel-timings = [00 16 05 05 09 0e 05 05 04 03 04 00];
+	qcom,mdss-dsi-t-clk-post = <0x06>;
+	qcom,mdss-dsi-t-clk-pre = <0x22>;
+};
+
+&dsi_dual_s6e3ha3_amoled_cmd {
+	qcom,mdss-dsi-panel-timings = [00 1c 06 06 0b 10 06 07 05 03 04 00];
+	qcom,mdss-dsi-t-clk-post = <0x07>;
+	qcom,mdss-dsi-t-clk-pre = <0x2a>;
+};
+
+&dsi_dual_nt36850_truly_cmd {
+	qcom,mdss-dsi-panel-timings = [00 1c 06 06 0b 11 06 07 05 03 04 00];
+	qcom,mdss-dsi-t-clk-post = <0x34>;
+	qcom,mdss-dsi-t-clk-pre = <0x2a>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-mdss-pll.dtsi b/arch/arm64/boot/dts/qcom/msm8998-mdss-pll.dtsi
new file mode 100644
index 000000000000..d12b0ea1a9cc
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-mdss-pll.dtsi
@@ -0,0 +1,173 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	mdss_dsi0_pll: qcom,mdss_dsi_pll@c994400 {
+		compatible = "qcom,mdss_dsi_pll_8998";
+		status = "ok";
+		label = "MDSS DSI 0 PLL";
+		cell-index = <0>;
+		#clock-cells = <1>;
+
+		reg = <0xc994a00 0x1c0>,
+		      <0xc994400 0x7c0>,
+		      <0x0c8c2300 0x8>;
+		reg-names = "pll_base", "phy_base", "gdsc_base";
+
+		gdsc-supply = <&gdsc_mdss>;
+
+		clocks = <&clock_mmss clk_mmss_mdss_ahb_clk>;
+		clock-names = "iface_clk";
+		clock-rate = <0>;
+		qcom,dsi-pll-ssc-en;
+		qcom,dsi-pll-ssc-mode = "down-spread";
+
+		qcom,platform-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,platform-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+
+		};
+	};
+
+	mdss_dsi1_pll: qcom,mdss_dsi_pll@c996400 {
+		compatible = "qcom,mdss_dsi_pll_8998";
+		status = "ok";
+		label = "MDSS DSI 1 PLL";
+		cell-index = <1>;
+		#clock-cells = <1>;
+
+		reg = <0x0c996a00 0x1c0>,
+		      <0x0c996400 0x7c0>,
+		      <0x008c2300 0x8>;
+		reg-names = "pll_base", "phy_base", "gdsc_base";
+
+		gdsc-supply = <&gdsc_mdss>;
+
+		clocks = <&clock_mmss clk_mmss_mdss_ahb_clk>;
+		clock-names = "iface_clk";
+		clock-rate = <0>;
+		qcom,dsi-pll-ssc-en;
+		qcom,dsi-pll-ssc-mode = "down-spread";
+
+		qcom,platform-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,platform-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+	};
+
+	mdss_dp_pll: qcom,mdss_dp_pll@c011000 {
+		compatible = "qcom,mdss_dp_pll_8998";
+		status = "ok";
+		label = "MDSS DP PLL";
+		cell-index = <0>;
+		#clock-cells = <1>;
+
+		reg = <0xc011c00 0x190>,
+		      <0xc011000 0x910>,
+		      <0x0c8c2300 0x8>;
+		reg-names = "pll_base", "phy_base", "gdsc_base";
+
+		gdsc-supply = <&gdsc_mdss>;
+
+		clocks = <&clock_mmss clk_mmss_mdss_ahb_clk>,
+			 <&clock_gcc clk_ln_bb_clk1>,
+			 <&clock_gcc clk_gcc_usb3_clkref_clk>;
+		clock-names = "iface_clk", "ref_clk_src", "ref_clk";
+		clock-rate = <0>;
+
+		qcom,platform-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,platform-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+
+		};
+	};
+
+	mdss_hdmi_pll: qcom,mdss_hdmi_pll@0xc9a0600 {
+		compatible = "qcom,mdss_hdmi_pll_8998";
+		label = "MDSS HDMI PLL";
+		cell-index = <2>;
+		#clock-cells = <1>;
+
+		reg = <0xc9a0600 0xb10>,
+		      <0xc9a1200 0x0e4>,
+		      <0xc8c2300 0x8>;
+		reg-names = "pll_base", "phy_base", "gdsc_base";
+
+		gdsc-supply = <&gdsc_mdss>;
+		vdda-pll-supply = <&pm8998_l2>;
+		vdda-phy-supply = <&pm8998_l12>;
+
+		clocks = <&clock_mmss clk_mmss_mdss_ahb_clk>,
+			 <&clock_gcc clk_gcc_hdmi_clkref_clk>,
+			 <&clock_gcc clk_ln_bb_clk1>;
+		clock-names = "iface_clk", "ref_clk", "ref_clk_src";
+		clock-rate = <0>;
+
+		qcom,platform-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,platform-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+			qcom,platform-supply-entry@1 {
+				reg = <1>;
+				qcom,supply-name = "vdda-pll";
+				qcom,supply-min-voltage = <1200000>;
+				qcom,supply-max-voltage = <1200000>;
+				qcom,supply-enable-load = <14200>;
+				qcom,supply-disable-load = <1>;
+			};
+
+			qcom,platform-supply-entry@2 {
+				reg = <2>;
+				qcom,supply-name = "vdda-phy";
+				qcom,supply-min-voltage = <1800000>;
+				qcom,supply-max-voltage = <1800000>;
+				qcom,supply-enable-load = <13100>;
+				qcom,supply-disable-load = <4>;
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-mdss.dtsi b/arch/arm64/boot/dts/qcom/msm8998-mdss.dtsi
new file mode 100644
index 000000000000..5708fce44378
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-mdss.dtsi
@@ -0,0 +1,668 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	mdss_mdp: qcom,mdss_mdp@c900000 {
+		compatible = "qcom,mdss_mdp";
+		status = "ok";
+		reg = <0x0c900000 0x90000>,
+		      <0x0c9b0000 0x1040>;
+		reg-names = "mdp_phys", "vbif_phys";
+		interrupts = <0 83 0>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		vdd-supply = <&gdsc_mdss>;
+		gdsc-core-supply = <&gdsc_bimc_smmu>;
+
+		/* Bus Scale Settings */
+		qcom,msm-bus,name = "mdss_mdp";
+		qcom,msm-bus,num-cases = <3>;
+		qcom,msm-bus,num-paths = <2>;
+		qcom,msm-bus,vectors-KBps =
+			<22 512 0 0>, <23 512 0 0>,
+			<22 512 0 6400000>, <23 512 0 6400000>,
+			<22 512 0 6400000>, <23 512 0 6400000>;
+
+		/* Fudge factors */
+		qcom,mdss-ab-factor = <1 1>;		/* 1 time  */
+		qcom,mdss-ib-factor = <1 1>;		/* 1 time  */
+		qcom,mdss-clk-factor = <105 100>;	/* 1.05 times */
+
+		qcom,max-mixer-width = <2560>;
+		qcom,max-pipe-width = <2560>;
+
+		qcom,max-dest-scaler-input-width = <2048>;
+		qcom,max-dest-scaler-output-width = <2560>;
+
+		/* VBIF QoS remapper settings*/
+		qcom,mdss-vbif-qos-rt-setting = <1 2 2 2>;
+		qcom,mdss-vbif-qos-nrt-setting = <1 1 1 1>;
+		qcom,vbif-settings = <0x00ac 0x00000040>,
+				     <0x00d0 0x00001010>; /* v1 only */
+
+		qcom,mdss-has-panic-ctrl;
+		qcom,mdss-per-pipe-panic-luts = <0x000f>,
+						<0xffff>,
+						<0xfffc>,
+						<0xff00>;
+
+		qcom,mdss-mdp-reg-offset = <0x00001000>;
+		qcom,max-bandwidth-low-kbps = <6700000>;
+		qcom,max-bandwidth-high-kbps = <6700000>;
+		qcom,max-bandwidth-per-pipe-kbps = <2400000>;
+		qcom,max-clk-rate = <412500000>;
+		qcom,mdss-default-ot-rd-limit = <32>;
+		qcom,mdss-default-ot-wr-limit = <32>;
+		qcom,mdss-dram-channels = <2>;
+
+		qcom,mdss-pipe-vig-off = <0x00005000 0x00007000
+					  0x00009000 0x0000b000>;
+		qcom,mdss-pipe-dma-off = <0x00025000 0x00027000
+					  0x00029000 0x0002b000>;
+		qcom,mdss-pipe-cursor-off = <0x00035000 0x00037000>;
+
+		qcom,mdss-pipe-vig-xin-id = <0 4 8 12>;
+		qcom,mdss-pipe-dma-xin-id = <1 5 9 13>;
+		qcom,mdss-pipe-cursor-xin-id = <2 10>;
+
+		/* These Offsets are relative to
+		 * "mdp_phys + mdp-reg-offset" address
+		*/
+		qcom,mdss-pipe-vig-clk-ctrl-offsets = <0x2ac 0 0>,
+						      <0x2b4 0 0>,
+						      <0x2bc 0 0>,
+						      <0x2c4 0 0>;
+		qcom,mdss-pipe-dma-clk-ctrl-offsets = <0x2ac  8 12>,
+						      <0x2b4  8 12>,
+						      <0x2c4  8 12>,
+						      <0x2c4 12 14>;
+		qcom,mdss-pipe-cursor-clk-ctrl-offsets = <0x3a8 16 15>,
+							 <0x3b0 16 15>;
+
+		qcom,mdss-ctl-off = <0x00002000 0x00002200 0x00002400
+				     0x00002600 0x00002800>;
+		qcom,mdss-mixer-intf-off = <0x00045000 0x00046000
+					    0x00047000 0x0004a000>;
+		qcom,mdss-dspp-off = <0x00055000 0x00057000>;
+		qcom,mdss-wb-off = <0x00066000>;
+		qcom,mdss-intf-off = <0x0006b000 0x0006b800
+					0x0006c000 0x0006c800>;
+		qcom,mdss-pingpong-off = <0x00071000 0x00071800
+					  0x00072000 0x00072800>;
+		qcom,mdss-slave-pingpong-off = <0x00073000>;
+		qcom,mdss-ppb-ctl-off = <0x00000330 0x00000338 0x00000370
+			0x00000374> ;
+		qcom,mdss-ppb-cfg-off = <0x00000334 0x0000033C>;
+		qcom,mdss-has-pingpong-split;
+		qcom,mdss-has-separate-rotator;
+
+		qcom,mdss-ad-off = <0x0079000 0x00079800>;
+		qcom,mdss-cdm-off = <0x0007a200>;
+		qcom,mdss-dsc-off = <0x00081000 0x00081400>;
+		qcom,mdss-wfd-mode = "intf";
+		qcom,mdss-has-source-split;
+		qcom,mdss-highest-bank-bit = <0x2>;
+		qcom,mdss-has-decimation;
+		qcom,mdss-idle-power-collapse-enabled;
+		clocks = <&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			 <&clock_mmss clk_mmss_mdss_ahb_clk>,
+			 <&clock_mmss clk_mmss_mdss_axi_clk>,
+			 <&clock_mmss clk_mdp_clk_src>,
+			 <&clock_mmss clk_mmss_mdss_mdp_clk>,
+			 <&clock_mmss clk_mmss_mdss_vsync_clk>,
+			 <&clock_mmss clk_mmss_mdss_mdp_lut_clk>;
+		clock-names = "mnoc_clk", "iface_clk", "bus_clk",
+				"core_clk_src", "core_clk", "vsync_clk",
+				"lut_clk";
+
+		qcom,mdp-settings = <0x01190 0x00000000>,
+				    <0x012ac 0xc0000ccc>,
+				    <0x012b4 0xc0000ccc>,
+				    <0x012bc 0x00cccccc>,
+				    <0x012c4 0x0000cccc>,
+				    <0x013a8 0x0cccc0c0>,
+				    <0x013b0 0xccccc0c0>,
+				    <0x013b8 0xcccc0000>,
+				    <0x013d0 0x00cc0000>,
+				    <0x0506c 0x00000000>,
+				    <0x0706c 0x00000000>,
+				    <0x0906c 0x00000000>,
+				    <0x0b06c 0x00000000>,
+				    <0x1506c 0x00000000>,
+				    <0x1706c 0x00000000>,
+				    <0x1906c 0x00000000>,
+				    <0x1b06c 0x00000000>,
+				    <0x2506c 0x00000000>,
+				    <0x2706c 0x00000000>;
+
+		qcom,regs-dump-mdp = <0x01000 0x01458>,
+				     <0x02000 0x02094>,
+				     <0x02200 0x02294>,
+				     <0x02400 0x02494>,
+				     <0x02600 0x02694>,
+				     <0x02800 0x02894>,
+				     <0x05000 0x05154>,
+				     <0x05a00 0x05b00>,
+				     <0x07000 0x07154>,
+				     <0x07a00 0x07b00>,
+				     <0x09000 0x09154>,
+				     <0x09a00 0x09b00>,
+				     <0x0b000 0x0b154>,
+				     <0x0ba00 0x0bb00>,
+				     <0x25000 0x25184>,
+				     <0x27000 0x27184>,
+				     <0x29000 0x29184>,
+				     <0x2b000 0x2b184>,
+				     <0x35000 0x35150>,
+				     <0x37000 0x37150>,
+				     <0x45000 0x452bc>,
+				     <0x46000 0x462bc>,
+				     <0x47000 0x472bc>,
+				     <0x48000 0x482bc>,
+				     <0x49000 0x492bc>,
+				     <0x4a000 0x4a2bc>,
+				     <0x55000 0x5522c>,
+				     <0x57000 0x5722c>,
+				     <0x61000 0x61014>,
+				     <0x61800 0x61888>,
+				     <0x62000 0x62088>,
+				     <0x66000 0x662c0>,
+				     <0x6b000 0x6b268>,
+				     <0x6b800 0x6ba68>,
+				     <0x6c000 0x6c268>,
+				     <0x6c800 0x6ca68>,
+				     <0x71000 0x710d4>,
+				     <0x71800 0x718d4>,
+				     <0x73000 0x730d4>,
+				     <0x81000 0x81140>,
+				     <0x81400 0x81540>;
+
+		qcom,regs-dump-names-mdp = "MDP",
+			"CTL_0",    "CTL_1", "CTL_2",   "CTL_3", "CTL_4",
+			"VIG0_SSPP", "VIG0",  "VIG1_SSPP", "VIG1",
+			"VIG2_SSPP", "VIG2",  "VIG3_SSPP", "VIG3",
+			"DMA0_SSPP", "DMA1_SSPP",
+			"DMA2_SSPP", "DMA3_SSPP",
+			"CURSOR0_SSPP", "CURSOR1_SSPP",
+			"LAYER_0", "LAYER_1", "LAYER_2",
+			"LAYER_3", "LAYER_4", "LAYER_5",
+			"DSPP_0",  "DSPP_1",
+			"DEST_SCALER_OP", "DEST_SCALER_0", "DEST_SCALER_1",
+			"WB_2",
+			"INTF_0", "INTF_1",  "INTF_2", "INTF_3",
+			"PP_0",    "PP_1", "PP_4",
+			"DSC_0",    "DSC_1";
+
+		/* buffer parameters to calculate prefill bandwidth */
+		qcom,mdss-prefill-outstanding-buffer-bytes = <0>;
+		qcom,mdss-prefill-y-buffer-bytes = <0>;
+		qcom,mdss-prefill-scaler-buffer-lines-bilinear = <2>;
+		qcom,mdss-prefill-scaler-buffer-lines-caf = <4>;
+		qcom,mdss-prefill-post-scaler-buffer-pixels = <2560>;
+		qcom,mdss-prefill-pingpong-buffer-pixels = <5120>;
+
+		qcom,mdss-pp-offsets {
+			qcom,mdss-sspp-mdss-igc-lut-off = <0x2000>;
+			qcom,mdss-sspp-vig-pcc-off = <0x1b00>;
+			qcom,mdss-sspp-rgb-pcc-off = <0x380>;
+			qcom,mdss-sspp-dma-pcc-off = <0x380>;
+			qcom,mdss-lm-pgc-off = <0x3c0>;
+			qcom,mdss-dspp-gamut-off = <0x1600>;
+			qcom,mdss-dspp-pcc-off = <0x1700>;
+			qcom,mdss-dspp-pgc-off = <0x17c0>;
+		};
+
+		qcom,mdss-scaler-offsets {
+			qcom,mdss-vig-scaler-off = <0xa00>;
+			qcom,mdss-vig-scaler-lut-off = <0xb00>;
+			qcom,mdss-has-dest-scaler;
+			qcom,mdss-dest-block-off = <0x00061000>;
+			qcom,mdss-dest-scaler-off = <0x800 0x1000>;
+			qcom,mdss-dest-scaler-lut-off = <0x900 0x1100>;
+		};
+
+		smmu_mdp_unsec: qcom,smmu_mdp_unsec_cb {
+			compatible = "qcom,smmu_mdp_unsec";
+			iommus = <&mmss_smmu 0>;
+			gdsc-mmagic-mdss-supply = <&gdsc_bimc_smmu>;
+			clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+				<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+				<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+				<&clock_mmss clk_mmss_bimc_smmu_axi_clk>;
+			clock-names = "mmss_noc_axi_clk",
+					"mmss_noc_ahb_clk",
+					"mmss_smmu_ahb_clk",
+					"mmss_smmu_axi_clk";
+		};
+
+		smmu_mdp_sec: qcom,smmu_mdp_sec_cb {
+			compatible = "qcom,smmu_mdp_sec";
+			iommus = <&mmss_smmu 1>;
+			gdsc-mmagic-mdss-supply = <&gdsc_bimc_smmu>;
+			clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+				<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+				<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+				<&clock_mmss clk_mmss_bimc_smmu_axi_clk>;
+			clock-names = "mmss_noc_axi_clk",
+					"mmss_noc_ahb_clk",
+					"mmss_smmu_ahb_clk",
+					"mmss_smmu_axi_clk";
+		};
+
+		mdss_fb0: qcom,mdss_fb_primary {
+			cell-index = <0>;
+			compatible = "qcom,mdss-fb";
+			qcom,cont-splash-memory {
+				linux,contiguous-region = <&cont_splash_mem>;
+			};
+		};
+
+		mdss_fb1: qcom,mdss_fb_wfd {
+			cell-index = <1>;
+			compatible = "qcom,mdss-fb";
+		};
+
+		mdss_fb2: qcom,mdss_fb_hdmi {
+			cell-index = <2>;
+			compatible = "qcom,mdss-fb";
+			qcom,mdss-intf = <&mdss_hdmi_tx>;
+		};
+
+		mdss_fb3: qcom,mdss_fb_dp {
+			cell-index = <3>;
+			compatible = "qcom,mdss-fb";
+			qcom,mdss-intf = <&mdss_dp_ctrl>;
+		};
+
+	};
+
+	mdss_dsi: qcom,mdss_dsi@0 {
+		compatible = "qcom,mdss-dsi";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		gdsc-supply = <&gdsc_mdss>;
+		vdda-1p2-supply = <&pm8998_l2>;
+		vdda-0p9-supply = <&pm8998_l1>;
+		ranges = <0xc994000 0xc994000 0x400
+			0xc994400 0xc994400 0x7c0
+			0xc828000 0xc828000 0xac
+			0xc996000 0xc996000 0x400
+			0xc996400 0xc996400 0x7c0
+			0xc828000 0xc828000 0xac>;
+
+		/* Bus Scale Settings */
+		qcom,msm-bus,name = "mdss_dsi";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<22 512 0 0>,
+			<22 512 0 1000>;
+
+		qcom,mmss-ulp-clamp-ctrl-offset = <0x14>;
+
+		clocks = <&clock_mmss clk_mmss_mdss_mdp_clk>,
+			 <&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			 <&clock_mmss clk_mmss_mdss_ahb_clk>,
+			 <&clock_mmss clk_mmss_mdss_axi_clk>,
+			 <&clock_mmss clk_mmss_misc_ahb_clk>,
+			 <&clock_mmss clk_ext_byte0_clk_src>,
+			 <&clock_mmss clk_ext_byte1_clk_src>,
+			 <&clock_mmss clk_ext_pclk0_clk_src>,
+			 <&clock_mmss clk_ext_pclk1_clk_src>;
+		clock-names = "mdp_core_clk",
+			"mnoc_clk", "iface_clk",
+			"bus_clk", "core_mmss_clk",
+			"ext_byte0_clk", "ext_byte1_clk",
+			"ext_pixel0_clk", "ext_pixel1_clk";
+
+		qcom,core-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,core-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+				qcom,supply-lp-mode-disable-allowed;
+			};
+		};
+
+		qcom,ctrl-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,ctrl-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vdda-1p2";
+				qcom,supply-min-voltage = <1200000>;
+				qcom,supply-max-voltage = <1200000>;
+				qcom,supply-enable-load = <12560>;
+				qcom,supply-disable-load = <4>;
+			};
+		};
+
+		qcom,phy-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,phy-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vdda-0p9";
+				qcom,supply-min-voltage = <880000>;
+				qcom,supply-max-voltage = <880000>;
+				qcom,supply-enable-load = <73400>;
+				qcom,supply-disable-load = <32>;
+				qcom,supply-lp-mode-disable-allowed;
+			};
+		};
+
+		mdss_dsi0: qcom,mdss_dsi_ctrl0@c994000 {
+			pinctrl-names = "mdss_default", "mdss_sleep";
+			pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+			pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+			compatible = "qcom,mdss-dsi-ctrl";
+			label = "MDSS DSI CTRL->0";
+			cell-index = <0>;
+			reg =	<0xc994000 0x400>,
+				<0xc994400 0x7c0>,
+				<0xc828000 0xac>;
+			reg-names = "dsi_ctrl", "dsi_phy", "mmss_misc_phys";
+
+			qcom,timing-db-mode;
+			wqhd-vddio-supply = <&pm8998_l14>;
+			lab-supply = <&lab_regulator>;
+			ibb-supply = <&ibb_regulator>;
+			qcom,mdss-mdp = <&mdss_mdp>;
+			qcom,mdss-fb-map = <&mdss_fb0>;
+
+			qcom,null-insertion-enabled;
+
+			clocks = <&clock_mmss clk_mmss_mdss_byte0_clk>,
+				 <&clock_mmss clk_mmss_mdss_pclk0_clk>,
+				 <&clock_mmss clk_mmss_mdss_esc0_clk>,
+				 <&clock_mmss clk_byte0_clk_src>,
+				 <&clock_mmss clk_pclk0_clk_src>,
+				 <&clock_mmss clk_mmss_mdss_byte0_intf_clk>;
+			clock-names = "byte_clk", "pixel_clk", "core_clk",
+				"byte_clk_rcg", "pixel_clk_rcg",
+				"byte_intf_clk";
+
+			qcom,platform-strength-ctrl =  [55 03
+							55 03
+							55 03
+							55 03
+							55 00];
+			qcom,platform-lane-config = [00 00 00 00
+						00 00 00 00
+						00 00 00 00
+						00 00 00 00
+						00 00 00 80];
+		};
+
+		mdss_dsi1: qcom,mdss_dsi_ctrl1@c996000 {
+			compatible = "qcom,mdss-dsi-ctrl";
+			label = "MDSS DSI CTRL->1";
+			cell-index = <1>;
+			reg =	<0xc996000 0x400>,
+				<0xc996400 0x7c0>,
+				<0xc828000 0xac>;
+			reg-names = "dsi_ctrl", "dsi_phy", "mmss_misc_phys";
+
+			qcom,timing-db-mode;
+			wqhd-vddio-supply = <&pm8998_l14>;
+			lab-supply = <&lab_regulator>;
+			ibb-supply = <&ibb_regulator>;
+			qcom,mdss-mdp = <&mdss_mdp>;
+			qcom,mdss-fb-map = <&mdss_fb0>;
+
+			qcom,null-insertion-enabled;
+
+			clocks = <&clock_mmss clk_mmss_mdss_byte1_clk>,
+				 <&clock_mmss clk_mmss_mdss_pclk1_clk>,
+				 <&clock_mmss clk_mmss_mdss_esc1_clk>,
+				 <&clock_mmss clk_byte1_clk_src>,
+				 <&clock_mmss clk_pclk1_clk_src>,
+				 <&clock_mmss clk_mmss_mdss_byte1_intf_clk>;
+			clock-names = "byte_clk", "pixel_clk", "core_clk",
+				"byte_clk_rcg", "pixel_clk_rcg",
+				"byte_intf_clk";
+
+			qcom,platform-strength-ctrl =  [55 03
+							55 03
+							55 03
+							55 03
+							55 00];
+			qcom,platform-lane-config = [00 00 00 00
+						00 00 00 00
+						00 00 00 00
+						00 00 00 00
+						00 00 00 80];
+		};
+	};
+
+	qcom,mdss_wb_panel {
+		compatible = "qcom,mdss_wb";
+		qcom,mdss_pan_res = <640 480>;
+		qcom,mdss_pan_bpp = <24>;
+		qcom,mdss-fb-map = <&mdss_fb1>;
+	};
+
+	msm_ext_disp: qcom,msm_ext_disp {
+		compatible = "qcom,msm-ext-disp";
+
+		ext_disp_audio_codec: qcom,msm-ext-disp-audio-codec-rx {
+			compatible = "qcom,msm-ext-disp-audio-codec-rx";
+			qcom,msm_ext_disp = <&msm_ext_disp>;
+		};
+	};
+
+	mdss_dp_ctrl: qcom,dp_ctrl@c990000 {
+		cell-index = <0>;
+		compatible = "qcom,mdss-dp";
+		qcom,mdss-fb-map = <&mdss_fb3>;
+
+		gdsc-supply = <&gdsc_mdss>;
+		vdda-1p2-supply = <&pm8998_l2>;
+		vdda-0p9-supply = <&pm8998_l1>;
+
+		reg =	<0xc990000 0xa84>,
+			<0xc011000 0x910>,
+			<0x1fcb200 0x050>,
+			<0xc8c2200 0x1a0>,
+			<0x780000 0x621c>,
+			<0xc9e1000 0x02c>;
+		reg-names = "dp_ctrl", "dp_phy", "tcsr_regs", "dp_mmss_cc",
+				"qfprom_physical","hdcp_physical";
+
+		clocks = <&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			 <&clock_mmss clk_mmss_mdss_ahb_clk>,
+			 <&clock_mmss clk_mmss_mdss_axi_clk>,
+			 <&clock_mmss clk_mmss_mdss_mdp_clk>,
+			 <&clock_mmss clk_mmss_mdss_hdmi_dp_ahb_clk>,
+			 <&clock_mmss clk_mmss_mdss_dp_aux_clk>,
+			 <&clock_gcc clk_ln_bb_clk1>,
+			 <&clock_gcc clk_gcc_usb3_clkref_clk>,
+			 <&clock_mmss clk_mmss_mdss_dp_link_clk>,
+			 <&clock_mmss clk_mmss_mdss_dp_link_intf_clk>,
+			 <&clock_mmss clk_mmss_mdss_dp_crypto_clk>,
+			 <&clock_mmss clk_mmss_mdss_dp_pixel_clk>;
+		clock-names = "core_mnoc_clk", "core_iface_clk", "core_bus_clk",
+			"core_mdp_core_clk", "core_alt_iface_clk",
+			"core_aux_clk", "core_ref_clk_src", "core_ref_clk",
+			"ctrl_link_clk", "ctrl_link_iface_clk",
+			"ctrl_crypto_clk", "ctrl_pixel_clk";
+
+		qcom,dp-usbpd-detection = <&pmi8998_pdphy>;
+
+		qcom,msm_ext_disp = <&msm_ext_disp>;
+
+		qcom,aux-cfg0-settings = [1c 00];
+		qcom,aux-cfg1-settings = [20 13 23 1d];
+		qcom,aux-cfg2-settings = [24 00];
+		qcom,aux-cfg3-settings = [28 00];
+		qcom,aux-cfg4-settings = [2c 0a];
+		qcom,aux-cfg5-settings = [30 26];
+		qcom,aux-cfg6-settings = [34 0a];
+		qcom,aux-cfg7-settings = [38 03];
+		qcom,aux-cfg8-settings = [3c bb];
+		qcom,aux-cfg9-settings = [40 03];
+		qcom,logical2physical-lane-map = [02 03 01 00];
+
+		qcom,core-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,core-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+
+		qcom,ctrl-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,ctrl-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vdda-1p2";
+				qcom,supply-min-voltage = <1200000>;
+				qcom,supply-max-voltage = <1200000>;
+				qcom,supply-enable-load = <12560>;
+				qcom,supply-disable-load = <4>;
+			};
+		};
+
+		qcom,phy-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,phy-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vdda-0p9";
+				qcom,supply-min-voltage = <880000>;
+				qcom,supply-max-voltage = <880000>;
+				qcom,supply-enable-load = <73400>;
+				qcom,supply-disable-load = <32>;
+			};
+		};
+	};
+
+	mdss_rotator: qcom,mdss_rotator {
+		compatible = "qcom,sde_rotator";
+		reg = <0x0c900000 0xab100>,
+		      <0x0c9b8000 0x1040>;
+		reg-names = "mdp_phys",
+			"rot_vbif_phys";
+
+		qcom,mdss-rot-mode = <1>;
+		qcom,mdss-highest-bank-bit = <0x2>;
+
+		/* Bus Scale Settings */
+		qcom,msm-bus,name = "mdss_rotator";
+		qcom,msm-bus,num-cases = <3>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<25 512 0 0>,
+			<25 512 0 6400000>,
+			<25 512 0 6400000>;
+
+		rot-vdd-supply = <&gdsc_mdss>;
+		qcom,supply-names = "rot-vdd";
+
+		clocks = <&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_mdss_ahb_clk>,
+			<&clock_mmss clk_rot_clk_src>,
+			<&clock_mmss clk_mmss_mdss_rot_clk>,
+			<&clock_mmss clk_mmss_mdss_axi_clk>;
+		clock-names = "mnoc_clk",
+			"iface_clk", "rot_core_clk",
+			"rot_clk", "axi_clk";
+
+		interrupt-parent = <&mdss_mdp>;
+		interrupts = <2 0>;
+
+		/* VBIF QoS remapper settings*/
+		qcom,mdss-rot-vbif-qos-setting = <1 1 1 1>;
+
+		qcom,mdss-default-ot-rd-limit = <32>;
+		qcom,mdss-default-ot-wr-limit = <32>;
+
+		smmu_rot_unsec: qcom,smmu_rot_unsec_cb {
+			compatible = "qcom,smmu_sde_rot_unsec";
+			iommus = <&mmss_smmu 0xe00>;
+			gdsc-mdss-supply = <&gdsc_bimc_smmu>;
+			clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+				<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+				<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+				<&clock_mmss clk_mmss_bimc_smmu_axi_clk>;
+			clock-names = "mmss_noc_axi_clk",
+					"mmss_noc_ahb_clk",
+					"mmss_smmu_ahb_clk",
+					"mmss_smmu_axi_clk";
+		};
+
+		smmu_rot_sec: qcom,smmu_rot_sec_cb {
+			compatible = "qcom,smmu_sde_rot_sec";
+			iommus = <&mmss_smmu 0xe01>;
+			gdsc-mdss-supply = <&gdsc_bimc_smmu>;
+			clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+				<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+				<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+				<&clock_mmss clk_mmss_bimc_smmu_axi_clk>;
+			clock-names = "mmss_noc_axi_clk",
+					"mmss_noc_ahb_clk",
+					"mmss_smmu_ahb_clk",
+					"mmss_smmu_axi_clk";
+			      };
+	};
+
+	mdss_hdmi_tx: qcom,hdmi_tx@c9a0000 {
+		cell-index = <0>;
+		compatible = "qcom,hdmi-tx";
+
+		reg =	<0xc9a0000 0x50c>,
+			<0x780000 0x621c>,
+			<0xc9e0000 0x28>;
+		reg-names = "core_physical", "qfprom_physical", "hdcp_physical";
+
+		hpd-gdsc-supply = <&gdsc_mdss>;
+
+		qcom,supply-names = "hpd-gdsc";
+		qcom,min-voltage-level = <0>;
+		qcom,max-voltage-level = <0>;
+		qcom,enable-load = <0>;
+		qcom,disable-load = <0>;
+
+		qcom,msm_ext_disp = <&msm_ext_disp>;
+
+		clocks = <&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			 <&clock_mmss clk_mmss_mdss_ahb_clk>,
+			 <&clock_mmss clk_mmss_mdss_hdmi_clk>,
+			 <&clock_mmss clk_mmss_mdss_mdp_clk>,
+			 <&clock_mmss clk_mmss_mdss_hdmi_dp_ahb_clk>,
+			 <&clock_mmss clk_mmss_mdss_extpclk_clk>;
+
+		clock-names = "hpd_mnoc_clk", "hpd_iface_clk",
+				"hpd_core_clk", "hpd_mdp_core_clk",
+				"hpd_alt_iface_clk", "core_extp_clk";
+
+		qcom,mdss-fb-map = <&mdss_fb2>;
+		qcom,pluggable;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-mtp-overlay.dts b/arch/arm64/boot/dts/qcom/msm8998-mtp-overlay.dts
new file mode 100644
index 000000000000..0659ced82a56
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-mtp-overlay.dts
@@ -0,0 +1,29 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/msm-clocks-8998.h>
+#include <dt-bindings/regulator/qcom,rpm-smd-regulator.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v1 MTP";
+	compatible = "qcom,msm8998-mtp", "qcom,msm8998", "qcom,mtp";
+	qcom,msm-id = <292 0x0>;
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-mtp.dts b/arch/arm64/boot/dts/qcom/msm8998-mtp.dts
new file mode 100644
index 000000000000..8a38d1eeea50
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-mtp.dts
@@ -0,0 +1,39 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8998.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v1 MTP";
+	compatible = "qcom,msm8998-mtp", "qcom,msm8998", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
+
+&qusb_phy0 {
+	qcom,qusb-phy-host-init-seq =
+			/* value reg_offsets> */
+				<0x63 0x210
+				0x13 0x04
+				0x7c 0x18c
+				0x80 0x2c
+				0x0a 0x184
+				0x8c 0x21c
+				0x05 0x23c
+				0x03 0x240
+				0xff 0x218
+				0x62 0x210>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi b/arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi
new file mode 100644
index 000000000000..14cb260b8f35
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi
@@ -0,0 +1,615 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/irq.h>
+#include "msm8998-camera-sensor-mtp.dtsi"
+&vendor {
+	bluetooth: bt_wcn3990 {
+		compatible = "qca,wcn3990";
+		qca,bt-vdd-io-supply = <&pm8998_s3>;
+		qca,bt-vdd-xtal-supply = <&pm8998_s5>;
+		qca,bt-vdd-core-supply = <&pm8998_l7>;
+		qca,bt-vdd-pa-supply = <&pm8998_l17>;
+		qca,bt-vdd-ldo-supply = <&pm8998_l25>;
+		qca,bt-chip-pwd-supply = <&pmi8998_bob_pin1>;
+		clocks = <&clock_gcc clk_rf_clk2_pin>;
+		clock-names = "rf_clk2";
+
+		qca,bt-vdd-io-voltage-level = <1352000 1352000>;
+		qca,bt-vdd-xtal-voltage-level = <2040000 2040000>;
+		qca,bt-vdd-core-voltage-level = <1800000 1800000>;
+		qca,bt-vdd-pa-voltage-level = <1304000 1304000>;
+		qca,bt-vdd-ldo-voltage-level = <3312000 3312000>;
+		qca,bt-chip-pwd-voltage-level = <3600000 3600000>;
+
+		qca,bt-vdd-io-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-xtal-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-core-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-pa-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-ldo-current-level = <1>; /* LPM/PFM */
+	};
+};
+
+&blsp1_uart3_hs {
+	status = "ok";
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm8998_l1>;
+	vdda-pll-supply = <&pm8998_l2>;
+	vddp-ref-clk-supply = <&pm8998_l26>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14600>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm8998_l20>;
+	vccq-supply = <&pm8998_l26>;
+	vccq2-supply = <&pm8998_s4>;
+	vcc-max-microamp = <750000>;
+	vccq-max-microamp = <560000>;
+	vccq2-max-microamp = <750000>;
+	status = "ok";
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8998_l21>;
+	qcom,vdd-voltage-level = <2950000 2960000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8998_l13>;
+	qcom,vdd-io-voltage-level = <1808000 2960000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000
+				50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x1>;
+
+	status = "ok";
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&pm8998_gpios {
+	/* GPIO 2 for Home Key */
+	gpio@c100 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 6 for Vol+ Key */
+	gpio@c500 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 7 for Snapshot Key */
+	gpio@c600 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 8 for Focus Key */
+	gpio@c700 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	gpio@cc00 { /* GPIO 13 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <0>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <3>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@d200 { /* GPIO 19 - wil6210 refclk3_en */
+		qcom,mode = <0>;		/* Input */
+		qcom,pull = <5>;		/* No Pull */
+		qcom,vin-sel = <1>;		/* VIN1 GPIO_MV */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	/* GPIO 21 (NFC_CLK_REQ) */
+	gpio@d400 {
+		qcom,mode = <0>;
+		qcom,vin-sel = <1>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	/* GPIO 18 SMB138X */
+	gpio@d100 {
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&pmi8998_gpios {
+	/* GPIO 6 for the internal QNOVO discharge FET control signal */
+	gpio@c500 {
+		status = "okay";
+		qcom,mode = <1>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,master-en = <1>;
+	};
+};
+
+&i2c_5 {
+	status = "okay";
+	synaptics@20 {
+		compatible = "synaptics,dsx";
+		reg = <0x20>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <125 0x2008>;
+		vdd-supply = <&pm8998_l6>;
+		avdd-supply = <&pm8998_l28>;
+		synaptics,vdd-voltage = <1808000 1808000>;
+		synaptics,avdd-voltage = <3008000 3008000>;
+		synaptics,vdd-current = <40000>;
+		synaptics,avdd-current = <20000>;
+		pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+		pinctrl-0 = <&ts_active>;
+		pinctrl-1 = <&ts_int_suspend &ts_reset_suspend>;
+		synaptics,display-coords = <0 0 1439 2559>;
+		synaptics,panel-coords = <0 0 1439 2559>;
+		synaptics,reset-gpio = <&tlmm 89 0x00>;
+		synaptics,irq-gpio = <&tlmm 125 0x2008>;
+		synaptics,disable-gpios;
+		synaptics,fw-name = "PR1702898-s3528t_60QHD_00400001.img";
+	};
+};
+
+&i2c_6 { /* BLSP1 QUP6 (NFC) */
+	status = "okay";
+	nq@28 {
+		compatible = "qcom,nq-nci";
+		reg = <0x28>;
+		qcom,nq-irq = <&tlmm 92 0x00>;
+		qcom,nq-ven = <&tlmm 12 0x00>;
+		qcom,nq-firm = <&tlmm 93 0x00>;
+		qcom,nq-clkreq = <&pm8998_gpios 21 0x00>;
+		qcom,nq-esepwr = <&tlmm 116 0x00>;
+		interrupt-parent = <&tlmm>;
+		qcom,clk-src = "BBCLK3";
+		interrupts = <92 0>;
+		interrupt-names = "nfc_irq";
+		pinctrl-names = "nfc_active", "nfc_suspend";
+		pinctrl-0 = <&nfc_int_active &nfc_enable_active>;
+		pinctrl-1 = <&nfc_int_suspend &nfc_enable_suspend>;
+		clocks = <&clock_gcc clk_ln_bb_clk3_pin>;
+		clock-names = "ref_clk";
+	};
+};
+
+&mdss_hdmi_tx {
+	pinctrl-names = "hdmi_hpd_active", "hdmi_ddc_active", "hdmi_cec_active",
+				"hdmi_active", "hdmi_sleep";
+	pinctrl-0 = <&mdss_hdmi_5v_active  &mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_suspend &mdss_hdmi_cec_suspend>;
+	pinctrl-1 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_active &mdss_hdmi_cec_suspend>;
+	pinctrl-2 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+			&mdss_hdmi_cec_active &mdss_hdmi_ddc_suspend>;
+	pinctrl-3 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_active &mdss_hdmi_cec_active>;
+	pinctrl-4 = <&mdss_hdmi_5v_suspend &mdss_hdmi_hpd_suspend
+			&mdss_hdmi_ddc_suspend &mdss_hdmi_cec_suspend>;
+};
+
+&mdss_dp_ctrl {
+	pinctrl-names = "mdss_dp_active", "mdss_dp_sleep";
+	pinctrl-0 = <&mdss_dp_aux_active &mdss_dp_usbplug_cc_active>;
+	pinctrl-1 = <&mdss_dp_aux_suspend &mdss_dp_usbplug_cc_suspend>;
+	qcom,aux-en-gpio = <&tlmm 77 0>;
+	qcom,aux-sel-gpio = <&tlmm 78 0>;
+	qcom,usbplug-cc-gpio = <&tlmm 38 0>;
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,panel-mode-gpio = <&tlmm 91 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,panel-mode-gpio = <&tlmm 91 0>;
+};
+
+&labibb {
+	status = "ok";
+	qcom,qpnp-labibb-mode = "lcd";
+};
+
+&pmi8998_wled {
+	qcom,led-strings-list = [00 01];
+};
+
+&red_led {
+	/delete-property/ linux,default-trigger;
+	qcom,start-idx = <0>;
+	qcom,idx-len = <10>;
+	qcom,duty-pcts = [00 19 32 4b 64
+			64 4b 32 19 00];
+	qcom,use-blink;
+};
+
+&green_led {
+	/delete-property/ linux,default-trigger;
+};
+
+&dsi_dual_nt35597_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled = "single_roi";
+	qcom,panel-roi-alignment = <720 256 720 256 1440 256>;
+};
+
+&dsi_dual_nt35597_truly_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_truly_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35597_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "single_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35597_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "single_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_4k_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_4k_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_jdi_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,5v-boost-gpio = <&tlmm 51 0>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_jdi_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,5v-boost-gpio = <&tlmm 51 0>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_1080_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_jdi_1080p_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_no_labibb>;
+	qcom,5v-boost-gpio = <&tlmm 51 0>;
+};
+
+&dsi_dual_sharp_1080_120hz_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sim_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sim_vid {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_sim_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_sim_vid {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&mem_client_3_size {
+	qcom,peripheral-size = <0x500000>;
+};
+
+&pmi8998_haptics {
+	status = "okay";
+};
+
+&pm8998_vadc {
+	chan@83 {
+		label = "vph_pwr";
+		reg = <0x83>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@85 {
+		label = "vcoin";
+		reg = <0x85>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@4c {
+		label = "xo_therm";
+		reg = <0x4c>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@4d {
+		label = "msm_therm";
+		reg = <0x4d>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@51 {
+		label = "quiet_therm";
+		reg = <0x51>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8998_adc_tm {
+	chan@83 {
+		label = "vph_pwr";
+		reg = <0x83>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,btm-channel-number = <0x60>;
+	};
+
+	chan@4d {
+		label = "msm_therm";
+		reg = <0x4d>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@51 {
+		label = "quiet_therm";
+		reg = <0x51>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@4c {
+		label = "xo_therm";
+		reg = <0x4c>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+};
+
+&wil6210 {
+	status = "ok";
+};
+
+&snd_9335 {
+	qcom,mbhc-audio-jack-type = "6-pole-jack";
+};
+
+&soc {
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+		status = "okay";
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8998_gpios 6 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_snapshot {
+			label = "cam_snapshot";
+			gpios = <&pm8998_gpios 7 0x1>;
+			linux,input-type = <1>;
+			linux,code = <766>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_focus {
+			label = "cam_focus";
+			gpios = <&pm8998_gpios 8 0x1>;
+			linux,input-type = <1>;
+			linux,code = <528>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+};
+
+&vendor {
+	mtp_batterydata: qcom,battery-data {
+		qcom,batt-id-range-pct = <15>;
+		#include "fg-gen3-batterydata-itech-3000mah.dtsi"
+		#include "fg-gen3-batterydata-ascent-3450mah.dtsi"
+		#include "fg-gen3-batterydata-demo-6000mah.dtsi"
+	};
+};
+
+&pmi8998_fg {
+	qcom,battery-data = <&mtp_batterydata>;
+};
+
+&pmi8998_charger {
+	qcom,dc-is-wipower;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-pinctrl.dtsi b/arch/arm64/boot/dts/qcom/msm8998-pinctrl.dtsi
new file mode 100644
index 000000000000..ed1259918620
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-pinctrl.dtsi
@@ -0,0 +1,3363 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	tlmm: pinctrl@03400000 {
+		compatible = "qcom,msm8998-pinctrl";
+		reg = <0x03400000 0xc00000>;
+		interrupts = <0 208 0>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+
+		uart_console_active: uart_console_active {
+			mux {
+				pins = "gpio4", "gpio5";
+				function = "blsp_uart8_a";
+			};
+
+			config {
+				pins = "gpio4", "gpio5";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		wcd9xxx_intr {
+			wcd_intr_default: wcd_intr_default{
+				mux {
+					pins = "gpio54";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio54";
+					drive-strength = <2>; /* 2 mA */
+					bias-pull-down; /* pull down */
+					input-enable;
+				};
+			};
+		};
+
+		/* I2C CONFIGURATION */
+		i2c_1 {
+			i2c_1_active: i2c_1_active {
+				mux {
+					pins = "gpio2", "gpio3";
+					function = "blsp_i2c1";
+				};
+
+				config {
+					pins = "gpio2", "gpio3";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_1_sleep: i2c_1_sleep {
+				mux {
+					pins = "gpio2", "gpio3";
+					function = "blsp_i2c1";
+				};
+
+				config {
+					pins = "gpio2", "gpio3";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_2 {
+			i2c_2_active: i2c_2_active {
+				mux {
+					pins = "gpio32", "gpio33";
+					function = "blsp_i2c2";
+				};
+
+				config {
+					pins = "gpio32", "gpio33";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_2_sleep: i2c_2_sleep {
+				mux {
+					pins = "gpio32", "gpio33";
+					function = "blsp_i2c2";
+				};
+
+				config {
+					pins = "gpio32", "gpio33";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_3 {
+			i2c_3_active: i2c_3_active {
+				mux {
+					pins = "gpio47", "gpio48";
+					function = "blsp_i2c3";
+				};
+
+				config {
+					pins = "gpio47", "gpio48";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_3_sleep: i2c_3_sleep {
+				mux {
+					pins = "gpio47", "gpio48";
+					function = "blsp_i2c3";
+				};
+
+				config {
+					pins = "gpio47", "gpio48";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_4 {
+			i2c_4_active: i2c_4_active {
+				mux {
+					pins = "gpio10", "gpio11";
+					function = "blsp_i2c4";
+				};
+
+				config {
+					pins = "gpio10", "gpio11";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_4_sleep: i2c_4_sleep {
+				mux {
+					pins = "gpio10", "gpio11";
+					function = "blsp_i2c4";
+				};
+
+				config {
+					pins = "gpio10", "gpio11";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_5 {
+			i2c_5_active: i2c_5_active {
+				mux {
+					pins = "gpio87", "gpio88";
+					function = "blsp_i2c5";
+				};
+
+				config {
+					pins = "gpio87", "gpio88";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_5_sleep: i2c_5_sleep {
+				mux {
+					pins = "gpio87", "gpio88";
+					function = "blsp_i2c5";
+				};
+
+				config {
+					pins = "gpio87", "gpio88";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+		};
+
+		i2c_6 {
+			i2c_6_active: i2c_6_active {
+				mux {
+					pins = "gpio43", "gpio44";
+					function = "blsp_i2c6";
+				};
+
+				config {
+					pins = "gpio43", "gpio44";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_6_sleep: i2c_6_sleep {
+				mux {
+					pins = "gpio43", "gpio44";
+					function = "blsp_i2c6";
+				};
+
+				config {
+					pins = "gpio43", "gpio44";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		nfc {
+			nfc_int_active: nfc_int_active {
+				/* active state */
+				mux {
+					/* GPIO 92 NFC Read Interrupt */
+					pins = "gpio92";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio92";
+					drive-strength = <6>; /* 6 MA */
+					bias-pull-up;
+				};
+			};
+
+			nfc_int_suspend: nfc_int_suspend {
+				/* sleep state */
+				mux {
+					/* GPIO 92 NFC Read Interrupt */
+					pins = "gpio92";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio92";
+					drive-strength = <6>; /* 6 MA */
+					bias-pull-up;
+				};
+			};
+
+			nfc_enable_active: nfc_enable_active {
+				/* active state */
+				mux {
+					/* 12: NFC ENABLE 116:ESE Enable */
+					pins = "gpio12", "gpio116";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio12", "gpio116";
+					drive-strength = <6>; /* 6 MA */
+					bias-pull-up;
+				};
+			};
+
+			nfc_enable_suspend: nfc_enable_suspend {
+				/* sleep state */
+				mux {
+					/* 12: NFC ENABLE 116:ESE Enable */
+					pins = "gpio12", "gpio116";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio12", "gpio116";
+					drive-strength = <6>; /* 6 MA */
+					bias-disable;
+				};
+			};
+		};
+
+		i2c_7 {
+			i2c_7_active: i2c_7_active {
+				mux {
+					pins = "gpio55", "gpio56";
+					function = "blsp_i2c7";
+				};
+
+				config {
+					pins = "gpio55", "gpio56";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_7_sleep: i2c_7_sleep {
+				mux {
+					pins = "gpio55", "gpio56";
+					function = "blsp_i2c7";
+				};
+
+				config {
+					pins = "gpio55", "gpio56";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_8 {
+			i2c_8_active: i2c_8_active {
+				mux {
+					pins = "gpio6", "gpio7";
+					function = "blsp_i2c8";
+				};
+
+				config {
+					pins = "gpio6", "gpio7";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_8_sleep: i2c_8_sleep {
+				mux {
+					pins = "gpio6", "gpio7";
+					function = "blsp_i2c8";
+				};
+
+				config {
+					pins = "gpio6", "gpio7";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_9 {
+			i2c_9_active: i2c_9_active {
+				mux {
+					pins = "gpio51", "gpio52";
+					function = "blsp_i2c9";
+				};
+
+				config {
+					pins = "gpio51", "gpio52";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_9_sleep: i2c_9_sleep {
+				mux {
+					pins = "gpio51", "gpio52";
+					function = "blsp_i2c9";
+				};
+
+				config {
+					pins = "gpio51", "gpio52";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_10 {
+			i2c_10_active: i2c_10_active {
+				mux {
+					pins = "gpio67", "gpio68";
+					function = "blsp_i2c10";
+				};
+
+				config {
+					pins = "gpio67", "gpio68";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_10_sleep: i2c_10_sleep {
+				mux {
+					pins = "gpio67", "gpio68";
+					function = "blsp_i2c10";
+				};
+
+				config {
+					pins = "gpio67", "gpio68";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_11 {
+			i2c_11_active: i2c_11_active {
+				mux {
+					pins = "gpio60", "gpio61";
+					function = "blsp_i2c11";
+				};
+
+				config {
+					pins = "gpio60", "gpio61";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_11_sleep: i2c_11_sleep {
+				mux {
+					pins = "gpio60", "gpio61";
+					function = "blsp_i2c11";
+				};
+
+				config {
+					pins = "gpio60", "gpio61";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_12 {
+			i2c_12_active: i2c_12_active {
+				mux {
+					pins = "gpio83", "gpio84";
+					function = "blsp_i2c12";
+				};
+
+				config {
+					pins = "gpio83", "gpio84";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_12_sleep: i2c_12_sleep {
+				mux {
+					pins = "gpio83", "gpio84";
+					function = "blsp_i2c12";
+				};
+
+				config {
+					pins = "gpio83", "gpio84";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		/* SPI CONFIGURATION */
+
+		spi_1 {
+			spi_1_active: spi_1_active {
+				mux {
+					pins = "gpio0", "gpio1",
+							"gpio2", "gpio3";
+					function = "blsp_spi1";
+				};
+
+				config {
+					pins = "gpio0", "gpio1",
+							"gpio2", "gpio3";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_1_sleep: spi_1_sleep {
+				mux {
+					pins = "gpio0", "gpio1",
+							"gpio2", "gpio3";
+					function = "blsp_spi1";
+				};
+
+				config {
+					pins = "gpio0", "gpio1",
+							"gpio2", "gpio3";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_2 {
+			spi_2_active: spi_2_active {
+				mux {
+					pins = "gpio31", "gpio34",
+							"gpio32", "gpio33";
+					function = "blsp_spi2";
+				};
+
+				config {
+					pins = "gpio31", "gpio34",
+							"gpio32", "gpio33";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_2_sleep: spi_2_sleep {
+				mux {
+					pins = "gpio31", "gpio34",
+							"gpio32", "gpio33";
+					function = "blsp_spi2";
+				};
+
+				config {
+					pins = "gpio31", "gpio34",
+							"gpio32", "gpio33";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_3 {
+			spi_3_active: spi_3_active {
+				mux {
+					pins = "gpio45", "gpio46",
+							"gpio47", "gpio48";
+					function = "blsp_spi3";
+				};
+
+				config {
+					pins = "gpio45", "gpio46",
+							"gpio47", "gpio48";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_3_sleep: spi_3_sleep {
+				mux {
+					pins = "gpio45", "gpio46",
+							"gpio47", "gpio48";
+					function = "blsp_spi3";
+				};
+
+				config {
+					pins = "gpio45", "gpio46",
+							"gpio47", "gpio48";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		pcie0 {
+			pcie0_clkreq_default: pcie0_clkreq_default {
+				mux {
+					pins = "gpio36";
+					function = "pci_e0";
+				};
+
+				config {
+					pins = "gpio36";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+
+			pcie0_perst_default: pcie0_perst_default {
+				mux {
+					pins = "gpio35";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio35";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+
+			pcie0_wake_default: pcie0_wake_default {
+				mux {
+					pins = "gpio37";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio37";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+
+			pcie0_wake_sleep: pcie0_wake_sleep {
+				mux {
+					pins = "gpio37";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio37";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+		};
+
+		hph_en0_ctrl {
+			hph_en0_idle: hph_en0_idle {
+				mux {
+					pins = "gpio67";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio67";
+					drive-strength = <2>;
+					bias-pull-down;
+					output-low;
+				};
+			};
+			hph_en0_active: hph_en0_active {
+				mux {
+					pins = "gpio67";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio67";
+					drive-strength = <2>;
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		hph_en1_ctrl {
+			hph_en1_idle: hph_en1_idle {
+				mux {
+					pins = "gpio68";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio68";
+					drive-strength = <2>;
+					bias-pull-down;
+					output-low;
+				};
+			};
+			hph_en1_active: hph_en1_active {
+				mux {
+					pins = "gpio68";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio68";
+					drive-strength = <2>;
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		wcd_gnd_mic_swap {
+			wcd_gnd_mic_swap_idle: wcd_gnd_mic_swap_idle {
+				mux {
+					pins = "gpio75";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio75";
+					drive-strength = <2>;
+					bias-pull-down;
+					output-low;
+				};
+			};
+			wcd_gnd_mic_swap_active: wcd_gnd_mic_swap_active {
+				mux {
+					pins = "gpio75";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio75";
+					drive-strength = <2>;
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		/* USB C analog configuration */
+		wcd_usbc_analog_en1 {
+			wcd_usbc_analog_en1_idle: wcd_usbc_ana_en1_idle {
+				mux {
+					pins = "gpio59";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio59";
+					drive-strength = <2>;
+					bias-pull-down;
+					output-low;
+				};
+			};
+
+			wcd_usbc_analog_en1_active: wcd_usbc_ana_en1_active {
+				mux {
+					pins = "gpio59";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio59";
+					drive-strength = <2>;
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		wcd_usbc_analog_en2n {
+			wcd_usbc_analog_en2n_idle: wcd_usbc_ana_en2n_idle {
+				mux {
+					pins = "gpio60";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio60";
+					drive-strength = <2>;
+					bias-disable;
+					output-high;
+				};
+			};
+
+			wcd_usbc_analog_en2n_active: wcd_usbc_ana_en2n_active {
+				mux {
+					pins = "gpio60";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio60";
+					drive-strength = <2>;
+					bias-pull-down;
+					output-low;
+				};
+			};
+		};
+
+		cdc_reset_ctrl {
+			cdc_reset_sleep: cdc_reset_sleep {
+				mux {
+					pins = "gpio64";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio64";
+					drive-strength = <16>;
+					bias-disable;
+					output-low;
+				};
+			};
+			cdc_reset_active:cdc_reset_active {
+				mux {
+					pins = "gpio64";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio64";
+					drive-strength = <16>;
+					bias-pull-down;
+					output-high;
+				};
+			};
+		};
+
+		spi_4 {
+			spi_4_active: spi_4_active {
+				mux {
+					pins = "gpio8", "gpio9",
+							"gpio10", "gpio11";
+					function = "blsp_spi4";
+				};
+
+				config {
+					pins = "gpio8", "gpio9",
+							"gpio10", "gpio11";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_4_sleep: spi_4_sleep {
+				mux {
+					pins = "gpio8", "gpio9",
+							"gpio10", "gpio11";
+					function = "blsp_spi4";
+				};
+
+				config {
+					pins = "gpio8", "gpio9",
+							"gpio10", "gpio11";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spkr_1_sd_n {
+			spkr_1_sd_n_sleep: spkr_1_sd_n_sleep {
+				mux {
+					pins = "gpio65";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio65";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;
+					input-enable;
+				};
+			};
+			spkr_1_sd_n_active: spkr_1_sd_n_active {
+				mux {
+					pins = "gpio65";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio65";
+					drive-strength = <16>;   /* 16 mA */
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		spi_5 {
+			spi_5_active: spi_5_active {
+				mux {
+					pins = "gpio85", "gpio86",
+							"gpio87", "gpio88";
+					function = "blsp_spi5";
+				};
+
+				config {
+					pins = "gpio85", "gpio86",
+							"gpio87", "gpio88";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_5_sleep: spi_5_sleep {
+				mux {
+					pins = "gpio85", "gpio86",
+							"gpio87", "gpio88";
+					function = "blsp_spi5";
+				};
+
+				config {
+					pins = "gpio85", "gpio86",
+							"gpio87", "gpio88";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spkr_2_sd_n {
+			spkr_2_sd_n_sleep: spkr_2_sd_n_sleep {
+				mux {
+					pins = "gpio66";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio66";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;
+					input-enable;
+				};
+			};
+			spkr_2_sd_n_active: spkr_2_sd_n_active {
+				mux {
+					pins = "gpio66";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio66";
+					drive-strength = <16>;   /* 16 mA */
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		cci0_active: cci0_active {
+			mux {
+				/* CLK, DATA */
+				pins = "gpio17","gpio18"; // Only 2
+				function = "cci_i2c";
+			};
+
+			config {
+				pins = "gpio17","gpio18";
+				bias-pull-up; /* PULL UP*/
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cci0_suspend: cci0_suspend {
+			mux {
+				/* CLK, DATA */
+				pins = "gpio17","gpio18";
+				function = "cci_i2c";
+			};
+
+			config {
+				pins = "gpio17","gpio18";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cci1_active: cci1_active {
+			mux {
+				/* CLK, DATA */
+				pins = "gpio19","gpio20";
+				function = "cci_i2c";
+			};
+
+			config {
+				pins = "gpio19","gpio20";
+				bias-pull-up; /* PULL UP*/
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cci1_suspend: cci1_suspend {
+			mux {
+				/* CLK, DATA */
+				pins = "gpio19","gpio20";
+				function = "cci_i2c";
+			};
+
+			config {
+				pins = "gpio19","gpio20";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_actuator_vaf_active: cam_actuator_vaf_active {
+			/* ACTUATOR POWER */
+			mux {
+				pins = "gpio27";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio27";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_actuator_vaf_suspend: cam_actuator_vaf_suspend {
+			/* ACTUATOR POWER */
+			mux {
+				pins = "gpio27";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio27";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_tof_active: cam_tof_active {
+			mux {
+				pins = "gpio26", "gpio126";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio26", "gpio126";
+				bias-pull-up;
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_tof_suspend: cam_tof_suspend {
+			mux {
+				pins = "gpio26", "gpio126";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio26", "gpio126";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_depth_default: cam_sensor_depth_default {
+			mux {
+				pins = "gpio28","gpio23","gpio7";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio28","gpio23","gpio7";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_depth_sleep: cam_sensor_depth_sleep {
+			mux {
+				pins = "gpio28","gpio23","gpio7";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio28","gpio23","gpio7";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_depth_v1_active: cam_sensor_depth_v1_active {
+			/* Depth VANA */
+			mux {
+				pins = "gpio24";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio24";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_depth_v1_sleep: cam_sensor_depth_v1_sleep {
+			mux {
+				pins = "gpio24";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio24";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_depth_v2_active: cam_sensor_depth_v2_active {
+			/* Depth CUSTOM2 */
+			mux {
+				pins = "gpio21";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio21";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_depth_v2_sleep: cam_sensor_depth_v2_sleep {
+			mux {
+				pins = "gpio21";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio21";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk0_active: cam_sensor_mclk0_active {
+			/* MCLK0 */
+			mux {
+				/* CLK */
+				pins = "gpio13";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio13";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk0_suspend: cam_sensor_mclk0_suspend {
+			/* MCLK0 */
+			mux {
+				/* CLK */
+				pins = "gpio13";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio13";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_rear_active: cam_sensor_rear_active {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio30","gpio29";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio30","gpio29";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		spi_6 {
+			spi_6_active: spi_6_active {
+				mux {
+					pins = "gpio41", "gpio42",
+							"gpio43", "gpio44";
+					function = "blsp_spi6";
+				};
+
+				config {
+					pins = "gpio41", "gpio42",
+							"gpio43", "gpio44";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_6_sleep: spi_6_sleep {
+				mux {
+					pins = "gpio41", "gpio42",
+							"gpio43", "gpio44";
+					function = "blsp_spi6";
+				};
+
+				config {
+					pins = "gpio41", "gpio42",
+							"gpio43", "gpio44";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_7 {
+			spi_7_active: spi_7_active {
+				mux {
+					pins = "gpio53", "gpio54",
+							"gpio55", "gpio56";
+					function = "blsp_spi7";
+				};
+
+				config {
+					pins = "gpio53", "gpio54",
+							"gpio55", "gpio56";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_7_sleep: spi_7_sleep {
+				mux {
+					pins = "gpio53", "gpio54",
+							"gpio55", "gpio56";
+					function = "blsp_spi7";
+				};
+
+				config {
+					pins = "gpio53", "gpio54",
+							"gpio55", "gpio56";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_8 {
+			spi_8_active: spi_8_active {
+				mux {
+					pins = "gpio4", "gpio5",
+							"gpio6", "gpio7";
+					function = "blsp_spi8";
+				};
+
+				config {
+					pins = "gpio4", "gpio5",
+							"gpio6", "gpio7";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_8_sleep: spi_8_sleep {
+				mux {
+					pins = "gpio4", "gpio5",
+							"gpio6", "gpio7";
+					function = "blsp_spi8";
+				};
+
+				config {
+					pins = "gpio4", "gpio5",
+							"gpio6", "gpio7";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_9 {
+			spi_9_active: spi_9_active {
+				mux {
+					pins = "gpio49", "gpio50",
+							"gpio51", "gpio52";
+					function = "blsp_spi9";
+				};
+
+				config {
+					pins = "gpio49", "gpio50",
+							"gpio51", "gpio52";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_9_sleep: spi_9_sleep {
+				mux {
+					pins = "gpio49", "gpio50",
+							"gpio51", "gpio52";
+					function = "blsp_spi9";
+				};
+
+				config {
+					pins = "gpio49", "gpio50",
+							"gpio51", "gpio52";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_10 {
+			spi_10_active: spi_10_active {
+				mux {
+					pins = "gpio65", "gpio66",
+							"gpio67", "gpio68";
+					function = "blsp_spi10";
+				};
+
+				config {
+					pins = "gpio65", "gpio66",
+							"gpio67", "gpio68";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_10_sleep: spi_10_sleep {
+				mux {
+					pins = "gpio65", "gpio66",
+							"gpio67", "gpio68";
+					function = "blsp_spi10";
+				};
+
+				config {
+					pins = "gpio65", "gpio66",
+							"gpio67", "gpio68";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_11 {
+			spi_11_active: spi_11_active {
+				mux {
+					pins = "gpio58", "gpio59",
+							"gpio60", "gpio61";
+					function = "blsp_spi11";
+				};
+
+				config {
+					pins = "gpio58", "gpio59",
+							"gpio60", "gpio61";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_11_sleep: spi_11_sleep {
+				mux {
+					pins = "gpio58", "gpio59",
+							"gpio60", "gpio61";
+					function = "blsp_spi11";
+				};
+
+				config {
+					pins = "gpio58", "gpio59",
+							"gpio60", "gpio61";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_12 {
+			spi_12_active: spi_12_active {
+				mux {
+					pins = "gpio81", "gpio82",
+							"gpio83", "gpio84";
+					function = "blsp_spi12";
+				};
+
+				config {
+					pins = "gpio81", "gpio82",
+							"gpio83", "gpio84";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_12_sleep: spi_12_sleep {
+				mux {
+					pins = "gpio81", "gpio82",
+							"gpio83", "gpio84";
+					function = "blsp_spi12";
+				};
+
+				config {
+					pins = "gpio81", "gpio82",
+							"gpio83", "gpio84";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		/* HS UART CONFIGURATION */
+		blsp1_uart1_active: blsp1_uart1_active {
+			mux {
+				pins = "gpio0", "gpio1", "gpio2", "gpio3";
+				function = "blsp_uart1_a";
+			};
+
+			config {
+				pins = "gpio0", "gpio1", "gpio2", "gpio3";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp1_uart1_sleep: blsp1_uart1_sleep {
+			mux {
+				pins = "gpio0", "gpio1", "gpio2", "gpio3";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio0", "gpio1", "gpio2", "gpio3";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		cam_sensor_rear_suspend: cam_sensor_rear_suspend {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio30","gpio29";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio30","gpio29";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk1_active: cam_sensor_mclk1_active {
+			/* MCLK1 */
+			mux {
+				/* CLK */
+				pins = "gpio14";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio14";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk1_suspend: cam_sensor_mclk1_suspend {
+			/* MCLK1 */
+			mux {
+				/* CLK */
+				pins = "gpio14";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio14";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk3_active: cam_sensor_mclk3_active {
+			/* MCLK3 */
+			mux {
+				/* CLK */
+				pins = "gpio16";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio16";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk3_suspend: cam_sensor_mclk3_suspend {
+			/* MCLK3 */
+			mux {
+				/* CLK */
+				pins = "gpio16";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio16";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_rear2_active: cam_sensor_rear2_active {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio9","gpio8";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio9","gpio8";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		blsp1_uart2_active: blsp1_uart2_active {
+			mux {
+				pins = "gpio31", "gpio34", "gpio33", "gpio32";
+				function = "blsp_uart2_a";
+			};
+
+			config {
+				pins = "gpio31", "gpio34", "gpio33", "gpio32";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp1_uart2_sleep: blsp1_uart2_sleep {
+			mux {
+				pins = "gpio31", "gpio34", "gpio33", "gpio32";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio31", "gpio34", "gpio33", "gpio32";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp1_uart3: blsp1_uart3 {
+			blsp1_uart3_tx_active: blsp1_uart3_tx_active {
+				mux {
+					pins = "gpio45";
+					function = "blsp_uart3_a";
+				};
+
+				config {
+					pins = "gpio45";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			blsp1_uart3_tx_sleep: blsp1_uart3_tx_sleep {
+				mux {
+					pins = "gpio45";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio45";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+
+			blsp1_uart3_rxcts_active: blsp1_uart3_rxcts_active {
+				mux {
+					pins = "gpio46", "gpio47";
+					function = "blsp_uart3_a";
+				};
+
+				config {
+					pins = "gpio46", "gpio47";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			blsp1_uart3_rxcts_sleep: blsp1_uart3_rxcts_sleep {
+				mux {
+					pins = "gpio46", "gpio47";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio46", "gpio47";
+					drive-strength = <2>;
+					bias-no-pull;
+				};
+			};
+
+			blsp1_uart3_rfr_active: blsp1_uart3_rfr_active {
+				mux {
+					pins = "gpio48";
+					function = "blsp_uart3_a";
+				};
+
+				config {
+					pins = "gpio48";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			blsp1_uart3_rfr_sleep: blsp1_uart3_rfr_sleep {
+				mux {
+					pins = "gpio48";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio48";
+					drive-strength = <2>;
+					bias-no-pull;
+				};
+			};
+		};
+
+		cam_sensor_rear2_suspend: cam_sensor_rear2_suspend {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio9","gpio8";
+				function = "gpio";
+			};
+			config {
+				pins = "gpio9","gpio8";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk2_active: cam_sensor_mclk2_active {
+			/* MCLK1 */
+			mux {
+				/* CLK */
+				pins = "gpio15";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio15";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk2_suspend: cam_sensor_mclk2_suspend {
+			/* MCLK1 */
+			mux {
+				/* CLK */
+				pins = "gpio15";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio15";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_front_active: cam_sensor_front_active {
+			/* RESET  VANA*/
+			mux {
+				pins = "gpio28", "gpio29";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio28", "gpio29";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+
+		cam_sensor_front_iris_active: cam_sensor_front_iris_active {
+			/* RESET */
+			mux {
+				pins = "gpio23";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio23";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		blsp2_uart1_active: blsp2_uart1_active {
+			mux {
+				pins = "gpio53", "gpio54", "gpio55", "gpio56";
+				function = "blsp_uart7_a";
+			};
+
+			config {
+				pins = "gpio53", "gpio54", "gpio55", "gpio56";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp2_uart1_sleep: blsp2_uart1_sleep {
+			mux {
+				pins = "gpio53", "gpio54", "gpio55", "gpio56";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio53", "gpio54", "gpio55", "gpio56";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp2_uart2_active: blsp2_uart2_active {
+			mux {
+				pins = "gpio4", "gpio5", "gpio6", "gpio7";
+				function = "blsp_uart8_a";
+			};
+
+			config {
+				pins = "gpio4", "gpio5", "gpio6", "gpio7";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp2_uart2_sleep: blsp2_uart2_sleep {
+			mux {
+				pins = "gpio4", "gpio5", "gpio6", "gpio7";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio4", "gpio5", "gpio6", "gpio7";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		cam_sensor_front_suspend: cam_sensor_front_suspend {
+			/* RESET */
+			mux {
+				pins = "gpio28";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio28";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_front_iris_suspend: cam_sensor_front_iris_suspend {
+			/* RESET */
+			mux {
+				pins = "gpio23";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio23";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		pmx_mdss: pmx_mdss {
+			mdss_dsi_active: mdss_dsi_active {
+				mux {
+					pins = "gpio94", "gpio91", "gpio51";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio94", "gpio91", "gpio51";
+					drive-strength = <8>; /* 8 mA */
+					bias-disable = <0>; /* no pull */
+				};
+			};
+			mdss_dsi_suspend: mdss_dsi_suspend {
+				mux {
+					pins = "gpio94", "gpio91", "gpio51";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio94", "gpio91", "gpio51";
+					drive-strength = <2>; /* 2 mA */
+					bias-pull-down; /* pull down */
+				};
+			};
+		};
+
+		pmx_mdss_te {
+			mdss_te_active: mdss_te_active {
+				mux {
+					pins = "gpio10";
+					function = "mdp_vsync_a";
+				};
+				config {
+					pins = "gpio10";
+					drive-strength = <2>; /* 8 mA */
+					bias-pull-down; /* pull down*/
+				};
+			};
+
+			mdss_te_suspend: mdss_te_suspend {
+				mux {
+					pins = "gpio10";
+					function = "mdp_vsync_a";
+				};
+				config {
+					pins = "gpio10";
+					drive-strength = <2>; /* 2 mA */
+					bias-pull-down; /* pull down */
+				};
+			};
+		};
+
+		mdss_dp_aux_active: mdss_dp_aux_active {
+			mux {
+				pins = "gpio77", "gpio78";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio77", "gpio78";
+				bias-disable = <0>; /* no pull */
+				drive-strength = <8>;
+			};
+		};
+
+		mdss_dp_aux_suspend: mdss_dp_aux_suspend {
+			mux {
+				pins = "gpio77", "gpio78";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio77", "gpio78";
+				bias-pull-down;
+				drive-strength = <2>;
+			};
+		};
+
+		mdss_dp_usbplug_cc_active: mdss_dp_usbplug_cc_active {
+			mux {
+				pins = "gpio38";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio38";
+				bias-disable;
+				drive-strength = <16>;
+			};
+		};
+
+		mdss_dp_usbplug_cc_suspend: mdss_dp_usbplug_cc_suspend {
+			mux {
+				pins = "gpio38";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio38";
+				bias-pull-down;
+				drive-strength = <2>;
+			};
+		};
+
+		mdss_dp_hpd_active: mdss_dp_hpd_active {
+			mux {
+				pins = "gpio34";
+				function = "edp_hot";
+			};
+
+			config {
+				pins = "gpio34";
+				bias-pull-down;
+				drive-strength = <16>;
+			};
+		};
+
+		mdss_dp_hpd_suspend: mdss_dp_hpd_suspend {
+			mux {
+				pins = "gpio34";
+				function = "edp_hot";
+			};
+
+			config {
+				pins = "gpio34";
+				bias-pull-down;
+				drive-strength = <2>;
+			};
+		};
+
+		blsp2_uart3_active: blsp2_uart3_active {
+			mux {
+				pins = "gpio49", "gpio50", "gpio51", "gpio52";
+				function = "blsp_uart9_a";
+			};
+
+			config {
+				pins = "gpio49", "gpio50", "gpio51", "gpio52";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp2_uart3_sleep: blsp2_uart3_sleep {
+			mux {
+				pins = "gpio49", "gpio50", "gpio51", "gpio52";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio49", "gpio50", "gpio51", "gpio52";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		/* add pingrp for touchscreen */
+		pmx_ts_int_active {
+			ts_int_active: ts_int_active {
+				mux {
+					pins = "gpio125";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio125";
+					drive-strength = <8>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		pmx_ts_int_suspend {
+			ts_int_suspend1: ts_int_suspend1 {
+				mux {
+					pins = "gpio125";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio125";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+		};
+
+		pmx_ts_reset_active {
+			ts_reset_active: ts_reset_active {
+				mux {
+					pins = "gpio89";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio89";
+					drive-strength = <8>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		pmx_ts_reset_suspend {
+			ts_reset_suspend1: ts_reset_suspend1 {
+				mux {
+					pins = "gpio89";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio89";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+		};
+
+		pmx_ts_release {
+			ts_release: ts_release {
+				mux {
+					pins = "gpio125", "gpio89";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio125", "gpio89";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+		};
+
+		ts_mux {
+			ts_active: ts_active {
+				mux {
+					pins = "gpio89", "gpio125";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio89", "gpio125";
+					drive-strength = <16>;
+					bias-pull-up;
+				};
+			};
+
+			ts_reset_suspend: ts_reset_suspend {
+				mux {
+					pins = "gpio89";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio89";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+
+			ts_int_suspend: ts_int_suspend {
+				mux {
+					pins = "gpio125";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio125";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+		};
+
+		ufs_dev_reset_assert: ufs_dev_reset_assert {
+			config {
+				pins = "ufs_reset";
+				bias-pull-down;		/* default: pull down */
+				/*
+				 * UFS_RESET driver strengths are having
+				 * different values/steps compared to typical
+				 * GPIO drive strengths.
+				 *
+				 * Following table clarifies:
+				 *
+				 * HDRV value | UFS_RESET | Typical GPIO
+				 *   (dec)    |   (mA)    |    (mA)
+				 *     0      |   0.8     |    2
+				 *     1      |   1.55    |    4
+				 *     2      |   2.35    |    6
+				 *     3      |   3.1     |    8
+				 *     4      |   3.9     |    10
+				 *     5      |   4.65    |    12
+				 *     6      |   5.4     |    14
+				 *     7      |   6.15    |    16
+				 *
+				 * POR value for UFS_RESET HDRV is 3 which means
+				 * 3.1mA and we want to use that. Hence just
+				 * specify 8mA to "drive-strength" binding and
+				 * that should result into writing 3 to HDRV
+				 * field.
+				 */
+				drive-strength = <8>;	/* default: 3.1 mA */
+				output-low; /* active low reset */
+			};
+		};
+
+		ufs_dev_reset_deassert: ufs_dev_reset_deassert {
+			config {
+				pins = "ufs_reset";
+				bias-pull-down;		/* default: pull down */
+				/*
+				 * default: 3.1 mA
+				 * check comments under ufs_dev_reset_assert
+				 */
+				drive-strength = <8>;
+				output-high; /* active low reset */
+			};
+		};
+
+		sdc2_clk_on: sdc2_clk_on {
+			config {
+				pins = "sdc2_clk";
+				bias-disable;		/* NO pull */
+				drive-strength = <16>;	/* 16 MA */
+			};
+		};
+
+		sdc2_clk_off: sdc2_clk_off {
+			config {
+				pins = "sdc2_clk";
+				bias-disable;		/* NO pull */
+				drive-strength = <2>;	/* 2 MA */
+			};
+		};
+
+		sdc2_cmd_on: sdc2_cmd_on {
+			config {
+				pins = "sdc2_cmd";
+				bias-pull-up;		/* pull up */
+				drive-strength = <10>;	/* 10 MA */
+			};
+		};
+
+		sdc2_cmd_off: sdc2_cmd_off {
+			config {
+				pins = "sdc2_cmd";
+				bias-pull-up;		/* pull up */
+				drive-strength = <2>;	/* 2 MA */
+			};
+		};
+
+		sdc2_data_on: sdc2_data_on {
+			config {
+				pins = "sdc2_data";
+				bias-pull-up;		/* pull up */
+				drive-strength = <10>;	/* 10 MA */
+			};
+		};
+
+		sdc2_data_off: sdc2_data_off {
+			config {
+				pins = "sdc2_data";
+				bias-pull-up;		/* pull up */
+				drive-strength = <2>;	/* 2 MA */
+			};
+		};
+
+		sdc2_cd_on: sdc2_cd_on {
+			mux {
+				pins = "gpio95";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio95";
+				bias-pull-up;           /* pull up */
+				drive-strength = <2>;   /* 2 MA */
+			};
+		};
+
+		sdc2_cd_off: sdc2_cd_off {
+			mux {
+				pins = "gpio95";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio95";
+				bias-pull-up;           /* pull up */
+				drive-strength = <2>;   /* 2 MA */
+			};
+
+		};
+
+		led_enable: led_enable {
+			mux {
+				pins = "gpio21";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio21";
+				drive_strength = <2>;
+				output-high;
+				bias-disable;
+			};
+		};
+
+		led_disable: led_disable {
+			mux {
+				pins = "gpio21";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio21";
+				drive_strength = <2>;
+				output-low;
+				bias-disable;
+			};
+		};
+
+		trigout_a: trigout_a {
+			mux {
+				pins = "gpio58";
+				function = "qdss_cti1_a";
+			};
+
+			config {
+				pins = "gpio58";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		mdss_hdmi_5v_active: mdss_hdmi_5v_active {
+			mux {
+				pins = "gpio133";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio133";
+				bias-pull-up;
+				drive-strength = <16>;
+			};
+		};
+
+		mdss_hdmi_5v_suspend: mdss_hdmi_5v_suspend {
+			mux {
+				pins = "gpio133";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio133";
+				bias-pull-down;
+				drive-strength = <2>;
+			};
+		};
+
+
+		mdss_hdmi_hpd_active: mdss_hdmi_hpd_active {
+			mux {
+				pins = "gpio34";
+				function = "hdmi_hot";
+			};
+
+			config {
+				pins = "gpio34";
+				bias-pull-down;
+				drive-strength = <16>;
+			};
+		};
+
+		mdss_hdmi_hpd_suspend: mdss_hdmi_hpd_suspend {
+			mux {
+				pins = "gpio34";
+				function = "hdmi_hot";
+			};
+
+			config {
+				pins = "gpio34";
+				bias-pull-down;
+				drive-strength = <2>;
+			};
+		};
+
+		mdss_hdmi_ddc_active: mdss_hdmi_ddc_active {
+			mux {
+				pins = "gpio32", "gpio33";
+				function = "hdmi_ddc";
+			};
+
+			config {
+				pins = "gpio32", "gpio33";
+				drive-strength = <2>;
+				bias-pull-up;
+			};
+		};
+
+		mdss_hdmi_ddc_suspend: mdss_hdmi_ddc_suspend {
+			mux {
+				pins = "gpio32", "gpio33";
+				function = "hdmi_ddc";
+			};
+
+			config {
+				pins = "gpio32", "gpio33";
+				drive-strength = <2>;
+				bias-pull-up;
+			};
+		};
+
+		mdss_hdmi_cec_active: mdss_hdmi_cec_active {
+			mux {
+				pins = "gpio31";
+				function = "hdmi_cec";
+			};
+
+			config {
+				pins = "gpio31";
+				drive-strength = <2>;
+				bias-pull-up;
+			};
+		};
+
+		mdss_hdmi_cec_suspend: mdss_hdmi_cec_suspend {
+			mux {
+				pins = "gpio31";
+				function = "hdmi_cec";
+			};
+
+			config {
+				pins = "gpio31";
+				drive-strength = <2>;
+				bias-pull-up;
+			};
+		};
+
+		tsif0_signals_active: tsif0_signals_active {
+			tsif1_clk {
+				pins = "gpio89"; /* TSIF0 CLK */
+				function = "tsif1_clk";
+			};
+			tsif1_en {
+				pins = "gpio90"; /* TSIF0 Enable */
+				function = "tsif1_en";
+			};
+			tsif1_data {
+				pins = "gpio91"; /* TSIF0 DATA */
+				function = "tsif1_data";
+			};
+			signals_cfg {
+				pins = "gpio89", "gpio90", "gpio91";
+				drive_strength = <2>;	/* 2 mA */
+				bias-pull-down;		/* pull down */
+			};
+		};
+
+		/* sync signal is only used if configured to mode-2 */
+		tsif0_sync_active: tsif0_sync_active {
+			tsif1_sync {
+				pins = "gpio9";	/* TSIF0 SYNC */
+				function = "tsif1_sync";
+				drive_strength = <2>;	/* 2 mA */
+				bias-pull-down;		/* pull down */
+			};
+		};
+
+		tsif1_signals_active: tsif1_signals_active {
+			tsif2_clk {
+				pins = "gpio93"; /* TSIF1 CLK */
+				function = "tsif2_clk";
+			};
+			tsif2_en {
+				pins = "gpio94"; /* TSIF1 Enable */
+				function = "tsif2_en";
+			};
+			tsif2_data {
+				pins = "gpio95"; /* TSIF1 DATA */
+				function = "tsif2_data";
+			};
+			signals_cfg {
+				pins = "gpio93", "gpio94", "gpio95";
+				drive_strength = <2>;	/* 2 mA */
+				bias-pull-down;		/* pull down */
+			};
+		};
+
+		/* sync signal is only used if configured to mode-2 */
+		tsif1_sync_active: tsif1_sync_active {
+			tsif2_sync {
+				pins = "gpio96";	/* TSIF1 SYNC */
+				function = "tsif2_sync";
+				drive_strength = <2>;	/* 2 mA */
+				bias-pull-down;		/* pull down */
+			};
+		};
+
+		pri_aux_pcm_clk {
+			pri_aux_pcm_clk_sleep: pri_aux_pcm_clk_sleep {
+				mux {
+					pins = "gpio65";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio65";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			pri_aux_pcm_clk_active: pri_aux_pcm_clk_active {
+				mux {
+					pins = "gpio65";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio65";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		pri_aux_pcm_sync {
+			pri_aux_pcm_sync_sleep: pri_aux_pcm_sync_sleep {
+				mux {
+					pins = "gpio66";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio66";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			pri_aux_pcm_sync_active: pri_aux_pcm_sync_active {
+				mux {
+					pins = "gpio66";
+					function = "pri_mi2s_ws";
+				};
+
+				config {
+					pins = "gpio66";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		pri_aux_pcm_din {
+			pri_aux_pcm_din_sleep: pri_aux_pcm_din_sleep {
+				mux {
+					pins = "gpio67";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio67";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			pri_aux_pcm_din_active: pri_aux_pcm_din_active {
+				mux {
+					pins = "gpio67";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio67";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		pri_aux_pcm_dout {
+			pri_aux_pcm_dout_sleep: pri_aux_pcm_dout_sleep {
+				mux {
+					pins = "gpio68";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio68";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			pri_aux_pcm_dout_active: pri_aux_pcm_dout_active {
+				mux {
+					pins = "gpio68";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio68";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		sec_aux_pcm {
+			sec_aux_pcm_sleep: sec_aux_pcm_sleep {
+				mux {
+					pins = "gpio80", "gpio81";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio80", "gpio81";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			sec_aux_pcm_active: sec_aux_pcm_active {
+				mux {
+					pins = "gpio80", "gpio81";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio80", "gpio81";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		sec_aux_pcm_din {
+			sec_aux_pcm_din_sleep: sec_aux_pcm_din_sleep {
+				mux {
+					pins = "gpio82";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio82";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			sec_aux_pcm_din_active: sec_aux_pcm_din_active {
+				mux {
+					pins = "gpio82";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio82";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		sec_aux_pcm_dout {
+			sec_aux_pcm_dout_sleep: sec_aux_pcm_dout_sleep {
+				mux {
+					pins = "gpio83";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio83";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			sec_aux_pcm_dout_active: sec_aux_pcm_dout_active {
+				mux {
+					pins = "gpio83";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio83";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		tert_aux_pcm {
+			tert_aux_pcm_sleep: tert_aux_pcm_sleep {
+				mux {
+					pins = "gpio75", "gpio76";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio75", "gpio76";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			tert_aux_pcm_active: tert_aux_pcm_active {
+				mux {
+					pins = "gpio75", "gpio76";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio75", "gpio76";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		tert_aux_pcm_din {
+			tert_aux_pcm_din_sleep: tert_aux_pcm_din_sleep {
+				mux {
+					pins = "gpio77";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio77";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			tert_aux_pcm_din_active: tert_aux_pcm_din_active {
+				mux {
+					pins = "gpio77";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio77";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		tert_aux_pcm_dout {
+			tert_aux_pcm_dout_sleep: tert_aux_pcm_dout_sleep {
+				mux {
+					pins = "gpio78";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio78";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			tert_aux_pcm_dout_active: tert_aux_pcm_dout_active {
+				mux {
+					pins = "gpio78";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio78";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		quat_aux_pcm {
+			quat_aux_pcm_sleep: quat_aux_pcm_sleep {
+				mux {
+					pins = "gpio58", "gpio59";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio58", "gpio59";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			quat_aux_pcm_active: quat_aux_pcm_active {
+				mux {
+					pins = "gpio58", "gpio59";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio58", "gpio59";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		quat_aux_pcm_din {
+			quat_aux_pcm_din_sleep: quat_aux_pcm_din_sleep {
+				mux {
+					pins = "gpio60";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio60";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			quat_aux_pcm_din_active: quat_aux_pcm_din_active {
+				mux {
+					pins = "gpio60";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio60";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		quat_aux_pcm_dout {
+			quat_aux_pcm_dout_sleep: quat_aux_pcm_dout_sleep {
+				mux {
+					pins = "gpio61";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio61";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			quat_aux_pcm_dout_active: quat_aux_pcm_dout_active {
+				mux {
+					pins = "gpio61";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio61";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		pri_mi2s_mclk {
+			pri_mi2s_mclk_sleep: pri_mi2s_mclk_sleep {
+				mux {
+					pins = "gpio64";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio64";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			pri_mi2s_mclk_active: pri_mi2s_mclk_active {
+				mux {
+					pins = "gpio64";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio64";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		pri_mi2s_sck {
+			pri_mi2s_sck_sleep: pri_mi2s_sck_sleep {
+				mux {
+					pins = "gpio65";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio65";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			pri_mi2s_sck_active: pri_mi2s_sck_active {
+				mux {
+					pins = "gpio65";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio65";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		pri_mi2s_ws {
+			pri_mi2s_ws_sleep: pri_mi2s_ws_sleep {
+				mux {
+					pins = "gpio66";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio66";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			pri_mi2s_ws_active: pri_mi2s_ws_active {
+				mux {
+					pins = "gpio66";
+					function = "pri_mi2s_ws";
+				};
+
+				config {
+					pins = "gpio66";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		pri_mi2s_sd0 {
+			pri_mi2s_sd0_sleep: pri_mi2s_sd0_sleep {
+				mux {
+					pins = "gpio67";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio67";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			pri_mi2s_sd0_active: pri_mi2s_sd0_active {
+				mux {
+					pins = "gpio67";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio67";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		pri_mi2s_sd1 {
+			pri_mi2s_sd1_sleep: pri_mi2s_sd1_sleep {
+				mux {
+					pins = "gpio68";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio68";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			pri_mi2s_sd1_active: pri_mi2s_sd1_active {
+				mux {
+					pins = "gpio68";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio68";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		sec_mi2s_mclk {
+			sec_mi2s_mclk_sleep: sec_mi2s_mclk_sleep {
+				mux {
+					pins = "gpio79";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio79";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			sec_mi2s_mclk_active: sec_mi2s_mclk_active {
+				mux {
+					pins = "gpio79";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio79";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		sec_mi2s {
+			sec_mi2s_sleep: sec_mi2s_sleep {
+				mux {
+					pins = "gpio80", "gpio81";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio80", "gpio81";
+					drive-strength = <2>;   /* 2 mA */
+					bias-disable;         /* NO PULL */
+					input-enable;
+				};
+			};
+
+			sec_mi2s_active: sec_mi2s_active {
+				mux {
+					pins = "gpio80", "gpio81";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio80", "gpio81";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		sec_mi2s_sd0 {
+			sec_mi2s_sd0_sleep: sec_mi2s_sd0_sleep {
+				mux {
+					pins = "gpio82";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio82";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			sec_mi2s_sd0_active: sec_mi2s_sd0_active {
+				mux {
+					pins = "gpio82";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio82";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		sec_mi2s_sd1 {
+			sec_mi2s_sd1_sleep: sec_mi2s_sd1_sleep {
+				mux {
+					pins = "gpio83";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio83";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			sec_mi2s_sd1_active: sec_mi2s_sd1_active {
+				mux {
+					pins = "gpio83";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio83";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		tert_mi2s_mclk {
+			tert_mi2s_mclk_sleep: tert_mi2s_mclk_sleep {
+				mux {
+					pins = "gpio74";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio74";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			tert_mi2s_mclk_active: tert_mi2s_mclk_active {
+				mux {
+					pins = "gpio74";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio74";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		tert_mi2s {
+			tert_mi2s_sleep: tert_mi2s_sleep {
+				mux {
+					pins = "gpio75", "gpio76";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio75", "gpio76";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			tert_mi2s_active: tert_mi2s_active {
+				mux {
+					pins = "gpio75", "gpio76";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio75", "gpio76";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		tert_mi2s_sd0 {
+			tert_mi2s_sd0_sleep: tert_mi2s_sd0_sleep {
+				mux {
+					pins = "gpio77";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio77";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			tert_mi2s_sd0_active: tert_mi2s_sd0_active {
+				mux {
+					pins = "gpio77";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio77";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		tert_mi2s_sd1 {
+			tert_mi2s_sd1_sleep: tert_mi2s_sd1_sleep {
+				mux {
+					pins = "gpio78";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio78";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			tert_mi2s_sd1_active: tert_mi2s_sd1_active {
+				mux {
+					pins = "gpio78";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio78";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		quat_mi2s_mclk {
+			quat_mi2s_mclk_sleep: quat_mi2s_mclk_sleep {
+				mux {
+					pins = "gpio57";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio57";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			quat_mi2s_mclk_active: quat_mi2s_mclk_active {
+				mux {
+					pins = "gpio57";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio57";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		quat_mi2s {
+			quat_mi2s_sleep: quat_mi2s_sleep {
+				mux {
+					pins = "gpio58", "gpio59";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio58", "gpio59";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			quat_mi2s_active: quat_mi2s_active {
+				mux {
+					pins = "gpio58", "gpio59";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio58", "gpio59";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		quat_mi2s_sd0 {
+			quat_mi2s_sd0_sleep: quat_mi2s_sd0_sleep {
+				mux {
+					pins = "gpio60";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio60";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			quat_mi2s_sd0_active: quat_mi2s_sd0_active {
+				mux {
+					pins = "gpio60";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio60";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		quat_mi2s_sd1 {
+			quat_mi2s_sd1_sleep: quat_mi2s_sd1_sleep {
+				mux {
+					pins = "gpio61";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio61";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			quat_mi2s_sd1_active: quat_mi2s_sd1_active {
+				mux {
+					pins = "gpio61";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio61";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		quat_mi2s_sd2 {
+			quat_mi2s_sd2_sleep: quat_mi2s_sd2_sleep {
+				mux {
+					pins = "gpio62";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio62";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			quat_mi2s_sd2_active: quat_mi2s_sd2_active {
+				mux {
+					pins = "gpio62";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio62";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		quat_mi2s_sd3 {
+			quat_mi2s_sd3_sleep: quat_mi2s_sd3_sleep {
+				mux {
+					pins = "gpio63";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio63";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;         /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			quat_mi2s_sd3_active: quat_mi2s_sd3_active {
+				mux {
+					pins = "gpio63";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio63";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;           /* NO PULL */
+				};
+			};
+		};
+
+		spkr_i2s_clk_pin {
+			spkr_i2s_clk_sleep: spkr_i2s_clk_sleep {
+				mux {
+					pins = "gpio69";
+					function = "spkr_i2s";
+				};
+
+				config {
+					pins = "gpio69";
+					drive-strength = <2>; /* 2 mA */
+					bias-pull-down;       /* PULL DOWN */
+				};
+			};
+
+			spkr_i2s_clk_active: spkr_i2s_clk_active {
+				mux {
+					pins = "gpio69";
+					function = "spkr_i2s";
+				};
+
+				config {
+					pins = "gpio69";
+					drive-strength = <8>; /* 8 mA */
+					bias-disable;         /* NO PULL */
+				};
+			};
+		};
+
+		spkr_1_sd_mediabox {
+			spkr_1_sd_sleep_mediabox: spkr_1_sd_sleep_mediabox {
+				mux {
+					pins = "gpio85";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio85";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;
+					input-enable;
+				};
+			};
+			spkr_1_sd_active_mediabox: spkr_1_sd_active_mediabox {
+				mux {
+					pins = "gpio85";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio85";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		spkr_2_sd_mediabox_mediabox {
+			spkr_2_sd_sleep_mediabox: spkr_2_sd_sleep_mediabox {
+				mux {
+					pins = "gpio112";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio112";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;
+					input-enable;
+				};
+			};
+			spkr_2_sd_active_mediabox: spkr_2_sd_active_mediabox {
+				mux {
+					pins = "gpio112";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio112";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		sdc2_cd_on_mediabox: sdc2_cd_on_mediabox {
+			mux {
+				pins = "gpio86";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio86";
+				bias-pull-up;           /* pull up */
+				drive-strength = <2>;   /* 2 MA */
+			};
+		};
+
+		sdc2_cd_off_mediabox: sdc2_cd_off_mediabox {
+			mux {
+				pins = "gpio86";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio86";
+				bias-pull-up;           /* pull up */
+				drive-strength = <2>;   /* 2 MA */
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-pm.dtsi b/arch/arm64/boot/dts/qcom/msm8998-pm.dtsi
new file mode 100644
index 000000000000..bb478794e832
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-pm.dtsi
@@ -0,0 +1,807 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+&soc {
+	qcom,spm@178120000 {
+		compatible = "qcom,spm-v2";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0x17812000 0x1000>;
+		qcom,name = "gold-l2"; /* Gold L2 SAW */
+		qcom,saw2-ver-reg = <0xfd0>;
+		qcom,cpu-vctl-list = <&CPU4 &CPU5 &CPU6 &CPU7>;
+		qcom,vctl-timeout-us = <500>;
+		qcom,vctl-port = <0x0>;
+		qcom,phase-port = <0x1>;
+		qcom,saw2-avs-ctl = <0x1010031>;
+		qcom,saw2-avs-limit = <0x4580458>;
+		qcom,pfm-port = <0x2>;
+	};
+
+	qcom,spm@179120000 {
+		compatible = "qcom,spm-v2";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0x17912000 0x1000>;
+		qcom,name = "silver-l2"; /* Silver L2 SAW */
+		qcom,saw2-ver-reg = <0xfd0>;
+		qcom,cpu-vctl-list = <&CPU0 &CPU1 &CPU2 &CPU3>;
+		qcom,vctl-timeout-us = <500>;
+		qcom,vctl-port = <0x0>;
+		qcom,phase-port = <0x1>;
+		qcom,saw2-avs-ctl = <0x1010031>;
+		qcom,saw2-avs-limit = <0x4580458>;
+		qcom,pfm-port = <0x2>;
+	};
+
+	qcom,lpm-levels {
+		compatible = "qcom,lpm-levels";
+		qcom,use-psci;
+		#address-cells = <1>;
+		#size-cells = <0>;
+		qcom,pm-cluster@0 {
+			reg = <0>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			label = "system";
+			qcom,spm-device-names = "cci";
+			qcom,psci-mode-shift = <8>;
+			qcom,psci-mode-mask = <0xf>;
+
+			qcom,pm-cluster-level@0{
+				reg = <0>;
+				label = "system-wfi";
+				qcom,psci-mode = <0x0>;
+				qcom,latency-us = <100>;
+				qcom,ss-power = <725>;
+				qcom,energy-overhead = <85000>;
+				qcom,time-overhead = <120>;
+			};
+
+			qcom,pm-cluster-level@1{ /* E3 */
+				reg = <1>;
+				label = "system-pc";
+				qcom,psci-mode = <0x3>;
+				qcom,latency-us = <5534>;
+				qcom,ss-power = <399>;
+				qcom,energy-overhead = <3340281>;
+				qcom,time-overhead = <16744>;
+				qcom,min-child-idx = <3>;
+				qcom,is-reset;
+				qcom,notify-rpm;
+			};
+
+			qcom,pm-cluster@0{
+				reg = <0>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				label = "pwr";
+				qcom,spm-device-names = "l2";
+				qcom,cpu = <&CPU0 &CPU1 &CPU2 &CPU3>;
+				qcom,psci-mode-shift = <4>;
+				qcom,psci-mode-mask = <0xf>;
+
+				qcom,pm-cluster-level@0{ /* D1 */
+					reg = <0>;
+					label = "pwr-l2-wfi";
+					qcom,psci-mode = <0x1>;
+					qcom,latency-us = <51>;
+					qcom,ss-power = <452>;
+					qcom,energy-overhead = <69355>;
+					qcom,time-overhead = <99>;
+				};
+				qcom,pm-cluster-level@1{ /* D2D */
+					reg = <1>;
+					label = "pwr-l2-dynret";
+					qcom,psci-mode = <0x2>;
+					qcom,latency-us = <659>;
+					qcom,ss-power = <434>;
+					qcom,energy-overhead = <465725>;
+					qcom,time-overhead = <976>;
+					qcom,min-child-idx = <1>;
+				};
+
+				qcom,pm-cluster-level@2{ /* D2E */
+					reg = <2>;
+					label = "pwr-l2-ret";
+					qcom,psci-mode = <0x3>;
+					qcom,latency-us = <743>;
+					qcom,ss-power = <425>;
+					qcom,energy-overhead = <629936>;
+					qcom,time-overhead = <1312>;
+					qcom,min-child-idx = <2>;
+				};
+
+				qcom,pm-cluster-level@3{ /* D4 */
+					reg = <3>;
+					label = "pwr-l2-pc";
+					qcom,psci-mode = <0x4>;
+					qcom,latency-us = <4562>;
+					qcom,ss-power = <408>;
+					qcom,energy-overhead = <2421840>;
+					qcom,time-overhead = <5376>;
+					qcom,min-child-idx = <2>;
+					qcom,is-reset;
+				};
+
+				qcom,pm-cpu {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					qcom,psci-mode-shift = <0>;
+					qcom,psci-mode-mask = <0xf>;
+
+					qcom,pm-cpu-level@0 { /* C1 */
+						reg = <0>;
+						qcom,spm-cpu-mode = "wfi";
+						qcom,psci-cpu-mode = <0x1>;
+						qcom,latency-us = <43>;
+						qcom,ss-power = <454>;
+						qcom,energy-overhead = <38639>;
+						qcom,time-overhead = <83>;
+					};
+
+					qcom,pm-cpu-level@1 { /* C2D */
+						reg = <1>;
+						qcom,psci-cpu-mode = <2>;
+						qcom,spm-cpu-mode = "ret";
+						qcom,latency-us = <86>;
+						qcom,ss-power = <449>;
+						qcom,energy-overhead = <78456>;
+						qcom,time-overhead = <167>;
+					};
+
+					qcom,pm-cpu-level@2 {  /* C3 */
+						reg = <2>;
+						qcom,spm-cpu-mode = "pc";
+						qcom,psci-cpu-mode = <0x3>;
+						qcom,latency-us = <612>;
+						qcom,ss-power = <436>;
+						qcom,energy-overhead = <418225>;
+						qcom,time-overhead = <885>;
+						qcom,is-reset;
+					};
+				};
+			};
+
+			qcom,pm-cluster@1{
+				reg = <1>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				label = "perf";
+				qcom,spm-device-names = "l2";
+				qcom,cpu = <&CPU4 &CPU5 &CPU6 &CPU7>;
+				qcom,psci-mode-shift = <4>;
+				qcom,psci-mode-mask = <0xf>;
+
+				qcom,pm-cluster-level@0{  /* D1 */
+					reg = <0>;
+					label = "perf-l2-wfi";
+					qcom,psci-mode = <0x1>;
+					qcom,latency-us = <51>;
+					qcom,ss-power = <512>;
+					qcom,energy-overhead = <99986>;
+					qcom,time-overhead = <99>;
+				};
+
+				qcom,pm-cluster-level@1{ /* D2D */
+					reg = <1>;
+					label = "perf-l2-dynret";
+					qcom,psci-mode = <2>;
+					qcom,latency-us = <529>;
+					qcom,ss-power = <468>;
+					qcom,energy-overhead = <496783>;
+					qcom,time-overhead = <871>;
+					qcom,min-child-idx = <1>;
+				};
+
+				qcom,pm-cluster-level@2{ /* D2E */
+					reg = <2>;
+					label = "perf-l2-ret";
+					qcom,psci-mode = <3>;
+					qcom,latency-us = <605>;
+					qcom,ss-power = <456>;
+					qcom,energy-overhead = <597126>;
+					qcom,time-overhead = <1025>;
+					qcom,min-child-idx = <2>;
+				};
+
+				qcom,pm-cluster-level@3{ /* D4 */
+					reg = <3>;
+					label = "perf-l2-pc";
+					qcom,psci-mode = <0x4>;
+					qcom,latency-us = <2027>;
+					qcom,ss-power = <420>;
+					qcom,energy-overhead = <1624216>;
+					qcom,time-overhead = <2751>;
+					qcom,min-child-idx = <2>;
+					qcom,is-reset;
+				};
+
+				qcom,pm-cpu {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					qcom,psci-mode-shift = <0>;
+					qcom,psci-mode-mask = <0xf>;
+
+					qcom,pm-cpu-level@0 { /* C1 */
+						reg = <0>;
+						qcom,spm-cpu-mode = "wfi";
+						qcom,psci-cpu-mode = <0x1>;
+						qcom,latency-us = <43>;
+						qcom,ss-power = <515>;
+						qcom,energy-overhead = <48502>;
+						qcom,time-overhead = <86>;
+					};
+
+					qcom,pm-cpu-level@1 { /* C2D */
+						reg = <1>;
+						qcom,psci-cpu-mode = <2>;
+						qcom,spm-cpu-mode = "ret";
+						qcom,latency-us = <82>;
+						qcom,ss-power = <505>;
+						qcom,energy-overhead = <98530>;
+						qcom,time-overhead = <161>;
+					};
+
+					qcom,pm-cpu-level@2 { /* C3 */
+						reg = <2>;
+						qcom,spm-cpu-mode = "pc";
+						qcom,psci-cpu-mode = <0x3>;
+						qcom,latency-us = <525>;
+						qcom,ss-power = <476>;
+						qcom,energy-overhead = <485037>;
+						qcom,time-overhead = <861>;
+						qcom,is-reset;
+					};
+				};
+			};
+		};
+	};
+
+	qcom,rpm-stats@200000 {
+		compatible = "qcom,rpm-stats";
+		reg = <0x200000 0x1000>,
+			<0x290014 0x4>,
+			<0x29001c 0x4>;
+		reg-names = "phys_addr_base",
+			"offset_addr",
+			"heap_phys_addrbase";
+		qcom,sleep-stats-version = <2>;
+	};
+
+	qcom,rpm-rail-stats@200000 {
+		compatible = "qcom,rpm-rail-stats";
+		reg = <0x200000 0x100>,
+			<0x29000c 0x4>;
+		reg-names = "phys_addr_base",
+			    "offset_addr";
+	};
+
+	qcom,rpm-log@200000 {
+		compatible = "qcom,rpm-log";
+		reg = <0x200000 0x4000>,
+			<0x290018 0x4>;
+		qcom,rpm-addr-phys = <0x200000>;
+		qcom,offset-version = <4>;
+		qcom,offset-page-buffer-addr = <36>;
+		qcom,offset-log-len = <40>;
+		qcom,offset-log-len-mask = <44>;
+		qcom,offset-page-indices = <56>;
+	};
+
+	qcom,rpm-master-stats@778150 {
+		compatible = "qcom,rpm-master-stats";
+		reg = <0x778150 0x5000>;
+		qcom,masters = "APSS", "MPSS", "ADSP", "SLPI", "TZ", "SPSS";
+		qcom,master-stats-version = <2>;
+		qcom,master-offset = <4096>;
+	};
+
+	rpm_msg_ram: memory@0x200000 {
+		compatible = "qcom,rpm-msg-ram";
+		reg = <0x200000 0x1000>,
+			<0x290000 0x1000>;
+	};
+
+	rpm_code_ram: rpm-memory@0x778000 {
+		compatible = "qcom,rpm-code-ram";
+		reg = <0x778000 0x5000>;
+	};
+
+	qcom,system-stats {
+		compatible = "qcom,system-stats";
+		qcom,rpm-msg-ram = <&rpm_msg_ram>;
+		qcom,rpm-code-ram = <&rpm_code_ram>;
+		qcom,masters = "APSS", "MPSS", "ADSP", "SLPI", "TZ", "SPSS";
+	};
+
+	qcom,mpm@7781b8 {
+		compatible = "qcom,mpm-v2";
+		reg = <0x7781b8 0x1000>, /* MSM_RPM_MPM_BASE 4K */
+		    <0x17911008 0x4>;   /* MSM_APCS_GCC_BASE 4K */
+		reg-names = "vmpm", "ipc";
+		interrupts = <GIC_SPI 171 IRQ_TYPE_EDGE_RISING>;
+		clocks = <&clock_gcc clk_cxo_lpm_clk>;
+		clock-names = "xo";
+		qcom,num-mpm-irqs = <96>;
+
+		qcom,ipc-bit-offset = <1>;
+
+		qcom,gic-parent = <&intc>;
+		qcom,gic-map =
+			<0x1f 212>, /* usb30_power_event_irq	*/
+			<0x2 216>, /* tsens1_upper_lower_int	*/
+			<0x34 275>, /* qmp_usb3_lfps_rxterm_irq_cx	*/
+			<0x57 358>, /*  spmi_periph_irq[0]	*/
+			<0x4f 379>, /* usb2phy_intr: qusb2phy_dmse_hv	*/
+			<0x51 379>, /* usb2phy_intr: qusb2phy_dpse_hv	*/
+			<0x50 384>, /* sp_rmb_sp2soc_irq	*/
+			<0xff 16>, /* APC0_qgicQTmrHypPhysIrptReq	*/
+			<0xff 17>, /* APC3_qgicQTmrSecPhysIrptReq	*/
+			<0xff 18>, /* APC0_qgicQTmrNonSecPhysIrptReq	*/
+			<0xff 19>, /* APC3_qgicQTmrVirtIrptReq	*/
+			<0xff 20>, /* APC0_dbgCommRxFull	*/
+			<0xff 21>, /* APC3_dbgCommTxEmpty	*/
+			<0xff 22>, /* APC0_qgicPerfMonIrptReq	*/
+			<0xff 23>, /* corespm_vote_int[7]	*/
+			<0xff 24>, /* APC0_qgicExtFaultIrptReq	*/
+			<0xff 28>, /* qgicWakeupSync	*/
+			<0xff 29>, /* APCC_cti_SPI_intx	*/
+			<0xff 30>, /* APCC_cti_SPI_inty	*/
+			<0xff 32>, /* l2spm_vote_int[0]	*/
+			<0xff 33>, /* l2spm_vote_int[1]	*/
+			<0xff 34>, /* APCC_qgicL2ErrorIrptReq	*/
+			<0xff 35>, /* WDT_barkInt	*/
+			<0xff 36>, /* WDT_biteExpired	*/
+			<0xff 39>, /* QTMR_qgicFrm0VirtIrq	*/
+			<0xff 40>, /* QTMR_qgicFrm0PhyIrq	*/
+			<0xff 41>, /* QTMR_qgicFrm1PhyIrq	*/
+			<0xff 42>, /* QTMR_qgicFrm2PhyIrq	*/
+			<0xff 43>, /* QTMR_qgicFrm3PhyIrq	*/
+			<0xff 44>, /* QTMR_qgicFrm4PhyIrq	*/
+			<0xff 45>, /* QTMR_qgicFrm5PhyIrq	*/
+			<0xff 46>, /* QTMR_qgicFrm6PhyIrq	*/
+			<0xff 47>, /* rbif_Irq[0]	*/
+			<0xff 48>, /* rbif_Irq[1]	*/
+			<0xff 52>, /* cci_spm_vote_summary_int	*/
+			<0xff 54>, /* ~nERRORIRQ	*/
+			<0xff 55>, /* nEVNTCNTOVERFLOW_cci	*/
+			<0xff 56>, /* QTMR_qgicFrm0VirtIrq	*/
+			<0xff 57>, /* QTMR_qgicFrm0PhyIrq	*/
+			<0xff 58>, /* QTMR_qgicFrm1PhyIrq	*/
+			<0xff 59>, /* QTMR_qgicFrm2PhyIrq	*/
+			<0xff 60>, /* QTMR_qgicFrm3PhyIrq	*/
+			<0xff 61>, /* QTMR_qgicFrm4PhyIrq	*/
+			<0xff 62>, /* QTMR_qgicFrm5PhyIrq	*/
+			<0xff 63>, /* QTMR_qgicFrm6PhyIrq	*/
+			<0xff 64>, /* wakeup_counter_irq_OR	*/
+			<0xff 65>, /* apc0_vs_alarm	*/
+			<0xff 66>, /* apc1_vs_alarm	*/
+			<0xff 67>, /* o_pwr_osm_irq	*/
+			<0xff 68>, /* o_perf_osm_irq	*/
+			<0xff 69>, /* o_pwr_dcvsh_interrupt	*/
+			<0xff 70>, /* o_perf_dcvsh_interrupt	*/
+			<0xff 73>, /* L2_EXTERRIRQ_C0	*/
+			<0xff 74>, /* L2_EXTERRIRQ_C1	*/
+			<0xff 75>, /* L2_INTERRIRQ_C0	*/
+			<0xff 76>, /* L2_INTERRIRQ_C1	*/
+			<0xff 77>, /* L2SPM_svicInt[0]	*/
+			<0xff 78>, /* L2SPM_svicInt[1]	*/
+			<0xff 79>, /* L2SPM_svicIntSwDone[0]	*/
+			<0xff 80>, /* L2SPM_svicIntSwDone[1]	*/
+			<0xff 81>, /* l2_avs_err[0]	*/
+			<0xff 82>, /* l2_avs_err[1]	*/
+			<0xff 83>, /* l2_avs_ack[0]	*/
+			<0xff 84>, /* l2_avs_ack[1]	*/
+			<0xff 96>, /* uart_dm_intr	*/
+			<0xff 97>, /* uart_dm_intr	*/
+			<0xff 98>, /* o_qm_interrupt	*/
+			<0xff 100>, /* jpeg_vbif_irpt	*/
+			<0xff 101>, /* processor_1_user_int	*/
+			<0xff 102>, /* processor_1_kernel_int	*/
+			<0xff 106>, /* dir_conn_irq_lpa_dsp_2	*/
+			<0xff 107>, /* dir_conn_irq_lpa_dsp_1	*/
+			<0xff 109>, /* camss_vbif_0_irq	*/
+			<0xff 110>, /* csiphy_irq	*/
+			<0xff 111>, /* csiphy_irq	*/
+			<0xff 112>, /* csiphy_irq	*/
+			<0xff 115>, /* mdp_irq	*/
+			<0xff 116>, /* vbif_irpt	*/
+			<0xff 117>, /* dir_conn_irq_lpa_dsp_0	*/
+			<0xff 119>, /* lcc_audio_wrapper_q6	*/
+			<0xff 122>, /* PIMEM TPDM BC interrupt	*/
+			<0xff 123>, /* PIMEM TPDM TC interrupt	*/
+			<0xff 124>, /* dir_conn_irq_sensors_1	*/
+			<0xff 125>, /* dir_conn_irq_sensors_0	*/
+			<0xff 126>, /* qup_irq	*/
+			<0xff 127>, /* qup_irq	*/
+			<0xff 128>, /* qup_irq	*/
+			<0xff 129>, /* qup_irq	*/
+			<0xff 130>, /* qup_irq	*/
+			<0xff 131>, /* qup_irq	*/
+			<0xff 132>, /* qup_irq	*/
+			<0xff 133>, /* qup_irq	*/
+			<0xff 134>, /* qup_irq	*/
+			<0xff 135>, /* qup_irq	*/
+			<0xff 136>, /* qup_irq	*/
+			<0xff 137>, /* qup_irq	*/
+			<0xff 138>, /* qup_irq	*/
+			<0xff 139>, /* uart_dm_intr	*/
+			<0xff 140>, /* uart_dm_intr	*/
+			<0xff 141>, /* uart_dm_intr	*/
+			<0xff 145>, /* uart_dm_intr	*/
+			<0xff 146>, /* uart_dm_intr	*/
+			<0xff 147>, /* uart_dm_intr	*/
+			<0xff 148>, /* osmmu_Cirpt[4]	*/
+			<0xff 149>, /* osmmu_Cirpt[5]	*/
+			<0xff 151>, /* tsif_irq[0]	*/
+			<0xff 152>, /* tsif_irq[1]	*/
+			<0xff 153>, /* tspp_irq	*/
+			<0xff 154>, /* bam_irq	*/
+			<0xff 155>, /* dir_conn_irq_lpa_dsp_5	*/
+			<0xff 156>, /* dir_conn_irq_lpa_dsp_4	*/
+			<0xff 157>, /* sdcc_irq	*/
+			<0xff 158>, /* sdcc_irq	*/
+			<0xff 159>, /* lpass_qos_apps_interrupt	*/
+			<0xff 160>, /* smmu_PMIrpt	*/
+			<0xff 161>, /* sdcc_irq	*/
+			<0xff 162>, /* sdcc_irq	*/
+			<0xff 163>, /* usb30_ctrl_irq[0]	*/
+			<0xff 164>, /* usb30_bam_irq	*/
+			<0xff 165>, /* usb30_hs_phy_irq	*/
+			<0xff 166>, /* o_lm_int_2qgic	*/
+			<0xff 167>, /* pcie20_inta	*/
+			<0xff 168>, /* pcie20_intb	*/
+			<0xff 169>, /* smmu_Cirpt[12]	*/
+			<0xff 170>, /* pcie20_intc	*/
+			<0xff 171>, /* pcie20_intd	*/
+			<0xff 172>, /* dcvs_int(8)	*/
+			<0xff 173>, /* dcvs_int(9)	*/
+			<0xff 184>, /* dir_conn_irq_lpa_dsp_3	*/
+			<0xff 185>, /* camss_vbif_2_irq	*/
+			<0xff 186>, /* mnoc_obs_mainFault	*/
+			<0xff 188>, /* q6ss_irq_out(4)	*/
+			<0xff 189>, /* q6ss_irq_out(5)	*/
+			<0xff 190>, /* q6ss_irq_out(6)	*/
+			<0xff 191>, /* q6ss_irq_out(7)	*/
+			<0xff 192>, /* audio_out0_irq	*/
+			<0xff 194>, /* q6ss_wdog_exp_irq	*/
+			<0xff 195>, /* lpass_slimbus_core_ee1_irq	*/
+			<0xff 196>, /* lpass_slimbus_bam_ee1_irq	*/
+			<0xff 197>, /* resampler_irq[0]	*/
+			<0xff 199>, /* qdss_usb_trace_bam_irq	*/
+			<0xff 200>, /* rpm_ipc[4]	*/
+			<0xff 201>, /* rpm_ipc[5]	*/
+			<0xff 202>, /* rpm_ipc[6]	*/
+			<0xff 203>, /* rpm_ipc[7]	*/
+			<0xff 204>, /* rpm_ipc[20]	*/
+			<0xff 205>, /* rpm_ipc[21]	*/
+			<0xff 206>, /* rpm_ipc[22]	*/
+			<0xff 207>, /* rpm_ipc[23]	*/
+			<0xff 208>, /* q6ss_irq_out(4)	*/
+			<0xff 209>, /* q6ss_irq_out(5)	*/
+			<0xff 210>, /* q6ss_irq_out(6)	*/
+			<0xff 211>, /* q6ss_irq_out(7)	*/
+			<0xff 213>, /* secure_wdog_bark_irq	*/
+			<0xff 214>, /* tsens1_tsens_max_min_int	*/
+			<0xff 215>, /* o_bimc_intr[0]	*/
+			<0xff 217>, /* ocimem_nonsec_irq	*/
+			<0xff 218>, /* sscaon_tmr_timeout_irq	*/
+			<0xff 219>, /* q6ss_irq_out(28)	*/
+			<0xff 220>, /* spmi_protocol_irq	*/
+			<0xff 221>, /* q6ss_irq_out(29)	*/
+			<0xff 222>, /* q6ss_irq_out(30)	*/
+			<0xff 223>, /* spdm_offline_irq	*/
+			<0xff 224>, /* spdm_realtime_irq	*/
+			<0xff 225>, /* snoc_obs_mainFault	*/
+			<0xff 226>, /* cnoc_obs_mainFault	*/
+			<0xff 227>, /* o_ss_xpu3_sec_intr	*/
+			<0xff 228>, /* o_tcsr_xpu3_non_sec_summary_intr	*/
+			<0xff 229>, /* o_timeout_slave_kpss_summary_intr */
+			<0xff 230>, /* o_tcsr_vmidmt_client_sec_summary_intr */
+			<0xff 231>, /* o_tcsr_vmidmt_client_non_sec */
+			<0xff 232>, /* o_tcsr_vmidmt_cfg_sec_summary_intr */
+			<0xff 233>, /* o_tcsr_vmidmt_cfg_non_sec */
+			<0xff 234>, /* q6ss_irq_out(31)	*/
+			<0xff 235>, /* cpr_irq[0]	*/
+			<0xff 236>, /* crypto_core_irq[0]	*/
+			<0xff 237>, /* crypto_core_irq[1]	*/
+			<0xff 238>, /* crypto_bam_irq[0]	*/
+			<0xff 239>, /* crypto_bam_irq[1]	*/
+			<0xff 240>, /* summary_irq_hmss	*/
+			<0xff 241>, /* dir_conn_irq_hmss_7	*/
+			<0xff 242>, /* dir_conn_irq_hmss_6	*/
+			<0xff 243>, /* dir_conn_irq_hmss_5	*/
+			<0xff 244>, /* dir_conn_irq_hmss_4	*/
+			<0xff 245>, /* dir_conn_irq_hmss_3	*/
+			<0xff 246>, /* dir_conn_irq_hmss_2	*/
+			<0xff 247>, /* dir_conn_irq_hmss_1	*/
+			<0xff 248>, /* dir_conn_irq_hmss_0	*/
+			<0xff 249>, /* summary_irq_hmss_tz	*/
+			<0xff 250>, /* cpr_irq[3]	*/
+			<0xff 251>, /* cpr_irq[2]	*/
+			<0xff 252>, /* cpr_irq[1]	*/
+			<0xff 253>, /* sdcc_pwr_cmd_irq	*/
+			<0xff 254>, /* sdio_wakeup_irq	*/
+			<0xff 255>, /* cpr_irq[0]	*/
+			<0xff 256>, /* smmu_Cirpt[13]	*/
+			<0xff 257>, /* smmu_Cirpt[14]	*/
+			<0xff 258>, /* smmu_Cirpt[0]	*/
+			<0xff 259>, /* sdcc_pwr_cmd_irq	*/
+			<0xff 260>, /* sdio_wakeup_irq	*/
+			<0xff 261>, /* o_tcsr_mmu_nsgcfglrpt_summary_intr */
+			<0xff 262>, /* o_tcsr_mmu_gcfglrpt_summary_intr	*/
+			<0xff 263>, /* o_tcsr_mmu_nsglrpt_summary_intr	*/
+			<0xff 264>, /* o_tcsr_mmu_glrpt_summary_intr	*/
+			<0xff 265>, /* vbif_irpt	*/
+			<0xff 266>, /* smmu_PMIrpt	*/
+			<0xff 267>, /* smmu_Cirpt[3]	*/
+			<0xff 268>, /* q6ss_irq_out(31)	*/
+			<0xff 269>, /* rpm_wdog_expired_irq	*/
+			<0xff 270>, /* bam_irq	*/
+			<0xff 271>, /* bam_irq	*/
+			<0xff 272>, /* q6ss_irq_out(28)	*/
+			<0xff 273>, /* q6ss_irq_out(29)	*/
+			<0xff 274>, /* q6ss_irq_out(30)	*/
+			<0xff 276>, /* osmmu_Cirpt [4]	*/
+			<0xff 277>, /* osmmu_Cirpt [5]	*/
+			<0xff 278>, /* usb30_ctrl_irq[1]	*/
+			<0xff 279>, /* osmmu_Cirpt [6]	*/
+			<0xff 280>, /* osmmu_Cirpt [7]	*/
+			<0xff 281>, /* osmmu_Cirpt [8]	*/
+			<0xff 282>, /* osmmu_Cirpt [9]	*/
+			<0xff 283>, /* osmmu_Cirpt [10]	*/
+			<0xff 284>, /* osmmu_Cirpt [11]	*/
+			<0xff 285>, /* osmmu_Cirpt [12]	*/
+			<0xff 286>, /* osmmu_Cirpt [13]	*/
+			<0xff 287>, /* osmmu_Cirpt [14]	*/
+			<0xff 288>, /* osmmu_Cirpt [15]	*/
+			<0xff 289>, /* ufs_ice_sec_level_irq	*/
+			<0xff 290>, /* cpr_irq[4]	*/
+			<0xff 291>, /* smmu_Cirpt[2]	*/
+			<0xff 292>, /* osmmu_Cirpt [16]	*/
+			<0xff 293>, /* osmmu_Cirpt [17]	*/
+			<0xff 294>, /* osmmu_Cirpt [18]	*/
+			<0xff 295>, /* osmmu_Cirpt [0]	*/
+			<0xff 296>, /* osmmu_PMIrpt	*/
+			<0xff 297>, /* ufs_intrq	*/
+			<0xff 298>, /* osmmu_Cirpt [1]	*/
+			<0xff 299>, /* osmmu_Cirpt [2]	*/
+			<0xff 300>, /* osmmu_Cirpt [3]	*/
+			<0xff 301>, /* smmu_Cirpt[1]	*/
+			<0xff 302>, /* qdss_etrbytecnt_irq	*/
+			<0xff 303>, /* smmu_Cirpt[0]	*/
+			<0xff 304>, /* osmmu_Cirpt [19]	*/
+			<0xff 305>, /* osmmu_Cirpt [20]	*/
+			<0xff 306>, /* osmmu_Cirpt [21]	*/
+			<0xff 307>, /* osmmu_Cirpt [22]	*/
+			<0xff 308>, /* osmmu_Cirpt [23]	*/
+			<0xff 310>, /* pcie20_global_int	*/
+			<0xff 311>, /* pcie20_int_edma_int	*/
+			<0xff 316>, /* lpass_hdmitx_interrupt_ext	*/
+			<0xff 317>, /* rbif_irq	*/
+			<0xff 318>, /* gpu_cc_gpu_cx_gds_hw_ctrl_irq_out */
+			<0xff 319>, /* VENUS_IRQ	*/
+			<0xff 323>, /* lpass_slimbus1_core_ee1_irq	*/
+			<0xff 324>, /* lpass_slimbus1_bam_ee1_irq	*/
+			<0xff 325>, /* camss_irq18	*/
+			<0xff 326>, /* camss_irq0	*/
+			<0xff 327>, /* camss_irq1	*/
+			<0xff 328>, /* camss_irq2	*/
+			<0xff 329>, /* camss_irq3	*/
+			<0xff 330>, /* camss_irq4	*/
+			<0xff 331>, /* camss_irq5	*/
+			<0xff 332>, /* GC_SYS_irq_0	*/
+			<0xff 333>, /* GC_SYS_irq_1	*/
+			<0xff 334>, /* GC_SYS_irq_2	*/
+			<0xff 335>, /* GC_SYS_irq_3	*/
+			<0xff 336>, /* camss_irq13	*/
+			<0xff 337>, /* camss_irq14	*/
+			<0xff 338>, /* camss_irq15	*/
+			<0xff 339>, /* camss_irq16	*/
+			<0xff 340>, /* camss_irq17	*/
+			<0xff 341>, /* camss_irq6	*/
+			<0xff 342>, /* smmu_Cirpt[15]	*/
+			<0xff 343>, /* bam_irq[0]	*/
+			<0xff 344>, /* uart_dm_intr	*/
+			<0xff 345>, /* camss_irq7	*/
+			<0xff 346>, /* camss_irq8	*/
+			<0xff 347>, /* camss_irq9	*/
+			<0xff 348>, /* camss_irq10	*/
+			<0xff 350>, /* camss_irq12	*/
+			<0xff 351>, /* sif_aud_dec_out_irq_ext	*/
+			<0xff 356>, /* vbif_nrt_irpt	*/
+			<0xff 357>, /* Nonfatal pIMEM interrupt	*/
+			<0xff 359>, /* spmi_periph_irq[1]	*/
+			<0xff 360>, /* fatal pIMEM interrupt	*/
+			<0xff 361>, /* osmmu_Cirpt[0]	*/
+			<0xff 362>, /* osmmu_Cirpt[1]	*/
+			<0xff 363>, /* osmmu_Cirpt[2]	*/
+			<0xff 364>, /* osmmu_Cirpt[3]	*/
+			<0xff 365>, /* ipa_irq(0)	*/
+			<0xff 366>, /* osmmu_PMIrpt	*/
+			<0xff 380>, /* sp_sp2apps_irq[0]	*/
+			<0xff 381>, /* sp_sp2apps_irq[1]	*/
+			<0xff 382>, /* sp_sp2apps_irq[2]	*/
+			<0xff 383>, /* sp_sp2apps_irq[3]	*/
+			<0xff 385>, /* osmmu_CIrpt[12]	*/
+			<0xff 386>, /* osmmu_CIrpt[13]	*/
+			<0xff 387>, /* osmmu_CIrpt[14]	*/
+			<0xff 388>, /* osmmu_CIrpt[15]	*/
+			<0xff 389>, /* osmmu_CIrpt[16]	*/
+			<0xff 390>, /* osmmu_CIrpt[17]	*/
+			<0xff 391>, /* osmmu_CIrpt[18]	*/
+			<0xff 392>, /* osmmu_CIrpt[19]	*/
+			<0xff 393>, /* o_dcc_crc_fail_int	*/
+			<0xff 395>, /* aggre1_obs_mainfault	*/
+			<0xff 396>, /* aggr1_smmu_cirpt[0]	*/
+			<0xff 397>, /* aggr1_smmu_cirpt[1]	*/
+			<0xff 398>, /* aggr1_smmu_cirpt[2]	*/
+			<0xff 399>, /* aggr1_smmu_cirpt[3]	*/
+			<0xff 400>, /* aggr1_smmu_cirpt[4]	*/
+			<0xff 401>, /* aggr1_smmu_cirpt[5]	*/
+			<0xff 402>, /* aggr1_smmu_cirpt[6]	*/
+			<0xff 403>, /* aggr1_smmu_pmirpt	*/
+			<0xff 404>, /* aggre2noc_obs_mainFault	*/
+			<0xff 405>, /* osmmu_CIrpt[0]	*/
+			<0xff 406>, /* osmmu_CIrpt[1]	*/
+			<0xff 407>, /* osmmu_CIrpt[2]	*/
+			<0xff 408>, /* osmmu_CIrpt[3]	*/
+			<0xff 409>, /* osmmu_CIrpt[4]	*/
+			<0xff 410>, /* osmmu_CIrpt[5]	*/
+			<0xff 411>, /* o_dcc_task_done_int	*/
+			<0xff 412>, /* vsense_alarm_irq	*/
+			<0xff 413>, /* osmmu_PMIrpt	*/
+			<0xff 414>, /* pmic_arb_trans_done_irq[0]	*/
+			<0xff 415>, /* pmic_arb_trans_done_irq[1]	*/
+			<0xff 416>, /* rpm_ipc[28]	*/
+			<0xff 417>, /* rpm_ipc[29]	*/
+			<0xff 418>, /* rpm_ipc[30]	*/
+			<0xff 419>, /* rpm_ipc[31]	*/
+			<0xff 420>, /* qup_irq	*/
+			<0xff 421>, /* qup_irq	*/
+			<0xff 422>, /* wd_bite_apps	*/
+			<0xff 423>, /* lpass_qos_apps_interrupt	*/
+			<0xff 424>, /* ipa_irq(2)	*/
+			<0xff 425>, /* smmu_Cirpt[1]	*/
+			<0xff 426>, /* smmu_Cirpt[2]	*/
+			<0xff 427>, /* smmu_Cirpt[3]	*/
+			<0xff 428>, /* smmu_Cirpt[4]	*/
+			<0xff 429>, /* smmu_Cirpt[5]	*/
+			<0xff 430>, /* smmu_Cirpt[6]	*/
+			<0xff 431>, /* smmu_Cirpt[7]	*/
+			<0xff 432>, /* smmu_Cirpt[8]	*/
+			<0xff 433>, /* smmu_Cirpt[9]	*/
+			<0xff 434>, /* smmu_Cirpt[10]	*/
+			<0xff 435>, /* smmu_Cirpt[11]	*/
+			<0xff 436>, /* smmu_Cirpt[16]	*/
+			<0xff 437>, /* pcie20_0_int_msi_dev0	*/
+			<0xff 438>, /* pcie20_0_int_msi_dev1	*/
+			<0xff 439>, /* pcie20_0_int_msi_dev2	*/
+			<0xff 440>, /* pcie20_0_int_msi_dev3	*/
+			<0xff 441>, /* pcie20_0_int_msi_dev4	*/
+			<0xff 442>, /* pcie20_0_int_msi_dev5	*/
+			<0xff 443>, /* pcie20_0_int_msi_dev6	*/
+			<0xff 444>, /* pcie20_0_int_msi_dev7	*/
+			<0xff 445>, /* o_wcss_apps_intr[0]	*/
+			<0xff 446>, /* o_wcss_apps_intr[1]	*/
+			<0xff 447>, /* o_wcss_apps_intr[2]	*/
+			<0xff 448>, /* o_wcss_apps_intr[3]	*/
+			<0xff 449>, /* o_wcss_apps_intr[4]	*/
+			<0xff 450>, /* o_wcss_apps_intr[5]	*/
+			<0xff 452>, /* o_wcss_apps_intr[6]	*/
+			<0xff 453>, /* o_wcss_apps_intr[7]	*/
+			<0xff 454>, /* o_wcss_apps_intr[8]	*/
+			<0xff 455>, /* o_wcss_apps_intr[9]	*/
+			<0xff 456>, /* o_wcss_apps_intr[10]	*/
+			<0xff 457>, /* o_wcss_apps_intr[11]	*/
+			<0xff 458>, /* o_wcss_apps_intr[12]	*/
+			<0xff 461>, /* o_ocimem_nonsec_irq	*/
+			<0xff 462>, /* tsens1_tsens_critical_int	*/
+			<0xff 463>, /* aggr1_smmu_cirpt[7]	*/
+			<0xff 464>, /* ipa_bam_irq(0)	*/
+			<0xff 465>, /* ipa_bam_irq(2)	*/
+			<0xff 466>, /* ssc_uart_int	*/
+			<0xff 468>, /* cri_cm_irq_tz	*/
+			<0xff 469>, /* cri_cm_irq_hyp	*/
+			<0xff 471>, /* mmss_bimc_smmu_gds_hw_ctrl_irq_out */
+			<0xff 472>, /* gcc_gds_hw_ctrl_irq_out	*/
+			<0xff 473>, /* lcc_audio_core_smmu_gds_hw_ctrl */
+			<0xff 477>, /* tsens0_tsens_critical_int	*/
+			<0xff 478>, /* tsens0_tsens_max_min_int	*/
+			<0xff 480>, /* q6ss_wdog_expired_irq	*/
+			<0xff 481>, /* mss_ipc_out_irq[4]	*/
+			<0xff 482>, /* mss_ipc_out_irq[5]	*/
+			<0xff 483>, /* mss_ipc_out_irq[6]	*/
+			<0xff 484>, /* mss_ipc_out_irq[7]	*/
+			<0xff 485>, /* mss_ipc_out_irq[28]	*/
+			<0xff 486>, /* mss_ipc_out_irq[29]	*/
+			<0xff 487>, /* mss_ipc_out_irq[30]	*/
+			<0xff 488>, /* mss_ipc_out_irq[31]	*/
+			<0xff 489>, /* skl_core_irq	*/
+			<0xff 490>, /* tsens0_upper_lower_int	*/
+			<0xff 494>, /* osmmu_CIrpt[6]	*/
+			<0xff 495>, /* osmmu_CIrpt[7]	*/
+			<0xff 496>, /* osmmu_CIrpt[8]	*/
+			<0xff 497>, /* osmmu_CIrpt[9]	*/
+			<0xff 498>, /* osmmu_CIrpt[10]	*/
+			<0xff 499>, /* osmmu_CIrpt[11]	*/
+			<0xff 503>; /* o_bimc_intr[1]	*/
+
+		qcom,gpio-parent = <&tlmm>;
+		qcom,gpio-map = <3  1>,
+			<4  5>,
+			<5  9>,
+			<6  11>,
+			<7  66>,
+			<8  22>,
+			<9  24>,
+			<10  26>,
+			<11  34>,
+			<12  36>,
+			<13  37>, /* PCIe0 */
+			<14  38>,
+			<15  40>,
+			<16  42>,
+			<17  46>,
+			<18  50>,
+			<19  53>,
+			<20  54>,
+			<21  56>,
+			<22  57>,
+			<23  58>,
+			<24  59>,
+			<25  60>,
+			<26  61>,
+			<27  62>,
+			<28  63>,
+			<29  64>,
+			<30  71>,
+			<31  73>,
+			<32  77>,
+			<33  78>,
+			<34  79>,
+			<35  80>,
+			<36  82>,
+			<37  86>,
+			<38  91>,
+			<39  92>,
+			<40  95>,
+			<41  97>,
+			<42  101>,
+			<43  104>,
+			<44  106>,
+			<45  108>,
+			<46  112>,
+			<47  113>,
+			<48  110>,
+			<50  127>,
+			<51  115>,
+			<54  116>, /* PCIe2 */
+			<55  117>,
+			<56  118>,
+			<57  119>,
+			<58  120>,
+			<59  121>,
+			<60  122>,
+			<61  123>,
+			<62  124>,
+			<63  125>,
+			<64  126>,
+			<65  129>,
+			<66  131>,
+			<67  132>, /* PCIe1 */
+			<68  133>,
+			<69  145>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-qrd-overlay.dts b/arch/arm64/boot/dts/qcom/msm8998-qrd-overlay.dts
new file mode 100644
index 000000000000..ce1c62d9c2ae
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-qrd-overlay.dts
@@ -0,0 +1,28 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/msm-clocks-8998.h>
+#include <dt-bindings/interrupt-controller/irq.h>
+
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-qrd.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 QRD";
+	compatible = "qcom,msm8998-qrd", "qcom,msm8998", "qcom,qrd";
+	qcom,msm-id = <292 0x0>;
+	qcom,board-id = <11 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-qrd-skuk-hdk.dtsi b/arch/arm64/boot/dts/qcom/msm8998-qrd-skuk-hdk.dtsi
new file mode 100644
index 000000000000..7809b81fcefd
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-qrd-skuk-hdk.dtsi
@@ -0,0 +1,162 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8998-qrd-skuk.dtsi"
+#include "msm8998-camera-sensor-skuk-hdk.dtsi"
+
+&soc {
+	sound-tavil {
+		qcom,msm-mbhc-hphl-swh = <0>;
+	};
+};
+
+&pmx_mdss {
+	mdss_dsi_active: mdss_dsi_active {
+		mux {
+			pins = "gpio52", "gpio94";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio52", "gpio94";
+			drive-strength = <8>; /* 8 mA */
+			bias-disable = <0>; /* no pull */
+		};
+	};
+
+	mdss_dsi_suspend: mdss_dsi_suspend {
+		mux {
+			pins = "gpio52", "gpio94";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio52", "gpio94";
+			drive-strength = <2>; /* 2 mA */
+			bias-pull-down; /* pull down */
+		};
+	};
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_hdmi_tx {
+	pinctrl-names = "hdmi_hpd_active", "hdmi_ddc_active", "hdmi_cec_active",
+		"hdmi_active", "hdmi_sleep";
+	pinctrl-0 = <&mdss_hdmi_5v_active  &mdss_hdmi_hpd_active
+		&mdss_hdmi_ddc_suspend &mdss_hdmi_cec_suspend>;
+	pinctrl-1 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+		&mdss_hdmi_ddc_active &mdss_hdmi_cec_suspend>;
+	pinctrl-2 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+		&mdss_hdmi_cec_active &mdss_hdmi_ddc_suspend>;
+	pinctrl-3 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+		&mdss_hdmi_ddc_active &mdss_hdmi_cec_active>;
+	pinctrl-4 = <&mdss_hdmi_5v_suspend &mdss_hdmi_hpd_suspend
+		&mdss_hdmi_ddc_suspend &mdss_hdmi_cec_suspend>;
+};
+
+&mdss_dp_ctrl {
+	pinctrl-names = "mdss_dp_active", "mdss_dp_sleep";
+	pinctrl-0 = <&mdss_dp_aux_active &mdss_dp_usbplug_cc_active>;
+	pinctrl-1 = <&mdss_dp_aux_suspend &mdss_dp_usbplug_cc_suspend>;
+	qcom,aux-en-gpio = <&tlmm 77 0>;
+	qcom,aux-sel-gpio = <&tlmm 78 0>;
+	qcom,usbplug-cc-gpio = <&tlmm 38 0>;
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_s6e3ha3_amoled_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,platform-enable-gpio = <&tlmm 52 0>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-avdd-en-gpio = <&pmi8998_gpios 1 0>;
+	qcom,platform-avdd-en-gpio-invert;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_s6e3ha3_amoled_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,platform-enable-gpio = <&tlmm 52 0>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-avdd-en-gpio = <&pmi8998_gpios 1 0>;
+	qcom,platform-avdd-en-gpio-invert;
+};
+
+&pmi8998_wled {
+	qcom,disp-type-amoled;
+};
+
+&labibb {
+	status = "ok";
+	qcom,qpnp-labibb-mode = "amoled";
+	qcom,swire-control;
+};
+
+&pmi8998_gpios {
+	/* GPIO 1 for AVDD power enable */
+	gpio@c000 {
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <0>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <0>;
+		qcom,invert = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&dsi_dual_s6e3ha3_amoled_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_dcs";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <255>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&i2c_5 {
+	status = "okay";
+	st_fts@49 {
+		compatible = "st,fts";
+		reg = <0x49>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <125 0x2008>;
+		vdd-supply = <&pm8998_l6>;
+		avdd-supply = <&pm8998_l28>;
+		pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+		pinctrl-0 = <&ts_active>;
+		pinctrl-1 = <&ts_int_suspend &ts_reset_suspend>;
+		st,irq-gpio = <&tlmm 125 0x2008>;
+		st,reset-gpio = <&tlmm 89 0x00>;
+		st,regulator_dvdd = "vdd";
+		st,regulator_avdd = "avdd";
+	};
+};
+
+&soc {
+	/* HDK835 do not use improveTouch. If do not remove this node,
+	 * legacy TOUCH could not work.
+	 */
+	/delete-node/hbtp;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-qrd-skuk-overlay.dts b/arch/arm64/boot/dts/qcom/msm8998-qrd-skuk-overlay.dts
new file mode 100644
index 000000000000..408a067dbeee
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-qrd-skuk-overlay.dts
@@ -0,0 +1,27 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/msm-clocks-8998.h>
+#include <dt-bindings/interrupt-controller/irq.h>
+
+#include "msm8998-qrd-skuk.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 QRD SKUK";
+	compatible = "qcom,msm8998-qrd", "qcom,msm8998", "qcom,qrd";
+	qcom,msm-id = <292 0x0>;
+	qcom,board-id = <0x01000b 0x80>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-qrd-skuk.dts b/arch/arm64/boot/dts/qcom/msm8998-qrd-skuk.dts
new file mode 100644
index 000000000000..b3062c48e051
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-qrd-skuk.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8998.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-qrd-skuk.dtsi"
+#include "msm8998-camera-sensor-skuk.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 SKUK";
+	compatible = "qcom,msm8998-qrd", "qcom,msm8998", "qcom,qrd";
+	qcom,board-id = <0x01000b 0x80>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-qrd-skuk.dtsi b/arch/arm64/boot/dts/qcom/msm8998-qrd-skuk.dtsi
new file mode 100644
index 000000000000..c4a428635231
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-qrd-skuk.dtsi
@@ -0,0 +1,499 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/irq.h>
+#include "msm8998-pinctrl.dtsi"
+#include "msm8998-audio.dtsi"
+
+/ {
+	bluetooth: bt_wcn3990 {
+		compatible = "qca,wcn3990";
+		qca,bt-vdd-io-supply = <&pm8998_s3>;
+		qca,bt-vdd-xtal-supply = <&pm8998_s5>;
+		qca,bt-vdd-core-supply = <&pm8998_l7>;
+		qca,bt-vdd-pa-supply = <&pm8998_l17>;
+		qca,bt-vdd-ldo-supply = <&pm8998_l25>;
+		qca,bt-chip-pwd-supply = <&pmi8998_bob_pin1>;
+		clocks = <&clock_gcc clk_rf_clk2_pin>;
+		clock-names = "rf_clk2";
+
+		qca,bt-vdd-io-voltage-level = <1352000 1352000>;
+		qca,bt-vdd-xtal-voltage-level = <2040000 2040000>;
+		qca,bt-vdd-core-voltage-level = <1800000 1800000>;
+		qca,bt-vdd-pa-voltage-level = <1304000 1304000>;
+		qca,bt-vdd-ldo-voltage-level = <3312000 3312000>;
+		qca,bt-chip-pwd-voltage-level = <3600000 3600000>;
+
+		qca,bt-vdd-io-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-xtal-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-core-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-pa-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-ldo-current-level = <1>; /* LPM/PFM */
+	};
+};
+
+&blsp1_uart3_hs {
+	status = "ok";
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm8998_l1>;
+	vdda-pll-supply = <&pm8998_l2>;
+	vddp-ref-clk-supply = <&pm8998_l26>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14600>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm8998_l20>;
+	vccq-supply = <&pm8998_l26>;
+	vccq2-supply = <&pm8998_s4>;
+	vcc-max-microamp = <750000>;
+	vccq-max-microamp = <560000>;
+	vccq2-max-microamp = <750000>;
+	status = "ok";
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8998_l21>;
+	qcom,vdd-voltage-level = <2950000 2960000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8998_l13>;
+	qcom,vdd-io-voltage-level = <1808000 2960000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000
+				50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x0>;
+
+	status = "ok";
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&i2c_6 { /* BLSP1 QUP6 (NFC) */
+	status = "okay";
+	nq@28 {
+		compatible = "qcom,nq-nci";
+		reg = <0x28>;
+		qcom,nq-irq = <&tlmm 92 0x00>;
+		qcom,nq-ven = <&tlmm 12 0x00>;
+		qcom,nq-firm = <&tlmm 93 0x00>;
+		qcom,nq-clkreq = <&pm8998_gpios 21 0x00>;
+		qcom,nq-esepwr = <&tlmm 116 0x00>;
+		interrupt-parent = <&tlmm>;
+		qcom,clk-src = "BBCLK3";
+		interrupts = <92 0>;
+		interrupt-names = "nfc_irq";
+		pinctrl-names = "nfc_active", "nfc_suspend";
+		pinctrl-0 = <&nfc_int_active &nfc_enable_active>;
+		pinctrl-1 = <&nfc_int_suspend &nfc_enable_suspend>;
+		clocks = <&clock_gcc clk_ln_bb_clk3_pin>;
+		clock-names = "ref_clk";
+	};
+};
+
+&pm8998_gpios {
+	/* GPIO 5 for Home Key */
+	gpio@c400 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 6 for Vol+ Key */
+	gpio@c500 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	gpio@d200 { /* GPIO 19 - wil6210 refclk3_en */
+		qcom,mode = <0>;		/* Input */
+		qcom,pull = <5>;		/* No Pull */
+		qcom,vin-sel = <1>;		/* VIN1 GPIO_MV */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	/* GPIO 21 (NFC_CLK_REQ) */
+	gpio@d400 {
+		qcom,mode = <0>;
+		qcom,vin-sel = <1>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&soc {
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+		status = "okay";
+
+		home {
+			label = "home";
+			gpios = <&pm8998_gpios 5 0x1>;
+			linux,input-type = <1>;
+			linux,code = <102>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8998_gpios 6 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+
+	sound-tavil {
+		qcom,model = "msm8998-skuk-tavil-snd-card";
+
+		qcom,audio-routing =
+			"AIF4 VI", "MCLK",
+			"RX_BIAS", "MCLK",
+			"AMIC2", "MIC BIAS2",
+			"MIC BIAS2", "Headset Mic",
+			"DMIC0", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic0",
+			"DMIC1", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic1",
+			"DMIC2", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic2",
+			"DMIC4", "MIC BIAS4",
+			"MIC BIAS4", "Digital Mic4",
+			"SpkrLeft IN", "SPK1 OUT";
+
+		qcom,msm-mbhc-hphl-swh = <1>;
+
+		qcom,wsa-max-devs = <1>;
+		qcom,wsa-devs = <&wsa881x_0211>, <&wsa881x_0213>;
+		qcom,wsa-aux-dev-prefix = "SpkrLeft", "SpkrLeft";
+	};
+
+	hbtp {
+		compatible = "qcom,hbtp-input";
+		pinctrl-names = "pmx_ts_active","pmx_ts_suspend";
+		pinctrl-0 = <&ts_rst_active>;
+		pinctrl-1 = <&ts_rst_suspend>;
+		vcc_ana-supply = <&pm8998_l28>;
+		vcc_dig-supply = <&pm8998_l6>;
+		qcom,afe-load = <20000>;
+		qcom,afe-vtg-min = <3008000>;
+		qcom,afe-vtg-max = <3008000>;
+		qcom,dig-load = <40000>;
+		qcom,dig-vtg-min = <1808000>;
+		qcom,dig-vtg-max = <1808000>;
+		qcom,fb-resume-delay-us = <10000>;
+		qcom,afe-power-on-delay-us = <1000>;
+		qcom,afe-power-off-delay-us = <6>;
+	};
+};
+
+&pmx_mdss {
+	mdss_dsi_active: mdss_dsi_active {
+		mux {
+			pins = "gpio94";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio94";
+			drive-strength = <8>; /* 8 mA */
+			bias-disable = <0>; /* no pull */
+			output-high;
+		};
+	};
+
+	mdss_dsi_suspend: mdss_dsi_suspend {
+		mux {
+			pins = "gpio94";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio94";
+			drive-strength = <2>; /* 2 mA */
+			bias-pull-down; /* pull down */
+		};
+	};
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_jdi_a407_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_jdi_a407_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+};
+
+&labibb {
+	status = "ok";
+	qcom,qpnp-labibb-mode = "lcd";
+};
+
+&dsi_dual_jdi_a407_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&vendor {
+	qrd_batterydata: qcom,battery-data {
+		qcom,batt-id-range-pct = <15>;
+		#include "fg-gen3-batterydata-qrd-skuk-4v4-3000mah.dtsi"
+	};
+};
+
+&pmi8998_fg {
+	qcom,battery-data = <&qrd_batterydata>;
+	qcom,fg-jeita-thresholds = <0 5 55 55>;
+};
+
+&pmi8998_haptics {
+	status = "okay";
+};
+
+&pmi8998_wled {
+	qcom,led-strings-list = [00 01];
+	qcom,fs-curr-ua = <20000>;
+};
+
+&tlmm {
+	/* add pingrp for touchscreen */
+	pmx_ts_rst_active {
+		ts_rst_active: ts_rst_active {
+			mux {
+				pins = "gpio89";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio89";
+				drive-strength = <16>;
+				bias-pull-up;
+			};
+		};
+	};
+
+	pmx_ts_rst_suspend {
+		ts_rst_suspend: ts_rst_suspend {
+			mux {
+				pins = "gpio89";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio89";
+				drive-strength = <2>;
+				bias-pull-down;
+			};
+		};
+	};
+};
+
+&pm8998_vadc {
+	chan@83 {
+		label = "vph_pwr";
+		reg = <0x83>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@85 {
+		label = "vcoin";
+		reg = <0x85>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@4c {
+		label = "xo_therm";
+		reg = <0x4c>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@4d {
+		label = "msm_therm";
+		reg = <0x4d>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@51 {
+		label = "quiet_therm";
+		reg = <0x51>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8998_adc_tm {
+	chan@83 {
+		label = "vph_pwr";
+		reg = <0x83>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,btm-channel-number = <0x60>;
+	};
+
+	chan@4d {
+		label = "msm_therm";
+		reg = <0x4d>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@51 {
+		label = "quiet_therm";
+		reg = <0x51>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@4c {
+		label = "xo_therm";
+		reg = <0x4c>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+};
+
+&red_led {
+	/delete-property/ linux,default-trigger;
+	qcom,start-idx = <1>;
+	qcom,idx-len = <10>;
+	qcom,duty-pcts = [00 19 32 4b 64
+			64 4b 32 19 00];
+	qcom,lut-flags = <3>;
+	qcom,pause-lo = <0>;
+	qcom,pause-hi = <0>;
+	qcom,ramp-step-ms = <255>;
+	qcom,use-blink;
+};
+
+&green_led {
+	/delete-property/ linux,default-trigger;
+	qcom,start-idx = <1>;
+	qcom,idx-len = <10>;
+	qcom,duty-pcts = [00 19 32 4b 64
+			64 4b 32 19 00];
+	qcom,lut-flags = <3>;
+	qcom,pause-lo = <0>;
+	qcom,pause-hi = <0>;
+	qcom,ramp-step-ms = <255>;
+	qcom,use-blink;
+};
+
+&blue_led {
+	/delete-property/ linux,default-trigger;
+	qcom,start-idx = <1>;
+	qcom,idx-len = <10>;
+	qcom,duty-pcts = [00 19 32 4b 64
+			64 4b 32 19 00];
+	qcom,lut-flags = <3>;
+	qcom,pause-lo = <0>;
+	qcom,pause-hi = <0>;
+	qcom,ramp-step-ms = <255>;
+	qcom,use-blink;
+};
+
+&wil6210 {
+	status = "ok";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-qrd-vr1-overlay.dts b/arch/arm64/boot/dts/qcom/msm8998-qrd-vr1-overlay.dts
new file mode 100644
index 000000000000..ff0e24dd0371
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-qrd-vr1-overlay.dts
@@ -0,0 +1,27 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/msm-clocks-8998.h>
+#include <dt-bindings/interrupt-controller/irq.h>
+
+#include "msm8998-qrd-vr1.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 QRD VR1 Board";
+	compatible = "qcom,msm8998-qrd", "qcom,msm8998", "qcom,qrd";
+	qcom,msm-id = <292 0x0>;
+	qcom,board-id = <0x02000b 0x80>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-qrd-vr1.dts b/arch/arm64/boot/dts/qcom/msm8998-qrd-vr1.dts
new file mode 100644
index 000000000000..9b8e631f80a6
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-qrd-vr1.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8998.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-qrd-vr1.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 VR1 Board";
+	compatible = "qcom,msm8998-qrd", "qcom,msm8998", "qcom,qrd";
+	qcom,board-id = <0x02000b 0x80>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-qrd-vr1.dtsi b/arch/arm64/boot/dts/qcom/msm8998-qrd-vr1.dtsi
new file mode 100644
index 000000000000..9b1145242cc0
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-qrd-vr1.dtsi
@@ -0,0 +1,473 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/irq.h>
+#include "msm8998-pinctrl.dtsi"
+#include "msm8998-camera-sensor-qrd-vr1.dtsi"
+
+/ {
+	bluetooth: bt_wcn3990 {
+		compatible = "qca,wcn3990";
+		qca,bt-vdd-io-supply = <&pm8998_s3>;
+		qca,bt-vdd-xtal-supply = <&pm8998_s5>;
+		qca,bt-vdd-core-supply = <&pm8998_l7>;
+		qca,bt-vdd-pa-supply = <&pm8998_l17>;
+		qca,bt-vdd-ldo-supply = <&pm8998_l25>;
+		qca,bt-chip-pwd-supply = <&pmi8998_bob_pin1>;
+		clocks = <&clock_gcc clk_rf_clk2_pin>;
+		clock-names = "rf_clk2";
+
+		qca,bt-vdd-io-voltage-level = <1352000 1352000>;
+		qca,bt-vdd-xtal-voltage-level = <2040000 2040000>;
+		qca,bt-vdd-core-voltage-level = <1800000 1800000>;
+		qca,bt-vdd-pa-voltage-level = <1304000 1304000>;
+		qca,bt-vdd-ldo-voltage-level = <3312000 3312000>;
+		qca,bt-chip-pwd-voltage-level = <3600000 3600000>;
+
+		qca,bt-vdd-io-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-xtal-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-core-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-pa-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-ldo-current-level = <1>; /* LPM/PFM */
+	};
+};
+
+&blsp1_uart3_hs {
+	status = "ok";
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm8998_l1>;
+	vdda-pll-supply = <&pm8998_l2>;
+	vddp-ref-clk-supply = <&pm8998_l26>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14600>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm8998_l20>;
+	vccq-supply = <&pm8998_l26>;
+	vccq2-supply = <&pm8998_s4>;
+	vcc-max-microamp = <750000>;
+	vccq-max-microamp = <560000>;
+	vccq2-max-microamp = <750000>;
+	status = "ok";
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8998_l21>;
+	qcom,vdd-voltage-level = <2950000 2960000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8998_l13>;
+	qcom,vdd-io-voltage-level = <1808000 2960000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000
+				50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x0>;
+
+	status = "ok";
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&i2c_6 { /* BLSP1 QUP6 (NFC) */
+	status = "okay";
+	nq@28 {
+		compatible = "qcom,nq-nci";
+		reg = <0x28>;
+		qcom,nq-irq = <&tlmm 92 0x00>;
+		qcom,nq-ven = <&tlmm 12 0x00>;
+		qcom,nq-firm = <&tlmm 93 0x00>;
+		qcom,nq-clkreq = <&pm8998_gpios 21 0x00>;
+		qcom,nq-esepwr = <&tlmm 116 0x00>;
+		interrupt-parent = <&tlmm>;
+		qcom,clk-src = "BBCLK3";
+		interrupts = <92 0>;
+		interrupt-names = "nfc_irq";
+		pinctrl-names = "nfc_active", "nfc_suspend";
+		pinctrl-0 = <&nfc_int_active &nfc_enable_active>;
+		pinctrl-1 = <&nfc_int_suspend &nfc_enable_suspend>;
+		clocks = <&clock_gcc clk_ln_bb_clk3_pin>;
+		clock-names = "ref_clk";
+	};
+};
+
+&pm8998_gpios {
+	/* GPIO 6 for Vol+ Key */
+	gpio@c500 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 21 (NFC_CLK_REQ) */
+	gpio@d400 {
+		qcom,mode = <0>;
+		qcom,vin-sel = <1>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&pmi8998_gpios {
+	/* GPIO 6 for the internal QNOVO discharge FET control signal */
+	gpio@c500 {
+		status = "okay";
+		qcom,mode = <1>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,master-en = <1>;
+	};
+};
+
+&i2c_5 {
+	status = "okay";
+	st_fts@49 {
+		compatible = "st,fts";
+		reg = <0x49>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <125 0x2008>;
+		vdd-supply = <&pm8998_l6>;
+		avdd-supply = <&pm8998_l28>;
+		pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+		pinctrl-0 = <&ts_active>;
+		pinctrl-1 = <&ts_int_suspend &ts_reset_suspend>;
+		st,irq-gpio = <&tlmm 125 0x2008>;
+		st,reset-gpio = <&tlmm 89 0x00>;
+		st,regulator_dvdd = "vdd";
+		st,regulator_avdd = "avdd";
+	};
+};
+
+&soc {
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+		status = "okay";
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8998_gpios 6 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+
+	sound-tavil {
+		qcom,model = "msm8998-qvr-tavil-snd-card";
+		qcom,audio-routing =
+			"RX_BIAS", "MCLK",
+			"MADINPUT", "MCLK",
+			"AMIC2", "MIC BIAS2",
+			"MIC BIAS2", "Headset Mic",
+			"DMIC0", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic0",
+			"DMIC1", "MIC BIAS1",
+			"MIC BIAS1", "Digital Mic1",
+			"DMIC2", "MIC BIAS3",
+			"MIC BIAS3", "Digital Mic2",
+			"DMIC4", "MIC BIAS4",
+			"MIC BIAS4", "Digital Mic4",
+			"SpkrLeft IN", "SPK1 OUT";
+
+		qcom,msm-mbhc-hphl-swh = <1>;
+		/delete-property/ qcom,us-euro-gpios;
+		/delete-property/ qcom,hph-en0-gpio;
+		/delete-property/ qcom,hph-en0-gpio;
+
+		qcom,wsa-max-devs = <1>;
+		qcom,wsa-devs = <&wsa881x_0211>, <&wsa881x_0213>;
+		qcom,wsa-aux-dev-prefix = "SpkrLeft", "SpkrLeft";
+	};
+};
+
+&vendor {
+	qrd_batterydata: qcom,battery-data {
+		qcom,batt-id-range-pct = <15>;
+		#include "fg-gen3-batterydata-qrd-skuk-4v4-3000mah.dtsi"
+	};
+};
+
+&pmi8998_fg {
+	qcom,battery-data = <&qrd_batterydata>;
+	qcom,fg-jeita-thresholds = <0 5 55 55>;
+};
+
+&pmi8998_haptics {
+	status = "okay";
+};
+
+&pm8998_vadc {
+	chan@83 {
+		label = "vph_pwr";
+		reg = <0x83>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@85 {
+		label = "vcoin";
+		reg = <0x85>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@4c {
+		label = "xo_therm";
+		reg = <0x4c>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@4d {
+		label = "msm_therm";
+		reg = <0x4d>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@51 {
+		label = "quiet_therm";
+		reg = <0x51>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8998_adc_tm {
+	chan@83 {
+		label = "vph_pwr";
+		reg = <0x83>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,btm-channel-number = <0x60>;
+	};
+
+	chan@4d {
+		label = "msm_therm";
+		reg = <0x4d>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@51 {
+		label = "quiet_therm";
+		reg = <0x51>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@4c {
+		label = "xo_therm";
+		reg = <0x4c>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+};
+
+&red_led {
+	/delete-property/ linux,default-trigger;
+	qcom,start-idx = <1>;
+	qcom,idx-len = <10>;
+	qcom,duty-pcts = [00 19 32 4b 64
+			64 4b 32 19 00];
+	qcom,lut-flags = <3>;
+	qcom,pause-lo = <0>;
+	qcom,pause-hi = <0>;
+	qcom,ramp-step-ms = <255>;
+	qcom,use-blink;
+};
+
+&green_led {
+	/delete-property/ linux,default-trigger;
+	qcom,start-idx = <1>;
+	qcom,idx-len = <10>;
+	qcom,duty-pcts = [00 19 32 4b 64
+			64 4b 32 19 00];
+	qcom,lut-flags = <3>;
+	qcom,pause-lo = <0>;
+	qcom,pause-hi = <0>;
+	qcom,ramp-step-ms = <255>;
+	qcom,use-blink;
+};
+
+&blue_led {
+	/delete-property/ linux,default-trigger;
+	qcom,start-idx = <1>;
+	qcom,idx-len = <10>;
+	qcom,duty-pcts = [00 19 32 4b 64
+			64 4b 32 19 00];
+	qcom,lut-flags = <3>;
+	qcom,pause-lo = <0>;
+	qcom,pause-hi = <0>;
+	qcom,ramp-step-ms = <255>;
+	qcom,use-blink;
+};
+
+&pmx_mdss {
+	mdss_dsi_active: mdss_dsi_active {
+		mux {
+			pins = "gpio52", "gpio94";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio52", "gpio94";
+			drive-strength = <8>; /* 8 mA */
+			bias-disable = <0>; /* no pull */
+		};
+	};
+
+	mdss_dsi_suspend: mdss_dsi_suspend {
+		mux {
+			pins = "gpio52", "gpio94";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio52", "gpio94";
+			drive-strength = <2>; /* 2 mA */
+			bias-pull-down; /* pull down */
+		};
+	};
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_s6e3ha3_amoled_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,platform-enable-gpio = <&tlmm 52 0>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-avdd-en-gpio = <&pmi8998_gpios 1 0>;
+	qcom,platform-avdd-en-gpio-invert;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_s6e3ha3_amoled_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,platform-enable-gpio = <&tlmm 52 0>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-avdd-en-gpio = <&pmi8998_gpios 1 0>;
+	qcom,platform-avdd-en-gpio-invert;
+};
+
+&pmi8998_wled {
+	qcom,disp-type-amoled;
+};
+
+&labibb {
+	status = "ok";
+	qcom,qpnp-labibb-mode = "amoled";
+	qcom,swire-control;
+};
+
+&pmi8998_gpios {
+	/* GPIO 1 for AVDD power enable */
+	gpio@c000 {
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <0>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <0>;
+		qcom,invert = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&dsi_dual_s6e3ha3_amoled_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_dcs";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <255>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&wil6210 {
+	status = "ok";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-qrd.dts b/arch/arm64/boot/dts/qcom/msm8998-qrd.dts
new file mode 100644
index 000000000000..4d50d8611050
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-qrd.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8998.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-qrd.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 QRD";
+	compatible = "qcom,msm8998-qrd", "qcom,msm8998", "qcom,qrd";
+	qcom,board-id = <11 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-qrd.dtsi b/arch/arm64/boot/dts/qcom/msm8998-qrd.dtsi
new file mode 100644
index 000000000000..328fad732c15
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-qrd.dtsi
@@ -0,0 +1,636 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/irq.h>
+#include "msm8998-pinctrl.dtsi"
+#include "msm8998-camera-sensor-qrd.dtsi"
+/ {
+	bluetooth: bt_wcn3990 {
+		compatible = "qca,wcn3990";
+		qca,bt-vdd-io-supply = <&pm8998_s3>;
+		qca,bt-vdd-xtal-supply = <&pm8998_s5>;
+		qca,bt-vdd-core-supply = <&pm8998_l7_pin_ctrl>;
+		qca,bt-vdd-pa-supply = <&pm8998_l17_pin_ctrl>;
+		qca,bt-vdd-ldo-supply = <&pm8998_l25_pin_ctrl>;
+		qca,bt-chip-pwd-supply = <&pmi8998_bob_pin1>;
+
+		qca,bt-vdd-io-voltage-level = <1352000 1352000>;
+		qca,bt-vdd-xtal-voltage-level = <2040000 2040000>;
+		qca,bt-vdd-core-voltage-level = <1800000 1800000>;
+		qca,bt-vdd-pa-voltage-level = <1304000 1304000>;
+		qca,bt-vdd-ldo-voltage-level = <3312000 3312000>;
+		qca,bt-chip-pwd-voltage-level = <3600000 3600000>;
+
+		qca,bt-vdd-io-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-xtal-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-core-current-level = <0>; /* LPM/PFM */
+		qca,bt-vdd-pa-current-level = <0>; /* LPM/PFM */
+		qca,bt-vdd-ldo-current-level = <0>; /* LPM/PFM */
+	};
+};
+
+&blsp1_uart3_hs {
+	status = "ok";
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm8998_l1>;
+	vdda-pll-supply = <&pm8998_l2>;
+	vddp-ref-clk-supply = <&pm8998_l26>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14600>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm8998_l20>;
+	vccq-supply = <&pm8998_l26>;
+	vccq2-supply = <&pm8998_s4>;
+	vcc-max-microamp = <750000>;
+	vccq-max-microamp = <560000>;
+	vccq2-max-microamp = <750000>;
+	status = "ok";
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8998_l21>;
+	qcom,vdd-voltage-level = <2950000 2960000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8998_l13>;
+	qcom,vdd-io-voltage-level = <1808000 2960000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000
+				50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x1>;
+
+	status = "ok";
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&pm8998_gpios {
+	/* GPIO 6 for Vol+ Key */
+	gpio@c500 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 7 for Snapshot Key */
+	gpio@c600 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 8 for Focus Key */
+	gpio@c700 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	gpio@cc00 { /* GPIO 13 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <0>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <3>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	gpio@d200 { /* GPIO 19 - wil6210 refclk3_en */
+		qcom,mode = <0>;		/* Input */
+		qcom,pull = <5>;		/* No Pull */
+		qcom,vin-sel = <1>;		/* VIN1 GPIO_MV */
+		qcom,src-sel = <0>;		/* GPIO */
+		qcom,invert = <0>;		/* Invert */
+		qcom,master-en = <1>;		/* Enable GPIO */
+		status = "okay";
+	};
+
+	/* GPIO 21 (NFC_CLK_REQ) */
+	gpio@d400 {
+		qcom,mode = <0>;
+		qcom,vin-sel = <1>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	/* GPIO 18 SMB138X */
+	gpio@d100 {
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&pmi8998_gpios {
+	/* GPIO 6 for the internal QNOVO discharge FET control signal */
+	gpio@c500 {
+		status = "okay";
+		qcom,mode = <1>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <2>;
+		qcom,out-strength = <1>;
+		qcom,master-en = <1>;
+	};
+};
+
+&i2c_5 {
+	status = "okay";
+	synaptics@20 {
+		compatible = "synaptics,dsx";
+		reg = <0x20>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <125 0x2008>;
+		vdd-supply = <&pm8998_l6>;
+		avdd-supply = <&pm8998_l28>;
+		synaptics,vdd-voltage = <1808000 1808000>;
+		synaptics,avdd-voltage = <3008000 3008000>;
+		synaptics,vdd-current = <40000>;
+		synaptics,avdd-current = <20000>;
+		pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+		pinctrl-0 = <&ts_active>;
+		pinctrl-1 = <&ts_int_suspend &ts_reset_suspend>;
+		synaptics,display-coords = <0 0 1439 2559>;
+		synaptics,panel-coords = <0 0 1439 2559>;
+		synaptics,reset-gpio = <&tlmm 89 0x00>;
+		synaptics,irq-gpio = <&tlmm 125 0x2008>;
+		synaptics,disable-gpios;
+		synaptics,fw-name = "PR1702898-s3528t_60QHD_00400001.img";
+	};
+};
+
+&i2c_6 { /* BLSP1 QUP6 (NFC) */
+	status = "okay";
+	nq@28 {
+		compatible = "qcom,nq-nci";
+		reg = <0x28>;
+		qcom,nq-irq = <&tlmm 92 0x00>;
+		qcom,nq-ven = <&tlmm 12 0x00>;
+		qcom,nq-firm = <&tlmm 93 0x00>;
+		qcom,nq-clkreq = <&pm8998_gpios 21 0x00>;
+		qcom,nq-esepwr = <&tlmm 116 0x00>;
+		interrupt-parent = <&tlmm>;
+		qcom,clk-src = "BBCLK3";
+		interrupts = <92 0>;
+		interrupt-names = "nfc_irq";
+		pinctrl-names = "nfc_active", "nfc_suspend";
+		pinctrl-0 = <&nfc_int_active &nfc_enable_active>;
+		pinctrl-1 = <&nfc_int_suspend &nfc_enable_suspend>;
+		clocks = <&clock_gcc clk_ln_bb_clk3_pin>;
+		clock-names = "ref_clk";
+	};
+};
+
+&mdss_hdmi_tx {
+	pinctrl-names = "hdmi_hpd_active", "hdmi_ddc_active", "hdmi_cec_active",
+				"hdmi_active", "hdmi_sleep";
+	pinctrl-0 = <&mdss_hdmi_5v_active  &mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_suspend &mdss_hdmi_cec_suspend>;
+	pinctrl-1 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_active &mdss_hdmi_cec_suspend>;
+	pinctrl-2 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+			&mdss_hdmi_cec_active &mdss_hdmi_ddc_suspend>;
+	pinctrl-3 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_active &mdss_hdmi_cec_active>;
+	pinctrl-4 = <&mdss_hdmi_5v_suspend &mdss_hdmi_hpd_suspend
+			&mdss_hdmi_ddc_suspend &mdss_hdmi_cec_suspend>;
+};
+
+&mdss_dp_ctrl {
+	pinctrl-names = "mdss_dp_active", "mdss_dp_sleep";
+	pinctrl-0 = <&mdss_dp_aux_active &mdss_dp_usbplug_cc_active>;
+	pinctrl-1 = <&mdss_dp_aux_suspend &mdss_dp_usbplug_cc_suspend>;
+	qcom,aux-en-gpio = <&tlmm 77 0>;
+	qcom,aux-sel-gpio = <&tlmm 78 0>;
+	qcom,usbplug-cc-gpio = <&tlmm 38 0>;
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,panel-mode-gpio = <&tlmm 91 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,panel-mode-gpio = <&tlmm 91 0>;
+};
+
+&labibb {
+	status = "ok";
+	qcom,qpnp-labibb-mode = "lcd";
+};
+
+&pmi8998_wled {
+	qcom,led-strings-list = [01 02];
+};
+
+&red_led {
+	/delete-property/ linux,default-trigger;
+	qcom,start-idx = <0>;
+	qcom,idx-len = <10>;
+	qcom,duty-pcts = [00 19 32 4b 64
+			64 4b 32 19 00];
+	qcom,use-blink;
+};
+
+&green_led {
+	/delete-property/ linux,default-trigger;
+};
+
+&dsi_dual_nt35597_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_truly_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,mdss-dsi-panel-orientation = "180";
+};
+
+&dsi_dual_nt35597_truly_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,mdss-dsi-panel-orientation = "180";
+};
+
+&dsi_nt35597_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "single_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35597_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "single_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_4k_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,mdss-dsi-panel-orientation = "180";
+};
+
+&dsi_sharp_4k_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,mdss-dsi-panel-orientation = "180";
+};
+
+&dsi_dual_jdi_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,5v-boost-gpio = <&tlmm 51 0>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_jdi_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,5v-boost-gpio = <&tlmm 51 0>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_1080_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_jdi_1080p_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_no_labibb>;
+	qcom,5v-boost-gpio = <&tlmm 51 0>;
+};
+
+&pmi8998_haptics {
+	status = "okay";
+};
+
+&pm8998_vadc {
+	chan@83 {
+		label = "vph_pwr";
+		reg = <0x83>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@85 {
+		label = "vcoin";
+		reg = <0x85>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@4c {
+		label = "xo_therm";
+		reg = <0x4c>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@4d {
+		label = "msm_therm";
+		reg = <0x4d>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@51 {
+		label = "quiet_therm";
+		reg = <0x51>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8998_adc_tm {
+	chan@83 {
+		label = "vph_pwr";
+		reg = <0x83>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,btm-channel-number = <0x60>;
+	};
+
+	chan@4d {
+		label = "msm_therm";
+		reg = <0x4d>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@51 {
+		label = "quiet_therm";
+		reg = <0x51>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@4c {
+		label = "xo_therm";
+		reg = <0x4c>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+};
+
+&wil6210 {
+	status = "ok";
+};
+
+&soc {
+	sound-9335 {
+		qcom,wcn-btfm;
+	};
+
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+		status = "okay";
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8998_gpios 6 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_snapshot {
+			label = "cam_snapshot";
+			gpios = <&pm8998_gpios 7 0x1>;
+			linux,input-type = <1>;
+			linux,code = <766>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		cam_focus {
+			label = "cam_focus";
+			gpios = <&pm8998_gpios 8 0x1>;
+			linux,input-type = <1>;
+			linux,code = <528>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+};
+
+&vendor {
+	qrd_batterydata: qcom,battery-data {
+		qcom,batt-id-range-pct = <15>;
+		#include "fg-gen3-batterydata-itech-3000mah.dtsi"
+		#include "fg-gen3-batterydata-ascent-3450mah.dtsi"
+	};
+};
+
+&pmi8998_fg {
+	qcom,battery-data = <&qrd_batterydata>;
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_truly_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,panel-mode-gpio = <&tlmm 91 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_truly_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,panel-mode-gpio = <&tlmm 91 0>;
+};
+
+&dsi_sharp_4k_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_sharp_4k_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_truly_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_truly_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&soc {
+	sound-tavil {
+		qcom,msm-mbhc-hphl-swh = <1>;
+		/delete-property/ qcom,us-euro-gpios;
+	};
+
+	sound-9335 {
+		qcom,msm-mbhc-hphl-swh = <1>;
+		/delete-property/ qcom,us-euro-gpios;
+	};
+};
+
+&pmi8998_charger {
+	qcom,dc-is-wipower;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-regulator.dtsi b/arch/arm64/boot/dts/qcom/msm8998-regulator.dtsi
new file mode 100644
index 000000000000..bfd2a035d2a4
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-regulator.dtsi
@@ -0,0 +1,1145 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/clock/msm-clocks-8998.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+&rpm_bus {
+	/* PM8998 S1 + S6 = VDD_CX supply */
+	rpm-regulator-smpa1 {
+		status = "okay";
+		pm8998_s1_level: regulator-s1-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_s1_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-level;
+		};
+
+		pm8998_s1_floor_level: regulator-s1-floor-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_s1_floor_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-floor-level;
+			qcom,always-send-voltage;
+		};
+
+		pm8998_s1_level_ao: regulator-s1-level-ao {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_s1_level_ao";
+			qcom,set = <1>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-level;
+		};
+	};
+
+	rpm-regulator-smpa2 {
+		status = "okay";
+		pm8998_s2: regulator-s2 {
+			regulator-min-microvolt = <1128000>;
+			regulator-max-microvolt = <1128000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-smpa3 {
+		status = "okay";
+		pm8998_s3: regulator-s3 {
+			regulator-min-microvolt = <1352000>;
+			regulator-max-microvolt = <1352000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-smpa4 {
+		status = "okay";
+		pm8998_s4: regulator-s4 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-smpa5 {
+		status = "okay";
+		pm8998_s5: regulator-s5 {
+			regulator-min-microvolt = <1904000>;
+			regulator-max-microvolt = <2040000>;
+			qcom,init-pin-ctrl-mode = <8>;		/* PMIC_AWAKE */
+			qcom,send-defaults;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-smpa7 {
+		status = "okay";
+		pm8998_s7: regulator-s7 {
+			regulator-min-microvolt = <900000>;
+			regulator-max-microvolt = <1028000>;
+			qcom,init-pin-ctrl-mode = <8>;		/* PMIC_AWAKE */
+			qcom,send-defaults;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-smpa8 {
+		status = "okay";
+		pm8998_s8: regulator-s8 {
+			regulator-min-microvolt = <800000>;
+			regulator-max-microvolt = <800000>;
+			status = "okay";
+		};
+	};
+
+	/* PM8998 S9 = VDD_MX supply */
+	rpm-regulator-smpa9 {
+		status = "okay";
+		pm8998_s9_level: regulator-s9-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_s9_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-level;
+		};
+
+		pm8998_s9_floor_level: regulator-s9-floor-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_s9_floor_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-floor-level;
+			qcom,always-send-voltage;
+		};
+
+		pm8998_s9_level_ao: regulator-s9-level-ao {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_s9_level_ao";
+			qcom,set = <1>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-level;
+		};
+	};
+
+	rpm-regulator-ldoa1 {
+		status = "okay";
+		pm8998_l1: regulator-l1 {
+			regulator-min-microvolt = <880000>;
+			regulator-max-microvolt = <880000>;
+			proxy-supply = <&pm8998_l1>;
+			qcom,proxy-consumer-enable;
+			qcom,proxy-consumer-current = <73400>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa2 {
+		status = "okay";
+		pm8998_l2: regulator-l2 {
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			proxy-supply = <&pm8998_l2>;
+			qcom,proxy-consumer-enable;
+			qcom,proxy-consumer-current = <12560>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa3 {
+		status = "okay";
+		pm8998_l3: regulator-l3 {
+			regulator-min-microvolt = <1000000>;
+			regulator-max-microvolt = <1000000>;
+			status = "okay";
+		};
+	};
+
+	/* PM8998 L4 = VDD_SSC_MX supply */
+	rpm-regulator-ldoa4 {
+		status = "okay";
+		pm8998_l4_level: regulator-l4-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l4_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-level;
+		};
+
+		pm8998_l4_floor_level: regulator-l4-floor-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l4_floor_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-floor-level;
+			qcom,always-send-voltage;
+		};
+	};
+
+	rpm-regulator-ldoa5 {
+		status = "okay";
+		pm8998_l5: regulator-l5 {
+			regulator-min-microvolt = <800000>;
+			regulator-max-microvolt = <800000>;
+			/* Force NPM follows HW0_EN */
+			qcom,init-pin-ctrl-mode = <1>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa6 {
+		status = "okay";
+		pm8998_l6: regulator-l6 {
+			regulator-min-microvolt = <1808000>;
+			regulator-max-microvolt = <1808000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa7 {
+		status = "okay";
+		pm8998_l7: regulator-l7 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			status = "okay";
+		};
+
+		pm8998_l7_pin_ctrl: regulator-l7-pin-ctrl {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l7_pin_ctrl";
+			qcom,set = <3>;
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			/* Force NPM follows HW_EN2 */
+			qcom,init-pin-ctrl-mode = <4>;
+			/* Enable follows HW_EN2 */
+			qcom,enable-with-pin-ctrl = <0 4>;
+		};
+	};
+
+	rpm-regulator-ldoa8 {
+		status = "okay";
+		pm8998_l8: regulator-l8 {
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa9 {
+		status = "okay";
+		pm8998_l9: regulator-l9 {
+			regulator-min-microvolt = <1808000>;
+			regulator-max-microvolt = <2960000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa10 {
+		status = "okay";
+		pm8998_l10: regulator-l10 {
+			regulator-min-microvolt = <1808000>;
+			regulator-max-microvolt = <2960000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa11 {
+		status = "okay";
+		pm8998_l11: regulator-l11 {
+			regulator-min-microvolt = <1000000>;
+			regulator-max-microvolt = <1000000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa12 {
+		status = "okay";
+		pm8998_l12: regulator-l12 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa13 {
+		status = "okay";
+		pm8998_l13: regulator-l13 {
+			regulator-min-microvolt = <1808000>;
+			regulator-max-microvolt = <2960000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa14 {
+		status = "okay";
+		pm8998_l14: regulator-l14 {
+			regulator-min-microvolt = <1880000>;
+			regulator-max-microvolt = <1880000>;
+			proxy-supply = <&pm8998_l14>;
+			qcom,proxy-consumer-enable;
+			qcom,proxy-consumer-current = <32000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa15 {
+		status = "okay";
+		pm8998_l15: regulator-l15 {
+			regulator-min-microvolt = <1800000>;
+			regulator-max-microvolt = <1800000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa16 {
+		status = "okay";
+		pm8998_l16: regulator-l16 {
+			regulator-min-microvolt = <2704000>;
+			regulator-max-microvolt = <2704000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa17 {
+		status = "okay";
+		pm8998_l17: regulator-l17 {
+			regulator-min-microvolt = <1304000>;
+			regulator-max-microvolt = <1304000>;
+			status = "okay";
+		};
+
+		pm8998_l17_pin_ctrl: regulator-l17-pin-ctrl {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l17_pin_ctrl";
+			qcom,set = <3>;
+			regulator-min-microvolt = <1304000>;
+			regulator-max-microvolt = <1304000>;
+			/* Force NPM follows HW_EN2 */
+			qcom,init-pin-ctrl-mode = <4>;
+			/* Enable follows HW_EN2 */
+			qcom,enable-with-pin-ctrl = <0 4>;
+		};
+	};
+
+	rpm-regulator-ldoa18 {
+		status = "okay";
+		pm8998_l18: regulator-l18 {
+			regulator-min-microvolt = <2704000>;
+			regulator-max-microvolt = <2704000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa19 {
+		status = "okay";
+		pm8998_l19: regulator-l19 {
+			regulator-min-microvolt = <3008000>;
+			regulator-max-microvolt = <3008000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa20 {
+		status = "okay";
+		pm8998_l20: regulator-l20 {
+			regulator-min-microvolt = <2960000>;
+			regulator-max-microvolt = <2960000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa21 {
+		status = "okay";
+		pm8998_l21: regulator-l21 {
+			regulator-min-microvolt = <2960000>;
+			regulator-max-microvolt = <2960000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa22 {
+		status = "okay";
+		pm8998_l22: regulator-l22 {
+			regulator-min-microvolt = <2864000>;
+			regulator-max-microvolt = <2864000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa23 {
+		status = "okay";
+		pm8998_l23: regulator-l23 {
+			regulator-min-microvolt = <3312000>;
+			regulator-max-microvolt = <3312000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa24 {
+		status = "okay";
+		pm8998_l24: regulator-l24 {
+			regulator-min-microvolt = <1848000>;
+			regulator-max-microvolt = <3088000>;
+			parent-supply = <&pm8998_l12>;
+			status = "okay";
+		};
+	};
+	rpm-regulator-ldoa25 {
+		status = "okay";
+		pm8998_l25: regulator-l25 {
+			regulator-min-microvolt = <3104000>;
+			regulator-max-microvolt = <3312000>;
+			status = "okay";
+		};
+
+		pm8998_l25_pin_ctrl: regulator-l25-pin-ctrl {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l25_pin_ctrl";
+			qcom,set = <3>;
+			regulator-min-microvolt = <3104000>;
+			regulator-max-microvolt = <3312000>;
+			/* Force NPM follows HW_EN2 */
+			qcom,init-pin-ctrl-mode = <4>;
+			/* Enable follows HW_EN2 */
+			qcom,enable-with-pin-ctrl = <0 4>;
+		};
+	};
+
+	rpm-regulator-ldoa26 {
+		status = "okay";
+		pm8998_l26: regulator-l26 {
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			status = "okay";
+		};
+	};
+
+	/* PM8998 L27 = VDD_SSC_CX supply */
+	rpm-regulator-ldoa27 {
+		status = "okay";
+		pm8998_l27_level: regulator-l27-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l27_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-level;
+		};
+
+		pm8998_l27_floor_level: regulator-l27-floor-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_l27_floor_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-floor-level;
+			qcom,always-send-voltage;
+		};
+	};
+
+	rpm-regulator-ldoa28 {
+		status = "okay";
+		pm8998_l28: regulator-l28 {
+			regulator-min-microvolt = <3008000>;
+			regulator-max-microvolt = <3008000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-vsa1 {
+		status = "okay";
+		pm8998_lvs1: regulator-lvs1 {
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-vsa2 {
+		status = "okay";
+		pm8998_lvs2: regulator-lvs2 {
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-bobb {
+		status = "okay";
+		pmi8998_bob: regulator-bob {
+			regulator-min-microvolt = <3312000>;
+			regulator-max-microvolt = <3600000>;
+			qcom,pwm-threshold-current = <2000000>;
+			qcom,init-bob-mode = <2>;
+			status = "okay";
+		};
+		pmi8998_bob_pin1: regulator-bob-pin1 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_bob_pin1";
+			qcom,set = <3>;
+			regulator-min-microvolt = <3312000>;
+			regulator-max-microvolt = <3600000>;
+			qcom,pwm-threshold-current = <2000000>;
+			qcom,init-bob-mode = <2>;
+			qcom,use-pin-ctrl-voltage1;
+		};
+		pmi8998_bob_pin2: regulator-bob-pin2 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_bob_pin2";
+			qcom,set = <3>;
+			regulator-min-microvolt = <3312000>;
+			regulator-max-microvolt = <3600000>;
+			qcom,pwm-threshold-current = <2000000>;
+			qcom,init-bob-mode = <2>;
+			qcom,use-pin-ctrl-voltage2;
+		};
+		pmi8998_bob_pin3: regulator-bob-pin3 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm8998_bob_pin3";
+			qcom,set = <3>;
+			regulator-min-microvolt = <3312000>;
+			regulator-max-microvolt = <3600000>;
+			qcom,pwm-threshold-current = <2000000>;
+			qcom,init-bob-mode = <2>;
+			qcom,use-pin-ctrl-voltage3;
+		};
+	};
+};
+
+&spmi_bus {
+	qcom,pm8005@5 {
+		/* PM8005 S1 + S4 = 2 phase VDD_GFX supply */
+		pm8005_s1: regulator@1400 {
+			regulator-name = "pm8005_s1";
+			status = "okay";
+			regulator-min-microvolt = <524000>;
+			regulator-max-microvolt = <1100000>;
+			qcom,enable-time = <500>;
+		};
+	};
+
+	qcom,pm8998@1 {
+		pm8998_s10: regulator@2f00 {
+			compatible = "qcom,qpnp-regulator";
+			reg = <0x2f00 0x100>;
+			regulator-name = "pm8998_s10";
+			regulator-min-microvolt = <572000>;
+			regulator-max-microvolt = <1112000>;
+			qcom,enable-time = <500>;
+			regulator-always-on;
+		};
+
+		pm8998_s13: regulator@3800 {
+			compatible = "qcom,qpnp-regulator";
+			reg = <0x3800 0x100>;
+			regulator-name = "pm8998_s13";
+			regulator-min-microvolt = <572000>;
+			regulator-max-microvolt = <1112000>;
+			qcom,enable-time = <500>;
+			regulator-always-on;
+		};
+	};
+};
+
+/* Stub regulators */
+
+/ {
+	gfx_stub_vreg: regulator-gfx-stub {
+		compatible = "qcom,stub-regulator";
+		regulator-name = "gfx_stub_corner";
+		qcom,hpm-min-load = <100000>;
+		regulator-min-microvolt = <1>;
+		regulator-max-microvolt = <6>;
+		status = "disabled";
+	};
+};
+
+&soc {
+/* CPR controller regulators */
+	apc0_cpr: cprh-ctrl@179c8000 {
+		compatible = "qcom,cprh-msm8998-v1-kbss-regulator";
+		reg = <0x179c8000 0x4000>, <0x00784000 0x1000>;
+		reg-names = "cpr_ctrl", "fuse_base";
+		clocks = <&clock_gcc clk_gcc_hmss_rbcpr_clk>;
+		clock-names = "core_clk";
+		qcom,cpr-ctrl-name = "apc0";
+		qcom,cpr-controller-id = <0>;
+
+		qcom,cpr-sensor-time = <1000>;
+		qcom,cpr-loop-time = <5000000>;
+		qcom,cpr-idle-cycles = <15>;
+		qcom,cpr-up-down-delay-time = <3000>;
+		qcom,cpr-step-quot-init-min = <11>;
+		qcom,cpr-step-quot-init-max = <12>;
+		qcom,cpr-count-mode = <0>;		/* All at once */
+		qcom,cpr-count-repeat = <1>;
+		qcom,cpr-down-error-step-limit = <1>;
+		qcom,cpr-up-error-step-limit = <1>;
+		qcom,cpr-corner-switch-delay-time = <209>;
+		qcom,cpr-voltage-settling-time = <1760>;
+
+		qcom,apm-threshold-voltage = <832000>;
+		qcom,apm-crossover-voltage = <880000>;
+		qcom,apm-hysteresis-voltage = <32000>;
+		qcom,voltage-step = <4000>;
+		qcom,voltage-base = <352000>;
+		qcom,cpr-saw-use-unit-mV;
+
+		qcom,cpr-enable;
+		qcom,cpr-hw-closed-loop;
+
+		qcom,cpr-panic-reg-addr-list =
+			<0x179cbaa4 0x17912c18>;
+		qcom,cpr-panic-reg-name-list =
+			"PWR_CPRH_STATUS", "APCLUS0_L2_SAW4_PMIC_STS";
+
+		qcom,cpr-aging-ref-voltage = <1112000>;
+		vdd-supply = <&pm8998_s10>;
+
+		thread@0 {
+			qcom,cpr-thread-id = <0>;
+			qcom,cpr-consecutive-up = <0>;
+			qcom,cpr-consecutive-down = <2>;
+			qcom,cpr-up-threshold = <2>;
+			qcom,cpr-down-threshold = <2>;
+
+			apc0_pwrcl_vreg: regulator {
+				regulator-name = "apc0_pwrcl_corner";
+				regulator-min-microvolt = <1>;
+				regulator-max-microvolt = <23>;
+
+				qcom,cpr-fuse-corners = <4>;
+				qcom,cpr-fuse-combos = <8>;
+				qcom,cpr-corners = <22>;
+
+				qcom,cpr-corner-fmax-map = <7 10 17 22>;
+
+				qcom,cpr-voltage-ceiling =
+					<896000  896000  896000  896000  896000
+					 896000  896000  896000  896000  896000
+					 896000  896000  896000  896000  896000
+					 896000  896000 1032000 1032000 1032000
+					1112000 1112000>;
+
+				qcom,cpr-voltage-floor =
+					<896000  896000  896000  896000  896000
+					 896000  896000  896000  896000  896000
+					 896000  896000  896000  896000  896000
+					 896000  896000  896000  896000  896000
+					 896000  896000>,
+					<572000  572000  572000  572000  572000
+					 572000  572000  572000  572000  572000
+					 664000  664000  664000  664000  664000
+					 664000  664000  752000  752000  752000
+					 752000  752000>,
+					<572000  572000  572000  572000  572000
+					 572000  572000  572000  572000  572000
+					 664000  664000  664000  664000  664000
+					 664000  664000  752000  752000  752000
+					 752000  752000>,
+					<572000  572000  572000  572000  572000
+					 572000  572000  572000  572000  572000
+					 664000  664000  664000  664000  664000
+					 664000  664000  752000  752000  752000
+					 752000  752000>,
+					<572000  572000  572000  572000  572000
+					 572000  572000  572000  572000  572000
+					 664000  664000  664000  664000  664000
+					 664000  664000  752000  752000  752000
+					 752000  752000>,
+					<572000  572000  572000  572000  572000
+					 572000  572000  572000  572000  572000
+					 664000  664000  664000  664000  664000
+					 664000  664000  752000  752000  752000
+					 752000  752000>,
+					<572000  572000  572000  572000  572000
+					 572000  572000  572000  572000  572000
+					 664000  664000  664000  664000  664000
+					 664000  664000  752000  752000  752000
+					 752000  752000>,
+					<572000  572000  572000  572000  572000
+					 572000  572000  572000  572000  572000
+					 664000  664000  664000  664000  664000
+					 664000  664000  752000  752000  752000
+					 752000  752000>;
+
+				qcom,cpr-floor-to-ceiling-max-range =
+					<55000  55000  55000  55000
+					 55000  55000  55000  55000
+					 55000  55000  65000  65000
+					 65000  65000  65000  65000
+					 65000  65000  65000  65000
+					 65000  65000>;
+
+				qcom,corner-frequencies =
+					<300000000  345600000  422400000
+					 499200000  576000000  633600000
+					 710400000  806400000  883200000
+					 960000000 1036800000 1113600000
+					1190400000 1248000000 1324800000
+					1401600000 1478400000 1574400000
+					1651200000 1728000000 1804800000
+					1881600000>;
+
+				qcom,cpr-ro-scaling-factor =
+					<3430 3512 3262 3426 3100 3238 2463
+					 2725 1749 2891 4058 4014 3195 2866
+					    0    0>,
+					<3430 3512 3262 3426 3100 3238 2463
+					 2725 1749 2891 4058 4014 3195 2866
+					    0    0>,
+					<3162 3153 3163 3261 3037 3135 2645
+					 2857 1864 2417 3499 3706 3315 2771
+					    0    0>,
+					<2632 2539 2835 2857 2767 2813 2690
+					 2827 1857 1632 2596 3068 3212 2454
+					    0    0>;
+
+				qcom,cpr-open-loop-voltage-fuse-adjustment =
+					<0 0 0 0>,
+					<40000 24000 0 0>,
+					<40000 24000 0 0>,
+					<40000 24000 0 0>,
+					<40000 24000 0 0>,
+					<40000 24000 0 0>,
+					<40000 24000 0 0>,
+					<40000 24000 0 0>;
+
+				qcom,cpr-closed-loop-voltage-fuse-adjustment =
+					<0 0 0 0>,
+					<20000 26000 0 0>,
+					<20000 26000 0 0>,
+					<20000 26000 0 0>,
+					<20000 26000 0 0>,
+					<20000 26000 0 0>,
+					<20000 26000 0 0>,
+					<20000 26000 0 0>;
+
+				qcom,allow-voltage-interpolation;
+				qcom,allow-quotient-interpolation;
+				qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+
+				qcom,cpr-aging-max-voltage-adjustment = <15000>;
+				qcom,cpr-aging-ref-corner = <22>;
+				qcom,cpr-aging-ro-scaling-factor = <1620>;
+				qcom,allow-aging-voltage-adjustment = <0>;
+				qcom,allow-aging-open-loop-voltage-adjustment =
+					<1>;
+			};
+		};
+	};
+
+	apc1_cpr: cprh-ctrl@179c4000{
+		compatible = "qcom,cprh-msm8998-v1-kbss-regulator";
+		reg = <0x179c4000 0x4000>, <0x00784000 0x1000>;
+		reg-names = "cpr_ctrl", "fuse_base";
+		clocks = <&clock_gcc clk_gcc_hmss_rbcpr_clk>;
+		clock-names = "core_clk";
+		qcom,cpr-ctrl-name = "apc1";
+		qcom,cpr-controller-id = <1>;
+
+		qcom,cpr-sensor-time = <1000>;
+		qcom,cpr-loop-time = <5000000>;
+		qcom,cpr-idle-cycles = <15>;
+		qcom,cpr-up-down-delay-time = <3000>;
+		qcom,cpr-step-quot-init-min = <9>;
+		qcom,cpr-step-quot-init-max = <14>;
+		qcom,cpr-count-mode = <0>;		/* All at once */
+		qcom,cpr-count-repeat = <1>;
+		qcom,cpr-down-error-step-limit = <1>;
+		qcom,cpr-up-error-step-limit = <1>;
+		qcom,cpr-corner-switch-delay-time = <209>;
+		qcom,cpr-voltage-settling-time = <1760>;
+
+		qcom,apm-threshold-voltage = <832000>;
+		qcom,apm-crossover-voltage = <880000>;
+		qcom,apm-hysteresis-voltage = <32000>;
+		qcom,voltage-step = <4000>;
+		qcom,voltage-base = <352000>;
+		qcom,cpr-saw-use-unit-mV;
+
+		qcom,cpr-enable;
+		qcom,cpr-hw-closed-loop;
+
+		qcom,cpr-panic-reg-addr-list =
+			<0x179c7aa4 0x17812c18>;
+		qcom,cpr-panic-reg-name-list =
+			"PERF_CPRH_STATUS", "APCLUS1_L2_SAW4_PMIC_STS";
+
+		qcom,cpr-aging-ref-voltage = <1112000>;
+		vdd-supply = <&pm8998_s13>;
+
+		thread@0 {
+			qcom,cpr-thread-id = <0>;
+			qcom,cpr-consecutive-up = <0>;
+			qcom,cpr-consecutive-down = <2>;
+			qcom,cpr-up-threshold = <2>;
+			qcom,cpr-down-threshold = <2>;
+
+			apc1_perfcl_vreg: regulator {
+				regulator-name = "apc1_perfcl_corner";
+				regulator-min-microvolt = <1>;
+				regulator-max-microvolt = <26>;
+
+				qcom,cpr-fuse-corners = <4>;
+				qcom,cpr-fuse-combos = <8>;
+				qcom,cpr-corners = <25>;
+
+				qcom,cpr-corner-fmax-map = <8 12 18 25>;
+
+				qcom,cpr-voltage-ceiling =
+					<896000  896000  896000  896000
+					 896000  896000  896000  896000
+					 896000  896000  896000  896000
+					 896000  896000  896000  896000
+					 896000  896000 1032000 1032000
+					1032000 1032000 1112000 1112000
+					1112000>;
+
+				qcom,cpr-voltage-floor =
+					<896000  896000  896000  896000
+					 896000  896000  896000  896000
+					 896000  896000  896000  896000
+					 896000  896000  896000  896000
+					 896000  896000  896000  896000
+					 896000  896000  896000  896000
+					 896000>,
+					<572000  572000  572000  572000
+					 572000  572000  572000  572000
+					 572000  572000  572000  572000
+					 664000  664000  664000  664000
+					 664000  664000  752000  752000
+					 752000  752000  752000  752000
+					 752000>,
+					<572000  572000  572000  572000
+					 572000  572000  572000  572000
+					 572000  572000  572000  572000
+					 664000  664000  664000  664000
+					 664000  664000  752000  752000
+					 752000  752000  752000  752000
+					 752000>,
+					<572000  572000  572000  572000
+					 572000  572000  572000  572000
+					 572000  572000  572000  572000
+					 664000  664000  664000  664000
+					 664000  664000  752000  752000
+					 752000  752000  752000  752000
+					 752000>,
+					<572000  572000  572000  572000
+					 572000  572000  572000  572000
+					 572000  572000  572000  572000
+					 664000  664000  664000  664000
+					 664000  664000  752000  752000
+					 752000  752000  752000  752000
+					 752000>,
+					<572000  572000  572000  572000
+					 572000  572000  572000  572000
+					 572000  572000  572000  572000
+					 664000  664000  664000  664000
+					 664000  664000  752000  752000
+					 752000  752000  752000  752000
+					 752000>,
+					<572000  572000  572000  572000
+					 572000  572000  572000  572000
+					 572000  572000  572000  572000
+					 664000  664000  664000  664000
+					 664000  664000  752000  752000
+					 752000  752000  752000  752000
+					 752000>,
+					<572000  572000  572000  572000
+					 572000  572000  572000  572000
+					 572000  572000  572000  572000
+					 664000  664000  664000  664000
+					 664000  664000  752000  752000
+					 752000  752000  752000  752000
+					 752000>;
+
+				qcom,cpr-floor-to-ceiling-max-range =
+					<55000  55000  55000  55000
+					 55000  55000  55000  55000
+					 55000  55000  55000  55000
+					 65000  65000  65000  65000
+					 65000  65000  65000  65000
+					 65000  65000  65000  65000
+					 65000>;
+
+				qcom,corner-frequencies =
+					<300000000  345600000  422400000
+					 480000000  556800000  633600000
+					 710400000  787200000  844800000
+					 902400000  979200000 1056000000
+					1171200000 1248000000 1324800000
+					1401600000 1478400000 1536000000
+					1632000000 1708800000 1785600000
+					1862400000 1939200000 2016000000
+					2092800000>;
+
+				qcom,cpr-ro-scaling-factor =
+					<3430 3512 3262 3426 3100 3238 2463
+					 2725 1749 2891 4058 4014 3195 2866
+					    0    0>,
+					<3430 3512 3262 3426 3100 3238 2463
+					 2725 1749 2891 4058 4014 3195 2866
+					    0    0>,
+					<3162 3153 3163 3261 3037 3135 2645
+					 2857 1864 2417 3499 3706 3315 2771
+					    0    0>,
+					<2632 2539 2835 2857 2767 2813 2690
+					 2827 1857 1632 2596 3068 3212 2454
+					    0    0>;
+
+				qcom,cpr-open-loop-voltage-fuse-adjustment =
+					<0 0 0 0>,
+					<8000 0 0 52000>,
+					<8000 0 0 52000>,
+					<8000 0 0 52000>,
+					<8000 0 0 52000>,
+					<8000 0 0 52000>,
+					<8000 0 0 52000>,
+					<8000 0 0 52000>;
+
+				qcom,cpr-closed-loop-voltage-fuse-adjustment =
+					<0 0 0 0>,
+					<0 0 0 50000>,
+					<0 0 0 50000>,
+					<0 0 0 50000>,
+					<0 0 0 50000>,
+					<0 0 0 50000>,
+					<0 0 0 50000>,
+					<0 0 0 50000>;
+
+				qcom,allow-voltage-interpolation;
+				qcom,allow-quotient-interpolation;
+				qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+
+				qcom,cpr-aging-max-voltage-adjustment = <15000>;
+				qcom,cpr-aging-ref-corner = <25>;
+				qcom,cpr-aging-ro-scaling-factor = <1700>;
+				qcom,allow-aging-voltage-adjustment = <0>;
+				qcom,allow-aging-open-loop-voltage-adjustment =
+					<1>;
+			};
+		};
+	};
+
+	gfx_cpr: cpr4-ctrl@5061000 {
+		compatible = "qcom,cpr4-msm8998-v1-mmss-regulator";
+		reg =	<0x05061000 0x4000>,
+			<0x00784000 0x1000>,
+			<0x05065204 0x4>;
+		reg-names = "cpr_ctrl", "fuse_base", "aging_allowed";
+		clocks = <&clock_gpu clk_gpucc_rbcpr_clk>,
+			 <&clock_gcc clk_cnoc_clk>;
+		clock-names = "core_clk", "bus_clk";
+		interrupts = <GIC_SPI 285 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "cpr";
+		qcom,cpr-ctrl-name = "gfx";
+
+		qcom,cpr-sensor-time = <1000>;
+		qcom,cpr-loop-time = <5000000>;
+		qcom,cpr-idle-cycles = <15>;
+		qcom,cpr-step-quot-init-min = <8>;
+		qcom,cpr-step-quot-init-max = <12>;
+		qcom,cpr-count-mode = <0>;		/* All-at-once min */
+		qcom,cpr-count-repeat = <1>;
+
+		vdd-supply = <&pm8005_s1>;
+		qcom,voltage-step = <4000>;
+		mem-acc-supply = <&gfx_mem_acc_vreg>;
+		qcom,cpr-aging-ref-voltage = <1032000>;
+		qcom,cpr-aging-allowed-reg-mask  = <0x00000003>;
+		qcom,cpr-aging-allowed-reg-value = <0x00000003>;
+
+		qcom,cpr-enable;
+
+		thread@0 {
+			qcom,cpr-thread-id = <0>;
+			qcom,cpr-consecutive-up = <0>;
+			qcom,cpr-consecutive-down = <2>;
+			qcom,cpr-up-threshold = <0>;
+			qcom,cpr-down-threshold = <2>;
+
+			gfx_vreg: regulator {
+				regulator-name = "gfx_corner";
+				regulator-min-microvolt = <1>;
+				regulator-max-microvolt = <6>;
+
+				qcom,cpr-fuse-corners = <4>;
+				qcom,cpr-fuse-combos = <8>;
+				qcom,cpr-corners = <6>;
+
+				qcom,cpr-corner-fmax-map = <1 3 5 6>;
+
+				qcom,cpr-voltage-ceiling =
+					<896000  896000  896000  896000  896000
+					1032000>,
+					<672000  740000  800000  868000  976000
+					1100000>,
+					<672000  740000  800000  868000  976000
+					1100000>,
+					<672000  740000  800000  868000  976000
+					1100000>,
+					<672000  740000  800000  868000  976000
+					1100000>,
+					<672000  740000  800000  868000  976000
+					1100000>,
+					<672000  740000  800000  868000  976000
+					1100000>,
+					<672000  740000  800000  868000  976000
+					1100000>;
+
+				qcom,cpr-voltage-floor =
+					<896000  896000  896000  896000  896000
+					 896000>,
+					<528000  528000  568000  612000  664000
+					 752000>,
+					<528000  528000  568000  612000  664000
+					 752000>,
+					<528000  528000  568000  612000  664000
+					 752000>,
+					<528000  528000  568000  612000  664000
+					 752000>,
+					<528000  528000  568000  612000  664000
+					 752000>,
+					<528000  528000  568000  612000  664000
+					 752000>,
+					<528000  528000  568000  612000  664000
+					 752000>;
+
+				qcom,mem-acc-voltage = <1 1 1 2 2 2>;
+
+				qcom,corner-frequencies =
+					<171000000 251000000 332000000
+					 403000000 504000000 650000000>;
+
+				qcom,cpr-target-quotients =
+				      <   0    0  404  478  363  411  140  176
+					105    0    0    0    0    0    0    0>,
+				      <   0    0  574  651  532  584  266  319
+					196    0    0    0    0    0    0    0>,
+				      <   0    0  743  830  693  753  389  456
+					285    0    0    0    0    0    0    0>,
+				      <   0    0  879  977  829  893  495  570
+					365    0    0    0    0    0    0    0>,
+				      <   0    0 1168 1270 1097 1150    0    0
+					  0    0    0 1406  899  805    0    0>,
+				      <1669 1757    0    0    0    0    0    0
+					  0 1359 1902 1740    0 1033    0    0>;
+
+				qcom,cpr-ro-scaling-factor =
+				      <2389 2287 2985 3112 2873 2904 2159 2399
+				       1580 1602 2158 3042 2780 2069    0    0>,
+				      <2389 2287 2985 3112 2873 2904 2159 2399
+				       1580 1602 2158 3042 2780 2069    0    0>,
+				      <2389 2287 2985 3112 2873 2904 2159 2399
+				       1580 1602 2158 3042 2780 2069    0    0>,
+				      <2389 2287 2985 3112 2873 2904 2159 2399
+				       1580 1602 2158 3042 2780 2069    0    0>,
+				      <2389 2287 2985 3112 2873 2904 2159 2399
+				       1580 1602 2158 3042 2780 2069    0    0>,
+				      <2389 2287 2985 3112 2873 2904 2159 2399
+				       1580 1602 2158 3042 2780 2069    0    0>;
+
+				qcom,cpr-open-loop-voltage-fuse-adjustment =
+					<   72000        0        0        0>,
+					<   72000        0        0        0>,
+					<   72000        0        0        0>,
+					<   72000        0        0        0>,
+					<   72000        0        0        0>,
+					<   72000        0        0        0>,
+					<   72000        0        0        0>,
+					<   72000        0        0        0>;
+
+				qcom,cpr-closed-loop-voltage-adjustment =
+					<   65000    26000     8000        0
+						0        0>,
+					<   65000    26000     8000        0
+						0        0>,
+					<   65000    26000     8000        0
+						0        0>,
+					<   65000    26000     8000        0
+						0        0>,
+					<   65000    26000     8000        0
+						0        0>,
+					<   65000    26000     8000        0
+						0        0>,
+					<   65000    26000     8000        0
+						0        0>,
+					<   65000    26000     8000        0
+						0        0>;
+
+				qcom,cpr-floor-to-ceiling-max-range =
+				       <75000 75000 75000 75000 75000 75000>;
+
+			     qcom,cpr-fused-closed-loop-voltage-adjustment-map =
+					<0 0 1 2 3 4>;
+
+				qcom,allow-voltage-interpolation;
+				qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+
+				qcom,cpr-aging-max-voltage-adjustment = <15000>;
+				qcom,cpr-aging-ref-corner = <6>;
+				qcom,cpr-aging-ro-scaling-factor = <2950>;
+				qcom,allow-aging-voltage-adjustment = <0>;
+				qcom,allow-aging-open-loop-voltage-adjustment =
+					<1>;
+			};
+		};
+	};
+
+	gfx_mem_acc_vreg: regulator@1fcf004 {
+		compatible = "qcom,mem-acc-regulator";
+		reg = <0x01fcf004 0x4>;
+		reg-names = "acc-sel-l1";
+		regulator-name = "gfx_mem_acc_corner";
+		regulator-min-microvolt = <1>;
+		regulator-max-microvolt = <2>;
+
+		qcom,corner-acc-map = <0x1 0x0>;
+		qcom,acc-sel-l1-bit-pos = <0>;
+		qcom,acc-sel-l1-bit-size = <1>;
+	};
+};
+
+&pmi8998_charger {
+	smb2_vbus: qcom,smb2-vbus {
+		regulator-name = "smb2-vbus";
+	};
+
+	smb2_vconn: qcom,smb2-vconn {
+		regulator-name = "smb2-vconn";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-rumi.dts b/arch/arm64/boot/dts/qcom/msm8998-rumi.dts
new file mode 100644
index 000000000000..eaeb711efba6
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-rumi.dts
@@ -0,0 +1,108 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+/memreserve/ 0x90000000 0x00000100;
+
+#include "msm8998.dtsi"
+#include "msm8998-rumi.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 RUMI";
+	compatible = "qcom,msm8998-rumi", "qcom,msm8998", "qcom,rumi";
+	qcom,board-id = <15 0>;
+};
+
+&wdog {
+	status = "disabled";
+};
+
+&apc0_cpr {
+	qcom,cpr-initial-temp-band = <3>;
+	qcom,cpr-temp-point-map = <0 25 85>;
+};
+
+&apc0_pwrcl_vreg {
+	qcom,cpr-corner-bands = <4>;
+	qcom,corner-band-allow-core-count-adjustment = <1 1 1 1>;
+	qcom,corner-band-allow-temp-adjustment = <1 0 0 0>;
+	qcom,cpr-corner-band-map = <7 14 18 20>;
+	qcom,max-core-count = <4>;
+	qcom,cpr-corner-band1-temp-core-voltage-adjustment =
+		<(-24000) (-20000) (-20000) (-16000)>,
+		<(-16000) (-16000) (-12000) (-8000)>,
+		<(-8000)  (-8000)  (-4000)  (-4000)>,
+		<0     0     0     0>;
+	qcom,cpr-corner-band2-temp-core-voltage-adjustment =
+		<(-36000) 0 0 0>,
+		<(-32000) 0 0 0>,
+		<(-24000) 0 0 0>,
+		<    0 0 0 0>;
+	qcom,cpr-corner-band3-temp-core-voltage-adjustment =
+		<(-40000) 0 0 0>,
+		<(-36000) 0 0 0>,
+		<(-32000) 0 0 0>,
+		<    0 0 0 0>;
+	qcom,cpr-corner-band4-temp-core-voltage-adjustment =
+		<(-44000) 0 0 0>,
+		<(-32000) 0 0 0>,
+		<(-24000) 0 0 0>,
+		<    0 0 0 0>;
+};
+
+&apc1_cpr {
+	qcom,cpr-initial-temp-band = <3>;
+	qcom,cpr-temp-point-map = <0 25 85>;
+};
+
+&apc1_perfcl_vreg {
+	qcom,cpr-corner-bands = <4>;
+	qcom,corner-band-allow-core-count-adjustment = <1 1 1 1>;
+	qcom,corner-band-allow-temp-adjustment = <1 0 0 0>;
+	qcom,cpr-corner-band-map = <6 12 15 20>;
+	qcom,max-core-count = <4>;
+	qcom,cpr-corner-band1-temp-core-voltage-adjustment =
+		<(-24000) (-20000) (-20000) (-16000)>,
+		<(-16000) (-16000) (-12000) (-8000)>,
+		<(-8000)  (-8000)  (-4000)  (-4000)>,
+		<0     0     0     0>;
+	qcom,cpr-corner-band2-temp-core-voltage-adjustment =
+		<(-36000) 0 0 0>,
+		<(-32000) 0 0 0>,
+		<(-24000) 0 0 0>,
+		<    0 0 0 0>;
+	qcom,cpr-corner-band3-temp-core-voltage-adjustment =
+		<(-40000) 0 0 0>,
+		<(-36000) 0 0 0>,
+		<(-32000) 0 0 0>,
+		<    0 0 0 0>;
+	qcom,cpr-corner-band4-temp-core-voltage-adjustment =
+		<(-44000) 0 0 0>,
+		<(-32000) 0 0 0>,
+		<(-24000) 0 0 0>,
+		<    0 0 0 0>;
+};
+
+&rpm_bus {
+	rpm-standalone;
+};
+
+&soc {
+	qcom,rmnet-ipa {
+	status = "disabled";
+	};
+};
+
+&ipa_hw {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-rumi.dtsi b/arch/arm64/boot/dts/qcom/msm8998-rumi.dtsi
new file mode 100644
index 000000000000..d5fd190c938d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-rumi.dtsi
@@ -0,0 +1,287 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8998-pinctrl.dtsi"
+&uartblsp2dm1 {
+	status = "ok";
+};
+
+&ufsphy1 {
+	compatible = "qcom,ufs-phy-qrbtc-v2";
+	reg = <0x1da7000 0xda8>, /* PHY regs */
+		<0x1db8000 0x100>; /* U11 user regs */
+	reg-names = "phy_mem", "u11_user";
+	vdda-phy-supply = <&pm8998_l1>;
+	vdda-pll-supply = <&pm8998_l2>;
+	vddp-ref-clk-supply = <&pm8998_l26>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14600>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+	status = "ok";
+};
+
+&usb3 {
+	qcom,disable-dev-mode-pm;
+	dwc3@a800000 {
+		maximum-speed = "high-speed";
+	};
+};
+
+&pcie0 {
+	status = "disabled";
+};
+
+&qusb_phy0 {
+	reg = <0x0a928000 0x8000>,
+	    <0x0a8f8800 0x400>,
+	    <0x0a920000 0x100>;
+	reg-names = "qusb_phy_base",
+		"qscratch_base",
+		"emu_phy_base";
+	qcom,emulation;
+	qcom,emu-init-seq = <0x7f 0x4
+			0x0 0x4
+			0x3ff 0x28
+			0x1f 0x2c>;
+	qcom,qusb-phy-init-seq = <0x19 0x1404
+				0x20 0x1414
+				0x79 0x1410
+				0x00 0x1418
+				0x99 0x1404
+				0x04 0x1408
+				0xd9 0x1404>;
+	qcom,phy-pll-reset-seq = <0x80000000 0x7500
+				0x0 0x7500
+				0x201e0 0x7500
+				0x0 0x7500>;
+	qcom,emu-dcm-reset-seq = <0x100000 0x20
+				0x0 0x20
+				0x1e0 0x20
+				0x5 0x14>;
+};
+
+&ssphy {
+	compatible =  "usb-nop-xceiv";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm8998_l20>;
+	vccq-supply = <&pm8998_l26>;
+	vccq2-supply = <&pm8998_s4>;
+	vcc-max-microamp = <750000>;
+	vccq-max-microamp = <560000>;
+	vccq2-max-microamp = <750000>;
+
+	qcom,disable-lpm;
+	rpm-level = <0>;
+	spm-level = <0>;
+	status = "ok";
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8998_l21>;
+	qcom,vdd-voltage-level = <2950000 2960000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8998_l13>;
+	qcom,vdd-io-voltage-level = <1808000 2960000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000
+				50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x1>;
+
+	status = "ok";
+};
+
+&gfx_stub_vreg {
+	status = "okay";
+};
+
+&clock_gfx {
+	vdd_gpucc-supply = <&gfx_stub_vreg>;
+};
+
+&gdsc_gpu_gx {
+	parent-supply = <&gfx_stub_vreg>;
+};
+
+&clock_cpu {
+	qcom,cc-factor = <10>;
+	qcom,osm-clk-rate = <2000000>;
+	qcom,xo-clk-rate = <333333>;
+
+	qcom,pwrcl-speedbin0-v0 =
+		< 300000000  0x0004000f 0x031e001e 0x1>,
+		< 345600000  0x05040012 0x04200020 0x1>,
+		< 422400000  0x05040016 0x04200020 0x1>,
+		< 499200000  0x0504001a 0x05200020 0x1>,
+		< 576000000  0x0504001e 0x06200020 0x1>,
+		< 633600000  0x04040021 0x07200020 0x1>,
+		< 710400000  0x04040025 0x07200020 0x1>,
+		< 748800000  0x04030027 0x07200020 0x1>,
+		< 768000000  0x04020028 0x07200020 0x1>,
+		< 787200000  0x04010029 0x07200020 0x1>,
+		< 806400000  0x0404002a 0x08220022 0x2>,
+		< 883200000  0x0404002e 0x09250025 0x2>,
+		< 960000000  0x04040032 0x0a280028 0x2>,
+		< 1036800000 0x04040036 0x0b2b002b 0x3>,
+		< 1113600000 0x0404003a 0x0c2e002e 0x3>,
+		< 1190400000 0x0404003e 0x0c320032 0x3>,
+		< 1248000000 0x04040041 0x0d340034 0x3>,
+		< 1324800000 0x04040045 0x0e370037 0x3>,
+		< 1401600000 0x04040049 0x0f3a003a 0x3>,
+		< 1478400000 0x0404004d 0x103e003e 0x3>,
+		< 1574400000 0x04040052 0x10420042 0x4>,
+		< 1651200000 0x04040056 0x11450045 0x4>,
+		< 1728000000 0x0404005a 0x12480048 0x4>,
+		< 1804800000 0x0404005e 0x134b004b 0x4>,
+		< 1881600000 0x04040062 0x144e004e 0x4>;
+
+	qcom,perfcl-speedbin0-v0 =
+		< 300000000  0x0004000f 0x03200020 0x1>,
+		< 345600000  0x05040012 0x04200020 0x1>,
+		< 422400000  0x05040016 0x04200020 0x1>,
+		< 480000000  0x05040019 0x05200020 0x1>,
+		< 556800000  0x0504001d 0x06200020 0x1>,
+		< 633600000  0x04040021 0x07200020 0x1>,
+		< 652800000  0x04030022 0x07200020 0x1>,
+		< 672000000  0x04020023 0x07200020 0x1>,
+		< 691200000  0x04010024 0x07200020 0x1>,
+		< 710400000  0x04040025 0x07200020 0x1>,
+		< 787200000  0x04040029 0x08210021 0x1>,
+		< 844800000  0x0404002c 0x09240024 0x2>,
+		< 902400000  0x0404002f 0x09260026 0x2>,
+		< 979200000  0x04040033 0x0a290029 0x2>,
+		< 1056000000 0x04040037 0x0b2c002c 0x2>,
+		< 1171200000 0x0404003d 0x0c300030 0x3>,
+		< 1248000000 0x04040041 0x0d340034 0x3>,
+		< 1324800000 0x04040045 0x0e370037 0x3>,
+		< 1401600000 0x04040049 0x0f3b003b 0x3>,
+		< 1478400000 0x0404004d 0x0f3e003e 0x3>,
+		< 1536000000 0x04040050 0x10400040 0x3>,
+		< 1632000000 0x04040055 0x11440044 0x4>,
+		< 1708800000 0x04040059 0x12480048 0x4>,
+		< 1785600000 0x0404005d 0x134a004a 0x4>,
+		< 1862400000 0x04040061 0x134e004e 0x4>,
+		< 1939200000 0x04040065 0x14510051 0x4>,
+		< 2016000000 0x04040069 0x15540054 0x4>,
+		< 2092800000 0x0404006d 0x16570057 0x4>;
+};
+
+&soc {
+	qcom,icnss@18800000 {
+		compatible = "qcom,icnss";
+		reg = <0x18800000 0x800000>;
+		reg-names = "membase";
+		interrupts = <0 413 0 /* CE0 */ >,
+			     <0 414 0 /* CE1 */ >,
+			     <0 415 0 /* CE2 */ >,
+			     <0 416 0 /* CE3 */ >,
+			     <0 417 0 /* CE4 */ >,
+			     <0 418 0 /* CE5 */ >,
+			     <0 420 0 /* CE6 */ >,
+			     <0 421 0 /* CE7 */ >,
+			     <0 422 0 /* CE8 */ >,
+			     <0 423 0 /* CE9 */ >,
+			     <0 424 0 /* CE10 */ >,
+			     <0 425 0 /* CE11 */ >;
+		qcom,wlan-msa-memory = <0x100000>;
+	};
+
+	msm_cpufreq: qcom,msm-cpufreq {
+		compatible = "qcom,msm-cpufreq";
+		clock-names = "cpu0_clk", "cpu1_clk", "cpu2_clk",
+				"cpu3_clk", "cpu4_clk", "cpu5_clk",
+				"cpu6_clk", "cpu7_clk";
+		clocks = <&clock_cpu clk_pwrcl_clk>,
+			 <&clock_cpu clk_pwrcl_clk>,
+			 <&clock_cpu clk_pwrcl_clk>,
+			 <&clock_cpu clk_pwrcl_clk>,
+			 <&clock_cpu clk_perfcl_clk>,
+			 <&clock_cpu clk_perfcl_clk>,
+			 <&clock_cpu clk_perfcl_clk>,
+			 <&clock_cpu clk_perfcl_clk>;
+
+		qcom,governor-per-policy;
+
+		qcom,cpufreq-table-0 =
+			<  300000 >,
+			<  345600 >,
+			<  422400 >,
+			<  499200 >,
+			<  576000 >,
+			<  633600 >,
+			<  710400 >,
+			<  806400 >,
+			<  883200 >,
+			<  960000 >,
+			< 1036800 >,
+			< 1113600 >;
+
+		qcom,cpufreq-table-4 =
+			<  300000 >,
+			<  345600 >,
+			<  422400 >,
+			<  480000 >,
+			<  556800 >,
+			<  633600 >,
+			<  710400 >,
+			<  787200 >,
+			<  844800 >,
+			<  902400 >,
+			<  979200 >,
+			< 1056000 >,
+			< 1171200 >;
+	};
+
+	qcom,lmh {
+		status = "disabled";
+	};
+};
+
+&gdsc_ufs {
+	compatible = "regulator-fixed";
+};
+
+&spmi_bus {
+	qcom,pmi8998@3 {
+		flash_led: qcom,leds@d300 {
+			status = "disabled";
+		};
+	};
+};
+
+&pmi8998_charger {
+	qcom,suspend-input;
+};
+
+&tsens0 {
+	status = "disabled";
+};
+
+&tsens1 {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-sde-display.dtsi b/arch/arm64/boot/dts/qcom/msm8998-sde-display.dtsi
new file mode 100644
index 000000000000..6e19c77995c1
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-sde-display.dtsi
@@ -0,0 +1,75 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+
+	sde_wb: qcom,wb-display@0 {
+		compatible = "qcom,wb-display";
+		cell-index = <0>;
+		label = "wb_display";
+	};
+
+	msm_ext_disp: qcom,msm_ext_disp {
+		compatible = "qcom,msm-ext-disp";
+
+		ext_disp_audio_codec: qcom,msm-ext-disp-audio-codec-rx {
+			compatible = "qcom,msm-ext-disp-audio-codec-rx";
+			qcom,msm_ext_disp = <&msm_ext_disp>;
+		};
+	};
+
+	sde_hdmi: qcom,hdmi-display {
+		compatible = "qcom,hdmi-display";
+		label = "sde_hdmi";
+		qcom,display-type = "secondary";
+		qcom,msm_ext_disp = <&msm_ext_disp>;
+	};
+
+	sde_hdmi_cec: qcom,hdmi-cec@c9a0000 {
+		compatible = "qcom,hdmi-cec";
+		label = "sde_hdmi_cec";
+		qcom,hdmi-dev = <&sde_hdmi>;
+		interrupt-parent = <&sde_hdmi_tx>;
+		interrupts = <1 0>;
+
+		reg = <0xc9a0000 0x50c>;
+		reg-names = "hdmi_cec";
+
+		clocks = <&clock_mmss clk_mmss_mnoc_ahb_clk>,
+		       <&clock_mmss clk_mmss_mdss_ahb_clk>,
+		       <&clock_mmss clk_mmss_mdss_hdmi_clk>;
+		clock-names = "cec_mnoc_clk", "cec_iface_clk", "cec_core_clk";
+
+		pinctrl-names = "cec_active", "cec_sleep";
+		pinctrl-0 = <&mdss_hdmi_cec_active>;
+		pinctrl-1 = <&mdss_hdmi_cec_suspend>;
+
+		cec-gdsc-supply = <&gdsc_mdss>;
+		qcom,platform-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,platform-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "cec-gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+	};
+};
+
+&sde_kms {
+	connectors = <&sde_hdmi_tx &sde_hdmi &sde_wb>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-sde.dtsi b/arch/arm64/boot/dts/qcom/msm8998-sde.dtsi
new file mode 100644
index 000000000000..354ac830e0fa
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-sde.dtsi
@@ -0,0 +1,222 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	sde_kms: qcom,sde_kms@c900000 {
+		compatible = "qcom,sde-kms";
+		reg = <0x0c900000 0x90000>,
+		      <0x0c9b0000 0x1040>;
+		reg-names = "mdp_phys", "vbif_phys";
+
+		/* clock and supply entries */
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			 <&clock_mmss clk_mmss_mdss_ahb_clk>,
+			 <&clock_mmss clk_mmss_mdss_axi_clk>,
+			 <&clock_mmss clk_mdp_clk_src>,
+			 <&clock_mmss clk_mmss_mdss_mdp_clk>,
+			 <&clock_mmss clk_mmss_mdss_vsync_clk>,
+			 <&clock_mmss clk_mmss_mdss_mdp_lut_clk>;
+		clock-names = "mmss_noc_axi_clk",
+					"mmss_noc_ahb_clk",
+					"mmss_smmu_ahb_clk",
+					"mmss_smmu_axi_clk",
+			    "mnoc_clk", "iface_clk", "bus_clk",
+				"core_clk_src", "core_clk", "vsync_clk",
+				"lut_clk";
+		clock-rate = <0 0 0 0 0 0 0 330000000 0 0 0 0>;
+		clock-max-rate = <0 0 0 0 0 0 412500000 412500000 0 0 0 0>;
+		qcom,sde-max-bw-low-kbps = <6700000>;
+		qcom,sde-max-bw-high-kbps = <6700000>;
+
+		/* interrupt config */
+		interrupt-parent = <&intc>;
+		interrupts = <0 83 0>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		iommus = <&mmss_smmu 0>;
+
+		gpus = <&msm_gpu>;
+
+		/* hw blocks */
+		qcom,sde-off = <0x1000>;
+		qcom,sde-ctl-off = <0x2000 0x2200 0x2400
+				     0x2600 0x2800>;
+		qcom,sde-mixer-off = <0x45000 0x46000 0x47000
+				      0x48000 0x49000 0x4a000>;
+		qcom,sde-dspp-off = <0x55000 0x57000>;
+		qcom,sde-wb-off = <0x66000>;
+		qcom,sde-wb-id = <2>;
+		qcom,sde-wb-xin-id = <6>;
+		qcom,sde-wb-clk-ctrl = <0x2bc 0x10>;
+		qcom,sde-intf-off = <0x6b000 0x6b800
+					0x6c000 0x6c800>;
+		qcom,sde-intf-type = "dp", "dsi", "dsi", "hdmi";
+		qcom,sde-pp-off = <0x71000 0x71800
+					  0x72000 0x72800>;
+		qcom,sde-te2-off = <0x2000 0x2000 0x0 0x0>;
+		qcom,sde-cdm-off = <0x7a200>;
+		qcom,sde-dsc-off = <0x10000 0x10000 0x0 0x0>;
+		qcom,sde-intf-max-prefetch-lines = <0x15 0x15 0x15 0x15>;
+
+		qcom,sde-sspp-type =  "vig", "vig", "vig", "vig",
+						"dma", "dma", "dma", "dma",
+						"cursor", "cursor";
+
+		qcom,sde-sspp-off = <0x5000 0x7000 0x9000 0xb000
+						0x25000 0x27000 0x29000 0x2b000
+						0x35000 0x37000>;
+
+		qcom,sde-sspp-xin-id = <0 4 8 12 1 5 9 13 2 10>;
+
+		/* offsets are relative to "mdp_phys + qcom,sde-off */
+		qcom,sde-sspp-clk-ctrl = <0x2ac 0x8>, <0x2b4 0x8>,
+				  <0x2c4 0x8>, <0x2c4 0xc>, <0x3a8 0x10>,
+				  <0x3b0 0x10>;
+
+		qcom,sde-qseed-type = "qseedv3";
+		qcom,sde-mixer-linewidth = <2560>;
+		qcom,sde-sspp-linewidth = <2560>;
+		qcom,sde-mixer-blendstages = <0x7>;
+		qcom,sde-highest-bank-bit = <0x2>;
+		qcom,sde-panic-per-pipe;
+		qcom,sde-has-cdp;
+		qcom,sde-has-src-split;
+		qcom,sde-sspp-danger-lut = <0x000f 0xffff 0x0000>;
+		qcom,sde-sspp-safe-lut = <0xfffc 0xff00 0xffff>;
+
+		qcom,sde-vbif-off = <0>;
+		qcom,sde-vbif-id = <0>;
+		qcom,sde-vbif-default-ot-rd-limit = <32>;
+		qcom,sde-vbif-default-ot-wr-limit = <32>;
+		qcom,sde-vbif-dynamic-ot-rd-limit = <62208000 2>,
+			<124416000 4>, <248832000 16>;
+		qcom,sde-vbif-dynamic-ot-wr-limit = <62208000 2>,
+			<124416000 4>, <248832000 16>;
+
+		vdd-supply = <&gdsc_mdss>;
+		gdsc-mmagic-mdss-supply = <&gdsc_bimc_smmu>;
+		qcom,sde-csc-type = "csc-10bit";
+
+		qcom,sde-sspp-vig-blocks {
+			qcom,sde-vig-csc-off = <0x1a00>;
+			qcom,sde-vig-qseed-off = <0xa00>;
+		};
+
+		qcom,platform-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,platform-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc-mmagic-mdss";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+
+			qcom,platform-supply-entry@1 {
+				reg = <1>;
+				qcom,supply-name = "vdd";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+
+		smmu_kms_unsec: qcom,smmu_kms_unsec_cb {
+			compatible = "qcom,smmu_sde_unsec";
+			iommus = <&mmss_smmu 0>;
+		};
+
+		smmu_kms_sec: qcom,smmu_kms_sec_cb {
+			compatible = "qcom,smmu_sde_sec";
+			iommus = <&mmss_smmu 1>;
+		};
+
+		/* data and reg bus scale settings */
+		qcom,sde-data-bus {
+			qcom,msm-bus,name = "mdss_sde";
+			qcom,msm-bus,num-cases = <3>;
+			qcom,msm-bus,num-paths = <2>;
+			qcom,msm-bus,vectors-KBps =
+				<22 512 0 0>, <23 512 0 0>,
+				<22 512 0 6400000>, <23 512 0 6400000>,
+				<22 512 0 6400000>, <23 512 0 6400000>;
+		};
+		qcom,sde-reg-bus {
+			qcom,msm-bus,name = "mdss_reg";
+			qcom,msm-bus,num-cases = <4>;
+			qcom,msm-bus,num-paths = <1>;
+			qcom,msm-bus,active-only;
+			qcom,msm-bus,vectors-KBps =
+				<1 590 0 0>,
+				<1 590 0 76800>,
+				<1 590 0 160000>,
+				<1 590 0 320000>;
+		};
+	};
+
+	sde_hdmi_tx: qcom,hdmi_tx_8998@c9a0000 {
+		cell-index = <0>;
+		compatible = "qcom,hdmi-tx-8998";
+		reg =	<0xc9a0000 0x50c>,
+			<0x780000 0x621c>,
+			<0xc9e0000 0x28>;
+		reg-names = "core_physical", "qfprom_physical", "hdcp_physical";
+		interrupt-parent = <&sde_kms>;
+		interrupts = <8 0>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		qcom,hdmi-tx-ddc-clk-gpio = <&tlmm 32 0>;
+		qcom,hdmi-tx-ddc-data-gpio = <&tlmm 33 0>;
+		qcom,hdmi-tx-hpd-gpio = <&tlmm 34 0>;
+		qcom,hdmi-tx-hpd5v-gpio = <&tlmm 133 0>;
+		pinctrl-names = "default", "sleep";
+		pinctrl-0 = <&mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_active
+			&mdss_hdmi_5v_active>;
+		pinctrl-1 = <&mdss_hdmi_hpd_suspend
+			&mdss_hdmi_ddc_suspend
+			&mdss_hdmi_5v_suspend>;
+		hpd-gdsc-supply = <&gdsc_mdss>;
+		qcom,supply-names = "hpd-gdsc";
+		qcom,min-voltage-level = <0>;
+		qcom,max-voltage-level = <0>;
+		qcom,enable-load = <0>;
+		qcom,disable-load = <0>;
+
+		clocks = <&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			 <&clock_mmss clk_mmss_mdss_ahb_clk>,
+			 <&clock_mmss clk_mmss_mdss_hdmi_clk>,
+			 <&clock_mmss clk_mmss_mdss_mdp_clk>,
+			 <&clock_mmss clk_mmss_mdss_hdmi_dp_ahb_clk>,
+			 <&clock_mmss clk_mmss_mdss_extpclk_clk>,
+			 <&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			 <&clock_mmss clk_mmss_misc_ahb_clk>,
+			 <&clock_mmss clk_mmss_mdss_axi_clk>;
+		clock-names = "hpd_mnoc_clk", "hpd_iface_clk",
+				"hpd_core_clk", "hpd_mdp_core_clk",
+				"hpd_alt_iface_clk", "core_extp_clk",
+				"mnoc_clk","hpd_misc_ahb_clk",
+				"hpd_bus_clk";
+
+		/*qcom,mdss-fb-map = <&mdss_fb2>;*/
+		qcom,pluggable;
+	};
+};
+#include "msm8998-sde-display.dtsi"
diff --git a/arch/arm64/boot/dts/qcom/msm8998-sim.dts b/arch/arm64/boot/dts/qcom/msm8998-sim.dts
new file mode 100644
index 000000000000..c92050ab20d6
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-sim.dts
@@ -0,0 +1,42 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+/memreserve/ 0x90000000 0x00000100;
+
+#include "msm8998.dtsi"
+#include "msm8998-sim.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 SIM";
+	compatible = "qcom,msm8998-sim", "qcom,msm8998", "qcom,sim";
+	qcom,board-id = <16 0>;
+};
+
+&wdog {
+	status = "disabled";
+};
+
+&clock_cpu {
+	qcom,cc-factor = <1>;
+	qcom,osm-clk-rate = <19200000>;
+	qcom,xo-clk-rate = <19200000>;
+};
+
+&qusb_phy0 {
+	compatible =  "usb-nop-xceiv";
+};
+
+&ssphy {
+	compatible =  "usb-nop-xceiv";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-sim.dtsi b/arch/arm64/boot/dts/qcom/msm8998-sim.dtsi
new file mode 100644
index 000000000000..8a0f4b30121c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-sim.dtsi
@@ -0,0 +1,124 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8998-pinctrl.dtsi"
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm8998_l1>;
+	vdda-pll-supply = <&pm8998_l2>;
+	vddp-ref-clk-supply = <&pm8998_l26>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14600>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm8998_l20>;
+	vccq-supply = <&pm8998_l26>;
+	vccq2-supply = <&pm8998_s4>;
+	vcc-max-microamp = <750000>;
+	vccq-max-microamp = <560000>;
+	vccq2-max-microamp = <750000>;
+	status = "ok";
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&pcie0 {
+	status = "disabled";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8998_l21>;
+	qcom,vdd-voltage-level = <2950000 2960000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8998_l13>;
+	qcom,vdd-io-voltage-level = <1808000 2960000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000
+				50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x1>;
+
+	status = "ok";
+};
+
+&gfx_stub_vreg {
+	status = "okay";
+};
+
+&clock_gfx {
+	vdd_gpucc-supply = <&gfx_stub_vreg>;
+};
+
+&gdsc_gpu_gx {
+	parent-supply = <&gfx_stub_vreg>;
+};
+
+&soc {
+	sound_sim {
+		compatible = "qcom,msm8998-asoc-snd-stub";
+		qcom,model = "msm8998-stub-snd-card";
+
+		qcom,audio-routing =
+			"AIF4 VI", "MCLK",
+			"RX_BIAS", "MCLK";
+
+		qcom,tasha-mclk-clk-freq = <9600000>;
+		asoc-platform = <&pcm0>, <&routing>;
+		asoc-platform-names = "msm-pcm-dsp.0", "msm-pcm-routing";
+		asoc-cpu = <&sb_0_rx>, <&sb_0_tx>;
+		asoc-cpu-names = "msm-dai-q6-dev.16384", "msm-dai-q6-dev.16385";
+		asoc-codec = <&stub_codec>;
+		asoc-codec-names = "msm-stub-codec.1";
+		qcom,wsa-max-devs = <0>;
+	};
+};
+
+&wcd9xxx_intc {
+	status = "disabled";
+	compatible = "qcom,wcd9xxx-irq";
+	interrupt-controller;
+	#interrupt-cells = <1>;
+	interrupt-names = "cdc-int";
+};
+
+&pmi8998_charger {
+	qcom,suspend-input;
+};
+
+&tsens0 {
+	status = "disabled";
+};
+
+&tsens1 {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-smp2p.dtsi b/arch/arm64/boot/dts/qcom/msm8998-smp2p.dtsi
new file mode 100644
index 000000000000..2926a6889395
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-smp2p.dtsi
@@ -0,0 +1,267 @@
+/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+&soc {
+	qcom,smp2p-modem@17911008 {
+		compatible = "qcom,smp2p";
+		reg = <0x17911008 0x4>;
+		qcom,remote-pid = <1>;
+		qcom,irq-bitmask = <0x4000>;
+		interrupts = <0 451 1>;
+	};
+
+	qcom,smp2p-adsp@17911008 {
+		compatible = "qcom,smp2p";
+		reg = <0x17911008 0x4>;
+		qcom,remote-pid = <2>;
+		qcom,irq-bitmask = <0x400>;
+		interrupts = <0 158 1>;
+	};
+
+	qcom,smp2p-dsps@17911008 {
+		compatible = "qcom,smp2p";
+		reg = <0x17911008 0x4>;
+		qcom,remote-pid = <3>;
+		qcom,irq-bitmask = <0x4000000>;
+		interrupts = <0 178 1>;
+	};
+
+	smp2pgpio_smp2p_15_in: qcom,smp2pgpio-smp2p-15-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <15>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_15_in {
+		compatible = "qcom,smp2pgpio_test_smp2p_15_in";
+		gpios = <&smp2pgpio_smp2p_15_in 0 0>;
+	};
+
+	smp2pgpio_smp2p_15_out: qcom,smp2pgpio-smp2p-15-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <15>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_15_out {
+		compatible = "qcom,smp2pgpio_test_smp2p_15_out";
+		gpios = <&smp2pgpio_smp2p_15_out 0 0>;
+	};
+
+	smp2pgpio_smp2p_1_in: qcom,smp2pgpio-smp2p-1-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <1>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_1_in {
+		compatible = "qcom,smp2pgpio_test_smp2p_1_in";
+		gpios = <&smp2pgpio_smp2p_1_in 0 0>;
+	};
+
+	smp2pgpio_smp2p_1_out: qcom,smp2pgpio-smp2p-1-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <1>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_1_out {
+		compatible = "qcom,smp2pgpio_test_smp2p_1_out";
+		gpios = <&smp2pgpio_smp2p_1_out 0 0>;
+	};
+
+	smp2pgpio_smp2p_2_in: qcom,smp2pgpio-smp2p-2-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <2>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_2_in {
+		compatible = "qcom,smp2pgpio_test_smp2p_2_in";
+		gpios = <&smp2pgpio_smp2p_2_in 0 0>;
+	};
+
+	smp2pgpio_smp2p_2_out: qcom,smp2pgpio-smp2p-2-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <2>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_2_out {
+		compatible = "qcom,smp2pgpio_test_smp2p_2_out";
+		gpios = <&smp2pgpio_smp2p_2_out 0 0>;
+	};
+
+	smp2pgpio_smp2p_3_in: qcom,smp2pgpio-smp2p-3-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <3>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_3_in {
+		compatible = "qcom,smp2pgpio_test_smp2p_3_in";
+		gpios = <&smp2pgpio_smp2p_3_in 0 0>;
+	};
+
+	smp2pgpio_smp2p_3_out: qcom,smp2pgpio-smp2p-3-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <3>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - inbound entry from mss */
+	smp2pgpio_ssr_smp2p_1_in: qcom,smp2pgpio-ssr-smp2p-1-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "slave-kernel";
+		qcom,remote-pid = <1>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - outbound entry to mss */
+	smp2pgpio_ssr_smp2p_1_out: qcom,smp2pgpio-ssr-smp2p-1-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "master-kernel";
+		qcom,remote-pid = <1>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - inbound entry from lpass */
+	smp2pgpio_ssr_smp2p_2_in: qcom,smp2pgpio-ssr-smp2p-2-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "slave-kernel";
+		qcom,remote-pid = <2>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - outbound entry to lpass */
+	smp2pgpio_ssr_smp2p_2_out: qcom,smp2pgpio-ssr-smp2p-2-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "master-kernel";
+		qcom,remote-pid = <2>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - inbound entry from ssc */
+	smp2pgpio_ssr_smp2p_3_in: qcom,smp2pgpio-ssr-smp2p-3-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "slave-kernel";
+		qcom,remote-pid = <3>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - outbound entry to ssc */
+	smp2pgpio_ssr_smp2p_3_out: qcom,smp2pgpio-ssr-smp2p-3-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "master-kernel";
+		qcom,remote-pid = <3>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_3_out {
+		compatible = "qcom,smp2pgpio_test_smp2p_3_out";
+		gpios = <&smp2pgpio_smp2p_3_out 0 0>;
+	};
+
+	smp2pgpio_sleepstate_3_out: qcom,smp2pgpio-sleepstate-gpio-3-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "sleepstate";
+		qcom,remote-pid = <3>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio-sleepstate-3-out {
+		compatible = "qcom,smp2pgpio_sleepstate_3_out";
+		gpios = <&smp2pgpio_sleepstate_3_out 0 0>;
+	};
+
+	/* ipa - outbound entry to mss */
+	smp2pgpio_ipa_1_out: qcom,smp2pgpio-ipa-1-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "ipa";
+		qcom,remote-pid = <1>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ipa - inbound entry from mss */
+	smp2pgpio_ipa_1_in: qcom,smp2pgpio-ipa-1-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "ipa";
+		qcom,remote-pid = <1>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-svr20-pinctrl.dtsi b/arch/arm64/boot/dts/qcom/msm8998-svr20-pinctrl.dtsi
new file mode 100644
index 000000000000..1347fcef4251
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-svr20-pinctrl.dtsi
@@ -0,0 +1,3386 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	tlmm: pinctrl@03400000 {
+		compatible = "qcom,msm8998-pinctrl";
+		reg = <0x3400000 0xc00000>;
+		interrupts = <0 208 0>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+
+		uart_console_active: uart_console_active {
+			mux {
+				pins = "gpio4", "gpio5";
+				function = "blsp_uart8_a";
+			};
+
+			config {
+				pins = "gpio4", "gpio5";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		wcd9xxx_intr {
+			wcd_intr_default: wcd_intr_default{
+				mux {
+					pins = "gpio54";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio54";
+					drive-strength = <2>; /* 2 mA */
+					bias-pull-down; /* pull down */
+					input-enable;
+				};
+			};
+		};
+
+		/* I2C CONFIGURATION */
+		i2c_1 {
+			i2c_1_active: i2c_1_active {
+				mux {
+					pins = "gpio2", "gpio3";
+					function = "blsp_i2c1";
+				};
+
+				config {
+					pins = "gpio2", "gpio3";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_1_sleep: i2c_1_sleep {
+				mux {
+					pins = "gpio2", "gpio3";
+					function = "blsp_i2c1";
+				};
+
+				config {
+					pins = "gpio2", "gpio3";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_2 {
+			i2c_2_active: i2c_2_active {
+				mux {
+					pins = "gpio32", "gpio33";
+					function = "blsp_i2c2";
+				};
+
+				config {
+					pins = "gpio32", "gpio33";
+					drive-strength = <8>;
+					bias-disable;
+				};
+			};
+
+			i2c_2_sleep: i2c_2_sleep {
+				mux {
+					pins = "gpio32", "gpio33";
+					function = "blsp_i2c2";
+				};
+
+				config {
+					pins = "gpio32", "gpio33";
+					drive-strength = <8>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_3 {
+			i2c_3_active: i2c_3_active {
+				mux {
+					pins = "gpio47", "gpio48";
+					function = "blsp_i2c3";
+				};
+
+				config {
+					pins = "gpio47", "gpio48";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_3_sleep: i2c_3_sleep {
+				mux {
+					pins = "gpio47", "gpio48";
+					function = "blsp_i2c3";
+				};
+
+				config {
+					pins = "gpio47", "gpio48";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_4 {
+			i2c_4_active: i2c_4_active {
+				mux {
+					pins = "gpio10", "gpio11";
+					function = "blsp_i2c4";
+				};
+
+				config {
+					pins = "gpio10", "gpio11";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_4_sleep: i2c_4_sleep {
+				mux {
+					pins = "gpio10", "gpio11";
+					function = "blsp_i2c4";
+				};
+
+				config {
+					pins = "gpio10", "gpio11";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_5 {
+			i2c_5_active: i2c_5_active {
+				mux {
+					pins = "gpio87", "gpio88";
+					function = "blsp_i2c5";
+				};
+
+				config {
+					pins = "gpio87", "gpio88";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_5_sleep: i2c_5_sleep {
+				mux {
+					pins = "gpio87", "gpio88";
+					function = "blsp_i2c5";
+				};
+
+				config {
+					pins = "gpio87", "gpio88";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+		};
+
+		i2c_6 {
+			i2c_6_active: i2c_6_active {
+				mux {
+					pins = "gpio43", "gpio44";
+					function = "blsp_i2c6";
+				};
+
+				config {
+					pins = "gpio43", "gpio44";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_6_sleep: i2c_6_sleep {
+				mux {
+					pins = "gpio43", "gpio44";
+					function = "blsp_i2c6";
+				};
+
+				config {
+					pins = "gpio43", "gpio44";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		nfc {
+			nfc_int_active: nfc_int_active {
+				/* active state */
+				mux {
+					/* GPIO 92 NFC Read Interrupt */
+					pins = "gpio92";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio92";
+					drive-strength = <6>; /* 6 MA */
+					bias-pull-up;
+				};
+			};
+
+			nfc_int_suspend: nfc_int_suspend {
+				/* sleep state */
+				mux {
+					/* GPIO 92 NFC Read Interrupt */
+					pins = "gpio92";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio92";
+					drive-strength = <6>; /* 6 MA */
+					bias-pull-up;
+				};
+			};
+
+			nfc_enable_active: nfc_enable_active {
+				/* active state */
+				mux {
+					/* 12: NFC ENABLE 116:ESE Enable */
+					pins = "gpio12", "gpio116";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio12", "gpio116";
+					drive-strength = <6>; /* 6 MA */
+					bias-pull-up;
+				};
+			};
+
+			nfc_enable_suspend: nfc_enable_suspend {
+				/* sleep state */
+				mux {
+					/* 12: NFC ENABLE 116:ESE Enable */
+					pins = "gpio12", "gpio116";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio12", "gpio116";
+					drive-strength = <6>; /* 6 MA */
+					bias-disable;
+				};
+			};
+		};
+
+		i2c_7 {
+			i2c_7_active: i2c_7_active {
+				mux {
+					pins = "gpio55", "gpio56";
+					function = "blsp_i2c7";
+				};
+
+				config {
+					pins = "gpio55", "gpio56";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_7_sleep: i2c_7_sleep {
+				mux {
+					pins = "gpio55", "gpio56";
+					function = "blsp_i2c7";
+				};
+
+				config {
+					pins = "gpio55", "gpio56";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_8 {
+			i2c_8_active: i2c_8_active {
+				mux {
+					pins = "gpio6", "gpio7";
+					function = "blsp_i2c8";
+				};
+
+				config {
+					pins = "gpio6", "gpio7";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_8_sleep: i2c_8_sleep {
+				mux {
+					pins = "gpio6", "gpio7";
+					function = "blsp_i2c8";
+				};
+
+				config {
+					pins = "gpio6", "gpio7";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_9 {
+			i2c_9_active: i2c_9_active {
+				mux {
+					pins = "gpio51", "gpio52";
+					function = "blsp_i2c9";
+				};
+
+				config {
+					pins = "gpio51", "gpio52";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_9_sleep: i2c_9_sleep {
+				mux {
+					pins = "gpio51", "gpio52";
+					function = "blsp_i2c9";
+				};
+
+				config {
+					pins = "gpio51", "gpio52";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_10 {
+			i2c_10_active: i2c_10_active {
+				mux {
+					pins = "gpio67", "gpio68";
+					function = "blsp_i2c10";
+				};
+
+				config {
+					pins = "gpio67", "gpio68";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_10_sleep: i2c_10_sleep {
+				mux {
+					pins = "gpio67", "gpio68";
+					function = "blsp_i2c10";
+				};
+
+				config {
+					pins = "gpio67", "gpio68";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_11 {
+			i2c_11_active: i2c_11_active {
+				mux {
+					pins = "gpio60", "gpio61";
+					function = "blsp_i2c11";
+				};
+
+				config {
+					pins = "gpio60", "gpio61";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_11_sleep: i2c_11_sleep {
+				mux {
+					pins = "gpio60", "gpio61";
+					function = "blsp_i2c11";
+				};
+
+				config {
+					pins = "gpio60", "gpio61";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_12 {
+			i2c_12_active: i2c_12_active {
+				mux {
+					pins = "gpio83", "gpio84";
+					function = "blsp_i2c12";
+				};
+
+				config {
+					pins = "gpio83", "gpio84";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_12_sleep: i2c_12_sleep {
+				mux {
+					pins = "gpio83", "gpio84";
+					function = "blsp_i2c12";
+				};
+
+				config {
+					pins = "gpio83", "gpio84";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		/* SPI CONFIGURATION */
+
+		spi_1 {
+			spi_1_active: spi_1_active {
+				mux {
+					pins = "gpio0", "gpio1",
+							"gpio2", "gpio3";
+					function = "blsp_spi1";
+				};
+
+				config {
+					pins = "gpio0", "gpio1",
+							"gpio2", "gpio3";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_1_sleep: spi_1_sleep {
+				mux {
+					pins = "gpio0", "gpio1",
+							"gpio2", "gpio3";
+					function = "blsp_spi1";
+				};
+
+				config {
+					pins = "gpio0", "gpio1",
+							"gpio2", "gpio3";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_2 {
+			spi_2_active: spi_2_active {
+				mux {
+					pins = "gpio31", "gpio34",
+							"gpio32", "gpio33";
+					function = "blsp_spi2";
+				};
+
+				config {
+					pins = "gpio31", "gpio34",
+							"gpio32", "gpio33";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_2_sleep: spi_2_sleep {
+				mux {
+					pins = "gpio31", "gpio34",
+							"gpio32", "gpio33";
+					function = "blsp_spi2";
+				};
+
+				config {
+					pins = "gpio31", "gpio34",
+							"gpio32", "gpio33";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_3 {
+			spi_3_active: spi_3_active {
+				mux {
+					pins = "gpio45", "gpio46",
+							"gpio47", "gpio48";
+					function = "blsp_spi3";
+				};
+
+				config {
+					pins = "gpio45", "gpio46",
+							"gpio47", "gpio48";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_3_sleep: spi_3_sleep {
+				mux {
+					pins = "gpio45", "gpio46",
+							"gpio47", "gpio48";
+					function = "blsp_spi3";
+				};
+
+				config {
+					pins = "gpio45", "gpio46",
+							"gpio47", "gpio48";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		pcie0 {
+			pcie0_clkreq_default: pcie0_clkreq_default {
+				mux {
+					pins = "gpio36";
+					function = "pci_e0";
+				};
+
+				config {
+					pins = "gpio36";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+
+			pcie0_perst_default: pcie0_perst_default {
+				mux {
+					pins = "gpio35";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio35";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+
+			pcie0_wake_default: pcie0_wake_default {
+				mux {
+					pins = "gpio37";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio37";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+		};
+
+		hph_en0_ctrl {
+			hph_en0_idle: hph_en0_idle {
+				mux {
+					pins = "gpio67";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio67";
+					drive-strength = <2>;
+					bias-pull-down;
+					output-low;
+				};
+			};
+			hph_en0_active: hph_en0_active {
+				mux {
+					pins = "gpio67";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio67";
+					drive-strength = <2>;
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		hph_en1_ctrl {
+			hph_en1_idle: hph_en1_idle {
+				mux {
+					pins = "gpio68";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio68";
+					drive-strength = <2>;
+					bias-pull-down;
+					output-low;
+				};
+			};
+			hph_en1_active: hph_en1_active {
+				mux {
+					pins = "gpio68";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio68";
+					drive-strength = <2>;
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		wcd_gnd_mic_swap {
+			wcd_gnd_mic_swap_idle: wcd_gnd_mic_swap_idle {
+				mux {
+					pins = "gpio75";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio75";
+					drive-strength = <2>;
+					bias-pull-down;
+					output-low;
+				};
+			};
+			wcd_gnd_mic_swap_active: wcd_gnd_mic_swap_active {
+				mux {
+					pins = "gpio75";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio75";
+					drive-strength = <2>;
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		/* USB C analog configuration */
+		wcd_usbc_analog_en1 {
+			wcd_usbc_analog_en1_idle: wcd_usbc_ana_en1_idle {
+				mux {
+					pins = "gpio59";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio59";
+					drive-strength = <2>;
+					bias-pull-down;
+					output-low;
+				};
+			};
+
+			wcd_usbc_analog_en1_active: wcd_usbc_ana_en1_active {
+				mux {
+					pins = "gpio59";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio59";
+					drive-strength = <2>;
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		wcd_usbc_analog_en2n {
+			wcd_usbc_analog_en2n_idle: wcd_usbc_ana_en2n_idle {
+				mux {
+					pins = "gpio60";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio60";
+					drive-strength = <2>;
+					bias-disable;
+					output-high;
+				};
+			};
+
+			wcd_usbc_analog_en2n_active: wcd_usbc_ana_en2n_active {
+				mux {
+					pins = "gpio60";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio60";
+					drive-strength = <2>;
+					bias-pull-down;
+					output-low;
+				};
+			};
+		};
+
+		cdc_reset_ctrl {
+			cdc_reset_sleep: cdc_reset_sleep {
+				mux {
+					pins = "gpio116";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio116";
+					drive-strength = <16>;
+					bias-disable;
+					output-low;
+				};
+			};
+			cdc_reset_active:cdc_reset_active {
+				mux {
+					pins = "gpio116";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio116";
+					drive-strength = <16>;
+					bias-pull-down;
+					output-high;
+				};
+			};
+		};
+
+		spi_4 {
+			spi_4_active: spi_4_active {
+				mux {
+					pins = "gpio8", "gpio9",
+							"gpio10", "gpio11";
+					function = "blsp_spi4";
+				};
+
+				config {
+					pins = "gpio8", "gpio9",
+							"gpio10", "gpio11";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_4_sleep: spi_4_sleep {
+				mux {
+					pins = "gpio8", "gpio9",
+							"gpio10", "gpio11";
+					function = "blsp_spi4";
+				};
+
+				config {
+					pins = "gpio8", "gpio9",
+							"gpio10", "gpio11";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spkr_1_sd_n {
+			spkr_1_sd_n_sleep: spkr_1_sd_n_sleep {
+				mux {
+					pins = "gpio111";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio111";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;
+					input-enable;
+				};
+			};
+			spkr_1_sd_n_active: spkr_1_sd_n_active {
+				mux {
+					pins = "gpio111";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio111";
+					drive-strength = <16>;   /* 16 mA */
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		spi_5 {
+			spi_5_active: spi_5_active {
+				mux {
+					pins = "gpio85", "gpio86",
+							"gpio87", "gpio88";
+					function = "blsp_spi5";
+				};
+
+				config {
+					pins = "gpio85", "gpio86",
+							"gpio87", "gpio88";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_5_sleep: spi_5_sleep {
+				mux {
+					pins = "gpio85", "gpio86",
+							"gpio87", "gpio88";
+					function = "blsp_spi5";
+				};
+
+				config {
+					pins = "gpio85", "gpio86",
+							"gpio87", "gpio88";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spkr_2_sd_n {
+			spkr_2_sd_n_sleep: spkr_2_sd_n_sleep {
+				mux {
+					pins = "gpio112";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio112";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;
+					input-enable;
+				};
+			};
+			spkr_2_sd_n_active: spkr_2_sd_n_active {
+				mux {
+					pins = "gpio112";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio112";
+					drive-strength = <16>;   /* 16 mA */
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		cci0_active: cci0_active {
+			mux {
+				/* CLK, DATA */
+				pins = "gpio17","gpio18"; // Only 2
+				function = "cci_i2c";
+			};
+
+			config {
+				pins = "gpio17","gpio18";
+				bias-pull-up; /* PULL UP*/
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cci0_suspend: cci0_suspend {
+			mux {
+				/* CLK, DATA */
+				pins = "gpio17","gpio18";
+				function = "cci_i2c";
+			};
+
+			config {
+				pins = "gpio17","gpio18";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cci1_active: cci1_active {
+			mux {
+				/* CLK, DATA */
+				pins = "gpio19","gpio20";
+				function = "cci_i2c";
+			};
+
+			config {
+				pins = "gpio19","gpio20";
+				bias-pull-up; /* PULL UP*/
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cci1_suspend: cci1_suspend {
+			mux {
+				/* CLK, DATA */
+				pins = "gpio19","gpio20";
+				function = "cci_i2c";
+			};
+
+			config {
+				pins = "gpio19","gpio20";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_actuator_vaf_active: cam_actuator_vaf_active {
+			/* ACTUATOR POWER */
+			mux {
+				pins = "gpio27";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio27";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_actuator_vaf_suspend: cam_actuator_vaf_suspend {
+			/* ACTUATOR POWER */
+			mux {
+				pins = "gpio27";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio27";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk0_active: cam_sensor_mclk0_active {
+			/* MCLK0 */
+			mux {
+				/* CLK, DATA */
+				pins = "gpio13";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio13";
+				bias-disable; /* No PULL */
+				drive-strength = <8>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk0_suspend: cam_sensor_mclk0_suspend {
+			/* MCLK0 */
+			mux {
+				/* CLK, DATA */
+				pins = "gpio13";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio13";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <8>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_6dofl_active: cam_sensor_6dofl_active {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio148","gpio29";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio148","gpio29";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_6dofr_active: cam_sensor_6dofr_active {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio149","gpio29";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio149","gpio29";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_6dofl_suspend: cam_sensor_6dofl_suspend {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio148","gpio29";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio148","gpio29";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_6dofr_suspend: cam_sensor_6dofr_suspend {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio149","gpio29";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio149","gpio29";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_rear_active: cam_sensor_rear_active {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio30","gpio29";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio30","gpio29";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+		max_volt_active: max_volt_active {
+			/* RESET */
+			mux {
+				pins = "gpio128", "gpio129",
+					"gpio130", "gpio133";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio128", "gpio129",
+					"gpio130", "gpio133";
+				bias-disable; /* No PULL */
+				drive-strength = <8>; /* 2 MA */
+			};
+		};
+		max_volt_suspend: max_volt_suspend {
+			/* RESET */
+			mux {
+				pins = "gpio128", "gpio129",
+					"gpio130", "gpio133";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio128", "gpio129",
+					"gpio130", "gpio133";
+				bias-disable; /* No PULL */
+				drive-strength = <8>; /* 2 MA */
+			};
+		};
+		max_rst_active: max_rst_active {
+			/* RESET */
+			mux {
+				pins = "gpio30";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio30";
+				bias-disable; /* No PULL */
+				drive-strength = <8>; /* 2 MA */
+			};
+		};
+		max_rst_suspend: max_rst_suspend {
+			/* RESET */
+			mux {
+				pins = "gpio30";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio30";
+				bias-disable; /* No PULL */
+				drive-strength = <8>; /* 2 MA */
+			};
+		};
+
+		spi_6 {
+			spi_6_active: spi_6_active {
+				mux {
+					pins = "gpio41", "gpio42",
+							"gpio43", "gpio44";
+					function = "blsp_spi6";
+				};
+
+				config {
+					pins = "gpio41", "gpio42",
+							"gpio43", "gpio44";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_6_sleep: spi_6_sleep {
+				mux {
+					pins = "gpio41", "gpio42",
+							"gpio43", "gpio44";
+					function = "blsp_spi6";
+				};
+
+				config {
+					pins = "gpio41", "gpio42",
+							"gpio43", "gpio44";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_7 {
+			spi_7_active: spi_7_active {
+				mux {
+					pins = "gpio53", "gpio54",
+							"gpio55", "gpio56";
+					function = "blsp_spi7";
+				};
+
+				config {
+					pins = "gpio53", "gpio54",
+							"gpio55", "gpio56";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_7_sleep: spi_7_sleep {
+				mux {
+					pins = "gpio53", "gpio54",
+							"gpio55", "gpio56";
+					function = "blsp_spi7";
+				};
+
+				config {
+					pins = "gpio53", "gpio54",
+							"gpio55", "gpio56";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_8 {
+			spi_8_active: spi_8_active {
+				mux {
+					pins = "gpio4", "gpio5",
+							"gpio6", "gpio7";
+					function = "blsp_spi8";
+				};
+
+				config {
+					pins = "gpio4", "gpio5",
+							"gpio6", "gpio7";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_8_sleep: spi_8_sleep {
+				mux {
+					pins = "gpio4", "gpio5",
+							"gpio6", "gpio7";
+					function = "blsp_spi8";
+				};
+
+				config {
+					pins = "gpio4", "gpio5",
+							"gpio6", "gpio7";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_9 {
+			spi_9_active: spi_9_active {
+				mux {
+					pins = "gpio49", "gpio50",
+							"gpio51", "gpio52";
+					function = "blsp_spi9";
+				};
+
+				config {
+					pins = "gpio49", "gpio50",
+							"gpio51", "gpio52";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_9_sleep: spi_9_sleep {
+				mux {
+					pins = "gpio49", "gpio50",
+							"gpio51", "gpio52";
+					function = "blsp_spi9";
+				};
+
+				config {
+					pins = "gpio49", "gpio50",
+							"gpio51", "gpio52";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_10 {
+			spi_10_active: spi_10_active {
+				mux {
+					pins = "gpio65", "gpio66",
+							"gpio67", "gpio68";
+					function = "blsp_spi10";
+				};
+
+				config {
+					pins = "gpio65", "gpio66",
+							"gpio67", "gpio68";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_10_sleep: spi_10_sleep {
+				mux {
+					pins = "gpio65", "gpio66",
+							"gpio67", "gpio68";
+					function = "blsp_spi10";
+				};
+
+				config {
+					pins = "gpio65", "gpio66",
+							"gpio67", "gpio68";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_11 {
+			spi_11_active: spi_11_active {
+				mux {
+					pins = "gpio58", "gpio59",
+							"gpio60", "gpio61";
+					function = "blsp_spi11";
+				};
+
+				config {
+					pins = "gpio58", "gpio59",
+							"gpio60", "gpio61";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_11_sleep: spi_11_sleep {
+				mux {
+					pins = "gpio58", "gpio59",
+							"gpio60", "gpio61";
+					function = "blsp_spi11";
+				};
+
+				config {
+					pins = "gpio58", "gpio59",
+							"gpio60", "gpio61";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_12 {
+			spi_12_active: spi_12_active {
+				mux {
+					pins = "gpio81", "gpio82",
+							"gpio83", "gpio84";
+					function = "blsp_spi12";
+				};
+
+				config {
+					pins = "gpio81", "gpio82",
+							"gpio83", "gpio84";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_12_sleep: spi_12_sleep {
+				mux {
+					pins = "gpio81", "gpio82",
+							"gpio83", "gpio84";
+					function = "blsp_spi12";
+				};
+
+				config {
+					pins = "gpio81", "gpio82",
+							"gpio83", "gpio84";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		/* HS UART CONFIGURATION */
+		blsp1_uart1_active: blsp1_uart1_active {
+			mux {
+				pins = "gpio0", "gpio1", "gpio2", "gpio3";
+				function = "blsp_uart1_a";
+			};
+
+			config {
+				pins = "gpio0", "gpio1", "gpio2", "gpio3";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp1_uart1_sleep: blsp1_uart1_sleep {
+			mux {
+				pins = "gpio0", "gpio1", "gpio2", "gpio3";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio0", "gpio1", "gpio2", "gpio3";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		cam_sensor_rear_suspend: cam_sensor_rear_suspend {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio30","gpio29";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio30","gpio29";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk1_active: cam_sensor_mclk1_active {
+			/* MCLK1 */
+			mux {
+				/* CLK, DATA */
+				pins = "gpio14";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio14";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk1_suspend: cam_sensor_mclk1_suspend {
+			/* MCLK1 */
+			mux {
+				/* CLK, DATA */
+				pins = "gpio14";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio14";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_rear2_active: cam_sensor_rear2_active {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio9","gpio8";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio9","gpio8";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		blsp1_uart2_active: blsp1_uart2_active {
+			mux {
+				pins = "gpio31", "gpio34", "gpio33", "gpio32";
+				function = "blsp_uart2_a";
+			};
+
+			config {
+				pins = "gpio31", "gpio34", "gpio33", "gpio32";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp1_uart2_sleep: blsp1_uart2_sleep {
+			mux {
+				pins = "gpio31", "gpio34", "gpio33", "gpio32";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio31", "gpio34", "gpio33", "gpio32";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp1_uart3: blsp1_uart3 {
+			blsp1_uart3_tx_active: blsp1_uart3_tx_active {
+				mux {
+					pins = "gpio45";
+					function = "blsp_uart3_a";
+				};
+
+				config {
+					pins = "gpio45";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			blsp1_uart3_tx_sleep: blsp1_uart3_tx_sleep {
+				mux {
+					pins = "gpio45";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio45";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+
+			blsp1_uart3_rxcts_active: blsp1_uart3_rxcts_active {
+				mux {
+					pins = "gpio46", "gpio47";
+					function = "blsp_uart3_a";
+				};
+
+				config {
+					pins = "gpio46", "gpio47";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			blsp1_uart3_rxcts_sleep: blsp1_uart3_rxcts_sleep {
+				mux {
+					pins = "gpio46", "gpio47";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio46", "gpio47";
+					drive-strength = <2>;
+					bias-no-pull;
+				};
+			};
+
+			blsp1_uart3_rfr_active: blsp1_uart3_rfr_active {
+				mux {
+					pins = "gpio48";
+					function = "blsp_uart3_a";
+				};
+
+				config {
+					pins = "gpio48";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			blsp1_uart3_rfr_sleep: blsp1_uart3_rfr_sleep {
+				mux {
+					pins = "gpio48";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio48";
+					drive-strength = <2>;
+					bias-no-pull;
+				};
+			};
+		};
+
+		cam_sensor_rear2_suspend: cam_sensor_rear2_suspend {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio9","gpio8";
+				function = "gpio";
+			};
+			config {
+				pins = "gpio9","gpio8";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk2_active: cam_sensor_mclk2_active {
+			/* MCLK1 */
+			mux {
+				/* CLK, DATA */
+				pins = "gpio15";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio15";
+				bias-disable; /* No PULL */
+				drive-strength = <8>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk2_suspend: cam_sensor_mclk2_suspend {
+			/* MCLK1 */
+			mux {
+				/* CLK, DATA */
+				pins = "gpio15";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio15";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <8>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk3_active: cam_sensor_mclk3_active {
+			/* MCLK1 */
+			mux {
+				/* CLK, DATA */
+				pins = "gpio16";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio16";
+				bias-disable; /* No PULL */
+				drive-strength = <8>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk3_suspend: cam_sensor_mclk3_suspend {
+			/* MCLK1 */
+			mux {
+				/* CLK, DATA */
+				pins = "gpio16";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio16";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <8>; /* 2 MA */
+			};
+		};
+
+
+		cam_sensor_front_active: cam_sensor_front_active {
+			/* RESET  VANA*/
+			mux {
+				pins = "gpio28", "gpio29";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio28", "gpio29";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		blsp2_uart1_active: blsp2_uart1_active {
+			mux {
+				pins = "gpio53", "gpio54", "gpio55", "gpio56";
+				function = "blsp_uart7_a";
+			};
+
+			config {
+				pins = "gpio53", "gpio54", "gpio55", "gpio56";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp2_uart1_sleep: blsp2_uart1_sleep {
+			mux {
+				pins = "gpio53", "gpio54", "gpio55", "gpio56";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio53", "gpio54", "gpio55", "gpio56";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp2_uart2_active: blsp2_uart2_active {
+			mux {
+				pins = "gpio4", "gpio5", "gpio6", "gpio7";
+				function = "blsp_uart8_a";
+			};
+
+			config {
+				pins = "gpio4", "gpio5", "gpio6", "gpio7";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp2_uart2_sleep: blsp2_uart2_sleep {
+			mux {
+				pins = "gpio4", "gpio5", "gpio6", "gpio7";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio4", "gpio5", "gpio6", "gpio7";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		cam_sensor_front_suspend: cam_sensor_front_suspend {
+			/* RESET */
+			mux {
+				pins = "gpio28";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio28";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		pmx_mdss: pmx_mdss {
+			mdss_dsi_active: mdss_dsi_active {
+				mux {
+					pins = "gpio94", "gpio97", "gpio51";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio94", "gpio97", "gpio51";
+					drive-strength = <8>; /* 8 mA */
+					bias-disable = <0>; /* no pull */
+				};
+			};
+			mdss_dsi_suspend: mdss_dsi_suspend {
+				mux {
+					pins = "gpio94", "gpio97", "gpio51";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio94", "gpio97", "gpio51";
+					drive-strength = <2>; /* 2 mA */
+					bias-pull-down; /* pull down */
+				};
+			};
+		};
+
+		pmx_mdss_te {
+			mdss_te_active: mdss_te_active {
+				mux {
+					pins = "gpio97";
+					function = "mdp_vsync_b";
+				};
+				config {
+					pins = "gpio97";
+					drive-strength = <2>; /* 8 mA */
+					bias-pull-down; /* pull down*/
+				};
+			};
+
+			mdss_te_suspend: mdss_te_suspend {
+				mux {
+					pins = "gpio97";
+					function = "mdp_vsync_b";
+				};
+				config {
+					pins = "gpio97";
+					drive-strength = <2>; /* 2 mA */
+					bias-pull-down; /* pull down */
+				};
+			};
+		};
+
+		mdss_dp_aux_active: mdss_dp_aux_active {
+			mux {
+				pins = "gpio77", "gpio78";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio77", "gpio78";
+				bias-disable = <0>; /* no pull */
+				drive-strength = <8>;
+			};
+		};
+
+		mdss_dp_aux_suspend: mdss_dp_aux_suspend {
+			mux {
+				pins = "gpio77", "gpio78";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio77", "gpio78";
+				bias-pull-down;
+				drive-strength = <2>;
+			};
+		};
+
+		mdss_dp_usbplug_cc_active: mdss_dp_usbplug_cc_active {
+			mux {
+				pins = "gpio38";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio38";
+				bias-disable;
+				drive-strength = <16>;
+			};
+		};
+
+		mdss_dp_usbplug_cc_suspend: mdss_dp_usbplug_cc_suspend {
+			mux {
+				pins = "gpio38";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio38";
+				bias-pull-down;
+				drive-strength = <2>;
+			};
+		};
+
+		mdss_dp_hpd_active: mdss_dp_hpd_active {
+			mux {
+				pins = "gpio34";
+				function = "edp_hot";
+			};
+
+			config {
+				pins = "gpio34";
+				bias-pull-down;
+				drive-strength = <16>;
+			};
+		};
+
+		mdss_dp_hpd_suspend: mdss_dp_hpd_suspend {
+			mux {
+				pins = "gpio34";
+				function = "edp_hot";
+			};
+
+			config {
+				pins = "gpio34";
+				bias-pull-down;
+				drive-strength = <2>;
+			};
+		};
+
+		blsp2_uart3_active: blsp2_uart3_active {
+			mux {
+				pins = "gpio49", "gpio50", "gpio51", "gpio52";
+				function = "blsp_uart9_a";
+			};
+
+			config {
+				pins = "gpio49", "gpio50", "gpio51", "gpio52";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp2_uart3_sleep: blsp2_uart3_sleep {
+			mux {
+				pins = "gpio49", "gpio50", "gpio51", "gpio52";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio49", "gpio50", "gpio51", "gpio52";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		/* add pingrp for touchscreen */
+		pmx_ts_int_active {
+			ts_int_active: ts_int_active {
+				mux {
+					pins = "gpio125";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio125";
+					drive-strength = <8>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		pmx_ts_int_suspend {
+			ts_int_suspend1: ts_int_suspend1 {
+				mux {
+					pins = "gpio125";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio125";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+		};
+
+		pmx_ts_reset_active {
+			ts_reset_active: ts_reset_active {
+				mux {
+					pins = "gpio89";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio89";
+					drive-strength = <8>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		pmx_ts_reset_suspend {
+			ts_reset_suspend1: ts_reset_suspend1 {
+				mux {
+					pins = "gpio89";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio89";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+		};
+
+		pmx_ts_release {
+			ts_release: ts_release {
+				mux {
+					pins = "gpio125", "gpio89";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio125", "gpio89";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+		};
+
+		ts_mux {
+			ts_active: ts_active {
+				mux {
+					pins = "gpio89", "gpio125";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio89", "gpio125";
+					drive-strength = <16>;
+					bias-pull-up;
+				};
+			};
+
+			ts_reset_suspend: ts_reset_suspend {
+				mux {
+					pins = "gpio89";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio89";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+
+			ts_int_suspend: ts_int_suspend {
+				mux {
+					pins = "gpio125";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio125";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+		};
+
+		ufs_dev_reset_assert: ufs_dev_reset_assert {
+			config {
+				pins = "ufs_reset";
+				bias-pull-down;		/* default: pull down */
+				/*
+				 * UFS_RESET driver strengths are having
+				 * different values/steps compared to typical
+				 * GPIO drive strengths.
+				 *
+				 * Following table clarifies:
+				 *
+				 * HDRV value | UFS_RESET | Typical GPIO
+				 *   (dec)    |   (mA)    |    (mA)
+				 *     0      |   0.8     |    2
+				 *     1      |   1.55    |    4
+				 *     2      |   2.35    |    6
+				 *     3      |   3.1     |    8
+				 *     4      |   3.9     |    10
+				 *     5      |   4.65    |    12
+				 *     6      |   5.4     |    14
+				 *     7      |   6.15    |    16
+				 *
+				 * POR value for UFS_RESET HDRV is 3 which means
+				 * 3.1mA and we want to use that. Hence just
+				 * specify 8mA to "drive-strength" binding and
+				 * that should result into writing 3 to HDRV
+				 * field.
+				 */
+				drive-strength = <8>;	/* default: 3.1 mA */
+				output-low; /* active low reset */
+			};
+		};
+
+		ufs_dev_reset_deassert: ufs_dev_reset_deassert {
+			config {
+				pins = "ufs_reset";
+				bias-pull-down;		/* default: pull down */
+				/*
+				 * default: 3.1 mA
+				 * check comments under ufs_dev_reset_assert
+				 */
+				drive-strength = <8>;
+				output-high; /* active low reset */
+			};
+		};
+
+		sdc2_clk_on: sdc2_clk_on {
+			config {
+				pins = "sdc2_clk";
+				bias-disable;		/* NO pull */
+				drive-strength = <16>;	/* 16 MA */
+			};
+		};
+
+		sdc2_clk_off: sdc2_clk_off {
+			config {
+				pins = "sdc2_clk";
+				bias-disable;		/* NO pull */
+				drive-strength = <2>;	/* 2 MA */
+			};
+		};
+
+		sdc2_cmd_on: sdc2_cmd_on {
+			config {
+				pins = "sdc2_cmd";
+				bias-pull-up;		/* pull up */
+				drive-strength = <10>;	/* 10 MA */
+			};
+		};
+
+		sdc2_cmd_off: sdc2_cmd_off {
+			config {
+				pins = "sdc2_cmd";
+				bias-pull-up;		/* pull up */
+				drive-strength = <2>;	/* 2 MA */
+			};
+		};
+
+		sdc2_data_on: sdc2_data_on {
+			config {
+				pins = "sdc2_data";
+				bias-pull-up;		/* pull up */
+				drive-strength = <10>;	/* 10 MA */
+			};
+		};
+
+		sdc2_data_off: sdc2_data_off {
+			config {
+				pins = "sdc2_data";
+				bias-pull-up;		/* pull up */
+				drive-strength = <2>;	/* 2 MA */
+			};
+		};
+
+		sdc2_cd_on: sdc2_cd_on {
+			mux {
+				pins = "gpio95";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio95";
+				bias-pull-up;	   /* pull up */
+				drive-strength = <2>;   /* 2 MA */
+			};
+		};
+
+		sdc2_cd_off: sdc2_cd_off {
+			mux {
+				pins = "gpio95";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio95";
+				bias-pull-up;	   /* pull up */
+				drive-strength = <2>;   /* 2 MA */
+			};
+
+		};
+
+		led_enable: led_enable {
+			mux {
+				pins = "gpio21";
+				drive_strength = <16>;
+				output-high;
+			};
+		};
+
+		led_disable: led_disable {
+			mux {
+				pins = "gpio21";
+				drive_strength = <2>;
+				output-low;
+			};
+		};
+
+		trigout_a: trigout_a {
+			mux {
+				pins = "gpio58";
+				function = "qdss_cti1_a";
+			};
+
+			config {
+				pins = "gpio58";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		mdss_hdmi_5v_active: mdss_hdmi_5v_active {
+			mux {
+				pins = "gpio133";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio133";
+				bias-pull-up;
+				drive-strength = <16>;
+			};
+		};
+
+		mdss_hdmi_5v_suspend: mdss_hdmi_5v_suspend {
+			mux {
+				pins = "gpio133";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio133";
+				bias-pull-down;
+				drive-strength = <2>;
+			};
+		};
+
+
+		mdss_hdmi_hpd_active: mdss_hdmi_hpd_active {
+			mux {
+				pins = "gpio34";
+				function = "hdmi_hot";
+			};
+
+			config {
+				pins = "gpio34";
+				bias-pull-down;
+				drive-strength = <16>;
+			};
+		};
+
+		mdss_hdmi_hpd_suspend: mdss_hdmi_hpd_suspend {
+			mux {
+				pins = "gpio34";
+				function = "hdmi_hot";
+			};
+
+			config {
+				pins = "gpio34";
+				bias-pull-down;
+				drive-strength = <2>;
+			};
+		};
+
+		mdss_hdmi_ddc_active: mdss_hdmi_ddc_active {
+			mux {
+				pins = "gpio32", "gpio33";
+				function = "hdmi_ddc";
+			};
+
+			config {
+				pins = "gpio32", "gpio33";
+				drive-strength = <2>;
+				bias-pull-up;
+			};
+		};
+
+		mdss_hdmi_ddc_suspend: mdss_hdmi_ddc_suspend {
+			mux {
+				pins = "gpio32", "gpio33";
+				function = "hdmi_ddc";
+			};
+
+			config {
+				pins = "gpio32", "gpio33";
+				drive-strength = <2>;
+				bias-pull-up;
+			};
+		};
+
+		mdss_hdmi_cec_active: mdss_hdmi_cec_active {
+			mux {
+				pins = "gpio31";
+				function = "hdmi_cec";
+			};
+
+			config {
+				pins = "gpio31";
+				drive-strength = <2>;
+				bias-pull-up;
+			};
+		};
+
+		mdss_hdmi_cec_suspend: mdss_hdmi_cec_suspend {
+			mux {
+				pins = "gpio31";
+				function = "hdmi_cec";
+			};
+
+			config {
+				pins = "gpio31";
+				drive-strength = <2>;
+				bias-pull-up;
+			};
+		};
+
+		tsif0_signals_active: tsif0_signals_active {
+			tsif1_clk {
+				pins = "gpio89"; /* TSIF0 CLK */
+				function = "tsif1_clk";
+			};
+			tsif1_en {
+				pins = "gpio90"; /* TSIF0 Enable */
+				function = "tsif1_en";
+			};
+			tsif1_data {
+				pins = "gpio91"; /* TSIF0 DATA */
+				function = "tsif1_data";
+			};
+			signals_cfg {
+				pins = "gpio89", "gpio90", "gpio91";
+				drive_strength = <2>;	/* 2 mA */
+				bias-pull-down;		/* pull down */
+			};
+		};
+
+		/* sync signal is only used if configured to mode-2 */
+		tsif0_sync_active: tsif0_sync_active {
+			tsif1_sync {
+				pins = "gpio9";	/* TSIF0 SYNC */
+				function = "tsif1_sync";
+				drive_strength = <2>;	/* 2 mA */
+				bias-pull-down;		/* pull down */
+			};
+		};
+
+		tsif1_signals_active: tsif1_signals_active {
+			tsif2_clk {
+				pins = "gpio93"; /* TSIF1 CLK */
+				function = "tsif2_clk";
+			};
+			tsif2_en {
+				pins = "gpio94"; /* TSIF1 Enable */
+				function = "tsif2_en";
+			};
+			tsif2_data {
+				pins = "gpio95"; /* TSIF1 DATA */
+				function = "tsif2_data";
+			};
+			signals_cfg {
+				pins = "gpio93", "gpio94", "gpio95";
+				drive_strength = <2>;	/* 2 mA */
+				bias-pull-down;		/* pull down */
+			};
+		};
+
+		/* sync signal is only used if configured to mode-2 */
+		tsif1_sync_active: tsif1_sync_active {
+			tsif2_sync {
+				pins = "gpio96";	/* TSIF1 SYNC */
+				function = "tsif2_sync";
+				drive_strength = <2>;	/* 2 mA */
+				bias-pull-down;		/* pull down */
+			};
+		};
+
+		pri_aux_pcm_clk {
+			pri_aux_pcm_clk_sleep: pri_aux_pcm_clk_sleep {
+				mux {
+					pins = "gpio65";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio65";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			pri_aux_pcm_clk_active: pri_aux_pcm_clk_active {
+				mux {
+					pins = "gpio65";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio65";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		pri_aux_pcm_sync {
+			pri_aux_pcm_sync_sleep: pri_aux_pcm_sync_sleep {
+				mux {
+					pins = "gpio66";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio66";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			pri_aux_pcm_sync_active: pri_aux_pcm_sync_active {
+				mux {
+					pins = "gpio66";
+					function = "pri_mi2s_ws";
+				};
+
+				config {
+					pins = "gpio66";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		pri_aux_pcm_din {
+			pri_aux_pcm_din_sleep: pri_aux_pcm_din_sleep {
+				mux {
+					pins = "gpio67";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio67";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			pri_aux_pcm_din_active: pri_aux_pcm_din_active {
+				mux {
+					pins = "gpio67";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio67";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		pri_aux_pcm_dout {
+			pri_aux_pcm_dout_sleep: pri_aux_pcm_dout_sleep {
+				mux {
+					pins = "gpio68";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio68";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			pri_aux_pcm_dout_active: pri_aux_pcm_dout_active {
+				mux {
+					pins = "gpio68";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio68";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		sec_aux_pcm {
+			sec_aux_pcm_sleep: sec_aux_pcm_sleep {
+				mux {
+					pins = "gpio80", "gpio81";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio80", "gpio81";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			sec_aux_pcm_active: sec_aux_pcm_active {
+				mux {
+					pins = "gpio80", "gpio81";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio80", "gpio81";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		sec_aux_pcm_din {
+			sec_aux_pcm_din_sleep: sec_aux_pcm_din_sleep {
+				mux {
+					pins = "gpio82";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio82";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			sec_aux_pcm_din_active: sec_aux_pcm_din_active {
+				mux {
+					pins = "gpio82";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio82";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		sec_aux_pcm_dout {
+			sec_aux_pcm_dout_sleep: sec_aux_pcm_dout_sleep {
+				mux {
+					pins = "gpio83";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio83";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			sec_aux_pcm_dout_active: sec_aux_pcm_dout_active {
+				mux {
+					pins = "gpio83";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio83";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		tert_aux_pcm {
+			tert_aux_pcm_sleep: tert_aux_pcm_sleep {
+				mux {
+					pins = "gpio75", "gpio76";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio75", "gpio76";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			tert_aux_pcm_active: tert_aux_pcm_active {
+				mux {
+					pins = "gpio75", "gpio76";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio75", "gpio76";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		tert_aux_pcm_din {
+			tert_aux_pcm_din_sleep: tert_aux_pcm_din_sleep {
+				mux {
+					pins = "gpio77";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio77";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			tert_aux_pcm_din_active: tert_aux_pcm_din_active {
+				mux {
+					pins = "gpio77";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio77";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		tert_aux_pcm_dout {
+			tert_aux_pcm_dout_sleep: tert_aux_pcm_dout_sleep {
+				mux {
+					pins = "gpio78";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio78";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			tert_aux_pcm_dout_active: tert_aux_pcm_dout_active {
+				mux {
+					pins = "gpio78";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio78";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		quat_aux_pcm {
+			quat_aux_pcm_sleep: quat_aux_pcm_sleep {
+				mux {
+					pins = "gpio58", "gpio59";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio58", "gpio59";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			quat_aux_pcm_active: quat_aux_pcm_active {
+				mux {
+					pins = "gpio58", "gpio59";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio58", "gpio59";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		quat_aux_pcm_din {
+			quat_aux_pcm_din_sleep: quat_aux_pcm_din_sleep {
+				mux {
+					pins = "gpio60";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio60";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			quat_aux_pcm_din_active: quat_aux_pcm_din_active {
+				mux {
+					pins = "gpio60";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio60";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		quat_aux_pcm_dout {
+			quat_aux_pcm_dout_sleep: quat_aux_pcm_dout_sleep {
+				mux {
+					pins = "gpio61";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio61";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			quat_aux_pcm_dout_active: quat_aux_pcm_dout_active {
+				mux {
+					pins = "gpio61";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio61";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		pri_mi2s_mclk {
+			pri_mi2s_mclk_sleep: pri_mi2s_mclk_sleep {
+				mux {
+					pins = "gpio64";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio64";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			pri_mi2s_mclk_active: pri_mi2s_mclk_active {
+				mux {
+					pins = "gpio64";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio64";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		pri_mi2s_sck {
+			pri_mi2s_sck_sleep: pri_mi2s_sck_sleep {
+				mux {
+					pins = "gpio65";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio65";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			pri_mi2s_sck_active: pri_mi2s_sck_active {
+				mux {
+					pins = "gpio65";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio65";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		pri_mi2s_ws {
+			pri_mi2s_ws_sleep: pri_mi2s_ws_sleep {
+				mux {
+					pins = "gpio66";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio66";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			pri_mi2s_ws_active: pri_mi2s_ws_active {
+				mux {
+					pins = "gpio66";
+					function = "pri_mi2s_ws";
+				};
+
+				config {
+					pins = "gpio66";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		pri_mi2s_sd0 {
+			pri_mi2s_sd0_sleep: pri_mi2s_sd0_sleep {
+				mux {
+					pins = "gpio67";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio67";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			pri_mi2s_sd0_active: pri_mi2s_sd0_active {
+				mux {
+					pins = "gpio67";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio67";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		pri_mi2s_sd1 {
+			pri_mi2s_sd1_sleep: pri_mi2s_sd1_sleep {
+				mux {
+					pins = "gpio68";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio68";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			pri_mi2s_sd1_active: pri_mi2s_sd1_active {
+				mux {
+					pins = "gpio68";
+					function = "pri_mi2s";
+				};
+
+				config {
+					pins = "gpio68";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		sec_mi2s_mclk {
+			sec_mi2s_mclk_sleep: sec_mi2s_mclk_sleep {
+				mux {
+					pins = "gpio79";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio79";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			sec_mi2s_mclk_active: sec_mi2s_mclk_active {
+				mux {
+					pins = "gpio79";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio79";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		sec_mi2s {
+			sec_mi2s_sleep: sec_mi2s_sleep {
+				mux {
+					pins = "gpio80", "gpio81";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio80", "gpio81";
+					drive-strength = <2>;   /* 2 mA */
+					bias-disable;	 /* NO PULL */
+					input-enable;
+				};
+			};
+
+			sec_mi2s_active: sec_mi2s_active {
+				mux {
+					pins = "gpio80", "gpio81";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio80", "gpio81";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		sec_mi2s_sd0 {
+			sec_mi2s_sd0_sleep: sec_mi2s_sd0_sleep {
+				mux {
+					pins = "gpio82";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio82";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			sec_mi2s_sd0_active: sec_mi2s_sd0_active {
+				mux {
+					pins = "gpio82";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio82";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		sec_mi2s_sd1 {
+			sec_mi2s_sd1_sleep: sec_mi2s_sd1_sleep {
+				mux {
+					pins = "gpio83";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio83";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			sec_mi2s_sd1_active: sec_mi2s_sd1_active {
+				mux {
+					pins = "gpio83";
+					function = "sec_mi2s";
+				};
+
+				config {
+					pins = "gpio83";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		tert_mi2s_mclk {
+			tert_mi2s_mclk_sleep: tert_mi2s_mclk_sleep {
+				mux {
+					pins = "gpio74";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio74";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			tert_mi2s_mclk_active: tert_mi2s_mclk_active {
+				mux {
+					pins = "gpio74";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio74";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		tert_mi2s {
+			tert_mi2s_sleep: tert_mi2s_sleep {
+				mux {
+					pins = "gpio75", "gpio76";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio75", "gpio76";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			tert_mi2s_active: tert_mi2s_active {
+				mux {
+					pins = "gpio75", "gpio76";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio75", "gpio76";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		tert_mi2s_sd0 {
+			tert_mi2s_sd0_sleep: tert_mi2s_sd0_sleep {
+				mux {
+					pins = "gpio77";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio77";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			tert_mi2s_sd0_active: tert_mi2s_sd0_active {
+				mux {
+					pins = "gpio77";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio77";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		tert_mi2s_sd1 {
+			tert_mi2s_sd1_sleep: tert_mi2s_sd1_sleep {
+				mux {
+					pins = "gpio78";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio78";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			tert_mi2s_sd1_active: tert_mi2s_sd1_active {
+				mux {
+					pins = "gpio78";
+					function = "ter_mi2s";
+				};
+
+				config {
+					pins = "gpio78";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		quat_mi2s_mclk {
+			quat_mi2s_mclk_sleep: quat_mi2s_mclk_sleep {
+				mux {
+					pins = "gpio57";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio57";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			quat_mi2s_mclk_active: quat_mi2s_mclk_active {
+				mux {
+					pins = "gpio57";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio57";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		quat_mi2s {
+			quat_mi2s_sleep: quat_mi2s_sleep {
+				mux {
+					pins = "gpio58", "gpio59";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio58", "gpio59";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			quat_mi2s_active: quat_mi2s_active {
+				mux {
+					pins = "gpio58", "gpio59";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio58", "gpio59";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+					output-high;
+				};
+			};
+		};
+
+		quat_mi2s_sd0 {
+			quat_mi2s_sd0_sleep: quat_mi2s_sd0_sleep {
+				mux {
+					pins = "gpio60";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio60";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			quat_mi2s_sd0_active: quat_mi2s_sd0_active {
+				mux {
+					pins = "gpio60";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio60";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		quat_mi2s_sd1 {
+			quat_mi2s_sd1_sleep: quat_mi2s_sd1_sleep {
+				mux {
+					pins = "gpio61";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio61";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			quat_mi2s_sd1_active: quat_mi2s_sd1_active {
+				mux {
+					pins = "gpio61";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio61";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		quat_mi2s_sd2 {
+			quat_mi2s_sd2_sleep: quat_mi2s_sd2_sleep {
+				mux {
+					pins = "gpio62";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio62";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			quat_mi2s_sd2_active: quat_mi2s_sd2_active {
+				mux {
+					pins = "gpio62";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio62";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		quat_mi2s_sd3 {
+			quat_mi2s_sd3_sleep: quat_mi2s_sd3_sleep {
+				mux {
+					pins = "gpio63";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio63";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;	 /* PULL DOWN */
+					input-enable;
+				};
+			};
+
+			quat_mi2s_sd3_active: quat_mi2s_sd3_active {
+				mux {
+					pins = "gpio63";
+					function = "qua_mi2s";
+				};
+
+				config {
+					pins = "gpio63";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;	   /* NO PULL */
+				};
+			};
+		};
+
+		spkr_i2s_clk_pin {
+			spkr_i2s_clk_sleep: spkr_i2s_clk_sleep {
+				mux {
+					pins = "gpio69";
+					function = "spkr_i2s";
+				};
+
+				config {
+					pins = "gpio69";
+					drive-strength = <2>; /* 2 mA */
+					bias-pull-down;	/* PULL DOWN */
+				};
+			};
+
+			spkr_i2s_clk_active: spkr_i2s_clk_active {
+				mux {
+					pins = "gpio69";
+					function = "spkr_i2s";
+				};
+
+				config {
+					pins = "gpio69";
+					drive-strength = <8>; /* 8 mA */
+					bias-disable;	 /* NO PULL */
+				};
+			};
+		};
+
+		spkr_1_sd_mediabox {
+			spkr_1_sd_sleep_mediabox: spkr_1_sd_sleep_mediabox {
+				mux {
+					pins = "gpio85";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio85";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;
+					input-enable;
+				};
+			};
+			spkr_1_sd_active_mediabox: spkr_1_sd_active_mediabox {
+				mux {
+					pins = "gpio85";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio85";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		spkr_2_sd_mediabox_mediabox {
+			spkr_2_sd_sleep_mediabox: spkr_2_sd_sleep_mediabox {
+				mux {
+					pins = "gpio112";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio112";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;
+					input-enable;
+				};
+			};
+			spkr_2_sd_active_mediabox: spkr_2_sd_active_mediabox {
+				mux {
+					pins = "gpio112";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio112";
+					drive-strength = <8>;   /* 8 mA */
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		sdc2_cd_on_mediabox: sdc2_cd_on_mediabox {
+			mux {
+				pins = "gpio86";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio86";
+				bias-pull-up;	   /* pull up */
+				drive-strength = <2>;   /* 2 MA */
+			};
+		};
+
+		sdc2_cd_off_mediabox: sdc2_cd_off_mediabox {
+			mux {
+				pins = "gpio86";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio86";
+				bias-pull-up;	   /* pull up */
+				drive-strength = <2>;   /* 2 MA */
+			};
+		};
+
+		ir_active: ir_active {
+			mux {
+				pins = "gpio90", "gpio91";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio90", "gpio91";
+				drive-strength = <16>;
+				bias-disable;
+				output-high;
+			};
+		};
+
+		mtch6102_int {
+			mtch6102_int_active: mtch6102_int_active {
+				mux {
+					pins = "gpio125";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio125";
+					drive-strength = <16>; /* 16 mA */
+					bias-pull-up;
+				};
+			};
+
+			mtch6102_int_suspend: mtch6102_int_suspend {
+				mux {
+					pins = "gpio125";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio125";
+					drive-strength = <2>; /* 2 mA */
+					bias-pull-down;
+				};
+			};
+		};
+
+		mtch6102_rst {
+			mtch6102_rst_active: mtch6102_rst_active {
+				mux {
+					pins = "gpio85";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio85";
+					drive-strength = <8>; /* 8 mA */
+					bias-disable;	 /* NO PULL */
+					output-high;
+				};
+			};
+			mtch6102_rst_suspend: mtch6102_rst_suspend {
+				mux {
+					pins = "gpio85";
+					function = "gpio";
+				};
+
+				config {
+				      pins = "gpio85";
+				      drive-strength = <2>; /* 2 mA */
+				      bias-pull-down;
+				};
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-svr20.dtsi b/arch/arm64/boot/dts/qcom/msm8998-svr20.dtsi
new file mode 100644
index 000000000000..a1fce88c8e54
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-svr20.dtsi
@@ -0,0 +1,409 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/irq.h>
+#include "msm8998-svr20-pinctrl.dtsi"
+#include "msm8998-camera-sensor-svr20.dtsi"
+&vendor {
+	bluetooth: bt_wcn3990 {
+		compatible = "qca,wcn3990";
+		qca,bt-vdd-io-supply = <&pm8998_s3>;
+		qca,bt-vdd-xtal-supply = <&pm8998_s5>;
+		qca,bt-vdd-core-supply = <&pm8998_l7>;
+		qca,bt-vdd-pa-supply = <&pm8998_l17>;
+		qca,bt-vdd-ldo-supply = <&pm8998_l25>;
+		qca,bt-chip-pwd-supply = <&pmi8998_bob_pin1>;
+		clocks = <&clock_gcc clk_rf_clk2_pin>;
+		clock-names = "rf_clk2";
+
+		qca,bt-vdd-io-voltage-level = <1352000 1352000>;
+		qca,bt-vdd-xtal-voltage-level = <2040000 2040000>;
+		qca,bt-vdd-core-voltage-level = <1800000 1800000>;
+		qca,bt-vdd-pa-voltage-level = <1304000 1304000>;
+		qca,bt-vdd-ldo-voltage-level = <3312000 3312000>;
+		qca,bt-chip-pwd-voltage-level = <3600000 3600000>;
+
+		qca,bt-vdd-io-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-xtal-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-core-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-pa-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-ldo-current-level = <1>; /* LPM/PFM */
+	};
+	svr20_batterydata: qcom,battery-data {
+		qcom,batt-id-range-pct = <25>;
+		#include "fg-gen3-batterydata-svr-v2-3200mah.dtsi"
+	};
+};
+
+&blue_led {
+	qcom,default-state = "on";
+	linux,default-trigger = "system-running";
+};
+
+&pmi8998_charger {
+	qcom,fcc-max-ua = <5000000>;
+	qcom,usb-icl-ua = <3000000>;
+};
+
+&blsp1_uart3_hs {
+	status = "ok";
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm8998_l1>;
+	vdda-pll-supply = <&pm8998_l2>;
+	vddp-ref-clk-supply = <&pm8998_l26>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14600>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm8998_l20>;
+	vccq-supply = <&pm8998_l26>;
+	vccq2-supply = <&pm8998_s4>;
+	vcc-max-microamp = <750000>;
+	vccq-max-microamp = <560000>;
+	vccq2-max-microamp = <750000>;
+	status = "ok";
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm8998_l21>;
+	qcom,vdd-voltage-level = <2950000 2960000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm8998_l13>;
+	qcom,vdd-io-voltage-level = <1808000 2960000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000
+				50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x1>;
+
+	status = "ok";
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&pm8998_gpios {
+	/* GPIO 5 for Home Key */
+	gpio@c400 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 6 for Vol+ Key */
+	gpio@c500 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 7 for Snapshot Key */
+	gpio@c600 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 8 for Focus Key */
+	gpio@c700 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	gpio@cc00 { /* GPIO 13 */
+		qcom,mode = <1>;
+		qcom,output-type = <0>;
+		qcom,pull = <5>;
+		qcom,vin-sel = <0>;
+		qcom,out-strength = <1>;
+		qcom,src-sel = <3>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	/* GPIO 21 (NFC_CLK_REQ) */
+	gpio@d400 {
+		qcom,mode = <0>;
+		qcom,vin-sel = <1>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+
+	/* GPIO 18 SMB138X */
+	gpio@d100 {
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&i2c_5 {
+	status = "okay";
+};
+
+&i2c_6 { /* BLSP1 QUP6 (NFC) */
+	status = "okay";
+	nq@28 {
+		compatible = "qcom,nq-nci";
+		reg = <0x28>;
+		qcom,nq-irq = <&tlmm 92 0x00>;
+		qcom,nq-ven = <&tlmm 12 0x00>;
+		qcom,nq-firm = <&tlmm 93 0x00>;
+		qcom,nq-clkreq = <&pm8998_gpios 21 0x00>;
+		qcom,nq-esepwr = <&tlmm 116 0x00>;
+		interrupt-parent = <&tlmm>;
+		qcom,clk-src = "BBCLK3";
+		interrupts = <92 0>;
+		interrupt-names = "nfc_irq";
+		pinctrl-names = "nfc_active", "nfc_suspend";
+		pinctrl-0 = <&nfc_int_active &nfc_enable_active>;
+		pinctrl-1 = <&nfc_int_suspend &nfc_enable_suspend>;
+		clocks = <&clock_gcc clk_ln_bb_clk3_pin>;
+		clock-names = "ref_clk";
+	};
+};
+
+&mdss_hdmi_tx {
+	status = "disabled";
+	pinctrl-names = "hdmi_hpd_active", "hdmi_ddc_active", "hdmi_cec_active",
+				"hdmi_active", "hdmi_sleep";
+	pinctrl-0 = <&mdss_hdmi_5v_active  &mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_suspend &mdss_hdmi_cec_suspend>;
+	pinctrl-1 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_active &mdss_hdmi_cec_suspend>;
+	pinctrl-2 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+			&mdss_hdmi_cec_active &mdss_hdmi_ddc_suspend>;
+	pinctrl-3 = <&mdss_hdmi_5v_active &mdss_hdmi_hpd_active
+			&mdss_hdmi_ddc_active &mdss_hdmi_cec_active>;
+	pinctrl-4 = <&mdss_hdmi_5v_suspend &mdss_hdmi_hpd_suspend
+			&mdss_hdmi_ddc_suspend &mdss_hdmi_cec_suspend>;
+};
+
+&mdss_dp_ctrl {
+	status = "disabled";
+	pinctrl-names = "mdss_dp_active", "mdss_dp_sleep";
+	pinctrl-0 = <&mdss_dp_aux_active &mdss_dp_usbplug_cc_active>;
+	pinctrl-1 = <&mdss_dp_aux_suspend &mdss_dp_usbplug_cc_suspend>;
+	qcom,aux-en-gpio = <&tlmm 77 0>;
+	qcom,aux-sel-gpio = <&tlmm 78 0>;
+	qcom,usbplug-cc-gpio = <&tlmm 38 0>;
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+};
+
+&mem_client_3_size {
+	qcom,peripheral-size = <0x500000>;
+};
+
+&pmi8998_haptics {
+	status = "okay";
+};
+
+&pm8998_vadc {
+	chan@83 {
+		label = "vph_pwr";
+		reg = <0x83>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@85 {
+		label = "vcoin";
+		reg = <0x85>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@4c {
+		label = "xo_therm";
+		reg = <0x4c>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@4d {
+		label = "msm_therm";
+		reg = <0x4d>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+
+	chan@51 {
+		label = "quiet_therm";
+		reg = <0x51>;
+		qcom,decimation = <2>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,fast-avg-setup = <0>;
+	};
+};
+
+&pm8998_adc_tm {
+	chan@83 {
+		label = "vph_pwr";
+		reg = <0x83>;
+		qcom,pre-div-channel-scaling = <1>;
+		qcom,calibration-type = "absolute";
+		qcom,scale-function = <0>;
+		qcom,hw-settle-time = <0>;
+		qcom,btm-channel-number = <0x60>;
+	};
+
+	chan@4d {
+		label = "msm_therm";
+		reg = <0x4d>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x68>;
+		qcom,thermal-node;
+	};
+
+	chan@51 {
+		label = "quiet_therm";
+		reg = <0x51>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <2>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x70>;
+		qcom,thermal-node;
+	};
+
+	chan@4c {
+		label = "xo_therm";
+		reg = <0x4c>;
+		qcom,pre-div-channel-scaling = <0>;
+		qcom,calibration-type = "ratiometric";
+		qcom,scale-function = <4>;
+		qcom,hw-settle-time = <2>;
+		qcom,btm-channel-number = <0x78>;
+		qcom,thermal-node;
+	};
+};
+
+&wil6210 {
+	status = "ok";
+};
+
+&soc {
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+		status = "okay";
+
+		home {
+		       label = "home";
+		       gpios = <&pm8998_gpios 5 0x1>;
+		       linux,input-type = <1>;
+		       linux,code = <158>;
+		       gpio-key,wakeup;
+		       debounce-interval = <15>;
+	       };
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm8998_gpios 6 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		vol_down {
+			label = "volume_down";
+			gpios = <&pm8998_gpios 7 0x1>;
+			linux,input-type = <1>;
+			linux,code = <114>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		confirm {
+			label = "confirm_key";
+			gpios = <&pm8998_gpios 8 0x1>;
+			linux,input-type = <1>;
+			linux,code = <28>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+};
+
+&pmi8998_fg {
+	qcom,battery-data = <&svr20_batterydata>;
+	qcom,fg-force-load-profile;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2-camera.dtsi b/arch/arm64/boot/dts/qcom/msm8998-v2-camera.dtsi
new file mode 100644
index 000000000000..93da11e66799
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2-camera.dtsi
@@ -0,0 +1,192 @@
+/*
+ * Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	qcom,csiphy@ca34000 {
+		cell-index = <0>;
+		compatible = "qcom,csiphy-v5.01", "qcom,csiphy";
+		reg = <0xca34000 0x1000>;
+		reg-names = "csiphy";
+		interrupts = <0 78 0>;
+		interrupt-names = "csiphy";
+		gdscr-supply = <&gdsc_camss_top>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "gdscr", "bimc_smmu";
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_csi0_clk_src>,
+			<&clock_mmss clk_mmss_camss_csi0_clk>,
+			<&clock_mmss clk_mmss_camss_cphy_csid0_clk>,
+			<&clock_mmss clk_csi0phytimer_clk_src>,
+			<&clock_mmss clk_mmss_camss_csi0phytimer_clk>,
+			<&clock_mmss clk_mmss_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csiphy_clk_src>,
+			<&clock_mmss clk_mmss_camss_csiphy0_clk>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"csi_src_clk", "csi_clk", "cphy_csid_clk",
+			"csiphy_timer_src_clk", "csiphy_timer_clk",
+			"camss_ispif_ahb_clk", "csiphy_clk_src", "csiphy_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 274290000 0 0 200000000 0
+			0 274290000 0>;
+		status = "ok";
+	};
+
+	qcom,csiphy@ca35000 {
+		cell-index = <1>;
+		compatible = "qcom,csiphy-v5.01", "qcom,csiphy";
+		reg = <0xca35000 0x1000>;
+		reg-names = "csiphy";
+		interrupts = <0 79 0>;
+		interrupt-names = "csiphy";
+		gdscr-supply = <&gdsc_camss_top>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "gdscr", "bimc_smmu";
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_csi1_clk_src>,
+			<&clock_mmss clk_mmss_camss_csi1_clk>,
+			<&clock_mmss clk_mmss_camss_cphy_csid1_clk>,
+			<&clock_mmss clk_csi1phytimer_clk_src>,
+			<&clock_mmss clk_mmss_camss_csi1phytimer_clk>,
+			<&clock_mmss clk_mmss_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csiphy_clk_src>,
+			<&clock_mmss clk_mmss_camss_csiphy1_clk>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"csi_src_clk", "csi_clk", "cphy_csid_clk",
+			"csiphy_timer_src_clk", "csiphy_timer_clk",
+			"camss_ispif_ahb_clk", "csiphy_clk_src", "csiphy_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 274290000 0 0 200000000 0
+			0 274290000 0>;
+		status = "ok";
+	};
+
+	qcom,csiphy@ca36000 {
+		cell-index = <2>;
+		compatible = "qcom,csiphy-v5.01", "qcom,csiphy";
+		reg = <0xca36000 0x1000>;
+		reg-names = "csiphy";
+		interrupts = <0 80 0>;
+		interrupt-names = "csiphy";
+		gdscr-supply = <&gdsc_camss_top>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "gdscr", "bimc_smmu";
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_csi2_clk_src>,
+			<&clock_mmss clk_mmss_camss_csi2_clk>,
+			<&clock_mmss clk_mmss_camss_cphy_csid2_clk>,
+			<&clock_mmss clk_csi2phytimer_clk_src>,
+			<&clock_mmss clk_mmss_camss_csi2phytimer_clk>,
+			<&clock_mmss clk_mmss_camss_ispif_ahb_clk>,
+			<&clock_mmss clk_csiphy_clk_src>,
+			<&clock_mmss clk_mmss_camss_csiphy2_clk>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"csi_src_clk", "csi_clk", "cphy_csid_clk",
+			"csiphy_timer_src_clk", "csiphy_timer_clk",
+			"camss_ispif_ahb_clk", "csiphy_clk_src", "csiphy_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 274290000 0 0 200000000 0
+			0 274290000 0>;
+		status = "ok";
+	};
+
+	qcom,cpp@ca04000 {
+		cell-index = <0>;
+		compatible = "qcom,cpp";
+		reg = <0xca04000 0x100>,
+			<0xca80000 0x3000>,
+			<0xca18000 0x3000>,
+			<0xc8c36d4 0x4>;
+		reg-names = "cpp", "cpp_vbif", "cpp_hw", "camss_cpp";
+		interrupts = <0 294 0>;
+		interrupt-names = "cpp";
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		vdd-supply = <&gdsc_cpp>;
+		qcom,vdd-names = "smmu-vdd", "camss-vdd", "vdd";
+		clocks = <&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_top_ahb_clk>,
+			<&clock_mmss clk_cpp_clk_src>,
+			<&clock_mmss clk_mmss_camss_cpp_clk>,
+			<&clock_mmss clk_mmss_camss_cpp_ahb_clk>,
+			<&clock_mmss clk_mmss_camss_cpp_axi_clk>,
+			<&clock_mmss clk_mmss_camss_micro_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_camss_cpp_vbif_ahb_clk>;
+		clock-names = "mmssnoc_axi_clk",
+			"mnoc_ahb_clk",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"cpp_src_clk",
+			"cpp_core_clk", "camss_cpp_ahb_clk",
+			"camss_cpp_axi_clk", "micro_iface_clk",
+			"mmss_smmu_axi_clk", "cpp_vbif_ahb_clk";
+		qcom,clock-rates = <0 0 0 0 200000000 200000000 0 0 0 0 0>;
+		qcom,min-clock-rate = <200000000>;
+		qcom,bus-master = <1>;
+		qcom,vbif-qos-setting = <0x20 0x10000000>,
+			<0x24 0x10000000>,
+			<0x28 0x10000000>,
+			<0x2C 0x10000000>;
+		status = "ok";
+		qcom,msm-bus,name = "msm_camera_cpp";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<106 512 0 0>,
+			<106 512 0 0>;
+		qcom,msm-bus-vector-dyn-vote;
+		resets = <&clock_mmss CAMSS_MICRO_BCR>;
+		reset-names = "micro_iface_reset";
+		qcom,src-clock-rates = <100000000 200000000 384000000 404000000
+			480000000 576000000 600000000>;
+		qcom,micro-reset;
+		qcom,cpp-fw-payload-info {
+			qcom,stripe-base = <790>;
+			qcom,plane-base = <715>;
+			qcom,stripe-size = <63>;
+			qcom,plane-size = <25>;
+			qcom,fe-ptr-off = <11>;
+			qcom,we-ptr-off = <23>;
+			qcom,ref-fe-ptr-off = <17>;
+			qcom,ref-we-ptr-off = <36>;
+			qcom,we-meta-ptr-off = <42>;
+			qcom,fe-mmu-pf-ptr-off = <7>;
+			qcom,ref-fe-mmu-pf-ptr-off = <10>;
+			qcom,we-mmu-pf-ptr-off = <13>;
+			qcom,dup-we-mmu-pf-ptr-off = <18>;
+			qcom,ref-we-mmu-pf-ptr-off = <23>;
+			qcom,set-group-buffer-len = <135>;
+			qcom,dup-frame-indicator-off = <70>;
+		};
+	};
+};
+
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2-cdp-overlay.dts b/arch/arm64/boot/dts/qcom/msm8998-v2-cdp-overlay.dts
new file mode 100644
index 000000000000..1ae671663edb
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2-cdp-overlay.dts
@@ -0,0 +1,29 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/msm-clocks-8998.h>
+#include <dt-bindings/regulator/qcom,rpm-smd-regulator.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v2 CDP";
+	compatible = "qcom,msm8998-cdp", "qcom,msm8998", "qcom,cdp";
+	qcom,msm-id = <292 0x20000>;
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2-cdp.dts b/arch/arm64/boot/dts/qcom/msm8998-v2-cdp.dts
new file mode 100644
index 000000000000..f54017dcae9e
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2-cdp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8998-v2.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v2 CDP";
+	compatible = "qcom,msm8998-cdp", "qcom,msm8998", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2-interposer-sdm660.dtsi b/arch/arm64/boot/dts/qcom/msm8998-v2-interposer-sdm660.dtsi
new file mode 100644
index 000000000000..4edcd964f0b3
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2-interposer-sdm660.dtsi
@@ -0,0 +1,851 @@
+/* Copyright (c) 2016 The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only version-specific property overrides should be placed
+ * inside this file. Common device definitions should be placed inside the
+ * msm8998.dtsi file.
+ */
+
+#include "msm8998-interposer-sdm660.dtsi"
+#include "msm8998-v2-camera.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM8998 v2";
+	qcom,msm-id = <292 0x20000>;
+};
+
+&clock_cpu {
+	compatible = "qcom,cpu-clock-osm-msm8998-v2";
+	reg = <0x179c0000 0x4000>,
+	      <0x17916000 0x1000>,
+	      <0x17816000 0x1000>,
+	      <0x179d1000 0x1000>,
+	      <0x17914800 0x800>,
+	      <0x17814800 0x800>,
+	      <0x00784130 0x8>,
+	      <0x1791101c 0x8>;
+	reg-names = "osm", "pwrcl_pll", "perfcl_pll",
+		    "apcs_common", "pwrcl_acd", "perfcl_acd",
+		    "perfcl_efuse", "debug";
+
+	qcom,acdtd-val = <0x00009611 0x00009611>;
+	qcom,acdcr-val = <0x002b5ffd 0x002b5ffd>;
+	qcom,acdsscr-val = <0x00000501 0x00000501>;
+	qcom,acdextint0-val = <0x2cf9ae8 0x2cf9ae8>;
+	qcom,acdextint1-val = <0x2cf9afc 0x2cf9afc>;
+	qcom,acdautoxfer-val = <0x00000015 0x00000015>;
+
+	/delete-property/ qcom,llm-sw-overr;
+	qcom,pwrcl-speedbin0-v0 =
+		<   300000000 0x0004000f 0x01200020 0x1 1 >,
+		<   364800000 0x05040013 0x01200020 0x1 2 >,
+		<   441600000 0x05040017 0x02200020 0x1 3 >,
+		<   518400000 0x0504001b 0x02200020 0x1 4 >,
+		<   595200000 0x0504001f 0x02200020 0x1 5 >,
+		<   672000000 0x05040023 0x03200020 0x1 6 >,
+		<   748800000 0x05040027 0x03200020 0x1 7 >,
+		<   825600000 0x0404002b 0x03220022 0x1 8 >,
+		<   883200000 0x0404002e 0x04250025 0x1 9 >,
+		<   960000000 0x04040032 0x04280028 0x1 10 >,
+		<  1036800000 0x04040036 0x042b002b 0x1 11 >,
+		<  1094400000 0x04040039 0x052e002e 0x2 12 >,
+		<  1171200000 0x0404003d 0x05310031 0x2 13 >,
+		<  1248000000 0x04040041 0x05340034 0x2 14 >,
+		<  1324800000 0x04040045 0x06370037 0x2 15 >,
+		<  1401600000 0x04040049 0x063a003a 0x2 16 >,
+		<  1478400000 0x0404004d 0x073e003e 0x2 17 >,
+		<  1555200000 0x04040051 0x07410041 0x2 18 >,
+		<  1670400000 0x04040057 0x08460046 0x2 19 >,
+		<  1747200000 0x0404005b 0x08490049 0x2 20 >,
+		<  1824000000 0x0404005f 0x084c004c 0x3 21 >,
+		<  1900800000 0x04040063 0x094f004f 0x3 22 >;
+
+	qcom,perfcl-speedbin0-v0 =
+		<   300000000 0x0004000f 0x01200020 0x1 1 >,
+		<   345600000 0x05040012 0x01200020 0x1 2 >,
+		<   422400000 0x05040016 0x02200020 0x1 3 >,
+		<   499200000 0x0504001a 0x02200020 0x1 4 >,
+		<   576000000 0x0504001e 0x02200020 0x1 5 >,
+		<   652800000 0x05040022 0x03200020 0x1 6 >,
+		<   729600000 0x05040026 0x03200020 0x1 7 >,
+		<   806400000 0x0504002a 0x03220022 0x1 8 >,
+		<   902400000 0x0404002f 0x04260026 0x1 9 >,
+		<   979200000 0x04040033 0x04290029 0x1 10 >,
+		<  1056000000 0x04040037 0x052c002c 0x1 11 >,
+		<  1132800000 0x0404003b 0x052f002f 0x1 12 >,
+		<  1190400000 0x0404003e 0x05320032 0x2 13 >,
+		<  1267200000 0x04040042 0x06350035 0x2 14 >,
+		<  1344000000 0x04040046 0x06380038 0x2 15 >,
+		<  1420800000 0x0404004a 0x063b003b 0x2 16 >,
+		<  1497600000 0x0404004e 0x073e003e 0x2 17 >,
+		<  1574400000 0x04040052 0x07420042 0x2 18 >,
+		<  1651200000 0x04040056 0x07450045 0x2 19 >,
+		<  1728000000 0x0404005a 0x08480048 0x2 20 >,
+		<  1804800000 0x0404005e 0x084b004b 0x2 21 >,
+		<  1881600000 0x04040062 0x094e004e 0x2 22 >,
+		<  1958400000 0x04040066 0x09520052 0x2 23 >,
+		<  2035200000 0x0404006a 0x09550055 0x3 24 >,
+		<  2112000000 0x0404006e 0x0a580058 0x3 25 >,
+		<  2188800000 0x04040072 0x0a5b005b 0x3 26 >,
+		<  2265600000 0x04040076 0x0a5e005e 0x3 27 >,
+		<  2342400000 0x0404007a 0x0a620062 0x3 28 >,
+		<  2419200000 0x0404007e 0x0a650065 0x3 29 >,
+		<  2496000000 0x04040082 0x0a680068 0x3 30 >;
+
+	qcom,perfcl-speedbin1-v0 =
+		<   300000000 0x0004000f 0x01200020 0x1 1 >,
+		<   345600000 0x05040012 0x01200020 0x1 2 >,
+		<   422400000 0x05040016 0x02200020 0x1 3 >,
+		<   499200000 0x0504001a 0x02200020 0x1 4 >,
+		<   576000000 0x0504001e 0x02200020 0x1 5 >,
+		<   652800000 0x05040022 0x03200020 0x1 6 >,
+		<   729600000 0x05040026 0x03200020 0x1 7 >,
+		<   806400000 0x0504002a 0x03220022 0x1 8 >,
+		<   902400000 0x0404002f 0x04260026 0x1 9 >,
+		<   979200000 0x04040033 0x04290029 0x1 10 >,
+		<  1056000000 0x04040037 0x052c002c 0x1 11 >,
+		<  1132800000 0x0404003b 0x052f002f 0x1 12 >,
+		<  1190400000 0x0404003e 0x05320032 0x2 13 >,
+		<  1267200000 0x04040042 0x06350035 0x2 14 >,
+		<  1344000000 0x04040046 0x06380038 0x2 15 >,
+		<  1420800000 0x0404004a 0x063b003b 0x2 16 >,
+		<  1497600000 0x0404004e 0x073e003e 0x2 17 >,
+		<  1574400000 0x04040052 0x07420042 0x2 18 >,
+		<  1651200000 0x04040056 0x07450045 0x2 19 >,
+		<  1728000000 0x0404005a 0x08480048 0x2 20 >,
+		<  1804800000 0x0404005e 0x084b004b 0x2 21 >,
+		<  1881600000 0x04040062 0x094e004e 0x2 22 >,
+		<  1958400000 0x04040066 0x09520052 0x2 23 >,
+		<  2035200000 0x0404006a 0x09550055 0x3 24 >,
+		<  2112000000 0x0404006e 0x0a580058 0x3 25 >,
+		<  2208000000 0x04040073 0x0a5c005c 0x3 26 >,
+		<  2304000000 0x04010078 0x0a5c005c 0x3 26 >;
+};
+
+&msm_cpufreq {
+	qcom,cpufreq-table-0 =
+		<   300000 >,
+		<   364800 >,
+		<   441600 >,
+		<   518400 >,
+		<   595200 >,
+		<   672000 >,
+		<   748800 >,
+		<   825600 >,
+		<   883200 >,
+		<   960000 >,
+		<  1036800 >,
+		<  1094400 >,
+		<  1171200 >,
+		<  1248000 >,
+		<  1324800 >,
+		<  1401600 >,
+		<  1478400 >,
+		<  1555200 >,
+		<  1670400 >,
+		<  1747200 >,
+		<  1824000 >,
+		<  1900800 >;
+
+	qcom,cpufreq-table-4 =
+		<   300000 >,
+		<   345600 >,
+		<   422400 >,
+		<   499200 >,
+		<   576000 >,
+		<   652800 >,
+		<   729600 >,
+		<   806400 >,
+		<   902400 >,
+		<   979200 >,
+		<  1056000 >,
+		<  1132800 >,
+		<  1190400 >,
+		<  1267200 >,
+		<  1344000 >,
+		<  1420800 >,
+		<  1497600 >,
+		<  1574400 >,
+		<  1651200 >,
+		<  1728000 >,
+		<  1804800 >,
+		<  1881600 >,
+		<  1958400 >,
+		<  2035200 >,
+		<  2112000 >,
+		<  2188800 >,
+		<  2265600 >,
+		<  2342400 >,
+		<  2419200 >,
+		<  2496000 >;
+};
+
+&bwmon {
+	compatible = "qcom,bimc-bwmon4";
+	qcom,hw-timer-hz = <19200000>;
+};
+
+&devfreq_cpufreq {
+	mincpubw-cpufreq {
+		cpu-to-dev-map-0 =
+			< 1900800 1525 >;
+		cpu-to-dev-map-4 =
+			< 2112000 1525 >,
+			< 2496000 5195 >;
+		};
+};
+
+&clock_gcc {
+	compatible = "qcom,gcc-8998-v2";
+};
+
+&clock_mmss {
+	compatible = "qcom,mmsscc-8998-v2";
+};
+
+&clock_gpu {
+	compatible = "qcom,gpucc-8998-v2";
+};
+
+&clock_gfx {
+	compatible = "qcom,gfxcc-8998-v2";
+	qcom,gfxfreq-speedbin0 =
+		<         0 0                           0 >,
+		< 180000000 1 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 257000000 2 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 342000000 3 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 414000000 4 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 515000000 5 RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 596000000 6 RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 670000000 7 RPM_SMD_REGULATOR_LEVEL_TURBO >;
+	qcom,gfxfreq-mx-speedbin0 =
+		<         0                           0 >,
+		< 180000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 257000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 342000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 414000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 515000000 RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 596000000 RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 670000000 RPM_SMD_REGULATOR_LEVEL_TURBO >;
+};
+
+&mdss_mdp {
+	qcom,vbif-settings = <0x00d0 0x00002020>;
+	qcom,max-bandwidth-low-kbps = <9400000>;
+	qcom,max-bandwidth-high-kbps = <9400000>;
+	qcom,max-bandwidth-per-pipe-kbps = <4700000>;
+};
+
+&pm8998_s10 {
+	regulator-min-microvolt = <568000>;
+	regulator-max-microvolt = <1056000>;
+};
+
+&pm8998_s13 {
+	regulator-min-microvolt = <568000>;
+	regulator-max-microvolt = <1056000>;
+};
+
+&apc0_cpr {
+	compatible = "qcom,cprh-msm8998-v2-kbss-regulator";
+	qcom,cpr-corner-switch-delay-time = <1042>;
+	qcom,cpr-aging-ref-voltage = <1056000>;
+};
+
+&apc0_pwrcl_vreg {
+	regulator-max-microvolt = <23>;
+
+	qcom,cpr-fuse-combos = <16>;
+	qcom,cpr-speed-bins = <2>;
+	qcom,cpr-speed-bin-corners = <22 22>;
+	qcom,cpr-corners =
+		/* Speed bin 0 */
+		<22 22 22 22 22 22 22 22>,
+		/* Speed bin 1 */
+		<22 22 22 22 22 22 22 22>;
+
+	qcom,cpr-corner-fmax-map =
+		/* Speed bin 0 */
+		<8 11 18 22>,
+		/* Speed bin 1 */
+		<8 11 18 22>;
+
+	qcom,cpr-voltage-ceiling =
+		/* Speed bin 0 */
+		<828000  828000  828000  828000  828000
+		 828000  828000  828000  828000  828000
+		 828000  900000  900000  900000  900000
+		 900000  900000  900000  952000  952000
+		1056000 1056000>,
+		/* Speed bin 1 */
+		<828000  828000  828000  828000  828000
+		 828000  828000  828000  828000  828000
+		 828000  900000  900000  900000  900000
+		 900000  900000  900000  952000  952000
+		1056000 1056000>;
+
+	qcom,cpr-voltage-floor =
+		/* Speed bin 0 */
+		<568000  568000  568000  568000  568000
+		 568000  568000  568000  568000  568000
+		 568000  632000  632000  632000  632000
+		 632000  632000  632000  712000  712000
+		 772000  772000>,
+		/* Speed bin 1 */
+		<568000  568000  568000  568000  568000
+		 568000  568000  568000  568000  568000
+		 568000  632000  632000  632000  632000
+		 632000  632000  632000  712000  712000
+		 772000  772000>;
+
+	qcom,cpr-floor-to-ceiling-max-range =
+		/* Speed bin 0 */
+		<55000  55000  55000  55000
+		 55000  55000  55000  55000
+		 55000  55000  55000  65000
+		 65000  65000  65000  65000
+		 65000  65000  65000  65000
+		 65000  65000>,
+		/* Speed bin 1 */
+		<55000  55000  55000  55000
+		 55000  55000  55000  55000
+		 55000  55000  55000  65000
+		 65000  65000  65000  65000
+		 65000  65000  65000  65000
+		 65000  65000>;
+
+	qcom,corner-frequencies =
+		/* Speed bin 0 */
+		<300000000  364800000  441600000
+		 518400000  595200000  672000000
+		 748800000  825600000  883200000
+		 960000000 1036800000 1094400000
+		1171200000 1248000000 1324800000
+		1401600000 1478400000 1555200000
+		1670400000 1747200000 1824000000
+		1900800000>,
+		/* Speed bin 1 */
+		<300000000  364800000  441600000
+		 518400000  595200000  672000000
+		 748800000  825600000  883200000
+		 960000000 1036800000 1094400000
+		1171200000 1248000000 1324800000
+		1401600000 1478400000 1555200000
+		1670400000 1747200000 1824000000
+		1900800000>;
+
+	qcom,cpr-ro-scaling-factor =
+		<2595 2794 2577 2762 2471 2674 2199
+		 2553 3189 3255 3192 2962 3054 2982
+		 2042 2945>,
+		<2595 2794 2577 2762 2471 2674 2199
+		 2553 3189 3255 3192 2962 3054 2982
+		 2042 2945>,
+		<2391 2550 2483 2638 2382 2564 2259
+		 2555 2766 3041 2988 2935 2873 2688
+		 2013 2784>,
+		<2066 2153 2300 2434 2220 2386 2288
+		 2465 2028 2511 2487 2734 2554 2117
+		 1892 2377>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		/* Speed bin 0 */
+		<40000 24000 0 30000>,
+		<40000 24000 0 30000>,
+		<40000 24000 0 30000>,
+		<40000 24000 0 30000>,
+		<40000 24000 0 30000>,
+		<40000 24000 0 30000>,
+		<40000 24000 0 30000>,
+		<40000 24000 0 30000>,
+		/* Speed bin 1 */
+		<40000 24000 0 30000>,
+		<40000 24000 0 30000>,
+		<40000 24000 0 30000>,
+		<40000 24000 0 30000>,
+		<40000 24000 0 30000>,
+		<40000 24000 0 30000>,
+		<40000 24000 0 30000>,
+		<40000 24000 0 30000>;
+
+	qcom,cpr-closed-loop-voltage-fuse-adjustment =
+		/* Speed bin 0 */
+		<20000 26000 0 30000>,
+		<20000 26000 0 30000>,
+		<20000 26000 0 30000>,
+		<20000 26000 0 30000>,
+		<20000 26000 0 30000>,
+		<20000 26000 0 30000>,
+		<20000 26000 0 30000>,
+		<20000 26000 0 30000>,
+		/* Speed bin 1 */
+		<20000 26000 0 30000>,
+		<20000 26000 0 30000>,
+		<20000 26000 0 30000>,
+		<20000 26000 0 30000>,
+		<20000 26000 0 30000>,
+		<20000 26000 0 30000>,
+		<20000 26000 0 30000>,
+		<20000 26000 0 30000>;
+
+	qcom,allow-voltage-interpolation;
+	qcom,allow-quotient-interpolation;
+	qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+
+	qcom,cpr-aging-ref-corner = <22 22>;
+	qcom,cpr-aging-ro-scaling-factor = <2950>;
+	qcom,allow-aging-voltage-adjustment = <0>;
+};
+
+&apc1_cpr {
+	compatible = "qcom,cprh-msm8998-v2-kbss-regulator";
+	qcom,cpr-corner-switch-delay-time = <1042>;
+	qcom,cpr-aging-ref-voltage = <1056000>;
+};
+
+&apc1_perfcl_vreg {
+	regulator-max-microvolt = <31>;
+
+	qcom,cpr-fuse-combos = <16>;
+	qcom,cpr-speed-bins = <2>;
+	qcom,cpr-speed-bin-corners = <30 26>;
+	qcom,cpr-corners =
+		/* Speed bin 0 */
+		<30 30 30 30 30 30 30 30>,
+		/* Speed bin 1 */
+		<26 26 26 26 26 26 26 26>;
+
+	qcom,cpr-corner-fmax-map =
+		/* Speed bin 0 */
+		<8 12 20 30>,
+		/* Speed bin 1 */
+		<8 12 20 26>;
+
+	qcom,cpr-voltage-ceiling =
+		/* Speed bin 0 */
+		<828000  828000  828000  828000  828000
+		 828000  828000  828000  828000  828000
+		 828000  828000  900000  900000  900000
+		 900000  900000  900000  900000  900000
+		 952000  952000  952000 1056000 1056000
+		1056000 1056000 1056000 1056000 1056000>,
+		/* Speed bin 1 */
+		<828000  828000  828000  828000  828000
+		 828000  828000  828000  828000  828000
+		 828000  828000  900000  900000  900000
+		 900000  900000  900000  900000  900000
+		 952000  952000  952000 1056000 1056000
+		1056000>;
+
+	qcom,cpr-voltage-floor =
+		/* Speed bin 0 */
+		<568000  568000  568000  568000  568000
+		 568000  568000  568000  568000  568000
+		 568000  568000  632000  632000  632000
+		 632000  632000  632000  632000  632000
+		 712000  712000  712000  772000  772000
+		 772000  772000  772000  772000  772000>,
+		/* Speed bin 1 */
+		<568000  568000  568000  568000  568000
+		 568000  568000  568000  568000  568000
+		 568000  568000  632000  632000  632000
+		 632000  632000  632000  632000  632000
+		 712000  712000  712000  772000  772000
+		 772000>;
+
+	qcom,cpr-floor-to-ceiling-max-range =
+		/* Speed bin 0 */
+		<55000  55000  55000  55000
+		 55000  55000  55000  55000
+		 55000  55000  55000  55000
+		 65000  65000  65000  65000
+		 65000  65000  65000  65000
+		 65000  65000  65000  65000
+		 65000  65000  65000  65000
+		 65000  65000>,
+		/* Speed bin 1 */
+		<55000  55000  55000  55000
+		 55000  55000  55000  55000
+		 55000  55000  55000  55000
+		 65000  65000  65000  65000
+		 65000  65000  65000  65000
+		 65000  65000  65000  65000
+		 65000  65000>;
+
+	qcom,corner-frequencies =
+		/* Speed bin 0 */
+		<300000000  345600000  422400000
+		 499200000  576000000  652800000
+		 729600000  806400000  902400000
+		 979200000 1056000000 1132800000
+		1190400000 1267200000 1344000000
+		1420800000 1497600000 1574400000
+		1651200000 1728000000 1804800000
+		1881600000 1958400000 2035200000
+		2112000000 2188800000 2265600000
+		2342400000 2419200000 2496000000>,
+		/* Speed bin 1 */
+		<300000000  345600000  422400000
+		 499200000  576000000  652800000
+		 729600000  806400000  902400000
+		 979200000 1056000000 1132800000
+		1190400000 1267200000 1344000000
+		1420800000 1497600000 1574400000
+		1651200000 1728000000 1804800000
+		1881600000 1958400000 2035200000
+		2112000000 2208000000>;
+
+	qcom,cpr-ro-scaling-factor =
+		<2857 3057 2828 2952 2699 2798 2446
+		 2631 2629 2578 2244 3344 3289 3137
+		 3164 2655>,
+		<2857 3057 2828 2952 2699 2798 2446
+		 2631 2629 2578 2244 3344 3289 3137
+		 3164 2655>,
+		<2603 2755 2676 2777 2573 2685 2465
+		 2610 2312 2423 2243 3104 3022 3036
+		 2740 2303>,
+		<1901 2016 2096 2228 2034 2161 2077
+		 2188 1565 1870 1925 2235 2205 2413
+		 1762 1478>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		/* Speed bin 0 */
+		<8000 0 0 52000>,
+		<8000 0 0 52000>,
+		<8000 0 0 52000>,
+		<8000 0 0 52000>,
+		<8000 0 0 52000>,
+		<8000 0 0 52000>,
+		<8000 0 0 52000>,
+		<8000 0 0 52000>,
+		/* Speed bin 1 */
+		<8000 0 0 52000>,
+		<8000 0 0 52000>,
+		<8000 0 0 52000>,
+		<8000 0 0 52000>,
+		<8000 0 0 52000>,
+		<8000 0 0 52000>,
+		<8000 0 0 52000>,
+		<8000 0 0 52000>;
+
+	qcom,cpr-closed-loop-voltage-fuse-adjustment =
+		/* Speed bin 0 */
+		<0 0 0 50000>,
+		<0 0 0 50000>,
+		<0 0 0 50000>,
+		<0 0 0 50000>,
+		<0 0 0 50000>,
+		<0 0 0 50000>,
+		<0 0 0 50000>,
+		<0 0 0 50000>,
+		/* Speed bin 1 */
+		<0 0 0 50000>,
+		<0 0 0 50000>,
+		<0 0 0 50000>,
+		<0 0 0 50000>,
+		<0 0 0 50000>,
+		<0 0 0 50000>,
+		<0 0 0 50000>,
+		<0 0 0 50000>;
+
+	qcom,allow-voltage-interpolation;
+	qcom,allow-quotient-interpolation;
+	qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+
+	qcom,cpr-aging-ref-corner = <30 26>;
+	qcom,cpr-aging-ro-scaling-factor = <2950>;
+	qcom,allow-aging-voltage-adjustment = <0>;
+};
+
+&pm8005_s1 {
+	regulator-min-microvolt = <516000>;
+	regulator-max-microvolt = <1088000>;
+};
+
+&gfx_cpr {
+	compatible = "qcom,cpr4-msm8998-v2-mmss-regulator";
+	qcom,cpr-aging-ref-voltage = <1024000>;
+};
+
+&gfx_vreg {
+	regulator-min-microvolt = <1>;
+	regulator-max-microvolt = <8>;
+
+	qcom,cpr-fuse-corners = <4>;
+	qcom,cpr-fuse-combos = <8>;
+	qcom,cpr-corners = <8>;
+
+	qcom,cpr-corner-fmax-map = <1 3 5 8>;
+
+	qcom,cpr-voltage-ceiling =
+		<656000 716000 772000 880000 908000 948000 1016000 1088000>,
+		<660000 724000 772000 832000 916000 968000 1024000 1024000>,
+		<660000 724000 772000 832000 916000 968000 1024000 1024000>,
+		<660000 724000 772000 832000 916000 968000 1024000 1024000>,
+		<660000 724000 772000 832000 916000 968000 1024000 1024000>,
+		<660000 724000 772000 832000 916000 968000 1024000 1024000>,
+		<660000 724000 772000 832000 916000 968000 1024000 1024000>,
+		<660000 724000 772000 832000 916000 968000 1024000 1024000>;
+
+	qcom,cpr-voltage-floor =
+		<516000 516000 532000 584000 632000 672000 712000 756000>;
+
+	qcom,mem-acc-voltage = <1 1 1 2 2 2 2 2>;
+
+	qcom,corner-frequencies =
+		<180000000 257000000 342000000 414000000
+		 515000000 596000000 670000000 710000000>;
+
+	qcom,cpr-target-quotients =
+		<   0    0    0    0  331  357    0    0
+		    0    0    0    0    0    0  115    0>,
+		<   0    0    0    0  467  500    0    0
+		    0    0    0    0    0    0  199    0>,
+		<   0    0    0    0  628  665    0    0
+		    0    0    0    0    0    0  290    0>,
+		<   0    0    0    0  762  805    0    0
+		    0    0    0    0    0    0  397    0>,
+		<   0    0    0    0  964 1013    0    0
+		    0    0 1143    0 1138 1055    0    0>,
+		<   0    0    0    0    0    0    0    0
+		    0    0 1306    0 1289 1168    0    0>,
+		<   0    0    0    0    0    0    0    0
+		    0    0 1468    0 1429 1256    0    0>,
+		<   0    0    0    0    0    0    0    0
+		    0    0 1627    0 1578 1353    0    0>;
+
+	qcom,cpr-ro-scaling-factor =
+		<   0    0    0    0 2377 2571    0    0
+		    0    0 2168    0 2209 1849 1997    0>,
+		<   0    0    0    0 2377 2571    0    0
+		    0    0 2168    0 2209 1849 1997    0>,
+		<   0    0    0    0 2377 2571    0    0
+		    0    0 2168    0 2209 1849 1997    0>,
+		<   0    0    0    0 2377 2571    0    0
+		    0    0 2168    0 2209 1849 1997    0>,
+		<   0    0    0    0 2377 2571    0    0
+		    0    0 2168    0 2209 1849 1997    0>,
+		<   0    0    0    0 2377 2571    0    0
+		    0    0 2168    0 2209 1849 1997    0>,
+		<   0    0    0    0 2377 2571    0    0
+		    0    0 2168    0 2209 1849 1997    0>,
+		<   0    0    0    0 2377 2571    0    0
+		    0    0 2168    0 2209 1849 1997    0>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		<  100000        0        0        0>,
+		<  100000        0        0        0>,
+		<   85000  (-15000) (-15000) (-15000)>,
+		<   85000  (-15000) (-15000) (-15000)>,
+		<   85000  (-15000) (-15000) (-15000)>,
+		<   85000  (-15000) (-15000) (-15000)>,
+		<   85000  (-15000) (-15000) (-15000)>,
+		<   85000  (-15000) (-15000) (-15000)>;
+
+	qcom,cpr-closed-loop-voltage-adjustment =
+		<   96000    18000     4000        0
+			0    13000     9000        0>,
+		<   96000    18000     4000        0
+			0    13000     9000        0>,
+		<   81000     3000  (-11000) (-15000)
+		  (-15000)  (-2000)  (-6000) (-15000)>,
+		<   81000     3000  (-11000) (-15000)
+		  (-15000)  (-2000)  (-6000) (-15000)>,
+		<   81000     3000  (-11000) (-15000)
+		  (-15000)  (-2000)  (-6000) (-15000)>,
+		<   81000     3000  (-11000) (-15000)
+		  (-15000)  (-2000)  (-6000) (-15000)>,
+		<   81000     3000  (-11000) (-15000)
+		  (-15000)  (-2000)  (-6000) (-15000)>,
+		<   81000     3000  (-11000) (-15000)
+		  (-15000)  (-2000)  (-6000) (-15000)>;
+
+	qcom,cpr-floor-to-ceiling-max-range =
+	       <50000 50000 50000 50000 50000 50000 70000 70000>;
+
+	qcom,cpr-fused-closed-loop-voltage-adjustment-map =
+		<0 0 1 2 3 0 0 4>;
+
+	qcom,allow-voltage-interpolation;
+	qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+
+	qcom,cpr-aging-max-voltage-adjustment = <15000>;
+	qcom,cpr-aging-ref-corner = <8>;
+	qcom,cpr-aging-ro-scaling-factor = <2950>;
+	qcom,allow-aging-voltage-adjustment = <0 0 1 1 1 1 1 1>;
+};
+
+&qusb_phy0 {
+	reg = <0x0c012000 0x2a8>,
+	      <0x01fcb24c 0x4>,
+	      <0x00784238 0x4>;
+	reg-names = "qusb_phy_base",
+			"tcsr_clamp_dig_n_1p8",
+			"efuse_addr";
+	qcom,efuse-bit-pos = <16>;
+	qcom,efuse-num-bits = <4>;
+	qcom,qusb-phy-init-seq =
+			/* <value reg_offset> */
+				<0x13 0x04 /* analog_controls_two */
+				0x7c 0x18c /* pll_clock_inverter */
+				0x80 0x2c /* pll_cmode */
+				0x0a 0x184 /* pll_lock_delay */
+				0xa5 0x23c /* tune1 */
+				0x09 0x240 /* tune2 */
+				0x19 0xb4>; /* digital_timers_two */
+};
+
+&msm_vidc {
+	qcom,load-freq-tbl =
+		/* Encoders */
+		<1105920 533000000 0x55555555>, /* 4kx2304@30 */ /*TURBO*/
+		<1036800 444000000 0x55555555>, /* 720p@240, 1080p@120,1440p@60,
+						 * UHD@30 */ /*NOMINAL*/
+		< 829440 355200000 0x55555555>, /* UHD/4096x2160@30 SVSL1 */
+		< 489600 269330000 0x55555555>, /* 1080p@60, 720p@120 SVS */
+		< 345600 200000000 0x55555555>, /* 2560x1440@24, 1080p@30 */
+						/* SVS2 */
+
+		/* Decoders */
+		<2211840 533000000 0xffffffff>, /* 4kx2304@60, 1080p@240 */
+						/* TURBO */
+		<1728000 444000000 0xffffffff>, /* 2560x1440@120 */
+						/* NOMINAL */
+		<1675472 355200000 0xffffffff>, /* 4kx2304@44 */ /*SVSL1*/
+		<1105920 269330000 0xffffffff>, /* UHD/4k2304@30, 1080p@120 */
+						/* SVS */
+		< 829440 200000000 0xffffffff>; /* 720p@120, 1080p@60 */
+						/* SVS2 */
+
+	qcom,imem-ab-tbl =
+		<200000000 1560000>,/* imem @ svs2 freq 75 Mhz */
+		<269330000 3570000>,/* imem @ svs freq 171 Mhz */
+		<355200000 3570000>,/* imem @ svs freq 171 Mhz */
+		<444000000 6750000>,/* imem @ nom freq 323 Mhz */
+		<533000000 8490000>;/* imem @ turbo freq 406 Mhz */
+
+	qcom,dcvs-tbl = /* minLoad LoadLow LoadHigh CodecCheck */
+		/* Decode */
+		/* Load > Nominal, Nominal <-> Turbo Eg.3840x2160@60 */
+		<1728000 1728000 2211840 0x3f00000c>,
+		/* Encoder */
+		/* Load > Nominal, Nominal <-> Turbo Eg. 4kx2304@30 */
+		<1036800 1036800 1105920 0x04000004>,
+		/* Load > SVSL1, SVSL1<-> Nominal Eg. 3840x2160@30 */
+		< 829440  829440 1036800 0x04000004>,
+		/* Load > SVS , SVS <-> SVSL1 Eg. 4kx2304@24 */
+		< 489600  489600  829440 0x04000004>;
+
+	qcom,dcvs-limit = /* Min Frame size, Min MBs/sec */
+		<32400 30>, /* Encoder 3840x2160@30 */
+		<32400 60>; /* Decoder 3840x2160@60 */
+
+};
+
+&soc {
+	/* Gold L2 SAW */
+	qcom,spm@178120000 {
+		qcom,saw2-avs-limit = <0x4200420>;
+	};
+
+	/* Silver L2 SAW */
+	qcom,spm@179120000 {
+		qcom,saw2-avs-limit = <0x4200420>;
+	};
+};
+
+/* GPU overrides */
+&msm_gpu {
+	/* Updated chip ID */
+	qcom,chipid = <0x05040001>;
+	qcom,initial-pwrlevel = <0>;
+
+	qcom,gpu-pwrlevels {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		compatible = "qcom,gpu-pwrlevels";
+
+		qcom,gpu-pwrlevel@0 {
+			reg = <0>;
+			qcom,gpu-freq = <342000000>;
+			qcom,bus-freq = <8>;
+			qcom,bus-min = <5>;
+			qcom,bus-max = <9>;
+		};
+
+		qcom,gpu-pwrlevel@1 {
+			reg = <1>;
+			qcom,gpu-freq = <257000000>;
+			qcom,bus-freq = <5>;
+			qcom,bus-min = <3>;
+			qcom,bus-max = <8>;
+		};
+
+		qcom,gpu-pwrlevel@2 {
+			reg = <2>;
+			qcom,gpu-freq = <180000000>;
+			qcom,bus-freq = <3>;
+			qcom,bus-min = <1>;
+			qcom,bus-max = <5>;
+		};
+		qcom,gpu-pwrlevel@3 {
+			reg = <3>;
+			qcom,gpu-freq = <27000000>;
+			qcom,bus-freq = <0>;
+			qcom,bus-min = <0>;
+			qcom,bus-max = <0>;
+		};
+	};
+};
+
+&spss_utils {
+	qcom,spss-test-firmware-name = "spss2t";	/* 8 chars max */
+	qcom,spss-prod-firmware-name = "spss2p";	/* 8 chars max */
+};
+
+&ufs1 {
+	clock-names =
+		"core_clk",
+		"bus_aggr_clk",
+		"iface_clk",
+		"core_clk_unipro",
+		"core_clk_ice",
+		"ref_clk",
+		"tx_lane0_sync_clk",
+		"rx_lane0_sync_clk",
+		"rx_lane1_sync_clk";
+	clocks =
+		<&clock_gcc clk_gcc_ufs_axi_hw_ctl_clk>,
+		<&clock_gcc clk_gcc_aggre1_ufs_axi_clk>,
+		<&clock_gcc clk_gcc_ufs_ahb_clk>,
+		<&clock_gcc clk_gcc_ufs_unipro_core_hw_ctl_clk>,
+		<&clock_gcc clk_gcc_ufs_ice_core_hw_ctl_clk>,
+		<&clock_gcc clk_ln_bb_clk1>,
+		<&clock_gcc clk_gcc_ufs_tx_symbol_0_clk>,
+		<&clock_gcc clk_gcc_ufs_rx_symbol_0_clk>,
+		<&clock_gcc clk_gcc_ufs_rx_symbol_1_clk>;
+	freq-table-hz =
+		<50000000 200000000>,
+		<0 0>,
+		<0 0>,
+		<37500000 150000000>,
+		<75000000 300000000>,
+		<0 0>,
+		<0 0>,
+		<0 0>,
+		<0 0>;
+
+	lanes-per-direction = <2>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2-mtp-overlay.dts b/arch/arm64/boot/dts/qcom/msm8998-v2-mtp-overlay.dts
new file mode 100644
index 000000000000..c446a6a78f42
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2-mtp-overlay.dts
@@ -0,0 +1,29 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/msm-clocks-8998.h>
+#include <dt-bindings/regulator/qcom,rpm-smd-regulator.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v2 MTP";
+	compatible = "qcom,msm8998-mtp", "qcom,msm8998", "qcom,mtp";
+	qcom,msm-id = <292 0x20000>;
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2-mtp.dts b/arch/arm64/boot/dts/qcom/msm8998-v2-mtp.dts
new file mode 100644
index 000000000000..0375ee29984c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2-mtp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8998-v2.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v2 MTP";
+	compatible = "qcom,msm8998-mtp", "qcom,msm8998", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2-qrd-skuk-evt3.dts b/arch/arm64/boot/dts/qcom/msm8998-v2-qrd-skuk-evt3.dts
new file mode 100644
index 000000000000..b1d00eda89ef
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2-qrd-skuk-evt3.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8998-v2.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-qrd-skuk.dtsi"
+#include "msm8998-camera-sensor-skuk-evt3.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 V2 SKUK EVT3";
+	compatible = "qcom,msm8998-qrd", "qcom,msm8998", "qcom,qrd";
+	qcom,board-id = <0x02000b 0x10>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2-qrd-skuk-hdk.dts b/arch/arm64/boot/dts/qcom/msm8998-v2-qrd-skuk-hdk.dts
new file mode 100644
index 000000000000..4e75d161ec72
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2-qrd-skuk-hdk.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8998-v2.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-qrd-skuk-hdk.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 SKUK HDK";
+	compatible = "qcom,msm8998-qrd", "qcom,msm8998", "qcom,qrd";
+	qcom,board-id = <0x06000b 0x10>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2-qrd-skuk.dts b/arch/arm64/boot/dts/qcom/msm8998-v2-qrd-skuk.dts
new file mode 100644
index 000000000000..5727f3312a49
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2-qrd-skuk.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8998-v2.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-qrd-skuk.dtsi"
+#include "msm8998-camera-sensor-skuk.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 V2 SKUK";
+	compatible = "qcom,msm8998-qrd", "qcom,msm8998", "qcom,qrd";
+	qcom,board-id = <0x01000b 0x10>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2-qrd-vr1.dts b/arch/arm64/boot/dts/qcom/msm8998-v2-qrd-vr1.dts
new file mode 100644
index 000000000000..ebd5b307388c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2-qrd-vr1.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8998-v2.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-qrd-vr1.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 V2 VR1 Board";
+	compatible = "qcom,msm8998-qrd", "qcom,msm8998", "qcom,qrd";
+	qcom,board-id = <0x02000b 0x80>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2-qrd.dts b/arch/arm64/boot/dts/qcom/msm8998-v2-qrd.dts
new file mode 100644
index 000000000000..ed3a73e0b811
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2-qrd.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "msm8998-v2.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-qrd.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v2 QRD";
+	compatible = "qcom,msm8998-qrd", "qcom,msm8998", "qcom,qrd";
+	qcom,board-id = <11 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2-rumi.dts b/arch/arm64/boot/dts/qcom/msm8998-v2-rumi.dts
new file mode 100644
index 000000000000..e6cf24e593ce
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2-rumi.dts
@@ -0,0 +1,29 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+/memreserve/ 0x90000000 0x00000100;
+
+#include "msm8998-v2.dtsi"
+#include "msm8998-rumi.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 V2 RUMI";
+	compatible = "qcom,msm8998-rumi", "qcom,msm8998", "qcom,rumi";
+	qcom,board-id = <15 0>;
+};
+
+&gfx_stub_vreg {
+	regulator-max-microvolt = <8>;
+	status = "okay";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2-sim.dts b/arch/arm64/boot/dts/qcom/msm8998-v2-sim.dts
new file mode 100644
index 000000000000..91c583df7ff3
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2-sim.dts
@@ -0,0 +1,29 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+/memreserve/ 0x90000000 0x00000100;
+
+#include "msm8998-v2.dtsi"
+#include "msm8998-sim.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 V2 SIM";
+	compatible = "qcom,msm8998-sim", "qcom,msm8998", "qcom,sim";
+	qcom,board-id = <16 0>;
+};
+
+&gfx_stub_vreg {
+	regulator-max-microvolt = <8>;
+	status = "okay";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2.1-cdp-overlay.dts b/arch/arm64/boot/dts/qcom/msm8998-v2.1-cdp-overlay.dts
new file mode 100644
index 000000000000..f57238978baf
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2.1-cdp-overlay.dts
@@ -0,0 +1,29 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/msm-clocks-8998.h>
+#include <dt-bindings/regulator/qcom,rpm-smd-regulator.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v2.1 CDP";
+	compatible = "qcom,msm8998-cdp", "qcom,msm8998", "qcom,cdp";
+	qcom,msm-id = <292 0x20001>;
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2.1-cdp.dts b/arch/arm64/boot/dts/qcom/msm8998-v2.1-cdp.dts
new file mode 100644
index 000000000000..5d007dd55910
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2.1-cdp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8998-v2.1.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v2.1 CDP";
+	compatible = "qcom,msm8998-cdp", "qcom,msm8998", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660-cdp.dts b/arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660-cdp.dts
new file mode 100644
index 000000000000..6e4247fd884f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660-cdp.dts
@@ -0,0 +1,156 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8998-v2.1-interposer-sdm660.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-interposer-sdm660-cdp.dtsi"
+#include "msm8998-interposer-pm660.dtsi"
+#include "msm8998-interposer-sdm660-audio.dtsi"
+#include "msm8998-interposer-camera-sensor-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v2.1 SDM 660 Interposer CDP";
+	compatible = "qcom,msm8998-cdp", "qcom,msm8998", "qcom,cdp";
+	qcom,board-id = <1 1>;
+};
+
+&pm660_charger {
+	qcom,batteryless-platform;
+};
+
+&clock_gcc {
+	vdd_dig-supply = <&pm660l_s3_level>;
+	vdd_dig_ao-supply = <&pm660l_s3_level_ao>;
+};
+
+&clock_mmss {
+	vdd_dig-supply = <&pm660l_s3_level>;
+	vdd_mmsscc_mx-supply = <&pm660l_s5_level>;
+};
+
+&clock_gpu {
+	vdd_dig-supply = <&pm660l_s3_level>;
+};
+
+&clock_gfx {
+	/* GFX Rail = CX */
+	vdd_gpucc-supply = <&pm660l_s3_level>;
+	vdd_mx-supply = <&pm660l_s5_level>;
+	vdd_gpu_mx-supply = <&pm660l_s5_level>;
+	qcom,gfxfreq-speedbin0 =
+		<         0 0                           0 >,
+		< 180000000 RPM_SMD_REGULATOR_LEVEL_MIN_SVS
+					RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 257000000 RPM_SMD_REGULATOR_LEVEL_LOW_SVS
+					RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 342000000 RPM_SMD_REGULATOR_LEVEL_SVS
+					RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 414000000 RPM_SMD_REGULATOR_LEVEL_SVS_PLUS
+					RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 515000000 RPM_SMD_REGULATOR_LEVEL_NOM
+					RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 596000000 RPM_SMD_REGULATOR_LEVEL_NOM_PLUS
+					RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 670000000 RPM_SMD_REGULATOR_LEVEL_TURBO
+					RPM_SMD_REGULATOR_LEVEL_TURBO >,
+		< 710000000 RPM_SMD_REGULATOR_LEVEL_TURBO
+					RPM_SMD_REGULATOR_LEVEL_TURBO >;
+	qcom,gfxfreq-mx-speedbin0 =
+		<         0                           0 >,
+		< 180000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 257000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 342000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 414000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 515000000 RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 596000000 RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 670000000 RPM_SMD_REGULATOR_LEVEL_TURBO >,
+		< 710000000 RPM_SMD_REGULATOR_LEVEL_TURBO >;
+};
+
+&gdsc_gpu_gx {
+	clock-names = "core_root_clk";
+	clocks = <&clock_gfx clk_gfx3d_clk_src>;
+	qcom,force-enable-root-clk;
+	/* GFX Rail = CX */
+	parent-supply = <&pm660l_s3_level>;
+	status = "ok";
+};
+
+&usb3 {
+	extcon = <&pm660_pdphy>;
+};
+
+&qusb_phy0 {
+	vdd-supply = <&pm660l_l1>;
+	vdda18-supply = <&pm660_l10>;
+	qcom,vdd-voltage-level = <0 925000 925000>;
+	vdda33-supply = <&pm660l_l7>;
+};
+
+&ssphy {
+	vdd-supply = <&pm660l_l1>;
+	qcom,vdd-voltage-level = <0 925000 925000>;
+	core-supply = <&pm660_l1>;
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+	vdda-1p2-supply = <&pm660_l1>;
+	vdda-0p9-supply = <&pm660l_l1>;
+
+	qcom,ctrl-supply-entries {
+		qcom,ctrl-supply-entry@0 {
+			qcom,supply-min-voltage = <1200000>;
+			qcom,supply-max-voltage = <1250000>;
+		};
+	};
+
+	qcom,phy-supply-entries {
+		qcom,phy-supply-entry@0 {
+			qcom,supply-min-voltage = <880000>;
+			qcom,supply-max-voltage = <925000>;
+		};
+	};
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_truly_video>;
+	wqhd-vddio-supply = <&pm660_l11>;
+	lab-supply = <&lcdb_ldo_vreg>;
+	ibb-supply = <&lcdb_ncp_vreg>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,panel-mode-gpio = <&tlmm 91 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_truly_video>;
+	wqhd-vddio-supply = <&pm660_l11>;
+	lab-supply = <&lcdb_ldo_vreg>;
+	ibb-supply = <&lcdb_ncp_vreg>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,panel-mode-gpio = <&tlmm 91 0>;
+};
+
+&pm660l_wled {
+	qcom,led-strings-list = [01 02];
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660-mtp.dts b/arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660-mtp.dts
new file mode 100644
index 000000000000..cb7ee2266d52
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660-mtp.dts
@@ -0,0 +1,185 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8998-v2.1-interposer-sdm660.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-interposer-sdm660-mtp.dtsi"
+#include "msm8998-interposer-pm660.dtsi"
+#include "msm8998-interposer-sdm660-audio.dtsi"
+#include "msm8998-interposer-camera-sensor-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v2.1 SDM 660 Interposer MTP";
+	compatible = "qcom,msm8998-mtp", "qcom,msm8998", "qcom,mtp";
+	qcom,board-id = <8 2>;
+};
+
+&pm660_fg {
+	qcom,battery-data = <&mtp_batterydata>;
+};
+
+&clock_gcc {
+	vdd_dig-supply = <&pm660l_s3_level>;
+	vdd_dig_ao-supply = <&pm660l_s3_level_ao>;
+};
+
+&clock_mmss {
+	vdd_dig-supply = <&pm660l_s3_level>;
+	vdd_mmsscc_mx-supply = <&pm660l_s5_level>;
+};
+
+&clock_gpu {
+	vdd_dig-supply = <&pm660l_s3_level>;
+};
+
+&clock_gfx {
+	/* GFX Rail = CX */
+	vdd_gpucc-supply = <&pm660l_s3_level>;
+	vdd_mx-supply = <&pm660l_s5_level>;
+	vdd_gpu_mx-supply = <&pm660l_s5_level>;
+	qcom,gfxfreq-speedbin0 =
+		<         0 0                           0 >,
+		< 180000000 RPM_SMD_REGULATOR_LEVEL_MIN_SVS
+					RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 257000000 RPM_SMD_REGULATOR_LEVEL_LOW_SVS
+					RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 342000000 RPM_SMD_REGULATOR_LEVEL_SVS
+					RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 414000000 RPM_SMD_REGULATOR_LEVEL_SVS_PLUS
+					RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 515000000 RPM_SMD_REGULATOR_LEVEL_NOM
+					RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 596000000 RPM_SMD_REGULATOR_LEVEL_NOM_PLUS
+					RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 670000000 RPM_SMD_REGULATOR_LEVEL_TURBO
+					RPM_SMD_REGULATOR_LEVEL_TURBO >,
+		< 710000000 RPM_SMD_REGULATOR_LEVEL_TURBO
+					RPM_SMD_REGULATOR_LEVEL_TURBO >;
+	qcom,gfxfreq-mx-speedbin0 =
+		<         0                           0 >,
+		< 180000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 257000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 342000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 414000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 515000000 RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 596000000 RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 670000000 RPM_SMD_REGULATOR_LEVEL_TURBO >,
+		< 710000000 RPM_SMD_REGULATOR_LEVEL_TURBO >;
+};
+
+&gdsc_gpu_gx {
+	clock-names = "core_root_clk";
+	clocks = <&clock_gfx clk_gfx3d_clk_src>;
+	qcom,force-enable-root-clk;
+	/* GFX Rail = CX */
+	parent-supply = <&pm660l_s3_level>;
+	status = "ok";
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+	vdda-1p2-supply = <&pm660_l1>;
+	vdda-0p9-supply = <&pm660l_l1>;
+
+	qcom,ctrl-supply-entries {
+		qcom,ctrl-supply-entry@0 {
+			qcom,supply-min-voltage = <1200000>;
+			qcom,supply-max-voltage = <1250000>;
+		};
+	};
+
+	qcom,phy-supply-entries {
+		qcom,phy-supply-entry@0 {
+			qcom,supply-min-voltage = <880000>;
+			qcom,supply-max-voltage = <925000>;
+		};
+	};
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_truly_video>;
+	wqhd-vddio-supply = <&pm660_l11>;
+	lab-supply = <&lcdb_ldo_vreg>;
+	ibb-supply = <&lcdb_ncp_vreg>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,panel-mode-gpio = <&tlmm 91 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_truly_video>;
+	wqhd-vddio-supply = <&pm660_l11>;
+	lab-supply = <&lcdb_ldo_vreg>;
+	ibb-supply = <&lcdb_ncp_vreg>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,panel-mode-gpio = <&tlmm 91 0>;
+};
+
+&usb3 {
+	extcon = <&pm660_pdphy>;
+};
+
+&qusb_phy0 {
+	vdd-supply = <&pm660l_l1>;
+	vdda18-supply = <&pm660_l10>;
+	qcom,vdd-voltage-level = <0 925000 925000>;
+	vdda33-supply = <&pm660l_l7>;
+};
+
+&ssphy {
+	vdd-supply = <&pm660l_l1>;
+	qcom,vdd-voltage-level = <0 925000 925000>;
+	core-supply = <&pm660_l1>;
+};
+
+&pm660l_gpios {
+	/* GPIO 7 for VOL_UP */
+	gpio@c600 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+};
+
+&soc {
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+		status = "okay";
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm660l_gpios 7 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+};
+
+&pm660l_wled {
+	qcom,led-strings-list = [01 02];
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660-qrd.dts b/arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660-qrd.dts
new file mode 100644
index 000000000000..9376f52e0737
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660-qrd.dts
@@ -0,0 +1,219 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8998-v2.1-interposer-sdm660.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-v2.1-interposer-sdm660-qrd.dtsi"
+#include "msm8998-interposer-pm660.dtsi"
+#include "msm8998-interposer-sdm660-audio.dtsi"
+#include "msm8998-interposer-camera-sensor-qrd.dtsi"
+
+/ {
+	model =
+	"Qualcomm Technologies, Inc. MSM 8998 v2.1 SDM 660 Interposer QRD";
+	compatible = "qcom,msm8998-qrd", "qcom,msm8998", "qcom,qrd";
+	qcom,board-id = <0x03000b 0x80>;
+};
+
+&clock_gcc {
+	vdd_dig-supply = <&pm660l_s3_level>;
+	vdd_dig_ao-supply = <&pm660l_s3_level_ao>;
+};
+
+&clock_mmss {
+	vdd_dig-supply = <&pm660l_s3_level>;
+	vdd_mmsscc_mx-supply = <&pm660l_s5_level>;
+};
+
+&clock_gpu {
+	vdd_dig-supply = <&pm660l_s3_level>;
+};
+
+&clock_gfx {
+	/* GFX Rail = CX */
+	vdd_gpucc-supply = <&pm660l_s3_level>;
+	vdd_mx-supply = <&pm660l_s5_level>;
+	vdd_gpu_mx-supply = <&pm660l_s5_level>;
+	qcom,gfxfreq-speedbin0 =
+		<         0 0                           0 >,
+		< 180000000 RPM_SMD_REGULATOR_LEVEL_MIN_SVS
+					RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 257000000 RPM_SMD_REGULATOR_LEVEL_LOW_SVS
+					RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 342000000 RPM_SMD_REGULATOR_LEVEL_SVS
+					RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 414000000 RPM_SMD_REGULATOR_LEVEL_SVS_PLUS
+					RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 515000000 RPM_SMD_REGULATOR_LEVEL_NOM
+					RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 596000000 RPM_SMD_REGULATOR_LEVEL_NOM_PLUS
+					RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 670000000 RPM_SMD_REGULATOR_LEVEL_TURBO
+					RPM_SMD_REGULATOR_LEVEL_TURBO >,
+		< 710000000 RPM_SMD_REGULATOR_LEVEL_TURBO
+					RPM_SMD_REGULATOR_LEVEL_TURBO >;
+	qcom,gfxfreq-mx-speedbin0 =
+		<         0                           0 >,
+		< 180000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 257000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 342000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 414000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 515000000 RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 596000000 RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 670000000 RPM_SMD_REGULATOR_LEVEL_TURBO >,
+		< 710000000 RPM_SMD_REGULATOR_LEVEL_TURBO >;
+};
+
+&gdsc_gpu_gx {
+	clock-names = "core_root_clk";
+	clocks = <&clock_gfx clk_gfx3d_clk_src>;
+	qcom,force-enable-root-clk;
+	/* GFX Rail = CX */
+	parent-supply = <&pm660l_s3_level>;
+	status = "ok";
+};
+
+&usb3 {
+	extcon = <&pm660_pdphy>;
+};
+
+&qusb_phy0 {
+	vdd-supply = <&pm660l_l1>;
+	vdda18-supply = <&pm660_l10>;
+	qcom,vdd-voltage-level = <0 925000 925000>;
+	vdda33-supply = <&pm660l_l7>;
+};
+
+&ssphy {
+	vdd-supply = <&pm660l_l1>;
+	qcom,vdd-voltage-level = <0 925000 925000>;
+	core-supply = <&pm660_l1>;
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm660l_l5>;
+	vdd-io-supply = <&pm660l_l2>;
+};
+
+&pm660l_gpios {
+	/* GPIO 7 for VOL_UP */
+	gpio@c600 {
+		status = "ok";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+};
+
+&soc {
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+		status = "ok";
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm660l_gpios 7 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+};
+
+/ {
+	qrd_batterydata: qcom,battery-data {
+		qcom,batt-id-range-pct = <15>;
+
+		#include "fg-gen3-batterydata-qrd-skuk-4v4-3000mah.dtsi"
+	};
+};
+
+&pm660_fg {
+	qcom,battery-data = <&qrd_batterydata>;
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+	vdda-1p2-supply = <&pm660_l1>;
+	vdda-0p9-supply = <&pm660l_l1>;
+
+	qcom,ctrl-supply-entries {
+		qcom,ctrl-supply-entry@0 {
+			qcom,supply-min-voltage = <1200000>;
+			qcom,supply-max-voltage = <1250000>;
+		};
+	};
+
+	qcom,phy-supply-entries {
+		qcom,phy-supply-entry@0 {
+			qcom,supply-min-voltage = <880000>;
+			qcom,supply-max-voltage = <925000>;
+		};
+	};
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt36850_truly_cmd>;
+	wqhd-vddio-supply = <&pm660_l11>;
+	lab-supply = <&lcdb_ldo_vreg>;
+	ibb-supply = <&lcdb_ncp_vreg>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt36850_truly_cmd>;
+	wqhd-vddio-supply = <&pm660_l11>;
+	lab-supply = <&lcdb_ldo_vreg>;
+	ibb-supply = <&lcdb_ncp_vreg>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+};
+
+&pm660l_wled {
+	qcom,led-strings-list = [00 01];
+};
+
+&tasha_snd {
+	qcom,model = "msmfalcon-tasha-skus-snd-card";
+	qcom,audio-routing =
+		"AIF4 VI", "MCLK",
+		"RX_BIAS", "MCLK",
+		"MADINPUT", "MCLK",
+		"AMIC2", "MIC BIAS2",
+		"MIC BIAS2", "Headset Mic",
+		"DMIC0", "MIC BIAS1",
+		"MIC BIAS1", "Digital Mic0",
+		"DMIC2", "MIC BIAS3",
+		"MIC BIAS3", "Digital Mic2",
+		"DMIC4", "MIC BIAS3",
+		"MIC BIAS3", "Digital Mic4",
+		"SpkrLeft IN", "SPK1 OUT";
+	qcom,msm-mbhc-hphl-swh = <1>;
+	/delete-property/ qcom,us-euro-gpios;
+	qcom,wsa-max-devs = <1>;
+	qcom,wsa-devs = <&wsa881x_211>, <&wsa881x_213>;
+	qcom,wsa-aux-dev-prefix = "SpkrLeft", "SpkrLeft";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660-qrd.dtsi b/arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660-qrd.dtsi
new file mode 100644
index 000000000000..c92872648709
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660-qrd.dtsi
@@ -0,0 +1,175 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/irq.h>
+#include "msm8998-v2.1-interposer-sdm660.dtsi"
+#include "msm8998-camera-sensor-mtp.dtsi"
+
+/ {
+	bluetooth: bt_wcn3990 {
+		compatible = "qca,wcn3990";
+		qca,bt-vdd-core-supply = <&pm660_l9_pin_ctrl>;
+		qca,bt-vdd-pa-supply = <&pm660_l6_pin_ctrl>;
+		qca,bt-vdd-ldo-supply = <&pm660_l19_pin_ctrl>;
+		qca,bt-chip-pwd-supply = <&pm660l_bob_pin1>;
+		clocks = <&clock_gcc clk_rf_clk1>;
+		clock-names = "rf_clk1";
+
+		qca,bt-vdd-core-voltage-level = <1800000 1900000>;
+		qca,bt-vdd-pa-voltage-level = <1304000 1370000>;
+		qca,bt-vdd-ldo-voltage-level = <3312000 3400000>;
+		qca,bt-chip-pwd-voltage-level = <3600000 3600000>;
+
+		qca,bt-vdd-core-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-pa-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-ldo-current-level = <1>; /* LPM/PFM */
+	};
+};
+
+&blsp1_uart3_hs {
+	status = "ok";
+};
+
+&uartblsp2dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm660l_l1>;
+	vdda-pll-supply = <&pm660_l1>;
+	vddp-ref-clk-supply = <&pm660_l1>;
+	vdda-phy-max-uv = <925000>;
+	vdda-phy-min-uv = <800000>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14600>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm660l_l4>;
+	vccq2-supply = <&pm660_l8>;
+	vcc-max-microamp = <500000>;
+	vccq2-max-microamp = <600000>;
+	status = "ok";
+};
+
+&ufs_ice {
+	status = "ok";
+};
+
+&sdhc_2 {
+	vdd-supply = <&pm660l_l5>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 800000>;
+
+	vdd-io-supply = <&pm660l_l2>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on  &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000
+				50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	cd-gpios = <&tlmm 95 0x0>;
+
+	status = "ok";
+};
+
+
+&i2c_5 {
+	status = "okay";
+	synaptics@20 {
+		compatible = "synaptics,dsx";
+		reg = <0x20>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <125 0x2008>;
+		avdd-supply = <&pm660l_l3>;
+		vdd-supply = <&pm660_l11>;
+		synaptics,vdd-voltage = <1880000 1880000>;
+		synaptics,avdd-voltage = <3000000 3008000>;
+		synaptics,vdd-current = <40000>;
+		synaptics,avdd-current = <20000>;
+		/* pins used by touchscreen */
+		pinctrl-names = "pmx_ts_active", "pmx_ts_suspend",
+			"pmx_ts_release";
+		pinctrl-0 = <&ts_int_active &ts_reset_active>;
+		pinctrl-1 = <&ts_int_suspend1 &ts_reset_suspend1>;
+		pinctrl-2 = <&ts_release>;
+		synaptics,display-coords = <0 0 1439 2559>;
+		synaptics,panel-coords = <0 0 1439 2779>;
+		synaptics,irq-gpio = <&tlmm 125 0x2008>;
+		synaptics,reset-gpio = <&tlmm 89 0x0>;
+		synaptics,i2c-pull-up;
+		synaptics,disable-gpios;
+		synaptics,button-map = <139 172 158>;
+	};
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_fb0 {
+	qcom,mdss-mixer-swap;
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+	vdda-1p2-supply = <&pm660_l1>;
+	vdda-0p9-supply = <&pm660l_l1>;
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt36850_truly_cmd>;
+	wqhd-vddio-supply = <&pm660_l11>;
+	lab-supply = <&lcdb_ldo_vreg>;
+	ibb-supply = <&lcdb_ncp_vreg>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt36850_truly_cmd>;
+	wqhd-vddio-supply = <&pm660_l11>;
+	lab-supply = <&lcdb_ldo_vreg>;
+	ibb-supply = <&lcdb_ncp_vreg>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+};
+
+&labibb {
+	status = "ok";
+	qcom,qpnp-labibb-mode = "lcd";
+};
+
+&dsi_dual_nt36850_truly_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660.dtsi b/arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660.dtsi
new file mode 100644
index 000000000000..8adbff55fead
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2.1-interposer-sdm660.dtsi
@@ -0,0 +1,18 @@
+/* Copyright (c) 2016 The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8998-v2-interposer-sdm660.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM8998 v2.1";
+	qcom,msm-id = <292 0x20001>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2.1-mtp-4k-display.dts b/arch/arm64/boot/dts/qcom/msm8998-v2.1-mtp-4k-display.dts
new file mode 100644
index 000000000000..eb2d812aa1f8
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2.1-mtp-4k-display.dts
@@ -0,0 +1,52 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8998-v2.1.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v2.1 MTP, 4k display";
+	compatible = "qcom,msm8998-mtp", "qcom,msm8998", "qcom,mtp";
+	qcom,board-id = <8 4>;
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_sharp_4k_dsc_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,panel-mode-gpio = <&tlmm 91 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_sharp_4k_dsc_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 94 0>;
+	qcom,platform-te-gpio = <&tlmm 10 0>;
+	qcom,panel-mode-gpio = <&tlmm 91 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2.1-mtp-overlay.dts b/arch/arm64/boot/dts/qcom/msm8998-v2.1-mtp-overlay.dts
new file mode 100644
index 000000000000..5f17f73df8d6
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2.1-mtp-overlay.dts
@@ -0,0 +1,29 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/msm-clocks-8998.h>
+#include <dt-bindings/regulator/qcom,rpm-smd-regulator.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v2.1 MTP";
+	compatible = "qcom,msm8998-mtp", "qcom,msm8998", "qcom,mtp";
+	qcom,msm-id = <292 0x20001>;
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2.1-mtp.dts b/arch/arm64/boot/dts/qcom/msm8998-v2.1-mtp.dts
new file mode 100644
index 000000000000..0bf3e62766c4
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2.1-mtp.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8998-v2.1.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v2.1 MTP";
+	compatible = "qcom,msm8998-mtp", "qcom,msm8998", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2.1-qrd.dts b/arch/arm64/boot/dts/qcom/msm8998-v2.1-qrd.dts
new file mode 100644
index 000000000000..4d64740143e8
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2.1-qrd.dts
@@ -0,0 +1,24 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msm8998-v2.1.dtsi"
+#include "msm8998-mdss-panels.dtsi"
+#include "msm8998-qrd.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v2.1 QRD";
+	compatible = "qcom,msm8998-qrd", "qcom,msm8998", "qcom,qrd";
+	qcom,board-id = <11 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2.1.dts b/arch/arm64/boot/dts/qcom/msm8998-v2.1.dts
new file mode 100644
index 000000000000..64559c71307f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2.1.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include <dt-bindings/clock/msm-clocks-8998.h>
+#include "msm8998-v2.1.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v2.1 SoC";
+	compatible = "qcom,msm8998";
+	qcom,board-id = <0 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2.1.dtsi b/arch/arm64/boot/dts/qcom/msm8998-v2.1.dtsi
new file mode 100644
index 000000000000..563157df40a8
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2.1.dtsi
@@ -0,0 +1,18 @@
+/* Copyright (c) 2016 The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8998-v2.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM8998 v2.1";
+	qcom,msm-id = <292 0x20001>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2.dts b/arch/arm64/boot/dts/qcom/msm8998-v2.dts
new file mode 100644
index 000000000000..f1b5af9f14c8
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include <dt-bindings/clock/msm-clocks-8998.h>
+#include "msm8998-v2.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v2 SoC";
+	compatible = "qcom,msm8998";
+	qcom,board-id = <0 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-v2.dtsi b/arch/arm64/boot/dts/qcom/msm8998-v2.dtsi
new file mode 100644
index 000000000000..abc0247b4475
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-v2.dtsi
@@ -0,0 +1,1319 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only version-specific property overrides should be placed
+ * inside this file. Common device definitions should be placed inside the
+ * msm8998.dtsi file.
+ */
+
+#include "msm8998.dtsi"
+#include "msm8998-v2-camera.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM8998 v2";
+	qcom,msm-id = <292 0x20000>;
+};
+
+&clock_cpu {
+	compatible = "qcom,cpu-clock-osm-msm8998-v2";
+	reg = <0x179c0000 0x4000>,
+	      <0x17916000 0x1000>,
+	      <0x17816000 0x1000>,
+	      <0x179d1000 0x1000>,
+	      <0x17914800 0x800>,
+	      <0x17814800 0x800>,
+	      <0x00784130 0x8>,
+	      <0x1791101c 0x8>;
+	reg-names = "osm", "pwrcl_pll", "perfcl_pll",
+		    "apcs_common", "pwrcl_acd", "perfcl_acd",
+		    "perfcl_efuse", "debug";
+
+	qcom,acdtd-val = <0x00009611 0x00009611>;
+	qcom,acdcr-val = <0x002b5ffd 0x002b5ffd>;
+	qcom,acdsscr-val = <0x00000501 0x00000501>;
+	qcom,acdextint0-val = <0x2cf9ae8 0x2cf9ae8>;
+	qcom,acdextint1-val = <0x2cf9afe 0x2cf9afe>;
+	qcom,acdautoxfer-val = <0x00000015 0x00000015>;
+	qcom,pwrcl-apcs-mem-acc-threshold-voltage = <852000>;
+	qcom,perfcl-apcs-mem-acc-threshold-voltage = <852000>;
+	qcom,apm-threshold-voltage = <800000>;
+
+	/delete-property/ qcom,llm-sw-overr;
+	qcom,pwrcl-speedbin0-v0 =
+		<   300000000 0x0004000f 0x01200020 0x1 1 >,
+		<   364800000 0x05040013 0x01200020 0x1 2 >,
+		<   441600000 0x05040017 0x02200020 0x1 3 >,
+		<   518400000 0x0504001b 0x02200020 0x1 4 >,
+		<   595200000 0x0504001f 0x02200020 0x1 5 >,
+		<   672000000 0x05040023 0x03200020 0x1 6 >,
+		<   748800000 0x05040027 0x03200020 0x1 7 >,
+		<   825600000 0x0404002b 0x03220022 0x1 8 >,
+		<   883200000 0x0404002e 0x04250025 0x1 9 >,
+		<   960000000 0x04040032 0x04280028 0x1 10 >,
+		<  1036800000 0x04040036 0x042b002b 0x1 11 >,
+		<  1094400000 0x04040039 0x052e002e 0x2 12 >,
+		<  1171200000 0x0404003d 0x05310031 0x2 13 >,
+		<  1248000000 0x04040041 0x05340034 0x2 14 >,
+		<  1324800000 0x04040045 0x06370037 0x2 15 >,
+		<  1401600000 0x04040049 0x063a003a 0x2 16 >,
+		<  1478400000 0x0404004d 0x073e003e 0x2 17 >,
+		<  1555200000 0x04040051 0x07410041 0x2 18 >,
+		<  1670400000 0x04040057 0x08460046 0x2 19 >,
+		<  1747200000 0x0404005b 0x08490049 0x2 20 >,
+		<  1824000000 0x0404005f 0x084c004c 0x3 21 >,
+		<  1900800000 0x04040063 0x094f004f 0x3 22 >;
+
+	qcom,perfcl-speedbin0-v0 =
+		<   300000000 0x0004000f 0x01200020 0x1 1 >,
+		<   345600000 0x05040012 0x01200020 0x1 2 >,
+		<   422400000 0x05040016 0x02200020 0x1 3 >,
+		<   499200000 0x0504001a 0x02200020 0x1 4 >,
+		<   576000000 0x0504001e 0x02200020 0x1 5 >,
+		<   652800000 0x05040022 0x03200020 0x1 6 >,
+		<   729600000 0x05040026 0x03200020 0x1 7 >,
+		<   806400000 0x0504002a 0x03220022 0x1 8 >,
+		<   902400000 0x0404002f 0x04260026 0x1 9 >,
+		<   979200000 0x04040033 0x04290029 0x1 10 >,
+		<  1056000000 0x04040037 0x052c002c 0x1 11 >,
+		<  1132800000 0x0404003b 0x052f002f 0x1 12 >,
+		<  1190400000 0x0404003e 0x05320032 0x2 13 >,
+		<  1267200000 0x04040042 0x06350035 0x2 14 >,
+		<  1344000000 0x04040046 0x06380038 0x2 15 >,
+		<  1420800000 0x0404004a 0x063b003b 0x2 16 >,
+		<  1497600000 0x0404004e 0x073e003e 0x2 17 >,
+		<  1574400000 0x04040052 0x07420042 0x2 18 >,
+		<  1651200000 0x04040056 0x07450045 0x2 19 >,
+		<  1728000000 0x0404005a 0x08480048 0x2 20 >,
+		<  1804800000 0x0404005e 0x084b004b 0x2 21 >,
+		<  1881600000 0x04040062 0x094e004e 0x2 22 >,
+		<  1958400000 0x04040066 0x09520052 0x2 23 >,
+		<  2035200000 0x0404006a 0x09550055 0x3 24 >,
+		<  2112000000 0x0404006e 0x0a580058 0x3 25 >,
+		<  2208000000 0x04040073 0x0a5c005c 0x3 26 >,
+		<  2265600000 0x04010076 0x0a5e005e 0x3 26 >,
+		<  2265600000 0x04040076 0x0a5e005e 0x3 27 >,
+		<  2342400000 0x0401007a 0x0a620062 0x3 27 >,
+		<  2342400000 0x0404007a 0x0a620062 0x3 28 >,
+		<  2419200000 0x0401007e 0x0a650065 0x3 28 >,
+		<  2419200000 0x0404007e 0x0a650065 0x3 29 >,
+		<  2496000000 0x04010082 0x0a680068 0x3 29 >,
+		<  2457600000 0x04040080 0x0a660066 0x3 30 >,
+		<  2553600000 0x04010085 0x0a6a006a 0x3 30 >,
+		<  2476800000 0x04040081 0x0a670067 0x3 31 >,
+		<  2572800000 0x04010086 0x0a6b006b 0x3 31 >,
+		<  2496000000 0x04040082 0x0a680068 0x3 32 >,
+		<  2592000000 0x04010087 0x0a6c006c 0x3 32 >;
+
+	qcom,perfcl-speedbin1-v0 =
+		<   300000000 0x0004000f 0x01200020 0x1 1 >,
+		<   345600000 0x05040012 0x01200020 0x1 2 >,
+		<   422400000 0x05040016 0x02200020 0x1 3 >,
+		<   499200000 0x0504001a 0x02200020 0x1 4 >,
+		<   576000000 0x0504001e 0x02200020 0x1 5 >,
+		<   652800000 0x05040022 0x03200020 0x1 6 >,
+		<   729600000 0x05040026 0x03200020 0x1 7 >,
+		<   806400000 0x0504002a 0x03220022 0x1 8 >,
+		<   902400000 0x0404002f 0x04260026 0x1 9 >,
+		<   979200000 0x04040033 0x04290029 0x1 10 >,
+		<  1056000000 0x04040037 0x052c002c 0x1 11 >,
+		<  1132800000 0x0404003b 0x052f002f 0x1 12 >,
+		<  1190400000 0x0404003e 0x05320032 0x2 13 >,
+		<  1267200000 0x04040042 0x06350035 0x2 14 >,
+		<  1344000000 0x04040046 0x06380038 0x2 15 >,
+		<  1420800000 0x0404004a 0x063b003b 0x2 16 >,
+		<  1497600000 0x0404004e 0x073e003e 0x2 17 >,
+		<  1574400000 0x04040052 0x07420042 0x2 18 >,
+		<  1651200000 0x04040056 0x07450045 0x2 19 >,
+		<  1728000000 0x0404005a 0x08480048 0x2 20 >,
+		<  1804800000 0x0404005e 0x084b004b 0x2 21 >,
+		<  1881600000 0x04040062 0x094e004e 0x2 22 >,
+		<  1958400000 0x04040066 0x09520052 0x2 23 >,
+		<  2035200000 0x0404006a 0x09550055 0x3 24 >,
+		<  2112000000 0x0404006e 0x0a580058 0x3 25 >,
+		<  2208000000 0x04040073 0x0a5c005c 0x3 26 >,
+		<  2304000000 0x04010078 0x0a600060 0x3 26 >;
+
+	qcom,perfcl-speedbin2-v0 =
+		<   300000000 0x0004000f 0x01200020 0x1 1 >,
+		<   345600000 0x05040012 0x01200020 0x1 2 >,
+		<   422400000 0x05040016 0x02200020 0x1 3 >,
+		<   499200000 0x0504001a 0x02200020 0x1 4 >,
+		<   576000000 0x0504001e 0x02200020 0x1 5 >,
+		<   652800000 0x05040022 0x03200020 0x1 6 >,
+		<   729600000 0x05040026 0x03200020 0x1 7 >,
+		<   806400000 0x0504002a 0x03220022 0x1 8 >,
+		<   902400000 0x0404002f 0x04260026 0x1 9 >,
+		<   979200000 0x04040033 0x04290029 0x1 10 >,
+		<  1056000000 0x04040037 0x052c002c 0x1 11 >,
+		<  1132800000 0x0404003b 0x052f002f 0x1 12 >,
+		<  1190400000 0x0404003e 0x05320032 0x2 13 >,
+		<  1267200000 0x04040042 0x06350035 0x2 14 >,
+		<  1344000000 0x04040046 0x06380038 0x2 15 >,
+		<  1420800000 0x0404004a 0x063b003b 0x2 16 >,
+		<  1497600000 0x0404004e 0x073e003e 0x2 17 >,
+		<  1574400000 0x04040052 0x07420042 0x2 18 >,
+		<  1651200000 0x04040056 0x07450045 0x2 19 >,
+		<  1728000000 0x0404005a 0x08480048 0x2 20 >,
+		<  1804800000 0x0404005e 0x084b004b 0x2 21 >,
+		<  1881600000 0x04040062 0x094e004e 0x2 22 >,
+		<  1958400000 0x04040066 0x09520052 0x2 23 >,
+		<  2035200000 0x0404006a 0x09550055 0x3 24 >,
+		<  2112000000 0x0404006e 0x0a580058 0x3 25 >,
+		<  2208000000 0x04040073 0x0a5c005c 0x3 26 >,
+		<  2265600000 0x04010076 0x0a5e005e 0x3 26 >,
+		<  2265600000 0x04040076 0x0a5e005e 0x3 27 >,
+		<  2342400000 0x0401007a 0x0a620062 0x3 27 >,
+		<  2323200000 0x04040079 0x0a610061 0x3 28 >,
+		<  2419200000 0x0401007e 0x0a650065 0x3 28 >,
+		<  2342400000 0x0404007a 0x0a620062 0x3 29 >,
+		<  2438400000 0x0401007f 0x0a660066 0x3 29 >,
+		<  2361600000 0x0404007b 0x0a620062 0x3 30 >,
+		<  2457600000 0x04010080 0x0a660066 0x3 30 >;
+
+	qcom,perfcl-speedbin3-v0 =
+		<   300000000 0x0004000f 0x01200020 0x1 1 >,
+		<   345600000 0x05040012 0x01200020 0x1 2 >,
+		<   422400000 0x05040016 0x02200020 0x1 3 >,
+		<   499200000 0x0504001a 0x02200020 0x1 4 >,
+		<   576000000 0x0504001e 0x02200020 0x1 5 >,
+		<   652800000 0x05040022 0x03200020 0x1 6 >,
+		<   729600000 0x05040026 0x03200020 0x1 7 >,
+		<   806400000 0x0504002a 0x03220022 0x1 8 >,
+		<   902400000 0x0404002f 0x04260026 0x1 9 >,
+		<   979200000 0x04040033 0x04290029 0x1 10 >,
+		<  1056000000 0x04040037 0x052c002c 0x1 11 >,
+		<  1132800000 0x0404003b 0x052f002f 0x1 12 >,
+		<  1190400000 0x0404003e 0x05320032 0x2 13 >,
+		<  1267200000 0x04040042 0x06350035 0x2 14 >,
+		<  1344000000 0x04040046 0x06380038 0x2 15 >,
+		<  1420800000 0x0404004a 0x063b003b 0x2 16 >,
+		<  1497600000 0x0404004e 0x073e003e 0x2 17 >,
+		<  1574400000 0x04040052 0x07420042 0x2 18 >,
+		<  1651200000 0x04040056 0x07450045 0x2 19 >,
+		<  1728000000 0x0404005a 0x08480048 0x2 20 >,
+		<  1804800000 0x0404005e 0x084b004b 0x2 21 >,
+		<  1881600000 0x04040062 0x094e004e 0x2 22 >,
+		<  1958400000 0x04040066 0x09520052 0x2 23 >,
+		<  2035200000 0x0404006a 0x09550055 0x3 24 >,
+		<  2112000000 0x0404006e 0x0a580058 0x3 25 >,
+		<  2208000000 0x04040073 0x0a5c005c 0x3 26 >,
+		<  2265600000 0x04010076 0x0a5e005e 0x3 26 >,
+		<  2265600000 0x04040076 0x0a5e005e 0x3 27 >,
+		<  2342400000 0x0401007a 0x0a620062 0x3 27 >,
+		<  2323200000 0x04040079 0x0a610061 0x3 28 >,
+		<  2419200000 0x0401007e 0x0a650065 0x3 28 >,
+		<  2342400000 0x0404007a 0x0a620062 0x3 29 >,
+		<  2438400000 0x0401007f 0x0a660066 0x3 29 >,
+		<  2361600000 0x0404007b 0x0a620062 0x3 30 >,
+		<  2457600000 0x04010080 0x0a660066 0x3 30 >;
+};
+
+&msm_cpufreq {
+	qcom,cpufreq-table-0 =
+		<   300000 >,
+		<   364800 >,
+		<   441600 >,
+		<   518400 >,
+		<   595200 >,
+		<   672000 >,
+		<   748800 >,
+		<   825600 >,
+		<   883200 >,
+		<   960000 >,
+		<  1036800 >,
+		<  1094400 >,
+		<  1171200 >,
+		<  1248000 >,
+		<  1324800 >,
+		<  1401600 >,
+		<  1478400 >,
+		<  1555200 >,
+		<  1670400 >,
+		<  1747200 >,
+		<  1824000 >,
+		<  1900800 >;
+
+	qcom,cpufreq-table-4 =
+		<   300000 >,
+		<   345600 >,
+		<   422400 >,
+		<   499200 >,
+		<   576000 >,
+		<   652800 >,
+		<   729600 >,
+		<   806400 >,
+		<   902400 >,
+		<   979200 >,
+		<  1056000 >,
+		<  1132800 >,
+		<  1190400 >,
+		<  1267200 >,
+		<  1344000 >,
+		<  1420800 >,
+		<  1497600 >,
+		<  1574400 >,
+		<  1651200 >,
+		<  1728000 >,
+		<  1804800 >,
+		<  1881600 >,
+		<  1958400 >,
+		<  2035200 >,
+		<  2112000 >,
+		<  2208000 >,
+		<  2265600 >,
+		<  2304000 >,
+		<  2323200 >,
+		<  2342400 >,
+		<  2361600 >,
+		<  2419200 >,
+		<  2457600 >,
+		<  2476800 >,
+		<  2496000 >,
+		<  2592000 >;
+};
+
+&bwmon {
+	compatible = "qcom,bimc-bwmon4";
+	qcom,hw-timer-hz = <19200000>;
+};
+
+&devfreq_cpufreq {
+	mincpubw-cpufreq {
+		cpu-to-dev-map-0 =
+			< 1900800 1525 >;
+		cpu-to-dev-map-4 =
+			< 2112000 1525 >,
+			< 2342400 5195 >,
+			< 2496000 13763 >;
+		};
+};
+
+&devfreq_memlat_0 {
+	qcom,core-dev-table =
+		<  300000 1525 >,
+		<  595200 3143 >,
+		< 1324800 4173 >,
+		< 1555200 5859 >,
+		< 1747200 5859 >,
+		< 1900800 7759 >;
+};
+
+&devfreq_memlat_4 {
+	qcom,core-dev-table =
+		<  576000  3143 >,
+		< 1132800  4173 >,
+		< 1344000  5859 >,
+		< 1728000  7759 >,
+		< 1958400 11863 >,
+		< 2208000 13763 >;
+};
+&clock_gcc {
+	compatible = "qcom,gcc-8998-v2";
+};
+
+&clock_mmss {
+	compatible = "qcom,mmsscc-8998-v2";
+};
+
+&clock_gpu {
+	compatible = "qcom,gpucc-8998-v2";
+};
+
+&clock_gfx {
+	compatible = "qcom,gfxcc-8998-v2";
+	qcom,gfxfreq-speedbin0 =
+		<         0 0                           0 >,
+		< 180000000 1 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 257000000 2 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 342000000 3 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 414000000 4 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 515000000 5 RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 596000000 6 RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 670000000 7 RPM_SMD_REGULATOR_LEVEL_TURBO >,
+		< 710000000 8 RPM_SMD_REGULATOR_LEVEL_TURBO >;
+	qcom,gfxfreq-mx-speedbin0 =
+		<         0                           0 >,
+		< 180000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 257000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 342000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 414000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 515000000 RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 596000000 RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 670000000 RPM_SMD_REGULATOR_LEVEL_TURBO >,
+		< 710000000 RPM_SMD_REGULATOR_LEVEL_TURBO >;
+};
+
+&mdss_mdp {
+	qcom,vbif-settings = <0x00d0 0x00002020>;
+	qcom,max-bandwidth-low-kbps = <9400000>;
+	qcom,max-bandwidth-high-kbps = <9400000>;
+	qcom,max-bandwidth-per-pipe-kbps = <4700000>;
+};
+
+&pm8998_s10 {
+	regulator-min-microvolt = <568000>;
+	regulator-max-microvolt = <1056000>;
+};
+
+&pm8998_s13 {
+	regulator-min-microvolt = <568000>;
+	regulator-max-microvolt = <1136000>;
+};
+
+&pcie0 {
+	qcom,phy-sequence = <0x804 0x01 0x00
+				0x034 0x14 0x00
+				0x138 0x30 0x00
+				0x048 0x0f 0x00
+				0x15c 0x06 0x00
+				0x090 0x01 0x00
+				0x088 0x20 0x00
+				0x0f0 0x00 0x00
+				0x0f8 0x01 0x00
+				0x0f4 0xc9 0x00
+				0x11c 0xff 0x00
+				0x120 0x3f 0x00
+				0x164 0x01 0x00
+				0x154 0x00 0x00
+				0x148 0x0a 0x00
+				0x05C 0x19 0x00
+				0x038 0x90 0x00
+				0x0b0 0x82 0x00
+				0x0c0 0x03 0x00
+				0x0bc 0x55 0x00
+				0x0b8 0x55 0x00
+				0x0a0 0x00 0x00
+				0x09c 0x0d 0x00
+				0x098 0x04 0x00
+				0x13c 0x00 0x00
+				0x060 0x08 0x00
+				0x068 0x16 0x00
+				0x070 0x34 0x00
+				0x15c 0x06 0x00
+				0x138 0x33 0x00
+				0x03c 0x02 0x00
+				0x040 0x07 0x00
+				0x080 0x04 0x00
+				0x0dc 0x00 0x00
+				0x0d8 0x3f 0x00
+				0x00c 0x09 0x00
+				0x010 0x01 0x00
+				0x01c 0x40 0x00
+				0x020 0x01 0x00
+				0x014 0x02 0x00
+				0x018 0x00 0x00
+				0x024 0x7e 0x00
+				0x028 0x15 0x00
+				0x244 0x02 0x00
+				0x2a4 0x12 0x00
+				0x260 0x10 0x00
+				0x28c 0x06 0x00
+				0x504 0x03 0x00
+				0x500 0x1c 0x00
+				0x50c 0x14 0x00
+				0x4d4 0x0a 0x00
+				0x4d8 0x04 0x00
+				0x4dc 0x1a 0x00
+				0x434 0x4b 0x00
+				0x414 0x04 0x00
+				0x40c 0x04 0x00
+				0x4f8 0x00 0x00
+				0x4fc 0x80 0x00
+				0x51c 0x40 0x00
+				0x444 0x71 0x00
+				0x43c 0x40 0x00
+				0x854 0x04 0x00
+				0x62c 0x52 0x00
+				0x9ac 0x00 0x00
+				0x8a0 0x01 0x00
+				0x9e0 0x00 0x00
+				0x9dc 0x20 0x00
+				0x9a8 0x00 0x00
+				0x8a4 0x01 0x00
+				0x8a8 0x73 0x00
+				0x9d8 0x99 0x00
+				0x9b0 0x03 0x00
+				0x804 0x03 0x00
+				0x800 0x00 0x00
+				0x808 0x03 0x00>;
+};
+
+&apc0_cpr {
+	compatible = "qcom,cprh-msm8998-v2-kbss-regulator";
+	qcom,cpr-corner-switch-delay-time = <1042>;
+	qcom,cpr-aging-ref-voltage = <1056000>;
+	qcom,apm-threshold-voltage = <800000>;
+	qcom,apm-hysteresis-voltage = <0>;
+	qcom,mem-acc-threshold-voltage = <852000>;
+	qcom,mem-acc-crossover-voltage = <852000>;
+};
+
+&apc0_pwrcl_vreg {
+	regulator-max-microvolt = <23>;
+
+	qcom,cpr-fuse-combos = <32>;
+	qcom,cpr-speed-bins = <4>;
+	qcom,cpr-speed-bin-corners = <22 22 22 22>;
+	qcom,cpr-corners = <22>;
+
+	qcom,cpr-corner-fmax-map = <8 11 18 22>;
+
+	qcom,cpr-voltage-ceiling =
+		<828000  828000  828000  828000  828000
+		 828000  828000  828000  828000  828000
+		 828000  900000  900000  900000  900000
+		 900000  900000  900000  952000  952000
+		1056000 1056000>;
+
+	qcom,cpr-voltage-floor =
+		<568000  568000  568000  568000  568000
+		 568000  568000  568000  568000  568000
+		 568000  632000  632000  632000  632000
+		 632000  632000  632000  712000  712000
+		 772000  772000>;
+
+	qcom,cpr-floor-to-ceiling-max-range =
+		<32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 32000  32000  40000  40000
+		 40000  40000>;
+
+	qcom,corner-frequencies =
+		<300000000  364800000  441600000
+		 518400000  595200000  672000000
+		 748800000  825600000  883200000
+		 960000000 1036800000 1094400000
+		1171200000 1248000000 1324800000
+		1401600000 1478400000 1555200000
+		1670400000 1747200000 1824000000
+		1900800000>;
+
+	qcom,cpr-ro-scaling-factor =
+		<2595 2794 2577 2762 2471 2674 2199
+		 2553 3189 3255 3192 2962 3054 2982
+		 2042 2945>,
+		<2595 2794 2577 2762 2471 2674 2199
+		 2553 3189 3255 3192 2962 3054 2982
+		 2042 2945>,
+		<2391 2550 2483 2638 2382 2564 2259
+		 2555 2766 3041 2988 2935 2873 2688
+		 2013 2784>,
+		<2066 2153 2300 2434 2220 2386 2288
+		 2465 2028 2511 2487 2734 2554 2117
+		 1892 2377>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		/* Speed bin 0 */
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		/* Speed bin 1 */
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		/* Speed bin 2 */
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		/* Speed bin 3 */
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>,
+		<40000  24000   12000  30000>;
+
+	qcom,cpr-closed-loop-voltage-fuse-adjustment =
+		/* Speed bin 0 */
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		/* Speed bin 1 */
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		/* Speed bin 2 */
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		/* Speed bin 3 */
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>,
+		<20000  26000   12000  30000>;
+
+	qcom,cpr-open-loop-voltage-adjustment =
+		/* Speed bin 0 */
+		<     0        0        0        0        0
+		      0        0        0        0        0
+		      0  (-12000) (-12000) (-12000) (-12000)
+		(-12000) (-16000) (-16000) (-20000) (-24000)
+		(-28000) (-28000)>,
+		/* Speed bin 1 */
+		<     0        0        0        0        0
+		      0        0        0        0        0
+		      0  (-12000) (-12000) (-12000) (-12000)
+		(-12000) (-16000) (-16000) (-20000) (-24000)
+		(-28000) (-28000)>,
+		/* Speed bin 2 */
+		<     0        0        0        0        0
+		      0        0        0        0        0
+		      0  (-12000) (-12000) (-12000) (-12000)
+		(-12000) (-16000) (-16000) (-20000) (-24000)
+		(-28000) (-28000)>,
+		/* Speed bin 3 */
+		<     0        0        0        0        0
+		      0        0        0        0        0
+		      0  (-12000) (-12000) (-12000) (-12000)
+		(-12000) (-16000) (-16000) (-20000) (-24000)
+		(-28000) (-28000)>;
+
+	qcom,cpr-closed-loop-voltage-adjustment =
+		/* Speed bin 0 */
+		<     0        0        0        0        0
+		      0        0        0        0        0
+		      0  (-10000) (-11000) (-12000) (-13000)
+		(-14000) (-14000) (-15000) (-21000) (-24000)
+		(-26000) (-28000)>,
+		/* Speed bin 1 */
+		<     0        0        0        0        0
+		      0        0        0        0        0
+		      0  (-10000) (-11000) (-12000) (-13000)
+		(-14000) (-14000) (-15000) (-21000) (-24000)
+		(-26000) (-28000)>,
+		/* Speed bin 2 */
+		<     0        0        0        0        0
+		      0        0        0        0        0
+		      0  (-10000) (-11000) (-12000) (-13000)
+		(-14000) (-14000) (-15000) (-21000) (-24000)
+		(-26000) (-28000)>,
+		/* Speed bin 3 */
+		<     0        0        0        0        0
+		      0        0        0        0        0
+		      0  (-10000) (-11000) (-12000) (-13000)
+		(-14000) (-14000) (-15000) (-21000) (-24000)
+		(-26000) (-28000)>;
+
+	qcom,allow-voltage-interpolation;
+	qcom,allow-quotient-interpolation;
+	qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+
+	qcom,cpr-aging-ref-corner = <22>;
+	qcom,cpr-aging-ro-scaling-factor = <1620>;
+	qcom,allow-aging-voltage-adjustment = <0>;
+};
+
+&apc1_cpr {
+	compatible = "qcom,cprh-msm8998-v2-kbss-regulator";
+	qcom,cpr-corner-switch-delay-time = <1042>;
+	qcom,cpr-aging-ref-voltage = <1136000>;
+	qcom,apm-threshold-voltage = <800000>;
+	qcom,apm-hysteresis-voltage = <0>;
+	qcom,mem-acc-threshold-voltage = <852000>;
+	qcom,mem-acc-crossover-voltage = <852000>;
+};
+
+&apc1_perfcl_vreg {
+	regulator-max-microvolt = <34>;
+
+	qcom,cpr-fuse-combos = <32>;
+	qcom,cpr-speed-bins = <4>;
+	qcom,cpr-speed-bin-corners = <32 26 30 31>;
+	qcom,cpr-corners =
+		/* Speed bin 0 */
+		<32 32 32 32 32 32 32 32>,
+		/* Speed bin 1 */
+		<26 26 26 26 26 26 26 26>,
+		/* Speed bin 2 */
+		<30 30 30 30 30 30 30 30>,
+		/* Speed bin 3 */
+		<31 31 31 31 31 31 31 31>;
+
+	qcom,cpr-corner-fmax-map =
+		/* Speed bin 0 */
+		<8 12 20 32>,
+		/* Speed bin 1 */
+		<8 12 20 26>,
+		/* Speed bin 2 */
+		<8 12 20 30>,
+		/* Speed bin 3 */
+		<8 12 20 31>;
+
+	qcom,cpr-voltage-ceiling =
+		/* Speed bin 0 */
+		<828000  828000  828000  828000  828000
+		 828000  828000  828000  828000  828000
+		 828000  828000  900000  900000  900000
+		 900000  900000  900000  900000  900000
+		 952000  952000  952000 1136000 1136000
+		1136000 1136000 1136000 1136000 1136000
+		1136000 1136000>,
+		/* Speed bin 1 */
+		<828000  828000  828000  828000  828000
+		 828000  828000  828000  828000  828000
+		 828000  828000  900000  900000  900000
+		 900000  900000  900000  900000  900000
+		 952000  952000  952000 1136000 1136000
+		1136000>,
+		/* Speed bin 2 */
+		<828000  828000  828000  828000  828000
+		 828000  828000  828000  828000  828000
+		 828000  828000  900000  900000  900000
+		 900000  900000  900000  900000  900000
+		 952000  952000  952000 1136000 1136000
+		1136000 1136000 1136000 1136000 1136000>,
+		/* Speed bin 3 */
+		<828000  828000  828000  828000  828000
+		 828000  828000  828000  828000  828000
+		 828000  828000  900000  900000  900000
+		 900000  900000  900000  900000  900000
+		 952000  952000  952000 1136000 1136000
+		1136000 1136000 1136000 1136000 1136000
+		1136000>;
+
+	qcom,cpr-voltage-floor =
+		/* Speed bin 0 */
+		<568000  568000  568000  568000  568000
+		 568000  568000  568000  568000  568000
+		 568000  568000  632000  632000  632000
+		 632000  632000  632000  632000  632000
+		 712000  712000  712000  772000  772000
+		 772000  772000  772000  772000  772000
+		 772000  772000>,
+		/* Speed bin 1 */
+		<568000  568000  568000  568000  568000
+		 568000  568000  568000  568000  568000
+		 568000  568000  632000  632000  632000
+		 632000  632000  632000  632000  632000
+		 712000  712000  712000  772000  772000
+		 772000>,
+		/* Speed bin 2 */
+		<568000  568000  568000  568000  568000
+		 568000  568000  568000  568000  568000
+		 568000  568000  632000  632000  632000
+		 632000  632000  632000  632000  632000
+		 712000  712000  712000  772000  772000
+		 772000  772000  772000  772000  772000>,
+		/* Speed bin 3 */
+		<568000  568000  568000  568000  568000
+		 568000  568000  568000  568000  568000
+		 568000  568000  632000  632000  632000
+		 632000  632000  632000  632000  632000
+		 712000  712000  712000  772000  772000
+		 772000  772000  772000  772000  772000
+		 772000>;
+
+	qcom,cpr-floor-to-ceiling-max-range =
+		/* Speed bin 0 */
+		<32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 40000  40000  40000  40000
+		 40000  40000  40000  40000
+		 40000  40000  40000  40000>,
+		/* Speed bin 1 */
+		<32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 40000  40000  40000  40000
+		 40000  40000>,
+		/* Speed bin 2 */
+		<32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 40000  40000  40000  40000
+		 40000  40000  40000  40000
+		 40000  40000>,
+		/* Speed bin 3 */
+		<32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 32000  32000  32000  32000
+		 40000  40000  40000  40000
+		 40000  40000  40000  40000
+		 40000  40000  40000>;
+
+	qcom,corner-frequencies =
+		/* Speed bin 0 */
+		<300000000  345600000  422400000
+		 499200000  576000000  652800000
+		 729600000  806400000  902400000
+		 979200000 1056000000 1132800000
+		1190400000 1267200000 1344000000
+		1420800000 1497600000 1574400000
+		1651200000 1728000000 1804800000
+		1881600000 1958400000 2035200000
+		2112000000 2208000000 2265600000
+		2342400000 2419200000 2457600000
+		2476800000 2496000000>,
+		/* Speed bin 1 */
+		<300000000  345600000  422400000
+		 499200000  576000000  652800000
+		 729600000  806400000  902400000
+		 979200000 1056000000 1132800000
+		1190400000 1267200000 1344000000
+		1420800000 1497600000 1574400000
+		1651200000 1728000000 1804800000
+		1881600000 1958400000 2035200000
+		2112000000 2208000000>,
+		/* Speed bin 2 */
+		<300000000  345600000  422400000
+		 499200000  576000000  652800000
+		 729600000  806400000  902400000
+		 979200000 1056000000 1132800000
+		1190400000 1267200000 1344000000
+		1420800000 1497600000 1574400000
+		1651200000 1728000000 1804800000
+		1881600000 1958400000 2035200000
+		2112000000 2208000000 2265600000
+		2323200000 2342400000 2361600000>,
+		/* Speed bin 3 */
+		<300000000  345600000  422400000
+		 499200000  576000000  652800000
+		 729600000  806400000  902400000
+		 979200000 1056000000 1132800000
+		1190400000 1267200000 1344000000
+		1420800000 1497600000 1574400000
+		1651200000 1728000000 1804800000
+		1881600000 1958400000 2035200000
+		2112000000 2208000000 2265600000
+		2323200000 2342400000 2361600000
+		2457600000>;
+
+	qcom,cpr-ro-scaling-factor =
+		<2857 3057 2828 2952 2699 2798 2446
+		 2631 2629 2578 2244 3344 3289 3137
+		 3164 2655>,
+		<2857 3057 2828 2952 2699 2798 2446
+		 2631 2629 2578 2244 3344 3289 3137
+		 3164 2655>,
+		<2603 2755 2676 2777 2573 2685 2465
+		 2610 2312 2423 2243 3104 3022 3036
+		 2740 2303>,
+		<1901 2016 2096 2228 2034 2161 2077
+		 2188 1565 1870 1925 2235 2205 2413
+		 1762 1478>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		/* Speed bin 0 */
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		/* Speed bin 1 */
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		/* Speed bin 2 */
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		/* Speed bin 3 */
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>,
+		<  8000        0   12000  52000>;
+
+	qcom,cpr-closed-loop-voltage-fuse-adjustment =
+		/* Speed bin 0 */
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		/* Speed bin 1 */
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		/* Speed bin 2 */
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		/* Speed bin 3 */
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>,
+		<      0        0   12000  50000>;
+
+	qcom,cpr-open-loop-voltage-adjustment =
+		/* Speed bin 0 */
+		<     0        0        0        0        0
+		      0        0        0        0        0
+		      0   (-8000) (-12000) (-12000) (-12000)
+		(-12000) (-12000) (-12000) (-16000) (-16000)
+		(-20000) (-16000) (-16000) (-16000) (-12000)
+		(-28000) (-28000) (-28000) (-28000) (-28000)
+		(-28000) (-28000)>,
+		/* Speed bin 1 */
+		<     0        0        0        0        0
+		      0        0        0        0        0
+		      0   (-8000) (-12000) (-12000) (-12000)
+		(-12000) (-12000) (-12000) (-16000) (-16000)
+		(-20000) (-16000) (-16000) (-16000) (-16000)
+		(-28000)>,
+		/* Speed bin 2 */
+		<     0        0        0        0        0
+		      0        0        0        0        0
+		      0   (-8000) (-12000) (-12000) (-12000)
+		(-12000) (-12000) (-12000) (-16000) (-16000)
+		(-20000) (-16000) (-16000) (-16000) (-12000)
+		(-28000) (-28000) (-28000) (-28000) (-28000)>,
+		/* Speed bin 3 */
+		<     0        0        0        0        0
+		      0        0        0        0        0
+		      0   (-8000) (-12000) (-12000) (-12000)
+		(-12000) (-12000) (-12000) (-16000) (-16000)
+		(-20000) (-16000) (-16000) (-16000) (-12000)
+		(-28000) (-28000) (-28000) (-28000) (-28000)
+		(-28000)>;
+
+	qcom,cpr-closed-loop-voltage-adjustment =
+		/* Speed bin 0 */
+		<     0        0        0        0        0
+		      0        0        0        0        0
+		      0  (-10000) (-10000) (-11000) (-12000)
+		(-12000) (-13000) (-14000) (-14000) (-15000)
+		(-16000) (-16000) (-17000) (-15000) (-13000)
+		(-26000) (-26000) (-27000) (-27000) (-28000)
+		(-28000) (-28000)>,
+		/* Speed bin 1 */
+		<     0        0        0        0        0
+		      0        0        0        0        0
+		      0  (-10000) (-10000) (-11000) (-12000)
+		(-12000) (-13000) (-14000) (-14000) (-15000)
+		(-16000) (-16000) (-17000) (-16000) (-15000)
+		(-28000)>,
+		/* Speed bin 2 */
+		<     0        0        0        0        0
+		      0        0        0        0        0
+		      0  (-10000) (-10000) (-11000) (-12000)
+		(-12000) (-13000) (-14000) (-14000) (-15000)
+		(-16000) (-16000) (-17000) (-15000) (-14000)
+		(-27000) (-27000) (-28000) (-28000) (-28000)>,
+		/* Speed bin 3 */
+		<     0        0        0        0        0
+		      0        0        0        0        0
+		      0  (-10000) (-10000) (-11000) (-12000)
+		(-12000) (-13000) (-14000) (-14000) (-15000)
+		(-16000) (-16000) (-17000) (-15000) (-14000)
+		(-26000) (-27000) (-27000) (-28000) (-28000)
+		(-28000)>;
+
+	qcom,allow-voltage-interpolation;
+	qcom,allow-quotient-interpolation;
+	qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+
+	qcom,cpr-aging-ref-corner = <32 26 30 31>;
+	qcom,cpr-aging-ro-scaling-factor = <1700>;
+	qcom,allow-aging-voltage-adjustment = <0>;
+};
+
+&pm8005_s1 {
+	regulator-min-microvolt = <516000>;
+	regulator-max-microvolt = <1088000>;
+};
+
+&gfx_cpr {
+	compatible = "qcom,cpr4-msm8998-v2-mmss-regulator";
+	qcom,cpr-aging-ref-voltage = <1088000>;
+};
+
+&gfx_vreg {
+	regulator-min-microvolt = <1>;
+	regulator-max-microvolt = <8>;
+
+	qcom,cpr-fuse-corners = <4>;
+	qcom,cpr-fuse-combos = <8>;
+	qcom,cpr-corners = <8>;
+
+	qcom,cpr-corner-fmax-map = <1 3 5 8>;
+
+	qcom,cpr-voltage-ceiling =
+		<716000 716000 772000 880000 908000 948000 1016000 1088000>,
+		<724000 724000 772000 832000 916000 968000 1024000 1088000>,
+		<724000 724000 772000 832000 916000 968000 1024000 1088000>,
+		<724000 724000 772000 832000 916000 968000 1024000 1088000>,
+		<724000 724000 772000 832000 916000 968000 1024000 1088000>,
+		<724000 724000 772000 832000 916000 968000 1024000 1088000>,
+		<724000 724000 772000 832000 916000 968000 1024000 1088000>,
+		<724000 724000 772000 832000 916000 968000 1024000 1088000>;
+
+	qcom,cpr-voltage-floor =
+		<516000 516000 532000 584000 632000 672000 712000 756000>;
+
+	qcom,mem-acc-voltage = <1 1 1 2 2 2 2 2>;
+
+	qcom,corner-frequencies =
+		<180000000 257000000 342000000 414000000
+		 515000000 596000000 670000000 710000000>;
+
+	qcom,cpr-target-quotients =
+		<   0    0    0    0  331  357    0    0
+		    0    0    0    0    0    0  115    0>,
+		<   0    0    0    0  467  500    0    0
+		    0    0    0    0    0    0  199    0>,
+		<   0    0    0    0  628  665    0    0
+		    0    0    0    0    0    0  290    0>,
+		<   0    0    0    0  762  805    0    0
+		    0    0    0    0    0    0  397    0>,
+		<   0    0    0    0  964 1013    0    0
+		    0    0 1143    0 1138 1055    0    0>,
+		<   0    0    0    0    0    0    0    0
+		    0    0 1306    0 1289 1168    0    0>,
+		<   0    0    0    0    0    0    0    0
+		    0    0 1468    0 1429 1256    0    0>,
+		<   0    0    0    0    0    0    0    0
+		    0    0 1627    0 1578 1353    0    0>;
+
+	qcom,cpr-ro-scaling-factor =
+		<   0    0    0    0 2377 2571    0    0
+		    0    0 2168    0 2209 1849 1997    0>,
+		<   0    0    0    0 2377 2571    0    0
+		    0    0 2168    0 2209 1849 1997    0>,
+		<   0    0    0    0 2377 2571    0    0
+		    0    0 2168    0 2209 1849 1997    0>,
+		<   0    0    0    0 2377 2571    0    0
+		    0    0 2168    0 2209 1849 1997    0>,
+		<   0    0    0    0 2377 2571    0    0
+		    0    0 2168    0 2209 1849 1997    0>,
+		<   0    0    0    0 2377 2571    0    0
+		    0    0 2168    0 2209 1849 1997    0>,
+		<   0    0    0    0 2377 2571    0    0
+		    0    0 2168    0 2209 1849 1997    0>,
+		<   0    0    0    0 2377 2571    0    0
+		    0    0 2168    0 2209 1849 1997    0>;
+
+	qcom,cpr-open-loop-voltage-fuse-adjustment =
+		<   60000        0        0        0>,
+		<   60000        0        0        0>,
+		<   60000        0        0        0>,
+		<   60000        0        0        0>,
+		<   60000        0        0        0>,
+		<   60000        0        0        0>,
+		<   60000        0        0        0>,
+		<   60000        0        0        0>;
+
+	qcom,cpr-closed-loop-voltage-adjustment =
+		<   90000    38000    28000     8000
+			0    29000    11000        0>,
+		<   90000    38000    28000     8000
+			0    29000    11000        0>,
+		<   90000    38000    28000     8000
+			0    29000    11000        0>,
+		<   90000    38000    28000     8000
+			0    29000    11000        0>,
+		<   90000    38000    28000     8000
+			0    29000    11000        0>,
+		<   90000    38000    28000     8000
+			0    29000    11000        0>,
+		<   90000    38000    28000     8000
+			0    29000    11000        0>,
+		<   90000    38000    28000     8000
+			0    29000    11000        0>;
+
+	qcom,cpr-floor-to-ceiling-max-range =
+	       <40000 40000 40000 40000 40000 40000 50000 50000>;
+
+	qcom,cpr-fused-closed-loop-voltage-adjustment-map =
+		<0 0 0 0 1 2 3 4>;
+
+	qcom,allow-voltage-interpolation;
+	qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+
+	qcom,cpr-aging-max-voltage-adjustment = <15000>;
+	qcom,cpr-aging-ref-corner = <8>;
+	qcom,cpr-aging-ro-scaling-factor = <1620>;
+	qcom,allow-aging-voltage-adjustment = <0>;
+};
+
+&qusb_phy0 {
+	reg = <0x0c012000 0x2a8>,
+	      <0x01fcb24c 0x4>,
+	      <0x00784238 0x4>;
+	reg-names = "qusb_phy_base",
+			"tcsr_clamp_dig_n_1p8",
+			"efuse_addr";
+	qcom,efuse-bit-pos = <16>;
+	qcom,efuse-num-bits = <4>;
+	qcom,qusb-phy-init-seq =
+			/* <value reg_offset> */
+				<0x13 0x04 /* analog_controls_two */
+				0x7c 0x18c /* pll_clock_inverter */
+				0x80 0x2c /* pll_cmode */
+				0x0a 0x184 /* pll_lock_delay */
+				0xa5 0x23c /* tune1 */
+				0x09 0x240 /* tune2 */
+				0x19 0xb4>; /* digital_timers_two */
+};
+
+&msm_vidc {
+	qcom,load-freq-tbl =
+		/* Encoders */
+		<1105920 533000000 0x55555555>, /* 4kx2304@30 */ /*TURBO*/
+		<1036800 444000000 0x55555555>, /* 720p@240, 1080p@120,1440p@60,
+						 * UHD@30 */ /*NOMINAL*/
+		< 829440 355200000 0x55555555>, /* UHD/4096x2160@30 SVSL1 */
+		< 489600 269330000 0x55555555>, /* 1080p@60, 720p@120 SVS */
+		< 345600 200000000 0x55555555>, /* 2560x1440@24, 1080p@30 */
+						/* SVS2 */
+
+		/* Decoders */
+		<2211840 533000000 0xffffffff>, /* 4kx2304@60, 1080p@240 */
+						/* TURBO */
+		<1728000 444000000 0xffffffff>, /* 2560x1440@120 */
+						/* NOMINAL */
+		<1675472 355200000 0xffffffff>, /* 4kx2304@44 */ /*SVSL1*/
+		<1105920 269330000 0xffffffff>, /* UHD/4k2304@30, 1080p@120 */
+						/* SVS */
+		< 829440 200000000 0xffffffff>; /* 720p@120, 1080p@60 */
+						/* SVS2 */
+
+	qcom,imem-ab-tbl =
+		<200000000 1560000>,/* imem @ svs2 freq 75 Mhz */
+		<269330000 3570000>,/* imem @ svs freq 171 Mhz */
+		<355200000 3570000>,/* imem @ svs freq 171 Mhz */
+		<444000000 6750000>,/* imem @ nom freq 323 Mhz */
+		<533000000 8490000>;/* imem @ turbo freq 406 Mhz */
+
+	qcom,dcvs-tbl = /* minLoad LoadLow LoadHigh CodecCheck */
+		/* Decode */
+		/* Load > Nominal, Nominal <-> Turbo Eg.3840x2160@60 */
+		<1728000 1728000 2211840 0x3f00000c>,
+		/* Encoder */
+		/* Load > Nominal, Nominal <-> Turbo Eg. 4kx2304@30 */
+		<1036800 1036800 1105920 0x04000004>,
+		/* Load > SVSL1, SVSL1<-> Nominal Eg. 3840x2160@30 */
+		< 829440  829440 1036800 0x04000004>,
+		/* Load > SVS , SVS <-> SVSL1 Eg. 4kx2304@24 */
+		< 489600  489600  829440 0x04000004>;
+
+	qcom,dcvs-limit = /* Min Frame size, Min MBs/sec */
+		<32400 30>, /* Encoder 3840x2160@30 */
+		<32400 60>; /* Decoder 3840x2160@60 */
+
+};
+
+&soc {
+	/* Gold L2 SAW */
+	qcom,spm@178120000 {
+		qcom,saw2-avs-limit = <0x4700470>;
+	};
+
+	/* Silver L2 SAW */
+	qcom,spm@179120000 {
+		qcom,saw2-avs-limit = <0x4200420>;
+	};
+};
+
+/* GPU overrides */
+&msm_gpu {
+	/* Updated chip ID */
+	qcom,chipid = <0x05040001>;
+	qcom,initial-pwrlevel = <6>;
+
+	qcom,gpu-pwrlevels {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		compatible = "qcom,gpu-pwrlevels";
+
+		qcom,gpu-pwrlevel@0 {
+			reg = <0>;
+			qcom,gpu-freq = <710000000>;
+			qcom,bus-freq = <12>;
+			qcom,bus-min = <12>;
+			qcom,bus-max = <12>;
+		};
+
+		qcom,gpu-pwrlevel@1 {
+			reg = <1>;
+			qcom,gpu-freq = <670000000>;
+			qcom,bus-freq = <12>;
+			qcom,bus-min = <11>;
+			qcom,bus-max = <12>;
+		};
+
+		qcom,gpu-pwrlevel@2 {
+			reg = <2>;
+			qcom,gpu-freq = <596000000>;
+			qcom,bus-freq = <11>;
+			qcom,bus-min = <9>;
+			qcom,bus-max = <12>;
+		};
+
+		qcom,gpu-pwrlevel@3 {
+			reg = <3>;
+			qcom,gpu-freq = <515000000>;
+			qcom,bus-freq = <11>;
+			qcom,bus-min = <9>;
+			qcom,bus-max = <12>;
+		};
+
+		qcom,gpu-pwrlevel@4 {
+			reg = <4>;
+			qcom,gpu-freq = <414000000>;
+			qcom,bus-freq = <9>;
+			qcom,bus-min = <8>;
+			qcom,bus-max = <11>;
+		};
+
+		qcom,gpu-pwrlevel@5 {
+			reg = <5>;
+			qcom,gpu-freq = <342000000>;
+			qcom,bus-freq = <8>;
+			qcom,bus-min = <5>;
+			qcom,bus-max = <9>;
+		};
+
+		qcom,gpu-pwrlevel@6 {
+			reg = <6>;
+			qcom,gpu-freq = <257000000>;
+			qcom,bus-freq = <5>;
+			qcom,bus-min = <3>;
+			qcom,bus-max = <8>;
+		};
+
+		qcom,gpu-pwrlevel@7 {
+			reg = <7>;
+			qcom,gpu-freq = <27000000>;
+			qcom,bus-freq = <0>;
+			qcom,bus-min = <0>;
+			qcom,bus-max = <0>;
+		};
+	};
+};
+
+&spss_utils {
+	qcom,spss-test-firmware-name = "spss2t";	/* 8 chars max */
+	qcom,spss-prod-firmware-name = "spss2p";	/* 8 chars max */
+	qcom,spss-hybr-firmware-name = "spss2h";	/* 8 chars max */
+};
+
+&ufs1 {
+	clock-names =
+		"core_clk",
+		"bus_aggr_clk",
+		"iface_clk",
+		"core_clk_unipro",
+		"core_clk_ice",
+		"ref_clk",
+		"tx_lane0_sync_clk",
+		"rx_lane0_sync_clk",
+		"rx_lane1_sync_clk";
+	clocks =
+		<&clock_gcc clk_gcc_ufs_axi_hw_ctl_clk>,
+		<&clock_gcc clk_gcc_aggre1_ufs_axi_clk>,
+		<&clock_gcc clk_gcc_ufs_ahb_clk>,
+		<&clock_gcc clk_gcc_ufs_unipro_core_hw_ctl_clk>,
+		<&clock_gcc clk_gcc_ufs_ice_core_hw_ctl_clk>,
+		<&clock_gcc clk_ln_bb_clk1>,
+		<&clock_gcc clk_gcc_ufs_tx_symbol_0_clk>,
+		<&clock_gcc clk_gcc_ufs_rx_symbol_0_clk>,
+		<&clock_gcc clk_gcc_ufs_rx_symbol_1_clk>;
+	freq-table-hz =
+		<50000000 200000000>,
+		<0 0>,
+		<0 0>,
+		<37500000 150000000>,
+		<75000000 300000000>,
+		<0 0>,
+		<0 0>,
+		<0 0>,
+		<0 0>;
+
+	lanes-per-direction = <2>;
+};
+
+&ssc_sensors {
+	qcom,firmware-name = "slpi_v2";
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-vidc.dtsi b/arch/arm64/boot/dts/qcom/msm8998-vidc.dtsi
new file mode 100644
index 000000000000..57e8d6505693
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-vidc.dtsi
@@ -0,0 +1,251 @@
+/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/msm/msm-bus-ids.h>
+#include <dt-bindings/clock/msm-clocks-8998.h>
+
+&soc {
+	msm_vidc: qcom,vidc@cc00000 {
+		compatible = "qcom,msm-vidc";
+		status = "ok";
+		reg = <0xcc00000 0x100000>;
+		interrupts = <GIC_SPI 287 IRQ_TYPE_LEVEL_HIGH>;
+		qcom,hfi = "venus";
+		qcom,hfi-version = "3xx";
+		qcom,firmware-name = "venus";
+		qcom,never-unload-fw;
+		qcom,sw-power-collapse;
+		qcom,max-secure-instances = <5>;
+		qcom,reg-presets =
+			<0x80124 0x00000003>,
+			<0x80550 0x01111111>,
+			<0x80560 0x01111111>,
+			<0x80568 0x01111111>,
+			<0x80570 0x01111111>,
+			<0x80580 0x01111111>,
+			<0x80588 0x01111111>,
+			<0xe2010 0x00000000>;
+
+		qcom,imem-size = <524288>; /* 512 kB */
+		qcom,max-hw-load = <2563200>; /* Full 4k @ 60 + 1080p @ 60 */
+		qcom,power-conf = <8294400>; /* WxH - 3840*2160 */
+		qcom,load-freq-tbl =
+			/* Encoders */
+			<972000 465000000 0x55555555>, /* 4k UHD @ 30 */
+			<489600 360000000 0x55555555>, /* 1080p @ 60 */
+			<244800 186000000 0x55555555>, /* 1080p @ 30 */
+			<108000 100000000 0x55555555>, /* 720p @ 30 */
+
+			/* Decoders */
+			<1944000 465000000 0xffffffff>, /* 4k UHD @ 60 */
+			< 972000 360000000 0xffffffff>, /* 4k UHD @ 30 */
+			< 489600 186000000 0xffffffff>, /* 1080p @ 60 */
+			< 244800 100000000 0xffffffff>; /* 1080p @ 30 */
+
+		qcom,dcvs-tbl =
+			<972000 972000 19944000 0x3f00000c>, /* UHD 30 */
+			<489600 489600   972000 0x3f00000c>, /* 1080p 60 */
+			<244800 244800   489600 0x3f00000c>, /* 1080p 30 */
+			<829440 489600   972000 0x04000004>; /* DCI 24 */
+
+		qcom,dcvs-limit =
+			<32400 30>, /* Encoder UHD */
+			<14400 30>; /* Decoder WQHD */
+
+		/* Table lists <video_core_freq imem_ab> pairs.
+		* imem_ab value determines the imem clock frequency for the
+		* corresponding video core frequency.
+		*/
+		qcom,imem-ab-tbl =
+			<100000000 1560000>, /* imem @ svs2 freq 75 Mhz */
+			<186000000 3570000>, /* imem @ svs freq 171 Mhz */
+			<360000000 6750000>, /* imem @ nom freq 323 Mhz */
+			<465000000 8490000>; /* imem @ turbo freq 406 Mhz */
+
+		/* Regulators */
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		venus-supply = <&gdsc_venus>;
+		venus-core0-supply = <&gdsc_venus_core0>;
+		venus-core1-supply = <&gdsc_venus_core1>;
+
+		/* Clocks */
+		clock-names = "sys_noc_axi_clk",
+			"noc_axi_clk", "mnoc_ahb_clk",
+			"smmu_ahb_clk", "smmu_axi_clk",
+			"mnoc_maxi_clk",
+			"core_clk", "iface_clk", "bus_clk",
+			"maxi_clk", "core0_clk", "core1_clk";
+		clocks = <&clock_gcc clk_gcc_mmss_sys_noc_axi_clk>,
+			<&clock_gcc clk_mmssnoc_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_ahb_clk>,
+			<&clock_mmss clk_mmss_bimc_smmu_axi_clk>,
+			<&clock_mmss clk_mmss_mnoc_maxi_clk>,
+			<&clock_mmss clk_mmss_video_core_clk>,
+			<&clock_mmss clk_mmss_video_ahb_clk>,
+			<&clock_mmss clk_mmss_video_axi_clk>,
+			<&clock_mmss clk_mmss_video_maxi_clk>,
+			<&clock_mmss clk_mmss_video_subcore0_clk>,
+			<&clock_mmss clk_mmss_video_subcore1_clk>;
+		qcom,clock-configs = <0x0 0x0 0x0 0x0 0x0 0x0
+				0x3 0x0 0x2 0x2 0x3 0x3>;
+
+		/* Buses */
+		bus_cnoc {
+			compatible = "qcom,msm-vidc,bus";
+			label = "cnoc";
+			qcom,bus-master = <MSM_BUS_MASTER_AMPSS_M0>;
+			qcom,bus-slave = <MSM_BUS_SLAVE_VENUS_CFG>;
+			qcom,bus-governor = "performance";
+			qcom,bus-range-kbps = <1 1>;
+		};
+
+		venus_bus_ddr {
+			compatible = "qcom,msm-vidc,bus";
+			label = "venus-ddr";
+			qcom,bus-master = <MSM_BUS_MASTER_VIDEO_P0>;
+			qcom,bus-slave = <MSM_BUS_SLAVE_EBI_CH0>;
+			qcom,bus-governor = "msm-vidc-ddr";
+			qcom,bus-range-kbps = <1000 4946000>;
+		};
+
+		venus_bus_vmem {
+			compatible = "qcom,msm-vidc,bus";
+			label = "venus-vmem";
+			qcom,bus-master = <MSM_BUS_MASTER_VIDEO_P0_OCMEM>;
+			qcom,bus-slave = <MSM_BUS_SLAVE_VMEM>;
+			qcom,bus-governor = "msm-vidc-vmem+";
+			qcom,bus-range-kbps = <1000 8490000>;
+		};
+
+		arm9_bus_ddr {
+			compatible = "qcom,msm-vidc,bus";
+			label = "venus-arm9-ddr";
+			qcom,bus-master = <MSM_BUS_MASTER_VIDEO_P0>;
+			qcom,bus-slave = <MSM_BUS_SLAVE_EBI_CH0>;
+			qcom,bus-governor = "performance";
+			qcom,bus-range-kbps = <1 1>;
+		};
+
+
+		/* MMUs */
+		non_secure_cb {
+			compatible = "qcom,msm-vidc,context-bank";
+			label = "venus_ns";
+			iommus =
+				<&mmss_smmu 0x400>,
+				<&mmss_smmu 0x401>,
+				<&mmss_smmu 0x40a>,
+				<&mmss_smmu 0x407>,
+				<&mmss_smmu 0x40e>,
+				<&mmss_smmu 0x40f>,
+				<&mmss_smmu 0x408>,
+				<&mmss_smmu 0x409>,
+				<&mmss_smmu 0x40b>,
+				<&mmss_smmu 0x40c>,
+				<&mmss_smmu 0x40d>,
+				<&mmss_smmu 0x410>,
+				<&mmss_smmu 0x421>,
+				<&mmss_smmu 0x428>,
+				<&mmss_smmu 0x429>,
+				<&mmss_smmu 0x42b>,
+				<&mmss_smmu 0x42c>,
+				<&mmss_smmu 0x42d>,
+				<&mmss_smmu 0x411>,
+				<&mmss_smmu 0x431>;
+			buffer-types = <0xfff>;
+			virtual-addr-pool = <0x70800000 0x6f800000>;
+		};
+
+		firmware_cb {
+			compatible = "qcom,msm-vidc,context-bank";
+			qcom,fw-context-bank;
+			iommus = <&mmss_smmu 0x580>,
+				<&mmss_smmu 0x586>;
+		};
+		secure_bitstream_cb {
+			compatible = "qcom,msm-vidc,context-bank";
+			label = "venus_sec_bitstream";
+			iommus = <&mmss_smmu 0x500>,
+				<&mmss_smmu 0x502>,
+				<&mmss_smmu 0x509>,
+				<&mmss_smmu 0x50a>,
+				<&mmss_smmu 0x50b>,
+				<&mmss_smmu 0x50e>,
+				<&mmss_smmu 0x526>,
+				<&mmss_smmu 0x529>,
+				<&mmss_smmu 0x52b>;
+			buffer-types = <0x241>;
+			virtual-addr-pool = <0x4b000000 0x25800000>;
+			qcom,secure-context-bank;
+		};
+
+		venus_secure_pixel_cb: secure_pixel_cb {
+			compatible = "qcom,msm-vidc,context-bank";
+			label = "venus_sec_pixel";
+			iommus = <&mmss_smmu 0x504>,
+				<&mmss_smmu 0x50c>,
+				<&mmss_smmu 0x510>,
+				<&mmss_smmu 0x52c>;
+			buffer-types = <0x106>;
+			virtual-addr-pool = <0x25800000 0x25800000>;
+			qcom,secure-context-bank;
+		};
+
+		venus_secure_non_pixel_cb: secure_non_pixel_cb {
+			compatible = "qcom,msm-vidc,context-bank";
+			label = "venus_sec_non_pixel";
+			iommus = <&mmss_smmu 0x505>,
+				<&mmss_smmu 0x507>,
+				<&mmss_smmu 0x508>,
+				<&mmss_smmu 0x50d>,
+				<&mmss_smmu 0x50f>,
+				<&mmss_smmu 0x525>,
+				<&mmss_smmu 0x528>,
+				<&mmss_smmu 0x52d>,
+				<&mmss_smmu 0x540>;
+			buffer-types = <0x480>;
+			virtual-addr-pool = <0x1000000 0x24800000>;
+			qcom,secure-context-bank;
+		};
+	};
+
+	qcom,vmem@c880000 {
+		compatible = "qcom,msm-vmem";
+		status = "ok";
+		interrupts = <GIC_SPI 429 IRQ_TYPE_LEVEL_HIGH>;
+
+		reg = <0xc880000 0x6b>,
+		    <0x14800000 0x80000>;
+		reg-names = "reg-base", "mem-base";
+
+		clocks = <&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			<&clock_mmss clk_mmss_mnoc_maxi_clk>,
+			<&clock_mmss clk_mmss_vmem_ahb_clk>,
+			<&clock_mmss clk_mmss_vmem_maxi_clk>;
+		clock-names = "mnoc_ahb","mnoc_maxi",
+			"ahb", "maxi";
+		clock-config = <0x0 0x0 0x0 0x1>;
+
+		qcom,msm-bus,name = "vmem";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <2>;
+		qcom,msm-bus,vectors-KBps =
+		<MSM_BUS_MASTER_VIDEO_P0_OCMEM MSM_BUS_SLAVE_VMEM    0    0>,
+		<MSM_BUS_MASTER_AMPSS_M0 MSM_BUS_SLAVE_VMEM_CFG   0   0>,
+		<MSM_BUS_MASTER_VIDEO_P0_OCMEM MSM_BUS_SLAVE_VMEM 1000 1000>,
+		<MSM_BUS_MASTER_AMPSS_M0 MSM_BUS_SLAVE_VMEM_CFG 500 800>;
+
+		qcom,bank-size = <131072>; /* 128 kB */
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-wcd.dtsi b/arch/arm64/boot/dts/qcom/msm8998-wcd.dtsi
new file mode 100644
index 000000000000..29f4ccaede9f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-wcd.dtsi
@@ -0,0 +1,183 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&slim_aud {
+	tasha_codec {
+		wsa_spkr_sd1: msm_cdc_pinctrll {
+		      compatible = "qcom,msm-cdc-pinctrl";
+		      pinctrl-names = "aud_active", "aud_sleep";
+		      pinctrl-0 = <&spkr_1_sd_n_active>;
+		      pinctrl-1 = <&spkr_1_sd_n_sleep>;
+		};
+
+		wsa_spkr_sd2: msm_cdc_pinctrlr {
+		      compatible = "qcom,msm-cdc-pinctrl";
+		      pinctrl-names = "aud_active", "aud_sleep";
+		      pinctrl-0 = <&spkr_2_sd_n_active>;
+		      pinctrl-1 = <&spkr_2_sd_n_sleep>;
+		};
+	};
+
+	tavil_codec {
+		wcd: wcd_pinctrl@5 {
+			compatible = "qcom,wcd-pinctrl";
+			qcom,num-gpios = <5>;
+			gpio-controller;
+			#gpio-cells = <2>;
+
+			us_euro_sw_wcd_active: us_euro_sw_wcd_active {
+				mux {
+					pins = "gpio1";
+				};
+
+				config {
+					pins = "gpio1";
+					output-high;
+				};
+			};
+
+			us_euro_sw_wcd_sleep: us_euro_sw_wcd_sleep {
+				mux {
+					pins = "gpio1";
+				};
+
+				config {
+					pins = "gpio1";
+					output-low;
+				};
+			};
+
+			spkr_1_wcd_en_active: spkr_1_wcd_en_active {
+				mux {
+					pins = "gpio2";
+				};
+
+				config {
+					pins = "gpio2";
+					output-high;
+				};
+			};
+
+			spkr_1_wcd_en_sleep: spkr_1_wcd_en_sleep {
+				mux {
+					pins = "gpio2";
+				};
+
+				config {
+					pins = "gpio2";
+					input-enable;
+				};
+			};
+
+			spkr_2_wcd_en_active: spkr_2_sd_n_active {
+				mux {
+					pins = "gpio3";
+				};
+
+				config {
+					pins = "gpio3";
+					output-high;
+				};
+			};
+
+			spkr_2_wcd_en_sleep: spkr_2_sd_n_sleep {
+				mux {
+					pins = "gpio3";
+				};
+
+				config {
+					pins = "gpio3";
+					input-enable;
+				};
+			};
+
+			hph_en0_wcd_active: hph_en0_wcd_active {
+				mux {
+					pins = "gpio4";
+				};
+
+				config {
+					pins = "gpio4";
+					output-high;
+				};
+			};
+
+			hph_en0_wcd_sleep: hph_en0_wcd_sleep {
+				mux {
+					pins = "gpio4";
+				};
+
+				config {
+					pins = "gpio4";
+					output-low;
+				};
+			};
+
+			hph_en1_wcd_active: hph_en1_wcd_active {
+				mux {
+					pins = "gpio5";
+				};
+
+				config {
+					pins = "gpio5";
+					output-high;
+				};
+			};
+
+			hph_en1_wcd_sleep: hph_en1_wcd_sleep {
+				mux {
+					pins = "gpio5";
+				};
+
+				config {
+					pins = "gpio5";
+					output-low;
+				};
+			};
+		};
+
+		wsa_spkr_wcd_sd1: msm_cdc_pinctrll {
+		      compatible = "qcom,msm-cdc-pinctrl";
+		      pinctrl-names = "aud_active", "aud_sleep";
+		      pinctrl-0 = <&spkr_1_wcd_en_active>;
+		      pinctrl-1 = <&spkr_1_wcd_en_sleep>;
+		};
+
+		wsa_spkr_wcd_sd2: msm_cdc_pinctrlr {
+		      compatible = "qcom,msm-cdc-pinctrl";
+		      pinctrl-names = "aud_active", "aud_sleep";
+		      pinctrl-0 = <&spkr_2_wcd_en_active>;
+		      pinctrl-1 = <&spkr_2_wcd_en_sleep>;
+		};
+
+		tavil_us_euro_sw: msm_cdc_pinctrl_us_euro_sw {
+		      compatible = "qcom,msm-cdc-pinctrl";
+		      pinctrl-names = "aud_active", "aud_sleep";
+		      pinctrl-0 = <&us_euro_sw_wcd_active>;
+		      pinctrl-1 = <&us_euro_sw_wcd_sleep>;
+		};
+
+		tavil_hph_en0: msm_cdc_pinctrl_hph_en0 {
+		      compatible = "qcom,msm-cdc-pinctrl";
+		      pinctrl-names = "aud_active", "aud_sleep";
+		      pinctrl-0 = <&hph_en0_wcd_active>;
+		      pinctrl-1 = <&hph_en0_wcd_sleep>;
+		};
+
+		tavil_hph_en1: msm_cdc_pinctrl_hph_en1 {
+		      compatible = "qcom,msm-cdc-pinctrl";
+		      pinctrl-names = "aud_active", "aud_sleep";
+		      pinctrl-0 = <&hph_en1_wcd_active>;
+		      pinctrl-1 = <&hph_en1_wcd_sleep>;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998-wsa881x.dtsi b/arch/arm64/boot/dts/qcom/msm8998-wsa881x.dtsi
new file mode 100644
index 000000000000..746cf23b4c97
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998-wsa881x.dtsi
@@ -0,0 +1,78 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#include "msm8998-wcd.dtsi"
+
+&slim_aud {
+	tasha_codec {
+		swr_master {
+			compatible = "qcom,swr-wcd";
+			#address-cells = <2>;
+			#size-cells = <0>;
+
+			wsa881x_211: wsa881x@20170211 {
+				compatible = "qcom,wsa881x";
+				reg = <0x00 0x20170211>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_sd1>;
+			};
+
+			wsa881x_212: wsa881x@20170212 {
+				compatible = "qcom,wsa881x";
+				reg = <0x00 0x20170212>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_sd2>;
+			};
+
+			wsa881x_213: wsa881x@21170213 {
+				compatible = "qcom,wsa881x";
+				reg = <0x00 0x21170213>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_sd1>;
+			};
+
+			wsa881x_214: wsa881x@21170214 {
+				compatible = "qcom,wsa881x";
+				reg = <0x00 0x21170214>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_sd2>;
+			};
+		};
+	};
+
+	tavil_codec {
+		swr_master {
+			compatible = "qcom,swr-wcd";
+			#address-cells = <2>;
+			#size-cells = <0>;
+
+			wsa881x_0211: wsa881x@20170211 {
+				compatible = "qcom,wsa881x";
+				reg = <0x00 0x20170211>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_wcd_sd1>;
+			};
+
+			wsa881x_0212: wsa881x@20170212 {
+				compatible = "qcom,wsa881x";
+				reg = <0x00 0x20170212>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_wcd_sd2>;
+			};
+
+			wsa881x_0213: wsa881x@21170213 {
+				compatible = "qcom,wsa881x";
+				reg = <0x00 0x21170213>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_wcd_sd1>;
+			};
+
+			wsa881x_0214: wsa881x@21170214 {
+				compatible = "qcom,wsa881x";
+				reg = <0x00 0x21170214>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_wcd_sd2>;
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998.dts b/arch/arm64/boot/dts/qcom/msm8998.dts
new file mode 100644
index 000000000000..b340b6de4c00
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include <dt-bindings/clock/msm-clocks-8998.h>
+#include "msm8998.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998 v1 SoC";
+	compatible = "qcom,msm8998";
+	qcom,board-id = <0 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi
new file mode 100644
index 000000000000..ae9a7544bbf9
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi
@@ -0,0 +1,3362 @@
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "skeleton64.dtsi"
+#include <dt-bindings/clock/msm-clocks-8998.h>
+#include <dt-bindings/regulator/qcom,rpm-smd-regulator.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8998";
+	compatible = "qcom,msm8998";
+	qcom,msm-id = <292 0x0>;
+	interrupt-parent = <&intc>;
+
+	aliases {
+		serial0 = &uartblsp2dm1;
+		pci-domain0 = &pcie0;
+		sdhc2 = &sdhc_2; /* SDC2 SD card slot */
+	};
+
+	psci {
+		compatible = "arm,psci-1.0";
+		method = "smc";
+	};
+
+	chosen {
+		stdout-path = "serial0";
+		bootargs = "rcupdate.rcu_expedited=1";
+	};
+
+	cpus {
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		CPU0: cpu@0 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x0>;
+			qcom,limits-info = <&mitigation_profile0>;
+			qcom,lmh-dcvs = <&lmh_dcvs0>;
+			enable-method = "psci";
+			efficiency = <1024>;
+			next-level-cache = <&L2_0>;
+			qcom,ea = <&ea0>;
+			L2_0: l2-cache {
+			      compatible = "arm,arch-cache";
+			      cache-level = <2>;
+				  qcom,dump-size = <0x0>;      /* A53 L2 dump not supported */
+			};
+			L1_I_0: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_0: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_TLB_0: l1-tlb {
+				qcom,dump-size = <0x2000>;
+			};
+		};
+
+		CPU1: cpu@1 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x1>;
+			qcom,limits-info = <&mitigation_profile1>;
+			qcom,lmh-dcvs = <&lmh_dcvs0>;
+			enable-method = "psci";
+			efficiency = <1024>;
+			next-level-cache = <&L2_0>;
+			qcom,ea = <&ea1>;
+			L1_I_1: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_1: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_TLB_1: l1-tlb {
+				qcom,dump-size = <0x2000>;
+			};
+		};
+
+		CPU2: cpu@2 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x2>;
+			qcom,limits-info = <&mitigation_profile2>;
+			qcom,lmh-dcvs = <&lmh_dcvs0>;
+			enable-method = "psci";
+			efficiency = <1024>;
+			next-level-cache = <&L2_0>;
+			qcom,ea = <&ea2>;
+			L1_I_2: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_2: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_TLB_2: l1-tlb {
+				qcom,dump-size = <0x2000>;
+			};
+		};
+
+		CPU3: cpu@3 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x3>;
+			qcom,limits-info = <&mitigation_profile3>;
+			qcom,lmh-dcvs = <&lmh_dcvs0>;
+			enable-method = "psci";
+			efficiency = <1024>;
+			next-level-cache = <&L2_0>;
+			qcom,ea = <&ea3>;
+			L1_I_3: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_3: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_TLB_3: l1-tlb {
+				qcom,dump-size = <0x2000>;
+			};
+		};
+
+		CPU4: cpu@100 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x100>;
+			qcom,limits-info = <&mitigation_profile4>;
+			qcom,lmh-dcvs = <&lmh_dcvs1>;
+			enable-method = "psci";
+			efficiency = <1536>;
+			next-level-cache = <&L2_1>;
+			qcom,ea = <&ea4>;
+			L2_1: l2-cache {
+				compatible = "arm,arch-cache";
+				cache-level = <2>;
+			};
+			L1_I_100: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_D_100: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_TLB_100: l1-tlb {
+				qcom,dump-size = <0x4800>;
+			};
+		};
+
+		CPU5: cpu@101 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x101>;
+			qcom,limits-info = <&mitigation_profile5>;
+			qcom,lmh-dcvs = <&lmh_dcvs1>;
+			enable-method = "psci";
+			efficiency = <1536>;
+			next-level-cache = <&L2_1>;
+			qcom,ea = <&ea5>;
+			L1_I_101: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_D_101: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_TLB_101: l1-tlb {
+				qcom,dump-size = <0x4800>;
+			};
+		};
+
+		CPU6: cpu@102 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x102>;
+			qcom,limits-info = <&mitigation_profile6>;
+			qcom,lmh-dcvs = <&lmh_dcvs1>;
+			enable-method = "psci";
+			efficiency = <1536>;
+			next-level-cache = <&L2_1>;
+			qcom,ea = <&ea6>;
+			L1_I_102: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_D_102: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_TLB_102: l1-tlb {
+				qcom,dump-size = <0x4800>;
+			};
+		};
+
+		CPU7: cpu@103 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x103>;
+			qcom,limits-info = <&mitigation_profile7>;
+			qcom,lmh-dcvs = <&lmh_dcvs1>;
+			enable-method = "psci";
+			efficiency = <1536>;
+			next-level-cache = <&L2_1>;
+			qcom,ea = <&ea7>;
+			L1_I_103: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_D_103: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_TLB_103: l1-tlb {
+				qcom,dump-size = <0x4800>;
+			};
+		};
+
+		cpu-map {
+			cluster0 {
+				core0 {
+					cpu = <&CPU0>;
+				};
+
+				core1 {
+					cpu = <&CPU1>;
+				};
+
+				core2 {
+					cpu = <&CPU2>;
+				};
+
+				core3 {
+					cpu = <&CPU3>;
+				};
+			};
+
+			cluster1 {
+				core0 {
+					cpu = <&CPU4>;
+				};
+
+				core1 {
+					cpu = <&CPU5>;
+				};
+
+				core2 {
+					cpu = <&CPU6>;
+				};
+
+				core3 {
+					cpu = <&CPU7>;
+				};
+			};
+		};
+	};
+
+	soc: soc { };
+
+	vendor: vendor {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges = <0 0 0 0xffffffff>;
+		compatible = "simple-bus";
+	};
+
+	firmware: firmware {
+		android {
+			compatible = "android,firmware";
+			fstab {
+				compatible = "android,fstab";
+				vendor {
+					compatible = "android,vendor";
+					dev = "/dev/block/platform/soc/1da4000.ufshc/by-name/vendor";
+					type = "ext4";
+					mnt_flags = "ro,barrier=1,discard";
+					fsmgr_flags = "wait,slotselect,verify";
+					status = "ok";
+				};
+			};
+		};
+	};
+
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		removed_regions: removed_regions@85800000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0 0x85800000 0 0x3700000>;
+		};
+
+		pil_ipa_gpu_mem: pil_ipa_gpu_region@95200000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0 0x95200000 0 0x100000>;
+		};
+
+		pil_slpi_mem: pil_slpi_region@94300000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0 0x94300000 0 0xf00000>;
+		};
+
+		pil_mba_mem: pil_mba_region@94100000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0 0x94100000 0 0x200000>;
+		};
+
+		pil_video_mem: pil_video_region@93c00000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0 0x93c00000 0 0x500000>;
+		};
+
+		modem_mem: modem_region@8cc00000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0 0x8cc00000 0 0x7000000>;
+		};
+
+		pil_adsp_mem: pil_adsp_region@0x8b200000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0 0x8b200000 0 0x1a00000>;
+		};
+
+		spss_mem: spss_region@8ab00000 { /* for SPSS-PIL */
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0 0x8ab00000 0 0x700000>;
+		};
+
+		adsp_mem: adsp_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0 0x00000000 0 0xffffffff>;
+			reusable;
+			alignment = <0 0x400000>;
+			size = <0 0x800000>;
+		};
+
+		qseecom_mem: qseecom_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0 0x00000000 0 0xffffffff>;
+			reusable;
+			alignment = <0 0x400000>;
+			size = <0 0x1400000>;
+		};
+
+		sp_mem: sp_region {  /* SPSS-HLOS ION shared mem */
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0 0x00000000 0 0xffffffff>; /* 32-bit */
+			reusable;
+			alignment = <0 0x100000>;
+			size = <0 0x800000>;
+		};
+
+		secure_display_memory: secure_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0 0x00000000 0 0xffffffff>;
+			reusable;
+			alignment = <0 0x200000>;
+			size = <0 0x5c00000>;
+		};
+
+		/* global autoconfigured region for contiguous allocations */
+		linux,cma {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0 0x00000000 0 0xffffffff>;
+			reusable;
+			alignment = <0 0x400000>;
+			size = <0 0x2000000>;
+			linux,cma-default;
+		};
+
+		cont_splash_mem: splash_region@9d600000 {
+			reg = <0x0 0x9d600000 0x0 0x02400000>;
+			label = "cont_splash_mem";
+		};
+	};
+};
+
+#include "msm8998-smp2p.dtsi"
+#include "msm-gdsc-8998.dtsi"
+
+&soc {
+	#address-cells = <1>;
+	#size-cells = <1>;
+	ranges = <0 0 0 0xffffffff>;
+	compatible = "simple-bus";
+
+	intc: interrupt-controller@17a00000 {
+		compatible = "arm,gic-v3";
+		reg = <0x17a00000 0x10000>,       /* GICD */
+		      <0x17b00000 0x100000>;      /* GICR * 8 */
+		#interrupt-cells = <3>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		interrupt-controller;
+		#redistributor-regions = <1>;
+		redistributor-stride = <0x0 0x20000>;
+		interrupts = <1 9 4>;
+
+		gic-its@0x17a20000{
+			compatible = "arm,gic-v3-its";
+			msi-contoller;
+			reg = <0x17a20000 0x20000>;
+		};
+	};
+
+	timer {
+		compatible = "arm,armv8-timer";
+		interrupts = <1 1 0xf08>,
+			     <1 2 0xf08>,
+			     <1 3 0xf08>,
+			     <1 0 0xf08>;
+		clock-frequency = <19200000>;
+	};
+
+	restart@10ac000 {
+		compatible = "qcom,pshold";
+		reg = <0x10ac000 0x4>,
+		      <0x1fd3000 0x4>;
+		reg-names = "pshold-base", "tcsr-boot-misc-detect";
+	};
+
+	spmi_bus: qcom,spmi@800f000 {
+		compatible = "qcom,spmi-pmic-arb";
+		reg =	<0x800f000 0x1000>,
+			<0x8400000 0x1000000>,
+			<0x9400000 0x1000000>,
+			<0xa400000 0x220000>,
+			<0x800a000 0x3000>;
+		reg-names = "core", "chnls", "obsrvr", "intr", "cnfg";
+		interrupt-names = "periph_irq";
+		interrupts = <GIC_SPI 326 IRQ_TYPE_NONE>;
+		qcom,ee = <0>;
+		qcom,channel = <0>;
+		qcom,reserved-chan = <511>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+		interrupt-controller;
+		#interrupt-cells = <4>;
+		cell-index = <0>;
+	};
+
+	qcom,sps {
+		compatible = "qcom,msm_sps_4k";
+		qcom,device-type = <3>;
+		qcom,pipe-attr-ee;
+	};
+
+	uartblsp1dm1: serial@0c170000 {
+		compatible = "qcom,msm-uartdm-v1.4", "qcom,msm-uartdm";
+		reg = <0xc170000 0x1000>;
+		interrupts = <0 108 0>;
+		status = "disabled";
+		clocks = <&clock_gcc clk_gcc_blsp1_uart2_apps_clk>,
+			 <&clock_gcc clk_gcc_blsp1_ahb_clk>;
+		clock-names = "core", "iface";
+	};
+
+	uartblsp2dm1: serial@0c1b0000 {
+		compatible = "qcom,msm-uartdm-v1.4", "qcom,msm-uartdm";
+		reg = <0xc1b0000 0x1000>;
+		interrupts = <0 114 0>;
+		status = "disabled";
+		clocks = <&clock_gcc clk_gcc_blsp2_uart2_apps_clk>,
+			 <&clock_gcc clk_gcc_blsp2_ahb_clk>;
+		clock-names = "core", "iface";
+	};
+
+	slim_aud: slim@171c0000 {
+		cell-index = <1>;
+		compatible = "qcom,slim-ngd";
+		reg = <0x171c0000 0x2C000>,
+			<0x17184000 0x32000>;
+		reg-names = "slimbus_physical", "slimbus_bam_physical";
+		interrupts = <0 163 0>, <0 164 0>;
+		interrupt-names = "slimbus_irq", "slimbus_bam_irq";
+		qcom,apps-ch-pipes = <0x00001f80>;
+		qcom,ea-pc = <0x210>;
+	};
+
+	slim_qca: slim@17240000 {
+		status = "ok";
+		cell-index = <3>;
+		compatible = "qcom,slim-ngd";
+		reg = <0x17240000 0x2C000>,
+			<0x17204000 0x26000>;
+		reg-names = "slimbus_physical", "slimbus_bam_physical";
+		interrupts = <0 291 0>, <0 292 0>;
+		interrupt-names = "slimbus_irq", "slimbus_bam_irq";
+
+		/* Slimbus Slave DT for WCN3990 */
+		btfmslim_codec: wcn3990 {
+			compatible = "qcom,btfmslim_slave";
+			elemental-addr = [00 01 20 02 17 02];
+			qcom,btfm-slim-ifd = "btfmslim_slave_ifd";
+			qcom,btfm-slim-ifd-elemental-addr = [00 00 20 02 17 02];
+		};
+	};
+
+	timer@17920000 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		compatible = "arm,armv7-timer-mem";
+		reg = <0x17920000 0x1000>;
+		clock-frequency = <19200000>;
+
+		frame@17921000 {
+			frame-number = <0>;
+			interrupts = <0 8 0x4>,
+				     <0 7 0x4>;
+			reg = <0x17921000 0x1000>,
+			      <0x17922000 0x1000>;
+		};
+
+		frame@17923000 {
+			frame-number = <1>;
+			interrupts = <0 9 0x4>;
+			reg = <0x17923000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17924000 {
+			frame-number = <2>;
+			interrupts = <0 10 0x4>;
+			reg = <0x17924000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17925000 {
+			frame-number = <3>;
+			interrupts = <0 11 0x4>;
+			reg = <0x17925000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17926000 {
+			frame-number = <4>;
+			interrupts = <0 12 0x4>;
+			reg = <0x17926000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17927000 {
+			frame-number = <5>;
+			interrupts = <0 13 0x4>;
+			reg = <0x17927000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17928000 {
+			frame-number = <6>;
+			interrupts = <0 14 0x4>;
+			reg = <0x17928000 0x1000>;
+			status = "disabled";
+		};
+	};
+
+	cpubw: qcom,cpubw {
+		compatible = "qcom,devbw";
+		governor = "performance";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		qcom,bw-tbl =
+			<   762 /*  100 MHz */ >,
+			<  1144 /*  150 MHz */ >,
+			<  1525 /*  200 MHz */ >,
+			<  2288 /*  300 MHz */ >,
+			<  3143 /*  412 MHz */ >,
+			<  4173 /*  547 MHz */ >,
+			<  5195 /*  681 MHz */ >,
+			<  5859 /*  768 MHz */ >,
+			<  7759 /* 1017 MHz */ >,
+			<  9887 /* 1296 MHz */ >,
+			< 11863 /* 1555 MHz */ >,
+			< 13763 /* 1804 MHz */ >;
+	};
+
+	bwmon: qcom,cpu-bwmon {
+		compatible = "qcom,bimc-bwmon3";
+		reg = <0x01008000 0x300>, <0x01001000 0x200>;
+		reg-names = "base", "global_base";
+		interrupts = <0 183 4>;
+		qcom,mport = <0>;
+		qcom,target-dev = <&cpubw>;
+	};
+
+	mincpubw: qcom,mincpubw {
+		compatible = "qcom,devbw";
+		governor = "powersave";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		qcom,bw-tbl =
+			<   762 /*  100 MHz */ >,
+			<  1144 /*  150 MHz */ >,
+			<  1525 /*  200 MHz */ >,
+			<  2288 /*  300 MHz */ >,
+			<  3143 /*  412 MHz */ >,
+			<  4173 /*  547 MHz */ >,
+			<  5195 /*  681 MHz */ >,
+			<  5859 /*  768 MHz */ >,
+			<  7759 /* 1017 MHz */ >,
+			<  9887 /* 1296 MHz */ >,
+			< 11863 /* 1555 MHz */ >,
+			< 13763 /* 1804 MHz */ >;
+	};
+
+	memlat_cpu0: qcom,memlat-cpu0 {
+		compatible = "qcom,devbw";
+		governor = "powersave";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		qcom,bw-tbl =
+			<   762 /*  100 MHz */ >,
+			<  1144 /*  150 MHz */ >,
+			<  1525 /*  200 MHz */ >,
+			<  2288 /*  300 MHz */ >,
+			<  3143 /*  412 MHz */ >,
+			<  4173 /*  547 MHz */ >,
+			<  5195 /*  681 MHz */ >,
+			<  5859 /*  768 MHz */ >,
+			<  7759 /* 1017 MHz */ >,
+			<  9887 /* 1296 MHz */ >,
+			< 11863 /* 1555 MHz */ >,
+			< 13763 /* 1804 MHz */ >;
+	};
+
+	memlat_cpu4: qcom,memlat-cpu4 {
+		compatible = "qcom,devbw";
+		governor = "powersave";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		status = "ok";
+		qcom,bw-tbl =
+			<   762 /*  100 MHz */ >,
+			<  1144 /*  150 MHz */ >,
+			<  1525 /*  200 MHz */ >,
+			<  2288 /*  300 MHz */ >,
+			<  3143 /*  412 MHz */ >,
+			<  4173 /*  547 MHz */ >,
+			<  5195 /*  681 MHz */ >,
+			<  5859 /*  768 MHz */ >,
+			<  7759 /* 1017 MHz */ >,
+			<  9887 /* 1296 MHz */ >,
+			< 11863 /* 1555 MHz */ >,
+			< 13763 /* 1804 MHz */ >;
+	};
+
+	devfreq_memlat_0: qcom,arm-memlat-mon-0 {
+		compatible = "qcom,arm-memlat-mon";
+		qcom,cpulist =	<&CPU0 &CPU1 &CPU2 &CPU3>;
+		qcom,target-dev = <&memlat_cpu0>;
+		qcom,core-dev-table =
+			<  300000 1525 >,
+			<  499200 3143 >,
+			< 1113600 4173 >,
+			< 1881600 5859 >;
+	};
+
+	devfreq_memlat_4: qcom,arm-memlat-mon-4 {
+		compatible = "qcom,arm-memlat-mon";
+		qcom,cpulist =	<&CPU4 &CPU5 &CPU6 &CPU7>;
+		qcom,target-dev = <&memlat_cpu4>;
+		qcom,core-dev-table =
+			<  300000  1525 >,
+			<  480000  3143 >,
+			<  900000  4173 >,
+			< 1017000  7759 >,
+			< 1296000  9887 >,
+			< 1555000 11863 >,
+			< 1804000 13763 >;
+	};
+
+	devfreq_cpufreq: devfreq-cpufreq {
+		mincpubw-cpufreq {
+			target-dev = <&mincpubw>;
+			cpu-to-dev-map-0 =
+				< 1881600 1525 >;
+			cpu-to-dev-map-4 =
+				< 2016000 1525 >,
+				< 2092800 5195 >;
+		};
+	};
+
+	msm_cpufreq: qcom,msm-cpufreq {
+		compatible = "qcom,msm-cpufreq";
+		clock-names = "cpu0_clk", "cpu1_clk", "cpu2_clk",
+				"cpu3_clk", "cpu4_clk", "cpu5_clk",
+				"cpu6_clk", "cpu7_clk";
+		clocks = <&clock_cpu clk_pwrcl_clk>,
+			 <&clock_cpu clk_pwrcl_clk>,
+			 <&clock_cpu clk_pwrcl_clk>,
+			 <&clock_cpu clk_pwrcl_clk>,
+			 <&clock_cpu clk_perfcl_clk>,
+			 <&clock_cpu clk_perfcl_clk>,
+			 <&clock_cpu clk_perfcl_clk>,
+			 <&clock_cpu clk_perfcl_clk>;
+
+		qcom,governor-per-policy;
+
+		qcom,cpufreq-table-0 =
+			<  300000 >,
+			<  345600 >,
+			<  422400 >,
+			<  499200 >,
+			<  576000 >,
+			<  633600 >,
+			<  710400 >,
+			<  806400 >,
+			<  883200 >,
+			<  960000 >,
+			< 1036800 >,
+			< 1113600 >,
+			< 1190400 >,
+			< 1248000 >,
+			< 1324800 >,
+			< 1401600 >,
+			< 1478400 >,
+			< 1574400 >,
+			< 1651200 >,
+			< 1728000 >,
+			< 1804800 >,
+			< 1881600 >;
+
+		qcom,cpufreq-table-4 =
+			<  300000 >,
+			<  345600 >,
+			<  422400 >,
+			<  480000 >,
+			<  556800 >,
+			<  633600 >,
+			<  710400 >,
+			<  787200 >,
+			<  844800 >,
+			<  902400 >,
+			<  979200 >,
+			< 1056000 >,
+			< 1171200 >,
+			< 1248000 >,
+			< 1324800 >,
+			< 1401600 >,
+			< 1478400 >,
+			< 1536000 >,
+			< 1632000 >,
+			< 1708800 >,
+			< 1785600 >,
+			< 1862400 >,
+			< 1939200 >,
+			< 2016000 >,
+			< 2092800 >;
+	};
+
+	arm64-cpu-erp {
+		compatible = "arm,arm64-cpu-erp";
+		interrupts = <0 43 4>,
+			     <0 44 4>,
+			     <0 41 4>,
+			     <0 42 4>;
+
+		interrupt-names = "pri-dbe-irq",
+				  "sec-dbe-irq",
+				  "pri-ext-irq",
+				  "sec-ext-irq";
+
+		poll-delay-ms = <5000>;
+	};
+
+	clock_gcc: qcom,gcc@100000 {
+		compatible = "qcom,gcc-8998";
+		reg = <0x100000 0xb0000>;
+		reg-names = "cc_base";
+		vdd_dig-supply = <&pm8998_s1_level>;
+		vdd_dig_ao-supply = <&pm8998_s1_level_ao>;
+		#clock-cells = <1>;
+		#reset-cells = <1>;
+	};
+
+	clock_mmss: qcom,mmsscc@c8c0000 {
+		compatible = "qcom,mmsscc-8998";
+		reg = <0xc8c0000 0x40000>;
+		reg-names = "cc_base";
+		vdd_dig-supply = <&pm8998_s1_level>;
+		vdd_mmsscc_mx-supply = <&pm8998_s9_level>;
+		clock-names = "xo", "gpll0", "gpll0_div",
+				"pclk0_src", "pclk1_src",
+				"byte0_src", "byte1_src",
+				"dp_link_src", "dp_vco_div",
+				"extpclk_src";
+		clocks = <&clock_gcc clk_cxo_clk_src>,
+			 <&clock_gcc clk_gcc_mmss_gpll0_clk>,
+			 <&clock_gcc clk_gcc_mmss_gpll0_div_clk>,
+			 <&mdss_dsi0_pll clk_dsi0pll_pclk_mux>,
+			 <&mdss_dsi1_pll clk_dsi1pll_pclk_mux>,
+			 <&mdss_dsi0_pll clk_dsi0pll_byteclk_mux>,
+			 <&mdss_dsi1_pll clk_dsi1pll_byteclk_mux>,
+			 <&mdss_dp_pll clk_dp_link_2x_clk_divsel_five>,
+			 <&mdss_dp_pll clk_vco_divided_clk_src_mux>,
+			 <&mdss_hdmi_pll clk_hdmi_vco_clk>;
+		#clock-cells = <1>;
+		#reset-cells = <1>;
+	};
+
+	clock_gpu: qcom,gpucc@5065000 {
+		compatible = "qcom,gpucc-8998";
+		reg = <0x5065000 0x9000>;
+		reg-names = "cc_base";
+		vdd_dig-supply = <&pm8998_s1_level>;
+		clock-names = "xo_ao", "gpll0";
+		clocks = <&clock_gcc clk_cxo_clk_src_ao>,
+			<&clock_gcc clk_gcc_gpu_gpll0_clk>;
+		#clock-cells = <1>;
+	};
+
+	clock_gfx: qcom,gfxcc@5065000 {
+		compatible = "qcom,gfxcc-8998";
+		reg = <0x5065000 0x9000>;
+		reg-names = "cc_base";
+		vdd_gpucc-supply = <&gfx_vreg>;
+		vdd_mx-supply = <&pm8998_s9_level>;
+		vdd_gpu_mx-supply = <&pm8998_s9_level>;
+		qcom,gfx3d_clk_src-opp-handle = <&msm_gpu>;
+		qcom,gfxfreq-speedbin0 =
+			<	  0 0				0 >,
+			< 171000000 1 RPM_SMD_REGULATOR_LEVEL_SVS >,
+			< 251000000 2 RPM_SMD_REGULATOR_LEVEL_SVS >,
+			< 332000000 3 RPM_SMD_REGULATOR_LEVEL_SVS >,
+			< 403000000 4 RPM_SMD_REGULATOR_LEVEL_SVS >,
+			< 504000000 5 RPM_SMD_REGULATOR_LEVEL_NOM >,
+			< 650000000 6 RPM_SMD_REGULATOR_LEVEL_TURBO >;
+		qcom,gfxfreq-mx-speedbin0 =
+			<         0			      0 >,
+			< 171000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+			< 251000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+			< 332000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+			< 403000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+			< 504000000 RPM_SMD_REGULATOR_LEVEL_NOM >,
+			< 650000000 RPM_SMD_REGULATOR_LEVEL_TURBO >;
+		#clock-cells = <1>;
+	};
+
+	clock_cpu: qcom,cpu-clock-8998@179c0000 {
+		compatible = "qcom,cpu-clock-osm-msm8998-v1";
+		reg = <0x179c0000 0x4000>,
+		      <0x17916000 0x1000>,
+		      <0x17816000 0x1000>,
+		      <0x179d1000 0x1000>,
+		      <0x00784130 0x8>,
+		      <0x1791101c 0x8>;
+		reg-names = "osm", "pwrcl_pll", "perfcl_pll",
+			    "apcs_common", "perfcl_efuse", "debug";
+
+		vdd-pwrcl-supply = <&apc0_pwrcl_vreg>;
+		vdd-perfcl-supply = <&apc1_perfcl_vreg>;
+
+		interrupts = <GIC_SPI 35 IRQ_TYPE_EDGE_RISING>,
+			     <GIC_SPI 36 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "pwrcl-irq", "perfcl-irq";
+
+		qcom,pwrcl-speedbin0-v0 =
+			<   300000000 0x0004000f 0x01200020 0x1 1 >,
+			<   345600000 0x05040012 0x02200020 0x1 2 >,
+			<   422400000 0x05040016 0x02200020 0x1 3 >,
+			<   499200000 0x0504001a 0x02200020 0x1 4 >,
+			<   576000000 0x0504001e 0x03200020 0x1 5 >,
+			<   633600000 0x05040021 0x03200020 0x1 6 >,
+			<   710400000 0x05040025 0x03200020 0x1 7 >,
+			<   806400000 0x0504002a 0x04200020 0x1 8 >,
+			<   883200000 0x0404002e 0x04250025 0x1 9 >,
+			<   960000000 0x04040032 0x05280028 0x1 10 >,
+			<  1036800000 0x04040036 0x052b002b 0x2 11 >,
+			<  1113600000 0x0404003a 0x052e002e 0x2 12 >,
+			<  1190400000 0x0404003e 0x06320032 0x2 13 >,
+			<  1248000000 0x04040041 0x06340034 0x2 14 >,
+			<  1324800000 0x04040045 0x06370037 0x2 15 >,
+			<  1401600000 0x04040049 0x073a003a 0x2 16 >,
+			<  1478400000 0x0404004d 0x073e003e 0x2 17 >,
+			<  1574400000 0x04040052 0x08420042 0x2 18 >,
+			<  1651200000 0x04040056 0x08450045 0x2 19 >,
+			<  1728000000 0x0404005a 0x08480048 0x2 20 >,
+			<  1804800000 0x0404005e 0x094b004b 0x3 21 >,
+			<  1881600000 0x04040062 0x094e004e 0x3 22 >;
+
+		qcom,perfcl-speedbin0-v0 =
+			<   300000000 0x0004000f 0x01200020 0x1 1 >,
+			<   345600000 0x05040012 0x02200020 0x1 2 >,
+			<   422400000 0x05040016 0x02200020 0x1 3 >,
+			<   480000000 0x05040019 0x02200020 0x1 4 >,
+			<   556800000 0x0504001d 0x03200020 0x1 5 >,
+			<   633600000 0x05040021 0x03200020 0x1 6 >,
+			<   710400000 0x05040025 0x03200020 0x1 7 >,
+			<   787200000 0x05040029 0x04200020 0x1 8 >,
+			<   844800000 0x0404002c 0x04230023 0x1 9 >,
+			<   902400000 0x0404002f 0x04260026 0x1 10 >,
+			<   979200000 0x04040033 0x05290029 0x1 11 >,
+			<  1056000000 0x04040037 0x052c002c 0x1 12 >,
+			<  1171200000 0x0404003d 0x06310031 0x2 13 >,
+			<  1248000000 0x04040041 0x06340034 0x2 14 >,
+			<  1324800000 0x04040045 0x06370037 0x2 15 >,
+			<  1401600000 0x04040049 0x073a003a 0x2 16 >,
+			<  1478400000 0x0404004d 0x073e003e 0x2 17 >,
+			<  1536000000 0x04040050 0x07400040 0x2 18 >,
+			<  1632000000 0x04040055 0x08440044 0x2 19 >,
+			<  1708800000 0x04040059 0x08470047 0x2 20 >,
+			<  1785600000 0x0404005d 0x094a004a 0x2 21 >,
+			<  1862400000 0x04040061 0x094e004e 0x2 22 >,
+			<  1939200000 0x04040065 0x09510051 0x3 23 >,
+			<  2016000000 0x04040069 0x0a540054 0x3 24 >,
+			<  2092800000 0x0404006d 0x0a570057 0x3 25 >;
+
+		qcom,up-timer =
+			<1000 1000>;
+		qcom,down-timer =
+			<1000 1000>;
+		qcom,pc-override-index =
+			<0 0>;
+		qcom,set-ret-inactive;
+		qcom,enable-llm-freq-vote;
+		qcom,llm-freq-up-timer =
+			<327675 327675>;
+		qcom,llm-freq-down-timer =
+			<327675 327675>;
+		qcom,enable-llm-volt-vote;
+		qcom,llm-volt-up-timer =
+			<327675 327675>;
+		qcom,llm-volt-down-timer =
+			<327675 327675>;
+		qcom,cc-reads = <10>;
+		qcom,cc-delay = <5>;
+		qcom,cc-factor = <100>;
+		qcom,osm-clk-rate = <200000000>;
+		qcom,xo-clk-rate = <19200000>;
+
+		qcom,l-val-base =
+			<0x17916004 0x17816004>;
+		qcom,apcs-itm-present =
+			<0x179d143c 0x179d143c>;
+		qcom,apcs-pll-user-ctl =
+			<0x1791600c 0x1781600c>;
+		qcom,apcs-cfg-rcgr =
+			<0x17911054 0x17811054>;
+		qcom,apcs-cmd-rcgr =
+			<0x17911050 0x17811050>;
+		qcom,apm-mode-ctl =
+			<0x179d0004 0x179d0010>;
+		qcom,apm-ctrl-status =
+			<0x179d000c 0x179d0018>;
+		qcom,llm-sw-overr=
+			<0x8fff0036 0x8fff003a 0x0fff0036>,
+			<0x8fff003d 0x8fff0041 0x0fff003d>;
+
+		qcom,apm-threshold-voltage = <832000>;
+		qcom,boost-fsm-en;
+		qcom,safe-fsm-en;
+		qcom,ps-fsm-en;
+		qcom,droop-fsm-en;
+		qcom,wfx-fsm-en;
+		qcom,pc-fsm-en;
+
+		qcom,pwrcl-apcs-mem-acc-cfg =
+			<0x179d1360 0x179d1364 0x179d1364>;
+		qcom,perfcl-apcs-mem-acc-cfg =
+			<0x179d1368 0x179d136C 0x179d1370>;
+		qcom,pwrcl-apcs-mem-acc-val =
+			<0x00000000 0x80000000 0x80000000>,
+			<0x00000000 0x00000000 0x00000000>,
+			<0x00000000 0x00000001 0x00000001>;
+		qcom,perfcl-apcs-mem-acc-val =
+			<0x00000000 0x00000000 0x80000000>,
+			<0x00000000 0x00000000 0x00000000>,
+			<0x00000000 0x00000000 0x00000001>;
+
+		clock-names = "aux_clk", "xo_ao";
+		clocks = <&clock_gcc clk_hmss_gpll0_clk_src>,
+			<&clock_gcc clk_cxo_clk_src_ao>;
+		#clock-cells = <1>;
+	};
+
+	clock_debug: qcom,debugcc@162000 {
+		compatible = "qcom,cc-debug-8998";
+		reg = <0x162000 0x4>;
+		reg-names = "cc_base";
+		clock-names = "debug_gpu_clk", "debug_gfx_clk",
+				"debug_mmss_clk", "debug_cpu_clk";
+		clocks = <&clock_gpu clk_gpucc_gcc_dbg_clk>,
+			 <&clock_gfx clk_gfxcc_dbg_clk>,
+			 <&clock_mmss clk_mmss_debug_mux>,
+			 <&clock_cpu clk_cpu_debug_mux>;
+		#clock-cells = <1>;
+	};
+
+	qcom,rmtfs_sharedmem@0 {
+		compatible = "qcom,sharedmem-uio";
+		reg = <0x0 0x00200000>;
+		reg-names = "rmtfs";
+		qcom,client-id = <0x00000001>;
+	};
+
+	qcom,msm_gsi {
+		compatible = "qcom,msm_gsi";
+	};
+
+	qcom,rmnet-ipa {
+		compatible = "qcom,rmnet-ipa3";
+		qcom,rmnet-ipa-ssr;
+		qcom,ipa-loaduC;
+		qcom,ipa-advertise-sg-support;
+	};
+
+	ipa_hw: qcom,ipa@01e00000 {
+		compatible = "qcom,ipa";
+		reg = <0x01e00000 0x34000>,
+			<0x01e84000 0x31fff>,
+			<0x01e04000 0x2c000>;
+		reg-names = "ipa-base", "bam-base", "gsi-base";
+		interrupts =
+			<0 333 0>,
+			<0 432 0>,
+			<0 432 0>;
+		interrupt-names = "ipa-irq", "bam-irq", "gsi-irq";
+		qcom,ipa-hw-ver = <11>; /* IPA core version = IPAv3.1 */
+		qcom,ipa-hw-mode = <0>; /* IPA hw type = Normal */
+		qcom,ee = <0>;
+		qcom,use-gsi;
+		qcom,use-ipa-tethering-bridge;
+		qcom,modem-cfg-emb-pipe-flt;
+		qcom,do-not-use-ch-gsi-20;
+		qcom,ipa-wdi2;
+		qcom,use-64-bit-dma-mask;
+		clocks = <&clock_gcc clk_ipa_clk>;
+		clock-names = "core_clk";
+		qcom,arm-smmu;
+		qcom,smmu-disable-htw;
+		qcom,smmu-s1-bypass;
+		qcom,msm-bus,name = "ipa";
+		qcom,msm-bus,num-cases = <4>;
+		qcom,msm-bus,num-paths = <4>;
+		qcom,msm-bus,vectors-KBps =
+		/* No vote */
+			<90 512 0 0>,
+			<90 585 0 0>,
+			<1 676 0 0>,
+			 /* SMMU smmu_aggre2_noc_clk */
+			<81 10065 0 0>,
+		/* SVS */
+			<90 512 80000 640000>,
+			<90 585 80000 640000>,
+			<1 676 80000 80000>,
+			/* SMMU smmu_aggre2_noc_clk */
+			<81 10065 0 16000>,
+		/* NOMINAL */
+			<90 512 206000 960000>,
+			<90 585 206000 960000>,
+			<1 676 206000 160000>,
+			/* SMMU smmu_aggre2_noc_clk */
+			<81 10065 0 16000>,
+		/* TURBO */
+			<90 512 206000 3600000>,
+			<90 585 206000 3600000>,
+			<1 676 206000 300000>,
+			/* SMMU smmu_aggre2_noc_clk */
+			<81 10065 0 16000>;
+		qcom,bus-vector-names = "MIN", "SVS", "NOMINAL", "TURBO";
+
+		/* IPA RAM mmap */
+		qcom,ipa-ram-mmap = <
+				0x280	/* ofst_start; */
+				0x0	/* nat_ofst; */
+				0x0	/* nat_size; */
+				0x288	/* v4_flt_hash_ofst; */
+				0x78	/* v4_flt_hash_size; */
+				0x4000	/* v4_flt_hash_size_ddr; */
+				0x308	/* v4_flt_nhash_ofst; */
+				0x78	/* v4_flt_nhash_size; */
+				0x4000	/* v4_flt_nhash_size_ddr; */
+				0x388	/* v6_flt_hash_ofst; */
+				0x78	/* v6_flt_hash_size; */
+				0x4000	/* v6_flt_hash_size_ddr; */
+				0x408	/* v6_flt_nhash_ofst; */
+				0x78	/* v6_flt_nhash_size; */
+				0x4000	/* v6_flt_nhash_size_ddr; */
+				0xf	/* v4_rt_num_index; */
+				0x0	/* v4_modem_rt_index_lo; */
+				0x7	/* v4_modem_rt_index_hi; */
+				0x8	/* v4_apps_rt_index_lo; */
+				0xe	/* v4_apps_rt_index_hi; */
+				0x488	/* v4_rt_hash_ofst; */
+				0x78	/* v4_rt_hash_size; */
+				0x4000	/* v4_rt_hash_size_ddr; */
+				0x508	/* v4_rt_nhash_ofst; */
+				0x78	/* v4_rt_nhash_size; */
+				0x4000	/* v4_rt_nhash_size_ddr; */
+				0xf	/* v6_rt_num_index; */
+				0x0	/* v6_modem_rt_index_lo; */
+				0x7	/* v6_modem_rt_index_hi; */
+				0x8	/* v6_apps_rt_index_lo; */
+				0xe	/* v6_apps_rt_index_hi; */
+				0x588	/* v6_rt_hash_ofst; */
+				0x78	/* v6_rt_hash_size; */
+				0x4000	/* v6_rt_hash_size_ddr; */
+				0x608	/* v6_rt_nhash_ofst; */
+				0x78	/* v6_rt_nhash_size; */
+				0x4000	/* v6_rt_nhash_size_ddr; */
+				0x688	/* modem_hdr_ofst; */
+				0x140	/* modem_hdr_size; */
+				0x7c8	/* apps_hdr_ofst; */
+				0x0	/* apps_hdr_size; */
+				0x800	/* apps_hdr_size_ddr; */
+				0x7d0	/* modem_hdr_proc_ctx_ofst; */
+				0x200	/* modem_hdr_proc_ctx_size; */
+				0x9d0	/* apps_hdr_proc_ctx_ofst; */
+				0x200	/* apps_hdr_proc_ctx_size; */
+				0x0	/* apps_hdr_proc_ctx_size_ddr; */
+				0x0	/* modem_comp_decomp_ofst; diff */
+				0x0	/* modem_comp_decomp_size; diff */
+				0xbd8	/* modem_ofst; */
+				0x1424	/* modem_size; */
+				0x1ffc	/* apps_v4_flt_hash_ofst; */
+				0x0	/* apps_v4_flt_hash_size; */
+				0x1ffc	/* apps_v4_flt_nhash_ofst; */
+				0x0	/* apps_v4_flt_nhash_size; */
+				0x1ffc	/* apps_v6_flt_hash_ofst; */
+				0x0	/* apps_v6_flt_hash_size; */
+				0x1ffc	/* apps_v6_flt_nhash_ofst; */
+				0x0	/* apps_v6_flt_nhash_size; */
+				0x80	/* uc_info_ofst; */
+				0x200	/* uc_info_size; */
+				0x2000	/* end_ofst; */
+				0x1ffc	/* apps_v4_rt_hash_ofst; */
+				0x0	/* apps_v4_rt_hash_size; */
+				0x1ffc	/* apps_v4_rt_nhash_ofst; */
+				0x0	/* apps_v4_rt_nhash_size; */
+				0x1ffc	/* apps_v6_rt_hash_ofst; */
+				0x0	/* apps_v6_rt_hash_size; */
+				0x1ffc	/* apps_v6_rt_nhash_ofst; */
+				0x0	/* apps_v6_rt_nhash_size; */
+				>;
+
+		/* smp2p gpio information */
+		qcom,smp2pgpio_map_ipa_1_out {
+			compatible = "qcom,smp2pgpio-map-ipa-1-out";
+			gpios = <&smp2pgpio_ipa_1_out 0 0>;
+		};
+
+		qcom,smp2pgpio_map_ipa_1_in {
+			compatible = "qcom,smp2pgpio-map-ipa-1-in";
+			gpios = <&smp2pgpio_ipa_1_in 0 0>;
+		};
+
+		ipa_smmu_ap: ipa_smmu_ap {
+			compatible = "qcom,ipa-smmu-ap-cb";
+			iommus = <&anoc2_smmu 0x18e0>;
+			qcom,iova-mapping = <0x10000000 0x40000000>;
+		};
+
+		ipa_smmu_wlan: ipa_smmu_wlan {
+			compatible = "qcom,ipa-smmu-wlan-cb";
+			iommus = <&anoc2_smmu 0x18e1>;
+		};
+
+		ipa_smmu_uc: ipa_smmu_uc {
+			compatible = "qcom,ipa-smmu-uc-cb";
+			iommus = <&anoc2_smmu 0x18e2>;
+			qcom,iova-mapping = <0x40000000 0x20000000>;
+		};
+	};
+
+	qcom,ipa_fws@1e08000 {
+		compatible = "qcom,pil-tz-generic";
+		qcom,pas-id = <0xF>;
+		qcom,firmware-name = "ipa_fws";
+	};
+
+	qcom,chd_silver {
+		compatible = "qcom,core-hang-detect";
+		label = "silver";
+		qcom,threshold-arr = <0x179880b0 0x179980b0
+		0x179a80b0 0x179b80b0>;
+		qcom,config-arr = <0x179880b8 0x179980b8
+		0x179a80b8 0x179b80b8>;
+	};
+
+	qcom,chd_gold {
+		compatible = "qcom,core-hang-detect";
+		label = "gold";
+		qcom,threshold-arr = <0x178880b0 0x178980b0
+		0x178a80b0 0x178b80b0>;
+		qcom,config-arr = <0x178880b8 0x178980b8
+		0x178a80b8 0x178b80b8>;
+	};
+
+	qcom,ipc-spinlock@1f40000 {
+		compatible = "qcom,ipc-spinlock-sfpb";
+		reg = <0x1f40000 0x8000>;
+		qcom,num-locks = <8>;
+	};
+
+	qcom,ghd {
+		compatible = "qcom,gladiator-hang-detect";
+		qcom,threshold-arr = <0x179d141c 0x179d1420
+		0x179d1424 0x179d1428 0x179d142c 0x179d1430>;
+		qcom,config-reg = <0x179d1434>;
+	};
+
+	qcom,msm-gladiator-v2@17900000 {
+		compatible = "qcom,msm-gladiator-v2";
+		reg = <0x17900000 0xe000>;
+		reg-names = "gladiator_base";
+		interrupts = <0 22 0>;
+		clock-names = "atb_clk";
+		clocks = <&clock_gcc clk_qdss_clk>;
+	};
+
+	qcom,smem@86000000 {
+		compatible = "qcom,smem";
+		reg = <0x86000000 0x200000>,
+			<0x17911008 0x4>,
+			<0x778000 0x7000>,
+			<0x1fd4000 0x8>;
+		reg-names = "smem", "irq-reg-base", "aux-mem1",
+			"smem_targ_info_reg";
+		qcom,mpu-enabled;
+	};
+
+	qcom,msm-adsprpc-mem {
+		compatible = "qcom,msm-adsprpc-mem-region";
+		memory-region = <&adsp_mem>;
+	};
+
+	qcom,msm_fastrpc {
+		compatible = "qcom,msm-fastrpc-adsp";
+		qcom,fastrpc-glink;
+
+		qcom,msm_fastrpc_cpz_cb1 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 2>;
+			qcom,secure-context-bank;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb1 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 8>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb2 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 9>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb3 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 10>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb4 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 11>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb6 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 5>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb7 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 6>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb8 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 7>;
+			dma-coherent;
+		};
+	};
+
+	rpm_bus: qcom,rpm-smd {
+		compatible = "qcom,rpm-glink";
+		qcom,glink-edge = "rpm";
+		rpm-channel-name = "rpm_requests";
+	};
+
+	glink_mpss: qcom,glink-ssr-modem {
+		compatible = "qcom,glink_ssr";
+		label = "modem";
+		qcom,edge = "mpss";
+		qcom,notify-edges = <&glink_lpass>, <&glink_dsps>, <&glink_rpm>;
+		qcom,xprt = "smem";
+	};
+
+	glink_lpass: qcom,glink-ssr-adsp {
+		compatible = "qcom,glink_ssr";
+		label = "adsp";
+		qcom,edge = "lpass";
+		qcom,notify-edges = <&glink_mpss>, <&glink_dsps>, <&glink_rpm>;
+		qcom,xprt = "smem";
+	};
+
+	glink_dsps: qcom,glink-ssr-dsps {
+		compatible = "qcom,glink_ssr";
+		label = "slpi";
+		qcom,edge = "dsps";
+		qcom,notify-edges = <&glink_mpss>, <&glink_lpass>, <&glink_rpm>;
+		qcom,xprt = "smem";
+	};
+
+	glink_rpm: qcom,glink-ssr-rpm {
+		compatible = "qcom,glink_ssr";
+		label = "rpm";
+		qcom,edge = "rpm";
+		qcom,notify-edges = <&glink_lpass>, <&glink_mpss>,
+					<&glink_dsps>, <&glink_spss>;
+		qcom,xprt = "smem";
+	};
+
+	glink_spss: qcom,glink-ssr-spss {
+		compatible = "qcom,glink_ssr";
+		label = "spss";
+		qcom,edge = "spss";
+		qcom,notify-edges = <&glink_mpss>, <&glink_lpass>,
+				<&glink_dsps>, <&glink_rpm>;
+		qcom,xprt = "mailbox";
+	};
+
+	qcom,glink-smem-native-xprt-modem@86000000 {
+		compatible = "qcom,glink-smem-native-xprt";
+		reg = <0x86000000 0x200000>,
+			<0x17911008 0x4>;
+		reg-names = "smem", "irq-reg-base";
+		qcom,irq-mask = <0x8000>;
+		interrupts = <0 452 1>;
+		label = "mpss";
+	};
+
+	qcom,glink-smem-native-xprt-adsp@86000000 {
+		compatible = "qcom,glink-smem-native-xprt";
+		reg = <0x86000000 0x200000>,
+			<0x17911008 0x4>;
+		reg-names = "smem", "irq-reg-base";
+		qcom,irq-mask = <0x200>;
+		interrupts = <0 157 1>;
+		label = "lpass";
+		qcom,qos-config = <&glink_qos_adsp>;
+		qcom,ramp-time = <0xaf>;
+	};
+
+	glink_qos_adsp: qcom,glink-qos-config-adsp {
+		compatible = "qcom,glink-qos-config";
+		qcom,flow-info = <0x3c 0x0>,
+				<0x3c 0x0>,
+				<0x3c 0x0>,
+				<0x3c 0x0>;
+		qcom,mtu-size = <0x800>;
+		qcom,tput-stats-cycle = <0xa>;
+	};
+
+	qcom,glink-smem-native-xprt-dsps@86000000 {
+		compatible = "qcom,glink-smem-native-xprt";
+		reg = <0x86000000 0x200000>,
+			<0x17911008 0x4>;
+		reg-names = "smem", "irq-reg-base";
+		qcom,irq-mask = <0x8000000>;
+		interrupts = <0 179 1>;
+		label = "dsps";
+	};
+
+	qcom,glink-smem-native-xprt-rpm@778000 {
+		compatible = "qcom,glink-rpm-native-xprt";
+		reg = <0x778000 0x7000>,
+			<0x17911008 0x4>;
+		reg-names = "msgram", "irq-reg-base";
+		qcom,irq-mask = <0x1>;
+		interrupts = <0 168 1>;
+		label = "rpm";
+	};
+
+	qcom,glink-mailbox-xprt-spss@1d05008 {
+		compatible = "qcom,glink-mailbox-xprt";
+		reg = <0x1d05008 0x8>,
+			<0x1d05010 0x4>,
+			<0x1d0501c 0x4>,
+			<0x1d06008 0x4>;
+		reg-names = "mbox-loc-addr", "mbox-loc-size", "irq-reg-base",
+			"irq-rx-reset";
+		qcom,irq-mask = <0x1>;
+		interrupts = <0 348 4>;
+		label = "spss";
+		qcom,tx-ring-size = <0x800>;
+		qcom,rx-ring-size = <0x800>;
+	};
+
+	glink_spi_xprt_wdsp: qcom,glink-spi-xprt-wdsp {
+		compatible = "qcom,glink-spi-xprt";
+		label = "wdsp";
+		qcom,remote-fifo-config = <&glink_fifo_wdsp>;
+		qcom,qos-config = <&glink_qos_wdsp>;
+		qcom,ramp-time = <0x10>,
+				     <0x20>,
+				     <0x30>,
+				     <0x40>;
+	};
+
+	glink_fifo_wdsp: qcom,glink-fifo-config-wdsp {
+		compatible = "qcom,glink-fifo-config";
+		qcom,out-read-idx-reg = <0x12000>;
+		qcom,out-write-idx-reg = <0x12004>;
+		qcom,in-read-idx-reg = <0x1200C>;
+		qcom,in-write-idx-reg = <0x12010>;
+	};
+
+	glink_qos_wdsp: qcom,glink-qos-config-wdsp {
+		compatible = "qcom,glink-qos-config";
+		qcom,flow-info = <0x80 0x0>,
+				 <0x70 0x1>,
+				 <0x60 0x2>,
+				 <0x50 0x3>;
+		qcom,mtu-size = <0x800>;
+		qcom,tput-stats-cycle = <0xa>;
+	};
+
+	qcom,glink_pkt {
+		compatible = "qcom,glinkpkt";
+
+		qcom,glinkpkt-at-mdm0 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DS";
+			qcom,glinkpkt-dev-name = "at_mdm0";
+		};
+
+		qcom,glinkpkt-loopback_cntl {
+			qcom,glinkpkt-transport = "lloop";
+			qcom,glinkpkt-edge = "local";
+			qcom,glinkpkt-ch-name = "LOCAL_LOOPBACK_CLNT";
+			qcom,glinkpkt-dev-name = "glink_pkt_loopback_ctrl";
+		};
+
+		qcom,glinkpkt-loopback_data {
+			qcom,glinkpkt-transport = "lloop";
+			qcom,glinkpkt-edge = "local";
+			qcom,glinkpkt-ch-name = "glink_pkt_lloop_CLNT";
+			qcom,glinkpkt-dev-name = "glink_pkt_loopback";
+		};
+
+		qcom,glinkpkt-apr-apps2 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "adsp";
+			qcom,glinkpkt-ch-name = "apr_apps2";
+			qcom,glinkpkt-dev-name = "apr_apps2";
+		};
+
+		qcom,glinkpkt-data40-cntl {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DATA40_CNTL";
+			qcom,glinkpkt-dev-name = "smdcntl8";
+		};
+
+		qcom,glinkpkt-data1 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DATA1";
+			qcom,glinkpkt-dev-name = "smd7";
+		};
+
+		qcom,glinkpkt-data4 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DATA4";
+			qcom,glinkpkt-dev-name = "smd8";
+		};
+
+		qcom,glinkpkt-data11 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DATA11";
+			qcom,glinkpkt-dev-name = "smd11";
+		};
+	};
+
+	qcom,ipc_router {
+		compatible = "qcom,ipc_router";
+		qcom,node-id = <1>;
+	};
+
+	qcom,ipc_router_modem_xprt {
+		compatible = "qcom,ipc_router_glink_xprt";
+		qcom,ch-name = "IPCRTR";
+		qcom,xprt-remote = "mpss";
+		qcom,glink-xprt = "smem";
+		qcom,xprt-linkid = <1>;
+		qcom,xprt-version = <1>;
+		qcom,fragmented-data;
+	};
+
+	qcom,ipc_router_q6_xprt {
+		compatible = "qcom,ipc_router_glink_xprt";
+		qcom,ch-name = "IPCRTR";
+		qcom,xprt-remote = "lpass";
+		qcom,glink-xprt = "smem";
+		qcom,xprt-linkid = <1>;
+		qcom,xprt-version = <1>;
+		qcom,fragmented-data;
+	};
+
+	qcom,ipc_router_dsps_xprt {
+		compatible = "qcom,ipc_router_glink_xprt";
+		qcom,ch-name = "IPCRTR";
+		qcom,xprt-remote = "dsps";
+		qcom,glink-xprt = "smem";
+		qcom,xprt-linkid = <1>;
+		qcom,xprt-version = <1>;
+		qcom,fragmented-data;
+		qcom,dynamic-wakeup-source;
+	};
+
+	qcom,spcom {
+		compatible = "qcom,spcom";
+
+		/* predefined channels, remote side is server */
+		qcom,spcom-ch-names = "sp_kernel" , "sp_ssr";
+		status = "ok";
+	};
+
+	spss_utils: qcom,spss_utils {
+		compatible = "qcom,spss-utils";
+		/* spss fuses physical address */
+		qcom,spss-fuse1-addr = <0x007841c4>;
+		qcom,spss-fuse1-bit = <27>;
+		qcom,spss-fuse2-addr = <0x0078413c>;
+		qcom,spss-fuse2-bit = <31>;
+		qcom,spss-test-firmware-name = "spss";    /* default name */
+		qcom,spss-prod-firmware-name = "spss1p";  /* 8 chars max */
+		qcom,spss-hybr-firmware-name = "spss1h";  /* 8 chars max */
+		qcom,spss-debug-reg-addr = <0x01d06020>;
+		status = "ok";
+	};
+
+	sdhc_2: sdhci@c0a4900 {
+		compatible = "qcom,sdhci-msm";
+		reg = <0xc0a4900 0x314>, <0xc0a4000 0x800>;
+		reg-names = "hc_mem", "core_mem";
+
+		interrupts = <0 125 0>, <0 221 0>;
+		interrupt-names = "hc_irq", "pwr_irq";
+
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc clk_gcc_sdcc2_ahb_clk>,
+			 <&clock_gcc clk_gcc_sdcc2_apps_clk>;
+
+		qcom,large-address-bus;
+		qcom,bus-width = <4>;
+		qcom,cpu-dma-latency-us = <701>;
+
+		qcom,devfreq,freq-table = <52000000 200000000>;
+
+		qcom,msm-bus,name = "sdhc2";
+		qcom,msm-bus,num-cases = <8>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps = <81 512 0 0>, /* No vote */
+				<81 512 1600 3200>,    /* 400 KB/s*/
+				<81 512 80000 160000>, /* 20 MB/s */
+				<81 512 100000 200000>, /* 25 MB/s */
+				<81 512 200000 400000>, /* 50 MB/s */
+				<81 512 400000 800000>, /* 100 MB/s */
+				<81 512 800000 800000>, /* 200 MB/s */
+				<81 512 2048000 4096000>; /* Max. bandwidth */
+		qcom,bus-bw-vectors-bps = <0 400000 20000000 25000000 50000000
+						100000000 200000000 4294967295>;
+
+		qcom,sdr104-wa;
+
+		status = "disabled";
+	};
+
+	ufsphy1: ufsphy@1da7000 {
+		compatible = "qcom,ufs-phy-qmp-v3";
+		reg = <0x1da7000 0xda8>;
+		reg-names = "phy_mem";
+		#phy-cells = <0>;
+		clock-names = "ref_clk_src",
+			"ref_clk",
+			"ref_aux_clk";
+		clocks = <&clock_gcc clk_ln_bb_clk1>,
+			<&clock_gcc clk_gcc_ufs_clkref_clk>,
+			<&clock_gcc clk_gcc_ufs_phy_aux_hw_ctl_clk>;
+		status = "disabled";
+	};
+
+	ufs_ice: ufsice@1db0000 {
+		compatible = "qcom,ice";
+		reg = <0x1db0000 0x8000>;
+		qcom,enable-ice-clk;
+		clock-names =   "ufs_core_clk",
+				"bus_clk",
+				"iface_clk",
+				"ice_core_clk";
+		clocks = <&clock_gcc clk_gcc_ufs_axi_clk>,
+			 <&clock_gcc clk_gcc_aggre1_ufs_axi_clk>,
+			 <&clock_gcc clk_gcc_ufs_ahb_clk>,
+			 <&clock_gcc clk_gcc_ufs_ice_core_clk>;
+		qcom,op-freq-hz =	<0>,
+					<0>,
+					<0>,
+					<300000000>;
+		vdd-hba-supply = <&gdsc_ufs>;
+		qcom,msm-bus,name = "ufs_ice_noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<1 650 0 0>,    /* No vote */
+				<1 650 1000 0>; /* Max. bandwidth */
+		qcom,bus-vector-names = "MIN",
+					"MAX";
+		qcom,instance-type = "ufs";
+		status = "disabled";
+	};
+
+	ufs1: ufshc@1da4000 {
+		compatible = "qcom,ufshc";
+		reg = <0x1da4000 0x2500>;
+		interrupts = <0 265 0>;
+		phys = <&ufsphy1>;
+		phy-names = "ufsphy";
+		ufs-qcom-crypto = <&ufs_ice>;
+
+		clock-names =
+			"core_clk",
+			"bus_aggr_clk",
+			"iface_clk",
+			"core_clk_unipro",
+			"core_clk_ice",
+			"ref_clk",
+			"tx_lane0_sync_clk",
+			"rx_lane0_sync_clk";
+		clocks =
+			<&clock_gcc clk_gcc_ufs_axi_hw_ctl_clk>,
+			<&clock_gcc clk_gcc_aggre1_ufs_axi_hw_ctl_clk>,
+			<&clock_gcc clk_gcc_ufs_ahb_clk>,
+			<&clock_gcc clk_gcc_ufs_unipro_core_hw_ctl_clk>,
+			<&clock_gcc clk_gcc_ufs_ice_core_hw_ctl_clk>,
+			<&clock_gcc clk_ln_bb_clk1>,
+			<&clock_gcc clk_gcc_ufs_tx_symbol_0_clk>,
+			<&clock_gcc clk_gcc_ufs_rx_symbol_0_clk>;
+		freq-table-hz =
+			<50000000 200000000>,
+			<0 0>,
+			<0 0>,
+			<37500000 150000000>,
+			<75000000 300000000>,
+			<0 0>,
+			<0 0>,
+			<0 0>;
+
+		lanes-per-direction = <1>;
+
+		qcom,msm-bus,name = "ufs1";
+		qcom,msm-bus,num-cases = <22>;
+		qcom,msm-bus,num-paths = <2>;
+		qcom,msm-bus,vectors-KBps =
+		/*
+		 * During HS G3 UFS runs at nominal voltage corner, vote
+		 * higher bandwidth to push other buses in the data path
+		 * to run at nominal to achieve max throughput.
+		 * 4GBps pushes BIMC to run at nominal.
+		 * 200MBps pushes CNOC to run at nominal.
+		 * Vote for half of this bandwidth for HS G3 1-lane.
+		 * For max bandwidth, vote high enough to push the buses
+		 * to run in turbo voltage corner.
+		 */
+		<95 512 0 0>, <1 650 0 0>,          /* No vote */
+		<95 512 922 0>, <1 650 1000 0>,     /* PWM G1 */
+		<95 512 1844 0>, <1 650 1000 0>,    /* PWM G2 */
+		<95 512 3688 0>, <1 650 1000 0>,    /* PWM G3 */
+		<95 512 7376 0>, <1 650 1000 0>,    /* PWM G4 */
+		<95 512 1844 0>, <1 650 1000 0>,    /* PWM G1 L2 */
+		<95 512 3688 0>, <1 650 1000 0>,    /* PWM G2 L2 */
+		<95 512 7376 0>, <1 650 1000 0>,    /* PWM G3 L2 */
+		<95 512 14752 0>, <1 650 1000 0>,   /* PWM G4 L2 */
+		<95 512 127796 0>, <1 650 1000 0>,  /* HS G1 RA */
+		<95 512 255591 0>, <1 650 1000 0>,  /* HS G2 RA */
+		<95 512 2097152 0>, <1 650 102400 0>,  /* HS G3 RA */
+		<95 512 255591 0>, <1 650 1000 0>,  /* HS G1 RA L2 */
+		<95 512 511181 0>, <1 650 1000 0>,  /* HS G2 RA L2 */
+		<95 512 4194304 0>, <1 650 204800 0>, /* HS G3 RA L2 */
+		<95 512 149422 0>, <1 650 1000 0>,  /* HS G1 RB */
+		<95 512 298189 0>, <1 650 1000 0>,  /* HS G2 RB */
+		<95 512 2097152 0>, <1 650 102400 0>,  /* HS G3 RB */
+		<95 512 298189 0>, <1 650 1000 0>,  /* HS G1 RB L2 */
+		<95 512 596378 0>, <1 650 1000 0>,  /* HS G2 RB L2 */
+		<95 512 4194304 0>, <1 650 204800 0>, /* HS G3 RB L2 */
+		<95 512 7643136 0>, <1 650 307200 0>; /* Max. bandwidth */
+		qcom,bus-vector-names = "MIN",
+		"PWM_G1_L1", "PWM_G2_L1", "PWM_G3_L1", "PWM_G4_L1",
+		"PWM_G1_L2", "PWM_G2_L2", "PWM_G3_L2", "PWM_G4_L2",
+		"HS_RA_G1_L1", "HS_RA_G2_L1", "HS_RA_G3_L1",
+		"HS_RA_G1_L2", "HS_RA_G2_L2", "HS_RA_G3_L2",
+		"HS_RB_G1_L1", "HS_RB_G2_L1", "HS_RB_G3_L1",
+		"HS_RB_G1_L2", "HS_RB_G2_L2", "HS_RB_G3_L2",
+		"MAX";
+
+		/* PM QoS */
+		qcom,pm-qos-cpu-groups = <0x0F 0xF0>;
+		qcom,pm-qos-cpu-group-latency-us = <70 70>;
+		qcom,pm-qos-default-cpu = <0>;
+
+		pinctrl-names = "dev-reset-assert", "dev-reset-deassert";
+		pinctrl-0 = <&ufs_dev_reset_assert>;
+		pinctrl-1 = <&ufs_dev_reset_deassert>;
+
+		resets = <&clock_gcc UFS_BCR>;
+		reset-names = "core_reset";
+
+		status = "disabled";
+	};
+
+	usb3: ssusb@a800000 {
+		compatible = "qcom,dwc-usb3-msm";
+		reg = <0x0a800000 0xf8c00>,
+		      <0x0c016000 0x400>;
+		reg-names = "core_base", "ahb2phy_base";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+
+		interrupts = <0 347 0>, <0 243 0>,  <0 180 0>;
+		interrupt-names = "hs_phy_irq", "ss_phy_irq", "pwr_event_irq";
+
+		USB3_GDSC-supply = <&gdsc_usb30>;
+		qcom,usb-dbm = <&dbm_1p5>;
+		qcom,msm-bus,name = "usb3";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+					<61 512 0 0>,
+					<61 512 240000 800000>;
+
+		qcom,dwc-usb3-msm-tx-fifo-size = <21288>;
+		extcon = <&pmi8998_pdphy>;
+
+		clocks = <&clock_gcc clk_gcc_usb30_master_clk>,
+			<&clock_gcc clk_gcc_cfg_noc_usb3_axi_clk>,
+			<&clock_gcc clk_gcc_aggre1_usb3_axi_clk>,
+			<&clock_gcc clk_gcc_usb30_mock_utmi_clk>,
+			<&clock_gcc clk_gcc_usb30_sleep_clk>,
+			<&clock_gcc clk_cxo_dwc3_clk>;
+
+		clock-names = "core_clk", "iface_clk", "bus_aggr_clk",
+				"utmi_clk", "sleep_clk", "xo";
+
+		qcom,core-clk-rate = <120000000>;
+		qcom,core-clk-rate-hs = <60000000>;
+
+		resets = <&clock_gcc USB_30_BCR>;
+		reset-names = "core_reset";
+
+		dwc3@a800000 {
+			compatible = "snps,dwc3";
+			reg = <0x0a800000 0xcd00>;
+			interrupt-parent = <&intc>;
+			interrupts = <0 131 0>;
+			usb-phy = <&qusb_phy0>, <&ssphy>;
+			tx-fifo-resize;
+			snps,nominal-elastic-buffer;
+			snps,disable-clk-gating;
+			snps,has-lpm-erratum;
+			snps,hird-threshold = /bits/ 8 <0x10>;
+			snps,num-gsi-evt-buffs = <0x3>;
+		};
+
+		qcom,usbbam@a904000 {
+			compatible = "qcom,usb-bam-msm";
+			reg = <0xa904000 0x17000>;
+			interrupt-parent = <&intc>;
+			interrupts = <0 132 0>;
+
+			qcom,bam-type = <0>;
+			qcom,usb-bam-fifo-baseaddr = <0x146bb000>;
+			qcom,usb-bam-num-pipes = <8>;
+			qcom,ignore-core-reset-ack;
+			qcom,disable-clk-gating;
+			qcom,usb-bam-override-threshold = <0x4001>;
+			qcom,usb-bam-max-mbps-highspeed = <400>;
+			qcom,usb-bam-max-mbps-superspeed = <3600>;
+			qcom,reset-bam-on-connect;
+
+			qcom,pipe0 {
+				label = "ssusb-qdss-in-0";
+				qcom,usb-bam-mem-type = <2>;
+				qcom,dir = <1>;
+				qcom,pipe-num = <0>;
+				qcom,peer-bam = <0>;
+				qcom,peer-bam-physical-address = <0x6064000>;
+				qcom,src-bam-pipe-index = <0>;
+				qcom,dst-bam-pipe-index = <0>;
+				qcom,data-fifo-offset = <0x0>;
+				qcom,data-fifo-size = <0x1800>;
+				qcom,descriptor-fifo-offset = <0x1800>;
+				qcom,descriptor-fifo-size = <0x800>;
+			};
+		};
+	};
+
+	qusb_phy0: qusb@c012000 {
+		compatible = "qcom,qusb2phy-v2";
+		reg = <0x0c012000 0x2a8>,
+		      <0x01fcb24c 0x4>;
+		reg-names = "qusb_phy_base",
+				"tcsr_clamp_dig_n_1p8";
+		vdd-supply = <&pm8998_l1>;
+		vdda12-supply = <&pm8998_l2>;
+		vdda18-supply = <&pm8998_l12>;
+		vdda33-supply = <&pm8998_l24>;
+		qcom,vdd-voltage-level = <0 880000 880000>;
+		qcom,vdda33-voltage-level = <2400000 3088000 3088000>;
+		qcom,qusb-phy-init-seq =
+				/* <value reg_offset> */
+					<0x80 0x0
+					0x13 0x04
+					0x7c 0x18c
+					0x80 0x2c
+					0x0a 0x184
+					0x00 0x240>;
+		phy_type= "utmi";
+
+		clocks = <&clock_gcc clk_ln_bb_clk1>,
+			 <&clock_gcc clk_gcc_rx1_usb2_clkref_clk>;
+		clock-names = "ref_clk_src", "ref_clk";
+
+		resets = <&clock_gcc QUSB2PHY_PRIM_BCR>;
+		reset-names = "phy_reset";
+	};
+
+	ssphy: ssphy@c010000 {
+		compatible = "qcom,usb-ssphy-qmp-v2";
+		reg = <0x0c010000 0xe0c>,
+		      <0x01fcb244 0x4>,
+		      <0x01fcb248 0x4>;
+		reg-names = "qmp_phy_base",
+			    "vls_clamp_reg",
+			    "tcsr_usb3_dp_phymode";
+		vdd-supply = <&pm8998_l1>;
+		core-supply = <&pm8998_l2>;
+		qcom,vdd-voltage-level = <0 880000 880000>;
+		qcom,vbus-valid-override;
+		qcom,qmp-phy-init-seq =
+			/* <reg_offset, value, delay> */
+			<0x138 0x30 0x00
+			 0x034 0x04 0x01
+			 0x080 0x14 0x00
+			 0x03c 0x06 0x00
+			 0x08c 0x08 0x00
+			 0x15c 0x06 0x00
+			 0x164 0x01 0x00
+			 0x13c 0x80 0x00
+			 0x0b0 0x82 0x00
+			 0x0b8 0xab 0x00
+			 0x0bc 0xea 0x00
+			 0x0c0 0x02 0x00
+			 0x060 0x06 0x00
+			 0x068 0x16 0x00
+			 0x070 0x36 0x00
+			 0x0dc 0x00 0x00
+			 0x0d8 0x3f 0x00
+			 0x0f8 0x01 0x00
+			 0x0f4 0xc9 0x00
+			 0x148 0x0a 0x00
+			 0x0a0 0x00 0x00
+			 0x09c 0x34 0x00
+			 0x098 0x15 0x00
+			 0x090 0x04 0x00
+			 0x154 0x00 0x00
+			 0x094 0x00 0x00
+			 0x0f0 0x00 0x00
+			 0x00c 0x0a 0x00
+			 0x048 0x07 0x00
+			 0x0d0 0x80 0x00
+			 0x184 0x01 0x00
+			 0x010 0x01 0x00
+			 0x01c 0x31 0x00
+			 0x020 0x01 0x00
+			 0x014 0x00 0x00
+			 0x018 0x00 0x00
+			 0x024 0x85 0x00
+			 0x028 0x07 0x00
+			 0x430 0x0b 0x00
+			 0x4d4 0x0f 0x00
+			 0x4d8 0x4e 0x00
+			 0x4dc 0x18 0x00
+			 0x4f8 0x07 0x00
+			 0x4fc 0x80 0x00
+			 0x504 0x43 0x00
+			 0x50c 0x1c 0x00
+			 0x434 0x75 0x00
+			 0x43c 0x00 0x00
+			 0x440 0x00 0x00
+			 0x444 0x80 0x00
+			 0x408 0x0a 0x00
+			 0x414 0x06 0x00
+			 0x500 0x00 0x00
+			 0x4c0 0x03 0x00
+			 0x564 0x05 0x00
+			 0x830 0x0b 0x00
+			 0x8d4 0x0f 0x00
+			 0x8d8 0x4e 0x00
+			 0x8dc 0x18 0x00
+			 0x8f8 0x07 0x00
+			 0x8fc 0x80 0x00
+			 0x904 0x43 0x00
+			 0x90c 0x1c 0x00
+			 0x834 0x75 0x00
+			 0x83c 0x00 0x00
+			 0x840 0x00 0x00
+			 0x844 0x80 0x00
+			 0x808 0x0a 0x00
+			 0x814 0x06 0x00
+			 0x900 0x00 0x00
+			 0x8c0 0x03 0x00
+			 0x964 0x05 0x00
+			 0x260 0x10 0x00
+			 0x2a4 0x12 0x00
+			 0x28c 0x16 0x00
+			 0x244 0x00 0x00
+			 0x660 0x10 0x00
+			 0x6a4 0x12 0x00
+			 0x68c 0x16 0x00
+			 0x644 0x00 0x00
+			 0xcc8 0x83 0x00
+			 0xccc 0x09 0x00
+			 0xcd0 0xa2 0x00
+			 0xcd4 0x40 0x00
+			 0xcc4 0x02 0x00
+			 0xc80 0xd1 0x00
+			 0xc84 0x1f 0x00
+			 0xc88 0x47 0x00
+			 0xc64 0x1b 0x00
+			 0xc0c 0x9f 0x00
+			 0xc10 0x9f 0x00
+			 0xc14 0xb7 0x00
+			 0xc18 0x4e 0x00
+			 0xc1c 0x65 0x00
+			 0xc20 0x6b 0x00
+			 0xc24 0x15 0x00
+			 0xc28 0x0d 0x00
+			 0xc2c 0x15 0x00
+			 0xc30 0x0d 0x00
+			 0xc34 0x15 0x00
+			 0xc38 0x0d 0x00
+			 0xc3c 0x15 0x00
+			 0xc40 0x0d 0x00
+			 0xc44 0x15 0x00
+			 0xc48 0x0d 0x00
+			 0xc4c 0x15 0x00
+			 0xc50 0x0d 0x00
+			 0xc5c 0x02 0x00
+			 0xca0 0x04 0x00
+			 0xc8c 0x44 0x00
+			 0xc70 0xe7 0x00
+			 0xc74 0x03 0x00
+			 0xc78 0x40 0x00
+			 0xc7c 0x00 0x00
+			 0xdd8 0x8a 0x00
+			 0xcb8 0x75 0x00
+			 0xcb0 0x86 0x00
+			 0xcbc 0x13 0x00
+			 0xffffffff 0xffffffff 0x00>;
+
+		qcom,qmp-phy-reg-offset =
+				<0xd74 /* USB3_PHY_PCS_STATUS */
+				 0xcd8 /* USB3_PHY_AUTONOMOUS_MODE_CTRL */
+				 0xcdc /* USB3_PHY_LFPS_RXTERM_IRQ_CLEAR */
+				 0xc04 /* USB3_PHY_POWER_DOWN_CONTROL */
+				 0xc00 /* USB3_PHY_SW_RESET */
+				 0xc08 /* USB3_PHY_START */
+				 0xa00>; /* USB3PHY_PCS_MISC_TYPEC_CTRL */
+
+		clocks = <&clock_gcc clk_gcc_usb3_phy_aux_clk>,
+			 <&clock_gcc clk_gcc_usb3_phy_pipe_clk>,
+			 <&clock_gcc clk_ln_bb_clk1>,
+			 <&clock_gcc clk_gcc_usb3_clkref_clk>;
+
+		clock-names = "aux_clk", "pipe_clk", "ref_clk_src",
+				"ref_clk";
+
+		resets = <&clock_gcc USB3_PHY_BCR>,
+			 <&clock_gcc USB3PHY_PHY_BCR>;
+		reset-names = "phy_reset", "phy_phy_reset";
+	};
+
+	usb_audio_qmi_dev {
+		compatible = "qcom,usb-audio-qmi-dev";
+		iommus = <&lpass_q6_smmu 12>;
+		qcom,usb-audio-stream-id = <12>;
+		qcom,usb-audio-intr-num = <2>;
+	};
+
+	dbm_1p5: dbm@a8f8000 {
+		compatible = "qcom,usb-dbm-1p5";
+		reg = <0xa8f8000 0x300>;
+		qcom,reset-ep-after-lpm-resume;
+	};
+
+	usb_nop_phy: usb_nop_phy {
+		compatible = "usb-nop-xceiv";
+	};
+
+	qcom,lpass@17300000 {
+		compatible = "qcom,pil-tz-generic";
+		reg = <0x17300000 0x00100>;
+		interrupts = <0 162 1>;
+
+		vdd_cx-supply = <&pm8998_s1_level>;
+		qcom,proxy-reg-names = "vdd_cx";
+		qcom,vdd_cx-uV-uA = <RPM_SMD_REGULATOR_LEVEL_TURBO 100000>;
+
+		clocks = <&clock_gcc clk_cxo_pil_lpass_clk>;
+		clock-names = "xo";
+		qcom,proxy-clock-names = "xo";
+
+		qcom,pas-id = <1>;
+		qcom,proxy-timeout-ms = <10000>;
+		qcom,smem-id = <423>;
+		qcom,sysmon-id = <1>;
+		status = "ok";
+		qcom,ssctl-instance-id = <0x14>;
+		qcom,firmware-name = "adsp";
+		memory-region = <&pil_adsp_mem>;
+
+		/* GPIO inputs from lpass */
+		qcom,gpio-err-fatal = <&smp2pgpio_ssr_smp2p_2_in 0 0>;
+		qcom,gpio-proxy-unvote = <&smp2pgpio_ssr_smp2p_2_in 2 0>;
+		qcom,gpio-err-ready = <&smp2pgpio_ssr_smp2p_2_in 1 0>;
+		qcom,gpio-stop-ack = <&smp2pgpio_ssr_smp2p_2_in 3 0>;
+
+		/* GPIO output to lpass */
+		qcom,gpio-force-stop = <&smp2pgpio_ssr_smp2p_2_out 0 0>;
+	};
+
+	qcom,memshare {
+		compatible = "qcom,memshare";
+
+		qcom,client_1 {
+			compatible = "qcom,memshare-peripheral";
+			qcom,peripheral-size = <0x200000>;
+			qcom,client-id = <0>;
+			qcom,allocate-boot-time;
+			label = "modem";
+		};
+
+		qcom,client_2 {
+			compatible = "qcom,memshare-peripheral";
+			qcom,peripheral-size = <0x300000>;
+			qcom,client-id = <2>;
+			label = "modem";
+		};
+
+		mem_client_3_size: qcom,client_3 {
+			compatible = "qcom,memshare-peripheral";
+			qcom,peripheral-size = <0x0>;
+			qcom,client-id = <1>;
+			label = "modem";
+		};
+	};
+
+	pil_modem: qcom,mss@4080000 {
+		compatible = "qcom,pil-q6v55-mss";
+		reg = <0x4080000 0x100>,
+		      <0x1f63000 0x008>,
+		      <0x1f65000 0x008>,
+		      <0x1f64000 0x008>,
+		      <0x4180000 0x020>,
+		      <0x00179000 0x004>;
+		reg-names = "qdsp6_base", "halt_q6", "halt_modem",
+			    "halt_nc", "rmb_base", "restart_reg";
+
+		clocks = <&clock_gcc clk_cxo_clk_src>,
+			 <&clock_gcc clk_gcc_mss_cfg_ahb_clk>,
+			 <&clock_gcc clk_gcc_bimc_mss_q6_axi_clk>,
+			 <&clock_gcc clk_gcc_boot_rom_ahb_clk>,
+			 <&clock_gcc clk_gpll0_out_msscc>,
+			 <&clock_gcc clk_gcc_mss_snoc_axi_clk>,
+			 <&clock_gcc clk_gcc_mss_mnoc_bimc_axi_clk>,
+			 <&clock_gcc clk_qdss_clk>;
+		clock-names = "xo", "iface_clk", "bus_clk",
+			      "mem_clk", "gpll0_mss_clk", "snoc_axi_clk",
+			      "mnoc_axi_clk", "qdss_clk";
+		qcom,proxy-clock-names = "xo", "qdss_clk", "mem_clk";
+		qcom,active-clock-names = "iface_clk", "bus_clk",
+			"gpll0_mss_clk", "snoc_axi_clk", "mnoc_axi_clk";
+
+		interrupts = <0 448 1>;
+		vdd_cx-supply = <&pm8998_s1_level>;
+		vdd_cx-voltage = <RPM_SMD_REGULATOR_LEVEL_TURBO>;
+		vdd_mx-supply = <&pm8998_s9_level>;
+		vdd_mx-uV = <RPM_SMD_REGULATOR_LEVEL_TURBO>;
+		qcom,firmware-name = "modem";
+		qcom,pil-self-auth;
+		qcom,sysmon-id = <0>;
+		qcom,ssctl-instance-id = <0x12>;
+		qcom,qdsp6v62-1-2;
+		status = "ok";
+		memory-region = <&modem_mem>;
+		qcom,mem-protect-id = <0xF>;
+
+		/* GPIO inputs from mss */
+		qcom,gpio-err-fatal = <&smp2pgpio_ssr_smp2p_1_in 0 0>;
+		qcom,gpio-err-ready = <&smp2pgpio_ssr_smp2p_1_in 1 0>;
+		qcom,gpio-proxy-unvote = <&smp2pgpio_ssr_smp2p_1_in 2 0>;
+		qcom,gpio-stop-ack = <&smp2pgpio_ssr_smp2p_1_in 3 0>;
+		qcom,gpio-shutdown-ack = <&smp2pgpio_ssr_smp2p_1_in 7 0>;
+
+		/* GPIO output to mss */
+		qcom,gpio-force-stop = <&smp2pgpio_ssr_smp2p_1_out 0 0>;
+		qcom,mba-mem@0 {
+			compatible = "qcom,pil-mba-mem";
+			memory-region = <&pil_mba_mem>;
+		};
+	};
+
+	tsens0: tsens@10aa000 {
+		compatible = "qcom,msm8998-tsens";
+		reg = <0x10aa000 0x2000>;
+		reg-names = "tsens_physical";
+		interrupts = <0 458 0>, <0 445 0>;
+		interrupt-names = "tsens-upper-lower", "tsens-critical";
+		qcom,client-id = <0 1 2 3 4 7 8 9 10 11 12 13>;
+		qcom,sensor-id = <0 1 2 3 4 7 8 9 10 11 12 13>;
+		qcom,sensors = <12>;
+	};
+
+	tsens1: tsens@10ad000 {
+		compatible = "qcom,msm8998-tsens";
+		reg = <0x10ad000 0x2000>;
+		reg-names = "tsens_physical";
+		interrupts = <0 184 0>, <0 430 0>;
+		interrupt-names = "tsens-upper-lower", "tsens-critical";
+		qcom,client-id = <14 15 16 17 18 19 20 21>;
+		qcom,sensor-id = <0 1 3 4 5 6 7 2>;
+		qcom,sensors = <8>;
+	};
+
+	qcom,qbt1000 {
+		compatible = "qcom,qbt1000";
+		clock-names = "core", "iface";
+		clocks = <&clock_gcc clk_gcc_blsp2_qup6_spi_apps_clk>,
+			<&clock_gcc clk_gcc_blsp2_ahb_clk>;
+		clock-frequency = <15000000>;
+		qcom,ipc-gpio = <&tlmm 121 0>;
+		qcom,finger-detect-gpio = <&pm8998_gpios 2 0>;
+	};
+
+	qcom,sensor-information {
+		compatible = "qcom,sensor-information";
+		sensor_information0: qcom,sensor-information-0 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor0";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information1: qcom,sensor-information-1 {
+			qcom,sensor-type =  "tsens";
+			qcom,sensor-name = "tsens_tz_sensor1";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information2: qcom,sensor-information-2 {
+			qcom,sensor-type =  "tsens";
+			qcom,sensor-name = "tsens_tz_sensor2";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information3: qcom,sensor-information-3 {
+			qcom,sensor-type =  "tsens";
+			qcom,sensor-name = "tsens_tz_sensor3";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information4: qcom,sensor-information-4 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor4";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information7: qcom,sensor-information-7 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor7";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information8: qcom,sensor-information-8 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor8";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information9: qcom,sensor-information-9 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor9";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information10: qcom,sensor-information-10 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor10";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information11: qcom,sensor-information-11 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor11";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information12: qcom,sensor-information-12 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor12";
+			qcom,scaling-factor = <10>;
+			qcom,alias-name = "gpu_1";
+		};
+		sensor_information13: qcom,sensor-information-13 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor13";
+			qcom,scaling-factor = <10>;
+			qcom,alias-name = "gpu";
+		};
+		sensor_information14: qcom,sensor-information-14 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor14";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information15: qcom,sensor-information-15 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor15";
+			qcom,scaling-factor = <10>;
+			qcom,alias-name = "modem_dsp";
+		};
+		sensor_information16: qcom,sensor-information-16 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor16";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information17: qcom,sensor-information-17 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor17";
+			qcom,scaling-factor = <10>;
+			qcom,alias-name = "hvx";
+		};
+		sensor_information18: qcom,sensor-information-18 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor18";
+			qcom,scaling-factor = <10>;
+			qcom,alias-name = "camera";
+		};
+		sensor_information19: qcom,sensor-information-19 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor19";
+			qcom,scaling-factor = <10>;
+			qcom,alias-name = "multi_media_ss";
+		};
+		sensor_information20: qcom,sensor-information-20 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor20";
+			qcom,scaling-factor = <10>;
+			qcom,alias-name = "modem";
+		};
+		sensor_information21: qcom,sensor-information-21 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor21";
+			qcom,scaling-factor = <10>;
+			qcom,alias-name = "pop_mem";
+		};
+		sensor_information22: qcom,sensor-information-22 {
+			qcom,sensor-type =  "alarm";
+			qcom,sensor-name = "pm8998_tz";
+			qcom,scaling-factor = <1000>;
+		};
+		sensor_information23: qcom,sensor-information-23 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "msm_therm";
+		};
+		sensor_information24: qcom,sensor-information-24 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "emmc_therm";
+		};
+		sensor_information25: qcom,sensor-information-25 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "pa_therm0";
+		};
+		sensor_information26: qcom,sensor-information-26 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "pa_therm1";
+		};
+		sensor_information27: qcom,sensor-information-27 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "quiet_therm";
+		};
+		sensor_information28: qcom,sensor-information-28 {
+			qcom,sensor-type = "llm";
+			qcom,sensor-name = "limits_sensor-01";
+		};
+		sensor_information29: qcom,sensor-information-29 {
+			qcom,sensor-type = "llm";
+			qcom,sensor-name = "limits_sensor-02";
+		};
+	};
+
+	qcom_seecom: qseecom@86600000 {
+		compatible = "qcom,qseecom";
+		reg = <0x86600000 0x2200000>;
+		reg-names = "secapp-region";
+		qcom,hlos-num-ce-hw-instances = <1>;
+		qcom,hlos-ce-hw-instance = <0>;
+		qcom,qsee-ce-hw-instance = <0>;
+		qcom,disk-encrypt-pipe-pair = <2>;
+		qcom,support-fde;
+		qcom,no-clock-support;
+		qcom,appsbl-qseecom-support;
+		qcom,fde-key-size;
+		qcom,commonlib64-loaded-by-uefi;
+		qcom,msm-bus,name = "qseecom-noc";
+		qcom,msm-bus,num-cases = <4>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<55 512 0 0>,
+				<55 512 0 0>,
+				<55 512 120000 1200000>,
+				<55 512 393600 3936000>;
+		clock-names = "core_clk_src", "core_clk",
+				"iface_clk", "bus_clk";
+		clocks = <&clock_gcc clk_ce1_clk>,
+			 <&clock_gcc clk_qseecom_ce1_clk>,
+			 <&clock_gcc clk_gcc_ce1_ahb_m_clk>,
+			 <&clock_gcc clk_gcc_ce1_axi_m_clk>;
+		qcom,ce-opp-freq = <171430000>;
+		qcom,qsee-reentrancy-support = <2>;
+	};
+
+	qcom_tzlog: tz-log@146BF720 {
+		compatible = "qcom,tz-log";
+		reg = <0x146BF720 0x3000>;
+		qcom,hyplog-enabled;
+		hyplog-address-offset = <0x410>; /* 0x066BFB30 */
+		hyplog-size-offset = <0x414>;    /* 0x066BFB34 */
+	};
+
+	qcom_msmhdcp: qcom,msm_hdcp {
+		compatible = "qcom,msm-hdcp";
+	};
+
+	qcom_crypto: qcrypto@1DE0000 {
+		compatible = "qcom,qcrypto";
+		reg = <0x1DE0000 0x20000>,
+		      <0x1DC4000 0x24000>;
+		reg-names = "crypto-base","crypto-bam-base";
+		interrupts = <0 206 0>;
+		qcom,bam-pipe-pair = <2>;
+		qcom,ce-hw-instance = <0>;
+		qcom,ce-device = <0>;
+		qcom,bam-ee = <0>;
+		qcom,ce-hw-shared;
+		qcom,clk-mgmt-sus-res;
+		qcom,msm-bus,name = "qcrypto-noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<55 512 0 0>,
+				<55 512 3936000 393600>;
+		clock-names = "core_clk_src", "core_clk",
+				"iface_clk", "bus_clk";
+		clocks = <&clock_gcc clk_qcrypto_ce1_clk>,
+			 <&clock_gcc clk_qcrypto_ce1_clk>,
+			 <&clock_gcc clk_gcc_ce1_ahb_m_clk>,
+			 <&clock_gcc clk_gcc_ce1_axi_m_clk>;
+		qcom,ce-opp-freq = <171430000>;
+		qcom,use-sw-aes-cbc-ecb-ctr-algo;
+		qcom,use-sw-aes-xts-algo;
+		qcom,use-sw-aes-ccm-algo;
+		qcom,use-sw-ahash-algo;
+		qcom,use-sw-aead-algo;
+		qcom,use-sw-hmac-algo;
+	};
+
+	qcom_cedev: qcedev@1DE0000{
+		compatible = "qcom,qcedev";
+		reg = <0x1DE0000 0x20000>,
+		      <0x1DC4000 0x24000>;
+		reg-names = "crypto-base","crypto-bam-base";
+		interrupts = <0 206 0>;
+		qcom,bam-pipe-pair = <1>;
+		qcom,ce-hw-instance = <0>;
+		qcom,ce-device = <0>;
+		qcom,ce-hw-shared;
+		qcom,bam-ee = <0>;
+		qcom,msm-bus,name = "qcedev-noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<55 512 0 0>,
+				<55 512 3936000 393600>;
+		clock-names = "core_clk_src", "core_clk",
+				"iface_clk", "bus_clk";
+		clocks = <&clock_gcc clk_qcedev_ce1_clk>,
+			 <&clock_gcc clk_qcedev_ce1_clk>,
+			 <&clock_gcc clk_gcc_ce1_ahb_m_clk>,
+			 <&clock_gcc clk_gcc_ce1_axi_m_clk>;
+		qcom,ce-opp-freq = <171430000>;
+	};
+
+	qcom_rng: qrng@793000 {
+		compatible = "qcom,msm-rng";
+		reg = <0x793000 0x1000>;
+		qcom,msm-rng-iface-clk;
+		qcom,no-qrng-config;
+		qcom,msm-bus,name = "msm-rng-noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<1 618 0 0>,	/* No vote */
+			<1 618 0 800>;	/* 100 MB/s */
+		clocks = <&clock_gcc clk_gcc_prng_ahb_clk>;
+		clock-names = "iface_clk";
+	};
+
+	mitigation_profile0: qcom,limit_info-0 {
+		qcom,temperature-sensor = <&sensor_information1>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile1: qcom,limit_info-1 {
+		qcom,temperature-sensor = <&sensor_information2>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile2: qcom,limit_info-2 {
+		qcom,temperature-sensor = <&sensor_information3>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile3: qcom,limit_info-3 {
+		qcom,temperature-sensor = <&sensor_information4>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile4: qcom,limit_info-4 {
+		qcom,temperature-sensor = <&sensor_information7>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile5: qcom,limit_info-5 {
+		qcom,temperature-sensor = <&sensor_information8>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile6: qcom,limit_info-6 {
+		qcom,temperature-sensor = <&sensor_information9>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile7: qcom,limit_info-7 {
+		qcom,temperature-sensor = <&sensor_information10>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	qcom,lmh {
+		compatible = "qcom,lmh_v1";
+		interrupts = <GIC_SPI 134 IRQ_TYPE_LEVEL_HIGH>;
+	};
+
+	qcom,msm-thermal {
+		compatible = "qcom,msm-thermal";
+		qcom,sensor-id = <1>;
+		qcom,poll-ms = <100>;
+		qcom,therm-reset-temp = <115>;
+		qcom,core-limit-temp = <70>;
+		qcom,core-temp-hysteresis = <10>;
+		qcom,hotplug-temp = <105>;
+		qcom,hotplug-temp-hysteresis = <20>;
+		qcom,online-hotplug-core;
+		qcom,synchronous-cluster-id = <0 1>;
+		qcom,synchronous-cluster-map = <0 4 &CPU0 &CPU1 &CPU2 &CPU3>,
+						<1 4 &CPU4 &CPU5 &CPU6 &CPU7>;
+		clock-names = "osm";
+		clocks = <&clock_cpu clk_pwrcl_clk>;
+
+		qcom,vdd-restriction-temp = <5>;
+		qcom,vdd-restriction-temp-hysteresis = <10>;
+
+		vdd-dig-supply = <&pm8998_s1_floor_level>;
+		vdd-gfx-supply = <&gfx_vreg>;
+
+		qcom,vdd-dig-rstr{
+			qcom,vdd-rstr-reg = "vdd-dig";
+			qcom,levels = <RPM_SMD_REGULATOR_LEVEL_NOM
+					RPM_SMD_REGULATOR_LEVEL_TURBO
+					RPM_SMD_REGULATOR_LEVEL_TURBO>;
+				/* Nominal, Super Turbo, Super Turbo */
+			qcom,min-level = <RPM_SMD_REGULATOR_LEVEL_NONE>;
+				/* No Request */
+		};
+
+		qcom,vdd-gfx-rstr{
+			qcom,vdd-rstr-reg = "vdd-gfx";
+			qcom,levels = <5 6 6>; /* Nominal, Turbo, Turbo */
+			qcom,min-level = <1>; /* No Request */
+		};
+
+		msm_thermal_freq: qcom,vdd-apps-rstr{
+			qcom,vdd-rstr-reg = "vdd-apps";
+			qcom,levels = <1248000>;
+			qcom,freq-req;
+		};
+	};
+
+	pcie0: qcom,pcie@01c00000 {
+		compatible = "qcom,pci-msm";
+		cell-index = <0>;
+
+		reg = <0x1c00000 0x2000>,
+		      <0x1c06000 0x1000>,
+		      <0x1b000000 0xf1d>,
+		      <0x1b000f20 0xa8>,
+		      <0x1b100000 0x100000>,
+		      <0x1b200000 0x100000>,
+		      <0x1b300000 0xd00000>;
+
+		reg-names = "parf", "phy", "dm_core", "elbi",
+				"conf", "io", "bars";
+
+		#address-cells = <3>;
+		#size-cells = <2>;
+		ranges = <0x01000000 0x0 0x1b200000 0x1b200000 0x0 0x100000>,
+			<0x02000000 0x0 0x1b300000 0x1b300000 0x0 0xd00000>;
+		interrupt-parent = <&pcie0>;
+		interrupts = <0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
+				20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35
+				36 37>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0 0 0 0xffffffff>;
+		interrupt-map = <0 0 0 0 &intc 0 0 405 0
+				0 0 0 1 &intc 0 0 135 0
+				0 0 0 2 &intc 0 0 136 0
+				0 0 0 3 &intc 0 0 138 0
+				0 0 0 4 &intc 0 0 139 0
+				0 0 0 5 &intc 0 0 278 0
+				0 0 0 6 &intc 0 0 576 0
+				0 0 0 7 &intc 0 0 577 0
+				0 0 0 8 &intc 0 0 578 0
+				0 0 0 9 &intc 0 0 579 0
+				0 0 0 10 &intc 0 0 580 0
+				0 0 0 11 &intc 0 0 581 0
+				0 0 0 12 &intc 0 0 582 0
+				0 0 0 13 &intc 0 0 583 0
+				0 0 0 14 &intc 0 0 584 0
+				0 0 0 15 &intc 0 0 585 0
+				0 0 0 16 &intc 0 0 586 0
+				0 0 0 17 &intc 0 0 587 0
+				0 0 0 18 &intc 0 0 588 0
+				0 0 0 19 &intc 0 0 589 0
+				0 0 0 20 &intc 0 0 590 0
+				0 0 0 21 &intc 0 0 591 0
+				0 0 0 22 &intc 0 0 592 0
+				0 0 0 23 &intc 0 0 593 0
+				0 0 0 24 &intc 0 0 594 0
+				0 0 0 25 &intc 0 0 595 0
+				0 0 0 26 &intc 0 0 596 0
+				0 0 0 27 &intc 0 0 597 0
+				0 0 0 28 &intc 0 0 598 0
+				0 0 0 29 &intc 0 0 599 0
+				0 0 0 30 &intc 0 0 600 0
+				0 0 0 31 &intc 0 0 601 0
+				0 0 0 32 &intc 0 0 602 0
+				0 0 0 33 &intc 0 0 603 0
+				0 0 0 34 &intc 0 0 604 0
+				0 0 0 35 &intc 0 0 605 0
+				0 0 0 36 &intc 0 0 606 0
+				0 0 0 37 &intc 0 0 607 0>;
+
+		interrupt-names = "int_msi", "int_a", "int_b", "int_c",
+				"int_d", "int_global_int",
+				"msi_0", "msi_1", "msi_2", "msi_3",
+				"msi_4", "msi_5", "msi_6", "msi_7",
+				"msi_8", "msi_9", "msi_10", "msi_11",
+				"msi_12", "msi_13", "msi_14", "msi_15",
+				"msi_16", "msi_17", "msi_18", "msi_19",
+				"msi_20", "msi_21", "msi_22", "msi_23",
+				"msi_24", "msi_25", "msi_26", "msi_27",
+				"msi_28", "msi_29", "msi_30", "msi_31";
+
+		qcom,phy-sequence = <0x804 0x01 0x00
+					0x034 0x14 0x00
+					0x138 0x30 0x00
+					0x048 0x0f 0x00
+					0x15c 0x06 0x00
+					0x090 0x01 0x00
+					0x088 0x20 0x00
+					0x0f0 0x00 0x00
+					0x0f8 0x01 0x00
+					0x0f4 0xc9 0x00
+					0x11c 0xff 0x00
+					0x120 0x3f 0x00
+					0x164 0x01 0x00
+					0x154 0x00 0x00
+					0x148 0x0a 0x00
+					0x05C 0x19 0x00
+					0x038 0x90 0x00
+					0x0b0 0x82 0x00
+					0x0c0 0x03 0x00
+					0x0bc 0x55 0x00
+					0x0b8 0x55 0x00
+					0x0a0 0x00 0x00
+					0x09c 0x0d 0x00
+					0x098 0x04 0x00
+					0x13c 0x00 0x00
+					0x060 0x08 0x00
+					0x068 0x16 0x00
+					0x070 0x34 0x00
+					0x15c 0x06 0x00
+					0x138 0x33 0x00
+					0x03c 0x02 0x00
+					0x040 0x0e 0x00
+					0x080 0x04 0x00
+					0x0dc 0x00 0x00
+					0x0d8 0x3f 0x00
+					0x00c 0x09 0x00
+					0x010 0x01 0x00
+					0x01c 0x40 0x00
+					0x020 0x01 0x00
+					0x014 0x02 0x00
+					0x018 0x00 0x00
+					0x024 0x7e 0x00
+					0x028 0x15 0x00
+					0x244 0x02 0x00
+					0x2a4 0x12 0x00
+					0x260 0x10 0x00
+					0x28c 0x06 0x00
+					0x504 0x03 0x00
+					0x500 0x10 0x00
+					0x50c 0x14 0x00
+					0x4d4 0x0a 0x00
+					0x4d8 0x04 0x00
+					0x4dc 0x1a 0x00
+					0x434 0x4b 0x00
+					0x414 0x04 0x00
+					0x40c 0x04 0x00
+					0x4f8 0x00 0x00
+					0x4fc 0x80 0x00
+					0x51c 0x40 0x00
+					0x444 0x71 0x00
+					0x43c 0x40 0x00
+					0x854 0x04 0x00
+					0x62c 0x52 0x00
+					0x9ac 0x00 0x00
+					0x8a0 0x01 0x00
+					0x9e0 0x00 0x00
+					0x9dc 0x20 0x00
+					0x9a8 0x00 0x00
+					0x8a4 0x01 0x00
+					0x8a8 0x73 0x00
+					0x9d8 0xaa 0x00
+					0x9b0 0x03 0x00
+					0x804 0x03 0x00
+					0x800 0x00 0x00
+					0x808 0x03 0x00>;
+
+		pinctrl-names = "default", "sleep";
+		pinctrl-0 = <&pcie0_clkreq_default
+			&pcie0_perst_default
+			&pcie0_wake_default>;
+		pinctrl-1 = <&pcie0_clkreq_default
+			&pcie0_perst_default
+			&pcie0_wake_sleep>;
+
+		perst-gpio = <&tlmm 35 0>;
+		wake-gpio = <&tlmm 37 0>;
+
+		gdsc-vdd-supply = <&gdsc_pcie_0>;
+		vreg-1.8-supply = <&pm8998_l2>;
+		vreg-0.9-supply = <&pm8998_l1>;
+		vreg-cx-supply = <&pm8998_s1_level>;
+
+		qcom,vreg-1.8-voltage-level = <1200000 1200000 24000>;
+		qcom,vreg-0.9-voltage-level = <880000 880000 24000>;
+		qcom,vreg-cx-voltage-level = <RPM_SMD_REGULATOR_LEVEL_BINNING
+						RPM_SMD_REGULATOR_LEVEL_SVS 0>;
+
+		qcom,l1-supported;
+		qcom,l1ss-supported;
+		qcom,aux-clk-sync;
+
+		qcom,ep-latency = <10>;
+
+		qcom,boot-option = <0x1>;
+
+		linux,pci-domain = <0>;
+
+		qcom,msi-gicm-addr = <0x17a00040>;
+		qcom,msi-gicm-base = <0x260>;
+
+		qcom,pcie-phy-ver = <0x20>;
+		qcom,use-19p2mhz-aux-clk;
+
+		iommus = <&anoc1_smmu>;
+		qcom,smmu-exist;
+		qcom,smmu-sid-base = <0x1480>;
+
+		qcom,msm-bus,name = "pcie0";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<45 512 0 0>,
+				<45 512 500 800>;
+
+		clocks = <&clock_gcc clk_gcc_pcie_0_pipe_clk>,
+			<&clock_gcc clk_ln_bb_clk1>,
+			<&clock_gcc clk_gcc_pcie_0_aux_clk>,
+			<&clock_gcc clk_gcc_pcie_0_cfg_ahb_clk>,
+			<&clock_gcc clk_gcc_pcie_0_mstr_axi_clk>,
+			<&clock_gcc clk_gcc_pcie_0_slv_axi_clk>,
+			<&clock_gcc clk_gcc_pcie_clkref_clk>;
+
+		clock-names = "pcie_0_pipe_clk", "pcie_0_ref_clk_src",
+				"pcie_0_aux_clk", "pcie_0_cfg_ahb_clk",
+				"pcie_0_mstr_axi_clk", "pcie_0_slv_axi_clk",
+				"pcie_0_ldo";
+
+		max-clock-frequency-hz = <0>, <0>, <19200000>,
+					<0>, <0>, <0>, <0>, <0>, <0>,
+					<0>, <0>, <0>, <0>, <0>, <0>,
+					<0>, <0>;
+
+		resets = <&clock_gcc PCIE_PHY_BCR>,
+			 <&clock_gcc PCIE_0_PHY_BCR>,
+			 <&clock_gcc PCIE_0_PHY_BCR>;
+
+		reset-names = "pcie_phy_reset",
+				"pcie_0_phy_reset",
+				"pcie_0_phy_pipe_reset";
+	};
+
+	qcom,bcl {
+		compatible = "qcom,bcl";
+		qcom,bcl-enable;
+		qcom,bcl-framework-interface;
+		qcom,bcl-freq-control-list = <&CPU4 &CPU5 &CPU6 &CPU7>;
+		qcom,bcl-hotplug-list = <&CPU4 &CPU5 &CPU6 &CPU7>;
+		qcom,bcl-soc-hotplug-list = <&CPU4 &CPU5 &CPU6 &CPU7>;
+		qcom,ibat-monitor {
+			qcom,low-threshold-uamp = <3400000>;
+			qcom,high-threshold-uamp = <4200000>;
+			qcom,mitigation-freq-khz = <576000>;
+			qcom,vph-high-threshold-uv = <3500000>;
+			qcom,vph-low-threshold-uv = <3300000>;
+			qcom,soc-low-threshold = <10>;
+			qcom,thermal-handle = <&msm_thermal_freq>;
+		};
+	};
+
+	qcom,ssc@5c00000 {
+		compatible = "qcom,pil-tz-generic";
+		reg = <0x5c00000 0x4000>;
+		interrupts = <0 390 1>;
+
+		vdd_cx-supply = <&pm8998_l27_level>;
+		vdd_px-supply = <&pm8998_lvs2>;
+		qcom,vdd_cx-uV-uA = <RPM_SMD_REGULATOR_LEVEL_TURBO 0>;
+		qcom,proxy-reg-names = "vdd_cx", "vdd_px";
+		qcom,keep-proxy-regs-on;
+
+		clocks = <&clock_gcc clk_cxo_pil_ssc_clk>,
+			 <&clock_gcc clk_aggre2_noc_clk>;
+		clock-names = "xo", "aggre2";
+		qcom,proxy-clock-names = "xo", "aggre2";
+
+		qcom,pas-id = <12>;
+		qcom,proxy-timeout-ms = <10000>;
+		qcom,smem-id = <424>;
+		qcom,sysmon-id = <3>;
+		qcom,ssctl-instance-id = <0x16>;
+		qcom,firmware-name = "slpi";
+		status = "ok";
+		memory-region = <&pil_slpi_mem>;
+
+		/* GPIO inputs from ssc */
+		qcom,gpio-err-fatal = <&smp2pgpio_ssr_smp2p_3_in 0 0>;
+		qcom,gpio-proxy-unvote = <&smp2pgpio_ssr_smp2p_3_in 2 0>;
+		qcom,gpio-err-ready = <&smp2pgpio_ssr_smp2p_3_in 1 0>;
+		qcom,gpio-stop-ack = <&smp2pgpio_ssr_smp2p_3_in 3 0>;
+
+		/* GPIO output to ssc */
+		qcom,gpio-force-stop = <&smp2pgpio_ssr_smp2p_3_out 0 0>;
+	};
+
+	qcom,venus@cce0000 {
+		compatible = "qcom,pil-tz-generic";
+		reg = <0xcce0000 0x4000>;
+
+		vdd-supply = <&gdsc_venus>;
+		qcom,proxy-reg-names = "vdd";
+
+		clocks = <&clock_mmss clk_mmss_video_core_clk>,
+			 <&clock_mmss clk_mmss_mnoc_ahb_clk>,
+			 <&clock_mmss clk_mmss_video_ahb_clk>,
+			 <&clock_gcc clk_mmssnoc_axi_clk>,
+			 <&clock_mmss clk_mmss_video_axi_clk>,
+			 <&clock_mmss clk_mmss_video_maxi_clk>;
+		clock-names = "core_clk", "mnoc_ahb_clk", "iface_clk",
+			      "noc_axi_clk", "bus_clk", "maxi_clk";
+		qcom,proxy-clock-names = "core_clk","mnoc_ahb_clk",
+		 "iface_clk", "noc_axi_clk", "bus_clk", "maxi_clk";
+
+		qcom,pas-id = <9>;
+		qcom,msm-bus,name = "pil-venus";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<63 512 0 0>,
+			<63 512 0 304000>;
+		qcom,proxy-timeout-ms = <100>;
+		qcom,firmware-name = "venus";
+		memory-region = <&pil_video_mem>;
+		status = "ok";
+	};
+
+	wdog: qcom,wdt@17817000 {
+		compatible = "qcom,msm-watchdog";
+		reg = <0x17817000 0x1000>;
+		reg-names = "wdt-base";
+		interrupts = <0 3 0>, <0 4 0>;
+		qcom,bark-time = <11000>;
+		qcom,pet-time = <10000>;
+		qcom,ipi-ping;
+		qcom,wakeup-enable;
+		qcom,scandump-size = <0x40000>;
+	};
+
+	qcom,spss@1d00000 {
+		compatible = "qcom,pil-tz-generic";
+		reg = <0x1d0101c 0x4>,
+		      <0x1d01024 0x4>,
+		      <0x1d01028 0x4>,
+		      <0x1d0103c 0x4>,
+		      <0x1d02030 0x4>;
+		reg-names = "sp2soc_irq_status", "sp2soc_irq_clr",
+			    "sp2soc_irq_mask", "rmb_err", "rmb_err_spare2";
+		interrupts = <0 352 1>;
+
+		vdd_cx-supply = <&pm8998_s1_level>;
+		qcom,proxy-reg-names = "vdd_cx";
+		qcom,vdd_cx-uV-uA = <RPM_SMD_REGULATOR_LEVEL_TURBO 100000>;
+
+		clocks = <&clock_gcc clk_cxo_pil_spss_clk>;
+		clock-names = "xo";
+		qcom,proxy-clock-names = "xo";
+		qcom,pil-generic-irq-handler;
+		status = "ok";
+
+		qcom,pas-id = <14>;
+		qcom,proxy-timeout-ms = <10000>;
+		qcom,firmware-name = "spss";
+		memory-region = <&spss_mem>;
+		qcom,spss-scsr-bits = <24 25>;
+	};
+
+	qcom,msm-rtb {
+		compatible = "qcom,msm-rtb";
+		qcom,rtb-size = <0x100000>;
+	};
+
+	qcom,mpm2-sleep-counter@10a3000 {
+		compatible = "qcom,mpm2-sleep-counter";
+		reg = <0x010a3000 0x1000>;
+		clock-frequency = <32768>;
+	};
+
+	qcom,msm-imem@146bf000 {
+		compatible = "qcom,msm-imem";
+		reg = <0x146bf000 0x1000>;
+		ranges = <0x0 0x146bf000 0x1000>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		mem_dump_table@10 {
+			compatible = "qcom,msm-imem-mem_dump_table";
+			reg = <0x10 8>;
+		};
+
+		dload_type@18 {
+			compatible = "qcom,msm-imem-dload-type";
+			reg = <0x18 4>;
+		};
+
+		restart_reason@65c {
+			compatible = "qcom,msm-imem-restart_reason";
+			reg = <0x65c 4>;
+		};
+
+		boot_stats@6b0 {
+			compatible = "qcom,msm-imem-boot_stats";
+			reg = <0x6b0 32>;
+		};
+
+		kaslr_offset@6d0 {
+			compatible = "qcom,msm-imem-kaslr_offset";
+			reg = <0x6d0 12>;
+		};
+
+		pil@94c {
+			compatible = "qcom,msm-imem-pil";
+			reg = <0x94c 200>;
+		};
+
+		diag_dload@c8 {
+			compatible = "qcom,msm-imem-diag-dload";
+			reg = <0xc8 200>;
+		};
+	};
+
+	cpu_pmu: cpu-pmu {
+		compatible = "arm,armv8-pmuv3";
+		qcom,irq-is-percpu;
+		interrupts = <1 6 4>;
+	};
+
+	cpuss_dump {
+		compatible = "qcom,cpuss-dump";
+		qcom,l1_i_cache0 {
+			qcom,dump-node = <&L1_I_0>;
+			qcom,dump-id = <0x60>;
+		};
+		qcom,l1_i_cache1 {
+			qcom,dump-node = <&L1_I_1>;
+			qcom,dump-id = <0x61>;
+		};
+		qcom,l1_i_cache2 {
+			qcom,dump-node = <&L1_I_2>;
+			qcom,dump-id = <0x62>;
+		};
+		qcom,l1_i_cache3 {
+			qcom,dump-node = <&L1_I_3>;
+			qcom,dump-id = <0x63>;
+		};
+		qcom,l1_i_cache100 {
+			qcom,dump-node = <&L1_I_100>;
+			qcom,dump-id = <0x64>;
+		};
+		qcom,l1_i_cache101 {
+			qcom,dump-node = <&L1_I_101>;
+			qcom,dump-id = <0x65>;
+		};
+		qcom,l1_i_cache102 {
+			qcom,dump-node = <&L1_I_102>;
+			qcom,dump-id = <0x66>;
+		};
+		qcom,l1_i_cache103 {
+			qcom,dump-node = <&L1_I_103>;
+			qcom,dump-id = <0x67>;
+		};
+		qcom,l1_d_cache0 {
+			qcom,dump-node = <&L1_D_0>;
+			qcom,dump-id = <0x80>;
+		};
+		qcom,l1_d_cache1 {
+			qcom,dump-node = <&L1_D_1>;
+			qcom,dump-id = <0x81>;
+		};
+		qcom,l1_d_cache2 {
+			qcom,dump-node = <&L1_D_2>;
+			qcom,dump-id = <0x82>;
+		};
+		qcom,l1_d_cache3 {
+			qcom,dump-node = <&L1_D_3>;
+			qcom,dump-id = <0x83>;
+		};
+		qcom,l1_d_cache100 {
+			qcom,dump-node = <&L1_D_100>;
+			qcom,dump-id = <0x84>;
+		};
+		qcom,l1_d_cache101 {
+			qcom,dump-node = <&L1_D_101>;
+			qcom,dump-id = <0x85>;
+		};
+		qcom,l1_d_cache102 {
+			qcom,dump-node = <&L1_D_102>;
+			qcom,dump-id = <0x86>;
+		};
+		qcom,l1_d_cache103 {
+			qcom,dump-node = <&L1_D_103>;
+			qcom,dump-id = <0x87>;
+		};
+		qcom,l1_tlb_dump0 {
+			qcom,dump-node = <&L1_TLB_0>;
+			qcom,dump-id = <0x20>;
+		};
+		qcom,l1_tlb_dump1 {
+			qcom,dump-node = <&L1_TLB_1>;
+			qcom,dump-id = <0x21>;
+		};
+		qcom,l1_tlb_dump2 {
+			qcom,dump-node = <&L1_TLB_2>;
+			qcom,dump-id = <0x22>;
+		};
+		qcom,l1_tlb_dump3 {
+			qcom,dump-node = <&L1_TLB_3>;
+			qcom,dump-id = <0x23>;
+		};
+		qcom,l1_tlb_dump100 {
+			qcom,dump-node = <&L1_TLB_100>;
+			qcom,dump-id = <0x24>;
+		};
+		qcom,l1_tlb_dump101 {
+			qcom,dump-node = <&L1_TLB_101>;
+			qcom,dump-id = <0x25>;
+		};
+		qcom,l1_tlb_dump102 {
+			qcom,dump-node = <&L1_TLB_102>;
+			qcom,dump-id = <0x26>;
+		};
+		qcom,l1_tlb_dump103 {
+			qcom,dump-node = <&L1_TLB_103>;
+			qcom,dump-id = <0x27>;
+		};
+	};
+
+	ssc_sensors: qcom,msm-ssc-sensors {
+		compatible = "qcom,msm-ssc-sensors";
+		status = "ok";
+		qcom,firmware-name = "slpi_v1";
+	};
+
+	dcc: dcc@10b3000 {
+		compatible = "qcom,dcc";
+		reg = <0x10b3000 0x1000>,
+		      <0x10b4000 0x2000>;
+		reg-names = "dcc-base", "dcc-ram-base";
+
+		clocks = <&clock_gcc clk_gcc_dcc_ahb_clk>;
+		clock-names = "dcc_clk";
+	};
+
+	qcom,msm-core@780000 {
+		compatible = "qcom,apss-core-ea";
+		reg = <0x780000 0x1000>;
+		qcom,low-hyst-temp = <100>;
+		qcom,high-hyst-temp = <100>;
+		qcom,polling-interval = <50>;
+
+		ea0: ea0 {
+			sensor = <&sensor_information1>;
+		};
+
+		ea1: ea1 {
+			sensor = <&sensor_information2>;
+		};
+
+		ea2: ea2 {
+			sensor = <&sensor_information3>;
+		};
+
+		ea3: ea3 {
+			sensor = <&sensor_information4>;
+		};
+
+		ea4: ea4 {
+			sensor = <&sensor_information7>;
+		};
+
+		ea5: ea5 {
+			sensor = <&sensor_information8>;
+		};
+
+		ea6: ea6 {
+			sensor = <&sensor_information9>;
+		};
+
+		ea7: ea7 {
+			sensor = <&sensor_information10>;
+		};
+
+	};
+
+	msm_ath10k_wlan: qcom,msm_ath10k_wlan {
+		status = "disabled";
+		compatible = "qcom,wcn3990-wifi";
+		reg = <0x18800000 0x800000>;
+		reg-names = "membase";
+		interrupts =
+			<0 413 0 /* CE0 */ >,
+			<0 414 0 /* CE1 */ >,
+			<0 415 0 /* CE2 */ >,
+			<0 416 0 /* CE3 */ >,
+			<0 417 0 /* CE4 */ >,
+			<0 418 0 /* CE5 */ >,
+			<0 420 0 /* CE6 */ >,
+			<0 421 0 /* CE7 */ >,
+			<0 422 0 /* CE8 */ >,
+			<0 423 0 /* CE9 */ >,
+			<0 424 0 /* CE10 */ >,
+			<0 425 0 /* CE11 */ >;
+	};
+
+	qcom,icnss@18800000 {
+		compatible = "qcom,icnss";
+		reg = <0x18800000 0x800000>,
+		      <0xa0000000 0x10000000>,
+		      <0xb0000000 0x10000>;
+		reg-names = "membase", "smmu_iova_base", "smmu_iova_ipa";
+		clocks = <&clock_gcc clk_rf_clk2_pin>;
+		clock-names = "cxo_ref_clk_pin";
+		iommus = <&anoc2_smmu 0x1900>,
+			 <&anoc2_smmu 0x1901>;
+		interrupts = <0 413 0 /* CE0 */ >,
+			     <0 414 0 /* CE1 */ >,
+			     <0 415 0 /* CE2 */ >,
+			     <0 416 0 /* CE3 */ >,
+			     <0 417 0 /* CE4 */ >,
+			     <0 418 0 /* CE5 */ >,
+			     <0 420 0 /* CE6 */ >,
+			     <0 421 0 /* CE7 */ >,
+			     <0 422 0 /* CE8 */ >,
+			     <0 423 0 /* CE9 */ >,
+			     <0 424 0 /* CE10 */ >,
+			     <0 425 0 /* CE11 */ >;
+		qcom,wlan-msa-memory = <0x100000>;
+		vdd-0.8-cx-mx-supply = <&pm8998_l5>;
+		vdd-1.8-xo-supply = <&pm8998_l7_pin_ctrl>;
+		vdd-1.3-rfa-supply = <&pm8998_l17_pin_ctrl>;
+		vdd-3.3-ch0-supply = <&pm8998_l25_pin_ctrl>;
+		qcom,vdd-0.8-cx-mx-config = <800000 800000>;
+		qcom,vdd-3.3-ch0-config = <3104000 3312000>;
+		qcom,icnss-vadc = <&pm8998_vadc>;
+		qcom,icnss-adc_tm = <&pm8998_adc_tm>;
+	};
+
+	tspp: msm_tspp@0c1e7000 {
+		compatible = "qcom,msm_tspp";
+		reg = <0x0c1e7000 0x200>, /* MSM_TSIF0_PHYS */
+		      <0x0c1e8000 0x200>, /* MSM_TSIF1_PHYS */
+		      <0x0c1e9000 0x1000>, /* MSM_TSPP_PHYS  */
+		      <0x0c1c4000 0x23000>; /* MSM_TSPP_BAM_PHYS */
+		reg-names = "MSM_TSIF0_PHYS",
+			"MSM_TSIF1_PHYS",
+			"MSM_TSPP_PHYS",
+			"MSM_TSPP_BAM_PHYS";
+		interrupts = <0 121 0>, /* TSIF_TSPP_IRQ */
+			<0 119 0>, /* TSIF0_IRQ */
+			<0 120 0>, /* TSIF1_IRQ */
+			<0 122 0>; /* TSIF_BAM_IRQ */
+		interrupt-names = "TSIF_TSPP_IRQ",
+			"TSIF0_IRQ",
+			"TSIF1_IRQ",
+			"TSIF_BAM_IRQ";
+
+		clock-names = "iface_clk", "ref_clk";
+		clocks = <&clock_gcc clk_gcc_tsif_ahb_clk>,
+			<&clock_gcc clk_gcc_tsif_ref_clk>;
+
+		qcom,msm-bus,name = "tsif";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<82 512 0 0>, /* No vote */
+				<82 512 12288 24576>;
+				/* Max. bandwidth, 2xTSIF, each max of 96Mbps */
+
+		pinctrl-names = "disabled",
+			"tsif0-mode1", "tsif0-mode2",
+			"tsif1-mode1", "tsif1-mode2",
+			"dual-tsif-mode1", "dual-tsif-mode2";
+
+		pinctrl-0 = <>;				/* disabled */
+		pinctrl-1 = <&tsif0_signals_active>;	/* tsif0-mode1 */
+		pinctrl-2 = <&tsif0_signals_active
+			&tsif0_sync_active>;		/* tsif0-mode2 */
+		pinctrl-3 = <&tsif1_signals_active>;	/* tsif1-mode1 */
+		pinctrl-4 = <&tsif1_signals_active
+			&tsif1_sync_active>;		/* tsif1-mode2 */
+		pinctrl-5 = <&tsif0_signals_active
+			&tsif1_signals_active>;		/* dual-tsif-mode1 */
+		pinctrl-6 = <&tsif0_signals_active
+			&tsif0_sync_active
+			&tsif1_signals_active
+			&tsif1_sync_active>;		/* dual-tsif-mode2 */
+	};
+
+	wil6210: qcom,wil6210 {
+		compatible = "qcom,wil6210";
+		qcom,pcie-parent = <&pcie0>;
+		qcom,wigig-en = <&tlmm 80 0>;
+		qcom,msm-bus,name = "wil6210";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<45 512 0 0>,
+			<45 512 600000 800000>; /* ~4.6Gbps (MCS12) */
+		qcom,use-ext-supply;
+		vdd-supply= <&pm8998_s7>;
+		vddio-supply= <&pm8998_s5>;
+		qcom,use-ext-clocks;
+		clocks = <&clock_gcc clk_rf_clk3>,
+			 <&clock_gcc clk_rf_clk3_pin>;
+		clock-names = "rf_clk3_clk", "rf_clk3_pin_clk";
+		qcom,smmu-support;
+		qcom,smmu-s1-en;
+		qcom,smmu-fast-map;
+		qcom,smmu-coherent;
+		qcom,smmu-mapping = <0x20000000 0xe0000000>;
+		qcom,keep-radio-on-during-sleep;
+		status = "disabled";
+	};
+
+	qcom,qsee_ipc_irq_bridge {
+		compatible = "qcom,qsee-ipc-irq-bridge";
+
+		qcom,qsee-ipc-irq-spss {
+			qcom,rx-irq-clr = <0x1d08008 0x4>;
+			qcom,rx-irq-clr-mask = <0x1>;
+			qcom,dev-name = "qsee_ipc_irq_spss";
+			interrupts = <0 349 4>;
+			label = "spss";
+		};
+	};
+};
+
+&clock_cpu {
+	lmh_dcvs0: qcom,limits-dcvs@0 {
+		compatible = "qcom,msm-hw-limits";
+		interrupts = <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>;
+	};
+
+	lmh_dcvs1: qcom,limits-dcvs@1 {
+		compatible = "qcom,msm-hw-limits";
+		interrupts = <GIC_SPI 38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&gdsc_usb30 {
+	status = "ok";
+};
+
+&gdsc_pcie_0 {
+	status = "ok";
+};
+
+&gdsc_ufs {
+	status = "ok";
+};
+
+&gdsc_bimc_smmu {
+	clock-names = "bus_clk";
+	clocks = <&clock_mmss clk_mmss_bimc_smmu_axi_clk>;
+	proxy-supply = <&gdsc_bimc_smmu>;
+	qcom,proxy-consumer-enable;
+	status = "ok";
+};
+
+&gdsc_hlos1_vote_lpass_adsp {
+	status = "ok";
+};
+
+&gdsc_hlos1_vote_lpass_core {
+	status = "ok";
+};
+
+&gdsc_venus {
+	status = "ok";
+};
+
+&gdsc_venus_core0 {
+	status = "ok";
+	qcom,support-hw-trigger;
+};
+
+&gdsc_venus_core1 {
+	status = "ok";
+	qcom,support-hw-trigger;
+};
+
+&gdsc_camss_top {
+	status = "ok";
+};
+
+&gdsc_vfe0 {
+	parent-supply = <&gdsc_camss_top>;
+	status = "ok";
+};
+
+&gdsc_vfe1 {
+	parent-supply = <&gdsc_camss_top>;
+	status = "ok";
+};
+
+&gdsc_cpp {
+	parent-supply = <&gdsc_camss_top>;
+	qcom,support-hw-trigger;
+	status = "ok";
+};
+
+&gdsc_mdss {
+	proxy-supply = <&gdsc_mdss>;
+	qcom,proxy-consumer-enable;
+	status = "ok";
+};
+
+&gdsc_gpu_gx {
+	clock-names = "core_root_clk";
+	clocks = <&clock_gfx clk_gfx3d_clk_src>;
+	qcom,force-enable-root-clk;
+	parent-supply = <&gfx_vreg>;
+	status = "ok";
+};
+
+&gdsc_gpu_cx {
+	status = "ok";
+};
+
+#include "msm-pm8998.dtsi"
+#include "msm-pmi8998.dtsi"
+#include "msm-pm8005.dtsi"
+#include "msm-pm8998-rpm-regulator.dtsi"
+#include "msm8998-regulator.dtsi"
+
+#include "msm8998-pm.dtsi"
+#include "msm-arm-smmu-8998.dtsi"
+#include "msm-arm-smmu-impl-defs-8998.dtsi"
+#include "msm8998-ion.dtsi"
+#include "msm8998-camera.dtsi"
+#include "msm8998-vidc.dtsi"
+#include "msm8998-coresight.dtsi"
+#include "msm8998-bus.dtsi"
+#include "msm8998-gpu.dtsi"
+#include "msm8998-pinctrl.dtsi"
+#include "msm-audio-lpass.dtsi"
+#include "msm8998-mdss.dtsi"
+#include "msm8998-mdss-pll.dtsi"
+#include "msm-rdbg.dtsi"
+#include "msm8998-blsp.dtsi"
+#include "msm8998-audio.dtsi"
+#include "msm-smb138x.dtsi"
+#include "msm8998-sde.dtsi"
diff --git a/arch/arm64/boot/dts/qcom/msmhamster-cdp.dts b/arch/arm64/boot/dts/qcom/msmhamster-cdp.dts
new file mode 100644
index 000000000000..a9a3e6d9f88a
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msmhamster-cdp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msmhamster.dtsi"
+#include "msm8998-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM HAMSTER";
+	compatible = "qcom,msmhamster-cdp", "qcom,msmhamster", "qcom,cdp";
+	qcom,board-id = <1 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msmhamster-mtp.dts b/arch/arm64/boot/dts/qcom/msmhamster-mtp.dts
new file mode 100644
index 000000000000..5d63fcb88e8a
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msmhamster-mtp.dts
@@ -0,0 +1,23 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "msmhamster.dtsi"
+#include "msm8998-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM HAMSTER";
+	compatible = "qcom,msmhamster-mtp", "qcom,msmhamster", "qcom,mtp";
+	qcom,board-id = <8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/msmhamster-pinctrl.dtsi b/arch/arm64/boot/dts/qcom/msmhamster-pinctrl.dtsi
new file mode 100644
index 000000000000..5b0c41fd3d02
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msmhamster-pinctrl.dtsi
@@ -0,0 +1,36 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	tlmm: pinctrl@03400000 {
+		compatible = "qcom,msmhamster-pinctrl";
+		reg = <0x03400000 0xc00000>;
+		interrupts = <0 208 0>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+
+		uart_console_active: uart_console_active {
+			mux {
+				pins = "gpio4", "gpio5";
+				function = "blsp_uart8_a";
+			};
+
+			config {
+				pins = "gpio4", "gpio5";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/msmhamster-rumi.dts b/arch/arm64/boot/dts/qcom/msmhamster-rumi.dts
new file mode 100644
index 000000000000..250fe060a9af
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msmhamster-rumi.dts
@@ -0,0 +1,43 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+/memreserve/ 0x90000000 0x00000100;
+
+#include "msmhamster.dtsi"
+#include "msm8998-rumi.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM HAMSTER RUMI";
+	compatible = "qcom,msmhamster-rumi", "qcom,msmhamster", "qcom,rumi";
+	qcom,board-id = <15 0>;
+};
+
+&rpm_bus {
+	rpm-standalone;
+};
+
+&wdog {
+	status = "disabled";
+};
+
+&soc {
+	qcom,lmh {
+		status = "disabled";
+	};
+};
+
+&gfx_stub_vreg {
+	regulator-max-microvolt = <8>;
+	status = "okay";
+};
diff --git a/arch/arm64/boot/dts/qcom/msmhamster.dtsi b/arch/arm64/boot/dts/qcom/msmhamster.dtsi
new file mode 100644
index 000000000000..30308182e199
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/msmhamster.dtsi
@@ -0,0 +1,76 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * As a general rule, only version-specific property overrides should be placed
+ * inside this file. Common device definitions should be placed inside the
+ * msm8998.dtsi file.
+ */
+
+#include "msm8998-v2.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM HAMSTER";
+	qcom,msm-id = <306 0x0>;
+};
+
+&clock_gcc {
+	compatible = "qcom,gcc-hamster";
+};
+
+&clock_mmss {
+	compatible = "qcom,mmsscc-hamster";
+};
+
+&clock_gpu {
+	compatible = "qcom,gpucc-hamster";
+};
+
+&clock_gfx {
+	compatible = "qcom,gfxcc-hamster";
+	qcom,gfxfreq-speedbin0 =
+		<	  0 0				0 >,
+		< 180000000 1 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 265000000 2 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 358000000 3 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 434000000 4 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 542000000 5 RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 630000000 6 RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 700000000 7 RPM_SMD_REGULATOR_LEVEL_TURBO >,
+		< 750000000 8 RPM_SMD_REGULATOR_LEVEL_TURBO >;
+	qcom,gfxfreq-mx-speedbin0 =
+		<         0                           0 >,
+		< 180000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 265000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 358000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 434000000 RPM_SMD_REGULATOR_LEVEL_SVS >,
+		< 542000000 RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 630000000 RPM_SMD_REGULATOR_LEVEL_NOM >,
+		< 700000000 RPM_SMD_REGULATOR_LEVEL_TURBO >,
+		< 750000000 RPM_SMD_REGULATOR_LEVEL_TURBO >;
+};
+
+&tsens0 {
+	compatible = "qcom,msmhamster-tsens";
+};
+
+&tsens1 {
+	compatible = "qcom,msmhamster-tsens";
+	qcom,client-id = <14 15 16 17 18 19 20>;
+	qcom,sensor-id = <0 1 3 4 5 6 7>;
+	qcom,sensors = <7>;
+	qcom,slope = <2901 2846 3200 3200 3200 3200 3200>;
+};
+
+&slv_ebi {
+	qcom,buswidth = <4>;
+};
diff --git a/arch/arm64/boot/dts/qcom/pm8916.dtsi b/arch/arm64/boot/dts/qcom/pm8916.dtsi
new file mode 100644
index 000000000000..b222ece7e3d2
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/pm8916.dtsi
@@ -0,0 +1,99 @@
+#include <dt-bindings/iio/qcom,spmi-vadc.h>
+#include <dt-bindings/interrupt-controller/irq.h>
+#include <dt-bindings/spmi/spmi.h>
+
+&spmi_bus {
+
+	usid0: pm8916@0 {
+		compatible = "qcom,spmi-pmic";
+		reg = <0x0 SPMI_USID>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		rtc@6000 {
+			compatible = "qcom,pm8941-rtc";
+			reg = <0x6000 0x6100>;
+			reg-names = "rtc", "alarm";
+			interrupts = <0x0 0x61 0x1 IRQ_TYPE_EDGE_RISING>;
+		};
+
+		pwrkey@800 {
+			compatible = "qcom,pm8941-pwrkey";
+			reg = <0x800>;
+			interrupts = <0x0 0x8 0 IRQ_TYPE_EDGE_BOTH>;
+			debounce = <15625>;
+			bias-pull-up;
+		};
+
+		pm8916_gpios: gpios@c000 {
+			compatible = "qcom,pm8916-gpio";
+			reg = <0xc000 0x400>;
+			gpio-controller;
+			#gpio-cells = <2>;
+			interrupts = <0 0xc0 0 IRQ_TYPE_NONE>,
+				     <0 0xc1 0 IRQ_TYPE_NONE>,
+				     <0 0xc2 0 IRQ_TYPE_NONE>,
+				     <0 0xc3 0 IRQ_TYPE_NONE>;
+		};
+
+		pm8916_mpps: mpps@a000 {
+			compatible = "qcom,pm8916-mpp";
+			reg = <0xa000 0x400>;
+			gpio-controller;
+			#gpio-cells = <2>;
+			interrupts = <0 0xa0 0 IRQ_TYPE_NONE>,
+				     <0 0xa1 0 IRQ_TYPE_NONE>,
+				     <0 0xa2 0 IRQ_TYPE_NONE>,
+				     <0 0xa3 0 IRQ_TYPE_NONE>;
+		};
+
+		pm8916_temp: temp-alarm@2400 {
+			compatible = "qcom,spmi-temp-alarm";
+			reg = <0x2400 0x100>;
+			interrupts = <0 0x24 0 IRQ_TYPE_EDGE_RISING>;
+			io-channels = <&pm8916_vadc VADC_DIE_TEMP>;
+			io-channel-names = "thermal";
+			#thermal-sensor-cells = <0>;
+		};
+
+		pm8916_vadc: vadc@3100 {
+			compatible = "qcom,spmi-vadc";
+			reg = <0x3100 0x100>;
+			interrupts = <0x0 0x31 0x0 IRQ_TYPE_EDGE_RISING>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			#io-channel-cells = <1>;
+
+			usb_in {
+				reg = <VADC_USBIN>;
+				qcom,pre-scaling = <1 10>;
+			};
+			vph_pwr {
+				reg = <VADC_VSYS>;
+				qcom,pre-scaling = <1 3>;
+			};
+			die_temp {
+				reg = <VADC_DIE_TEMP>;
+			};
+			ref_625mv {
+				reg = <VADC_REF_625MV>;
+			};
+			ref_1250v {
+				reg = <VADC_REF_1250MV>;
+			};
+			ref_gnd {
+				reg = <VADC_GND_REF>;
+			};
+			ref_vdd {
+				reg = <VADC_VDD_VADC>;
+			};
+		};
+	};
+
+	usid1: pm8916@1 {
+		compatible = "qcom,spmi-pmic";
+		reg = <0x1 SPMI_USID>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sda630-cdp.dts b/arch/arm64/boot/dts/qcom/sda630-cdp.dts
new file mode 100644
index 000000000000..665fa94d9713
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda630-cdp.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda630.dtsi"
+#include "sdm630-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 630 PM660 + PM660L CDP";
+	compatible = "qcom,sda630-cdp", "qcom,sda630", "qcom,cdp";
+	qcom,board-id = <1 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda630-mtp.dts b/arch/arm64/boot/dts/qcom/sda630-mtp.dts
new file mode 100644
index 000000000000..08a996ddb709
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda630-mtp.dts
@@ -0,0 +1,30 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda630.dtsi"
+#include "sdm630-mtp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 630 PM660 + PM660L MTP";
+	compatible = "qcom,sda630-mtp", "qcom,sda630", "qcom,mtp";
+	qcom,board-id = <8 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-moist-cfg = <0>, <0>, <3>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda630-pm660a-cdp.dts b/arch/arm64/boot/dts/qcom/sda630-pm660a-cdp.dts
new file mode 100644
index 000000000000..6094d22c1c92
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda630-pm660a-cdp.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda630.dtsi"
+#include "sdm630-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 630 PM660 + PM660A CDP";
+	compatible = "qcom,sda630-cdp", "qcom,sda630", "qcom,cdp";
+	qcom,board-id = <1 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda630-pm660a-mtp.dts b/arch/arm64/boot/dts/qcom/sda630-pm660a-mtp.dts
new file mode 100644
index 000000000000..49c10129aada
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda630-pm660a-mtp.dts
@@ -0,0 +1,30 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda630.dtsi"
+#include "sdm630-mtp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 630 PM660 + PM660A MTP";
+	compatible = "qcom,sda630-mtp", "qcom,sda630", "qcom,mtp";
+	qcom,board-id = <8 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-moist-cfg = <0>, <0>, <3>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda630-pm660a-qrd-hdk.dts b/arch/arm64/boot/dts/qcom/sda630-pm660a-qrd-hdk.dts
new file mode 100644
index 000000000000..4c4c758daa29
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda630-pm660a-qrd-hdk.dts
@@ -0,0 +1,98 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda630.dtsi"
+#include "sdm630-qrd.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 630 PM660 + PM660A QRD HDK630";
+	compatible = "qcom,sda630-qrd", "qcom,sda630", "qcom,qrd";
+	qcom,board-id = <0x0016000b 0x00>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&pm660a_oledb {
+	status = "okay";
+	qcom,oledb-default-voltage-mv = <6400>;
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "single_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_rm67195_amoled_fhd_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	oledb-supply = <&pm660a_oledb>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+	qcom,platform-reset-gpio = <&tlmm 53 0>;
+	qcom,platform-te-gpio = <&tlmm 59 0>;
+};
+
+&dsi_rm67195_amoled_fhd_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_dcs";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <255>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_labibb_amoled>;
+};
+
+/delete-node/ &tasha_hph_en0;
+/delete-node/ &tasha_hph_en1;
+
+&qusb_phy0 {
+	qcom,qusb-phy-init-seq = <0xf8 0x80
+				0xb3 0x84
+				0x83 0x88
+				0xc7 0x8c
+				0x30 0x08
+				0x79 0x0c
+				0x21 0x10
+				0x14 0x9c
+				0x9f 0x1c
+				0x00 0x18>;
+};
+
+&tasha_snd {
+	qcom,model = "sdm660-tasha-skus-snd-card";
+	qcom,audio-routing =
+		"AIF4 VI", "MCLK",
+		"RX_BIAS", "MCLK",
+		"MADINPUT", "MCLK",
+		"AMIC2", "MIC BIAS2",
+		"MIC BIAS2", "Headset Mic",
+		"DMIC0", "MIC BIAS1",
+		"MIC BIAS1", "Digital Mic0",
+		"DMIC3", "MIC BIAS3",
+		"MIC BIAS3", "Digital Mic3",
+		"DMIC5", "MIC BIAS4",
+		"MIC BIAS4", "Digital Mic5",
+		"SpkrLeft IN", "SPK1 OUT";
+	qcom,msm-mbhc-hphl-swh = <0>;
+	/delete-property/ qcom,us-euro-gpios;
+	/delete-property/ qcom,hph-en0-gpio;
+	/delete-property/ qcom,hph-en1-gpio;
+	qcom,wsa-max-devs = <1>;
+	qcom,wsa-devs = <&wsa881x_211>, <&wsa881x_213>;
+	qcom,wsa-aux-dev-prefix = "SpkrLeft", "SpkrLeft";
+};
diff --git a/arch/arm64/boot/dts/qcom/sda630-pm660a-rcm.dts b/arch/arm64/boot/dts/qcom/sda630-pm660a-rcm.dts
new file mode 100644
index 000000000000..aed97f122407
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda630-pm660a-rcm.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda630.dtsi"
+#include "sdm630-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 630 PM660 + PM660A RCM";
+	compatible = "qcom,sda630-cdp", "qcom,sda630", "qcom,cdp";
+	qcom,board-id = <21 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda630-rcm.dts b/arch/arm64/boot/dts/qcom/sda630-rcm.dts
new file mode 100644
index 000000000000..5bc031a56c38
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda630-rcm.dts
@@ -0,0 +1,35 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda630.dtsi"
+#include "sdm630-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 630 PM660 + PM660L RCM";
+	compatible = "qcom,sda630-cdp", "qcom,sda630", "qcom,cdp";
+	qcom,board-id = <21 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda630.dtsi b/arch/arm64/boot/dts/qcom/sda630.dtsi
new file mode 100644
index 000000000000..c0ac1a4e814e
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda630.dtsi
@@ -0,0 +1,29 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdm630.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 630";
+	compatible = "qcom,sda630";
+	qcom,msm-id = <327 0x0>;
+};
+
+&soc {
+	qcom,rmnet-ipa {
+		status = "disabled";
+	};
+};
+
+&ipa_hw {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/sda636-cdp.dts b/arch/arm64/boot/dts/qcom/sda636-cdp.dts
new file mode 100644
index 000000000000..a4cc4b3f4662
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda636-cdp.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda636.dtsi"
+#include "sdm636-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 636 PM660 + PM660L CDP";
+	compatible = "qcom,sda636-cdp", "qcom,sda636", "qcom,cdp";
+	qcom,board-id = <1 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda636-mtp.dts b/arch/arm64/boot/dts/qcom/sda636-mtp.dts
new file mode 100644
index 000000000000..3fd19437b3eb
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda636-mtp.dts
@@ -0,0 +1,30 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda636.dtsi"
+#include "sdm636-mtp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 636 PM660 + PM660L MTP";
+	compatible = "qcom,sda636-mtp", "qcom,sda636", "qcom,mtp";
+	qcom,board-id = <8 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-moist-cfg = <0>, <0>, <3>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda636-pm660a-cdp.dts b/arch/arm64/boot/dts/qcom/sda636-pm660a-cdp.dts
new file mode 100644
index 000000000000..72db1be68c83
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda636-pm660a-cdp.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda636.dtsi"
+#include "sdm636-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 636 PM660 + PM660A CDP";
+	compatible = "qcom,sda636-cdp", "qcom,sda636", "qcom,cdp";
+	qcom,board-id = <1 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda636-pm660a-mtp.dts b/arch/arm64/boot/dts/qcom/sda636-pm660a-mtp.dts
new file mode 100644
index 000000000000..fd5b94420102
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda636-pm660a-mtp.dts
@@ -0,0 +1,30 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda636.dtsi"
+#include "sdm636-mtp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 636 PM660 + PM660A MTP";
+	compatible = "qcom,sda636-mtp", "qcom,sda636", "qcom,mtp";
+	qcom,board-id = <8 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-moist-cfg = <0>, <0>, <3>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda636-pm660a-qrd-hdk.dts b/arch/arm64/boot/dts/qcom/sda636-pm660a-qrd-hdk.dts
new file mode 100644
index 000000000000..3535c54f5dd0
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda636-pm660a-qrd-hdk.dts
@@ -0,0 +1,240 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda636.dtsi"
+#include "sdm636-qrd.dtsi"
+#include "msm-pm660a.dtsi"
+
+&smb1351_charger {
+	status = "disabled";
+};
+
+&i2c_2 {
+	smb138x: qcom,smb138x@8 {
+		compatible = "qcom,i2c-pmic";
+		reg = <0x8>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <21 IRQ_TYPE_LEVEL_LOW>;
+		interrupt_names = "smb138x";
+		interrupt-controller;
+		#interrupt-cells = <3>;
+		qcom,periph-map = <0x10 0x11 0x12 0x13 0x14 0x16 0x36>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&smb_int_default>;
+
+		smb138x_revid: qcom,revid@100 {
+			compatible = "qcom,qpnp-revid";
+			reg = <0x100 0x100>;
+		};
+
+		smb138x_tadc: qcom,tadc@3600 {
+			compatible = "qcom,tadc";
+			reg = <0x3600 0x100>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			#io-channel-cells = <1>;
+			interrupt-parent = <&smb138x>;
+			interrupts = <0x36 0x0 IRQ_TYPE_EDGE_BOTH>;
+			interrupt-names = "eoc";
+
+			batt_temp@0 {
+				reg = <0>;
+				qcom,rbias = <68100>;
+				qcom,rtherm-at-25degc = <68000>;
+				qcom,beta-coefficient = <3450>;
+			};
+
+			skin_temp@1 {
+				reg = <1>;
+				qcom,rbias = <33000>;
+				qcom,rtherm-at-25degc = <68000>;
+				qcom,beta-coefficient = <3450>;
+			};
+
+			die_temp@2 {
+				reg = <2>;
+				qcom,scale = <(-1306)>;
+				qcom,offset = <397904>;
+			};
+
+			batt_i@3 {
+				reg = <3>;
+				qcom,channel = <3>;
+				qcom,scale = <(-20000000)>;
+			};
+
+			batt_v@4 {
+				reg = <4>;
+				qcom,scale = <5000000>;
+			};
+
+			input_i@5 {
+				reg = <5>;
+				qcom,scale = <14285714>;
+			};
+
+			input_v@6 {
+				reg = <6>;
+				qcom,scale = <25000000>;
+			};
+
+			otg_i@7 {
+				reg = <7>;
+				qcom,scale = <5714286>;
+			};
+		};
+
+		smb138x_parallel_slave: qcom,smb138x-parallel-slave@1000 {
+			compatible = "qcom,smb138x-parallel-slave";
+			qcom,pmic-revid = <&smb138x_revid>;
+			reg = <0x1000 0x700>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			interrupt-parent = <&smb138x>;
+			io-channels =
+				<&smb138x_tadc 1>,
+				<&smb138x_tadc 2>,
+				<&smb138x_tadc 3>,
+				<&smb138x_tadc 14>,
+				<&smb138x_tadc 15>,
+				<&smb138x_tadc 16>,
+				<&smb138x_tadc 17>;
+			io-channel-names =
+				"connector_temp",
+				"charger_temp",
+				"batt_i",
+				"connector_temp_thr1",
+				"connector_temp_thr2",
+				"connector_temp_thr3",
+				"charger_temp_max";
+
+			qcom,chgr@1000 {
+				reg = <0x1000 0x100>;
+				interrupts = <0x10 0x1 IRQ_TYPE_EDGE_RISING>;
+				interrupt-names = "chg-state-change";
+			};
+
+			qcom,chgr-misc@1600 {
+				reg = <0x1600 0x100>;
+				interrupts = <0x16 0x1 IRQ_TYPE_EDGE_RISING>,
+					     <0x16 0x6 IRQ_TYPE_EDGE_RISING>;
+				interrupt-names = "wdog-bark",
+						  "temperature-change";
+			};
+		};
+	};
+};
+
+&tlmm {
+	smb_int_default: smb_int_default {
+		mux {
+			pins = "gpio21";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio21";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+};
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 636 PM660 + PM660A QRD HDK636";
+	compatible = "qcom,sda636-qrd", "qcom,sda636", "qcom,qrd";
+	qcom,board-id = <0x0016000b 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&pm660a_oledb {
+	status = "okay";
+	qcom,oledb-default-voltage-mv = <6400>;
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dp_ctrl {
+	pinctrl-names = "mdss_dp_active", "mdss_dp_sleep";
+	pinctrl-0 = <&mdss_dp_aux_active &mdss_dp_usbplug_cc_active>;
+	pinctrl-1 = <&mdss_dp_aux_suspend &mdss_dp_usbplug_cc_suspend>;
+	qcom,aux-en-gpio = <&tlmm 55 0>;
+	qcom,aux-sel-gpio = <&tlmm 56 0>;
+	qcom,usbplug-cc-gpio = <&tlmm 58 0>;
+};
+
+&mdss_dsi {
+	hw-config = "single_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_rm67195_amoled_fhd_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+	qcom,platform-reset-gpio = <&tlmm 53 0>;
+	qcom,platform-te-gpio = <&tlmm 59 0>;
+};
+
+&dsi_rm67195_amoled_fhd_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_dcs";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <255>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_labibb_amoled>;
+};
+
+&tasha_snd {
+	qcom,audio-routing =
+		"AIF4 VI", "MCLK",
+		"RX_BIAS", "MCLK",
+		"MADINPUT", "MCLK",
+		"AMIC2", "MIC BIAS2",
+		"MIC BIAS2", "Headset Mic",
+		"DMIC0", "MIC BIAS1",
+		"MIC BIAS1", "Digital Mic0",
+		"DMIC3", "MIC BIAS3",
+		"MIC BIAS3", "Digital Mic3",
+		"DMIC5", "MIC BIAS4",
+		"MIC BIAS4", "Digital Mic5",
+		"SpkrLeft IN", "SPK1 OUT";
+	qcom,msm-mbhc-hphl-swh = <0>;
+};
+
+&usb2s {
+	status = "okay";
+};
+
+&qusb_phy0 {
+	reg = <0x0c012000 0x180>,
+		<0x00188018 0x4>;
+	reg-names = "qusb_phy_base",
+		"ref_clk_addr";
+	qcom,qusb-phy-init-seq = <0xf8 0x80
+				0xb3 0x84
+				0x83 0x88
+				0xc7 0x8c
+				0x30 0x08
+				0x79 0x0c
+				0x21 0x10
+				0x14 0x9c
+				0x9f 0x1c
+				0x00 0x18>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda636-pm660a-rcm.dts b/arch/arm64/boot/dts/qcom/sda636-pm660a-rcm.dts
new file mode 100644
index 000000000000..321de0526c77
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda636-pm660a-rcm.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda636.dtsi"
+#include "sdm636-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 636 PM660 + PM660A RCM";
+	compatible = "qcom,sda636-cdp", "qcom,sda636", "qcom,cdp";
+	qcom,board-id = <21 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda636-rcm.dts b/arch/arm64/boot/dts/qcom/sda636-rcm.dts
new file mode 100644
index 000000000000..50cf84bef0e5
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda636-rcm.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda636.dtsi"
+#include "sdm636-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 636 PM660 + PM660L RCM";
+	compatible = "qcom,sda636-cdp", "qcom,sda636", "qcom,cdp";
+	qcom,board-id = <21 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda636.dtsi b/arch/arm64/boot/dts/qcom/sda636.dtsi
new file mode 100644
index 000000000000..a219ca92767a
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda636.dtsi
@@ -0,0 +1,29 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdm636.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 636";
+	compatible = "qcom,sda636";
+	qcom,msm-id = <346 0x0>;
+};
+
+&soc {
+	qcom,rmnet-ipa {
+		status = "disabled";
+	};
+};
+
+&ipa_hw {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/sda658-cdp.dts b/arch/arm64/boot/dts/qcom/sda658-cdp.dts
new file mode 100644
index 000000000000..9992963b8705
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda658-cdp.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda658.dtsi"
+#include "sdm660-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 658 PM660 + PM660L CDP";
+	compatible = "qcom,sda658-cdp", "qcom,sda658", "qcom,cdp";
+	qcom,board-id = <1 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda658-mtp.dts b/arch/arm64/boot/dts/qcom/sda658-mtp.dts
new file mode 100644
index 000000000000..f4322ecfd701
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda658-mtp.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda658.dtsi"
+#include "sdm660-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 658 PM660 + PM660L MTP";
+	compatible = "qcom,sda658-mtp", "qcom,sda658", "qcom,mtp";
+	qcom,board-id = <8 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda658-pm660a-cdp.dts b/arch/arm64/boot/dts/qcom/sda658-pm660a-cdp.dts
new file mode 100644
index 000000000000..c280c4afda51
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda658-pm660a-cdp.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda658.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 658 PM660 + PM660A CDP";
+	compatible = "qcom,sda658-cdp", "qcom,sda658", "qcom,cdp";
+	qcom,board-id = <1 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda658-pm660a-mtp.dts b/arch/arm64/boot/dts/qcom/sda658-pm660a-mtp.dts
new file mode 100644
index 000000000000..ba8741e2a068
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda658-pm660a-mtp.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda658.dtsi"
+#include "sdm660-mtp.dtsi"
+#include "msm-pm660a.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 658 PM660 + PM660A MTP";
+	compatible = "qcom,sda658-mtp", "qcom,sda658", "qcom,mtp";
+	qcom,board-id = <8 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda658-pm660a-rcm.dts b/arch/arm64/boot/dts/qcom/sda658-pm660a-rcm.dts
new file mode 100644
index 000000000000..f3edc9a5d29f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda658-pm660a-rcm.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda658.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 658 PM660 + PM660A RCM";
+	compatible = "qcom,sda658-cdp", "qcom,sda658", "qcom,cdp";
+	qcom,board-id = <21 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda658-rcm.dts b/arch/arm64/boot/dts/qcom/sda658-rcm.dts
new file mode 100644
index 000000000000..9fafd9632c8d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda658-rcm.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda658.dtsi"
+#include "sdm660-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 658 PM660 + PM660L RCM";
+	compatible = "qcom,sda658-cdp", "qcom,sda658", "qcom,cdp";
+	qcom,board-id = <21 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda658.dtsi b/arch/arm64/boot/dts/qcom/sda658.dtsi
new file mode 100644
index 000000000000..035b93eacf5d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda658.dtsi
@@ -0,0 +1,29 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdm658.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 658";
+	compatible = "qcom,sda658";
+	qcom,msm-id = <326 0x0>;
+};
+
+&soc {
+	qcom,rmnet-ipa {
+		status = "disabled";
+	};
+};
+
+&ipa_hw {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/sda660-cdp.dts b/arch/arm64/boot/dts/qcom/sda660-cdp.dts
new file mode 100644
index 000000000000..92097729087b
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda660-cdp.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda660.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 660 PM660 + PM660L CDP";
+	compatible = "qcom,sda660-cdp", "qcom,sda660", "qcom,cdp";
+	qcom,board-id = <1 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda660-mtp.dts b/arch/arm64/boot/dts/qcom/sda660-mtp.dts
new file mode 100644
index 000000000000..027137e54c0e
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda660-mtp.dts
@@ -0,0 +1,30 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda660.dtsi"
+#include "sdm660-mtp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 660 PM660 + PM660L MTP";
+	compatible = "qcom,sda660-mtp", "qcom,sda660", "qcom,mtp";
+	qcom,board-id = <8 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-moist-cfg = <0>, <0>, <3>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda660-pm660a-cdp.dts b/arch/arm64/boot/dts/qcom/sda660-pm660a-cdp.dts
new file mode 100644
index 000000000000..a46083a00298
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda660-pm660a-cdp.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda660.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 660 PM660 + PM660A CDP";
+	compatible = "qcom,sda660-cdp", "qcom,sda660", "qcom,cdp";
+	qcom,board-id = <1 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda660-pm660a-mtp.dts b/arch/arm64/boot/dts/qcom/sda660-pm660a-mtp.dts
new file mode 100644
index 000000000000..d94cf8ea1eb5
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda660-pm660a-mtp.dts
@@ -0,0 +1,30 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda660.dtsi"
+#include "sdm660-mtp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 660 PM660 + PM660A MTP";
+	compatible = "qcom,sda660-mtp", "qcom,sda660", "qcom,mtp";
+	qcom,board-id = <8 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-moist-cfg = <0>, <0>, <3>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda660-pm660a-qrd-hdk.dts b/arch/arm64/boot/dts/qcom/sda660-pm660a-qrd-hdk.dts
new file mode 100644
index 000000000000..0f4b462fd57b
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda660-pm660a-qrd-hdk.dts
@@ -0,0 +1,240 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda660.dtsi"
+#include "sdm660-qrd.dtsi"
+#include "msm-pm660a.dtsi"
+
+&smb1351_charger {
+	status = "disabled";
+};
+
+&i2c_2 {
+	smb138x: qcom,smb138x@8 {
+		compatible = "qcom,i2c-pmic";
+		reg = <0x8>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <21 IRQ_TYPE_LEVEL_LOW>;
+		interrupt_names = "smb138x";
+		interrupt-controller;
+		#interrupt-cells = <3>;
+		qcom,periph-map = <0x10 0x11 0x12 0x13 0x14 0x16 0x36>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&smb_int_default>;
+
+		smb138x_revid: qcom,revid@100 {
+			compatible = "qcom,qpnp-revid";
+			reg = <0x100 0x100>;
+		};
+
+		smb138x_tadc: qcom,tadc@3600 {
+			compatible = "qcom,tadc";
+			reg = <0x3600 0x100>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			#io-channel-cells = <1>;
+			interrupt-parent = <&smb138x>;
+			interrupts = <0x36 0x0 IRQ_TYPE_EDGE_BOTH>;
+			interrupt-names = "eoc";
+
+			batt_temp@0 {
+				reg = <0>;
+				qcom,rbias = <68100>;
+				qcom,rtherm-at-25degc = <68000>;
+				qcom,beta-coefficient = <3450>;
+			};
+
+			skin_temp@1 {
+				reg = <1>;
+				qcom,rbias = <33000>;
+				qcom,rtherm-at-25degc = <68000>;
+				qcom,beta-coefficient = <3450>;
+			};
+
+			die_temp@2 {
+				reg = <2>;
+				qcom,scale = <(-1306)>;
+				qcom,offset = <397904>;
+			};
+
+			batt_i@3 {
+				reg = <3>;
+				qcom,channel = <3>;
+				qcom,scale = <(-20000000)>;
+			};
+
+			batt_v@4 {
+				reg = <4>;
+				qcom,scale = <5000000>;
+			};
+
+			input_i@5 {
+				reg = <5>;
+				qcom,scale = <14285714>;
+			};
+
+			input_v@6 {
+				reg = <6>;
+				qcom,scale = <25000000>;
+			};
+
+			otg_i@7 {
+				reg = <7>;
+				qcom,scale = <5714286>;
+			};
+		};
+
+		smb138x_parallel_slave: qcom,smb138x-parallel-slave@1000 {
+			compatible = "qcom,smb138x-parallel-slave";
+			qcom,pmic-revid = <&smb138x_revid>;
+			reg = <0x1000 0x700>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			interrupt-parent = <&smb138x>;
+			io-channels =
+				<&smb138x_tadc 1>,
+				<&smb138x_tadc 2>,
+				<&smb138x_tadc 3>,
+				<&smb138x_tadc 14>,
+				<&smb138x_tadc 15>,
+				<&smb138x_tadc 16>,
+				<&smb138x_tadc 17>;
+			io-channel-names =
+				"connector_temp",
+				"charger_temp",
+				"batt_i",
+				"connector_temp_thr1",
+				"connector_temp_thr2",
+				"connector_temp_thr3",
+				"charger_temp_max";
+
+			qcom,chgr@1000 {
+				reg = <0x1000 0x100>;
+				interrupts = <0x10 0x1 IRQ_TYPE_EDGE_RISING>;
+				interrupt-names = "chg-state-change";
+			};
+
+			qcom,chgr-misc@1600 {
+				reg = <0x1600 0x100>;
+				interrupts = <0x16 0x1 IRQ_TYPE_EDGE_RISING>,
+					     <0x16 0x6 IRQ_TYPE_EDGE_RISING>;
+				interrupt-names = "wdog-bark",
+						  "temperature-change";
+			};
+		};
+	};
+};
+
+&tlmm {
+	smb_int_default: smb_int_default {
+		mux {
+			pins = "gpio21";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio21";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+};
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 660 PM660 + PM660A QRD HDK660";
+	compatible = "qcom,sda660-qrd", "qcom,sda660", "qcom,qrd";
+	qcom,board-id = <0x0016000b 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&pm660a_oledb {
+	status = "okay";
+	qcom,oledb-default-voltage-mv = <6400>;
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dp_ctrl {
+	pinctrl-names = "mdss_dp_active", "mdss_dp_sleep";
+	pinctrl-0 = <&mdss_dp_aux_active &mdss_dp_usbplug_cc_active>;
+	pinctrl-1 = <&mdss_dp_aux_suspend &mdss_dp_usbplug_cc_suspend>;
+	qcom,aux-en-gpio = <&tlmm 55 0>;
+	qcom,aux-sel-gpio = <&tlmm 56 0>;
+	qcom,usbplug-cc-gpio = <&tlmm 58 0>;
+};
+
+&mdss_dsi {
+	hw-config = "single_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_rm67195_amoled_fhd_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+	qcom,platform-reset-gpio = <&tlmm 53 0>;
+	qcom,platform-te-gpio = <&tlmm 59 0>;
+};
+
+&dsi_rm67195_amoled_fhd_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_dcs";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <255>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_labibb_amoled>;
+};
+
+&tasha_snd {
+	qcom,audio-routing =
+		"AIF4 VI", "MCLK",
+		"RX_BIAS", "MCLK",
+		"MADINPUT", "MCLK",
+		"AMIC2", "MIC BIAS2",
+		"MIC BIAS2", "Headset Mic",
+		"DMIC0", "MIC BIAS1",
+		"MIC BIAS1", "Digital Mic0",
+		"DMIC3", "MIC BIAS3",
+		"MIC BIAS3", "Digital Mic3",
+		"DMIC5", "MIC BIAS4",
+		"MIC BIAS4", "Digital Mic5",
+		"SpkrLeft IN", "SPK1 OUT";
+	qcom,msm-mbhc-hphl-swh = <0>;
+};
+
+&usb2s {
+	status = "okay";
+};
+
+&qusb_phy0 {
+	reg = <0x0c012000 0x180>,
+		<0x00188018 0x4>;
+	reg-names = "qusb_phy_base",
+		"ref_clk_addr";
+	qcom,qusb-phy-init-seq = <0xf8 0x80
+				0xb3 0x84
+				0x83 0x88
+				0xc7 0x8c
+				0x30 0x08
+				0x79 0x0c
+				0x21 0x10
+				0x14 0x9c
+				0x9f 0x1c
+				0x00 0x18>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda660-pm660a-rcm.dts b/arch/arm64/boot/dts/qcom/sda660-pm660a-rcm.dts
new file mode 100644
index 000000000000..7172d00c1a1e
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda660-pm660a-rcm.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda660.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 660 PM660 + PM660A RCM";
+	compatible = "qcom,sda660-cdp", "qcom,sda660", "qcom,cdp";
+	qcom,board-id = <21 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda660-rcm.dts b/arch/arm64/boot/dts/qcom/sda660-rcm.dts
new file mode 100644
index 000000000000..1a790466d9a9
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda660-rcm.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sda660.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 660 PM660 + PM660L RCM";
+	compatible = "qcom,sda660-cdp", "qcom,sda660", "qcom,cdp";
+	qcom,board-id = <21 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sda660.dtsi b/arch/arm64/boot/dts/qcom/sda660.dtsi
new file mode 100644
index 000000000000..d394c277ecdd
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sda660.dtsi
@@ -0,0 +1,29 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdm660.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDA 660";
+	compatible = "qcom,sda660";
+	qcom,msm-id = <324 0x0>;
+};
+
+&soc {
+	qcom,rmnet-ipa {
+		status = "disabled";
+	};
+};
+
+&ipa_hw {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-camera-sensor-cdp.dtsi b/arch/arm64/boot/dts/qcom/sdm630-camera-sensor-cdp.dtsi
new file mode 100644
index 000000000000..94158834eee6
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-camera-sensor-cdp.dtsi
@@ -0,0 +1,370 @@
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	led_flash0: qcom,camera-flash@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pm660l_flash0 &pm660l_flash1>;
+		qcom,torch-source = <&pm660l_torch0 &pm660l_torch1>;
+		qcom,switch-source = <&pm660l_switch0>;
+		status = "ok";
+	};
+
+	led_flash1: qcom,camera-flash@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pm660l_flash2>;
+		qcom,torch-source = <&pm660l_torch2>;
+		qcom,switch-source = <&pm660l_switch1>;
+		status = "ok";
+	};
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&pm660l_l8>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <3400000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&pm660l_l8>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <3400000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	actuator2: qcom,actuator@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&pm660l_l8>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <3400000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	ois0: qcom,ois@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,ois";
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 50 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+		status = "disabled";
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		cam_vaf-supply = <&pm660l_l8>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig",
+					"cam_vaf";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000 2800000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000 3400000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000 100000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				&cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_sensor_rear_suspend>;
+		gpios = <&tlmm 32 0>,
+			<&tlmm 46 0>,
+			<&pm660l_gpios 4 0>,
+			<&tlmm 51 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK0_CLK_SRC>,
+				<&clock_mmss MMSS_CAMSS_MCLK0_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		cam_vaf-supply = <&pm660l_l8>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig",
+					"cam_vaf";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000 2800000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000 3400000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000 100000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+			&cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+			&cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 34 0>,
+		    <&tlmm 48 0>,
+		    <&pm660l_gpios 3 0>,
+		    <&tlmm 51 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK",
+				"CAM_RESET",
+				"CAM_VDIG",
+				"CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK2_CLK_SRC>,
+		    <&clock_mmss MMSS_CAMSS_MCLK2_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom2: qcom,eeprom@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig",
+					"cam_vaf";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000 2800000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000 3400000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000 100000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 33 0>,
+			<&tlmm 47 0>,
+			<&pm660_gpios 3 0>,
+			<&tlmm 44 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK1_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK1_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <270>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,ois-src = <&ois0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				 &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				 &cam_sensor_rear_suspend>;
+		gpios = <&tlmm 32 0>,
+			<&tlmm 46 0>,
+			<&pm660l_gpios 4 0>,
+			<&tlmm 51 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK0_CLK_SRC>,
+				<&clock_mmss MMSS_CAMSS_MCLK0_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,actuator-src = <&actuator1>;
+		qcom,eeprom-src = <&eeprom1>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 34 0>,
+			<&tlmm 48 0>,
+			<&pm660l_gpios 3 0>,
+			<&tlmm 51 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK",
+					  "CAM_RESET",
+					  "CAM_VDIG",
+					  "CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK2_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK2_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,actuator-src = <&actuator2>;
+		qcom,eeprom-src = <&eeprom2>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 33 0>,
+			<&tlmm 47 0>,
+			<&pm660l_gpios 3 0>,
+			<&tlmm 51 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK1_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK1_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
+
+&pm660l_gpios {
+	gpio@c300 { /* GPIO4 -CAMERA SENSOR 0 VDIG*/
+		qcom,mode = <1>;                /* Output */
+		qcom,pull = <5>;                /* No Pull */
+		qcom,vin-sel = <0>;             /* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;             /* GPIO */
+		qcom,invert = <0>;              /* Invert */
+		qcom,master-en = <1>;           /* Enable GPIO */
+		status = "ok";
+	};
+
+	gpio@c200 { /* GPIO3 -CAMERA SENSOR 2 VDIG*/
+		qcom,mode = <1>;                /* Output */
+		qcom,pull = <5>;                /* No Pull */
+		qcom,vin-sel = <0>;             /* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;             /* GPIO */
+		qcom,invert = <0>;              /* Invert */
+		qcom,master-en = <1>;           /* Enable GPIO */
+		status = "ok";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-camera-sensor-mtp.dtsi b/arch/arm64/boot/dts/qcom/sdm630-camera-sensor-mtp.dtsi
new file mode 100644
index 000000000000..32a251f00550
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-camera-sensor-mtp.dtsi
@@ -0,0 +1,427 @@
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	led_flash0: qcom,camera-flash@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pm660l_flash0 &pm660l_flash1>;
+		qcom,torch-source = <&pm660l_torch0 &pm660l_torch1>;
+		qcom,switch-source = <&pm660l_switch0>;
+		status = "ok";
+	};
+
+	led_flash1: qcom,camera-flash@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pm660l_flash2>;
+		qcom,torch-source = <&pm660l_torch2>;
+		qcom,switch-source = <&pm660l_switch1>;
+		status = "ok";
+	};
+
+	cam_avdd_gpio_regulator: cam_avdd_fixed_regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "cam_avdd_gpio_regulator";
+		regulator-min-microvolt = <3600000>;
+		regulator-max-microvolt = <3600000>;
+		enable-active-high;
+		gpio = <&tlmm 51 0>;
+		vin-supply = <&pm660l_bob>;
+	};
+
+	cam_dvdd_gpio_regulator: cam_dvdd_fixed_regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "cam_dvdd_gpio_regulator";
+		regulator-min-microvolt = <1350000>;
+		regulator-max-microvolt = <1350000>;
+		enable-active-high;
+		gpio = <&pm660l_gpios 3 0>;
+		vin-supply = <&pm660_s5>;
+	};
+
+	cam_rear_dvdd_gpio_regulator: cam_rear_dvdd_fixed_regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "cam_rear_dvdd_gpio_regulator";
+		regulator-min-microvolt = <1350000>;
+		regulator-max-microvolt = <1350000>;
+		enable-active-high;
+		gpio = <&pm660l_gpios 4 0>;
+		vin-supply = <&pm660_s5>;
+	};
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&pm660l_l8>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <3400000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&pm660l_l8>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <3400000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	actuator2: qcom,actuator@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&pm660l_l8>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <3400000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	ois0: qcom,ois@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,ois";
+		qcom,cci-master = <0>;
+		gpios = <&tlmm 50 0>;
+		qcom,gpio-vaf = <0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "CAM_VAF";
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_actuator_vaf_suspend>;
+		status = "disabled";
+	};
+
+	tof0: qcom,tof@29{
+		cell-index = <0>;
+		reg = <0x29>;
+		compatible = "st,stmvl53l0";
+		qcom,cci-master = <0>;
+		cam_laser-supply = <&pm660l_l8>;
+		qcom,cam-vreg-name =  "cam_laser";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <3400000>;
+		qcom,cam-vreg-op-mode = <100000>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_tof_active>;
+		pinctrl-1 = <&cam_tof_suspend>;
+		stm,irq-gpio = <&tlmm 45 0x2008>;
+		gpios = <&tlmm 42 0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "RNG_EN";
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&cam_rear_dvdd_gpio_regulator>;
+		cam_vaf-supply = <&pm660l_l8>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig",
+					"cam_vaf";
+		qcom,cam-vreg-min-voltage = <1780000 0 0 2800000>;
+		qcom,cam-vreg-max-voltage = <1950000 0 0 3400000>;
+		qcom,cam-vreg-op-mode = <105000 0 0 100000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				&cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_sensor_rear_suspend>;
+		gpios = <&tlmm 32 0>,
+			<&tlmm 46 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-req-tbl-num = <0 1>;
+		qcom,gpio-req-tbl-flags = <1 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK0_CLK_SRC>,
+				<&clock_mmss MMSS_CAMSS_MCLK0_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&cam_dvdd_gpio_regulator>;
+		cam_vaf-supply = <&pm660l_l8>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig",
+					"cam_vaf";
+		qcom,cam-vreg-min-voltage = <1780000 0 0 2800000>;
+		qcom,cam-vreg-max-voltage = <1950000 0 0 3400000>;
+		qcom,cam-vreg-op-mode = <105000 0 0 100000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+			&cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+			&cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 34 0>,
+		    <&tlmm 48 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-req-tbl-num = <0 1>;
+		qcom,gpio-req-tbl-flags = <1 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK",
+				"CAM_RESET";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK2_CLK_SRC>,
+		    <&clock_mmss MMSS_CAMSS_MCLK2_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom2: qcom,eeprom@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&cam_dvdd_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig",
+					"cam_vaf";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 0 2800000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 0 3400000>;
+		qcom,cam-vreg-op-mode = <105000 80000 0 100000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 33 0>,
+			<&tlmm 47 0>,
+			<&tlmm 44 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vana = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VANA";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK1_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK1_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <270>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,ois-src = <&ois0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&cam_rear_dvdd_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 0>;
+		qcom,cam-vreg-max-voltage = <1950000 0 0>;
+		qcom,cam-vreg-op-mode = <105000 0 0>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				 &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				 &cam_sensor_rear_suspend>;
+		gpios = <&tlmm 32 0>,
+			<&tlmm 46 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-req-tbl-num = <0 1>;
+		qcom,gpio-req-tbl-flags = <1 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK0_CLK_SRC>,
+				<&clock_mmss MMSS_CAMSS_MCLK0_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,actuator-src = <&actuator1>;
+		qcom,eeprom-src = <&eeprom1>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&cam_dvdd_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 0>;
+		qcom,cam-vreg-max-voltage = <1950000 0 0>;
+		qcom,cam-vreg-op-mode = <105000 0 0>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 34 0>,
+			<&tlmm 48 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-req-tbl-num = <0 1>;
+		qcom,gpio-req-tbl-flags = <1 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK",
+					  "CAM_RESET";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK2_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK2_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,actuator-src = <&actuator2>;
+		qcom,eeprom-src = <&eeprom2>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&cam_dvdd_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 0>;
+		qcom,cam-vreg-max-voltage = <1950000 0 0>;
+		qcom,cam-vreg-op-mode = <105000 0 0>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 33 0>,
+			<&tlmm 47 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-req-tbl-num = <0 1>;
+		qcom,gpio-req-tbl-flags = <1 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK1_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK1_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@3 {
+		cell-index = <3>;
+		compatible = "qcom,camera";
+		reg = <0x03>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <90>;
+		qcom,led-flash-src = <&led_flash1>;
+		qcom,actuator-src = <&actuator2>;
+		qcom,eeprom-src = <&eeprom2>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&cam_dvdd_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 0>;
+		qcom,cam-vreg-max-voltage = <1950000 0 0>;
+		qcom,cam-vreg-op-mode = <105000 0 0>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk3_active
+				 &cam_sensor_front_iris_active>;
+		pinctrl-1 = <&cam_sensor_mclk3_suspend
+				 &cam_sensor_front_iris_suspend>;
+		gpios = <&tlmm 35 0>,
+			<&tlmm 52 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-req-tbl-num = <0 1>;
+		qcom,gpio-req-tbl-flags = <1 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK3",
+					"CAM_RESET3";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK3_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK3_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
+
+&pm660l_gpios {
+	gpio@c300 { /* GPIO4 -CAMERA SENSOR 0 VDIG*/
+		qcom,mode = <1>;                /* Output */
+		qcom,pull = <5>;                /* No Pull */
+		qcom,vin-sel = <0>;             /* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;             /* GPIO */
+		qcom,invert = <0>;              /* Invert */
+		qcom,master-en = <1>;           /* Enable GPIO */
+		status = "ok";
+	};
+
+	gpio@c200 { /* GPIO3 -CAMERA SENSOR 2 VDIG*/
+		qcom,mode = <1>;                /* Output */
+		qcom,pull = <5>;                /* No Pull */
+		qcom,vin-sel = <0>;             /* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;             /* GPIO */
+		qcom,invert = <0>;              /* Invert */
+		qcom,master-en = <1>;           /* Enable GPIO */
+		status = "ok";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-camera-sensor-qrd.dtsi b/arch/arm64/boot/dts/qcom/sdm630-camera-sensor-qrd.dtsi
new file mode 100644
index 000000000000..1db8503b0200
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-camera-sensor-qrd.dtsi
@@ -0,0 +1,428 @@
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	led_flash0: qcom,camera-flash {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pm660l_flash0 &pm660l_flash1>;
+		qcom,torch-source = <&pm660l_torch0 &pm660l_torch1>;
+		qcom,switch-source = <&pm660l_switch0>;
+		status = "ok";
+	};
+
+	cam_avdd_gpio_regulator: cam_avdd_fixed_regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "cam_vadd_gpio_regulator";
+		regulator-min-microvolt = <2800000>;
+		regulator-max-microvolt = <2800000>;
+		enable-active-high;
+		gpio = <&tlmm 51 0>;
+		vin-supply = <&pm660l_bob>;
+	};
+
+	cam_vaf_gpio_regulator: cam_vaf_fixed_regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "cam_vaf_gpio_regulator";
+		regulator-min-microvolt = <2800000>;
+		regulator-max-microvolt = <2800000>;
+		enable-active-high;
+		gpio = <&tlmm 50 0>;
+		vin-supply = <&pm660l_bob>;
+	};
+};
+
+&tlmm {
+	cam_sensor_rear_active: cam_sensor_rear_active {
+		/* RESET */
+		mux {
+			pins = "gpio46";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio46";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_rear_suspend: cam_sensor_rear_suspend {
+		/* RESET */
+		mux {
+			pins = "gpio46";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio46";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_rear2_active: cam_sensor_rear2_active {
+		/* RESET */
+		mux {
+			pins = "gpio48";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio48";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_rear2_suspend: cam_sensor_rear2_suspend {
+		/* RESET */
+		mux {
+			pins = "gpio48";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio48";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_front_active: cam_sensor_front_active {
+		/* RESET */
+		mux {
+			pins = "gpio47";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio47";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_front_suspend: cam_sensor_front_suspend {
+		/* RESET */
+		mux {
+			pins = "gpio47";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio47";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&cam_vaf_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <0>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&cam_vaf_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <0>;
+	};
+
+	ois0: qcom,ois {
+		cell-index = <0>;
+		compatible = "qcom,ois";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&cam_vaf_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <0>;
+		status = "disabled";
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 0 1350000>;
+		qcom,cam-vreg-op-mode = <105000 0 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				&cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_sensor_rear_suspend>;
+		gpios = <&tlmm 32 0>,
+			<&tlmm 46 0>,
+			<&pm660l_gpios 4 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 1>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET0",
+					"CAM_VDIG";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK0_CLK_SRC>,
+				<&clock_mmss MMSS_CAMSS_MCLK0_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 0 1350000>;
+		qcom,cam-vreg-op-mode = <105000 0 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 34 0>,
+			<&tlmm 48 0>,
+			<&pm660l_gpios 4 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 1>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_VDIG";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK2_CLK_SRC>,
+		    <&clock_mmss MMSS_CAMSS_MCLK2_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom2: qcom,eeprom@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 1352000>;
+		qcom,cam-vreg-max-voltage = <1950000 0 1352000>;
+		qcom,cam-vreg-op-mode = <105000 0 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 33 0>,
+			<&tlmm 47 0>,
+			<&pm660l_gpios 3 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK1_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK1_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,special-support-sensors = "imx362_gt24c64a";
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <270>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,ois-src = <&ois0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 0 1350000>;
+		qcom,cam-vreg-op-mode = <105000 0 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				 &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				 &cam_sensor_rear_suspend>;
+		gpios = <&tlmm 32 0>,
+			<&tlmm 46 0>,
+			<&pm660l_gpios 4 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 1>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET0",
+					"CAM_VDIG";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK0_CLK_SRC>,
+				<&clock_mmss MMSS_CAMSS_MCLK0_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <270>;
+		qcom,actuator-src = <&actuator1>;
+		qcom,eeprom-src = <&eeprom1>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 0 1350000>;
+		qcom,cam-vreg-op-mode = <105000 0 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 34 0>,
+			<&tlmm 48 0>,
+			<&pm660l_gpios 4 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 1>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1",
+					  "CAM_VDIG";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK2_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK2_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <270>;
+		qcom,eeprom-src = <&eeprom2>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 0 1350000>;
+		qcom,cam-vreg-op-mode = <105000 0 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 33 0>,
+			<&tlmm 47 0>,
+			<&pm660l_gpios 3 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK1_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK1_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
+
+&pm660l_gpios {
+	gpio@c300 { /* GPIO4 -CAMERA SENSOR 0 VDIG*/
+		qcom,mode = <1>;                /* Output */
+		qcom,pull = <5>;                /* No Pull */
+		qcom,vin-sel = <0>;             /* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;             /* GPIO */
+		qcom,invert = <0>;              /* Invert */
+		qcom,master-en = <1>;           /* Enable GPIO */
+		status = "ok";
+	};
+
+	gpio@c200 { /* GPIO3 -CAMERA SENSOR 2 VDIG*/
+		qcom,mode = <1>;                /* Output */
+		qcom,pull = <5>;                /* No Pull */
+		qcom,vin-sel = <0>;             /* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;             /* GPIO */
+		qcom,invert = <0>;              /* Invert */
+		qcom,master-en = <1>;           /* Enable GPIO */
+		status = "ok";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-camera.dtsi b/arch/arm64/boot/dts/qcom/sdm630-camera.dtsi
new file mode 100644
index 000000000000..834a5706a525
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-camera.dtsi
@@ -0,0 +1,870 @@
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	qcom,msm-cam@ca00000 {
+		compatible = "qcom,msm-cam";
+		reg = <0xca00000 0x4000>;
+		reg-names = "msm-cam";
+		status = "ok";
+		bus-vectors = "suspend", "svs", "nominal", "turbo";
+		qcom,bus-votes = <0 150000000 320000000 320000000>;
+	};
+
+	qcom,csiphy@c824000 {
+		cell-index = <0>;
+		compatible = "qcom,csiphy-v3.5", "qcom,csiphy";
+		reg = <0xc824000 0x1000>,
+				<0xca00120 0x4>;
+		reg-names = "csiphy", "csiphy_clk_mux";
+		interrupts = <0 78 0>;
+		interrupt-names = "csiphy";
+		gdscr-supply = <&gdsc_camss_top>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "gdscr", "bimc_smmu";
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss CSI0_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI0_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPHY_CSID0_CLK>,
+			<&clock_mmss CSI0PHYTIMER_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI0PHYTIMER_CLK>,
+			<&clock_mmss MMSS_CAMSS_ISPIF_AHB_CLK>,
+			<&clock_mmss CSIPHY_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSIPHY0_CLK>,
+			<&clock_mmss MMSS_CSIPHY_AHB2CRIF_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"csi_src_clk", "csi_clk", "cphy_csid_clk",
+			"csiphy_timer_src_clk", "csiphy_timer_clk",
+			"camss_ispif_ahb_clk", "csiphy_clk_src", "csiphy_clk",
+			"csiphy_ahb2crif";
+		qcom,clock-rates = <0 0 0 0 0 0 310000000 0 0 269333333 0
+			0 200000000 0 0>;
+		status = "ok";
+	};
+
+	qcom,csiphy@c825000 {
+		cell-index = <1>;
+		compatible = "qcom,csiphy-v3.5", "qcom,csiphy";
+		reg = <0xc825000 0x1000>,
+				<0xca00124 0x4>;
+		reg-names = "csiphy", "csiphy_clk_mux";
+		interrupts = <0 79 0>;
+		interrupt-names = "csiphy";
+		gdscr-supply = <&gdsc_camss_top>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "gdscr", "bimc_smmu";
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss CSI1_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI1_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPHY_CSID1_CLK>,
+			<&clock_mmss CSI1PHYTIMER_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI1PHYTIMER_CLK>,
+			<&clock_mmss MMSS_CAMSS_ISPIF_AHB_CLK>,
+			<&clock_mmss CSIPHY_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSIPHY1_CLK>,
+			<&clock_mmss MMSS_CSIPHY_AHB2CRIF_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"csi_src_clk", "csi_clk", "cphy_csid_clk",
+			"csiphy_timer_src_clk", "csiphy_timer_clk",
+			"camss_ispif_ahb_clk", "csiphy_clk_src", "csiphy_clk",
+			"csiphy_ahb2crif";
+		qcom,clock-rates = <0 0 0 0 0 0 310000000 0 0 269333333 0
+			0 200000000 0 0>;
+		status = "ok";
+	};
+
+	qcom,csiphy@c826000 {
+		cell-index = <2>;
+		compatible = "qcom,csiphy-v3.5", "qcom,csiphy";
+		reg = <0xc826000 0x1000>,
+				<0xca00128 0x4>;
+		reg-names = "csiphy", "csiphy_clk_mux";
+		interrupts = <0 80 0>;
+		interrupt-names = "csiphy";
+		gdscr-supply = <&gdsc_camss_top>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "gdscr", "bimc_smmu";
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss CSI2_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI2_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPHY_CSID2_CLK>,
+			<&clock_mmss CSI2PHYTIMER_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI2PHYTIMER_CLK>,
+			<&clock_mmss MMSS_CAMSS_ISPIF_AHB_CLK>,
+			<&clock_mmss CSIPHY_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSIPHY2_CLK>,
+			<&clock_mmss MMSS_CSIPHY_AHB2CRIF_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"csi_src_clk", "csi_clk", "cphy_csid_clk",
+			"csiphy_timer_src_clk", "csiphy_timer_clk",
+			"camss_ispif_ahb_clk", "csiphy_clk_src", "csiphy_clk",
+			"csiphy_ahb2crif";
+		qcom,clock-rates = <0 0 0 0 0 0 310000000 0 0 269333333 0
+			0 200000000 0 0>;
+		status = "ok";
+	};
+
+	qcom,csid@ca30000  {
+		cell-index = <0>;
+		compatible = "qcom,csid-v5.0", "qcom,csid";
+		reg = <0xca30000 0x400>;
+		reg-names = "csid";
+		interrupts = <0 296 0>;
+		interrupt-names = "csid";
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_ISPIF_AHB_CLK>,
+			<&clock_mmss CSI0_CLK_SRC>,
+			<&clock_mmss CSIPHY_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI0_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI0_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI0RDI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI0PIX_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPHY_CSID0_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csi_src_clk", "csiphy_clk_src",
+			"csi_clk", "csi_ahb_clk", "csi_rdi_clk",
+			"csi_pix_clk", "cphy_csid_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 0 310000000 200000000
+			0 0 0 0 0>;
+		status = "ok";
+	};
+
+	qcom,csid@ca30400 {
+		cell-index = <1>;
+		compatible = "qcom,csid-v5.0", "qcom,csid";
+		reg = <0xca30400 0x400>;
+		reg-names = "csid";
+		interrupts = <0 297 0>;
+		interrupt-names = "csid";
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_ISPIF_AHB_CLK>,
+			<&clock_mmss CSI1_CLK_SRC>,
+			<&clock_mmss CSIPHY_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI1_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI1_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI1RDI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI1PIX_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPHY_CSID1_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csi_src_clk", "csiphy_clk_src",
+			"csi_clk", "csi_ahb_clk", "csi_rdi_clk",
+			"csi_pix_clk", "cphy_csid_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 0 310000000 200000000
+			 0 0 0 0 0>;
+		status = "ok";
+	};
+
+	qcom,csid@ca30800 {
+		cell-index = <2>;
+		compatible = "qcom,csid-v5.0", "qcom,csid";
+		reg = <0xca30800 0x400>;
+		reg-names = "csid";
+		interrupts = <0 298 0>;
+		interrupt-names = "csid";
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_ISPIF_AHB_CLK>,
+			<&clock_mmss CSI2_CLK_SRC>,
+			<&clock_mmss CSIPHY_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI2_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI2_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI2RDI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI2PIX_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPHY_CSID2_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csi_src_clk", "csiphy_clk_src",
+			"csi_clk", "csi_ahb_clk", "csi_rdi_clk",
+			"csi_pix_clk", "cphy_csid_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 0 310000000 200000000
+			 0 0 0 0 0>;
+		status = "ok";
+	};
+
+	qcom,csid@ca30c00 {
+		cell-index = <3>;
+		compatible = "qcom,csid-v5.0", "qcom,csid";
+		reg = <0xca30c00 0x400>;
+		reg-names = "csid";
+		interrupts = <0 299 0>;
+		interrupt-names = "csid";
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_ISPIF_AHB_CLK>,
+			<&clock_mmss CSI3_CLK_SRC>,
+			<&clock_mmss CSIPHY_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI3_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI3_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI3RDI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI3PIX_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPHY_CSID3_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csi_src_clk", "csiphy_clk_src",
+			"csi_clk", "csi_ahb_clk", "csi_rdi_clk",
+			"csi_pix_clk", "cphy_csid_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 0 310000000 200000000
+			 0 0 0 0 0>;
+		status = "ok";
+	};
+
+	qcom,cam_smmu {
+		compatible = "qcom,msm-cam-smmu";
+		status = "ok";
+
+		msm_cam_smmu_cb1 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&mmss_bimc_smmu 0xc00>,
+					<&mmss_bimc_smmu 0xc01>,
+					<&mmss_bimc_smmu 0xc02>,
+					<&mmss_bimc_smmu 0xc03>;
+			label = "vfe";
+			qcom,scratch-buf-support;
+		};
+
+		msm_cam_smmu_cb2 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&mmss_bimc_smmu 0xa00>;
+			label = "cpp";
+		};
+
+		msm_cam_smmu_cb4 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&mmss_bimc_smmu 0x800>;
+			label = "jpeg_enc0";
+		};
+
+		msm_cam_smmu_cb5 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&mmss_bimc_smmu 0x801>;
+			label = "jpeg_dma";
+		};
+	};
+
+	qcom,cpp@ca04000 {
+		cell-index = <0>;
+		compatible = "qcom,cpp";
+		reg = <0xca04000 0x100>,
+			<0xca80000 0x3000>,
+			<0xca18000 0x3000>,
+			<0xc8c36D4 0x4>;
+		reg-names = "cpp", "cpp_vbif", "cpp_hw", "camss_cpp";
+		interrupts = <0 294 0>;
+		interrupt-names = "cpp";
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		vdd-supply = <&gdsc_cpp>;
+		qcom,vdd-names = "smmu-vdd", "camss-vdd", "vdd";
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss CPP_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CPP_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPP_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPP_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_MICRO_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPP_VBIF_AHB_CLK>;
+		clock-names = "mmssnoc_axi_clk",
+			"mnoc_ahb_clk",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"cpp_src_clk",
+			"cpp_core_clk", "camss_cpp_ahb_clk",
+			"camss_cpp_axi_clk", "micro_iface_clk",
+			"mmss_smmu_axi_clk", "cpp_vbif_ahb_clk";
+		qcom,clock-rates = <0 0 0 0 200000000 200000000 0 0 0 0 0>;
+		qcom,min-clock-rate = <200000000>;
+		qcom,bus-master = <1>;
+		qcom,vbif-qos-setting = <0x550 0x55555555>,
+			<0x554 0x55555555>,
+			<0x558 0x55555555>,
+			<0x55c 0x55555555>,
+			<0x560 0x55555555>,
+			<0x564 0x55555555>,
+			<0x568 0x55555555>,
+			<0x56c 0x55555555>,
+			<0x570 0x55555555>,
+			<0x574 0x55555555>,
+			<0x578 0x55555555>,
+			<0x57c 0x55555555>,
+			<0x580 0x55555555>,
+			<0x584 0x55555555>,
+			<0x588 0x55555555>,
+			<0x58c 0x55555555>;
+		status = "ok";
+		qcom,msm-bus,name = "msm_camera_cpp";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<106 512 0 0>,
+			<106 512 0 0>;
+		qcom,msm-bus-vector-dyn-vote;
+		resets = <&clock_mmss CAMSS_MICRO_BCR>;
+		reset-names = "micro_iface_reset";
+		qcom,src-clock-rates = <120000000 256000000 384000000
+					480000000 540000000 576000000>;
+		qcom,micro-reset;
+		qcom,cpp-fw-payload-info {
+			qcom,stripe-base = <790>;
+			qcom,plane-base = <715>;
+			qcom,stripe-size = <63>;
+			qcom,plane-size = <25>;
+			qcom,fe-ptr-off = <11>;
+			qcom,we-ptr-off = <23>;
+			qcom,ref-fe-ptr-off = <17>;
+			qcom,ref-we-ptr-off = <36>;
+			qcom,we-meta-ptr-off = <42>;
+			qcom,fe-mmu-pf-ptr-off = <7>;
+			qcom,ref-fe-mmu-pf-ptr-off = <10>;
+			qcom,we-mmu-pf-ptr-off = <13>;
+			qcom,dup-we-mmu-pf-ptr-off = <18>;
+			qcom,ref-we-mmu-pf-ptr-off = <23>;
+			qcom,set-group-buffer-len = <135>;
+			qcom,dup-frame-indicator-off = <70>;
+		};
+	};
+
+	qcom,ispif@ca31000 {
+		cell-index = <0>;
+		compatible = "qcom,ispif-v3.0", "qcom,ispif";
+		reg = <0xca31000 0xc00>,
+			<0xca00020 0x4>;
+		reg-names = "ispif", "csi_clk_mux";
+		interrupts = <0 309 0>;
+		interrupt-names = "ispif";
+		qcom,num-isps = <0x2>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		vfe0-vdd-supply = <&gdsc_vfe0>;
+		vfe1-vdd-supply = <&gdsc_vfe1>;
+		qcom,vdd-names = "camss-vdd", "vfe0-vdd",
+				"vfe1-vdd";
+		qcom,clock-cntl-support;
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_ISPIF_AHB_CLK>,
+			<&clock_mmss CSI0_CLK_SRC>,
+			<&clock_mmss CSI1_CLK_SRC>,
+			<&clock_mmss CSI2_CLK_SRC>,
+			<&clock_mmss CSI3_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI0RDI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI1RDI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI2RDI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI3RDI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI0PIX_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI1PIX_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI2PIX_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI3PIX_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI0_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI1_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI2_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI3_CLK>,
+			<&clock_mmss VFE0_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_VFE0_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI_VFE0_CLK>,
+			<&clock_mmss VFE1_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_VFE1_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI_VFE1_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb_clk",
+			"camss_ahb_clk",
+			"camss_top_ahb_clk", "ispif_ahb_clk",
+			"csi0_src_clk", "csi1_src_clk",
+			"csi2_src_clk", "csi3_src_clk",
+			"csi0_rdi_clk", "csi1_rdi_clk",
+			"csi2_rdi_clk", "csi3_rdi_clk",
+			"csi0_pix_clk", "csi1_pix_clk",
+			"csi2_pix_clk", "csi3_pix_clk",
+			"camss_csi0_clk", "camss_csi1_clk",
+			"camss_csi2_clk", "camss_csi3_clk",
+			"vfe0_clk_src",
+			"camss_vfe_vfe0_clk",
+			"camss_csi_vfe0_clk",
+			"vfe1_clk_src",
+			"camss_vfe_vfe1_clk",
+			"camss_csi_vfe1_clk";
+		qcom,clock-rates = <0 0 0 0 0
+			0 0 0 0
+			0 0 0 0
+			0 0 0 0
+			0 0 0 0
+			0 0 0
+			0 0 0>;
+		qcom,clock-control = "INIT_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE",
+			"INIT_RATE", "INIT_RATE",
+			"INIT_RATE", "INIT_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"INIT_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"INIT_RATE",
+			"NO_SET_RATE", "NO_SET_RATE";
+		status = "ok";
+	};
+
+	vfe0: qcom,vfe0@ca10000 {
+		cell-index = <0>;
+		compatible = "qcom,vfe48";
+		reg = <0xca10000 0x4000>,
+			<0xca40000 0x3000>,
+			<0x007801a4 0x8>;
+		reg-names = "vfe", "vfe_vbif", "vfe_fuse";
+		interrupts = <0 314 0>;
+		interrupt-names = "vfe";
+		vdd-supply = <&gdsc_vfe0>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		qcom,vdd-names = "vdd", "camss-vdd", "smmu-vdd";
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss VFE0_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_VFE0_CLK>,
+			<&clock_mmss MMSS_CAMSS_VFE0_STREAM_CLK>,
+			<&clock_mmss MMSS_CAMSS_VFE0_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_VFE_VBIF_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_VFE_VBIF_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI_VFE0_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb_clk",
+			"bimc_smmu_ahb_clk", "bimc_smmu_axi_clk",
+			"camss_ahb_clk", "camss_top_ahb_clk", "vfe_clk_src",
+			"camss_vfe_clk", "camss_vfe_stream_clk",
+			"camss_vfe_ahb_clk", "camss_vfe_vbif_ahb_clk",
+			"camss_vfe_vbif_axi_clk",
+			"camss_csi_vfe_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 404000000 0 0 0 0 0 0
+					0 0 0 0 0 0 480000000 0 0 0 0 0 0
+					0 0 0 0 0 0 576000000 0 0 0 0 0 0>;
+		status = "ok";
+		qos-entries = <8>;
+		qos-regs = <0x404 0x408 0x40c 0x410 0x414 0x418
+			0x41c 0x420>;
+		qos-settings = <0xaaa5aaa5
+			0xaaa5aaa5
+			0xaaa5aaa5
+			0xaa55aaa5
+			0xaa55aa55
+			0xaa55aa55
+			0xaa55aa55
+			0x0005aa55>;
+		vbif-entries = <3>;
+		vbif-regs = <0x124 0xac 0xd0>;
+		vbif-settings = <0x3 0x40 0x1010>;
+		ds-entries = <17>;
+		ds-regs = <0x424 0x428 0x42c 0x430 0x434
+			0x438 0x43c 0x440 0x444 0x448 0x44c
+			0x450 0x454 0x458 0x45c 0x460 0x464>;
+		ds-settings = <0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0x110>;
+		qcom,msm-bus,name = "msm_camera_vfe";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<29 512 0 0>,
+			<29 512 100000000 100000000>;
+		qcom,msm-bus-vector-dyn-vote;
+	};
+
+	vfe1: qcom,vfe1@ca14000 {
+		cell-index = <1>;
+		compatible = "qcom,vfe48";
+		reg = <0xca14000 0x4000>,
+			<0xca40000 0x3000>,
+			<0x007801a4 0x8>;
+		reg-names = "vfe", "vfe_vbif", "vfe_fuse";
+		interrupts = <0 315 0>;
+		interrupt-names = "vfe";
+		vdd-supply = <&gdsc_vfe1>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		qcom,vdd-names = "vdd", "camss-vdd", "smmu-vdd";
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss VFE1_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_VFE1_CLK>,
+			<&clock_mmss MMSS_CAMSS_VFE1_STREAM_CLK>,
+			<&clock_mmss MMSS_CAMSS_VFE1_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_VFE_VBIF_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_VFE_VBIF_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI_VFE1_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb_clk",
+			"bimc_smmu_ahb_clk", "bimc_smmu_axi_clk",
+			"camss_ahb_clk", "camss_top_ahb_clk", "vfe_clk_src",
+			"camss_vfe_clk", "camss_vfe_stream_clk",
+			"camss_vfe_ahb_clk", "camss_vfe_vbif_ahb_clk",
+			"camss_vfe_vbif_axi_clk",
+			"camss_csi_vfe_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 404000000 0 0 0 0 0 0
+					0 0 0 0 0 0 480000000 0 0 0 0 0 0
+					0 0 0 0 0 0 576000000 0 0 0 0 0 0>;
+		status = "ok";
+		qos-entries = <8>;
+		qos-regs = <0x404 0x408 0x40c 0x410 0x414 0x418
+			0x41c 0x420>;
+		qos-settings = <0xaaa5aaa5
+			0xaaa5aaa5
+			0xaaa5aaa5
+			0xaa55aaa5
+			0xaa55aa55
+			0xaa55aa55
+			0xaa55aa55
+			0x0005aa55>;
+		vbif-entries = <3>;
+		vbif-regs = <0x124 0xac 0xd0>;
+		vbif-settings = <0x3 0x40 0x1010>;
+		ds-entries = <17>;
+		ds-regs = <0x424 0x428 0x42c 0x430 0x434
+			0x438 0x43c 0x440 0x444 0x448 0x44c
+			0x450 0x454 0x458 0x45c 0x460 0x464>;
+		ds-settings = <0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0x110>;
+		qcom,msm-bus,name = "msm_camera_vfe";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<29 512 0 0>,
+			<29 512 100000000 100000000>;
+		qcom,msm-bus-vector-dyn-vote;
+	};
+
+	qcom,vfe {
+		compatible = "qcom,vfe";
+		num_child = <2>;
+	};
+
+	cci: qcom,cci@ca0c000 {
+		cell-index = <0>;
+		compatible = "qcom,cci";
+		reg = <0xca0c000 0x4000>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "cci";
+		interrupts = <0 295 0>;
+		interrupt-names = "cci";
+		status = "ok";
+		mmagic-supply = <&gdsc_bimc_smmu>;
+		gdscr-supply = <&gdsc_camss_top>;
+		qcom,cam-vreg-name = "mmagic", "gdscr";
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss CCI_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CCI_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_CCI_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb", "smmu_ahb", "smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"cci_src_clk", "cci_ahb_clk", "camss_cci_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 19200000 0 0>,
+			<0 0 0 0 0 0 37500000 0 0>;
+		pinctrl-names = "cci_default", "cci_suspend";
+			pinctrl-0 = <&cci0_active &cci1_active>;
+			pinctrl-1 = <&cci0_suspend &cci1_suspend>;
+		gpios = <&tlmm 36 0>,
+			<&tlmm 37 0>,
+			<&tlmm 38 0>,
+			<&tlmm 39 0>;
+		qcom,gpio-tbl-num = <0 1 2 3>;
+		qcom,gpio-tbl-flags = <1 1 1 1>;
+		qcom,gpio-tbl-label = "CCI_I2C_DATA0",
+				      "CCI_I2C_CLK0",
+				      "CCI_I2C_DATA1",
+				      "CCI_I2C_CLK1";
+		i2c_freq_100Khz: qcom,i2c_standard_mode {
+			status = "disabled";
+		};
+		i2c_freq_400Khz: qcom,i2c_fast_mode {
+			status = "disabled";
+		};
+		i2c_freq_custom: qcom,i2c_custom_mode {
+			status = "disabled";
+		};
+		i2c_freq_1Mhz: qcom,i2c_fast_plus_mode {
+			status = "disabled";
+		};
+	};
+
+	qcom,jpeg@ca1c000 {
+		cell-index = <0>;
+		compatible = "qcom,jpeg";
+		reg = <0xca1c000 0x4000>,
+			<0xca60000 0x3000>;
+		reg-names = "jpeg_hw", "jpeg_vbif";
+		interrupts = <0 316 0>;
+		interrupt-names = "jpeg";
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		qcom,vdd-names = "smmu-vdd", "camss-vdd";
+		clock-names = "mmssnoc_axi",
+			"mmss_mnoc_ahb_clk",
+			"mmss_bimc_smmu_ahb_clk",
+			"mmss_bimc_smmu_axi_clk",
+			"mmss_camss_ahb_clk",
+			"mmss_camss_top_ahb_clk",
+			"core_clk",
+			"mmss_camss_jpeg_ahb_clk",
+			"mmss_camss_jpeg_axi_clk";
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_JPEG0_VOTE_CLK>,
+			<&clock_mmss MMSS_CAMSS_JPEG_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_JPEG_AXI_CLK >;
+		qcom,clock-rates = <0 0 0 0 0 0 480000000 0 0>;
+		qcom,vbif-reg-settings = <0x4 0x1>;
+		qcom,prefetch-reg-settings = <0x30c 0x1111>,
+			<0x318 0x31>,
+			<0x324 0x31>,
+			<0x330 0x31>,
+			<0x33c 0x0>;
+		qcom,msm-bus,name = "msm_camera_jpeg0";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps = <62 512 0 0>,
+			<62 512 1200000 1200000>;
+		status = "ok";
+	};
+
+	qcom,jpeg@caa0000 {
+		cell-index = <3>;
+		compatible = "qcom,jpegdma";
+		reg = <0xcaa0000 0x4000>,
+			<0xca60000 0x3000>;
+		reg-names = "jpeg_hw", "jpeg_vbif";
+		interrupts = <0 304 0>;
+		interrupt-names = "jpeg";
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		qcom,vdd-names = "smmu-vdd", "camss-vdd";
+		clock-names = "mmssnoc_axi",
+			"mmss_mnoc_ahb_clk",
+			"mmss_bimc_smmu_ahb_clk",
+			"mmss_bimc_smmu_axi_clk",
+			"mmss_camss_ahb_clk",
+			"mmss_camss_top_ahb_clk",
+			"core_clk",
+			"mmss_camss_jpeg_ahb_clk",
+			"mmss_camss_jpeg_axi_clk";
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_JPEG0_DMA_VOTE_CLK>,
+			<&clock_mmss MMSS_CAMSS_JPEG_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_JPEG_AXI_CLK>;
+		qcom,clock-rates = <0 0 0 0 0 0 480000000 0 0>;
+		qcom,vbif-reg-settings = <0x4 0x1>;
+		qcom,prefetch-reg-settings = <0x18c 0x11>,
+			<0x1a0 0x31>,
+			<0x1b0 0x31>;
+		qcom,msm-bus,name = "msm_camera_jpeg_dma";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps = <62 512 0 0>,
+			<62 512 1200000 1200000>;
+		qcom,max-ds-factor = <128>;
+		status = "ok";
+	};
+};
+
+&i2c_freq_100Khz {
+	qcom,hw-thigh = <201>;
+	qcom,hw-tlow = <174>;
+	qcom,hw-tsu-sto = <204>;
+	qcom,hw-tsu-sta = <231>;
+	qcom,hw-thd-dat = <22>;
+	qcom,hw-thd-sta = <162>;
+	qcom,hw-tbuf = <227>;
+	qcom,hw-scl-stretch-en = <0>;
+	qcom,hw-trdhld = <6>;
+	qcom,hw-tsp = <3>;
+	qcom,cci-clk-src = <37500000>;
+	status = "ok";
+};
+
+&i2c_freq_400Khz {
+	qcom,hw-thigh = <38>;
+	qcom,hw-tlow = <56>;
+	qcom,hw-tsu-sto = <40>;
+	qcom,hw-tsu-sta = <40>;
+	qcom,hw-thd-dat = <22>;
+	qcom,hw-thd-sta = <35>;
+	qcom,hw-tbuf = <62>;
+	qcom,hw-scl-stretch-en = <0>;
+	qcom,hw-trdhld = <6>;
+	qcom,hw-tsp = <3>;
+	qcom,cci-clk-src = <37500000>;
+	status = "ok";
+};
+
+&i2c_freq_custom {
+	qcom,hw-thigh = <38>;
+	qcom,hw-tlow = <56>;
+	qcom,hw-tsu-sto = <40>;
+	qcom,hw-tsu-sta = <40>;
+	qcom,hw-thd-dat = <22>;
+	qcom,hw-thd-sta = <35>;
+	qcom,hw-tbuf = <62>;
+	qcom,hw-scl-stretch-en = <1>;
+	qcom,hw-trdhld = <6>;
+	qcom,hw-tsp = <3>;
+	qcom,cci-clk-src = <37500000>;
+	status = "ok";
+};
+
+&i2c_freq_1Mhz {
+	qcom,hw-thigh = <16>;
+	qcom,hw-tlow = <22>;
+	qcom,hw-tsu-sto = <17>;
+	qcom,hw-tsu-sta = <18>;
+	qcom,hw-thd-dat = <16>;
+	qcom,hw-thd-sta = <15>;
+	qcom,hw-tbuf = <24>;
+	qcom,hw-scl-stretch-en = <0>;
+	qcom,hw-trdhld = <3>;
+	qcom,hw-tsp = <3>;
+	qcom,cci-clk-src = <37500000>;
+	status = "ok";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-cdp.dts b/arch/arm64/boot/dts/qcom/sdm630-cdp.dts
new file mode 100644
index 000000000000..973df0df3be5
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-cdp.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660L CDP";
+	compatible = "qcom,sdm630-cdp", "qcom,sdm630", "qcom,cdp";
+	qcom,board-id = <1 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-cdp.dtsi b/arch/arm64/boot/dts/qcom/sdm630-cdp.dtsi
new file mode 100644
index 000000000000..fd109450ad81
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-cdp.dtsi
@@ -0,0 +1,221 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdm660-pinctrl.dtsi"
+#include "sdm630-camera-sensor-cdp.dtsi"
+/ {
+};
+
+&uartblsp1dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&pm660l_wled {
+	qcom,led-strings-list = [01 02];
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm660l_l1>;
+	vdda-pll-supply = <&pm660_l10>;
+	vddp-ref-clk-supply = <&pm660_l1>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14200>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm660l_l4>;
+	vccq2-supply = <&pm660_l8>;
+	vcc-max-microamp = <500000>;
+	vccq2-max-microamp = <600000>;
+	status = "ok";
+};
+
+&pm660_gpios {
+	/* GPIO 4 (NFC_CLK_REQ) */
+	gpio@c300 {
+		qcom,mode = <0>;
+		qcom,vin-sel = <1>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&i2c_6 { /* BLSP1 QUP6 (NFC) */
+	status = "okay";
+	nq@28 {
+		compatible = "qcom,nq-nci";
+		reg = <0x28>;
+		qcom,nq-irq = <&tlmm 28 0x00>;
+		qcom,nq-ven = <&tlmm 29 0x00>;
+		qcom,nq-firm = <&tlmm 30 0x00>;
+		qcom,nq-clkreq = <&pm660_gpios 4 0x00>;
+		qcom,nq-esepwr = <&tlmm 31 0x00>;
+		interrupt-parent = <&tlmm>;
+		qcom,clk-src = "BBCLK3";
+		interrupts = <28 0>;
+		interrupt-names = "nfc_irq";
+		pinctrl-names = "nfc_active", "nfc_suspend";
+		pinctrl-0 = <&nfc_int_active &nfc_enable_active>;
+		pinctrl-1 = <&nfc_int_suspend &nfc_enable_suspend>;
+		clocks = <&clock_rpmcc RPM_LN_BB_CLK3_PIN>;
+		clock-names = "ref_clk";
+	};
+};
+&soc {
+	qcom,msm-ssc-sensors {
+		compatible = "qcom,msm-ssc-sensors";
+	};
+};
+
+&pm660_charger {
+	qcom,batteryless-platform;
+};
+
+&sdhc_1 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l4>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660_l8>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-lpm-sup;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <110 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	status = "ok";
+};
+
+&sdhc_2 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l5>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <15000 800000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660l_l2>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	#address-cells = <0>;
+	interrupt-parent = <&sdhc_2>;
+	interrupts = <0 1 2>;
+	#interrupt-cells = <1>;
+	interrupt-map-mask = <0xffffffff>;
+	interrupt-map = <0 &intc 0 0 125 0
+			1 &intc 0 0 221 0
+			2 &tlmm 54 0>;
+	interrupt-names = "hc_irq", "pwr_irq", "status_irq";
+	cd-gpios = <&tlmm 54 0x1>;
+
+	status = "ok";
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "single_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_nt35695b_truly_fhd_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 53 0>;
+	qcom,platform-te-gpio = <&tlmm 59 0>;
+};
+
+&mdss_dp_ctrl {
+	pinctrl-names = "mdss_dp_active", "mdss_dp_sleep";
+	pinctrl-0 = <&mdss_dp_aux_active &mdss_dp_usbplug_cc_active>;
+	pinctrl-1 = <&mdss_dp_aux_suspend &mdss_dp_usbplug_cc_suspend>;
+	qcom,aux-en-gpio = <&tlmm 55 0>;
+	qcom,aux-sel-gpio = <&tlmm 56 0>;
+	qcom,usbplug-cc-gpio = <&tlmm 58 0>;
+};
+
+&pm660l_wled {
+	qcom,led-strings-list = [01 02];
+};
+
+&dsi_nt35695b_truly_fhd_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35695b_truly_fhd_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_truly_1080_vid {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_dcs";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_truly_1080_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_dcs";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled = "single_roi";
+	qcom,panel-roi-alignment = <2 2 4 2 1080 2>;
+};
+
+&pm660l_pwm_4 {
+	qcom,dtest-line = <2>;   /* DTEST2 */
+	qcom,dtest-output = <2>; /* OUTPUT PWM */
+};
+
+&pm660l_gpios {
+	gpio@c500 {
+		qcom,mode = <1>;        /* DIG_OUT */
+		qcom,output-type = <0>; /* CMOS */
+		qcom,src-sel = <7>;     /* DTEST2 */
+		qcom,master-en = <1>;   /* Enable MPP */
+		qcom,invert = <0>;      /* Enable MPP */
+	};
+};
+
+&dsi_sharp_split_link_wuxga_video {
+	pwms = <&pm660l_pwm_4 0 0>;
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-pwm-pmi;
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+	qcom,panel-supply-entries = <&dsi_panel_split_link_pwr_supply>;
+};
+
+&dsi_rm67195_amoled_fhd_cmd {
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_labibb_amoled>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-coresight.dtsi b/arch/arm64/boot/dts/qcom/sdm630-coresight.dtsi
new file mode 100644
index 000000000000..e035cf85b9df
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-coresight.dtsi
@@ -0,0 +1,79 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdm660-coresight.dtsi"
+
+&etm0 {
+	cpu = <&CPU4>;
+};
+
+&etm1 {
+	cpu = <&CPU5>;
+};
+
+&etm2 {
+	cpu = <&CPU6>;
+};
+
+&etm3 {
+	cpu = <&CPU7>;
+};
+
+&etm4 {
+	cpu = <&CPU0>;
+};
+
+&etm5 {
+	cpu = <&CPU1>;
+};
+
+&etm6 {
+	cpu = <&CPU2>;
+};
+
+&etm7 {
+	cpu = <&CPU3>;
+};
+
+&cti_cpu0 {
+	cpu = <&CPU4>;
+};
+
+&cti_cpu1 {
+	cpu = <&CPU5>;
+};
+
+&cti_cpu2 {
+	cpu = <&CPU6>;
+};
+
+&cti_cpu3 {
+	cpu = <&CPU7>;
+};
+
+&cti_cpu4 {
+	cpu = <&CPU0>;
+};
+
+&cti_cpu5 {
+	cpu = <&CPU1>;
+};
+
+&cti_cpu6 {
+	cpu = <&CPU2>;
+};
+
+&cti_cpu7 {
+	cpu = <&CPU3>;
+};
+
+/delete-node/ &cti_turing;
diff --git a/arch/arm64/boot/dts/qcom/sdm630-gpu.dtsi b/arch/arm64/boot/dts/qcom/sdm630-gpu.dtsi
new file mode 100644
index 000000000000..72b89a7e7c47
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-gpu.dtsi
@@ -0,0 +1,535 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	pil_gpu: qcom,kgsl-hyp {
+		compatible = "qcom,pil-tz-generic";
+		qcom,pas-id = <13>;
+		qcom,firmware-name = "a508_zap";
+	};
+
+	msm_bus: qcom,kgsl-busmon{
+		label = "kgsl-busmon";
+		compatible = "qcom,kgsl-busmon";
+	};
+
+	gpubw: qcom,gpubw {
+		compatible = "qcom,devbw";
+		governor = "bw_vbif";
+		qcom,src-dst-ports = <26 512>;
+		/*
+		 * active-only flag is used while registering the bus
+		 * governor. It helps release the bus vote when the CPU
+		 * subsystem is inactive
+		 */
+		qcom,active-only;
+		/*
+		 * IB votes in MBPS, derived using below formula
+		 * IB = (DDR frequency * DDR bus width in Bytes * Dual rate)
+		 * Note: IB vote is per DDR channel vote
+		 */
+		qcom,bw-tbl =
+			<     0 /*  off     */ >,
+			<   381 /*  100 MHz */ >,
+			<   572 /*  150 MHz */ >,
+			<   762 /*  200 MHz */ >,
+			<  1144 /*  300 MHz */ >,
+			<  1571 /*  412 MHz */ >,
+			<  2086 /*  547 MHz */ >,
+			<  2597 /*  681 MHz */ >,
+			<  2929 /*  768 MHz */ >,
+			<  3879 /*  1017 MHz */ >,
+			<  4943 /*  1296 MHz */ >,
+			<  5161 /*  1353 MHz */ >;
+	};
+
+	msm_gpu: qcom,kgsl-3d0@5000000 {
+		label = "kgsl-3d0";
+		compatible = "qcom,kgsl-3d0", "qcom,kgsl-3d";
+		status = "ok";
+		reg = <0x5000000 0x40000
+			0x780000 0x6220>;
+		reg-names = "kgsl_3d0_reg_memory", "qfprom_memory";
+		interrupts = <0 300 0>;
+		interrupt-names = "kgsl_3d0_irq";
+		qcom,id = <0>;
+
+		qcom,chipid = <0x05000800>;
+
+		qcom,initial-pwrlevel = <5>;
+
+		/* <HZ/12> */
+		qcom,idle-timeout = <80>;
+
+		qcom,highest-bank-bit = <14>;
+
+		/* size in bytes */
+		qcom,snapshot-size = <1048576>;
+
+		clocks = <&clock_gfx GPUCC_GFX3D_CLK>,
+			<&clock_gcc GCC_GPU_CFG_AHB_CLK>,
+			<&clock_gfx GPUCC_RBBMTIMER_CLK>,
+			<&clock_gcc GCC_GPU_BIMC_GFX_CLK>,
+			<&clock_gcc GCC_BIMC_GFX_CLK>,
+			<&clock_gpu GPUCC_RBCPR_CLK>;
+
+		clock-names = "core_clk", "iface_clk", "rbbmtimer_clk",
+			"mem_clk", "alt_mem_iface_clk", "rbcpr_clk";
+
+		/* Bus Scale Settings */
+		qcom,gpubw-dev = <&gpubw>;
+		qcom,bus-control;
+		/* GPU to BIMC bus width, VBIF data transfer in 1 cycle */
+		qcom,bus-width = <32>;
+		qcom,msm-bus,name = "grp3d";
+		qcom,msm-bus,num-cases = <12>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<26 512 0 0>,
+				<26 512 0 400000>,     /*  1 bus=100  */
+				<26 512 0 600000>,     /*  2 bus=150  */
+				<26 512 0 800000>,     /*  3 bus=200  */
+				<26 512 0 1200000>,    /*  4 bus=300  */
+				<26 512 0 1648000>,    /*  5 bus=412  */
+				<26 512 0 2188000>,    /*  6 bus=547  */
+				<26 512 0 2724000>,    /*  7 bus=681  */
+				<26 512 0 3072000>,    /*  8 bus=768  */
+				<26 512 0 4068000>,    /*  9 bus=1017 */
+				<26 512 0 5184000>,    /* 10 bus=1296 */
+				<26 512 0 5412000>;    /* 11 bus=1353 */
+
+		/* GDSC regulator names */
+		regulator-names = "vddcx", "vdd";
+		/* GDSC oxili regulators */
+		vddcx-supply = <&gdsc_gpu_cx>;
+		vdd-supply = <&gdsc_gpu_gx>;
+
+		/* CPU latency parameter */
+		qcom,pm-qos-active-latency = <424>;
+		qcom,pm-qos-wakeup-latency = <424>;
+
+		/* Quirks */
+		qcom,gpu-quirk-dp2clockgating-disable;
+		qcom,gpu-quirk-lmloadkill-disable;
+
+		/* Enable context aware freq. scaling */
+		qcom,enable-ca-jump;
+
+		/* Context aware jump busy penalty in us */
+		qcom,ca-busy-penalty = <12000>;
+
+		/* Context aware jump target power level */
+		qcom,ca-target-pwrlevel = <4>;
+
+		qcom,gpu-speed-bin = <0x41a0 0x1fe00000 21>;
+
+		/* Enable midframe sampling */
+		qcom,enable-midframe-timer;
+
+		/* GPU Mempools */
+		qcom,gpu-mempools {
+			#address-cells= <1>;
+			#size-cells = <0>;
+			compatible = "qcom,gpu-mempools";
+
+			qcom,mempool-max-pages = <32768>;
+
+			/* 4K Page Pool configuration */
+			qcom,gpu-mempool@0 {
+				reg = <0>;
+				qcom,mempool-page-size = <4096>;
+			};
+			/* 64K Page Pool configuration */
+			qcom,gpu-mempool@1 {
+				reg = <1>;
+				qcom,mempool-page-size  = <65536>;
+				qcom,mempool-allocate;
+			};
+		};
+
+		/*
+		 * Speed-bin zero is default speed bin.
+		 * For rest of the speed bins, speed-bin value
+		 * is calulated as FMAX/4.8 MHz round up to zero
+		 * decimal places.
+		 */
+		qcom,gpu-pwrlevel-bins {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			compatible="qcom,gpu-pwrlevel-bins";
+
+			qcom,gpu-pwrlevels-0 {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				qcom,speed-bin = <0>;
+
+				qcom,initial-pwrlevel = <5>;
+
+				/* TURBO */
+				qcom,gpu-pwrlevel@0 {
+					reg = <0>;
+					qcom,gpu-freq = <775000000>;
+					qcom,bus-freq = <11>;
+					qcom,bus-min = <10>;
+					qcom,bus-max = <11>;
+				};
+
+				/* TURBO */
+				qcom,gpu-pwrlevel@1 {
+					reg = <1>;
+					qcom,gpu-freq = <700000000>;
+					qcom,bus-freq = <10>;
+					qcom,bus-min = <9>;
+					qcom,bus-max = <11>;
+				};
+
+				/* NOM_L1 */
+				qcom,gpu-pwrlevel@2 {
+					reg = <2>;
+					qcom,gpu-freq = <647000000>;
+					qcom,bus-freq = <9>;
+					qcom,bus-min = <8>;
+					qcom,bus-max = <9>;
+				};
+
+				/* NOM */
+				qcom,gpu-pwrlevel@3 {
+					reg = <3>;
+					qcom,gpu-freq = <588000000>;
+					qcom,bus-freq = <9>;
+					qcom,bus-min = <7>;
+					qcom,bus-max = <9>;
+				};
+
+				/* SVS_L1 */
+				qcom,gpu-pwrlevel@4 {
+					reg = <4>;
+					qcom,gpu-freq = <465000000>;
+					qcom,bus-freq = <8>;
+					qcom,bus-min = <6>;
+					qcom,bus-max = <9>;
+				};
+
+				/* SVS */
+				qcom,gpu-pwrlevel@5 {
+					reg = <5>;
+					qcom,gpu-freq = <370000000>;
+					qcom,bus-freq = <5>;
+					qcom,bus-min = <4>;
+					qcom,bus-max = <7>;
+				};
+
+				/* Low SVS */
+				qcom,gpu-pwrlevel@6 {
+					reg = <6>;
+					qcom,gpu-freq = <240000000>;
+					qcom,bus-freq = <3>;
+					qcom,bus-min = <3>;
+					qcom,bus-max = <5>;
+				};
+
+				/* Min SVS */
+				qcom,gpu-pwrlevel@7 {
+					reg = <7>;
+					qcom,gpu-freq = <160000000>;
+					qcom,bus-freq = <3>;
+					qcom,bus-min = <2>;
+					qcom,bus-max = <4>;
+				};
+
+				/* XO */
+				qcom,gpu-pwrlevel@8 {
+					reg = <8>;
+					qcom,gpu-freq = <19200000>;
+					qcom,bus-freq = <0>;
+					qcom,bus-min = <0>;
+					qcom,bus-max = <0>;
+				};
+			};
+
+			qcom,gpu-pwrlevels-1 {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				qcom,speed-bin = <162>;
+
+				qcom,initial-pwrlevel = <5>;
+
+				/* TURBO */
+				qcom,gpu-pwrlevel@0 {
+					reg = <0>;
+					qcom,gpu-freq = <775000000>;
+					qcom,bus-freq = <11>;
+					qcom,bus-min = <10>;
+					qcom,bus-max = <11>;
+				};
+
+				/* TURBO */
+				qcom,gpu-pwrlevel@1 {
+					reg = <1>;
+					qcom,gpu-freq = <700000000>;
+					qcom,bus-freq = <10>;
+					qcom,bus-min = <9>;
+					qcom,bus-max = <11>;
+				};
+
+				/* NOM_L1 */
+				qcom,gpu-pwrlevel@2 {
+					reg = <2>;
+					qcom,gpu-freq = <647000000>;
+					qcom,bus-freq = <9>;
+					qcom,bus-min = <8>;
+					qcom,bus-max = <9>;
+				};
+
+				/* NOM */
+				qcom,gpu-pwrlevel@3 {
+					reg = <3>;
+					qcom,gpu-freq = <588000000>;
+					qcom,bus-freq = <9>;
+					qcom,bus-min = <7>;
+					qcom,bus-max = <9>;
+				};
+
+				/* SVS_L1 */
+				qcom,gpu-pwrlevel@4 {
+					reg = <4>;
+					qcom,gpu-freq = <465000000>;
+					qcom,bus-freq = <8>;
+					qcom,bus-min = <6>;
+					qcom,bus-max = <9>;
+				};
+
+				/* SVS */
+				qcom,gpu-pwrlevel@5 {
+					reg = <5>;
+					qcom,gpu-freq = <370000000>;
+					qcom,bus-freq = <5>;
+					qcom,bus-min = <4>;
+					qcom,bus-max = <7>;
+				};
+
+				/* Low SVS */
+				qcom,gpu-pwrlevel@6 {
+					reg = <6>;
+					qcom,gpu-freq = <240000000>;
+					qcom,bus-freq = <3>;
+					qcom,bus-min = <3>;
+					qcom,bus-max = <5>;
+				};
+
+				/* Min SVS */
+				qcom,gpu-pwrlevel@7 {
+					reg = <7>;
+					qcom,gpu-freq = <160000000>;
+					qcom,bus-freq = <3>;
+					qcom,bus-min = <2>;
+					qcom,bus-max = <4>;
+				};
+
+				/* XO */
+				qcom,gpu-pwrlevel@8 {
+					reg = <8>;
+					qcom,gpu-freq = <19200000>;
+					qcom,bus-freq = <0>;
+					qcom,bus-min = <0>;
+					qcom,bus-max = <0>;
+				};
+			};
+
+			qcom,gpu-pwrlevels-2 {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				qcom,speed-bin = <146>;
+
+				qcom,initial-pwrlevel = <4>;
+
+				/* TURBO */
+				qcom,gpu-pwrlevel@0 {
+					reg = <0>;
+					qcom,gpu-freq = <700000000>;
+					qcom,bus-freq = <11>;
+					qcom,bus-min = <10>;
+					qcom,bus-max = <11>;
+				};
+
+				/* NOM_L1 */
+				qcom,gpu-pwrlevel@1 {
+					reg = <1>;
+					qcom,gpu-freq = <647000000>;
+					qcom,bus-freq = <9>;
+					qcom,bus-min = <8>;
+					qcom,bus-max = <9>;
+				};
+
+				/* NOM */
+				qcom,gpu-pwrlevel@2 {
+					reg = <2>;
+					qcom,gpu-freq = <588000000>;
+					qcom,bus-freq = <9>;
+					qcom,bus-min = <7>;
+					qcom,bus-max = <9>;
+				};
+
+				/* SVS_L1 */
+				qcom,gpu-pwrlevel@3 {
+					reg = <3>;
+					qcom,gpu-freq = <465000000>;
+					qcom,bus-freq = <8>;
+					qcom,bus-min = <6>;
+					qcom,bus-max = <9>;
+				};
+
+				/* SVS */
+				qcom,gpu-pwrlevel@4 {
+					reg = <4>;
+					qcom,gpu-freq = <370000000>;
+					qcom,bus-freq = <5>;
+					qcom,bus-min = <4>;
+					qcom,bus-max = <7>;
+				};
+
+				/* Low SVS */
+				qcom,gpu-pwrlevel@5 {
+					reg = <5>;
+					qcom,gpu-freq = <240000000>;
+					qcom,bus-freq = <3>;
+					qcom,bus-min = <3>;
+					qcom,bus-max = <5>;
+				};
+
+				/* Min SVS */
+				qcom,gpu-pwrlevel@6 {
+					reg = <6>;
+					qcom,gpu-freq = <160000000>;
+					qcom,bus-freq = <3>;
+					qcom,bus-min = <2>;
+					qcom,bus-max = <4>;
+				};
+
+				/* XO */
+				qcom,gpu-pwrlevel@7 {
+					reg = <7>;
+					qcom,gpu-freq = <19200000>;
+					qcom,bus-freq = <0>;
+					qcom,bus-min = <0>;
+					qcom,bus-max = <0>;
+				};
+			};
+
+			qcom,gpu-pwrlevels-3 {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				qcom,speed-bin = <135>;
+
+				qcom,initial-pwrlevel = <3>;
+
+				/* NOM_L1 */
+				qcom,gpu-pwrlevel@0 {
+					reg = <0>;
+					qcom,gpu-freq = <647000000>;
+					qcom,bus-freq = <11>;
+					qcom,bus-min = <10>;
+					qcom,bus-max = <11>;
+				};
+
+				/* NOM */
+				qcom,gpu-pwrlevel@1 {
+					reg = <1>;
+					qcom,gpu-freq = <588000000>;
+					qcom,bus-freq = <9>;
+					qcom,bus-min = <7>;
+					qcom,bus-max = <9>;
+				};
+
+				/* SVS_L1 */
+				qcom,gpu-pwrlevel@2 {
+					reg = <2>;
+					qcom,gpu-freq = <465000000>;
+					qcom,bus-freq = <8>;
+					qcom,bus-min = <6>;
+					qcom,bus-max = <9>;
+				};
+
+				/* SVS */
+				qcom,gpu-pwrlevel@3 {
+					reg = <3>;
+					qcom,gpu-freq = <370000000>;
+					qcom,bus-freq = <5>;
+					qcom,bus-min = <4>;
+					qcom,bus-max = <7>;
+				};
+
+				/* Low SVS */
+				qcom,gpu-pwrlevel@4 {
+					reg = <4>;
+					qcom,gpu-freq = <240000000>;
+					qcom,bus-freq = <3>;
+					qcom,bus-min = <3>;
+					qcom,bus-max = <5>;
+				};
+
+				/* Min SVS */
+				qcom,gpu-pwrlevel@5 {
+					reg = <5>;
+					qcom,gpu-freq = <160000000>;
+					qcom,bus-freq = <3>;
+					qcom,bus-min = <2>;
+					qcom,bus-max = <4>;
+				};
+
+				/* XO */
+				qcom,gpu-pwrlevel@6 {
+					reg = <6>;
+					qcom,gpu-freq = <19200000>;
+					qcom,bus-freq = <0>;
+					qcom,bus-min = <0>;
+					qcom,bus-max = <0>;
+				};
+			};
+		};
+	};
+
+	kgsl_msm_iommu: qcom,kgsl-iommu {
+		compatible = "qcom,kgsl-smmu-v2";
+
+		reg = <0x05040000 0x10000>;
+		qcom,protect = <0x40000 0x10000>;
+		qcom,micro-mmu-control = <0x6000>;
+
+		clocks = <&clock_gcc GCC_GPU_CFG_AHB_CLK>,
+			<&clock_gcc GCC_GPU_BIMC_GFX_CLK>,
+			<&clock_gcc GCC_BIMC_GFX_CLK>;
+
+		clock-names = "iface_clk", "mem_clk", "alt_mem_iface_clk";
+
+		qcom,secure_align_mask = <0xfff>;
+		qcom,retention;
+		qcom,hyp_secure_alloc;
+
+		gfx3d_user: gfx3d_user {
+			compatible = "qcom,smmu-kgsl-cb";
+			label = "gfx3d_user";
+			iommus = <&kgsl_smmu 0>;
+			qcom,gpu-offset = <0x48000>;
+		};
+
+		gfx3d_secure: gfx3d_secure {
+			compatible = "qcom,smmu-kgsl-cb";
+			iommus = <&kgsl_smmu 2>;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-headset-jacktype-no-cdp.dts b/arch/arm64/boot/dts/qcom/sdm630-headset-jacktype-no-cdp.dts
new file mode 100644
index 000000000000..4db377dc755a
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-headset-jacktype-no-cdp.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660L, Headset Jacktype NO, CDP";
+	compatible = "qcom,sdm630-cdp", "qcom,sdm630", "qcom,cdp";
+	qcom,board-id = <1 2>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-headset-jacktype-no-rcm.dts b/arch/arm64/boot/dts/qcom/sdm630-headset-jacktype-no-rcm.dts
new file mode 100644
index 000000000000..be30eb172176
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-headset-jacktype-no-rcm.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660L, Headset Jacktype NO, RCM";
+	compatible = "qcom,sdm630-cdp", "qcom,sdm630", "qcom,cdp";
+	qcom,board-id = <21 2>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-internal-codec-cdp.dts b/arch/arm64/boot/dts/qcom/sdm630-internal-codec-cdp.dts
new file mode 100644
index 000000000000..baa55fa15160
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-internal-codec-cdp.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-cdp.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660L Int. Audio Codec CDP";
+	compatible = "qcom,sdm630-cdp", "qcom,sdm630", "qcom,cdp";
+	qcom,board-id = <1 1>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-internal-codec-mtp.dts b/arch/arm64/boot/dts/qcom/sdm630-internal-codec-mtp.dts
new file mode 100644
index 000000000000..b469a59d7818
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-internal-codec-mtp.dts
@@ -0,0 +1,30 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-mtp.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660L Int. Audio Codec MTP";
+	compatible = "qcom,sdm630-mtp", "qcom,sdm630", "qcom,mtp";
+	qcom,board-id = <8 1>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&int_codec {
+	qcom,model = "sdm660-snd-card-mtp";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-internal-codec-pm660a-cdp.dts b/arch/arm64/boot/dts/qcom/sdm630-internal-codec-pm660a-cdp.dts
new file mode 100644
index 000000000000..c4e71835b701
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-internal-codec-pm660a-cdp.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660A Int. Audio Codec CDP";
+	compatible = "qcom,sdm630-cdp", "qcom,sdm630", "qcom,cdp";
+	qcom,board-id = <1 1>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-internal-codec-pm660a-mtp.dts b/arch/arm64/boot/dts/qcom/sdm630-internal-codec-pm660a-mtp.dts
new file mode 100644
index 000000000000..e11cdfbed668
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-internal-codec-pm660a-mtp.dts
@@ -0,0 +1,30 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-mtp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660A Int. Audio Codec MTP";
+	compatible = "qcom,sdm630-mtp", "qcom,sdm630", "qcom,mtp";
+	qcom,board-id = <8 1>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&int_codec {
+	qcom,model = "sdm660-snd-card-mtp";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-internal-codec-pm660a-rcm.dts b/arch/arm64/boot/dts/qcom/sdm630-internal-codec-pm660a-rcm.dts
new file mode 100644
index 000000000000..4cb49ce12969
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-internal-codec-pm660a-rcm.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660A Int. Audio Codec RCM";
+	compatible = "qcom,sdm630-cdp", "qcom,sdm630", "qcom,cdp";
+	qcom,board-id = <21 1>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-internal-codec-rcm.dts b/arch/arm64/boot/dts/qcom/sdm630-internal-codec-rcm.dts
new file mode 100644
index 000000000000..ee03652c394d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-internal-codec-rcm.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-cdp.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660L Int. Audio Codec RCM";
+	compatible = "qcom,sdm630-cdp", "qcom,sdm630", "qcom,cdp";
+	qcom,board-id = <21 1>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-ion.dtsi b/arch/arm64/boot/dts/qcom/sdm630-ion.dtsi
new file mode 100644
index 000000000000..00b9e61d01b8
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-ion.dtsi
@@ -0,0 +1,47 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	qcom,ion {
+		compatible = "qcom,msm-ion";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		system_heap: qcom,ion-heap@25 {
+			reg = <25>;
+			qcom,ion-heap-type = "SYSTEM";
+		};
+
+		qcom,ion-heap@22 { /* ADSP HEAP */
+			reg = <22>;
+			memory-region = <&adsp_mem>;
+			qcom,ion-heap-type = "DMA";
+		};
+
+		qcom,ion-heap@27 { /* QSEECOM HEAP */
+			reg = <27>;
+			memory-region = <&qseecom_mem>;
+			qcom,ion-heap-type = "DMA";
+		};
+
+		qcom,ion-heap@10 { /* SECURE DISPLAY HEAP */
+			reg = <10>;
+			memory-region = <&secure_display_memory>;
+			qcom,ion-heap-type = "HYP_CMA";
+		};
+
+		qcom,ion-heap@9 {
+			reg = <9>;
+			qcom,ion-heap-type = "SYSTEM_SECURE";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-mdss-panels.dtsi b/arch/arm64/boot/dts/qcom/sdm630-mdss-panels.dtsi
new file mode 100644
index 000000000000..4e3ebd445814
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-mdss-panels.dtsi
@@ -0,0 +1,245 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "dsi-panel-sim-video.dtsi"
+#include "dsi-panel-nt35695b-truly-fhd-video.dtsi"
+#include "dsi-panel-nt35695b-truly-fhd-cmd.dtsi"
+#include "dsi-panel-truly-1080p-cmd.dtsi"
+#include "dsi-panel-truly-1080p-video.dtsi"
+#include "dsi-panel-rm67195-amoled-fhd-cmd.dtsi"
+#include "dsi-panel-sharp-split-link-wuxga-video.dtsi"
+
+&soc {
+	dsi_panel_pwr_supply: dsi_panel_pwr_supply {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "wqhd-vddio";
+			qcom,supply-min-voltage = <1800000>;
+			qcom,supply-max-voltage = <1950000>;
+			qcom,supply-enable-load = <32000>;
+			qcom,supply-disable-load = <80>;
+		};
+
+		qcom,panel-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "lab";
+			qcom,supply-min-voltage = <4600000>;
+			qcom,supply-max-voltage = <6000000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+
+		qcom,panel-supply-entry@2 {
+			reg = <2>;
+			qcom,supply-name = "ibb";
+			qcom,supply-min-voltage = <4600000>;
+			qcom,supply-max-voltage = <6000000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+			qcom,supply-post-on-sleep = <10>;
+		};
+	};
+
+	dsi_panel_split_link_pwr_supply: dsi_panel_split_link_pwr_supply {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "wqhd-vddio";
+			qcom,supply-min-voltage = <1800000>;
+			qcom,supply-max-voltage = <1950000>;
+			qcom,supply-enable-load = <32000>;
+			qcom,supply-disable-load = <80>;
+		};
+
+		qcom,panel-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "vdda-3p3";
+			qcom,supply-min-voltage = <3300000>;
+			qcom,supply-max-voltage = <3300000>;
+			qcom,supply-enable-load = <13900>;
+			qcom,supply-disable-load = <100>;
+		};
+
+		qcom,panel-supply-entry@2 {
+			reg = <2>;
+			qcom,supply-name = "lab";
+			qcom,supply-min-voltage = <5500000>;
+			qcom,supply-max-voltage = <6000000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+
+		qcom,panel-supply-entry@3 {
+			reg = <3>;
+			qcom,supply-name = "ibb";
+			qcom,supply-min-voltage = <5500000>;
+			qcom,supply-max-voltage = <6000000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+			qcom,supply-post-on-sleep = <10>;
+		};
+	};
+
+	dsi_panel_pwr_supply_labibb_amoled:
+			dsi_panel_pwr_supply_labibb_amoled {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "wqhd-vddio";
+			qcom,supply-min-voltage = <1800000>;
+			qcom,supply-max-voltage = <1950000>;
+			qcom,supply-enable-load = <32000>;
+			qcom,supply-disable-load = <80>;
+		};
+
+		qcom,panel-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "vdda-3p3";
+			qcom,supply-min-voltage = <3300000>;
+			qcom,supply-max-voltage = <3300000>;
+			qcom,supply-enable-load = <13200>;
+			qcom,supply-disable-load = <80>;
+		};
+
+		qcom,panel-supply-entry@2 {
+			reg = <2>;
+			qcom,supply-name = "lab";
+			qcom,supply-min-voltage = <4600000>;
+			qcom,supply-max-voltage = <6100000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+
+		qcom,panel-supply-entry@3 {
+			reg = <3>;
+			qcom,supply-name = "ibb";
+			qcom,supply-min-voltage = <4000000>;
+			qcom,supply-max-voltage = <6300000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+
+		qcom,panel-supply-entry@4 {
+			reg = <4>;
+			qcom,supply-name = "oledb";
+			qcom,supply-min-voltage = <5000000>;
+			qcom,supply-max-voltage = <8100000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+	};
+};
+
+&dsi_nt35695b_truly_fhd_video {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [24 1e 08 09 05 03 04 a0
+		24 1e 08 09 05 03 04 a0
+		24 1e 08 09 05 03 04 a0
+		24 1e 08 09 05 03 04 a0
+		24 1a 08 09 05 03 04 a0];
+	qcom,mdss-dsi-min-refresh-rate = <48>;
+	qcom,mdss-dsi-max-refresh-rate = <60>;
+	qcom,mdss-dsi-pan-enable-dynamic-fps;
+	qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x9c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x9c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-panel-max-error-count = <3>;
+
+};
+
+&dsi_nt35695b_truly_fhd_cmd {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [24 1e 08 09 05 03 04 a0
+		24 1e 08 09 05 03 04 a0
+		24 1e 08 09 05 03 04 a0
+		24 1e 08 09 05 03 04 a0
+		24 1a 08 09 05 03 04 a0];
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x9c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x9c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-panel-max-error-count = <3>;
+
+};
+
+&dsi_truly_1080_vid {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [23 1e 08 09 05 03 04 a0
+		23 1e 08 09 05 03 04 a0
+		23 1e 08 09 05 03 04 a0
+		23 1e 08 09 05 03 04 a0
+		23 1a 08 09 05 03 04 a0];
+	qcom,mdss-dsi-min-refresh-rate = <48>;
+	qcom,mdss-dsi-max-refresh-rate = <60>;
+	qcom,mdss-dsi-pan-enable-dynamic-fps;
+	qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x1c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x1c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-panel-max-error-count = <3>;
+
+};
+
+&dsi_truly_1080_cmd {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [23 1e 08 09 05 03 04 a0
+		23 1e 08 09 05 03 04 a0
+		23 1e 08 09 05 03 04 a0
+		23 1e 08 09 05 03 04 a0
+		23 1a 08 09 05 03 04 a0];
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x1c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x1c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-panel-max-error-count = <3>;
+
+};
+
+&dsi_rm67195_amoled_fhd_cmd {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [24 1f 08 09 05 03 04 a0
+		24 1f 08 09 05 03 04 a0
+		24 1f 08 09 05 03 04 a0
+		24 1f 08 09 05 03 04 a0
+		24 1a 08 09 05 03 04 a0];
+	qcom,mdss-dsi-t-clk-post = <0x0d>;
+	qcom,mdss-dsi-t-clk-pre = <0x2f>;
+};
+
+&dsi_sharp_split_link_wuxga_video {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [25 1f 09 0a 06 03 04 a0
+		25 1f 09 0a 06 03 04 a0
+		25 1f 09 0a 06 03 04 a0
+		25 1f 09 0a 06 03 04 a0
+		25 1f 08 0a 06 03 04 a0];
+	qcom,mdss-dsi-min-refresh-rate = <48>;
+	qcom,mdss-dsi-max-refresh-rate = <60>;
+	qcom,mdss-dsi-pan-enable-dynamic-fps;
+	qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-mdss-pll.dtsi b/arch/arm64/boot/dts/qcom/sdm630-mdss-pll.dtsi
new file mode 100644
index 000000000000..42eac0ab223a
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-mdss-pll.dtsi
@@ -0,0 +1,82 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	mdss_dsi0_pll: qcom,mdss_dsi_pll@c994400 {
+		compatible = "qcom,mdss_dsi_pll_sdm630";
+		status = "ok";
+		label = "MDSS DSI 0 PLL";
+		cell-index = <0>;
+		#clock-cells = <1>;
+
+		reg = <0xc994400 0x588>,
+		      <0xc8c2300 0x8>;
+		reg-names = "pll_base", "gdsc_base";
+
+		gdsc-supply = <&gdsc_mdss>;
+
+		clocks = <&clock_mmss MMSS_MDSS_AHB_CLK>;
+		clock-names = "iface_clk";
+		clock-rate = <0>;
+		qcom,dsi-pll-ssc-en;
+		qcom,dsi-pll-ssc-mode = "down-spread";
+
+		qcom,platform-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,platform-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+	};
+
+	mdss_dp_pll: qcom,mdss_dp_pll@c011000 {
+		compatible = "qcom,mdss_dp_pll_sdm630";
+		status = "ok";
+		label = "MDSS DP PLL";
+		cell-index = <0>;
+		#clock-cells = <1>;
+
+		reg = <0xc011c00 0x190>,
+		      <0xc011000 0x910>,
+		      <0x0c8c2300 0x8>;
+		reg-names = "pll_base", "phy_base", "gdsc_base";
+
+		gdsc-supply = <&gdsc_mdss>;
+
+		clocks = <&clock_mmss MMSS_MDSS_AHB_CLK>,
+			 <&clock_rpmcc RPM_LN_BB_CLK1>,
+			 <&clock_gcc GCC_USB3_CLKREF_CLK>;
+		clock-names = "iface_clk", "ref_clk_src", "ref_clk";
+		clock-rate = <0>;
+
+		qcom,platform-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,platform-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-mdss.dtsi b/arch/arm64/boot/dts/qcom/sdm630-mdss.dtsi
new file mode 100644
index 000000000000..d7fef426d4b6
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-mdss.dtsi
@@ -0,0 +1,557 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/clock/mdss-pll-clk.h>
+
+&soc {
+	mdss_mdp: qcom,mdss_mdp@c900000 {
+		compatible = "qcom,mdss_mdp";
+		status = "ok";
+		reg = <0x0c900000 0x90000>,
+		      <0x0c9b0000 0x1040>;
+		reg-names = "mdp_phys", "vbif_phys";
+		interrupts = <0 83 0>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		vdd-supply = <&gdsc_mdss>;
+
+		/* Bus Scale Settings */
+		qcom,msm-bus,name = "mdss_mdp";
+		qcom,msm-bus,num-cases = <3>;
+		qcom,msm-bus,num-paths = <2>;
+		qcom,msm-bus,vectors-KBps =
+			<22 512 0 0>, <23 512 0 0>,
+			<22 512 0 6400000>, <23 512 0 6400000>,
+			<22 512 0 6400000>, <23 512 0 6400000>;
+
+		/* Fudge factors */
+		qcom,mdss-ab-factor = <1 1>;		/* 1 time  */
+		qcom,mdss-ib-factor = <1 1>;		/* 1 time  */
+		qcom,mdss-clk-factor = <105 100>;	/* 1.05 times */
+
+		qcom,max-mixer-width = <2048>;
+		qcom,max-pipe-width = <2048>;
+
+		qcom,max-dest-scaler-input-width = <2048>;
+		qcom,max-dest-scaler-output-width = <2560>;
+
+		/* VBIF QoS remapper settings*/
+		qcom,mdss-vbif-qos-rt-setting = <1 2 2 2>;
+		qcom,mdss-vbif-qos-nrt-setting = <1 1 1 1>;
+		qcom,vbif-settings = <0x00ac 0x00008040>,
+				     <0x00d0 0x00002828>;
+
+		qcom,mdss-has-panic-ctrl;
+		qcom,mdss-per-pipe-panic-luts = <0x000f>,
+						<0xffff>,
+						<0xfffc>,
+						<0xff00>;
+
+		qcom,mdss-mdp-reg-offset = <0x00001000>;
+		qcom,max-bandwidth-low-kbps = <4100000>;
+		qcom,max-bandwidth-high-kbps = <4100000>;
+		qcom,max-bandwidth-per-pipe-kbps = <1 3200000>, /* Default */
+						   <2 2400000>; /* Camera */
+		qcom,max-clk-rate = <412500000>;
+		qcom,mdss-default-ot-rd-limit = <32>;
+		qcom,mdss-default-ot-wr-limit = <32>;
+		qcom,mdss-dram-channels = <2>;
+
+		/* Bandwidth limit settings */
+		qcom,max-bw-settings = <1 4100000>, /* Default */
+				       <2 3000000>; /* Camera */
+
+		qcom,mdss-pipe-vig-off = <0x00005000>;
+		qcom,mdss-pipe-dma-off = <0x00025000 0x00027000 0x00029000>;
+		qcom,mdss-pipe-cursor-off = <0x00035000>;
+
+		qcom,mdss-pipe-vig-xin-id = <0>;
+		qcom,mdss-pipe-dma-xin-id = <1 5 9>;
+		qcom,mdss-pipe-cursor-xin-id = <2>;
+
+		/*
+		 * These Offsets are relative to
+		 * "mdp_phys + mdp-reg-offset" address
+		 */
+		qcom,mdss-pipe-vig-clk-ctrl-offsets = <0x2ac 0 0>;
+		qcom,mdss-pipe-dma-clk-ctrl-offsets = <0x2ac  8 12>,
+						      <0x2b4  8 12>,
+						      <0x2c4  8 12>;
+		qcom,mdss-pipe-cursor-clk-ctrl-offsets = <0x3a8 16 15>;
+
+		qcom,mdss-ctl-off = <0x00002000 0x00002200 0x00002400
+				     0x00002600 0x00002800>;
+		qcom,mdss-mixer-intf-off = <0x00045000 0x00047000>;
+		qcom,mdss-dspp-off = <0x00055000>;
+		qcom,mdss-wb-off = <0x00066000>;
+		qcom,mdss-intf-off = <0x0006b000 0x0006b800>;
+		qcom,mdss-pingpong-off = <0x00071000 0x00072000>;
+		qcom,mdss-slave-pingpong-off = <0x00073000>;
+		qcom,mdss-ppb-ctl-off = <0x00000330 0x00000338 0x00000370
+			0x00000374> ;
+		qcom,mdss-ppb-cfg-off = <0x00000334 0x0000033C>;
+		qcom,mdss-has-pingpong-split;
+		qcom,mdss-has-separate-rotator;
+
+		qcom,mdss-ad-off = <0x0079000 0x00079800>;
+		qcom,mdss-cdm-off = <0x0007a200>;
+		qcom,mdss-wfd-mode = "intf";
+		qcom,mdss-has-source-split;
+		qcom,mdss-highest-bank-bit = <0x1>;
+		qcom,mdss-has-decimation;
+		qcom,mdss-idle-power-collapse-enabled;
+		clocks = <&clock_mmss MMSS_MNOC_AHB_CLK>,
+			 <&clock_mmss MMSS_MDSS_AHB_CLK>,
+			 <&clock_mmss MMSS_MDSS_AXI_CLK>,
+			 <&clock_mmss MMSS_THROTTLE_MDSS_AXI_CLK>,
+			 <&clock_mmss MDP_CLK_SRC>,
+			 <&clock_mmss MMSS_MDSS_MDP_CLK>,
+			 <&clock_mmss MMSS_MDSS_VSYNC_CLK>,
+			 <&clock_mmss MDP_CLK_SRC>;
+		clock-names = "mnoc_clk", "iface_clk", "bus_clk",
+				"throttle_bus_clk", "core_clk_src",
+				"core_clk", "vsync_clk", "lut_clk";
+
+		qcom,mdp-settings = <0x01190 0x00000000>,
+				    <0x012ac 0xc0000ccc>,
+				    <0x012b4 0xc0000ccc>,
+				    <0x012bc 0x00cccccc>,
+				    <0x012c4 0x0000cccc>,
+				    <0x013a8 0x0cccc0c0>,
+				    <0x013b0 0xccccc0c0>,
+				    <0x013b8 0xcccc0000>,
+				    <0x013d0 0x00cc0000>,
+				    <0x0506c 0x00000000>,
+				    <0x0706c 0x00000000>,
+				    <0x0906c 0x00000000>,
+				    <0x0b06c 0x00000000>,
+				    <0x1506c 0x00000000>,
+				    <0x1706c 0x00000000>,
+				    <0x1906c 0x00000000>,
+				    <0x1b06c 0x00000000>,
+				    <0x2506c 0x00000000>,
+				    <0x2706c 0x00000000>;
+
+		qcom,regs-dump-mdp = <0x01000 0x01458>,
+				     <0x02000 0x02094>,
+				     <0x02200 0x02294>,
+				     <0x02400 0x02494>,
+				     <0x02600 0x02694>,
+				     <0x02800 0x02894>,
+				     <0x05000 0x05154>,
+				     <0x05a00 0x05b00>,
+				     <0x25000 0x25184>,
+				     <0x27000 0x27184>,
+				     <0x29000 0x29184>,
+				     <0x35000 0x35150>,
+				     <0x45000 0x452bc>,
+				     <0x47000 0x472bc>,
+				     <0x55000 0x5522c>,
+				     <0x66000 0x662c0>,
+				     <0x6b000 0x6b268>,
+				     <0x6b800 0x6ba68>,
+				     <0x71000 0x710d4>,
+				     <0x72000 0x720d4>;
+
+		qcom,regs-dump-names-mdp = "MDP",
+			"CTL_0",    "CTL_1", "CTL_2",   "CTL_3", "CTL_4",
+			"VIG0_SSPP", "VIG0",
+			"DMA0_SSPP", "DMA1_SSPP","DMA2_SSPP",
+			"CURSOR0_SSPP",
+			"LAYER_0", "LAYER_2",
+			"DSPP_0",
+			"WB_2",
+			"INTF_0", "INTF_1",
+			"PP_0",    "PP_2";
+
+		/* buffer parameters to calculate prefill bandwidth */
+		qcom,mdss-prefill-outstanding-buffer-bytes = <0>;
+		qcom,mdss-prefill-y-buffer-bytes = <0>;
+		qcom,mdss-prefill-scaler-buffer-lines-bilinear = <2>;
+		qcom,mdss-prefill-scaler-buffer-lines-caf = <4>;
+		qcom,mdss-prefill-post-scaler-buffer-pixels = <2560>;
+		qcom,mdss-prefill-pingpong-buffer-pixels = <5120>;
+
+		qcom,mdss-reg-bus {
+			/* Reg Bus Scale Settings */
+			qcom,msm-bus,name = "mdss_reg";
+			qcom,msm-bus,num-cases = <4>;
+			qcom,msm-bus,num-paths = <1>;
+			qcom,msm-bus,active-only;
+			qcom,msm-bus,vectors-KBps =
+				<1 590 0 0>,
+				<1 590 0 76800>,
+				<1 590 0 160000>,
+				<1 590 0 320000>;
+		};
+
+		qcom,mdss-pp-offsets {
+			qcom,mdss-sspp-mdss-igc-lut-off = <0x2000>;
+			qcom,mdss-sspp-vig-pcc-off = <0x1b00>;
+			qcom,mdss-sspp-rgb-pcc-off = <0x380>;
+			qcom,mdss-sspp-dma-pcc-off = <0x380>;
+			qcom,mdss-lm-pgc-off = <0x3c0>;
+			qcom,mdss-dspp-gamut-off = <0x1600>;
+			qcom,mdss-dspp-pcc-off = <0x1700>;
+			qcom,mdss-dspp-pgc-off = <0x17c0>;
+		};
+
+		qcom,mdss-scaler-offsets {
+			qcom,mdss-vig-scaler-off = <0xa00>;
+			qcom,mdss-vig-scaler-lut-off = <0xb00>;
+			qcom,mdss-has-dest-scaler;
+			qcom,mdss-dest-block-off = <0x00061000>;
+			qcom,mdss-dest-scaler-off = <0x800 0x1000>;
+			qcom,mdss-dest-scaler-lut-off = <0x900 0x1100>;
+		};
+
+		smmu_mdp_unsec: qcom,smmu_mdp_unsec_cb {
+			compatible = "qcom,smmu_mdp_unsec";
+			iommus = <&mmss_bimc_smmu 0>;
+			gdsc-mmagic-mdss-supply = <&gdsc_bimc_smmu>;
+			clocks = <&clock_rpmcc  MMSSNOC_AXI_CLK>,
+				<&clock_mmss MMSS_MNOC_AHB_CLK>,
+				<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+				<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>;
+			clock-names = "mmss_noc_axi_clk",
+					"mmss_noc_ahb_clk",
+					"mmss_smmu_ahb_clk",
+					"mmss_smmu_axi_clk";
+		};
+
+		smmu_mdp_sec: qcom,smmu_mdp_sec_cb {
+			compatible = "qcom,smmu_mdp_sec";
+			iommus = <&mmss_bimc_smmu 1>;
+			gdsc-mmagic-mdss-supply = <&gdsc_bimc_smmu>;
+			clocks = <&clock_rpmcc  MMSSNOC_AXI_CLK>,
+				<&clock_mmss MMSS_MNOC_AHB_CLK>,
+				<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+				<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>;
+			clock-names = "mmss_noc_axi_clk",
+					"mmss_noc_ahb_clk",
+					"mmss_smmu_ahb_clk",
+					"mmss_smmu_axi_clk";
+		};
+
+		mdss_fb0: qcom,mdss_fb_primary {
+			cell-index = <0>;
+			compatible = "qcom,mdss-fb";
+			qcom,cont-splash-memory {
+				linux,contiguous-region = <&cont_splash_mem>;
+			};
+		};
+
+		mdss_fb1: qcom,mdss_fb_wfd {
+			cell-index = <1>;
+			compatible = "qcom,mdss-fb";
+		};
+
+		mdss_fb2: qcom,mdss_fb_dp {
+			cell-index = <2>;
+			compatible = "qcom,mdss-fb";
+			qcom,mdss-intf = <&mdss_dp_ctrl>;
+		};
+	};
+
+	mdss_dsi: qcom,mdss_dsi@0 {
+		compatible = "qcom,mdss-dsi";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		gdsc-supply = <&gdsc_mdss>;
+		vdda-1p2-supply = <&pm660_l1>;
+		vdda-0p9-supply = <&pm660l_l1>;
+		ranges = <0xc994000 0xc994000 0x400
+			0xc994400 0xc994400 0x588
+			0xc828000 0xc828000 0xac>;
+
+		/* Bus Scale Settings */
+		qcom,msm-bus,name = "mdss_dsi";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<22 512 0 0>,
+			<22 512 0 1000>;
+
+		qcom,mmss-ulp-clamp-ctrl-offset = <0x14>;
+
+		clocks = <&clock_mmss MMSS_MDSS_MDP_CLK>,
+			 <&clock_mmss MMSS_MNOC_AHB_CLK>,
+			 <&clock_mmss MMSS_MDSS_AHB_CLK>,
+			 <&clock_mmss MMSS_MDSS_AXI_CLK>,
+			 <&clock_mmss MMSS_MISC_AHB_CLK>,
+			 <&mdss_dsi0_pll BYTE0_MUX_CLK>,
+			 <&mdss_dsi0_pll PIX0_MUX_CLK>;
+		clock-names = "mdp_core_clk",
+			"mnoc_clk", "iface_clk",
+			"bus_clk", "core_mmss_clk",
+			"ext_byte0_clk","ext_pixel0_clk";
+
+		qcom,core-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,core-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+
+		qcom,ctrl-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,ctrl-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vdda-1p2";
+				qcom,supply-min-voltage = <1200000>;
+				qcom,supply-max-voltage = <1250000>;
+				qcom,supply-enable-load = <12560>;
+				qcom,supply-disable-load = <4>;
+			};
+		};
+
+		qcom,phy-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,phy-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vdda-0p9";
+				qcom,supply-min-voltage = <880000>;
+				qcom,supply-max-voltage = <925000>;
+				qcom,supply-enable-load = <73400>;
+				qcom,supply-disable-load = <32>;
+			};
+		};
+
+		mdss_dsi0: qcom,mdss_dsi_ctrl0@c994000 {
+			compatible = "qcom,mdss-dsi-ctrl";
+			label = "MDSS DSI CTRL->0";
+			cell-index = <0>;
+			reg = <0xc994000 0x400>,
+			      <0xc994400 0x588>,
+			      <0xc828000 0xac>;
+			reg-names = "dsi_ctrl", "dsi_phy", "mmss_misc_phys";
+
+			qcom,timing-db-mode;
+			wqhd-vddio-supply = <&pm660_l11>;
+			vdda-3p3-supply = <&pm660l_l6>;
+			lab-supply = <&lcdb_ldo_vreg>;
+			ibb-supply = <&lcdb_ncp_vreg>;
+			qcom,mdss-mdp = <&mdss_mdp>;
+			qcom,mdss-fb-map = <&mdss_fb0>;
+
+			clocks = <&clock_mmss MMSS_MDSS_BYTE0_CLK>,
+				 <&clock_mmss MMSS_MDSS_PCLK0_CLK>,
+				 <&clock_mmss MMSS_MDSS_ESC0_CLK>,
+				 <&clock_mmss BYTE0_CLK_SRC>,
+				 <&clock_mmss PCLK0_CLK_SRC>,
+				 <&clock_mmss MMSS_MDSS_BYTE0_INTF_CLK>;
+			clock-names = "byte_clk", "pixel_clk", "core_clk",
+				"byte_clk_rcg", "pixel_clk_rcg",
+				"byte_intf_clk";
+
+			qcom,platform-strength-ctrl = [ff 06
+							ff 06
+							ff 06
+							ff 06
+							ff 00];
+			qcom,platform-regulator-settings = [1d
+							1d 1d 1d 1d];
+			qcom,platform-lane-config = [00 00 10 0f
+						00 00 10 0f
+						00 00 10 0f
+						00 00 10 0f
+						00 00 10 8f];
+		};
+	};
+
+	qcom,mdss_wb_panel {
+		compatible = "qcom,mdss_wb";
+		qcom,mdss_pan_res = <640 480>;
+		qcom,mdss_pan_bpp = <24>;
+		qcom,mdss-fb-map = <&mdss_fb1>;
+	};
+
+	msm_ext_disp: qcom,msm_ext_disp {
+		status = "ok";
+		compatible = "qcom,msm-ext-disp";
+
+		ext_disp_audio_codec: qcom,msm-ext-disp-audio-codec-rx {
+			compatible = "qcom,msm-ext-disp-audio-codec-rx";
+			qcom,msm_ext_disp = <&msm_ext_disp>;
+		};
+	};
+
+	mdss_dp_ctrl: qcom,dp_ctrl@c990000 {
+		status = "ok";
+		cell-index = <0>;
+		compatible = "qcom,mdss-dp";
+		qcom,mdss-fb-map = <&mdss_fb2>;
+
+		gdsc-supply = <&gdsc_mdss>;
+		vdda-1p8-supply = <&pm660_l10>;
+		vdda-0p9-supply = <&pm660l_l1>;
+
+		reg =	<0xc990000 0xa84>,
+			<0xc011000 0x910>,
+			<0x1fcb200 0x050>,
+			<0xc8c2200 0x1a0>,
+			<0x780000 0x621c>,
+			<0xc9e1000 0x02c>;
+		reg-names = "dp_ctrl", "dp_phy", "tcsr_regs", "dp_mmss_cc",
+				"qfprom_physical","hdcp_physical";
+
+		clocks = <&clock_mmss MMSS_MNOC_AHB_CLK>,
+			 <&clock_mmss MMSS_MDSS_AHB_CLK>,
+			 <&clock_mmss MMSS_MDSS_AXI_CLK>,
+			 <&clock_mmss MMSS_MDSS_MDP_CLK>,
+			 <&clock_mmss MMSS_MDSS_HDMI_DP_AHB_CLK>,
+			 <&clock_mmss MMSS_MDSS_DP_AUX_CLK>,
+			 <&clock_rpmcc RPM_LN_BB_CLK1>,
+			 <&clock_gcc GCC_USB3_CLKREF_CLK>,
+			 <&clock_gcc GCC_USB_PHY_CFG_AHB2PHY_CLK>,
+			 <&clock_mmss MMSS_MDSS_DP_LINK_CLK>,
+			 <&clock_mmss MMSS_MDSS_DP_LINK_INTF_CLK>,
+			 <&clock_mmss MMSS_MDSS_DP_CRYPTO_CLK>,
+			 <&clock_mmss MMSS_MDSS_DP_PIXEL_CLK>,
+			 <&clock_mmss DP_PIXEL_CLK_SRC>,
+			 <&mdss_dp_pll DP_VCO_DIVIDED_CLK_SRC_MUX>;
+		clock-names = "core_mnoc_clk", "core_iface_clk", "core_bus_clk",
+			"core_mdp_core_clk", "core_alt_iface_clk",
+			"core_aux_clk", "core_ref_clk_src", "core_ref_clk",
+			"core_ahb_phy_clk", "ctrl_link_clk",
+			"ctrl_link_iface_clk", "ctrl_crypto_clk",
+			"ctrl_pixel_clk", "pixel_clk_rcg", "pixel_parent";
+
+		qcom,dp-usbpd-detection = <&pm660_pdphy>;
+
+		qcom,msm_ext_disp = <&msm_ext_disp>;
+
+		qcom,aux-cfg0-settings = [20 00];
+		qcom,aux-cfg1-settings = [24 13 23 1d];
+		qcom,aux-cfg2-settings = [28 00];
+		qcom,aux-cfg3-settings = [2c 00];
+		qcom,aux-cfg4-settings = [30 0a];
+		qcom,aux-cfg5-settings = [34 28];
+		qcom,aux-cfg6-settings = [38 0a];
+		qcom,aux-cfg7-settings = [3c 03];
+		qcom,aux-cfg8-settings = [40 b7];
+		qcom,aux-cfg9-settings = [44 03];
+		qcom,logical2physical-lane-map = [00 01 02 03];
+		qcom,phy-register-offset = <0x4>;
+		qcom,max-pclk-frequency-khz = <150000>;
+
+		qcom,core-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,core-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+
+		qcom,ctrl-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,ctrl-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vdda-1p8";
+				qcom,supply-min-voltage = <1780000>;
+				qcom,supply-max-voltage = <1950000>;
+				qcom,supply-enable-load = <12560>;
+				qcom,supply-disable-load = <4>;
+			};
+		};
+
+		qcom,phy-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,phy-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vdda-0p9";
+				qcom,supply-min-voltage = <880000>;
+				qcom,supply-max-voltage = <925000>;
+				qcom,supply-enable-load = <73400>;
+				qcom,supply-disable-load = <32>;
+			};
+		};
+	};
+
+	mdss_rotator: qcom,mdss_rotator {
+		compatible = "qcom,sde_rotator";
+		reg = <0x0c900000 0xab100>,
+		      <0x0c9b0000 0x1040>;
+		reg-names = "mdp_phys",
+			"rot_vbif_phys";
+
+		qcom,mdss-rot-mode = <1>;
+		qcom,mdss-highest-bank-bit = <0x1>;
+
+		/* Bus Scale Settings */
+		qcom,msm-bus,name = "mdss_rotator";
+		qcom,msm-bus,num-cases = <3>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<22 512 0 0>,
+			<22 512 0 6400000>,
+			<22 512 0 6400000>;
+
+		rot-vdd-supply = <&gdsc_mdss>;
+		qcom,supply-names = "rot-vdd";
+
+		clocks = <&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_MDSS_AHB_CLK>,
+			<&clock_mmss ROT_CLK_SRC>,
+			<&clock_mmss MMSS_MDSS_ROT_CLK>,
+			<&clock_mmss MMSS_MDSS_AXI_CLK>;
+		clock-names = "mnoc_clk",
+			"iface_clk", "rot_core_clk",
+			"rot_clk", "axi_clk";
+
+		interrupt-parent = <&mdss_mdp>;
+		interrupts = <2 0>;
+
+		/* VBIF QoS remapper settings*/
+		qcom,mdss-rot-vbif-qos-setting = <1 1 1 1>;
+		qcom,mdss-rot-xin-id = <14 15>;
+
+		qcom,mdss-default-ot-rd-limit = <32>;
+		qcom,mdss-default-ot-wr-limit = <32>;
+
+		qcom,sde-reg-bus {
+			/* Reg Bus Scale Settings */
+			qcom,msm-bus,name = "mdss_rot_reg";
+			qcom,msm-bus,num-cases = <4>;
+			qcom,msm-bus,num-paths = <1>;
+			qcom,msm-bus,active-only;
+			qcom,msm-bus,vectors-KBps =
+				<1 590 0 0>,
+				<1 590 0 76800>,
+				<1 590 0 160000>,
+				<1 590 0 320000>;
+		};
+	};
+};
+
+#include "sdm630-mdss-panels.dtsi"
diff --git a/arch/arm64/boot/dts/qcom/sdm630-mtp.dts b/arch/arm64/boot/dts/qcom/sdm630-mtp.dts
new file mode 100644
index 000000000000..b1a9bb86149d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-mtp.dts
@@ -0,0 +1,30 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-mtp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660L MTP";
+	compatible = "qcom,sdm630-mtp", "qcom,sdm630", "qcom,mtp";
+	qcom,board-id = <8 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-moist-cfg = <0>, <0>, <3>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-mtp.dtsi b/arch/arm64/boot/dts/qcom/sdm630-mtp.dtsi
new file mode 100644
index 000000000000..bb50f23d8126
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-mtp.dtsi
@@ -0,0 +1,208 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdm660-pinctrl.dtsi"
+#include "sdm630-camera-sensor-mtp.dtsi"
+/ {
+	mtp_batterydata: qcom,battery-data {
+		qcom,batt-id-range-pct = <15>;
+		#include "fg-gen3-batterydata-itech-3000mah.dtsi"
+		#include "fg-gen3-batterydata-ascent-3450mah.dtsi"
+	};
+};
+
+&uartblsp1dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm660l_l1>;
+	vdda-pll-supply = <&pm660_l10>;
+	vddp-ref-clk-supply = <&pm660_l1>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14200>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm660l_l4>;
+	vccq2-supply = <&pm660_l8>;
+	vcc-max-microamp = <500000>;
+	vccq2-max-microamp = <600000>;
+	status = "ok";
+};
+
+&pm660_gpios {
+	/* GPIO 4 (NFC_CLK_REQ) */
+	gpio@c300 {
+		qcom,mode = <0>;
+		qcom,vin-sel = <1>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&i2c_6 { /* BLSP1 QUP6 (NFC) */
+	status = "okay";
+	nq@28 {
+		compatible = "qcom,nq-nci";
+		reg = <0x28>;
+		qcom,nq-irq = <&tlmm 28 0x00>;
+		qcom,nq-ven = <&tlmm 29 0x00>;
+		qcom,nq-firm = <&tlmm 30 0x00>;
+		qcom,nq-clkreq = <&pm660_gpios 4 0x00>;
+		qcom,nq-esepwr = <&tlmm 31 0x00>;
+		interrupt-parent = <&tlmm>;
+		qcom,clk-src = "BBCLK3";
+		interrupts = <28 0>;
+		interrupt-names = "nfc_irq";
+		pinctrl-names = "nfc_active", "nfc_suspend";
+		pinctrl-0 = <&nfc_int_active &nfc_enable_active>;
+		pinctrl-1 = <&nfc_int_suspend &nfc_enable_suspend>;
+		clocks = <&clock_rpmcc RPM_LN_BB_CLK3_PIN>;
+		clock-names = "ref_clk";
+	};
+};
+
+&mem_client_3_size {
+	qcom,peripheral-size = <0x500000>;
+};
+
+&pm660l_wled {
+	qcom,led-strings-list = [01 02];
+};
+
+&soc {
+	qcom,msm-ssc-sensors {
+		compatible = "qcom,msm-ssc-sensors";
+	};
+};
+
+&pm660_fg {
+	qcom,battery-data = <&mtp_batterydata>;
+};
+
+&sdhc_1 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l4>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660_l8>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-lpm-sup;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <110 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	status = "ok";
+};
+
+&sdhc_2 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l5>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <15000 800000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660l_l2>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	#address-cells = <0>;
+	interrupt-parent = <&sdhc_2>;
+	interrupts = <0 1 2>;
+	#interrupt-cells = <1>;
+	interrupt-map-mask = <0xffffffff>;
+	interrupt-map = <0 &intc 0 0 125 0
+			1 &intc 0 0 221 0
+			2 &tlmm 54 0>;
+	interrupt-names = "hc_irq", "pwr_irq", "status_irq";
+	cd-gpios = <&tlmm 54 0x1>;
+
+	status = "ok";
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "single_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_nt35695b_truly_fhd_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 53 0>;
+	qcom,platform-te-gpio = <&tlmm 59 0>;
+};
+
+&mdss_dp_ctrl {
+	pinctrl-names = "mdss_dp_active", "mdss_dp_sleep";
+	pinctrl-0 = <&mdss_dp_aux_active &mdss_dp_usbplug_cc_active>;
+	pinctrl-1 = <&mdss_dp_aux_suspend &mdss_dp_usbplug_cc_suspend>;
+	qcom,aux-en-gpio = <&tlmm 55 0>;
+	qcom,aux-sel-gpio = <&tlmm 56 0>;
+	qcom,usbplug-cc-gpio = <&tlmm 58 0>;
+};
+
+&pm660l_wled {
+	qcom,led-strings-list = [01 02];
+};
+
+&dsi_nt35695b_truly_fhd_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35695b_truly_fhd_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&i2c_2 {
+	status = "ok";
+	smb1351-charger@1d {
+		compatible = "qcom,smb1351-charger";
+		reg = <0x1d>;
+		qcom,parallel-charger;
+		qcom,float-voltage-mv = <4400>;
+		qcom,recharge-mv = <100>;
+		qcom,parallel-en-pin-polarity = <1>;
+	};
+};
+
+&dsi_rm67195_amoled_fhd_cmd {
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_labibb_amoled>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-pm.dtsi b/arch/arm64/boot/dts/qcom/sdm630-pm.dtsi
new file mode 100644
index 000000000000..f39f8b880690
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-pm.dtsi
@@ -0,0 +1,774 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+&soc {
+	qcom,spm@178120000 {
+		compatible = "qcom,spm-v2";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0x17812000 0x1000>;
+		qcom,name = "gold-l2"; /* Gold L2 SAW */
+		qcom,saw2-ver-reg = <0xfd0>;
+		qcom,cpu-vctl-list = <&CPU0 &CPU1 &CPU2 &CPU3>;
+		qcom,vctl-timeout-us = <500>;
+		qcom,vctl-port = <0x0>;
+		qcom,phase-port = <0x1>;
+		qcom,saw2-avs-ctl = <0x1010031>;
+		qcom,saw2-avs-limit = <0x4580458>;
+		qcom,pfm-port = <0x2>;
+	};
+
+	qcom,spm@179120000 {
+		compatible = "qcom,spm-v2";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0x17912000 0x1000>;
+		qcom,name = "silver-l2"; /* Silver L2 SAW */
+		qcom,saw2-ver-reg = <0xfd0>;
+		qcom,cpu-vctl-list = <&CPU4 &CPU5 &CPU6 &CPU7>;
+		qcom,vctl-timeout-us = <500>;
+		qcom,vctl-port = <0x0>;
+		qcom,phase-port = <0x1>;
+		qcom,saw2-avs-ctl = <0x1010031>;
+		qcom,saw2-avs-limit = <0x4580458>;
+		qcom,pfm-port = <0x2>;
+	};
+
+	qcom,lpm-levels {
+		compatible = "qcom,lpm-levels";
+		qcom,use-psci;
+		#address-cells = <1>;
+		#size-cells = <0>;
+		qcom,pm-cluster@0 {
+			reg = <0>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			label = "system";
+			qcom,spm-device-names = "cci";
+			qcom,psci-mode-shift = <8>;
+			qcom,psci-mode-mask = <0xf>;
+
+			qcom,pm-cluster-level@0{
+				reg = <0>;
+				label = "system-active";
+				qcom,psci-mode = <0x0>;
+				qcom,latency-us = <50>;
+				qcom,ss-power = <240>;
+				qcom,energy-overhead = <61750>;
+				qcom,time-overhead = <7870>;
+			};
+
+			qcom,pm-cluster-level@1{ /* E3 */
+				reg = <1>;
+				label = "system-pc";
+				qcom,psci-mode = <0x3>;
+				qcom,latency-us = <4026>;
+				qcom,ss-power = <167>;
+				qcom,energy-overhead = <749982>;
+				qcom,time-overhead = <14773>;
+				qcom,min-child-idx = <3>;
+				qcom,is-reset;
+				qcom,notify-rpm;
+			};
+
+			qcom,pm-cluster@0{
+				reg = <0>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				label = "pwr";
+				qcom,spm-device-names = "l2";
+				qcom,cpu = <&CPU4 &CPU5 &CPU6 &CPU7>;
+				qcom,psci-mode-shift = <4>;
+				qcom,psci-mode-mask = <0xf>;
+
+				qcom,pm-cluster-level@0{ /* D1 */
+					reg = <0>;
+					label = "pwr-l2-active";
+					qcom,psci-mode = <0x1>;
+					qcom,latency-us = <51>;
+					qcom,ss-power = <198>;
+					qcom,energy-overhead = <83852>;
+					qcom,time-overhead = <91>;
+				};
+				qcom,pm-cluster-level@1{ /* D2D */
+					reg = <1>;
+					label = "pwr-l2-dynret";
+					qcom,psci-mode = <0x2>;
+					qcom,latency-us = <384>;
+					qcom,ss-power = <197>;
+					qcom,energy-overhead = <198413>;
+					qcom,time-overhead = <668>;
+					qcom,min-child-idx = <1>;
+				};
+
+				qcom,pm-cluster-level@2{ /* D2E */
+					reg = <2>;
+					label = "pwr-l2-ret";
+					qcom,psci-mode = <0x3>;
+					qcom,latency-us = <423>;
+					qcom,ss-power = <193>;
+					qcom,energy-overhead = <218055>;
+					qcom,time-overhead = <761>;
+					qcom,min-child-idx = <2>;
+				};
+
+				qcom,pm-cluster-level@3{ /* D4 */
+					reg = <3>;
+					label = "pwr-l2-pc";
+					qcom,psci-mode = <0x4>;
+					qcom,latency-us = <1821>;
+					qcom,ss-power = <184>;
+					qcom,energy-overhead = <558835>;
+					qcom,time-overhead = <2336>;
+					qcom,min-child-idx = <2>;
+					qcom,is-reset;
+				};
+
+				qcom,pm-cpu {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					qcom,psci-mode-shift = <0>;
+					qcom,psci-mode-mask = <0xf>;
+
+					qcom,pm-cpu-level@0 { /* C1 */
+						reg = <0>;
+						qcom,spm-cpu-mode = "wfi";
+						qcom,psci-cpu-mode = <0x1>;
+						qcom,latency-us = <42>;
+						qcom,ss-power = <240>;
+						qcom,energy-overhead = <30562>;
+						qcom,time-overhead = <91>;
+					};
+
+					qcom,pm-cpu-level@1 { /* C2D */
+						reg = <1>;
+						qcom,psci-cpu-mode = <2>;
+						qcom,spm-cpu-mode = "ret";
+						qcom,latency-us = <90>;
+						qcom,ss-power = <213>;
+						qcom,energy-overhead = <79070>;
+						qcom,time-overhead = <253>;
+					};
+
+					qcom,pm-cpu-level@2 {  /* C3 */
+						reg = <2>;
+						qcom,spm-cpu-mode = "pc";
+						qcom,psci-cpu-mode = <0x3>;
+						qcom,latency-us = <343>;
+						qcom,ss-power = <200>;
+						qcom,energy-overhead = <170215>;
+						qcom,time-overhead = <605>;
+						qcom,is-reset;
+					};
+				};
+			};
+
+			qcom,pm-cluster@1{
+				reg = <1>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				label = "perf";
+				qcom,spm-device-names = "l2";
+				qcom,cpu = <&CPU0 &CPU1 &CPU2 &CPU3>;
+				qcom,psci-mode-shift = <4>;
+				qcom,psci-mode-mask = <0xf>;
+
+				qcom,pm-cluster-level@0{  /* D1 */
+					reg = <0>;
+					label = "perf-l2-active";
+					qcom,psci-mode = <0x1>;
+					qcom,latency-us = <51>;
+					qcom,ss-power = <287>;
+					qcom,energy-overhead = <61412>;
+					qcom,time-overhead = <89>;
+				};
+
+				qcom,pm-cluster-level@1{ /* D2D */
+					reg = <1>;
+					label = "perf-l2-dynret";
+					qcom,psci-mode = <2>;
+					qcom,latency-us = <329>;
+					qcom,ss-power = <284>;
+					qcom,energy-overhead = <206996>;
+					qcom,time-overhead = <601>;
+					qcom,min-child-idx = <1>;
+				};
+
+				qcom,pm-cluster-level@2{ /* D2E */
+					reg = <2>;
+					label = "perf-l2-ret";
+					qcom,psci-mode = <3>;
+					qcom,latency-us = <368>;
+					qcom,ss-power = <277>;
+					qcom,energy-overhead = <240450>;
+					qcom,time-overhead = <700>;
+					qcom,min-child-idx = <2>;
+				};
+
+				qcom,pm-cluster-level@3{ /* D4 */
+					reg = <3>;
+					label = "perf-l2-pc";
+					qcom,psci-mode = <0x4>;
+					qcom,latency-us = <1609>;
+					qcom,ss-power = <262>;
+					qcom,energy-overhead = <703061>;
+					qcom,time-overhead = <2154>;
+					qcom,min-child-idx = <2>;
+					qcom,is-reset;
+				};
+
+				qcom,pm-cpu {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					qcom,psci-mode-shift = <0>;
+					qcom,psci-mode-mask = <0xf>;
+
+					qcom,pm-cpu-level@0 { /* C1 */
+						reg = <0>;
+						qcom,spm-cpu-mode = "wfi";
+						qcom,psci-cpu-mode = <0x1>;
+						qcom,latency-us = <39>;
+						qcom,ss-power = <315>;
+						qcom,energy-overhead = <37558>;
+						qcom,time-overhead = <83>;
+					};
+
+					qcom,pm-cpu-level@1 { /* C2D */
+						reg = <1>;
+						qcom,psci-cpu-mode = <2>;
+						qcom,spm-cpu-mode = "ret";
+						qcom,latency-us = <87>;
+						qcom,ss-power = <299>;
+						qcom,energy-overhead = <91434>;
+						qcom,time-overhead = <241>;
+					};
+
+					qcom,pm-cpu-level@2 { /* C3 */
+						reg = <2>;
+						qcom,spm-cpu-mode = "pc";
+						qcom,psci-cpu-mode = <0x3>;
+						qcom,latency-us = <301>;
+						qcom,ss-power = <291>;
+						qcom,energy-overhead = <199377>;
+						qcom,time-overhead = <563>;
+						qcom,is-reset;
+					};
+				};
+			};
+		};
+	};
+
+	qcom,rpm-stats@200000 {
+		compatible = "qcom,rpm-stats";
+		reg = <0x200000 0x1000>,
+			<0x290014 0x4>,
+			<0x29001c 0x4>;
+		reg-names = "phys_addr_base",
+			"offset_addr",
+			"heap_phys_addrbase";
+		qcom,sleep-stats-version = <2>;
+	};
+
+	qcom,rpm-rail-stats@200000 {
+		compatible = "qcom,rpm-rail-stats";
+		reg = <0x200000 0x100>,
+			<0x29000c 0x4>;
+		reg-names = "phys_addr_base",
+			    "offset_addr";
+	};
+
+	qcom,rpm-log@200000 {
+		compatible = "qcom,rpm-log";
+		reg = <0x200000 0x4000>,
+			<0x290018 0x4>;
+		qcom,rpm-addr-phys = <0x200000>;
+		qcom,offset-version = <4>;
+		qcom,offset-page-buffer-addr = <36>;
+		qcom,offset-log-len = <40>;
+		qcom,offset-log-len-mask = <44>;
+		qcom,offset-page-indices = <56>;
+	};
+
+	qcom,rpm-master-stats@778150 {
+		compatible = "qcom,rpm-master-stats";
+		reg = <0x778150 0x5000>;
+		qcom,masters = "APSS", "MPSS", "ADSP", "CDSP", "TZ";
+		qcom,master-stats-version = <2>;
+		qcom,master-offset = <4096>;
+	};
+
+	rpm_msg_ram: memory@0x200000 {
+		compatible = "qcom,rpm-msg-ram";
+		reg = <0x200000 0x1000>,
+			<0x290000 0x1000>;
+	};
+
+	rpm_code_ram: rpm-memory@0x778000 {
+		compatible = "qcom,rpm-code-ram";
+		reg = <0x778000 0x5000>;
+	};
+
+	qcom,system-stats {
+		compatible = "qcom,system-stats";
+		qcom,rpm-msg-ram = <&rpm_msg_ram>;
+		qcom,rpm-code-ram = <&rpm_code_ram>;
+		qcom,masters = "APSS", "MPSS", "ADSP", "CDSP", "TZ";
+	};
+
+	qcom,mpm@7781b8 {
+		compatible = "qcom,mpm-v2";
+		reg = <0x7781b8 0x1000>, /* MSM_RPM_MPM_BASE 4K */
+		    <0x17911008 0x4>;   /* MSM_APCS_GCC_BASE 4K */
+		reg-names = "vmpm", "ipc";
+		interrupts = <GIC_SPI 171 IRQ_TYPE_EDGE_RISING>;
+		clocks = <&clock_rpmcc CXO_LPM_CLK>;
+		clock-names = "xo";
+		qcom,num-mpm-irqs = <96>;
+
+		qcom,ipc-bit-offset = <1>;
+
+		qcom,gic-parent = <&intc>;
+		qcom,gic-map =
+			<0x02 216>, /* tsens1_tsens_upper_lower_int */
+			<0x31 212>, /* usb30_power_event_irq */
+			<0x34 275>, /* qmp_usb3_lfps_rxterm_irq_cx */
+			<0x3d 209>, /* lpi_dir_conn_irq_apps[1] */
+			<0x4f 379>, /* qusb2phy_intr */
+			<0x57 358>, /* ee0_apps_hlos_spmi_periph_irq */
+			<0x5b 519>, /* lpass_pmu_tmr_timeout_irq_cx */
+			<0xff 16>,  /* APC[0-7]_qgicQTmrHypPhysIrptReq */
+			<0xff 17>,  /* APC[0-7]_qgicQTmrSecPhysIrptReq */
+			<0xff 18>,  /* APC[0-7]_qgicQTmrNonSecPhysIrptReq */
+			<0xff 19>,  /* APC[0-7]_qgicQTmrVirtIrptReq */
+			<0xff 20>,  /* APC[0-7]_dbgCommRxFull */
+			<0xff 21>,  /* APC[0-7]_dbgCommTxEmpty */
+			<0xff 22>,  /* APC[0-7]_qgicPerfMonIrptReq */
+			<0xff 23>,  /* corespm_vote_int[0-7] */
+			<0xff 24>,  /* APC[0-3]_qgicExtFaultIrptReq */
+			<0xff 28>,  /* qgicWakeupSync[0-7] */
+			<0xff 29>,  /* APCC_cti_SPI_intx[0-7] */
+			<0xff 30>,  /* APCC_cti_SPI_inty[0-7] */
+			<0xff 32>,  /* l2spm_vote_int[0] */
+			<0xff 33>,  /* l2spm_vote_int[1] */
+			<0xff 34>,  /* APCC_qgicL2ErrorIrptReq */
+			<0xff 35>,  /* WDT_barkInt */
+			<0xff 36>,  /* WDT_biteExpired */
+			<0xff 39>,  /* QTMR_qgicFrm0VirtIrq */
+			<0xff 40>,  /* QTMR_qgicFrm0PhyIrq */
+			<0xff 41>,  /* QTMR_qgicFrm1PhyIrq */
+			<0xff 42>,  /* QTMR_qgicFrm2PhyIrq */
+			<0xff 43>,  /* QTMR_qgicFrm3PhyIrq */
+			<0xff 44>,  /* QTMR_qgicFrm4PhyIrq */
+			<0xff 45>,  /* QTMR_qgicFrm5PhyIrq */
+			<0xff 46>,  /* QTMR_qgicFrm6PhyIrq */
+			<0xff 47>,  /* rbif_Irq[0] */
+			<0xff 48>,  /* rbif_Irq[1] */
+			<0xff 49>,  /* rbif_Irq[2] */
+			<0xff 50>,  /* rbif_Irq[3] */
+			<0xff 51>,  /* rbif_Irq[4] */
+			<0xff 52>,  /* cci_spm_vote_summary_int */
+			<0xff 54>,  /* nERRORIRQ */
+			<0xff 55>,  /* nEVNTCNTOVERFLOW_cci */
+			<0xff 56>,  /* QTMR_qgicFrm0VirtIrq */
+			<0xff 57>,  /* QTMR_qgicFrm0PhyIrq */
+			<0xff 58>,  /* QTMR_qgicFrm1PhyIrq */
+			<0xff 59>,  /* QTMR_qgicFrm2PhyIrq */
+			<0xff 60>,  /* QTMR_qgicFrm3PhyIrq */
+			<0xff 61>,  /* QTMR_qgicFrm4PhyIrq */
+			<0xff 62>,  /* QTMR_qgicFrm5PhyIrq */
+			<0xff 63>,  /* QTMR_qgicFrm6PhyIrq */
+			<0xff 64>,  /* wakeup_counter_irq_OR */
+			<0xff 65>,  /* APC[0-3]_vs_alarm */
+			<0xff 66>,  /* apc1_vs_alarm */
+			<0xff 67>,  /* o_pwr_osm_irq */
+			<0xff 68>,  /* o_perf_osm_irq */
+			<0xff 69>,  /* o_pwr_dcvsh_interrupt */
+			<0xff 70>,  /* o_perf_dcvsh_interrupt */
+			<0xff 73>,  /* L2_EXTERRIRQ_C0 */
+			<0xff 74>,  /* L2_EXTERRIRQ_C1 */
+			<0xff 75>,  /* L2_INTERRIRQ_C0 */
+			<0xff 76>,  /* L2_INTERRIRQ_C1 */
+			<0xff 77>,  /* L2SPM_svicInt[0] */
+			<0xff 78>,  /* L2SPM_svicInt[1] */
+			<0xff 79>,  /* L2SPM_svicIntSwDone[0] */
+			<0xff 80>,  /* L2SPM_svicIntSwDone[1] */
+			<0xff 81>,  /* l2_avs_err[0] */
+			<0xff 82>,  /* l2_avs_err[1] */
+			<0xff 83>,  /* l2_avs_ack[0] */
+			<0xff 84>,  /* l2_avs_ack[1] */
+			<0xff 98>,  /* o_qm_interrupt */
+			<0xff 100>, /* camss_vbif_1_irpt */
+			<0xff 101>, /* processor_1_user_int */
+			<0xff 102>, /* processor_1_kernel_int */
+			<0xff 106>, /* dir_conn_irq_lpa_dsp[2] */
+			<0xff 107>, /* dir_conn_irq_lpa_dsp[1] */
+			<0xff 109>, /* camss_vbif_0_irpt */
+			<0xff 110>, /* csiphy_0_irq */
+			<0xff 111>, /* csiphy_1_irq */
+			<0xff 112>, /* csiphy_2_irq */
+			<0xff 115>, /* mdss_irq */
+			<0xff 116>, /* mdss_vbif_irpt */
+			<0xff 117>, /* dir_conn_irq_lpa_dsp[0] */
+			<0xff 119>, /* lpass_irq_out_apcs[11] */
+			<0xff 122>, /* o_pimem_tpdm_bc_irq_ofsat */
+			<0xff 123>, /* o_pimem_tpdm_tc_irq_ofsat */
+			<0xff 124>, /* dir_conn_irq_sensors[1] */
+			<0xff 125>, /* dir_conn_irq_sensors[0] */
+			<0xff 127>, /* peripheral_irq[2] */
+			<0xff 128>, /* peripheral_irq[3] */
+			<0xff 129>, /* peripheral_irq[4] */
+			<0xff 130>, /* peripheral_irq[5] */
+			<0xff 133>, /* peripheral_irq[2] */
+			<0xff 134>, /* peripheral_irq[3] */
+			<0xff 135>, /* peripheral_irq[4] */
+			<0xff 136>, /* peripheral_irq[5] */
+			<0xff 139>, /* peripheral_irq[0] */
+			<0xff 140>, /* peripheral_irq[1] */
+			<0xff 142>, /* sdcc_irq[0] */
+			<0xff 143>, /* sdcc_irq[1] */
+			<0xff 144>, /* sdcc_pwr_cmd_irq */
+			<0xff 145>, /* peripheral_irq[0] */
+			<0xff 146>, /* peripheral_irq[1] */
+			<0xff 148>, /* osmmu_CIrpt[4] */
+			<0xff 149>, /* osmmu_CIrpt[5] */
+			<0xff 150>, /* sdio_wakeup_irq */
+			<0xff 151>, /* acvremoval_int */
+			<0xff 152>, /* trs_int */
+			<0xff 155>, /* dir_conn_irq_lpa_dsp[5] */
+			<0xff 156>, /* dir_conn_irq_lpa_dsp[4] */
+			<0xff 157>, /* sdcc_irq[0] */
+			<0xff 158>, /* sdcc_irq[1] */
+			<0xff 159>, /* lpass_irq_out_apcs[39] */
+			<0xff 160>, /* lpass_irq_out_apcs[38] */
+			<0xff 163>, /* usb30_ctrl_irq[0] */
+			<0xff 164>, /* usb30_bam_irq[0] */
+			<0xff 165>, /* usb30_hs_phy_irq */
+			<0xff 166>, /* o_lm_int_2qgic */
+			<0xff 169>, /* lpass_irq_out_apcs[33] */
+			<0xff 172>, /* dcvs_int[6] */
+			<0xff 173>, /* dcvs_int[7] */
+			<0xff 184>, /* dir_conn_irq_lpa_dsp[3] */
+			<0xff 185>, /* camss_vbif_2_irpt */
+			<0xff 186>, /* mnoc_obs_mainfault */
+			<0xff 188>, /* lpass_irq_out_apcs[00] */
+			<0xff 189>, /* lpass_irq_out_apcs[01] */
+			<0xff 190>, /* lpass_irq_out_apcs[02] */
+			<0xff 191>, /* lpass_irq_out_apcs[03] */
+			<0xff 192>, /* lpass_irq_out_apcs[04] */
+			<0xff 193>, /* lpass_irq_out_apcs[05] */
+			<0xff 194>, /* lpass_irq_out_apcs[06] */
+			<0xff 195>, /* lpass_irq_out_apcs[07] */
+			<0xff 196>, /* lpass_irq_out_apcs[08] */
+			<0xff 197>, /* lpass_irq_out_apcs[09] */
+			<0xff 199>, /* qdss_usb_trace_bam_irq[0] */
+			<0xff 200>, /* rpm_ipc[4] */
+			<0xff 201>, /* rpm_ipc[5] */
+			<0xff 202>, /* rpm_ipc[6] */
+			<0xff 203>, /* rpm_ipc[7] */
+			<0xff 204>, /* rpm_ipc[20] */
+			<0xff 205>, /* rpm_ipc[21] */
+			<0xff 206>, /* rpm_ipc[22] */
+			<0xff 207>, /* rpm_ipc[23] */
+			<0xff 208>, /* lpi_dir_conn_irq_apps[0] */
+			<0xff 210>, /* lpi_dir_conn_irq_apps[2] */
+			<0xff 213>, /* secure_wdog_bark_irq */
+			<0xff 214>, /* tsens1_tsens_max_min_int */
+			<0xff 215>, /* o_bimc_intr[0] */
+			<0xff 217>, /* o_ocimem_nonsec_irq */
+			<0xff 218>, /* cpr_irq[1] */
+			<0xff 219>, /* lpass_irq_out_vmm[00] */
+			<0xff 220>, /* spmi_protocol_irq */
+			<0xff 221>, /* lpass_irq_out_vmm[01] */
+			<0xff 222>, /* lpass_irq_out_vmm[02] */
+			<0xff 223>, /* spdm_offline_irq */
+			<0xff 224>, /* spdm_realtime_irq[1] */
+			<0xff 225>, /* snoc_obs_mainFault */
+			<0xff 226>, /* cnoc_obs_mainFault */
+			<0xff 227>, /* o_tcsr_xpu3_sec_summary_intr */
+			<0xff 228>, /* o_tcsr_xpu3_non_sec_summary_intr */
+			<0xff 229>, /* o_timeout_slave_hmss_summary_intr */
+			<0xff 230>, /* o_tcsr_vmidmt_client_sec_summary_intr */
+			<0xff 231>, /* o_tcsr_vmidmt_client_nsec_summary_intr */
+			<0xff 232>, /* o_tcsr_vmidmt_cfg_sec_summary_intr */
+			<0xff 233>, /* o_tcsr_vmidmt_cfg_non_sec_summary_intr */
+			<0xff 234>, /* lpass_irq_out_vmm[03] */
+			<0xff 235>, /* cpr_irq[0] */
+			<0xff 236>, /* crypto_core_irq[0] */
+			<0xff 237>, /* crypto_core_irq[1] */
+			<0xff 238>, /* crypto_bam_irq[0] */
+			<0xff 239>, /* crypto_bam_irq[1] */
+			<0xff 240>, /* summary_irq_hmss */
+			<0xff 241>, /* dir_conn_irq_hmss[7] */
+			<0xff 242>, /* dir_conn_irq_hmss[6] */
+			<0xff 243>, /* dir_conn_irq_hmss[5] */
+			<0xff 244>, /* dir_conn_irq_hmss[4] */
+			<0xff 245>, /* dir_conn_irq_hmss[3] */
+			<0xff 246>, /* dir_conn_irq_hmss[2] */
+			<0xff 247>, /* dir_conn_irq_hmss[1] */
+			<0xff 248>, /* dir_conn_irq_hmss[0] */
+			<0xff 249>, /* summary_irq_hmss_tz */
+			<0xff 250>, /* cpr_irq[3] */
+			<0xff 251>, /* cpr_irq[2] */
+			<0xff 252>, /* cpr_irq[1] */
+			<0xff 253>, /* sdcc_pwr_cmd_irq */
+			<0xff 254>, /* sdio_wakeup_irq */
+			<0xff 255>, /* cpr_irq[0] */
+			<0xff 256>, /* lpass_irq_out_apcs[34] */
+			<0xff 257>, /* lpass_irq_out_apcs[35] */
+			<0xff 258>, /* lpass_irq_out_apcs[21] */
+			<0xff 261>, /* o_tcsr_mmu_nsgcfglrpt_summary_intr */
+			<0xff 262>, /* o_tcsr_mmu_gcfglrpt_summary_intr */
+			<0xff 263>, /* o_tcsr_mmu_nsglrpt_summary_intr */
+			<0xff 264>, /* o_tcsr_mmu_glrpt_summary_intr */
+			<0xff 265>, /* vbif_irpt */
+			<0xff 266>, /* lpass_irq_out_apcs[20] */
+			<0xff 267>, /* lpass_irq_out_apcs[19] */
+			<0xff 269>, /* rpm_wdog_expired_irq */
+			<0xff 270>, /* bam_irq[0] */
+			<0xff 271>, /* bam_irq[0] */
+			<0xff 276>, /* mmss_bimc_smmu_cirpt[4] */
+			<0xff 277>, /* mmss_bimc_smmu_cirpt[5] */
+			<0xff 278>, /* usb30_ctrl_irq[1] */
+			<0xff 279>, /* mmss_bimc_smmu_cirpt[6] */
+			<0xff 280>, /* mmss_bimc_smmu_cirpt[7] */
+			<0xff 281>, /* mmss_bimc_smmu_cirpt[8] */
+			<0xff 282>, /* mmss_bimc_smmu_cirpt[9] */
+			<0xff 283>, /* mmss_bimc_smmu_cirpt[10] */
+			<0xff 284>, /* mmss_bimc_smmu_cirpt[11] */
+			<0xff 285>, /* mmss_bimc_smmu_cirpt[12] */
+			<0xff 286>, /* mmss_bimc_smmu_cirpt[13] */
+			<0xff 287>, /* mmss_bimc_smmu_cirpt[14] */
+			<0xff 288>, /* mmss_bimc_smmu_cirpt[15] */
+			<0xff 289>, /* ufs_ice_sec_level_irq */
+			<0xff 291>, /* lpass_irq_out_apcs[18] */
+			<0xff 292>, /* mmss_bimc_smmu_cirpt[16] */
+			<0xff 293>, /* mmss_bimc_smmu_cirpt[17] */
+			<0xff 294>, /* mmss_bimc_smmu_cirpt[18] */
+			<0xff 295>, /* mmss_bimc_smmu_cirpt[0] */
+			<0xff 296>, /* mmss_bimc_smmu_pmirpt */
+			<0xff 297>, /* ufs_intrq */
+			<0xff 298>, /* mmss_bimc_smmu_cirpt[1] */
+			<0xff 299>, /* mmss_bimc_smmu_cirpt[2] */
+			<0xff 300>, /* mmss_bimc_smmu_cirpt[3] */
+			<0xff 301>, /* lpass_irq_out_apcs[17] */
+			<0xff 302>, /* qdss_etrbytecnt_irq */
+			<0xff 303>, /* lpass_irq_out_apcs[16] */
+			<0xff 304>, /* mmss_bimc_smmu_cirpt[19] */
+			<0xff 305>, /* mmss_bimc_smmu_cirpt[20] */
+			<0xff 306>, /* mmss_bimc_smmu_cirpt[21] */
+			<0xff 307>, /* mmss_bimc_smmu_cirpt[22] */
+			<0xff 308>, /* mmss_bimc_smmu_cirpt[23] */
+			<0xff 316>, /* lpass_irq_out_apcs[13] */
+			<0xff 317>, /* rbif_irq */
+			<0xff 318>, /* gpu_cc_gpu_cx_gds_hw_ctrl_irq_out */
+			<0xff 319>, /* venus0_irq */
+			<0xff 323>, /* lpass_irq_out_apcs[14] */
+			<0xff 324>, /* lpass_irq_out_apcs[15] */
+			<0xff 325>, /* camss_irq18 */
+			<0xff 326>, /* camss_irq0 */
+			<0xff 327>, /* camss_irq1 */
+			<0xff 328>, /* camss_irq2 */
+			<0xff 329>, /* camss_irq3 */
+			<0xff 330>, /* camss_irq4 */
+			<0xff 331>, /* camss_irq5 */
+			<0xff 332>, /* GC_SYS_irq[0] */
+			<0xff 333>, /* GC_SYS_irq[1] */
+			<0xff 334>, /* GC_SYS_irq[2] */
+			<0xff 335>, /* GC_SYS_irq[3] */
+			<0xff 336>, /* camss_irq13 */
+			<0xff 337>, /* camss_irq14 */
+			<0xff 338>, /* camss_irq15 */
+			<0xff 339>, /* camss_irq16 */
+			<0xff 340>, /* camss_irq17 */
+			<0xff 341>, /* camss_irq6 */
+			<0xff 342>, /* lpass_irq_out_apcs[36] */
+			<0xff 345>, /* camss_irq7 */
+			<0xff 346>, /* camss_irq8 */
+			<0xff 347>, /* camss_irq9 */
+			<0xff 348>, /* camss_irq10 */
+			<0xff 350>, /* camss_irq12 */
+			<0xff 351>, /* lpass_irq_out_apcs[12] */
+			<0xff 357>, /* o_pimem_nonfatal_irq */
+			<0xff 359>, /* ee1_apps_trustzone_spmi_periph_irq */
+			<0xff 360>, /* o_pimem_fatal_irq */
+			<0xff 361>, /* osmmu_CIrpt[0] */
+			<0xff 362>, /* osmmu_CIrpt[1] */
+			<0xff 363>, /* osmmu_CIrpt[2] */
+			<0xff 364>, /* osmmu_CIrpt[3] */
+			<0xff 365>, /* ipa_irq[0] */
+			<0xff 366>, /* osmmu_PMIrpt */
+			<0xff 381>, /* osmmu_CIrpt[6] */
+			<0xff 382>, /* osmmu_CIrpt[7] */
+			<0xff 385>, /* osmmu_CIrpt[12] */
+			<0xff 386>, /* osmmu_CIrpt[13] */
+			<0xff 387>, /* osmmu_CIrpt[14] */
+			<0xff 388>, /* osmmu_CIrpt[15] */
+			<0xff 389>, /* osmmu_CIrpt[16] */
+			<0xff 390>, /* osmmu_CIrpt[17] */
+			<0xff 391>, /* osmmu_CIrpt[18] */
+			<0xff 392>, /* osmmu_CIrpt[19] */
+			<0xff 393>, /* o_dcc_crc_fail_int */
+			<0xff 404>, /* aggre2noc_obs_mainFault */
+			<0xff 405>, /* osmmu_CIrpt[0] */
+			<0xff 406>, /* osmmu_CIrpt[1] */
+			<0xff 407>, /* osmmu_CIrpt[2] */
+			<0xff 408>, /* osmmu_CIrpt[3] */
+			<0xff 409>, /* osmmu_CIrpt[4] */
+			<0xff 410>, /* osmmu_CIrpt[5] */
+			<0xff 411>, /* o_dcc_task_done_int */
+			<0xff 412>, /* vsense_apps_alarm_irq */
+			<0xff 413>, /* osmmu_PMIrpt */
+			<0xff 414>, /* channel0_apps_hlos_trans_done_irq */
+			<0xff 415>, /* channel1_apps_trustzone_trans_done_irq */
+			<0xff 416>, /* rpm_ipc[28] */
+			<0xff 417>, /* rpm_ipc[29] */
+			<0xff 418>, /* rpm_ipc[30] */
+			<0xff 419>, /* rpm_ipc[31] */
+			<0xff 423>, /* lpass_irq_out_apcs[40] */
+			<0xff 424>, /* ipa_irq[2] */
+			<0xff 425>, /* lpass_irq_out_apcs[22] */
+			<0xff 426>, /* lpass_irq_out_apcs[23] */
+			<0xff 427>, /* lpass_irq_out_apcs[24] */
+			<0xff 428>, /* lpass_irq_out_apcs[25] */
+			<0xff 429>, /* lpass_irq_out_apcs[26] */
+			<0xff 430>, /* lpass_irq_out_apcs[27] */
+			<0xff 431>, /* lpass_irq_out_apcs[28] */
+			<0xff 432>, /* lpass_irq_out_apcs[29] */
+			<0xff 433>, /* lpass_irq_out_apcs[30] */
+			<0xff 434>, /* lpass_irq_out_apcs[31] */
+			<0xff 435>, /* lpass_irq_out_apcs[32] */
+			<0xff 436>, /* lpass_irq_out_apcs[37] */
+			<0xff 445>, /* wcss_apss_ce_intr[0] */
+			<0xff 446>, /* wcss_apss_ce_intr[1] */
+			<0xff 447>, /* wcss_apss_ce_intr[2] */
+			<0xff 448>, /* wcss_apss_ce_intr[3] */
+			<0xff 449>, /* wcss_apss_ce_intr[4] */
+			<0xff 450>, /* wcss_apss_ce_intr[5] */
+			<0xff 452>, /* wcss_apss_ce_intr[6] */
+			<0xff 453>, /* wcss_apss_ce_intr[7] */
+			<0xff 454>, /* wcss_apss_ce_intr[8] */
+			<0xff 455>, /* wcss_apss_ce_intr[9] */
+			<0xff 456>, /* wcss_apss_ce_intr[10] */
+			<0xff 457>, /* wcss_apss_ce_intr[11] */
+			<0xff 458>, /* wcss_apss_status_intr */
+			<0xff 462>, /* tsens1_tsens_critical_int */
+			<0xff 464>, /* ipa_bam_irq[0] */
+			<0xff 465>, /* ipa_bam_irq[2] */
+			<0xff 466>, /* ssc_uart_int */
+			<0xff 468>, /* cri_cm_irq_tz */
+			<0xff 469>, /* cri_cm_irq_hyp */
+			<0xff 471>, /* mmss_bimc_smmu_gds_hw_ctrl_irq_out */
+			<0xff 472>, /* gcc_gds_hw_ctrl_irq_out */
+			<0xff 474>, /* osmmu_CIrpt[20] */
+			<0xff 475>, /* osmmu_CIrpt[21] */
+			<0xff 476>, /* osmmu_CIrpt[22] */
+			<0xff 477>, /* tsens0_tsens_critical_int */
+			<0xff 478>, /* tsens0_tsens_max_min_int */
+			<0xff 479>, /* osmmu_CIrpt[23] */
+			<0xff 480>, /* q6_wdog_expired_irq */
+			<0xff 481>, /* mss_ipc_out_irq[4] */
+			<0xff 482>, /* mss_ipc_out_irq[5] */
+			<0xff 483>, /* mss_ipc_out_irq[6] */
+			<0xff 484>, /* mss_ipc_out_irq[7] */
+			<0xff 485>, /* mss_ipc_out_irq[28] */
+			<0xff 486>, /* mss_ipc_out_irq[29] */
+			<0xff 487>, /* mss_ipc_out_irq[30] */
+			<0xff 488>, /* mss_ipc_out_irq[31] */
+			<0xff 490>, /* tsens0_tsens_upper_lower_int */
+			<0xff 491>, /* qspi_irq0 */
+			<0xff 492>, /* sdcc_ice_sec_level_irq */
+			<0xff 494>, /* osmmu_CIrpt[6] */
+			<0xff 495>, /* osmmu_CIrpt[7] */
+			<0xff 496>, /* osmmu_CIrpt[8] */
+			<0xff 497>, /* osmmu_CIrpt[9] */
+			<0xff 498>, /* osmmu_CIrpt[10] */
+			<0xff 499>, /* osmmu_CIrpt[11] */
+			<0xff 500>, /* osmmu_CIrpt[24] */
+			<0xff 501>, /* osmmu_CIrpt[25] */
+			<0xff 503>, /* o_bimc_intr[1] */
+			<0xff 504>, /* osmmu_CIrpt[26] */
+			<0xff 505>, /* osmmu_CIrpt[27] */
+			<0xff 506>, /* osmmu_CIrpt[28] */
+			<0xff 516>, /* lpass_irq_out_apcs[41] */
+			<0xff 517>, /* lpass_irq_out_apcs[42] */
+			<0xff 520>; /* lpass_irq_out_apcs[45] */
+
+		qcom,gpio-parent = <&tlmm>;
+		qcom,gpio-map =
+			<3  1>,
+			<4  5>,
+			<5  9>,
+			<6  10>,
+			<7  66>,
+			<8  22>,
+			<9  25>,
+			<10  28>,
+			<11  58>,
+			<13  41>,
+			<14  43>,
+			<15  40>,
+			<16  42>,
+			<17  46>,
+			<18  50>,
+			<19  44>,
+			<21  56>,
+			<22  45>,
+			<23  68>,
+			<24  69>,
+			<25  70>,
+			<26  71>,
+			<27  72>,
+			<28  73>,
+			<29  64>,
+			<30  2>,
+			<31  13>,
+			<32  111>,
+			<33  74>,
+			<34  75>,
+			<35  76>,
+			<36  82>,
+			<37  17>,
+			<38  77>,
+			<39  47>,
+			<40  54>,
+			<41  48>,
+			<42  101>,
+			<43  49>,
+			<44  51>,
+			<45  86>,
+			<46  90>,
+			<47  91>,
+			<48  52>,
+			<50  55>,
+			<51  6>,
+			<53  65>,
+			<55  67>,
+			<56  83>,
+			<57  84>,
+			<58  85>,
+			<59  87>,
+			<63  21>,
+			<64  78>,
+			<65  113>,
+			<66  60>,
+			<67  98>,
+			<68  30>,
+			<70  31>,
+			<71  29>,
+			<76  107>,
+			<83  109>,
+			<84  103>,
+			<85  105>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-pm660a-cdp.dts b/arch/arm64/boot/dts/qcom/sdm630-pm660a-cdp.dts
new file mode 100644
index 000000000000..7e3e9a0cca59
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-pm660a-cdp.dts
@@ -0,0 +1,43 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660A CDP";
+	compatible = "qcom,sdm630-cdp", "qcom,sdm630", "qcom,cdp";
+	qcom,board-id = <1 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_rm67195_amoled_fhd_cmd>;
+	oledb-supply = <&pm660a_oledb>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-pm660a-headset-jacktype-no-cdp.dts b/arch/arm64/boot/dts/qcom/sdm630-pm660a-headset-jacktype-no-cdp.dts
new file mode 100644
index 000000000000..15936f47da7b
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-pm660a-headset-jacktype-no-cdp.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660A, Headset Jacktype NO, CDP";
+	compatible = "qcom,sdm630-cdp", "qcom,sdm630", "qcom,cdp";
+	qcom,board-id = <1 2>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-pm660a-headset-jacktype-no-rcm.dts b/arch/arm64/boot/dts/qcom/sdm630-pm660a-headset-jacktype-no-rcm.dts
new file mode 100644
index 000000000000..aeba192834f3
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-pm660a-headset-jacktype-no-rcm.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660A, Headset Jacktype NO, RCM";
+	compatible = "qcom,sdm630-cdp", "qcom,sdm630", "qcom,cdp";
+	qcom,board-id = <21 2>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-pm660a-mtp.dts b/arch/arm64/boot/dts/qcom/sdm630-pm660a-mtp.dts
new file mode 100644
index 000000000000..a522b7ad1d5f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-pm660a-mtp.dts
@@ -0,0 +1,37 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-mtp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660A MTP";
+	compatible = "qcom,sdm630-mtp", "qcom,sdm630", "qcom,mtp";
+	qcom,board-id = <8 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-moist-cfg = <0>, <0>, <3>;
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_rm67195_amoled_fhd_cmd>;
+	oledb-supply = <&pm660a_oledb>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-pm660a-qrd.dts b/arch/arm64/boot/dts/qcom/sdm630-pm660a-qrd.dts
new file mode 100644
index 000000000000..deb10b591444
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-pm660a-qrd.dts
@@ -0,0 +1,85 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-qrd.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660A QRD";
+	compatible = "qcom,sdm630-qrd", "qcom,sdm630", "qcom,qrd";
+	qcom,board-id = <0x0002000b 0x00>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&int_codec {
+	qcom,model = "sdm660-snd-card-skush";
+	/delete-property/ qcom,us-euro-gpios;
+	qcom,audio-routing =
+		"RX_BIAS", "INT_MCLK0",
+		"SPK_RX_BIAS", "INT_MCLK0",
+		"INT_LDO_H", "INT_MCLK0",
+		"MIC BIAS External2", "Headset Mic",
+		"AMIC2", "MIC BIAS External2",
+		"MIC BIAS External", "Digital Mic1",
+		"DMIC1", "MIC BIAS External",
+		"MIC BIAS External", "Digital Mic3",
+		"DMIC3", "MIC BIAS External",
+		"MIC BIAS External", "Digital Mic4",
+		"DMIC4", "MIC BIAS External",
+		"SpkrLeft IN", "SPK1 OUT",
+		"PDM_IN_RX1", "PDM_OUT_RX1",
+		"PDM_IN_RX2", "PDM_OUT_RX2",
+		"PDM_IN_RX3", "PDM_OUT_RX3",
+		"ADC1_IN", "ADC1_OUT",
+		"ADC2_IN", "ADC2_OUT",
+		"ADC3_IN", "ADC3_OUT";
+	qcom,wsa-max-devs = <1>;
+	qcom,wsa-devs = <&wsa881x_211_en>, <&wsa881x_213_en>;
+	qcom,wsa-aux-dev-prefix = "SpkrLeft", "SpkrLeft";
+};
+
+&pm660a_oledb {
+	status = "okay";
+	qcom,oledb-default-voltage-mv = <6400>;
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "single_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_rm67195_amoled_fhd_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	oledb-supply = <&pm660a_oledb>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+	qcom,platform-reset-gpio = <&tlmm 53 0>;
+	qcom,platform-te-gpio = <&tlmm 59 0>;
+};
+
+&dsi_rm67195_amoled_fhd_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_dcs";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <255>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_labibb_amoled>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-pm660a-rcm.dts b/arch/arm64/boot/dts/qcom/sdm630-pm660a-rcm.dts
new file mode 100644
index 000000000000..4bdbbbe26380
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-pm660a-rcm.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660A RCM";
+	compatible = "qcom,sdm630-cdp", "qcom,sdm630", "qcom,cdp";
+	qcom,board-id = <21 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-pm660a-rumi.dts b/arch/arm64/boot/dts/qcom/sdm630-pm660a-rumi.dts
new file mode 100644
index 000000000000..398496a943ac
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-pm660a-rumi.dts
@@ -0,0 +1,88 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm660-pinctrl.dtsi"
+#include "msm-pm660a.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660A RUMI";
+	compatible = "qcom,sdm630-rumi", "qcom,sdm630", "qcom,rumi";
+	qcom,board-id = <15 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+
+	chosen {
+		bootargs = "lpm_levels.sleep_disabled=1";
+	};
+};
+
+&usb3 {
+	/delete-property/ USB3_GDSC-supply;
+	/delete-property/ extcon;
+	dwc3@a800000 {
+		maximum-speed = "high-speed";
+	};
+};
+
+&ssphy {
+	compatible =  "usb-nop-xceiv";
+};
+
+&qusb_phy0 {
+	reg = <0x0a928000 0x8000>,
+		<0x0a8f8800 0x400>,
+		<0x0a920000 0x100>;
+	reg-names = "qusb_phy_base",
+		"qscratch_base",
+		"emu_phy_base";
+	qcom,emulation;
+	qcom,qusb-phy-init-seq = <0x19 0x1404
+				0x20 0x1414
+				0x79 0x1410
+				0x00 0x1418
+				0x99 0x1404
+				0x04 0x1408
+				0xd9 0x1404>;
+	qcom,emu-dcm-reset-seq = <0x100000 0x20
+				0x0 0x20
+				0x1a0 0x20
+				0x5 0x14>;
+};
+
+&uartblsp1dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&clock_gcc {
+	compatible = "qcom,dummycc";
+	clock-output-names = "gcc_clocks";
+};
+
+&clock_gfx {
+	compatible = "qcom,dummycc";
+	clock-output-names = "gfx_clocks";
+};
+
+&clock_mmss {
+	compatible = "qcom,dummycc";
+	clock-output-names = "mmss_clocks";
+};
+
+&clock_debug {
+	compatible = "qcom,dummycc";
+	clock-output-names = "debug_clocks";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-qrd.dtsi b/arch/arm64/boot/dts/qcom/sdm630-qrd.dtsi
new file mode 100644
index 000000000000..af3c5d1b51da
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-qrd.dtsi
@@ -0,0 +1,411 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm-pm660a.dtsi"
+#include "sdm660-pinctrl.dtsi"
+#include "sdm630-camera-sensor-qrd.dtsi"
+
+&i2c_2 {
+	status = "okay";
+	smb138x: qcom,smb138x@8 {
+		compatible = "qcom,i2c-pmic";
+		reg = <0x8>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <21 IRQ_TYPE_LEVEL_LOW>;
+		interrupt_names = "smb138x";
+		interrupt-controller;
+		#interrupt-cells = <3>;
+		qcom,periph-map = <0x10 0x11 0x12 0x13 0x14 0x16 0x36>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&smb_int_default>;
+
+		smb138x_revid: qcom,revid@100 {
+			compatible = "qcom,qpnp-revid";
+			reg = <0x100 0x100>;
+		};
+
+		smb138x_tadc: qcom,tadc@3600 {
+			compatible = "qcom,tadc";
+			reg = <0x3600 0x100>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			#io-channel-cells = <1>;
+			interrupt-parent = <&smb138x>;
+			interrupts = <0x36 0x0 IRQ_TYPE_EDGE_BOTH>;
+			interrupt-names = "eoc";
+
+			batt_temp@0 {
+				reg = <0>;
+				qcom,rbias = <68100>;
+				qcom,rtherm-at-25degc = <68000>;
+				qcom,beta-coefficient = <3450>;
+			};
+
+			skin_temp@1 {
+				reg = <1>;
+				qcom,rbias = <33000>;
+				qcom,rtherm-at-25degc = <68000>;
+				qcom,beta-coefficient = <3450>;
+			};
+
+			die_temp@2 {
+				reg = <2>;
+				qcom,scale = <(-1306)>;
+				qcom,offset = <397904>;
+			};
+
+			batt_i@3 {
+				reg = <3>;
+				qcom,channel = <3>;
+				qcom,scale = <(-20000000)>;
+			};
+
+			batt_v@4 {
+				reg = <4>;
+				qcom,scale = <5000000>;
+			};
+
+			input_i@5 {
+				reg = <5>;
+				qcom,scale = <14285714>;
+			};
+
+			input_v@6 {
+				reg = <6>;
+				qcom,scale = <25000000>;
+			};
+
+			otg_i@7 {
+				reg = <7>;
+				qcom,scale = <5714286>;
+			};
+		};
+
+		smb138x_parallel_slave: qcom,smb138x-parallel-slave@1000 {
+			compatible = "qcom,smb138x-parallel-slave";
+			qcom,pmic-revid = <&smb138x_revid>;
+			reg = <0x1000 0x700>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			interrupt-parent = <&smb138x>;
+			io-channels =
+				<&smb138x_tadc 1>,
+				<&smb138x_tadc 2>,
+				<&smb138x_tadc 3>,
+				<&smb138x_tadc 14>,
+				<&smb138x_tadc 15>,
+				<&smb138x_tadc 16>,
+				<&smb138x_tadc 17>;
+			io-channel-names =
+				"connector_temp",
+				"charger_temp",
+				"batt_i",
+				"connector_temp_thr1",
+				"connector_temp_thr2",
+				"connector_temp_thr3",
+				"charger_temp_max";
+
+			qcom,chgr@1000 {
+				reg = <0x1000 0x100>;
+				interrupts = <0x10 0x1 IRQ_TYPE_EDGE_RISING>;
+				interrupt-names = "chg-state-change";
+			};
+
+			qcom,chgr-misc@1600 {
+				reg = <0x1600 0x100>;
+				interrupts = <0x16 0x1 IRQ_TYPE_EDGE_RISING>,
+					     <0x16 0x6 IRQ_TYPE_EDGE_RISING>;
+				interrupt-names = "wdog-bark",
+						  "temperature-change";
+			};
+		};
+	};
+};
+
+&tlmm {
+	smb_int_default: smb_int_default {
+		mux {
+			pins = "gpio21";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio21";
+			drive-strength = <2>;
+			bias-pull-up;
+		};
+	};
+};
+
+/ {
+	qrd_batterydata: qcom,battery-data {
+		qcom,batt-id-range-pct = <15>;
+
+		#include "fg-gen3-batterydata-qrd-skuk-4v4-3000mah.dtsi"
+	};
+};
+
+&pm660_fg {
+	qcom,battery-data = <&qrd_batterydata>;
+	qcom,fg-jeita-thresholds = <0 5 55 55>;
+	qcom,battery-thermal-coefficients = [9d 50 ff];
+};
+
+&uartblsp1dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm660l_l1>;
+	vdda-pll-supply = <&pm660_l10>;
+	vddp-ref-clk-supply = <&pm660_l1>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14200>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm660l_l4>;
+	vccq2-supply = <&pm660_l8>;
+	vcc-max-microamp = <500000>;
+	vccq2-max-microamp = <600000>;
+	status = "ok";
+};
+
+&sdhc_1 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l4>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660_l8>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-lpm-sup;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <200 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 100000000 192000000
+								384000000>;
+
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&sdc2_cd_on {
+	config {
+		/delete-property/ bias-pull-up;
+		bias-disable;
+	};
+};
+
+&sdhc_2 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l5>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <15000 800000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660l_l2>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	#address-cells = <0>;
+	interrupt-parent = <&sdhc_2>;
+	interrupts = <0 1 2>;
+	#interrupt-cells = <1>;
+	interrupt-map-mask = <0xffffffff>;
+	interrupt-map = <0 &intc 0 0 125 0
+			1 &intc 0 0 221 0
+			2 &tlmm 54 0>;
+	interrupt-names = "hc_irq", "pwr_irq", "status_irq";
+	cd-gpios = <&tlmm 54 0x0>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 100000000
+								200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	status = "ok";
+};
+
+&pm660l_gpios {
+	/* GPIO 7 for VOL_UP */
+	gpio@c600 {
+		status = "ok";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+};
+
+&pm660_gpios {
+	/* GPIO 11 for home key */
+	gpio@ca00 {
+		status = "ok";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+
+	/* GPIO 4 (NFC_CLK_REQ) */
+	gpio@c300 {
+		qcom,mode = <0>;
+		qcom,vin-sel = <1>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&i2c_6 { /* BLSP1 QUP6 (NFC) */
+	status = "okay";
+	nq@28 {
+		compatible = "qcom,nq-nci";
+		reg = <0x28>;
+		qcom,nq-irq = <&tlmm 28 0x00>;
+		qcom,nq-ven = <&tlmm 29 0x00>;
+		qcom,nq-firm = <&tlmm 30 0x00>;
+		qcom,nq-clkreq = <&pm660_gpios 4 0x00>;
+		qcom,nq-esepwr = <&tlmm 31 0x00>;
+		interrupt-parent = <&tlmm>;
+		qcom,clk-src = "BBCLK3";
+		interrupts = <28 0>;
+		interrupt-names = "nfc_irq";
+		pinctrl-names = "nfc_active", "nfc_suspend";
+		pinctrl-0 = <&nfc_int_active &nfc_enable_active>;
+		pinctrl-1 = <&nfc_int_suspend &nfc_enable_suspend>;
+		clocks = <&clock_rpmcc RPM_LN_BB_CLK3_PIN>;
+		clock-names = "ref_clk";
+	};
+};
+
+&tlmm {
+	pmx_ts_rst_active {
+		ts_rst_active: ts_rst_active {
+			mux {
+				pins = "gpio66";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio66";
+				drive-strength = <16>;
+				bias-pull-up;
+			};
+		};
+	};
+
+	pmx_ts_rst_suspend {
+		ts_rst_suspend: ts_rst_suspend {
+			mux {
+				pins = "gpio66";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio66";
+				drive-strength = <2>;
+				bias-pull-down;
+			};
+		};
+	};
+};
+
+&ssphy {
+	fpc-redrive-supply = <&pm660_l11>;
+	qcom,redrive-voltage-level = <0 1800000 1950000>;
+	qcom,redrive-load = <105000>;
+};
+
+&soc {
+	qcom,msm-ssc-sensors {
+		compatible = "qcom,msm-ssc-sensors";
+	};
+
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+		status = "ok";
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm660l_gpios 7 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+		home {
+			label = "home";
+			gpios = <&pm660_gpios 11 0x1>;
+			linux,input-type = <1>;
+			linux,code = <102>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+
+	};
+
+	hbtp {
+		compatible = "qcom,hbtp-input";
+		pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+		pinctrl-0 = <&ts_rst_active>;
+		pinctrl-1 = <&ts_rst_suspend>;
+		vcc_ana-supply = <&pm660l_l3>;
+		vcc_dig-supply = <&pm660_l13>;
+		qcom,afe-load = <20000>;
+		qcom,afe-vtg-min = <3008000>;
+		qcom,afe-vtg-max = <3008000>;
+		qcom,dig-load = <40000>;
+		qcom,dig-vtg-min = <1808000>;
+		qcom,dig-vtg-max = <1808000>;
+		qcom,fb-resume-delay-us = <10000>;
+		qcom,afe-power-on-delay-us = <1000>;
+		qcom,afe-power-off-delay-us = <6>;
+	};
+};
+
+&qusb_phy0 {
+	qcom,qusb-phy-init-seq = <0xf8 0x80
+				0x83 0x84
+				0x83 0x88
+				0xc3 0x8c
+				0x30 0x08
+				0x79 0x0c
+				0x21 0x10
+				0x14 0x9c
+				0x9f 0x1c
+				0x00 0x18>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-rcm.dts b/arch/arm64/boot/dts/qcom/sdm630-rcm.dts
new file mode 100644
index 000000000000..1de2a4dead6f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-rcm.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660L RCM";
+	compatible = "qcom,sdm630-cdp", "qcom,sdm630", "qcom,cdp";
+	qcom,board-id = <21 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-regulator.dtsi b/arch/arm64/boot/dts/qcom/sdm630-regulator.dtsi
new file mode 100644
index 000000000000..c4adcfe1bdfb
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-regulator.dtsi
@@ -0,0 +1,906 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/clock/qcom,gcc-sdm660.h>
+#include <dt-bindings/clock/qcom,gpu-sdm660.h>
+#include <dt-bindings/clock/qcom,rpmcc.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+&rpm_bus {
+	rpm-regulator-smpa4 {
+		status = "okay";
+		pm660_s4: regulator-s4 {
+			regulator-min-microvolt = <1805000>;
+			regulator-max-microvolt = <2040000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-smpa5 {
+		status = "okay";
+		pm660_s5: regulator-s5 {
+			regulator-min-microvolt = <1224000>;
+			regulator-max-microvolt = <1350000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-smpa6 {
+		status = "okay";
+		pm660_s6: regulator-s6 {
+			regulator-min-microvolt = <504000>;
+			regulator-max-microvolt = <992000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-smpb1 {
+		status = "okay";
+		pm660l_s1: regulator-s1 {
+			regulator-min-microvolt = <1125000>;
+			regulator-max-microvolt = <1125000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-smpb2 {
+		status = "okay";
+		pm660l_s2: regulator-s2 {
+			regulator-min-microvolt = <1050000>;
+			regulator-max-microvolt = <1050000>;
+			status = "okay";
+		};
+	};
+
+	/* PM660L S3 + S4 - VDD_CX supply */
+	rpm-regulator-smpb3 {
+		status = "okay";
+		pm660l_s3_level: regulator-s3-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_s3_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-level;
+		};
+
+		pm660l_s3_floor_level: regulator-s3-floor-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_s3_floor_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-floor-level;
+			qcom,always-send-voltage;
+		};
+
+		pm660l_s3_level_ao: regulator-s3-level-ao {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_s3_level_ao";
+			qcom,set = <1>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-level;
+		};
+	};
+
+	/* PM660L S5 - VDD_MX supply */
+	rpm-regulator-smpb5 {
+		status = "okay";
+		pm660l_s5_level: regulator-s5-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_s5_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-level;
+		};
+
+		pm660l_s5_floor_level: regulator-s5-floor-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_s5_floor_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-floor-level;
+			qcom,always-send-voltage;
+		};
+
+		pm660l_s5_level_ao: regulator-s5-level-ao {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_s5_level_ao";
+			qcom,set = <1>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-level;
+		};
+	};
+
+	rpm-regulator-ldoa1 {
+		status = "okay";
+		pm660_l1: regulator-l1 {
+			regulator-min-microvolt = <1150000>;
+			regulator-max-microvolt = <1250000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa2 {
+		status = "okay";
+		pm660_l2: regulator-l2 {
+			regulator-min-microvolt = <950000>;
+			regulator-max-microvolt = <1010000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa3 {
+		status = "okay";
+		pm660_l3: regulator-l3 {
+			regulator-min-microvolt = <950000>;
+			regulator-max-microvolt = <1010000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa5 {
+		status = "okay";
+		pm660_l5: regulator-l5 {
+			regulator-min-microvolt = <525000>;
+			regulator-max-microvolt = <950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa6 {
+		status = "okay";
+		pm660_l6: regulator-l6 {
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1370000>;
+			status = "okay";
+		};
+
+		pm660_l6_pin_ctrl: regulator-l6-pin-ctrl {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l6_pin_ctrl";
+			qcom,set = <3>;
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1370000>;
+			/* Force NPM follows HW_EN1 */
+			qcom,init-pin-ctrl-mode = <2>;
+			/* Enable follows HW_EN1 */
+			qcom,enable-with-pin-ctrl = <0 2>;
+		};
+	};
+
+	rpm-regulator-ldoa7 {
+		status = "okay";
+		pm660_l7: regulator-l7 {
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa8 {
+		status = "okay";
+		pm660_l8: regulator-l8 {
+			regulator-min-microvolt = <1750000>;
+			regulator-max-microvolt = <1900000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa9 {
+		status = "okay";
+		pm660_l9: regulator-l9 {
+			regulator-min-microvolt = <1750000>;
+			regulator-max-microvolt = <1900000>;
+			status = "okay";
+		};
+
+		pm660_l9_pin_ctrl: regulator-l9-pin-ctrl {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l9_pin_ctrl";
+			qcom,set = <3>;
+			regulator-min-microvolt = <1750000>;
+			regulator-max-microvolt = <1900000>;
+			/* Force NPM follows HW_EN1 */
+			qcom,init-pin-ctrl-mode = <2>;
+			/* Enable follows HW_EN1 */
+			qcom,enable-with-pin-ctrl = <0 2>;
+		};
+	};
+
+	rpm-regulator-ldoa10 {
+		status = "okay";
+		pm660_l10: regulator-l10 {
+			regulator-min-microvolt = <1780000>;
+			regulator-max-microvolt = <1950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa11 {
+		status = "okay";
+		pm660_l11: regulator-l11 {
+			regulator-min-microvolt = <1780000>;
+			regulator-max-microvolt = <1950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa12 {
+		status = "okay";
+		pm660_l12: regulator-l12 {
+			regulator-min-microvolt = <1780000>;
+			regulator-max-microvolt = <1950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa13 {
+		status = "okay";
+		pm660_l13: regulator-l13 {
+			regulator-min-microvolt = <1780000>;
+			regulator-max-microvolt = <1950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa14 {
+		status = "okay";
+		pm660_l14: regulator-l14 {
+			regulator-min-microvolt = <1710000>;
+			regulator-max-microvolt = <1900000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa15 {
+		status = "okay";
+		pm660_l15: regulator-l15 {
+			regulator-min-microvolt = <1650000>;
+			regulator-max-microvolt = <2950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa17 {
+		status = "okay";
+		pm660_l17: regulator-l17 {
+			regulator-min-microvolt = <1650000>;
+			regulator-max-microvolt = <2950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa19 {
+		status = "okay";
+		pm660_l19: regulator-l19 {
+			regulator-min-microvolt = <3200000>;
+			regulator-max-microvolt = <3400000>;
+			status = "okay";
+		};
+
+		pm660_l19_pin_ctrl: regulator-l19-pin-ctrl {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l19_pin_ctrl";
+			qcom,set = <3>;
+			regulator-min-microvolt = <3200000>;
+			regulator-max-microvolt = <3400000>;
+			/* Force NPM follows HW_EN1 */
+			qcom,init-pin-ctrl-mode = <2>;
+			/* Enable follows HW_EN1 */
+			qcom,enable-with-pin-ctrl = <0 2>;
+		};
+	};
+
+	rpm-regulator-ldob1 {
+		status = "okay";
+		pm660l_l1: regulator-l1 {
+			regulator-min-microvolt = <800000>;
+			regulator-max-microvolt = <925000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldob2 {
+		status = "okay";
+		pm660l_l2: regulator-l2 {
+			regulator-min-microvolt = <350000>;
+			regulator-max-microvolt = <3100000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldob3 {
+		status = "okay";
+		pm660l_l3: regulator-l3 {
+			regulator-min-microvolt = <1710000>;
+			regulator-max-microvolt = <3600000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldob4 {
+		status = "okay";
+		pm660l_l4: regulator-l4 {
+			regulator-min-microvolt = <1700000>;
+			regulator-max-microvolt = <2950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldob5 {
+		status = "okay";
+		pm660l_l5: regulator-l5 {
+			regulator-min-microvolt = <1721000>;
+			regulator-max-microvolt = <3600000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldob6 {
+		status = "okay";
+		pm660l_l6: regulator-l6 {
+			regulator-min-microvolt = <1700000>;
+			regulator-max-microvolt = <3300000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldob7 {
+		status = "okay";
+		pm660l_l7: regulator-l7 {
+			regulator-min-microvolt = <2700000>;
+			regulator-max-microvolt = <3125000>;
+			parent-supply = <&pm660_l10>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldob8 {
+		status = "okay";
+		pm660l_l8: regulator-l8 {
+			regulator-min-microvolt = <2800000>;
+			regulator-max-microvolt = <3400000>;
+			status = "okay";
+		};
+	};
+
+	/* PM660L L9 = VDD_SSC_CX supply */
+	rpm-regulator-ldob9 {
+		status = "okay";
+		pm660l_l9_level: regulator-l9-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_l9_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-level;
+		};
+
+		pm660l_l9_floor_level: regulator-l9-floor-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_l9_floor_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-floor-level;
+			qcom,always-send-voltage;
+		};
+	};
+
+	/* PM660L L10 = VDD_SSC_MX supply */
+	rpm-regulator-ldob10 {
+		status = "okay";
+		pm660l_l10_level: regulator-l10-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_l10_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-level;
+		};
+
+		pm660l_l10_floor_level: regulator-l10-floor-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_l10_floor_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-floor-level;
+			qcom,always-send-voltage;
+		};
+	};
+
+	rpm-regulator-bobb {
+		status = "okay";
+		pm660l_bob: regulator-bob {
+			regulator-min-microvolt = <3300000>;
+			regulator-max-microvolt = <3600000>;
+			status = "okay";
+		};
+
+		pm660l_bob_pin1: regulator-bob-pin1 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_bob_pin1";
+			qcom,set = <3>;
+			regulator-min-microvolt = <3300000>;
+			regulator-max-microvolt = <3600000>;
+			qcom,use-pin-ctrl-voltage1;
+		};
+
+		pm660l_bob_pin2: regulator-bob-pin2 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_bob_pin2";
+			qcom,set = <3>;
+			regulator-min-microvolt = <3300000>;
+			regulator-max-microvolt = <3600000>;
+			qcom,use-pin-ctrl-voltage2;
+		};
+
+		pm660l_bob_pin3: regulator-bob-pin3 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_bob_pin3";
+			qcom,set = <3>;
+			regulator-min-microvolt = <3300000>;
+			regulator-max-microvolt = <3600000>;
+			qcom,use-pin-ctrl-voltage3;
+		};
+	};
+};
+
+&pm660_charger {
+	smb2_vbus: qcom,smb2-vbus {
+		regulator-name = "smb2-vbus";
+	};
+
+	smb2_vconn: qcom,smb2-vconn {
+		regulator-name = "smb2-vconn";
+	};
+};
+
+/* Stub regulators */
+/ {
+	/* GFX Supply */
+	gfx_stub_vreg: regulator-gfx-stub {
+		compatible = "qcom,stub-regulator";
+		regulator-name = "gfx_stub_corner";
+		regulator-min-microvolt = <400000>;
+		regulator-max-microvolt = <1070000>;
+	};
+};
+
+&soc {
+	/* MEM ACC regulators */
+	gfx_mem_acc_vreg: regulator@01fcf004 {
+		compatible = "qcom,mem-acc-regulator";
+		reg = <0x01fcf004 0x4>;
+		reg-names = "acc-sel-l1";
+		regulator-name = "gfx_mem_acc_corner";
+		regulator-min-microvolt = <1>;
+		regulator-max-microvolt = <2>;
+
+		qcom,corner-acc-map = <0x1 0x0>;
+		qcom,acc-sel-l1-bit-pos = <0>;
+		qcom,acc-sel-l1-bit-size = <1>;
+	};
+
+	gfx_ldo_vreg: ldo@0506e000 {
+		compatible = "qcom,sdm660-gfx-ldo";
+		reg = <0x0506e000 0x34>;
+		reg-names = "ldo_addr";
+		regulator-name = "msm_gfx_ldo";
+		regulator-min-microvolt = <400000>;
+		regulator-max-microvolt = <925000>;
+	};
+
+/* CPR controller regulators */
+	/* MMSS CPR Controller node */
+	gfx_cpr: cpr4-ctrl@05061000 {
+		compatible = "qcom,cpr4-sdm630-mmss-ldo-regulator";
+		reg = <0x05061000 0x4000>, <0x00784000 0x1000>;
+		reg-names = "cpr_ctrl", "fuse_base";
+		clocks = <&clock_gpu GPUCC_RBCPR_CLK>,
+			 <&clock_rpmcc RPM_CNOC_CLK>;
+		clock-names = "core_clk", "bus_clk";
+		interrupts = <GIC_SPI 285 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "cpr";
+		qcom,cpr-ctrl-name = "gfx";
+
+
+		qcom,cpr-sensor-time = <1000>;
+		qcom,cpr-loop-time = <5000000>;
+		qcom,cpr-idle-cycles = <15>;
+		qcom,cpr-step-quot-init-min = <12>;
+		qcom,cpr-step-quot-init-max = <14>;
+		qcom,cpr-count-mode = <0>;		/* All at once */
+		qcom,cpr-count-repeat = <14>;
+
+		vdd-supply = <&gfx_stub_vreg>;
+		mem-acc-supply = <&gfx_mem_acc_vreg>;
+		system-supply = <&pm660l_s3_level>; /* vdd_cx */
+		qcom,voltage-step = <5000>;
+		vdd-thread0-ldo-supply = <&gfx_ldo_vreg>;
+
+		thread@0 {
+			qcom,cpr-thread-id = <0>;
+			qcom,cpr-consecutive-up = <0>;
+			qcom,cpr-consecutive-down = <2>;
+			qcom,cpr-up-threshold = <2>;
+			qcom,cpr-down-threshold = <2>;
+
+			gfx_vreg_corner: regulator {
+				regulator-name = "gfx_corner";
+				regulator-min-microvolt = <1>;
+				regulator-max-microvolt = <7>;
+
+				qcom,cpr-fuse-corners = <6>;
+				qcom,cpr-fuse-combos = <8>;
+				qcom,cpr-corners = <7>;
+
+				qcom,cpr-corner-fmax-map = <1 2 3 4 5 6>;
+
+				qcom,cpr-voltage-ceiling =
+					<585000  645000  725000  790000
+					 870000  925000 1070000>;
+				qcom,cpr-voltage-floor =
+					<504000  504000  596000  652000
+					 712000  744000 1070000>;
+
+				qcom,mem-acc-voltage = <1 1 1 2 2 2 2>;
+				qcom,system-voltage =
+					<RPM_SMD_REGULATOR_LEVEL_LOW_SVS>,
+					<RPM_SMD_REGULATOR_LEVEL_LOW_SVS>,
+					<RPM_SMD_REGULATOR_LEVEL_SVS>,
+					<RPM_SMD_REGULATOR_LEVEL_SVS_PLUS>,
+					<RPM_SMD_REGULATOR_LEVEL_NOM>,
+					<RPM_SMD_REGULATOR_LEVEL_NOM_PLUS>,
+					<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+
+				qcom,corner-frequencies =
+					<160000000 240000000 370000000
+					 465000000 588000000 647000000
+					 775000000>;
+
+				qcom,cpr-target-quotients =
+					<0    0    0    0     0    0  174  167
+					294  292  303  313    0    0    0    0>,
+					<0    0    0    0     0    0  263  247
+					413  397  415  412    0    0    0    0>,
+					<0    0    0    0     0    0  375  354
+					554  519  573  554    0    0    0    0>,
+					<0    0    0    0     0    0  412  380
+					597  562  612  591    0    0    0    0>,
+					<0    0    0    0     0    0  513  476
+					722  680  738  718    0    0    0    0>,
+					<0    0    0    0     0    0  595  553
+					811  768  837  811    0    0    0    0>,
+					<0    0    0    0     0    0    0    0
+					 0    0    0    0     0    0    0    0>;
+
+				qcom,cpr-ro-scaling-factor =
+					<  0    0    0    0   0    0 1790 1760
+					1990 1900 2140 2020   0    0    0    0>,
+					<  0    0    0    0   0    0 1790 1760
+					1990 1900 2140 2020   0    0    0    0>,
+					<  0    0    0    0   0    0 1790 1760
+					1990 1900 2140 2020   0    0    0    0>,
+					<  0    0    0    0   0    0 1790 1760
+					1990 1900 2140 2020   0    0    0    0>,
+					<  0    0    0    0   0    0 1790 1760
+					1990 1900 2140 2020   0    0    0    0>,
+					<  0    0    0    0   0    0 1790 1760
+					1990 1900 2140 2020   0    0    0    0>,
+					<  0    0    0    0   0    0 1790 1760
+					1990 1900 2140 2020   0    0    0    0>;
+
+				qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+				qcom,cpr-corner-allow-ldo-mode =
+					<0 0 0 0 0 0 0>;
+				qcom,cpr-corner-allow-closed-loop =
+					<0 0 0 0 0 0 0>;
+			};
+		};
+	};
+
+	/* APC0 CPR Controller node for Silver cluster */
+	apc0_cpr: cprh-ctrl@179c8000 {
+		compatible = "qcom,cprh-sdm630-kbss-regulator";
+		reg = <0x179c8000 0x4000>, <0x00784000 0x1000>;
+		reg-names = "cpr_ctrl", "fuse_base";
+		clocks = <&clock_gcc GCC_HMSS_RBCPR_CLK>;
+		clock-names = "core_clk";
+		qcom,cpr-ctrl-name = "apc0";
+		qcom,cpr-controller-id = <0>;
+
+		qcom,cpr-sensor-time = <1000>;
+		qcom,cpr-loop-time = <5000000>;
+		qcom,cpr-idle-cycles = <15>;
+		qcom,cpr-up-down-delay-time = <3000>;
+		qcom,cpr-step-quot-init-min = <12>;
+		qcom,cpr-step-quot-init-max = <14>;
+		qcom,cpr-count-mode = <0>;		/* All at once */
+		qcom,cpr-count-repeat = <14>;
+		qcom,cpr-down-error-step-limit = <1>;
+		qcom,cpr-up-error-step-limit = <1>;
+		qcom,cpr-corner-switch-delay-time = <1042>;
+		qcom,cpr-voltage-settling-time = <1760>;
+		qcom,cpr-reset-step-quot-loop-en;
+
+		qcom,apm-threshold-voltage = <872000>;
+		qcom,apm-crossover-voltage = <872000>;
+		qcom,apm-hysteresis-voltage = <20000>;
+		qcom,voltage-step = <4000>;
+		qcom,voltage-base = <400000>;
+		qcom,cpr-saw-use-unit-mV;
+
+		qcom,cpr-enable;
+		qcom,cpr-hw-closed-loop;
+
+		qcom,cpr-panic-reg-addr-list =
+			<0x179cbaa4 0x17912c18>;
+		qcom,cpr-panic-reg-name-list =
+			"PWR_CPRH_STATUS", "APCLUS0_L2_SAW4_PMIC_STS";
+
+		thread@0 {
+			qcom,cpr-thread-id = <0>;
+			qcom,cpr-consecutive-up = <0>;
+			qcom,cpr-consecutive-down = <2>;
+			qcom,cpr-up-threshold = <2>;
+			qcom,cpr-down-threshold = <2>;
+
+			apc0_pwrcl_vreg: regulator {
+				regulator-name = "apc0_pwrcl_corner";
+				regulator-min-microvolt = <1>;
+				regulator-max-microvolt = <8>;
+
+				qcom,cpr-fuse-corners = <3>;
+				qcom,cpr-fuse-combos = <24>;
+				qcom,cpr-speed-bins = <3>;
+				qcom,cpr-speed-bin-corners = <8 8 8>;
+				qcom,cpr-corners = <8>;
+				qcom,cpr-corner-fmax-map = <2 4 8>;
+
+				qcom,cpr-voltage-ceiling =
+					<724000   724000   788000  788000
+					 1068000 1068000  1068000 1068000>;
+
+				qcom,cpr-voltage-floor =
+					<588000   588000   596000   652000
+					 712000   744000   784000   844000>;
+
+				qcom,corner-frequencies =
+					<300000000  614400000  883200000
+					1094400000 1382400000 1536000000
+					1728000000 1843200000>;
+
+				qcom,allow-voltage-interpolation;
+				qcom,allow-quotient-interpolation;
+				qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+
+				qcom,cpr-ro-scaling-factor =
+					<3600 3600 3830 2430 2520 2700 1790
+					 1760 1970 1880 2110 2010 2510 4900
+					 4370 4780>,
+					<3600 3600 3830 2430 2520 2700 1790
+					 1760 1970 1880 2110 2010 2510 4900
+					 4370 4780>,
+					<3600 3600 3830 2430 2520 2700 1790
+					 1760 1970 1880 2110 2010 2510 4900
+					 4370 4780>;
+
+				qcom,cpr-closed-loop-voltage-fuse-adjustment =
+					<(-30000) (-30000) (-30000)>;
+
+				qcom,cpr-floor-to-ceiling-max-range =
+					<32000  32000  32000  40000  44000
+					 40000  40000  40000>;
+			};
+		};
+	};
+
+	/* APC1 CPR Controller node for Gold cluster */
+	apc1_cpr: cprh-ctrl@179c4000 {
+		compatible = "qcom,cprh-sdm630-kbss-regulator";
+		reg = <0x179c4000 0x4000>, <0x00784000 0x1000>;
+		reg-names = "cpr_ctrl", "fuse_base";
+		clocks = <&clock_gcc GCC_HMSS_RBCPR_CLK>;
+		clock-names = "core_clk";
+		qcom,cpr-ctrl-name = "apc1";
+		qcom,cpr-controller-id = <1>;
+
+		qcom,cpr-sensor-time = <1000>;
+		qcom,cpr-loop-time = <5000000>;
+		qcom,cpr-idle-cycles = <15>;
+		qcom,cpr-up-down-delay-time = <3000>;
+		qcom,cpr-step-quot-init-min = <12>;
+		qcom,cpr-step-quot-init-max = <14>;
+		qcom,cpr-count-mode = <0>;		/* All at once */
+		qcom,cpr-count-repeat = <14>;
+		qcom,cpr-down-error-step-limit = <1>;
+		qcom,cpr-up-error-step-limit = <1>;
+		qcom,cpr-corner-switch-delay-time = <1042>;
+		qcom,cpr-voltage-settling-time = <1760>;
+		qcom,cpr-reset-step-quot-loop-en;
+
+		qcom,apm-threshold-voltage = <872000>;
+		qcom,apm-crossover-voltage = <872000>;
+		qcom,apm-hysteresis-voltage = <20000>;
+		qcom,voltage-step = <4000>;
+		qcom,voltage-base = <400000>;
+		qcom,cpr-saw-use-unit-mV;
+
+		qcom,cpr-enable;
+		qcom,cpr-hw-closed-loop;
+
+		qcom,cpr-panic-reg-addr-list =
+			<0x179c7aa4 0x17812c18>;
+		qcom,cpr-panic-reg-name-list =
+			"PERF_CPRH_STATUS", "APCLUS1_L2_SAW4_PMIC_STS";
+
+		thread@0 {
+			qcom,cpr-thread-id = <0>;
+			qcom,cpr-consecutive-up = <0>;
+			qcom,cpr-consecutive-down = <2>;
+			qcom,cpr-up-threshold = <2>;
+			qcom,cpr-down-threshold = <2>;
+
+			apc1_perfcl_vreg: regulator {
+				regulator-name = "apc1_perfcl_corner";
+				regulator-min-microvolt = <1>;
+				regulator-max-microvolt = <11>;
+
+				qcom,cpr-fuse-corners = <5>;
+				qcom,cpr-fuse-combos = <24>;
+				qcom,cpr-speed-bins = <3>;
+				qcom,cpr-speed-bin-corners = <10 10 11>;
+				qcom,cpr-corners =
+					/* Speed bin 0 */
+					<10 10 10 10 10 10 10 10>,
+
+					/* Speed bin 1 */
+					<10 10 10 10 10 10 10 10>,
+
+					/* Speed bin 2 */
+					<11 11 11 11 11 11 11 11>;
+
+				qcom,cpr-corner-fmax-map =
+					/* Speed bin 0 */
+					<2 4 6 9 10>,
+
+					/* Speed bin 1 */
+					<2 4 6 9 10>,
+
+					/* Speed bin 2 */
+					<2 4 6 9 11>;
+
+				qcom,cpr-voltage-ceiling =
+					/* Speed bin 0 */
+					<724000  724000  724000  788000
+					 868000  868000  988000  988000
+					 988000 1068000>,
+
+					/* Speed bin 1 */
+					<724000  724000  724000  788000
+					 868000  868000  988000  988000
+					 988000 1068000>,
+
+					/* Speed bin 2 */
+					<724000  724000  724000  788000
+					 868000  868000  988000  988000
+					 988000 1140000 1140000>;
+
+				qcom,cpr-voltage-floor =
+					/* Speed bin 0 */
+					<588000  588000  596000  652000
+					 712000  712000  744000  784000
+					 784000  844000>,
+
+					/* Speed bin 1 */
+					<588000  588000  596000  652000
+					 712000  712000  744000  784000
+					 784000  844000>,
+
+					/* Speed bin 2 */
+					<588000  588000  596000  652000
+					 712000  712000  744000  784000
+					 784000  844000  900000>;
+
+				qcom,corner-frequencies =
+					/* Speed bin 0 */
+					<300000000   787200000 1113600000
+					 1344000000 1516800000 1670400000
+					 1881600000 2016000000 2150400000
+					 2380800000>,
+
+					/* Speed bin 1 */
+					<300000000   787200000 1113600000
+					 1344000000 1516800000 1670400000
+					 1881600000 2016000000 2150400000
+					 2208000000>,
+
+					/* Speed bin 2 */
+					<300000000   787200000 1113600000
+					 1344000000 1516800000 1670400000
+					 1881600000 2016000000 2150400000
+					 2380800000 2515200000>;
+
+				qcom,allow-voltage-interpolation;
+				qcom,allow-quotient-interpolation;
+				qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+
+				qcom,cpr-ro-scaling-factor =
+					<4040 4230 0000 2210 2560 2450 2230
+					 2220 2410 2300 2560 2470 1600 3120
+					 2620 2280>,
+					<4040 4230 0000 2210 2560 2450 2230
+					 2220 2410 2300 2560 2470 1600 3120
+					 2620 2280>,
+					<4040 4230 0000 2210 2560 2450 2230
+					 2220 2410 2300 2560 2470 1600 3120
+					 2620 2280>,
+					<4040 4230 0000 2210 2560 2450 2230
+					 2220 2410 2300 2560 2470 1600 3120
+					 2620 2280>,
+					<4040 4230 0000 2210 2560 2450 2230
+					 2220 2410 2300 2560 2470 1600 3120
+					 2620 2280>;
+
+				qcom,cpr-open-loop-voltage-fuse-adjustment =
+					<15000 5000 5000 0 0>;
+
+				qcom,cpr-closed-loop-voltage-fuse-adjustment =
+					<(-30000) (-30000) (-30000)
+					 (-30000) (-30000)>;
+
+				qcom,cpr-floor-to-ceiling-max-range =
+					/* Speed bin 0 */
+					<40000  40000  40000  40000
+					 40000  40000  40000  66000
+					 66000  40000>,
+
+					/* Speed bin 1 */
+					<40000  40000  40000  40000
+					 40000  40000  40000  66000
+					 66000  40000>,
+
+					/* Speed bin 2 */
+					<40000  40000  40000  40000
+					 40000  40000  40000  66000
+					 66000  40000  40000>;
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-rumi.dts b/arch/arm64/boot/dts/qcom/sdm630-rumi.dts
new file mode 100644
index 000000000000..018429a4ebb1
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-rumi.dts
@@ -0,0 +1,158 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm660-pinctrl.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660L RUMI";
+	compatible = "qcom,sdm630-rumi", "qcom,sdm630", "qcom,rumi";
+	qcom,board-id = <15 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+
+	chosen {
+		bootargs = "lpm_levels.sleep_disabled=1";
+	};
+};
+
+&usb3 {
+	/delete-property/ USB3_GDSC-supply;
+	/delete-property/ extcon;
+	dwc3@a800000 {
+		maximum-speed = "high-speed";
+	};
+};
+
+&ssphy {
+	compatible =  "usb-nop-xceiv";
+};
+
+&qusb_phy0 {
+	reg = <0x0a928000 0x8000>,
+		<0x0a8f8800 0x400>,
+		<0x0a920000 0x100>;
+	reg-names = "qusb_phy_base",
+		"qscratch_base",
+		"emu_phy_base";
+	qcom,emulation;
+	qcom,qusb-phy-init-seq = <0x19 0x1404
+				0x20 0x1414
+				0x79 0x1410
+				0x00 0x1418
+				0x99 0x1404
+				0x04 0x1408
+				0xd9 0x1404>;
+	qcom,emu-dcm-reset-seq = <0x100000 0x20
+				0x0 0x20
+				0x1a0 0x20
+				0x5 0x14>;
+};
+
+&uartblsp1dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm660l_l1>;
+	vdda-pll-supply = <&pm660_l10>;
+	vddp-ref-clk-supply = <&pm660_l1>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14200>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm660l_l4>;
+	vccq2-supply = <&pm660_l8>;
+	vcc-max-microamp = <500000>;
+	vccq2-max-microamp = <600000>;
+	status = "ok";
+};
+
+&clock_gcc {
+	compatible = "qcom,dummycc";
+	clock-output-names = "gcc_clocks";
+};
+
+&clock_gfx {
+	compatible = "qcom,dummycc";
+	clock-output-names = "gfx_clocks";
+};
+
+&clock_mmss {
+	compatible = "qcom,dummycc";
+	clock-output-names = "mmss_clocks";
+};
+
+&clock_debug {
+	compatible = "qcom,dummycc";
+	clock-output-names = "debug_clocks";
+};
+
+&sdhc_1 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l4>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660_l8>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-lpm-sup;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <110 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	status = "ok";
+};
+
+&sdhc_2 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l5>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <15000 800000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660l_l2>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	#address-cells = <0>;
+	interrupt-parent = <&sdhc_2>;
+	interrupts = <0 1 2>;
+	#interrupt-cells = <1>;
+	interrupt-map-mask = <0xffffffff>;
+	interrupt-map = <0 &intc 0 0 125 0
+			1 &intc 0 0 221 0
+			2 &tlmm 54 0>;
+	interrupt-names = "hc_irq", "pwr_irq", "status_irq";
+	cd-gpios = <&tlmm 54 0x1>;
+
+	status = "ok";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-smp2p.dtsi b/arch/arm64/boot/dts/qcom/sdm630-smp2p.dtsi
new file mode 100644
index 000000000000..b458bbb08dc2
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-smp2p.dtsi
@@ -0,0 +1,182 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+&soc {
+	qcom,smp2p-modem@17911008 {
+		compatible = "qcom,smp2p";
+		reg = <0x17911008 0x4>;
+		qcom,remote-pid = <1>;
+		qcom,irq-bitmask = <0x4000>;
+		interrupts = <0 451 1>;
+	};
+
+	qcom,smp2p-adsp@17911008 {
+		compatible = "qcom,smp2p";
+		reg = <0x17911008 0x4>;
+		qcom,remote-pid = <2>;
+		qcom,irq-bitmask = <0x400>;
+		interrupts = <0 158 1>;
+	};
+
+	smp2pgpio_smp2p_15_in: qcom,smp2pgpio-smp2p-15-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <15>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_15_in {
+		compatible = "qcom,smp2pgpio_test_smp2p_15_in";
+		gpios = <&smp2pgpio_smp2p_15_in 0 0>;
+	};
+
+	smp2pgpio_smp2p_15_out: qcom,smp2pgpio-smp2p-15-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <15>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_15_out {
+		compatible = "qcom,smp2pgpio_test_smp2p_15_out";
+		gpios = <&smp2pgpio_smp2p_15_out 0 0>;
+	};
+
+	smp2pgpio_smp2p_1_in: qcom,smp2pgpio-smp2p-1-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <1>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_1_in {
+		compatible = "qcom,smp2pgpio_test_smp2p_1_in";
+		gpios = <&smp2pgpio_smp2p_1_in 0 0>;
+	};
+
+	smp2pgpio_smp2p_1_out: qcom,smp2pgpio-smp2p-1-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <1>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_1_out {
+		compatible = "qcom,smp2pgpio_test_smp2p_1_out";
+		gpios = <&smp2pgpio_smp2p_1_out 0 0>;
+	};
+
+	smp2pgpio_smp2p_2_in: qcom,smp2pgpio-smp2p-2-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <2>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_2_in {
+		compatible = "qcom,smp2pgpio_test_smp2p_2_in";
+		gpios = <&smp2pgpio_smp2p_2_in 0 0>;
+	};
+
+	smp2pgpio_smp2p_2_out: qcom,smp2pgpio-smp2p-2-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <2>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_2_out {
+		compatible = "qcom,smp2pgpio_test_smp2p_2_out";
+		gpios = <&smp2pgpio_smp2p_2_out 0 0>;
+	};
+
+	smp2pgpio_sleepstate_2_out: qcom,smp2pgpio-sleepstate-gpio-2-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "sleepstate";
+		qcom,remote-pid = <2>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio-sleepstate-2-out {
+		compatible = "qcom,smp2pgpio-sleepstate-out";
+		gpios = <&smp2pgpio_sleepstate_2_out 0 0>;
+	};
+
+	/* ssr - inbound entry from mss */
+	smp2pgpio_ssr_smp2p_1_in: qcom,smp2pgpio-ssr-smp2p-1-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "slave-kernel";
+		qcom,remote-pid = <1>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - outbound entry to mss */
+	smp2pgpio_ssr_smp2p_1_out: qcom,smp2pgpio-ssr-smp2p-1-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "master-kernel";
+		qcom,remote-pid = <1>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - inbound entry from lpass */
+	smp2pgpio_ssr_smp2p_2_in: qcom,smp2pgpio-ssr-smp2p-2-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "slave-kernel";
+		qcom,remote-pid = <2>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - outbound entry to lpass */
+	smp2pgpio_ssr_smp2p_2_out: qcom,smp2pgpio-ssr-smp2p-2-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "master-kernel";
+		qcom,remote-pid = <2>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-usbc-audio-mtp.dts b/arch/arm64/boot/dts/qcom/sdm630-usbc-audio-mtp.dts
new file mode 100644
index 000000000000..eb089b524fef
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-usbc-audio-mtp.dts
@@ -0,0 +1,31 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-mtp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660L, USBC Audio MTP";
+	compatible = "qcom,sdm630-mtp", "qcom,sdm630", "qcom,mtp";
+	qcom,board-id = <8 2>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-moist-cfg = <0>, <0>, <3>;
+	qcom,msm-mbhc-usbc-audio-supported = <1>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630-usbc-audio-rcm.dts b/arch/arm64/boot/dts/qcom/sdm630-usbc-audio-rcm.dts
new file mode 100644
index 000000000000..6c944305acff
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630-usbc-audio-rcm.dts
@@ -0,0 +1,30 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm630.dtsi"
+#include "sdm630-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 630 PM660 + PM660L, USBC Audio, RCM";
+	compatible = "qcom,sdm630-cdp", "qcom,sdm630", "qcom,cdp";
+	qcom,board-id = <21 3>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-usbc-audio-supported = <1>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm630.dtsi b/arch/arm64/boot/dts/qcom/sdm630.dtsi
new file mode 100644
index 000000000000..e918864a3df7
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm630.dtsi
@@ -0,0 +1,2290 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "skeleton64.dtsi"
+#include <dt-bindings/clock/qcom,gcc-sdm660.h>
+#include <dt-bindings/clock/qcom,gpu-sdm660.h>
+#include <dt-bindings/clock/qcom,mmcc-sdm660.h>
+#include <dt-bindings/clock/qcom,rpmcc.h>
+#include <dt-bindings/clock/audio-ext-clk.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/regulator/qcom,rpm-smd-regulator.h>
+#include <dt-bindings/clock/qcom,cpu-osm.h>
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM630";
+	compatible = "qcom,sdm630";
+	qcom,msm-id = <318 0x0>;
+	interrupt-parent = <&intc>;
+
+	aliases {
+		serial0 = &uartblsp1dm1;
+		sdhc1 = &sdhc_1; /* SDC1 eMMC slot */
+		sdhc2 = &sdhc_2; /* SDC2 for SD card */
+	};
+
+	chosen {
+		stdout-path = "serial0";
+		bootargs = "rcupdate.rcu_expedited=1 core_ctl_disable_cpumask=0-7";
+	};
+
+	psci {
+		compatible = "arm,psci-1.0";
+		method = "smc";
+	};
+
+	cpus {
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		CPU0: cpu@100 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x100>;
+			enable-method = "psci";
+			qcom,limits-info = <&mitigation_profile0>;
+			qcom,lmh-dcvs = <&lmh_dcvs1>;
+			qcom,ea = <&ea0>;
+			efficiency = <1126>;
+			next-level-cache = <&L2_1>;
+			L2_1: l2-cache {
+				compatible = "arm,arch-cache";
+				cache-level = <2>;
+				/* A53 L2 dump not supported */
+				qcom,dump-size = <0x0>;
+			};
+			L1_I_100: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_100: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_TLB_100: l1-tlb {
+				qcom,dump-size = <0x2800>;
+			};
+		};
+
+		CPU1: cpu@101 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x101>;
+			enable-method = "psci";
+			qcom,limits-info = <&mitigation_profile1>;
+			qcom,lmh-dcvs = <&lmh_dcvs1>;
+			qcom,ea = <&ea1>;
+			efficiency = <1126>;
+			next-level-cache = <&L2_1>;
+			L1_I_101: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_101: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_TLB_101: l1-tlb {
+				qcom,dump-size = <0x2800>;
+			};
+		};
+
+		CPU2: cpu@102 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x102>;
+			enable-method = "psci";
+			qcom,limits-info = <&mitigation_profile2>;
+			qcom,lmh-dcvs = <&lmh_dcvs1>;
+			qcom,ea = <&ea2>;
+			efficiency = <1126>;
+			next-level-cache = <&L2_1>;
+			L1_I_102: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_102: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_TLB_102: l1-tlb {
+				qcom,dump-size = <0x2800>;
+			};
+		};
+
+		CPU3: cpu@103 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x103>;
+			enable-method = "psci";
+			qcom,limits-info = <&mitigation_profile3>;
+			qcom,lmh-dcvs = <&lmh_dcvs1>;
+			qcom,ea = <&ea3>;
+			efficiency = <1126>;
+			next-level-cache = <&L2_1>;
+			L1_I_103: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_103: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_TLB_103: l1-tlb {
+				qcom,dump-size = <0x2800>;
+			};
+		};
+
+		CPU4: cpu@0 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x0>;
+			enable-method = "psci";
+			qcom,limits-info = <&mitigation_profile4>;
+			qcom,lmh-dcvs = <&lmh_dcvs0>;
+			qcom,ea = <&ea4>;
+			efficiency = <1024>;
+			next-level-cache = <&L2_0>;
+			L2_0: l2-cache {
+				compatible = "arm,arch-cache";
+				cache-level = <2>;
+				/* A53 L2 dump not supported */
+				qcom,dump-size = <0x0>;
+			};
+			L1_I_0: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_0: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_TLB_0: l1-tlb {
+				qcom,dump-size = <0x2800>;
+			};
+		};
+
+		CPU5: cpu@1 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x1>;
+			enable-method = "psci";
+			qcom,limits-info = <&mitigation_profile4>;
+			qcom,lmh-dcvs = <&lmh_dcvs0>;
+			qcom,ea = <&ea5>;
+			efficiency = <1024>;
+			next-level-cache = <&L2_0>;
+			L1_I_1: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_1: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_TLB_1: l1-tlb {
+				qcom,dump-size = <0x2800>;
+			};
+		};
+
+		CPU6: cpu@2 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x2>;
+			enable-method = "psci";
+			qcom,limits-info = <&mitigation_profile4>;
+			qcom,lmh-dcvs = <&lmh_dcvs0>;
+			qcom,ea = <&ea6>;
+			efficiency = <1024>;
+			next-level-cache = <&L2_0>;
+			L1_I_2: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_2: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_TLB_2: l1-tlb {
+				qcom,dump-size = <0x2800>;
+			};
+		};
+
+		CPU7: cpu@3 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x3>;
+			enable-method = "psci";
+			qcom,limits-info = <&mitigation_profile4>;
+			qcom,lmh-dcvs = <&lmh_dcvs0>;
+			qcom,ea = <&ea7>;
+			efficiency = <1024>;
+			next-level-cache = <&L2_0>;
+			L1_I_3: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_3: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_TLB_3: l1-tlb {
+				qcom,dump-size = <0x2800>;
+			};
+		};
+
+		cpu-map {
+			cluster0 {
+				core0 {
+					cpu = <&CPU4>;
+				};
+
+				core1 {
+					cpu = <&CPU5>;
+				};
+
+				core2 {
+					cpu = <&CPU6>;
+				};
+
+				core3 {
+					cpu = <&CPU7>;
+				};
+			};
+
+			cluster1 {
+				core0 {
+					cpu = <&CPU0>;
+				};
+
+				core1 {
+					cpu = <&CPU1>;
+				};
+
+				core2 {
+					cpu = <&CPU2>;
+				};
+
+				core3 {
+					cpu = <&CPU3>;
+				};
+			};
+		};
+	};
+
+	clocks {
+		xo_board {
+			compatible = "fixed-clock";
+			#clock-cells = <0>;
+			clock-frequency = <19200000>;
+			clock-output-names = "xo_board";
+		};
+
+		sleep_clk {
+			compatible = "fixed-clock";
+			#clock-cells = <0>;
+			clock-frequency = <32764>;
+			clock-output-names = "sleep_clk";
+		};
+	};
+
+	soc: soc { };
+
+	firmware: firmware {
+		android {
+			compatible = "android,firmware";
+			fstab {
+				compatible = "android,fstab";
+				vendor {
+					compatible = "android,vendor";
+					dev = "/dev/block/platform/soc/c0c4000.sdhci/by-name/vendor";
+					type = "ext4";
+					mnt_flags = "ro,barrier=1,discard";
+					fsmgr_flags = "wait,slotselect";
+					status = "ok";
+				};
+			};
+		};
+	};
+
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		wlan_msa_guard: wlan_msa_guard@85600000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0x0 0x85600000 0x0 0x100000>;
+		};
+
+		wlan_msa_mem: wlan_msa_mem@85700000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0x0 0x85700000 0x0 0x100000>;
+		};
+
+		removed_region: removed_region0@85800000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0x0 0x85800000 0x0 0x3700000>;
+		};
+
+		modem_fw_mem: modem_fw_region@8ac00000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0x0 0x8ac00000 0x0 0x7e00000>;
+		};
+
+		adsp_fw_mem: adsp_fw_region@92a00000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0x0 0x92a00000 0x0 0x1e00000>;
+		};
+
+		pil_mba_mem: pil_mba_region@94800000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0x0 0x94800000 0x0 0x200000>;
+		};
+
+		buffer_mem: buffer_region@94a00000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0x0 0x94a00000 0x0 0x100000>;
+		};
+
+		venus_fw_mem: venus_fw_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x80000000 0x0 0x20000000>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x800000>;
+		};
+
+		adsp_mem: adsp_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x800000>;
+		};
+
+		qseecom_mem: qseecom_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x1400000>;
+		};
+
+		secure_display_memory: secure_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x5c00000>;
+		};
+
+		/* global autoconfigured region for contiguous allocations */
+		linux,cma {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x2000000>;
+			linux,cma-default;
+		};
+
+		cont_splash_mem: splash_region@9d400000 {
+			reg = <0x0 0x9d400000 0x0 0x02400000>;
+			label = "cont_splash_mem";
+		};
+	};
+
+	bluetooth: bt_wcn3990 {
+		compatible = "qca,wcn3990";
+		qca,bt-vdd-core-supply = <&pm660_l9>;
+		qca,bt-vdd-pa-supply = <&pm660_l6>;
+		qca,bt-vdd-ldo-supply = <&pm660_l19>;
+		qca,bt-chip-pwd-supply = <&pm660l_bob_pin1>;
+		clocks = <&clock_rpmcc RPM_RF_CLK1_PIN>;
+		clock-names = "rf_clk1";
+
+		qca,bt-vdd-core-voltage-level = <1800000 1900000>;
+		qca,bt-vdd-pa-voltage-level = <1304000 1370000>;
+		qca,bt-vdd-ldo-voltage-level = <3312000 3400000>;
+		qca,bt-chip-pwd-voltage-level = <3600000 3600000>;
+
+		qca,bt-vdd-core-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-pa-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-ldo-current-level = <1>; /* LPM/PFM */
+	};
+};
+
+#include "sdm660-blsp.dtsi"
+#include "sdm630-smp2p.dtsi"
+#include "sdm630-coresight.dtsi"
+&soc {
+	#address-cells = <1>;
+	#size-cells = <1>;
+	ranges = <0 0 0 0xffffffff>;
+	compatible = "simple-bus";
+
+	intc: interrupt-controller@17a00000 {
+		compatible = "arm,gic-v3";
+		reg = <0x17a00000 0x10000>,       /* GICD */
+		      <0x17b00000 0x100000>;      /* GICR * 8 */
+		#interrupt-cells = <3>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		interrupt-controller;
+		#redistributor-regions = <1>;
+		redistributor-stride = <0x0 0x20000>;
+		interrupts = <1 9 4>;
+	};
+
+	timer {
+		compatible = "arm,armv8-timer";
+		interrupts = <1 1 0xf08>,
+			     <1 2 0xf08>,
+			     <1 3 0xf08>,
+			     <1 0 0xf08>;
+		clock-frequency = <19200000>;
+	};
+
+	dma_blsp1: qcom,sps-dma@0xc144000{ /* BLSP1 */
+		#dma-cells = <4>;
+		compatible = "qcom,sps-dma";
+		reg = <0xc144000 0x1F000>;
+		interrupts = <0 238 0>;
+		qcom,summing-threshold = <0x10>;
+	};
+
+	dma_blsp2: qcom,sps-dma@0xc184000{ /* BLSP2 */
+		#dma-cells = <4>;
+		compatible = "qcom,sps-dma";
+		reg = <0xc184000 0x1F000>;
+		interrupts = <0 239 0>;
+		qcom,summing-threshold = <0x10>;
+	};
+
+	restart@10ac000 {
+		compatible = "qcom,pshold";
+		reg = <0x10ac000 0x4>,
+		      <0x1fd3000 0x4>;
+		reg-names = "pshold-base", "tcsr-boot-misc-detect";
+	};
+
+	cpuss_dump {
+		compatible = "qcom,cpuss-dump";
+		qcom,l1_i_cache0 {
+			qcom,dump-node = <&L1_I_0>;
+			qcom,dump-id = <0x60>;
+		};
+		qcom,l1_i_cache1 {
+			qcom,dump-node = <&L1_I_1>;
+			qcom,dump-id = <0x61>;
+		};
+		qcom,l1_i_cache2 {
+			qcom,dump-node = <&L1_I_2>;
+			qcom,dump-id = <0x62>;
+		};
+		qcom,l1_i_cache3 {
+			qcom,dump-node = <&L1_I_3>;
+			qcom,dump-id = <0x63>;
+		};
+		qcom,l1_i_cache100 {
+			qcom,dump-node = <&L1_I_100>;
+			qcom,dump-id = <0x64>;
+		};
+		qcom,l1_i_cache101 {
+			qcom,dump-node = <&L1_I_101>;
+			qcom,dump-id = <0x65>;
+		};
+		qcom,l1_i_cache102 {
+			qcom,dump-node = <&L1_I_102>;
+			qcom,dump-id = <0x66>;
+		};
+		qcom,l1_i_cache103 {
+			qcom,dump-node = <&L1_I_103>;
+			qcom,dump-id = <0x67>;
+		};
+		qcom,l1_d_cache0 {
+			qcom,dump-node = <&L1_D_0>;
+			qcom,dump-id = <0x80>;
+		};
+		qcom,l1_d_cache1 {
+			qcom,dump-node = <&L1_D_1>;
+			qcom,dump-id = <0x81>;
+		};
+		qcom,l1_d_cache2 {
+			qcom,dump-node = <&L1_D_2>;
+			qcom,dump-id = <0x82>;
+		};
+		qcom,l1_d_cache3 {
+			qcom,dump-node = <&L1_D_3>;
+			qcom,dump-id = <0x83>;
+		};
+		qcom,l1_d_cache100 {
+			qcom,dump-node = <&L1_D_100>;
+			qcom,dump-id = <0x84>;
+		};
+		qcom,l1_d_cache101 {
+			qcom,dump-node = <&L1_D_101>;
+			qcom,dump-id = <0x85>;
+		};
+		qcom,l1_d_cache102 {
+			qcom,dump-node = <&L1_D_102>;
+			qcom,dump-id = <0x86>;
+		};
+		qcom,l1_d_cache103 {
+			qcom,dump-node = <&L1_D_103>;
+			qcom,dump-id = <0x87>;
+		};
+		qcom,l1_tlb_dump0 {
+			qcom,dump-node = <&L1_TLB_0>;
+			qcom,dump-id = <0x20>;
+		};
+		qcom,l1_tlb_dump1 {
+			qcom,dump-node = <&L1_TLB_1>;
+			qcom,dump-id = <0x21>;
+		};
+		qcom,l1_tlb_dump2 {
+			qcom,dump-node = <&L1_TLB_2>;
+			qcom,dump-id = <0x22>;
+		};
+		qcom,l1_tlb_dump3 {
+			qcom,dump-node = <&L1_TLB_3>;
+			qcom,dump-id = <0x23>;
+		};
+		qcom,l1_tlb_dump100 {
+			qcom,dump-node = <&L1_TLB_100>;
+			qcom,dump-id = <0x24>;
+		};
+		qcom,l1_tlb_dump101 {
+			qcom,dump-node = <&L1_TLB_101>;
+			qcom,dump-id = <0x25>;
+		};
+		qcom,l1_tlb_dump102 {
+			qcom,dump-node = <&L1_TLB_102>;
+			qcom,dump-id = <0x26>;
+		};
+		qcom,l1_tlb_dump103 {
+			qcom,dump-node = <&L1_TLB_103>;
+			qcom,dump-id = <0x27>;
+		};
+	};
+
+	qcom,sps {
+		compatible = "qcom,msm_sps_4k";
+		qcom,pipe-attr-ee;
+	};
+
+	qcom,memshare {
+		compatible = "qcom,memshare";
+
+		qcom,client_1 {
+			compatible = "qcom,memshare-peripheral";
+			qcom,peripheral-size = <0x200000>;
+			qcom,client-id = <0>;
+			qcom,allocate-boot-time;
+			label = "modem";
+		};
+
+		qcom,client_2 {
+			compatible = "qcom,memshare-peripheral";
+			qcom,peripheral-size = <0x300000>;
+			qcom,client-id = <2>;
+			label = "modem";
+		};
+
+		mem_client_3_size: qcom,client_3 {
+			compatible = "qcom,memshare-peripheral";
+			qcom,peripheral-size = <0x0>;
+			qcom,client-id = <1>;
+			qcom,allocate-boot-time;
+			label = "modem";
+		};
+	};
+
+	tsens: tsens@10ad000 {
+		compatible = "qcom,sdm630-tsens";
+		reg = <0x10ad000 0x2000>;
+		reg-names = "tsens_physical";
+		interrupts = <0 184 0>, <0 430 0>;
+		interrupt-names = "tsens-upper-lower", "tsens-critical";
+		qcom,client-id = <0 1 2 3 4 5 6 7 8 9 10 11>;
+		qcom,sensor-id = <0 8 10 4 5 6 7 9 2 1 3 11>;
+		qcom,sensors = <12>;
+	};
+
+	qcom,sensor-information {
+		compatible = "qcom,sensor-information";
+		sensor_information0: qcom,sensor-information-0 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor0";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information1: qcom,sensor-information-1 {
+			qcom,sensor-type =  "tsens";
+			qcom,sensor-name = "tsens_tz_sensor1";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information2: qcom,sensor-information-2 {
+			qcom,sensor-type =  "tsens";
+			qcom,sensor-name = "tsens_tz_sensor2";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information3: qcom,sensor-information-3 {
+			qcom,sensor-type =  "tsens";
+			qcom,sensor-name = "tsens_tz_sensor3";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information4: qcom,sensor-information-4 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor4";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information5: qcom,sensor-information-5 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor5";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information6: qcom,sensor-information-6 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor6";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information7: qcom,sensor-information-7 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor7";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information8: qcom,sensor-information-8 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor8";
+			qcom,scaling-factor = <10>;
+			qcom,alias-name = "gpu";
+		};
+		sensor_information9: qcom,sensor-information-9 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor9";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information10: qcom,sensor-information-10 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor10";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information11: qcom,sensor-information-11 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor11";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information12: qcom,sensor-information-12 {
+			qcom,sensor-type =  "alarm";
+			qcom,sensor-name = "pm660_tz";
+			qcom,scaling-factor = <1000>;
+		};
+		sensor_information13: qcom,sensor-information-13 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "msm_therm";
+		};
+		sensor_information14: qcom,sensor-information-14 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "xo_therm";
+		};
+		sensor_information15: qcom,sensor-information-15 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "pa_therm0";
+		};
+		sensor_information16: qcom,sensor-information-16 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "pa_therm1";
+		};
+		sensor_information17: qcom,sensor-information-17 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "quiet_therm";
+		};
+		sensor_information18: qcom,sensor-information-18 {
+			qcom,sensor-type = "llm";
+			qcom,sensor-name = "limits_sensor-00";
+		};
+		sensor_information19: qcom,sensor-information-19 {
+			qcom,sensor-type = "llm";
+			qcom,sensor-name = "limits_sensor-01";
+		};
+	};
+
+	mitigation_profile0: qcom,limit_info-0 {
+		qcom,temperature-sensor = <&sensor_information3>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile1: qcom,limit_info-1 {
+		qcom,temperature-sensor = <&sensor_information4>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile2: qcom,limit_info-2 {
+		qcom,temperature-sensor = <&sensor_information5>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile3: qcom,limit_info-3 {
+		qcom,temperature-sensor = <&sensor_information6>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile4: qcom,limit_info-4 {
+		qcom,temperature-sensor = <&sensor_information7>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	qcom,msm-thermal {
+		compatible = "qcom,msm-thermal";
+		qcom,sensor-id = <3>;
+		qcom,poll-ms = <100>;
+		qcom,therm-reset-temp = <115>;
+		qcom,core-limit-temp = <70>;
+		qcom,core-temp-hysteresis = <10>;
+		qcom,hotplug-temp = <105>;
+		qcom,hotplug-temp-hysteresis = <20>;
+		qcom,online-hotplug-core;
+		qcom,synchronous-cluster-id = <0 1>;
+		qcom,synchronous-cluster-map = <0 4 &CPU4 &CPU5 &CPU6 &CPU7>,
+						<1 4 &CPU0 &CPU1 &CPU2 &CPU3>;
+
+		clock-names = "osm";
+		clocks = <&clock_cpu PERFCL_CLK>;
+		qcom,vdd-restriction-temp = <5>;
+		qcom,vdd-restriction-temp-hysteresis = <10>;
+
+		vdd-dig-supply = <&pm660l_s3_floor_level>;
+		vdd-gfx-supply = <&gfx_vreg_corner>;
+
+		qcom,vdd-dig-rstr{
+			qcom,vdd-rstr-reg = "vdd-dig";
+			qcom,levels = <RPM_SMD_REGULATOR_LEVEL_NOM
+					RPM_SMD_REGULATOR_LEVEL_TURBO
+					RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,min-level = <RPM_SMD_REGULATOR_LEVEL_NONE>;
+		};
+
+		qcom,vdd-gfx-rstr{
+			qcom,vdd-rstr-reg = "vdd-gfx";
+			qcom,levels = <5 6 6>; /* Nominal, Turbo, Turbo */
+			qcom,min-level = <1>; /* No Request */
+		};
+
+		msm_thermal_freq: qcom,vdd-apps-rstr{
+			qcom,vdd-rstr-reg = "vdd-apps";
+			qcom,levels = <1248000>;
+			qcom,freq-req;
+		};
+	};
+
+	qcom,lmh {
+		compatible = "qcom,lmh_v1";
+		interrupts = <GIC_SPI 134 IRQ_TYPE_LEVEL_HIGH>;
+	};
+
+	qcom,bcl {
+		compatible = "qcom,bcl";
+		qcom,bcl-enable;
+		qcom,bcl-framework-interface;
+		qcom,bcl-hotplug-list = <&CPU2 &CPU3>;
+		qcom,bcl-soc-hotplug-list = <&CPU0 &CPU1 &CPU2 &CPU3>;
+		qcom,ibat-monitor {
+			qcom,low-threshold-uamp = <3400000>;
+			qcom,high-threshold-uamp = <4200000>;
+			qcom,vph-high-threshold-uv = <3500000>;
+			qcom,vph-low-threshold-uv = <3300000>;
+			qcom,soc-low-threshold = <10>;
+		};
+	};
+
+	qcom,msm-core@780000 {
+		compatible = "qcom,apss-core-ea";
+		reg = <0x780000 0x1000>;
+		qcom,low-hyst-temp = <100>;
+		qcom,high-hyst-temp = <100>;
+
+		ea0: ea0 {
+			sensor = <&sensor_information3>;
+		};
+
+		ea1: ea1 {
+			sensor = <&sensor_information4>;
+		};
+
+		ea2: ea2 {
+			sensor = <&sensor_information5>;
+		};
+
+		ea3: ea3 {
+			sensor = <&sensor_information6>;
+		};
+
+		ea4: ea4 {
+			sensor = <&sensor_information7>;
+		};
+
+		ea5: ea5 {
+			sensor = <&sensor_information7>;
+		};
+
+		ea6: ea6 {
+			sensor = <&sensor_information7>;
+		};
+
+		ea7: ea7 {
+			sensor = <&sensor_information7>;
+		};
+	};
+
+	wdog: qcom,wdt@17817000 {
+		compatible = "qcom,msm-watchdog";
+		reg = <0x17817000 0x1000>;
+		reg-names = "wdt-base";
+		interrupts = <0 3 0>, <0 4 0>;
+		qcom,bark-time = <11000>;
+		qcom,pet-time = <10000>;
+		qcom,ipi-ping;
+		qcom,wakeup-enable;
+		qcom,scandump-size = <0x40000>;
+	};
+
+	uartblsp1dm1: serial@0c170000 {
+		compatible = "qcom,msm-uartdm-v1.4", "qcom,msm-uartdm";
+		reg = <0xc170000 0x1000>;
+		interrupts = <0 108 0>;
+		status = "disabled";
+		clocks = <&clock_gcc GCC_BLSP1_UART2_APPS_CLK>,
+			 <&clock_gcc GCC_BLSP1_AHB_CLK>;
+		clock-names = "core", "iface";
+	};
+
+	uartblsp2dm1: serial@0c1b0000 {
+		compatible = "qcom,msm-uartdm-v1.4", "qcom,msm-uartdm";
+		reg = <0xc1b0000 0x1000>;
+		interrupts = <0 114 0>;
+		status = "disabled";
+		clocks = <&clock_gcc GCC_BLSP2_UART2_APPS_CLK>,
+			 <&clock_gcc GCC_BLSP2_AHB_CLK>;
+		clock-names = "core", "iface";
+	};
+
+	slim_aud: slim@151c0000 {
+		cell-index = <1>;
+		compatible = "qcom,slim-ngd";
+		reg = <0x151c0000 0x2c000>,
+			<0x15184000 0x2a000>;
+		reg-names = "slimbus_physical", "slimbus_bam_physical";
+		interrupts = <0 163 0>, <0 164 0>;
+		interrupt-names = "slimbus_irq", "slimbus_bam_irq";
+		qcom,apps-ch-pipes = <0x7e0000>;
+		qcom,ea-pc = <0x260>;
+		status = "disabled";
+	};
+
+	slim_qca: slim@15240000 {
+		cell-index = <3>;
+		compatible = "qcom,slim-ngd";
+		reg = <0x15240000 0x2c000>,
+			<0x15204000 0x20000>;
+		reg-names = "slimbus_physical", "slimbus_bam_physical";
+		interrupts = <0 291 0>, <0 292 0>;
+		interrupt-names = "slimbus_irq", "slimbus_bam_irq";
+		qcom,apps-ch-pipes = <0x1800>;
+
+		/* Slimbus Slave DT for WCN3990 */
+		btfmslim_codec: wcn3990 {
+			compatible = "qcom,btfmslim_slave";
+			elemental-addr = [00 01 20 02 17 02];
+			qcom,btfm-slim-ifd = "btfmslim_slave_ifd";
+			qcom,btfm-slim-ifd-elemental-addr = [00 00 20 02 17 02];
+		};
+	};
+
+	timer@17920000 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		compatible = "arm,armv7-timer-mem";
+		reg = <0x17920000 0x1000>;
+		clock-frequency = <19200000>;
+
+		frame@17921000 {
+			frame-number = <0>;
+			interrupts = <0 8 0x4>,
+				     <0 7 0x4>;
+			reg = <0x17921000 0x1000>,
+			      <0x17922000 0x1000>;
+		};
+
+		frame@17923000 {
+			frame-number = <1>;
+			interrupts = <0 9 0x4>;
+			reg = <0x17923000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17924000 {
+			frame-number = <2>;
+			interrupts = <0 10 0x4>;
+			reg = <0x17924000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17925000 {
+			frame-number = <3>;
+			interrupts = <0 11 0x4>;
+			reg = <0x17925000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17926000 {
+			frame-number = <4>;
+			interrupts = <0 12 0x4>;
+			reg = <0x17926000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17927000 {
+			frame-number = <5>;
+			interrupts = <0 13 0x4>;
+			reg = <0x17927000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17928000 {
+			frame-number = <6>;
+			interrupts = <0 14 0x4>;
+			reg = <0x17928000 0x1000>;
+			status = "disabled";
+		};
+	};
+
+	arm64-cpu-erp {
+		compatible = "arm,arm64-cpu-erp";
+		interrupts = <0 43 4>,
+			     <0 44 4>,
+			     <0 41 4>,
+			     <0 42 4>;
+
+		interrupt-names = "pri-dbe-irq",
+				  "sec-dbe-irq",
+				  "pri-ext-irq",
+				  "sec-ext-irq";
+
+		poll-delay-ms = <5000>;
+	};
+
+	clock_rpmcc: qcom,rpmcc {
+		compatible = "qcom,rpmcc-sdm660", "qcom,rpmcc";
+		#clock-cells = <1>;
+	};
+
+	clock_gcc: clock-controller@100000 {
+		compatible = "qcom,gcc-sdm660", "syscon";
+		reg = <0x100000 0x94000>;
+		vdd_dig-supply = <&pm660l_s3_level>;
+		vdd_dig_ao-supply = <&pm660l_s3_level_ao>;
+		#clock-cells = <1>;
+		#reset-cells = <1>;
+	};
+
+	clock_mmss: clock-controller@c8c0000 {
+		compatible = "qcom,mmcc-sdm630";
+		reg = <0xc8c0000 0x40000>;
+		vdd_mx_mmss-supply = <&pm660l_s5_level>;
+		vdd_dig_mmss-supply = <&pm660l_s3_level>;
+		vdda-supply = <&pm660_l10>;
+		#clock-cells = <1>;
+		#reset-cells = <1>;
+	};
+
+	clock_gpu: clock-controller@5065000 {
+		compatible = "qcom,gpu-sdm660";
+		reg = <0x5065000 0x10000>;
+		#clock-cells = <1>;
+		#reset-cells = <1>;
+	};
+
+	clock_gfx: gfx@5065000 {
+		compatible = "qcom,gpucc-sdm630";
+		reg = <0x5065000 0x10000>;
+		vdd_dig_gfx-supply = <&pm660l_s3_level>;
+		vdd_mx_gfx-supply = <&pm660l_s5_level>;
+		vdd_gfx-supply = <&gfx_vreg_corner>;
+		qcom,gfxfreq-corner =
+			< 0         0>,
+			< 160000000 1>,  /* MinSVS */
+			< 240000000 2>,  /* LowSVS */
+			< 370000000 3>,  /* SVS    */
+			< 465000000 4>,  /* SVS_L1 */
+			< 588000000 5>,  /* NOM    */
+			< 647000000 6>,  /* NOM_L1 */
+			< 700000000 7>,  /* TURBO */
+			< 775000000 7>;  /* TURBO  */
+		#clock-cells = <1>;
+		#reset-cells = <1>;
+	};
+
+	cpu_debug: syscon@1791101c {
+		compatible = "syscon";
+		reg = <0x1791101c 0x4>;
+	};
+
+	gpu_debug: syscon@05065120 {
+		compatible = "syscon";
+		reg = <0x05065120 0x4>;
+	};
+
+	mmss_debug: syscon@c8c0900 {
+		compatible = "syscon";
+		reg = <0xc8c0900 0x4>;
+	};
+
+	clock_debug: qcom,cc-debug@62000 {
+		compatible = "qcom,gcc-debug-sdm660";
+		reg = <0x62000 0x4>;
+		reg-names = "dbg_offset";
+		clocks = <&clock_rpmcc  RPM_XO_CLK_SRC>;
+		clock-names = "xo_clk_src";
+		qcom,cc-count = <4>;
+		qcom,gcc = <&clock_gcc>;
+		qcom,cpu = <&cpu_debug>;
+		qcom,mmss = <&mmss_debug>;
+		qcom,gpu = <&gpu_debug>;
+		#clock-cells = <1>;
+	};
+
+	cpubw: qcom,cpubw {
+		compatible = "qcom,devbw";
+		governor = "performance";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		qcom,bw-tbl =
+			<  381  /*  100 MHz */ >,
+			<  572  /*  150 MHz */ >,
+			<  762  /*  200 MHz */ >,
+			<  1144 /*  300 MHz */ >,
+			<  1571 /*  412 MHz */ >,
+			<  2086 /*  547 MHz */ >,
+			<  2597 /*  681 MHz */ >,
+			<  2929 /*  768 MHz */ >,
+			<  3879 /* 1017 MHz */ >,
+			<  4943 /* 1296 MHz */ >,
+			<  5163 /* 1353 MHz */ >;
+	};
+
+	bwmon: qcom,cpu-bwmon {
+		compatible = "qcom,bimc-bwmon4";
+		reg = <0x01008000 0x300>, <0x01001000 0x200>;
+		reg-names = "base", "global_base";
+		interrupts = <0 183 4>;
+		qcom,mport = <0>;
+		qcom,hw-timer-hz = <19200000>;
+		qcom,target-dev = <&cpubw>;
+	};
+
+	mincpubw: qcom,mincpubw {
+		compatible = "qcom,devbw";
+		governor = "powersave";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		qcom,bw-tbl =
+			<  381  /*  100 MHz */ >,
+			<  572  /*  150 MHz */ >,
+			<  762  /*  200 MHz */ >,
+			<  1144 /*  300 MHz */ >,
+			<  1571 /*  412 MHz */ >,
+			<  2086 /*  547 MHz */ >,
+			<  2597 /*  681 MHz */ >,
+			<  2929 /*  768 MHz */ >,
+			<  3879 /* 1017 MHz */ >,
+			<  4943 /* 1296 MHz */ >,
+			<  5163 /* 1353 MHz */ >;
+	};
+
+	memlat_cpu0: qcom,memlat-cpu0 {
+		compatible = "qcom,devbw";
+		governor = "powersave";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		qcom,bw-tbl =
+			<  381  /*  100 MHz */ >,
+			<  572  /*  150 MHz */ >,
+			<  762  /*  200 MHz */ >,
+			<  1144 /*  300 MHz */ >,
+			<  1571 /*  412 MHz */ >,
+			<  2086 /*  547 MHz */ >,
+			<  2597 /*  681 MHz */ >,
+			<  2929 /*  768 MHz */ >,
+			<  3879 /* 1017 MHz */ >,
+			<  4943 /* 1296 MHz */ >,
+			<  5163 /* 1353 MHz */ >;
+	};
+
+	memlat_cpu4: qcom,memlat-cpu4 {
+		compatible = "qcom,devbw";
+		governor = "powersave";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		qcom,bw-tbl =
+			<  381  /*  100 MHz */ >,
+			<  572  /*  150 MHz */ >,
+			<  762  /*  200 MHz */ >,
+			<  1144 /*  300 MHz */ >,
+			<  1571 /*  412 MHz */ >,
+			<  2086 /*  547 MHz */ >,
+			<  2597 /*  681 MHz */ >,
+			<  2929 /*  768 MHz */ >,
+			<  3879 /* 1017 MHz */ >,
+			<  4943 /* 1296 MHz */ >,
+			<  5163 /* 1353 MHz */ >;
+	};
+
+	devfreq_memlat_0: qcom,arm-memlat-mon-0 {
+		compatible = "qcom,arm-memlat-mon";
+		qcom,cpulist = <&CPU0 &CPU1 &CPU2 &CPU3>;
+		qcom,target-dev = <&memlat_cpu0>;
+		qcom,core-dev-table =
+			< 1113600 762 >,
+			< 1344000 2086 >,
+			< 1670400 2929 >,
+			< 1881600 3879 >,
+			< 2150400 4943 >,
+			< 2380800 5163 >;
+	};
+
+	devfreq_memlat_4: qcom,arm-memlat-mon-4 {
+		compatible = "qcom,arm-memlat-mon";
+		qcom,cpulist = <&CPU4 &CPU5 &CPU6 &CPU7>;
+		qcom,target-dev = <&memlat_cpu4>;
+		qcom,core-dev-table =
+			< 614400 762 >,
+			< 1536000 2929 >,
+			< 1728000 3879 >;
+	};
+
+	devfreq_cpufreq: devfreq-cpufreq {
+		mincpubw-cpufreq {
+			target-dev = <&mincpubw>;
+			cpu-to-dev-map-0 =
+				< 787200 762 >,
+				< 1344000 1571 >,
+				< 1881600 2929 >,
+				< 2380800 3879 >;
+			cpu-to-dev-map-4 =
+				< 614400 762 >,
+				< 1536000 1571 >,
+				< 1728000 3879 >;
+		};
+	};
+
+	msm_cpufreq: qcom,msm-cpufreq {
+		compatible = "qcom,msm-cpufreq";
+		clock-names = "cpu0_clk", "cpu4_clk";
+		clocks = <&clock_cpu PERFCL_CLK>,
+			 <&clock_cpu PWRCL_CLK>;
+
+		qcom,governor-per-policy;
+
+		qcom,cpufreq-table-0 =
+			<  787200 >,
+			< 1113600 >,
+			< 1344000 >,
+			< 1516800 >,
+			< 1670400 >,
+			< 1881600 >,
+			< 2016000 >,
+			< 2150400 >,
+			< 2208000 >,
+			< 2380800 >,
+			< 2515200 >;
+
+		qcom,cpufreq-table-4 =
+			<  614400 >,
+			<  883200 >,
+			< 1094400 >,
+			< 1382400 >,
+			< 1536000 >,
+			< 1728000 >,
+			< 1843200 >;
+	};
+
+	ipa_hw: qcom,ipa@14780000 {
+		compatible = "qcom,ipa";
+		reg = <0x14780000 0x4effc>, <0x14784000 0x26934>;
+		reg-names = "ipa-base", "bam-base";
+		interrupts = <0 333 0>,
+				<0 432 0>;
+		interrupt-names = "ipa-irq", "bam-irq";
+		qcom,ipa-hw-ver = <6>; /* IPA core version = IPAv2.6L */
+		qcom,ipa-hw-mode = <0>; /* IPA hw type = Normal */
+		qcom,wan-rx-ring-size = <192>; /* IPA WAN-rx-ring-size*/
+		qcom,lan-rx-ring-size = <192>; /* IPA LAN-rx-ring-size*/
+		clocks = <&clock_rpmcc RPM_IPA_CLK>,
+			<&clock_rpmcc AGGR2_NOC_SMMU_CLK>;
+		clock-names = "core_clk", "smmu_clk";
+		qcom,arm-smmu;
+		qcom,smmu-disable-htw;
+		qcom,smmu-s1-bypass;
+		qcom,ee = <0>;
+		qcom,use-ipa-tethering-bridge;
+		qcom,modem-cfg-emb-pipe-flt;
+		qcom,ipa-wdi2;
+		qcom,use-dma-zone;
+		qcom,msm-bus,name = "ipa";
+		qcom,msm-bus,num-cases = <4>;
+		qcom,msm-bus,num-paths = <2>;
+		qcom,msm-bus,vectors-KBps =
+		/* No vote */
+		<90 512 0 0>,
+		<1 676 0 0>,
+		/* SVS */
+		<90 512 80000 640000>,
+		<1 676 80000 80000>,
+		/* NOMINAL */
+		<90 512 206000 960000>,
+		<1 676 206000 160000>,
+		/* TURBO */
+		<90 512 206000 960000>,
+		<1 676 206000 160000>;
+		qcom,bus-vector-names = "MIN", "SVS", "PERF", "TURBO";
+		qcom,rx-polling-sleep-ms = <1>; /* Polling sleep interval */
+		qcom,ipa-polling-iteration = <40>; /* Polling Iteration */
+
+		ipa_smmu_ap: ipa_smmu_ap {
+			compatible = "qcom,ipa-smmu-ap-cb";
+			iommus = <&anoc2_smmu 0x19C0>;
+			qcom,iova-mapping = <0x10000000 0x40000000>;
+		};
+
+		ipa_smmu_wlan: ipa_smmu_wlan {
+			status = "disabled";
+			compatible = "qcom,ipa-smmu-wlan-cb";
+			iommus = <&anoc2_smmu 0x19C1>;
+		};
+
+		ipa_smmu_uc: ipa_smmu_uc {
+			compatible = "qcom,ipa-smmu-uc-cb";
+			iommus = <&anoc2_smmu 0x19C2>;
+			qcom,iova-mapping = <0x40000000 0x20000000>;
+		};
+	};
+
+	qcom,rmtfs_sharedmem@85e00000 {
+		compatible = "qcom,sharedmem-uio";
+		reg = <0x85e00000 0x200000>;
+		reg-names = "rmtfs";
+		qcom,client-id = <0x00000001>;
+	};
+
+	qcom,rmnet-ipa {
+		compatible = "qcom,rmnet-ipa";
+		qcom,rmnet-ipa-ssr;
+		qcom,ipa-loaduC;
+		qcom,ipa-advertise-sg-support;
+	};
+
+	clock_cpu: qcom,clk-cpu-630@179c0000 {
+		compatible = "qcom,clk-cpu-osm-sdm630";
+		reg = <0x179c0000 0x4000>, <0x17916000 0x1000>,
+			<0x17816000 0x1000>, <0x179d1000 0x1000>,
+			<0x00784130 0x8>;
+		reg-names = "osm", "pwrcl_pll", "perfcl_pll",
+			"apcs_common", "perfcl_efuse";
+
+		vdd-pwrcl-supply = <&apc0_pwrcl_vreg>;
+		vdd-perfcl-supply = <&apc1_perfcl_vreg>;
+
+		interrupts = <GIC_SPI 35 IRQ_TYPE_EDGE_RISING>,
+			<GIC_SPI 36 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "pwrcl-irq", "perfcl-irq";
+
+		qcom,pwrcl-speedbin0-v0 =
+			<   300000000 0x0004000f 0x01200020 0x1 1 >,
+			<   614400000 0x05040020 0x03200020 0x1 2 >,
+			<   883200000 0x0404002e 0x04250025 0x1 3 >,
+			<  1094400000 0x04040039 0x052e002e 0x2 4 >,
+			<  1382400000 0x04040048 0x07390039 0x2 5 >,
+			<  1536000000 0x04040050 0x08400040 0x2 6 >,
+			<  1728000000 0x0404005a 0x09480048 0x2 7 >,
+			<  1843200000 0x04040060 0x094c004c 0x3 8 >;
+
+		qcom,perfcl-speedbin0-v0 =
+			<   300000000 0x0004000f 0x01200020 0x1 1 >,
+			<   787200000 0x05040029 0x04200020 0x1 2 >,
+			<  1113600000 0x0404003a 0x052e002e 0x1 3 >,
+			<  1344000000 0x04040046 0x07380038 0x2 4 >,
+			<  1516800000 0x0404004f 0x073f003f 0x2 5 >,
+			<  1670400000 0x04040057 0x08450045 0x2 6 >,
+			<  1881600000 0x04040062 0x094e004e 0x2 7 >,
+			<  2016000000 0x04040069 0x0a540054 0x2 8 >,
+			<  2150400000 0x04040070 0x0b590059 0x2 9 >,
+			<  2380800000 0x0404007c 0x0c630063 0x3 10 >;
+
+		qcom,perfcl-speedbin1-v0 =
+			<   300000000 0x0004000f 0x01200020 0x1 1 >,
+			<   787200000 0x05040029 0x04200020 0x1 2 >,
+			<  1113600000 0x0404003a 0x052e002e 0x1 3 >,
+			<  1344000000 0x04040046 0x07380038 0x2 4 >,
+			<  1516800000 0x0404004f 0x073f003f 0x2 5 >,
+			<  1670400000 0x04040057 0x08450045 0x2 6 >,
+			<  1881600000 0x04040062 0x094e004e 0x2 7 >,
+			<  2016000000 0x04040069 0x0a540054 0x2 8 >,
+			<  2150400000 0x04040070 0x0b590059 0x2 9 >,
+			<  2208000000 0x04040073 0x0b5c005c 0x3 10 >;
+
+		qcom,perfcl-speedbin2-v0 =
+			<   300000000 0x0004000f 0x01200020 0x1 1 >,
+			<   787200000 0x05040029 0x04200020 0x1 2 >,
+			<  1113600000 0x0404003a 0x052e002e 0x1 3 >,
+			<  1344000000 0x04040046 0x07380038 0x2 4 >,
+			<  1516800000 0x0404004f 0x073f003f 0x2 5 >,
+			<  1670400000 0x04040057 0x08450045 0x2 6 >,
+			<  1881600000 0x04040062 0x094e004e 0x2 7 >,
+			<  2016000000 0x04040069 0x0a540054 0x2 8 >,
+			<  2150400000 0x04040070 0x0b590059 0x2 9 >,
+			<  2380800000 0x0404007c 0x0c630063 0x3 10 >,
+			<  2515200000 0x04040083 0x0d680068 0x3 11 >;
+
+		qcom,up-timer = <1000 1000>;
+		qcom,down-timer = <1000 1000>;
+		qcom,set-ret-inactive;
+		qcom,enable-llm-freq-vote;
+		qcom,llm-freq-up-timer = <327675 327675>;
+		qcom,llm-freq-down-timer = <327675 327675>;
+		qcom,enable-llm-volt-vote;
+		qcom,llm-volt-up-timer = <327675 327675>;
+		qcom,llm-volt-down-timer = <327675 327675>;
+		qcom,cc-reads = <10>;
+		qcom,cc-delay = <5>;
+		qcom,cc-factor = <100>;
+		qcom,osm-clk-rate = <200000000>;
+		qcom,xo-clk-rate = <19200000>;
+
+		qcom,l-val-base = <0x17916004 0x17816004>;
+		qcom,apcs-itm-present = <0x179d143c 0x179d143c>;
+		qcom,apcs-pll-user-ctl = <0x1791600c 0x1781600c>;
+		qcom,apcs-cfg-rcgr = <0x17911054 0x17811054>;
+		qcom,apcs-cmd-rcgr = <0x17911050 0x17811050>;
+		qcom,apm-mode-ctl = <0x179d0004 0x179d0010>;
+		qcom,apm-ctrl-status = <0x179d000c 0x179d0018>;
+
+		qcom,apm-threshold-voltage = <872000>;
+		qcom,boost-fsm-en;
+		qcom,safe-fsm-en;
+		qcom,ps-fsm-en;
+		qcom,droop-fsm-en;
+		qcom,wfx-fsm-en;
+		qcom,pc-fsm-en;
+
+		clock-names = "aux_clk", "xo_a";
+		clocks = <&clock_gcc HMSS_GPLL0_CLK_SRC>,
+			<&clock_rpmcc RPM_XO_A_CLK_SRC>;
+
+		#clock-cells = <1>;
+	};
+
+	qcom,ipc-spinlock@1f40000 {
+		compatible = "qcom,ipc-spinlock-sfpb";
+		reg = <0x1f40000 0x8000>;
+		qcom,num-locks = <8>;
+	};
+
+	qcom,smem@86000000 {
+		compatible = "qcom,smem";
+		reg = <0x86000000 0x200000>,
+			<0x17911008 0x4>,
+			<0x778000 0x7000>,
+			<0x1fd4000 0x8>;
+		reg-names = "smem", "irq-reg-base", "aux-mem1",
+			"smem_targ_info_reg";
+		qcom,mpu-enabled;
+	};
+
+	qcom,msm-adsprpc-mem {
+		compatible = "qcom,msm-adsprpc-mem-region";
+		memory-region = <&adsp_mem>;
+	};
+
+	qcom,msm_fastrpc {
+		compatible = "qcom,msm-fastrpc-adsp";
+		qcom,fastrpc-glink;
+
+		qcom,msm_fastrpc_compute_cb1 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 3>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb2 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 7>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb3 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 8>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb4 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 9>;
+			dma-coherent;
+		};
+	};
+
+	dcc: dcc@10b3000 {
+		compatible = "qcom,dcc";
+		reg = <0x10b3000 0x1000>,
+			<0x10b4000 0x2000>;
+		reg-names = "dcc-base", "dcc-ram-base";
+
+		clocks = <&clock_gcc GCC_DCC_AHB_CLK>;
+		clock-names = "dcc_clk";
+	};
+
+	qcom,glink-smem-native-xprt-modem@86000000 {
+		compatible = "qcom,glink-smem-native-xprt";
+		reg = <0x86000000 0x200000>,
+			<0x17911008 0x4>;
+		reg-names = "smem", "irq-reg-base";
+		qcom,irq-mask = <0x8000>;
+		interrupts = <0 452 1>;
+		label = "mpss";
+	};
+
+	qcom,glink-smem-native-xprt-adsp@86000000 {
+		compatible = "qcom,glink-smem-native-xprt";
+		reg = <0x86000000 0x200000>,
+			<0x17911008 0x4>;
+		reg-names = "smem", "irq-reg-base";
+		qcom,irq-mask = <0x200>;
+		interrupts = <0 157 1>;
+		label = "lpass";
+		qcom,qos-config = <&glink_qos_adsp>;
+		qcom,ramp-time = <0xaf>;
+	};
+
+	glink_qos_adsp: qcom,glink-qos-config-adsp {
+		compatible = "qcom,glink-qos-config";
+		qcom,flow-info = <0x3c 0x0>,
+				<0x3c 0x0>,
+				<0x3c 0x0>,
+				<0x3c 0x0>;
+		qcom,mtu-size = <0x800>;
+		qcom,tput-stats-cycle = <0xa>;
+	};
+
+	qcom,glink-smem-native-xprt-rpm@778000 {
+		compatible = "qcom,glink-rpm-native-xprt";
+		reg = <0x778000 0x7000>,
+			<0x17911008 0x4>;
+		reg-names = "msgram", "irq-reg-base";
+		qcom,irq-mask = <0x1>;
+		interrupts = <0 168 1>;
+		label = "rpm";
+	};
+
+	glink_spi_xprt_wdsp: qcom,glink-spi-xprt-wdsp {
+		compatible = "qcom,glink-spi-xprt";
+		label = "wdsp";
+		qcom,remote-fifo-config = <&glink_fifo_wdsp>;
+		qcom,qos-config = <&glink_qos_wdsp>;
+		qcom,ramp-time = <0x10>,
+				     <0x20>,
+				     <0x30>,
+				     <0x40>;
+	};
+
+	glink_fifo_wdsp: qcom,glink-fifo-config-wdsp {
+		compatible = "qcom,glink-fifo-config";
+		qcom,out-read-idx-reg = <0x12000>;
+		qcom,out-write-idx-reg = <0x12004>;
+		qcom,in-read-idx-reg = <0x1200c>;
+		qcom,in-write-idx-reg = <0x12010>;
+	};
+
+	glink_qos_wdsp: qcom,glink-qos-config-wdsp {
+		compatible = "qcom,glink-qos-config";
+		qcom,flow-info = <0x80 0x0>,
+				 <0x70 0x1>,
+				 <0x60 0x2>,
+				 <0x50 0x3>;
+		qcom,mtu-size = <0x800>;
+		qcom,tput-stats-cycle = <0xa>;
+	};
+
+	qcom,glink_pkt {
+		compatible = "qcom,glinkpkt";
+
+		qcom,glinkpkt-at-mdm0 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DS";
+			qcom,glinkpkt-dev-name = "at_mdm0";
+		};
+
+		qcom,glinkpkt-loopback_cntl {
+			qcom,glinkpkt-transport = "lloop";
+			qcom,glinkpkt-edge = "local";
+			qcom,glinkpkt-ch-name = "LOCAL_LOOPBACK_CLNT";
+			qcom,glinkpkt-dev-name = "glink_pkt_loopback_ctrl";
+		};
+
+		qcom,glinkpkt-loopback_data {
+			qcom,glinkpkt-transport = "lloop";
+			qcom,glinkpkt-edge = "local";
+			qcom,glinkpkt-ch-name = "glink_pkt_lloop_CLNT";
+			qcom,glinkpkt-dev-name = "glink_pkt_loopback";
+		};
+
+		qcom,glinkpkt-apr-apps2 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "adsp";
+			qcom,glinkpkt-ch-name = "apr_apps2";
+			qcom,glinkpkt-dev-name = "apr_apps2";
+		};
+
+		qcom,glinkpkt-data40-cntl {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DATA40_CNTL";
+			qcom,glinkpkt-dev-name = "smdcntl8";
+		};
+
+		qcom,glinkpkt-data1 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DATA1";
+			qcom,glinkpkt-dev-name = "smd7";
+		};
+
+		qcom,glinkpkt-data4 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DATA4";
+			qcom,glinkpkt-dev-name = "smd8";
+		};
+
+		qcom,glinkpkt-data11 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DATA11";
+			qcom,glinkpkt-dev-name = "smd11";
+		};
+	};
+
+	glink_mpss: qcom,glink-ssr-modem {
+		compatible = "qcom,glink_ssr";
+		label = "modem";
+		qcom,edge = "mpss";
+		qcom,notify-edges = <&glink_lpass>, <&glink_rpm>;
+		qcom,xprt = "smem";
+	};
+
+	glink_lpass: qcom,glink-ssr-adsp {
+		compatible = "qcom,glink_ssr";
+		label = "adsp";
+		qcom,edge = "lpass";
+		qcom,notify-edges = <&glink_mpss>, <&glink_rpm>;
+		qcom,xprt = "smem";
+	};
+
+	glink_rpm: qcom,glink-ssr-rpm {
+		compatible = "qcom,glink_ssr";
+		label = "rpm";
+		qcom,edge = "rpm";
+		qcom,notify-edges = <&glink_lpass>, <&glink_mpss>;
+		qcom,xprt = "smem";
+	};
+
+	rpm_bus: qcom,rpm-smd {
+		compatible = "qcom,rpm-glink";
+		qcom,glink-edge = "rpm";
+		rpm-channel-name = "rpm_requests";
+	};
+
+	qcom,ipc_router {
+		compatible = "qcom,ipc_router";
+		qcom,node-id = <1>;
+	};
+
+	qcom,ipc_router_modem_xprt {
+		compatible = "qcom,ipc_router_glink_xprt";
+		qcom,ch-name = "IPCRTR";
+		qcom,xprt-remote = "mpss";
+		qcom,glink-xprt = "smem";
+		qcom,xprt-linkid = <1>;
+		qcom,xprt-version = <1>;
+		qcom,fragmented-data;
+	};
+
+	qcom,ipc_router_q6_xprt {
+		compatible = "qcom,ipc_router_glink_xprt";
+		qcom,ch-name = "IPCRTR";
+		qcom,xprt-remote = "lpass";
+		qcom,glink-xprt = "smem";
+		qcom,xprt-linkid = <1>;
+		qcom,xprt-version = <1>;
+		qcom,fragmented-data;
+	};
+
+	qcom,icnss@18800000 {
+		compatible = "qcom,icnss";
+		reg = <0x18800000 0x800000>,
+		      <0xa0000000 0x10000000>,
+		      <0xb0000000 0x10000>;
+		reg-names = "membase", "smmu_iova_base", "smmu_iova_ipa";
+		iommus = <&anoc2_smmu 0x1a00>,
+			 <&anoc2_smmu 0x1a01>;
+		clocks = <&clock_rpmcc RPM_RF_CLK1_PIN>;
+		clock-names = "cxo_ref_clk_pin";
+		interrupts = <0 413 0>,   /* CE0 */
+			     <0 414 0>,   /* CE1 */
+			     <0 415 0>,   /* CE2 */
+			     <0 416 0>,   /* CE3 */
+			     <0 417 0>,   /* CE4 */
+			     <0 418 0>,   /* CE5 */
+			     <0 420 0>,   /* CE6 */
+			     <0 421 0>,   /* CE7 */
+			     <0 422 0>,   /* CE8 */
+			     <0 423 0>,   /* CE9 */
+			     <0 424 0>,   /* CE10 */
+			     <0 425 0>;   /* CE11 */
+		vdd-0.8-cx-mx-supply = <&pm660_l5>;
+		vdd-1.8-xo-supply = <&pm660_l9_pin_ctrl>;
+		vdd-1.3-rfa-supply = <&pm660_l6_pin_ctrl>;
+		vdd-3.3-ch0-supply = <&pm660_l19_pin_ctrl>;
+		qcom,vdd-0.8-cx-mx-config = <525000 950000>;
+		qcom,vdd-1.8-xo-config = <1750000 1900000>;
+		qcom,vdd-1.3-rfa-config = <1200000 1370000>;
+		qcom,vdd-3.3-ch0-config = <3200000 3400000>;
+		qcom,wlan-msa-memory = <0x100000>;
+		qcom,wlan-msa-fixed-region = <&wlan_msa_mem>;
+		qcom,smmu-s1-bypass;
+	};
+
+	qcom,lpass@15700000 {
+		compatible = "qcom,pil-tz-generic";
+		reg = <0x15700000 0x00100>;
+		interrupts = <0 162 1>;
+
+		vdd_cx-supply = <&pm660l_l9_level>;
+		qcom,proxy-reg-names = "vdd_cx";
+		qcom,vdd_cx-uV-uA = <RPM_SMD_REGULATOR_LEVEL_TURBO 100000>;
+
+		clocks = <&clock_rpmcc CXO_PIL_LPASS_CLK>;
+		clock-names = "xo";
+		qcom,proxy-clock-names = "xo";
+
+		qcom,pas-id = <1>;
+		qcom,proxy-timeout-ms = <10000>;
+		qcom,smem-id = <423>;
+		qcom,sysmon-id = <1>;
+		qcom,ssctl-instance-id = <0x14>;
+		qcom,firmware-name = "adsp";
+		memory-region = <&adsp_fw_mem>;
+
+		/* GPIO inputs from lpass */
+		qcom,gpio-err-fatal = <&smp2pgpio_ssr_smp2p_2_in 0 0>;
+		qcom,gpio-proxy-unvote = <&smp2pgpio_ssr_smp2p_2_in 2 0>;
+		qcom,gpio-err-ready = <&smp2pgpio_ssr_smp2p_2_in 1 0>;
+		qcom,gpio-stop-ack = <&smp2pgpio_ssr_smp2p_2_in 3 0>;
+
+		/* GPIO output to lpass */
+		qcom,gpio-force-stop = <&smp2pgpio_ssr_smp2p_2_out 0 0>;
+		status = "ok";
+	};
+
+	qcom,venus@cce0000 {
+		compatible = "qcom,pil-tz-generic";
+		reg = <0xcce0000 0x4000>;
+
+		vdd-supply = <&gdsc_venus>;
+		qcom,proxy-reg-names = "vdd";
+
+		clocks = <&clock_mmss MMSS_VIDEO_CORE_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_VIDEO_AHB_CLK>,
+			<&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_VIDEO_AXI_CLK>;
+		clock-names = "core_clk", "mnoc_ahb_clk", "iface_clk",
+			"noc_axi_clk", "bus_clk";
+		qcom,proxy-clock-names = "core_clk", "mnoc_ahb_clk",
+			"iface_clk", "noc_axi_clk", "bus_clk";
+
+		qcom,msm-bus,name = "pil-venus";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<63 512 0 0>,
+				<63 512 0 304000>;
+
+		qcom,pas-id = <9>;
+		qcom,proxy-timeout-ms = <100>;
+		qcom,firmware-name = "venus";
+		memory-region = <&venus_fw_mem>;
+		status = "ok";
+	};
+
+	pil_modem: qcom,mss@4080000 {
+		compatible = "qcom,pil-q6v55-mss";
+		reg = <0x4080000 0x100>,
+		      <0x1f63000 0x008>,
+		      <0x1f65000 0x008>,
+		      <0x1f64000 0x008>,
+		      <0x4180000 0x040>,
+		      <0x00179000 0x004>;
+		reg-names = "qdsp6_base", "halt_q6", "halt_modem",
+			    "halt_nc", "rmb_base", "restart_reg";
+
+		clocks = <&clock_rpmcc RPM_XO_CLK_SRC>,
+			 <&clock_gcc GCC_MSS_CFG_AHB_CLK>,
+			 <&clock_gcc GCC_BIMC_MSS_Q6_AXI_CLK>,
+			 <&clock_gcc GCC_BOOT_ROM_AHB_CLK>,
+			 <&clock_gcc GPLL0_OUT_MSSCC>,
+			 <&clock_gcc GCC_MSS_SNOC_AXI_CLK>,
+			 <&clock_gcc GCC_MSS_MNOC_BIMC_AXI_CLK>,
+			 <&clock_rpmcc RPM_QDSS_CLK>;
+		clock-names = "xo", "iface_clk", "bus_clk",
+			      "mem_clk", "gpll0_mss_clk", "snoc_axi_clk",
+			      "mnoc_axi_clk", "qdss_clk";
+		qcom,proxy-clock-names = "xo", "qdss_clk";
+		qcom,active-clock-names = "iface_clk", "bus_clk", "mem_clk",
+					 "gpll0_mss_clk", "snoc_axi_clk",
+					 "mnoc_axi_clk";
+
+		interrupts = <0 448 1>;
+		vdd_cx-supply = <&pm660l_s3_level>;
+		vdd_cx-voltage = <RPM_SMD_REGULATOR_LEVEL_TURBO>;
+		vdd_mx-supply = <&pm660l_s5_level>;
+		vdd_mx-uV = <RPM_SMD_REGULATOR_LEVEL_TURBO>;
+		qcom,firmware-name = "modem";
+		qcom,pil-self-auth;
+		qcom,sysmon-id = <0>;
+		qcom,ssctl-instance-id = <0x12>;
+		qcom,qdsp6v62-1-5;
+		memory-region = <&modem_fw_mem>;
+		qcom,mem-protect-id = <0xF>;
+
+		/* GPIO inputs from mss */
+		qcom,gpio-err-fatal = <&smp2pgpio_ssr_smp2p_1_in 0 0>;
+		qcom,gpio-err-ready = <&smp2pgpio_ssr_smp2p_1_in 1 0>;
+		qcom,gpio-proxy-unvote = <&smp2pgpio_ssr_smp2p_1_in 2 0>;
+		qcom,gpio-stop-ack = <&smp2pgpio_ssr_smp2p_1_in 3 0>;
+		qcom,gpio-shutdown-ack = <&smp2pgpio_ssr_smp2p_1_in 7 0>;
+
+		/* GPIO output to mss */
+		qcom,gpio-force-stop = <&smp2pgpio_ssr_smp2p_1_out 0 0>;
+		status = "ok";
+		qcom,mba-mem@0 {
+			compatible = "qcom,pil-mba-mem";
+			memory-region = <&pil_mba_mem>;
+		};
+	};
+
+	qcom,msm-rtb {
+		compatible = "qcom,msm-rtb";
+		qcom,rtb-size = <0x100000>;
+	};
+
+	qcom,mpm2-sleep-counter@10a3000 {
+		compatible = "qcom,mpm2-sleep-counter";
+		reg = <0x10a3000 0x1000>;
+		clock-frequency = <32768>;
+	};
+
+	qcom,msm-imem@146bf000 {
+		compatible = "qcom,msm-imem";
+		reg = <0x146bf000 0x1000>;
+		ranges = <0x0 0x146bf000 0x1000>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		mem_dump_table@10 {
+			compatible = "qcom,msm-imem-mem_dump_table";
+			reg = <0x10 8>;
+		};
+
+		dload_type@1c {
+			compatible = "qcom,msm-imem-dload-type";
+			reg = <0x1c 4>;
+		};
+
+		restart_reason@65c {
+			compatible = "qcom,msm-imem-restart_reason";
+			reg = <0x65c 4>;
+		};
+
+		boot_stats@6b0 {
+			compatible = "qcom,msm-imem-boot_stats";
+			reg = <0x6b0 32>;
+		};
+
+		kaslr_offset@6d0 {
+			compatible = "qcom,msm-imem-kaslr_offset";
+			reg = <0x6d0 12>;
+		};
+
+		pil@94c {
+			compatible = "qcom,msm-imem-pil";
+			reg = <0x94c 200>;
+		};
+
+		diag_dload@c8 {
+			compatible = "qcom,msm-imem-diag-dload";
+			reg = <0xc8 200>;
+		};
+	};
+
+	qcom,ghd {
+		compatible = "qcom,gladiator-hang-detect";
+		qcom,threshold-arr = <0x179d141c 0x179d1420
+				      0x179d1424 0x179d1428
+				      0x179d142c 0x179d1430>;
+		qcom,config-reg = <0x179d1434>;
+	};
+
+	qcom,msm-gladiator-v2@17900000 {
+		compatible = "qcom,msm-gladiator-v2";
+		reg = <0x17900000 0xe000>;
+		reg-names = "gladiator_base";
+		interrupts = <0 22 0>;
+		clock-names = "atb_clk";
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>;
+	};
+
+	cpu_pmu: cpu-pmu {
+		compatible = "arm,armv8-pmuv3";
+		qcom,irq-is-percpu;
+		interrupts = <1 6 4>;
+	};
+
+	qcom,chd_silver {
+		compatible = "qcom,core-hang-detect";
+		label = "silver";
+		qcom,threshold-arr = <0x179880b0 0x179980b0
+				      0x179a80b0 0x179b80b0>;
+		qcom,config-arr = <0x179880b8 0x179980b8
+				   0x179a80b8 0x179b80b8>;
+	};
+
+	qcom,chd_gold {
+		compatible = "qcom,core-hang-detect";
+		label = "gold";
+		qcom,threshold-arr = <0x178880b0 0x178980b0
+				      0x178a80b0 0x178b80b0>;
+		qcom,config-arr = <0x178880b8  0x178980b8
+				   0x178a80b8  0x178b80b8>;
+	};
+
+	jtag_fuse: jtagfuse@786040 {
+		compatible = "qcom,jtag-fuse-v4";
+		reg = <0x786040 0x8>;
+		reg-names = "fuse-base";
+	};
+
+	jtag_mm0: jtagmm@7840000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x7840000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU4>;
+	};
+
+	jtag_mm1: jtagmm@7940000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x7940000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU5>;
+	};
+
+	jtag_mm2: jtagmm@7a40000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x7a40000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU6>;
+	};
+
+	jtag_mm3: jtagmm@7b40000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x7b40000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU7>;
+	};
+
+	jtag_mm4: jtagmm@7c40000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x7c40000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU0>;
+	};
+
+	jtag_mm5: jtagmm@7d40000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x7d40000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU1>;
+	};
+
+	jtag_mm6: jtagmm@7e40000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x7e40000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU2>;
+	};
+
+	jtag_mm7: jtagmm@7f40000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x7f40000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU3>;
+	};
+
+	spmi_bus: qcom,spmi@800f000 {
+		compatible = "qcom,spmi-pmic-arb";
+		reg = <0x800f000 0x1000>,
+			<0x8400000 0x1000000>,
+			<0x9400000 0x1000000>,
+			<0xa400000 0x220000>,
+			<0x800a000 0x3000>;
+		reg-names = "core", "chnls", "obsrvr", "intr", "cnfg";
+		interrupt-names = "periph_irq";
+		interrupts = <GIC_SPI 326 IRQ_TYPE_NONE>;
+		qcom,ee = <0>;
+		qcom,channel = <0>;
+		qcom,reserved-chan = <511>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+		interrupt-controller;
+		#interrupt-cells = <4>;
+		cell-index = <0>;
+		status = "ok";
+	};
+
+	qcom_seecom: qseecom@86d00000 {
+		compatible = "qcom,qseecom";
+		reg = <0x86d00000 0x2200000>;
+		reg-names = "secapp-region";
+		qcom,hlos-num-ce-hw-instances = <1>;
+		qcom,hlos-ce-hw-instance = <0>;
+		qcom,qsee-ce-hw-instance = <0>;
+		qcom,disk-encrypt-pipe-pair = <2>;
+		qcom,support-fde;
+		qcom,fde-key-size;
+		qcom,no-clock-support;
+		qcom,msm-bus,name = "qseecom-noc";
+		qcom,msm-bus,num-cases = <4>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<55 512 0 0>,
+			<55 512 200000 400000>,
+			<55 512 300000 800000>,
+			<55 512 400000 1000000>;
+		clock-names = "core_clk_src", "core_clk",
+				"iface_clk", "bus_clk";
+		clocks = <&clock_rpmcc QSEECOM_CE1_CLK>,
+			<&clock_rpmcc QSEECOM_CE1_CLK>,
+			<&clock_rpmcc QSEECOM_CE1_CLK>,
+			<&clock_rpmcc QSEECOM_CE1_CLK>;
+		qcom,ce-opp-freq = <171430000>;
+		qcom,qsee-reentrancy-support = <2>;
+	};
+
+	qcom_cedev: qcedev@1de0000{
+		compatible = "qcom,qcedev";
+		reg = <0x1de0000 0x20000>,
+			<0x1dc4000 0x24000>;
+		reg-names = "crypto-base","crypto-bam-base";
+		interrupts = <0 206 0>;
+		qcom,bam-pipe-pair = <1>;
+		qcom,ce-hw-instance = <0>;
+		qcom,ce-device = <0>;
+		qcom,ce-hw-shared;
+		qcom,bam-ee = <0>;
+		qcom,msm-bus,name = "qcedev-noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<55 512 0 0>,
+				<55 512 393600 393600>;
+		clock-names = "core_clk_src", "core_clk",
+				"iface_clk", "bus_clk";
+		clocks = <&clock_rpmcc QCEDEV_CE1_CLK>,
+			<&clock_rpmcc QCEDEV_CE1_CLK>,
+			<&clock_rpmcc QCEDEV_CE1_CLK>,
+			<&clock_rpmcc QCEDEV_CE1_CLK>;
+		qcom,ce-opp-freq = <171430000>;
+	};
+
+	qcom_crypto: qcrypto@1de0000 {
+		compatible = "qcom,qcrypto";
+		reg = <0x1de0000 0x20000>,
+			<0x1dc4000 0x24000>;
+		reg-names = "crypto-base","crypto-bam-base";
+		interrupts = <0 206 0>;
+		qcom,bam-pipe-pair = <2>;
+		qcom,ce-hw-instance = <0>;
+		qcom,ce-device = <0>;
+		qcom,bam-ee = <0>;
+		qcom,ce-hw-shared;
+		qcom,clk-mgmt-sus-res;
+		qcom,msm-bus,name = "qcrypto-noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<55 512 0 0>,
+			<55 512 393600 393600>;
+		clock-names = "core_clk_src", "core_clk",
+				"iface_clk", "bus_clk";
+		clocks = <&clock_rpmcc QCRYPTO_CE1_CLK>,
+			<&clock_rpmcc QCRYPTO_CE1_CLK>,
+			<&clock_rpmcc QCRYPTO_CE1_CLK>,
+			<&clock_rpmcc QCRYPTO_CE1_CLK>;
+		qcom,ce-opp-freq = <171430000>;
+		qcom,use-sw-aes-cbc-ecb-ctr-algo;
+		qcom,use-sw-aes-xts-algo;
+		qcom,use-sw-aes-ccm-algo;
+		qcom,use-sw-ahash-algo;
+		qcom,use-sw-aead-algo;
+		qcom,use-sw-hmac-algo;
+	};
+
+	qcom_tzlog: tz-log@146bf720 {
+		compatible = "qcom,tz-log";
+		reg = <0x146bf720 0x3000>;
+		qcom,hyplog-enabled;
+		hyplog-address-offset = <0x410>;
+		hyplog-size-offset = <0x414>;
+	};
+
+	qcom_rng: qrng@793000 {
+		compatible = "qcom,msm-rng";
+		reg = <0x793000 0x1000>;
+		qcom,msm-rng-iface-clk;
+		qcom,no-qrng-config;
+		qcom,msm-bus,name = "msm-rng-noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<1 618 0 0>,    /* No vote */
+			<1 618 0 800>;  /* 100 KHz */
+		clocks = <&clock_gcc GCC_PRNG_AHB_CLK>;
+		clock-names = "iface_clk";
+	};
+};
+
+#include "sdm630-ion.dtsi"
+#include "msm-pm660.dtsi"
+#include "msm-pm660l.dtsi"
+#include "msm-pm660-rpm-regulator.dtsi"
+#include "msm-pm660l-rpm-regulator.dtsi"
+#include "sdm660-bus.dtsi"
+#include "sdm630-regulator.dtsi"
+#include "msm-gdsc-660.dtsi"
+#include "sdm660-common.dtsi"
+#include "msm-arm-smmu-630.dtsi"
+#include "msm-audio.dtsi"
+#include "sdm660-audio.dtsi"
+#include "sdm630-gpu.dtsi"
+#include "sdm630-camera.dtsi"
+#include "sdm630-pm.dtsi"
+#include "sdm660-vidc.dtsi"
+#include "sdm630-mdss.dtsi"
+#include "sdm630-mdss-pll.dtsi"
+
+&gdsc_usb30 {
+	status = "ok";
+};
+
+&gdsc_ufs {
+	status = "ok";
+};
+
+&gdsc_bimc_smmu {
+	clock-names = "bus_clk";
+	clocks = <&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>;
+	proxy-supply = <&gdsc_bimc_smmu>;
+	qcom,proxy-consumer-enable;
+	status = "ok";
+};
+
+&gdsc_hlos1_vote_lpass_adsp {
+	status = "ok";
+};
+
+&gdsc_venus {
+	status = "ok";
+};
+
+&gdsc_venus_core0 {
+	qcom,support-hw-trigger;
+	status = "ok";
+};
+
+&gdsc_camss_top {
+	status = "ok";
+};
+
+&gdsc_vfe0 {
+	parent-supply = <&gdsc_camss_top>;
+	status = "ok";
+};
+
+&gdsc_vfe1 {
+	parent-supply = <&gdsc_camss_top>;
+	status = "ok";
+};
+
+&gdsc_cpp {
+	parent-supply = <&gdsc_camss_top>;
+	qcom,support-hw-trigger;
+	status = "ok";
+};
+
+&gdsc_mdss {
+	proxy-supply = <&gdsc_mdss>;
+	qcom,proxy-consumer-enable;
+	status = "ok";
+};
+
+&gdsc_gpu_gx {
+	clock-names = "core_root_clk";
+	clocks = <&clock_gfx GFX3D_CLK_SRC>;
+	qcom,force-enable-root-clk;
+	parent-supply = <&gfx_vreg_corner>;
+	status = "ok";
+};
+
+&gdsc_gpu_cx {
+	status = "ok";
+};
+
+&clock_cpu {
+	lmh_dcvs0: qcom,limits-dcvs@0 {
+		compatible = "qcom,msm-hw-limits";
+		interrupts = <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>;
+	};
+
+	lmh_dcvs1: qcom,limits-dcvs@1 {
+		compatible = "qcom,msm-hw-limits";
+		interrupts = <GIC_SPI 38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&blsp2_uart1_hs {
+	status = "ok";
+};
+
+&pm660l_gpios {
+	/* GPIO 7 for VOL_UP */
+	gpio@c600 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+};
+
+&soc {
+	gpio_keys {
+		status = "okay";
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+		pinctrl-names = "tlmm_gpio_key_active","tlmm_gpio_key_suspend";
+		pinctrl-0 = <&gpio_key_active>;
+		pinctrl-1 = <&gpio_key_suspend>;
+
+		camera_focus {
+			label = "camera_focus";
+			gpios = <&tlmm 64 0x1>;
+			linux,input-type = <1>;
+			linux,code = <0x210>;
+			debounce-interval = <15>;
+		};
+
+		camera_snapshot {
+			label = "camera_snapshot";
+			gpios = <&tlmm 113 0x1>;
+			linux,input-type = <1>;
+			linux,code = <0x2fe>;
+			debounce-interval = <15>;
+		};
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm660l_gpios 7 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+
+	devfreq_spdm_cpu {
+		qcom,bw-dwnstep = <6750>;
+		qcom,max-vote = <6750>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-camera-sensor-mtp.dtsi b/arch/arm64/boot/dts/qcom/sdm636-camera-sensor-mtp.dtsi
new file mode 100644
index 000000000000..ab6a7aebd6b9
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-camera-sensor-mtp.dtsi
@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&pm660l_l8>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <3400000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&pm660l_l8>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <3400000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+
+	actuator2: qcom,actuator@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&pm660l_l8>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <3400000>;
+		qcom,cam-vreg-op-mode = <100000>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-cdp.dts b/arch/arm64/boot/dts/qcom/sdm636-cdp.dts
new file mode 100644
index 000000000000..47f5eba8f491
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-cdp.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660L CDP";
+	compatible = "qcom,sdm636-cdp", "qcom,sdm636", "qcom,cdp";
+	qcom,board-id = <1 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-cdp.dtsi b/arch/arm64/boot/dts/qcom/sdm636-cdp.dtsi
new file mode 100644
index 000000000000..279a542be7e4
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-cdp.dtsi
@@ -0,0 +1,27 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdm660-cdp.dtsi"
+/ {
+};
+
+&mdss_dsi {
+	hw-config = "single_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_nt35695b_truly_fhd_video>;
+};
+
+&mdss_dsi1 {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-headset-jacktype-no-cdp.dts b/arch/arm64/boot/dts/qcom/sdm636-headset-jacktype-no-cdp.dts
new file mode 100644
index 000000000000..4d47ac1ef517
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-headset-jacktype-no-cdp.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660L, Headset Jacktype NO, CDP";
+	compatible = "qcom,sdm636-cdp", "qcom,sdm636", "qcom,cdp";
+	qcom,board-id = <1 2>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-headset-jacktype-no-rcm.dts b/arch/arm64/boot/dts/qcom/sdm636-headset-jacktype-no-rcm.dts
new file mode 100644
index 000000000000..dfe066d1902c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-headset-jacktype-no-rcm.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660L, Headset Jacktype NO, RCM";
+	compatible = "qcom,sdm636-cdp", "qcom,sdm636", "qcom,cdp";
+	qcom,board-id = <21 2>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-internal-codec-cdp.dts b/arch/arm64/boot/dts/qcom/sdm636-internal-codec-cdp.dts
new file mode 100644
index 000000000000..725e9739a487
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-internal-codec-cdp.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-cdp.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660L Int. Audio Codec CDP";
+	compatible = "qcom,sdm636-cdp", "qcom,sdm636", "qcom,cdp";
+	qcom,board-id = <1 1>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-internal-codec-mtp.dts b/arch/arm64/boot/dts/qcom/sdm636-internal-codec-mtp.dts
new file mode 100644
index 000000000000..3630e329b13d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-internal-codec-mtp.dts
@@ -0,0 +1,30 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-mtp.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660L Int. Audio Codec MTP";
+	compatible = "qcom,sdm636-mtp", "qcom,sdm636", "qcom,mtp";
+	qcom,board-id = <8 1>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&int_codec {
+	qcom,model = "sdm660-snd-card-mtp";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-internal-codec-pm660a-cdp.dts b/arch/arm64/boot/dts/qcom/sdm636-internal-codec-pm660a-cdp.dts
new file mode 100644
index 000000000000..416cd3754a10
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-internal-codec-pm660a-cdp.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660A Int. Audio Codec CDP";
+	compatible = "qcom,sdm636-cdp", "qcom,sdm636", "qcom,cdp";
+	qcom,board-id = <1 1>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-internal-codec-pm660a-mtp.dts b/arch/arm64/boot/dts/qcom/sdm636-internal-codec-pm660a-mtp.dts
new file mode 100644
index 000000000000..e9ad9048c6e9
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-internal-codec-pm660a-mtp.dts
@@ -0,0 +1,31 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-mtp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660A Int. Audio Codec MTP";
+	compatible = "qcom,sdm636-mtp", "qcom,sdm636", "qcom,mtp";
+	qcom,board-id = <8 1>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&int_codec {
+	qcom,model = "sdm660-snd-card-mtp";
+	status = "okay";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-internal-codec-pm660a-rcm.dts b/arch/arm64/boot/dts/qcom/sdm636-internal-codec-pm660a-rcm.dts
new file mode 100644
index 000000000000..1812423ed948
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-internal-codec-pm660a-rcm.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660A Int. Audio Codec RCM";
+	compatible = "qcom,sdm636-cdp", "qcom,sdm636", "qcom,cdp";
+	qcom,board-id = <21 1>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-internal-codec-rcm.dts b/arch/arm64/boot/dts/qcom/sdm636-internal-codec-rcm.dts
new file mode 100644
index 000000000000..4bb67fa5bb71
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-internal-codec-rcm.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-cdp.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660L Int. Audio Codec RCM";
+	compatible = "qcom,sdm636-cdp", "qcom,sdm636", "qcom,cdp";
+	qcom,board-id = <21 1>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-mtp.dts b/arch/arm64/boot/dts/qcom/sdm636-mtp.dts
new file mode 100644
index 000000000000..7f08e44148b5
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-mtp.dts
@@ -0,0 +1,30 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-mtp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660L MTP";
+	compatible = "qcom,sdm636-mtp", "qcom,sdm636", "qcom,mtp";
+	qcom,board-id = <8 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-moist-cfg = <0>, <0>, <3>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-mtp.dtsi b/arch/arm64/boot/dts/qcom/sdm636-mtp.dtsi
new file mode 100644
index 000000000000..30174df3bd6a
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-mtp.dtsi
@@ -0,0 +1,28 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdm660-mtp.dtsi"
+#include "sdm636-camera-sensor-mtp.dtsi"
+/ {
+};
+
+&mdss_dsi {
+	hw-config = "single_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_nt35695b_truly_fhd_video>;
+};
+
+&mdss_dsi1 {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-pm660a-cdp.dts b/arch/arm64/boot/dts/qcom/sdm636-pm660a-cdp.dts
new file mode 100644
index 000000000000..84a28770d5a8
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-pm660a-cdp.dts
@@ -0,0 +1,54 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660A CDP";
+	compatible = "qcom,sdm636-cdp", "qcom,sdm636", "qcom,cdp";
+	qcom,board-id = <1 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&mdss_dsi {
+	hw-config = "single_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_rm67195_amoled_fhd_cmd>;
+	oledb-supply = <&pm660a_oledb>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+};
+
+&mdss_dsi1 {
+	status = "disabled";
+	oledb-supply = <&pm660a_oledb>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-pm660a-headset-jacktype-no-cdp.dts b/arch/arm64/boot/dts/qcom/sdm636-pm660a-headset-jacktype-no-cdp.dts
new file mode 100644
index 000000000000..b2517e32ae26
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-pm660a-headset-jacktype-no-cdp.dts
@@ -0,0 +1,38 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660A, Headset Jacktype NO, CDP";
+	compatible = "qcom,sdm636-cdp", "qcom,sdm636", "qcom,cdp";
+	qcom,board-id = <1 2>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&mdss_dsi0 {
+	oledb-supply = <&pm660a_oledb>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+};
+
+&mdss_dsi1 {
+	oledb-supply = <&pm660a_oledb>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-pm660a-headset-jacktype-no-rcm.dts b/arch/arm64/boot/dts/qcom/sdm636-pm660a-headset-jacktype-no-rcm.dts
new file mode 100644
index 000000000000..20b4365380bb
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-pm660a-headset-jacktype-no-rcm.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660A, Headset Jacktype NO, RCM";
+	compatible = "qcom,sdm636-cdp", "qcom,sdm636", "qcom,cdp";
+	qcom,board-id = <21 2>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-pm660a-mtp.dts b/arch/arm64/boot/dts/qcom/sdm636-pm660a-mtp.dts
new file mode 100644
index 000000000000..966a00af7216
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-pm660a-mtp.dts
@@ -0,0 +1,48 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-mtp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660A MTP";
+	compatible = "qcom,sdm636-mtp", "qcom,sdm636", "qcom,mtp";
+	qcom,board-id = <8 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&mdss_dsi {
+	hw-config = "single_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_rm67195_amoled_fhd_cmd>;
+	oledb-supply = <&pm660a_oledb>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+};
+
+&mdss_dsi1 {
+	status = "disabled";
+	oledb-supply = <&pm660a_oledb>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-moist-cfg = <0>, <0>, <3>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-pm660a-qrd.dts b/arch/arm64/boot/dts/qcom/sdm636-pm660a-qrd.dts
new file mode 100644
index 000000000000..d8b6c744a204
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-pm660a-qrd.dts
@@ -0,0 +1,56 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-qrd.dtsi"
+#include "msm-pm660a.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660A QRD";
+	compatible = "qcom,sdm636-qrd", "qcom,sdm636", "qcom,qrd";
+	qcom,board-id = <0x0012000b 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&pm660a_oledb {
+	status = "okay";
+	qcom,oledb-default-voltage-mv = <6400>;
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "single_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_rm67195_amoled_fhd_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+	qcom,platform-reset-gpio = <&tlmm 53 0>;
+	qcom,platform-te-gpio = <&tlmm 59 0>;
+};
+
+&dsi_rm67195_amoled_fhd_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_dcs";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <255>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_labibb_amoled>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-pm660a-rcm.dts b/arch/arm64/boot/dts/qcom/sdm636-pm660a-rcm.dts
new file mode 100644
index 000000000000..a23b074b4392
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-pm660a-rcm.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660A RCM";
+	compatible = "qcom,sdm636-cdp", "qcom,sdm636", "qcom,cdp";
+	qcom,board-id = <21 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-qrd.dts b/arch/arm64/boot/dts/qcom/sdm636-qrd.dts
new file mode 100644
index 000000000000..a2d22f281a5d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-qrd.dts
@@ -0,0 +1,87 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-qrd.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660L QRD";
+	compatible = "qcom,sdm636-qrd", "qcom,sdm636", "qcom,qrd";
+	qcom,board-id = <0x1000b 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_fb0 {
+	qcom,mdss-mixer-swap;
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt36850_truly_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 53 0>;
+	qcom,platform-te-gpio = <&tlmm 59 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt36850_truly_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 53 0>;
+	qcom,platform-te-gpio = <&tlmm 59 0>;
+};
+
+&dsi_dual_nt36850_truly_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&pm660l_wled {
+	qcom,led-strings-list = [00 01];
+};
+
+&soc {
+	hbtp {
+		compatible = "qcom,hbtp-input";
+		pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+		pinctrl-0 = <&ts_rst_active>;
+		pinctrl-1 = <&ts_rst_suspend>;
+		vcc_ana-supply = <&pm660l_l3>;
+		vcc_dig-supply = <&pm660_l13>;
+		qcom,afe-load = <20000>;
+		qcom,afe-vtg-min = <3008000>;
+		qcom,afe-vtg-max = <3008000>;
+		qcom,dig-load = <40000>;
+		qcom,dig-vtg-min = <1808000>;
+		qcom,dig-vtg-max = <1808000>;
+		qcom,fb-resume-delay-us = <10000>;
+		qcom,afe-force-power-on;
+		qcom,afe-power-on-delay-us = <1000>;
+		qcom,afe-power-off-delay-us = <6>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-qrd.dtsi b/arch/arm64/boot/dts/qcom/sdm636-qrd.dtsi
new file mode 100644
index 000000000000..8791e7420148
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-qrd.dtsi
@@ -0,0 +1,16 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdm660-qrd.dtsi"
+/ {
+};
+
diff --git a/arch/arm64/boot/dts/qcom/sdm636-rcm.dts b/arch/arm64/boot/dts/qcom/sdm636-rcm.dts
new file mode 100644
index 000000000000..5566610566f8
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-rcm.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660L RCM";
+	compatible = "qcom,sdm636-cdp", "qcom,sdm636", "qcom,cdp";
+	qcom,board-id = <21 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-usbc-audio-mtp.dts b/arch/arm64/boot/dts/qcom/sdm636-usbc-audio-mtp.dts
new file mode 100644
index 000000000000..90879cdf35cc
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-usbc-audio-mtp.dts
@@ -0,0 +1,31 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-mtp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660L, USBC Audio MTP";
+	compatible = "qcom,sdm636-mtp", "qcom,sdm636", "qcom,mtp";
+	qcom,board-id = <8 2>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-moist-cfg = <0>, <0>, <3>;
+	qcom,msm-mbhc-usbc-audio-supported = <1>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636-usbc-audio-rcm.dts b/arch/arm64/boot/dts/qcom/sdm636-usbc-audio-rcm.dts
new file mode 100644
index 000000000000..6fff927913fa
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636-usbc-audio-rcm.dts
@@ -0,0 +1,30 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm636.dtsi"
+#include "sdm636-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636 PM660 + PM660L, USBC Audio, RCM";
+	compatible = "qcom,sdm636-cdp", "qcom,sdm636", "qcom,cdp";
+	qcom,board-id = <21 3>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-usbc-audio-supported = <1>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm636.dtsi b/arch/arm64/boot/dts/qcom/sdm636.dtsi
new file mode 100644
index 000000000000..9d63a25c6350
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm636.dtsi
@@ -0,0 +1,46 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdm660.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 636";
+	compatible = "qcom,sdm636";
+	qcom,msm-id = <345 0x0>;
+};
+
+&soc {
+	/delete-node/ qcom,turing@1a300000;
+
+	/delete-node/ cti@7068000;
+	/delete-node/ turing_etm0;
+	funnel@6042000 {
+		ports {
+			/delete-node/ port@4;
+		};
+	};
+};
+
+&soc {
+	/delete-node/ arm,smmu-turing_q6@5180000;
+	qcom,msm_fastrpc {
+		/delete-node/ qcom,msm_fastrpc_compute_cb5;
+		/delete-node/ qcom,msm_fastrpc_compute_cb6;
+		/delete-node/ qcom,msm_fastrpc_compute_cb7;
+		/delete-node/ qcom,msm_fastrpc_compute_cb8;
+		/delete-node/ qcom,msm_fastrpc_compute_cb9;
+		/delete-node/ qcom,msm_fastrpc_compute_cb10;
+		/delete-node/ qcom,msm_fastrpc_compute_cb11;
+		/delete-node/ qcom,msm_fastrpc_compute_cb12;
+		/delete-node/ qcom,msm_fastrpc_compute_cb13;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm658-cdp.dts b/arch/arm64/boot/dts/qcom/sdm658-cdp.dts
new file mode 100644
index 000000000000..8569af157049
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm658-cdp.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm658.dtsi"
+#include "sdm660-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 658 PM660 + PM660L CDP";
+	compatible = "qcom,sdm658-cdp", "qcom,sdm658", "qcom,cdp";
+	qcom,board-id = <1 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm658-internal-codec-cdp.dts b/arch/arm64/boot/dts/qcom/sdm658-internal-codec-cdp.dts
new file mode 100644
index 000000000000..d0f5c14223ff
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm658-internal-codec-cdp.dts
@@ -0,0 +1,73 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm658.dtsi"
+#include "sdm660-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 658 PM660 + PM660L Int. Audio Codec CDP";
+	compatible = "qcom,sdm658-cdp", "qcom,sdm658", "qcom,cdp";
+	qcom,board-id = <1 1>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&slim_aud {
+	status = "disabled";
+};
+
+&dai_slim {
+	status = "disabled";
+};
+
+&wcd9335 {
+	status = "disabled";
+};
+
+&wcd934x_cdc {
+	status = "disabled";
+};
+
+&clock_audio {
+	status = "disabled";
+};
+
+&wcd_rst_gpio {
+	status = "disabled";
+};
+
+&wcd9xxx_intc {
+	status = "disabled";
+};
+
+&tasha_snd {
+	status = "disabled";
+};
+
+&tavil_snd {
+	status = "disabled";
+};
+
+&int_codec {
+	status = "okay";
+};
+
+&pmic_analog_codec {
+	status = "okay";
+};
+
+&msm_sdw_codec {
+	status = "okay";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm658-internal-codec-mtp.dts b/arch/arm64/boot/dts/qcom/sdm658-internal-codec-mtp.dts
new file mode 100644
index 000000000000..acec15e0615f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm658-internal-codec-mtp.dts
@@ -0,0 +1,74 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm658.dtsi"
+#include "sdm660-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 658 PM660 + PM660L Int. Audio Codec MTP";
+	compatible = "qcom,sdm658-mtp", "qcom,sdm658", "qcom,mtp";
+	qcom,board-id = <8 1>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&slim_aud {
+	status = "disabled";
+};
+
+&dai_slim {
+	status = "disabled";
+};
+
+&wcd9335 {
+	status = "disabled";
+};
+
+&wcd934x_cdc {
+	status = "disabled";
+};
+
+&clock_audio {
+	status = "disabled";
+};
+
+&wcd_rst_gpio {
+	status = "disabled";
+};
+
+&wcd9xxx_intc {
+	status = "disabled";
+};
+
+&tasha_snd {
+	status = "disabled";
+};
+
+&tavil_snd {
+	status = "disabled";
+};
+
+&int_codec {
+	qcom,model = "sdm660-snd-card-mtp";
+	status = "okay";
+};
+
+&pmic_analog_codec {
+	status = "okay";
+};
+
+&msm_sdw_codec {
+	status = "okay";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm658-internal-codec-pm660a-cdp.dts b/arch/arm64/boot/dts/qcom/sdm658-internal-codec-pm660a-cdp.dts
new file mode 100644
index 000000000000..b7f2e70ce962
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm658-internal-codec-pm660a-cdp.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm658.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 658 PM660 + PM660A Int. Audio Codec CDP";
+	compatible = "qcom,sdm658-cdp", "qcom,sdm658", "qcom,cdp";
+	qcom,board-id = <1 1>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm658-internal-codec-pm660a-mtp.dts b/arch/arm64/boot/dts/qcom/sdm658-internal-codec-pm660a-mtp.dts
new file mode 100644
index 000000000000..949d7ae7faa5
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm658-internal-codec-pm660a-mtp.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm658.dtsi"
+#include "sdm660-mtp.dtsi"
+#include "msm-pm660a.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 658 PM660 + PM660A Int. Audio Codec MTP";
+	compatible = "qcom,sdm658-mtp", "qcom,sdm658", "qcom,mtp";
+	qcom,board-id = <8 1>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm658-internal-codec-pm660a-rcm.dts b/arch/arm64/boot/dts/qcom/sdm658-internal-codec-pm660a-rcm.dts
new file mode 100644
index 000000000000..c0b3e3a6b34f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm658-internal-codec-pm660a-rcm.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm658.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 658 PM660 + PM660A Int. Audio Codec RCM";
+	compatible = "qcom,sdm658-cdp", "qcom,sdm658", "qcom,cdp";
+	qcom,board-id = <21 1>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm658-internal-codec-rcm.dts b/arch/arm64/boot/dts/qcom/sdm658-internal-codec-rcm.dts
new file mode 100644
index 000000000000..69a089c41c32
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm658-internal-codec-rcm.dts
@@ -0,0 +1,73 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm658.dtsi"
+#include "sdm660-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 658 PM660 + PM660L Int. Audio Codec RCM";
+	compatible = "qcom,sdm658-cdp", "qcom,sdm658", "qcom,cdp";
+	qcom,board-id = <21 1>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&slim_aud {
+	status = "disabled";
+};
+
+&dai_slim {
+	status = "disabled";
+};
+
+&wcd9335 {
+	status = "disabled";
+};
+
+&wcd934x_cdc {
+	status = "disabled";
+};
+
+&clock_audio {
+	status = "disabled";
+};
+
+&wcd_rst_gpio {
+	status = "disabled";
+};
+
+&wcd9xxx_intc {
+	status = "disabled";
+};
+
+&tasha_snd {
+	status = "disabled";
+};
+
+&tavil_snd {
+	status = "disabled";
+};
+
+&int_codec {
+	status = "okay";
+};
+
+&pmic_analog_codec {
+	status = "okay";
+};
+
+&msm_sdw_codec {
+	status = "okay";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm658-mtp.dts b/arch/arm64/boot/dts/qcom/sdm658-mtp.dts
new file mode 100644
index 000000000000..2fbe9b0a6201
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm658-mtp.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm658.dtsi"
+#include "sdm660-mtp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 658 PM660 + PM660L MTP";
+	compatible = "qcom,sdm658-mtp", "qcom,sdm658", "qcom,mtp";
+	qcom,board-id = <8 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm658-pm660a-cdp.dts b/arch/arm64/boot/dts/qcom/sdm658-pm660a-cdp.dts
new file mode 100644
index 000000000000..39e2df958347
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm658-pm660a-cdp.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm658.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 658 PM660 + PM660A CDP";
+	compatible = "qcom,sdm658-cdp", "qcom,sdm658", "qcom,cdp";
+	qcom,board-id = <1 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm658-pm660a-mtp.dts b/arch/arm64/boot/dts/qcom/sdm658-pm660a-mtp.dts
new file mode 100644
index 000000000000..4d205ef403f4
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm658-pm660a-mtp.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm658.dtsi"
+#include "sdm660-mtp.dtsi"
+#include "msm-pm660a.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 658 PM660 + PM660A MTP";
+	compatible = "qcom,sdm658-mtp", "qcom,sdm658", "qcom,mtp";
+	qcom,board-id = <8 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm658-pm660a-qrd.dts b/arch/arm64/boot/dts/qcom/sdm658-pm660a-qrd.dts
new file mode 100644
index 000000000000..f1edf6b244a8
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm658-pm660a-qrd.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm658.dtsi"
+#include "sdm660-qrd.dtsi"
+#include "msm-pm660a.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 658 PM660 + PM660A QRD";
+	compatible = "qcom,sdm658-qrd", "qcom,sdm658", "qcom,qrd";
+	qcom,board-id = <0x1000b 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm658-pm660a-rcm.dts b/arch/arm64/boot/dts/qcom/sdm658-pm660a-rcm.dts
new file mode 100644
index 000000000000..e0ab5725dcd7
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm658-pm660a-rcm.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm658.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 658 PM660 + PM660A RCM";
+	compatible = "qcom,sdm658-cdp", "qcom,sdm658", "qcom,cdp";
+	qcom,board-id = <21 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm658-qrd.dts b/arch/arm64/boot/dts/qcom/sdm658-qrd.dts
new file mode 100644
index 000000000000..bd7d76ee1f6c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm658-qrd.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm658.dtsi"
+#include "sdm660-qrd.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 658 PM660 + PM660L QRD";
+	compatible = "qcom,sdm658-qrd", "qcom,sdm658", "qcom,qrd";
+	qcom,board-id = <0x1000b 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm658-rcm.dts b/arch/arm64/boot/dts/qcom/sdm658-rcm.dts
new file mode 100644
index 000000000000..67e03f2e2adb
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm658-rcm.dts
@@ -0,0 +1,25 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm658.dtsi"
+#include "sdm660-cdp.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 658 PM660 + PM660L RCM";
+	compatible = "qcom,sdm658-cdp", "qcom,sdm658", "qcom,cdp";
+	qcom,board-id = <21 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm658.dtsi b/arch/arm64/boot/dts/qcom/sdm658.dtsi
new file mode 100644
index 000000000000..3387482dbc18
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm658.dtsi
@@ -0,0 +1,82 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdm660.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 658";
+	compatible = "qcom,sdm658";
+	qcom,msm-id = <325 0x0>;
+
+	cpus {
+		/delete-node/ cpu@102;
+		/delete-node/ cpu@103;
+
+		cpu-map {
+			cluster1 {
+				/delete-node/ core2;
+				/delete-node/ core3;
+			};
+		};
+	};
+};
+
+&soc {
+	/delete-node/ jtagmm@7e40000;
+	/delete-node/ jtagmm@7f40000;
+	/delete-node/ etm@7e40000;
+	/delete-node/ etm@7f40000;
+	/delete-node/ cti@7e20000;
+	/delete-node/ cti@7f20000;
+
+	devfreq_memlat_4: qcom,arm-memlat-mon-4 {
+		qcom,cpulist = <&CPU4 &CPU5>;
+	};
+
+	cpuss_dump {
+		/delete-node/ qcom,l1_i_cache102;
+		/delete-node/ qcom,l1_i_cache103;
+		/delete-node/ qcom,l1_d_cache102;
+		/delete-node/ qcom,l1_d_cache103;
+		/delete-node/ qcom,l1_tlb_dump102;
+		/delete-node/ qcom,l1_tlb_dump103;
+	};
+
+	funnel@7b60000 {
+		ports {
+			/delete-node/ port@7;
+			/delete-node/ port@8;
+		};
+	};
+
+	qcom,msm-thermal {
+		qcom,synchronous-cluster-map = <0 4 &CPU0 &CPU1 &CPU2 &CPU3>,
+						<1 2 &CPU4 &CPU5>;
+	};
+
+	qcom,bcl {
+		qcom,bcl-hotplug-list = <&CPU4 &CPU5>;
+		qcom,bcl-soc-hotplug-list = <&CPU4 &CPU5>;
+	};
+
+	qcom,spm@178120000 {
+		qcom,cpu-vctl-list = <&CPU4 &CPU5>;
+	};
+
+	qcom,lpm-levels {
+		qcom,pm-cluster@0 {
+			qcom,pm-cluster@1 {
+				qcom,cpu = <&CPU4 &CPU5>;
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-audio.dtsi b/arch/arm64/boot/dts/qcom/sdm660-audio.dtsi
new file mode 100644
index 000000000000..402f19efd50d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-audio.dtsi
@@ -0,0 +1,280 @@
+/*
+ * Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdm660-wsa881x.dtsi"
+#include "sdm660-lpi.dtsi"
+
+&slim_aud {
+	status = "okay";
+	dai_slim: msm_dai_slim {
+		compatible = "qcom,msm-dai-slim";
+		elemental-addr = [ff ff ff fe 17 02];
+	};
+
+	wcd9335: tasha_codec {
+		compatible = "qcom,tasha-slim-pgd";
+		elemental-addr = [00 01 a0 01 17 02];
+
+		interrupt-parent = <&wcd9xxx_intc>;
+		interrupts = <0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
+			      17 18 19 20 21 22 23 24 25 26 27 28 29
+			      30>;
+
+		qcom,wcd-rst-gpio-node = <&wcd_rst_gpio>;
+
+		clock-names = "wcd_clk", "wcd_native_clk";
+		clocks = <&clock_audio AUDIO_PMI_CLK>,
+			<&clock_audio AUDIO_LPASS_MCLK>;
+
+		cdc-vdd-mic-bias-supply = <&pm660l_bob>;
+		qcom,cdc-vdd-mic-bias-voltage = <3300000 3300000>;
+		qcom,cdc-vdd-mic-bias-current = <30400>;
+
+		qcom,cdc-static-supplies = "cdc-vdd-mic-bias";
+
+		qcom,cdc-micbias1-mv = <1800>;
+		qcom,cdc-micbias2-mv = <1800>;
+		qcom,cdc-micbias3-mv = <1800>;
+		qcom,cdc-micbias4-mv = <1800>;
+
+		qcom,cdc-mclk-clk-rate = <9600000>;
+		qcom,cdc-slim-ifd = "tasha-slim-ifd";
+		qcom,cdc-slim-ifd-elemental-addr = [00 00 a0 01 17 02];
+		qcom,cdc-dmic-sample-rate = <4800000>;
+		qcom,cdc-mad-dmic-rate = <600000>;
+	};
+
+	wcd934x_cdc: tavil_codec {
+		compatible = "qcom,tavil-slim-pgd";
+		elemental-addr = [00 01 50 02 17 02];
+
+		interrupt-parent = <&wcd9xxx_intc>;
+		interrupts = <0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
+			      17 18 19 20 21 22 23 24 25 26 27 28 29
+			      30 31>;
+
+		qcom,wcd-rst-gpio-node = <&wcd_rst_gpio>;
+
+		clock-names = "wcd_clk";
+		clocks = <&clock_audio_lnbb AUDIO_PMIC_LNBB_CLK>;
+
+		cdc-vdd-mic-bias-supply = <&pm660l_bob>;
+		qcom,cdc-vdd-mic-bias-voltage = <3300000 3300000>;
+		qcom,cdc-vdd-mic-bias-current = <30400>;
+
+		qcom,cdc-static-supplies = "cdc-vdd-mic-bias";
+
+		qcom,cdc-micbias1-mv = <1800>;
+		qcom,cdc-micbias2-mv = <1800>;
+		qcom,cdc-micbias3-mv = <1800>;
+		qcom,cdc-micbias4-mv = <1800>;
+
+		qcom,cdc-mclk-clk-rate = <9600000>;
+		qcom,cdc-slim-ifd = "tavil-slim-ifd";
+		qcom,cdc-slim-ifd-elemental-addr = [00 00 50 02 17 02];
+		qcom,cdc-dmic-sample-rate = <4800000>;
+		qcom,cdc-mad-dmic-rate = <600000>;
+
+		qcom,wdsp-cmpnt-dev-name = "tavil_codec";
+
+		wcd_spi_0: wcd_spi {
+			compatible = "qcom,wcd-spi-v2";
+			qcom,master-bus-num = <7>;
+			qcom,chip-select = <0>;
+			qcom,max-frequency = <24000000>;
+			qcom,mem-base-addr = <0x100000>;
+		};
+
+		wcd_usbc_analog_en1_gpio: msm_cdc_pinctrl_usbc_audio_en1 {
+			compatible = "qcom,msm-cdc-pinctrl";
+			pinctrl-names = "aud_active", "aud_sleep";
+			pinctrl-0 = <&wcd_usbc_analog_en1_active>;
+			pinctrl-1 = <&wcd_usbc_analog_en1_idle>;
+		};
+
+		wcd_usbc_analog_en2n_gpio: msm_cdc_pinctrl_usbc_audio_en2 {
+			compatible = "qcom,msm-cdc-pinctrl";
+			pinctrl-names = "aud_active", "aud_sleep";
+			pinctrl-0 = <&wcd_usbc_analog_en2n_active>;
+			pinctrl-1 = <&wcd_usbc_analog_en2n_idle>;
+		};
+	};
+};
+
+&pm660l_3 {
+	pmic_analog_codec: analog-codec@f000 {
+		status = "disabled";
+		compatible = "qcom,pmic-analog-codec";
+		reg = <0xf000 0x200>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+		interrupt-parent = <&spmi_bus>;
+		interrupts = <0x3 0xf0 0x0 IRQ_TYPE_NONE>,
+				<0x3 0xf0 0x1 IRQ_TYPE_NONE>,
+				<0x3 0xf0 0x2 IRQ_TYPE_NONE>,
+				<0x3 0xf0 0x3 IRQ_TYPE_NONE>,
+				<0x3 0xf0 0x4 IRQ_TYPE_NONE>,
+				<0x3 0xf0 0x5 IRQ_TYPE_NONE>,
+				<0x3 0xf0 0x6 IRQ_TYPE_NONE>,
+				<0x3 0xf0 0x7 IRQ_TYPE_NONE>,
+				<0x3 0xf1 0x0 IRQ_TYPE_NONE>,
+				<0x3 0xf1 0x1 IRQ_TYPE_NONE>,
+				<0x3 0xf1 0x2 IRQ_TYPE_NONE>,
+				<0x3 0xf1 0x3 IRQ_TYPE_NONE>,
+				<0x3 0xf1 0x4 IRQ_TYPE_NONE>,
+				<0x3 0xf1 0x5 IRQ_TYPE_NONE>;
+		interrupt-names = "spk_cnp_int",
+				  "spk_clip_int",
+				  "spk_ocp_int",
+				  "ins_rem_det1",
+				  "but_rel_det",
+				  "but_press_det",
+				  "ins_rem_det",
+				  "mbhc_int",
+				  "ear_ocp_int",
+				  "hphr_ocp_int",
+				  "hphl_ocp_det",
+				  "ear_cnp_int",
+				  "hphr_cnp_int",
+				  "hphl_cnp_int";
+
+
+		cdc-vdda-cp-supply = <&pm660_s4>;
+		qcom,cdc-vdda-cp-voltage = <1900000 2050000>;
+		qcom,cdc-vdda-cp-current = <50000>;
+
+		cdc-vdd-pa-supply = <&pm660_s4>;
+		qcom,cdc-vdd-pa-voltage = <2040000 2040000>;
+		qcom,cdc-vdd-pa-current = <260000>;
+
+		cdc-vdd-mic-bias-supply = <&pm660l_l7>;
+		qcom,cdc-vdd-mic-bias-voltage = <3088000 3088000>;
+		qcom,cdc-vdd-mic-bias-current = <5000>;
+
+		qcom,cdc-mclk-clk-rate = <9600000>;
+
+		qcom,cdc-static-supplies = "cdc-vdda-cp",
+					   "cdc-vdd-pa";
+
+		qcom,cdc-on-demand-supplies = "cdc-vdd-mic-bias";
+
+		/*
+		 * Not marking address @ as driver searches this child
+		 * with name msm-dig-codec
+		 */
+		msm_digital_codec: msm-dig-codec {
+			compatible = "qcom,msm-digital-codec";
+			reg = <0x152c0000 0x0>;
+		};
+	};
+};
+
+&soc {
+	cdc_pdm_gpios: cdc_pdm_pinctrl {
+		compatible = "qcom,msm-cdc-pinctrl";
+		pinctrl-names = "aud_active", "aud_sleep";
+		pinctrl-0 = <&cdc_pdm_gpios_active &cdc_pdm_2_gpios_active>;
+		pinctrl-1 = <&cdc_pdm_gpios_sleep &cdc_pdm_2_gpios_sleep>;
+		qcom,lpi-gpios;
+	};
+
+	cdc_comp_gpios: cdc_comp_pinctrl {
+		compatible = "qcom,msm-cdc-pinctrl";
+		pinctrl-names = "aud_active", "aud_sleep";
+		pinctrl-0 = <&cdc_comp_gpios_active>;
+		pinctrl-1 = <&cdc_comp_gpios_sleep>;
+		qcom,lpi-gpios;
+	};
+
+	cdc_dmic_gpios: cdc_dmic_pinctrl {
+		compatible = "qcom,msm-cdc-pinctrl";
+		pinctrl-names = "aud_active", "aud_sleep";
+		pinctrl-0 = <&cdc_dmic12_gpios_active
+				&cdc_dmic34_gpios_active>;
+		pinctrl-1 = <&cdc_dmic12_gpios_sleep
+				&cdc_dmic34_gpios_sleep>;
+		qcom,lpi-gpios;
+	};
+
+	cdc_sdw_gpios: sdw_clk_data_pinctrl {
+	      compatible = "qcom,msm-cdc-pinctrl";
+	      pinctrl-names = "aud_active", "aud_sleep";
+	      pinctrl-0 = <&sdw_clk_active &sdw_data_active>;
+	      pinctrl-1 = <&sdw_clk_sleep &sdw_data_sleep>;
+	};
+
+	wsa_spkr_en1: wsa_spkr_en1_pinctrl {
+	      compatible = "qcom,msm-cdc-pinctrl";
+	      pinctrl-names = "aud_active", "aud_sleep";
+	      pinctrl-0 = <&spkr_1_sd_n_active>;
+	      pinctrl-1 = <&spkr_1_sd_n_sleep>;
+	};
+
+	wsa_spkr_en2: wsa_spkr_en2_pinctrl {
+	      compatible = "qcom,msm-cdc-pinctrl";
+	      pinctrl-names = "aud_active", "aud_sleep";
+	      pinctrl-0 = <&spkr_2_sd_n_active>;
+	      pinctrl-1 = <&spkr_2_sd_n_sleep>;
+	};
+
+	msm_sdw_codec: msm-sdw-codec@152c1000 {
+		status = "disabled";
+		compatible = "qcom,msm-sdw-codec";
+		reg = <0x152c1000 0x0>;
+		interrupts = <0 161 0>;
+		interrupt-names = "swr_master_irq";
+		qcom,cdc-sdw-gpios = <&cdc_sdw_gpios>;
+
+		swr_master {
+			compatible = "qcom,swr-wcd";
+			#address-cells = <2>;
+			#size-cells = <0>;
+
+			wsa881x_211_en: wsa881x_en@20170211 {
+				compatible = "qcom,wsa881x";
+				reg = <0x0 0x20170211>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_en1>;
+			};
+
+			wsa881x_212_en: wsa881x_en@20170212 {
+				compatible = "qcom,wsa881x";
+				reg = <0x0 0x20170212>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_en2>;
+			};
+
+			wsa881x_213_en: wsa881x_en@21170213 {
+				compatible = "qcom,wsa881x";
+				reg = <0x0 0x21170213>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_en1>;
+			};
+
+			wsa881x_214_en: wsa881x_en@21170214 {
+				compatible = "qcom,wsa881x";
+				reg = <0x0 0x21170214>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_en2>;
+			};
+		};
+	};
+};
+
+&pm660_gpios {
+	gpio@c200 {
+		status = "ok";
+		qcom,mode = <1>;
+		qcom,pull = <4>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <2>;
+		qcom,master-en = <1>;
+		qcom,out-strength = <2>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-blsp.dtsi b/arch/arm64/boot/dts/qcom/sdm660-blsp.dtsi
new file mode 100644
index 000000000000..555d9a285102
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-blsp.dtsi
@@ -0,0 +1,570 @@
+/*
+ * Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#include "sdm660-pinctrl.dtsi"
+
+/ {
+	aliases {
+		spi1 = &spi_1;
+		spi2 = &spi_2;
+		spi3 = &spi_3;
+		spi4 = &spi_4;
+		spi5 = &spi_5;
+		spi6 = &spi_6;
+		spi7 = &spi_7;
+		spi8 = &spi_8;
+		i2c1 = &i2c_1;
+		i2c2 = &i2c_2;
+		i2c3 = &i2c_3;
+		i2c4 = &i2c_4;
+		i2c5 = &i2c_5;
+		i2c6 = &i2c_6;
+		i2c7 = &i2c_7;
+		i2c8 = &i2c_8;
+	};
+};
+
+
+&soc {
+	i2c_1: i2c@c175000 { /* BLSP1 QUP1 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0xc175000  0x600>;
+		reg-names = "qup_phys_addr";
+		interrupt-names = "qup_irq";
+		interrupts = <0 95 0>;
+		dmas = <&dma_blsp1 4 64 0x20000020 0x20>,
+			<&dma_blsp1 5 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <86>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc GCC_BLSP1_AHB_CLK>,
+			 <&clock_gcc GCC_BLSP1_QUP1_I2C_APPS_CLK>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_1_active>;
+		pinctrl-1 = <&i2c_1_sleep>;
+		status = "disabled";
+	};
+
+	i2c_2: i2c@c176000 { /* BLSP1 QUP2 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0xc176000  0x600>;
+		reg-names = "qup_phys_addr";
+		interrupt-names = "qup_irq";
+		interrupts = <0 96 0>;
+		dmas = <&dma_blsp1 6 64 0x20000020 0x20>,
+			<&dma_blsp1 7 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <86>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc GCC_BLSP1_AHB_CLK>,
+			 <&clock_gcc GCC_BLSP1_QUP2_I2C_APPS_CLK>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_2_active>;
+		pinctrl-1 = <&i2c_2_sleep>;
+		status = "disabled";
+	};
+
+	i2c_3: i2c@c177000 { /* BLSP1 QUP3 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0xc177000  0x600>;
+		reg-names = "qup_phys_addr";
+		interrupt-names = "qup_irq";
+		interrupts = <0 97 0>;
+		dmas = <&dma_blsp1 8 64 0x20000020 0x20>,
+			<&dma_blsp1 9 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <86>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc GCC_BLSP1_AHB_CLK>,
+			 <&clock_gcc GCC_BLSP1_QUP3_I2C_APPS_CLK>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_3_active>;
+		pinctrl-1 = <&i2c_3_sleep>;
+		status = "disabled";
+	};
+
+	i2c_4: i2c@c178000 { /* BLSP1 QUP4 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0xc178000  0x600>;
+		reg-names = "qup_phys_addr";
+		interrupt-names = "qup_irq";
+		interrupts = <0 98 0>;
+		dmas = <&dma_blsp1 10 64 0x20000020 0x20>,
+			<&dma_blsp1 11 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <86>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc GCC_BLSP1_AHB_CLK>,
+			 <&clock_gcc GCC_BLSP1_QUP4_I2C_APPS_CLK>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_4_active>;
+		pinctrl-1 = <&i2c_4_sleep>;
+		status = "disabled";
+	};
+
+	i2c_5: i2c@c1b5000 { /* BLSP2 QUP1 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0xc1b5000  0x600>;
+		reg-names = "qup_phys_addr";
+		interrupt-names = "qup_irq";
+		interrupts = <0 101 0>;
+		dmas = <&dma_blsp2 4 64 0x20000020 0x20>,
+			<&dma_blsp2 5 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <84>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc GCC_BLSP2_AHB_CLK>,
+			 <&clock_gcc GCC_BLSP2_QUP1_I2C_APPS_CLK>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_5_active>;
+		pinctrl-1 = <&i2c_5_sleep>;
+		status = "disabled";
+	};
+
+	i2c_6: i2c@c1b6000 { /* BLSP2 QUP2 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0xc1b6000  0x600>;
+		reg-names = "qup_phys_addr";
+		interrupt-names = "qup_irq";
+		interrupts = <0 102 0>;
+		dmas = <&dma_blsp2 6 64 0x20000020 0x20>,
+			<&dma_blsp2 7 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <84>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc GCC_BLSP2_AHB_CLK>,
+			 <&clock_gcc GCC_BLSP2_QUP2_I2C_APPS_CLK>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_6_active>;
+		pinctrl-1 = <&i2c_6_sleep>;
+		status = "disabled";
+	};
+
+	i2c_7: i2c@c1b7000 { /* BLSP2 QUP3 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0xc1b7000  0x600>;
+		reg-names = "qup_phys_addr";
+		interrupt-names = "qup_irq";
+		interrupts = <0 103 0>;
+		dmas = <&dma_blsp2 8 64 0x20000020 0x20>,
+			<&dma_blsp2 9 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <84>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc GCC_BLSP2_AHB_CLK>,
+			 <&clock_gcc GCC_BLSP2_QUP3_I2C_APPS_CLK>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_7_active>;
+		pinctrl-1 = <&i2c_7_sleep>;
+		status = "disabled";
+	};
+
+	i2c_8: i2c@c1b8000 { /* BLSP2 QUP4 */
+		compatible = "qcom,i2c-msm-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0xc1b8000  0x600>;
+		reg-names = "qup_phys_addr";
+		interrupt-names = "qup_irq";
+		interrupts = <0 104 0>;
+		dmas = <&dma_blsp2 10 64 0x20000020 0x20>,
+			<&dma_blsp2 11 32 0x20000020 0x20>;
+		dma-names = "tx", "rx";
+		qcom,master-id = <84>;
+		qcom,clk-freq-out = <400000>;
+		qcom,clk-freq-in  = <19200000>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc GCC_BLSP2_AHB_CLK>,
+			 <&clock_gcc GCC_BLSP2_QUP4_I2C_APPS_CLK>;
+		pinctrl-names = "i2c_active", "i2c_sleep";
+		pinctrl-0 = <&i2c_8_active>;
+		pinctrl-1 = <&i2c_8_sleep>;
+		status = "disabled";
+	};
+
+	spi_1: spi@c175000 { /* BLSP1 QUP1 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xc175000 0x600>,
+		      <0xc144000 0x1f000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 95 0>, <0 238 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <4>;
+		qcom,bam-producer-pipe-index = <5>;
+		qcom,master-id = <86>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_1_active>;
+		pinctrl-1 = <&spi_1_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc GCC_BLSP1_AHB_CLK>,
+			 <&clock_gcc GCC_BLSP1_QUP1_SPI_APPS_CLK>;
+		status = "disabled";
+	};
+
+	spi_2: spi@c176000 { /* BLSP1 QUP2 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xc176000 0x600>,
+		      <0xc144000 0x1f000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 96 0>, <0 238 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <6>;
+		qcom,bam-producer-pipe-index = <7>;
+		qcom,master-id = <86>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_2_active>;
+		pinctrl-1 = <&spi_2_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc GCC_BLSP1_AHB_CLK>,
+			 <&clock_gcc GCC_BLSP1_QUP2_SPI_APPS_CLK>;
+		status = "disabled";
+	};
+
+	spi_3: spi@c177000 { /* BLSP1 QUP3 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xc177000 0x600>,
+		      <0xc144000 0x1f000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 97 0>, <0 238 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <8>;
+		qcom,bam-producer-pipe-index = <9>;
+		qcom,master-id = <86>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_3_active>;
+		pinctrl-1 = <&spi_3_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc GCC_BLSP1_AHB_CLK>,
+			 <&clock_gcc GCC_BLSP1_QUP3_SPI_APPS_CLK>;
+		status = "disabled";
+	};
+
+	spi_4: spi@c178000 { /* BLSP1 QUP4 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xc178000 0x600>,
+		      <0xc144000 0x1f000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 98 0>, <0 238 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <10>;
+		qcom,bam-producer-pipe-index = <11>;
+		qcom,master-id = <86>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_4_active>;
+		pinctrl-1 = <&spi_4_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc GCC_BLSP1_AHB_CLK>,
+			 <&clock_gcc GCC_BLSP1_QUP4_SPI_APPS_CLK>;
+		status = "disabled";
+	};
+
+	spi_5: spi@c1b5000 { /* BLSP2 QUP1 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xc1b5000 0x600>,
+		      <0xc184000 0x1f000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 101 0>, <0 239 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <4>;
+		qcom,bam-producer-pipe-index = <5>;
+		qcom,master-id = <84>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_5_active>;
+		pinctrl-1 = <&spi_5_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc GCC_BLSP2_AHB_CLK>,
+			 <&clock_gcc GCC_BLSP2_QUP1_SPI_APPS_CLK>;
+		status = "disabled";
+	};
+
+	spi_6: spi@c1b6000 { /* BLSP2 QUP2 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xc1b6000 0x600>,
+		      <0xc184000 0x1f000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 102 0>, <0 239 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <6>;
+		qcom,bam-producer-pipe-index = <7>;
+		qcom,master-id = <84>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_6_active>;
+		pinctrl-1 = <&spi_6_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc GCC_BLSP2_AHB_CLK>,
+			 <&clock_gcc GCC_BLSP2_QUP2_SPI_APPS_CLK>;
+		status = "disabled";
+	};
+
+	spi_7: spi@c1b7000 { /* BLSP2 QUP3 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xc1b7000 0x600>,
+		      <0xc184000 0x1f000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 103 0>, <0 239 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <8>;
+		qcom,bam-producer-pipe-index = <9>;
+		qcom,master-id = <84>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_7_active>;
+		pinctrl-1 = <&spi_7_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc GCC_BLSP2_AHB_CLK>,
+			 <&clock_gcc GCC_BLSP2_QUP3_SPI_APPS_CLK>;
+		status = "disabled";
+	};
+
+	spi_8: spi@c1b8000 { /* BLSP2 QUP4 */
+		compatible = "qcom,spi-qup-v2";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "spi_physical", "spi_bam_physical";
+		reg = <0xc1b8000 0x600>,
+		      <0xc184000 0x1f000>;
+		interrupt-names = "spi_irq", "spi_bam_irq";
+		interrupts = <0 104 0>, <0 239 0>;
+		spi-max-frequency = <50000000>;
+		qcom,use-bam;
+		qcom,ver-reg-exists;
+		qcom,bam-consumer-pipe-index = <10>;
+		qcom,bam-producer-pipe-index = <11>;
+		qcom,master-id = <84>;
+		qcom,use-pinctrl;
+		pinctrl-names = "spi_default", "spi_sleep";
+		pinctrl-0 = <&spi_8_active>;
+		pinctrl-1 = <&spi_8_sleep>;
+		clock-names = "iface_clk", "core_clk";
+		clocks = <&clock_gcc GCC_BLSP2_AHB_CLK>,
+			 <&clock_gcc GCC_BLSP2_QUP4_SPI_APPS_CLK>;
+		status = "disabled";
+	};
+
+	blsp1_uart1_hs: uart@c16f000 { /* BLSP1 UART1 */
+		compatible = "qcom,msm-hsuart-v14";
+		reg = <0xc16f000 0x200>,
+		    <0xc144000 0x1f000>;
+		reg-names = "core_mem", "bam_mem";
+		interrupt-names = "core_irq", "bam_irq", "wakeup_irq";
+		#address-cells = <0>;
+		interrupt-parent = <&blsp1_uart1_hs>;
+		interrupts = <0 1 2>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-map = <0 &intc 0 0 107 0
+			    1 &intc 0 0 238 0
+			    2 &tlmm 1 0>;
+
+		qcom,inject-rx-on-wakeup;
+		qcom,rx-char-to-inject = <0xfd>;
+
+		qcom,bam-tx-ep-pipe-index = <0>;
+		qcom,bam-rx-ep-pipe-index = <1>;
+		qcom,master-id = <86>;
+		clock-names = "core_clk", "iface_clk";
+		clocks = <&clock_gcc GCC_BLSP1_UART1_APPS_CLK>,
+		    <&clock_gcc GCC_BLSP1_AHB_CLK>;
+		pinctrl-names = "sleep", "default";
+		pinctrl-0 = <&blsp1_uart1_sleep>;
+		pinctrl-1 = <&blsp1_uart1_active>;
+
+		qcom,msm-bus,name = "buart1";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			    <86 512 0 0>,
+			    <86 512 500 800>;
+		status = "disabled";
+	};
+
+	blsp1_uart2_hs: uart@c170000 { /* BLSP1 UART2 */
+		compatible = "qcom,msm-hsuart-v14";
+		reg = <0xc170000 0x200>,
+		    <0xc144000 0x1f000>;
+		reg-names = "core_mem", "bam_mem";
+		interrupt-names = "core_irq", "bam_irq", "wakeup_irq";
+		#address-cells = <0>;
+		interrupt-parent = <&blsp1_uart2_hs>;
+		interrupts = <0 1 2>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-map = <0 &intc 0 0 108 0
+			    1 &intc 0 0 238 0
+			    2 &tlmm 5 0>;
+
+		qcom,inject-rx-on-wakeup;
+		qcom,rx-char-to-inject = <0xfd>;
+
+		qcom,bam-tx-ep-pipe-index = <2>;
+		qcom,bam-rx-ep-pipe-index = <3>;
+		qcom,master-id = <86>;
+		clock-names = "core_clk", "iface_clk";
+		clocks = <&clock_gcc GCC_BLSP1_UART2_APPS_CLK>,
+		    <&clock_gcc GCC_BLSP1_AHB_CLK>;
+		pinctrl-names = "sleep", "default";
+		pinctrl-0 = <&blsp1_uart2_sleep>;
+		pinctrl-1 = <&blsp1_uart2_active>;
+
+		qcom,msm-bus,name = "buart2";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			    <86 512 0 0>,
+			    <86 512 500 800>;
+		status = "disabled";
+	};
+
+	blsp2_uart1_hs: uart@c1af000 { /* BLSP2 UART1 */
+		compatible = "qcom,msm-hsuart-v14";
+		reg = <0xc1af000 0x200>,
+		    <0xc184000 0x1f000>;
+		reg-names = "core_mem", "bam_mem";
+		interrupt-names = "core_irq", "bam_irq", "wakeup_irq";
+		#address-cells = <0>;
+		interrupt-parent = <&blsp2_uart1_hs>;
+		interrupts = <0 1 2>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-map = <0 &intc 0 0 113 0
+			    1 &intc 0 0 239 0
+			    2 &tlmm 17 0>;
+
+		qcom,inject-rx-on-wakeup;
+		qcom,rx-char-to-inject = <0xfd>;
+
+		qcom,bam-tx-ep-pipe-index = <0>;
+		qcom,bam-rx-ep-pipe-index = <1>;
+		qcom,master-id = <84>;
+		clock-names = "core_clk", "iface_clk";
+		clocks = <&clock_gcc GCC_BLSP2_UART1_APPS_CLK>,
+		    <&clock_gcc GCC_BLSP2_AHB_CLK>;
+		pinctrl-names = "sleep", "default";
+		pinctrl-0 = <&blsp2_uart1_tx_sleep>,
+			 <&blsp2_uart1_rxcts_sleep>, <&blsp2_uart1_rfr_sleep>;
+		pinctrl-1 = <&blsp2_uart1_tx_active>,
+			<&blsp2_uart1_rxcts_active>, <&blsp2_uart1_rfr_active>;
+		qcom,msm-bus,name = "buart3";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			    <84 512 0 0>,
+			    <84 512 500 800>;
+		status = "disabled";
+	};
+
+	blsp2_uart2_hs: uart@c1b0000 { /* BLSP2 UART2 */
+		compatible = "qcom,msm-hsuart-v14";
+		reg = <0xc1b0000 0x200>,
+		    <0xc184000 0x1f000>;
+		reg-names = "core_mem", "bam_mem";
+		interrupt-names = "core_irq", "bam_irq", "wakeup_irq";
+		#address-cells = <0>;
+		interrupt-parent = <&blsp2_uart2_hs>;
+		interrupts = <0 1 2>;
+		#interrupt-cells = <1>;
+		interrupt-map-mask = <0xffffffff>;
+		interrupt-map = <0 &intc 0 0 114 0
+			    1 &intc 0 0 239 0
+			    2 &tlmm 25 0>;
+
+		qcom,inject-rx-on-wakeup;
+		qcom,rx-char-to-inject = <0xfd>;
+
+		qcom,bam-tx-ep-pipe-index = <2>;
+		qcom,bam-rx-ep-pipe-index = <3>;
+		qcom,master-id = <84>;
+		clock-names = "core_clk", "iface_clk";
+		clocks = <&clock_gcc GCC_BLSP2_UART2_APPS_CLK>,
+		    <&clock_gcc GCC_BLSP2_AHB_CLK>;
+		pinctrl-names = "sleep", "default";
+		pinctrl-0 = <&blsp2_uart2_sleep>;
+		pinctrl-1 = <&blsp2_uart2_active>;
+
+		qcom,msm-bus,name = "buart4";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			    <84 512 0 0>,
+			    <84 512 500 800>;
+		status = "disabled";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-bus.dtsi b/arch/arm64/boot/dts/qcom/sdm660-bus.dtsi
new file mode 100644
index 000000000000..6c956fc9b9d2
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-bus.dtsi
@@ -0,0 +1,1293 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/msm/msm-bus-ids.h>
+
+&soc {
+	ad_hoc_bus: ad-hoc-bus {
+		/*Version = 14 */
+		compatible = "qcom,msm-bus-device";
+		reg = <0x1620000 0x20000>,
+			<0x1000000 0x80000>,
+			<0x1500000 0x10000>,
+			<0x1700000 0x20000>,
+			<0x17900000 0xE000>,
+			<0x1740000 0x10000>,
+			<0x1740000 0x10000>;
+
+		reg-names = "snoc-base", "bimc-base", "cnoc-base",
+		"a2noc-base", "gnoc-base", "mmnoc-ahb-base", "mnoc-base";
+
+		/*Buses*/
+
+		fab_a2noc: fab-a2noc {
+			cell-id = <MSM_BUS_FAB_A2_NOC>;
+			label = "fab-a2noc";
+			qcom,fab-dev;
+			qcom,base-name = "a2noc-base";
+			qcom,bus-type = <1>;
+			qcom,qos-off = <4096>;
+			qcom,base-offset = <16384>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_rpmcc AGGR2_NOC_MSMBUS_CLK>,
+				<&clock_rpmcc AGGR2_NOC_MSMBUS_A_CLK>;
+			qcom,node-qos-clks {
+				clock-names =
+				"clk-ipa-clk",
+				"clk-ufs-axi-clk",
+				"clk-aggre2-ufs-axi-no-rate",
+				"clk-aggre2-usb3-axi-cfg-no-rate",
+				"clk-cfg-noc-usb2-axi-no-rate";
+				clocks =
+				<&clock_rpmcc RPM_IPA_CLK>,
+				<&clock_gcc GCC_UFS_AXI_CLK>,
+				<&clock_gcc GCC_AGGRE2_UFS_AXI_CLK>,
+				<&clock_gcc GCC_AGGRE2_USB3_AXI_CLK>,
+				<&clock_gcc GCC_CFG_NOC_USB2_AXI_CLK>;
+			};
+		};
+
+		fab_bimc: fab-bimc {
+			cell-id = <MSM_BUS_FAB_BIMC>;
+			label = "fab-bimc";
+			qcom,fab-dev;
+			qcom,base-name = "bimc-base";
+			qcom,bus-type = <2>;
+			qcom,util-fact = <153>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_rpmcc BIMC_MSMBUS_CLK>,
+				<&clock_rpmcc BIMC_MSMBUS_A_CLK>;
+		};
+
+		fab_cnoc: fab-cnoc {
+			cell-id = <MSM_BUS_FAB_CONFIG_NOC>;
+			label = "fab-cnoc";
+			qcom,fab-dev;
+			qcom,base-name = "cnoc-base";
+			qcom,bus-type = <1>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_rpmcc CNOC_MSMBUS_CLK>,
+				<&clock_rpmcc CNOC_MSMBUS_A_CLK>;
+		};
+
+		fab_gnoc: fab-gnoc {
+			cell-id = <MSM_BUS_FAB_GNOC>;
+			label = "fab-gnoc";
+			qcom,virt-dev;
+			qcom,base-name = "gnoc-base";
+		};
+
+		fab_mnoc: fab-mnoc {
+			cell-id = <MSM_BUS_FAB_MMSS_NOC>;
+			label = "fab-mnoc";
+			qcom,fab-dev;
+			qcom,base-name = "mnoc-base";
+			qcom,bus-type = <1>;
+			qcom,qos-off = <4096>;
+			qcom,base-offset = <20480>;
+			qcom,util-fact = <153>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+				<&clock_rpmcc MMSSNOC_AXI_A_CLK>;
+			qcom,node-qos-clks {
+				clock-names =
+				"clk-mmssnoc-axi-no-rate",
+				"clk-mmss-noc-cfg-ahb-no-rate";
+				clocks =
+				<&clock_rpmcc MMSSNOC_AXI_CLK>,
+				<&clock_gcc GCC_MMSS_NOC_CFG_AHB_CLK>;
+			};
+		};
+
+		fab_snoc: fab-snoc {
+			cell-id = <MSM_BUS_FAB_SYS_NOC>;
+			label = "fab-snoc";
+			qcom,fab-dev;
+			qcom,base-name = "snoc-base";
+			qcom,bus-type = <1>;
+			qcom,qos-off = <4096>;
+			qcom,base-offset = <24576>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_rpmcc SNOC_MSMBUS_CLK>,
+				<&clock_rpmcc SNOC_MSMBUS_A_CLK>;
+		};
+
+		fab_mnoc_ahb: fab-mnoc-ahb {
+			cell-id = <MSM_BUS_FAB_MMSS_AHB>;
+			label = "fab-mnoc-ahb";
+			qcom,fab-dev;
+			qcom,base-name = "mmnoc-ahb-base";
+			qcom,setrate-only-clk;
+			qcom,bus-type = <1>;
+			clock-names = "bus_clk", "bus_a_clk";
+			clocks = <&clock_mmss AHB_CLK_SRC >,
+			     <&clock_mmss AHB_CLK_SRC>;
+		};
+
+		/*Masters*/
+
+		mas_ipa: mas-ipa {
+			cell-id = <MSM_BUS_MASTER_IPA>;
+			label = "mas-ipa";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <3>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_IPA>;
+		};
+
+		mas_cnoc_a2noc: mas-cnoc-a2noc {
+			cell-id = <MSM_BUS_MASTER_CNOC_A2NOC>;
+			label = "mas-cnoc-a2noc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_CNOC_A2NOC>;
+			qcom,blacklist = <&slv_snoc_cnoc>;
+		};
+
+		mas_sdcc_1: mas-sdcc-1 {
+			cell-id = <MSM_BUS_MASTER_SDCC_1>;
+			label = "mas-sdcc-1";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SDCC_1>;
+		};
+
+		mas_sdcc_2: mas-sdcc-2 {
+			cell-id = <MSM_BUS_MASTER_SDCC_2>;
+			label = "mas-sdcc-2";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SDCC_2>;
+		};
+
+		mas_blsp_1: mas-blsp-1 {
+			cell-id = <MSM_BUS_MASTER_BLSP_1>;
+			label = "mas-blsp-1";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_BLSP_1>;
+		};
+
+		mas_blsp_2: mas-blsp-2 {
+			cell-id = <MSM_BUS_MASTER_BLSP_2>;
+			label = "mas-blsp-2";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_BLSP_2>;
+		};
+
+		mas_ufs: mas-ufs {
+			cell-id = <MSM_BUS_MASTER_UFS>;
+			label = "mas-ufs";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <4>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_UFS>;
+		};
+
+		mas_usb_hs: mas-usb-hs {
+			cell-id = <MSM_BUS_MASTER_USB_HS>;
+			label = "mas-usb-hs";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <1>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_USB_HS>;
+		};
+
+		mas_usb3: mas-usb3 {
+			cell-id = <MSM_BUS_MASTER_USB3>;
+			label = "mas-usb3";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <2>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_USB3>;
+		};
+
+		mas_crypto_c0: mas-crypto-c0 {
+			cell-id = <MSM_BUS_MASTER_CRYPTO_CORE0>;
+			label = "mas-crypto-c0";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,qport = <11>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_a2noc_snoc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_CRYPTO_CORE0>;
+		};
+
+		mas_gnoc_bimc: mas-gnoc-bimc {
+			cell-id = <MSM_BUS_MASTER_GNOC_BIMC>;
+			label = "mas-gnoc-bimc";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <2>;
+			qcom,ap-owned;
+			qcom,qport = <0>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_ebi>;
+			qcom,prio-lvl = <0>;
+			qcom,prio-rd = <0>;
+			qcom,prio-wr = <0>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_GNOC_BIMC>;
+		};
+
+		mas_oxili: mas-oxili {
+			cell-id = <MSM_BUS_MASTER_GRAPHICS_3D>;
+			label = "mas-oxili";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <2>;
+			qcom,ap-owned;
+			qcom,qport = <1>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_hmss_l3
+				 &slv_ebi &slv_bimc_snoc>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_GFX3D>;
+		};
+
+		mas_mnoc_bimc: mas-mnoc-bimc {
+			cell-id = <MSM_BUS_MNOC_BIMC_MAS>;
+			label = "mas-mnoc-bimc";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <2>;
+			qcom,ap-owned;
+			qcom,qport = <2>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_hmss_l3
+				 &slv_ebi &slv_bimc_snoc>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_MNOC_BIMC>;
+		};
+
+		mas_snoc_bimc: mas-snoc-bimc {
+			cell-id = <MSM_BUS_SNOC_BIMC_MAS>;
+			label = "mas-snoc-bimc";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <2>;
+			qcom,connections = <&slv_hmss_l3 &slv_ebi>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SNOC_BIMC>;
+		};
+
+		mas_pimem: mas-pimem {
+			cell-id = <MSM_BUS_MASTER_PIMEM>;
+			label = "mas-pimem";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <2>;
+			qcom,ap-owned;
+			qcom,qport = <4>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_hmss_l3 &slv_ebi>;
+			qcom,prio-lvl = <1>;
+			qcom,prio-rd = <1>;
+			qcom,prio-wr = <1>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_PIMEM>;
+		};
+
+		mas_snoc_cnoc: mas-snoc-cnoc {
+			cell-id = <MSM_BUS_SNOC_CNOC_MAS>;
+			label = "mas-snoc-cnoc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_clk_ctl
+				 &slv_qdss_cfg &slv_qm_cfg
+				 &slv_srvc_cnoc &slv_ufs_cfg
+				 &slv_tcsr &slv_a2noc_smmu_cfg
+				 &slv_snoc_cfg &slv_tlmm_south
+				 &slv_mpm &slv_cnoc_mnoc_mmss_cfg
+				 &slv_sdcc_2 &slv_sdcc_1
+				 &slv_spdm &slv_pmic_arb
+				 &slv_prng &slv_mss_cfg
+				 &slv_gpuss_cfg &slv_imem_cfg
+				 &slv_usb3_0 &slv_a2noc_cfg
+				 &slv_tlmm_north &slv_usb_hs
+				 &slv_pdm &slv_tlmm_center
+				 &slv_ahb2phy &slv_blsp_2
+				 &slv_blsp_1 &slv_pimem_cfg
+				 &slv_glm &slv_message_ram
+				 &slv_bimc_cfg &slv_cnoc_mnoc_cfg>;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SNOC_CNOC>;
+		};
+
+		mas_qdss_dap: mas-qdss-dap {
+			cell-id = <MSM_BUS_MASTER_QDSS_DAP>;
+			label = "mas-qdss-dap";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_clk_ctl
+				 &slv_qdss_cfg &slv_qm_cfg
+				 &slv_srvc_cnoc &slv_ufs_cfg
+				 &slv_tcsr &slv_a2noc_smmu_cfg
+				 &slv_snoc_cfg &slv_tlmm_south
+				 &slv_mpm &slv_cnoc_mnoc_mmss_cfg
+				 &slv_sdcc_2 &slv_sdcc_1
+				 &slv_spdm &slv_pmic_arb
+				 &slv_prng &slv_mss_cfg
+				 &slv_gpuss_cfg &slv_imem_cfg
+				 &slv_usb3_0 &slv_a2noc_cfg
+				 &slv_tlmm_north &slv_usb_hs
+				 &slv_pdm &slv_tlmm_center
+				 &slv_ahb2phy &slv_blsp_2
+				 &slv_blsp_1 &slv_pimem_cfg
+				 &slv_glm &slv_message_ram
+				 &slv_cnoc_a2noc &slv_bimc_cfg
+				 &slv_cnoc_mnoc_cfg>;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_QDSS_DAP>;
+		};
+
+		mas_apps_proc: mas-apps-proc {
+			cell-id = <MSM_BUS_MASTER_AMPSS_M0>;
+			label = "mas-apps-proc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_gnoc_snoc &slv_gnoc_bimc>;
+			qcom,bus-dev = <&fab_gnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_APPSS_PROC>;
+		};
+
+		mas_cnoc_mnoc_mmss_cfg: mas-cnoc-mnoc-mmss-cfg {
+			cell-id = <MSM_BUS_MASTER_CNOC_MNOC_MMSS_CFG>;
+			label = "mas-cnoc-mnoc-mmss-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_venus_throttle_cfg
+				 &slv_venus_cfg &slv_camera_throttle_cfg
+				 &slv_smmu_cfg &slv_camera_cfg &slv_csi_phy_cfg
+				 &slv_display_throttle_cfg &slv_display_cfg
+				 &slv_mmss_clk_cfg &slv_mnoc_mpu_cfg
+				 &slv_misc_cfg &slv_mmss_clk_xpu_cfg>;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,mas-rpm-id = <ICBID_MASTER_CNOC_MNOC_MMSS_CFG>;
+		};
+
+		mas_cnoc_mnoc_cfg: mas-cnoc-mnoc-cfg {
+			cell-id = <MSM_BUS_MASTER_CNOC_MNOC_CFG>;
+			label = "mas-cnoc-mnoc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,connections = <&slv_srvc_mnoc>;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,mas-rpm-id = <ICBID_MASTER_CNOC_MNOC_CFG>;
+		};
+
+		mas_cpp: mas-cpp {
+			cell-id = <MSM_BUS_MASTER_CPP>;
+			label = "mas-cpp";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <4>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_CPP>;
+		};
+
+		mas_jpeg: mas-jpeg {
+			cell-id = <MSM_BUS_MASTER_JPEG>;
+			label = "mas-jpeg";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <6>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_JPEG>;
+		};
+
+		mas_mdp_p0: mas-mdp-p0 {
+			cell-id = <MSM_BUS_MASTER_MDP_PORT0>;
+			label = "mas-mdp-p0";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <0>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,vrail-comp = <50>;
+			qcom,mas-rpm-id = <ICBID_MASTER_MDP0>;
+		};
+
+		mas_mdp_p1: mas-mdp-p1 {
+			cell-id = <MSM_BUS_MASTER_MDP_PORT1>;
+			label = "mas-mdp-p1";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <1>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,vrail-comp = <50>;
+			qcom,mas-rpm-id = <ICBID_MASTER_MDP1>;
+		};
+
+		mas_venus: mas-venus {
+			cell-id = <MSM_BUS_MASTER_VIDEO_P0>;
+			label = "mas-venus";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <2>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_VIDEO>;
+		};
+
+		mas_vfe: mas-vfe {
+			cell-id = <MSM_BUS_MASTER_VFE>;
+			label = "mas-vfe";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <5>;
+			qcom,qos-mode = "bypass";
+			qcom,connections = <&slv_mnoc_bimc>;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_VFE>;
+		};
+
+		mas_qdss_etr: mas-qdss-etr {
+			cell-id = <MSM_BUS_MASTER_QDSS_ETR>;
+			label = "mas-qdss-etr";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <1>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_pimem
+				 &slv_imem &slv_snoc_cnoc
+				 &slv_snoc_bimc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_QDSS_ETR>;
+		};
+
+		mas_qdss_bam: mas-qdss-bam {
+			cell-id = <MSM_BUS_MASTER_QDSS_BAM>;
+			label = "mas-qdss-bam";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,qport = <0>;
+			qcom,qos-mode = "fixed";
+			qcom,connections = <&slv_pimem
+				 &slv_imem &slv_snoc_cnoc
+				 &slv_snoc_bimc>;
+			qcom,prio1 = <1>;
+			qcom,prio0 = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_QDSS_BAM>;
+		};
+
+		mas_snoc_cfg: mas-snoc-cfg {
+			cell-id = <MSM_BUS_MASTER_SNOC_CFG>;
+			label = "mas-snoc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,connections = <&slv_srvc_snoc>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_SNOC_CFG>;
+		};
+
+		mas_bimc_snoc: mas-bimc-snoc {
+			cell-id = <MSM_BUS_BIMC_SNOC_MAS>;
+			label = "mas-bimc-snoc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,connections = <&slv_pimem
+				 &slv_ipa &slv_qdss_stm
+				 &slv_lpass &slv_hmss
+				 &slv_cdsp &slv_snoc_cnoc
+				 &slv_wlan &slv_imem>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_BIMC_SNOC>;
+		};
+
+		mas_a2noc_snoc: mas-a2noc-snoc {
+			cell-id = <MSM_BUS_A2NOC_SNOC_MAS>;
+			label = "mas-a2noc-snoc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,connections = <&slv_pimem
+				 &slv_ipa &slv_qdss_stm
+				 &slv_lpass &slv_hmss
+				 &slv_snoc_bimc &slv_cdsp
+				 &slv_snoc_cnoc &slv_wlan
+				 &slv_imem>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_A2NOC_SNOC>;
+		};
+
+		/*Internal nodes*/
+
+		/*Slaves*/
+
+		slv_a2noc_snoc:slv-a2noc-snoc {
+			cell-id = <MSM_BUS_A2NOC_SNOC_SLV>;
+			label = "slv-a2noc-snoc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_a2noc>;
+			qcom,connections = <&mas_a2noc_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A2NOC_SNOC>;
+		};
+
+		slv_ebi:slv-ebi {
+			cell-id = <MSM_BUS_SLAVE_EBI_CH0>;
+			label = "slv-ebi";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <2>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_EBI1>;
+		};
+
+		slv_hmss_l3:slv-hmss-l3 {
+			cell-id = <MSM_BUS_SLAVE_HMSS_L3>;
+			label = "slv-hmss-l3";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_HMSS_L3>;
+		};
+
+		slv_bimc_snoc:slv-bimc-snoc {
+			cell-id = <MSM_BUS_BIMC_SNOC_SLV>;
+			label = "slv-bimc-snoc";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_bimc>;
+			qcom,connections = <&mas_bimc_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_BIMC_SNOC>;
+		};
+
+		slv_cnoc_a2noc:slv-cnoc-a2noc {
+			cell-id = <MSM_BUS_SLAVE_CNOC_A2NOC>;
+			label = "slv-cnoc-a2noc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,connections = <&mas_cnoc_a2noc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CNOC_A2NOC>;
+		};
+
+		slv_mpm:slv-mpm {
+			cell-id = <MSM_BUS_SLAVE_MPM>;
+			label = "slv-mpm";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MPM>;
+		};
+
+		slv_pmic_arb:slv-pmic-arb {
+			cell-id = <MSM_BUS_SLAVE_PMIC_ARB>;
+			label = "slv-pmic-arb";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PMIC_ARB>;
+		};
+
+		slv_tlmm_north:slv-tlmm-north {
+			cell-id = <MSM_BUS_SLAVE_TLMM_NORTH>;
+			label = "slv-tlmm-north";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_TLMM_NORTH>;
+		};
+
+		slv_tcsr:slv-tcsr {
+			cell-id = <MSM_BUS_SLAVE_TCSR>;
+			label = "slv-tcsr";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_TCSR>;
+		};
+
+		slv_pimem_cfg:slv-pimem-cfg {
+			cell-id = <MSM_BUS_SLAVE_PIMEM_CFG>;
+			label = "slv-pimem-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PIMEM_CFG>;
+		};
+
+		slv_imem_cfg:slv-imem-cfg {
+			cell-id = <MSM_BUS_SLAVE_IMEM_CFG>;
+			label = "slv-imem-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_IMEM_CFG>;
+		};
+
+		slv_message_ram:slv-message-ram {
+			cell-id = <MSM_BUS_SLAVE_MESSAGE_RAM>;
+			label = "slv-message-ram";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MESSAGE_RAM>;
+		};
+
+		slv_glm:slv-glm {
+			cell-id = <MSM_BUS_SLAVE_GLM>;
+			label = "slv-glm";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_GLM>;
+		};
+
+		slv_bimc_cfg:slv-bimc-cfg {
+			cell-id = <MSM_BUS_SLAVE_BIMC_CFG>;
+			label = "slv-bimc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_BIMC_CFG>;
+		};
+
+		slv_prng:slv-prng {
+			cell-id = <MSM_BUS_SLAVE_PRNG>;
+			label = "slv-prng";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PRNG>;
+		};
+
+		slv_spdm:slv-spdm {
+			cell-id = <MSM_BUS_SLAVE_SPDM_WRAPPER>;
+			label = "slv-spdm";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SPDM_WRAPPER>;
+		};
+
+		slv_qdss_cfg:slv-qdss-cfg {
+			cell-id = <MSM_BUS_SLAVE_QDSS_CFG>;
+			label = "slv-qdss-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_QDSS_CFG>;
+		};
+
+		slv_cnoc_mnoc_cfg:slv-cnoc-mnoc-cfg {
+			cell-id = <MSM_BUS_SLAVE_CNOC_MNOC_CFG>;
+			label = "slv-cnoc-mnoc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,connections = <&mas_cnoc_mnoc_cfg>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CNOC_MNOC_CFG>;
+		};
+
+		slv_snoc_cfg:slv-snoc-cfg {
+			cell-id = <MSM_BUS_SLAVE_SNOC_CFG>;
+			label = "slv-snoc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SNOC_CFG>;
+		};
+
+		slv_qm_cfg:slv-qm-cfg {
+			cell-id = <MSM_BUS_SLAVE_QM_CFG>;
+			label = "slv-qm-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_QM_CFG>;
+		};
+
+		slv_clk_ctl:slv-clk-ctl {
+			cell-id = <MSM_BUS_SLAVE_CLK_CTL>;
+			label = "slv-clk-ctl";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CLK_CTL>;
+		};
+
+		slv_mss_cfg:slv-mss-cfg {
+			cell-id = <MSM_BUS_SLAVE_CNOC_MSS>;
+			label = "slv-mss-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CNOC_MSS>;
+		};
+
+		slv_tlmm_south:slv-tlmm-south {
+			cell-id = <MSM_BUS_SLAVE_TLMM_SOUTH>;
+			label = "slv-tlmm-south";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_TLMM_SOUTH>;
+		};
+
+		slv_ufs_cfg:slv-ufs-cfg {
+			cell-id = <MSM_BUS_SLAVE_UFS_CFG>;
+			label = "slv-ufs-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_UFS_CFG>;
+		};
+
+		slv_a2noc_cfg:slv-a2noc-cfg {
+			cell-id = <MSM_BUS_SLAVE_A2NOC_CFG>;
+			label = "slv-a2noc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A2NOC_CFG>;
+		};
+
+		slv_a2noc_smmu_cfg:slv-a2noc-smmu-cfg {
+			cell-id = <MSM_BUS_SLAVE_A2NOC_SMMU_CFG>;
+			label = "slv-a2noc-smmu-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_A2NOC_SMMU_CFG>;
+		};
+
+		slv_gpuss_cfg:slv-gpuss-cfg {
+			cell-id = <MSM_BUS_SLAVE_GRAPHICS_3D_CFG>;
+			label = "slv-gpuss-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_GFX3D_CFG>;
+		};
+
+		slv_ahb2phy:slv-ahb2phy {
+			cell-id = <MSM_BUS_SLAVE_PCIE20_AHB2PHY>;
+			label = "slv-ahb2phy";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PCIE20_AHB2PHY>;
+		};
+
+		slv_blsp_1:slv-blsp-1 {
+			cell-id = <MSM_BUS_SLAVE_BLSP_1>;
+			label = "slv-blsp-1";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_BLSP_1>;
+		};
+
+		slv_sdcc_1:slv-sdcc-1 {
+			cell-id = <MSM_BUS_SLAVE_SDCC_1>;
+			label = "slv-sdcc-1";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SDCC_1>;
+		};
+
+		slv_sdcc_2:slv-sdcc-2 {
+			cell-id = <MSM_BUS_SLAVE_SDCC_2>;
+			label = "slv-sdcc-2";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SDCC_2>;
+		};
+
+		slv_tlmm_center:slv-tlmm-center {
+			cell-id = <MSM_BUS_SLAVE_TLMM_CENTER>;
+			label = "slv-tlmm-center";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_TLMM_CENTER>;
+		};
+
+		slv_blsp_2:slv-blsp-2 {
+			cell-id = <MSM_BUS_SLAVE_BLSP_2>;
+			label = "slv-blsp-2";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_BLSP_2>;
+		};
+
+		slv_pdm:slv-pdm {
+			cell-id = <MSM_BUS_SLAVE_PDM>;
+			label = "slv-pdm";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PDM>;
+		};
+
+		slv_cnoc_mnoc_mmss_cfg:slv-cnoc-mnoc-mmss-cfg {
+			cell-id = <MSM_BUS_SLAVE_CNOC_MNOC_MMSS_CFG>;
+			label = "slv-cnoc-mnoc-mmss-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,connections = <&mas_cnoc_mnoc_mmss_cfg>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CNOC_MNOC_MMSS_CFG>;
+		};
+
+		slv_usb_hs:slv-usb-hs {
+			cell-id = <MSM_BUS_SLAVE_USB_HS>;
+			label = "slv-usb-hs";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_USB_HS>;
+		};
+
+		slv_usb3_0:slv-usb3-0 {
+			cell-id = <MSM_BUS_SLAVE_USB3>;
+			label = "slv-usb3-0";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_USB3_0>;
+		};
+
+		slv_srvc_cnoc:slv-srvc-cnoc {
+			cell-id = <MSM_BUS_SLAVE_SERVICE_CNOC>;
+			label = "slv-srvc-cnoc";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SERVICE_CNOC>;
+		};
+
+
+		slv_gnoc_bimc:slv-gnoc-bimc {
+			cell-id = <MSM_BUS_SLAVE_GNOC_BIMC>;
+			label = "slv-gnoc-bimc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_gnoc>;
+			qcom,connections = <&mas_gnoc_bimc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_GNOC_BIMC>;
+		};
+
+		slv_gnoc_snoc:slv-gnoc-snoc {
+			cell-id = <MSM_BUS_SLAVE_GNOC_SNOC>;
+			label = "slv-gnoc-snoc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_gnoc>;
+			qcom,connections = <&mas_gnoc_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_GNOC_SNOC>;
+		};
+
+		mas_gnoc_snoc: mas-gnoc-snoc {
+			cell-id = <MSM_BUS_MASTER_GNOC_SNOC>;
+			label = "mas-gnoc-snoc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,connections = <&slv_pimem
+				 &slv_ipa &slv_qdss_stm
+				 &slv_lpass &slv_hmss
+				 &slv_cdsp &slv_snoc_cnoc
+				 &slv_wlan &slv_imem>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,mas-rpm-id = <ICBID_MASTER_GNOC_SNOC>;
+		};
+
+		slv_camera_cfg:slv-camera-cfg {
+			cell-id = <MSM_BUS_SLAVE_CAMERA_CFG>;
+			label = "slv-camera-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CAMERA_CFG>;
+		};
+
+		slv_camera_throttle_cfg:slv-camera-throttle-cfg {
+			cell-id = <MSM_BUS_SLAVE_CAMERA_THROTTLE_CFG>;
+			label = "slv-camera-throttle-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CAMERA_THROTTLE_CFG>;
+		};
+
+		slv_misc_cfg:slv-misc-cfg {
+			cell-id = <MSM_BUS_SLAVE_MISC_CFG>;
+			label = "slv-misc-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MISC_CFG>;
+		};
+
+		slv_venus_throttle_cfg:slv-venus-throttle-cfg {
+			cell-id = <MSM_BUS_SLAVE_VENUS_THROTTLE_CFG>;
+			label = "slv-venus-throttle-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_VENUS_THROTTLE_CFG>;
+		};
+
+		slv_venus_cfg:slv-venus-cfg {
+			cell-id = <MSM_BUS_SLAVE_VENUS_CFG>;
+			label = "slv-venus-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_VENUS_CFG>;
+		};
+
+		slv_mmss_clk_xpu_cfg:slv-mmss-clk-xpu-cfg {
+			cell-id = <MSM_BUS_SLAVE_MMSS_CLK_XPU_CFG>;
+			label = "slv-mmss-clk-xpu-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MMSS_CLK_XPU_CFG>;
+		};
+
+		slv_mmss_clk_cfg:slv-mmss-clk-cfg {
+			cell-id = <MSM_BUS_SLAVE_MMSS_CLK_CFG>;
+			label = "slv-mmss-clk-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MMSS_CLK_CFG>;
+		};
+
+		slv_mnoc_mpu_cfg:slv-mnoc-mpu-cfg {
+			cell-id = <MSM_BUS_SLAVE_MNOC_MPU_CFG>;
+			label = "slv-mnoc-mpu-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MNOC_MPU_CFG>;
+		};
+
+		slv_display_cfg:slv-display-cfg {
+			cell-id = <MSM_BUS_SLAVE_DISPLAY_CFG>;
+			label = "slv-display-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_DISPLAY_CFG>;
+		};
+
+		slv_csi_phy_cfg:slv-csi-phy-cfg {
+			cell-id = <MSM_BUS_SLAVE_CSI_PHY_CFG>;
+			label = "slv-csi-phy-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CSI_PHY_CFG>;
+		};
+
+		slv_display_throttle_cfg:slv-display-throttle-cfg {
+			cell-id = <MSM_BUS_SLAVE_DISPLAY_THROTTLE_CFG>;
+			label = "slv-display-throttle-cfg";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_DISPLAY_THROTTLE_CFG>;
+		};
+
+		slv_smmu_cfg:slv-smmu-cfg {
+			cell-id = <MSM_BUS_SLAVE_MMSS_SMMU_CFG>;
+			label = "slv-smmu-cfg";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MMSS_SMMU_CFG>;
+		};
+
+		slv_mnoc_bimc:slv-mnoc-bimc {
+			cell-id = <MSM_BUS_MNOC_BIMC_SLV>;
+			label = "slv-mnoc-bimc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <2>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc>;
+			qcom,connections = <&mas_mnoc_bimc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_MNOC_BIMC>;
+			qcom,enable-only-clk;
+			clock-names = "node_clk";
+			clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>;
+		};
+
+		slv_srvc_mnoc:slv-srvc-mnoc {
+			cell-id = <MSM_BUS_SLAVE_SERVICE_MNOC>;
+			label = "slv-srvc-mnoc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_mnoc_ahb>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SERVICE_MNOC>;
+		};
+
+		slv_hmss:slv-hmss {
+			cell-id = <MSM_BUS_SLAVE_APPSS>;
+			label = "slv-hmss";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_APPSS>;
+		};
+
+		slv_lpass:slv-lpass {
+			cell-id = <MSM_BUS_SLAVE_LPASS>;
+			label = "slv-lpass";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_LPASS>;
+		};
+
+		slv_wlan:slv-wlan {
+			cell-id = <MSM_BUS_SLAVE_WLAN>;
+			label = "slv-wlan";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_WLAN>;
+		};
+
+		slv_cdsp:slv-cdsp {
+			cell-id = <MSM_BUS_SLAVE_CDSP>;
+			label = "slv-cdsp";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_CDSP>;
+		};
+
+		slv_ipa:slv-ipa {
+			cell-id = <MSM_BUS_SLAVE_IPA_CFG>;
+			label = "slv-ipa";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,ap-owned;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_IPA_CFG>;
+		};
+
+		slv_snoc_bimc:slv-snoc-bimc {
+			cell-id = <MSM_BUS_SNOC_BIMC_SLV>;
+			label = "slv-snoc-bimc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,connections = <&mas_snoc_bimc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SNOC_BIMC>;
+		};
+
+		slv_snoc_cnoc:slv-snoc-cnoc {
+			cell-id = <MSM_BUS_SNOC_CNOC_SLV>;
+			label = "slv-snoc-cnoc";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,connections = <&mas_snoc_cnoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SNOC_CNOC>;
+		};
+
+		slv_imem:slv-imem {
+			cell-id = <MSM_BUS_SLAVE_OCIMEM>;
+			label = "slv-imem";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_IMEM>;
+		};
+
+		slv_pimem:slv-pimem {
+			cell-id = <MSM_BUS_SLAVE_PIMEM>;
+			label = "slv-pimem";
+			qcom,buswidth = <8>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_PIMEM>;
+		};
+
+		slv_qdss_stm:slv-qdss-stm {
+			cell-id = <MSM_BUS_SLAVE_QDSS_STM>;
+			label = "slv-qdss-stm";
+			qcom,buswidth = <4>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_QDSS_STM>;
+		};
+
+		slv_srvc_snoc:slv-srvc-snoc {
+			cell-id = <MSM_BUS_SLAVE_SERVICE_SNOC>;
+			label = "slv-srvc-snoc";
+			qcom,buswidth = <16>;
+			qcom,agg-ports = <1>;
+			qcom,bus-dev = <&fab_snoc>;
+			qcom,slv-rpm-id = <ICBID_SLAVE_SERVICE_SNOC>;
+		};
+	};
+
+	devfreq_spdm_cpu {
+		compatible = "qcom,devfreq_spdm";
+		qcom,msm-bus,name = "devfreq_spdm";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<1 512 0 0>,
+				<1 512 0 0>;
+		qcom,msm-bus,active-only;
+		qcom,spdm-client = <0>;
+
+		qcom,bw-upstep = <450>;
+		qcom,bw-dwnstep = <8200>;
+		qcom,max-vote = <8200>;
+		qcom,up-step-multp = <2>;
+		qcom,spdm-interval = <30>;
+
+		qcom,ports = <24>;
+		qcom,alpha-up = <8>;
+		qcom,alpha-down = <15>;
+		qcom,bucket-size = <8>;
+
+		/*max pl1 freq, max pl2 freq*/
+		qcom,pl-freqs = <210000 610000>;
+
+		/* pl1 low, pl1 high, pl2 low, pl2 high, pl3 low, pl3 high */
+		qcom,reject-rate = <5000 5000 5000 5000 5000 5000>;
+		/* pl1 low, pl1 high, pl2 low, pl2 high, pl3 low, pl3 high */
+		qcom,response-time-us = <5000 5000 5000 5000 5000 5000>;
+
+		/* pl1 low, pl1 high, pl2 low, pl2 high, pl3 low, pl3 high */
+		qcom,cci-response-time-us = <10000 10000 10000
+						10000 10000 10000>;
+		qcom,max-cci-freq = <1036800>;
+	};
+
+	devfreq_spdm_gov {
+		compatible = "qcom,gov_spdm_hyp";
+		interrupt-names = "spdm-irq";
+		interrupts = <0 192 IRQ_TYPE_EDGE_RISING>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-camera-sensor-cdp.dtsi b/arch/arm64/boot/dts/qcom/sdm660-camera-sensor-cdp.dtsi
new file mode 100644
index 000000000000..476fedec35a4
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-camera-sensor-cdp.dtsi
@@ -0,0 +1,402 @@
+/*
+ * Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	led_flash0: qcom,camera-flash@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pm660l_flash0 &pm660l_flash1>;
+		qcom,torch-source = <&pm660l_torch0 &pm660l_torch1>;
+		qcom,switch-source = <&pm660l_switch0>;
+		status = "ok";
+	};
+
+	led_flash1: qcom,camera-flash@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pm660l_flash2>;
+		qcom,torch-source = <&pm660l_torch2>;
+		qcom,switch-source = <&pm660l_switch1>;
+		status = "ok";
+	};
+
+	cam_actuator_regulator: cam_actuator_fixed_regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "cam_actuator_regulator";
+		regulator-min-microvolt = <3600000>;
+		regulator-max-microvolt = <3600000>;
+		enable-active-high;
+		gpio = <&tlmm 50 0>;
+		vin-supply = <&pm660l_bob>;
+	};
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&cam_actuator_regulator>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <3600000>;
+		qcom,cam-vreg-max-voltage = <3600000>;
+		qcom,cam-vreg-op-mode = <0>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&cam_actuator_regulator>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <3600000>;
+		qcom,cam-vreg-max-voltage = <3600000>;
+		qcom,cam-vreg-op-mode = <0>;
+	};
+
+	actuator2: qcom,actuator@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&cam_actuator_regulator>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <3600000>;
+		qcom,cam-vreg-max-voltage = <3600000>;
+		qcom,cam-vreg-op-mode = <0>;
+	};
+
+	ois0: qcom,ois@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,ois";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&cam_actuator_regulator>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <3600000>;
+		qcom,cam-vreg-max-voltage = <3600000>;
+		qcom,cam-vreg-op-mode = <0>;
+		status = "disabled";
+	};
+
+	tof0: qcom,tof@29{
+		cell-index = <0>;
+		reg = <0x29>;
+		compatible = "st,stmvl53l0";
+		qcom,cci-master = <0>;
+		cam_laser-supply = <&cam_actuator_regulator>;
+		qcom,cam-vreg-name =  "cam_laser";
+		qcom,cam-vreg-min-voltage = <3600000>;
+		qcom,cam-vreg-max-voltage = <3600000>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_tof_active>;
+		pinctrl-1 = <&cam_tof_suspend>;
+		stm,irq-gpio = <&tlmm 45  0x2008>;
+		gpios = <&tlmm 42 0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "RNG_EN";
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				&cam_sensor_rear_active
+				&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_sensor_rear_suspend
+				&cam_actuator_vaf_suspend>;
+		gpios = <&tlmm 32 0>,
+			<&tlmm 46 0>,
+			<&pm660l_gpios 4 0>,
+			<&tlmm 51 0>,
+			<&tlmm 50 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-vaf = <4>;
+		qcom,gpio-req-tbl-num = <0 1 2 3 4>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA",
+					"CAM_VAF";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK0_CLK_SRC>,
+				<&clock_mmss MMSS_CAMSS_MCLK0_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				&cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				&cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 34 0>,
+		    <&tlmm 48 0>,
+		    <&pm660l_gpios 3 0>,
+		    <&tlmm 51 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK",
+					"CAM_RESET",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK2_CLK_SRC>,
+		    <&clock_mmss MMSS_CAMSS_MCLK2_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom2: qcom,eeprom@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active
+				&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend
+				&cam_actuator_vaf_suspend>;
+		gpios = <&tlmm 33 0>,
+			<&tlmm 47 0>,
+			<&pm660_gpios 3 0>,
+			<&tlmm 44 0>,
+			<&tlmm 50 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-vaf = <4>;
+		qcom,gpio-req-tbl-num = <0 1 2 3 4>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG",
+					"CAM_VANA",
+					"CAM_VAF";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK1_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK1_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <90>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,ois-src = <&ois0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				 &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				 &cam_sensor_rear_suspend>;
+		gpios = <&tlmm 32 0>,
+			<&tlmm 46 0>,
+			<&pm660l_gpios 4 0>,
+			<&tlmm 51 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK0_CLK_SRC>,
+				<&clock_mmss MMSS_CAMSS_MCLK0_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator1>;
+		qcom,eeprom-src = <&eeprom1>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 34 0>,
+			<&tlmm 48 0>,
+			<&pm660l_gpios 3 0>,
+			<&tlmm 51 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK",
+					  "CAM_RESET",
+					  "CAM_VDIG",
+					  "CAM_VANA";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK2_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK2_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,actuator-src = <&actuator2>;
+		qcom,eeprom-src = <&eeprom2>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 1350000>;
+		qcom,cam-vreg-op-mode = <105000 80000 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 33 0>,
+			<&tlmm 47 0>,
+			<&pm660l_gpios 3 0>,
+			<&tlmm 51 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-vana = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG",
+					"CAM_VANA";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK1_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK1_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
+
+&pm660l_gpios {
+	gpio@c300 { /* GPIO4 -CAMERA SENSOR 0 VDIG*/
+		qcom,mode = <1>;                /* Output */
+		qcom,pull = <5>;                /* No Pull */
+		qcom,vin-sel = <0>;             /* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;             /* GPIO */
+		qcom,invert = <0>;              /* Invert */
+		qcom,master-en = <1>;           /* Enable GPIO */
+		status = "ok";
+	};
+
+	gpio@c200 { /* GPIO3 -CAMERA SENSOR 2 VDIG*/
+		qcom,mode = <1>;                /* Output */
+		qcom,pull = <5>;                /* No Pull */
+		qcom,vin-sel = <0>;             /* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;             /* GPIO */
+		qcom,invert = <0>;              /* Invert */
+		qcom,master-en = <1>;           /* Enable GPIO */
+		status = "ok";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-camera-sensor-mtp.dtsi b/arch/arm64/boot/dts/qcom/sdm660-camera-sensor-mtp.dtsi
new file mode 100644
index 000000000000..11eb288804ff
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-camera-sensor-mtp.dtsi
@@ -0,0 +1,438 @@
+/*
+ * Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	led_flash0: qcom,camera-flash@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pm660l_flash0 &pm660l_flash1>;
+		qcom,torch-source = <&pm660l_torch0 &pm660l_torch1>;
+		qcom,switch-source = <&pm660l_switch0>;
+		status = "ok";
+	};
+
+	led_flash1: qcom,camera-flash@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pm660l_flash2>;
+		qcom,torch-source = <&pm660l_torch2>;
+		qcom,switch-source = <&pm660l_switch1>;
+		status = "ok";
+	};
+
+	cam_avdd_gpio_regulator: cam_avdd_fixed_regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "cam_avdd_gpio_regulator";
+		regulator-min-microvolt = <3600000>;
+		regulator-max-microvolt = <3600000>;
+		enable-active-high;
+		gpio = <&tlmm 51 0>;
+		vin-supply = <&pm660l_bob>;
+	};
+
+	cam_actuator_regulator: cam_actuator_fixed_regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "cam_actuator_regulator";
+		regulator-min-microvolt = <3600000>;
+		regulator-max-microvolt = <3600000>;
+		enable-active-high;
+		gpio = <&tlmm 50 0>;
+		vin-supply = <&pm660l_bob>;
+	};
+
+	cam_dvdd_gpio_regulator: cam_dvdd_fixed_regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "cam_dvdd_gpio_regulator";
+		regulator-min-microvolt = <1350000>;
+		regulator-max-microvolt = <1350000>;
+		enable-active-high;
+		gpio = <&pm660l_gpios 3 0>;
+		vin-supply = <&pm660_s5>;
+	};
+
+	cam_rear_dvdd_gpio_regulator: cam_rear_dvdd_fixed_regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "cam_rear_dvdd_gpio_regulator";
+		regulator-min-microvolt = <1350000>;
+		regulator-max-microvolt = <1350000>;
+		enable-active-high;
+		gpio = <&pm660l_gpios 4 0>;
+		vin-supply = <&pm660_s5>;
+	};
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&cam_actuator_regulator>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <3600000>;
+		qcom,cam-vreg-max-voltage = <3600000>;
+		qcom,cam-vreg-op-mode = <0>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&cam_actuator_regulator>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <3600000>;
+		qcom,cam-vreg-max-voltage = <3600000>;
+		qcom,cam-vreg-op-mode = <0>;
+	};
+
+	actuator2: qcom,actuator@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&cam_actuator_regulator>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <3600000>;
+		qcom,cam-vreg-max-voltage = <3600000>;
+		qcom,cam-vreg-op-mode = <0>;
+	};
+
+	ois0: qcom,ois@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,ois";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&cam_actuator_regulator>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <3600000>;
+		qcom,cam-vreg-max-voltage = <3600000>;
+		qcom,cam-vreg-op-mode = <0>;
+		status = "disabled";
+	};
+
+	tof0: qcom,tof@29{
+		cell-index = <0>;
+		reg = <0x29>;
+		compatible = "st,stmvl53l0";
+		qcom,cci-master = <0>;
+		cam_laser-supply = <&cam_actuator_regulator>;
+		qcom,cam-vreg-name =  "cam_laser";
+		qcom,cam-vreg-min-voltage = <3600000>;
+		qcom,cam-vreg-max-voltage = <3600000>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_tof_active>;
+		pinctrl-1 = <&cam_tof_suspend>;
+		stm,irq-gpio = <&tlmm 45  0x2008>;
+		gpios = <&tlmm 42 0>;
+		qcom,gpio-req-tbl-num = <0>;
+		qcom,gpio-req-tbl-flags = <0>;
+		qcom,gpio-req-tbl-label = "RNG_EN";
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&cam_rear_dvdd_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 0>;
+		qcom,cam-vreg-max-voltage = <1950000 0 0>;
+		qcom,cam-vreg-op-mode = <105000 0 0>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				&cam_sensor_rear_active
+				&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_sensor_rear_suspend
+				&cam_actuator_vaf_suspend>;
+		gpios = <&tlmm 32 0>,
+			<&tlmm 46 0>,
+			<&tlmm 50 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vaf = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0",
+					"CAM_VAF";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK0_CLK_SRC>,
+				<&clock_mmss MMSS_CAMSS_MCLK0_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&cam_dvdd_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 0>;
+		qcom,cam-vreg-max-voltage = <1950000 0 0>;
+		qcom,cam-vreg-op-mode = <105000 0 0>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+			&cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+			&cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 34 0>,
+		    <&tlmm 48 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-req-tbl-num = <0 1>;
+		qcom,gpio-req-tbl-flags = <1 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK",
+				"CAM_RESET";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK2_CLK_SRC>,
+		    <&clock_mmss MMSS_CAMSS_MCLK2_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom2: qcom,eeprom@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&pm660l_bob>;
+		cam_vdig-supply = <&cam_dvdd_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 3300000 0>;
+		qcom,cam-vreg-max-voltage = <1950000 3600000 0>;
+		qcom,cam-vreg-op-mode = <105000 80000 0>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active
+				&cam_actuator_vaf_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend
+				&cam_actuator_vaf_suspend>;
+		gpios = <&tlmm 33 0>,
+			<&tlmm 47 0>,
+			<&tlmm 44 0>,
+			<&tlmm 50 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vana = <2>;
+		qcom,gpio-vaf = <3>;
+		qcom,gpio-req-tbl-num = <0 1 2 3>;
+		qcom,gpio-req-tbl-flags = <1 0 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VANA",
+					"CAM_VAF";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK1_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK1_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <90>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,ois-src = <&ois0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&cam_rear_dvdd_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 0>;
+		qcom,cam-vreg-max-voltage = <1950000 0 0>;
+		qcom,cam-vreg-op-mode = <105000 0 0>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				 &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				 &cam_sensor_rear_suspend>;
+		gpios = <&tlmm 32 0>,
+			<&tlmm 46 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-req-tbl-num = <0 1>;
+		qcom,gpio-req-tbl-flags = <1 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK0",
+					"CAM_RESET0";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK0_CLK_SRC>,
+				<&clock_mmss MMSS_CAMSS_MCLK0_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator1>;
+		qcom,eeprom-src = <&eeprom1>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&cam_dvdd_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 0>;
+		qcom,cam-vreg-max-voltage = <1950000 0 0>;
+		qcom,cam-vreg-op-mode = <105000 0 0>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 34 0>,
+			<&tlmm 48 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-req-tbl-num = <0 1>;
+		qcom,gpio-req-tbl-flags = <1 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK",
+					  "CAM_RESET";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK2_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK2_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <90>;
+		qcom,actuator-src = <&actuator2>;
+		qcom,eeprom-src = <&eeprom2>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&cam_dvdd_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 0>;
+		qcom,cam-vreg-max-voltage = <1950000 0 0>;
+		qcom,cam-vreg-op-mode = <105000 0 0>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 33 0>,
+			<&tlmm 47 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-req-tbl-num = <0 1>;
+		qcom,gpio-req-tbl-flags = <1 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK1_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK1_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@3 {
+		cell-index = <3>;
+		compatible = "qcom,camera";
+		reg = <0x03>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <90>;
+		qcom,led-flash-src = <&led_flash1>;
+		qcom,actuator-src = <&actuator2>;
+		qcom,eeprom-src = <&eeprom2>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&cam_dvdd_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 0>;
+		qcom,cam-vreg-max-voltage = <1950000 0 0>;
+		qcom,cam-vreg-op-mode = <105000 0 0>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk3_active
+				 &cam_sensor_front_iris_active>;
+		pinctrl-1 = <&cam_sensor_mclk3_suspend
+				 &cam_sensor_front_iris_suspend>;
+		gpios = <&tlmm 35 0>,
+			<&tlmm 52 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-req-tbl-num = <0 1>;
+		qcom,gpio-req-tbl-flags = <1 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK3",
+					"CAM_RESET3";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		clocks = <&clock_mmss MCLK3_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK3_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
+
+&pm660l_gpios {
+	gpio@c300 { /* GPIO4 -CAMERA SENSOR 0 VDIG*/
+		qcom,mode = <1>;                /* Output */
+		qcom,pull = <5>;                /* No Pull */
+		qcom,vin-sel = <0>;             /* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;             /* GPIO */
+		qcom,invert = <0>;              /* Invert */
+		qcom,master-en = <1>;           /* Enable GPIO */
+		status = "ok";
+	};
+
+	gpio@c200 { /* GPIO3 -CAMERA SENSOR 2 VDIG*/
+		qcom,mode = <1>;                /* Output */
+		qcom,pull = <5>;                /* No Pull */
+		qcom,vin-sel = <0>;             /* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;             /* GPIO */
+		qcom,invert = <0>;              /* Invert */
+		qcom,master-en = <1>;           /* Enable GPIO */
+		status = "ok";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-camera-sensor-qrd.dtsi b/arch/arm64/boot/dts/qcom/sdm660-camera-sensor-qrd.dtsi
new file mode 100644
index 000000000000..6bccb320577b
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-camera-sensor-qrd.dtsi
@@ -0,0 +1,427 @@
+/*
+ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	led_flash0: qcom,camera-flash@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera-flash";
+		qcom,flash-source = <&pm660l_flash0 &pm660l_flash1>;
+		qcom,torch-source = <&pm660l_torch0 &pm660l_torch1>;
+		qcom,switch-source = <&pm660l_switch0>;
+		status = "ok";
+	};
+
+	cam_avdd_gpio_regulator:cam_avdd_fixed_regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "cam_vadd_gpio_regulator";
+		regulator-min-microvolt = <2800000>;
+		regulator-max-microvolt = <2800000>;
+		enable-active-high;
+		gpio = <&tlmm 51 0>;
+		vin-supply = <&pm660l_bob>;
+	};
+
+	cam_vaf_gpio_regulator:cam_vaf_fixed_regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "cam_vaf_gpio_regulator";
+		regulator-min-microvolt = <2800000>;
+		regulator-max-microvolt = <2800000>;
+		enable-active-high;
+		gpio = <&tlmm 50 0>;
+		vin-supply = <&pm660l_bob>;
+	};
+
+	cam_rear_dvdd_gpio_regulator: cam_rear_dvdd_fixed_regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "cam_rear_dvdd_gpio_regulator";
+		regulator-min-microvolt = <1350000>;
+		regulator-max-microvolt = <1350000>;
+		enable-active-high;
+		gpio = <&pm660l_gpios 4 0>;
+		vin-supply = <&pm660_s5>;
+	};
+};
+
+&tlmm {
+	cam_sensor_rear_active: cam_sensor_rear_active {
+		/* RESET */
+		mux {
+			pins = "gpio46";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio46";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_rear_suspend: cam_sensor_rear_suspend {
+		/* RESET */
+		mux {
+			pins = "gpio46";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio46";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_rear2_active: cam_sensor_rear2_active {
+		/* RESET */
+		mux {
+			pins = "gpio48";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio48";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_rear2_suspend: cam_sensor_rear2_suspend {
+		/* RESET */
+		mux {
+			pins = "gpio48";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio48";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_front_active: cam_sensor_front_active {
+		/* RESET */
+		mux {
+			pins = "gpio47";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio47";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+
+	cam_sensor_front_suspend: cam_sensor_front_suspend {
+		/* RESET */
+		mux {
+			pins = "gpio47";
+			function = "gpio";
+		};
+
+		config {
+			pins = "gpio47";
+			bias-disable; /* No PULL */
+			drive-strength = <2>; /* 2 MA */
+		};
+	};
+};
+
+&cci {
+	actuator0: qcom,actuator@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&cam_vaf_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <0>;
+	};
+
+	actuator1: qcom,actuator@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,actuator";
+		qcom,cci-master = <1>;
+		cam_vaf-supply = <&cam_vaf_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <0>;
+	};
+
+	ois0: qcom,ois@0 {
+		cell-index = <0>;
+		reg = <0x0>;
+		compatible = "qcom,ois";
+		qcom,cci-master = <0>;
+		cam_vaf-supply = <&cam_vaf_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vaf";
+		qcom,cam-vreg-min-voltage = <2800000>;
+		qcom,cam-vreg-max-voltage = <2800000>;
+		qcom,cam-vreg-op-mode = <0>;
+		status = "disabled";
+	};
+
+	eeprom0: qcom,eeprom@0 {
+		cell-index = <0>;
+		reg = <0>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&cam_rear_dvdd_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 0>;
+		qcom,cam-vreg-max-voltage = <1950000 0 0>;
+		qcom,cam-vreg-op-mode = <105000 0 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				&cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				&cam_sensor_rear_suspend>;
+		gpios = <&tlmm 32 0>,
+			<&tlmm 46 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-req-tbl-num = <0 1>;
+		qcom,gpio-req-tbl-flags = <1 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET0";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK0_CLK_SRC>,
+				<&clock_mmss MMSS_CAMSS_MCLK0_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom1: qcom,eeprom@1 {
+		cell-index = <1>;
+		reg = <0x1>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&cam_rear_dvdd_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 0>;
+		qcom,cam-vreg-max-voltage = <1950000 0 0>;
+		qcom,cam-vreg-op-mode = <105000 0 0>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 34 0>,
+			<&tlmm 48 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-req-tbl-num = <0 1>;
+		qcom,gpio-req-tbl-flags = <1 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK2_CLK_SRC>,
+		    <&clock_mmss MMSS_CAMSS_MCLK2_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	eeprom2: qcom,eeprom@2 {
+		cell-index = <2>;
+		reg = <0x2>;
+		compatible = "qcom,eeprom";
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 1352000>;
+		qcom,cam-vreg-max-voltage = <1950000 0 1352000>;
+		qcom,cam-vreg-op-mode = <105000 0 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 33 0>,
+			<&tlmm 47 0>,
+			<&pm660l_gpios 3 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK1_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK1_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@0 {
+		cell-index = <0>;
+		compatible = "qcom,camera";
+		reg = <0x0>;
+		qcom,csiphy-sd-index = <0>;
+		qcom,csid-sd-index = <0>;
+		qcom,mount-angle = <270>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator0>;
+		qcom,ois-src = <&ois0>;
+		qcom,eeprom-src = <&eeprom0>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&cam_rear_dvdd_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 0>;
+		qcom,cam-vreg-max-voltage = <1950000 0 0>;
+		qcom,cam-vreg-op-mode = <105000 0 0>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk0_active
+				 &cam_sensor_rear_active>;
+		pinctrl-1 = <&cam_sensor_mclk0_suspend
+				 &cam_sensor_rear_suspend>;
+		gpios = <&tlmm 32 0>,
+			<&tlmm 46 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-req-tbl-num = <0 1>;
+		qcom,gpio-req-tbl-flags = <1 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET0";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <0>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK0_CLK_SRC>,
+				<&clock_mmss MMSS_CAMSS_MCLK0_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@1 {
+		cell-index = <1>;
+		compatible = "qcom,camera";
+		reg = <0x1>;
+		qcom,csiphy-sd-index = <1>;
+		qcom,csid-sd-index = <1>;
+		qcom,mount-angle = <270>;
+		qcom,led-flash-src = <&led_flash0>;
+		qcom,actuator-src = <&actuator1>;
+		qcom,eeprom-src = <&eeprom1>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&cam_rear_dvdd_gpio_regulator>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 0>;
+		qcom,cam-vreg-max-voltage = <1950000 0 0>;
+		qcom,cam-vreg-op-mode = <105000 0 0>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk2_active
+				 &cam_sensor_rear2_active>;
+		pinctrl-1 = <&cam_sensor_mclk2_suspend
+				 &cam_sensor_rear2_suspend>;
+		gpios = <&tlmm 34 0>,
+			<&tlmm 48 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-req-tbl-num = <0 1>;
+		qcom,gpio-req-tbl-flags = <1 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK1",
+					  "CAM_RESET1";
+		qcom,sensor-position = <0>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK2_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK2_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+
+	qcom,camera@2 {
+		cell-index = <2>;
+		compatible = "qcom,camera";
+		reg = <0x02>;
+		qcom,csiphy-sd-index = <2>;
+		qcom,csid-sd-index = <2>;
+		qcom,mount-angle = <270>;
+		qcom,eeprom-src = <&eeprom2>;
+		cam_vio-supply = <&pm660_l11>;
+		cam_vana-supply = <&cam_avdd_gpio_regulator>;
+		cam_vdig-supply = <&pm660_s5>;
+		qcom,cam-vreg-name = "cam_vio", "cam_vana", "cam_vdig";
+		qcom,cam-vreg-min-voltage = <1780000 0 1350000>;
+		qcom,cam-vreg-max-voltage = <1950000 0 1350000>;
+		qcom,cam-vreg-op-mode = <105000 0 105000>;
+		qcom,gpio-no-mux = <0>;
+		pinctrl-names = "cam_default", "cam_suspend";
+		pinctrl-0 = <&cam_sensor_mclk1_active
+				 &cam_sensor_front_active>;
+		pinctrl-1 = <&cam_sensor_mclk1_suspend
+				 &cam_sensor_front_suspend>;
+		gpios = <&tlmm 33 0>,
+			<&tlmm 47 0>,
+			<&pm660l_gpios 3 0>;
+		qcom,gpio-reset = <1>;
+		qcom,gpio-vdig = <2>;
+		qcom,gpio-req-tbl-num = <0 1 2>;
+		qcom,gpio-req-tbl-flags = <1 0 0>;
+		qcom,gpio-req-tbl-label = "CAMIF_MCLK2",
+					"CAM_RESET2",
+					"CAM_VDIG";
+		qcom,sensor-position = <1>;
+		qcom,sensor-mode = <0>;
+		qcom,cci-master = <1>;
+		status = "ok";
+		clocks = <&clock_mmss MCLK1_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_MCLK1_CLK>;
+		clock-names = "cam_src_clk", "cam_clk";
+		qcom,clock-rates = <24000000 0>;
+	};
+};
+
+&pm660l_gpios {
+	gpio@c300 { /* GPIO4 -CAMERA SENSOR 0 VDIG*/
+		qcom,mode = <1>;                /* Output */
+		qcom,pull = <5>;                /* No Pull */
+		qcom,vin-sel = <0>;             /* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;             /* GPIO */
+		qcom,invert = <0>;              /* Invert */
+		qcom,master-en = <1>;           /* Enable GPIO */
+		status = "ok";
+	};
+
+	gpio@c200 { /* GPIO3 -CAMERA SENSOR 2 VDIG*/
+		qcom,mode = <1>;                /* Output */
+		qcom,pull = <5>;                /* No Pull */
+		qcom,vin-sel = <0>;             /* VIN1 GPIO_LV */
+		qcom,src-sel = <0>;             /* GPIO */
+		qcom,invert = <0>;              /* Invert */
+		qcom,master-en = <1>;           /* Enable GPIO */
+		status = "ok";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-camera.dtsi b/arch/arm64/boot/dts/qcom/sdm660-camera.dtsi
new file mode 100644
index 000000000000..8ad33a5cb68a
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-camera.dtsi
@@ -0,0 +1,876 @@
+/*
+ * Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	qcom,msm-cam@ca00000 {
+		compatible = "qcom,msm-cam";
+		reg = <0xca00000 0x4000>;
+		reg-names = "msm-cam";
+		status = "ok";
+		bus-vectors = "suspend", "svs", "nominal", "turbo";
+		qcom,bus-votes = <0 150000000 320000000 320000000>;
+		qcom,gpu-limit = <700000000>;
+	};
+
+	qcom,csiphy@c824000 {
+		cell-index = <0>;
+		compatible = "qcom,csiphy-v3.5", "qcom,csiphy";
+		reg = <0xc824000 0x1000>,
+				<0xca00120 0x4>;
+		reg-names = "csiphy", "csiphy_clk_mux";
+		interrupts = <0 78 0>;
+		interrupt-names = "csiphy";
+		gdscr-supply = <&gdsc_camss_top>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "gdscr", "bimc_smmu";
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss CSI0_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI0_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPHY_CSID0_CLK>,
+			<&clock_mmss CSI0PHYTIMER_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI0PHYTIMER_CLK>,
+			<&clock_mmss MMSS_CAMSS_ISPIF_AHB_CLK>,
+			<&clock_mmss CSIPHY_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSIPHY0_CLK>,
+			<&clock_mmss MMSS_CSIPHY_AHB2CRIF_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"csi_src_clk", "csi_clk", "cphy_csid_clk",
+			"csiphy_timer_src_clk", "csiphy_timer_clk",
+			"camss_ispif_ahb_clk", "csiphy_clk_src", "csiphy_clk",
+			"csiphy_ahb2crif";
+		qcom,clock-rates = <0 0 0 0 0 0 310000000 0 0 269333333 0
+			0 200000000 0 0>;
+		status = "ok";
+	};
+
+	qcom,csiphy@c825000 {
+		cell-index = <1>;
+		compatible = "qcom,csiphy-v3.5", "qcom,csiphy";
+		reg = <0xc825000 0x1000>,
+				<0xca00124 0x4>;
+		reg-names = "csiphy", "csiphy_clk_mux";
+		interrupts = <0 79 0>;
+		interrupt-names = "csiphy";
+		gdscr-supply = <&gdsc_camss_top>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "gdscr", "bimc_smmu";
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss CSI1_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI1_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPHY_CSID1_CLK>,
+			<&clock_mmss CSI1PHYTIMER_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI1PHYTIMER_CLK>,
+			<&clock_mmss MMSS_CAMSS_ISPIF_AHB_CLK>,
+			<&clock_mmss CSIPHY_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSIPHY1_CLK>,
+			<&clock_mmss MMSS_CSIPHY_AHB2CRIF_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"csi_src_clk", "csi_clk", "cphy_csid_clk",
+			"csiphy_timer_src_clk", "csiphy_timer_clk",
+			"camss_ispif_ahb_clk", "csiphy_clk_src", "csiphy_clk",
+			"csiphy_ahb2crif";
+		qcom,clock-rates = <0 0 0 0 0 0 310000000 0 0 269333333 0
+			0 200000000 0 0>;
+		status = "ok";
+	};
+
+	qcom,csiphy@c826000 {
+		cell-index = <2>;
+		compatible = "qcom,csiphy-v3.5", "qcom,csiphy";
+		reg = <0xc826000 0x1000>,
+				<0xca00128 0x4>;
+		reg-names = "csiphy", "csiphy_clk_mux";
+		interrupts = <0 80 0>;
+		interrupt-names = "csiphy";
+		gdscr-supply = <&gdsc_camss_top>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "gdscr", "bimc_smmu";
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss CSI2_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI2_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPHY_CSID2_CLK>,
+			<&clock_mmss CSI2PHYTIMER_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI2PHYTIMER_CLK>,
+			<&clock_mmss MMSS_CAMSS_ISPIF_AHB_CLK>,
+			<&clock_mmss CSIPHY_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSIPHY2_CLK>,
+			<&clock_mmss MMSS_CSIPHY_AHB2CRIF_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"csi_src_clk", "csi_clk", "cphy_csid_clk",
+			"csiphy_timer_src_clk", "csiphy_timer_clk",
+			"camss_ispif_ahb_clk", "csiphy_clk_src", "csiphy_clk",
+			"csiphy_ahb2crif";
+		qcom,clock-rates = <0 0 0 0 0 0 310000000 0 0 269333333 0
+			0 200000000 0 0>;
+		status = "ok";
+	};
+
+	qcom,csid@ca30000  {
+		cell-index = <0>;
+		compatible = "qcom,csid-v5.0", "qcom,csid";
+		reg = <0xca30000 0x400>;
+		reg-names = "csid";
+		interrupts = <0 296 0>;
+		interrupt-names = "csid";
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_ISPIF_AHB_CLK>,
+			<&clock_mmss CSI0_CLK_SRC>,
+			<&clock_mmss CSIPHY_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI0_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI0_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI0RDI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI0PIX_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPHY_CSID0_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csi_src_clk", "csiphy_clk_src",
+			"csi_clk", "csi_ahb_clk", "csi_rdi_clk",
+			"csi_pix_clk", "cphy_csid_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 0 310000000 200000000
+			0 0 0 0 0>;
+		status = "ok";
+	};
+
+	qcom,csid@ca30400 {
+		cell-index = <1>;
+		compatible = "qcom,csid-v5.0", "qcom,csid";
+		reg = <0xca30400 0x400>;
+		reg-names = "csid";
+		interrupts = <0 297 0>;
+		interrupt-names = "csid";
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_ISPIF_AHB_CLK>,
+			<&clock_mmss CSI1_CLK_SRC>,
+			<&clock_mmss CSIPHY_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI1_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI1_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI1RDI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI1PIX_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPHY_CSID1_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csi_src_clk", "csiphy_clk_src",
+			"csi_clk", "csi_ahb_clk", "csi_rdi_clk",
+			"csi_pix_clk", "cphy_csid_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 0 310000000 200000000
+			 0 0 0 0 0>;
+		status = "ok";
+	};
+
+	qcom,csid@ca30800 {
+		cell-index = <2>;
+		compatible = "qcom,csid-v5.0", "qcom,csid";
+		reg = <0xca30800 0x400>;
+		reg-names = "csid";
+		interrupts = <0 298 0>;
+		interrupt-names = "csid";
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_ISPIF_AHB_CLK>,
+			<&clock_mmss CSI2_CLK_SRC>,
+			<&clock_mmss CSIPHY_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI2_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI2_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI2RDI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI2PIX_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPHY_CSID2_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csi_src_clk", "csiphy_clk_src",
+			"csi_clk", "csi_ahb_clk", "csi_rdi_clk",
+			"csi_pix_clk", "cphy_csid_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 0 310000000 200000000
+			 0 0 0 0 0>;
+		status = "ok";
+	};
+
+	qcom,csid@ca30c00 {
+		cell-index = <3>;
+		compatible = "qcom,csid-v5.0", "qcom,csid";
+		reg = <0xca30c00 0x400>;
+		reg-names = "csid";
+		interrupts = <0 299 0>;
+		interrupt-names = "csid";
+		qcom,csi-vdd-voltage = <1200000>;
+		qcom,mipi-csi-vdd-supply = <&pm660_l1>;
+		gdscr-supply = <&gdsc_camss_top>;
+		vdd_sec-supply = <&pm660l_l1>;
+		bimc_smmu-supply = <&gdsc_bimc_smmu>;
+		qcom,cam-vreg-name = "vdd_sec", "gdscr", "bimc_smmu";
+		qcom,cam-vreg-min-voltage = <925000 0 0>;
+		qcom,cam-vreg-max-voltage = <925000 0 0>;
+		qcom,cam-vreg-op-mode = <0 0 0>;
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_ISPIF_AHB_CLK>,
+			<&clock_mmss CSI3_CLK_SRC>,
+			<&clock_mmss CSIPHY_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI3_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI3_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI3RDI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI3PIX_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPHY_CSID3_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb",
+			"bmic_smmu_ahb", "bmic_smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"ispif_ahb_clk", "csi_src_clk", "csiphy_clk_src",
+			"csi_clk", "csi_ahb_clk", "csi_rdi_clk",
+			"csi_pix_clk", "cphy_csid_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 0 310000000 200000000
+			 0 0 0 0 0>;
+		status = "ok";
+	};
+
+	qcom,cam_smmu {
+		compatible = "qcom,msm-cam-smmu";
+		status = "ok";
+
+		msm_cam_smmu_cb1 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&mmss_bimc_smmu 0xc00>,
+					<&mmss_bimc_smmu 0xc01>,
+					<&mmss_bimc_smmu 0xc02>,
+					<&mmss_bimc_smmu 0xc03>;
+			label = "vfe";
+			qcom,scratch-buf-support;
+		};
+
+		msm_cam_smmu_cb2 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&mmss_bimc_smmu 0xa00>;
+			label = "cpp";
+		};
+
+		msm_cam_smmu_cb4 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&mmss_bimc_smmu 0x800>;
+			label = "jpeg_enc0";
+		};
+
+		msm_cam_smmu_cb5 {
+			compatible = "qcom,msm-cam-smmu-cb";
+			iommus = <&mmss_bimc_smmu 0x801>;
+			label = "jpeg_dma";
+		};
+	};
+
+	qcom,cpp@ca04000 {
+		cell-index = <0>;
+		compatible = "qcom,cpp";
+		reg = <0xca04000 0x100>,
+			<0xca80000 0x3000>,
+			<0xca18000 0x3000>,
+			<0xc8c36D4 0x4>;
+		reg-names = "cpp", "cpp_vbif", "cpp_hw", "camss_cpp";
+		interrupts = <0 294 0>;
+		interrupt-names = "cpp";
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		vdd-supply = <&gdsc_cpp>;
+		qcom,vdd-names = "smmu-vdd", "camss-vdd", "vdd";
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss CPP_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CPP_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPP_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPP_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_MICRO_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CPP_VBIF_AHB_CLK>;
+		clock-names = "mmssnoc_axi_clk",
+			"mnoc_ahb_clk",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"cpp_src_clk",
+			"cpp_core_clk", "camss_cpp_ahb_clk",
+			"camss_cpp_axi_clk", "micro_iface_clk",
+			"mmss_smmu_axi_clk", "cpp_vbif_ahb_clk";
+		qcom,clock-rates = <0 0 0 0 200000000 200000000 0 0 0 0 0>;
+		qcom,min-clock-rate = <200000000>;
+		qcom,bus-master = <1>;
+		qcom,vbif-qos-setting = <0x550 0x55555555>,
+			<0x554 0x55555555>,
+			<0x558 0x55555555>,
+			<0x55c 0x55555555>,
+			<0x560 0x55555555>,
+			<0x564 0x55555555>,
+			<0x568 0x55555555>,
+			<0x56c 0x55555555>,
+			<0x570 0x55555555>,
+			<0x574 0x55555555>,
+			<0x578 0x55555555>,
+			<0x57c 0x55555555>,
+			<0x580 0x55555555>,
+			<0x584 0x55555555>,
+			<0x588 0x55555555>,
+			<0x58c 0x55555555>;
+		status = "ok";
+		qcom,msm-bus,name = "msm_camera_cpp";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<106 512 0 0>,
+			<106 512 0 0>;
+		qcom,msm-bus-vector-dyn-vote;
+		qcom,cpp-cx-ipeak = <&cx_ipeak_lm 2>;
+		resets = <&clock_mmss CAMSS_MICRO_BCR>;
+		reset-names = "micro_iface_reset";
+		qcom,src-clock-rates = <120000000 256000000 384000000
+					480000000 540000000 576000000>;
+		qcom,micro-reset;
+		qcom,cpp-fw-payload-info {
+			qcom,stripe-base = <790>;
+			qcom,plane-base = <715>;
+			qcom,stripe-size = <63>;
+			qcom,plane-size = <25>;
+			qcom,fe-ptr-off = <11>;
+			qcom,we-ptr-off = <23>;
+			qcom,ref-fe-ptr-off = <17>;
+			qcom,ref-we-ptr-off = <36>;
+			qcom,we-meta-ptr-off = <42>;
+			qcom,fe-mmu-pf-ptr-off = <7>;
+			qcom,ref-fe-mmu-pf-ptr-off = <10>;
+			qcom,we-mmu-pf-ptr-off = <13>;
+			qcom,dup-we-mmu-pf-ptr-off = <18>;
+			qcom,ref-we-mmu-pf-ptr-off = <23>;
+			qcom,set-group-buffer-len = <135>;
+			qcom,dup-frame-indicator-off = <70>;
+		};
+	};
+
+	qcom,ispif@ca31000 {
+		cell-index = <0>;
+		compatible = "qcom,ispif-v3.0", "qcom,ispif";
+		reg = <0xca31000 0xc00>,
+			<0xca00020 0x4>;
+		reg-names = "ispif", "csi_clk_mux";
+		interrupts = <0 309 0>;
+		interrupt-names = "ispif";
+		qcom,num-isps = <0x2>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		vfe0-vdd-supply = <&gdsc_vfe0>;
+		vfe1-vdd-supply = <&gdsc_vfe1>;
+		qcom,vdd-names = "camss-vdd", "vfe0-vdd",
+				"vfe1-vdd";
+		qcom,clock-cntl-support;
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_ISPIF_AHB_CLK>,
+			<&clock_mmss CSI0_CLK_SRC>,
+			<&clock_mmss CSI1_CLK_SRC>,
+			<&clock_mmss CSI2_CLK_SRC>,
+			<&clock_mmss CSI3_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CSI0RDI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI1RDI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI2RDI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI3RDI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI0PIX_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI1PIX_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI2PIX_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI3PIX_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI0_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI1_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI2_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI3_CLK>,
+			<&clock_mmss VFE0_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_VFE0_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI_VFE0_CLK>,
+			<&clock_mmss VFE1_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_VFE1_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI_VFE1_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb_clk",
+			"camss_ahb_clk",
+			"camss_top_ahb_clk", "ispif_ahb_clk",
+			"csi0_src_clk", "csi1_src_clk",
+			"csi2_src_clk", "csi3_src_clk",
+			"csi0_rdi_clk", "csi1_rdi_clk",
+			"csi2_rdi_clk", "csi3_rdi_clk",
+			"csi0_pix_clk", "csi1_pix_clk",
+			"csi2_pix_clk", "csi3_pix_clk",
+			"camss_csi0_clk", "camss_csi1_clk",
+			"camss_csi2_clk", "camss_csi3_clk",
+			"vfe0_clk_src",
+			"camss_vfe_vfe0_clk",
+			"camss_csi_vfe0_clk",
+			"vfe1_clk_src",
+			"camss_vfe_vfe1_clk",
+			"camss_csi_vfe1_clk";
+		qcom,clock-rates = <0 0 0 0 0
+			0 0 0 0
+			0 0 0 0
+			0 0 0 0
+			0 0 0 0
+			0 0 0
+			0 0 0>;
+		qcom,clock-control = "INIT_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE",
+			"INIT_RATE", "INIT_RATE",
+			"INIT_RATE", "INIT_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"INIT_RATE",
+			"NO_SET_RATE", "NO_SET_RATE",
+			"INIT_RATE",
+			"NO_SET_RATE", "NO_SET_RATE";
+		status = "ok";
+	};
+
+	vfe0: qcom,vfe0@ca10000 {
+		cell-index = <0>;
+		compatible = "qcom,vfe48";
+		reg = <0xca10000 0x4000>,
+			<0xca40000 0x3000>;
+		reg-names = "vfe", "vfe_vbif";
+		interrupts = <0 314 0>;
+		interrupt-names = "vfe";
+		vdd-supply = <&gdsc_vfe0>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		qcom,vdd-names = "vdd", "camss-vdd", "smmu-vdd";
+		clocks = <&clock_mmss MMSS_THROTTLE_CAMSS_AXI_CLK>,
+			<&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss VFE0_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_VFE0_CLK>,
+			<&clock_mmss MMSS_CAMSS_VFE0_STREAM_CLK>,
+			<&clock_mmss MMSS_CAMSS_VFE0_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_VFE_VBIF_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_VFE_VBIF_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI_VFE0_CLK>;
+		clock-names = "mmss_throttle_camss_axi_clk", "mmssnoc_axi",
+			"mnoc_ahb_clk", "bimc_smmu_ahb_clk",
+			"bimc_smmu_axi_clk", "camss_ahb_clk",
+			"camss_top_ahb_clk", "vfe_clk_src",
+			"camss_vfe_clk", "camss_vfe_stream_clk",
+			"camss_vfe_ahb_clk", "camss_vfe_vbif_ahb_clk",
+			"camss_vfe_vbif_axi_clk",
+			"camss_csi_vfe_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 0 404000000 0 0 0 0 0 0
+					0 0 0 0 0 0 0 480000000 0 0 0 0 0 0
+					0 0 0 0 0 0 0 576000000 0 0 0 0 0 0>;
+		status = "ok";
+		qos-entries = <8>;
+		qos-regs = <0x404 0x408 0x40c 0x410 0x414 0x418
+			0x41c 0x420>;
+		qos-settings = <0xaaa5aaa5
+			0xaaa5aaa5
+			0xaaa5aaa5
+			0xaa55aaa5
+			0xaa55aa55
+			0xaa55aa55
+			0xaa55aa55
+			0x0005aa55>;
+		vbif-entries = <3>;
+		vbif-regs = <0x124 0xac 0xd0>;
+		vbif-settings = <0x3 0x40 0x1010>;
+		ds-entries = <17>;
+		ds-regs = <0x424 0x428 0x42c 0x430 0x434
+			0x438 0x43c 0x440 0x444 0x448 0x44c
+			0x450 0x454 0x458 0x45c 0x460 0x464>;
+		ds-settings = <0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0x110>;
+		qcom,msm-bus,name = "msm_camera_vfe";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<29 512 0 0>,
+			<29 512 100000000 100000000>;
+		qcom,msm-bus-vector-dyn-vote;
+		qcom,vfe-cx-ipeak = <&cx_ipeak_lm 2>;
+	};
+
+	vfe1: qcom,vfe1@ca14000 {
+		cell-index = <1>;
+		compatible = "qcom,vfe48";
+		reg = <0xca14000 0x4000>,
+			<0xca40000 0x3000>;
+		reg-names = "vfe", "vfe_vbif";
+		interrupts = <0 315 0>;
+		interrupt-names = "vfe";
+		vdd-supply = <&gdsc_vfe1>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		qcom,vdd-names = "vdd", "camss-vdd", "smmu-vdd";
+		clocks = <&clock_mmss MMSS_THROTTLE_CAMSS_AXI_CLK>,
+			<&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss VFE1_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_VFE1_CLK>,
+			<&clock_mmss MMSS_CAMSS_VFE1_STREAM_CLK>,
+			<&clock_mmss MMSS_CAMSS_VFE1_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_VFE_VBIF_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_VFE_VBIF_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_CSI_VFE1_CLK>;
+		clock-names = "mmss_throttle_camss_axi_clk", "mmssnoc_axi",
+			"mnoc_ahb_clk", "bimc_smmu_ahb_clk",
+			"bimc_smmu_axi_clk", "camss_ahb_clk",
+			"camss_top_ahb_clk", "vfe_clk_src",
+			"camss_vfe_clk", "camss_vfe_stream_clk",
+			"camss_vfe_ahb_clk", "camss_vfe_vbif_ahb_clk",
+			"camss_vfe_vbif_axi_clk",
+			"camss_csi_vfe_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 0 404000000 0 0 0 0 0 0
+					0 0 0 0 0 0 0 480000000 0 0 0 0 0 0
+					0 0 0 0 0 0 0 576000000 0 0 0 0 0 0>;
+		status = "ok";
+		qos-entries = <8>;
+		qos-regs = <0x404 0x408 0x40c 0x410 0x414 0x418
+			0x41c 0x420>;
+		qos-settings = <0xaaa5aaa5
+			0xaaa5aaa5
+			0xaaa5aaa5
+			0xaa55aaa5
+			0xaa55aa55
+			0xaa55aa55
+			0xaa55aa55
+			0x0005aa55>;
+		vbif-entries = <3>;
+		vbif-regs = <0x124 0xac 0xd0>;
+		vbif-settings = <0x3 0x40 0x1010>;
+		ds-entries = <17>;
+		ds-regs = <0x424 0x428 0x42c 0x430 0x434
+			0x438 0x43c 0x440 0x444 0x448 0x44c
+			0x450 0x454 0x458 0x45c 0x460 0x464>;
+		ds-settings = <0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0xcccc1111
+			0x110>;
+		qcom,msm-bus,name = "msm_camera_vfe";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<29 512 0 0>,
+			<29 512 100000000 100000000>;
+		qcom,msm-bus-vector-dyn-vote;
+		qcom,vfe-cx-ipeak = <&cx_ipeak_lm 2>;
+	};
+
+	qcom,vfe {
+		compatible = "qcom,vfe";
+		num_child = <2>;
+	};
+
+	cci: qcom,cci@ca0c000 {
+		cell-index = <0>;
+		compatible = "qcom,cci";
+		reg = <0xca0c000 0x4000>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg-names = "cci";
+		interrupts = <0 295 0>;
+		interrupt-names = "cci";
+		status = "ok";
+		mmagic-supply = <&gdsc_bimc_smmu>;
+		gdscr-supply = <&gdsc_camss_top>;
+		qcom,cam-vreg-name = "mmagic", "gdscr";
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss CCI_CLK_SRC>,
+			<&clock_mmss MMSS_CAMSS_CCI_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_CCI_CLK>;
+		clock-names = "mmssnoc_axi", "mnoc_ahb", "smmu_ahb", "smmu_axi",
+			"camss_ahb_clk", "camss_top_ahb_clk",
+			"cci_src_clk", "cci_ahb_clk", "camss_cci_clk";
+		qcom,clock-rates = <0 0 0 0 0 0 19200000 0 0>,
+			<0 0 0 0 0 0 37500000 0 0>;
+		pinctrl-names = "cci_default", "cci_suspend";
+			pinctrl-0 = <&cci0_active &cci1_active>;
+			pinctrl-1 = <&cci0_suspend &cci1_suspend>;
+		gpios = <&tlmm 36 0>,
+			<&tlmm 37 0>,
+			<&tlmm 38 0>,
+			<&tlmm 39 0>;
+		qcom,gpio-tbl-num = <0 1 2 3>;
+		qcom,gpio-tbl-flags = <1 1 1 1>;
+		qcom,gpio-tbl-label = "CCI_I2C_DATA0",
+				      "CCI_I2C_CLK0",
+				      "CCI_I2C_DATA1",
+				      "CCI_I2C_CLK1";
+		i2c_freq_100Khz: qcom,i2c_standard_mode {
+			status = "disabled";
+		};
+		i2c_freq_400Khz: qcom,i2c_fast_mode {
+			status = "disabled";
+		};
+		i2c_freq_custom: qcom,i2c_custom_mode {
+			status = "disabled";
+		};
+		i2c_freq_1Mhz: qcom,i2c_fast_plus_mode {
+			status = "disabled";
+		};
+	};
+
+	qcom,jpeg@ca1c000 {
+		cell-index = <0>;
+		compatible = "qcom,jpeg";
+		reg = <0xca1c000 0x4000>,
+			<0xca60000 0x3000>;
+		reg-names = "jpeg_hw", "jpeg_vbif";
+		interrupts = <0 316 0>;
+		interrupt-names = "jpeg";
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		qcom,vdd-names = "smmu-vdd", "camss-vdd";
+		clock-names = "mmssnoc_axi",
+			"mmss_mnoc_ahb_clk",
+			"mmss_bimc_smmu_ahb_clk",
+			"mmss_bimc_smmu_axi_clk",
+			"mmss_camss_ahb_clk",
+			"mmss_camss_top_ahb_clk",
+			"core_clk",
+			"mmss_camss_jpeg_ahb_clk",
+			"mmss_camss_jpeg_axi_clk";
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_JPEG0_VOTE_CLK>,
+			<&clock_mmss MMSS_CAMSS_JPEG_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_JPEG_AXI_CLK >;
+		qcom,clock-rates = <0 0 0 0 0 0 480000000 0 0>;
+		qcom,vbif-reg-settings = <0x4 0x1>;
+		qcom,prefetch-reg-settings = <0x30c 0x1111>,
+			<0x318 0x31>,
+			<0x324 0x31>,
+			<0x330 0x31>,
+			<0x33c 0x0>;
+		qcom,msm-bus,name = "msm_camera_jpeg0";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps = <62 512 0 0>,
+			<62 512 1200000 1200000>;
+		status = "ok";
+	};
+
+	qcom,jpeg@caa0000 {
+		cell-index = <3>;
+		compatible = "qcom,jpegdma";
+		reg = <0xcaa0000 0x4000>,
+			<0xca60000 0x3000>;
+		reg-names = "jpeg_hw", "jpeg_vbif";
+		interrupts = <0 304 0>;
+		interrupt-names = "jpeg";
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		camss-vdd-supply = <&gdsc_camss_top>;
+		qcom,vdd-names = "smmu-vdd", "camss-vdd";
+		clock-names = "mmssnoc_axi",
+			"mmss_mnoc_ahb_clk",
+			"mmss_bimc_smmu_ahb_clk",
+			"mmss_bimc_smmu_axi_clk",
+			"mmss_camss_ahb_clk",
+			"mmss_camss_top_ahb_clk",
+			"core_clk",
+			"mmss_camss_jpeg_ahb_clk",
+			"mmss_camss_jpeg_axi_clk";
+		clocks = <&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_CAMSS_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_TOP_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_JPEG0_DMA_VOTE_CLK>,
+			<&clock_mmss MMSS_CAMSS_JPEG_AHB_CLK>,
+			<&clock_mmss MMSS_CAMSS_JPEG_AXI_CLK>;
+		qcom,clock-rates = <0 0 0 0 0 0 480000000 0 0>;
+		qcom,vbif-reg-settings = <0x4 0x1>;
+		qcom,prefetch-reg-settings = <0x18c 0x11>,
+			<0x1a0 0x31>,
+			<0x1b0 0x31>;
+		qcom,msm-bus,name = "msm_camera_jpeg_dma";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps = <62 512 0 0>,
+			<62 512 1200000 1200000>;
+		qcom,max-ds-factor = <128>;
+		status = "ok";
+	};
+};
+
+&i2c_freq_100Khz {
+	qcom,hw-thigh = <201>;
+	qcom,hw-tlow = <174>;
+	qcom,hw-tsu-sto = <204>;
+	qcom,hw-tsu-sta = <231>;
+	qcom,hw-thd-dat = <22>;
+	qcom,hw-thd-sta = <162>;
+	qcom,hw-tbuf = <227>;
+	qcom,hw-scl-stretch-en = <0>;
+	qcom,hw-trdhld = <6>;
+	qcom,hw-tsp = <3>;
+	qcom,cci-clk-src = <37500000>;
+	status = "ok";
+};
+
+&i2c_freq_400Khz {
+	qcom,hw-thigh = <38>;
+	qcom,hw-tlow = <56>;
+	qcom,hw-tsu-sto = <40>;
+	qcom,hw-tsu-sta = <40>;
+	qcom,hw-thd-dat = <22>;
+	qcom,hw-thd-sta = <35>;
+	qcom,hw-tbuf = <62>;
+	qcom,hw-scl-stretch-en = <0>;
+	qcom,hw-trdhld = <6>;
+	qcom,hw-tsp = <3>;
+	qcom,cci-clk-src = <37500000>;
+	status = "ok";
+};
+
+&i2c_freq_custom {
+	qcom,hw-thigh = <38>;
+	qcom,hw-tlow = <56>;
+	qcom,hw-tsu-sto = <40>;
+	qcom,hw-tsu-sta = <40>;
+	qcom,hw-thd-dat = <22>;
+	qcom,hw-thd-sta = <35>;
+	qcom,hw-tbuf = <62>;
+	qcom,hw-scl-stretch-en = <1>;
+	qcom,hw-trdhld = <6>;
+	qcom,hw-tsp = <3>;
+	qcom,cci-clk-src = <37500000>;
+	status = "ok";
+};
+
+&i2c_freq_1Mhz {
+	qcom,hw-thigh = <16>;
+	qcom,hw-tlow = <22>;
+	qcom,hw-tsu-sto = <17>;
+	qcom,hw-tsu-sta = <18>;
+	qcom,hw-thd-dat = <16>;
+	qcom,hw-thd-sta = <15>;
+	qcom,hw-tbuf = <24>;
+	qcom,hw-scl-stretch-en = <0>;
+	qcom,hw-trdhld = <3>;
+	qcom,hw-tsp = <3>;
+	qcom,cci-clk-src = <37500000>;
+	status = "ok";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-cdp.dts b/arch/arm64/boot/dts/qcom/sdm660-cdp.dts
new file mode 100644
index 000000000000..7b4b68af6188
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-cdp.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660L CDP";
+	compatible = "qcom,sdm660-cdp", "qcom,sdm660", "qcom,cdp";
+	qcom,board-id = <1 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-cdp.dtsi b/arch/arm64/boot/dts/qcom/sdm660-cdp.dtsi
new file mode 100644
index 000000000000..4d05ea75b576
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-cdp.dtsi
@@ -0,0 +1,263 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdm660-pinctrl.dtsi"
+#include "sdm660-camera-sensor-cdp.dtsi"
+/ {
+};
+
+&uartblsp1dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm660l_l1>;
+	vdda-pll-supply = <&pm660_l10>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14200>;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm660l_l4>;
+	vccq2-supply = <&pm660_l8>;
+	vcc-max-microamp = <500000>;
+	vccq2-max-microamp = <600000>;
+	qcom,vddp-ref-clk-supply = <&pm660_l1>;
+	qcom,vddp-ref-clk-max-microamp = <100>;
+
+	status = "ok";
+};
+
+&pm660_gpios {
+	/* GPIO 4 (NFC_CLK_REQ) */
+	gpio@c300 {
+		qcom,mode = <0>;
+		qcom,vin-sel = <1>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&i2c_6 { /* BLSP1 QUP6 (NFC) */
+	status = "okay";
+	nq@28 {
+		compatible = "qcom,nq-nci";
+		reg = <0x28>;
+		qcom,nq-irq = <&tlmm 28 0x00>;
+		qcom,nq-ven = <&tlmm 29 0x00>;
+		qcom,nq-firm = <&tlmm 30 0x00>;
+		qcom,nq-clkreq = <&pm660_gpios 4 0x00>;
+		qcom,nq-esepwr = <&tlmm 31 0x00>;
+		interrupt-parent = <&tlmm>;
+		qcom,clk-src = "BBCLK3";
+		interrupts = <28 0>;
+		interrupt-names = "nfc_irq";
+		pinctrl-names = "nfc_active", "nfc_suspend";
+		pinctrl-0 = <&nfc_int_active &nfc_enable_active>;
+		pinctrl-1 = <&nfc_int_suspend &nfc_enable_suspend>;
+		clocks = <&clock_rpmcc RPM_LN_BB_CLK3_PIN>;
+		clock-names = "ref_clk";
+	};
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_truly_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 53 0>;
+	qcom,platform-te-gpio = <&tlmm 59 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_truly_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 53 0>;
+	qcom,platform-te-gpio = <&tlmm 59 0>;
+};
+
+&pm660l_wled {
+	qcom,led-strings-list = [01 02];
+};
+
+&dsi_dual_nt35597_truly_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_truly_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_sharp_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35597_truly_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35597_truly_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_dcs";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_dcs";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled = "single_roi";
+	qcom,panel-roi-alignment = <720 128 720 128 1440 128>;
+};
+
+&dsi_nt35695b_truly_fhd_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35695b_truly_fhd_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_truly_1080_vid {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_dcs";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_truly_1080_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_dcs";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,partial-update-enabled = "single_roi";
+	qcom,panel-roi-alignment = <2 2 4 2 1080 2>;
+};
+
+&dsi_rm67195_amoled_fhd_cmd {
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_labibb_amoled>;
+};
+
+&mdss_dp_ctrl {
+	pinctrl-names = "mdss_dp_active", "mdss_dp_sleep";
+	pinctrl-0 = <&mdss_dp_aux_active &mdss_dp_usbplug_cc_active>;
+	pinctrl-1 = <&mdss_dp_aux_suspend &mdss_dp_usbplug_cc_suspend>;
+	qcom,aux-en-gpio = <&tlmm 55 0>;
+	qcom,aux-sel-gpio = <&tlmm 56 0>;
+	qcom,usbplug-cc-gpio = <&tlmm 58 0>;
+};
+
+&sdhc_1 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l4>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660_l8>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-lpm-sup;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <200 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 100000000 192000000
+								384000000>;
+
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&sdhc_2 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l5>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <15000 800000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660l_l2>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	#address-cells = <0>;
+	interrupt-parent = <&sdhc_2>;
+	interrupts = <0 1 2>;
+	#interrupt-cells = <1>;
+	interrupt-map-mask = <0xffffffff>;
+	interrupt-map = <0 &intc 0 0 125 0
+			1 &intc 0 0 221 0
+			2 &tlmm 54 0>;
+	interrupt-names = "hc_irq", "pwr_irq", "status_irq";
+	cd-gpios = <&tlmm 54 0x1>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 100000000
+								200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	status = "ok";
+};
+
+&soc {
+	qcom,msm-ssc-sensors {
+		compatible = "qcom,msm-ssc-sensors";
+	};
+};
+
+&pm660_charger {
+	qcom,batteryless-platform;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-common.dtsi b/arch/arm64/boot/dts/qcom/sdm660-common.dtsi
new file mode 100644
index 000000000000..d60a22d7cb4d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-common.dtsi
@@ -0,0 +1,680 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	ufsphy1: ufsphy@1da7000 {
+		compatible = "qcom,ufs-phy-qmp-v3-660";
+		reg = <0x1da7000 0xdb8>;
+		reg-names = "phy_mem";
+		#phy-cells = <0>;
+		clock-names = "ref_clk_src",
+			"ref_clk",
+			"ref_aux_clk";
+		clocks = <&clock_rpmcc RPM_LN_BB_CLK1>,
+			<&clock_gcc GCC_UFS_CLKREF_CLK>,
+			<&clock_gcc GCC_UFS_PHY_AUX_CLK>;
+		status = "disabled";
+	};
+
+	ufs_ice: ufsice@1db0000 {
+		compatible = "qcom,ice";
+		reg = <0x1db0000 0x8000>;
+		qcom,enable-ice-clk;
+		clock-names = "ufs_core_clk", "bus_clk",
+				"iface_clk", "ice_core_clk";
+		clocks = <&clock_gcc GCC_UFS_AXI_CLK>,
+			 <&clock_gcc GCC_UFS_CLKREF_CLK>,
+			 <&clock_gcc GCC_UFS_AHB_CLK>,
+			 <&clock_gcc GCC_UFS_ICE_CORE_CLK>;
+		qcom,op-freq-hz = <0>, <0>, <0>, <300000000>;
+		vdd-hba-supply = <&gdsc_ufs>;
+		qcom,msm-bus,name = "ufs_ice_noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<1 650 0 0>,    /* No vote */
+				<1 650 1000 0>; /* Max. bandwidth */
+		qcom,bus-vector-names = "MIN",
+					"MAX";
+		qcom,instance-type = "ufs";
+	};
+
+	sdcc1_ice: sdcc1ice@c0c8000 {
+		compatible = "qcom,ice";
+		reg = <0xc0c8000 0x8000>;
+		qcom,enable-ice-clk;
+		clock-names = "ice_core_clk_src", "ice_core_clk",
+				"bus_clk", "iface_clk";
+		clocks = <&clock_gcc SDCC1_ICE_CORE_CLK_SRC>,
+			 <&clock_gcc GCC_SDCC1_ICE_CORE_CLK>,
+			 <&clock_gcc GCC_SDCC1_APPS_CLK>,
+			 <&clock_gcc GCC_SDCC1_AHB_CLK>;
+		qcom,op-freq-hz = <300000000>, <0>, <0>, <0>;
+		qcom,msm-bus,name = "sdcc_ice_noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<78 512 0 0>,    /* No vote */
+			<78 512 1000 0>; /* Max. bandwidth */
+		qcom,bus-vector-names = "MIN",
+					"MAX";
+		qcom,instance-type = "sdcc";
+	};
+
+	ufs1: ufshc@1da4000 {
+		compatible = "qcom,ufshc";
+		reg = <0x1da4000 0x3000>;
+		interrupts = <0 265 0>;
+		phys = <&ufsphy1>;
+		phy-names = "ufsphy";
+		ufs-qcom-crypto = <&ufs_ice>;
+
+		clock-names =
+			"core_clk",
+			"bus_aggr_clk",
+			"iface_clk",
+			"core_clk_unipro",
+			"core_clk_ice",
+			"ref_clk",
+			"tx_lane0_sync_clk",
+			"rx_lane0_sync_clk";
+		clocks =
+			<&clock_gcc GCC_UFS_AXI_CLK>,
+			<&clock_gcc GCC_AGGRE2_UFS_AXI_CLK>,
+			<&clock_gcc GCC_UFS_AHB_CLK>,
+			<&clock_gcc GCC_UFS_UNIPRO_CORE_CLK>,
+			<&clock_gcc GCC_UFS_ICE_CORE_CLK>,
+			<&clock_rpmcc RPM_LN_BB_CLK1>,
+			<&clock_gcc GCC_UFS_TX_SYMBOL_0_CLK>,
+			<&clock_gcc GCC_UFS_RX_SYMBOL_0_CLK>;
+		freq-table-hz =
+			<50000000 200000000>,
+			<0 0>,
+			<0 0>,
+			<37500000 150000000>,
+			<75000000 300000000>,
+			<0 0>,
+			<0 0>,
+			<0 0>;
+
+		lanes-per-direction = <1>;
+
+		non-removable;
+		qcom,msm-bus,name = "ufs1";
+		qcom,msm-bus,num-cases = <12>;
+		qcom,msm-bus,num-paths = <2>;
+		qcom,msm-bus,vectors-KBps =
+		<95 512 0 0>, <1 650 0 0>,          /* No vote */
+		<95 512 922 0>, <1 650 1000 0>,     /* PWM G1 */
+		<95 512 1844 0>, <1 650 1000 0>,    /* PWM G2 */
+		<95 512 3688 0>, <1 650 1000 0>,    /* PWM G3 */
+		<95 512 7376 0>, <1 650 1000 0>,    /* PWM G4 */
+		<95 512 127796 0>, <1 650 1000 0>,  /* HS G1 RA */
+		<95 512 255591 0>, <1 650 1000 0>,  /* HS G2 RA */
+		<95 512 2097152 0>, <1 650 102400 0>,  /* HS G3 RA */
+		<95 512 149422 0>, <1 650 1000 0>,  /* HS G1 RB */
+		<95 512 298189 0>, <1 650 1000 0>,  /* HS G2 RB */
+		<95 512 2097152 0>, <1 650 102400 0>,  /* HS G3 RB */
+		<95 512 7643136 0>, <1 650 307200 0>; /* Max. bandwidth */
+		qcom,bus-vector-names = "MIN",
+		"PWM_G1_L1", "PWM_G2_L1", "PWM_G3_L1", "PWM_G4_L1",
+		"HS_RA_G1_L1", "HS_RA_G2_L1", "HS_RA_G3_L1",
+		"HS_RB_G1_L1", "HS_RB_G2_L1", "HS_RB_G3_L1",
+		"MAX";
+
+		qcom,pm-qos-cpu-groups = <0x0F 0xF0>;
+		qcom,pm-qos-cpu-group-latency-us = <26 26>;
+		qcom,pm-qos-default-cpu = <0>;
+
+		resets = <&clock_gcc GCC_UFS_BCR>;
+		reset-names = "core_reset";
+
+		status = "disabled";
+	};
+
+	usb3: ssusb@a800000 {
+		compatible = "qcom,dwc-usb3-msm";
+		reg = <0x0a800000 0xfc100>,
+			<0x0c016000 0x400>;
+		reg-names = "core_base",
+		"ahb2phy_base";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+
+		interrupts = <0 347 0>, <0 243 0>, <0 180 0>;
+		interrupt-names = "hs_phy_irq", "ss_phy_irq", "pwr_event_irq";
+
+		USB3_GDSC-supply = <&gdsc_usb30>;
+
+		qcom,usb-dbm = <&dbm_1p5>;
+		qcom,msm-bus,name = "usb3";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<61 512 0 0>,
+				<61 512 240000 800000>;
+
+		qcom,dwc-usb3-msm-tx-fifo-size = <21288>;
+		extcon = <&pm660_pdphy>;
+		qcom,pm-qos-latency = <41>; /* CPU-CLUSTER-WFI-LVL latency +1 */
+
+		clocks = <&clock_gcc GCC_USB30_MASTER_CLK>,
+			<&clock_gcc GCC_CFG_NOC_USB3_AXI_CLK>,
+			<&clock_gcc GCC_AGGRE2_USB3_AXI_CLK>,
+			<&clock_rpmcc AGGR2_NOC_USB_CLK>,
+			<&clock_gcc GCC_USB30_MOCK_UTMI_CLK>,
+			<&clock_gcc GCC_USB30_SLEEP_CLK>,
+			<&clock_gcc GCC_USB_PHY_CFG_AHB2PHY_CLK>,
+			<&clock_rpmcc CXO_DWC3_CLK>;
+
+		clock-names = "core_clk", "iface_clk", "bus_aggr_clk",
+				"noc_aggr_clk", "utmi_clk", "sleep_clk",
+				"cfg_ahb_clk", "xo";
+
+		qcom,core-clk-rate = <133330000>;
+		qcom,core-clk-rate-hs = <66666667>;
+
+		resets = <&clock_gcc GCC_USB_30_BCR>;
+		reset-names = "core_reset";
+
+		dwc3@a800000 {
+			compatible = "snps,dwc3";
+			reg = <0x0a800000 0xc8d0>;
+			interrupt-parent = <&intc>;
+			interrupts = <0 131 0>;
+			usb-phy = <&qusb_phy0>, <&ssphy>;
+			tx-fifo-resize;
+			snps,usb3-u1u2-disable;
+			snps,nominal-elastic-buffer;
+			snps,disable-clk-gating;
+			snps,has-lpm-erratum;
+			snps,is-utmi-l1-suspend;
+			snps,hird-threshold = /bits/ 8 <0x0>;
+		};
+
+		qcom,usbbam@a904000 {
+			compatible = "qcom,usb-bam-msm";
+			reg = <0x0a904000 0x17000>;
+			interrupt-parent = <&intc>;
+			interrupts = <0 132 0>;
+
+			qcom,bam-type = <0>;
+			qcom,usb-bam-fifo-baseaddr = <0x146bb000>;
+			qcom,usb-bam-num-pipes = <8>;
+			qcom,ignore-core-reset-ack;
+			qcom,disable-clk-gating;
+			qcom,usb-bam-override-threshold = <0x4001>;
+			qcom,usb-bam-max-mbps-highspeed = <400>;
+			qcom,usb-bam-max-mbps-superspeed = <3600>;
+			qcom,reset-bam-on-connect;
+
+			qcom,pipe0 {
+				label = "ssusb-ipa-out-0";
+				qcom,usb-bam-mem-type = <1>;
+				qcom,dir = <0>;
+				qcom,pipe-num = <0>;
+				qcom,peer-bam = <1>;
+				qcom,src-bam-pipe-index = <1>;
+				qcom,data-fifo-size = <0x8000>;
+				qcom,descriptor-fifo-size = <0x2000>;
+			};
+			qcom,pipe1 {
+				label = "ssusb-ipa-in-0";
+				qcom,usb-bam-mem-type = <1>;
+				qcom,dir = <1>;
+				qcom,pipe-num = <0>;
+				qcom,peer-bam = <1>;
+				qcom,dst-bam-pipe-index = <0>;
+				qcom,data-fifo-size = <0x8000>;
+				qcom,descriptor-fifo-size = <0x2000>;
+			};
+			qcom,pipe2 {
+				label = "ssusb-qdss-in-0";
+				qcom,usb-bam-mem-type = <2>;
+				qcom,dir = <1>;
+				qcom,pipe-num = <0>;
+				qcom,peer-bam = <0>;
+				qcom,peer-bam-physical-address = <0x06064000>;
+				qcom,src-bam-pipe-index = <0>;
+				qcom,dst-bam-pipe-index = <2>;
+				qcom,data-fifo-offset = <0x0>;
+				qcom,data-fifo-size = <0x1800>;
+				qcom,descriptor-fifo-offset = <0x1800>;
+				qcom,descriptor-fifo-size = <0x800>;
+			};
+			qcom,pipe3 {
+				label = "ssusb-dpl-ipa-in-1";
+				qcom,usb-bam-mem-type = <1>;
+				qcom,dir = <1>;
+				qcom,pipe-num = <1>;
+				qcom,peer-bam = <1>;
+				qcom,dst-bam-pipe-index = <2>;
+				qcom,data-fifo-size = <0x8000>;
+				qcom,descriptor-fifo-size = <0x2000>;
+			};
+		};
+	};
+
+	qusb_phy0: qusb@c012000 {
+		compatible = "qcom,qusb2phy";
+		reg = <0x0c012000 0x180>,
+			<0x01fcb24c 0x4>,
+			<0x00780240 0x4>,
+			<0x00188018 0x4>;
+		reg-names = "qusb_phy_base",
+			"tcsr_clamp_dig_n_1p8",
+			"tune2_efuse_addr",
+			"ref_clk_addr";
+		vdd-supply = <&pm660l_l1>;
+		vdda18-supply = <&pm660_l10>;
+		vdda33-supply = <&pm660l_l7>;
+		qcom,vdd-voltage-level = <0 925000 925000>;
+		qcom,tune2-efuse-bit-pos = <25>;
+		qcom,tune2-efuse-num-bits = <4>;
+		qcom,qusb-phy-init-seq = <0xf8 0x80
+					0xb3 0x84
+					0x83 0x88
+					0xc0 0x8c
+					0x30 0x08
+					0x79 0x0c
+					0x21 0x10
+					0x14 0x9c
+					0x9f 0x1c
+					0x00 0x18>;
+		phy_type= "utmi";
+		qcom,phy-clk-scheme = "cml";
+		qcom,major-rev = <1>;
+
+		clocks = <&clock_rpmcc RPM_LN_BB_CLK1>,
+			<&clock_gcc GCC_RX0_USB2_CLKREF_CLK>,
+			<&clock_gcc GCC_USB_PHY_CFG_AHB2PHY_CLK>;
+
+		clock-names =  "ref_clk_src", "ref_clk", "cfg_ahb_clk";
+
+		resets = <&clock_gcc GCC_QUSB2PHY_PRIM_BCR>;
+		reset-names = "phy_reset";
+	};
+
+	ssphy: ssphy@c010000 {
+		compatible = "qcom,usb-ssphy-qmp-v2";
+		reg = <0xc010000 0xe18>,
+			<0x01fcb244 0x4>,
+			<0x01fcb248 0x4>;
+		reg-names = "qmp_phy_base",
+			"vls_clamp_reg",
+			"tcsr_usb3_dp_phymode";
+		vdd-supply = <&pm660l_l1>;
+		core-supply = <&pm660_l10>;
+		qcom,vdd-voltage-level = <0 925000 925000>;
+		qcom,core-voltage-level = <0 1800000 1800000>;
+		qcom,vbus-valid-override;
+		qcom,qmp-phy-init-seq =
+			/* <reg_offset, value, delay> */
+				<0xac  0x14 0x00
+				 0x34  0x08 0x00
+				 0x174 0x30 0x00
+				 0x3c  0x06 0x00
+				 0xb4  0x00 0x00
+				 0xb8  0x08 0x00
+				 0x70  0x0f 0x00
+				 0x19c 0x01 0x00
+				 0x178 0x00 0x00
+				 0xd0  0x82 0x00
+				 0xdc  0x55 0x00
+				 0xe0  0x55 0x00
+				 0xe4  0x03 0x00
+				 0x78  0x0b 0x00
+				 0x84  0x16 0x00
+				 0x90  0x28 0x00
+				 0x108 0x80 0x00
+				 0x10c 0x00 0x00
+				 0x184 0x0a 0x00
+				 0x4c  0x15 0x00
+				 0x50  0x34 0x00
+				 0x54  0x00 0x00
+				 0xc8  0x00 0x00
+				 0x18c 0x00 0x00
+				 0xcc  0x00 0x00
+				 0x128 0x00 0x00
+				 0x0c  0x0a 0x00
+				 0x10  0x01 0x00
+				 0x1c  0x31 0x00
+				 0x20  0x01 0x00
+				 0x14  0x00 0x00
+				 0x18  0x00 0x00
+				 0x24  0xde 0x00
+				 0x28  0x07 0x00
+				 0x48  0x0f 0x00
+				 0x194 0x06 0x00
+				 0x100 0x80 0x00
+				 0xa8  0x01 0x00
+				 0x430 0x0b 0x00
+				 0x830 0x0b 0x00
+				 0x444 0x00 0x00
+				 0x844 0x00 0x00
+				 0x43c 0x00 0x00
+				 0x83c 0x00 0x00
+				 0x440 0x00 0x00
+				 0x840 0x00 0x00
+				 0x408 0x0a 0x00
+				 0x808 0x0a 0x00
+				 0x414 0x06 0x00
+				 0x814 0x06 0x00
+				 0x434 0x75 0x00
+				 0x834 0x75 0x00
+				 0x4d4 0x02 0x00
+				 0x8d4 0x02 0x00
+				 0x4d8 0x4e 0x00
+				 0x8d8 0x4e 0x00
+				 0x4dc 0x18 0x00
+				 0x8dc 0x18 0x00
+				 0x4f8 0x77 0x00
+				 0x8f8 0x77 0x00
+				 0x4fc 0x80 0x00
+				 0x8fc 0x80 0x00
+				 0x4c0 0x0a 0x00
+				 0x8c0 0x0a 0x00
+				 0x504 0x03 0x00
+				 0x904 0x03 0x00
+				 0x50c 0x16 0x00
+				 0x90c 0x16 0x00
+				 0x500 0x00 0x00
+				 0x900 0x00 0x00
+				 0x564 0x00 0x00
+				 0x964 0x00 0x00
+				 0x260 0x10 0x00
+				 0x660 0x10 0x00
+				 0x2a4 0x12 0x00
+				 0x6a4 0x12 0x00
+				 0x28c 0xc6 0x00
+				 0x68c 0xc6 0x00
+				 0x244 0x00 0x00
+				 0x644 0x00 0x00
+				 0x248 0x00 0x00
+				 0x648 0x00 0x00
+				 0xc0c 0x9f 0x00
+				 0xc24 0x17 0x00
+				 0xc28 0x0f 0x00
+				 0xcc8 0x83 0x00
+				 0xcc4 0x02 0x00
+				 0xccc 0x09 0x00
+				 0xcd0 0xa2 0x00
+				 0xcd4 0x85 0x00
+				 0xc80 0xd1 0x00
+				 0xc84 0x1f 0x00
+				 0xc88 0x47 0x00
+				 0xcb8 0x75 0x00
+				 0xcbc 0x13 0x00
+				 0xcb0 0x86 0x00
+				 0xca0 0x04 0x00
+				 0xc8c 0x44 0x00
+				 0xc70 0xe7 0x00
+				 0xc74 0x03 0x00
+				 0xc78 0x40 0x00
+				 0xc7c 0x00 0x00
+				 0xdd8 0x88 0x00
+				 0xffffffff 0xffffffff 0x00>;
+
+		qcom,qmp-phy-reg-offset =
+				<0xd74 /* USB3_PHY_PCS_STATUS */
+				 0xcd8 /* USB3_PHY_AUTONOMOUS_MODE_CTRL */
+				 0xcdc /* USB3_PHY_LFPS_RXTERM_IRQ_CLEAR */
+				 0xc04 /* USB3_PHY_POWER_DOWN_CONTROL */
+				 0xc00 /* USB3_PHY_SW_RESET */
+				 0xc08 /* USB3_PHY_START */
+				 0xa00>; /* USB3PHY_PCS_MISC_TYPEC_CTRL */
+
+		clocks = <&clock_gcc GCC_USB3_PHY_AUX_CLK>,
+			<&clock_gcc GCC_USB3_PHY_PIPE_CLK>,
+			<&clock_gcc GCC_USB_PHY_CFG_AHB2PHY_CLK>,
+			<&clock_rpmcc RPM_LN_BB_CLK1>,
+			<&clock_gcc GCC_USB3_CLKREF_CLK>;
+
+		clock-names = "aux_clk", "pipe_clk", "cfg_ahb_clk",
+				"ref_clk_src", "ref_clk";
+
+		resets = <&clock_gcc GCC_USB3_PHY_BCR>,
+			<&clock_gcc GCC_USB3PHY_PHY_BCR>;
+		reset-names = "phy_reset", "phy_phy_reset";
+	};
+
+	usb_audio_qmi_dev {
+		compatible = "qcom,usb-audio-qmi-dev";
+		iommus = <&lpass_q6_smmu 6>;
+		qcom,usb-audio-stream-id = <6>;
+		qcom,usb-audio-intr-num = <2>;
+	};
+
+	dbm_1p5: dbm@a8f8000 {
+		compatible = "qcom,usb-dbm-1p5";
+		reg = <0xa8f8000 0x300>;
+		qcom,reset-ep-after-lpm-resume;
+	};
+
+       usb2s: hsusb@c200000 {
+		compatible = "qcom,dwc-usb3-msm";
+		reg = <0x0c200000 0xfc000>,
+			<0x0c016000 0x400>;
+		reg-names = "core_base",
+			"ahb2phy_base";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+
+		interrupts = <0 348 0>, <0 144 0>;
+		interrupt-names = "hs_phy_irq", "pwr_event_irq";
+
+		qcom,msm-bus,name = "usb-hs";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<87 512 0 0>,
+			<87 512 60000 800000>;
+
+		qcom,pm-qos-latency = <52>; /* CPU-CLUSTER-WFI-LVL latency +1 */
+		clocks = <&clock_gcc GCC_USB20_MASTER_CLK>,
+			<&clock_gcc GCC_CFG_NOC_USB2_AXI_CLK>,
+			<&clock_gcc GCC_USB20_MOCK_UTMI_CLK>,
+			<&clock_gcc GCC_USB20_SLEEP_CLK>,
+			<&clock_rpmcc CXO_DWC3_CLK>,
+			<&clock_gcc GCC_USB_PHY_CFG_AHB2PHY_CLK>;
+		clock-names = "core_clk", "iface_clk", "utmi_clk", "sleep_clk",
+				"xo", "cfg_ahb_clk";
+		qcom,core-clk-rate = <60000000>;
+		resets = <&clock_gcc GCC_USB_20_BCR>;
+		reset-names = "core_reset";
+
+		status = "disabled";
+		dwc3@c200000 {
+			compatible = "snps,dwc3";
+			reg = <0x0c200000 0xc8d0>;
+			interrupt-parent = <&intc>;
+			interrupts = <0 143 0>;
+			usb-phy = <&qusb_phy1>, <&usb_nop_phy>;
+			maximum-speed = "high-speed";
+			snps,nominal-elastic-buffer;
+			snps,is-utmi-l1-suspend;
+			snps,hird-threshold = /bits/ 8 <0x0>;
+			dr_mode = "host";
+		};
+	};
+
+	qusb_phy1: qusb@c014000 {
+		compatible = "qcom,qusb2phy";
+		reg = <0x0c014000 0x180>,
+			<0x00188014 0x4>;
+		reg-names = "qusb_phy_base",
+			"ref_clk_addr";
+		vdd-supply = <&pm660l_l1>;
+		vdda18-supply = <&pm660_l10>;
+		vdda33-supply = <&pm660l_l7>;
+		qcom,vdd-voltage-level = <0 925000 925000>;
+		qcom,qusb-phy-init-seq = <0xF8 0x80
+					0xB3 0x84
+					0x83 0x88
+					0xC0 0x8C
+					0x30 0x08
+					0x79 0x0C
+					0x21 0x10
+					0x14 0x9C
+					0x9F 0x1C
+					0x00 0x18>;
+		phy_type = "utmi";
+		qcom,phy-clk-scheme = "cml";
+		qcom,major-rev = <1>;
+		qcom,hold-reset;
+
+		clocks = <&clock_gcc GCC_USB_PHY_CFG_AHB2PHY_CLK>,
+			<&clock_gcc GCC_RX1_USB2_CLKREF_CLK>,
+			<&clock_rpmcc RPM_LN_BB_CLK1>;
+		clock-names = "cfg_ahb_clk", "ref_clk", "ref_clk_src";
+
+		resets = <&clock_gcc GCC_QUSB2PHY_SEC_BCR>;
+		reset-names = "phy_reset";
+	};
+
+	usb_nop_phy: usb_nop_phy {
+		compatible = "usb-nop-xceiv";
+	};
+
+	sdhc_1: sdhci@c0c4000 {
+		compatible = "qcom,sdhci-msm-v5";
+		reg = <0xc0c4000 0x1000>, <0xc0c5000 0x1000>;
+		reg-names = "hc_mem", "cmdq_mem";
+
+		interrupts = <0 110 0>, <0 112 0>;
+		interrupt-names = "hc_irq", "pwr_irq";
+
+		qcom,bus-width = <8>;
+		qcom,large-address-bus;
+		sdhc-msm-crypto = <&sdcc1_ice>;
+
+		qcom,devfreq,freq-table = <50000000 200000000>;
+
+		qcom,pm-qos-irq-type = "affine_irq";
+		qcom,pm-qos-irq-latency = <43 518>;
+		qcom,pm-qos-cpu-groups = <0x0f 0xf0>;
+		qcom,pm-qos-cmdq-latency-us = <43 518>, <40 518>;
+		qcom,pm-qos-legacy-latency-us = <43 518>, <40 518>;
+
+		qcom,msm-bus,name = "sdhc1";
+		qcom,msm-bus,num-cases = <9>;
+		qcom,msm-bus,num-paths = <2>;
+		qcom,msm-bus,vectors-KBps =
+			/* No vote */
+			<78 512 0 0>, <1 606 0 0>,
+			/* 400 KB/s*/
+			<78 512 1046 1600>,
+			<1 606 1600 1600>,
+			/* 20 MB/s */
+			<78 512 52286 80000>,
+			<1 606 80000 80000>,
+			/* 25 MB/s */
+			<78 512 65360 100000>,
+			<1 606 100000 100000>,
+			/* 50 MB/s */
+			<78 512 130718 200000>,
+			<1 606 133320 133320>,
+			/* 100 MB/s */
+			<78 512 130718 200000>,
+			<1 606 150000 150000>,
+			/* 200 MB/s */
+			<78 512 261438 400000>,
+			<1 606 300000 300000>,
+			/* 400 MB/s */
+			<78 512 261438 400000>,
+			<1 606 300000 300000>,
+			/* Max. bandwidth */
+			<78 512 1338562 4096000>,
+			<1 606 1338562 4096000>;
+		qcom,bus-bw-vectors-bps = <0 400000 20000000 25000000 50000000
+			100000000 200000000 400000000 4294967295>;
+
+		clocks = <&clock_gcc GCC_SDCC1_AHB_CLK>,
+			 <&clock_gcc GCC_SDCC1_APPS_CLK>,
+			 <&clock_gcc GCC_SDCC1_ICE_CORE_CLK>;
+		clock-names = "iface_clk", "core_clk", "ice_core_clk";
+
+		qcom,clk-rates = <400000 20000000 25000000 50000000 100000000
+						192000000 384000000>;
+
+		qcom,nonremovable;
+		qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+		qcom,ice-clk-rates = <300000000 75000000>;
+
+		qcom,scaling-lower-bus-speed-mode = "DDR52";
+
+		status = "disabled";
+	};
+
+	sdhc_2: sdhci@c084000 {
+		compatible = "qcom,sdhci-msm-v5";
+		reg = <0xc084000 0x1000>;
+		reg-names = "hc_mem";
+
+		interrupts = <0 125 0>, <0 221 0>;
+		interrupt-names = "hc_irq", "pwr_irq";
+
+		qcom,bus-width = <4>;
+		qcom,large-address-bus;
+
+		qcom,msm-bus,name = "sdhc2";
+		qcom,msm-bus,num-cases = <8>;
+		qcom,msm-bus,num-paths = <2>;
+		qcom,msm-bus,vectors-KBps =
+			/* No vote */
+			<81 512 0 0>, <1 608 0 0>,
+			/* 400 KB/s*/
+			<81 512 1046 1600>,
+			<1 608 1600 1600>,
+			/* 20 MB/s */
+			<81 512 52286 80000>,
+			<1 608 80000 80000>,
+			/* 25 MB/s */
+			<81 512 65360 100000>,
+			<1 608 100000 100000>,
+			/* 50 MB/s */
+			<81 512 130718 200000>,
+			<1 608 133320 133320>,
+			/* 100 MB/s */
+			<81 512 261438 200000>,
+			<1 608 150000 150000>,
+			/* 200 MB/s */
+			<81 512 261438 400000>,
+			<1 608 300000 300000>,
+			/* Max. bandwidth */
+			<81 512 1338562 4096000>,
+			<1 608 1338562 4096000>;
+		qcom,bus-bw-vectors-bps = <0 400000 20000000 25000000 50000000
+			100000000 200000000 4294967295>;
+
+		qcom,devfreq,freq-table = <50000000 200000000>;
+
+		qcom,pm-qos-irq-type = "affine_irq";
+		qcom,pm-qos-irq-latency = <43 518>;
+		qcom,pm-qos-cpu-groups = <0x0f 0xf0>;
+		qcom,pm-qos-legacy-latency-us = <43 518>, <40 518>;
+
+		clocks = <&clock_gcc GCC_SDCC2_AHB_CLK>,
+			<&clock_gcc GCC_SDCC2_APPS_CLK>;
+		clock-names = "iface_clk", "core_clk";
+
+		qcom,clk-rates = <400000 20000000 25000000 50000000 100000000
+								200000000>;
+		qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50",
+								"SDR104";
+
+		status = "disabled";
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-coresight.dtsi b/arch/arm64/boot/dts/qcom/sdm660-coresight.dtsi
new file mode 100644
index 000000000000..76023a72ed96
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-coresight.dtsi
@@ -0,0 +1,1684 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/clock/qcom,gcc-sdm660.h>
+#include <dt-bindings/clock/qcom,gpu-sdm660.h>
+#include <dt-bindings/clock/qcom,mmcc-sdm660.h>
+
+&soc {
+	tmc_etr: tmc@6048000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b961>;
+
+		reg = <0x6048000 0x1000>,
+		      <0x6064000 0x15000>;
+		reg-names = "tmc-base", "bam-base";
+
+		arm,buffer-size = <0x400000>;
+		arm,sg-enable;
+		arm,default-sink;
+
+		coresight-ctis = <&cti0 &cti8>;
+
+		coresight-name = "coresight-tmc-etr";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			tmc_etr_in_replicator: endpoint {
+				slave-mode;
+				remote-endpoint = <&replicator_out_tmc_etr>;
+			};
+		};
+	};
+
+	replicator: replicator@6046000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b909>;
+
+		reg = <0x6046000 0x1000>;
+		reg-names = "replicator-base";
+
+		coresight-name = "coresight-replicator";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports{
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				replicator_out_tmc_etr:endpoint {
+					remote-endpoint =
+						<&tmc_etr_in_replicator>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				replicator_in_tmc_etf:endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tmc_etf_out_replicator>;
+				};
+			};
+		};
+	};
+
+	tmc_etf: tmc@6047000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b961>;
+
+		reg = <0x6047000 0x1000>;
+		reg-names = "tmc-base";
+
+		coresight-name = "coresight-tmc-etf";
+
+		coresight-ctis = <&cti0 &cti8>;
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports{
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				tmc_etf_out_replicator:endpoint {
+					remote-endpoint =
+						<&replicator_in_tmc_etf>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				tmc_etf_in_funnel_merg:endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&funnel_merg_out_tmc_etf>;
+				};
+			};
+		};
+	};
+
+	funnel_merg: funnel@6045000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x6045000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-merg";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_merg_out_tmc_etf:endpoint {
+					remote-endpoint =
+						<&tmc_etf_in_funnel_merg>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				funnel_merg_in_funnel_in0:endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&funnel_in0_out_funnel_merg>;
+				};
+			};
+			port@2 {
+				reg = <1>;
+				funnel_merg_in_funnel_in1:endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&funnel_in1_out_funnel_merg>;
+				};
+			};
+		};
+	};
+
+	funnel_in0: funnel@6041000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x6041000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-in0";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_in0_out_funnel_merg: endpoint {
+					remote-endpoint =
+						<&funnel_merg_in_funnel_in0>;
+				};
+			};
+			port@2 {
+				reg = <6>;
+				funnel_in0_in_funnel_qatb: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&funnel_qatb_out_funnel_in0>;
+				};
+			};
+			port@3 {
+				reg = <7>;
+				funnel_in0_in_stm: endpoint {
+					slave-mode;
+					remote-endpoint = <&stm_out_funnel_in0>;
+				};
+			};
+			port@4 {
+				reg = <0>;
+				funnel_in0_in_rpm_etm0: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&rpm_etm0_out_funnel_in0>;
+				};
+			};
+		};
+	};
+
+	funnel_in1: funnel@6042000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x6042000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-in1";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_in1_out_funnel_merg: endpoint {
+					remote-endpoint =
+						<&funnel_merg_in_funnel_in1>;
+				};
+			};
+			port@1 {
+				reg = <2>;
+				funnel_in1_in_tpda_nav: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&tpda_nav_out_funnel_in1>;
+				};
+			};
+			port@2 {
+				reg = <5>;
+				funnel_in1_in_modem_etm0: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&modem_etm0_out_funnel_in1>;
+				};
+			};
+			port@3 {
+				reg = <6>;
+				funnel_in1_in_funnel_apss_merg: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&funnel_apss_merg_out_funnel_in1>;
+				};
+			};
+			port@4 {
+				reg = <4>;
+				funnel_in1_in_turing_etm0: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&turing_etm0_out_funnel_in1>;
+				};
+			};
+		};
+	};
+
+	funnel_apss_merg: funnel@7b70000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x7b70000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-apss-merg";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_apss_merg_out_funnel_in1: endpoint {
+					remote-endpoint =
+					    <&funnel_in1_in_funnel_apss_merg>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				funnel_apss_merg_in_funnel_apss: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&funnel_apss_out_funnel_apss_merg>;
+				};
+			};
+			port@2 {
+				reg = <1>;
+				funnel_apss_merg_in_tpda_olc: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&tpda_olc_out_funnel_apss_merg>;
+				};
+			};
+			port@3 {
+				reg = <3>;
+				funnel_apss_merg_in_tpda_apss: endpoint {
+					slave-mode;
+					remote-endpoint =
+					    <&tpda_apss_out_funnel_apss_merg>;
+				};
+			};
+		};
+	};
+
+	funnel_apss: funnel@7b60000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x7b60000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-apss";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_apss_out_funnel_apss_merg: endpoint {
+					remote-endpoint =
+					    <&funnel_apss_merg_in_funnel_apss>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				funnel_apss_in_etm0: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm0_out_funnel_apss>;
+				};
+			};
+			port@2 {
+				reg = <1>;
+				funnel_apss_in_etm1: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm1_out_funnel_apss>;
+				};
+			};
+			port@3 {
+				reg = <2>;
+				funnel_apss_in_etm2: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm2_out_funnel_apss>;
+				};
+			};
+			port@4 {
+				reg = <3>;
+				funnel_apss_in_etm3: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm3_out_funnel_apss>;
+				};
+			};
+			port@5 {
+				reg = <4>;
+				funnel_apss_in_etm4: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm4_out_funnel_apss>;
+				};
+			};
+			port@6 {
+				reg = <5>;
+				funnel_apss_in_etm5: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm5_out_funnel_apss>;
+				};
+			};
+			port@7 {
+				reg = <6>;
+				funnel_apss_in_etm6: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm6_out_funnel_apss>;
+				};
+			};
+			port@8 {
+				reg = <7>;
+				funnel_apss_in_etm7: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&etm7_out_funnel_apss>;
+				};
+			};
+		};
+	};
+
+	stm: stm@6002000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b962>;
+
+		reg = <0x6002000 0x1000>,
+		      <0x16280000 0x180000>;
+		reg-names = "stm-base", "stm-data-base";
+
+		coresight-name = "coresight-stm";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			stm_out_funnel_in0: endpoint {
+				remote-endpoint = <&funnel_in0_in_stm>;
+			};
+		};
+	};
+
+	etm0: etm@7840000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x7840000 0x1000>;
+		cpu = <&CPU0>;
+
+		coresight-name = "coresight-etm0";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm0_out_funnel_apss: endpoint {
+				remote-endpoint = <&funnel_apss_in_etm0>;
+			};
+		};
+	};
+
+	etm1: etm@7940000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x7940000 0x1000>;
+		cpu = <&CPU1>;
+
+		coresight-name = "coresight-etm1";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm1_out_funnel_apss: endpoint {
+				remote-endpoint = <&funnel_apss_in_etm1>;
+			};
+		};
+	};
+
+	etm2: etm@7a40000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x7a40000 0x1000>;
+		cpu = <&CPU2>;
+
+		coresight-name = "coresight-etm2";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm2_out_funnel_apss: endpoint {
+				remote-endpoint = <&funnel_apss_in_etm2>;
+			};
+		};
+	};
+
+	etm3: etm@7b40000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x7b40000 0x1000>;
+		cpu = <&CPU3>;
+
+		coresight-name = "coresight-etm3";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm3_out_funnel_apss: endpoint {
+				remote-endpoint = <&funnel_apss_in_etm3>;
+			};
+		};
+	};
+
+	etm4: etm@7c40000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x7c40000 0x1000>;
+		cpu = <&CPU4>;
+
+		coresight-name = "coresight-etm4";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm4_out_funnel_apss: endpoint {
+				remote-endpoint = <&funnel_apss_in_etm4>;
+			};
+		};
+	};
+
+	etm5: etm@7d40000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x7d40000 0x1000>;
+		cpu = <&CPU5>;
+
+		coresight-name = "coresight-etm5";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm5_out_funnel_apss: endpoint {
+				remote-endpoint = <&funnel_apss_in_etm5>;
+			};
+		};
+	};
+
+	etm6: etm@7e40000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x7e40000 0x1000>;
+		cpu = <&CPU6>;
+
+		coresight-name = "coresight-etm6";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm6_out_funnel_apss: endpoint {
+				remote-endpoint = <&funnel_apss_in_etm6>;
+			};
+		};
+	};
+
+	etm7: etm@7f40000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b95d>;
+
+		reg = <0x7f40000 0x1000>;
+		cpu = <&CPU7>;
+
+		coresight-name = "coresight-etm7";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		port{
+			etm7_out_funnel_apss: endpoint {
+				remote-endpoint = <&funnel_apss_in_etm7>;
+			};
+		};
+	};
+
+	cti0: cti@6010000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6010000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti0";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti1: cti@6011000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6011000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti1";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti2: cti@6012000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6012000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti2";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,cti-gpio-trigout = <4>;
+		pinctrl-names = "cti-trigout-pctrl";
+		pinctrl-0 = <&trigout_a>;
+	};
+
+	cti3: cti@6013000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6013000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti3";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti4: cti@6014000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6014000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti4";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti5: cti@6015000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6015000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti5";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti6: cti@6016000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6016000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti6";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti7: cti@6017000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6017000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti7";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti8: cti@6018000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6018000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti8";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti9: cti@6019000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x6019000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti9";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti10: cti@601a000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x601a000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti10";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti11: cti@601b000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x601b000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti11";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti12: cti@601c000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x601c000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti12";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti13: cti@601d000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x601d000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti13";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti14: cti@601e000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x601e000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti14";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti15: cti@601f000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x601f000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti15";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu0: cti@7820000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7820000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu0";
+		cpu = <&CPU0>;
+
+		qcom,cti-save;
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu1: cti@7920000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7920000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu1";
+		cpu = <&CPU1>;
+
+		qcom,cti-save;
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu2: cti@7a20000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7a20000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu2";
+		cpu = <&CPU2>;
+
+		qcom,cti-save;
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu3: cti@7b20000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7b20000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu3";
+		cpu = <&CPU3>;
+
+		qcom,cti-save;
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu4: cti@7c20000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7c20000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu4";
+		cpu = <&CPU4>;
+
+		qcom,cti-save;
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu5: cti@7d20000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7d20000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu5";
+		cpu = <&CPU5>;
+
+		qcom,cti-save;
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu6: cti@7e20000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7e20000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu6";
+		cpu = <&CPU6>;
+
+		qcom,cti-save;
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_cpu7: cti@7f20000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7f20000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-cpu7";
+		cpu = <&CPU7>;
+
+		qcom,cti-save;
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_apss: cti@7b80000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7b80000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-apss";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_apss_dl: cti@7bc1000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7bc1000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-apss-dl";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_olc: cti@7b91000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7b91000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-olc";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_turing: cti@7068000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7068000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-turing";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_wcss0: cti@71a4000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x71a4000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-wcss0";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_wcss1: cti@71a5000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x71a5000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-wcss1";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_wcss2: cti@71a6000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x71a6000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-wcss2";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_mmss: cti@7188000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7188000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-mmss";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_isdb: cti@7121000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7121000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-isdb";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_rpm: cti@7048000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7048000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-rpm";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	cti_mss: cti@7041000 {
+		compatible = "arm,coresight-cti";
+		reg = <0x7041000 0x1000>;
+		reg-names = "cti-base";
+
+		coresight-name = "coresight-cti-mss";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+	};
+
+	qpdi: qpdi@1fc1000 {
+		compatible = "qcom,coresight-qpdi";
+		reg = <0x01fc1000 0x4>;
+		reg-names = "qpdi-base";
+
+		coresight-name = "coresight-qpdi";
+
+		vdd-supply = <&pm660l_l5>;
+		qcom,vdd-voltage-level = <2950000 2950000>;
+		qcom,vdd-current-level = <15000 900000>;
+
+		vdd-io-supply = <&pm660l_l2>;
+		qcom,vdd-io-voltage-level = <1800000 2950000>;
+		qcom,vdd-io-current-level = <200 22000>;
+	};
+
+	funnel_qatb: funnel@6005000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x6005000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-qatb";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_qatb_out_funnel_in0: endpoint {
+					remote-endpoint =
+					    <&funnel_in0_in_funnel_qatb>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				funnel_qatb_in_tpda: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpda_out_funnel_qatb>;
+				};
+			};
+			port@2 {
+				reg = <3>;
+				funnel_qatb_in_funnel_dlct: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&funnel_dlct_out_funnel_qatb>;
+				};
+			};
+		};
+	};
+
+	tpda: tpda@6004000 {
+		compatible = "qcom,coresight-tpda";
+		reg = <0x6004000 0x1000>;
+		reg-names = "tpda-base";
+
+		coresight-name = "coresight-tpda";
+
+		qcom,tpda-atid = <65>;
+		qcom,bc-elem-size = <8 32>,
+				    <10 32>;
+		qcom,tc-elem-size = <4 32>,
+				    <7 32>,
+				    <10 32>;
+		qcom,dsb-elem-size = <2 32>,
+				     <8 32>,
+				     <10 32>,
+				     <11 32>;
+		qcom,cmb-elem-size = <4 32>,
+				     <5 32>,
+				     <6 32>,
+				     <10 64>;
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			port@0 {
+				reg = <0>;
+				tpda_out_funnel_qatb: endpoint {
+					remote-endpoint =
+						<&funnel_qatb_in_tpda>;
+				};
+			};
+			port@2 {
+				reg = <2>;
+				tpda_in_funnel_dlct: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&funnel_dlct_out_tpda>;
+				};
+			};
+			port@3 {
+				reg = <4>;
+				tpda_in_tpdm_vsense: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_vsense_out_tpda>;
+				};
+			};
+			port@4 {
+				reg = <5>;
+				tpda_in_tpdm_dcc: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_dcc_out_tpda>;
+				};
+			};
+			port@5 {
+				reg = <6>;
+				tpda_in_tpdm_prng: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_prng_out_tpda>;
+				};
+			};
+			port@6 {
+				reg = <8>;
+				tpda_in_tpdm_qm: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_qm_out_tpda>;
+				};
+			};
+			port@7 {
+				reg = <10>;
+				tpda_in_tpdm_pimem: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_pimem_out_tpda>;
+				};
+			};
+			port@8 {
+				reg = <11>;
+				tpda_in_tpdm: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_out_tpda>;
+				};
+			};
+		};
+	};
+
+	tpdm_vsense: tpdm@7038000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x7038000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-vsense";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_vsense_out_tpda: endpoint {
+				remote-endpoint = <&tpda_in_tpdm_vsense>;
+			};
+		};
+	};
+
+	tpdm_dcc: tpdm@7054000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x7054000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-dcc";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_dcc_out_tpda: endpoint {
+				remote-endpoint = <&tpda_in_tpdm_dcc>;
+			};
+		};
+	};
+
+	tpdm_prng: tpdm@704c000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x704c000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-prng";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_prng_out_tpda: endpoint {
+				remote-endpoint = <&tpda_in_tpdm_prng>;
+			};
+		};
+	};
+
+	tpdm_qm: tpdm@71d0000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x71d0000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-qm";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_qm_out_tpda: endpoint {
+				remote-endpoint = <&tpda_in_tpdm_qm>;
+			};
+		};
+	};
+
+	tpdm_pimem: tpdm@7050000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x7050000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-pimem";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_pimem_out_tpda: endpoint {
+				remote-endpoint = <&tpda_in_tpdm_pimem>;
+			};
+		};
+	};
+
+	tpdm: tpdm@6006000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x6006000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm";
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_out_tpda: endpoint {
+				remote-endpoint = <&tpda_in_tpdm>;
+			};
+		};
+	};
+
+	tpda_nav: tpda@7191000 {
+		compatible = "qcom,coresight-tpda";
+		reg = <0x7191000 0x1000>;
+		reg-names = "tpda-base";
+
+		coresight-name = "coresight-tpda-nav";
+
+		qcom,tpda-atid = <68>;
+		qcom,cmb-elem-size = <0 32>;
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			port@0 {
+				reg = <0>;
+				tpda_nav_out_funnel_in1: endpoint {
+					remote-endpoint =
+						<&funnel_in1_in_tpda_nav>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				tpda_nav_in_tpdm_nav: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_nav_out_tpda_nav>;
+				};
+			};
+		};
+	};
+
+	tpda_apss: tpda@7bc2000 {
+		compatible = "qcom,coresight-tpda";
+		reg = <0x7bc2000 0x1000>;
+		reg-names = "tpda-base";
+
+		coresight-name = "coresight-tpda-apss";
+
+		qcom,tpda-atid = <66>;
+		qcom,dsb-elem-size = <0 32>;
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			port@0 {
+				reg = <0>;
+				tpda_apss_out_funnel_apss_merg: endpoint {
+					remote-endpoint =
+					       <&funnel_apss_merg_in_tpda_apss>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				tpda_apss_in_tpdm_apss: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_apss_out_tpda_apss>;
+				};
+			};
+		};
+	};
+
+	tpdm_apss: tpdm@7bc0000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x7bc0000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-apss";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_apss_out_tpda_apss: endpoint {
+				remote-endpoint = <&tpda_apss_in_tpdm_apss>;
+			};
+		};
+	};
+
+	tpda_mss: tpda@7043000 {
+		compatible = "qcom,coresight-tpda";
+		reg = <0x7043000 0x1000>;
+		reg-names = "tpda-base";
+
+		coresight-name = "coresight-tpda-mss";
+
+		qcom,tpda-atid = <67>;
+		qcom,dsb-elem-size = <0 32>;
+		qcom,cmb-elem-size = <0 32>;
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			port@0 {
+				reg = <0>;
+				tpda_mss_out_funnel_dlct: endpoint {
+					remote-endpoint =
+						<&funnel_dlct_in_tpda_mss>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				tpda_mss_in_tpdm_mss: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_mss_out_tpda_mss>;
+				};
+			};
+		};
+	};
+
+	tpdm_mss: tpdm@7042000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x7042000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-mss";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_mss_out_tpda_mss: endpoint {
+				remote-endpoint = <&tpda_mss_in_tpdm_mss>;
+			};
+		};
+	};
+
+	tpdm_nav: tpdm@7190000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x7190000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-nav";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_nav_out_tpda_nav: endpoint {
+				remote-endpoint = <&tpda_nav_in_tpdm_nav>;
+			};
+		};
+	};
+
+	tpda_olc: tpda@7b92000 {
+		compatible = "qcom,coresight-tpda";
+		reg = <0x7b92000 0x1000>;
+		reg-names = "tpda-base";
+
+		coresight-name = "coresight-tpda-olc";
+
+		qcom,tpda-atid = <69>;
+		qcom,cmb-elem-size = <0 64>;
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			port@0 {
+				reg = <0>;
+				tpda_olc_out_funnel_apss_merg: endpoint {
+					remote-endpoint =
+						<&funnel_apss_merg_in_tpda_olc>;
+				};
+			};
+			port@1 {
+				reg = <0>;
+				tpda_olc_in_tpdm_olc: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_olc_out_tpda_olc>;
+				};
+			};
+		};
+	};
+
+	tpdm_olc: tpdm@7b90000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x7b90000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-olc";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_olc_out_tpda_olc: endpoint {
+				remote-endpoint = <&tpda_olc_in_tpdm_olc>;
+			};
+		};
+	};
+
+	funnel_dlct: funnel@71c3000 {
+		compatible = "arm,primecell";
+		arm,primecell-periphid = <0x0003b908>;
+
+		reg = <0x71c3000 0x1000>;
+		reg-names = "funnel-base";
+
+		coresight-name = "coresight-funnel-dlct";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "apb_pclk", "core_a_clk";
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				funnel_dlct_out_tpda: endpoint {
+					remote-endpoint =
+					    <&tpda_in_funnel_dlct>;
+				};
+			};
+			port@1 {
+				reg = <1>;
+				funnel_dlct_out_funnel_qatb: endpoint {
+					remote-endpoint =
+					    <&funnel_qatb_in_funnel_dlct>;
+				};
+			};
+			port@2 {
+				reg = <0>;
+				funnel_dlct_in_tpdm_dlct: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpdm_dlct_out_funnel_dlct>;
+				};
+			};
+			port@4 {
+				reg = <1>;
+				funnel_dlct_in_audio_etm0: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&audio_etm0_out_funnel_dlct>;
+				};
+			};
+			port@5 {
+				reg = <2>;
+				funnel_dlct_in_tpda_mss: endpoint {
+					slave-mode;
+					remote-endpoint =
+						<&tpda_mss_out_funnel_dlct>;
+				};
+			};
+		};
+	};
+
+	tpdm_dlct: tpdm@71c2000 {
+		compatible = "qcom,coresight-tpdm";
+		reg = <0x71c2000 0x1000>;
+		reg-names = "tpdm-base";
+
+		coresight-name = "coresight-tpdm-dlct";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		port{
+			tpdm_dlct_out_funnel_dlct: endpoint {
+				remote-endpoint = <&funnel_dlct_in_tpdm_dlct>;
+			};
+		};
+	};
+
+	hwevent: hwevent@158000 {
+		compatible = "qcom,coresight-hwevent";
+		reg = <0x158000 0x80>,
+		      <0x17091000 0x80>,
+		      <0x1730200c 0x4>,
+		      <0xc90137c 0x4>,
+		      <0xc828018 0x80>,
+		      <0x1c00058 0x80>,
+		      <0x5e02038 0x4>,
+		      <0x5e02028 0x10>,
+		      <0x1fcb360 0x80>,
+		      <0x1fcb760 0x80>,
+		      <0x1fcbf60 0x80>,
+		      <0xa8f8860 0x4>,
+		      <0x500c260 0x4>,
+		      <0x500d040 0x4>,
+		      <0x1da6400 0x80>;
+		reg-names = "gcc-ctrl", "lpass-stm", "lpass-qdsp", "mdss-mdp",
+			    "mdss-misc", "pcie0-hwev", "ssc-en", "ssc-hwev",
+			    "tcsr-qdss", "tcsr-mss0", "tcsr-mss1", "usb-ctrl",
+			    "vbif-stm", "vbif-stm-en", "ufs-mux";
+
+		coresight-name = "coresight-hwevent";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>,
+			 <&clock_mmss MMSS_MISC_AHB_CLK>;
+		clock-names = "core_clk", "core_a_clk", "core_mmss_clk";
+
+		qcom,hwevent-clks = "core_mmss_clk";
+	};
+
+	csr: csr@6001000 {
+		compatible = "qcom,coresight-csr";
+		reg = <0x6001000 0x1000>;
+		reg-names = "csr-base";
+
+		coresight-name = "coresight-csr";
+
+		qcom,blk-size = <1>;
+	};
+
+	modem_etm0 {
+		compatible = "qcom,coresight-remote-etm";
+
+		coresight-name = "coresight-modem-etm0";
+		qcom,inst-id = <2>;
+
+		port{
+			modem_etm0_out_funnel_in1: endpoint {
+				remote-endpoint = <&funnel_in1_in_modem_etm0>;
+			};
+		};
+	};
+
+	audio_etm0 {
+		compatible = "qcom,coresight-remote-etm";
+
+		coresight-name = "coresight-audio-etm0";
+		qcom,inst-id = <5>;
+
+		port{
+			audio_etm0_out_funnel_dlct: endpoint {
+				remote-endpoint = <&funnel_dlct_in_audio_etm0>;
+			};
+		};
+	};
+
+	rpm_etm0 {
+		compatible = "qcom,coresight-remote-etm";
+
+		coresight-name = "coresight-rpm-etm0";
+		qcom,inst-id = <4>;
+
+		port{
+			rpm_etm0_out_funnel_in0: endpoint {
+				remote-endpoint = <&funnel_in0_in_rpm_etm0>;
+			};
+		};
+	};
+
+	turing_etm0 {
+		compatible = "qcom,coresight-remote-etm";
+
+		coresight-name = "coresight-turing-etm0";
+		qcom,inst-id = <13>;
+
+		port{
+			turing_etm0_out_funnel_in1: endpoint {
+				remote-endpoint = <&funnel_in1_in_turing_etm0>;
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-external-codec.dtsi b/arch/arm64/boot/dts/qcom/sdm660-external-codec.dtsi
new file mode 100644
index 000000000000..1cea52f2b0dd
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-external-codec.dtsi
@@ -0,0 +1,35 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&cdc_pdm_gpios {
+	status = "disabled";
+};
+
+&cdc_comp_gpios {
+	status = "disabled";
+};
+
+&cdc_dmic_gpios {
+	status = "disabled";
+};
+
+&cdc_sdw_gpios {
+	status = "disabled";
+};
+
+&wsa_spkr_en1 {
+	status = "disabled";
+};
+
+&wsa_spkr_en2 {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-gpu.dtsi b/arch/arm64/boot/dts/qcom/sdm660-gpu.dtsi
new file mode 100644
index 000000000000..2194cf606d29
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-gpu.dtsi
@@ -0,0 +1,586 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	pil_gpu: qcom,kgsl-hyp {
+		compatible = "qcom,pil-tz-generic";
+		qcom,pas-id = <13>;
+		qcom,firmware-name = "a512_zap";
+	};
+
+	msm_bus: qcom,kgsl-busmon{
+		label = "kgsl-busmon";
+		compatible = "qcom,kgsl-busmon";
+	};
+
+	gpubw: qcom,gpubw {
+		compatible = "qcom,devbw";
+		governor = "bw_vbif";
+		qcom,src-dst-ports = <26 512>;
+		/*
+		 * active-only flag is used while registering the bus
+		 * governor. It helps release the bus vote when the CPU
+		 * subsystem is inactive
+		 */
+		qcom,active-only;
+		/*
+		 * IB votes in MBPS, derived using below formula
+		 * IB = (DDR frequency * DDR bus width in Bytes * Dual rate)
+		 * Note: IB vote is per DDR channel vote
+		 */
+		qcom,bw-tbl =
+			<     0 /*  off     */ >,
+			<   381 /*  100 MHz */ >,
+			<   572 /*  150 MHz */ >,
+			<   762 /*  200 MHz */ >,
+			<  1144 /*  300 MHz */ >,
+			<  1571 /*  412 MHz */ >,
+			<  2086 /*  547 MHz */ >,
+			<  2597 /*  681 MHz */ >,
+			<  2929 /*  768 MHz */ >,
+			<  3879 /*  1017 MHz */ >,
+			<  4943 /*  1296 MHz */ >,
+			<  5161 /*  1353 MHz */ >,
+			<  5931 /*  1555 MHz */ >,
+			<  6881 /*  1804 MHz */ >;
+	};
+
+	msm_gpu: qcom,kgsl-3d0@5000000 {
+		label = "kgsl-3d0";
+		compatible = "qcom,kgsl-3d0", "qcom,kgsl-3d";
+		status = "ok";
+		reg = <0x5000000 0x40000
+			0x780000 0x6220>;
+		reg-names = "kgsl_3d0_reg_memory", "qfprom_memory";
+		interrupts = <0 300 0>;
+		interrupt-names = "kgsl_3d0_irq";
+		qcom,id = <0>;
+
+		qcom,chipid = <0x05010200>;
+
+		qcom,initial-pwrlevel = <6>;
+
+		/* <HZ/12> */
+		qcom,idle-timeout = <80>;
+
+		qcom,highest-bank-bit = <14>;
+
+		/* size in bytes */
+		qcom,snapshot-size = <1048576>;
+
+		clocks = <&clock_gfx GPUCC_GFX3D_CLK>,
+			<&clock_gcc GCC_GPU_CFG_AHB_CLK>,
+			<&clock_gfx GPUCC_RBBMTIMER_CLK>,
+			<&clock_gcc GCC_GPU_BIMC_GFX_CLK>,
+			<&clock_gcc GCC_BIMC_GFX_CLK>,
+			<&clock_gpu GPUCC_RBCPR_CLK>;
+
+		clock-names = "core_clk", "iface_clk", "rbbmtimer_clk",
+			"mem_clk", "alt_mem_iface_clk", "rbcpr_clk";
+
+		/* Bus Scale Settings */
+		qcom,gpubw-dev = <&gpubw>;
+		qcom,bus-control;
+		/* GPU to BIMC bus width, VBIF data transfer in 1 cycle */
+		qcom,bus-width = <32>;
+		qcom,msm-bus,name = "grp3d";
+		qcom,msm-bus,num-cases = <14>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<26 512 0 0>,
+
+				<26 512 0 400000>,     /*  1 bus=100  */
+				<26 512 0 600000>,     /*  2 bus=150  */
+				<26 512 0 800000>,     /*  3 bus=200  */
+				<26 512 0 1200000>,    /*  4 bus=300  */
+				<26 512 0 1648000>,    /*  5 bus=412  */
+				<26 512 0 2188000>,    /*  6 bus=547  */
+				<26 512 0 2724000>,    /*  7 bus=681  */
+				<26 512 0 3072000>,    /*  8 bus=768  */
+				<26 512 0 4068000>,    /*  9 bus=1017 */
+				<26 512 0 5184000>,    /* 10 bus=1296 */
+				<26 512 0 5412000>,    /* 11 bus=1353 */
+				<26 512 0 6220000>,    /* 12 bus=1555 */
+				<26 512 0 7216000>;    /* 13 bus=1804 */
+
+		/* GDSC regulator names */
+		regulator-names = "vddcx", "vdd";
+		/* GDSC oxili regulators */
+		vddcx-supply = <&gdsc_gpu_cx>;
+		vdd-supply = <&gdsc_gpu_gx>;
+
+		/* Cx ipeak limit supprt */
+		qcom,gpu-cx-ipeak = <&cx_ipeak_lm 1>;
+		qcom,gpu-cx-ipeak-clk = <700000000>;
+
+		/* CPU latency parameter */
+		qcom,pm-qos-active-latency = <518>;
+		qcom,pm-qos-wakeup-latency = <518>;
+
+		/* Quirks */
+		qcom,gpu-quirk-dp2clockgating-disable;
+		qcom,gpu-quirk-lmloadkill-disable;
+
+		/* Enable context aware freq. scaling */
+		qcom,enable-ca-jump;
+
+		/* Context aware jump busy penalty in us */
+		qcom,ca-busy-penalty = <12000>;
+
+		/* Context aware jump target power level */
+		qcom,ca-target-pwrlevel = <4>;
+
+		qcom,gpu-speed-bin = <0x41a0 0x1fe00000 21>;
+
+		/* GPU Mempools */
+		qcom,gpu-mempools {
+			#address-cells= <1>;
+			#size-cells = <0>;
+			compatible = "qcom,gpu-mempools";
+
+			qcom,mempool-max-pages = <32768>;
+
+			/* 4K Page Pool configuration */
+			qcom,gpu-mempool@0 {
+				reg = <0>;
+				qcom,mempool-page-size = <4096>;
+			};
+			/* 64K Page Pool configuration */
+			qcom,gpu-mempool@1 {
+				reg = <1>;
+				qcom,mempool-page-size  = <65536>;
+				qcom,mempool-allocate;
+			};
+		};
+
+		/*
+		 * Speed-bin zero is default speed bin.
+		 * For rest of the speed bins, speed-bin value
+		 * is calulated as FMAX/4.8 MHz round up to zero
+		 * decimal places.
+		 */
+		qcom,gpu-pwrlevel-bins {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			compatible="qcom,gpu-pwrlevel-bins";
+
+			qcom,gpu-pwrlevels-0 {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				qcom,speed-bin = <0>;
+
+				qcom,initial-pwrlevel = <6>;
+
+				/* TURBO */
+				qcom,gpu-pwrlevel@0 {
+					reg = <0>;
+					qcom,gpu-freq = <750000000>;
+					qcom,bus-freq = <13>;
+					qcom,bus-min = <12>;
+					qcom,bus-max = <13>;
+				};
+
+				/* TURBO */
+				qcom,gpu-pwrlevel@1 {
+					reg = <1>;
+					qcom,gpu-freq = <700000000>;
+					qcom,bus-freq = <11>;
+					qcom,bus-min = <11>;
+					qcom,bus-max = <13>;
+				};
+
+				/* NOM_L1 */
+				qcom,gpu-pwrlevel@2 {
+					reg = <2>;
+					qcom,gpu-freq = <647000000>;
+					qcom,bus-freq = <11>;
+					qcom,bus-min = <10>;
+					qcom,bus-max = <12>;
+				};
+
+				/* NOM */
+				qcom,gpu-pwrlevel@3 {
+					reg = <3>;
+					qcom,gpu-freq = <588000000>;
+					qcom,bus-freq = <10>;
+					qcom,bus-min = <9>;
+					qcom,bus-max = <12>;
+				};
+
+				/* SVS_L1 */
+				qcom,gpu-pwrlevel@4 {
+					reg = <4>;
+					qcom,gpu-freq = <465000000>;
+					qcom,bus-freq = <9>;
+					qcom,bus-min = <8>;
+					qcom,bus-max = <11>;
+				};
+
+				/* SVS */
+				qcom,gpu-pwrlevel@5 {
+					reg = <5>;
+					qcom,gpu-freq = <370000000>;
+					qcom,bus-freq = <8>;
+					qcom,bus-min = <6>;
+					qcom,bus-max = <9>;
+				};
+
+				/* Low SVS */
+				qcom,gpu-pwrlevel@6 {
+					reg = <6>;
+					qcom,gpu-freq = <266000000>;
+					qcom,bus-freq = <3>;
+					qcom,bus-min = <3>;
+					qcom,bus-max = <6>;
+				};
+
+				/* Min SVS */
+				qcom,gpu-pwrlevel@7 {
+					reg = <7>;
+					qcom,gpu-freq = <160000000>;
+					qcom,bus-freq = <3>;
+					qcom,bus-min = <3>;
+					qcom,bus-max = <5>;
+				};
+
+				/* XO */
+				qcom,gpu-pwrlevel@8 {
+					reg = <8>;
+					qcom,gpu-freq = <19200000>;
+					qcom,bus-freq = <0>;
+					qcom,bus-min = <0>;
+					qcom,bus-max = <0>;
+				};
+			};
+
+			qcom,gpu-pwrlevels-1 {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				qcom,speed-bin = <157>;
+
+				qcom,initial-pwrlevel = <6>;
+
+				/* TURBO */
+				qcom,gpu-pwrlevel@0 {
+					reg = <0>;
+					qcom,gpu-freq = <750000000>;
+					qcom,bus-freq = <13>;
+					qcom,bus-min = <12>;
+					qcom,bus-max = <13>;
+				};
+
+				/* TURBO */
+				qcom,gpu-pwrlevel@1 {
+					reg = <1>;
+					qcom,gpu-freq = <700000000>;
+					qcom,bus-freq = <11>;
+					qcom,bus-min = <11>;
+					qcom,bus-max = <13>;
+				};
+
+				/* NOM_L1 */
+				qcom,gpu-pwrlevel@2 {
+					reg = <2>;
+					qcom,gpu-freq = <647000000>;
+					qcom,bus-freq = <11>;
+					qcom,bus-min = <10>;
+					qcom,bus-max = <12>;
+				};
+
+				/* NOM */
+				qcom,gpu-pwrlevel@3 {
+					reg = <3>;
+					qcom,gpu-freq = <588000000>;
+					qcom,bus-freq = <10>;
+					qcom,bus-min = <9>;
+					qcom,bus-max = <12>;
+				};
+
+				/* SVS_L1 */
+				qcom,gpu-pwrlevel@4 {
+					reg = <4>;
+					qcom,gpu-freq = <465000000>;
+					qcom,bus-freq = <9>;
+					qcom,bus-min = <8>;
+					qcom,bus-max = <11>;
+				};
+
+				/* SVS */
+				qcom,gpu-pwrlevel@5 {
+					reg = <5>;
+					qcom,gpu-freq = <370000000>;
+					qcom,bus-freq = <8>;
+					qcom,bus-min = <6>;
+					qcom,bus-max = <9>;
+				};
+
+				/* Low SVS */
+				qcom,gpu-pwrlevel@6 {
+					reg = <6>;
+					qcom,gpu-freq = <266000000>;
+					qcom,bus-freq = <3>;
+					qcom,bus-min = <3>;
+					qcom,bus-max = <6>;
+				};
+
+				/* Min SVS */
+				qcom,gpu-pwrlevel@7 {
+					reg = <7>;
+					qcom,gpu-freq = <160000000>;
+					qcom,bus-freq = <3>;
+					qcom,bus-min = <3>;
+					qcom,bus-max = <5>;
+				};
+
+				/* XO */
+				qcom,gpu-pwrlevel@8 {
+					reg = <8>;
+					qcom,gpu-freq = <19200000>;
+					qcom,bus-freq = <0>;
+					qcom,bus-min = <0>;
+					qcom,bus-max = <0>;
+				};
+			};
+
+			qcom,gpu-pwrlevels-2 {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				qcom,speed-bin = <146>;
+
+				qcom,initial-pwrlevel = <5>;
+
+				/* TURBO */
+				qcom,gpu-pwrlevel@0 {
+					reg = <0>;
+					qcom,gpu-freq = <700000000>;
+					qcom,bus-freq = <13>;
+					qcom,bus-min = <12>;
+					qcom,bus-max = <13>;
+				};
+
+				/* NOM_L1 */
+				qcom,gpu-pwrlevel@1 {
+					reg = <1>;
+					qcom,gpu-freq = <647000000>;
+					qcom,bus-freq = <11>;
+					qcom,bus-min = <10>;
+					qcom,bus-max = <12>;
+				};
+
+				/* NOM */
+				qcom,gpu-pwrlevel@2 {
+					reg = <2>;
+					qcom,gpu-freq = <588000000>;
+					qcom,bus-freq = <10>;
+					qcom,bus-min = <9>;
+					qcom,bus-max = <12>;
+				};
+
+				/* SVS_L1 */
+				qcom,gpu-pwrlevel@3 {
+					reg = <3>;
+					qcom,gpu-freq = <465000000>;
+					qcom,bus-freq = <9>;
+					qcom,bus-min = <8>;
+					qcom,bus-max = <11>;
+				};
+
+				/* SVS */
+				qcom,gpu-pwrlevel@4 {
+					reg = <4>;
+					qcom,gpu-freq = <370000000>;
+					qcom,bus-freq = <8>;
+					qcom,bus-min = <6>;
+					qcom,bus-max = <9>;
+				};
+
+				/* Low SVS */
+				qcom,gpu-pwrlevel@5 {
+					reg = <5>;
+					qcom,gpu-freq = <266000000>;
+					qcom,bus-freq = <3>;
+					qcom,bus-min = <3>;
+					qcom,bus-max = <6>;
+				};
+
+				/* Min SVS */
+				qcom,gpu-pwrlevel@6 {
+					reg = <6>;
+					qcom,gpu-freq = <160000000>;
+					qcom,bus-freq = <3>;
+					qcom,bus-min = <3>;
+					qcom,bus-max = <5>;
+				};
+
+				/* XO */
+				qcom,gpu-pwrlevel@7 {
+					reg = <7>;
+					qcom,gpu-freq = <19200000>;
+					qcom,bus-freq = <0>;
+					qcom,bus-min = <0>;
+					qcom,bus-max = <0>;
+				};
+			};
+
+			qcom,gpu-pwrlevels-3 {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				qcom,speed-bin = <135>;
+
+				qcom,initial-pwrlevel = <4>;
+
+				/* NOM_L1 */
+				qcom,gpu-pwrlevel@0 {
+					reg = <0>;
+					qcom,gpu-freq = <647000000>;
+					qcom,bus-freq = <13>;
+					qcom,bus-min = <12>;
+					qcom,bus-max = <13>;
+				};
+
+				/* NOM */
+				qcom,gpu-pwrlevel@1 {
+					reg = <1>;
+					qcom,gpu-freq = <588000000>;
+					qcom,bus-freq = <10>;
+					qcom,bus-min = <9>;
+					qcom,bus-max = <12>;
+				};
+
+				/* SVS_L1 */
+				qcom,gpu-pwrlevel@2 {
+					reg = <2>;
+					qcom,gpu-freq = <465000000>;
+					qcom,bus-freq = <9>;
+					qcom,bus-min = <8>;
+					qcom,bus-max = <11>;
+				};
+
+				/* SVS */
+				qcom,gpu-pwrlevel@3 {
+					reg = <3>;
+					qcom,gpu-freq = <370000000>;
+					qcom,bus-freq = <8>;
+					qcom,bus-min = <6>;
+					qcom,bus-max = <9>;
+				};
+
+				/* Low SVS */
+				qcom,gpu-pwrlevel@4 {
+					reg = <4>;
+					qcom,gpu-freq = <266000000>;
+					qcom,bus-freq = <3>;
+					qcom,bus-min = <3>;
+					qcom,bus-max = <6>;
+				};
+
+				/* Min SVS */
+				qcom,gpu-pwrlevel@5 {
+					reg = <5>;
+					qcom,gpu-freq = <160000000>;
+					qcom,bus-freq = <3>;
+					qcom,bus-min = <3>;
+					qcom,bus-max = <5>;
+				};
+
+				/* XO */
+				qcom,gpu-pwrlevel@6 {
+					reg = <6>;
+					qcom,gpu-freq = <19200000>;
+					qcom,bus-freq = <0>;
+					qcom,bus-min = <0>;
+					qcom,bus-max = <0>;
+				};
+			};
+
+			qcom,gpu-pwrlevels-4 {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				qcom,speed-bin = <78>;
+
+				qcom,initial-pwrlevel = <1>;
+
+				/* SVS */
+				qcom,gpu-pwrlevel@0 {
+					reg = <0>;
+					qcom,gpu-freq = <370000000>;
+					qcom,bus-freq = <8>;
+					qcom,bus-min = <6>;
+					qcom,bus-max = <11>;
+				};
+
+				/* Low SVS */
+				qcom,gpu-pwrlevel@1 {
+					reg = <1>;
+					qcom,gpu-freq = <266000000>;
+					qcom,bus-freq = <3>;
+					qcom,bus-min = <3>;
+					qcom,bus-max = <6>;
+				};
+
+				/* Min SVS */
+				qcom,gpu-pwrlevel@2 {
+					reg = <2>;
+					qcom,gpu-freq = <160000000>;
+					qcom,bus-freq = <3>;
+					qcom,bus-min = <3>;
+					qcom,bus-max = <5>;
+				};
+
+				/* XO */
+				qcom,gpu-pwrlevel@3 {
+					reg = <3>;
+					qcom,gpu-freq = <19200000>;
+					qcom,bus-freq = <0>;
+					qcom,bus-min = <0>;
+					qcom,bus-max = <0>;
+				};
+			};
+		};
+	};
+
+	kgsl_msm_iommu: qcom,kgsl-iommu {
+		compatible = "qcom,kgsl-smmu-v2";
+
+		reg = <0x05040000 0x10000>;
+		qcom,protect = <0x40000 0x10000>;
+		qcom,micro-mmu-control = <0x6000>;
+
+		clocks =<&clock_gcc GCC_GPU_CFG_AHB_CLK>,
+			<&clock_gcc GCC_GPU_BIMC_GFX_CLK>,
+			<&clock_gcc GCC_BIMC_GFX_CLK>;
+
+		clock-names = "iface_clk", "mem_clk", "alt_mem_iface_clk";
+
+		qcom,secure_align_mask = <0xfff>;
+		qcom,retention;
+		qcom,hyp_secure_alloc;
+
+		gfx3d_user: gfx3d_user {
+			compatible = "qcom,smmu-kgsl-cb";
+			label = "gfx3d_user";
+			iommus = <&kgsl_smmu 0>;
+			qcom,gpu-offset = <0x48000>;
+		};
+
+		gfx3d_secure: gfx3d_secure {
+			compatible = "qcom,smmu-kgsl-cb";
+			iommus = <&kgsl_smmu 2>;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-headset-jacktype-no-cdp.dts b/arch/arm64/boot/dts/qcom/sdm660-headset-jacktype-no-cdp.dts
new file mode 100644
index 000000000000..48cfefb4cdd0
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-headset-jacktype-no-cdp.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660L, Headset Jacktype NO, CDP";
+	compatible = "qcom,sdm660-cdp", "qcom,sdm660", "qcom,cdp";
+	qcom,board-id = <1 2>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-headset-jacktype-no-rcm.dts b/arch/arm64/boot/dts/qcom/sdm660-headset-jacktype-no-rcm.dts
new file mode 100644
index 000000000000..aad1d7bd6aec
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-headset-jacktype-no-rcm.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660L, Headset Jacktype NO, RCM";
+	compatible = "qcom,sdm660-cdp", "qcom,sdm660", "qcom,cdp";
+	qcom,board-id = <21 2>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-internal-codec-cdp.dts b/arch/arm64/boot/dts/qcom/sdm660-internal-codec-cdp.dts
new file mode 100644
index 000000000000..6755385313b1
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-internal-codec-cdp.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660L Int. Audio Codec CDP";
+	compatible = "qcom,sdm660-cdp", "qcom,sdm660", "qcom,cdp";
+	qcom,board-id = <1 1>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-internal-codec-mtp.dts b/arch/arm64/boot/dts/qcom/sdm660-internal-codec-mtp.dts
new file mode 100644
index 000000000000..39da13e7565b
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-internal-codec-mtp.dts
@@ -0,0 +1,30 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-mtp.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660L Int. Audio Codec MTP";
+	compatible = "qcom,sdm660-mtp", "qcom,sdm660", "qcom,mtp";
+	qcom,board-id = <8 1>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&int_codec {
+	qcom,model = "sdm660-snd-card-mtp";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-internal-codec-pm660a-cdp.dts b/arch/arm64/boot/dts/qcom/sdm660-internal-codec-pm660a-cdp.dts
new file mode 100644
index 000000000000..caf8af514237
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-internal-codec-pm660a-cdp.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660A Int. Audio Codec CDP";
+	compatible = "qcom,sdm660-cdp", "qcom,sdm660", "qcom,cdp";
+	qcom,board-id = <1 1>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-internal-codec-pm660a-mtp.dts b/arch/arm64/boot/dts/qcom/sdm660-internal-codec-pm660a-mtp.dts
new file mode 100644
index 000000000000..d2ae22879ef4
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-internal-codec-pm660a-mtp.dts
@@ -0,0 +1,31 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-mtp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660A Int. Audio Codec MTP";
+	compatible = "qcom,sdm660-mtp", "qcom,sdm660", "qcom,mtp";
+	qcom,board-id = <8 1>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&int_codec {
+	qcom,model = "sdm660-snd-card-mtp";
+	status = "okay";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-internal-codec-pm660a-rcm.dts b/arch/arm64/boot/dts/qcom/sdm660-internal-codec-pm660a-rcm.dts
new file mode 100644
index 000000000000..462362211f5b
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-internal-codec-pm660a-rcm.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660A Int. Audio Codec RCM";
+	compatible = "qcom,sdm660-cdp", "qcom,sdm660", "qcom,cdp";
+	qcom,board-id = <21 1>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-internal-codec-rcm.dts b/arch/arm64/boot/dts/qcom/sdm660-internal-codec-rcm.dts
new file mode 100644
index 000000000000..8d95f8c422f9
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-internal-codec-rcm.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "sdm660-internal-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660L Int. Audio Codec RCM";
+	compatible = "qcom,sdm660-cdp", "qcom,sdm660", "qcom,cdp";
+	qcom,board-id = <21 1>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-internal-codec.dtsi b/arch/arm64/boot/dts/qcom/sdm660-internal-codec.dtsi
new file mode 100644
index 000000000000..5f36e76c910d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-internal-codec.dtsi
@@ -0,0 +1,83 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&slim_aud {
+	status = "disabled";
+};
+
+&dai_slim {
+	status = "disabled";
+};
+
+&wcd9335 {
+	status = "disabled";
+};
+
+&wcd934x_cdc {
+	status = "disabled";
+};
+
+&clock_audio {
+	status = "disabled";
+};
+
+&wcd_rst_gpio {
+	status = "disabled";
+};
+
+&wcd9xxx_intc {
+	status = "disabled";
+};
+
+&tasha_snd {
+	status = "disabled";
+};
+
+&tavil_snd {
+	status = "disabled";
+};
+
+&spi_7 {
+	status = "disabled";
+};
+
+&wdsp_mgr {
+	status = "disabled";
+};
+
+&wdsp_glink {
+	status = "disabled";
+};
+
+&glink_spi_xprt_wdsp {
+	status = "disabled";
+};
+
+&glink_fifo_wdsp {
+	status = "disabled";
+};
+
+&glink_qos_wdsp {
+	status = "disabled";
+};
+
+&int_codec {
+	status = "okay";
+};
+
+&pmic_analog_codec {
+	status = "okay";
+};
+
+&msm_sdw_codec {
+	status = "okay";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-ion.dtsi b/arch/arm64/boot/dts/qcom/sdm660-ion.dtsi
new file mode 100644
index 000000000000..00b9e61d01b8
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-ion.dtsi
@@ -0,0 +1,47 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	qcom,ion {
+		compatible = "qcom,msm-ion";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		system_heap: qcom,ion-heap@25 {
+			reg = <25>;
+			qcom,ion-heap-type = "SYSTEM";
+		};
+
+		qcom,ion-heap@22 { /* ADSP HEAP */
+			reg = <22>;
+			memory-region = <&adsp_mem>;
+			qcom,ion-heap-type = "DMA";
+		};
+
+		qcom,ion-heap@27 { /* QSEECOM HEAP */
+			reg = <27>;
+			memory-region = <&qseecom_mem>;
+			qcom,ion-heap-type = "DMA";
+		};
+
+		qcom,ion-heap@10 { /* SECURE DISPLAY HEAP */
+			reg = <10>;
+			memory-region = <&secure_display_memory>;
+			qcom,ion-heap-type = "HYP_CMA";
+		};
+
+		qcom,ion-heap@9 {
+			reg = <9>;
+			qcom,ion-heap-type = "SYSTEM_SECURE";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-lpi.dtsi b/arch/arm64/boot/dts/qcom/sdm660-lpi.dtsi
new file mode 100644
index 000000000000..1fcf0993c4b3
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-lpi.dtsi
@@ -0,0 +1,212 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	lpi_tlmm: lpi_pinctrl@15070000 {
+		compatible = "qcom,lpi-pinctrl";
+		reg = <0x15070000 0x0>;
+		qcom,num-gpios = <32>;
+		gpio-controller;
+		#gpio-cells = <2>;
+
+		lpi_mclk0_active: lpi_mclk0_active {
+			mux {
+				pins = "gpio18";
+				function = "func2";
+			};
+
+			config {
+				pins = "gpio18";
+				drive-strength = <8>;
+				bias-disable;
+			};
+		};
+
+		lpi_mclk0_sleep: lpi_mclk0_sleep {
+			mux {
+				pins = "gpio18";
+				function = "func2";
+			};
+
+			config {
+				pins = "gpio18";
+				drive-strength = <2>;
+				bias-pull-down;
+			};
+		};
+
+		cdc_pdm_gpios_active: cdc_pdm_gpios_active {
+			mux {
+				pins = "gpio18", "gpio19",
+					"gpio21", "gpio23",
+					"gpio25";
+				function = "func1";
+			};
+
+			config {
+				pins = "gpio18", "gpio19",
+					"gpio21", "gpio23",
+					"gpio25";
+				drive-strength = <8>;
+				output-high;
+			};
+		};
+
+		cdc_pdm_gpios_sleep: cdc_pdm_gpios_sleep {
+			mux {
+				pins = "gpio18", "gpio19",
+					"gpio21", "gpio23",
+					"gpio25";
+				function = "func1";
+			};
+
+			config {
+				pins = "gpio18", "gpio19",
+					"gpio21", "gpio23",
+					"gpio25";
+				drive-strength = <2>;
+				bias-disable;
+				output-low;
+			};
+		};
+
+		cdc_pdm_2_gpios_active: cdc_pdm_2_gpios_active {
+			mux {
+				pins = "gpio20";
+				function = "func1";
+			};
+
+			config {
+				pins = "gpio20";
+				drive-strength = <8>;
+			};
+		};
+
+		cdc_pdm_2_gpios_sleep: cdc_pdm_2_gpios_sleep {
+			mux {
+				pins = "gpio20";
+				function = "func1";
+			};
+
+			config {
+				pins = "gpio20";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		cdc_comp_gpios_active: cdc_pdm_comp_gpios_active {
+			mux {
+				pins = "gpio22", "gpio24";
+				function = "func1";
+			};
+
+			config {
+				pins = "gpio22", "gpio24";
+				drive-strength = <8>;
+			};
+		};
+
+		cdc_comp_gpios_sleep: cdc_pdm_comp_gpios_sleep {
+			mux {
+				pins = "gpio22", "gpio24";
+				function = "func1";
+			};
+
+			config {
+				pins = "gpio22", "gpio24";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		lpi_cdc_reset_active: lpi_cdc_reset_active {
+			mux {
+				pins = "gpio24";
+				function = "gpio";
+			};
+			config {
+				pins = "gpio24";
+				drive-strength = <16>;
+				output-high;
+			};
+		};
+
+		lpi_cdc_reset_sleep: lpi_cdc_reset_sleep {
+			mux {
+				pins = "gpio24";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio24";
+				drive-strength = <16>;
+				bias-disable;
+				output-low;
+			};
+		};
+
+		cdc_dmic12_gpios_active: dmic12_gpios_active {
+			mux {
+				pins = "gpio26", "gpio28";
+				function = "func1";
+			};
+
+			config {
+				pins = "gpio26", "gpio28";
+				drive-strength = <8>;
+				output-high;
+			};
+		};
+
+		cdc_dmic12_gpios_sleep: dmic12_gpios_sleep {
+			mux {
+				pins = "gpio26", "gpio28";
+				function = "func1";
+			};
+
+			config {
+				pins = "gpio26", "gpio28";
+				drive-strength = <2>;
+				bias-disable;
+				output-low;
+			};
+		};
+
+		cdc_dmic34_gpios_active: dmic34_gpios_active {
+			mux {
+				pins = "gpio27", "gpio29";
+				function = "func1";
+			};
+
+			config {
+				pins = "gpio27", "gpio29";
+				drive-strength = <8>;
+				input-enable;
+			};
+		};
+
+		cdc_dmic34_gpios_sleep: dmic34_gpios_sleep {
+			mux {
+				pins = "gpio27", "gpio29";
+				function = "func1";
+			};
+
+			config {
+				pins = "gpio27", "gpio29";
+				drive-strength = <2>;
+				pull-down;
+				input-enable;
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-mdss-panels.dtsi b/arch/arm64/boot/dts/qcom/sdm660-mdss-panels.dtsi
new file mode 100644
index 000000000000..3ffd43bcda60
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-mdss-panels.dtsi
@@ -0,0 +1,327 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "dsi-panel-sim-video.dtsi"
+#include "dsi-panel-sim-dualmipi-video.dtsi"
+#include "dsi-panel-nt35597-truly-dualmipi-wqxga-video.dtsi"
+#include "dsi-panel-nt35597-truly-dualmipi-wqxga-cmd.dtsi"
+#include "dsi-panel-nt36850-truly-dualmipi-wqhd-cmd.dtsi"
+#include "dsi-panel-sharp-dualmipi-wqxga-video.dtsi"
+#include "dsi-panel-nt35597-truly-dsc-wqxga-video.dtsi"
+#include "dsi-panel-nt35597-truly-dsc-wqxga-cmd.dtsi"
+#include "dsi-panel-nt35597-dualmipi-wqxga-video.dtsi"
+#include "dsi-panel-nt35597-dualmipi-wqxga-cmd.dtsi"
+#include "dsi-panel-nt35695b-truly-fhd-video.dtsi"
+#include "dsi-panel-nt35695b-truly-fhd-cmd.dtsi"
+#include "dsi-panel-truly-1080p-cmd.dtsi"
+#include "dsi-panel-truly-1080p-video.dtsi"
+#include "dsi-panel-rm67195-amoled-fhd-cmd.dtsi"
+
+&soc {
+	dsi_panel_pwr_supply: dsi_panel_pwr_supply {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "wqhd-vddio";
+			qcom,supply-min-voltage = <1800000>;
+			qcom,supply-max-voltage = <1950000>;
+			qcom,supply-enable-load = <32000>;
+			qcom,supply-disable-load = <80>;
+		};
+
+		qcom,panel-supply-entry@1 {
+			reg = <1>;
+			qcom,supply-name = "lab";
+			qcom,supply-min-voltage = <4600000>;
+			qcom,supply-max-voltage = <6000000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+		};
+
+		qcom,panel-supply-entry@2 {
+			reg = <2>;
+			qcom,supply-name = "ibb";
+			qcom,supply-min-voltage = <4600000>;
+			qcom,supply-max-voltage = <6000000>;
+			qcom,supply-enable-load = <100000>;
+			qcom,supply-disable-load = <100>;
+			qcom,supply-post-on-sleep = <10>;
+		};
+	};
+
+	dsi_panel_pwr_supply_labibb_amoled:
+		dsi_panel_pwr_supply_labibb_amoled {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,panel-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "wqhd-vddio";
+				qcom,supply-min-voltage = <1800000>;
+				qcom,supply-max-voltage = <1950000>;
+				qcom,supply-enable-load = <32000>;
+				qcom,supply-disable-load = <80>;
+			};
+
+			qcom,panel-supply-entry@1 {
+				reg = <1>;
+				qcom,supply-name = "vdda-3p3";
+				qcom,supply-min-voltage = <3300000>;
+				qcom,supply-max-voltage = <3300000>;
+				qcom,supply-enable-load = <13200>;
+				qcom,supply-disable-load = <80>;
+			};
+
+			qcom,panel-supply-entry@2 {
+				reg = <2>;
+				qcom,supply-name = "lab";
+				qcom,supply-min-voltage = <4600000>;
+				qcom,supply-max-voltage = <6100000>;
+				qcom,supply-enable-load = <100000>;
+				qcom,supply-disable-load = <100>;
+			};
+
+			qcom,panel-supply-entry@3 {
+				reg = <3>;
+				qcom,supply-name = "ibb";
+				qcom,supply-min-voltage = <4000000>;
+				qcom,supply-max-voltage = <6300000>;
+				qcom,supply-enable-load = <100000>;
+				qcom,supply-disable-load = <100>;
+			};
+
+			qcom,panel-supply-entry@4 {
+				reg = <4>;
+				qcom,supply-name = "oledb";
+				qcom,supply-min-voltage = <5000000>;
+				qcom,supply-max-voltage = <8100000>;
+				qcom,supply-enable-load = <100000>;
+				qcom,supply-disable-load = <100>;
+			};
+		};
+
+	dsi_panel_pwr_supply_no_labibb: dsi_panel_pwr_supply_no_labibb {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		qcom,panel-supply-entry@0 {
+			reg = <0>;
+			qcom,supply-name = "wqhd-vddio";
+			qcom,supply-min-voltage = <1800000>;
+			qcom,supply-max-voltage = <1950000>;
+			qcom,supply-enable-load = <32000>;
+			qcom,supply-disable-load = <80>;
+		};
+	};
+};
+
+&dsi_dual_nt35597_truly_video {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 18 07 08 04 03 04 a0];
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x9c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x9c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-panel-max-error-count = <3>;
+	qcom,mdss-dsi-min-refresh-rate = <53>;
+	qcom,mdss-dsi-max-refresh-rate = <60>;
+	qcom,mdss-dsi-pan-enable-dynamic-fps;
+	qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
+};
+
+&dsi_dual_nt35597_truly_cmd {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 18 07 08 04 03 04 a0];
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x9c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x9c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-panel-max-error-count = <3>;
+};
+
+&dsi_dual_nt36850_truly_cmd {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [24 1f 08 09 05 03 04 a0
+		24 1f 08 09 05 03 04 a0
+		24 1f 08 09 05 03 04 a0
+		24 1f 08 09 05 03 04 a0
+		24 1c 08 09 05 03 04 a0];
+	qcom,mdss-dsi-t-clk-post = <0x0e>;
+	qcom,mdss-dsi-t-clk-pre = <0x31>;
+};
+
+&dsi_dual_sharp_video {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [23 20 06 09 05 03 04 a0
+			23 20 06 09 05 03 04 a0
+			23 20 06 09 05 03 04 a0
+			23 20 06 09 05 03 04 a0
+			23 2e 06 08 05 03 04 a0];
+	qcom,mdss-dsi-min-refresh-rate = <53>;
+	qcom,mdss-dsi-max-refresh-rate = <60>;
+	qcom,mdss-dsi-pan-enable-dynamic-fps;
+	qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
+};
+
+&dsi_nt35597_truly_dsc_video {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [20 1d 05 07 03 03 04 a0
+		20 1d 05 07 03 03 04 a0
+		20 1d 05 07 03 03 04 a0
+		20 1d 05 07 03 03 04 a0
+		20 12 05 06 03 13 04 a0];
+	qcom,config-select = <&dsi_nt35597_truly_dsc_video_config2>;
+	qcom,mdss-dsi-min-refresh-rate = <53>;
+	qcom,mdss-dsi-max-refresh-rate = <60>;
+	qcom,mdss-dsi-pan-enable-dynamic-fps;
+	qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x9c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x9c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-panel-max-error-count = <3>;
+};
+
+&dsi_nt35597_truly_dsc_cmd {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [20 1d 05 07 03 03 04 a0
+		20 1d 05 07 03 03 04 a0
+		20 1d 05 07 03 03 04 a0
+		20 1d 05 07 03 03 04 a0
+		20 12 05 06 03 13 04 a0];
+	qcom,config-select = <&dsi_nt35597_truly_dsc_cmd_config2>;
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x9c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x9c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-panel-max-error-count = <3>;
+};
+
+&dsi_dual_nt35597_video {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 18 07 08 04 03 04 a0];
+	qcom,mdss-dsi-min-refresh-rate = <53>;
+	qcom,mdss-dsi-max-refresh-rate = <60>;
+	qcom,mdss-dsi-pan-enable-dynamic-fps;
+	qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
+};
+
+&dsi_dual_nt35597_cmd {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 1e 07 08 05 03 04 a0
+		23 18 07 08 04 03 04 a0];
+};
+
+&dsi_nt35695b_truly_fhd_video {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [24 1e 08 09 05 03 04 a0
+		24 1e 08 09 05 03 04 a0
+		24 1e 08 09 05 03 04 a0
+		24 1e 08 09 05 03 04 a0
+		24 1a 08 09 05 03 04 a0];
+	qcom,mdss-dsi-min-refresh-rate = <48>;
+	qcom,mdss-dsi-max-refresh-rate = <60>;
+	qcom,mdss-dsi-pan-enable-dynamic-fps;
+	qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x9c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x9c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-panel-max-error-count = <3>;
+};
+
+&dsi_nt35695b_truly_fhd_cmd {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [24 1e 08 09 05 03 04 a0
+		24 1e 08 09 05 03 04 a0
+		24 1e 08 09 05 03 04 a0
+		24 1e 08 09 05 03 04 a0
+		24 1a 08 09 05 03 04 a0];
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x9c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x9c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-panel-max-error-count = <3>;
+};
+
+&dsi_truly_1080_vid {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [23 1e 08 09 05 03 04 a0
+		23 1e 08 09 05 03 04 a0
+		23 1e 08 09 05 03 04 a0
+		23 1e 08 09 05 03 04 a0
+		23 1a 08 09 05 03 04 a0];
+	qcom,mdss-dsi-min-refresh-rate = <48>;
+	qcom,mdss-dsi-max-refresh-rate = <60>;
+	qcom,mdss-dsi-pan-enable-dynamic-fps;
+	qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x1c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x1c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-panel-max-error-count = <3>;
+
+};
+
+&dsi_truly_1080_cmd {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [23 1e 08 09 05 03 04 a0
+		23 1e 08 09 05 03 04 a0
+		23 1e 08 09 05 03 04 a0
+		23 1e 08 09 05 03 04 a0
+		23 1a 08 09 05 03 04 a0];
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x1c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x1c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-panel-max-error-count = <3>;
+
+};
+
+&dsi_rm67195_amoled_fhd_cmd {
+	qcom,mdss-dsi-panel-timings-phy-v2 = [24 1f 08 09 05 03 04 a0
+		24 1f 08 09 05 03 04 a0
+		24 1f 08 09 05 03 04 a0
+		24 1f 08 09 05 03 04 a0
+		24 1a 08 09 05 03 04 a0];
+	qcom,mdss-dsi-t-clk-post = <0x0d>;
+	qcom,mdss-dsi-t-clk-pre = <0x2f>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-mdss-pll.dtsi b/arch/arm64/boot/dts/qcom/sdm660-mdss-pll.dtsi
new file mode 100644
index 000000000000..69d3736d4ba8
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-mdss-pll.dtsi
@@ -0,0 +1,117 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	mdss_dsi0_pll: qcom,mdss_dsi_pll@c994400 {
+		compatible = "qcom,mdss_dsi_pll_sdm660";
+		status = "ok";
+		label = "MDSS DSI 0 PLL";
+		cell-index = <0>;
+		#clock-cells = <1>;
+
+		reg = <0xc994400 0x588>,
+		      <0xc8c2300 0x8>;
+		reg-names = "pll_base", "gdsc_base";
+
+		gdsc-supply = <&gdsc_mdss>;
+
+		clocks = <&clock_mmss MMSS_MDSS_AHB_CLK>;
+		clock-names = "iface_clk";
+		clock-rate = <0>;
+		qcom,dsi-pll-ssc-en;
+		qcom,dsi-pll-ssc-mode = "down-spread";
+
+		qcom,platform-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,platform-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+
+		};
+	};
+
+	mdss_dsi1_pll: qcom,mdss_dsi_pll@c996400 {
+		compatible = "qcom,mdss_dsi_pll_sdm660";
+		status = "ok";
+		label = "MDSS DSI 1 PLL";
+		cell-index = <1>;
+		#clock-cells = <1>;
+
+		reg = <0xc996400 0x588>,
+		      <0xc8c2300 0x8>;
+		reg-names = "pll_base", "gdsc_base";
+
+		gdsc-supply = <&gdsc_mdss>;
+
+		clocks = <&clock_mmss MMSS_MDSS_AHB_CLK>;
+		clock-names = "iface_clk";
+		clock-rate = <0>;
+		qcom,dsi-pll-ssc-en;
+		qcom,dsi-pll-ssc-mode = "down-spread";
+
+		qcom,platform-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,platform-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+	};
+
+	mdss_dp_pll: qcom,mdss_dp_pll@c011000 {
+		compatible = "qcom,mdss_dp_pll_sdm660";
+		status = "ok";
+		label = "MDSS DP PLL";
+		cell-index = <0>;
+		#clock-cells = <1>;
+
+		reg = <0xc011c00 0x190>,
+		      <0xc011000 0x910>,
+		      <0x0c8c2300 0x8>;
+		reg-names = "pll_base", "phy_base", "gdsc_base";
+
+		gdsc-supply = <&gdsc_mdss>;
+
+		clocks = <&clock_mmss MMSS_MDSS_AHB_CLK>,
+			 <&clock_rpmcc RPM_LN_BB_CLK1>,
+			 <&clock_gcc GCC_USB3_CLKREF_CLK>;
+		clock-names = "iface_clk", "ref_clk_src", "ref_clk";
+		clock-rate = <0>;
+
+		qcom,platform-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,platform-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-mdss.dtsi b/arch/arm64/boot/dts/qcom/sdm660-mdss.dtsi
new file mode 100644
index 000000000000..ab4e71e3cd65
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-mdss.dtsi
@@ -0,0 +1,623 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/clock/mdss-pll-clk.h>
+
+&soc {
+	mdss_mdp: qcom,mdss_mdp@c900000 {
+		compatible = "qcom,mdss_mdp";
+		status = "ok";
+		reg = <0x0c900000 0x90000>,
+		      <0x0c9b0000 0x1040>;
+		reg-names = "mdp_phys", "vbif_phys";
+		interrupts = <0 83 0>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		vdd-supply = <&gdsc_mdss>;
+
+		/* Bus Scale Settings */
+		qcom,msm-bus,name = "mdss_mdp";
+		qcom,msm-bus,num-cases = <3>;
+		qcom,msm-bus,num-paths = <2>;
+		qcom,msm-bus,vectors-KBps =
+			<22 512 0 0>, <23 512 0 0>,
+			<22 512 0 6400000>, <23 512 0 6400000>,
+			<22 512 0 6400000>, <23 512 0 6400000>;
+
+		/* Fudge factors */
+		qcom,mdss-ab-factor = <1 1>;		/* 1 time  */
+		qcom,mdss-ib-factor = <1 1>;		/* 1 time  */
+		qcom,mdss-clk-factor = <105 100>;	/* 1.05 times */
+
+		qcom,max-mixer-width = <2560>;
+		qcom,max-pipe-width = <2560>;
+
+		qcom,max-dest-scaler-input-width = <2048>;
+		qcom,max-dest-scaler-output-width = <2560>;
+
+		/* VBIF QoS remapper settings*/
+		qcom,mdss-vbif-qos-rt-setting = <1 2 2 2>;
+		qcom,mdss-vbif-qos-nrt-setting = <1 1 1 1>;
+		qcom,vbif-settings = <0x00ac 0x00008040>,
+				     <0x00d0 0x00002828>;
+
+		qcom,mdss-cx-ipeak = <&cx_ipeak_lm 3>;
+		qcom,mdss-has-panic-ctrl;
+		qcom,mdss-per-pipe-panic-luts = <0x000f>,
+						<0xffff>,
+						<0xfffc>,
+						<0xff00>;
+
+		qcom,mdss-mdp-reg-offset = <0x00001000>;
+		qcom,max-bandwidth-low-kbps = <6600000>;
+		qcom,max-bandwidth-high-kbps = <6600000>;
+		qcom,max-bandwidth-per-pipe-kbps = <3100000>;
+		qcom,max-clk-rate = <412500000>;
+		qcom,mdss-default-ot-rd-limit = <32>;
+		qcom,mdss-default-ot-wr-limit = <32>;
+		qcom,mdss-dram-channels = <2>;
+
+		/* Bandwidth limit settings */
+		qcom,max-bw-settings = <1 6600000>, /* Default */
+				       <2 4500000>; /* Camera */
+
+		qcom,mdss-pipe-vig-off = <0x00005000 0x00007000>;
+		qcom,mdss-pipe-dma-off = <0x00025000 0x00027000
+					  0x00029000>;
+		qcom,mdss-pipe-cursor-off = <0x00035000>;
+
+		qcom,mdss-pipe-vig-xin-id = <0 4>;
+		qcom,mdss-pipe-dma-xin-id = <1 5 9>;
+		qcom,mdss-pipe-cursor-xin-id = <2>;
+
+		/* These Offsets are relative to
+		 * "mdp_phys + mdp-reg-offset" address
+		*/
+		qcom,mdss-pipe-vig-clk-ctrl-offsets = <0x2ac 0 0>,
+						      <0x2b4 0 0>;
+		qcom,mdss-pipe-dma-clk-ctrl-offsets = <0x2ac  8 12>,
+						      <0x2b4  8 12>,
+						      <0x2c4  8 12>;
+		qcom,mdss-pipe-cursor-clk-ctrl-offsets = <0x3a8 16 15>;
+
+		qcom,mdss-ctl-off = <0x00002000 0x00002200 0x00002400
+				     0x00002600 0x00002800>;
+		qcom,mdss-mixer-intf-off = <0x00045000 0x00046000
+					    0x00047000 0x0004a000>;
+		qcom,mdss-dspp-off = <0x00055000 0x00057000>;
+		qcom,mdss-wb-off = <0x00066000>;
+		qcom,mdss-intf-off = <0x0006b000 0x0006b800
+					0x0006c000 0x0006c800>;
+		qcom,mdss-pingpong-off = <0x00071000 0x00071800
+					  0x00072000 0x00072800>;
+		qcom,mdss-slave-pingpong-off = <0x00073000>;
+		qcom,mdss-ppb-ctl-off = <0x00000330 0x00000338 0x00000370
+			0x00000374> ;
+		qcom,mdss-ppb-cfg-off = <0x00000334 0x0000033C>;
+		qcom,mdss-has-pingpong-split;
+		qcom,mdss-has-separate-rotator;
+
+		qcom,mdss-ad-off = <0x0079000 0x00079800>;
+		qcom,mdss-cdm-off = <0x0007a200>;
+		qcom,mdss-dsc-off = <0x00081000 0x00081400>;
+		qcom,mdss-wfd-mode = "intf";
+		qcom,mdss-has-source-split;
+		qcom,mdss-highest-bank-bit = <0x1>;
+		qcom,mdss-has-decimation;
+		qcom,mdss-idle-power-collapse-enabled;
+		clocks = <&clock_mmss MMSS_MNOC_AHB_CLK>,
+			 <&clock_mmss MMSS_MDSS_AHB_CLK>,
+			 <&clock_mmss MMSS_MDSS_AXI_CLK>,
+			 <&clock_mmss MMSS_THROTTLE_MDSS_AXI_CLK>,
+			 <&clock_mmss MDP_CLK_SRC>,
+			 <&clock_mmss MMSS_MDSS_MDP_CLK>,
+			 <&clock_mmss MMSS_MDSS_VSYNC_CLK>,
+			 <&clock_mmss MDP_CLK_SRC>;
+		clock-names = "mnoc_clk", "iface_clk", "bus_clk",
+				"throttle_bus_clk", "core_clk_src",
+				"core_clk", "vsync_clk", "lut_clk";
+
+		qcom,mdp-settings = <0x01190 0x00000000>,
+				    <0x012ac 0xc0000ccc>,
+				    <0x012b4 0xc0000ccc>,
+				    <0x012bc 0x00cccccc>,
+				    <0x012c4 0x0000cccc>,
+				    <0x013a8 0x0cccc0c0>,
+				    <0x013b0 0xccccc0c0>,
+				    <0x013b8 0xcccc0000>,
+				    <0x013d0 0x00cc0000>,
+				    <0x0506c 0x00000000>,
+				    <0x0706c 0x00000000>,
+				    <0x0906c 0x00000000>,
+				    <0x0b06c 0x00000000>,
+				    <0x1506c 0x00000000>,
+				    <0x1706c 0x00000000>,
+				    <0x1906c 0x00000000>,
+				    <0x1b06c 0x00000000>,
+				    <0x2506c 0x00000000>,
+				    <0x2706c 0x00000000>;
+
+		qcom,regs-dump-mdp = <0x01000 0x01458>,
+				     <0x02000 0x02094>,
+				     <0x02200 0x02294>,
+				     <0x02400 0x02494>,
+				     <0x02600 0x02694>,
+				     <0x02800 0x02894>,
+				     <0x05000 0x05154>,
+				     <0x05a00 0x05b00>,
+				     <0x07000 0x07154>,
+				     <0x07a00 0x07b00>,
+				     <0x25000 0x25184>,
+				     <0x27000 0x27184>,
+				     <0x29000 0x29184>,
+				     <0x35000 0x35150>,
+				     <0x45000 0x452bc>,
+				     <0x46000 0x462bc>,
+				     <0x47000 0x472bc>,
+				     <0x4a000 0x4a2bc>,
+				     <0x55000 0x5522c>,
+				     <0x57000 0x5722c>,
+				     <0x66000 0x662c0>,
+				     <0x6b000 0x6b268>,
+				     <0x6b800 0x6ba68>,
+				     <0x6c000 0x6c268>,
+				     <0x71000 0x710d4>,
+				     <0x71800 0x718d4>,
+				     <0x73000 0x730d4>,
+				     <0x81000 0x81140>,
+				     <0x81400 0x81540>;
+
+		qcom,regs-dump-names-mdp = "MDP",
+			"CTL_0",    "CTL_1", "CTL_2",   "CTL_3", "CTL_4",
+			"VIG0_SSPP", "VIG0",  "VIG1_SSPP", "VIG1",
+			"DMA0_SSPP", "DMA1_SSPP","DMA2_SSPP",
+			"CURSOR0_SSPP",
+			"LAYER_0", "LAYER_1", "LAYER_2",
+			"LAYER_5",
+			"DSPP_0",  "DSPP_1",
+			"WB_2",
+			"INTF_0", "INTF_1",  "INTF_2",
+			"PP_0",    "PP_1", "PP_4",
+			"DSC_0",    "DSC_1";
+
+		/* buffer parameters to calculate prefill bandwidth */
+		qcom,mdss-prefill-outstanding-buffer-bytes = <0>;
+		qcom,mdss-prefill-y-buffer-bytes = <0>;
+		qcom,mdss-prefill-scaler-buffer-lines-bilinear = <2>;
+		qcom,mdss-prefill-scaler-buffer-lines-caf = <4>;
+		qcom,mdss-prefill-post-scaler-buffer-pixels = <2560>;
+		qcom,mdss-prefill-pingpong-buffer-pixels = <5120>;
+
+		qcom,mdss-reg-bus {
+			/* Reg Bus Scale Settings */
+			qcom,msm-bus,name = "mdss_reg";
+			qcom,msm-bus,num-cases = <4>;
+			qcom,msm-bus,num-paths = <1>;
+			qcom,msm-bus,active-only;
+			qcom,msm-bus,vectors-KBps =
+				<1 590 0 0>,
+				<1 590 0 76800>,
+				<1 590 0 160000>,
+				<1 590 0 320000>;
+		};
+
+		qcom,mdss-pp-offsets {
+			qcom,mdss-sspp-mdss-igc-lut-off = <0x2000>;
+			qcom,mdss-sspp-vig-pcc-off = <0x1b00>;
+			qcom,mdss-sspp-rgb-pcc-off = <0x380>;
+			qcom,mdss-sspp-dma-pcc-off = <0x380>;
+			qcom,mdss-lm-pgc-off = <0x3c0>;
+			qcom,mdss-dspp-gamut-off = <0x1600>;
+			qcom,mdss-dspp-pcc-off = <0x1700>;
+			qcom,mdss-dspp-pgc-off = <0x17c0>;
+		};
+
+		qcom,mdss-scaler-offsets {
+			qcom,mdss-vig-scaler-off = <0xa00>;
+			qcom,mdss-vig-scaler-lut-off = <0xb00>;
+			qcom,mdss-has-dest-scaler;
+			qcom,mdss-dest-block-off = <0x00061000>;
+			qcom,mdss-dest-scaler-off = <0x800 0x1000>;
+			qcom,mdss-dest-scaler-lut-off = <0x900 0x1100>;
+		};
+
+		smmu_mdp_unsec: qcom,smmu_mdp_unsec_cb {
+			compatible = "qcom,smmu_mdp_unsec";
+			iommus = <&mmss_bimc_smmu 0>;
+			gdsc-mmagic-mdss-supply = <&gdsc_bimc_smmu>;
+			clocks = <&clock_rpmcc  MMSSNOC_AXI_CLK>,
+				<&clock_mmss MMSS_MNOC_AHB_CLK>,
+				<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+				<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>;
+			clock-names = "mmss_noc_axi_clk",
+					"mmss_noc_ahb_clk",
+					"mmss_smmu_ahb_clk",
+					"mmss_smmu_axi_clk";
+		};
+
+		smmu_mdp_sec: qcom,smmu_mdp_sec_cb {
+			compatible = "qcom,smmu_mdp_sec";
+			iommus = <&mmss_bimc_smmu 1>;
+			gdsc-mmagic-mdss-supply = <&gdsc_bimc_smmu>;
+			clocks = <&clock_rpmcc  MMSSNOC_AXI_CLK>,
+				<&clock_mmss MMSS_MNOC_AHB_CLK>,
+				<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+				<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>;
+			clock-names = "mmss_noc_axi_clk",
+					"mmss_noc_ahb_clk",
+					"mmss_smmu_ahb_clk",
+					"mmss_smmu_axi_clk";
+		};
+
+		mdss_fb0: qcom,mdss_fb_primary {
+			cell-index = <0>;
+			compatible = "qcom,mdss-fb";
+			qcom,cont-splash-memory {
+				linux,contiguous-region = <&cont_splash_mem>;
+			};
+		};
+
+		mdss_fb1: qcom,mdss_fb_wfd {
+			cell-index = <1>;
+			compatible = "qcom,mdss-fb";
+		};
+
+		mdss_fb2: qcom,mdss_fb_dp {
+			cell-index = <2>;
+			compatible = "qcom,mdss-fb";
+			qcom,mdss-intf = <&mdss_dp_ctrl>;
+		};
+
+	};
+
+	mdss_dsi: qcom,mdss_dsi@0 {
+		compatible = "qcom,mdss-dsi";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		gdsc-supply = <&gdsc_mdss>;
+		vdda-1p2-supply = <&pm660_l1>;
+		vdda-0p9-supply = <&pm660l_l1>;
+		ranges = <0xc994000 0xc994000 0x400
+			0xc994400 0xc994400 0x588
+			0xc828000 0xc828000 0xac
+			0xc996000 0xc996000 0x400
+			0xc996400 0xc996400 0x588
+			0xc828000 0xc828000 0xac>;
+
+		/* Bus Scale Settings */
+		qcom,msm-bus,name = "mdss_dsi";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<22 512 0 0>,
+			<22 512 0 1000>;
+
+		qcom,mmss-ulp-clamp-ctrl-offset = <0x14>;
+
+		clocks = <&clock_mmss MMSS_MDSS_MDP_CLK>,
+			 <&clock_mmss MMSS_MNOC_AHB_CLK>,
+			 <&clock_mmss MMSS_MDSS_AHB_CLK>,
+			 <&clock_mmss MMSS_MDSS_AXI_CLK>,
+			 <&clock_mmss MMSS_MISC_AHB_CLK>,
+			 <&mdss_dsi0_pll BYTE0_MUX_CLK>,
+			 <&mdss_dsi1_pll BYTE1_MUX_CLK>,
+			 <&mdss_dsi0_pll PIX0_MUX_CLK>,
+			 <&mdss_dsi1_pll PIX1_MUX_CLK>;
+		clock-names = "mdp_core_clk",
+			"mnoc_clk", "iface_clk",
+			"bus_clk", "core_mmss_clk",
+			"ext_byte0_clk", "ext_byte1_clk",
+			"ext_pixel0_clk", "ext_pixel1_clk";
+
+		qcom,core-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,core-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+
+		qcom,ctrl-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,ctrl-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vdda-1p2";
+				qcom,supply-min-voltage = <1200000>;
+				qcom,supply-max-voltage = <1250000>;
+				qcom,supply-enable-load = <12560>;
+				qcom,supply-disable-load = <4>;
+			};
+		};
+
+		qcom,phy-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,phy-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vdda-0p9";
+				qcom,supply-min-voltage = <880000>;
+				qcom,supply-max-voltage = <925000>;
+				qcom,supply-enable-load = <73400>;
+				qcom,supply-disable-load = <32>;
+			};
+		};
+
+		mdss_dsi0: qcom,mdss_dsi_ctrl0@c994000 {
+			compatible = "qcom,mdss-dsi-ctrl";
+			label = "MDSS DSI CTRL->0";
+			cell-index = <0>;
+			reg =	<0xc994000 0x400>,
+				<0xc994400 0x588>,
+				<0xc828000 0xac>;
+			reg-names = "dsi_ctrl", "dsi_phy", "mmss_misc_phys";
+
+			qcom,timing-db-mode;
+			wqhd-vddio-supply = <&pm660_l11>;
+			vdda-3p3-supply = <&pm660l_l6>;
+			lab-supply = <&lcdb_ldo_vreg>;
+			ibb-supply = <&lcdb_ncp_vreg>;
+			qcom,mdss-mdp = <&mdss_mdp>;
+			qcom,mdss-fb-map = <&mdss_fb0>;
+
+			clocks = <&clock_mmss MMSS_MDSS_BYTE0_CLK>,
+				 <&clock_mmss MMSS_MDSS_PCLK0_CLK>,
+				 <&clock_mmss MMSS_MDSS_ESC0_CLK>,
+				 <&clock_mmss BYTE0_CLK_SRC>,
+				 <&clock_mmss PCLK0_CLK_SRC>,
+				 <&clock_mmss MMSS_MDSS_BYTE0_INTF_CLK>;
+			clock-names = "byte_clk", "pixel_clk", "core_clk",
+				"byte_clk_rcg", "pixel_clk_rcg",
+				"byte_intf_clk";
+
+			qcom,null-insertion-enabled;
+			qcom,platform-strength-ctrl = [ff 06
+							ff 06
+							ff 06
+							ff 06
+							ff 00];
+			qcom,platform-regulator-settings = [1d
+							1d 1d 1d 1d];
+			qcom,platform-lane-config = [00 00 10 0f
+						00 00 10 0f
+						00 00 10 0f
+						00 00 10 0f
+						00 00 10 8f];
+		};
+
+		mdss_dsi1: qcom,mdss_dsi_ctrl1@c996000 {
+			compatible = "qcom,mdss-dsi-ctrl";
+			label = "MDSS DSI CTRL->1";
+			cell-index = <1>;
+			reg =	<0xc996000 0x400>,
+				<0xc996400 0x588>,
+				<0xc828000 0xac>;
+			reg-names = "dsi_ctrl", "dsi_phy", "mmss_misc_phys";
+
+			qcom,timing-db-mode;
+			wqhd-vddio-supply = <&pm660_l11>;
+			lab-supply = <&lcdb_ldo_vreg>;
+			ibb-supply = <&lcdb_ncp_vreg>;
+			qcom,mdss-mdp = <&mdss_mdp>;
+			qcom,mdss-fb-map = <&mdss_fb0>;
+
+			clocks = <&clock_mmss MMSS_MDSS_BYTE1_CLK>,
+				 <&clock_mmss MMSS_MDSS_PCLK1_CLK>,
+				 <&clock_mmss MMSS_MDSS_ESC1_CLK>,
+				 <&clock_mmss BYTE1_CLK_SRC>,
+				 <&clock_mmss PCLK1_CLK_SRC>,
+				 <&clock_mmss MMSS_MDSS_BYTE1_INTF_CLK>;
+			clock-names = "byte_clk", "pixel_clk", "core_clk",
+				"byte_clk_rcg", "pixel_clk_rcg",
+				"byte_intf_clk";
+
+			qcom,null-insertion-enabled;
+			qcom,platform-strength-ctrl = [ff 06
+							ff 06
+							ff 06
+							ff 06
+							ff 00];
+			qcom,platform-regulator-settings = [1d
+							1d 1d 1d 1d];
+			qcom,platform-lane-config = [00 00 10 0f
+						00 00 10 0f
+						00 00 10 0f
+						00 00 10 0f
+						00 00 10 8f];
+		};
+	};
+
+	qcom,mdss_wb_panel {
+		compatible = "qcom,mdss_wb";
+		qcom,mdss_pan_res = <640 480>;
+		qcom,mdss_pan_bpp = <24>;
+		qcom,mdss-fb-map = <&mdss_fb1>;
+	};
+
+	msm_ext_disp: qcom,msm_ext_disp {
+		status = "ok";
+		compatible = "qcom,msm-ext-disp";
+
+		ext_disp_audio_codec: qcom,msm-ext-disp-audio-codec-rx {
+			compatible = "qcom,msm-ext-disp-audio-codec-rx";
+			qcom,msm_ext_disp = <&msm_ext_disp>;
+		};
+	};
+
+	mdss_dp_ctrl: qcom,dp_ctrl@c990000 {
+		status = "ok";
+		cell-index = <0>;
+		compatible = "qcom,mdss-dp";
+		qcom,mdss-fb-map = <&mdss_fb2>;
+
+		gdsc-supply = <&gdsc_mdss>;
+		vdda-1p8-supply = <&pm660_l10>;
+		vdda-0p9-supply = <&pm660l_l1>;
+
+		reg =	<0xc990000 0xa8c>,
+			<0xc011000 0x910>,
+			<0x1fcb200 0x050>,
+			<0xc8c2200 0x1a0>,
+			<0x780000 0x621c>,
+			<0xc9e1000 0x02c>;
+		reg-names = "dp_ctrl", "dp_phy", "tcsr_regs", "dp_mmss_cc",
+				"qfprom_physical","hdcp_physical";
+
+		clocks = <&clock_mmss MMSS_MNOC_AHB_CLK>,
+			 <&clock_mmss MMSS_MDSS_AHB_CLK>,
+			 <&clock_mmss MMSS_MDSS_AXI_CLK>,
+			 <&clock_mmss MMSS_MDSS_MDP_CLK>,
+			 <&clock_mmss MMSS_MDSS_HDMI_DP_AHB_CLK>,
+			 <&clock_mmss MMSS_MDSS_DP_AUX_CLK>,
+			 <&clock_rpmcc RPM_LN_BB_CLK1>,
+			 <&clock_gcc GCC_USB3_CLKREF_CLK>,
+			 <&clock_gcc GCC_USB_PHY_CFG_AHB2PHY_CLK>,
+			 <&clock_mmss MMSS_MDSS_DP_LINK_CLK>,
+			 <&clock_mmss MMSS_MDSS_DP_LINK_INTF_CLK>,
+			 <&clock_mmss MMSS_MDSS_DP_CRYPTO_CLK>,
+			 <&clock_mmss MMSS_MDSS_DP_PIXEL_CLK>,
+			 <&clock_mmss DP_PIXEL_CLK_SRC>,
+			 <&mdss_dp_pll DP_VCO_DIVIDED_CLK_SRC_MUX>;
+		clock-names = "core_mnoc_clk", "core_iface_clk", "core_bus_clk",
+			"core_mdp_core_clk", "core_alt_iface_clk",
+			"core_aux_clk", "core_ref_clk_src", "core_ref_clk",
+			"core_ahb_phy_clk", "ctrl_link_clk",
+			"ctrl_link_iface_clk", "ctrl_crypto_clk",
+			"ctrl_pixel_clk", "pixel_clk_rcg", "pixel_parent";
+
+		qcom,dp-usbpd-detection = <&pm660_pdphy>;
+
+		qcom,msm_ext_disp = <&msm_ext_disp>;
+
+		qcom,aux-cfg0-settings = [20 00];
+		qcom,aux-cfg1-settings = [24 13 23 1d];
+		qcom,aux-cfg2-settings = [28 00];
+		qcom,aux-cfg3-settings = [2c 00];
+		qcom,aux-cfg4-settings = [30 0a];
+		qcom,aux-cfg5-settings = [34 28];
+		qcom,aux-cfg6-settings = [38 0a];
+		qcom,aux-cfg7-settings = [3c 03];
+		qcom,aux-cfg8-settings = [40 b7];
+		qcom,aux-cfg9-settings = [44 03];
+		qcom,logical2physical-lane-map = [00 01 02 03];
+		qcom,phy-register-offset = <0x4>;
+		qcom,max-pclk-frequency-khz = <300000>;
+
+		qcom,core-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,core-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "gdsc";
+				qcom,supply-min-voltage = <0>;
+				qcom,supply-max-voltage = <0>;
+				qcom,supply-enable-load = <0>;
+				qcom,supply-disable-load = <0>;
+			};
+		};
+
+		qcom,ctrl-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,ctrl-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vdda-1p8";
+				qcom,supply-min-voltage = <1780000>;
+				qcom,supply-max-voltage = <1950000>;
+				qcom,supply-enable-load = <12560>;
+				qcom,supply-disable-load = <4>;
+			};
+		};
+
+		qcom,phy-supply-entries {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			qcom,phy-supply-entry@0 {
+				reg = <0>;
+				qcom,supply-name = "vdda-0p9";
+				qcom,supply-min-voltage = <880000>;
+				qcom,supply-max-voltage = <925000>;
+				qcom,supply-enable-load = <73400>;
+				qcom,supply-disable-load = <32>;
+			};
+		};
+	};
+
+	mdss_rotator: qcom,mdss_rotator {
+		compatible = "qcom,sde_rotator";
+		reg = <0x0c900000 0xab100>,
+		      <0x0c9b0000 0x1040>;
+		reg-names = "mdp_phys",
+			"rot_vbif_phys";
+
+		qcom,mdss-rot-mode = <1>;
+		qcom,mdss-highest-bank-bit = <0x1>;
+
+		/* Bus Scale Settings */
+		qcom,msm-bus,name = "mdss_rotator";
+		qcom,msm-bus,num-cases = <3>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<22 512 0 0>,
+			<22 512 0 6400000>,
+			<22 512 0 6400000>;
+
+		rot-vdd-supply = <&gdsc_mdss>;
+		qcom,supply-names = "rot-vdd";
+
+		clocks = <&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_MDSS_AHB_CLK>,
+			<&clock_mmss ROT_CLK_SRC>,
+			<&clock_mmss MMSS_MDSS_ROT_CLK>,
+			<&clock_mmss MMSS_MDSS_AXI_CLK>;
+		clock-names = "mnoc_clk",
+			"iface_clk", "rot_core_clk",
+			"rot_clk", "axi_clk";
+
+		interrupt-parent = <&mdss_mdp>;
+		interrupts = <2 0>;
+
+		/* VBIF QoS remapper settings*/
+		qcom,mdss-rot-vbif-qos-setting = <1 1 1 1>;
+		qcom,mdss-rot-xin-id = <14 15>;
+
+		qcom,mdss-default-ot-rd-limit = <32>;
+		qcom,mdss-default-ot-wr-limit = <32>;
+
+		qcom,sde-reg-bus {
+			/* Reg Bus Scale Settings */
+			qcom,msm-bus,name = "mdss_rot_reg";
+			qcom,msm-bus,num-cases = <4>;
+			qcom,msm-bus,num-paths = <1>;
+			qcom,msm-bus,active-only;
+			qcom,msm-bus,vectors-KBps =
+				<1 590 0 0>,
+				<1 590 0 76800>,
+				<1 590 0 160000>,
+				<1 590 0 320000>;
+		};
+	};
+
+};
+
+#include "sdm660-mdss-panels.dtsi"
diff --git a/arch/arm64/boot/dts/qcom/sdm660-mtp.dts b/arch/arm64/boot/dts/qcom/sdm660-mtp.dts
new file mode 100644
index 000000000000..72bfa20b2bf9
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-mtp.dts
@@ -0,0 +1,30 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-mtp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660L MTP";
+	compatible = "qcom,sdm660-mtp", "qcom,sdm660", "qcom,mtp";
+	qcom,board-id = <8 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-moist-cfg = <0>, <0>, <3>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-mtp.dtsi b/arch/arm64/boot/dts/qcom/sdm660-mtp.dtsi
new file mode 100644
index 000000000000..4b996389ee07
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-mtp.dtsi
@@ -0,0 +1,264 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdm660-pinctrl.dtsi"
+#include "sdm660-camera-sensor-mtp.dtsi"
+/ {
+	mtp_batterydata: qcom,battery-data {
+		qcom,batt-id-range-pct = <15>;
+		#include "fg-gen3-batterydata-itech-3000mah.dtsi"
+		#include "fg-gen3-batterydata-ascent-3450mah.dtsi"
+	};
+};
+
+&uartblsp1dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm660l_l1>;
+	vdda-pll-supply = <&pm660_l10>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14200>;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm660l_l4>;
+	vccq2-supply = <&pm660_l8>;
+	vcc-max-microamp = <500000>;
+	vccq2-max-microamp = <600000>;
+	qcom,vddp-ref-clk-supply = <&pm660_l1>;
+	qcom,vddp-ref-clk-max-microamp = <100>;
+
+	status = "ok";
+};
+
+&pm660_gpios {
+	/* GPIO 4 (NFC_CLK_REQ) */
+	gpio@c300 {
+		qcom,mode = <0>;
+		qcom,vin-sel = <1>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&i2c_6 { /* BLSP1 QUP6 (NFC) */
+	status = "okay";
+	nq@28 {
+		compatible = "qcom,nq-nci";
+		reg = <0x28>;
+		qcom,nq-irq = <&tlmm 28 0x00>;
+		qcom,nq-ven = <&tlmm 29 0x00>;
+		qcom,nq-firm = <&tlmm 30 0x00>;
+		qcom,nq-clkreq = <&pm660_gpios 4 0x00>;
+		qcom,nq-esepwr = <&tlmm 31 0x00>;
+		interrupt-parent = <&tlmm>;
+		qcom,clk-src = "BBCLK3";
+		interrupts = <28 0>;
+		interrupt-names = "nfc_irq";
+		pinctrl-names = "nfc_active", "nfc_suspend";
+		pinctrl-0 = <&nfc_int_active &nfc_enable_active>;
+		pinctrl-1 = <&nfc_int_suspend &nfc_enable_suspend>;
+		clocks = <&clock_rpmcc RPM_LN_BB_CLK3_PIN>;
+		clock-names = "ref_clk";
+	};
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_truly_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 53 0>;
+	qcom,platform-te-gpio = <&tlmm 59 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt35597_truly_video>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 53 0>;
+	qcom,platform-te-gpio = <&tlmm 59 0>;
+};
+
+&mdss_dp_ctrl {
+	pinctrl-names = "mdss_dp_active", "mdss_dp_sleep";
+	pinctrl-0 = <&mdss_dp_aux_active &mdss_dp_usbplug_cc_active>;
+	pinctrl-1 = <&mdss_dp_aux_suspend &mdss_dp_usbplug_cc_suspend>;
+	qcom,aux-en-gpio = <&tlmm 55 0>;
+	qcom,aux-sel-gpio = <&tlmm 56 0>;
+	qcom,usbplug-cc-gpio = <&tlmm 58 0>;
+};
+
+&pm660l_wled {
+	qcom,led-strings-list = [01 02];
+};
+
+&dsi_dual_nt35597_truly_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_nt35597_truly_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,mdss-dsi-mode-sel-gpio-state = "dual_port";
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_dual_sharp_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35597_truly_dsc_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35597_truly_dsc_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35695b_truly_fhd_video {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_nt35695b_truly_fhd_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&dsi_rm67195_amoled_fhd_cmd {
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_labibb_amoled>;
+};
+
+&sdhc_1 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l4>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660_l8>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-lpm-sup;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <200 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 100000000 192000000
+								384000000>;
+
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&sdhc_2 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l5>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <15000 800000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660l_l2>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	#address-cells = <0>;
+	interrupt-parent = <&sdhc_2>;
+	interrupts = <0 1 2>;
+	#interrupt-cells = <1>;
+	interrupt-map-mask = <0xffffffff>;
+	interrupt-map = <0 &intc 0 0 125 0
+			1 &intc 0 0 221 0
+			2 &tlmm 54 0>;
+	interrupt-names = "hc_irq", "pwr_irq", "status_irq";
+	cd-gpios = <&tlmm 54 0x1>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 100000000
+								200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	status = "ok";
+};
+
+&soc {
+	qcom,msm-ssc-sensors {
+		compatible = "qcom,msm-ssc-sensors";
+	};
+};
+
+&mem_client_3_size {
+	qcom,peripheral-size = <0xf00000>;
+};
+
+&pm660_fg {
+	qcom,battery-data = <&mtp_batterydata>;
+};
+
+&i2c_2 {
+	status = "ok";
+	smb1351-charger@1d {
+		compatible = "qcom,smb1351-charger";
+		reg = <0x1d>;
+		qcom,parallel-charger;
+		qcom,float-voltage-mv = <4400>;
+		qcom,recharge-mv = <100>;
+		qcom,parallel-en-pin-polarity = <1>;
+	};
+};
+
+&pm660_charger {
+	qcom,dc-is-wipower;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-pinctrl.dtsi b/arch/arm64/boot/dts/qcom/sdm660-pinctrl.dtsi
new file mode 100644
index 000000000000..e55a67e68b36
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-pinctrl.dtsi
@@ -0,0 +1,1696 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	tlmm: pinctrl@03000000 {
+		compatible = "qcom,sdm660-pinctrl";
+		reg = <0x03000000 0xc00000>;
+		interrupts = <0 208 0>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+
+		uart_console_active: uart_console_active {
+			mux {
+				pins = "gpio4", "gpio5";
+				function = "blsp_uart2";
+			};
+
+			config {
+				pins = "gpio4", "gpio5";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		led_enable: led_enable {
+			mux {
+				pins = "gpio40";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio40";
+				drive_strength = <2>;
+				output-high;
+				bias-disable;
+			};
+		};
+
+		led_disable: led_disable {
+			mux {
+				pins = "gpio40";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio40";
+				drive_strength = <2>;
+				output-low;
+				bias-disable;
+			};
+		};
+
+		trigout_a: trigout_a {
+			mux {
+				pins = "gpio49";
+				function = "qdss_cti0_a";
+			};
+
+			config {
+				pins = "gpio49";
+				drive-strength = <16>;
+				bias-disable;
+				output-low;
+			};
+		};
+
+		/* SDC pin type */
+		sdc1_clk_on: sdc1_clk_on {
+			config {
+				pins = "sdc1_clk";
+				bias-disable;		/* NO pull */
+				drive-strength = <16>;	/* 16 MA */
+			};
+		};
+
+		sdc1_clk_off: sdc1_clk_off {
+			config {
+				pins = "sdc1_clk";
+				bias-disable;		/* NO pull */
+				drive-strength = <2>;	/* 2 MA */
+			};
+		};
+
+		sdc1_cmd_on: sdc1_cmd_on {
+			config {
+				pins = "sdc1_cmd";
+				bias-pull-up;		/* pull up */
+				drive-strength = <10>;	/* 10 MA */
+			};
+		};
+
+		sdc1_cmd_off: sdc1_cmd_off {
+			config {
+				pins = "sdc1_cmd";
+				num-grp-pins = <1>;
+				bias-pull-up;		/* pull up */
+				drive-strength = <2>;	/* 2 MA */
+			};
+		};
+
+		sdc1_data_on: sdc1_data_on {
+			config {
+				pins = "sdc1_data";
+				bias-pull-up;		/* pull up */
+				drive-strength = <10>;	/* 10 MA */
+			};
+		};
+
+		sdc1_data_off: sdc1_data_off {
+			config {
+				pins = "sdc1_data";
+				bias-pull-up;		/* pull up */
+				drive-strength = <2>;	/* 2 MA */
+			};
+		};
+
+		sdc1_rclk_on: sdc1_rclk_on {
+			config {
+				pins = "sdc1_rclk";
+				bias-pull-down; /* pull down */
+			};
+		};
+
+		sdc1_rclk_off: sdc1_rclk_off {
+			config {
+				pins = "sdc1_rclk";
+				bias-pull-down; /* pull down */
+			};
+		};
+
+		sdc2_clk_on: sdc2_clk_on {
+			config {
+				pins = "sdc2_clk";
+				drive-strength = <16>; /* 16 MA */
+				bias-disable; /* NO pull */
+			};
+		};
+
+		sdc2_clk_off: sdc2_clk_off {
+			config {
+				pins = "sdc2_clk";
+				bias-disable; /* NO pull */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		sdc2_cmd_on: sdc2_cmd_on {
+			config {
+				pins = "sdc2_cmd";
+				bias-pull-up; /* pull up */
+				drive-strength = <10>; /* 10 MA */
+			};
+		};
+
+		sdc2_cmd_off: sdc2_cmd_off {
+			config {
+				pins = "sdc2_cmd";
+				bias-pull-up; /* pull up */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		sdc2_data_on: sdc2_data_on {
+			config {
+				pins = "sdc2_data";
+				bias-pull-up; /* pull up */
+				drive-strength = <10>; /* 10 MA */
+			};
+		};
+
+		sdc2_data_off: sdc2_data_off {
+			config {
+				pins = "sdc2_data";
+				bias-pull-up; /* pull up */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		sdc2_cd_on: cd_on {
+			mux {
+				pins = "gpio54";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio54";
+				drive-strength = <2>;
+				bias-pull-up;
+			};
+		};
+
+		sdc2_cd_off: cd_off {
+			mux {
+				pins = "gpio54";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio54";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		/* I2C CONFIGURATION */
+		i2c_1 {
+			i2c_1_active: i2c_1_active {
+				mux {
+					pins = "gpio2", "gpio3";
+					function = "blsp_i2c1";
+				};
+
+				config {
+					pins = "gpio2", "gpio3";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_1_sleep: i2c_1_sleep {
+				mux {
+					pins = "gpio2", "gpio3";
+					function = "blsp_i2c1";
+				};
+
+				config {
+					pins = "gpio2", "gpio3";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_2 {
+			i2c_2_active: i2c_2_active {
+				mux {
+					pins = "gpio6", "gpio7";
+					function = "blsp_i2c2";
+				};
+
+				config {
+					pins = "gpio6", "gpio7";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_2_sleep: i2c_2_sleep {
+				mux {
+					pins = "gpio6", "gpio7";
+					function = "blsp_i2c2";
+				};
+
+				config {
+					pins = "gpio6", "gpio7";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_3 {
+			i2c_3_active: i2c_3_active {
+				mux {
+					pins = "gpio10", "gpio11";
+					function = "blsp_i2c3";
+				};
+
+				config {
+					pins = "gpio10", "gpio11";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_3_sleep: i2c_3_sleep {
+				mux {
+					pins = "gpio10", "gpio11";
+					function = "blsp_i2c3";
+				};
+
+				config {
+					pins = "gpio10", "gpio11";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_4 {
+			i2c_4_active: i2c_4_active {
+				mux {
+					pins = "gpio14", "gpio15";
+					function = "blsp_i2c4";
+				};
+
+				config {
+					pins = "gpio14", "gpio15";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_4_sleep: i2c_4_sleep {
+				mux {
+					pins = "gpio14", "gpio15";
+					function = "blsp_i2c4";
+				};
+
+				config {
+					pins = "gpio14", "gpio15";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_5 {
+			i2c_5_active: i2c_5_active {
+				mux {
+					pins = "gpio18", "gpio19";
+					function = "blsp_i2c5";
+				};
+
+				config {
+					pins = "gpio18", "gpio19";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_5_sleep: i2c_5_sleep {
+				mux {
+					pins = "gpio18", "gpio19";
+					function = "blsp_i2c5";
+				};
+
+				config {
+					pins = "gpio18", "gpio19";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_6 {
+			i2c_6_active: i2c_6_active {
+				mux {
+					pins = "gpio22", "gpio23";
+					function = "blsp_i2c6";
+				};
+
+				config {
+					pins = "gpio22", "gpio23";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_6_sleep: i2c_6_sleep {
+				mux {
+					pins = "gpio22", "gpio23";
+					function = "blsp_i2c6";
+				};
+
+				config {
+					pins = "gpio22", "gpio23";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		nfc {
+			nfc_int_active: nfc_int_active {
+				/* active state */
+				mux {
+					/* GPIO 28 NFC Read Interrupt */
+					pins = "gpio28";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio28";
+					drive-strength = <2>; /* 2 MA */
+					bias-pull-up;
+				};
+			};
+
+			nfc_int_suspend: nfc_int_suspend {
+				/* sleep state */
+				mux {
+					/* GPIO 28 NFC Read Interrupt */
+					pins = "gpio28";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio28";
+					drive-strength = <2>; /* 2 MA */
+					bias-pull-up;
+				};
+			};
+
+			nfc_enable_active: nfc_enable_active {
+				/* active state */
+				mux {
+					/* 29: NFC ENABLE 30:FW DNLD */
+					/* 31:ESE Enable */
+					pins = "gpio29", "gpio30", "gpio31";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio29", "gpio30", "gpio31";
+					drive-strength = <2>; /* 2 MA */
+					bias-pull-up;
+				};
+			};
+
+			nfc_enable_suspend: nfc_enable_suspend {
+				/* sleep state */
+				mux {
+					/* 29: NFC ENABLE 30:FW DNLD */
+					/* 31:ESE Enable */
+					pins = "gpio29", "gpio30", "gpio31";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio29", "gpio30", "gpio31";
+					drive-strength = <2>; /* 2 MA */
+					bias-disable;
+				};
+			};
+		};
+
+		i2c_7 {
+			i2c_7_active: i2c_7_active {
+				mux {
+					pins = "gpio26", "gpio27";
+					function = "blsp_i2c7";
+				};
+
+				config {
+					pins = "gpio26", "gpio27";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_7_sleep: i2c_7_sleep {
+				mux {
+					pins = "gpio26", "gpio27";
+					function = "blsp_i2c7";
+				};
+
+				config {
+					pins = "gpio26", "gpio27";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		i2c_8 {
+			i2c_8_active: i2c_8_active {
+				mux {
+					pins = "gpio30", "gpio31";
+					function = "blsp_i2c8_a";
+				};
+
+				config {
+					pins = "gpio30", "gpio31";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			i2c_8_sleep: i2c_8_sleep {
+				mux {
+					pins = "gpio30", "gpio31";
+					function = "blsp_i2c8_a";
+				};
+
+				config {
+					pins = "gpio30", "gpio31";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		/* SPI CONFIGURATION */
+		spi_1 {
+			spi_1_active: spi_1_active {
+				mux {
+					pins = "gpio0", "gpio1",
+							"gpio2", "gpio3";
+					function = "blsp_spi1";
+				};
+
+				config {
+					pins = "gpio0", "gpio1",
+							"gpio2", "gpio3";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_1_sleep: spi_1_sleep {
+				mux {
+					pins = "gpio0", "gpio1",
+							"gpio2", "gpio3";
+					function = "blsp_spi1";
+				};
+
+				config {
+					pins = "gpio0", "gpio1",
+							"gpio2", "gpio3";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_2 {
+			spi_2_active: spi_2_active {
+				mux {
+					pins = "gpio4", "gpio5",
+							"gpio6", "gpio7";
+					function = "blsp_spi2";
+				};
+
+				config {
+					pins = "gpio4", "gpio5",
+							"gpio6", "gpio7";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_2_sleep: spi_2_sleep {
+				mux {
+					pins = "gpio4", "gpio5",
+							"gpio6", "gpio7";
+					function = "blsp_spi2";
+				};
+
+				config {
+					pins = "gpio4", "gpio5",
+							"gpio6", "gpio7";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_3 {
+			spi_3_active: spi_3_active {
+				mux {
+					pins = "gpio8", "gpio9",
+							"gpio10", "gpio11";
+					function = "blsp_spi3";
+				};
+
+				config {
+					pins = "gpio8", "gpio9",
+							"gpio10", "gpio11";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_3_sleep: spi_3_sleep {
+				mux {
+					pins = "gpio8", "gpio9",
+							"gpio10", "gpio11";
+					function = "blsp_spi3";
+				};
+
+				config {
+					pins = "gpio8", "gpio9",
+							"gpio10", "gpio11";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_4 {
+			spi_4_active: spi_4_active {
+				mux {
+					pins = "gpio12", "gpio13",
+							"gpio14", "gpio15";
+					function = "blsp_spi4";
+				};
+
+				config {
+					pins = "gpio12", "gpio13",
+							"gpio14", "gpio15";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_4_sleep: spi_4_sleep {
+				mux {
+					pins = "gpio12", "gpio13",
+							"gpio14", "gpio15";
+					function = "blsp_spi4";
+				};
+
+				config {
+					pins = "gpio12", "gpio13",
+							"gpio14", "gpio15";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_5 {
+			spi_5_active: spi_5_active {
+				mux {
+					pins = "gpio16", "gpio17",
+							"gpio18", "gpio19";
+					function = "blsp_spi5";
+				};
+
+				config {
+					pins = "gpio16", "gpio17",
+							"gpio18", "gpio19";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_5_sleep: spi_5_sleep {
+				mux {
+					pins = "gpio16", "gpio17",
+							"gpio18", "gpio19";
+					function = "blsp_spi5";
+				};
+
+				config {
+					pins = "gpio16", "gpio17",
+							"gpio18", "gpio19";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_6 {
+			spi_6_active: spi_6_active {
+				mux {
+					pins = "gpio49", "gpio52",
+							"gpio22", "gpio23";
+					function = "blsp_spi6";
+				};
+
+				config {
+					pins = "gpio49", "gpio52",
+							"gpio22", "gpio23";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_6_sleep: spi_6_sleep {
+				mux {
+					pins = "gpio49", "gpio52",
+							"gpio22", "gpio23";
+					function = "blsp_spi6";
+				};
+
+				config {
+					pins = "gpio49", "gpio52",
+							"gpio22", "gpio23";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_7 {
+			spi_7_active: spi_7_active {
+				mux {
+					pins = "gpio24", "gpio25",
+							"gpio26", "gpio27";
+					function = "blsp_spi7";
+				};
+
+				config {
+					pins = "gpio24", "gpio25",
+							"gpio26", "gpio27";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_7_sleep: spi_7_sleep {
+				mux {
+					pins = "gpio24", "gpio25",
+							"gpio26", "gpio27";
+					function = "blsp_spi7";
+				};
+
+				config {
+					pins = "gpio24", "gpio25",
+							"gpio26", "gpio27";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+
+		spi_8 {
+			spi_8_active: spi_8_active {
+				mux {
+					pins = "gpio28", "gpio29",
+							"gpio30", "gpio31";
+					function = "blsp_spi8_a";
+				};
+
+				config {
+					pins = "gpio28", "gpio29",
+							"gpio30", "gpio31";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+
+			spi_8_sleep: spi_8_sleep {
+				mux {
+					pins = "gpio28", "gpio29",
+							"gpio30", "gpio31";
+					function = "blsp_spi8_a";
+				};
+
+				config {
+					pins = "gpio28", "gpio29",
+							"gpio30", "gpio31";
+					drive-strength = <6>;
+					bias-disable;
+				};
+			};
+		};
+		/* USB C analog configuration */
+		wcd_usbc_analog_en1 {
+			wcd_usbc_analog_en1_idle: wcd_usbc_ana_en1_idle {
+				mux {
+					pins = "gpio80";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio80";
+					drive-strength = <2>;
+					bias-pull-down;
+					output-low;
+				};
+			};
+
+			wcd_usbc_analog_en1_active: wcd_usbc_ana_en1_active {
+				mux {
+					pins = "gpio80";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio80";
+					drive-strength = <2>;
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		wcd_usbc_analog_en2n {
+			wcd_usbc_analog_en2n_idle: wcd_usbc_ana_en2n_idle {
+				mux {
+					pins = "gpio77";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio77";
+					drive-strength = <2>;
+					bias-disable;
+					output-high;
+				};
+			};
+
+			wcd_usbc_analog_en2n_active: wcd_usbc_ana_en2n_active {
+				mux {
+					pins = "gpio77";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio77";
+					drive-strength = <2>;
+					bias-pull-down;
+					output-low;
+				};
+			};
+		};
+
+		sdw_clk_pin {
+			sdw_clk_sleep: sdw_clk_sleep {
+				mux {
+					pins = "gpio24";
+					function = "sndwire_clk";
+				};
+
+				config {
+					pins = "gpio24";
+					drive-strength = <2>;
+					bias-bus-hold;
+				};
+			};
+
+			sdw_clk_active: sdw_clk_active {
+				mux {
+					pins = "gpio24";
+					function = "sndwire_clk";
+				};
+
+				config {
+					pins = "gpio24";
+					drive-strength = <2>;
+					bias-bus-hold;
+				};
+			};
+		};
+
+		sdw_clk_data {
+			sdw_data_sleep: sdw_data_sleep {
+				mux {
+					pins = "gpio25";
+					function = "sndwire_data";
+				};
+
+				config {
+					pins = "gpio25";
+					drive-strength = <4>;
+					bias-bus-hold;
+				};
+			};
+
+			sdw_data_active: sdw_data_active {
+				mux {
+					pins = "gpio25";
+					function = "sndwire_data";
+				};
+
+				config {
+					pins = "gpio25";
+					drive-strength = <4>;
+					bias-bus-hold;
+				};
+			};
+		};
+
+		/* WSA speaker reset pins */
+		spkr_1_sd_n {
+			spkr_1_sd_n_sleep: spkr_1_sd_n_sleep {
+				mux {
+					pins = "gpio26";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio26";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;
+					input-enable;
+				};
+			};
+
+			spkr_1_sd_n_active: spkr_1_sd_n_active {
+				mux {
+					pins = "gpio26";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio26";
+					drive-strength = <16>;   /* 16 mA */
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		spkr_2_sd_n {
+			spkr_2_sd_n_sleep: spkr_2_sd_n_sleep {
+				mux {
+					pins = "gpio27";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio27";
+					drive-strength = <2>;   /* 2 mA */
+					bias-pull-down;
+					input-enable;
+				};
+			};
+
+			spkr_2_sd_n_active: spkr_2_sd_n_active {
+				mux {
+					pins = "gpio27";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio27";
+					drive-strength = <16>;   /* 16 mA */
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		wcd_gnd_mic_swap {
+			wcd_gnd_mic_swap_idle: wcd_gnd_mic_swap_idle {
+				mux {
+					pins = "gpio63";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio63";
+					drive-strength = <2>;
+					bias-pull-down;
+					output-low;
+				};
+			};
+
+			wcd_gnd_mic_swap_active: wcd_gnd_mic_swap_active {
+				mux {
+					pins = "gpio63";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio63";
+					drive-strength = <2>;
+					bias-disable;
+					output-high;
+				};
+			};
+		};
+
+		msm_hph_en0 {
+			hph_en0_sleep: hph_en0_sleep {
+				mux {
+					pins = "gpio24";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio24";
+					output-low;
+				};
+			};
+
+			hph_en0_active: hph_en0_active {
+				mux {
+					pins = "gpio24";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio24";
+					output-high;
+				};
+			};
+		};
+
+		msm_hph_en1 {
+			hph_en1_sleep: hph_en1_sleep {
+				mux {
+					pins = "gpio25";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio25";
+					output-low;
+				};
+			};
+
+			hph_en1_active: hph_en1_active {
+				mux {
+					pins = "gpio25";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio25";
+					output-high;
+				};
+			};
+		};
+
+		cci0_active: cci0_active {
+			mux {
+				/* CLK, DATA */
+				pins = "gpio36","gpio37"; // Only 2
+				function = "cci_i2c";
+			};
+
+			config {
+				pins = "gpio36","gpio37";
+				bias-pull-up; /* PULL UP*/
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cci0_suspend: cci0_suspend {
+			mux {
+				/* CLK, DATA */
+				pins = "gpio36","gpio37";
+				function = "cci_i2c";
+			};
+
+			config {
+				pins = "gpio36","gpio37";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cci1_active: cci1_active {
+			mux {
+				/* CLK, DATA */
+				pins = "gpio38","gpio39";
+				function = "cci_i2c";
+			};
+
+			config {
+				pins = "gpio38","gpio39";
+				bias-pull-up; /* PULL UP*/
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cci1_suspend: cci1_suspend {
+			mux {
+				/* CLK, DATA */
+				pins = "gpio38","gpio39";
+				function = "cci_i2c";
+			};
+
+
+			config {
+				pins = "gpio38","gpio39";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_actuator_vaf_active: cam_actuator_vaf_active {
+			/* ACTUATOR POWER */
+			mux {
+				pins = "gpio50";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio50";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_actuator_vaf_suspend: cam_actuator_vaf_suspend {
+			/* ACTUATOR POWER */
+			mux {
+				pins = "gpio50";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio50";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_tof_active: cam_tof_active {
+			/* LASER */
+			mux {
+				pins = "gpio50", "gpio42", "gpio45";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio50", "gpio42", "gpio45";
+				bias-pull-up;
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_tof_suspend: cam_tof_suspend {
+			/* LASER */
+			mux {
+				pins = "gpio50", "gpio42", "gpio45";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio50", "gpio42", "gpio45";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk0_active: cam_sensor_mclk0_active {
+			/* MCLK0 */
+			mux {
+				/* CLK */
+				pins = "gpio32";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio32";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk0_suspend: cam_sensor_mclk0_suspend {
+			/* MCLK0 */
+			mux {
+				/* CLK */
+				pins = "gpio32";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio32";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_rear_active: cam_sensor_rear_active {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio46","gpio44";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio46","gpio44";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_rear_suspend: cam_sensor_rear_suspend {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio46","gpio44";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio46","gpio44";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk1_active: cam_sensor_mclk1_active {
+			/* MCLK1 */
+			mux {
+				/* CLK */
+				pins = "gpio33";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio33";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk1_suspend: cam_sensor_mclk1_suspend {
+			/* MCLK1 */
+			mux {
+				/* CLK */
+				pins = "gpio33";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio33";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_rear2_active: cam_sensor_rear2_active {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio48","gpio51";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio48","gpio51";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_rear2_suspend: cam_sensor_rear2_suspend {
+			/* RESET, STANDBY */
+			mux {
+				pins = "gpio48","gpio51";
+				function = "gpio";
+			};
+			config {
+				pins = "gpio48","gpio51";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk2_active: cam_sensor_mclk2_active {
+			/* MCLK1 */
+			mux {
+				/* CLK */
+				pins = "gpio34";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio34";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk2_suspend: cam_sensor_mclk2_suspend {
+			/* MCLK1 */
+			mux {
+				/* CLK */
+				pins = "gpio34";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio34";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_front_active: cam_sensor_front_active {
+			/* RESET  VANA*/
+			mux {
+				pins = "gpio47", "gpio44";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio47", "gpio44";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_front_suspend: cam_sensor_front_suspend {
+			/* RESET */
+			mux {
+				pins = "gpio47";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio47";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk3_active: cam_sensor_mclk3_active {
+			/* MCLK3 */
+			mux {
+				/* CLK */
+				pins = "gpio35";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio35";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_mclk3_suspend: cam_sensor_mclk3_suspend {
+			/* MCLK3 */
+			mux {
+				/* CLK */
+				pins = "gpio35";
+				function = "cam_mclk";
+			};
+
+			config {
+				pins = "gpio35";
+				bias-pull-down; /* PULL DOWN */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_front_iris_active: cam_sensor_front_iris_active {
+			/* RESET */
+			mux {
+				pins = "gpio52";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio52";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		cam_sensor_front_iris_suspend: cam_sensor_front_iris_suspend {
+			/* RESET */
+			mux {
+				pins = "gpio52";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio52";
+				bias-disable; /* No PULL */
+				drive-strength = <2>; /* 2 MA */
+			};
+		};
+
+		/* HS UART CONFIGURATION */
+		blsp1_uart1_active: blsp1_uart1_active {
+			mux {
+				pins = "gpio0", "gpio1", "gpio2", "gpio3";
+				function = "blsp_uart1";
+			};
+
+			config {
+				pins = "gpio0", "gpio1", "gpio2", "gpio3";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp1_uart1_sleep: blsp1_uart1_sleep {
+			mux {
+				pins = "gpio0", "gpio1", "gpio2", "gpio3";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio0", "gpio1", "gpio2", "gpio3";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp1_uart2_active: blsp1_uart2_active {
+			mux {
+				pins = "gpio4", "gpio5", "gpio6", "gpio7";
+				function = "blsp_uart2 ";
+			};
+
+			config {
+				pins = "gpio4", "gpio5", "gpio6", "gpio7";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp1_uart2_sleep: blsp1_uart2_sleep {
+			mux {
+				pins = "gpio4", "gpio5", "gpio6", "gpio7";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio4", "gpio5", "gpio6", "gpio7";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp2_uart1: blsp2_uart1 {
+			blsp2_uart1_tx_active: blsp2_uart1_tx_active {
+				mux {
+					pins = "gpio16";
+					function = "blsp_uart5";
+				};
+
+				config {
+					pins = "gpio16";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			blsp2_uart1_tx_sleep: blsp2_uart1_tx_sleep {
+				mux {
+					pins = "gpio16";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio16";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+
+			blsp2_uart1_rxcts_active: blsp2_uart1_rxcts_active {
+				mux {
+					pins = "gpio17", "gpio18";
+					function = "blsp_uart5";
+				};
+
+				config {
+					pins = "gpio17", "gpio18";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			blsp2_uart1_rxcts_sleep: blsp2_uart1_rxcts_sleep {
+				mux {
+					pins = "gpio17", "gpio18";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio17", "gpio18";
+					drive-strength = <2>;
+					bias-no-pull;
+				};
+			};
+
+			blsp2_uart1_rfr_active: blsp2_uart1_rfr_active {
+				mux {
+					pins = "gpio19";
+					function = "blsp_uart5";
+				};
+
+				config {
+					pins = "gpio19";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+
+			blsp2_uart1_rfr_sleep: blsp2_uart1_rfr_sleep {
+				mux {
+					pins = "gpio19";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio19";
+					drive-strength = <2>;
+					bias-no-pull;
+				};
+			};
+		};
+
+		blsp2_uart2_active: blsp2_uart2_active {
+			mux {
+				pins = "gpio24", "gpio25", "gpio26", "gpio27";
+				function = "blsp_uart6_a";
+			};
+
+			config {
+				pins = "gpio24", "gpio25", "gpio26", "gpio27";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		blsp2_uart2_sleep: blsp2_uart2_sleep {
+			mux {
+				pins = "gpio24", "gpio25", "gpio26", "gpio27";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio24", "gpio25", "gpio26", "gpio27";
+				drive-strength = <2>;
+				bias-disable;
+			};
+		};
+
+		tlmm_gpio_key {
+			gpio_key_active: gpio_key_active {
+				mux {
+					pins = "gpio64", "gpio113";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio64", "gpio113";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+
+			gpio_key_suspend: gpio_key_suspend {
+				mux {
+					pins = "gpio64", "gpio113";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio64", "gpio113";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+			};
+		};
+
+		pmx_mdss: pmx_mdss {
+			mdss_dsi_active: mdss_dsi_active {
+				mux {
+					pins = "gpio53";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio53";
+					drive-strength = <8>; /* 8 mA */
+					bias-disable = <0>; /* no pull */
+				};
+			};
+			mdss_dsi_suspend: mdss_dsi_suspend {
+				mux {
+					pins = "gpio53";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio53";
+					drive-strength = <2>; /* 2 mA */
+					bias-pull-down; /* pull down */
+				};
+			};
+		};
+
+		pmx_mdss_te {
+			mdss_te_active: mdss_te_active {
+				mux {
+					pins = "gpio59";
+					function = "mdp_vsync";
+				};
+				config {
+					pins = "gpio59";
+					drive-strength = <2>; /* 8 mA */
+					bias-pull-down; /* pull down*/
+				};
+			};
+
+			mdss_te_suspend: mdss_te_suspend {
+				mux {
+					pins = "gpio59";
+					function = "mdp_vsync";
+				};
+				config {
+					pins = "gpio59";
+					drive-strength = <2>; /* 2 mA */
+					bias-pull-down; /* pull down */
+				};
+			};
+		};
+
+		mdss_dp_aux_active: mdss_dp_aux_active {
+			mux {
+				pins = "gpio55", "gpio56";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio55", "gpio56";
+				bias-disable = <0>; /* no pull */
+				drive-strength = <8>;
+			};
+		};
+
+		mdss_dp_aux_suspend: mdss_dp_aux_suspend {
+			mux {
+				pins = "gpio55", "gpio56";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio55", "gpio56";
+				bias-pull-down;
+				drive-strength = <2>;
+			};
+		};
+
+		mdss_dp_usbplug_cc_active: mdss_dp_usbplug_cc_active {
+			mux {
+				pins = "gpio58";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio58";
+				bias-disable;
+				drive-strength = <16>;
+			};
+		};
+
+		mdss_dp_usbplug_cc_suspend: mdss_dp_usbplug_cc_suspend {
+			mux {
+				pins = "gpio58";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio58";
+				bias-pull-down;
+				drive-strength = <2>;
+			};
+		};
+
+		ts_mux {
+			ts_active: ts_active {
+				mux {
+					pins = "gpio66", "gpio67";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio66", "gpio67";
+					drive-strength = <16>;
+					bias-pull-up;
+				};
+			};
+
+			ts_reset_suspend: ts_reset_suspend {
+				mux {
+					pins = "gpio66";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio66";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
+			};
+
+			ts_int_suspend: ts_int_suspend {
+				mux {
+					pins = "gpio67";
+					function = "gpio";
+				};
+
+				config {
+					pins = "gpio67";
+					drive-strength = <2>;
+					bias-disable;
+				};
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-pm.dtsi b/arch/arm64/boot/dts/qcom/sdm660-pm.dtsi
new file mode 100644
index 000000000000..679a1b89b2f8
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-pm.dtsi
@@ -0,0 +1,823 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+&soc {
+	qcom,spm@178120000 {
+		compatible = "qcom,spm-v2";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0x17812000 0x1000>;
+		qcom,name = "gold-l2"; /* Gold L2 SAW */
+		qcom,saw2-ver-reg = <0xfd0>;
+		qcom,cpu-vctl-list = <&CPU4 &CPU5 &CPU6 &CPU7>;
+		qcom,vctl-timeout-us = <500>;
+		qcom,vctl-port = <0x0>;
+		qcom,phase-port = <0x1>;
+		qcom,saw2-avs-ctl = <0x1010031>;
+		qcom,saw2-avs-limit = <0x4580458>;
+		qcom,pfm-port = <0x2>;
+	};
+
+	qcom,spm@179120000 {
+		compatible = "qcom,spm-v2";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0x17912000 0x1000>;
+		qcom,name = "silver-l2"; /* Silver L2 SAW */
+		qcom,saw2-ver-reg = <0xfd0>;
+		qcom,cpu-vctl-list = <&CPU0 &CPU1 &CPU2 &CPU3>;
+		qcom,vctl-timeout-us = <500>;
+		qcom,vctl-port = <0x0>;
+		qcom,phase-port = <0x1>;
+		qcom,saw2-avs-ctl = <0x101c031>;
+		qcom,saw2-avs-limit = <0x4580458>;
+		qcom,pfm-port = <0x2>;
+	};
+
+	qcom,lpm-levels {
+		compatible = "qcom,lpm-levels";
+		qcom,use-psci;
+		#address-cells = <1>;
+		#size-cells = <0>;
+		qcom,pm-cluster@0 {
+			reg = <0>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			label = "system";
+			qcom,spm-device-names = "cci";
+			qcom,psci-mode-shift = <8>;
+			qcom,psci-mode-mask = <0xf>;
+
+			qcom,pm-cluster-level@0{
+				reg = <0>;
+				label = "system-wfi";
+				qcom,psci-mode = <0x0>;
+				qcom,latency-us = <1654>;
+				qcom,ss-power = <219>;
+				qcom,energy-overhead = <98750>;
+				qcom,time-overhead = <2294>;
+			};
+
+			qcom,pm-cluster-level@1{ /* E3 */
+				reg = <1>;
+				label = "system-pc";
+				qcom,psci-mode = <0x3>;
+				qcom,latency-us = <4506>;
+				qcom,ss-power = <88>;
+				qcom,energy-overhead = <1228536>;
+				qcom,time-overhead = <15337>;
+				qcom,min-child-idx = <3>;
+				qcom,is-reset;
+				qcom,notify-rpm;
+			};
+
+			qcom,pm-cluster@0{
+				reg = <0>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				label = "pwr";
+				qcom,spm-device-names = "l2";
+				qcom,cpu = <&CPU0 &CPU1 &CPU2 &CPU3>;
+				qcom,psci-mode-shift = <4>;
+				qcom,psci-mode-mask = <0xf>;
+
+				qcom,pm-cluster-level@0{ /* D1 */
+					reg = <0>;
+					label = "pwr-l2-wfi";
+					qcom,psci-mode = <0x1>;
+					qcom,latency-us = <51>;
+					qcom,ss-power = <250>;
+					qcom,energy-overhead = <83452>;
+					qcom,time-overhead = <89>;
+				};
+				qcom,pm-cluster-level@1{ /* D2D */
+					reg = <1>;
+					label = "pwr-l2-dynret";
+					qcom,psci-mode = <0x2>;
+					qcom,latency-us = <421>;
+					qcom,ss-power = <235>;
+					qcom,energy-overhead = <219416>;
+					qcom,time-overhead = <781>;
+					qcom,min-child-idx = <1>;
+				};
+
+				qcom,pm-cluster-level@2{ /* D2E */
+					reg = <2>;
+					label = "pwr-l2-ret";
+					qcom,psci-mode = <0x3>;
+					qcom,latency-us = <517>;
+					qcom,ss-power = <226>;
+					qcom,energy-overhead= <299405>;
+					qcom,time-overhead = <922>;
+					qcom,min-child-idx = <2>;
+				};
+
+				qcom,pm-cluster-level@3{ /* D4 */
+					reg = <3>;
+					label = "pwr-l2-pc";
+					qcom,psci-mode = <0x4>;
+					qcom,latency-us = <2118>;
+					qcom,ss-power = <210>;
+					qcom,energy-overhead = <833056>;
+					qcom,time-overhead = <2918>;
+					qcom,min-child-idx = <2>;
+					qcom,is-reset;
+				};
+
+				qcom,pm-cpu {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					qcom,psci-mode-shift = <0>;
+					qcom,psci-mode-mask = <0xf>;
+
+					qcom,pm-cpu-level@0 { /* C1 */
+						reg = <0>;
+						qcom,spm-cpu-mode = "wfi";
+						qcom,psci-cpu-mode = <0x1>;
+						qcom,latency-us = <42>;
+						qcom,ss-power = <250>;
+						qcom,energy-overhead = <30562>;
+						qcom,time-overhead = <91>;
+					};
+
+					qcom,pm-cpu-level@1 { /* C2D */
+						reg = <1>;
+						qcom,psci-cpu-mode = <2>;
+						qcom,spm-cpu-mode = "ret";
+						qcom,latency-us = <63>;
+						qcom,ss-power = <245>;
+						qcom,energy-overhead = <49239>;
+						qcom,time-overhead = <172>;
+					};
+
+					qcom,pm-cpu-level@2 {  /* C3 */
+						reg = <2>;
+						qcom,spm-cpu-mode = "pc";
+						qcom,psci-cpu-mode = <0x3>;
+						qcom,latency-us = <376>;
+						qcom,ss-power = <237>;
+						qcom,energy-overhead = <181018>;
+						qcom,time-overhead = <666>;
+						qcom,is-reset;
+					};
+				};
+			};
+
+			qcom,pm-cluster@1{
+				reg = <1>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+				label = "perf";
+				qcom,spm-device-names = "l2";
+				qcom,cpu = <&CPU4 &CPU5 &CPU6 &CPU7>;
+				qcom,psci-mode-shift = <4>;
+				qcom,psci-mode-mask = <0xf>;
+
+				qcom,pm-cluster-level@0{  /* D1 */
+					reg = <0>;
+					label = "perf-l2-wfi";
+					qcom,psci-mode = <0x1>;
+					qcom,latency-us = <51>;
+					qcom,ss-power = <283>;
+					qcom,energy-overhead = <83083>;
+					qcom,time-overhead = <89>;
+				};
+
+				qcom,pm-cluster-level@1{ /* D2D */
+					reg = <1>;
+					label = "perf-l2-dynret";
+					qcom,psci-mode = <2>;
+					qcom,latency-us = <345>;
+					qcom,ss-power = <254>;
+					qcom,energy-overhead = <198349>;
+					qcom,time-overhead = <659>;
+					qcom,min-child-idx = <1>;
+				};
+
+				qcom,pm-cluster-level@2{ /* D2E */
+					reg = <2>;
+					label = "perf-l2-ret";
+					qcom,psci-mode = <3>;
+					qcom,latency-us = <419>;
+					qcom,ss-power = <244>;
+					qcom,energy-overhead = <281921>;
+					qcom,time-overhead = <737>;
+					qcom,min-child-idx = <2>;
+				};
+
+				qcom,pm-cluster-level@3{ /* D4 */
+					reg = <3>;
+					label = "perf-l2-pc";
+					qcom,psci-mode = <0x4>;
+					qcom,latency-us = <1654>;
+					qcom,ss-power = <219>;
+					qcom,energy-overhead = <815573>;
+					qcom,time-overhead = <2294>;
+					qcom,min-child-idx = <2>;
+					qcom,is-reset;
+				};
+
+				qcom,pm-cpu {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					qcom,psci-mode-shift = <0>;
+					qcom,psci-mode-mask = <0xf>;
+
+					qcom,pm-cpu-level@0 { /* C1 */
+						reg = <0>;
+						qcom,spm-cpu-mode = "wfi";
+						qcom,psci-cpu-mode = <0x1>;
+						qcom,latency-us = <39>;
+						qcom,ss-power = <292>;
+						qcom,energy-overhead = <37558>;
+						qcom,time-overhead = <68>;
+					};
+
+					qcom,pm-cpu-level@1 { /* C2D */
+						reg = <1>;
+						qcom,psci-cpu-mode = <2>;
+						qcom,spm-cpu-mode = "ret";
+						qcom,latency-us = <60>;
+						qcom,ss-power = <275>;
+						qcom,energy-overhead = <70737>;
+						qcom,time-overhead = <181>;
+					};
+
+					qcom,pm-cpu-level@2 { /* C3 */
+						reg = <2>;
+						qcom,spm-cpu-mode = "pc";
+						qcom,psci-cpu-mode = <0x3>;
+						qcom,latency-us = <324>;
+						qcom,ss-power = <263>;
+						qcom,energy-overhead = <213213>;
+						qcom,time-overhead = <621>;
+						qcom,is-reset;
+					};
+				};
+			};
+		};
+	};
+
+	qcom,rpm-stats@200000 {
+		compatible = "qcom,rpm-stats";
+		reg = <0x200000 0x1000>,
+			<0x290014 0x4>,
+			<0x29001c 0x4>;
+		reg-names = "phys_addr_base",
+			"offset_addr",
+			"heap_phys_addrbase";
+		qcom,sleep-stats-version = <2>;
+	};
+
+	qcom,rpm-rail-stats@200000 {
+		compatible = "qcom,rpm-rail-stats";
+		reg = <0x200000 0x100>,
+			<0x29000c 0x4>;
+		reg-names = "phys_addr_base",
+			    "offset_addr";
+	};
+
+	qcom,rpm-log@200000 {
+		compatible = "qcom,rpm-log";
+		reg = <0x200000 0x4000>,
+			<0x290018 0x4>;
+		qcom,rpm-addr-phys = <0x200000>;
+		qcom,offset-version = <4>;
+		qcom,offset-page-buffer-addr = <36>;
+		qcom,offset-log-len = <40>;
+		qcom,offset-log-len-mask = <44>;
+		qcom,offset-page-indices = <56>;
+	};
+
+	qcom,rpm-master-stats@778150 {
+		compatible = "qcom,rpm-master-stats";
+		reg = <0x778150 0x5000>;
+		qcom,masters = "APSS", "MPSS", "ADSP", "CDSP", "TZ";
+		qcom,master-stats-version = <2>;
+		qcom,master-offset = <4096>;
+	};
+
+	rpm_msg_ram: memory@0x200000 {
+		compatible = "qcom,rpm-msg-ram";
+		reg = <0x200000 0x1000>,
+			<0x290000 0x1000>;
+	};
+
+	rpm_code_ram: rpm-memory@0x778000 {
+		compatible = "qcom,rpm-code-ram";
+		reg = <0x778000 0x5000>;
+	};
+
+	qcom,system-stats {
+		compatible = "qcom,system-stats";
+		qcom,rpm-msg-ram = <&rpm_msg_ram>;
+		qcom,rpm-code-ram = <&rpm_code_ram>;
+		qcom,masters = "APSS", "MPSS", "ADSP", "CDSP", "TZ";
+	};
+
+	qcom,mpm@7781b8 {
+		compatible = "qcom,mpm-v2";
+		reg = <0x7781b8 0x1000>, /* MSM_RPM_MPM_BASE 4K */
+		    <0x17911008 0x4>;   /* MSM_APCS_GCC_BASE 4K */
+		reg-names = "vmpm", "ipc";
+		interrupts = <GIC_SPI 171 IRQ_TYPE_EDGE_RISING>;
+		clocks = <&clock_rpmcc CXO_LPM_CLK>;
+		clock-names = "xo";
+		qcom,num-mpm-irqs = <96>;
+
+		qcom,ipc-bit-offset = <1>;
+
+		qcom,gic-parent = <&intc>;
+		qcom,gic-map =
+			<0x02 216>, /* tsens1_tsens_upper_lower_int */
+			<0x34 275>, /* qmp_usb3_lfps_rxterm_irq_cx */
+			<0x3d 209>, /* lpi_dir_conn_irq_apps[1] */
+			<0x4f 379>, /* qusb2phy_intr for Dm */
+			<0x50 380>, /* qusb2phy_intr for Dm for secondary PHY */
+			<0x51 379>, /* qusb2phy_intr for Dp */
+			<0x52 380>, /* qusb2phy_intr for Dp for secondary PHY */
+			<0x57 358>, /* ee0_apps_hlos_spmi_periph_irq */
+			<0x5b 519>, /* lpass_pmu_tmr_timeout_irq_cx */
+			<0xff 16>,  /* APC[0-7]_qgicQTmrHypPhysIrptReq */
+			<0xff 17>,  /* APC[0-7]_qgicQTmrSecPhysIrptReq */
+			<0xff 18>,  /* APC[0-7]_qgicQTmrNonSecPhysIrptReq */
+			<0xff 19>,  /* APC[0-7]_qgicQTmrVirtIrptReq */
+			<0xff 20>,  /* APC[0-7]_dbgCommRxFull */
+			<0xff 21>,  /* APC[0-7]_dbgCommTxEmpty */
+			<0xff 22>,  /* APC[0-7]_qgicPerfMonIrptReq */
+			<0xff 23>,  /* corespm_vote_int[0-7] */
+			<0xff 24>,  /* APC[0-3]_qgicExtFaultIrptReq */
+			<0xff 28>,  /* qgicWakeupSync[0-7] */
+			<0xff 29>,  /* APCC_cti_SPI_intx[0-7] */
+			<0xff 30>,  /* APCC_cti_SPI_inty[0-7] */
+			<0xff 32>,  /* l2spm_vote_int[0] */
+			<0xff 33>,  /* l2spm_vote_int[1] */
+			<0xff 34>,  /* APCC_qgicL2ErrorIrptReq */
+			<0xff 35>,  /* WDT_barkInt */
+			<0xff 36>,  /* WDT_biteExpired */
+			<0xff 39>,  /* QTMR_qgicFrm0VirtIrq */
+			<0xff 40>,  /* QTMR_qgicFrm0PhyIrq */
+			<0xff 41>,  /* QTMR_qgicFrm1PhyIrq */
+			<0xff 42>,  /* QTMR_qgicFrm2PhyIrq */
+			<0xff 43>,  /* QTMR_qgicFrm3PhyIrq */
+			<0xff 44>,  /* QTMR_qgicFrm4PhyIrq */
+			<0xff 45>,  /* QTMR_qgicFrm5PhyIrq */
+			<0xff 46>,  /* QTMR_qgicFrm6PhyIrq */
+			<0xff 47>,  /* rbif_Irq[0] */
+			<0xff 48>,  /* rbif_Irq[1] */
+			<0xff 49>,  /* rbif_Irq[2] */
+			<0xff 50>,  /* rbif_Irq[3] */
+			<0xff 51>,  /* rbif_Irq[4] */
+			<0xff 52>,  /* cci_spm_vote_summary_int */
+			<0xff 54>,  /* nERRORIRQ */
+			<0xff 55>,  /* nEVNTCNTOVERFLOW_cci */
+			<0xff 56>,  /* QTMR_qgicFrm0VirtIrq */
+			<0xff 57>,  /* QTMR_qgicFrm0PhyIrq */
+			<0xff 58>,  /* QTMR_qgicFrm1PhyIrq */
+			<0xff 59>,  /* QTMR_qgicFrm2PhyIrq */
+			<0xff 60>,  /* QTMR_qgicFrm3PhyIrq */
+			<0xff 61>,  /* QTMR_qgicFrm4PhyIrq */
+			<0xff 62>,  /* QTMR_qgicFrm5PhyIrq */
+			<0xff 63>,  /* QTMR_qgicFrm6PhyIrq */
+			<0xff 64>,  /* wakeup_counter_irq_OR */
+			<0xff 65>,  /* APC[0-3]_vs_alarm */
+			<0xff 66>,  /* apc1_vs_alarm */
+			<0xff 67>,  /* o_pwr_osm_irq */
+			<0xff 68>,  /* o_perf_osm_irq */
+			<0xff 69>,  /* o_pwr_dcvsh_interrupt */
+			<0xff 70>,  /* o_perf_dcvsh_interrupt */
+			<0xff 73>,  /* L2_EXTERRIRQ_C0 */
+			<0xff 74>,  /* L2_EXTERRIRQ_C1 */
+			<0xff 75>,  /* L2_INTERRIRQ_C0 */
+			<0xff 76>,  /* L2_INTERRIRQ_C1 */
+			<0xff 77>,  /* L2SPM_svicInt[0] */
+			<0xff 78>,  /* L2SPM_svicInt[1] */
+			<0xff 79>,  /* L2SPM_svicIntSwDone[0] */
+			<0xff 80>,  /* L2SPM_svicIntSwDone[1] */
+			<0xff 81>,  /* l2_avs_err[0] */
+			<0xff 82>,  /* l2_avs_err[1] */
+			<0xff 83>,  /* l2_avs_ack[0] */
+			<0xff 84>,  /* l2_avs_ack[1] */
+			<0xff 98>,  /* o_qm_interrupt */
+			<0xff 100>, /* camss_vbif_1_irpt */
+			<0xff 101>, /* processor_1_user_int */
+			<0xff 102>, /* processor_1_kernel_int */
+			<0xff 106>, /* dir_conn_irq_lpa_dsp[2] */
+			<0xff 107>, /* dir_conn_irq_lpa_dsp[1] */
+			<0xff 109>, /* camss_vbif_0_irpt */
+			<0xff 110>, /* csiphy_0_irq */
+			<0xff 111>, /* csiphy_1_irq */
+			<0xff 112>, /* csiphy_2_irq */
+			<0xff 115>, /* mdss_irq */
+			<0xff 116>, /* mdss_vbif_irpt */
+			<0xff 117>, /* dir_conn_irq_lpa_dsp[0] */
+			<0xff 119>, /* lpass_irq_out_apcs[11] */
+			<0xff 122>, /* o_pimem_tpdm_bc_irq_ofsat */
+			<0xff 123>, /* o_pimem_tpdm_tc_irq_ofsat */
+			<0xff 124>, /* dir_conn_irq_sensors[1] */
+			<0xff 125>, /* dir_conn_irq_sensors[0] */
+			<0xff 127>, /* peripheral_irq[2] */
+			<0xff 128>, /* peripheral_irq[3] */
+			<0xff 129>, /* peripheral_irq[4] */
+			<0xff 130>, /* peripheral_irq[5] */
+			<0xff 133>, /* peripheral_irq[2] */
+			<0xff 134>, /* peripheral_irq[3] */
+			<0xff 135>, /* peripheral_irq[4] */
+			<0xff 136>, /* peripheral_irq[5] */
+			<0xff 139>, /* peripheral_irq[0] */
+			<0xff 140>, /* peripheral_irq[1] */
+			<0xff 142>, /* sdcc_irq[0] */
+			<0xff 143>, /* sdcc_irq[1] */
+			<0xff 144>, /* sdcc_pwr_cmd_irq */
+			<0xff 145>, /* peripheral_irq[0] */
+			<0xff 146>, /* peripheral_irq[1] */
+			<0xff 148>, /* osmmu_CIrpt[4] */
+			<0xff 149>, /* osmmu_CIrpt[5] */
+			<0xff 150>, /* sdio_wakeup_irq */
+			<0xff 151>, /* acvremoval_int */
+			<0xff 152>, /* trs_int */
+			<0xff 155>, /* dir_conn_irq_lpa_dsp[5] */
+			<0xff 156>, /* dir_conn_irq_lpa_dsp[4] */
+			<0xff 157>, /* sdcc_irq[0] */
+			<0xff 158>, /* sdcc_irq[1] */
+			<0xff 159>, /* lpass_irq_out_apcs[39] */
+			<0xff 160>, /* lpass_irq_out_apcs[38] */
+			<0xff 163>, /* usb30_ctrl_irq[0] */
+			<0xff 164>, /* usb30_bam_irq[0] */
+			<0xff 165>, /* usb30_hs_phy_irq */
+			<0xff 166>, /* o_lm_int_2qgic */
+			<0xff 169>, /* lpass_irq_out_apcs[33] */
+			<0xff 171>, /* usb20s_hs_phy_irq */
+			<0xff 172>, /* dcvs_int[6] */
+			<0xff 173>, /* dcvs_int[7] */
+			<0xff 175>, /* usb20s_ee1_irq */
+			<0xff 176>, /* usb20s_power_event_irq */
+			<0xff 184>, /* dir_conn_irq_lpa_dsp[3] */
+			<0xff 185>, /* camss_vbif_2_irpt */
+			<0xff 186>, /* mnoc_obs_mainfault */
+			<0xff 188>, /* lpass_irq_out_apcs[00] */
+			<0xff 189>, /* lpass_irq_out_apcs[01] */
+			<0xff 190>, /* lpass_irq_out_apcs[02] */
+			<0xff 191>, /* lpass_irq_out_apcs[03] */
+			<0xff 192>, /* lpass_irq_out_apcs[04] */
+			<0xff 193>, /* lpass_irq_out_apcs[05] */
+			<0xff 194>, /* lpass_irq_out_apcs[06] */
+			<0xff 195>, /* lpass_irq_out_apcs[07] */
+			<0xff 196>, /* lpass_irq_out_apcs[08] */
+			<0xff 197>, /* lpass_irq_out_apcs[09] */
+			<0xff 199>, /* qdss_usb_trace_bam_irq[0] */
+			<0xff 200>, /* rpm_ipc[4] */
+			<0xff 201>, /* rpm_ipc[5] */
+			<0xff 202>, /* rpm_ipc[6] */
+			<0xff 203>, /* rpm_ipc[7] */
+			<0xff 204>, /* rpm_ipc[20] */
+			<0xff 205>, /* rpm_ipc[21] */
+			<0xff 206>, /* rpm_ipc[22] */
+			<0xff 207>, /* rpm_ipc[23] */
+			<0xff 208>, /* lpi_dir_conn_irq_apps[0] */
+			<0xff 210>, /* lpi_dir_conn_irq_apps[2] */
+			<0xff 212>, /* usb30s_power_event_irq */
+			<0xff 213>, /* secure_wdog_bark_irq */
+			<0xff 214>, /* tsens1_tsens_max_min_int */
+			<0xff 215>, /* o_bimc_intr[0] */
+			<0xff 217>, /* o_ocimem_nonsec_irq */
+			<0xff 218>, /* cpr_irq[1] */
+			<0xff 219>, /* lpass_irq_out_vmm[00] */
+			<0xff 220>, /* spmi_protocol_irq */
+			<0xff 221>, /* lpass_irq_out_vmm[01] */
+			<0xff 222>, /* lpass_irq_out_vmm[02] */
+			<0xff 223>, /* spdm_offline_irq */
+			<0xff 224>, /* spdm_realtime_irq[1] */
+			<0xff 225>, /* snoc_obs_mainFault */
+			<0xff 226>, /* cnoc_obs_mainFault */
+			<0xff 227>, /* o_tcsr_xpu3_sec_summary_intr */
+			<0xff 228>, /* o_tcsr_xpu3_non_sec_summary_intr */
+			<0xff 229>, /* o_timeout_slave_hmss_summary_intr */
+			<0xff 230>, /* o_tcsr_vmidmt_client_sec_summary_intr */
+			<0xff 231>, /* o_tcsr_vmidmt_client_nsec_summary_intr */
+			<0xff 232>, /* o_tcsr_vmidmt_cfg_sec_summary_intr */
+			<0xff 233>, /* o_tcsr_vmidmt_cfg_non_sec_summary_intr */
+			<0xff 234>, /* lpass_irq_out_vmm[03] */
+			<0xff 235>, /* cpr_irq[0] */
+			<0xff 236>, /* crypto_core_irq[0] */
+			<0xff 237>, /* crypto_core_irq[1] */
+			<0xff 238>, /* crypto_bam_irq[0] */
+			<0xff 239>, /* crypto_bam_irq[1] */
+			<0xff 240>, /* summary_irq_hmss */
+			<0xff 241>, /* dir_conn_irq_hmss[7] */
+			<0xff 242>, /* dir_conn_irq_hmss[6] */
+			<0xff 243>, /* dir_conn_irq_hmss[5] */
+			<0xff 244>, /* dir_conn_irq_hmss[4] */
+			<0xff 245>, /* dir_conn_irq_hmss[3] */
+			<0xff 246>, /* dir_conn_irq_hmss[2] */
+			<0xff 247>, /* dir_conn_irq_hmss[1] */
+			<0xff 248>, /* dir_conn_irq_hmss[0] */
+			<0xff 249>, /* summary_irq_hmss_tz */
+			<0xff 250>, /* cpr_irq[3] */
+			<0xff 251>, /* cpr_irq[2] */
+			<0xff 252>, /* cpr_irq[1] */
+			<0xff 253>, /* sdcc_pwr_cmd_irq */
+			<0xff 254>, /* sdio_wakeup_irq */
+			<0xff 255>, /* cpr_irq[0] */
+			<0xff 256>, /* lpass_irq_out_apcs[34] */
+			<0xff 257>, /* lpass_irq_out_apcs[35] */
+			<0xff 258>, /* lpass_irq_out_apcs[21] */
+			<0xff 261>, /* o_tcsr_mmu_nsgcfglrpt_summary_intr */
+			<0xff 262>, /* o_tcsr_mmu_gcfglrpt_summary_intr */
+			<0xff 263>, /* o_tcsr_mmu_nsglrpt_summary_intr */
+			<0xff 264>, /* o_tcsr_mmu_glrpt_summary_intr */
+			<0xff 265>, /* vbif_irpt */
+			<0xff 266>, /* lpass_irq_out_apcs[20] */
+			<0xff 267>, /* lpass_irq_out_apcs[19] */
+			<0xff 269>, /* rpm_wdog_expired_irq */
+			<0xff 270>, /* bam_irq[0] */
+			<0xff 271>, /* bam_irq[0] */
+			<0xff 276>, /* mmss_bimc_smmu_cirpt[4] */
+			<0xff 277>, /* mmss_bimc_smmu_cirpt[5] */
+			<0xff 278>, /* usb30_ctrl_irq[1] */
+			<0xff 279>, /* mmss_bimc_smmu_cirpt[6] */
+			<0xff 280>, /* mmss_bimc_smmu_cirpt[7] */
+			<0xff 281>, /* mmss_bimc_smmu_cirpt[8] */
+			<0xff 282>, /* mmss_bimc_smmu_cirpt[9] */
+			<0xff 283>, /* mmss_bimc_smmu_cirpt[10] */
+			<0xff 284>, /* mmss_bimc_smmu_cirpt[11] */
+			<0xff 285>, /* mmss_bimc_smmu_cirpt[12] */
+			<0xff 286>, /* mmss_bimc_smmu_cirpt[13] */
+			<0xff 287>, /* mmss_bimc_smmu_cirpt[14] */
+			<0xff 288>, /* mmss_bimc_smmu_cirpt[15] */
+			<0xff 289>, /* ufs_ice_sec_level_irq */
+			<0xff 291>, /* lpass_irq_out_apcs[18] */
+			<0xff 292>, /* mmss_bimc_smmu_cirpt[16] */
+			<0xff 293>, /* mmss_bimc_smmu_cirpt[17] */
+			<0xff 294>, /* mmss_bimc_smmu_cirpt[18] */
+			<0xff 295>, /* mmss_bimc_smmu_cirpt[0] */
+			<0xff 296>, /* mmss_bimc_smmu_pmirpt */
+			<0xff 297>, /* ufs_intrq */
+			<0xff 298>, /* mmss_bimc_smmu_cirpt[1] */
+			<0xff 299>, /* mmss_bimc_smmu_cirpt[2] */
+			<0xff 300>, /* mmss_bimc_smmu_cirpt[3] */
+			<0xff 301>, /* lpass_irq_out_apcs[17] */
+			<0xff 302>, /* qdss_etrbytecnt_irq */
+			<0xff 303>, /* lpass_irq_out_apcs[16] */
+			<0xff 304>, /* mmss_bimc_smmu_cirpt[19] */
+			<0xff 305>, /* mmss_bimc_smmu_cirpt[20] */
+			<0xff 306>, /* mmss_bimc_smmu_cirpt[21] */
+			<0xff 307>, /* mmss_bimc_smmu_cirpt[22] */
+			<0xff 308>, /* mmss_bimc_smmu_cirpt[23] */
+			<0xff 316>, /* lpass_irq_out_apcs[13] */
+			<0xff 317>, /* rbif_irq */
+			<0xff 318>, /* gpu_cc_gpu_cx_gds_hw_ctrl_irq_out */
+			<0xff 319>, /* venus0_irq */
+			<0xff 323>, /* lpass_irq_out_apcs[14] */
+			<0xff 324>, /* lpass_irq_out_apcs[15] */
+			<0xff 325>, /* camss_irq18 */
+			<0xff 326>, /* camss_irq0 */
+			<0xff 327>, /* camss_irq1 */
+			<0xff 328>, /* camss_irq2 */
+			<0xff 329>, /* camss_irq3 */
+			<0xff 330>, /* camss_irq4 */
+			<0xff 331>, /* camss_irq5 */
+			<0xff 332>, /* GC_SYS_irq[0] */
+			<0xff 333>, /* GC_SYS_irq[1] */
+			<0xff 334>, /* GC_SYS_irq[2] */
+			<0xff 335>, /* GC_SYS_irq[3] */
+			<0xff 336>, /* camss_irq13 */
+			<0xff 337>, /* camss_irq14 */
+			<0xff 338>, /* camss_irq15 */
+			<0xff 339>, /* camss_irq16 */
+			<0xff 340>, /* camss_irq17 */
+			<0xff 341>, /* camss_irq6 */
+			<0xff 342>, /* lpass_irq_out_apcs[36] */
+			<0xff 345>, /* camss_irq7 */
+			<0xff 346>, /* camss_irq8 */
+			<0xff 347>, /* camss_irq9 */
+			<0xff 348>, /* camss_irq10 */
+			<0xff 350>, /* camss_irq12 */
+			<0xff 351>, /* lpass_irq_out_apcs[12] */
+			<0xff 357>, /* o_pimem_nonfatal_irq */
+			<0xff 359>, /* ee1_apps_trustzone_spmi_periph_irq */
+			<0xff 360>, /* o_pimem_fatal_irq */
+			<0xff 361>, /* osmmu_CIrpt[0] */
+			<0xff 362>, /* osmmu_CIrpt[1] */
+			<0xff 363>, /* osmmu_CIrpt[2] */
+			<0xff 364>, /* osmmu_CIrpt[3] */
+			<0xff 365>, /* ipa_irq[0] */
+			<0xff 366>, /* osmmu_PMIrpt */
+			<0xff 381>, /* osmmu_CIrpt[6] */
+			<0xff 382>, /* osmmu_CIrpt[7] */
+			<0xff 385>, /* osmmu_CIrpt[12] */
+			<0xff 386>, /* osmmu_CIrpt[13] */
+			<0xff 387>, /* osmmu_CIrpt[14] */
+			<0xff 388>, /* osmmu_CIrpt[15] */
+			<0xff 389>, /* osmmu_CIrpt[16] */
+			<0xff 390>, /* osmmu_CIrpt[17] */
+			<0xff 391>, /* osmmu_CIrpt[18] */
+			<0xff 392>, /* osmmu_CIrpt[19] */
+			<0xff 393>, /* o_dcc_crc_fail_int */
+			<0xff 404>, /* aggre2noc_obs_mainFault */
+			<0xff 405>, /* osmmu_CIrpt[0] */
+			<0xff 406>, /* osmmu_CIrpt[1] */
+			<0xff 407>, /* osmmu_CIrpt[2] */
+			<0xff 408>, /* osmmu_CIrpt[3] */
+			<0xff 409>, /* osmmu_CIrpt[4] */
+			<0xff 410>, /* osmmu_CIrpt[5] */
+			<0xff 411>, /* o_dcc_task_done_int */
+			<0xff 412>, /* vsense_apps_alarm_irq */
+			<0xff 413>, /* osmmu_PMIrpt */
+			<0xff 414>, /* channel0_apps_hlos_trans_done_irq */
+			<0xff 415>, /* channel1_apps_trustzone_trans_done_irq */
+			<0xff 416>, /* rpm_ipc[28] */
+			<0xff 417>, /* rpm_ipc[29] */
+			<0xff 418>, /* rpm_ipc[30] */
+			<0xff 419>, /* rpm_ipc[31] */
+			<0xff 423>, /* lpass_irq_out_apcs[40] */
+			<0xff 424>, /* ipa_irq[2] */
+			<0xff 425>, /* lpass_irq_out_apcs[22] */
+			<0xff 426>, /* lpass_irq_out_apcs[23] */
+			<0xff 427>, /* lpass_irq_out_apcs[24] */
+			<0xff 428>, /* lpass_irq_out_apcs[25] */
+			<0xff 429>, /* lpass_irq_out_apcs[26] */
+			<0xff 430>, /* lpass_irq_out_apcs[27] */
+			<0xff 431>, /* lpass_irq_out_apcs[28] */
+			<0xff 432>, /* lpass_irq_out_apcs[29] */
+			<0xff 433>, /* lpass_irq_out_apcs[30] */
+			<0xff 434>, /* lpass_irq_out_apcs[31] */
+			<0xff 435>, /* lpass_irq_out_apcs[32] */
+			<0xff 436>, /* lpass_irq_out_apcs[37] */
+			<0xff 445>, /* wcss_apss_ce_intr[0] */
+			<0xff 446>, /* wcss_apss_ce_intr[1] */
+			<0xff 447>, /* wcss_apss_ce_intr[2] */
+			<0xff 448>, /* wcss_apss_ce_intr[3] */
+			<0xff 449>, /* wcss_apss_ce_intr[4] */
+			<0xff 450>, /* wcss_apss_ce_intr[5] */
+			<0xff 452>, /* wcss_apss_ce_intr[6] */
+			<0xff 453>, /* wcss_apss_ce_intr[7] */
+			<0xff 454>, /* wcss_apss_ce_intr[8] */
+			<0xff 455>, /* wcss_apss_ce_intr[9] */
+			<0xff 456>, /* wcss_apss_ce_intr[10] */
+			<0xff 457>, /* wcss_apss_ce_intr[11] */
+			<0xff 458>, /* wcss_apss_status_intr */
+			<0xff 462>, /* tsens1_tsens_critical_int */
+			<0xff 464>, /* ipa_bam_irq[0] */
+			<0xff 465>, /* ipa_bam_irq[2] */
+			<0xff 466>, /* ssc_uart_int */
+			<0xff 468>, /* cri_cm_irq_tz */
+			<0xff 469>, /* cri_cm_irq_hyp */
+			<0xff 471>, /* mmss_bimc_smmu_gds_hw_ctrl_irq_out */
+			<0xff 472>, /* gcc_gds_hw_ctrl_irq_out */
+			<0xff 474>, /* osmmu_CIrpt[20] */
+			<0xff 475>, /* osmmu_CIrpt[21] */
+			<0xff 476>, /* osmmu_CIrpt[22] */
+			<0xff 477>, /* tsens0_tsens_critical_int */
+			<0xff 478>, /* tsens0_tsens_max_min_int */
+			<0xff 479>, /* osmmu_CIrpt[23] */
+			<0xff 480>, /* q6_wdog_expired_irq */
+			<0xff 481>, /* mss_ipc_out_irq[4] */
+			<0xff 482>, /* mss_ipc_out_irq[5] */
+			<0xff 483>, /* mss_ipc_out_irq[6] */
+			<0xff 484>, /* mss_ipc_out_irq[7] */
+			<0xff 485>, /* mss_ipc_out_irq[28] */
+			<0xff 486>, /* mss_ipc_out_irq[29] */
+			<0xff 487>, /* mss_ipc_out_irq[30] */
+			<0xff 488>, /* mss_ipc_out_irq[31] */
+			<0xff 490>, /* tsens0_tsens_upper_lower_int */
+			<0xff 491>, /* qspi_irq0 */
+			<0xff 492>, /* sdcc_ice_sec_level_irq */
+			<0xff 494>, /* osmmu_CIrpt[6] */
+			<0xff 495>, /* osmmu_CIrpt[7] */
+			<0xff 496>, /* osmmu_CIrpt[8] */
+			<0xff 497>, /* osmmu_CIrpt[9] */
+			<0xff 498>, /* osmmu_CIrpt[10] */
+			<0xff 499>, /* osmmu_CIrpt[11] */
+			<0xff 500>, /* osmmu_CIrpt[24] */
+			<0xff 501>, /* osmmu_CIrpt[25] */
+			<0xff 503>, /* o_bimc_intr[1] */
+			<0xff 504>, /* osmmu_CIrpt[26] */
+			<0xff 505>, /* osmmu_CIrpt[27] */
+			<0xff 506>, /* osmmu_CIrpt[28] */
+			<0xff 512>, /* turing_irq_out_vmm[0] */
+			<0xff 513>, /* turing_irq_out_vmm[1] */
+			<0xff 514>, /* turing_irq_out_vmm[2] */
+			<0xff 515>, /* turing_irq_out_vmm[3] */
+			<0xff 516>, /* lpass_irq_out_apcs[41] */
+			<0xff 517>, /* lpass_irq_out_apcs[42] */
+			<0xff 520>, /* lpass_irq_out_apcs[45] */
+			<0xff 544>, /* turing_irq_out_apcs[00] */
+			<0xff 545>, /* turing_irq_out_apcs[01] */
+			<0xff 546>, /* turing_irq_out_apcs[02] */
+			<0xff 547>, /* turing_irq_out_apcs[03] */
+			<0xff 548>, /* turing_irq_out_apcs[04] */
+			<0xff 549>, /* turing_irq_out_apcs[05] */
+			<0xff 550>, /* turing_irq_out_apcs[06] */
+			<0xff 551>, /* turing_irq_out_apcs[07] */
+			<0xff 552>, /* turing_irq_out_apcs[08] */
+			<0xff 553>, /* turing_irq_out_apcs[09] */
+			<0xff 554>, /* turing_irq_out_apcs[10] */
+			<0xff 556>, /* turing_irq_out_apcs[12] */
+			<0xff 557>, /* turing_irq_out_apcs[13] */
+			<0xff 558>, /* turing_irq_out_apcs[14] */
+			<0xff 559>, /* turing_irq_out_apcs[15] */
+			<0xff 560>, /* turing_irq_out_apcs[16] */
+			<0xff 561>, /* turing_irq_out_apcs[17] */
+			<0xff 562>, /* turing_irq_out_apcs[18] */
+			<0xff 563>, /* turing_irq_out_apcs[19] */
+			<0xff 564>, /* turing_irq_out_apcs[20] */
+			<0xff 565>, /* turing_irq_out_apcs[21] */
+			<0xff 566>, /* turing_irq_out_apcs[22] */
+			<0xff 567>, /* turing_irq_out_apcs[23] */
+			<0xff 568>, /* turing_irq_out_apcs[24] */
+			<0xff 569>, /* turing_irq_out_apcs[25] */
+			<0xff 570>, /* turing_irq_out_apcs[26] */
+			<0xff 571>, /* turing_irq_out_apcs[27] */
+			<0xff 572>, /* turing_irq_out_apcs[28] */
+			<0xff 573>, /* turing_irq_out_apcs[29] */
+			<0xff 574>, /* turing_irq_out_apcs[30] */
+			<0xff 575>, /* turing_irq_out_apcs[31] */
+			<0xff 576>, /* turing_irq_out_apcs[32] */
+			<0xff 577>, /* turing_irq_out_apcs[33] */
+			<0xff 578>, /* turing_irq_out_apcs[34] */
+			<0xff 579>, /* turing_irq_out_apcs[35] */
+			<0xff 580>, /* turing_irq_out_apcs[36] */
+			<0xff 581>, /* turing_irq_out_apcs[37] */
+			<0xff 582>, /* turing_irq_out_apcs[38] */
+			<0xff 583>, /* turing_irq_out_apcs[39] */
+			<0xff 584>; /* turing_irq_out_apcs[40] */
+
+		qcom,gpio-parent = <&tlmm>;
+		qcom,gpio-map =
+			<3  1>,
+			<4  5>,
+			<5  9>,
+			<6  10>,
+			<7  66>,
+			<8  22>,
+			<9  25>,
+			<10  28>,
+			<11  58>,
+			<13  41>,
+			<14  43>,
+			<15  40>,
+			<16  42>,
+			<17  46>,
+			<18  50>,
+			<19  44>,
+			<21  56>,
+			<22  45>,
+			<23  68>,
+			<24  69>,
+			<25  70>,
+			<26  71>,
+			<27  72>,
+			<28  73>,
+			<29  64>,
+			<30  2>,
+			<31  13>,
+			<32  111>,
+			<33  74>,
+			<34  75>,
+			<35  76>,
+			<36  82>,
+			<37  17>,
+			<38  77>,
+			<39  47>,
+			<40  54>,
+			<41  48>,
+			<42  101>,
+			<43  49>,
+			<44  51>,
+			<45  86>,
+			<46  90>,
+			<47  91>,
+			<48  52>,
+			<50  55>,
+			<51  6>,
+			<53  65>,
+			<55  67>,
+			<56  83>,
+			<57  84>,
+			<58  85>,
+			<59  87>,
+			<63  21>,
+			<64  78>,
+			<65  113>,
+			<66  60>,
+			<67  98>,
+			<68  30>,
+			<70  31>,
+			<71  29>,
+			<76  107>,
+			<83  109>,
+			<84  103>,
+			<85  105>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-pm660a-cdp.dts b/arch/arm64/boot/dts/qcom/sdm660-pm660a-cdp.dts
new file mode 100644
index 000000000000..c27f76d3027b
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-pm660a-cdp.dts
@@ -0,0 +1,54 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660A CDP";
+	compatible = "qcom,sdm660-cdp", "qcom,sdm660", "qcom,cdp";
+	qcom,board-id = <1 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&mdss_dsi {
+	hw-config = "single_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_rm67195_amoled_fhd_cmd>;
+	oledb-supply = <&pm660a_oledb>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+};
+
+&mdss_dsi1 {
+	status = "disabled";
+	oledb-supply = <&pm660a_oledb>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-pm660a-headset-jacktype-no-cdp.dts b/arch/arm64/boot/dts/qcom/sdm660-pm660a-headset-jacktype-no-cdp.dts
new file mode 100644
index 000000000000..281af3b1768e
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-pm660a-headset-jacktype-no-cdp.dts
@@ -0,0 +1,38 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660A, Headset Jacktype NO, CDP";
+	compatible = "qcom,sdm660-cdp", "qcom,sdm660", "qcom,cdp";
+	qcom,board-id = <1 2>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&mdss_dsi0 {
+	oledb-supply = <&pm660a_oledb>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+};
+
+&mdss_dsi1 {
+	oledb-supply = <&pm660a_oledb>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-pm660a-headset-jacktype-no-rcm.dts b/arch/arm64/boot/dts/qcom/sdm660-pm660a-headset-jacktype-no-rcm.dts
new file mode 100644
index 000000000000..8b009718eb87
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-pm660a-headset-jacktype-no-rcm.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660A, Headset Jacktype NO, RCM";
+	compatible = "qcom,sdm660-cdp", "qcom,sdm660", "qcom,cdp";
+	qcom,board-id = <21 2>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-pm660a-mtp.dts b/arch/arm64/boot/dts/qcom/sdm660-pm660a-mtp.dts
new file mode 100644
index 000000000000..eb5e4999fb67
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-pm660a-mtp.dts
@@ -0,0 +1,48 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-mtp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660A MTP";
+	compatible = "qcom,sdm660-mtp", "qcom,sdm660", "qcom,mtp";
+	qcom,board-id = <8 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&mdss_dsi {
+	hw-config = "single_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_rm67195_amoled_fhd_cmd>;
+	oledb-supply = <&pm660a_oledb>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+};
+
+&mdss_dsi1 {
+	status = "disabled";
+	oledb-supply = <&pm660a_oledb>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-moist-cfg = <0>, <0>, <3>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-pm660a-qrd.dts b/arch/arm64/boot/dts/qcom/sdm660-pm660a-qrd.dts
new file mode 100644
index 000000000000..d9d74ea31d3d
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-pm660a-qrd.dts
@@ -0,0 +1,56 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-qrd.dtsi"
+#include "msm-pm660a.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660A QRD";
+	compatible = "qcom,sdm660-qrd", "qcom,sdm660", "qcom,qrd";
+	qcom,board-id = <0x0012000b 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&pm660a_oledb {
+	status = "okay";
+	qcom,oledb-default-voltage-mv = <6400>;
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "single_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_rm67195_amoled_fhd_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	lab-supply = <&lab_regulator>;
+	ibb-supply = <&ibb_regulator>;
+	qcom,platform-reset-gpio = <&tlmm 53 0>;
+	qcom,platform-te-gpio = <&tlmm 59 0>;
+};
+
+&dsi_rm67195_amoled_fhd_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_dcs";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <255>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply_labibb_amoled>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-pm660a-rcm.dts b/arch/arm64/boot/dts/qcom/sdm660-pm660a-rcm.dts
new file mode 100644
index 000000000000..14af76ff84b9
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-pm660a-rcm.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "msm-pm660a.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660A RCM";
+	compatible = "qcom,sdm660-cdp", "qcom,sdm660", "qcom,cdp";
+	qcom,board-id = <21 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-pm660a-rumi.dts b/arch/arm64/boot/dts/qcom/sdm660-pm660a-rumi.dts
new file mode 100644
index 000000000000..16f1efb92f74
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-pm660a-rumi.dts
@@ -0,0 +1,146 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-pinctrl.dtsi"
+#include "msm-pm660a.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660A RUMI";
+	compatible = "qcom,sdm660-rumi", "qcom,sdm660", "qcom,rumi";
+	qcom,board-id = <15 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+
+	chosen {
+		bootargs = "lpm_levels.sleep_disabled=1";
+	};
+};
+
+&usb3 {
+	/delete-property/ USB3_GDSC-supply;
+	/delete-property/ extcon;
+	dwc3@a800000 {
+		maximum-speed = "high-speed";
+	};
+};
+
+&ssphy {
+	compatible =  "usb-nop-xceiv";
+};
+
+&qusb_phy0 {
+	reg = <0x0a928000 0x8000>,
+		<0x0a8f8800 0x400>,
+		<0x0a920000 0x100>;
+		reg-names = "qusb_phy_base",
+			"qscratch_base",
+			"emu_phy_base";
+		qcom,emulation;
+		qcom,qusb-phy-init-seq = <0x19 0x1404
+					0x20 0x1414
+					0x79 0x1410
+					0x00 0x1418
+					0x99 0x1404
+					0x04 0x1408
+					0xd9 0x1404>;
+		qcom,emu-dcm-reset-seq = <0x100000 0x20
+					0x0 0x20
+					0x1a0 0x20
+					0x5 0x14>;
+};
+
+&uartblsp1dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&sdhc_1 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l4>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660_l8>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-lpm-sup;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <200 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 192000000
+								384000000>;
+
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&clock_gcc {
+	compatible = "qcom,dummycc";
+	clock-output-names = "gcc_clocks";
+};
+
+&pm660_charger {
+	status = "disabled";
+};
+
+&pm660_fg {
+	status = "disabled";
+};
+
+&clock_gfx {
+	compatible = "qcom,dummycc";
+	clock-output-names = "gfx_clocks";
+};
+
+&pm660_pdphy {
+	status = "disabled";
+};
+
+&clock_mmss {
+	compatible = "qcom,dummycc";
+	clock-output-names = "mmss_clocks";
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm660l_l1>;
+	vdda-pll-supply = <&pm660_l10>;
+	vddp-ref-clk-supply = <&pm660_l1>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14200>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm660l_l4>;
+	vccq2-supply = <&pm660_l8>;
+	vcc-max-microamp = <500000>;
+	vccq2-max-microamp = <600000>;
+	qcom,disable-lpm;
+};
+
+&clock_debug {
+	compatible = "qcom,dummycc";
+	clock-output-names = "debug_clocks";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-pm660a-sim.dts b/arch/arm64/boot/dts/qcom/sdm660-pm660a-sim.dts
new file mode 100644
index 000000000000..2e2e1ac3993c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-pm660a-sim.dts
@@ -0,0 +1,111 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-pinctrl.dtsi"
+#include "msm-pm660a.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660A SIM";
+	compatible = "qcom,sdm660-sim", "qcom,sdm660", "qcom,sim";
+	qcom,board-id = <16 0>;
+	qcom,pmic-id = <0x0001001b 0x0001011a 0x0 0x0>;
+
+	chosen {
+		bootargs = "lpm_levels.sleep_disabled=1";
+	};
+};
+
+&usb3 {
+	reg = <0xa800000 0xfc000>;
+	reg-names = "core_base";
+	/delete-property/ extcon;
+	dwc3@a800000 {
+		maximum-speed = "high-speed";
+	};
+};
+
+&ssphy {
+	compatible =  "usb-nop-xceiv";
+};
+
+&qusb_phy0 {
+	compatible =  "usb-nop-xceiv";
+};
+
+&uartblsp1dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&sdhc_1 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l4>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660_l8>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-lpm-sup;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <200 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 192000000
+								384000000>;
+
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&pm660_charger {
+	status = "disabled";
+};
+
+&pm660_fg {
+	status = "disabled";
+};
+
+&pm660_pdphy {
+	status = "disabled";
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm660l_l1>;
+	vdda-pll-supply = <&pm660_l10>;
+	vddp-ref-clk-supply = <&pm660_l1>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14200>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm660l_l4>;
+	vccq2-supply = <&pm660_l8>;
+	vcc-max-microamp = <500000>;
+	vccq2-max-microamp = <600000>;
+	status = "ok";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-qrd.dts b/arch/arm64/boot/dts/qcom/sdm660-qrd.dts
new file mode 100644
index 000000000000..4d120e83cb9b
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-qrd.dts
@@ -0,0 +1,87 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-qrd.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660L QRD";
+	compatible = "qcom,sdm660-qrd", "qcom,sdm660", "qcom,qrd";
+	qcom,board-id = <0x1000b 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_fb0 {
+	qcom,mdss-mixer-swap;
+};
+
+&mdss_dsi {
+	hw-config = "split_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt36850_truly_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 53 0>;
+	qcom,platform-te-gpio = <&tlmm 59 0>;
+};
+
+&mdss_dsi1 {
+	qcom,dsi-pref-prim-pan = <&dsi_dual_nt36850_truly_cmd>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+	qcom,platform-reset-gpio = <&tlmm 53 0>;
+	qcom,platform-te-gpio = <&tlmm 59 0>;
+};
+
+&dsi_dual_nt36850_truly_cmd {
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+};
+
+&pm660l_wled {
+	qcom,led-strings-list = [00 01];
+};
+
+&soc {
+	hbtp {
+		compatible = "qcom,hbtp-input";
+		pinctrl-names = "pmx_ts_active", "pmx_ts_suspend";
+		pinctrl-0 = <&ts_rst_active>;
+		pinctrl-1 = <&ts_rst_suspend>;
+		vcc_ana-supply = <&pm660l_l3>;
+		vcc_dig-supply = <&pm660_l13>;
+		qcom,afe-load = <20000>;
+		qcom,afe-vtg-min = <3008000>;
+		qcom,afe-vtg-max = <3008000>;
+		qcom,dig-load = <40000>;
+		qcom,dig-vtg-min = <1808000>;
+		qcom,dig-vtg-max = <1808000>;
+		qcom,fb-resume-delay-us = <10000>;
+		qcom,afe-force-power-on;
+		qcom,afe-power-on-delay-us = <1000>;
+		qcom,afe-power-off-delay-us = <6>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-qrd.dtsi b/arch/arm64/boot/dts/qcom/sdm660-qrd.dtsi
new file mode 100644
index 000000000000..d870941b2088
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-qrd.dtsi
@@ -0,0 +1,290 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdm660-pinctrl.dtsi"
+#include "sdm660-camera-sensor-qrd.dtsi"
+#include "sdm660-external-codec.dtsi"
+/ {
+};
+
+&blsp2_uart1_hs {
+	status = "ok";
+};
+
+&uartblsp1dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&sdhc_1 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l4>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660_l8>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-lpm-sup;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <200 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 100000000 192000000
+								384000000>;
+
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&sdc2_cd_on {
+	config {
+		/delete-property/ bias-pull-up;
+		bias-disable;
+	};
+};
+
+&sdhc_2 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l5>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <15000 800000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660l_l2>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	#address-cells = <0>;
+	interrupt-parent = <&sdhc_2>;
+	interrupts = <0 1 2>;
+	#interrupt-cells = <1>;
+	interrupt-map-mask = <0xffffffff>;
+	interrupt-map = <0 &intc 0 0 125 0
+			1 &intc 0 0 221 0
+			2 &tlmm 54 0>;
+	interrupt-names = "hc_irq", "pwr_irq", "status_irq";
+	cd-gpios = <&tlmm 54 0x0>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 100000000
+								200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	status = "ok";
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm660l_l1>;
+	vdda-pll-supply = <&pm660_l10>;
+	vddp-ref-clk-supply = <&pm660_l1>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14200>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm660l_l4>;
+	vccq2-supply = <&pm660_l8>;
+	vcc-max-microamp = <500000>;
+	vccq2-max-microamp = <600000>;
+	status = "ok";
+};
+
+&soc {
+	qcom,msm-ssc-sensors {
+		compatible = "qcom,msm-ssc-sensors";
+	};
+};
+
+&qusb_phy0 {
+	qcom,qusb-phy-init-seq = <0xf8 0x80
+				0x83 0x84
+				0x83 0x88
+				0xc3 0x8c
+				0x30 0x08
+				0x79 0x0c
+				0x21 0x10
+				0x14 0x9c
+				0x9f 0x1c
+				0x00 0x18>;
+};
+
+&pm660_gpios {
+	/* GPIO 4 (NFC_CLK_REQ) */
+	gpio@c300 {
+		qcom,mode = <0>;
+		qcom,vin-sel = <1>;
+		qcom,src-sel = <0>;
+		qcom,master-en = <1>;
+		status = "okay";
+	};
+};
+
+&i2c_6 { /* BLSP1 QUP6 (NFC) */
+	status = "okay";
+	nq@28 {
+		compatible = "qcom,nq-nci";
+		reg = <0x28>;
+		qcom,nq-irq = <&tlmm 28 0x00>;
+		qcom,nq-ven = <&tlmm 29 0x00>;
+		qcom,nq-firm = <&tlmm 30 0x00>;
+		qcom,nq-clkreq = <&pm660_gpios 4 0x00>;
+		qcom,nq-esepwr = <&tlmm 31 0x00>;
+		interrupt-parent = <&tlmm>;
+		qcom,clk-src = "BBCLK3";
+		interrupts = <28 0>;
+		interrupt-names = "nfc_irq";
+		pinctrl-names = "nfc_active", "nfc_suspend";
+		pinctrl-0 = <&nfc_int_active &nfc_enable_active>;
+		pinctrl-1 = <&nfc_int_suspend &nfc_enable_suspend>;
+		clocks = <&clock_rpmcc RPM_LN_BB_CLK3_PIN>;
+		clock-names = "ref_clk";
+	};
+};
+
+&pm660l_gpios {
+	/* GPIO 7 for VOL_UP */
+	gpio@c600 {
+		status = "ok";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+};
+
+&tlmm {
+	pmx_ts_rst_active {
+		ts_rst_active: ts_rst_active {
+			mux {
+				pins = "gpio66";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio66";
+				drive-strength = <16>;
+				bias-pull-up;
+			};
+		};
+	};
+
+	pmx_ts_rst_suspend {
+		ts_rst_suspend: ts_rst_suspend {
+			mux {
+				pins = "gpio66";
+				function = "gpio";
+			};
+
+			config {
+				pins = "gpio66";
+				drive-strength = <2>;
+				bias-pull-down;
+			};
+		};
+	};
+};
+
+&ssphy {
+	fpc-redrive-supply = <&pm660_l11>;
+	qcom,redrive-voltage-level = <0 1800000 1950000>;
+	qcom,redrive-load = <105000>;
+};
+
+&soc {
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+		status = "ok";
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm660l_gpios 7 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+};
+
+/ {
+	qrd_batterydata: qcom,battery-data {
+		qcom,batt-id-range-pct = <15>;
+
+		#include "fg-gen3-batterydata-qrd-skuk-4v4-3000mah.dtsi"
+	};
+};
+
+&pm660_fg {
+	qcom,battery-data = <&qrd_batterydata>;
+	qcom,fg-jeita-thresholds = <0 5 55 55>;
+	qcom,battery-thermal-coefficients = [9d 50 ff];
+};
+
+&i2c_2 {
+	status = "ok";
+	smb1351_charger: smb1351-charger@1d {
+		compatible = "qcom,smb1351-charger";
+		reg = <0x1d>;
+		qcom,parallel-charger;
+		qcom,float-voltage-mv = <4400>;
+		qcom,recharge-mv = <100>;
+		qcom,parallel-en-pin-polarity = <1>;
+	};
+};
+
+/delete-node/ &tasha_hph_en0;
+/delete-node/ &tasha_hph_en1;
+
+&tasha_snd {
+	qcom,model = "sdm660-tasha-skus-snd-card";
+	qcom,audio-routing =
+		"AIF4 VI", "MCLK",
+		"RX_BIAS", "MCLK",
+		"MADINPUT", "MCLK",
+		"AMIC2", "MIC BIAS2",
+		"MIC BIAS2", "Headset Mic",
+		"DMIC0", "MIC BIAS1",
+		"MIC BIAS1", "Digital Mic0",
+		"DMIC3", "MIC BIAS3",
+		"MIC BIAS3", "Digital Mic3",
+		"DMIC5", "MIC BIAS3",
+		"MIC BIAS3", "Digital Mic5",
+		"SpkrLeft IN", "SPK1 OUT";
+	qcom,msm-mbhc-hphl-swh = <1>;
+	/delete-property/ qcom,us-euro-gpios;
+	/delete-property/ qcom,hph-en0-gpio;
+	/delete-property/ qcom,hph-en1-gpio;
+	qcom,wsa-max-devs = <1>;
+	qcom,wsa-devs = <&wsa881x_211>, <&wsa881x_213>;
+	qcom,wsa-aux-dev-prefix = "SpkrLeft", "SpkrLeft";
+};
+
+&pm660_charger {
+	qcom,dc-is-wipower;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-rcm.dts b/arch/arm64/boot/dts/qcom/sdm660-rcm.dts
new file mode 100644
index 000000000000..0fa148e82d43
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-rcm.dts
@@ -0,0 +1,36 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660L RCM";
+	compatible = "qcom,sdm660-cdp", "qcom,sdm660", "qcom,cdp";
+	qcom,board-id = <21 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
+
+&tasha_snd {
+	qcom,msm-mbhc-hphl-swh = <0>;
+	qcom,msm-mbhc-gnd-swh = <0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-regulator.dtsi b/arch/arm64/boot/dts/qcom/sdm660-regulator.dtsi
new file mode 100644
index 000000000000..6556c986ae75
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-regulator.dtsi
@@ -0,0 +1,929 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/clock/qcom,gcc-sdm660.h>
+#include <dt-bindings/clock/qcom,gpu-sdm660.h>
+#include <dt-bindings/clock/qcom,rpmcc.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+&rpm_bus {
+	rpm-regulator-smpa4 {
+		status = "okay";
+		pm660_s4: regulator-s4 {
+			regulator-min-microvolt = <1805000>;
+			regulator-max-microvolt = <2040000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-smpa5 {
+		status = "okay";
+		pm660_s5: regulator-s5 {
+			regulator-min-microvolt = <1224000>;
+			regulator-max-microvolt = <1350000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-smpa6 {
+		status = "okay";
+		pm660_s6: regulator-s6 {
+			regulator-min-microvolt = <504000>;
+			regulator-max-microvolt = <992000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-smpb1 {
+		status = "okay";
+		pm660l_s1: regulator-s1 {
+			regulator-min-microvolt = <1125000>;
+			regulator-max-microvolt = <1125000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-smpb2 {
+		status = "okay";
+		pm660l_s2: regulator-s2 {
+			regulator-min-microvolt = <1050000>;
+			regulator-max-microvolt = <1050000>;
+			status = "okay";
+		};
+	};
+
+	/* PM660L S3 + S4 - VDD_CX supply */
+	rpm-regulator-smpb3 {
+		status = "okay";
+		pm660l_s3_level: regulator-s3-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_s3_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-level;
+		};
+
+		pm660l_s3_floor_level: regulator-s3-floor-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_s3_floor_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-floor-level;
+			qcom,always-send-voltage;
+		};
+
+		pm660l_s3_level_ao: regulator-s3-level-ao {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_s3_level_ao";
+			qcom,set = <1>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-level;
+		};
+	};
+
+	/* PM660L S5 - VDD_MX supply */
+	rpm-regulator-smpb5 {
+		status = "okay";
+		pm660l_s5_level: regulator-s5-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_s5_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-level;
+		};
+
+		pm660l_s5_floor_level: regulator-s5-floor-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_s5_floor_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-floor-level;
+			qcom,always-send-voltage;
+		};
+
+		pm660l_s5_level_ao: regulator-s5-level-ao {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_s5_level_ao";
+			qcom,set = <1>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-level;
+		};
+	};
+
+	rpm-regulator-ldoa1 {
+		status = "okay";
+		pm660_l1: regulator-l1 {
+			regulator-min-microvolt = <1150000>;
+			regulator-max-microvolt = <1250000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa2 {
+		status = "okay";
+		pm660_l2: regulator-l2 {
+			regulator-min-microvolt = <950000>;
+			regulator-max-microvolt = <1010000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa3 {
+		status = "okay";
+		pm660_l3: regulator-l3 {
+			regulator-min-microvolt = <950000>;
+			regulator-max-microvolt = <1010000>;
+			status = "okay";
+		};
+	};
+
+	/* TODO: remove if ADRASTEA CX/MX not voted from APPS */
+	rpm-regulator-ldoa5 {
+		status = "okay";
+		pm660_l5: regulator-l5 {
+			regulator-min-microvolt = <525000>;
+			regulator-max-microvolt = <950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa6 {
+		status = "okay";
+		pm660_l6: regulator-l6 {
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1370000>;
+			status = "okay";
+		};
+
+		pm660_l6_pin_ctrl: regulator-l6-pin-ctrl {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l6_pin_ctrl";
+			qcom,set = <3>;
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1370000>;
+			/* Force NPM follows HW_EN1 */
+			qcom,init-pin-ctrl-mode = <2>;
+			/* Enable follows HW_EN1 */
+			qcom,enable-with-pin-ctrl = <0 2>;
+		};
+	};
+
+	rpm-regulator-ldoa7 {
+		status = "okay";
+		pm660_l7: regulator-l7 {
+			regulator-min-microvolt = <1200000>;
+			regulator-max-microvolt = <1200000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa8 {
+		status = "okay";
+		pm660_l8: regulator-l8 {
+			regulator-min-microvolt = <1750000>;
+			regulator-max-microvolt = <1900000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa9 {
+		status = "okay";
+		pm660_l9: regulator-l9 {
+			regulator-min-microvolt = <1750000>;
+			regulator-max-microvolt = <1900000>;
+			status = "okay";
+		};
+
+		pm660_l9_pin_ctrl: regulator-l9-pin-ctrl {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l9_pin_ctrl";
+			qcom,set = <3>;
+			regulator-min-microvolt = <1750000>;
+			regulator-max-microvolt = <1900000>;
+			/* Force NPM follows HW_EN1 */
+			qcom,init-pin-ctrl-mode = <2>;
+			/* Enable follows HW_EN1 */
+			qcom,enable-with-pin-ctrl = <0 2>;
+		};
+	};
+
+	rpm-regulator-ldoa10 {
+		status = "okay";
+		pm660_l10: regulator-l10 {
+			proxy-supply = <&pm660_l10>;
+			qcom,proxy-consumer-enable;
+			qcom,proxy-consumer-current = <14000>;
+			regulator-min-microvolt = <1780000>;
+			regulator-max-microvolt = <1950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa11 {
+		status = "okay";
+		pm660_l11: regulator-l11 {
+			regulator-min-microvolt = <1780000>;
+			regulator-max-microvolt = <1950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa12 {
+		status = "okay";
+		pm660_l12: regulator-l12 {
+			regulator-min-microvolt = <1780000>;
+			regulator-max-microvolt = <1950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa13 {
+		status = "okay";
+		pm660_l13: regulator-l13 {
+			regulator-min-microvolt = <1780000>;
+			regulator-max-microvolt = <1950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa14 {
+		status = "okay";
+		pm660_l14: regulator-l14 {
+			regulator-min-microvolt = <1710000>;
+			regulator-max-microvolt = <1900000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa15 {
+		status = "okay";
+		pm660_l15: regulator-l15 {
+			regulator-min-microvolt = <1650000>;
+			regulator-max-microvolt = <2950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa17 {
+		status = "okay";
+		pm660_l17: regulator-l17 {
+			regulator-min-microvolt = <1650000>;
+			regulator-max-microvolt = <2950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldoa19 {
+		status = "okay";
+		pm660_l19: regulator-l19 {
+			regulator-min-microvolt = <3200000>;
+			regulator-max-microvolt = <3400000>;
+			status = "okay";
+		};
+
+		pm660_l19_pin_ctrl: regulator-l19-pin-ctrl {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660_l19_pin_ctrl";
+			qcom,set = <3>;
+			regulator-min-microvolt = <3200000>;
+			regulator-max-microvolt = <3400000>;
+			/* Force NPM follows HW_EN1 */
+			qcom,init-pin-ctrl-mode = <2>;
+			/* Enable follows HW_EN1 */
+			qcom,enable-with-pin-ctrl = <0 2>;
+		};
+	};
+
+	rpm-regulator-ldob1 {
+		status = "okay";
+		pm660l_l1: regulator-l1 {
+			regulator-min-microvolt = <800000>;
+			regulator-max-microvolt = <925000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldob2 {
+		status = "okay";
+		pm660l_l2: regulator-l2 {
+			regulator-min-microvolt = <350000>;
+			regulator-max-microvolt = <3100000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldob3 {
+		status = "okay";
+		pm660l_l3: regulator-l3 {
+			regulator-min-microvolt = <1710000>;
+			regulator-max-microvolt = <3600000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldob4 {
+		status = "okay";
+		pm660l_l4: regulator-l4 {
+			regulator-min-microvolt = <1700000>;
+			regulator-max-microvolt = <2950000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldob5 {
+		status = "okay";
+		pm660l_l5: regulator-l5 {
+			regulator-min-microvolt = <1721000>;
+			regulator-max-microvolt = <3600000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldob6 {
+		status = "okay";
+		pm660l_l6: regulator-l6 {
+			regulator-min-microvolt = <1700000>;
+			regulator-max-microvolt = <3300000>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldob7 {
+		status = "okay";
+		pm660l_l7: regulator-l7 {
+			regulator-min-microvolt = <2700000>;
+			regulator-max-microvolt = <3125000>;
+			parent-supply = <&pm660_l10>;
+			status = "okay";
+		};
+	};
+
+	rpm-regulator-ldob8 {
+		status = "okay";
+		pm660l_l8: regulator-l8 {
+			regulator-min-microvolt = <3200000>;
+			regulator-max-microvolt = <3400000>;
+			status = "okay";
+		};
+	};
+
+	/* PM660L L9 = VDD_SSC_CX supply */
+	rpm-regulator-ldob9 {
+		status = "okay";
+		pm660l_l9_level: regulator-l9-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_l9_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-level;
+		};
+
+		pm660l_l9_floor_level: regulator-l9-floor-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_l9_floor_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-floor-level;
+			qcom,always-send-voltage;
+		};
+	};
+
+	/* PM660L L10 = VDD_SSC_MX supply */
+	rpm-regulator-ldob10 {
+		status = "okay";
+		pm660l_l10_level: regulator-l10-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_l10_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-level;
+		};
+
+		pm660l_l10_floor_level: regulator-l10-floor-level {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_l10_floor_level";
+			qcom,set = <3>;
+			regulator-min-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_RETENTION>;
+			regulator-max-microvolt =
+				<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,use-voltage-floor-level;
+			qcom,always-send-voltage;
+		};
+	};
+
+	rpm-regulator-bobb {
+		status = "okay";
+		pm660l_bob: regulator-bob {
+			regulator-min-microvolt = <3300000>;
+			regulator-max-microvolt = <3600000>;
+			qcom,pwm-threshold-current = <2000000>;
+			qcom,init-bob-mode = <2>;
+			status = "okay";
+		};
+
+		pm660l_bob_pin1: regulator-bob-pin1 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_bob_pin1";
+			qcom,set = <3>;
+			regulator-min-microvolt = <3300000>;
+			regulator-max-microvolt = <3600000>;
+			qcom,pwm-threshold-current = <2000000>;
+			qcom,init-bob-mode = <2>;
+			qcom,use-pin-ctrl-voltage1;
+		};
+
+		pm660l_bob_pin2: regulator-bob-pin2 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_bob_pin2";
+			qcom,set = <3>;
+			regulator-min-microvolt = <3300000>;
+			regulator-max-microvolt = <3600000>;
+			qcom,pwm-threshold-current = <2000000>;
+			qcom,init-bob-mode = <2>;
+			qcom,use-pin-ctrl-voltage2;
+		};
+
+		pm660l_bob_pin3: regulator-bob-pin3 {
+			compatible = "qcom,rpm-smd-regulator";
+			regulator-name = "pm660l_bob_pin3";
+			qcom,set = <3>;
+			regulator-min-microvolt = <3300000>;
+			regulator-max-microvolt = <3600000>;
+			qcom,pwm-threshold-current = <2000000>;
+			qcom,init-bob-mode = <2>;
+			qcom,use-pin-ctrl-voltage3;
+		};
+	};
+};
+
+&pm660_charger {
+	smb2_vbus: qcom,smb2-vbus {
+		regulator-name = "smb2-vbus";
+	};
+
+	smb2_vconn: qcom,smb2-vconn {
+		regulator-name = "smb2-vconn";
+	};
+};
+
+/* Stub regulators */
+/ {
+	/* GFX Supply */
+	gfx_stub_vreg: regulator-gfx-stub {
+		compatible = "qcom,stub-regulator";
+		regulator-name = "gfx_stub_corner";
+		regulator-min-microvolt = <400000>;
+		regulator-max-microvolt = <1070000>;
+	};
+};
+
+&soc {
+	/* MEM ACC regulators */
+	gfx_mem_acc_vreg: regulator@01fcf004 {
+		compatible = "qcom,mem-acc-regulator";
+		reg = <0x01fcf004 0x4>;
+		reg-names = "acc-sel-l1";
+		regulator-name = "gfx_mem_acc_corner";
+		regulator-min-microvolt = <1>;
+		regulator-max-microvolt = <2>;
+
+		qcom,corner-acc-map = <0x1 0x0>;
+		qcom,acc-sel-l1-bit-pos = <0>;
+		qcom,acc-sel-l1-bit-size = <1>;
+	};
+
+	gfx_ldo_vreg: ldo@0506e000 {
+		compatible = "qcom,sdm660-gfx-ldo";
+		reg = <0x0506e000 0x34>;
+		reg-names = "ldo_addr";
+		regulator-name = "msm_gfx_ldo";
+		regulator-min-microvolt = <400000>;
+		regulator-max-microvolt = <925000>;
+	};
+
+/* CPR controller regulators */
+	/* MMSS CPR Controller node */
+	gfx_cpr: cpr4-ctrl@05061000 {
+		compatible = "qcom,cpr4-sdm660-mmss-ldo-regulator";
+		reg = <0x05061000 0x4000>, <0x00784000 0x1000>;
+		reg-names = "cpr_ctrl", "fuse_base";
+		clocks = <&clock_gpu GPUCC_RBCPR_CLK>,
+			 <&clock_rpmcc RPM_CNOC_CLK>;
+		clock-names = "core_clk", "bus_clk";
+		interrupts = <GIC_SPI 285 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "cpr";
+		qcom,cpr-ctrl-name = "gfx";
+
+
+		qcom,cpr-sensor-time = <1000>;
+		qcom,cpr-loop-time = <5000000>;
+		qcom,cpr-idle-cycles = <15>;
+		qcom,cpr-step-quot-init-min = <12>;
+		qcom,cpr-step-quot-init-max = <14>;
+		qcom,cpr-count-mode = <0>;		/* All at once */
+		qcom,cpr-count-repeat = <14>;
+		qcom,cpr-reset-step-quot-loop-en;
+
+		vdd-supply = <&gfx_stub_vreg>;
+		mem-acc-supply = <&gfx_mem_acc_vreg>;
+		system-supply = <&pm660l_s3_level>; /* vdd_cx */
+		qcom,voltage-step = <5000>;
+		vdd-thread0-ldo-supply = <&gfx_ldo_vreg>;
+
+		thread@0 {
+			qcom,cpr-thread-id = <0>;
+			qcom,cpr-consecutive-up = <0>;
+			qcom,cpr-consecutive-down = <2>;
+			qcom,cpr-up-threshold = <2>;
+			qcom,cpr-down-threshold = <2>;
+
+			gfx_vreg_corner: regulator {
+				regulator-name = "gfx_corner";
+				regulator-min-microvolt = <1>;
+				regulator-max-microvolt = <7>;
+
+				qcom,cpr-fuse-corners = <6>;
+				qcom,cpr-fuse-combos = <8>;
+				qcom,cpr-corners = <7>;
+
+				qcom,cpr-corner-fmax-map = <1 2 3 4 5 6>;
+
+				qcom,cpr-voltage-ceiling =
+					<585000  645000  725000  790000
+					 870000  925000 1070000>;
+				qcom,cpr-voltage-floor =
+					<504000  504000  596000  652000
+					 712000  744000 1070000>;
+
+				qcom,mem-acc-voltage = <1 1 1 2 2 2 2>;
+				qcom,system-voltage =
+					<RPM_SMD_REGULATOR_LEVEL_LOW_SVS>,
+					<RPM_SMD_REGULATOR_LEVEL_LOW_SVS>,
+					<RPM_SMD_REGULATOR_LEVEL_SVS>,
+					<RPM_SMD_REGULATOR_LEVEL_SVS_PLUS>,
+					<RPM_SMD_REGULATOR_LEVEL_NOM>,
+					<RPM_SMD_REGULATOR_LEVEL_NOM_PLUS>,
+					<RPM_SMD_REGULATOR_LEVEL_TURBO>;
+
+				qcom,corner-frequencies =
+					<160000000 266000000 370000000
+					 465000000 588000000 647000000
+					 750000000>;
+
+				qcom,cpr-target-quotients =
+					<0    0    0    0     0    0  174  167
+					294  292  303  313    0    0    0    0>,
+					<0    0    0    0     0    0  263  247
+					413  397  415  412    0    0    0    0>,
+					<0    0    0    0     0    0  375  354
+					554  519  573  554    0    0    0    0>,
+					<0    0    0    0     0    0  412  380
+					597  562  612  591    0    0    0    0>,
+					<0    0    0    0     0    0  513  476
+					722  680  738  718    0    0    0    0>,
+					<0    0    0    0     0    0  595  553
+					811  768  837  811    0    0    0    0>,
+					<0    0    0    0     0    0    0    0
+					 0    0    0    0     0    0    0    0>;
+
+				qcom,cpr-ro-scaling-factor =
+					<  0    0    0    0   0    0 1790 1760
+					1990 1900 2140 2020   0    0    0    0>,
+					<  0    0    0    0   0    0 1790 1760
+					1990 1900 2140 2020   0    0    0    0>,
+					<  0    0    0    0   0    0 1790 1760
+					1990 1900 2140 2020   0    0    0    0>,
+					<  0    0    0    0   0    0 1790 1760
+					1990 1900 2140 2020   0    0    0    0>,
+					<  0    0    0    0   0    0 1790 1760
+					1990 1900 2140 2020   0    0    0    0>,
+					<  0    0    0    0   0    0 1790 1760
+					1990 1900 2140 2020   0    0    0    0>,
+					<  0    0    0    0   0    0 1790 1760
+					1990 1900 2140 2020   0    0    0    0>;
+
+				qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+				qcom,cpr-corner-allow-ldo-mode =
+					<0 0 0 0 0 0 0>;
+				qcom,cpr-corner-allow-closed-loop =
+					<0 0 0 0 0 0 0>;
+			};
+		};
+	};
+
+	/* APC0 CPR Controller node for Silver cluster */
+	apc0_cpr: cprh-ctrl@179c8000 {
+		compatible = "qcom,cprh-sdm660-kbss-regulator";
+		reg = <0x179c8000 0x4000>, <0x00784000 0x1000>;
+		reg-names = "cpr_ctrl", "fuse_base";
+		clocks = <&clock_gcc GCC_HMSS_RBCPR_CLK>;
+		clock-names = "core_clk";
+		qcom,cpr-ctrl-name = "apc0";
+		qcom,cpr-controller-id = <0>;
+
+		qcom,cpr-sensor-time = <1000>;
+		qcom,cpr-loop-time = <5000000>;
+		qcom,cpr-idle-cycles = <15>;
+		qcom,cpr-up-down-delay-time = <3000>;
+		qcom,cpr-step-quot-init-min = <12>;
+		qcom,cpr-step-quot-init-max = <14>;
+		qcom,cpr-count-mode = <0>;		/* All at once */
+		qcom,cpr-count-repeat = <14>;
+		qcom,cpr-down-error-step-limit = <1>;
+		qcom,cpr-up-error-step-limit = <1>;
+		qcom,cpr-corner-switch-delay-time = <1042>;
+		qcom,cpr-voltage-settling-time = <1760>;
+
+		qcom,apm-threshold-voltage = <872000>;
+		qcom,apm-crossover-voltage = <872000>;
+		qcom,apm-hysteresis-voltage = <20000>;
+		qcom,voltage-step = <4000>;
+		qcom,voltage-base = <400000>;
+		qcom,cpr-saw-use-unit-mV;
+		qcom,cpr-reset-step-quot-loop-en;
+
+		qcom,cpr-panic-reg-addr-list =
+			<0x179cbaa4 0x17912c18>;
+		qcom,cpr-panic-reg-name-list =
+			"PWR_CPRH_STATUS", "APCLUS0_L2_SAW4_PMIC_STS";
+
+		qcom,cpr-enable;
+		qcom,cpr-hw-closed-loop;
+
+		thread@0 {
+			qcom,cpr-thread-id = <0>;
+			qcom,cpr-consecutive-up = <0>;
+			qcom,cpr-consecutive-down = <2>;
+			qcom,cpr-up-threshold = <2>;
+			qcom,cpr-down-threshold = <2>;
+
+			apc0_pwrcl_vreg: regulator {
+				regulator-name = "apc0_pwrcl_corner";
+				regulator-min-microvolt = <1>;
+				regulator-max-microvolt = <8>;
+
+				qcom,cpr-fuse-corners = <5>;
+				qcom,cpr-fuse-combos = <32>;
+				qcom,cpr-speed-bins = <4>;
+				qcom,cpr-speed-bin-corners = <8 8 0 8>;
+				qcom,cpr-corners =
+					/* Speed bin 0 */
+					<8 8 8 8 8 8 8 8>,
+
+					/* Speed bin 1 */
+					<8 8 8 8 8 8 8 8>,
+
+					/* Speed bin 2 */
+					<0 0 0 0 0 0 0 0>,
+
+					/* Speed bin 3 */
+					<8 8 8 8 8 8 8 8>;
+				qcom,cpr-corner-fmax-map =
+					/* Speed bin 0 */
+					<2 3 4 5 8>,
+
+					/* Speed bin 1 */
+					<2 3 4 5 8>,
+
+					/* Speed bin 2 */
+					<0 0 0 0 0>,
+
+					/* Speed bin 3 */
+					<2 3 4 5 8>;
+
+				qcom,cpr-voltage-ceiling =
+					< 724000  724000  724000  788000  868000
+					 1068000 1068000 1068000>;
+
+				qcom,cpr-voltage-floor =
+					<588000  588000  596000  652000  712000
+					 744000  784000  844000>;
+
+				qcom,corner-frequencies =
+					/* Speed bin 0 */
+					<300000000  633600000  902400000
+					1113600000 1401600000 1536000000
+					1747200000 1843200000>,
+
+					/* Speed bin 1 */
+					<300000000  633600000  902400000
+					1113600000 1401600000 1536000000
+					1747200000 1843200000>,
+
+					/* Speed bin 3 */
+					<300000000  633600000  902400000
+					1113600000 1401600000 1536000000
+					1612800000 1843200000>;
+
+				qcom,allow-voltage-interpolation;
+				qcom,allow-quotient-interpolation;
+				qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+
+				qcom,cpr-ro-scaling-factor =
+					<3600 3600 3830 2430 2520 2700 1790
+					 1760 1970 1880 2110 2010 2510 4900
+					 4370 4780>,
+					<3600 3600 3830 2430 2520 2700 1790
+					 1760 1970 1880 2110 2010 2510 4900
+					 4370 4780>,
+					<3600 3600 3830 2430 2520 2700 1790
+					 1760 1970 1880 2110 2010 2510 4900
+					 4370 4780>,
+					<3600 3600 3830 2430 2520 2700 1790
+					 1760 1970 1880 2110 2010 2510 4900
+					 4370 4780>,
+					<3600 3600 3830 2430 2520 2700 1790
+					 1760 1970 1880 2110 2010 2510 4900
+					 4370 4780>;
+
+				qcom,cpr-open-loop-voltage-fuse-adjustment =
+					< (-4000)  4000  7000  19000 (-8000)>;
+
+				qcom,cpr-closed-loop-voltage-fuse-adjustment =
+					<(-32000) (-30000) (-29000) (-38000)
+					(-36000)>;
+
+				qcom,cpr-floor-to-ceiling-max-range =
+					<32000  32000  32000  40000  44000
+					 40000  40000  40000>;
+			};
+		};
+	};
+
+	/* APC1 CPR Controller node for Gold cluster */
+	apc1_cpr: cprh-ctrl@179c4000 {
+		compatible = "qcom,cprh-sdm660-kbss-regulator";
+		reg = <0x179c4000 0x4000>, <0x00784000 0x1000>;
+		reg-names = "cpr_ctrl", "fuse_base";
+		clocks = <&clock_gcc GCC_HMSS_RBCPR_CLK>;
+		clock-names = "core_clk";
+		qcom,cpr-ctrl-name = "apc1";
+		qcom,cpr-controller-id = <1>;
+
+		qcom,cpr-sensor-time = <1000>;
+		qcom,cpr-loop-time = <5000000>;
+		qcom,cpr-idle-cycles = <15>;
+		qcom,cpr-up-down-delay-time = <3000>;
+		qcom,cpr-step-quot-init-min = <12>;
+		qcom,cpr-step-quot-init-max = <14>;
+		qcom,cpr-count-mode = <0>;		/* All at once */
+		qcom,cpr-count-repeat = <14>;
+		qcom,cpr-down-error-step-limit = <1>;
+		qcom,cpr-up-error-step-limit = <1>;
+		qcom,cpr-corner-switch-delay-time = <1042>;
+		qcom,cpr-voltage-settling-time = <1760>;
+
+		qcom,apm-threshold-voltage = <872000>;
+		qcom,apm-crossover-voltage = <872000>;
+		qcom,apm-hysteresis-voltage = <20000>;
+		qcom,voltage-step = <4000>;
+		qcom,voltage-base = <400000>;
+		qcom,cpr-saw-use-unit-mV;
+		qcom,cpr-reset-step-quot-loop-en;
+
+		qcom,cpr-panic-reg-addr-list =
+			<0x179c7aa4 0x17812c18>;
+		qcom,cpr-panic-reg-name-list =
+			"PERF_CPRH_STATUS", "APCLUS1_L2_SAW4_PMIC_STS";
+
+		qcom,cpr-enable;
+		qcom,cpr-hw-closed-loop;
+
+		thread@0 {
+			qcom,cpr-thread-id = <0>;
+			qcom,cpr-consecutive-up = <0>;
+			qcom,cpr-consecutive-down = <2>;
+			qcom,cpr-up-threshold = <2>;
+			qcom,cpr-down-threshold = <2>;
+
+			apc1_perfcl_vreg: regulator {
+				regulator-name = "apc1_perfcl_corner";
+				regulator-min-microvolt = <1>;
+				regulator-max-microvolt = <7>;
+
+				qcom,cpr-fuse-corners = <5>;
+				qcom,cpr-fuse-combos = <32>;
+				qcom,cpr-speed-bins = <4>;
+				qcom,cpr-speed-bin-corners = <7 7 0 7>;
+				qcom,cpr-corners =
+					/* Speed-bin 0 */
+					<7 7 7 7 7 7 7 7>,
+
+					/* Speed-bin 1 */
+					<7 7 7 7 7 7 7 7>,
+
+					/* Speed-bin 1 */
+					<0 0 0 0 0 0 0 0>,
+
+					/* Speed-bin 3 */
+					<7 7 7 7 7 7 7 7>;
+
+				qcom,cpr-corner-fmax-map =
+					/* Speed-bin 0 */
+					<2 3 4 6 7>,
+
+					/* Speed-bin 1 */
+					<2 3 4 6 7>,
+
+					/* Speed-bin 2 */
+					<0 0 0 0 0>,
+
+					/* Speed-bin 3 */
+					<2 3 4 6 7>;
+
+				qcom,cpr-voltage-ceiling =
+					<724000  724000  788000  868000
+					 988000  988000 1068000>;
+
+				qcom,cpr-voltage-floor =
+					<588000  596000  652000  712000
+					 744000  784000  844000>;
+
+				qcom,corner-frequencies =
+					/* Speed bin 0 */
+					<300000000  1113600000 1401600000
+					 1747200000 1958400000 2150400000
+					 2457600000>,
+
+					/* Speed bin 1 */
+					<300000000  1113600000 1401600000
+					 1747200000 1958400000 2150400000
+					 2208000000>,
+
+					/* Speed bin 3 */
+					<300000000  1113600000 1401600000
+					 1747200000 1804800000 2150400000
+					 2208000000>;
+
+				qcom,allow-voltage-interpolation;
+				qcom,allow-quotient-interpolation;
+				qcom,cpr-scaled-open-loop-voltage-as-ceiling;
+
+				qcom,cpr-ro-scaling-factor =
+					<4040 4230 0000 2210 2560 2450 2230
+					 2220 2410 2300 2560 2470 1600 3120
+					 2620 2280>,
+					<4040 4230 0000 2210 2560 2450 2230
+					 2220 2410 2300 2560 2470 1600 3120
+					 2620 2280>,
+					<4040 4230 0000 2210 2560 2450 2230
+					 2220 2410 2300 2560 2470 1600 3120
+					 2620 2280>,
+					<4040 4230 0000 2210 2560 2450 2230
+					 2220 2410 2300 2560 2470 1600 3120
+					 2620 2280>,
+					<4040 4230 0000 2210 2560 2450 2230
+					 2220 2410 2300 2560 2470 1600 3120
+					 2620 2280>;
+
+				qcom,cpr-open-loop-voltage-fuse-adjustment =
+					<16000 27000 39000 39000 20000>;
+
+				qcom,cpr-closed-loop-voltage-fuse-adjustment =
+					<(-22000) (-9000) (-7000) (-2000)
+					   11000>;
+
+				qcom,cpr-floor-to-ceiling-max-range =
+					<40000  40000  40000  40000
+					 66000  66000  40000>;
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-rumi.dts b/arch/arm64/boot/dts/qcom/sdm660-rumi.dts
new file mode 100644
index 000000000000..09213e5b9c21
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-rumi.dts
@@ -0,0 +1,179 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-pinctrl.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660L RUMI";
+	compatible = "qcom,sdm660-rumi", "qcom,sdm660", "qcom,rumi";
+	qcom,board-id = <15 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+
+	chosen {
+		bootargs = "lpm_levels.sleep_disabled=1";
+	};
+};
+
+&usb3 {
+	/delete-property/ USB3_GDSC-supply;
+	/delete-property/ extcon;
+	dwc3@a800000 {
+		maximum-speed = "high-speed";
+	};
+};
+
+&ssphy {
+	compatible =  "usb-nop-xceiv";
+};
+
+&qusb_phy0 {
+	reg = <0x0a928000 0x8000>,
+		<0x0a8f8800 0x400>,
+		<0x0a920000 0x100>;
+		reg-names = "qusb_phy_base",
+			"qscratch_base",
+			"emu_phy_base";
+		qcom,emulation;
+		qcom,qusb-phy-init-seq = <0x19 0x1404
+					0x20 0x1414
+					0x79 0x1410
+					0x00 0x1418
+					0x99 0x1404
+					0x04 0x1408
+					0xd9 0x1404>;
+		qcom,emu-dcm-reset-seq = <0x100000 0x20
+					0x0 0x20
+					0x1a0 0x20
+					0x5 0x14>;
+};
+
+&uartblsp1dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&sdhc_1 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l4>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660_l8>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-lpm-sup;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <200 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 100000000 192000000
+								384000000>;
+
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&sdhc_2 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l5>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <15000 800000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660l_l2>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	#address-cells = <0>;
+	interrupt-parent = <&sdhc_2>;
+	interrupts = <0 1 2>;
+	#interrupt-cells = <1>;
+	interrupt-map-mask = <0xffffffff>;
+	interrupt-map = <0 &intc 0 0 125 0
+			1 &intc 0 0 221 0
+			2 &tlmm 54 0>;
+	interrupt-names = "hc_irq", "pwr_irq", "status_irq";
+	cd-gpios = <&tlmm 54 0x1>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 100000000
+								200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	status = "ok";
+};
+
+&clock_gcc {
+	compatible = "qcom,dummycc";
+	clock-output-names = "gcc_clocks";
+};
+
+&pm660_charger {
+	status = "disabled";
+};
+
+&pm660_fg {
+	status = "disabled";
+};
+
+&clock_gfx {
+	compatible = "qcom,dummycc";
+	clock-output-names = "gfx_clocks";
+};
+
+&pm660_pdphy {
+	status = "disabled";
+};
+
+&clock_mmss {
+	compatible = "qcom,dummycc";
+	clock-output-names = "mmss_clocks";
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm660l_l1>;
+	vdda-pll-supply = <&pm660_l10>;
+	vddp-ref-clk-supply = <&pm660_l1>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14200>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm660l_l4>;
+	vccq2-supply = <&pm660_l8>;
+	vcc-max-microamp = <500000>;
+	vccq2-max-microamp = <600000>;
+	qcom,disable-lpm;
+};
+
+&clock_debug {
+	compatible = "qcom,dummycc";
+	clock-output-names = "debug_clocks";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-sim.dts b/arch/arm64/boot/dts/qcom/sdm660-sim.dts
new file mode 100644
index 000000000000..33e0f9bd5507
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-sim.dts
@@ -0,0 +1,144 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-pinctrl.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660L SIM";
+	compatible = "qcom,sdm660-sim", "qcom,sdm660", "qcom,sim";
+	qcom,board-id = <16 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+
+	chosen {
+		bootargs = "lpm_levels.sleep_disabled=1";
+	};
+};
+
+&usb3 {
+	reg = <0xa800000 0xfc000>;
+	reg-names = "core_base";
+	/delete-property/ extcon;
+	dwc3@a800000 {
+		maximum-speed = "high-speed";
+	};
+};
+
+&ssphy {
+	compatible =  "usb-nop-xceiv";
+};
+
+&qusb_phy0 {
+	compatible =  "usb-nop-xceiv";
+};
+
+&uartblsp1dm1 {
+	status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart_console_active>;
+};
+
+&sdhc_1 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l4>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <200 570000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660_l8>;
+	qcom,vdd-io-always-on;
+	qcom,vdd-io-lpm-sup;
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <200 325000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 100000000 192000000
+								384000000>;
+
+	qcom,nonremovable;
+	qcom,bus-speed-mode = "HS400_1p8v", "HS200_1p8v", "DDR_1p8v";
+
+	status = "ok";
+};
+
+&sdhc_2 {
+	/* device core power supply */
+	vdd-supply = <&pm660l_l5>;
+	qcom,vdd-voltage-level = <2950000 2950000>;
+	qcom,vdd-current-level = <15000 800000>;
+
+	/* device communication power supply */
+	vdd-io-supply = <&pm660l_l2>;
+	qcom,vdd-io-voltage-level = <1800000 2950000>;
+	qcom,vdd-io-current-level = <200 22000>;
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
+
+	#address-cells = <0>;
+	interrupt-parent = <&sdhc_2>;
+	interrupts = <0 1 2>;
+	#interrupt-cells = <1>;
+	interrupt-map-mask = <0xffffffff>;
+	interrupt-map = <0 &intc 0 0 125 0
+			1 &intc 0 0 221 0
+			2 &tlmm 54 0>;
+	interrupt-names = "hc_irq", "pwr_irq", "status_irq";
+	cd-gpios = <&tlmm 54 0x1>;
+
+	qcom,clk-rates = <400000 20000000 25000000 50000000 100000000
+								200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	status = "ok";
+};
+
+&pm660_charger {
+	status = "disabled";
+};
+
+&pm660_fg {
+	status = "disabled";
+};
+
+&pm660_pdphy {
+	status = "disabled";
+};
+
+&ufsphy1 {
+	vdda-phy-supply = <&pm660l_l1>;
+	vdda-pll-supply = <&pm660_l10>;
+	vddp-ref-clk-supply = <&pm660_l1>;
+	vdda-phy-max-microamp = <51400>;
+	vdda-pll-max-microamp = <14200>;
+	vddp-ref-clk-max-microamp = <100>;
+	vddp-ref-clk-always-on;
+	status = "ok";
+};
+
+&ufs1 {
+	vdd-hba-supply = <&gdsc_ufs>;
+	vdd-hba-fixed-regulator;
+	vcc-supply = <&pm660l_l4>;
+	vccq2-supply = <&pm660_l8>;
+	vcc-max-microamp = <500000>;
+	vccq2-max-microamp = <600000>;
+	status = "ok";
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-smp2p.dtsi b/arch/arm64/boot/dts/qcom/sdm660-smp2p.dtsi
new file mode 100644
index 000000000000..b43fae954ec2
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-smp2p.dtsi
@@ -0,0 +1,244 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+&soc {
+	qcom,smp2p-modem@17911008 {
+		compatible = "qcom,smp2p";
+		reg = <0x17911008 0x4>;
+		qcom,remote-pid = <1>;
+		qcom,irq-bitmask = <0x4000>;
+		interrupts = <0 451 1>;
+	};
+
+	qcom,smp2p-adsp@17911008 {
+		compatible = "qcom,smp2p";
+		reg = <0x17911008 0x4>;
+		qcom,remote-pid = <2>;
+		qcom,irq-bitmask = <0x400>;
+		interrupts = <0 158 1>;
+	};
+
+	qcom,smp2p-cdsp@17911008 {
+		compatible = "qcom,smp2p";
+		reg = <0x17911008 0x4>;
+		qcom,remote-pid = <5>;
+		qcom,irq-bitmask = <0x40000000>;
+		interrupts = <0 514 1>;
+	};
+
+	smp2pgpio_smp2p_15_in: qcom,smp2pgpio-smp2p-15-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <15>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_15_in {
+		compatible = "qcom,smp2pgpio_test_smp2p_15_in";
+		gpios = <&smp2pgpio_smp2p_15_in 0 0>;
+	};
+
+	smp2pgpio_smp2p_15_out: qcom,smp2pgpio-smp2p-15-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <15>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_15_out {
+		compatible = "qcom,smp2pgpio_test_smp2p_15_out";
+		gpios = <&smp2pgpio_smp2p_15_out 0 0>;
+	};
+
+	smp2pgpio_smp2p_1_in: qcom,smp2pgpio-smp2p-1-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <1>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_1_in {
+		compatible = "qcom,smp2pgpio_test_smp2p_1_in";
+		gpios = <&smp2pgpio_smp2p_1_in 0 0>;
+	};
+
+	smp2pgpio_smp2p_1_out: qcom,smp2pgpio-smp2p-1-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <1>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_1_out {
+		compatible = "qcom,smp2pgpio_test_smp2p_1_out";
+		gpios = <&smp2pgpio_smp2p_1_out 0 0>;
+	};
+
+	smp2pgpio_smp2p_2_in: qcom,smp2pgpio-smp2p-2-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <2>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_2_in {
+		compatible = "qcom,smp2pgpio_test_smp2p_2_in";
+		gpios = <&smp2pgpio_smp2p_2_in 0 0>;
+	};
+
+	smp2pgpio_smp2p_2_out: qcom,smp2pgpio-smp2p-2-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <2>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_2_out {
+		compatible = "qcom,smp2pgpio_test_smp2p_2_out";
+		gpios = <&smp2pgpio_smp2p_2_out 0 0>;
+	};
+
+	smp2pgpio_sleepstate_2_out: qcom,smp2pgpio-sleepstate-gpio-2-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "sleepstate";
+		qcom,remote-pid = <2>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio-sleepstate-2-out {
+		compatible = "qcom,smp2pgpio-sleepstate-out";
+		gpios = <&smp2pgpio_sleepstate_2_out 0 0>;
+	};
+
+	smp2pgpio_smp2p_5_in: qcom,smp2pgpio-smp2p-5-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <5>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_5_in {
+		compatible = "qcom,smp2pgpio_test_smp2p_5_in";
+		gpios = <&smp2pgpio_smp2p_5_in 0 0>;
+	};
+
+	smp2pgpio_smp2p_5_out: qcom,smp2pgpio-smp2p-5-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "smp2p";
+		qcom,remote-pid = <5>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	qcom,smp2pgpio_test_smp2p_5_out {
+		compatible = "qcom,smp2pgpio_test_smp2p_5_out";
+		gpios = <&smp2pgpio_smp2p_5_out 0 0>;
+	};
+
+	/* ssr - inbound entry from mss */
+	smp2pgpio_ssr_smp2p_1_in: qcom,smp2pgpio-ssr-smp2p-1-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "slave-kernel";
+		qcom,remote-pid = <1>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - outbound entry to mss */
+	smp2pgpio_ssr_smp2p_1_out: qcom,smp2pgpio-ssr-smp2p-1-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "master-kernel";
+		qcom,remote-pid = <1>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - inbound entry from lpass */
+	smp2pgpio_ssr_smp2p_2_in: qcom,smp2pgpio-ssr-smp2p-2-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "slave-kernel";
+		qcom,remote-pid = <2>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - outbound entry to lpass */
+	smp2pgpio_ssr_smp2p_2_out: qcom,smp2pgpio-ssr-smp2p-2-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "master-kernel";
+		qcom,remote-pid = <2>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - inbound entry from turing */
+	smp2pgpio_ssr_smp2p_5_in: qcom,smp2pgpio-ssr-smp2p-5-in {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "slave-kernel";
+		qcom,remote-pid = <5>;
+		qcom,is-inbound;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	/* ssr - outbound entry to turing */
+	smp2pgpio_ssr_smp2p_5_out: qcom,smp2pgpio-ssr-smp2p-5-out {
+		compatible = "qcom,smp2pgpio";
+		qcom,entry-name = "master-kernel";
+		qcom,remote-pid = <5>;
+		gpio-controller;
+		#gpio-cells = <2>;
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-usbc-audio-mtp.dts b/arch/arm64/boot/dts/qcom/sdm660-usbc-audio-mtp.dts
new file mode 100644
index 000000000000..dff55d8e9cf8
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-usbc-audio-mtp.dts
@@ -0,0 +1,31 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-mtp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660L, USBC Audio MTP";
+	compatible = "qcom,sdm660-mtp", "qcom,sdm660", "qcom,mtp";
+	qcom,board-id = <8 2>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-moist-cfg = <0>, <0>, <3>;
+	qcom,msm-mbhc-usbc-audio-supported = <1>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-usbc-audio-rcm.dts b/arch/arm64/boot/dts/qcom/sdm660-usbc-audio-rcm.dts
new file mode 100644
index 000000000000..6528558e92ec
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-usbc-audio-rcm.dts
@@ -0,0 +1,30 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sdm660.dtsi"
+#include "sdm660-cdp.dtsi"
+#include "sdm660-external-codec.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660 PM660 + PM660L, USBC Audio, RCM";
+	compatible = "qcom,sdm660-cdp", "qcom,sdm660", "qcom,cdp";
+	qcom,board-id = <21 3>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+			<0x0001001b 0x0201011a 0x0 0x0>;
+};
+
+&tavil_snd {
+	qcom,msm-mbhc-usbc-audio-supported = <1>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-vidc.dtsi b/arch/arm64/boot/dts/qcom/sdm660-vidc.dtsi
new file mode 100644
index 000000000000..588973fbd840
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-vidc.dtsi
@@ -0,0 +1,267 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/msm/msm-bus-ids.h>
+#include <dt-bindings/clock/qcom,gcc-sdm660.h>
+#include <dt-bindings/clock/qcom,mmcc-sdm660.h>
+#include <dt-bindings/clock/qcom,rpmcc.h>
+
+
+&soc {
+	msm_vidc: qcom,vidc@cc00000 {
+		compatible = "qcom,msm-vidc";
+		status = "ok";
+		reg = <0xcc00000 0x100000>;
+		interrupts = <GIC_SPI 287 IRQ_TYPE_LEVEL_HIGH>;
+		qcom,hfi = "venus";
+		qcom,hfi-version = "3xx";
+		qcom,firmware-name = "venus";
+		qcom,never-unload-fw;
+		qcom,sw-power-collapse;
+		qcom,max-secure-instances = <5>;
+		qcom,reg-presets =
+			<0x80010 0x001f001f>,
+			<0x80018 0x00000156>,
+			<0x8001c 0x00000156>;
+
+		qcom,max-hw-load = <1036800>; /* Full 4k @ 30 */
+		qcom,allowed-clock-rates =
+			/* TURBO     NOM+      NOM
+			 *  SVS+      SVS       SVS-
+			 */
+			<518400000 441600000 404000000
+			320000000 269330000 133330000>;
+
+		qcom,dcvs-tbl =
+			/* Dec UHD@30 All decoder - NOM to SVS+ */
+			<897600 783360 979200 0x3f00000c>,
+
+			/* Dec DCI@24 HEVC - NOM to SVS+ */
+			<816000 734400 829440 0x0c000000>,
+
+			/* Enc UHD@30 H264/HEVC - TURBO to NOM+ */
+			<897600 897600 979200 0x4000004>;
+		qcom,dcvs-limit =
+			<32400 30>, /* Encoder UHD */
+			<32400 24>; /* Decoder UHD */
+
+		/* Regulators */
+		smmu-vdd-supply = <&gdsc_bimc_smmu>;
+		venus-supply = <&gdsc_venus>;
+		venus-core0-supply = <&gdsc_venus_core0>;
+
+		/* Clocks */
+		clock-names = "gcc_mmss_sys_noc_axi_clk",
+			"mmssnoc_axi_clk", "mmss_throttle_video_axi_clk",
+			"mmss_mnoc_ahb_clk", "mmss_bimc_smmu_ahb_clk",
+			"mmss_bimc_smmu_axi_clk", "mmss_video_core_clk",
+			"mmss_video_ahb_clk", "mmss_video_axi_clk",
+			"mmss_video_core0_clk";
+		clocks = <&clock_gcc GCC_MMSS_SYS_NOC_AXI_CLK>,
+			<&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_THROTTLE_VIDEO_AXI_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AHB_CLK>,
+			<&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>,
+			<&clock_mmss MMSS_VIDEO_CORE_CLK>,
+			<&clock_mmss MMSS_VIDEO_AHB_CLK>,
+			<&clock_mmss  MMSS_VIDEO_AXI_CLK>,
+			<&clock_mmss MMSS_VIDEO_SUBCORE0_CLK>;
+		qcom,clock-configs = <0x0 0x0 0x0 0x0 0x0 0x0
+				0x3 0x0 0x2 0x3>;
+
+		/* Buses */
+		bus_cnoc {
+			compatible = "qcom,msm-vidc,bus";
+			label = "cnoc";
+			qcom,bus-master = <MSM_BUS_MASTER_AMPSS_M0>;
+			qcom,bus-slave = <MSM_BUS_SLAVE_VENUS_CFG>;
+			qcom,bus-governor = "performance";
+			qcom,bus-range-kbps = <1 1>;
+		};
+
+		venus_bus_ddr {
+			compatible = "qcom,msm-vidc,bus";
+			label = "venus-ddr";
+			qcom,bus-master = <MSM_BUS_MASTER_VIDEO_P0>;
+			qcom,bus-slave = <MSM_BUS_SLAVE_EBI_CH0>;
+			qcom,bus-governor = "venus-ddr-gov";
+			qcom,bus-range-kbps = <1000 2365000>;
+		};
+
+		arm9_bus_ddr {
+			compatible = "qcom,msm-vidc,bus";
+			label = "venus-arm9-ddr";
+			qcom,bus-master = <MSM_BUS_MASTER_VIDEO_P0>;
+			qcom,bus-slave = <MSM_BUS_SLAVE_EBI_CH0>;
+			qcom,bus-governor = "performance";
+			qcom,bus-range-kbps = <1 1>;
+		};
+
+		qcom,clock-freq-tbl {
+			qcom,profile-enc {
+				qcom,codec-mask = <0x55555555>;
+				qcom,cycles-per-mb = <931>;
+				qcom,low-power-mode-factor = <33286>;
+			};
+			qcom,profile-dec {
+				qcom,codec-mask = <0xf3ffffff>;
+				qcom,cycles-per-mb = <355>;
+			};
+			qcom,profile-hevcdec {
+				qcom,codec-mask = <0x0c000000>;
+				qcom,cycles-per-mb = <400>;
+			};
+	    };
+
+	    venus-ddr-gov {
+		compatible = "qcom,msm-vidc,governor,table";
+		name = "venus-ddr-gov";
+		status = "ok";
+		qcom,bus-freq-table {
+			qcom,profile-enc {
+				qcom,codec-mask = <0x55555555>;
+				qcom,load-busfreq-tbl =
+					<979200 1044000>,  /* UHD30E     */
+					<864000 887000>,   /* 720p240LPE */
+					<489600 666000>,   /* 1080p60E   */
+					<432000 578000>,   /* 720p120E   */
+					<244800 346000>,   /* 1080p30E   */
+					<216000 293000>,   /* 720p60E    */
+					<108000 151000>,   /* 720p30E    */
+					<0 0>;
+			};
+			qcom,profile-dec {
+				qcom,codec-mask = <0xffffffff>;
+				qcom,load-busfreq-tbl =
+					<979200 2365000>,  /* UHD30D     */
+					<864000 1978000>,  /* 720p240D   */
+					<489600 1133000>,  /* 1080p60D   */
+					<432000 994000>,   /* 720p120D   */
+					<244800 580000>,   /* 1080p30D   */
+					<216000 501000>,   /* 720p60E    */
+					<108000 255000>,   /* 720p30D    */
+					<0 0>;
+			};
+			qcom,profile-dec-ubwc {
+				qcom,codec-mask = <0xffffffff>;
+				qcom,ubwc-mode;
+				qcom,load-busfreq-tbl =
+					<979200 1892000>,  /* UHD30D     */
+					<864000 1554000>,  /* 720p240D   */
+					<489600 895000>,   /* 1080p60D   */
+					<432000 781000>,   /* 720p120D   */
+					<244800 460000>,   /* 1080p30D   */
+					<216000 301000>,   /* 720p60E    */
+					<108000 202000>,   /* 720p30D    */
+					<0 0>;
+			};
+			qcom,profile-dec-ubwc-10bit {
+				qcom,codec-mask = <0xffffffff>;
+				qcom,ubwc-10bit;
+				qcom,load-busfreq-tbl =
+					<979200 2446336>,  /* UHD30D     */
+					<864000 2108416>,  /* 720p240D   */
+					<489600 1207296>,  /* 1080p60D   */
+					<432000 1058816>,  /* 720p120D   */
+					<244800 616448>,   /* 1080p30D   */
+					<216000 534528>,   /* 720p60D    */
+					<108000 271360>,   /* 720p30D    */
+					<0 0>;
+			};
+		};
+	};
+
+
+		/* MMUs */
+		non_secure_cb {
+			compatible = "qcom,msm-vidc,context-bank";
+			label = "venus_ns";
+			iommus =
+				<&mmss_bimc_smmu 0x400>,
+				<&mmss_bimc_smmu 0x401>,
+				<&mmss_bimc_smmu 0x40a>,
+				<&mmss_bimc_smmu 0x407>,
+				<&mmss_bimc_smmu 0x40e>,
+				<&mmss_bimc_smmu 0x40f>,
+				<&mmss_bimc_smmu 0x408>,
+				<&mmss_bimc_smmu 0x409>,
+				<&mmss_bimc_smmu 0x40b>,
+				<&mmss_bimc_smmu 0x40c>,
+				<&mmss_bimc_smmu 0x40d>,
+				<&mmss_bimc_smmu 0x410>,
+				<&mmss_bimc_smmu 0x421>,
+				<&mmss_bimc_smmu 0x428>,
+				<&mmss_bimc_smmu 0x429>,
+				<&mmss_bimc_smmu 0x42b>,
+				<&mmss_bimc_smmu 0x42c>,
+				<&mmss_bimc_smmu 0x42d>,
+				<&mmss_bimc_smmu 0x411>,
+				<&mmss_bimc_smmu 0x431>;
+			buffer-types = <0xfff>;
+			virtual-addr-pool = <0x79000000 0x60000000>;
+		};
+
+		firmware_cb {
+			compatible = "qcom,msm-vidc,context-bank";
+			qcom,fw-context-bank;
+			iommus = <&mmss_bimc_smmu 0x580>,
+				<&mmss_bimc_smmu 0x586>;
+		};
+		secure_bitstream_cb {
+			compatible = "qcom,msm-vidc,context-bank";
+			label = "venus_sec_bitstream";
+			iommus = <&mmss_bimc_smmu 0x500>,
+				<&mmss_bimc_smmu 0x502>,
+				<&mmss_bimc_smmu 0x509>,
+				<&mmss_bimc_smmu 0x50a>,
+				<&mmss_bimc_smmu 0x50b>,
+				<&mmss_bimc_smmu 0x50e>,
+				<&mmss_bimc_smmu 0x526>,
+				<&mmss_bimc_smmu 0x529>,
+				<&mmss_bimc_smmu 0x52b>;
+			buffer-types = <0x241>;
+			virtual-addr-pool = <0x51000000 0x28000000>;
+			qcom,secure-context-bank;
+		};
+
+		venus_secure_pixel_cb: secure_pixel_cb {
+			compatible = "qcom,msm-vidc,context-bank";
+			label = "venus_sec_pixel";
+			iommus = <&mmss_bimc_smmu 0x504>,
+				<&mmss_bimc_smmu 0x50c>,
+				<&mmss_bimc_smmu 0x510>,
+				<&mmss_bimc_smmu 0x52c>;
+			buffer-types = <0x106>;
+			virtual-addr-pool = <0x29000000 0x28000000>;
+			qcom,secure-context-bank;
+		};
+
+		venus_secure_non_pixel_cb: secure_non_pixel_cb {
+			compatible = "qcom,msm-vidc,context-bank";
+			label = "venus_sec_non_pixel";
+			iommus = <&mmss_bimc_smmu 0x505>,
+				<&mmss_bimc_smmu 0x507>,
+				<&mmss_bimc_smmu 0x508>,
+				<&mmss_bimc_smmu 0x50d>,
+				<&mmss_bimc_smmu 0x50f>,
+				<&mmss_bimc_smmu 0x525>,
+				<&mmss_bimc_smmu 0x528>,
+				<&mmss_bimc_smmu 0x52d>,
+				<&mmss_bimc_smmu 0x540>;
+			buffer-types = <0x480>;
+			virtual-addr-pool = <0x1000000 0x28000000>;
+			qcom,secure-context-bank;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-wcd.dtsi b/arch/arm64/boot/dts/qcom/sdm660-wcd.dtsi
new file mode 100644
index 000000000000..006bf0175874
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-wcd.dtsi
@@ -0,0 +1,197 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&slim_aud {
+	tasha_codec {
+		wsa_spkr_sd1: msm_cdc_pinctrll {
+		      compatible = "qcom,msm-cdc-pinctrl";
+		      pinctrl-names = "aud_active", "aud_sleep";
+		      pinctrl-0 = <&spkr_1_sd_n_active>;
+		      pinctrl-1 = <&spkr_1_sd_n_sleep>;
+		};
+
+		wsa_spkr_sd2: msm_cdc_pinctrlr {
+		      compatible = "qcom,msm-cdc-pinctrl";
+		      pinctrl-names = "aud_active", "aud_sleep";
+		      pinctrl-0 = <&spkr_2_sd_n_active>;
+		      pinctrl-1 = <&spkr_2_sd_n_sleep>;
+		};
+
+		tasha_hph_en0: msm_cdc_pinctrl_hph_en0 {
+		      compatible = "qcom,msm-cdc-pinctrl";
+		      pinctrl-names = "aud_active", "aud_sleep";
+		      pinctrl-0 = <&hph_en0_active>;
+		      pinctrl-1 = <&hph_en0_sleep>;
+		};
+
+		tasha_hph_en1: msm_cdc_pinctrl_hph_en1 {
+		      compatible = "qcom,msm-cdc-pinctrl";
+		      pinctrl-names = "aud_active", "aud_sleep";
+		      pinctrl-0 = <&hph_en1_active>;
+		      pinctrl-1 = <&hph_en1_sleep>;
+		};
+	};
+
+	tavil_codec {
+		wcd: wcd_pinctrl@5 {
+			compatible = "qcom,wcd-pinctrl";
+			qcom,num-gpios = <5>;
+			gpio-controller;
+			#gpio-cells = <2>;
+
+			us_euro_sw_wcd_active: us_euro_sw_wcd_active {
+				mux {
+					pins = "gpio1";
+				};
+
+				config {
+					pins = "gpio1";
+					output-high;
+				};
+			};
+
+			us_euro_sw_wcd_sleep: us_euro_sw_wcd_sleep {
+				mux {
+					pins = "gpio1";
+				};
+
+				config {
+					pins = "gpio1";
+					output-low;
+				};
+			};
+
+			spkr_1_wcd_en_active: spkr_1_wcd_en_active {
+				mux {
+					pins = "gpio2";
+				};
+
+				config {
+					pins = "gpio2";
+					output-high;
+				};
+			};
+
+			spkr_1_wcd_en_sleep: spkr_1_wcd_en_sleep {
+				mux {
+					pins = "gpio2";
+				};
+
+				config {
+					pins = "gpio2";
+					input-enable;
+				};
+			};
+
+			spkr_2_wcd_en_active: spkr_2_sd_n_active {
+				mux {
+					pins = "gpio3";
+				};
+
+				config {
+					pins = "gpio3";
+					output-high;
+				};
+			};
+
+			spkr_2_wcd_en_sleep: spkr_2_sd_n_sleep {
+				mux {
+					pins = "gpio3";
+				};
+
+				config {
+					pins = "gpio3";
+					input-enable;
+				};
+			};
+
+			hph_en0_wcd_active: hph_en0_wcd_active {
+				mux {
+					pins = "gpio4";
+				};
+
+				config {
+					pins = "gpio4";
+					output-high;
+				};
+			};
+
+			hph_en0_wcd_sleep: hph_en0_wcd_sleep {
+				mux {
+					pins = "gpio4";
+				};
+
+				config {
+					pins = "gpio4";
+					output-low;
+				};
+			};
+
+			hph_en1_wcd_active: hph_en1_wcd_active {
+				mux {
+					pins = "gpio5";
+				};
+
+				config {
+					pins = "gpio5";
+					output-high;
+				};
+			};
+
+			hph_en1_wcd_sleep: hph_en1_wcd_sleep {
+				mux {
+					pins = "gpio5";
+				};
+
+				config {
+					pins = "gpio5";
+					output-low;
+				};
+			};
+		};
+
+		wsa_spkr_wcd_sd1: msm_cdc_pinctrll {
+		      compatible = "qcom,msm-cdc-pinctrl";
+		      pinctrl-names = "aud_active", "aud_sleep";
+		      pinctrl-0 = <&spkr_1_wcd_en_active>;
+		      pinctrl-1 = <&spkr_1_wcd_en_sleep>;
+		};
+
+		wsa_spkr_wcd_sd2: msm_cdc_pinctrlr {
+		      compatible = "qcom,msm-cdc-pinctrl";
+		      pinctrl-names = "aud_active", "aud_sleep";
+		      pinctrl-0 = <&spkr_2_wcd_en_active>;
+		      pinctrl-1 = <&spkr_2_wcd_en_sleep>;
+		};
+
+		tavil_us_euro_sw: msm_cdc_pinctrl_us_euro_sw {
+		      compatible = "qcom,msm-cdc-pinctrl";
+		      pinctrl-names = "aud_active", "aud_sleep";
+		      pinctrl-0 = <&us_euro_sw_wcd_active>;
+		      pinctrl-1 = <&us_euro_sw_wcd_sleep>;
+		};
+
+		tavil_hph_en0: msm_cdc_pinctrl_hph_en0 {
+		      compatible = "qcom,msm-cdc-pinctrl";
+		      pinctrl-names = "aud_active", "aud_sleep";
+		      pinctrl-0 = <&hph_en0_wcd_active>;
+		      pinctrl-1 = <&hph_en0_wcd_sleep>;
+		};
+
+		tavil_hph_en1: msm_cdc_pinctrl_hph_en1 {
+		      compatible = "qcom,msm-cdc-pinctrl";
+		      pinctrl-names = "aud_active", "aud_sleep";
+		      pinctrl-0 = <&hph_en1_wcd_active>;
+		      pinctrl-1 = <&hph_en1_wcd_sleep>;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660-wsa881x.dtsi b/arch/arm64/boot/dts/qcom/sdm660-wsa881x.dtsi
new file mode 100644
index 000000000000..a71aa7ded60b
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660-wsa881x.dtsi
@@ -0,0 +1,79 @@
+/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdm660-wcd.dtsi"
+
+&slim_aud {
+	tasha_codec {
+		swr_master {
+			compatible = "qcom,swr-wcd";
+			#address-cells = <2>;
+			#size-cells = <0>;
+
+			wsa881x_211: wsa881x@20170211 {
+				compatible = "qcom,wsa881x";
+				reg = <0x0 0x20170211>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_sd1>;
+			};
+
+			wsa881x_212: wsa881x@20170212 {
+				compatible = "qcom,wsa881x";
+				reg = <0x0 0x20170212>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_sd2>;
+			};
+
+			wsa881x_213: wsa881x@21170213 {
+				compatible = "qcom,wsa881x";
+				reg = <0x0 0x21170213>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_sd1>;
+			};
+
+			wsa881x_214: wsa881x@21170214 {
+				compatible = "qcom,wsa881x";
+				reg = <0x0 0x21170214>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_sd2>;
+			};
+		};
+	};
+
+	tavil_codec {
+		swr_master {
+			compatible = "qcom,swr-wcd";
+			#address-cells = <2>;
+			#size-cells = <0>;
+
+			wsa881x_0211: wsa881x@20170211 {
+				compatible = "qcom,wsa881x";
+				reg = <0x0 0x20170211>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_wcd_sd1>;
+			};
+
+			wsa881x_0212: wsa881x@20170212 {
+				compatible = "qcom,wsa881x";
+				reg = <0x0 0x20170212>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_wcd_sd2>;
+			};
+
+			wsa881x_0213: wsa881x@21170213 {
+				compatible = "qcom,wsa881x";
+				reg = <0x0 0x21170213>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_wcd_sd1>;
+			};
+
+			wsa881x_0214: wsa881x@21170214 {
+				compatible = "qcom,wsa881x";
+				reg = <0x0 0x21170214>;
+				qcom,spkr-sd-n-node = <&wsa_spkr_wcd_sd2>;
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm660.dtsi b/arch/arm64/boot/dts/qcom/sdm660.dtsi
new file mode 100644
index 000000000000..a414ff6504e0
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sdm660.dtsi
@@ -0,0 +1,2662 @@
+/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "skeleton64.dtsi"
+#include <dt-bindings/clock/qcom,gcc-sdm660.h>
+#include <dt-bindings/clock/qcom,gpu-sdm660.h>
+#include <dt-bindings/clock/qcom,mmcc-sdm660.h>
+#include <dt-bindings/clock/qcom,rpmcc.h>
+#include <dt-bindings/clock/audio-ext-clk.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+#include <dt-bindings/regulator/qcom,rpm-smd-regulator.h>
+#include <dt-bindings/clock/qcom,cpu-osm.h>
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDM 660";
+	compatible = "qcom,sdm660";
+	qcom,msm-id = <317 0x0>;
+	interrupt-parent = <&intc>;
+
+	aliases {
+		serial0 = &uartblsp1dm1;
+		sdhc1 = &sdhc_1; /* SDC1 eMMC slot */
+		sdhc2 = &sdhc_2; /* SDC2 for SD card */
+	};
+
+	chosen {
+		stdout-path = "serial0";
+		bootargs = "rcupdate.rcu_expedited=1";
+	};
+
+	psci {
+		compatible = "arm,psci-1.0";
+		method = "smc";
+	};
+
+	cpus {
+		#address-cells = <2>;
+		#size-cells = <0>;
+
+		CPU0: cpu@0 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x0>;
+			enable-method = "psci";
+			qcom,limits-info = <&mitigation_profile0>;
+			qcom,lmh-dcvs = <&lmh_dcvs0>;
+			qcom,ea = <&ea0>;
+			efficiency = <1024>;
+			next-level-cache = <&L2_0>;
+			L2_0: l2-cache {
+				compatible = "arm,arch-cache";
+				cache-level = <2>;
+				/* A53 L2 dump not supported */
+				qcom,dump-size = <0x0>;
+			};
+			L1_I_0: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_0: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_TLB_0: l1-tlb {
+				qcom,dump-size = <0x2800>;
+			};
+		};
+
+		CPU1: cpu@1 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x1>;
+			enable-method = "psci";
+			qcom,limits-info = <&mitigation_profile0>;
+			qcom,lmh-dcvs = <&lmh_dcvs0>;
+			qcom,ea = <&ea1>;
+			efficiency = <1024>;
+			next-level-cache = <&L2_0>;
+			L1_I_1: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_1: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_TLB_1: l1-tlb {
+				qcom,dump-size = <0x2800>;
+			};
+		};
+
+		CPU2: cpu@2 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x2>;
+			enable-method = "psci";
+			qcom,limits-info = <&mitigation_profile0>;
+			qcom,lmh-dcvs = <&lmh_dcvs0>;
+			qcom,ea = <&ea2>;
+			efficiency = <1024>;
+			next-level-cache = <&L2_0>;
+			L1_I_2: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_2: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_TLB_2: l1-tlb {
+				qcom,dump-size = <0x2800>;
+			};
+		};
+
+		CPU3: cpu@3 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x3>;
+			enable-method = "psci";
+			qcom,limits-info = <&mitigation_profile0>;
+			qcom,lmh-dcvs = <&lmh_dcvs0>;
+			qcom,ea = <&ea3>;
+			efficiency = <1024>;
+			next-level-cache = <&L2_0>;
+			L1_I_3: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_D_3: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x9040>;
+			};
+			L1_TLB_3: l1-tlb {
+				qcom,dump-size = <0x2800>;
+			};
+		};
+
+		CPU4: cpu@100 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x100>;
+			enable-method = "psci";
+			qcom,limits-info = <&mitigation_profile1>;
+			qcom,lmh-dcvs = <&lmh_dcvs1>;
+			qcom,ea = <&ea4>;
+			efficiency = <1638>;
+			next-level-cache = <&L2_1>;
+			L2_1: l2-cache {
+				compatible = "arm,arch-cache";
+				cache-level = <2>;
+			};
+			L1_I_100: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_D_100: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_TLB_100: l1-tlb {
+				qcom,dump-size = <0x4800>;
+			};
+		};
+
+		CPU5: cpu@101 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x101>;
+			enable-method = "psci";
+			qcom,limits-info = <&mitigation_profile2>;
+			qcom,lmh-dcvs = <&lmh_dcvs1>;
+			qcom,ea = <&ea5>;
+			efficiency = <1638>;
+			next-level-cache = <&L2_1>;
+			L1_I_101: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_D_101: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_TLB_101: l1-tlb {
+				qcom,dump-size = <0x4800>;
+			};
+		};
+
+		CPU6: cpu@102 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x102>;
+			enable-method = "psci";
+			qcom,limits-info = <&mitigation_profile3>;
+			qcom,lmh-dcvs = <&lmh_dcvs1>;
+			qcom,ea = <&ea6>;
+			efficiency = <1638>;
+			next-level-cache = <&L2_1>;
+			L1_I_102: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_D_102: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_TLB_102: l1-tlb {
+				qcom,dump-size = <0x4800>;
+			};
+		};
+
+		CPU7: cpu@103 {
+			device_type = "cpu";
+			compatible = "arm,armv8";
+			reg = <0x0 0x103>;
+			enable-method = "psci";
+			qcom,limits-info = <&mitigation_profile4>;
+			qcom,lmh-dcvs = <&lmh_dcvs1>;
+			qcom,ea = <&ea7>;
+			efficiency = <1638>;
+			next-level-cache = <&L2_1>;
+			L1_I_103: l1-icache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_D_103: l1-dcache {
+				compatible = "arm,arch-cache";
+				qcom,dump-size = <0x12000>;
+			};
+			L1_TLB_103: l1-tlb {
+				qcom,dump-size = <0x4800>;
+			};
+		};
+
+		cpu-map {
+			cluster0 {
+				core0 {
+					cpu = <&CPU0>;
+				};
+
+				core1 {
+					cpu = <&CPU1>;
+				};
+
+				core2 {
+					cpu = <&CPU2>;
+				};
+
+				core3 {
+					cpu = <&CPU3>;
+				};
+			};
+
+			cluster1 {
+				core0 {
+					cpu = <&CPU4>;
+				};
+
+				core1 {
+					cpu = <&CPU5>;
+				};
+
+				core2 {
+					cpu = <&CPU6>;
+				};
+
+				core3 {
+					cpu = <&CPU7>;
+				};
+			};
+		};
+	};
+
+	clocks {
+		xo_board {
+			compatible = "fixed-clock";
+			#clock-cells = <0>;
+			clock-frequency = <19200000>;
+			clock-output-names = "xo_board";
+		};
+
+		sleep_clk {
+			compatible = "fixed-clock";
+			#clock-cells = <0>;
+			clock-frequency = <32764>;
+			clock-output-names = "sleep_clk";
+		};
+	};
+
+	soc: soc { };
+
+	firmware: firmware {
+		android {
+			compatible = "android,firmware";
+			fstab {
+				compatible = "android,fstab";
+				vendor {
+					compatible = "android,vendor";
+					dev = "/dev/block/platform/soc/c0c4000.sdhci/by-name/vendor";
+					type = "ext4";
+					mnt_flags = "ro,barrier=1,discard";
+					fsmgr_flags = "wait,slotselect";
+					status = "ok";
+				};
+			};
+		};
+	};
+
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		wlan_msa_guard: wlan_msa_guard@85600000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0x0 0x85600000 0x0 0x100000>;
+		};
+
+		wlan_msa_mem: wlan_msa_mem@85700000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0x0 0x85700000 0x0 0x100000>;
+		};
+
+		removed_regions: removed_regions@85800000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0x0 0x85800000 0x0 0x3700000>;
+		};
+
+		modem_fw_mem: modem_fw_region@8ac00000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0x0 0x8ac00000 0x0 0x7e00000>;
+		};
+
+		adsp_fw_mem: adsp_fw_region@92a00000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0x0 0x92a00000 0x0 0x1e00000>;
+		};
+
+		pil_mba_mem: pil_mba_region@94800000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0x0 0x94800000 0x0 0x200000>;
+		};
+
+		cdsp_fw_mem: cdsp_fw_region@94a00000 {
+			compatible = "removed-dma-pool";
+			no-map;
+			reg = <0x0 0x94a00000 0x0 0x600000>;
+		};
+
+		venus_fw_mem: venus_fw_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x80000000 0x0 0x20000000>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x800000>;
+		};
+
+		adsp_mem: adsp_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x800000>;
+		};
+
+		qseecom_mem: qseecom_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x1400000>;
+		};
+
+		secure_display_memory: secure_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			reusable;
+			alignment = <0x0 0x400000>;
+			size = <0x0 0x5c00000>;
+		};
+
+		/* global autoconfigured region for contiguous allocations */
+		linux,cma {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0 0x00000000 0 0xffffffff>;
+			reusable;
+			alignment = <0 0x400000>;
+			size = <0 0x2c00000>;
+			linux,cma-default;
+		};
+
+		cont_splash_mem: splash_region@9d400000 {
+			reg = <0x0 0x9d400000 0x0 0x02400000>;
+			label = "cont_splash_mem";
+		};
+	};
+
+	bluetooth: bt_wcn3990 {
+		compatible = "qca,wcn3990";
+		qca,bt-vdd-core-supply = <&pm660_l9>;
+		qca,bt-vdd-pa-supply = <&pm660_l6>;
+		qca,bt-vdd-ldo-supply = <&pm660_l19>;
+		qca,bt-chip-pwd-supply = <&pm660l_bob_pin1>;
+		clocks = <&clock_rpmcc RPM_RF_CLK1_PIN>;
+		clock-names = "rf_clk1";
+
+		qca,bt-vdd-core-voltage-level = <1800000 1900000>;
+		qca,bt-vdd-pa-voltage-level = <1304000 1370000>;
+		qca,bt-vdd-ldo-voltage-level = <3312000 3400000>;
+		qca,bt-chip-pwd-voltage-level = <3600000 3600000>;
+
+		qca,bt-vdd-core-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-pa-current-level = <1>; /* LPM/PFM */
+		qca,bt-vdd-ldo-current-level = <1>; /* LPM/PFM */
+	};
+};
+
+#include "sdm660-smp2p.dtsi"
+#include "sdm660-coresight.dtsi"
+&soc {
+	#address-cells = <1>;
+	#size-cells = <1>;
+	ranges = <0 0 0 0xffffffff>;
+	compatible = "simple-bus";
+
+	intc: interrupt-controller@17a00000 {
+		compatible = "arm,gic-v3";
+		reg = <0x17a00000 0x10000>,       /* GICD */
+		      <0x17b00000 0x100000>;      /* GICR * 8 */
+		#interrupt-cells = <3>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		interrupt-controller;
+		#redistributor-regions = <1>;
+		redistributor-stride = <0x0 0x20000>;
+		interrupts = <1 9 4>;
+	};
+
+	timer {
+		compatible = "arm,armv8-timer";
+		interrupts = <1 1 0xf08>,
+			     <1 2 0xf08>,
+			     <1 3 0xf08>,
+			     <1 0 0xf08>;
+		clock-frequency = <19200000>;
+	};
+
+	dma_blsp1: qcom,sps-dma@0xc144000{ /* BLSP1 */
+		#dma-cells = <4>;
+		compatible = "qcom,sps-dma";
+		reg = <0xc144000 0x1F000>;
+		interrupts = <0 238 0>;
+		qcom,summing-threshold = <0x10>;
+	};
+
+	dma_blsp2: qcom,sps-dma@0xc184000{ /* BLSP2 */
+		#dma-cells = <4>;
+		compatible = "qcom,sps-dma";
+		reg = <0xc184000 0x1F000>;
+		interrupts = <0 239 0>;
+		qcom,summing-threshold = <0x10>;
+	};
+
+	restart@10ac000 {
+		compatible = "qcom,pshold";
+		reg = <0x10ac000 0x4>,
+		      <0x1fd3000 0x4>;
+		reg-names = "pshold-base", "tcsr-boot-misc-detect";
+	};
+
+	spmi_bus: qcom,spmi@800f000 {
+		compatible = "qcom,spmi-pmic-arb";
+		reg = <0x800f000 0x1000>,
+			<0x8400000 0x1000000>,
+			<0x9400000 0x1000000>,
+			<0xa400000 0x220000>,
+			<0x800a000 0x3000>;
+		reg-names = "core", "chnls", "obsrvr", "intr", "cnfg";
+		interrupt-names = "periph_irq";
+		interrupts = <GIC_SPI 326 IRQ_TYPE_NONE>;
+		qcom,ee = <0>;
+		qcom,channel = <0>;
+		qcom,reserved-chan = <511>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+		interrupt-controller;
+		#interrupt-cells = <4>;
+		cell-index = <0>;
+		status = "ok";
+	};
+
+	cpuss_dump {
+		compatible = "qcom,cpuss-dump";
+		qcom,l1_i_cache0 {
+			qcom,dump-node = <&L1_I_0>;
+			qcom,dump-id = <0x60>;
+		};
+		qcom,l1_i_cache1 {
+			qcom,dump-node = <&L1_I_1>;
+			qcom,dump-id = <0x61>;
+		};
+		qcom,l1_i_cache2 {
+			qcom,dump-node = <&L1_I_2>;
+			qcom,dump-id = <0x62>;
+		};
+		qcom,l1_i_cache3 {
+			qcom,dump-node = <&L1_I_3>;
+			qcom,dump-id = <0x63>;
+		};
+		qcom,l1_i_cache100 {
+			qcom,dump-node = <&L1_I_100>;
+			qcom,dump-id = <0x64>;
+		};
+		qcom,l1_i_cache101 {
+			qcom,dump-node = <&L1_I_101>;
+			qcom,dump-id = <0x65>;
+		};
+		qcom,l1_i_cache102 {
+			qcom,dump-node = <&L1_I_102>;
+			qcom,dump-id = <0x66>;
+		};
+		qcom,l1_i_cache103 {
+			qcom,dump-node = <&L1_I_103>;
+			qcom,dump-id = <0x67>;
+		};
+		qcom,l1_d_cache0 {
+			qcom,dump-node = <&L1_D_0>;
+			qcom,dump-id = <0x80>;
+		};
+		qcom,l1_d_cache1 {
+			qcom,dump-node = <&L1_D_1>;
+			qcom,dump-id = <0x81>;
+		};
+		qcom,l1_d_cache2 {
+			qcom,dump-node = <&L1_D_2>;
+			qcom,dump-id = <0x82>;
+		};
+		qcom,l1_d_cache3 {
+			qcom,dump-node = <&L1_D_3>;
+			qcom,dump-id = <0x83>;
+		};
+		qcom,l1_d_cache100 {
+			qcom,dump-node = <&L1_D_100>;
+			qcom,dump-id = <0x84>;
+		};
+		qcom,l1_d_cache101 {
+			qcom,dump-node = <&L1_D_101>;
+			qcom,dump-id = <0x85>;
+		};
+		qcom,l1_d_cache102 {
+			qcom,dump-node = <&L1_D_102>;
+			qcom,dump-id = <0x86>;
+		};
+		qcom,l1_d_cache103 {
+			qcom,dump-node = <&L1_D_103>;
+			qcom,dump-id = <0x87>;
+		};
+		qcom,l1_tlb_dump0 {
+			qcom,dump-node = <&L1_TLB_0>;
+			qcom,dump-id = <0x20>;
+		};
+		qcom,l1_tlb_dump1 {
+			qcom,dump-node = <&L1_TLB_1>;
+			qcom,dump-id = <0x21>;
+		};
+		qcom,l1_tlb_dump2 {
+			qcom,dump-node = <&L1_TLB_2>;
+			qcom,dump-id = <0x22>;
+		};
+		qcom,l1_tlb_dump3 {
+			qcom,dump-node = <&L1_TLB_3>;
+			qcom,dump-id = <0x23>;
+		};
+		qcom,l1_tlb_dump100 {
+			qcom,dump-node = <&L1_TLB_100>;
+			qcom,dump-id = <0x24>;
+		};
+		qcom,l1_tlb_dump101 {
+			qcom,dump-node = <&L1_TLB_101>;
+			qcom,dump-id = <0x25>;
+		};
+		qcom,l1_tlb_dump102 {
+			qcom,dump-node = <&L1_TLB_102>;
+			qcom,dump-id = <0x26>;
+		};
+		qcom,l1_tlb_dump103 {
+			qcom,dump-node = <&L1_TLB_103>;
+			qcom,dump-id = <0x27>;
+		};
+	};
+
+	wdog: qcom,wdt@17817000 {
+		compatible = "qcom,msm-watchdog";
+		reg = <0x17817000 0x1000>;
+		reg-names = "wdt-base";
+		interrupts = <0 3 0>, <0 4 0>;
+		qcom,bark-time = <11000>;
+		qcom,pet-time = <10000>;
+		qcom,ipi-ping;
+		qcom,wakeup-enable;
+		qcom,scandump-size = <0x40000>;
+	};
+
+	qcom,sps {
+		compatible = "qcom,msm_sps_4k";
+		qcom,pipe-attr-ee;
+	};
+
+	qcom,memshare {
+		compatible = "qcom,memshare";
+
+		qcom,client_1 {
+			compatible = "qcom,memshare-peripheral";
+			qcom,peripheral-size = <0x200000>;
+			qcom,client-id = <0>;
+			qcom,allocate-boot-time;
+			label = "modem";
+		};
+
+		qcom,client_2 {
+			compatible = "qcom,memshare-peripheral";
+			qcom,peripheral-size = <0x300000>;
+			qcom,client-id = <2>;
+			label = "modem";
+		};
+
+		mem_client_3_size: qcom,client_3 {
+			compatible = "qcom,memshare-peripheral";
+			qcom,peripheral-size = <0x0>;
+			qcom,client-id = <1>;
+			qcom,allocate-boot-time;
+			label = "modem";
+		};
+	};
+
+	tsens: tsens@10ad000 {
+		compatible = "qcom,sdm660-tsens";
+		reg = <0x10ad000 0x2000>,
+			<0x784240 0x1000>;
+		reg-names = "tsens_physical", "tsens_eeprom_physical";
+		interrupts = <0 184 0>, <0 430 0>;
+		interrupt-names = "tsens-upper-lower", "tsens-critical";
+		qcom,client-id = <0 1 2 3 4 5 6 7 8 9 10 11 12 13>;
+		qcom,sensor-id = <0 10 11 4 5 6 7 8 13 2 3 12 9 1>;
+		qcom,sensors = <14>;
+		qcom,slope = <3200 3200 3200 3200 3200 3200 3200 3200
+					3200 3200 3200 3200 3200 3200>;
+	};
+
+	uartblsp1dm1: serial@0c170000 {
+		compatible = "qcom,msm-uartdm-v1.4", "qcom,msm-uartdm";
+		reg = <0xc170000 0x1000>;
+		interrupts = <0 108 0>;
+		status = "disabled";
+		clocks = <&clock_gcc GCC_BLSP1_UART2_APPS_CLK>,
+			 <&clock_gcc GCC_BLSP1_AHB_CLK>;
+		clock-names = "core", "iface";
+	};
+
+	qcom,sensor-information {
+		compatible = "qcom,sensor-information";
+		sensor_information0: qcom,sensor-information-0 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor0";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information1: qcom,sensor-information-1 {
+			qcom,sensor-type =  "tsens";
+			qcom,sensor-name = "tsens_tz_sensor1";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information2: qcom,sensor-information-2 {
+			qcom,sensor-type =  "tsens";
+			qcom,sensor-name = "tsens_tz_sensor2";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information3: qcom,sensor-information-3 {
+			qcom,sensor-type =  "tsens";
+			qcom,sensor-name = "tsens_tz_sensor3";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information4: qcom,sensor-information-4 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor4";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information5: qcom,sensor-information-5 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor5";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information6: qcom,sensor-information-6 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor6";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information7: qcom,sensor-information-7 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor7";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information8: qcom,sensor-information-8 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor8";
+			qcom,scaling-factor = <10>;
+			qcom,alias-name = "gpu";
+		};
+		sensor_information9: qcom,sensor-information-9 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor9";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information10: qcom,sensor-information-10 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor10";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information11: qcom,sensor-information-11 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor11";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information12: qcom,sensor-information-12 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor12";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information13: qcom,sensor-information-13 {
+			qcom,sensor-type = "tsens";
+			qcom,sensor-name = "tsens_tz_sensor13";
+			qcom,scaling-factor = <10>;
+		};
+		sensor_information14: qcom,sensor-information-14 {
+			qcom,sensor-type =  "alarm";
+			qcom,sensor-name = "pm660_tz";
+			qcom,scaling-factor = <1000>;
+		};
+		sensor_information15: qcom,sensor-information-15 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "msm_therm";
+		};
+		sensor_information16: qcom,sensor-information-16 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "xo_therm";
+		};
+		sensor_information17: qcom,sensor-information-17 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "pa_therm0";
+		};
+		sensor_information18: qcom,sensor-information-18 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "pa_therm1";
+		};
+		sensor_information19: qcom,sensor-information-19 {
+			qcom,sensor-type =  "adc";
+			qcom,sensor-name = "quiet_therm";
+		};
+		sensor_information20: qcom,sensor-information-20 {
+			qcom,sensor-type = "llm";
+			qcom,sensor-name = "limits_sensor-00";
+		};
+		sensor_information21: qcom,sensor-information-21 {
+			qcom,sensor-type = "llm";
+			qcom,sensor-name = "limits_sensor-01";
+		};
+	};
+
+	mitigation_profile0: qcom,limit_info-0 {
+		qcom,temperature-sensor = <&sensor_information1>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile1: qcom,limit_info-1 {
+		qcom,temperature-sensor = <&sensor_information3>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile2: qcom,limit_info-2 {
+		qcom,temperature-sensor = <&sensor_information4>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile3: qcom,limit_info-3 {
+		qcom,temperature-sensor = <&sensor_information5>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	mitigation_profile4: qcom,limit_info-4 {
+		qcom,temperature-sensor = <&sensor_information6>;
+		qcom,hotplug-mitigation-enable;
+	};
+
+	qcom,msm-thermal {
+		compatible = "qcom,msm-thermal";
+		qcom,sensor-id = <1>;
+		qcom,poll-ms = <100>;
+		qcom,therm-reset-temp = <115>;
+		qcom,core-limit-temp = <70>;
+		qcom,core-temp-hysteresis = <10>;
+		qcom,hotplug-temp = <105>;
+		qcom,hotplug-temp-hysteresis = <20>;
+		qcom,online-hotplug-core;
+		qcom,synchronous-cluster-id = <0 1>;
+		qcom,synchronous-cluster-map = <0 4 &CPU0 &CPU1 &CPU2 &CPU3>,
+						<1 4 &CPU4 &CPU5 &CPU6 &CPU7>;
+
+		clock-names = "osm";
+		clocks = <&clock_cpu PWRCL_CLK>;
+		qcom,cxip-lm-enable = <1>;
+		qcom,vdd-restriction-temp = <5>;
+		qcom,vdd-restriction-temp-hysteresis = <10>;
+
+		vdd-dig-supply = <&pm660l_s3_floor_level>;
+		vdd-gfx-supply = <&gfx_vreg_corner>;
+
+		qcom,vdd-dig-rstr{
+			qcom,vdd-rstr-reg = "vdd-dig";
+			qcom,levels = <RPM_SMD_REGULATOR_LEVEL_NOM
+					RPM_SMD_REGULATOR_LEVEL_TURBO
+					RPM_SMD_REGULATOR_LEVEL_TURBO>;
+			qcom,min-level = <RPM_SMD_REGULATOR_LEVEL_NONE>;
+		};
+
+		qcom,vdd-gfx-rstr{
+			qcom,vdd-rstr-reg = "vdd-gfx";
+			qcom,levels = <5 6 6>; /* Nominal, Turbo, Turbo */
+			qcom,min-level = <1>; /* No Request */
+		};
+
+		msm_thermal_freq: qcom,vdd-apps-rstr{
+			qcom,vdd-rstr-reg = "vdd-apps";
+			qcom,levels = <1248000>;
+			qcom,freq-req;
+		};
+	};
+
+	cx_ipeak_lm: cx_ipeak@1fe5040 {
+		compatible = "qcom,cx-ipeak-sdm660";
+		reg = <0x1fe5040 0x28>;
+	};
+
+	qcom,bcl {
+		compatible = "qcom,bcl";
+		qcom,bcl-enable;
+		qcom,bcl-framework-interface;
+		qcom,bcl-hotplug-list = <&CPU6 &CPU7>;
+		qcom,bcl-soc-hotplug-list = <&CPU4 &CPU5 &CPU6 &CPU7>;
+		qcom,ibat-monitor {
+			qcom,low-threshold-uamp = <3400000>;
+			qcom,high-threshold-uamp = <4200000>;
+			qcom,vph-high-threshold-uv = <3500000>;
+			qcom,vph-low-threshold-uv = <3300000>;
+			qcom,soc-low-threshold = <10>;
+		};
+	};
+
+	qcom,lmh {
+		compatible = "qcom,lmh_v1";
+		interrupts = <GIC_SPI 134 IRQ_TYPE_LEVEL_HIGH>;
+	};
+
+	qcom,msm-core@780000 {
+		compatible = "qcom,apss-core-ea";
+		reg = <0x780000 0x1000>;
+		qcom,low-hyst-temp = <100>;
+		qcom,high-hyst-temp = <100>;
+
+		ea0: ea0 {
+			sensor = <&sensor_information1>;
+		};
+
+		ea1: ea1 {
+			sensor = <&sensor_information1>;
+		};
+
+		ea2: ea2 {
+			sensor = <&sensor_information1>;
+		};
+
+		ea3: ea3 {
+			sensor = <&sensor_information1>;
+		};
+
+		ea4: ea4 {
+			sensor = <&sensor_information3>;
+		};
+
+		ea5: ea5 {
+			sensor = <&sensor_information4>;
+		};
+
+		ea6: ea6 {
+			sensor = <&sensor_information5>;
+		};
+
+		ea7: ea7 {
+			sensor = <&sensor_information6>;
+		};
+	};
+
+	uartblsp2dm1: serial@0c1b0000 {
+		compatible = "qcom,msm-uartdm-v1.4", "qcom,msm-uartdm";
+		reg = <0xc1b0000 0x1000>;
+		interrupts = <0 114 0>;
+		status = "disabled";
+		clocks = <&clock_gcc GCC_BLSP2_UART2_APPS_CLK>,
+			 <&clock_gcc GCC_BLSP2_AHB_CLK>;
+		clock-names = "core", "iface";
+	};
+
+	slim_aud: slim@151c0000 {
+		cell-index = <1>;
+		compatible = "qcom,slim-ngd";
+		reg = <0x151c0000 0x2c000>,
+			<0x15184000 0x2a000>;
+		reg-names = "slimbus_physical", "slimbus_bam_physical";
+		interrupts = <0 163 0>, <0 164 0>;
+		interrupt-names = "slimbus_irq", "slimbus_bam_irq";
+		qcom,apps-ch-pipes = <0x7e0000>;
+		qcom,ea-pc = <0x260>;
+		status = "disabled";
+	};
+
+	slim_qca: slim@15240000 {
+		cell-index = <3>;
+		compatible = "qcom,slim-ngd";
+		reg = <0x15240000 0x2c000>,
+			<0x15204000 0x20000>;
+		reg-names = "slimbus_physical", "slimbus_bam_physical";
+		interrupts = <0 291 0>, <0 292 0>;
+		interrupt-names = "slimbus_irq", "slimbus_bam_irq";
+		qcom,apps-ch-pipes = <0x1800>;
+
+		/* Slimbus Slave DT for WCN3990 */
+		btfmslim_codec: wcn3990 {
+			compatible = "qcom,btfmslim_slave";
+			elemental-addr = [00 01 20 02 17 02];
+			qcom,btfm-slim-ifd = "btfmslim_slave_ifd";
+			qcom,btfm-slim-ifd-elemental-addr = [00 00 20 02 17 02];
+		};
+	};
+
+	timer@17920000 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+		compatible = "arm,armv7-timer-mem";
+		reg = <0x17920000 0x1000>;
+		clock-frequency = <19200000>;
+
+		frame@17921000 {
+			frame-number = <0>;
+			interrupts = <0 8 0x4>,
+				     <0 7 0x4>;
+			reg = <0x17921000 0x1000>,
+			      <0x17922000 0x1000>;
+		};
+
+		frame@17923000 {
+			frame-number = <1>;
+			interrupts = <0 9 0x4>;
+			reg = <0x17923000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17924000 {
+			frame-number = <2>;
+			interrupts = <0 10 0x4>;
+			reg = <0x17924000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17925000 {
+			frame-number = <3>;
+			interrupts = <0 11 0x4>;
+			reg = <0x17925000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17926000 {
+			frame-number = <4>;
+			interrupts = <0 12 0x4>;
+			reg = <0x17926000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17927000 {
+			frame-number = <5>;
+			interrupts = <0 13 0x4>;
+			reg = <0x17927000 0x1000>;
+			status = "disabled";
+		};
+
+		frame@17928000 {
+			frame-number = <6>;
+			interrupts = <0 14 0x4>;
+			reg = <0x17928000 0x1000>;
+			status = "disabled";
+		};
+	};
+
+	arm64-cpu-erp {
+		compatible = "arm,arm64-cpu-erp";
+		interrupts = <0 43 4>,
+			     <0 44 4>,
+			     <0 41 4>,
+			     <0 42 4>;
+
+		interrupt-names = "pri-dbe-irq",
+				  "sec-dbe-irq",
+				  "pri-ext-irq",
+				  "sec-ext-irq";
+
+		poll-delay-ms = <5000>;
+	};
+
+	clock_rpmcc: qcom,rpmcc {
+		compatible = "qcom,rpmcc-sdm660", "qcom,rpmcc";
+		#clock-cells = <1>;
+	};
+
+	clock_gcc: clock-controller@100000 {
+		compatible = "qcom,gcc-sdm660", "syscon";
+		reg = <0x100000 0x94000>;
+		vdd_dig-supply = <&pm660l_s3_level>;
+		vdd_dig_ao-supply = <&pm660l_s3_level_ao>;
+		#clock-cells = <1>;
+		#reset-cells = <1>;
+	};
+
+	clock_mmss: clock-controller@c8c0000 {
+		compatible = "qcom,mmcc-sdm660";
+		reg = <0xc8c0000 0x40000>;
+		vdd_mx_mmss-supply = <&pm660l_s5_level>;
+		vdd_dig_mmss-supply = <&pm660l_s3_level>;
+		vdda-supply = <&pm660_l10>;
+		#clock-cells = <1>;
+		#reset-cells = <1>;
+	};
+
+	clock_gpu: clock-controller@5065000 {
+		compatible = "qcom,gpu-sdm660";
+		reg = <0x5065000 0x10000>;
+		#clock-cells = <1>;
+		#reset-cells = <1>;
+	};
+
+	clock_gfx: gfx@5065000 {
+		compatible = "qcom,gpucc-sdm660";
+		reg = <0x5065000 0x10000>;
+		vdd_dig_gfx-supply = <&pm660l_s3_level>;
+		vdd_mx_gfx-supply = <&pm660l_s5_level>;
+		vdd_gfx-supply = <&gfx_vreg_corner>;
+		qcom,gfxfreq-corner =
+			< 0         0>,
+			< 160000000 1>,  /* MinSVS */
+			< 266000000 2>,  /* LowSVS */
+			< 370000000 3>,  /* SVS    */
+			< 465000000 4>,  /* SVS_L1 */
+			< 588000000 5>,  /* NOM    */
+			< 647000000 6>,  /* NOM_L1 */
+			< 700000000 7>,  /* TURBO */
+			< 750000000 7>;  /* TURBO  */
+		#clock-cells = <1>;
+		#reset-cells = <1>;
+	};
+
+	cpu_debug: syscon@1791101c {
+		compatible = "syscon";
+		reg = <0x1791101c 0x4>;
+	};
+
+	gpu_debug: syscon@05065120 {
+		compatible = "syscon";
+		reg = <0x05065120 0x4>;
+	};
+
+	mmss_debug: syscon@c8c0900 {
+		compatible = "syscon";
+		reg = <0xc8c0900 0x4>;
+	};
+
+	clock_debug: qcom,cc-debug@62000 {
+		compatible = "qcom,gcc-debug-sdm660";
+		reg = <0x62000 0x4>;
+		reg-names = "dbg_offset";
+		clocks = <&clock_rpmcc  RPM_XO_CLK_SRC>;
+		clock-names = "xo_clk_src";
+		qcom,cc-count = <4>;
+		qcom,gcc = <&clock_gcc>;
+		qcom,cpu = <&cpu_debug>;
+		qcom,mmss = <&mmss_debug>;
+		qcom,gpu = <&gpu_debug>;
+		#clock-cells = <1>;
+	};
+
+	cpubw: qcom,cpubw {
+		compatible = "qcom,devbw";
+		governor = "performance";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		qcom,bw-tbl =
+			<  381  /*  100 MHz */ >,
+			<  572  /*  150 MHz */ >,
+			<  762  /*  200 MHz */ >,
+			<  1144 /*  300 MHz */ >,
+			<  1571 /*  412 MHz */ >,
+			<  2086 /*  547 MHz */ >,
+			<  2597 /*  681 MHz */ >,
+			<  2929 /*  768 MHz */ >,
+			<  3879 /* 1017 MHz */ >,
+			<  4943 /* 1296 MHz */ >,
+			<  5163 /* 1353 MHz */ >,
+			<  5931 /* 1555 MHz */ >,
+			<  6881 /* 1804 MHz */ >;
+	};
+
+	bwmon: qcom,cpu-bwmon {
+		compatible = "qcom,bimc-bwmon4";
+		reg = <0x01008000 0x300>, <0x01001000 0x200>;
+		reg-names = "base", "global_base";
+		interrupts = <0 183 4>;
+		qcom,mport = <0>;
+		qcom,hw-timer-hz = <19200000>;
+		qcom,target-dev = <&cpubw>;
+	};
+
+	mincpubw: qcom,mincpubw {
+		compatible = "qcom,devbw";
+		governor = "powersave";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		qcom,bw-tbl =
+			<  381  /*  100 MHz */ >,
+			<  572  /*  150 MHz */ >,
+			<  762  /*  200 MHz */ >,
+			<  1144 /*  300 MHz */ >,
+			<  1571 /*  412 MHz */ >,
+			<  2086 /*  547 MHz */ >,
+			<  2597 /*  681 MHz */ >,
+			<  2929 /*  768 MHz */ >,
+			<  3879 /* 1017 MHz */ >,
+			<  4943 /* 1296 MHz */ >,
+			<  5163 /* 1353 MHz */ >,
+			<  5931 /* 1555 MHz */ >,
+			<  6881 /* 1804 MHz */ >;
+	};
+
+	memlat_cpu0: qcom,memlat-cpu0 {
+		compatible = "qcom,devbw";
+		governor = "powersave";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		qcom,bw-tbl =
+			<  381  /*  100 MHz */ >,
+			<  572  /*  150 MHz */ >,
+			<  762  /*  200 MHz */ >,
+			<  1144 /*  300 MHz */ >,
+			<  1571 /*  412 MHz */ >,
+			<  2086 /*  547 MHz */ >,
+			<  2597 /*  681 MHz */ >,
+			<  2929 /*  768 MHz */ >,
+			<  3879 /* 1017 MHz */ >,
+			<  4943 /* 1296 MHz */ >,
+			<  5163 /* 1353 MHz */ >,
+			<  5931 /* 1555 MHz */ >,
+			<  6881 /* 1804 MHz */ >;
+	};
+
+	memlat_cpu4: qcom,memlat-cpu4 {
+		compatible = "qcom,devbw";
+		governor = "powersave";
+		qcom,src-dst-ports = <1 512>;
+		qcom,active-only;
+		qcom,bw-tbl =
+			<  381  /*  100 MHz */ >,
+			<  572  /*  150 MHz */ >,
+			<  762  /*  200 MHz */ >,
+			<  1144 /*  300 MHz */ >,
+			<  1571 /*  412 MHz */ >,
+			<  2086 /*  547 MHz */ >,
+			<  2597 /*  681 MHz */ >,
+			<  2929 /*  768 MHz */ >,
+			<  3879 /* 1017 MHz */ >,
+			<  4943 /* 1296 MHz */ >,
+			<  5163 /* 1353 MHz */ >,
+			<  5931 /* 1555 MHz */ >,
+			<  6881 /* 1804 MHz */ >;
+	};
+
+	devfreq_memlat_0: qcom,arm-memlat-mon-0 {
+		compatible = "qcom,arm-memlat-mon";
+		qcom,cpulist = <&CPU0 &CPU1 &CPU2 &CPU3>;
+		qcom,target-dev = <&memlat_cpu0>;
+		qcom,core-dev-table =
+			< 902400 762 >,
+			< 1401600 2086 >,
+			< 1881600 3879 >;
+	};
+
+	devfreq_memlat_4: qcom,arm-memlat-mon-4 {
+		compatible = "qcom,arm-memlat-mon";
+		qcom,cpulist = <&CPU4 &CPU5 &CPU6 &CPU7>;
+		qcom,target-dev = <&memlat_cpu4>;
+		qcom,core-dev-table =
+			< 1113600 762 >,
+			< 1401600 3879 >,
+			< 2150400 5931 >,
+			< 2457600 6881 >;
+	};
+
+	devfreq_cpufreq: devfreq-cpufreq {
+		mincpubw-cpufreq {
+			target-dev = <&mincpubw>;
+			cpu-to-dev-map-0 =
+				< 633600 762 >,
+				< 1401600 1571 >,
+				< 1881600 2929 >;
+			cpu-to-dev-map-4 =
+				< 1113600 762 >,
+				< 1401600 2086 >,
+				< 1747200 2929 >,
+				< 2150400 3879 >,
+				< 2457600 6881 >;
+		};
+	};
+
+	clock_cpu: qcom,clk-cpu-660@179c0000 {
+		compatible = "qcom,clk-cpu-osm";
+		reg = <0x179c0000 0x4000>, <0x17916000 0x1000>,
+		      <0x17816000 0x1000>, <0x179d1000 0x1000>,
+		      <0x00784130 0x8>, <0x00784130 0x8>,
+		      <0x17914800 0x800>;
+		reg-names = "osm", "pwrcl_pll", "perfcl_pll",
+			    "apcs_common", "pwrcl_efuse",
+			    "perfcl_efuse", "pwrcl_acd";
+
+		qcom,acdtd-val = <0x0000a111 0x0000a111>;
+		qcom,acdcr-val = <0x002c5ffd 0x002c5ffd>;
+		qcom,acdsscr-val = <0x00000901 0x00000901>;
+		qcom,acdextint0-val = <0x2cf9ae8 0x2cf9ae8>;
+		qcom,acdextint1-val = <0x2cf9afe 0x2cf9afe>;
+		qcom,acdautoxfer-val = <0x00000015 0x00000015>;
+
+		vdd-pwrcl-supply = <&apc0_pwrcl_vreg>;
+		vdd-perfcl-supply = <&apc1_perfcl_vreg>;
+
+		interrupts = <GIC_SPI 35 IRQ_TYPE_EDGE_RISING>,
+			     <GIC_SPI 36 IRQ_TYPE_EDGE_RISING>;
+		interrupt-names = "pwrcl-irq", "perfcl-irq";
+
+		qcom,pwrcl-speedbin0-v0 =
+			<   300000000 0x0004000f 0x01200020 0x1 1 >,
+			<   633600000 0x05040021 0x03200020 0x1 2 >,
+			<   902400000 0x0404002f 0x04260026 0x1 3 >,
+			<  1113600000 0x0404003a 0x052e002e 0x2 4 >,
+			<  1401600000 0x04040049 0x073a003a 0x2 5 >,
+			<  1536000000 0x04040050 0x08400040 0x2 6 >,
+			<  1747200000 0x0404005b 0x09480048 0x2 7 >,
+			<  1843200000 0x04040060 0x094c004c 0x3 8 >;
+
+		qcom,pwrcl-speedbin1-v0 =
+			<   300000000 0x0004000f 0x01200020 0x1 1 >,
+			<   633600000 0x05040021 0x03200020 0x1 2 >,
+			<   902400000 0x0404002f 0x04260026 0x1 3 >,
+			<  1113600000 0x0404003a 0x052e002e 0x2 4 >,
+			<  1401600000 0x04040049 0x073a003a 0x2 5 >,
+			<  1536000000 0x04040050 0x08400040 0x2 6 >,
+			<  1747200000 0x0404005b 0x09480048 0x2 7 >,
+			<  1843200000 0x04040060 0x094c004c 0x3 8 >;
+
+		qcom,pwrcl-speedbin3-v0 =
+			<   300000000 0x0004000f 0x01200020 0x1 1 >,
+			<   633600000 0x05040021 0x03200020 0x1 2 >,
+			<   902400000 0x0404002f 0x04260026 0x1 3 >,
+			<  1113600000 0x0404003a 0x052e002e 0x2 4 >,
+			<  1401600000 0x04040049 0x073a003a 0x2 5 >,
+			<  1536000000 0x04040050 0x08400040 0x2 6 >,
+			<  1612800000 0x04040054 0x09430043 0x2 7 >;
+
+		qcom,perfcl-speedbin0-v0 =
+			<   300000000 0x0004000f 0x01200020 0x1 1 >,
+			<  1113600000 0x0404003a 0x052e002e 0x1 2 >,
+			<  1401600000 0x04040049 0x073a003a 0x2 3 >,
+			<  1747200000 0x0404005b 0x09480048 0x2 4 >,
+			<  1958400000 0x04040066 0x0a510051 0x2 5 >,
+			<  2150400000 0x04040070 0x0b590059 0x2 6 >,
+			<  2457600000 0x04040080 0x0c660066 0x3 7 >;
+
+		qcom,perfcl-speedbin1-v0 =
+			<   300000000 0x0004000f 0x01200020 0x1 1 >,
+			<  1113600000 0x0404003a 0x052e002e 0x1 2 >,
+			<  1401600000 0x04040049 0x073a003a 0x2 3 >,
+			<  1747200000 0x0404005b 0x09480048 0x2 4 >,
+			<  1958400000 0x04040066 0x0a510051 0x2 5 >,
+			<  2150400000 0x04040070 0x0b590059 0x2 6 >,
+			<  2208000000 0x04040073 0x0b5c005c 0x3 7 >;
+
+		qcom,perfcl-speedbin3-v0 =
+			<   300000000 0x0004000f 0x01200020 0x1 1 >,
+			<  1113600000 0x0404003a 0x052e002e 0x1 2 >,
+			<  1401600000 0x04040049 0x073a003a 0x2 3 >,
+			<  1747200000 0x0404005b 0x09480048 0x2 4 >,
+			<  1804800000 0x0404005e 0x094b004b 0x2 5 >;
+
+		qcom,up-timer = <1000 1000>;
+		qcom,down-timer = <1000 1000>;
+		qcom,pc-override-index = <0 0>;
+		qcom,set-ret-inactive;
+		qcom,enable-llm-freq-vote;
+		qcom,llm-freq-up-timer = <327675 327675>;
+		qcom,llm-freq-down-timer = <327675 327675>;
+		qcom,enable-llm-volt-vote;
+		qcom,llm-volt-up-timer = <327675 327675>;
+		qcom,llm-volt-down-timer = <327675 327675>;
+		qcom,cc-reads = <10>;
+		qcom,cc-delay = <5>;
+		qcom,cc-factor = <100>;
+		qcom,osm-clk-rate = <200000000>;
+		qcom,xo-clk-rate = <19200000>;
+
+		qcom,l-val-base = <0x17916004 0x17816004>;
+		qcom,apcs-itm-present = <0x179d143c 0x179d143c>;
+		qcom,apcs-pll-user-ctl = <0x1791600c 0x1781600c>;
+		qcom,apcs-cfg-rcgr = <0x17911054 0x17811054>;
+		qcom,apcs-cmd-rcgr = <0x17911050 0x17811050>;
+		qcom,apm-mode-ctl = <0x179d0004 0x179d0010>;
+		qcom,apm-ctrl-status = <0x179d000c 0x179d0018>;
+
+		qcom,apm-threshold-voltage = <872000>;
+		qcom,boost-fsm-en;
+		qcom,safe-fsm-en;
+		qcom,ps-fsm-en;
+		qcom,droop-fsm-en;
+		qcom,wfx-fsm-en;
+		qcom,pc-fsm-en;
+
+		clock-names = "aux_clk", "xo_a";
+		clocks = <&clock_gcc HMSS_GPLL0_CLK_SRC>,
+			<&clock_rpmcc RPM_XO_A_CLK_SRC>;
+
+		#clock-cells = <1>;
+	};
+
+	msm_cpufreq: qcom,msm-cpufreq {
+		compatible = "qcom,msm-cpufreq";
+		clock-names = "cpu0_clk", "cpu4_clk";
+		clocks = <&clock_cpu PWRCL_CLK>,
+			 <&clock_cpu PERFCL_CLK>;
+
+		qcom,governor-per-policy;
+
+		qcom,cpufreq-table-0 =
+			<  633600 >,
+			<  902400 >,
+			< 1113600 >,
+			< 1401600 >,
+			< 1536000 >,
+			< 1612800 >,
+			< 1747200 >,
+			< 1843200 >;
+
+		qcom,cpufreq-table-4 =
+			< 1113600 >,
+			< 1401600 >,
+			< 1747200 >,
+			< 1804800 >,
+			< 1958400 >,
+			< 2150400 >,
+			< 2208000 >,
+			< 2457600 >;
+	};
+
+	sdhc_1: sdhci@c0c4000 {
+		compatible = "qcom,sdhci-msm-v5";
+		reg = <0xc0c4000 0x1000>, <0xc0c5000 0x1000>;
+		reg-names = "hc_mem", "cmdq_mem";
+
+		interrupts = <0 110 0>, <0 112 0>;
+		interrupt-names = "hc_irq", "pwr_irq";
+
+		qcom,bus-width = <8>;
+		qcom,large-address-bus;
+		sdhc-msm-crypto = <&sdcc1_ice>;
+
+		qcom,devfreq,freq-table = <50000000 200000000>;
+
+		qcom,msm-bus,name = "sdhc1";
+		qcom,msm-bus,num-cases = <9>;
+		qcom,msm-bus,num-paths = <2>;
+		qcom,msm-bus,vectors-KBps =
+			/* No vote */
+			<78 512 0 0>, <1 606 0 0>,
+			/* 400 KB/s*/
+			<78 512 1046 1600>,
+			<1 606 1600 1600>,
+			/* 20 MB/s */
+			<78 512 52286 80000>,
+			<1 606 80000 80000>,
+			/* 25 MB/s */
+			<78 512 65360 100000>,
+			<1 606 100000 100000>,
+			/* 50 MB/s */
+			<78 512 130718 200000>,
+			<1 606 133320 133320>,
+			/* 100 MB/s */
+			<78 512 130718 200000>,
+			<1 606 150000 150000>,
+			/* 200 MB/s */
+			<78 512 261438 400000>,
+			<1 606 300000 300000>,
+			/* 400 MB/s */
+			<78 512 261438 400000>,
+			<1 606 300000 300000>,
+			/* Max. bandwidth */
+			<78 512 1338562 4096000>,
+			<1 606 1338562 4096000>;
+		qcom,bus-bw-vectors-bps = <0 400000 20000000 25000000 50000000
+			100000000 200000000 400000000 4294967295>;
+
+		clocks = <&clock_gcc GCC_SDCC1_AHB_CLK>,
+			 <&clock_gcc GCC_SDCC1_APPS_CLK>,
+			 <&clock_gcc GCC_SDCC1_ICE_CORE_CLK>;
+		clock-names = "iface_clk", "core_clk", "ice_core_clk";
+		qcom,ice-clk-rates = <300000000 75000000>;
+
+		status = "disabled";
+	};
+
+	sdhc_2: sdhci@c084000 {
+		compatible = "qcom,sdhci-msm-v5";
+		reg = <0xc084000 0x1000>;
+		reg-names = "hc_mem";
+
+		interrupts = <0 125 0>, <0 221 0>;
+		interrupt-names = "hc_irq", "pwr_irq";
+
+		qcom,bus-width = <4>;
+		qcom,large-address-bus;
+
+		qcom,msm-bus,name = "sdhc2";
+		qcom,msm-bus,num-cases = <8>;
+		qcom,msm-bus,num-paths = <2>;
+		qcom,msm-bus,vectors-KBps =
+			/* No vote */
+			<81 512 0 0>, <1 608 0 0>,
+			/* 400 KB/s*/
+			<81 512 1046 1600>,
+			<1 608 1600 1600>,
+			/* 20 MB/s */
+			<81 512 52286 80000>,
+			<1 608 80000 80000>,
+			/* 25 MB/s */
+			<81 512 65360 100000>,
+			<1 608 100000 100000>,
+			/* 50 MB/s */
+			<81 512 130718 200000>,
+			<1 608 133320 133320>,
+			/* 100 MB/s */
+			<81 512 261438 200000>,
+			<1 608 150000 150000>,
+			/* 200 MB/s */
+			<81 512 261438 400000>,
+			<1 608 300000 300000>,
+			/* Max. bandwidth */
+			<81 512 1338562 4096000>,
+			<1 608 1338562 4096000>;
+		qcom,bus-bw-vectors-bps = <0 400000 20000000 25000000 50000000
+			100000000 200000000 4294967295>;
+
+		qcom,devfreq,freq-table = <50000000 200000000>;
+		clocks = <&clock_gcc GCC_SDCC2_AHB_CLK>,
+			<&clock_gcc GCC_SDCC2_APPS_CLK>;
+		clock-names = "iface_clk", "core_clk";
+
+		status = "disabled";
+	};
+
+	ipa_hw: qcom,ipa@14780000 {
+		compatible = "qcom,ipa";
+		reg = <0x14780000 0x4effc>, <0x14784000 0x26934>;
+		reg-names = "ipa-base", "bam-base";
+		interrupts = <0 333 0>,
+				<0 432 0>;
+		interrupt-names = "ipa-irq", "bam-irq";
+		qcom,ipa-hw-ver = <6>; /* IPA core version = IPAv2.6L */
+		qcom,ipa-hw-mode = <0>; /* IPA hw type = Normal */
+		qcom,wan-rx-ring-size = <192>; /* IPA WAN-rx-ring-size*/
+		qcom,lan-rx-ring-size = <192>; /* IPA LAN-rx-ring-size*/
+		clocks = <&clock_rpmcc RPM_IPA_CLK>,
+			<&clock_rpmcc AGGR2_NOC_SMMU_CLK>;
+		clock-names = "core_clk", "smmu_clk";
+		qcom,arm-smmu;
+		qcom,smmu-disable-htw;
+		qcom,smmu-s1-bypass;
+		qcom,ee = <0>;
+		qcom,use-ipa-tethering-bridge;
+		qcom,modem-cfg-emb-pipe-flt;
+		qcom,ipa-wdi2;
+		qcom,use-dma-zone;
+		qcom,msm-bus,name = "ipa";
+		qcom,msm-bus,num-cases = <4>;
+		qcom,msm-bus,num-paths = <2>;
+		qcom,msm-bus,vectors-KBps =
+		/* No vote */
+		<90 512 0 0>,
+		<1 676 0 0>,
+		/* SVS */
+		<90 512 80000 640000>,
+		<1 676 80000 80000>,
+		/* NOMINAL */
+		<90 512 206000 960000>,
+		<1 676 206000 160000>,
+		/* TURBO */
+		<90 512 206000 960000>,
+		<1 676 206000 160000>;
+		qcom,bus-vector-names = "MIN", "SVS", "PERF", "TURBO";
+		qcom,rx-polling-sleep-ms = <1>; /* Polling sleep interval */
+		qcom,ipa-polling-iteration = <40>; /* Polling Iteration */
+
+		ipa_smmu_ap: ipa_smmu_ap {
+			compatible = "qcom,ipa-smmu-ap-cb";
+			iommus = <&anoc2_smmu 0x19C0>;
+			qcom,iova-mapping = <0x10000000 0x40000000>;
+		};
+
+		ipa_smmu_wlan: ipa_smmu_wlan {
+			status = "disabled";
+			compatible = "qcom,ipa-smmu-wlan-cb";
+			iommus = <&anoc2_smmu 0x19C1>;
+		};
+
+		ipa_smmu_uc: ipa_smmu_uc {
+			compatible = "qcom,ipa-smmu-uc-cb";
+			iommus = <&anoc2_smmu 0x19C2>;
+			qcom,iova-mapping = <0x40000000 0x20000000>;
+		};
+	};
+
+	qcom,rmtfs_sharedmem@85e00000 {
+		compatible = "qcom,sharedmem-uio";
+		reg = <0x85e00000 0x200000>;
+		reg-names = "rmtfs";
+		qcom,client-id = <0x00000001>;
+	};
+
+	qcom,rmnet-ipa {
+		compatible = "qcom,rmnet-ipa";
+		qcom,rmnet-ipa-ssr;
+		qcom,ipa-loaduC;
+		qcom,ipa-advertise-sg-support;
+	};
+
+	qcom,ipc-spinlock@1f40000 {
+		compatible = "qcom,ipc-spinlock-sfpb";
+		reg = <0x1f40000 0x8000>;
+		qcom,num-locks = <8>;
+	};
+
+	qcom,smem@86000000 {
+		compatible = "qcom,smem";
+		reg = <0x86000000 0x200000>,
+			<0x17911008 0x4>,
+			<0x778000 0x7000>,
+			<0x1fd4000 0x8>;
+		reg-names = "smem", "irq-reg-base", "aux-mem1",
+			"smem_targ_info_reg";
+		qcom,mpu-enabled;
+	};
+
+	qcom,msm-cdsp-loader {
+		compatible = "qcom,cdsp-loader";
+		qcom,proc-img-to-load = "cdsp";
+	};
+
+	qcom,msm-adsprpc-mem {
+		compatible = "qcom,msm-adsprpc-mem-region";
+		memory-region = <&adsp_mem>;
+	};
+
+	qcom,msm_fastrpc {
+		compatible = "qcom,msm-fastrpc-adsp";
+		qcom,fastrpc-glink;
+
+		qcom,msm_fastrpc_compute_cb1 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 3>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb2 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 7>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb3 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 8>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb4 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "adsprpc-smd";
+			iommus = <&lpass_q6_smmu 9>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb5 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "cdsprpc-smd";
+			iommus = <&turing_q6_smmu 3>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb6 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "cdsprpc-smd";
+			iommus = <&turing_q6_smmu 4>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb7 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "cdsprpc-smd";
+			iommus = <&turing_q6_smmu 5>;
+			dma-coherent;
+		};
+
+		qcom,msm_fastrpc_compute_cb8 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "cdsprpc-smd";
+			iommus = <&turing_q6_smmu 6>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb9 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "cdsprpc-smd";
+			iommus = <&turing_q6_smmu 7>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb10 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "cdsprpc-smd";
+			iommus = <&turing_q6_smmu 8>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb11 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "cdsprpc-smd";
+			iommus = <&turing_q6_smmu 9>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb12 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "cdsprpc-smd";
+			iommus = <&turing_q6_smmu 10>;
+			dma-coherent;
+		};
+		qcom,msm_fastrpc_compute_cb13 {
+			compatible = "qcom,msm-fastrpc-compute-cb";
+			label = "cdsprpc-smd";
+			iommus = <&turing_q6_smmu 11>;
+			dma-coherent;
+		};
+	};
+
+
+	dcc: dcc@10b3000 {
+		compatible = "qcom,dcc";
+		reg = <0x10b3000 0x1000>,
+		      <0x10b4000 0x2000>;
+		reg-names = "dcc-base", "dcc-ram-base";
+
+		clocks = <&clock_gcc GCC_DCC_AHB_CLK>;
+		clock-names = "dcc_clk";
+	};
+
+	qcom,glink-smem-native-xprt-modem@86000000 {
+		compatible = "qcom,glink-smem-native-xprt";
+		reg = <0x86000000 0x200000>,
+			<0x17911008 0x4>;
+		reg-names = "smem", "irq-reg-base";
+		qcom,irq-mask = <0x8000>;
+		interrupts = <0 452 1>;
+		label = "mpss";
+	};
+
+	qcom,glink-smem-native-xprt-adsp@86000000 {
+		compatible = "qcom,glink-smem-native-xprt";
+		reg = <0x86000000 0x200000>,
+			<0x17911008 0x4>;
+		reg-names = "smem", "irq-reg-base";
+		qcom,irq-mask = <0x200>;
+		interrupts = <0 157 1>;
+		label = "lpass";
+		qcom,qos-config = <&glink_qos_adsp>;
+		qcom,ramp-time = <0xaf>;
+	};
+
+	glink_qos_adsp: qcom,glink-qos-config-adsp {
+		compatible = "qcom,glink-qos-config";
+		qcom,flow-info = <0x3c 0x0>,
+				<0x3c 0x0>,
+				<0x3c 0x0>,
+				<0x3c 0x0>;
+		qcom,mtu-size = <0x800>;
+		qcom,tput-stats-cycle = <0xa>;
+	};
+
+	qcom,glink-smem-native-xprt-cdsp@86000000 {
+		compatible = "qcom,glink-smem-native-xprt";
+		reg = <0x86000000 0x200000>,
+			<0x17911008 0x4>;
+		reg-names = "smem", "irq-reg-base";
+		qcom,irq-mask = <0x20000000>;
+		interrupts = <0 513 1>;
+		label = "cdsp";
+	};
+
+	qcom,glink-smem-native-xprt-rpm@778000 {
+		compatible = "qcom,glink-rpm-native-xprt";
+		reg = <0x778000 0x7000>,
+			<0x17911008 0x4>;
+		reg-names = "msgram", "irq-reg-base";
+		qcom,irq-mask = <0x1>;
+		interrupts = <0 168 1>;
+		label = "rpm";
+	};
+
+	glink_mpss: qcom,glink-ssr-modem {
+		compatible = "qcom,glink_ssr";
+		label = "modem";
+		qcom,edge = "mpss";
+		qcom,notify-edges = <&glink_lpass>, <&glink_rpm>,
+				<&glink_cdsp>;
+		qcom,xprt = "smem";
+	};
+
+	glink_lpass: qcom,glink-ssr-adsp {
+		compatible = "qcom,glink_ssr";
+		label = "adsp";
+		qcom,edge = "lpass";
+		qcom,notify-edges = <&glink_mpss>, <&glink_rpm>,
+				<&glink_cdsp>;
+		qcom,xprt = "smem";
+	};
+
+	glink_rpm: qcom,glink-ssr-rpm {
+		compatible = "qcom,glink_ssr";
+		label = "rpm";
+		qcom,edge = "rpm";
+		qcom,notify-edges = <&glink_lpass>, <&glink_mpss>,
+				<&glink_cdsp>;
+		qcom,xprt = "smem";
+	};
+
+	glink_cdsp: qcom,glink-ssr-cdsp {
+		compatible = "qcom,glink_ssr";
+		label = "cdsp";
+		qcom,edge = "cdsp";
+		qcom,notify-edges = <&glink_lpass>, <&glink_mpss>,
+				<&glink_rpm>;
+		qcom,xprt = "smem";
+	};
+
+	glink_spi_xprt_wdsp: qcom,glink-spi-xprt-wdsp {
+		compatible = "qcom,glink-spi-xprt";
+		label = "wdsp";
+		qcom,remote-fifo-config = <&glink_fifo_wdsp>;
+		qcom,qos-config = <&glink_qos_wdsp>;
+		qcom,ramp-time = <0x10>,
+				     <0x20>,
+				     <0x30>,
+				     <0x40>;
+	};
+
+	glink_fifo_wdsp: qcom,glink-fifo-config-wdsp {
+		compatible = "qcom,glink-fifo-config";
+		qcom,out-read-idx-reg = <0x12000>;
+		qcom,out-write-idx-reg = <0x12004>;
+		qcom,in-read-idx-reg = <0x1200c>;
+		qcom,in-write-idx-reg = <0x12010>;
+	};
+
+	glink_qos_wdsp: qcom,glink-qos-config-wdsp {
+		compatible = "qcom,glink-qos-config";
+		qcom,flow-info = <0x80 0x0>,
+				 <0x70 0x1>,
+				 <0x60 0x2>,
+				 <0x50 0x3>;
+		qcom,mtu-size = <0x800>;
+		qcom,tput-stats-cycle = <0xa>;
+	};
+
+	qcom,glink_pkt {
+		compatible = "qcom,glinkpkt";
+
+		qcom,glinkpkt-at-mdm0 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DS";
+			qcom,glinkpkt-dev-name = "at_mdm0";
+		};
+
+		qcom,glinkpkt-loopback_cntl {
+			qcom,glinkpkt-transport = "lloop";
+			qcom,glinkpkt-edge = "local";
+			qcom,glinkpkt-ch-name = "LOCAL_LOOPBACK_CLNT";
+			qcom,glinkpkt-dev-name = "glink_pkt_loopback_ctrl";
+		};
+
+		qcom,glinkpkt-loopback_data {
+			qcom,glinkpkt-transport = "lloop";
+			qcom,glinkpkt-edge = "local";
+			qcom,glinkpkt-ch-name = "glink_pkt_lloop_CLNT";
+			qcom,glinkpkt-dev-name = "glink_pkt_loopback";
+		};
+
+		qcom,glinkpkt-apr-apps2 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "adsp";
+			qcom,glinkpkt-ch-name = "apr_apps2";
+			qcom,glinkpkt-dev-name = "apr_apps2";
+		};
+
+		qcom,glinkpkt-data40-cntl {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DATA40_CNTL";
+			qcom,glinkpkt-dev-name = "smdcntl8";
+		};
+
+		qcom,glinkpkt-data1 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DATA1";
+			qcom,glinkpkt-dev-name = "smd7";
+		};
+
+		qcom,glinkpkt-data4 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DATA4";
+			qcom,glinkpkt-dev-name = "smd8";
+		};
+
+		qcom,glinkpkt-data11 {
+			qcom,glinkpkt-transport = "smem";
+			qcom,glinkpkt-edge = "mpss";
+			qcom,glinkpkt-ch-name = "DATA11";
+			qcom,glinkpkt-dev-name = "smd11";
+		};
+	};
+
+	rpm_bus: qcom,rpm-smd {
+		compatible = "qcom,rpm-glink";
+		qcom,glink-edge = "rpm";
+		rpm-channel-name = "rpm_requests";
+	};
+
+	qcom,ipc_router {
+		compatible = "qcom,ipc_router";
+		qcom,node-id = <1>;
+	};
+
+	qcom,ipc_router_modem_xprt {
+		compatible = "qcom,ipc_router_glink_xprt";
+		qcom,ch-name = "IPCRTR";
+		qcom,xprt-remote = "mpss";
+		qcom,glink-xprt = "smem";
+		qcom,xprt-linkid = <1>;
+		qcom,xprt-version = <1>;
+		qcom,fragmented-data;
+	};
+
+	qcom,ipc_router_q6_xprt {
+		compatible = "qcom,ipc_router_glink_xprt";
+		qcom,ch-name = "IPCRTR";
+		qcom,xprt-remote = "lpass";
+		qcom,glink-xprt = "smem";
+		qcom,xprt-linkid = <1>;
+		qcom,xprt-version = <1>;
+		qcom,fragmented-data;
+	};
+
+	qcom,ipc_router_cdsp_xprt {
+		compatible = "qcom,ipc_router_glink_xprt";
+		qcom,ch-name = "IPCRTR";
+		qcom,xprt-remote = "cdsp";
+		qcom,glink-xprt = "smem";
+		qcom,xprt-linkid = <1>;
+		qcom,xprt-version = <1>;
+		qcom,fragmented-data;
+	};
+
+	qcom,venus@cce0000 {
+		compatible = "qcom,pil-tz-generic";
+		reg = <0xcce0000 0x4000>;
+
+		vdd-supply = <&gdsc_venus>;
+		qcom,proxy-reg-names = "vdd";
+
+		clocks = <&clock_mmss MMSS_VIDEO_CORE_CLK>,
+			<&clock_mmss MMSS_MNOC_AHB_CLK>,
+			<&clock_mmss MMSS_VIDEO_AHB_CLK>,
+			<&clock_rpmcc MMSSNOC_AXI_CLK>,
+			<&clock_mmss MMSS_VIDEO_AXI_CLK>;
+		clock-names = "core_clk", "mnoc_ahb_clk", "iface_clk",
+			"noc_axi_clk", "bus_clk";
+		qcom,proxy-clock-names = "core_clk", "mnoc_ahb_clk",
+			"iface_clk", "noc_axi_clk", "bus_clk";
+
+		qcom,msm-bus,name = "pil-venus";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<63 512 0 0>,
+				<63 512 0 304000>;
+
+		qcom,pas-id = <9>;
+		qcom,proxy-timeout-ms = <100>;
+		qcom,firmware-name = "venus";
+		memory-region = <&venus_fw_mem>;
+		status = "ok";
+	};
+
+	qcom,icnss@18800000 {
+		compatible = "qcom,icnss";
+		reg = <0x18800000 0x800000>,
+		      <0xa0000000 0x10000000>,
+		      <0xb0000000 0x10000>;
+		reg-names = "membase", "smmu_iova_base", "smmu_iova_ipa";
+		iommus = <&anoc2_smmu 0x1a00>,
+			 <&anoc2_smmu 0x1a01>;
+		clocks = <&clock_rpmcc RPM_RF_CLK1_PIN>;
+		clock-names = "cxo_ref_clk_pin";
+		interrupts = <0 413 0>,   /* CE0 */
+			     <0 414 0>,   /* CE1 */
+			     <0 415 0>,   /* CE2 */
+			     <0 416 0>,   /* CE3 */
+			     <0 417 0>,   /* CE4 */
+			     <0 418 0>,   /* CE5 */
+			     <0 420 0>,   /* CE6 */
+			     <0 421 0>,   /* CE7 */
+			     <0 422 0>,   /* CE8 */
+			     <0 423 0>,   /* CE9 */
+			     <0 424 0>,   /* CE10 */
+			     <0 425 0>;   /* CE11 */
+		vdd-0.8-cx-mx-supply = <&pm660_l5>;
+		vdd-1.8-xo-supply = <&pm660_l9_pin_ctrl>;
+		vdd-1.3-rfa-supply = <&pm660_l6_pin_ctrl>;
+		vdd-3.3-ch0-supply = <&pm660_l19_pin_ctrl>;
+		qcom,vdd-0.8-cx-mx-config = <525000 950000>;
+		qcom,vdd-1.8-xo-config = <1750000 1900000>;
+		qcom,vdd-1.3-rfa-config = <1200000 1370000>;
+		qcom,vdd-3.3-ch0-config = <3200000 3400000>;
+		qcom,wlan-msa-memory = <0x100000>;
+		qcom,wlan-msa-fixed-region = <&wlan_msa_mem>;
+		qcom,smmu-s1-bypass;
+	};
+
+	qcom,lpass@15700000 {
+		compatible = "qcom,pil-tz-generic";
+		reg = <0x15700000 0x00100>;
+		interrupts = <0 162 1>;
+
+		vdd_cx-supply = <&pm660l_l9_level>;
+		qcom,proxy-reg-names = "vdd_cx";
+		qcom,vdd_cx-uV-uA = <RPM_SMD_REGULATOR_LEVEL_TURBO 100000>;
+
+		clocks = <&clock_rpmcc CXO_PIL_LPASS_CLK>;
+		clock-names = "xo";
+		qcom,proxy-clock-names = "xo";
+
+		qcom,pas-id = <1>;
+		qcom,proxy-timeout-ms = <10000>;
+		qcom,smem-id = <423>;
+		qcom,sysmon-id = <1>;
+		qcom,ssctl-instance-id = <0x14>;
+		qcom,firmware-name = "adsp";
+		memory-region = <&adsp_fw_mem>;
+
+		/* GPIO inputs from lpass */
+		qcom,gpio-err-fatal = <&smp2pgpio_ssr_smp2p_2_in 0 0>;
+		qcom,gpio-proxy-unvote = <&smp2pgpio_ssr_smp2p_2_in 2 0>;
+		qcom,gpio-err-ready = <&smp2pgpio_ssr_smp2p_2_in 1 0>;
+		qcom,gpio-stop-ack = <&smp2pgpio_ssr_smp2p_2_in 3 0>;
+
+		/* GPIO output to lpass */
+		qcom,gpio-force-stop = <&smp2pgpio_ssr_smp2p_2_out 0 0>;
+		status = "ok";
+	};
+
+	qcom,turing@1a300000 {
+		compatible = "qcom,pil-tz-generic";
+		reg = <0x1a300000 0x00100>;
+		interrupts = <0 518 1>;
+
+		vdd_cx-supply = <&pm660l_s3_level>;
+		qcom,proxy-reg-names = "vdd_cx";
+		qcom,vdd_cx-uV-uA = <RPM_SMD_REGULATOR_LEVEL_TURBO 100000>;
+
+		clocks = <&clock_rpmcc CXO_PIL_CDSP_CLK>;
+		clock-names = "xo";
+		qcom,proxy-clock-names = "xo";
+
+		qcom,pas-id = <18>;
+		qcom,proxy-timeout-ms = <10000>;
+		qcom,smem-id = <601>;
+		qcom,sysmon-id = <7>;
+		qcom,ssctl-instance-id = <0x17>;
+		qcom,firmware-name = "cdsp";
+		memory-region = <&cdsp_fw_mem>;
+
+		/* GPIO inputs from turing */
+		qcom,gpio-err-fatal = <&smp2pgpio_ssr_smp2p_5_in 0 0>;
+		qcom,gpio-proxy-unvote = <&smp2pgpio_ssr_smp2p_5_in 2 0>;
+		qcom,gpio-err-ready = <&smp2pgpio_ssr_smp2p_5_in 1 0>;
+		qcom,gpio-stop-ack = <&smp2pgpio_ssr_smp2p_5_in 3 0>;
+
+		/* GPIO output to turing*/
+		qcom,gpio-force-stop = <&smp2pgpio_ssr_smp2p_5_out 0 0>;
+		status = "ok";
+	};
+
+	pil_modem: qcom,mss@4080000 {
+		compatible = "qcom,pil-q6v55-mss";
+		reg = <0x4080000 0x100>,
+		      <0x1f63000 0x008>,
+		      <0x1f65000 0x008>,
+		      <0x1f64000 0x008>,
+		      <0x4180000 0x040>,
+		      <0x00179000 0x004>,
+		      <0x01fe5048 0x004>;
+		reg-names = "qdsp6_base", "halt_q6", "halt_modem",
+			    "halt_nc", "rmb_base", "restart_reg",
+			    "cxip_lm_vote_clear";
+
+		clocks = <&clock_rpmcc RPM_XO_CLK_SRC>,
+			 <&clock_gcc GCC_MSS_CFG_AHB_CLK>,
+			 <&clock_gcc GCC_BIMC_MSS_Q6_AXI_CLK>,
+			 <&clock_gcc GCC_BOOT_ROM_AHB_CLK>,
+			 <&clock_gcc GPLL0_OUT_MSSCC>,
+			 <&clock_gcc GCC_MSS_SNOC_AXI_CLK>,
+			 <&clock_gcc GCC_MSS_MNOC_BIMC_AXI_CLK>,
+			 <&clock_rpmcc RPM_QDSS_CLK>;
+		clock-names = "xo", "iface_clk", "bus_clk",
+			      "mem_clk", "gpll0_mss_clk", "snoc_axi_clk",
+			      "mnoc_axi_clk", "qdss_clk";
+		qcom,proxy-clock-names = "xo", "qdss_clk";
+		qcom,active-clock-names = "iface_clk", "bus_clk", "mem_clk",
+					 "gpll0_mss_clk", "snoc_axi_clk",
+					 "mnoc_axi_clk";
+
+		interrupts = <0 448 1>;
+		vdd_cx-supply = <&pm660l_s3_level>;
+		vdd_cx-voltage = <RPM_SMD_REGULATOR_LEVEL_TURBO>;
+		vdd_mx-supply = <&pm660l_s5_level>;
+		vdd_mx-uV = <RPM_SMD_REGULATOR_LEVEL_TURBO>;
+		qcom,firmware-name = "modem";
+		qcom,pil-self-auth;
+		qcom,sysmon-id = <0>;
+		qcom,minidump-id = <0>;
+		qcom,ssctl-instance-id = <0x12>;
+		qcom,qdsp6v62-1-5;
+		memory-region = <&modem_fw_mem>;
+		qcom,mem-protect-id = <0xF>;
+		qcom,cx-ipeak-vote;
+
+		/* GPIO inputs from mss */
+		qcom,gpio-err-fatal = <&smp2pgpio_ssr_smp2p_1_in 0 0>;
+		qcom,gpio-err-ready = <&smp2pgpio_ssr_smp2p_1_in 1 0>;
+		qcom,gpio-proxy-unvote = <&smp2pgpio_ssr_smp2p_1_in 2 0>;
+		qcom,gpio-stop-ack = <&smp2pgpio_ssr_smp2p_1_in 3 0>;
+		qcom,gpio-shutdown-ack = <&smp2pgpio_ssr_smp2p_1_in 7 0>;
+
+		/* GPIO output to mss */
+		qcom,gpio-force-stop = <&smp2pgpio_ssr_smp2p_1_out 0 0>;
+		status = "ok";
+		qcom,mba-mem@0 {
+			compatible = "qcom,pil-mba-mem";
+			memory-region = <&pil_mba_mem>;
+		};
+	};
+
+	qcom,msm-rtb {
+		compatible = "qcom,msm-rtb";
+		qcom,rtb-size = <0x100000>;
+	};
+
+	qcom,mpm2-sleep-counter@10a3000 {
+		compatible = "qcom,mpm2-sleep-counter";
+		reg = <0x10a3000 0x1000>;
+		clock-frequency = <32768>;
+	};
+
+	qcom,msm-imem@146bf000 {
+		compatible = "qcom,msm-imem";
+		reg = <0x146bf000 0x1000>;
+		ranges = <0x0 0x146bf000 0x1000>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		mem_dump_table@10 {
+			compatible = "qcom,msm-imem-mem_dump_table";
+			reg = <0x10 8>;
+		};
+
+		dload_type@1c {
+			compatible = "qcom,msm-imem-dload-type";
+			reg = <0x1c 4>;
+		};
+
+		restart_reason@65c {
+			compatible = "qcom,msm-imem-restart_reason";
+			reg = <0x65c 4>;
+		};
+
+		boot_stats@6b0 {
+			compatible = "qcom,msm-imem-boot_stats";
+			reg = <0x6b0 32>;
+		};
+
+		kaslr_offset@6d0 {
+			compatible = "qcom,msm-imem-kaslr_offset";
+			reg = <0x6d0 12>;
+		};
+
+		pil@94c {
+			compatible = "qcom,msm-imem-pil";
+			reg = <0x94c 200>;
+		};
+
+		diag_dload@c8 {
+			compatible = "qcom,msm-imem-diag-dload";
+			reg = <0xc8 200>;
+		};
+
+		ss_mdump@b88 {
+			compatible = "qcom,msm-imem-minidump";
+			reg = <0xb88 28>;
+		};
+	};
+
+	qcom,ghd {
+		compatible = "qcom,gladiator-hang-detect";
+		qcom,threshold-arr = <0x179d141c 0x179d1420
+				      0x179d1424 0x179d1428
+				      0x179d142c 0x179d1430>;
+		qcom,config-reg = <0x179d1434>;
+	};
+
+	qcom,msm-gladiator-v2@17900000 {
+		compatible = "qcom,msm-gladiator-v2";
+		reg = <0x17900000 0xe000>;
+		reg-names = "gladiator_base";
+		interrupts = <0 22 0>;
+		clock-names = "atb_clk";
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>;
+	};
+
+	cpu_pmu: cpu-pmu {
+		compatible = "arm,armv8-pmuv3";
+		qcom,irq-is-percpu;
+		interrupts = <1 6 4>;
+	};
+
+	qcom_seecom: qseecom@86d00000 {
+		compatible = "qcom,qseecom";
+		reg = <0x86d00000 0x2200000>;
+		reg-names = "secapp-region";
+		qcom,hlos-num-ce-hw-instances = <1>;
+		qcom,hlos-ce-hw-instance = <0>;
+		qcom,qsee-ce-hw-instance = <0>;
+		qcom,disk-encrypt-pipe-pair = <2>;
+		qcom,support-fde;
+		qcom,fde-key-size;
+		qcom,no-clock-support;
+		qcom,msm-bus,name = "qseecom-noc";
+		qcom,msm-bus,num-cases = <4>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<55 512 0 0>,
+			<55 512 200000 400000>,
+			<55 512 300000 800000>,
+			<55 512 400000 1000000>;
+		clock-names = "core_clk_src", "core_clk",
+				"iface_clk", "bus_clk";
+		clocks = <&clock_rpmcc QSEECOM_CE1_CLK>,
+			<&clock_rpmcc QSEECOM_CE1_CLK>,
+			<&clock_rpmcc QSEECOM_CE1_CLK>,
+			<&clock_rpmcc QSEECOM_CE1_CLK>;
+		qcom,ce-opp-freq = <171430000>;
+		qcom,qsee-reentrancy-support = <2>;
+	};
+
+	qcom_cedev: qcedev@1de0000{
+		compatible = "qcom,qcedev";
+		reg = <0x1de0000 0x20000>,
+			<0x1dc4000 0x24000>;
+		reg-names = "crypto-base","crypto-bam-base";
+		interrupts = <0 206 0>;
+		qcom,bam-pipe-pair = <1>;
+		qcom,ce-hw-instance = <0>;
+		qcom,ce-device = <0>;
+		qcom,ce-hw-shared;
+		qcom,bam-ee = <0>;
+		qcom,msm-bus,name = "qcedev-noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<55 512 0 0>,
+				<55 512 393600 393600>;
+		clock-names = "core_clk_src", "core_clk",
+				"iface_clk", "bus_clk";
+		clocks = <&clock_rpmcc QCEDEV_CE1_CLK>,
+			 <&clock_rpmcc QCEDEV_CE1_CLK>,
+			 <&clock_rpmcc QCEDEV_CE1_CLK>,
+			 <&clock_rpmcc QCEDEV_CE1_CLK>;
+		qcom,ce-opp-freq = <171430000>;
+	};
+
+	qcom_crypto: qcrypto@1de0000 {
+		compatible = "qcom,qcrypto";
+		reg = <0x1de0000 0x20000>,
+			 <0x1dc4000 0x24000>;
+		reg-names = "crypto-base","crypto-bam-base";
+		interrupts = <0 206 0>;
+		qcom,bam-pipe-pair = <2>;
+		qcom,ce-hw-instance = <0>;
+		qcom,ce-device = <0>;
+		qcom,bam-ee = <0>;
+		qcom,ce-hw-shared;
+		qcom,clk-mgmt-sus-res;
+		qcom,msm-bus,name = "qcrypto-noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<55 512 0 0>,
+			<55 512 393600 393600>;
+		clock-names = "core_clk_src", "core_clk",
+				"iface_clk", "bus_clk";
+		clocks = <&clock_rpmcc QCRYPTO_CE1_CLK>,
+			 <&clock_rpmcc QCRYPTO_CE1_CLK>,
+			 <&clock_rpmcc QCRYPTO_CE1_CLK>,
+			 <&clock_rpmcc QCRYPTO_CE1_CLK>;
+		qcom,ce-opp-freq = <171430000>;
+		qcom,use-sw-aes-cbc-ecb-ctr-algo;
+		qcom,use-sw-aes-xts-algo;
+		qcom,use-sw-aes-ccm-algo;
+		qcom,use-sw-ahash-algo;
+		qcom,use-sw-aead-algo;
+		qcom,use-sw-hmac-algo;
+	};
+
+	qcom_tzlog: tz-log@146bf720 {
+		compatible = "qcom,tz-log";
+		reg = <0x146bf720 0x3000>;
+		qcom,hyplog-enabled;
+		hyplog-address-offset = <0x410>;
+		hyplog-size-offset = <0x414>;
+	};
+
+	qcom_rng: qrng@793000 {
+		compatible = "qcom,msm-rng";
+		reg = <0x793000 0x1000>;
+		qcom,msm-rng-iface-clk;
+		qcom,no-qrng-config;
+		qcom,msm-bus,name = "msm-rng-noc";
+		qcom,msm-bus,num-cases = <2>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+			<1 618 0 0>,    /* No vote */
+			<1 618 0 800>;  /* 100 KHz */
+		clocks = <&clock_gcc GCC_PRNG_AHB_CLK>;
+		clock-names = "iface_clk";
+	};
+
+	qcom,chd_silver {
+		compatible = "qcom,core-hang-detect";
+		label = "silver";
+		qcom,threshold-arr = <0x179880b0 0x179980b0
+				      0x179a80b0 0x179b80b0>;
+		qcom,config-arr = <0x179880b8 0x179980b8
+				   0x179a80b8 0x179b80b8>;
+	};
+
+	qcom,chd_gold {
+		compatible = "qcom,core-hang-detect";
+		label = "gold";
+		qcom,threshold-arr = <0x178880b0 0x178980b0
+				      0x178a80b0 0x178b80b0>;
+		qcom,config-arr = <0x178880b8  0x178980b8
+				   0x178a80b8  0x178b80b8>;
+	};
+
+	ufsphy1: ufsphy@1da7000 {
+		compatible = "qcom,ufs-phy-qmp-v3-660";
+		reg = <0x1da7000 0xdb8>;
+		reg-names = "phy_mem";
+		#phy-cells = <0>;
+		clock-names = "ref_clk_src",
+			"ref_clk",
+			"ref_aux_clk";
+		clocks = <&clock_rpmcc RPM_LN_BB_CLK1>,
+			<&clock_gcc GCC_UFS_CLKREF_CLK>,
+			<&clock_gcc GCC_UFS_PHY_AUX_CLK>;
+		status = "disabled";
+	};
+
+	ufs1: ufshc@1da4000 {
+		compatible = "qcom,ufshc";
+		reg = <0x1da4000 0x3000>;
+		interrupts = <0 265 0>;
+		phys = <&ufsphy1>;
+		phy-names = "ufsphy";
+		ufs-qcom-crypto = <&ufs_ice>;
+
+		clock-names =
+			"core_clk",
+			"bus_aggr_clk",
+			"iface_clk",
+			"core_clk_unipro",
+			"core_clk_ice",
+			"ref_clk",
+			"tx_lane0_sync_clk",
+			"rx_lane0_sync_clk";
+		clocks =
+			<&clock_gcc GCC_UFS_AXI_CLK>,
+			<&clock_gcc GCC_AGGRE2_UFS_AXI_CLK>,
+			<&clock_gcc GCC_UFS_AHB_CLK>,
+			<&clock_gcc GCC_UFS_UNIPRO_CORE_CLK>,
+			<&clock_gcc GCC_UFS_ICE_CORE_CLK>,
+			<&clock_rpmcc RPM_LN_BB_CLK1>,
+			<&clock_gcc GCC_UFS_TX_SYMBOL_0_CLK>,
+			<&clock_gcc GCC_UFS_RX_SYMBOL_0_CLK>;
+		freq-table-hz =
+			<50000000 200000000>,
+			<0 0>,
+			<0 0>,
+			<37500000 150000000>,
+			<75000000 300000000>,
+			<0 0>,
+			<0 0>,
+			<0 0>;
+
+		lanes-per-direction = <1>;
+		spm-level = <5>;
+
+		non-removable;
+		qcom,msm-bus,name = "ufs1";
+		qcom,msm-bus,num-cases = <12>;
+		qcom,msm-bus,num-paths = <2>;
+		qcom,msm-bus,vectors-KBps =
+		<95 512 0 0>, <1 650 0 0>,          /* No vote */
+		<95 512 922 0>, <1 650 1000 0>,     /* PWM G1 */
+		<95 512 1844 0>, <1 650 1000 0>,    /* PWM G2 */
+		<95 512 3688 0>, <1 650 1000 0>,    /* PWM G3 */
+		<95 512 7376 0>, <1 650 1000 0>,    /* PWM G4 */
+		<95 512 127796 0>, <1 650 1000 0>,  /* HS G1 RA */
+		<95 512 255591 0>, <1 650 1000 0>,  /* HS G2 RA */
+		<95 512 2097152 0>, <1 650 102400 0>,  /* HS G3 RA */
+		<95 512 149422 0>, <1 650 1000 0>,  /* HS G1 RB */
+		<95 512 298189 0>, <1 650 1000 0>,  /* HS G2 RB */
+		<95 512 2097152 0>, <1 650 102400 0>,  /* HS G3 RB */
+		<95 512 7643136 0>, <1 650 307200 0>; /* Max. bandwidth */
+		qcom,bus-vector-names = "MIN",
+		"PWM_G1_L1", "PWM_G2_L1", "PWM_G3_L1", "PWM_G4_L1",
+		"HS_RA_G1_L1", "HS_RA_G2_L1", "HS_RA_G3_L1",
+		"HS_RB_G1_L1", "HS_RB_G2_L1", "HS_RB_G3_L1",
+		"MAX";
+
+		resets = <&clock_gcc GCC_UFS_BCR>;
+		reset-names = "core_reset";
+
+		status = "disabled";
+	};
+
+	jtag_fuse: jtagfuse@786040 {
+		compatible = "qcom,jtag-fuse-v4";
+		reg = <0x786040 0x8>;
+		reg-names = "fuse-base";
+	};
+
+	jtag_mm0: jtagmm@7840000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x7840000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU0>;
+	};
+
+	jtag_mm1: jtagmm@7940000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x7940000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU1>;
+	};
+
+	jtag_mm2: jtagmm@7a40000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x7a40000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU2>;
+	};
+
+	jtag_mm3: jtagmm@7b40000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x7b40000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU3>;
+	};
+
+	jtag_mm4: jtagmm@7c40000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x7c40000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU4>;
+	};
+
+	jtag_mm5: jtagmm@7d40000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x7d40000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU5>;
+	};
+
+	jtag_mm6: jtagmm@7e40000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x7e40000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU6>;
+	};
+
+	jtag_mm7: jtagmm@7f40000 {
+		compatible = "qcom,jtagv8-mm";
+		reg = <0x7f40000 0x1000>;
+		reg-names = "etm-base";
+
+		clocks = <&clock_rpmcc RPM_QDSS_CLK>,
+			 <&clock_rpmcc RPM_QDSS_A_CLK>;
+		clock-names = "core_clk", "core_a_clk";
+
+		qcom,coresight-jtagmm-cpu = <&CPU7>;
+	};
+};
+
+#include "sdm660-ion.dtsi"
+#include "sdm660-bus.dtsi"
+#include "msm-pm660.dtsi"
+#include "msm-pm660l.dtsi"
+#include "msm-pm660-rpm-regulator.dtsi"
+#include "msm-pm660l-rpm-regulator.dtsi"
+#include "sdm660-regulator.dtsi"
+#include "msm-gdsc-660.dtsi"
+#include "sdm660-gpu.dtsi"
+#include "sdm660-pm.dtsi"
+
+&gdsc_usb30 {
+	status = "ok";
+};
+
+&gdsc_ufs {
+	status = "ok";
+};
+
+&gdsc_bimc_smmu {
+	clock-names = "bus_clk";
+	clocks = <&clock_mmss MMSS_BIMC_SMMU_AXI_CLK>;
+	proxy-supply = <&gdsc_bimc_smmu>;
+	qcom,proxy-consumer-enable;
+	status = "ok";
+};
+
+&gdsc_hlos1_vote_lpass_adsp {
+	status = "ok";
+};
+
+&gdsc_hlos1_vote_turing_adsp {
+	status = "ok";
+};
+
+&gdsc_hlos2_vote_turing_adsp {
+	status = "ok";
+};
+
+&gdsc_venus {
+	status = "ok";
+};
+
+&gdsc_venus_core0 {
+	qcom,support-hw-trigger;
+	status = "ok";
+};
+
+&gdsc_camss_top {
+	status = "ok";
+};
+
+&gdsc_vfe0 {
+	parent-supply = <&gdsc_camss_top>;
+	status = "ok";
+};
+
+&gdsc_vfe1 {
+	parent-supply = <&gdsc_camss_top>;
+	status = "ok";
+};
+
+&gdsc_cpp {
+	parent-supply = <&gdsc_camss_top>;
+	qcom,support-hw-trigger;
+	status = "ok";
+};
+
+&gdsc_mdss {
+	proxy-supply = <&gdsc_mdss>;
+	qcom,proxy-consumer-enable;
+	status = "ok";
+};
+
+&gdsc_gpu_gx {
+	clock-names = "core_root_clk";
+	clocks = <&clock_gfx GFX3D_CLK_SRC>;
+	qcom,force-enable-root-clk;
+	parent-supply = <&gfx_vreg_corner>;
+	status = "ok";
+};
+
+&gdsc_gpu_cx {
+	status = "ok";
+};
+
+&clock_cpu {
+	lmh_dcvs0: qcom,limits-dcvs@0 {
+		compatible = "qcom,msm-hw-limits";
+		interrupts = <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>;
+	};
+
+	lmh_dcvs1: qcom,limits-dcvs@1 {
+		compatible = "qcom,msm-hw-limits";
+		interrupts = <GIC_SPI 38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+#include "msm-arm-smmu-660.dtsi"
+#include "msm-arm-smmu-impl-defs-660.dtsi"
+#include "sdm660-common.dtsi"
+#include "sdm660-blsp.dtsi"
+#include "msm-rdbg.dtsi"
+#include "sdm660-camera.dtsi"
+#include "sdm660-vidc.dtsi"
+#include "msm-audio.dtsi"
+#include "sdm660-audio.dtsi"
+
+&pm660l_gpios {
+	/* GPIO 7 for VOL_UP */
+	gpio@c600 {
+		status = "okay";
+		qcom,mode = <0>;
+		qcom,pull = <0>;
+		qcom,vin-sel = <0>;
+		qcom,src-sel = <0>;
+		qcom,out-strength = <1>;
+	};
+};
+
+&msm_vidc {
+	qcom,cx-ipeak-data = <&cx_ipeak_lm 4>;
+	qcom,clock-freq-threshold = <518400000>;
+};
+
+&soc {
+	gpio_keys {
+		status = "okay";
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+		pinctrl-names = "tlmm_gpio_key_active","tlmm_gpio_key_suspend";
+		pinctrl-0 = <&gpio_key_active>;
+		pinctrl-1 = <&gpio_key_suspend>;
+
+		camera_focus {
+			label = "camera_focus";
+			gpios = <&tlmm 64 0x1>;
+			linux,input-type = <1>;
+			linux,code = <0x210>;
+			debounce-interval = <15>;
+		};
+
+		camera_snapshot {
+			label = "camera_snapshot";
+			gpios = <&tlmm 113 0x1>;
+			linux,input-type = <1>;
+			linux,code = <0x2fe>;
+			debounce-interval = <15>;
+		};
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&pm660l_gpios 7 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			gpio-key,wakeup;
+			debounce-interval = <15>;
+		};
+	};
+};
+
+&blsp2_uart1_hs {
+	status = "ok";
+};
+
+#include "sdm660-mdss.dtsi"
+#include "sdm660-mdss-pll.dtsi"
diff --git a/arch/arm64/boot/dts/qcom/skeleton64.dtsi b/arch/arm64/boot/dts/qcom/skeleton64.dtsi
new file mode 100644
index 000000000000..1f8ba28132c4
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/skeleton64.dtsi
@@ -0,0 +1,15 @@
+/*
+ * Skeleton device tree in the 64 bits version; the bare minimum
+ * needed to boot; just include and add a compatible value.  The
+ * bootloader will typically populate the memory node.
+ */
+
+/ {
+	#address-cells = <2>;
+	#size-cells = <2>;
+	cpus { };
+	soc { };
+	chosen { };
+	aliases { };
+	memory { device_type = "memory"; reg = <0 0 0 0>; };
+};
diff --git a/arch/arm64/boot/dts/qcom/vplatform-lfv-ion.dtsi b/arch/arm64/boot/dts/qcom/vplatform-lfv-ion.dtsi
new file mode 100644
index 000000000000..1176b54835b1
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/vplatform-lfv-ion.dtsi
@@ -0,0 +1,31 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&soc {
+	qcom,ion {
+		compatible = "qcom,msm-ion";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		system_heap: qcom,ion-heap@25 {
+			reg = <25>;
+			memory-region = <&ion_system>;
+			qcom,ion-heap-type = "CARVEOUT";
+		};
+
+		qcom,ion-heap@28 { /* Audio Heap */
+			reg = <28>;
+			memory-region = <&ion_audio>;
+			qcom,ion-heap-type = "CARVEOUT";
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/vplatform-lfv-msm8996.dts b/arch/arm64/boot/dts/qcom/vplatform-lfv-msm8996.dts
new file mode 100644
index 000000000000..30b36c0ac541
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/vplatform-lfv-msm8996.dts
@@ -0,0 +1,514 @@
+/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "skeleton64.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. MSM 8996";
+	compatible = "qcom,msm8996";
+	qcom,msm-id = <246 0x0>;
+
+	soc: soc { };
+
+	psci {
+		compatible = "arm,psci";
+		method = "smc";
+		cpu_suspend = <0xc4000001>;
+		cpu_off	= <0x84000002>;
+		cpu_on = <0xc4000003>;
+	};
+
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		pmem_shared: pmem_shared_region {
+			reg = <0 0xd0000000 0 0x20000000>;
+			label = "pmem_shared_mem";
+		};
+		ion_system: ion_system_region {
+			reg = <0x1 0x0 0 0x10000000>;
+			label = "ion_system_mem";
+		};
+		qseecom_mem: qseecom_region {
+			compatible = "shared-dma-pool";
+			alloc-ranges = <0 0x00000000 0 0xffffffff>;
+			reusable;
+			alignment = <0 0x400000>;
+			size = <0 0x1400000>;
+		};
+		ion_audio: ion_audio_region {
+			reg = <0 0xc8000000 0 0x00400000>;
+			label = "ion_audio_mem";
+		};
+	};
+};
+
+#include "vplatform-lfv-ion.dtsi"
+
+&soc {
+	#address-cells = <1>;
+	#size-cells = <1>;
+	ranges = <0 0 0 0xffffffff>;
+	compatible = "simple-bus";
+
+	sound-adp-agave {
+		compatible = "qcom,apq8096-asoc-snd-adp-agave";
+		qcom,model = "apq8096-adp-agave-snd-card";
+
+		asoc-platform = <&pcm0>, <&pcm1>, <&pcm2>, <&voip>, <&voice>,
+			<&loopback>, <&compress>, <&hostless>,
+			<&afe>, <&lsm>, <&routing>, <&pcmnoirq>,
+			<&loopback1>;
+		asoc-platform-names = "msm-pcm-dsp.0", "msm-pcm-dsp.1",
+			"msm-pcm-dsp.2", "msm-voip-dsp",
+			"msm-pcm-voice", "msm-pcm-loopback",
+			"msm-compress-dsp", "msm-pcm-hostless",
+			"msm-pcm-afe", "msm-lsm-client",
+			"msm-pcm-routing", "msm-pcm-dsp-noirq",
+			"msm-pcm-loopback.1";
+		asoc-cpu = <&dai_pri_auxpcm>, <&dai_sec_auxpcm>, <&dai_hdmi>,
+			<&dai_mi2s_sec>, <&dai_mi2s>, <&dai_mi2s_quat>,
+			<&afe_pcm_rx>, <&afe_pcm_tx>,
+			<&afe_proxy_rx>, <&afe_proxy_tx>,
+			<&incall_record_rx>, <&incall_record_tx>,
+			<&incall_music_rx>, <&incall_music2_rx>,
+			<&dai_pri_tdm_tx_0>, <&dai_pri_tdm_tx_1>,
+			<&dai_pri_tdm_tx_2>, <&dai_pri_tdm_tx_3>,
+			<&dai_pri_tdm_rx_0>, <&dai_pri_tdm_rx_1>,
+			<&dai_pri_tdm_rx_2>, <&dai_pri_tdm_rx_3>,
+			<&dai_sec_tdm_tx_0>, <&dai_sec_tdm_tx_1>,
+			<&dai_sec_tdm_tx_2>, <&dai_sec_tdm_tx_3>,
+			<&dai_tert_tdm_rx_0>, <&dai_tert_tdm_rx_1>,
+			<&dai_tert_tdm_rx_2>, <&dai_tert_tdm_rx_3>,
+			<&dai_tert_tdm_rx_4>, <&dai_tert_tdm_tx_0>,
+			<&dai_tert_tdm_tx_1>, <&dai_tert_tdm_tx_2>,
+			<&dai_tert_tdm_tx_3>, <&dai_quat_tdm_rx_0>,
+			<&dai_quat_tdm_rx_1>, <&dai_quat_tdm_rx_2>,
+			<&dai_quat_tdm_rx_3>, <&dai_quat_tdm_tx_0>,
+			<&dai_quat_tdm_tx_1>, <&dai_quat_tdm_tx_2>,
+			<&dai_quat_tdm_tx_3>;
+		asoc-cpu-names = "msm-dai-q6-auxpcm.1", "msm-dai-q6-auxpcm.2",
+			"msm-dai-q6-hdmi.8", "msm-dai-q6-mi2s.1",
+			"msm-dai-q6-mi2s.2", "msm-dai-q6-mi2s.3",
+			"msm-dai-q6-dev.224", "msm-dai-q6-dev.225",
+			"msm-dai-q6-dev.241", "msm-dai-q6-dev.240",
+			"msm-dai-q6-dev.32771", "msm-dai-q6-dev.32772",
+			"msm-dai-q6-dev.32773", "msm-dai-q6-dev.32770",
+			"msm-dai-q6-tdm.36865", "msm-dai-q6-tdm.36867",
+			"msm-dai-q6-tdm.36869", "msm-dai-q6-tdm.36871",
+			"msm-dai-q6-tdm.36864", "msm-dai-q6-tdm.36866",
+			"msm-dai-q6-tdm.36868", "msm-dai-q6-tdm.36870",
+			"msm-dai-q6-tdm.36881", "msm-dai-q6-tdm.36883",
+			"msm-dai-q6-tdm.36885", "msm-dai-q6-tdm.36887",
+			"msm-dai-q6-tdm.36896", "msm-dai-q6-tdm.36898",
+			"msm-dai-q6-tdm.36900", "msm-dai-q6-tdm.36902",
+			"msm-dai-q6-tdm.36904", "msm-dai-q6-tdm.36897",
+			"msm-dai-q6-tdm.36899", "msm-dai-q6-tdm.36901",
+			"msm-dai-q6-tdm.36903", "msm-dai-q6-tdm.36912",
+			"msm-dai-q6-tdm.36914", "msm-dai-q6-tdm.36916",
+			"msm-dai-q6-tdm.36918", "msm-dai-q6-tdm.36913",
+			"msm-dai-q6-tdm.36915", "msm-dai-q6-tdm.36917",
+			"msm-dai-q6-tdm.36919";
+		asoc-codec = <&stub_codec>;
+		asoc-codec-names = "msm-stub-codec.1";
+	};
+
+	qcom,msm-audio-ion {
+		compatible = "qcom,msm-audio-ion";
+		qcom,smmu-enabled;
+		qcom,smmu-sid = <1>;
+	};
+
+	pcm0: qcom,msm-pcm {
+		compatible = "qcom,msm-pcm-dsp";
+		qcom,msm-pcm-dsp-id = <0>;
+	};
+
+	pcm1: qcom,msm-pcm-low-latency {
+		compatible = "qcom,msm-pcm-dsp";
+		qcom,msm-pcm-dsp-id = <1>;
+		qcom,msm-pcm-low-latency;
+		qcom,latency-level = "regular";
+	};
+
+	pcm2: qcom,msm-ultra-low-latency {
+		compatible = "qcom,msm-pcm-dsp";
+		qcom,msm-pcm-dsp-id = <2>;
+		qcom,msm-pcm-low-latency;
+		qcom,latency-level = "ultra";
+	};
+
+	routing: qcom,msm-pcm-routing {
+		compatible = "qcom,msm-pcm-routing";
+	};
+
+	compress: qcom,msm-compress-dsp {
+		compatible = "qcom,msm-compress-dsp";
+	};
+
+	pcmnoirq: qcom,msm-pcm-dsp-noirq {
+		compatible = "qcom,msm-pcm-dsp-noirq";
+		qcom,msm-pcm-low-latency;
+		qcom,latency-level = "ultra";
+	};
+
+	voip: qcom,msm-voip-dsp {
+		compatible = "qcom,msm-voip-dsp";
+	};
+
+	voice: qcom,msm-pcm-voice {
+		compatible = "qcom,msm-pcm-voice";
+		qcom,destroy-cvd;
+	};
+
+	stub_codec: qcom,msm-stub-codec {
+		compatible = "qcom,msm-stub-codec";
+	};
+
+	qcom,msm-dai-fe {
+		compatible = "qcom,msm-dai-fe";
+	};
+
+	afe: qcom,msm-pcm-afe {
+		compatible = "qcom,msm-pcm-afe";
+	};
+
+	dai_hdmi: qcom,msm-dai-q6-hdmi {
+		compatible = "qcom,msm-dai-q6-hdmi";
+		qcom,msm-dai-q6-dev-id = <8>;
+	};
+
+	lsm: qcom,msm-lsm-client {
+		compatible = "qcom,msm-lsm-client";
+	};
+
+	loopback: qcom,msm-pcm-loopback {
+		compatible = "qcom,msm-pcm-loopback";
+	};
+
+	loopback1: qcom,msm-pcm-loopback-low-latency {
+		compatible = "qcom,msm-pcm-loopback";
+		qcom,msm-pcm-loopback-low-latency;
+	};
+
+	qcom,msm-dai-q6 {
+		compatible = "qcom,msm-dai-q6";
+
+		afe_pcm_rx: qcom,msm-dai-q6-be-afe-pcm-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <224>;
+		};
+
+		afe_pcm_tx: qcom,msm-dai-q6-be-afe-pcm-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <225>;
+	};
+
+		afe_proxy_rx: com,msm-dai-q6-afe-proxy-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <241>;
+		};
+
+		afe_proxy_tx: qcom,msm-dai-q6-afe-proxy-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <240>;
+		};
+
+		incall_record_rx: qcom,msm-dai-q6-incall-record-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <32771>;
+		};
+
+		incall_record_tx: qcom,msm-dai-q6-incall-record-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <32772>;
+		};
+
+		incall_music_rx: qcom,msm-dai-q6-incall-music-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <32773>;
+		};
+
+		incall_music2_rx: qcom,msm-dai-q6-incall-music-2-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <32770>;
+		};
+	};
+
+	dai_pri_auxpcm: qcom,msm-pri-auxpcm {
+		compatible = "qcom,msm-auxpcm-dev";
+		qcom,msm-cpudai-auxpcm-mode = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-sync = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-frame = <5>, <4>;
+		qcom,msm-cpudai-auxpcm-quant = <2>, <2>;
+		qcom,msm-cpudai-auxpcm-num-slots = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-slot-mapping = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-data = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-pcm-clk-rate = <2048000>, <2048000>;
+		qcom,msm-auxpcm-interface = "primary";
+		qcom,msm-cpudai-afe-clk-ver = <2>;
+	};
+
+	dai_sec_auxpcm: qcom,msm-sec-auxpcm {
+		compatible = "qcom,msm-auxpcm-dev";
+		qcom,msm-cpudai-auxpcm-mode = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-sync = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-frame = <5>, <4>;
+		qcom,msm-cpudai-auxpcm-quant = <2>, <2>;
+		qcom,msm-cpudai-auxpcm-num-slots = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-slot-mapping = <1>, <1>;
+		qcom,msm-cpudai-auxpcm-data = <0>, <0>;
+		qcom,msm-cpudai-auxpcm-pcm-clk-rate = <2048000>, <2048000>;
+		qcom,msm-auxpcm-interface = "secondary";
+		qcom,msm-cpudai-afe-clk-ver = <2>;
+	};
+
+	qcom,msm-dai-mi2s {
+		compatible = "qcom,msm-dai-mi2s";
+		dai_mi2s_sec: qcom,msm-dai-q6-mi2s-sec {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <1>;
+			qcom,msm-mi2s-rx-lines = <2>;
+			qcom,msm-mi2s-tx-lines = <1>;
+		};
+
+		dai_mi2s: qcom,msm-dai-q6-mi2s-tert {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <2>;
+			qcom,msm-mi2s-rx-lines = <2>;
+			qcom,msm-mi2s-tx-lines = <1>;
+		};
+
+		dai_mi2s_quat: qcom,msm-dai-q6-mi2s-quat {
+			compatible = "qcom,msm-dai-q6-mi2s";
+			qcom,msm-dai-q6-mi2s-dev-id = <3>;
+			qcom,msm-mi2s-rx-lines = <1>;
+			qcom,msm-mi2s-tx-lines = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-sec-tx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37137>;
+		qcom,msm-cpudai-tdm-group-num-ports = <4>;
+		qcom,msm-cpudai-tdm-group-port-id = <36881 36883 36885 36887>;
+		qcom,msm-cpudai-tdm-clk-rate = <12288000>;
+		qcom,msm-cpudai-tdm-clk-internal = <0>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <0>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <0>;
+		qcom,msm-cpudai-tdm-data-delay = <0>;
+		dai_sec_tdm_tx_0: qcom,msm-dai-q6-tdm-sec-tx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36881>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_sec_tdm_tx_1: qcom,msm-dai-q6-tdm-sec-tx-1 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36883>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_sec_tdm_tx_2: qcom,msm-dai-q6-tdm-sec-tx-2 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36885>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_sec_tdm_tx_3: qcom,msm-dai-q6-tdm-sec-tx-3 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36887>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-tert-rx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37152>;
+		qcom,msm-cpudai-tdm-group-num-ports = <5>;
+		qcom,msm-cpudai-tdm-group-port-id = <36896 36898 36900
+							36902 36904>;
+		qcom,msm-cpudai-tdm-clk-rate = <12288000>;
+		qcom,msm-cpudai-tdm-clk-internal = <0>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <0>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <0>;
+		qcom,msm-cpudai-tdm-data-delay = <0>;
+		dai_tert_tdm_rx_0: qcom,msm-dai-q6-tdm-tert-rx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36896>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_tert_tdm_rx_1: qcom,msm-dai-q6-tdm-tert-rx-1 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36898>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_tert_tdm_rx_2: qcom,msm-dai-q6-tdm-tert-rx-2 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36900>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_tert_tdm_rx_3: qcom,msm-dai-q6-tdm-tert-rx-3 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36902>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_tert_tdm_rx_4: qcom,msm-dai-q6-tdm-tert-rx-4 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36904>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-tert-tx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37153>;
+		qcom,msm-cpudai-tdm-group-num-ports = <4>;
+		qcom,msm-cpudai-tdm-group-port-id = <36897 36899 36901 36903>;
+		qcom,msm-cpudai-tdm-clk-rate = <12288000>;
+		qcom,msm-cpudai-tdm-clk-internal = <0>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <0>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <0>;
+		qcom,msm-cpudai-tdm-data-delay = <0>;
+		dai_tert_tdm_tx_0: qcom,msm-dai-q6-tdm-tert-tx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36897>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_tert_tdm_tx_1: qcom,msm-dai-q6-tdm-tert-tx-1 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36899>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_tert_tdm_tx_2: qcom,msm-dai-q6-tdm-tert-tx-2 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36901>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_tert_tdm_tx_3: qcom,msm-dai-q6-tdm-tert-tx-3 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36903>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-quat-rx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37168>;
+		qcom,msm-cpudai-tdm-group-num-ports = <4>;
+		qcom,msm-cpudai-tdm-group-port-id = <36912 36914 36916 36918>;
+		qcom,msm-cpudai-tdm-clk-rate = <12288000>;
+		qcom,msm-cpudai-tdm-clk-internal = <0>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <0>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <0>;
+		qcom,msm-cpudai-tdm-data-delay = <0>;
+		dai_quat_tdm_rx_0: qcom,msm-dai-q6-tdm-quat-rx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36912>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_quat_tdm_rx_1: qcom,msm-dai-q6-tdm-quat-rx-1 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36914>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_quat_tdm_rx_2: qcom,msm-dai-q6-tdm-quat-rx-2 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36916>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_quat_tdm_rx_3: qcom,msm-dai-q6-tdm-quat-rx-3 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36918>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom,msm-dai-tdm-quat-tx {
+		compatible = "qcom,msm-dai-tdm";
+		qcom,msm-cpudai-tdm-group-id = <37169>;
+		qcom,msm-cpudai-tdm-group-num-ports = <4>;
+		qcom,msm-cpudai-tdm-group-port-id = <36913 36915 36917 36919>;
+		qcom,msm-cpudai-tdm-clk-rate = <12288000>;
+		qcom,msm-cpudai-tdm-clk-internal = <0>;
+		qcom,msm-cpudai-tdm-sync-mode = <1>;
+		qcom,msm-cpudai-tdm-sync-src = <0>;
+		qcom,msm-cpudai-tdm-data-out = <0>;
+		qcom,msm-cpudai-tdm-invert-sync = <0>;
+		qcom,msm-cpudai-tdm-data-delay = <0>;
+		dai_quat_tdm_tx_0: qcom,msm-dai-q6-tdm-quat-tx-0 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36913>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_quat_tdm_tx_1: qcom,msm-dai-q6-tdm-quat-tx-1 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36915>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_quat_tdm_tx_2: qcom,msm-dai-q6-tdm-quat-tx-2 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36917>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+
+		dai_quat_tdm_tx_3: qcom,msm-dai-q6-tdm-quat-tx-3 {
+			compatible = "qcom,msm-dai-q6-tdm";
+			qcom,msm-cpudai-tdm-dev-id = <36919>;
+			qcom,msm-cpudai-tdm-data-align = <0>;
+		};
+	};
+
+	qcom_seecom: qseecom@86600000 {
+		compatible = "qcom,qseecom";
+		reg = <0x86600000 0x2200000>;
+		reg-names = "secapp-region";
+		qcom,hlos-num-ce-hw-instances = <1>;
+		qcom,hlos-ce-hw-instance = <0>;
+		qcom,qsee-ce-hw-instance = <0>;
+		qcom,disk-encrypt-pipe-pair = <2>;
+		qcom,no-clock-support;
+		qcom,msm-bus,name = "qseecom-noc";
+		qcom,msm-bus,num-cases = <4>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,ce-opp-freq = <171430000>;
+		qcom,qsee-reentrancy-support = <2>;
+	};
+
+	hostless: qcom,msm-pcm-hostless {
+		compatible = "qcom,msm-pcm-hostless";
+	};
+};
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 7ccfbd987236..f8e3c6e2a355 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -415,25 +415,27 @@ ENDPROC(__create_page_tables)
 /*
  * The following fragment of code is executed with the MMU enabled.
  */
-	.set	initial_sp, init_thread_union + THREAD_START_SP
-__mmap_switched:
-	adr_l	x6, __bss_start
-	adr_l	x7, __bss_stop
-
-1:	cmp	x6, x7
-	b.hs	2f
-	str	xzr, [x6], #8			// Clear BSS
-	b	1b
-2:
-	adrp	x4, initial_sp
-	add	sp, x4, :lo12:initial_sp
-	str_l	x21, __fdt_pointer, x5		// Save FDT pointer
-
-	ldr_l	x4, kimage_vaddr		// Save the offset between
-	sub	x4, x4, x24			// the kernel virtual and
-	str_l	x4, kimage_voffset, x5		// physical mappings
 
-	mov	x29, #0
+__primary_switched:
+	adrp	x4, init_thread_union
+	add	sp, x4, #THREAD_SIZE
+	msr	sp_el0, x4			// Save thread_info
+
+	adr_l	x8, vectors			// load VBAR_EL1 with virtual
+	msr	vbar_el1, x8			// vector table address
+	isb
+
+	stp	xzr, x30, [sp, #-16]!
+	mov	x29, sp
+
+	// Clear BSS
+	adr_l	x0, __bss_start
+	mov	x1, xzr
+	adr_l	x2, __bss_stop
+	sub	x2, x2, x0
+	bl	__pi_memset
+	dsb	ishst				// Make zero page visible to PTW
+
 #ifdef CONFIG_KASAN
 	bl	kasan_early_init
 #endif
@@ -445,8 +447,8 @@ __mmap_switched:
 	bl	kaslr_early_init		// parse FDT for KASLR options
 	cbz	x0, 0f				// KASLR disabled? just proceed
 	orr	x23, x23, x0			// record KASLR offset
-	ret	x28				// we must enable KASLR, return
-						// to __enable_mmu()
+	ldp	x29, x30, [sp], #16		// we must enable KASLR, return
+	ret					// to __primary_switch()
 0:
 #endif
 	b	start_kernel
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index ac4514c92063..84505ffaea4a 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3028,6 +3028,7 @@ static void binder_transaction(struct binder_proc *proc,
 			return_error_line = __LINE__;
 			goto err_dead_binder;
 		}
+		e->to_node = target_node->debug_id;
 		if (WARN_ON(proc == target_proc)) {
 			return_error = BR_FAILED_REPLY;
 			goto err_invalid_target_handle;
@@ -3557,28 +3558,25 @@ static int binder_thread_write(struct binder_proc *proc,
 				return -EFAULT;
 
 			ptr += sizeof(uint32_t);
-			if (target == 0 && binder_context_mgr_node &&
-			    (cmd == BC_INCREFS || cmd == BC_ACQUIRE)) {
-				if (binder_context_mgr_node->proc == proc) {
-					binder_user_error("%d:%d context manager tried to acquire desc 0\n",
-							  proc->pid, thread->pid);
-					return -EINVAL;
-				}
-				ref = binder_get_ref_for_node(proc,
-					       binder_context_mgr_node);
-				if (ref->desc != target) {
-					binder_user_error("%d:%d tried to acquire reference to desc 0, got %d instead\n",
-						proc->pid, thread->pid,
-						ref->desc);
-				}
-			} else
-				ref = binder_get_ref(proc, target,
-						     cmd == BC_ACQUIRE ||
-						     cmd == BC_RELEASE);
-			if (ref == NULL) {
-				binder_user_error("%d:%d refcount change on invalid ref %d\n",
-					proc->pid, thread->pid, target);
-				break;
+			ret = -1;
+			if (increment && !target) {
+				struct binder_node *ctx_mgr_node;
+				mutex_lock(&context->context_mgr_node_lock);
+				ctx_mgr_node = context->binder_context_mgr_node;
+				if (ctx_mgr_node)
+					ret = binder_inc_ref_for_node(
+							proc, ctx_mgr_node,
+							strong, NULL, &rdata);
+				mutex_unlock(&context->context_mgr_node_lock);
+			}
+			if (ret)
+				ret = binder_update_ref_for_handle(
+						proc, target, increment, strong,
+						&rdata);
+			if (!ret && rdata.desc != target) {
+				binder_user_error("%d:%d tried to acquire reference to desc %d, got %d instead\n",
+					proc->pid, thread->pid,
+					target, rdata.desc);
 			}
 			switch (cmd) {
 			case BC_INCREFS:
diff --git a/drivers/md/dm-req-crypt.c b/drivers/md/dm-req-crypt.c
index 0ec61ee586b7..dd6ec0742044 100644
--- a/drivers/md/dm-req-crypt.c
+++ b/drivers/md/dm-req-crypt.c
@@ -45,7 +45,9 @@
 #define KEY_SIZE_XTS 32
 #define AES_XTS_IV_LEN 16
 #define MAX_MSM_ICE_KEY_LUT_SIZE 32
+#ifndef SECTOR_SIZE
 #define SECTOR_SIZE 512
+#endif
 #define MIN_CRYPTO_TRANSFER_SIZE (4 * 1024)
 
 #define DM_REQ_CRYPT_ERROR -1
diff --git a/drivers/platform/msm/ipa/ipa_common b/drivers/platform/msm/ipa/ipa_common
index 6f66e0ed6e36cf09c9720be70d26f0bec8708aa2..6a243aa0fdc5ba32fba7eee6c98d52914475e671 100644
GIT binary patch
literal 877632
zcmeFa3w%|@wLiZ1IXU~B1PFnI5C|kE3DE?3Bs_zPoFpJYc|R1j_T&jk$%{M$#7Y1k
zv9uN{R%&aBpe?~ZXoc2TA3U_h+m~%^YkS*k0By0h_itMtP)qrL*P7X9&v|7hdhYLk
z`}=b~<ear;*36n&vu4ejHM2Kc<}JL|q3fFY(Y5bt7G|bu+R>j54j?{;eA;ry632zj
z&v##NYP%lQw8P%Jv~#^q{osYo#||8I`hNwoo%q{@zul*tnFr5byf`w5ey;Y^fau3*
z8wW(6q7~WGKiB=v5}o_-cc*r+EkSE3*R_=%y<@pUPgw_Htn76rA4L1dQ$IRe#!m6L
zw8B<H+jZjNMb3L?Npbgu&BwXV7dD5~XNdYbwJ7!7mSIz$kgo@_^yt3xCn0D0t<|-|
znm*@Os;n_?EblDHyyWtZ<<#DIO-rG&4&B!Se5Xo7`I?sXil%i8H|sISCy1ZRo}XiU
z4EYVQ=T|ZzhWz5~`E8pNLw>{T`5iBaA-@s!{Ps<aA-_@f{2Vi4$ZxDYzsjN*^2@U4
zclyd0^2@d7S28<>{POMj?VA%reiQBaWtYT|U!gs}ZF6JDZ+buY&5t3!S@!%K*Ts<E
zY<qtD7RHcYu|2<SOJc}xo;|;P%VNlHfjvLR${6xnWY4eih8Xf&X3uZi>KO7{WzX;U
z%`xP6lRdx6TVu%YR(pQ?{4wNLVb8CmGKTzW?D_4hjv>D~dw$t#W5}<;p5L~*81h?h
z&+qiQ81iek=U37gLw=j=`R!|tA-_-B^UH3HA-}Em{3_dH$nS1@e)~4Wkl%gw{7!F*
zA-~Vq^UJ;?hWvKf^Q*iwhWsA1=eMsThWx%@&(E<vhWs9}=T~`m4Ea53&+quXG358S
zJwL~%V#u%Co?pqQW61C8_WZWpA47iMvgdbvR}A?bvFEpKcMSRU*z<Ed6hnT`_JiNU
zG30m5o?qo7G3586J-^d?W619%dw!06G357Sdw$0siw(cC6u<tN?|di4uQhFWUoq^{
zUx^J*j+y_`zK{E!h#|k<*z>FWW(@iLUdptOGl9xOf}a`dw>uXw=^~y9oa#sao{VAt
z-slIvBeCJfI{K!N=Up~Bn*H6_@MInROF#PfR1Eq3)t=w!o*43b*PdVHGcn|M-k#sS
z=VHk3f<3>}M`OrOFSb1g%svrAelB}{l`qDSU%WlPeLsjHzajSg9RCqRe#7kfo&I6}
z`So7hySz`EJ;I(}$xr&v&-UDSls&)WFUOGISbKgYzlb5ftbXwOWeoY{+ViV?HHQ51
z?fE%=8$*5*?fF&yE;jsljV~-de*k`HiQO9iUxKGOw?2~JG~K?Br(cUr9}kePJ*)V9
znY=4940l07?|_^>)qh@I++iV~-IPN_zi_sF|MtD!f1b8Brr4g}=|9Af-#mMM``(Np
zzXko^_vaY$TV&5K`|TL=TV~Ji^xtC0Z&k6_d-kzU+V+m%XX^P!n(uY?{oD3#4Ext$
z&+quT81h?h&+qgHvEj$|ti5l0mVKfByn4l*zP|0*x9s~@@~{5$?8}~U|L*R)f0Y;e
z&#Pbk`=ovU_Gw#Vcb9OhJ-^d>4Efz^&(GnEA-@WHe%Wy`<aeJvzY<pr`F+NoU!@U4
ze!J}Lb%|T>`>6K%Ecr_{!Y8ziO~#1lN#gmSy-ZJgVkpxi_WT?PG33`{&#z=qZ1}Ma
zy~)Og4(>lMI~(eOZ|(Vl&>7sj9&Wdna3uDhcVBA->&>J6kn7MG@_WRdUu9AZ`8{sW
zZ{M&O^6R#@HQR;@ejnA=@c4b*zJHa;G3?*7{opquhWw7%^V^mh8-8cWj=m_y&u$Lx
z8x<R#JccjX_i<l(4Eg=op5O7YG356%`#DjWDfq=?PW;lof7w~F>E8j;ncsjPe(4<2
zf%u4>z2`Ciy}eAfjf<g7PTBK2o%`YVdFYuTJR3yMYlX&hSUzuj2>HBeKZg6p$7T$9
zJpN+O&oMDJ{8%P`{SY#F*S?M03S!enmWivx_H3wfO8@y`UId=&3)K_m7jMsR+qC}k
zv-N$3*z>EL(SLrn{TpV_&oQh2{A~L-!k*v0t76D+RLS{HX$MU^ZYvYrzKtbwK3p3;
zaoV!XLTx?f+e$pcxHDhZc6onOdrp0>G?L9?T^wuQuF7Q}u3ZszKMS&xF?LgSp>g(o
zD+E6?-(&Mkrb!o(Uv5A6t%@PPe0zCjua2QSC))Gdc5@8*725OL_puoAn{Lm~;g2D|
zS@!()Rm70rY<qqsRsH8@Yln*M`JJx*X#8kC<By+Z7tc&<DG}%9Jo~m(*7m<Gw(G<K
zds~qG3Bk{_DIdx9EVA$4>2)#e-!glC`x;`%Z<Rg2ZB6~>7p%L_cE3AFJO9oS2fuG%
z1a#_v!*`zEJ8+ibNWgXY;(2*k`-W-j_s3}~^9BPRqOH#}w3Uy77JHPP*x&A=cM?D!
zcO&M+&-cTJKd-0lT&|aOwKzU6&Ir03+IerBcDQ^-@p&Bl^0WWD9ojCG*_DH{+|$k!
zuA^Mjrf+rldW!#fak{GKUEoJNo<}_^938_^M@pnNp#9@BQ#^$ocvnKJu1!<xaHCAC
z-Z9*TUo|}$?;JoM#=o<q1TyiRzp(j)e1AfO_Z^(K_nl8K?*EwB&Z!Ib{2WU^9KVZB
z{bv_8>)r1rlO8y`FO+J#Xx!<Y4x|rf-P(E5iOzKG@H@~8ANds+gL0Sn?Zh}`&ePVv
z<kVKifgbl0cV$S~>cBzE<9j+m=m3?)J1n>k$|wEF0uAZV8I=b7h&CF{VT}LF;A8q?
z<2Kcv3#Ba`WbyPmg4=r^{5Z3{`0ZCc+YMjOmcf_@=quV5^zMq&Dlgf;yFee>rZWm%
zZ?b4pUv$*Z&!c@b23oPO_XKZ++-aVk#=A~vta_auo;$rxZQ3cM^~$-_WoXkdZuG8@
zp!OagV#y}jc$`pZ$~}?C!=$+?(wGmn=W%8LG%1ipmXyUQC**;Cla5gT%F*x8K2|2$
z^RF5JO)v2TKa&3`vUhSkD9sy1r*npOEPvgZLh|2Df90@$^c$)dD&6P^vMf>OMigG9
z{iG?tdv8duXzrYK`_AV>j&pR+Tc<E5pf|9ArLYHN1B<(1A9l$-&hE^)+IpHdXg|+u
zO7{T9nZqvargGj3nfBzp8y$F$O|U&lWq#WElaQZhgm(B{p_jWgIX9obR@AS~OSAsC
zo7%(XchzuZd_Q6x)FyL02{z}}Dd&js>imkNXO3j09Z|-{sn8saq5~!kjm>Q6fT?dC
z(CvtGSgAAW99C(h%?{PQ6QJ>eAMwq^FZG}Lt<EoRg!#2C#lGL$2S6kE_H$m12%c9_
z=bu6ss_$9wXH0#6@5U0mGbu>lgY4z$VfKAJGXNTr_3tnb$rhM?`)S<&a5665S9M|Y
zGu`jQKMTwy*mV@xd6wqSU|NqI<Nxl|$D8x0SIz+sXlO3cynItx=e8j2ByiVFt>+Ak
zGtDVVyASV;f<LtLaje0iy0Lwv)o<tk+b*gb@sGgzNp+ObJE~9z@ud0zvmZ#f$tS)a
ze9kKKkl^>Q#%*_K!_9ek8a|r2)=@tBdZ(PJ{j$Z|(@1BM1GYGt&Zu<4CoJtI{dk}K
z!WRPX5+hk*{Dgm#YRM_uTs$)XnkS(jr<C`TWy3$d<Ko4K%so>yow-;l{JHnx&%Jk}
z6E-+5$fsldflo)W>&zw_EObcPm)+(V?;Y?Mx3MnuImVfmjQ&sXiKI*WS(j4Sribbh
z%_CKpp8ttnxOJ$ulIkHp3u}JBCepn9pX@_v*8dq<nS9Q|x7qqV@O)JGn7vrXAP>{0
z<atjz@lwdVKN~XdhhW~5J$NZzTM1jXvkLQLagZ$#dQ$hV=r+fh)3N*y&JoO;<m{7n
z=YK*cRbKDPcj`s63sq>>>$EPSO+5Zl)_RpLY|TlaHD?5Tthul$rQPqFepadQvpmv<
zI$=Y>BWMjO$+mRD^qEN3<da4AnOehqrqUSJam3v*oaE5;-o+!&h_x)Jy{9vj_C}G_
znE}uofld5c$eKxZ@x;IE?c)E2wKV4nOCF}}cz(ckR;<~5*;$iMB>NYuwKQi!|JG8K
zuD@&Pw(*vnqOGOd2S8)DmYRDOyBJ7WJjX!BXXa_^_rZ5G_X`JvAHsX_Q`kSL`vuy6
zhtA{U)9m|qVgNKLh+RdDxlFa^b4H=@McE&iG~}~p!<P5TeK7e9)OU3+9C7ce@Q5~^
zrTwJ&FU)^xN2p!3+q?EP#<bU?IG3l~*W<}Yd^1a1e;ng$#zWO{uBi0&px<F}m-0yC
zTx2i*6ADeVeW6JcX^fB0><15p#*Bl7`uQg$4dlw>Td~I1Q@O8r7TI?(#)!=pOW#1o
zdPB$H7}lX^v4g(kACLI*9LSu;V4KU5JNu-PXJ2#7>kgk|mGb?Q)c$BXS2X|{nq#55
zJ|D6Qo!gaH+mA<;LIeB2zE$XWm^7s86XlptjGW&4OZ!CXSLToO!g7*1=3%c(o9?0g
z2x2*U9OCZ9h`Y<!RtI8t<lhZK{+pXOe>=g;F~gp9*qf0qXLjkcFb3TT6ZCG+9fR|=
z4(tQtx)6`gJa`6w#Ea^ty<F$do!tcETmbR6j^*2Pt+@R=XxDe6%+E)ay>^7yQjp(J
za!tqbGfK?N8^w1h1)UmO>;2osh_Y1a?nnFD5dZ&-^dtJxOEvx-E8D+MzQ>bf8ci?v
z4}d0`?LS^>uZJfTnrOD)r1`M6KU?7ut-m?_r1_|}KM+SLh5oZXQ~W?bNb`qm508nA
zq0n9<x?kNE=2veoQ{?>->)1P9TYnn!h2o_rvA&vimtfkHiM?n){EP)ko1)C269b^3
zGcs=kn|E66dlWur20%mp8m)D`uvyt`^TgRA#d=5vhy?}KA{w)3_Q835|9n)HE_6*h
z1^cS{tsybO-KPEcpVX~0i<EKvkh*2o5i8xwmhZFe%Z}v?fQEF7V$Y~Acr940^gW7h
zl@5T0bZe~CE%sZXKLgdP(xv^=E0r#mdZnJDl%;5g$%awvipN6g2kk4P+pqAmloKly
zIe)}Do|NUyd0CCK%25Btxzgg-AG%OGNPdg3gTd!BT@if2;|eb=iVmF^01fG?utSzl
z+?O5Nj&~LJEAFh&h3ZSOC%PT#g`HG&+55r8X`%CI-zxH{>|@{iL8rF$=()%~l}h)l
z@TG$1t*TE^WL`P|8k)D?lRlgJe_D9tI^K!%5IPH?wVcO7>Yy1PGtV~=CkvcQ&^bk@
zUY@y$`fr`rn){`XQcvx8v8OCStkfsgGx+c+<KbI#TmLS9yPVpQaS?1_wtN>f&+jO*
z%ozX;$+9nft-2*x2h8~yDl3&vtdZ9LI})mYC6Ft(zYo8+bO1EehcnQJ3!9%s9973T
zhq%LJ>cczG1=<Jw9p@Wl8+kuubS$T{qxYOnmU}sLg!V)yaVB8yi)c?YVrg7{a-P-`
z*b^PnW|{TE<{YGbkM4qBMt#9Eb`fJ9P5tQa0BFjwXQ8`E@7+i;7I%|O-y>4o%8Y4H
z8$0A&sJ%?w)d^h}$kxz(X1YUDlkMwSGv3#;_S?Q$q2s;(R?(+g&}7DI>#=88S(~U$
z=X&$C^_7VEM~s<(uW7H<*jUG)@O`_(Z!b5eLeq<w9Q84@ttJia(Ff9|NO7F(3i~$Y
zC^V2u#5S2U6hlLsgY0GY$NRxUq3M!i8rtt1Nkiu_v@TR&EJ;3e-_67;F}9R;fPHCe
z4Z|EhNa>+#&#^w@IyC>(JA~#u>1+NG53;KXkil8RBjOQ{xK5dOo^e`td>&#E$R~a2
z@0@eA*vrs40Ge_+=iXKB1NL{$QU9o)JXdf(?moy6YtPQRa2|%=KJS}3<-66(G0!}7
z_Y$$OO3XE?FQP7kF4Fw!jS!Qp{Di%Xss=z4szc)<=ys*-54B&5vVK)5H04or+oXZb
z7P<_(Li<CiH?$oeR+s-bt|h12?8ofP0BB6T4q8i2(7gd?_xm|?Z@`81)abr&LXDGX
z2M=t|q%%pLyY%~Ebi1lr^o7dCBi2rF-+gYeZXCf~-~+eUo}>NEf|`z>;{nKB3$&wu
z>&?-2y?43ZZN_NKJ1}Nk<Sgu1g`5NXO0}P<YfNv1{lMv(e#mnGG{hh0K7p7-*_w`@
zm!aM7<>=j}jNU{%$HVqa+m#z(jvSYAA-P7IBPSFZ^ZYQ>{+l%PZmlk-|6IkV=H^$!
z-c#(D>JDuytqUY`lCddYb?zM4?mwsA4}53IweUgaK~Ly@U}^Wo6W0B}P`{jG(dHd+
zdG`ei-_8!)-##kV$erYu7sH=I+jc#Uzhb?sh2}KHonM!+=T691b7|+x-P&RE?oUU8
zHjVb}C>OMjR&KN(+o}Q32;Rcin-*c*PTywF@5}&b=x+Ly2z<={&w$1-nttrxVBZ##
zhWK=lTu~q9TMG3Pcl_B`h*tlZe#p(Fp*>CLp5WqkaX0Ba?k1h{JE2E$urscp`$@lc
zbSx)5yy(=<ckp?uKE62q+{`qZJMd>H{%Ov8@^R0D&wKbIJwERkHRxA{HtaRTPmj{Q
z6wr$pL8^6c=i<fby-0ub_^ch<9HXwM{=W}B^8V}Mj0vcN$~eHQ3;89`$N2n(`GX3V
z<uB0V2kp=Y4N53n#PE>(<@xs^?Fpn^hrhuS7c)Mja7BI{(huqhgFc17L4`{gA2M+z
z=TrKStfl$Y`0WOr6Mvm(hyF?51JoAcpQ?=-B-$`zhx1lnPh7XJr_+(jG}I=d8>yuZ
zB3kwAH6HC&@AGCs2EERaxN9;GvYy+0&R^Pn-n?(J-I}-Now0L%2k64@jL|$ZZG$G)
zW^+HR`ZOLIBlvM~5%$%kpAx!h`Y&Q!tou}5ap8M`)3OZpH>yq!h$icmP#NhtbY>~;
z;+*r#JD~C|&H>DcEthHQQ!xf3X$;`Q#V?q;W7<}I7u}yE8F)r&E9<bok6)0#V_KGD
z*P9rVoDsgBIy^5r2YaM5D1$pt)9AT@V`<vTH=(P09a<0UApYTQlk|tqqMT~W;~p%|
zr?KAu86h{ykAJi{ANRD^<rQ|0?nE7&7Vqn!c6!jR_z`0MmMeAM<*;IJF3@J7POA6J
zXGOhKcF?y<@=4E!%vzSeS0A*FbUk7AqWmB0Lk8{Gx?^-=;d0jbH<A7yNE^~qnoqj@
zJZPUl{^040^Irq}L%{ceW+>(W>Gq#U*Porsw1a0Y$v5eVX7G`D`4>^<EtGi)_+G%o
zYw)wz2IvB5N9G4;18L8eMW9;{M)$ng#v|9|54u(BG0Rgr;naTm9W;Gu{@|>YJXfi2
zPohmJ_*KV99Uqcm&gVp&<P8}wVtsL>tZSXJdvqFfCb?UT#}>!Pbz3nPGo7jHifK;1
z6*;DM0`(EU8xhwq$B^n&`NpAM7j%*MZ-2lVL(*$6_DU4<NMYU>cRB-h37RgP0f+9l
z%zakM!nl0m6S~iu9wDx`@6)2bzUJh9g{I^6$bB_w#zf#zB6U-hec1fK93vT&ekj_k
zSN`=czIz?yJ2>S3k<wS+oC;0X?<4okq<KT|!2Ry$y8n)Q-1Pqv_f>b!gZ8pDX_7JC
zwHPz<v8YalWlXA^(vh|WepX-nPV|GHN%ME!14sTpg^7n(+MMdtxd<f%Ki5@tm*`iy
zF*l!Rk4AZ(!Ety0&i$RBQ)9Hz_KPYVbf4|57G?jr9d%OMOy4*3|4=r^&%<jR<{A82
z@;~_b#^EBaNafL%^W}JN0iLrQA1N-FE$1WAMr%vX0BC407dkd(TQ%G*p*Cuo(1&tE
z{wB!ZMEN^h{-(;`(egJ#{$|VH%jEBP`8!GePLaPe<nNX8_Zs<IB7d(HzgzC~bZ@!S
zjXwi_F8sye&xt<={&f6l-J`^K1<lWGZu|MMeE>9}ax?$m?JoE@h#S+rfP-_!Y3n<&
zhU5S3ro9Ho(dOVes805+MA}*SN11V2VHaZ3y`b&<ZSA>CUHhx1?HyeUeQ=;JlozT~
zCO_gs`74>Peo)76Io9n=@UBID#Ft`5^!$|vd<i#sc5vG=$3O7fymOKGbU_zEdyw=o
z^QJ6*MvHifcU6QxU($uU))c#=ewX1n$1=p9D2C2=;vCvadLDzGnR!>n(5c^E#HN1z
z+wybo<GCjC`Kf)Bt|1<L4C%+P_UuE99lj`ZQJlBZuQo(G(iCBwD@WLmbCp6<o)9_S
zYSO^TPoXvw&ogL0euMO?QtnMDzf0N&nm1+{)1JMKv@EPSwC+@)jA<*VoKN24>TkJR
zZj+Ez#5RqzWMH<5^u&~J#5SP}+RQRm`!bMnc4tGSY5hAJQt7D8bT2UU8Jb9UvSX=#
zi2bnsJ&L$NB>g*@pdGn2g8m&(w`3p9MxRh<ywRSGl{B*ikACacnK8k-h52=u#?wx>
z%yMHw_}PuWGvmYQjatr5Z=87cM?F{eMp=hdy6AfI9O4E#zq7zxkLeBs`M&6@IO{_k
z!HgBrn%oP1IQZ?Ug>PiukMzWM^k{#%;};}bO2=5Ar(X|zs!rHJvYFE(=!e5&uOCi@
zraap7o{}a#0*~x?dmcFhped*Rp`YY0sOwNU<f8hgs=r{`H+7xtf-Z)h`HX;nL2Cw;
zorAma*}OIid+WL5jt8FqMBce}@Hg!#9I=$W*Wr$vN=N4$STj7s_TKFIWOx}q2cb0u
z`Lq^3@5tmjHM*DkbMFqUPqS(heLZwm<8f)ra4y+H=cVRZY3MnzhJK*U2ajQFsNEe{
zZ*M~zSK&NYU3ams;&u0=T!+<m(0WV!sgJLqk5oq+>KJJGPPBi7Y(LsQ%xt?FpYOst
z?imc9z@@G4{p#M)w0?ULC#ByGHE*QIi)33VPNu;Y;<?d-$JsZGJ9rm<-^JJ=26k`@
z*8EQPC&c-90{XWFKF3)lEmHr_qR;V=L3~}^xjN`m{2jgrJj3F5c(Q!6W}uDmfo46A
zIEtu8JU>O}lhhtcufubp&m)$i=11bwsqlFTeU8MZ*O?k|t$`0Tp5A@p(a+7y_xO4!
zj`9Thl@HxL>-3EGzz%rp#QVG??f5)}_J@)-Z&@Dq3;x~uUbm37hWcn6=(!NBVDHTY
zbNg|&VdA0s_a1yIbIxd(m#{r-<IQ#5^fR3DeG#?fbK{+m<~=WO6nc8+h53vcJ-_&_
z^TE;d+lBLoU*f$gH^gZ(vM?s*+>UtX4)0_*(~sxeN<nAxqCP}zlS0>)s`YT}48P_3
z#D2IO^M=Zc=i-9zI9%BLboU3?JO5*?1My2GW{kab2j*^&3}tMx7WGk_81|oizM51k
z1{UPQZ6P^~IQR$Y8`gr3-fhzhS<yV(ig(=XHE_=XztqMu(q*)p+G@7h?1Nl$gZ#>U
zciP+V{R)jYF|rPrG<BFW@8EqlTS#_t?*^N>e%)YkSD4PlC{9k#G1A%D`}n&BZBB!%
z<g+8YwLyXh$w>GGeaom6dw0{PTmb%FC+5ybAp@aDqi_#T++(6P9YOq^<b!wgtUCz*
zs{&~>u9T)-ym<IL#)aTsslR!s?;pxo<&O0ATt3y;L*uj^=O(?*(FadC)4*e7V4U(m
z!{dbYgU1Q`k~W7nJrCtzKi4C8zA|sB)^iN`)ZVLPdwZRuP*>*oR}gceaXp4Poi|gI
zS;sK?b^hW?YG2oR5!;E>K5ARl9cJ57xouSDDC$*X?f+O?0^Ox^vhT}x2|WWH*5L=s
zcVl2&-gU;o_BwHf;TV5TuAwZeDD!*!P@z+`v=@gxAb*GGqs_e&pf_VBd&v$!Hm|@A
zd{@_IkPRStQ2C)4+uGrfg`RqSZKWf>9r?A{ESqJu*;<bq`Q=gO0Iln$e}B$T_mjjk
z^5VQFWZrJK&Xmug-}DXxT7PH_HqVz$-5?zm`^~;}l-^$fyU%)6`*Fmw^$~+ECSqL~
zuJv?c?s_<8qwVU}w4{W(4Mq9!2|I2`>=^FVGk+D2yo3=QKhMKFp*v95;oNr1c=(B!
zV{bm8byJ^7K2%>Xok>AY@XK+$4i}$U>^>^TDzv?(Emv*McI;ctwo={VdCZZx4=Cmc
zwd)mUK=#8(_Qby&cLVcyjI^Fq_#BjW)S(^8LE2NAHsdbruZyK!N1u4Ch=$hK!x!8$
zDUE2vm<xX9{X@uj{O*6cXA-?C`~KJm=V<DWwdahchdH2o9cwf3AepP@$~yajv~FAH
zR2MdvbVGjv@1BXYewupoq1w%REYa@T<t6#|8QL<BKH_>hv#EvNl%h@35U1RWaX*GR
zlj;eK$@(W?*Jxbmokz9VxW@pSvjci@8^+<RGk$y>^75b?dlR(v6-Y0aIz-P$QCqt-
z?Fa@iB}I;-D)auVTRB-IbL;u|Xfmf~`^~v8=4kNRS_^$4J4m|Tp|lhAO`|r`v#h3G
zu7qAv+mHU^;t{%cDfEc)MW3K6+_$6WFCO_%<oC61Q#^^*Z9dCIotj*?4}hmS-_`lE
z2D+OiV=p=5#2hluUH$=C+%mKT?m_xnUc{p4{)o92n(H8~fyuCGbWXe(XK6%x6!EQA
zj9Kk=e^Kp4zB3)zqf=XGtulQGn#0aq;!A6YSdUEp<@@jK7P7*#a<IuHr`~^x^<z8A
z&^sk){i1Ywr-!QN;cG<jeO3+rxksb5n(z1@%*@3*XwgRx`l!kC9zN%haZfMScTb15
z>(Oj&7mW?c)8ln?6Yq|sD0e3E?ERFg0nnKCZ3$#eae)`{OYeyDK;B{Pmj11Gn0EL8
ze1&}Iq&e<5pE`d4v1xPM;ZvXQz+OH+PV0fM-J=~9cG!peBTK;peGKxyN~YQOt5l)!
z$@j6D{7t?l4c+_yTm(MZm)rBn82}C4%?RzwzA5%R_Nz2QqWF@Mrkwf#xqTk;e9gc*
ziM^FxA>@g*czj2M_dS(Nw{Jt~0BAbE6aCyh8*QQab|3IOUF$huNH|`!D--A1(;~>d
zWMV(sGccMU{W(6>zWx&fprLW4m;vb#>?hW{V0#?8#!*a}{34Q(Y2&LQr%?SoG0SRa
zf9Pr<U-Fwf;2Rwnq)jKk-7D`=(|+QIc-DmMIqf4T)<Qo0UdM=a8q!sN-Uol4aAC8B
z|APKe-(Vw!KlWGHJG4JYuGva^wJ3gWjzZIgm<7oowBII87i>%c+R6Qpu~O~__HhyW
zf%N|MBNhD+ccQ5u)GunsJNWHPEWsI1%3EFV6GnJDetzVaAN(yf*VnC8Xg@pXh}-p&
zp`D+Bc;bkBjcxC1j+D2~LMEs1-Wzl8X4Xe>#!y|LK79b5=G~lV?{lJiIX;XX$3OYL
zly;Eb>7)%7?})6#_*6k>UQZTtyEj3b@m{iT)_1X<QeR%f-Goz#@M+~ZzzziMo$rpa
zcRqn<L{uN-qm-{h-0oA^C3MH+dfM0B2mk9plJ%Z-2tDbFy4s@aa0QF}Ss(oN&MCt0
zqJ10rT=z}Udg{<tiZ{)HZWj;7-fp-yopiViY4=31AKO-2^Cp@eZdYld#BqrR`|hyy
zXJ0>_XW2gh8d^)^F_+FN?`(WDnf4=OOCrBdi0%oXVLMw93!r!HmdkNI3ms7B6UDRc
zay;;G34E+G%CkfRrT5ADvHx!|>#rWZ`{69pcZ1%L-qBxwY3VNEam<Cl8AH5wgx32G
z=qlAiV@|)l*bj|EdgqJ~-IyVCV-9rdQJhJV4wdQJ^yw%^b#%i2rSe+=(_AE<*W4R%
zy#t&Z&dQHAH`MYSn7<XWpJX?vjnt;^;7-|A%p1BZYuXX>IWn(oua0qtJr2BIx2lTv
z1LDk)>gf7Q<ohcsT{YxR@?tr>fAPqVfD=q>mHONV;)`s9D)5^E|C8eAXR$Bzz(*xJ
z>BXKYUiY8-ghB5bO?ayqF<;aZv@TT6wRA&^)(3^g7iB(HfhN*?boApr15Sm;)Xz{k
zS~MNQ3whpm44;hOFyB_*<LE_S>fqZTu6!^7J{IX%Jl2Lf$YMmXHY=f9@5UbTJo!Jk
z$a+5hXL|Ri;Fm?ZKeBC}y^OXGfTo<!gCf848uRHe_P&SX2bY|iqib)KW8X0zV|Yaz
z^(Fow-3#~YgWk%*SSH}^(IBjYPhcISHLzZf+eLj@fPM}t6l);$+kAgv=-3}$VBfES
zysLoLPm@<)&+O3pSq?vo_E%Zb-!j+F3e2@_m~-3lYp$O@!~w{5hT2uKpJt!7!;S*p
zm4&~3ORRpCOP%h^_U`|X^eO1?Vb;ZvIn|G6<Es=JpNtQO>byxq?*T#Q*w@1I8h9^f
z3ih_b_aj?H{*sA920`(p{=_y;;Mw{}enl<DV4&qYVIS*mD9O*$J%hRt-!Wr5RqPjL
zj(-r(M?H`Djt_pYId<l_Rj#zgO^arW20&xRdc26^T?YA)9Lw-q3qJ<FXb<gs$(AF2
zJ&fXMwEom#U8;p&LvkcPmfrW%3x9{oltUiv$Orv0lZNQX*3fT%<(0GQqscq8yf=!h
zO2NmBMN#|uLl^4noI>BtSaXDT2w_bMzt5DMBF;IsV4Q1Z+{A-8Z#Tz+TR9d?J|e|}
zNq_S&2ILRym2#(j#1+sNS_9w5AH~6ML@bPG=~)Bn%WF96z>9lVVm-!Lhlp{~SqJ&3
z<{C}oNn_h-){C(`dg0<qqJdsh-ZIMbUAQ>ya`2#c9isA-Rp3RjdEzZ-M~<(B@6v(s
zC%;zpUFaDf;lGIWn)=lVpLmPIv(ASYCbd<Qv9?Z>S7UAWMDg?Y*HfLT2j7r>1D)lV
zv3~V^xS@MjQ|`5xcl50A8I0Y#sN)xii_%zBU@WL_a4b?tmbIqbX9#`g{Ttd$eW3F~
zqEXM5{)By(khicsEN}RIro36!vM%xmS-!yk8~zL7h%>MZ_hPI`E?XfFnt!GYDUEp3
zetiV?>mOB)XWAmkF?|28`cxP*UYF=TAdOc%&i^SMkg3P7dlWiJZ9FRX?P2!%USYrH
zq5Yr>^0SWLV{h9|41k8#T6%V-R>l>MVyr!JcrF||MRKQDLnr1(ImVFMOk+C;xH-0z
zu8u8)9<)EFv8B5m@p){^ulFQr6f5fSL$AoT6MhPFNkg2J>i;vwn0ONn>0TY~f>fYQ
z<-jSQ<_PV#)#rLCUj5G|y*tu5Gp#$+$78r>NU`f}3Fl^Zp)T?n-jnl!?#`3lHsc=q
z(O%52@wIqvhkWpk<K7+gj1TRvs0{~FJNOLKLw+&x>Fg;R&)=uwxgILhaeM~T6YZmr
z&lsfV;hq7>@(Iixif`lI&`!2X*w<}Fe4FM8(UM&v+Sf4euY;bLHpvS)o<loHPPL9P
z*MH&o)jLMZ=Z-}CDYiWt`Py#hP+!j|Z4BBn3T>IiZ82lmo{^&Mm_sWoH`ks^!}ChD
zjx^8}1=>7DOB?ii-YejK4Cw~=2{~LHBnJ&VLgV58Y@#zn^UO4OpFuLG_$0N_C)XOP
zm-L@xn}xreL|SVc0h_f2ca8Q#--rg~ct3>SUHd?H2K7;0^k=R~q4n*T^_g@>WsIpW
zI=bIU<9ZhQL1R08tY^mohi_IVo^uLqM<vc^sU7OxELz{H_&nF@8?~vww4}qKdQa==
zlmF84sUCV3|L-_Up?23M>Ui!G@q!t+6Nj^e@@>KI1l)35+qC6V`mEZ^@Qf>BT~r?9
zyp!e@t*_+I)c(ZT-Hp3Hk>1l`#x>2h*Od653YBLm?zho6Qr)%4AA$P$8Q~1i4lPT}
zBT9#FbnpPu;$JMD^`=9d$wnK?Ga+?SU$d}}p;$Q8k@+I}ggOa!&c?HV#e&aRjA!aG
z@jlGka6WcauA`xC-k)H#neI6C)xR9Rt0VeX4xVN|xg9Twc94HfxY^&(IHCH?t=+sR
z#W{I@=EZT)^=Dqtxw|<&)OMeY(}v1Kr7H}X7t=5=u(r)Q0GW1_2w9U3?Zq<yd+{v5
zUOW@97taRl#WMnX@vOjJJTtHt&klG|Pv|__meT)uME@^^DhqCZ6nhd%E9Mc|DD!!k
zU>jvO4pn@I+M2^;pQ<9*r_-S8&p4cs^-&+VA5rcj6WuJxjcgL>eZr|tzo0ojzU~u6
z*WtW}Y}8@Qby~-$o>Q1tdF)d{2aoG0N^7TxAJKk<`9-sZeBLkmXx^`)ITSW#qx#p!
z?VwY2&79v<AL&~b?0E_PR65#YiTy(8S|8~iPTy<FnX#t62!HeWC}UQMyVU&|vntT3
z{V9(!W<*y6xxEL!o7Vi3r#JnA?sc90L~T(X#_U{1>W<_b8Z&V=aTaIO@e}74kxk4z
zm09$ryrW{;q0qVM^al6qEb1fM9S=J=Ey8#?aF4q`{S)`Ng>54}DUY%*ROx75(Oqcz
z9fe<Rhpx@a{DIItbIil~!1o*kFIt1%L?3k6^c>jlY_i|5?NWE)-w53nKA?CeLA|qN
z{=XWaCtm^o=Yx3vtr<%~+NICGlLT@LwTHE>_iDM*W7_H~bsZ*De3mM3r2@Ap@I4Cr
zhyou{;1de`YX$z30$)(zVGgSe;}rO61zxJaH41!(0)Iw<yA=3I1%5$+f2F{0Dewga
z9*!3qnDWV0;8_a1P=Wml+@ipDEAST-_z4AmR)K%2z^4=#=c9r4xZ*50O@Xga;A<3k
zsRCCjaGL_(ufUHf@KXx>vI4)Qz!w!b$z`?eG6kNgz_%*!W(D4^z+Y70Clt6xflny#
zPZju#0>7)kZo_KZC<VSkfoCi5QU&%aaEk)pqreX<@IeJWp};RI@EHaEs{&tC;Gu4-
z&AAFZQ-K#LaE$_QRp5sd_%Q|kngV}cfnQVLHx>AA3jBcryF6AqhbnNI0%s{OHdz6E
zo~poCD)1Zyp0B`575HWau2SG;1-@N@w=3{x6nM7+e^G&-P~gJ~{9^_Fy#oKY0)L>u
z@$puF$0_h+1zx4VwF-Qf0zaU@k16nz3Vc$5f3Lv*P~aU2R(l>%;IAw2F$I1_f!|Qz
za|%3UkX7es1-@K?rw%f$s-~4H>B|(@ufPooe1`&WQ22Hz@M^^tZ3bN3Qg>TTOY7w3
z`iizSO)U+R8(JGC*ELtrpTDBHZc>$YiR6-8E-AyMNpi_DTr!83mWfMi<0XgSlB0CV
zJG|sIU)m~M+8<roH(uH-Uy2Z1ikw^u7yaK8Mr&!X3;Hp|f~Cd&(uE7=Enev_Td|<D
z(7$x~lDV3adgH?4#o?($J0*;E)rykvL?WFUi8MTsNT)?24NoM}>5)jo(u$}1sSp0*
zMN8+d3eTP5pSP%F-rTwK=0?g}Id5gzyycPdmM&f4r)opxRZJN-M$0H&6wYQzgk~)&
zTM$<BvKbK>A~_N}Bu8SlXx^gIr8oKKE-Ln~xM^`|7!xJGI3fY+ojb2|$)crUMFTnE
zI<TtL58VhWv2xyul@Sxe6^=;5>!s9iHKNqW8dK;mU9xyZxO#`C3iS?6W%UkCB;A@4
zR;^I_P+C+lHH?%h2u~GLAwmVyB32NdDkeyT3c||M$jn{3Ff6@TnHr(>ATKaA!t$oG
zo|00AWtp=kVn(DAG&wLq!)l^*YC%{A&79EMp_w#QBP2&+NqW30oLZR~JTXFRQ}V^k
z2_*>3k4Oy>b1GbssOc-``EOis?E-)C{Q1kn%JLivWkreMx=yL#94Iwh|0q=|l|Gf?
z1RGlF+G_kWrd{b>ylUY>Z$))=OHFHQR)VHxPo2_dcHxXZvx_3+=C)p$TkXYq<So0=
zTi5DsY-;niwl_C7wY1e#Cur2Ns;0)qnyNN5Bv<6uH8j`PG}JVL!iyjem&Qiln=1=c
z*R`5uxO{z0MT@_tvAVgbuCdKuT~lANi7Q42YuW-CoP?qkmGw2jiB)UX`fHj+TNv~=
zR<x;TZFNfs>aW=tMA6VxU89mztX&&aq`D?FrKPF8EvQIsQ+=gc1zM$|4K-~Q)fH_O
z{)URyb!rBc^H*;2SJl@+WNJ=TTT4CT7;L}U2Z$#CS2Z;>)U^drAup3~Eo5iH&FvOk
z)zrKxkRfaKH@7rZ`K#JCGCRp4IFTq@+Wal;^`h5Aq~fwIEusgaDH5TUfV8br^oAOv
zpzGUfS~gKaU1N2PXh1{t8cqo?Bj#)BL%0VeaFL)C*&w8Gr$mbgtEjJUs;a<bf|fwr
zZmX*jJtDNO5%R2RsOBP^-v9+yadg|nTcNZ5hE_4mEj4TFTH9(`{LSt4^?}stn#k#a
zRA~Gf**;mGQUdC!ln+qSq#$kd2b7jl)>k!FHTW@!{H=AOMU>iF*SHqbg_4`mwuZ{O
z2Ikhb(O)fQ3`72gb}=?<T54+it?Ps$qk?u+x2e_NT-PjQ)P|{A-L#=GIF(44nCm9Y
zqzfdpH$(Yr{A*k5pnLVLoGy)ke?xVh#lbQT!Ra-PJn=(m!xJ&k?F}`-g<IQOn`y9u
zN|RbrLTg(^n`jWFv^LZ<_)$k&3npb-jmW5MX{xBMs%RAj*0(od9=Fs~RMnEwa$nl3
zxGt)py0W>#Ov5<)TdFsemY4}Vpfahgrmfar*-}@%wuTi?QxhyX1SPA6lLlC^8pJyy
z>ThqZuWJ-WryBZ9O3v*eM94LON&_3fTQ@aU`5}_3W?_@5NJXSX2q1*4nuORSiZ#^M
ziMdtNxVElQ+D)-;_$e=-U{<$-(}}3Ht*MzcsH(OCOODW3;)^^nz10jZ(cJ2nY5tmq
z<~Gro^$m5h+kPxhRW*<rtw3a*n=3FRG_P3zL?{JfL%Fu5v8II-yscs_+fA&^LWXj|
zYDG%|oeXO*WCPRDSRuM3`dR^#Xtq5lo5ne?*pLn=JpGk5=o02xMH^;5w}5IBHkQ?O
zO%ta|v6&M?6`Ywx(yqA;YZCN_C$CCWThZ!o!kiM8XiZB+gBVoVHJX8vyfwIUX6-Z`
ztLy#k^)Mw+vARatFseXmj#-1+;DGMRdT8hx+l48UNzE+~molr7OjDd1R8u8pfpDhQ
zH&itH>%>sg3d2%vX>W#jD;lfoYlH{TQq$0M8%<D*P=rh<CFE_&Q7u?mL55_lzq-9a
zw2ua^rWp=EbF(=(Sa&zl(!b7sTa$DrtfcnFK%zCbgNjpf3!AH^c2eXuElmxkD@1v1
zEftNe<g5AHHc1Ok$*m0y?f&YfhKjnzASFe^TKyX;8p)+=#V7=P9x6mLAFCx7XsLnN
zTZNHTyHf?D2tkuoRg=ReZsDW?t#DGIHU+;^_;>o`DU)UZp0QAyio~f%oH}Vb{Q+9g
zcw0q%UA31^i|U$0o2?ZTE-2VmLyThCs)ITSJ7~^w$XCwBnn0F0uLF6Ji}@Ry{FU$*
zgx;9L3~M6<9+WFr9y60A6;^_@UF6W%)vRx?YpJQG#d!_cjWu=By&{R%HCOrTo7Psg
z3lAYU2{{|!a>Fyf(%atHQd0#bZK2iB3pIt)jS1>)s;X*lLG=^76|Jo`Eo2ge%igll
z-`rF$tPP58!Ytx(4_^5(aT?ni*=z~%(W(x;!Sau+rZsEou_`Lr)WBw`B6wD(sbK=#
z`-!z1CZc6xn{uTWG+t9c-Zd5IuGk}3l;)O(x)s=Im_yHd2;T8r>7~5`-K6kWx7<du
ztE`a~iaug)OX0J)fr{~w8>W^9ueG;XzR0@)@}kWR8JId~+wJD|2J=g*wb^d2uV3ZG
z-Yh^`C-u0ZWo@e*2(uM^WaWZ3N=3Id)x-GL1a?+ooK%94I?Ud9E9!arcxyJofemd}
zRH~5LXfRYuBt({%A2cLZ^X#Z2*Io_lxwfUExz-PJZBuu@Xy>h7u+qDsuB}#)AdFmn
z4UCxC^HABF>E7z58lf^QxRCLTN)@?hCb?v8)3@l<k!!bPAr>>6>TSu{Zo#{YDx<23
zMlYsg6}DQK-%X8Piqhh@ep85;`XUVJi`nTAxkpvl;Nc0MLt(5bh$Gtw6{y$*vm99G
znp)QR*R)H^9Z=)Gst8O7_+E;n{G@IEwz>w>Bx2S`Lqv-%{H7MzM=pckw)U1r2vAsb
zGko$P3IsZ03Q?Lcq>EjriCg<kGld+?u+=HhgpwPtv`n(ql|bj^G8tNlY5BvtH1L90
zpxf#YF2Hhws8d_OJus!p9xU2OS{T8SHa2;&Z85ddzhOOl|A8%jprcXf%;nt-3BUxJ
zRY2721<T+8a;&9A%M}YMlZP4@VLH7VpmWfJ_TW`5(4eSPA=5_EVNS#2u4$~=<YfyQ
z*)9)=c*UyH(s?UZBxuF;^<J#M)!s_D%^T{f+iFQECU_~GlsY&)LAwDX*0}acueCT$
zut->)7A(G@c;SM%-sSUFELpX@be^e<sv`34U~NsP^h{sT)O1978fwh(HJ5z34);aV
zP_fZpxxqV|d(v1_Qw?(<@v!B%y>VS5ydp1eGq?jnk0m>sY_k=X3`l&Ybj17$st;B*
zg1oVgM;3Qb*;YscRV%KbIZ+yGHpmQhWUNMo_X~%X^Ol>UMaW7<6#^<st80P=H<n!k
z+F@B*C`VLED7V!+@fyI<sCkbVR%Am(U0W+hnCCAqUcA!Vv<6j73LBl33l_~=vI^@w
z$f0*!01QPLHV>16s~&Ix)JB!VQd77)P<L*9yO%6Inq&$=`WAi20hVMoMxWb7fHZHW
zp@tUHGK!pl;9+pgZD+{b4``MQ+|w#-7L$_i2Z^+CY>=?6;GHqFQn6sBqut+j&`N95
zj>sf1sC_j9ogtHJN~6z5ZUU$8%NO}gGvmi;PvAURO%FOe4b7mlySb|tExIXkSvm-e
zoU>x(T>re%MUgX?FP^(#MdYj->C~(sN?y>JxY|@Yu`8Ziyi_^yRkMRmywwcIByhZ?
zrjtyfW(1vQs-;*O5sUF9frvSLq#rTI>Qlt*z*(d;K|#xhoLFs5G&h3{0Qs$CDcYL&
z>`Lg-B-0|3aSp6>id779lT5cnRPU$7Jana^Mv-F_F$mD7hcxg~bbu$iAq+|#?QTP?
zMTm=I?E-{X5G*2-IHV498{1rgh#<_l6uecJFo3~z*%k^}Izo8D-Uj>nCR=IZ?DC^*
z0?n;vxXBLTZ;B$IWQbDv>#>)Xaf9H_22;x>nhGa}sI<iF0+d6#(B|$S;L5W~37)c+
zKxu2|5ZK#>v^fH4lubrIC?hsfY<t2RiP2y;N%d=@SJ3xU5=y`Um#u<i!Dkc{X$mYE
zVre!7Yv~60Jz*`9*%4JE>W~Dt03GE;oSnJIt9WD?kSpC@h0{87XTt}>=5i}rwwQN4
zWTaF+A-$`ts9NWxn6OvGL%pO}A(|kyHqfa6cexi3F*>tiWu!RN8{Fmo))m?WcE{m8
znT;^H$-WBv5R@NUgK#mMYeJ@8<Xw(zW_0S%+U0g3#Hg9Al`)$TQA8|bb|@tLB}|N$
z{b>=7GV4~C7c-4wokBrOr!aI(&4`|vPsToYcF2&QN)XcNh;}MC(Ncy$i^AgvfmZiz
z#4V3FBp!*_bv5>0-pWl7UV_$+ICg7u1&-|3;lNCu0S0y){jDXWujT^8W*|gV5%a8`
z+pZ2ullokxJ_H?wtb>FTG{$vn8*ws)IVFNg@MWZ$DV(HGgUXo(+DqqmYa#jE>WSAV
z+l|101_oWSkSb=$Mj_ziqA-HMnkGDU^8hC>oMuzlga(YMIY1Vp(C|{Qvh$V~ZK1Q3
z1nm}zOlZr+0ao>`wC@BaWV8T*%9f_J=wYkKn2+-_Z0k%a?u9puDo`0$99|WY&5A76
zLDe8RyjKD7N&hQUX+w-ifZUwaHc{S4<0yiGVFfKo2S!Y`>9UOzuc57Pu*4&eo0lR`
zSg}wW%gAQ+i>eb>2G$AHI@UE-RJGOJR@b&kL{~Z57HSxA;sd#h!$h{`2=up@l9$Fg
z3QdUgiOQ59nh`Ks6ypmsxBVkVi$l7g-k{+4VMx9dWMFtAbr+68q%$q0v-T89N2%8o
zm1fT)u&jhP-He=@MMD+jO7BXFfd}M<DLesN6K^XH=^@Rv6?F*L2I^N@3qp?Kz?e~p
zp2GnVMvx=yIMQmS<5dpJm@PrIIAWAOK$ytGgZwmj@Wl8qgL*A{W>%pz&Gh0!`%a<f
zVD9GINvIW=Qha@qVC(h^H&EP5!K}G-GxE~SNY;o;HzUo9yOyU3<0J1-k{@vCW~4ME
zmu^M|?o-pnl>cjQM*gq4%U0J4M+En<*igY6?f1pD+6~tAG*lw*Zb|=-oi(n~8pWW?
zWt6N0g2L{=(Jg6Q;h_fu8Y=m=5?v(^)cC*TiX8QVE=S{rOW-PG*tI#D*+eMs!QomX
zt~!QXKPQ_1zg~yqzS~@FBl($^)JSi{M#gfXxsHagOF%L?B#03)RXwaU>#_FStaz-i
zya@_p9O^t;^dIu3Mj(tBdO;%GX%AekjkMVq@Mc5`C(OkT>!IllU;4cyflCs&B!Np3
zxFmr~61XIROA@#wflCs&B!Np3xFmr~5{QKa%!l$~QP=;Mb(sB_NKdj(tZ1HyM?e1^
zKf(RjP+!sb@7a^!ezaHpd-g&T53RN~G*4+>+g#T)5zjDBL=<ac;Y2(r{qOYQ@rcw9
zytL-usUMfx`Vl2i+*sYxgeT|oW=x$iZAxJQF0QxYJ_KDzm^yRj%%UmP`M4X3dtQMD
ztP2Y!6-=7p&8ux|Yi_-A@?<>kK{ZTT+th?N$%xCylkl+J<hG`!dR!5!Yn)tPe_O*u
z9Qb?!Z-Md_R8<yMtf{Unm{CwYV@BbuidjWdXI50sD4H>&YR$BY>NQiQqA7(l@-^*J
z<1R^#-sj-Gq;otWPR`f0IG*tMzk%`LuZRW!|F<Ku@4p(~&Qg5EX)a1}#TjMzaW5j6
z5<EKor$<e5Jm{>TUt<lv;u8pT-l22p?F9eh^Y}XSOMpfvzW6^+N^-`f4hEue{UbGo
zsYqO!hv6hNFK*OehO-GCoiv2#znBU*z1P7=K5C8|b5<aa5|Z(@Kn|gSahc}?@}HEG
ztvR{O8-(O~oLXYKlz_|2y>aM6iNVVbV~{h6ph-@&c(7ArWGW$vPW(6L_{=6G$(h6m
z^}rbBT*}DVZ9s-QS2I$N)*C6#az+yG0g~qIWMt>PKt?%tGV-(=NV;>6g^YD}G4k+z
z$jNjb7)DI5ydQ|yc~WQWi-hGkUl!Qogk9!*RbX#W^YWd&0&{*A*ktG10=t>oRNy=(
zuy|rU-KjaaP7hJebb18FwajuR39OLvu5x+>b`@dQIP(NHkFa8Afxwm!R_ZJgnCk&x
z^PH;%HW>dmu5qoiTwrfb0aoU$6&Q`IvA|g`u*FbS<9cVaz_=|7of`$#O0_I@b_%SE
zuqDm|0=sTIu%*sJ0(<f<V9T9P2`m#sZ>(@0bqptYl7<<poVxBlsU+Nh1mmPbGf3%-
zB1kfsh*Rjx=bpp*NF(m{37w^uxr>F)4nmvVC235PL~yB>;a@_(+;j67{s0np&nsZ~
z7f=@WwMF<ZwKZ)orC%4PXI^cg*T?A@3c4^(AFH5?;`A{Jx;Rcxzgo02$@L7^Z=emX
zXGJ>&?9mJsB`fd<WOKjD-QQz+?#nZRp5*U-Hi^@T+Wnm9*N-Uu`PEwDO#tYVu#oGB
zOYo)EAt|9)8yS~S%;h!{UIH3Pk&;FQc2O$vPW%$S=o6naDlR@fj>|law0N&*1H)Mk
zE%8N3=t<_8>UJ1ELyG%X_~NS5+z)YKCkc9wC_I+nFNlGeN$|r-n%e`w7=o|SY@TS4
zoHS~hJDYMYryLqxr;>9u<rIgPao&J5&A0{MY|^|5?$2^79z%+Ir)b491n){?%R?;P
zpGy-q=_F-5Fh(GpvwKW}mQHqS%n^J!HDeLz@!vJW&bqC1pO#MP8APLDIDd;@mO-BT
zUgn-@pyE!!{R)EblLnO(>{DVuM-aS24Cq?~f7+`V<3OA#q+t|L!Rh$os*?u)nybD6
z34>o1Rlh{=Z_t2S0E}+N7Z-KzA&7dRC2j^tAJ;XB_egM1S>i4eOe7-B<uM*XisUnv
z`OpXq&JcW_L+0R2kEH{y5ynrD7Rr)G?JU)u_;>oo$2BYQUlJTNKaorweFhC>zHW~}
zO*KX%d2}wmWY5QwI40wZTU0Pa%-Rkl49OQQ`U=70g-{O>e1#C|_XwUKg!)T@CwjRz
zuMs>cPxI0gr%&9F^ehJWTjy_wSW(?^#uK2*X4`axAX*%9jHCD-U4cT*9|F>hm+{SZ
z$@ndxY|1fS2bAd~dd+wn--4dC+kmEs4sA^Q1UKr3NJv~KI>d0jn0{oQ5^ocoBatR<
zNa9KRN21^45xpaJiJOHDqfRB>QIuLk1fTSc^d^3i8H~pNjG1_+V6YZ;E^&*1?;yAX
zV~RR7YHZ^6a)xP+C*EDlFb#U*J))(|;9govHSHxT+}W%p{tDda<2pPp&h>51qdDYy
zQqyuNJ#FYX(FYp!p}B(F2sCNvWg?y7%ab&NI>tktmUtc4LnRWg7bWIXCl-kkA0v20
zk|6dBy@H9knh6ki1#-EX=EO%hhXuJ;RKs2964iX0s@X56A?!xtV?L%Q+ne~+GKR0h
ze>R@jy;@XQkn}Jo{sIM)z9=d@11Br#OL>AIFKIjz6j0(7f`H)(f+GngX`<lB@T3%`
zCkvl6S&S&B7mTs$DfGfGK!t4C3Oq>}oW*3Bf(64~p*0T?>nu;e$|YrcJeO^x#GEA0
zNN-XOmwt>Aay8bcLj+$&qnJ)@73NIW(n<Pk|Kh|zCb>?FUi=(Xt}}x5uL*t~wufpl
zeuuA2C*^C#S$y*_bR<2<JjvQ5eO?rcM`w~A@+eG(V*VqMOXMYfj!XDyP#zE^?j(4(
zXh06>-sgoFXA`_fh;9+VUx2u(K`fRPQWfVWpu!LuBr0QjAo~HzAsWrt1CY6Q4janc
z$#M=$65Pp}4I3u7Gdx^yXE<4KXE?>nWoP4i*oZs}PAy=VT)tr=ix{SPG%U@>@UON4
z9#zXQHF4PJW`;+hN5j%LGE6gc*q9D2v5Zm3y&!Rg1P9$HEqG#$O!178wpB=U_!Lej
z`!al*=o2a3@aaNpNacsm5dHfWD2Eq`KDo*OUj>PN2Z=+`FzwKg<Ru1s#O?5ol5aGG
zPfm?XUTp}UoVX<4WC)*}W?b^kMhcf<<Q5~1k=v<)j~iY_sMpDUBhMnMGA1xWdYD{o
z6fi=KORh1BtTJm2pM}&Jb1h_@QKljbRYYtNxH<L4O3v9$&1o>ieqlc$jYc^;;}4Dk
z(qu>{w_r4|^~TG>ktJ6-`8LDnWJ(&}<PC77Eo>uPU<=!1tQJ^iIw)^9$^}O9Pu^_Q
zDwKB^8wHk6lv|7rflVcBtI;Vi?!c#wf;i^DGW?7&O<=cYfbxE$NXgq}_yqP9%KMx#
zS76Nj0i#S{ahb^5ZLAhpB4J-P$`#5-jShh=q`dvc&bZ4-Gst`=KW2EI5}BJQ^Q*?o
zLD;JTV=;9by#kxD4wMItvjQt2>}!U{Wp(MBMw)^hGR6d9UIqJ>F-~BtG~YJz1jb@I
zVidS|x53y`1|0lpN<t43GSq~pkuX+Gc#et`DMg;AB5J}9sYsF1f}a>Zf#IbPTJp<A
znZSNk5A5g0Mg{wYafedw*G7lHSl|E4=v1)RjGY4GVLM~&QLxvI0}ACE##2h(pN*pm
z_7~%2f&H1<^0v{d<o(siGg$h};crHfz(!y#On%2G6BrrQ<adpw3ih6{T419Zkax}~
z55j7Lu;w6aqk^3`Is`V3YWauJDKH+j4~(4x%cs15!f)hu@@O0GLqXV60%KisyN@cE
z$9+<vOmM#(guN;$iNj!bufTQ?HpG2SU~|fWCAst5%$>1e?g9l%b{7fkAu2b*?GxC3
z!bZE73he8I<+@i3?7M_r?k*SDF~aiQwF3JgVOO}D1@`wAU=!RM1vX<nuu1NYAgoit
zCcAeEYy?pjxc3N*Wj4iqNMN*hB~NufB`{jSlc&3n3hdXdz-GEn3hWeNSG!*p7)y7K
zyH~+{?y~};1tz)F{kFg^VE>eSt@|B;4Q>Ng<~}Dda_*8Bx-}2WlRUZPMQ)G4@`!SY
zJ4s-?&a}AG1U7~8+TC7(T}{{~cb>qmCG3;#0)gGX0N56Hk-(Nx-d49yU@VF4?lOVh
zOnG;?mkR6}lJ(v0)iQ4|uzTHm6s*(TB{0_c``iZv_MO{6`DyndfqBT>e#ZTjz}QUR
z?|w$XKI=Xzu%A=82izwG#`Et%_sarXz6E)E+`R((7-0{)&nlE(a=$IGHI(;=TZ?CT
zlB1FQWw%FQJdgIe3k23ol>6L83gv!xnZTI)WA5g7Ht*!%CI8Ot=@6L<Zw7kGy;ETK
zP&H@Vdj!TEeA|6M!T#$0n!s4te{&xa7^}}e-A^gl1@}>fGTC!d!A5vq78rAw>UmXQ
zY$&FAdKGNC=d8e<q?XO}ydAIQkpr4SE0rfj1VuiJMLwkjz8`ra#uxDA{xYrmM8nQb
zo+J7DE_Mz!&@%r6mzGa?ywaU?d4z+*VtUD?crO3p68;JI?nf@+pD^-cmvBiK`H4$-
zA&mUgB^(b%e&#A?u3sUpuefS?7`e}{x@0JE68R**ah(;x!>NS*r%MJF8T-9U1{P;i
z-f5TS(8g2alagnPF7ZfQ<I<QDyD@WI*xZwT(8rU?BG{-W-zez0WveAUBR4?=M9Rp`
zE+Gy^ZgHhqIUjR*E#y`yC?@l}3ap%RDYYDGZ-pwgDphLLs?=&!sjZPx<Em?2wN}-2
zu4W7QglnUPtaEi(NWH7mLK<B=Eu_h{$3mK2T^6$5b-+SeT!$>A)%BExw7HI2NW1H#
zh1}+P*+MqCUbT?hUA-2v*>%=J?r^<rA)j=eWBuT6-|5n<;BxX-mq)?2xsnuYyDLq>
z?s9n*>~2?{g5BdPP_TPlMGE#QmrucVxXKjl)2^io_8He|1-su>u3(>Y)hgHnu4Wzk
zdsr>{c+w1V#*HFU3rb)u&P!gZXyr0hE0;;FWR+enwNfHt7s8sqLaL}lyrSN+<Ufdd
zc~<{X*2^?!WmSy4DND08{gYI1ikl?A<r>Fh!^odqmobt>dxrm(s?W&VQuQyRoWDuc
zXXG81PcvxCVO&9Zfi5>Ee^Kf3_tc5|jN0XAT!WeC+f@2l+30@~@|<jdL<*RUCG)&&
zfJCn599F2K>O?%MPQ;^fB2s8L`IwxDT)}bI$G8HW_9`b_<ytx=b1cE783d;fK^7+@
zXo+cn>ElV_EvrX2#!*2^GA5Z2kNSb+b1usQpNF}!8j2Gg3(*a)g*fD{lKbP78%aju
z<VKQB&LFvw<eb4q8CSsLJH%MZ2wUJRxm}dVYBfi6TjrE=&O6kB%Z*yG^7uwpuv*U>
zqiG{6#Xfv3!Brw|a4*5tB5rVm;2IG(AaRXcBjN@Oubm|-^p5bPk)UWv8WHcYY8;V}
zrX{wZ3i_nxUqL^f)LiCH-A%m=()~2@M?Zuw=OLoB!lEN5WKjW)zje)^UKme<CYMru
zBk%EXMT6nfjl5Sdy&4%KJ4Fa#8vLD+_YG#6>j;*??q-5_h^}(CKb@x;!%)ctu2vuU
zZBZ}ziX)#C^^)&2@~{X~P%B3s5j<#QMt(<xVHp0dh@~<7ln7r?>~>_2h@~<7^jMe@
zal$k5nK*su7z=$iPES<O=i>Asq98Z)dC_QYz)>+i%;=aHABK-l;|?=?LW~u|FI>&(
zdDM~b`w*_hgrQG@H!&G$^huk>j!9hF<Ukc^1(+rzav6h5oFi#nV-rc%^ci#u7fTv3
zgo}|IJt9$vZ5^mb3`Jm$RLy7ymQ5W=yj#{XYN&99Mu}k8!$=;51>cJL>DokM5tlq(
zgnOO=MKTT}CdDORAyP;YlPAak5F--}ot2)ENruBhCL8kbmJLK9JTW6aQ%-W8+TP@+
z#ZfPt*JmU(MYEEhl}Ejd9F<4Cj2v^OiD{5GdKF861T*>uApx@Bqi+<-!tm-e&A1ax
z*{>;ZrtcPwoso@hKd1{+LLyB6yzb$alO;%hNKazqotuDsK^I1b8kzoxE{qH#U)J-O
zjFG*%u&s=A=|!AV_z9GGRQEALA+q#+x-c?~?AJwr>bDD#^O!Cy4kKUDEhCeDKo@p}
zHdpBf^=hu|=zJhg=(UVcU(>&??_`8q@TA^lA&2z?7V;hakcE6#f679h(vMn5kABiZ
zp4MNsknicQTF5hcuZ29TpH-2!RYW)}+_q<R>98>NoGu*}iAje=V$xw@?0H=}EE1Cr
zi^QbEA~ET(ETjQArb~xqHDN!{yF?goGhr|3@^t!c!hWb96?u;k_7nZ2z_`wr^;ZS<
zBIW&D?-dvi$}9R=fsI4VC;gZD+X8!`0@&;NIf1>t1lS*SO@#5tHl@299)V4wa)TW4
z0&80YEY*>OQ^>2JspDx<9!j4ibe9`bD0P>SDN=V?t7k~vl}K7(?MyGyJzi@>d{RXz
zW|ux!s%Uu*ka<!?x$bNArISz4Y+0(WF7V=;YxpIltkkth-t=X<#bG&aq*xqQ=xG8g
zMf1~Fp}(BRy83Z_BO|vF!*acokq$ztR4rbk@8KL4U9D7UiU*|ENtMo{!C0>!!f_f(
z(`U?zM4H45jxshQRk#&*19E=~Uo6hmV+V__<cz~H?+__YMiQksCsWQ)Db6{BBuP`S
zyAH@OX$pQqNU}5qOg2)Q0!BtlIlo3^nNrS9w0dl=lyfp6rTS9M$ODs1CyktDOam;=
zGXy?22zRaosu?%on{9g0*mt?lwD^pDPZ+}&kU92!v5L}Ijy)#~Bgt><d9jNAlxRK>
zD<{MMv{YoQLw4#eYI>YrU~Lp#UB)XYDLjL8dAh~=GFeOgD{|5cJtIBoh1{lx;C7@>
z5pCkJn*~=S6=l<BCyh%=pPiab@HH9=T*C#pqB%+d9}3JTqEf20)FPU%rTQs-nKsUo
zzASYe!7FeBB3<kx*vM9EsoN=ijW#YWeNABTPhT6Cl%!c`ZQM{@LF?k6uc8UGz@%e-
zGFz^)Ax<D9?er#Or@lcPZugE%O23`SSjjhQsTU}{Lqj(^IGtpizE!DryBHJZao1q$
zbS`~|M@zkmB==b={aLHe@@fO~epr-d_=_M(ZJ-k0D1el{VU_r%;I}vqc~1-Yb_{9y
zvuL^TC6p)xpzX=%k&1uo<v0?2T26_I8X(`3IaEc)GjbM?C^DYa$M6iLMKt3%IVEUq
z%6MK`9W#!}#f^qG<G5Vh7&##qx0!2@^MYK@IOj#ZnX6`|-<Jl11e@^#y@PW|n=(%7
zJ2j&cP3AQ|&yjJX@ImMlJ7cv&7#-S~W!&TtIWu7aGH!OnaUFGp+~V*sLW0crm_ux)
zzDPNK2ebqqM#>#&j66;`RSq##$Z5-{cI0sm>3T+uqks`^Uag~u5$;mG!#8<Y9!T08
zWd(8g=B%M4;&$0mZo+L2X)NiER>nq$a1-c+F=LZsDHl3{)g<F~$7&1N?5MSnI~*Gs
zVc~t!Aq*@_;ZDb=Ifof-aqMK|EAvrXhhq;T+|+v=U5rp9F{9IQz{>fQ<7Erk;dqsi
zGqXYV8AmT8JV^ID-sTtuBM&*`lF!&4N0L5ebUsRa!Qq9m#1EHyi7I*6AtG)Re9ZWw
z14<SMb!0r^kgNO~3z7L{hg{`Z6ZbmgD$iJ#W3C7<F!rcJ1}TOtL%GKtGDwj^g8zzR
zwGQpkG@1z+Uv+rOML}-q0mnIg$_v!eZimNF;K2{KltQ5y2j!5JmH~M}A~#Z<Uy}%(
zCue*egUMaENP~IEktEy!#-4Pf2#mXa*pVhM)|~G;ytsT-0$rm|X6m@OOtIZrfuu}W
zuEdYaJXdxggg2-lvCS-zjuN9Ve42JQl|VQkai>`#$0|{1bRktNk_Q2~zlpD@R7}$|
zzAAUfmrp?34@k%VS@<Uz-SXu3*MuCDC%=Ct<O#VgHx>i=n%tJB6Y>qYEuT)vH|4hc
zT0*`hx8*g2d|NWzLdcVHTfUo+!*W~x4ML6>Li?HQJ4QK=%t^}mt|6wv9|?KNXyzP)
zX3W!um>1&-dB*7AoX=DOdDak<<g0`{XNY;Rt_sNWhL{(hCFH0f=EXM%IcA7?agvbZ
z#v!il_k^4<o?_(d)j(b}jxzEiLcVXDWQ4o$k|E~OyOi@E#;ck!0fHV~j4vmdVJAa0
zRdI0>iM-e!_0psiTUu|UFzB>p_BM&de&R&H&0=Yw^4|4gfnQDOEnY55m3v#oPWA|;
zw-<5xF@iU)W;kUM;7#QWla=${Udu4q2k+))hDlSscWh*sW{mgF4h!D0(}Fv?7*3@6
z?>#g!$&1wvAF><XyRCK4dk-eO=w?!u2wf~jk*v!!CSSoYwz$+sgL1@f*gGM$7KnEu
zya?~a)HZ@A!71=g;$pM|^-dO52w1M*<SBX!<=XxPm6}QyTL8EzM3qioyczcjMxLCs
z)Sn?2;gpe{oKYNyiHDeS(y?6si8985YtC5aO13vgUZkT1J|`0iTHv}yc7`zuMco<r
z%0-6O;r+ai3%*Q(e@HZ!;XPt7-=Op_2+u8kGT?{Bz|JK2OI|KJpWsLGEcnY}kXKOp
zUNOkk1a}EucM|+)8Ph*U@V=!C|AOHCLJ`gq{8%}sUm*DLTFv++8Y3Lk;t5bxp`(8a
zB>n@CGY-U>aS@=KwAUaFG!l_03Nj6UQE6u>h@BI;$P|3LnfmG=YRy;(Jd>vdstdq8
zSu~@Lh{@=RdBYG%9`}DJ=YD)S_uxx29>BLSd5-`RN;J;RJtV4eGOR{j8;2O1aRP}-
zZ)x|Y8Lv`e=rsKcC9+8Pi?TJtf$5X!OvJb3pA67Vtc|gNhJr@(85y&zKy=2HE-i_Y
z*#)>t#&k&^Gp=@7G3|`mGAhl^!8I-~mq~#6&Y0uMV<h7mAU;<CBM(5x8O1X6d&gWL
zB`zQ5d}}_CQdb!x>;lY{(OyR8$!ISl*UDoT>S4xwdF;YoUzt31A*p99a0$c7Yw&fh
zFLBkpwk>pZF*2H#&c!ZaMJExm)FrGaFTcxN!iw?=yWAxVC!OnNtZ)g#xrdOIu2;D>
zc0yLUdKqE=<_39cvX97al&2>1uLp9IYqeNwuUZJ~7FV9QiZY+DkGbT%7;fvwUGiQG
z*XVc2doe4BvfNcI%8^ycsCLx~jGd-WxS9pVUO=;JkAmIi>Jk{)*o+OX0|H~I-QhYU
zu#XdmJ6-Z}&2I_Y>N=-T-sRH76%Kt7^6qtc1jfEZrz^=ts;3R2y!%}~pMrkY<?9eA
zds#bO9(mh@A`cn6T=ISicjEz<yivl9+vDmL1=+FuqRWS1E^*=E`Vy`aYl-i`&7qHL
zcp~{Y3=R#r8`-0cq0mnDL&`FK?&h(gnV<0sx5fzbdByEv<W17#-?@_*@k|5qU+y$U
z=<;tyuiMMW1j;$(&SRvAkkf9V@H`dHxQjT4CG)!5$4ETQi$A!_EaZ<Wa#kY4iR?`^
z=Pecavx@x1U8WiTjV22NK)jvQ9bwu?n{fXftrOX7jv~?&f+o{RYp!O@28?>}apumH
z@q^tnv1Am<9U6%~_bRzVdzx~tkvp{S6H+X<UTblcC$~fwvx@|tTPlNpjLg-KvLNWj
za_&4`Otn00)pN^a@NWen3uN$*=0fguGWbV&lDk+x%bIX2ks(ebylAFdrpquMV=MJB
zB9CidWd`-Q`Wti^)FT6%yGEDpK4W!yp;E41m(D+zYcNB6%%M@2?mlDd^@XC`U#~=+
zExL66M_vW2U6;;3jZN+r-Pa*V8QrFL3XH3{Ti+Rk?N+c(eNPbfC4prTi=BFxg6+~@
zRVW|S<z|36JgCdfz#1yIN0*xc&U;wT6XuGsFY6No#$%7rv%r=@*K)gbpTOt|vfRh@
zGJ!on*jMzW0=o)sS8lgnE3kQleNAr`7@4cwZ|NHa#*#RqcL<ERe@E|Bu&4D;3v3D1
z@;!a0z^Vv)PT!+YK5s@|xt8PlV<NAMC{O4I1ok*#-`5W*<$hqsXb)4~Ni#;vwY+4;
zXju}!(q9(k7<<)>(Vn1k|7k{LX*J6IJ)*MOG^&C=ak)8q7DN0kU<boa@x%u^fknbm
zD9_D@!i(q7a>r{7lg-J!!pAUAp$WpJ8bq^hqHw9`GF|SZ)p&LdKr+=}j0TiKkoPjN
zQ==B)NSN!Pi|CiZu}r)c0DUgMf@#w(znt^Q1Ye#fXsN@O=fhE{H)|})72!8}z9UzL
z-=0Ng?o{DG{*K`3!h!sN;F(^obui7}BH=)eA$V4SW*i5Bc;<u5i1XL<MS7wcWMhm|
z5wgjuIO&d=W@xA;(@7#?Lx?2<3BsGAM9s(w5Wuqs?4E)z?rT!sXl@m`9eHC!U#aH2
zvFPh+BBdOo(xlJJpUd<_lRr<;6Oa6BJ)HhJ2=nI)3ETpEkY6SwP)_gy!HbTv@~=xz
zeVS;m_m1@BU(aP}D&#K|b+!=wA^|@_@M7x6o7ABHHrwLOFW_=CrulLNE+^V)qAk}F
zJVUhQHKHlPY1ITI3em6tuLg?epYZLbJ{s2tvW0U?*={<HPh3YJJ|6LejiDPGsMH<!
z5|Ydp=Vja)d0s|!<lhKM?jzE#nxx+RTdaoPDmux<J}x$xe+FT`UlC}z=mZO>0-YdY
z<2|!F&-htf9j%1puM*V>I8HOhz}96mMvX7Zogl*UJf9}Y6>c8c!$~+?;EohraT!;4
zGg7a(9Gf&c2<Q3fkUgC!=F$Tom?-BGahRAcn#?c`dW}6GU`NC^p-8YDhr9{1BwI$V
z)J2?dGUb@7?3ILEEsqA~5i(mYxlDGAF1!-1V2+G~GUC%G@G8q>#Rz>-rx_{Hi?o2h
zG$AFCc9ry*Fv0?dTHtVF71**o22UCu5bvZ^OT3fDh|!{`-=qxDb%wnO*#Dq3cRek)
zP;~tTq~uPKU8e!eohp3_UJ#~%%6JJhiLc;`TlRfspElunX3zaQD%jIDWx_GRp5fyz
zrpbjNo^Zlom}U5aXckN0#Uw4U00dljQsAk>?2(2Kslr}f7l2j*a^Hk6<Kuy}T0o*r
zldobP4<Z3|TkvebkJGOKKidD(XYwqArkin)D*R@k!X84O3!o<fO=kuk*HJF{Ur2Es
z0}*XKI48;Vf|c{4U>ye+()A*y8IjLmh6Ru7>EwX2-r}4u2e3O2Upy#pXZ)u)Z+~hI
zoX_7G8tchPLVhp9Zm$sXnhd+WK}fF*yT$o{oRVQTE^}Ij-PlV$Bg1YfME1H2yX6z|
zh77wg@&_4qW8{xA?8eAh8FrgRW!{uwx7CFF$*ARqwh;1`47=?j<j*qf_9!8LkzqG(
z&VS3W+qWs_|B+$06NLO#hTUEz<Zm+U#yNkNVK+wJkzqGR-j!juzfqa@W!NpX7|1yp
zcDs_0^D^u<27{jQfgyH}GYI*o(aT+6<X^^F&3G2F6`OqFkN+5Wri?fICIGXWuNi+L
zVwxW!diM{Yh=1T)sBb))Wo6?T^Z-tE%Q_|nCE`Kv0A4%+M2msqIcj{1I&TeRa~;Zq
zPa6U`yweEH{yb%q$(Bzoeg(LAf>9=XmlKqhoeWgS4^dHbG~@SyMCPL8yiYm&Y-*qm
zb{g0#a8kem58h)qLTP9wsx)(m<~n>ysV@O&ti+d?D}`f)0i!8cm>~@q`9p=7(n2%h
zl}4G7ENOaa=Tew0cU9yV7Usw!D003E$LY<i4b=X^T)mT#e}Hr0W%8JsdQo_}Jf<dB
zq%cqKVzPTmfaL23gjw(u&P}C<u?y$nc(QOF^<ATLsKRT7iJ)Vs!ubOB5glS7OthAe
z>*DZGBmnwM896R)$_UQ;7?P$S@DMl%n38PW=PI0$#q|6wJzCM0vceNw`~#}`1;K{l
z7ln0X`1@i>XZQ!wOC<V}UaRa&c^3R1!q*`)TKK~vPG|T>KI>j*VM*dJ8eDu_W!6*4
ztBowAih04B^3!n`>lg5a`wx^ux43yX?7W_e8%y!c#@0J^5OX5hse?sNXb`3*i=NO-
zoSG_navus!Ma0&)AAp!TdjPo~!51r1S)p_S#>_<@OebIhAy>+ku$Yjmq*gK6)pFfu
zWVTc>My`?TKH1sAIa1#iQ3Y7)SwkubDb;=Oe*ua9lWuE9A>jmyUh{%$T#Lj^ryy8P
z1h?W#P6-+&V=X0G#%BXi%^+nmwgPnDgD>vr(!$5Yj2S);4R~D67;fiRWJjT<TH#k^
zM;SRFJIZ9;vZL1$*+JRSUla0#>?k8&lO28eTI76P&N8m;8+w^$j6?xt)VbySB|@|_
zg0smbf&Uwv$mHcn(~KH?bN9T3xW9!IjWP@O$nH_`!Y@c?j**9DUm5w5E)IPec|>-c
zkuU4kbBu+1r4%@)OCO^dzYA^<83*TIxk2xl4cb_^Kxxo*vO(l}6kadez{o<$mXSr0
z6C;bIyct;{<;}=aDQ~*pS-4Efn~@b#-YkWcx(IVIvPxb%;|gw&;UPwD)K|0Q7+I~C
zGs3mqB+VjMaI@Zw_&)|!8ND}vYQ~@N&4X~LaEItKOX}0I&x!NV$_L=cr;i3CeIKST
zD*U8Ef2TTVThu|@st(#Vb<nn}gLaoXXm?9d){w;Sk)r$xHRWC@N=7<$+;Ac5K_AzB
z#&<yB{vN*ASg^gxo0iV@h78g)xf`YRWZGC^Z|D;1v<zV_U9jNOyy8A7J<>Pr|K;vG
z;HxT@xKFt`xhaG|0tp0?3j_&83DQClLJ$E(3<{C}LMS32-UJE79<fm@Siz1R8=#<K
z1+1v3*q+$+*?lUu_mpS*X8yDH?%tcjeGjki`~AM}{$MjRJ3BKwJ6q14bM|x$$)FYJ
zodqF0-Sj5eUJ-G6#gwFWrbKHCwrdAQ+yHA&JR>L@-ukxiW$_kn4!okg#cfmgs`3`!
zcPM;Kd5cHY!q=69u&etw<rB8P@C_9zycj6lr2+!Tn<^k6`Yja@yc<{ewt5Z`0^U{8
zfqnY-)uS5R@`WGR4G5w--hls5&7jEnNX?)S{jq%+*iL4)Pt<gJHY1;^=@fcCQ%`+y
zD;0jDwl5*zJGFg@%Kcz(r{`a(v<&lSM4@F-=+Y>3Z3Mzim>Rps9wQL{tz3(B!Y|63
zKz>yn?^i0`<2U7|;Gu;4Zr5QWbiiSR{6SlhRslDLiuQtB;!!YSYDACM(8|lW?CUaz
zag}=fO=5~G-eZ@{VOU_iDKjuS)>|?I1Ae<3<Y2~rM`mNd@5*e<?b+kKa+?20Q5TN!
zP>*}0s!(^Ys_G85W234nUxxSCqyh&P-bYXMc`p-B>fa)A%6jZCaxga>pyUAQuH*nI
zRdRszPyvX!@<4Oq?5R2>a(YpxEMSwA%g{(W?ZTdNrwnc1OWi5sC0k+dlprGMB=UY?
zpOlbQa1KGH!&ml|MZ<GM@2eIKyra>#NjV(I_p$n_H||+v-==k-v#!3`OQjQ+_mNg$
zA}zF{41L<mRWBFp(?PF7`g9ECv(Nc{OP~FM(rj%;5mHiSJcQq;Z9C>t58(rLj15St
z4R21NHgxsM&Cb7+8xTq5J!Qx5VG`R@?Kc5d`%P?X&%P2#Jc9L9Z~SA$)KBWe(bjXI
znD;u%8B}I@TM1~*T<%VS)FO=UPI+%plJyBC{42}L`c{D{4;BYg9>`=WYf9NnynLdL
zF}U@U;|W4U?bnmCI}*^53zYZUPa1;vH~Xpm&7+u29s9x(`*l~NX?{N$lG*TnYDfk{
zp*k!i)PDx-U{m`aD=o#${bx$++(451A4hLa+(iKY`saA}5Lo1HW`f7J#JtBTk)w%*
zbR!SEf*kHq-aDMbo|P*;hAi*9C=u60xJ4{E8Ka4vA0{)|LrjDWNSB>G2<lHca<Qqd
z$qtLMLMZt8NjF#SNY9C8BPYsZd1ps+4C0lIiE4*-qfZX&vAh@dlH>ARWO-ltWE&bY
zj)+t>N)%7PUIet)J<0>(U_veLU`oktmQ`8k>H)ft9@9j3$J2f(YVN}Wex4e7@PJ>c
zS}EWzc~Ff*c!VxZjYB}v)zAYZL#?Lx;p4*Qv|vRi%N~%1aN-M@0qGWCj<*3Bw7>HO
zu~ID4&n{fx%Elo**h^3CxfVU<woqPo;8#xz7rDk`Zj0TZCH3G(0t!!dvr#E_QQ;|W
z2nZfsJJl@#!d;_qi7Weu9NC3uxpGm#E-XCTEe9L!QJ>=;3<Oi-xvne(;fV8Gxx77N
z3YA&vE(Y7+8bX%2tAX^MM#yq^4G>-x7M|~J1%l<lh3<BZT<q=y!kw$|a(9<Tu5dpG
zf~O-_yFb$zePd_>$)f~Kx~uRU+3w=$rjSmn0(Zlagq)|gyRKqnsoL&(jFDw(yX##>
zmaFY9AS={%*VwU?LnmcG+73o8P}^PqVB|uz-38<#wcV96j&fG2?XK30T&%Xcx-)W#
z+U`QmrQR%vuH>A{)OJ@bBbTe~uCp1rLTz_l$H*#gDat%wO~`7s-No;j6ke&eyYeRx
za+N18N13bDc2^1KT%)$TQn}5pRoh)%8M)4rmN|lv>pf|iFe5j3J1y@V@>6SWc9#Ph
z+b?Rv>3Yt=J`Hj({P2w%_d&{_8_-n7dm@&Hf?sXX2+!Z6+20f7RvpC!e<Bd=TT-ar
z8$eeYqq;0YkX{*pKPsq1;Zdq%BDTh=j>+R<;W#^FdBcgP$b|y#aV{s8cMMT;39w2A
z%3_-f3~VbsldCaM?R^6-%5Hfv6&M)G&kGI=QOzvt8OGHV{yoF(rEFUYl7Su6HVn^x
z18D{C?I4cSmnnhH?1N-FWs47LF6H<Dw1aYJH28^Ge~q#ZYzB4AI#98~BxY?-x>7q)
zB2owCf%T<g%Nmp~Qn_CbY9&(^;MQ~lqnb*{#DSKZO{nFCDTUj!3#Uo9x`Zf&(^a>E
z+h=$|D|Ho-``*N5=vO$!^VSk9;#iVAw18;|VZ+^DJ?8Z?GqM#DOCPcf?^8;1Sd{lI
zXQPQ=78u!qmX}U_z%W=|Z77NoF(+^tdjBCxgp7j;wfeH}_*eLX>y3+LfQd-hVw$$2
z*$5aRE{hUTEl8G}o1!^UqPv-BwEs&f+_|$bMMiX{7t)E22waSIsR4;%-hwO)2J&@I
zTA&07+h3R-C<DR{Da;6z1HmI*nE@H2k<%nF0y%71VOBsM{>~pyNYg+ia<J0P4paeQ
zgA1DlWGF}LHV-UD4v?Hc1CV=JK#RaqAlw>-d4ZK0$q%dsl3hhPtpjU-Ok|`WuolR3
zM-$Q^u%R?m*hU<&fXA)2$`N-lQmBxBF>m{TbwGY$k?_J#A(f4qwL^y2mh8&qCaWAQ
zH*NU3c<@0w>IV;!CG~V-99%B%zVb49@Q`2#-K3T?D(E_aAMa5s{en}72-p_sp~3R1
zCaWIYN2IUif_<e=anlW^=JD<(qJ;4S1fk_i3xAPHVA}oFti*2t$w7^NS788G{}ITB
z+t55#ioA%0$F1y?V94@XkZ)64Q=<Cn%d$8a#4dlumEbypkymMP;0+~+R-_a~DlErF
z36@twaO$y?K-7rBzlo@iiBkB6619hsU2YIIrEy!msa6@S7<tRhM-DW;t(F`eIp-a<
z<mk`HyK2dCC?oHwCC3a#-gnDs{X<HmdmEPi&O}^2NQcTI_SW1VTy$!$knkb}ci}wt
zrBsz6%Nxu@Uf-&!AJLe}<pWmf`A>*~ZY<FeSD|uQvGF5%<!Z%tBQcg|NXv6%mecN^
zcN-DW@+cN8m!W+dv(g2<_jDxN+ewfyVe&97k9kFBO*OObVMbIPqY9wdgr5JTSzW3u
zwcVd_%*OnZfef%b$;urO9w01l4CTPcl|$t1VP4w}DV3<^!C^>`5_An_A97&10UvC@
zBQ)G|l!kj%YPk1U4fm<iaNkK9E~^2|ZWz*U7GUlHL;BZgc)()7ttS$FU<2TPGknle
z+W#T|wJ8}QFE~I_3#koi&{A4T;7pXR<I;K3M4;#AgU;?9(kevzKg5uFvKD;=vf0N&
z#);@HEMl^VevRQ7A`bMhi2H=;^GV#31V}TXS-2vW_a>!9u0i;cxe%%b@ed-RXU@u5
zE<KZnxSSQLX9782T`d5)Ky_0f7rC-C4P>S2vu}+e0avI#%T>;~M)g@B*Q!1Xw(C@%
z-7<;TZcu#|$c^eUfycg_Th)~TUp(d9=2l@ifPg#P8md2)Mk8&lxDcLXdnzsxPnJ$5
zcx9mFSHx6taWF5x;$rY{*Q&V0$|qmpxPppHsSt8_lcnPF5a2Of`U(j~p5ZH2RkrMN
z4E<eQl^3j74IaLiRB@%01$>nf1mv0;FtO<s*GdHPWnaa0+%GI^A}hFFqVXvjC@R*}
zgAVwHg@ETV&n=4qvkxooZfN;18?j|6RYx9iSj;?It(LDceVbLBU9k=Pw=n&2F^*Ty
z6;Dt#Tkc`5=hx(gDxL?|dgj_;wQR<JU$BZp6)%7eC%q)4-{HKS?E0($1oE$<DC-af
zrp%5W1JJ&ecQjEkTxHFSu(pprL6TBScF@L)gEq^rI9eMzUR04ot%@p%ejc|fs%Z$k
zBO<damkw1(FGr)O=YVz+M+N;aU?L{ifW$@iP+F1F?>EXES|B>ukwe?i^yScHh)k-P
z1Q}x|MmF>njGf$*>40?R;hrj^A6Alw5>4&9@c8bHWgfl81b1`|XnFG~yU4}OXdZf{
z|Ah*Vmj3q!<ra=t{SPavD%It3Ybd8$^)l=uOmOA?k3wXcWOaoT-8NR%-$@kz4yN0(
z2g}Cd4@BZ&HtTnlm)5yBkS5RUHLalowoB+@g=?yB)(-X>@B4w`BBke~4yJ;sBPl_H
zt{t`r&gM=yY_T|-4II`WYbB2UVP{I?g1$sXP0-JhVGi`OWyA&joP5Xx{am@00{y%Y
z=xp(@rNw|(PbGL+iH4V#YIsGNhR-k8@C73P=NC}fiz)&0Ff{DqDh*#!qv1<uY4|ef
zy&QDIR!J}A`D56X4dCH7?T1~p6!41-U%j&BN&NTP)p^;&t_7XjY}j=&81Xu6*!AQ*
zIt`fE_;*Mvcs6*5TzhRM@*y;E74S3ch;urX{#hbQ7{5vo_*V`S@1P}&jo@KwBN$rM
zMsPmurVJ~VmMCVp<4Ssyotg^rX>+%fh=3`;nNI&GN(!e+)N*esoTj3dTcdEgidrBu
z)I<T~I2FP`W~mUy^}uX8K*PI)6iE-m2IY`$)VXAz?Jl33ZA7!Yrzu61XAPIf5BP#`
zxO(7>H~)s`1>tDkiyNLV)nxs{Tj_us-dYFT@B#@qlx-sc$0iPMD=y_-xZ#B*kO{a*
z0t;|x1nBIO;q4@V`2ODT_BEDQH$752RE$SDm)c7$p}0jX?=t4WGE4Jtbg4&HH^yd1
z_e5y_v$1f?`+Jm#OW0otb#cASiRIZdR9og39we9KXqQ3ik{rljPp%|@l&fv8!Bntt
z2o>=TCJ5dy8zJ802Lwknv&0Jwt7jfSZy`LFQ=t(p#mgMWBl5(XH!wZF8y)>Z1yykC
zK&Qvi?j;6^57g%wLe-L%o$tLIn+*?Qh0Dgf-2OO#+4BA!%ZQC{_&=37y;jF6zmyg3
zXIx=*Qdd~GW-L(`RX{qM*VbJEC6+gdMCe6(_Q>Pm5SBi2t~iGu4jFlZjEff%_sB3!
zNS6|j!GTcjj2y3vR7nvOuMV_)gxMzq^Rh=yXt|x?i8SetoCto1Qj;PF&d4c2J+_RT
zMq>-u*zA$VN)xo2N$|{)Cakw3!^f4--JR$}T5cT0<DymQ7^Z>5mpX(Jj0I~8)ot=g
z$5CKJZj;Yr<P5cwb}l1J)K1#fj708#-^s{%>Q>uxj4W6C-M=w%fx4sFbrvC)sLk)g
z7`fCg$7*mYBbV8-JF$?F%k4_!EMepdbr<v+My|GNWCh8{we~C^D07`%2L!fVZ!ZS&
z3$v|JH;Y@$CgetYDRN2~xk=qD9>&P6>i%$;k+t?3I{%&QmvF_km^^m3FiJ#da*pM#
zh!S}-+7-?<QKB$yh~g*-PQJiYyI(K)WMk>UVFMobXJS#S6&C3^R6S!w1Br1(U^&ME
zt$&!ioDvs|3>i-*EcGghP~@UOR3&}?hf8tik{k|u%R42?YI)}|1BSflCaro3?}lhm
zD1>Ar4^xJ*OgS{Y9pQ1eC%yN%G%k8jW;d7V%ZBmqFvs>RYAC}p9<yCe==}%EQ8npG
zpvwupA7N9{J6b4eljR*6B~D>>G|z05nL(*c&Fn63KA}a(x4bi=S<4902gMBbt|VLx
z<DE#@<ZdLIYUs_({sblbYjbe)Y2h}ly;q4UN42P<SUx5~yeP~kXc3unf^&#xD9KW1
zyyP<upGDQH$Ab$x+Fl>Z%^E@p|Jod(wYSkHc6F0sA-~`vxhGaj>;)^yeFblgQX@N!
z<_$!JZ~9)W#I@Su6!5WNYLv-ZtLUQ&inB+_V8wTJN41hcj4Lv#H4U535nmU!r>x*4
z(a7tbf|J#j{x6hWaEcm;_}!L*Q|WO56v!^9mjd_DuvoA_6(~BMkcIR>kjF*6&V<5H
zDoVe@R~N8jU}PX7W|@d#j}|OfVrH_K6?VX)Z}3E`joGqvv@GXNnQK|2^R1Q_66fev
z!Mu{u@{YiDjJLOnOGe9WWIiWxw7QMV8%CqmlRbb7WlaOPNM=}`-$#eUV<_7$Brf}j
z1$U*ZywS2^=JWAJca%JyPDiUxVXS1sN(^CL)P{c<XY^zN`;!jK+QIk%B7kc-y1T5l
z0GEno+^I(QQ0oJR59CX4uYronwbBZLERRnn_bw+8E(#uTa3)c$`-yObdSzxC!-vpQ
zrws7#h~ns_XRw9$GEvb^Ss$wWl>BIZMnS>PL`AE)q9T9r@JyD1P1cc82fpkYd?-D|
zfRTVQD+3<K9HJ#Z=R`SZ14k^^I~Jw_APXGX!^Gjz3yDh=INvC6fmz@}Re+a=ITsOE
z0nf?GJbcavFs-rHo}jAb-5Z4-i9%0Dp`8RZ<@$W!=DaUzxf|qspwt5S(9t`?Ie%9+
zu;!eP9N8J>jk=sqoDk~9-6H36rwj;=?f!=&vo1Gq&Nq&1$N>4#ky9s8=AVvCw8;6{
zk%^W^-<&<p+<t5&kbp}k+1F`2h44a|h*2`=)<ZQcOjGxQagt@GD-$s{SWXjl$CnQl
z%*j%Be2<(*NDFrt?UK?lDvT7kL3zz_0z0kHRd03TNcE6gE_o2x-mMc1R&;b13-&up
z>Et#D7Ce!#F0OhVvpHi2y6SaI1Vv9*y@08(HBwGtYh$nt2G+~nY+$|Jt%BjG`96`4
zy>Wo%^o@MbO<|u4r^3FC!G1O{`i7ajk_gVS$miV@mK~F)Uid^_zsSel6jowz_KSS%
zP34stdHr4W`X}=GyCWnIhnf#?D+NPW80xMR>^Ao2Xji?e`5I$m-POj|CdRvK46Mq%
zS+Mt*v)WxN*yoH*ayJOZ+i5w+xSI@YvU|T^b2-$fx|<_|!<g1YkXOjZsEs2&;eHIA
zER{8c0RA00u{d~SHTd}4$|Gq5ykIirq3fz+uJd!I8Dqe7a}1cF`X3M7ImfF02V^Gg
zkYNM~<-8=NU*OQ&sY>%wB<E#Ec71@n;<SnkIX6lH9<_3AQU!qA9O>?ya|>~KE_;V7
z;x&mteG3WVU;fqh0m1y$GOy)O?eecw^V(=ybmm`0^BM-~@}p#biRYZ7)R~`vvt=d#
ztiDnMI9KK+z%4^?9$<A%4Y;^e)Auj43O15aYCMF}?6LBFqu)Kt8mqo<1h^Yb+HXec
z;(Zi>^h0SkdOs5p<77!N=P2<NhQ_hVSN-ObQ^q-RfIZhW=V&J=7{*3A$%`Hp9!6ZS
zs9ZJFn0Df-Nt7{$KNKkKHzr5OS24MT@*wwuF)h`K<Ppwkqb`jQVuiFk$-0He{2SNY
zyMw^2`yzO=BDv_zdL}|?;q71!eh~~Ma=mv5&tX`+b#!aElLxb-RV+L81oI|nDgj`H
zy}_LJGC_1;atErt$6rYB_K$FReWTEjD0Em98W)A85R^5C68?>!m&<<|#!I`hA>(`K
zRm1oL<w6+ro)R}VQql2s*?D#2d&Bri3kg@ZNFU?8fpi|q_<qRa`F?zVk;lhRjUS*+
z()o-Thgrq><K-)jvsg&Ep?HWWp3n3OQG5o&Lj{IG2WLxxUJEE=6kThNAEC9Xbpx~>
zD#9S(Fm+bTY%Vm87EI&iRu4?AG)x_1RQ*WNdM8_Olq{G4k5#L$`&rmD7FGodcm+JZ
zT7>b~HvSk9@E-F`rE?6&Pu6@>gb!tEXkmbyAgh|ib>h)io{JnmQ}R&x<5WF*Fk>w<
z%3cP<sJ#p@o*=4uS|1-~S$fq=8`8|ezl;fbZA0;~oTTz^e0o>@6C9rkD<DuQhN3j$
zr6;iP%c#!UrixWfDGpXmK@lE*t7vE2dxP>am@#BmUx_U4-PKo1op`NReS?_Fi;C(y
zWHbVNX9@TL-%|#7^&;ZgGy-t{GYEdTQuAzEtl`I(YX0X}1LjX?RPR^=_z*7p`dZDu
z>*pqHBoE%zZwKxEjPU+%^?O00dDoI&)Z%ly`a_gDdog9IkDc-OQT@qg(AihjySHli
zrzZjP$L6Z{YzN$twf}pkhJV?GWfeD8b&CCgMm+mtAgF7aIy|HF6k^MW9G(I9G>aUb
zfr_<`9FT#$kgb+WJf&8*i=0=%gJ*TItrj}`0Bdz8d%JoNVsrIOSO<U4lC~;5iCB&g
zg1+f=g2U1!9ypocc_ToF!g`}k7Sw<auc*_&P|MTg<{Hl~)#pgNAud)l@WqI@{=(o=
z6ozdVt)};1$pTCjmR-G8#_`)&`R!^Pe}s`c)HuF_kvr8m4&*NNuo#fL)fN|!b!v+X
z$a=NKwTlJZqqexdXXIYB#RX)e+TwbGLwJ+g;`*K0?o(S_IowY7+p_Wo@_;QX?_$o`
zthTs-JgBy~V8KIbiwj<RL~U^)G@rB2M?3&|-o5|`*j`kdU%Ycr{gT@J0`iKz25bnM
z*X^}H_)~?|yX*}>&}#455`-VJZ6Dj8BL~PQ_P0RLaNpSUWaeE|&DPxRE+_QdFm(oR
z8xz?UMSPj?A_c!2&HEe$zNQqjoc9yBgzA!Nk-!%%YHKW?h(#_4JoeD_f0RJ`KLjHp
z8k$#kR}((htW-q=Opd&w4nOr#5BYMBuI^`NHzSc2LT{k0mgI29VB3;~FGN&C&R~Jx
zhDA<Y*-q-KM?}t2d7ZJt?DFR3_h0EslDbx8ZQ^}OJeb+HR*w^VQEH;G5~-e~!i;Zr
zR!>u51~ZOTVFu&`dn}p-{c^sFIq85Z=3Y3J1T0Wtb~Ja{Q&gB8&&U}n%!Z#v2%TdC
zX_FYCV{CxTW8_>FOe+{UPX$v03%F1P(^ZUIs)FenX1m7TY<aJcdaN@>WIc+G%!;y}
zmC=OtWIZpV39HH4A)^Uv$$B9l{46T#r4V3tM%J4pfI0fJJ}A{ZAC>_gLUv?*Tu$e|
zQ9%hL+}xG8naV^4<&LjBle#dLh-}GONjd7~u#~@nS+O(vFhPx8Qr=2L)OK;!U9bk9
z7hNZ{<vqx(^-^1wmbF1@%R_S3MyV}_XV#{2l;vj3x^DzvzO9sXe-&VOVRH>&c;UfW
zfEzjx&qH-|{v)|SY7Qgi*~y7a<e?V5(dAA}_rI9PukD${bE3u3yO|TWsOYo~pByeN
zbuODAhbg}`ioW_YR_e^N;)H6ca~jQf6DCNV0Z+_tL1i)DPMAdB_YOse{RzheOX&PR
zDv;HR68=r-TjYiq_ITcblY`Y<AIrkDI*C>{Y%eYVQjDz|`l`ryDkme&)F^a(1S&X{
zAa!-<of)A*L3Y7cP{2E{1z$^z`0iN2ZmALAZ!=|8u+^P77TmcF^dO0Pa)|3c@n~ru
zz*TkNd60P~G+?~}`ouNziD@8{)(Ud+nZ$L>26bA=tceGsELha`8(?)}4PbR*4PbR*
z4d9U>UG~rt4Ifsj;Zf3qz<+qTrjH(>;Ug+FTq*Gg{xLObh38BzYWW=1ZgR*PknKzs
zwS`oX$?dF`A8|%|YanH`hn$I=(ZPZr_$qsHu_aXp(lOxBH<>N^@nAQ(bG9Q&vYlf_
zMT;MExUg_z95Y%K2XaI}WbqyPV=9Am2kkggho%l$ediO*ze#J;sB_W1vurHxvh9g-
z0mEH!;s9xMzz6B8f{BA90Jf5hiR$q`z(eRh{f>wdx|)BPV2Ql92}=Ed5=2(0SrID0
zBVaSN5zM1rvvwkwN5f|Av%$k7X0r}-FTQXIiQqR!yb^+>hjZ-9^VfVc)$%H0axCx2
z7~GArs~(gkkNaSlqFp<&P2E7akBVkZ6bEc!c#_!0x1+L-5!+C3GTHVJF{JWf?>$M7
zRQbgS1hIiB`KS)hvr}l$@V@3E-&2CQu+*dP7*Gu?Uaxq0>caofvk1von<NX)CZv_x
zlUdG4Yqj69k&!lPgLDfcg$@lMM{wz}l%!Tu0xL=~Wsn+5S~Arjbsc49j+4r5W_Y|*
zE}MLtSuIxAk<iQuA<Mgo7+T}THJ{!k-%;oApy$71b6z1--3ot$Kxi+^ya7JoqqZ_{
z6xZ@_o~gbx&C^2W&7!e{HQplq2k>nrC_9Gfx0llOKLN%AQZNTf@eBfP8nSH5JDM5U
zM!5~98D(bRGTzBio&#KBJes?NcM%gI4aD0Cb=PsikDt(aHzeKThk(4zL@aWdiQ1pw
z)MqI{vu>{GBukv%&#|nU61BwP_NwWu7U{_8q88~ux~fGwkZx*`4rG6|NC$F&TBHN%
zt`_M)O4aHKNDsAo0&-wvk<RAyR0}5L^im5ZAidQh9Y`OwdIHi{t)76CsnrvZeroju
zq`z7{0U4lHPe2B$)f13|)anVyAbSJt|D79YEOBQJ;fS5p-fXo0P<HYhi5<Y|a*Wx%
zxe~dV=Mj8@#L=N=5ge8{0$eL`1h}pgGEZUt6UzXjm(4E+%w~D@BQ(6A5-|GP!YWN)
zT%+NWW&y5PMrGCI9^|OQpV2+l;m>C>Ps391uVi@1O2B;Jk$2W=I{%FfLmY*?_A)$h
z*YP^2;h}=<E><JLBu4ggXfPU1kn{|8ip$<mhtN&+$zdm|hj|(}8$AUDR}xD1zbJ(b
zi#_#1A(x=9`C1sSvZ#T)6cx+-UYeJxVi{~f70bL*^U_r;*DfU_!!Cw^3mIvm0{dM?
zvW&o{d)#GUgAbdjz(xbmtA@ydr*n+J_HtEVqm5grz=q@VRA4V+Z@04RjC=OpJME}m
z@%QX6C4*8|Q-UDeKJ^PU(11~vHT6pgLcsr!0DGAjr+y{DGnHgb{d%i$?bATdKe4#a
zBH}_*<)R=&)=Yg&#Pwx(i^MTc<5Rav90T6g#wzGW44A~z^ylH)(>Z9Vu-=;5#2Zc=
zMl+5l)XJL1DgA27QIkN8d_#m=yJj#s<5bF*dFxz)QddOL%OemjGDCLF0TPKUwx+wo
zXBNr=rKZ%OTW0}{_aMAbaBlvZ10CB=G4P&*2MoLy;jV%ACfqUbK7`u_-j{I8z{?0v
zmG|9wlf0&%nmGANqGo{VCVaQOW}uoY4?dregPd~M3>ycrj1d|iOt@#@<%Fk5-1WbJ
z3J-HC5rpjinnRohAiP^sGu)A@N#10t8R4u&PAQie>1+kUOM#k0o$VSq%-NycH_8dP
zZFg$?aB^oG10PLzfq@@EcxwZ%B)pY@k0CtYz>g$6&%lo&yrqGUCA@`!k0U(Sz>g+8
zXD5tb#nl?`yawb6MyedyN<n;8JMSO|$OPvDAn@2k=W~rra%7VQImbBqOIS6NBcH|i
zf@Rk@LAh~QbRl6==_47~!6;>Hnv+j^l_RNL5$2nx^+AW_v1nRf>0ulW)5?ONbDT`;
zCq0bYW?KIc=-jr`29yA1bEXZH(VlPTPCKXubijjTv<E!6PSeX5Yj{Y5mQx|4J!B45
zqdm(%c(vvkwnoE;tc_kIP8&|4xj~~NC^Bir>`kVk<D$Z)(=$<+ca^6{o_Zt&)7Aa1
z6~sL~M=H!lOwW}H^99HB7E)nurs*xaS>8%wE|MpZ^bxQ%d2--u%-IVVIwQ|u8@%>j
zdFlLTl8%Wbzovr>Dd@GuYI5Uio|=y8;Q(~uPV|uzub5g{)>`hixn!u<n+P&+4JHTz
zch$@nfxHf@i98jtoa1AGvl#)$(@D)j)e*5CTckQ7kj2hUTK{QPJT_R~ny9Kf2!g*$
zX2_MyZX(PGS@8WHhSik}V09$}xLAA-xMRrjevHceJqq!4z1QR-Rhw+@VW|y!#M`Re
z!;R-{V~_M9MsYxS6go5l!N}0;92mBgsIzm$NM38tR__aO?Pll8ob$^i1h=MD#0A8h
zdI=>Ev2tc}h?u|9vS#Lph;0lj5g#(Fo?lMCnBX>2&-Dx!NsRr*a0iL8wxniemr}?a
z!tnlOfTuFtqg=ziMgTsQ>3u6T+`kI&DyFLrc^AW~LjqPEavRfChx~-$iUySBIG;Iu
zspTyu<7Hb6>mI&ra90rxXREol5oCGSP#S%-EahtNF2doN;IYM!#<zQp?MR$YQ;v#I
zNMcXBTwF=|lt5#8=Bp4KS|L0rA}X7bzYNBng!(g<Q4Va$K2DB&J(dW^b&^)%s5!1A
z2pa)+rWc~;L`sB?OGgfe({buvIk=h{C9-8q;W`}GOu_^_ITR+FNK$Lm4!(P-n2cm$
z@*3VQ%9U#CcQ|IHVzlrXKj`^SY98e~$b>hv5U)Mu8!q8`;v&;Ecn;AreDi1O{8$~9
zcc#vYElTYltC>q$-aWBI?8kXeGZBprkLcz%n)XYr2>F~v=RaQ>>B;E?p+(ou>4Em)
z32cr!s|K*TC%v8+=k$^`0bQL`{SedD**ncHBe+cZ8sL7?*HW0Lzw|Z01EjA39w>e7
zAet=a93*{>n|02h)v$-Ho-=rjmBkYW|K@}w0*}u}{@Wz`c=c3dCh0$(o{H2VaD3Cf
zg#hRQq_lI%weVU}amb!Ervqg3CHb6UiEi%0b2>__!lwPi7pP|^u?2RQgiw~_c24IK
zz`QRpr%R~_56$faA`6*YBEosrncG=}ze+nbbLp8w?-nu#vrL26AlLTnckfJfJ%mf3
zCF*+UjLRwKY;`?^tC7ev=DZ8xovW^gaLu_?T>^c>WtOQ+AomJFR;WuLT=kr<E`e~>
zbD?o<?_FeG0<Bb+Kpm+%-X-c1s3}XkR9yn$dgyX>ZI7$ZRrX@CmeiwqA@2#P9xgeb
zRMoqWt$Rw<=p{y;p+`f!hX|5O&Nbv7m+P%AIbZY1VTY+p&L22Cc8|sKf@Eir%aSZF
zm*Cb@xd8Vjn*RyUA%MPrO%URu>;##cRuJI?H8%mym8N5LC#W|)I2KM&Z+diQ{yd2b
zfh8^krbF(oAO`-W+@VMQTfAF|ntCTC;-;zUTfQ$5WooLLopBWxq>FKV=PTFpJ|Gs@
z4zq)^3lVWVYRoR83jIOZ*o55>aOLfv&DT-ATSzdb+)8l1)Ch2EiFCkfwgp@$HEO~9
zA*oR>hTF>sa1_HG%b@y1hD*u;U(9gV5r8)^e1MDqFEQMs3iNLn?o|W0$!!Gpodvj(
z;r?}iYZ*RhG2jasE^h#Q6T?H70{)cYLskO*V=ciWRs+r(K=7e!G(2i8;03o6ee?#v
zsAJ`3!0VWP<W|5XcMv>wJK!%FK6)qMnmY-u+68#|I)W#B0JzC|f+u~h;mO|uZp-u<
zc@_e?rdf6qj)Li&F(W9*?TpOK7Np+>LT2R)QnrbZIUzwFW@K)OAkY{tHITY8K}O$4
zY$uirat9;zBLwMjKOqY%1=+;N;wnMDX5{1=L8d%F$Z4|#xr&j7IzjGWWXWPdwr(cm
z+y+7Je2|b8O9gqDkqcG|@-ZV9trp}*MlN0>NZ=ttE?p}~`Bp-%*dWMiMy}i}$P0{I
zy;Tr6@w)AT%-lvfYjzqrH}4YUBF?$>13_+Q<o3@Ew!6MHkaa&B$Od)O1A6Wa%1sX-
zo3aHt@JW((f4(3So+e~-NRSzfJX9jc*^E3|D#)XZY$+22ak;HrkfzU2&J!a9na0Rd
zm4cke$TL-fe8R|cHG&juC**}$f^=o%r8+?%`sKw2@@j*DyuMVB0bJ&dm4b|8<jvKB
zoW#gGYXspZG2Hjo3UVpue6T?f==u9*L16XATLrm^**@Ja$a+RT-zkXu93fxs5(FOo
z`U62AdiUo>&UfDm5_*x!{P43N^BMV<<)Z(f%$}eiu;7<$1Nkjqkn6e3A0c@J_C7{z
zyF{?oFA)~7O9g`nI($s9O*<*CiCr$(lZ<8CBLst2Xopa+H#x6`T_qSFBjx7VH3rto
zo@HPKcAa4GU|V~!VBfHmBD+DbPA?Ni&lL&wBV%;(wNb9bRu2lpmM-=h$wM8w*=q&6
zHI>R8U~do%oTc_=13S>(Dp=qZ;_PK_7c7^tKK4$*iWw`jcL@fW{p}9~+sb(Z?au|{
zi(q$<{jGtO+dm72=B}XqwPrN*Ss!t^gYBSTKQVTQoh?}AtAvfT^95_k*kN|az((68
zf`vJ6j9n_&i;Nv*mkIU}V@KQN23Bp45UlDo%9~_Y3O0+eDRz~CO|xqZY=%8cu*J+d
z)2<VYKZNDZwig@N@pgk?4>IQo_EN#l+(KBby;86jId7i5TCl5MCv1VeMljTUvAvdF
zJb#qtYPmFdg=g)@Z=r<WbfM?}2v2>7lBVp+Y&)DI*YlTLZ&~47wPM(E10gM(%d(k=
zS1I9^&T1gM!Vc#-Yk=_bG@KvVO(Y%RR?Y^^)>>_EpiF`D2y*!HKHNs_bu8jCZPi`}
zkU~d3NCmc{$le;TkdtQ1GUu`|opQ~lm93%jYt?FSE+e<w0pwi8NaWG8rd*vn)mJ=D
zV&pEhaIL$Ekh|5wwd2i%tg~l8z;s5|+wy+J$&74Jcbnd0<R1HMu>F&fd)3{hOs>vG
z`+Qjm2EwOd4nLetIh`K3<mEp90^#Cz0Fc^9)pG@b@N$$na}AYQ5mRP=vy5mc4nGWT
zIQS7u!;i}CanK(NYWfzrb_RWGwx(~B6&~o1=WF^C@_skyPliNkZul+D@V24!9Z`z5
zdRLUz+(6ZMPn3fGz9<F!K{L}OCpNBLF#HuXUByz=BOi#&Zvtk?{$@$Qvd`xlOtqU0
zCZCIa<f<z@z;d*MYz_oLNkb~{Qf2_oMA`&tmXXT!WHu<xkTyq}gESXu3#2WP<{`~T
z+6rlFqy<RZAeAF#3jr4yX$WvTr0tP*Kq?W|5%7LUJ0UGW+8JpVq+OAALn<+L0O0OO
zOOf_KdLYuCNP8jeja0r_&=+tS(tb##VFm!Ev-;?F5Yj<N2O}*<Is|Ej^zJs{eCge<
zbLVWOdiRfvv{t<v0a>7~Yk{;;j}Zc)Z%d$a0x49diX-NV==#v;hr^&ZCLYY}(T%e~
zQG3gPJux~vOj8h75juw}qoH$zY4k|b=tJ#HDIEyYJ@;touC}_I%M70=WXPGXgl^^`
zr(Ox=lZC?zlu#fG?KI;XY2iv4Ut;Pgm58WT8wW7_%!ukhSiQ0dGQF}X+`;grhDDbt
zi+JB7d^x@G(sv+@fcy(TV|zmgR-Yz0l0ezIH=KVg%-E}8p}H?b70)ttUn*666<qfZ
zRbQT&>b^1>yY6dshnKCc`-YGDe}+`!+PE^@Rc1QOXWi6HhwAOG?#*EaqC1Lc3LxDb
zdblI~*2rYa-1MYN4DNOz)bhGhn#z-?*Dp4EB(g_yHcwYxRc!VwWS_v<JZE`}VzbXf
z_W7LM^ajelA~yS0WZ%izJg<58#b!T+?B_U}XFBh-*zAvy{RL<9+~@reo9*7l6$?_D
z%Cn)@oFG|Lupiv^$nM11-6(;RgW=w)(E=0%eN>~t$$cq4ym7H2j)jOhEP|(4uRb>W
zY-BIvY@T$zOQYF54JZTFMv1U$Gs-;5Wge#lRypCvjHunBtU{;SYSSIMe?&$63#EUF
z6b#f(a}f;P)>>BWbl1|z4E6j$U(Pw!rMGVRUO4|!PAC{kMBElv1}v@}Epqt&eC-iR
z&f{FP(hX^$W84}bFLKV2uB=3$`zUu7a`@D!+Oh6jAl&b2$GLS{z|rc3&>vaAcy}S)
zp^unSZj1`GnKFd=b-w85yi&qmfVMQG#hVgD`(Kp8qk-COhGQN#9rJ{8%rN4ueUcng
zFoq!08^PN9q%bOTzbcH%JV5;3$;2;O&mqY2mQxC?#kIE?Zd|JhLdxxK$nrKu3qFQ|
zPecmNt-Zo1xXSeZYSaH$n*P7a^#9e$|7eVB+}UtBynL-Yho1ksBVuwHL3I2sr7$^A
zd#2&2C8nd!QjQ7}Z|&LasFMjY9hF^sq7>fDEc4C!)~loEQ27OJP{+eUH`8qCg1xph
zhF`VjvAo@+LY)3@f@uGb(k=v8f!cSB8oX=P;5}7?Qrgw3eV=PEkRY=L!P=LkFzno^
z3ZtoC=B7TD_(f|SL3I8frO?`~_76j=6_B2{m9lH;F%8rfeaQ(()zL0)paeM|Fk2wd
z&Gf^uKJ%be@D*{I_TF6kwW#fK7m4`Btn6-Au7FUJZ{2IO$G>yeh|#NSdrN5^o@)D;
z?bX+8FM6REr7vP7{nQCis6l^MuDO5=a4!cNkb$)O4$myDJw)a)7&2VVV+h3&>IOBC
zk&YZ%1msXP!vQ(WN!M~mIdW1VlpO9f(K(}?ER7uDGz9{sm1>HFv@uRDa)2D^wA5@z
zsV72FW~|c&IVY~8I*)T?&;xR`v!Bix?{w2hm2)5vh^}_ZfLwDo37G2)EFD!lK^(D;
zDbpP5fZW=NLP2FFDc1lw#*rBSwoF!j0y0Ip21t$a1`v9fL&B~p+k8AJ7*#vnP%uL&
z0Q0d*CbZ2|GEe7%$0?aWW+^uSnXM`dWRAn#LXX#;RltG~ozzn<B2m&)t|Ew@|ECo3
zkXd_*^ap4@)$A#!sh)zI(^XG-mu)(OuGI>@Ajk~<VC}&o2^AWqB%!k&5+D<r(>Al1
z!2OWUzmDSj6J&V@QVNqwYP03ZC-m25DdI)+*XHUtW~j(XDYm>>Q7Q8wWwDmBOw56l
z<;omLS)nQhDdz`B%DSkO2O;ILh?LCQ-iCYnnC|Iox~ELJ=T|CN+mGE7+z{)YHMN~Y
z62^uSB?%^U4#?O5Uv&vwL*M_S!s4ru1X<o_O5vOA+Pe*V)|vLKSN34^*kBH9_XLbi
zdT&5F>8&KPb|VQZxR)T+kWERMHN&pGN|gM_JXZ%S?3*DBt_f7xz+m{bfk}eF^6LUM
zw(JX4*|q;NBK;?`EB&mx()xQy_8zk<{ab}S#<gEm*uTzfzdDy`rN24q+uktfcc)TJ
z0QQG7#=z))ieMN4Y<H}Y=g<ZnWTKqwj<?O>{&b(=9uuA`&9J%lTB#o-UvJj$2FIxR
zO^z`Q-D39f+Z>5;sJ}xEws{+=vg?!^kh4Jzk8?O@qZ$#BbDvY1&8-FG0jGyX9#rEV
zn&@Gtm(F=i4T86^w5?8mo%4i4pGKwM^PKaPQ?7HiJ0pO=g6Ex4I_E`a29Vuc=4Izt
zo%5P=8<2&Z^Eb7_2Sax`o2-HkL`J}=Lma%?E5v7GnSYh?CS1E(c@xN$4y}`?5D))S
zj*Wi)xP49mYcfS<*7B(@^n=Ki=1_aF8FQD=Q%C4nf!b4z0;icaobD()gSATxp0iA$
zXOn3Kzr-2Qu6C)xzfAFW+eDRIu6hBG74&MN9=Wq={YNa){YMaFd52S~Mr+Fm8(R&H
z7~vc>G{VhpiYyUUu&zJ~4M(d8iXE+gkUowm`B4od=*R!$(RwTKiwVyYWO+L&RVI8S
z1)=C;a|HUt91%ZNBTyFI0<8UvN5s|ynd3~2UHiH*&iqY{Gcf3l$T$OwcF{OP-#?}D
zV$x)SEN?ocFsZcmeDMlK_Y0I)_&Jo?3sYpNa2fH|UX)ToA5h}5^h?Rp@4O%FttYC;
zeu(qEEtEobo7&qAkKdtW!^S(!$>=WSapbH^kpUOT`V`p_KnUNHVk~#=O)-``8&l}n
zgFg31%osutz5hok%m~!(Hq7`|nK6g5YrjjO&|655*}R#x9~%6BSNv$Qk5Y`a%qOZ2
zFz(Y7dIax5k|dsZk|4`_mQt7ytleRVe8Kd@i)4cLeY9XI->2n$7xy57=!^?WRV@yX
zRV57Ru8zV4QtF9SFr<g)SbaxwS^9-9aJ<n3tIZ%>rgLI>Gl(jtLSsD_=-Ut}cD3W3
z6J>xkM$zk|Ib788)<^N7gt|`>>K;LNn5q5*roKoCYLFf7D_xpph09cz{+_bK^oX|Q
z{S;x`T-!^$h0fVqc?(lpALVmQ)O}OV$2bL~EM+AS#BskAS<K^VzJJOldjE+GO0A|u
znKHyMr9zo<8fAxvvMEa<jF;7(XqYnJG^O4&Wq~pU3KyoVw7jQCgg7|XEAIQ0VR;`@
zn)*dVO@8=ru?IUNqm?~euP{B%je5apm1=(LL^tEZW2lJNjUZHMSM5=TrDK()SOSbw
zmSWj(bc);!LjM|{vK7J+MpY?K0zpo7%66SIA!UconV7Ou=S)g@&GI&o4Z5n9w>64C
zPmsB-I{^y;wf8~aKZr8&qd%6nCyKKlEH8~7GZ4Y-3b&A-I{0=A=X4+t)&5{!2d8^)
z!sgKf!=?F@b|1=EN4jRnrxd1g!FipOSAmo`!S2U1wTqKo8swCuTKxF-ysnC`4Jn#O
zo0XP)c<Qqtq1`DstnN2+!2_LqDtMq2e4aY&yq>Bc54-bvQ9;N&p2hTaLY-N`0!9Wq
z!4hQgcIdnzP8ATo**LGlsR42UBL_RPfUII<xKjs&?_|vz<t*07;m)Z*_*?MvMypp3
zfE?j0(K+Lsv-`0LyjM2wXnK7i^<0gQC)_jeDu>><Fz{;1cMW_3;f{e%B-}ReNrYSH
zLis&x{dDyb#G{OaouyiHtz)|>23|)c0|q{i@@)e@ktG{=Jz454)AANjeu{xFWO)X@
zh;Y}y7ZdIn_(_D@27WT(mVuu}c<OSk?{vaF13!cC6a#M{JYe8wlD&?BFQI(fz|ZFT
ztkCk$WqAg^l;s)tGQ!;zx|uI<WK2W=T;yEXeaxfe@=KkSr2$I8_bfNUWscQ-E@xd%
z9VI}i7IB4&V~AKq3pfd6e)DMFRqD<(V*F}#XBs)zII=JE8cV-c-KK_!>zo_Azrm{3
zI5(3OYeW?S`39v5$c?0_yY(0`-r}q!Mm`9Pevp0}=e6Oyb<SOsx6a60uY`b+UK6*v
z4`arS&W2KlQV4-nn-n9uz<rT=!N$$bz1jf}I-4}|kaNG5@QAvvjxvur4{5f?)J=Be
zY;hh#4r2dtN5<Iq*)dO>$TN-%xc}gs?T!q%K%RAEjD=sGQ}595dqVS`cixeKFF5a3
zyZZrL@;2L|kx1Q_=cfqg(S7;uBRT7K+d3dfDXifcWZoUdje&W0(v1NcOzVg>hh43o
zQlxt?=MuFDV=g^88sYG+At;x51M_YsRdQg+Ji61P&%@@e6dGjIk}CR%g%eAn``ahB
zi=KBo?;6|V6Yjl#l3<MJ`QekL&2Ufc6xC*!7*ACze;}u+%bROf(p-4Dni!FD29@`Q
zZH<{b#t~|H6DWm}l5iWjy5whj!)?`mA)cxzbhF_uAVqGzAbe9L<c2KoS`ty@-VAZK
zN5o}^JBv7;T*6(HI9S%zrS-%s#3&Ql-w9IBgM1b#y*WHvYK$jA=BOHD_CH?rH_ZNX
zReytJCq%j!`92(0*NLcpt$Gp!NS$*JDgb1jigF+)IvXwT_-!$UEhiM#Ny2<I3)7V2
zT^40zQ{>Tp&ak|7(VWM)blQ_le1br1h~(ShGFiZUM%4}XQ`bD7QGR%EU~_3@xW8l%
zdYmW&RQ3i&1}Y@@1R)10<YYz$QEOlW0u?C_sQ18L;k=3f5z)rw;V-38_|9ecAF5H{
z$*<HlFmh<$87>0yjcRZpyWJ3SQ07}#W^I0$C;XjTiX0%{yJeB6YA%&Q=^SM;O6RIe
zI^?tn7#druGupwH7ceyD)Akx_QW^eLYQk@Lgnu(@^1EsLAIf;JSxOW%+5xc_N}NEM
zHr@@CYa|dDAsWlV9i=7^wVzoN+KNK~<di7mp`^3A2>>NsOpRRwy{x|PQS<OG{Il(S
zL~xP2n^O5utA1B3{7TIJ5xoXX0R=B)hsPM+J<_!4r~q}czQib<tO7AOJW}xHu=>K+
z@k9x~q1?CaDMEI+RU*79e1o_c#@}eV_$GA&0Xa9T$mz<ZZ&5c87BX_H87#NCvUP+q
zYhCd-klWpXa37F6TyZ{-JKckI&Ry;Zjoj^y(#SfuQX}i#v0{I2_#DIjb4~ltGwolh
z?1#o>%6=gHttI$5H$2Y}b)qS1zA38S6t%z<wJ;)TRQPd2)DxyCx<9F_@s#P+r%kUu
zV|sPF>D6aVuRdpb^?B2)J4~;>;Eu4oDNkEg`-cKFO3fxnB8IPd+>;2U^OX-klv*h#
zdds5umvNSNC8a79CyDhKq>oXdh)yt>L-Fxw!52{Ql}N$-@GL2ak!!Xphyi_$8X??g
zD432XuD<W{_)5R<aRD!vsA6gnLG=Cur7$HwY>A6Yc_Oftiy_fbUWJja8YrNcUM#S@
z<Dw#&fu4Ve;!B|7yoieIaF)@EP0d!!R;~CH@rIk3`kKew3=Mzh^9HEpeM!aS&`|dm
z0_CgBdMv2DRvreE5h3zynHSnlz5qWjL+Si~#<^bVppkOMIZJ<2MCDA_OODH~mXXLi
zJ<7xF=^_z5tD}0vVQUF5QeTqZ6fL!dAj^A_QnXKLy(P=9&xuk`7ZZs3Z=NN@u}fqv
zRZ{;w)>6Zm`h$M3ul`5<1Y!L@^%I2k|I$wo*8ilRAgupco*+Dn<?IR3`Tqo9wU#|!
zPDSUQKK}r%VSaboU8EoArCQs3dfm)hN~ODUZlHcAxNc{;f77Mw--s**>tAjW5mWz4
zfId2@(N{UHHTqg07&Oq=sk=ml{2H~T{x|Yr@VQ7k<`bk=O>GH;V;ky2;@H1$C9B#g
z$MT}FzP)-%X*BWHcOWhlsH-oK0w*%LjVkaqBW>wOeeeY9TL{lhOm1lk%`=|+s?VqW
zWBou?{iE%;_7>8ZU<F0p=?DCWTAa+PS6hit<S9i6fK+Auh0l`-k&kcly1qX0@oi@Z
zA?da(6_Asm-Wt1*b28OiWA+P#G*NGj@rY2LWy^fSou$61EmO=4X3Mr^R^b(3eKWfX
zQOesw_08=Xdj5xOK_GRj|4g^#=e!iq=odV+=_dSAhgSVRB(z}bR}#p8zn0(y{Ea;F
z3V1i&SWKn5D4lOXD%$pKQ3&`Qx>mNKALzUE=?r?VkA6J5*T3gzTi!Qp`M|K{L&KK8
z8@7C8*zz&iaw*wT<X%N7-T$Q&!IHfoO@f7eyC7Y);ZDk4kfGX;w`3P&l2JNX7W|Ar
z_z%Hic^)-Ok=uk)y8lb5^y38$nW!LZJX4%Km@*eEkxD_|SuyJ7?M)rce^gS{WVh6W
zr@#f@+H#r)Pl^k^v*|RCAT}g`e@}R!f&X9!Qd$}KkCdNp;Qu5%&%pmh{LKygCp$pL
zR%`h`b2l^aJ%ndx>imCmJ`GMCUyKY6r3BIY|CFLGnG1iD*^13w7<qmLNUCv@Wns3O
zZ#l>pHV>rH``=NKXF=rBh{(Xg&K%nGnmCK>#!H8rDNoH@8^FvD;&~4dC^HYw5bkrx
zd5Kb3R<fX8uJhpK1?oBv$U@`#b-^O_kOy)Ws~eX<PI5x@{m++TlwjgRGKex<?g`fZ
zY;5*|ZldmfqA%EAspB?ZaDYOZ>?DK^Z$afwVYc419hAMGR0^WOd#G$62O2j37xYv{
zBc~VlHWf?{8^QF58BC9IV;YV7SX^UoiEHew(%4FDfuqBq4H=ScglStRKwVtt7dnB|
z6az1E0x4=E3+9H@i84Ui(X&iu%(mxen+!8MaIFozn3WqbiQ_3KCLbhsO7rs!O!q&c
zI9}r6#PZ&Y67jyPEG>SB5`QO%&cAwDIWt(hT5kJrK-FGp-uAi5qdQ04h*4A?LXi6k
zCkO@}lZ@N);a>mM(`XngWYM*+PvGzE*?aW_K3)HjZTt&Qb-j-WE^=Wq8>*IGdx)wl
zLpu-jf{`rjczr@AH8GB!C0^^ycrQw1d1ovfzcw!-|HDxGU(`AAy9Yisr~5x-R{Q5D
z(IbCYUMNuJSl;K%@--#i_mp4<&ij=haREoB%L$$T^(ry)d(U10L6XfLak~;q>t9OI
zMMB|4GEU)2WU;!s;BA`lNous?JG<eNx$n@Ay%;_vKsQh4v)t1uQ48g>A|i9c=ZQ%0
zE>$9dEK{Q?kmX7~kQM5o86f9VdGA%0&#1Z5{+x)k2|y{Ge?lo{xcvIlF~bcdYW*29
z!*NHcZ;%;|h18!Z>)-ufBX~)!;o|y*XwAL0xaA!~WyBIud_olGK(f5kqWA>_xd=QR
zSm8D1b&QW1Iu9@^08Pa9QvIXE?^!BetI1tn9<JR5uQSh2l#|QcHH&KDf_x$`suLFg
zo~I5eC|xub4BQnKsWVo&$rl|hK4Qg-)bWj=tK%C%pAbS>z!QrBgXfqMdj6L*!i4Na
zr|6th#RPDjMpw6Mh)Z0E7L^+E;b`e>y?dSw@>vZ3o2+s-aP^SqOt;b9Po7O=-rSZ~
z6D03^$>VU9JZ6w`bJ~l{E`Osujtuv!{*l67cOs_pNf|u6S|bUYG&7Ali~I_h9edFg
z)*vQT(IhcxkgYieGj;!Xs^%T*%WG0K?@V7_ld5?a`|_Gp&AZ%}*Q9FR8+>_9s^;C~
z%WG0K?=!x<CROvk?aOOYHSagRye3ui+KyklnN-c&!k5>iYTgoGUX!YM%YAuGs^%T*
z%WG0K?`&UQld5?ee0fc(=DpaL*Q9FRn|*mrs^)#bm)E3f-tE4;CROvk<;!bQHSca;
zUX!YMZPzz;465dBX;Ag}U{W=2XJ1~Es(BCc<u$3Ax6+r_q-x&jzPu(?^Dgw|HL03+
znJ=$N)x6jG@|sl5yWW@Aq-x%6zPu(?^S<iKYf?4uC%(KURrCJj%WG0KZ(6`F&P=N2
zZR5*pQZ;XPUtW`{c`JN*O{(S{>&t6WHSbJcUX!YM7yI&>RLy&dFRw|}ylZ`VO{(U7
z#Fy8kYTnm;c}=S3-R;Y3QZ=ue;ujAlRrBWh@|sl5+r^jHq-x#)zPu(?^G@~UHL05S
z3}0T8s(H`x<u$3A_j+Gmld5^w`|_Gp&HJb?uSwOs&-n71RL%RUFRw|}yr22<npDlZ
z$CuZnYTgXbFV0M==56cCYf?3DcVAwUs(FX_@|sl5JJy%iq-x&jzPu(?^Dgw|HL03+
zxi7Ct)x6jF@|sl5yUv%_q-x%0e0fc(=6%hV*Q9FR&wP1Js^<N{m)E3fUN_Y*&P=N2
z&GF?mshYR5FRw|}yaRlBO{(S{<I8JOHScU+UX!YM&++9osham{UtW`{d2jXQHL03+
zgD<a1)x6L7@|sl5`;jlNN!7fYgMRT~QZ?_(zPu(?^M2^dYf?4u_rAO)RrCJl%WG0K
zZ<92?x|vkXTj0xUQZ?^>zPu(?^Y-xNHL03+pf9gU)x0Bpc}=S3t@h<LshW4LFRw|}
zyeIkcnpDlZ)R)(!YTi}8ye3uiuJz?LshalzUtW`{d3X5onpDmEp)apV)x5iXc}=S3
z{oR+>q-x&MbiY_Psham9UtW`{d9U~7HL03+y)Umx)x1yn@|sl5yUUl?q-x$Te0fc(
z=Ka-|*Q9FRW*L6|HL04n(3jVwYTmBCye3ui4)^6XshamFUtW`{c^iCrO)7Xl`v>j4
zt~PkH_%uEKEk3K9|D=9J4AZrr^v-*2OLONv@k16V#x0$_-ny}%kT<9&&Cm*muoV}v
z6@zSJU$S5Xk+F-MX@TWlW*O_x(o|SpXO@}%EUkp)XJ%RK&ypi7^u;x6(sF;67Q!-!
zS#I!W$q*KpyUAqHwRolx8D_oRh<q#S`Nkw`w`7YRu-J~_Iq3O-OSUk{x@2=H>3%~j
zCH^eU4B_P_i>}1jMr62ub|doftcTvp&`qvQX>I7a*kpkoM8(bi<Odp&;qmQ_$X~Mh
zw@k8DpC#&{XSd0s)zix`+HjBu>?VONO|ll)L<Ay)I-4vg3GzXW$Y{b!fAaK3WYlM2
zBQmU7)`$$JT<cF>--wJb+}4PUNO{$t{E0vLr$%H%WLhBJn=r6VBQk2)y%G6=Z^`!+
zCRzJFS9}j+$C@ngJ)At#pS-vc8Q#345xLKIq<*bQ*6Le|`f6r*#GfT!Sm24*Ocq!O
z;kz4=QDrwJ-fs|++lUMyT^f;hvsD93vNpVpSk?S{VwvjCk}fQ0lru~g-676tL`E=O
z--rwg*Eb?V_M?r+Xw7FDk>TZ68<Ek$K5Ik<_nt;%cs9d}_bi08ZA1ol_eNxJ4{1b3
z^Nejo#t=EZ5&6O&$oC6PvTmOC;(MrHZnD7l@XvLP$ngETMr843BXW};N&RakS*y=8
z)PH8OKs|cz5B_8~HQuvm`kY2&bhgfo$dEmt5g8qMOd~S<GrJKP&2vs8GMeY=Mr6po
zwGkPzH#8zc_H&KMh_;U!k)d*PFy1Ga9baxlUh_|Ck`GO?Zj!drB<R!Mn=CpaerrTV
zL^Mf@R}bG8G$Mn0zeZ%#xJM&0+%~WgdB(q}4kJynu0w&;0g+d2vY-yA+T2Fu`&i&f
zCRqzCG6XI)Ss)NCxT+D^`-uduHOX3FI}wPwJz%mxAR2i`BQomqVIwls?`}kfJAZFP
zhLF<q_@+XnT-1mRFJIq?3>U6%ME;p;{FF)7H7=GK7yL{tyZl)Sg$4Eb!eoI{VBxQg
z$Pm~pBfdU}vBE}V)V^yYGS+Cr8<AnjQH{t5>jsmItD%2#)y^}nhVbakhQRtvz6hDT
zhaSA&AdlVvz9$HJnCbV*15hV3tUj6zo=x&_4}YvNa9;`dZ=frj!2N3g^OJ#r2iDU0
zA5>5t;o--0==m?gi(G-vh{<#D-9XrT3uR0?(756);D>&2Rg@~v);xJOaV#-vRKd^i
z1Wu9@d?OFO@e?`tl~QV-z~H3&pQe*r4+a$|KLu`}oI4E9xJ6j}guE0h<RyN_Nee;l
ze-`p_tdNiSS#m7|x&K+nPq9LN;>WzS5ah-RIV4iAN&=Kmf;LMT9?6*`IA4k4Hz^$t
zMQJ<(xaB9Rb(|={b<s9)qT0rZsw0ics@}-bR`s^|pmP)FGtV{N$L5zLwW>0dAE_!q
z&u5#N{YCGgc2y)l#!WGZuBc(%s5t9J*&GB~`{+d4E0fheIZpfJIPEowv`<S`dtIFN
zx;X78CemJ?to9{w+Ly#>KRc23bCcD6Wt{dap<PGem3Eg~%{aI^ku}#QYt3D8*4!0m
z&0RL1O{}AGT_S5XBx}u<IBT}VS+m9FqmZ>V+Y(vxM6%Yr5@*dTan`(Q^U2HFn%5Iq
z^G34Pd>UuXr*YPNYV$$Q+M3T3S@UJG*6fM1W>1_odu%>eT3ho=B5Qt2)|yP5i>doi
zro&^Y#+x{NjJ39=Dfss?vNuDf_2)<SP@FZPIBP-<pPH?$X`jfN;$*EUi?gOI&YCiZ
z59!v{^iO2Xz+|l%6=%(;IBP~ZeBQUVW^^KJDwDNlN}M%Q;;gB0_;_(`&9p?;%t+Rn
zMRC?Fa`>_N;gR*lq{VS9b#fwWPEFRDWpUOli}TGghmTR$zFCpTnhTP(=9)Nbu5tJn
zcCG!oMB3LRt9^Z(_Vo^*b*{DFlSuo<WVLUF0IluuMB1KAR@*Ca+Fnbf?Qh9y`wRkf
zjDP0vdG5NdUnJ80k7Tv)iPOFZF|M`$l1Te+$!gESD@?lXSuP(*ueE0*e=oCCb9w*i
z&(Bir;<UGO`B-|by+b1H9h24GJ5GCVmyeX!+WRKb-Y;40BjU7=aQSF?t^LqM+D9d;
zePW#Ui7p@4t+gMMNc)szwTI)hhh09rQfseEr2WKXwVxTM{meM+XC=~pPO{oBkJEm+
z%cqj-y01#4{mNvu-xjC+HoUW^wbOw+G}rH?zu%dx_6Os%Kj`vV>RS85iL^hOtoG;Q
zv_J1Y7^D4#MA~0UR{Ohg+TV3YZZPZqej@E3CaZmSoc7%=ANZ_2|6L;OKP0Q&4scZI
zS;h|VS<hO#i~PMrT?#UjxE9Kd)1DiM9c@}B(w?8J_D*ryJH=`5oJf1uWVQE?)80S8
zM_Oyo4@{(eP_o)b#c3ZE;6tyq_R)#7S0<}{a-8<b0Y2+mYp+S9eOj{G>*BQ61^Ae2
zt^LGA+Ut|mzAR4rvH%}Ht$X0I0KZzS@#O(NL0emQej@8GOxC(Jan`Mgvu;g*kJ#4M
z+?dFko0GL>Q=B!MV2##(e<JOhlhyuwoc8Afe6vQk%<}<0BV6M<0(@M!w(iA5*6mEz
zx=-S)`y|e~PvWfm6xL~LKMU{)-rCwP5?T9?WUc)r&e~sKt=9fqBJF=9t35L%c9zRb
z;S;^J_AKP@WtPiEW)ibp`#A0GQ}`eVt-Uyr_Wk~p_Ie6bb)Tzeoc5k6eD_pq@100{
z-#?|@xQ|s8r@bmAcGs#Zg^!xmQCXeB2cv82CML4(m}IS67-!wWIO`UrjN58jb5bH}
zPT3c04x<Lb&+yfmDcTQbrrf+WZnZy(nvL!-pS3S)4uK9z3^l9bD!nS@?_13#Sd|ic
zqw~r{mA*PzYi^6P=C+jB8=bc&(thWk(r$E)d*Za;6X%P2Q}`e`-7Fj7n?!hQ=ej?U
z^_%~c^+ro>iL-u7obR?J(*8uU+MkWn{w%a>-#nYbN1$l@IpDf$??`0bi^*E|UYvFB
zrSP%N+M4%M_=IO|&4-Ds`6yXyzKgTwySSG6A(8ffCac}`Vy8dXi|u16$luHKmx|0J
zroR?(+FQhF&r77eRkGSU#cA&pr@eC`?Ol`A-Y-sjzc}p!5@|muS?#0Zw2$)mL}?xK
zqZ4VbOji3uj~_WYoM)g($0X7;C0R{#Awc)-xgMW4rtuRzK6OynyEc(E^OCjZ%s6Y7
zczo)z)_!&(?dK+|{qi{NS9pAMv(~;kk@l;S)qX1kXl-i~X}cp?ZCfBfxAPW{50%#1
zw<Xg4M6%j<#A)B*@zPdne=(8voylr{KTiAm9-nrtwSSmM`$zktJ-Spi)=j%T?e*Pp
zmhATUOlvcr*F-V1i(1Nlw=ZV+EoFa+Q}qi3YA5^#JVv$7{3BWI8L3<`UD1qGo@Qmh
zYXW#Lnwugsi7B-m1n8=CNTjV}vf6saY3rRxTi;~0jf~TFSR!qQC#!8L1n4%Ln#xb?
zCc?RmwdbcNvhLVqtve;ox>Mq;YmCP(^iECX1L1XTPEF;#MQ#1*iL7r(*7{51tiLps
zk6zT)G{$3ndwC-3R_%**(IL#Zc)Bq)rgy3#>E?YA>o+8=jjQz9)Ggahm*0`7Qg<b*
zeOsLNZK-_ZymtBHsj=7gPbRYF>13^WJI<Q7Q)90?-c6+a{baR&5;r`5k{UZde}?>+
zAkaPIi)6Kb6IXY^wSsRG)&2Wqwf_`X_n+eGz9&)Le@Rxm6^tE*>>!_QuIuh1e=nX-
zL1q$@V|twSj36I_uC+Hwq`hgf+H)a5YipTETYj?I+CqTt-))1jF<z8Nd%I+{?-!?i
zzc}qBiL`e~R(tn2?cL+F_ei9@=e}t7n?A~d+UsR;mXrngEd7}HR?|!WKc&`Kcpqe_
zJt(-hh4tWlQR6p@Rm9b(0>0HX9vXZurcVt6e@u;a7Z{$bHKXFJ5nL-6ok)9Svf9VR
zX%}2;AD>8jb+X#0ppmubr^H41)W$)eO`HCwv@fO=uDW?NE3WRd;^JU-oOObaCIQx@
zIYIuAgSLE5kl!BD#?4LSxA32`+*sZ%h_ie_kiTW1wJ%Df{iI~IpAo11jJQ@iGm-YQ
zlGVO6PW#dzf3iWh#4_O87b_B3bHTn?<2O=X5{wxa)JS;QzKHc3qE^LKa#fJ;s_IHg
zzOLkzi7I(@vew)N0b1MbiL~9BthNmhpzFFJ$e-KL+V4%Iebb-PZp=YX#c6*k$REJa
z);t~L&v$72nYck>docDY^tnXV?)X#I8Uw+ban`;GYqhW5PNe<aWVL?@0b1KviL`yQ
zFWUUN+8*Do_RGGA_3LUWX|e11l(g7YW-9VydbzG~8Z!5FJ>N^uK`qjFnPWW4ZuwQc
zeOiouHOdt4i*i4)`}>ORzAs{r;MtIW{OY=0%h05<wA8OG{o=1t+o7nf?mR=&_?p?Q
zy<ZEBL5t{8V_=|egrk7Rct~fC+n3t-X`hkC-yG4}XT)irnMnJrKc(I9*!)KE;b&t*
z8h^w_S9(bzo6i1IHW`D?MQQv!9IfqQ;Cu1^rO9f$9s;!guTP7;|0TG#=7vOdzbRR3
z)~E3&ezdlGfbXU58<W-cWL({!M1Rq~cruMYE~Kq_I#J!XCu_}{an`&UXU&^&*1Vm_
zns@({HAc_)B8@+Vq<!%P1pcS7<X>@h_!sJ+J@|7XoB#c%Y%b9wqn950kfoQ-Bc;|J
zM7|z6jZSw?dh9fHPI~O__qpk@>yD-1-%DUFN2WRO#vIxZgZNHJSEp;oU!Be$X^PRL
zCa7zZRdc7I=FYvUxqDyK_zj<rK!C2%qfn)rWef6SYN#`}C98dBoc5jRJmF{suO!m`
zTC&<djMM&Moc50rY5ycy?LWq8|1nPczY=NxIa%$g8L@pTHG@AVrsE)(5xb?I4*tEw
zK_)W)%Rc27g)K8;dvHGRy=ZHlthNqu+BzoE)@fg~MOT__c;J(hgGw`E#}vQ%4~7!$
z{lW0QiF0e|elZ06d-2cEKV`8o-X4*mH6M||&+*1+QX|}$eNp3A>8iL&S7q?G=d|kT
z4E_wAiF1&cIPW`Yd_o3)r%pR*QX(f!PS*P4;;fIyXCYr(GbfQXbCb1ZaYpRg>}23E
z&8AH`bzihqQsChiqEv<S#Sk!t$<9uE70<@jAR+wy#t8gmv1J{J$0i(g4vHmZ<~ZDv
zs>~cmmzm>m8R42U74N_a7a{y@JxHE24WHN(c)EOc`zW@Bf5mi3sjM6rH^2@|KZ_W&
z8wMeNY~Nv2ME&yV@1zmw&Brl*Fl7L!Bw(x?$L7p+(vX`SVQWJ`)Z;AaXqM7h%8fn7
zD9@wAq{GuQQGQOO{K5#Zgjt6j$EDS8*vqd+K*~uYPegt(W6Q9y5i<Q9cAr_sJew@0
zj1_gAF#^nwbKU&(*zj6_{AgwAaX`bbi;($W&IW$kPmR-lYMl1d6KQYQ7wsO8AXd>R
zIs*=#3nCPBJb<W@;=UB^4BHp-V2l_HShO{1St$XJ!zz_y9fTl#ubqC*!Sro%%SuBr
z_jD9vf+{OK!@vWUz(u@9b}y&IN^hsk2&8;%XE4PwQlU7YxJUy?Q;>Q{Q;`OdrXfu?
z(hR_vNSh$dLfRB*HqvHDn@gQi1F+F+-;WG)%h@{AH8tpQyz(Z96-di%!ha_cA*}`Z
zG;1dF(J$DcX&_i2pK3juXu*(t)ERI)$I7}$F{b8-R0rD9^Wn66C=+gRi|7*6^6n=b
z3RkA*X0!O`iICpHvYNd?K=XWJYHoS&M7Tm31Hr|P%{WLD_apfkgT$aC86F%2&*==8
zXKHvzHsEDUuMlnP7#^B$<wV;kqa9o&O=KI5m$^n7X|IiEWkrOfwlw7BneqUu#<skT
zq#c#dZc+%-J|IGqBB>U;t4T<z0=ON0_xTfDqB%;imzv~A36GrBBsXYfHDlM(FDrx=
zaO_;hf~g*JlLV^sY_vvyVpI(=m_Ty7WtC*U>Ck?bWwDPl-*PM<?AXk=odA&K#GCn!
z69n=lBkwx-8hOtNiKy(%$3;{Pi+VzdTE_*Rbb?miLj>_J^Ipf>LU6uYLzughK$m0F
z^#0wZ_ifADO-!x05~xplJJbi!#g$aGJONZqNH5lGTs_4m{keii4sST6Xp^#xY49+|
zUdD9sa06v#%m{(bk}{4h)$q(-sxh-30r3XzHIGU`f$593EP)Oww5+C=yBi6%yv>vr
zNTZww>s}**%c10=9lbXRhecHxM`?@3ieOkVPAn><*3LM(1U%d-8RJK2xT;cwgtA+K
z$O^Jsi;%%oFuQ;P=TO88b-u1pnBS}uc#kJ?vl8Lu3N-6XybBd?+9>b_(#qSMOQf_R
zR@*?@5R~K5B&~ufDb-uzQ$498Jkoru`x*(5st=`7?o?WWSl*jNgo@JU(wVyuxp^}&
zhr^_KbLrUQn4Xgl)u88!Uw9yB-a`DsCNyu^Ez(j?g848inDvwhtOQIg#acYh@g`7`
zF9GSzB)E`d&{wo?v87rKs1~9}2(?jydo{7EX5>yI`SWA*6?Fxu9INgQDrI>uQ;HrL
z$ox#Y5mzMhb4nm5a2iSkX#pl9D*6p#Mh`!MF^z{GDW2XI#mlI;<#ER;;#%e2X1j-h
zR7q)wNn-RB+Ppf}$f)J<JlT$+7IMs?i#*IL+=2m#_4Fc_6$s+(k10p|3EAnLAX`rj
z+%?5($j_bvfuFHjhAfXGU5a+wYf+fhbh=%`!b)g{mcSAL`x73b3^Bgx`N9P?=y{w-
zUhX|MyA<_>XWUwrC1UCcL}=FJ&O;>KO@!PNC6YL9bLUG4vP*LpR)U8u&RtZcx?}DP
z5Z~g0$4Wu&V!1PA<PWA1d|bYj^$9WXuVr4=w+hU9uzfJ=0Tj21Eo-xy$5Vn?IfU~s
zH^<8-FyAd=g2(2euVq~9a=^+^i;xlWg)T-PjwDt6_3_n*BskX@f^+|5m4oKUxB<-p
z89dEOBO<Vz0k(THjJTar8D5;zVLV5QbB5HN<Hu=`y0a|jOzGQyr$P>WfL%wnv#@bw
zgQ8YZ63@;+rB>{_I?g^cHrf|XkZM&(wRp-y%vc@B5NmF_W#yfwzlo8`AyCXY=f>x(
zAOdQbo!=TYWY+vPQbVq7e%qiS^lmLw%QJ{t{VqRFgV>SHfuX&PQ>XW1DvUI#ns<RO
zuSwOs_xkdhRL$GN_++xS!K7;5Nxr-$Rr8+f%WG0K?`B_Kld5^&_vJOIXo&^Xw0V7X
zOL!*}0nNQ3uLqi&N3y&FrMbE1=k=6;=6N))mjv`imeM;{3a-xUjDkNiv5OSs@XPBu
z0`vf_#q+w20-Vk8{`G))LdZMdGOHOgtHp9NOn1C+PPa51v^sGV9LR-FGup7(2%@57
zp22aq!GUsfxZEy-s>`*sN?7s*%+cHYWRGSk5S9(hvcR9Em9V_ZEcg1e<QptK%#YSU
zf0HaKImskz{n=8olv&R8XK8K--)yo#I4pnPBqI{eV1c<h5}FN-IJ3FcnTM7@E4f^Y
zTupT5aXOgWMy}zJ+DILwF4BOJnz=#`BG*FN)JTOcsVN~FJR&Cr@BpMmNdKT;szAch
za5}ILI729=3Her6R4ccIdD$u#ta5oOmzyCB#N|jEgtehT*cuvyv7tej6j^0DmbbmB
z>P>ZlLlERV$p(f?r{I-AU_?zc_yZ$l`s7QWz@fABC0N!PuNiTnTb2f<qX5r-ff*u*
zS51LqL!d+G%woVi^97D80SuwDx>?>tLX{-xcaXHeFlnJk;yEv{NF;GL3@kPzokWsu
ziAXBR>jxbyDX+gsLXRIHlF+jU7F*r8Z{_9SEDn2rg|NZa0i3jMXM4?PBLg{vv?Rpx
zGAPaB#W(-bLLQGh-5G8@%T}zjz$(RN**rg$_5jBmASO(s2Iugv8?6~+PcH8;o=JOx
zN=e>fd@0#0iXP7ESdETm1sXkq%l2mGyhV{BeO`e-h%~{W{Ta)8pYgH?l_??mADjD?
zD#N*Cnw2+Q%I-ng0(OS_ar5OZmfT{ZLq#bw^cx%DX@sCFsN4i>Q%wPj_lm@@#UTG>
zng5|VCAK!Z-xVfOOzj%^_4^-M@IMs&<Nu{9q;m+WUqAjFMdbGv$If5sDyx6QN?v=~
zwcO!!|BLqgUgSg7^Owf<{G~h^>At-pwyQ6X9SF|XJ^!|d-o}0W(u5;GOm3qQ;If1x
zz}kHr0sc%k-Fsj9OB=3VjBPQo_t)wvFvI$<6&+KB|5tiUjN|p(n9tqk1P<!FS7Up~
ztK38MRQVdC{Wddy<ToG!@XovvvOZSG`dA?wV$pket)e^O#@J4{iACuN_F<!YB~LAD
z)CC_+*ae^Xzug7zF-PM6e}e3@*!cJ?HXuH49AwOopAo6uvDHDZ9>_1RyUpb^UJAV5
zv3zqa@{0!R=QJ>=VEsDQn6G1v`6d?K9UH7a#s=$mEJ}y+_puYm56rBC_7~q!{<GA^
zq5PW>%7YrMCtcewmIp`Hta(A()l=zTOm1NZ{AB+n<YuPqL6Pck`-kX%-o9l2#Y>-<
zxpnUyJ7xvD_w{|u^z&aX!e2H=lfPE<Un}i@I8(<M`oGg-`Hffy$BkIS;zq1Pd`2uk
zIr0fBJ<`?1$(bi|rf|eZe&rFsn5N}3U|P<oI5~&M;iGLH{f0y&<yGQ(TjOI;KRsAf
zsWAqZ!+!~RP@@TZg3^J@=ElQZjqfn`zwFsxnVsza%_-Y2=H$a<I#$k(i;Z)9VlFD@
zV>>$AUK-a2E=4&VLs!Jb)a5o$qB?&S%2#j<=G{#>@@pIyH|{kqcz-2toqt@!jL|V8
z@&9h9_+Rc!^f0e~VuJB6t&cS{(hv>QBx+r?$=1=b$>v*cx)nFuPtaDW#{Um{Uji7{
zS)F@l?%dI6u_Vi~WjkI*-s45`7AH=;CUFuwi5;8-3{5+XMl;e_Bh7dgTMi)!AuL@e
zDUgLNgtpMWHo$|v$JSCHr7cTK)Akief!9zdOA9TuukC9~%lp1_{{Jqck?lBfLi;kd
z?)~@w{O3RC{O6qizxRHqX_h}IRG_o``7_M&W3$e(IL-d(|BqSz$gH#c?of_;U3(sn
zy%dwBu2e)G!0wi~QW1`UHPn^bV~<L9zf*R<;FI0i{iq2pxwe~{EPqRS#Fg7~JpNL|
zOryu+L8HgxY}C0Lf6hgVVh8ljBP9w>{|#}jDOwW|Zcqz2{Wr#?6KTKyo3iqlQs0bm
zV@gYXD;CuFwh&FQ@;($8q+f25I$v&*I$v#)I{&+g9-ox@0lof((67>`i*EEcQwn`+
zR{9hvl!&)d!uNd0Aeybx;2HSm*j!PVKZOhlJdVJgk)~ojI1DPeWn1iJQew|nLj{TX
zfgc&L{)!oUeh|u*?i>Twe;`8|>{yFp1Gv~9q3=Ipx?6<|DYn@Lc1h8l&xtg>a8fSf
zJlXjWHYV(EXBWuU{&s#ioO3vw^Nb4J2si=Nht}FY`ASqEh5O<(W&<kj7ZwZR^Kn8t
zoWDToE0u3N1C<XNdYP$%36*bZN#)NCbzHa^*jY|m3V@63!ck!`)3;$t%v!s<X{L9}
zOb0W+C(hGc!A$ROn)xf6W`192=3f}h{0wvYYBRN>;m@?TquDcb_d~PNjjY};YE3s0
z3oa7L1{2`yJV%@OIgwEpkP7dfl?o%MibT!>Zvhn^3#f3si3-P?sIb^Xg{3AcoNS`P
zi4YaueFiElpP34y*)yoHab_xf#q(4cu+_P8)g#X~6)vF?sXG{NXrjV5G*RIj<2<7p
z$ifGjsPMriD!e~Lg&#Nr6+V1sDvV~&pu%4~GZp^Evq6Osp%96jhlF@;*7wM|8yP|*
zaz5kvV3?*apaj2gO$S1|D-hcH(bhm!_*9(dh=Ta<HYtt2A7TeQVPSqV*Z$9+nH?h8
z&#*tPxWj_gd_?BL;r1CG!i57gAc7wPOGaiE<&1bR=|z`^%!2rFIVc^(C*<^X5HGn=
z&#->zGmx=mw+p5~#IWV*uz|9>S}e!e4O<pFcf+>o>aLX-wtK%VZKIo0ZkGiA5myPs
zE<>|XtL;WOsO;|oy5x-8<4a+O#+O14jVHuY7QBJt-hflT77q~qwKyGWa@1|$ui`{*
zfb4HHEnr`l1@1}?ZeRg;TYob-_B#=dov}jwpSa>yt-Kl8o<Y52pR1nmoM_+ANv9W%
zp?6*prrcHGNMtpP_yT>`{P#f(MhM*9Bn0kmV)|FOJR=&=;5{x+dIofNuhb9XuX115
z%=GKf+rX>b?ZSk!Gd+u)JJY|mHPgTD$B5~#QJ!-gK9Oh8z1Iy;xmO-?QFgvc&=#Qa
zN;m42*)I?9%w*qd4I0!IpTVC;+}X|pV3M4HTTJcf0n?cqYCmC`iIzK8elLcp^Eu(e
z2uoZ*rhHj=q>)Zr^I>Q)exQjDA86vk2b=itA>qS-nBLs97{9fNFW)wkFJ&=)+gbVY
zsV&CuXw8?u{Nu=%R|m`N;t*dh4)Nu(Cca$S#FtBiFLjyaiE{nT<kJ;lKE2kKBWkaU
zzh1n>0~fn|&@5853;9S_9u^jNW^OlZn3c!-S$%U$9zRGB{I0i1*TH7}mN2wVL>`FT
z*!i^N!2@9~`7bRGF6tnf^%wOH&k5(W77povI^W;K%)cRVrMl1hRHyMj@Z*Qr@xbTZ
zhz2fuJ^$0~x&FV$xD;RiiC5g+H|xd{3UONrh3@IoZKbICycYI?{arxydFSqDsh<nD
zG=%5)nKc^&+wP%2&-hBya`F{<&^cHxG(XTc{<2A}`&v`{$tJm{AFvPVpDq5sLvpg+
z-=Cf-%)T|NFcVqWk!ZDddIqo4tzpV(%o+)=)%xVoz?OvWJR`v8oMh*DU~7Wfuc~a@
z6OT|BUS%2JrPu*9THbYu0MpkcqWf<*NfQC)jx@z@Ohh%mL(+Xv{)VRV*C&?V5LU?b
zGwYFMBn=P;jvCa-GIFg2no|+9eN4ZK?B{ZPLGDyj&l(S2gT-YmDE+dgwxYRjXlhI2
z&ffdwumHe)*ns;m62x%$H3TqF$N3-vd+l!dz>b7&e@E<!y>^%U-0g{7roSd9!d{ac
zbt0VeM$@x(n&=$&y`KAGS<ayOMc0yN$rW=Um#GW4d<0VFaUjn~nO{jfvkS@2H-zP5
zWX-*RtCw#je?J)6MIrflQ6hSZY^jLdK+dE^&ZzFQ$zNH{)i&K1*26B`{GBT}VLUrY
zt~Jij;F)b5Rw_oukqZNn-+h=mmcB5r2ooeF?stEIJtQB%rBgcd^sQmP%H*!?2C_u*
zd$Bo8aY9#3iA#zrSH2<u@Bff%Qm$=sP06)gt{tIkr-ZxYI!CVEa_x~TUowFA{Kz%>
z*08pdbbGlk1ax}2kDw>{o-kk*PYAT_!l^{Z;UL;}I}-jdGTZhfB>cw=?@dYg-x=Q5
z6@>TqN;rik+pg@F@Fs@whOS;8A8msImZBpTLR9JzMaZm(a^~7b+82b{8wj^2VS`vF
zxfQ+3uzEX|2{;)fbS&3l5fL3}9g2kchOW_|MxWFmraI<njaRWY-q1BykcR4=_6=Rg
zz&LMjh1))6CCrO#K97PfN8x^nRg!;->pT|lcxg*%Ve>v47SX~oZdP!-E2IyhF-_PN
zB>4F0e1yiXlQ0Jz=bOlFFotY+DZ&c|B*PwboI7TWrOusmt0p+-+PMNL3eM@#M$JJ-
zZRmJBX!LlTjmmL7w(C5KKNZehD+%NxCi2&{^0k;1d1Z}6S2I_hQR>>n1pb!1+(5uc
z8h>4DdzLcH7coiT0R)z<Ybuq%0YJ&U#1`9+fV{$nmDA?WIjr>tgWYVrF()kX2E&`B
z(MXmpncrYoiHJtR#hewk!eucZDVGKaxwHccVStdGM9AR1w$6X~$OT0FN+PjqE)g1A
zrC~D9Y6;F`vICo5e-+$flOM<8AtdxU8~B0^d<}s#%kl{a3H&nxYw<EX|F>jI(hti^
zNxEJ#Pg>iJbg6P33k?37aIY2}>{4pf7=04*8^_h~PlbR6<WeEI1kn=|QUUeI3(A6M
zopqJF?nX#{5h&A0>bm`Wp<II6`q7Opc?Vhm*3S~kb+H$)$F86IRo*U^@L@t^X5$D8
z>BQW`A{u<brAXB|x`l-`cr$}SD_waf*@Ge?-0$nwwPqC)AeJ@|9UC_z)~ALlUY*D!
zAF(`0Wf1!gHW`5YjwoUu`PE47JEPHG<a!X``CZXj_~mHy-Rwwb;gbl-ZwX1w{+1xn
z^}ggx%1g7vIT9S*0<8(oiF8I(bbaV)b_N8`*4gajJ$MCX!v3Oi^}<Pk!3S-RxSy+-
zkJQPA8<<_@N9sf(=Qy}Xo%885Qs<dn!+id^Ea0C%iSo~%MEU1WqYU%EqR~H#^3Ru|
z4D-ck^of9f{@Kn&grtRkzWy{x`YG|xcb{fw=f^(}h8K>=1fL^`MJQx;QjQdh^b?6Z
zZGw%o7KuFVrq6K*kz(hD5GP4OcP6lRlMre=lQsGfipZp0kQY{Wu>YtvN-FkEj^9Ao
z{TMHwVsi4sxQLacCPzYVDXn8H50=zAtf;^n%j5qt0q@1tAFW$4lhi=ctER*y-Ic4_
zj-G^*a&42V8ei=a?g(8wC9Ia^90_;JwMVXMWzLmwp8-y-AOWt|2d-^U${46ZP{Y&=
z<+Om>2{kehDjFG@GnYLj+7*7=OP}q&;}Nm!tP$2vj3II}NWq5t5uPt^UWS{S0uCz6
zPZ|F1*x6S!!LDojWbTmN)uW9XBTO4Q9uFEl9%rM@0Ndh^ABj+1r&Fwog_;c8wJCb}
zD2UnDggOPGqTF=eWUGk!(s^`A-N424Rru@N)4P=6S0G&iuR~zj@}^S0X~yShq!`x`
z7-zP*&TAIUY$k1+nXUSHt?lQ*^5?2HoKMsD5)byb!Ui@YV5aW2VA^i$!aU7x8|sTm
zI~S9hRK@PRh-@Jmbf>&DI50*(9P}^|^iX0CL3EPUm%k~2D}J5Tewn045EsMg*O?Jy
z*IQ)|eoN}=B^u#-=k0GW90{QO1o90Y?he3uMHI?=-T{Fe<i7HCh%T`}vxANJ>wIl1
z=w=rCnO4Ql0C!|~kwN%;NcBX`q|OHkTL9{V97w=;Z)UDC-Xo}^Kff6=ylLjqXfyAL
zHuJuqnGf1l0;#|cJ{pw%UbLCtkD~R{ocsXR&qQ-S8_oS3&o%`k`9roGL_bfGjNp1Z
z5<34>4bLb&MT+fXu|IEB?CDJjDZ=3LyHV=-E<s(ZmTTwtqKN%F7S;LrN0idvIvWt4
zEi={`i*fuH+Z@E%>Uz^^JjP}>__+xwO^}?<j({iphS8J-cD^(eG(2CLa{3-(8T>k|
zS2Fp_ND+@3+`2=|;(WF3)&scrqZhb!CH=h&?@dXVFFA!<Hwf?VmGGal%$5BTChT<U
z`itG11<AQclg@g(mr0>LNa$X!opI>hY3)G5bhcg<)aa8ML~ZvxtwH2<!`Yf-UrENC
zJ<xDf44p~cx@FL+TL)r11@B6g_??Fl_L$(^ic8WF+uKW|UV>PA1{X<4#iY3V^HN+(
z$}$zZT3S<e>*u`(*wFjvw@JMf7kO9evBb@yMm>py#4Y;HQ8tsfH7)7?0}Ul!xK6_F
zLe<2Jt_#9=!@o3w9UMvA4RmAUN5YRYyeA>y?=ZYq^|kqIa9@|COL%{;gwssFvR}dn
z7{*l1`3x%Z$M2YQODJ^Jl(?k0a!tt9lWS70ZE{V?wOy_qp=+mvyX4BZ`C|6u+9TIq
zxz3eqpJKW#(c^=Z7?d3K=fpy=CLd9lG{@viSp%!nYa3}>5NdBA++L)7>JShjnC?w2
z6AYa~LTY(1U8%HU_b|qg0-dJr2x|06jkmMLJgxDI41-QnPojA5dl2KVJuTD}*SF`U
zI~GYjg4(fI>-`x@cHpZGy-%7db2bQ63+JqrvM~_IoON3EE{5^dhF<F^?7Bh9Cc5^`
z<zru6`<=c-*M6zT4+M2x2@p()eo+{&W-31f(|ZIV{yJCoCps@unwmsfXIlG`@L=5O
zoi+vA=E+dn^a~!n?Y|}6Jc8Wzk7*SR0|kUL^=r7yC+-4@OTH&Oi})-H0qB_UzQ8V0
zWD7~@{soUzub(W5?UOG~X^QY<_v^`y;Uc@W$WmsfR^X}_jNK_9vUKb&1@R}48M`}}
z*VrqRQ(nq+yqG>k0T9qn?Bs0pBk2hhL*4gqm;#VTmh(8jo{+!-WH_<CGluY*7B#f7
z)GEo6%iqd?gmc+WVp38`b*AiPlE4BcVLLOu=F}a8r8zZmyWg58wFF?9fYcgK+LTDo
z{hoXzB=s_why#SkNexMZETf|iLhqy<nPRrKv|d^Ybs!CNzg+tMDhg`@l%R^S0Quc7
z=w@dTW;d;_)m8&4>3yrBnDgsxfM-1{+}rdMH~5N#i2cLNmMLOECv`KfqT0x0;VTkS
zN*a+;yf}+wssC9N?YJR$Rk(U`ow@IdEn%rdpUOi6vXgo*$_p*7OKcKa{4x@-)Jm8V
zBQdP>M~+EsUa0m^Z}PFYe4T`VB=Nx=iTnsvll<V$@=jqy#6A#D^&*_s<xFs>Lt2AW
z>G!h4i1hU&T1w=!U+HT!E$N(wM1FG+#^-N*N!tEMs*HwuZ#VtT>z4pNruAwB2AP-Q
z7P~JZ<_)ACVGa{hzs4NF9r~EJSiVI+$i&pAnDa-t@HcOn1lm%mFC#F>ycL=QNrixF
zX8nr^=}Mc?znD|MDkdgr{}Sc}wR#aTwXTTPx*}X_ceGZpA=m$cXsx3UpuwQ)o5|uq
z^cGH|SXBg~|Anl(MuHVy`CGeQ?=2#ihH}=$j@j5b)>!*<(24ACZNY|cUpqZ(B;4h>
z_VXE#r~R${awrn$wSNFKs43C^xB3QrRzR58^AXVhcP`0vgKez;2QCp7#Q)x<EZWHY
z{^cSo7~J#;p=P8lOsJ;%86*rb>(3Av{+h{V!kN(huOZOaMi3Dm)Y@-{i$%tM0dcGz
zI2pk+FoeGkVPtKj>G_n<=68nqKSxygGm93Zt<BniL*vNlf7Ff1k<tG5xPxGN4Zl~&
zL*7^2|D>z;Z@2-Kg}8Je=J(ydFvcc=_@Wr8EQl|TkxMt2Q9J!hV*d@&Gzza@nj@JN
z`17gr)EPSvX5R-ihOO#Ru~d(WrAAaNounPG(jV|Cjz5S_M}?MX0%sUmm{XqmV4_lL
zRz}lzD|fswMt6YI@j_7wSJ)BU0Qe0a-VnvZ8>4u5Q*_|>M+g1@qpRYtmuCClLR~SC
z-4C(hAo^xvR7Lq8S}-p8qWH`;O7YbHE?30RUoia)D4d<3A~~JD$UD#0e)ilNh|I#*
zW%<`Jo!1Z|tP_cZDJLN6|Bl7mOy(D&lljHyWPT|+nNLK?_RG=v`U>YuSB@lAHu;^`
zcp}(|jA!;pWE#W6J_7`iV&XuxP=9RJX}p0R5L+w^j<bWQcy}G|Dq0b_ey$O%2xlN8
zFTG4keNoh9s9`TeK7Z{yd$T6E;M!i%B9XeFM;kpJ4>fu`9yEG9&PKKC{>{>;k?Nac
z-?d%$Z;AcD4{weAlONs|y9OuS1fu>+q_Rr<>tlMqG3KPG4x}jEQ~!o~;&Wb?d_whO
zs&h%ac|r8!?=XUITS|m_b`syVln8w+NqpNfi16E%DN@fi{5kU%smz(bh!(6FOg222
zY-lhevG)V$Ev(p|3k_y8G?+qYFbxdi0Th<5Iu07~c2LCIPPW3|57DvVh*wBme`fpd
zkv@X>D+QKdEqkq$58|(pxFYpcG4`zCSI3A&<&O{e{Gsvx;m0?<0a)g*|Gt>|{@#HE
z5pf?v;BsdD5dy<sHszQw{Pj@eic%=D5V`%A#=50})5ws(s}Q(ips5(2N|0PWPb&fW
zu#0oW^+31%iOAg(i%b5^lCddc^84RxATA+63fzl;K>RiYhJV$RV_P$U9DiCsZu+2U
zyuW6E`)x^ByA_0Je``+-*dU~PAqYRy>UuG(;zc01fSvy5Z2C)KL3;s*@CAPZ<ibw<
zg&Tt73#;JC{r;Z#VUTekoO<F>MZ7njM&=fhdjH%wm+wGO&6B!8e14qbH;DJgsidob
z+JTz-o5{KB<8y@DpDFROJsuJ-SN!{+?HNNru>TU1?X56UrWb)rmf&K4bU@7CtBtI(
zrG{<baw+)?v;T#g_NWBAaQy`2)gSlQ!jH>Z7LeD+V^jyYafFHZlw=0<@;goO-))M2
zQYr`Kf3L|Xd`$AMIK4!gm&<kR=bJHA@$W&#?w`j+mXx>Hz`GIHW2;b_NcL|a)w$wx
zyqX`WqW?D2)}JEdlD`P$QmdOk5f?)K7Sbi~_Xx~v`af8Aw`fAzG&`OD60Lg;()S+4
zMH=`iTk0A12hHwK*brWNPT1}N;4@6{5!Ly8!1+IEMINtfBMatj;UR=`jN{@3F{9!h
zjZxUCc6Dov!fR&u7V$Kw*4_W&*e7MmQ@@8>JN>Y#e-@4YSrq+K(_UoKUc@vpiRVl3
z(tU(@{!6+9w~P8x2r`Am=D$Qeyz7yNFdjVRcE*)E5RK`>a;Y|Pz6>PH7!a61t_Wy^
zspZ@7VT7Gj1-V!IlAlM|jGFq9CdvPiI9W4b)sHsCf3r#Yf3hk5@uv81H^o2Jv|4;3
zP8W}^4vP`e-`YFElQ(UXagTDq`B-bS*Lh~8;xpS?gi#_0iRAbbM^r^3kz$bsB9Tb3
zNCS~bq*$bZh|xWJ&c~jM3I1WY(@5mQdMZ!|ElOgMAw-59K}aMLDHd)ZSRJp1sb*O4
zgi9Xv8|XhFj?`d*JLS?N62$9LK8V+v;tlb=U&gWYpOidhuU`z<D<Wwlk%(J4f|ba`
zMyAgP9X&>gZdP715_7kaj=KZtC_$6G#$>MvveyQ|bqod=eH;;k(QBH7+BHq;?6soK
z1{gfpB$TdiQem6pheV~_iVmIrpNem?>OudpxbA8^%W6S%-MesdC%`p#Rt&C>H{tqt
z(}FS46fZR`2$iPzRMT9PC9V|wE8qkD`RddShzApSU!1JsM3;{XhmZ@Y481!nt0IxG
zK#9t#S=lYhl@WfOz0L*1TVx1-6Y|AJb|s^Oi`1DN>d4?Ck=g4+nvO&wl04E{BoZzb
zaLFBkj9=3v<JUCF_>E06{^BN?zOE_0USxbg_!~lU{-wU0SFS1e@#qfX>~eqh8F|`r
z-`7Dy$Qe#V7r@~}R0rLhSPg6kgWW3SgZMTne+C*4PtS$q*$74>k;t+dSxLi@fOH-T
zNGIQfokA0K#u7X&<CA0mcoTL?P4S7Q`0=Lrq+&C|E!{~YcPU(Fk3>d!J`IGMc2e~I
zr`BU+FkW!JCHXDgF5qTT^4pa2Z|z1h^PDrCAg#bCmxUvC;ZBg=;ynT=yuFw<IkMzk
zgOHPY7cQOnb2caRSm!?>oS3WT-5`o2`t;z?I)>*h>|$9-@7IGpd{sbV{yIq~lOz^w
z)CPOKPf6kc3V6S(4K9%|4(_p+6mz(#gZB`mHX%I6W5Z52VdO8lKywqR>ye`RZ`-@%
z<3>*Eu~-3#-XzOPv3M+1MMMVk($op*``3|>s%qaHX{x3`Uk7ZbPTu4LojP?)E2dMU
zlK3T7%xlFY3m5b#A0H)2jV*M#zs`Q~Yai(TTNCs?GB@RYNUHw`N#2JIU|vdK>h<&>
z<61P~nS+cP20qwF_ocY-mztN_h2R|TDkh|45H}(yj((x0jupg|my`T)T&0IZm!7@k
zi%aC}Wj9|Q%U}5HB~_G8bM{iggK?+ZzLp?q&tB4r<jk4YvwWXpGxP1VB)Y#BTfl55
zbk&r&q_}cT$kmf;Qm$=s)iZMK67C3HJ0;vD*Ew?SmTQk(d*wP;u6>R|cY6rB4#Ly1
zNl>C>BxO?XS27`GdYpA37%ecsD(}bA)AMt|LA!P$b|G^<*PO$5wChavE|ytl(cUFW
zBs}}syELUwJV>MO3mOgD3nd2KKhdgWC{aB6(q?ZgD7x4OGMp-{z8XZ*vo$Ds(HoGk
zWE=FgJ{`f`J$mN%-&oL``Q;?{T&(AFlPKD=UP+!z)w4l`fRx`@k<m+dlk%B_hpIkS
zdWNT+Zt^F8Ub=fO+T$-cM!a+oNjOHl%pM~q70WSVd3Q#tEzR;b5sse=4f-NFn`9(Q
z9Vt;|iTAZEk=7D#Vu>eOmblm%WG_;pHx??gg0!BPt3;|~9&=WZt5c~ZD_KX+xWptJ
zm#Zt+MCcmM)%29)YTX_Q>s8bB8g8Li%4j>Dgs+h6a=HEpzcvkNk-P7d*ptlAlrRVj
zofPRnP9Cq~5c;w)l5lLbiF|--Xgi0#hAHzF#n$SbVoKgE!Km|T)|q6eXNr7vF@yZ|
zOp%6yXqm0Ae~7Iz_Z6Eq@cu5wH-5;ZG6g_6J+F>S?#G$F$=4NTM8b;FrUJ6<Z&O$+
zjz%JNp8KZnwIK5@6VX2yy8<eJP6Q&?(@CG&hif<4g1@eGicBfRQ{Rk{;j}m+lxs4F
zsc*%&9%}g8GP%wWYxj@GOylFyxRgL5Cun%HlsGPtaM*ZgnR_gl^8La5?&ta>J_eTQ
zx%%fZcR}=8HokF?Loq)}<enSi+lH97{w9;t^8#09{wEQaK+y&oEV1z(Q;v;D3qKj(
z_OrIggUmcva^Z_4?eARcyv(&V&b^-qiA9L-Md8+pp-8}8e45X2mmCud(ESj(>s;Z!
zfUI!~Ahf>=$btb%f>T^QABzf{-zG`|lKUh{E{J}Dg(DP5YUz30QlO=*o<BKXih5?T
z9HGxJb!_^`c~I^%3tO0sgPB<ZxD2uWb#!L_COR|Un;{HjDt>6DV!IUvq$|m3kLh|a
zi&S`S*dQ`N5iXBJ!nnGC405hGh={N-Sz+$x##VRF^W5&<fs4B5#%>*e9Xb?qyD#s&
zqI2z{gY$MR+6(2=^_+wAuuM~p^;S7<_nywqPMBvslH9gNZmFQ2)@oma;vFW{3tH=(
zhYmVDc7bJW4w^eSkCDp|#hV5FC{{Zd00-wOG~ipm9&+%)K~vCUJ-m6)k0Q4(h<0|)
z>Fnyf42kpRq0BA}r(YWCQ~>7tMKLBRislx~LBAHJfq_`3DZDT!{MuL#J6<%;WFn5I
zbmzwo&RdHvE{Y)lMRgGET#8~#iM7toJqRw7G{CcbevC!a2^3|f!ZWxIC6}PB74uP-
z1y<7VU1j^h>K=eEov!hLMWbtd2t7iGly#S&9cX3I3;?p;ZwI9|3~*8m3>$q+cS;YN
z{7jS_GLRrRY<iX{*lf^*^esWlQh%#o4w>8h#t9*IoI~SB_9gQj4tfVCOW;A;r9K%T
za+#llG3*RR70lk{ej>pq4z2)fhTwJqd=uQg9eo^}w|5aS9|v*o(F8<2M)!vDC1IbR
zFU9x!QI3Q)uH;xO7Oxrtcl9OrEqw6GMFB^VpRV?t_<$yHY7YGLJu%>HF4nGVn(GMP
zu+Fu99glUc+ishX=)q3u%W)2|tv6n|kd0m6qA@mg!**xM9O+)_-pFBa%xw3t7m6Gi
za-t*fp}DDLj^n%_%<gGS(9uo+a&rqn*x4;hV;pv0@>u7Ky%(YMtsLYQ<h+o>W1v|=
z^(CK<gfe3bWRbi{r6Wp#ot6W;d@=@TA<0CdLQ1o6(s>t}4y2PvwYe${`m8jV7wQlV
z^#{UXzTYLN7E;I;YA7}k=7NPPJQi6YvA9|KUPS4;#1{>yzci3z%X}U}H_L-LQ^B3K
zf^sm(u}i^<Kn|_+$zQl(l|}<@TJ7fx^Q;NwOTt<|pKMC@S?8x%hPpV+Q0rx4uobhx
zPX+iJ!$9s`M55aiCgP!RK68hI1V%TLLbtGI%L7}R$yJs@at=HwVaDC=Ghrvm`H~K8
zq?63IgS36?04TeYlzpkC?8`zlFF88{?!P?LF^T_*P+Y|YDHq4mn$vy0-0cG>+`K2$
znK0O1A1aCNYuOM^^Y{akX09{?^Ej{>Vhx>(P%~%+vWV6LW)1{1t;8BcniX0UW(x!S
zLzqz!Ib?f<B=hjqdtwBl>sgcw!HASGI>}RAA?5}7;fZ-&ue*KL#pv-?WW%~50D41p
zkP9znpw{#S<Y<{J&{V>C#45Hg0z54s<qm`?cVY8<`jorKCk&a8#r_0K6dy`a`r-sH
z2@#D@=u%6&%R)IqKg;b5rtQ282GqQw1u!I(l>u50&f}m~g-J!E1{Y)!`kGJ^oc^^P
zW}RFIkd$Ji+{NK0RR*lLLxQ+a@w?HA-%WwMeO8v20Jtz2g{M~2=UBPh9U>Qy7#y@p
zV$Edai$Nf<FHBSO!i^Kf{b9P9Pr6wUrkjBfo&!O{$yyktn?+H&S!|I^y77tVsgaN`
zk%ZRLepCqT873!7rE8<)v#xpgzC69yAHE2}^?p5xZt$@o(T!GM5gVJr;$SE$4q8*4
z;p{*;kyqIz0_w5i!BcZAi51gn3(PUR+m1W~vx_%tctHXfstW_uY<5KnuG<n^PbeK!
zggux*Zo%XVY^1(Gx0n}<)hJ4^w?ewne5<l72otHoI6wir(6YgzA>a{`%1TnI2p5Gl
zmnC5aSn7`tEVIl9LTr=eKH$hptLikUc2O%SMVkO}%Ab3YG0<<qA_sCRtO~3NbHds{
z2(An1<B(D_)M<7^s#0^{>{JzHk0I8iU>vrBadUuF^8J=D-*2__2}LHLDi+%wmcW;U
zq`dItj-X8y*q2g(Tox7}J6jA*v3R-Vxhq1=3UBX<njx^pIFdbfN!ja3Tx>489_&|1
zex;S<R|S&%>PtX6KYom*wAN%QfTFEw+Z)EMGQnKSE)eRL70$|3Aw~s>FR%<O+JUku
zxo4p=Q=p?mo?8=x`G(mfUv%^tevB~FFAJD{c`y-B1uVlFwSLe~v1<K_FypQiV4>Ep
z3gd!gxjIa}&;{($#5{;_jZ)an5a7Pv69{l&;`KiN2xa3L0_C5LA>x#rO#uss3<!2S
zOyb|nAz6E2OEdAKcetUW0s^K3$$NXKBjEyP6Mb&ZyW#Xq#QqK6)QI6nO2+@;@$zJT
z_(UT+H8$GF4Nv5&Q~A=S$!tA4Tq;gAriY7Dxl&^^uQBJW#Yd~fllf|GxKhg23+3wM
z@MLXrxLC=ay{7FbTbtZ8mY>R3i@CE`8XC@4bK|&7?%3{wiWbhLrtPqitrUl!Qm@ZY
zO+oNehV-0kwZM!W>e)NBLsTNDAX=}M9H&w(PSq!d#z{N1Qg%c`nBNSLhzNZ3cIGpq
z`IE(5UQ5(ZSMoIthLb1CBggZ(x@l#qzNu8&u^ln&TGh~Jshpe0*s9o#oRJ17D&<;n
z+AjpbR6AWOn66ConJF6wb=$n^NWGdj&=p6k3PLS^B2y@qO!8!-o}V@ux$*p{21})4
z%|Ki)PUfp88u^B)Fu?>ZHC~lWzgZ4NBe_arGFvl|O3>Kkq(2G{Ypk9fDdjhXMn5^J
z4cHMhilbvi1Jr0P3kWrzO=d<)8o_i~q{6L5D608_W>vEFaSctDM;ms~x$<PCl&=@d
zQ<`@wTQsB1PglxS6V@7)Y&C0uYGiY{e2sX<JSlE75CJ*UL%zgLafZt83dKemV@SkY
zA8$-nP<kX!ppii^NAnd#fQb{0ay_fTO0|64j<_}sQiQnDoa(7s-at~WoyY{(uI3t<
z+UcpBX&_$(`ZtA2XY1w3Vs2BZJY`@J?3Jnwt#GPbod`{^nO}^fQ7mf-4IpKt6woRs
z&;kmI%iuq`Ly{}`P;?@HTGO+&S~-`=R;yW)P(8&#gh?V-wIrC!R<a|-Qn7Bz*6LX^
zFNI=$GE2lk)>pHm#pz7}l}{GOs@ZxzgDJ2CK6!h2$`5nMKz;*Q9<j_?AFt-KqnYAV
z!3>w=A)TQlP)USjju#8)mvc|PEsjlP4e|M5kX{`$pDC6zpp$ZAs$LX)10mIXt=y=J
zoB$HF#-`D{5IMOykMfg-6p(8mL4#8mM!-n9v1++du@#AEGu8Qm^ru+H&`70aQVj-R
z<yKDQR=t`PFxnlbP^lFs$yz8BVi-eVK%fzB!lS0?$;_$jM807_4RJpOp5m{=aYiSz
zo3izK)kq{pF=3E(BtL*%%ON*k4a5RVj25eql0HlN5){yt4Ko)`5g*#dL{Pg}4tN%$
z)qE_;8I6ES5ZP3#7;tJ6BaMP-(Mlf73h^{KZYY=$Ovz+<N@yAqpY4s+LfI!Ki<w%!
zO7WjLxp@nEMMtdH$YsifLaCfJVyif1g-fkIib+@aoWyNTyT2RlelQmEk{!cdhl@{B
z#a4Q*TiXTAY~YxtuGO?tOq*xYR%_a6rp+~Jt2FI)ru7{2Iy$cRk}JIh!=9T=dtJ#v
z&%MH%i(os0%e^>kGq>Z=xs~fb<i$I-B!|-JbaKVUWWAo;%$|o@rOtWUseLV5=za>R
zJx`%*>vo??3-em`*1Cmo>dFnoB<;)ABkpS1Zfkg3r?zgP^$hj4?Cq(PZ4E<s!~yNJ
zF8lOTTldy_6whwz(;wT@hj)I<Id09ztufh}))%yFw{;7xX|gp8;j){3xii?Zw?(Z|
zw?RS;i`?>JkbCh>UTh54WL=_;+uy2^+u160M<DFBSjJ`Z&0=wTkQOj_Yg9b_34JOp
zv?jogR%3O;?VfEEt;g09hpq7)!tB`ugtY2U=<v)5Z9SY2Fhh3n+7--G&}(?yL27H_
zJUc4{m}}jF0PBxtCV6gc1!8L+Zb`@id74r0YtdlPi7B+dMWLXjVEqp&K67bjK*kn;
z<!8^F`SXCrpPrzuLBW*)3ihq%BE8jff<nm_6$2E^hAJQSne)t{HH(qfLMQ}8K%QYj
z^hHza`fgaF1}&V85ZzhXstt;3e{#rMllDZnT;avAf$p}GyUs9Tx1D0=ECt#-=6P|n
z?Ic}%9$}WAI$HAatg>#FRs`M|Q!wkO{ps>4VHOOvR;pU3LP)iMZZHXjKB@Sc0iejW
z`R=MZQ2vAy!bAX<Nar&lT2OVS0<EEKjp5eh)w*nW-SFXUwHC~lHoO}o2i(j_&&oe%
z8kdluL20Z0{j^!;_Tw+-gwcjdVvahJZXe(Pxvou4z}`wH;@*m+`yW%syw2oM;x?~0
z>3+BOkk>ZoZCaH$?zOuQRnts%|9VaxwGvQII(FlhhLtwxt#jw?Vk_R9<V!twch-v?
z^_-t*G0vG1As&YVJZfV8!a&Sx??BPyA<6wfA06f%+!;T{4)Y=3;Vo|6bMy;a$L>>d
zcwZ1Vd&HSM)2mRd<lx5}gU83XMp&c@&jp+W#_50*M8eKuc%d^j>n;lUKH({u;XI~y
zsoBX44~*#s{>S{(XnrbpIs>;^g?>!*YBEDkD@|0#g~_etu>+DZP8j4{PYT^TzR!Gi
zKWoT!6mf($`66|zMmvsrF^y-dIyoect+3xV>}Iip*Cqm=QPiUjPn(k%2>W9`=g=Q>
zI=L%}rF>N~o%R+c-QR2*f@9{f>0`-4I$cLvd(!=6+kIXfX}g$a3$=qundZ$Ohg?X*
z`?8tY_n<^P`Adn#VE9kO(uo0-`ox`SZ`GhT0EJ+g2cF-I;>q+7<i%PqxyN&dO<zg(
z^gSl%rLh*?=Us}D8`B>AMad)_JcBlOak3%qp2f*k=qc|0J$rIrf9EcYf)Kb#_r>?w
z!m*^g{?k}E9%`$53$fJ34twp(b@~4OG+HJK0P{A~<>2mV!=O31e+vd2P8*Z4z21!N
z2RgR+avj)^$AP)YmA3O0$v0t~gdg50J5X<B@{N)@Y{s@ZGPY?M(_=EGkNabaB|nFm
z$rWtNSP*{Cc^KjjI-)8Mx1slr+YpW?k8m)Uy04<^g-gBmmAGP*?MbWy801n6@7<>l
zu_+Gu&y(roA;~<1=uXWXmvMd*ht4^NZ@CMa$qG(j=b$%l*y~*GE#B|p8!bftqXO!m
zhd_N5K&^y9-Fjab(%*N6!qMNpi;%xora>SFOmCS1(>DWvTV^W2YZTs>oB`bL%9zl_
zUAw$N^&4)&q@^)yijUVd_3gU<5cJ(L(_3@g>sao2E4+?nUfXIfVX5hE+myHPT9Vbm
zonFGd`}RXg@)m~a=VJnhddc+SuLUF|WKMd!`>$Rd8UJ$HXTW<gt!Ql4G|Wjy9c91=
zw+)2|=J6=OtdGn>3-bAdH!J!44#r@}=VRd3DES~$XXBvG#-(5YOFVr|#M498J!LsJ
zmOKmTz;acNZA)$w3VqdGLqefHazx6^#)%LvzC>7=bi3{o65cBG`&)MrOxN8kL*mRp
zW(+`POhfT`$crD5j=pxMcJz*zbTp?~oCRE;bf<km2Hj}RJs!vbnv>L6yjuEvtMnOj
zzl|w@gSvp8Znr)C)}6a#NT1T4W*d^XIO#6BM_T*lojQVlar_~$V;N-M4ar@J9x7=Q
z5I4}#1|W^xC5OE9Di7ZA_2BoFUV4)kA52{2&2is;2b)^vKIuY|uT1oNOWenudq9P6
z6-39}r5^>VCJLlrk|^ZR;76P0<kbdM|8eF4gy&>U)0}+FjOcwae?(?d+@3o0!(TGI
z`o{oM#Py?h`0No*^V-I}IH$SSed6Uhfxi+z4@w~o#N9U%D)(<=yOKlq3<-B)6Cw=G
zyDd0h48RGeg}`~Q0q0N72b_HZ&Uao;a2|>`fn%4n{RT(>j2;9>uYS3Yqi~v+9OD9H
zSMPfTTd!c-81j$K3?7MajuPRA1e(tRnm~AMbZZ5(0PbcVN;FA#%4bH<&&G#AKYL~2
zvLOGy1^I&j*~rRpn%8#Hi|;Ri5>LvISR@Xe;U2$l%8`;!JLu(?V)u~^I^4gz;}AgF
zMIHkq-0vPEV7p+r40}B*Ja?(E!LOa>@Y7ryp}Bw!+TCy5!73}=x4CH(XOS+(J$H*0
zvvEi;$Nj52xs~*wnSe**khIh({`lp)yn*`xY1&Ic^=T6st<?FxJ4l_bOX6KU==DQi
zz)~{kZ9$nfC>4o7seo7)l=r$1n@WFq)=Eit+?PqKlJ3%bygun+m0KA?5Me3>7aj9r
z4S@eQPC;??L<CpA?j8cJyn!3Mc|g<>LDZWBQ3LJ|U<wjTpEp?gfWgw|MV@rIh|j>%
zd+tJeK9)Wo6D+yz`|jN3wH3Yi;X$Fq|MfEE+eZ_^xASHfyxv90hA_qh(y8ly&Gjh&
zLLY*7uF7DQ`>$sy_aEF{I_O<y%#TIJ{FtSW0ni7Bt@QEl)13T8?rWef8v6K<8Tn_-
z$UkI8j`)m`{{ZyicD&2b$3NJS|BQ~j-Tj9c=*RtqJ9jBF{$GQF*Pc5HK59_#`+$F;
z`wjHqqCH=)2ReF*4&Y;{w^;G<eyP&#zSjeA?wg_7LXR-W`6s8Y6!B|!>@us!oTU2%
z2m)wXyc#6^u(we4+|JcZ3$)$-<Q>ou(3mJBC99AmAFwQw5?H_#SP+JAr6?jpL*TdH
z18SUe$Xnd;KCg3?h=`R!6u))5StFsMq};A!-bS}U5s>ygY}$4$_vQ}s+P2C|t?(8g
znOnnipuTd`coE_-D*BQat@L`9uJrnrdOb+$!$z`1H=Hqw!Yh}0tGCIZ(2PqvW{KCi
zg6$?(40@}V+N>lzs*BY|dGdA=Ow9cyk3-r8ld8jQf7lSfRYpKxzRO!hduqtr3_S-Z
z2)G_5Pt5(SQ@|4a(Yp%V^9B%@J}6dm26ub&HhXiHdmWd+OG!*q!ns|$FpZ~xQMy;&
zfE2i8P@KEtZW3GLZVwiY<U6U@_pMv$wGo3o>wpH_(7wd`xLe<|bc@MlOw)JZ4)dvJ
zhu5cA)9Ne$blN=Lr8zB*EviHEuP}57{p^sMn1J{S0P+UtC~0pArZ2tB+X|cLC0_j1
zNLiKqMUtNT+qYZ&<?^Ka80LNPAksVCj|paz?w1p=<5r7Mdh*mUaP~V>=@lZA-X`p`
z$o)n_Wz^eV#<_6apYeQRbmxnBybnA7zu<oCE}KsE=KBsO3r;v8O4^=lNQh~mde9Pf
zipm{eox^)Tzm%ol15d|0ZsII#!`hHSsU&6r{Gp2>>b(h>$&+4eIPUULCk%gl;}RZ+
z=e<@uy4vI*3wykts_!ZA+ZZ2DD=*YpoI}A$Jl{c+IfJXnv^K*JrH7T8Pd(07TD(>c
z-nbMxP_r_YNKl{oFcvWC^<AJo_j7kZHefa1ZG~$*`5F)*#5hzeul*8mK4c99z=glY
z35R?7VGBtN>j2I|6Ow)I$6<W;!xY@jYtsE4c=fyYK}gdTa}|m~cFhrI#@6I2<ilK&
z;@E{@@vp;yux_6h-=igyaO<qy<Hc5jFTt?A;KPoeM7Tfc{_UN0l>c2ezt!t^KSEan
zdK+T2(|r<w_>I5_RH~xo`Q%S0AqGAQmVC?v0Mp}OQJ6c)d(mSbgs^S@H_zDq16X!#
z`vt%KpFvw}-fjP=hS0v-{%PAoJP9Gd?+nJBe}S*@znl;_13#bjTzV_F_j4cw!v5Eg
zTi9@KNE)=@a!QRrhQND0vzFoZ&M>!MZn*uO!tJ{fonCj+{Y&Nci`IB61|bY!q(k@Y
z^ftSHb;po*IW%&lfq5j+MIv-nvOks|-j(jv&55;$+Lq<j6nK^ESxnAtVcU=_Hvh$x
z9^mTO4dgpCfW+>f07Jb;xY_+vu+vi1>PDG<_fhby@Hdo)Wr#l>$$jr#X-Qv-bTB6>
z49ohzi0zM|eQbC2bzBcF?oMund)0jqtV@YO5dh_6nK$44rgO+!hW_SYK;0~Je@IM7
znSMA}4h8LU&$bgPYsY+QEv(9w9J&s=gJ1}fAw?GM@)mR)PYxkH>HZNGadu8|C15Xb
z-wzdiqqdL$min$h|DS=*OaXP!>)dQhE_6SPlF-7~mnj+J^D14C)Z7n;)v^TwJne0v
z0?QMJ7<!OH12CQ>#-Uox2gWfk@fbwJt$2rC-1+W#=?PE&`Hpkkr)pyMbF9^h&Ce<u
z&VP5yc4wcfcq$LB%vx9YI&{KT_N2mlVVF4oISho27zpi2p+<1V7u#bfVYaUV`7w(Q
zf~r<7q3Osb72<Zw$Um0eY7Y(N%tHeKaOQBZQKOLV?_MDs>~bOEOGs7@z{NIH^Eh)n
zFCFZ%MYpYRYMH>}Sq`4{Mq5szKP(j&$Dmu!=Mi1u8isptkYFuRPhmZUHPH}zCY~H-
zGzn#B(PpphN-sg(ME&seVlGL((p$R2TMREX*ljc93GTQ$?vIi@cs%XJ_pyPc$?r&s
zHZbItE#8t%^oOiRTc~vr^&Ql5PuP_n=9b%ckGEt6EN~p{m<yY0x!dz78(NffKXBJK
zyk$$VX~67HKukdh&RvEg-okAZXKkBdqP-cWi1hmvzu&nl#BsC~Ms{k@TeQkH(#GQ`
zb1^!=Vlw0IJeXf%Nk8Ur6YLAq^j5x;X){psO0NwY^Dt@L_Cp*Q%)&*3-d6YYA#dp>
zW^5RgeS0b^@cT}op+96p%adRB;=|r@j1CBRO`-!wyx)J<F<4$p+|N7Et+3^XZN6pR
z<`rzE4Q;Jpy)DVlN_!Bm%iyDc;j{;k1AnI>lP^IK*qa=Jb?a?8A_zu7998LprUp?v
zfPt(;Gs!1-`K;&sG~k(5c>bJ_C_H*yMb8%TvIs~UaErjx9&Zs)Jm_`1J!x<2upQYP
zpnI2X^<Hm_`_h89bh)=>khGCPYl~NT9&P7^htM1p?lOSI;dDf>X2|h0VmFzB5B-&1
z{0eW`u&fer6LEt8!@e~6TS6v#8HpvwIV%p7)Q+20TSxsLVx^=;-_NDzD{vL1*Ld?+
zV8<dcALjp8;5hDw^7_j#L9uiNjuuW#9R>ctIVJ}4r^3y=4!*W6YcM%+_p8!C+WjTC
zCASPp(pTWS?Z?djGLpC!GqnRAb1Xe{e!A`#;?|SKmDu;*CIFw~YYosyK5*B4^j)?=
zwN88UfR#>o8nCDZo425RKuI=Ropf*KZYkExG!{tZqNPOCpf?|>P|ANZu*A{T_PW(i
zFw_BVoOF^ok9u+Lw~>!~p`dd+dTw&J%y%!EO04jDU*aW}d2_dUz016Itkp0nHg3VF
zCVYR`+@zbnFI;7=ROz!-=4zF=`{bR+hQ01aV!rz(EcSEU5?u+)p$()lIo<AGVuyhE
z`T@2+;um?V-Cv2(q!F!&*2+g?1+Nz_&mnJnaz9bs3m;C~QUE;!2PK7w=n3)Uj%4}^
z7|`nE6XL#t0P_|IhxND%@A2A}d+EI%T%nhuCE)2gyV*+QS|q`L_Q&9Q*ZuHa_2i-S
z!ywB?fF~F?fCxqqtPgKp(mkYefTZ=*QhJi^PvFE)&_Q|^)4-zG;f!;CmT;|4ehHvc
zSZ##vB>{-bo|W7Hl|nR@+&Uaw<cn8Aed_Hv0$Ah8HAzSp_{9J`I!SD{&|(w~3p&X+
z>0bS4zy*H<`8d4BTe8I)+~5s^J_dysz70=Kzc=VU2+z)Z>{`7JD()O^balboN9T|0
z{>b&kF^1Sl@7vr%fCi@?ws}kT2^?3Ta=&{&l;-XmW}DN5`#l)VF<8*<l;0vy3;{3N
zV{gZ6FurZUtR|Pr+^kN1IxV<&Pkq#mb#2n^hEoa1xflxx$pfNq=6rKgPUm+qb~%RX
zMBi&r379P%BC_Xi^wP_L3vb>AFTH|+wyhrY>Wjg`a6&@f;&cG?Mr}O#CEUp++*Wqn
ze}&Xp+L58`Ug-AS2Wfp`h*~|?7p_6$E!HEvig_U(wpqpn0gv3Iu=Y@a#hI`6`$)o&
z=_|~lIDozI<=%>nu%oNXZyc*9coq`1;|1szgn%vZzGLXQHY5wA_I$$`dtT0-m#*@9
z4@=Y1<8s-S&>nA}+2d<t$1vfC0bfsYwYL)(6s%GuNWR?82_ygpaWOI}Jb3TJT!QED
z6j2{`JO(*#gnPDe>o~R98(bmI)^2R%U>)vX#<Vqq@IO-wZS$5v?qOo&x=v-AT2nY3
z*C`TU5UveuykdRq+~n=u>vh7byizQIMVMo8QTM|%Aek(|R`0`LR!{&U*iZ)Nf{W=O
z#)7}aTe;a=yIh3F3VOgn{F}U<eO_vrw|3AbL%J*g-zCr-B=6#nMtkB3o7l>D8w`t&
zi0|PDw5_M^dwA9i3#)gB-GLX-L}+Qph%WmSRD63R444gR=OOhNN`6F(4xbf6rRe#v
z)(7TLY=(M|`J9o4a=twgSQ&vkqBxbsvx+D2aB4=u7CqfRgvM^{vwjE%&yFGzDD$>g
ztGoAvb@#t>sJxGX2_XjF;JKTvLwqd`O>q%l3qHjb2KIv>w76<P+RlAA(Fe`stFc2^
zBeu8?VYy}e+gN^kAnG2zbI99p0NVhlz9V^!w;d8?MPeRgI$Q%%;%}TZ8r=Y<#bOMX
zLcAkGG4MvL6}|2kO*8)uIv2Ed9CzBV0-$h#q*EX2<14)dgNYP8EpK**(B3-tn^<u!
zLvI&B@~y}HVldzO<x=D!_+5ISK>sz?l{vPN<Qq|FIme6p;^blU8+U&$&XO_rA76e5
zU|r6=<LhVQWgYNBB^I2IA?!}Bk(C3w70<Q=DC(qQG#6S2{HHT;+m@V$7(oMvIN+rF
zB^-t#;@*SP9sTZG1g$&VZ;2KI>qGF7a=*j9K<<E0*O-3PP88+?2Wjwl(J^#ZJbPyw
zwXYZB@GxwfjouDyUqLboYF7az+XYG7vNBsE+p$i5+S>;8Ldwhs`Zr?jU(RXSs7QWN
zK#aNXy0Z}XAiQ8A;>~OLlQ-KtiRoos%N_Z`rR3;E-d&F1m0e4FAI2wEFLeH@P~QyR
zWa3wKEls~M_NMs5?%Tnm=AG>(kGI*%HN#smb!HpS^ZAOP=ke2;-k+zB=jnqOc%DC=
z=Z{wF;o0OvUD@Y9E&cpwhyQHz^L+k=mG95f&xOVB^Yr`N;`hg$zNi0_uRl+hzJJ{3
zXZtfeKmDdXd!xP2U$b5OO!xb2xBqnM;_23Zs`zW3mvuTVGv?*#!u9`qeM^V`S?#s7
zp$iLtvwv)ry78Q=yOwUIf9(Fm!`|C*cEpa`RCk^#9W?s|oBQ1;UO0S`qN(3zy0-P~
z-NLgSK6(E9`tAb)c{AL2fwKJU_&1uky(Qp9=MU}dlkuaS2a^xCy&W&$<L_+koh`q)
zzi*pyU-K;W_jJeCjQ4LCdhzjY=%u;b-RD^Dp#c98`fG0QT>HJPxjjP{&FvjK$8t+%
zp|j@px=ed#^E3ZY$tvKtS>U_38NONY{Qc(kW-0fTbDWRa;A^Jis||d!(Qz|=(zD>F
zxm|w2p1*6mmfqy^qxVqq&8dgm-;URTHkW@X_R;u@z=86XgPY-aT#Gw0PyTMe%>4k1
z*XH@`LjCZ5M|1m+o@4u$nQ@*C4l8$?;b`u6Jlt<+pQBlxT6xus$GZc1Ybght%U^bu
z@@K=-4dL;J;B6k)W-~6VPw6+FVZJ_W%AHLveIjU2<&ELL+3?hyZsX1P=neR*CH`zZ
z)4fl}&FOZ$&FN-2nz7&3T#k6>uQ|O}ll5E0Cd`|qLx24@_}CsQ!{8s7`37IUG{To{
zZ%Mti<KfP?n~t0D@_o}zWPJ_sXLI=*Oh4z!&-@H6e`kZ=j`M8rH`Ct_jr?zJzqwq$
zfxEd}^Y|W0D7=yJ`O<2p9I|rTZ`a6o%g5T9<2-HxR?lgM@7vAmm}#dOzB|rB$Ib0t
zJq!Mu%h`6D$I(n@A^AU(&f4GRQ(70sdnP%|@1gV8++Q<X$C}H{wjP^uXOqJ-=y4W2
z^CP|d&Bhn|r$(#g;%Iu^j%_=(Z{4yvJ(8{EN7Lo0bamUMmtK0=*3pa8xe`7?k>=MU
z@TTkZmd!((hjygbjo0gy+U3K;S#4oxtXv)|*>{HH2+eT4TrTCtv&E_5Qt9O6CcYyc
zFUwAE&W&uz7Dh)l@7O%LW5<@A*`1edyEHqp<FXw)a)s^L(Zbek0A<ULi=Ej{9`Umk
z@>zqke}}@H$LE1{2e4F~i2^<@Ag6rzIfTq;^<+j~tL{u?Cy_pi|Cwx~UUo890(@tL
z7rfTn!5j7SXrsbN5pU1NIscP*XS>5M892zPo_414(<o3yVIG&sjN|?6&O|L=m#C)k
zD3DXtYxb194c{rB!Y4JH#uVSM4$Rla@h*R-v1NzD&qQSGd7DffuZ=(DNBz@3egFj;
z`ICSoQ?Aq;d@BJjD>o@<Y3!tv$?QLRbpMMpHy?b-fy^y0zUe?F1HeyK<dP|lPUE%z
z1^$)tQ!=cKX%B^D95&AOCwSTkuZS<@K`#1b2k95kpTdDBkP9)M$>`Gr80gd(0QBRv
zTJiQg66~FCzIPhDB9U)lFOJ|74>*rhuI9BlA3u?H8#5X<?dlCLF3&bf^^CmN9rIr-
zjpCCN@{EKW*9x%CR<A#D<)O^sn-w>Qj~qVGlycyfNW#sEB->uDQ6+_BCbOsUB7eL{
z-@)6-Mlv>ess{R~<6)TzK;Yn$0u!LgV!fCxF%BNA@J?#75CWfhd=>yKhpHgXS|yuP
zdeZ^aM)4p8`;jXqThEdafjs7g*%<-Ct0NgDUA!8;RIVa1Q!S2-gPKM%rF=o|d_lc~
zUdFSvaR;xocWR9h+-iz3j7n;i%P7pt#FSGgWyfk5KpAwC1<O>Oabgg}UnovHrR-^f
z1C|&m*6|X3CzmaiMzZ*5g78G4F_mK-d{~0z>g9^oK!1&@oR%XKl20=^G-|?*B$x)L
zs+o~S?KJYT8Iwdn@P!d}C6rjr%PioN4i1SDX^Kix9@;8Tf~7|@{NO<e0~yT&Y?5s&
z+AS1-)Dqs0kDGjT0Z+6zMjVD}MM$)<W4k<Tqdd;XZsfglAZbbsTtNVhT6Qe&ROIsp
zC_ItRs34IKnPg;E@GgIR%t12ob&66EtjB^H#<vb~ptgDq_=CWa3~h&XP_=r3@~<qN
z7ITzYWqh5XItikaaJ4S?Dvku=`v&-sN(Q37285C6AiYlIg;a`DCo?A4*tS)&Y`of-
zQb6S^4;su*=W`j15Mr#>n9N8N<#^`MIcWowlbIRWm{<K6hEP3m1xZ@WanL}Zwkg5M
z?6jsS3uty@(kYfDsHrA`UhsOqe7<6Vk}z9f|C(dLs$tqjD4$JP4YRBaLn@Uh{~3xv
zOa2;VQXz|Hn?^(9$Yk*qjwx_ht2}f(g%>Hd&Kw7~u~r$M;Rv_LM9y{t<PZeqb1LDu
z`L0Mf2}8@4!U<#(5M-#809w<9fuB+|KUo2_g$h?dE|fK)q~d5P60a3&EvquURayC9
zP6%ff3YM?oBN!QcWF_36ZATa-1P9ZV4#J7~+(>I^n8EMSM4DzIVa$xkMEIac`czA3
zm<72wRUOOJvL|P>He31(NDCvfZq2|r)6qUTJTxwoiZ!7rks^5pnpt{Ahq-L)d1AU2
zRuK{6O1uK0KJMi35gkaH$<vt=PWI%O3Zq74l%KQ_rl%|+uRHiEO-TY+*^2m9ORfyX
zsW_q%g;k{h1KL#(f?%YOf=B_ws3c|6<whN103S0NEd$;4>}17ZGME}XN(o3!%;D05
zssvKoMc6jTE+(^8%kPAeU$2=O72z<B>Se5BT*Wh|uuNbfA?8JTh2o+7aGus1X;c9O
zI>MS|Ln?IyJGxq%)@!WJkJtzZT;otFH<1U|`OAywv5m__f57qr+*Wc}pX?IguLreL
zMPMca9QjFr9p8T`K@CSIXmhMup%RCgLR7yfB!Zk7iaXZGoz6kAH@K6}1!<vBa1>f{
zDPyH5f}_xWq3z_Eth3F~$SGd&^46NnrdbriWdTLGUWWi>!Ku8IhZ0@`giJYI%$G(r
zNaR)JV?&V56?}-N=G0F@e9O1K^osRbO38<!baBem$_0EpOv_Ufp;q8rcl4HnHy${e
zIeg^kftzpHfAkhV#m3EN!!qbbRyLYR{LWHF0%6r0o#Ja{{A=JPwOH%(Ck*?T0JR7s
z^+`)+{@D&RAX$4(f#qO0;16siABO^vAX$ER3>;n_za3v|5*@ENl_6xHY|I|`S5wDf
zuK~+-nP-a~U=#KUFM9l+l0pmy5$M%CI1vCKk+o}JifIWc3oBeQR*MOL@RA41$=B{p
z0>&AHMDq(xhQ!A(M&SYIRy36SrUeVq8-zFr)aDo(1R)syt(3v(Fukf|ON_r%DxU(1
zA`vKvK&*b;&E7c&_yCz`bJE!q=9TNPpW4um+|?@i9F%ltMAZVKKM!U(Q6pM`QVm0u
zbZS!9mS;QE;EYPgsOS<XFN&SbHzVSAsGN$@2_@VpnDVspG(J5BQ?sNIq2y8dW*0<7
zqc%>G$dC~!Iq(%P5qQ$Egyb`J+M{0@*wYG=lg=d7^OMkmgs2g~tCblSTEU%yj&ax$
zFc@GL@T+B+F|CC9ECMAK<)Erm>UjVP)K<nAM*!JsDgaQ(wQw7hS59^cbS;**gicQ4
z3s&?PXa=Hef%YbBp(#=mm~Ij(3;Gw!&KWCIpo-NdB*2bANzTb)wcY?A+0juj1?C=7
zn^1zL<%3?%IOK^_l<%$KR<0OxCW8<6IYhNj$w=6?7307i*9pB9Gx)k+PzDhxgFDOU
zt!Tzw1WT68rw|z`VrGp^DlytV<?=)Weg#tlD<!yo6ubvxtRnay7k|PC<RJ|;h<o)#
zfRgC5pt;V%Fz2S66SaC3C19CJNj&m{5~E^-KoLM+&}@~;G8vjEOkl<+uz(9@J6nP!
z1&weNDt>k%n!*S7(KqrypAaunLtOxX3UteqB0fIH5~gc9Q`8<lS*U4X5>_470QyY$
zsY4XTYRCEE*tt0Q@Pj|Gut4JjofM(DV(2U{bpf$&AEV-kqi^=cjs6-852lJgkx0Vi
z=(VPtC@u(*4WR_ohTt1HUFUkIb~e8fDCVvKo;LSZhmt0j!ALT|R@Rv)!t4YLHy*kA
z)*B9Fu!h`nAaldP7aoYFTy^BegNLt;rd@kvM$)Z^uQ_t`#sgQIk1~=wf$T}~HNi<@
z9b*~V>QH%*gs()BEV7fv*CCDsPM3Z$(iz3)1jS&|&;5yP$iRkxRi%rg$m6CsFcxaU
z^um@gMeLM9%k)PN3s$;12pOoWi?MFu3i)%YIcqkL!&>6Y*u~v&dJ^_@w$y-oLq2m0
zMSOAuj<;MDrr#8eG?viukz$>R3M2yURCrnNXKHByW`Hs#!5Am8au~OoC{4A?=n8{5
z476pZ$u9^}>Q87@6NAKMz5`mE6n6nYkccfOUxSSFDo_F{0y|a#DG=aDK*j=KGUW*;
zOGAS)b0iN2!vu(W!{UWTy-|h!YO9;LkBH_n><^YH)o4&G)^@H3&<tzv(G;gK8~N!R
zlys^Ol4X`7x}NOxgu^-d+nA7%aWkqRNrT=L&IqEDb+{?SRYzSsBWr|6AP`A7hGNp2
zv{o&LI<XP@Jn^Ags8Hi7-42urJGN(DRIXxyMa%R$;;sy-dB^ZbrDRgvJDRqiL6kFk
zg(e=s(ttD>8SeDOF)m9l?yL^sHwK~@Cz_;OUb?T1qd7p85p)}5GfpMRBA;V5E?cM!
z1$-pAj+Kn&GUf<hRITx|s>UEeKxc|c>==Ad!<q)qfrdnNW~PWbX9D6zXaW~h1lcNf
za98l*^{tOX9Y#WJd<wo?$UnG{b>P=!OBi`Qqb$ZE^nsb7ot`wMZbpcp`dw7n6G!Fu
zF7)8X@C8uoT16>Jpis&byb5AZ!i{Kh!%1L6;Zmq&=7XRL6af%_Sfwnu3xzXqltIPk
zw?HLRKTd10pW}iTe6ALv3mT2ehSNbwXo~1SirI>OkC_oDQ22&&rZ9=h>?WLIG$c(o
zYI7)pC8`9!iiO@P)}{o~4dj?ll%f6-Dl6Igu~nrH1zp4WX|O7mXu3ibkq%a*S_2}E
zZhjh+svii$X;6eYmP4-g_>iqx_UYP_Xe|R*J616h!MY47#O2x~oPtA;vYAzjK`T(0
z_}yibtYL_6i3{bz{R$6}VNxm-x=0#j1VXM_K5dtFsAx7U-I;U=i>p|C1KfO}Yh0V)
z&WqIzpkyc#;Pizog_oE9VQeZ0W^4q>^>J>S5M8jKO&R)xv83WQVeWyqcq`S+DLDA-
z(w-|<;L*1+gSnABK7Ya;3!;%abJ)kcRb$XLL<f>AQCuX%9&7sXWS|{}gM3FhBO~W(
zmKkLN_5@C-4v0Ix_YTDu0m9Ea&<<}10<s$7t~wn8vV=ES9%{k~swB8VU8QPEwH1pF
zzSL}P)K@hDp<8c0`hr`J+_K-f_UKI-xasI24Jd>nd?!wzHkzcKjhhN$1V&G=r;*GE
z6nz-}lOWm?6f<a8l4*8pGNbU9=ynDp)!NA*QVi-duQ;QgkOHxTzQlI)bv(w%_j;4s
zQeYA^iCAd@m4I1iMAX149Oq@-Wf0qdCL}-A4NX`S95IDa0y_#*&J+fXW^(Wqp)viW
zF(#QGx>hF^2vzncnwk*0izuqVT*Xm}S7?++G(2i}#N^~oG~m`yda!$KCMGT`r2@-7
zFd#`iuz2u+UkpQW$|N)A(rOr(S_YnpilIMvL3Elqvl>!|gNa~)65T?x#8XNag)Bd?
zcIcN8Lkyq!!S{iPc%AMdnKu%L_pP}I<EOIKsc@BW+*ApYPUN&_<rkUT5DXlA4%}lY
zQR5*}5}3mIgfX0N2vW)!-txym1IrG;7+V57h*HuCCBp{ja5p9?+><16XV0%d+_Bxz
zpdl}EhK7lBrDl#@Edw~xr?@tc!YzTdL97J}p+RY64ou6zBsJk5g#%QF!0_8rX9zT!
z(gfBeFdh8`SWyK|$_WDmpjK$`d8lcj9HpjQT{r1!P+s{RY%+x(@~t{+cwu-dXK0*_
zL9xPm#f?b2jyd?UJe92yi~@{Fwu~?n@QsOW<5aN#&}V?1b!d-9R{G8|y4oO*WDhJe
zEryI->HUK1A39Zr=BHU@VTGI3Rb)T$O?d*LB4#IUbX9O|Mo^b61a$pDKvqpZOA2Aj
z4KTw9LAF{&K}ZTHgEwbUPlVG4mAFzu)0D8;yP|%F99T8b4$ytQ+JMPsQVaqR!^WO5
z_eYt@79m5X<c_$(o*F17hGa1wafiAjM<5U^)Xd7Nyb?|^BNkl*h@xMfC@YFr9>XTu
z00^WPX15M8TPIu+#hB_@xKN2?6+0v?#*DZ;0f(2iKYF4(1;J%v)JC{HjaEiaKsa&B
z6YEidsvQ?YglHu~+CxFomRUtNcSV(vx{CN9E)qV7it|ue5oR)0Jj0jfRD_9{<^=@l
zm7U9x4+O-`7AYZ%tN^W`GAMFh(JndSjbLa5M+_)A5Tuvb1Zk9zp_N;i$rMVsAcb=$
zYZ<bMCWXP^UB*rAvRb|!HnLGEOiY={slu-|COfL|Ody~Wj{r+M+)EQFgn)W_E2<VA
zz3SG?%`ZNDl_P<xt~+pb5WVs`4bwF$N}b@s#&mMD8wF5OsHY0iTQefc>?5jIVKCfm
z#HB$+2!e$oQ)v#kp()4`(64befLDk#xPPcg0I#qJGa)5eDULe$h(K7ww3@R88S$fG
zw*+KMWg=6-`6200l?6Sk;cFPwErLisPkyEaO@B80gn67O88yc`U<C7IOnDOf_~y`y
zHYoy%>g!1ymyq)y)aJ8r_>@i~piV3LS;`qYfikB~IQ~0`tYD~RAS{Ki#N5o3stt#K
z00Wi)Y!`7rA|*pNk{=O^!^VIk5qDA<lLlv-D*Wut5hoc#@Nhs~$F3d2MlJ!B)Zs;!
zmE{XusauPFn~>=?UwQ$sRO!vs!^wcD!jf62Nk@=TfF6>OCw_3Z=UH&x12KratgO!f
zvQXxZfe?T=jf&XLhODRmNP}BNsiNzaNEM#}O%Dm=kOb<NFt!WCpKy9o?voQ>TBkb6
z>*NFwh3aAq=nWP^9{d46R544l93+B(kRR?OQQWAm<0i&B?l=p9G1hTvA`jQXNgNa6
z9ckQhkm^zZC9w&Fk_d=UD`3!tMn(>mFo3xcmMo|<6}!VSj}(axybPd18LBF&5+o7e
z<Q%oUQiXS(f5FW-2XTbO9)`1S?}=hLH-f_$C#?qtL5b>~4$|p-Ln0ub;AKQF010m3
z5zWR8BAq_I5fCp6fF5gk9y~$=0+UK;3G%|(z!n&eIRVlVa1TNwtPF9Lgpz_d40T?N
zL(I^iZudZK2IO^k9_i`ES|O1_2^%dq^Q3YcZ5BlR%>pV76~v*(5+cxXmo-xEa5CYp
zA_@T&{RpT=gMi2o+$)%F+(<sM$Bgh4lo)I{H6}->P)xxGg*^t6k*cSR>2^tj<@kq6
zB7kw%$%iXawsw#}GnMHE*sL;?YE%Uf3v#n&0G4#{T~9KJ`YR2l(8LG`e?oZ<F>H!Y
zK}u3+lJ1bg#T7TPoQ10qv8$q`6@n)aptP^?p<HQ_wM($FbhE)=3<-id@irhr<yUcu
z2szS^z|B-Fz~_N75Z%}qhxd)}N}Jr<1joY5CBACWN_6v~+5`urpLqVADU@b8?SP3=
zOO_ABwqqt)bh{?&vKPdqSeEVyJ6^E<)Tq!o$IzJKrWEK7`zl$Zkyz58r@Mw7Jb0pn
z&>dZQrm8rk3GJo9I}dDPp}^)N#1rp!@g^Biy|Qs~0Gt(IWE^2Iq55P+InK<mZNo%u
zRq0M3=6VI=1SkYM!TE%PRdsIBREkjfQ7nu@n+E7`(hZl4_DkObbUN;K!yV3Vxl;Ls
z5aP6fda?eA@}_ZUhwy6)zuGLKpZ4uI4wOt4soCIQ9FH{G9&uIzoB{8Z`1a8?H*hnV
z8a9OB;FHZdWP${k0d@wRoXnqwwWwm<q>EI9-2gxT>5L4(w-e<208XRiPnHP@bW1sX
zL8l8Njc_kqO3;TWSQL6(pk(Jk&iTs8L!oK*qRL;sma7&;qu?5fbrH49U@%skRFv|S
z>}ffpNBxLxZWcIgs(ABcB|^;_HXLx`6eL!~aY49IDM+ECoP>v#8v}GIg-U=xWfk->
z2yDs*qptUg{gXgG5M`HeLA|d3s#hu5lAyTM=^kN0d>s_h;s`6q29h#HSOy3qIXLGf
z+6<I-(RZQSi+0Av$CjXMx7xJ0-m9mCH{md~0m?{0>rDr*mP60DJAU}uP~_%N_{ROm
zKrpu0Ei9H7#Sz;B*b6E^7TA#kPHJg2$>x#`&mbhJ#0xcsg>3SA3L#5hCLHxeb^r4y
zo7ucV&^8%Lfhvu3QAcq44hI_$%Y)(doCjkgTp$_9PL33zzTw4<;@B11H>~E*q&eeb
zs0jotdr!>fq4#l}QfPuQwZTH8hdWi`Nf?WftY~0i9458P8#nX0UI;=8nJNzC%GzU=
z4;rP_tOy+J2|(=Oj3lfGIZGuoNePJpDnbib@#TR7%&^aRX7SKH*FpwII!WUsg1X9A
zA$gFB+31%wuxK|Yc^7?75>#QU(s)<ZYEqUjRi5D35WP$M!=zw!3_xOQfa|-4RQ1*{
zykO`V6m4m?2>*uoMFb+uAF_g!>2TC6(_9nb;()*^z<L-zU9(|GficVwQmuy%+xLhW
z?g*06D4{U@L}QedWhZ<#&zKZ+S~yq^1YsDi99vL+4zVVDd(i59>>_GCC*tKpmLfHi
zv7ur{5R8(XeVm3+)fAS#sHj#|RfdK^D;w{)mnMW?7=pZk#%HL)>_JeYs}~_{PmNQg
znh4v}l%l%M0hKusgKZ301cYBzGoHhc0|)>R6kGI(jbj2+@Zc5|T&$S5(|EFBSrl!g
z0G*kWovULmOU8s@pg^!C36zZ^@scUeO89yJT2ze`?eho$L85zvgQYmdO*~5ggET4^
z41-n%PN2}o1Z2WiLH{+gcp3+6C|(uZS)EHYeXisx^vCslcU1(t<t<TNYb9<$)OpGu
znjIF|U{5y`7cZRT$Z#<^Bs^kBx1l8t042G4ii_z~mEBXB#gQOrjz(dTEgwCGpB42{
z&@4I!*ANN#Nsv0AP#FfNo(r)SF^y$(cSg#K);mJ31g*j{z)~D|y-fSEI!Txw9togb
z?rt7DV$R=b>Wv4lJ<5X}`^AM}V~pUe$F<kp;)IiIO=H&8$~<PN>K1l2Bw{=bP+w*I
z(sL=>z#3n*1#t(ZL&ib}snpA$6cC0So522=j8IOu!c~B=88?8mQ#-{qf$M}UxQvnc
z?HVK5ICyCba1$EKJ{(8f_zdy9PZlKTNGUo@Fr&no(2OtzRZt2D!y&S9Wj9oyt%0Zv
zClN>pf15{bAKV5PC{+eOHcDg8k71)9dSnIm8NXMe`!&vlY{}5uB4-x$2pEo{@i-c0
zn@7<25Rg-ugnz(>U~?mnN!V2dY78{wjL8W>t5YdJ*EQj6jv6auDF8Gl{B(lkc$zg|
zEN+o#4x*uN`W2a=CbF_R;#^?`ngVP%NDm~@0<cX?%8@%9fKxXTWD@lb;Uh7jB~;3f
zWpg+n%%iAs7FUGqICNpSUNUHr7GGsd{>*^KWWd@z7hy9Q&<BAn+42HTc=*$L^oST^
zDGQHF$7JM5I6AoZT!dN<a-~1ehM^nQ%g}NG0(9~zJk`dK9sy)X9;ILkpMqfmd|hT8
zlT{Ev!4C)EHK1uCBbg=vO&ft{iGLcyl_bi8_o{XvL=52hHIu>+Q*bb!ntEgUB>kAo
z1Qh_|Har4O!65+1+Qu}VFOmpODgacFb`2ooK|*t&lwr`2mE|W#Yh^{N$acx$85(hh
z0?Vp^!6VU_gi<H7hPo)B89EXi+o9tDeo6A2234ZcuYz=q0F6ps_0kB?2Ok9#MYX0H
zQ2a)q-D|(9f6+)5UmQkiOnE&n4Dk%|Q%ZB}(FP9F#|O_Kn6@OS^CO8+h-v>plGJ&$
zMq<ayBlMwQfVDDmgQttAxxiANqDLOH2A1U%^E?e7_k+U~t2LiH(j4>n3Y=g#`;2Fb
z@R$ig`cMxJL7Q#Z;6WSf9#xG9eUS>R=LP4XczD5SP=xWhG(aNWGfmlwN9?A`aw;EQ
zyE-0OQwNZQX*im=s2H4XaSt&j-nT{pOhY3TPLwHzVK0d{gbyhA8`NTp&`krfsEcJF
z3;?5=&&q-OdA<=2LinDGBOtypSf=F$bX<r;k$ZIUgPZNC5;;IwWY1_)6a%B*o8$R<
zpkEgElf<|<fMxB}M<MGlPUx$KYd{{2WE@Xmz=s3kHY3HUXv8JPXX|L`$fz|uCb?1+
zQ=`--+YdtTqS>3KoT-z!+9_<L%T1?7D$B4#acqTwm?@Qy%iV$^HaA3+2s+y+?t*44
zI*JtxMa~%$mlDEELFs_YjHg<&u*>B1jP8d~Hj_tWa}2(=YIz#Z!6^;n#uGOsKHOxm
zDl3z0hUCU^c#-FF<hc)!8SDZp-z*EF0k%bgr-y;_81RnK*L0B#WpZ$)FdjUyGMEoC
z$ppcV4Rld(kiMGJMAKAsaIYg274HxhJWM4XuoP+%cO$r3(2w0?c%rEp;V!C#1Tz{W
zlHp5YU4wT&0DYc25|K%<Y2fbM1U*n%HB6fHZ<<tSF*pf|^%75_7&@;*qr;z_7#<*2
zf+l?#+aC)eg(Kywp;#r<oKj>?sV!&7EoX@;XQ`^F_N!BFsAo236EG#30y5^Bh8l7&
zma{n=@W*Dpb4t&W;#pJd4dZ%BuAnU7a@3eGs(Y$A1OCqCOME6UoGNq-y8@~OtqgLz
zJdP+r(LP91#f}}G7cXL+#-p(k06Y@FbO}BL_ZrGJMlqvApC6(%387M}ox(!{z^P`?
zZ&)tdv-y4q*krgS3sQFUcr*q<izE2puFP12zB027ChTJ83Ixwxb9tr(rb!JRfULid
z4iB6ZhF(RXXv$)T9Z?ihv5f#FH<m;?3{5boVG^{4m^)~O%NTmYev%(XNET1ru>wKI
zI(1^4>`3S=utNGW*_3Lc5}<@M>N7DP#KC`94<<x2R;G?iDI9Bpa=ZG&#Nf(6Q-gP|
z&UCn{P?t4KHX(8H(vRrzAAz-^XYH`xiYI}wOD8w;>_$=C`c$q_iZTd6tP6$uBp+o!
zni&TcS3c<`b7RUm$IFc>kf63dw^BrLtCSiza!{JcNC4Ijk0AgxVqnnRHQOb+*kGNL
zhn2<82`q^pp+>WQYzjN~@M=_HMKU0|0n+6}5VU<h8k6DicmyGpWOK`i1l&T;QHVew
zWnfpR3I=f4IMh}&O63(kRTH8E)6ZfFRsthh9oxal8L3P$jR1z!03a$S{KZ%vO_G}I
zSjww)Am?!%J(XL6ze7VKplUGFDUxLa4tv}HgKQ>20cR$bekK7Bm^gHbiKaoo7(+8W
z+Kd7Qb#h1l;D1PA5E;yvEgGYm=|>3NbVZJz1<yBeO&3iR>m>GP?Q>7`T~J1I(V<m@
zC5<8p&*IRE(sZ$$q8TDxDZUE2Aju(8XOd@>dBg<A-K?K&l)E|<)p$;$zzi&Fc!`6P
z1N=hC62jIqpZsGYHt_tg*#Uyifec!W5&%cjfr%vSU*ihliY*#?I;XIbKtaL-rn*83
zG~(=}Jhhpo3|2cij4b6*RWwYMyc(7S=<=`!vQ=2qau9u_3I{$Op)10K!}Od6(^YA%
z%t$w;78MD+Lc|<DYK)NTL}2(Wkii8*Q1*ETT5(iKS<Z}uuS>AIVX&@neo799nq2Xz
z5D_evEASvFkzSw^n}*r6Sw*-jAigBCM+&I8aRv&&&In$@Apx<27?OQSO@hmc#;9ug
z^uDSH;+kNbfx1kw16q67oDv^3HooX3RFlJ23v$fz$A^l9==dbPHYBe?;F01C({v<Q
z>&14p<I<0*b34M$Hgp}b5;zTn3#r0`w&Z-10AjUA2_UMt6_wHFUE!R^)ACjc2}%PY
zvfYDSRHaXOxr9Nwc4nksrCe#~BeB!~=|Ts&(u_BSC9HOmrlYnv!Nio|V=Go!^U1>u
zCP&7kqK+*s5Idjhg-oP4_5)^FHGCr?{6rJAs1b){9Yn;Ze?`Fux7vHHno}l4+9<e!
z9hv^LjH(`7LST8*+X8A6CNz&Hz;<l#yanz1P&jbSU}rp(ZmpqEk`~3XB<qP;aBNIm
z8fuPVNiawk>r6FdRV*|?*CWg#R!n)h4a{HAZzyipsUS(~hswx6%toqsRs{itYIY1u
zGu#^z0>2tRGIz(UOSzJTFck+gHqIC}E@xe=AWNZx^023QsIMtm)=u**0ajQXdX~c_
z=u?&&^de_!F$3i(ni7-+#wM3VDU^(r1`oQ*!fEUg3Uq&&p5C(4nclh?e_Qak6@T0C
zw;g|%;BN>1F2&zvP66T?_=Cn?F^_}PD_c#dP^lH+5L1-XKb6rGytIRdF8t@u;oYCA
zZ$V>t#zaF{#!wWeE-FxoMQf8I$hwUbX;#N=+=%)Nr)mtNc|7d`4H)J$+@FLZUvWk%
z^mG~=oeD?BN3in+IWrNW1&4{UNsRg6voo^N8oR?-c{1}R3_(aEOC)93;mNZhLTr*F
z+|C_2$Un1|tDw~<Faj5<;Z;*q#JCCbIWkfd6h~T$8N5IzoP!5$#CSJpB4mY^jg=^}
zJ6u7wuS|k$Zs9bJ0w~qwflg&SE^=@lLusYm4%H4g;V59NXcRMHU+aWp32IVsD@l%%
znfE_Qh7Cja!HTVKDuRa`b|Op;Sr&~J0b})Kk^T$uQ)9vPqYM*teYX=sIPPZBph?>t
z9NVB)fjtiyO$9#0D%|flx=Wo}9y>K;0=Wp2iEs1alOOV=2drMGXpo-FqZMIE3NIUi
zOIRypL<2C@G((;e(PZ0#UxUq<DyCzIQ9g2STGNOEVREE7P4}Dg>qvVhM#~SIR{nrY
z+ziZ^flvj2O&}yw(Wjwxqe%C)A*v-y=742{@)%GIo3cK7abTpTDAsyr+V~<g6U13r
zC|%f_FwdBoDW@Zp#~V0p;$AfS>PL@Uc_4H3fot~Pdc!Sv@Rb`R*S^@fNs@0mdf*zo
zRzdblt~+|<@R3_@HaU2}^(s6ki>(uzUgox~JU%F!N1SYIaFLFXV@3hxDx1Ta5iSTR
zbeVY~R(-?d1?Y$N-C(&A^wSdbG`Loza?q9x1Jg)qhySKg=TRo?3P5>Qb0-Kw#Odqk
zd@I8=qp3!x0H~_(7U6cnX-O(%swEo#zdnkE{dSoKJ?{Z!j7A~|6sijZ1^rY)HF`Ay
znfkE4f5tpMYH0=xXBY&YQphMPLKzV%izdm&Q>YN^H;}ieELeZI)N$j>XEoC$ZzOp!
zN*R!qj@vNsQ0uBEtE>inU!Cj%FijL!35W$LAxI#Ys(@V<c1g04(CbmmvM)QaW^Gg}
z1=<gkVGV1CCZZsl2)#$zntgqS$=2uXWI%Au>El^2)hIIHTgJrGYUAD-r%+ZUW3`I<
zC2l}HA1`n5GQFwhr!bj?%baADw+M+q$A-SRE9~J5>uazFe(Cg}R0H$Ngfl?o=xYh-
z_x1t9MBpVu1^8!cnr&%<<*QP`q`-23!6?tHgC@$Lc{%yv9KGqr%+Uicz>81tx;q;=
zc=ZiI<mOv%zUjc>tNqOVx88E3ISnsKx%I{aP8C?Q4O^hO%s@i1>HSyT!Uy8D7gXS5
z?~It%@VI*@#!R+n>f7ejBPo+=CMEQy48AT0EY26BWX$JF?c715uqlDVO(ql_&|{-q
zD!iwj0U>7s5Xuqt9qY&xHL)^0SM=;TCwRhCg>xt<$_MI?mM8f_3%remrl~;3l}JvI
zf<)v9jHzvk;+b<>ixX^8<%Bjax&O!B+rVg*rRRYkP0dWr3^T47<1wBPyF4c2vW=&!
z>6&(Vmh~1*6;pVs;rptJ>6%&MDyR>-m?@wJs=I3}6caBSp)5&I7DXsxQ^-OQijajO
zWT6N}B@1Oygd!B7h|Qu1StvqT6tNK-p$IwqzUMs8dC$G)9`0rAII`3w)py?eocDds
z?>+b2^LLj|=!ulRBc-_`6P+GKL*bst-osaXFS`opMHiercwH1VG?!M{zUAL#=a0(*
zCGCm^L<OA=#jB>fJa9tRh3o66tjIm8+HUfZ7YB7NS7tRlBb!R4(L)O4=m>rH&`Vh#
z?<J|94hf+vAfvBX7%4}A_;y+b9>s&Q^h~u&tuODc?37bmU02l|pY}Di@m41H?9v|C
z$q)P#+Q|=Ono3^*Tn7wGY@Di}4tHjNWf(`6V96M)ycHdj1k0f$a+0FFS*v)G8@f4}
z+!}pv$LzbiM|V$-Nwwd*XUBv?ruWLD^1Hitj=8H{lY8Hbuiag!!E0Ky$0$v)CeJMr
zm8_F>m&$)q4$9JHqbj(S^CxBWSk_L-<HM~SE@M9Xq545d&0j-BU-xy$-rr^#6Io`j
z8??0lDEX#{8}E?(mn9V+9`mj~f@G<Z%PozUmVkQ#I)o+aF8qTL;ker-l$|{0eUDEE
zY2~qh_(SQ4yKc?lkDbS^_xJ1_9h=>~=es*5WJMk>_wJ&!V`qDJEYFVaknOBcYsVM6
zCp$aGceh)f*mq=P(Dt~ivqTXM=_JUzq^vfQaXmjqE$bMh_0*9b_{mmWd5_i$>1y~r
z2mX{;7j4N~cl3y~>wZR80F~W*lI{(V$FJ_qZXKKbp|4#&A7n9|oXp}N4|py2i@I#G
z?^Fx(tUDz{1>a?tzK?JVmCUZ_tE_lX=Fz3TOnkSS0}tV~OAK_+mMlLIJO9wsp&mRw
zwb=atscuro9(HXB<d)N!cA1!z`$G?U3Edl?Gm?4ePr2dVBQoKCRF^`?M2XHOOYfDp
zbjcE5=$2Il`t~6Q0m~x5`NML6qRipTzXaFX-IiPLd+i-lQ?q+^OuNge$(=zSotk#C
z8hZ<00gOyxeJ9tovD(2gu|&VS{oQwV`VhwU?09!VDyK)3>&Vha??_ilhRj?)FQPX-
z*_|hodD24ZXq&pn56j4lG>`{e6Ci`zl2Hln5NX)t<xVHqrSl;><%$$bKlClKzT3wX
z#686~Ww>d@iM~PAq6Dc!Lqw#V1yhs^#$C5nXdLxGRhhz<06#dUj|2z$l^~M5S!tbA
z0}l~z;MOo}%;jMuC!%QZG7+YJWjj}l<D-+a?H!{*o|gUU6SEUzdn!$QzE_b&xgyIG
zWO=fbQul~#^eU!K#-o;fZQ3!ld#967%)2IcX#Zt)d~~9K%X?7SM;-)@)-U$b159L4
z&T;LW*gdvqdRAVQe2Q>AE@8cupzlxY*ps5FyDib(H}!4`s_NTSswt?dLshCNsH)$r
zQcbWO-<;Jn%<g!vJ-RRT-8MV+-n(O?qp~BgoFO~5%}$R^kB?1O`L)|qvr3y7smJ>{
z54Fg8?tCwegPiM>1o7VZ?gZ<+QyCk9tAZ1_DzNv)-rL#!-mG>Z+~UG=+9H4VYF!nJ
z(J?t}s-5>qE6Bc`vr=&qi)lF#u@X#cqpGI7il%i;(X=}4+`DHgzBjaby)|1#{k>2|
zRd-vW>+XfJsuHBCO7M0SK?*8CiYmcS6+sFrL5eEDH>(ILvC;NKg3G-U?xS+5<NGM_
z`=+b6T1gWx-eQ#=RTg@)NGuX2#q~~3JoHW~v*S*xfUANO?a_T{+@m|i-AQG($lu>d
zWd-H+cT(0Ttw<VmStk7c?p?cQcYOQXlS$g#Jyj-DFs<u~rXeVr);~qlN~N1w^tm>_
zsQW{b&WPJqbKrvy<ivLQDRpo(_VIJCd_6km5T%E;=hrUSd++XkZ&nVWQaL;)rzhGD
znA|hE+u!Nm9@{fEiKlC4=X*QaF0ziz^_!feD{15<O^=oFJ~|*0U2C@{y3{i_+)5k|
zYNDLk$&Y6b$!mrmBZwdN>Z_f2b7r;QpuI9#5H08LqT7OwLlKkJ8-7SfUx(qPmQiN{
z)H1TIqtH?adX9t~nj5KjKkdrue3XXgX7_|g<{zUg%}&WX*W27VHM@7$u8F<q5}|Wq
z=<L3Uxbz~AQSTwh<kWXZT|6up4KZ~6G#}7slgaAYA00iYuYmF<EN}jW1ZdQQm3vE!
zQdjiQtJaV7RZ;q;6<Ypf^T+b?r>A|${B^kpEttI6xcyG3)(7S6L(NfK%3Fbc(!x)n
z_!>91b4<sdH2>b8+%5O#s1ADRB|2X2<lou$-U;N5@1D8G=$;+&YN-+J$}+x>qML{-
z`Q-E?-K%%_h%T}JUAN0GT)53~GHRh?o!Hc`$}RWu#2wKGWWRvS&FK1~lQPq#>M|v-
zn<r2H@Q4KJ-*V*We@U3$Z90tUi%s5Bbja3?tjK$}crq`LvzieqDsQAEuXy?*!uKe7
zeUoY~{a}B(ni}}Up@d{4QxBz84~}ip%SYs}3>?VPWi@o7dyR@Nr6$F`TCuc)9cj3>
zD7tp{V|0z%C_?;Q69IBg%0YScl+8>h^k#MJKJ)Z+71_RI(bEbWT^6fo<e_%bnxFxV
zP26CdYDx$kd&Q+?7D5lY@{*&Ci%w^0d!}=!!}7YUZ`cB#bTv|6bSAd>VOigPx@*@9
z-ZM5myL)%6Haxg(_U#y8ldoC4xD9uYD}0>}bT3PKujp`~49?2%&7tLmZE}~(Tcm$q
z4A(AtZ@nY&({w4HMBmA>6kTPP6!nt?JK3j0M)lafsgZaFBPyzq&x63>>!27oWgV%b
ztf9r%x|*GSZl5_XRIvacj&k#<k8HKj2=c;BWqFv{ES+r`D`3;$-Z&MJtlzzRR>tp~
z5Hj0o2ft!LI6ntv?1Eo~U0j4Nwyp_eyd~{ELnYZEF;ztqJY9|=>x*E4qN1RR+M1p6
z06QV)Jqo4Ehu!VjkA{NeANYbX1=4!CxZ|<sM)cfpl2FJ{QuuY%vXDSOX^E*}Kk%rF
zTil6Ji?Z5~^1=~)rw(|K1((?$t<rL|tV-^wB!?;l(_rVGTz>9N+W|iU>(wO`*&U&o
zD{XOf;n_5>;2mFhZ@H1=N$Jx6VM}sJVxgmk%g5z&A&xE3s$i53Ryu<}dZ)EKFFOhK
zypjV4<%ZIQ0pTXld~~CN@;wFD57Cdk$TD$vLb#00=@C(;i~`h!JTmL;K8~RFtW_xB
zq(WK2`};k<rcJp9#X7j%WqqdJ{Qhpoh2GqvDjg%|$NN2k^p=k<We8U07X<Lz2KkUH
z8mgy%_#N%a=>npSiYuXec~(6_kcpOLzivbDX7Y5CWyJ@j1(jj059eK#cf*X*EKKg*
zH?5Oa+Kdp3M;(cA^fA^Oo7p+m)>#4<4-HOxs50;`Js;cyu6X5AcCP5iyH;kok`9Gi
zo#8J-#frUH*#vVf-;o75pTixiB73c6rKR@Jt1wxht)G~1k0!4u6;C#Us)=qf^I0ZG
zr!ULqFNaEegiG&i@E;XKw$2o<LdWokx7BNnuP83h#}Ri|Qr%<BUB%ILVTNpo(%~bc
zwG80^u++OSGp2e{M8Q-5O;{8F5|<*S4A6yAQ4Z*3M9tJIZ2gZzKaxW#Shhu2j6aei
zNAwLr5<neel>N+lBTHfXTgCN)MblR!G{mYQ9dGULkzEGeWegVgN~rJ@Lc<UMxi5S=
z&<mi41NAXe0C<t~1L)z*+|3sdmku^aL@VxAdN~R-FoL;D-@@pXn-G-AQa9p{IgPLu
zT*^l}IR4jVr6fvc2K<D%&NnKmh?`uUKPsCk<OL25j~0kV*1e@kp6W@4GItXrPLpp@
z{=zBwiXrR5^eYZJQQ}YW7V{z`k5KnOVB{o3#wJ8f=jJqKq>*b7`*`Y$Mv+A+)JhNa
zA~P{%VxqM;^?FIR#>nwwnaHr+*W+zuv5mY7>ZGWScgq2<vVL8z_)@I0Ry-GiUg+Yf
z*~9*gS*LW}>!qy1U35em57lx2v}8kErCva#={n4=o=nS0Gbn4yw3DD)>kmj18!oi}
z<2ofOgx<2={!$HOx1}=4ohJ4g5dgji;kM~R^F&z_fU_z@%f0o;!R)f^M9<AZkDJ$W
z%8xMVQ4zX%#NT-*XIEtY%s+&rx9)EZKHFJz+8Zdwm57T%lw&S$)J$6dH!$K}y!4Ue
z25rJ9PiN<zow9I42Z2=GRB8O9`D63)wGeqLmYoewM=3EMt*}g;&dR|g{tlA7>&mlB
zUORNj#Sdj5!HfFY9w*7RXb4=bapItxLzT5#Qtf2f1BOQQHk0ou3gTub<*>0?<&*bo
zDOP<IcbocT*MrRJ$~&(doN?^1%opln-eY>Q%rUvwbY{=ZvT3!{E}Xh<O^<ZL{D(r^
zQPA#-JJR<%?5<?N=^;7vr=_#Ee&z6r9{qS!7Y;2QmbSt#Jy37mqa(@E-6*p<K&3YW
z8v$OobOVhn!0Jk6l^D7u84^Rka#)fqOM#9`XvdEqmk$T%Ct-&C(H1h2rJcLh$Fk8z
zdJB3Ck*`Mv=sKpu@&N@|u5w`Mq%LW9T?)O@j-adymo4S`14}1L1M1dT%4&M==f9%h
z{0_=maXlPV8b_J5cDJ@Xjdb~$n<1B8l#C|0*Adsf#mz6rCTked)VaOA@>uunkqENx
zO;?{wG~`<pAvQkCXrv`Ai|1smh3sq7GCp!dzVISnq}5>cJFRlsgLFF_vOIr8=742=
zpnJHvV-#eOwAKMVFImc1e)N&x&PUb*V`Z(R)XYMxad|}6xhlQ)l;V*6p?XlQFIT`)
z19df65!9Llt;DQk5UH}hNaHD~bVEP>9YnSYpO6nk=(v!s$(H-W`?j<OxyO+<WYRM&
zU87LTsLu1s5TrKy`b3d+j!@J)TJF!#EW3MEriW!Z{>QRG6Jt?MW;3oTZlQ_}W~sev
z#-)t3oI()JN7_PFWeXuI?sRX2Yl~fhadDokc+roI$+J)&iT)9!ni!~xhp*(|u@kyp
z)0kYNB+61{bPK(<Z*oPw0O0tW4`kt!bT9mf8Tmi%;_wx*Y)RTrbmgT%SH!rd=aMW!
zBH&6ST*(e8c<K$5ni%?Vg=WI_kq@X~C732jWB8%lD1JZ|V3`IZXozE#tuTf7%XRm-
z%*4z4qms1f@07LcDuwFH+GmUgCm)Q$u%QHeQWmy`TyR1NF^!+s7JFx9iU>6rgb=)<
zYKJPIF^Gn7zb&I*?~m@Do!ZfMpV{$~2vdscbc;W*o*5;zSsJ9mfUVMb*ssPEe?6)a
zIV<nTOsX8XUC5|KnLA;3R7v!^dX=N8u83UKR#sn=ix`Jbl_n_4y(r5*i;7%%T2RzC
zWd)?2l$B?4XX$66oviQu5-quK$3W;qM^+U{p{k(mr8{>|&LUm$l|pK*9~*I96&csj
znhshKcS#4VrP!E!_EQch5NV(80v*@azi>4nuZ5H9B_DU(>6Yp4UOF)Tu|iWCE9qJ5
zc(kV#X_pL<J7&n992dqP0~&-}mqK{=z)=REX%q$R{$RVYJ2rE+d(b6cK1{VDhotIP
z4uQA~k;0aekRuqQC6mgeecWR|nEgnXA^Giy{^ifZhd-8Hhdcu#ADt74gXS~lt?;zj
z)^eHR;w!axa%H!i#WSjnr?l@;3A&L>Iq6IGPrB;oZc|@I8ndn(^dYMP<@G~XKC_|m
zSsUkpq|6=0CZ8G9ugkj3_iMOHxg^JB>8WcU>xZCp`Ji|gV>%tjw2+1<1zOLwR-V*Z
z3rV~T3E(6z@sPcg2fFeRQD15OLDMqmB$ZbB0d9ENoo%cfAIet%q+%;o_n<URiYXw;
zj_x$klJ2w|EcWA_@9Nm~hdbr^K-UlAI8V8VZ|Z;*NnD2*G|MthCow(JmC+5Y4f3qj
z&$zlHDW!QRdowyQt{o#xr^GNZmp&nNU4CsxGz0|$pjNU+QHsm;#@$4@U-zObjpWN>
zW3!X*$>4vh%18U{)gChY>*7<Qk7t7`;>#3j47E#-$u@aKkQV~Xm&wu!9quwf7c~?S
zi~-9#0_WwVn!0k;LI$aZVVAPK+O5V_RJ$pzIC$Y(Q%9hFXh_4gTlp%LaDEB%RNBp{
z0;Nin)Z9D6ac?F)Ygxl8lb!B`N8UMPIlhmiJ9SMDMAGe-t~vE#`%P+ohK(<Unr)Gy
zJaXj@(~l>*!yc6H=z^Y`C%2xz<69r@l-J}V?vyRvYwiUZ#HOyU)%J_FkLt-0Iv}l|
zGL%`36WDI<E?uY0`MU1|>GMHHcKn4r?>NkZkCn*7SD)*81h*sSU2<}Cao^&Uz+>o)
z?OWV2KY#SQGW_}B;(I5LjOo6OY5ne~ew#qP&YEJo^-1vF!Vxm<JlbvR0&smO$Tw5p
z-geNpHboV*i%hl4At^9qlJwg`hBz<n$iYud*p<`Fbq`l<sC7e-ycFmg?)dw&Zn??$
zjy-$ECh(~~OsMA-{M35he{!Fz`PJ;)FOdy?YI?6<7Eu|wvB}B3eicTgH`haJ;uk)4
zm5NE$Cxgtfh$F8ql7+x!@3+o`$%Lr9EX#vS+8gP>J6A@p<U~CgB9XeLM{b{R^V27^
z%P-shKla^f&00_4cadwJyRX5yN+;DVkk2o;D99;YCp8p#MV8%_I`2Ba;6l;%PL9$E
z1?p|Z*B4otSJtI#!>-=$1U3Isq5V54+;30GA|feOE)buco*bK%yfY7()tlWhF|l{2
z>`@z?9sBOI>`B=<Cd-5iS~8F?t14#S-M35ju2uWVhL^qjWCL5tci*0=eeL$%NoC)?
zXL@XMc5G~RZ@Wl8{{G(Cw;ZGu*Cj=grN{2Lenl%r+3}UkM$+{i(5G6Ht4YX2H}Xnj
ztDbd{RUQ4G)Thtbd+q7(g-C0LYn<Jk=Viu}HB8o=OGVP@ilM=l)EE7C^=(#OfLt}v
zQNg!deb7gql=R^vAAE>2E!~H*-D42_XFbkHPO#^*@%V8WJJN3phSo<~p^v)T+{{<p
z1D1XH+6Vin`?ehQV;y6&(<ErrSmWeSAGiGxZ6j0Y9?SaFKJ<|+@OPVOC3P$+X<cxS
zMO0R&eXjsdRB2=7okUh`JAdmmxLAaj0p)QgK*d4m4gRB}(jCInMjj{fBIOooI5PFa
z>qg||YKsnm$#Yx>7vwY;v2wi*H<=_uYut(^36q?0-`|$6Avrxis8m8-Xs-%M2;GS7
zM}u#Lm{r8O6g5rXE49kBE|+9c3k&a%drwgs^^tPdJ_cL=INN>pYNJ@`t(}puSVVRG
zT%+r<%K5ok{e8ZuByFNP(mJxN{9`nVhQ8M!ApN2R%KrnIhjw-IEoUj0RFWf@d@Wq*
z%7~WVF)5#4cDK!nt{^%&ug`F~XXN4U-`4%gAvs1v2I{r%;FWPLDR8zLL8VN>kx?wU
z7xj0W`+eK}4uury<CAe>y3k=Fmn&!OR%y-EDS&dfLhaxmx^%eKDtrt>Hh^TvPu}JH
zn@wa{DAPia*baznE_mrlYJM9jhJH#)?hz&Fkn_r%oj<lDUY@2i0fx$LqEV78^@Vvt
zPG$|KT<J6Z-5v5-n?15<1dkWlZsd9nV|%A%DX8pNAh2(zinD{x7Z-2E7xLaHeDLv0
zeDq?^tZvzq_SrSd5!>X9TTt$OckP=f1U3Ci&%L_HTci9PkQdCIpG<R0=%!H&Uc#2=
zXh@r18d`uP0<p%_^q8y?aa+2OL4Gw&L?RaGJOy5X#`jLVJ3BflPgW-V-5u}E>bBJa
zpijsGsCgY$rO4Jw3}MSVhFnNHp`ZJbo~aft_QSZFwNSp^)158AC0{gkhWdi7ucvy#
zrvtPxktJZ9Qc!!H!U=Dz@*c6GYs=(VQ5~68e}g_e7C<q=JCu)UG;SNcJjKB%EE~$@
zp7CwDe8EZ1g!OB7CUxJh@5I>R{uq=s%u*VDV@iw{wg{9xbVd5;zW3hyUbU?*Z?E>5
znwI{Uyhv6C>DCHYd%dq~!3Q&b@-|xSqwCOjjP7Vh`x@eu6!vw*9vVAWf%K+~JtVWj
zYVH`<%*uKcmhZ<_E}JUN^aZ<`aEC6^ue7nmR(cnf-p8@vjS|-&H%+QFRI8Tu=jFX#
zmwL+hm+Me)-d(+I^26O`nq_i0#GWbbAJ4i^F-*1n;B5((+t%F$B?1jr_q_Us-f76C
zRBqiYub!3tC5?$2PR2HBzt@o$V#N-J%=n#@aWMUmwd{+G7Md!98*7k5*fkjJo^%6K
zyxVl_Um}842RdYhr?PvYRx3F;QCA<R7mXBFa(yaG0})h34ud3oLm+TOrUn;%JVZPo
zi^=2|HAm!0d^Z~L#5}r>bTlTWTkXPdj9Ypjt&a@%yOR;6kKGz;x2AT#*Va=2&_=Z6
z5P+S#WfOD!vWczspwg2jLxY-l$%rNn<k9GKWmXnu%zqyR@vDxVykFobU$y7Bcxc)R
zzP?U`cF$K1^bdlCj(2z;DFW>P>$s{;SG&1>cj}K;+3)V1nBMX2F@0Oo9N4v6jwy)o
zsqgwaOuapOWnZA?Q)D~6Z}Q!}1%&t3N5>asgh+NWNcY6Q5NL%sq95-&{()2>U$h0t
z4Gg&=mAwY?PK2`d(`H(Kb?(jOk<Nl?kL#Fxc3tmInJdsj;6#za4scUHT3_96eDl{a
zb$ndNjVL)4KTo8l@{IFTGTMu=TBUT8Z&sNVl1i!jJ2|8%gG~}EH>N9tMkZ^dgL-Lp
zMJMrOKwM_~#1vD>NR*msuIa8}mvEf`mLTP8({kvlTS@%39CE2^UF3`#d9)ssBm8ur
z+8?d%*Z4?VBb%Imh$AxGIrEr<m+c~AqdUO$b9yr8|DmkSa$nMMf%#gj^Zc5ZvPFFM
zhw~@qW%Z65+trlo`g%eAXVuGSq$@W<wR+JbvZ!31UkXZk*1D(1FY1^3PFL_3<0yB8
z<Q`Q@QB6Ig@OkTIY^%H@YrjXJ6rO>JrmlFZ)TT#jA*&p!E#OgU;a2CAa?x*R&_xrv
zVWF6RKFWT~zS7K%dsW)F?G2SS^hslgCsU=B`K5M#qeP`y@Jg-RTX3ZjeNr3Akm_8A
zM{1#q4qOxC7Kc^_m#CyH8lz~NMkP(Elk&KY8kN@ciEQ*GFs)`08tLjfx>PqpBVC!@
z(`7}edeI}Y@V9DeP{1R7Z8KBt2#s{P+oG5&5gO@+%@;-G7>=}&Q*JiJ?anA#Re49&
z$h(|%m3L&V<T3=LtLaJ=w&WApC}p)x$tSWwk-2qX#pi%4V~<DrzQhvs7>=~H#3V+#
zaK4y#MUTiLT1a2CD0)N|rM31&tJE{HEG(!m+LgT`E6x9~uD57a_KK{u1Tt1-ugI#n
z>bMwK;uqPWRP~joXjJrwEPMf`1_d1Ynf1!(MPz)Vuyh@-n;p}IyT$mGy-HU4u2XFk
z`IK!W=QB3u6WN3{!o`@yaHJg;&xRGjMYBr($Ua*6nqkOjL>wUu84)^M%Fx6wXUE<{
z)E6w+(m%3~Vpb7yg>Pi5{W@E+Tg<b>uVhzT*qhoW{w4dWCBP|5Ml0fySxQ+lT(k^W
zS<fw3tk5MM>4&9?MfDhtwEas>Sh85ONj)P=u0FI?ibdl}|Hxj$bODs|pn#Y3$ys3%
zdzGxp%OZ>M)bJ`aA`ZN~xFHTVk5we7@{X+SB_~Ia(TF%OBc)?36%nZLjcoa{k}<CG
zj;y5xFRa}wCcVNpvgKGtCgdvb$XXxrYUyW6is2@HCA(y~R%%|Q60y8`ZC8=5RyX36
zmwZi>CcrHOD>7C17Hy?b#k#J<u;5j+a*b)uuH*^Jc;S?r)UxoZyeh1$R!4VhY+F>Q
zU`PiIV)Mv1O0Bm3e&iww6@x~RM`WQzQE5^1sI=gUF3TK_*<cJ1E55`(ve({5DNofb
zhD+N14lkuh_06MXf!n&mB=RZQ#LLNwDbk=yz9rkjTC~)->|L^!dXGhGscFHlWXGj#
zsa50?+2|Cm>pNmqRne}(H?n0juUZw2aFustZI#`YLli^LXha+~PpgZ9iq?r=WT!6{
z>2zPwKC2V)WM>YGRIgGiuvJermdUbO5m#YqvPe+&imdbokLE9ncByA%8KyalHZdG&
z+oY$P@+{h<o|TrEF3s7RcVw+ekY#gj>Y`{^@`-FRbFoG9yi&xZVW1V{yik#)TA{=c
z&(U#~H>JsFmAEp~dMRCAvBX%K$V-`0g%U$NgO{3@d?Q=5;xcboF}YVHs#A?vwMewB
z*9nIrNy#U&shTw`+GaE&j*2<NB1N@A#GvturyGmr6~2*eGQC<fuJVqol^Y*)$6QH8
z)};y&gS{zBFTgFI(50ZoNMv;)p6dC<5>Z|$V#>{87UT2^t%$2SK%4a}ayHP8xcLep
z?;(C6NSG}xvc6I;;=}t4=}K8w;Tzc|VYqqNns`tr=8^hTJ!@OydX-+pr}Z<McP)~n
zo>@ybJ^LzaDntyj`^wGa7R@3w*2M-%&h(aSQs2l{li_Abi$)Qwy*~HtI_+so`|b{k
z5Nt?Rhr`D&kJ33-J~VZzTNbA8(PIQ4fAkjCv<WV<U(%-Xwg}%=z`q%6x6R_rK&StX
zpG#Ncw<F`XBjdMc%~<5fXGknGDU7PhZhBY`(brs9K2bGQYp8WM%j%hl)re7U1j+Ei
z<Y<8yhd$uEwNh;SS!z`vr#qvNFa^ok91F!fIJB5rae6ZK;Ur}0V-t<3Uzklyy*Ou>
z`f$!LiFz{cm)fRtdZ`X)?jj%U%cnV}69p++oOFvwd>N+(dQYWjG+`ET#4}?NjQADj
zwk&@T(VVwh$MaN0!)l-6Je67aL}EV5U`=B*@njywX{0Dg=}b}NS)LAxyfiU|i5&~8
zJh2m5C6hOiUvZ8m^6+Wp9E}erGuskbm8VonUfNmY^oT`WjWqhHPdpD2QH9=3VHU#(
zquGFrMqmhY31(gJt7tAF_6lol>WXs>#;ktHd_j~h_0P-%L|S3gzl?EoKf>c-{0NqS
z;*$r8tt*GdizD?>Dhea<MVz*!heT%3Jc<#=Lkfex#%+(E;;6W3RE%mz^n9tw&`V`c
zhOLd7UA2s{-u~)kBhO~4epN%qQPgUOgCpIF0pFsp)ZJ*{*5V<CrGZ=6#Y3cFkkQ-4
zUY7q+$;JxN@M;tzt<ce6sl`Y0rN$#3EHy)IK}zxDV5kjlMlo=&r+%AI6my!C1}RH+
z<x$9zcVVQl<QI)6Mm`lIhLJCCfx?Jkl=84Ft~exU8p)tuM6OSc>OnoTf7M7_L?t(i
z`*I&|3+xvtWp8;PEh5muFAbzwB;rA_$R-{4s`Rvht;k!$W5>7H)a6H}O6C<KQx;|A
z&kQM*X!0XPCB<|gsH9LD>WO^W)MbZyiV=^;Z_Fn%1``ESJ;V|zXs(opSS*05QIe8z
zItUUe*h9KJ2x4JW4-S;-=_^JhqTs5jilY)1Fz*bxQ!2(8Ob?G8s+D4vu<-3aikCL9
z`L}-yNeiR&R-g0adwCQ}^adWI={t7ht09J!$Xs=-OY7Z%esYqP--s4I_9r*EtVgzQ
z9QltyYC}z9*)O2q<8+Y!{O92Vi*k;c9t*`4%dH>&uIr@A8HV~oP+YCtI;LOzKEC8O
zZ|J&ef1ZdE`leG(U$YAwed&GlY|x<Q53a;Veqe(u7-{0!;;5Zom#VYEes8d2j>Z_=
zwVW_7Tf*hYw&Hs2kKK`Ot%Z+UM_NCSu?RgPU3OgP$}9PmZ5t=#^Fnf5s_dMQMZ)6f
zyO(!dPga{<-F+^ud#M!{udpKd7giD6>#4ZzWl<R15!QOflAI<X87Ny8mRH<|6eTu`
z@&Qlz$}GRdC<n60sXB7<qki^EU+ndKK!3WNJQL*%d+9t%v^DkmgpiX~w2k0#LON0A
z_I${Z6WX1UQ}EPV_M57PYfV0KqLiK-<KWM>@h7af!x|(<)Q3+}9N>UiRY$JdMcvkM
z88UUQx5GxrasR<JxuZ0PRM%w%_q$HCr}g|Z_hG2XLqBi_>4Y8qm|T@}++>3>H&4r&
zvoJ!7?``VsDo;=yv+W*~tpl2SE)p(ZbWf~qvy&5x-7Y-IVSiG-y!Xjxx~0(k23HmQ
z=QX8Xx$F$#$nkQLt=Lf^#|0hhete`WyPl8ASEQw|<YX5ax{_N#a>{Sa^GTJnFB}i9
zB){F~$Cg?<j&)BQKho_Vc<1eRhPJ&m*sr@Cy8XwG^`ChAH-6(chPQQprC+|ScI<<G
zRPp||2EQ@*jd%J77M7QnPJZjnHzf+n@Qn|SAD7Sb`8M$z^5*&GvV8SWvi``iHy0N_
zI{NEUw=`4x2j>sIb>MLK;NUxh-FM!3>o*Vl=J4CUap2%P!|%K^e|YFX_wcs2B`R;d
z^DFpt+Q~QBZoGN)<k2^!a_PT3lfN<FdUN6U(L-<k=tGHL_rv)&{Wo!cU7C^uZ^|}$
z`RJG1U@QAw<uhFp6`z-Szedd^M2^=hcTvOkqC~q4r7^T`g)6;|3C0`CD);z(vfVJ<
zYWc}_Lp^v$PM7{z4%U(VL-L)KAL>@!lLzE;&5Ot7&I{k9*LtRUs?w5eLee+{KRKR8
z#;!ipv#GUx)(;ChK1b)xl-`;8`$rxQOY$}B14|38!iSCu1w72%12t@Jlq#+Twr}T{
zKdVKqb;G567}p=38h4eQQL({_H;ny7Y&O%g;tqb?lHE*_Er+_Y_f4+cPI$XvC&qS6
zVZWQZfjj%;14Fv|ToU?i*&67#zKPejWn-rtdQ!41Xd-7r7W$y%FjYAu)qiVOMcqc}
z`i|}?by7a2Bj=#WmgU)ZrO9j^)SohuQuq_^9f4=`&j_eSfs~A;|FC0na>w^(r*?mT
z%x_AaWdNZL5Mb1>ms6rDhd{a0jQk^2cd+1tGy0S(H+xAQVfXdq7_u30a~(v6X-ANS
znDcaGA2J`SjGV;EedtsAMaW1P;>86K1{l()hZ!(TT1v(*%K3?eP1nCL6A$Y07?Veh
z?4U=Sa5j(@uJ-Em3}%@y*GvEDQ+)V3sN1zmK_!3dhdQ*EcuCJkN3t|%Z~LL1Q;41d
zvnVL(R>Tv>KahyaCu?=qN{_#DUuJKeaIHXS4k+j;eR@v4tEh5Ttsa*r-5L1^te)HI
z?4xVZmZ!WPqpJt*hJwROkw&8uL;_qlNuJ9Rg#V1Uel1=P^_EVk%fSVgh3;5n|K0PG
z@~K?;F0=;b>Y)EhZSrk)*WUTB!761rUQzMo^B?8w>tLS3#)=aieRV7Bvekwtd}UaA
z$Ax|yB3Up1_OX2XTqf7t@Hy_a_uaV{yLT0jA22lD052#vH_z%hg0AB<E2KIck1MP4
z{_gPyOCSI7te*Po%3se(@sjqEKEx+!<EB1jtDR`lIyryLUHSdJqHO`;p0kJEhwj0o
zk3FfcIslbMP6xS!K{7+XOzvx=9_DD3(A6Y;MMx6n!;8(cdt<p}mM@+179-`1ZL<Du
z5Viw9mPd)^ioTGkEBAtYz+T#D_r%r*^?~K%@?9@?>Z2Fsu`L^u<<&;2v9p;~NdU)#
zjCD6d>tp%ummKLF2gF3B4G~*U_o1*?+;lilLmF+L3`Spbt9m#B`51x>Z3~-UmvYsr
z9zuyW+q<pi(kDOk-*?-6TxX-yxYo#(r_1J74!lH54TKF39A=Rl<@xbZPPbPm_+bhE
zrXrItM-R%wUdAnptf;Sf)(V9pL+NhOk<mi5QvX-ky9K{#+KMDWsmO$=Mz?MfnM#!+
z3m<R!EUD5cbCfy_Nkmw$<50>Rcq&xbnorRtdQK!(MZcn5@(@X^t2BxnY#i)Kosgs|
zxbO8dVxi4u`y)*gyj>?k8veunNFN=OXw82p2mCqd;K$ni=*pnP$9hhI3^1ve^uA%O
zhI%NkE`zlbHS~tTDT`sLs*Pn<+)kRBf<nceQB){aT34wH1V#T)sf#3)HMXcyRUgY5
z74@+Y7Y>A{u`Je`B5zf#C~Bld&KfU6i*k&ceE3NWTG0^f`+Fz9Bd3T??%OHH3605T
zP35@6cXv;>VtjOLV#oK!Miaa(y^yl*#O^)csZiaycVh44?9}+~T}5h-3&~U=M8u?k
zAr=KpVo<pDp%)<eEatR)pVg&jkABNmB7(s7?Dd!4b7y;>oRjkI-hF#U3k16+cDO8o
zk$kbVGwU&Vy_5oU%nseTW6#bpiNd$NeHN=?Z13GGr@31GIOB;iW|zBkI+j<4$;qH&
zX`J8NG4-7SD#bOrV_LqFQudIHP;RgM?!GDMf%>WtA#z0Q9wtqW1|1!n+UY)BFQg&Y
zBx5GW#=fr~cWntSpC^`H>duKBa=5cxj_>~VczbfUikjDY#OR(W{idk^Q{S7~B^lh2
zc)YI%kM7#Fd#8S0Uh`LCJ-K7I3*24pogCGVse3P6%#O{pC&WZ*mpdd)j(M8~wVYPN
z7)r9F2DJC7(&(-UDi!V#X&L9`bXI!-L%Sv|gX<jfQQ~@8t}XlEuzVs=x^}Mb?caZK
zAM!SrKIQRai{Yh3RLxpnirlcdbd9CgSP`<mD%klyZpnjoP+i#7FB}M7V{QS3w?ThY
zAjhTLd)2Z`NyvL;+FPI1li-f(p)1ba#@=(woung;v>XO1i-0~v7dQawEtvwxpOVX2
z9x2M{*@@jU7BfC3pZ;}kr6(m)ZoMY6+4VrX{?{G*l6KLf?rwPaL<b<@Ojm95BqMA{
zox0^7o|Ur<8zch|#ivJ0DRug|1XrT+VG%jGP7YyQ4#Pi1Gdzo`jotiV-m8MV;u!|}
z)F<arL7P1HSX6~O!o386wQMo_@e!HP@NYsvrSzx_c=07YdMrXCc^CpuAA#_Y+lbRM
zhPZcd-d)kVb9B#TjHJ=fTd`;Zuw<g6A@bo`{Rj>tFVkd{<Iw?k9O(x^?a+#h?7*a;
zhD7?R?cZ;TBV-y8>9!q|uLNmVPhPI&OnCXMf(}XR44TY9a&VHbOD!#!)(LmZ#YL)<
zhwd$pxu$Q$Zi$*x)q~UA;ctG#*-hlm9@cOXBgsm4DRX8m$uj9G`hFv1?M$}j<-Pid
zG&1pYsGQ2~dz>mr|57`i(s!Aa4^6-2er4#_f8qd9KKYk<(kmLn@MHIXp|fDs<C5A{
z4D%45%!Tcg)6hRTdNT|={$xjQ$}=-`w~9|e`SzK#Kdx7U0ntw;q&WBN=2-p`Oi1Ao
z5lT4iaMX{_rc<L;2OILKC{GW0{O}_TewaZQt0>|-=CFRf9;=^(DE3<sq#HTWr3NmH
zkW^QD!&M<lVXUP%AL|~NVagD*vW=$nB$)7Yk7MQLeEnmW-3ANWmqm)pU6_K!NiriT
z-LgsGX@LjZq#q(a9Q3ES{FnL>ZZoz29Uk8GH&)?M{*&Hi<#}Okqm#+vPnN@^d7>Hh
z$?4l@F!Y@R4d_qwtXCtRS^O8V+$7Zc|MqK2qOsZkHqS3>r3#Ou*La>q48?~{<WYRu
zL>}0$pa>s3k*_{qGG4Om-+v(`T}=}a=*Q38Cr2_YZtyF5*{X<xt`g*fJnEDd7d*XU
z0g}Z=zqXuT6@+_%LHTqmueb6vO_u_J%))ks>tFTxreCe&M)J_3aBDN7S9mvmP>7(c
zIkDjcAJGVKouI$OOHV_&H+g_-c2=$^b?2Xlb*D14;g+a!$!cQ7Dj4#aBQhAT(&bq6
z^YyXtBoA%VC*Q-U?2LT!Jq-EOTljEH{QmvP3pabN$?C?R_=UUJ;--%(-pGHp);^vk
z;wXD)HEI_K{&_4l=4_IiIKmu~Eix>vm3+-LhfERkD!VF_3VuMj+z=*(`pPA%SZ;P`
zRvv$Bkqcw)y4!?9^M34~!Bd^rZjN1_4%MrtYy+Bov*a&u8I`mEI=i8Z4<*9!90un>
zLOQ}pJLoykj*8LbN7V5s_6Y-7wnwPXP}d2m?w^o=xg3S0mc<(m6tt0!o-P7@b$<^L
zD~y3hfi&nbmV2$tC(R$!N||w%PoDkxE$)mW826}cZD!RAKG#5M9hVJZvR~DGHiR%I
zcMD4+bxQZgZh5in{g%CN?lO8wsaZ#k0^zKj|G0~L2>A&<u0fZzz>7!bbs_VSWBxmK
zqU5ZO%*!W-W$wyNGWq?7+D*lxY^lcjSr{}K(&6THeibmr1w$vw_0DEzKOB|`DBWiv
zzp|~s<zJeK;)%_J@sm_1vE1TfKl7(OHbQ<Kxy+-uMpD)X%OYW!97E6AEtIyEuB{c8
z!Jpf3Ww;d>A#MP`^jvXCeGwE}9cSb+20xEiHGN;c?ZUGNZ2_<S!tf})Wy26j+>}3(
zFQ@9Z3d}Li&dN73Wi76*!WRuJET45N+Z`aqBjqP+G39q&{?q*t@+>-WM4E)-$7FMc
zYj&2jckMZKEcDo+k6UhCJZKd|G&Od3PX?k1D<UDknP#b*evaEsQ<f7PX_XeM#`UYL
z#Rz2sOB6!J@=naHDwZ9Iwre8r2Xoeid;sZGePGdcl0&_+)VrJ)Q6MfaUZqfdd*>Df
zgcyV%qV?>-)Afg=^*GEbTVvUE8=T#9Q|=4j2K%9YC7!jdNYMs$X}a`l!(pDhyvj#+
znDSVS^4cTaD~82Ehz#?eONx9PqE~izZ@7AG@8$X_cFlPGzD#&thF%pbm)}2yB?w*p
zEUfOy)gFTGOmQuNq|)_NUVGPrMpO43yP5uDe)I2<ztn^MM~=C##2t|jYq=FIf3YJ5
zRr_n){=n=eoAgmuwe2Q66m_~^AA@!KaOMw4JG!WCuWg<1M;^F6Z?4U2zJ;Rn-q37E
zg@)l*hslBk-Nce?v9SFp?jg)gnDy^LO?F!*Z!6{ZkjhbsPo_vdnIcJ^Z|(sUo{FWF
zaaM`bWt!>YNZr3AUH9UqfpVKAJs0V5i&}9HNwu2a;NqfKv&$v1j}KNV>{fY|W=+(S
z+paztRVKBeluMyDv)J8Zw}Pdt-$Rq`zZ|9Ddcj8yb^VTD>iNZa+CaTxA7@ZTT7*O(
zE}nI*t^P>C+9uH-965aWh=%HytV%qj^YfAR@~ZpCrHvO!8HGwy*wT=w#fAQA&8l)K
z?rTWMlT41@NaL*wpKNIei}Rz69#tC<KH1U`wlo|)d1(Hmt{dl_b5uSYT(M>y$1X^Z
z`H<eUIOxH3F_y77J?<B^;^pj3*W2@^E%i2i%boL#7hxy24)4pHadJ226-#ZS%eR&;
zB9_By{ww}krN2I0uWPk8L+m#QQgG^7I%F9LES+Euq0BM}d<3q<WddT`AV|TfXX%h-
zCa~1TWe%!K!K8f(;%S2*1*aUBIrtb$hb(8|wXRhgm-A4)98B8RAYL~JQgF&~Nm)8%
zxfxh$<FW?Td%>hl@lk;0pF`|j=Y@5xc_6_lNAG@O(ha&0$|ethGqm-sFSS<djQS9z
z{t&e`#lZm0k3yU=sE&9`Vp5xc0hlnfMhTdM(diJi_F0JM47vjGx<PdbNQpZnJ|9>*
zB)(zL>l06s_)=h*B=I$a>WG;IWRnKt4y^A5mUbP>8dPt?l~Pz&TaC#7%))sA@ufi<
z-|&I=!<7iu#fF4r6O&<Bk2Gf)gz6C7Mrk7doQ1OhanYbN5YHP_mnIUDP11A~*4LY}
zT!!iuxQ)_8{(BbA1Bed|dJeI*-Y2C&IgyZTVzLR={mohWpt=!mqco9!#KIYeIAKs1
z;*vpi<wQcVNt({W`h0Vi(@;GFw^5qNf8D~l3GtRe_aQzqs4h(@afifffu%#@#|G6A
zGp1yd%z6RqR!`$<^b97?;Wo-F^7mUf0}!_wGzzh8P+gi*;tq)i151a*(+1TMGp1yd
z%vyl;QedfV8|R?fh1)2z$ba6#xd`!+K{p_-8B~|1l(<9U%Ymgs;@bw*5i_P_lgxSm
z>qmj5HnZ+Q^*-E2nMMBAr+g$O=w65$4B7&5(4e|BrNkW)_XU;?iH8iTBW6s=CNUm|
zbvv-sX4VK)N8vWgEb=c|I4clO8FT^SWrOO{loEGHd^)gnNPNYhI%39@Y?4_wVZ9bu
zYBTFPRBym-lv(6|WZ^u4_|%}DPx~bF!IcQsr70!ukoZ|3?vQw6Ag+DYVNA&;aT$R1
zU|^|@UO!Z~z-^RS<ZoLzGZ6P1v<&gIL3Npx5_d>E7g#zZK4VZFF=I+L$*ha8z8qL;
zGwVE5FTib-S>#`{aPC07YtUne&kU+dQ%c++@x8#(A@OsA>WCRrvPow3e#RU1!EI3S
zTTtzR+bFZhKWO0$L)>oAG{iZB>e7@FcSt-ESUM!`8dOKjn37F$W(C%#150hqT7v2_
z+(wy2{>v85RfyLNx()H3L3L?Li8~~|9#}dgzHd++F=I+L$*d=^eim42GwTslAH!{w
zS>*5Q^^ugIH$mKN&=ABCgX+?h5_d@4A6Pmh9yO?rm@y@r#CQhQbAhEcv)WLdhTAB!
z$bZ_xIScWeL02GNH>fU6DRGCy=L1WJ#5WA8BW6s=CYf~y*7pKSZDy@O^)}o_nMM9*
z7S0QZFAduGS)YV{xDvs-G^NBH61M_Nhs0Y9sv~Ah$tH0bhV@8bsg2$sREOX;$}IBF
zSvU(27Y#ZC@w`EGX(A!nBu!UgeZ4u$WvE_(+bB)szh~h*fcVg$=MY<;^GRt^0boKl
zG1&y`{^l%wP~8Z(QJO}eJZ|Bfg?Qeex<WY()iZD#1$`aLH!YkO5L=&boOjP)@*HlX
zpvm8F;S50BYS1Xewn23nK|-=gNiM*8sX5CWRJ(8+rHTCKEu4!GFBx<L;+jEqX(A!n
zBux)s{ir$1J*eJ?+bB)sZ*2(mp%>x?gSJ2%G^j33BqW=pX&lz=<}4#n9fjK{P2^v)
za8@9mGUx)t%Ldh@iG*a6G~I;tT631`P`v@SQJTpA$ijI7@u@*QU+_ujgDVlNOA`sn
zCME;09&FCi57jMj8>NZ-Z3|}x;(mjcA)Yp<E=?pPo22O?tS>ibIS<tfa2utG{A(7@
z9f)@gdJOTIL3L>&A=xBNy<bFW!);L7EvWXuZIq@yC=XgV!w|O{G!1dipt>}XkZh8G
z6<D8c&awp6Ww?#fME=Vb&Q*xl47v^Ro<VhKA|cr%O;2F`tU1dgs6K|<C{5(=`zaqu
z33?O6%?1rY95JXaO(Z0n5YNDRt~pB^s?%^ArHTBfEu6Cu&lz+D;&p@S(nLbCNt*7!
z`d)LEHK^W(+bB)se`evlfcVm&jeR}|{ct6Mb!j3Y*~DZR)+5bX2BA6xw^5qNKWE`A
zKwLEF48-#W)uoAqWRo;qh4uC3ESI5r1#Y7>k^i2B^8n&QgPuc_H7V||K{=6-Y+|wr
z*8R;{`k=ZIZlg4jf5gHWhd5zS7vhpZb>&1tvPqiG!uou3meWu@1GiC{$ba3!xe4)>
zLH8j(GN>+1BqW=p=>@D?Uv6C5&tUQ#Zlg4jzu&?cfVkD5QHX7W>e56)vPqg2V7=6w
zWe%!cxQ)_8{__^jMTnOSx&d*`pt>}XkZh8s2e5wBoaG)=@561BCi1s_I@E_=h#L&r
z0&&owx-^lHY?7vNSht(Aj6ii1Zlg4jf62mGfq2TG3lJ|GRF@_al1<Wd6V_|ZS*}C%
z2HZwzBL5=`=Ly882K8+8N$7(s5v)rS3CSiV1F#-!&e9LnEpQv9iTrH~X9nVagO(wl
zHmEL5BqW=p=_0HzH)lBy)eCSNrHTA&7S0`rcMW<B@tHw&X-bJZB)%6|IwXE>(CZUV
zlK5d@nI!R3gX)Nx1!R*_==~XQ)Cadg{cJ(C2X3QMApf9+GYoONLDLZD45~|0O57pw
zNMPxZxNA@yF=I+L$(a>cpAIawH}euym*F<bEb?EraIQkUX3%Yj_YA5_6A8&CX?g<d
zXU$n2LG>}*Mrk5{-&cGjCFo5MHybnram1jyG^NBH688s|4v9w%dVS(a5^oJGlO*15
zP#rO|fNYW#Gq9cuEVVVO4b^G5jY@(1r!Abb5YHKO1>$vs>e7@FcSw9buyja#!=TqE
zo+R<5z%ohVYX-eO@f3+K2bL)kuNhQF%)BL=6z?5a-wQ0Y#mfM1!=zF1lK+{7^8(^a
zgEs!GPeMOjiC|rtNJus@8HV*pbCyA<4#91dCi2f&I13OL4LSqyyg_woA|cr%O;=%k
zy*bNes9u5FC{5(QXW=}6_|Tx|5L=skQW}&K3CSiVn_%7FoTU${8{sxe6ZuChoC%0+
zgBBnz8&p?LqfjNAr0E=>3(Z;1K=mx#Mrk7d4GZTM#5IE+KzwXaU7Awj4vB9EmJW%Z
z81(wYlO(<uSSCsQ$e=o6W&zox6kfu*=jXg}gZlX#CNJPNDh2Xyv2eCR95iSg;<Q0^
zX-bJZBpwPZ9TLwNR7cF1l1*}E5!TCrrMA)SLUjRdqs$`z1q<gA#LEWVf_TTEx->n8
zYR^|gX>WkoXV3t|A%k9@xI^NNfu%#@VT0<38B?-JDNMk6I<VB1!YEY7;WjD-@-JIB
zry!m-=pw``2GymBgk+O6-GcS)<}5d$dJ}G=G?D*_h4T#JbAvYg6`zDna2qrVDRGCy
zF9LCg#G3<gr!KQn;z<(s1eQq>Z#3xjiKj^18(5}DJYY~$;>RJ~(<$+EN<3Xh%t9lZ
z6w4r@H5{T>doM60TVc|u-jILB!kL5EHRu$?vj)|riG*a6G+l=E)#fZ0p?V2!qcoBK
zj)ij%;(ddjLVRIRU7Awj4v8NGmJW$u8ua?alO%o|SSCsQ+@LyQW&zox6#B4(e-qpW
zZ9p$nH^6OF3gjQQa7G}G8nhqcf<bj@N{Krp9uF)X5-%E5N6eU#O>*Wmtj`9P+S_mi
zs;A&K$}I9<wQ#OOykXE?hz|^^OA`snCTV&G>le*go<Q{}+(v04|E9m{BPl`mL)>D}
zc8KE!)uoAqWE0{!ST8hZnSttlxQ)_8{<9X&d59Mbx(4y4L3L>&A=xBN_h9{?Im;cW
z-i6yJP2_(Oh4b@1zCCayHk%<17*v-g61L1_1md_sbu7bB-43@=n#jLk;VeO1Hs~D0
ziw4!jhJ<93oVgC`o6T9SLiHNlMrk7d0}JO7#K#7`gxLEFJ}DBxx-^lHY+}+6>w)Gh
zo1nTGZlg4vh4Q)AF}euln{Xw*YY=Z6^bq0`gX%IOCGL>;PGISf_^Cm4#EdD~v{3rJ
zQ7_yE<@5ppzJ%K-hsi%+;S53?GH3$gj6to^U-^_45|T|4umtOs<}3?PU4+{xP2|65
z;arAz#h_ad?-<l7{gu;1Lb6Gk9>MxabCw5CeF(QvntFe+<^KBMO3-bHGX{Ab`z<G6
z9I6v=8wE}N6$|Gy#4`q6f_T*+i-(uWu^}PZBu#6uzSErLCRA_1ZImYRKe2G0L40n|
zhOhaEZ-OfktV<IK$tEU)upVyCG62=Ba2utG{4*BL9K^0cry!m+s4h(;B%7q^GOVvQ
zXSoQ~OK=;diTrmhocj<T81x)s>z8~|8kAE?+#&J9K-?j5Pav)xw;=JIz%ohVCkB!D
zr9pM2uo-dK9^%p-g*a}|9K=O~>WE25Hp#s+us+wE<rGv;!);W&<iBR&T!(nWpt}$s
z7*v<0Cs2I~w^3|1Z}GHS;7UexAubwJ7xaFp&cSUI^f@SBuyF1}d}vTz(08GF4{oEN
zUqZR(uX%b&^(e#%gX)6b4%HF3je;isqJ^^zamAqX5HA^27n_v0L*i3`r9<M&2E9J<
zB#F-kmPry{G^mc4SwJ=^g&VNG6<BJYKG&dn9d4siApb)P=P|@52DQHKldu7<M6fPR
zDRGCyPXlp>#C?IdwvA1RCrSJw5Kof0HxN(0evGF`{4x+vk$7_;o_c-a>6CanC9WMC
zW}%Tyie(F;wKYVqwxpPnewZ|>H{_qNaHb*77_<cOltFcwl@fPIyg#sXNPOC$*C(DN
z@j_skB=L$tb;Qg9vPmgifc2%oQd<h=pn4u|qf*%L%RX{j;Y!d$5QhzFL)>prU7AQp
zHX&Yy^{M78i%?yH+bB)szhvQDfq2!RHHdc&s!LN!+#&I`z|tY{J%j3q8B?-JW<7@W
z)4)<&0Ukp25!^<ZMg9!~K9UmjMu?jX8icsrpt>}XkZeLc4eR~QStg*`hTAAj<UeKM
zoQ8PDpi2<18dR62i%_NM8?C|BTfo-fDptpH6S}l*l&ZThdJ0!E^f|;A2KD`l4}3FR
z(W;9L3CSiVL$Kc7oMkIi2jMnK6Z!XBICBuY2AzU<)}XpHtw5EgS}K=-U54AFq%K02
zwvAGC4Mun2N`~Ht_`slN5MLTpmnssHO^7%CD#{yfgYw=0)jqh5(zF@M+bx_?h~oy$
zL0mMbE=?pPn<U^2tj{%PIR(|za2uuR8kBEXIL{%zG^j2CPoeq@Zlj>dzxmfZy`*{z
z!~ugwAWj%m7aJ0iO^Ca&UTn^?AF6Y38>NZ-=PaBH5HA{Z9pWv6>e56)vPqim!}?)!
zmb*~B2e(n0$p6y9>DlVz+Y47>(+_d0L3L>&A=!jw6xI{XS++xU1a6}=k$=&`S%$b`
z&;^K>4XR61O57pwsld`9@fCyWh;KplVK8Ywf%w#*-e31T8{tZp))5avwQVLd5ceCj
z4Dqx<uTR_|@myf(kob&2b;OJ**(8w{VSPEU)TaA9R4>47RBy<?X5rj{c-NrE5T6-T
zmnIUDP14l+4R6#3w?SF9pxOhsQJTm<XyFV)+-}e`#5sfN(nLbCNdi`2eY!cz5>%Jr
zHcAuuFIzZQAYL_S4dPvc>e6%zsx;LO)FWVz;Wp`1J%lc88>Q+Qj5fXLqbV8M4{?h@
z+aZn{RF^6e_XU#<i3bcK@q|H5i8lt5NfHkkMB-6{ni5-9>?84TVA)6F8H4JGNk}%y
z<2hI_1eV&yg#qq|Nu%N=|5*#?Jj4qIU4wYjpt>}XkZh8sd$4}coaGKw@4{`ACi1_C
z!Ws1O?SU(?*$i>Opt>}Xuw^DA5XTLwV;P3(cDRkwME(T}X9?o6LFXV|G^j2%DRGCy
zD}kj$;!6hA5i_P_lPtdu>zje4UB_}2s@LE)%B+F6JncAK3Azn&+Mq><D+blYCME8W
zcqXuPNPNnmI%39@Y!c)1u)Y{rYBTFBRL{X}lvy{SycUJC&BwPFuEeG;0WV<v@^ykH
z|A2)v2yw`u35YWW)y0N{WRnCe!Fr`R%K}sv;Wo-n@?WxWu0XtM&>F<M2Gyl0CGL>;
zT43pr_?|&ci7y6|NfO^Qh{SgcYD#QbF-78Afn|!s4-Kj#CL!6Rcpt<1X<(_XvJCJM
zOd1t0`8T}nBPl^|gt*C|L5SN8s!J0I$tJ|pu-@OCWdf>gxQ)_u3d(0JoZArZ8dR5n
zTToqt+bHPmL!Nd&TuF5o;(|e^A)Yg+E;b}2n-E`t^|j_Km!NtXZlg5a{icuHQ@9fJ
zGl<U(s!KrY9k0<3S6BuhZZ&8WV%wlPViJ-~h!<eJ)SP7ws$IB^a)$ipEu4!GFBx<L
z;+jEqX(A!nBux)s{ir$1J*eJ?+bB&#zu_ad9j*j@3gQ`q>JqRF)fKpng1!RfYZlIJ
zh<D)XYvB{fPa}--b6^tdx+p$|D(M<Uk^CEnJ-vjp8DhUd!w^Res*6oZ+#&Inz|tY{
zxIuNqj49b9#`|I24J@^pH4W7nxQ#OF43y7VI9DKEg{$Rx2lCwrqkJD&gYvu$Rnj$z
zBKe<NI4>c#elryDCWu=Ms>}A2xI^Nez|tY{fI)S{j49b9XSTz7G_cf`=MYqf;Wo-F
z@^>wqMTkoVorQS8pt>}r#2peZ2bK<rFB()w%$Sl*GV2<wZv>Xw%(?>At8g1-7Wwa6
zI1eE{GN>*APoUcSEw3pF=!3Y?psf&x4XPt1A=!ku4eOcaEaOm}fZHf%$iHOaEJIu|
zs4fAgpnAHw2~{tf$yJEg47v^Ro<VhSNr^ioz8+XQB))G@9Wi4{HYueiuznU;YU}SK
zs6K|<sFcXx_dobZO3<4iZZ>Eb;;2D&X_|xTX)`$s@ti?dA>J^kj`$u_pP9)Eh%XJ=
zxZU&g!<BT^5tEQ?VloWtk>)IeP#uEXs1(RQXW=YBTr}tm#PbH#rHO=OlQdn0_4Vc~
zm!WzEZlg4j|DJ{O0OCV~o<nT?k3K04%87(z6O&D_?r+Z02i1*m8>NZ-BNom$#0i7C
z5SI+9D<=|?P11B0*5{kEoQCQdxQ)_8{_7UbO^CM)x)1S@L3L?Li8~}-3oIQHKQ^e2
zm@y@rWY!B<w|=W}HF^e<=WrWkRzLU$ESwRDqj0sa+l9OkVU(AEHK^%xP$gZXD4vJW
zMGNOT#2aumiuWNuh%m~JfHjEXJ*bkdQ50XoX!HLRN^1+m0fR;$P8d{IGg9IXiMIxp
z4vE_a)e$qMWRslf!g?{V)IMSMLv;>rqs$`zISc0k#ES;qfVgH*U78+3^`)8gjCiA7
zxRT6%h+7TvI`&)MYL^msNW3AibVxjCkWqT6o_LbPn*z%ui3bdNec~w+Zw@R|B;Ib&
z>l06>#M3G9bR97Zjcig<qlnf-h+b`lWJ*S0(x^g`f6>BOhPYzTd5D(`YL))V#hVg$
zNPH@=bVz*Jpb~GZOw5>)O)~2StZxOD+RVBJ)$4E@W!6I|KeljQLTv45xj$`<`yp?M
zFv?qjNvyqr{gxBD8LFgf6h-onTR0S-259~n#NKy(@atOhTObY?v=!oZgDkdQD#!T@
zh_AryY4u(I>?*lQ=+W2Z`gE&r?Qfp`a>7RZb@~3><M#WRxC#Ecag(zCe3DQH)-hd0
z&fkXHprYM?>YZTHtqbL55=y7egb}(QLTR)5v3^K3tYc}TE-r;S*<OKo%AgAnFB?=x
zOhU3rzTJfNT631`P`v@S(LGE4M;6W#h))gb+3Aze2e(1Nl8|g-G63tr<}CeC-2%5V
zP0Zdw2oe;<8v*LBLA<ig3+r0ls}P?UH1US_y$)BjZa}<a(8cv$>k{0G{1`=WGjP|n
zX4W9yH3(90o<rIgVnq9(at&TL;I412^d<NBEqLBSoZo2uy%y!$AswAT#D6HCjx{hb
z$rbkrRqjKzLWMcZ?3HX~b{cVV=MN)Vqi`#ey0yn=%`jXkixG$u28HZ{(1zD(Q=$0u
z(_Uv?>(HjpcyTk_igG>=f@^{3P&uso@OqY4+3+cEv=MG)N;kvPA~;_TiYh};ttg5C
zcwL68RfF=CVAkG%T-XR#)yjX@piW&WRep5d;@B-)@w@4lz+9QuGsy7^`J7KxlIOrB
zSl=-giv6GU@sd*J*KW55DCr-Oh+ny0*9srJ=GTEGt4TBxh_W$S3o)9cXff)NXd)0z
zmUEHc+2&`jB^@up+1neER<?Qy6{>3efOcQ7N@~?GytW6GL;E2v8B`8y6kb%7uoeKV
z1gj*h3-G!Gx3YHdlhBrBhs&Y!<IVhRawQLy9)$QLJS<)dDv9!CloG%EThU6SDoM?_
z36?vd%#&J}sw6D@>hOlou@1B;&V7MUm!E~4_+o%4wgZ#|Pww8p-JxjQ^C|Z{x%qiT
zxqHgRMed%!JxQ_e^Ni#n63vB3Cilf=5ZEV?yZn0bbl^_fqyczQRqE;lp#8xrDR_R!
znBPLyE(Nr21*;@1eleM<64ni9-wswuSdZZK1a4)0=4XzrI1Z=9kyP;w$l%RzE2*ip
zC6q?O!-CqhAru(JKGZ$wzqM9*VX-{KSdO4zogOb(>e9rOtIZH%!|(i7J*CE>GZA9m
zU4(erpfd9`yr?Rrv;ydCuu4klI=uJ+WvLPTl<|{bmDGq^@S>`O#cvuv3sy;3{mABN
z%kBk;%;Ab08-&VGu<FvvJ}jKXa67autoda?X97_YLuxYsNf!(HQfQ14tMa#nH4hPn
zec(5V;Vr08Rr3(gvwRG1BN~tL(cu?rw}dt)iSbQ%-3cm5+nK7QO(3lK-PDT52*2TK
zDhUfe)VlGfcoViM+D9x8@gtUJ`+`>a1|U&iAnH);3s&<aIv1d9j5Y+KNs1PuE{QG%
zqNHi>2f<(<Iy4TE-(#()@WW7{s#J^#K>GtxQlw|#WuI0(bQRF8V3jmS=ix<F3F`)+
z+rcUc>k+)3z^!b5pTX0zENOo?AnP{6t>mH7mXOa04~y4=N}~J})-MA~yIg-#m853$
ze90RP!Ic_M@lJrccOlx>9=k(d_J$*HrHPn^I1`{GMq5EN2)8nS_ytjhDn-c97=%FO
z#L|i%9j#EAL8v6wM-`ce5$USO7t?5=Cv9K(6PlF?dx9{cPdZYZ-ssaKvF<`#FsPi?
zpUjG%kKFpxp06^FL-6G15j8(HA|{*QR^`!f$xiA6&4xlkl5C^Z1gyoXoYnzYlch4&
z%qxDLPpUD+fuCW{c1IwN2B^)CqTLBl5`jyIz*V@F5x5Rd1|j80YJRIrpfg|bak1|*
zCDoWjcR*NCjc>t=DbwO$VEj~^Vo#B#mmzJ*NY++(S+u*%iMzq7JAr63C9Z48v^<Ar
zMbQm{f*<><%sGbh1j_4MeM_q(Wkxx$Tr<j+G81t5^yR+9n0TH2pE2Y=$b>9-IpiMX
zSv#M18{jn%RK8zk8G;v!MP@Xvy^(}PtyhG#y%7<$SQ{!{A*u3;uv$OslQ9Ta?o^7m
z1Ju0(amyyJEtP8!;&y}hiK*!TB@dhd5N(B9Sp~=8$x!8<V`vPb;x?oeKPgtBGF>9p
zyOPX9h;&tB$~0Q&Nvp&!Zt(+Il?mg=sd|5o+1RGYuX#w$ZvQLZcLZ+5olGKrJW0x)
z;^0@wJwF7IpSY16xdiCCX?b<~-HgZ$he#%gorBk@yvh}LU4vVhA2;C1h)Q3T5$p?z
zPr8(}x*I}IRMtwwTBu~cjHFi;G_%D*PaX*TY|k2KDig+{i@vQw@yuUk`E>ayfr|!N
zF?fkYb0IrA6whrY(foOc&kf>N8F~YEl9Cm0UI^StLEnOxefA_#X(7yBxRv?Q2Tw*+
z3YrmI2oX$5kyZmCS&7Q#60sI4nP0-Ms-T%I7J8CB8xXNga4QqWqT`nsr1_-CQ|2YD
zJg$DcpG9_v;zWRwwvya;LJoB(4*vp)=E;5EAab_@cgL&S??Z6D2;525_W!(B=LZ=o
zUL^TlgBwt-%%WTHwEXBY&Wvb93rDN_u&z+K121NVmNS`oj=y4*?}Z#nvYHeY$9d+b
z#WATN+d()Ew=(%RPzd+oN)4en{xzS&k~SXAy+1%n97%L95OpY?{Y4VZUx4_+AadKW
z-$`|N49=EWc}Dx)3a|0J3Qv(|bX>ob7mS!ZgcvtVf0DIp$Ok)WyG_v!luoKFt)i2^
zDe^e#ih7h<P15RdD2{9lsk*K;Me#+jI^6q9J_onLl{s(AQZF%GJoMakk1IN<Wj*O0
z53V*MlRkKz-Ydy?ptzLh@+vQ)v&t#*^lzufi(4V(NsaD@*GN$LemR~)iOOVIg~y&7
zOH#d4m4t=Sd>G==rpRM#rRHw`x(|H>ZbcvS83_8ec-4v$pMjU1EMBo*VF5~y;c839
zBffd4wqiUu_|aeU;VH&bnV&^iIoo&=I{Ed+fI8^~BKwAr;BJ}dDI)kBZe=UT471~T
z+Y|?WnHiPb&$Nn83#PawSS1lkttM&J4at}<Cxg*B1(n=wSk|k&bIMA&SKhMTE6Hvm
zX72Xl#jTK{HpPBqjnm`BV92lJHoORm8-eP3<;=O7s3bSg^+YAP4O5kbh0$zVbSc`=
zs`I_S;v={LZpCfb1;Lp>lr+3I;l*QuD=Y3DDDlKxy}inZ#wu3+<6*|MlY5C~j|RMQ
z#iNK;JUF<SN(16iglVVuRx~+0*Y*LFD>H<7&Vy;CKSQzgt4vsOC(~*mlvszNow}Ob
z$*I*Ot$4U?MbW2LQ?wcl!5^N6$n$9{+G(b10;;(tp{!SV7nhZCO+s1km1O4;Gk2@=
z;zCGdo8pUDj~Bh6xRNGe5&Gu>Rq|v$ov0)?^VvitX%bSEgoV-EYSE=Qw3QWZejFlC
zzO1MhBOu_>xD_SN!)q^uu##5e7QAl5t-ML@!gJ-<d<5TU{hcKqVEQP+c;@Iv#9sBh
zh5g<uap_YT6q`f(lUs*Yk6~TWl2oXWnDMHx8b{dEa4XZ#gKn3gBw0;LJFGRy+UL-2
zAz78wYw#TW^-%UNA@Zooin3q)hS$CUS6VHKJV>tM{gzfdv{8oHD4JE0^%oGvz?(iy
z-Go4S9N4<n|4i{zfWA-hOn{~-@|Zd$v%29W2FTMFRfjU|*R{S!(aztSDl=U~)Oi%8
zGCc+M0<J#oDEEYjCQV40N}8yztdjR0xYo5k;GvJCl#=NMYhPghfN{PYp!Q9Ow+y0a
zh4VpO3ME>t5Uq=W>Ig+ru4^4GQ(Z?Qco=7Ob%hdBUI@<;c$gx~&FS%CE8->Kx>a5b
z8~Da5FGdVpzsifYfjz6dm@)8EtGrk+@YAcjSTgW4tGqaEVDBm~Si>ZqpIzkzbI_%z
zoQFKX)JiPrm<N?mXHpeJhAfpO!8>SR&__Zl8pUS;n&14E_uc$9wdVVWy!aAsMf0*1
z1SHb?hD?3iyt!hO?JT>$PSFDVKE-~-K`kji2=VHc<E3goDEoa?#5P0`qud+lzekbB
zk10K6#!y-niZj77$*`)3@u<rg%X*8om(C=a`uAGQR36%>jS=PjC_0H0k2|~?pqXnB
zuN%bk4euEA2x1F)BM&ZS^BEMs2FU}%?u05a^8n&=gUShdT1t?+oy$rCh{4=9y-!8M
zvo%pknz>=9Y=<ikavmhfnj{dDWHmc^m@&I<2cqQVkSaVjvZ7zrgY0BAb8P`HHo?<n
z2QRi7_{J(P1`S-l%8OA0dscbTHgNqaFQyIbS>?rk13$IOi)8~py~>Lf13$IOi!%m(
zW|bFb4gB;fFU}j-yUGimTPSJ&%qlOg#G1UgZs2EEd2!Rg&#m&}wt=5t<;7hCH>~pF
zfq`FG<wbP(;TKnV@ys-TYLyo)-0~868DYc)n+*ZKw8{&%8v?dMBf`@W1^nzPFW8(2
z_?cB+u*y1fUhuvYuy>U;n0Ji>%eNNk2CS(ntB~AOk~`udte?Woy%m=A<V9{EX`jnV
zxwpcy-YdzNGxDG+=S#)2i_~V-O|6n#XrY<g9GbhNUFb_xCd=8qDN*Uvt0XLJav5zY
z{B=oA5541=c|M{%{wZ$$4ewQvIU_%j)hSp#g<J6&#bjcRvL(@>cm;kH(V@zAs8m;T
zcv4B~)Y{*y*!5Z_ll3a+(|jvyIX2n%%LLFZ>%E%oGR!0atyNxJ11Na`DLC|6GZl&}
z>pUjeMe$UC5+YjN0g;OUFYXz*Zj~1g418mi7mo~Fzsidz2KKD-;+cV;TIIzH13$gW
z3#kL{PonghRbKQO*t^P$J_A3y%8N|~er}Z){RV!1l@|jBZdm2Tpn+dl<;AdpUtHzI
zh=D(~%8PLW`&N0;Ht<WUyjU?XtwoRF`4X;F1&X6@`0S~;nP{~ksC4=u_8UZkaf46{
z!6DI$5d0)XT36hajNz+;4}n0S)fPlYiv9Oic`+E`I8(Nx%1~Z~DVz=}?J^6!x~4*r
zyL&4#npR7}szdR5fRfj<1$a@#-E+L)9^8tXeg$?H;kq2+#pMuQl0&pR6I9w~Azm=3
zoFgQ@7E}^q#`ShkX;Zuxpc#ty1C-?c19<hV_py+~Q=ALXVT#=VwQoaw+C#%+Sc2To
zL+~AnB$SdR(YZjBJmN{z6M~<lI31vQ61^~J2Aod<_k20C$-OC9O;NN+9-_EnS`5xI
zAen1;iiD5AN?$)Iw*ym$<cw|ATPmprA}Y$XmoY4gjGR)D)-oY^Nn??350N@dhGzzq
zvo5s?g=tnvVbW?#AkM06hKjr0cwu%)Wv0qtpbpjajzQ&QY=svS?;3@2@*SA7WUk8_
zGBf*3sBy_{!SJH0n_A81!eT5dT7MGr!~mCVyfC{Y+o&>OdBh0q56MWZMxo8byBwk&
zlV6!_OgJqiDcpWP{wbgCiqy@(>wHjYQ+yPl!xSF}s6F~=&$;C@<W7o&+{?kLLy?5i
zQjzF32rC{-Bsvp_CMn(z&^(Ez1JV2qi2WgwNev+P#XvMg(IR<>;tSJaaFzjw%C&0|
z+G}vN-JpCgFm*`I*jBYvq`DeWQKr4LR1_IGr6R3mLef&P$Zv&69VWv>$j!s$<fT@j
zFwH7yhG=yqgq2mf1QmD7@xttqn};gb19hmT;~^P|70+~F;@#a<PJZPrM@#0qv{cOO
zTOqt8+h`S4-P9_nr?g@$EAC~g+=#P{7iO1a09Ec<wlP9CLoyPp+t6m>T@KNX$*;^d
zCY+X%lmXnJr}H-|YhOPE=~Gc04c+;qD$#0Fu<B4Wt0c2YJPfPc7*JX7jn+u=;#}6r
z4FQ$)s<<W)9~Q=^S}U!gEvvkohId6@`zN;~`4Y%;c~PlXu{3cAg|!{7RFUN*(<b0K
z7fQBGaXCOqv7Lg~rJ&NLxHa^avsM>_RfnQkB^B!ew0Ss@B;)s1d2uUHwQob@Q9(|R
z7tc%&xf>kvGb$C2#hb8RgX^ey!EmK6Jca-BSdSO2kTER45C!rZRhLvf!79m^A$Uy(
zl{Ur40ZIyiRue&`L($#@vti8zt7PzSKfD&<x=iB5Qm|`NJQeHlg0Gj7ndjhtKGq9a
z2B93N*p>M!s01n#G40pl(0Fkjpx9Bo73=Zhj_KWncrVtg3$%h?pfXiO?4Ki)p7lNm
zQR#)a!Ju;Rw4&-8t+$f)fv-FLd783HRj-O~Ju^l_adQvjob;Ax#U8gT8=+`chsw#K
z)o2K7lA>89HJnxp!D?y|;wgj9K|F6zE_iz#nWkvL&zG(EescxHnu(Ne1njL<z6jn8
z*x>30<RIy*%8|MKXHH(3$lc~-T|}&;{!wJ+IXzySHNA5XnWIjxoICVfGdpI)BZHnp
zWIj~fD9lP)%UUJo<cmO*)F@irhKh?LFN~^9s>iV&FP;VdHY3U)E7LrLQr#Zzk2b~W
z03{=9RM`&|tw)sSf?3l1(QCm}DDv#OirHwYaO|t<&gUU^7mT@Fy1ed%P*H9h;KeRw
zg$n0Q*p(C&iX29-=*rUy^Jgt-VknwbmocPEtHBWCNs1GA_E#)7Sb(;vBsFas*6d(O
zA}Ct_VV<IO4%%Hl0YWy<GqQBay%J*Bp-4jQ`+%qyu4D+gZv?2z4n|K1F3F=sXkUga
zmAti@+9g>)l~%Z4x&shj5n5_>B(*xitf2doS@k2)<00{Fimgw1>WZ31tI=T9q1YR&
zSVb7Y7Oh5t)g;B9V3oZ2(u%Et?5Uz?VI_}SS`CM=rYTxjNqMb6+mhZ5v4_xyn2v-P
zw<(U=d*}?r{RZWTwg;jP#qnTuC?!fF%@_>_qDhMP!<%?E9YeutisD2FejyD$Db-OB
zaInPP8@%X-2pp!k2*~O2V#V|*UX1m4aoO}J7Df$tVL5m>O~T=FQJh5*Ea4xdRv(nD
zI0Etn*6UmUOS+bW6<{UgX`3QXXO#QvIvy7rKI;RixaCN+9Eds;$6+lUfRyM^Ioc#z
z3Ph6>uLh#SDN&MZOve^jxdP?IV4&(!9E$aLVVTfnkdI<LUOY8EiY;W83zrv`gGr6Q
zg#<H-@_;BuO`vit1S$upPnOajgB=P5*rqu6IhJWs6to%)Rvn64gH<-Ht-)%NqFE(R
z%+t`m3U__$e_L3+hKub8&4Hz)wMOCD4N+=S-1zyBHi|qQQJ(e`w|+5b<+$epcZVVg
zCATS(P@dxyjXTLFo@03z9WGZ-cwvVs&Qm0n)8oZZh<lQwi-<F0ClTf0g^LJMARg1l
zgZC;bPfBzsB|4N6CH09!JTlXzgclagd9qK$IaB8Mw^gaY7{XbkU6z~;C-2#1rQG0U
zS+6-+#ZKsRh|%Rxlaludp2-;<XUVd+gAJ2vlv*81t&*ZBTe;jU+f`;UEk|%~Nv_N!
zSzK1iWpP=rIax&(Z%2%lL(G=a2OjJBop1{zFK9flbSB(eZHk+IicQ5l#mxa~pN6=-
zFKCtOXX`dNAHa24%nMS=gYq1xF2i+tyx>WL6}x|Uw4_mWFM`6Xk~;Jfu`#RUY1#u8
zp7|*4=UqVe;R=)_Hwil-X0!(KnZ`pCdxFXg#pwJ)ibj;&VYK4WiWTqK4ODs&4P!~t
z&EpwOC0S`o6-HZLVky2N1w7R86~t5_i&UN7<OZb@gKQT1G*W&x6hxci<u9?$cPU;8
zP`mYI@4FwaJY_CGykyYaPkXH=8v~aY?3Xb(9b(X-$Y8Z|ngln`;4X&X<{4ZU!HVG$
z#4{lV^A8|eq>?8sBXurBYLepJ03BldZiH-^OyhZo@nqyG?(r3HUV|%}J9;QD1oFcS
z?>thhYGl72a^Wz=djXnx1hEw|W`@yW21$KkhCD?EDZdqzml)MWL`z4lC^LRKgi5&^
z;ySp>xSm2R)RywufW5U!`9{D7SIdP~HCo2FRfW0sXXJ9tH50)4<v?CoMkbZc>9Gbf
zB~m#lGUJ_IImej`_mP5%`ojVn`WbI5?e=+y7Yu5B#ryWct!Ujz)Dx^a6iKKzBM5E=
zqT~j8i7G@Dmoi@533lyrVmBe+@eqL-hQ{L&E1LKX(B2rVk_Tb~l`V)CPfn}|h;i8r
zRq5TN9g?zAuB%kmYfe_tRT@qrpX`+%saF|IRFbD$s*(i6@_h(4sc1ZDk*7LV)ID1D
z<9I}Q=c3h+LFEc_4`I+sD%uZLc|m(u`*?8?WKOe8_q;?WyZFi~&k~iSSJFVGK|mW2
zQKqIM&-xOTq%bx%S78oG&ZPYd@@xX1<P1fNV3HHeY&%4=P4QVEnm@D2XYyINlG3LT
zw|>=oNwdTA8QbBcz@*t>aBG3PL-Bcly5zq8bL8%ldoBc*v>@cZ8;B+;GXByuQ@j|G
zGRfec2Pk=Yy9v&xaP`Scd2=wE*$Q#Op#2a}8N?{?WJM)Ag*-bAx9ZW(Nc1BQ++D*9
zD~B${)3F{etZ>o{M0WEqPRT81JFP38ZF304R1#t)>Qbl}ZHiAZ*;FwIauM35l2j+M
zJb|jq5nfCL>JKP#^OV!$#WeH;{J|<OW(;ht@?t;0p4ONC&hM@AYA#mg#R5QCOiA&4
zfDTc-5S#Mindz0AwtGk?lbA{G;mW9$$u=OIts%VRX}=v_%)g4_e+iY1;fTmK#i9J6
zjD65Hm85I~3shZNhj1|r*OvsZcwD7Z<;8G_MRHe<gJpjl1TU@vtVr`Ic=71XiiUp#
zp)Q2b+Y~PbXrAJw0JU4c;LGV6T<y-4{>VKOtU44)sJBx>l-!s7P~o|jF5h@@E<_;7
zw;6by2`Wj=xdpF>rb2P#7kzpvGL}})gH?y(aIi{}L8~XhYLcQ^CAs(r+8g_QbX?+j
zF$Yjyx+vZc&?3c`0Xjl)V~FO$W{4JtMIVy=GPt2YbeLj0K<&E_9~$%wVowOJ&5$=4
zG?c_3DW^FQoq_9effuBdTxga4u0o&bUe{VEX@pBW_+;?`55{hBlb=-XxpiJ~8E!>=
zClg*-bQJ?d&iYGzC()filvI=jc)dd93RJEImKg?5m(~x1N}J-w^<JqW5f7kE)%C5V
zrBz<gP9_YORv8Z60W2|~QpKZ^DqQ|pp>hT+XW_1EO)>zwsmc_+=%y+ideP-ty1|ea
zZHkwAyi!H>T!Gikpwgzund1tp)1UH$+zcQ!gVCUSu3qI5RPMp8$i3-Ldp^!iOI@be
z4fBwP7$)8Am|wKz=-roq?Av}xEgc2nL?BK|Dpg5JDpg6chSB^<-BB1$z+HoT7jD_%
zmlq!(4<5pO1h@Q+#TGJvpJgob<#_mIN9Hwo%J!Ub-i~lsCj8i9S)W;2)?0#oS$`8I
zp8DaAz@30w)*r~|aoV!1e;WFndgHtvKZ;k@FMmIedi>;GS$`C>I{f|{zv#x#xs~;&
zp<mYH>{?m>8uV|#y$_e4a4YNI%II<OvaG)q6HY^L`8Bm=T$lCB-)f`Ysf_+L;5Xpj
zhs)2WmH9alR@URk*~<FU;M)(k{0X?Sem|yuw!j^LyA|#*+;O-QaQO|eGGC5|pAjqb
zl<iN0|18|AaQS7gvVQp^VASJx!^-+R^?CT0yifW3=CVGIr@i)d?^8Z#wye*yE6@Cj
z_bH!3S=Q%qhKs-EeadGUmi6~TudL5w9?SZ7-uB3SxaA{Rc(4giw`pqs1bly1eV*j9
zamX|A*cKicQ|2E5Fb<cU)9JDzu1DZD)xT8g%W(tBBjDv=${SV6yHv{h<@J^2C7ES?
zu5Q?fc8u-TIPPz@BWx$i_MEzBd&<QFYhNg9`s;Co(}p_(cMdMwY4Vj>USc4%7lU3K
z;BJOn)@KjAi~MDGdnuFO3+Re+EiF5j=YW^_&!B(C#d+nfU0J`u^?G@ksQO#a^|>X_
z^;`#<;ON67IM!1ocy%9OeG6ri=vSBV`WDs^B>H_N#9yxG{AbB`eT#2YMUVBI11Z9i
zJAA7vdaQ3@G_VMZK8A@B9Ag*>-d{re<@(mwGWeDZj<&w!yS_D0Lj2`=9!_2IUC+a2
z6Z{(`ggk>8d|L)bn_2Q*-+HHn_{;UJ;SBz*48A>s|5gSc$>8s1aJ~!_z1O#P6#-nW
zZ?O?CdarN&b`c2r6B&F@2Is@1=)FFD>van2Th$Mp^{wv~32?PO{XhqJzMs+GpTU18
zgU@B~gBd(|jdXhJ(~%qC3mKjtWbnldek_A8W$+Ujd^v-El)+ar`0r-$QyKhkWbo4&
z{P#2XnGF87GWgjH{<kyuxeWeyGx+%o{`WKZg$(`=GWf*|{tq+wr40U$GWg{T{s$TS
zN(TSO8T@Jn|0fyzS_c2a41PU>|I-Y9BZL1@2EUoX|5*mVmBIgc24BnIf1JT@XYhZK
z!S7`7f0@DWX7GQN!S7}8f1SbaXYhZM!5?Jsf1AM{X7GQP!5?MtKgr;aGx)#H;7>C6
zf5_lZGx&eZ;LkGnf6Cy`Gx&eb;4d=xf63r4Gx(oo@ah+X^{qE5Ul`W6dNTN@Gk9+X
z|6B&&kioy0!TU1!moxar4E~i2zA1x$HG^-?;6I<i`!o30GWeDZ{`Cw#kima7gKy2?
z-^k#D8GKs?AIjkGWbok({;dqYJ%j&N1|P}b?`H7P48ALak7w}T&fpUnd`|}F6l3xB
zmi~W6pEHSN{qJV<XEONrGx+`t{yQ0bE`uM;;2d-*$Nz9fpMx`H{U2oX7c=;=3|>9x
zv%YmAqraTNKg!@M8T@xM_^Ay3H!}F?4F3BW{7eS_TN(Up2LIa`{9FeAyBYj^2LJmR
z{6Yr*2O0cg2LFc{{89%0M;ZKb2LFQ$ekFtd;|zW^ga4BZel3IlVFtgR!T)InzmdWJ
zD1+b3;QuUx-^$?sJcF-g@ITJrw=?*^$l!M}_`l5HcQg3E%Ha1h_`lBJ_cQpv$>0w%
z_`l8I4>S0`%ixbP_@89(#~J+JXYeN({6A#yry2Y|X7Fbj{6A&z=NbGzXYdyp{J&)I
zml^y|GdNEQDL)_Ic%z8;E9w7d@K0y(-VFY^489?Qe=&piW$-U&@QoS#D;a!K2LEaX
z-<-jJK7;pX@ULa?EgAgl8JtU|ilr&z{~7(Q8T=a=d@zG=%ivtPRgTX)8U5i5{;dqY
zJ%j&N1|P}bJ2LpY8GL63AIspoGWd7~|LqL^oech7f@=fN)B1n^Ycc0rn2Af9hcAla
zx|ZcnFAQ~Uw&J|*0sd>wP3H&wOdnRsL06q`$p0JB{A0g@^7mWvzpl0YjkBQQ2;+AI
ze?xq>?oh2(YYU=$SY*{_OR$3J(;o}2`t5gByVY9qPV20=im#P$AOE!eczh(uPaQE{
z7tLcbKfM0u5t=zVvbwHi^P3ys<@GhUi+_JCm+M-60W9(xPKE#5>3^X`UaUfCdHyd`
zEx0-owJw?uE%I*+dK7+E@>}DNwfQaVq5%I_s21FBIsHxHy2x)h72XH`5P+YC>*N1b
zss(r1>2D6#MSjDn@V|rq+W>wBuIK-Gss&eju<Kg=;kw9gI2Ha+@b3rkdAOecYg7xa
z_LSDOwuI{<zu{E)|G@tNfMWT6ood0=C+50n{<p|K5cDYgveW-U>mvX~{$Hh9aP^Lm
zyD?lB`3<MSUkCsH3ZPiN+8Px9e%I*_2C&F)I2A5{{~`e1AwK`NQ7yQC==53JT4D91
z*EgI7cffzOlK&m51@}*!{&2W1#@}!%{3-Zv0^l9%<MS=51^27cq)NLNu8aJJQ{kIV
z{|hb7JbVcro?lzt;$Pe8j|8yDZ#Wfx0Df(U^skuz?|Lx$J>&F815)HSoC^O3`2QaO
z#rnC6YQg;@r#~L9i~NRD;r{|ZN7jq&+iz1XxG$alM7S>U8%_m1m`&TypO*Vr|Jb7W
z{NLlj=vU8`i+9`<`P-4E7k>x*zYhLl{!b?QdgR->XgxrYfBOGt?EC}jy6f|Q+tErZ
zsYFp(i<MSdQ87YFTdL^N4wZH2GL4mWv4j9Av?QTGT3WG7HFi;%vKk#K_8TiI>sS|S
z?3XDjcIa4#nrY_H#V+fjL&r3Anador-_MWdIp=+zdvE%^e{k=8o##BC_j%6ee9n)1
z?j=wEe)zu{{$)_a`fte7`&-@ZSC_N??Roky!2h=j`rnwRKN9pDZFT!iIcNMa{NDoq
zZ2!55vgG+}cN}q6Zd>v`TYt(axG?C~<+|a|J$lS%J7vl9#-Q&`-e>(&PC+aD2Mgxo
zkAkv~n}WVKfm#2QQ!otwy9@f?LRs?s-k|SK-e>(&PQfSO&ntgC5{mikqAYoy4f=uP
zebzta6#N7H{{;1C_wR$0CC|SI`r+h#)<5MGJojARAJ*k~g)HmOy(ZPUTw~CWBp~ab
zathuE|F5F{?Dl&XWyy1I(2pkXv;HZk;GOXQyMq3AQ<gkW2L0aTebzta6!?E;;Pd%s
z_-Fh7J1I+^mx6v@@;>XIati(h{y&3%w*TBqS@QhLpx>Xo&-$mFg6FvN4PQU6pk&8~
z_fnQT*9HAp@;>XIatdAx|7W`Wynkf<-yfm*dsEPlCnW2iathuKe_ol$9$(!@S@Jv)
z^aqmnS^tz%@HzOu9Q9|9A3jW3^8C%9pGe+k{ZmfCkKxZV^{oF#DNCM9oZ(ry$>e?3
zKjjp>FzDCiey3pl_fwWUzcT0#ChxQUDW~8D_-})M_W11q%97{7pr1<KXZ=%7!TaDp
z2>)#V`7~w8^Hk7JC-1ZVDW_mA=-1`$fq!=UeUP%``DoD3B=58SDW~A)@c#h(D=;CB
z{|`}?JeRv$iqFa&O5SJvQ%=Flf_`1@lkm^>pNA<+o?jRAhm-eN|CCd(4gQDWUycc}
z{zoWFp6?3!+2noJKjjo0fd4{4|1VIMJU<llbIJRxf66KN8vKvKKRbSYnX=^hSkTWW
z@3a0Xr(g~K{|x`<VM5I3QOc6%s`LH&T}a+%{ZmfCYl41V?!Vw)i3!pF>y#zW+k$>E
zd7t%9IR&Hef0jG0_mAxM`&fkL??liqB_!*gatdbQe+m4v`FxYI<as&hk0kH2{wb&6
z7x2Ft{@Ly8+mt2G{_7cM<&Gxrv;HZkpg!o=<$k+hKHsG*d2S2(<>Y<VKjjqouW9)G
z@7oII^L@&a=dqwamb}mUr<{U^;XefbDol7;cz&F+<as&hk0<Z5{wb$m75*Q9zgr#Q
z5&fT_EPXEX%X=bupY=~U1(iX+F82}mXUFFsQI<T{2mMO&KI@-y3SJNY&%i%BKKz8T
z<oTwcUrpX;{ZmfC+u?s0{@LS`pHh}QPXztR<bBpZ<rK`q|F7Yn-M)TKS@OIb^rw>d
zS^tz%a1#DMD472*C`+D8U4UohPN(njD)xtzQ}CjoUzhtg_-FTDzoaaAeofG?CGWHK
zr<{Uq@b}j({G&2H;ri{b@GgCNXVAMvz$5FQa!&sQ{3}W#$(|pbo%m2cAM_;&&-$mF
z`X}K368LB9KR5BAzQk=HXXQ#0p7l>T^_K?yy4<z!ufT-3zRpj4sP{kSdRDG1;aUHb
zQ{Msqw-n6hg2adVyMw+w;aUHbQ$Gp+TME|y?8JxqF9dx>!n6J<r~Z5Jzq?@l&r5u$
zKOOXy3D5ecocaoPK<mf<55hmY|GhBrq27Nz_pDr1!n6J<r~b|G{}lYQ*Y_??e5k)Y
z=&KW+^-nqV55WJ+@V^ujV*j}`@uB{kLC;UI^!ioGsb7WvarkHZ=jD0+=a>6@Y7?HV
zKjrklEa=zePQgDr{=78tp?*`)*CjmbpK|Ko2LE&1br=80j{h4HpExy_yDRAH6Q1=?
zIrSfce<l30^>0jks6Q0+jS0{Cr=0q~ga1q5&u@pu^?Oy~L;cT#zA52Z|CCc-?h5w(
zpZ`=NyMFzrY1zkypl?oi)<5N(>-F&8g8E%|3XfR-YZ4#ow*~#CglGLzPW_$m?<(kj
zUE)LieL>%n@T`Bzsec&$gYeJp-(Q#bQ2*_qZ%ugCKjqZ_82<d)t=rv%N6hE?#D{u+
zf^b%@E#X=JlvDrfLBB5dp@R9mG4Y{(W6*C-c-BAV)VINZ3jVJ9g-5LaO^FZnJA!^o
z!n6J<r+y#&`QJaX{qu&zhx!MCzCGbt|CCezRroKW{_OF?jfoHS{<nnB%56<})<5Oc
zufhKZ@ON*+Bj$5c;zNC<8=&0v|Ac4#Q%?QHpkJ5!S;73bCqC4-1$}qIv;HZk{ucN@
z1^;aRI}#u2{jV3hpQ}oE)<5Oce+K@~ao0`#Bb)y%iBFuG%Y8lQ`xBn^PdW7~@UMk`
z_V{gA;zRxUZUN8A4J174pK|Ii4|+F#!auuy`Kbxjx!iR@KU~B=<(y*&{NDus3o#+~
zpW723>fammBMHyepK|Iy3xEFL(hD;FcO^d5`yXvSD>s_(tbfX>{}ue-gZi`Qzx>pP
zYIlE)>i}ov_7?F^Ip_F|pkJ5!6#U(A8Xhs9cP2j6-x&1!5}vI;<<#E+|3~2Ox>I;W
z|9cZ3>isWHpOxF6@T`BzssA(h{|)@J<NtdTAL<_s`muy({Zmf;Kf(XI1?zu*;zRvf
z(2plP>z{J!FLFCXfBf)c_`BJ|Bj$5o;zRu_gZ@Cmv;HZk-v1o6_x~0Av-_71CqC5g
z3i^qJXZ=%7{RiQHf%_c5KX{)}tpB5lPn?>|`CsvN*Z&iq^-nqV--G{4;GaEyyFc-v
z{+B_2FyUGMlvD42eK;Jy!9TlwJ&^cN|GJ=`N_f^k<<#$n|5o_pcO7y5{^`VrdjC7Y
zXXU07p7l>T^?wO}|2dL>xVPaE^M5e$0nU9t=w}k1^-nqVr{RAe{M~RA9?}1y#E1Il
zxgCVN{-5xyf6A%9Ht5&oJ`Mj%Fd_OsocK`RAM}S4p7l>T_4mU6ui>BV|Boa-)E^A`
z*@S2PQ%?P(@c#$+ySL#H>;FRHL;Z=MpG$bwKjqY)<4$;e|NI&Jv+MWEi4XOc2mO4)
zv;HZkz6Jj0LYQ5@k0w6UZx8x~glGLzPW?UbzYxOg`1bY0hx&s-znJi>f6A%<D*Rso
zVK$$~5+CZH2>PXjXZ=%7{kiUd!RP-v2(!lz-%Na{e`(MkNqE*j<<$QU{I@}v9Y4RF
z_)tF_^hXn(^-nqVABF$hA<T|%-%Wg|pAY)wglGLzPW?~e|0fXEU_$Kw-%os~uW}1`
zR_<8Bv;HZkz9s0_<-Q2v#Toy{6CdjPgZ_BJv;HZk{=M-39)#Kc|3u<L{dCZuNO;yi
z<<u|1|KA~WafL_B=SPVT^(TXVCE;2Blv7{nR;cfv&v2jP`A0UNpCmqUYA&}a=vNb-
z^-nqVZ-f73@XsE<{WS5R{;r@uneeQC%BlYt{F~sP-F|<b_)tF=^rsS@^-nqV--iG1
zz~6lw5FRoAUnD-%uLS++glGLzPW`#=fZyl;`|!{9pI;_E)Yk<4TEesbDX0Eb@ZSyp
z?D6fd5+CZ{6!g3sL$6P!ocdiskCRgeXE7n>lXB`KZ#|p)QSv*TPmcf9lF&W>0r-my
z^Do~G{yO3B1Md_5$KYea{{;Lmgnu0T+rmEy{-47C6ueRr{R{9{34a9qCgEQKzeo52
z_>}O!1^4%%+sC)TbqoF;_&R)^&Uuc5>o<G;75vSj|0($G!v7QeBf{6f=Y;=S7;w(Z
z{gd$X!OzC$R;+V9_+`Q?!CQsD5d2o*mxI4w_{+gRD?I*||9QEi!e0gbe+j=1{6bt;
zXZ^ng{%YZy!M6#2EBL#F-vs_?;XUAgBfKAcRrnD2vt(1f3*6tYY9IH2zeV_daDESm
z^LzmOW1{~s_?Lx$9Q>b!Pl1=<Je2-_2L58<4})JX{4c?G3ZDlb7yj4apA-H~aGuw*
zp1%kGZ_ytEuflOS_5T9?8^V7AzFqi};O`cG8hl##Q{aCq{M>LNd0y_P!q<VX=Z*!1
zR)F(orCI+);BOWErQml7e+l@<h1Y}63%?rtUxdE~{9NqUSkG(0Un0B>yiNF<!MT5=
z&yC>siM|v3^TK<<mxb>J{~zJEgI~-WM$qs(z^@e^{~N`5IsPkR*7-i@|4{Vzfj=nx
zBjDc<eh~bm@Xvrh=b3CVK0gG0mGIAl|DN#pZ!FHsjSBxO=>L!K$G{&I{&(O%6ut~z
z$^$f%`%mC66aFLcHwyoE@Y{sP|I~3_?tt+Bf&TvrKfBr&a9-~F!p{T$U*YB8)jUA+
zv%AOhtNq{ea=$73V(=ZpF9Uy%@Rx(n2)`2iTf$!r{&V541%IyloZmj)0Ny10E#SW|
z{B7X=eh2&L0sn;Xo#6b3x147W_`iz&9pLBl15eEGZt#~2|0D3t!aoE)B>dyx9~S;8
z@V^xP=itYLe;)iP;a>v3R1TEC2L4*%-vI9w{`cVT6aEA6hlKwS+<)$EAO8-1O89?*
zKc5%=G1LEozf$-)mw3T>xwi>l2fkPMbHP6;`~~1&7k(MI|6JETUJhQy4~Q`FO7K?*
ze>M1<gufPikMK8u^Z&uJ?YDq`QS@&Ee_VJE_*pzrhS5&&8sU4uUoZR};QsSN`*=6_
z9|`{>@I%5s1pXc2A9wsr-z%^GP1|ZN_i3m1-ydi9;qLsifuEDBJ}c_SG22%zjo;T^
zx;_H_0>x9{xi>_<QWBqk>qSvt`KGM?>(1YQ?|XGe<oj@*u?)WLmdKBx{hxz3?Towy
z`j>^b&&VyyaosafPxqZse=<Jd`h2>)z`2c1@0x<Eo?oY&`Zovty4)y^AF|gs&Q5%&
z9}aq^rT!_W{zLHpU_t-<-}iVV=+oc#;ChVtq@4cWh5v)_cOS2WN7U#49>_0(KK(tA
ztbfYsf00}7{`$#0{N3d*<DdWgA)A7pzZ#(Vq@4a;@c&2nyUV}E|Ji3#$LD*4z9Qk-
z`cqE*H2hD&KYRT@|My8A3;Oi;NwWSar~fMa%Wzzm_2;*SsLtgssPTEGzh{#5PdVqP
z4f=Jt8u)Yjj_dd0BnRrR3;ODWXZ=%7{Y~(1gg=MN=znSAL;YPrUz6~xf6A$!g#YUb
z=9B;XDqjxz+9Libr~g00|0ein`%nJwvBc#{$3yy*T;|uy`MIs(cr%x~6ceJp_3YXT
zD&sS+r~N|4ZC+2S6#WIx|4ifgmb<e4Y&ZEq2u!Yh8lMyQ6!xj*g>6i3ej1<Ad$T@o
z4Ebz2oBbQZd9FL~^K;ei**{|4d_E^PM`4_d>8)q;zj^{E<2n7wcRo#>M?OPkeEvh!
zSxt=X{v(e2{nW&t#tH4HE7rT|>_m_G9tl3_@AhQ-dCJ+$4}yMO?hf?Ba5>IRjQ;t*
z^HXxU?{DeVz^s4D>AxZ9*X0htzZw&w|Hfo{p}sxn8xx-OPdWAPgFpYR(@Qe``M)Fd
z<)BZ0M=0x`a{50B{~w_KtbhLR4#nkaJv(0aqKmtK=EeRu5T1PMIZr$Ur#S6Gx1OKv
z65WjLaR9Si>-3%<e@z5c;BD~fedX#=pz!4X?U2_`U>u;&cBfyTOUFZw!*|2y8Snqw
zw_Be{@b7$W_rsPy9DIJ6Ao?`B0mrw?<GQ+%DEUUv-=3#m4SYu)Kf5;O^VRuv=Oz=~
zix)V)-u<2r8TZ5u(4TnfqGnF>&#w*o2NJ|O7u|aFb=Eu-CvlI}8T9Gr_0+%Jaj&2G
zgQ#cExF5XY{>WE;Ek1wAald|hKX&hpk;K3M5d72qDgEz8ZhK!Jb&c@(Z}|N7rN8%X
z>yvY-_<H8cA|1fQXSojP+kNnpFL;a9*E+sFm)-}$c7HeUjfs@}*1&H_Mm_TPIPTkR
z+Z1PEyR+v-eh~W$^2bXfKaL$T`Ly$)XVSQPu@Lx^PhD{Md+g$2^5bZ?>C;g?fy&0+
zaf`2~aZBVUz!%;A)bkTvk@JY~?3YG9ac|^J(APTdbG!QPSH%hVdja~%$p<6Y2YqYM
zXQbiH?>oLem)=jpWxO}=^gb@~pSz{>b@u;8^kP1rbb8NAvDVAc?$^PWT)*%S>Q~(s
z;q~>dUs(Q6&_|lf)#Jr#sORg%$-20}4Orf1+q>eVSt#njr$-~`1;5tu^|>eTE?uW@
zaop$mz#G5VolJBuZVB9y_<98T&%NvBB|G)KMf8)7ug{%}RMK|844?jcN3O6w{}lA;
z_|N>GT^H;8#i!ndC5v;_Ileyk{=|a%*9M-B^W-Ce|0qvC4*v@lKYk>c=w3`a9@ZCf
zuE)dyx1D(2=Jvz>F%X|}gKoWgeh}B$$iE7oZP3x@o1vccbLVnQKLP#RR0N|)@SK;&
z9KNyR&T}9QPZv4v+nu~EQf_xIhW_sxem$dqwd3n^SLLmjbKQQx`|$n~)_+sb-=3$x
z-JPI${h{XAF7@vW`UjH|xm@!YKM!9YC-L~}qoK}3p1ha}{K=>OzU7NN)eO^?++W}B
z5mdx>zZ}}VFt5(<JMQ&cWqbS&_&@s6^GA|K-HWmfQD1p)q;7SD$K_bwO|rZ%gZ`N7
zzy85`u6NvTU*CD-!e`@@__quEBlqlmo8|X8zCO8YBi&v;3;$F5qMC>Me+QqYpRIhy
z`us5XJf0xt|IAm!dY(M=f>$OJ-HQ#5`+N?%Jp6<8|CZzHbJ%G*PM?GBwbyTx{JVpG
zdtUx`!+*x@AN+&<pK;vhGx3v?d*YP%_shZOy9r{u-w*l(Cohf%eR_W#^=H?|I>+2N
z>K|<PBFBBZ2XFiuFTsTA6>dhqTqD)tZKA&hKF$4+uf?a_o8j}3AHL{KK;fwc`_pk;
zw;aI4JD?wb{=Pr7`uBssqyE||%m2c0U(fO%MS2Ly9&vnq?x%^g9IyTz`Z;viVen@)
z#O1Br@F><moY3n=1@Axb%=mr)`eux8$7-_t2B-7-Lr9JKm%;zL<Et&O2v4tf-0NLg
z;lbxE;8n6-9&_i7UVj9;clzHA{VWW~|Jd>M=Kr9Tqn!t#ue>3Gy~u3=od3p>KK~MY
zuFLDUYk{Zt-O<0rjYhuC`75J;8QQ&MW8}-&PPsCh9ryjM?&bgXDM-W9n;c)C{EC>@
z#K%vNf8FKrJ?lK;&NqC!{&?I!$ae>yyCZae>GPhzugl|?pC5hpJ~vLH&k46)z5l+e
zv;336=Z$&!%sK9t>r0ot;Y&#)?#1%6qEBgc*5~^{Z<X=&lkmCsi?_ekPJM<uI`IDG
zTQ_8m6D|h7_x|JStp5CG$9DUr-);(etBkMT>iGH`26=~=+pfUV`|-%{3*7C*@F4$8
z;OUS`?*Hwx&(nWT(LV;_Q|_;v-Y-|jr@pisC_MRpZ|e2EZani3>Ps6V--`1NEMBe(
zytO{7pZ~R}Kk3@{5Bk(O{rX&bmr{A0oZIgDnQwP^CIXH#-L8Ll-t6Y{5BjtQpY(n+
z`gEY4`SGad_tbB9J9_Wa-4r=}ZVx_>Md<$0=RU`MKEM0+_RM~HD(H9Q^}|Qe?%aWB
z#VfPl3;Oibj{ZLj{KI+ep6|A2U+38S;-t2-<MYcL_w}6n#}B4ERX6F==SF?`1yRT4
zD#3a`Dg17XZ`)*iyEgbo5Bv8mj<3&sG(oI?An>2(@p07o;GeF?$QLDFcLR}MuC>?1
z_pI~Jp#SOff06D?oaAr7|Lh;%{eh$r_oAXA`joou)j#Odv_A4_Y#PIHa_%AQ2mSG~
ze^6hI{%}ghnJ2??U7xppORtLgU+}e-2cuK`TLb=;HyrP<{2IsI`CWpT+ZM-t4kzx3
zliJYI*%+^8FOHmb?hO8kP4ePy_#8m*Jc23jEuuf@_<HmITv$)PyMXNLS-B?L?ib)c
ziqU~r(wBnIdy_io^8otWCV&Abp1}Ir>c$oSApc?T`EXv&PdV=U`DEW6m&7^Z-{-jX
z<oT1=oqfRaTJT$5@|Mhg|5f0>e)Hv6vN+f8JMQ{(Ub}l8_c<Js^XvU?`|*4k7dTn}
zp9G)h<@r2<c3=3Gcin93+<ad2nSV~C^f?-Q-kIm~v%u5)`O9H;0qQx89XoxV<Hj|g
z&%gi0Q%7yP8ysJ6{x2<kemC%4iIlt-J{PP${^4Yzd-45}Sbw$KZ~F(^eY?~9d?wx+
z`2@zR`@xU2MP3=7a$j-WonPcF?-P#u`m284{5?qH(~F}2iujxkK3`6xtp8bVZLiM_
z=J5@Ir`M&aZ^U?b@|AHGF4tRv{=PgPe|_IC@3`B)`3LobL7(2APyg}2za7QyFL|pw
zYVbb({(b+T&qG1)HUd1TUv%8(Q*qlRFXc4<?6+IbryqGVoyqb40l)I0|M<Gq-~Zg$
z?o4B(c*;G`Ex-49>~pVjJuH2^7W{8-|Ko*}=5lWX|Kb1r!TT*AcHA#ly`0Cr7y38#
zU-%uX{{-|cI0UN4#AhR)Cdub((69V%6tZ9Ka|a~8-NkK@S7H79o71n)Jqp(}|7W`W
zpI_do{}{U|ndn};6#QM6T*8ku!sIsaU;Sw9GOO=&+_zinj??{v>+zk~UN*Vy-tu`j
zx7YJ?9Dajn#QCf@|Ie4}{bOkN(du`ej!yBfzfaWr?8Vw*yN80$`FY#dH{o;oktfqI
zoYj-y7k;+n&#iw+bIj+afxb+Cd!;+k@a+!&dQ`LB0~L|4Zp`vZ_?)xxJImI8gX7-k
zWKX1Pn0T$@>%*`2N5CAm2A+QYPQC&Cc}ey!_c*;@zsLJt^J3fX{opm@e~~#4dIHO}
zaA8yrW2P^LcGK^bu-)ar)6a9s%g%|*H7?`iL+B5Oq(A)9`S=|6<0yyMnJ;~Htp5|g
z_>fbik4NFZ+12YG1Mw;MThQ;>^4tFk6rOH$e0?sxuYh%a!M*V9E?yGV^cltRlA9PF
z<nMrg?l(WZAx?>ZKNS4GoY&tT33{uHuNQ;<o5=*$vjYF0{NuX2l8Np`i923gpL<=N
z{{vWGTd=-ZXHC>67W99$<9>Mu`r@RMP_#Sl`$_K~|II%oGr1Q7;6J?XQ=hkd%^7;1
zCLCw7-8W+W9&!2k2l@L#J->?3{dKd4$Dcdyeahbv-&cXpxZFLTyDS3wT#V};o1UNL
z{tVIU-G}YrLH*Z4yWh>r?cdlgrfiP0<^DV9Uz(?{aK}U5f9(@d$m_sYI=(*q_l?N8
zTyJvR=lSqGBRJBD({Bs<FQBzFhxbAMrO$5vK{C<3_^ji;-3b|27lO~%^XmMUz|;Ge
zSWn3&U*~)C^cOkq>m2{<&%DdF+Z6P-<mulE{mgskzG3x4;0NE;_A<+FaofMI|D+qA
z{DbS|k2b}2U;3=G-yJ64&u1KW*O74al;*R~Er|DNza$Fj^O)0nzWj<Te*%0Bqc-*b
z<+vMH^OkE2`&s|JJ^!G-{MxjJI3@mlzT>`K-Y<b+DEE?}fAXojfAqlztiGj)&o=0v
z-SVcdSp5k6n_m(s>$wm5d*A-Uo2-7u@%6dK&LS(vi*LZEYD)w>PIxltf0?Jh-t9;I
za`nC->e=ptZbr|KHf8xfH;#K=@AiBCLH)C?^Yz@F=YOT+UOykyx!h(v|EA-<A5MMk
zTMIzp$vb#`wH#;O2>k_jp1*4K{h{6OCx|(WL7#iUw`!A#?!{*u_x`!JN6P)qSAyOu
z<Lj>n|MdPV`X3Mc*?G(RtKjqGQzQF6(rDc(f79o4SDyYi9QQf=$<%v(V)gCdSN(4J
zBbHz4Mi*cI<mHhv|GS`n<JXQXS^X2(9*;aPtN*amd!ONZBggQa`z(CkvG&YAus(kU
z{<{8)Z?XIz!9V-6Te>X&U&p<F<4~mA-2U4?DqAAok9L{oOC9$)eEqM-(Q~8zTF2Mt
zaIohP^=}ROsIh-{!e{xp=j^xqUEo*z{`0n5J^|jec*WzEKU~EBL3jM;m#h7iQO(Zv
z75Mz_kq>{y`h3fAcOH5+8S8%%`Vai{N*uvO#Rad8{%v*fJ=gC=j&ojm`R5IeyZcr0
z`qhm^^w+;A`sdyhT{u3hV!8HWx!7)B@Okp7ryiXex9#2o{@EAYvcvKZJMQzLxE>SR
zY9b%NDAtZd9)N!2lTp}$CHX7I*PH*NT@IgzFN!|Z?zqW62I5ohiBJ#Tn5PHaaf7d?
z!d+MJ59<Fn_+Orv+eNR7`livW{u;-9|9tqXpTbBPr?-PQ^nW$&q;Ar!j<3(9n+of{
zCvb%CbmTW+yDq~~JL_z7<E*cLWMgb^I6mb*hIW6iYTf&R!qXwgy?*b8Na?c(ef$6U
zz>3vxMn1=J7R^Cx)~z4!Gk;FjrxNS2Vr%4Eu^xX6|8M-w#DmuVe7B?YJ|%MA^o-ZX
zJWsA&`BAHHaD07kSKfMgbKpNoq|EJ>z#q@k-v|F+UptIFSe*4U;1?g<`L4vwz3~0c
z*Leub!`%Kd=&droe$Ba2U+<11{Db;$JH7YeeV#LMa_%Q+_v#ZL`A?wm^lPnYAF%w{
zj(eXYAC7dQBtAC={gY2!_`$#ZywzXt`1;&C6U2PBL;nXqc-6hhMEByJpno7Qx9hRq
zkE1;<*Jt3<H!%7)*5^_1{*Qicr{zBg{)2h`{|)^&H}zo)i*xOB$6<bX{rQJ~u-)t3
zf_T1C9dN>*_gj8>w@2vya(Op6?zhv)pH6%{ndn}880QiG`nP{@JGw6DBeQ=?uw4vb
zyI?)X*2j9*+&JnV<ga{I<h3u%^0%R$kIwJ<X`B-O-UI&b7k}=DmTz#Qi(lTkO_9?7
zpwoL^_m0T-qMyz??(Xx!yEKP?4*u3TzW%SE#~|zwb1T2z`#hA)K)%6opXc|wKK4j5
z(Y<&*`2Lb#9<}^{8!vpF$6en3!TRsR_%{0DEcf3V_xioh$nu+FJ$e1-(dR{dPS(q4
z(5K&nVEvEbIDfzEU;e>*CWHQl2;E=m9}fJ2ymtRC@K5LIA2>hOv(44zAN0Q-{h60^
z$bahkpI_dVYqI(aN+Yj!{mVb7uf+B^Alu_lTs?lhT>rz($-4LRmHc+(zw;-5{5Jod
zk6*bLzTHhw)Bh6apK-x+UPi5dzS{Bix%={RxFP7RGQPeA+eMXZ7rhw&PssS+8~pFj
z^M6m^zepM=$E!~`?(08^{n`llqoJNBpBnqt8~!?($-OuVeYxxh{~NsbV^Mt!6<pNj
zm)Bi{z=Q2J2L8&tI^X2D&;PE!{}q-v&NvwK-_O%8x$|LP|8eYKnSZbA_nsed<A;Bc
zAB6uy7yWi-octX4V{e>^GvM!t>wn&7>B<PWAAjPRksrXgNB_TrPv72S|6q-N7Puwx
z^*L{d%ln1v-sz6O(#M71-+A;`TT|-tcd7V#>Tisc_nlsa<=rOBTaV+<!`LoZ|JCpx
ze|gU~>%ZCY^|_zt<$PP<_vZ2U2mWXt--qpMvmEElpxuRkd&389y9>eRjR|5uSqc0n
zdH&^28rJV0##xrI{axX>J0HyRc?0y5?~RjALNVmH?{DA!?$7@;naRBv1Hbow&ri)9
z|1|jHFYHFrajq{pzCQP0UY$2$94>e3$3NIl9uN8rdHVke{E;Yjf0@I%=!cup59#yV
z---2~zV@}rJpM%u+CAuwr~HHZTIip>`^Wzqr^LUnc6@zqV_rSK#CgH^tD}xS?eIC&
zT$>(rJBk1PvtKW*7iaZ@(LWhexm=Tudwt8tqy9*I%FPFVyfIIY72)55PvyQSp2s|=
z9ABTiF>kq^vpLPy*yozDpXI;M<?{aMyjW+s8*luB`~|`1$*1Pu{pvTzDe-TU<Lh&m
zC#W2+CNZ9mVRWNUu5X~TqjR8dLszb5gl{^!h6nqTH@$as4Bt7>ldI_tXy@+kJ^ei$
zeY^UG!~22$&f$*k!P~=|n|pTk4EA+(5Oxd<?%v*$(RJ+X9Pa83sB@rWXwT3<&#vg~
z-VXK*?b+Fr>*%<(Yp`p$b9;v`uWR?NT|HgHo(>HU7NADk-8WQNo}FOk=<4t39PDs4
z4D9aP<(8zUzw=IQs))q6xWape6Bn63f1;Vw71p`k1<DF!-a?bj++90v?&ukic~Y3C
z?AX<r7i6&Dg#0;ry9W#UcVI%nIXZeqinQbA;>7$pUFQmG->&Ca9;f8b(|PmFMGEAU
z{CT>2I4!@WbXxv=gS+<(7b!5Als{MR?*8pXBE*#ZdE7cIJPRh|&#|*-xU;)+xYKQ5
zL$?;5H&2r9;%n{LerHEle_zk8VyiGulkXFT5ZPkmn&cESPiJ>Gdy`ooh8nHgKnrLM
zHQKJ-J9qXC7m#Nsm^tF6n&0I!+~{w1TYbLTP@^5#Q%Gy5(RS?~xU+z<#YT;!{Ak<d
z2JaDB`-LW(xshG5xeHA;b9?i_;f_JKQz+1^nPTSgmS&1s=Q732gH<+|*C*pTj@;<u
z8q1SgY}9^@xr&Cj_sc?LCzv_>dMh|bc7mDXwmm(Aclvqyc6ImYI?A7D=G@u6Bg|MJ
zWSwN@@@r;Cf6-NACz-kY8nBaO<=9DPu26=ZW@gKqX6D0Mb#qGY*$HNjxB~NM$Z+U8
z`}=oybq@FVotxXU-`>|{`)HA=rY%34KhWvu+Sx7j=_Hw}d#5{YDL9jvqVu@qi_DWw
zG4l+$Lxzr>L%N@^*r*44Ztfcz?iuVD*wf!%V77wO&HUXx1r=sJ7f~3G#K9eD?T|q8
zrWKoyM-Qgu%)Fd#<~NlUXt}^tGp|3c^9KtZJOVN8=1r6NZtL3BwX?$=T6PTe<*%mU
zj=bqI|4`qqo86(IHyChhZs+#Cosycbpoq$N4Ucqm>p^0|RM)X{j}C%COK$W#277us
zhHlk^8;gzF)w;(eapzFSK%YCG$Q~TzPc(B5yF>Ku-FNINHgm!0W`5shXh0jaT=euT
zFpHfebL|;$hhRM&HxKo>y?6gmftd>^j0a9$I_~K1E0j{9$!6~KB&V1`5ry&S*%eMl
ziWE>_s+pH3D@A55G}+AUMsRoXSFG{^Q_Z|Mk1RHGp~+@$zmxYh4-Iz?>pIJuCi4yL
z?AhthTZaeTVe@cLq1g*bjLY`H-JRWCokOvP+xF~s$MAzaon5{DKtX!Y(`t?Hp02P^
zegV3-4|IxCfvMSf-Jser*nOwFvm?8ux*0Q*vU7#OwAg$y5pxdr4EJ_yAMESC8J88(
z_6kiZFjv~EO|5p`te}8H{zU^jyP0a1){ngfPm{6}%p87I6r3YFq2L@Hdj|UZcIk;-
zI-{9x=J!V%;ZjYSslTLRv8dw~ZgQkPogi~yvo0`;nIiKH-MOo)!)-ZT1A4K=mnKtX
z-cFfpcF2Baoh);^?pw6o%ru#=+i&8#3sq~Tn0a>g_Qhkzo?SQh?b6*{fvIL*4)b1B
zU|(5ivY9*W>>Wi6iYSc79fN&tH+I`jcTKKO$Dq7vW<Gz;;SRBS1_$>HxU=2PUETdX
zdUd9##`p~O?A(339}doJbtYNHZD@G+pgUBFR~w7e<p=R1D&w`i(+~GIcXaRBsfScL
z$;{=q)1Co$X=Y%+9n;CCl0VVR**D~O2JUzCvRkmlM(wTujQEQ;w|3mVJMT(W{=|ZF
z?%8$5dDF>eZode;P@FAPrkHu$BE-QE>!aiL&i=g4R$OG9d>gPTo^ZZE90tRFeD|Kg
zuAYt^gS&U;Us(0+6j6znKUvt>5iZ2;+#a@Je^M>$(AyOkisSHL=dPiF-Tsn;zZ#z(
za=t(uhIa1U)6u<qXJ_B80<+6hGcQJQ_c6i1P{$peyZi<DA$K}m;1cT7NsX&tct2db
z)A9n<m?>tS!5()dekdLy7GBXs6vm^=ZB1@y^M`wdEeZ>agRk5l;JfX)Z`Y391*(^+
zW?nbK41}4x+}OCQM^Cg0O*V7;mT&JF9O~QcPKAaC3y&oE0^^XLDZ8V9Fs^iT>FHZh
zjq&MoyKihzI3;jnjvo6K7a6DSp2Ug0r-0QNRK}}tgB`necWieTg7nzw|3huOx$kg$
zi8w?QaXq8X_~CqpcG8OqOf~c7wc(G5#G$Ch`ndiy*mK*SzQLYue}!R(zXrUcFYijO
zKcFqDGk(5*_6>A(^zXiT`yRc(lRvTOoX+45S)A<L6c~rWk&c1g{klOJYPCIGce>C0
z!eEwv`C>4Cs+rdpGEjKX0`|w-UGCyy`0&z=@BFy5F@6rZvt#$bP;Nup#<Ls3-;Lq#
z72$7V_<LpedsX;*b@<y9{$3OQHq^(bICn#wy&=xu5DgllLqoJ^h#n2mq#?R&j4m5d
zLv+~~T{cFSjnQReblDhPHb$3?(dCNhaz%8x0*ew|u81yIM3*a~%N5b(is*7hbZLw(
zjnSnsx-=q@=+YQn8ly{NbZLw(jnU=G=yGLrxiY%AyRm)JS4NjBqsx`i<;v)CWpueR
zx?B}qu8J;KMVG6h%T>|ks_1f6bh#?JToqleiY`}2m#d@8)zRhZ=yG**xjMRB9bK-D
zE>}mFtD{R(bZLq%P0^((x-><Xrs&cXU7DgxQ*>#HF779Hd<54-musTSHPPjo=yFYT
zabNZi%II=Ubh#$FG}K3%hWhB!P#=vN>Z4ObeY9$*k6sP+(X639x;4~CyM}uBCEXZ)
z?8xlN?8@xR?9A-V?9S-V4d~Df=+O-uQ6Ktr13GmBdUXT3bp!f!13GpCdUgZ4b_4o$
z13GuZ6<A($?*{bm26XTS^za6B@dotq26XZU^zsID^9J<uhDPLvp5EZPx<B(C-05!3
zh%dq?d)!~Rk2Ku1vf<tSIDpgdxGg!e!5ofoKfrUbbPDz{GQsW!+@5o|&wcddn(?#U
zv3oG=L(ORDj)rl(#KL6UE-c78xR0EA+#y+UhXR7EgFmJ0?(uh$^z7==QzchI{`51=
zAFe;-FGtoS5oMiF>Y0iuD9O6`ovk|?Jwqgg6zUNVmW#*AgJr8wkNBZcei%GR^i#6)
zq#vi`&y}5)ozEX+*v^+fcOgaA1O3%~csSs?lsin$H_4Z5Xxrd6q77~!$F`BKypEd(
zI|q8xEpVX69esE7yARS*#`HW1pA{yJZ*bZ4-08;D;D06U`*wA94foyNH|#d7zMVaT
zsg=K1AzU&UDyHq&v1eB}(#tNlT81l6`O98Z_B3wh3YSZYcVM~gD$md;pT@IL2Ywp!
zLbE(=D^Ir(<Sjyht->`D2EYObp}xy>4h{8$8x5$7H(;fo7~Z+lWR}?mI0qZeo|bYd
z{CMZgQ0nJD*|Hx;nMrP#@pq79Z|g|s^ve?OTwyEe<sn?+@yixZ^4!N~;dIlV;Zg4T
zePVH|X*ciVelyKC%2WGvV~bmv8^FVEAl>@75pWC3AI5zxMK08vR$WJBzO*vSVQbQ*
z%iNTg&93-`8`E;}j^I<U*Rg#Xenq+qH12awcOiQBjvf8(bD?nUXef6_ryCn~>>hO2
zUO2Rc!Nc8;CW~UPJs@H(wC@Vtd%FBR0Pfm>`{3Ap+?AKHzqsQ*h8s*G!(N}O9gCEA
zpV-c!o-WrHcX!;<w_`^iJ_k!9<GFp&i%6+7?T6tyBo-nadONy$d%AA5`+G0(*Y4fr
z^4KeRb;VDJm#f{eyT4?Xwvuj!=^YXIP2mEwZ=6ZF{)rCj4hY1QAF3x|r8l6t9r_-3
z#_0~BI>K&=5^Sc<$gK{ySY5rhcHF$jecmnBE<j%QHy^LkrTAr1v&e-8>;hvdJ++Hw
z^UL1m^t7!M7>3hzVec<s>pZ~lp8@P(_NEiW(IQNUYuKG2WGm#kKh|op6%;s(V59yJ
z&s|{+_gP`Ku#uQ?Azb|rchZ>V>==};C?oJ@-n{S!8fg--`}#}8LtVSVR_ZUKusk=_
ze?rbB5r03BrJrK^7X1cM;F2Qk{0!zp2`sS5*b9=zQo~Lc5w@_nK)X8qbr)-!xeCMy
zh5O$bdj^M%WFXEjvbWP6k@-*0!$z8xfjh`>2VfepU;Tw|nMvv__TiIn9ODd6t2okR
zyPn^u-AYXFicFi2yFa%(b)O}AzuR`YE6MSm3pc*Ij~?O;>HbdMfll|qxWAptgsY!1
znGMe`SbC?@t^O_?=^@+;+M^6#L%40<Ulkwjyg3{%^bFZOecGeb4-~N;{0XKj(DxGG
zGvn=R%+VL*$CpBv7pal^=!jicDRjDpR@o=RClPjMCClpyuy-8!xqVG$DLc0JxYXSZ
zJDtPvYB~$>I=wxM(~_Ynxs}d4$5F^#Ch%|kT4moYzFNH!{mHNOU3=muifL!z&eq+6
z@48gyo$fMivJU;8B%BR+m%Lq{-7xKL&u`N4m`<`Pd^Nnl!0UE3Jv#@6{aH2x3Ab0e
z0~+4Fm@a@@Q?9{e>&@RvIND~XaJhNod}`=7pX5#iwjU1g^o)71^Nx-o_i3xUR_u1G
zeS^0Rb>8kb2+m|T#FV0C-p!wgi+oCPtH1lF%iXKf(-Ceb?QoyM;U?3x<`_c$K!i`D
zlir+M#ZPCA<;bc+jmal)EYh#rB8R1>r-kjcyT4;ke>?yUpJDmwAw_(+;l`)1>d`xs
zTS(H%e0+XtdJjiB%@-0bhO2G7RwRp)Y))ZMpRNjXXS^BZd`}PO*|@Jlo4|2Fwm<pt
zn78StWoGW3Rv&X59D0`NIib7bmRvX675a6jY}<YuE3z-(nVVY?$xV@5nLb~+m4%bS
ziptw<a_ZCGB4)z$jbPn!_RQMAy|kR><;lipN0rPdjwH=-M6%k`L);ymeeo-1Zee;x
z+;_?1@i9la^f=iz<J-rm%7MvO-{<ZdxJ&nS;n*d;qd#5ienNVy0v9cAqwzC(GHhpV
z;mpc+!yoU*ppM4^XWEd99H9HG;$F&aOS^`5;dC$CgXmx2xZmuW%~YG&84eiIRqeNa
zf0If4FgRJRLLXMAK^FbyoROqoV@XW?;ex+wJ=x&019!(AeeS3yTo|K7js(KJ8GXCE
zhU15QX={GX7P!}vEoWD}&B)#|Z?+EK?isG2xSpGL@u<K+=@w7F_K}wCy384l=*>AQ
z#ztE;x+iYK;8Oac3!P<fdVx*8z;aSuXc^CN%Ba_VXp=Y6`cXUv6K-=2cTrI6wglHR
zaSv(!VB%Nf9(TcQXu$1h{Z)V>-6ULHDcV<(zMmY!r8^$C&~YzfuQ8;PeF09AZ0+g2
zLR<oKZtUyFPBgvf5^t19djZy@em#$N=|(PlPMkNGEuXU#T5mGYo9~iwu0rSGe%Hx^
zG^`9B^yeS$VL^EGWP7WtNVa1f?yzwmYu-Ifoap8*^f^-+p`SZ*(kX5G!_ds93(4?<
zBc9~i7(XBgUx1X;pm1w^kxN)CHD(}d%GH0SE`{8ZBRX3=mfN1Q;VOH$niTe%+8V#>
z<3|nIhx?##=Z?9fI2+`drlVB%#O;pVfxD^fNuY1f*Y2;QWYUa>WW_E|`y(R#ssvV9
zdI2t8os)$xcB_z|d%#^#b(bjJNm_OfTWH8hw(q28VBnK^5s2SW#4kOwBe-?WzLZ?F
zm3i%vWIDjO8S{25{9wf|g{#)5=}x!(g;239aJ|R&rl;MI<oM?Q>&g}{O!`qB_bZza
zvYWjtm(z+5Uv3F~pYeSs`RYR2MGFS&gYoTi+u(&6&v_<3<ZfV0?x#-u{MdkV;xI<v
z%AW1lyjvCV+nTJJX6dM#oN4aa#dA&9dHlV^W?}t)*Y618`4X%374cG<J*zJA-9&S6
z;<J%k{k*BmCU2mLce55cVk&T}lW77AQScT5Y)Rp=dXkLWq|KQQF%B=ZpSt>sU0`9v
z$#sKd$$05KE@RH6=~kXNy9l^<*C~15Fk+2vQT=gPx=u5n6`bKVa~k9w<#9r>5Yx>d
z|11!TYtEqj+8&B0IW)#bXS$g0$LR&Yv;ofxUGYqsNpJiMo$==QiyeNb@OS#^25^SY
z9MhWo!G^oPu5UQ(pE`Qo*@dZ;V`jX*lPnQ_ARzqo0ihlP;{&j8y~Q~4lNTB5&Ty>i
zBgKx6Hv;=WJPtqD;NQsam}GYvXFk!!!H65Fai1<1NWVTo&P?33KHqedHE}3%-6-C6
zYW7Cq5`c7Z4#lP?`-O1VAl<+)*yl!!VjG8!x#%6~-qt6>GEDMCP6N4E_RFAVY$<$k
z2N~dlZd!zf<Egwa%3tu`?e6u7eSOEEyAjHiQ{*~kx;2;%Rp8ja@a)-Jh|@hsdSsqn
z8P9f-B8$&sCFW@x;9}zgjO;au&^=uj>FV6o<%U}~4u-43;d)6ppw3%u$;Fq%H*RJ;
zU<q4lINuI;t6=`5u)MvA$=Y6z$u742@P+OA(hHoP+buS%=`)^MF*wt|>0hAhTkm4q
zUAo8QGRr3Aupbk`&)~2vKL$GLF4*r5H%+@!3wJw@zlPGW=ZcLTor8nnSA-I|Ug|YB
zk5hxbpFIi8Tbp?YQ+5#xEJ~(>#I?L5-W8ShVyvvVg!C(X1j1t7U=g;X<eQ#;f<0C&
za3LhF|Lk{A(jr{#XI!?zM-e<yFx`O*;G-+L31z?S!lm*R$}v?sZeaZ+-+D<)cSAD1
zbcGvdT<;imp9}2SwSD&<ceU$|+oVVNc4XI+-F(vS<(I-A*1Ap@K46Pq8}U13_szKM
z=dSkiZhxfd<_aeRJ-54G^5MypJuG&Sv&*Nqh7>t;N=G`gEOv#byMCrgr*P|(xx8ps
z(9;jMshi&lGq+j!l=K`iU0-hL{2ZB+{tkRf<A=+5VB&AkOXu-3;7lNe1x~=ziD3}1
z*YEAp`SqM$l;D>Z%wEt7%qQ^KPT(inyLr+^!*<Si&H4yk9;18SZ#0=^Ly`qQn8kRL
zbPKmueZL#zSM=~@p|tP&%~CE8<<HEcFdw@~JKb*Zg~N1R>-RG_#W!b8F*NMF>ql0Q
zH)h$1;Y{3}qUB$_z_&VBLAvdl;O&MWm)ZPg7<RGdd%$UYZcU!?RKMURnjXRU5_X1>
zI)~@@VPtaus5yo3(cu;eyWoBwp81>!gI5@|xX|3S`h_WQ0*#^3e^7!4ex5h?9QO-|
z{-+>cgx`a##`Nb3uK~Zv@mulRogTTLFAWd+Tn8WbGl$_pAM!2W>cbyhrB5e(_Cik|
za{QcQPJQ?*t@POopF`q9ez-_ItA_72%iD}!jP&hV-V5&AP5(PUF4qr!vGDyy?@PQN
zb&d)D3ivoUbD;i!aOx+)HJ>Tt@9T6wgB%{y;4g5`md_ZyFXeAh5C3l}b7s4Tp=X`c
z&kCo04qWS8HtpIx`TN0|=V_z&B{H8i;U`gl4!=0cI;k%aPJJ1;*2(|B%Jt4X{qIQo
zhvr!Y&fJ(!wQ#mu1I{|BuN6*x9k|xnYW!`U{J*c7XRp!QJo|+|g**qqSts)x7Eb*r
zxYp@^AJ{)M&;8(<=a|v^Qkc)UaJG8@oOMz^A)NY2aIMq-zXtzco$*~RHwUhHE*rhg
z^O*2T{2uUeaMsB@PY9=e6<q5)W&G`SeHvWzTr+x`XU_d@uz#@MvfUDJ*2z3eg;QS!
zu65QLf7?Inz%|cSqqljs34a;#+zie-ndcVa)NcjXI=hX(&9fI=^XxZzo9BRVwmS^Y
zI+^E)aOy|Fway9SZ}Xf4*F0y9-sU+cd=v8Y|99IzSSRyb5KjFPxYl{p_}e^}!8Olg
zMsM>xE}ZS20B4=db457ytKeE^DgGaTZtrE_nrE%i+dS)p|2Fch2WOqkvr#zp&EQ&R
zi}AO4wt{P(ZANeN+$@~!ZUJYV%(GoM^;^NU&Jp8p`{yXQ=E?uZ!tsasOd20w|BcA=
zAUNx!eo8p?GvHe1VdHP}oCViB=ZxOwIWL^;E`YO6=D8@G`Xz9!bH(`EJXgUr&r%%I
zYM%c8iuwn6AMz{*XPwNmLOAtR;96&m@wa)_f@_|2MsM@17tVGY!C5EsY!Xhr|6O<g
z&^p_Vzs++ixaK)x^uA8!Gb(%(dGg$WbyB|%dUEQ=z_m{Q|6lxr;}VZQC%`q&Nu#%U
z9u&@Yr@&bc^PCn={S3I)xoG@to=f1G=ZewWJXeK}A<vWGtdn`35>EXZxYk+X8!M1!
zDY)iYX7v6g^C=h3b}PVHC-s%WsjmXpI-88Y&9fO?^K3VI|C0G^6+VePw}G=x>br$g
z-w&>J4jX^Fy^nxvo})(ZUosz_uX9{tyZfMLoz(9aPW>3T);SH%?Z`D99y8#Y=c3X3
zm&|8L_(RC^2srDc{-|*3kAZ8QCyc+%a|K-UTs3<ClKJp_k$JM+Q_!<c>Q4)&ehpmf
z<ng}dS%o|_&n9rz!+e^Be+BP(yv91IZ^3kO>f6Az&Mn5@=GhLed2Tg&o98y+Y_}Vn
z^)OHWe~A2pocexnt#iNex7$0%3C(lb=zX2cXGZw9@cs~<Sr7Gxg;PHVu5~VebG>ta
zv<R+wE*ZVe^N4V^dlZ~?GS6k<)E@)aI!_yao97z1=2?ja(f(N_{Bg`*4bD25XN_>`
z>%g_nM&ob$XA`*Q*=+PS&rQPFZVNc;WS*_Usc!?<I(v=3&9fg|^W1OrwttQZ|1ab@
z4$eB6=K<l=Pl9WmQ^w!sISsCP&KSMT^N?`1dl;N`GS6Az)X#xyoy*4G=6MWU^E_?z
zHqSNT>+wG4{%?_guukS#BAog%aILcfT(|d1aLu#I=xv_W!r5*OIO}AdwZf^d1J^oR
zjla#a4P5i=HF}$8zwk?t=KwhCWS+yqsUHQ`I{p9q_7BZ-Ke*;OX7o1Cap7$D066Pp
zo)f~Up9I%BXN|wja}HedTsC@}=P}_gN1n&QSts*6A)NYEaIN!{@weOiX>iSR&FF2O
zIro1jxn4YHyCvYPlX;d3r@jna>#Q~YHqSb6&9l|$ZJuqyuR)%h!C5Es+#;O%t>9W`
zxAC`m_JV7k{YG!|91zZShrwAV^BfUQ{V2HBIbr;5o|E93=d97&Jm-XSzc>%hI+^E!
zaO#)9wa%l)-{!dtu6Z6adYk8Q;cWK=IO}AdE5fN?1=l)D-T$>@|F?OTfoq<%MsM@1
z6Mh5wXFWLUWS)(}sc#0?I$Mmt&9fC;^K3JEo9AZXY<CMd>tvqo!l~a1u62$Wf1Bqh
zxaK)w^fu2);oFhtL2%Z|Jg0<HKLf6H9yb0q&slKIbI#~(p7X-l?gBXLWS)z{sb2!u
zI#-Op&2tr8^DHe(`?JlnO!zM3Sq{!RnP-J?>Z`!D&Kl!y^Q;BeJnM|!=2<VC?KXn5
zPUhJpocd;Pt+U<u+dQ{|Yn~%UZ}S`#{&wWK7o2r6&wawF9|PAq4;X)&=LERsIcfAZ
z&x69*?i4udWS-N)sh<JYIv0(<&2tG{^IS1{o9C)<o)?`2XPwORlyK_Tz_rejb?J6t
z^DG6|Jj;yU=2<SB?N)%ZPUcxDocbzot+UDa+dP}WHP3dVw|Q<A{weg&ZQ!hvd3Fn@
zz8_rc95((o&k=CVbJXZ<o_mF}-F@J!lX>nJPW>3T);VqbZJsmWn&+a?+dP+qe;#=r
z0cV}e^Qds@kAZ8QCyc+%a|K-UTs3-|=Sksg_Y^qmWS*ymQ@;kTbym9nckCZLkBjee
zxhinYv&rafp3TC)hCDZcvrgvOBAog*aIJHT@wa)lgKM5!jo#+DO*q@_24|hjvsXCv
z{oq>Xe&cWZ=NP!=Ic@Yd&l%z0L7s=eSts*6ES&l|aIMq-pKJf%dWU^(5nS_JGJ2cm
z5#en2C^+k6p3B0iKL)OKo;LnA&oyw(v+`N#a@jnqgdfKOSA(-o=2;`0`Z{o}v(fn5
z{@Dbsc{Urp&2y7*w%Y>EI+<syaO&H@wa#ASZ}aR2*F5(dz0Gq>_|K5%I5_KMo(F_e
zKMAgNP8olj=QOzHIb-xT&qKo5?qP7&$vkI;Q$Gi;buJr!o98ib&GWR;+dS8V|B4$V
z{_#5NWS%9$sV@W9IxE0+d#?o7Jgbb}=2<PA?bd*^PUcxFoccO&t+Unm+dSLAHP2q7
zw|VvpUyti$1K_Nac@7JweiU5m+-Ll4|J)C*d5#&q&2wBh+dTlzI+^E$aOx+)wa!`N
zZ}Xf3*F2Yv-sX8s_@&76I5_KMo+pG;zY4B(o-+P6&(q+V=bF*mJag-_<3HOi0cV}e
zvs5_sW#C$8t?{>c)`4rDtwwM2Y!iM3^4tv0I+^Dd;nZ&h*E+k6zs<83T=VQVdYk8f
zaJD-P&N`Xrh;Zsh!L`l_<8Skv1lK%gjo#)tC%grD&V#c~=D8r8`Xz9!^QiH+c`k!%
zp2v*d=6PH=+dTo!I+^E+aOzjVwa(IKr~TjNSq83o)*8LdvrhO8$g>`tbu!OJ;nX*S
zYn?5|-{#p0u6ec@z0Gs8aJIVzoOLqKcHz`-1=l)9jK9ru6kPM1FnXKkr0^c(c@Ug+
zGS4aD)X#uxorjIT&2tu9^PDq!o9Dc6wz~k%I+^F9aO#)9wayjeZ}VIQ*E~y~llEtu
zXPNLJ<XH~RI+<sMaO$hTwayyjZ}Y4L*F5Wt-sV{^ob5J(vrgvOB%JzYaILf5_}e_U
zf@_{5MsM>R75<0Fb1yjSWS;wkQ$Gf-bsjMOHqQxg&2!S|ZJq~(v)w6h*2z4lg;PHR
zu5~UNf1BqLxaPTH^fu2`;r!hCBslA2o~MLUzXq;#mQ<wMh0U`RT=Oh5dYfmtaJE|k
z&N`WArEu!2z_rdM<8Sk92G=~>jo#+DRroae=QeQG$vnG-Q{NA+bq*VUo976)<~eHg
zHqX7n+3r4Y*2z5g3#WbzT<e@R{x;7UaLsek=xv@$!e^1^5pdSYJdX;e{usE{dBXVH
zJXgRq&sC$hd7c!`c29w`PUd-9IQ47bT4&{Rv)fU8=dOQ(Yo1L;Z}V&x{x#&e37mB@
z&lcg-w}ES&Ta3TWvmIRX+-meT&uzllZZ|mVWS+gksqY8ZI`<oY+ds#^HP30Iw|UM8
z|3~C`2%L2?&%?s0p99xA7mUBna}iwgTrzr_=Mmv-_b52)WS+~ysXqp;b)Gi<HqSM1
z&9m}(X@9nPRtf(P<XH{QI+<sUaO&&8wa!N4Z}V&d*F2kz-sZVUINNOjXPwNmRXFu+
z;96&|@wa*QgKM7qjo#)tCj1=Sk1`I<I+^DI;nYupYn@ZZ-{v_Du6fQFz0LEGaJG9G
zoOLqKS>e>rfoq-1#^2_73|#X(ZS*$JHQ^T_&)oB4e`cM`vqU)cW#C$81$f@|PjJn%
z%IIyL)xz0s4LIv$p0&cMuLIXQTaCZXvkhGH>@|9uXTR`QAkP7C*2z4Fg;PHYu66D+
z{<eSa2iH8ujNaxsE}ZQi0B4=db3!=vli*tCtns&b&Vg&5%SLbWJSO~F<ar#Nbu!Nr
z!l_>c*E&xbf1BrNaLseg=xv_4%Ix^hc1yrnC-W>7PJJ1;)>&)(ZJu@DnrEBQ+dMZ5
ze=G9b0?s;_XS;Cfw}ES&y~f|>*$=LH4j8@7b67ar9RX*Z%yU#Y^?Sj!&Pn5M^E?Qy
zdCnQV&2wJ(5b|6AXPwM*Q8@KSz_re0<8Sjk2CjJ?H+q}r3E^ya1)Oy<&sE{np9I%B
z%YHrW|2EHZaLu#M=xv_$!ry^B8^Kv8^K24M{U&g&v(@<9JlnuE&&@_}^V}kw?Y4un
zPUg8)IQ84Wwa!uFZ}Z#>u6a%xz0LEW@b@9lDR9=wJg0?Ie+XRboHPD5&v|gobHV6s
zo{PfS?h-ibWS&QaQ-2g(>s&SdHqVpbnrGRCX@9nPmJ8>7<Q3qolX+GOr@k6o>#Q~Y
zHqSb6&9mO<ZJv$7*=`d!>tvqI!l~Z`u61rT{x;8T;F{;C(c3)t3jZ_o&wb#mlX>nJ
zPW?Ez);VGPZJv|hn&&~Iw|PzpXS>tjtdn`p2&euKxYoI3{B52`z%|d4MsM>xCH$+%
z^E5c?WS(onsV})G_J6Ij3|x=r%fU6z3Zu7qRtjgkRp6|Xc~%Rjz6M<D++_T1o-N>-
z=Qg9ad3Fo`7V_)`XPwNmUpV!{;9BRX@wfeRFSzEp&**KQ`-QXJF>uz&JjaDoe*j$T
zJY@WBo`=CT&m%@}^E@h?-%D8rXPwORm~iS(fNPzr#^2_75?u2<W%M@B)56*A8aV4@
zo;mzrB02RX;96%jIJcv?wdHa(;F{+qqqljs2tSSf*$U2jm}i@C>bHPvom-8+&2t;L
z=GkrZHqTz+Y_}hrbu!NZ;nWX<Yn|i9-}cV~;F{+lqqlh;7QPPO519pLoy>DiIQ0wQ
zTIZ7Sw|O1`*F29Jz0Gr3INLo2&N`XrapBaT0M|NmFG!DnY@Q|HnrF4q+dON8Uxqwu
z!C5EstP@UsBe>StZ2WDWo4_^C7NfU$whCvvZQ!hvd2SX?{T6VobHMo9Jcq$G&vB!-
zc^(jc4f31-XPwM*QaJTf;9BR5@wa&%0@pkb8@<hQRyf<8181Ggb6z<03*cJkapQ0E
zJOQqG<}ObAv(2+a_#2UDDLCt7o@K(RuK?FNtBk+Rvl?9UtTB3<XRUCyTL;cMnP<Il
z>Knne&dtW(=D7u2^BgdGo9D3b?Z|TkoOLqKQQ_3@1J^pojK9ru99;7}VDvW63E^ya
z5}b81&x69Lp90r9=Z(M3a{*lQJZ|(h&lAG$K%Oh$tdn`J3a9=QxYoI5{B54O7sl;H
z^DF`P$1OI`QsHd344ic`&vN0^SAc7s^~T@k*$A$AZZ>+G=N94bL7wg4tdn_e6;6FO
zxYpTk{B52C;F{;K(c3&ngtOgIaMsB@_X?+eAGp?e(D>Utr@%GOd84;^E(m`Bc`kyp
zPUg8Jocg2STIVt2Z}U73u6dp?dYk8paJIV&&N`XrN#WF=0@pgrtJD39&9eer^Q<>|
zn`fhNe*d`%oOLqKX5rMgfNPy?#^2_-8C>(+V)Qo8cHwMyD>&<9p4)^|-wm#H?lt~4
z&wb#U=Ru>lc}@vmM*o}!XPwM*MmY6{!L`mg<8Skv2iH6ojNazCD4gvsfwNBLc|<t%
zN5Qqulg8iXc?w+fEWacd9vtVHPlfOwBhN~3)=7PpaO!Kowaz-@Z}Y4N*E}1I-sagP
zob5J)vrgu@NjUW_;9BQ4<8Slq2G>0I8olkG`-HC{&;8)6lX;E_r~UxA);VeXZJr0g
zHP0!dw|PzrXS*}ttdn^j5>EYLaIN!*@wa&%1=l=J8okZ)l<;-<9{Xu<*2z5Agi~K~
zY3%=6XBjxJ+azBX1J^t&jNay1DV*(AfwNBLSuLFU8gQ+1lkvBCwt#D%+l=1k*)5#E
zPtgm`I+<s`aO#J_wa!uFZ~Nz7aLsd{(c3)t3un7y;H;B*jti&$0Jzq9$oShl4})u-
zM~&X*xh$N&yKxMhbu!Q6!l_>Y*E&xbf1BrNaLseg=xv_47iGtPwp#+uI+<swaO%sz
zwayyjZ}Y4L*F0N{-sagV{Po!0+rU{T^V}?)`gU-wbDQzEd3J+qp1nqI^XwPSb_c*&
zC-WQ@PW=eD)_K7A+dL=0HP1svZ}U7X{08JX3(h*3=bUir7r?d7CF5`NJOZwH9yNNK
z=dy6Ndkma)GSB0}sXqa(b(Ykm{om$U3a)w97`@H2R(L=1tOIAA%(GrN^-bVf=O*KC
z^K1dvJX?+4=Gi8k?QRBVoy>EKaO&H^wa#JVZ}S`h*E|mxz0Gq%_?^ge5}b81&x69L
zp9a@D4;g=(=V5TobJpl>o^!(4?mRf_WS$Gcsb2)wI!_pXo97C+=2>!C+MjKnrNZ|k
z&oXe<$vn%2Q(p<LbygdHn`aHU=2>g>HqScYY_}eqbu!OJ;nX*QYn@w+zs<89T=N_@
zdYk8n@CoEO3eGy2=U(B|?+4d9$Bn<u^8mQ!IbrlR&q?8I_aHdyWS&#Psh<YdIv0$;
z&2tf4^E_enHqRB|GstrloOLqKlftP#4X$<OE>E`$n`a5Q=2>d=zE0*-CY<e-gR@TR
zD}+;D39fZE8h@K-6S(HN#pus<buyoJ;a^3bTftc;_1lC~-wUpF4j6x%=P<bDIb!tZ
znmk8^v)#Smtdn`}6HfhpaIJI7_}e_E!8OkXqd(W=xhVWQ$a4vtbu!N*!l_>d*E&xa
zf1BqDxaPTP^yiv9PYP$dr@&b!^E@q_`ZaK^v*N|BG56qkaeSA{Rf21tjYfa26EmMC
z;s1g>o55Kp^_zrK-wLjEZZ`fl&n@7ZXS>n+I+@Q_;cRysIP0XoTR8Q-;9BQC<8S-t
zesIlm%IIyL)58A?dCq{dPUd+?IQ6sOTIam+w|OprYo3cnZ}VId&UTN0vrguDR5<m^
z;9BP?<8Sjk4X$}s)W#mH*FP(Tm*Mx_s=!$%^Q;z5eJ!}wS#SJpo{iv|XOq#}Je!5H
z-A&-ElX<oXr@j?j>+ClEHqTyg&2z8O+y1#vcn$L056(K7=a_Kn4}fc(lg8iXc@SLl
zoHBZw=d^IPI|I%-ndc$l)E@@dI*%HEo98mP=6TBKZJwuvzZ!Y2fwNBLnR`j>=j7Cv
zf@_`S;2h^m<LtQ#aLu#Q=xv@=!r5*$IO}1aHNvT{1=l)TjK9sZ6<qV&X7o1CZs9i|
z&t7oW$vpdoQ$Gx@b&eW;+dub$Yo7az-sZVqINKcqXPwM*TsZXyz_rf9#^2^S3$A${
zHF}%pvhV@qc?_I&GSB0}sb2xtI!_vZo98KT&GWR;+dS8Vv)$ZFv)c>vED=t9DY({I
z1J3OTn^CS7T=Q%(dYfmf@Q)zRHgL^zvvBI$!L`n9#^2`I4X%0i8okZ4UpU(x0B4=d
zb67a_Bj8%+0poA`=LERsdD!S}p0mRL3VF_fvrhKUdEwMAf@_^ejK9tED7faiZ1gtI
zW5U_)ad6hjJWmLxeg$0XEO}Y%k=j2?!8Oksqqlk13g_?k)`7E5=2<VC`X+F#bCdD6
zdA5LSo~=f2^K28&b~l5wPUg8qIQ8w|TIaCwxBYVjT=P6&^fu24;ZLG}PJ**e=6O&!
z_0!;5=ON>7^E?c$dCnTW&2vsT+nonzoy>DVIQ5I*TIUJlZ}VIM*E~z=(*A7oEEQgk
z-?uFTXPwNmTsZZW;96(3@wa)_fNP$$MsM@16V7()!C5EsY!ps?6S&s7#rWGi+rc%@
zVWYQsjtGAR@*D+coy>EuaO(GiYn=y-zs++3T=SeXdYk7#;cRyboOLqKY2nn*fNPx#
z#^2_-2(Edq7`@GNRd_S<JPFP^ndd3t)USbSouw~Nw+owR8Mx+IZuB<K3gK+G5}b81
z&nn^6SA%PvO~&8m*$l3Ewi~_8bF1*1kmojV*2z4(g;U=Tu5}I@f1BqBxaK)(^fu4E
z!rAUVaMsB@_Y0?f3|#A+HvTrx8F0;W(dccSOTved=Miw$$vlq=r~VkY)_KDC+dNmm
zHP2O}w|Slv&UR0MvrguDS~&G<;96(phU|6}-?`tj0@pm7jNaziEc^o(M5j&Qtdn`R
z2&cXcT<hEd&f_|szqf;Ho?DIH=DAHc+wBHtoy@aWIQ9MDTIYV_Z~NyMxaK)!^fu3F
z;fF7XdCq{dPUd+?IQ6sOTIW2t=D7f_c`h2g&2vdO+dTr#I+^ED;nXjKYn`W!zs++E
zT=T4cMcSWjo;AYx{|RcrSts+X6Ha|2xYpTh{O$I>30(7RF?yS4t8lj42F^N}=Vsy5
zZvodj2aLbXa~NFn95;HK=K<mWenHHA0-SX+&q?9bPl0QlGsfTMc?ewdJZ$tf&spJY
zcMhC&GS7M8)GvT*oyU#8&GQ7f=9#N6+&@c%uX|S1m4dTQ=2<43`U-HZv&#6}JgdPq
z&l;n*dDaSNyLI5KlX=z)r@j$f>)dSoZJt}eHO~Q~xBYWi_+`j*1e|p;&r#vj?*rF5
z$Be(ta~xdrJYe)T&k5mdcM_a+GS7p;sh<MZI_HhQ&2s@<^E__!HqR5nuSA|J;H;B*
zt_r9A6u8!zYe=^Xn`a5Q=2>d=HqSEQY_}Yobu!Ni;nY`xYn}DR-{#o}u6b@YdYk7K
z;rzcW?cl7Fd2SU>eK)w)*>C)9o&(^T=djV+JV%7H-BEDX$vpQ8r+y!})_KtQ+dQYh
zHP3mYw|OoI??C@t1ZSPhb4fV$N5QquW5(a+c^q8xJYn=U&lTZpcNLs<GS8F3sXqm-
zb(U|;Zb$K5E>{7rdDa`f&9hPXAo6SiXPwNmSvd7A;96&!@wa(y2G=~d7`@H2T{zp_
z3eGy2=QiQgcY|x4dyT*CpZmZy&ncs~c}@%8hdgJ%Sts*6B%JzLaIJIR_}e@ez%|cB
zqqli331_=Uz*#5rJSv>}WpJ(Yl<~KDo(9)EE3QcUv(2+oIr6LmXPwNmS~>K!;96(B
z@wa(4f@_{lMsM?M7Jfh4-2~1$nP-b|>RZ9J&Tivx^XvuJJog#B&2zu-FQU#daMsB@
z$Awcr0j_l(H2yZvDR9km+URYbGs4;KA#m2oJP!+}eimHoJZk)Hp3C5x=P9GNd7c*j
z56E*3oOLqKTx0C#<kXjfYn>I~dj4Jsu6b4&z0I>)INPlOXFbfbRyg%_;96&k@wa)l
zf@_}LMsM@%6~2Nz`@vZ!^BfRP{Rp_$x!3sH{<#la^W1OrHqSBPY<C=-bu!Nb!l|DC
z*E$ayf1BqlxaPT1M88@@UwUQX@wQC({~-Tza4r|~uMkds6}T=}t?{?{*MV#P^+s>=
zZxqgUo4{Eo^KTYT{U&g&v)%aH{I`N@{v$?j`}3&q3(8~ed%;;J^V}z#`Y~{=bHe!B
zJSV|5&x1y9^PCdScBjEvC-a;UPW>Tpt#jV^+d3D(wa%lWkE!Ky%ix-S=~Zcew(F}5
zT=lg^Z`W6y@E2iy)q^t!uCGSn)Hj1`4lTyt=FkeRIkXwQU0<7pv)wJ=tdr}jT{!hy
z!L`m2<8SjE1=l<$jNaxsDg2el^B_3uWS&#Psh<JYIu9Fvo98UJ<~e8dHqUwCY<B^i
zbu!OI;nXjIYn>~`-{!dru6b5nUARA2gR8#T=xzR+gx`StTfn(o%)eDQ^_#(Ux!R4t
z&3`Mn=D*G8ZT{WD*={d5>tz1@!l@qs*E+|Hzs-LfT=SeUdYk7V;X9G%VQ|*TJZFVd
zKM$^TE*gKE=MuQ)dBo^#o=1hV-DPmr$vlq<r~Wv&*12Z<ZJxQN*l#t@DsX=sYxArY
zeh>1j0cV}evsO6u_261(lkvBCHiK)Pn~dJ(*&>|nwt}-x=Gi8k`pw{4XTR~cc@BVU
zo?}LD^Bfoc0P;Kl&N`XrgmCH)f@_`A#^2^S1Fm@<GJ2cmVc~3d7Myi5&pF}L&x327
z$Be(t^EkNXxn}e>&)hZXIPCeu$g>2Tbu!OV;nbIdYn_$G-{x5bu6b4)z0I>mINPlS
zXPwNmPB``T;96&!@wa(y2G>0Mjo#)tAp9}pISkG^ndgXb>i2?co%@Zy&2tP~^BgyN
zo96-HY<B{jbu!OM;nW`l*E;8nzs++VT=P6xM1QJ?zWkNhe#<;7g#R=0uLS3EQC}sT
z`WkRut~%py^REZj{2Ptl=HDco?KXq6PUgQ!IQ1>yT4%TM|1}rYY>X?{YkVvpHhN#@
zW$WV%BSvreextYRcMM$D@3hf-ALc(J{7STY2%I@ke^@y6bKsi8g7LTOYY|-6*OJlO
z^>suz+dT@-I=Q}<g;ReFT<bh-{B53V;F@RUtK$06<Bclezk@uh!C5EstPxIq9k|xn
zWc+QO&ET5nCZo4`wg_jtt>CPadA13selxh%*=zi5p8epO=YFHN{c}wCEy!~moOLqK
z1H!4F1lKyJjla!v23+$zWb`)A!@}9_EI8|Ao^!&fp9j}EmyN&8^BB11dD`f0o@>JI
zMV`6l*q>P^^DGfgeHpmcSplARJsDi{tTK9=XSHy)TLaEInP;tV>g&L@&Q{}Z^K1jx
zJbR7a=Gia&LF73A&N`XruyE=}!L`nP#^3hO{otDCn9<uj$Az=q1K_Nac}@tYeiB^k
zoHhP7&pB|-bJ^%^p2vhQBG2RCtdn`35KjFnxYl{f_}e^BgKM5^MsM@Xy*fMov)vMK
z*2z3eg;QS!u65QLf176=xaQev^fu2n;m45YW^mTYJhup^ek-`v*=_u7p1t6jXTQ<g
zJO_lc-C=On$vj7dQ$Gr>bxs(6o986B<~eKhHqSZXzd)Yz;H;B*E(oW730&(uYW!`U
z%ix;lF{8J69v9AbPk^&d=D8xA`c-hPv-CA-|F?OTfoq<%MsM@16JGJ`=vxoYI+<sq
zaO#`EwaymfZ}V&g*F4*d-sZVkINRL<&N`WAyKw5af@_^4#^2^S3a)uh7`@GNQuvFJ
z=Rt7R$vmfoQ$GW)bsjeUHqTjb&2!G^ZJzVO+3o^3>tvpb!l_>Z*E(0k|24>AReZ=#
z7V#<hjl%uB6kOL!jnUinQY(BA_0)lLdAVNdg;U=IuFJd0_}lf;0<P<&)#&YdX%o(N
zH-ocIu9q#ssc#3@I){zF?dK!ln&$zdw|PzozZ-c@g0oKMc~Cg@)8Ja?VdHP}oCViB
z=ZxOwIWL^;E`YO6=D8@G`Xz9!^MvuYd9HwKo+X>o{%rFs6@DM`ECXkq%(GlL^_AdS
zXSMOSdDehyp0!4A^Q;rjcI&}eC-ZC+PJI)&*15&_+dSLBHP2zAw|R~T|5M~S3eGy2
z=U(B|?+4d9$Bn<u^8mQ!IbrlR&q?8I_aHdyWS&#Psh<YdIv0$;&2tf4^E_enzE0+|
zB76~fu7a~p>Q4%%{xrDOnY%U@9(vwd0<L+M8ojTR`IHG~yXD}lllltb)K`LQoz2GI
z=D7)6^K276zwfpgT$iiAh|hrWsXi;0D?dBtH4N^T%koihU;pGeQS1Ni1NS*^aKW`>
z(tdDXzvUC)-sdk%QlCkqw>eCM>w26q+^?_iq5m8L_w{=p=5yF^tDgt=_58hAt|Q>S
zU9bN!{Evcjy^}A4>-s$g?sKrqb=>I3Ob#cC=uZ~mr@(!kc72@&*Y%jYE@mE<*R)#!
z&gE@<PSjO`b9u?DjL)qmw>t58E_~|6hrF?fPrLE4xorj4JV%V)uP=@pqrz`MJ$u2q
zT-5IqPW>3TuHOU3-`C0hHUX~N<D}91Iyr6}6wY?1z*#5t)558r0oOVgjla!v30(7B
zF?yTls_-7<c@ms;GS5@Osb2%vI!k^t_B-9)OTjhIGNZS7mJ4UQ72vFsc~%Oiz6xCH
zY%%_CGuu%sxX;t_Hlz3X<72ek7NfVk8{D`1Q?q^b7vZDE-{<hWi(-y@!MVKT`$hja
z*5jD)`@zS>hx!A;sh<Sb+zuLUmutERp8@B%^gpQQkZ`tp7@W&X{j6~6=fQoQ_nVv-
z3_oJ{QW1UxT<bh4ob4`yYn{i0Q-1<n>pW@vf6c9OzYp+_Q^v>gHKPyxq$28bE%BN4
zv)vMK*7-c>ONCQk4z6`p7;f{dD#Gi)Sr7YdJ$O<N`gxPl+vROGddpjk-saFMoXgc_
ze5`)6aO&H^HHTjDe=+jx7fzo6@uz-RIQ668zFoUt-fOts?)Deq<KWEydenJ9INO~7
z=X#-jQaJTf;F{00;kKU~D#B;Mwaz)=Y<C`9>s$~{{Svs=xeU(zCdc#RMt`^j+m?Ge
zQAEFH^nYf?nX=c$d40Q!#-|dT%lnsDFIB=>e>FIlm--sv)YpM)|EV|J_MfIAycwKz
z{up&`63%v8z*#5tt-`6_46f^Ci{ZBaY%RjKfoq-J!r5*wxYpS(ocdvKt#efTZ$&<P
zh0|xB_*1`MIQ8S;x*iW0Zr9^v5q=Py`Fs#{P6=nb)8Nd9`WfNW9|qTaW(~LNalQy&
z0M|Mfg|poyaIN!*aO#)AwaydZIu4vP`gXJZu7R`8=RX%?#OvZSIomA(XPwlS3a7pt
zT-SSr;dZ@O72(z3tmn0;vqm`Etp#VD)Yl28z7bsWY%<)g_f1833%J(VDxB@Mfoq+c
zg;U=Su61rR{2ONdc7tnw7%=)>=U|<?r(whGdKoRk_kweIZ^L@oC!F=~2j}uqKPH^|
z32<HBNyF`WnJU7k!L`mA;cWL1xYl`CIQ8@3TIZtp58-@aNjQCuh(Gm5g;ReF+_!6w
zuZ|mT*W*eNz6#EKK94$23TL~gz?l#Ar-f6WdwuL<noo)0c0HCA;pO03XN7RKTM4dp
zRtcxR&iL5#<wkHlk8TJ5e|+5mTxC_gJ@BidqG3{^qLN~wqM?$KqG6Jul46olQjubk
zQsG2OMoCJBhKh!YiiU=TN{UKFNl#v4kzrC%kx^1n(F+R;3lod-&z`fEvu6G8hR=J=
z@SVkP|IXg~o^$TKfZ@3QPak(uXNUDe=ktX|IQyYDOJ1KBv`AjPNAlWdFWmd=le|8!
zACSEIFgzTW?w`?!Pe^?|-buJ0@3iFgxMn1;J}3Fj^>N*wH}AsvXF=*{e$kxyWw`Ip
z6>;64YZ1?^O!hhVC)YO%?(>i%c|G1-$*bo}UXQE5oX1rtbu?dO&U^{n=b;qt*O79`
z>+_3>NWM<;`uw5+&UyPX*0Ir?eKx^4pUgL#Gv5ji$ED}VHgVnO9TD$@v(Kl{XO}t0
z?S`{Y=6lSU?}PjN_lxU39E|u7-1{6h=eQ$q?{n0g`Ej`SIW4aDA#-r{^E~El-kkLp
z;OvL_MRVqt;l92r;<~<T5l_8+>&Nf@dnBJ{m~-4rIQwKi%bfWfxX)XzxUO%0#0%h@
zPmWt?&T)(2-e<8n^A&J^yjR0R|7Xa3V;!9RoPl|(H)s6@IQwC~(VY2axUX-ExUO$o
z#M|NQvmJeQm~-4tIQwM2%bfWhxUX-oxUO%1#0TKs=b$;q9fEtG!{*G7!oANixUc)9
z<TuH>Pl@aN&qRC{&g0_!|C~AdoQLzcm|rkwei`n^wIZ(bzZUV-sau~1IBteH$IXO$
zpIPS2=fb_uJgKkubp>$0ud9@NxW4oGLX|nkt%kEt=4;HEuY-p^^}1OvuIt_y@g_Le
zozEAV%{guhoP9FiYR-H++~>1HT-UuT;@xoXv&Wp{_QJi-K6B;=;NIu3xIT}VhlhUj
z{(J%MkJDADqwA77E!oduT=fiisIT{#S@3XN>N%3%d_RfzJ8~tjUK+`lMe^mAe<?5N
zyTbhU@Jg%0e3d!#HE^H*T5;Vc^$~A^bD!`&zZuT`KyQ=0&S$&i)w?43?nu60@;d(m
zl2;$JJm+o5obxtpb(kM9XMPOs^E?jseLE?6eI79t$uCNNPOe8wk^GwEH%UHKmHu&&
z8SyMQ*PYjeY;(>-4xIae`CN163*bI)h2pwDiz8kF_dZL_Ic^!;`z$wSz6$PrHd=jN
zUz*HWr`hT=-(t>u8$67w*Q0iEJ->BEybI3x;q|54oa6SuIX}$znls-I_xTwR*L56<
z_%Pi295Ls(qj2wY%$)fNxc8ZRdh)mk<LZ4#9^CIk@+Gg=sY1!Cm%+ohx?U9#ua^3H
z9;<=#czM39m%N@=8zisZ9Lcvt@*R@bemW(u-eq~7KfBGdUzf~#kJVwm*PQu&xUb`Y
z_*VNZ;-hfxH_qo6+~;{x@;aYWl2@ON<mV#!CCTf2E=yj0#qylDRddeUn$=-G^^Rm6
zc)ZMK!hN2z;C@}pk-T2lawGW?$?J8kG?K5Byk6I8BKZc%>+5fg;`(@Oj(8i~_endP
z^Tz$tC3)Qs-I7=Di{$$w`C-ZHei)Iw`l#iL@VFZ@=emzu9p)#@nV*9DKA9HR$K!0o
z7vMh6i*TRk70K&-u1a1#<BTomdG$<qsIQ(Yd7aNZ$*bpEp7T~<&Uq`eI?NZDGhYJt
zd9DyYS>Bha7T0}V8}SCX&wnG_=f6erI&ZC#SMQR%&Re(S)q5qcb^0W)J|uaqGc0-a
z5zCL_aWQJn`5&`7%#WKhKLz*onik*caS`zaxUb71+}CAA@;X1Ol2^~Djyx{l|KH<6
z@;aY+l2^~SJm;;zoby&_b(k+QXTB8f^IR^j`@b^cRdCKTpTAU_bKDv@=b!mnbLJc1
z-e;q@?uX`xx4^y6R&$Qq2KPSO&6)3ld!OA>U+<H9;eMYyE_vN=6L8;GQ<4w+rv{J5
zX>;~DBXu-CYtH;UJRFxkpIQ*teX<nsRXFFL*Znm(=b4`I&dB2n?(>i>`EXpH!#w1e
z^SE-Qj^^{snJ<9*`WA}oJ}i!S8QkZg9PaZ_DS6!wRgzb)k-Q#PtvQdYPU>jB-kkYH
zxX(kgxbBBGIFFal-`mYuzXQ&BV7}9w`EI!H&mM8@r!V6DaQ4aP?*rx>cM#4#nIAG|
zegy9GHY%?BXFTE)aPM={oa0Wxz0YZL=4avF=YqJt{#<nCmdB|+e=mmn^PLKKsITi%
z74d4Rulu|f9*#@BUh-i-^L)}EdG(G+zB7{VvOJ#;cANhR=bs*{!+ftf^Zjt2{{eB`
zCqoe*g>#>99>(C@5A;dN>wHd0UVS!_pNr&|B(L+oEP3@6%X8jV%{gytR)_i2S;_w7
z@iLzY_j%5O`@YSQ{8rD?Bl!}^m&)^t(n!8i@|)!K=PGf1ywpUz7S46&{Z*Yg=b;|X
z`C-1nocU(B&s&SQ?$5S}x5K^94s(v%3HLs`%$e_nd!Hj#pVyaBbJiKN`pl1;Gd~Fr
z<Ldp=l(??rOvGp5oF86a=FB<nJe>2x{DL|2OK_i`WpQ1{)rhabz0Xw5mg_=zTyxwE
zxc8Z9&U`l9`>d4udS6`y_xtK<$?J8hR`Tl2@G!1E-diI1F3IcbW<7Au&pvx5^U`bn
zFuu>E56<~vzTcerLAdX?A#vSrBM~2kv(F0jIcCmr$KmXg`3ZC8r{KPh)8e|{W+Ofa
z_de&%Iqm}7`&=|<ei`n4u37!>W4%)E+IpX}P6nLgGM{PAd^X(IF-Kh2F)!lzaL&))
z(Px1<$1Q}jPv(ovnJ<C+{FI98I+jPg0`7fQnseMLxc6CY&U`K0`)m|{w_InN;eOq3
zll&&hcfi>{uM3^#?57LP{+aJKXTBHi`=L)<_rpNM2jT3K*M%W-jynuzpUjV#Gd~9R
zc^((n{V*BvDY*AJZO(CL;NIt~IrEEBN3R#laKB#UygPYZhvVAn`3^kvsdb9sUZ+a(
zdVQ&uym~D>jH}n3x=6l7@_OBAgL6K49ceee73cX5IOmi3PIKnF;l4k6#C3o6MZ6!*
zK6xD(Fz2{~aQ4akkU8@saNnP!;<`V_BR&E5J}1pN?iAenoHl2E7Vdq{Tm6q<y%x+_
zXVL02zhut*3f$LmRb1CGb@rCWg?a{@^D~S-GtD_}7M%0Le6~6Bxp1GKJaJvef`}Kw
zz0V?Zj#~`(K1<A*FN1rZ)#A6x^T8UpUw7&yze%n;jpF)yc$(nhxb(c#BK6gKq>i57
zh9Y%_BXuSuujjEz$*a%6!~E#^Z8nl$mb{+dR^ePnp0C!-f4OI}U-^rkxQ@(c;1@vA
zna_gz<04yJ_kV80^Wf~0=c{~kj#~g{Kg<`JGhYn%{Z=BbkBhR1m&3i!3UiKI3HLs$
z%$cu&d!Kc1-~Wx0*ZtoNXP-R3wU~3<Ryg})zRjHZ4!Ey-r?{?rcf@<(?33rWUUQDy
z2WOwm_nR|62>1CM64!MfiTEho`y4apxZ`l|bHbeYDY*B!C_XLc!!>y5=kWCx4odOx
zO}!`iOV}ss+3-+be?MCuJk<HJ)GvaE{?%)w&iCYeTPt;bBVH$U)EgxK#_+-iJ{sYn
zfAv;)=zmfA?36ls-tLw<>LZd5!>-}HH)_sx8G~~jnIAW2ehMD?)YrA9#r1J98}T_f
z_uCP<$pp=tbKC_u`(%F6ocR^F@3&QPeO#p8n~Wdw>KSnFGt->oX2HGBY;)%G;NEAE
zxL%hl;GrK~_eyx!SL#)g*XwVM<kg$tp&z|2H%IcFlGp2UH=Ogv>uisCJ=VP!&Us_L
z&z$)Ic<592;h?zg!{LaJz}Y9Sv!mu5cMQ%xnIAW2eiH8MJ0-6BZ6@NgaPM=@oa4^J
zz0U=6=9l2!=c?7`>sM>$tdn|Q@;KtS%x9Q0p9S}I%of*m%#C;+ob&VdJ(521%{guX
zoP9E1XwG~w+~=o6T-UKI;^lDfv%;L?R>Hl{Ds$#*;NEA0_&sv{YJ&THSF7YVNxmJ<
z{`vY<hdKM{gtLF<yUdyIf%|^w71#aHAMpV=`{e6agXSD}2+ls4A2w%x6z=mpCa(Ko
zBI1*9?{mtW<4(i9&lz*(7o?6}7nb0Dy~wWHavjv`P9Z$>sdb9rUZ+gz=z3K|yjtpq
z`<6ZSN&2XP^LXiXlGpd6>m{$=DEZCxbCUW^=B>CMHA@}Mx0o~E2KW8YF0T8bGvYmP
z?gt)kFWl#$U-Ejq1Cm!ClDr<*usM%wMCxdM)SUToxX;6s)YtosX}F(%W~Gkahs;It
zE0WjykTp2xllK*=_b2O5Xa5;+&NK6w=FDfq{d|=puKPbP;`wm)!~2Q?bB<dGXP?X$
znKNGk_jM^1*Zo-@@d~*2S!vF3tKi;ewK?;(aPPCh>hr#$(VTUftUmM2=FGRkeI47x
zbsak*-U;XY@V=tUoa1)GIX}$zm^0r8_xb4;*L56>_z>Lt95&~;BXI9?)SUToxc50L
z{<7Rx%)|XWuq63Sl3y0rby<!08l1<=?{7(+6FCpSdA!VLn)7&b;C{Th;<_&R5ifvy
zpM~Zew+QZi7Mn9)2KPS8rM_O@E8%{9Z<0ECpU@Gh(;2DLD|K`o`y)Oi^*3LSaGx*?
z=REMbIVyR*4vtA)eM0hjy_+=e#C^h))Y1I3IrFn{pZ_^=-6snXUxss^@OW3?J`Zb>
z*W*o{o9zFPSI>mMQXltAS>`;hY^kI3kYmn#9^B`lQ0nV_LJ{204<%AZ?-NQR`D)4Q
zeL^jq$II(}ojLojhjX5pZ!l-R2_BADU$1Bu*Ztob@isX7<aNK@oa1)D*(dXz=FE4)
zeO-FQb$|9nydUm;4w!S?LAduhWX}8u-1{82`n>K>n6u8L)n|UnocS5Juj8z^uH$^f
z7vP*9UiTNxIqnji^TYhIIrFP<pPw~xUB`_2<UA1a>X~rwGs~RgX2ZSD9CPOL;NEAk
zcu_c^;G?uY`HP<iD&V2cCb>_j6xVgBj(826$II(}tvUOzgY$TquQzAD3GT<+EUxq4
z8u2!`_t|dFaXaANXQw&yJ#g={SL*A1LO<N^6DFjN-Y3jO>dZ&#EJ$9j3rmt$UxSDK
zb=@=0OKtve&xUh8c|Fa6bKdBAlHYE<BLDjZ`I1*Jl)PRai_Gu9eMPa<(R_(H^JQ>f
zuX1tSSCtX3f%`nv!hIg<C9lWZAbIsB$?I`7oAbC@q>koW&6#h9`#f}t>wf5tcrTpu
z@HMPUpE<|vhjV_IA24Tr2=09ji|cxgMtmIZeNLEj+)23iIc3iL4BY#ih5LDUUh;ZB
zwh+m$NnY>AGCq(zPI+9szsfXcpILAo7xUTX%;&<xaq0b7p1AIlf`}Kw*(dL>ip)7~
zF`RueUt-RD8QkZ;TwM1_WyGuC-e<Kr$E|^TpS9-9*TcQfM!4^j7Rhgt>vgNR&VPHv
zJK#JnUVl5y*=HA=$HjcNIrDvRKdydpo&Ujz55c|9VRMc<0{1>g&6%Hod!Lh1U$58G
zaKB!!Nu7_#_aS7SzxCts`#2wFnX{j4IQwTl$DH|mc<5grj|JkoABrMg4Cg#=yI0b8
zi8;qDg|koQ%gmXtg!?>KiR*r-iFhsC`>ZqPxb<-Fv%#GCX1Mp+YW4YkT$?%Tv|D}V
zJItByg8Mpli|ab}M!XNs`QiI<{pK8Z0M7Yge$brxVYtuFh`6rfSj5NS-sgll$DM?G
zpHt?{&%nLUd2zk3UWSK$^nQ2+?&sl*hUD=P>g&2>MLZYI<9+3R7|!FO7f61)^`Us5
zTqt?<V#$a5y&67#&EE_!l{%U)GiSaM?(<nCuIpYC@p`z=Lj&CBp-J+3yv>qVZ<V|r
zSDQJHt6l17zQdgPZn)3Gu=o*jT^<$JeKG;(Jn;J}C(SwT6rA(J{Iogqv+&TTUKi%X
zwV#EEFT&X;zprx1oZ~LT*(dWW=FG3beLhnk-17L+eU%yUEV%cXZO(CX;NEAhIrI5&
z@3T-`=d(ECC2;o1`>0ZLj#~z2pUjt=GhYSwKC8ubK5HXh2lqbf%{guZ-1}@aXTAmQ
zeRf)XUN^hUS*P3TGv8y*d>=fF`;qOFJr@4AUtHI5FycdS&JVAf!{!`!1kU+ke$<@#
zak$UVgt)HbRK%y@-sg-t$DM_HpL6ESFTlOe)CI}hhH>@#jWgikda7Os4|VkWkc*|x
z`ah+X@Oe4@41KECN?xzyb#T9qH^IZW@5@Mf4*%OKb#_?){A0LowwZUr+u@uy<~z)p
z?}CSMbsu(%>ptv_cpseW`vvsVZ_aTC;Ovw6L38GZ;l92j;<^vVB0diHJ}1mM?j+p%
zoHA#A2JU^PE=<-mjH}P%GT{C^E*l=|=yBynyin@zus#&;--_VupI#z)y>BU%yn2=7
zL;Y>`O^&D9ybN9=bu?dV&U`)G=dE4p>*J^c?vJA`siUu7bw~1pl7C?P<e0+$4#T-m
z_<GccIr|@lbDo(WGiQDR9*$QZca!4!xSNjn44i%P^{82MjynfupUlsjGrtJ;by*VE
z{kanHRk-)LX3lX_jmcVgpBd)NXTiPC9C#R4_fIa|_fNjm(fv~p$(Ko9_fG|!$IJat
zY0mzu;5=UDtIe6Oh5P=g6W9II5b;Jh`{aITGUvF>aQ4Z3i#hXca9@{paos<i5$}R~
zpWWshw+HTh_L?)_5BEL?t^PZ3ej74ponfob{D?X8V{l)`adBP8$%s$EIX{=6&uMdx
zI|JwZFh6U~{5;&}XF*)oaVg@<aPM=)oa3&-z0Wms<}*H&oHxAB9Pz!v1qmO8;>XGP
zzX<N<hf>LJl6<+i{yc95JRGlH_p7A7dXv=A*M-`pj^3|!NFDV7siXI?LsDnGrBwZg
zlZhCGhj~_?lDwWjr{O+7^YAeLdLO$ab;9)XzI54q8261UaIQP^tLDt7a2)<P$`IGb
zQC7sW;oP6RFU>LMxVdol$$XwU^969<pM~Q3I4X{K3EcZEHRrfxaPPC+ocT()_t_%#
zb>Fta!+ucjkUDx?T@mk-`eC2&ezhOY{^^5~*Zb8W$*Ye@KGeSz=gCp?G5DC&(fqhM
z^OJC&w>k0q<h(Ht59_FpuLZb2zLunp-k&T-@|hn=9^auKy+6r@bN}#uBgdS_l?&(m
zGoNS9d;vU+tM|8s;`(?jj(7>2ee!;z)STm%!PzJC<>t&+!hOA}#C6}+M7$R6eb$+C
z+<Lh8*<j9m6Wsf3hWkEgle}K1I^gW{Y3%b(bB@~uXP?Y>n={`F_jT_R*L5F=_#m8p
z{u_M`nRDD>IQwLN#GLstxX<UfxUTzT#HZli=d?M;oq>Cwv*ygt!@bWH@zdn>qE)!>
zhm58z=K<XhS>k%%k_`{XrRVcpxS!`srH<aWR7oAZKdF{F>Mc@7?_1iW&U#C!(u<Pg
z>4Jy(R3DJMo>vFqK0l-IFwc75G9h*JzGc$<DcrYA!MVP?Z<#h{eirVJmpO5Lyevd~
z5zc+c`;aAbj=KzJpUkhAGrtD+eVD>J1lPw)X2i4L-e<Ns$IXFzpSkAD=fl0vYN@aL
zxd!h0xnAn%aWzJ~RqE?~OB<a1^S-4+@_K*LDS7p7$%p#;?w9QU9`m=sd!>%%`^=di
zfcw0SN`38TOzNmlNdD#Zf55{cH6?lVd3YFiXSpw0kUIMKU4;ANcUkJ_ebGuJpS3BO
zzc8-e7v;dYKY5>%YtDJggL8eE&o^hj5FW<W`=TOoeY}@MycEtpd7o2e&T-4(?34Kl
zbLOkyz8|W^^>I-f@jAHoS#Qp98{pn&qdD`<aPPAP?)#)&@_HTYgR@UQPW$2PhdyX|
z-WLs-v(I6x!~BRj^J8$|C*$I}PbMQi1?O?`zG&K<<Icc&yv)y<Gd~aa`Cky%eX<ns
zWw`gbV$N|_;oj$(IrAAG-ST+9OU^TS;`@XXB|h@uzJH1&uluK5d`9laD#i8wstO*C
zcdP3W+^<KiQb+HvI;Bpyk19w1T~bHAPwMFXRln5H^X-7tQ6G|gn6?*jq8~Q@7km`X
z^<sX^ocU>Z*jKNTb(w+tx-3ZkyRyE^aPF%!_f95g#r%)xa}~}$nO`$!KBGCQ=a17&
zaebU-M?444K0kv#bImz!9-MtLpKs25A>1FQMdJE6Es1z3-1{su=eXr?@3X?3`6{^g
zSq=Afua*4UWZmoG?34H54dxuT5zaoDZ!%}T1@7zKDz59^9`O!1`{aFir#Z*%g0oNN
zyUm&Jh5LN=iR-!#M0^nLeGZv(++n!)IbzQI7~K1uwE7u%Tuhm>&a~BMe#V^nIk>Om
zytuC8V#Jr=oS!1}xopmHSKyo<=2y*`Pkn65c}A~a8REK*SrN~Md!ISx95)y4edd`n
zUjX-YEQ0&vw^;IeeJqXS%O$VtQW^0oIFI)stV^{y`>%oXc$u#?XTBcp$J-#T>(UhQ
zX1Mp+V$N|};ofJPIrANG?{ie@>wU-=-0wqXC9n4bbCOqIgoknUd0E!Q$$s|zkOvQW
zeO^{9UMcri<&ioSaL(rh*1ZbOd83a>{f|ri@ksqitG|N!^H!g}5UIZuslO`uO>$jZ
zgNNhN^~$(p%Y3RA!^3>)ePb2e>r_YT)JYxP&kYf8mipoLjnA7};GBPYo8<NNgm%fR
zcS?S9ef)ldF7t!;N#><n>S(^locTVuKVJH!zV7n@xbNo?siXUOOzMPw_`1QkIs2J_
zbKaPrG-rMq9{ShU8D_-w{5co#c{m?OeBEHdoZ~LS*(dW$=FG3aeV$jvb-$%rlJyLE
z^$fW8nQ6{(v*6xmwmI{;aPKo;>g(gK5bo#CDskOELsDOlYb4@ha2{_L_W8Iu`=5aG
zc$uFvXMP6m$GZaeeV+Pw`gO^Scn+NX{}cV^nzNsLIQwV5z?}Iaxc6TS_x`IdP2YcQ
z#OvVf|KPmj>+9WdTn%vc&wQgh@~v?1zYXsFcS~OP&tSxd;Ozf=^gnFQ`5b|>f96Nc
znIDIH|5M`H=QP}pYX;6fKaD<T%{lHIoP9FCXwLjH-1}UCdq1o2(2u@vwI+G>oKI}o
zSNeKO9z4`p|G!kjCzD(uJoK+#3ip00rM|vzRW0?y_2oqDs~U68LoJ;1#(bSQ^9}GY
zZ+d-c6xZuZbHrQVT;E3Se{+u824|nlx0^HH3HSBw64!m$6Y*ZS_t|I8ar@!k=YTo$
zLvZhN#Oi+&^D}DBI%8I!`EhgRC*i)1Q{uXgGZCMIbAEn-KIhFj?gE_i!~Bvt^DA(l
zpH*>P$5iW<$DMj6-22Qj=eXH$?=#n&`FyzdS!DJ3`ckp^1^Xv`msow~OU;=thx<BK
zi0e95MZ6l$`QhtJHRc?*7S8!$zRsNa2Dr~pqqweDbHrQV-e;>h$8CdqpY7(%cf!5T
zZgG7+)i18|JQ(pIIQxH?*I)DR!bjljpZQU9=EvdQ|Ae^C^HjvA;oj$rImexad!KXW
z%rC&b&qb-P_sL6ezYeZQoh#(|@@gcX!u2+ctFIepz`cH^<n?u`tVljv^12^#Bc2E6
zJpUN$o^Q^1D}ZyJnJ+YFz8LQFTq3Ufp)BI%aPPCioa0u)z0WFh=4;^IXN$P@*%t8*
zIQ#6xd9~C0d+;te`((b`ocUh3_t`IA7;e1qF$8BnOBi?9ob^ZG?1%YLbLJ=Dp&z{;
zn-tf5I34jBIQuMkeR2S^<{Wnp&OVu+H)nnc?(?=RuIsxR@in;jnfg@HFP-CNz`f5*
zbLMm4-e;b;_E`||LOA<*FXpqzoZ}Y5*(dWQ=FFGDz0V49Jzv$sLqGbya05J?_te{@
zjy`|smO5dZx8b;Y%x{MG!g*ZG_n9+40QdboD6ac?IN~F4&i@1GXVjeIj=|X{^W)~s
zPr`lvr^I!i%tU+^?tRXgbKH5j_qkxs{1V*z%)Kmmyad;Mk{|KHh!;n^G~(qEuZ(zg
z#A_p7AMwVBH%GiR;_VUdjCgm%dn4W-@hLd>$vF1&wE1u0GjQ$`=4Z{BpNIS7Zb4ih
zcS{jphO^HX(a(xG$6bZ9Pv+Omna^n3vTybM&`fcC++{~R2kw35nseMdxc8ZF&U_)<
zA9r=)O>)25EdF`%8F9@oh-<#-(_7|8^Bv-v?-xH--v1gD*L5F(bKbbGM$K~$NctFq
zbKaOAH)nnl?)z{`T>F`c_$-`#a$n7vbKH42`(%E>ocSfVukW(B?!(oHufe^~)aA+i
z(K&7g-22QlXFeP5eddWjF6&+Z=eQ+U$3k<~FM_il=8MglFNOR1mWk{7Rz$p7T>Gzq
zv;TLa|5|hQQx9kV%r}@b-wgNpY!TOWZ;N=Rxc1)#_x`)h*-tOr`|mSnei$D5*KtR!
zehDAH=BzVr^_ibAXMPIq>pm^6>pmOt1##_v5$^N0WX^t8;687w=FDeYvE{tF)pbW)
z*F8JpdE(lCKHU2+FlRqSaPPm^ocS`i@7oG-o&TzcSHs!orPwDm<{Y;c&OVv1GiSaL
z?tM0i>pZtaycO<!wwZI>cDVQ1Va|Lv-1}S-*XwUa`<DHq*WY~cC*-<cD6Z>L0_Sn@
zdRl6JBi5x1&f{Xf+?@GJxIa#-#I>KAh}Xi|C$Fb<<{Y;k&OVuMFlW9A?(^R)uKT1l
z;%#v6v)!EIcEG*QPIKnF;ofJjxXx#P#D~Q7yfF-C|Ga*Un6sZTIQwUQ+?@F-xc5IT
zuJb$_@da`1e-ZBeFPXES6}b1mYR-J-XHuI#LjO9?*%8kZ*FN*%-e-Y1$1Q?;pT*|P
zm%)9W%f)q`D<fVbuKm}-z5hCM_R|3O{u|AiZ-IONZQ?rr9TD$@vrk?xy39FlH=KPk
z-(${vKivBq5Z8Ggiuf?x`y4UnxTA3IbIhFiNx1j9EcNyK4OZZM9j`Rm_NnYEx9op?
z9j`?EFnPVY2F~Le;r+AuQ}8-CkBj+wbLJc2;kfkm>LzjBCoK_gg|p8E^wVa}aogeS
zllcyF=DXlN|J~xcPkJNX2lqbv%{lG>-1{6fXMPy&eU4gvuFIG?>x^4{<|oXVpMv{3
zPK)b0&PIF=?(;Km&T$vuK0k}*%rC=zepbYF9oHhB`fTzz@;)=nIc_H0`^++DJ_qi7
z=85a;w3QLBj(C^2-k0`Ad_-LDS7#z#)v@I~qxI{=wN96~=KI7oUwKuezPRQG#I^o}
zxaLQ$-cn!p!&t<};oJ`|9guweg!x_tiBH10ADEvqXMP6m`(Z&``&^3nGMs&$fPPlY
zIqoW)eKNmh&V1(Qw#=J8FD??--@8=;XFrYTr_`MF%i!#X`EqmStKfcKsutJtQf<WR
z;Ow&peb$?E+y*%NWWLdy`4+gZZ>zYjZ+pZ$;NEAaImhjSd!OCr%=f{)&tdUfw@>y!
z_}@|S8^l+|^|(@<TlSB7wz%HM=E8Zr*>6a`KF|EQLlZB6^LUvrG-tjP?#J68uE*6R
zesM-JX87M0ah;zwIQzfl;N)xC&Dl=}oc%N3Y0i8%-1mQvxbFYHi1)+U=Tqo&z?|a_
z!r3SDL*~qnz<r)a#dSZ7M|=YAeNLKl+$p&CIc?7TEZqBC62DgWIh_4md|<M^Yv$V=
zmU!x#<WJ@&i;~YX;p~%jvdmd0$DDQY;Gut=&w_}Ti0k9749-5;Pq{hgtrG72SD7<k
z3-@_$6xYXHtGNFD#tv~^mtOJ9<Z(J6uJbb#@iB3opLub;4(48)tY<hb?Y}}?$E}KZ
zow$zMDz4*Bh->|+h)=`0zPvw~G5<EMgR^k1FY|Ne%rC%weOJV_&$WoBuG{+Y!uyj9
zbB>z{XP?YxnKPdY_dZL+^?s&NT-Uc*T(1iQ@G#H%b3=ph@cdnUT<YljOh$ZGT=&U5
zoa?)QbzCri8NLMPyfMFQ&ioqO=Pjpe%X)3M{@3C4;|m|T@K9g9Sn^rxkJG)9c&beD
z>NW5%t{!irc>j7Gel&~ge6~isQ(WtJ!8xC&;XL1M&iUzub3U2xGiQDf?(;b&exn@M
zjJO`xV#KqqPi7?4*L_<ouD=(hOkC?%M7%~^=dBLTdE<4Y-kkH$2<N;p-(=2wE8OR;
zO<eo$h<GQQecp)m?K0=M-Ej8Fe2+Qv{c!JdK<evxU<mH#hZ(7(-<Q53uE)C;@vIxR
z><3-1960BJ=Yd@FA<R!cob$kZfjRTVaG!@>aowN&;(A=e5g(2Cq_`gMG@QrF{WfFH
z{^#I4Ugqb`nO}nY@h*$&ajiyt4bDEf-%_7X){)L}GvMr#`Al=>bKu@*xp<qLe`>_v
zzCF*jsZ^b~9#@OF{vOLVam^1$d^F;d;<~<5aL&&Uv2Ul%w>u~~hB-Lrjrn<V=9l3<
zZyDWNuS+%RXPUE4miZfy&xW%f*2ytvom_L)DT9YTb)G9CUL&sa*(|R2pB>^_zboQ>
z;#y}B9@b0W?^uHS`yFdiN8j(ry)l{paJ(<e{w#oVKfIwR$rYNv3SI=~{4-x{&U`66
zjH~Z=l!^aU`l*O`C7gX;fPSjXIc_zaeKKET&U_u*_ieqnu47}wo8aDOvpL6YfqS2=
z=FGRlz0Xc@eVx1??)zr|?)zs%>gfKNkUBf8Z;{6^|C8e3=aq7k?UR~;^SGFw71#VS
zJRH|evLDu@ei-)!oCi`jB?EDuzXH#Ib6n;#&6&@J`~J)k*Zr9n@q9S@*%Pl96_|6}
zLOA<mzQ~;U61cB>skrXX@`zW!z0XQ>j#~xyKC8`{uZ4S`4Oai!!esp#&AHE;tUmM2
z=FGRkeI47xbsak*-U;XY+>JiF%sFm1ob$tck2&*waG#%kab3s3h!4TN&tY?pI|BDU
zN6ncZhkKusR{vr=?xxJSAEvE7^E2km&%u2i=f!m$7bCs|=lqPL&t-Fty8`F@Fu!Wf
zeCp<8|N8u7i0e9LMLZksedd^R++4W#nP<*?0o?m67hjP3*eW>tIR@vkYID}FfwLdx
zYt5Ojhx__Ai0k?`MZ6i#J}*R{E#@4z70y1HZ!>4U1Mc(IDX#0=9q}Hx_t|UCar@xj
zXTLe~gK+P2Sp0{wzH@N)!}IFA`4@40Ux2e8<`>PGUxxeou88aUu0=f6v-S0z=hX~z
zj++T*pUh{OGoJ(ZdCL{o_05lX0i5&6aSP2kZV}x3EH-Dp6z+YNS$&>Y%gwn@Dy%;9
zmFCP>!+jlV#C09(B3=*Y{P4WmV9s$H;hZ1lo6MPSf&2Wlit9SIN4x{>eRi62+%CBH
z*=^2zFWmc_5!d;gi}(VZeJ<j>w`e{BUxKqw=9kTxUxj<0YvMYe8Mkb?4ytFtz0YiO
zj++DbK6A~P&xd=TW#an&SEIPT|J5eGw><CY64&ob?}78U_<nS+Is5E`^SGGrH)nnj
z9*#?&FAs_9J{gJlD4c!r{pc}sjyn!#pUh8~Gd~6Q`JWco{V*HxIk@*ZZ_aTS;NIt=
zIrGbK?=$1pE&EpYNwK)@lL~R&CpF@_PwK_*k$u%8uFum4#V?TS^{}|+7vW*v^mXzj
zxW7)GciWcZJyYrziR->9i+Gi|z7AFc=Q{Fr?^^TWLy|t~;ao@N8_bz+hWk3Ui0gi9
zi+Go~_TK~d{(H^YPe0uIA24Tr81DT~N&WCX;K=%VhL35fqn_8B{5$*P`6S<*;}*c#
zC-a5o%ooE$pL+f&5#MT`M7$i%K6yT=Fz2|HaQ4Z3l{xb@aG%dwaorE~5pRHdpN-}m
zw+ZfjHk&iwW_5mw{oiiRe23LxzSErfZn&>kkGQT^U&Q<2oQE~^IbhCl2jQFt=7-Fg
zAA$RNjf(4fjYoU}?tM<0bKEJo_c?9O{4Cu2oR|7~zFma-`8NCZtskewn9m&Z<KVe)
z_Q`ynIr9bZ(5J3%k<~9aH0h(*oX1;Y^_ed>XTB2d^HU|R>sS-<Iyl#n<JOyV+y*%3
zhxul6=3C+3XPdarTSvsZ;Oz5s%xAYb$L)o)Pv-l~nIC|ApM&B$pTiL!g?pc4<{Wnd
z?tM<0Gd~UYKIg@CK9|LBko%uiam|<Bk?hk@U-MPsM@XG&ajjDu@kVjI?l;3ZZ+!o{
z#hmld2Issn-)_!)7u@HqTU^(-H{yfh+W#=z`yVl9KVxw3f83n;DY*APD}J`zPcB4!
zRs2@Tr@pXd-E|!^Bc284@!oh~^7Yx~>^}$2<7GbAocRK{A8(<!u2*ryOW@vTsX50j
zgL|Ll=FC^Yz0X>4ozDhw{XUr?IQu*q?{^HF7r;m0?34LXbLPk4p-;V^oDkPOry@QL
zXP+NJKQrbWcNWe*nV&OfegW?DxhSsdz8vutxc9kg&T-e^-e;;W+1GUDv*4`H`}u5h
z=5wqL^SS2C=fi!y3dD82iXvVNXP>;EFEQu1rEnfE^JV7DSHOL}D#dlZsv}+l_daXQ
zIc^=?`>Z!-z7g(ywn=^czK(Xdzc1e{b@YAtX{ocr`j+AA^E2k`XBN)>nV&OfegW?L
zVNqQ7!*aw|;GAc^PQGf+ao6DNllj!0=^q!FaG&QaaorC&5zmEtpLyo&Gav4K7ML?%
z1ou9B#r1WbK{)&2<9EpXn>=sB*$?w0=FE@5eSOEpb$urzJ_To=eEd$EbKDs?`(%FB
zocVdU&)b5yuJ2OBm*L*$iaEz!g?pcC=FDf@mF!RNvk)G})#r~zaDV<-Cw27ox<;uJ
z9`D6?{@7&B=ZVd5_RoBaIrD8+=Oyf`cJp7sJFO1$UFOX9z<s~<itB#skN6;*>-bj8
z!;m@09forrm>)A|egf|6I4Q3CZ93w!aPM=@oa4^Jz0W0c=2zg}XX=Z|KIFJO4`i6L
zP9~h=GM{D6d=A{#F;`sIF+bu3aQ4abK%qIuErPR8=8MglFNOR3l!@y)Rz$oK?tNC7
zbKGjU_gQ1kd>!2TY!yEuJmB%s8SyT0o&TPQ4~XmY${{$9m#@zco3sB>IFFb4F>~f8
z;eNbR;<_#~5nmA3{+Hn1|FSvzS%rK5Yv#;n_9qMB{g=Wy?xi>{m6@|nIh^A%Ut!LC
z6+Dcq&!?)zb=_+tUI%BNJ?OLEoZ~jY*(dXj=FB(4eSTWRb$#0+-VXOZJIpz5C*1q&
zGH1RA?tS)&>wM0LPs{5VtKv6opL*qEO<e0_+?_<ixav9Lx}WploCm({lyA=CDui<$
zm@hJCz7+2BP$sVHRT1$TaqYhj?)}%Bv!6z|_upjBd@J1hZxh#f?ud9NoPFMSV6skK
z<{Y;h&OVv%F=xIX?tKo3>pTxdd>HP1j+k@YQMmUxX3qR1-20r8`g$Kb1NZybRjH$|
zJLP{Vnb**Ncz<(r{m<}G01thtSHVL+`hI<L#5=_Gef$A&ef+M7>*F``%Sm5hTz&mH
zPh8ilAmSzB`nV{Aa~-e3`wQjf55OzoTu0`s%$cu)`#MgD>wL~fd_`R6Gkajm{OIet
zCE_}tmEt;|4dObVO%ZPs*ZJ&#`+RnqPw{;mxX)*gIr9T>pU)+6?SCcWt8n)D?l&a!
zxMuz)c<P?y-`OYg8RpDq!M)EMILGCEey%y|<XL^@^UawrgoknU{-j7;&%-4VFNL#D
z-shK@bKG(`=ZE<UbLOkyK0npsx{kFGuY-G^_2wM60q%V^nls-F_dff@_3=9v@o8~=
z{HE^R^7z%qX@108#J76fiR*tyxChSp`55+dKb-SGABfZ$kviM0w>-YSzrx3;)KQ;~
z)LE1|JFI^_$6XQ+b>>lj1@3*WifcaizR=bBf7f>X>vf(>#C6^(#C6{4Bi<45J~-!j
zCw%|*Ae{Zvhaz<r#dZHLM|=g&aZfxfIsR4i0{9x7{V<;zOumlJd^X(oe;(Y&%{M<6
z;}%$bj$3HXd<i^^tLL#&aXpWfN4x^=eO8)Zg+8m`oCo$<ZO(ih+~=oWT-UKN;!SYx
zv)P>Ew!pp5R&(Y%;NEAK)DJ%on4fHeRFBkAACP=_{BnK<&A)>A9FjVkA2w%x9PaBr
zA+GB_74d1f&*zN!Ec%><`+UxsGrt7)`CJy)bzhD68r=I#eI;24I>*g`d!L!+%;&<r
z&r<PsWMI+P|EPe6ao7JZ)r-%o@MjoTy;bUbZ~HBE+N92J#5<&p`jFJoc^irNnA8vZ
zs`ZFu>~Zr`;1h7p8}pOq%+J7m-sYsfJ}%~^j{1_+8IgI;xIgJP)Ys$9ig-4h`+@!E
znCIhobK!oxdFIR)!u@!QrT&YujwSH$d{ezf>MY9f){E=$HbuM{?#J6=ehZGb74FB|
zX3l&k+>f_MT>I>Udq4f=kD{Lexc4(?&in}6`xz5|b=c_mm=oV5>ymmP3HZLsjCdBD
z$F=?8$=7F_^L`))&f{V}*PQu6xF1)E)n}bjbKVb>S$*cq&6%%)hjI1(p;}z8BefB)
zgZuo{oAWx`0QdQ6G-tjA?(@?suKTb(;vI1Bv(ud8cEP>RZgb}Q;NIte)YtRgkknBh
zmpYHjzFm?!VViS(m(6*fup;#}ziQ5W=FpbMh3<zeaorC&5zmGDJm;D7`kN2;c`h(#
zz69>`Tq>^np*-RhaPPCyoa0u(z0YcM=Ii0!XQ#OK*&Xp7IQu*h=bv74o=^JV?34L^
zbLNNP-shOrXPt3#o=+yMKJ%02%+J8XxVqnF#dW{UM|=V9^RsBq$LSK>=V#fR`8BxD
zPwK%fj~89X%!p^f*(d8~n{(cB;Ovw6Tyy3NrH-CYiY2dJ2@l7m_g!`3dfjXgf4khb
zG>Pjxv_!lW&Us+}ZRS1L=k0LL1M?l`%=f~5z51;_>kOE`1LF=_eddSEnIDDwejXFo
z{X7xzNx09?l=;Qza~kgRGh@#DJlyAJL0s2yDdNj;_R0Dy=A5@xIQwLN&7AqnhqgSv
z^!H7biEEz~5wC=^&+)^Px>e={hb3MOXP?a1m^0r1_xWtL`mEDp&hufb)n~rVocT_;
z@3$^--ETb+?}hvP^qKSg(+~Ig88Byl81C~kBChK=7V&X7`(*tIbI#i&oP9DsWzPJZ
z)Y0?gg5=fL;NiIR{F(FcmVK+ol^5}RIFF0{6qrAIcv80z&f{Xf$ej5yxX*vJ)n}a=
zbDrO7tv>U0=FB(3eSbEI>;7zscq`oJr_G$_lXkezPlq}4-Eg0u9&ugAzKHk3*(d7{
zm~-9+;p~(7A#>(O;oj%0xb`_8@dY^hWc@|+{3DY6wghLN%rBcWzXta{Q^QHUFs{BH
zk_q?MNpj(#j=oM(Ag=c(nMwInsGq<7|D8J~kOdF@tLMN&{Xu!2)ePTe-PivwRefRt
zt>)wKQStCR>z~;PjGO-pK5716__X=9uSsCmd<Xcv`K#fJ<_E%;Bfc8(%?H2!Z($z7
zaqWgWnPF1aKj?eHv(5K`=bG;a4{M=yF5fTtywLnsc(M7z@KW=i!pqH<;Fab(<tO7-
zn-{=q&CB8S=I@0!ntu}BY<?5G)%<>VyZLwFo#ylKZu5V^d(Ct9Pi_9_H$NOcXns0;
z-24-7Na{?QUj?5wzY9KV{s4U5d;-2`J`G<s{}X)G{O|Cj+x6E?*8e?3cszV66a1+4
zH%j?A&l}7aZ<|!W!*z3=63ORc0OtFV&l7)><O{?@KiT0;+VzjZ<d4nukCuF~c*wUS
zUm|{t<jcfEei`|4@lwfGiidnXCZbCGSjpFjhdjSmsaE_r$=8dAd^yg!4dQQ>e3N*{
z4<p|!UMBfg@sQ6CC$065w&ah^^Lf1FJH$i28~IN0w@AKQJmgcjzTnpmZLWWU<niM{
zn?2;4k?#**yZ#aONx9?)6MiK>kNlAMTO~gt9_m+TCNL^~qU6WLLw+3j3Guf{eo8##
zi+4(3TD(H?v*ID&kNlkYNs?a>5Bcn!6Ic{KS@O%`A>WStiufs#UlR}cW#l(M_}4!V
z^Is|X%n*Wyzt+EM^QWmS@wZDpM?Cy>8u?uDQzf4-9{yUMmDDc~KTYyQ;^D8u$QO%O
zNxoD({55}<q<)$B>5{Jy4}a}OzEb=hlCKuu{MT0}^=rh>kbIqZ_-ixr_2Si%Zxj!I
zokzY&{GF0-5f6W@-Zkl`Rs2lJw~L3rjw9b8ewO6B#KT{Uvy=MW;x&@*6%T*yN4`(|
zU6LOV4}Z<ZebJ!!yCpv?9{$>nJbxcg*w1H6e$4XA$d8NHN`6v2{I&kI>;JR<F(v*U
z$<K&~zfL1REB;=|&x?n@mhTp-r&0^z@00wJc=+ou^2_3Nl3x`Mf6dPc)l;c8@%KwU
z1J`F>ue*`Y6hBAu+2Wf^?w-`o5kFV*dEz18jC{U$z2pnULw+9lBJuMiUm_mz)q5oU
zl!|{q^5x<oKaPBb`1z8r5)b*}J(K#?;ti6o6%YA-<m<#gDES8Qkk8Id>NkpCAo*tT
zkncdgMf^g^w~2@R3i9pZjgs#a5BY|@l770xKP34c@sOWIzE}LilJ6G}`HH=h`UB!0
zk^GQ&$d4dDEZ!vfQSp#3+$X6&CVr9RC&WX(7x_u?O_HA$5Bbczr2dTfM<qWe9`dco
z&x<!peo;K+7m;5Q|Cr=g#6!OJbxA*~;ulLkwf^_;!N>a~@)_cnNIpwE)Gyt4^OwJJ
zpC0P8NIuu{gUIKJe_Zkf;-P*no}U(qUn==x@sRICK0F5rAEBR5NIu*f(?foh&x^%d
zB_HmEG~bw?d>-yG!bhn8Ny&$6A3fBc&ENcKDqK^-N63Fl^5I-Z5BbXdlh4CBBz%PY
zWs(njn;!C`$cH^cZ<BmD7JA4RzCQUpWWq<N|7pp0h=+VH@}1(BOTJq?<g*V5Ra2=R
z@hc?XCm!-`$oGr4OMXy1<QI`2690_kN5n(Eu3-It);~tYuax|_c*sv7KOz2E$xn%g
zeA$7a`ucTVJj`K6!l_yDkmrA=W={Mn$uEe9eBMDxp+)hlCBG~l@?FTUh<{G<YvLiF
zIykA%hQodcYt8;M@t5Es--LXY_%)Kx5fAw}<a5QZm3+Q<$X696{S=5_C;1}rkRL_9
zSiDQ}rQ#u9bVyRaO#FJuSBQsvFY=Y*H%Pu(Jmj+uP3qT(e_rx+;vwILe7$&hOySd1
zqj<<KA>Sl^qvTt}L%t5L^R$ZJB>8snke@=nL;PmR^LJcuKa>@%f6@9!x8%cPAD^ar
z#Y6pJ<om>Lk^F#o$n*WgLGfE9KP(>d-FUx}?>&V+Z<G9(<x_b7Xk5Hk@{{7Belzk@
z;<rnFMm*%_ke?O5L-O<DAzypM`v0tdEQo(W@=M|&KZ*RZcsR%6)6}YX$d?v}>g)Ia
z;&)0u1Ft7>eFu@x6u(RI+2Wyo-WxZUPvwYzQSy1>A>WC7zIeD6u>V5wkY7c<Nc?We
zmxzaa<B>@}rQ%<be7ShY&mmtS{$<HmiHCgEQAz!3@d3%#iii9d@^#|(NWMWl<cmv^
z`i<iEO1@b<<ol3s5x-CJZQ>zc@usAHyLh<fa{fETLw*GLF7dBOzDGRd>yJ+A_ln;y
z`F`<`pGJN_`~k@iiHCg4F-d*C4jT4txHn+`qn2MleoXv9$xn!f`Zc9V{YmkMBtI=4
z@)O9<h(9d(Iq{G$IX0<3FFq{!Me&dyKz>R5tCC+45BbXDlKQLSUz2<aukZ5lK978c
z_}3+$B_8V6yg8|#EgtT{IRClgAwPk9p7=K;Umzax#brtTLh)}(zF0iu`;jjZe?;<S
z;vt`Xd{Vz$Jlrd?|4Q+YZ%4jL{9BT*5fAxg<ZH$MNAmUJAz%NNq@M=yM<w4R9`e)3
zH;a!+zEwQrSCDTL|6j>>h=+XL2}wVl;@_4$-yh)qnMS@x@{dWrPdwBwD^Ke8i-&u1
z&i|lz$PXbuB>uSMN5n%u@2yGwQSt9ceq21{hfhrM6XM^M{FHde=f5q<Pm71=4(xwc
zd~-i7Nq$a!J<R-q`g*jWHOViEZ!7uaUz7Kpuft=U7XA$HM}LmR*FVSG8=IYf_xwST
zI-l5}4qk?TrBoP~=jvB*{V&0Jjtb5mf``B3<(BYIn?Hh|Amgf!OP^i`mqErik9)b~
z`46G~W#V4v6bA8U$R96x{&Vmwaj#RypwxLja$IL_Q0Kxlb-pBd{&VQ(d2#ROQU;|T
zUi<W)LY=2JsB@Ku*Z&^!heVERckJQtCEibOnmRAYxcui(|C{1oXOKbs8S-zHJpVa3
zpQ8oyI-?BY&&}gTj_be;j_U_$>f9XZCx3%F&!nltdoBH^(B~hez8}|LG`#-zkpGqB
z`Om?>E63|~{>32v4EZX_^Pht^i+i2$eM$Ne@`p*D{}%jo>C@{RmZlExby*|)8R{Ic
zL7n5%)Zue>uXF4Mb>5z)&U+)rwao@~-j$|KNu*Bc26Y<J)Ok$uJhm`DM{ckWFHTeE
zsYpL}i2Hh7o~F*Bk$(Ol?scwBQ)f5H>v5Hdd!5_T)HzM^TIVer9M@2qI!%(-I^U7{
z-p}J{>Krb4t;5%df_a^vq^Wadq@SOPd!65<sk4LZ6Yb|<>C@}{Elr)TNnY#xY=eII
z{-x&kkJQ;!`t*KYh4)3Y&Q*~*+iy^3?=*GxjMRB<gX20ZO`UyZT<!DQ8`ODAnmV6~
z^s_AP^K(X;I(tZ7`?-08e(KZI`F5mExw!Xpahf`O?TfvHKf`(KHyiZxnKX4iCgZYJ
zsB_W=bv~b_PLJfZ&cWh-TwhL8=PQ!eIxmTPosl$kej<6T^9ea#ufz92HJ_5aI$tvn
z=5_c!sOImC^mCN#bFcHeG{?o)c33<78P@Azsqb}OOjGBBl4q?@=X^O{ue0m=b3FYB
z`QJtAJhwre{nOOBMe-aY)W1gD`#B~}oi531op*|Ro$$R@`Vq#xJ#t)p4L{_)&im8U
zxn9QQ7@<C2D@#`=y!WghA>SLRv(pCqC%gxvAEC}0B6Yqc?#C5g>(`G^=RwKy-+~v3
zd!6u_tbT<2YovevTkw}QsKfU=HP6><Y2nXM=adcVd_PS;Ka)Ibg*tB%_v89?nmXN*
z*E;)%d!4_esk38bes<lU4&U$8aepXz^$&}CKRNao2=l=AR#+qa8T{D|>iBcxkpF<>
zSt~f-qY38yyfsZf7e(rPT-@utD@~oxN?!Z<r)0g(hvnbG*M$D3B6SXxb@V!yr>S#l
zq|P5D>vi;Ag#A1jsWU6?b?%WdSmzlt`k~@pNAJ~`=X*WjbAE(*`}ziT=H=hQ*M$6D
z(!bW}maO-)BLBuZzl+rQiMZF<UjB`Bes4y<K-}x(%D*vxt{MFVaj$cT{2TMf*|E~A
zB<pqb9+dek*|)*MN0|R#OMS0XBV#asP^8YPWWA2wi?Gf~k`ER>LO(}KeXnz|eND)}
z){J$2A?|hj8WZaLUglwQGw5ej-0S$gPN?&J8CUCkVS_q+zfkk%NnZUzaqnlu#t!}P
zy?fROe+I9Xtk>cDh5VY3|ET2EAK0LuU)$G&I^U4I*7=-dy`R6yzlE;}bq<kzqIHHP
z>vdk1e`6iK*Tx$31<87y-E8d8&*vk@H6-qJ3e(iNTgGKiq5j+kb;{G!c}=9wSH-=b
zGt<=J_tLNz&d*^R)ZzPl{F>1J)sk2L>juYlO`3kLmAuwDQtJD0-IJ!yry_Np5cfLY
zOjGCYlGlE6Ht6TcG<EXKLai`w8RFj0)ADc39~tTA0LgltXXW2m$FGg_`=q|t`EQy!
z=Sn`*2p{3NG9~MEUcF<I<Nt>I9WtNle-igPhoq^KFL|x=w7AzPPgCcy$Z>sRgF1C-
z>Kr9`?dL1v-p^%e>ik{uT4z}L^g1`Csq^MYo!@Ry=iW4Rj+eal^Q5@<^Zhh+iX^Xf
zE|osL&M(r`*+ur7*3oN=*ZEtTI;TYX$(H(FX9ofX4*U5(kve}C=a+4MysUri-UO-h
z519u&uG_@<Wvp`qLF#NP{cD~64eFenrjFl(gj!+Toj0gcpQg?uG7s9%j5xoH$8{M2
zUl9C%WL&M&zd@bb($x87q)yugbskMq=TgaQKNpMh%XnPBB*=07L-JbZKIxNR#yZat
zq|Qx|I(l!yFJqk@@pGU$u0Qt;{}%H4`#`+TfobX-6zOMrgX1bqQ|CXD*FJwK^}U}n
z($slf<Z<!N4eGovO`U>BooA#^@8_dw>Xb-ckL!pH`e{p3=f{ycWgFDFIZd7OB6V6e
zsB?dsI=4t(k8201@AEUBrp|tn*E(Mm_d3s{sq?i+KW`WJIxA`F{7UlLkN#d$uamVi
zlgXdqakME?=aCJLs~}CCJtF&1pM!coC28vH9I5lV4f;7bO`TfF^Qgn|o+`)d{hX7g
zj=y#iYK1xlQs3)*B2At5N?!XpeS>~_($v{KQs;Xc)EP-r=L*SdKSzuEas4_?9bGQX
z2gi?%rtss<o98V!e%v9Ii-E&@20sy>=bN96&kM~j!sqyQ{8#E<2`{xgzn`ky{6TzP
zY5rY&UTyvhd|qq*0zR)df6e;wg^$MMk5~HS_vbX5pNxE~`ML0RbN(EAr#XKvz1zGW
zbvPfK|3~2cmj4la(EN|^Ve{?re&VS4LGW?&a`>eA`{2{&e7}3v{By|9o8JjvH2*q$
z+5AcPs`+o>n}6tQ{ogomFTgV~AM{t@{hDlZzQ37kel+s==2h@Q^AEs_&BM=jhL2M7
z@H1WEquf0FEJygLH0RF;R-69_`C4=SoL;^8D)Noy**MoUoAbFD_ciCU68Uz^pAYXe
z=RI_{IqwO2%^yUaesjKdGic6h@US_*hjr9E6X))6bKYA_nxBCDw0S*z)|}tVGH=e;
zlNZhTJ)_I!{NC18^H<&r!G7nuyoi1>&H3Dzzh5onL&>7IZr*OGVLT6JouBjfLWt+D
ze?d0t=4K{e7xLIr3E+Q&Bf435ZQ6F-4_g0!e(?LUgC8P};ZyWJd;zax!4H-^e$4)r
z{A0);gg-<64U)%?5x$b2M-D#@@rwTm{tl@V`sDYizRR5FuSWBK;`3|Fzf_yRP3AkH
z*SpML4Zq)<*R^k&7a;!~^FoaKWAmfobLQv5pEbV>&g0{HT?gL|<I|t0NeYDD>lZ%g
z`{DCE^S$u-0p|OoKCj!XQ;6JgmOlcYpJHB)&-wdsSf{)y>F+$tzl2S_$^1cVsLRYB
zKRv0_X@2DyiQi&=4g5>y-^T`g*!(u+`Fms7|2bzR^?zXbo8dfPG5;0#|5<(;tk;V9
z&hTw9AFQ(*oaYJpf$)7TUji>OzYKny`Bm^r^Sj{hHh%!l-&?|dxDR>%Lci|a$-K2&
zoqOOnn4gau;y&|N9;fDw$n*DpaNHL76P9m>^ZV48AA<kh@~2|oE}I{Z&;M(lfyYr6
zPU5Ve4S${a8Q5>fn!geI<1OZ;=qLP6u<*h9JimqC^`w3h>YQWF$94GKESl$ic=(+g
z>c`+XuQU%o+ZH~;&&Y=l_VcsTlF!4>K8FwbEIj-SsrsMcyf0(^B{;udiM}i5;c2T=
z2>(BGeqa4x%}>Mp{L8!=z6b7`I4<XBUvqxHJ-;V}`46EEpL^1Io;=a&@b^reW&Swo
zyw{xfVSKHF^)Er5_lfie;Czpg{z>?)R{sm|FPUEnf5@Ek$@h9#pWkoK`%OB}<G-*v
z2V=kSJrw4DfpPz0dG7xg&3}V@9q!{;XHV4spgEuSea!s7sPk#_?NH}h^DH>uQ{cEf
zkMsVN{%6$ZYn$}&v%%qmKNCUc`G@bt&`-j+|F(X94d?gNG5;4h-=C+4pE(a7{N55e
z>%RpzpmcuU_^IZ6e)@6q%Q0@d`9<*S%-;{c$-D-Bm-)@`d(F8|zGi+k^4~ST4*s0^
z)9_VuUT?O;eLm;s8_4f$&hG;+Hs|@Y)SUNA73OcpdR3c;-z675_&zH8`3Stx^5J(6
zg^w2VtKnCfm%*<$=j#JEoAdg2yZPa$({Ik}>rc#iecA@kn|NH`$Ms?-^Z!Nt-OXp<
z`<wInc$hi&&#~supbp>PV?R6Ld~~Mev)~^#e+~Rn^D_=k*5yj`Q*sjjy!i_!CH@6-
zUWe{8=l=h?`BC{voyW}oP@MR*`BRvOXUxOTRELj6^KEdv&zt`S`Tv;n_aE(q_YFAD
zFCo8=`TMaS4lv&x;~ruDI{2H-4~JKp^S!rfa~{_R%-@NAK5Tvz>R)Qk^}5oW?>XII
z{zKHc!~9r`d#`yp{OjiYo`Xlt`LiG2H@_d_&X_YlXU^BV7R~vyYJ6Xa>w7ior|>#G
z{dzdx|DoRq&$T@7Z}>hB^Sr+~+VZWabAmbF+c?d<2KlqidEa)vInPU<Ha`b-t}*A&
zu6#A(|6|Vku_w$gLH%dV`F+dJn|~Ae|CqDSeO{G3zB!)<VP73!&i9g!Fke9ZH=Cc0
z^WG`u?}wjd{vr77=C3;~>F;iH-lsii&eu7=W&Tg}`8{*4<4?^0jr_08`MqM#niu1~
z?FI8=;oD?wJ<r_dyO{s`)Fii;`D;&0{6O>H;C%i@^OFjb{E6m#@9=bUes6k>`K!?X
zx#oN?^8)j?B7c!NUl;ngIp_Z~=DhE}-kjf?e!KaVxDUU_{CoMyJUn9lH_Y?n=FRB;
zN9Oz<tY^&mv+IlIJpaF7ekJN}yGzm+A9vTlcQxmG`FZB|B7cba*WgE+KLLN6Ie%uL
z+Wc3@zu$Zw{$cY!!argDJiNo4-?MU~`A)bmzssDzli~sMhj3o|mif!@@0&l0$LG(@
zpM?Lx{Au{}=6w9WZ2n*5cX{>J>$@lR!9M2s@I%bs06)h36!=NzkKyyP%%8yL=b1l^
z&p&GZFMR%K^Xy%d<GIef7Jj?=h4A~#KLh`U`8VO;H6Mfj#Qe{2{+@L{j@ICRwfukZ
z`?%K3?>r_suAT99tg|D2zgDh!3Uv-LKM?s6^J4gk=EuSLd*3<k$?$V5UjuJ4e;@o)
z<`=@RGrtVpXMPL(LGuClx6L1d|JZyKK5sq+|Eu{g;aoS)!&8S~U9z`+9JS*2lI5Cz
z8h()ZweS*iK2JQ+oX;bw&2L4WbIk98H<>>G|CIUH;hpB=@LSD)1RpSe2L3hkKf%Y%
z{|^6=c?!RWZO%L!{%7-i_^SCqaQ^q5xQ<7{bMX87>2HC*-n;@{Y<?#EE#`IbD)SG)
z-)sI+c%%8H@Jr1<1Me`u5q^{T?eKo{yWtO+e;Yn#{v`Yd=1;?C&1;I2$I1Vh&m+HL
z{zv$>c!Qbi@;7+4`OjaU)Zf>9C%jQyWd0iXapvzRPwG^fABywByUqWNe1m!BTa!8$
zo9_W{H{Tb2gLxsm&%6YFzxfI9QS;N`Pnb8rXUs2w|K7YEzHELS{J-Wm!?Siv=7Z~a
zFMMzFufhw>zXw0s{15O7^JVy%<}bnP&38O8>2H(yr?9Wu%y&orTJwB(ulW)1d(8{+
zdk#m;Kl8SvpYND|9zJc}2mg)vSKv$LkHi0E{!@4+UjO5I{TaT8`F0gap9SVwm5Co|
zo&zs8e<S=I=5_Eo^AE#6Y~BfPHNPExwfQ~p9`i}~m&|_&A2xsYLCNtxX8tVlKQw;<
z{*3ufZ%^txYn}st(fmO8_PZxv$Mre}zMJ{U@cqr-4?n{EeE9L^m%vXmzZ(7?^E=@e
znvcLQGw;Fkvd^0Hb*C?y^Lg2T`Q3P)^^kckp2t0EeggbS^Gf*B=6oLd2lKO#Up7An
z{vY#?!gt<d>ve2}?`eJmyuh5l7xj(i$73E&Fz0>d>E>@k{(a`B!arnw2E5grzl-NH
z=KNWX8_fB$8U5x*;CSydFT%KAHNOw}Z=3V|xu?t@MSj-&3HTq)e+>V-Ie#DP%jSPV
zK5Ngd*Y_Xrz0CguKgfKy9h0v=%6va~xjBFC@^tefk$<mw8T>-?GvF=eAAx_yoZr8A
zgZbUaf5H5l@Imv(;omUl`*z<kUqJrH<}bkK%y-O8=JQ$ez2N^eFM)5DyY)Jr0_T5c
ziRa<7;jgp&N8yK>e-?g>`4{08=8wSNY5rsQx#kP-i_H0c*k$Ig-6=WFYs?RY-)4Ri
z{2udq_}9%_;g6g1{ih$B^L?gYn~$N+U(A03f64sM@E!NsdL3Ve?{2;)&NGGPyJBA*
zYtHlMTg-1mom0%ug4dWgz|S+k2)@buQut-&SHU~YZ-C!w{x|p+&H4V&kU8HU`j+{3
zQ0EErpTK`+&g<#C`5f}knJ>WqWzOr`j(cytzI<OQ$DG%-B6H^7XwKJfk2BA}>#L`j
z?+ULm-wl4A`QGqN<_EzqGd~*MX?`;N7V|UVUot-j{;>In;A7^Oz@Id~68^OLjqpF1
z-wA*1K3lKXD10yT`{4(gZ;RKTk1#KTmzY0{*ISP_=lkrZnV*U}wdU`Ff6)9q_{HWQ
zfnQ<%F?g4G8~k?j4*0$1e1GTb=6t_u-24vI`JwsU@L!n^!T)5=_px3u=j-hMF&{^r
zo$|I`_htC*=Kq23Z(fS`ISw=D`(?+P_ha2pHlIiRcbK!!_nChW`6lyO_$B5)g<od=
zLwKKgA&zUnd<Xdb=DF}k&9BGtPM9B${IogWN1ii(8|v`CAISS0e!tU-<@r8M>UCSM
z@71XDTJs~}dFFgSy3qVx=)c7LQh2%f<?t%=E8+a_9P+q64{xyi-SB4fufyBSAA?_K
z{v`YkbH4xg6?4A-_YL!9)Op<e-|!!rZ;yHYrFk~|kLG*9pEo}kzU{tSukXnicNg=I
zz;nz$0M9dj5Bym3b1-g&`DyUe%rAnUW!?xs*PO32Tw%V9{MF`*@Egqk0Kd<?3a=**
zn-{{rW6sx~e{6mv@^j|L!Jjoh8UCXAsqmfm+j<>a;k%mieNz5+HTihyLjFL@-wZ#}
z{7(1@=J&%-H~%gCUFLk>|2*@jkiW?M=kP1c|8Z<`{MVSjjQp+Uw;hw@ziiI;ZHLX<
z-jL+~*Ze`$`GNT(@L!lu!WYbc3V+`Gckut3ufSiGpY+9b{0}_We23B`ccA&J;YXV9
z0YAY!A6{i%41bULvG5Db%i))pSHauO&xT)b{>H;on?LR_uSfnq^AE#E%v<1(o43J#
zWPTO=8S~G>7tQa0zhM4l__q6}Hh*v(AA)C_KLX#^{Bd}Z`S;+*ng0Y{Y5olS-R6IQ
zH<&*Mzu5c*c)K~j&*291-SPPCGd~1=zxgR}{`YS=Z@hng!t&=KKVyCy{P*Txf-jrD
z8t;ex*ZfiBv+%wX`<a06ZT>Wz|2<yj7vN=<@5JN!B=ZcsUw)?fF7R{BbKp(pdGJq~
z7r;Mfeki=h{8;$i<|n`(GUxX_JZXL*^3Ry_`|6)H--P^&=9j~_KVa*}7r#&9wdS`W
zzn^(OyvV!;>vF95`{5^>e-M6_`N!cOG=CSyZ8oohx0$p5>&#C;{T}oCQ0H#*A^1b)
z{JxM!&A)~Gr1_tZPUijR=G&p4-<$6O|C{;V@HO*;;5!v;y}tapj6KW`L;k(yzeArN
zFz5MXllfyf-cOnH`(Um%pF#d6^9A@_=7$s|$8*2=57Fl%=D&bHX+DYiKR0Ln-<b1w
z|7rdl>TG-9*7ID3aSt}<^U$NrPei`T{4{v8c@4bN{2cgg<_++B&GT?P-!yMR{=4QE
z!>7&peEHAjdmV&%;h)<izi)xhM_z6INz~ul{0jKN=KMbYa`R5)tIThO*P0K&FE;1*
zbzg4&b>y!#e*}J~`Qh;U%wNF%88QFIQOUeLZhm4(;y*I4f<I$k2VXQlAO3=QGkn{F
zx8BdK@LkQXgy)&x1V6-_kE5f__s9Ia&3tFnsWyM8IO*?v^XD*c7n%PH^ZY6EZSZ|s
zpEG|IyvO_~_}%7b!yhs~7yhXEN8yv^pN9Y3{IDaF<Ndw)k?_Bnm%-P}Pl4}Qxb^y;
z4lgi&7yL-`bKxhLUjXNSub%gB7s20S`H#adF#k0C67#Fz?dDzZ>&<)McbMM=zt8+W
z_=x$#@W;&`f&a*S0{)Eo)9^*}U&CK8{}X(>L$+S8=ivF~FTxKqPvLP<X1)XbRP$_j
zt@%Fi3(OCIx0oLRztX%6-fey&{4Vp)!XGrh7XAbC9{4ZJzW`q_{}TLp^M~Lsn|}ko
z%b{DZ%Xi@WnEw=hi1{DjW#&aV51eBD8hEYwLGbg<cZY8>uZDlpob|6YKNa~~%#VfN
zZT>;{uz4Q#=cDFVB0p*VGOkZQH-8n*Yri+&1O7Mj*TdJ$4~6f9*RgoMItsprc^Uiw
zb6&TK%`1^V-kd+De5yHrj_+)9{v2O}Ij?^oGw09uU2fitey%fbh4-32i|gz?=6{EO
z&HTVOCXa{5%nyf8nI8lHrTJUo|7U(W{2%5k@D!dOa2-?FZ@ZXh!S^=LfuCaD`r72U
z&M?2`HHp8^{6_eN=C{EwG5;F;3iC(d*O|}2Z!@2Rf7yHi{;>IuIIc&{`F+*jH~$_U
zk3Tb?g8$b1=kULn^FH-O^FJWJ-C<jwSD%CLX8t^UKl7L1hno*z9*#EW^N|zH??V1P
z=0Api(wx7q;41U)Ab*qj6YwvZ^LhGr%wI<SY4g9r|7Onj8UJn0p96h0UMJ?`<t5bF
z&wK>?q|iJIUShr%yxg4ozsmd#$k&>`3Ep7-7I?Ecf6k%Jyc+pV^RwYS=I6ru%{$;j
z=GVhV&G~Z<6Xsv$xJPWg&p!gc%lr!Xz2+_OubK0FwJ*-oT;FfuaZzag6zaUm{HO2}
z&Hn*E!#rcR<ap}Lv*8~y-v@rFc`d%5=CkG>#rw70=4<df%`eYS`nlh{5B`Yx0DQvy
zLHJM1zX9jZg>#<A;D53F^YB&km*CsKF}3-Fb@=|rYt47T>+JiP9{?{hFNGg#{#N+O
z<}G-=_$>45;PvKrz%Met7yc>p5%}lKU;F>Kx(o2Au67N>!QI`ZK#}5J9Ev-|-JRm@
zQrw|Xw79#rxVuBq;!xb3B0rn`em`rTT<4q~?mYQs&DuMYWRjWD{ZYTc@5$%FAIn$6
zU&*(_Kg*B8Bj|psOYr#ed+=29H}Kr@P+0<xV-a}_cv*Qecx8D;cvE>k_#Sy__-T0!
z_`mXI@KCyau%FBAJd7wGguaw~0^A-yG6!B${VMn%`8N1i`4RX``6c)&`D6H_=>G9|
z2frc@sh`8_`kt5D&%x&QcaZVW+t=$<@Z`FE%L-2?F9^>pFAL8luL&<MZw4O_%)h>!
z;P!n^fB3q1em@$1QEops+djOMFG3$ox7+sfvGvjA_VclMQu%SrNhkjYo>QJ*_Y2yb
z<yuckxc$9cRk%G5q1_K^bL=?&|9;Rf`<Uj-|1OQ;?@w>c$sN=8;q*|xPlmTqKM!t?
z?^+EXq<$NGhWs$x9^Z8yzEu5f_y+k4cnLk8Cs=m>df5Jymq&rumM4NYk*9<IBF_!)
zEH4fpA+G|TCT|2^DsK<pF7FFJDjx-ZEuRMePrd{mCbqv{f5KzP_rVj%&%nQz-+<?k
zKZO^Se}cD`N6Zm;96QV7!w1My!^g;Tz-!0x=l%q5B(DT-Ew2ynEdK?*K;8?UKCXYc
z!{K@4zr(A`7r?v9*TH+qcfkkBPr%2>ufYG1KZI|VzlT4Shs_yyyn^ZWEjB!kJOw<X
zJPW+6ydb=;yd1o{yf%E8ye0fMc{liM`C#}0`4sp}-QLcDmzOVsH;}J@cb2b%50&qS
zr`7G@akxDX?IrkX&A9_#FMk2wDgO*VCy$mZ@VM`hCx9o>I=_S8QJ)cRkC(Q;FSFb8
zNSad|{ePNM9&Yz1)Pg@#-v(}vbM6ec=VR;-x93M41-Iu%odPeT_0NY_lCOqWlV{Bx
zxX)wcdEmq3_IFjbZ}xpcBlLM<`Ey&rt?vrA^JgIZFJ0~!_*wZhxIONAA>4l7x*h&h
za}L8_%Fn@L>Uuqa?^XW>ZkHS4$H0Bwsy+&Qr#u1Nj#m@-BlWG}*X6z8p|$>B;cwNC
zgMXGUf@jd2Rq(j-E%1c$1MrmcGjKcZ*WhW?zky$qe}?}pkB}#D|1Zju!|TTOyL50n
zKXbwD@gv3H<us=p-1=tlQgQstZ3~~MIX&TN)enLHD4zmPBA)~QUGrDMm&&)m*UAsV
z56I8LFUfDhpU9uW-^f40?Qz%P^9CNrFuGoG;4$TC;P&|QZ163*+yd|u@>1~I@~ZIZ
zy4<?(zVepvQF418AiG_iEFXa0Zciq{lg9P;Wd?ku<}86nR=*J*Pksy@QvNsmz2;wr
zZ;;=EZ<D`*?~@117kGT_@!pZ(_teLOKbNP4Uy)~rpO+Vc7t{4E4R0*32VW&`0lzJ8
z4?iI94ZkQK2EQ(!3O_1e1<xDL-^cCnmhwaJ<MLDRZSq_2J@SWeyI<uk+<t!)K7Zix
zy{$QE;B^!ET^4wq_`Vl_w~&{Cca_(G50p2B&z5(DFO&C!|0y2@-zA?4KO|oWKPO)Y
zzb@Yie<(i&e=ENPx98El3lEdP-_KX@81mo+0*_a6c@%gic|y27{x%KVp1(H-yoBZy
zfmfARfH#uYfwz&jgm;s7g%6Yuf{&4pgTF}V@5@YhIGwjk;icq31q1hUjE+}j_-A>Q
zLV^7wU2a|YRIRfWe2%;ue5w3bxIM0TJba7#Kj3@h%i#8S<G<klsNV;_AwLbzuIqaZ
zo>%?|UR3@cJd-?1;lTa8tIJIQe<=SR{#2d~Zm+XY6dt6@tpK;bFKPgPqxr4jDK)1P
zJiNRIJchg<JfVCD{HA;iyo`Jrypen%yn}o#ysvyae5Cv^e46|m+#VNw6aJ_AC-4jM
zpdx|C-5&290e(t-Z1^sDMR*>4Ue|!z-~Ts(Cs5xWo=V;uo>p$p4`<&WW|GfD|3JPF
z-dVm5-d}Fd8)x%J$&aC*Ccgx?$1~rBZ&d#ZzDpkbr@-T4k7teozovc&ynRyt<Hy27
zB=&s<JfeIFJhprz{5$y`cxL%YcwYGx_;&dN`06D7I^V)K%R?3Q-*3mISyKPsP2n3g
zzb(9|ycgX5PJ0-<qWVej2J*S^_VQKmLGrEeiSk46dGa^#McRj;VuAZ`P<<r$-}3nI
z+w$+>ujJX_p>(;0;IZW8;ECk5;A!N|;o0S#;f3S_;P!awG4LAdr^8#z7sKsw(Hr2y
z)$fK+kw1Xf)p__5zE^#);(^EOq&xw<g65=v+t0a~;TJR~Km3loH2jskIy|&4w+TF^
zyaPPBye~Yfd?Y-ld<wj{d?`G?d<%TId?);t{2<)^p6zeAy?()UxV_%NBlup;e+M5B
zEa>Z7=o0>a?RM#y`pEEu^0e?+$^4Jc2u~}|3Adj^OTwEa_vciCm(ZMg@bdE3@S5`O
z@J8~%@YeDP@XqpC@V@fp@DcJ&@ZaS7;j`pt;H%`<;XCAy;YZ~E!7s|gmh|`4j_*Tx
zEcknQa(Fl$myGau^1Sd&@{;ge@~ZG6a(f<ATW1w{7xeb{?SAlR>W9OV%O}F^d4p%d
z$ElwS50k>*$K`OlecJ@zqB;BF`{ifg_Wan_;r6)b$8ft}Jyxl}<7<zbO$5KD%S{9S
z?K}VDv%_b}3&B^)%fkPX*MRSlH-R6Qw})Ss_lCcakAV-A{|<kk>pLI*O1=i(L36gl
zd&<wj8_2K0KWP3VcqH}j;R)qoN(UZCd;ED!cpml1;P&|Q3~+n=c?q~Z9=H<R9zR<T
z{+-VM*6_^o!SF-!(ePaIsc?Jz^8&cdUjtvSIose{<cHz2<@Wltb~}?-eieOD`2%=4
z`5Smud5AKB$FZI~D!iFI8GM2~4ZN*9BfOhDJA8<|Iy`zxe|`1fo8`^mZRH)|z2$x3
z!{sC3W95_KcKbOOZhz0V5<W?DuELkg@5ATFU%_{W@b@81*}&uVQhh{tp;Ues6K=l;
zOa;%XJ|o=z-XIU$9#>u*o=9^l!&Av?!)@Q1!);DycsI@I4R0nN2DjIh{ta%gE4KjN
zT62n)58P*a9m#U=e&73DE%-2bbND!UXZY`OdwqEOeE&l}2K_?$bhtg9c`^K?`VH`l
z@;&hF@+0t7^7HVG^80Z6yZl%18|uSU2;Ap?<uT#*`0DTA@6~652TSeG%?A%BF9jd3
z$A?sdPmwo<&z84`FP8U#uab{|Z<hZK-zlFDFO<>0UTferGWot8K1F^6K39GLZjbB#
z7rt5j3-~^HP{qLGct#!<K0wzi89kW)@fqNeb-ePxW64Xv<IAhSlgb;yx5?YW56XMN
zpUH>8!=~}qKM5X3J{NA!|F#Nl&wH~Ko<egD!Se<8FZUcgyZT%3Jo0DoqVi90yZw()
zDe(AqOy~bQF5I4vE+u@l`YiCN@&fQ#@-pyhI)7@w8_Ao(TgyAbyU5?dtLpd$`#JFX
zrj<vA+w(Fcfag}98g9>Lk{w=FeO>r^c~iLk-lqe+w)#GByMJa9yqWqr@B#7_@FDWe
z@a6JT@LuwZ@K*AF;hp3k;kKSol>?89&4~uLIjQ0EH9r%4q&zQtqPzrrn!GLiw!9ns
zr2JR-b@_DoIr$y<YkA2kf%}kFpTFDSE%bS`A6`cN8F*#+b$D(0V|ZivfABW)uvG)s
z*+m`;-dCO+K17}oK3bj^K2=^4eq3G^ZqHBA2!2(4JNR9BZ}=1WaCnxq{`H>>FDRb}
zuOwd$A1&Vox93MV0Z*Xgei@!$ejnaM{sC^!s}QbQ;BmCa^(2Pd>lmhj+wD&lxc%L1
zez?6pW+}KmuB{q;uJ*qde4l&}e5rgaJX}csdQOLLQNIGdLjET_g^t%w_&fE-;K9^i
zf`^gch1>I<yn@G4AG~_t@k%650JrBKNdd2+J~O<jyea&Xye)jPycc|td>DMad=h+@
zd@lUBd=>nHd@J0ZujCN?f%<dsSMn}30{7FNXQU6@J}-vD2k86TNpSo5cM&|fJ|CCE
ztIF5IZT^0EG4+*d2Cl!jzW=ESx7V$13b)5Ebbznb{66qa^5O8E@=5T6@;UI6@)dBq
z|9KPKp2uV#{GR5Vg4^?$T!DX7e;*$D2Y(-5!(+*V*9zR{6!OUMrt+lln)1|edtStB
zaC_eSf^d7ji!yM#AHF)=?$>Gzx9?Yb!i#C01K}CuW8k^u)8O{=%R+cT^=skwIEA3v
zf%}|C=W{rCE6s@wx95NP4&GaRCiqZ!KKSqQQt<imYVfu4#_(<O_V6R}KJc^h5%8GW
zhu`5T<n!V7cW7(i_Wad*;r92yN8$Fm@E71Ww9aSnkm>#7_YrQ-FB73o;PJKRmx%+n
z&!g|)KWKg)cy@VlcwTvBcyW1sxb0hOxc&WJH@H1+Xb`-)=8uK9mrsY=*Ox_b`~2Mj
z@2ffI;r8?6Ex0{D&L{X^niIQj;Bh%8PY%B>&knce8!8BYqVuFQ{GPlT{5#FB53eI{
z1+Ogc0JrB4>JDG1zCYadZ4})0Z3=v*<}8H|ldpmwmj4OgDc=LP`@Jv2!|L<>HavsA
zzkLROt@$D91s>mj<^AB<bwA`VxZPhg32r|Z%!OamI#<E%^J^<SjV|{PJcIln_&LqL
z1MjZy$KJvZst-{=a3Ab?#e>`Wlfmz4&iC+F^7QcFT7On}WO;6Qe0eE&W!>*u32wK~
zb>X(pE#Y=M)&*WdmpcGnRz4bT$7?FQlKKVkYVtMkI`VDsM)E`OU*u=uv*kD7E9H;j
zTjlTJ`{bb;1buz8-`AXyM~B<j<;3tS>eIp>%X7d#$_vBo>s>jxeSNG6x7Q133Qwu?
zrw_c0d^p^G9-jf9sCCYR50Ec|_mLlh$JXVZf!jL&f!le07oJITUcz(9gBk`N$Aa>R
z@SI8gE(d&s`U3E}@-pyex*e_oZ>+v4ysf+=yqmlqe1LpE+@7!MI6SMa*Clw0VE*;J
z10NjR_ZRT@y4=rjyPb*9$p1L|e6ib^IPjp%e)k>R_AMjap0_IxJc8yFhewnD438tP
z2e;!Mym8?Aud9y$uPl!XuOm+hZ!6CN?;|e?KP@i{A0w{;pDJ$xUm$M}UnTDi-zFah
z-!G5fByfM)XVr0pmy&0K|18f3uOlx7x944|17EDZAv{Yqe?2YXAJun(+v6z)z(Z=z
zM0j%f47fdi;9|JlFM1SiuQz%D{{P?4!tHtZU&8JA+k=`09+x;;XGC}+d0}|i9RA0b
zhX1a<I(&}234E!%1AK$LFMO|jB>cF13jC6M0o<N<X)WBIcWDPacy|B#9)(AiUxdez
z-+?ESzl1lJ2Wu91Tn5P_!^g=Jz-P)+!`I2P!}rSz!!O9o!{5q_HV<6qeeLrOcrEn@
z;OXVZ;CbX{;N|2m;hp78S_H1=j=Ue-o<C?b{F2V+t?-ZX1MrvfG%W)!*Ipkd5BzaX
zzbgj6Ew2F&m)q|f!tM5<KRluO;qct@Iq=Hz<?zV*`u-QZy!ylN|G!=pytVr4aC^R$
z$8dXIl@D-x9+pt80{6L(=0}Iy<G$0vSE$bjx7W8S0*~{fe|cr#QROw@c3e8bFR1Sc
zzayUjzb~H)e=1)Ix5sa8hTHu=`{A!O=QRAI{3<+n9)BMm!o$fw!0q*0!?q4QUNO|i
zgvXU9h1=`iria_#+vJ1W^PZH1SJM0{@M`h~aQl0<HgNlUwn^|Dnllq_bC$qu&SrRO
z&DjS}AwLB#Ex!csApaNMNd6AKS01cQ;PJA*3ylP~`)v}#W9RihJ}tbqJS#k^ydXTO
zye!=AZ>a@et-dkb=C_C2{66ryq5btQhTqowweaWit?&=>{qS)4{P`#01q=Fq2_9Gd
zU3e1tE4ba>2LHvMXFpG+P#*=JNuCg%U!DeDN}dDWR9*z$MP30uP+kW<LEaK>w_{!5
z^VAQ4Z<J4lAC}L9UzD$g-;r;FKbIedf0Unx+w+XvhG)p{AEy`a**brMwGBLu+vHK;
zeKjW$e55=be1beTe2%<0e3`ro+&;e=!R_;_J=~r*q%Zt{=8uBs*Y%wSKdyc;+-_$!
z!dqz0UU*yiY4};qzYf1Fe*zz;IUnIu<Pq8h9>?376A%7a{yqGSJUjfeya+r@0srzU
z!lTOT!Q;u>z>~^*!c)tK!AHs`!|i!V=EJwBUkg7X-w8h}KMsE&zYKpTe*lkC(BGeT
z@I>-3?fv)L?Po@LY`FbiI5FJ*ej_bBnr<KR!0X71!E4Ct!N1dSZw|Nbmpa2EsUHB3
zE*}GrE1v;xAzuK`DPIfk63O4k9q^j!kHL${&%y0><`&#;XP&|B>v+fxfyZ&O=0}Fx
z?Oq)CM)fJ+_B!&J;r9JW0eE+vhsELP<v+u-%Im>%%Ui(<$h*Re$_K*B$j88|$)~{^
z$=AWx%eTPi$`8Po$uGip$#22!^ZF4yggzhN!5_*)bPPQ1_H$WOcvba@;OFG&;8*3v
z;D_bq;dSJ7;5+3_;q~Pm;X~y8;A7>Z;D5>gfOnIxgtwCKgfEewgin`Wh8HLl^!4oq
zysZ2_+<ss18h%dqKZNb%&$HWMd;Y0N@Tr;~8*cXlWPscAI^}{t)tticPx3PGFopf~
zRfWfrH->jD;`goKZRH)|c{Qgm+@9BI1iYO3$?&T3h4A|FweTkL-SAfO<M4L!f8d?v
z58=J!Z{g$RAv*^icUxyv_%!ti;rr!j;AiBy;dZ@>!tHuhgxlrTg`d~_U*I;s2i)cl
zhF{m5@$h@{nebpbf0n|-$~VKK%lE_M%1^_S%WuMekUxQEm4Af)D38=7@c0&y$Ag!Y
zr-GN2=YUs{7lzlDmxH&Ew}JQ9J`aL#laGLJluv-qmHz=>E?)(ID&Gv>pmpwp-;C_<
z<9T?<624!DNBGJ2NAQ^PcX0cA`%qm2k5_#4(cs_76Tvgc)4-b+_vdDZ|0yp7KOip)
zKOwIH|3}^geplWe{!-o>{#ia8Zoglf3D2wRyAYmJz7}rxZ)}I#{qTq3F|?j@@T?*I
z{k#cJrv3>$m;68YPx7$c0*`xTc`Udc$K-JPyRuC1Hky+k-c4Qx-cMc=K1|*mK3U!c
zK41PT{Btq?dX9qIahw7#qT@IpZm*lL8g9S0-3p(i`&|#h6X`hq4Y%{*I^52mNAUZ)
zUhm-cJXxW-2OeKLpQFR=^`TP0$7_BDcrooy9(V<L33x4e6?ijwLwF~7TX=7IFZdAo
zF!&VtB=}nST=-7;D)<5UR`?nDA^2taIru&KEx5f-$1}J+5C13lW6g=sBk=gXkjI68
zlBa}6De8ZG7Py^<1>oWIeR~=B_nK1!ZnqCj;r4ug9pN)Iryty&2XGX;o6gUv@FDWY
z@Oj#Y96bZ~ZMZJCAUvzQEIg0ACcL=38N9N*6TF6e0KB1mEZlAfX2M&mUk2|g-vqbg
zcn98I`}P!W{YSVxP9%J<!2MjQ%Z&rK^{0T_^EPIN+wE|Exc%O$H2k10w>rGEu2&Oy
zWqAkq3C-yXzaSq8zbT&re<)u7ucOOd3vVXh0k`KjI1MkT{u12Qe+O>se*w4ke}>!o
zBlHeDzV<u}ap3m+nBT#3YMmM3cD?ez?RgS*!c%F^LAZTi^f%m|hvYi^m5$3JxIGT;
z9sIreP<;aT!R`l+2Dj%AO$4|7Ndr%;>y;foE2@8a>)}_`Z-v|aU<cu|)c*~)$6;NE
z+w*chf}hfy4{-Z?;23=a_h+^GRPZ14eOd;%9mneMr22WMA^azKYq&kH;sE%1^+VvF
z<zwLX_`7Lvd;Hx(__L7y^<M|SUds2a@XaNCKL~#-{~I1mbFRZ9$REMm%HPB7dF#UT
z^Dp1-e;cYk7TngE2yV|Cm<E1W>(359E-wT>EiVf{C$9m&ByR%0DsK<JDen!xBOeBT
zApZ^iL_Qn-T)rIsO1=qh$Lj<<uJ->PJcaxfyo5Y>|DdmLb{y?_52L~R==U{A;B_=7
zHQX*Y8{96p5Zo@e9K4d|w}$7HcY>#t_k^F74}y=DkA=^WPlqp&FM@BBuY(_vpMvj{
zUx$Y%?H`YOaC=<9EBGhP2{s_`INJT&k>K`vZO!3bb-C@}ZREY-i{!t;?eW6n;PyO4
zGvIc+w-`QM^Y_9>$dAMSlAnRw^CA8NxBI(Zz}J`c_wfVVzK;zzFmRtsmGS=_8-692
z@87|vsLuqquc!Iov(?vx50f{9+d6-NS5)5vURypG-d#Q(ZqJ8!9^Oj*HMqTQ;6u0_
z_qTBSxgg}Az<svw8>7PQ`@n>7`#$gxe2I?lY4|)_KYW?|5q!P;J$$P?%&&p#-y@F+
zKP*oMKOxTmzaY;8zb-EUe=M&8|4-f!ZqFCl79L&u)(f6gJ`A2gJ_(*zJ{Mk6z6xGd
zz7^g;ehA)9eh%J8ehWTY{tP}t9&>QuaqM2+|93*Tecq*p@70`a@MH3V@N@Dq@aOXC
z@Q?Dw@UZ3lb+&`YkoSVy?bT5DNA(loA+!&(;Nj)V;3edL!pqC|!0q$v1l&Hq{(;-=
z<Xw0*&3_5csN3hDA%VxYo%-nT>)Pi8aJzj=4Y#ke+2J#S`<FKf{-ZAU54fFI%iue;
zp1<G&biMY$<LNk_h9{R_gXfSxf)AI!hp(2085+2scK*bK+xe3WZs$)1xSbDq;C4Qg
zfZNyQDsVeb8p7>-=mfWY=mjsN>pK8mT|N}vK|TdOPd*!N$9*~coz9=X;8QebFWesQ
ze;58({ZqKzfBONxUwznNfyeiTJSO~Kd1m-7d0zNwd2M)NeO@$z$B?&z+x;!Q;px<m
zgxl@IBzOb$)8LhU_OJhZ_zd-H;P$+_yWs28pMvj_-+&*JKZjqE2Ol1ITpr7#!-FdL
zU2?eH|DOdORefRjxRCyw^6;X%{izMN*S~H7PpbJ{;P(8mgW(Y?`j<Ni9#g&mo<hDB
zUS5~G1D-|wQFu=IMfmrca|d2n{Y!W`d9V?I$E&718oaqY8N7!)Gkmzb5PYh<BHW&5
zwgKFpXSO}uo@cf{e4plzgP)bphToH~hQE<-gIBNQ@7H1YLiu_4diibme))6wN%?2^
zHF?C5fye8)JU%>(ZXZ&^)5~+fi^xmCpX<D;1h=mXb>a4T*Ai}@r(NK7-VT80(&dhZ
z+vm$vcpdc%;LYW0;P(92+u%LbAA*mTpM}qs-+(WdKZb9TzlZOWhaMGpd{4`x!_S29
zyJYZd>T|#|%JaZ~k{5y7aV!tFzu&F}{}|C<PcyiE-R}su-=p<~=hu3s!|nN$=fgki
z^K>aZqCPKH!{f;}!qdpN!t==wz^BVk!kfv@!8^z=!~4o_!bi!Uz!U59^ex;zze0@;
zJb&!|rReY&b~^wsE-wiGRbCQq_p?=nH&@>X-d5fY-c8;c-djE!K2yFF{!+dcZr@jL
zhi_1S7;eu8eGYzE{Z05i`75|R5A|pG9`%vO1Rk#@mHmImf#;W}fR~r&gpZOJf-jVp
zhHsQtfcL5DuctcvxcbKM8tU7@>&bh;A4T=&Pk@(IKMj6Pm%9*de`m55Zuh@!hd<Yx
z!|)1K{PmoJ&zIkXuaZB3Z<PNB-ysh(*1sJ4eTO}tbqx3e^-19Nyw&O8k+p9*;R)qM
z;A!RM;W_2C;Q8du;6>%L;g_|~%i(wB>*4lwA@{hz{VA?}C<OncIc4EF)YpLLmA8VY
zm3M>(m-mI+?@vd-BdVVak0GB6Pa?kzA1}WRuOWW`ZzX>Q?=F7>A0`hrA#k5t>o`V$
z+w)e(fZO+hN#J(>KsxvY&Cdy+CNBb?FE0;IUd>;3EqHNxGr0YIV@G&J^?l*?caJ0B
z1@&{~WO#bbnG3h?f7ZcmA2!2dYR+!B?dNfLc=gxdpR{jx;mhQY;hW_z;d|xp;V0!m
z69dnm8}iWbC-OLOd;at!a67Nk!R_-aCwy2;e;q~O_WQ^3a64YL;MugF&ER(bYA5(?
z^}XOD<wM~U<rCr4<O|@-<SXH}KU?5-zw1Hx8qGNixBKmH!tHt9pTf^+&PTZYJ~8}n
zI3Lu<fj^a}fZP46nc;T-YJRxgPg@%PLG!D_7wG4vCUCnywgcS0Z~PU$P4h>??L3(V
zxBKB2!R>zdl#>GYEo627-x=XK<T>H?d-)>pTI$Qg?fj_)x39m=;Qzn<gxl?8U%1__
zj)j-jdZxh($d|#J%h$tg{k!0H|L}GA2+jEyK2iP{9=@`_|3Q-jkIQkL_u=4cG$$7P
zO%wm)lfgqb^*ud2o;)`^i@YejxV$2~lDrPQfxHF0oxC%Apu9hPf_xNwu6zo7y?j1=
zpL{j^nS3iesF}ZS2jTJLf5WrNufyBQAHj<?_vgQZ_mqeF-G9G*-#%O(4gR}45qzCI
z4cwlOEIa&)`a<ygE&O$qg{N=ndkuJw*1k7^x0JVsca!&q|0*8_Unrjh-yok0zb#({
zPuRv^=T^8qPsAbk&~|=*4t`jE3w}}l41QPs3I2V1e}051{(tSb?~=!bC+y&NDdFYh
zS>U7P1>p8L_A>Az>TAFob@VT{Dg0k~NBDbrKX}eg{+v<pvhu0$7V?E~d;HZpc*$=5
z{GIT&@?-D~@=Nd|^1JYh@>lQ&^59eb%eUhgqPzd^DDa|soIpZ&9eEmfdwCA{V0jVv
zRCxvXN_ic4QT@GgOL$#*SNJgbAoxo8IQUEXOn4am-R)9%e)*s9D)PPXr2YJTJ_YYA
zzX~5De+Zu{e+OSE4?QjD>zf_l4e}W9ee$I6i}LjFC-NWR!TJY%eJc*Pzgw*gPous8
zys-Qicr|%Xcz5|w_%Z#x;BWArL;Q8lflrXHgxlYFY=Iw8e-Lhe$8Z*Ie;;rYetM|C
zo~Q8V@{jOn`h9cw>Hf#r@l7m`3$H0p1-IWTXM>m0??(&6TgofId&uj;N6A~m=gE7(
zx5|gY&&wylKg#F9qw4pCYv4KMJK!<(`-5Zf%<_NWW##wbb>(m2?d73o1Rk$G@|f^(
z^5pOZ@=WlZ^8E1g@-pzOWBqm1gjbR`hcA(Lf&V2R1m7<o5C2C#3;t2Q0-jj+(`|ug
zkRO6KmY;|Bl>ZAqD}M=pDi1z0@OX6?@Bce0e6&0<e2x4E_zC%s@LTc{@K5rp@R7P7
zsxkZzc?b9gc|Z6r`DplA`E>YP{oJ<%zDs@?zD+;(-Jw_a_wyxub7S9w{SmnTyX2AK
zC*=v?_PDUr@T=;x!|i#=3&X2v{pI0}<+b5m<t^ZL|7REYT=j$CE9Dd5+q7@f;Rof5
z;qhzu`?vw#Pre&ou%_RifZOx`T!x2f==b;G5gYmb2L6jY<ShUF_VsJ5JQ}>bj#pxM
z7kN5(l}P^F-0%pxzJ=gNwQrT+|H*5@&&cb;Z_1m(pUB(5TWUR>;VI>V;nn1$;aTMq
z;YH=s;F)!N=fVf6UkM*6-wdB8-w)p)KMg-FzY4!2e*k|ce*+Jx^@o@p^!3fopZM~q
z@F=zXE-t);`V{aw@=WmV^1Sfh<R#!Y<dxwc<xSuR<Za+f<Q?G~<UQbT8u-_D0Ng%*
zN5ea5fBt|sl`n)RmoJC^AYTjrN&XkSu6z&tP6L1aN8sJmpMnpSpNG$sUxBZa-+~{K
z--ln7KZU=NzlMje?XUj>JgGeR9RK}x-e#AFg_o8`hS!tFg!h)mhfk3wg|C;Vf*+Ir
z0KX&80uNcozdpI(iRAg=ndLvhi^@yEYs)LZJIbrVhs$fjm&hB!56hdwZ_9sy2i5hj
zZzp&hc@Ovx@_z8b^1<-x@{#ag<m2Ik<iEow%4fot$mhX#$d|y+%2&Z3$Tz@))${jf
z3p|c|7yJkL0eE5gF?e<P8F(A{MfgDZHTV?yzwqVqhw#1f=kV+DxA2ehPw=?){rw3!
z*Z;5G4rG>xhnJE^g*TMPhWC^wgpZLYhcA$)hHsT;fS-|PgTIvj2#?hu=<8cSct&|K
zcqw@qcq@4&ct3e{_#}B<_%eB8_%3-%_<4DI_=kr6_38nSC?5j1?~^CO=cu0zUn5@u
z-zDD+KPf)|zbC&4FDAbMk14+kPa%H{&nABdpC}JD&)+9I&#TG9z#GXU!CT8?z&pv~
z!TZRQz=z9I!D~12*Ow6<L!K9&TwW5MLtYhLR^AxiSKbERN!}A)u(7|+LGX#{$HC{x
zXToD^&Qf@K`Br!s`9Am>%|8M^C_e?iAwLiQPkt3%r?G#1@51fp!PoGC>OaGK$|KDW
zJP()2W5XxQzk|<}XNTu);?J!H|3O|4{;%dVfj^hGf(O%__V76JZg6`&v;Od0`nh;C
zyqD%ogAbN3f<FuCU*Glc5$X@X@5)cYPs*>rFUudm?S7TFaJye6{ldWGdtJXb&jCLx
zF9N?H-wm(V%%6J%UPOKYUP=A|o<qOC4z(z7ojuh@hYy!0f!qBync)M}{{&Cl+`qiC
zaQnNFnsA%n3~u)ibb{O8<MoH%*Lp_7U&*JzKgt)uLpJx<zaAb(ej0vJbN+!(kl%pM
zmEVPLl0SwYmcN51YwoWz*5bh9+e)4oZpS?xypsA{@LKXp@OtuEaO<1HZJ$TL=V{JF
zxSc1n;WmE{{HW#}h1;Bqa68}b!0mi{3Aght*pk3~w(~7A+|Hi_a65nU!%w#G=N5<C
z@v01eq3hcK9!zt3!neo=!R>mDgWKoJO!!L8Sqit~yA?h|{XTej`4M<R`6+lV`FVI{
z`4xCO`7QWJdC=0p;~2B0|L<^c+yB^b`+WHhZs%t{_-9>iF}U?V!)-siz?19mcKX6?
zog?A-biJm)Tgex|yUN$X`^)#j>&cJ73(C*HOUW<7E6X3jqwD&<h7VC6Vp-sE{M5?-
zcT{+2%}E5eeNG2|t~uG@cE4pIxP88qgOAiYYr$v8o5TOs<#vW&kq?01k&lJ%l}~}s
z)8#IJuad8YZ;|hSACMn~pOIgL+wII9_<^|o@p=irra8fu2Oi)1^2qQP@&xcV^3?Dk
z?N4@iIC)`s40(BYa(QjIy?$g1cp>#&;N|24;q~QX;jQFz;BDmV;O*o);hp5i;JxLS
z;DhCN;S=Sr;4|bQRs<f$rSe$t74qcp)$)w+E%Ll@TYpKot-mVV*53$j>z@U$+S<Q9
zi{W-Vya8^v!@J@3b>sxxzAoH{7t`gwfLkB5GH{>m_AM)XqUPj<+d50a?fa;zaJ$^@
z@S~bP0B-Zgz-|6?_(9Ft4iD4Dzn%x+w*P;_?Q(Cx?d#nWxP83~w<>TyUu!+l;r8_?
z3EaN!`~bJ(QXZbSoqu`N;dZ^6!0mc<fT!2~^o3`VkA&MkOo7`ztc9m*=dW`s-1gxR
z+`cZKhbPvYf8n-2ui(+te}>!F!HBB^k5^7z-+1t<1^q4+-0la<3ZJ2`BL(3zHNPzU
zVq1THE%<GD3%GsV?+UlC`@h0pYR&}s2l;GxIPKdy_!zB!D?FckH@u?!AiRnEIJ~?3
zEPS8Vc@@4${X_Uh`8)VNdFVBP$Ni{02K>4_Dg2Q<Jv`Je{@fqo73Ia@jpUW#BjpX?
zQ{}(FXUTiQSICFL*U5i_AC=F6KasD5ht+Y}0#7SH2rno<3$G-<32!2Q3Lhc=2%jSl
zzc%pru9l~O|ETMg9zHm-jw3v!`r`16@*42O^2YFZ@~-eM@_ukz&nS3%^;6;Y_{v4_
zE9zInZT>d6%{c;(r~UjJZgXzHZO#XHC(Q}9F7SBSoak`7zDeLVzZ|@yZpW&@?dxM>
zxP5(W54Z2T`oQh`ncv|Jb-A<Q)~|ru*RPZC^_p`LZtK4TxAnh-+t=%0>jU@MzFsGQ
z&(-CogxlBaEbyu73&QPsHHJrP@2{f`d~aFbd%*4f{2_2VPo}^lX#PC-2d#4le1-ah
z@Lck<@WS$&@XGS1@TT&Q@Q(8E8v>8ZuktwX3Gx(hd;Qen@UR{HxfS52G^Y;yqP#2o
zrMw^fihLCOzI-a&j@LrC{eI*SJdf6Y8g7?+4gQ1rNE-w9v%Nevyq5escw>1ccnf)9
zcprIp_&oV>c>0e1`p(0zsJ{)rD}M`*t2x2`47|Q}I}jOe-<KwU+v}mGhQHS3W{2DB
zp%#Wm)Ou>dtH~R|?fSNZ+w~m?FRVEu;dXte!0q}jfalhnwQyViefS0SFW}wfL4O7A
z|1fzZxLx1)aJ#<g;kz{_2i&f25xD()Q2}1HpufI4aQnHVC47P|w<~<Ad=PxTd>q_<
z?wAQ*qy7XuO(%by=iw3MSK#sGDK-V}|C+A;ze~dH`6a5tD+KfV_VA9H-v{19J_<fd
zz65Tsle!VUMEzcP3a#f9e4qMj@PqP4@W18n;r99wVKxWu+dcI$;k%;wT{8G*^%>w{
zJNtbexc$DY1l(SSwF*43<}`t)ly`=wlm80OBL59;uiH8wUPS$Rcv<;gcy;+HcvJaR
zcsKbIcz^k4_y~EFErG{tqC5$FhCCyDp}YWmmApLsPkBA~4tZPnNqJxRKk_l~oAN*4
z&*UrNL0$aoza1VyejJ`qeii<`{0Tgh{4>0OJj&L<{Vyv|0&gJC2yZXX3-2MX1|J~r
z03R*y3!fq%4WBQc245jx1dnKcKLg*Oei!_J{4)Hc{674GJoL7}{k$bl4u2@m2!AFo
z4G*E)|LXAQ@}}^l@{aJF@_z6#@=<X6{m4{!9rX+0zsT3Y?e$`J!iTCq20xh8-^WYv
zTGf5O3vV9T_g8THK0Nq#|NZv&kaKmpQQ*tuiQxA2F&q3>eZ43TA11F2A1`kY-z=X1
zzb2mne=eU7e=I)+AENW>0(__Z7JQ=i;Wa#5H-8^L!#AmqxFc|%56R=fugO!v?Ro05
z!r!Q`1<$4RG=>-XKIrRPd$>J5u@C$^%^3mDC|?3^Bwq`!D&GOGDZdN<L;ehIk2m}T
zx5sHl*ctTo&CX|g9A#X%UEh>&dpu?qxIHei0NfrISq45p>#qSHBi{oL)6-w~F?ihW
zzF&gd?|C1=6RLj?FCNjK6K0qHU)!GyJ^X*igg2HahyNze1fL@>0AH^4lz=CZSAl1e
zH-zVxw}qFL_kuT)4}*7=Pl6AZ&xKEsuZAbo_1y&Du6{rKr2Gv0n*2Kasr)fKNSFH`
zJd!-z?!e<)RvsOmL!Ja~`~L&n_CGh=UdOi>-1h%xxb1&^xb1%%xb1&Wcpt5Q5WKZ~
z9NhMQCcKOKrEuH-KjF6jd*QbK=irYt|0Vpa{3Cq1Jj9;B<G5QM1)fE>8*$<B<SF54
z<R#$g`}mhv5x!G>UHHJ>e%~72Lf#pERC5NvZ^*~MU&*J#L-+D8cQM>ve|H0XpZeYK
zi}Dlj>+;KRdtKZ6@Tj`JZ{Xj{L+%Ycj)mmW;8o;_;q~M{z$<H=+2L{Jh2hEM<>Be%
zwc)wtE#SrEUEv$#{orloqu@Q|Q{hA93*l4b>)?y!yWlZ&J|BkL`F0*YM*DmlzC`{U
zzES=eZs%ddeSyc_&bN4QJKs{l?YzwjKcveo2)Fa9Ec~JRKJb3ppQ-Q}^0{#P{%RH6
zZf8!z|IwU(;5+2^;P(C4Yq)(s7IuH&ejd@BlyG}J;0*A%ef^Km17DHJ_Y!cszE$A%
zec(`dsDA#Oaqt$p+?ntm@}=+*@;~A4<cHw5<)`6O<rm=g`oUM>N7V-%@UMq`f7nRZ
zD;zwdJPN#^JQlo?d@tOdFY6e5RR5r_Z<pX}2KastK281%Zm-+=5xzn5!yWYJ+4bEa
zj|D$2PX@mtPY-_}&kcVoFAbkB{~10}UJpJ)-U@C%*LQ{6@6(6D`)l9E!DGm0z<bD-
z!0XD_z~jqz!hevTfaj23g_n{)fp3t%f!lFOd?@hv)*9mf`+K<koRtlJQ}YYK?RkC6
z!%J#@b-10+P2hGucZA;_=&!REyj>{YhrvV1C&BIY+7`hNYyK+uV_n}3@F?oHz%$Bs
z!OO@Gz}v`=!AHo?z?aDXf#=jd--g@%Jcrxuz-Rbt&5w9E@H{Cv$p3dd_|NiG@JaHl
z@TKyC@CCp6^UK034EDVy++NqS8N7-5PVl(epZ@Sn@`>=wTIY0laQRYrc=;xHbooAb
zJozbjQu!5lD*1hQI{9mO26@;cfyZ%(JSx1NJR!W9JRQ89{71O`{Xj8zH}#d^edTrG
zwht}gwhvw4whsf~why!5<8{6*hOgIpHo*7Dcf;*<eE){q>;7JbAJ&|k@LTeG@bFsa
z6L>25EBH_H|KKg;F^&eF5Bc=@k^sI+{r7O&hpcehho9h?HNOmeljc`~|1GZ$e=e^J
zkFEJF;r2SU9pNq1_k;J4kA>Uq%q)06^{e2M<U8Pt<tN}9<k#Q_<WJ$p<w3^+kK;{w
zRQP>)4tS2C{>K-9Khy1D8F(o5HQ-U@P2s8J!{8(3<KZ^{1iZ{Jf1MZL_Idp;+-?V6
zz_V#i(DA^1%P)@vFDfqpPdwcJ_!97*>Z`!*>rq4aO!aNy_Wf#qcxYYjXm~{VG`PKv
z=^}Vs^&8=XwVoaDzVf4RJ3lYO?fiTMxAXHO+|JL)CjyVlBVBGB_+0t-a9d|i_-ggV
z;alX@;K$^R;aB9H;I<Eg;I<DF;kFO+;I<DTPX_Ko@)7>OBf;(G@%Zqbjs3nf{MAU`
zE5j>leoc4_d3|^fc~kfhd29GYc?Y<?zG*l33iW;92jqj`_Ijnm;lXu%$HG&{C&7!$
zr^Bnt=fGRY7s0#9SHOqM*TJXBH^EoPcffbc_rcG|kHGKA&%uL_^3R9dr~Log&-;nT
z`u{Erf2qC%Jltr%F9%O1uMGcDUK3tNULW37-V{Dj-WtAA-T`i}o7fG0TYVpR$T9x)
z8U#-y9}dqU9}6!hp9F6vpAH`+p97yMUj+YCz5;$qz7GCOz6l;)$Ne~bviuyph5RzS
zpZo><sXX)P!1JxbIRD>2!i&j^!|i!*D#PvX<Qu?CYR(||9{DKv82MEARQW>qQu#Xg
z2Ki3-PWdbN&*S}l_y~_64|gVT->zix{~ZfHIgani;P$xkEbv^K|06t>ydXTTycj%*
zybL_Gyb?T<d_26z1b_Y0;0fik;o0O1;Xlcj!>h~J!duGU!fQ|T*Aw)&|6jYEw7)Be
z2)Dm0hzBpJImzJmbv!-%k=BzNZm(}w6dqRdE5hT;>%ddVTfno+d%{P^2f{nb$H4o_
zH^6VmPr+ZyAHyU4=I?v>vw{1cOr9N{S6)aSELc!b){r`eU;a}SeFgQ6oIcFAJg7DL
zrs}&p{kTxyK41X)Uh2m<efV#A(C_GfQ$OG7gF=7%fEDOhsNd}L5x?a@d(fX$f70nc
zIs0=F{Y&+CoIbKM|0()tll*snbowRE{Ltt8_uJ=D2K6!I-tmg+%uk5Etok%g-_Mz!
z1$}Gv1)M&*Grt7-{_3kZ{T63_UG$UGw{rTJ&iqd3SE}#t^x2)`I~@H1^^=`GwljYg
z`s?bKJN+DI{TtA~SHIio<2v(?ppP@zf9D0KujZWpH_&HO|HSFzJM-V7FQ-1#c|Y>b
zheFQ!Bg^glX|6tj(<gN1r$9eIeP*YR>a71q^wZTBclyN6{0iv*RA0yGw>s-@ivEoH
zj!vJ{ncoZj6ZONKK9jTl@#w?<?hpIJ>61J27oks~e!bJLaMr&KeSY<aoj!##{|x$S
z>aRO}31|KH(YI6o#_3Zz^Mfw<|FH96g8E2u@BB&W%#V$JgZl5BKD9Id2lN-!=XUxy
z&gXAo^!7S!<()pQGru}|d!4o>PQTJw|1aq6b=rD5{SVIkLFh|N@!vVl>F+!9r=qW`
zexcK6aOST<-%0&er$6SLKl{)RSAW{+^{wsKOZf-=T=n;y{;IS7=jgYn|LpWxob`vj
z=>NmcpEK%X$-VRElruju`iJV%Iej)~em3;>x^9J>KC`nwrO?Nn>JO{t^f{dQ_0eZg
z-^S@zIP33%{wMVVoj#W{e<b=^>ZdsUXJ`F$(05S3(&>M6=KqP_Uhi$M(}#7|e+>Pq
zss6A_PM_DAe+&I__0OC>le7N!=pU;ObIBj-oe%k)`BCL|{)C<8zcZ23$9HZYQlU?-
zKC9Cgbmr$ppI3cJr(f=@zY_YY>gzduVP}4G^!B=Lot^%Gv;Te251!@^8{zanIrAr?
zpP_!X({FOtzXbg{^&6eOm@|I|`lITPI{iau{#o?@s=w*<C7k&W(SKI|&gmOE^Mn86
zf3Teo_Ihto<lgyH%9$S*efH`8J5xG+1ZV#<ps%DpkJFcN=KqAgjrxjCf81GrP4xD9
zZ_S*(oHM^2`nl8nclLJrv(Eg%=(nk#;Pe%o`P0!~P`}ve2RrlEpns`;yVF;4<{v;G
zb%y`Wznwn2Gye+uAJji^`pVAym*|VC4|ds)yz}9qb9}?g?fj{$K918@b>=5UZ?6NF
z-sw9!>(7CH^bCJk5vQ;2%rAp}nfe+|f6ZBcL-h7KaBZEwrZc}A`r9-7cmC@1H=Xs5
zMjtfO@25F^ZD;;G^zqfNcKYPb?eiw|+0^fM`nt~i6X?sSzwGoioc;M1eRK6MoW8y@
z{{#BI>cd^}Bk%kP<IImPxASL``Xo-@(3zha{RZ{foj$QMKR^1j>PtI)V`qM4^l#NS
zaQdpw@okAd{vZCZu1??7ncok64)vp){*W_&68cK&=Q@3JXZ|wu9n}Bj^glWKvkU!r
z^~asQr8ECL`c>+0JAGtl{$upV)c@!7t)2NHuloP6^TA#RE}Gmse?~a_6CZu(S^md=
z@ASVo^E07Or9Pk2_jcA_41F>6KRbOpXMSz;t<|@1`hm{+JD?x0zOU1FaOMw1zd-$O
zPG7^BKNI~X^-G<;lQVxE`cvw6I(=hj{vq`D)t__vF3$XG=!4Dn-}%Vtw>bO%8oj;l
zT8L}@$9d;NH)noCxt%}RH9wxyPj=Ry9DODA8J)gI(6_f-=sTz{>h$NF`Q^}$S6|EN
zdj)-aYm9!0`u0x$pR+$b(C<<|#OeD4eR~@#xBa=SeumR$aMr&7{af{GoxWetx3?{F
zn;(CU|GtBA?|7AS)_)3pUiDX<et<vX>;JurzLxq|PQSpJ{|S8$^%1Ur9T()SXORE@
ze*M2O<+lFm>XSKrU1xvNqTi-Ir_&F1<`+c&kNUDspW0b}RrK%GH*)%+&ivNs<IVNo
z+1=?MIP(Xf&!v8h(+_v%|Bk+@`uR>jz?r`SeJAysoqnV<e-HWz>Q6fT8)yG7qF<x_
zj?<5J=08P$O#Mfv@8--8eZ&7?J0I?=k0JNYpRvyTgy`+{htfEGNN0btpwBeVA6CHW
z$2;>&ps%gIiqp?<=GR3(RDCO_pXki*gnohg{!YKdnLix;9`%!*ev&hP7J7S~p5;zo
z#hJeW{d>*d?exDp^N*m9Gv9yb1*cEueE)m{eKz$^oL+aSd>!-_eR=hvZu*zwoe$qT
z^CQdc{AsB^fzwZS)}I3X2=$qrzHP{FAMhjkW$KGN{mgH9PzCgd)YozPV9xrRqQ9%Y
zqtnlF=J!G$Y=QsIVNTy7)VB{9k3PQoKb(Hfw>)SO`mE~LJN<lTf3~47qyDhd>y-L>
zDQD2PR)5{;i#hARkA9^3H%>3|uf;9@KXyLM)jK1}z4Paqv;NrVH>v;5=@&Ws^8@<R
z>T^5&>X6?)pfLJ}>dQO*l5crXb@ZVZ`tNMw^!Gx3`+#52Csp6m>6d-Wg9f3`uYR1<
z7Y_OD1E!*{t$v}?ulSY+twP^Z{Z^;X6#Cl->_b0Q{b{FP^(_zj2mJ>1_ndxD$ZsF;
z9Q`TvpPhcqw>&89ZT}y3{ybD4OYWUNL!J4F(TCQ_lFsSZIrFojPoch$(;so>mqK4y
zeKn`w;LNX&zJdBSPG3LNw-4xozMuMmPXFh(JZL2PIqIi4{pL{LK41>|J?d9F{ibhu
z(4Xk9so(4L$3lJkfMe)CsK4a&TfXH%x6mhD?7#Dw)3<l_|2_Jj)Q9=k|2Xe_*yhZS
zD!22emHI?ZKPc3<4@iZ6y!xz8zvEjTlo$P<>PtF(H)nn&^jFl^bNXG*{O0K2sqgIc
z@16bWgFdEi%tko<9%ueU^qJMqcKR5hzkR?G^ySoVbozbY@}M2)o2WnP^mU#6Ig7rR
z`kPLFz?uIL{S@`@oW6pyKf&+#A8hBt2K7<o-uZLLnI9MZ-|AC3{cC6a8PLB}pU3Hs
zIP-r(A9<<&&WcX|#94n$^r_W1bNXY>{C4Qes_*UeFP-^=(RWZk!Rb#p^QWVqpnkE_
zzjyX$4f=KJw>$kQXZ`{7_IgWyJN+SN{uT5=`eOUQ>CZUxU!qT=KG<D9^3I2X&i;g#
z+xb&TeH^Dh>&#DzzN7l|PM;+7w-3mHexmv!PJjMe9#jVX8uc}t{$FQ*8lpd;zOB<=
zbmn(M|DXC_oxZ%YKcms7TJ8^<=JfwK^XH*2sD8E6=XB<8LSIw;ey6|U%s+v?m-@?2
zKgyZ^FZ!A4UpW0WXZ{ED+tr7==SSZ8Q`p)6=yE%MuBlJr^!kzO>wwhgKdH~|^f8_D
zCqMdx`ev}S)8BH|Um1NK^$nc9wzK}0=xeI)>h!wl{dy_=(Dzh7%IP~e^CzL7u70l5
zYs<gRUxt2%`oEn1Kj--FLVrvBai_oU?9X}h;a2+ZyzTT0ocWK@XHfs2(?4|Pht!4H
z`A}JXG`V;F{Os&ceDpokfA92<o%xy2FH)b+=|ec@Pcigo)&K1DPo4R-(SK6k!s)j<
z>+gU*m42A$>-5i^`9snFr2aRjkL1jsiN2xwrB46SnZFMGVD&qlezS9Y520V8{+!dl
zcIID0e@gu$r;qFG|7-N`)rWZC5B1K6x6b^Cayx(GtoGj-&*^hG`;#1fHuV{u{=G9l
z7y2sdi#mODXZ_{ScTr!<=|4F08>1hozP;18boRdo`Z?-{IQ=JQ{#f)o)X#AGPR{-;
zKz~L3TBi^Cat!Qk3;I{;4?6vRXZ@$pN7N6ySDikYGyfs_)aqZrv&ug^bCQ3V6IKh2
zs2d$SPj0A>1ur5`053032CpUm9^Ooz9^O%&72a2#8$Lo_06tk>6h2R08oo+i5pJ&!
zR1JPWeI2;HK2T%$WA*Li-sh>e|Mu1${eS9*IK3S!?_;K;kG9sIv;=)bUBGtqY1JP^
zpFsT$^kvmQMW0Q5s7L<)W9Lsx^)ck$_4U?YTzzWv!_?<MUt4`?^fT4hK;KM#L-ZTf
zw?p4WeRuRH)DJ=btNO9%AE}>--tLQEi$09*WZH>-k>(#lpG^IE^mbp*BlP*y|A+pN
z=10{x0d~Bqt4}Pq<E1~73;G^?2ld&}>*ggWKl%~s%b>TfB~{Sd>kKtQA48ur-O!)X
z{K4qcs~>~@q52u<^Qm8eKKOcn<JO@sseUW^xatq1ucH18`poKYpl_`H4f>MmLp|}=
zWyh<7`p9xSzV*~6MBhh!O7xx8XGK3;eF^j<)mKG7S$#e9OVzhQzf64>^oP_BLcde}
zDD=0~PeXrF{XF!a)UQE*UHxYCv2`czLG(}5pF*Er{WbI-)Zas2O#K`55rXRz_^JQj
z{~urVk>z$i#8)2&eJ}MX(Wh6R0sUn4dC})rUljcs^*^I8uf8_=qv~6tudlu%`g`j8
zqwk=8IQrll{r&nKeSh_{(Z^T668#wUd(h`ne+vCv^_S59to|PQb?Tp^Z=*iwS>WgU
z9`)hmc0LSI9|!#z^-0msRG$I;b@fHiZ&P0p{Tua7(O*;F34N3h{`KjN{)74v=##0R
zh(4jd5Y9oLQ~gr(KdS!=eQEW(&{tJ|0(~9z7tnW6e+PX>^&ikrS0Da);PD-!K8f6p
z?<)1_(N9sI1N{N@KcQc!zAXBy>T982r@k@z59&Lh-><$W`h<V^*K-*9%j(CY&!&DB
z`UmP4qc5+1Bl-{Occ5>t{uuh0`q}Ip`myS7qfev$G5R&?KcKhAMuvLf?}r^<dwr=G
za=SgRqWKBYKhgZO=<R3Ytmq@@mw1KH_tE@P=zmaO9sLCL4bYcR-xj_7EkZZ+t<(=j
zzfJR}p`WaNF?#!3fi>vYtKWg%ez$QD{R#Ew(A)D;UPEuMU-cM$T-|r@27TDg{_zg=
zGVt>~jr#a<J0H@hPmR8y`poEyt1p1QvicI}>#MJdzLENR=)0?LgWm3|?Sg)a`a$T2
zYW^tntJF_J|C{=G=ntx2gMOa+&FF8cKZt&v`cvqG>6g;i(A#6H?x9br{tf!enjiEk
z@bf*d`p9zoe1D=o4*II<Q=<Q@J_Gtr>hq$v-`y5PKSBM^=u_*yyxQp3t8a<Ep!$yJ
zPpa>azLNUk=wGS-9er!{%h4y?>hJGn^uyHeL0?$?DfIKzUqW9;{XO&>)IUexLw(Te
zz|Z%C>ch$H^L?E9IOxx+Pl|qp`V8prsn3c2sQRMlKdCQ={*L<E=p%>muTOjQ5%otF
zebJ{;KNNj>^^?#SRR0J1pVco%Ut9ey^u5%dK;KjS1@tr2-$6fK{ZsUt)qg_2Kz)oi
zfuHaHs!t}j&-eZ6)1nXB?tgqP^ykzULZ4iHdGt@zS4Uq&eN*(Ib*E!n^bOSaMjv1O
zVD$aePeh+l{S5T8)h|U~O#M3ad)4nkUtj%U^!L?YK;KjS4fIiW`1}79{bco_-Uc4u
z{OV)K?f7n1pBjBr^*PXAP+tK3AoXR@KT=;6{UY^^(T52a^!2R``V;DVqED%Q5c)^z
z$D_}sej577JN?UDjJ~}3HRw~Q-+{iC`h(~Tt3QXnt@>-|?RBjlIepSE_stB|=gVvK
zgEjvX{9`%)dWC=I|JQEMLzMUb9UC5Ao*cfujNfN~Z<YTDAD}tK;7zs8O7OPwvG7Uq
z8FKHu_4XmEey(4GezE%PPOl%azFvV7=+~(~3*RKa?9BOcvHyR2fd0Mu*N&%kKH$CM
zX}<V^UH+(0@BROJ$HnW5=@P;@?)8h*$CZ2g@a2DkQmao6&m_-;Ibk#>kK^9uj#OX3
zad(}i9QXQD>dQIquCtEZ)>&PBGkAS@XUvJIb@p@IyWF_mmHzTJ$Z_v-m#ZJ+xYyTJ
zKf!T#opa>2&Y}MJpk?r}@=chNOqaXYaqn{H>2eP`?p<!`DE^=`j(h!m_2(UT*Lg>7
z>-<yec?RDh|BN~5way6t`GK8pnS%TOj^em`xd|Ni);Ual634xMmFA~&-0Qcf&*-?<
zuTh^@Zr3a7m-l&ZrO@Y5U)6DM{xi+5>A1W8rjC1kDcu;fblhEk7stK6xB4EAyXzk!
zxAoW8`hR1uPk`Bud-K<5{(Q&1`RjCjS3B<Y5p@5<ddIzfqxzkWd%Zmtbg$!HZ?98!
z(s8f1=a%~0aj)O3`Pb!keRq6$pZE6I>Ag82^mE^H$Gth*H7D2y|Kn^<Kh22@pCwNK
zx64flKcPOW+`ituY2sgA0mr>{=F&QgIPUIGdB?rpo}2Gy$KCy@C%5ZmpI@z=-kWny
zm)p*9cYpd~&Qo2lk#PGuI0bH(I~QIsxW5mp<+eZZn)<%gac`Xw_4C(G$KCxo>bTc8
zQGe2LcYiL+ZGUEIJ@=j7o3m7N9y{*t&qvI$-^+ymi1SMG<G}55lfhT1&nUP339bFf
z<G8oZYg%Uk$KCxY?YP(H*7tAa9e4MqmfZFys%{^eJH0ojujaIN+})p^m~%qcYbgAw
z{5QB=?jP`^TF-L1?N1i%&tHyv>s+UGZgt$<pM#EjeI)(7aMW>ke=f*vfBI=X|2n-l
z=V#5i@3^}^?=YvJ=7jzfc>dIv$AH`ACW4PupH6Q3Q(XI#({XQ|L$%I4j=TF)+;OkJ
zuD-P6UT?44Tg`E=|4~0*)N<V2&t`Jl&!<{{C#U!3^wXSfj=TFg1anqt&P4bL`E0md
z?oxP=zTW*MxBaZ7{oL!gx6bwU^Oxi9e*W#a*GCTTAMXo}d;QT}zTbA->zk>+=eWC{
zujIC$^|k)spZ$5>`n@^JH7B&=?taFS+nl7DlN?@9o)K=Bn;YIveQ~+%X9Ml$&yIWR
zyrFegbKKp}Mvi-Zo(TT+Z05MvpV5AHblmGFs_*K!yPpH)wht$?{;^K)&AF&K6CHQ=
zb1vqL)tpuERr0NHyWIWoYwG`&+kUpweqMLnTW6GrI<Fje_w$+KUf*2(E62V5lJ+xL
z(3gLFd9(9sr}|KiyZaeUZu@D!uSx9m-sOgg<gYWi<L-WD#+)F1Ka(GxR9+fxms<s1
zL46~+?dL%4XIsa;b>`JNJ38*}XJ5y?{x|gl9ryZwwVz`g_xi``Cphlz=O1$0&sAFg
zGN<?EWQ*+Y=PJkD{oIZ@?KI~Ie60Ke+%ESfe24mHa@)@d+Ru-Ud+ThWbq4dU(3dys
z?dOF^j(hzs_0b&nu9v;8b|S~UK7oGzP3E|}pXue^f4=-rP}0y}ml5=%(|dCoXik2|
z-Tf?!IoGrgHQ_;;-wbY-+a7L@J?<;F{h6!%9O1aP&PiJ57{|SJ+I~)R-0PpH|HE;w
zf35R#spDQ>BC5YXD;;<DbF<w0&zJuR8msGj!0Ej?qc!J<<L-W5!kh}4a~IxD{t9lF
z`x!n<eI#!qzr5Lgu5bGFpF!~)_tv>v>rCXhyPs(s_xgm<{5k0z_xhmSzUOw_>pQE@
z=eWC{CFS1L@Wuq```fBc@6Fk)IW--3_p=4&?9e`RfnSpkgxlqgf=AVQrpdkkc$d3R
z`?=6@Z=FxI&ZUlfy`7&M9ryZ@(fxhf?6}v5(|+!E-0SD4KkT^I+x-dW<hGyfwEkO8
z@6EZZId>iR=GgrSZ!jm5=7bFKCHnGa^DD@s!R>Mr!279BBlj-GyWD5m&+LwS>r52G
z-=Ex$d%f*vQOCW$i~5p|d;Qo({+ud~d;M|sH5~VP+s`I)yS~@7{tiy>&50G$pWnrC
zZ;tKfub4ASbH>AW$p3)b<t~OlRliYg`x(^CU(asGy>*t-I`=#7?&oR8y?(CxbB=p`
z`NsbIn~r<^2laOxclYy!-1f7Ae*Ovy`Q?MZym{;Q<`j<Q&kyOiyPq-SHYcj)B!y>^
zr-$3+=7iht6N}1iKjUdXD?0A2v#Zuw#qqD#SNqezaj!q2zKP>rZ=dh&9ryY)vHgAM
z?6|w1{pGd~J9K?VJH0ojt>%n(+}+RFnA1;lR={V;H^c36_rg!8KP|WY%&Pso>bSSg
zd0OX9$Gvsh=lc`Kz5b*67mj;<G~IrFcHHZ$#_{(vM5r(S`0{4!vCsD?a@)^L`uR7Z
z(|dEKYfe(f-TlmnIZw3@dErqtza-o)_h)!P^$p~<{<hlBHjaDiJgIfIcidZNJnc_!
z$GtvnTz`N1JMQ(iKcnQfKeM!+sZQ_BX{R|e9e4L<Ip);YoK0}MpJYGWF83sSmF8TP
z+x`@5?q9D5j(h8zuXR3g+*@a2?azOXd;KT%pB;DiCqn2i(U&*dpQ!qIKd#(ck2mM1
zc>a14I_~aII?Oqt>y-=sR9+Nrms=j5RO_iDxBcm<{b}L2x6bZbXB)@e>)Rdk`)U4Q
zr}yS;*PP*wyVrLL<`mSN1@QXvwQ#%Kt?;qx56kWP4%hWP=eW1dms;l~$KC6D2lJn5
z{!6F#=KL7nKfZ4rcdu`lFkhlCZ+4!n(wvy^6Y^wmyWDi}Al+}1TW;6)cU|A2j(h8D
zt96!i+*{`WeIHxJaj!q1zJ}xO{xp%>^{TJ+bZ~laPUHms{&aEN-Jf4EC#mL)hZmIp
z0k_Lt3~#4?qulmqo%Uz9<K8-pXr22V_tyDJx3{Mq_xkDT&pGby&rP}Q&k3#PsndIN
zZfMR+$KCx25%x>uoIhhVCn|iEJQ3V3_j~v?_1WdNKRdKPg&g<R87HBC9E&>ct@AtG
zepYnc>)WZX;<&p%4dk{z1$F=1FHY~x*`PTc9C!DpKjs8!&S-d2`82p)?tFL!^=sv}
zKUcIr+a34T`9SO3?YOtj)Y_lpj(h!2iTwRM?YO%?SLL=ptF)enPVdbbt~pN~clYNr
z=CsqCh~d6`@Rv86KUN+OZkPKVe24nXa@(K#E&S`1&v9>^+qKR@j;HzJ_Vu@{<6a*(
zu|KDx<6dvypVX1t`jhJZ#+FX+&8e$7zc}vAv7gs^W6m{Qui@|@&7Tan%bg9+q<*E`
z_9uNy|9Wk9+*{`at#iBMX})-W^@knz`iJU|JMQ(iKbPdTKV!9?yH4-T$&$oh&qK$(
zIkrFlVNM0j2^;=P^ySUwx0A<$+vO&K&r+XWZu^s?wZER+j;H-{QO&f@e2#nTwDYH=
z<6gf*eObr7-u9=4+}0nY`(v9ry*DRxQhz-y9e4MqJLc@r^%@MnCZ7Pe%bfv_s`V_D
z+y1oF{%mwS?U!}t(K<If?yWPQ&Y%5`d;LW9haGqK=bYU3r=8Yw%jvy27d7Xu<L>^v
z!JJH*6Eeb=5B~CI^DD@s!R>Mr!279BBe(tOrv1t8xVO$I$-Z7(P;STF{VD3W*Ed&R
z(s6fxs>p5q*R-C7PVdcGp*c+*clW0==FHNZ0q`C2F>t%wDe$N27s_pae%1c0b=+I$
zO|5gI<K8;$`@`Lidwt&I{(kOv+})qka@(H@x_|zf(|dCUXwEIi-TiriIZ-tyDB_n7
z{_<w?Gsz>t?Q-M5>#I*GxBXeD{mJaOx6X}PXLiTEb#`jx??WNSy*}!9z87`e-Jgnb
zTmKHNr>@g`bE;}iL&x3yX^%PmG^Y=ImV5-<F84S13H5X3wm%!RKPw&g);U7!T<f^E
zPWyYj?T&l>E%mz{clYPG-1aAvet+?g(|dE$rttUqn&a;NJi(l&x?UgPQ8hnYq%T9i
zyzz2lzzeER_CLDr1-|FH?F0B|NvurCAxoo?!-$AsG=<R8Xfzs)97dyIF^6i-htMz*
zVmairm_w4#M2?Gv5Q`NzOG`@*bBO16`F^hZx%PRz?%(U~x$S*_c73n!^*j9ko3#h7
z^Z5_vQ`@-o`6l|TXI%Q!*RN*ACBGT@7RK#-UV&?$spzMx$xEF(sMFoJozDQO6N5S<
z$dlj`$#vZs<mt#Sg6n(&2DtOJ+PL&tzpC@K#-&ev|MQJ;$xlW8TjO><2jDs%e|(*L
z!sMmSVbsYsZs+p{)ycxX3dr-}_do0v^$uRQ6nP-}c>=EU=@9ScP{X+N`9L-2wT(-k
zdi^vuF8LVbn;EzBX$#jrlh99Rlb1T5qfS@jc0T>6P8jM8C69rRCD(PQktZWRAFlJ6
zg!wEtE`6RtpR0}A`Fv$u@(rGL^ZdrRozEV)&PV^g@2JU3oe`*W!nmE!1*(&deO)2X
zf)^>}74;5Yw<Ng_{$8&FT<3ED^QmfF`do`XYZ#Y4_5I;<#wB08x|>g9<90r+;M!*l
z`srx$Ql~xYbT)41)0^r9qRwFQF!%@Ly6$B1c;r8Z>wHdPK1+;CpJUPIa^rSB8;nan
z8~Lw{+xhH->wL1%PnO9`ohmiloR1o}^Epd(l2Iq0JRSZoxvu*F{sjT;CkOe*;5wgN
z%%`$(>GO5;S=G4o`Rq>De?8-pPe=Ya<90qR;Mz|Z{(iQ-$xEGUsMFE7olg&{<AXW_
z$phgd$#vcF<Ppfvg6n*q9_04B$hh=btETfM#--0|_<O*$#w9-v`3=VHe7=S2eA3ZR
zrpZg4{iu^=+|K6=)rm))Jo04t4RT%gzS7=e-l6?uAYU4;^Z5?*dBV8#c^7?FHZFah
zM839h$w$?4^Q>pw&Zik%`w7I~N4GP1sk0Du+8ej?=|**Ou&@5)KBzy8T-O~<UKja~
z;5wgx!ERskjZ2?L(B~rK(q}{5U#pEvJ~-IbS!>+R=Nq`rCmH?hHF>Es7<Dp@+xeWL
zIuWRoOCAruO0MhPB~L~Ep+~$XyhG>H9`mVST>4y&KA$iyeGcvA=1{}9<b7&8uWelN
zO)$^K#wFhc`DVr?|2*<-jZ1z#@~;?|{C~f{1lRfd;5pF8<fTpl>hw1*b@cmh!>LXN
z<~D&m2R@5j*Zq{-AN{O`>-?u<{$ClFK5N%;^ZdrR^r`dTV_fnRkUwDD&hxl&$)7>~
zlyN)H3viuhJo>+4@=~YjGp^49<9418;1>^Sow}$~hCBjZnOxVcMV^FwW4O+9Bj(x4
zxb)c-eYQ1j=h?})<ToJS#kieMZ@BI&2mK5-d8u;)b%q+Z^BGTdQc-6nc?NtDxvsmC
zJRkY5;5wg7%x9-@>9bB<cOLf`mp&i#{*mK|ami0a{<v|;x552;*0|(zkiTGD@-HL*
zk8#O2uIJXhZd~$uzu#BJ`@lPN{t@_j6@R$wSL%F#I%SMY9lhV5qB{PlQ<uChycxN!
z`x1E!@}1y1|F?#?ef2OdeQrdby^Tws4|@N|G03>&A9~jLyT&E2^B-+o@_mpWZ(Q;^
z{~5+5|1I*fjZ3~g&evzgC11Y2>t~s9$?N%A2iNnJf%$AVd8yMKb-pt$b@Y7wNOh7>
z=QMdL{10+n_bPc7^7lRFE#@71zRu%(l`<}U&O)D$8kasFbf50?q;bjTA^((dJD+FZ
zI-k1u`JzyhmpacjaB~hbZs+qV)yc=cqRIVHzaP1-JA^z8`O$El&rQr{nsMo~FZ!He
zT>6|))b;<Vami;O|Cw<+pD*A#pH%d-#pI<<vFBX<?Z)kVexN!rsB@A$34VcG*ZrG3
z9r?R(olm0#*H6i^UUS|dE`2sdpQVgTpIw@{d`07uPeJ}k<90r^;5r|F{5(~N$xEG+
zs1s`3&gW&SlZAank>|sElk2+gkO!il_ux98S1_N+#--0v4c#238J9jg;`#H5ammLb
z|EY01pOtW(&p7n6$>gQZ8r0ch+|Fko)oF=3$H;rZ&ywr9f0Cyle+#bj>4*6|P|j=4
zJM{WFi#|&lmp&8TaC0kXT=o^($azKMlJA`8{AuHopN)Ji<C53+pN))5{u1&{jZ0pi
z|1ZIH{#UTyNRyX34MJQ$QO2c?KL7htosFoIKz<ZHnq1fYklYtPpY{n{=l@uu>t~s9
z>9ZgDTxneT?1Jm_OXHIN4*9Q*OTHWO-y4^F#l~*kea7uPe}d~gd!hf|OkV2rK%Mi(
z?L4niogmaHieF%&_4Vf}OOflk7044%=V`dkvn}TNjB)964*INbT>9*b?=wG7^-rMw
zE0ovkB%1Om$oC`P2p>wW^^?fYAwM0i`+5ianrB@0^;cte9v2$Fw=bOcRmLUXrish1
zF)n%iIqfaRCI1=n+l@<J@4Nl*|DH$uoZ)ekmpT_v=ag}&qw~B-b$n6hI(ZP>w}SV{
z-ofiWOdg4R09@y}3G=LOT>1=X>gE${+|DP&xa8kOKGe9KPaC-Qxe@(zGI^=<4eE3;
zZs!wAbrMkLUGfz87;;^AD)}zt=fQP8nV8S##--1E^tsBo^w}5J+a}|ZZyW07xy88T
z2O_`Qxa1cjzu&mzM<ajCxa4mkf6}<*^?E*UT=J24|8vo}<fo(lHRF>10{NT9C9l_i
zvB$j+yhG1#^@?u4kHTf1Qs*DkDQ8^j==EQX>g3|Q)F&^F`eEd{ZaeZ2<fGtveox~3
z_A)MgR&Vb5k2P-RnP6P<qmfTEZs#)&uJf6TerA}w)Y*eNvyI#NETuY8sI!hd5x$*V
z*WF9L0{LTbozEYb&u_-1&)ewpym339%f=<&>3KKLYsMu%7uQ?Sirxp_q1VY8<ck@X
z{1W6JF)sBV2)p;`K4pzdUa!w8aGif~{9NlZCNFhfL7n=>rH)>oFHoJmnA@x5x$tOm
zUAGT;dGwP2*ZJQ!-0dsLxb!&&eU39Oed^DpBpa9fDdba(OMVUJnQC0}4O+N$mm0V8
zOo!_{6Vd-Rlb1RpP-lm6JI^et6M{OwkVnBUlIyxx$R{CRG{9@ZJ9M6{M!J1HY+U+W
zi#{JQE`93rvyySi7k|OksbbvDrw&}_lZ$?un!MC$k2=pAxASRFbylFx8{~W8vE;h$
zVDbXwli)g^ZkW$h<I?9?^qFkj&S!yf$!8;<YTV8z4X*Qvdcw`~Ym=8cRbF(y&A6RU
zCe<mAIzN+#z|WKGy7}a>$lrnMd<J1YC7$q_^A2(8^L6z3uyH$|$Bj!q9r;Se?R;v&
zbv}F1Pa~6;I@eIAsc}1>c2s8)>by?A0^W;U*BwZH0{KyJozDc!XOeO0vsO!Y9;X_&
z^O<X0^5c+SVBF4U1zhJ7Qpwf-(&VMie$@HexSh{ls#Ab{{Y0)mxBnZtuA4{R2L0TG
z>wM;6KE*0|&3T7jKX=h*3FCG?WsS?eqFTBAK5pF3ry5-6vjY9pH+iYE5Oo?ExASRD
zbz)KHHS$UD7;;^=Klx_l6X80awV2O1<I?95^f}46^tl!96H<&zKDf1;&s^hnK1<;`
zpYr&*`gJBRbq1r(m&WaUc2S)Z*w>Hb1@P14x^6Ccb@X!$uJdX2zS~#PC%xvpLtWqJ
zJPg-;O+uZDCNKM1j(t68-0rIm)oFt|P03^7ZOC=qj^uNZkAZ9d-LbDY<I-m~`iwU&
zeXif><}k{*<ez)Vd6IF-Z$f^mami0dKH0eBb)F00I?n?1ztZHT&Qa9)!nmF1R;sfZ
zb@q{;fFC2*b#usz2fF=Ug6ljdW1csSOP>$6arryOrOyn^r$nIlfp<t9$@fJ5VdHi_
zkHd97v4QtK-REhOmpUs@r<QR$pC(kNI_kVc-Uc2?uIqLuPeeWruJc)o`6L>bK7T=<
zql`<RyD^_h#wFjdt=sQZ<90rC;X0oa=x3S9OPx`uv(mVo&t|GK7j?cT-wZ!YuIpx#
z=OTX*uJgHq`CKzDeXc{FH;vo<7OU)qyhHcfrt-ZHeIAADb#)ze${Dx&twwc<qfUMD
z>hLgfUAG;16!KAU-R}b*xITLsm;DB}a~^A4`h0YZ^919PACG*ZamnlRWE{MRXWoB&
zHdl6aW|+LxIe<E|jY}Q<I&>-3NkpA><a6QM$#vbm<a?1n2G{vC$9#S>E`9pE?D{`%
z{N8?hIlpXN@?DU>X57xFXcZ~?|JP6TDy~i`xb!1+7NO3g#_fEnP@UY$uFf;$#Zf<$
zT-R+)9)f%%yr|cUtlJ6mi7_sH9z~zMj7vTf&y#rLlCK@^`b;n`dA)v;;6*(1{^K(j
z{Y*1?sWSw1W*C<`di|tQoha1#f;<tvg<RL&MZN<0!|<ZsnzC+SlH1ow<I?8}^m*F2
z<n{lL)kWiyFY=13bIJI<`QUoHX<YJMk-uYH@~8Cm?kVpB@6dVbzu#0IUex=aC9iXP
zn(~?0Zv*l?cnfl^|1x>NQ*K{f;JWU+NzQv4mwj!(zWN!LK7Yf$-Zd_HzxJ-qaO3yp
z_MP+baGk>_^fS}srA|lGnPc3}XBpKAMV<BJ(eQ7{b=`gBQ;|Oo*ZGV~a{Zq*E`3f!
zpBIeV`TRq!_t#yx&LJ1;`UQDKy+hWO`Z=iYZ`{t|Nx0TYL!Dsqz3|55y6%hQw~_Av
z*E!5fy4RjhH{;UhW3M{zVceeg0aQOa$mK_vywrIEb>25__dAX11fb45@=*A4a$R>F
zc^vZJ!gasPvEKv6rO#yadC0ik?<uOEiTb%FFLjQgPM&eQ-&<5?D(V!k>V2|z{P(=W
zA0yXwpCr#lzBXL<y9xVkY+U**8F6nppJvAGe%n(0(5f!q+2o~82h{0m-0rs@)wzv6
zhmr@N{#bHdcN%#(^7G-k-`&{na^uqH1oXMuxb&(2|4_a%F8MRae`8$o`tt*Oj7vVG
zgPYF*<C6cbwDaS}B|iiCQ^qB)&yx%A|6UK+?-i4mI>%9`z_`@W*PREdc^`O()`>%%
zGUWR24^}2mL%tUIR(NB$&i`c6z2$sb8J9l&Iy!G_T>8}ccQP*d-pF?`E_t1QZ{w2R
zj(k7klGpjaYh3c>UUU5nH!k@<b~+z#T=MbAPc|<3e~_PTT=M&n|HQcD_53b_>v;*N
z=GI+r@=~W%r1MS2rH-E8@2O5U&dXu)+we2wy6*4f!RY5YT+i=cNv@y!p7xsX4sq$T
zCHj28xb&&#_fg}L{}lOh#wD-k_bKC&zlQwN#wD-kx4v=7zuL+5*~qx$b^b5Hb^cSa
z-w2bJI<rwH(zw*o`M*VV!cixlJP!UIxvo2rd;#*a;X3~!qustfrMwURea6+4*FLvU
zek<zlA<u>%CD;0=$^Ecy9$fnzjy?;F%RKjEp0|z5JoW41;?=zmyhE?6r#id+`Wd(9
zu{>PQV;uUaYVxvfKh&vV+@8k}suPSlt;oaS9m#dwX!23W_lN6z4vumA8fsknT!=nL
z7?(cv?`J0%m;80)rx=&K{{7<|<C2ef-K{&%xSi+caGhs1`rlykQfCh8d}Z9ub2rsl
zfI3IWx59JCb=`~PdB_*Qb)F+9x_$Xd6W*cM&jIvV+_?Nv=TpYG>?<hB)hTaW{;1E5
zAh^yayt>QRGkK}gA9bEHE`QYfu_e{<L!A!f!SL?nx^66aH1b2?I-gmX&luy<=OXku
z!MObKn_g~TGmT5W0Qot_@8$9J;9|JWXEXX)Yw}Vjtc$C^!MOZU=kp!a8HGBB$mhbd
z$#vcH<eA7{f$MyhPI3L*dolC=sMpWC=+jr4hRdhk!Rx-iarxsx<jWYByk0+naGg(Z
zjeBK%YMZ?Lu}oLz^^8j$olh9m$-};0A@@W5uH?FIFY-|22g7wfUr%!Vyl-6o*cN?`
zF@A5qxPGP^mp?8>ex`9dpM`Lp&s_Ag+T`Vr7g1-eaXX*wR3{pB4v;6pPmt@nzmcaQ
zpAXmh?8W_c+qnGk$v52Gd}?_gc!%cwb~*PmF8M^{{f*oC1i*DZel=a48YVAwwxdpM
z<90rwR3{VrYD=C6?@X@i#*hb~pMh}QZ%<r5BaBO*|DezJjZ2?8pDD&AA0F-YJKeaQ
z&pf!!XB7HbZt_xRChDv<Zs)Uw>V%@s9`b1TQF2}PH2GBI^WZw48l&C53XDsid(h`?
z<95HrgT0V<=zjB1|1r4KmpTu1bM-42xBIP5b<$AhIr2>S3*@?PIQeblyTWz9FN}8m
z^f4}dzJNaa8^5<-JWqxim;8L>M;N#BnE==MMAvfb&N6wa^DF9nY~0T0bE*@7IvdDC
z;Thz*?tbz(<WInLK1XoBoHH(cmhJBP&oyr6bH%vi-$A~>xSfx0Z7<{<I-gARQyQ+<
z&zGq4m~lIwAgVJJb?T9)!JCuox^2j_k?#!G`CP_)dK#DgUPPaLjNADPHZJ)W-*odF
zYTV9e3|!|Eihu9^Ba@dplTl}uaXX*IROdGKwU#^p^|zAiy1U84kv|I8`IMgQ_LXg1
z`rM8_bBs%${&+pgGcNgZF|JO&amklM{x)3ala78$)bT>zq5bIlmI`pq$01*hd@8&?
zxz=w+z7_eG;kxeYqh0^68JB&<$2fo8xa_MmzF+qi)epk&B^X3`-B%LjbI{K;a{WCF
z^T@USQu4Z3cRgJ9RSD;JyK&jqKJ4o|<FYS(KY!4;<g4^>b2w~V@&P!%r;ST~B=Wx*
zzgHjc|1ZJy{3fISTP81ccA(B(<5EZG`S3H|2i~D|B2cFyc|5#2xvu*xc`EW@aGmG2
zDQ*to#--0|=rh8&^r`Rvqm4`c)t;_SjBz`kIJoZ1r;f`HH+iWu8+G0@Zs#+V>SSPF
zpOELkKPT69)5-nO&vv-Z=LF`n-?;R-AAKG)Zs&8-xa6OD%kB5HaXX)jaGg&)`nhiM
zQl}s4+%j(GQ=+aH@(!(27j?>!N5F%~b=^ATNyvx7bv~s>yM47WE`2UUpW(*u?HBK7
zqKr%aI`YxR?R;Y4y02{X^RCHDo##=1xN$q5NmM5lb!L-qg)b)8b<@c6k>3K>`E<qe
zYPWIeGXZ_>H*V*1%(&!#K>nn0$p`In^FMD~^3{4fzi3?Yjgh}b-VR>0o)_{C>0j!6
zfI7vDOC9}rgGY=@{si)6jo;fBo|9GJdLE;maeY2x@=~W#ALsRrOC5bqzCd-#qt2`3
zA@FE&UAGT;Eb<9(J&*1197r-QeZGc1#~GJCJ7J#5#wDMIe2Q^9pH#TcXD|Bs!sMmS
zWz<<`+|DP1>P$kNAIMk0Pm=4p=g3bWe;Kaxc^31zV_f=ty01HrMW6LP@D9!E>+-|K
zC7*=+BgXA~D#3L=A$48-S|%@bcB9TS#_fEXQ=J0r>t*uts2@eH>-HpXgM2((_uC)y
z8D(7hyoElKj7y(gaQ#d*F8Rn<x8G#rlJAN90^^eZ0{K+qcAjZ)o#zVl|Fy|Woqteg
zn{hkOOsW%$IzN+7f}bbXb@RzLBYy|3^BjSB7OU?y=N;OAKs`5~GH}i7bK@z>pFsV(
z<OT3%<XZnF^6FT(6I|DwhCX{3mw8t2=lbkzT;`d8^Ek-3<VPd_u5ro#?d$4{HZJ*-
z$d5N}&-)Cx&TSI<Uug1DC$PV(zu34v@9U^e8`RlO9t%G}uIv6pJ{S43aGmGBnCD-{
zrO!_2^B?1OzjvvA0qXlT@IKi)q`uUdk2?Ow?S7wx>)bY@PB8ficw=&1_eJvJ&$>Bx
zfa`w!KXl&Bxb&HYK6@CKKHtOjGr+jyYrO613^H!#^B!FH6^nkRn7q_^2X&?!xAXaw
z>QqOaRpf2pUy<v&JIE7}KLpqLG{SsN8J9knqR%tNrOyeN&mYDm|1a`?8JB!A^0$mj
zzH^+L=UwBHpNo9S=e!TRL$9l~$d@uM`89aXR5UL2iw|)1pENFc{ri+!a6Mnym`{kw
zOP%(p6KY)Q==1Pps<QxfqR6+xdz0(B?~vyq{~lb=SD9&UUz3eXpJUPIG~?2zp07`g
zOFkR<PmSC8tc2@)!t1+rH<`TDsWQ;{7UOn4`>2i|>Kr2vhMy(Zb^j!fM*bFD=Ti^!
zd7z=!oOkH;^E&!0Y25C&99;Li74?HmUiSMb>Qpyw_uGi-j6$83<O|>($aUQ}$TN}e
z2iN_+g8dGneBB1_ynH};y>6#dJ`eThll!603UaN#o;(!!47m2$9erjRmw6t>JhP17
zJ1@Ol|JlYRU+W#`ImYdI%!BKBT!4OVn7q^(ggXBkx98EXkr(m~trLwp705@ytC8!v
zb;;9^Zw}Y_48nZEDW8daXYw3)FRJrC>cmmLC4N8H2+HgAFq!f`$j>1UgfAi2`d^So
zApZ?q_d5f9?xg%i<bR~R_L)QZc;x>iPln$l*ZRI8h0kvW@{ho^&$jrwyAtIykq@T)
z=h#<>ak<_;$MqI!T&_3$d6ITiKM(aI$$c8S>%S+}*@1Nj8kcqRu<l^vvabHz{`<xy
z-zwhKA7k9!U(?}wU&NrF`6e%QK17{G#_j#JhUx^O&Nt*?@V(@^?qTwH<a6M99#3FC
zdB&yB4D^|A+|K8=amiO0<mThk*!#dcw7$Nt@Pq4ovd~Wjlb1SgqRtb>?R<i%PBQ8=
zCQpaACf9W%$a9eI4%hzcC%b*cQQil?|7|FF8TdG=(-C!&jmv&hu-_Ep_PR=?`U$B2
zg~>~ulc=-KxSd-D)oFk_KafYlPm=4p=g7w)e;KZG%f^217?(av4R-S^+Qj?7J2bD?
z$-{8HPR^lzMU$60@1f3<#_fLVP@Scy)0BJ{ybZao+mZYV@-cAj|6jdMj7y*E(PzAI
z>GN~EpC4sh@+F73`6L;a{95Fv8kc-8<dcm{Ugx<0uJeoxarIZ4ywq8RI$s#K^V~{x
z%An3Za{YaV$H;Zv9P(bMa|y2VtTe;*dDFP`c?NynF>d!;qNx}14&CoA)Gr5@`cg-K
z4`)T=cE2^L&N$R*M7|W>l3dqqPkt2nXt?gT4)z;sT>2c7;N}o#T>5-G#d)G}$)7@g
zlyS+Qs^apKj7z@3yUwQ?xAU9}*LgN*?DES@Uh0fMot4JzJU3IFE11Lg<YiF*FuAUq
zP2Ljui*TK1FU<3rap`j{`n+k}&a+sk7xE6hPKpn8`z>MI&a<p>sow+n$Bo;0R)gz2
zm!kjrCNFiCqfR5^cAl-NPA}AXjeHzDhFsU}PrecPM7Yj#B<4BJxb&HgJ|`KMK7YaA
z*UX{%M^QhOJQu!(>g>UDb&GLXx5_YgUbY*Tb@hGYe&doKiTpw1_Pm^g>v_@NOL@WM
zrOpo2`NOz9FE^=9@g}a%2by`G>>XOaI=l?Iu3L#b3i)8To|i6oA0A>{`n-ldLyb$H
zU*mP8jd96`Cb~YujZ6MY8RuQ#+J6%I=}Y-zxK4%`m-_nqLWdcb`rFXYSmTo4i+&~=
zmwfto*Uv2DlCM16`Nzg3udjnk;M#u<`cF4`snZvAHX4^Y`gPV$s*{R3S>ze;U&wXc
z3*`C8Uxn-W&Br|dH7<QFK%YgLdmng*<{x$+`aA^J{YEx*^QlOA-B(S@`y=0oye_;Y
zxz=w_9)o-|T>Bh6)AiHKxa{jH_7!Vf=CAuop!&N|e+=byUo$A5g#1GCRQPIgt^Xx?
z7V<mcy07Wj*CFGwul6I{evcTp`#NJ>^2?DwYusMXf5G+q)(v&_Z=1Z-`4e?~p7%cR
z4((ItQwpwi^0BV~a(~pXL9Xl8Cl5ou1zgu%kNLb}T>7js()HiLxa_xKl=E)JB|j4R
z9>(o_2EcV+spw~f$xEFbsPn#YsiX6mMs;FPXC8SHd^x$UyN)~^`ETJmpDfJhfN|;b
z8u~nB+|K8eaml|r%FXSJaXX(s;5r}wW-eb~@=|9u>fAPN=TkDw3weju$-=(Mljp;$
zlIyz9kO!ilW^kR)In1Z6ap`kE`h3N>olh6zl7H$wx8H8Y?R@&dbze#7XQ;_boqnh@
z!nmE!WU3Q}I&;Wl;7iDL-7m<Kk^cs+^SOih>@hBVE<~RPj7y*U@%nq*xa6-Rf6BPz
zPauE6xa1?=ck}$ixSi*9xXv>l{rk4?KG{2@f2lJEb&4Ce^DGC~I_anrM4kn&N3QEO
zCHHCW`fm%@c}|_>ypwV1^8otnV%+YxH`R|p{lO+LbsFRM)eJRm_dA~I1ftGN@-X-!
za$R>Nc|7u8!F9iju-~1=rO$!rbB}Sm-y>8%3-xnMUg~6{&N<_DzyDC3WYqC_!TV(I
zDB}H>{3#v&5V@{fjywnXs_>#-5m`4L@1N^Y{tEI<$@TXwx1~Cp^g1yv`z@U$U3))w
zV_eqNuTy#(mwf-EdvTwB#wC9N_uae3CBGB-;l?Ge?|a9?b#BqmyZSRtUg|tJ+W8#g
zQb%70mr<Pn)LBm+3jdZ|*WE`Rhx~DPQEyFI_dCq<jB)9+`DoYYS>uxLjIS5|g6n>>
zQ2$@b>%RP6^gh`;G(Q#j3gl_<YUEnKE_pWc&EZA8Wu(tz*jGE_vagRvyM47cF8ND1
z?_G^cJ|Fq+#wCBIm#fp?xa8Z8aX!$v<gd1JKEk-<7bE|^amkPC;__3BOa2z}(~V31
zGWwrqT=J1)U7dx-C9l`*D!87P&@h+(%H*ZaJk<HdxYW_}yPxXZ#(6nT9)SAi$aURI
z<l)HQhU@uVg73=}Z|ODR9pcjGA@u2IT>89@`II*<`Re2DeY#J8amnBRz4PkEB|jSZ
zVB>b4A#j~%T9~WT%H*Za9@J@T+|DzK>cpW=Z}O?|!Q{H`DDthyPl4+^zr#G|7?(b8
zqtAK9?S4O}`T;H6em9uB)aj4!Cwyhx?sqrU$wr??$Zx}Q$aUR|#*4aE?)~2axbAo4
zckX}mZRIuR9qQlia9)~Re@^cS@`k=HUz1#azB+__59+rf*ZLjEwSIT<L#XpM`8oJ7
z@(b{><oWPqxL&uxE!@5qQvO5CZIy93zl(5w*BF=c`zY?CEyg9^82=vJcH@$7i|@l6
zglj+JTDX4Bn7q`fG{Jc;d4KrT|52w{Ywwf2L(aR@*@Ap2@?sNR{qk_`rz+(;BmW%b
zSF~_-T2nq1`B%w{VLnmhN09GB^^;J42>Akd68SFpH1cftJo0n!<>bCExP5IT4}|X^
z4}l*bkAVLS*ZXl5zAybB<8r<}z<ho;F4s?x_m3P`jZ6Ln@;8i2US9|Af60BKp5Juz
z^9Wq86aDws${LqC`Z`#Z>cpeYv*gL}=gD>5w&WSezYf>=e2w|MWnA|A8vebNzQ*l*
zh8UN88uG)8+xd)z>wE%VbaPHNd8u<5byAGm`7EJ2IoMY^xew}ZBiD5goBGwfbr<6~
ze8RY_`#7FIr^z?Le>48Hm#<gO?d!a8sdEDPi*TJoUG#aK@;8uwu#NZ0-l6BqXSb{W
zIJqypGWmn>I^+THR^+wd9mrpR_aUFQ*Y)!b`CG`pOP&ZHNuCTJO}-L7kvtPVjr=@(
z7WsX9T%VtiSAs7hZvtON9tmGfJ_Npwd@B4a@@4RC<lEpo$&bPJk^cifME(%Y%TMG_
z!%va7fd5J!1HV8%9Da$sGv<Gld@=IH+7`Z^zlJ|TUUVO>bMgbo2a{ihhmaqIw<P})
z-iiEocr^J*_*>+q(C1k4M-RCEKP0b>{7Uk__PhK#@=)Zrk+*>FBOeL>iTnoqS8`vh
z`zQIs@EhbGz)Q3%d>;Ft{v+hA;pNFY!=EC*01qag41bpVGk6I3I(T#P@8K=UkHcRj
z_rZR<lJ|r6BrgMxB@coRB!3>BK;9mnME(nW68RK(3i%#*D*2D__2lc}Tga2)yU9O+
zA1D6;ewuta{6FM(;eV3{;Xd+vx$yP&8~ibHy<e)3>wWPIc~jI0CC`AjCI1orI{8X?
z40&t#0P+a<2jp|%pOJqEUq#*(o=!d(zJvTa{5ZK^rhES6l0OB%L*5i#CcN-@nGX*j
z*XyS`c{K73$VbA%$UlU?LOuxIiCmxaJ;>vbA3~lEpFq9|{yBNiAKcv5kn4W8kRL~#
z-Q;KChspIiJWa0G;UDC$qo04sec*S=?}z)pQusW!f|nz&4}X%p1iTh`4R|PdCHRZv
zkHKFjF9q*SJ`6sdd@lTR@*MaY^5yU?<lEu9$#=sKlOKYgCO-<lNPZH2oqPlQF1cRM
zCEFK1Utb_!pZpJaDEUqJE94aqy6brWc{BJ}@*ePo<cr|T$;ZIIB;Nr4nY{QR*Uzuy
zyOF;@o(=z#{4)Fsd0Esi@oM3D)`34k9tN*M-U0ps`MdBp$v=R{k$((-pL_#+A^8#b
z*W`b}e<pt<%gys9c@6ko@&@pV5ryZ|2Ht}FD|lP-?(k0JtKdDz)8PZiH^4`bFNBXF
z*ZXlgx!&*d$fu#sYVr@@o5&O3JILRHA0&Sp{xkVZ_}}Ea;Ke%>o_`+vaq?0>y7SwR
z{0Vp)@<#Bt$h*OZlJAGVPo4;$LOupQhkPP@F}Z$Svw?gq^52k8h3_E$2)>7W4*Uo5
zMerl!%i$-<e~0Ii-+$Q6|DleB&sQyY5P4g8UATN-NWRyjM{~;eN4}lOce`KH-v6IN
z%FjSPhWtZ#9J#)K9!|ap`SEb+)7SJlo$?vT&olX7OrJ|A|10uqO}?0^znStyj<`MV
zGWlFn{|CxfM*gJ97dQ3KQoc3v`6ge_)W1Rbw~;UQnky>vDPiiDg6sG3rXwF<^36^C
zs+3=c{Ie$SXX-bl{1N2anEWTEeh125MZUYqKWysvrF^-gZvF`--xS|NmH*{E$~Q)S
zipl$%`m-qi8uF<oKic%alJWzP-(>QSnEKyRelqfzCSS|+{}bhxA^)4nmofGKp!^=>
z3rxO|>Ay&%`((Wyen<XcxLiMFP5p9|_xs7sKgi^JoBFjW{|xetO}>g(-`|z-d5QAN
zkbjlD3H%N6mhish?cqbnyTX&mr@|+Z_kyR8_k*XB4}qtVkAiO|9|!-P{A>6%xSW^b
z-pocl=muA^lRHUz9#0})9<KRW$XBNPE#&J^eiiaBQoiCbw{8c@XCU8)@?pp)Q2rG1
zlPUie@*h+F3i4@`ACLSN%KMdYeeR_Ea^!!cd=T>IDZc~xE0k}5{DYkf&;J+X%fWU2
zt&tC;{9WYhP`*3zjVNE`xZBr@CV!ttfvydo7|J(7z7Kgb_`BpUz(<mIg^wm544+6o
z0X~iVQ}`_MFX5k%XTlee=fIbdUxBYC_dVg}wvN0U{44UB@NMLc;XBD+g6|`bf*&Fu
z2>*$E4Ez-NT==i#Y48i=8Sp>Je}ex*ehz+vya0aR>xHj#zn|SaOORKAmnLrt4<LUP
zUWL2|ygK<1cnJAecysdU@RsEB;qAy*!6V4Ogm)(24UZ;21b>VCH~8D+`S2m+|H4O-
zKYG&5e++qL_$2ZW_-yiC@K4G0>*bZ?t&#tdT>l<t2YDp&hsnpoPm`~OpC{LTE|Y(V
z{2g-bvqV(k>vkscWy$BltCOFG*Cp3}LdkXAHsm`|Cz4#}7DIjz`N8D=r`&lTL9YEw
zAlLUTGs%mf&LVRCd-gPP-PhOT!KkyFT)!WiP2LpwT=I7Czsa@EzvTM;%o1G+pWhy+
zQ<l6RJP0nY%kr7}^AFEb{<&;7=Vr!hdY|z06z46B*YLdL8Ry}~CEw&j=Mlywuiu}4
z!?@(fA^)av$?Jam8<+fk<Odp;d<FC~oIDWz0bJ+MtF`NMs>#>#>V!G=Nii<#Zp9oH
zQ=Ooe?i1Ei{xb3zl+Q*!i}H_QU#BS_i#{(=-e;;?_d5A<)VaT_*R*%&eq-@-FOQJN
z!=EHig$I)_g*PTogSRH%1%HivFFb}k3qF867e0c#4CXnJygWRGJP`gFc{F?tc@q2^
z@^SFJ<Wu24k*|RNMxF-$i+m&eHhC8O!8Zz@-*fP?<UXz3b@CLsKfEq^U3fF{2Jm*|
zq43wqBjLTsqu_(cW8m+TC&E7@Pl3-Rp9^0`o(f-2z8U^4`Br!)`7Zd+<k|4^<X7PT
zke9)I?Gs)2JeG$)L>>r#oIC{nG<hhz0eMS!3-V}qdvbkFzCoUVd@Ok){9W=S_!#m9
z@Q=t-;S0!Dz*my*f^Q<vf$t<g2hSqUga1PA`;xnlE|M3AUnlp67wJ~`{6@pez~%cG
z^7>L0&+|%@PeMM}<mL4)9Iw}nj7yz2P^YPJ$?N->*2X1YYMR?uJLC5Cx07+ncS634
zamnlJdoSaXPene~xa9TqdI-6`UJr-s>(|z{uFnbVn9m$jN7h}6IV`2TPa9WfBjxuX
z{~hH+kv~lNi^%6tJ_CK`Q~ns{aD)6=_ygU&roBV=yHT$b@~!a7<X7Nz$P3_2$#o8G
z$V0H-PUJ1&J;`I>?~spzk0MWkPbQxPpF^GsUqZeVo=%<y-$uR*zMuRk{5bg)_&M?d
z_}}C{IPZ7J%fm~)S@`@0z{`^d!K;!-!k;BifIm;32oEPuf_EXG3-3d|06v6#DLjc>
z@6&1InaIy0&w?)}KLOuJeg(dRya0ZX+^3zp-%pVTz;nrC;8)3e!HdQeK96zmQsm>{
z0pye5HOQ0U4arx)!^k(n+r#zy;cww}p^I^O9^S%prkip5x)5tz@|C8$xy2cmd{uls
zH4?7Rt6k`4Jb5O37S$P!J{KC7bz5NF#l~%)Ul^DC6y(<#w|#CkF8L$KXBd~f{#@k&
z<C3qC?B;ODxa9Tg)04&}KMwiR#wD+>cYhj}uQ%ged7rDsrB26>-2ZT25AOr-kn=0~
zjC&t>Uw<2yd;szlj7#1}{_&2=#w9-q`DctvzAo~Oj7xqy@~z-SJd^0Im+zJL=|uS}
z$iGGTE65L_d?@BNio6GW3e~xd>*`~2U({bp9tB@V9u414-V1(!JOh4$JQMyO@;vxu
za-VQFx4Y!NaKE1JL=?fC{oobItHZ022gB==H-LwcN5EepPl9(P9|!MCJ{6uoz7#&1
zd<A?uc{+SP`Cj-k@+|lUcu{X|a^EH6IkVlkT+hpKU43U<^7=mc2ji08kNl6uC9luJ
z9JrpZ9Q1RMJQrR-b=ILz-?zM?-ci*1FIo3btXtf;?X!$=$@|Z6*HwArw$JKt?Xv*=
zJWKBLimMYwbu!WC%f@Bh`dIf><F?PP#wGs|^4*QwKKmJ${2#~<FfRG$@OqSJT=Mm1
zx&B8Pm%Ki=CmNUhTI4@8E_r=!&oM6fDk-l1JmZpYiGG$Dmwct!F2B;a<X=I4vvGM2
z<K@67!?@IGFw@mJXk7Bi-am32GcNi5$e%MV`3&Uqj7vTh`J2WipO1XeUhWTieI7&J
zAFkJxe|y(YAm#lq=Q@-RL;iWn_eH)9x&Ho{&c>zBz@l#5H;v1_TH|~TFfREB<cAuU
z{3ztd8JBz#^3#k<em(N@jY~cq`K87spNsr@<C4!o{u|?xkHqz}&$#6M?{oV-Y+UkF
zkk2tL`7q>vH!k^W$X_=u`FP}gdV3#uho1M~Id0vDjY~ci`Etgkeg^7Sh3j>aAK~gW
zq<l}*Z%O$E9bCQ><;Nrc7Uje69E&G!1AmWvDSQg~3i!w5>F}lGez>03k(Y;WCl7%i
zAP<M1AdiLrhdd5`nLGi0mplvZ*T<b-JugS$709#U)yP9$b?2o%c^h~bc_jQ5@@RNh
z@+^2?@}uws@@)8M@=#oF)5%-H=aYxSSCGfTza)=?e@C7GKSZ7k&n7<y|D8M+evMr3
zqx<?6K9ALLzxa~}!=E76`>Q5-9P*9G6W}e$Q{WxQ=fb;_r^4SR-waPA-wGd3z6(B+
zJR81%JQuzSF3&f4UCzb(oK42%Ikp1NnJva8ukRao8<+e6<o6qwyuNQd3D^6s0R5aJ
z_vz^Fugg^D;a{BJF)r&~!n#Fcy$`%Y_oaP4Y+UlCKX!E<F>d>;0@ptM(N8dWd3Y15
z^ECQwZCuuEfOXp$xAW|5T=MTB-_^M7vyXAf??%4Aamnk~`$LUO-tQAPhY`jlukRZt
z7?=Do<fj;yyuNRoXIx$%v+(-3#JJRHHP@}X&bZ_QeVuPHF8NZ(?=>#@803F6F8Ptj
zpD`}^WaM*=OMV^l*Wmv>@2|Oj9_Z(VyhGm)TtNOYxaPx<uSWT2Ft=yOBjL@cP8(cT
z?Z_kGuahr@_aa{bA4HxGf1lhB{eMVa9zK^m1ip+s9KN1B0{$&|6g-nW0sb?2BK$mg
z68s<X1#qAK?mX)G%7i~eo&|rL`~>`I@_cv$@+<Hb<hSAN$;(8#>n(~r0Nw|#&$kwM
z&I~qQ)7#=aTvtPl*YI4QhhvOOejD-=j7wgh+jHPLw_x;>O5OmzhU)Z2pIeOA^y=qe
z-R;J0pZkqVK4G4l&q3po*XPwq<C6aY`P0TFuYZ4c(YWOApYQ5lGA?<2zTG6(zrQQ;
zwiogaolkrxSLb2!ILzlsxIRx_MW3}PpMW~eDPJ9ZzC^wXbvkh!tlN`38U7A=8hjLa
zI(#zuX80WPEcg=gqwsX{Z1^_vEAai~WiX%P<mKV#$OGYjlZU|XkcYxc#uYxlE#c+K
zqv2J_<KWMdC&8a5UjPp$Plb0OUjgq!o&g_1z6+j2o(Z2qUcR%tp69~#`STv`>r~@%
zAH9O>bE$E;kM!pl(~V1h4)Pm~OTHt%UzA~7@_!@0%ecL-vy4l=#sb&>QR9-==SB{>
z-q#o4dS6Gr?&@4&$9(P|;1%@_y{|LT=c90~6NNfKlpljWYm>hTZ%TEdv2GjkM0h9i
z6nIbax$t+$Q{kh?H^V2BZ-vhx-vwVno()eYFMw|&zYX6{?u&UICl7$1BM*fCO<o;-
zhdc~ka-ciEdLH$9C{NxC`Ksh`@Mqw99}Pa`uB%Y;5%4zTdfj#+UygiV@>KX>@?`jX
z<R8Gtk$(Z7L9Ts%O0IpbBL5O~)|2moZztaeKR|v4ew_S2@N?vU!2c%Ke;@o`a;^X1
zJO6)Q%X35Pmxb%~Fc;@Hi1HufIa$}ZJeQW^zHVS#>g)ToFyoT1{;9i8S{k>{u?XXm
zPeDG?xa9TyPmFQNpFzHtamnlZpLpYv@4U$MlVDu(QFv}Ak?V7HB3$Pd9p&nzkY{0@
z%S;_v_dfKwf$}k^vy1Z07P|UBkPkwgQ&i_R>f}+rC+b`!UjQ!}?=|Ngx-YHsC|q9`
zvXKuUFN=BBqB@~nT>qhzAC7!G%J)M44a$Fqd@u3^@Ih234t2&*zGSNF=R@*3@D%d@
zp#Bo7e*)(>o%{-X8@WHu%YO1Q@Z;nG@N?u1;D3{c!0(WU!AlM*e14<g<;mmVRmms8
zpCz9Pf1W%A9!{PH??Rpq??b*BK7>3Ao<yDppGIB=*TX#WDEM;nQSgoAS@0d?N8ty_
zv*D-63*forx8YaGeY?8rw&>u(=P?lOM_w2HI9y+^xBTMjR5LEmr4G3MYZ{m5p+3(W
z8khWkkZ)pK^7^{j+PLJKf9BS0XI%37Jnw8=@<WmDYFzUAJnuuU&*uSfeU8Pw;np2N
z9*g;WXzIwi8Q9k+l#fT9Rh0h(eQqGH2;aeVu<k+fsqj<eE8w~0Y4EG$8{tKVc$@JK
zokJ$P6nPdrfcyl!26;ZbA-O;1^CEc}cm#O>yc>A~cz^N`_%QM?_&D+?_zdz`_(Jkg
z@YUpV;hV`9z`rM73O`J~6@G?11D;2|7k-VrO!U3e>f@W>&ad9rhjCx~8<*>OJFder
z#_fF_Xk79SEOzySj7wgBA7EYMl0S%i1LKm{=RlZo$v?fs)o*EB^7<TzFfREwk&iSk
zd3_GVkn3}xFI=zxoNjL21oAeR=Xg^`)_n{6nnn4k$S<Y*1mxFK{wVT0DZdi=A1Qwh
zef~!IF_^<2<i7A5R3{AU7JJv*jCbf9bia?1Cm|n5J`P@+T<6e)d>8UBk!Qmr$qV2;
z$je|31If$7N0JA^Cy|H1XOoA*7n8SyuO*L$ZzUfE-$$MVKSn+YewI8Ho=?6M{x5kN
zyu{GL=XV#p9C<c8h&&%&kNgU}Ir(k)%jD&|yZbAOJOJLCJP1CRJPbaHJRUv;uFt*S
zesSy0F)sJ-a@-g5jLUOF-_Lw*T=MzIuQD!qeeP{CF8QyPx^=f0m%Kjrb{m(x|1y`~
zZ(Q>F+&gAm@@<emX<YL9+&fRM&%Hn4dcTLnxOH!mFU34d4)cn7hkkt*j(t^tYn@!=
zYf}Cl<U=T5_f5BMTguNw{&mWS#<+Ye<=@5}29f`XIv-G-1?Y1sx$gH9@@(WkC(nUz
zAlEr$kOyMFKahvOPm)K%FObK>uaGCeizK@9rRQZ7{9*DGct!HL@ap8L@aM=k!(Sjj
z0e_V|8y-!54&IOaHhd_#53Yx?<i+91<bm){$s52|k+*?=MIH{{MIH(NkvtxLnmhsi
z2l*&?0r^~b(cy*9?_Rh+T%UVa@Z1Y9F3*i*+%JK~<+-8Hy<p>#&qKbhamn{S<8$u_
zH7@xLpF0mTE_r?Kg&UW=-*T6aFfMt0?nN7y{Oica7?-?0_u|O)xi<u^_eE?^w{8-7
z@gB}+m^!j<8|-Tl<-?Irr~KQ<Z>M}V@`ort9r<4<ABR3KQGOccaGm^j)VY6z*R*%&
zetod+Bjmc@C&|N*4<>I3Z%nRpXiYv2`Pay&!ehu&-~-6h;Uma5!Y7h%g{P38fPY4Q
z4!(xm2lM}iJOI9zJP`g9d3E@2<YDl?$Xmj1lZV3}99g8$`RxTSOP&aSihLBjF8Mfk
zGxAh;JMyLQ*U8i1y~y{%2a)@{b#FU9?~@0?KP0aXpG#gBzKlE^zMeb+{w;YFJd->D
z{xf+p{5*LI{2%fKaGz0y&*Mh;L*$#`kCSJ>pC&&6uSb3k{ybb?FZ@os`M+#jo_p)@
zoO#u_Ja6^)5xrqt^0$zG)41gI_2q5jlK*stTlXE~_IW;%T%YG-;QD;4-rLprh}^%I
z^Hftu)_oo8uAzJs^50T^1oA&nzBuwH$#vZe<l)F)A&-C;dCzOkJ9J;#&%@*?$X6ua
z2(M1Q75*G~Hv9$h9Qdo`x$tOmAI!fWxi5SuxgUHic@R9AJQ)5dc?0+=@(B1><dN`Q
z<k9dS$rItH$y4EfkS~Q7kf*`#f4}hg-35Pyd@uY-@+^2Tc`m#mc|N=)T<>@Nz3~yo
z<-W+pbslM4?nnK7WiiGjUumVgzj_(B_j|l?$wwleU|jP0JV`Px`6<YcGcI}ky=TeB
zB|l)5>nFvy<n{ews&UEZBfr$R<n`xyHp2CO^y%a3e{b?qrw!^HBoBn2`X6=jD1Qt4
zy-I!r?)!nan0IJD5$NYJxPG1f1J-@YcrEW!GkjhD!N#TkM^`(4j=UlKMYygTjCCW(
z<Kf-Nli~fzQ{cnM7r@7nZ-mbv-wa<!o&jG?eggg_T<?oJr`#OABiEm!I7qJ7$tkLz
zhx)%$zA9d4|28i3?}9mBHEyrNB1!JNYo7z~_18njrOrjvDQ#Tp=+{$E7?*szG`HW%
z#wD*`uhk|Wj&&Qr^?C^H=jyZ|5A5r_qp2h7E=Hd*l%ItBAj*G_{0Ec|h;{XoDL)JQ
zT1fdasK1&#0KS>L7yNtjWcXq7H24|vz3@EpO!y7*qwr#*y<vHW&N&bMD0x0Skh}n1
zo7^9BYeF6be~CN{9!VYz??D~|A4nbxA4#4BpF}<mKAU_hd@=b__*(J|_*U{=@O|W&
z@MGlX;AhEm;rZnG@PEmR<9;bIrttYK4=+a^3=bmL`>q~&OXQo9$HUvgi+an;{oV-A
zrB24>KHZG_sEcvQ>-+iM#wC9V`F_SFufIq1UE`7u`oi76!;MQ`f4}H><C4FE{AA;j
z*Vp&i#w9;&jjR8Oamnj*dnLSxXWoB&k}#hwCNFgkVcnhN%i&r7qt36CAA|fw@~-e3
zRA(>xDKS>M`~UC5M`B;)jmztMK3?A|8<+m)Azzbx8$1NAb6A0OTallGcO>`if3H2C
zH_3~`<H-Ht!^x||Cy)ojXOTC6r;>-mSCPlSH^Ym1vytneBd-4p<1)7#%x9Nzd;MgQ
z>+5p1aj7$Ct(#AdajB!P%X!8nzY_U;<C53cWuI~02i~FQD+T*14VQgMof@d~B;|9F
zuS@xG<eO7I;ceIdtCSB(cOFH426g&So!h80jPl)3CyBf$d^**cg#PD~C&O2eXTrZE
z&w+nOo)14n?uY)f$*aSECl7{SBX0n|Z+zkN7!LO*kAOcx9tE#S9uIFso&;}6z5w2V
zJQd!Zd<Fb%@(g$)`7Zc)@=W+l@^kP-<OT3F^5SvsI{cd4AHI`36#gSzp967t4*X(V
z?xQid4u3T+_oKcJ{%KtDo00$9xa9S9@L%JSzl3~|3El_Zq5bIV;6uhGAGFTxx3qDo
zufKo$3FDG~V7<#%HZFO6-K=d~@>7tnXI%37y4eD*&!2G2v!lsNo!`*s8{}KyvHzpa
zaLUg{ehm2l_zbGE0R1ecd|&J<-MGAN2Hx-H^R;p5{|n^5BhP|o!F3LaSoat5t?-NF
z+3@S+IdI>JUK8G-^>g8+$$bX6{wtCD!fTQH!9&P{;4hGez$4&#eNMpr5@lTG_7CP0
zZQNczvE=%?nP6P%EZ^Yvm1tb*=<DV<<M-A@ev)y?>+5C;xqd%+K3wPA@*TJC3i5c&
z;cHVz)(yqFJ1M^z`6DJT{fx!e(P#fh{))*<{WnqnzDeE(-l2Wwp?(>-zV44fz6#|N
z2fBUL=ln+Jq2x8-t&Pk5l7#!Ey>Yv*?#3k_fqY-%_s%cs4~6T#f-wJyl>Y_!Wb$zM
zLaNgX^I1(E2j5J-0{%VuIrw4nEATVq{+M$fc`*D2d0lw1$%W5v2>em<2zVfQB)m3x
zG`tCU0{kWNaqvj;40sRnUGRbAnedV1=irmbbK$ee^Wlrhi{m<3OCAW{N?sSfk6iEf
zW8~q;=a7$rUxMrNa1ow|H;v16Ui3?Mf88-&!*hN8EiuKNcdauO&xg`*y)Po-U7g1%
z|0(j7DIYw@<!e%2pL-1{KMDJK<A3-V@>JwMBF}{{ATN&oSCad|H<6ct?<5a~XOY*1
z|3V%Dzeuk0yiOjCyzhsF@5e-VY4TC<O623<wa6F1L&#I%t;kovJCbL>-z3k0$C00d
z4=2xqPayZj^)rjSI6RfyAN~b-b@&$Y2Jk)PE#XJW!{NV@_kv#{kA>eNkB1kZTKN1<
zf<HpO03Ha}`*a=d_h92Sy^<lg-|HHe`#lZ!X{d3@4@5r9xa9TUKMgl7`K8E57?*rH
z>PH)w{9~Kkb0EgJ<hLRpXI%1cA|G#D^7_7OlyS+gLO#j3<n{SB)wtwaeC7H{HZJ+S
z=x2d($*)5`)wtv{kxw%&`K-;Ze!6kV>-)g1<oZ0^3D@Us-e6ZJi~Jm}hhI${S$8V>
z{EPDWsN*xu3wejWPb>SitN$SRKj^<4{J;HR-5~Nn)UQY00N$KD1O763E<B3-HoPZX
zum1<LUH@;B_xj2CF!EZ+k0sZyE0f{6-v&cmorRR&hWqYw<1+uInCB|va^Cgp^i9Sk
z|1t7gj7whcqus_OUw4b^XTNdD>wR?0xa9MYKWSX@dLNxPF8SZSarG}6mwYy^^J~T>
zfB#mOziC|Z|3SXkbngT2(Ce)_@+FK*J`ee_#-;vO$Ukme@_OIZgzNc=#rbM#@=|9X
z=Fp1r0ST`Ej+EbqIdnEI>mEd(Z&95Ss1tAUvhE=CpI}_-{DV44#wDME{5a#1zk&P=
zxb8P7(e=O3<fYDIJDe{zZu?(Lb&`g<{8p2fI?cXyo?+bfpJ`n3G00~bxBdTWyq1?w
z$Jb>SjZ2-^GTgfVkUs&xO`ZmS@FVY&y+f`ysh^Mfj~JKw1?aOPc^167aj6qn>|R-)
zdd8*BYUG=ckA=5|>-nlX%+={i`N<j1V~xwY5m<MSaas2e@*~JE!zaUa-5A^#bIA36
zSwfzQd^-7N_%`yR@crZ`;K#{x;OEE-;D3|fhTkFg#eG*Y*&B*?=zjISE>E70d{y$z
z@Mp>OzJ8wE_uYHT`Gk}E!Ml*xh4&$k#C<n}JQ|)vJ_<gKJOw_FJPp2_d>4Epc@}&J
z`4#v<^76QzPmzbibID`jSIOhxMQ0Q~j|uQn<Wu1R<jL?F<a6N-$<yI4l4rsr$g|+x
z$WOrglNZ2;k>7@oBlpGgd<OY{pY!A`kzY;T2ELg*0{%UDEc`He9Q+J<0z8j=D*PIG
z3fy<5JHPt=?F8OO`NQ@8U5fk@<Z1Al<h$UF$oIlql4rp?kmtg?lNZ3>Ciflgo&$;G
ze(>?+W#BW(1K^9u8^F`ZL*QSNhrxG~N5Qkmd%;h`^}L+Jc{y)fUU!=8aQnSzTwdSx
z{qr^Bl8;CJrg6#NJ>%*Wo8^7r9s2(8bL2}Hmwd^bdoiD~<ob2f6L7tL!bZ4!P4YzS
zw-I>~ye0Vpcn9*O@b2V$;ct^?!V}4l!pD>6!)KCTfiEJz4NoI4k2!oz9tht}ULAgf
zT<4iX-Uj)ra5<0FynnV7ck{nxT+U-DoW~+5-Ur^H*V}6N{l=g6A{T1hi}^fgT<V-g
z{vo)Y_ek{fIOXpmA532CS69Coc?oz+@>1{)<W=CY<n`bQ<Za*+$=kyhkbiR4^|_4v
z9pqP&kAtrxUjYA#{7d*Y@)Pi#<d@<5$V>g^`aDEl6aEu<YxpVh82GQ`AHXk=&xQX<
zz7GBm`9Am!^55Wh$?wANpIzkM2KBnFfb&w4ygs}%`77{p<Z<vP$j8Hj$a`Y`waC{X
z|1x>ff82R_jr<4X-y}Z_f1BLzoU1d8d<uLl`E2+{<cr|*$^Fr18u@kfvyuEbd<*#n
z`1j<ASoa|L<M5;8&%#fVzW~o6?+iar9t;1Qd<OhB`AxX*oWj@JGI$B{FX8^=S@5#t
zXW&)H2V(v;$t%Jel1IT`Anyr}B!3YeO<oxuOI{N`oV+<ai97^8kvti`n0!5aC;2}3
zUh<>xL*(b-e~{mV-zN7v@9v}09~VBqmEh&cgWy%kgW>hayTF^1zX^{Z?+AZ``~`R)
z@_O(A<h|h|$hFT2<l5&fIKPg6M)~_LxVfbnm-m_bb~sNrF7FeTApebV$!C1$^4}Vl
z{B`udpZpFy3$A@$!TXJ0$YbDtnmV%XJgj?-d@%gJxn9USw7%9U1K0P-;mAKh9t5xU
zKkC${{M{XH4lhzZ3H?WquYh+WPlNX--v}Q@o(UgEo&}#legeLbJRiP-+-IcQ*Cx2W
zURT8Ru+6xfmjcXfhjF<cw&A>I8kc;FovwbCamgnme+I7SF#!GKkq5zVkO#wyec~1M
z4z1Gw{wR4UJdnI4yf%3_ya{<E{3Y^ecqDl*cn|V8_(1Xm_(<|m@JZz3;Iql6!WWaL
zz}J#5fNv#V3g1V54t|V07k-vJAD&NMe3ZLR{w4Q=mzY=h{FZ^2BM*jGhU@h_0M}b>
z@-grba=kuVQvDFrf8FHeI?vhV`i~(m`@Qpi<Zr?Uli#=7<wufNgHM9%b-n=o%qEY3
zFQYoMvF;l31Msa>CkA!)kte{9kgtIMYU<1VULVhsJmWIAw%Av`ar->EWnA(fAb;1m
z<n?_~iTU0K-l5O`FOh%Pxa9TqtAcT<|Hd9S|0j$~UayDh<obG72d?ME_dQpqDS0O5
z^RlTU>sH0Ok>r1(|DIIm1nRs)o(msN?vH*Zn)<S@HaIUcjY~i8qn|m(C9lu<CFFV^
zttDS{-p%0~a;>wQT<iQuuID$KT+hn|ay`G7$@P5QB|ncoA6VdR(mV9Iu@fFhei$AM
z*Yh5XIX9tv4CdU*xXgJE=G@k}opYpd$v?H%%`?il<aKUu8JBz<@_mg<{tNUo*tq2P
zB0to)<n`-|(Z(eow9oZ3-uS)#Q9s$Z<ljL)#kl16BEQJE<eO%?`b&&UUeE6uay`Er
z;d)+Le&FitAn%3q^`ogH>;8Z~Pm<ra-_<!wo&wJ!-w(e5*M7>s@9Gr$)LYCu)U}_o
zaD9$7Mx7_gqv3U^P7?OjobtX0+`2E3H-SfxAAoluFM{*Z2d@36VP8YYwV$z6Cm!{u
zlFx$Ar#kW2*9!7U@Gr@i!oMR=gC8Q#glCgy!G9+|0l!9`55I3=;q!Y1?oWOj{seg$
z%(EtWAiNQID7+<k7`y{{8+do}Nch|23GhVnMEH2}B=}77sqjVQ8{ui>S@5sPkHUA8
zXTy(>=fZQyi{tt5C%GT|CV3h71B(iu-#~a7@-TR1@;2}~<Pq?u<Z<ve<ni!M<caW}
z<SFnt@-+AexV{c1;rTq?xI8BZ;W;qb_`T;pULRA8-+QhiKi9bA_4R9samknc!9A~*
z8<)Jkeyuky`N7C<GA?<2{n}w%@&}Rs-uS)#vEMA?lCN;k^>fs?<n{IIjB&~TC(Gr}
z8kfAjeqAEh*RLyZeXfog?dlXs^*-4<)X(93m4@r<#W3{wIQbXwr^uTha`l7B6X1>E
zy6)U0mv2q3{dA@}XR+>^<i${bAl30f{r4%q2KkBP=itfY?_&O+kgtY+4%dAZ$DB8i
zYd<@w&f}<)N!|>8it6O!eC3iC$9}Jp2f>SeR`|RJ!%LBe!vn}8;5Epj;0?*+;V+UW
zz$3^<!Ml;C!26RgfDa>I3Li(F4xd4u1z$*h6uz1~8@`!57ydoDAFhYP<YnMz$OGYd
z<YDj|<SpUF78mi6qlouk@~3e4qvTQWK=MR*ZSo{|6Y@#$m&ljGBgt35dyuEY2a;#P
z$HI#iaev=kq~yJA`b;)1&%?ub-hM<rFxTa08JEBB&a3VGW8+e1KJxS7I?r>XU48}S
zw<5oVd?)+>`5yRT@=W*{@-y&j<d@(@mv~KkM^W#;r2qSWcYQuaUJ~Aryb8Q2d2RR$
z<W1mh$;08j$z$Ln$QS(K`W#C>82QQM6X73`FM`h|-wdBmehU5>`BnIG@<%SZKEEKZ
z4c|cC7XCH)Tkvnm$H2cQpASDkz7hT-c_#cg`G4TQkQc@L&yokge<yDU|BE~VewF+k
z_$~5D@S;l#U$^Vv<;c&%pCsQ2uS$LdUYERco;#0?$qSHwp4=b#R^);3m&qHzJCL`A
zN0V=Z_acvl_a{$;$CJ;34<%m=A5VS+{vr9#@HynC;h&P9gRdgbgKr|Q@TZ&qPVy(=
zKaoEI&mk`g|AYK*tb3WfD)M*9wa=2v3SWoXXL&e3|Ep2{9n`O9T;8`={L$_AIpg<U
zr!F}UGcNfK$hR~u`Ps<7YFzSX54$?A8JB$9znpg`kAU}r>%Pj5b@>65k3l|>^7*4(
zev-*cKey2T4DuuJh5w_@TFS3Qelz(*_#Wf(bNflfTtA15OFvyOpA+QY!2e@h>ZGI2
zCF4@(N#w7S&w>~G+zWY!&a=!I*UzKmaqvL$czA8{M0gYOWcW+uDey@01@Io^8{q@V
zv*07ikHROBXTxWcUx6<sFMzKl_rZ0zm0YjSedK}2A0e*`{}rz9izeYd%{4CPxA+lv
zzVeLQ`|cLi4@dpt%L||PNcbagUAH#Ytwi1tUV}Ua{v6ehLH!pg{~7Y_jLW{7V_)r!
z+kJI0F8KuHyBU|f_8Dhf?w1_gFA2t_PKl##p6`*bLj4boOCA3QTz-~usWT0A7LeD5
zuY&7+myG#*MZOfii+nTuNAeT!Q{?5xxjuh~>-qf_^UpUf{qIDdSB%^F-!(4z8_3_c
z!u!BGwEpLK{y%J7^3VL_`gz2-)L)ByWw_3#CHk*t@=|9H>NFwm2ya7m#-UCW<;Nd$
z{q!LBhrdI0B2Z@(c?^6qc`|$sc`7`W`~-XrT<3Wb=j&_ZGKYicbDME{zV;fIyzg<h
z-%R6@*Vo_U<obI03tZ1j9{RjMeg%G&>iFRN`mFR8^A6dU^iv)E_!_tUmohH-myv(e
zxa76}O61yq5M2BB9q;B)hrBpEl<EYc|CfwQKkuNQmyOr(yf@y5bT%&eWyp6mE_r=k
z^)@c~Q^@x-F8Ku1PcSa|(kI-$5{*lKJo00WOTH`e6OBt=@5h<OC7+D^9OIJL`G00y
z@@sx}{VX#sd40Xu2-ouxiuvy{d8w0+b$=jljQXdj&Ro>_gYwsrzd~O7r0cWjDsM6G
z(0;;ErxbY%Jb-)!yaxGRczyEn6WqEj;CjEmi0dufculXh#ppA_cnvepZsd9$#u}G8
zCr~HOxYW_}IE-BHqxaxCpD^@4k-Q~*Hq|MC>+mz<HNAC9opN(nX58*;1G(<&TjNrv
z73%CXZufPFT=#VhuKS8d|2gCd@Jm#u4)%4^culXLe(2|pap_0DJ}R}^`@lQ&yx+oe
zzAX7wcop)SxK3)4_k=ej?+br{JPzKTd<48J`FMCA@{izy$#uVD$wwpq5qU2BWAaq^
z67s|FwdC3G9pu~K`^fcu%TMI`JiKhYns@4kJ>;(20^|42FRq6><n{7hzG&M2pZBM|
zKbCsdc`@TsCmQ(@aJ@c9;W{iw`S*|yB2R%gC0_y$CtnVKjXVwBn|uR&5czKSB=Ul*
zZokRozazhZyx@w<uORnDosHzj;2Go>;6IS(qW(|hm(kC!<S+i?`uUUmJ@^gsTk!k8
z`2X`R=eHQvElutZe}a58ybgIC)Ne%Y`?u?}8F>Zxi{$m-ZOPlgUnL&^??gTk{s#F{
zcn|V#;eE+Z!3U6Eg%2SwbJ^{8IC*XO2js2c<H@_jKO`RppFy4i|CoFY{8RG1@FnEG
z!B>(O!TDWF{y2OS`E^{kJIG^^-$&jCeuz8@ev<rm_*wD~;lGnFf&WFm0e+Qy5BwJS
z&+uYv3g1UX^*$nh8(x9DEc{9GYVfM$E#S4tBjAn5kHMcOp9+7OJOlnZ`F?mm^40J`
z<of)4k9;Qbv&cV(&m&KTe@1=)&(D?QmEm8KSA*{+|5~5J<jdhdk=KI%N<JNanS3n#
z2Kfm1Lu(6PKXu_1$p^rnB5w$Pj=USZ1^M&vSIDE_-N_^2y~$g_<H$dSCy;CXB=Wh)
zr;<0n=ANG`$sdBRC9ewKME){-FL@OFC-Nci3*-~w1?2PLrP2$Z$I{nb|K-TPMgA%B
zeeh?<55k+0>+608@@vR<AwL3tll&OGH~BB{x5>}L2a#WbCz9929Oja@gRdfwg?~>z
z7M?@C0RA`m26)kRh0n`DczN<a;dRJM7r67-mb^Z^GkG|?A9+Xktp986{Nwr__y7M!
zwlFjs!c1tBnF-^BA%rkAX9%-u)mCTyc&{3bAq-(>!VrcKCk!2iF!Z5A7{U%=2qBCU
zhA{JeU0sjMt{(5_v%UWKzHi5=_x<&_o{#Hsy{_x^>;2wFd@lI?#OuIcC;mD3JH+n>
zUq$>$@K1@q0sa;7AHjboKKxfZ4vCKp9M7G=cOkwvcslV6@S};J3_gQ+K6n|px$oF5
z_%G3RCsIxNV(70VUJZT?@e9FkCEf{sH}OlsA13|^_|wGS25%?+DEOPi7lD67ydJ!l
z_+8*59v!$}cKyu`&`!kNd3g`w-=og{#5Y2n!-)?E&mw*xcrNkd!DkVl1b#8`lfiE#
zek%B5#4Es;6F&?5HE_Of{ebjEYwfsw;c@f)WFelPeC=^_-*ogktN(>~&hM6Qvdr!m
z=Ua>W<>BD&dCPh59p!Q3`!IZyJnsAMP2Bk&1nzw6;d?CU7sB@xj~m~&;Cq_Kjc*fj
z<$2ub<5$_dg&sHhzhiu&9yj{Kps(_{(NBl|B99w=74(;S+~}jwFCzXF_WNRRHxA3M
zu>HJ~cnikoA>yszPZRG1f01|>_}j#Lz`Ka|f`3bV82b4e@l^1kj|Jg_m&=s}K9cxU
z@Lh>d1D`;=8vGFA^T9KTF91K4cmwzh;>*CxiM#zWk9Y_4SAe_q;-2SR<8d=jZo)jd
z-sAqfy~E>1|0DEwd)(+7F@GNRxY5t}(9WMnJ#O?DVje!{aii~m{soU4{jI3~25~oU
z-vM{~chr^E_cKqwS5PN?sO76YZhVJ)Wcg3TZ$W=HemoEbFIPX~DyvT*z82%ZGx4}u
zs~<;vB>3NmPXf;%UIadccocj(@oMnd#215C6R!uqjCce1b;Mi1?;yS$d@1oZ@F$6{
z0)LTsFZkQUldylgh^K&mOFRwyH{#R4hdwcI|CWG{Bt9Q}SK_tc6NoPXKZJM_cqZ{?
z@KcGmg3ln{4PH)s6z1oA;+f!A63+s^k$5in-NfgEKM3xQGu2q9j}v$6_j%&(xbZsi
z`%&i|;%>cv4DQxr?KO6NeM|Zs|FHZgkDK*=>1USz>T&-#vuTT+4<?t<KMDP29`}!X
z+j`vS{|EgJ9yj`LaNHZ?aibs8ZTqvQ$Bq6=Tt6HH?(!}}-eZU_2md?q72vtV*MOH2
zPp`B6IgfZI_!Y#n!50&+0>6X!0`R58Yr&r+UI+dn@doe?;!7|;KLU62^O3bS*H<1l
z<39<<|8G5R#@}7P^?BUrE1+NNaie$FZ$qC9-UKf<f104*!sAAN73RZs9yj$rf__Jj
z8@;>U8{=`KANjG(wWr68{$|vl=y9Vz9{Mzo8@;<eJQm!|w|0!@RN@`rdBl6bONjS^
z&m-OkemU{T)i&4l#7BWQ5KjYtka!9BQ^c#l+rZsCc@D>)6~x~J@1!~lQRfTNcVfPM
z?{PE!?%$>Q$>V1H-F%BY6}$;vZvH%u{T1hNqj&RXYmb}y?(g9o;c=s1hWRks<3@i#
zSHE3kH;)^A8}zBf9{@kZ<EGAqsB^f-O&xcib-c%o{)kVk?@1mvdbf_wAnuO;IpA)7
zPWq><Q$jprq2=?vI>z^0_+CZ&Htffnh_3)|B)$s#-^3&EeU^AO_^ZTAz&nXofqzbX
zKKKvB7lQvud@1;_r-Sgp%Z*zr_zuK7!N(F`4Zc6|1dM+=@rmFk5>E#|lXxchEaKVV
zRmA6mUrf9Pd=c?l@LP#Dg5N{D6Z}zdcYOF2>-t%bn|ZYa^XhqzoB8b4^=lqC`p=<%
z)8j_(*7Yin8~ub&?R@U?xY2iDJ$~cy{&^1l|2%H=Zax0yaiiY@*DdQjZuDKKzuEHO
zP4IH#;MQXTxSLn=ab2-9@ji^_IO35-HrL;XCxB-Vp9nsM_!98x#2dk96JG{iO?)}{
zWyDv2Uq`$b{0`!4z?TwV3;rbWM2y>u#52I(CY}x6MLZY$TjJH=zY(tik9%g|{(T$g
zyWzw?0N<H-Jg!&A5#I`Y67h||k0t&+>YqZq3;Yb?BT;82ao5iZ;;x?;5g&y*3yHhu
z!1cu4eN7|rNvP9I+<jiWoVZ($?ZjuIP6u(f?s|wH5B>MV-S=VE5qIBv+2YxO``taa
zPbBWXpEHKI`+iOu@hbEuo%p5TlZn@YpF!M>e<5*qT%AMQjsFG2-S}Tg+>QSY#N9aG
zP5j^J=L5vu_2CoX?s(XW`;`BX{z%-PzUgsu9L~Z0;D0@Cj>9h3CmuKYr=kDc<3{hs
z?R$?K{q~>R<Lyr#_s<I(Jr{_Am%IM_XOGoy>T#oY<2jtT+b=s4ck5+O;v4^I>!*Ud
zaa(%5<p+`8?U!`YH!ZgM6Ft3o?ia;#ztcQ!#^GFyLk{s)@FL=yePQd*1$X^iaINK+
z5Klw@uOZ%p`OrZ1XQTdo#NFQ;_PA2#CDON`P6zQ1!9S)tBhmj}(r@~u&Go0p&3HCr
zJmXt~H^IxzlN9KO6Q2&gBk{%Hdw{#~oP_;2k$408c{J5|9d%A3{v-HVN}UqY?}T|i
zmv}n(0*{+<=o)Ir=bs)o^Qs8?CEzYs1pU8{_$ctliBAH5fp|K22k}hs4~gf3e@(mq
z{1@US;Bo(F_pj@}o9DxcFNA(H@fPsCh>yI^j$0b>MDU}DCxM?rJPkaD_$2TW;u+xc
zh))B*ocMh3>xtKZHxRD{e~@?s_*29i!CxZ26nrJ|Ht<h~cY%LLyc_&?;;X^qpC7n?
z<8Zv%mUuk)Zp0J7_aUAFK8bh+_;JJwz)vGy1fEYk3LYh13w{Cdh2U2aUkrW|ad+Nn
zB)$y#e-mE={w(o6@K=dPaD3||o(TRq@loJE5KjjGlejy64trtX{+$Z_4#cy;#}dy4
z-=BCjcslX<;3pDa0DdO%CEx|bi*B{YhYIkGgBa#|;|yFcUFdOhysi76)nDRqqj%RE
zi#%@h??Hc^$Bo`y_ufw2eP88%kDEHX^;+MDJZ|c^>&d4)ZuDnD|E$N2{xe)pzT$DC
ze+T;4J#O^wbAk7XyX&G)z&8rC!T%x?Z?paUj`;i~mjCJ1F}}aTH@?lZUVnZc{k_$1
z3-0Q>I%7$H4D|aDpACK()meuAoJ{)bp+B4S%b_nL{o~M|OS}%b7Eqm5)LBgWwWxC&
zarfsY?j`;n^p8>fHq7VeiMNBlLA(Qe74aVMuZXV(|C#t2@J;?>_oLfi$;g{PJOzAb
z;;G={h-ZTTjre5n4B}J4rw}gzpH6%+_-x`m;MK%egI`8`4fu7$hhbgZK|BF`De*+`
zCyA$mzd(FBj&E;*yW^Pq9_EK0H|wq$*NvZe+^lzZANL(`cbxgn<EGBAuk1Qq=W$cV
zeeYuP7lSv!%k;<SOQ7G%<3>LM_hmbJ-01IuezeDp-re_&^SIIf2l@#fH+uK|_Jcic
z^uI%Yn8%IY9nVh!ck_ALjW%zNr#E#*e{Fdw@gu;`A>ILg5!J6j{e`4|5c*q4zX19N
zNPiXdEu^o7zMb?xLjNZ5?Y^<O-lsYXQRhq2FNS`NqK|ti7_8vs=EG#@w;}HSo~2}P
zH~yWN=lc@x0zZuSTJRHyM{cmWvWdro7ZOhfuOOZdei88!@P)){z;7mA2YxT{rQnYe
zZw7BA-U9v_@ec6!iLV6zlK3j{HN@9|Z`5x0quVd>m=9YKp9sDa@l5a(;@RK_5HA2f
zl6XD%$;6j}Pb0nzd?vU%PX6ETc0QC7cgKPAiGKq96~x{3)%C>PbyNfKUeswJ{tI|3
z@yJ@+&lSXnfUhL({v5~0#ND6!_=fm!)cJ$>w&0t+yng+f<K#}@yA$69d>rxp!S^SA
zH2C4fj|D%0_y>4CKONl7!w&4<64JXrFHr4qbKHIf$DjEg-!tIuJXq^-qo2Imj{icB
z8~x5Wf7N^3=s$seiN}rJosXJ4ZuD8-+WJd9ZuBXr-{NtjcYhvyxyOzEQ0Ut|ZuB>O
zhxy}iqdy7yPLCV?XV9<mxY4`ofgX<=eJSpDR(ss&r=flyad#i_C%D^>ky~v)hrJRs
z4qlEY-DLR=#8bh?5>E%;pLiB{I`Jy-6Ny)YpGmw1d=~LK@G9cVz%M2~vEJrdL_7`r
zR^sX4O~kXoA0s{u{CVO9;BOFL48DqZJ@{9|8^C`i-U7bKs{{Ara_|J=ZQwf-Uj;sn
zc*@Oo-2O&<GI$2@EbuABv%#kmpASBpcnx?p@mlc9h&O>>M|>&x9mJP`FD1Sb{7K^7
z;4czi1O7JgwcuUEC*5Ml^IPIs;J*={3O;nj!2LT7d?fJ_@Lh@5flna582k|8OTaUU
zF9ko9cnA0l;;X>RiT8ldC%zW^O5$-iUfoE182H`9Q^1>vj|YE-_(bqmh-ZPnOMDvm
zC&a7ow)^*g;O_e8<3B9_-Q(keT{^qZ@;^Opj_2;WXp7hEes|aNcS66l$Bo|oeFZyt
z+|+M_eix4$y*t0`<#D6m<5%0CeLQaT?tb$Sj~jgs^oM)g=-vI}3B+@8o;sblJ5Nmq
zcju$*M%$m+#M?2>)x^8OFC*RuejV|VsDB6XH1MUwCxbspya@b7;!*IoiPwO45pM$j
z8r;pF6L6jO1M#Wge-O_G-|Y2ZX9O=-=WOud#9f_H#NGAn9>m@C?f&3ye`VnL$q}SK
zAM^i2kDK|k%MW({PVu;zKW_e??Qx?&75Y4n8@+qpTk3J6zZ&{E9yfY7|1a>k(Z3J<
z#U3|$cR%t^j~o3T&|m9uqj&cyw|U&?XZ~pO-sy3pclR$35_jw3NssRp=#%1Yo##Dn
z>L;Q88{lrgEX02KnDkdd-$UH}IqUDKP95s3BmElG+2W0$6T!>*I{i-I?l`s-`aOxi
z0e&#mSpwf<iMN7JCEf;}M|=f%8S!rL^NII>*AnjqzkzuC?RLN1L3||mgWzsG-tmXk
zKk0F^AIGh+{27m%dE)MyUiP@r-wge09yfY--}Iixjs7R-KlHfKyZffEJZ|(;ezN`f
z*5gL+?wfw~xY4`s7yaRJqj&3WvyR|R@N)B^<Y!xdOOG49J74TT+^vfwa5vx9HrP6Q
z5^n}S(5qwmc_4fb_PFtN-&;O`>f~ZSW)rUmFC@MMyn=Wm_(jCq!50!=0e&;_mEiXh
z?*o67c;X#)d|HW*0)LHoGWh$%CxL%SJRN)u@l5cI-n9GO?XO($t%%PD---A_@D$>8
z;0F+|2S1W{6Zpx*SAb6=-T_`ryc7H!;yvJ(5+8<nSVuey{5IlK!S5$N4g3k>Rp4#J
ztHIwSUIYFS@p|xYh&O=u5$^=w^sRyW*R98Gh)3>>^uKl?9uGdAcp~^g#3z9tLp&Y)
z@5D2~bBSkzmlB^3ejf1}@GFSdf-ffC2!1E=Ch&)dH-kS-d<FP_h_3~I8{C~=p2hj)
zV~?BT-ZePxedcj<+;i7m|MR%f{|EXXJ#O^wzT;1i8+{M-o4g&o30|&0?)bm8$Bn-8
zmws7fgvU*Nci*v#$Bljr?rV1UxY4`&j(t3C^qJ7_?{TAd=a<8YyFa&h47fX9CEz~d
zWYW9y(P^a5g+8Bn)?GGllz0{R1;lH?uOi+AeiQLN@J8ap(4T)3PXd3IcnbKd#M8h#
ziMza?5?_w{nqF`>A0q4QIIQ)!*<Y97zA~~hcoV#w-d+C;^SIG}1bu?X&Hj!4Y3q;j
zxY6(No8?I!_vhPqj~jgs^r;><`uk8n9o)^6UgSNIcpvzg#1rnZ{h394Ja`rHRPc+5
zr-3gbo&|m@@u}cV#HWEjM!X9AdE$-WZxC+<UqyT+_*cZ^?zQ9aGx22b$bW-D4_<DZ
z)4;a^ck^Ud%&Q$e-aoIfA4hxK>_<1R#(CW6TcDrdaif0-`~6^#8~u0CALenRcb}&m
z?{T9~{@vz1$>T=<2<o5daie#~x9J`?`p2RFhsTY69PanaJZ|*QK!2XcjeZ977kb?2
zo$n%WH~!Ta|67UIf;SOw0)LG7O7Q22kNTG#pEro7fv+N-3H}xF0`Q-S*Me{IP7pG9
zxm?ZQ+k?A#bpysNiFh^mM30XRN_HgJ{vYgdGoH^upHBR&{%?6jA{idvBhVKeX6s~n
z+|*eF{bX?0{|@y34AMUg{Y>I7f?q)Vzu=3AzXyH;@sGg&Mf`K{M~U}=uOwb%f&{Ns
z#D{|S5Z@hq4e>+4Bk$UJZa*FaK8*MY;EBX%fR7=b2);M*Ex`{Wz72R5@x8!j5uXlT
zMtlnRdBiKhFC~5n_zlEw1;3N{j%J{O*L}qAg#Iz&Yr+4I_{OO78u9JG-zVOSI-e4E
z`|CU6Za(}*{A1MFqI2MWe;#~0;!l9@O8j2%3B(@)KY;ju!4D<w=EHHsJD|@Y-VHvV
z_@)@Qi;3?6eiQL1_#MO#1OGSiT<~Xz9}E66ahL0T;?to2g!qZzJ;W~nUq}48IJ^Ib
zzBh0`-T?iU#P0_mLHv2}9f*Gbz6<en;A4m<Zeshf7x4qY_a&YM{x{+!;D-{w9Q-Ka
z_kbTq{8{jmiN6beD)Ik;pG7<#<D5r)4EQYKhl7_AKLfmycqRBe;@5#+MEn8p%ZaZ9
zuP445{C?u`o7(;LD)G_a?}D4<mT0B@$Gy)<e>C*pd-}~b?U(ld-=CyE7y6;^+oEPV
zne%lC_z2<^;7P<U10N4=`njVm+3$M*=^uvv2v5J)koEmMp7ifQf10Ns<<-w2{jec+
z<7`i#8@IlG73mL${$fu*+N*yR=_{bW$<yb1^&3ck5A;ht{cb`1By{QjNWb?`YyL9v
zCs60V#M{6>A^sNlx5VA~@mJ#CL%-<<*5A#CIP_;Y@sZ#=6CVRUf%tQ%e-QC6z|)C;
z2tJkgyWlg39}eGQ;(rG}2i(k0^U>6~o7)|5HR;cTzMk}pp?{F{jnF?u`eo3+LHc*0
z|B&<_LjN7<H;=dbV-4{H@J&_?++W**Z$^A?@U4j-4Zbb$Gr)Hu9tGc(crExI#P0y#
zoA{&P`xAc&{2=1*f*(%&Yw)9q{{emi@nM_U@tQ(>NAS~$?*)D~@gu<ViJuByOnf$Y
zIq{3Y=Mujj{Cwg~;1?5r0{jZ%uYzAo{A2KX;y;1kL42#t?YP}fd^hlB;uFCiCw>h0
zOT<qDUrBrx_!q>B!M`J34gMRrS?{Lj?tU}=Lz}}L-#&$YgvZAPlFRU%VSA778E|*J
z-Ob}h|2p(zJ#O@iwg~<&cpczz^Z9rdJ|92S<EGB`cpiQNxa)t_ef?!3XOaG3=!;3e
z8u!=d5MKj+De;j_wtgM)H1OMqPXfQ6cn0_r#B;&hh!=prNxTI7BjUB--w<yD?<3w0
zzUfDHKe+Mi0N;jqFZeFR*MN^Fz83r-;-j#?jv+oDJPX{-!wWDE&nE89<CVl0LVpqQ
zTfr9+clWvV#2<pbk@zz3e-nQS{3+tDpDz-3&nw<0{wC^tO#D6YZ^7OEs>itfPWnHg
z-}qy@f6aJ~3;sJB>tcw<&3bg#Kf^t4^w&ebt;daiG1hOA$Bq6q=#xEe^e*rI;I99x
z(Ek%Xy*Uol#M^aus>e<JGw^(PI`I+UvxpxEJ{R2icHD34Uq$*}^uM0;&FJSn#9P20
zA>Il89PwW86~yDwpZAC-fPX=JJot~qv%w=>!C(b1m$v|XOX5-R9f>al--CEP_(b9@
z;71T|1wV;+7kD=DUhtXV?l>?C^KFjD&3u^e_OHjyd~@fc1yn!o0lVL?B|Z%NcH-l~
zA0VCu-a>pT_<x8`1AmKnHTcKG=Yy{%z5x7J;tk+KJ{h>*+rUQ<AGXwvLlW@>@V$vA
zf*(vg4g6T*lfb7E&j8OOUI0Fucoq0Oa5o<&VLmMIxS0=+U_R7(+@BBEd)(-IpufrE
z{_*NAj~o32JpaGf<3@iI`tun0Mga@{7n$^+9p^VZy*a)$<M_79<EH)=sQ)$9S%`7?
zh4^CdxKEAS`t`mHd^qt=@X^Fqf$v4U8$6A81i6kT9tVC3@nPUO#3zH75YGjlN4yC9
za^g|&>xox`HxOR}{vh$?;7<{61%HWnJNQcC-Qb@P?*adgcrW<x#D_g(=g+2}4cx!U
z;3L2{4mO*4ScrKz+T&(kO~Jg{&Ex*M*xTbqe+BgWdfZ<Z>EIg$+TeeYUi9Zo;v<`F
z|7Ux3O#MyzTLu440&(~G<^{yN(4VWRemZ>XiD!b}L%az55#kHMpCeuezJho?_<O{c
zfqy}~1^h?it>BSvGm7iiZ{%S+Zd(#h1mBT(68Ij()4?YaF9AP-coh63;?>}15nl{m
zM7$n+F7XENONcKAzlQiK@Fm2%!S5p;!F+q1_$crfh^K%*hU2lD&vx{KXUp5$-wfZ_
z!Qki7JFe$u&!rw^-wzo-kWW3&zF)J?K;C_^eZTnu1G)S6NncDK$lZPVNQ?WwSCe9=
zOg~8k=l)Mr^l79|#rvs>KAZHpcweRHt4Uvn_lp&MJ?UHVez~G|+g;uSj77Ji?*VuE
zT<GKQ(;Pqj@x)`YzpkJ0wb)3qqIYdw{d7#03`L&_?)1&j7byB7(kE?V11(VWwWP0u
zzEROPkv@WF_ic*4o%B)YyA^#8>ARqhL++UI2Y2I>h0kn~6@3cnTcOWT^qHhj#b+%A
zioS^S4bU%8^tGf<7;5)dqoQvjeGT+&ioTunz0h|n`X18f;&>N_c@Z=I;BNdopifrx
zDWp%|%;wEd^qHh@hQ2`27m+?`bIgB5UrYKr=o=M%6X_#c*!pdXzMb?@=(`nt59zz0
zkHb2M8Gmp${#nCpf07k_3h7&+&rtN4q)*+_)-O=>MWk<leu1K|C4ItHwtl0cZz6pS
z^lgg1o%FrXcPsiH(&uh%`xA%bM9lbuyYcUUK3UPHkUl-Z*3VG%nWS%qzCh6zkv?g-
zt-nCg*OI;t`bI_HMEb}!wtkzUZzp{e`ff$vL;5c0<8T~}8Gmp${#hezf07k_3h7&+
z&rtN4q)#1b>lY~cBGNZNzd+H~l0IQuTfb4!H<7*u`Zh)1PWoQxyA^#8>2tTU{fWbQ
zBWC=;-S~GvpRDLpNS}`D<_txjN&05!3lx13>5~#|{}(9wTGB6uzEROPkv?t*Tfa@w
zx0AjK`ff$vL;7y$<8WS$8Gmp${!?+kk*w%bNZ$s1hN90TecDboZ-JsOB7GC|3lx1V
z=@UoU`i+XdiS)J5w<-E|()U5%t>}A5U$nFBPaLj0V#XibjejTf$%;OO^qHe={R~B)
zN%|J(3lx13=~H&G^%p4mTGH1;->B%DNFSeM>$fTTcG6cv->v9-NZ$i}9Ine^#vj~`
zfA+4nKgo(dh4k&vXDIqi(x>fa>lY~cBGNZOzd+H~l77_gwtl0cZzBCd=-U*1JL%U#
z->v9-NMDj{`xA%j(3tTDcjLbb`ea3)Li)*LZ2b&HpGo@V&=)BBBGQi^YwIsi^tGg4
z0)3;RZzBD$J#76pMc+>P`OtSO`X17+hCUA0=`rIE?#6#witSIbqE8|H3g|NweJ1HA
z?P=>5DEcDOFNJ=AqOT?WsByM_qoQvj{X*#56n#7C*FxW|=zB<CvX|{o9PVRc#vj~`
z|0?K{6@3cnCy%%FGZcL$>6b%apy-Q8pSriLzd+H~lD+}@Mn&I5`h*F#ew(6iCw&d{
z-HN`4^u5r>;l3?q{K4J$7vcG7vZ7BReJAu8iawL{nRozNpy-Q8-va#tMPEz$lzr`Z
zHY)li($_=Zrs&&AAHSci->v9-NM8+o9PVpl#vj~`|7z%y6@3cnr|ob1lcDG{NxuU6
z0!3d$`biUQ{RN7?mh?-ZZ&dV6r0;^hP0_cLJ`2zByA^#8>06;+tLP(m9^l4*1@xo9
zd4DC5K60QPpGk_|J)dy(qtH)N^tn{O3;OwrzJ~N8|7QEMMA0{pegX8$6@4q|*Fe8Y
z(RY!)AkFq?t)h?Md5IgJmC%m@j~Rc`XB>p_SM=$mUk3d&MW0Lh9_Z&Q`Wn(_A8h-x
zSkc#$z6SbbioS*Pz0j{z^qr*7J;e5BjiT=(eFyX-@!W{VKM~yRuk=Z_{zOHeM*3#x
zrz-kv(kC5i>sKlIYSPz1zgW@NlRk2ot-nmsw~#&x{YpjON%}76*C_fv(yxVnB%Z6q
zj6b*=|B}No{)#@0^sAtss_3&xKRF%aujs2uza09-ioV{{<D-&(gJp`o#nYRQw#FY}
z`?E^Xcac8pNUL9~=p%T(=*F`Z`tjgy{1frsJ->8%_j&YGMW0ReryXniQ=;gjq_2T~
zv7)ah{j%e2{bh>2h4d?+?^g6Zr0<w)>&M|aD34D(xEr4y=#v$F3h5&!+WJ!!eKzTP
zrdWNIqOT@><P@u4tmx}Wp9p=MqHibtsHwJox1#SM{Y2=8;khr5X9Bnz&&1Pg{fUY`
zjr8@WTm3Xe@19S)`l)AH{Q^Z_OZ7)iv-+iqzM1sV=~ll|(RY%*J=f~jD*DLwcDw6;
zcfNg}49?@3Li*l9tDmgsvq-;srqx#|`fAcgi>-c%qHiF5?mw))P0_cLeo~3muU7QE
zq)#ig`cZgJ&*S5s_q*|&UvBjoiarzE>6gs0`YJ_VP5OzIR^O=Tn@GR7+Ui#*`VP_;
z%(Hs;IfKjF3tjvUcDw7p`ySDFaMq`iK61WoKUL9ZlRj;})z4S-HKcEXzEROPkv`!9
zTYtHtZzcVB=vOQHUeYhU$krdfqy6c|ClT*c@zaf``~H>tT!r=7q))vR<D=BCA$>0N
zjf%dB^oa{>{S}J7gY=!ycPsiH(yxJjt)h?M^Bgxm@t0vd!FhaANuPMR)n_RBOwwmS
zKTXl+lD-Q11*DJSeJ$zT_vn@=`UcY1qW&^P-$MF&=vOKFF4A{gVaI3WDErfmr|ZA_
ze9VpilB+PDiarzE=@(vY^;L?#n)L49RbQg$8%SS!jjg{@(RY&G{d>D>6@6r9ThH}>
z`C|J%8Jx!_h4k*<vzV&rvq|s%J-hjezJ~M}x7q$IQS=R@cYjZ8o1$+g{n|Ti{WXfd
zkMz}dTm7if_9u@|68K-^*=Thcir#%b>GbaJ<621iYP_$b`tJLv%M`u)Jk!;8e@<<c
zqVJ;m?#}_m;d4uu*YzhJ+|_q~PGr2IPbIzk{yaVw{_A_5cGQA@_XEGU`i^6o#^~Qy
z^hxICFnDpDnF?R3@E;VOhMQHcf33pZ_X%15tD-+;6S@DFDf}sgkBF1&lqmc^3g2Q=
zxlX#mZ&vun3LiN{u3xI~M-|TBx3N_tkt2r6^{-I)a)ob8-)C_3&r*1u!oO1Zk(<f=
z<nI+Y-)9v4cALv}$`$^Y!oODdQCrCMmni&Gg>OGht`k-G%L?C`KId}dlcDh26#lcq
zC(-9PuKpZ_zoPKn>GKFzr&!^)EBqIQXVLR^SN}$ZzpC(LdJgRBT%hn56wc3+U7acP
zoYV3972d1xG4y=T)wxjN?<#!fk+vltpHETv0}6M~!MM)x^qj}_^CE?JDtuph9^&ep
zt8n)mhWoQAJqK`grYpQr;qNJYKf3RB_4$6^@dp+C5W3%V`pF8vSm7@ze67Ndr29DM
zd#=LyKGEs7qx%uZPf&QH!oODdE_D6x>hpbv<IgJk9~C~Cu7_Qn>lFTy!udMc)tO1x
zpN`+E@HGlQn65KjopOb@D}1XY+mhGIQ3_w8@J|)K{jPHTsKOst_%{mA*iEi~mBOD>
zc;fDIo#_g{Ug4`1zF)Fjf0n{q6+UE)T;~vlFIM>b3g3FHT)#-+4=MaJg-_Z;u78Qb
zpHO&0id^S3g<q}kZiSD-_s)1-<S4vF;p-H>|2Vn-?)zx$`<9{~x|duhSK;?6`~!tg
z952^DPvH+MJbrJvPM*S_Qg~#7T;~9VFH-oI3g3Glx&91=KdtbMQsp`aD*PIS_bB{`
zedYRBD15oXx7|;!Q>O5j6rQxdTxX`jZ&mmjg&#aou3xV3c7<<sfL!M&g)dR~rwZTx
zK)JsA-V?9u#})lI3eWhPT>mzO|E%yyX>y%83V%i6yB{RiDOULH3jamnSqIDY?^F2y
z6rOyDT;~FXzo76wg-@9z*S}xkn;a_Zrz!j~h5xSb)WhWZS1SAsg~uH(*Ew6^k1KrZ
zbh*x{3cpI>pDBFO5pw-Y6#j(56ONSYoTl)r72d7zaYxDZa}?g9@O28`KSQp+P~mSW
zeCW|~om_?AtMCsLKJgg2{&@<2SmE6YKlE6+{*4M>rSRdIa-DxDyjkI&EBvtI<oXK~
z{-nbHRQSZ><@*0r_}dDPKS8dOr|^F%e3ilvm@L;nU*XLP-|R%W&J2Y=t?-d2$#u?D
z_%#aeQTWa$%k}dWUa#<v6h0zLu78HY7b*Npg{M!E>))*Kj}<=h6uC~R!e3PQE`OKn
zR4e>Vg>OGqt}|KT_b7aw!cRX{u78`t-%|Kqr^$8ZDEwZ9|Ecio)8+cNEBtMRkI$Ct
zR4Dvk3Xhy2*U41)1qy#h;iJx!>rYYm{R;m<;d`7V*RN6diwgf;;Zvu{^>0!58w%g{
zY`M<y3cp+7UnzX_bh-Yy3V%l7KPdc!9J&6r3V%`IyX4AssuljG!pG&wbuLx-%L-qo
z@Y83=^>0)7TMFMRU#>Gp;rA;1PlX>_AlIL-@c$}&LZMve3WawmeC$lQ&RGgyrtses
zzRxVVeyze^SNJAHa-C@ke@x-OD?GJWu79P%KUH|jKjb=REBtPScPf0}*>e4J6~0vA
zo0iCRrYrmjg(sBCbxu?G)e7%c__#8;evZQLQTY1`-@jb0KTqKgDSVB>PmId-uUB}x
z!grk`*O{eo_x)>r&i1LI-@Zbwf0@FcQuv5UxlW0~A5r+13O}_<u78!nKU4UmxpJLL
z6#j(56V8$A6f68;g?B4_+_`f7OBMdI!q+K0qgt+iuEIMMzUMr-PPxJx75<09PdiVp
z|FFV;Quw&@<vN!t{AGo&Q~2rg<@&cN{4Is=b%9)Gj>7L%_@4^TzEG}zyTadA_z@S$
zb<R<Ex59U*k?T|_{8fbyzgVtwjKc3wc%Q<jTq4)MU*VfvD(j~y{4RyRtMJqXa{Vh6
z{)WQiE|cq2DEwavAA7k{N8!&ae5)(uI@1;2r0@?EzE!PU{|JR&q3|w+kG)c^f0n|R
zDf~Bu+v>63bB@Obciwk@PBuZ|iNxKXV@>k-#`xX*NFknt_mK&e^Gd7oW&}U0D(uf9
z_gh6_N#2C2!s@EXg#KTP%ZjV~_Z8&@c~yCKV@}SDxwCSD0wsk3=-*%}`oHfxVPB`s
znVnyeABguVj^^d$mzR|l=2t~>a%S7U<OB_i%Vt%sS6e<n-QT60pp93lpt#Z%`)jk;
zRNCyd&Mzs<tH>!VD~OgCmsRBy1nK9=T^Lm8RjeqiEUfygqF76lcvXUKn_(TijxO>l
z<<FdzQy3Nd!JA@Q<&@=N9+*M*M%A_)xH-0UQGuBY!H~+W2W%Ew=lnGf)d~Y8u~kaT
z3(VwHJ27y3Z2P=fvjz<@aC>a~g2I7{*g<4PY>kTYxmAOPAVF+}qVkepwd<oWaC>a~
zV1EzRe8A?|)}@72dFH5*Q<_&fd$2l+Ft(!UZ_bQ)Ir$~Ug=K?IQB4_JGry{$WU$T+
z-0ro{D=5erFqgf39J9@97aVNVb}`$$cKPL{rNvchQ)#o;+8%tg{t8>YwzGmGo7OUB
zo7XNnS8o@y&1;um9-XHe#%}alV%&4073KLk`Bl~8j@3n8CG3g8E9oMylCi6(%Bh&!
zf4Yo4B8l6*_Qqte_TqN0JtjtlvR>@0^0#_z?Y!_edXqeMqu0{Ri=fw4Gvvi3ZT4E5
z*)d3KX|vaQ&fLO^d8U1FSwW#Z2Q-OSrL<sXe-U-Z$pWu}*|RfCHn8hs1zrWSZ({}C
zK9B`oh5k+sT0&8HH86vMD&l&QHhZn@G|?IhThTVJq@+AQud2{oZUk3o=M?A1o(u=o
zczrM>%q4A3erbW2K^9Pjg3{m$c8~%w+qr$PHwSIc+r9Rc!NqD$X{CHVj@{_BtSFpS
zTv=6EkrSO;Qlgd^MCH{gC>%sLU|J5M^XmPj3a-LuiaSP8Xf+027kWJ!P-mdZtL5cW
zd!%Z-I_6%$Tma?_yw3FcqbR7xocyx<(wyKnC8x4j+x1mBii&Dg2KQOPt%WHT4Q4~>
zjN(#p#7)lz)p~WSs&fkDn+)2*ZE{NI$|r{Yb_2J1ZD&>#7UopWmM>~!H+n6DRC9w-
zoL89>Esn+>NX*TtCh@9N1-Fd_<>!_SUT6@NSIhLJ-%{QSv0JIFb5Wbe3aG-|XmEL6
zm@})gIJnvhp8iXB3Z|E;&Z~!;@tkuDiuDoJMP8-#x9)=%8&v1jD=h23r5?0ns>ZA1
zZo3C9q>H>t!8vbkY2o1MRE<}sa&BeRoE8S{kuLHonaeR#rLrooN}dObf@)Nj7MA7&
zU9YMLZqup?^-{Xft2m>gJg*=>uhRBy&fN0gUb3PvFTcoK*om_>WDCz@Zhn7o6R%)K
z^sgse10H**nt^qKQ%p`p!Mvl66uTA_5d;G(^q*P=uOUiMrK+&1C}&1Ralx#@{;Qps
ze&_<B!us_!XdOu=RMQ^T`CW?9c%x&^N`u_?OPjscX7>)#TG}kO4i1GS#bxrtjP*rg
zR9-D}jcBe!W5(2+fnqmOOM9GB+wx{=jf0cgJZ3w!ubfwwpA)R`{HXk})O26eP@Ozc
z<Xs$@Lb8Y|1&e9}{Sg#Yqre=lg3myuv!Cfm%yzGRX;HDguP7{=Ra_=tR;U`Ujyo|L
zt$KZ;i@Zwfmt)SL#Rk=R_0Fv*4lWVql;%ZqisfUjqVQ^%`{3Ymy0D^RZZvozlvh?z
zQYb%N-GI`oSy5P8evUcJg(<sX@qo&eRpk}IWhTz9gZ0;(>IT(%b!X(6Q{$|hg1M#g
zC9^E>DwrcoVKjK08jS|m^5TTmBwm%`N^=qo{<1x3!pCm(S_V(ms?EdK**WKwD^I31
ziCATBS%^9;@+z6IMd#*J%~LMu#qD1EAgnzpU{2<olUJfl@(oG7s>T&%H?*fT8C9$3
zzosgmTajOwGqa++RQq7ZI1j3&y5{DzG^hVVozfZo#~t&qNt_p^^oHbAy{aOwtTI||
z9^(zRgESdct1K;@n^RC;npa$=c2LxKb#Q*m3D!?#&bfJI=Htl9;P|e7R1>a&=U|4(
zo-@u-dl|FcYae`6Q<zt2Zw&^UJcH`IdilXh4-Vhv(tfaVgUP&VCY`xi430s?Wi!jw
zgrdf)6C5+6{e|*_V{2KV{2)LVd6i6$&MB;@EG`dj$@@P^Ry(E1ylU&85e3&`{m00h
zeECts29#dS;^2}A%N#eE!SPeRFWQjQt6EU_S5-Gh)v_DZdUfS4<dl`?%m^OF%GbT2
z+ju_i+!~xe?O|<DhY)J7Htw8VX>mfR8m~@_tGQ|wt8GB(*9_)sMd6&e#TA7G<|*7v
z^ZC-uV&#(|b5pYcwO8A$h2m&_PD%N!8FS@_shUKs5)?aEj6AT?K$%yqqB<v9ULr5>
zm~DQ$!u)x`cQpDB(%R#`3QgnHG2M&?pB<<f25$6P2Io;66$hV4gUAL}3qGkS3=YK`
zs;0^YRx=mM1%>A6PhnZUd?^<s&{Tuf>c4{%$1A2FNe5O%kPUZo5aGazW+?>M+Z!B0
zUB~t8$#z4##GPzobzIMW(4q~VJ87)nKCu1z4;I!dyqn@+_$9@_8s?C(!Q)C$N!Jam
zS5{tC9DEEKe8d+Grf+bX)w(u_aA3vavb_AN;&Y0t=H*lsmj)k1s82(JZf-!lfyyy=
z?gK|Nrg)5g1NHTZwgDr(;RYSUP1%@e@*JM9{!4um%x=gJK2M$4|663jjLP6D#eB5e
z|4o}<_ZCh#_M}ty4xSLZ>wpObh31QZ_EOOPo;PDgg*)0}bMU+j&qV-cR^*ii#5M>n
z+U$&S>T;Z7@jkeRm=!!m{{Qka--FyJ_-_bROUL{4=7AgH2EL8#6udVqop{GNwqnQk
zrg|ij6?_@f{N}#r>At_YSHL9y8u%s!+x-{&j}10T{tZReDHDy2|0coj?0-nWjKBX~
zQPZTs<)#g;z0sK0fx&;0e-HdSjcM>Q{+k9rU3-_`^iTAE#I%Y;dTGaS{-Xko<lkCi
zom$Nf3SP#4Xz-K$%^!0%{`&?0`LDVs?Yo0V`qXL-F>TB%H~3F#|H^A-Yb5gXKK7^k
zf7j0aG=I#+{7%ChY5l{taQ$`d`Mvq$OH%%tTB~&9Z1QgrXkB~9uMU{x-wyvFrjhq@
z{dVZC;1{WVN4!<K?=L&O^LOuW3x1LMUyuH$LTLKGRq(rO@B062z$E`J_&Yty{MFvQ
zH@jK#Zx_bTWO4PJ|AzsS{Ch&??^OJ|g#6nG{%aNgzL5EUQT!9Gv`Jk~GyY~NaQ-nt
zcqxBmGeaYh4ekG=KqifU3jF>3zn$QJlH#8Lf7jps&Uo$J`{NY<Y$3lH3s=vL%N)f&
zF=YM{#Xl<K-%;>itoWyd%zusI-yq~4CHOz7_@{=<zfAFO5%P}~{6A9s(?jNePx0>&
z@+S%YzbgKjA@i?M{3BP{ndZ;`-30%U!MY4e#GF5}L+0N)XfLh5RQS7jZq|RY;J?4(
zpBpm&1jRp7$ZxK7c>SHC_(wzLKT+|o7V@VE{&N)n>X7+M6#qIQ|2V<FPVuh|ng43V
zzg5UTUhscZ@vjS+{~^V{Q^-F-@P9|~ZwQ(HO~pU{YCF^X`ES-D&%d7)|E7@nzgPT|
z;P0=0bB)UW+XdIx()w=+nSXfDURwWILjH+@|AC5sYsmcjD*i=6esizE`A<{)J3{84
zqWISf`O^gdYQ?`ZWd2IUzgftCu;71-;@=Z8{|$<Nmymyw;QzGZ-y1Uj<BETukpD2j
zf0g1N+1#v(_4B3wjqv_m#Xn_X?D|jl+PmYzTE#ye{t3<)Ki&Lw_!q@L9sd6MKT_}?
z6)aw9{U?UZzkSeNTK`cYe}>?Hh~l3VGXH^!f31-J7{UKc#XmJ<{!<nI79oG8;D4#&
zpB6Izg^GWNkpFnWf2rc188ZLB6#vLSW9R>5!T%k_KPzPZHx>Ux`1|w!B*EW2RFdX@
zZpi$<EB={6{w%>iN%1cVnSZCCeb9wSdhnnB$`$gT5(wP!!ySLp760mx`43V2>xBGM
z1^;P^e@)2zrz`$VLjKbP|7yj*E@b{n#lKU?pDp+=R{ZNj=D$Yq?-lZ&Dfl-l{!JnC
zKcM(0Es9<L(**xF6#wRs`Cn1|)8Ox~|LKDNcZz>&$oyX^{zXFmT)}@>@O)Z2{<Me8
zKQw4Bt^XP!{|v!@oZ{aZGXEIGzgfs%Aow4n_;-cOe}v-SF65sn_|H)Mdqd_wTk-D`
z@)rsI7b^aJA@k2u{1dLR>(8J6=C79H<Nqy+fBY8Vu77V({L|s@&NJrukNK<Q*#8N|
zKLP#;K^y<&+B^1$;-4+#H-8nJYw!BCQt?j;ng0#NzgEZ}75sly{8K{aU!(Xp2>B}n
z|IxvRTGH_+EoA;3g7(t!r$fkZKC9yKKT7dW51Ick#lJ_$e~#c^r1)or%%89LC*mK1
zbo0#2|7yX%R`Jgcng3G7KNbG|`Zs?y8jpXI;$IXp|J{mzu8@De;NPzJM?>a+LGiB^
z@?R+U_bC1~A@hHx_%{jpYXtux!48quUv0?z8wKs9_17xozeMm)R{ZNj=HEr}?-lYd
z5d4o&{2M~%pQQN5UmI))UjF>QT=1W+_&0~le}>|p27iD3*9!g@DE=)W^H(eWSwjA+
z1pg(9e|yOMH!1!#LjHw<|I><pN67q-EB^ID{zZcS`-*>8$o&6R{M&{6b%OsNihobY
z{C$dlmyrKD!9Qs;`S{ZpGXG9Nd+GR-a9z-`;N{Q%#e)A4ihpF7z5Yz-ud@FCY}NJe
zCn^3Z@b}mMje`FS#XkZ5?8ooVR{XPt{PlwWrHX%I$ov;7{!t<SErNfe;-3;S{~d~d
zgOGoT;Qt@RKQ(0jR>i+X$bY-w|Ape89y0$Yihqxgzd`Vi-&|gQnIZFU6111rU*vi_
zQ~mjWm*786@y`yKe~jXv3V(n7Hwym8DgL=3^JggjnL_@11^*(&KN>QBzT#gk<ZlxE
zFIW7lL*~C&@vjr|-!J$#D*m-0^WUNPw+i`}3jXbie_hD@FDU+<LjH#Y|J90rL&*GJ
zD*o|{?fUcQf3x7fW$^t->H5DZWd8V|y|n(5;P0>hM+E-~ihoPU{Cg_?SwjA0g8xa1
ze{0D6$0`0rLjK1E|1!nDBV_(!#lK$2-y--gQv5qZ=D$+$Zx-@DCHOz2`1gd&f1l#t
zCFEZ&_`j<7_lC^>qT=5t<bPK1?@|0CTiWYSzTV^apDF$+H^i?0R>6O(Ve<NqhkruQ
z#(%N@W<h&t{inm<U;obsg<N}gT$-r(Cx*<wkK!K{^0x{8(-i-tkoiwn{A-2$FADw(
z6#vwa`7cuZTZH`Wg8#jWe_F`=cPjoJLjG3-|8~VcGi3f36#vMLvGae0;QyWCpA|Cy
zSBifk{Qdd=y5K)@OL_g}hRnZp&|X@9nL_>!!9Pv$FAAA|f5ksn$p4n$KTYwk4w?US
z#lKF-zf$nOQ1Pz`nSY+*-z4OJNAPb@{OdyIzg6+?6!Lcp{x2&2^&#{BpW@#u<bPlA
zU#<8zh0On@;-6$53<fWEo-v<)tP=bax02UibIAN7g7(t-OM}0^{y!4@GZg>UkogZ+
z{ELMAU4s8~#lJmd{xcN+8X^Cuf`7H*-x)H0rQ+W#<nI>zZ&dudLgv3#@oyLMe<AoU
zQ~Y~F=6_i6?-TO(2>x#>{(T|yuTcCG>h1dT=l|D&|96Ui{8r(vf4@@v)8X&0|J8#3
z@U7+bp8)@appE~ssn(NWL3?TaXAAki3!1t1u3r-s|D=%l_fh<7h5WsO|Cx$^O33`D
zD*g>Z{vQPY8pS^?Wd8FN{|+Jl8o~c|#Xmh{{+kv59wGnFg8y>GKPzPZClvq0o9#?<
z^UR$8`UL+E760sz`8yT=RQUVr|2M&Zo#I~<GXJlNf3A>!t>8a4Sm4t0uV~2py9Vv0
z^<ORIUnlsVr1;l_%zvEX-z4NWLHYPosrc81%wMMXw+i_;7X0fK|N4;muUGtgh5T`X
zf2-o(5HkPMihukqcBE5-eQsW6{S6WPdldiXkoiAT{L|p?uYdDLs(Jqp8!pfPmXP^}
z2JNN!pC#lsUnyk&RK>qNWd6Mr{~95`d8Ehwrz-v(A@gS`{`EqBQ<DA9Q~bL^=AWzh
zw+s0b1pnI=|DKTfZ&v)fg#6nG{?9A^eIfHdqxdJ>YDe0i|04zeFBSjD)`2*91<Px|
z%k4i0KUMrw;P0>h?F9c}+sNxL0sidA?}rBMrS+FB<WCg*Cn)}jA@lF4_(z5OI|}|;
zihoMT{3j^>4MP4=g8w|lKQ(0jD#gD=$Uj=}zf18?51Icq#lJ_$pCtINRQxkT=6^%+
zkC-oZ1uuX8?<V*U86nUA?2!343ffEaKNbG|`cD@8$0`1~A@h$>{4<68V+H?{6#r<*
z{KqN&)k6Lh!M|MbuMV02ABumSkbj)uU#IxjhRlDp;@>LdA20Yns`%H1%>R($-znsu
zAo#zd_&0>i|EA&}f16!@{`^lB{C`pWn?mOQLGe$5zrX(X6Z{iL%Im)+Wd0FBdujb=
z3Hc`q{)a36ts(Q9zh6u8FB0+}DEQA*{5wMC&r|&Ch5TuP|5b{AXUP1QDgMnu{(}Yo
zhZO&wkooUZ{JVtwlLY_Q6#w3k`P&u$J|X{Mg8yp8KVmM{gBM@#@%t|o|CHNf*MGX;
zzs0ul`iqDEhOU2y1ns5ypALV2{U0g#k5l{;L*^f&_(z5O8G?V7;-3^U{|SnJt&sm1
z!T%h^KQ(0jIf{RakUvxKzh3cA3z>hB;@=_UKVI-}R{S$V=6^u(kK7SE|0fInZz%p*
zA@jeY_$R{OpZ_Nb{@*G7xgqm^rTAwG`LhK7t+tcbe^JQ%n+5Hq^`9%`KSl7Lp!ipZ
z%)h7NUnk_BD)^tG_}7HYf1={wB;-F$@IOcKuM3%fj^f`b<j)rTZ&m#3L*~Cx@$VJ#
zpDFmaD*jC&^FOWlCpE;b|7n8%r;2}b$owBF{%P>{*Z*|EKW=+@{k4Y7|EJ<#B;?N(
z{F4>`_K^8^3EE5RzedPEL-5Z~{5wPDKV0!|7V;Me{zZy^SIGSNihsM1f2QESQ1R~#
zng0sKzfZ_tB>4YZ@$U<nf2rc1aHm~={`~)k;Qx-|A3r=0hq(TIQ}IuSzkmN*BKWUU
z{1f1x(BF&o|7TOJfB&oEpDpAs6a2>p9W+UUkB0`ll0xR+HE1ubzgi)GRPfJK{8K{a
zKT7d$5b{?D{{K+?(?aGiRQx-H{8fVgV#Pl_Wd3Uu{~jU#IfDPQihowf{7)+WiFd`G
z|EdN5ZxsLRkomt*{8QoYumAG||HK{S`Ck+=|A?TyH2-sj{PP9>48=bhGXLR<f3=YR
zLcu?(_}7HYKU?u{67tsw{?{u0wITB_RQy|o{Fey+k0}22A@e_|`1cC=7YP3URs0)5
z=I>Da<L{0=|6MNl_bL9(A@l#J_@}`?Sf2ea^ZkQb!GGHw<@MJRGJitQURr-yLjJ1+
z|NRvI_K^AaR{U#({0jyDQx*S?komI||9T<+BEi2}@$U+mzf$pU7xLE${<kUqJt6bg
zEB;+V{_6z)=N13Hkolic{1X~u&wq;r|4$YF$TopEcx~wV??c5u1^)i|??%CY<KW--
zFiw2^mjHjh-sJaxDE`?({(8ZGZ^b_`Wd4+(y|n(LLjGF>|7^uSC1n1;EB*~a{w0F{
zMT&oF$o%Ii{w+fO+Xer7760^*`R`QxdxZQAg8y5Je`d)1uPOeKdt%RjcM1OM6#wjy
z`F~aXQ{nHQ{~87Vy+_IGFE?cVl%Tyd|1*XB_X_^g6#r<*{HH7a)k6Lz!T(alzdB_8
z3l;x5A^-h?|NV-8ZOHuhDE_TN{-uKd>xzF}$owxW{+&YphXns06#s^h`M*{C<L`|<
z|1}H#yYDQ||E7@nM+fbt`JV)T|NQre;6GLIZwZ<IWW_&A$iGbRuTuP5L*_46{ELMA
zj|={b75|Qq`L9v@>xKL+g8y>GzcXb1Clvo?A^%f?f4Ab_6EgqDihq}of4Shl#b|l{
z_lC?rBxo<q|2`rAvx5JAihpE8AP!!9y~pqOR{T@`6}$dh1^?3&|9JRs==yhx;-3zG
zfBio%_@AfvCx*;FSMiSu`P&5lI~4z<koj*>{A-2$FADx`ihpXz{Ld-=Ekgcw!T%e@
zKP_bbFBJa{A^$6a|2DhG>n}58{w;&{()x=u#m@f~g8wANKPzPZzbXES@b~Bc>w^DG
z#XmP>{yfD$Q^?;T_+P8|7lq8fQ1Q<d^1mhcFIW7lL*{=%@vjr|uN3@y6#tr#`9D+q
zn}q!D2>v6J<oRD0GXK^=dujf63i&$)|4hZdK4ku*6#rf!|NDafe8s;hWd3s%|D^k3
z*Z(TP|9-{4Ib{BO6#q2%`|JNB!M{`SZw;CMZN<Mx$loRSuT}ipL+1ZQ@vjl`e=7JV
z?JCdz&XD<c3ffEazgfuNE%+a=_;-cOf3)J?F6940@UK$*dqd_gSN!{g{5^vIU5bBS
z$o#h{{t5Tn_2<w3uLb`O#Xo*zAP!!(O8>9o`&SkJbol$ve^v|rKPvtS@K0E8E&6|_
z_-70GzZ3ko+fAPTNg?wO586xfzgEcKEBGI(_@{)-pQiXX2>E{y{0kKSw2=986#ot(
z{~E!+M)6M%ng4vnzemXbv*5o(@y`mG|0cyh@qyU$U!UOLs`zJz%>T6Fp9+6}{r@KT
zcPsuyA@hH%_~#1w*9!g{?JlpsXvq9)75{1>|2n~cwBlbAGXD-idujbQ3Hi;3OzwE<
zj*CYt{<R_Vrz`%gLjH{f{}RQ&K4kt`ihr+=KThz!Uh!`TnSYVuAHOvA{5M4Ke@gLh
z4w?Tk#Xk-HZa<sP|KkP!F2%nkWd08n|12T@=7Rr_WO@Cyhs?iG&|aGVHA4Pjg8#mX
ze@Dpt;}!pUA^%o_|1`zFD`fuD75{c2e}dqDnd09QGJlQY-zDVVM(}?~@$U<n|31Y(
z;lbGRpZT}O`S|ya;vd;II9La-4PF1esraYB-#`CtC-|>Z{1f2s`rF@`;Q#pjuZn-R
zkUvrIA3H`~e~BUU?;5m^3;LDrI*6Z9A^(no|4E8}O33`jDgF&Y{!xN|nc|-sGJmn+
z-y-B6E%+}|{L@3`zf$q<5%MPq{>_SiX2|>xDE^U$>`e9N|89c+TZ(^n$o#J<{;BZy
z&wt5+|8I(aZpi#UDgK#4{;`7pZe!*37Y&(z=b*i`{;GxiDT4nAihp&;{KqK%bwd7e
zf`66bUmG%ix#Hg{<R35i->LZ5h0MQ1@$VG!PZ0cHSNt17=6_l7kAK*%KY#wG3jXU9
z|E7@ne^vaG;P0>h{RICBd&u*@C1n0RgZ9$=&l2)a6#Qo?{;eVN&rtk}g!~5z{tb$M
zN67rQD*p9C{xre=J;lE>Wd4<kf3uMPV8MTz6ubX7q3eep_@~hY550|S8MK%7e;54g
zhS<X9{%4Zlzq8_>G}>POu^+!rRQ#ilTcyAL4io(M4%!<f=TCvZ`S-E>m#w;<>=(2*
zJ$38MZE@`%qQW+nZDX{DpuKD7e!jD-Q#xXQGR@jR``64vckeauT_kcs&|cbqwHUvq
z8*Koy|Be#IZ<^wN_Ym9e(%|nW@n7s;uCyP!qisLtD8KdkadY$^O8-+&4E|#H;MD}7
z>Hjf8|7#Tgth23ucJTS4|BCnD1izoJ_;<oTYcJct_-6|K|Aar!pQicN|5p4vY|hq=
zpZj^6(*L7s&0dW}#`e!n*E)9m>XrVd%(LT{xwma=`hSAZ{|6QS;@VC78+OI7_cp(|
zemmNv_(#n@j1au)AT<6b3jV=g{}!`$`<wjBwtqUP@4wjJybsF8yt1yf{ZF~UZkiH^
e#s)*`;<)3AIXu`sHLyhWSbN}`k~NUC|NjHzCTIWv

literal 878352
zcmeFa3w%`7wLgB&Oy<mlM+gMMBajS%Xo9@L%b=opfP#uV1VwF|HzWc{NP<Gq62V8*
z+CsJU(FcgOC3t(Ut=fuDgxccmZLfXUdcEy6fc9c-@3qzk)GEL4ckO*<_Dp6tiO&7~
zZ-0O0LuU5cd+oi}UVH7e*Is*{!{&JxpYOA6%l+8a53DHU=33UaUkr!<rIISOmiiX?
zKHT(d*N1*<`~8;nX!u6!ShwHa^WmoFcJK37{u*f8@V6a*cOCNQ?Kytp#PAsWxz^)-
z!XIyK=o9`>tHc}snXY#h+0uu<_^mzd{jAn1+gcW~JC^$Fp{pT`W!?U)J>Y)=`_b7t
zW?Cp<6}LIo_5&wQNZC7!%DO(>v|sxC;ikCu9MxW@m889Eay{Bp@(n?jA-nYWLCBfE
z4Yu{DWuNzJQ`Q(ak@r~0y!`ZzrQ|o=vWBv*&o12yc$<mCa?2X~E6eH_;<n?CPYk_)
zH$C5k6w({$O|N`n3hAYL)7vsRh4cn{)7w8ah4hAb)7v#Yh4e;x)AP+rA-yr)^lC~{
zNN=n+y~AgvkY0f|z4AFJq*vrkZ`XM#q&LZ%UVeEB=@om^+cGzW^k(*g-UTV7H`|+@
z@4^()o8wJy*TpHMSLRJ`%c2z0o99h$*OC;{Ti{L4w=9M97JAdGxh#eBmUz?KvLc1_
zmV49Ne`N~kUExiy=F=&p_i1l>yDC#iuiBelc})uG)qB(1RhL3~jo$R~SEZ2NT5oz=
z8dFGboj1M1t5ZmCy*It`rWDfK=uK}|OA6^-?@ceiErs-M@TOO@K85sd@}{@z+7!~e
z)tlbojVYvehc~_a>rzN>yEna>&!v#wm%Zuj>PR8Id%fxTwx*EY*S+c0+>}Ck_j}XZ
ze@hDKebbws@3s`u>++^o{`nNr`;IrgEni3>z3+O{+rK@9^d9r3x8<%B(%b7z&v$nU
z={?;GdiSM}-gDmcYQCOAde3{)JG>)>^j`3$=i8M+dO!81xBtP^&^yZb_0LO>cQSr$
zSwl`1!#@12)X<ce`Agn?-1Sfj>HV8Gy_$bYA-&&enV#fKpypvk&yDqaoeQ{l3C{!$
z^`d`|q_BUl_k!MIsi7x2`i7F{jUGCh|AW-f6dnCjFZ%d+3hDjXo8IBQDWvzVH@%vt
zQb_N(H@#iYq>$c+-t-RdOCdeG%<~*D|3C`q1-$9iJfA{(>E85q{Wyj6271%;{c{TG
z4fdvY_$R%m*L`Bg(v#ZkVczu0f7W|?p6A9Rz3J_LF@^NTc+)HYWeVwy?FGG;Qb@1B
zn_kV!DWq5AP0#mA3h7PqrdRXZ)X<YPzPRl8Zup_)UTge+D4Oov`b2)yOz%D(el<0H
z+)ZD5cG>ay`mV@e+y#lh19JFK?`ef`hlM`7D~E)B;T-S&?Ru^EG(BxhnK!+|zfU2(
zdEWGPy^%tC3wlBCk13?L(3@WVTPdWs#GBsXw^K-Od70XKo@Af2<sC)O)$>m@-y6OA
zx8>aw_HV5>z5T~hNN=4ty~7`*hMw57^(VJy`5*S4R=2v-cXE67UGM&tf7E-LC$neL
zznf0pznT-hr`4<eUGLq$UDge$yGwY3H@(Al3h8~?o1V{~LVDHS^zzeENbgo}dgXx>
z(!0Z(UX7DNdfUD2b$L+H`=s{zDE*~+<r8|wCR0T7AZdQtTc(FYDU|7B-t>I^Qb=#F
zH@))ysi7w}^a>9fI-vKoyliL)zIEtcr8Bs9J;ZA-;mhbf?USt)qBr;VLau{SNbl?3
z^lCCwNbj58^mYwSA-yhdTeD?|qW4K{jf~%Sy!%&^mBRi#-3xldQb_MPZ+cs@Q$z14
z?dbDr{JiGiu92ysDP#D8cOQ4<q>$cEz3J^AlR|nw_ns3qd5T_2=EO_h{mUPln*Qyk
z&iotb;g{!-KEy}7?7fWn@4RKQWqb-{a>$$B;ewAxFT`ht@N5vD*NTtlh<slE81i|;
zdkl9?NX;0^c>Kwmo^MiW=!s1J{4r$mt~ZZcrly8Rkx8K3^K7VQTJPy$UPPYji`NsO
zm+nn(%Z%RB^YncNdef_!)q8rL{Tu8}&o{gG^gR1F%$we>vr|ZKWcl$<Z3kUD?kN-7
zo5%9=J|2&uG;2v-v9%8KZ5f_n+*V{;+r$6XaLjzJG?C2`T^!@hSIv@-$5%q#9}C&(
z7`rRG_&EEnOBFr0Jmm3Ari+)5UO_MDEl(l6B5!%-uSlUhCwbG`a%BqX6?@a$^{Eun
zo9Ru@SD8Y3v%Tr<s!k!jIo|ZjYkN=6(+-t+(>q-E$>?!D<4>MtSI<maLle%;dEUI#
zH1wVq&vjyfw=KxOTG4ZD$|tft3%&bycy$W<x5S&?uC*zox7?fFmge5mi`CtyyWZ_@
z9e-z$Pu@2$3_7*jS9+Z99XQH35?~v?cwr&dzQNYI2hyx%g#(ZtXss)BtY!BD7kiX#
z*xzpFI|-nVcOm8^&-cTJKW>lMw$z@#v(@(%bw;q$XB`ixS&vrDDm#vYUwQWbE}yj>
zb+(VgS?*!~P-&yevS!}kE8Sc6w-Yl>J>Lm>r131;xzyJ&1Z@mW!~^)BkT*0`+<|u`
zwAt1SvyC9?wAmd)0{Auav+&LV^kKp~i^?IB(&Ha)I-uX5kl=j>$Gv^$!<Y1aOg!h*
zhu-vji$5N{6Mp;WA8xX{-p!&O_`5!=u(osD`A!Gw!_lC1oI25&V?Fu~^rDo01;(H%
zpnf|sPI>dJbuaj>Wof|2{lx9LTDCS|;L7+O?x%Esb@2`hX@lj|pRvH94jnOZK##b|
za300@zX&?6FE)N-!?AeWivCfWVP7o2x5AHe`NeOq+S%%q?%g~9^8kGXZ!zz#IBe3=
z{kswP@jM+d@Vc`UPbb4;KfeP0I0jakviD5i0J(FX9>%*)I9A>Mkj$NKzcu3!^1Ah0
z+UZy`Fm8NTNDROG2S#O+Y&;GaI8~v<<Kg0*ooLJlc+)u22b`gh#aJziLw?8u{icqv
ze^uyrd>?Bvyy@5W0jHZZL67o3M0=;lgL&a3Iz4Vs$I{pQLn;5e_*Vt{$KQCpF!4qu
zkY%|!H<Hk*=q1iny!VEB#kq4dSbDq&ay-uty?F?80(t`*SOI%L8(7u_`><W_aqh~S
zYpvtF0sk_unIA$LXAaw~E2?BK<l2+>F8AR*HnH|3Tj*KG4?=#SVb-JXD!shR(sT3K
z^HuxiymZ@7yJCHh`CU827~fCW26=MFlWBKu9r6#GV9u{ZdgjYA_((D~egkJ;5*=`H
zI5u;j1FpVxK(`alVWZ8YbJ)buHalMT4ge<%dZe3&U-qB<Hs@D3!Tj1X)VtqX`+%e9
z_Htegi=9_V=bwQWukT~w&$#;j-sR<ZXHty5$JoomgT4EDqz^ch^=~l`X$xGx{V?u-
z_ytz)tNL)$Q(f=FKa0#I*mYFcc9ipH0M}#RgunRh3GO`V)^i{P9L^=q%QuX5ZZq-@
z0uEf!cFe&zb51euR=hU~{?N8>VhxVhjjh9@{e}*R?PA-Ae?-<#wlSaYs6rd0$@Y;J
zKaj9XC%qSRjvDij>G!b4ZS`40+<AByKAOAMv7El%A%AwSZ1L6+)S0Y^El#F0CZ6&M
zE4rv3?~7mf!^peDC@YMg@^7-Ea!NKAkMsfO5$MMu<Naj$@Q<%MapG=w&y-AOPE;s=
z?tS=k?_KVP4Ni;k=|q3v(@}Pv`Lw}GhqQgU%N^q#eIDa>(WR4)ab8qL|2OC)(xnGP
zmxhW>kJly6BU6{2{h3{S!ys!J+o7L@H9uk#IdA_b`%p3V|BkF&I!EE#-0&o5-miSj
zZmeUFhwD?yyr)jQ5I66S#?AYInD?{?FQi+`V9U1EVt!l_V+)j?G=7xa=J>~TEd9NI
zn9!!2OSRqkpU_E@*1P(hddciUE%<tk>mqoP@lUeWn|M9eoPJz$hQY_03!75W^}g$8
zRVY6zq;04lHWV~s)}ZqIs7|;(6J<@GEV0kj*28D2NMRd~1v`dN4m;mF@z_&pEsNpz
zaIV2`5?LMT1I}ZxiT@C{X3{Pm_{iHX{%=@I$DI+Chif~Y?X#U#Yxc?PtV<`6{Y%wa
zI&Na`)>0F%w`=K^2~jyETT8e00mo}Cb@wb@F_8J`5(Al#S7@!<1>e!#FYH!+i0s7=
zVgF?A7r6h9pU3-Wc=zu>A8>{uc9k&ZGTocb5d)_*$^O8_q0gERTi&hr!Sor}cXKbC
zaPMl+NH(4oy~Ozs%zyF`Z&$tct|uE~?)4bw3RRWv4HY52Io4XYALHxBL(Ornt|{G%
ze)ovGR3#ec5^wn*FmRIX3tgN<W4!;&UeGXb+&EagpMOB(K&~>r)hkQ)*6b>qP5Z9K
z7_r$h?HlM=Z~PcMhjl1f?BHbbPe*+DJjk45uq6<cyZEG<=E>$*IM{QJ)#&$6lK*5n
zSK9|1&arr1zW}m|pW8L(c#lV|fdl&>zE%8qxH#1HNqS5eBj<a6xld%j^8UpxuA<B_
z54!`_%n<h@h~?O6h`W~|?yh579f;l0zw3|kH#TkhUca!!4EL_a-i*4Ox6_`DG3e?y
z(e4UeH=xMsz&<c-C*tvWdye3bwAeQHa-F~McQK7~0mR=rmToPG#_it$Uq47PKkqm8
z+6iJyF@8h&xgAT77%{VO65pW$cxG&^`|T46WohDl0sOTi{(pz|BTlB5X8b!<wtts?
zk0)iCOfMhk15PsAzrVs;4-XhP$!x!i^Kor|zCj~df5-I_=abt0NF1dC`Y-y-_<_BL
z^M|%a#ze<ZxYtPTSGV`@tGCWK<oyZT*fGIccNp`9@zR4>UtPP)H1}j`FWL(~V}Zd_
zk~wss4>&v{3n#F7ht0kxp>w1UIP}-J)^)>X<%`WzXN!#WPzHzvMb;vYSu*?Jzo>UU
zs)-lBrX7NPHT~AO7~x&6{rI2Mts@JKar~IN<+hP3-OAVRvpty|8`lRM>K0?qXfJjx
zxWwpt65Xok0}gd-jMgpjTcJOF)vJodz0)fbFO_;_o}<hkYCTFD#@LmNh1L)5E0f!=
zo@XfsE;Z!*3EOx?*LUY-9nLD_{Tu(XD81g`#oIypEy@nYp3m$|;0x|IXjw^g=s+KE
zsH@5jMSbFv*`cj?S8=c6&IVq*zLbTM+o5jQNmG}@ADoyGKaX}Tr%&Y_`+fj;Ca?RB
zCHARIyr-2f6+3TDeM%zpiay|Q-ae^)HuL|q2<dga6Xzj33*lNWW1)4>jgPtK8;Fxd
z&LwzG5wDj=u3-P8=e6#B>65h6FhT7p%MmLrRqGji_@NWvTMMs$(Z4(W)??!n*uZ@K
zE@+wGNn|;$4>*+N$@I1Ms#qOx=V!dEOgyzlM*rWDc>ODfT!sIW_`MZ<z+oSbKp#Hb
z^fcnAHqJTJ9VS;F-hnP~AM_WTZ_qZ%e#q%q%Cn>Q{C<&p6?BAqqJuaSaQ8*r6AfFO
zR+Lp}?Tze-9=2w??ZW2l;l9TXz%OH8@Qhu;m`8Ij`r8MbD(qQ!H|f30DPwgv$@M)F
z#jV_!26^nzbD`lhbyp{TU7)SueP-UFsn0LnyK+M5-c{c#ogF{k4}4nnsR1~7>DD^z
z8J0C<STm*FB5Pd@V*UwZCZOxuYcn?1(ZA=u-B;-?H@|_?jhGz!7|*MV!##RmcuEw<
z$*=b2X`F!rxg_Mt#bFE$Jjd9}{Ll1)hJmwFk7<0r$7vj%!*E@w##mB5yzl11H5gmw
z?G|4;x`ts6?_qxY+Vk8=;yRpv<{d(Jo}6s{kp}H*Kgi%H;t}bHM_g#kyU=*6E4>i0
z2$WM_dOPQQt==;9_W`F$&$)Mv`+&WjbL=1cDRTw)<8FlvvG#1c5$9p}J?VWjzkauR
z73NupcP|ketHE4jdkJ+Jc!}m$cY>H?&DGvAs_g?#ybg^|pxZUNKjhy^vVPSXI8{k>
z+r@#+R=Nzk!u=uJjpyUz>hk}_wd8QS_m~~&1CFcLF>A>I-W%|Dy+4lk1_D@5ovsfL
zm~j$o&+e^xJd>2U%ioWq+qHG7FRYu6SUcmsyMk)ncno)ecYn6w822{|>N|dc2OzgE
zu=c&(J<i(x-syIi8>4aWz_@Xdqp)MudJgQWuzqf?G2IFF1BdH-A<sVGkUq|RA~A{i
zD?5HMAAG+z&hBz$^akQNA+cxH_JRa+WWSaR<(h1c958U)^TT-i@8a;?T08xf$Et6e
zTT};o&)6~Bj^~x@0%cAayYe;X&hD+1$ISbI?<_hWKFB=i3GWA1be%X5y&o9wmrE?#
zy#ucAzF^_o)`9!m`_vk_jedC<{3-CZ{hRnJvv;;~PBZTOnvOkpLcUhOI$jmD9(C{j
zbo8@kaNmx4G3#i}2Jf-0?E{XYt$e*13C8X4HQw}&^Z|!=)2Ah%<NkjJ9K&S#@xZm-
zytp`|(?PkSJ<PYE>?iK{i?5KZ{Ug1Qn~TFeP5hqV#8!1T={W8t9jo+1kJ4ag0x|cK
ze&g#{N<BQ`w~lwnd8<94EdAJ-BRF^9&oKV!&U^Z}$3f>k{85jO`$qQvwPOu_74g%3
zyq5xe6(h)w-rG5GVrDn;@83WB_AS1V7qS2ELyy8AotQNdZLp3Hw05Gr9Qv4Eba7Gt
z;w423?DYP(+x`3ZD_$t+fkjJ;ZbjZh$h#1K114P}@WA3riyD!?$L`nvHvIK3UL^3q
zNz0_1`2)u;E~>+C7x4V}>jWS6^`&=`7t+tRM)p@c%(~tG>C(MvU8Q?Fec6ITo`^Tx
z%I;5G^XxSpe4F=q$3h0({^7W5G7qwz+jXq6qU*SO-(+ia-nw_jj#c`A*YnO8=b398
zEWI|n`(e|k32}_z$E79MS6AGobkp@;)VM_NQ|(OaxfeLB>#)B`b+S)5V}BJdBYPar
zEY)3{W0m?2sJ@G{8*^gwY1X=IjKOe@0erah1=DYzaf7{`_a`ZX&~R&6Blh>{3yN-^
zG1j;J4UEaSVWoQ;@x17H*drZ59o&JM!RH2^8(}Sb1G>7yXYGX@#6R3^(*Dp<)H7{)
z+Lz0UIMxr`q2$K$^!v+-a8G-6VR7fEPP8F;>7{$gX9#?y4^#8E%4qXOUo`d>0Pa|{
z$##!?QMJpu{l8mYL_Hrkdr8p_yZ>tHdcQdfi+*Yk?0@?Ww~xvwUMf2O2J-(Ic?0)W
z6j8UI1@1#AA29QhqF0gr3DUO$XAtH9b^8z0^{3|w?ts~gid=l+40vo_(FxRf6Lnqy
zyaQ>{8u0Y_5xhv=V;4klBY98HPk^_e2i~(TkB?ng)c@1gUbjB;36p>R_Mf@9Xu#NI
zGFRERN5Ioi{F-BAjt^xx?n^38^16-}iN5%Tu5O!l*QgQDnXE1~9-Do`SKolSnCH)4
zUB)^2X5yII0klVYmm{v>jv?DL>87FG0CbV`x84~YL+W)HdnLv^h6-(rJI{av3TG$I
zfaCXD?mlbi#c4&P6Ti=znINvW>+`C;lg-Ho44jVF68F``8J&Pexz<fn_C4kY<``vA
z@v(5n{_3NT<nDEh@8Hw_N6N|i<~MM5{w{IfT%6Yx4cza3rt2@b$Ibtj_+)L5`?9xe
zU7Re8cLT<ZJ{H@Qw2nztF&}xG;b)zU-hp1wb8-G6d*H<Xr!Z-Rwaux^o{LaY>~meU
zH>!SBIdhAMyD!P}48EIsckb^8o*AP}wqG>yp!;HPtt9);t!R_HxxR1w|Do)TUr5$C
z%rp44^grbJ#vv-M$ok;rcop7TfafeHB#H~>>-k9BWW0>)0}l6c@nhriYT<4Pd9*C0
z4^@u-?Wcb;^zRV;o2`FG>EB%ao3DRQ)4vn+?_~WuP5;i)zh~*+bM<ez{yks)ZvI@T
zYxC!V_;c_Vz+W2v{P^?X&&HqCHByaN%>3LE^qwDE`+yTKH~0VD-U%NEabw;K*mK@^
zYh5SSaQwgB+-pc2?L0gO)hWJ}$~y}GC@;+_-ierWH*h;&X*iZ=TYt8!9itkc4?gsT
zW$`-Y(jy&~FB7`<9vi<^Shw>)y8-QyE@MV~{wf5zgk72)!du>iJ6|b0mWa+y=pu0U
zP#^QI7%R_ck(PQ_MbGC;cH*uzV|VQLd_3nkAMq!~(B)2?&sxUkG5E~PyE=x>euoj8
z`pqj<$KJ<tP4xN6AM-85gP%kGb69(JA;u106uPL+Tls4Zv>t0tFwQl@yvMoLz^Uq&
zINs{wz{wv<o=Niv_{VRIUe)NmDa&_i`@nhQ)^Y9GYsedmHHYg?E$X<og7r%EJ+9u?
zD-fQPtP=7xJSqd1C+dkS--JA&4tN$Bn|<j^J+HH&iV?j#8#3|8Gw%h)KSPt~PIfBw
zFN`x&>fa&64HD^JX@Bdn>IC|?KPM{tWH$PMfkWSl@^;6>)e#p*J<At8Q*_7EOIMDJ
zj@7X$eXh{kdg>01(y_kigFpA<>5*B_OOO0`7RWqj4kuZcO}ylK^bFz%w!Fi@U7vX;
zg1#_xU!DCSuHeRwxJGw_9u9){Ho#YM?@NZ#JN8<Cy6%^h74tFn$N3wAkJSmgNE<pc
zfxh@c-umJ<aH^6$|EY0u641y`_ogwf4>(oqANooE!CaTBAQ#hLrLMXDgKO{1b#o_l
zGX4x`82k;cA*_2I?#k!OTB-Cublr7#K6`cHvGt(u+E+McLw8(=J8vc)&poh)ga+@p
zGIV{<I&v<;H3sEe8=v*%Nt+h$>HZ>oJJze&4H>0-d3F;DSW9qDxtHgs?%8Slxv_<Q
zfag8WVQk2E2iD(fz~ge9@0#l{_F1wHAJprz$p_b8(q|ukg+8*4cC^vg`kml^nC2h6
z4|aJs<MlhSu7?J|M+jK!y1%_+6xZ`G;->uVFw2IkvP8C)aWf0H5zmqC*)P6g+MXNn
z`!2=~F|j?H;RAGvf1%FH`=NiE;e#AC@)Gs`DEgcZ8KgHh9&3a?rC(QiXJ~Nx?V+)y
zvuA-v_(ZdxMO;O-qn@YYc_sN_ej}a}eHO75vpf-<PJ_-1=yM`E-Tv%^YY%*)349ky
z$Ub&vQK)n;<0=oKUq#T}qyEr@5bQv>QN7<w<4!0vaDSq43zrm1zu@n!>kcYeTWF8t
zz~@A)sXMM@TKLCVhYQE+-+S<}+&N=mUc&YyTvPn|{SgiH!SRkr_uf}H2|nL};Xbp*
z=NaGie|Z#tcj7$aCA??lvNUVfSd57~w-esM!#f&|^y0a<3gEf4*oUM%8F=m4)?SIF
z;kRm++8<Y8-mt!UPA>M&!-t!m==uPA>A$Y>A)aZ(kg>Pkr{^y070yGIZ!WUbG0O(D
z%lI+YfeFm7&yL2%Vtl*Jl*h0=zt=uv1Mv9Hn{LRA^X&$_`(}rO`w#dfuk)$X;Gb<0
zmS5eM(P9%~{mosU^S0#=7&zS-iFLunp%48I-gC2=GSquI*v@rl3{-cBd0xi&IiGLj
zncDmKy9zvyfXu?E>+(##aVJCcj<QmI<H==JfxW%!b1p<%VL#^5a3u?+S0iyxPu+7O
zZ;v59Pda#q&*};A&#IBfab})%;>4rJF+LnWfsxm(^|}!4{?!<}g5jlmPoG}8m*ch-
z=PTX*QF{*gM}XGw$hZ{(N5&27ii{ifFYP{SW+CdquC7CneOcjjYwvR?C*NmlzPtS+
z(N^AsUm!NcaefYSz3@y`XSJlQy|@=AbzDBf$5kvS5ufC-_BxlxY~hjh_{^jkoB!*o
za_BbC)qbSkJ@gcG+=kz*-=%@^de@%@+w8}ghi}3$y~YX;N#_67K}y#exOa!Wpg%<X
zWOMTX@ZH$T4%!LG=vS~4Kd`M?v=NjG>kq<MHw=MH?CgsgYJ5fOQQnX*GFsA*Z|x0g
zy-GAUxbD0Afn$}t&!nEISLZ`<^LlIS8T2vqo$ozRXVIL`(RuFb3UycQQ%|nDeD4L;
z2k0C8z0V*9ZV&5!A_MEs5NmHI=5|P8J=XRv%gXH6cx_2hdcWH*%jg&qw)1`sKVVzG
zVI99H#605NsS9!5yLkfqNzB1F9<sWsv>jl3-8{>J-r!f_f29FyhFebB`}Ekw^X={@
zOxv^-`(Br4wxOQq9FF^hY7UXVW&X%m4CYwye6In0%7$-(xZ%*pEo;_|*pHWKyN|v^
zYyj8b86O4DWFB$Un5*{P`-+h5grOe>&oujB%Dy*t!#|4si0)OB>Ek%yy@oZMa-z)5
z^JrWAMXvAB^Q{jzm3KjpBJZq;UuU&H3;p1|z{I-KEB<9~ruc7IT3&RkV=W2U!!F{P
z4`p2o-ezE&cVPVQ#~iu_>uiIXAM5&K9pShvqb_l5ke?2FbUSq98jQ_RfBJ+*lo!IL
z@8}2ngZi$l`HU6Ea45zShID8H#*j9Ode?#aE?$+^F+Pv#>IUi2SLQE$Rkr2gTad3g
zhP_!Q$BpF}MxWD9Himr1fNN9K+>c$;m5z~5Wm{;YUV&{q*;>yr;yR)3cSgrCjJ5t6
z=q>xxiTOc4)?M!t&8KnW*@xkKUdR0Tz1Fk8LNBixR1Wtd=S|2_p2Kn1P<Q?0+L;BL
z$8+aRIGZD`g>h}e_%&>;ENM7#Vnzq(lMnvw)N`CXagB3%;@tKZkO!_gYW*TFtW)*C
z=eqdb6F!GW+b!+<O|3IqQHSrU;CjdWS3TE~*n6@T{QMB)$2||nI<EllwnblQ^DKRi
zB<Dvuo*IT<5bChD-=A-7=Qz>6hQhus((cGiau=h}+s~=(1CDF=7D48WFFcQ5zI!f&
zIAssMwVxawY(2UgK1LDdi97x{_d32CG4HWDmIvSbcn4wv>1ozp`0RVFecDdrUdm$7
zKp$h`h2=B6`&D7!l<N1qx%6GSE)Jh3_)-Eo`KNo+8P^9K-uZ~{%dTnOG#)T<1}5=E
zHBJ@#0l9qz@_g07I*L7-U9IE^+dH8n!F#02XL|Ec(FdFk&_qA)V%%*v=G(1+VN3V!
zc62&j@s)@3@)-%_UOuT8{PYbcMt}BC_iq0{A8<IXwCB_#*ix*AvGz574P>lZt%FfN
zunuyH*Utm9qkOuy{bYCzkT3o04){*H`&%>V?}zpMZ0<*X0)L;jo%;~3L);7O@C{pS
z#q9%1u@B(BK>2XW7NURb8*HTV*ZvH97q83t2ESGke|VgMgJ*>vrJlt1+r`-l8#5Jr
zN<Vb$Rr&!tpRgauH}^Bi`;m=)sJqte2m3`n-obBYMmf%ohQ5jQV%e~8$1fgx>4Uek
z3rf4JYU}5Fd}-TXaIE9A5SJWQWQpy4)i?CbqmaoVyidp7`?>8gUKy_o?9&IJ>E2_G
z>@6yyem3v=@a`33sAX~o%fcGrn_vx4@13l{*wjK_UdvMR8f(L>qgkc1yRh!&+3Bmt
z;+;tyC}*Ge*KMqQreASWlKuAqJbz;P6`!PjBVvHJ<(KpR%0=7@-U{DrcV_e*?ht(D
z8I27k7vg#secw{}_MOv|KgPWteX(1oS$iA7D`QvZLBH)G$RBLYq#n;l-i--t$d(n+
zxsyy6x0*OfV#371-o3{fw5u1-$~@2q9ImJ7Sm%x!?}Mz);+`dXb`$^XEBw%HU~F3(
z;t70@Z<QWr>Vi3^7#q9McjtZOSZ|LQ&nfi<AMt|Lwjp=jM|}z>o7?KSC7DaT#p6B2
z{g@At^NMuqF|PR?T7Nm_=;P4NS#dfsOX<XU(5XW>=cMk;x2>5ofzP^~@W;u+4M=ky
z(g%0<Pj1^R@9yK=@Yj5@xnb7tz&x(j{iN+6ujJ|bxUY5t<_+)Ry0*l9MlG4_YisG_
z8)r>_N_;oQ#H)kcDL4J@DBP2YeU=0<O0hxJ_#F!0ld<@t@XbT;PiZ5=xHq0|S020C
z;rmPby;+91G5C*JYis6u&%;^+r!>htBu=7v=<CJ13;YI7X%gLy;&cotmigW>WD0(J
z__g|O2=%5Behp&Nd-}n@qK>6wU1)?XhLu^f`*qn}*i#;-?}N*+$J2jqcije`EYY2m
zE%Ur(w6za7RdS}3_&wU)*q>oP`)K-r@?+=Omh7)4U<}VlV_(wu@UD5K-T%$87|VXR
z&(t4l;6qpgx&E!O)3&oO3((L0#cKUyzuk8t#*h8}1>XJY%li+wcDl6O^)u14cU(WK
z;A3%bHCFpt?)u63wgq!-D}LSevoxgE&v<)EyXp36E9@uI+sEQ>*P>{@s<b|x%;rAu
zG4Y3@zpw>8)}ESPJa1oX;FRi^vW>Y3KQ8jVZx@H}7Wo?J&<5cd5WMSiDE76=@1u>P
zujIm2+D1VZ5!=~-JkzhJPv%$Px&1_b#mA}N3H#W1S$R>R9qQkO*pD0c87IDB-h}0N
z_Uc*0ek}OH?ijk`SF<cSepV8DP}>I_#)7gTKg#h!{5HUUfgie;dtTabo*^>U#`UKW
z>rw;!8Oo17EZ-s24L^r<svyVpC<p!$7l(Po<sWShe|syhamzoMyyNSKlgO$9blmt7
z`Rff{ysvWzGH~P43EoeHwW;S_sjQ*ujAS#$xk1NHLWl)-NxZmC;>Gk4884<D7h){v
z7wpjTmopmZ3)jH+@yD3?<%rD@m(MY<FR${P1n~{5$2ccZaZsL<&_{LGXpSq#xYKPH
zW4iCd6U&H$dBL(JEGzx+#Ec@);CmDqJ6sN0jN_BG!W}-L0X|Fz#+-hw>BI2(A?3%Y
z7#;i7iFvl!7g~+jNsPa5>GQTuv}4BMZ%#5VA6Ub-vk`++{sYg0-17nRoxAb-SXcfH
zn16g8nRo5qMH|0F?2}_sjWJ;#C!mj%X@e{OSxWz9F9+V)7oI^9$2_0<1NLA_?#dR4
z+~Ehhau=EFw&)*<oB{tA{2IcDIfyKGV9Ys|H$WbokFG44N7~%G55pWzl{}BMCz5B+
zn1K1*ZYjo$>lN=Fa@^8!w}3GM?&t1@j*{1XdN1F@j^Co}**x?EcrpIh{+qpR-GM&f
za1G{jIt@D3un%J%O2aeg&@IZJ@rO>#mnw`UdFB}R2kee9^UX1a@MHGu9An-aNiP)J
zeo-jXV*F@tCG?B7p70^eEeo+zw*N<rHE9!vI@pMNCe`4n3NXt#XSfIFJ(TF(lP9|V
z)@*krI>Y8V#y&oWJB^HOZ|QgJ%$;b9WAmP#AH1hed+x?U9ss|XXA>Imj1bq?j{V`=
z`8*N#TjXJPc88pUhUhP&oaa^fc-B7~&k(Ur$NpJ@Pu%+<pV7!K#2p68@*&J2#=dbU
zX`9$7?DIAu_RaZ1T-qt(z6v{VA@szxQDMmO82F@|8hoQKx_AFMw~x}#I4S-a?;a(4
zHUFT}y(6vB;AJFunJv7yaqZA>#XIKGvYJf|$421Us0QB%;FUyp9&L^2|2vF>g*g<W
zZh)SW!#Oc>ut38+E8=<U-<o;;=$^O6?msAV#w;n9QoZ)DUFtt&I~ITAGPw5mBDQNY
z?lC<8eIpL)iLZm-?Yn??1nsdc{<&*Ze0vY*_FTMuI_`8bJl-YcxE_UmaBOFe3EjTi
zS30{B&s4?pQG@ec@?q}PlJ%`t&Vr+TBTv1>r4GmIJ=fPqKC+6~4xjt~3(k(ncSDAa
zXG{@4n1%axIA5sR68rwa&HJs5n{TscH=Ks&X%YWoeT?%q&MmID^m7`1=I=uMX?CJ_
zg1E6xm-qVe%E#m7S%JHA97nd@fbwBzU!F(K4c%^yRr84XJa^iSy!7YGX20Q+XV#LA
z<&n5H+1Ihy-!MMTHu9cFpU@`L{yBK=uuRbzgYnFMPQ82c8k_;{)9YzG&kyvA^33~F
zC+puhxd){BR|T4GKZTDM6d&}v3A_D`j~$xN_j=8X3Y@L?W?t+EUT@|F&+6UrA@8L+
zb{j7f6R$XKUd+I}z}hx@H)PsTu4GLe+JWZ{cHp^#9eDm=2cARNf#(r+;JJhycs^kV
zo>K^;o%ngQWoYl`5&sViQx?L15_=MltL71Hl>6*Wtc~&-hg!L>9i79pPqhi`(_!HC
zW*m;__SgsMN0PhG#G4Jd(I!#v`yJZ&OV05LjaQdkh%+GCs7Eo^xsI`&Lzq{E;$uPw
z_uHt-wNv?n+@}b=WVTT52&g`~ceXf(dW_k~-t}=S@Jw9`C)szHc-(ub{X_g(pXd(H
z$=8%4V_bbve&@4E#;gYSw0kpVwZJp`Q<Y@Qh*tu+y$AoBYyQE*8-K~WVn?rTC@I94
z9m~zWJ!>4tOr2L8#d&r5qzg)D6Y~z`mAnDJTXZ6cZu`Tr{W^;FXuH#42T`%dc=>Qg
zyf^(*cf^%#BmJr*<7MJ;Uh$qae@Eh1_^_?nc|TUV=Z<;2eeug(21Sc&&>QH34Vyj=
z_B)^U8@65RF8mv%+sX%2&p(*=o!tM!1Nih6@c&DwckQ|{Cgh#^{Jlxw^eNUo)(tmV
z1v691`B}CNGpas|jdYEXZa3058|kkb>4%N<0VDkzBmD;>{h^T_?2Ga+-bkNgq!%0M
zdLw<Ek-o!7?=;en80jAx>0cY^H;wd%MtTTdq~OY@z(~(F(ia=)N+aEBq;E3P_ZsPk
zjP%n+`d^LoAtQ~m(+EF-v}k&Skv_vnpKGKS8|fM&-EO46V5A>3(vKVI7mf6rM*4)2
z&J09(JIzR+X{0}Gq&FGqtw#E*M*1Nmz1K(|Fw*~Oq>mWsca3z=iSjnmNS|S(=NRe5
zM!M2Sw;Ji2jr4s+dXJGlV5DC((npN+pN;ehBRwb><+;E}pJ}8Q8tHl?eS?v{+eklX
zr2oN4|Hw$cYNX#V(r+8-4~%pm6y<Y}kse{B#~NvDv?BUE-AJEhq|Y<b7Z~ZqM*2!4
zU2CLUjPz%X^j0H%hmpR^NPpExKV+mIHPSyd(!Vp(|7D~<Fw*Ji(f*D%(o>A|awFYf
zq;E9RcN*yjjr1c%`k;~ioss^lk-oiOl%KB~>F*fn=Zy5PjP&b9`k0X(*gx9lC?kEk
zk)Gb)wW^j?VdO6{(v?Pft&zUYNMCEv?J&|S3|q7b>AKd&YwBCurnIc7ZeQ8lx^~Li
zwzX3lTdMh2S>4h&xz;*`a!M|zl;PAQIb|76nZr}d#HqFMltXaJQ99)vp7NScZ52-K
zk526yPi>Y@MF>tsPELi3{@)3swXXFF`U%E@#buQh7cZE1$+F7%moBI%u3Wry(Ok>O
zz5L>`OM2!KcUlkJ<(HQC%p~gcM5sM8i8><@YR^of&P;^bBd=^`CHqiWws7&><vmNM
zRnA*jK5y>ad2<t$Et|J&{=B7$$`&uaw35xn%d3n9mnSQzSlE-yq6BO$oWGz)%S&b@
zB#7)p<dB_+*ur@WD;8f-Id@@M<)v3#QqhBmQC^l10qxG6SFvc};vQ8aB|UXuc||33
zqeqQp^DbSMFtew^5w&N#%<ZX0%uTE@#g!F{F1fU)ddKG~^^VUK^^VV^ZcXdatWx@T
zTr@Df2PzxrnX9Hkf(B+JY@lbZnji@p=uw{|Gk5XDJ@U(psS)1}$|6&vN7+o#Qz~VT
zB6rp#EJ##?lLHg9M@!5n2R#ZnbK+ZvW^$?~$WBC(dc3?RwlOngV#K#*l&hH&j}Vz3
zi5O9Hs;456^=0!aFJEx}g37WBE?C;5uFRo$Qq1hB>&)#*fw?{PkGWc@?CFdXT-(~%
zUSBzD##!M@mS22vxVo;cwZ5%wY(L8^o<8lQ#l^EuT3nK#w4m**g1Ru)qwxI8!;Nj>
zrsno=+xnK4=GON5x_%Zpt8H#-s;_MaBL%9wac#?*`nB~<zz8GABek*74;SbPb&YLq
z9jU*jzPh!tzNxOIxv{CevaWtj^+stJ9jtGU6i61TR@bblkIk%IxvH|hMe!oZ%BJde
z6Ktq!jRPy|H^gA9ZLX^~QL0z1im6gpAD`3OyuLlAN<;IS8nX#-WrAz#+pFuU+p8<r
zR=2G-3s|qRW@BaTnnsAsEU9g8T_Z3CyVC6g#1l!^Hm_aV*d76uyj;Xpke!=uSszW;
zHn(hy6zG;KTUwiID{I>~2suq6Hj|jG?Uk+T*Qj0-$%Hj8t*Qr#6%CLRptjej-jEps
zT(`cybt5wxo9gNn18eJ6N=}3riLYD}M?EG(s>I}IhL9(nQXCPgUbCjTwi=TOS^{mm
zrm<G_h+tzA<XOA6PO3=xS}3>)quVar2A!>3+op!OwSHA&TYG(LWy|_CYa+RI^@;N%
zxzPBPnm=8iIT7_V>PIj+DX5K=5v66$y4t4NwUwAem2HiRBj&a>Hm$;RVRj36TU*n(
zR;aaasH{^nMpBh)*Q>Ev*;-#;*|u6KG8$Nq<~FufwluaV8MR}o)-_+-6q`#FL6)`&
zxp<L`^(|2T`pQ*pjnKU{ZIZ8zK;^Y{jZq3w;}Dx)-y{=19=B&E273M4`q;{C>)Tp5
zSTVJ!mdt2tuWnZiF{f>9{n|>j(cX$l*<P;-YFeAC>uRgpRE2fxn=y}D>#J)UsI=0T
z^|jI#Td1pPsdn=)&Xuio8!O7)3>i?J)n4D;P+8O3ShuQP6wfj<qH>7IHVr2S*svO;
zoe->C-?FB$Ng16w=rfgE_#vR=8UeL|jlgXin`$c|lG+w!lUb!YQ6>ZshgL@+HmhoD
z8yeNzs&87=*re^IS~n_L7E!Qhw`22()YjhIA{tcNP>m%=X)NiYOigdIKx(wKRqDLT
z`n4_XikWq58+ErUu{_n*Luy=sXq{WCF(jPVA^;+4fp}o9s&A@qrGmFtuM)e7wOPqf
zFIa8hB+|(q3_~_B9Zl7$ORBHcFo`bjF~uC`$YMhsFlbiR)T2w7XVvYP`N9EPQ#MxA
zb!D^UYO%Q!!xWrbL}}MwgEa~IBa_!eYN&3jY{r~YmS|;b^;$Kkx@(+)8oe#Hb8hRL
zj&*A)*RO#ofr>RYX~x)q)*QD5li`T&>UKDEP3x5@(^)O85SKBlk<BSihU#n8EKttW
zy0z6Um5pksxx$E)Ti3Thywy#0YwDE;&|1H?`5I18j8K9?C?(|W%F(P?Q%ys%s<LkV
zTE!m+uD%5hKue1|I9PW#aOq!Nc}=r+C!$&Fn<AOfxgArT*{x!(n%7g2SGG2<bzLEr
zwYOF`wb56rY~QFYIJ4W<u3cYQ*Sxm6u_;DL!B|`6wbe~@>Dn*~5ub;ZIP<YuN`=;X
zh`mi2S+hH}Fp3Z~t*V*bW8xN1o@y0OF1DuOcbfdpoHA|lETm^$Y)wbzbYxDSJd=M&
zEoi!?dQD?pn5RXJ&5Gyf3JMn#Wa}VCwQMy)os=DPXF24nXJdV&$eq`bvc%OYo0=<Y
z;4dh>afcb!MhQHoRIfa4p-8Gn4Qjh8;n>x$Ti@7PU&qCHCGEz_M(tiv;*Bk}m1~+;
z)vQ+@LTnaFu7%4D&-|?L`li<US}18NSHm#W6izoLXt=qyc6}?FpBS!gYpZXiNl-3(
z>xRmf<~7RNpz21<A{qDCl^+wQsl7?emJ%OVb?6P2e-t&ZT)76TqESo+TeOPcd7b99
z6XD)ZYPfb1I8)n{v%<g$y8;TYtVVa$9wCb9ZfV%9$WFr@df7wBj_0f}_YS;CQCZh|
z4P{qTuNzc-#N5`x7jXkr<D)lBt!u;4z0J~v;cFo;Zf<B`8li2Ub+<Q|Us|nQzNNih
z)mMA72x_C&<LcH`ZF(SFE>2QZ0Nf-EUDLb<#=kzYv+6;~M2Ks{?M=9PjZB|#{RTL&
z@q8u4iffI7VOk<3vcjU6A&Ii*g`K$dI#|zDt<^0Jl`z*HZTAXy-iigw!q+yoHy9Fx
zky}#_Bj)xzUiNN&xURWgsf-9NZakA>CGMGvu8Di}Ejf1L)}yjei<w9Bp6Ft?;N2ya
zQEhco7}K#9TP@7*=B6;CwD?`KF-}Y;LyYT-+vzyDCso+k;psVtdXQ!iNAn03sNM*(
z99id@TUS@ET(2#6M2%0@L}Wt1_cA0^No}iaZ(Qq|M9dm(h`8v&Z)$~olsforU*FmU
z0V<2`hEG05g-AzSA!-wbe6{Oz;pl$T&7p(YV|9wKP=5JYQIj0)N~H68nT&75wfsH0
z)c1;5pxYY}F2Hhws8f5yJ#eKe9xQmI7ACNyP0e9!TU@QIymp;<|B)?zq@zjj+~wU3
z3BUxpO+eJ*1?%7eN}@}PRiGABL60{u%5;XWh0Z|_*2k`D5r&dt#Z4QHhdB+8yS}M*
zV^}O`V!PZY<V%-VRLr~d(tcLinl)jpzjfgnxXsr#*0ncKDJF)QPo<8{?`K_x5o=m?
zRyeviO^l+5IxV>5va*X8%ndJ{cj=<#ODpEN%4jO0><(7d$4k%k6<tk7lxJ<dJHGCc
zuh-#|;jFFRP+4<rc#ia>slL7r=0L+emgDtJtDE2zg=L!|9Z-6#$$1pJTtsC+@ww7b
z^DCx3Sk(mb#yXx@+%a|AAPqEaxPtCPX{x_g7nmaxWy<Im!c#he5K%`QV9r|_CuXj$
z{Vce#;u>&=71csLqFO=)ZQ)7hBApCd_J}>ITwC4P-X;;|3zn8$vMk)Z5=~6*F*?f@
zES$G!Io5fgL+_*l2&y__9wx^&-RBBujg7-nGu$0%yI{@wFfBb;a)qFMiym^I)iC#t
z5xJr<*p@la2jP?nZSY*v4ZY;Tijp2Zk7$+-+;bI<8>5q<h$+*NvxLlP>nElP8xGks
zLtoqC=VUw)uCyL}m?-1}P0*SqWJ8tp<l>}{+(b^_moBVy%}gaudm`t_W`4}!X?y|C
z?&dCExbTX^b$Jk&xa87hb1UanEKFRu^pd#?E=^o?IZw@|CMk<K6E|7qiCx*;vc<-U
zuUQ;(;%yc{CXwSUGoLa^S`c%dY1R^HB&;Tv1QM3Wk$%FGXrB@mN6sR(35r=h^fYR3
z=G;uUz{Frway^c<6LfEBP}-a2h)b#4WY=)hhDR1eF`jWNGnt}elrRWzQV*%`wRnK1
z_*3Sik-OVCe&Sr5=q^Bc1+jg1k>lEMx3MkNhzP=*Yr#j`QU)-#Eze4EOGg|{n8;XP
z-z5u6#KTLk@+6x;cdOacWXI8WMG;XlM5!v*U@xuX2C<!u!*)%hgxu);M_l#f`lbi6
zqCBpnk^Jb+A+ooP<2eCpl1)Z0Fln4sILzI`h)#3cV{{@pR;++9T;fM5$48M*@?@nE
zaKL3NC4W8Waz?>O6J)AZ2DLQDi44T(_ZS3YT1luHiFzyHP|ZQKqjZYb*J4cFJ&GLh
zx~_jzJ!NSZr!Vo^p1=pZM0P#2KIlTEeq8Trs%uw=850hxcxad^6Q>DUYa^YC@T~U&
zDn{ov9PL{oqtM&7;#m-PyuOaZC3@si(-KnlA*MXO1?6J4)W=P|#Je2LW^(NK*7bHF
z&ZxQE>X=Qe{w20)ZinK+U&_RU#fMhmD7S6X>2~uN>r`sxx`6Rx>PGb3avJ*>y-tJ>
z*XdY0r5TUSj4DHfqn`1D2-hb!;!%${E*^>4bshFz;hK%$p`W!LaqPC1Y8=_G#(|kW
z1B`gfy=^6~ukK)p8Hf{A!m?=3Jy!>VrIW5w9|Mme>loq0jB(?tCY(%RPN`rLoD{8Q
z1|==jr1Mr+j#VDlK!<t2w+cg3P&et^Xe1{pn}}BEFj^1$7+EfqTkjs=M26F)B&M;4
zk&6<F4==^?D_dUh!n2ir)>Vv5SWDFbR^6w$?*yb|v;cw1*5*}E*)~;h0nX2`t#h%&
z%7=SkMH-Wadp3n^x1lKMm}Zdes$H~K5%FnL8?Ur+MkIpn&U%k1Z)9S6SB&x$88OY%
zX&WY;%dKyZp^Y@!r=blqNQFfW1VxPI!iVr#b!~g&HI3~XRs2-qX|Y2MhcB{-Byzb~
zzQDBR2=uqQlGipa2~M2!<0wUp7Gr!p%x&+Gdv?&gK_T(OI00xWMTRGS9Uxse3W?6N
zjLv#vxT*q?Qof8zi{}wpR(i7TM$X-;J;!MoW8e|FVG2*g)+F49L;AXK^{VPdgli-1
z8{7g>qBt;S4AF~k=Z;`cHhRYFDH935<GibdXRi{oaoGe-oIl3cQC5IkCWjg9weDF0
zEO$Q`-*<+dV+pu#Cm|tBDY-t$boBO%@SyIcU`m|28F}hvq-eyco00Ct-KeLDS+DO<
z(hoRwGg2FpQ#T_c_o;a?<^S26k^gJ%vNg8B5y3qyF;wvXdVR62;o9i+G&G{`ZfVC+
zZhlFV(NT=KT*ho85Y*!i9B)bE3J)I)SX(2vm3Wmr(&GP;D{|}wFGu5sOXMnKk85+B
z*+kU$;Bc)GR~_T7pA+Z*uh-$E?;cm%C_nd-8udnPWTGy#w6V6wB_N$07sN=IYaUj*
z?L_z7qIjaOvcu^?INo`T;(yGW8j;{*`~``g-g4w}ZKBOapEn~~I6by)J$mSR!>4{v
zN#K+OPD$XD1Wrldlmt#m;FJVTN#K+OPD$XD1Wrldlmt>C0r#Q2RJ8T~WgBikCh<wu
zN!2Zr@aX5?<0rNs*RH8<`uprjY(Li5{(bhsQV*@Rt!<gsvZ|%Ac@myso`fjYq~b|<
zQ2OubBjb^%A9!ia-%~$M@%jlRP}Wq}+KeaX3ujHAHDg-wRNP2!!<7eKNSJ=+nP-+v
zt1H6YP+a4RJYZcsb@J57v%-Z9?d>gXXHA)cr#jfe<W<ehc$18}pE(&1+f8Y2ZeD{M
zV2w>v)~vZ^?IaxdT#dItg{Rim6j!gTtC>1$YTc|^#j~qtmrOsix@K0%tXZ`yXH?g%
zoHiY-6wfNMtW(ULk{sXX5I&`IG9hlgz_!w4!sGu3#z(#q8UXzNjwt@ZIr#Qh;494v
zFei}a%*Rh~A=AtV+4$ccEz9?1e>H!dmH0~U$E5!{TWW7*`pK{0Yu!soI-U5E|2!$v
zpO!rUfF<n@w<OIfX(K|C&IEgDBL_%2pXpJV1Bt&m8|j>Gp8$XOGJw%X6;J~*X}NDH
z;9)SBmUm16Ut>wW<(E3&B2W<WTNyc80)epf#%B*Affs#FKYu1ull|Zr|4+IA(+Ldp
z<G(t`XAXfu{!9Vb11HnJSb(lA00#S42(Sj+J6ZlJ0si$S0K@&A0xY=&zzF{~0iFl~
z80Ehw3XJye6yT~`QIhN5J(xs4xC20*|DY|<r@jCv-~Xb5RuU@kzpS9w$zGwqTR}f$
z*<}A)3c8X!P4OR7P&!G^@LN7<^95qg@`n^8t(5pP74$aC&hm#9^fy9t{Dlf~z6hw)
zKUG1Qgv$LT3i{EP0L}HUP|#2B1T@cIrJ!f00lL87pdgN{GvB{PL6<;PoeTXf3KCu}
z@^4Vk4E!&<&O(2uf~pB!;@_>H{#yYp@;|Jg_8S2$@jtGhZm5g1)W6R+gz}_@Im`UE
z9Xx1cEJucO&<EMFxCD~SBJxmvl?KlfedLG-OO?)&vtXIh+5X@;SUy5<GMTOjOZp|~
zS8#5jq(6YfgY%|J`YtF-@cfctY<mauFHE!Z&WVB-rP;X#cyXFN#sC+l*`p2ck~BN#
z9K~m5;3;X}0S|$v6`v{{vK$emDDW^8OTVguPYS;D<tc?v`3IlQlzd_bpHcn#7v?{^
z!pgV;34Z!rEN!IqE6r|1R=+Z9cv`<Qske!6IdC+_&=IV#ow=l)@ilz$lRj=_T6#{J
z)OiAV>0!l#q{sTKjOR6CC<~GVeV_Al<OF|>FKK#2@NTK>r=agqmB%oBuNs&$nZ7U6
z3Wkty2I6a!m?sXBpQC04^I38_OE|iIqvRZxl=ZCRzYKYna}~bDq=owhzbIThh@9Xy
z#l=%hZyzC+ha`hv8lh~`K^ELOS^-jW*XVv$4(-<H$MEHch65k}Wi#w-Fq&U#<uE^&
zI2MNU75s_}3WK)@^*jd+cPi><Fny~ws8q1q)PN3S`gS#-Z!-P)u;q*ga-NcgGnEx*
z;!B#&9Pk@y`Z8n;cv&_50@MEn2ChP4R13bOs{bCQ*b6IT6O#M{&ds=4C;QLO*zP7X
zh-3vq&exHn>5LIN9DxD3iq11A9FP}^>Of$a^E2edlax_A%C<B9!f$*6vok)@$^I8)
z(A4qMe~{1(h8(i$j6(LP0(|M7PoOxa;7d4~I#A8p4rB~0QXGAY=?O}x4>Ns+66%vo
zPgFvEiRnpU>CLN5PcF2=oZ|eX4a^xU3Hi3=+ox94V4Cv~u=2$=J;oFlhjGq6e2=O|
zCI3&5vYZ$3Eq2Ly1*v?NIIkg<=O@19yoGOtFWT)uQ&fjGWLzyw{R9~qt5t_2y+%zx
znx~9wROcwtjB7Jx(*7s$H-=R2NG@ZOvSI90#&spx^+dS7ba*)9dLb|h|1)OB=M;fL
z*tv|&Dm{nk4vZ<<u*hu2)+$MJj%VD|AZZSI#?6XTA#e+qQp>uHl{;Ikj9-HqKY>Tb
zrv<(zWt>BSM=Yy=`6C96SAF294=Pa9hJmF)r>T5NpPp$s?3fJoh>Q!R9oERWNY%K2
zomi-9e2VEyGZk`Z&>4a(%}j*At5GV=v}Al;N<@%5R5Q|rovNAdv6%<-G=$yAc(7FP
zX?ruiJzvs;@gI(7bgfVgPR+beGJlDRnO{{69)XjU`L#lYP?$ME5T-Ko422-+iHafx
zlQ~IIl=S4Gf=>&dIYo`A<WC(PZKpVFIWy6qShlI5%v>oFv^+&Z(qW}Fca!wkP{hh*
z=7&P3ZD8iO%+T;~<~XVSATtUq(Wi%*K8>T8Ltd3Rv#lITU+iC+8pzDRVbzOY04s1r
zk^T+Sufg`P73a73%JZ|_a*pC#hM^<#%R-aZCi5$*S~@zDd3VSlG6?e@nNp)L<4aPb
zl7n)ms_{9d?@|oBb_3F1QDXdv>3fvuGN_aHLR@t~R?7-i#lI1tGK3CA<!p@<-^mi<
zSk6623iZyxgM>OQ=ip35oz`sdU`1WhLlkvMXDRBE9vYUqbMQTQSYb4sJyp_l`34U!
zku>Mg;1Q*gz8k$5JhDO3WO4AQ7D>Ot{G1Jv<_sM?y2HwtFCgSTHRDp9?0>no;2HHg
zCp1#qRwdCP(<GnvWylQGCo0{LnM!M@@<V2+{(TpiLrPSi{`~@^&xS<5k4*8&I|gPg
za>OIP0^U*9<&N^n$z0Y7NBQKWl68fnd~(jXtSg<NQb&NRoDl+ih7Eki2@AkpXH`0d
zQM6iTq5#yxtU70^0Awz!-YJRJS>=>QfktO;6j<%dH-U>yKy49(oi)xfDcL}F);emx
za0`JZr%IghjUxdxJKD(|IttJ_=SAhn(pAp71}?W?a(uI{h3g!JHaLq7Xrr@2LH-<I
ze%7f{5apk>$!Rb!uX8piXdp2+I~@udPUr@wQ$f;!&pT7ogr3Oo4rhjfK9dW~FE}Me
z*><N?LASB&OU_&c3H3Xj`3gG9vb&rW3VNH+H=HU1^M0p8K~wWk_JFf3?Q{&DMf08Y
zpc8sr6@Hq9-*#S%fnHXSh^fozR?z!b19OjaR6+jLfd0V=1)^R0Cuf8KJ?xB*fx-s#
zU1z+4L}|X~6e>u>^q4a>AiE8L9(Um2&oDCfA|uz#cmf$?%#3GPrNpT6EUTCqKVg*;
zgM*(rr3#wPUcKndSJ2&S0R6(*U_ifgt~2WW#_3Ry==*;-od)!(vrR!VY)71X4Cpmy
zw}JV(^SDv=M`xb_{mFSzLEj-SZ#msY*`J+4N2D(l-gZh9^yZnse8-uuAR5)Icb&xs
z^q#XqL9ejQV@_2J)DQ!;#6TMi=(y9Npx4>TU!6_`$*6tcY*Wx5SoSygjl!plwiA3f
z26|jUqHDq6J_8B`4;q;Lf-lBEFDoc#Ehr2Kb}Q&&LIZ=x6l7Ha$_y3;g}Ok4gHsJC
zD_EkS6|6TbSgN2pLZgC<71TtiAh<$78wi~qtWwYxLPfy_1$~~-8Nn6>J=zLrVsL|k
z-fsakIoJ^cbsEr=;5G&QnwV3A_b5nYHZAzDg1C5PO%Fb<Ag<t9GlTmSbWa<gGlK^e
zw2RO=!50-I=I^{<w*i#~UsDhln5>H6Q3V~s{weGH;2#zAQ?@cc_?Cj`++|%HJf<Le
za#;(5R!F4#1~C@}Lkg00rZt$UpuezeeQ<<=J|wg;7*<fQ9nkf`LIu?=0JJ$cRY8MU
zc0;g4K_ZE*!BPd~u<XX*d<C6Y2k55YVg-pV-4fhpK%K#R6eK!-YjCH6uDu5JJ|Enz
zpg*$jcLX0+keKN&1Rph^F9si1(4DMzXK<f_Wd40Qcu+xEn^AU8@MQ&!A#`7`+ra!<
z@Th`LXW7?-#}rgdXlKw$7kSd{$htq6sUV@SD_D{)CY(-O)+@o#d{vl#CBRpMD-?7A
zn>iG$Qjm1wzk)3W^xwgD1&Ki43T{x42<@-I4g>li*lA!64sA1_tk69Q5(>qkoeC0T
zFfFv(fTo8YR!}=Rn;F`dZWYqW6ptq~R0TfTu#gWehkr+J!?_+`!7W_dxnhY!Q|Qb3
zQ9vAktGJZ^IA9gAOjfglfsk@yL`*LP4DaNh1Ih=H-u+8J`5*%PG@#rL0e%)xo`wMb
z8c@!K06z~@3Dw(3^;dxg864^J%K;rO974b2-vUQffN(gWe-G&3p+LV2=-}a4mK_dQ
zK5GJ*&&-;mx+EiUZom>sYOV&bfu}9yCzLHB*kET}uJDDk6&hcFD<A@*3UFmWi9>*^
z0wba&p9+Mdz^ApK1g$bKHCj@or4}T=)uz;HO{vwHQmZ$mwo*$?nr;X*M4N65v_yfc
z0~?~i>Oe;nSQF@s0!@K!QJ^_+PZVeg?2H2I0=uI?YvAE1&=z<+3bY6IMS=B!gHhm`
zz>85}W8mc|@Yz6j6xb9v8U?NkycGqm4;&NykZyl2U_}GSSvLei2DBxRX+T>8BMj)q
zK-hq83KSa9&4H-~bW5PbfNl$v8qn>5`3Cg)z+wZsBe24Nz7VJ~pf3d)4Cu~4i;X=z
zY!N@95e^-0XEfD<8KT97S&I#=Tw-eF60Mb@(o3~gYC!EYMDs7zDyo67YIlCt?^U}p
ztN&BCD>z4WQv$r9Ym4Xc2d&_YjbyzU7%yWZz#jvr2@v4E;J>u$3-Fd!{eCQYTdTeR
z?*vLMhuaEg5X&N6Zpr$p(d8%2iTjk<<);DzgyyeU`)SQ|H-Tp~0~(krXd;<sH3J$r
zM@mGY_L&oLpE(it>50hjZ`N~qB1!}M1D}!xUMJB5fhsG9*%B`ZSPs)Ue@2mH^s_Sl
zhBQB+Oxc!(Y$wEx46~deZc0Xdch<2$)B+!exr#E1gPJH{JK-qc(>q7$k6&*V1xVAI
zMKL-3^=45@1~~Jj0U6(c&SC+?0*}>OLJh1iOH{XYNtKkm%nqFHG^mxQba=I>b<t?c
z8eXIJ+7~fht6~GInXXf@fqR**SFr(#YxqhP8<6y>*{Z?tu#g05xFiir4@FxX)^CKB
zaT%K6C%fnj{)Dm%ggU#MeHx_Og7Q(D@a4aYn9<PZ@QGtt!IE#=a@Y&!8^9@GZt3uw
zOQoT=kTd)iMf4mL4DVE7f)Usl4!?DP;7n#(2eg+leY@(abo=v#mh&zenJCTL!@sB6
zr9U|Q5!EjJqv4OLPz1Rg{+Ob{ks1Dd6>5?64^+HN(vPbU1>>{B_o{fAq@NfAQ=(3B
zhCh{N4;mc>pH8zg4DgvWd!VW)j6SQF76$gI@exALsqvBY{u$C?Ngq&SCFviYBl!rG
zTf=`;ijXWO3_tzC8SkTW{EV0(j!D{xDUl{dOvN;z$aS18V;t)96Bv_0S@YBXDyfz^
zY@k%5t2``2iER<EhYdpTjjHBc0Vtmx$!OHAj2xs~p^++}^*LmZ#DX7<?Ag{Nl1R&%
zph7x3fsus+hskMKXQ&)1V%9_*<Pl(!V~f%YFxl}%fhmqYpcMmA3{TAY6B{H6ncCs3
zC)9DSnAfK?HX~M9PwV4c0ru(RTmhc*k5JQ~aMW^<00lGZG9>|8@KKj5Ws&rX5tdVv
zr(L_L{+zoMv!n9S?JwKPlu(2@U$H~NIW0lX-FBt`|9l02du?T8$YjpfZDnKx_=a65
zXael8m2DMZr(Gf?Z#SaO{dTDU41?wDvXzk$-~n3&p&q^%B@f!l;t239J8EQdcH7FX
za08XI$F7sszH$M8hwKIc*w>uz*xLjU4j!?0MuA7|-BIBC_QO%&2lnGp;Bk9j6xeGY
zi~>*CFGhhU?U$p#Q+9V0c-lT{0&kgsa#)17r)}-92=t7t9Tp8~hebo$VG-zATRSWo
z(hiG;w8Nqy?XV2I8iIMw)(*=^LO-^5s!-iIgkG@q3H14deq!%aWuGDRGy9-|q|F!Y
zmlbp~%YI>ZD@X?ASN2f_z0R_i?6(wjQ#GL1>|+XgViBPKv@I2?qixCw_(BT$Z`SMY
zOIOf^3jt;OGI7$F2Th&88S`+?WTm^pOtIEo0j6o)6|J77byou;B5P+(i5&_@N2FA%
zDC2TDbG3@j9S2~ZR#9pDe0%YfZ*#URwpUCI<6BzT%baDlH94HK#Ew!}id!d93YXd=
z6jTBBbC#pOQYO0k8GC~OSCU|r-6=pFfm&0GSK9YTiHNR2t2FogIgMJS-{1^eXFqIZ
zEJAI5Mqir2Ni4~cP9<`cThWMAunAux&J|+@sICOZ<0yBa7N-CiTAW!d8KlKIjzFe1
z1<OHn%wTN_zDOWTn*u=_u1$deqqLlN5-m^5`G*7ww48rMpu%2kIRii>&(D#AXM?ml
zvruqh4D2rfh<hIR7Mor&=3VJC7oRcjDPy=Bg=5}Vt0>2E%rRvcDZeqt)hhZ3aXwHh
zr=<TDRgp11-KlwGFwLGC-6#fjI*+5K@(gnH36|)~6f65Bl;jkLhKF*Bg{Mt$J94He
zo@DH1!xi}}k>+HM&&-*V?Vz2Ub1hUjS1L$D=NT1BQQ-_CRj}2HDAEO1b_Mg7SmQ%E
zOR^U+eJO4^<fxs57}+{2dlmCnTI17lRz?>8oK<O=nN}2RNE>7uU}GBeRk6SYCI|6a
zAuCO;O;Z4+ozsls>=#Jkv*F>HIiD3YQSwbz_95nXSm<Vl<Wt5uHyG`1RbwJFZX6Ij
zfy=o)WM$`3a$jU^b$vkuqpvRr?fX=1Nq-dtvX`*NKTd^|{!!>jjek<~#8N$>(r05x
zbDjq0P6uifBVpZ>yH_iI+37g;dqPi%{CWUS>Jm1Q`;?vq6h-dS_Gp=*Ttsu9(NltJ
zQ|`0I>X`eSUfjq}?tZ<v32;C!ZpTRHhk8AelIQIfX<CT>NE-|aHuuMNhcXLn?V!EQ
za?S_K61xcdaxYgt2v4eWSNN3C;m$1g3ZE(&2n&#Vr7um|IFG<pzK{SEWbUVYYBRNt
zC6zvC2|fZ;`9=t^i6yl@HC6s=3V=Fap(=qibL)Lm1)#F$Huy>ekS?w9l}>pVtmd}+
z=1)z-w-mithn)4AQ(@s6pEj1fhn2g*r`!adBIa)NEtX36Vl~PAtZzjW*yL-70@wLA
z2q40{-lq(#Na1t7&r69A+U(mVz;zd(wGQ7s0tl<O_;w1w_+W0QZ+EohHs6a;;CA23
z0_>dwv^#v=0>~hJ!S|NLC<M6Mr<Z(z?(t>X(>^LhjeC7z7)$&}y&Y`iKA(!XG5DDK
zRUecr66(nPx=*k2qI=))=~Z5!9lmo^KtZ6LKE382S&U{L^ywhQOBD4teT!`jf@M+n
zbHC*a=_rNp_HEx=_O$zoP_Wx)`KE^OBfK&AncJlYY2<tWdo(bDn){FjcuJi64;VgS
z`XvtEKlwt+0TAeWz5xo7&OYMH)Xo8Q<@>%7xKcF&+Qm;^_V~0swZSPuRvv6s#tdB+
z$d3f=`cKWc(5;b!8Y5-mU&R`5)-zVRHO5726g$@-S1pSjNCj`g*K{Fj=YC7?i9f{t
zG56cr)xQ%SN$zfap8FjFUHUwCKY=}ZBmP?g59y8gp9y?NZ^Zjw0^lF@Mtn4ZhxJDM
zYy#iaM3)ozp5BOGP2dr|5x<eZqmI&dL3_-pl9BlaOTO<Y<$s#M51bY$`7MFHj+zM;
zC(M&hhm>4W1K=q~O^XHsPdjQROsoa)jH714Vgk=PY9=%j*ypI3a4Ui5oQD+$1ok_R
z3xNMZ5{As#C%_#9o_7ukAYC}<sM+&<mb~D+Y&pJ(Sm}r3%TL4WmlP)_;$O&=<$Yh6
z(@<?<!%fPBbCVoyR?EA864EVdF<|}hI<=%vW`1i}>ay{0o7%hH&iwUizj`;*8&(L;
zADG@)C288V@Mjw&O^XoT)FNqGweWQtB+VHU{#-{iy?I+S-LX^BuT2EbEe{XR3}b!6
zhn6CIQ*@;Z-;61)x|un)Kv2emjj^X$k}i@oHnr@d!xFXs4NuHI7eIIt{D$zP><gKm
z3^yP=S*mf*8J?n=P-(qp(>Dxb!4s?-SZg{OzZr=jgHk#ClI?d`5ekhPk^OCyjvEO=
z<3>v4<yFEtSfKYYF$Pq}jgj_fZLw#UG?(;odC0ILmoV~ko&P4Gckoq!0;?nZl~O_e
z)?_epx2h=Vd(>b)$^3hjul6d__o;y$$iewqSn7^p`s;<!^f%NX7cqZ_8sxK>-l=FU
zWBUI2f`1p&yB15ji|GfHB0R(NgH@9MOQyfsU^x$g0p*e!I=U~C`65#OSMX&yFX1~#
z?RBVu&TFwaf=CUQE9`zh+P9n#zJr221Sv&^h`8<xI8UYpnv0}mvRKY}M5fVI^F~sX
zJmMcLsl%7Q3161eh;L=`+K^I8G(IRjB-VHxNMqN=BdX@yi%g@p+^<>AKQc3ZnjT=L
zh(x|vjPMyU^Zc*jTho67$skEPf5F!v;8>*&t_z51kfmpKz!E?f{j+owm-?7{b|4zX
z&OJxRp~W4T69`M4Zmu-v1_}juhwJEhfvEyCRsbl~!QQ2F0h9$wrR0_i0F(#j3m}Vr
zg^uqEFjvQS1(>G~TG+$f^YuZC_<0xTgBD6XcYZ(_PFaH&1imIsiyw4RV5b0Yk?6vJ
zvZ85RM;8T@6%`pQ4k#-sE9{bhGMqfE&0QK$hO>#lrGb~FHE}zZ1-b<gk7l_(C)q%>
z%k(+Pn2P|c2&_<R?cj?6T^T4;7fi+wx+<V=y9lqJ4(Qu1(&A?V`nF3EF)IUgsvfOM
zZf&4JLE<Li%t=Aw1>gY5fYt|gDu^~V_nN?N1&P!)1s+z=3{tp0ps&m@5|rB!IA&mO
z4Or@8#&1}5b0DN3@g;5vWCo~u)*+VN5hyJ+z%K+!I}|8>)fWRHeTRgxhTLrdeQQLz
z@uh&iCnC(<9q3jS#g)7-P->}54>DX|#U)`Y<Da2?`~-$%(8rPFpoqJXKgxL>x#EY+
z&;4mo#tKSl<^C*a2_SU-H5d}$SvVrOzX@gv@E-*JEjU5|Ug^#K_h486-wXi14HgQJ
zLEv{mrSLKp{v%i-B_f$ugQWtz%6V}pI6n#;Hi07=I7+nF%#z=mz<-*+(cpZ``60Me
z27t8v?2a;R)F#V05-ApQln^I~9_0DC=Hj^&q)`PQf5DkLVsJGs+Z2@OJsCw`aJJr)
zZDYx~dQbK>0%dx$HKznXxvgdw1zu30!+iqGwfBi2cn`T?o~@?ZN31hnhx>}KQ!iMc
z!+o3!1sCdYAN8c*68orlxzmY;$dGcs1#gM119t)~vq!5kX??jH#*^kRvvnAc2DV_O
ztsQ)U8tr1E-WprG`%-VM8`KjDO}2LM1zKlctm^&vEVS8bFILc>2(7nQ*r!vr9Gim8
zc4>zy6mW~(sUT_QCVN{9be92j+V{jjUsKTgB(crjX+YcUmkrD>+uGq53SYK|DwA~1
z*{FAqJwk5{$l85&p#govo~R%hdjy*mbQ*N6V5eQGpgKa|wC5|Rk<hp7#R?h>r7q~Q
z8x)j7=pXDB1<_m;eAnKfAd$plc87w5&+prv2K0pec?A`)l_%|O3Ytym8T%ds^I136
zDy{6dA5>-65c7b&TS1!${m6dUsP|(xDtjBt4!TiUY2^hsDl3xswf&;1C(z4oRQ6uh
z`*$}E%hjmhcZkDUGuQ+_X$9l#v67N+mG(*6ub$%&C$L003RML~P<ZupS-}M5rqSjU
zoS|GQnL-nlOLd4-aFTMVctx&Y@(RoOJrY@L!Fda*p-hEOQ#&<sblND@Ca;&D2FEgE
zG!p!reum(VIQ?{?PZNB4p~7W{PcMR_QVv|fDk)F_H$JsdpaX7qaz0O24&?Wko~azj
zpEG@CSXw>Ibcu2x-)4IDRNQ|?LOsbrGvfaazo;jcLmT7#AVD#$ik~;fEa%rK&ht}5
zVhC}WpZH=JnQ1xiM-brI!+r!q_>x{^7LF3G=ynv2R()m5g=5gy$wXy|Q{v(m7R?oW
z;uOtO_@q&Een|440AkSvN&>~0o<;MO1ZFY4K+)piRndhx+1rSFQFwT$=pt1Yl(6bc
zdOq<Ns&pIEm#`ntlA#~Eyo8IU3NFXANRPmWY;%U<Wi;!}QoOuMoD!T*`H-nZBLW-(
z5RW6`JIFpdV<W}l+)8nf2k;qX#Kb40o||!OXCZ4X#g~#~kvbt0ZuAKm+bFsmlH5Sl
z>s{1v(N$5#Kdm|`)jp#(nEQcPRA~sbN_B#^qNp03AhPo>ZgZgtv!yu>_=K}nb1I!?
zId20iUm!AHQZP{k;$=Qf(komJ?crn`CrC%8o^hHqHx;>OoQ_QzkG^Go`gBhxskzh$
zgh_fXk;0@L#j>PvwCgkhK^&3Ni6x5cUy(C$wk9jUS+<G{22g9FyUJz~I7c4_;AuW<
z;vBu?3fj50@=BzE^K|4>fKq#+tg?buhF}*vEkL<lVnzI=i9<8EtK?_muxN5nG&#gM
z17t-W111lNh<9>!RJ@Z%tI=YdZ*s2cx}?MXu>V1A>H3I*V%7EgkW(;Ccbx-RFkSl;
zvLMU=ma_vm8GG<0oc&11kC^zZkeB}LQ{=f#nfRO{FX{aO!TA7HCmwJlEi(L}VoN0O
ze5RG*z*0-wnUQA+^M^ax$W`_-97#<;DmVpS&WuRjxkxFVrkpJ_RwHA|If^Gq&r$Rw
zeJ<#6|Ig2q*$$_h)4>LBiZu8|f_Fv0Zy+^O2!sOrq~@c@2|NcRZat(VGw{P`$@7Zz
zE5v#p(~Rh|gy7U~+BtMUMQ?GkcO2>9NBELKc`Nr7b;ACI^Wc2`yJLx-e1pJmb=YkW
zf&b89w<ig_s>5!t5a`xnH>q<-huy?WKCHuTe<0cs9d<iG;58j~6X10nb`#+DI_xIE
zf9kN?pi<O1s>5!R3B2Jn2&3}}{6UA^RuOnphuy9v@JAhX6L$Wj!)~1{`7a%IyO+RQ
zI_&n31pchUZc_5L4!a5P7aevJ;2j-yJIFfk>9E@$3B0evZkc5Oj_I)5+vNcM>Zsl0
z0BAt&2Tr$iL4XgPqn2|gM58wO${&9KaGs7g{8J<?ZocL0BQocQir&2l5b+OuEA@Rf
zrr2`+I|8$9-9{SNRc$DOLnE*R6vhL@r4D?nHm665r48e8riGCb*=fWVuVFDwwtg1z
zI>73=M4fSmWEh-%BhsKe8bx+2=aERJP%%n=$`X0vG}4AR4dNB}8L+UNKPSMEg^!+t
z#u<ho8x_WvmU;n_&IEj^xl%kv88A-4;#_UO=noa=X$vhtSQ}*l#%j~col9}P-c`{t
zEFPy1o#=cOkGESy8_0igf!!&<i=bS5nm(9jFN#ms2h(&#iVN+Xg7zusR&kNNTbYGW
z@!afgR-A_e$>MqJJ04C2e7-UfJa{U;K&7);6R{9MnnU2iG%I5)68uaXK0a;QFe#gc
ztZ4{5L=FO`Wkqjr70((g`0}kiTE)x!;sa9s=WP0iij1V6SJqL|KT=D&q<^fvMB*O|
zN9(>&7)}4P@^yYooS&3PzNG)9G<uV>xIE)OQO-|be)L)670&y}jjFt#=c0ZdSR=Rq
zWf;YK+p-(>kEL!nr{P<SZFqWrp+wy215{5q2-CAvPdF2&XRDr6qSACkY@IqJ)YNH0
zD%gfEQKb3B+6j0YImNCM;F}BJEWHvACvdjbDnUC(uloYb(JCguxq98Foh?33>)SXs
zfTdnEq=Z0)T?+pf6jlGJ+m;hV$tWgOuh|X6|B;#JR|thfn2s+!B{)pZ9A-w1&q9Ef
zLuGO<M>6;+d`U+a7eA<G%u(bNe^bvG;qzO%qrrJ7`L^z;0K0WZ1+7bWbTrZS=#GAe
zz(cyD0{nyS=(o;C$#?WDlh*#xo{#%qAa9Jia4ug>m~OcLfcA`Hx+L&_V>1PP7V<3T
zY<x@i!o|3;g&d28#rNp$v3l{n+L;sJKHXOVzGkaqUID(YJ1)RCY!z)4V275106Xo`
zmh-(>hG-o8KNg1m#bszi@dAUP3pGP@J&G^VJP2^HCM&=~O-X=Dw7dmaq~$HZVl8jp
z=qz5M<t@OaTHYdsWwr`)39wvWG?NA{)8QcjF1J^R<OEn@R|z1kU7^jQG;pQeg7`lM
z)fk>90b0&Je9Is_TztFgvq<Xmy3ems5$=Q|pYs+{+V>IslH%(P{Lh(#w%HuC8_Yr5
zVh-9?bI@)y2kj;;%6dxtW-UsdaTnjBMJYh1jXN#09{dDubv_S_;C6h8u@HMxI3q{w
z4Gq!^y&L6vGGmOgH@vnwBUf2VJ{>zFtZtC<LA@CTVP&+^W@bnuTyAEfZRcHJI)5d#
z6EW06W5)`j9DwBmCl`x?Nb9ZKpDSs};lMAnv^X}oztqy=xkK)+w6wT><-Vi^BvIX8
zYnhPy+}~(bp)>G*$a@p;sH&uI{4U)$orMrcAb~(=5Htu%kR@RcK_qB|pezZChD8L#
zBuH4?BW@rnC@wf|=(ykt3My^`ZX@ov&ESr&`-+S+D&shQRlhpj=XCd_=f!ru=lTBs
ze&D96PMxYcb?Pkl+;h(@+NlBp$XhBPAo^_;5WE^!^p4tj2m$Y@=)gMt2WoQ$*L=|~
zyBR@r1TVmUs76qve56KDi2m5V0&LaH_K6x!Co}S?8cw0-Gqul)YpLj4wR{Nyd(`qJ
z3irLe-SUp2+|tcYh(gClp}A3LVFYT)^<HQ9-fINnKb31SPxx7R6Ue_*!+VXg_x?q>
z>3v52Z8u^ev=u#O=>01#MOuYi87kTfza$<7Bc>{Qzkyml{zzhfQ^qhZQt!V=OmV?`
z@02kN6O6ZH1V+PpTSj2O@AQNmjM(qWXbkv08I8F<d%s^!;~yzP6oq@=Cq;$2`&ChI
zW;-^iqVjEc@69T3VBrI_kI%cEc+&2U$SLc6h{(a%aHx_4q?eKdq(sR9(pv=}#>&IY
zfwPZllt}4Ijk1tUQZ7R!?XZgulP6`U`#$PP8Bf{hCEXArX)HhF=@$%Jg;NMJ9lp9$
zCJpO|UaBSyyrNOsq8tw7=UAocJ$e>d+OiRJ)>WFbTpDqCf2jo~(nKrD(7%h^^>W7k
z2k2Qy|8C&|Vzu~rOaB8yQf+@D3;GwA8QbprckIkuYTG?v$5?=*((vLGN<(+AT<!b|
z-h@ah?;|UImsQbBN3AyjR_je{YoAhyB<{ibsQ36WV;Ugk;b`kKSj@YN<qR#eysHRk
z&s^?p1gS|FKb`XUp;Y#xbm3oFe)gXg7<{;EDELqoQ(04R3-P{7X}T*74LA(RKM-|5
zA4>k2fNq?je87QH5xl-RK&@}mTAMXM9p=Ik2lP_CX~6*LlG*S9s!Ik#kvak-Ja85i
zv8e-3keXuVfwQG{mXPFuC(^qT%Lw4#z+CS_0z0{vGQs0VV%}Q1$bmz+2V0L6Zc*O-
zoWh=!J3fXi@7X93_e9+M)y>_9oWk43O!gn5?2wL?JrR^Mh7Cb})<*LmA{gqx&wJZk
zc_LjNO-2ebGGuv^qbUZlA(5z7Xjk~8upZ0%<33Vc9*ZpRNuOjx<A=$TT?Dij92+Sk
z3ekp8I{$;N<TlHyE^>7TT|^r*(cH1WFQ~>oZ0Yk<*Mlv6X=<i`r{p2k4`I_>y6T63
zWT>tONT!-iJwlp`TGNCTjVxzSI>L!>WCmqOIB~oU%B1z3t;9;POh3D*$(4n}zjF4a
zu0<Q$7Rd_^{IY4$V%ON%w#22m0LsBz0*X#`bAYhlicWLGKt8G_<aD<f2%f&4<I4IW
zM|RONS8giUg+=GO<zS=LYOClx_i!K>8qarSA_zxZ;L7c7`SHYdp}Q1pRvjVB-L*h|
zm`=zFcO4L(6&9^@w*kTQ;1YMcMpnB!fN<j~y29P5kt^NLf$-knqO0AX==_&z8bH3G
z3#xQy(Rs4m#lua}`D(dq;xU9=pq9HD8M#m`cU{5Aa<$yGiIEj*xeLfeYPsv+@szSs
zEqC3_$i-^8>j_3KQOjLGE>+82?{La0wcPa`BdgVNS8xI$m#O70q+IUJL9q_xlr?I(
zYa}CAsO7H7j9jUfyP6oe%3F>+H`NkywOa1tH%p4vs^zY48M($2mm|*~)N<FqIptcl
z+_n8ULatNGU0*YDy(cx3!?k&XCpFWHk#*h<I{%CO)Sj!|<$%W0it3XVaSGOHkb>?9
z%P*@afo>})k9SQh&j?D8WgOwz5>4JtkbCH{obe?BQNP7S>P-POrE#jsA_VCr0r;bU
zaugk_8YW_EylR--5f)9b!<N^Pc<5Y3R=_O|7t8BI)I8#`iU-SNn==gVC@qtVF<7mA
z1MZa5_C(4sI9!k)8XTsQS=RN8t08<l!(Alr_Y5DPmSK4G8%#5J?`EQ=-A)(i%o!rX
zDO)_GwaQ02hvZUk@Dj7W7G)jW3hJ13uwsQt%=#0v{t{&!nh#c92N_x*Qn_6ZZ6`w(
z;P&(YqZb9Jj0UK=VT95lj&z0FbBd-*vzkMcq8X}L!R<4>kd<~akxNhIJoGC%&hyS9
zSj4d;*|fmklwjfJuX^a)nUSrKSbB(Mc#qLFmqmGh=44b6%mO1j(DHV13Pd7BUS{}5
zl!$?XQ!FooT8qg^s8!0o<6qH>uGb@$0g;Uhi>F~bnv8%E;_*?Uwn0)(ji$gbBwtE2
zTK}ah+_|GDAU!(Mi-G|Qfs5YG3rH065@b<Ypg^aD0>wbubDs1-84z|zQAVH~2)1-(
z2BeQhN>-o}DQrYhi-2tR{&pfE*@0@LV5ZwLPy>VwF3Jf=SB~0k6<CTCAgu$<K$cG;
zw!FY{AY2<oZ3C+{k{?(L<WpvA7gz_RcMT!!1M7jTV+*<jHkO2o3dIpeafj4FIbs<j
z9ToB-^L7qchZYnS2`~Ia8z3PHB?}|L`<__yxXP-B$wM2yFCI2TNByv&GNm3smJKVH
zw_SM}J#2U=jAk;D6DsIFfw%XlnSS9oA_BHWdU#l0Fth4m{YCm&oUv5e6j$9asvhrL
zB1#xvLJ(@cr0Abg2n@SFn}zt7iV2kH7ZnC@^}ho-C@ZSx*MPiwh3!^!mSWiQz9Q*q
z-$hj96z!17K_0vORagAfjgi-Aa^STih-Rb|MYz!Vca%U!!4jM{h%T_Uvgl0_^$1al
z{-Q*^!pL9U5N!H@k)3Lmv73>%+ybOP<J)S=@iV8qqoy1=T)*$CDMy%*_tcbQAS3U)
z<uw1H4AN)~OW$B32b{9}W5&5XxO}m^zY|XHIRUmvlp%n<YI$v#$n#qzpj#r7>(RXe
z?f;|{<t0qf5m(`InX&N}y>c~UTS|=OnNsr{ndP+l=bcGJ)I73<%B5?+npx?F-n%Z6
z?A=C?F<@f3noZRsq8eFWVMY`ky$Yb%i{*XKJjgAjbtgxJ^GgQO!SWz0!nuQ>^G_)S
zMy?(%?+f$XZg`1AHFplfdlw_xnSJ<S<pzAX0at3cPnCxIR%^K5cn$Zj(QxTh4VTpc
zW;YBUFb6QVfZ+ohH9Tl3;P1%r;e(q2KRSirA<Jp~D^i-`;dw}bq&89-l%TEDl)zcw
zIf8TNOBI1$Aj@v--r?=SwEja3Y1MRrql$-*MK<>F@ChRNN)~aPh`y8ISt1VfdJzZu
zLK61}VvuS=wQxZ!ZvzoKxdvey5zq+d<X$9=kbAS-m8uZ}xmev80J%i9NFb|RS%e0%
zS~X9e-REAVnkSbo_d3-)fn2YeC)jRK&9iwbvE8JaCy<-f9RYW9xwomC0KQMkz1^)r
z%ZGqF-8y>yO}XK;Z55ZoX>3o$DskGLX#}qhw7rLzDlQA<7gSsZ9&SYyms<to795XL
zv4%1sh1XLmt_%ZiO%v6Mt0eAtFt50}y6ulFX>Cn@sA4U6__0yNHIf(bACw><*VTcE
zO|Q6Kf{pL+DsJE=KwUm7xKRR+H#=0UYXTkcO^X2^#yq!5K(Y@j?rCm&1{Z7Vaw?AO
zW*ERc+pM-%F#QRuYfi-z$UB?qPl|CoQLcE3irMxN=6YdWez@WVa5Xa5i&op$nEsO0
zHC*u$=y1|2lKXn**}<;Q{ui<FucA|S8d3QdoEv?|ze_tWpQz}WvJX<}6<wm6MS=}v
z2jy^3X9X1#wV{(l70=cyY9!Ek%2`oMz1>L>nLRjnxI!8<Dn)Jixr{g}=zk#-F_s1-
zE^<cD<dc4XqQnt}qJtedq63XoPetT<FA-#Pljy|IR@eqLlib5RgGrWjbeJ?|(mjhS
zODsH$cx?zbrjy`~PWNd42PJoM@!XkvS!sXaq6yOe*76O|MAiN<iJGLE+?$+Iqgol3
z3~F6@)T0m?5m{Z)WVZvI21^<EcQ`$PJzUlhHxr3_)a<P)Exmi!K)P(t+d-uCV!AKk
z?nytF9p+(KFJ_4k6c<<85*4hYo-2bcsL=Hzm%!QF2uCgzXS0DLn`K(W(LeGWsa(*P
zNe2n~xzeM7ex7u$pr0?j8|W9vZ4>AhhM|is9=W_L;M(Z~uPD~=MI{<uS*GEO%QbvS
zC19T0j$Bm@n7g5om(^(a@;VK#nWNz=r1f&pjl5b~DGwDRuW1GkzeYdu56c0sV))wC
zZ3pt->(}PzjJzInuCtLhNN2=Tu8}vA^Q`Py#KylP+QGA-Bjh&gR3aZi9akZ5S4W)F
zvGNxYQKo@c5Cs0!BgH$Y31iK7q+0WZR<-8)7G)aQRchiBhP$n{3faYw&+E8E1WW<W
zboxh8QdB2V%dM$sx{6w^jiMPUYJtpD0|k)TDujWYs6rT1|2cFzhIj0YNDISSq_L!S
zvQNq~qFLUBbVZTpjFO!OeD60(?JeVVzESxhIGUH;MiodgS^ubZI^agN*8w-GPy!Bl
zJ4nE>iK9A-OL@U<R8cWx0`4S%1vp#@I{Rc)X9*yFlsBpija9v8MoNc*aZl%xXVq+p
zYsB&<Fb~!@G!I7?W>l8f6q_7f{;<4D6NS_IXOxJ$)yD~Sacj&MTK^;*by-j}Snj@2
zFGJMbH;|#8+)e-)rdGJDSyapAl*J1Y1n-wsiZ^*LU}Y-{UI47NHvn!UJQFEXWn1ww
z$8lx8cyk8R3wm0G%&dZ22RiLMTSyGj1EW04301RKcD{FcY%)BE$t)Z1V(FQ;99iC@
zv5Z*bhX2!;(|ene;g_<aZpO{jf$C-ow}%I*`zIj9=52KMKryZVoS>Q{oRc&9Bshen
zkDf2i;e8;ZPnLdhEOC#nrvYg^0c@dF?u?$Kv(!iyWUmdhJ(Jldhw^hqPj0({;VCre
zkDda4h*E<h2hQl@L%MGnJ%jodu(8>rPmn5jn?=knZozs#W%$HmdXN(xNXw0Lc3jj7
zow4)_@ufMlm7mrZsVCwcPo%(zJP|*Pk+apJ*(gSqsYSD?j6@!F&u8R9JB*p#N=7bH
zOWS{9<P!Dp@@qyeSL@taa|l^umm^OXMy{}BA)=I#EA48ej9}y{^}ur)BiGt>NV%4g
z>+Lx}kmm-w5eRI%(OwGVF=kt*o(unlk(=%1NZG^4AJubVZ!RIXsYk)R7+G(xqxb*F
zWC>T?cF7LA(kKz3$tjjs6(#bzvn!m_qeNj^5XF%boO~~-rYEa?k}>t*umO+zFtMoF
z3XAlf`p;QlImd$K?O|@4%I!imL&hcqI^C8Con%8)R3+X25!G;lY?T@uWwpFYW<Zx0
zU5{0p>1IT;LLp4S<qS$NrYT2ebS6CRNu;-qbK_PVc{XyMQZ|f#M>)3lL{vN&xX*U^
zVtMaSiYm$11iE~&JeKAC5X}^|i9YB<RW4-=6C~5ag9)PV=g?J#W_Fj?mr&Zb$WuSB
zJeqVQLHZP!VculIMI0|W!X~$gXsV)5W%l#v!oLoOM>hs{XzyJ?R5^!5owIT)5#mL0
zZKB&$edlw`GlFEP16<x>94?8fS37|VyV>54l$!0#gL13GSgpN-K8~xW8deHd$>XmQ
zVlP}x?knUwH}oOYn-3={d{cUi64&l-r;yM5QoT&}Tt%-c?3z<0ofSX8t!gKo7#F0f
zJ$0KaiSJ;xsI2f*(a7_j!qe31{bQ6|c)IF{_%)WoGiYZ3GUOCCNe15bQn*NE*u@zZ
z)7~GCvwC0B1%}dU1^td*TgZ-qk%5Sq6(WX5k;03Vn1fCtWThRjc-wuX*ccE>#>jMT
z@O;Y}Q((0nOPpich4PEXv?Dt#>v+bySY3<9$P?pTG&voko*47m&=|Fe2XK+hX#jVU
z5thgIF=6o-@^%i3%eJuK9(0#CMrO=>_}!RplE%a781*fSaco$zA?#qaw!fDJ^kD&q
zz|u>Y@lX-Kr5w{sW?O(u#4>JFV|t4)z=!dzw>O-!%Dqw*LG*NlM0*nngo{FB56>d1
zwS)*`)!Q-47(RkFm@>e>v0bCLo}o70<wQk2W#6pQg9Xv_%)-KliK>DRDhh^;%3>*4
zPaQ2~;M=ZYN79A`^aPYx9q>5j5G@6{r^uNaZ<D0lCda~10A!IP%ay#XDt9q)sSFnz
z87?t1T&gng^e}f7aTW5ItjxprcmUHJYwpRaSl+@YbY>K~FbZ8pP)jb)E;siBQOnIB
zcb8HN<U>bhG+aNq|D$YR&AA^rvIxv;a=D*4G9GiY$o<?YLqT!w_E(OKx)AWKBMUM>
z{_e<;lF0K9M+RD?{N%_$%e`;zUT6LQwh~CdrK9K@H6A3qNCsl$47p8E4GYuNV_zIo
zndQnr%oUc~LOtB&Qv-9e)x+J~1%$M5cVdUrG)4;Dki5}|GtrA&^#W%VyD;pQOBw`r
zaT^7L72VvWf^B6f2f59HJ;&I=u6pzGb;b^J)ti?HiaxG-*HU5YB%i|8$6y-`tgpMp
z!1}q{1pAVsu7BifZ5*JvrI9bPDeQCMRM>Yh*iQyl7WqCKILjj6XH!^?yqTyl^=>Dy
z0g<n@DXiGw91!_hn@TG)(gwQfO;4l^bSotdr;-nHs|7<-7~!rKY|bfEzA>(PEAvXm
z#=C3foH@kKBzK*G)ws7Pj5%xF^@82O*i?6;V7#1`JI&o}V8^)+3O1iZeY(5FmHww-
zTzeu|7DwJVwQ%%fBf)fRRJKEP&A(%&bPXL-3qC%S@)%laE$l>TXu9eQ>w?@FMjtTK
z>;q=0_Qzd!?g^^>0hvuJWavS{xvxm>OF6uDsN6gi$$iz4RUaU)Iqf1{&drkH(JJEk
zqsjo}7Nrizt;FR$%|f{#-pdiF^aFzUS8#=WXsF;a8Q1vi&w|U<xW<o`3f9oLhF-M%
zSXp1<G3QuypeNuQ83_QZ&&&YMlW_@f+c2C5Slv?t?pmVhhm=``O;nAlKZMep@$!M9
zf74C<c=drIz&&Zu{sY%J7s0zF0_pu{H+v5g5&dLwDEC<L6}rap%2)s7OcNYAbDqnZ
zJJAUVhQ5)G>7rf1-a=(jxvHpfoyAohDPdd}svxPqak)aC!sIr}gWL+nwN*2cGdZP$
zx-~+G718u0dp42zH=(t65`o!^BY3M$GI7gZ9-*}HE@2LS=L<RVyz2?iWmvp5u|3?$
zo!LYc%TE!<L|z2l9$|&Oq1-MqKzz*P1E};Kf8xOVHp1oo6os57rNqmMLT#f^n4s()
zbm8Bm1$q3Zd6LvC8#1Z4o;6H5Om2ih?;~+Dld?`~%*k(@)DOmYTuiun8hSRT4W^?{
zCJjIukN1-Xiab7PYSJKeXwG_O9BFkem^2KG-C0Pvp?J6`?#uKFQC!aO2tAFNba;+r
z_y-HCqI>O0m0GKsH$dx=A`AkKQpd6!yofSQpb66?d8z|bs|{1f8AU%vw9aP>j+F@$
z;PGnqwS<MuU|}_|fM>vyYDF0LZIh;nfE$@_Ivr9t={U`Iyzn7U9Zd|7@*H!{;WBaW
zD_bBZ&6YIO#)+yNe`Cf5W|XxIh*4`9U_4o=W|Qh!mY(&}f;6-6FLSb<+faNQMJ46m
zq>LW?Cp1aUwShpT7>d$~H~PW9+U#X2Tg~xZLp8_4aPEI=Xc^mEOKF)bENs_agCuU<
zwbx3Sc&=A_lbFg~d+nXl8v(wn82o_mD+64+gm^Yr0{;0df*-BcJWnju@RQ3m{|jpY
z^EWVRUt9+`?QDYIT(9|e{?vkv<j%YHosd0{5nlhTeLqAr?>N$nQhaXLeu!MOpl;Qw
zua$BCQTxdj(AihDySHih$EN}F*WzmTZU_7+TmH`-8vc1Frd2$S)&}ie8u9FpfuOAE
z>YR){rx9Cb<eUt+r&Z*f3>2(=<SY!Ng>5xm;vu!RbL40W?mTO|+G?W1dsS->vbU=}
z4_j(y!#enTj?~o$T;h{LpfBPQ)Jv0C%H}Mn1RV;Sj5=9V2Rgi>4*o(Z&y<I2Ji64L
zFZG7FSlL_<b^WEG<;V=%R;{J;pU46X6_#DQUi$Glto#nukDtlNovI(dgps>cKMv$>
zwJ!|FJ!**y$h~Tb3&;kw#B~h|xKAx{ZDQnpwZsKvlUm}shC_I>TH@NuY!9d<t~VHY
z(3Y7ukcVuUd4IwwThtO4kcZV07c6*0EpfqXkEtatgy!@1#fS$WFW8p=0o%)J@oNOf
z-z#eI3&?BsI<O&Z-n7>P;cpGr?zA@oL9M-SOAy|CI;DJUe~uI&pV;34LB)M*(<aQ5
z$^Q0S?=D~Hd%sjM-ZCb#EsA(K;hhwGLp1FUWVn~Exm?lS7H|pm=_nW9w5X-Ax4-}b
z_dRs~A0^QG55b6t=GL{nBqI2;d$lDhB4BdlZFKmlzuM2sExLAqozse~K<Ev&)s!6W
z7-m~C@r8(r$Z;$1+sMcPD=XMnm62mpu43#cyS%me0av<{q^2darE+@zfp{>oZ>yak
z_9E95V<u8NRfQQp?5v%k!VG4dpu!Bu$@X|u3)<yE6?4)6Rm@#_1_@ZC!YrSg?CC1Z
zdNOjh3bW9egwT;Skk*kAI<W@GVT@d$f~ks;3so=;X91V0V4A|n8Wl{_nC&`y3+;a+
z^?B^x%IwF{kXcdobJClzp6nN-H(@o|FG_F1TC!g%06&Y$ekBZ;oss=kF<_4V>|G_A
z=fg6<4%w0YF?qQKWt32qhr5WIE==SQk|(~h{j@Zeh-66_M=6nq!^l5_S+O#D20;n$
zBcDS=ly+(M-LMAV2fbHH%WI6;8>F<XBYUHimb>KaO;TD8&+N_R$jjB3{XivPeyo)J
zU=3h+VM`rgc;VqWfM*>*JdZTe`=8_jDLIVfl`(q%lZo8bqBXkQsOk9^6Zs82lXyfl
zJ6bn$;t`eQ)%m1wZYguw<YQq6FDOnPFJ<OYadNGc`FYAcd9sul@RWi!lo#Xe<f-(5
z?r^l*pFAy8Y<aIxhU~ZL!oSI-o!k!@_ITWZlS8#!9{OZDDXE=Gvm3S-w<JMh>4rWT
zQa~fU^fX<fP|pZdID{Z|cj#3_s8Eno_%#&p%4^{_QX+mjR=8VA1o*ownH6kvr;G>p
zn<Qh3+9br~pE6PE2XIXzcus33`s8NJH$b1VPQDQhWa@fB2AxA((>AJuN#;yB9C^W_
zmfrxY!)XAk!)XAk!)XAI4(q%}7HjyZ5)D^L3j+Vq<(fXGQp01bHC!$62>x+(YKG?=
z*QxDFD&28mYfz4JoT&YP37xIBxA5OC)?iBL0y!P1gvT9V!4G_weOy;diVmb(z_BEa
zJG<k$=QyGy$C*|Y%|7jDVd2V{Hb!L!GBzNx_zC^A>JU9aD<*ZQ>abPXmtg))U7t>k
zi=Lh3U~-pZPmvoKZi-U|Nu>iGqVEc(43z*lhh$7qJN*C;r|0ySM3m6o{N)5o<XuNl
z+D&vpWQALGLIJo3Y^4^0xz}seSp;)$*s4noc(})GbpSn!|A0mCOCsJE1W60$*q5!=
z{4kZyKU!v{(D`pMxEp0xEhu{;RG^!h6tPV`Kv+y!v!{pyni-xdw(%3J>}g^fG9E{^
zolXpC+}V5Q6C_1m6@gIX!12<>@i==tbsFBioMjVTFcy}0^pOIt2cEBZ`Rc|$^ISp-
z)FMg$^9X6D)?|)iq`g{iX=0><S|Dv^q{yKTB!_dip-WnOy1<I!Ea{|1kd`dfNgYp#
zSrepir!qWA3YSB^&8iivdy~+t$zgi`kr>+J!8IS$B_BfP@UXnIVpG--svhU8B@o)n
zvTlOE`Bbf}o5i)<ooA^}Mf0$bb&F{Hf-+^@D(wgG?ZwF3nk~7bgzo=YpMLQI=0GX-
zAmBM8%O+=14v7{#rPPcvGH@PmP?YCTm+Y30-d8gb(m<R?sN297-hN_v>;;cE0ePnq
zv6IV8RR090T|^gD>z2BMWQw!(e0n{$SWR)bzUsQGNjg#vR+DrfJ=7!}NKZ9M2Xcs-
zqysrrP11q%Qj>HbC2IBrq_>(q0XZx(NoRBVs0kBN`l<;NkbY{C4y3=DJpn0IvnL>B
zYW4(VfSNr48K`DYKnAJV6Oh4b_5@^znmqv-YHy_VKQc@zOWgSe;fS5J-dxoG2zK&3
zi5<Y|c8uA*`4YJ=T|n^35=Ur4^%6&b8zhbZH<m!=;0uZWlrq3*WedvzvsqqKrG^((
z14esWT%+kr>ok1o9Kh}h%ByboAV;0^jOMA%d9Gld=H=iY$MCY%fIk>Q@VRR(?=>n2
z;wbEOk?w(;j(33S9$dD&tLhOtGIF3pol%G&X&H!H_J%rdu8U6!J5g=s8P3Vvni0$H
zI6~?97hPe)Qct}*2)9Sx9ejm-6jZUyub_EpDwe?(QnAc4H7`TOa>;T+GVQMD@WwLI
zLIw5>jAR>uP0zT?zy=?-Qh|*MptlN<0#D}}f$im~z(yUnQGpG|=c~XjV{f;!8;xi7
z-n*Ttxbe^I$CE*6wRAxcZlC@IDyUVJWljH5f)Mam5@44T<Mgj3c({+4{>?Vy-lv)N
zKe4#=5pm(^a#QdjXZw?g`-$PL630A@Pv0hS4ETu-G!Y{P4C3kf+izX+qE82>x9~z#
zIHMX12(_{g;4A&=%2AR)oqQmKYrAe3Ib#T=%eXa)ptPzeIxzy_CNpf;9V(H?V(WT2
zR`gL>U5P`F&H@_mO?Z*uT>W*2Ikp`%@IHhG47@Mlu7UR>+%fR}gxdyQO1Nd<WrU~6
ztL?l<UN=AuoO~xyH%K)Te%f9)SdEpziwPOxl*4A&IFw~nYJ3>so`IJW9+bHInKO@c
zsu6@d3#>cBX$HcpHFcvLxtrugrn*XJJyP~?p3%-WAUqYQJJQ*%k)xa!wfm}^fZK70
z#*Zd<b};ZUgcln4Si;*Ics1ee4165n1qOZ$;rRxBEa7bpd_3W8415CNc?Ld_@Z23R
zzUC4t$t33uAm=es<H%A9;;Ytq7b!p{JG+3uV^f^ZH8RzaMHZw?bM$Af>W+(i^WsjH
zUFU@4!Qn2(rqdTNu!6CNu^CPQtyN}_n-S()X7tbEsOP?DMya$g4u=_KA<#KaW(<%P
z#&t7epfqHz+Zlt3!Ncav7%aU#KhB*oqz-hzL#4L|JgiaE%a>|+c(ayMA-z3hj*#9S
z@ZoDU&&YKeK4N|JCUM3n3eAlgt)$4L5%Y(ORl`MrOJ-&vGp{PoRJ$Ho!A$kMtBRa7
zGgk@>dY%-RZ#ZVQkpgoy&1~D#^2QN!C)t6dPkXJ)m$O~>y$9RiwfD(O?|+bV3@in8
z2S}HKR@+q#ZhX&E*G+8>KodU5p@&1Cz$OfA%jT1z-Va2Oj?21K3EWw?Pz3TktS+)E
z;wVb4TjXp(z+uL*ST#h<$Cjvu2xO_V!}6*rgG}qx0RhvAAgWFx2>vdfC3i9#i7+c{
z!S|0atnOq0t2-IMUB&l+yM-<9fvC)_QHbyBy_X4vdvd%-q%`aiZ>w?-SDv?xJ@R8T
zpS>z#UuFb?k>R<yFl;nY=jJIRDgRvcY7qB)a|>k5dF*n6+tVy!3^Au2OBaY(J-anT
z^j&RPvvWnnGKQ6in;BO7mtSDGgOs!JGJ-ovjQxq>10=@YXZYX}$aF~M>_f@`cVW19
zxrX~z0v^Kj(rOJ4tN~oZbk!hFW>_^yz^XwmW4daPw=rDNjJzD@vqvqrya8meEQ=wo
z__o2VAsUWRbLS9bdDG|`-C7pB);pPScqVj0S4iW>JtuS{&I>6;g$*QOL5;I3Nw*Vd
z4A0oorg@M>RPKmn{5y;AW!y_CuqEe2Io<U@^6rTTNiA{IoLC%!jext;yU#s{K|<ri
z45V;4ov5CbgR7;HBS-oaF2jkfBuv1QOJTBzB(+EB;5%L`lKp`w$TgHI#n$g|%t=d}
zXn{gI@SY-m<vYlX6XJcu+PL0ihRWrXje}Z|mqt~rWca2Zq|;+{(D~0gDK;zBKP4HO
zIVasS#1gR{=UvD|)Dt}7TVr==MM&pzTHX^xmHy=gf>1x}=k-SY@BlVX9ZLgPJ(F%+
zL-f8<C!niCsZVFRI%elJhRdX_0UjW2?a!oS-au(<fCoui13Xx@H5x4E4Ux9SF*0xH
zTG+!@&l|SR%I1NCfAhi;fhQFp{W{WllG+vd62r7BQis4vE%y}ypa*cJl}j##_gA_=
z_MCYKKsMi!&+97D&9N}Ao5U(?I#7IpavmhM!0zHO@^akH>s}0)*Cpm1T%sDne0lMR
zh0HG&;XLZh?=Hfxpp}~WwCB*9eTC|mo4sbaw`ae5=cs#o+yX6A_e14ZQp$Pieh7CX
zkv-<T3gKO#?uT&Cxm?`>ZQwjB)Gg4{jI30*K)CC<Slt5QuIEzY-rief-U6*ww?N&f
zINs&z7H9`cTcd7)a6fdVy0^#O=hgO7dX7ar7<R(mQ&K$Kaz3q!x0ppdqe`@zk!Sf#
ztJ4XRTh8g^9+%6lZaJ^?NnwYnTh7g#9J|J1dCw8ClgpCm{8wg}&KbBh(fChzE&+7@
zD?x~hvXf<Os=CUuPF7<R;5?~1R(G;`(}QE-Wc8-Umn7iie2EKzB`yS}^Xw*(K>h{q
z)II;L-ibs_n@<;U({%Nr-ql2zo~A};+{K0HW?Vn{%Co$ihy}L8?9kjIgdz7Db30Li
zwox(`VK)X`dHd(o8>rmsUEV+6N^pUc2ylCebiit~1zaR0`U~@ir9}T=xQp}vdAAYV
ztqiLBFkD;?_!x$JR03YW@S)NJtY)}(4d@#f?pp`=Wrj=V0B&_V!2=rsmoPkJDd4dT
zmp22R#qfybfNy8`h}D3%ttYs0EnxnvgnQ&V4OguP-2V=ukJ$(qWvt!;xPj@%Yy<oS
z!{fIDzUxkcC++~;`7VNMb^<=?UV<m@0{k+=Q$N@6ao+)cpXqh77XrFwSau7Jg034V
zVOB_xd5p}?5#*nY%qb9L?<PX#g#|fdGa>Vf1%bx;5(8;06Qtz>#CA%#ASW@>R4K^c
z7+G8`$f5@cSz05=y^NezCrJ1qLe88c$P`AJ8wELuk!4E-IcEzY7c>hp|6xK_E*Ins
zMlM+`$gPa5S}Vu{j9j)(kY^ZKvtAH;8zEP16r`4sYqkh-DI?cz69i7YVY?s)JwYk!
zb{HwQ>=dM$Q*PTO$UH{w_}pN-`#S@<_a_6{s2+Mi&;22J=mBJNjv(JZMbaKD5Tx+W
zglq{5(v6WviUk?T$m1n~oW;o2GC>fRPm~L?gHxWW6y$(s33;YkkUoq&TO-JAj67c_
z$h(ZZG)IuH8F{5q5Qu(tse!!SY#?tg7vx`@=dY^;X}g_}x7G?Wkdb%S3Bo%u-1pZD
zGM-a*Z4?B0{%4CIu=?X|g3MyJPqz!w$jIkA1bO;7LcZK72t4}DE<qrA_vc2+p6>+t
z@FmLg{ZE4QeVLFSEEnwudG>|`fdxP37|1ULg4A)IU&FEmb}=KiT`br;j0Nlx!61Up
z853;L4oYibmkV}2V>x!EVDJj95DNAOPHSV=2*xKyx%qaTfwi;e7+9g*C>T80(OxRp
z2A0yvZWiow#%N!WU=O@X7#(tL<SVw-Mq$`;u)R*wP==oNdckf>qkM<j8wCSriM_?Z
z4zsrj_6%$2Yi}3qO~(4$I|TcLu`+w7V30Y`-X+*MuTk1y`*XqgCfFTne`jFj_D_PL
zx+`dXtrc~B)-9axa62T}7RHXSa|C;dvC(#cV1H%oC_8LmW9(wVdc96*<LnZ_Rxx(0
zT_)Hqj7_x54XoC#6s+AFls46_7OXpC$J;dqHp8wnuvzvT!3HqrY`ak~{^pfC*IsI1
zC)v${oyMFe+sg&3*h*M~y;`tUoVLJTE7;UG30q{Z6AWcvYOkjk&(ET<T5b^5@Th$*
z54rrN3+?|SJneeAv}9N2*!8(`KY#3vmQ|mpW(>_Y5z@xFB8Pc+mQvr=Sqp?`*!B6&
zIv_kftuKhICf-6wJ7=S2Yp<3!kf+dj3@LnjU*AEkb(E1^^&Qn(2aqC1zC8uDPLZ`W
zU|}cSmTArv^>m;$o3@vYUaw|@hpZ#y4m*I9DU3w6p6y`dF1sgE26EZ%Ruk9We<b7{
zHF5ovk$de~VC%}o*<d#T8N|p&^|a|mM((rEL&}4U+^?QCy~M~S`(l|12I|km7@p1A
z&!P>NJl*GCpuTHo0Jz$?s(l54`iqdKVjbmK8I$J_GmmKKTK_1x;o!$C4L>fA$3g#7
zNYl5<y))?Bay0!3nc;!{WPzqXCGU5G{&ZNB=GDKg8Qw9JzAH*mSMQ0^&Nopp-WR2y
ze;`T$?`mbb<dnqXh3dbCrYS5%ZTUcCej6}z4m5KDmUTYYU~1T6Fzs`(5IjL#<!A?4
z90-Auj;p*&nF%-x*A}>D8&|oX%mJkpuB~y+#WfGtHn_IMH6PakT-)K=9@j!#JK!p(
z$rb_bWL(35JLB2~*8^~s2<ry;KwJ;PwHVj#xE_pa4_tfVDlv8_;9j_v;MyD4!*K0`
zYhPUZ;VPdeC<R=G>i}G(Vg>=GWBKSe1lOUs4#Tw^*WtKUNbBxUUm&gfDsGSMRO^0#
zk@l)}BOnXaeJzj<Y8xRC`iuk`Cy*j_fH-2V6Wt#g?QkUY#>9h}JSH(26c^V3uAUg3
zQ%^$>7ZEx~DWjpY(lmOsY4nkHmgEl9(=+#I?jE+foy)2}MaYn|PzgPidzmIBln)WE
zU!;TrS!|~ppF^v!mi{HCj8ce*YPE0x!_SGR4%DkxHbJIWHibJ>zs9iW3S|+md(>Y^
zZ@iTLLbma*{#n~|sB>3eA<5<OhsP1qyC=YmeHs>S{6bXmDAV|*QpI<{jbEwqvc$%(
zjmmEPMm^zWs~f-NQ~j5dYTO%F*Y}W-4&zx*HPWGYhp1<B7=h@CBB}yNFNZdFyg(vk
zFlBDbdnX2Wzao^r|3=p|9z?x=#wKUn#>p+|n#RMG*Nz}9&FzllLphnpEUzp!xf01o
zb25)&-lW*%6OlZhlX+b87RM%EfaH~&%p;w5Wo+`TNWPPkdF=Bx$0k3G<mWh<M?>%R
z*yN9p{5dCoLl-zXRNqfkT7ZI}zp6Aixs>9=YkPZ4;SVH~)_>`m#zU;vFE)83l8@wM
z9(29&(PSP5Trps7l*nq_Q<3K^&T}qZV3kw<CnIXNDyz__w%PQA?(V3FhmiZRNX9_J
z3>U%h4N)3qx|T*}sr?5(amooUy>-ja!uc0GxiGL^Jr-96ENvJga`^dt!&oKfT;gh|
zcEeieIJXYSDo#1Zm6-^1AM4IR3ZEL)Fy5UHgxg)i1h-KOn5bR|eSif_au?GRda@5s
z=*x{>p&?7UFu%qZ{c=~Z-g}0`NUZK4h}OU83XcXFo-iEqr0JNalw&+v0%>@f98=hu
zAeaydl7<H)GYa#d%8bH1MEu?$;uoz)5Jcy{(G^;|Hr#HwalOh2DR;PG+8q<kcs4Sg
z7s)uk;VL8J)u#W~n*P7W^#31B|6i;8kIJ~toeP)4%h$W}X#ZDK^ImBFcSLib;T*$J
z%S=a|s~pwqPIA<F?5IHmnU2b7I7Kp_$}9`b@<z_2M&TE^Asr8k-7K@F3-?*m=ze7o
zqt)$=q(YqjC_$FDjjjh1U<Df9HA?WFS%UXf3HA_g!v|b~UkEZw5NdcuGQ-XtDl@A3
zRj%p-X+2D|_9lqVzoaX)_H6jo&}s#w<()&x4YW-IrA1qE0#bC;iyJ6L%1z7`2=p}l
zaDvY`XcgW=oTk0EG<+j!zhV*JnuXo%${i3&@|}B~_V^xmofy5gp`YaD?x~@_Szo2<
zs6gbV7mAU)`fg$ypiY272?n}y&jn<VdnMR_40f*)CCeL*kZ}y6MyYWOp;)ONPy-q5
z$e~3*j#MKYkfWRoEw{?a(#X+H3yq9%vNbZ+X$b^MtJM$*Y2%zcqyRa_X{*_eRXakF
zXS~w^DShsxGEZ=%(*rWmIZ&rea^x-zDK*YvT6C>b24vbjBw)TXxTLCKvN)oFDKi}F
z(7c8zLV?GoD%Sv+=Ew*DTaHtH0&=`^4UjtJ4Is3cL&9zcD>#W1R5i>r6wFczz<h#|
z32n2L%wb&E6O~LLbCer^%vFU2GSA^=q5EskDrCWkPHHLDBuZM!6oP2~KV8vMvKmg8
z_5jUim@VZ@)l!ghmTD<CuuW&vy;|X&1ew7fYB*dZp+F;*BsA6|0%XGL#4jdrJG8uy
zqWHH2(fOxzg-OK?IkNK!?X^`<yomPNI%ufK4R)pP-_d%tNbO4yJ^!YwlCna0A>|@v
z4y3G91%sg%2S`doRLW_Pa&|;YRzp9-J^fAhl$!1-Q|@`3GBylg_dG|C>7I2B2Z<!~
z4aG_lOz0kvz5%{EIB=ci{YsgoR2dt&R4wU>Qsp$<W7u=AY0m~_4|<P{X2*74z-XlR
z2c(gnNFp0Hk+8yr1Sv~fk}_+S-S7ud@&NN(8?dl$hA_A;P$N5(VEFZcse-}s8v=E<
ztP9oH4L=x>{-fEHeo{@T@jjBh*KA7vRAG;P?PnGCS25eaoGV}gl>XwV&v?V2e>>G;
z0<d45aRx@uQv^fjV!PvwG=~=Gbg^7_l5KYPXZdvZ81P)FhAj=(OZg!AMzef3IY!C<
z=orJ$t!5j)-H{lF*>|eWcIW+6*n5>5kg`#Ak3Hx~Ov5JCBO>JirzD4K3&=xGZ;d>x
z`aO8-QKzp?`IG7d=diSG&On{=ltW)ZrQgMz@{CiiQ?@&mKw!ZOPL)o1*_j1oBj<V5
zIYFnq;oJ_SlvDnqR`_7(PG_@K_%Rg|0jCae@EWcXpS5BBtCct5+O^7?K(29Uo*X6~
z{sm8ne(AVNZXs(jMP@bdsW0?{$kk?7dzl$?m(#8zG^{|w8AgUPO&iW~l%1i5Wd_f=
zrqJ`qw8F>YjOg63+~8lK_`l&oUZh$9kd;m=qvy`CynhpmH2?I?R0c1buCOwz!7{?e
zR$U`{I7fAjaI+hfDMA%xYzPFYJE|eb?2bYW-%A@ul>A+FBxuL~;NJQi;ujMxCdl$G
zqpLFEBgqIwADcbUCuWcMsp^4Vp^OcmagX>8L1sTwXE(fQ^fP}^{R|BHYowonMLVgV
zvAjHbekdk&B8Ya2(-kI_G+ZoRLGONv@(S-mX}B~fQ-uk{+psEFY-QJRUit;|^*iqq
zy+)#n?9(~jYo;q?cWAi7@c5ldHf+4h9E|Q(9!JW(LFsUTYzWGV07Ce_pfTOKKWI#M
zHU(+#!H-choCn#AG`hl!K*MgsjPH~gJt(<hPmn^dlpwQuvl>1$`2R=oqsl%C8grRX
zR2g90r$O3+cN$3&Pn=H>oqtMKm=J1s(GdBP>4}%g1aDI`<932%ch|om;-!d)K*OOj
ztAruF)KQo~N<6U&hV=Fvt2Be2_VTa(631&vuv!elZ8~4*{5PVCsnFPuGn5XGWV_b!
zj)*ewDv)brt&65`R?BOQ;v)!k&nMK)p(o5#ege~0(FIP(sV|i#&9dstRFmFB$@R2F
zo8EtpFm7q+E8arm?5Dhip{>92IR@&|;Kk^tfRqJS13?@Q2+Cw0ck=^-o9X>0GAOM*
zU6d)q4O1$VDMKl_egvB`BEon@!zqR-3r$m+Oj8yqQ=o8ha5Zh}Ara!>Sg*M2D8ce>
zrEA)q5j6$%M~gjJ85yJO;d0f}c5ajlPODbq+vk+AejH`-zKMv~*>J33>3C%+rT`O^
zrI<EM49e3Ww696QZ4izystG;~1Sz$_?K)+0@I{?6CAdSUObxzac?)PafG#Tae^LBm
zg3N`-$(RVJwGYd?Gs?(Ye=P5jD9(Pcyyv4hyTbi|Q1`yAoboY&sL5Rm4sd$?K-dD>
zFkDhV*It1~2<t}o3<Y$Bshn}aLCUK@ik(oep3HZ!lT#AnD@nC@`}Tq!itoKY5kiZV
zmV9ICvk;-ZC^)QMCve8YoC3;tm}Go`n#h7aDkFEh3;I$<$m~h>E+}=v-C03@Mus_|
zVkGf$=z`%+4G@0VxS+zR12Tq@!<{)mY8V;iGy>r#SqrM1r5ZWfIRglP_I<$^_38nT
zvCcA`GQl}-0Gq&TWeX<K>kDZYXnYdko`Kgm^u~pO*HXG`;FAe=415aVwt-J2+`0hD
zPhsn4s+S<nVx-<#t~EC}wi`6?M#>p5@CB4^8~7<K*}$8~Qg4Npw}{e%2ELf(8Tb;y
zT?1cAxMSd_5^fv#X@pw_ekS2*7ioQG5$+lI*@OoTyqWNTfuBS6ItIRs(rp7jkIS=C
z%fEo-8TfLRXW%OccUS6azQmC}5dpBuxwKd7$I0buoYf@(x`OW_u7oQbtJfi%bR{*E
z0A00+t5h6A#MLx`lR)M-j~4tvJ()&~U#p%>Bjq|r)@80_>DQ~r)DUrlb91k?tZJQe
z3t6#FR3VUWQmTO5OqzN<!Hl;$>xq#M0;3<K-_B|8aoWAk-IR8(k+wkz0pmty^tkD6
zayFJYbcGODwOKKu2|N%f7i`?(+^-$*u(Mesk2nu%36H7g>d5oB^N42qlX}RGl&#L6
zkb>BM(vd!P9XsaFCi1K!9q!$nvfYsm7szvt^s(^E^XeTMeott@3(mW0O0nQJyVq_m
z=<T*eJ&}4Y&$|d0&~y1-87%Y;+d4EvS6IU%$bvhK2LlW4q6Y)inf4~uTz0kIrAW_S
zMiI3W`dm8yJi_5kBPfq~0}F1!BVt%Z&t3F+*u0cNos61NML)4{N^x|3`;^Yn^KKVh
zXM23Yz4ssqMvq=lf11=8o~fO#>I?(p8EWPa<V<yY!&|WH&r$;;QqHFQp0_PBC}Heq
zOQ_`)(iKXI>pRHZCGYL6@2J)bv8$rU&4IgsbaD#>;fE?=H%#Xrk%&(22@p3gA}*)C
zyNKh#rT$<g4wm(BX+E)r7-fX~BSC6E$ofd`E%kGy#MlWkPn8&>|4FL7Vf3G`+8Zo8
zSv9de^mwMeUfn06_zh|&2#`kSJ`@1R0u|*zPH{F_Ue70D3_FTYSSJ_evpgQAya`c8
zHbu7fa{{gZ=oHTV{8LOkk3cMl6xj7;GJ)aZ)(=qkJnJdFepp~jNp<}|N&b~7bUGTW
zUGO9!gB9`|BSRE2h{V?qrP{y(1PW3fQ15}Q;k1eX5mCqG^<PS*@RQ5>uT-VLlV7W4
zV5HExGn4}PR#iBV-EJ5u$n%{mqc(5mso&$4AO*<Z+_FeiwU)vlcdjxSx%1R59a7o^
z42^Bo8SP-p4;UH?Xn74KsjmN*l!V{#sQ<+*$-hnGe^thV%~GPE(GG~cP~rs2wDE4B
zTqA)%rD!ax?<OUIsK^2H$W2Re$bgi{0rOBo2h1Y{YzLbfdj$H@5!W0U^sE2L_HH4#
zle>|wxY;q*kLq8GSwFJ8SBME-$f+M^c=s67yT=Bok^MxB(#YJWNsSkxD>B|v{}*vz
zPomWSRk?53GlcAPYlNq!{wCpp@i&_;{-b(;fRtNQ<b2JdZdDHuN?FuxX0Y7u%F+??
ztaruVK<;n{YbV|5it~|jmwUKQx!bMO$USbAM(%a1HL}4SFZSovpKsWIfocDRrv1y6
z{m{5V*$;%jwFGzN)h{qaonnewXo_kwMJ+N#Eslt)s(;cD^^_@!o=@sxJY#zG&!$(O
zHNCps^y+h_SD!b%`hw}z7fr9e<W^c<_|KNr<&gkI$iW0j#PB_jJCIN-o4@hEzu+m}
zk<s)Coa9ZWs|v-bVm&(PX(|-a2#(`WJU5#0Qe<2c$yiW7M>3-4nyWIRL!YO5h^L9S
z{v_fm{eb&d`qiHp@ZO9{+y#lBXo+;U&0H7=Y~^A|bd*<Nq^mj#D5e(+EU)<4Na>k@
z_CG}N5d>LYC0$i%vyED8Y1U$ns>KV4x4xCBuXW7B(E2?-Z-83fU6f4@4Rs$QP~NZ9
z?~OKGFPp)nM~Lh#^FAcj_TcAfsO9ZpoXe#S8lf-Ot7_%hkbGD~I1BfY;<BryC-R0x
zdAL4ZTqJibr$CQ5Y%bxQ)H|VzqPdz0qVqrK3g?wHSu*{)gD6dOGl9z5@EjqIT`Y5{
z;-<f0F6A-xd%dx*>F;_6VbeeK4#K7%^bW$NAN3Bxrk`X7;o&T2Z<r2OAON$qoP}~K
zI=A$NhiVNAd(rA5{Xj3#+7{C5X5MJZ-GfsDO*_CfkLCVF=WhCIWHQ+FYMY3drq=@W
zeMybJ&T*~LHv*xMfxb!2B`V}!QCpgRAs;?R>ZEzTMUa{`y-y$<+uRfu$MTe_sk3q{
zPa2!Ls9j1epC{x1;zEYTrb5ZkhshmOhU*yVNJr{}C)CtNcxExVttm9$*!R^`K<meP
zH(S%=ow@WDt}($1N&r{c-T14ToXlxbONmhADMbi?G-dtR7s!OjceXi_n<C%Yeu`5v
zY?&$`B~!gMHugnI$x?5PJ;_K5_0|~o2u<0xj5i#_O)YI1V!FLVNRBO|3eNzWTG=&-
zQeGBnYHioi{vXnaK<e4_nXb#vc`BgMFSu*dRrsY2t){Oev|#Jk63BqRk>CaVt!#M(
zyqg{@Zr3{BhE&w;JE9QqyL7K?LqE{>Y|o;7ee~nrz3F{N+wy^7%Pzx~4-H%X$FSui
z!<LW9mhmrgQ=dXtdj3mS1WV4MbO{#r?V=1-hnG?EqD)nXyd=9Qi;U92vgjv-!+!`C
z%X=0oUxv!p=_>7bQF9gw$QsWPXIoT%i<U{Dpzqumbqn^Tj>bRAsY<e2O2R|nqVH@u
z&4UNUMSE;I%_D>b3E+PtyvV@6w*$d;2L5+SFEH?b5T0+~KM;Rw1OL$u(6QB8{!iS@
z416!)IaxaWpPWve)2C#+bPjt6qWAwJWyxCni;Pxm?&8S)6(DKGLzcxkYP{tjU)(y7
zPS3wzj)***AnO0<3ikvScjwTyEJ*3eQ->2MO^sX&z|0%*yweF3qj-dHS0ZIKT_L7;
zQIp)~!OM%(eIAg-#{KJ}C2ErgQkJR*mq1Q+!j`uyRtW|qTz;hlms^5$2pgNTsHdn~
z@(R`CAxa(B`JzJ=@-nB;;VmfKU`G1Ua!}5q63K`P@2!%79A-QKT+~Myjg-FJ+Eg$-
zY6R0`W-vX@m1$J&pW-TeYg}b-lgd_N3mqK>9mtRzBTPFw0czqpy~qiq1r5BD69}q>
zESMWsC&~cnOnaHknC-%Qn+!7#;8GiSS5|JsB#x(`m^^Jqr22UTrsp3~953<k#qw^9
z67jyPOf5D?iCYP>yr=1kQimGW%3~i6sD^9I$3B0cZ!CG=L^GznO0~a+F9-(ilg!(y
zzW=M;Xy_|s(zU-k@b|U%UhTlA`#-XcfA!N{?-qhPxiFaxRa37=h$_v8Q)vC4ag>JV
zCzkg%<7ippwJ#a}2VG?1XG|QwF>fOOLs$F1D0A|64}3~a&wuCzs4gq%qI>>&d7(g=
zV|jNl%e{2*HqiwuaNgqti3>O~UB1xyU(CqwJ$vs)li4Hg*M!pim#zqwaQzbLr*J2-
zRNY<hGEM!ds<-1OyY;7W+o2zOvHtV`Jv{CEI;kB-7d3@GoIr@otG`f0f_J$R31o%p
zO@Umb<O5l$Hq8LJnDTp9uzW_%nf4t-q(uO_THXV6#Ryl>bQVUq5kze|TSho;C{4{W
z!m*I1b7cPeEoEw2mS?!QX)$VZpEXWLBEAu^L=+zy#W|2HZ)g-BLlB;On$2jPc^~7W
z#`4aN3P2UHy;S}vaT81Bdo{#7x@))po6NI?Qu3I)Zb<`N@D>r4G>QuVFHnaRlq?w!
z25t&V)ETQ><x3`tk67^%b$lb}>i9;`Cx?+2@RY8A!85Ix_WzP0Fd=8j={n^MF#%j>
z(%tQJ;*!cljY<jmaI_4z-o4NU`CNt{C9B*8Ts)*XGi@~YL34@Bi`(*Qf}~w6X&kPS
z#tf2gUKf%16-knFKA#*I$?Sbc#56uBgS%HN<1dyqb#^*67Wox&AYm=K!Wzn?Lurth
zI@H!2!<g#EQ#J2+UtW`{d1w3bnpDlZ)R)(!YTk={c}=S3y~&r?q-x&HzPu(?^FHg#
zYf?4uJHEUoRr7x9%WG0KukHBNn@QEYZG3r6s^%^B<u$3Ax7?T4q-x&rzPu(?^Un3<
zHL04n*_YR(YTnCyc}=S3y~UT;q-x%We0fc(=H2egYf?4u+rGReRrBul<u$3A*LHnl
z$DnH7wgy%A4<=RfcK78qshW3)FRw|}yw$$ECROv!^yM|Fns>1;uSwOsD|~rPs^-1k
zm)E3f-VMIICROu3;md1MHSg=bye3uie&Wk(QZ?_7zPu(?^QH&<;>@IK-VVOJCROwH
z^5r$DnzzE2*Q9FR@xHt!RrAjF<u$3Acd0M0N!7fU`|_Gp&AZ;0*Q9FR$9#EBs^)#e
zm)E3f-rc^uCROvgLBDt~shT&>m)E3f-h+L4O{(S{<jZSPHScs^UX!YM&-UdtshanE
zUtW`{d2jUPHL03+gD<a1)x3}U@|sl5`>ZdoN!7fs`|_Gp&HI@zuSwOsdwqFLs^-n~
z{Nl`{YTk~%ye3ui_VVR5shW4VFRw|}yyJa&O{(Ud>C0<UHSc0yUX!YMFY@Izshal&
zUtW`{dGGb*HL05SSzlh0s(Ih=<u$3A_cLE!ld5^Y_vJOIn%7P9i!+m|d2@YvO{(VY
z?#pXZHSZu_UX!YM$NBP_RLwirm)E3f-t&EVO{(U-)|c0$YTny?c}=S3-RR3}QZ?`M
zzPu(?^M2&ZYf?4umXKdOm{iUCsxPle)x012@|sl5`!`=+ld5@t@#QtCnzu!|U)fBm
z<}LK)HL05SKwn;ys(E|+@|sl5JJ^@kq-x&LzPu(?^Va(EnpDj@-<Q{<YTi?Qc}=S3
zUGB?kQZ?_@zPu(?^RD;hHL05SAzxmTs(D}Z<u$3A_d{P^ld5@l`|_Gp&HHa(UX!YM
zOEUao-K1*XRld9?RrB8H%WG0K?*?C9ld5^2@#QtCns=u!uSwOsU-<HxRL%P@UtW`{
zd0S=r`PZas-XdRKld5@p`0|=m%{$7M*Q9FRV|{r|s^)F><u$3`UH=uWy{<KQv-vbV
z{w+PXod0ZRhMC$=#v`4!=E{5WO%}4%LLOu7^U;k3g}gvLb(U5*oUN$-8cW2+x@2J`
zk+F)LWr1ZOvy8WWSy~FqRm?KmpQW9!Jj^Uh{aJE_<y~gE$e*Q+u>8s_H~F(<3Jc8L
zY_jN5Jexp<S??r}PyB}Td~1@mTXIAXSZv2|3-sK?Iop_IowK#%e41H`{aIQW!plt-
zU5N1sWVnBB0=eh6q=(+h&{eKYX>aJc%w&NcM8z%s<cAW-@c8xw@?EU{ZIi6kXN!91
z*=@3D_4G1~HXP)CvB0(_Sqp3-0ue&pO%~(?c}M~oRaos$o|!;Kc@`&-VbzKRGMsX~
zKY2p}8DaQD0vVC=x<C07fAWtBWJF|oAl{oWutNeFrR<eJUiuyRzQQDH-{*<%VeEL5
z1-^%qXZw?vCXnIH%M-{yvikKVS*vd=>f7%jmdE^A3WNooc*A6Yg%G|wfs7)%!Fazx
zNL~UNLJm$KZ)B?mnPhEv2eImPW|{8Kk|8Xpl(S71-5}0SAS0M=Od!L;4GCn(emsGU
z+I%*F3@^W)Kt==mEP)K}y$NJ^Hq(puEQEASAcMPC0vX)H6UeBZ@d;#fkuwv>W4|Zg
zFE+`#db)`3q5dM11-^%WZb%@*_xC1{#hVG_ms$NACRwY`H`IS-vOqmr@Av*>H!a??
zsQTOlG8$X=1Ttg~N+6>lk4qrKKXVhvsGjo^$f%xc6UdN#TLKxfHztrF`}qViqV1yu
zGE{B}#rp)K<Eshe>HnZA`OqZmD(NUyf;Rm(lSN0wF9~EsM2qxz_3(XR0vX%~CXi9$
z-U(#5ZEym)+YeNR(I#1!p-{?z$g4G3PzDrjegb(h3p~{%Yk{2%fy+%62t*BDoj`t;
z1+F*AT3}}ph_XFovOpjz`Nae>%JX3Y8R~Z@km1gMCy*heBqP465Gkt?$nf%w31ql%
zLjw8XAF0I8m}Fhzu2SN6nPsOxOOddkJYSeBa0)E^R{|LVTV=+V2QgNZKt}0%B#<#j
z8<jwYCC4U^5!THn8Fxbu{zOH)(6}4I)|-ui4Ox5>(rGVkyx%BWZvfvXn|pdO{eIa1
zHHcyL(QNQ+md!o<vBtmy#gH?D?r;JRt^>?_=>iX}r}IB3qio^fZ9267i||gaz~wP%
zF1{NGduLO^)WeKB-a_8=gS(<M*;{k|dBm~IC{YFP;R&27C-_D-zVVJ6{7UF*pUmLY
z2QM6DTZe-Rly`v}D5s9ZhO`KapO9B#g}lOhoU{<6{%0W{#|rtF_mXQNNd3=3evB3J
zBk#)9LXa9O<cLVQstHg&3E3=VR3v4p;Cv^F-_#6jiqd!{aLZ3r`#4d8>#QB(M0Jc4
z)kqqZRsE2pt?Fm<LFXpUXP#@kzs)a6YE@;(KUx)n_Gg=k14ZwVc1<Kb#!WGZE~sH$
zRh)HIHV1*$J|>y=>QuEK7pMKWIPG=Gw9iOYdt;pT#yIV#B-7rMs`h1Z+Ly&?KQEc~
z3sTj7O`P^?pj}7dH8vj>tmEL?WY%1tsx^1VS#x)sHFw*5HnFzm-elHnOx2pLan@{&
zvu3N!M<Hu#o=9fRQ>j|>TAVen#aZ*Z%_lEwYu-#|&0kZs=F>Q9K8>^HQ=1QZ*4BKU
z%$hG#wPtUeHGAW%*=zH;(%PDzlUegis@7!TTuj}DvK;P9HQvJEW306`Ey2H!p1l<k
zt>50WhvTdX$5|70_|$A|O_yZWbWPQovN&tX;;boi_>63A&A?>V3{KUWsyJ(^;;gB1
z_`Gjz&6s4?RHtgq@p0B1A7@RS!^ewjYi1;~W>%`!EQzybiNo9Gbrdg+tEtnHS#w6J
z)~txLW<{KDRycf&y7tY=WY%1gsx{ZeS#zDk$FOVdHzd=(E>-Ot;<RsY_^flS{k~+{
zH>Ik58w6-=PbSm$bgJ53i_`W-GHriJRoiC}pkw?qhtG4@W&I+V_ODXazBf+$Uc|W8
z{&O<zzoe=?8?P|wvS+(|B)!(2gY<ojQmy6vr{6wGb&k{C+2v#Dwe|y&Y44V*_I`2N
z`?-9iyw+ZtO#6UTwO7VzuXOond9D4(WZJ7z)jlOo`xKXt>(<(*CDVR<s@m)0wAZ_Q
zc%|0fm`wXAscJtbPWw4=+Rsg<{rpt5Um2(UO846s&tIKP`!%U*zdcU-?RaNTd!7#5
zp|ym4wD-GG)&6jt_J>_QOI>S!G@16tQ`P=Loc0%7K7(Cre<_*vS5npfUYz##Tt0DK
zYyTjb_779lzB^9)ZkG>y*4p<Z)Bb&`+U)>Gl^$j60H5`&wYx~)N7Mz8n8LkKUYz#4
zKx}W*HktN<RJ9)zr~RNf?cI}U?~$tZfpOXg2KY#8?fJpUv=2>HdsUqFssJB)t+kIy
zroB2<?Z?GwKQ6#$U2E-i$+XW%ReNKc_Qn7obFH<Xl1zJ3s@hk?X<rfG<EM2CToK?`
zi#2{xfKSlY)?J*;x=T~FZe5&p>*B0i7vLkdwKX><v*wmmt=SxB&1P7mwLh3l`<7I-
zzYwSWg#bUS(KYizfX@im_=^EPE?ispax&|7q-xzKan^kjXWb`p)_n@=w6&iF_ylil
z?H9?c{VG*!e~z>EXIQJX|B_7muc>O!3dW9dS;31RHp`xk^nHwSIY>-ll<N|wy-Sb}
zg3x8}noRqFze#%&1*&?^)hAASpCCUy)!O?d(_Z?Uv>VT{YT~rl1Y=jNYJz;!td7ds
zARmmbt(%g}x@oCew>Zwa#c|dx3AWv4T61bLYfj%EYmTA{!q4#4IYI4*bAl&qi<|9N
zQMJ(%=5zN)%@NQ+7emd}afQA*_{VK#6<i&Reb9MLvO-^*sx`OAS#x_Z_Ce<z$+X|~
zo3tB^<GwiU_r>|*{vaPDr>kWXe3J~1ZCno~vwq8Ovfil4t#Q_Gjq}|T$+SO}s`lsN
zv_A*!+BeSy`3Mw^KM!0t?H7|-_j0P%y&q@Y`@yqgYVw01pYW`$`7oI^AEj!|o;Yjv
z#MRXI$+Z6?Rqd`9JN&s`Y#R$AeILVL8WK|&{@TQ8Zxg3IKbiJ+scJtcPWwS|+Pf#y
z-Xm4*1LCv~h|@kOnf4*6YOjjZUghzL(mLkHB-37<s`e=!Z#g=eN1&<Gl4&|VRZa6D
zK=(BBJw9(t<0pH3>Yy%nLo#a?q-xDMan>yJ_|#>s{k&w_FGyAUm2ujy^7!axt$l4W
z?SDvB`)v@QwXIL4?aoxSZG`|`&s#k{R9b6)BANE5Qq}%qoc0$zp4w{dFDKK!BUSAm
z#A*M)<I}FS_79V3|7d@-N2jXBylJ<my}monlHJ~8WQm#1bE25hMNMV*?2j2oa7V&F
zV*>PZoT{H8P&?rl;4!Lo;;*S{&rIWj>4Ija@h~eLUJJnc(A*M<DGaHdAwU=9fMnXb
zrK+t@oVI?+w3Vi+ZFHQrqmpSmI#q4cAwbvR^fcbFn+)eV)}Ei4%(@d&weIvd>rRie
zE)kEN=$(<q2g2*poRP+Bi`x3Ll3CxJs`YE)tY4GHM=xq?67g8yUYX3gtM|vcXcuPm
z9XF@Nv`*C}-LgMo{ko*}afM!=#s}$Zm*1JJP<N-Q{fRj3Po(jY^V;Q4rp4adKb_2)
zKc{NVJ8{;$lNNj5@m@0RAEc`Nleq5rleF0J`7@-)1c9!mFH+V1ZCu#}*9yK%R`$Q8
zs{O~fvi}%Y_Pxo<{&T9@tx#+?WQX`{b6s{9>HF|}5Q!-aju~;<Gedj~y4Kzznf8{c
zYR`iJt*vb`Z3U@n>j(k5eRmAS#(1Y>+B>JJ{lGZw2gYeHPNx0fRJHet)7~pid+%i0
z`|OW)zu}`Sq`h7iXGvLz&(e>HZ#BFO{7q_&iT4mg?U2yECf39DM~&YoRuNaC3iwu+
zctnW53815VB=}=WtP@A2YE4y~HG*peW0GmFPF4GaIPHRK?URyeuT53^@u+0&`QziF
ze0pLKXwzo?ChbdUhN~VP&50}foVYlc8)u#1V@QBCbzX=+<e)8|7vi_av~ly3`K|sp
zS#C`47R6b<D8%0~(At+I(|&5I+Ru*Des)}~os&%axv6Sj9;bbIh(Fn&Yhnd(?TeMk
zthr==tnuq9FAv4^3#uo)Vt>T?bx~Kx74qs3KULL*lyqIlYmyc6+ElH%9RjqrJCbR;
zD^+b9AwZXPV~9Vup|#(iO#9~Fq}>>Uo{7``Oo%^op{@CIh(F(<@n_>YiS41-yU^#8
zS^MH|vexJb-iovKEm*64^-ePF@1?5!O9;@~zD}m?+x^kz*VOj<HnpGkN335{3#P};
z=Y#37v&=N4$Fy=?;&deL?|i<m9)sGX^EAiU%5M1;y-RwGe$~r#-5=$CVh`~Z+iQQs
zj^)vifBfpY-N4Y)vUENnEb42cv?EYj-FQZ%^F6a!`e-gA$j6~ZbgpqQP*=jSz+*h5
z6DRCXY5cU$O6PBmXzjD&w9ihaea>&vZg^~ALVWny*qqKEvC)NImdvK}ev?f`eXL67
z@8M`|mjU00|JS6d?M4XD{=YFj_W76K+M1h^mHm&YTC*XYKk=ir-3NRhW#5#lwx{FD
z{xsT)_Qlib{Ba>|&7YH%eS50bycK87TXELB6=%&m$*g(rH(6t}j4#spQ%KquUqIl0
z>PvozE5i>cgZAK0$!z}TZ?d^q_l#af>?TVugL_J?J%n`KbsCNC{EXOP>imq@)$a>3
zV&@&p!M~5dya<VA#~X8KLk!|OAYGfG9e-^Gf21i!lNz9|PgTubhMK$fspg*jQRCNr
zJ_Z50M2|z2u9mGxk13%}d?HotJL0tO$lw7-D|juL_BT@1{$ZT<5973dluY|4scQdw
zoc6!RY5yUa_McMKo|YNgrqVL`b7DFULYc8k`WfKgM;v4!@qgK-{GzaJW^4;C0KN}x
z?NiluK%BO2$+R7`KiZ-*%?{l0$;m+_nX!F}U-^eYiT3_5c;CdiwsgA~4*q@kXT)!^
z*ywM^W@^o2GkG6xj3(8?joTkJeub`yD|AgJe|t`=uFd4n(3v;~iHY;Nlg1}!@^|XA
zlcpwf(s8L;e`1{V@%S91Yis5uvu1v()-278otvEoJf_;TDQE1DwrUDI{K9lqA$=JH
zjAOF117F3nu{1~sf4?yTukUJE$6(upqs~FGB+opDYf|Nz=jc519L^(L^QPk+IN>6M
zzpV$!^Jd@^djijt&u$;fw(zej-BKzm2gh}=gEP)02JMESNFV>x;gm)F3h3|D%8b?%
z7!QuLEdZ?u82@w}n={`@N9wDT0N_0Wq8?{S6Isfal5czw35oo;cbIx~Mi#R5h^Q%z
z03(=n<cSe(`aAOSH#Ii$c@r@Y9UD1bb6F!7?~~2UV?|wO^Z*OvT(>YIHoO)gJz7}W
z4rusw2@?O8qk*6HGvc(L5vTpEWZIkeN4tlw5qGMhGvMI45b8)*l;KXRYbixL6YNX5
zGe!&sELxhRNC|ixR%smTAcW|9?eudFr*D&6Rywk|XCWICR9@j32_CQnR`DF!y^=0g
zMrUP4Aoz`)$rQ`D3dI4%#WjFy5LXY^G+aZtrsJAnTr&Y@;o1V%Y+PI7nuBXATw6<-
z(gLv2>oR~0bIaK}lr=5nalG;(h!sfBYr%h~5Fxz{`80br^U*JKK+8a=P(Iaq9??Q!
z`KUAC&W@G6N-?J8ic|;MG78|d`zR4^aXZm1sO3FKI25kV$jf2zFAyQ4jb*j^D*>$w
zh^e*Zy&K^QXATAzJ2rEOC>}uaGlz;n$1prB1fH`PF3-~N@EpJ^m|h{;?qzsHft4Gr
zqs-25l~j>!R9@CPsib{Yo|PRDlGfIcmv71gtSXy6#!K2!_?#9+Fl`qRT69t$$)+N<
z2uo4ebuBv6cb`AeIa(tJd#OdP<nYK@E%HKEb}M!*{j$TT0msf`ER^OkH%Xu}&qZwv
zBt}&c!w4j|TUK$_TMn&fSr+>^>utvZ!j8>)#|Z$rh<LN!bwWVCWaK@kKqK!vVG)&+
z^`wZZV^L2jQTK9&r=5_M{|G_+%evq3wh~<6))D6JAkgL5G`)Y1>3!Ssb`w)OE(FSx
z(OE|q7gCk-WKcCBqpN1);wd(1&lTKrc%$fwIw{MX0S|NRWzG~2H&bHftT5;-Df5I9
z4bSeYDl_{r5O3mE^SERbn7(Ms5@@btSuL-0HxW!9<E3k%RLX_0?hPWi97-<g(R+(<
zSX7gFthQ*p2!<6C#G)dq?aYbA;Ne=yoK&gdnraae&S?iCE68atLWWVsoI(nmBM~pu
z_<BHLL92tndlHdb6$>vHpjCI`U95Q1tH2vbFYj;xk<y1-9RumZk&k<m^a?7Z6mOYN
z@uZCKNbB+L8zexAK7w+&(`gD~d2bOBDoR>QV?LP3ty_sX944(>OT(VP^xOid20c&w
z!W}{DHsTjHp>^Ayk(zoM%tuki>}Nz^HDIbK*5YxBH<>O45|G|(f{RE7eMS3LTZ+|;
zVj+5j&=4iK*Aly`Ms75czA!djQCEV>vFg4^xh(Hhx}rq}vObe$#0AOvoGy?PI1@QS
zGy#(y73~Hwqr0ELxWw*9vS)Ne_A<(DdE6~`;!@?^Zo5Z;R87|~lf>w&w0VuJkx|Rz
zak4W*ZRD6k7ikz*xCR3f>lvL~Rv?IX2!<T-CuC<F1lf9M;HD{FLwe5f5cnCZWr#kl
zO(7v!d+swU%xXE)u47@vG(t;YiGV{04^x5|-|}MNf*Q0uzDQc$eKxxk<%MV529_ma
zng~Q_*5xfgB;7-Vyi+8SIBxS6N(iz`^A=Zwhb_)qQlpw<-YgK`=8PvuMs8wxv!&+`
zr4xK&ftCFUG4QW#e)e|?%zn5_DElE~w}~x#iyFs+q3m43`IndL6%bh9c4C6Z=Ao@+
zUgmPZN>_`J5%Q%jdLND?Rs0R{#fKy~*BOp;|74bf>d3qa)d3ki%t|F9u$)1*dkc)X
zgRauOIA_6ljuhu?DLcoH(=26YS<X4qw*QARIrIT`9of#}#K;Ck&7vfpoxw`2*mrH5
zeW+~IFPtF7s*qywkcXJD4j@CU`5Bg#f2RH>MjD4eS5CPgK4m2lP{N#o_9!8<7Icsj
za%l@Xh76(iXrWr3LDcGZ`f(b>Zfp(=?Pr`ieIQd|q)FAhi+p)as^-1lm)E3f-rmM1
zleG;dRr5~u<u$3A_X1yDld5^Q`0|=m&HI5buSrEsETXE-FV!{Sokj#y_s0C*sBZ4b
z@(+{h=9Zt|M*^D1(fqy=(3@CFzdXsfHorSE{=~$CB_oGleveAf12h-U?^y*nhv7q-
z0P}#5f9MrfD`r-c<yIK(c;cL4X*gsZ#8Ge<XFk)Y!&a3<Mb3PK;~s+p`Q~xHod#9s
zYikv=<V%>NpZUoi%~B{V8<}O1KTA7dd7WAA_h%_ESbCcut%3d)*_3mtN!I#vBxeb;
zT;R{r+7Q0QWPxy4{((tGB%I9x^K>M%8WC}3YpXkVErE7&yB4{d=+6CgD6fOuw&QB!
z>fq|)8ZfSAs?bA7wQy}|T!k)IQ$h}SL{1R!AY41)`YZj?1QM3!vw-d51fiHF6j(h_
zth_enZL8d{%I&G#Zidkjm*d(jtj*2B*4!+N&CSB3$STpXyzMPjYibM}fgtBWHZV#W
z1<woum37hJ4~&-KlW%<jN6yi=VA<=uR>Xy7SrV9u3_SV;W{Du4H3d!xgASpyy8`Bs
zFK}WpU<jSl)AFVesw7FfgQP`<NsC1ik9mP5B8i(}V5uSLRFZUSL{f470O(*z`2$4~
zTKpi9gqA(HtJRa+R(@`PBg;NSA#AX9C|}xlw!K!76hhh(VtJW#&F0BB|I))A_dC59
zZa>EsAp|fh1QN{SQ%P@d%mZS=)N61G|9aA#LDuB*kK&QE52$p>KZ<W9`$o~Dc^<3L
zF|0tNV>xd>X3k#{$<qHd_=8B39a^8UtPdD3i%^*orvI_2U#mQvN~T%)GbQg{<SnEU
zMt)p<`Aa3WE775%gc$~mkMJZQXbLJd3EOm2z|wspF>Eo&|1!^i(VSvin?2wv6X{Cz
z8u<<QFIw<l6#e)AOGU`w5LCYb{5guq?{|)!-_=#tz=)MR_p}?h!RhuFZTWr4hpOc-
zk8SzOxi`{ndu41>zbLjNxLCLR+ar1t+xVKKJwQxqLJx37(jH*_e)a&rrJ3%#E&Z+)
zHz3BgnArP$^%R<6{rifJDZ>9NEhfhCdTcD<=5sO!b^hzIE#!4>A$q8MgV6z7m_PCx
z6ajc;UJ2O{D`Z2gkd3kEeLPpujc`+JBiziQ^Z@&)(Y#WpmL)X7$CEa}r~Yp@!TZdf
z`2RaW_E~Ivd=?uJpC<+x^W$ekYA-Bx(5naX%kO1#K8=?EA8<lpgoFM@gY|Rj7*w!+
z6Kl*jvBrEGi|&pM*1yLF>mC-RL-}v91IYKxtb_Jv-%$Ro)WlH!#R%o03G+$U_KW3V
zkvVIA$aeKm`a6@`*a1J;zYDpQDSK$7I2;0D`k%i)$-nc|CuVHjcf*dE!R~v0A2a;?
zFDK!zn!U;IEBg19_Fo*SV+{T8>9PEJti$7atdVg&))78EmY*E?gq7~;8sp?F5IM(l
z#7BPR5x^Lx<uhPfPF0+oqvP-~HurwRBa-r~alftcaVVeeENWCAgWKWXg*-H2z@Dsh
z;I=ujo2&Ef=Kh;4`)jk2{l7V6`^B7mm`umYd2z9EzE8|W<$P>MN82@VZD0-Z=@_~y
zE~c)uc@Wj<S0jG~$6)?Flp?>xxVU+ralz{=`S<$AMNA(Z(-Z&qx{Cki%0zGT{wF3F
zf7kL@BO(>iOjV-hRhw-cEt_qA^rmZZi~STWm1_K<xLSS?Q6RPaa*|qpa-X$~MYC7_
z|53{i@3WR~Gg4&LwdD@Gjw(x*QVF?=o^D|&m0+8ihAgGFjBJ(6z6npiXiauN_T38X
zFe;m8vi$4N5=*%)=Q(wRDWUTmEp(p4LglNTh3)K-1Y3pecuR?xlUL>Nm?Aj|;Rn<(
zC+}znN+3V)Q;a-{>r<N_ObOR#w$AZ6f<}+LYxNE3J8`|vJ8`|vdvU$a`*HEO3;A`t
zet`Iu_;g8){1SVi&-NLg=!F7~-z0qKL(0+rhrM@!kL#+=#m~%{Ga5ZC$+BeGj%APh
zPGU=b#fcL;wv#xCox~1~113%HFdEHBV?Aa(4_gi)2_Zb%LP;Sn3Z#KT+uH^x^xgs~
zuTolQxut1)FC~TEUuY?X7FxJ{-P_Xg|Gu^MK9AAJc48}`{by{Qv)_B|wbxpEt+n?#
zhpp1!>Hp{0LQ$AMhYSfkjlk6-4aK@}7*ujgw%Dts#MOTmDoD)t|ImQ-m&~~O`=M;<
z&M{#9J2Irfw)H61kBj{g`rgB)yEVv=Vw-JXmlWOkqDa&ElX4N~$<D{HF=2l@J3zMf
zxASA+oI~N93o3LY-~?13T5EgcD^Y<I?upZw4XC(RSS*P5;e>QJf3eh8D&KepDjziT
zGFt}|D&N$U%3mDnn7<j=SxQ<8fQxMYs4$r6J253@t=-)))4OG+gPFfN&eL4MOz&%$
z`D+?xes5^zUmnc-EOYugGqs}O&$hOs*|T)_gLBf2tlqC^PB#$?E)vNG6X5JTN1OOX
zkx}zVh4;-#g%MOmBF_VF0Tmt#sBpZ23db9$u-HI_lMPfj)j)+4Au7D@3{+S;GZjX&
zXHjAO%vAW=m#8pct8?Y5CtheOTuvoYcQD@8K!tB>pu)Guc}6vmg^x5);iC;y_;82{
zKXL{teEiH*7|otVh3`Ex75>@_L4^^a5Q#hw3Gw2r?~!#kGK5Iv`Hbh+!!$jQ5`6xe
z4up0`Ahh+Pt%0iWxj4@e1@Yf*P#QlUVh227VScmM{x6-G9U|Em*dJHiVZmxVA~S!u
zy}(15KR^Q__yMqFWM)y$hzFBiba}`uh#!}O(m{MePG1M{NjK^l)(?FKGPdM)z!ZoW
zwmcoyUvk%q<v6!t%VOtl*j8NKwGzX2&$py)baTq>kl;V!DuLJ)Xf|rK-2w-d{mr9G
z&bU3k5_V{OCFIa}Mm%M~8z>$KIQ8rC0O4Pc)1f9u-TMDBPUHs2{zk(B_7}3iUBkik
zF9vVxZ#Kt%JHoNER;Yi7D{j@wo0aVu)Jyic>IpB3_Wh!CI)4nk^QtiAt_epXt6{_!
z=)2~>2Wl`v;JyYSa9;z{zt-g$(SQc;cX`q?pt}d8eh`1X`|?Jn-+<owU+-=gCY+n;
zS?t`I{!Pu9{w+U3On<%doa69`JcI5%Zh*=?@{o(N^R<Gu0FBqUQLoHCd4Oj&``%#C
zptkrd{ygl?bshkd<n$jkwW9}2XK$$em}w?j?p*o37^cn_g%2YvF^^37>hMS-oi^vg
z&|>^Z10O!pz=w}E@Zn>^hXFCYqhT?AX9HipYc^lXV*IYN^5t_|jDM~<U%u~0kuR?c
zmf2+?zFZdK%M}fLIncnD%Y`p>ndOOc{mtgnRbf88!ImRxZ;ZcHyv6+&yL`|rQnds5
zNLL;f7I$WEH(WX=kN2|r=B7M;fFSr?Z;`Hp&H622Xq|{W5V^7QyyU?nVJ`VkEe|eg
zBbxOW^$srx=QI}%>3}*v+`!DgCUK>@-}9+X<Nw2tA7sb<UveWFxa{@(cem@NUyX4o
zzUecsy{~7^jU^P~wh{{6-=o_~QT2H}>;?OqNA-E<?iZ+^d0ZO8b9`aV#=y3FEYLH)
z*07v>O&)X(mJ7`f^o>7nQ0u<l5P!Bo?&$~YgZgKS|L>5TZ1wl2XA85xnp2pGENn|O
z+dDmj*Xi~!<<#elgx6|)@~D4HLU*1K;B!v0^W48RLG4#nw(W^0C=9Q)4Dc%K02(dt
z#zcVW8xzs}w_Bx&0CR^M;<qHCn%_a`J}7^4L;0H$12=~ia{bJDWEn{V#Qq}&b+U}y
zV1edT1Z^MFuOj=o9AA(--O#hfgV$hj84F6kx}mLT?%NvL(zvtdVL2=Sa343|K8^%2
z9DW%A4AgOc9f3V|x4eHxLbtyocEujMOMdS5#4gicgA-woNsc-Z&UvHhg*r`ij{9CO
zez7cP(EOrn$qVF)na^cv{+5qG$~+C^87cFNi3_`s?0j2TK1SBud0f4GEBSlD$Sw-W
z&x;b#Q)B}ob^|$+7CEE3&nACmIak|sZ&(kTzxg{?aKd<Yl3Z(?_u-js9abtv#*qsH
zk>3-TI+mWFSA+?Y5)ZpS!yb~4;L<LgdHU9{Ut)5{b^}==`Q6w8rZ}Oiro<)1l`CHn
zfcJmMH7VB?xu)dWD%ZBqwOzs;a$O+TPPul;l`k2<dw%2^eQQ|DNxHq<mjgPzJV?-!
zd`}oKizftHcHvZ_<8TlyyB!IC44ExgCnWrb4DU%v_}>`b+YyBKbxSyfCR?uQmGCBp
z@rJH$A0I7)0+ym97D80&2}Q`9h;kO%Mp_q#+UpOuCt-tFC%F~9%dooJRtPv5B($y6
zVG$8+X&s7$`G&61phl0>Ag0<DX^q#jHr~*+P>_b|?e+~_$iO)7YKGe$W+lvvY`%no
zE=S>hg;kP&jO!v6@OWuSX<_p|8y3;RGHzCIysM-Sp)pO^6(sohX@7#ou9Gka9s5k=
zP8dTrJb>`xe#x*09T$!nW2t@T!iotlxM86{ih>Kev{7@=Q5!lQ4;nolXQOglkL@~7
z;!lNh$7%w(l!^RxtbQ+MMP6AW(Y4H#XOucNF@eA3uQ3oXlEz=h`mO<n`64C>Jc7WA
z4GpCdH~=WQm)T<b5Rg~cuyWe`Ift~~V6dBwH|B&T-e7pMG#bgWCG#5$D-qF1xR|rb
zR=6VOBjxe{A(yv7Aq)_*lL#4nz}ERsADKtQuO<>Z780ScH5w-Ktd-y*COfd{^;gC%
zHuY&N9zsH2w1F?%z}FE-vn-!*kib79upTeN^MA{?B>k|wl%(U1Mbg@Cq)U|>Szz#A
zg?qK=V24tp#^{rf-#D&@f64?jAeS=9C5WD&kP4_rUQiZ9Ypko>bss|Vi$Ix1Qpa7-
z7s}<RtsmX!kawU3VEq)K+z@*id+d1gFY$J<gbxuSGaH9lNGIl27SZ6#E=Q`)(NPxG
z;B5>Ft#ss_WEYBvaDT8<*P1m<fLOYe=-9X!u^u&4@#;h-`H1B~DudXcW0L{MKNm&p
z6TcM6eNQy{UakiLp5Gsxh4)3Hzrc=k7Jd^U`7I}@+23*mIzE(~O?hdSI7fn`TcA0?
zIg!qYijI$-XJ<h0T%FBL-h)?RChRXNSLaU(3_fam#Qj{we56h`+`!y2KT;<WImf|8
z>O7xLBXut98s_uQjRF7sQIvoFD9S&79A%jQ8IAt0DF1vV$}oQtjXo3b&p+F_h>*1K
z&tIG;Nk1q4`ObNE_Wbzg(eT0%nc#CIu?U6CP0EpC5weVQ8i_=TMH-m9pGciZB+_&w
z5-Ik4`iazuG#!aVip@QQa4{!I7H}r8tCJ8qJ(HdK7>dYr&daN;+t`29P9=T&#>lTB
z?0%A$&oMdqF<iucQez~cx0Kc~HVI2=9adD}jZN}@nSeLu>W_A>7*J|D=~YwWlJ3e?
ztx8YANx8PjRn4+i3Acr=?Gjd-bAg0A<=Q1zwLce1xW@pe_K^VB?E}{`C}j*(A*f-5
zhH{!f?SvZX4;76J%~{Bv60Hiq?WM<d-}Z#qeAYbcCB_iB4WwYhy$JWoJDK4Cr|5$+
z^Ir_-x9#jHnqbEbJu-L5?&#7+jd`XG9ghc%9*?t8r=M-{$InNo7St~G#u812Rof7~
zaumeu>qzZ_P*Ho@Z?#oKv1vcDyk_8H`WpPTU)?>x@N1DSfwv&AVr4@q-)Q3#Hd5>g
zDY4Qv*M9xd+0CSFGjmmcUaNkXm!tOF3<qL<gOOtMD0m;RJ@UTFMm8g0rtZ#Q+V1SY
zJk4!2>MKjzmyw!O`EI|6Y$3XJySz>~=;32Q4--KTlk6dgPO<vRhZ4Br*IwzBNqPct
zF{yrq89{cfS@z&xNnO1}BYY#h{SAgA0hFIXzQMzN0a&k%LV5qsK_CaYuX_uk%Pr9C
zU?cw8-_#7c*~NacS+O&~9T{F^5I!GLaZv-R{ZYaefchv05-{F7n5&HU1nTI|Z-xwS
znt3wX%m<>)d?;w<*KI3-RN$u|4N89}+RW#pX#D~wKY;ajqq)Bq&HW-zJq08AeYPA#
zzeJLZ;Ced}+W%Nh(kMMeitS~wKW$d*{HBByVQ~4KDD`}YpsrV&w*9+N#Qq(N>iqm8
zO6hNd4G7Pc7;BHkIR1-m4&rR}64Pot#%3?|a}!dUAUW-A0Z;f1qbUn)pEMLS+$T*r
zJ&&;rer?uYnS38o#McIg?+~*%UoE@!Xzs)41rA?H{~*JAQWECtPvP(l!uz@<{HH8)
zO|OIrI~~6MVz*#%av{>Bv+m9nQs`<VbgtCSIP}i6b|7K8VXqBp^hgb&wsVozAo4ol
zhE1}sBxBBJAc9p4ok`vL)j_Ln?T_(%yen1W_Z&jlV}f@(E=fnMaxam(1F_Z&E|QRn
zNpbh5rMQ-qWh!=^w5ICTPkWEBp%2lclX@pE@)p%&iQ7btdKL+Zqxv>dHj}tLE$ROa
z4JBT_LBj7x)x;}q48nN#zchlq9ZB2`bYn|M!cQ}Nbwa}5W_XY4Ykh2RZ-=Bycwe`K
z(@ejnSHk-l##Al%T~y?cUpVQMQ0S^DaY=FInvkm}*Q8uq<eHLet6bYc*LDea$d&K;
z#q7zoORn8=T`1Qc#dJ%e%LgejC^_osiG^TIKA|vaj>(s@23DurHqx><)LwtMy-4}g
zK_Emh-JMz?7&?W7)XHGGQfbBRA&emfI!)aj)aa2K?`DlfTI0P8gHBV=qImZQ5aX{k
zEz}g(_v)tGmP$Q>+O|yV{V$Yk!}lDzpEXq$Tq;m4S+HKp#y}toHfY&<8OHY<x~&Vb
z<7O$F=-9iE4}^8>b9xdT`=lN}9n^6RKrkhGMPa;-sr*Dt_hE$iYhT@)Xun8lY6@xX
zY3)nGgK?*O#uRK>BtvP@Z+mpNenPr=0=cc9)G8VV3J7QFmvQMM?gENSejq%H_+SeG
zXq)i9%q~)73rXqx8IM%2A2W&Vm2XjLituFTTgi^$BD=N70JBr8a8(S(?hz1KI(Dyu
z_+!Y7-51Pj?6t}%uVOl0S)ZZ+2<RtvaxVIj^n{9`&igq`0mviEd7NKQNMJECoY<aO
zLwIA88roQDjbzE?Z)HHjxojsfC8?x3Q}zl;U;&e`ota)^>JGxvn3}lDZ_Sfh0<cU#
zYMm!-N~G&yPd*=#dNoYMenRA=hNMB3(NPDX_t1_^F<V=@L|O`UAPscBM*99U6xIeP
zK^0>G@;hJF$<89oZdzThtp-%m{Z2(O=hwRwKKHP2Z_$t6;QJCH_75>zricZd)NQzm
zY9o_{?@LH2X+%o#;w+V={-;p1?dISm;_Bmd7QR2WoTU;yDi00FPU?dwFSNKJu}Nt0
zt4P37D`85E#IVvIIVQ1riP}Tm$<M~+yCno9iBIuJ<cFx5<fnL6whJR7_K|q18{xDr
zXM#f=(mJF{zgHwiq_1buQX;4QN?)UCN#`^q@|%M&K8)i_($*(ZB{bB1m+5a&uLSU!
ztv4Vr$h_2pxcDMsQGe<Q<}fk!%ghnnp^rt&<SX@qOiX=_Ie&l)e~VT~pe2?1DguMd
zTctUWR0ybM*1L?5uC^Jy%Q*FGVq%i^E@xg)s~Zth>#At2tHQN*M{5OJb-gc();jVC
z8VtI=jVvBSk8&Etsv;1*FK69#5-jt|-}+1R-XwB)C}%_Ln2nudjrDJaPGo=U3pRxN
z`k6T+;V#d$pWg*}+TZ%Gh9ZGp`yHS`O^M#W)pz5w0>Z?ekAU94b4jL`+Qxdn?-F4_
z{QtO=MH`vlyHaEYgPZ<As2OQX5~`{G8xn??)e0gR?h^uL6u<TV5(4lHBa9S_U?n`l
z_1_A&7D2>3B3#{Z^D>@wAzZDG^wUS#ZGIORi4k1;)PTOC^Ajl+o)U)!mDBsA8<PX5
zy&rG~At*HbK_Mx5`*rWLuHL`l29z1NzIyv(e&4-IVr(LaFO88hgZQ!-IXj@t<+1+?
z34H!|iHy<j?%YxF+{Hv78o!5b43pNPLar7Sa`mW?J4vfzHK%~T-c!U(5S@vNK+!9r
z^BNgucwV3TV4^Z_PEOT#IJdn#M(2Xl_Ht1%S24`rQNVBT@U|!(-X6unL(zdh93A*0
zjIN2lRod+RS!$laO7IvP4x;ZMMs;EMeJPL2WotWa5X&%vz3+F2n6ioK7ns!AeQA0j
zn*OP9Ymr&lBD)G4#f9i6LOGF0n2Z7n{{-{`GqYdj1O!z2C()VxN_1wQiPG>_SvQ!x
zuW|BpQA$!9l;8Q!PXuq`K($SOGK}8yl^Ey9i|cQubH)C4Fo1XD@vcG_k#{UKLKoo-
zr03;VNU1*&<r_-f`;gCH>(1^Enc(6Zx<w~N>f$bK^mshf=<#^a=<zrkb);19W@*&O
z`^~W{aavC0{g&7sKfE<|ogdy7dkA5HsP{6dyp^!@-W1dOEiorW<swD7pE`iD;=$gK
zd`7ixDu+qD;X$<RZ!>~#Xi9`ydlKK!ln6aGNqj>yi0~VlDH6;!_Sd&mWlrBx+QVir
z+3;Ypp}~yAeh5HxV7bs>Mni)sga%W`ARe(@wH+|x?SP24o$Q{!AE0By1h194KI8P>
zFMR~@*9k1aD)%NSAH?4%aYgFuW9(VOZ-^0#$`T*(SwiFg&5v(-)=)w3gE93aeisQt
zgweyWuVi2Vf#HjBvA^Lhp~zKFnHHG41b@Ak$2z5f&)b&%7=f$u4aNBMgA}XSV)sai
ztKJc6Ttx2GvA7g`k7R86fXVNDhk^JhBuIfjLO>w?YXpY>$&@2pvw<8xFCaH1#94#E
zRt<0+lCXX&2+{u5|8~C(LeLh1@P$_Xi($1e0>M0X`X96DuY|?+JPu)vcq4Sm=X2`k
zZwQVrtb#WL^mfG$VN8K=>WW8I^zQh3k-3HA?p+w?iX8~5MN&72_r)oGgLrS8>bnZ4
z9jK|l*_?Yxe1UNLg%U5@<00{KReqK28ACv@_cD_`g$(I;27${S2o<9{qi>Hk@@8A=
zQ5$%#l)S(+Fn`k?m0<JNPe5M1aepoRw5(+Td3`!Yb%5JYn266wW<W2$)e!&fhWKwv
z<)HlUG?<H@mHewdzg(J^%Z=>kn=w`KpGL;+ui+v~%C~Ib9}u|OR-rVJ>=-qbtMpie
zW|As;?=)=<BKxvUqRnV76}i5NxDeE3NSDA~1ZFpVGwc3Ts4hG0yF=?fg!Da6;35q?
zX-i#T@6y~(h)csu&!=to0Pq46eAt#agHL2`a1IYD;(1*kSupPm4<VdmTpBNn85Q@4
zXjH0Q-5#UxnjJnWJ_yyidtVvTXCzWQrO-;RuIisfqkk4f|J1Zsn6y_gO-$lG30}UJ
z5cl12hv0T;Ppa>Z4yLeJ-yP~No<SbMc)*pLBiB5DXiOi<OSOnwrax)MfWXI*D*_r}
z>hU&w2w^AnDdb+~OMV{9Fly?@8zle7<7CZ%RiA2z|3-uK|ILQ@ryJs*YKVWbVYT>7
zoX#Iz9hM=azx8*ACof`#&Db)yN7*4#EJ9fRa9Af2nY+$~6_FRVwaDP+Mo6SsWZ02N
zq}V*R7BRXbkx#zpv;BiG1d+%h3Vid6(pv;o5hO;?8;OLA1xsbfQF_89!}@i4Pl&%Y
zSnW=^^oRuUnv@UX)rNRo-1=8=0KF$APkHUV0k1_?fk-6cmyRIf9H-A82f9B;#xt^X
zw~?E>1Gy<dlfBMluM4u*2f+;t2Izen5hL!dZxDCaHz>L{h@u;y^FV{Rx~W0AZHylj
zWp^t&bb9|we3MlidXL3*_v8gu7@{lU{0X4|*WUx?4X%$j;QDyOQZmsHpKMqv$_?@9
zhPfz7T*>(t!4&%Q6|I{Q4<_=#IQhnjE-dqhkoi=TejzNYB9X{y77<U8NTgU;B1Ks=
z!n||WnMWk<>@<_gnTv>=2sn|!MIw=6=RML$(~-zIHXSY&unf<u8kSktApO@hNdJuu
z(*NQHX}_T%eu+r`fD0}StpKm`R{&+9f*+46;&ZPEb5GCQ3wng8B9S@gD!|m;0j7o%
z(RFe-5!G8aCw>vF2P5Aq<%9S(DSrln56{(na&rW|kw|3qjZl9$5@08I6H{-#0Xu~T
z?2ILNUdKm&?|1`tCL7`t4e{d*@hQb-WC}ZzA?BSs5*g+5X&~IRlj4p+>Pd_Y1`oFO
zl7FRJ4BT@{ev2!>J0VkOX``5U%jF{R@TCkxUY3;D{GDMv>OFxjy*+?H4o!L26PDEb
zacRe&vpJy$OaBSs#6mR*2T>%^qequEFuZ6<2g^!&uO2PpYYY;78zh}fl32V^8|?Nz
zCyD(i;Qh8XxLm?GI>=s9%;825-jR^ngzy574LhBLk-y|(%}u0kLW(|@)AD}#@RF1I
zY^;DpZ;EB5SUi@hAR>c#RqBNF{VPaFRkUx8G*wlg`LJW^<gGr?sZ+<aVmdV{iC<yG
zyjD!Ia6u0f@?n<L*b=AnFW4`Bt^J*UYl7a#7pA<AO7$Ni$@`cA%u5MO-JTw$T#qI^
zbCgoUzz6&2yc`$)Qj1c%5M1D0%Y>8+;uZvDD?+HLZ51))<s^R`SLq?qp{GCjQWZJ<
z*~u5%@)th+N#&*8oc@&XVBG1nuS`hV)1P98ESS;LgkNMceRf(Bo!^ZumS#g&O^Hj2
zE7ycvJ-H_3+9FpyrPnIqw$Qa*!X0v5AlFX0cFDC{t_$Vb<0y1@g`jIAKy8}@B}zt8
zCiP(@6H=zfSr>xQ0{yJ=VXQ-4Zw`+7wGy#QnDfQP9KJtZXR>>l%rc91FIOVr>C^6k
zls<DIjeaO-G-xlB7<B(kvy!1id8k6#?2ZLRWp6-$45vz~Zvc^WZ4HWE^fn|c-v&*t
zM@Mj9m!3NQR~9s<jycI)7wZY(B#L%jq9jkI>bg{gfRx`@meEUilk%B_hblf+x`t<*
zPVy&zUb=H3+T$-c$UHEJBphU3VGlBsisc})yw@Yul4ki^3CEj5gT9CkDjCUuBPA*<
z@u8+A(pusnmUyOViHn^<_97*^W1%9eNb8A(N~DeuUCdcUu1=+vuVx)RaS)SmT&}KM
z6QOH3SJP9Ht9831tXECfYq*7ODWmOp623~VE9Lq_{8}`mMee&tV$U)|Q^FuDaZ;oM
zIs3eZL+HuINW!tTCh`%kp{*SHI;JdI8e6Y-iYa;T1*6UvSZ9i%u4(es#SHS-HBA}{
zq9wL|$zyDlxv$-HDev!ReB(z=DpLTI)Afe9<bImzn|xhiRwS$_Z7Lw!{x*eG<Y**P
z=f!XO0ShwkG7-Ilv8$j0=tLlL6CL}hy|{LgE%@t5r^u92JoU{O8BU8MLb)b$nEI<2
z*Fz0|OD5MDV(s4Xm}z`m8kZ7C<OB_GmJ-J$5)K=$E_06sQ@$^l-+f%4#QVT9UDy3I
z<}Qfdz{WQYawz6UiQIK_eA^JyF1gj@biK@#ng4ObB~Y}1I!kQ4-;`q`(!!6&xBZkY
z@+dRUm0b9eOZz+5I<IzZjdSlOLShl(dqudlVki=DS74uY$<eX^-H(yG&K2%?WR0Vk
zSNoes77S4Gs{!?WGAeLBMU(_2_nRcSAo>{=j!+<}rR!-+ftIqm{^<Eq)P==zgg(R6
zvFYQ_gK{q{Y+*7EW@b6yGE2c<M`z}5qBHZ|S;9c3;s<6bwp(F9x{{pMn63wNNQD=N
z4I&d1;qpi%jH`KMkaNXBM1+OO3UjwGwzhMT=XQ4YU(~rUc6&eU(4m;yd1d=m?dz8w
zShQ>D9w?u#=N!Pnqy*JiZ;j)2Uftf_4)d%_l3UivEfv($TCM9)yv?L~L2K=c&_TP$
zF0iaEKywEcF>(c>c<Z4b#cBrw;J_k<27K$+Lk?bsXbO6)hqog7QRMan(f0NQ?H%n`
zAaT(ml-Y&h^h!hR3P7J<6l0R2Xm0TW^lM@2?~k>c!b^g}Z;ExX<E4vCCgONbxG#2K
z(Ry@oQ49ens)K0faugdN*4o>zMsS6s0iKn8F&0fHP?VVp&)^1>T#mL@^`R~ctft|+
z#`c5NJpf-iUFQRfM%VigdV~-u8!kgT(8{720OS(C9hADXpOa!>*yv-rU3%E$XQJeg
zfds)})3Z#$W`icAZwXqK`dj^S$lT^PP6)9}9U4EfFY9wS=pCFafd^@q`(%K~6@CuJ
zurnA{Fnd?}i3FcGxC*ctg4+e~O>p;i^l@O(o~6Wm9K?OKCLroDx+jz`348r~DZbB-
zawM#A4aZ`!c<m6lt0%d4$)ndS4LFMYbe-qK`!$JEv;QaVj{#>3v36bGSV#DVb#CzM
zc&u~dcH4wR541~Pj&qQ0z5SXcZ0x2cjj^elw>!%hNcU3r77l}BX1j;HP~`BC6CHsM
z&8<yy9Oq?Wc28r1j<f@i+nNBv&W;YmIP9L}vG!MbuR!VBImj)@c{zv2K%<1}NuG~{
zGGhy5k-W>LElPpymIFI{G6rZN$wZ<;N~3Vnc^8@vq?1Usg(?kttTb2@>JSa}2Ew7w
z?-EoCDdY<^6zdOj!4ef7ORbPt)+l{1qV!$viw4vm2;|rbpNG)R%3#h^aHp-H91L>o
zQm`tJL#uuA7j9Ui(SV!Q`uV~<>q7aGu-?xno05Gt_$ij5E)Fx)B{DI1?BG&A72t0S
z1G#4@iEdMvh=;=Y%pDFA7~M<?-NK$N4{U8DS6K?lIq;x_8F#zSgzY5f%i6S&b~4`%
z()R8BpzL;1_T`qcuL#k+<m?Q%|H@FuB>t;HaTOP&TpVR<O!xV6w-2Cj^VOlwgu(Xs
zP)T%e(}r*Y$RC(AbB!68$AQffYv^2rnn5d&MYQfWb0C;$Ce|R*tk9w`TN2<O!i<W@
zLE9@NnddC;B1Ry(UO>4Jj7S-yojlbMVqTCRp4r#+y3=P}j2>@nHmoZGpgU9tx$t5J
zYE4f-j+V&+O(mR1tYZ5jz|&$<Zhx3^mo(0&Pq|Bd!jK7B=1;Ih@evoLFHZ3C5YY&Q
z4p`b<5y}zzS!ri5ZRce$pypLgfFYr*4$yjF5eKy<Oe!KZxFD0z*M*wk^sjF->*NN2
zq!c6NE)F-TGT;(BB!~+YzZ<Ri-4w{%7i4(}fD4mRcxp9$ft9<RA#wqU!9lAe)<{Oa
z7z7e~!Zfug+&EF(8>X8+(#_&9-Smg>90(dt){-dQERE95GK*x=jZZ|+jf8xOB(#?H
zqe5U8n4Bz?u8)$>hQ{Ih^7LYV_#y}|@#{(SQXd-<-Dm|Cv9T#E4u+!QpgGkU&JL6l
zd6`}!pdKq8JT=FXSTUWJz#PNd^~f_YyLhvP7bJk8x-dYEW>=KpIxWF<h0;Mq*n<h=
z7EG?dM(PQ4i$%d$jiLm5E2JCsS(RmRm`D}IehSznmJOB;0gsSWR+3UhxG1c-EDtll
zfImL4%nBa}u}xO`fFm!hs?(s_Ma`rXZ34(Cf9^%bK)(r#9LTA#DzGlh3F`wPxFMvE
zLrTq3r`ZvyO3i_@Q&p5bhFFt=ao7sR%>h!$_glhzztz$w6q$gkSZsS(0$&!A^1_ol
zf;LrPUrqsXMOc9BY%(;(;+2-?t_n3PyuB-GhQJ!*NUpX^${tVRVsqK`V4q6zYpf){
zHjw1kT?W$m(PJ#7wFXlG6m3o0?l5kZ2^Ly*fl#-sa8{-YF)B!Wv1MS<4wOyFJxi3C
z0v#Rl+?p87H_RsaqNC69V}zN0MZokcgNcADU>Vk^^@DzjRqI!U8F#e+3$=bt7#AeV
zwPEUoE?}1?=0SvOl)`S70QdEtK!6JqU*hwRP&N+wEB|Z^5vSyA3RpN~K(OOs68~ln
z$=VBB8i^mh!wnr35HKA`-rGYR2^Tn*)92>=Dx98)*uUa?A2Iw$$@o7!UYg1epQvZ2
z$42Y9;fZ`@IzPE-DqG8%@NjWDH(4Le4^I}S>od;T%a2xyC-ar+aCtIYE0iiz!&B9%
z;bJ*^4pnVe+3M7$vHWztQp}x0t)by;B{z=C)Q;^wv}od-s@g8=*>Z9Cx%GRYs-7!i
zhy1|_u;*T_33}{s&jCkvn9|>H8PQs0(s9a_;&g3dXq;43oy?AC2=kl)CJ}+x-cmqj
zG=H*~%WH|+>2kiR!Eo|KY2<i5S2L|l*EUT~?%0kP_OGhwbF!41$k?jbmz<RbD9WX3
zamFtM5mh~1EtsxM^O<QI2c6rz%1Et}H_#PFD+)q2e<D*TPMYMYdM!U=GIHbjQ4LN`
z7OMv0T5&30IZ@BoO@#?2XsPjvWctl=C>qI?>r>gPiIjuJrl$N+a9Crt?8sz(Q)u*4
zQ`&$XLA^LSRy073=CXiL^Vwu(WKtuTE{jw+xClihU(l>_wl=PzsnTfO4mwwwDo^HX
z#nQCqoyr!?X!A4WQpJR|Mmbx_8ldXgTrOWFo-t2~+YCfO&h(I<WT!Yy<#&Z*BlR&P
zVy=(Zr^+Zjk|)r}Aef{1G9tjliF&D))nK_&I&Mc?9S12waA{8ER5foPDOFEo0&G`u
z^-T5jbj~!8uK@j<LZ!2{(o`|GX|gnJU=i$1R_a>eRH-r%nqV`(7)QNW(h?d#%E)9u
ztDHa!C@3z2|KtuyF6TqhiTr6z&sM9YTqawoWKBZl6bBI|iCo2!U@lwEjua=0HB+`)
z%bIy96!TMAA`Vi&k{vD1YznA+syJ53*76xlfhF*%yGql3m_r8g>%j7eW!BnwC7&J5
z6sHSjxFiqh3?+d|A|!LXSU|s=d-82@Y&vU*&kuw2YM}W{v6KOwl<L#9qTm|{spPAr
zdPU>}kf=2_jpl{O$<29`pE9I?TmuOjoW?K$M#_y<O7*g>NJN{d&KIOV#WIFQDlL&}
zFaRsJaw4~Cm8^i#>NtgRwKzrALZJ}D7zzUdjc^klHBC=tPGu+ZbpvXM`zi1ge{GI4
zI+fj&t<@?<A~A{ygRCR@0qklHx%o;U7Fc4mSb>!ES<;uFfUabixp0d3&^9K5+Qm}9
zvly-BV`<K41XO~^rfS)MQ=J&87fg#*@?chor>Sv6!Hi%^rb^R7(~$UVZ>$>1J~36y
zRPz;z|IEqFThJ>yV!e7UQz{fDOIahfiqlrORBNM{bcN4J-08IX`_k^O$6{WxZP;sb
z@d2&aYR`46yP%`>AJf$Jns$n5i%i;DO*_rBg(hu{rrpJ~u47(X+f80_wYPZKbCYSW
zBRS}~S9uE&Y-Mnz7l)PRwjDgTa=iz=c-xlbP&%DXuG*Na)smap^H8(Y1?QdG)3k-o
z=aAa<9LhFt_qnvNsA+G_TL`DFzLc1xrP+MM9ZlP94sY|+<}Eazq3))=J(sf0VF-^n
zpq=Jr&p)+!Z_P*X!ls`8*v=o`zNT~BoR6DhvN^3UZrX117Mjy!a~Q&9H~VsDuxW2g
zo271pgc=sP<;5WP;+wqK7_P~hL>;%cStYl<S?Z2J*ln?l%jO%!;`SgdVDRRsIR6QK
zE-f@Cz_w;%b;IqRZ4}MN))a@$@g2hK*#v~N>QCtK><Mi?oDeWWcJbO3%u~>7c-%p1
zbK*QZD+HKp-hu$@k7hP`Zfyo)a~^I=$N_npQSWWiV9<#vw695_prv5_4=P@`v@;-M
z3&8TTXV3iefX1Jmpsqo|H316tUcyCstLFrTl1(ZGD3}XXKJ2sSnL}$7Bh7_S2#A0@
z!-VLIrsnnCutW`7I2$3lbFx(n6xZJ5khd=FiEg>di(xC>Z6$Y|VZ?4L#m-p@w6-ns
z;%M7Ry7*MX96hx)<>NVJ-5jk5ytAfY&Qbf*<x|2O7;3ImHBW_*Y69J05(<4%@ihxT
zk!yYKni^34j1$5{0GCMTGa*_~b*2K%p>2-g=H%79Y<S)9;cd1S%#}908zcwZEJ)AE
zKW7@3kf1?nv;O_GIp+4$ui=EzhDu_N+LCS$-~hR<PfozzN+;sps-*kx)5pB_<WS;H
zuRG~}r~9DSGU#nulQ{0Rx{p=TOm_czK@GJMP*2)+<Ccb%Ht20|7wuvz-h$+-Ja>22
ziyiTtA8Rts*%Bchhbug4V*X5j%xi5!(d0qN{a6oO=k0K3{Ajz*pQm%!I(MI&=X-uU
z?h%*rY~Mn$oP#%S41OQuAYqXT{1<Q)7}o<*5DB}C;fu~xt<xyv0foP0mJ69arbbsY
z{4k~)cp>xCqxtFF=?t7_WqLEwtH}(xt~62I7bdry$9_o0xMGlR{V8<v_@48*y{#b!
zQp6qF;E~j=8|^si%QXJ2%G8j!x5D1ru(QPuUYiI!M^V2z{B2I6KkSwHqC>CD>Ex~?
z7W6gAblO{zbbq5|2=1BB&Kye?(&-w~T9fW?wmj&?k+zFzwoofrm1$nzIHW@wKA6qS
zz8@vx$)8Uw1KWQlmQM7e)MxHVdus;0ey9a2JaGPI6i=pyAT`!|$*Vng*z}cjPv38X
zUK%UngWlyRxiRg*Ym`jF%`<3omnG}s^jVf%gP!8<|6xz=TkqM0Q4j(*>AvzoTR4_<
zFZlwNkH=bS-V!Xhu|r<#N?pXiH-nam0>Hctbvd~ETQF!2?q7oehttMnY;QGV`@W7X
zzETG^<Z)nba<%PzRq`Q>lkmeQWe4i5PQG1Iht1eFN5(cIWBRO&>C^t0V#zOJW^x7F
zGM0tkaUO@zgQln|#GUB9?M{T_$-^8BrtZ(s^^yUvbv3RSWor_v0R}mM;r+ttgKUaJ
z{?lYSc~CMBBDzyE$7P(~#36Lf;m_U+{bUs<uzk>5H0-sn^p@@O@YNWi|49M$PeY)-
z9-x-Ppl*FI4C&{cp>Xt5_Y(3q$utP$fazyv!Su}l;HH@h@H&O}jx&J!9T^k4xObN~
zsNTa(n6xxzP4V%ThQ3|*?}NUZW_s(6du=N{Z<W`!!fRRUB`h`FXPfet+(5EgveQer
z_uX|cN#4RR{d`OSQ7@TZ{7ry_gv?2Ab^pbyA>;p@_8IU2Oe-3jGYxanRzn%^!JR`P
zf_XYhFqcGTp$YkX#+#FTehXtT<nu{zYm|JDsk3oFXXA1(fF+)u2IA==>z=Zl8%v&r
zbYQ<K$F?N535CA?-XWpTA37ps=Hf&M7hfW*PP!cr3JGr&`u)Vc1k-gl%aAxTkQx1u
z88c9S9`oXdrK7LkqaFQROgdW7D9!?|Pr5U{AcKaq;C>I}0R2g7EL$smzEk>)x!=N+
zz)f91Pj}g#K5@@38Peypr@4mYElavf@0ZrTd5@0Z|2h5;*s%<<=jP<DL>E=H35XkL
zYW<K#?(&0PdW{Dk`6b}@)n0m&7avSq<SlUDeK(t0;Xdm^lCMtmdduCXo%=zB?-WGG
z+<~Wns)+(Am?R20H274*oV>xH>fg^ifbg8GYnYQynh|{{=8wosirZC#miY6ASN{-T
zinxCAZl68EX<o~?7w0s0yU)BvC-4{J&x2A(19A85gv$Nf*skQz{X@c?*op{)^9vT7
zKMBAIr-i`zpaJKPo)0*C1)OichTuFFZve+GY5NS0{uw<8j^6MZA4lOdFFD2q$gbWG
z2)16!wlU-%o*6t6;Q}SXj|w!u2WSG}wb88>%mTQZeJIf+-D#g0K|dQG2mS1kh0B8c
zc?<Hd17ssB!)ad2NiV){5|nsShQuOq=nVJ!eN&E1`m}>yem?df*`Uq+ySonpq+R4O
zFv7#`F#@&==F70xwaRk`gbjZAG>4z&+6c`BY|!d{<8D@2?Y_%Rn>dSfFz&fqteA~M
zf;sMA-op*0N6iF08Hc2$PVtAY+2!>=3`o;n3aU?w$Y`a`58X}bbX^kf+Ci@u`T~}c
zL2nDnv_Ppy1WE<Ox}dz<ecV*~^Rre;y5qh~T9b4K?)Q46hc#|_2tkCY6kK%7i`4=C
z-#7)u)iV)X{fc`KxbpgM_7(wA%LP#n38MPl@53M@mcC@L^bv!lFNr+qa1oz{r4QVT
z_IxaTDJEEQ-4ETf%WElm@k4_`iU0G}%C}D@gl`wkEqJ|)l67H>N2F8N{krQ@0E9jS
z@j{isD)-;YQtscoyL8aI%$PqL8S`f?ee{DqIBcblf1BatFLmDtb<xnrN6pB8*Npt5
zX5@&^8u|A@A8y<G4SoE*9r;h{$XngNkAZ&NpSfq3GUNX>D0tJkqu?ong3kl~CGI!S
zgNycjy&mZ3COUwR0dJY&<HJ&=)%~Cc;M{jWwS^vGkn>MYO)27+@7`rrkp)Tj84v`}
zvTQ9#`f+cG>bdP}nHFffy~(?wA)ql)NG7d9l6=InOiEw@Q(!?D!j+<k3=M(bdOxUf
z!9j0X+lRdNH6kKb3sHRHF0)2LMM=3G$GnYhogyIZdDyz`Sm`Ys=Cx&wms;g5Mlv^u
z7eIaG*6~urVN~=aFIw$&4XpNh2D~mL^<X<$qL-dAio&Z0ytUh8P-w=b9kbkPU&VHl
zs|LNb12!uOzv?ozQJ%ev1QT<A-s6yV!K7+)TOT(BaIF#0SMKuG(4HFdHbc(=3IeW&
z$rE#b&naMue(K%=cfJ7xrVonMg2CP1qRrldm0sIr@KqAilyGjxE==PoV3balw;=`2
z85HLpxtqiWx!Z+>Bl#XG_B|U`do9FZ*9M>gH?%MD9`4z94Qw&FjA{A~++jX-?eKaO
zYg(NJfKHpoyELc8u~BtU{uPD}qMsd76B7_$1wh^g9VP88$MmIFcw1o;-QmUGfRr`K
z_mcG7Pu*qpmn)O*XEE=~29e(Geo`=-bibN_9k*75(zB<IfwSL}O0N=`^e$narS3Np
zDx==@YR-l0{-oy<quVFq@j>kW|BU;|du=+^o9{WCEV$x?C~14HBO#`N>Oo7`DJpk>
zbph`I{Zf{G7d#zryOp!B4QoRRrIMHh@P{sjsP_;ulPA5{aNLDwD+R+p?(junFZr(g
z<E#yivasXpxjLW%=Z$gnG;>9r#X}Sv%JaQ6nKSr{Olz~8QF?Bv@c`sprNwpS;5AI4
zvo)(@i3F9Jk6{&~a^C?Gbia5v1O%4!-B!ZJlWzniLY70%@>(wg`$OPB3e5jCPB`4t
zk6TD$SPXDLnvm>uKMf1K7xv(8UX$)`!NK3T7m}L(m}^lC0&IbJG`1$!ARji96vu`P
zi~j|@2pjf#@vF6D626`FS9`J5U`}vtH<+>Q#}V#Lx_^654ds8E&2RO3-H+4XfZm1}
zZFiqVAbtxl0==qe89(_GNyvhyz?Yvj0l@S$_!Krz@&WYN14(S#|BW-Y{|MGz+kU}s
z|0lU=&-UHcr%Vt%xUFBXeZ-TH1#3hW{5xEZ|0!j`8MylFC)S%e!CwSf5cb7}T*QWn
zLqeemvr~8kq6D7o*|iMQw}+YjO2hQ;5vJdjX!kmk?w>2uU$o9!H3*pigB^NkySLf>
z%e#lXE1{hu4Ll@?E)t=)QVL)x;$6vKU7lE%sCikIO@U>(w#DQm7d8^fX??Gx5CL<?
zZYKMo0VH<*82IV~!qn~`gR2Hms}p5<-6z4i!sbvURv`X#B=>{&rX_s<>EKaR7#3Y%
zDcc`I``7^MX}bx`+?m`8SF8IdIGBQik^qXz3a`)orgP9+f&La?K%Fe}a7bE6nO-<s
z4hHRV7q=biYg->R7*^$~4!sB6K|Tb@5GG4@d5hbQCx?)pbpHSgIy<M-60jG$ABMWV
zQCmm=OFdVi|KElFOgVMHYu{{3E^$AGlF-Q5mnj+Jvn(AD*xVt91+xWmJne0vGRrfF
z7<!OHV=$g1#-V2Q0ppmLcnor4H{P!ocmDqQ=?oX((T{U~s=;#Yb9xxURthisXBQCX
zvEOAov=3Z7r{`MctSsyuI(jSHRN?J0%%A^&2Es-fgtn<rBRKqv9W#_LJ6eGlnL{H%
zRV$v*bY$NOal4D;pI2|Tt%h>uX@USab86TqRY><Yv=9z9z7X*RB`XKuVrQyxoH-t(
z4mRGRJ6Sl+OyKd52M>XxEho_%7LLneP`CSdc2}5(;VzsoSdY|GRKk}-fv1TRPYyGh
zgle>Ov)6Ksm!PJiu6a5(mnUE64eaoi!Eue!n;}+k$JKFvnB<A%8Tb{GyHIc-`E4oE
z0><33#aq6KK9Wn&7^+=F^#|456L#T;3Fh|P?=4>is~m?u7Qzl&>2^Iy6#(|5`;mLU
z;jI|JP6G2k19=5$xNrr^cuTfXuC;82-S!UHCoDgZ{F>kM!d2o<8i47Y8uXT~v8}Z5
zsLDbN5YU*+xVtDV^<iLt*5TgRmuKk2d{0yKyv}REu01RrxAh<g2WxTZptsdMeb5`&
z#EeS^WmBKZ3*5oeXz0^|mzBw{dhuazB}ND&yfM*+1K=ON_ZTd)<?fdps9V?y#P;6`
zZ}TcP(}Koe24YxSlD{V{Le{Q;^8#J(he26`G6;9rVZkf1aCW5w`Whr{KY)kUhgItt
zi~yCLp8ybd5{R_7GWn<MU!l<J8v412kEK9Xzgs-$Exg)W3fvBQoo-j!+d3@WZ%Mk9
zf;X_z+cHQhNTKqwHJ(SqdCC1jcMrfKKYk2ITw6e|ua{oa$rOC(uk+$pc`JrxWq_NA
z8w4EQ<;hP7P3$4MW65#i-+_YKcI#T}ssDW}kJRRSx!!yYzM}LxuWuE$EE0X_?Q8HH
z_d;=fA8b&pSAnO6Q&2;J|KS`Hi}`cmX5Ip4+m>~hg}D1?(m>k%dH5x_3`)}1;Jod{
z9KR1qT!5L{2A4Vbgx*ir{c_y8(zyKk?%M?5b9_|+YRE_KeUQ$}7O2%}ZxN8(4p#$K
zvS9ZXR1PS~RBMy&UED6kLYc;@s4O!;ObvQ{NQFZF8-Xc~uC~{#Qi7rObLXU;ta!wW
zbHj~X+YRNM`_T)NyJd>I(NtoU*L{bVSm7<)=5?>|TCqUGoY=Spqnhv?VhfXQ`oVCO
zg;J%*R#~W3;_kEe92@pJ>xn-1A*}EV+)4TpR=U52P0&8j&$HMfAilnjy^r`s-dgt;
zV>D+(RidTxRIK22xBUc``t8YmM0GcuI4uJJdI%m$N(@XYrPB@)%a<{vwaI71g9U-*
zEf!|#0s(q0E4}m{58lwr(H1auqup;MdM%p3;eQAYcioTOTS&t5@;Lb82{uez0f)ck
zJc-UWB;A8L4_$yM)NpziJV9haY;ML6TYxS}eg#ldCT)bSB>~9AuGQT9L@8|?TGKzj
z<|zyn)zH(rB!maNVSpFyCpKFE0eIa)OPWo(*F71K{vSX94zKf;Z}A2%^@c$dgTesc
zg8!!18+0FqKc^3SRd0bZyMWtU9q{qd<>R_PbbWz~VYbufw(uaJ!C8lG-txTy$5p7@
z>pl$ixbx<@CNklE7gll%CbK*3w+O64go~co-S$R|Z(A^x$pM*;waG7}1>5ear|ekQ
zC*4lCl7R4wu~d*IuC^$R%rW=kbWWFHb7QDB1TT|&;z?q-Z=;u92{d?%F7?u@7--q*
zL3zFyEDNtA1SyUKKshw+Cck24gB!_?`!5hP18o^f<t1*<gOI}~hN!z^?cf44-ej@C
z%b1toA)6JH^?1}Kg>{8$D$aVfK1iB{uwG@ByngI{uk==Bg#TQut`v50ERNt($kDc!
zp<hq|cD;L!q3i09tbf||&1dX-CA%J2<8>dBwx!FJvJ;_Q-qobbH^q)&x(@-uuH;&8
zC%K9w&NV;z8apFkdJN-YWKv%6-h-J0li~TH9_(@qa^whiZR2)vYO^=EN*t`6*u23i
z+q;5k>jvR-rsUb?t$?V*+{kr<iZivEa4xPL8y!R5AUqk^Y{lBwzRBCO$7_ctd9`T#
zOVb|k1--r(CIE?KIktBn2XBIX5Wyxg7!?SmQy9zn7H{=tZ~aP<7pv&?2I+6|y7qdh
z72f(mn+$=n7+jY?a}c)6o{ILwQ#G;G@fH{mpAts{zl#1m91Sm^0bzCP7t9i9a8anC
zBO2>-P~`1dFrYW2gNKx0sPYkAIebVAm7)j3nxB+Iu~|wyCUsUC%K279U`qtPhvIY=
zk1C$Tv#A*cTeNZi^clOckNP1TJUWU<pt9Rut%lwe*3kdXp^82RPJ}Rco9Aw}p78ZJ
zEycxqJ(v}H7uX2GG6gprcY+o^p6G!_@@KJwSSGf(k71c*{99OdyCCu&zh}t1bU*z6
zsJ<h4y|*25WmRGk#5(){QsQr%G#b4WoQp*m{)2d1hO*%8ST4HVKQYbxSLj+$&2i4@
z(p3P35`*4+Xo|1%77r#;aI3t-9YT8>+;3vhxdOdi1Oa#n?iYgtFIg!?9)pvm3o7zo
zV`*7n8%e$$g;sLBxGzf{LcekM&2g5Dx&Qc@g8=JFZW`Y-8!sDx7wW5Ee+*%Fa-A$5
z(5ZN+B|uR-6{3aEHlX{?!fi`(2C@VV9OQtL?pJUMiirCFj&=09KPzb6;r^9qFR(BK
zA1U|S+yvy-2cULmp0pE%`M?PpJY94QofXgC*+%W_l{h;L`(>lI1N&AGkAm7YK*@GN
z68Eaip2&7Am0$3-LAQ`HeL(+4EdMJxEgKcd&kBe!_x<-2;vOUz3_<?*p#gcxy_1+(
z(XrCO*Hj}vd5t+zuIU))ejHzDo$vfLk>2s$0u#TsV<7$Z*hBHh-FJga&FkAkW#=l_
z2yfZcnQJ^R<tu_-!cTL0e~CU`q7P!=CH{DcKbozFXOj;#WuO1B^z$Db{<F=`OZoFF
z-(RAi`Ni)`^!wuC_eY(+Xa0k)Kj%x|KkD<d{Q}QVuW8TTXz%maXcu4TeqZSJ&zCOF
zxBhd*U*o)N&}o@9FXs!_|KICdI{c4nucZxLSoj<LV{42f@4AkG&Ge5woOs-OH_nLI
zahvMSbEShuzhGm(8^sHUuTwPi+ep{8p1oUmw!<sWpI_g7L?Ca38}Cw<pB?{36Subn
z{OJ6loxL)CwDV~4@s@Yv4Sf8at-Z75H}>}}Gw$nOp#IKxe2sYjhM^Z9?}lC)%iVX5
z<sJ+0AECd-_Rh86I~&_GbkW$}v2!f9d=5HmY_G$#cQ!xs50tDNpWo(y?}0}6=D_p!
z8rz$r+}F-=KIVe2k&dr3@XbZXjrd8=fuF{9`7wL`Zs-`e)#pd=vE(~akGH-X?*nZt
z|0?XH@fU#u<t+y{!tt~gcVwRY-GJHq0T!=~^Vxy=;r))r_Mbe*_OCGGJR2NV?l!{F
z*zb6_-_Slsqdc|psu7R(1@zWb4mOtOmu~r+OKzSGPdA6hAA+}WT${BU@=N;dXPB>#
znQ~{7OP>kaQ+Z?fZ!SDFrrUTUKDq<`YKlKw&vft8abvn2Z)3Vyj%Mw*HI^gZ`D;w?
z)@1!`u?h2L>9A2AZ4Z@U@H=L{!I!U!@MX)-rrz21c>B9e$BlUTo@pmSCn5f9EYBkm
z{GBU5f5PDXZ17upI~)9s^!EcJ{~OzHEZ1w`K3lnm5;{JgPUn#SR$lw<8M$uxS6gwM
zr%k}>H;r(8uW|h{?KI;3fwRzWW4jigK74bG<L<`!G5t5vS4i&9rmxm_`4mPnJCpq7
zC(-%y;hJMTJl0rl4)`rz&L)5PW#nf4HsYDz>E&-Oe%LoXS}7Gr(;Ied+p&G?md)vr
zY&AccE={K^+b+NS@+-EEUYyQN;yV;+em(-PxK3}`JhXXeM|#6}tyZpHIXs-z7KX-3
zrLjr-vTz)p8LpK|lezJ1ae8=i^5oPez8oHJ$xd(1jcmylMn^X9*gU#p$CjPhomXtT
zJUg=EiXA(0h3(nV!q#m7Wy_9>ow?2(@w*lBJ%e-j4uv^z&lBkmfT=hW1$<UO4*2jx
z2$|8!$&9>E-I>l#A$=78Gue8r<YcY^{LTn3c%iq0cj@QRMwyW!-kXhs{3r3Yc8A|E
zaFA0u?M&xqP@sasJSmeI$D7%miE6$kQBC71Ag7|&>?wH<zEe7dZ)!O8X}((>sIQLW
zE&fh@%MOQMh{)KZHkle;7=Ox-`Uijf01DLeCjm*ORIWPsN&;R}Zc@<F*hwdo*>~i~
zzE@^$J8;MT%+Xigx<8Wv;3vy+$rMLt@WTHB|0eU(GOUbg4~1kLHqQ1Zc+d$iho8)Y
zUi6y|(l4Mtg|kke7h*h<(Z>Za(CIM%=*O$o;$3+p*gM~O@6>rkBHzDW9KpvOa1^Oj
z$!l{yej@GGXEkiv)f-+}o~=*TGV(@u%ztrm6d#+AhalvnR)BT3deh-+4rUJBrnotD
z_|X1_l>J8|3AZVdY<szSg%pyR%AUq6{P7BX2X7=B$=KxSD(Itz^JNo&z`@4^CP0(L
zS}{AxIGC`^JE_S+2z=)8K>+X^s)9JH<!nyrO$SgN#gh{3N3NJ`Jw`?Z@`M*=X9NhZ
zjAWE_@lyE7QU!^bN^xu))HITr%opU&SJOM_WjtFQcknWMr&=Gut*RKqsH9e@gu=W`
zOgn|i>{t~8D1mOWV3~?DP7H$h3&j~{GJBfffF(wXHM~CG$z>-eN3!@_g78G4KAmG7
zd{TntYNfK)K!5d$9F!vyl20=^G-|?*B$x)LE18jc^)&Lb8Iwdn@NE%xC6rjn%Piny
z4i1SDX^Kix9@;8Rfu%<?{M5lD1~Qrl*d*I#v|A_usgrm!K5p{81w69i7<m|~6(Q03
zj_vX^jq*63tC4rjfut!la0LO>tJ$%<Q<e`KpzuUKqk=>}VUm$q!CU<C83)P4cPS=|
zU_BPpFurn-1GUwvz#jyTWN16AgQ}Gilz%1Zw3wsJD&e~fl_?ONgex_<S8y5-UpBxe
zR5FnDRUnK^2kCVxFQihOKAADW`nIi-W#g6lv;r#MchF#dCZEe-gb-uZ`cy`uD97W5
z&Pf}foXpJ1#=PohFof!fD@f8}j)MjQwM_|5WoI-^SwOSvQ%<oYK}|Ig^nzFV<@03=
zl!Vy=`_~)`Ru$7WLiudUYM5nZ7*c7H@}HpywB)Z*CKa-Hcxf~=j!YKc-<Sr6HOoWC
z(|CDe^UQH@8*7#D0giBsOyq3WK@LGsKBN+kn=gullQ6XGWH^Cr0)h;+5<qLZFz{1~
z=BLV_wou_R$c3^dlvEs@jKr(OYSXGrZ&p@5l@r35g@Wa)`20l%pH~U@XWJ1*3Bkd1
zrGs!{J~z@F8fNfIG?Av6NEkCCG7&x~l0MxO8fHN*PFKb<)$GYxt<9A_3(~@ftXs1%
z&UCa-4iAmXq+(5INTf)fg=UtX)nP8%e4d!Dg;hj^xDszXsEs>0d_D(~X6kh2gp)lv
zroyOR9_7bugy|_u$m<TiM>8n_tZYSmr6pH_;#3?_iNdN<fC23)2thDXNI|54VN{Z`
z=~BH0F@Vn)jh2A!T6U`JFd0k@9;F1NCgyPIK~(~&?ILU&WEWG}isg4g$?w)okBV>@
zNA(icF|Oj7Q&=XjkP!1Cy+ZL&emGC-jnpdu0v%z^vLTf^f*oD0P3u)w=jUq#1g>$Y
zl$*$d>-^<K^w|0pqCa4H0dC7VtWS0c@YjRtsUk3w0gn76z>Y7!OhOMwCuno5Ql=7z
znL<>*B_x8J8HzjB$eqqXvp2Yt4+UwVP;eAl@?^$JQ3OY!{X*NxGg)Vwp^;O(;)ShM
znN71Ogv$boQmqC7%7W8*DGw#Q3J95Ux|p9F)gX~qk<Sc4Hka`Uo~lzj3Gppo`O+)a
zYbhn4h|<L=Q!N$n*)T0nO@vy3bK{Yt2X5JaBy;HSk^Q$F-FM`upJL<YgJBtTBP$#2
zBz|EjBZ07Lj!yBNGXB-^Vp^>A`4fhHOn_R1k@}=1GyiM{8j!3#r@(SB9PkIWlFvc`
zNRTW)IR*|djo*duG>MK^oX!w3P&Q@{{Hv+sFxY_Qn#{As4zLOPgcm*ePe~yLg9!9W
z9-IgOkjUCqFvX07l!X;88LP#FKX}Q5<>YJkCIRCNLZbPFCPU(57^Cn2bSoN4e$#>l
z=?y|01Zr~(4T2C1|CUSObeLWhvL(hpIaxXd6h$IX5P?|zted@a4)EzQ(dMMHY0N9v
zVL!F5pSP=)^EoK#&WNf7M1LO4a-vGK0;L*;D(O_Et}V}YsKFVPj#1GiP+k-}n{P(M
zFHkvUr4vfHQ849c<!O9$45sF!Mud__<!fCK74_;kNg_i=q~yT&yF}ng#}bkc*lCY`
zX<$z)OiejcRL@UB3lgG60IySKTxbP%3OdGNOTb`&UBK^^WyZ7;>az%xSd@dRQm*9z
zC{SA-V;liwtEm7$A=kofP+mFNY0$M;-V!=Fg>P5UWuO^|vIW|ku!W{cO<=kys4VDT
zEIVhcP=+d2osa-K1|>Nsi<Md(fMiEU!4#N#NNqw1nwC#_IpdHgPEo$JhFhs@%$W>6
z+2;_|J|!bz+g6MNcU&j*R?OhLenA;TqzvvXqqm|NcM&W(X+DC;P!Th0Y*LBQ_9>Mn
z>hLR=8dxd8^`qcD7-MC@|G4-QMj#Jqs6pJTF9MWAp9Rfz7KS-D?VPCADkuTVOiJQu
zACwpsBLs>7`hsSwRF=umL}3CmMu7!fFx%NlSW?gkN1@_pC!#5QG9P^-5A+G~A~n<n
z0H{E>Oex~Cb1Y%HrZYwD;gf}`2Bu)uVGW?qgdaIXVXStXAC8@ilMg@m6AKG8KF~=K
znk$CR@=_NN`}Q#^jyU=@Z`|mw!SG<J_!EgFOpacw%8BBF5ZMq)Ky3)Vk<&G<cWP(z
z`+#EZ8sKSjZ*?eXav6*y18ilTi6YESz;Mgq>u$e!e+FyF(fyg554?PTH09dEw;VWh
zLp1G%!?TiZKXm=!Be(3o&U}uM+zDh)iLVJx66+bu&{l`agCu+(l4OycGQJLRByhU)
zTanHvJ|rjxlYZz=WJ3lv1gt7u97P^C#DTF;6Q&ooj45KL6k4V~dRVa1)j-HVT}_O2
z3s=aWQ^{Ggc^uXfU%)QzhSO89r?ZoFxHsfew@}2VM&NkMRbcu}(@0|p9Um#ynJ7ad
z&`yPy1%IZN7GMS_V+xFM5-W#stBKN7y@IYVn8QF@c82_dAf^6<Ry8q5T;@BV#VK(Y
z00fEHa`GL>NUs7VpdzqiWsm{^js#>Z047tKaI!QsC^JX$U@%O8s5dNLsMqQh=&!cA
ziTj9XEW`d_nNp1g#bRyedH~I^3Li~z2D6c$$w5h{`XE_mIil;yPER<TqrZ&_85uXD
z8j>{VP2r3nI#q+4LR@v!#WS)-hy((WgkvZsy-918Qm7Lfq0bYasD%nOuF`G)WMRkl
z%qvP2EU;*qUPs)OAvNz9o~D#cihD=X_A!WZMz7Gs!&n-SCL_b0zBtBZ>BXJZA^gTb
z6yrpbl*>!^)p0Zjs4{|XgKWmBBw6Hhtj1*vm7##IB-gN#(OkwH;ajRzeo)mIBnaqC
zF^L_652{$x;5pEcsLsq3QRhrR+z3tJf{Gwp#SZQYKD@rQaj3&csE$v=mkap^7qSlg
z#_S|UUdt$pu?T%&W@x9UOsU%tBB*{B752nY`MnE0_%VF@)4EnsiV`T4G7YbS*pqN0
zn%r;_*ig6>YMJ>Ir~*X*#2;2J3GPDS3>;-p@%a@{$<)u%TI}bz-~}J5h3JAtqq5<2
zP!gIVI*?+vqTgd?1PT<so}4L6p)$J(rx*=M(~a63ieQPFgkQx%Zxw4(0_g^F%qPlF
ze+iY9Z2iot(uabs;rt9(6-zW-p^8WcD^j%%5l1&a4NBDygyA$O!W_#XS9^TI)-3yU
z?MbwnfvX*>n2BIrh7{s*Z4yqwAxPQGs>PrcC`|m~vPsr3#J9wSa^Zf3hsZD~6$)J>
zjWPluS1FygOFL9F8<y@&x`f45EWQD5zR)$UO>pPM>IP6U6bW$pLYBhIOaCx76$CRj
zg5=sbw@rvHSkR^neZp8$ahovrz+1ePYUVT?e0FKimCEqw+nB-JNFJX&;f@8-NS!(C
zW8SJUXd9vfNtP%s5@L^4{cJMO4#Ppdpq!DBb2ZD1G68!6CsYT-9Upmz;)?*`=N)K=
zHv|D$4RKeU4gp!h>nsm7;RIC@T%oQ~wWZpMMF-z#HaF_4nt;&lw;g%e?T3%<b8a|t
zs|Id8a!>;bp$OlJ6R3?Qsb}M+f*66(6YOauGXg~)hW`|Z_5{TY8kS_5-I~lO{3W`b
z!APZgGKds|`phfNswbpC?4U2P9eo{-G4j3Mq_z~80!<<|Ie|*RtTQ5NU<HozlI}8y
zZ9o%}AL)iBEDDa8!YF|qg=uFRgGMts_=?b&e#{t?%uiga6AOeY`x6aK2;D^#RbZ~{
zD8(x@$|D*cH9TT+awqC=YbZU~y*3jQmz7e1Wgi%jq#js2__QyEp*UrdnR9713`{ix
z&qUeKAG{zs&74^csl&lUut14!p;_W7rHewAA6Pr|%ZMR{Py67TKt#Mwcah8+iNpKW
zScLIY*~)adN;qz+1W6}y+OzVD%xwq;4n7C&v6QIs5Ge^v;e5gv&Nl=p<qU86<Dh|M
z2VjgX0Ukst>4cJD19Z3>lN9brlDM<yS0L`#ZfMYu7db=2M7mNl$F7zE9O=_sn@8c6
zz}g_zf`!naG%^RK<zSK;@Q=a)szYG-ZK*Q^8qMSc)+I0<{RLQ21y0Hd0|cN}Xz)p>
z8KE4drd&-o>8em(`2}n;g&*>*I%{}gcq(UToQ*-T!g|GxNV|?X_@+FStw|UK7?W%n
zVJ6@k6WhkAU;&`d06Xi@9*wN@on>^jK_1B-SY}2H8M)H?1=l}xstnCfv&zB>H><12
ze&U<*1VTm3PTc6K;M$C!E?Wrb`h$S1ntqlP!j>Cgh7p2nwTgm}6i^0l%%YwMrw=M|
zrG%y_VY7Ed{SG;>YM>pU`&y+Alg*?U1R#cuJ!9^VGLtPrhD^&Haf3ZIP)rQTVm#sw
zbxDpuAXuoHl~s8qoMJ{Sx(E<OzdTV^6t6snO|$_JNH5H84Pv%NxFm`()v|D*63Hrd
zNLq{;ad`p`FKvJHL}?m=%fzUSaC;i9jGlmS;+7}YqXJbsE`|uvN`$nBf}}08if-<T
zDkF6j@j+Z9d=M4qp|T>(WUP3GFU_e46En>V2+}J%mm?nth?^}^LKay8T0vz{<h-I?
za>N_K&<KtgP;wwhFR=;IC?P{Dw=$C{lyE@`=T6o#WD`vagTcFuo7!cibQf%7qf(fd
zGLut*Uu{fwRN<LGKqnpnmUg(8CQ=9i_4JliEj)7V?U~zNdFWb40@vQS|GFT0&5atS
zYgCjv!G(?K<Y+evprlYw6{5FhM3mV_RIkEdxY>wHor(|y3q_{V9B@NZkR_mB<7@!0
z5NUA#P?G>&VG(9RO0rTMb?^~^u!?ClXA3goN5gIj$d<}Pri}AL(xEB~dRD{NFsNGu
zk$j%~ObeR+Z1@TDI8iccj&;BY=E<1S6!!7Wp%-mZ1QgZRlQ=FR=Rv5=XW{UfJdJ=l
zt>|YdW#|OToI2t7uOG64p_+lP6uuI3Gc#GKJNyF}umoVchyxNS8M=}Dh*%sp1{{gF
zlggMhINMa=XK#);$ryr%1L`_<?HD$438<tFFS@KOU*JmJTJ+n5Ot<;c3xK6cZ>Anj
z222%}%tBQ<f{X(6kc>R>gS$P?g7Y4TLF8p+eFl()5_b%Q0K{oj#CA4hJ^e=-+$u^H
zUAIK4_zY-zNFawKP``w+T_FC1(^GPvngG)}l__4QCV(hZ7h^zgun_X#5BQ;qS(@b_
z5d?(%a3_i4Ms*!GG1hU%SqO}=hEo%HxE4<0m=Nzs<CcR|mjWn>O(2v+K!jQWgD%uF
za;Ss>%#E;QL7l1C9hP~dNOa(302RtmRY{c~i2x_(sO3$TdFS~T+>CP&M_BA(IP3PF
zD3)>~IE-=9dSDQgsP5??oz6ET0`du7M)U%Z;07MiY}_Ey>Ejy#@v;Euv6|<>BQzi|
zsf3mwFPsf*f#H}FAe{v6L1=`PA+C~8QV@rs&Wmw~85-2>9;nTLyavxBJ>6I<BvP2f
zMhnh7soX}J1yO&qfJ#FJap<vx2z1<Kjg&i_Ot`CvLO?}70;<s<ATk8^GNv0hl8@{$
zBRmZy1{+TGsSzp^)9^uIkAY;Q>M3KoT~cQ`{-KfxVBB@`;fj>49VF09Wx4@2s|=+Y
zRRP3;+^iXZB^`XrlT4!iN`omhF#^J$P@Y2!o8r@uk`$VxJEU-N#Z4?{;c7(es%UA2
z;0XjM?Q47}H#x=Hld!UMv%z2t34%KDHXuUfS8<65Ins~7%~UMF=YcX1-Pjn1_l@vM
zo7~$3$HL1czG~4*bn~Io00*R>c>bMflx8{YfQeE|mJh_XV<uU2yC&<h7sRDlmhK5V
zUa<c3sL(mbP@m?e6zC57Dp{kESkj=UyNVq=c%p>R9bI{*D>$SH?WN8;4{Tzgz~&>w
z6YqBMCK*t@vT<?%oE2bX9APk_+EiIN&djiF!$fUW=}sW#dIjSIC<Hsf`GkX2HEz+A
zi%|JdEQ~{&2Iz3o4VR4eOWy-@I_`GE9nSB!Qu&1t;<SN!vHpqjrg3P8@M{ad+AN}<
z_U$+hluQ??+2CLtk2KmIaaIDH0q>Rg_R%#ra5I@IHiY2dlg&D0f&`cWb_SiC%%6s}
zsAAoui&TW&06+ifj10iH6Xg5=PNU>cmIw)SOF4Z(rwb$Xa4%d+(1$2k6nb2sWamN7
z`O3*dp=tJ_%3r>ks}x0};2Mf`5w*-<FjkyYl=9{5X*r`u{fKRD7C3FHc=Kc>Ld_~R
z9B|?kBv!$3LAX&VNTH*ggol<J19U2dN`OFR74$I(Y{~|suJ?-llR!QYWtVV4y{`YN
zS1H+&pt#iO9$`Uz9Td{y2rI}2k}^hE1_&cLIOiqW43u`!ccI&hcE-iWmY{66+O)Xd
zE2o4v;V`uU%1A-$tp~1?L(jN7e)xt^<hD@wmVL)SFt*rH7R!s`i0uLF1r;C*?8pHp
zwX~{abIFEh5Rz2lg(|~BHhDdTkfkpZj{2gy|9O<nY+fN~n+&Bul}5U#BRGABgAIt~
z!SH&{gRv1VkPKv}Mv741@XkhY><aB0R`X}lobfT#1Ok@5CuZ}|`?yXiG(nl#V4=~&
zohtDpjKxS+G_WuZliKBtoB3QX1R;e?1qX6v?J>&-jnYb11P=BDAog%Z5>|wqrIMMX
zghT-qp#`k?^27mV*k?Smc<7#MA%i2Gq;V2KP35bQJV?cC^vfDpw40N>i#{g_s<2gP
zysK(8CCis8PjGCA-X;EFQm{G(Ah9*T^<6`%dTSV7F!T(HwlrIWe?$Bt0ukm9SwYH7
zIBJ$@u8DAQKwuSMJ&d2O+AyTR7-k5m*29PGd&CTP1j%TWP?&zAG0Mu46F!?~ObR+J
z94rTdFbr3YEhs;SSQEZIXmvhz5w)HZ@$w-{k($ZaP%$G2MoG>-PD7|_3QJ#9RI92g
zL&Knzjd$E9Cxl-Zg1mvoXQ;yLK~STs6(Ma;jZ>tW2;0<@qPorjl{pcEZ46ihgkM!N
zp2Ls>2mlZiTl9&IS}m4Iq|jorVOa@nqyR;kGn}ho0w;~#!a#wrN)pH!=int%9+2=C
zf3&D-DB9<_0m4C_2uDa6ikrBT00s$DE`Xh;1&*E2u>=glKtcaivtk;rYbah3gjq#P
z)q5`AD(T1dP<KV7xn(HPSF4lUcc}4bKh!y_tieWZC@!uy$&uk=Mo4YMknTN88~{pk
z<rG)Y=?c5228(k*P#2AsBKtgg_C6~*qo7$74K5rK@RJ~FK$bEL&No+IEn*tW=$4F>
z7gcwJtOx>yIe_&yaCMpXWl54S-8vFLyWG+|aM&EW)6`oI+;D`aIrfR)!p0cE0goGQ
zJnDp#Y)xa!RZBcusX7+6G9+T$3(#3*{L=GewvL6pVhiF9@`hlA;!&=ZKq(*$IV*up
zGZ~>AX@!3PV>7nDv{OCBg@B8Ltg?)e<L$yC**I-!3vlNdYdyS0-0ci8x=$7)=twDg
zNid_tnb3?d1@%r!1;Zh-TV;1qprV1O3?~stNPL?|6(8INzbEwsKQ>AW&W~YtAIf7H
zMj5|CqMJ0%gzUr6#Uck4_1qWEpYaSDW}D~E_~egMo`O@rhG1wTk4e}{1!@d5<cz5a
zL90_PK*2TPY>sLw1SkMB$NF@F<V>2iSuAdmXilG@Z#om1pmwpcI^tYb1)2g3H%Jd8
zQSG-)OvyProO)B=5zc{8*$_SwyIDe$`LS#cr-FI@R1V;ZWF3bB41Y@oEz-;@kIA1I
z@R$r(yXVSlCId<!uqFFkzzI)$S~ngMW6WdWap{<hJO%FtH=K*m#X+ug0@^SX!deNc
zEkJ-GK8;7&7}9fp49W8oOyQ$1On`&SEMBto0Vp`%0K5h?O=Kj~B%o;{a3}FkW4Mw;
zdD>oe4TOjRJhWy~7-9-e<5NAa&zz+5l9`|aVBCgBz$w`Ihpes7;GrUk;CKQ+1!-3S
zGM*kZr$`wF4Ov-!a<p1fw2Ew(93Gqz4=Av#S{K|9^(km_GHa-d5}KhS!C4)88{mv2
z&uLI4DxE1v*9g$4<W-v-0s7#WfOe=RR2|yh2vmCQSCuYW#^Qj(NR9ojXM`c1L4HbU
zjy=!7Vfy&s!2{El1a*ES5n3>fK1h-p&(lckcxi-=6AZ9gLT>O#5!Dr#=hJk<W7fd3
zoMIlL;WK{lvSNwm!$z88o>_tC3kRO@AQ7G|K}etE!O3T{_ZmE1V|}8k2B9xffpxdw
z5EM@=ICY9JK8yxP#AT)_Tk%}obV-il!&O(qb871Kkua@A6BoUL(=9$B#>C}TFMw%i
znZk22%`l84ae?ru1b<gr3=sNeKo&JI2ZRA&N%H|Ya6b<<!Yc@eb8!U3HwJUGREJ^<
zktlMHetmGWJxU^{CX4JDO^RY*lzMX}Ur+JN;(n4C7q73Zo%;M^4HgL<)bIz$^N@_=
zu?skEK-^}eI0}up#P~oR%^MlDhQ}mViehS%+GNi`=v~x#)08uPGFLr?-E+C=)JSC+
zb|{YhFAy`O@^QIaP{h!Nh!R0(8^vAFj73MWf}zOaV&YOlm?<b7@RRW<YZk_s9GTHg
zFv@1~i0p{L!B#2F;Ndr=VcdAkW|B`d8LZ06Bs(CvahzD>VH|nb17rqcz{)qvf@pwk
zk>Kf8;5-JrWArs$Btw}ToGFZ_O{@&&(@Qcza9#sl6da_l#x&716&>8*2t~yugar>%
ziKi-sn#9Klt`_uT%NXuwYDTz=Dj~s)28m=ikXYB?-48&C=Qc!SQfwNyJ2yeMlU5Cr
zCY_ol6<Q3Ae`3AF<0ppBYtZQMXD5cIhLxa6U&i3af=J;=`D!Ru2{oq_nNw=Z8FI^6
zqRLsSDyq@yl<Mk^&DjJ@iKc*zxu&6p+>51b4yXFDgYTTu1EhGs6dS_0o{}pl3%DFL
zc8ltsYQuoPbNNX=2pCQkI)+^V)q++Axm}(?6rpIJo~dA)4iAYJu}<T8SP1|g31GSe
zAA)-gW$UAuQKHWe(S(Fhsa8+nNde$gGw3WVmF$6hKLl(tT$KeWJ9<1CgP_H^dvI4~
ztWF1++4~Z9v2z82=T^Bq$O6-(3bQ}!Z=S>LCWWC_Q7D?S*j7gr#Z+t~K*^0IkzPU*
z3~HDJts&+Pn&C2r-mr<}hY^y+6L+jY(6LUP7$-XtIt#3jzDzcyny3UQA&vS>%%^Yg
zAJ&5j(RP)o<5CK5nxNdS{xC7PGSJlEovSmwtSZ!H4U?Tm9Jll%dge!9E$ab0Y_j6<
zUu@0E%{;JC6kk4-Ym}l4LJ;dhp*F?m7m#MgfyI@Nx5?a?a?bHmy#get!O#5@QQXRt
zb(}MpoXAK3)(+1e05xJ@(A+h9B)ZsOos%b&#kmPAiSwXJTYhXB+x2i|RA5CiAi4q4
z<romOeLfG9;hA^@A(doD%ZLQrLJv=fKp<scE2shnaM(E1Ry0cG6^>LBqSw;TVhL6P
zBU&BX!EqU>OfiiBhExY2DkuEKSe{3cn(SE0t92lUa2-90I|(O;hDJcuV5U<f%R0RD
zxB&*)L4pF#Of3CO0w6GP=m`@|gMcxHW_X?%1q|xsj{d>_kisA`m@!*4Mm5uq5W1PN
zoH+{~YT}wMnkd#uY|7e)o#2EyK^e_OhgK1mG>RlVfI}-v)5UU%W{7m9_$ugvBqv9m
zDIQGbxe}alv(B|qZskx^<Kc_~Gq9}T%?(Zt@CzkN2>Z=^+>eRawe!Pf+Xp%aGH5kQ
z031!PC6cgdjVpvJ_GReaoW@E51qn};>Ix~)h=-H%)MlD8SncElvXn<v(J)o=YFHAW
z%flYXR$xub>GP2ay!Lo*t_Twj({mb3SE0EwE8Un{R3z};5Oe0JK0>M!f#J761{VxL
z+2<W-#rY&<IWrEvBf)Ng!MehsDLD~pa>b`YM6g({z|)^ZdV!v68fG(Q72#HZ_>#=V
zD4^nQ87KhTA$aqK1jG(vNH!xi2`(!dqpIoC<*FixYl86r>N3R+XzgJ~N*vSJ?V@W?
zO%7Wv$T7<wpCl5Z<Ky$%ki7qZ=ZG^*(~)4U7u(g2OFx*-JqSD7&~?a4;4}~}qzX^h
zlJiXhh}E7SfT-gBQ$`<hg-0Hb$Xg{OC=G<j9uKxol|JQ-5(eqonUQ|wQn{|r!BPXH
z-yGyhGu{-Iu-ZwQj@se`6H|uIs#s;sCl52292t{}I`*+Z?0l3LGLhog513`u@QsM@
z6Ajd&MjV!P5D_2w6$KyMYVXxbPMH*Gqu>g5Wct%Gs(Nq<f#pqa3#d()&^(g>+p*3=
z7PRj};lMS6?eI{#wT41TS`^EYtS4r{u`zLJs5you!6F^*5IrhScL+!{6t_!Jkfgdt
zsEojBHb}*JDq}2EvSV0%;lYp)Skm~1x$9+J#pNvIr8thUA;z$ACF^<waS1h(hd9l{
zdJW04Jep?&u!!O?vm6>hpR$^u7da~nB$uXXEs))f*)8i%C>e_h9$=NV(U=^R+5SpA
zvt_3<vvo86w%~6o{<h(7JN_=i-wym;j=w9M0wgl<2c^7h9`mS`x0+C)TrI-qrK>z$
zP#I0Z%Q$$L!hfzDUi<0V7Bq%uM>K?$3Po|6q71E96f-$mtlLA8W_8@gQ>f2os!}kT
z$5Sj&a$zyU!$~OeWoM*JXQsi?sc>X`1Up&~B@-c9aF{5YznBj`6C;bMF)fTCCo^xt
zkae`9L>PvBnmqF%94tA)(A;T*h%?Kz%2Iu@BJh$Lb~HsrQkyWJ4<kiEH>5F`!HaRi
zIe3sp>~oVQa#YyW7=j|6!xdy($|T696;9bGfKp8!)KuQ$ItKqR^irDU(B6O(jso_G
zMlloibxk;KpjHF7h~$`<d9RaX*f7)^EXw)@A~?Ze3c{+8mCq;&ut!f8>7o!<G}cr<
z$}mCKcQ!GEV{9f3%CgPDaSSRB*w&EIl;I|<z{8Fsxm26waZ*Dj5Ph(U_?8|%(IHQ8
zz_5iD1_8-D8VZ)A@Dd?-eYHYH7I{-mGvw(HO|~ugHQ0=)VmgMT<fHVaHH|0`CP$jn
zbiX;jj<jcDH14n&<qycj&A^PMht(d~1VS=peacz)f^@$c(pa)&4p>Ggj{(K7DeI#b
z2SKWeVy$PUjW0MeL7ahwUWM%k^X!<Ja{4-XY=P4z9z?TWe&p~q`!m<=zkc8CHy_0V
zt=t2-;g!y<l6>ot{nz7l39=<}<B`LM4&Q#8$-#rG*W&qC?2g#<61QXJu|U}$;$&kF
zi*$q>GYaTW*&LRIa6w3+E6kIw>i#7!Kn1k#{K`#21)YQ{2JeYf4%(7oU>Zs7aM9Fj
zJfZ~0KlEd@Xo4U_oW5tyHzZ6mnrhSrfT}8O5uPQSf~3x+ilA}v>myd!N0({Pa~#mO
zXa|Bop`Acb&=n<AqgNx4sq*T3Wz1utmS(_khC$#Ag^aQylo6q_Xp-zLg$lt$19^*9
zg7t?>9rw0;Rx@4lMv@o1lL1-jxYGhBw61!x%4*Pe$BCn#X`-7-K#W8QK?1=V1?=)R
zI!UsT&}&aLS8WfoHfjV44)k3OYlkMHAe#ssMB18tEr!X~=jdcW@V@C|SFpw?GT=VO
z#M3b2_8F&8RwZMYiiRbgK0Ws?Z|5?-sdA?<nT5-oP?fg>i9p9jy?7+-p$h9xum^eR
z*Pv7b^UH)YK;-D_2I<=N0mDS#<v|6wV5^#KX@cb|Qo*FaIDkzk&!U4SN}zc;(cv7q
z^_I+${V&4{P4F5!8#!>@%|Yb0+i$yd|Do&r%zd{XJ=~avm!I5z%YLT<tl5Sw&|GF9
zq1g1kYmf3lckKlg_&7TwrZqgq9*QxO?V0+vIdwY9q?$<yy#a%-!2yf&g(n&FMN&I=
z&?sz5;8T+cMF(`sD3=QFsqru5OaMYTqM>6QnWiRIf^&+_JLd#Xj;e4D1x5Kl{n64C
zUsQp&tkC)t=(rNe$xx7p9BnbRO;J2cZfkLZO{$!{#wAy)@J*AdND({O%hXgOC}c&}
z3?+OG3ju0Sy2HXNAhI_ZD;~>Ib2V4O!6T}oehLHJ@if+?M6(r~_ol^(leSYVE&Gc$
zGQ#azY+PuIR#dVXzI*_$grIrBD9*iW2=pl_e(y|xgVh{(#4A2jPQ$l|3>$`KN|l=S
zxy&8gq|_Bsm-eV@Qh2i^S-Yr#RmXIftU89BD4GDGfSIE+QdD=mrJ6~Grv^u>;AVy4
zGmQb`Wg~b)B8+DStM)-{yI<^Fcgw!aH3zOcaAZHo{_vrFH%rRV!&oX`e&E{u61)D$
z;akFS;X-!Lu~1`#DCY3w@F!4*^OS7AiWgx0f9$;tj8<8C9{ABPGt3M#t{LMoo)Eh{
zCgZY=yQ}G%p7Jblil(Zk@KnS1RTa}Uv&2<UA9OKO4K+~RT{A*4ao7lXiBrm=EQ;6^
zYoQ25$U+gakcFaJ3uQ|Yico~IY!*exLJ^xq5gV}<ijcGKd(QKm_uPB#;a<j$BTHRU
zedoQ;dEe*!-gD1Ae^-}-s^C_{pOgV&Sra9X54R$?jQQ+`>U$+Me+?CVqt{V+f17Dc
zWcj>qywd)o<eMUHNJH{pR!w|x%)9ysk|jtkw=`Z_0`3Xu5SFOB@DE0W<8GT!cJi3_
zJw6?WmB;>(52PdRx-~~WavpELyLaF4$n>7Q-`+JQEA4Q(?`=xEcDMJ$^7Qa7*`^A$
zc6_mCyt8|BPrK!beMd&dWskc$OBB(NPJ+Bk$|@omy7R-(vQ$A@PaVvGpKP&}S7p7B
zu7=-B;7@;b(U!b*M~X<h?k8;pP}xlx>6(9e{OX?T*0JgD``YF6K^Do$i7O8BfY)-r
zsLLk%PPH&kyVE~Z@LhK4`v|vC$pnhN%8CbN9!cuU#CN+nwh&&s#6b6A$qECp^AAlO
z&B5bSi`|cb>gIFoP1lw{ZaJMym$^r|KlA{X(7o|FBbkT(lpE1KDs%ep>uLv?3(*N<
z>AmunE?MHE+p=&#-#+AoUs>EYdqfUKlxceTm*84^+H&iCr@d=pVtVhcNq0FhzB|an
z6O&F>V{hRrfRQPz@8r7XRXaE)mgx7izy0QJAHvAqU2ly^<@AVh9bNeFP3cO>sF>^L
zMfAoeyY6JZPFg4(P*eB#5gA;O2J)b50%ZJJGAh9xA`P3o-02*;bUtJUT#;ho`@Tii
zcl(%vxTpA<j3_NR(Ko1Clpu9zh={baV2YB#xa)QajiVlvDzo$w;CsjPk>EhT*h7*x
zEv=Jk;347-+}dP~xjc;Iq!SHZ=DO6cZ0Cw`ba;Hay=yqgld=zeY<g^DZ>5RP_bRd|
zS7Zf(EIXD`>K>I1T*cJMM9iYEO}i%c>~<20`R(yt+JBiI9Ud#-@*Y(7kq3dJ_3OFx
zU=kU3b6mT}_KfVEoR(K5pCVk3N?5Na=(}UP_NJ)n?nrd^PrQ|as`^HiY6`0AK$U6=
zs_NIOR1<91*QPZM)4Sej5ARQXcTA7G^VZ1lu<Z0JXUMJ{(~~2Uqa)*0e(m<ew9+O<
z>hW&QLoKqNyWdIUAm=qDLA*1%C&4;zR>nr)s^A2!3hbSccXqeGGp$_+w|=mkw#eVT
zT35wlctj47YUh2@3bKFqv{anLVp2{ztOV2AsH!QiqG=sdG_6j%_wAjC?+vY9uTPgz
ze=n3#)!mWkx_hClssyR361-7Gkb+8(qDnAOMUa9@kfKWPwJL&2Y`8s^;Bv2o`>34i
z_&!SfzUJz!R?@_aw^*e|m4)6c5{raMalMlh551Gh?6{LE;Hn@+dw72u_vlV>cT$-x
z^7nUASwVUIos{)SE0RWCRsz4f=j}byyT19&@g!~To+=Y6nAUYg(-0I*>z|@&rP56*
z`dpix*L@#JXT)unIr!dtauU1zlsY&X`}nz6z8)TNh|<H_^J^FEowxS9GcAWpsT`h@
zlVfcMjPD)Z<L~ruj_e&7$J4d5`<-2F7g@*V`b|#K#WM1erpLv29~}^huC-eeUFumH
zZn2FAHBrv&<VVwo<u${P5yTIB_0>+iIn&y2&|aCWd6si^(QQG;p@_)>4L_u#ufy<C
z%cwH}Y8lzqQD`XyJs(02!;MtDpLS(+K1#!L6L`WSQ;gA-W~bzx>uv6ynBMpH+hhCC
zB|_)K(CPhSap^@K!`?%X@riE_yLebI8e-`BX+EIOCiBtLKY0I;z5>ddu)O&f5};8J
zR_-k^N?p-IuUbFQS4HWYR%rQ`%^%9kpPu3&Q`F@iv|#dL<MuJ3S|5@#4K+t`DQ^Y(
zsR}=Z;%nT<?hze-()@dOe2?6p!#e1tm*{x86Md)K`^JzrzI)~#qkDJBtEEP?D=YOr
zjBX+>){|3>bPwK<qq>UzM{f6CxNw`^WYj{(I<Z+_m0RxRi94MS%9a3`o6#jiCuOEf
z)n(RQH$|TO{!t0kzval0{*o}g+jJPy7n{7N=#Z@&S&{c{@nl{gXEh^KRNhESUh(ur
zgzr)E`X<#}`oaFxG&S(+KMBc5rXDt{9vs`GmygI1890#D$!h3C_Zk&lN==G=wPI-p
zJJN7%QFQI@$LJcjQH1!rCIaOAlSA_ADVvl|=*{Zbedg(@DY7leqNf!$x-3@F$V2U<
zH9-R!o4CO^)szr8_KHi(EQB6(<t0ZO7oE=1_Dttc2jz8H->?Nf>1w3D=#1^~!?M2p
zbl0vIymw@Bde5F%ZLojG^cyk2CSS97eh2OzSNJ*|=w6oeUeVz|8Jv~jo5PE9JLE2x
zw@ClK7_MFPUVl^Kr|D8YiN2F%wYkbJDe5N)cCt^0jOwv{QzP*VMpRTIp9g`%*FiCG
z$~sa<SwoAjb-_CQ-2QQ1sA2&?9OdRyAK6Wz5#)uN%JML?SvuP?R=}pgy>TicS-)q`
zw2a?5A!N4G4t~XgaDEQT*ag1|ySNBlY+Vz`cuU%ShDx$SVycQJc)A=#))&D7MMXgs
zwKY5C0d_*paTH3I4}03v9}Wb`Kkx-(3Z(UNamQoNjp(`IB%zR@r10yiWg&rn(h^g{
ze&A8pueg(-=4C-4<+-E!P95+d3of%iTBYU4Se4vUNe)X0roqlVx%}LlwgY|y)~ib>
zvH?OfSK8v}!n0{$!8^Y2-f|<!lhURCgO=oy#6m|67mv$lKpb13Rlz77taJu{_-1Qy
zRyGUjIV1-U$ql6o1Hw(9`RGOk<vR(kAEF;|k(J=?<Zl_9)1#kE83m|ob!67tee^)>
zS*uXMNrke4_xF2zO`CEJigj?i%Mwhz`TgCF3%$8TRXRq_kN0~7=`9~!$`Gu~F9_gw
z2J#_SG*nOj@O!^2rv`{NDz1d?<!SW@K_*&~{kqe@o5|BnRt_JM7F340KA3e?-VHNK
zvoOAI|D;Y@X){7B9(5$f(Z^VCWNP<FTW1MeJTy4%p~}F&^n7p+xZ;&d*_@&y?^>DV
zN;(v7b%wtT6)W~)WfRP`d`IWx+zoeJitM45#gy7Zufk*vwthOoJ(|3tR6N=5sV2IM
z%x9S#iM}ZNyBsR<5iY&6!T-J>vOA`D6*`7Ty{%qrd_{3_HjcQvlIk8~?kbM13o~Rx
zlnx&mtz`%YfTiArnK9K9APS}eXu_fZkhl~nWq>Y}igG|NBWk8zVe5Y!{(&4m!LlvF
zV*H^TC8BQ#k^t%$qwG`G8(9k5-zu&bESkO=p&?cc>3C~@kL)t&E@QB`S3-rS5E_O6
z$bI3{fnEST9H@_(0>F!;A3zUh=5D@#xOA{VB3f~`(#uhxff3AI`W8m7+=QS^mbwvt
z%xQ$>-cml&!STN?D<x4nGvFu8b-qziMcm}-?EA7`LSEp|@MwW(WZheu<f)!eD04S4
z;xzdd<u9C)uNbl}Oux>c6D9t1ZZR)H@(6Vg1V&CmWNbpzbZ$;#MjE*Wv5%*|XcSqL
zLap?$E;18SCMH^oQ?D0f_lq1WmWd48eLc2D7Td_XpiYYFc()wfDofPmiZ8_~YsGUR
z=!Gtxnm*#+m~~3my<W;f+j&Q%@lY)XKuh+#Rq6#)nyw@4>dCa6G=s9HOgjm>d;Xv_
zvEf4dKdw`vLg+2)?Jw0pHdHE;+-YL35dq+P5N;<vG*6T@0XVBdwA@>d9JnsaPV_t+
z^tgE~r}qex9s!~IL;Rh0a(YST&-_D3dh7ny;Io}Yr@et<T#2|SL^<a2M$NPZa04Um
z#Y-PaZqO!-@^p6Z-7O0@bP!0@O_jz!m_0TtUjdP~V%falbd(bF(F)7d>9ia;;_o2I
zyRJOD<h4VWTzp>!61=FN<8hMge1^c)8Yd39IaFD@CDl%rJz!`=Z!`H$q9AT|QVtQD
zRz7*ZmSWXcakp<zHa5ttuDtWgff&b*$b6wL<~^n-#vGG-O=tGpESpwK?ZT<+*7Qg>
z%zpsH9r5hGq$7R5BkoEToF10Ld|Ent>sJmh>5-1_>%yUhBhps*r3dP*+i)aVy5VG6
z2dMOBU?afmmhO>}1z26FtP(@FBtv58R}M>(Whv16658?O$K`_n`l*)ze`JM>WNGKF
z^^xqQk=}wHFXZcy0lJRqh<q49ma80GIH{}FU6(?yv?C}>zh&3B{=m|S(tx@(ma<^p
z`}waUIKM-(99$3ml*Umet=+9HPa|D^=4QyH7bT+!?sdd<Z*lX>amX5mG<9zKt~}O#
zdnAIad(#Ex5)JvrM2L;gG8$<~%i=j%Yav_Lw2Y4)l`pr*r)D)+{r;*P=pfw=hb+z>
zl{sKpALt%#?xX}+B&~Ho&q0<lmLGj2xO0#7AXr%|DK)bYYg`_cb*@V9J*7Bg3#cAI
z>&q3e)IePgRs^*sK`SvU8APhAFVc8QD&5eJe+QA>z$fIx4>~TSYqI73@V+grLGE#+
z4Vm;zOV=pWGOF{uG6bp3zCKZ8og)<Wj+Xl~G|TQ@mFZ!bj{l+T!NgdUli7@`id(3n
zgIQ|tnsF&3EvFEK^O3etRoOzwiaXu@;M!tWU|gIhD_-;?V)881N1}fOsU`-h;^8Yf
zQ0#=R*EA;AD2cLE8QmqX?VDUtF90~!<~>>XB;5-?Vn+Utx;S4&EL)QH6J2>}&=oQ6
z>A4__kO;UE30JZS3Z8lcr6z`cRH2!0edq%!SP7;{(inc=_JSXj1z4uR2pZy8Ww%Qq
z{&L+tE;I4+{-`7^`a5Oqx=Nw?vi2FH!O4f9Fl;CRpOl5IAs3twLQLc5wZ-09nIb|B
z1|bBmsM?_lXbhrZ+;7V0*So`erYCl_-RE=sB*KKEI^E(AqGv`)ZI%Y9Fkq{69`>s-
z#b1x0M9#`PGLtF?X%{kTUgl2N9aR$jUS8#Bsw*N_wUyP^<RZr5Q>6)taxcoV&!Qq%
zo)#4KO<4hHCuQZC+*$hhXD91>zeGze+({4m(2-R|Qm86ud+E;8lQTw_e5H_D>&Hf1
zS4GBkw5Eer#J8mb)>3RlKIbWC5Qwy2H+qih>tDDUlh?v=^^%V^?$(`Htvw3|M?X?%
zLSrR8YaNgFv?9GNL*$MbvM0xd@yCD$A=jl4-a7a`1JE>zf_8tfqu3pXIo&<vk}n^e
zT9U(0_3MQ|T!u(tOG(JliqVouWzs(GvF}ZPsLPQ2jzj<Q=iwtCNv}hmfsv2SiNrzk
z8S{F0+U)R|;^Hf{cYJA&9Je#9ji<ElQ3<+{OF6+ywn)0_=WbJ9MjErOoaG^_0_F8X
zS3a|$@mU+^fuzhGvL>Go)UU?6%=c@!O1UJ*VCiXUAL$34boroo7h^gZ$J7-p(-5UV
z>$%p-lR9f5iI*V(oX{m6vR(3ES3VBvE3H33S_Yk@(n>$T4KKShi<RR8Io)3>wo-Ku
zN#mrL0+Q_LP7^KZPRoH|KivJ6j$MDSTdogw{UDC>l#BSL4p@=Ib%;T;DC2Yz)1zG(
z-O$<~&szOFt2=5^nuoGCqZ8xWF~W383=?zd6H?dZ*LFlhP%r>$CEF0CxLj}CO_cj}
zFS^o5z8E$#J^qdi{<o@pwBKIsA+x_OJ|+5iHn<|bOrge5yY!fBlUD?JA;5f@EUnPt
zE(3H?LlMCku)HI1UQVj1D_1RKkZKrqDLbg$YFtINo8pRt7rr%h1nP%|G+eutuTlwT
z7cfty-JB{=szgc6y)zv5X412kHLNn(>0Wr`okN!6`$)Qj)%46G-C^mPQy;e9q~>SX
z_)@6Z7AeXjSMD(VD55*hLHXXF)AR7;*7J9K>x13$ntaq9q@~-*y&!|w)YY}xe$n>(
zdN_m*Nb4sGWme+^c9gqI*C}(p?z=zwe9(~{e<9C14)fq6B=Ydp=ei!P?Z|nToE)Ct
zKR+Sx2s&f?=XcG{zW;3*{`_G6os&mLbl=9Leos`tIUrwMO|d=tBzR};D4BM@-)-vx
zaD6Dqw@}~MamcqeMHRG*Ots4)DKKP`^xHy)I4|wU!B0)tmD9|14_9rdbwiN66zCi7
z=)2Qyxyk6Ry?aN-@CiOlsOJ^@)Oy~3e7~#t)$H6akqv%ga-UxoQ5m_B@$r3r6-K2u
z*F$UK=RR_kib>WdgUqprBd;!!g}`Ndx6Xvggs8kM%Y#eW8|lD1S4OYo&^#F;k-DZw
zX`gWO(<ijcFFX4`^4)69T2J9Oiff*`ue`ZRC)F*G&(66h$U$5uH57S8mfe*)?>al@
zLech4PRj`e>TSi>7g?EC)}?F1uHNpDH2+ee{W~e#Z%)V}A}Lia5TBkLADNcCGY^^7
zo8C1xwr{uWQ5&8f`SzsjN!dLj%Y+MBGLSE;DyHAs|F-O1tM-!(FZ=e(2DXy#{=F0X
z+wFbh%D!js<jDB+$jJ1*c9DMc-F?%qJ4h?8ONt~*Pu6k$idKxW<13ksr0YANPqijj
zlaPsS<dw!&J?kQ?I{H7ZPoI%@+LPZ2k=6{?IJ-N~%Zw>&n5;RMiloyO1N|+jFZ%E5
z+qAp@xoV=Lg0H*!ppQH$=_5zq`vAvQx({Hx#~}L8dSa2BOwVWI@#8Xfq~8n-t&g-q
zA9i=RnXkA9EL-oj5B6dA4LQxnI>u(FNzkaV#>u%oZu=wJMyAj`mi4K9_(NIX?>5s)
z>R43Ly5Js*sH{%=UICt{(#Fa=iLBao{?=)5u?Q~%%Hs}sii6M_{0Hw#cL+}#d7Q|L
zlv||X$kY$78<Cf*Ejk1y&v6}GkON=D%Jn+jWReW6aVwf6OmfD3S6jYv<n;WYQVDgT
zy(lChbR)JO_P-utRuSt`)HHoB)GE`uT#`jCEWE?+Jw<8MN6KCM7;OFHZ1>r#jbf#@
zc1FTt5!Ll`jjqco=i+Mh_xYldw2A6S>&UY5kI^U^`d){C^h*^e|Mz4b+SSe1ouyn-
zNlsbvwQ#8`BU*mPq<mJ{-8M_Qg6QO|KEvgnk%zy3TlXu6<fIH4sMo%OSH`uZz}ad9
zl`;uOMzQ2x)ZZQM_YL<u5K^R%PsWMqLWhZ5uAH@7r8QTl0LtA8wS#}?(&1XG@G%V8
z0Fog;d6(0NhaZOkTqx5*kk}50Y%X}|VQGFFDTaPZO70OQ>5wDIoSi?JBwn7TGXaLm
zZK8>hEcJzXLJnUI2U+Pe{;gf|xthJQXatWJ*>2=|4kP;}WhtoaSRk-}w~EvK&KDQ2
z#~1S6D17koOMLWV@3d~&l=j&*%Msi7lv_~lec#?cRtReHg`WF#k+(+qTOco(J3pD`
zme5V37`%in&(V-JzcjP}Nd#hziOCUJCE~VpA%pyCnutU!(0K~H0*&q)duw`lT%N2<
z`dho+nbvKq1wfyW1yJ)ktV)rsl^DX7cMQ3Zc0xbnB|TFuT<nK&H*2AMy{9`{fJ?q;
z>J0S-TVGH05KjkaV<JnyIHjQWI)xM7SmixpN!OOi$)P$jtNsRka4djggm)+((`ei_
zdU=Y2QCK#V%RS@Ua``fo9Q*3m?2PNaU*Czb#r-iTYnY`p{Kk|RFKiJgd+3Vv;r;Kt
z^POs2UEW^pGchUsF?o@!4AQL?uJ(FY*Mj$F{N!!4+DF%+?;76Kj`lUgDJkshh&?oR
zt^(;z8GA@(h1J|Ku9=nfC@kNPtz0%$n&}I6HQ_E@q+e-ciLLZ5EWM9o!5by6L2jB<
zYp7N&?a#}5y)N~X@h{h*;Jmwf+vJD4%{0s8aEQGV+CQFlpIDe^`@!21EVr$@3rYkU
ztnPXB4ZYKlOR3ztSzbLW`%4-VH=K-Z)PAocFT{!+4w>;gDdS-Jfoj<o87(wb1~=9q
z=d5cm*gfe6rg*pM*uO*ss}6L?3QuMCLakPEHlnURP%j!OtmOJsmIflIiW~+>_=Z5>
zs7wvc`*?_WP!^NPNokJAllX2l;)!{5AL(dJOt;#F;TX5{Kw2Mp%(}x5rH|bjX}2c!
zywlcG0MJIX<Pd<}dt?)H{IZFy_Mp<kBtwImc*%$+4&>43bY)f+X3T#d1@WtnoxES*
zv|hF6xOiyV3ckKhgm%wY4)hO#g^qW4A1MOu0PDD_PFK6Res}7RR@raw8=Ktq%@KWD
z(j0huj~r7F;}hTZb(ng4_sPCM&8NtAa{u^S`w9r}tq+gS%LtL|WRUKOe<9Ecaa2Fb
zcl<r6LcVAVkQ*3sMJjs@<edm*?WfJO{_5PD%Ojly(;n9``JB4moibOTg}{j-g&p9g
zezd;2-T3COW9s;5kQ-5QDt?|wP30NqsbsVlW3@`@Cf}?wD<qXt_jhtgQ3jhNR&GpJ
z28~SCNC)-O?21m}$$+@b_K7K`l94Di(_GVC!!F@E0W3kvSES`!RkxD(4LQeB*Sg3V
zH}YsbB&YQ0K(#+T-LLVHwnjENe;-F=xTEAT2QS-2#71|3>u2(0&i?~ho8`Wc;{x-w
zSm*gQFJ+7P^!H~^%*yH=H@2%O*Y)*+`p>18(MVTrglhGoM`TgCJiio_^sIGHk6+X;
z_nofbFUC>s2+2LFl%kq?M&a|;&Dd6XN7jCiKq))}6HQ(5RH;pm)IwG{R9nEK(!#CI
zDdnQy&Y+7Xbi+b1|9q7Fn0=+08~3WTaoZazZRnH65KpE`EAvb3{6>jNv*49lxwqg-
zBl@H^k|EW(4v*AA7ah1J#w`x53@%YgSu{q`HjPS}R43(e8#OAe=@Z%LOJG{fA~e#~
zb#$q2ghskDyQj;FQuU%oWZ`es)S!Sz`r2lu+7TM*a<@e>S0Xgh4Vy2D$}t>iBd6SK
zirbx0w5sxstdVy)>niWaTFGSyNLSO9Ds0IovQf%vo03mtgCcY5z>3cSSH>QX^nHmX
z>M<N?Yl%sWbm4q4?}{FgMYNE<Xi@ZtEJ|zbi&m*;WLa2HU$iTGMOK>sVO?+0s_Ye6
zX$fSk%3hIGan*4#u*5I2L#gU3PtmC85n1>GObrS+^fT*~(Tm9VMq%kXUN<|Y3wMk0
zD|?l!^j)XgDDo-WNX}<$%qOx5YlMq2i{VH+ES?Q3f{SLA{*isO@-@Sd(TF%g7&0Ps
zq?DnFU(Sxbho~=Du%&-wAH}R9<O<)&R{M3fWVe`SiC@XCxUe_1P5evtRZD<VmW)=!
zC9{;WWVmP<u(F<8u2`W<Jkk$K6^rUI9BKQPny_TCXp?$ImRx;ks}zgImHv^vhUo$*
z<v{^2>65d<B=#y<m6t^p<Ei0QXha-%d2vG=ZXT;hP~{z2+e=Q4Afpj+U`9&ESSlh=
z;TzfVWhG-=<sDf|3tm{eS4?_^Z)D4{j7-Q?-jTIF<kiy8loZ2F{7QDoa;?<7N+n`>
z@!GB;U9E1!D=+z)C{2J{2v%gO@GaU(ql$H1iDAL3XyqEyoL$Kimhr+VH>qXeRe4od
zS*?!l*4VbFP{EK68pP(2Z<JbX{r$*A6e<RdB9F*Ii=xt^=uv6G6<wA&9J9d~AXa>d
ze`K${jZ&VfSqzu7{T*IPk?NaA$pW`^g-PU7vWb_I6;q@^m3&LKg|%p@aoM|ME%hFY
z)>6}gU&)S3+fu8@C$iBgT-SHRs;Z)0g>PibW?r=_8sRGM$l5BqEr%$Ep3#UnY@SvZ
z1r@CmzsOEsEYj(|qJ35;;>pe&7O7sOR$!~1YAlmwwIZ&<)MSyM>=jw*4Ia&37VT2c
z$TCcG7HwiU(zZ!YH|1HhNj)nqF<qLoHSfq;lOW6H+|)(Uu;dfjWaeUv=6R)vNy9)Z
z$a$e6OSM9YA)ce-EN@Da(JFCeru9;~ykd#5G?AAwr3xj6cm^*uFZo8cXvJmTuwrtr
zNK~g9v1*ZMTdxxiMUs+FWK%V3ShUS(L>v`!h((HOg@{4p7f&}9%`1E(+hlsRXk6tT
zSt~a_)Q-85imXc&A_jX?mR^8cKA}rNi;>9cL_F2=izTAGQpA*-#Vp3@1zHhTb$~YO
zS>$Y>9dYv&Lf%9CLXa?9T4a5pUc`s@8Pb)quEIC6O~P>Vur=|ZPRt|qse0D7#PuS*
zh)?ThH1Ap@Nj<ZcZhH1b)>McXWcQVu$t{{iXsnA3lAP%+*`&UattP|Gk`|33SbKf$
z^K{zNmiFBp6d~AvtPY2dUmm4%tbAzdRJSZl->b(6K>qM`tZ5TmWWS_M<sA{eqkw-c
z*zTCdnSoCKO+S~e#&1N%Z$!p#Oq;RDk<WlwXi^wemEH8P9-^<guy~?ss@72JZkE+E
z6RQ!U+z684g~`zZF%Esed26NE__NfiKu&i?Az=!VvpE)ud2nbkwc_+->cdIM)W;?o
zQ@=2qn0j%}F!kY_VG{LZ-Y>OH=k!t?&fG;l+LuprOeYFbv^eP&k@zxB4fLK$(P+Xf
z;)rL)A{g;2&TU!#Afh>MwT|bhiiXub#d#{T@QK8Hl);+DXyVB{iql9@lG2%?$g?~h
z6nSZ43KKgPR(WD4vPvdzBERAsP2}Oz$~hVzPG+_xvMNuhl)SXF$mtP_x*BQpQ=fPq
zB%%tvo5C!H5k|8C8I8aY<`T@h;8)RHMC=vT+SC>28jM-}lKFxtUFx5i35c}9sDByb
z=zfI9!}t*_0mUZ|6kAsgjTcAiqf`_|;)^(KOAm?6pm`J{j)xQme~sH7KgCgT)2JBL
zj_CPPlcAT&o(x+XHM?pVW4-;=%SN8fRQ;-kj-#m64hKiN6$8FSU#Yv%z^%nY3`+yI
zu#1OC!yu!#i@hxWqmqpkqT$sjMp~hx!BUHl=1Yx7JXmUm+Jcng$-z(?+>B!2UQhit
zp(y4wDGgGV?8>8%CGWyWW63WXPmFvjMhqig-U5XY!zkrpSzK{Q&@_@ky@*_&9Myw*
zX8)p*xQI$_7Wd^o-WJ#|P|Du&Kw3ngg<l#-vq;2)Vv$Wc?p5h&16z@|hR2R?v8l_C
zOqI+lMy4#v%AXlhD$(Reib{&<Ku}4cG}IIMvZ>1s^%Nr>kKdS2W(+0@rh14aQqWu}
z53yJPRih*&<8%-tQm}_~c@V_Hs2&_B)zcS@N<_g`Qx!)gEMVRla;H>`GngJ8J5(#h
zEMei>e-tlmVDoSP7Lpc5>8(EJ$@lUol;{mSM$>of$X7!QE0MYCSeMqj1O4PAE58vf
zeC$tda9NLR-#GFggVcta#<E{PzsKny|M|}&2j}G+Gd&iHE0$Z||B>sY${B|GLQq_-
z+&ZQo^*+AfHgD*<YJZ-H68ff7PG7SN9DV71^lZ?e<`1sKM}A;~D;R0w+2W|3UYDw~
z!hUbCV~)lc+_juAFI&Rp$hP8o?T_4%ZmqeGT1Q*old%XrB3*V|=*lbkm2Dd*<nuyu
zT&nDxkVV4c=)0G9Tu)Y;UEO^yu6wB!7q74)`4?6Z-0P{h?qyLJ+!5A##*&;SAsHxJ
z78aM>hZH3?^YQ^t`N}N6#V7}|$f-JV@}qwCN?+{td_aG?oIDfd414K3O0+fg`h<{^
zR<w=aaY8y#=JtHZkrUdTl2h>1TlSl(hHFhebfT1=9OK~6w(%#dxWgJGN7RQ;QXJrb
zSye}_+eO{haTzjouD8QR$Wi~nHMyfShg8>P1^2s-wI}ubGxuSr@x$M92kC?z{g_;p
zbKGQuF*i@knzJxMi|=jf?J7@D9kcBolC1-pdoB_#Uvy8bZnKjUi`_0f$zgv|zP$Iz
zXS$`({03JQ{O2{LUb*ZH;mGlFlC9WLA;$$B>wa{!E4!ZGm#;`mVadrZGIS-kg5;Fn
znCFu!XJ0rTTuFYr&yOv%b{*@UIDWL-+xO-hZw~Buy}ws?J9K-GAL~8w#@E08^}!w8
zU+R@_s~vl<7gfCX_5N4;UwyN;Z*FmM;p8`7drhLC46nX-{J4Cc&$o%M%A4nFi}KY&
z$@-(mUYno)@cmzvx}}-g+dq5g^@B&chx*^_@4orw>%VsJ*9PDC`oTkQ4!-&3?2&<k
z-6K2Rkf^-=<}cyXX(wM}yYbrlC*OZfDwqDtGx^oo)@yUe-#`4?4?d9ibw8MW&3_a3
zSEVUA2w4x+JGLkrUgf|hiHpxny<wyF5+VoemAt57n^B@|hSD0^$HJ9f2L<DuWtE%!
zKHhJb?zQ}QzoDMIBgadBBq!_01|s>;%J+4z?#YAlz2^Dja_fbU(rZ0aJymJRJ|Srx
zf}fmEBZF5T=;74bK<k$U9iOA~W=ii&{S72fhXwf@_Q8cYSK&iXg#w=D?ui<9H%b-P
z0^7fP#2?lo*Sh0UzKrWnPmTM^&ZyX8#XH9SB6geUVR45(YRPsc$(F-i+59F~ZY#Xq
zuwx^;Ca~en-N2pw@`WMYel7|9rtA&$d*8(Co3gW0PCY4E7BrEwAq#y_a+<1~lIlOU
ztD^3sbe%`{m^vw6(~*PFWY6;STheB>4(U&sNGbf0_m03b`iBHmqd-c=(t+4DKECTa
z(-V8XJK}exPBVZ|2M91~*vu(Wl~bVHaYp``s#{p_#Tk9fm7BdJkFfoEd<5ByxVau8
z!?ZKVLd<zQvJaWhRYp!?<-YVO9V28U4DsfI2m=gh)YA+YCM_l7=j8xJ!lvurn285<
zd5+1mMz+u+PB<J$3s<{!dI+=3nCqqg_9?!69n|gGrJ$0(^?e=NOT47(qeEF5w7300
z4=O}gfmsxkbT8tG<L^nt<(suSZKdbmxlgmVPPkSeGzS#)m_9wI-c?jNtX9v<lm3i+
z1y&Dkb@tJ<Xv<?>&(YNrcSFJ9tw^I$2_gZmpCr#^3BrHJTR#`Cr+P~-)aBru%R+Z9
zvj6b;N%>Z;d>C2-b9K;vrZ)LFyKC?K=U|nx9IvSO^7)VQ^>r{$VS~kqj=sAUw%KY!
z6h1R7-Qz;X4UsGu0Q*QjelD|XZu}hg+Pm)Hi#=}_&mS-}-T^NtcQ;S#L4vO5G%ch$
z9*--l^8W7eCrcmy;j|w6>&jmbO7W8Rl0LvUY2&6oWUC!%(mFYN%w72nzM^db;hwXH
z-Usf%q>nwRuQ~#iMove$gh4VxKTYmyqn_qymC)5BeMd+V=EIB4vzueNXO?fB@){%M
zjD52HZV<MEKa@v_=8C?NsVnz_oC+#!w0mOfgZkj&arv;9JND6w^4ON0$?|R^)!5lg
zt0aKqLB_h9q4kk`_)E@ojss$%(uRnwr~6Xa3vN1`s3DEEPX?o}xm7(LfqV=>hPH*x
zuS>aVRga-WyY1axb2;1U@PFHV_i>$#QsY`9SDr4LUpVp-tu+ufJaCvrZkXqX?{mJr
zLcxzq_*WH~g?aywJnUuQvdD`1nrE$0C^D4p79AQbL@V`wk-b~-o2IQu5|oNeh-!4}
zCXuOBDYEeKmd}zZjWS26(~v}j^*Rov%z>vug{}D%ZKCHyVpa4j+9eN>#JWnO$ic?J
zp416Rs)GAozatjfY_>nrG{M_-BBbFz;?MNaL5bGv2XexnlMa2P-H)z}N_?aT703va
zdP(ma)@rDy^6ENRJ5ob$7#y=0)~ecIX2tEKsVOK_+!;lMVx@JJx<F9$50$z|Qdwh*
zDpmEdtWi-P3vuB{cpA%My(#im)rz7<TI8(pGPWq^xXG8F#Gn<8!M?k1{9AI2==lEK
za-PtLeAiUYOMGk3WGlvpN5*!2XJk0R+tLdu>yGW&`>hJq-TTJ&jZaUE?s>aN?QtQQ
zD1?ZZ6fnf1fJqDr*FN+DB;UoHln=DJ^z7A-*-AtZ*xr5q(tGZ1@0Wv8-rBc+?{I<O
z?Xg`hOJF3QEbUBtOkOXg03EYKckkM}dqkq}O>dvYsu<h*_Q`RsmOsvTY=qh6E}f3$
zm0@x;=tvspcXmyDtAI*z4ey$i&!m(+BqNmDE5EgWLVBRSDny8!5xbX3le0mGM<#Z=
zZ`TWH$Ti8B@sW}5>epRcg3I@brI)&UY?qwwESIBuzB$?+-=m`DwVpA$cS1jED!{~d
zCf=3|?npe|)ssixetXYu{l2{Buf%$M*B%$RyV^HCtY1_2UbvVZnQD)TiPSE4N}8PW
zHVJAuu7)v`WJwKZ?^mVax5ubdxJRUAoR#BQ?F9_&nzRhAbI3=D>t(sN?7buMjX>$z
zxxTl5|HXaC+g$pT$B)g2mljbqYketl<L1&emR@5;$oi^a2LQP>586R>VOPI!Ab5?r
z1r*)}{aJw=mvZk_i!vu6@0Dq9eOix#dtXmoaqbTGo?GrH9ciTHG*DRu^Z~lS0Z?zr
z6gd8vTu$>yQBF>e?UAvV(GmIfuX`&!DUosuHkr+?2io<&?%bEOiyn1%!^0;!0SSk?
zYMUn+VPoplE%)%OoMqS`8GtB0Jz7es^T#E)5|uBD$kBCj3gcoJ{wbQ_SyXN8CJ^&p
z733AqFxaO)Igbk3<hjS9D%=t7B?zo#i|LP!%9MtG6ACJ&M`gf^FX_=^5gN(E5P13s
zgooTloS!koy@T`air$^0doE)njfUQeMH_%66CDkaFW2f<a2R=+C!-vX4!HA3-wSGo
zmt<rICIvMl(pPQ&ep4JF(}+m7?T~yXNV|ISaxI6#%XbxYNLr`RWD1gllYCujX~DEk
zxLYnRQk^|?Z+Xl$eJgfr)SRlGoaRn{^CQk~CU^RXhKm?UR=P`>G;2wgNmtSL8zF0F
zvNbF3)kmd~iRVM*Sa#pzR6+We+VPaW%d~uH`gQj!L%;qT2Z-{?zs$2<(HMpwyZ?)w
z2CE*J)V^Yvi1>IiY`2_;{_)|PVchY@JA6|fnxVf{d<@Fh&!hoz-5QLDemo<^$!9mo
z@|R#n3eSj8!fB7Aet<Te8?8FpkdH-qe8}^MpJDLh47yxJ5#KY1^~-fx{VYVW<BA~N
z(21@!aAAa`y4oAA3Q-D!EyW30_rwfyhM1OZG^Z!QgvWavD>v!upS$cgSlGTSQe5uB
z6fDk?8A<7uO#)8~JlG~35%J-uKgGqr)X#96s{L>A^sc|N3eWN%_cklf3~M8uOc#H=
zASTTd&8UwL;6{s~Zyjhsf2@bS8u8fTzla4Vq1OM`UsV!~&i>bVfLSwDcpkmP11(}G
zK5Zh8;^QXrz?KC?_}qzn^#POdl9m7dBPr>6nutKZf9AeAl3{VfU(xGUMI3aUAfMz>
zue7-2=><!WEH?VV<@~xJ+zSlKr(1cwm8WUC7zkt*wkur!vd?$@Y8^M0hc1O%oe{mn
zyAgy!1ZCBU4Ji1CMu6)D{Uu&~8p^%V6I}DNa#5)}13fG~mC+5iN|mct6D!uikkK5J
z!H|`%$fBRGkcCHiXq-O&CPrm%<l}E*$mia|$7A9*@Q+`)*>z18IR4nL+{Gq0eOB>C
z{<Agr@k9{^+C!^RyGHQOW3@3Sl-%4Arjcx&VQIPKOD;QPikMf~g`rgNW6I@*Fe%g*
zu3E*4v%}N!{9}t;7<ShkCmfyk!~YDP>b!Q-?D}-5UO;7=(CoV<e}OBhqy^9k4qbmJ
z5ss%ZI297o5l-7d*MW9ajOIV0o=34$7|60+LVbq1UPyHZg#^syC?vHk-f*Cxjr8<%
z9q@}ge27?K6g&!~L6@=IZDl@b{-9RMq_ceX?9Xp~XB5G>OKr<DtKRUr3{va3YzmV-
ztM1bwggL)kSRJXex<7O)jAj3~?0<8Y(OXK*QgRdsC+7SIUfe^-&+%~?x-18tKRT;x
znU5ax-?9@WXLWQ|K07SaS8krk??KdlD%NF7HP%nVpvjOPH?Q*xfiW@|I#I57Ha-2p
zpv*z(Rtx!+odquc(o7UjY#@xEq&kn~)))K9Kkcy*@=M8OCdD<9vP4+c3CsK#y4G&3
zv@LdREwK##+y*Set-uIz4*+K9imU32pxEk2BUdu`sl2Kg{PJxVo<(R2c<tAQN9ipa
zhDhS3{DFKuRd-fknsItszLP1-adjcSXkcymv|HTn04W|RKUt0`zq9h6Zjq2@(TStd
zBpg2``!ig#v!K0e&#9xK#}0qga!cbus~DoGvBQfp5KUMS3Hi-5OWpL-+-|0_oZv{S
zv|cr?Uu7*uC>vO!5Hgl`Vs2rv>`Jta6M;XNvo7QVNN4K<i?)*-?3LBt<-CXjae46~
zh3eZow=N*WAOsODX%C*RKO8N|VOH5P%dXqx?4Fx)U-&lI5B4kZwCzTUHmOU~rC%Hl
zQ|0A_KDx`4M{AUqAL({6tPetDnEzZ=<l_*%v%7o4)oXh(*UzzQ#_Km`!t*lps#v-F
z7AmYl=<26obziRb5Oi~jYY8NkuBY<S8y_^9y6@Oc_8;>bfRFyA9_~MS%zY{DsC-<@
zEo%7-9x|xfW8?M+W;fcT&$6nmH{q$MGyeJ<tlNt-dr%tEd2M`c`-DID!0mf;jb8I@
z6r~r3X1gjh48KB5)-32omSmfS?MZP@VQ$2%e-Uc3<1%?&DZhwR4oiGIN%HX|N%DYm
zPoVHvEUk{SN}Mj$OczM%9wzC#7dH-+8!hR&NS9mGiu*{a)%+$G7sZ;LE{T17x>8}s
z%8N8>qMqD#^~tC*sSTxE3bmQV{vP`kEM@&Dn)LtWJO$ScK6<$8cLh_=FVNEl>IHi_
zgEG=0Bm!{(t!r)dM+(+9ihl3tkt0VnRKILh;vv1C54D?D-9avGzDUX_RGPxJhD0qc
z^cQPZl}mANLqeWpa`Z|XZ(sO$TSHi&A8q!i+Jx}&wuZ2+;r)|`XHV+dao#!a%h!V|
z)~(~{1?e&$)|(cGJ-9B$A{MB}{i0U9q`m2yd)~CA?xt_KbDr@+?Bv$reVH>(?#8@g
zscm%m*3yN<a$?PY!C$NN*MsYIt@c)ky#_%FPCZM9EPa8c6U-r$S^9ww!Iij-L2MfY
zDLC~k9kNUXmfE<?Ky@LQv`;}iZ4jj3l;bi3A7kl|<t)6`wQA$C4Ao1)q<t0QHG?1p
zryQ4*r9+k*fu%Mst5CfYOxhG51Zegt#Et8`u&y-=Bsk^h-AzooK^H>V<Q{N_w!Za+
z)=HgG52Dl?qSmI^AE4P`h*JjD5pPROY7@{06Nc6(0W&Z<9irAg3-O#mmmyv=s4f91
zafigqfu%#@>ju3%@i>Vu29|LWUp1(Xm{~wJX)xAceJ8NA>sVHydJC?U!n)dOME)lh
z&NGP54ch#Q54;zyM6fP4BqW=d48nS-IZHoO2jDhJ6ZvN>oH>Z|2AzSpY*1aANJutG
z(-l}>YtC{Bs+Zw5N)!3-SUC3}-Z$te#MXMBlm_KQLb8d;7FhQ-XX%0JX1I;gME)TQ
zXB6U?L0yOo2Gx}l3CSjDIt%ON<}9b7dIoNzG?D+Bg>wVqO@r=2d|*&rno{BpiB|(l
zhr|yJsv~Ah$tIcg4A!j;jjPcUm^_8sD6`1lYvJ@k+-}e?#I`|oX-bJZB<>F^9THC(
zR7cF1l1(ye4%Q2SrM7LHfod0Sqs$`zvW0U2;zfh5LtHheE=?(Mhs2ixONYd_45}k$
zOvxshbr04L0!wXX-GS;|xQ#N4{H;&;NJ`KfA#O5g8^nHt>e7@FcSzh5SUMygFsP20
zF(sSCcof#{z*3u8Lr@)t+bFZhzhL1kK|E#9d5D(`s!LN!+#&Jlz|tY{WrOO78B?-J
zX5E1GYGA3&tZPuc4!2Qek^g~(^9bT&gEoB9C!q(fM6fPRDRGCyPXcj=#G3<g?W+!B
zN;Zj0AFTTWOKtRep}Gxjqs$_I+rpWGc)*}Vh^Gyz%dC{RL*kjh(joB~gX)MGQ?f~B
zU4Zqaz*3u8%TPTJw^3%1f7QZSgLvDZhY+6_RF|fdxI^MQfu%#@rv}v#Gp1yd%-Z-V
zZ`1>~LB(%DbpzZ+nMMA73uh4GPJ<>P&KOjerj)ot;-SFOA#vBBI%39@Y?3oeus$7F
zYHQX4R2Shk$}I9<vT&|IylT)bh<6OCOH)eRA@Q}q(joC(gX)MGQ?f~BJ%aU<z*3u8
z51{%GZlla1f6qoANeOxj#H|JmKpZltE=?(Mhs3>sr9<LjgX)MGQ?f~nr(iu3SZXt?
z4b@4wjWUb;r!Abb5YHKO8R9jA>e7@FcSyV(SUM!WZcrUDV@fv3tTkBQ2`sglwF=c+
za2sV7`JY%g&mcZGX!ECi5_;iE1nbh25_d@43M?HGZ!@Tlm@y@r#AOiHLxH6>di_ux
zfZHgu$UkG@%t4$t=nTYVgX+>mLb6GkuE6?QbCyd`y$rWen#h00!np_WzClkRwm##N
z(xd{wgluB61=hXIS$d$l8E&IA4MBO-!Z{0Z*`T^YISth_a2o}E4azqxoM#YQpKY9X
zPhj#CZlj>d-)rIYLELW8FvPY&bs0fIvPntK!Fr)N%M4Vza2utG{L2>31&9|7x(;#G
zpt>}XkZh8sd$4}coaGKw@4{`ACi1s7h5E1&;wFQ(LF_lEE=?pPo1|$J*6rpjLr@)t
z+bB)sU$AhNAf7VlJj6=|)uoAqWRo=Afc0u~mTOSG4!2R7$p65?c?9vXK^s2jlh6ZK
zB3PFu5|T|!`e5DPoTV44+u$}z6ZzW~&J@H01}#E7ZBSjBNJutG(*;;xYR<9@)$?#0
zrHTBj7S0;P+Xg*^_{5;PG?9>OlBSKHM`^=tP}(i1Zh+e;O+8TVw{Qj_?lfo;;*3Fc
zX(A!nBmqmXKHZ#U0ji5|8>NZ-mn@ts5U(0^3*sGv>e56)vPqgA!TL#amIqLM2)9w1
z$lvo5K9Umj7KmF78h|)tP+gixNH!s!g7r*umNrx;;WkPW`A=IoXCa<5=rY7>2GymB
zgk+O6t-<<EbCy-8-h$gGP2_)K;XH%*+@Q@pJ_)^WC4zNnA|cttWDwRv%~|@PIsms(
zn#ez6;mkptH|Pw+WrOO{L_)Gjny$e5T6305P`wPdQJTnq$HKV>@xDP%A<CK*_t&7D
zNJus@*#hg{<}5u>-3+%;n#ez7;fz8YGpGx3!JxWwA|cr%O=n@f+??e!RL{U|lqT|D
zvv6)eylK!~hz|^^OA`snCTV&G>(&<=m-Z8wJcZjRP2}&jaQYx_H)t4Q+n~BMk&tYX
zra4$IG-sKCY8P&!G?9PV!npwPqCwXot{POACK8fO(sU2j51O;wf$CkjjnYK^)=!4|
zuo2=WgSJ8JH>fU6BqW=pX%yD&<}5={9fsQ|P2^v&aF!sRGUz<SO9s`YiG*a6G~Iyp
zYIBxrP`wVfQJTpAz`}V1@v%W0Hv1&>z?BHrrHO=O6O%qz_cv$hh3YoAjnYK^wuLhV
z@qj^#5KkLamnIUDP11A$)|Z;IEJO7?+(v04|Eh(v2JyB*4<SA=s4h(@afifr0!xR)
zPYrr`;&Bq+4=m#(er!-3F|&YdQVJV?${Y2-ZBRd3P~8BxQ7MqW-@+M$xYM9Xh%*M&
zr70!uka#GtbV%GasE(L1C7a~T60A=LmfD+n0ji5|8)X*xFIhNOAYL`-7Q{OS)uoAq
zWRo;Kg7uT;EDxai5N@M1k-z6lK9Umj7KmF78h|)tP+gi*;tq*>151a*!v?)P@i>XM
z2bOUX?=+~6m{~wJ$%-jh&jgm*n$?EtB-}=&K>pJf&RK}(47v>Qnn87GN{KrpUJfiB
z5??py<%!2hd@-<$llZDZFHbx{;!A;Lg2bx^)e$pq$tK0S2J1V4rM7q(;4PRmDqiwG
zv2dP2d~VR@pY}=Ug)0%POA`snCMJWh9%|0g57hy<jnYK^84G6);=Dm;ATAqJmnIUD
zP11A)*4LV|T!QLlxQ)_8{yP@VJ&5-WdJ3_%#V4gfIgyZTVzLF+z0FyApt>1uqco9!
z$if+e*fwYm;-W!y<unXcvPqiG0XpBD<qTBM!fli$@?W=bZbDo&=pMv}2Gyl0CGL>;
zR$%Fn_>n;`PdrZIJAq}K#19OrBW4zmO-kW8tT+6OH*QcrpTguB+(xB9{%sb{c8L83
zjY6C>s4h(@afieMfu%#@DTC^W8B?-J&dkGlF|gD&x?QNw!EKaT<UeoWT!eVZpqmia
z45~}hL#S@}awzRh5PJ;jgE(N&%M*7<yg9IRNIYmz9Wi4{HYtTMSWgC)+EN&X>L}bs
zr9l2g3+EKX(*|9Dc-f%3G?9>OlBS!mzSW%NI#h4KZImYRKeBM1KzwS@roZBoumx^|
zMj<8ckoZ|3?vQwEAnw#<R!Tfh;thdioWz?AdU@gr5^oGF6D004s44NoknYKpcrqoP
ztRrTjkxh!FAJG~N(W|`|n3C-<X;g2>KV{*}K<pZH3gTIV>e56)vPqgQ!TL&bmJ3k5
z2)9w1$iHUc+<|!4pvMrO8B~|1l(<9Udx51x;^zjvJn=Y*9|o3j5<fMlj+j|MHYtT3
z?BL%5w?P}Q5vrTuHYx@34_Y`w5Qhyq0CCQsx-_N49TJZQmJW&M4XPt%OvxrWa~jrX
z1552~xCGTxa2sV7`L9?w*C1Xu=r+WA2GymBgk+O6J%RPJ<}8n(`WSAbG?9PHU-glc
zpnD;1GiWEoQG@EzL_)F&@eHiznzKwn^#I&PX(Inw3uhVPd4sM(ykSsXnn*}CNz)xz
z-)qjY2G!ee8>NZ-&!TXC*2i}PT#3zAh<ygtrHO<sGZ}(7YET`^AXIn4ZImYR&sjJN
z5El(P2l0YIb+I8K*(7JK!TLsXmMc)b3b#?3$bZkmc>wXDLC+y>{5hW#iC|rtNJus@
z>4kM)bCxYo-3qr+n$AM`+{+kUfbtEv65mybw+y-u@sUAw8IclqNW2zUIwXE<P#rO2
zN;WN&UT?G!Zi8}qh5(<#ZIr|0@3V0FAr2Tc264)uR_U*NN(%|eCJ9)8^-^<|IjGLV
zZImYRU$Ag4LA-3xO^9m-wMu{GG?9>OlBNf+e$<@h9#rqcZIq^sKi_hHJ#Z!HHpD4|
zypH{r6EF(ZF}RI_CjXL!a~k3qgDyh6VvxndOXb**kZh8sRambzXSo5@n{XSYiTsZ&
zoF@>U8no#vKH^*8N(AfDL_)HONk6Oyo3r#mbvxWfX(IoWg);-OYtSi(XAP=L6A8&C
zX}SdKE6rIhK=mTrMrk7dZ42iv#Crxkh1mK9pOgmWloEGHd_NF(NW38s*N$6|crCDu
zllYNABz|sCT`6ou9Cn7dw1**%8Z-lO-k>^S5|T}F?+mQZHD@^m)zfer6)*X(S~%Ar
zUN`7A#CrzSrRfn=AH!`Fo2}bC?KZfQ5nYJ$2Gs?90ID-^8wGt1%I7VdyAbaiR2TGZ
zsNR9wDCp-<-tgBvy`*{=;+R2oLGOg>5Zp#VlYidAS%kP`&@#k}2GzwTCGL>;RAA|l
z_>w^{PdrZIvw>xt#1{;zBW4zmO-kW9tZxRE+NaM|s9uBHs1(S5-@<ta@sUBTulgix
zf-4cMOH)eRA@Sot+#zvKAg*m=Q{r(FKMTa;B;FW^$6r3i6C{2fh$l$AH4sm{Jn>{o
zJed;Ljt#TW$R@?I4bj>jqE}l|Oi3?H8r2)}k6AdA5T^`UfOyKFy39(6J0w03SUMy=
zZP3dTkCS*Vu#A&<$)Gx7W&zox6wbr?VqmE)g>z6{hTEtVHvOWH+;+GU^Z>*`gW3=e
z7*v-g5|T}b7h!#>Im<j$7vMHZ6ZtP%IF}(_F=!RyZG-C4loEGHd^NCiNPNejI%39@
zY?4_IVf{F;)K-A|P<;TmQD%{UQ=gBd1icyJ7K8dB?lh<_O(Z0n5KqGTKy#KcsJ7uY
zN)!1{SvaR5o-ybm#485XrRf4xY5Gd5f8{2yRk(`P@!WteZ5yTPHjEy_l?;6f@tHwA
zzvKho3Rkr1Vnaf*iOB%0cQ$9)4%L3RjnYK^0~XE<#I8Z7Af7d-E=@~NrKy(6MPQfU
zHYuqK(4}poR9%J9ZMc%5cOl+0=n2H<2GymCgk%%q&A*KDhTEXLH$k-rZlg49h4M}d
zXBgtBK{F8N4XR5M3CSi2I0Nf*%~?)C^)%c@X}SvK>lV&ah|dkGOTc5OK7rdPX!39U
z6;Cgz-UhMHpdpB32Gzxegk%%qF0AL9vmAix4BSR(BL6uH=RCv<23>=A)1bOEk&tYX
zrn|7d-<;((RPVrTlqT{&w{SLW_wn5bS7Or(al1ivX(A!ngk>1kW6fE1LUjmkqco9!
z-ojagxMa|Ih?fkiOH)eRA@Qle(joC>gX)NHLiK(yX+MJa*r1KS>UlQ9l`O3z?uTmI
zOr{_nFlZ6tX@g##xI^NZz|tY{8H4JG8B?-JA}_%DQede~_cBz^!);V=$iHggtU<hO
z&_jq%45~{L3CSjD+W4wB>Vey!EL%|B0Jl+^$lq__3_{##&?LkegX+>mLb6E$mSBCl
zIm-f67vVNa6ZtP$IF}(_F=!RyZG-C4bQ7vH)eh7HU=QIo=~Uf^E^Qm7>Isatyyl}R
z8QKeRn?XAvjv7>#DiZeulMadd3?lKEK~0G_2a|CU4;Vz^VS}0yTUP8R@nB%tPvR+q
z>WE25Hp$}|SkDEP+Qx+e9)L-s;wArC3uhVPd4sM(ykSsXnn*}CNz)xz-)qjY2G!ee
z8>NZ-&!TYpeS9~-mDp^B*k@2(nn>6(lOc$s2Gy|)LUkwHMrk7doQ1OhanYc25HA>1
z7n_v0L*k{t(joChgX)MGQ?f~xUxW3Hz|yW`xdPRza2sV--|L=s6s`o_hB#@^Jj5k~
z>SB`;cSt-HSUMy=Wl$Y4V@fuO@iMG01eV&&It$fva2sXT4JfZh;q377-3V7=Q<s2e
zuzvnBL6g7F!s&-NV9*%EDTC@_Lqf7i0v2Gs)SP7ws`GFgWhePBS~!;>UNLAD;%$TK
z(v%W+NPIQ0bVz*1pr*tZg2_0EZx}@4HG`TGTUJbv_-0_4An|>J>WE25HYwhRuznm^
zYO5>*d;pV1#Y_H8Z}><`(3>G{F{mHnPJ`;wL_)F&@g%GdG-nxuY8!5&G@XL-84KqY
z#M=hdCEzAhSK&4adgp+rJpfly-Gw-3&}oS0462I_3CSkJmtlRiIm<<;UV_^wO}D@1
zBlj4t1pNf!Q-kUf(0bEr^uiUEK8V{58iv?5sE(L~WE0{!ST8hZnSp8-Zljzb|FVU1
z0pdl2u0vcks4h(;B%7q^9;_cUXSoB_yKoz&Y2fQVay#Kl(5E1tF{my9i%?yH+bHPE
zP`+y6+=93US6>SsL4F)zl%E2VSl31IAyi4%D2n9YJm~2qoUIUh4H|?vY*1ZnQsNGY
zw*{6CiAN2pBW6s=CNVw$>uzAF&8$hNPQh)IS!bYp&ceA2@d{im&o#)mBaHH0U=7Oi
z7F0>sD2n8NYT-PG*!s0l#9JV4GpH`xQ{oPZHw2ariTezyBW6s=CONYc*296Nwmb)*
zItaH>W|6;Z;mku^Fz77A^9I$WDJAZZcrmbaNPNMdI%39@Y?4`5VSPQY)MnOYs9u5F
zD6`0a*TT6E@qs~g33vq6jo<K^l7JqFn+@6yanPVTViJ-~h}*E9YR)nW)iJn@a)$g1
z7S1BXC4=e`a0;rYo10Mel9^nAc-5d=5bqdN7nhW{L*i?Jr9<Mo2GtQWreu>+dIaky
zfu*+oK7i^&xQ$AQ{5}7jkE8^>1>#nN1|bd`RF|e1sGc^Hvk=c2bOqvdgX)OyK=p~4
zJcIb$pv^lyPcK|aR~<14$tEU)upVm8(ht=ExQ$AI{4*BL9K?Bp&Olr?s4h(;B%7q^
z3aqa+XSoE`%WxZ|iTrmgoO=-O8}t-n>#zHyG$<z$l1)suz`D0NOAk~x!)=r%@()=!
zqY%do>Ox#FsIHtyNH$5+Sy(SOXE_bkGjJQFiTu|roEs2t8gv)p1B2?)loEGHyc$?K
zBz|a69Wi4{Hp#4Kux|Z&<7)H-CQsou%B)`S_gOeY5QpJvU$+Z+F2X1;0BcawXP`>D
zMp0ab(FF_V8pP{xHHvp3--|HH4}dj@;vJ}xu2B@9!)WW@2&J_RVxK`n5XTIvs~IVA
zhs4_hONYd5gX)MGQ?g0UbYVRoSZbdz2cS9ww^3%1|D1($9^wUqu0vcks4h+Sq59lR
zHVk>Ajc_HIy%4t><aO+~ywxrx?vQv>VCj&!-yoy(Qa$lFiMIrnaT50#^zy_LB;FcW
zCP=)~pqD3}Oo=B`;>kK<78=>4q=pf#u@Jr53dxiV!K6`zB>%jHvj}m?pk;^`4QiGC
z%Eg-!cSw9Huyja#$)FN%t4z$8l1(z}I;?L7mfFm^3e{_H8)epgC_l7to<nTyYPmmc
zje8+)i!jRDfk~{rf&G>fx)rLVYZOKDk6Jhs9|vgm3B-+W`QX>JX177?GiW=+od#KK
zy;P3#84zEFyP?%{?b9pdCZR`Pmg|$Pp4Gp7`ilu0@t5WMbC26^XW}OK%f?O0`m;$w
z9azV71v!5UZi9+;9ja@=q+1utjU<##oe3j!H-yq=^<({zYFNk8MqOM8b+Ww#@svU5
zAzm`5j+lgGlYF}Y>(%Bg*PwbGZlima{0}UgM-U$yv|+bTLJ!;q1xrG*iAf)<`<t`$
zLUkM5$}};1`yohB6t4%Uy9)90Ixnnib+15tWYE|v-uD_@(Yg+C&7ceGz1Bsz75OoY
z;HKcNYfY^}yloJq;5>!2ImC$eLFFpEuESm5TIxye@tg3xi8#N~`ui=)w?aBP{fPfS
zJ{_xIVv;NF6RO;WYK01OnAt1Y%Iq}a<jx;Nw1(kUCUyG;pEZMUr7VUZju{lP4?-JW
zr%i?8<4<~>b*;l&KIO%&a4X7r83b1Y(cyAfcj5IUud?YA-e@!2%9L(}r$unK928Xs
zpjuHBeek*jSE~l)%fYO@3AwNtuBw&)u0ox<QmXvuyv4Cww&HiwFM_!;t!I$q=kqzA
zswB^Wi?CiZ7K*)}_VJQZ=GSg_1}Nztk%(WpUe^jAyyn+|C96p^6o|4hS`9H8r)V+i
zl4vXtjhAzg-`VD8uO%JN!MSl`NLtzIF;u9k^#j^H!78a$gYeoJR1P12xL{B@tYLUj
zRl=GBv=pq8u+GElBHYT_!B0Y4mK`aF&W|_qv&oe_RJs@9lkl*3EvO{QmrzRl@^3{e
zk*Xv$;|5sPLYXJEFjYxd_|@S}pJ5$nQ=Iu6p)NlQIrjMgQEUe&37*^=19yj_anGjQ
zv*hOI73J<J7Z<rV1nzN)J)dPH50hvnL^8QAwt~PuiQMJaizfqj(kAu6i>gvr#{eA&
zR!PD0L&p3TvUVw;eKS}kVeyN}RF$x<L;F^+O2T>ouSakz>oY%dY{hXTEsms$Z$bud
zg<DBYrEQ@!5*`-RmQA6+DE6T4N&l_2!V8P#Va9R@1?%*9!BUqdu3T*f5F38yx9TZ1
z3Z1bK^X@#v(*~89C*eg^DWxSqXM<HzO4s1U4=78G;HQiq1*@b++=LfZB`ki^_(`xz
z!s<mfPg-`*L1YeB<XAsc27*<WR`y}xB!)YoZDGwW0y-0jk{D8(0Z6)7&=*5vlvtI&
zEv$KnFzf@rNepj7g{qo|fS%-Icni^ZkdF?(P`fR(IZ2Ffz-uk2ByDG^k~V>`=66#o
z9wYpQtEnU`{7~!WpWsc{rf46rJj{<+p6v-*<r{!RJ%Ol0u_su~lIUE3vN75eh{h>e
zjJhPc5Qvhdy%z-if#~okM1GI8qQVbCg{o39#sD1%L`jjJftP(+_3#xyH-lBu94*6(
zsuI?9K(~Tb64nEFJ%U@={yu@HWm(exZbH^=g<Hu(rEMXf6CM_?1(ihkF|3~lmUg-R
zq$)|x*zg5!Gyqp>JjJyDb#FtouRV4LzUU2y;7SuQ32`bwNsP9Gs2^@+{_qQ;3{{Gd
zp)m-7%88{FKRQ~WGKEk{tdA-(4<gc4k1wXtLQmSh@+UMa6ZQyUM4xn|IJw!UM`GQD
zIA>5ftv{X>KOedMCp}+f90%aZ&m(GnY(`ABz^%%o!IGWS2bv9pge2KUt1(!MRXMGF
zuqI1oteIE*JfBo!ihV!Dob3)l91c*MA4OXWP!fTQh`<%Nl@YiGPX;07NNRqoOQ17f
z@^P{6G9}fRL~9_dsKz(p#gu7rFfe{9PO-;G)ANwFWF%`lye!&X=EUt_)g42$nG)AE
zWLloWv!dwwLBWsxRpuPSc?9M4t)7Jyk}{(lSgsjmOPL9{box?HVobcw{?8cl?`1+3
zyd3fd<XJnPcbnkV7gWAmW*LANi$!KMuD+6lMXeWvwX+cswOAV}ULmRSg0NaY?UT_D
zSMF4bw*u5%gSc&r*OtoF4{@hK{KV8`fRYDJABeWYt*nBh@MNfR&oMLxQE?m6ik}p#
zP?;<d>s?9a0Ytj0F=ZMp^rThd7q|F<tjdJ(<5U}ehS}Jr$gg=w&hGpx-ggLY#hpwd
zemqIao?`!($vry&k)ODc9JvVSnrV4;``wDj4TeZ2iJgJhsl3W%cwL2CnIG5T$%sl{
zl@aU-iBGzew7MNaPgGV*#9F9izJ#P#6*RNOLQftD{A|xEXetxNqKm$*Lh;OBW%+dZ
zDS-<HSuuEtL^B~fIuy@sCDH6M#HR-Fs|*_hcaoANaGnp`NkQL)mwommQE4H}jc_aT
zqX(Xhs1!6KI2R(Alp?MALb4K-ttDbDR5Cw@UsXXfTP*Y>dp03rTi{kEj77&UF-Y@C
zk*CZ{T6tXkXfKQGFvYO|C2b|S*Fp|;C=UJ{iDt=t*C2AY19!)(+wXmFJ`3DQ*7p9a
zSLX*ADqbY{U4!dTt<0jE@U;BsGR}->MGHr(yRfcMS%VidL(7@WJjY)#%6CEzC0R`h
zi{mWw)8d%akewhLg<F~Y>nMb~aHWP&9Q}&VVM!a0<~|UhB#tDy6Now#&;C4#X3s->
zW)QjU*zcq|JOpRUtUROrZim-sUWKQ~Gdiwc$_qwJ9zu+pr9a8qRpf&mwcVy@2TCVZ
zmR8Zp-xPTqbwxc&t;T8fFce2NhE!eGnxObBSRL8;3qA+8!<9L2%Tg~fT|D&Mb&o4L
zsbxLs9`~;_B9lINo!$${c%ZnH=i&-4qO-~=^7L<~$BUaG<w=e1h1XC}`EEI$1BuFb
zS%t@*8%t8XQ<a2;(Yznx(x%8`Y^CPz{HhOq2yR6m^9cxgwt3Zx5}$&Xoh)9lUSSSO
z58-M{#v{IYsJ3D}IQYR|^WiDRQ<<McSUKBx5<2<y#(+BM1tR;Vkl=2a=rJPr6mDfJ
z$PBaNdD|5GevuiK+|RU%P79{EEm$QHO0C9e)eXs*EhmG~IR%y6ZCKW;ymQJ*xmVt@
z-V4cYAZG6N;>FF7qBg}|WR26~MSsYz<TktjitB;uJLSx|lBgs%(6vM*xeZg5goV*;
zTXZSf(W<i>f5}I16Wog1unU4SfhcKsZ@`Pk1XotvH7N1KT)n-@hsG*a{^McBw3B;@
zW)J$ja>b*FRy;VknMwoVVT5U?_f|AHJlFOflq)lYdCr4rr9VTl^~+3HawpTOFO*n^
zqMf>$+{vlcIIVcNZAH<iRui-u4#6Lpgvj%0E81zMYYeKnCZViXc^8+Ja!o>6?}cQ`
zh?%?9d2v1@vQ6<>tjCLup}3MJVIKPD0#)*4KAor}H}ly<C20~;m4t=S+-}jOIIx`+
zZgvzRPrj_E7egT6(YO^Q&ckcZhp>`X<0iar!L7VWZo_lwS9}CtY5lzg9$@+)!g%KB
zX2f3gyoLSVDRJpj85CPX`jcCSRu5ra(UMfCkeKnRuo^|!lW;53&x39kpd?vMN;|AI
z$=avTZXsEf)T{99|J6|T&mr=t%8Ig|f7NSWhbyfXMIIzq@qSAy9@;3wY!uBZ$@=pM
zqwh5zrfx!@JPK@G>%XUXDnQ?*cqTxT6nRXYl3CsG5(DJvi>gDJ_Ul^Tp=jstO_Z4~
zAnH7dQkfnDdj?mZc9b`Sh$c-)nM#_dFRhUG4!G8}-s7Q<q?D4`2-cp!{vP9eDM0NT
z5N{ep(F*6ix)e&ZS|M5&0@YE9q+HiJQl`3wMDQ@q>goz5ro0fICGZGEmYdV##dgF?
zz;!FU7&P#e6<!P(xPFBfZ38!~@M6lqPpt4_&cIKu@M6KhPp$Ccw1FE}c)=Pb@%;1(
zFPMWaMddu?0j5@BNyj{>ggTR|ATngBED7F0ef>TXQqd?r3DE4;*S+u7H>fq+JK)9V
za4VXZ?I0kL-Zy0G+2PF<qiko{{Y{D%;CCtZA`WUv`Cf=uw;V53^Fi6~iz2ouiWudM
zf&M!bdHk5tQ)UdMRiQW)ERzhYiWrZ&oU*L9SbOPAlBs{c#Z2X)joKJdK7gW=Nb$JC
zD*>9i3h|mjJl}B5pa&3J$QyZZF`Lhz_%%o#7`7Iw#MC{APYo(3=y54Q?shIK^&ti`
zU-Lc{4bS#OC28gcp|TUMJji*FBx{mDOp?{?<YC6_x)q3$mqV)X*vN{0)dplItC?#H
zc(DbZE<1R!-N08?c+qd*`W0Rb8@OSG7i|OAukd2hzzr+BIAGu>R(P>!;3rpjv1H&U
zR(Ns7z)!94;;ez6T;avCfg4wN!E*~G?VnoV#pPI&7uO8@^a?L-82FhLUfeS9vn#x~
zZQ!OAUfeVAb1S@v4nO?-3NN0R=1;8fqJ>*tA}=G1xL~s(;1^bS!FEHyR%k?cI--D|
zUf~6s69GT9!V6YeXU+@WmjZ5FVGZV8<G}K*MY=v~s>&)PH<jd$xDV^caC2{kWj%S3
z>r2|_vQqA?u&nn&GUkjtsLJ_L@$4eCS#?vZBo|s}=C+3BE@>Bf5|#0Cc5g{kI`t|E
z3!7X<TMB<&lG6ikdS;%FD35=NTfgqTDl%v2$Fe#FtH*FFUZa>y%u%)^IutL%uOd2B
z*$I{EY7S2-Nu65#+ZDTB%Ve@%WjW2avX*0$eZNcq-Ll?`*)G9M63|-V#Z`ck7m$KO
zuT@i_xU|k=l3f%}1t=k+)f$Lg1bA`Bz;!FUxM$!iE4+AM;QAF_JTh>@3NM}*_=y!>
zJTvf<E4+|8;Qk~^pIYI?Mgupl@S?}SPp|M|i-Dh6;YF{3pIzZapMjfJc+qd*=T>+z
zXyE5pcrj$)Ppt4_)WDt<UbGGT!U`{z3`}d$LwG)iD^-Ew@GCxhDsCoPZ3-%#9*DgL
zkzmvy6hm-G^ehBFPLb9XcO_%^;^0Fd5NNdx(UD^RtrcGMhd54^?Wi)4S78b#gG#&1
zLa(l=P~`63ij1b!La^#kycVG3^=uAaRB`tlFSrM{;-+7M-37QVhj?)*gqP$H?al<1
z_F0JM4JzjdiLVBggqU%?6;#?3?*wRy;@toxxqlB{J?nieB=Hny0(698H$d%M5Fc-#
zVKOX1?x!L64n-15$&%<?AW9zbB-#*yAE!7Opji?<GiVB&j{^5>IkU;VC0I>Rv`8MN
zxMW%k&N3jGYj})=55Y=bKPk5ZQ-|b?ZPi;Usrn)+%Cwg;EQ*YrQjyj&A$dt-k?#zV
zIzomg29>iewF-r4R!L#fYFi-As%(XdyWMzUc1dNXN`IgZ)pX6Eax%8Vi-~uQLOJ;k
z%vmzm<qesceJ0en<hEdVQPoYYW^-XNmKCi(iFsmx%Qjw^U6O578M8cMgbsvcBv!-F
zX5w8A(T>Tl%r+*RmXZ{1zaRaCPj^M?rr@<4RN53D1n3CGhXHC2f6{Xfe2Uyjk&t^a
zSam3pP+BSy-34LAV~Ip(0?|0dy8)Ud(SblTdlO=Rh-6X&$bBIYO;EH*9;W!rv>2Ra
zz~OT3nuqo(Tx~Zf-w8||k~6kdEfuM*L{yY%FD(^CMoy_nYnhO=R4nqFAyP-kFd1_5
zNI7|_RVYleN}3^BT@GPoRW3rs-EzDzyX5Af%C$fps_AG*Mq<S?9hi7`ca@W0dCSp~
zxh^dgGy8T3FUdAqMO8PoO6n=C7|V)#nJU-gY~zL5B^f}K+m>yN&}v9VVs#7JOuWk>
z+A;Z+*~Wy^Qj#)=8+18;qq6q(LXbWc#o^GMPpT5FwgjsVMYBpWo5X{#%8db)^<HTW
zB`?lpo!k&mS+9y~4Dn%Me4@3~8rZhN%Sm`w^tFF{OOh{uJeL=hdKF6(2T)i$;Yt-*
zOfqc@o-?6j+Y}cAloZ=3cwG!CZHn7NZ#ipqAy{=NnpIM<&O@7r6G<|DYlRm#16BJL
zL>?97^my^a^pLy3AwQ#1@mRb8>s7dpnimXL>cV6AKaKTx(Fz&E0t`_gzfpBbwINs~
z88ZN{$)M7v_%J|8A<$|psB|dWn_xDqnP8O+9v*<#JY1JayjTc!ZHlL2JzntjQZn-#
z{Fh_BkYy0cfr?$3zk*7jG7-~$H4cpz*8qwg#hbAnFV;-&HpDxzUR|IS`~sD!Dq{Z>
zp=?<1gAkRC5H}fA4xUz2eWmq!(mwEYr#DYiR;lV$@vUddXee&oz&IzpC0en^Ez3qI
zn$_WQvS>9N!WyS&R!I$~)m*Ten1^`EpmPwH4ax;?uOpKbE%@2872j_zgIF_>^7Vkd
zzQPy5+X3re*@PS<eN{O!xBtw^D-*ffoUHSRmDE3q%si*Zi?gP84kB~Z>6LSbo~vfZ
zjCf$sQ;5umiW`MlNo!fF#GHH<h>{vbt6NZUapZ+jwMq3b*5k#Kz~5#>8DwRe2T-az
z!~M~wI2oX1WQ{5ZprZAN@=P#Gnm>BYnF>XoT~{$1O%;xPRo(eK#O}N?mrIw|8zEGb
z+a`FiOIe}9c@uUeMTH`V(JQ+0w8H#ZOPUypX4Pd3>C&n{#CV+I7@qwV%MIqBZ7NAk
zn}qdJU};m_7#=RO6gLH^Jr8kP$mUr_mM*zZ2ks6<5=!5PVo%`ikefraqQyst1()Q}
zA_%U)l}g@PN$rv>ph{1;U%G=3Ul3Yqbu_g)%B-OK<5>+Mk6Hbtrcvzugr}~kX|(Ew
z66#RoxrysqtRjqHi&itiYMkP>5LWW$ODo>_vZsoog_S&RX~j{nb*)K?7FJST7Z5W`
zdN;%#LO)_U6Jp$^IB)Nvry=t2#fm&6(Oe+vP+SN^hf|^?(j+<%h{h>C4{zexbZ{t3
zvX$au2!1XNJ}FhEehFc@dxIC}LIjRbJRj@v;(~#{wZe-V2DVmsVS@`tDBh3tcwu>X
zBu&JTa;b9g$CCbDYV}^(>OOM3Cq&@yq^mht1uleKZByL(Y0oINqYvVcLFLd$bU6@p
zDDr?t=>nugNrfR1qp_|vPVrLUKJo~no#=QZ<xVn^L^F5*y4t{tu7SU`!V8{c=`?w9
z0h$|HU-)}cA#la>ES)MZEEBtoA5SQCdc3flP3{FA_qh$>$U~tI;*>!=pp&T)t#TR!
zVqAGJr$CoV(N}sDGb1NZxwskMnNTCz6c<0kdXu%94^|zDOTj9s5ouWC3~MeB&8|UQ
z2t>(qc@-*;;I41|k8>-JalvyS9av88Ignlr<ZX%vKFj1Drq~Too8sc<gI12)j*{$9
zB%u@lMG{K)iK1~Q8GaG*-HfC0T%F^^6@YSsQzVts<He~E_asMo<|Sh%5#`y0*U^&{
z=o!QfA;2V}DbeAS=x|DuR2CBP6it^BURX3|$$lPjb9!Zd2bRl=A>2XU%EGq6<ZZsJ
zlp7)~>oq5<*l&FoG2-!}6)zGz33Dw}(JsrrFBEf9I;qv+)G8^8vX#rtvR!2s(~^gD
zO0G;LSzK1iWpP=rIax&(pFzIeguA}AkUmsd&+P=y<TdatGW$}<^ftwrpI}olOR*cE
z_8LSUwOG-2<H3wPYSCpeFGwj5<GY};BMardffs!}j73teTVQ8Y-3NfoDyc)miB<A=
z=8=we5M+BZqQT=3D_%!=7@~!p5YuZRBr0ji2H`apRHi7-2j~bzBTB{vXw?l?KaNTp
z*2dB<w?mVOO0u4nDvY+gDpPzx3a09bsX`X1VjGhilu8V;S?CuL`fa#U;uIf$fpxM=
z@kxN%V_)>XSK!Kn=RQOpn<&uLpY&Qhw@#pP#xe%CLJT?-8LZrOX>hX)?qP_*EQ8}=
zh+=pXF}SmtshQpOQ{_k{^^=jh6CyQEaZAX9!;D`m#9%y)=V8W^k*nB8coV@qfh$``
zHc;k?pYnKNc=r&Vs*(Lch{M!#h+C0#vD^-EEP{{=JoHb=%4NfN-9VakAdE62qocBv
zuZ4*9uP|b32vTh+-wxR8E0muFOg1N$N~mf8j&Z9Ba{~%n?S33C*M>6ztV|B%1*=s>
z4Rd;|ZVX-YDDqx#dgUBvF7W8iips(QTS6wuEqfQ@J%fh7<f-lSzjiq+5{(9{4n-15
zv`NIH9R(^A@ia=RxRmi?6VBADc$OSMz~@2)rWo2NqF>ReYD0S}SS4*r1C==ha3LQM
z<1zyk>B^+NkFrv(UsTp>PFB$`I+a8|*?xbfUgd0}l04E<l_VgRZ?Bc}0>njw%2kF|
z-JsH;)sjJFtIhDDl~lCvt?+{OuJ-ZbJ}jJOnQpK|CmRFHDg%j1(!Xe+(jcIA5>Rr#
zP9`czVN5kwVGc>oRCFf5a{#X73`J&l#huB_-n7MMqulZod3vU_9&7NuZCd?5;|&(R
zOvBkFh!?}*gGsZ);5G!J4#mL$b;<o4VMrH*+?PXeNee>mo<KBCk@1(Nnc{uZVsLgk
zX40d7j!fmrqWa{eJQJ9v79cJgbP3|BL5#vJ<dc%ELB1Vf<%-Qn+(I6>yM`B*=}E>s
zL^eJP*?E}RN$ZMd7IWHE5@JU7Q7G^>#i4KrVPf?V+NP3J6S53ocFU!d7Z(7^(npFH
zV?AD6GVpsVytr&&YlRnA0Q%udUR{k<d2t<}1WxgOfDTi95S#L1IAlpuy|zN1NzA18
zNM+Q@)np1}OCerKvvd|-%)g4_ZzHyLnr55ga{m0rF04!?DO<9fg{n&{FU|q<CBdtH
z1n5+GaX!Q%$<B*lxfTb(i{}6<(tHPAkAq5*a~Bcntq^*f;?n@lQhXMm_JN=C<+QQa
zyA^#ha$gTt9f~BBmM|qs?yyq`>pWbSZ@hQ}up<4};q@S>B<bIR=nsZuv?*Tvd8RBW
z5L&f^RfnRTA(<qDR>Q$+oT6DJ^=l`z7vQ?Y^WtWpIzq8OM0=j%RDh0BTnNzI5=4u`
ze5>@w;Fc{oidO^F?gP<a;BJpWoH2+YFB-HA(PEI46I1s9!MR-E1t}{Q25bN|(_JwS
z%(UWxChHX16uBQzD)-DfueS)dqP~*|Z+=45p~wXSQr}6m7KoCHG6%00s9c81)xa{v
z;OWx(eo$#s+`Qf^RV3mbw5clNoeL|xpxye`-&t5;ICT548i7g`11(e;2rD3xw4Z_3
z*`PAc0O+PF6ZE2+s&wc@m&@+@LteBgUfkf7DzfJ?ylw=QHbq;WpWMTzKj8_N;Y!V5
zH0YkISGfq4JAoz1J?>eU#}u&CWr~~}tY{~9Vs4dl%u;gv)F5XWD++TM^N3?%PBJN}
zR3#~?R3*t8X3>x94#RK^?ke2daLdkJWXC<Y_u)Q(%lTR6Q41NsFF2O@ay$>gSLP|(
z4}gCsT$TyH%UITDmX`JS)yJ~_7R(~?<9qy^9>1km*6)LUS#J_}S^qTfvv4`t$*Hii
z{&Gf-U*{|94`XU(3@+z?_~o~<e)%JD)Z=&M%KBHq%g@8{gKzxWTUnn|MP)sHORlWH
z9W#;xaQWf2MO>Hl%b#_l9=`-v*1rm#>u~SF<(JmV`sI(ZQIFqoE9*~!?*QEL*W$|h
zoSE9jIV8B-;g-MsRh}g(^W}K>#j#QFlBaBc8vbYDUV+PxfR**j-wUH2KQUI;=K;}!
zzu<k!M?IJId6MnbuX>;InY3kn9&>r-m%LB;z{;{dPd=Rg74K6%_OPsf0D5J8o(Ngi
zUwgwNcj1;#Z{ZmzJP4<${Uh-GS@n77%jN;k#1me4x=fjW2*4;@c1|bDintzv+f@Hz
zsV~R9Di45{gDLN6DQ{>g>z9{emRE0<_1P|S@dQ^+EaU!u4wtjuWqY>2Tynq_02?v&
zUDjVl`+5QHCAe4MvfU+L*?tIvSz~ZHj>)g=l=ayI?;?NM-CoG#_Z+&ST&&B^<vHMG
z{xj&GorPQO+LiU|uh+}FMAhH=7CNsb&-E<?o#5zlBskVYC3y8CeSHf>ljvi?Pl8t$
zz05$AH2vjzPG^>U*SGjWRrFZj!aPC|mfYc+T+w5F3qy`YSoATFl;9Y`Nbueg;xE^?
zzLLSWWpFh0CExX}z7pau*Yg<blJ9yROPk=YmJssvXYd^v98G4)cYW*465=n{w+1u#
zH!}Fn4F2mGd?<szmBINgQ1o8kdb<eVYJH1sc+q=(>o<x(&>zd-dowtnB}MP`t>jh8
zDXec*KXcZ%zFj21)%x^P9^m<IM*lzt|IG|Olfe&V@Z^ov>8(#st_41q;rU($pU>dO
zGWbFUKas%~Gx&!Yd?|zfD1)EM;D0NFpU&XFox#s!@V}eE&t~x7$>8TQ`0r-$<qZB0
zGWhun{tq+wg$(|WGWf*|{*N>Gr40Ui8T@hv|0fyzN(TR@8T@Jn|NRVpErb8F41PU>
z|3L=7k-`5kgWt^H|2%`QX7E4C;I}gPzsTTg8T?;n@Y@;uUuEz+8T?;o@VgoO-(>K6
z8T{X7@cSA3-(~Oz8T^kk_`?kT?=$$L4E`T7_~Q)zA2axq4E~=o_|pvjCmH-%2LI0)
z{CNid(+pnyVz9pTO63c~`qqXF{>co!F@t|5gKx^<pU>bu8T^YGd~*i>QU>3W!M~ir
zw`TC4&EUNm{3{uJTL%AX2Jg$@znsChXYf}ucz*`pk--Nt_?sDgFoS<1gYV4Xzn;N|
zGWc5=d^m%@oxw*l_-|zJu?)U9gL8(lcza9#Kcmly#IpXkGx}2*{JR<aKnDNK3_g>=
z4`pzUxs>C7B%{x<nX>-(GWzow{8$FB9`jk>I+4*|%-|np@TCm?qYQp3ga54zemaBy
zb_PF_!T)XsKbygSCxf5M;J=%}moxZ3$l&KQ_&?0x7c%%i%HS6>_&?6zmooV8W$?=x
z{GVj-D;fNsX7H;S{P#2XwG95xGWhij{s$TSMh5@G41P0%|MLvKn!*1lgWt;F|0090
zW$=HQ!Ea~qf0e=SWbl8T!S819f0M!QW$=HS!S84Af0w}@Wbi-E;14tSzt7;0GWdVU
z;Eyx-f6U-dGWdVW;7>F7pJec78T>zI@aGx)Pct}=J}W;TUwNg7_$%rEXYfyE@QoS#
zGZ}nS2LF5p=UFJl*vj~SMt^e#|566ulEJ^6!MA4cpUvRC8T>05d|L+pY6j<usdE1O
zaz=l927fh!_h;}O8JsJ(%JF$Kqd%CzzmdUrX7FFn;6oXFR|bD8gYVAZBN_bd3_hB{
ze<Oo`D}%q2;MxFeX#KzcrI_<A%*3V5!{<eDUCZ)kBMf!5y5hXv0Q^^+o6ZmVnZ9(M
z@m0}(C7OTi1<$XGyRNnKm9wDY2;;Y${<_xoU0!h;qI?AUYzdYyb@@Z+x8L&m3*Kp+
z1-@Fsef-n<<8jLe(6n^KcwID)$^7v8pQT!Gb!2s2%jP#X!N==sZWsUlNG{h!^P5Hf
zo}#i`{a;T1b1m{>5lYMRe=*V5k*Iaid}xt>bE5y#lHVGC>{e*~3^Y9dmlFMNIQ=aF
zFY+5sg?GU}0N^L#dj2m{Ex3zLe`~ld@*7Tt{|Wrx1c0q~$e*93T5z=oyROw6u8aJJ
zQ{jIH{{aA>h3n)06{-bSdrIqC+ro8`-*77Yf8c))K(TzkO10qX6LVcO|6Anm3wjiO
z(dmD#^&x;F|1VQ5xOzv(-59Qm{DxEEZ-W1S08lJnZ4HWlKXUs00W9(xPKEQ}zW{)D
zh|m8WR15C!JAKx+78hZnJ{V4eHSk}l<bRWD!Tn>WKNzly@i&|be+vE^0C>mx_<w_H
z!Tqu{snSk{>mtA5RQQ_H|6GeR4_|<X=hs%Z_}6y&Ljf%E8%~AqfnVDp{VV4GTON#l
z&p7?zfE4)+r^5dN{{II+v3|Zywc!4N(;p4jMSjDn@PC4zBkRTX?Kh|v+~-bzEL<1)
z4W~ly1}(48wSH3WWBp@`=JS8A2czF%r{4}pk>7AC{3iH+75v5gAE#Pymz@4&xGwS=
zPKDnE|6d3HCV2Sxf17H-)s^n?2FoJ<RM4aFhv45+$^Tud1^15AXKP!&e+{R>{|)~A
z;4jvn-=tb_Uy**qy4Fm%F2>(*Dty`Lf3DR9KcDD6e-2SCxI3JFH(VF_4X45=_)k>k
zkM@F!f4}MU=K@&dH=GKK;Qw2d{NJNmaDT_?&xh+Gzu{E)U%}6jKlX%t{v4xPaBn#M
zg>YTuH=GLp2l)SI#J~7_KS8zN{)y9H4A(_|!>RC7pY-=HN63o&d}>m=)f#a6O93eI
z8%~A2;Q!wc|Kk1oBdP^=&gq{D*G2ySpRw}~sOzrJ|7}NWtfUe}Wfm({T2V1VN?WSv
zutQ}Xx=dr`>te|dNTDSO1=7-rU8>kcWr`IYD)yUIR90CRYxK($6+7%$Ma?vG=&;MW
z=ocN+)MYMHX1|{w&vVZEJon!8d;Z{ZU*|c`=Y5{@IiK_69xf@T;2rS)`-1*=P?o$-
z2K~Y0ebzta6dZ;Bzra7+|KCAb^12lCBgy-$f66KNSNQ)N{@MO>7iG!ouY&$i@;>XI
zatfaAt~dPn%sVLA@!>s`C9kzXKbpMH`lp<NSHu4)?l|wKtpEEWG(WEo`muy${ZmfC
z+u+YT6WQ~tyD3Xv{Z|{FlN(RoXZ=%7!RO%r64akPfA}zE$?La*ej<6F^-nnkKY>55
z)U*B{r7U?ZafavQCX@GB|CCek+@Rl>`-6h@-$PmQ`m&%uoV?Har<{W8;J*X@+4Hx1
zDNA1agMKP`pY=~U1@DD_Km4=(=Tnp=uTw!koxIQbr<{Vhpx>Cg6aLx#_dd#!*W*Dy
zlf2LRr<{Uc!2kX5FUO2H{@+ho@>=E|DLyB6Bzd3pPdNoI4*HF`PryIhe;%MLd3{aL
zA5Gq8{ZmeX{{~4vJ{*OA8D_-#zd%{?dVA2%ChxQUDW_l@{tE^Dzeri~dVkQ*CGWHT
zDW~A;@IMa!?D+W=%97WWpr23PXZ=%7!8-i^1^&;(jF``ZlqIi~7x+9ElJ{BvlvD7^
zpx>DLFZfqrM)ZG(vgCC~&@U$Mv;HZkU>N>Sb?5bd%I?1pM`(Ud1pQJ%vi>QjU>5$D
zz(1SMw<t?qmxKOT@;>XIateM4|Eu7i-M_v=S@K%`6rca`<bBpZ<rLHf{l?ty7tH5-
zlqIkJuj$UoEhq1@{wb%x|J8@zzusCfpC3?`yp9I_O7cGIpK=Nwfd2seD>386;q?*9
zlGo*+Kasr8`lp<NHTb_D{%&)GDf&N3S^8S)*Y{-dKI@-y3MztrW9}pH&yLSOrYw2&
ze|2+CZZ&zI^-nnkuZ91o;h!BJeo9&LdVSEZCGWHTDW~9V@IMOw?D@&hC`(=^g8o$U
zKI@-y3TEN|xA4#IU%#L%d0h_r)5-g+f66I11^*uw%>S2^C9fM?fam1Sr0?-t><=lY
z;Q2wnG52rq&mO;iMOpIt%Aj9Q-e>DiIR!i5@9$gqsUp7Me%EjCE`51N(7RQ@l=V+J
z=l?nU%S$53ULT#C_)tF|^d$+;`lp=wN8$fM_-E@sKk=cy#O)yG<TfNc>z{J!pBMBS
zbFYGbIcCJ|bwT1oeRI&4COqq(a_T$a|E7ZZT$uP!e@D=lB|Ph&a_T4He`CS=pO*Mg
z|HYs$Pk7cp<<x&4{&y6t|Cxyo^=E><BH>y8lv7{sPH6r3|3Ua?kH61Oe5m(-oqJBM
zGT~YOlvDpk_<s`q+53AJCqC5Q67*FG&-$mF`g`I375G07Gh+XFUgAUjw}PIZV(I;>
zlvBS3{}b@f_Rq`m{4Xf;`P3vlTYt*we`(Nf%$<gRcKmr!;zNCN(AOqB>z{J!-wOZp
z+<g~6Wyk-`iBFuH%iSLIbqUY<r=0o^!M_6j+4{F6KGYux`i6vO{Zmf;-^2ff@W&sE
zV*I=^@uB_~LEo70tbfX>FLMR^{@)D$?DqAare&wiLEn_{tbfY6)NA3t4gRh>g(>#W
zS0+Bx?+E(lglGLzPW^50-(ArEn#70tyMw+Z;aUHbQ~v<``{AEGzP~2%q5eBT-<t5O
zf6A%<3H<q2x9)HgrkKyQi4XPu0^yuoTf(#cDX0FogMMS~Lk07Bed0s?mZ0C7@T`Bz
zsrO&o>-*0X{9X48Q>_0Di4XOAf__`Vv;HZkegyvfPpR4dd0pZ|{k=iop75-H%BlYv
z{1;Jw_Wa>3i4XPu+k(%@ZBKaCKjqZ>uN3zA{1E=`ZJ1&{*C#&ISGWPn-TzN`)<5Oc
zZwdO1xt|xze^=r|z5gC#_pLYy&-$mF`WxZ@IQ+Bu?@4^9KNR%c3D5ecocd40|LN|&
zsh_g>-<bHsxw+g!LEoG3tbfX>Uxj}S{Iln8`w}1OFK{b(POdNES^tz%e_7DG@e}^p
z?aNP1sLtiC3Hrez{we1Yd*J^D_&*ynV*j}%@uB`bK|hr6Z2c*x{<HAs_bojq<9~bN
zL;Z5l4<|h9pK|Jd1OIoU{_OQHKlPzHm-FBCd`|9Q5&x8PiQftOjk!<4-wmf>iut@F
z@uB`LK|hl4Z2c*x{#N*Z0sgK#g(>>qmH1FU9`uJ2p7l>T^`C+N-@!jS{=X;jq5i?3
zA5D1HKjqZ_GyK0-u>SWYKGd%V{aC`Y{wb&aB6mRa<J(W*?-mbJ%;)aJhx(TV{dmH&
z{wb$^8~lF*|LpPQ!-)^|`+|NV;aUHbQ~yEuU+6vu@DraiiuHdq@riSDx!ItfOnBBm
z<<x&4{x5`o_WbRh#E1G{1^wZKXZ=%7z5nv)aQ+7W?EZCc;zRvwf_^IDS^tz%zaReF
z;g9d6#QEo^5+CX(f_^&TS^tz%|JU&MpCkFny$w^$|GvZrIQN5~pGkPuKjqY)f&bm`
zcf(PbqW}Gg5B1M<2MBlnKjB&blvDqzpx>DL6#Os2jOhPB;zNCJ&>u~B)<5Oc-v$4_
zg@3mHe<AUq-ha{YIl0+{XZ=%7{e$rTNBFz9VT$#CG4Y}PWYEtgJnNrw>d$i*yuN?_
z9RAtu`<29p`pbfTKH*valvCdV|MMZtZr=wJAL@4n{X)XC{wb&aPWV3?!tD6=P~t=V
z;h<kkc-BAV)PD{BFNH9h&%=oi^^XSqQo^(TDX0E?cf#QFe+`7$^M`LGKGeS`=#M2l
z>z{J!{{a5{e{R|F^E-(T^@BlwJmFdYlvDpv_`eOp?D+P*#E1I%pkGdS)<5Oc{|x?r
z24OX3#Qy(-#E1Gyw}R*7RuZ1|PdW81LBBEgB?vFh_&<{PP~RK$Cla3ZPdWAPf&cd*
z%=Z6B6CdiQgZ^Z~v;HZk-ha8c??3+zp^Ga_F`pkNKGdHI`qhMI{ZmeTh1;Os|4Ht1
zJU?ag`Dx-4=jL+FLBE#ptbfX>e=Gbig@5+^?PrM(^|uH8sf1_!Q%?QI;NJ-U?Ed?U
z#E1I1pg*1PtbfX>{|@~B0RHadfH1}Uf0_7DzZ&#s5}x%>IrZne6MmonAHhG{e}0wt
zP+uMN>j}^Lr=0qi!+$^gv*)+JNqne(L(ubS481>@a_aX5JuXfioW+coPs*u}y!Bij
zN6Bw<KDiu<By_KT4E}t>{IBl<e~s|>g7*mj0QjizKLh_O;U5S8j_^-_|EKW30I!fl
z{|fx&!oL81z3?xC-zj_nd`kE?!2NURcKQyu?!n&&--yrCxy%W0{mY*J3;ssY{|x*V
z;r|K#5#jOs=AWFK6aHIaz<F}+pM_rlel9+@Vx617FBM(^-YWdL;5P}s4E%k<UjqJF
z;SJ!&g})s9zl2`{{%qV=XZ^ni{tDq+!FLFMGx$4&Ul0B%;a%W=C%hMYP51!#Q)O4Z
z9o#>!YNtEF-z5AHIR6fZ%e)`_W1{~s_*aB~9Q<E|Pl1=<I+XsO0e^w;2f(it{@37p
zh0lYJ3IAL0&k6q)IIrtj&p&|wx9C^ED{&r9{l9|$j_{v??-KqP_`8J1|FQ7o+_dn=
zq5p>P^TUPYlXE{4z7c#A4=gCO9Gu@O&H66_f3xVH2Y$Qo7lMCWcpdn>@T<W8Rro8x
z&zD2StHEC=ybZif_#44_eB^q)1^jN&?*#w6@NV#B;rqdVE&LYni}}C^8h$(YtAvk$
zcM5+m_@4;B8~i@u9|8ZS@WbHz7r4yf)8J2k3Q2suAN)$;p9lY6!soz;h5rrs{}%o*
z_=Cd#9{fkbm%%si1P$f>Gx&>z{}}xB!v7uoX5pv7$A$kI{Qn3)x5^jr<lGO0KN<Xg
zgqML=@dV8;?xtr|`JYeD{jTtf!S@Ki6#U)7UjjZO{0i`I3x5UpFND7u{2A_ZemlJm
zyixd@!2d}2TfzPF4tDAS|8wDc!54%d0RO+j-wu8OKk&@O>0RJ25&oy(TZMlJd_efe
z!9Ohgli+_X{4c>*gnu6Vap7MEf1aEue;xeQ!oLaLE&LzA-z)rw;P(sv5xD={+fM%u
zep>i{f<KEl{;|;ifWJ)md6#&>lXGtsz7hPO@MnO3LilsQ9}<2kxc^+&PA>s3<p)HV
zc?I}Og}(y)4Z>dyen9x^z$b*i3H(dK-wOVS@GkIkc%h6s_kvdoKLGw(;co}`pC8)k
zUEqHz{7=F8Z$i1uhrqup`j0z)w!bT{`&~N3*H1aU|NC)vA0Ey>8~Ay-s&k@l42ymB
zdH(Oj&&e%a8v(z8;&JfY>mpw*iLbx+{HU*ZLstKg^Y=b$dm<mfb;dIIjvFIiLHoY|
zZ`>Ps3-m7zZ=aM~mh-x&pq|d#qW)BT!TtGkeSvdZoZdABSG~SYIrVQ0`i;3^oIhmm
zZ=9R>P(K*-OiTS!PW^}A|G|R(`QPvHg`iKr--FvR=96;ze-Hlm!QXwn5~irn|2~jk
z27UT{AX)#E)Bhs3-TnQOdHB2AU&cTG`$L+8p5Gdv`J|lwyW#&&@OQU=jsMfmrH-$6
z1$}wKv-PK(`f2!|hJW_{fByHAJRJ1t_mgD(Q%?Ui_?O~*FYC|08lpOvyRh2lnSP&1
z)<5N3q9*7!=BnY({X1^oi<2Cvzb5Fb5}x%>IrZ1WzXARnE~EeR5+CYs5BlnaXZ=%7
z{UrQfQ!t<W?^pRs(AO04PdWYn1^(B=KihxuzmFxZS2`Zjr{q$<T`tJ+|K2?hGorrr
z+?sMK<16o{{Zhtl-cRGdY35QFI{&kc=i6?lGQP6i<O?A%yXFaePTyJBr-nDSF}vvr
zd`9oe`n*2m(|j)bH-__EXW$p)s@$ueV%>Z_FE>YFoQ?Ud=N{xhlHsX8aBlAt)Y&vm
zWqkb;)LBK0{r)44`{Pu}eQ`!R>WcL?pPT5h+!umR`n^5bex7nR^TVLun7bAIFx;kd
zGoye0_xzMx=KEWEH!$m;a{6x$`i;49_*Y>@^xu-~FVwdOeM7>t{wb&az3}IM8F^vG
zKmU7#z7q85_XuVEQ%?WK;QvF^pY_lG-l4c&uAhYaD|B(s&%D5Y2f|~IKmF1B;S}dR
z+imBkxkR^Of9%5|uX1|NPrNdMO7J%LbiZuvI8b=;|8>agC&G1SE=QkTPQNLaj)xqF
z?|{#f-uI2SS)WPp?|yy%1C~D!e14T6`ZT!#$G6M#y4sQ``DW1HlBZt_d`})fw<hNE
zwfT+bCo|nI&vAT{`~Dv?9*OIrKl%7YO`PXnUmf)KCWv(|y6x!e9J@cx;t^|S(5Ii*
zQ~x%{y?*A8qrMdt+ymZyPvob5E53f&ald`LKX%t!B8fl$G5Dv)Q~KY5+z!4r>Kfql
z-|%_=OMm^4^~t$Zd_D7}k@jKcQ(cGj?cVo^=e)`4YaHK{OP>Q_yMGw?mPAT^Q{dMn
zqaOLY9rx|FHOEER?(CBzKaArG`6C-5KY;@>`Ly$)XVSR)Wg+m#9>4JD_u0k6>_^b<
z)Tg3)0+o%q^A=xE!?wszf-kz`spltmN6s_Cb6*ts^j(oRLSN&!&+V!^ULI%Q=Y^L=
z{r1m9FamvR&}XFK%^x|wDVIJ^!gahW@boz@@?W^M^mX?BPV{0vpKyB5E8Z1(8QOga
ze983-KT*Ht`lHv^xqe~!KSLjBE?0+N)<QiG5hvT?LN{P}pT2j-S^S)?7JPa*@@_2o
zD#thF9?kQ4ljA<mdtd*h&Sa+h<;K7*iN6m)|G9VGuw>`Hr-**i@lCn&kxJT^z5<`#
zyM`{eKK~r_>G;q5pH>^|{N*R#i8YH$)jGZ@_rAn}`d0^@j`QS0f&Vy9KL-B`7e9V1
zndyF+cHHOOjGXH*v(N1(p0~N<u%G(kORnE-SI-aQJ{$Sh;Ijid`g|+YlYZ`8hWRI<
zulZyI!$|PFm&6>tx#za?APp}UIqut?yg5?tcQ1hcAL@TQqko0tn{rp?ZI|=ialrfV
z`4iTEebC>Mr@zIWS9$%Brr0j^?+E()k`lRI^B6ymUK?le{O+Tn&P1O4G8On^kN-o<
zmw2fe<}JCOzTIP}i0ytQwEOJ5I)C7}*Ke2o@ju}I;EOI8N*Z;)lx~jtn!6%(n<Gq@
zVSSrreP0ayitE3AVm;S7?)R_nzJB4eaZdcX8~h`89(=3icRRi*d1@owUp@=}l6OTl
zFAx46K8-(L{jT--QSf;rLCpUtFOBs)cH}uPOJ=%XHaqU~IqdTA6YKvy$2aA0&~%(W
zhu!a9zeDox4EkMp`QHKm8Fzf}6a7E!xX)+er>73YIq~OLg3tF7#CCrW^a)OWIT7^f
z^L5mpTNmpbb>pa?*zQG+`*sh%<?Fl!6Xut@1^s#rRfV^S{%ZI%^+vuPUvh7R&qsdr
z{5JrFmlhmP$8g`W4>NCte(YHze`59T1Alwnt12!3E6063W$%lW*Eh!;-<11VA}zyj
z{|@~eI_x0$Q|sgUR&0I{TOiKpcB6v#?|Vvo-v@mY#<vxBeD)Lhbx!B?N01u%i{byh
zv9*@CMEv<$$GzT_6(+uJ1Fw|r^02#Z^!j5sywm><=x1R-{sG4~ng4@UhIa0QzT&zF
z4x&dcfb+jt(&t};&oz1dc0KU)xjXu|xY5YhIe$g;FGahTY>9kzBm!>CCdYk$t9{A8
zeG<~}@&?B@CEp_EHF5eW@~^!tzGt1s-1UZU*PoC3iF|+Xxg$dNlRobb{F*#|*#*((
z;4|VZ`kZvz)%%ZJmF1rZKCjQqXU=iIUSGcSbze>zalb4-HTrC*%KH2u=&dsT{uq4j
z`qC|LwsW84&JMhP+4jwu^Ms4R@4Dy2MytQzX|dg2>9@^6Z<X=)H#@#5he6&U=C&{J
z^m#n;y90LzF-+v24m=%F$^CzQ_IdihQ}k0`e98Td)BE-6_~e)O1BDm=-%Y)~+l^;_
zqJBd|<lAxGfz``Zg16RX_4B_K^`~6>exgsU({IY9Pbrnf*|}Y=pZRuA%tUYmTe{Qr
z56_$2a(<#uYw$^*H=|Dn>Z$lZ)bsDuZ*d2D@6*{BIel&kJ`YFee$wY|$9+D3__p@U
zad|4}_vH1%2hnc%hoTkl%zi)U(@Q)0|2*&y=e2u*+n;@%bMK9_ww)VaU+lQA=ll=c
zmmXBztWTXE^<@`E9oMS_+x?XAJ21ZOkn!zR!9RM~pKo$}Q|_Y)V*P!A|00i%q0amM
zViQKbD0#>YM1H;2Um4%C&d)&qvuFJ>J(xJj-+_PTpWgNUq!IT^d3p5N;PzKP(Wh}!
z<kQ$S2IK79{WuQ#^JPC#Uxof~TE>~j!g^hsw|zHU8S}sJ>n-<1r}(oP{Hw1!(P8=3
zj=Sr-1TnX5j{6*V-?9xYos02m_Tsn*>)ads6Px6hJK!^p-gyjj-cv+>*zrx~|GBW9
zUUvi8*Ry(cw%sqne;A_!@1!pUpZ6qn(C1$Cw`PDoC?3W3+U~{`Kau|^_<T4o=f@rQ
z{d}_L)=T0N@#oXscJlnOYt9|FyaxQn7rrTT+<!UvZ{Khk)+{ddM~=JxoY(F_$9)bf
za(#Ws?LVF`;|3?||Fhup%sihjpxx)b>76&&I=4PK`piE)Qu-VZKJUo$`FY^!^ZaEn
zyAbu9!GWDVPj};*&*$I&>ha^Y-OY|~GXIyBK7SbazC=pi4WA3w9{F%G)BW;;l30J0
zJ8t`l?Y_<FeLfR!j(h^+)ji<H+9I!rFS)Ne?yfKL*7s4zef^ccX!<^+@#Xo^e^q?W
z1fQ=YQr7=ex3xFr`t$haz|;HE)Hh%}JoU1;2-oXPL4S9ik3awQ>pSL-Z+@b_Kj_ov
z^XWep_;;e%{UmR7XAR!RKfmuM`rIG%ZYRJ*{i5SOpYoe8c@gLNSHItSKK+FU(}f)W
zHTV_x|HngCf6p^wyE6@u;wAS?xBlMe;m^I?^{{k$HTXAf`M^R-bGf&I|LFhx@O_pK
zI_}r2POjtL1N|F%pZ#5{|8wZK;S{J2GoOZh8YQ2vL%;fmQOJHZ;!a3>yNf#_uf+EG
zH>cl}dl0T^{!ekoKfk_H|1o-fGSmI?BJg)!atS}u2(#P3fAiz@ORavV<G$S*cb@Ji
zZpU|Ee`$96z2)<6X|Lz!IQ$EuA?LHn{6AlA_m8372dmz3COXBR{y9<aa}ZmL?H&m}
z7v$|<--6GXFFclp;jA75fA(if{?huFG{t<b@9W9*x0ksK4d3qIZ$~xT9WRf3ZA+F{
zz~{Uz-(9x;n;rK)r@A6t$IMqbzA1;31jm@e_Q2E6-^n+lKQGDg<xZ#f+xJAzD_>yS
zy$8H{?5{G{L62g+7M>l|gIMTGq22WFO4#ml;OXbN<fZ4u^%|3L@_zJ(Bhnv!<$Qb&
zOE}Bn`M~pD5$pf+Uw+6b(&<6?Z*}$hsV~0deh>Ns+kXH50)>~iIKIjJ9~0L3MfZzu
zckz;_rq3|Wm)y)Sk-r`Ox!?WN<~S$*{7~@!N?w2aLeN`f{CzR#zm?2jJ*)8l=|63}
zJ(=l#DREt4Q|>i+{`X>gZNv6roz+pFSkV6!j{EiP>xr{YLDBBG?<d_K_`82j7IMGz
zf&b{5Pk!F=b!X^(8gZV<c3+R}d(7qMC-V1(dVUk3`{@=B(_cF7eahY*-&caqxZFLT
zyEFp&T#Wl3&Ckkme}(Av?!)#lQUCSO?)UO?`!}|WIa}jmx&IFO7v<^8-T9FBZ@)JR
z`MJgwj&I7PU4iTM2FHD#58OF~Go85H%|ZV~w3g=ZUg*F4*<C+OX1ZTK>$q=sLdMmF
z;PX&ko&Oqm`uq~>DQWg~z9&zAk>kG3vA_NFJ8ip-L4RYO{>{+Oyl3v4RzCoK_?>Mp
zw){r7|NHt+x$((Q+%A9G9NT@-Q_p=@n1LUkcHG@ZI+u*~kGNk#{+Gl#^m*9nJzsul
zmOl!<j!~QX|8m@ot9k1+isP*RyFEWqU-qhW8^t;C=d&F5?ecjE3`4mW2K{4?-|^!Q
zqNhZCOA((P&_Au^4PUkXL-22UVWh0*Zs_lN+mEid`WeSJ<sLqVtPH<=6F!yOBH($#
zV?qC`JpHxqIO^A{`#Dk1cJFfwdVahy%SYTe?s=U%?)i!Or(Wahxg*d23dg;EKB#lK
zt$6)i$9+GX`uevQfWnJ+@cJq_&wLB?7v6Tkn$`D)c7Ko{<}eC<?m6GCNoKlVKJB>o
z&%G^De!ltDpts8S`$NG$eg2C6Cjx(3-unI~_&oOb(8xy`tXswJ`h0HB)Bld+K8HV>
zdiPJQz8(C^KP>x#<<E1Yi?4t3vPhZ#?a;se>&KR?{!#3Y$DWzhf7t20&&XYoWBAT}
z7CvuZf65<QpT7ZrP4C4wTK-SqpZ)obyDk48$Gv~UK%_g|@!L-oEs;;4UFP{B$9)bD
z{p}cfZq&cZ@l83`Nik9X=Ab7{U-!ai`5EUON@*_lPVmeB=$X4Lp8#)My!;W%A1LB~
zpF98a>(&0UsAlK-Dt!L%*oQxDeZK9uyAC~<jP*YT{ri7*1<v52;=)%)|F+urp4;~#
z$GI%M{Oe}N-SaAW{pu}6^w&N=`sdydT{u3hVZ9Dwz1VI~@OkX<#~+*;v+dpq{@Lf;
zxX1DjJMQzLxDGShsw3~iDAtZd?uCBk6H&<Xz`t>Pllec|W$=06qUclQ&YS$y7hiIZ
zhI;VEyxi-~8+<+G?!JPbsQ;hfe_38`7riFx8;7&{s~z|K^MS8@5+h}t-ws~i`?a)_
zx>+|lzA2aPDy;v`z!ARFkza@Xx)f*ath3FHv%dbJEwR19_>%h=+WlXZ8{Y>MUXD2K
z^#?acN}omO+yD3bSFL_4@;QO4XbxJlZu@wj`SY?q71)mD+auqO?f4V;fAjAq?z8?E
zxC5p4DUs`@C%rc2d20QNk6L}b<C}8(^0vzx1OI6vWo|bH{z#twZutN9`cWLg;-a4h
zzxeRpcP3`;mlo&X>pX(>VQzmN^i~;vf93g6U+2yv{6zhCoZkEJInS9mJNHwxd)3L0
z{3lR&`K{Kp4_N**$GuO@pG7)e5?>pF{;|iO{lRa1-s-P)d{gcn31U9Gp#S3^zWlCa
zru*g2puaaSw`;N8PoO=n*Qepr(>MHg*5^U+-j9B6ujM}s{{4CW{|)`OntQN^#id5v
zd6-{cfBoSnwtKBx5zkkv0#5idf6uS)t_a;vuJ2~Y{eC+6vx$!<Gu<yA#&v|h|LrI4
zN7n>>WcFtX_KQC37p!MxQ><s*jiY`df7w&9y`G!pZ$&*Ho!|GfI4AzR6Z~B-_}q^y
z-|R*gzrJ(Lk<$OL(|ca~_Q(&SpUyk(p7X)GG>3l){?<AE{$D|lLD(VYR(7rTxj$Ke
ze6!;|&+qU4Smr$Bwcv+Jesw%q$o(?z#tUEP375B@SpVG^--ch1<^J!+z5d{nvi$m3
zPhS6d(4EJ4eNMK^aL}iJ2f_Lu#(DlB*T4M4dM1PZx(MA*>K_RF!n}6>KJZWF>F>QD
z*0aOa<tO@Ii~h`8I^;id{m<9ma&=aJ;fBboT>tVD^%dA3`(%IosjJ6tmur8tHQDxl
zxsu<H{15)@18?>3IsL}{;@fS8n*NtS|D+3_{$gtV>s5|#%H5rp!*xM#mGSo*v0qfm
ze$kEb|D=rn-NFB!JpXqG{>!9+GW_=Ej{Evg;kY&g{$Qx*vByWh{kp$R7IMEFhrUdX
zgZ~Xa_pzv6K?N7J`So=-AuzGshQMEzSLYiX_xa!c55K`0#|8U?{s(#bC3ijS>py`5
zEc5Sn{oeCqZv5~Q`C<6qf6?z}#>vltKm7WcxBz|*x&G&Umad3^$MHv>68SjBJ^KGW
ze0mP9{G&DcdEl1B-_LtpT;DHV^A2|gmQK$G|L%jo*`89Dze~l}Q}>og`P}K1Sl=D8
zzI8bNJc|8-^<M@5v6po1u>M;e-<11BUd}fMepeoUU*Hes@e%A_Tje}w2JJ5V+v`4P
z+g%7guTK#B$!g#~&GRpF(y-nCBrf8gL-o_;j=Sr@_{ROD&+DLHdQY5n3W@>8eSiDT
z_kQsg$wKazQSiI|=YrJC@lSz2^4v}&9hdsD<C}8#<<<EXjKgJa`}m3d<dLA?oTvYF
z;9rPh_mlOXkAAon{g6J-_=8ygeJ}g~cipgTHQGJw&ZqoDeGT+a+y9gQiF4x5S2(^Y
zw<WKhU*Wo7>=jW*pLX~hX{t$2x}C)T{j=XLtrutY{n0-eQ@LJ~j(a`NDvrg)a`V9-
zZ_LZXMfmsOQ!^69^H}Dz<C}7C$y=|dZ%wl`_PHh;XZbI5xxPPsa;&q=jW>QGe@^gu
z?D6?`z2c2=PW;*E_@>-t2`a;HlNirOF}l$w*VDJNV`pE_=H0pKA-?I@J=ouyyy?ER
zWAL`Vu3U9zKzsLh9_a1r=-JmZ7~c2w?i}ps?7t<vxuI)cSAWm$4#JMU{{6eUGP;hv
zI|p}n2eh-VW8lC*U)R3q?B4cw4IJ3pmFwuZX?Oqb!JWH0e0jU~@7ve4d(hK?!Tti&
zXghlb3d^%I%o4kMyLR?>xElKQ_v~|P($%~3Hf^ei#JIS^y9N^%Sw4TJS<)4@bC(O0
z709xMW}BsV@42C)t523mVV<&M-_E=sg9T^gFVWrEU(mk;GYT%z(KS@09k&!`<}c|w
zSJ?V?JIC@kCx4lpH{4L9K+efurn8Il@>@#h<uBL2|G;380+U(!OLgz>-Blz)%*kKI
zZNtKgU`GBDd%FgAcJ3V9>2|Pzn+h+RC&_p5wRY^ftz&m@PuIR;n=nt4?-Pa)*<<6D
z<Q%ii&dyHuCbK;ZHCnfW7SI}Mw7d83-P<!*K%SjpmWaD*ewWX1qrbuJ_4#T;jkfPV
zA+4cCyL*4%Z3T=iHfkj0N88<Q@E($_Uud>j8rc<Fy3lO1v^Vb`?C5s~g#yi*Ic6De
zY37)1E_2K>*kt{AeKKz2$c;X3u{^oOM(wwlt7vdnudGCNhFQXIw}MM#XP6~!KG4;F
zn_s49UuTzYqx_j>$-SL>!h!`t)>&pLzh(CH7Tq*<mRZVg0Xs`Jj-6$e3T4=NX0g0^
zW;twCx1{8rone-U8!&%?42OPaZ}0xyI|sY`!Ob1nZ|T`>`)HB5rY*miKhf#fy|+{9
z(^;}q=U#W-Qg9(NN0)KQ7g;8qW0o0krwko?2lO~$u~GMT-Ow{I*wx?Bcc8boz+wgG
zo8>#Z3M$NYE}}3ViGw@S+9QGH%`3JX&mK(6nPoZOEN?0+&~kyfW?6q;=T8<ocm`tH
z&6_97-Mo9>?!6uE)UsosCx0^ycI3^M<p+B9-QZ3Qy+NPba(j36?3L7f1w~ZGYjCKe
zQ%@2Trn-*32Xqh&T5_Y`)8EzAF>sTf+*oYXuGRxCiQ5J``g+{;ME2w$f2LV-(4C@p
z?!R?kv4soHH_Q7rLj&5V<)Wu&fko^rS?WNaI|b|NxM85j9ld)83M^beVLWj0(s65N
zPob0w%{EJ?7dgcYiYSan*S>H$Qlx+abIr26SShk_q1k3>H-fv1zhadam}{2Bb!4%H
z3(Yo5`-8l%d0=qopl-9gd9vKV-mbm=x^=MMoi-146<WNI#JKG0-@mhS_s)S>!_5cw
zyL0&duARHP{fUC~peNKC-vhhDO8FJ&+|{>JoC?g%F6#!>j{eTu+>;&IJ=HCknU!5C
z45r1FlbKj@uxqfpV^@Dq=MA{6khWK7R)M9`UTtc%%Vq@y9P)1(*u~9Uv$lThEqIxf
zone;no1)+n*%<|w=s3{V+p|wE?9v6ze6zei+X%O6(oFp=6^lh3_i&RV_2~>*0=spA
zMa&#oX5hAcyF1*Tv%61kw)oOyt}MG#W}5@DUsz|$(ysd!Z8tMdmh1Gp`2IrGnmJ~f
zz1=<W+_7ul4L$qxa93ciS(d}RR~0x`7Mg9APCI)?5rZNM<8f<$k2{Rryw}~6>(MbN
zZ=PAsUvs!qtgin41AXplcjvy&-Y&g6Q&eMo`n&e-zr_y+XSX_=EaNsXxWC_>s>HjE
zMe6c{coCKH+O^XU_cwHO9@wj=R65Hn<@eLBK6h)Tug{&+$*z(=(=6FD;134wd-Sq<
zu*F90?f?w=n>ROg+_FFKPF4QQf=eFQch+Uo*=A|K3cOLAEmY>1W!x&n!4TV{<CdMh
zd7Z7e$T;~nU{yTfe1SOhhvWGE1O2<ZI`;JM-<yA9)wfebC0_nwVQ)vc5xaL+*oXZ^
zwQNIgS6nELgZ(@A4fO5zw;cT4`23Lb1>!KUckh9Y&i#9L_UtRLxXd-nVib2D6Z8#q
z+`4n0zac;1E~g9JLVY5sarG<jhii9PUZ5H?$1Ky|<?h4}#8bq=8@h<Xc<gq2lN;Ln
z>0V)r!UE&qEB7b(Zh!9Cw`YHW>SeB3){QWIVd33wY~0tS7g~j8o27lrw{-On^z3(+
zLWBK<N0NMjaY(O}-B~~wS2}j<<y%pW@#%4gZ|qRGByeMnp8FOT8K=&!#EHG9fYn)4
z#;b6H9sBlo>~c4P^xWzHLv6fy>~KekI7Ae2J*&?6;d+L4(u)erHOuC;;m?S~p{U0C
zxc=1Nb@PFq{;p1chhdMu2fU{z?@q2ip)IO2e!hS9^zH8G-G9Tb1A2oee`e7oox!cL
zI@zTuFb@4g9ew+Ib%!$4YP)vd=05iegIWIVi~jt%W?5fIU*SOu*q?9jb~hKphnH@A
z=f|ZD@pI6<9sBzRa+}+>oLe7$ZV5jx4?i2i&nv>uE5pyL!q3L=^Xl-kzAnDRrR(G3
z^>O+7Xiy&=>Z3({^r(*}_0eTZblHL$qRW=(vL(7~i7s2B%a-V}CAw^hE|*7_%cINX
zSe58<d33ovx?CPzE{`skN0-Z^OG9*Nh%OD$r2&aVmxk!l5M3IgOG9*Nh%Q$|mn)*n
z716~#jqQ`ZBD!1=U9N~OS45X9qRSQ0<;v)CWpueRx?CAuu8b~MMwct2%azgP%II=s
zbh#?JToqleiY`}0m#d=7Rng_D=yFwbxhlF`6<r#mOJj6tj4qAQr7^lRMwiCu(imMD
zqf29SabLOPBe*)cTpeAmjxJY6m#d?T`(yv0j4oG4m#d>oeO<JvuZuqQb<wE4E;`lM
zMXUO{=v7}A&Fbr-TYX)$tFMD!(v9KAj?A9SuFSs7&dlD-?u`Cij}Bdr9$mi$^`TGK
zqf^(TSJ$Ik*P~z8qhr^jXV;@^*Q0OOqjT3^j`c<Nu1Ei_M+dJ*53ffTuSXxRM<=gG
zFRw>8uSY+xZ$N(N>GiIw`z!DMz3$PB_)GX?kH-u5k%qfhHn`uP2XOwaHz!v%Si%t=
z2Y4-(&cQK8X4u1kJ8};8xR0J(Gk&pK_xFcms2L62*)YzRSeT64g#}p$_mNYVJ0&ab
zP(YA%@RyXGUH(auu6?`pQpuH&KmTmYhx-rt>yb4{L|G@4dbVN;O0q8gVC$|%&k{)?
zg?hx3<>ImOWZ5dzBYtR<9|lhn{haJF>BlMgOJ(O}m-8nXw)5pLT}YAjK!0@~9`?B|
z<xZ3HP4Xq1+cvwMXtNtiv2Uasuj7XPoqgTu9@y9A&b~W(-3MtYV|t#1&kB>qH@j@Q
zZgXR5^rwB#zMZ=Vdv56&bURkh-md=C%0H_RZkY@e({}7RurHkHW!GCR!=0!6buTJ=
z0ylGq%O%Apu-tx?XK0j9;8~~xKY@9nMV_#gC)x?}R-wRN;Tj18V1biR-(_|V40MGD
z4XBF`V5OfJ-nQ3dme~im1RKp>mU1rq_~gt$>gPY%vL8p8S#Fr|Pmp9E>qwXM>k^+_
zVJqqFA>88e>lQEa+{b6(a?@YoQSSPEVsVpcH}B(qGtW25OZ#+Zi+h<Hz{6o6-TSx`
za1YBL#(gbCZq%DrT}NfUv@+{qYtpsLJd~HsuK0}`({k~S;8U>ov3(kTL%JI@?sHCe
zBYOXyJ-zO8p>XeLAb0CdH#Y3q-|z0daA*sIhkG7PR>j_XK*U^W-xWF!?Do$9xO)fg
zgJbt`S6;^c=8pRqu0M$kM}2N~tWw@{VtWU=cDuf~zvIT9J$riaIanGQukDN8L`tP;
zKMeOFu@dRf+p)X5Yxhm|c<&|t-o3kB9(yJ4uJ{@8cC|Zq_qWW_R?^)teIg>iDcoT8
zjWa3NKha^`34xgML-i!A^Z_(?KtJHFINd2!M>s4|g5A^^xy|8LYj^ie9XA|spLdJ3
z3y}By&Bv>BDSn&Ota70NyTF)APwk@F{IZWZJz*;ahT(Ku*yjt_I!`eCX8?Pcz3BvT
zv<Nfe7Iqg1*$R2>kFA>Q1qDtc*r-3nb9Y$7b5>X^>?CGf2zUR(lQgC|I|ij2$_Tuf
zH!u8wMw&$IzW!G6!0vrvFZH)kSe~2fKOyIuh`%4m(oeB{i++bFa7&SPegX5L1XkE&
z>;*|<so_o+5%#dSLi=|5`!3cta~Fs+3irRW_6!ai$v~W6WcN;YM&>^~4?AgE2A&|p
z6M$*Ne)AW8WG1Pz*oRNPaf~y(tl~(M?RtKvb{jE$Dl%<89{$|n)P0ud{chgt?j*-&
zF5LL;K6;1`r28j%`*yky#{J`5CS3iD$?SN3#nLC0Zt_pzNDtvr(4J-Z8p31y{;v4o
z&Ktt{Lf3#j(x*K-{Xh}h!Czpy0(~#>Ju^PO#vFY?etao(dyyJ>j*i%Ml|q+WXqA03
zd=g;~R<gdX0Q<y|U)tAX*0N()mrLC}u(NY8-c4r#UZ;;|ab7YsC6Cg1=Qs+v+XViN
z->U4p#W$;0qCfeqzVAT%L^16wJlMKN@LiYMd7HaUn`}dWBnejo-X-tQXLn3{*z>z|
zJg1Ya3f~PcFz~uVP1oMOL4TFaK*Hmd?u3R<FQzNtwv=ly*?aT%5{|anIb3f(IG-B&
z-6wexf$fJAJiTJ>-+61tfcv!7-79v7)t>&F2X@}#cL*+Icf^#UWj@WHh>Ltmag%@g
zXSaJ+r>i48PTJu<g~LOpY0WW&{DBCcMkl>Fxr?7J8q1MQg&LDj;8>*Jwna`$O-~E^
zYiDoAf!=rm8a~7F^FxaGaKnvHVbh~`CXbM$mHGJm-1Hfabe=CH+zeOSc&|uSC)u6C
zkv`oN=E-<7%K4riuCwu6g*Jinf^2{C<1ru8Ps_|aJFPzEJUH|$({n<1$0NCJvCH+(
zow9BFajeL(fLCsALnIGHa%1{@<xv*S3L7f#u*tbk_=uPZ(>H=`%f&NW1JBZOo|h*(
zpB+^)qd1Z@=Ml+fPfv08?CgnuV&+z+YsmdASv)`HD3_im+h%<G7*#ni`RaSza|5^Q
zu`Zmuq)+sxTiwq{A64M0#eFn>Mo)(Q%&nZ+_-^>)^BC0eT;Oawa*-2spH)0cxqWHh
z;67aLWqT0)3!L|xL$jG{Gds%(L%ON`-tQkWi5~_h>s9E(>NLore>rC)>7TJArv7xn
zKee9haM^*o<JKN`))Q`wQ6gso;n|Fy{ksR_hka>le#;hk){-q}H@wZrJ~D6i4&Uxs
z?x47yn|Jf5z(DC%Pyg&AE!lOMvz*bJYgCMlwrX@wJchxw^hFoC%HaG0yL^H5q`J^L
zp5>BJ@BPpwZ>063cnl^y<{F-&pxEsRu4m#I()_{1Z^i@ehTA}&JJR~Q07be<xVuuc
zuOxjxIfqLRJZ`1qQN-S3NN4*3oFv)X(`SXa2Ikt>*N=l}debF7D3SI8Y)Sp|Jldr@
zxg0rh-C*{7E>dW_$v|)ZmW)dkx(@e;PM)M;WALOu|8x&4!m}saTU|x6ALDd~jr&;h
zo?+rlw{)S;nbHXT(wU1+Y1^NMW<Fg=h98{qB=^Sn0YUf!NVyCOkH#0dg~d{12C}7G
z{b%b^$Spaev&Cb*?KK<jvWL4#;kc=-@o#<ns3FI29~7S4F;5g{gFM@Ol<Ho%-?2OJ
zFqORs^zHfD{e6^7n(>sZ*zIY5Mx=i#flZd)fQxtMWaW!JD&&{$b2n7oElPKhmOa82
z8gi2TJLwr1_+(iG;tv$@kDl2P+%{)lN^aW9vi3|e9bnvoc?TALu;SOkRqNAqm)rhE
zs8|-b-(!2z6YfZIe)IozXNxx`{iu%Tl}!lQ-QJbUdBuk>w}!sY_`Z|;=|b8?3kK_h
z@$GZp;Efs2c_lvJ9$-wKr%wI+*nn%|Fh<|Rp6$21+Z6GyHCZ*y(or|L(mb$_*P5>L
z_-BdD%KGE3KM=(0C06Sz;;l4$RbAw76V1tq&qf~g^QJDFyn!Y@&06S;slcO7rU|S>
z!AA(NCxzSUNiuGiHdi{tIK9w*>gq3cgM|?%_YIOY<E{6&jyad6+j!#aBH+<o=j8o`
z5o>g->d(W{ZJPP4;4F`s(;)9Gk28venC=GoSAkeva|PwM_CUPIp)qzk)5Uy0PHzCF
z4R~JYj%U(L`ru#aj5ow@?C?W{f6`ZXfU|t&nAYS^Hr(@dJ%i!+)Y0v(E=;8yGvoc8
zWR36z0pY6;2=yEoAAp7XEyj_byvSI0mUC4fDGqde5ZDLearnXp|3<#YBzw>}`-L`6
zM%+k^=XAM3`sWkm%*5U6^G!!tBZnf_jpAdc=4cdd0Z13;P;7d#UkP^)(hUs#J#NG(
zwsYv1i{6nQZGAE<!z5qiGLWlf{}|MaEroCHAOn2RO^eWQyp;Dv`5XTG-LpQiukY!1
z4?>x8irmLc_Xg9U3Y_~FUOf8<aeCxP&&<<1<JnG9Wc7Kj#5`>STy1=Sk-aAox~J<R
zyLax}?S@-74u-qJ;eJUtq0ZZE$<3F<H|}OUVF`O`xZVy=t6=%0u)L#*$=cqJ$*#8j
z@P+OA(hFRk+dVdH>9by1F*wt|>0hAhTkm4~U3$diI?FEQupbk`*Wj=%KL$GLZrJY+
z4^6vE3->sWzlYLs;PNdUJNx^?w+JP2z13?T9;XI<KYJ0Fw>9%lrtB&fSd~l%iCcM3
zd@3sK#n@PJ4e3|-41~qH!6NKO$zOW<8TMSUz>Sc&{j-0Ak{01=KkK>`K8xU)g6R%i
z0Uuq_T`2q4E?g^Lp`25t;|8`*@>efu>265IA6?<W8P_`o-RA-a_U+n#z}@Y-^=9c&
zz8yLAWOtvmd-=8Sr?svVh7Z`{pN;r~vir-p?B}lb^KO5p>6Qu?16{YcZ}Q>AlszqW
zk+aLEkA@UEbxKD%vo3anr-y!~NvH7Wl)1fVH_#Igx2c=o3p0;d`IPh;G2LEn?fep%
zi~bILO5=yicw*uo&`X!`3*bs1g#|9a)0trqu=nrn+WGCA-jv`UEtsRA7no1rvz@@t
zv`_P-jfVZ4@tW-sx;#eryzgi-&4wfkelUyiCg~P#tNMP|&p*+_9}A^@-|v=kdnkWl
zo`w0?P1@;xgFiS-x3&I#2Iu(Z%q50~op=Ap3i8G*J2PB~yGykEn-}=24pxxvyC!(M
zBgkzwzZ-@_tob|OG(NW_&w8m}a2HL_V0;OC!$_UOYy2=Wd4AMfLip(Lh=g5ne+<uj
z&V<1$3|d@i9$Nj%6u5xK(C9xX!Gy2p%{|?H1ET*b$miqxAgeI{8N#c<FLL}Qe0Qfu
z?(0j#M4xNm<G$uFO!Oh&2ChE*(pCEGgwH|f=|hgMbIhp^zonHv2jO!>e8`U$sb|gb
zgJyl3@QsnaUCX<{eY@#@2gv1m!7mnm$mo5E_n^*E;a>$G17{A@j|-=M5?u3{GXB0!
z_ch32ng)N4d$oMV=zS^QKt24wsmz(}9)+HDQa>x4djEg!{G@d*n|5uU{Qh9g^Ni8^
z5}D7s@KdNihi@EZoz#~Ir@j<i>*W7m<#uPD{(GeTq<L0?GdJc_C7kV6gR@TRYlKr@
z3$Asx8h@K-8@T4#ZS*$JUg3`;&pvS0$vg*zQ$Gx@b^7lI_LJs$2wd|VHF{qP^BEJ)
zcE`b4C-oD;sh<SbI{p7^@DuBd?{c|0aLses=xv@W!YlB7z$d_2C-Xchocc9zt@E_;
zxBK-OaLsew=xv@k_r1Y>V!vg(CE%=+d2SF+eJQxsS!4Wd|EvYqJX?+4=Gi9v#mI9j
zIO}Ad+k{iU9bD_|H2yZvZg9=B*XV7YeZtx9AUNw}o<qW^9|qStCyc+%a}r$hoHcrz
z=bZ3n<mvzKwx3uh^IQ;4{Svs=dEEHhJeR>W&lRJ$d7co?c29z{PUg8Pocc9zt#bqZ
zAAs)frQn)pjnUgYYlZ(l@~i`Aoy@aAIQ327T4#&#w|TaLYo2XJZ}Z$Lob7G{XPwNm
zT{!jI!L`mI<8S-tFu3M9Ve~f7N#Sono`=C%C-a;VPW=qH)_K(U+dOB%HP1Ptw|UMB
zXS)mFtdn^z3a5SvT<csl{x;7waLscA&S^QGGavtdMg2tHgFMT?Sts@7!l|zW*E*|>
zzs<7-T=T3odYfmRaJJh3&N`WAqj2i|_qzK@>ufjvHqY(gn&*(w+x|H$d>DE1+JSX4
z&k^X!sUHQ`I{p8D@e{`-o_|h&Yo3!vZ}U7Xob675vmWL-Eu8upaIJIE_}e^}z%|cR
zqqljk2_HqCr@&b!^E@q_`gL%vv&1)6AkPipnrEre`(K$)nQ*pS4$eBMuMkdsCAikv
zX#8!SP2iemyV3h!na_6NlgM)iIP0XoQ#kd#;9BRP@wfZ?5V+<!Z1nzD=ELiCj!SHJ
z1bWs<{UPDhkAiER)8O2XT+?Bi0oObijo$yte3pdYk35fovrg)d3#WbsT<bh({B54A
z;F{-}(fePS53d)QC)+&@J?o_YjBx7L!L?4F?`xiw$V2mN1ZO?Wr%Cu%@t)^vtdsf{
z%qOS54P5KoX8diQ?ckc{cB8j>?hwv)JHc5G^Ys6R$WP?d_kwGkhm617-#Jcbp3_F}
z>tsGN!oQ98NASves6Q&4`Z;i|a{-*&oyVg^aLsec=xv_IgtOh_;H;B*E(@oA1zhVq
zWBhHN>)@Ja1y)4+XQl8*uzVFb>tvqQ!l|zX*E$=FzwMum;F@QX(c3(mg|pojaMsB@
zTZL2K2Cj8>8-JT;FSzD;$mnhV92Ndw$a4&wbu!O!;nYupYn@ZZ-{v_Du6fQFz0LE8
zaJG9CoOLqKS>e>rfoq-1#^2_-0<L+UF?yTly6{bSpL74W$WN@3d6o#Lz7$;REC<*9
zy#ieGtTcL?XO(caTMf=SnP-h~>TAKZ&Q{}Z^K1jxJiCqF=GiO!66Dzj&N`Xrpm6Gk
z!L?5R|GxdCc^(4SJV%Y*<~b&u?T&-9PUblwocc*{t#j7++dSvMHP2<Ew|TAze+lwD
z0nR#^=SktzuYqfwr;Wee-_L++p6f<$^US&bJIU?hIomA(XPwM*gK+9g!L`mB<8Sk<
z1=l=Vjo#+jCj4sTxfPssGS6+osoxH+b#@wmn`bw;=GklXHqSocY<Ccxbu!N(;nWX<
zYn>Cu-{v_9u6fQHz0Gq@IFF0-;H;B*E(oW730&(uZv1VY%ix;liqYFVPY7qbC&5`K
z^IR29{TjH|xxxKkOZI=8XDPVmS!47z&syQvp?}tavrgvOAe{OpaILe&_}e^N!8Ok|
zqqli(70!0IfwNBL*)E*=?ciGHkny*94ufl+6Gm_IoD{wbc^(F5oy>DeIQ28&TIW&Y
zZ}Xf5*F5Kp-sU+kob4`vvrgu@D4hBwaIJII_}e_!z%|berD=b*d6o*_hdj%`Sts)>
z7fyX8xYk*1{B52!;F@Qx(c3)hgtOfSaMsB@8--Kf1g>?q8-JVUc5uye$mngJ!@}Q&
zJP(4iPUblxocd94t#jP?+dL=0HP1<-w|O2G&UUB3Sts+H7Eb*PxYoI7{B52~;F{;E
z(c3)Ng!8)S6gcZ-o~MOVzYeZ-mTXM-3!CQ#aLu#S=xv^5!r5*)IO}Ad6~d{n1lKwn
zjla#a30(7RH+q}rcHy5y|J(u2I+<suaO!)(wa!7~Z}S`i*F1-f-sX8wINKcoXPwOR
zkZ|fp!L`n5<8Skv0oObijo#+DB>eNp^B6emWS+-`Q@;YPb)Gc-HqTXX&2!D@ZJwuu
zv)$9+tdn`35l;O&xYk+W{@<~mcpVqt<#LtanrEZY+dP|ue;s)?gR@TN*&>|!HgK(T
zoAI}Kwu5V)+l}7lxkEVH?F46?%(GiK^}XO)=ON>7`{yXQ<~eQjHqRO1-$kBBz*#5r
zJSv>}IdHAh|DS6=al6Alw+OCzE*ZVe^O$h9dmNl~GS6k<)USYRoo9@{&2t@G^Q?Gk
zx?VQVO5rE4!d2j`lX+GPr@j_k>ufOowtqH)Yo1L;Z}V&x&URbCSts*s6;6E{xYpTi
z{B54S;F{+lqqljE3jaCs90O;a%yV2g^^@RQ=alicc}|0Co-;;o^E@J)?H&bZoy>Dq
zIQ4VjTIaIyw|TCBYo2F}-sZV3{5RYo@sHP8C-W>3PJJo3)>#g&`+Ehr=2>a<HqR>I
zY_}Smbu!Ny;ndfHYn`pe-{#o{u6cGFz0I>%_$J&h>jP(<%yUpU^~2y==ZNvQ{qqpG
z<~eHgHqSBPY<C=-bu!Nh;nYupYn`*k-{v_7u6ZsSz0Gq)`16qG32@fQJWmRzehpmf
zJZ=1Ko@c-{&vm1>dFD1{$A7k40?s;_=LX@_mx61ZHOAlOSqrXtwi><7vrYKr$a5<=
z>tvqWgj2sAT<h#K{x;8UaLu#V=xv^T!rAU1IO}AdL&B*a2G=?#jK9ru5?u3~HF}%p
zobVRpIS<Y{ndgFV>X*Q^&f~`4=D7^6d9E0}&GUqCwtEtsbu!OY;nc5zYn>aOmiB*}
zXDPVmS!47z&syQvA<sH+*2z2@gj3%Hu64E;f1773xaQer^fu3}!rAUNaMsB@+l5oV
z9bD@iGX6HtVQ|fJ!su<Dlft`@=V5Tx$vmfoQ$GW)bsjbTHqTjb&2!G^ZJzVO+3o^3
z>tvpb!l_>Z*E&~?zs++ET=U%U^t3<QJWGWSAkQ*z*2z4}g;QS%u60%$f176wxaL`F
z^fu2r;cT}7oOLqKM&Z;qfoq-Z#^2_-9bEGqGJ2cmu<$=Yo(I8MC-WQ;PW>pj);Vtc
zZJrb0n&+g^+dK~oXS-A2tdn_83#WbtT<csk{x;7gaLseo=xv^B!uh%NDR9=wJWmU!
zejQxvEGbX-3!CQ#aLu#S=xv^5!r5*)IO}Ad6~d{n1lKwnjla#a30(7RH+q}rcHz_L
zpF6-=C-dwSPJJ)9);VbWZJtBmn&+_5+dK~nXS*Zdtdn^j5>EXnxYjvs{B52y;F{;6
z(c3(igwG<+W8kclc^(%|{R+6&dD8gXJXgUr&o!gBd7cu^c29$|PUd+=IQ8q`T4%*G
zvinhd=k9-kYo3ipZ}V&t{&nQp49+^4XNz#^+rYKXZN}f`*$%FGZZ~?H=MLd)w-cOo
zGS6<|)c1mGorjFS?VqFIn&-69+dOB4{}b{&0?s;_=TYI*&w*>53&!8(xd^U#E*ZVe
z^O$h9dmNl~GS6k<)USYRoo9@{&2t@G^Q?Gg+MjKnmBRl6c~*h5PUcxHocdaDt+T=S
z+dLb=HP0raw|O=TXS*%ntdn`R3a7peT<h#M{x;8EaLx0O(c3&ng`bD#QO3YoC-WQ^
zPW>df);VSTZJyKMn&*ts+dPj5XS+wiSts+H6;AyexYoIB{B52q;F{+dqqljk3%>|?
z=AIS%GwWoYCBmsM1=l*u!Sn8af@_|YMsM@163%w3!C5EstPxIqEx6X%YW!`UZQz<`
zx6#`?dxgIgdG>*`PUbl%ocdvKt#icq+x~e7T=N_?dYk8%aJD-R&N`XrgmCI7!L`m=
z<8Skv1J^v4jo#+DBK%dz^8`5SWS%F5Q@;kTb)Gi<HqSHQn&-OF+dOj>+3}z4mVmQP
z=D9&Q^`+oiXN~c<dDen!o^3{N^V}-@&B${bIO}Ad?ZT<w0j_m+8-JT;FSzE}XY@AD
zLE&t72%L2?&tc)z9|YGrCyl?&^DwyPIcM}X&w1ek$a4Xlbu!OI;nW`k*E*Mtzs++6
zT=P6(^fu3v!rAUBIO}AdYr?5N1+I0L{&w2`ZJuS|nrE%i+dS)pza4otfU{2K*(jX)
zW^k>u)%e>y+rTx?twwM2+$Nmuwu7@y=DA%s^*g||&SB$k^E?Qyc}^O=&GWGE_ae_J
zaMsB@r-f601YGN!GyXQud2r2h!RT$Ci^AFN5;*H*p2vh!e;i!vTr>VQ&r{%<XX&%k
z{%rFs6VB(z%fVSE^Q;g~eHFOYS!4Wdp0(hbXPwd8JR5|w-9~WM$vm5cQ{N1(b#6EQ
zHqRa4n&+_5+dK~n{|x%)2srCxo`-}}KL)OKP8ffi=Ono1dD!S}o>Riv?ld^-WS%p^
zsXqd)buJlyo98ib&GVGe+dNMT{~Gc<1I{{`=els}OD>B2U+XLd*Yo)@aLu#a=xv@A
z!r5*mIO}AdRl=#S2G=^9jla#a1zhvoVe~f7PT}81p55TAlX><Er+yGz>l`-zwtpT3
z*E~mz-sX8oINKcsXPwM*OgQ!9;9BPq<8Sjk3a)t`GkTlnapC;Clx1+%$vjttQ-2a%
z>s&MbHqTSwn&)Yww|Sls&UV+qSts+%;R_SVsV@Q7I;+6BAH}^bm#YTXJe!T)=Gh|r
z4Ekp)IO}1aZNjPF2Cj8(H~u!y9pIX0r_tLyyM?peUU1gQJo|)GKM1aMjv0U3KgYo}
z&m%@}^E@hiBmO>Q7Myi5&pF}LFMw;EOUB>kc??|hJZ|(h&t>6kcLkhvGS3sjsXqy>
zb>^Ovp8wc9OTabHDx<e~RtvurdDeilPUcxFocacEt+UDa+dP}WHP05Kw|TY-XS;3S
ztdn_e6;Ay&aILe?_}e@O!8Ok@qqljE3%?q9PJpvc<~b>x`YCX&bH@1FJdc2Do=1(|
z<~b{z?aqO-PUbl;ocaZDt@DKOw|Slf*F19<r~TRHSt9)P$a4cY>tvp#!l^F@*E%bW
zzs<7>T=T3pdYfmBaJE|u&N`WAop9<Kz_re;#^2_-4P5i=GkTlnpzvMDa|oPuGS6Y*
z)Q^B`oukIz<~atgd5#;s&2vIH+noewoy_yFaO$VPwa$6tZ}VIL*E~-cz0LEa@LQ4R
zDmd$8o@>IXKMk&Rt{Z=wXYRRif6+Wk!2NlP&2xirwp$9$I+<sgaO%s!waz-@Z}V&b
z*F3ixz0Gr*@OLB6c5v3oJhuy{z7t&Q>^1&2&pvR?bI|B*o<qXf?l3s(WS$3wQ$GT(
zbsjeUHqR+=&2!%9ZJrCl??s-A;H;B*E(xdpIJnliV*G8MC%`q&lSXgzToulC*T7jP
z^E@S-`qSWAXIWKxe6e|!gKM63MsM?M5YE4UZUkqY%(F>2^)299XPfc2d2R*QJhvIW
z&9hxN+uaV%I+^DV;na76Yn=y;zs++5T=P6^^fu2a;mhcs)8MR=dCmx@{wTQCIcNNB
zp7Y?E=YrAOJQszt-6e3=$vlq<r~Wv&)_KbK+dNN$Yo2A7<if;pp81pu{|WM}0B4=l
zR|==T8eHqFHU2iwI&jUi!RT$Cjl$V(6FBQ+p3TCkZvodjcNl-0XD7JkdC=%>{~Qs%
zjyw;6vrgtYDxCUpaIJIF_}e@WgKM5sMsM?+7S48Oz*#5rJR+R>qu^TSG2?IZJPxjT
zo-%ry=V{>^@ptTJz*#5rTo+D#$@60W*E&nVdEX}ab1`tuv)t%yo)yB`ZY4PDWS&*R
zsjmjtI-8BZ&9enu^W0(dHqTDs{C<jVaMsB@dxcX!2(EPw8-LqB4}xo+BSvrYJS3d$
zj)JpJ<~b&u`f+fr^N8`cc^(DVJdYc_&2w2ezjtE=oOLqK6T+!q1=l)H8-JVU8F0;W
z-RNzex#wrcf3{l!&N`Xr2I16~f@_`C#^2^y1Fm_t7`@H2RrqVMzqf(2PUg8)IQ8w|
zTIUYqZ}aQ~*F3w8-sagWobC33vrgtYD4hBsaIJIP_}e@uz%|b!MsM>xD*QU+ISbA@
zndh8v>KDMZ&L!h-^E?Kwc^)@<o9D7{wz~q(I+^DQ;nbf5*E&n8)BbPs+yJh5RvW#|
zvqpF?@~j1Coy@aNIQ5O-T4%HIw|TaJYo4t}Z}V&u&UUwgvrgu@O*r-K;9BRP@wa&n
zfoq=QMsM?+5Plo-oCIf`%=55t>ZifA&LhU(=6Muc^PDw$o9CQxwmT2bI+^E!aOxMq
zwa$~q-{!dru6dSRn)YX#=LX@2kY_14>tvo~!l|zS*E*|=zs<86T=T3kdYfmhaJE|q
z&N`WAgK+8_!L`n9#^2`I4z76)8okYPNcaTu90q5d%=4gd>JNcyonyw|<~a_oc}^I;
z&2v&X+dT}<I+^E`aO$VQwax|OZ}VIP*E~-ez0Gq~_zdz~181Gg^OSJv&wy*4xy#c1
z!sb~5u6b@SdS55=DHYCk%fMMD_2t5;uK?FN8;rlrvk_eL+-CIWyE>UqyYR0e&+Xu>
zllmRPsqY5YI{S>j&2tc3^Bgkz^G%+^!rAUYaMsB@M}$*<2wdx&GX6HtX>iSR!RXI7
zc`ge7F7jLgXPwORm~iTs!L`nl#^2_-3a)vs8U6Vt&r`zL?rCt=$vn>pr+yt=>nwkP
zYs^i&E{^YVxe9R2v%%=kcVgz#DEwcMXA?N<q`p}=^{wDq=T_ry^V|lmdA1w9uao&~
z7tVHffU{2OJB3r<4X$;L7=PP84}oi*Q$}y|oEH9H$a4mqbu!N*!l|DH*E;8ozs++2
zT=QHsdYk8xaJG94oOLqK<HD(52G=@I8-JVU8F0<Bye9Twz5iJuycFN>Rte5JnP-)7
z>TAHY&N}07^K1auJR6PP=Gi2i?KXq6PUhJnocdO9t+Uhk+dR9$HP3@aZ~Nzn@M`3F
z2%L2?&r#vjkArKSlg8iXc^F*toHBZw=d^IPI|I%-ndcGV)E@=cI*%KFo98mP=6Txa
zZJuX@zXEx#gR@TNnR{XE=j7CH0M|Opz&Xxuh>PdS!8Okcqqlih3TL}j;H-yvRtu-T
z23+fGG5$8sR&dR8htb<SJB43|JiEbJC-dwTPW>Rb);VnaZT~z7u6d3az0LEGaJD-N
z&N`Xrm~iUH!L`n##^2^S3$A${H+q}rvhY6SxdP5Qndb@N)USeTou`by&GR(4=6S~G
zZJz7G*>3Jd+5LrimI$YQ1Gv^%4bJ@tyHTzNT=Q%(dYfmf@Q)zRHgL^zt8nVu!L`mE
z#^2`I39fl|8@<i5S2)}4181Ggb5J<-L*QEHxbe6Ba{^rRJZkhd&spJrgFNTJSttAF
zym0Cl!L`m~#^2_799;8UHhP=qig31j0-SX+&y&KbUj^4XOI{p%r1sAZ;F@Q((c3(0
zg!6lQYr$D3^Q;q2eIvNm*=+o6o-N>-XRFcMJllk`-L2rPlX-3vPJKJL);VbWZT}ns
z*F49K-sU+W{4w;;NpRN5JP!+}ei~fsJYxK9o=3qo&sn3ldCm!EyYt|zlX)%(r+yJ!
z>pW@vZJw*(nrBIE+MjKn8-$nP`)y0XSts)>6Ha{vxYk)^{B54q;F@QR(c3(0g|po{
zaMsB@8-!Ee2(EQ*GyXQuc5uye(CBTRL&9H*Jcq$qC-XcgoccrHTIaa&w|P#0Yo3!v
zZ}U7Xob675vrgtYEu8upaIJH}_}e@e!8OlSqqljk32#E4r@&b!^E@q_`gL%vbHhv0
z{ley13a)vU8NJQ3TsYgU0B4=dvr;(qRp44@qw%+SHi2uN?M83&+%Eij<hcW!bu!OR
z;neqnYn_9}-{v_4u6Yg{z0LEWaJD-F&N`XrA>q`If@_`A#^2^S1Fm^48okYPN%$c0
zJO<7>ndfog)USYRohOaI&2tr8^IS7}o98LvZ1*%c>tvp1gj2r`u60&y&hAI?o%=p3
zaLu#P=xv@&!ry;kbZQ1?oy@aEIQ4DdTIV)!p4ajEy&YWh+-~$X&mF?qZYMbFWS-r^
zsqY2XIu99t+doIaHP0!dw|PzrKYC%za|WDsGS4Hzsh<VcI_JSP&joPJbJ6H+o=d{n
z?lExI$vlq>r+yh+>pWxpZJz7knrGEZ)BbGptQOAyPf!ESI+<s!aOxYtwazBvZ}<0R
zaLu#D=xv^@!r5*cIO}AdTZL1<4P5K&GyXQuL2%7;%;;^N<HG;_!kGI6IO}AdlftQ=
z0@pfcjK9tE2)O2X)aY%Vv%=Z#960M_p7X+~UjWxSPZ)oj=SgtQGgnu*f0hW}_|&M|
z0M0s@XQ^=N%fYqIO5<<ytOD0OtBu~~StFe7)`GK6=2<74`UY^VbF1;Ud2R#OJo}8^
z_Rm4#mm<$0aMsB@hlNu=0<LwA8h@MT7`Wy+ZuB<K3E^ya5}b81&%?s0p90r9=Z(M3
za{*lQJYn=U&y&KhK%T4Mtdn`J38(%vxYn7gPxlL(X9>9Gxxwgdo~6RsZW%c1WS-^1
zsjmRnI_r$T&9ebq^W19mHqULs`F~m3!C5Es+%BB@PH?TW*ZA8!`@l8NL8G^M4hd(w
z!{Drwc^(u_{Rp_$dD!^dJg2}l&v~P_c`gX=K>u6>XPwM*NjUY#!L`m6<8Sjk0j_zT
zG<uuos&KZu2F^N}=PBXTp9a@D%eG|qqxdeDD+kv+>x|y!*&w_hc{YNxPUhJpocb1U
zt+UPe+dQ{|Yo6PT-sagZob7H0XPwM*hj8jU!L`nV#^3hO5pd0O%IIyL)51rP=L|UO
zWS&QaQ$Gu?b<P`qo96<!=DBF}HqRyDZ1)&A>tvqCg;T!_u63R^{x;7u;F@Ro<!OJm
zc~&S#o|WLNlX+GthrR|}>#Q^WHqQod&9l+yZJtfS??JoG;H;B*wg{)b6<q7=H2yZv
zZg9<W#OQ6FhlGC#b&i6wPUbl#ocalHt@E()w|P#1Yo60aZ}XfH&UTN0vrguDR5<ms
z;9BQ#<8Sj^2G=}K8@<i*jPQR%p6lSOlX>PEVm~LRegnAHSq`q(?-k&hXQk2GJgbDW
z-D+^w!#rz*Q(p_Nb+#CPn`bMy=GkfVHqUP1tH`q#oOLqKKH=04foq)yjlb=mBjB3n
zA)~i>jtXbHW8kcld5#OGega(UJZk)Hp0nVZ=V}rCS`qz*D+-UdrNV!W{L8?(Ud+E-
zIQ5m_x?VNL-{xNnuKCv)z0JQtINNOmXPwNyNjUY*;96(9@wfSJ2iN?EjNbO=Vc{2+
z#oP~qvrgtYBAohBaIJH~_}e@u!8OmrMsM?+63%v~!C5EsoDoj_5pb<@-uT-(7r?d7
z<D!qL<#Nm5n*W9?)BbF?S1GvaYmDA*uUg^H$M&iNXAaz64Z^8!0@oZ`jK9sH6<l*@
zGkUwdwhCvv+rU{Tw^zGx>bHYyokPao<~a<mc}^I;&2v)t%aG?`aMsB@r-V~K1Fm%*
zHU2iwS#ZsB&ggBP^TOHg0yyhro{Pe%Ujo-USB<~Ta}8Ycth}mlf35;oeUs7K{F{Ye
zhx}W>xn9h_RXFuq!F9dbjla!*JGkb*!{}}Pox<5}H#qBL{=LGf?*rF5M~%PDe+*pn
zoH2Tv=Mmw1k>^ox*2z3)g;PHdu5~UNf1BqLxaN7x=xv_Ig|ppdaMsB@SA<i40$l4{
zH~u!yTx0CFnr9`rKaaI}Rtdioc~*n7PUcx7occO&t+Ubi+dP}VHP2?Fw|TY*XS=Q7
ztdn`R38#K5xYpTg{B53n;F{;C(c3)7gx`xi$H7@A^PCV){b6vebK3aZJZHc)&m%@}
z^E@h??aqR;PUbl$oceiit#ifr+dNNzYo6;yZ}ZGuosPqvKY%<-z*#5r+#sC#GH|W4
z!uZ=fE5S9-Dx<e~RtsmlHQ=n1dDaT2z7AaLY%~5g&#mB^XRp!QJo|({j64UySts)x
z5>EX=aIN!@@wa)7f@_{*MsM>R7tVGkz*#5roD@#|VQ{T;&iLCr=fO44Q$_Tri|ET<
zmhHF9vt0PUApZ(*t{3%{!l|zY*Y&D3{x<(QaLvEL=xzRu!r5*UIO}Bo&BCc~0oOV^
zjsI`CsAgkaxo+cQ`JmDJIxpQ67Z@^n%MTg7-M*vXx_zgO-up2B8R1u;-6P=4f%>Du
zsh<Pa92Shf-Cm2}y1kZ+-fpjB!rAU|aMsD~wJe<a6>zQdjPbX5u7hiy6)%t5N6$AZ
zh5rHatO949%(GfJ^|jzyXQT1Ac{YJ-p3O#Y^K22$c3Z(&C-ZC*PW@JJt+U(s+dO;0
zHP1svZ~Nz{@Eeim7&z->p5wx)p9I%Br;WeOa|T@VJYw`V&!fWG?kqU#WS(=vsh<be
zI+u;V&2t4@^E_kpHqUk8cOlPQQ|!;IlX;d1r@j<i>nsP)yPpiMc~%;|&9h24+pPv?
zoy@aFIQ6yQT4$^Aw|TaKYo6UkZ}aRGejoDe181Ggb5J<-!{A!yi1D}m^ANb^IcoGa
z&oSX_cO0B`GS3O&)K7wIowLT@<~awhc`h5h&2vTgBJw-|&N`XrN#WG5foq+ojla$F
z47ldGZuB<K+$*x<Kie$<XPwM*gK+9g!L`mB<8Sk<1=l=Vjo#+jCVT~XZUtwZ%yXM?
z>bHYyot?(t=GhIddG;E;&9hH9+Z_aFoy>DcIQ7HeTIYoEw|P#2Yo4=4Z}XfJ{!8RJ
z56(K7=YnwRm%z2o<Hq0SxeTs(t{A<|^Mr7=dlH;=GS5}v)USbSof}@6_J5maDY)iY
zWArx9TH)nSi@tT>tdn^*2&cXYT<dHx{x;86aLu#L=xv@`g|ppl;H;B*whO0zJGj<4
zWc+QO!{D0dgwfkPCxyQNc^(F5oy>DeIQ28&TIW&YZ}Xf5*F5Kp-sU+kob4`vvrgu@
zD4hBwaIJGy{9lP2*2IVWR1u$&-znVBH-PJQsWy7MU225)qn=uDt}nMsop9<K!F7F`
zjlbP4E#SIcT8-Xrmp0*ScPlvS<aXI6oceZft#i=$+kQR-u6d3dz0Gq%_#Mb|5}b81
z&%?s0p9a@Dj~aiQ=PbD9IcM}X&w1f&cLAJrGS5Zf)GvW+ohOaI&2tr8^DJpj`?Jk+
zgYdhNXDK-AWS(WhsjmRnI;)Jo&9fR@^Q<v?n`f<Xwp$0zI+<sKaOxYuwa#tE-{#p4
zu6Yg`z0Gq-_+KE;VQ|*TJP!(|{t&p<IcEHAp5x$}=Y-MQJST;--NWFllX*@Fr+yk-
z>s&DYHqS+H&GV$u`#PD=s_;eRxdzTUsXry0`ZM5KXYN(GFzIz`3ApCD!RURR%%@a1
z+bsiUoz#~Lr@jJQ>ufUqHqT~o&9hDP{Cl^p;JRMDMSS{<Pt`fOT-muXuR(CXUX~Ao
z`}!x(i(3D41l;Gm*#*~*S%<)V{gzLFd!N59Nqr`b-sUh3uG?|OaKF92kN$H6+}H1Y
zn9otet$rTd*Ygi%y^ewVcD?>5@IMaD?M}W7uG@D7+~;7|>x9vdnjB6R(Vr^9PlNk9
z?e;nYuG=wpP0T#3uW7d&oa@{0^r))<=lYUY8lRg?Znfg`4EWTE4|ziopLXM8bK4HC
zc@7!9-(DOyhJ{~;dJckfy{I1%PW>pjZr^d^@9SiLn*i7Sank60og6m~3un7i;H;DS
zY2nn*fNPzL#^2_-1g?3m8okYPO?VgbJO$1=ndfQY)UShUoh82;`<?FZ8^ATsQlqzd
zmI-IO<>0K7c~%Igz7kyPY%%_CHTzL3xX;t_Hlz3X<72ekHlw$^6Wq7^GqZp77U9Fj
z-{<hmi(-xk!MVQVheZDfw&SSqd%(xUhx&2h)K7wIZifxG>or}3&wz7W`Zek~BAo3W
z1?T!wKP#O2d2nCnJtpS`!;cxhRD>S`*E)|2XS>VbTIY&z>Q91eou`cdZ@EqGj{$x<
zZG0?WH~P>|%A-El5?@(A+bscSozH}RgK+B0z_reD!)>0GMR+YZ>tVmG15fHfKW{X8
zyS`0EZ+VN++Z<YjbG_P(kJWD#PJKJL=FlzvFF>BX!s*i|{?rc&r+ygRw`-5f2MxFT
z-Jv3U44nC2i#o@Jv)u`BZWrn&g;PHTuK7$GZu`lRB77EH>zotLcIUyh&IRGrFM(^F
z%iuh2ay&m_^hZmuZ@HI~MfB@N{~0sRl)gGH>)Ty4J{90x-@nFosT9uotH8Ow)K?3q
zz7|~jPo3em|1=iiP2jBaC#bVoINNOjXPwly3a5T6xNetihTHzLy$Ig{u61?_XS?0t
zT4%3t>IcEK&SCMt3HclpPM;C+r~Z&|>c_x!JB}M}x8r0Hei)qjd=Pa`31_?0;LL~m
z8R66)1=oCL4Y%8Iz6f6c*E$!4v)v_dt@D_0>X*T_&XeFe4xBRjcC-JkgR{<OJp*IJ
zYvL<8+bscSoz!m-PJJ1;ZufG-?RKv$!mGep&#O^qwQ#mu1I{|BuN6*x1GwhdXt>?(
z%|&<%xYpS!ob9%OYn@w#Q{N7*b?z|yn`ZlVf@^>1Gx~k!VVk>`LBs8K87{&Pf^&Uu
z#&#JI&iW65bA72F6;AyGxUTP{;dZ-B72(t1TIY;#wtECz>pUu)`gw4zb5Z;UaJ{f3
zoIc0IpZep%sb2y2?b`FJ6NcOExLSm-fis`aqs~*p+3sm@=0p7%;ne3|8~d2%Q)0N?
zj-^F-8MxM2E}ZRFfNPzV!l|z{KK6RK0bH-6+rj;M{n+kz#^-#u>bzd)24_9weMWDu
z3kHqe@^PcLbxwe5os&jyuj{9b-tr^he!Xn}nJvN>jK5vqMQ~l;V@7Y+>$uTdzGC#j
zAIJR@!bdUwoHRaGzbc&iQ{dV^PaAIg=Xw#op*8k%_D^o#QgF?o-01E4Rv5kIRYq^u
zt6DhMtH$_PeXVfn8^AS(MsPijG#kCWzGx|;-){8w`l1t@xqSlLv0FIn>;-3@)b|Oe
zehA#JmmMdE4Y&P#qzFF*&N{z=I!A@G-7#?1N&UF+|Hs!Iz*Sb2T?4-w8Y&hhDJmK!
zDk>@&DH<voDJmKo85t=R85vFFi;77`iiwJbhK5E;hDnKuN=ZdYNlJx9MT$v9g@#Fn
zg+@mDvFEJiEY`<{-}^elpEb{Z&ffc;bMC!B%=f^3{(HrBANEIl0PcMbnseMCxc511
z&ip9c`<xWl`;Zwp`*|MoHfzrMb8z;<{Jc5yi*R4xC2?Kfm58TKTKo9jdza+%G;@xd
z4riatXP7ge1^0Q&7T5L7jd&iM^T~1Z%{guX-1{svXTA*XkM~M==>J`E-&g}@Kkvf4
z)ta+@9i06zUvJKQBiz@wNnF>rCE~4c_SuR)+srv`JDhzo-(k*t7u?skTU^(-H{yM8
z@3Y^W;|{>R&p~tMhvDAm2;A3wT=JV_-6zC#{-+{74d-$3{(r`tea^ypT+GjzGrtJ;
z<608e`Co~6>g2WO0gjty&T-S>-e-n6^Vx9kGe_#{eO(^h@9WAXAFl6wzEEM#aVz2M
zlldxh=4;@gPrYu|itD=9N4x>fb?5ViMstqa1ZSVjH=8rx3itVJ6W4X`h<GR5`|L93
zxZQB?v&WqIKDhTeD6Y>VX5pb9y+5CW`{Q(3>gc+pPD%E27*{<F9_s6TW(GVQmwJ}u
zH{Va<{f=zOs~1P|C6Roo<^PkD^j&8DXLz~QVZOqg`6{^2f3>*oliG+kz`0L&pWg`Q
zexSEVUgxt_^6DLtd}k!zD|wy&KFO>1Tb}baV9t3Pv^vZWnKM5E_jw+L`@S8QygrYZ
zh~(!bKO@(pg-Cuy@|z@|s#yPVksk33IM<!mg-mnKLl&I-f%$B6=JVh_Z~5Z7KMNyX
z1ou9R%{guf-1{swXTAdNeb!rjUSAr_S*OwJGv8#+d<#5`tJkAeaXr7aN4x{h`Qi1Y
z)12dW!8t$7cbhZc3-|fy6W4Vdi1;Af`y4XoxWjPobHtqaF}U}ceQNT!2;=H~NDkcZ
zLvkgr*QtETtCzsTxVm0t5wDc`dLFBS^LTl_t(Cl<SL-CN-WbU@Me=Qu*M8b1uijyK
zo<BRyGxtp9z02w_-)+u(FWlF$PkhaOi})~{`;GHC0{3|ym%PsBgyhwyBl(#~enIj&
zpNo=LU$Q*sZP}djwqkXdPo0*m1CN*abhyuR2HdY}S(4Z5T6QE~Bze8A6-V;rlGp26
zRU}_0d42t@UR)oKjS+8w`#x!fbKbarIwY_Ap;PkeJ&}BGBtIy5-48>OS0A=~0UmcF
z=3MtttHb=5Ir9^6-zSse`goj<_#E8lc^>Zbyd-&@&t=K0r@d>-d0sso9_p)SOJ3(Q
zNAl{qmgl_XnRDLqtq$`A=FAtteV)t2PmuRzD#dl5S4X@K?(<&{_xW#<yv|#*<kdSQ
zuk+R^dG&6|Yn>j+s}D$C>kLX>eaP~|cw7vdbN)xH4)det%um35y(Y!iJT4+W2lsWE
zhx@uLNnYn?S@P;>m668<{QrAgNM7eNNAl{qmgl_XnRDLqtq$`A=FAtveV$9jb^n(~
zyaLX7=JS_IbB<dD=lnBYZO(ih-21E-*Zt5K@g}(U*=){nTj1Vjt2y%>aPPBI>g#=S
zH{9=&M<uWOZ4B=FYC`g1|5V}eIBCv4r=*VNr_Gt4g@@zP=Tmdyx=$7&z6|I5^SZwR
z=RDKXPLDjk;64wTk`KpqCFUW^oX3?dbu^!2&U_x+*Ee5W_hDhgOW-~arEs5za>?s{
zsF1vRmE`rfs?B*^HBv|OwdTy%!+jna#dSZlz<IoU{@!ZN`fYH|1M}_X%y+_le|Cv$
zKRpreg|kmSfA2HrxczYU$^3vh^Fwf-w_$PJKcf*JgL|Lj<{Wnd?tM<0Gd~UYKIg>s
z_2+^!wmeSt`FkPUpYN2xLw#MBiilTAeck8P@Nit}wUQ6}ndg%_$*Z?T^6im)hvoTv
zu+#jnIRA869p<~uneT=B{P&6LJ{gGkFr52@^DqMEexQ#_UgvW{^6Jx({7fXjAbFkt
zMaio#S)TK@Y|eRGu{zAB-kt1E9xwChaG&Q4xbNF6$**~y9?2I;zF3}L6i4#qlHVk+
zKUawB<E1L%)o`vm@2_giIS;jP&JXi-=FB(3ecqbHb$_-*ycO<!wwZI>cDVQ1Va|Lv
z-1{7|`n<jjo3qY{)n|UxocVEh7+3F?Cd73ery@QL=lt;cGGoqhXW^V5=I6|rUx54k
zEQ;$oE=PO??tP}Jwp<s&<C^29!M)FPbLKPQ-e<Yg*Zb-UxZhV-N?xy1)sk0lgoknU
z@!k~4cSv4eH|v6Pe)iZknU`+!d+>cGJ#fws^S$QG_rra^4T$T08;bZaoPCy|&k=Ku
zI|^r?%#WEfKLPi3oD|pnHXZR9xc510&T;49-sikI^NVorbH(aEg7r$hXYD>`oisSd
zWj@`U`AoR4W0ttCV@||#;hdj;qR%{Yj++l>pUfASGhYPv`6(9Hbu5i|8Ql9UH|Mw&
zaPPCyocU_F_gOD~rd($m;eOq3k^Cmfx53#zuM6$w?56|H{+aJIXTBTm`=Li%_d{RA
z`{C@9*M$LdjynivpUe-LGd}|Nc^(zl{V*Q!3Apz;Y0hz{;NIu7IrH;UN3R!)aKBz;
zotZqY!*Q*7z5@?^YMny3*Qt=aUSBFDuU-ug<LY&%CX#QGyk2)&;G9ohM_SEq!g;<8
z&iQ1%-JJPOxbM#{aowLi5$}bwPhLm*%sFm9oP9DsV9xvy-1q0OxbDx<h>yX&&vA2(
zI|27TC(W6khI^m0R{!HzuQ_wpnYa4PFPJmG1ow4Z7T0x5y?4vwLOl)6`58o?>E;|a
z1J3zjKGU4}Y`D))j<~L4Uc~d^-e-Y1$1Q|=pGD@(m%zQxO7WZI`Ct{?uRFDp-z3+a
zdU5?dJPq)0TzXz=lKSdhQb*5k1Ccs|kve0N*Ynu8<khF(VSe=dHXX??N?y-z%W$qE
z&sQtvPwblPSN@_Wt|Rkl_ytgO<}={_xX2XO{huB2960;r`6}0(<L1HH5A*rv%ooCa
zzZHq=<Dw+urEu@F%$(zv!@bW6bLOky-e(Qm_kX?Qb^kZQ*(c9$P39c88O}bLZ!u@S
z4esmSF0Sj|8SySS`{enp+nnR}z}YABz2?mK!+kyn#C6?=B0dcFK1a+s?kL>*95ZKr
z0`7gzi%-h=a0MRvIb`*PgJL{<Q}0Xu684FDCOp*F-_Mo<4|TpK^$XykfAuP<^AkDW
zR!f~fh}TFR^*YJFCA{!~k9v6MU%eR~`k$9R+og`4w>zbd`jF(quq!z44V!aaM&MjW
z=10w$pMZxx^>wXDaeZ7&M|=j({dQ<}GC{NE9Cr@RKAE34XMPFp`)yfV9~Y^!lJP@c
zJq_-Crkiuz47m51Y0i8O-1{sL*Xwc_JoKaMUJeiYO1(nzdi|}Eym|vX^rP41#z?+h
z@_JqFgmd0_o$WHO#kzOHId9DOm^0r84}I!B>=)O4I2iFEIQ!&vcG#Tbj=<R`^P}d>
zkHdX^C&YEXO+|bf?tRXfbKF_D_c>?I`~uwjT(<gr{c6RWbyDw79!DIP`80FpGvL0C
znc}*R*%8lybAJB0OVUTKImgX|vrp#p&6zKR`}`D%>pGT1ycF(zmYH+ha=7<dVa|LN
z-21E(zeBEH4RF8jYL@&a$+yDUKVQFUGiN{TaQ4r9hdJ|IaNiHz;<_JtBi;vRpM3qQ
z-<;zPz}YABgXYW+!+oAd#C1Q6MSL9YeNLEj+)23iIc3iLoYc|l!UEi{7nwC%u7i5r
z$%ltNwN3%t>y$_xU9Yl;S4#bG-?GadNgq{k9xuH{^7?*st>o3~CBM0TR#LygycyS{
zMyaFuCUfRn;JzPP#dSZlN4yKp{lMexhWkA9N?wn*Px9&mlGo!JH0N;*Ngd4(n=?NO
z_j#C*`g*@H3HS5QwA9i2keNt+N%DFhvI6IP^1dSVfn@#Z>^}|8d1gM{ocT<+pRcmS
zb^qr?JQvP>cwdoc&T;eM?34KdbLNZSzAnY$x<5-JUIzC*%gs4%1>F0rG-tjV?tRu-
zeco5po3l=X)n~rZocU(BuVah2u47xo+u@ua-dA*(bKFii=ZE<&bLM;CK0m$Ux{m!3
zAAozGgXSD}2=09jn=?NO_dch^Uy=KYS-77E79_t(@{8iSF3S;Lf%ACz{Vl1pBj*7)
zkC*v$a~^LN+>bX~T-PNx;(2iIGvA!!7QnsFLUZOz;NEAc)Yt2KIoz-B4N^z%6WStm
z+9P$krH-y+Z^Q?r{^siu?h^*#oCjVvhb6Dq!4b);k4avycjM;mxKEgnI+~v}XMP&)
z^FJf5`(!TSi*W7}9`6#|=V3+idc3J~lKmg@>gn)T>*IbY!<@&JDRp!nvdo#!f%`n<
zOMSghD1iI<p-AfJeL`_0UnzOLPpF3TczNBgF=zj^aLzOHb>_@Bz{BzC>lKaSy8oLa
z-U4TzyzaM}bKEvK`((b|ocT_;uS=J>?$4fx_rkr;K68%S5BEL?%$Xm8d!M6LpV$2{
zbJiKR`pi$5Gd~6Qb(|L0b)1d(9GvsR>;Aks$6bJPewbf0XMP#(^RptZ>zG!XoCiW)
zJss|SW|(u_Ot|-%WzKvK-1{sPF9;_Td=%FvfARA`89db4B=-sB;<_%C5wC*tczNBg
zHfR4ea2_x7wdTw>!2Ng|#dZFhBi;h{K3mN>ZX4YDY&U1V3+{b(OMSgh=!N@z!kE<2
z`-GWDo!Lm8ImzpFVL|fhEAY_2u6x=CQ=32BGvS<1UQe^&oHu%o<X^K|k^lPzxsq4U
zm%Lsd3(Rl9eMO<v(R`6P^CfU!uTpW{SLG3}g8MvF!+joVC9lU@CwcV-$?I`7n)A4t
zq>kpB&6#h7`#iLZ>wf5rcsHE$a39vC$DHH#!Z|<8_n9+40QWuz#dW=gBR&fEKF7>C
z?l|20oG@p83hsSQ!~HxwD|x*in~UUEB(L{lX&*`+r#vp+U!|L~&kQ(^i}_4*=Ck49
zxb%K3M_l(wUc~d^?34Fb1?C*L5Y9fCFEVGo1n%=+Dz5vaJmM8_@3YdJ<5t1F&uVk#
zYvJB!J>2(6ljJwa^}1PH=f5@LZEzkJufOf)?6U*T<6^$kocSKOA6Kuq&VPTz2jJf4
zpgG4Kf_tCC=FE@5z0Yx}uh;8IxL>bVq|V3X`w-GUy!P?<2+oHY=IkdE&i<LtGG{&)
z9{ShEW1hI~hk}R~!a2`d@0RpkWX^Gm;p~(75_9Iu;Xcn5;<_KIB3=#mK5NW5ZY|vV
ztTSi65$=69TYbJC*J92(tyZ7;Hgo1X;J%KX;<}FA5$}O>e)xV|uQ|u<gL8hE?>A?D
z5bpCcB(Cc?67f;E_c><HamV4_=Y%=)Q*iHdR$T9^7vZ5Fy&qnJ`*}F6E_r-}`noO|
z5zmJ6cwfCAhV!`Sd6Iw4>QKB-&X>G;q2$B;UKJm|=5L1=OC8OZm@{7v_xY?4*LAOo
zcrD!Lp$_iz&>(p|-bTr*H%nfRtHqqh)hcx~-)7EyC*0>@Q2bE2E)R?AJ{f~^9{7Eg
z<K`T90?zqie$t%zX?W;UuM0Ec+Rt3X=i%&=-&eU{&T$vv?34K=bLLmzKA)+NY<Ya?
zzDkdH2HgA1H0QWkaPKqQocUb1_n9xQ^H~`2A~^fxeN?eI$1Q=gPv%R_nXiC*pOxY|
zpVbksfqS2|<{Y;U?tRvqGv5UFKHIH6ubUm_tkY@rneQ@Zz6T!0{rEP?9t;2N71wp_
zkN5zb^TX@rpgG4Kf^&YDA2w%x6z=mgCa&u^5%Ed5_c>+Gai`(l=Zrb?b8zo7b#5}Z
zVO;%w<1~1<o~q}=LmmA-<U*;l`lZwYJ}<?ep-=T{$?J8z2JYAK26!0v{b@<h;lIsN
zXWP}!KZWaNi+MY|70!8MzRjHZ4tN+>_hF~F?!)eg_rSTnUq(N@<{Y;V&OVv%H)nnj
z?&~`wuKRE#;-hfybIhFMj>Emr33KMB;NEBIqsf|varJpz8r+}9Wx_)pJ+ADC=S%%<
zSBK*LTLGN?(~Bgp_btVeSFezKsK4`G$?;U0Zw0TCI-0LGXTBEh^VTZ$^>Ne&_s3C(
z)X~?kIwSdh$=|h2a!ldBgK+K>z8*DX&i;qtoM+}o%$Xm9hvU`9-MF|u?j|EX1!tdp
zJ!;yV<Icd@C-bxB%+JGpT^7W3e=bFQ8SZ_qm~-4zeX<tbXPP<l8F2423m(SR{gVy%
z{gW$obpPZ<@+Fej{Zj_#@p3<uo3sB4IFFb4N^|C`;l6)r#C8AFMZ6x)KDi$n%sFl&
zoP9FiWX^mG+}EX5T=!3V#5>^LXQw&G?Sgxs-R8{q!oAOatA85KZv*D6GiddhA2Mft
z1n%oNDz57|9`Ok{=jZ>>=cGBuoq}_In4dOheirWYGbgU=xDfG0xc9ka&T*IF-sg%r
z^JyPT&KurmmiTVrf`pHJ@uTGYUjX;>L$TyHNxoEEf1bAt9*$S9`xR1Oy+P{e>q4zk
zNAFkLq>g%@)Y1Fc0jaavQmXd6WFm&)VV>0|B(LYsNx09?EIiD=-p4LToiP2pFI_Yr
z#C_uuoa@f~vN`i99EU%S(!}*~lo9bvIQJ*-OS8;5ZZ@2KGM{74d>-8QXTG>TjtV1Q
z1ou9R%{guf-1{swXTBWneKtvb-M7u~upiXhq>dg}N5p%ie%L3xU+smne|o><^?r3g
z^6Ep95A_Feo*Xv62|glqG(T$2{5ag_ZASb~Id9Cu!#e8YYYy&@uLY^2_a}>yeEP?e
z$9L#Q?@uz}+&{eE$TH_~Wy3lD%;%Uhp9c@)>iuoLxIP{WBVGh&pS<5FHs`n{aQ4Z3
zsX6oIa9^(qaox975wC`OpEc$jw-)Yw)|oTk0QWu{;l58=B(K-0HaPoy4Ewy@oa1)D
z*(dXz=FE4)ecgM+b=~_S-VbM=|3#kz<{Wnr&OVtRGG~4S?(;b+uIoM?@d>#1Icd&u
zr{Lb_v^n#$aPM<T{1kb;Xc_MNA+2G{c|i9=hPd9hWWvL7>G?bx?&tYpsiXHT6;em<
zPb#I3dXv=A`<51|v)WRs_!G(Tbil)Ws`p7=&#V1#pPylPm}k9j8IwAC-!g9gbKJK~
zz`4G>Z<#b_ej4tNml<(=yv#*>9?pHp`;Y~5j=KnFpUf|rGrt1&eVD>J1lPw)dc-r}
z-e;yc$IXI!pV{Wj=fb_uN~y2=xeD(4xmN1van(n>S?cS3OADO+^S-4`@_K*LE_wA%
z$%pz!yeZlLUFLhiyQPlid(4^dgZsP<OMUHUMCz!IN&c19FW_O3nvlHuEIf?6z1$bg
zNgaLs&cprjyC`+^zGx|u&)AgAUl>>Ki?ZO{pS;h>Hs`$Mz`4H6=bAI04-ez&eNln9
zKHiHWUJPfSyw52y=eVVC_Q`yiIr9~8-w&1I`naf$cn#e9tTpGjb#U*q-kkYHxcAuv
z_kGeTdA$zyz}Y7sr@e6YL+`izW4u2xXP<*shxs9M=11VZPe#RcpNvO*0?y;&ebJ;j
z$DM-nc$uFzXMPs$^FJr9`(z>Fi*WCA$(-XZ!@bWHbLP`Nx#jVGtDI+Y#P<j%N_^zP
zeg70lUiVL__>|m_m5b~BRRug8@0#lo+^<K?Qb+Hv+NDmok19p~9a2ZVN9ySPRj<_1
z^KGBhQ6G?en6`i8L_cW$5_}lW^<sX+ocT$3*jGEqx=g`+UFIbJkgV?_ocrpG-IEDg
zGJgtvF2mU;^DE}er!^+^{BfEtu8-5qh-bms=jYI8wmHYmfwNEMbIqC0hx_BSKwKZE
zMG-HCd!Hrd9JdtieU_OsUjg?%E8)KG)slaQta~k-eeyoM&Ya`c!`UbE4d%=@!F}DE
z#dY0VBi;sQpS%xmH|Mw=aQ4Z3r#bW8aG%c}ab5Smi1)+2&jE9eI|%nahs>EDfqS3h
zRzD4oiwSeqnY8-MPnk161NU{D71wo~kN5(d^HYF67tJ~D5}fnH{IWUosZVV=&*=3l
zO<dP8BjTBG?=#Ds<7UIX&m42+^WeUY1#o}-7D`^PkHwLEspNHC$|GI@=kb0E>r!dX
z{;S|TUgoRKnXiTW@z#m!x->+*5$=69nRDD`xcAv&&U_o(`y7_~dLJ?Z_xq4($?N^V
zjO5kl;bB~TUY2owvY&lF<iJB-pO+Pim&^TCX{1gWobx$`b+3SP-smGz{{pE$8mT{S
z^_Nh8*6P#eBJ~#{^_L~TNv>-v@NitZUTOcgWj@sl;bA`YzOe%Cbt)ruYNU?t=emeD
zO8s#A#^+5<aLzxyMe_Q3LaXG}+a<rbK7PMJhxz_{B=gcKbu`~)&U_EtA1}R9U-x+*
z-1qa4)Y1JsB6UJPeBEHwoc)Z!Id9C5n=?NN5B=-w3{&EI{+x;UES!%czHTsQ&T;4A
z?34KgbLN-eKF`bIy5CYw$$EyodK%pOOgHDa8F242)13Kixc8YW_4RR=5BKwDg}CmY
z0jaOYH5Bm?IFGjj`+U@#{g1(Uyv$FSGd~6Q<6VOLK2Ke+{<@?`JPXeLUqt`e=IkdI
z&i<LtGiSa4?)?|Sz5mJ!*YCeN;x%ygzkg2h?`z$0Ty=2v&wRZ*^38DXzXk67cS>IO
zPk+P*;Ozgy=zq|h^Em`(|I81YGd~LV{wKt>&q=r+*A$$6eg=I`n{(V5IQwLN-kkYG
zxc9jP_kNb)p&xzUYDMzuSr={DSNeKO4m{LZ{l8S*#Yrw79{N`=hI>EdQeWS<s+9WS
z`f@z>Rh2pCp&HJ4W4^|m`8s%*H@&{pi|h5JG2%^du5Uf}zd6TkfwNEMTg{nohx__=
zi0eM=ig-8N`|L62xV>=iv(KFQ0l4=$Wc9y;`5886oe`_g{HQte<8WWc32|M=sff?O
zIX{o1&slShI|t|dFu!2V{1V*fXIWg=G1a`~ai^XR_dYYsIc_H0`^+|HJ{RtN7Fd10
zzEo&_?%qk?MOL5rVsqw8;l7S#;<}C%5wC=Ee)#%Ql{v?)hI4+HuQ6x74({_)FRts=
z81W{!_t|XDaa-WtXRA5$?Qrk2Q(T`<^@{5}_eXpH&i=p8>#zAe@F6(+XMWh6`BAv{
zKPIm8JQ49pxc50_&T*&V-sg-t^K)?Tb6)D}eewd_uY*fc=d<#Bc{!3#;d&d!)z^*F
z;9fsn^7=YeMkJppdEF1$5zm2ho_~pT&o$?~<-s}6%;%dkUkLYkE)v)MP!jP{xc6CR
z&T-4(-e-k5^Hp%~vq@b0Y>9XqoPFMd^J=?!JG=wVKAG<{XTBTmefEmyhZ`?^48YmX
z0>&LQXZ;~K`(b|AocS?$=tu9z#>I6XPDXqR&OY<roE*TkImexWvrpz{&6!_-`@AiR
z>-sK7d<E`(raqnYOXs+0aPKqSocS!c_n9NEeda|xAI^Tx!h9B(bKF8W`((bzocR*C
z_gN;c=c`(H=ttidu7ij3o_dSa(dRFnQYUQl793ZX`4{2ca2^-)J?6~!!F@mXi|c+K
zjQ9|o^M4om88+v*BXIV~{HQte<8Yt<331&gQxTtrd!IAr9CsG(ea@LPzX10>voA>=
zFTr)6<VHL{;)M|}j(BOr%OhSH@#=`zM!Y`ajS+8-cx%MlBi<SD?uhqBd;-pWGK&2?
zY5qs}6rB5n`Dt_JXW{<1n-kZ^-9p3{;q3F@=x52C<1WM5C-W=j%%`<%*|++BXu7yQ
z?lL2u1@}I)%{guk-22QmXFeb9kGmT22Dx8t6#s(wl(^>S#5LdWnJx39`8ILQ_lh4W
z?|=1+>$(rYId9xo!{%B0Bz=s)Id9C5nlnER_kB1auKi3!d>YO^xvyr-Iqoc+eKJ31
z&in%0*LP7|_u+EHSK!`f>e6KX=o~i<?tP}4GoK0fK6Au>B<r3B=eR{!$9!|vFMzWj
z<_pc4FNXX2mWb>6mPNc$T>Gzrv;Q;Ef3-RLsfDwD=IhLvZ-o1NHi_%Hw?w>MT>I~U
zd;gv0?57*<{r8wNKL`)~>$t;Kzle`tbJiKP`pl1+Gd}_Mb)OX1b)Sy-oVfNs5BGUn
zFlRqYaG$qjbLP`NyXCyP=DH)U>z*0$9C7VG7w-M%nX{h)xc6UZ&U^{n_idTD&VNP3
zE8*<(LhO?&bB<dLXP?a1m@{7w_dXlMb)K6d-VFCXTg*9bE8P2RGiSaN?tLzZ>-9IS
zb<6(I>u;|3!*bov7uR(ug7dg|JuNoB9_vy9=W#J#YR-H)+#jbE;@VGD#H-=#lh@N4
zbB<dJXP?a1nKR!2_xW!W*L~6)@fNuE*=o*l+u+`3yE*fnaPPB6T+ai&;yTa$5g!uQ
zI>T@t7q4q0=InC}&f{W!+?@F-xF6TFxX%A<#23W1|3$d>zhusSR^Z-$>T{{hA9Uuk
z;GusVH(OliKR4n9;##K=?)?{;v!4<;`{ewWnloPk_xZ0B*ZHrGc%8WRUk~^G8_d~H
z6Wsf6HfO#K?)`U&>-={`yc^Cwd41_I=eWIa_Q`yoIrD>X?{i38=XoUJqj2wY%$(zn
z!@bW5bLOYv-e>BvWdDb8_4^aj;C$V$IEkfl;h~Pc?pG#$u)MxqC-nml;kr|A{&RQ(
zoX5p{qdD`<@X(LGzTG0O`=l-6?QqWj9Qx@n=eV74_Q`ygIrBYmpZ{KQ-6#DKAAozG
zgXSD}2=09jn=?NO_ddt1KG$W!oOLFxKJ!!N%+J7m9cRUL9p@vy0QdP>H0QWWaG#%L
zbLLZ*Cl3UlpEPk@$Bc+)!oANdbB>!0_davXna_iJp9SLjx^8vEYa`wxuJ^Hn5g!xR
z``fvQ*R*Y!XRY5Lu626EH9sJ(`RXeo^~E(mB(C+R#5F(m`7QNzKTJe?63+ebro80e
zPnrK`pTwu(+z-spm@_{I_x-RWu6?dVJauI<KKncteWsan+;lkmWIn^3`E0oNSt72#
zr>hLke(KRrxjE}sz}XM;mFCRXz(YTJeW?}K^HP1p8{q7-3w<`4bKE94`((b^ocT7m
z&s)2=u5V|=yWrkuw>ih{fqS35=FAVkz0Xnco3=^zSorU__;unL?MWuo(fiU&aXsGb
zi06xIokBS0A@iVQydv|zADDOvob$kZsX6nNaG!@3aXsEP@$=J?F~fg5#C6`f;Ozg#
z{gZ#wZO(pr;Ow9IUUTOA;h}$hTnvco<6<b{!*KTbbM!f4&T&WK?34L1bLJ=DKF^cl
zx=*GfJ_GkYXU#e89NhbyH)nnk?tP|Rm8@Ivt7ZRZ!r9OH`zE<8^YMbjv(2A{=fc@1
z>*SfUPJub=6vIQG`Zy{P*Lg0Bc$K);se$|P)|zuZ>*0P}4d%=@!+rkS#r5&nEv~;G
zvQJ#sYgqgedHjxx>+w#A>%2`xd`?{Jq+h*d|LE(|rQ&*AjpACTNnHDBiFk*&*6A15
zewM_w{z}AC*CfZq{lNR5H1i+gI-3sXeqcVsocS!c?}t2b?Xw`_g>d%C`=26nj#~_8
zpUjt-GhYt(KI_EweyLkr*S%L<uP;;Z(7*m1(=<H1KA^rNb#&dA#dY3N9b5LNdZxJ6
z$%b=2x50TY$9xX!o(JcAGM{hGd=cE|vqI{>X0_$P)#DByl~PB&Uh)~MkN4e@c&bVA
z>K*Vft{!i%c(0r{2E;W#D6aE49Px2+tuq1VJfDJjo;2sYO~X0Q%+HuJKM(hLUJ<`u
zj<@96WCBB8_ie4X{+^abaXqdkah;!*h<Au<oh~@%hu6(+a~^Lmob$tcpE>h`aG#$c
zaqWL3;-hf(c|F!~%$(zn!`UbE6XwiM!@bWLsjugUIk=xUGOpXQzWV+1h2lE@MdCUS
zB@wR>*E&^j&JWKI)#d}3w^}&ohxs~l<{RPv-~5Q{eop(smU(EA{huv<(l$7mto~6X
zuE$j@uJcnG@k(*6Qw`_*aNpLL^LXpvoFC@v&6#h4`}{PEYyYhgZ-cW>?%Q^Aj@toe
zpUiifGv5REK1apZ{Ju?bozE3<J+Ac5E$gnHEv|KP;5^<Jus?InABE?`dA!UQm@{7r
z_v5Xy`jz`7eOH^aPL26N$k)Qz59`#KvrfG^>vY0HpE^HX;yRx_5g!oOI^*Jczd9qX
z_2(kKB(8NzuTSPLtfRjFQU>?;U#j5Yc=i34M)6nV{Lmuxw_P3Tpn_z)R`VU;ZE&s&
z^X=x$cfvzI`Z_?D_;b=vPsDrS+|TEtpFVSr+Ye`-%nz6|KLq#vJS?v3I2!RWxc513
z&T%K;-shw_^V4web5>kmw_k?){#k+h{>iu@S%2R@IdC4=gP8wZ@$mCj*~vdo6~K91
z%omDlz8oILy+QUvmDCUW^97zy%)bGzk@}jiHD|sa9>&%E*&wd_vnk@uaL&)Jc%7=n
zoa45_IX}#|nKR!3_jT_S*ZtWY@gBJM*=x>m`{3SZzd7@RaPM=(>R+9oY?M)R?(;FL
z&-}PK^OJC2$0>1L$C-%F!Z|-*MW1u#9Cseh`C)#+ocSfV&(E^Bu4C$pTON<<X>ji|
z-JIiQz`f5*bLO+*-e<1WKOc{~Jag`ce5=oVfjRR<a9_t_ab3sKh?l`RKcncg+??Z9
zz&St6SDG_l4fpw}5!dyqi+DZU`)n}hxQ%e{v&o$K7P$A>Ej}mDBl_U%=Lnp~`psE?
z0M34xA2erv81CykBChK@7V&X7`}`>SoG|COlW_LQ{FFKKGjN}`S#e$8`G_yTz0XB+
zj=Kc+K9|jzPjziMKj?j9y7;5AzD02M!}Dsf`E9tqm%!N%^QGp@m&1L1E5vnut0G<v
zXP-Q;)|hkLS~&Y;zRsNa2Dq<pqqwebbHrQV-e;>h$8CdqpY7(%cf!5TF00S;YPUJ}
zNsrZMzSo@jez>pWfVi&XP{fDfoFAT7N6b0yD4g@d{FpiO6L6oONpW4r>4?w3z0X;5
zjynhUKIhGuUxa&~1vhSa{OWubMZ5&gKId`XD>Wa2m%-U5^X2BuSHiu|Dsi39nuyoI
zz0Z1cj@tnDJ{!%MZ-#rHUE=!w+Nij`zcwYlyFBlh6W8ynUx4$t_&)feIs06K^SGE_
zHfKI{)0X|9&qvb4b)RHJJQL17`964-ImgY0vrp!8%$d)F`~2sN>pm%rcoE$DEH>x3
zC2;Sv)SUTpxc6BjuKT22T=z+jxbBkyaos1w;&;ftS`gRg>8USmS@(10dYvw=`4V`T
zH+}uQ6z;E|H%gr|q<)9EzOL0NuKTS!;{D=UXAsWy<?G=?=7R?$$3Ft+`Z7Oi&in-2
z*LPA}_u+KJ=f$=EMY#9BWX^t8;NE|#J2^f&^BHjOKOY{(4euKct^OH43Z#yDv*g3;
z9z4&qm~-4#siXNebLKnXp-(+8b&9XqClT*~b3S>V={4uLeQ?ej^Zn+`55j#uhs1S1
zj6{4C?tPA#bKG&b_c>wC{Iu2iHTM6EIrFnthxs{k<`>|;UW?+oUds_*fpZ>K&}ZuA
z&D$|W=eTKb&I9x5=FDfpeZ8{8b-i*To(pF`95>IL<L1M?&jNGii{Rd8iPYEga2eds
z!}U@}=f6SfgvVnc=DE@QD0mZ`{WITe&U`C8^snQ#Tm8HPlXdMd=R9;;edc@2neT)9
zy!DIg`VK~X7|!+OxFhBqcNEU~VSd7#`6;;fIV-O7HXrc?IQu*m^SNlwahKrillf(H
z=F@IT*2nuy7uWgBjCdB@`^+}yxH)j|GuNE?0=V~CBChjUA%30QFLgw`SNu@P_lxUw
zd_Y{s9g6svxYn6~bKdy=^`trHVH(bPV}8b*`FXg{+k&{R?^49mzPx3hX#W{-??2O=
z{ba+v{~UAX^Wolqk@$P%{<AdVRpK{EzD8Wvu`c5Ea31gV`zG_!V9x#<;XGdEo6MPS
zh5PZgiR*fGM7$I3eRi31+-|t{*<;RpKivBq7T52qN%bW2#C}e|`ygrNdGK^N`(ZxA
zocSzx=tu7-v&D6Nb0eMyXP+NKKl$byw*byQnJ+YFz8LQFRwAzJTNd$hxc6CM&T%W@
z-e;9L^R-ro_y2X~%-35T<{QkJZ-V=JHH+(dwMM)R&UxVde7iZv?SOM0nC~=az8miA
z)g!L!)fe%8xc50=&T$9f-sg}x^CNKYb5iQ-_j^pi{r&nmsiWWTk@uCgk6*rSpKs27
z3gGOY`9gE%i{ZW>O2l<PltsK8&UxnR_7&zFw-U}inXfWuz6S2|Tq~~op+4dbaPPCx
zoZ~jZz0YQI=3C+3=YqJt{<8vSKYaYAZe6?X-{E;1&VHCrH)lQ*?(3T+uIrl<@mx6j
z<l{Hboa5%h*(dV_=FAttecp=2b$v@CUIzC*%gs4%1>F0rG-tjV?tQjMeSQAe3is!a
zgHlId#~YD4`uuU!oX-cx;OxH;&nw5xnV+;e|G~bRGXEWX#_BLXYtH;U-1pmpxbC;5
zh_Ar8j>qx!irdycE;w!)ob$kZraAN3a9_t9aoulu5ifvypM~Zew+QZimYOqP4);E*
ztUk{J)#j{IWA&M@HD|sa?(5hfuItzo@n$&Zhv$J7bB@~z=ln3=X3l&E+~=oLT-UKX
z;yrNhv)7#C_QAc+esksr;oj$j_@UtekB^y%&xz~v!Fh3Am&J&udXs@dKUyap&UxVL
z_8I0pt}Hm`f%$B6=JVh_5BcJ{UWE}a71#dD;og6RIs2)Cd;itu%-6xa|1PV4A<kFb
z=B(3W^_lNAXTBdE#?|Lp1LC^wLlGZ_bAGze=ZHDS9ffm#m>)A|egf|EGbyg?J00;E
zxc510&T;49-sikI^NVorGykip%^$%h<@JgR@$0rpGU2~f;<^v3#dTe3Bi<;kb(-Ov
z2fpsqV$S1ggL593Z#QSY3-0sKEw1a;8}UJL?SB~V{g0TlpE0=iKW@(a6x{ot7T5Wo
zjrbg#eO|wBvc~h~9CrcEKAB%MXMP3leWq?t#@W2zWM8F6JOl21W}0){EV%cXZO(ii
z-22Rz`g(s`2>1KjDygHdN3}?u@V@8pR>|?V!b6|x{ZdEY-=B#1thm1KpZc22vplXV
z#r1JrC$6tcw}|ULZxz?aOMAq-#kEc^oa_5_yzkIweg%90&h=$}(46^E`2V-QeOu;7
z=eaE6)#5tOP2&1`Z@0M4^MJU{^Mtt0&!o7{^K``L#kI~N+~;}8d;;^l0{3}N-I2^2
zo%u|-&vUi7_Fo(EIyn10^PptBdh@rz8{q7R`9^c*o8jJPtJUZ8g*J26X}9{!cbGHZ
z1rOuu{Y<yGp0|4=-UsLW@cBZ&ImaD<bAFf~G-rMo?(;JuuIo4!@o~8KIbqImC*j`b
zlsWS=aPKqY>+3(R^CMm&u8->maee%DM0{3!&Ern|g0!T!&HueK`8((5Q`pZLaLxlg
z6CRFN>*PwE*Q}Nt#q}jm>Zq4Q>QqUcZCC4X+-mVqXBPEqrM~9t#5Lar5B=*r_loPh
z4T|gWPDFe$;_3Zs=XpDPe|Q$0^Gwf%`#e{P>;A8acrBdkn|E;1N1gd`@On7=VZOnf
z`4+hE|8}d-IvwWcVBAit&wQ6T^S$seuAayG#PvKj5b;5{&(Dzg73gyq?(;KZ&ipvs
z=VwA(*KsQ1({S%|#+>8M!oANqbLJP}-siH^4?l01n{1y{>Kn;lLVfj2xc8Z5{te7$
zw$uraU#@$OIr9Z@U-v?BUH9UMm%zQxQuAr_SqAs{EH`Jq8t(I1Bd+US7x8+y_t{|1
zaU0>@XOlVeZE)|iPy95wUJSxRKdb+jO8aKA4~C__`kd7H$u>zg{C8gJ{6TzC>ZoU9
zoY1GvTW-Yj;heV<4^74{Ft39b!Z~lu7nw6(3io*{m-_m+sE|79)lz3j=DAT^kGDDE
zEpR{HR`XmOZyVf?x80oiF1R0WkJSIStYa@cJU>+*l{)isyc6Pjywee%f&1~!n%{`y
zorC-F&YLs81oz`j-IeSk--qdN?<d3j`{*YV?)_w$GoK6he)7d%7fzt~C>P%(>(U^u
z^V}5iW;l;)n?sTTTFiMr&<f{qG2dp+d>7o0tJmtYPM<mN2l}l(^8@D055vQ_djBvY
zuGf*Vh>yd4ekRO$ot=dH{7jiMKMVKynG@G_T!{E0-1}TI=eWyo?{meR`SgKgUwEIH
z@G!2P_p;%kzIuVw`H}3~YN->pIoG$woc9T}QeX3R=FB(2eLpmd>wajBcpKd3x!s)C
z-wwFXbEi4;y>OrBK5^X-0}&sDd!Iw*9CsM*eU6wjKLPhXm&CQtm58VAPWBc1+!yDc
zG;^L$(&6lr`3!UBbKu@*zSU=)0&|{E3avi#Mdr+x!hOG$iR*r=h<GL3=cme?kJD<n
z&rgjx^Yw6_p9XPV$EJuk!`Ub6x0rL@TH)-I`8IRryQGeuPkJP;J_HZPrT1Oq;(Fbj
z6hBGsTc*Wz9%dsx2j@Jn|9SH+?DGXU=Yjb}bLP{&wf=cH1McHynxBSov*12%wmI{8
zaNp1Q;<}#;BVGjeK8wxIKO{NM61ewSYR-HG-1l>(xUOS$#B1Q}ll5!Oxn6Z}_Q`y`
zIrB|$@3UWA`y7n;5S)FE9+J%4usP3%BXIV~{HQtelW^~I#_F@qtU1qzb5@`Ed2{BM
z;J)9M#dW`>?%DFVP)~#V{G^-n{F4Fq`N=eAJ_qjelPj+4m>=;1IQwM%LUYbr5uAN8
zUu@2Nxzy3~WToWQ>*3+J^!(W>uE*6L@eVkTi~V$(KXXX3eqC@L7xUfb%=g26{zt4n
z>x`Q7{5EFwnIAW2ehTjUb6Q;Y;cUd`;66X|<~*M)z<que&6!_;`~0K^w>(~S9n&M8
z0cW4ApJ~o{%Yw5{=CjS2&x3oPW#ZarMZ_!N?34AY%=x-UHJp7iUt`XEJ>2_jkox+1
zNE6&&Cux&9`Z`Ic_$GONl%6ct=AS3cU42Zpzczskc<5g}3m*FHmpYB`tyX>Y|5BC5
zC(vv@3Lh2^&$C|4OkmXfCHT1c%kW9_t#?Xb+I(C1toiHU^XB`)7bCtL@y!Rn`n50*
z;kb52o%Ap%s~_}T;hE-pz_ZQY1P^PWbuN8V@_D}bP4GhVd*H?9zlN8ZFTl&qx64h&
ztu)VrSDTl@Yt7Gs*PCAqZ#2IF-faF&c&qtC@OJZAc&GVG@NV<0y;GY%dd&}k_nV&z
zA2q+|prp>Y`4#X<^IPH5=6Ato&Bx&L=9BP6^S{EE&Ho8cx?O$UWcBMI!sFpnnc#0-
zeWR40^Sr@);nqn7JX|-|DUy6P24KDy`5f`LNj^_J^phFhq+R{UPyX0k|8U6{iidnF
z@<rlDNWMfo<QI`I6)%>2xp>IeVj?QUkCc3sc*yg67OTaNl6<Xr$d}@rTPOZ@$v23H
z{2=m;;w6%A77zK{aMD`+Xi5IqJfBBPzD+#jJCSb}KSuJM;vt{H^##9{X><K!C66Dg
z+Uz0Uh<tDOx2qpvpOi|zKjByNv&avKA1C=C@ld}qJ%M5I<0U^T9`d8ekBPrS@)P1A
zU$|WYlj3EPpB4}KUgT%Q-zoVy@sQ8lK7o1h6C}SV9`dcoFNvQh`4#byUqpWMgMan&
zF#qL}PY)q@_-pMBn?Fruh@T|+Eb;KyN#wJ|PnLYHc=&5+Mp8dd{1nL-h=;!pB3~$8
zA^BqQ@YmcOllmp%r%Jv|Jp8p2`Ev2oBws1M`LC}_>Q{-sOY$}1;jfLz*NRt4zFs{1
zbr$&s@zW*WBp&`+`TC@vX7Mv5-zpydI*NRo_`4<FAs+r(n3>e?6t9wew|Mw#FY-O&
z?~#0;c=&53?u+`x&y@V2c=&58^8CF%VL!iD@*|dCM1EAfTJq!K;jguCSpCoH$AtL%
zBtIn{{yK^LwD?()pA`>(E!{a(Po?I>-!J(E@$lC{<QK(jB)=>k{+gQ=s;5#b;vbNF
z8m`a0UUwp&E`GM;GsQQTd}C5SOZ*(k=ZJ@VBl5Z8wUW;l5BXW-3&cMt`6BU<uiPc+
zr&#<$k}nkx`BCJ{#6K+g3h|IH+%>6RDPAY}YVnZoMZQM-Ba*KZ5BbdOq<+2lxsq=b
z5BWCao5VjV`4;hzUqZfByk7F{;vrwRThdR5_{SvQB_8tA$ajmMC;49SkT2Uksoy95
zamf#ehx`!ogW?U69~KY!{5_KTBjTTs{Fr#icOyS8zDe?v;vt`&lhmIQ|D@z+#6!Lr
z`C0Ks$<K?2{5<jt;-8ZIl6c5h@0s+oEPlS^Q>%XuAAG!zBcCSzf0EA-5A}=p+WgO7
zy-yEynk1iX`F`Yc#4nJ1o_MIAjpwKN;ulK3P(0+@kq^&7!bj-mBFTq)V|vIh^Lep&
zv*g3Qkml=ilh4CFM)(NzFP40`_R&NA>D<kqrouHPe1!a`B_Gap^pG##JNZ1EL&8VM
zUn2Rix9K52jC|NL^cKm7W1)w9{+pA}LneHL`k#?}n|R1~Bi}B5spLDwLq2n#P&Jk6
z6925^d&EP&1^Hg_R>}8^hx|P91LB{P{E&Fa*W|7KXZ2%P{4&Xpiii9J@?+wcOMXH;
z<V*Gq)mN|c;$aTc5>8Evhx`EYGvZfBeoj2(bM{LL&5M6t@{8gj-+}y+_?41h5fAy)
z{z-i{9QH$4YxbXxzXT8Y2IMouuabP0c*xHnpDlj1<a5PCz9K*ACr|tu$rp%+{4nx`
z;vJGN77zJ?1CshB;@3*POg!YfkuMj&PV$xFA)j$zQol<43zDx95BV14YsJH33ZJIx
z#Y27p`3CXpCEp|-@-=v!r&;_4$+wD!`~>oC;$M_Je^&<gLrKBvKU)3hlze#X<I_~P
zc&I;!e2@5zlJ64_`MiTe_0`v+#cz`Qpm@l4BG31pLZ4rf{D|dKc>icryj$|);-P*c
z@)P1WOMXf`<Y$nd7QaREv*ICNedy|cRzK#%zbyF$@sJ-!eo;J}WASNfSv=&63q$qQ
z`+xDTNIng(CvkoIkxv)DRq~nQp?=O=HkVIjiQgvq9PyBEM?P0PTnpHLzIezlBVQo?
zRmm5LhkX5ENk7Hnw@bcMJmhDPFBAWo<SWEOzT&M({YvpZ$ybYq{0Q<j;&({CPCVob
zi<0{F;$N41qj<>oAm1c@r{r72L%!^7N&QywaLwiXw~L4T5b_=3-;jKlc*xftp49Ia
z|EA=7#Y27)`9ATxBtIY?@=Zr1_4ztz*tg-{fc+0!eh&E&@w+8ICLZcn6({w_#lI!_
zN%4>$Lw-v99?8#$hkVhIN&Q*zLCMdHhkPIM3*z@men~v!%a2OxFN@zN`4nE?<>P%8
z`84tSC7&T4>Q}uzsh=qx?!h?!+2SEThJ23rw<Vt^9`c1HN&S5B??}E-Jmh<kFA{%1
z@+IOSpLujrzf?TjE3*G`@sMvtzC!%FlCKgE`9<Wb#lI){TJeytJtpa=PW=0lZx9dp
zN#q;FM<m}Y9`Z}bw}}5h@@?WFUvq5IPrLXJCC~Q<xPK;*?~?q3lJ5}@^-D^V`n}@e
zo}BaFFCOv($PbABNb*DCA)j+xQh!+d$C4iv5Bb64ll++YLz15m5Bc18B>744@Z5p@
zPm6Evrzy$LsIP{ZpHp9r<~1kzdGW0!pL{iW-}xFm#%bZt@P71_EWY|V-rm^k{JZD(
zi`2PjgF1K_{?$@pT%N06#nrzA=Q%1kdk7x>j+a})mo|R{KUT(7AC*464laX?Zyxtj
z$@2@L{w3mG=R^kaXUHEdd44%~hPc<MVNmKkA33fwHmLK_b?V$Md44(c^SrqCb0LG$
z53hatrBLVR8`QZ%!>fM}`2!-y^+xRB@K3y-?se+CAmj4Oq5gNoy-q)a_%q~>lRUp1
zoX^pMd7WVf@#p4oBgeJx2FLZYb?SUE(ogONb)H<O4)3+}OQFxFq`n{5vl?Fgd&vJz
z^89k}hvay@&Pxp9&ycT>Jii>gQQYf<@3+#AkUv=R{95o+rBAPO@H%yPuge<Y&roNd
z4eA`dP8~jH_c}*zQ0Js|>YNohuB|qx^PY9;6h-P3Z&0UhojMOnp2rsE=dca-;rZ*-
z`FW(DTf}|6E?uY2fsuaxBJOprUZ>8^lGo!Z5%)S@TBpt_lGi%NY;ary>(ptGyw>@#
z)c1aVv`(EvB(HV&8c{H>^Q(30To&o)*WzC1PwUj#R`!YZv%mD|b^ftVo%<xOb$+u!
zKYagE^Lt0?yk7eBes;k7B3kE)NS$pqsI&Vzb#{%^`TGXPb?`cM_L6b6&mV43=a_Zs
zd^*z4qPWk`yVj|*i{!PRFK*CJ?K*XS7^zb#?){v<P947X#a_an;XL+-4f^@qI(0rJ
z<FZz$^Ue+Gd|{nBU6R*2`-}T=eQljO-;li4`H#5Q8Cs{#uOzQ^E|TN*I(#2g^C`)z
z^ELBeUWf04YW^#ce%>nk-0S>lo#WzbJFFf44C{4|)b~37UZ>7SB+pu*&WGiAz0T`b
zpX2FA$p0x)=kFWT*?XNjH%gvkg!)&Bdp}34Q>R1nTIY0euM@u4N<YH5H%E?(ui=Nh
z*ZIIYb*`0hIYy|@*UHwb6W)8)kC5+<)Y)!>{S)4U(T`B)ph%tXiu-Ye*ZTD%)VW*o
z{95n=ajz3zlhu!q-%0xC*Mk3NgF1Y_Q}cYymKOdDbxz!%&Live^Bc*tR;cqfaX+r#
zuT!T}@>*vPaj*02I(1$fnV;8hP>1h#>bQ?eUj00A?<dP117RNc-U@4kKZ8HBK^=c?
z9P%HMJZlB#do;nkpX1i)=M#}S7l?bE_pDRra>;8yFG|+yoF`uk|0eW55vg;atfSYt
zbe%dUN9sH!S+Aq_BJAg<kvh}jUgr)OgLR%XqaP^lb@X11dA`>ZKIcc6xBEA!Gb>*U
z|0d*jlm4|%r)0gKCHWfb{3%lBSK?l08~GaR{Mn3tuDI99maj2?jv4(}aj$cLe2w{|
z>{#g)lJz=z56XOo?Au`BBh3HrrM}mxk};UyFH&b&vR+5;MOf#Zk`ER>LO+K~eXn!A
z{hN?~gBj~QF79>w8WZaLS>|DLGw5en-0S$gPN?&UjH`9Nyg?nlU#R&HN?!e=;@;1Y
zjUD>od-tpn{tR9zS+B$Q3;AzC{*#hdziWejesBLK)cLmLwa%52^?v>#Ukm>x)Hy)*
ziPjmEtk-!(zQ#IyuZ=b6bCUHsJKNZypD#p?Ye3xV<gZibt1>Qo3iW3;s8hO5ot+|e
z?iKfb&RC}ozn6x+aDEQnpbp>X<G%_0e_rzH&uwsASFO{})sojbhe>@ut~=JL^XW*P
zhsC|lch;%%PswXPSsV28({<|Pn1xzl-qOUqpU32D%pVr%XCKLWooD20tmD^4`khkW
z>%6>9opU4~YJ`t)T<MbaI<I?elH-3v{uY@}^}mXHodedXlPh_x^O(5TDP5<|gOTI<
z_6Buo)~WMW$!kB~5chsAS*OlFC9ib`rBAPO!#Z`|9;x%k4eES-ojONLUi<l}xcBqO
zI&}&puXQezKE2N4>(tp%_M6txYm3+U$2xURjP#Q!^}Wuv1PmPZ^Zz1s{wB_Uw)ye0
z`fqn9NS%MlJm_(KNu2+Tbq*y+ovo#Rt<$?fofFon<M$w;Rv35t4eHdcQ|AGh2kmD{
zod1l+bqN9gAo%xWT&>f)L7gwHQ|F0Dot6#ie1Dxf7fN3HIbWRrjK}o^L5}NRlGi$S
zN}v2^tn+t*)VU#2NAFGe&sgWR_&HD=*Pr`_uZ6t+J`k_7?>cq%i}W+O!EqI@Q|Et@
z*FK++`rgmG)~T~+<Z*HO26f)QPMy3+ohPMF@8^^2)G3m@9@n88^wY9VonJ=klx$Gv
zi|f?+V5Cmd26eu<PMsSiugA5m)c5%rU8l~QB(HUD6Zbk#u2bi}NIxfud!40q>ikaf
z+K>KTQ?HY;J(J0w;c>JnQs;pUjw^4SI=e*np*{!oeu~zqvwft_o*VRY!a8-TCC{S{
z$9u9IulIBII(7WDlTa(v$&>nC=c0A$oF#ef=hO}Q=~}1G8zXgovO%4pb?SUp^4ibg
z;(lDeU#E^Pm*#`x$3|25@#f9*792nBkjlouVLpQ&kI!?>-;2-l%|C(9@$LAp*1rs1
zY<Ye^RjK*i_`KZwA$(qG{y09bHh%%1*P8FNdVJxdKKbL-KKcDQjpipH-)w#kyw#jP
z$KGzvpG)sF??oNX2j~9*c(3Ju0q-||3O;DQ4c<>2Hs23EYF-K-H-A5T(wy&iPn%zf
z{H*y`;PdA9!xzne3STz=BYg7@eXV|t^Y#Kf9rHoo0q@sjn)Ch5Z1cmB&o!@r=bL{B
zUT7YEwljPbn}?t23LmBB;b%F*N4YtFKCsgK7sywe^XK$x&6km{H_ybmrqP_w&A6{Q
zpXJE6TK>cEc5~iCcbfB_pxgXz)af<nYd8Joyao@N^Lto_&C_x29yRB^#kl#g$WNNr
z!l%voy)3ild_8&IoZmCLXwL6#T{eI9y%6kouFJpCPr5mu8}s+8g?uPkaNOqYmKwzK
zVAlC9e=mf1?&?3tMBVK4<llunwp0T6Z*W963$IOEuljzg|IZJ8Uv}^V#4&t|-h+R@
z>savpC66Doe>MLg^84Y>kUvQB_%Xs)^M67PKMwJ#^E`E$)Cqkq;PdyGKabDr&Hs(h
zuQI=+I)NL^w@0tHn!g_YP4hRvzhk~H{Kw{7VccJuzaBngUJQT6ybAuJc^&*U7@zBS
zTU8Pazt=B((8JyeA35f`<MVyYU&4(DuiLD{J#>`i3-S4h=Evc4{yrSm*{ve!=Yy7i
z37dM8`M0p4E-}C5)T9p2hphkpcO`zK<v#?!-MkkY@E-F<<oSDJSpSH3C-r}3`35-8
zSIl1qf7<fDgD;u?1->=rgLM|*JWtSHhVNzh9kCw@%&Xu>nV$_WH@^serg<Bjzqf?_
za3Avig<f}NGH<O`=Ti7}<|WvNJ?5`IPR)-)p1=2l<DLqC*z)g#^ZV48zXJYe%kP7I
zyJ*huw|v?B_o$PBlQ`=?1K-m;AN%b{^TV(|jxpZ}{e<5M7Cu;?=eO{?p4552eYQCt
z*Wq`wXucNXhTplNUX0_s%sl+8TKEV*BOgB4&%i0k=iz6c!w3Cdc=#Do^@rfRFJu1K
zaDKlMeIEXp)!7R3^R)SyIIic+E8s7gpAO#z_e~s^^Rt)vN08_DgfM>|oX<V!JWn2P
zbsk0j-R3`rpJo1CIA7~v{U$i?6Y2bZb-qVQ|1|P9S^XaP?dF%mzh%z(<a<4=-;F%)
zH|bZwAGbRB*l&Cfg?XN5pS3*q|G&-ui260Sk7J!|)c=S%&)1(ae+6|uW1faOSDWt$
z=X(kqcPBXSPwCI1K406UhoAKgAN-jJI?q3RFNS^s>i^gJ`2(EaQ^!1iuMpp#r}O(2
z`Mo7{);|U}p!7=AKiT|N_yy*lg}0h-f?s2PHv9(j_rPy8?}C5bocrWHb3VU*$h-q}
z{%-y_eA)aF_-k;V&-wWde0%dgc%eDJf3?`0_e*8wCu5&fn%BVjJ}UcZfY)2T1>R(S
zCHxBWqv6+@^ZNHi^SzM2+5Av=ulXyOpI@2tb%3q#yotxvi|fL6=HX|U!^a!Ve+%E+
zoY%*L&AES$G@n5ozQ4zQw#WJC49o8bKhOLP@C(f=_fPu2%)C4+@h_M^`_9C_Y<>jl
z-)YYMf4_NAZc^t#^SQ#rC(S1?4^NthpOFq9^X6NlpXbg0i2VP|pNDUU_YFADyngRt
zemM5SKIXixA8O9)`rFO<UQxL@f5xNIoX7Pc^8?Y(dFDl2cXO`SW#;@|f$PkFfjYOC
zzX9WZ-F!Fr{pLSIo$s5!6aI)fzo%`=ocS4Zz9%$qemUy%eIc&zmGBf^r>9>B=lef&
zzDJvF`7a^Q_j#EA8vJm}UkpFi{51F}=KTKZ_nN;S`45}(y!09KbCAEv{9O3G5&xb!
z@5dfC=X;IMnDf5vdGiM_?*Gi$=N>yGk8jTBD<>zP?_<u_6%RFk3iaP^UXAnKiRNd+
z-)(*#{ATkP(a%@Sd7pN-`9IOmcg_C||A{%*@mJ<6$p7A)@6kSE{ubP~y<mP6e5;JL
z^UQs|qxlq$cQ^BA;rp8Z5$E%_n4gfJjCZ{Gf#~N{^WEW9<{9vF%-;t;*Zg?+C(QY}
z&;{n4|Ie9!0Clc4|0w)sb3U)R!~EggWF8(cAIE(D$ehm~eqnwQ#(mP9&nxE5dH#RF
zoIkU%^^R-z1D}Vy-kjf)lw;2CeL2AVe)M^``6KXmnEx7HY0l>}A28?Z?dO?4jXD>Z
z^LzE$%wI<SdUL+leycg(%fHL~p6!!){H}QlkHbgIN8rCT{~7!*=8walH~$;_74ui%
zJHBr1`etJv>|wq)`~dR;_z~vi@OPSz;`4W#KZ4IcX#O}p|D^eU@%d-WcY1wtJlB}N
z4}P<GJ^W7d%i!NOe*pfF`48Z~GJh7%-?Pr^*Z<(pS^i)6eOxQ%Upyi?uI=&fUaf<C
zw)u<2Nq#@`J@EUuip=+eA8%d==kI;zxFztjEq^k+!Tfair_DbAzsCGi@E-GP;CGwf
z0{@|TAN-f*--6GY{}}$9`7hxs<`V~CT{4qDIX|25d&#oR{|~;Oc`LlgoX-=FH|O(+
zO7jlXIorGo-eCS!_@~Xk0dF_|4*Vu_{vNhI^Isu<pZV|MqvrGQUzooLpE2JSzn|@I
z=DWa`&2!-V-*@7A<-@afTDy)#@Hd+u1urx&haY2p2E4-j9Qax0AA#4KH^476zX;xD
zekJ?{^Dn@A&A$ZymiZ8T#QZ_{&&(&_)8_9fOy>7#^T&{1GJg`jHQr$6dOZctG=J>P
zN&UUdUqQaW{Iz%k`6%<U(xgtg`9XO6pK1O)@^$7f!_PO*I4-H*YMuqZ&U`O;kNJV{
zZ<@aiK5YID_`~LB!KchW2LH49h44l5&%s|dzY3nQb8_5V#~%3Z=6AyL&A$&n-24f6
znfcT3GtB=1uQmT4e3SVl*jFv)I~<=J&(-F;z`M=&g@4_AFZ`avA@hsgk<|aO`4#X<
z^BdrQFux7HVEzF7CG&B3I$r<ddd<RjG5-%d&wT6hr2oUrw}+RS?+-uC{0w-Fc`f`r
z^Go5)=3j+>-uymzm-&15OZxws`Hzvm*Zddo2hINsf7JZ%@F&e*hCgGTc~a8Pzs=tS
z-{y_U*STJY!*@0>f$wcz0YB9I9Qe`Z7s5|5zZQOuIlrIkqvm`a>2h;E&uTZn9nYt3
zFy9UDm)vH~pU1r0{3PVRXU^x9kC^lKu}+zvgF1gQ=kHN{&irEJ|7-pQc=|4D*YPXx
zH<}-VdDzFC_l<8cFGK!VbH2`as(B^yHRk*o-H({_cT1gb&fjU+W?qQny2kuqjC-Sb
zKk~Pm-w(gXd;~sX{s{c1=KQ^@kD31-`M;RY!xzn$;Quq{&tq=C>)Q3rdTsLguI9P$
zJo5wLZ!v!>{2242;is7M{k&@P2IN0teii(D^V{K{HGcr!Vg6(I&E~&`f8G2k`2FTD
z!bi>1)06pp)SN%B_dD~qA^%tNa`=*YHGHe=wd>djf1P<7d=K+pc)s~C{B7oZKkOam
zPa%K0`OENg%y-@{>H8Dr2f;5fKLLJ~`3K=&GQSvphxr%a_nY4d|B?9*;J-BgHT?JH
z&%&QI=leSUG3Wa?8N01r$4u<2J<WOke6x8s&Q}MSSHX+TKLUTJ`6l=o=KQ&sbId=F
ze1rKH;GZ_<|32g8=Jz4rY5slqSIi%Rf7ATe@CVF!JsmUW&&B-8{3+D=gE_Bj&zk=Y
z`DJrn*D`lsyS~i7(VVZx?q$9WUN1e!JQH4Qo&|rWIp4=R!+d|_&oMs&-eAu6t1dR@
z`&FMeKL>TbXnr2N*SraSxB2Dp@0s5Kf5iM&_>1Oz-|K(ocOk#s9&6X@HF!OFXY-@s
z+2(_I{d8}0zHff0`6;MVVtyw4B=Zl!&opm<f7twdc%%7e;GZ$S0)DkQ->><S`E|(m
znSU96uleopADZ6{|GD`v{0Z}Z%=4ej`F_>k&7Vh||CqlF-zI16x*v)6Ep{^J`(JyS
ze--^4X#OYEKg^tc9&7$E@|EUKz~5{B8~8cqe1ERhobQLVo4*#vd!6}i@Y~F<!}0c;
zAA|gmIo}r^H7`S*33Gn`(zN-d$j_Ny34hW2t?<;IYuA_WFK3vaiT<<A`MzDA`Dc+Y
zG`}2PV*cv?4zKy`$XA&U!E4P&;h!}B8T?Z7$KcnR&%tjt=lgkgn6Dszulcr^=O38w
z1ple|?(pB5=fj^iKM~_TZ{7f3Hvcd@wb$BpKMTI6`8gOj-@F2TsQD)N5#}F*zr&ob
zGkn<mdF0PCe+GWO`5gQj^HcHqaF_W3@UNTm_2m1_--`UG`P<=-nx6=N()<+obLJPr
z|7FhiJy*=HMSi<CtzE}1_%7zR!uK)13;q^!z7Kb#Ip4>Br}+fxoNoRY{KMwY9GUd}
z33L8{^{36RJtE0pY0mdyyUagxP?G<u`PWeATjqDezi<9S__+Bv{I}+h!~bmlH~2ry
z{{>$$Ux9Czn;ZvUKTIo5KHtSW1HO;>F7QJ0{oqHN9|}L&{BZbt&5wuInV$;(l=)$Y
zq&9zCYJMj2*O=GByUovo-(h|}{66zb;18N#0iQ7Mgg;?^GyG}uKKPRP-SDmVPHq0+
zIz9l;H2*$)FY`y>1?InkA7%aoyxjaR@H5Syh1Z$C2tVI^2RwdT&EEvS&irV2k2&w3
zziIwn<oUmU%XzyN{;=h{;Zx?X$NQUqHoq77Mf2~$UpAkBXS{jsI{prxYknynzXzCa
zgZIA=H-8=c9p-O@SDNn$|A6_v@Q<4x1aCG!3VwxoDf|ZWbKrNI*TWw)=l97!YW_*&
zpEUn0{2BAB;4hkY!(X${+I9IVJk$JStjnI}?}i^}{(kro<{yWjWPT>btuj9qUTe<&
zKWY9p)NeNLN1ZFo?}p!Cen0#+^Y6h2%x4cz=JC7c|A9Yj{u=c88}m%~ta%Rn@8<kD
zi<ivzLH?M$wd?yh`Z>Xz=aVzc`F$;CoBtB?aGv>Z;TM`e1;5Pvz=EW|>&zcQpI<hA
z6n?k)Pf`E7=B)o?a~|*S%%4M@r_B$;xI65-c0Tz$bXW6Y<O|J@gIAfK3~w;6f?r~O
z7W``SJ<<0q<{v`-PV;*BkU5_(|H6Ft{gUH<+MLfv{%QV6)PLFh0{9N7$LkcoZ$Hoc
zQsfKGJK!bex4_Rd=l5xU$ow0~Z!*6d{yFnJ_%-G)V*hlTKl9dP-tI6jE=v49^W)(U
znx6rmFn=HX3G;K|Pn&Oo|I54?&j0;$u1h<7$Nkste?E?OH{TWWv%h%?b&AaIDNO2~
zX#N+>+v(>2#XR%p8`$U8_`a);TRsEcY+eMv!n_)OgLy6dHuFaKfcd5H@0uTSSaQ4%
zo4*zQ8}p;#v*zXS|C*l$PtRYwUT4C0F|UR1WByTiq4_5G(dHMzPd2|4{$BIX!|Tki
zg@4NYM);-Xx52M5?}vAr55n&-ABNv&{uB6v=8wZC%>Mv?!h9b7SM%rKX$P!buVwg7
z=3C)$k!${1_#x&y!As0{gP&}^FTC3PF!;IV#qcKci{Y1>x59hPuZG`kem(qq=H2i|
z%=_TKHNOk~7xQ8G^XB95SInP)zu~~O>vb?5?|YiR0e*=2{_rEscY&9gpALVQIqTP&
zpMw0y&5wd#WPUFE^X7YEA6{>MIr6uf^ZId@c?Ql?!{)ofe`3B5{MY6O!T)H^>&k-p
z(a8VDybQiAUiad4<Rtjc=KT5MTyy^X-NEL(J{@IVhx#X)^XKxa%s++v2hA^rZ!-TI
zuBVrn{|nx3zTaDteSD+&q43+yi{bZ}9}gcfKMnp<^B3TcnQw*t_80RV;fv;Pgzt&x
z6I{oO-;f;FzUEi&l=xfB`TgZbn|C9BlKK7c_n7nh%RgxTTjW1s{(Jbv=1;+|Fi*#E
zU2pyf{43@U<38^j=8wX^ZT=YiN9Hr|N6qKpPnbUkf5!Zu@E6Qqf~Ot4_Plxr<{`tJ
z&pWcsZ$ti2^GW!-%=vo;-f#X8^7ZDAz%MZ8^YL!;6xL<H{2!?E6LY?w_$zb%{N|kb
zOQ`dL`L{9d%jP@6x5w+se7x)q-^HB!|IOz7IfO&Z4@aG&%#VeiV15$(4D-|BXPZ~U
z&oi%uUub>>{4#U?e8P3+UqSvB^FEGy=-U0+0B<tq&qcJDUx0kOInP&1=HJ8P;$`y*
z)Y$>&b*|%Y;MwL&@O{m<**Q6$!_0SrA8VciuP}cfz7OVo=8bqi^<4A+!T-<vv$;t>
zt>#~WUu%8`{1)?X!S6Kx4t&V`2k;-6{}cWT^OxXHn!g6GgU_444*r699$z<qOKS56
z*YQaB>&=gc=a^rB*Le>x?|>g}{$=<(%<qI(ntvPq0rQ>ly3@za{|3L<{2%Zu&0mDy
zXr99BM_)6~fZuDr2mC?v{o#+A9|eEXybS(~`DyTfo4*IX&0%ZT@uTpa&3^*l+k6Us
zsQF*vd_92sWLumcPO<!s@UzTMfq%@LKPS>`{(j{7e4XQ70q?T>_3+!xZ-d`!elL8?
z{JA$I^Y}~iKf-@!{sjDK^KzV*{$bAR^@{mEIKOT8*0t+c0N=&@F!(;^N5cOfS9bv)
z)zz+TJh(%OI~14V?(XgscXx;4?owQfySo=DQYh|LoW4+sON$;h`+g2<uKd35^v$0u
z&#YN{XOc`ZGnwI~<ptnFLim?g7H;3?)Piq`=l9Lv*W{hyujT#WA+<ka;4$R(bG9A#
z@8wI-{~+H8x4$cmsr&zI&RVS}3EciJ?gzL%e_$TC9mkUJ)iM12sRqv*)AvU7Fuu2k
zcTnF4-djEbK1@CZK2N>?ZjZ}a3tz2%7kr!icX$~+4(AfQviv^0zWgP;g*-$Ke?RPa
zb(BYg_mC%okCmr~&ynYWua=jB?~~VnpOiO+zm<1}e~=G^+vAkR!(+zwum2o)V);sV
z8u@m3F8N`2N%?trd-)xB5BW3r5cwzgM0w<#fyc3a9RL0J@MiKf@b>bY@E-Ew@MZF<
z@QiW&%WVYDFYf^VQQjBcOFkOjPd)=aRK65GQN9^IUw#0-TYeh;T>d9Kq;B6H!{f@|
z!86Ol=L$St73Hzv_Be_ZaC^K&R`_VmDGZ+`uLxf#uLoZy?+E`zx3|6EmF4#L9d>)t
zL_QRK5BX^LDEVA?`k4NHErHwf$8Lac)SNx=t@7XD_PFH>@XPA|f*+DUhbPrK|AYTe
zeVE*V$Ne9<{XLrPTU5<Sg#Ls2lyJL0Aq)J4`eN|<nqLlX&!boiZqIAl6mHLJ+7Vts
z^X>1;?0Qv`k3e5r9wATQ{!EmA2Olj@1h?-K^1$=Q^5+(TTVDZg=g*Juox0rS@JsT}
z@ayt^aQnULRQPlC3*fKiYv8eTy$-<-t3Ls^%e?~MtNuRxfc!b!j#s|Cfye8K`l9eV
z@@nvKT7O;mf9hMpgVgtj+vC88!{e#{8J<W!51vZC5^l$RD?FY06L5Qc^#%Av^|#^I
z<p07O#`gC&M83d%w(~P8+#V;A5MD`hQoyY*0Jq2AmVn#ioU6do$MM%!AD&O%5uQ}u
z3qDip90p%4{~5kn{tMh5FTEOmUHuNYJudn%{9pCw;6YmdEqHkOKk!)c&+rABA2EO6
z@!cbj1wSKC3V$H~0X|okYtIj4x5ESFh0%|fmxs@g*M{5eNgMe0asBJl6~10`2EwDM
z9|w;wUknc;Uj=`!`J3R|<n}y3whzC`kE1^#zXU%mzYBjPe+qvo4=NCNd~eDl!LP{U
zz)R`+eh+Uh&jH^cF9d%eF9rWyUJZUt-VlCA-U)tEJ{(>ko`3zP!rRK{!%xeX!+(|U
zgddV0fZP2lC*k({qg(I?n)4anFp<Ch@C5^pV}tnq`?26{<jLT@<eA_@<@w<Y<z?XZ
zc-NZn9qOCH56U~ikIVbPFUv>6@5raa|B)|-|0mx7x97jz3lE>b-_PUlnDWc;<nsIQ
zEb<rdg7VLBd*0p1g#wSSJ)Slmyq4yqf;W?AgLjY@hWD0NfDe_|flrjTguhDYue%#O
zqR!hv@N)8t@QFHJ=?Vw#Ly#^veUU(aqRY(=pRK+Ke385&e6_qTe6ze2e2=_4{E&Pw
z{G@yW{D$0~-^;!(+?B6DpHtU&E4+aGAiSjf3_OecKK!9B_c`1ipKQ<jW$S#dK4Q_p
z<6^ImkN_S+mzxT1e_xaf{;%d2g{RV-vhYaq%J7)-ns9qubbYuzUbi{Cg64FFH<R~+
zca@KV+vA+4!pEs!0G}gY179WI0pB4%1ivc32(Kr<4L>J;3_mDOT`cgp+vA5b!R_z-
z^T8A9cAykIwY(ZUy}UU*i@Y2BvAiF=hkP`AuzWgvynHcyj(h`rrF<`ZyZku(p!_oY
zr2Ibow!D7v!2R!%)PKJPJal5;yTYT$2g2jX$H7y`XTh_|m%$6jH^c4my8Gc9llbdA
z3EwTh25+V7o4<tradx}3U6)$|UQ%8aZhw#65MEV%J9ra$Z@4}Fc{qHS`pNLA^7-&3
z@)PhC+J}qqW9sk1FUp_6AILw#-^e4D4BXGKy4*N$dpvUrcw+Tg;OXQA;W_2y;6>%N
z;T7f0;dSI);P!at0q}w9$HK?RXToR6_rn|NJUj+Jto{=Gto%8=isrn7+t0b-N(CO5
ztC|xN{y+Km@Hg^|@Nl}^eDGNE((vT+8u0A$Ch*+yj_}g*LGVKIpW$QV)8Y5!zrgM9
z*;c_@h6(!mwheBtQ*aP|So2T8?f2=|;iuH!gCCOzmHvA1|NnY?vA_4<4+Bpxj{>)!
zLzBQ;CG+Q`ftS&o9PrBWqVT%%N^pA|ay@u^^{wGO<UQc__~aq*vFaznr^)BS7syw_
zH^{fa_sf5SpOBw{Uz7g{|405e{Js2NctjnSFl7Rddwh9xcow-mU#Wdv%On2*eQ|jn
zcul!IU#ZQxt98~yA6<PTcyf6gxIN!*H@H1Mxi>s~3jg{Kf!podMED+E?p*j$`AYaj
z`8N1<`EPK$U;S_R$K?JxU&3!|&S&^E^^wX39^VD>IPmrI<nW#HOz=bUeDKrqQt&(S
zYVcR`=J28N4)DjizCXe3@!lihT{UMaysvx>yor1({G%@SAUvx2({Ov-_zidl^^f5B
z<!|Ao<e|$29!GoJcw+cXozH3D_Bh!b@D%Ec!n4Zj!H>(E!Sl#F!B@%q!fpOY_*V5(
z;Cti?;0xs|;05Gc;PyE1{qRcaPrz%*ufQA0AHZA5-@>QJKf^o8!;}v^zP;s<;3MT3
z;W1MBAD;uhTV4R(NnQrtUtR+~M&1}cN!}iAx1YV?_V;YV;L|l{3w*77AAFJgINV-O
z@CN*~`aAHVsr-F=1h?M<et>6JAErX!@v^@+_zrH5A5R2NtU2l6spVPWwr>UDHm4lC
zx8_uXw~{x6+v`EMh1=`F^@X?BoCK8u_rYHOF$H{3YQM_@A1yBkx5puugU?i78$Ms&
z9KKxM1^&By0Q{_cEc}{$7JQ$4A$)^;EquFtAKYGN?Ku3d`Wx`S<d5Lb<p06#@zP-{
z2Oh7GY5ezNz$40&!YAwTAsOKIxRJc@h3ZSeSIVoyH^>{qcgs7#56FLl7tQ2fuaWRN
znSGxMx5rT|gfCXV4sMU%-wofb{&)Bh`9=5z`4jjMU9Y$F5dQi@SMmRA-#<sw@%j#K
zk9$uHPoO?M{CjzBxIGTM1pJu#s_+-`hVTe!{dKp4$CdYn2L=26aJW6c&185=&6y7`
z7}B4!2A)&>PPjd8{0O|H`txwR{l5+GmfpYICvbb-x%co1>cdy{KhBQtY<VpB0(mlc
zZJj@v;LYUu;qB#R;63Fh;r6@+m*DAj-0#7&$)CgX%0I#Fc}pTy3*3i_>a)YQ%JakR
z_dccJ_0?C0+x;``;H}j6f)9}og^!d^g0Gb?hxe1OhqsgOhIf~rgWGzp!EMf8aGUc9
zzEtzWRuA0&aq{T!sq)0|Ir0+l2l9&Wv+}y|JMu2@%kn+&xAG)40@t5jpTAS!ZS;9G
z7hXaAN_Y+VHh6vcZ}8^wGw=@bKjA&)f5QjL|Ami~hp8EOeJ9AH!)MErz)#D6fM1s9
zf!~ssgg=y5gFlluf@e$Tue&|Gh`bNHntTL&f_w@*j*jnActZImcp>>dcnkSixIM4J
zO}IU-=M~&ufA9m`Zhykp3OtVXce63!_PUly;r6(;4DiL;|Eh3%K9M@`)#_Wo?e*)s
z!1t&h3STE54^OG%H68v={bG1X^&8;f<$K{#<;UT%<(J`!<<H@L<nQ2h<l$-u9<P@2
z{P55667U)Fs_+%^hVZTOcJPDp-tg1%;qa^S$?&`K`EYxlku~r)>dXHaxDQ$M`BEKj
zpBIhb_WO%=aQpeUKRmhS4}sT`kAd6#xo~@4k~DP!*I!!S|73>S>rLl}+v68X!#CSL
zz<0?T!4JsW!H>y%!OzNv!tMU&iSVoH=fEGym&0GlH^V>4_rb&c;P2xf@YwRpaC^Rz
zd+?U(-@xn2Kf&$!4<ptMJdXDK_Oapid>6^!c0YVZxZSUn7jECLR)Lq&I)8*`k~fFv
zk#~mM&oBMpMbwXi+v61W!}IHWJ_c{6IhWww<oDqH<<H@x<e%U(<&o+I9+#!^xbV&L
zl<;5WS>g8lEQR2g)R%|H(mwnMPbqH!x4%Q{3b*H}9uBv^2ObZ%*K?l*zpHg_gonxC
z@7G><O!*)1r1Hyf`#ib_&!GMTJf}Q-{lMc@KpqQTTK+xU_ALY4{(dhH+#WYn0^VBl
ztH8U+>%;BqOKZ4&{tki<)SQ`c`}uJRe6spq;XCD*;Fslh;dkV3;Q#7;2+<&L|DVYt
z!yn1x!c%De_wWYtAK*3Q+2DQTdEv|DMd7w@72&pTb>P2fPCNK$d1v?^^4{<R@?mhh
z-+LZBf<E7u!ZU^T_kAP$t>*s*|4Uw^Vc_w~srw<z!tMT|T5$Whpc(wO*4Y_upI`mq
z>2$ec;F;ue;g>akIlPbVZ`=Vtrv5j$U9YQfTmK#SBhC3A{EhqxJe1b|3LZ`V4xT_B
zsZro@vDdSX0k_-dByij3^l-Z!%LOl^%Pj`4D6a&!<5d@4O?^vvZFyIC1Ni`WGx->J
zNBMO4Lir;2digr|UimKg5&04LIr%xbeO<l@zp4Ij_*3~?xIJ%FsK!BG-|T)=`+64*
zZeJf0z@ugMKRz`)mAnwVg1j8uejaZCpQ`mYhYyjrhYygCfydG1PKDb#=fdqgUjfge
zIa}a)<on@8<R{>{lluGi7Cu&eP!s>(?YK0QM}fc4?Qnc}bM>j=o#ff!z2!yVL*ygj
zNwfItn+VUY>oo_SGKAkRhmQ#9`)2riUG6@(-Ol_0x7(S^@DN((J-F@LGk93_AK;PY
z;hXyFwc`?99upo{o)m7!{UH2~`aj?`<X7Mg<PYGT<S*d^<YAiyuK&C|Dtw|mK76)3
z6?~aIE8L!kt03H-hpR07sODUQx6J0R`yRZo{5iag{1d#IJW}((eW))_4F5%*9G)h-
z|MBVJFV*LQ+v6#U!QZK`0gtQs4dC|tfo<S+zvy_ly{_mixcz>18Qh+4e+%56r+q&>
ziq?4o9z!0gMc_W$^U*|xk5?ZLK0}@gZqJvL4Zd1^VfZe21^6L(9rzh}OZYW;H~2&O
zAo#!X@$k?&{C$}Xk0M_Vk0aj#Zy-Ma?;}42A0fXEpCW$<x92l@1K*=QRLj8QdrBS*
ze<BatDzLw0`v$L~eiS^pd;&a+d@8)Sd<(p-JXPz!_1usbfp5?0ca`90<o)3<<)h$_
z<d5L?IyfKT_j37{8?H^@I<Lv&!$0TtyX0`YeJBc#p2zRY!86I5!pq7#z@zEwdmnfS
z^<&}ox>Qr)P1G-hx0kPj50meK_m&@qcaxukm)H9LhA&qC3~sMu6}oNUafy=Ge?JO5
ztUNy4j!Sm<DfRi`H{{jfx8%*>59FQT_V~@daJ&C!B>b`FOo6|Y&xhOdlB|J$R=)>s
zuhaTFJVHKyKQF-Tc}#A@4@dU<Cvf|Fn@{lknjf)U;BhQ1j}5ONPX@QYXUhn;zh|oj
z|3Pya!fj4lxXtMcPpmm3;PK^?;YH+g;H~7#;6KWD!gt9J!0qosPr~hfo15^+`Tc$W
z8(vlZ3LaJ-qJ7};iY<={xBFWX!k4K}3Ag!K;WobzykS^>9c|#(G`}1CfAaqD7xIzt
z&+?z)ISc!jI|m-MfbT2dvE*Cfc6)me9$)=wcq;h~cy{?CcwzZlcs+UO4*q)W=c#t`
z@8G@ViQ%K<>EU)emK#1xeQEd_d2RT9d2{$_c^CK%`2hI;<YVD4<ul<y1^s<l3Qr;5
z44<y^<N$oL{4~6~=KKjCEPo6iC4UE>ArId%@Hj4%$A;VIR|>d&er1Jk)11O^dmfOA
zaC_dOdhkP<(*|z0GriyqwQs}W&E-?ze`x+f_&ND{_z2C}3!fnW1Aa|&uEOuh{|Em^
z{s#V99=cQD@%ku_4i8(%?~=l!$uq)Z%k#q%%ge$C%WK1@$XmcS%Dcf2$Ops!kWYl)
zmd}Gfm9K_}DeUjVPIwIYQFu!ECAj@w_$J)`e&cU=INd&cfZOvfh3o9E%Wgj_sZR=z
zr{kLzZr?BEgojdJ3~tY7R2d#seFJzyc}sW(c{g~^DE{>s1h1@q0^FYeXa?MFXO_V2
zc4i~ozK$P)kJIIzg4^xhW%wHP_u=+>@h{-^{Yg-lz~k6a=V5qwa(PU6T6t1<CixHW
z9P-@oeDdP(qVmdcdmf^C@E_H8hp&?NgU^(Yf-jWMhHsZIf!pWxTKIqJcf#)!_V@ia
zxcyvq23}tMpYRj%$M6gCa9#b&vCq@}@?dy1d1ClBd1`n~d3Ja|c@g+<c}4g-c_VlS
zc_(;d`C#~b`Oom5<@4Y<iUfUqTLdpAUj?_{7i@!H*3a+1!^>&TN%%zhCAi%W@D%>L
z`v2e$<e|Fx*TatQD|r;SJs(pXc%-8K$ESq1FXsCXaC<(T?C`9bQy894ULIatUK?Is
z-U@Ed$J7m8SN%|UWBEjQ3;A4lTlpGz7x@nONckbSt@8|glKLC)J@QBJWAb-!yIx_t
z2Of93UeV!pxk=zBH9r&F=I4Xk{8I2sno|vaQ{E8%R^AT&N!}M8UgzORcvSfmcwG5n
zcry8Vcv|^hcxL%Ycpmvxcp>>;@M7|}@N)7{JpzwoO?fnULwQDcPwiU?_-1)|xIHge
zb@)v6jo^#qo#7AUec`LM&Jpl?QT^*V6aKE0?+f7}iu=A69#Os%Zhvoo7#^(tEIgk4
zPk0LXBX~Wn^9_8hJY>(n<G5EI6@FMAAAVMz3jU`&EBukXApEtw9Nd1t))1am*S8fs
zgS;Eu?%x;)xBKD8!Xs!sGvL`n`}?&R9!LFpxIGWiZg^hxzr)MQFT(9O-i6!Wl|6?y
z)tt}p4)Q3y0*`wSc>?$Vd0O~5c`o>Dc}e)|lK$mYgxhhf1J9%5*aB{^o6rSrzqjoV
zAFKOaN5d2AI8KAx`LGaf=g(UBEnTmj@JI5)a66yR!R_^-?!!lF&Qo}P?av2zNqL0c
zfycLsJT}~(UoSbljrz=Rdw#tF@P6vc!Y9aU!B@ze!MDjf!}rSj!;i_wz|YBNz;DWz
z!0mN9Hp1<B_<x1p)0{ux59L?jujCKlVM_SN=_TCG!=OHa$I)I-AqqT^=ER5F?L%t#
zSoPWAQ{+Y9GvyWG9dv%yh4+)MgWK~ezJ(9e{186{Uf;CxsPHWE1n>g#H1M+W9Pmo=
zV({AXDsa0UXb5kjzCFCX{3o~_$K~*r+P4jG>-WO#aU#dzOLV!H;kN$!@J;Gp!0mSU
zGu(b}6}fNV@%mMB;=zmPdZmJwm1lz=)||rdQ}PP%EAl$<JMxzBYP#HR@cQyWaC?4(
zDe#=?=fG|K%i*^E&2U@)KDe#_54b%K!)16Vt>+#*gZvrXuGa^+Jx{{meu2j~q2`Q+
z+xJD&;PyNu3*mq3xU7ZS<KT9}?fE?q!|i_Hv+y^X|0mq`=Mg-nuGbs*f?)sp_vjzE
z4;R$;hui&Nqv6xkPlMazuol91s9y^|D&GUQzXv`KU#9*qcrtyT_7rZ%G2Vc{>l?eY
z|9*0KUU>$1M|m;$czJ2~WqD<|J^rp9+#Y||3jQLrzs~OPon?LR51&%T_tEe(@@ep^
z@`dnw^0n~Ny4+pxn)0LY#`24BTj!tf`MTUk@Wt{s@a6K51O4l5_rI-{M}@DK$A@p0
zr-E;nXNB*U7liMVmxbH&7}kUzRo?`DT;2hGQvMU%j@KmkbM-6XALU!&-|KiCgr}09
zg%8m0Yi_}Fs(%Q#%Y6;E%MCdw=<AyuN4wl;@bsFW0Uk@910G7AAHGgr0^U+y1>Qqm
zA3j9h8a`3p9lk_989qzC5Pn_05^j$R*b2X-{s7$W-#!Vq*K12VIB@?fm-FAx0xu~q
z2p=Rb3Ae`!SB2a26g7a`?Oq#rcg-ITx93}&2>)6ARQPK7T)5rewHZFXg1--Y;P!p&
zF?jOwet!vmGlcK=;9b-|huhcFPw+nK6Aba^+2>0Wd2+a|GZQ?W`h4&l@>1}s@@nwf
z@|p1B@&#~v-M}?)JMKH+_H)4@xP9Mv25#R6-hkWpfn$aS?%NO@-zo5Zwtl!hKjT{X
zc=fyB)8t3tbLAJ{i{*FVE96h%8|5G1JLM6E1zz7H^4Re6^5pPa^33qR<ptpX$;-mS
zX`gGsW67JrlgT^7Gs*kI^UBA-%gATIYsr_uTgo@Wd&n=qt5)*&_XgZP?;gVEY0hi-
zGI@yMfyZmTJPQ1{JRba_JSF_LJPZ7>ya3#8ugbtLR`l0b1AblJ7=BmY9{#=dtv5W4
zd>Gt5zb3)$^J^~LZYNj3Gi&}9x^AEM!^@~Y2j8iEyAHS8w}){1I{OAbFQmVpwMGOU
z_ZYg|MsPc?+QVmQJ$>Nzye=c)FVs(gzn3q7N7Hd!3vVjl1s^Rx3b*s;0^H7@J8(OH
zp2F>X_yD)_A;QSO{j{&kvEg=}B!_3#`H%x{`%nNLU)Q%7Jd3;xyqvrayq~-Y+>Uz(
zxILdhA9xqd84kC{`>%i>QNICh_uuY;&sYCDe3$$J{8#x4_-y${_-c8gQGv(ttvm(%
zvHS<P-QQ9W9$KGY72tOJPz#<{eLZ;kYX16Kz<a3g3Lh*V0v{)z44*Au1YaiK1m7$_
z2tOh}2fre}3%C3KU((fw8Xb6Ceh%%w9}F+4&!a?ed;RNlaC?5<T<|NE{rRQf_vN+V
z|HxayKgzqo)5r(GBUSM)cRV~;J{umSIm_V*)Ng^OmLGs;lb?kbk>7z=lfQsBm4_S?
zc)YsGqr>~klfg&Hv%;szi^6}ASB0;WH-R6JcY&Xl4}fQ>>R+F+@PYD~@bU7c@cHsh
z@Rjm?@E!6K@Z<7p@LTeS@UXhwcneP`k2E&$cpcYy6$5Tx7m~p3^DaHyK2LMO?Yu1p
z|4x@%32vV+b>TVHw}cmwcZHXg4}jbAUyp&eR6iZwN4^L?T)qxIS-uPYi~I<Dwfr3X
zLMZ<@-GT2={}vuz{sEpy9(r8hakt|b47b1EP6+=L+5h-7aQnKS9d5rzD-4gL_0)%_
z)cM>3ep#QV?cn$A^BVp_-U}X5^ZUbN%SXYx%YTL!md}8flh1?KmM@04kgtcomG6Mt
z=htDl-M@4W{#bL~!jtNDAjJ5<^Pzz}BHZq0ivusBJ_X#K_c;r^iu!`^n(`*_p7M6^
z6Y_3w`@VW0e1iJ1@Ky2|@U8O2@B{L#@DcKT@VW9+@PgI-eZLHkBfk$%BmWoPLLPEL
z;Bg!%j|`tE{|;WOrvLHr;LFvgglAQs1)f`80RAM{pI;rGN_{=}dR=ZSxc!|;H@MyZ
zHV}SXbH>8c*6`Oe1KwZ07(PnA9zIdN8$MHh6uw4&9&XQDeG7hG{bTrF@_*s4<)J4A
zo)4k4&%y9uc|v$>c^Y_Pc@y|n?Q;kCet8eLeO-75Ppb8YoD{hJOPUiE9!-6Gcr5u3
z@KEyX@N1f17;e8mEf2r1zBc@^yczso`8;@At!F7bt9&)QxO^kLs(d@ViTuFNf%{oP
z$MFw%=30Jt9&X<U-h$ix1CQbDH2+_CH+ksEf$Qln4~D;&CxqMcZl{6U-#2E5r_=Q+
z47a~~EDtZDpDSy_!)i`5xPAZA9d7&37ygf~*HF0a=S28j^$Xya<SXFA<m=$}{Onuc
z^VIKxuaxhH?~)&ZAC+H*$I-ssg4=oZ7;c|m|H4Pd^v|2nQv%N)`~71u+>Td5coeNC
z4czWu%>nPDz5u+rybQd(yav3Ryd`{?yc68^rytzzcO4BMqdC*zcE9~%_%ihy;Opgk
z;r9E)<M3VTFT;PA--p}%t1sYo|LSMB-A@~NYT$9dp!xCO%k*<oD!APrn+<N?H<pCk
z^W#^7+j&wCZui5thTHw{58yYn{%7!Lwf*b)FWi1FA9`BgK4e!P47c+qA>6+Hrh)(e
z?I+xBCkw;vcC`vTh1OFK9#`HTUPRslZtEWcxBG_|!kcN%GI)FWI{4jc{yy%9FW32Z
z3_eD4F2YYY_vhS!-;_UrzmUI!M{42E2|GRT_$HM{ho_e(hUb;1gO`!#gx8Z7g}0Me
zg!h%#f!p(uwSfPkz6<=Ayg&Skd^G%pd>TA*OMkx>!b{87!jrV}`<?LW^26|^^0V;H
z@;~9@<d5Jp<!|8I<RNDS9`}Q-{r987!?y7~K0I1G-&4Vh$+N<%$P2<7$jib9%4@+V
z$eY3U$~(hf%lpIAb@JCg2Hsdc1HM?k1ineW5x!skD?F&Pf4P6aXUng^U&|lBQ+M&_
zyo9%u2hH^V-Ttm-oIDEL9)BJmp1-UA@u}gz%Cp1I$&0{)yZLh}!c)oX!i&mV!JqW>
z=X8fB>*f1kcxm|r_yqYJ_!9XF_$K*Q_;2!q@ayu^@WlFi{TuL{@<;Hp^0#n%oI~hY
z{`I!w+g1H{@R9Pw@WlE%<Mi-c^4#zy@)Gco@~ZF?@`mtR@^<hz`n%ZP@Qm`|@c-nK
z;S~q^`!XM1U%m$3RlXBGP<{kHL4F?oi~Kfxll%$%sQf+rsyzJcps#Osd>_eU!9x!6
zyJYYL@=Wl|^8E0s@-pyc`n$cF@ap<|g{JU!@=ow!@_ump`;5`>d?WqqH68x5d@+2r
zd;|Qrd@uZw{5brr{0cmqet-NIJd%D-`5K;F9%_z%J?uCZlYa-VCQkxyA<qEsC(j3;
zCNBfuAg=|#C~ppbDDMgn*6;ZS!T%ZSU(X5fi28lNTzD$^DtIpW4tQDl5qK^61$Z0z
zUHAa`bNDRzXZQwrl(~V&G4e$J{RHsz^0e?F@?7wr<t5<r<<;O@<c;AM<sIQ~<^AB{
zbpPELcmerLcy;+Q_&WI(`0w(A@N&AJ?hL%8{3d*i{2%xV`Fr>td4zd^$Lo?j4!rqf
zze@@4CC>(*ATI)+Ew2Q(`^D<R`|9Vuw(!~VdGP7_Ic_<<w!i)@@F~rFKLDRCKLuYY
zzYe#@g*}9CSN{f{T<Z+=OW^)zmIuQN$P>XU%hSQ_{?A<SzUoWBN6M?ir)%Hp!xzfi
zz+cLH!hihHzn(+k@#^?K32x8-GY@{NvEQ$P-*4jkc6h0#z8`|OmY;>E(eb(ouOxpA
zuNlRk{|<gn`w()z|L^v7ZK*s4{JcB?++JVsd-!hkso_WE8R5mW|2g5G)R%&1R$mDo
zSzZI4SY8hvQOCC#yuSKQ@aFQq@P6`<@CouM@a6LP@O|>t@U!ym@Eh{q;4kH8;Q!P0
zy#oJUejlDw{v2La{t@0m9$`Vy*Ec(_cFAMGFUnKF7sxZhhsd+TC&=@`PdE10Q4DUM
zzm?z>>iT^ncp-T!_<LP$2Y49u-QbDjec-v|!{GZG`|BA8x7RP63~#JCGvPhuzre@I
zm%tavSHZW-H^5KIx54kq_rU*?AB0D(=U?C7;VI;&;JM`&;5Fsf;9cam;r9A}f5Dfj
z{|CNL{t|ve{vZ5}{4+daegFD~S?K@QK3@{cBf)dXzk`>T$ALGMCxQ==Cx<VVr-kp8
zXM$gm=YT(x=Yxl7;9t)o@C5Qw@GSBQ@KW+>@cQx};qB!O;X~xj;WOoJ;p^m`;r2Rn
zJ>gf?_k%x^4}phi=<m-ccmnwZcoz9ocuDzecs=<7co+FH_;C3e_&oV0_)hr__(l1z
z@aOVF@Q984eK-zJE<Xd$C%*)*F24b9CBF+FAb$v-CVvWFBYzD)A%72lA`h`B=<Az(
zzK3t@zaI{sTpk5pTpk1dqdXqGqdW<Gm^>wXwmdz2gFGwzLKA=e`QZ1}mxkN-$u;0V
zX-*UP7<otdY<XY!O8F@G0r_lr68R$dKU)6^_(%CVcofaq32!ey0M9Hx3ePV;2`?c(
z53eA<3a=%<1#c?<3!bB?e;l8|AFKZee=m=?*#9^?pQC9`9C#{uN_cH~MtB8zet5iQ
z{^gZ`w^v^k-cQ~T{#4!$Zm&<)AAU>y2>2NJIQT;OWcV)mO!#^Ee0a`g{`Fk}x1R^M
z!Rx8t2d^$a2_GiE1n(rj2k$F?1COPj)8j4)JRicylfr-1oK*1R@*m(=<yqm+<ayxj
zoBQi13eTgTiz~rvsILcaC~pma5!#>M1Kv#iD7d|D+0XEm>VJW6m9K`|{VF@)cE8G#
zrGfjuQ@;m)3tuM>y)3ZbC?5*X-O}&I!4t}7!PCq4z@xSD=NyJtSAP!PRDKI?_uIUH
z*Hs^8dEoU5rOS;9x4#=n0Jr&R;CBB&4!He2UQzf#t)~+Fq`V&dqP#WyhP(&-nS2U-
zlYB0`oqQ3zuY3i3vV0wUv3w`|o%|xacq{*S+=Sb4e+*Br{y%tjd5jf-$2Ye;A>8`3
zaNFnd@P3+818(O@6S&PE24AW<<KZ@EHr&p)<#0RSw!rOtI{>%y?G)V3pX+cte?G%k
zw)Xco{K~+6w&N8G{)et_GWb<_e)v?)F9EmfRTXZZFAd=%HK!fij&FZ>5A`G9ceT!O
z@YnLm@b5HdCOm`u7kC-@5_og@e)vD~V{qI5OK|&qxd*rN^Ar5C=7(Dqczmso3Ag>s
z1%Kbx|M<diTW1A$>^6R12VPv>5?)!}4PHk+9G+V~0Ul326>hInI2)cp{aX0nZT<Cc
zgEvzD8~l>`Gw_@8KjF5|kKxDFzlPiWmLXRM9!L9pi3V@3btZ)Okf(*O)#c`dZ<7~;
z?~_-7&y&}I_tWLJgpZPUgWKyh4uUUGKOVkDJ{xYgGt1$>$MyGd3w(#>9DpB`pMw7(
zzYaewe+a)Ke*?cG549%n_&$~g!{5sj!NY6+)4}caAalV}t1k}EW5*X>T;3F3Qr;b2
zMm`u`K|TRqQ$7dYP`(1*UcMFHL;f3lsQe;)g#0diwEP)-s{A9|)*o?g;BmC|$AR1W
zQ^0Ngjp3Qv`E%RA?RK~)+-`@5!tLwGB)ENDSOrg_%iRpOem~r9-(JDnYtBcwtux}f
zz<smtqvF8ra`VEMYJM@e&94l%`SsxoHD@6FmV6Z4_J11OE_V^!zTT~e+t<5e@Kd_n
zb8!25bPH}@cm9FfaS2`@xX-aV`R~Vr+x1EXx9gP+9=5$dr!YK%yaL?zp$^>kp&Q&@
zPp&`Q_F)X%zAn#%zwPL+a~a(BXDj@X`h9TwI(Pyetm}IfUcRt@xqrd!ey~^Y9=e?m
zvBCd1yZ^1H=0}BZ(mE5u?e+iC!R_mQZn%BjF9|=P`PJbU<W1mr<lW(|wEq6^*z%$9
zbn?;gg7S&*s`BaZU$mb2@ImU=z$eOg!hew;fiIPxhwqf%h98zcf&VFg4^P*@KM%rh
z3_Kt5%VWXq^+c1wyQ<Fw?=8;{A0aOTA1AK~x7QPG3O}m86a2QkA3T(f*JyY=`E+=C
z`C@oM`3871`Cj->^5gK)^84@@TK^NcJzn@d{F9Dv_)USwF}&u)hrd;y68=J-8(v9s
ziok6>72##o*M-~TD_g_2sqX@}`2*lKXB_;6=1hazoJDY(vj<*5$K^2G=A47u^}PkR
z`O!899+&c+{P*L+?dxMoxP5)h3b*gO3c>CBnIGZ#bh%C7)^~*4*RP-9<27eC+}6Jw
zZtLFyx3AX+;P&<UI=rtg_W|6#UcZEQRUcwY;Qrh7N(q0YJ|o<o_c9;c?$0j`xAUY9
z{GR4FhhLBnf{*CzuX{B7JNa~Y0{LQi2KfefA^Bc-dHHd;y-w<7csup?;REF1w+8P2
zZTWZbRr18}P4e9E6Y?VPZSsongYvp?J6^5e_WO}BaC;roDR8^o1@JIk{Of-bURHhy
zo?U(qUO@gFUQ`}xTi`y|lIMln>zGc2hwbWr{7m>Z%~=ZHFW&)wE<XUb+ksPX`@Zx#
z{IKRcgrAbXfnS%0+8($M_vH!TnRR_r!0q~Gf!p;h4o{#t72tM#>%i^$wuDF5oNjPi
z|0?)K^_$^U<@@1H<R{^FeXqgo`aXfr(VVw%yS|}!1n$56eDNK;d||&!47Z;<(!<;7
za&yDG%1gle%d5ie=Z=Q(G3qD5Lw57mITL<g{V(vB^84^HJ^eWmcl!UepTF$+CE~!V
zgz&qpaC<$}Lhx!@XGM5#d0Y5Ec`x`7`EYnjt!Fa)7xfF^3*~F!YvsG(_WBV=;Rn=T
zfFJzM-=911%j%!PZ_7Wx?e}F7b_E`nhw5X)-^x?LKgn~#LwEP*mV`%=*M!^au(p6F
zRNn)hN<JK(MLro`NIoB4MZO+hN4^i<Onw^PUVaPSL;egtP#&~9aQ{cigW;3pN#Qf)
znc*wth2dM|mEpVPjo`=Ro#0pG1L61N6XCDr^Wi}~{Oi9S9znhj9#?)Eo=ScTo>%@1
zURM4QUQHf%PvCK>E6)aRDK8A~BCiDRFRuq5A#V+jVt+papP+sSe1Uu(e5HI9e53pb
ze2@Gt{E++^{FprQ-oSmkE{_NQTb>&JpFBG}SYJnqz*EXA!tM7Xb>TVHw}O|FcZb)M
z4~93EPk<jw>R<mkaC<(P74X(k{eCOlz7IbL@2kr_4Id`|6K-E0U&9;dc02gjz~j|K
zo(SGno)tbtULC$e-T;1F-U5C^J^^m8uRIGrOXtZFczf-`HuxR+KKNw$3HT!URrn71
zUvPV#x>xYi>J#n@+~@Cl`R}KM7f<bbR=7Pru@L-&=9h<u*Zj8d{PJ$_O!7hSZ1NTG
zUh<7_d%WSVaC@BQA8>md<rTPH-v@AeJmyQdJuWh6f6&)A`##ei7a0X!SL=@tZzUfF
zztzW|I|2S&{T#Uco_8($wfbG~(vki7N8#agxfkFC<agm6<j>(h$%76A?$7Yv{`(Q&
z|7xAF;r9Bz$>DJ{Co?>iyZ}7Eyez!3ycWEvycxWUybJub{3rMf`AGOm`BeB0`9k>b
z@^x@~{oUPgd;Q&G@Kic3=it%gx8Sz_|G;hk-@)T*PPl`C$KCcnCfxS_d${d?M!4;N
zet0ciZV7k^c~!XWe?xdB_3hxc|GnY1|HI+7|1;o+HGd1-UO#v*e7O4G;B(}s;gNpw
z_x%d|h585Zkm@7+7I?hE_V?e94xgny3A|oEzs~?KD$faDsyW5ryX2MOC*}3wH|1^M
z1^fEz=?VWuJ`}!5J_){4J`ZlMQ@aZOQ2lmzkoMsaJih!aJfr+3Jh%KGcm`eW8~AhW
zPpCtI$M>B)7#>=462YU()4`L-bHgXdi@;0EE5fVG>%tq$Tfw`?yTb>|hrl0e-^Rl2
ze47bxrG6=Vh<p=#qI@6R&chRMJKwIt?R@(SZs+YQ_#$0yh{J)$*Uqb`@I&eg!GF}}
zdtJD_9&j_beSg&%Znra2;9E3*E_|kZCEUIr+XlDq$9{(|(VPeH&+@16=kgEmb(#Hr
zjBq4yKkfR)hTHdnW#IPuwN>Fo2l#Uv!mG*K!JEl@!_Ugc!1v0hz`M$4!N<wx!<WkU
z!}AaH*MAHiUVa)LPks@eUOxP&KhM5@w&%;50B<qK@8-bA4EB8`yqkO@++K%uFMNXL
zAA`@7UxY80-+^zFKY{-ye+NG!kNkV!KJ=HzgtwO`h4+yE0Jop(bHnZT>1E+{v~N}6
zk2Svmyqfy9@Lck)@Ryo17#>FbBzQFWe0XyCdiVtScDNmvoAB%-{C)o)+<wk_4d1Q#
zA&&(fFMD3!V0bdkj|aE&IThT_=j`ykL;TAt0Ph^e_p<P?@>+0vy|&iy#hTw4eni)|
zC;Wf%e(>;`GX$PeJ_=q^J^|iLJ{3MhJ{KOWeO?N;{n-S!+kt)XQ<{GQ9&f0>&sX6;
z$p3<Ol)r)xm4`SUc>W9+=D!~mo_4tJ3E=iRooV0&)#rdemluUc(7x4xN7Op&!>?(7
z+QIM2e}exl9|3<MpA7#`{tNuGd=)&j*0~KHPX0T*k^BrixBLdYu>3K+jQl;^{(d0b
zAA!fWiuxGv+VUiD+lTaU+lO3m+lOLs+lR*RwmRS1z{hJnJ>hfZL*Y#{XBxbQd>(wU
z<}8Nqk*|c`m9K|?mT!e8(&g@k7nPrf$JXb?b@(Xt|AX5;yn@?4ggFs-+#_m!6!>J#
zj{#pRj|V?4PXd1`PY=JM%gqiiDlY=BCa(gw+nL7jAJun;ca#r;50+1YPmnKwFOYA5
zFPHC!@0Oo|AC$j^M;qxMr=XL8$LpAG52L{Ul*flZl&6M&mY0P$*X34&+x$uJl%xFh
z&4SzK^)k5K4s3=;(VYG8IP#P5#PXn1f&24T9syom9vg07kCMZCs?Q9!?^lb$Z>p~Z
zzb~%`|6AS~{#@P*-cUXWURypMZs+GbxSgMC;dXxRh1>ag3Vv9Zdl}wW{y(^_^I!OA
z_2Ewk9>=NjxbS82l<;lx9B|u*5^&px8gSc(=5X7GL-6;b{dJ#&+t1_I;MJS?edIHN
z*Z1UD|NU6-bYpx^0JqmG{T^OTeQJ0kc?NiUc{X?-c^>!(c_H`$c?tMlc{#Yf&S(|*
zNA<PfNwq)q;hE%3;YH=G;Z@`v;Z5b;;oamv!AHmk!RN?Fz}Lvf!4Jr1z^}>Q!QW2s
z&xcTF1J9om<NWs{!0*VT!QaVa!DEcq`3BD^{~lgho*Ld>o&i2mo(*oVgO~@tSA8M)
z4S5Op8+kc+H0@gzcxrhqcwu>cczt<Ocu#q2_#}Bp_$qmK_%ZoU@VoMf@J<u`<23_b
zR6Y;>qkJ>`clir=+DZQW_wXe0@aO!0xBJKJd2eFD?eFB1!INoD3HV%jMR+TDU3gb{
zEBH`(clZSPVE8QgR`?G;``2?X{GR$_@SB<a{vv!v9N+K2?Q!KV;os?U-@~8iazmUC
z-2dnDaPWWSQQ#poKL$L4yc)dPWdHK&!C$Ly0*|7;6+Dr=13Zho8@!l&2i#sqZ9m-p
zuHXdR{;uFEJlPZ-7r1>Le*!<O^}K_hlZU+!cwBDFqr+dy6T?5t)4`)^o%!L-<i+9T
z<(1*J<vroM<dfm2<m=!M<j3Lf<Zs}yrfOd<`u`0PA}A<ZX#anE|2K}@ZcoyxPvP|8
zzU4s~&=*pl*XbvP`St<D(AQ93+36#G%Y%MI-$8u~rw<DI?E^ZZAECal(?|Z62Mt5N
zQvJ_P|H;{(+2~KGU+(l#o%tKkKT^Nf=~p`QkDw1X%^!B&>4Tm5H_)e2|H$bFI`dzm
zFQGo@l0VctAEG<+BgpN1sG~l%)9-fXCqds){SQtb)0v+G{Ydpioj!+ie9NI<puV=#
z$9Cp7M!!>i2d7`?tiLDvbLxjWeOzb$IP}ld&vN=&&iTIxeU$0`u=P$K-<iJyeQNcG
zoxX^({!{3SsK4&?37z@((brY~!s&yZ^}k2oU48h={!s7yN$kx3PHyMVB=w1%evh;M
z)aci!&+ha|o%sdOA5~x0=`%a)uZI4v`bJKl%$eUB{YUjZoPMpd{sHLY%<zYeb@~*}
z{Hf?Ot6%8!rJeP!LSIJxcBfC}%-@f`o%)kbpVFCs3H=21_nbbBGyfm-o7BH^`Z&(#
zZ>TH&2iy5@Nqw-~JAcwS^W&j^u0EC1uXEO)34NrQ{;>Q`|ARBX1p4pQS9SVF&iuOQ
zbE$9T^ckJ`ozYiN-{0v^I_J*_^i9=Iae94g`}I=hqVKDIrPJSZ*1rk;RQ3CuKC83-
z-_fs8f6?jBI`eO$KcxP#(`R?)zeayeeaNeR<ed*$oc)O;xAW(@`nXP?)0zK0`f#)S
zf6VCgYn}DyLZ3)|ai`Di%&&kxyZSm#|Jhl8Q}pH3cXIl?&ivl!+o&Jz^x>WLPe4CP
z{T!#y@62C<e!2RMPM_IX|1R`L)E{;Fg3kOi=x?k4)9K?ow-0}zx7TTV<@AM}`5)2S
z>$F9@=11Q7v&LC}47r^@_Bw4zoxZ3uKP~!Fv;BX}>GVgP{V#;Rq5ASpU)-5r1APzm
zO`LwGv;MZ|$Eok-^d+77gU~NkKi=sdJM*Wb|5g2Br!VcyUxWU#`khYS#F>8({d4uF
zoxZFy{|fr3bNqjN;PjE4{eOx+z4{MMU*4G?=DPomoew3|N0)o&&naj93D7rIpT_Ac
zI`gxj@2kF`(_eJvmqI^XeRZd=?98u^exv#}PCwk4-xd7{^#h&0sxyBS`iJVLIeiXi
z{x9gm%=L$@cKYhh{4MAct3TlMkDcRt9KF4++hwP(>CC^4zLMrYar&;#`ro2&sXp`#
zf2emp)OO}ak=yw*OnrQ(zvZkyIr>HFGdq19XMP^^d)1e8`n%5hE1|!lzMj+9bLKZk
z|5AMyr%&eGKL3P1$~=GANT+Y$%%6llwfcEZ|D&@%%h22Fy=`{-M$Y^_=xb~KF{cmb
z%s+>|qxxG;-^7{!5d8%8Z=61{GygOCb?PJk=@0eJpJvYdSaLgm&Ztl3^fjI1n;!j3
z^|_tCg)_eh`e?uS|5(xKk2&*ep-->AnbWs&=C?;*PJJJzFYfHm5cF-;Pjvb=&it9^
zN2y=x^iiGp>(DP#zuW2CIr9&pKdAn!(~oiX=Nfu@UAO-^eFta$bM&7z|C7`AbJid3
zrvJfqJ|vm%zaLZXoj;wN`H9e%P@m4}hdArchQ6)(!cO1CnO_F|0QEJU{zqqiL-do?
zw{!Y#&iwA^SE(QD^v#_4W6&Q|Kf~#JIP({vzp8$%)9-fne;fMe>VI?kUe5dz=%X(1
z|M9BRPj}XT7kzs5&z!!GGygyI<<y70<wxH6aLJh;O>XB;TlEQ@zOVnGU;l4P^h4BV
zb^7<t{^UbHTYYJ#?;rH-tqS_B>KizHMrZvk(VtP@&FKdQeS7OCx9e-K?=@QP?N3E#
z{gcthTIkQ3@AQLx`ucxY$ZdXh^;?~OsWbmq^!9pJe>nZnpl@#%(0AATJ5Jxg*`L4B
zPgno1(+>~&_7>u{|G#bhThvFDd;62dS$`b#=hUZg`jOwp2W3G2LVaGR|J#{g4E=YD
z{9%=yezY_HNA#K0w{ZHw&isz(E2!`5^kbd*!_c==|FhG-b@qQY`Z4O4JN<ZP{s#2R
z)bDlrUe5d@=ntwt@AMO$`8Uu%Q2)s3Lp%HP5`Bcl8g|G3uXjHD?97iKxAP~5`q)lC
z*O{LLePi`MIQ<l7eh%~l)E9O7mCpQf=;x}h?ex=}`Hj(USKq<uYdG_JqCcm8sMF7I
z=8r@FO#LjU|K9ojc@g?3OZ;K$oqm=xe+T+B>JK}8YG?i_^u^R)cltTb{QKyesej@0
z9YcTnfcNN!sSkhGZ@lwo-nTsHJGq@di_|A}`Vh|gQ={LnKD*P;cjgyBe^q^1r*9qR
z+Xqxb|5AM;r(gIj4{D7*@>2gFdpP|PXMYBuPpN*a)9V!ZI%q2T66zN^eMx8itI#)B
zzuoCYU+3>f-&g;5(&=wG>%WA4vif^YzueiMf6%X1|IX<*IP*i@^FP?mhePUv<=*+T
z(wQF*{Y~|$oc>|xZy%5e{eSB7JN@c!c~A-TahCc2Sk>u^hW_>eb<yWg-^%INe#?V8
zqpz;Mztd+9`|Sfppzo@Fiqo(EmIuv6KSBLUr~fVVw-4BaewF%tPQUS69`rl<L+UR&
z{m9VYKHw($o9Z7s{pN3Z&};M`)rY+AN8b7HhciEt+|D0+{inE2ztx%lJ^H*lc{4hF
zqcGn-AQ$={)fadA?cegC3g~}QU&rZph57aYP0`!yJauyVo!|1H-spE|{&1&18Rpvu
zOhA7@{T!#?{Vfk#g5F-YX`|D3cJ_Z4`a~=IVMm>QuQUG)`r_*Ubo!xTzJ0)7=-aA)
z<@Ec$<v}0OPf{Q8fggG2PcLVF47r^@+tep@`UB4VwCK;O&*}8<oc$?;{vY+_o&Gmx
zehu^yb>r8>>0^Zb_5p3tr&iy~=?{O)g9f25sD8ZDH*of6I{F&w7d!n?XZ{-WUDWS%
z`pVA!97I1s{b{E^=FGo>ey#ckPXESP|5NlQ)PHdLKb-kt{_@|k^WiV`(dFLx^VC^?
z0`wtP`5&Lg=}$WIv!G9<zM#{;a^{ypUrv2>r$6n?uaCZ+`ZiAg&e@-?=*Oua==5iu
z`J>QpQa{b<k2&*yL4QU4YNtQ%%-@3EUJvPj(-(I3=Q#TG`eJ_B=`T9-Z=)}-{)y8k
z3H$8>-lA`>KJ@?m#ycM_f6IfS$nE?YqdvaVKXCRZIr<gqGdulNXMP^^=hc^V`by6J
zR6_q*eLbhY?#yqFKHeJtAG<hxE@%Ev=(DLG>GZm5^Xs5V=xeB-=k(*8`ODDvRKMBj
zZ#nDVgMNnkV@_Yx+5dCscc{PR^!gF!>!mzIe@Xotr;q8JKcCURRv-DHzi99Lx#z4u
zmfX&tnEK{1nbX&E)}J1IHubrkUN?1LFQo|j>gp>xeHUkbE%e>hH*<Pj#jo?*qo1k1
zkJG<*j_(lkd(=;K`bW<G%tU`j{Zgl2>daq<KHNHg*lwqP?94xeK7;zRPG8O0pKIu=
zssEqTKXK+iM?XmYC#MhPoIl}o<?Vb}r#`0KJAa-z^An-Jq&}U~?{U_j4gF{Jg`NI|
zGrtV_MEc>Qrqf4p<~Ky2PklS5f91^Yj=rJ#!A`%+Ilg1i4^cnE>EAf>7ocCIey!8T
zb@qQ7`g7`kbNYXs`6tjnQ-9Uzb2|HT7k!is{;+3G|IV5JANq{y!~X3@-uV#SS${OS
zoj;Y-Cv^G`&is_<o2$?2^lhB|&xige^`)KulQX{x`kCq*IDI!~e_Ep7roNlg2YtED
z_SO&mN%f<h{)n^w$>{H^pYQbFJM-6|51}89H^U>#_c?QteVG$p3q65;m->tFg!1d~
zH1a#}?DGG?3(KFt%gbNEYs=rko5_Q8qiN@rz1~k)xV_#_WcVn}i4LDCj|*QQPYhot
zPYFLF&m#9eFTDM?x4h`jt1s>JcC5UQsgM4V`nKpJ>jDO%54Fkvhw<nWs9%IWmHG|n
zv#URhzL@&+=u4@8h`x#Xx9IDskNl7SKkWGSR3BgN?WeatE!8JSKT&-a^gYz)MZZFQ
zY4pR?S3z&D1Jn?`-51{ty}b_5VD!s1e+>F}TF*@Mc3;n0^s#j()^7C2H2)0xEb4Ef
z*Po>Y{SSRP^>5JY(=+HZ`ey2*=$j8aUiP&lw%m^I2=yt@$I$0Y9`vi!mqMRGeP#5A
z)Hgt1Kz&Q}*VK1MUq*d@^v~6gMPEbxRP+(I_y=YY`ey34qfe&(F#0a)PodAP{s#K~
z>K~x5sQwlD(dr{S_1A01%U-W2j@*v#boEKm57qpP=vS-Hg?^Fx66p7<uZVt+`g-Wk
zsBez`lKQUbZ>#T%{;B%W=%1>ej6SUH^j(1dgZh=|lc?X0K2k`3-}j@p*F8FgKEC?P
z=xb>H1N0fxKSke3{YUf#)rWl+cs|(cA;py2`A|uHBJ@i&KRx<J>a(LipuQ;jF6zsn
zzo!02^n=tlLH|;HC-f844@3XmHvjrhM!!h?9P~e^Ux|LR`c3Fds^5?PH}%KRH&TBY
z{dx7b(f3sU6#Z@Wp`QmH-|6b3%kB8SRi7HYz5Y`U^wC23a|@!sp!wy|f3Lm<`q%24
zqR*wi9r_sh!r2FXIrT%(XHq{2eSP(_&{tBw9DP^yd(d}Re;oY;^|#QEQvU?~O!aTk
zFHj%mg}>i+yq2ktD!1G7?dlVv->g0*`U~o_p+BNNKl<0|%c8%bz8d-{JN$JwM*p|^
zHt5r+?}h$@`a$T+s-J*9rhYb?fxfl+rRdYDUx$8-`aS6Fv5|+-uTXy;eGSdOf&Qra
zztP*z#;?#nP#^MT;Q7#B^CQXad<dgo`o%*(S$#6}->c7z-u@OL5BlQjOQGMZ`Ss9u
zQr`x>{jES(^yAeJLT|s@7>#~~`WfiM=)Qmj=nt!3hd!?Q?dWf-Ka4)D`fKPz?(&b*
zL-d8!zd)Z<ebB4G<6B*Q1i2mGJnG}1Z>l~i`l{+PqPP2MbD{5|z6AP_nqLw9DE0Nw
zPgUO>{X+F!(Jxlt7yWMaqtS0xKN<a1^$XA+RlgGbf9kiRzoC9V`dIp<_bK#G)n7)R
zN&N%#pVdD_UqSsx^!B^ku&@2|#LkCy>SN07>qQ#fmzN0rc=hSg7gnDg{Yv#k(N|Sp
z4*f~>Kca7^z61K#>ieP}rG6Ot1bh7JKN<ZJ^>fhYRKF7aR`r|ES5v<q{qO3Jp>L!9
zGWv_^Z=)Zf{wey0>i<Q*RDIYtfwvEz)JK!s`LIuYBJ@$i`5&JZ{eAU?(Wg~k27Orl
zQAREFh1EAg|AYDt=<BH;g1(0ON$7u4KMQ>i^~=%!tbPOfDe8Ykzf}Es^uMaVgZ_y6
zztLY&{~!8G>O;N_{QP~dK3Hy_zfaZ2L!a<h|Kn4m534&JGo#O|z99Pe>Pw;jQGE^c
znbbEx-$#8r^d;4IM?X*f5cG}Ik41k_{Veo9sb7Ttq52Kzr>j4VKF&UWKhLAzrT!uM
zLh9e5zoI_qUw@u`KGs(sRc^=kAN6t24^p2JeYgnz+>Gc~sLzi+rTP-+538?+KDYXM
z=>JmR27M*<UD1D3KL~wY^`p@z*dO%uZ3g;|>KCBTs(!80C;f8Y%t(E{Y(w8r{jczg
z75&RS4!<tH1ivf43m;$JpYs$xP5vHUx02t7`_KQcohOB~&KU60@+$C-@&<D6yz=%T
zSU=ZyML$^mK&RJ_SYH=13H><r)8Uil^PD+fF82T5R--?sew*XzoDbOLc-k*M;DA5s
zu;X4|QkQVdajzew{)*h&hcEvxD2@8N@XYe(m~(5t{|_G=_bzv=`k;6I|FGj_>x|^M
z*Pm4%&2e{~iRHG=+UnE58_9EG&Ocgb5y!pDjr-;Qdv7Hi_bzw1_NTJrUf)1{b;sRx
zHkI2tNBZM~+QTQxf5M!1`~80y?znfki*>o99rrFbZ8X21>bTcGQa{sicb&`Sw$ANZ
z&qnw@`991EtNr=Iaqn_7hx9+-wBzpOUU%H<N2$N%xYv);{Kt-a{ciQo9QXP$>Oacu
zdIf*^H}5Udd;h<79>!E3$8m4|bIniSxV!$;j(dGs-58{I++BYz$GyIv`h1SN>n|<0
z^*7S`YqHlTKoiHk`5QIAh2!4*ak{=;9QXQ2y8oev<6b{e{b0wv-X04&+;OkB*D3qi
zaj&=MmYU|c*H6*>g>t*T`@Z~}_qNXIy*Z)ubKfS%y*V>9=K$sm)SOfB`SR;<yW9ux
z)9PQz?fg02++SzV2mimGd+W@tb%u7_-Jf8`z22UiFQ((}{v?&#{@CYN2B-JtT+-!c
zaopXX!kF{y%g1<c72x)DunycVw;8-}NPkWjx$Vyj?N5Kly>&*`&tHQbclT$!<6hrf
z{m+iO`!i2&`!iqbS>^QJoK>2$&T)5t_F_&W%{dMqD8CH1%e@0%ul||b_UESd=Y!+k
zI&W#6K_C5nwcb9zB0KK&dG!5Tu;cFjB$V6!1nc%8t<!sR253$O$KCzOk2$Axy~@C!
z$!o&xavQ;uYCRp~c6}qY@UMR#$GvrK);jw;?yb}IXSCy9A4NYejCb7KpILI-pMhG>
zGN<?ERMVVQj=TG_6LSh{&JlPc`FXfq?w|09>L1H(f0Al{{&n12=SZ#dgX8Z0g#YyI
zyz=_n>LWYu_4c~GaUJ*iy!!bfq2um;rjgrzKGXVhIK4M#pyuRp+}+R8n6qAUYQRs+
zo51aI+rfkM^{$WH_A|ZqbGYN)I=9%*Uyi%`In8mej~db6-&u}({n7)zFLm7OTdH5_
zxVxWQ<+h)VwElxm@6B1GIY%6K_wyp=B-Na|@WS$EaJ$@h@J{N(fBtq}d6%14`x(=5
zZ=H9v&bW?yy?y?saNO(jMe^sSaop?IXg{+%?)6jD=XTud?fZ@5a@)_-T7MO%_vT#H
zoEnaMbL{(#W|%Wkb2`J<%lpIaa!0~%sh=jd^RtZhbD`tjI-^C_dF8mfpBo+b`c~?<
zI_~wGwVwwZ_xk<n4?FJe=UKV!r~SU>rqg?K!bS1ddDn4wKVM)@kiMV!3{NVL9Q0-A
zmp5K+Y<Ok$Dde`F^|YUv9rxCmU+c{7xVxW)9ryaF>We$>^}lLAD?9G>Pt;d;+}+Pc
za=TvZwf^=_@6E{`)!)y~j=TFg5OX?d&N%o)`7F3y?qc{p^&923pY61tdmZ=I*;?y7
z;JCY=Cmr|t1M1H@?)68spMN^;^$GOz?;Xe8{d^*~{Y)Cx-?#Tp@6BnfIiDSO_cN+D
z;LDrMxutzb01wjqG;q7ztZ;kmabdabXJ74SdB?qVPSZLoJMQjhJ;%NNsrp8ad;KZx
zXFJEezI3p^Kb;(R_p`6u`_GsE7c^1Vca+n6bH;1VILF=noP#-)HD?99lYA@OE_WY%
zzWS4L+t2YW{Ofhqac`Xmwaz~sclYy=<6fWeJAcj-$G!fF_Vb<NUf*5)C&%6WjOZ=!
z%bWMlU;mfBzl|gJ{^QNrr8x;4clR?L=Iqlx<bvOl7l#Mwax21v<@My=f4s~6Mf=&x
zac`Z^w9a;pd%b;q@8!7Hmx=E0XJ5y?{*Lx@q~l({Q2kiPz23gQ&yd@GcGCKnIK4OL
zf10zxac_=&ecz5bnKkDSyt4c(+%ESze4zSAa_>Lh<sQ?1zH!`JXQCMX{=9SC>uo>7
zhWhf(mpAX9y}pO~h>m-G>!$vk*p7SsDfRIk_j=pURC3$TTUviMr}yT>is{eK<+wM;
z_Om4B%-5W1@O|<|aJ$?#@Mr3K$!$NcXg`NK?ya+|);ZE~cR!~%?)8h*&v4x9(=_w1
z?_$Tj{)77Ej=TH0S#JATSwDa6cY1G5(OCZcLyo)qc^-3uHRm=wv-}C%F85!!{XQ{l
z=r4=-@@D(_Li-urac`YHwa(a%f4#oipJa}E{b}{79QS(re9!8**Qbr`??X<<-Tf>o
zxBc9w>s!g`y*V8<r<&vLem23Jftu41K40D!ZkIb8ep>w$x$S4<mj3mc@3^<l#aicL
z$Gvsh=lgocz5b*6&5nEhBi(-PbKL7|#_=!rH^<%mJT15V%&eb(Z#ca-XO8CFcHG_1
zXPEO$`|uGStoaecd>Q)Xjh7n}URZrHx$S3Z?Po^Ey>*_^I<q?Nt@DNUr=a6rpDwPy
zKSdpP_ot%V);VA6sq6IKoKBk4&~bNvI$%yC&G`v#_mhl-+vWZYU#~gy<+eXbTKU&&
zwd3A8muQ{q9rxDxR{OKtaj*ZRexKv+{`?`g{R!63`&XRan^QcVzn&Y8yZiGPb584e
z{Re+04;%K&&@XSi++cW8ttYYE_NTh`C!OQoI(uuK869`8Z(htFsQIOw-kbBQ=9F{X
zy}orYr?BR<gg26RgWKiyhfh>LR&Lj~sjlw~$GvsF(mLlj?q1*JnEy=kw>Z5wCvSZJ
z`0jAry}m~=XT9cJfS;D%f!pOih6m|>n|E@%zMXY_!-o5^xG!&>d+Y3|bw+gDTjvmc
z9~;|ouRp3jzT@uxq>|ft*huTi=Jej2s0sZ2$>q4aKP53IspeFJ7nV1I+vT=_cT(R=
zZu>J%`!m#WZ=J=o&XJCL>pZF3+bNEF{T%f(9C!C;vE26OwAQo1>Ag93G-r$B?*9CS
zITJPK41B%(Pq<y~|KPXOzmePi%+&sb4F6?u&iNB3p?@61I_|CWgKj^gJMLYtPU>Sj
z?(R=Ax$RG3-T#)!>Ag8yH7A?n?*0_ToFL7q1Wzij2e->@0k5pSo80zioAzg*<K8;|
z);fne?yWP#L4V&SI_~ww6Zt;Had&^_%WZ$wYdve6-kUR8b2d2c?$18V>7+R);1lIn
z;dZ(A;QQ3SklX$oZ0%pKPmX)*{8j4=8R5%2U*4>@ufI_p_xiYr{W;Mc_pX=yyp~vQ
z`;%1nH>P)bZ%zZv$>g{<$9`Tbh&i`(y~@FZG`}|7F1HChv-(bQyS`!D_}8ni<K8+a
zYn=lfPy5B|s2}UN*FRQ2(Q&W0{h1@T{h6rstZ;g7PSzy;de%7Z&9VL2jX9My=XZD~
z`9-*0?k)Iy^-tusKhfIx>v`w6x6YPY=O@S0esMd0B1Zi3&X+fDj@R!~AJuWMxBZDP
zxBUsy{jsT?-kTFP>DRGA=^gjx*#6|joPD}prQo;Z)!}xz4dB6APdmBoPciLJFUQk;
zSx-K#v#;acI%Dhn8R@v!Pf<VCad&@a$ZdZ*X+2Av-kWn(b5=O+?$372$*eht;FaZP
z;dZ&#;RDq_lH2}N(f+(~Jl&UdM*H4Bj_(|I_a|(mFVUAbJAYcKkLb9&Ke6SuKex1=
z<WBEh?pn=B?YO%?IWcFx<`jePlUIh@<<@~eQ{PH%`_n-C)6H>jop-g)UXFX~wC@jx
zI_~xPlll8O(s6fxrpRr7D(n9F1y1kH8LT-=9C!C;Gv)+q&VG1i`AN84?qzr*^$+B>
zKLfQtFC6#QxlQYQ<G8oZ3c9~BWaKaJIOk7ra({oqI_~aIbh+)%KCLH-(|ea&Q*)9#
z?(R=k%o(UTh2Zn$<>7X@HQ}e#H<R1`Owj&xa@<?z7_GCL<K8;$@9_pY?)CT74|Uw#
zpNVqYpUnFG#ayTN=A=vE@ACr3-ThgQInQ*x_P~QR{}|jZ_dL9?`a5#lpS{|jCysmT
zY^Zg<aNJv`ef|36xYuu2A2Q09cfP#YeEa$pRc`w;U+YQW^xm9Lnv=wFcYiWsP9x39
z2OlUe4Y$j!3SY0jk=)k*TKm(^ac`a3Qu@cSljGhx?faj;j(h!B^#dLEdfT6|a@(I^
z{hT|~>Ag8;HD|8l?*6RCoYT5qJK)dchv9a)r{PJpo<HTbKj}L8`|!wdZ=K;%`ToRl
zZ=H7jymQ>^8>#=~xVt|Qqkf6LyxIN?)OzB`z4dr={*SJEf$zC|`v5*dbErnhxj7Fb
zX);Vr&YJTaVlkORtjwV-7Q>1hG7-wk)XHSeVxde{#AJmUMyn7)D`INu`CjhN_581W
zUa!8ddj9r)KCb(^ukYda+syh9b*dY;^Jz?VLQ$s`c_h3exvtxjJQ4W_xXx!d<}=2)
z^mz(>MjN;Di8U_ypoVUqamMX@=E8M8`saObn!MDRiaKu@xARG*I-9VskIA#)pOfpl
zS>*a3Pd*9P`J`Yz=Z#CB8`0+_<I<<TKfGaF^1cCXK7Sdv^C@+o7xE6BPbB`F@qV~o
zKRr?B0poT)4XBPk>O4Xo3J)dMb-R<tAU_DM^Vy2|L>ZU;&PJbOjNAE4HZJ*G<YSH7
z`6R$~KH2DJvB^uFI*r_%-!yLLlR|Y8QD-yxCirLMy6yq;JmkNF>wNZNK0g_kJ_n-D
z^Twsmvin^Be;AkiCgg7zxAQ5Ezp$Y53B{k!-Urv~=LYKBZ`{tO4%P8NorlQ%;UVO@
zZfEk|$cMvqK0XuNej|;`ew#FQ9%Wqmyoo;tj4>|x1mq_hxATdI>wGq$pM@qbbq=D=
zV&ir`$y6r>b=H$7!grGEx|!q|$bSph`K-iz&KQ?I|3#la8J9k{B7fDm<Oemub!FVn
z=O4Jv#~*(lUADaUo4rG?pLbE`KI3*iwcuJO5Bq9D?t}Wl<ht$?<js-q4cGbniTy?x
zm;D|^pOMC;&--wHMH`oVV4#~%jBz`kIJoXB5&gVo@=|9a>MS&F=aWQrdZW%-@)-Db
za$PrrJQ?|~;X0p&6WzW}8kauTpwBbLrO#ebE`Q0m<b9etziM3a_hX)a8JGN1$p2$p
z@>P&8Q$dRU@4DK8{Jq8{ukSyr!FB#Vcn&l)d0Dprb($ELI{*LmC90Ewxpg7WgNKvr
zx<kqR&`&g6=RX?rk2NlRHf`qS8E0Jj)cMafF8NoHUtrwMbA@rq|A2gwaXZgcxXv>M
z{eNuoQm6hyuFp@5+j$<KI?Yk%IC*dQPvpApW%79B|AOm07h;~J@B<IUrO(0Wvy5>&
z&&tLnzZLmv#_fC>z;!-(=;slWmpZplr<HL#pUzY#8Fl)RXTT%Lb=|S#`N+q@bv_?p
zJ_*L9&t}ctd7Nup`Yhx9E5}mflAnY83geQmjr%vnxa9MYPc<(2ddP1xF8S6EyLHoz
zOJ48yOt{X!H@;ux8<UqhGf?NaajB#C`&p{vhdRHLH;4a2uIu_%^on|i_7jPGWw_2i
zWRlxg9plpHHuTxRxb#`ZmGx<1T=Ms{aCIIvE_t2*6UHS!3i-~)C9m`EYh3bskRM=N
z@(ppmo-r=@Dv!8+Mj4m9p09~;olgelGsEPi&QR2uZCvW;`Fexu#G}qC@?>}#xvsmN
zJRA8;xSp>)IA7VurOzek^O$kzvyAtz9C^kie;N6+#_fFa;X0q@`2M2XCNFhb1iAXf
zD!GNUPo0k+T<hdxUp2}7P`@#`t{X%iiu@CBUH2&F)6=;0IU0TTH7@&|Q{44G)VSm`
zkblOwozL@d-B&XDnP&1*r&LQ<e}-|Xqw{&4>O`W>O7eJkD!Hz^g?tn88E~DC-(=TM
zmT~E`E&9whE`9cD=kmG6CBGE;JmYpgm*F}eKYTycEt8izCsF6NaXX)KmA#O6Xq{~A
zt15XuyaBnc+nn4V{X7QO`82?Mx*L~1?|anEp{H@_vk9I*gN;jm4Dv&b+xd)z>%J1u
z&lHoFIvY@DnsGayc~qw(>MSRZf~Sz{x*N!sBEK81^LYaEIbdA+{26^_8J9kL3~_VI
zF)sO#R?c&cOa7r)=NF7i{!QdB8<)Jk|12;r`K!nm8kf92|9v0uKJX5m|8?xQ5?uBx
zb%KIjKUIxO9ld`8sLnRjX-R$z{sg(M8%ACN-=8)ZuJgY-#q~4Fxb*of`W$Oq`fP#g
z^F`y5{~Y<L#wGtK@~;|~eD&6D-Fe3CJeR?Bo>A!keUq0u!%=6AaXZiLRHq*5>?7Cj
ztIQ_Xbx)E{Mx6_AooAg`x37HT(&sYtdEL15IR;;6)*q;%`^`c9d+~!-w7y;^HQ}0H
zihN`8ZSYp)TE9K{S>$`cb=|Jm*AU~fuisj`{SGrO`wGQ*A7@<hUE8?)c;k}S@6(=U
zT=J`tpJ80`df&~5>l`}b`wUl@ywv#xb&`xr9i8Vos#5}W(#h+=zaZCjkC2BWe;Tgy
zT!eXEG%kJCXzS*4#kif%E#s1Z0r}g;?R-jC^+MjE^Vx=eD#N88sj~}psu{QQX+(7<
zqt2t`OW_^Jb=@B1naB@;>wG@Id`26WKJ(G%IOEc%UT;&3OTJr(o98s+lJA1+bB=Mz
zzlZ#M<B}hY{Bq-x{~P(0#wD-U^BUul56AnTb;cz>8ufP=m;8F<cNv$wUjO^ydVT|{
zyZs(Bd8u;^b#jbL9lid4p*k0EUaph-qJFVz-f#8}UbifHF!EL5dVaU!{MI)veFi+{
z`fp_1&a<U)$<IW-wQ)P2PH^pW1^Vf0@=|9%>I^V$=QEP(3__iW<gxG><ht%_<f+In
zhwFSYF`xI1OP_`4bB%F3pRL9v-~Vwp&mG1kKLOX<KI4+#fc$>rl8;0FsBy{P9qQ_T
zZ(Q<vef|vB`TOGgTJud_>hwUJ>&B&yUY~bW_df6rt#bf#^CQ0iuSu@!HYBftep<qH
z{<)Zcd*jmQtWfE~`?+VvrBD67ls?8Ke=77&+^4^B$<M(&hZ~oCP<xjjY240p0$k@1
zi~gsZywsVBI<t)1c`l|p!Km{t`5^c@a$Wah^0~<GgX=tNO>_G?VqE&%h(3=Rmp=9R
z`GaxE`#$07{A}FL=Qp^{=K}gEG<m7h6LoxQcprF&_Nmv~eQ>RliaIsO55OCd>$;DS
z7a-pruIoOE`SdU@ea=RoeT>`rJZ)U^xyTPUZs+qHT=zAorkm$flb1SmIyj$hT<Yk2
z7E+xmsPi^?FnkTUuDh9h4Dx&6I-l;C&mrT|=Rov%#JHW$DdUpgg!~W2?R<WP>wFHN
zp8}JYIyX?K(72sX*_vL+JG9PR)Tu(A3a?MD>pn!DgM2%<&Sx0r)6KZ_*`%X8k3Edr
z`8;J@@(IX4ZQRc1S-9>ixR$H`qRC60gQzprxSh{yRHp#@T1KwlxBou5uDhPREBe_5
z*ZEAseD)icKL16Zhm70#d~aOxgF3nWo-%Id^9x+(lZt+>o4nL{7j+7Z+xgsG%L{pj
z))|9370KtqYm@7`O~})cZw=S^%*A{<8J9kfqR(!|rOz#RpU~g9<O4gq`8;LZ&SxZC
z_f-YoS3l9@rOrgudC|C?&nr|X2m5-1ya2w6T-RMo9)Ny!z;!;grn`OZBiHviN2tzR
z)X6n@+1DEEE6=#y*Kbs(E9w-IkAatd&@1X4I!|5qe)1K_*M{r9T47&JjZ2@o=<{LY
z(&zkrZVv5?OTJ|n=k1M4ei8CLj7$D?<og(xyw3A!xbCX}{f{+ysdEf<o;Pmi`7+f>
zN1b`(Iq>D=y6$RnUw^mXjc}dkGnnTt<I-p8t}egFxb*oJ=5xrn<ex$Qh;cigQ*fQn
z81!?&<fTq3>RdK%=kqt!2|yiRfA2SYht}^3uSBlvK1d#md{em2XD;T`+PL(28hy4i
zE`6@Te7YHz{G;8ZJMZ%b<90qz!L|P!|2uJ?Q6?{S;!tO-aXX)vsLl%1d6hgJzJy%Y
zeTV!4^6TI_pTn5X4&&12X7stsxZUr5s^7J?+wU=xmpV65C&#$m?=Mux7j>?a2f&Nf
z_KJFk&RN$jOFjtss&L(J9`;+`xbzv=-Sywdxb%5>rt_A@CI1TYt&K}wpC_H*#XR%=
z@ky`k>hv{vsdET*1{jw*`o4E0)rm!&iR3HbGstz_*T@ebzZ|afd0>X?^L^ver_Ynl
z*BHOE-zeu>jZ6M1<aZdi^VtV4=4GXPKpj^n+vKIrD%3e<+|K7`s&k>XtCLUei~6_8
zb=|w`NEiRRu7Z)T1lRdA!+dHRmp+f7&-%ut&kyiCdDyt*n})eQTN=0XX%8>vWxaoV
zR-m7rCNFg+p-x}pc0R+Y&LGrzo;(&lja=7#g*+AcCGg^2FS70}%x9%>=`$65t}-t9
zQYGCS))|+4u^!Gh8ox6iTyMLKOMWo&dyGqdo4($`b)Ne7n@&((@4E|>&%%EHB)<$V
zUe{a9JGg#1@)~vBzN*2Cd%sQk>>2O8fpOW_R_v>>amnw(z8*C$`Eos7oi@hr%<XgM
zo#EPN9Qx^J@=~WS>I^h4b#y+Xs7?s#Od^kf$CK;2^T-z<zXGoFc^dOcF)n@1L7%C{
z?R>V8>+?ASu5-A6bq|}o)XzixZ;abH<WZe8)VV@_0R9)bu3Ms>x0rWmKZVFwfa@G4
zVGgy7OP`f`-TCc4b&T8d-i+!;)N}c^CNFjLzu)n=al7B1RHp{&3?UDJk0IA}Cz3}a
z9}n04#$&$=j7y)1*l(h7yWb?LpN0BsO<wAJhdS$x+x_mQItx(eEAlk>cjUTm9(gYE
zSK+$fMcD6O#--1)z1{ix$GF{ZnfhMHJM{VqsqgX+z@@&_>4Q4ejobY;raFb_vlV#_
z)bB{H>-HoMLp}no`&||9`W$0i`g|3AMjMwt^}mM_Yh3a_ARlL3^7{P)bB#+rxQ|<R
zfpN+2EAM=Tamg=6KFPS`^?8yC*ZHSmzaN{t)cGEDJ~1wJ^tpO~>O`Z?adQ3pgFlh$
zx|hj!qt0J&o&Q$Mzf=RS3GdMBq+H)SANrIrE`93!D;t-6jYPhhamnla8yJ`TXUI1;
zE_t2*qsArwKtI<{8{?AC+~>TrammLZ-`%+6vydNPT=HKbKiIhB_56;4>-nwGz^yyU
z<fYDi;m)TRmpXcWU!^*^I4?`c3*pJ+y6#8hf#@e4uIKkayz3{^xb)c(eI76_ed_r=
zW?b^`AfIDg@_K&H8khVH<S!VPyq@3d#wFjYzw5KWxa4*IB^r7kc!$n^0rp!SuGj6G
zs8h+f)Y19ZqdH-z^Ducd{4sJ}w<~!P@&n*H|C8}|+V&Yrc^~|J#%RiGpVKJ68};Xs
z=fdA4*ZQl-%VFL1aP712OxNcp#^t;m#5_MWF7wpSi@!21`MLvKox{fMc{~Bv^B9eO
z&YQf{c@}jp8Mo*07S#zvol*hbZ}twY9|pglT-U8h9*2ArxXx$IEVr*##--19(PvxZ
z(x?9UY!~B_zlr>l#wD+R{y5OM<a-Zv>kct)=Q$d#`^`oFlTBXgEJK}G<942Ns7?~<
zEG6F!Urny-t|PyU{3mdoXZRequP=;CpNG)rSH|spjvJSJy+N+d3FCG?=ioY@umG3;
z!{nvTSk$>;+|H+@eBd2gryS~3AP<B;NUrNPB9B166<p^NjrnviE`6>-pIwa0FPBES
zef2Xg`2yqz8o!gr=Yu2Qy03Kf6JzpHC-f;-f3k7;r9Q7_Q=K@}NhDtZe}`PxT|=IQ
z{Ks&e&&%^%KYNW!pD&=#FO17CzsKwTH^wFZHS))e%P;kH=SR5CC$N!Q_o~TDor;5<
z|6yEysq-l&A@9&Sm$9#V$;+XBb#h&|K6wc8kHB?4Z_IW5JZ@Zm*$sVmFfM)S_0!9^
z{PI2I`x(EJ$MrJ|uKQYnexglYet8LXVvO7Q%%D0EsI!1P7XB8wuKPZD8uFXrI-k|J
zzdkiCzkG0ro7-OF(&sr`KZlLWFJqDa#<-o&X}Hd(Tw_=NlF7?2KSQ0X#_fD=Q=KgA
zt4tH`H+zTHzYKqXT-U8lUIYC+1lRer#r4zHxU_H$eLim7&gV(vk`Ie;`|V}i&SwZ*
z`;S9EV@zJ^yn#B=#_fEjQJoOfnM)o4f0JC-T}8eC`Soy}Pw|;<U!NG4KKG-~PmSCC
zens^!qyBd$FLmyD+SNa4-0t@x)k#C08{}E=y8^wU-l22Wb?+fBM7}y)_gfwNZD?Hj
zd;)zoF@9&ics*)mT=FZCZ)@Dnrwd&BjA-KK5N`5P=SS2TWZceYG}WnrI+Mvm;4{f}
z-TCCv$iD^G`J~}~`M|jJS$U}If30ylpO1}8emwG@7`OBJ0<QDPLO<V{ywv#^b-puh
z=W~wgEI^$<$kX8elIyyqn|h0RhxU_;`~z^E&mqjGu5sz}68dat+|K6_<C5<%%+0fv
zaXX(5aP21~(B*rZywrIOb;6C?`HY}Ch1gdNc@5NmnOxVMLmr0wn{b`aCCuj?<I?A6
z=ySDk>GL99kJcNP`~#70znhIqJ|Fo{;X0p9=;sjS^?l1p%10yr3;6>0b#kr$5BYB7
z%Qf?w^A4Ru^O>&yipFJMF_F%z7?*ujz}M^Q!F6Bt@N)@TP+s@dp7MF<rzg4o9EKs}
zT7M*YbF4cFuKT))^E<=1?CUG+YqoLOm%blcWL)xfhPyc|F)sN(aeh}Bm;5y3-#31z
zKHk4=gzMZA(f@9fmpXe<C&ReZ(Rm)BI=xXRmplf3kzCikMxKm(v4_0HyhG=?Y@VCL
zJ;tTa8|bsVap_av|JO7w`CiYsI<<}4`80*=e0-X@d>fOOI&Y%RW5(@#dQhDV>}xQ2
z9(**pt~-I;5B<!5>wGq2KJ$%Bp9j(BBI9;GD~(IO?g+QvRmSan*1>f?G3Y1V<fV@O
zcWrhXxAQqfb(*724ta0*IdWb1H}ZJoZ^Lyym*U;NN;mhK^A2(8^Ih!s9^-fRi}y2C
zjZ6L}@->ay`80y-d~(sxqb4tP9!LE)#_fE%QJrMe89=@pK7w4=eU3aI`Dt*S&m*t7
z`OGmceNIN7^Nrj2EH^Is!^p2RF8SMdUac`M`3581y6cQfzCxz+9prW4`;1GS8K|@0
zxYW__H#lls@;S(VZ~V@_@SOY^uIF*kL$05Elb1TRMmfK3T<Yj^@~(%y54=O`R6!j-
z@?dyPa$UC}`55F|!u34X#dDy&ap|)k`s`#}`fP@I_AxH`H01jmxAPee*L@v8KhK-I
z)Y1Pw(M02RJ~OG#T-14;JQco@T-W`8JO}x$aGg(C%x8~r>9gTzcOLf{zq4Ol&qs_)
zJ|6j_#_fE5fa`pMo4fj#O<wAJi8}el?R@^FItAEQxfb4U_71II1@)_v>$-KxyCVNE
zT<6mP^J!;X`urPxwl^+)w!rn%!?@)2zuVHsxa8X+|Fm(*uOH*)Gu*hH=W}q~Zz}qq
zYVuO&8tP0pZs)m>>Wo31x5?+i*O2SFo5|CW-vifq_QO2)Q@+N-ZokJVug{IMl+Qu^
z-^mN$|B!2a-$%Tmc!$m{0P9wUYoDXgXC31*&wyuLpAC%5JbU0gwlFUFnaDqCT=IXE
zaCM$AF8PzlcQ$U%dtbQrKNtNEGkK}wKi1VBVceegiBzX6>dYV?17AR{>n<Z-fqV*F
z=lLDxxyiWn*&lswGj8{rLG=qz|FFqRot3Ebjd8o*JgSq9I#<YZ;D3?px+Q|V#k@o3
z?~9*nQ~|F0y@>tRGA?~)qt80VrOyGlewrDVe4}yhJhm`y=kpj``x%3No-}!>Gahw%
z8MpHpN_7HIXB>G~cr3ZDJBvIP`9!$R$8WydSCVn*GX;Gn8<#$ZVLoZbC4U?FO~xhv
zEb_aJOMXDKTQ|eF<R>7XWnA(bk<T_R`Hgta<QkW}?{ltxo^i?RpQl`g>-oyXd~TV%
z)ai*jw~b33eIAx;>3!fGS|<s0s*>-9Hz3z_o0DHg{xP_ouPY1OzPcNiK4+uPp2nq5
zJzs;3OFkF*p~mfe#=>=9VUM_Vr<lCdsq?(^X~yk*=24w;sI#0r5S~J=>uw;AKz=t|
z=Tl~(>*s)R>2o0Z%rb8Gn?v<?qy9OQmpbpD&PC&PzXen$4s}XC>iuT#(0L}oE0F8D
zHORA&Zw%M{Ho$&cP`-JPn?oq&^}6jv`OByuL0%4Zo+a1%lgLAmp9$AKTcOW|#$}%0
zVxEhQ-#IT)uK#z8OTNi?=c|p|^SB=V|8qt^J565dOhBE_jN9{gnCe8J&Pnn(_%Gy1
z@ZZVP;QzvPKHV{&ds-E}PO^}HfIJUgAFg!<qE1uFcf`*JYfE{(9=cQB2l;{I{_rSr
zt^YiEZ{*|P+UHpGnLzn%$iG2(?Q=EdW02oKo(SJXuJykl&p`etT>Gqp&%1x1d=~Oo
zC_e-Hx@BChw-0f>-8L@Qn|{Ad+2Eq*{W9uTBKLXJUH^6A+UMI?_aWo5?q#g|h;dnW
z7ryTCxN*sMigEQj7`OLVFSy=ck?1GF<fYDh)QL21@2~Mx#~*d#$V1_;k?Xok$YYRS
z4cGZ>#(dTrmp(Jl=Vs$}KA#$weANkVK6{PZ`5cDpe6rEcNt2g4!%*jpaXX(YR3{O2
z{vzK5zq_?p)H`_H^5l8QKM2?PluLB`YD#&ZR?b_ISA=(>I!#cgk8#=WQtY?CaXYu+
zRDUw+KX39<=OpS(G;ZfMlj;Pa&g<mi@Rj7c?g!)v$Zv(~+&;#B_ZXKx@0;l6w$HfT
z?-8nh7WH#YUh2GzI(f$Jet)AnDX3FOo(V7A#w+R_dY$OH_mf{ozBXL<`<-4V#--0K
z=<{LY(&r4kpKoVe@?|Hv`Ls7K`MJpVFfREh<og)6^L!ev`w9<s^~ajL)cFW?o;Pmi
z`7+h1h&uDg_2(HbC)agXlSiS>M!3%NCg!=zxb*o0`rKpO?)MPY&qVzklb1R@Cc8Q0
z8n^rXmFgs*P62reykuLisCVd`b=~{Ok0D<ZuKT@vvFoRiap`jw`fO@k`n<Np<y#w<
z{3+zy8JB!+9hdKBT=GFLIPYQH&hsg_?klLZ%a1a7sWTOI#u~Tte2MB@#~fZIuZa3f
z$aUR!$U7px4zBZThk5QWE`4r9pSz6PdG0qZdEXb^eh(S9^Zeep<cA}F%DA29FL0e_
z3i`ip@=|9F>J%8a^SnF63wejui9(%<<O%TF<hpJX@@>eshU+}TG0#rMrO#aS+0D50
zxgCFAGmz>ZL;d087vSTmPBNYY(~Qfyb*8xUGQ+s6tM41<8<+ev<QEyY=Vc{a=czxJ
zGS%dz&R*0>Gj7kzE~?|(#`SrCJOF;2T-W`9d=T<i;CfzK;C=Wl<I?91^m*I3^!Wx}
zM@qNzKJX5yBl(b6*XKRPCI4qd=hfgkpLp~WK>3ZhPJ)a}{qd+DY+ULuLq8pjOa1`z
zU5!irwO3p};l?Fj`z7atj7wg>t`!B>{`1iP1e2FKqfzGt<5EXI&q|;=$*8lKJOlnN
zxvrZ^o{#)?xSrpyFwf77OP@*T^K;|U=Y8J4a(qqo!`nK~rM&LzSIYY#UqId*Uh*-w
zkj_)<-$x#ad`-CS>&Z7<KlP2vzW&6%8X33yYDx7oQNIJ_bzglcACLSn@?>~4xz>M?
zJRA80xbAB-_LXQ{_SJK$+wW52c3;WHCBFvw6yuWD>v<Dg=ifZU)&JDwrOp-9*=t<t
z=zOxNPCoW^n%ocdFOloI*U3YXFaEf<n0M%W=3_qh8kaunOmqELFn(t~gPhkgF8OK5
z*D-GA(+sZjNk%_yO<wBkMV-fu+xhgQI+3U|gghQThFsU3NWKaAc(~4IE#|Ypxb%4g
zeI^>W^GPx;`Cf5uZpp^&eA3`LAHQ}k|B1;<oi|bEQ{#3%SyU$*`#M3M4?j<?>*kaD
zqo04^I-gH5pE99dbKW5?eI7)g_ZqkJsb*aAbzgS-t!3QKr!idT6OVpcnY`3_7IoSh
zxAW;vbwW{RAbBJ_id@%yo;(rxIJnN|d(3C9aq072^tr&e^!Ywse^(fn{7vMOj7xqq
z@~Orp-+Q{7XPR+4&vdxXGavnbVe(RE8R~px+|DzH>TE)tbL83ZKgf06LUNzST>oX-
zdrf$U&T}L_&#G)(`aFa_s~NZZZ2&LkWu;;y>OW%gQl~Y39!o3ZcE6pejz8-3BM*f~
zlIyx-$zza@h3kG}vEKya(&zK&bFOi_-=$PP8}(P4ywu4>oezxL{cfW=iKw%ed=va@
za$PrvJP-NvaNTb=ynp_K^4F0sB-fv}T;>TmtN*)B7U^|jT=rW&{!YxNnsM20aXil(
z7?=E5<Qp58d<O2jM~zE<AM$OC+w;;HUd+pS|M)~a?)vFx@=~YtOy>iQ+w(Gt>eN7;
zN#r5$cye8L9(gqKE8xYwUS!>sm}jza>GLu4nPOb>`rq}~1lRp$qyA@<*Y`h%DZc>u
zljLdeU&yuo@8r42{|hhf^(cLA#J<XQ@ILSkaoN}MnQs2~8JGNiocHR+C7+M{gT^JF
z9_8vZF)sOTvz$L<T=Ktma^BXs<ljU7apRJI`YD%x(zxXRM!uJE$sa=hLySv4e737I
z%(&$B{p~oop2v_-myb1hsq;4K#2J@5dVc3qokE<K734Kg{{wPecO!Wi@}I)>{KhSH
zeST$J`aFU@4;z<0voW6&#w8z+;Od+<F8MRaUo<ZHnaE!;Zs&OmuJcSo|D`&5zu7zV
zI^2&sWsKW-R)uSwXw+#yz5xCRxvtxed^hq>!gZc2G0%a<Wxs{!bBJ-f-_caRMtg6Q
z-Z9zarOsG<Jt5Y(-R~T#lN)-cjL%Z?LilQOU3Z=F;;zJ<|N9AC_Z$AX`+t5xzGAQQ
zZ^`xh^v;mCD&g|KlI!<Z-y%;&{ZgI0p?HV(qxCD0YyAhwQ&A_7{8M-^c?P^A`B(5h
zaJ}9F+q-=YqkI(RHqN-5-&Huj<BiMty`1UlOfxR|*82B=j7z=_z7DepuKgsmcXg6Y
zUh33()%jZTvGDExQD;BpcOsunUTTi3f8sytoTvN%<Zn<u75(4c*=yQ6^f{1>ydQZf
z%%>{(QRExKbw2T^A4Hx6Z%>{H?@68uA3}Z>K8C!+6K*~)ko&`Dkq5&UkoSha4cGf(
zHoh+Xp>a9yGccczjLY>?-}_gN?ZzdagZxh8lGoS4FX1}RP3Y&S$=|u&@b^K!H!gMb
zb?`jZi9wxf<cV;fF0Nr-w+wj(@>SqEpEod{dd8*Ce&{p6xSdasamlA4A8g#trz2eZ
z^zY#2+{fgl&L61L-?*Jm6xGSYz9x|Sp#F4nU3ZD8-@se<Jv@isGA`?0!}Dhq`Jyje
z|L+@b=;hl!;Czj7sk0gRb#R?SbM%=``J>1mBtHp1MSceU6Zy~Z-^g#kOLg^{^A5cp
zN`C43uRvY{-jICs0he!1-VXUk$@{`X$j8E;AfFBIO8z0dCwT@uocuI=FnIwylDy)6
zx35v;&EV1GJ>V0`N5NysXTYbEFNY_PZ-UPwKMYSK{{_B`yco_`5_xs_d*p54spS3O
z8_Anvp4-Xekl#<f1b&n}7k-NT1Nas4Ech+*4e*lPieBgY;g!kv!E2IlgV!U!2=7RK
z<)FKM!pQIb%K2FGuaKWeUK#o6<kjKx$os>WkspP>M}7vrf&2n|C;3z8^ALF`@<+-2
z;U~zO!_SiMg<l~b0l!8*4StJ!KKx(uRq&GCi(U_#;eO;N;nm4IU=DT3uOi=w{2%y3
z<W*6pC3yh6J^2oJH}WWWfAZDv;pFS!lgJmqr;(3^&mo@#UqL<xzKVP%{6q2+@Ga#3
zzz>t}KIHDB@5uFj`I%hri+u7*sB@eAZFrd{i(V(|;8n<H!)ufK!<&&ehKG_*gg-+*
z5<ZSR2tI*43_gqe8~6(H^YFFgx8ZxpD`mO)A18kSewtjbpNr&=BL63Oe|WL5qVpdK
zznA<;cx7^Z&etLDjC>IJJa`xKMEGd(ki%{c<H>cu)5tfY&K&Yj;Y-N%I$TAr*I^p@
z!{}!l`AO8zApZgW4f%tplS6(FJdgY=>Rcwj3;EmR1<04^QS|)&2CqVX5#E5j59)U&
zp9mjKz7sy4d?tJv`3m?P@?`iD^0n|)<Qw4Y$hX1M$rr*i$n|>8BA<i&b@DIZx5<ye
z@9kN1{(r)okw5UYyUsh3w}lTQe+fQ@JOchA`9k>H<UhgRBTt5>l5dA^AkTt-Or8%v
zMDBaU?e`3MHTciuP2hL+Dmu?zaDVcr;7!RVz#k`H2p>ki9zK=)EBM>wm*Km}@5*-j
z%^<%Qo=aW_Uc7hF{Vs-=ArFRECQpFZA)g0tM!pc<mOK{Tfn4v$UgUbe4<R3oI??1$
z!KaY-gwG;x2VX?q3H~;DG<*yByYR2bzl5J6zX-oceiL50Pto&L{u_7R>yfvDw<1r0
zKTh5k{v>$>d?5L7_y}_Syk;`_YsklukAlx4e-=KMJO=(c`AhJn<TK$b$@jt6lK%kz
zn!Mz<ZqDb(>%xDB%h!eEYcYEKOZkq-m+k99l7G6SroF%41J|$Tj6=RQ`AB$Ea((~Y
zhWsVuJHut&5~j~ylz$ufAtry?^ch9@UC76nd?{1^CCZ;d{uPtIVCuh4`M;50Y4X0N
zehTINkGh#|Hu;B5{hgHWg#3P!FJtOwQ+^Ecr%nDbQ~x~W=Ocg3<ja}*g_K{9eCd8J
zB<JfbQ@;XSuahIlKWOszn)(5h{~h_3Cf^ocLzT%rM)~`Xxp_Wm@_wd%IOUrnKiuSJ
zn*PU9z6<hGOumAtA5Zxa$S*YcCZ_*ol%Ik8`zBw})K8=QYUDpL`BtX?&ndqT`6DJ@
z+0@UW{CVWhnfypo|0?B6A9wTr%jD~L_5B?C_=da1^m>?qydQZ*cn$Je@Bs1vco2CI
zygm6ScsKIL;Qh%vz=xCffImk*0R9sBQ20mWOW-@;av%A6Gm9(j2A4(oZOEUX{1W7U
zqWp2>f1~_I$d~9}^t}9ud<D4nlYx9g%2)f&_1Tj0r;zVX`F6+;qWpE_pQHRR<fl=-
zTp71+0_A5S{|4pjA-{(5E0O=0@<GTSr2G!#b12^#`5!5N0{P!4KNR@_$`>MEVt_j@
zGXJ~0t@^tUeQLw?J}Upcn?pnL2jGvA*MNtR2f?2p4}*6lkA(Lmp8^jjUj!da{vkY)
zd?$Pq`PcAh@-y&><iEpX$xGz8xlJd(AD%#78$OS`1w4_wD|{Jw1U!j+BK$q_SK+DT
zZ^Ji`Z-j3n{|vs9{9AY?`FZ#u@<RBx<dsgid7dV31pk@5E&L*R5BM$er{VvSkAasQ
zSoAse0=z7F0=zu=BKQO3$?%%wYvJ|Ccf$k855j}UzlVpAUx9ZZ{~O+oyuwL0{{iHW
z!H1IT=gVWs{gHo>T>l(r7I`z|myi#GuOfd9zJ^@;*-AbV`90*?=OOZF<i97M2){_4
z4*#88`?*c7>y{o=^m=;-bt;kT+-j4jBL4{aC3stM?WYU5zHjMAehPIW$@S0KpCi|O
zO(idN%3W7;$o1>7?~qqQel2-D_!e@l^BK8*J@XKGTh#fUyaW6kTwXWj4C(hjT%-Jb
zxo%(o7;o(ThKBQ;7k{eg`8{{W`8~!Z-)6q^^2Qr^u3w+8VO;VF$om_YyzaM&amgP<
z{vqR%zlMI=kpBe_h3g!mI=eo5n0ynjPN-v_{>Ek9-I&7&s#C9{`wf#Q{|E9jDW8k{
zV#-&-zE)9w4Eo$id7lMt-E{IbsPiS)!S}r!C69sUktf5ikf*@^B2R<gJ=hzTcj%lm
z;T6dbz-yCd!<&&`fVU;Dh<SD;uLAE+?hk*4JOVzRJRTlLo&bN1d;xqJc`E#U@-+A+
z@@?=>$+O`H$<M;SC->>(u9LIme(>MPo5TMh4}zB+QuO?Wz^jml!|Rg|g0~=#gg;Im
z3lAe-3V(`x1$-2FGJFzwIy|0yH+&&^Cj4#kT=*LD>+o&l6>(qhC9eYin%p0LiaZ#8
zfjk8MCwWJB@ra`5F#>)cxjrXrkWWUw5qT{9QSx|r2l6C%Z}MdL)8wh}vE-TXDdc(Z
z1oE@+#pIXa?~<43;_jn$<i7B9azFUz<Pq@WaQVDdUSI0tdHw_C<B`8&^74Au0I$~t
z#-+{>)G0JBd3`@~_tV}7-l6N>x6tjYta1DLTiLkO?~i;n<C53c_xi>qpNxDX<C53c
z>mYJ{y>0{7*OA@bT%TRoF`t2^j;x!4IgF&dPghsx1<LP7em3PpkY7UiOUSRLd<Od5
zO!@CHhn?gt;0LJAHoZ>Bcf)@ozYhP6yZ~NEu5&0o)Eky}=$wPG-^%12;dRL);myh8
z;O)rc;oZsS!UvKk!=uPk;1kHx;M2)7;q%Fl!B>!9hkrm`0N+CHgY&+Jyb3&vyaxOP
zc|G`f@^JVy^2u<YVMWhlEc_nwcz8AP74U}SN$?=@6nJ}by-$0RXCXg?JR3fSJO};)
z`E~d#@&foGa-Z(*eorE=0bffV3Exg01>Z*=4bLV|fS)Fx3%^932){|53NIE}^!#pv
z-v`&Pf40NxLN(*^Jp3EanOer}>p~;rlCSl;n_E-klK&T<Pldqsxsi!}I+JI?!>LX`
z^f}D9tlJ*zjxcWfeBQX^=OI7Qxb5?0<B~s${7mDL*YB%bU|jN56WtsVjZ0oXKV4~D
z@(IYVGA?<2z1v`1KHrRS<$bmrmpXkHx&KF|ami;OpJiO~HIP4PT=G8huXp@pT=H{~
z&o?gl=ExTqm;7hQmm2N@|9{?}boDF4^?k*4<m*xXI`To355e5pkq?JINp%WwT@4~H
zf%+rK2f-(jN5E&0N5L16XTaYg&w_tQei^=%+$YS<ErYxS{4jYr_(}2r_%Gyv@ayD3
z@M6ytJ&(QN_maoMtCJ_d1IQP^Tau^1pCC_#_aff}k03t)A4Q%GpA0YVZBOpIv3SnR
zFfP~g8eCVijZ0qNC%<l7@&}QB!?@)2dAJ&0%royFpFH%lj{E}r6RI;GeSTqF*1dvt
zzcOz7JZ@a_ev938b;7vq^CDdPEI>ck$bEXaI>koFZvOZ8l|DqD<&4X^k6>Lt<F?Q0
z#wEW9`3H^LJ{udC{IAG2GcNi2esF!ZHZJ*xmpE@{T=M$d?rL1}`tt|Ej7wgh+XIbD
zzRprte~59(*Fry|j7z@On=U`rxa1om|B`We4&(9bGt;=#33|iTS!7)DiQd0*EH^Is
zvB-a5T=E&nuQx9FWaM`lmwZ0*`;1HeJLJEC>viSV)AjQs<;&r`{6_gu<b9&tLdCuR
zk@};NFHODx{(y1m)4#Y|*Wb9*>5TK$%(&!xBj3un<n`wjbTTgac;tH;m;4sgk1#Iz
zO~{WlF8K?{Pckm~JmlkyOFkUe&phLj_q)sOcZqSy&qIE-amj}w|B-RY-#|Xyxa4Dy
z-)mg*fy>;wM~q888TlOJlFvZ>^KiXR@_V~FH!1%N>X#hp{bujbd{7^kuMF4g<Q3%W
zQ9cyUv4_dK!XG0~fj>!}3Liwi2|kj%9Ioey<W=A^$b;bv$iv`ok&l6YNFEK}N<JB$
zL7ojiOnwZ0k~|mw3wdxacV4cOcZC-lRrEZD!|x@JfLABah6j)zgSRBlg+D<ag6pjp
zc}I8zc^Ldz@-gri$)n-3$tS}T$rIu4ke`KrM1BFjgIw>UO!5HSFW-;{!q1TF{q-w(
zH1Y-Hli?*t7d^jA;T6bNz#k+}h6j?T!&{T@hIb~<g!d!Qg+EPx0X_~c&l7oF{v7Xf
zrWlv!SSp?~(~L`A-#5-NF8M>q&o?f4ec!keuFtmu^z#9^PhWR`ZKXOF(B~fGvhG!^
zyU)1o^N4ZDmtXGcA2n|K{28u&`k|jI<W=B*Q=MX`UH!Yqc#C<5KDUFgZdv2D&j*Z4
zpD!a{-MH<up>fH7iF^~|lGo4oTN#&pxwl-OZH-G_-#2zKF8L|QKWSX@`o3|9ad~~r
z#_MC0ajDa3g<E%`amo9aa6Zkr<nKfNHRF<xME(uqlAnfrvT?~LBEQzS<ToR~1OET#
zy`Ssn0Ofx{{yWNtBL55JAHv-7$;09QP@S&0uF5{^HRm1LPj7e?@)US|@>F;W@=fr^
z$;+YtF!Cz!r^tihqsYVHlgN9+<H-lX7m`ngzfB$sUqc=b-$tGU-%Fka|C&4-eu_K?
zet|q6{wMi$c=54C&toC{KJtp;?s}_AUIX3`uFvi2c+Naxys@{`+qkY;8E@pdKDRp<
zm;9&5cQGz`eQpng>vb52euk3=!N*gb$I<6B<Bh%gd02Obaogv7<C35Jwwuo)<C53s
z)k@=%KaBh;<C51uzguTq@+DWg`WuZ)UY~Ef$o0?fK8NdkV*0x}N64cwpFC5iu~)wr
z`n*c{$*A)$<pa>C?>O%_dxyThe1tlc;o8q+tXr2n5#F3U4c?A?6TCZlI(#5`Hav>_
z7<>YGE_^!qb@+VpikQy|@+$BT$o=74$b;c~$V1>+<Q?HB$RptA$)n-d$m8KY(e6Cz
z`AUM{L!Jz;MxF|9NS*-?BF}`kC(nXENnT}uyPltd>+@$I?(5;k<$CUc>vN=WxsUYw
z7$+E){4(TUFfRE(e7$I<amoLV{42)oeZAPY<QpZq{@*k%d3|oICfEBq6|Uzce4wlI
zF+1k-rKuz9W}(kxlplmT=O{l5eO@IW1}~&K5m>kMbKYX!p?$`}E0ZsU*Ck&8Z%&>J
zZ%3XE?@qoOK9D>U9z~uDpFmy!pH5x~pHE%_^ISn*1O5TIKYR;$0DKR5C_IZ?uZI)l
zQOKVskA~;N^*#za<*uvS<l*qr&%5)hdA)8clg~sxfP5<a5%RI{$H<?8cOsty?@O+I
z4kgz<$B{2Wok`^H!e@}b4_`q3348_l9{303U%<DJ>)!|ej9lv<B-i@i!}Y#ff%AKg
z@)Pi!{N1=bAJ*W${?oWTm-KyFvGM;q?~)IA$6Y5Sjoar~dE=5_ihL#G_BmPGxa5C8
zzP@qE>-(RFjZ1#OD%Vd-<C1TI=XQH?eXe$e>)av+xjOyHvoX(6rjD$87y6t``AF1x
zh4Ss*b@g8-pMW|^RHqPi)>Hl&)Y(p+1mE``b&gR!7x~lVl`+rDR43#q*Z*zGzl40*
z7;h-vq4SJFz6M<1AAXK}eexuD3#t>1IvprqHu=tSK4Ij|;Qh(Zp?(zA&%ybfKz<!Q
zo!k%SWj=XD_zLnG@DIp?;9JOp;d{tK;aTK^;3vqV;pfTc!mp7pfcs1+dLEa;?;%fv
zS0mp9Z%CdF4<gTow<o_0?@3+}*TWF<LGUr;aqt(&v*EMIkHHs_=fac73*c+X3*p<z
zOAL0`?LKmU_+j$q@KbPo{at$6)%nG^JeT_5`v29qJP-AGe$%+*&msS}amnlJ=G_y$
z54=O~-^W(p`Ov4VamnlFvkw@T`Y$41-MHlSdESs*pU=(U`aFpq;?`|TJ_hp%Gj(L$
zjAWM|O!*kp8AtiI(C1|G>hM`y2kR~(UjR=cPlc}~PlInK-v-}Do(0b)&xW5S&w*be
z&xhY6_rrWjO!9{49XkJt@bcs};I+tu;7!Pb;lbpg@J{4|;C;!*z=x5?!K2Anz+WOy
zg1<_h0$)PD8=g#_0bfsk0KS8~VuZUszkus~ore4R8{=|4e}?PuxN&=5|7cwDcfaTA
zpEE9b{ds`D8<+go$p2|v^7<SoHre~YJM=lw@O@Xmq;bjXbD+F&sXq+)O2#Fx&w<+H
z`Wy&=>vfp-v|G0&c~{J{v#BHNj=;XcDZc>uk(7TG`AL*NhI|6$*CPK0<<Fwe_bERM
zb4VjE0pCe=Lb2|Ca^3GS@_6KbBu{`}CD%FpO`eIo?+e}#y+h}p3$H|80Ix${5p#Hm
zyb3&o+#lYJJQzNJJOn<1ydyk@JOchQc^rHmc|3eM`CNDkc`|%6c?$e9@-+A%@=SOR
zc`p1Mc|QCP^6T(_$qV7-UMzZks|<DbS5@*F@CM}d;E#}p!rPI@z@LQcb8q))x9&jW
za{sQueKEwiJU8_H%xL41&qscoamnj*Z;Elr??`d$PBSifeeTUME_uHXTz<ZB$?J1(
zxpB#NMSi7m$?J1(4Y@w|Ho*113yyT_?jldYJhMz4SvL&(I!XBp$p1?D@yOqzeDh&$
z-7-_WqTZp;|2L4Y0@pr6BJad}8c}{6=Fo!t3hIPXoh0<xgIxDJm^>Hx(d2pX$>chR
zndJW1@9X5j@Rj7@@Ko{`_{Zdv;h&So!H<wHh3As5fL|m}hTkAhhu;<J&ZC~M9Jn8O
zF1#lBS$JdeLU=23A6yR|$$jB{$o=6%$%EkI$h*R0$;05UkcY$HAdi8sBA*OTBaefB
zLcRjNkNg1q8@N9AzQ%L!v~jtA6LG)%Xk4Bf`rNx>T=JKZ|J}IcAOFGU&T-qg<hOq4
zyx2?L2i~Fm=yUHL<B~78#^uW!x6i$r#w9-x`P#<qbFV46KKFv)dVP+0#;x0)+;_P1
zzNU_>+ZFqYq<k3i6DU6p`5BbYMLv=8uOt61<)hK(M#?Y59MZ`zqRy98#|P^kCD;At
zk%uCGg}fvDFLIs3-BXL*8KBNN0r`sL3*fcMm%^KoZ-Tca-v;kWz8l`3JO};^`C0gQ
zav#h;j=To^HFAIWGV%cU`{beUP2?TnpOS~c50Xd0zbB7{pCylj|4yC&|A#yoUUpis
zBIh>+UWGgjUZ4B`yal<>2zTE-PF@clMjilvio7{|6nPkY5_xZUJozB_Lh{M*x5*RX
zYsi<vw~;5o_mXdee@&haKSiDazd)V?|AYK2+$YYRM}0n@$LmEo<MQ0wg6E8%ae3bA
z&m*c~T=IV-?{8f4`uY-RT=MUvy7S)LxP6|7kn8ij16-do0V7?V-sFB!&WD>ivhF~v
zJD&1`kdLSQRODZ$yf5-A$#vaS@-XB-ChraZoLu`kLcSFFT=H%3i{!iEH^_70cfITl
z#XEGKd2m1S3-FrcKA3-F@)Gb?<mKQU$?L)UkO#ttk_W-Zk@tqjl83`zA&-E+K^_ZV
zMV<^#BTs>ULY@Zyk~|ZBl>7iZk31WGh5Q2iCV4)*<aBp_^?ui%8(-eI+!q&comVn0
z_oM#2vf9QaUu&(qzv>&e_xr=fB_ED_OXHH)=Sh3xlAnisC*zXWpL^EFxa6Pv$o13T
zxa9To;^D?6pO5@V<C53!=Xn9H_l3_WSN~O$mpWZhXA!wSJn28`tf&0n*zb1oqwp`N
zPH*({9pw*W-LuA<cztG+aQ$B~F8$xX&iM`UN8u%Acp>l5IRs+e^5ik_TI7lFCge-u
z!Q@HsPUPF*eaX||!^kt>(d0Ss7vXwe<eYMIm`$$VN3n=puahLIe;M^ZqWr&jo!w$w
z=KmDtyxq9H4nHUFg3rIcHZFB8q0YC)rH+0b>5Os7cTaQs{mHoG_4Bo><o&SjpK!e%
zLY{SXipP7u**nzzM?1eCE_0T3-$S3ZDL)ta7L@-2`B2K&7~|^qq5Kl;YZ&D#qJA`a
z4fspsQSevE6X8q9)8NVE2jJ_;v*0_)kHPnoUxpte&xij=UI4#J?uWVkO<oV~JG1C{
z424%BkAT-9kAy!&J_a5_9uMzEo&X;}z5qUgJOv&@o&kTEJQF^TJPW>@{46|$`~rM4
zc|QCza$npphsdkIbI1eX=g9TG`-8kA@`dCv@G`U9`PJuM`7`c5s%%{D({$WN)r`yY
zLEq0eFfRG4$Tv1FdHp$}j~bVJz4dP0HpV5dKVP)7amimtzPoYB>+Aaf<C34U!POsZ
zT=M$d9t$t#nfH%RJmxda<fYCLteZf-2EO<|>byt!S;(&=9}M3~bq=7PLzEB4zD^jI
z*Y|w9zW-!g`hOewU&%j(--7ELQn7BS*)o;?J<rd=?<X%Y_D;;lpWGMTl-v*AhCBe?
zg**@*P96jwP96pyM;-}(30~aWo?H)sxc+Avm$~I(KCc+J*Uw^deO-RXxYU`j(amSI
zajB!P%j=Cxel7BwjZ0o%m-oW;d@aSkzBPHN(+G9)D1QO@-zgu4{J)f+JkIs+m*5rk
z4w;+O58mXwD)|qn(-5wG7NSlt<)22K_T<Iky{OJy^dCW<2!ED53;rT`9(*==K0J}U
z9QuEUJOKU?c_4fTc@R94JPiH~d2jd`@<H%l$z$LJ<ni#5uekH5=OqbVfjk-hAbBc0
zkURt4nmiNUnLG>LkNhk=lDq)^9Jz0_yAG$4`@s{)L*Q?~^*PWP&w+Q1%XK~r*Wr7{
z<$l!H!41YGpN{+%<C53c!Ox6K{wngH8<)Jk4t{N1^7S^m{eEj)@~J1CpD`}^ySF(1
z$++b8b@Qrm$<IUn595;8*UjRudLMX)UO!=&=lyVfKKz6}Ymo1RH~Nn{Z7BaH@*T*Z
zgZHI6N$6(;<ws**6O7C2rhiE{pQ*-W4(pMhO`Z*34A(itV%>Micf;3_=fcy;^Wa~Q
zUx0s0?(>}M{|E9C@XO@o;J3)@!S9+=^!x_H%ft14iNyU<)ws;<8s<~exV?TFk?ZSb
zOXE^!%~rRs*2bldzHW9herH|eyBU|fzHas>*RLl>!1X+K9PieBmOKV?m}=_Cx*=FM
zf%56dFEx4T=V^Q%o$?>~k4;|c4@3P-%3ntP<CLF;{Lhq+ectWsI_I}JzfIl<e)n9j
z3Ga~eF8513?w9+F+kHJ~T=Kn<4={e`{Gxs<xX!;G=HHd_r;+bN9tIyqb)qnzX!2<I
zOXR8WSIN)9mylnFCzJbO&g;no;XBEj!}pU1!;g{ohW|(&4!=qs0sotPGTiqycYbyL
z3Ghnf8Spyfned0mv*01*XW`w*FTe+o=fg*k`{Fu@A@_&BOx_$mk6iEf<>X<=uO^R!
zZ-ndf@FhGCcNv%Ky!glN{@P=_k>~pQdx(4#o)6!`^}O_sadl2nehTtGQ9f{j%l}Gw
zeeT_){9Np-#=N4}gL((@WaN93Uw}VN?u-7%l9z)|A+HEeAP<BuCT|XZmpmB0j$G%N
zP9A~$7v!<<Z^`4}KaeNDFOw(1Z;>a%OU*Aj|5W(><QZ^(@;rD`^0V+Z<d@-H$V=e*
z2`Bf34=4A7KTjS2pGF=8pG)2m{w8@C{5|q0_(t+E@ZIDw@UO_{!jF<C!GDD7{XQS}
z`xWDjy;B#A`~7$0jXZx9_vvlpl7AlgVhh}P*ZTVRPwz1<`4r^K8<+a?P`{>e$yeI$
zo&&XwOMV&hO^r)_81fGrm%P63YG+*XA0gk~xa9Tu*2B2u+wXAw^f4~^_t4MN#wEWQ
z`QgST{~_|v8JB!^x~o6Ixa9SH;LGItJWPP=^Y-#YS7$N#SzHhAnL4uW0`$3w^7*K<
zm-3ZAarF<9Uqk;nROd3*JxA`3`hSoI!T%-CfR|h7HSHa`-wW`n<c09MaJ@c%#-Eo3
zlIwrJDVV%uuG?=%a{aur4_x~Rn&k4sD8C%{-Du-7|F)RtIOB5O_4D*8#wEWT`Dw-_
zulLa$<C1T_)Acjoxa9RdT5eqOmyus-T=IG!tuZe7pLV(W>x@f&JFfE`#wA~Jx6AJ`
zF8Mvk?>8>_0OSuDm;9H=e{Wp!JCHwRT=II~{R-FfH3sLa(B!4gSC~Vo*S!zCL-REz
zyZ-No%XKCBPcerFjLW*I=(8Tx$w8fmO<w9uK>sa`OP#~0)84q`mm=TExa5x_-xsd^
z*Nb)i4>NhGQ)#dB5yox*F;pl1MVEis<fTr#J<ewuxBV|PF8N607aO<zzh}IOm*0fX
z%hnl}I{h--y4%QW!apTXgC8_5_485xsBx)ZfIf4{v*8zwOCA4GuAe`QOPzJd|4lv{
zUS^RO@(w*;&8N6J)!}-*y_Vs;k#SkKH`Z-oT-H5;d|UEA;N9W6ZY1uDf#iC>M3E;W
zKY=_QKArp+d_H*&d<A(P`~&g=_!ja)_#W~SxbL#a^}aqqz6tsB<mvEh<a%H04@TB`
zmUzLPuX_@Up5JotYUIt~4aviC-vyCJz}u6@!F!S~g%2T5gO4H4gug(Z4WC7R9lnUX
z3a;lQ@-X;X@-gu3<k9eb<dfmq<O|@Z$rIt1$XCE`l5c{SSX}fxX2HvoXTxie=fIng
z7r=wb3*nu}OW=9lm;C>q^W+_ok0$R5e~G*|{8jQX@FnEY@MQAI@b%;i;5*2d!oPs)
z`?oE4AN398Q;<JHo(BJwJQH3(egIzbjiTo_8(x9@0{lVp0(c;KiI?1Spf!0pcxUp8
z@P6bq;F07(@aM>b;Zw;&;d96b!55Q9!B@fcynKf9vc|Z)?zGwK_PfrwyuR!E=N-l+
zAA|fZ<B~t|gR8UOxa2=X{*ZCWpF{q8a{avN3|ybjp;KM`U&&*!-vaV@c*!N+V&0*3
zlHe7{Q{WGhAAkpvXTe*OAA@%$&xiLTzYdQiFN8lwUIlZQO70JzLmmKMO0M%<P2Lsx
z?Qpq%8hHQi^mX&!ZCuXdMV!aa$zREH`7ez(^zt_wIX`Gz>ZBw8HC)eEIQlt7`IE?B
zA^#En5BWKG$)(<6-l6x!C3pq$+wex@<$jdk?c>vuye_;ec_aAK<dc7Pbw-hQM?RW-
z7<?l66nHFoB78deR(JyWVfZ}qOYlVUl0Uirmyy?oCy}>>zehe8o=QFmzJYuJd>eTR
zd?)#*@C@>k@Gr@)!?Vcm#rgV{JOG|U-UWV!JQ9A6ydCCznfx{6%e`6b&cOA$9dgdi
zzan`m^8V!O;eq78z=O$0o^|y*lE=V%lTU?5kpBvQj{IA!`vUnE_%!m*;jfbSL;XeM
ze<J@T`8~+5B(DiyP5v-^4S5In7V>ELr{u@sUy#Sc50NLrzad`-|DJp&{AcoRxK4g0
zzk&Qs@<))rYgy6jtsT4)c`bNN@<P;aL|zj4Hsn>|?aA+lcO@SOA3?qlo<N=ge~o-2
zJdu1aJdOM~{8RE@;NOzpf}bG&7k-}n?(^=x`-40P{x5kOc=_c;&sS4;4f2}shUDeo
z&B#OHZOOIIF67#0IGkU{pP~F2)PK&nyl?z!ubaaJ<MKXX`Y+Doj7vV_bLa8KCI2nz
z&nG_tUkukiujBp3yX2AZ4W^E)`!?3yK|T?l`5$$TQ$7s&GvxK)zx+p?>y-a@ubV@O
z6<%}Rq5FzQ|K-V3;kC%q;7!Q4!Gp=O;GM{`;eE+-;KRuC;m?x$Omq910@v5U8#s^C
zjmvo{z}#jTm+N5#@(YbizWqK|f3b1Nk3&8guJf#ce%6!MgYP5{gzqO0f*&Iff&WO}
z5q_0C4E{HHINbLwZ!_MZ{YStnkw?MnkVnHGBA*NoA&-N1BTs-2AYT9<LB13oL!JbG
znLGtPkNhlrIr#;63VA+!Gr4b^yG}kMF9$zFUJ;%{9ti&luGe!{TyIy&pN8Ke*Xy(7
z+eOcBFzQ!<OMSV{^D<rkwaF`g;k+^VF!&?ncYW#dA><9<-Qaq?C83`I<h|jesLq>M
zcRcwa_{&r$5_RU0PlhigPldl{>dXCpFJ52P8<)9t!@f2fx6hN^#w9-k`3&Qd*Y`z-
zj7$Dw<c}DayuN;&G%ooe``!G{7?-?W4;RVx_3k&go|h6YyE=vBS(s0`m0nTr(Ceo@
z)~!T-1^w5BYyBM5X-<9t-iF){{d6_;WnXo1UiulAIZQ`C1C2{wpYu`VdLPA*Pd)GE
z5J#?c=8$WhH^}w;zC*6(C6!#y?^bd>Um4_k(dPm3ci}&huZLfO>v;*pod2eLTg<ss
zQql9iA9F5a+|Id@aXBw_54d?&H7<FbTRr2Fk48Sgxa8-epGS;K{s8i=j7wfWzj(s9
z<m-Lq`sr-^PXDOi$GGIjBj4Y+<ljd=(zxW?X1V%N#wD-kcRabC-xuI|UOLWjb!L%A
z;e5Se>d3l>(dSC?yAHZKDdbDx>&Xwocfz%wD$`w^{p8xu_f)4f>g16}z<;AU@z~eD
zlrM3}t?T=aw@L5N=T94WdGbT>YUIUmUK+x6UuoD^5V`i#k?O>teh=~`@Cd3CgMB?q
zJ{SHXc?x_sc^W*CJPZB~c{cnb@*MaM@_cwE`E~d=<c07v<P|Z`U&;O91>_;{lJC0n
ztLG&YUV*$T{6X??cp&*?cx&=lcxUo>ct7$5@JRA)@aM?0;Zw<v!RL_Y!k3a?fUhR^
z#q(hUc{%tl@`~^S<o@vE<e~7N$h*RSBkv6_B#(xdURCt`#=t9+$HME9FNHTHPlLCG
z>-*;+cs_SFF3-sccn)+oe&_j**T??G?>twLf6BPz_4O;txa2DzcF(IZ#wD+>Uz3bW
zej@Tyj7wf$zh)Vi{MX38YWz<B*zaQFlCS!;>*r15lGoR-WaE-Qm+kT?#wD+>UmMBw
z_3LA}-oFcGx;meepT+t5*3^-8r=ZVM<m=&Q$sar7>R%zB4F3zR{j7+0`MZ<7#k@mZ
z`*{GauP;AiU4QaYsQ(bv@rl1v*5`4`Z$Q2)`B``$@)t1w!Q|`Uqv6`WALcxnT>D9&
zI@M5TA$dD^64lAa`C3cvi~VjVuLs{p9th7S4}+g3?+w31J_vr3JO*B3b<y)X8D5?|
z4ql6VDZB}JGCY_(1>T7~4c?bL9X^aa2OdqH3xA3HEc{jSeE1UbD!5LP$!oyZlh=dq
zBySGiPu?4Tj659vBY6b;D)|`r-{f=QzV8+Dk)xRRKk}<YcqQ@`@H*t%;17|f!$Zh3
z;N8e`;X~oYi@84^FIM(Wdp=Rd<@vcD&*!n^-7dKN^Ty@R$M0(9e4=rw^CI#u!gUVU
zXS)1s%CA8FP4ZRn56Rz$uP0B1?<C&^|Azb^{51KG@O<)L;N{=<Ht8M3z5kK@{sXT}
zUizZjZ%y*b@OtC{@KEv)cz^QPUtRs7<UNs(A|C-COFj)AL%tOLBKZz@9Qil!S>#vY
zbID6za{a$fULU@c{Bii(<U`@f<Wt}uk|)B`$W!54$oIn2$<M$)BQJnwl2^d_I!GP}
z&nABo{vCM~{51JO_#fnZ;D3>?g8QTty`DG1%aXUa?9Nw3@?*$XBfkvyCohCIAooN4
zK=L~9R^)HNA1Ch!??fIBf0BGWybt+wcqI8o_$cy^;S<Pr!ehxZ;IEJ$fG;Nh6aFsw
z-|$W3SK+(J&%nPVKMX%iUhIlH?<dK%&-3Kk=QTJ#|BHQ4^m=;|^~)KT_uJLKaqIdS
zm*?$<tIn$%mwX@OA2crc3CK4#F8QCob#<B<mwf%-oVO+qgg*|~eFe;R`L2`?LB1d5
zeP+4*2$Pq7{zm`N<VWEz{YRa7l;4Q_67o6l_l(Q;`Nx-X{d{Cx`gscT*-E|(o?%?-
zY(kx{j7yydk^h!_3H(R6&a)oobCo;}{x^9%-1kFoG4IeibK#Z9li_v9Q{WGgr@=$W
zGvVFH^WX!>&%#HLUxvq!m%w%PGPy5&9=RWUIk{e+Ddf$O-#{J;-woIIIZ?Pz_ZgS-
z>wDB)Kl_c_`|dlcAA$NmlSjd?P@U3P_ZE3Gc!@RcylbB!a6h<S4>71;i}EicU*EXw
z>oM%Bk#W1PAmfssjC`<h$!niojLZF!hx?_Maj8@0n49My@{dq|lyRx!cel$wZ(Qmu
zM4c(*P2sP=bw0_M&l}|1;H$_Fz|+Vtz_*hJB)C2^;d;JSV*ZDWOaJ@O=Mm#}{wIw~
z{uc6Qj7xqNp8pq(Oa7tbuAeK$B|jheLb%Q+9Q~I|^+Mhu{Y#zws8fl&FT5^X>nuf`
zM=1ZwcdnlhazA)?suPJi1Ic6HQRK<+3FMpL)5tHtUxVxU+K%(J)VR#yYxKFoxIJI*
z8<%{E@7;da7?-@h{%#@H*VA;k&a)7GeokKE6<0r->g1yTQ^uvA0QB>NaohhT<C1?8
z`K!il|F_7s|9|1ye?|0JdaYN~JJhSdAAsxp3(<ca<I>M~^wYq2BhTC8eaOScCI12P
zEsaZFpI4#AC4UO}j>aY58})k`mwfpgH~)UdB|jYbp~fXY82M+6OJ48C=Zs4}5%~$m
zC9l^{oN>u-IN|z<H!gX7y;ua-`G;Ztt4v<%<YV1b^46%oo$92b&X<(GiTn}rrYBvW
zr>RZ^>Rcj^f!`!ghnM)sYuY<>Uper5$pc<>>(+ql_4Xj1hYgK4_Da5oKARYCWab%6
zuGe7)<5DLFb-EarI(i=alIwjm2(J6;jsBk@4~NH4o%7gNobkrqy7!%ObBH%?_w_ot
z?(1#iQl}H@yldR<>mzdA*JilxD<1vtB2R#SMRm&H{yJ{FvDeSD=;wrS=|?|5x<vjx
zo-@Cbe*?cw{vGC7a-CPyJM{W_3|^kR1H2}AS9l}x0q~aO!{P18$H9A$>wbrlKaKoY
z@=W+d@;LZ(a{c^t9(g+QN#t+AQ^@sw%O-Mt9v(K{z#I9Ld)#$<)cBqAi|gS8`91kA
zf7*CMuTGN|&VMv6b%K#U2iNO!0j|S8C_fnaf5|7nE2kB`PU7JW$rIqs$X|npk|)B$
z$lr&LAV2=6+wVB?FOi=@e*C)2&nEv7zKDD)>aQfvgr|~!fjXPWkD#C3<o?%OKL^MM
z!;g{Y!1Ks|hF>PX0xuvRiatxPFM1x!B42_0NAzEX{06)h`Mtlpebpmx2yaZ@9p0Qg
z3jQehOn3-+68s7Bba+?tZ{a=3e}{*Ym-)l(YcP3TcqDmS_$cylcr^J0_(byg@L2K>
z;M2+Xz!S*Nz~_<QgfAvPhVz?5-U-)93VD6_N8~NxACrFx|BQSLJd->gevmv7o=u(t
z|Bie+{73R1;Frm};(obKehvA*$nQelXG78Zs}{Tzc~f`=@~!Y{<j=wzkiP?OLB0mw
zk$f&Zj9j0egUH7t|2+9@_zUDO!{f+P@%&66{|EU*^1F~<O}<Q@!{iC@P2|4t-Q?ro
zhsh)1$H)i5FOc5@zd_y|{tx;6aKDX3uah?L8ss(L0pu;=t;rvThmzNUcOjn&??tZl
zhmgO3{510FH{5eFf&3Ek^T>-MznDA#{yuq2_$Kn+@XyJk;77@0;g`s-!v7#og8xJQ
zA-v3{qUUiPyfV4I?gx?|MLvjp6TA)iR(L4+PIzbXeef{yL-2m&_uO>naT0k$_$%a{
z;K}5X@Ll9D!L!H{;it*h!LN}YgqPl2bpBW2^~n7S+`b+rZv^j1{t*0m^1kp_$e)9+
zCI1}0nLHl8gM1nMQ}Q%;CV4jeJMydWYvcv+zsSqna`UOarRY3s!~Mwv;qAyn;oac!
zc}E@Z-zu)WPe00cMm~zXKYT3t5crGaAH%1UN5bckuYoTk-voc3JQ1EoJ`Vl~`3vwv
z<TKz`$^U`hAlKLB;#-TJm#>k(m;4O88u?Xt6Y~52awn!Oc|-UU<W=GS*V_5VcRlX^
z|4mbiPA16?VVJySWf6uQMmrh8q8MjvYg=vX$GdISq8QCFNyeG%P#I@3Bs)Yq8fS-b
z#tAENcAPLZ%+ZG(!Z?%fb?tgwy7qiOpX>VL`@Y>+@B8a<Js;QOdR^D+*ZbW{Cp->(
zKH(>WR}+3I`2B<@fH#2C`_|`){<nRm|9^A%cr{eZ@ciUehwJ;|V|E+;7Qz$%XZVNU
z*0&b-%R7nwO89>7aP9jveE;Wg*Ee$g!2M`_M}u462KXLB^!f0e;Bf7`1-_FUu6=Jq
zu0)4xedIQiH_72zACK|5$l+RlHuRS|T<gz*{%VJ7eHrxEI$Y~7hCZM0`?24P!R<I~
zy50115#enZpF0R|2VX&WH~7PZ_kgb>ycc{U;Q{ogjqtJH?-HH_zMb$)@UIBZ0q-Nc
z0DSm!Y7o`Sj!zZ%7{Zr<A4_-*cs${a;J+cf75qZN?S7d-cqjC;!0mHI`#k45hwFKA
zKjul1!`*p%gTuA{8|ZIxxYpl-`LopFT0iRpGk=ylT<d>_dH8_CwZ0wt)ehJCa@2o<
za651R3~u+!<U5S-OOF0TRVQhf;eU6y_8t16;q8P!fc|_y>K80E`Y#BNsxrKn@X_G=
zJ+I8v%l30D_$b2Tz>gw)26!Cd72szOUIjjt@M`eO3117INq8f8A>mEnHxS+qemmh?
z!D|TL2L3SNyTI2G9*O<Ck?=(DHo}v@-z7W+d^_Q3;9n8G2)vK*W#Gd%4BWpf!N(BZ
z0Ddgt&EWBbZvy`f;qBlT65auRCE?xRIfReEe4a~qGWbn|mx13&csY12;T7PI5?&4d
z4B>0Ro5AgIY$lEauM%#L51R?M$E6Plza4cxA>1BMz67`Hbkp5tUH1|F_kD&(G@1Rb
z`>Bs7@9i)=(&6rLY_!9*engkiM?2g-uEsiC>(7He=y0uX!*O-8!?pfS=o1{S^{u!*
zNddQc`;d1g;el$?&sl_z052wdEchbAlfmyGyas#);kDp@BD@Z~k?=<F7YW}4-bVN~
z@OKIC1m8}0H~3eC_k#aG_$JKfVSiDBu3mON-;Mb*%Heu{CE|QE#^HK@+3U%p9j^5y
z&>!b;t+&^c@ebGe2Iwa{T<hmx{+#1*t^W}EDGt|qd;NKd!?k|&M`oT}=5Vc_kNVd*
zT<b4{KFi@+Z?9KF;C6oYVmucU9=Ox^E+sq~{64~Cz#kzz2>vwT@!-vbPXm9Q@I3JM
z2ww@lgYbIr{{y%4WF?MQ-x9tKe4iK8V5yfKpJvoK5Zu;z4)g6WhwJe##P}cSa6SHZ
zzMbH3t+&5teuBfb-p-!{him=MsGsO?t-lBJ;e3Z{{i&V(aRL`PT<af({wl(&z;hg~
z>)eDoc@Ecg?0sLU!?k|O$HsSo!?oV7qgx5L=Zh+EJN^ZCnL76ozG#`@k2-a<??U)K
zOZ2_ik1d4vfxk(31nR#}_-OFY2u}dtMR+y%J{wi%)XV0o2OmjzBlzKjuLlnj-VA;!
z;hVtEBYY?LrGy7C&gq0Ff#(yR13sVdGVmpYmxEUmUID&}@M`cU2wxArf$%2qR>E7r
zHxs@M{NIE}EjRP(b8x%f-@|&}<#0XUR%5>PI$Y0lyWWR1oBgiqX#Hm&oBG2XuJv}k
zk8-%y$8R_KF%H-Ir?5_scDUBt-~V}>!?oV7(|Ct#{kgcln(T0`e-ZW1A>6Lhso-`#
z$KyKZa>6HLJTnPT052pw3H%1aQ^9X1ybQdC@J{fD36DfS*AYGzd?Vor;BAB_g1<|6
zGWd4FXMlf2csY0<;fuhBzo>SGdf9QV1Rq0q9r&??w}MXqxAVCX=esirZvvl6_$T0(
z6aEEwF5w@7hX{WQ{6@lG1izK=|AOC5xb5eIgxh{L5dH(|JV&^FF8w#c?S0Ujg#Q}X
z`Tru^et!K4;db5qm+&d5^8?{_eI4|Y+3$9L9S{9sgxl}u98b9Y9?oRK?dJ&R5^ldQ
zbP3`1`$AcSPe*_93C{$dM|dvyt%Te0Urx9^em+3B9sf0i+wp&fa6A4l5pKtM6XDCz
z&#i>p>%&fPyB?$OF~{dGiT<dc4FA#L`gr>)?jLtMTpw?3uKoYIXTNLx(Vv()BOR{w
zcH9ngxYjR*{z!+r$N%vT*ZOa|P5p@u*LpjiXA*Ar%T&Vcdby17kL-0OxE;5M8sj^Q
z=<R;VC;GsBMnB)t>*tUmJcqp5;X2m`7>6pt$9-z*+(URV_-b(5&u!ShPZD1J2UDks
z@FeJ8C-pa@{uaXR@8|qTsMACAM}B5}e;|Accw~zTuU@wQ1?bPO!R>X(_0R_$uE(<x
z<2lLUdOVjye<tCr;8O_y5j+*#_NNB>{Tjl1(a$1MXENsJ0>ZBXuN3OsNA$Nqznbth
z;7>VRk3%QM;dzJaad->*SHW$rH1vN9;bq_-5ncnnlki&b9|*4lANn`d31|N{fgenG
zGk6T)t>6;~xAXi=!n>e9pYW)A`@0dCL3jap7U3cABErkTZzQ}Lyo&G|@cRf~3H}J-
z>%pHUd@Fb};T_<w6W$5_9^t*<I|%Os?;$(_$Bmx|9}B+!%LDgs0{EeXCxXWko(w*T
z@O1FA3C{$-i10k{G{P&ua|vGwUP5>?_|1g3fG;Dw4g8OUcY?1WybJtU!gqqV5N^*q
zZxTKN$EEiPp9cOJ;i=%e2u}mw=aqr`F$6x6@G|hj310*rB-|c9PbGXU^yd-Y2!1Ky
zP2lN-w}a;sz7>2v;oHEM5WWliF2b81G{=nx!S_|eq^~zl!}Zc*4%f%q9bXy!lMdH<
zd%dy2;aVTpWAqyxuJ!i1_wR(;@6WvBa9w8}>ipB;x{ke`+~IJoe+v4~9Io{(xSssR
z;aY#fe@#EXcevKu&k=^SsyFIo$H!h5?GL_>+N>2-tNLYuLkVwRX?W17qkX5rcM{=q
z!Os@zTuStRgg%Y%m%!(cI+5sSInjR#{qKoB3i|tre)!iWR~_LyF#b=GI-^nNMWVkH
zbzUQUDEjj@;c?J^Na{ypoWCG^EO;;BvEci?YWA<)kBQ);2u}h(itrThIKs=p&mepe
z_*B9x!7nF#C3q&`b>M}BH-O(jcnkRLgm;725T1zr^)TT{;Ohua0pCb?CU_g+IpFUS
zUI4zG@JjHVgpbDk$dBN5o!ak(4t>q+U(NNpv%i07e~0V!Ztvp`CEOloj&-=MQ}Vf)
z|HnIA*RkINImO{xzXkf!9j^5~xG$UHaIKI0kEwsY!?oVt_g(IAtv?a^D;=)&_WSnP
z4%hlD=;t_G>+SJ;0k~Zk>sOfmR5^NGrxJBm5dIkWLxi99g{jj(>UW_2b3}hI^sf;8
zHt4q!eGhy;Ci+h3|4Z~&q5hAAF9IL(cNJ2->^O9xP87JES3g33grJ{5^v^(l7UA!L
zUrg%6W1e44cmntw!e@Y&5uOHq3*njI%L!iu{vhGC;0=Vgf<H%i2l&f`cZ0u8cm&3I
z8{v`QpA#Mh{vF{#@F8sj_hTG*6ycM>k05*+_;|uI!A~cA8F(_`b>PzpZv?-V@MiGq
z3GV?fCp_YQv%YR4d<6L2;PyDV8rMa&gxljlJ>f4w-$=N<zG^1iUPrx7_?xKnG2vUm
zKPUVH@NWs<0sa%=_V1NMzHaur&1?T2%4ovBM4fSje+_;z;l1F~2=4>GobaeVvtQB)
zKL$LH@L2FN!kh5?{C04ATnb|U-beKI?=L*;aDCj4-)Z{usKZZC+@1&j>~O7r2Kwh5
zuJu3S{Pj17YyJ8EXX?M|aILrJqs<Q2di#4t-gUUv@AtE*^RdIV{*o^Z|HR>1e;D-t
zb-3352l{UvuJtEEzt0=$je6PR`DwV{+0WrxZ?6Xqa=5PF0{tNl*ZMP1|7gPPeMAu4
z?#J{8O|DZ3FT?&lkML^nO9`(5PbYjOcs}84!RHg+4!(r&t>D#!Zv$UN_)hRA2#=~Y
zc{dPV4c<z44ftllSAu^?_<Ha!2yX)KCA<ZEzkitdVE0Q8_$b16fgeS9A9x($qyK2~
zo<Vpt_*BAUz%M5}0X&oN0`Nk@E5UCdyaD`n!q<Y=5WXJ#VZuAW*Ad<YzLD^q;BACQ
zK48Y@UBX9zZzp^-_*aC-gZB}h1U`Jz!2O#FK8EmW@M8(D2ahLwE%<K;Zv?-P@Fwsp
z32y_>A$%wJT*7<6Zz8-G{7%9nah$0oJP!O(!V|!sAv_uUuY{+8Zz4Ps{9lCUfqzPP
zCHOalSAhrK9Jn8=!GA^gTJS>&-}Wan-;M*f*9px(89vG3<CT^D`*f!|Tp#D{_0qWx
z*ZNJprp|92uJ!i!Dol5{)_(>4OozMYoh*lI{bfIx`ne9*dV3!_*Wp^f6#97%*Lr(j
zc?;pc!TIYh!tMF12HYMeo9j(~9ws~vd>!E_;2Q}~2X7<19Q<9vSAuURyb=5>!rQ_7
z2;T}m{4F&o>Sc3n10O^9PVi$1AN{BqhY8?zUIlSocPinNz>^3+6?_`uXM)cl+}6n;
z++Gh~N4UKno)2#G*5Y|fCDEs0T~s?<&#MwVm#cBOo>z8V)Hz)18=$XuxYpa}!;KEt
zdi#4P);nD5?e$oT!?k|GH)i}>9j^8E{-xdFTAvF2R)=f7y|3wXxYqv#`YwlSy}jS*
zA>6K)K8K&E^f8g9pZmS7-l&(o{wziPQQ&sJbYj08L-gCAKaubi;FC$6F4Q@f=+EC}
z`g4h(zn18KM*RZ9k3pTqq)rcfml8gDweh{5@M!RQ!ehYyOn3tLON1wa|AX*k@D9S$
z!M78h2i^m2*YzT-i#~_zd18NmMWB7p{?+ru-e-+)xYqB)xJ5Z!>+OBkSchwU%C~0R
zVjQmZ_C71l;aXo0eZ0f9-ri>=I$Y~d_|DW%a=6ypbvMo7T7N(EsSekAdmc$A+^&mk
za68XaA2z-Pghzlcbn0l|Ech;Vxc0T*b6!sBtjB(Qkno-04TSfAKSy{k_{)TkeaQ6x
zZNg)~w-Fu$|D5n?;NKBm06t{13aMUp+(O_{gqMRKL3lOzc*1MIPbYjOcrxMZ!KV}6
z4t_1+o#59K-VI((_)hTK2;T*MFX0h&{lgM?i0~lzTEgSN|3dg=@Ye`W27ia}Jn&A!
z*Mk2a;f>%w65a$pY|Fs?+YUaO@U7rS6TS_6BH_Eh&muhT;XwZ@g>btbXA+(U{Vc-M
z!HWsc0bfLT8TcK9*MhGgd?omw2(JfkBz!&ii-dQ8zd`sm@P88C1>Qw?;1M%!|0O&E
zd^h1Ezz=w5pZ<n+{RY7gAv_KISa5sZc@XEFlN_#(hxYfkoZ@hOJhazi=Qv#JdvN@m
z;&83E_bHb;T<Z`1-sHX9;aYFc3mFdA`XRWl$#%Hb+xwJahiiQ*^ra5hdV8O8v%|H%
z6#69&*Lr*2xtnnN_a#?=+wm{J{oq4HZ_iU}h`ts2X9-`6{nbKvJNTP~cY(i8cm(Qy
zM)(ZyU4-X>@3U2fS1+5Z0(>OlmEeaHz6?A__)73o3Af{L4&g!E2VD$q=j{iWw^un_
z@5iTbe|n9>^?tP1OZg7h`r$vCd06Oht-ttZ!xuVS>o0?TvBS0A&ciz#uJucyzsuoT
z|9jM51#ZVV9eJN1JO_LO;fugq39kj;O!!Lh4+*aa|AO#l@Ls}O!1sGsg;6it|2FVZ
zgm;1;MR?R2GtO~@$AO<gcoO(j!b9Mf6J8B|4dM0R*Mr-6wHxzlfy4Xf753we4tM9(
z?GD%a9njzDaIL=+`~7~0YrXy6_=67Ddi#0JV-DB)OaEua?Ma7g{oSa)!Qoo}4)hxx
zuJwO_{_hUg`k8n>@DGP;{R7bd)8Sfw7xe#jxYpa_?HAy7o^)aSdkNnKzTbPQv3gnk
z=*LXnQG_RfA4PZ-cpTyN;AarN9(*d{?ckRaz6(5)@Uac1pJm{7UX@_n785=b{2qso
zQ_<U_Or853uE%pF^s5L@=>Ha(`um^`KVInz&Ng)(b-1o`J@k)*+i^}r|DPxNyP$uC
z@Otp~34a#+3&J;me@%EZc*H+d=hVxN+biHvgue$qiSVg9h<cqt_$Sc+mhgR`pHBGU
z;MWiy3!YE-3E=YxPXfP{@bA!{rG$S0zJl-`@TUkLj{2>HCxZWj@RPv*N%(Z|PQo+6
zzb1Sk_-?{`!H0GX+>bYdk0Shi@FNND1RqcMF7VR{e+&E^!tMULh;Ta}t|a_L)X5{f
z4!o4``@nA^yb}CQ!k2;HOZc<k4-jtW!y3ZZLElXH%i#Yad<Xc4gzu*pntJUb{1Wg!
z!pDM-{MW$!dp7uCgdYb!j&Pgnbi&Vs{%pce1ph7JzXSgr;j1D{|8fW~h5kCitH48q
z*MZL`{4d~(2;T;NE8*XPR}p^j5Yx})gii#oA^bw{2MEsruOoa3_!`1jg0Cg~Iq+u)
ze-pfk@K3>CB76wOzm@PKz~3PJbnte<r-Q#ocnEwO;dg-VAp9BdZwY?`eAxQ~=kurF
zLBjjMCxh!{6>XaKucPyb{@DG@#!DRi@csIw{r^iR`kBz@5Pl(ei11YK#e`>r-vO@s
zd6?7Bdx`!o=vO=X6Nm2U=VL^_0s3bh{aB}dGtvJC`Zh<O8L_ASW}-i0s44cLqd(HA
z{~6JzLchz=XFK(OBKjrJ5C69*s>kOT^<NCSbR@W5w)%SMfMM!?>NSq=`%vd(!XE)Y
zoA5^P3kkR9$14bb8~Ry<ZwD_T{A=(V2p@v}-%0o?=vNTl3ciZ)jo^PK{5kNy5`F}H
zUn6`H_&eZw{Pjm!3-<3H=0G>mr$PTM(bqt~|2DIK?EbnH`a{8O{q@kt5&d(}pGou|
zKz|X@cSAp&@GrqL3I7IsHsJ?Entm4$ek^zi;irR_6MhN!O@z+|uOxgi_)@~}0k0<f
zQScRnKL@^&@HX&A2>&;D1L6MxUq^T^_<F*J4>#lX0^vu2w-9~`_-lk;0KSRvYrwY<
zJ{P=$@ZW=fNcer=U4%al{w3irf`3c+JK%kU?*t$A!NB<+*x$VW72%`64<<YoJeKgu
z;FAddE%+3|&j-JV@GHQt1lQ|P_t4&N<`R7i^dX0jR}C8RoT1F&Cn#=@w>LXn>wkcL
ziNm$N-~jbM^}5&L`t$Tue4hS*!*!kW@LZ??-1fio@%}P_CZf-U{xzac!~OL;glB?x
z5?%rRe}vbA|44WP_^=O6KHJYm@X>^C0zaDYcJPUWcYvQo_%84i!s9VMGYOvzK8x@~
z@M6N#!50yp34RCRdEhGuuLA!Q;oaa*f!p)Q?=TNvAl#nE+X=r8`fY?S1pl0Hd!PF)
z;me@k=OeQpZGY|sA4zyE_@RW`ejZD>eO?hy_|vG9NcaZu3&HKYig?1z|1_fi0QwAv
zk5^Huur9J4uGgcz{wZ>}*1rUOiNm$N1nYOP!?nH_`db{X^)_!cxb1%m`u~KZ*T;d1
zNR#UshwJ*4yA9t+_}SpCglB<o0k^)1PntTP5&hxNe@paZ(a(K5RVUQT)`<l_knm*i
zv4p3CpFnsS_-TYM0-r*7EqE&7t>D)X-VS~p;oHC$5Z()3Nq7Xt?H<Bo!B-O=2mU1C
z)4-o2JRSTMaJ%k)+~17*TMpOr;W4{^9j@n_Js*8c>W5JOOTx>+|3`Q&c;v?e_j@z=
zA%wSpA47N>_(_C!fhQ8)4SoUPJ>XXmK4Ptz&)I~>gNFz&2VYG1BJibzSAyS9cs+PM
z;SJz_CcF{+CBoam+X(Lje-GTwhr@9E`PkulK74@r@QK6S`OxEVtv?vg^LIJiJzo9n
zaIL=z`XSrRe6anQhyIKL-$!lMiiW4meu;DR`uNs}<J%by*Y!_B{qsqkUW~&G!UL$E
zMR*K&5#h<;Hxix#UPX8+_<e*IfImWb2>fZn%fXuoZvuav@J-<F5xy0C2jSbmdkF6W
z|B3L(b!NZpzeDe(J;(DP_@RWyfyWX)8GI7qso-Z5J_GzB!qdUi2rmbpMR+xM2z*}^
zL(khOn1?qyT+gdTm{&JD++7z-9j^7yK)>AK?z&h7Zs&RW(`Gz35MI$}c$-s4*PqzG
zIs$>sgm=UDeZmibzMIrvi*fjt@b%#Pb}2LUvi;l&ejwq!;A08z13!WA2;@DD@EGtZ
zgvWxX5*`PB4dDgg*AZR`zJTy$;FW~01;2;z4)E24Zv%gl@GkHs!UNd9uM!>szJ>4+
z;2#kl1m8(`3iuC%r-BdtWZ?cS06&=UD)1P>Yry}C<FTD5X4a}_l82f<X}+(8>gUYE
z_Hf;U_$lW7;c)}`j2q1RsQ7_=*DdD#gi{A{`|q*7oivc!`}ENU_kTVcG|~G>G&t@5
zWI>-m^ypq-hM-R)`b@kp6ZGXoUyb)Qg1(mMTkyVF(A(`cZxqI&OVD?NTYV<<5%{T(
zpYC|#vDYuh4San!5G&|yTU$Q~lO<Wur+{01BlJ0fK9A^QhL}K=g1(CAtD&zK^bJHG
zz_a^SLElF7A?UjVeK*l}LLY(LVdD>O$0rq^*~AL^Aknu#pDgH8h&~>lwd4r;Jfg3I
zzEaRv5q;D!v%l&EeFM=~K;J6p+lamg`Yu7=P4t;K-bG+ugpEJA9shRdV+DPX=#z$<
zyvc$-h3Ffh&k^)_L?5$1=D(n?BKm6R>jixS(FYDN^;-pf8_|cL?-KOgMBfR01lB>=
z_=DT=PaR?U6D#P0MBf5^vY<~P`uJa&`Z<C=kLc^5uN3rEL?1QM)UOxx4Mbl7eXF2v
zBl;fby99kV(PtiL`V)cUMA-O)+wpIQK332Ni9RXH)K3=lDMa50eU6~dBl?(wO#Mnh
zUq$rQ(ANw42BHs)GWA;peH+n-pzjj&-9+CBeFTo9VdD>O$3OL8)1O#DA0+w~=#vF~
z3em@pHuZA^eIC)*L0>88tB5}85L3Ti&^Hi$1@x_gzK!U6pzjj&-9(=`#`Grw=Z&!O
z2e;$j4t=bk4-$P6uA7queG1VxLZ2h(^N2ns+VsCt&{q+C4fOSbzJcf?er@Wv3i>vp
zFN3~I(03Dk7xWQ0uZE33xE=o)xZj8s^g*I;g+5u(rx1O@;U;g6pwA=v2IwmVeHGD1
zk2Uq{1$_h2S3%z@=-Y_C7y2$i-%a#+N0|OZ;JPDh{K4(`cR(L2=z~O`a-^xBEa+2+
zz6tsqL7zwT!J|z5N<m*m^tI5}3;G74kBl+(TLpa^(U(KtCFr|}z8m@oT$hE7Ke!$L
zw4+UbVg-GW=-Z%A7W64ZpKy$+pCjn=h`s^(N<m*m^ka`T_3H(F1JN&ozE#k-5q%%@
zU4p)w=nG;^e<E-l8aDpmcKo+NA1mmCL_h5~Q$JbIrx1NJ^f`h)kLcsZnfjH2zKZBq
zLSHZF8;E|y@uq&Opl>7kMbLK%`fj4%34H{v)5FFe+>U>G(DWx(&<BZr6ZFY~K85HL
zPcZd!1brUSuZ6x+&{q-t*zu-*y`XO(`eo3!3i>vp?}NTe(03Dk!HK3n5x9>D8-H*+
z{@b9B74$)(pB888Cky%%qHl&iN6_aHef$Jdzf#aw5q%x>^@6^E=%Xf@`mKV#jp!?&
z?-KOgMBf8_1n%3y#vj~{f8I%^Ke2*7Nc0`hCky%%qEEpC&>TUZNAyk5R|@(nq7P0o
z{jV4F4MblHeXF2vBl^gbP5mxG-%a%8&`03DHf;RC?fCD6K332Ni9Y=l)1PEPpF;GT
zpwAKXc|@N$+0?HT^i@Q^7W#TY-$3-8(6<WuHlk0(bNntr-%a!_(Dw=Y0G<cf@!tgf
zSa7<(Vu(I)ni-!&L2sW=*!m&p(*=Ddsox3xB0*n4^rKHV{aGpK>xjM*`es4jLiD?!
z-zMlgi9RR6^ruhI2k^Yaj?Y%;$AX8AKhY<jf$<mgNkqRM`gB2`N%Y;&FB0?>M4xu1
z=}(QIuO<2l=+_JSCZg|weygDGAo|R+On-I>`d*@Mhki7k8`1HP2DkewDbduQEa(%6
zz7hHvf<BGtV}4`mmkIiEqOXR&M$p$1ec)_Uf4!h@BKi>YTLpaw(RV_>OVIZceIN9r
z@mwuz{K4(`7o3Cf7xW24zYY2sf<BGtrzK(h1${ZuH$z_|=xZH4J}T)qSTE?C9KHT%
zEACv=pKXG^lju{=Gx|P3AHefPJDx4j$AR1NkH&lZ{L<>}=g~6+eHy8se!l5XfuIi&
zeFgM2g1(mM*I#JruNU-9M8668E<xW-^zGA3{Rlh<rQ;I`ZpWt^`dC39B>KR`rv3~;
zpGNfE(~Z7N(3cZ^;4-7H5%jf09}Ru0pl>7ku`^8lE<xW-^pl|<f#<$-Jfpzvct&4g
z>Q5H*2}ECerO~Ggdi#9Z){np1=qm+%6{$Zu-RRc}`bMG;U2F7P1$_t6w`CfApP&yM
zYPQ?{cV(ORvEXz(gGAqxYxL6ueJauKoNe@Fg1(&SL-|I(Qqb2CedcvW-zw<ah(58v
z=ywYG9->buH2Sf4PEW_jKJT~Vxv1FalLdVWxYe(mYxHG;zMSYMml}P&pl=}hnsTGx
zB<S0TK4+oP+s_$n-X7>8e{Htg{@d>n#eq|OJkbYkH0@^y`ZS_XSY-5z1bqe3H$Y!6
z=o^SWYO$%`Ea+Q^J`Vbwg1(37*WPUE#~o&V+VP3T`*{4c<7vNtWj|M;`ZS_XT7vNr
z>Q@kb2>N<K-$3-iN>hK6pl>JoZs@xNeK*lZ+-B<c3Hks&&#~hZ4SgIq9iMoj5B}cN
zPZsnkL_Y)ibU~j<^p((85`75otB8IX^eY8@9nsf9zh2Nc5q$&n+XQ_l(Rbc%#%J_c
z^V5!}?Z5qe%#Q!2r5H~^p8{_6&377onV>Hxdi(FQuN3rkM8D~7Q-7<V?;!f<dyKwM
z&<Bn%+im~tzXKHuPRA!m^!DG&m?r2`iQfKud1ZpWoapWEPp%R4wM1`!uWYlRZy|d7
z`v7+e`W~XUzvq1Pk!IZJ_(X%-@wC6UEm6=X5xxC=T$NOh_f<r1zmK|B&^Hpj{d;O#
z1$_t6+rJ0YC+GwCJk#d2e@`S9{Fm`Td;58*)!XmS<744pzUOI1SN;1W_=DA3UL)}L
z1s<bs4%Lg+nJw_O0{>dz3AkCM_3sh5{XQYp{~+iu8^ZVhHi5q&@Pi}xIt2oMRp1Bg
z$Ja>`_#XxSk-$d}<?9y;{8@q1@7tKFfxx-L`1-dCyjkFfknc0t`o9x+wZK0Y_<6(m
ze$ww1Sl<@~{h0mvI>iEiPT>C$_>=?q`YQ##UEqg~;Om40{<^>qB%gEH@kti=DuI6|
z@I>-Cj;%je;BN^0Sn_#<t&=bC)dK%s;Hl(!yRE-M;QtVKEO`!W>ns-dD*~s_lWm>p
z<T<D1PYAq6;Kz~Yd$!I^0{^GLk08&rY@N#l{-nU|b1-_GzmPoVvGs2jc!$6zk>??{
z&H{nk=P<NC`;q4Ww$8NzuNU~g1b#BP@3!^n{l4W-3HqVre$(ow3H%m;|6SmH0zZ%3
z$64P60;l(hRzHT^k63<@!0QG6AAui5uK#U)df#FBOM?Czf!phRI)CmZ*U7g2-vu5+
zt~0HEw!j}0_%4B;Nv=z6{bGT)34COXX-V@=5%@}hZx{HXNAvYV0)JlMUkE(;7{2~e
zf&W$D(Z}+2t`+zn1in+?C&%*j=Loz-;6sn&>zpO<8iBtr@B_#3_45S2PT)HPo_IW8
z|5kx-5O`FOuXBaK?-Y2Kz{lfzXLMa;2)s$)y9IvAc)tJk`)Jg6i=ZENB3~y{;A;f_
zZ-Gya<Llob@TUbHIf1W}CGZynuKq%I|BH^#sRCav@XrK3;UvEPEP-zn_&)J`oznz<
zx4^pve(of`{_O&97Wg42^L2^@{&#`LoWj?cE${~gzDwX|PUh<u3%pI>BTwb)OcD4>
zfo~W1p{Mcn?f0JOynSBKe<ASX)A{<V1pb}C6BGD4a|Ql}z>htHuahtE)dK%s;HhWw
z^&c1bR|1bci?6d-;I9b0SK!kV`T9=?e8_KjeY(J(6ZroG9)C7p{|<q_E%1nQ_&V1J
z{CR;Nn8eqaDe$EN-y!hCbNTwW3VegWqt4^&Tp{o~1>Pm_@l*Kv83Jz-_-=uplFZj%
zCh#o+ANE_mPNu-u2>jmypFEYXe}llE7I>Gye{()xe}%xe3H+cGzRq<5Zxr|^0zdl#
zzJ8^^|03|81wQ#gzW!YTe@Ebv7x8tn1pb)7w+Z~zX?*<~1>Pv|;TQ9DW(j<wz(-%g
z*ST8YcMH5*;744_*UuJst-wDN_`#`s{i_7NT;QJxJZU;#|BnLyNZ_L{<LeX({563e
zbva+BT;Q7pe&`Io&NP8PD)8L`zj7vDf0e+u2>iq=_&Re1zDD3b3q0*gzW!=~za#Lt
zG`>!Wz#kKM;3~dOioh2O{5^q>y_&B-UEog${A+<9|2w{Zg}`4E`2PexBb~4RfWY4t
z_#xNubuJY6p9KE7z>mC^ufIUxFADr?fnSut*S|;LuL=C9OukOJz&8tgd=_74iNIeM
z_-=t;Ig78qO5j@requIXXRg542>fS(pP$3mUnKB%1wJvCuXDS=I|V*&Hecs=0$(ri
z9|eBW9KL>)z~2)1kUYLly1<_k`2PeRpU>C7L*Uy59=wjPbB)0NB=8P_Pr9D3zd+z?
z1-@SaU*}qZZxDD?Az$YTf!`_cE`g6P;_GJ!{853wFYr@}`T7e5zE0q~1b%Udum1;u
zw+Z~{xqO{D0=M74rq9{73;IJ#`1-dA`~`s@T*}ue5co3!|4iUB%lP_B1-?VziSzh6
zw+eiNz@z5#b@B!Nw7|OrK7IjTe~G|f7x-?0Cztc}7YMvv;3q8P>l6#TUf@3o{E8d+
z`cDh|TY-<ik*~8v;I9jOx4^Gl#MfUX@GSyAaWP+KuE5s_{AYou-Ne^lE%0{)e(ueD
zo%sUq68Ntx_&Oy5|A)X2x`nSZRp1W^yjS4UZ{_PhA@CtfczwFS9})OJ1s-3?*S|yH
zZwuW1eFb{HD7lTV|CqqX{hrsC2>fM%kG!3)bFIJ|1paS<kF4VBpDXa&1>Py}ad+_b
ze<$$u0{>Cqrh54IoFlQp?nnFgWTONgO}PDgtT7JX7k}12f`rH5ePCkg!osqwS?Xt5
ziTRml|5TD&kTtO^x4bMcvHy?xMfqj!`;y|Etg<Y#F(YHvyg3=FKtZko{Tp;e_s^3i
zPO{pJ>$6L;mH5Q`P*z5EaZyojc3B`J<9gGV4An5dXin)Kwc!KQ{awmXZJbIu`K7kl
zFPojF+-9eBc0q1dNk(o_PN+D)s4OE#rC-Q*VNjt{u_U)Nx9pdSY%NLRR8ig5!#a2!
zS>#m8o;@ccH^laXZVGFaQIv&wpa<O<Rnv0d=J3{eIeIRrA>~^S*vz)h_+=i76$VPe
zs}vUJ=*cN|V&L}h_E~f03>sqK_VD&OxdRp9gGd$OHA;%-l?@t#2*NAm6&I-0E|0>%
z?cwd!{vNFPfX(5p3v<h|^id<DFst<X!RiRY@QS*>8M78<WEbS;77aQ@C1rTc?6Q)A
z!8$i^yVE`^CnsaTTz2+x*fyt~I@pNq!nQf>vWp7~^UK7h+-9e>IrvEZWwttP=cpr_
z)G}<F(=IemZWp%AX_s9bS|}QZZ**E>+%rNY#n~CzW##OSl|@b^?1{lE$s(tcwks*i
zD4ExPx(q)evD=;Y+GMcy>~^O;CPs;{Ud*g=w>oXjyl^)<lRSK*(^Ah1)$6iZ{Nmy^
zJFWHX7^F3~*=ap@UT(=k-9Eo4CzqcClEkS}m@~V-h`8f;fm1>6+1Ukq+4bQ9r-I(M
z;R0tL@B*hoe<uemAt;<0m_e!vyPmksPHQtwq{hrvw9P6gD9+9*%hi_~>I!Xses=iD
za8QlY2VFv6(q?2A=CB!f0jZEvsIFiKDG;`uwpV*|(Drn@)4o()tY#FJ^5^65jZVvw
z+&THBWw|98p?L)bVu?XiPOY5WL39JA<sdqz-Y+V36+WBYF@i#>G4Q(3>Cu2X1658f
zC!g3OQRCFn_X7F?Fk|3#rqdrmL2As+F3K*<P`4==rTNmXFUt^Aq*kfA&r-J*x>!if
zhQe9-h3tsyo(-yX>Xwyf<nT8cWD9MRQ8<r3G4!_^xYcPpyCgR^qx5?IqBeY^(^93H
zr$%vMX+|hN6n-GlH>Z-ssZyqH8*_>m6b)Wz5S3F)_od&G-wWYeNn7h8HV+q&3iCqh
z@;o<VPHDcn+EP#dxjO~jOHt?4!_9ccf}DJLgk_OaY0s_u;Kc^jIrVaj`fsTR?U<->
z>e$=vK?}(ur;<A7%`40uJe{a<>Xgna4e8UupgodBP9=RgrmK{eWtH*sKv0kxrG>eL
z8LI1LCF(Y<ELSci3!RFyN{X{`va?D}-{#IMR`-%6xmnqH`ofN#t)49$k9pbs!F9Zx
zS)pH^a1D6uA!-KJQKy)UlAMK8&SSf#iZFtK75YytgV$gss8W_&mX|TBBtK_PZvWLz
zSU+R|Q(@2g8ng~4W2#9H>)bAdX`Io~XQe@I`?<|dYrT61Y0YhBTdPB1L4FbcFk?@V
zFqKnFUnA-((XcVqXQ1$nq@_7diEZg-(i#URv3b~b(!O+IQFew};n^YnVX5vut08r=
zSdnvaqzmyPQb{eUz4V7skQzDqaHT#2<<5S(BVpT}_Jw)*=Ds4gXik0+e_0`FoI3Wz
zsI}tti7av|?OBc)gBBZ9=hRzJlCLfi<`!m!GV=LjuAp#g==)%GIh|WlGB2c_2xS%J
z6y)+xSNEcHYL?^{7SGp*IiIq77Z0dhT2@@5E;Dg<9jw3lR5z&BsXHr6pBm?6<jgDN
zFPV9PQ$ZhLazpBIYAB?x<=F`<Nt`PArTQeQe%T&3;lnpNE!9)Ca{ci2`i%L-!jox9
z!d97A<WYx;oJu-u-hzy>g~A0ryWMH8!kUu;=48hFtO8+@?@j7d)vhSJw>>4vNVSsw
zYpUXTCE2+dvrCE#r4M$r^PpN%SKpi#X7qokQ#h;txT7C7vGYQg-kY3MFDuC^Dh(Cu
z$9RM7AW255l@=Dx%g8A%%*rnkJIHFBIyk>&sP$8tu^_8Re;iq=j_=|}HGT~o2R%&Y
zoH1YQW!QG7z51voH>=d#8Vojh2Gu$Bveimghi`ppKUlfJWKK1mPTwr5V^Dt4>|!w?
zt8wb6V`iwoP_{a@7Ul8}0%Va>N%v@eZb@l=vAQMi|0G%Llq7Si?RiF|uEqL~kr~<i
zqlUdGotpXTk_pQkH<{}A$=?_4P3lz5$^E6Oougvey=tAhd>1l`iZf=Zhq3&1uXh{A
z$DUi&`O_TM26gaIJGF7=Y)i8fLew~Q!d&%LD_d<ZO1Gw(uO+#2=jE5==IEzzv-Rgo
zv-5>dhV)I%Uer!)y%zFA*%<}Jb7sxsAErtYv5G3TfQ>w`(m<J0t)x67R9wI>@UU%e
zyWH%B>N^_!2WjbXUx}n~>gaBU)Mp1`hJhQMmg+o;qvGHbX%N}KYU-1kTy-ekTQyNO
zu$sP5&dJqJe{zem`Aa#KKvE4>tN#v;9j~y0L^`l4g6zGMg9ry!)Js8KZ|`*oWgV?&
zPPTj7CH7<+uA}wL2QAXz*^|be?E~BI`Cws>!nr9{!_O%O*3gHHy&hLoC0RGHUQuyb
zzWNwceZ&`1(^s8lrLGMk99S{GC@Z@xe|~=1!i=)~LiIs}_%uXyb1&k(R1UjyA2^y}
z#l!S_sV`5oy%@<2_v+|3Wy7NJb9myOFZE5-yCGYBo;tbzPl1WEO4U`0{%E)Vn>K3q
z=1x5Sl9?0K6JmQEFfk`re-Y4J3YtG>&6-tWkG9yXo|oad2*B);tU^Uh19j16W|UPI
z;}nbc>K<Z_dW`)4<)yy|xsUp9D5;i&_iGymZipE8HgLFluUQh|4GT=g9{fVuRP|*{
z?PI^^X}`aDqGFu?PWZ-<y3~K1+RpjcUT2(A&|dowQGcfXXDO!r-S3L(CQ*OZ|5q=v
z!L~OW1O5Me7U$my{|;@cUfO>@_0zVu`E~zT|7UfpK%j^07@B{I(s2GwMaHQ`?;!Qk
z{=?Ky>aYKrv-Uq({WswCf_Zo5=mE4}tBG!-UzzGZuKk&B>8*jlcPE*j_W!n>{i*+&
zi~chi=0N;z)57-Gwx{p)Uti+#moGI+JI*@)0ZMDzTYjfvoPPrRhw4Vo%l6x%N7Ns<
z_DREy(tdy0>aD+hze@dq>wh)+9}l7K|48*`+urv7CB-=ZRQOvx%KXyazW<B*1Lxnu
zjGxY8>skK~6yyBUJo9%5{vAyIQH+0|;GgH2|9ind@=lY~=G5b_mjcayoC?q74|(Q~
zQH{CrkAc6t|Hm-?mk9n9p7}2j{8O3ydMs%Exq^R{XZ`}gKaa_O7~@|f_}6;ozgzIH
zW%7?@{Qn~O*Lmh&FZeey`Hy7$KNS2MJ@fxd@b6^u$1wgs2>wl;`F9Eay-faN82`~~
zU8)jc=Z`ke{0FM`-1-YH3t#`SjQ=Tuf4gV?iGqI;{N44huXX79yG-!!^vr*;;2&c0
z2O0mlf`7MX{sO_jipf8o@vj#Adp+~tDfl-r`QsS>X9fSj{(4rb>&X89@A;qIf0nEh
z{M(uQ6ICPI-kz7<6a1s#Z}rxXzTYhP2ktUT>!Z(qdM?`bmVYPsM|<Y~uizgIe|P@t
zYgFn#MqOWX>p$q3{~*<#TmLCc{>hC0X@Y;eXZ}foe<qXvG{*l5!9U3}|8&8>n#rHQ
z_?HX*DW3UD1^)&n|Cx;c1A>2=Xa4&H{|+X9BICbN@Xz$j|GePe!{k4k@!ux+hdlHD
zQ}B;j9=`sQ82>)OzuYtb_kw={{N43`9^*e&EnaT@S9#_?RJG^Ue;$)RnejhM@UQmF
zf12Q5!Q`LH_+Ksf*LmijDfl-s`BNDGC4zs0Xa1W6|28K7g^d4N!N18f|6_uGFOz>7
z<Nu!E-{P5nv)~_fw^@Jg{J(_p*AJDr`QPrD|9^si68!CXUZ4L{8UGl;zr!>C;i|pr
zLLf=~=f2XI{Ff;KJ^v>O{@tGW&l3ErnEW#s|8&8>$20$xf`1*8{|d&xT<{MZV6H#y
zc-gU~?@I;$b|!xs<6k5AN5VhK8sjJRzgzI{X7XRn_%{mv(VqFA6#S#{4`I3UKb`S^
zTkwzZ%>Rbq9}j<b{a?%Ye<}FKd*=UK@XuuOXEOdH)bnZX_><t7f0$~|t^aZ+|18FT
zyx^bWng2M!zk$i0!}w1X{8K&ipDXycF!^UQ{<8%COwat+2>v}x{yfJ2Cc!_?Gyg)t
zKk^=Pq;TiI{?&5!_+i)O1A>3KXa4&H{{;A3AASDQze<k!ZxH+|Jo7&z_@^@Yix~f{
zf`7GV{<j7H3MPMu@&7^aul3BoOYpB{@|Q6FN2(9CxZ_WQXZ~NS_T2HOjmfV+tD^gV
zis0Yqng49Tzmv&7pYhKV{98QpXAAyO_nM^c{4Zzxs|5cx&-_aS{~-L`^?w87-yryR
zc;^3;;Gf3iU&Q#g3I3g)`Ck$ILrngg82@g;zsEEG4#B^U$zQ?v4^`8ITYtTt`S(%n
zx%Jn?<iC~ij}`nQNBCX;9wqp9Gx;kS|8oWZDELRIHttKw2fPvm|G*!N(w+amS1oOO
zyDqO)fE)i9&-_;j{_*g)KKlGu#rQ84{DYqP%LV@wCjU~#f2H7`;F<q^!M~izzl`zU
zDEKFN=6_!BuV(TuXZ+t6{8K&izbp8+F!`$)|DOc^G|&9Kf`12-|6ayFW;j3p^E~q(
zuG(|QpU4{3G4*oie+}b*uHYZ?%%3Ru$H3oR|0@{(S%QCsXZ~vh|5PS_E#tpL@UQaB
zf0N*!$K-#2@vj&BYd!NnB>2}d`ByUjuL}Nkp7~n@|3)VNYR3Ol!N1Wn|Hp!VCzHR9
z@sHe}Uw=)W`G=_X-1_Tf@;}1(j~D#gJo6tX_y_L`U;p)t{{@17yJ!An!9NN9?)qQD
z_~!}!ou2u#1^*C}zk%`pz2M*Nng15SzlzEK1mj;X`1g9|e@O6eV)CzL{M!Woz^}~p
zXOwE=zRaxJLtYX5+nN09R5RP&o|kqC{!#F^dh1Bve<t_`Rv4xA(bs>CjQ_9H_anLM
z&uGv5k*Ynn{-fdV&i`i^|A~Ts&@=xDf`1B=e?8-WiQpgang0U8Ka<J-JmX&^_$PVh
z&lmiwnfy(R|8l`U#WVjMf`0>({{_Z>o#3D5ng4OYzk|u&%=rI9@Xz$j|C-?6!{mR7
z@$VM=L!S9}2>vnp#z?)~_1~i2+vA7jBS-M-zuYtbaMhk${|WGS*Z<3m|75|x$}|5-
zf`1;9zm@S%7yPR|^Is|WS1|csWBe-x|2oh7Hw*raO#U{;e~sYZ;F<qn!M}~k{|4jV
zCipjb=6^--?`86DV*I}p{98Qpe=hh()tZ&&&i}U<|IxqV*I&D5{sUEeZv7>}->!3g
z{%>de69oSb&-|wd{%K79EsTG<;NR_;|4PBXipjr~@xMv%@A1sPQ1Gu~^1sLU*9rcC
zk$%rV9~AuCnfx7$|7(JOB>baP8~0_;AC~=1@b6~wzponE_I6(G6#Sz-^M5AzNB_|{
zSsy+Bw=w?FBl-0g<C*_p)t*~_@$h%o|A&l!vfv-@ng1NYKa<Jd$@pI@_$PSgze?~g
zXYy}n{L2OZ6wmynf`0>(zl-r-A^4|y=D$bqZ(;I(%J{Dr{4+iCKP~w8F!{R~|ILDb
zo@f3|f`8-#X8pPI|38fXmx6z}Xa3Ix{{;BE>whQXf6#&a`mgZJKSH(V)_*FK|4YVy
zvfy9sng1lgzk<o%!}wn<_}6;opDFm)GWow|{3`_i2G9IA3jS?O{#}g!YQewJGyfk2
z|4t_VcZ`3t;NRkze}mv3^<en<ub1)vK=5z#%-<pS2jTCo{~sCu-GYCIXZ{}q|1>6l
zALBnRieLYop81bf?YZ?IV)E~1{4Wvwdpz@BAo$lY`SpW7Gb{Ey7bq3{dp+|P3I0t?
z{(Tw$TERc^K)>tXKM4NaO#TSQzeVtmg1_24;AO|p!i|D|K!32UUhxp>>(8N#f4ATt
z<C%Yl;2#fv_xu;h_>VY<pZ`J6{KHgxZvLk*`Sn+-?fBV##S8ukp7~D{{L7jA`XdGE
zKU45e^30zq_*XOe^^&6gHwgZzp84kq{w+-YD8_%a;GgE1|Br%y2a|sk<NvbYpXZtX
zMZrIEl^JO}&-D5m&G>&N_=i06Zx{Sy;P0;gF^vC+QT+O=@XS9<wddAfDw98&@t-L8
zS9#_?LGaIG@*l?drwabHp7}2l{A-!~V;TR2f`6T7{xZS8k;#7~<Nt`@-{_ftmEhmW
z<d0$ew+jAEp84Mv{Ck=F$1wgw59a58n`i!gRC{jz2Umx$|5(O<yx`yNng2M!KMDTs
z`X9&mUn2N-dgi}C@DDNhgN%Q%;NR_;|2o0Hipf8o@vj#Adp+~tDfl-r`QsS>X9fR&
zK3S@ly1W|jvgdCL*9rdZO#X?C|9gUe6#S_leZN`o4?Gk;|Kl0|?*;#8&-`Bt{?YJv
z=l{u!fAna6{RchsAFSGQ>pz9bKbi4ANAQpL%&&jH7U!SI<Uft^pDp+&dFIa&{HvM#
z35@?z!9T?_|80VQ1C#$u#($mQpXQnWalyZX$)CvhzbW`<dggBv{Ck-EXEXjg1^<v|
z{?7#en7Z)wpTzhda0tKt%02TBRqeU?p8$V%{h!D9j~D!_Jo6tX_~$YClNtY1!N1xw
z|3!j-1(Sa&<3C^Uuk*}5SMYCS@~1HVe-Qi|Jo7IX{M(rP7c%~hf`5}|{wD?hUMBxE
z#{X@>zr{2E8-jn-!)E=t^ZydY|4YHY-828^f`1bH-TU8E#((4(e*JfN<{z%wbL&5i
z$$uH+KT+`S_RN2R;9te$pTYQFCiwSw=D%3*uVeCG!T8S?`~wFmv3k+#J^FsG;NQ;V
zPh<Qa6#OIMzqjk(6@q^^lmBYQzeVtm_RPOg@Q;2Z{QQ^B_-_~dV?6VJAo$0_-(COL
zGX4>V^6M|&Gyl(me<qVZlktxg{1ZI$AEnxJ>%W}IKa25C7W`8@^PeO5H!%5g82>!M
zKh-mTw&35w<e$y>FBAMTJ@el#`1dgR^BDg>3;ubY`PT~mk$(z5|6RxUzbE*Yd*<IP
z_$R>MJ^vLj{<{VL3eWsM2>z)|{vyVIoa&&$VZZ;f+B5&rsy(;<DwzBs#y>^yul3A7
zMewg>@|Q6F*9ra&p80bH|28In8RK6g_&0jyzgzI{Wb)5v{9h9MTRijsMevWR4?q8v
zGyY!){%xN5KNb9g@ORIDH!%LuzvkzEhiCqSReNs!r!n~#G5*Pdf2U{ua|Hholm8~h
zKP33~c;>%e@ULU?S1|tf2>!jE`Iia)O-%k<8UJSl|498|p~v;_Q-XgtlfRPje^>C2
zg8$yGf7=EBz@y>kzuz<dy@G#?XZ~*l|9JST<=OwzpMO>{{)ZgKufL#Y{wUR+TYo7`
z{-uon$%21^XZ{I-e>szX8RI`w@K5s0pDOrQGx?V@{^f#ys%QRE!M}ycU(NWh68zIV
z^VbUg9Zddv8UL3B|2)t9FADyVYr@ZeHH`mu!9V1g{{z842LA5(Zw2GOuln~r6b`%o
ztMJVKli;7q<gaD?CkXykp812SJ-7bznEVeg{%L}Lt!Mtr1^-$m|4PRHX2HMCGye^O
ze<PEBHRHcV@Ne|Y|FGcS$>gtN{I>}HO`iGR6#RRc{EsmHy9NI?&-_0K{=vt>*MB|Z
zKVdAt{@OkB2UUA+{wKlTUH@ws|8&8>(=-2-f`5p~-@y1U5&XM7^WP-+S26jYVEmsD
z{Chp~KPvb)G5Oar{%;BXfrFJ;z4mtf_qyQU&g5Um_<t?<N5S9B;{LAm|Bt@^KfyoH
z5I+AK8UJIC;OBp|XZ|Bqdv5+m!{43%&oKTo1plCC{!0b_6ej<A#=lJPkN3=9Ecj<K
z`JZR}YXtu!&-`}_{?$zWCdR*6@K5o~zd`VCVDi7f_;(5ZX`cB%68t-u{LPI20Y~!l
zKhrb+P}QEB|2<6pml*$(1^<v|{t1GA%;VwfzlHI?Lhvv5%s*Z5Pk_I>{$FPNZxH;e
zJoC>J{PURnt&IOef`7GV{s#pA3MT(+jDM@(U+0<suY!LglfRAe|3dI@@XY_I;NQmN
ze}nNKbriq;nmqIWO10<KUoVq?6XTyK__uiGKV9&Tdcv$fcmBV{_|F#n+dcDV3I0j&
zcc1^XGyeAo{vDqAmkIu9O#Us5f3x7<?U{dr;9te$-^%!R3;sQx`F9BZbxi*E82`~R
z{QU3#%L?j>k6!Q5_Xn!>-2886@^>))DT06GXeCy!y<PuKQSCYZZYKZxjQ=9lUOTDB
zlLKDS@TYm{`voz)fAo_^>CXRcjQ<m=J?9_eng3D2KOX+>`u~ve?-2asJ@daK_-8Wt
zI~o5z!9T$>|M!A_Ig@`o;~#T0KmIA6`43m^x%t<?<nLnqFBJS!J@fxo@NZ%Af6Dlm
z3I3U$`HKbr9wvV`<Nt`@pXZr>mEa$_)~r8w{{M&ZZx{T_J@fxV@K1ohyZ(1F{@)1x
z6`uLO6#P?}{9iKuV~*kHf3;`+gH(HN{#P*hdl>)U2>!L6`4a^HS|<P3jDL>c-{6@)
zL-227^6z5&D+K>W&-^zE{+&$z?->7;f`5x={`&?0sHeiuf4z)<i{RhpnSZ0;AB4ZV
z{(ofry9ECZ&-@<={%K79KE{8aWBK*h>6yPz@DDNhcQgJ+3jRHw`G2k2bL+p3$*(W6
z?Ddm9F8)^V@Ab@|B=|Qm`S)e~3k3hjL)2iYm+f!=8|M8S!M~fyAHn$lLGX`)|K6^D
zmka)Zb>Zi~p^X0vf`5!>{^tb$c=+4>tUv#cWc)h?|Db37e+&L8O#b~D|Dmz``b+T4
zzmICq&Hr*H{|Lr^lHi}@nLkeOuV(U(Wc<?w|5VTXR|@_uO#Udw|2Dxt%`<<6;NQXI
zAI12u6a4c$^FJ>5M?M{X{?q@~xILcOb@86yAM(t<S@4g6zkB{0!}#wO{3|^3{~-9M
zGWnw!|8d9h>#xc)|Iw;_ggP!K*#k6w<}vvXWBe}>{A)e)Um*C`GWo|c{zZa+ooD`h
z!M~Boe<b6-T<~x7%zuaA-^t{UVf-5f|0d7;PYV9MO#WjS|1E-ln`izv1^-}U`1+4!
z{C^bu+dcDtEBGhD-(COX82@9&@$0YCGyf5)J-7ZsO#UF_f05wd?U{e7;9te$AJ6!g
z3I4sF`HKbrCMJIz<NvVW9~fh<KlgV1w^HzLXYx;E{NED%qu_7PSN8Bq-@h*S2mTyB
z|Kl0|-GYC#XZ{}q|7iHT^Z#VVf8z1{{11BOKS8zU=6?#4e=_4gNAQpL%s)%;&t&qS
z#`xC>{z;zs9~AtnnfwWi|GxzP6wmxy1^)&n|Cx;csG!;ZL+k{{&ouZakO@!T27aa5
zbNjyo{?$WGL4E&|$oL;2_*Wn4cmEkJ_~$j5p4#h7?SD4oKS8zEN}9hG{`%j?a$lzE
z9&)m3uX}3OncZUBuOo#`D$_=5&q90K&i<Twj8$4<eo~scm-gd78Q5aryFlO~)t=jb
z6&SyY`%M5nep8t7OBeh@!%Vv+>i3hlFX~?`wEyNX(|+O<xAmTJv-CQl|AAEXi{aI)
z0YcsXsZ9SX1pnZ*$gMtKbYGF~8};WK1^)*4r=DmUX#W((|1S8``BT2w_%Fo218HsT
z_}QPUg#Q1xO7GP`V0!=Tw5`L(uU6=P?~P{sQYM(Ty8jn3{eMdEKkttH`Wtpe?(x=t
zvi-KSLGVv{-1t{RsQoWy{ME023tPLoNjutaRQ25#_1EuJ*|1meUeo{JeP+{iB^sxO
b)W)&L6@7Rxdum{b)Z@*8Z+hxLPW}HM1pl56

diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 27e635c8cef0..9e838cd3383a 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -153,7 +153,7 @@ static int usb_string_copy(const char *s, char **s_copy)
 	char *str;
 	char *copy = *s_copy;
 	ret = strlen(s);
-	if (ret > MAX_USB_STRING_LEN)
+	if (ret > USB_MAX_STRING_LEN)
 		return -EOVERFLOW;
 
 	if (copy) {
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 8abe5b80a6a6..61ca40088b7e 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -347,10 +347,32 @@ static int xhci_plat_runtime_idle(struct device *dev)
 
 static int xhci_plat_runtime_suspend(struct device *dev)
 {
-	struct usb_hcd	*hcd = dev_get_drvdata(dev);
-	struct xhci_hcd	*xhci = hcd_to_xhci(hcd);
+	struct usb_hcd *hcd = dev_get_drvdata(dev);
+	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+
+	if (!xhci)
+		return 0;
+
+	dev_dbg(dev, "xhci-plat runtime suspend\n");
 
-	return xhci_resume(xhci, 0);
+	return xhci_suspend(xhci, true);
+}
+
+static int xhci_plat_runtime_resume(struct device *dev)
+{
+	struct usb_hcd *hcd = dev_get_drvdata(dev);
+	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+	int ret;
+
+	if (!xhci)
+		return 0;
+
+	dev_dbg(dev, "xhci-plat runtime resume\n");
+
+	ret = xhci_resume(xhci, false);
+	pm_runtime_mark_last_busy(dev);
+
+	return ret;
 }
 
 static const struct dev_pm_ops xhci_plat_pm_ops = {
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 89a37992a297..1cc3c9fe39d5 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1233,7 +1233,7 @@ static int reverse_path_check(void)
 
 static int ep_create_wakeup_source(struct epitem *epi)
 {
-	struct name_snapshot n;
+	const char *name;
 	struct wakeup_source *ws;
 
 	name = epi->ffd.file->f_path.dentry->d_name.name;
@@ -1245,9 +1245,7 @@ static int ep_create_wakeup_source(struct epitem *epi)
 			return -ENOMEM;
 	}
 
-	take_dentry_name_snapshot(&n, epi->ffd.file->f_path.dentry);
-	ws = wakeup_source_register(n.name);
-	release_dentry_name_snapshot(&n);
+	ws = wakeup_source_register(name);
 
 	if (!ws)
 		return -ENOMEM;
diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
index 7925a93c5c69..b481bd858c4b 100644
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -28,3 +28,17 @@
 #undef __no_sanitize_address
 #define __no_sanitize_address __attribute__((no_sanitize("address")))
 #endif
+
+/*
+ * Not all versions of clang implement the the type-generic versions
+ * of the builtin overflow checkers. Fortunately, clang implements
+ * __has_builtin allowing us to avoid awkward version
+ * checks. Unfortunately, we don't know which version of gcc clang
+ * pretends to be, so the macro may or may not be defined.
+ */
+#undef COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW
+#if __has_builtin(__builtin_mul_overflow) && \
+    __has_builtin(__builtin_add_overflow) && \
+    __has_builtin(__builtin_sub_overflow)
+#define COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW 1
+#endif
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index ab3f6ec018da..bba4070c1321 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -306,3 +306,7 @@
  * code
  */
 #define uninitialized_var(x) x = x
+
+#if GCC_VERSION >= 50100
+#define COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW 1
+#endif
diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h
index d4c71132d07f..8c9897b1b953 100644
--- a/include/linux/compiler-intel.h
+++ b/include/linux/compiler-intel.h
@@ -43,3 +43,7 @@
 #define __builtin_bswap16 _bswap16
 #endif
 
+/*
+ * icc defines __GNUC__, but does not implement the builtin overflow checkers.
+ */
+#undef COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW
diff --git a/include/linux/overflow.h b/include/linux/overflow.h
new file mode 100644
index 000000000000..c8890ec358a7
--- /dev/null
+++ b/include/linux/overflow.h
@@ -0,0 +1,205 @@
+/* SPDX-License-Identifier: GPL-2.0 OR MIT */
+#ifndef __LINUX_OVERFLOW_H
+#define __LINUX_OVERFLOW_H
+
+#include <linux/compiler.h>
+
+/*
+ * In the fallback code below, we need to compute the minimum and
+ * maximum values representable in a given type. These macros may also
+ * be useful elsewhere, so we provide them outside the
+ * COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW block.
+ *
+ * It would seem more obvious to do something like
+ *
+ * #define type_min(T) (T)(is_signed_type(T) ? (T)1 << (8*sizeof(T)-1) : 0)
+ * #define type_max(T) (T)(is_signed_type(T) ? ((T)1 << (8*sizeof(T)-1)) - 1 : ~(T)0)
+ *
+ * Unfortunately, the middle expressions, strictly speaking, have
+ * undefined behaviour, and at least some versions of gcc warn about
+ * the type_max expression (but not if -fsanitize=undefined is in
+ * effect; in that case, the warning is deferred to runtime...).
+ *
+ * The slightly excessive casting in type_min is to make sure the
+ * macros also produce sensible values for the exotic type _Bool. [The
+ * overflow checkers only almost work for _Bool, but that's
+ * a-feature-not-a-bug, since people shouldn't be doing arithmetic on
+ * _Bools. Besides, the gcc builtins don't allow _Bool* as third
+ * argument.]
+ *
+ * Idea stolen from
+ * https://mail-index.netbsd.org/tech-misc/2007/02/05/0000.html -
+ * credit to Christian Biere.
+ */
+#define is_signed_type(type)       (((type)(-1)) < (type)1)
+#define __type_half_max(type) ((type)1 << (8*sizeof(type) - 1 - is_signed_type(type)))
+#define type_max(T) ((T)((__type_half_max(T) - 1) + __type_half_max(T)))
+#define type_min(T) ((T)((T)-type_max(T)-(T)1))
+
+
+#ifdef COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW
+/*
+ * For simplicity and code hygiene, the fallback code below insists on
+ * a, b and *d having the same type (similar to the min() and max()
+ * macros), whereas gcc's type-generic overflow checkers accept
+ * different types. Hence we don't just make check_add_overflow an
+ * alias for __builtin_add_overflow, but add type checks similar to
+ * below.
+ */
+#define check_add_overflow(a, b, d) ({		\
+	typeof(a) __a = (a);			\
+	typeof(b) __b = (b);			\
+	typeof(d) __d = (d);			\
+	(void) (&__a == &__b);			\
+	(void) (&__a == __d);			\
+	__builtin_add_overflow(__a, __b, __d);	\
+})
+
+#define check_sub_overflow(a, b, d) ({		\
+	typeof(a) __a = (a);			\
+	typeof(b) __b = (b);			\
+	typeof(d) __d = (d);			\
+	(void) (&__a == &__b);			\
+	(void) (&__a == __d);			\
+	__builtin_sub_overflow(__a, __b, __d);	\
+})
+
+#define check_mul_overflow(a, b, d) ({		\
+	typeof(a) __a = (a);			\
+	typeof(b) __b = (b);			\
+	typeof(d) __d = (d);			\
+	(void) (&__a == &__b);			\
+	(void) (&__a == __d);			\
+	__builtin_mul_overflow(__a, __b, __d);	\
+})
+
+#else
+
+
+/* Checking for unsigned overflow is relatively easy without causing UB. */
+#define __unsigned_add_overflow(a, b, d) ({	\
+	typeof(a) __a = (a);			\
+	typeof(b) __b = (b);			\
+	typeof(d) __d = (d);			\
+	(void) (&__a == &__b);			\
+	(void) (&__a == __d);			\
+	*__d = __a + __b;			\
+	*__d < __a;				\
+})
+#define __unsigned_sub_overflow(a, b, d) ({	\
+	typeof(a) __a = (a);			\
+	typeof(b) __b = (b);			\
+	typeof(d) __d = (d);			\
+	(void) (&__a == &__b);			\
+	(void) (&__a == __d);			\
+	*__d = __a - __b;			\
+	__a < __b;				\
+})
+/*
+ * If one of a or b is a compile-time constant, this avoids a division.
+ */
+#define __unsigned_mul_overflow(a, b, d) ({		\
+	typeof(a) __a = (a);				\
+	typeof(b) __b = (b);				\
+	typeof(d) __d = (d);				\
+	(void) (&__a == &__b);				\
+	(void) (&__a == __d);				\
+	*__d = __a * __b;				\
+	__builtin_constant_p(__b) ?			\
+	  __b > 0 && __a > type_max(typeof(__a)) / __b : \
+	  __a > 0 && __b > type_max(typeof(__b)) / __a;	 \
+})
+
+/*
+ * For signed types, detecting overflow is much harder, especially if
+ * we want to avoid UB. But the interface of these macros is such that
+ * we must provide a result in *d, and in fact we must produce the
+ * result promised by gcc's builtins, which is simply the possibly
+ * wrapped-around value. Fortunately, we can just formally do the
+ * operations in the widest relevant unsigned type (u64) and then
+ * truncate the result - gcc is smart enough to generate the same code
+ * with and without the (u64) casts.
+ */
+
+/*
+ * Adding two signed integers can overflow only if they have the same
+ * sign, and overflow has happened iff the result has the opposite
+ * sign.
+ */
+#define __signed_add_overflow(a, b, d) ({	\
+	typeof(a) __a = (a);			\
+	typeof(b) __b = (b);			\
+	typeof(d) __d = (d);			\
+	(void) (&__a == &__b);			\
+	(void) (&__a == __d);			\
+	*__d = (u64)__a + (u64)__b;		\
+	(((~(__a ^ __b)) & (*__d ^ __a))	\
+		& type_min(typeof(__a))) != 0;	\
+})
+
+/*
+ * Subtraction is similar, except that overflow can now happen only
+ * when the signs are opposite. In this case, overflow has happened if
+ * the result has the opposite sign of a.
+ */
+#define __signed_sub_overflow(a, b, d) ({	\
+	typeof(a) __a = (a);			\
+	typeof(b) __b = (b);			\
+	typeof(d) __d = (d);			\
+	(void) (&__a == &__b);			\
+	(void) (&__a == __d);			\
+	*__d = (u64)__a - (u64)__b;		\
+	((((__a ^ __b)) & (*__d ^ __a))		\
+		& type_min(typeof(__a))) != 0;	\
+})
+
+/*
+ * Signed multiplication is rather hard. gcc always follows C99, so
+ * division is truncated towards 0. This means that we can write the
+ * overflow check like this:
+ *
+ * (a > 0 && (b > MAX/a || b < MIN/a)) ||
+ * (a < -1 && (b > MIN/a || b < MAX/a) ||
+ * (a == -1 && b == MIN)
+ *
+ * The redundant casts of -1 are to silence an annoying -Wtype-limits
+ * (included in -Wextra) warning: When the type is u8 or u16, the
+ * __b_c_e in check_mul_overflow obviously selects
+ * __unsigned_mul_overflow, but unfortunately gcc still parses this
+ * code and warns about the limited range of __b.
+ */
+
+#define __signed_mul_overflow(a, b, d) ({				\
+	typeof(a) __a = (a);						\
+	typeof(b) __b = (b);						\
+	typeof(d) __d = (d);						\
+	typeof(a) __tmax = type_max(typeof(a));				\
+	typeof(a) __tmin = type_min(typeof(a));				\
+	(void) (&__a == &__b);						\
+	(void) (&__a == __d);						\
+	*__d = (u64)__a * (u64)__b;					\
+	(__b > 0   && (__a > __tmax/__b || __a < __tmin/__b)) ||	\
+	(__b < (typeof(__b))-1  && (__a > __tmin/__b || __a < __tmax/__b)) || \
+	(__b == (typeof(__b))-1 && __a == __tmin);			\
+})
+
+
+#define check_add_overflow(a, b, d)					\
+	__builtin_choose_expr(is_signed_type(typeof(a)),		\
+			__signed_add_overflow(a, b, d),			\
+			__unsigned_add_overflow(a, b, d))
+
+#define check_sub_overflow(a, b, d)					\
+	__builtin_choose_expr(is_signed_type(typeof(a)),		\
+			__signed_sub_overflow(a, b, d),			\
+			__unsigned_sub_overflow(a, b, d))
+
+#define check_mul_overflow(a, b, d)					\
+	__builtin_choose_expr(is_signed_type(typeof(a)),		\
+			__signed_mul_overflow(a, b, d),			\
+			__unsigned_mul_overflow(a, b, d))
+
+
+#endif /* COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW */
+
+#endif /* __LINUX_OVERFLOW_H */
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 24df80a89291..00389bb3375e 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -2262,11 +2262,11 @@ static unsigned long zs_can_compact(struct size_class *class)
 }
 
 static unsigned long __zs_compact(struct zs_pool *pool,
-				   struct size_class *class)
+				  struct size_class *class)
 {
 	struct zs_compact_control cc;
-	struct page *src_page;
-	struct page *dst_page = NULL;
+	struct zspage *src_zspage;
+	struct zspage *dst_zspage = NULL;
 	unsigned long pages_freed = 0;
 
 	spin_lock(&class->lock);
@@ -2294,9 +2294,11 @@ static unsigned long __zs_compact(struct zs_pool *pool,
 		if (dst_zspage == NULL)
 			break;
 
-		putback_zspage(pool, class, dst_page);
-		if (putback_zspage(pool, class, src_page) == ZS_EMPTY)
+		putback_zspage(class, dst_zspage);
+		if (putback_zspage(class, src_zspage) == ZS_EMPTY) {
+			free_zspage(pool, class, src_zspage);
 			pages_freed += class->pages_per_zspage;
+		}
 		spin_unlock(&class->lock);
 		cond_resched();
 		spin_lock(&class->lock);

From 4cb51c9ca40b622365d273ee8407f3cd238ff954 Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Mon, 7 May 2018 16:47:02 -0700
Subject: [PATCH 1896/2658] overflow.h: Add allocation size calculation helpers

commit 610b15c50e86eb1e4b77274fabcaea29ac72d6a8 upstream.

In preparation for replacing unchecked overflows for memory allocations,
this creates helpers for the 3 most common calculations:

array_size(a, b): 2-dimensional array
array3_size(a, b, c): 3-dimensional array
struct_size(ptr, member, n): struct followed by n-many trailing members

Each of these return SIZE_MAX on overflow instead of wrapping around.

(Additionally renames a variable named "array_size" to avoid future
collision.)

Co-developed-by: Matthew Wilcox <mawilcox@microsoft.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-table.c    | 10 +++---
 include/linux/overflow.h | 73 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 78 insertions(+), 5 deletions(-)

diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index bad6eb3413b0..48c7c09a078a 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -517,14 +517,14 @@ static int adjoin(struct dm_table *table, struct dm_target *ti)
  * On the other hand, dm-switch needs to process bulk data using messages and
  * excessive use of GFP_NOIO could cause trouble.
  */
-static char **realloc_argv(unsigned *array_size, char **old_argv)
+static char **realloc_argv(unsigned *size, char **old_argv)
 {
 	char **argv;
 	unsigned new_size;
 	gfp_t gfp;
 
-	if (*array_size) {
-		new_size = *array_size * 2;
+	if (*size) {
+		new_size = *size * 2;
 		gfp = GFP_KERNEL;
 	} else {
 		new_size = 8;
@@ -532,8 +532,8 @@ static char **realloc_argv(unsigned *array_size, char **old_argv)
 	}
 	argv = kmalloc(new_size * sizeof(*argv), gfp);
 	if (argv) {
-		memcpy(argv, old_argv, *array_size * sizeof(*argv));
-		*array_size = new_size;
+		memcpy(argv, old_argv, *size * sizeof(*argv));
+		*size = new_size;
 	}
 
 	kfree(old_argv);
diff --git a/include/linux/overflow.h b/include/linux/overflow.h
index c8890ec358a7..8712ff70995f 100644
--- a/include/linux/overflow.h
+++ b/include/linux/overflow.h
@@ -202,4 +202,77 @@
 
 #endif /* COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW */
 
+/**
+ * array_size() - Calculate size of 2-dimensional array.
+ *
+ * @a: dimension one
+ * @b: dimension two
+ *
+ * Calculates size of 2-dimensional array: @a * @b.
+ *
+ * Returns: number of bytes needed to represent the array or SIZE_MAX on
+ * overflow.
+ */
+static inline __must_check size_t array_size(size_t a, size_t b)
+{
+	size_t bytes;
+
+	if (check_mul_overflow(a, b, &bytes))
+		return SIZE_MAX;
+
+	return bytes;
+}
+
+/**
+ * array3_size() - Calculate size of 3-dimensional array.
+ *
+ * @a: dimension one
+ * @b: dimension two
+ * @c: dimension three
+ *
+ * Calculates size of 3-dimensional array: @a * @b * @c.
+ *
+ * Returns: number of bytes needed to represent the array or SIZE_MAX on
+ * overflow.
+ */
+static inline __must_check size_t array3_size(size_t a, size_t b, size_t c)
+{
+	size_t bytes;
+
+	if (check_mul_overflow(a, b, &bytes))
+		return SIZE_MAX;
+	if (check_mul_overflow(bytes, c, &bytes))
+		return SIZE_MAX;
+
+	return bytes;
+}
+
+static inline __must_check size_t __ab_c_size(size_t n, size_t size, size_t c)
+{
+	size_t bytes;
+
+	if (check_mul_overflow(n, size, &bytes))
+		return SIZE_MAX;
+	if (check_add_overflow(bytes, c, &bytes))
+		return SIZE_MAX;
+
+	return bytes;
+}
+
+/**
+ * struct_size() - Calculate size of structure with trailing array.
+ * @p: Pointer to the structure.
+ * @member: Name of the array member.
+ * @n: Number of elements in the array.
+ *
+ * Calculates size of memory needed for structure @p followed by an
+ * array of @n @member elements.
+ *
+ * Return: number of bytes needed or SIZE_MAX on overflow.
+ */
+#define struct_size(p, member, n)					\
+	__ab_c_size(n,							\
+		    sizeof(*(p)->member) + __must_be_array((p)->member),\
+		    sizeof(*(p)))
+
 #endif /* __LINUX_OVERFLOW_H */

From 4b566cbb0e2c2d13df4b077c135a861e2ca854f3 Mon Sep 17 00:00:00 2001
From: Mike Galbraith <efault@gmx.de>
Date: Fri, 16 Apr 2021 14:02:07 +0200
Subject: [PATCH 1897/2658] x86/crash: Fix crash_setup_memmap_entries()
 out-of-bounds access

commit 5849cdf8c120e3979c57d34be55b92d90a77a47e upstream.

Commit in Fixes: added support for kexec-ing a kernel on panic using a
new system call. As part of it, it does prepare a memory map for the new
kernel.

However, while doing so, it wrongly accesses memory it has not
allocated: it accesses the first element of the cmem->ranges[] array in
memmap_exclude_ranges() but it has not allocated the memory for it in
crash_setup_memmap_entries(). As KASAN reports:

  BUG: KASAN: vmalloc-out-of-bounds in crash_setup_memmap_entries+0x17e/0x3a0
  Write of size 8 at addr ffffc90000426008 by task kexec/1187

  (gdb) list *crash_setup_memmap_entries+0x17e
  0xffffffff8107cafe is in crash_setup_memmap_entries (arch/x86/kernel/crash.c:322).
  317                                      unsigned long long mend)
  318     {
  319             unsigned long start, end;
  320
  321             cmem->ranges[0].start = mstart;
  322             cmem->ranges[0].end = mend;
  323             cmem->nr_ranges = 1;
  324
  325             /* Exclude elf header region */
  326             start = image->arch.elf_load_addr;
  (gdb)

Make sure the ranges array becomes a single element allocated.

 [ bp: Write a proper commit message. ]

Fixes: dd5f726076cc ("kexec: support for kexec on panic using new system call")
Signed-off-by: Mike Galbraith <efault@gmx.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Dave Young <dyoung@redhat.com>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/725fa3dc1da2737f0f6188a1a9701bead257ea9d.camel@gmx.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/crash.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
index 2c1910f6717e..a6d623e43d62 100644
--- a/arch/x86/kernel/crash.c
+++ b/arch/x86/kernel/crash.c
@@ -23,6 +23,7 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
+#include <linux/overflow.h>
 
 #include <asm/processor.h>
 #include <asm/hardirq.h>
@@ -572,7 +573,7 @@ int crash_setup_memmap_entries(struct kimage *image, struct boot_params *params)
 	struct crash_memmap_data cmd;
 	struct crash_mem *cmem;
 
-	cmem = vzalloc(sizeof(struct crash_mem));
+	cmem = vzalloc(struct_size(cmem, ranges, 1));
 	if (!cmem)
 		return -ENOMEM;
 

From 67bd8085661a2f7b71cc014459b9124672567256 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 26 Apr 2021 10:11:49 +0200
Subject: [PATCH 1898/2658] net: hso: fix NULL-deref on disconnect regression

commit 2ad5692db72874f02b9ad551d26345437ea4f7f3 upstream.

Commit 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device
unregistration") fixed the racy minor allocation reported by syzbot, but
introduced an unconditional NULL-pointer dereference on every disconnect
instead.

Specifically, the serial device table must no longer be accessed after
the minor has been released by hso_serial_tty_unregister().

Fixes: 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device unregistration")
Cc: stable@vger.kernel.org
Cc: Anirudh Rayabharam <mail@anirudhrb.com>
Reported-by: Leonardo Antoniazzi <leoanto@aruba.it>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Anirudh Rayabharam <mail@anirudhrb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/hso.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index c0779fbc045d..559c9b6290e1 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -3131,7 +3131,7 @@ static void hso_free_interface(struct usb_interface *interface)
 			cancel_work_sync(&serial_table[i]->async_put_intf);
 			cancel_work_sync(&serial_table[i]->async_get_intf);
 			hso_serial_tty_unregister(serial);
-			kref_put(&serial_table[i]->ref, hso_serial_ref_free);
+			kref_put(&serial->parent->ref, hso_serial_ref_free);
 		}
 	}
 

From db0ff1f3ae1b8493aae08f8a6973cd260eff720f Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 28 Apr 2021 12:05:48 +0200
Subject: [PATCH 1899/2658] Linux 4.4.268

Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Link: https://lore.kernel.org/r/20210426072816.574319312@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 0b937d865b62..16e023ca3eca 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 267
+SUBLEVEL = 268
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From b206abf44b6784a080bca6998a056e73d6da5fb3 Mon Sep 17 00:00:00 2001
From: Eric Caruso <ejcaruso@google.com>
Date: Wed, 8 Jun 2016 16:08:59 -0700
Subject: [PATCH 1900/2658] timerfd: Reject ALARM timerfds without
 CAP_WAKE_ALARM

commit 2895a5e5b3ae78d9923a91fce405d4a2f32c4309 upstream.

timerfd gives processes a way to set wake alarms, but unlike timers made using
timer_create, timerfds don't check whether the process has CAP_WAKE_ALARM
before setting alarm-time timers. CAP_WAKE_ALARM is supposed to gate this
behavior and so it makes sense that we should deny permission to create such
timerfds if the process doesn't have this capability.

Signed-off-by: Eric Caruso <ejcaruso@google.com>
Cc: Todd Poynor <toddpoynor@google.com>
Link: http://lkml.kernel.org/r/1465427339-96209-1-git-send-email-ejcaruso@chromium.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Kasper Zwijsen <Kasper.Zwijsen@UGent.be>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/timerfd.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/fs/timerfd.c b/fs/timerfd.c
index 0548c572839c..7ec77f8cc443 100644
--- a/fs/timerfd.c
+++ b/fs/timerfd.c
@@ -403,6 +403,11 @@ SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags)
 	     clockid != CLOCK_POWEROFF_ALARM))
 		return -EINVAL;
 
+	if (!capable(CAP_WAKE_ALARM) &&
+	    (clockid == CLOCK_REALTIME_ALARM ||
+	     clockid == CLOCK_BOOTTIME_ALARM))
+		return -EPERM;
+
 	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
 	if (!ctx)
 		return -ENOMEM;
@@ -446,6 +451,11 @@ static int do_timerfd_settime(int ufd, int flags,
 		return ret;
 	ctx = f.file->private_data;
 
+	if (!capable(CAP_WAKE_ALARM) && isalarm(ctx)) {
+		fdput(f);
+		return -EPERM;
+	}
+
 	timerfd_setup_cancel(ctx, flags);
 
 	/*

From 5ad04c63f639a04813da7e54974644ca58b9d4bf Mon Sep 17 00:00:00 2001
From: Phillip Potter <phil@philpotter.co.uk>
Date: Thu, 1 Apr 2021 23:36:07 +0100
Subject: [PATCH 1901/2658] net: usb: ax88179_178a: initialize local variables
 before use

commit bd78980be1a68d14524c51c4b4170782fada622b upstream.

Use memset to initialize local array in drivers/net/usb/ax88179_178a.c, and
also set a local u16 and u32 variable to 0. Fixes a KMSAN found uninit-value bug
reported by syzbot at:
https://syzkaller.appspot.com/bug?id=00371c73c72f72487c1d0bfe0cc9d00de339d5aa

Reported-by: syzbot+4993e4a0e237f1b53747@syzkaller.appspotmail.com
Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/ax88179_178a.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 2dcc8a039d42..53cef8cd1aad 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -307,12 +307,12 @@ static int ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
 	int ret;
 
 	if (2 == size) {
-		u16 buf;
+		u16 buf = 0;
 		ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 0);
 		le16_to_cpus(&buf);
 		*((u16 *)data) = buf;
 	} else if (4 == size) {
-		u32 buf;
+		u32 buf = 0;
 		ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 0);
 		le32_to_cpus(&buf);
 		*((u32 *)data) = buf;

From 0a117c5de49dd6497f5cf38dc62bb3f1ae6aecbc Mon Sep 17 00:00:00 2001
From: Jiri Kosina <jkosina@suse.cz>
Date: Tue, 2 Mar 2021 11:26:55 +0100
Subject: [PATCH 1902/2658] iwlwifi: Fix softirq/hardirq disabling in
 iwl_pcie_enqueue_hcmd()

commit 2800aadc18a64c96b051bcb7da8a7df7d505db3f upstream.

It's possible for iwl_pcie_enqueue_hcmd() to be called with hard IRQs
disabled (e.g. from LED core). We can't enable BHs in such a situation.

Turn the unconditional BH-enable/BH-disable code into
hardirq-disable/conditional-enable.

This fixes the warning below.

 WARNING: CPU: 1 PID: 1139 at kernel/softirq.c:178 __local_bh_enable_ip+0xa5/0xf0
 CPU: 1 PID: 1139 Comm: NetworkManager Not tainted 5.12.0-rc1-00004-gb4ded168af79 #7
 Hardware name: LENOVO 20K5S22R00/20K5S22R00, BIOS R0IET38W (1.16 ) 05/31/2017
 RIP: 0010:__local_bh_enable_ip+0xa5/0xf0
 Code: f7 69 e8 ee 23 14 00 fb 66 0f 1f 44 00 00 65 8b 05 f0 f4 f7 69 85 c0 74 3f 48 83 c4 08 5b c3 65 8b 05 9b fe f7 69 85 c0 75 8e <0f> 0b eb 8a 48 89 3c 24 e8 4e 20 14 00 48 8b 3c 24 eb 91 e8 13 4e
 RSP: 0018:ffffafd580b13298 EFLAGS: 00010046
 RAX: 0000000000000000 RBX: 0000000000000201 RCX: 0000000000000000
 RDX: 0000000000000003 RSI: 0000000000000201 RDI: ffffffffc1272389
 RBP: ffff96517ae4c018 R08: 0000000000000001 R09: 0000000000000000
 R10: ffffafd580b13178 R11: 0000000000000001 R12: ffff96517b060000
 R13: 0000000000000000 R14: ffffffff80000000 R15: 0000000000000001
 FS:  00007fc604ebefc0(0000) GS:ffff965267480000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 000055fb3fef13b2 CR3: 0000000109112004 CR4: 00000000003706e0
 Call Trace:
  ? _raw_spin_unlock_bh+0x1f/0x30
  iwl_pcie_enqueue_hcmd+0x5d9/0xa00 [iwlwifi]
  iwl_trans_txq_send_hcmd+0x6c/0x430 [iwlwifi]
  iwl_trans_send_cmd+0x88/0x170 [iwlwifi]
  ? lock_acquire+0x277/0x3d0
  iwl_mvm_send_cmd+0x32/0x80 [iwlmvm]
  iwl_mvm_led_set+0xc2/0xe0 [iwlmvm]
  ? led_trigger_event+0x46/0x70
  led_trigger_event+0x46/0x70
  ieee80211_do_open+0x5c5/0xa20 [mac80211]
  ieee80211_open+0x67/0x90 [mac80211]
  __dev_open+0xd4/0x150
  __dev_change_flags+0x19e/0x1f0
  dev_change_flags+0x23/0x60
  do_setlink+0x30d/0x1230
  ? lock_is_held_type+0xb4/0x120
  ? __nla_validate_parse.part.7+0x57/0xcb0
  ? __lock_acquire+0x2e1/0x1a50
  __rtnl_newlink+0x560/0x910
  ? __lock_acquire+0x2e1/0x1a50
  ? __lock_acquire+0x2e1/0x1a50
  ? lock_acquire+0x277/0x3d0
  ? sock_def_readable+0x5/0x290
  ? lock_is_held_type+0xb4/0x120
  ? find_held_lock+0x2d/0x90
  ? sock_def_readable+0xb3/0x290
  ? lock_release+0x166/0x2a0
  ? lock_is_held_type+0x90/0x120
  rtnl_newlink+0x47/0x70
  rtnetlink_rcv_msg+0x25c/0x470
  ? netlink_deliver_tap+0x97/0x3e0
  ? validate_linkmsg+0x350/0x350
  netlink_rcv_skb+0x50/0x100
  netlink_unicast+0x1b2/0x280
  netlink_sendmsg+0x336/0x450
  sock_sendmsg+0x5b/0x60
  ____sys_sendmsg+0x1ed/0x250
  ? copy_msghdr_from_user+0x5c/0x90
  ___sys_sendmsg+0x88/0xd0
  ? lock_is_held_type+0xb4/0x120
  ? find_held_lock+0x2d/0x90
  ? lock_release+0x166/0x2a0
  ? __fget_files+0xfe/0x1d0
  ? __sys_sendmsg+0x5e/0xa0
  __sys_sendmsg+0x5e/0xa0
  ? lockdep_hardirqs_on_prepare+0xd9/0x170
  do_syscall_64+0x33/0x80
  entry_SYSCALL_64_after_hwframe+0x44/0xae
 RIP: 0033:0x7fc605c9572d
 Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 da ee ff ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 2e ef ff ff 48
 RSP: 002b:00007fffc83789f0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e
 RAX: ffffffffffffffda RBX: 000055ef468570c0 RCX: 00007fc605c9572d
 RDX: 0000000000000000 RSI: 00007fffc8378a30 RDI: 000000000000000c
 RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000
 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
 R13: 00007fffc8378b80 R14: 00007fffc8378b7c R15: 0000000000000000
 irq event stamp: 170785
 hardirqs last  enabled at (170783): [<ffffffff9609a8c2>] __local_bh_enable_ip+0x82/0xf0
 hardirqs last disabled at (170784): [<ffffffff96a8613d>] _raw_read_lock_irqsave+0x8d/0x90
 softirqs last  enabled at (170782): [<ffffffffc1272389>] iwl_pcie_enqueue_hcmd+0x5d9/0xa00 [iwlwifi]
 softirqs last disabled at (170785): [<ffffffffc1271ec6>] iwl_pcie_enqueue_hcmd+0x116/0xa00 [iwlwifi]

Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Tested-by: Sedat Dilek <sedat.dilek@gmail.com> # LLVM/Clang v12.0.0-rc3
Acked-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/nycvar.YFH.7.76.2103021125430.12405@cbobk.fhfr.pm
Signed-off-by: Jari Ruusu <jariruusu@protonmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/iwlwifi/pcie/tx.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 7584796131fa..b020bd6adaf2 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -1341,6 +1341,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
 	u32 cmd_pos;
 	const u8 *cmddata[IWL_MAX_CMD_TBS_PER_TFD];
 	u16 cmdlen[IWL_MAX_CMD_TBS_PER_TFD];
+	unsigned long flags2;
 
 	if (WARN(!trans_pcie->wide_cmd_header &&
 		 group_id > IWL_ALWAYS_LONG_GROUP,
@@ -1423,10 +1424,10 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
 		goto free_dup_buf;
 	}
 
-	spin_lock_bh(&txq->lock);
+	spin_lock_irqsave(&txq->lock, flags2);
 
 	if (iwl_queue_space(q) < ((cmd->flags & CMD_ASYNC) ? 2 : 1)) {
-		spin_unlock_bh(&txq->lock);
+		spin_unlock_irqrestore(&txq->lock, flags2);
 
 		IWL_ERR(trans, "No space in command queue\n");
 		iwl_op_mode_cmd_queue_full(trans->op_mode);
@@ -1588,7 +1589,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
 	spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
 
  out:
-	spin_unlock_bh(&txq->lock);
+	spin_unlock_irqrestore(&txq->lock, flags2);
  free_dup_buf:
 	if (idx < 0)
 		kfree(dup_buf);

From 308d0807f7d940ac7b7e037ed9689a2716b6f4c6 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 7 Apr 2021 16:45:49 +0200
Subject: [PATCH 1903/2658] ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX

commit 64f40f9be14106e7df0098c427cb60be645bddb7 upstream.

ToneLab EX guitar pedal device requires the same quirk like ToneLab ST
for supporting the MIDI.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=212593
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210407144549.1530-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/quirks-table.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index a917b7e02d31..d3d3e05fe5b8 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -2479,6 +2479,16 @@ YAMAHA_DEVICE(0x7010, "UB99"),
 	}
 },
 
+{
+	USB_DEVICE_VENDOR_SPEC(0x0944, 0x0204),
+	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+		.vendor_name = "KORG, Inc.",
+		/* .product_name = "ToneLab EX", */
+		.ifnum = 3,
+		.type = QUIRK_MIDI_STANDARD_INTERFACE,
+	}
+},
+
 /* AKAI devices */
 {
 	USB_DEVICE(0x09e8, 0x0062),

From 0eafbeef6bdc88f821ad32e6ac920e9ba53a491b Mon Sep 17 00:00:00 2001
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date: Mon, 12 Apr 2021 21:54:53 +0800
Subject: [PATCH 1904/2658] USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock
 Gen2 Ethernet

commit 8f23fe35ff1e5491b4d279323a8209a31f03ae65 upstream.

This is another branded 8153 device that doesn't work well with LPM
enabled:
[ 400.597506] r8152 5-1.1:1.0 enx482ae3a2a6f0: Tx status -71

So disable LPM to resolve the issue.

Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
BugLink: https://bugs.launchpad.net/bugs/1922651
Link: https://lore.kernel.org/r/20210412135455.791971-1-kai.heng.feng@canonical.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/quirks.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index cd43e11d74f3..cd05813e8632 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -264,6 +264,9 @@ static const struct usb_device_id usb_quirk_list[] = {
 	{ USB_DEVICE(0x1532, 0x0116), .driver_info =
 			USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
 
+	/* Lenovo ThinkPad USB-C Dock Gen2 Ethernet (RTL8153 GigE) */
+	{ USB_DEVICE(0x17ef, 0xa387), .driver_info = USB_QUIRK_NO_LPM },
+
 	/* BUILDWIN Photo Frame */
 	{ USB_DEVICE(0x1908, 0x1315), .driver_info =
 			USB_QUIRK_HONOR_BNUMINTERFACES },

From 174853bdf1b765db868d2e76d7f8c9c6065913d5 Mon Sep 17 00:00:00 2001
From: Chris Chiu <chris.chiu@canonical.com>
Date: Wed, 21 Apr 2021 01:46:51 +0800
Subject: [PATCH 1905/2658] USB: Add reset-resume quirk for WD19's Realtek Hub

commit ca91fd8c7643d93bfc18a6fec1a0d3972a46a18a upstream.

Realtek Hub (0bda:5487) in Dell Dock WD19 sometimes fails to work
after the system resumes from suspend with remote wakeup enabled
device connected:
[ 1947.640907] hub 5-2.3:1.0: hub_ext_port_status failed (err = -71)
[ 1947.641208] usb 5-2.3-port5: cannot disable (err = -71)
[ 1947.641401] hub 5-2.3:1.0: hub_ext_port_status failed (err = -71)
[ 1947.641450] usb 5-2.3-port4: cannot reset (err = -71)

Information of this hub:
T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480  MxCh= 5
D:  Ver= 2.10 Cls=09(hub  ) Sub=00 Prot=02 MxPS=64 #Cfgs=  1
P:  Vendor=0bda ProdID=5487 Rev= 1.47
S:  Manufacturer=Dell Inc.
S:  Product=Dell dock
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=01 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   1 Ivl=256ms
I:* If#= 0 Alt= 1 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=02 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   1 Ivl=256ms

The failure results from the ETIMEDOUT by chance when turning on
the suspend feature for the specified port of the hub. The port
seems to be in an unknown state so the hub_activate during resume
fails the hub_port_status, then the hub will fail to work.

The quirky hub needs the reset-resume quirk to function correctly.

Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Chris Chiu <chris.chiu@canonical.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210420174651.6202-1-chris.chiu@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/quirks.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index cd05813e8632..3dfd584a1ef3 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -245,6 +245,7 @@ static const struct usb_device_id usb_quirk_list[] = {
 
 	/* Realtek hub in Dell WD19 (Type-C) */
 	{ USB_DEVICE(0x0bda, 0x0487), .driver_info = USB_QUIRK_NO_LPM },
+	{ USB_DEVICE(0x0bda, 0x5487), .driver_info = USB_QUIRK_RESET_RESUME },
 
 	/* Generic RTL8153 based ethernet adapters */
 	{ USB_DEVICE(0x0bda, 0x8153), .driver_info = USB_QUIRK_NO_LPM },

From d89ef98c8df114b30b3f59e9b3b82841eb81c9a2 Mon Sep 17 00:00:00 2001
From: Mark Pearson <markpearson@lenovo.com>
Date: Wed, 7 Apr 2021 17:20:15 -0400
Subject: [PATCH 1906/2658] platform/x86: thinkpad_acpi: Correct thermal sensor
 allocation

commit 6759e18e5cd8745a5dfc5726e4a3db5281ec1639 upstream.

On recent Thinkpad platforms it was reported that temp sensor 11 was
always incorrectly displaying 66C. It turns out the reason for this is
that this location in EC RAM is not a temperature sensor but is the
power supply ID (offset 0xC2).

Based on feedback from the Lenovo firmware team the EC RAM version can
be determined and for the current version (3) only the 0x78 to 0x7F
range is used for temp sensors. I don't have any details for earlier
versions so I have left the implementation unaltered there.

Note - in this block only 0x78 and 0x79 are officially designated (CPU &
GPU sensors). The use of the other locations in the block will vary from
platform to platform; but the existing logic to detect a sensor presence
holds.

Signed-off-by: Mark Pearson <markpearson@lenovo.com>
Link: https://lore.kernel.org/r/20210407212015.298222-1-markpearson@lenovo.com
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/platform/x86/thinkpad_acpi.c | 31 ++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 9180b24ba60a..20c588af33d8 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -5766,6 +5766,7 @@ enum thermal_access_mode {
 enum { /* TPACPI_THERMAL_TPEC_* */
 	TP_EC_THERMAL_TMP0 = 0x78,	/* ACPI EC regs TMP 0..7 */
 	TP_EC_THERMAL_TMP8 = 0xC0,	/* ACPI EC regs TMP 8..15 */
+	TP_EC_FUNCREV      = 0xEF,      /* ACPI EC Functional revision */
 	TP_EC_THERMAL_TMP_NA = -128,	/* ACPI EC sensor not available */
 
 	TPACPI_THERMAL_SENSOR_NA = -128000, /* Sensor not available */
@@ -5964,7 +5965,7 @@ static const struct attribute_group thermal_temp_input8_group = {
 
 static int __init thermal_init(struct ibm_init_struct *iibm)
 {
-	u8 t, ta1, ta2;
+	u8 t, ta1, ta2, ver = 0;
 	int i;
 	int acpi_tmp7;
 	int res;
@@ -5979,7 +5980,14 @@ static int __init thermal_init(struct ibm_init_struct *iibm)
 		 * 0x78-0x7F, 0xC0-0xC7.  Registers return 0x00 for
 		 * non-implemented, thermal sensors return 0x80 when
 		 * not available
+		 * The above rule is unfortunately flawed. This has been seen with
+		 * 0xC2 (power supply ID) causing thermal control problems.
+		 * The EC version can be determined by offset 0xEF and at least for
+		 * version 3 the Lenovo firmware team confirmed that registers 0xC0-0xC7
+		 * are not thermal registers.
 		 */
+		if (!acpi_ec_read(TP_EC_FUNCREV, &ver))
+			pr_warn("Thinkpad ACPI EC unable to access EC version\n");
 
 		ta1 = ta2 = 0;
 		for (i = 0; i < 8; i++) {
@@ -5989,11 +5997,13 @@ static int __init thermal_init(struct ibm_init_struct *iibm)
 				ta1 = 0;
 				break;
 			}
-			if (acpi_ec_read(TP_EC_THERMAL_TMP8 + i, &t)) {
-				ta2 |= t;
-			} else {
-				ta1 = 0;
-				break;
+			if (ver < 3) {
+				if (acpi_ec_read(TP_EC_THERMAL_TMP8 + i, &t)) {
+					ta2 |= t;
+				} else {
+					ta1 = 0;
+					break;
+				}
 			}
 		}
 		if (ta1 == 0) {
@@ -6009,9 +6019,12 @@ static int __init thermal_init(struct ibm_init_struct *iibm)
 				thermal_read_mode = TPACPI_THERMAL_NONE;
 			}
 		} else {
-			thermal_read_mode =
-			    (ta2 != 0) ?
-			    TPACPI_THERMAL_TPEC_16 : TPACPI_THERMAL_TPEC_8;
+			if (ver >= 3)
+				thermal_read_mode = TPACPI_THERMAL_TPEC_8;
+			else
+				thermal_read_mode =
+					(ta2 != 0) ?
+					TPACPI_THERMAL_TPEC_16 : TPACPI_THERMAL_TPEC_8;
 		}
 	} else if (acpi_tmp7) {
 		if (tpacpi_is_ibm() &&

From d45af9e0c5006d432e3858200e4a65f3b3573790 Mon Sep 17 00:00:00 2001
From: Vasily Gorbik <gor@linux.ibm.com>
Date: Tue, 20 Apr 2021 11:04:10 +0200
Subject: [PATCH 1907/2658] s390/disassembler: increase ebpf disasm buffer size

commit 6f3353c2d2b3eb4de52e9704cb962712033db181 upstream.

Current ebpf disassembly buffer size of 64 is too small. E.g. this line
takes 65 bytes:
01fffff8005822e: ec8100ed8065\tclgrj\t%r8,%r1,8,001fffff80058408\n\0

Double the buffer size like it is done for the kernel disassembly buffer.

Fixes the following KASAN finding:

UG: KASAN: stack-out-of-bounds in print_fn_code+0x34c/0x380
Write of size 1 at addr 001fff800ad5f970 by task test_progs/853

CPU: 53 PID: 853 Comm: test_progs Not tainted
5.12.0-rc7-23786-g23457d86b1f0-dirty #19
Hardware name: IBM 3906 M04 704 (LPAR)
Call Trace:
 [<0000000cd8e0538a>] show_stack+0x17a/0x1668
 [<0000000cd8e2a5d8>] dump_stack+0x140/0x1b8
 [<0000000cd8e16e74>] print_address_description.constprop.0+0x54/0x260
 [<0000000cd75a8698>] kasan_report+0xc8/0x130
 [<0000000cd6e26da4>] print_fn_code+0x34c/0x380
 [<0000000cd6ea0f4e>] bpf_int_jit_compile+0xe3e/0xe58
 [<0000000cd72c4c88>] bpf_prog_select_runtime+0x5b8/0x9c0
 [<0000000cd72d1bf8>] bpf_prog_load+0xa78/0x19c0
 [<0000000cd72d7ad6>] __do_sys_bpf.part.0+0x18e/0x768
 [<0000000cd6e0f392>] do_syscall+0x12a/0x220
 [<0000000cd8e333f8>] __do_syscall+0x98/0xc8
 [<0000000cd8e54834>] system_call+0x6c/0x94
1 lock held by test_progs/853:
 #0: 0000000cd9bf7460 (report_lock){....}-{2:2}, at:
     kasan_report+0x96/0x130

addr 001fff800ad5f970 is located in stack of task test_progs/853 at
offset 96 in frame:
 print_fn_code+0x0/0x380
this frame has 1 object:
 [32, 96) 'buffer'

Memory state around the buggy address:
 001fff800ad5f800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 001fff800ad5f880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>001fff800ad5f900: 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 f3 f3
                                                             ^
 001fff800ad5f980: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 001fff800ad5fa00: 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00

Cc: <stable@vger.kernel.org>
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/kernel/dis.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c
index 07477ba392b7..1d4a054ce59a 100644
--- a/arch/s390/kernel/dis.c
+++ b/arch/s390/kernel/dis.c
@@ -2033,7 +2033,7 @@ void show_code(struct pt_regs *regs)
 
 void print_fn_code(unsigned char *code, unsigned long len)
 {
-	char buffer[64], *ptr;
+	char buffer[128], *ptr;
 	int opsize, i;
 
 	while (len) {

From 889a6637e050b51fec6df567c870c1187b08552b Mon Sep 17 00:00:00 2001
From: Mark Langsdorf <mlangsdo@redhat.com>
Date: Fri, 23 Apr 2021 10:28:17 -0500
Subject: [PATCH 1908/2658] ACPI: custom_method: fix potential use-after-free
 issue

commit e483bb9a991bdae29a0caa4b3a6d002c968f94aa upstream.

In cm_write(), buf is always freed when reaching the end of the
function.  If the requested count is less than table.length, the
allocated buffer will be freed but subsequent calls to cm_write() will
still try to access it.

Remove the unconditional kfree(buf) at the end of the function and
set the buf to NULL in the -EINVAL error path to match the rest of
function.

Fixes: 03d1571d9513 ("ACPI: custom_method: fix memory leaks")
Signed-off-by: Mark Langsdorf <mlangsdo@redhat.com>
Cc: 5.4+ <stable@vger.kernel.org> # 5.4+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/acpi/custom_method.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c
index 435bd0ffc8c0..c76ab507c182 100644
--- a/drivers/acpi/custom_method.c
+++ b/drivers/acpi/custom_method.c
@@ -50,6 +50,7 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
 	    (*ppos + count < count) ||
 	    (count > uncopied_bytes)) {
 		kfree(buf);
+		buf = NULL;
 		return -EINVAL;
 	}
 
@@ -71,7 +72,6 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
 		add_taint(TAINT_OVERRIDDEN_ACPI_TABLE, LOCKDEP_NOW_UNRELIABLE);
 	}
 
-	kfree(buf);
 	return count;
 }
 

From 19e4b37ca7811b1ebb96344ee0c889711b0daedb Mon Sep 17 00:00:00 2001
From: Mark Langsdorf <mlangsdo@redhat.com>
Date: Tue, 27 Apr 2021 13:54:33 -0500
Subject: [PATCH 1909/2658] ACPI: custom_method: fix a possible memory leak

commit 1cfd8956437f842836e8a066b40d1ec2fc01f13e upstream.

In cm_write(), if the 'buf' is allocated memory but not fully consumed,
it is possible to reallocate the buffer without freeing it by passing
'*ppos' as 0 on a subsequent call.

Add an explicit kfree() before kzalloc() to prevent the possible memory
leak.

Fixes: 526b4af47f44 ("ACPI: Split out custom_method functionality into an own driver")
Signed-off-by: Mark Langsdorf <mlangsdo@redhat.com>
Cc: 5.4+ <stable@vger.kernel.org> # 5.4+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/acpi/custom_method.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c
index c76ab507c182..ea4c7c93a920 100644
--- a/drivers/acpi/custom_method.c
+++ b/drivers/acpi/custom_method.c
@@ -37,6 +37,8 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
 				   sizeof(struct acpi_table_header)))
 			return -EFAULT;
 		uncopied_bytes = max_size = table.length;
+		/* make sure the buf is not allocated */
+		kfree(buf);
 		buf = kzalloc(max_size, GFP_KERNEL);
 		if (!buf)
 			return -ENOMEM;

From ff329c3670b29a7ce7607bd8ddf03bfd930489e2 Mon Sep 17 00:00:00 2001
From: Jeffrey Mitchell <jeffrey.mitchell@starlab.io>
Date: Fri, 26 Feb 2021 15:00:23 -0600
Subject: [PATCH 1910/2658] ecryptfs: fix kernel panic with null dev_name

commit 9046625511ad8dfbc8c6c2de16b3532c43d68d48 upstream.

When mounting eCryptfs, a null "dev_name" argument to ecryptfs_mount()
causes a kernel panic if the parsed options are valid. The easiest way to
reproduce this is to call mount() from userspace with an existing
eCryptfs mount's options and a "source" argument of 0.

Error out if "dev_name" is null in ecryptfs_mount()

Fixes: 237fead61998 ("[PATCH] ecryptfs: fs/Makefile and fs/Kconfig")
Cc: stable@vger.kernel.org
Signed-off-by: Jeffrey Mitchell <jeffrey.mitchell@starlab.io>
Signed-off-by: Tyler Hicks <code@tyhicks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ecryptfs/main.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 85f7a289bdac..7d63228b9657 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -547,6 +547,12 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
 		goto out;
 	}
 
+	if (!dev_name) {
+		rc = -EINVAL;
+		err = "Device name cannot be null";
+		goto out;
+	}
+
 	rc = ecryptfs_parse_options(sbi, raw_data, &check_ruid);
 	if (rc) {
 		err = "Error parsing options";

From f7e0258acaab6905cc922e046b5901106e6a2e6d Mon Sep 17 00:00:00 2001
From: DooHyun Hwang <dh0421.hwang@samsung.com>
Date: Wed, 10 Feb 2021 13:59:36 +0900
Subject: [PATCH 1911/2658] mmc: core: Do a power cycle when the CMD11 fails

commit 147186f531ae49c18b7a9091a2c40e83b3d95649 upstream.

A CMD11 is sent to the SD/SDIO card to start the voltage switch procedure
into 1.8V I/O. According to the SD spec a power cycle is needed of the
card, if it turns out that the CMD11 fails. Let's fix this, to allow a
retry of the initialization without the voltage switch, to succeed.

Note that, whether it makes sense to also retry with the voltage switch
after the power cycle is a bit more difficult to know. At this point, we
treat it like the CMD11 isn't supported and therefore we skip it when
retrying.

Signed-off-by: DooHyun Hwang <dh0421.hwang@samsung.com>
Link: https://lore.kernel.org/r/20210210045936.7809-1-dh0421.hwang@samsung.com
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/core/core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 781aefd377ff..e2d9bf3769e2 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -2953,7 +2953,10 @@ int mmc_set_signal_voltage(struct mmc_host *host, int signal_voltage, u32 ocr)
 	mmc_host_clk_hold(host);
 	err = mmc_wait_for_cmd(host, &cmd, 0);
 	if (err)
-		goto err_command;
+		goto power_cycle;
+
+	if (!mmc_host_is_spi(host) && (cmd.resp[0] & R1_ERROR))
+		return -EIO;
 
 	if (!mmc_host_is_spi(host) && (cmd.resp[0] & R1_ERROR)) {
 		err = -EIO;

From 55f2a6bbfa3b5b16c0b7f37735a8dd7dbcbcc6c2 Mon Sep 17 00:00:00 2001
From: Seunghui Lee <sh043.lee@samsung.com>
Date: Mon, 22 Feb 2021 17:31:56 +0900
Subject: [PATCH 1912/2658] mmc: core: Set read only for SD cards with
 permanent write protect bit

commit 917a5336f2c27928be270226ab374ed0cbf3805d upstream.

Some of SD cards sets permanent write protection bit in their CSD register,
due to lifespan or internal problem. To avoid unnecessary I/O write
operations, let's parse the bits in the CSD during initialization and mark
the card as read only for this case.

Signed-off-by: Seunghui Lee <sh043.lee@samsung.com>
Link: https://lore.kernel.org/r/20210222083156.19158-1-sh043.lee@samsung.com
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/core/sd.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
index ed1f10859c05..666c12744e12 100644
--- a/drivers/mmc/core/sd.c
+++ b/drivers/mmc/core/sd.c
@@ -144,6 +144,9 @@ static int mmc_decode_csd(struct mmc_card *card)
 			csd->erase_size = UNSTUFF_BITS(resp, 39, 7) + 1;
 			csd->erase_size <<= csd->write_blkbits - 9;
 		}
+
+		if (UNSTUFF_BITS(resp, 13, 1))
+			mmc_card_set_readonly(card);
 		break;
 	case 1:
 		/*
@@ -178,6 +181,9 @@ static int mmc_decode_csd(struct mmc_card *card)
 		csd->write_blkbits = 9;
 		csd->write_partial = 0;
 		csd->erase_size = 1;
+
+		if (UNSTUFF_BITS(resp, 13, 1))
+			mmc_card_set_readonly(card);
 		break;
 	default:
 		pr_err("%s: unrecognised CSD structure version %d\n",

From 75c64034bbc52e5722f5b0bc0b3e5e076d24acfc Mon Sep 17 00:00:00 2001
From: Phillip Potter <phil@philpotter.co.uk>
Date: Wed, 31 Mar 2021 23:07:19 +0100
Subject: [PATCH 1913/2658] fbdev: zero-fill colormap in fbcmap.c

commit 19ab233989d0f7ab1de19a036e247afa4a0a1e9c upstream.

Use kzalloc() rather than kmalloc() for the dynamically allocated parts
of the colormap in fb_alloc_cmap_gfp, to prevent a leak of random kernel
data to userspace under certain circumstances.

Fixes a KMSAN-found infoleak bug reported by syzbot at:
https://syzkaller.appspot.com/bug?id=741578659feabd108ad9e06696f0c1f2e69c4b6e

Reported-by: syzbot+47fa9c9c648b765305b9@syzkaller.appspotmail.com
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
Link: https://lore.kernel.org/r/20210331220719.1499743-1-phil@philpotter.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/fbdev/core/fbcmap.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/video/fbdev/core/fbcmap.c b/drivers/video/fbdev/core/fbcmap.c
index 1f8b480b1a4d..1555106ae38f 100644
--- a/drivers/video/fbdev/core/fbcmap.c
+++ b/drivers/video/fbdev/core/fbcmap.c
@@ -101,17 +101,17 @@ int fb_alloc_cmap_gfp(struct fb_cmap *cmap, int len, int transp, gfp_t flags)
 		if (!len)
 			return 0;
 
-		cmap->red = kmalloc(size, flags);
+		cmap->red = kzalloc(size, flags);
 		if (!cmap->red)
 			goto fail;
-		cmap->green = kmalloc(size, flags);
+		cmap->green = kzalloc(size, flags);
 		if (!cmap->green)
 			goto fail;
-		cmap->blue = kmalloc(size, flags);
+		cmap->blue = kzalloc(size, flags);
 		if (!cmap->blue)
 			goto fail;
 		if (transp) {
-			cmap->transp = kmalloc(size, flags);
+			cmap->transp = kzalloc(size, flags);
 			if (!cmap->transp)
 				goto fail;
 		} else {

From c3d23991fdc632c02236d43dd29d3a20d9d89f76 Mon Sep 17 00:00:00 2001
From: karthik alapati <mail@karthek.com>
Date: Sun, 21 Feb 2021 21:01:05 +0530
Subject: [PATCH 1914/2658] staging: wimax/i2400m: fix byte-order issue

[ Upstream commit 0c37baae130df39b19979bba88bde2ee70a33355 ]

fix sparse byte-order warnings by converting host byte-order
type to __le16 byte-order types before assigning to hdr.length

Signed-off-by: karthik alapati <mail@karthek.com>
Link: https://lore.kernel.org/r/0ae5c5c4c646506d8be871e7be5705542671a1d5.1613921277.git.mail@karthek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wimax/i2400m/op-rfkill.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wimax/i2400m/op-rfkill.c b/drivers/net/wimax/i2400m/op-rfkill.c
index dc6fe93ce71f..e8473047b2d1 100644
--- a/drivers/net/wimax/i2400m/op-rfkill.c
+++ b/drivers/net/wimax/i2400m/op-rfkill.c
@@ -101,7 +101,7 @@ int i2400m_op_rfkill_sw_toggle(struct wimax_dev *wimax_dev,
 	if (cmd == NULL)
 		goto error_alloc;
 	cmd->hdr.type = cpu_to_le16(I2400M_MT_CMD_RF_CONTROL);
-	cmd->hdr.length = sizeof(cmd->sw_rf);
+	cmd->hdr.length = cpu_to_le16(sizeof(cmd->sw_rf));
 	cmd->hdr.version = cpu_to_le16(I2400M_L3L4_VERSION);
 	cmd->sw_rf.hdr.type = cpu_to_le16(I2400M_TLV_RF_OPERATION);
 	cmd->sw_rf.hdr.length = cpu_to_le16(sizeof(cmd->sw_rf.status));

From 44944323f28a3b4d1e20b028bdc696cd3393933d Mon Sep 17 00:00:00 2001
From: Pawel Laszczak <pawell@cadence.com>
Date: Mon, 8 Mar 2021 13:53:38 +0100
Subject: [PATCH 1915/2658] usb: gadget: uvc: add bInterval checking for HS
 mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 26adde04acdff14a1f28d4a5dce46a8513a3038b ]

Patch adds extra checking for bInterval passed by configfs.
The 5.6.4 chapter of USB Specification (rev. 2.0) say:
"A high-bandwidth endpoint must specify a period of 1x125 µs
(i.e., a bInterval value of 1)."

The issue was observed during testing UVC class on CV.
I treat this change as improvement because we can control
bInterval by configfs.

Reviewed-by: Peter Chen <peter.chen@kernel.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Pawel Laszczak <pawell@cadence.com>
Link: https://lore.kernel.org/r/20210308125338.4824-1-pawell@gli-login.cadence.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/function/f_uvc.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c
index f8a1881609a2..89da34ef7b3f 100644
--- a/drivers/usb/gadget/function/f_uvc.c
+++ b/drivers/usb/gadget/function/f_uvc.c
@@ -625,7 +625,12 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f)
 
 	uvc_hs_streaming_ep.wMaxPacketSize =
 		cpu_to_le16(max_packet_size | ((max_packet_mult - 1) << 11));
-	uvc_hs_streaming_ep.bInterval = opts->streaming_interval;
+
+	/* A high-bandwidth endpoint must specify a bInterval value of 1 */
+	if (max_packet_mult > 1)
+		uvc_hs_streaming_ep.bInterval = 1;
+	else
+		uvc_hs_streaming_ep.bInterval = opts->streaming_interval;
 
 	uvc_ss_streaming_ep.wMaxPacketSize = cpu_to_le16(max_packet_size);
 	uvc_ss_streaming_ep.bInterval = opts->streaming_interval;

From a85ed76115e87ff46a60fe20fa2722436ef68a18 Mon Sep 17 00:00:00 2001
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Date: Tue, 16 Mar 2021 16:51:40 +0100
Subject: [PATCH 1916/2658] PCI: PM: Do not read power state in
 pci_enable_device_flags()

[ Upstream commit 4514d991d99211f225d83b7e640285f29f0755d0 ]

It should not be necessary to update the current_state field of
struct pci_dev in pci_enable_device_flags() before calling
do_pci_enable_device() for the device, because none of the
code between that point and the pci_set_power_state() call in
do_pci_enable_device() invoked later depends on it.

Moreover, doing that is actively harmful in some cases.  For example,
if the given PCI device depends on an ACPI power resource whose _STA
method initially returns 0 ("off"), but the config space of the PCI
device is accessible and the power state retrieved from the
PCI_PM_CTRL register is D0, the current_state field in the struct
pci_dev representing that device will get out of sync with the
power.state of its ACPI companion object and that will lead to
power management issues going forward.

To avoid such issues it is better to leave the current_state value
as is until it is changed to PCI_D0 by do_pci_enable_device() as
appropriate.  However, the power state of the device is not changed
to PCI_D0 if it is already enabled when pci_enable_device_flags()
gets called for it, so update its current_state in that case, but
use pci_update_current_state() covering platform PM too for that.

Link: https://lore.kernel.org/lkml/20210314000439.3138941-1-luzmaximilian@gmail.com/
Reported-by: Maximilian Luz <luzmaximilian@gmail.com>
Tested-by: Maximilian Luz <luzmaximilian@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci.c | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index b7f65fc54dc2..22e8172f373d 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1328,20 +1328,10 @@ static int pci_enable_device_flags(struct pci_dev *dev, unsigned long flags)
 	int err;
 	int i, bars = 0;
 
-	/*
-	 * Power state could be unknown at this point, either due to a fresh
-	 * boot or a device removal call.  So get the current power state
-	 * so that things like MSI message writing will behave as expected
-	 * (e.g. if the device really is in D0 at enable time).
-	 */
-	if (dev->pm_cap) {
-		u16 pmcsr;
-		pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr);
-		dev->current_state = (pmcsr & PCI_PM_CTRL_STATE_MASK);
-	}
-
-	if (atomic_inc_return(&dev->enable_cnt) > 1)
+	if (atomic_inc_return(&dev->enable_cnt) > 1) {
+		pci_update_current_state(dev, dev->current_state);
 		return 0;		/* already enabled */
+	}
 
 	bridge = pci_upstream_bridge(dev);
 	if (bridge)

From ac7fa4fd59055ca061ac190ab6a8c59d1b230a50 Mon Sep 17 00:00:00 2001
From: John Millikin <john@john-millikin.com>
Date: Thu, 25 Mar 2021 17:04:33 -0700
Subject: [PATCH 1917/2658] x86/build: Propagate $(CLANG_FLAGS) to
 $(REALMODE_FLAGS)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 8abe7fc26ad8f28bfdf78adbed56acd1fa93f82d ]

When cross-compiling with Clang, the `$(CLANG_FLAGS)' variable
contains additional flags needed to build C and assembly sources
for the target platform. Normally this variable is automatically
included in `$(KBUILD_CFLAGS)' via the top-level Makefile.

The x86 real-mode makefile builds `$(REALMODE_CFLAGS)' from a
plain assignment and therefore drops the Clang flags. This causes
Clang to not recognize x86-specific assembler directives:

  arch/x86/realmode/rm/header.S:36:1: error: unknown directive
  .type real_mode_header STT_OBJECT ; .size real_mode_header, .-real_mode_header
  ^

Explicit propagation of `$(CLANG_FLAGS)' to `$(REALMODE_CFLAGS)',
which is inherited by real-mode make rules, fixes cross-compilation
with Clang for x86 targets.

Relevant flags:

* `--target' sets the target architecture when cross-compiling. This
  flag must be set for both compilation and assembly (`KBUILD_AFLAGS')
  to support architecture-specific assembler directives.

* `-no-integrated-as' tells clang to assemble with GNU Assembler
  instead of its built-in LLVM assembler. This flag is set by default
  unless `LLVM_IAS=1' is set, because the LLVM assembler can't yet
  parse certain GNU extensions.

Signed-off-by: John Millikin <john@john-millikin.com>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
Link: https://lkml.kernel.org/r/20210326000435.4785-2-nathan@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 07673d987c2c..e94f8ed5eea5 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -40,6 +40,7 @@ REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -ffreestanding
 REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -fno-stack-protector)
 REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -Wno-address-of-packed-member)
 REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), $(cc_stack_align4))
+REALMODE_CFLAGS += $(CLANG_FLAGS)
 export REALMODE_CFLAGS
 
 # BITS is used as extension for files which are available in a 32 bit

From 3cddbc8be5527fb3aaa377166548f0141eec2f5f Mon Sep 17 00:00:00 2001
From: Wei Yongjun <weiyongjun1@huawei.com>
Date: Fri, 9 Apr 2021 08:29:55 +0000
Subject: [PATCH 1918/2658] spi: dln2: Fix reference leak to master

[ Upstream commit 9b844b087124c1538d05f40fda8a4fec75af55be ]

Call spi_master_get() holds the reference count to master device, thus
we need an additional spi_master_put() call to reduce the reference
count, otherwise we will leak a reference to master.

This commit fix it by removing the unnecessary spi_master_get().

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Link: https://lore.kernel.org/r/20210409082955.2907950-1-weiyongjun1@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-dln2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/spi/spi-dln2.c b/drivers/spi/spi-dln2.c
index 3b7d91d94fea..64b64174ce2f 100644
--- a/drivers/spi/spi-dln2.c
+++ b/drivers/spi/spi-dln2.c
@@ -781,7 +781,7 @@ static int dln2_spi_probe(struct platform_device *pdev)
 
 static int dln2_spi_remove(struct platform_device *pdev)
 {
-	struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
+	struct spi_master *master = platform_get_drvdata(pdev);
 	struct dln2_spi *dln2 = spi_master_get_devdata(master);
 
 	pm_runtime_disable(&pdev->dev);

From bfab8ac63bfa3412c6f544b85514dd61f85998de Mon Sep 17 00:00:00 2001
From: Wei Yongjun <weiyongjun1@huawei.com>
Date: Fri, 9 Apr 2021 08:29:54 +0000
Subject: [PATCH 1919/2658] spi: omap-100k: Fix reference leak to master

[ Upstream commit a23faea76d4cf5f75decb574491e66f9ecd707e7 ]

Call spi_master_get() holds the reference count to master device, thus
we need an additional spi_master_put() call to reduce the reference
count, otherwise we will leak a reference to master.

This commit fix it by removing the unnecessary spi_master_get().

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Link: https://lore.kernel.org/r/20210409082954.2906933-1-weiyongjun1@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-omap-100k.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/spi/spi-omap-100k.c b/drivers/spi/spi-omap-100k.c
index 76a8425be227..1eccdc4a4581 100644
--- a/drivers/spi/spi-omap-100k.c
+++ b/drivers/spi/spi-omap-100k.c
@@ -435,7 +435,7 @@ static int omap1_spi100k_probe(struct platform_device *pdev)
 
 static int omap1_spi100k_remove(struct platform_device *pdev)
 {
-	struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
+	struct spi_master *master = platform_get_drvdata(pdev);
 	struct omap1_spi100k *spi100k = spi_master_get_devdata(master);
 
 	pm_runtime_disable(&pdev->dev);
@@ -449,7 +449,7 @@ static int omap1_spi100k_remove(struct platform_device *pdev)
 #ifdef CONFIG_PM
 static int omap1_spi100k_runtime_suspend(struct device *dev)
 {
-	struct spi_master *master = spi_master_get(dev_get_drvdata(dev));
+	struct spi_master *master = dev_get_drvdata(dev);
 	struct omap1_spi100k *spi100k = spi_master_get_devdata(master);
 
 	clk_disable_unprepare(spi100k->ick);
@@ -460,7 +460,7 @@ static int omap1_spi100k_runtime_suspend(struct device *dev)
 
 static int omap1_spi100k_runtime_resume(struct device *dev)
 {
-	struct spi_master *master = spi_master_get(dev_get_drvdata(dev));
+	struct spi_master *master = dev_get_drvdata(dev);
 	struct omap1_spi100k *spi100k = spi_master_get_devdata(master);
 	int ret;
 

From 12562abe86d617daa2421d7d19b076e64f59215a Mon Sep 17 00:00:00 2001
From: Pavel Machek <pavel@ucw.cz>
Date: Wed, 14 Apr 2021 20:12:49 +0300
Subject: [PATCH 1920/2658] intel_th: Consistency and off-by-one fix

[ Upstream commit 18ffbc47d45a1489b664dd68fb3a7610a6e1dea3 ]

Consistently use "< ... +1" in for loops.

Fix of-by-one in for_each_set_bit().

Signed-off-by: Pavel Machek <pavel@denx.de>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Link: https://lore.kernel.org/lkml/20190724095841.GA6952@amd/
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20210414171251.14672-6-alexander.shishkin@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwtracing/intel_th/gth.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hwtracing/intel_th/gth.c b/drivers/hwtracing/intel_th/gth.c
index 189eb6269971..e585b29ce738 100644
--- a/drivers/hwtracing/intel_th/gth.c
+++ b/drivers/hwtracing/intel_th/gth.c
@@ -485,7 +485,7 @@ static void intel_th_gth_disable(struct intel_th_device *thdev,
 	output->active = false;
 
 	for_each_set_bit(master, gth->output[output->port].master,
-			 TH_CONFIGURABLE_MASTERS) {
+			 TH_CONFIGURABLE_MASTERS + 1) {
 		gth_master_set(gth, master, -1);
 	}
 	spin_unlock(&gth->gth_lock);
@@ -597,7 +597,7 @@ static void intel_th_gth_unassign(struct intel_th_device *thdev,
 	othdev->output.port = -1;
 	othdev->output.active = false;
 	gth->output[port].output = NULL;
-	for (master = 0; master <= TH_CONFIGURABLE_MASTERS; master++)
+	for (master = 0; master < TH_CONFIGURABLE_MASTERS + 1; master++)
 		if (gth->master[master] == port)
 			gth->master[master] = -1;
 	spin_unlock(&gth->gth_lock);

From b2de51cac4100334c495d08e218bae28bcb03a8a Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Wed, 7 Apr 2021 17:27:16 +0800
Subject: [PATCH 1921/2658] phy: phy-twl4030-usb: Fix possible use-after-free
 in twl4030_usb_remove()

[ Upstream commit e1723d8b87b73ab363256e7ca3af3ddb75855680 ]

This driver's remove path calls cancel_delayed_work(). However, that
function does not wait until the work function finishes. This means
that the callback function may still be running after the driver's
remove function has finished, which would result in a use-after-free.

Fix by calling cancel_delayed_work_sync(), which ensures that
the work is properly cancelled, no longer running, and unable
to re-schedule itself.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20210407092716.3270248-1-yangyingliang@huawei.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/phy-twl4030-usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
index f96065a81d1e..168780eb29aa 100644
--- a/drivers/phy/phy-twl4030-usb.c
+++ b/drivers/phy/phy-twl4030-usb.c
@@ -753,7 +753,7 @@ static int twl4030_usb_remove(struct platform_device *pdev)
 
 	usb_remove_phy(&twl->phy);
 	pm_runtime_get_sync(twl->dev);
-	cancel_delayed_work(&twl->id_workaround_work);
+	cancel_delayed_work_sync(&twl->id_workaround_work);
 	device_remove_file(twl->dev, &dev_attr_vbus);
 
 	/* set transceiver mode to power on defaults */

From e4d221fb57acedae708d70d5af29a03f32f711a7 Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Fri, 12 Mar 2021 15:25:21 -0500
Subject: [PATCH 1922/2658] btrfs: convert logic BUG_ON()'s in replace_path to
 ASSERT()'s

[ Upstream commit 7a9213a93546e7eaef90e6e153af6b8fc7553f10 ]

A few BUG_ON()'s in replace_path are purely to keep us from making
logical mistakes, so replace them with ASSERT()'s.

Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/relocation.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 5681fc3976ad..628b6a046093 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1785,8 +1785,8 @@ int replace_path(struct btrfs_trans_handle *trans,
 	int ret;
 	int slot;
 
-	BUG_ON(src->root_key.objectid != BTRFS_TREE_RELOC_OBJECTID);
-	BUG_ON(dest->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID);
+	ASSERT(src->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID);
+	ASSERT(dest->root_key.objectid != BTRFS_TREE_RELOC_OBJECTID);
 
 	last_snapshot = btrfs_root_last_snapshot(&src->root_item);
 again:
@@ -1818,7 +1818,7 @@ int replace_path(struct btrfs_trans_handle *trans,
 	parent = eb;
 	while (1) {
 		level = btrfs_header_level(parent);
-		BUG_ON(level < lowest_level);
+		ASSERT(level >= lowest_level);
 
 		ret = btrfs_bin_search(parent, &key, level, &slot);
 		if (ret && slot > 0)

From 597cacbf3a7bb3046304e4509d2ad37f07c9b101 Mon Sep 17 00:00:00 2001
From: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Date: Sat, 27 Feb 2021 21:56:26 -0800
Subject: [PATCH 1923/2658] scsi: target: pscsi: Fix warning in
 pscsi_complete_cmd()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit fd48c056a32ed6e7754c7c475490f3bed54ed378 ]

This fixes a compilation warning in pscsi_complete_cmd():

     drivers/target/target_core_pscsi.c: In function ‘pscsi_complete_cmd’:
     drivers/target/target_core_pscsi.c:624:5: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body]
     ; /* XXX: TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE */

Link: https://lore.kernel.org/r/20210228055645.22253-5-chaitanya.kulkarni@wdc.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/target/target_core_pscsi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index d72a4058fd08..0ce3697ecbd7 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -629,8 +629,9 @@ static void pscsi_transport_complete(struct se_cmd *cmd, struct scatterlist *sg,
 			unsigned char *buf;
 
 			buf = transport_kmap_data_sg(cmd);
-			if (!buf)
+			if (!buf) {
 				; /* XXX: TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE */
+			}
 
 			if (cdb[0] == MODE_SENSE_10) {
 				if (!(buf[3] & 0x80))

From 3c8e6000c74077fee2ae349b8db2cdce9843e836 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Mon, 22 Feb 2021 09:08:35 +0100
Subject: [PATCH 1924/2658] media: ite-cir: check for receive overflow

[ Upstream commit 28c7afb07ccfc0a939bb06ac1e7afe669901c65a ]

It's best if this condition is reported.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/ite-cir.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c
index 63165d324fff..7d3e50d94d86 100644
--- a/drivers/media/rc/ite-cir.c
+++ b/drivers/media/rc/ite-cir.c
@@ -292,8 +292,14 @@ static irqreturn_t ite_cir_isr(int irq, void *data)
 	/* read the interrupt flags */
 	iflags = dev->params.get_irq_causes(dev);
 
+	/* Check for RX overflow */
+	if (iflags & ITE_IRQ_RX_FIFO_OVERRUN) {
+		dev_warn(&dev->rdev->dev, "receive overflow\n");
+		ir_raw_event_reset(dev->rdev);
+	}
+
 	/* check for the receive interrupt */
-	if (iflags & (ITE_IRQ_RX_FIFO | ITE_IRQ_RX_FIFO_OVERRUN)) {
+	if (iflags & ITE_IRQ_RX_FIFO) {
 		/* read the FIFO bytes */
 		rx_bytes =
 			dev->params.get_rx_bytes(dev, rx_buf,

From 751ecb2ad5dfbe8a5ebab20e6707c489f87a9f1b Mon Sep 17 00:00:00 2001
From: Daniel Niv <danielniv3@gmail.com>
Date: Thu, 11 Mar 2021 03:53:00 +0100
Subject: [PATCH 1925/2658] media: media/saa7164: fix
 saa7164_encoder_register() memory leak bugs

[ Upstream commit c759b2970c561e3b56aa030deb13db104262adfe ]

Add a fix for the memory leak bugs that can occur when the
saa7164_encoder_register() function fails.
The function allocates memory without explicitly freeing
it when errors occur.
Add a better error handling that deallocate the unused buffers before the
function exits during a fail.

Signed-off-by: Daniel Niv <danielniv3@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/saa7164/saa7164-encoder.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/drivers/media/pci/saa7164/saa7164-encoder.c b/drivers/media/pci/saa7164/saa7164-encoder.c
index 1b184c39ba97..966de363c575 100644
--- a/drivers/media/pci/saa7164/saa7164-encoder.c
+++ b/drivers/media/pci/saa7164/saa7164-encoder.c
@@ -1031,7 +1031,7 @@ int saa7164_encoder_register(struct saa7164_port *port)
 		       "(errno = %d), NO PCI configuration\n",
 			__func__, result);
 		result = -ENOMEM;
-		goto failed;
+		goto fail_pci;
 	}
 
 	/* Establish encoder defaults here */
@@ -1085,7 +1085,7 @@ int saa7164_encoder_register(struct saa7164_port *port)
 			  100000, ENCODER_DEF_BITRATE);
 	if (hdl->error) {
 		result = hdl->error;
-		goto failed;
+		goto fail_hdl;
 	}
 
 	port->std = V4L2_STD_NTSC_M;
@@ -1103,7 +1103,7 @@ int saa7164_encoder_register(struct saa7164_port *port)
 		printk(KERN_INFO "%s: can't allocate mpeg device\n",
 			dev->name);
 		result = -ENOMEM;
-		goto failed;
+		goto fail_hdl;
 	}
 
 	port->v4l_device->ctrl_handler = hdl;
@@ -1114,10 +1114,7 @@ int saa7164_encoder_register(struct saa7164_port *port)
 	if (result < 0) {
 		printk(KERN_INFO "%s: can't register mpeg device\n",
 			dev->name);
-		/* TODO: We're going to leak here if we don't dealloc
-		 The buffers above. The unreg function can't deal wit it.
-		*/
-		goto failed;
+		goto fail_reg;
 	}
 
 	printk(KERN_INFO "%s: registered device video%d [mpeg]\n",
@@ -1139,9 +1136,14 @@ int saa7164_encoder_register(struct saa7164_port *port)
 
 	saa7164_api_set_encoder(port);
 	saa7164_api_get_encoder(port);
+	return 0;
 
-	result = 0;
-failed:
+fail_reg:
+	video_device_release(port->v4l_device);
+	port->v4l_device = NULL;
+fail_hdl:
+	v4l2_ctrl_handler_free(hdl);
+fail_pci:
 	return result;
 }
 

From de27ec7afc8ad4408a66693bb7cb31bbea7ea02c Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Date: Thu, 11 Mar 2021 15:46:40 +0100
Subject: [PATCH 1926/2658] media: gspca/sq905.c: fix uninitialized variable

[ Upstream commit eaaea4681984c79d2b2b160387b297477f0c1aab ]

act_len can be uninitialized if usb_bulk_msg() returns an error.
Set it to 0 to avoid a KMSAN error.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reported-by: syzbot+a4e309017a5f3a24c7b3@syzkaller.appspotmail.com
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/gspca/sq905.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/gspca/sq905.c b/drivers/media/usb/gspca/sq905.c
index a7ae0ec9fa91..03322d2b2e82 100644
--- a/drivers/media/usb/gspca/sq905.c
+++ b/drivers/media/usb/gspca/sq905.c
@@ -172,7 +172,7 @@ static int
 sq905_read_data(struct gspca_dev *gspca_dev, u8 *data, int size, int need_lock)
 {
 	int ret;
-	int act_len;
+	int act_len = 0;
 
 	gspca_dev->usb_buf[0] = '\0';
 	if (need_lock)

From b08ed4a90d964fa1764ee94b15bf8e74e8ff1ff4 Mon Sep 17 00:00:00 2001
From: Muhammad Usama Anjum <musamaanjum@gmail.com>
Date: Wed, 24 Mar 2021 19:07:53 +0100
Subject: [PATCH 1927/2658] media: em28xx: fix memory leak

[ Upstream commit 0ae10a7dc8992ee682ff0b1752ff7c83d472eef1 ]

If some error occurs, URB buffers should also be freed. If they aren't
freed with the dvb here, the em28xx_dvb_fini call doesn't frees the URB
buffers as dvb is set to NULL. The function in which error occurs should
do all the cleanup for the allocations it had done.

Tested the patch with the reproducer provided by syzbot. This patch
fixes the memleak.

Reported-by: syzbot+889397c820fa56adf25d@syzkaller.appspotmail.com
Signed-off-by: Muhammad Usama Anjum <musamaanjum@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/em28xx/em28xx-dvb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c
index 5502a0fb94fd..a19c89009bf3 100644
--- a/drivers/media/usb/em28xx/em28xx-dvb.c
+++ b/drivers/media/usb/em28xx/em28xx-dvb.c
@@ -1757,6 +1757,7 @@ static int em28xx_dvb_init(struct em28xx *dev)
 	return result;
 
 out_free:
+	em28xx_uninit_usb_xfer(dev, EM28XX_DIGITAL_MODE);
 	kfree(dvb);
 	dev->dvb = NULL;
 	goto ret;

From 1d10fbbb3e7040a6943e084a9e5fa0a7037edd89 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Tue, 6 Apr 2021 18:01:15 +0100
Subject: [PATCH 1928/2658] clk: socfpga: arria10: Fix memory leak of
 socfpga_clk on error return

[ Upstream commit 657d4d1934f75a2d978c3cf2086495eaa542e7a9 ]

There is an error return path that is not kfree'ing socfpga_clk leading
to a memory leak. Fix this by adding in the missing kfree call.

Addresses-Coverity: ("Resource leak")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20210406170115.430990-1-colin.king@canonical.com
Acked-by: Dinh Nguyen <dinguyen@kernel.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/socfpga/clk-gate-a10.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/socfpga/clk-gate-a10.c b/drivers/clk/socfpga/clk-gate-a10.c
index 1cebf253e8fd..48e371035a63 100644
--- a/drivers/clk/socfpga/clk-gate-a10.c
+++ b/drivers/clk/socfpga/clk-gate-a10.c
@@ -158,6 +158,7 @@ static void __init __socfpga_gate_init(struct device_node *node,
 		if (IS_ERR(socfpga_clk->sys_mgr_base_addr)) {
 			pr_err("%s: failed to find altr,sys-mgr regmap!\n",
 					__func__);
+			kfree(socfpga_clk);
 			return;
 		}
 	}

From 2f206b331adeaed01529f88b7b278ab7017a6fd0 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Wed, 7 Apr 2021 17:17:06 +0800
Subject: [PATCH 1929/2658] power: supply: generic-adc-battery: fix possible
 use-after-free in gab_remove()

[ Upstream commit b6cfa007b3b229771d9588970adb4ab3e0487f49 ]

This driver's remove path calls cancel_delayed_work(). However, that
function does not wait until the work function finishes. This means
that the callback function may still be running after the driver's
remove function has finished, which would result in a use-after-free.

Fix by calling cancel_delayed_work_sync(), which ensures that
the work is properly cancelled, no longer running, and unable
to re-schedule itself.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/generic-adc-battery.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/power/generic-adc-battery.c b/drivers/power/generic-adc-battery.c
index fedc5818fab7..86289f9da85a 100644
--- a/drivers/power/generic-adc-battery.c
+++ b/drivers/power/generic-adc-battery.c
@@ -379,7 +379,7 @@ static int gab_remove(struct platform_device *pdev)
 	}
 
 	kfree(adc_bat->psy_desc.properties);
-	cancel_delayed_work(&adc_bat->bat_work);
+	cancel_delayed_work_sync(&adc_bat->bat_work);
 	return 0;
 }
 

From 185f45d31a97141e014c108728d0c30110a5479c Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Wed, 7 Apr 2021 17:19:03 +0800
Subject: [PATCH 1930/2658] power: supply: s3c_adc_battery: fix possible
 use-after-free in s3c_adc_bat_remove()

[ Upstream commit 68ae256945d2abe9036a7b68af4cc65aff79d5b7 ]

This driver's remove path calls cancel_delayed_work(). However, that
function does not wait until the work function finishes. This means
that the callback function may still be running after the driver's
remove function has finished, which would result in a use-after-free.

Fix by calling cancel_delayed_work_sync(), which ensures that
the work is properly cancelled, no longer running, and unable
to re-schedule itself.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/s3c_adc_battery.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/power/s3c_adc_battery.c b/drivers/power/s3c_adc_battery.c
index 0ffe5cd3abf6..06b412c43aa7 100644
--- a/drivers/power/s3c_adc_battery.c
+++ b/drivers/power/s3c_adc_battery.c
@@ -392,7 +392,7 @@ static int s3c_adc_bat_remove(struct platform_device *pdev)
 		gpio_free(pdata->gpio_charge_finished);
 	}
 
-	cancel_delayed_work(&bat_work);
+	cancel_delayed_work_sync(&bat_work);
 
 	if (pdata->exit)
 		pdata->exit();

From bc165a975e8bdab2f017d84b7a7df096cc7b00df Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Tue, 6 Apr 2021 15:48:12 +0200
Subject: [PATCH 1931/2658] media: i2c: adv7511-v4l2: fix possible
 use-after-free in adv7511_remove()

[ Upstream commit 2c9541720c66899adf6f3600984cf3ef151295ad ]

This driver's remove path calls cancel_delayed_work(). However, that
function does not wait until the work function finishes. This means
that the callback function may still be running after the driver's
remove function has finished, which would result in a use-after-free.

Fix by calling cancel_delayed_work_sync(), which ensures that
the work is properly cancelled, no longer running, and unable
to re-schedule itself.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/adv7511-v4l2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/adv7511-v4l2.c b/drivers/media/i2c/adv7511-v4l2.c
index b35400e4e9af..e85777dfe81d 100644
--- a/drivers/media/i2c/adv7511-v4l2.c
+++ b/drivers/media/i2c/adv7511-v4l2.c
@@ -1570,7 +1570,7 @@ static int adv7511_remove(struct i2c_client *client)
 		 client->addr << 1, client->adapter->name);
 
 	adv7511_init_setup(sd);
-	cancel_delayed_work(&state->edid_handler);
+	cancel_delayed_work_sync(&state->edid_handler);
 	i2c_unregister_device(state->i2c_edid);
 	i2c_unregister_device(state->i2c_pktmem);
 	destroy_workqueue(state->work_queue);

From 32b111fd3fabce998cebbe1094b72ba1804964f8 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Sun, 28 Mar 2021 21:32:19 +0200
Subject: [PATCH 1932/2658] media: dvb-usb: fix memory leak in
 dvb_usb_adapter_init

[ Upstream commit b7cd0da982e3043f2eec7235ac5530cb18d6af1d ]

syzbot reported memory leak in dvb-usb. The problem was
in invalid error handling in dvb_usb_adapter_init().

for (n = 0; n < d->props.num_adapters; n++) {
....
	if ((ret = dvb_usb_adapter_stream_init(adap)) ||
		(ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs)) ||
		(ret = dvb_usb_adapter_frontend_init(adap))) {
		return ret;
	}
...
	d->num_adapters_initialized++;
...
}

In case of error in dvb_usb_adapter_dvb_init() or
dvb_usb_adapter_dvb_init() d->num_adapters_initialized won't be
incremented, but dvb_usb_adapter_exit() relies on it:

	for (n = 0; n < d->num_adapters_initialized; n++)

So, allocated objects won't be freed.

Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Reported-by: syzbot+3c2be7424cea3b932b0e@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/dvb-usb/dvb-usb-init.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c
index 97a89ef7e4c1..151212168c9f 100644
--- a/drivers/media/usb/dvb-usb/dvb-usb-init.c
+++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c
@@ -82,11 +82,17 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs)
 			}
 		}
 
-		if ((ret = dvb_usb_adapter_stream_init(adap)) ||
-			(ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs)) ||
-			(ret = dvb_usb_adapter_frontend_init(adap))) {
+		ret = dvb_usb_adapter_stream_init(adap);
+		if (ret)
 			return ret;
-		}
+
+		ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs);
+		if (ret)
+			goto dvb_init_err;
+
+		ret = dvb_usb_adapter_frontend_init(adap);
+		if (ret)
+			goto frontend_init_err;
 
 		/* use exclusive FE lock if there is multiple shared FEs */
 		if (adap->fe_adap[1].fe)
@@ -106,6 +112,12 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs)
 	}
 
 	return 0;
+
+frontend_init_err:
+	dvb_usb_adapter_dvb_exit(adap);
+dvb_init_err:
+	dvb_usb_adapter_stream_exit(adap);
+	return ret;
 }
 
 static int dvb_usb_adapter_exit(struct dvb_usb_device *d)

From 574822217bac7a244cfd391b36a66fba67b0c808 Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Date: Thu, 8 Apr 2021 12:31:20 +0200
Subject: [PATCH 1933/2658] media: gscpa/stv06xx: fix memory leak

[ Upstream commit 4f4e6644cd876c844cdb3bea2dd7051787d5ae25 ]

For two of the supported sensors the stv06xx driver allocates memory which
is stored in sd->sensor_priv. This memory is freed on a disconnect, but if
the probe() fails, then it isn't freed and so this leaks memory.

Add a new probe_error() op that drivers can use to free any allocated
memory in case there was a probe failure.

Thanks to Pavel Skripkin <paskripkin@gmail.com> for discovering the cause
of the memory leak.

Reported-and-tested-by: syzbot+e7f4c64a4248a0340c37@syzkaller.appspotmail.com

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/gspca/gspca.c           | 2 ++
 drivers/media/usb/gspca/gspca.h           | 1 +
 drivers/media/usb/gspca/stv06xx/stv06xx.c | 9 +++++++++
 3 files changed, 12 insertions(+)

diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c
index 17b7b02330c9..a4f64bdb8017 100644
--- a/drivers/media/usb/gspca/gspca.c
+++ b/drivers/media/usb/gspca/gspca.c
@@ -2131,6 +2131,8 @@ int gspca_dev_probe2(struct usb_interface *intf,
 #endif
 	v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
 	v4l2_device_unregister(&gspca_dev->v4l2_dev);
+	if (sd_desc->probe_error)
+		sd_desc->probe_error(gspca_dev);
 	kfree(gspca_dev->usb_buf);
 	kfree(gspca_dev);
 	return ret;
diff --git a/drivers/media/usb/gspca/gspca.h b/drivers/media/usb/gspca/gspca.h
index d39adf90303b..bec8fccc2c94 100644
--- a/drivers/media/usb/gspca/gspca.h
+++ b/drivers/media/usb/gspca/gspca.h
@@ -101,6 +101,7 @@ struct sd_desc {
 	cam_cf_op config;	/* called on probe */
 	cam_op init;		/* called on probe and resume */
 	cam_op init_controls;	/* called on probe */
+	cam_v_op probe_error;	/* called if probe failed, do cleanup here */
 	cam_op start;		/* called on stream on after URBs creation */
 	cam_pkt_op pkt_scan;
 /* optional operations */
diff --git a/drivers/media/usb/gspca/stv06xx/stv06xx.c b/drivers/media/usb/gspca/stv06xx/stv06xx.c
index 7d255529ed4c..40d4c99debb8 100644
--- a/drivers/media/usb/gspca/stv06xx/stv06xx.c
+++ b/drivers/media/usb/gspca/stv06xx/stv06xx.c
@@ -541,12 +541,21 @@ static int sd_int_pkt_scan(struct gspca_dev *gspca_dev,
 static int stv06xx_config(struct gspca_dev *gspca_dev,
 			  const struct usb_device_id *id);
 
+static void stv06xx_probe_error(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *)gspca_dev;
+
+	kfree(sd->sensor_priv);
+	sd->sensor_priv = NULL;
+}
+
 /* sub-driver description */
 static const struct sd_desc sd_desc = {
 	.name = MODULE_NAME,
 	.config = stv06xx_config,
 	.init = stv06xx_init,
 	.init_controls = stv06xx_init_controls,
+	.probe_error = stv06xx_probe_error,
 	.start = stv06xx_start,
 	.stopN = stv06xx_stopN,
 	.pkt_scan = stv06xx_pkt_scan,

From 9dbb98e0ac1db260b750b61538058a794c9ccf77 Mon Sep 17 00:00:00 2001
From: Marijn Suijten <marijn.suijten@somainline.org>
Date: Tue, 6 Apr 2021 23:47:24 +0200
Subject: [PATCH 1934/2658] drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double
 the vtotal

[ Upstream commit 2ad52bdb220de5ab348098e3482b01235d15a842 ]

Leaving this at a close-to-maximum register value 0xFFF0 means it takes
very long for the MDSS to generate a software vsync interrupt when the
hardware TE interrupt doesn't arrive.  Configuring this to double the
vtotal (like some downstream kernels) leads to a frame to take at most
twice before the vsync signal, until hardware TE comes up.

In this case the hardware interrupt responsible for providing this
signal - "disp-te" gpio - is not hooked up to the mdp5 vsync/pp logic at
all.  This solves severe panel update issues observed on at least the
Xperia Loire and Tone series, until said gpio is properly hooked up to
an irq.

Suggested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
Link: https://lore.kernel.org/r/20210406214726.131534-2-marijn.suijten@somainline.org
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/mdp/mdp5/mdp5_cmd_encoder.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cmd_encoder.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cmd_encoder.c
index 8e6c9b598a57..d8c7b8a6a418 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cmd_encoder.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cmd_encoder.c
@@ -128,9 +128,17 @@ static int pingpong_tearcheck_setup(struct drm_encoder *encoder,
 		| MDP5_PP_SYNC_CONFIG_VSYNC_IN_EN;
 	cfg |= MDP5_PP_SYNC_CONFIG_VSYNC_COUNT(vclks_line);
 
+	/*
+	 * Tearcheck emits a blanking signal every vclks_line * vtotal * 2 ticks on
+	 * the vsync_clk equating to roughly half the desired panel refresh rate.
+	 * This is only necessary as stability fallback if interrupts from the
+	 * panel arrive too late or not at all, but is currently used by default
+	 * because these panel interrupts are not wired up yet.
+	 */
 	mdp5_write(mdp5_kms, REG_MDP5_PP_SYNC_CONFIG_VSYNC(pp_id), cfg);
 	mdp5_write(mdp5_kms,
-		REG_MDP5_PP_SYNC_CONFIG_HEIGHT(pp_id), 0xfff0);
+		REG_MDP5_PP_SYNC_CONFIG_HEIGHT(pp_id), (2 * mode->vtotal));
+
 	mdp5_write(mdp5_kms,
 		REG_MDP5_PP_VSYNC_INIT_VAL(pp_id), mode->vdisplay);
 	mdp5_write(mdp5_kms, REG_MDP5_PP_RD_PTR_IRQ(pp_id), mode->vdisplay + 1);

From 42b8a1c90ea2bca7512883bbce47b12bf5048571 Mon Sep 17 00:00:00 2001
From: Guchun Chen <guchun.chen@amd.com>
Date: Tue, 30 Mar 2021 17:52:18 +0800
Subject: [PATCH 1935/2658] drm/amdgpu: fix NULL pointer dereference
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 3c3dc654333f6389803cdcaf03912e94173ae510 ]

ttm->sg needs to be checked before accessing its child member.

Call Trace:
 amdgpu_ttm_backend_destroy+0x12/0x70 [amdgpu]
 ttm_bo_cleanup_memtype_use+0x3a/0x60 [ttm]
 ttm_bo_release+0x17d/0x300 [ttm]
 amdgpu_bo_unref+0x1a/0x30 [amdgpu]
 amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x78b/0x8b0 [amdgpu]
 kfd_ioctl_alloc_memory_of_gpu+0x118/0x220 [amdgpu]
 kfd_ioctl+0x222/0x400 [amdgpu]
 ? kfd_dev_is_large_bar+0x90/0x90 [amdgpu]
 __x64_sys_ioctl+0x8e/0xd0
 ? __context_tracking_exit+0x52/0x90
 do_syscall_64+0x33/0x80
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f97f264d317
Code: b3 66 90 48 8b 05 71 4b 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 41 4b 2d 00 f7 d8 64 89 01 48
RSP: 002b:00007ffdb402c338 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f97f3cc63a0 RCX: 00007f97f264d317
RDX: 00007ffdb402c380 RSI: 00000000c0284b16 RDI: 0000000000000003
RBP: 00007ffdb402c380 R08: 00007ffdb402c428 R09: 00000000c4000004
R10: 00000000c4000004 R11: 0000000000000246 R12: 00000000c0284b16
R13: 0000000000000003 R14: 00007f97f3cc63a0 R15: 00007f8836200000

Signed-off-by: Guchun Chen <guchun.chen@amd.com>
Acked-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index 062c23125b2a..6beb3e76e1c9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -566,7 +566,7 @@ static void amdgpu_ttm_tt_unpin_userptr(struct ttm_tt *ttm)
 		DMA_BIDIRECTIONAL : DMA_TO_DEVICE;
 
 	/* double check that we don't free the table twice */
-	if (!ttm->sg->sgl)
+	if (!ttm->sg || !ttm->sg->sgl)
 		return;
 
 	/* free the sg table and pages again */

From 67b677a84dcc52c29381a518c94c2595efe769b0 Mon Sep 17 00:00:00 2001
From: James Smart <jsmart2021@gmail.com>
Date: Sun, 11 Apr 2021 18:31:13 -0700
Subject: [PATCH 1936/2658] scsi: lpfc: Fix crash when a REG_RPI mailbox fails
 triggering a LOGO response

[ Upstream commit fffd18ec6579c2d9c72b212169259062fe747888 ]

Fix a crash caused by a double put on the node when the driver completed an
ACC for an unsolicted abort on the same node.  The second put was executed
by lpfc_nlp_not_used() and is wrong because the completion routine executes
the nlp_put when the iocbq was released.  Additionally, the driver is
issuing a LOGO then immediately calls lpfc_nlp_set_state to put the node
into NPR.  This call does nothing.

Remove the lpfc_nlp_not_used call and additional set_state in the
completion routine.  Remove the lpfc_nlp_set_state post issue_logo.  Isn't
necessary.

Link: https://lore.kernel.org/r/20210412013127.2387-3-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/lpfc/lpfc_nportdisc.c | 2 --
 drivers/scsi/lpfc/lpfc_sli.c       | 1 -
 2 files changed, 3 deletions(-)

diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index 6aa0698925da..1a44102b43c3 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -1604,8 +1604,6 @@ lpfc_cmpl_reglogin_reglogin_issue(struct lpfc_vport *vport,
 		ndlp->nlp_last_elscmd = ELS_CMD_PLOGI;
 
 		lpfc_issue_els_logo(vport, ndlp, 0);
-		ndlp->nlp_prev_state = NLP_STE_REG_LOGIN_ISSUE;
-		lpfc_nlp_set_state(vport, ndlp, NLP_STE_NPR_NODE);
 		return ndlp->nlp_state;
 	}
 
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 97c0d79a2601..9055a8fce3d4 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -15049,7 +15049,6 @@ lpfc_sli4_seq_abort_rsp_cmpl(struct lpfc_hba *phba,
 	if (cmd_iocbq) {
 		ndlp = (struct lpfc_nodelist *)cmd_iocbq->context1;
 		lpfc_nlp_put(ndlp);
-		lpfc_nlp_not_used(ndlp);
 		lpfc_sli_release_iocbq(phba, cmd_iocbq);
 	}
 

From 9127dabd9ded16764433ccf9bb6799a3024a5335 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Thu, 15 Apr 2021 15:08:13 -0700
Subject: [PATCH 1937/2658] scsi: libfc: Fix a format specifier

[ Upstream commit 90d6697810f06aceea9de71ad836a8c7669789cd ]

Since the 'mfs' member has been declared as 'u32' in include/scsi/libfc.h,
use the %u format specifier instead of %hu. This patch fixes the following
clang compiler warning:

warning: format specifies type
      'unsigned short' but the argument has type 'u32' (aka 'unsigned int')
      [-Wformat]
                             "lport->mfs:%hu\n", mfs, lport->mfs);
                                         ~~~          ^~~~~~~~~~
                                         %u

Link: https://lore.kernel.org/r/20210415220826.29438-8-bvanassche@acm.org
Cc: Hannes Reinecke <hare@suse.de>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/libfc/fc_lport.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
index 867fc036d6ef..815d224b9ff8 100644
--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -1754,7 +1754,7 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
 
 	if (mfs < FC_SP_MIN_MAX_PAYLOAD || mfs > FC_SP_MAX_MAX_PAYLOAD) {
 		FC_LPORT_DBG(lport, "FLOGI bad mfs:%hu response, "
-			     "lport->mfs:%hu\n", mfs, lport->mfs);
+			     "lport->mfs:%u\n", mfs, lport->mfs);
 		fc_lport_error(lport, fp);
 		goto out;
 	}

From 6b18178a9de10f2cf4685e1b3992d9c95c43aef7 Mon Sep 17 00:00:00 2001
From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Date: Mon, 26 Apr 2021 06:11:29 -0700
Subject: [PATCH 1938/2658] ALSA: emu8000: Fix a use after free in
 snd_emu8000_create_mixer

commit 1c98f574403dbcf2eb832d5535a10d967333ef2d upstream.

Our code analyzer reported a uaf.

In snd_emu8000_create_mixer, the callee snd_ctl_add(..,emu->controls[i])
calls snd_ctl_add_replace(.., kcontrol,..). Inside snd_ctl_add_replace(),
if error happens, kcontrol will be freed by snd_ctl_free_one(kcontrol).
Then emu->controls[i] points to a freed memory, and the execution comes
to __error branch of snd_emu8000_create_mixer. The freed emu->controls[i]
is used in snd_ctl_remove(card, emu->controls[i]).

My patch set emu->controls[i] to NULL if snd_ctl_add() failed to avoid
the uaf.

Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210426131129.4796-1-lyl2019@mail.ustc.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/isa/sb/emu8000.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/isa/sb/emu8000.c b/sound/isa/sb/emu8000.c
index 94c411299e5a..470058e89fef 100644
--- a/sound/isa/sb/emu8000.c
+++ b/sound/isa/sb/emu8000.c
@@ -1042,8 +1042,10 @@ snd_emu8000_create_mixer(struct snd_card *card, struct snd_emu8000 *emu)
 
 	memset(emu->controls, 0, sizeof(emu->controls));
 	for (i = 0; i < EMU8000_NUM_CONTROLS; i++) {
-		if ((err = snd_ctl_add(card, emu->controls[i] = snd_ctl_new1(mixer_defs[i], emu))) < 0)
+		if ((err = snd_ctl_add(card, emu->controls[i] = snd_ctl_new1(mixer_defs[i], emu))) < 0) {
+			emu->controls[i] = NULL;
 			goto __error;
+		}
 	}
 	return 0;
 

From 904ec2e81a9b984cb712b469ca2a752cfdeb5956 Mon Sep 17 00:00:00 2001
From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Date: Mon, 26 Apr 2021 07:55:41 -0700
Subject: [PATCH 1939/2658] ALSA: sb: Fix two use after free in
 snd_sb_qsound_build

commit 4fb44dd2c1dda18606348acdfdb97e8759dde9df upstream.

In snd_sb_qsound_build, snd_ctl_add(..,p->qsound_switch...) and
snd_ctl_add(..,p->qsound_space..) are called. But the second
arguments of snd_ctl_add() could be freed via snd_ctl_add_replace()
->snd_ctl_free_one(). After the error code is returned,
snd_sb_qsound_destroy(p) is called in __error branch.

But in snd_sb_qsound_destroy(), the freed p->qsound_switch and
p->qsound_space are still used by snd_ctl_remove().

My patch set p->qsound_switch and p->qsound_space to NULL if
snd_ctl_add() failed to avoid the uaf bugs. But these codes need
to further be improved with the code style.

Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210426145541.8070-1-lyl2019@mail.ustc.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/isa/sb/sb16_csp.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c
index 48da2276683d..2cc068be7d3b 100644
--- a/sound/isa/sb/sb16_csp.c
+++ b/sound/isa/sb/sb16_csp.c
@@ -1059,10 +1059,14 @@ static int snd_sb_qsound_build(struct snd_sb_csp * p)
 
 	spin_lock_init(&p->q_lock);
 
-	if ((err = snd_ctl_add(card, p->qsound_switch = snd_ctl_new1(&snd_sb_qsound_switch, p))) < 0)
+	if ((err = snd_ctl_add(card, p->qsound_switch = snd_ctl_new1(&snd_sb_qsound_switch, p))) < 0) {
+		p->qsound_switch = NULL;
 		goto __error;
-	if ((err = snd_ctl_add(card, p->qsound_space = snd_ctl_new1(&snd_sb_qsound_space, p))) < 0)
+	}
+	if ((err = snd_ctl_add(card, p->qsound_space = snd_ctl_new1(&snd_sb_qsound_space, p))) < 0) {
+		p->qsound_space = NULL;
 		goto __error;
+	}
 
 	return 0;
 

From 4da571a7a14a9785aac8cb8ca54b4378bf811e7e Mon Sep 17 00:00:00 2001
From: Bill Wendling <morbo@google.com>
Date: Fri, 23 Apr 2021 13:51:59 -0700
Subject: [PATCH 1940/2658] arm64/vdso: Discard .note.gnu.property sections in
 vDSO

[ Upstream commit 388708028e6937f3fc5fc19aeeb847f8970f489c ]

The arm64 assembler in binutils 2.32 and above generates a program
property note in a note section, .note.gnu.property, to encode used x86
ISAs and features. But the kernel linker script only contains a single
NOTE segment:

  PHDRS
  {
    text    PT_LOAD    FLAGS(5) FILEHDR PHDRS; /* PF_R|PF_X */
    dynamic PT_DYNAMIC FLAGS(4);               /* PF_R */
    note    PT_NOTE    FLAGS(4);               /* PF_R */
  }

The NOTE segment generated by the vDSO linker script is aligned to 4 bytes.
But the .note.gnu.property section must be aligned to 8 bytes on arm64.

  $ readelf -n vdso64.so

  Displaying notes found in: .note
    Owner                Data size      Description
    Linux                0x00000004     Unknown note type: (0x00000000)
     description data: 06 00 00 00
  readelf: Warning: note with invalid namesz and/or descsz found at offset 0x20
  readelf: Warning:  type: 0x78, namesize: 0x00000100, descsize: 0x756e694c, alignment: 8

Since the note.gnu.property section in the vDSO is not checked by the
dynamic linker, discard the .note.gnu.property sections in the vDSO.

Similar to commit 4caffe6a28d31 ("x86/vdso: Discard .note.gnu.property
sections in vDSO"), but for arm64.

Signed-off-by: Bill Wendling <morbo@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20210423205159.830854-1-morbo@google.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/vdso/vdso.lds.S | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/vdso/vdso.lds.S b/arch/arm64/kernel/vdso/vdso.lds.S
index beca249bc2f3..b3e6c4d5b75c 100644
--- a/arch/arm64/kernel/vdso/vdso.lds.S
+++ b/arch/arm64/kernel/vdso/vdso.lds.S
@@ -39,6 +39,13 @@ SECTIONS
 	.gnu.version_d	: { *(.gnu.version_d) }
 	.gnu.version_r	: { *(.gnu.version_r) }
 
+	/*
+	 * Discard .note.gnu.property sections which are unused and have
+	 * different alignment requirement from vDSO note sections.
+	 */
+	/DISCARD/	: {
+		*(.note.GNU-stack .note.gnu.property)
+	}
 	.note		: { *(.note.*) }		:text	:note
 
 	. = ALIGN(16);
@@ -59,7 +66,6 @@ SECTIONS
 	PROVIDE(end = .);
 
 	/DISCARD/	: {
-		*(.note.GNU-stack)
 		*(.data .data.* .gnu.linkonce.d.* .sdata*)
 		*(.bss .sbss .dynbss .dynsbss)
 	}

From 733ca88932db15819d3aaac3b849d576494e4f93 Mon Sep 17 00:00:00 2001
From: Davide Caratti <dcaratti@redhat.com>
Date: Wed, 28 Apr 2021 15:23:07 +0200
Subject: [PATCH 1941/2658] openvswitch: fix stack OOB read while fragmenting
 IPv4 packets

commit 7c0ea5930c1c211931819d83cfb157bff1539a4c upstream.

running openvswitch on kernels built with KASAN, it's possible to see the
following splat while testing fragmentation of IPv4 packets:

 BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60
 Read of size 1 at addr ffff888112fc713c by task handler2/1367

 CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+ #418
 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014
 Call Trace:
  dump_stack+0x92/0xc1
  print_address_description.constprop.7+0x1a/0x150
  kasan_report.cold.13+0x7f/0x111
  ip_do_fragment+0x1b03/0x1f60
  ovs_fragment+0x5bf/0x840 [openvswitch]
  do_execute_actions+0x1bd5/0x2400 [openvswitch]
  ovs_execute_actions+0xc8/0x3d0 [openvswitch]
  ovs_packet_cmd_execute+0xa39/0x1150 [openvswitch]
  genl_family_rcv_msg_doit.isra.15+0x227/0x2d0
  genl_rcv_msg+0x287/0x490
  netlink_rcv_skb+0x120/0x380
  genl_rcv+0x24/0x40
  netlink_unicast+0x439/0x630
  netlink_sendmsg+0x719/0xbf0
  sock_sendmsg+0xe2/0x110
  ____sys_sendmsg+0x5ba/0x890
  ___sys_sendmsg+0xe9/0x160
  __sys_sendmsg+0xd3/0x170
  do_syscall_64+0x33/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xae
 RIP: 0033:0x7f957079db07
 Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 eb ec ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 24 ed ff ff 48
 RSP: 002b:00007f956ce35a50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e
 RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 00007f957079db07
 RDX: 0000000000000000 RSI: 00007f956ce35ae0 RDI: 0000000000000019
 RBP: 00007f956ce35ae0 R08: 0000000000000000 R09: 00007f9558006730
 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
 R13: 00007f956ce37308 R14: 00007f956ce35f80 R15: 00007f956ce35ae0

 The buggy address belongs to the page:
 page:00000000af2a1d93 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112fc7
 flags: 0x17ffffc0000000()
 raw: 0017ffffc0000000 0000000000000000 dead000000000122 0000000000000000
 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
 page dumped because: kasan: bad access detected

 addr ffff888112fc713c is located in stack of task handler2/1367 at offset 180 in frame:
  ovs_fragment+0x0/0x840 [openvswitch]

 this frame has 2 objects:
  [32, 144) 'ovs_dst'
  [192, 424) 'ovs_rt'

 Memory state around the buggy address:
  ffff888112fc7000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ffff888112fc7080: 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00
 >ffff888112fc7100: 00 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00
                                         ^
  ffff888112fc7180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ffff888112fc7200: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00

for IPv4 packets, ovs_fragment() uses a temporary struct dst_entry. Then,
in the following call graph:

  ip_do_fragment()
    ip_skb_dst_mtu()
      ip_dst_mtu_maybe_forward()
        ip_mtu_locked()

the pointer to struct dst_entry is used as pointer to struct rtable: this
turns the access to struct members like rt_mtu_locked into an OOB read in
the stack. Fix this changing the temporary variable used for IPv4 packets
in ovs_fragment(), similarly to what is done for IPv6 few lines below.

Fixes: d52e5a7e7ca4 ("ipv4: lock mtu in fnhe when received PMTU < net.ipv4.route.min_pmt")
Cc: <stable@vger.kernel.org>
Acked-by: Eelco Chaudron <echaudro@redhat.com>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/openvswitch/actions.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 828fdced4ecd..b8f2ee52e64e 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -694,16 +694,16 @@ static void ovs_fragment(struct net *net, struct vport *vport,
 	}
 
 	if (ethertype == htons(ETH_P_IP)) {
-		struct dst_entry ovs_dst;
+		struct rtable ovs_rt = { 0 };
 		unsigned long orig_dst;
 
 		prepare_frag(vport, skb);
-		dst_init(&ovs_dst, &ovs_dst_ops, NULL, 1,
+		dst_init(&ovs_rt.dst, &ovs_dst_ops, NULL, 1,
 			 DST_OBSOLETE_NONE, DST_NOCOUNT);
-		ovs_dst.dev = vport->dev;
+		ovs_rt.dst.dev = vport->dev;
 
 		orig_dst = skb->_skb_refdst;
-		skb_dst_set_noref(skb, &ovs_dst);
+		skb_dst_set_noref(skb, &ovs_rt.dst);
 		IPCB(skb)->frag_max_size = mru;
 
 		ip_do_fragment(net, skb->sk, skb, ovs_vport_output);

From 2954258555d5defbfc0296aaeb5206f5c4618526 Mon Sep 17 00:00:00 2001
From: lizhe <lizhe67@huawei.com>
Date: Thu, 18 Mar 2021 11:06:57 +0800
Subject: [PATCH 1942/2658] jffs2: Fix kasan slab-out-of-bounds problem

commit 960b9a8a7676b9054d8b46a2c7db52a0c8766b56 upstream.

KASAN report a slab-out-of-bounds problem. The logs are listed below.
It is because in function jffs2_scan_dirent_node, we alloc "checkedlen+1"
bytes for fd->name and we check crc with length rd->nsize. If checkedlen
is less than rd->nsize, it will cause the slab-out-of-bounds problem.

jffs2: Dirent at *** has zeroes in name. Truncating to %d char
==================================================================
BUG: KASAN: slab-out-of-bounds in crc32_le+0x1ce/0x260 at addr ffff8800842cf2d1
Read of size 1 by task test_JFFS2/915
=============================================================================
BUG kmalloc-64 (Tainted: G    B      O   ): kasan: bad access detected
-----------------------------------------------------------------------------
INFO: Allocated in jffs2_alloc_full_dirent+0x2a/0x40 age=0 cpu=1 pid=915
	___slab_alloc+0x580/0x5f0
	__slab_alloc.isra.24+0x4e/0x64
	__kmalloc+0x170/0x300
	jffs2_alloc_full_dirent+0x2a/0x40
	jffs2_scan_eraseblock+0x1ca4/0x3b64
	jffs2_scan_medium+0x285/0xfe0
	jffs2_do_mount_fs+0x5fb/0x1bbc
	jffs2_do_fill_super+0x245/0x6f0
	jffs2_fill_super+0x287/0x2e0
	mount_mtd_aux.isra.0+0x9a/0x144
	mount_mtd+0x222/0x2f0
	jffs2_mount+0x41/0x60
	mount_fs+0x63/0x230
	vfs_kern_mount.part.6+0x6c/0x1f4
	do_mount+0xae8/0x1940
	SyS_mount+0x105/0x1d0
INFO: Freed in jffs2_free_full_dirent+0x22/0x40 age=27 cpu=1 pid=915
	__slab_free+0x372/0x4e4
	kfree+0x1d4/0x20c
	jffs2_free_full_dirent+0x22/0x40
	jffs2_build_remove_unlinked_inode+0x17a/0x1e4
	jffs2_do_mount_fs+0x1646/0x1bbc
	jffs2_do_fill_super+0x245/0x6f0
	jffs2_fill_super+0x287/0x2e0
	mount_mtd_aux.isra.0+0x9a/0x144
	mount_mtd+0x222/0x2f0
	jffs2_mount+0x41/0x60
	mount_fs+0x63/0x230
	vfs_kern_mount.part.6+0x6c/0x1f4
	do_mount+0xae8/0x1940
	SyS_mount+0x105/0x1d0
	entry_SYSCALL_64_fastpath+0x1e/0x97
Call Trace:
 [<ffffffff815befef>] dump_stack+0x59/0x7e
 [<ffffffff812d1d65>] print_trailer+0x125/0x1b0
 [<ffffffff812d82c8>] object_err+0x34/0x40
 [<ffffffff812dadef>] kasan_report.part.1+0x21f/0x534
 [<ffffffff81132401>] ? vprintk+0x2d/0x40
 [<ffffffff815f1ee2>] ? crc32_le+0x1ce/0x260
 [<ffffffff812db41a>] kasan_report+0x26/0x30
 [<ffffffff812d9fc1>] __asan_load1+0x3d/0x50
 [<ffffffff815f1ee2>] crc32_le+0x1ce/0x260
 [<ffffffff814764ae>] ? jffs2_alloc_full_dirent+0x2a/0x40
 [<ffffffff81485cec>] jffs2_scan_eraseblock+0x1d0c/0x3b64
 [<ffffffff81488813>] ? jffs2_scan_medium+0xccf/0xfe0
 [<ffffffff81483fe0>] ? jffs2_scan_make_ino_cache+0x14c/0x14c
 [<ffffffff812da3e9>] ? kasan_unpoison_shadow+0x35/0x50
 [<ffffffff812da3e9>] ? kasan_unpoison_shadow+0x35/0x50
 [<ffffffff812da462>] ? kasan_kmalloc+0x5e/0x70
 [<ffffffff812d5d90>] ? kmem_cache_alloc_trace+0x10c/0x2cc
 [<ffffffff818169fb>] ? mtd_point+0xf7/0x130
 [<ffffffff81487dc9>] jffs2_scan_medium+0x285/0xfe0
 [<ffffffff81487b44>] ? jffs2_scan_eraseblock+0x3b64/0x3b64
 [<ffffffff812da3e9>] ? kasan_unpoison_shadow+0x35/0x50
 [<ffffffff812da3e9>] ? kasan_unpoison_shadow+0x35/0x50
 [<ffffffff812da462>] ? kasan_kmalloc+0x5e/0x70
 [<ffffffff812d57df>] ? __kmalloc+0x12b/0x300
 [<ffffffff812da462>] ? kasan_kmalloc+0x5e/0x70
 [<ffffffff814a2753>] ? jffs2_sum_init+0x9f/0x240
 [<ffffffff8148b2ff>] jffs2_do_mount_fs+0x5fb/0x1bbc
 [<ffffffff8148ad04>] ? jffs2_del_noinode_dirent+0x640/0x640
 [<ffffffff812da462>] ? kasan_kmalloc+0x5e/0x70
 [<ffffffff81127c5b>] ? __init_rwsem+0x97/0xac
 [<ffffffff81492349>] jffs2_do_fill_super+0x245/0x6f0
 [<ffffffff81493c5b>] jffs2_fill_super+0x287/0x2e0
 [<ffffffff814939d4>] ? jffs2_parse_options+0x594/0x594
 [<ffffffff81819bea>] mount_mtd_aux.isra.0+0x9a/0x144
 [<ffffffff81819eb6>] mount_mtd+0x222/0x2f0
 [<ffffffff814939d4>] ? jffs2_parse_options+0x594/0x594
 [<ffffffff81819c94>] ? mount_mtd_aux.isra.0+0x144/0x144
 [<ffffffff81258757>] ? free_pages+0x13/0x1c
 [<ffffffff814fa0ac>] ? selinux_sb_copy_data+0x278/0x2e0
 [<ffffffff81492b35>] jffs2_mount+0x41/0x60
 [<ffffffff81302fb7>] mount_fs+0x63/0x230
 [<ffffffff8133755f>] ? alloc_vfsmnt+0x32f/0x3b0
 [<ffffffff81337f2c>] vfs_kern_mount.part.6+0x6c/0x1f4
 [<ffffffff8133ceec>] do_mount+0xae8/0x1940
 [<ffffffff811b94e0>] ? audit_filter_rules.constprop.6+0x1d10/0x1d10
 [<ffffffff8133c404>] ? copy_mount_string+0x40/0x40
 [<ffffffff812cbf78>] ? alloc_pages_current+0xa4/0x1bc
 [<ffffffff81253a89>] ? __get_free_pages+0x25/0x50
 [<ffffffff81338993>] ? copy_mount_options.part.17+0x183/0x264
 [<ffffffff8133e3a9>] SyS_mount+0x105/0x1d0
 [<ffffffff8133e2a4>] ? copy_mnt_ns+0x560/0x560
 [<ffffffff810e8391>] ? msa_space_switch_handler+0x13d/0x190
 [<ffffffff81be184a>] entry_SYSCALL_64_fastpath+0x1e/0x97
 [<ffffffff810e9274>] ? msa_space_switch+0xb0/0xe0
Memory state around the buggy address:
 ffff8800842cf180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8800842cf200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8800842cf280: fc fc fc fc fc fc 00 00 00 00 01 fc fc fc fc fc
                                                 ^
 ffff8800842cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8800842cf380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Cc: stable@vger.kernel.org
Reported-by: Kunkun Xu <xukunkun1@huawei.com>
Signed-off-by: lizhe <lizhe67@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/jffs2/scan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c
index 9ad5ba4b299b..5f90173ae38d 100644
--- a/fs/jffs2/scan.c
+++ b/fs/jffs2/scan.c
@@ -1075,7 +1075,7 @@ static int jffs2_scan_dirent_node(struct jffs2_sb_info *c, struct jffs2_eraseblo
 	memcpy(&fd->name, rd->name, checkedlen);
 	fd->name[checkedlen] = 0;
 
-	crc = crc32(0, fd->name, rd->nsize);
+	crc = crc32(0, fd->name, checkedlen);
 	if (crc != je32_to_cpu(rd->name_crc)) {
 		pr_notice("%s(): Name CRC failed on node at 0x%08x: Read 0x%08x, calculated 0x%08x\n",
 			  __func__, ofs, je32_to_cpu(rd->name_crc), crc);

From 7ab2831ce04316e07722b6a27179ad74f7e53db6 Mon Sep 17 00:00:00 2001
From: Mahesh Salgaonkar <mahesh@linux.ibm.com>
Date: Mon, 12 Apr 2021 13:22:50 +0530
Subject: [PATCH 1943/2658] powerpc/eeh: Fix EEH handling for hugepages in
 ioremap space.

commit 5ae5bc12d0728db60a0aa9b62160ffc038875f1a upstream.

During the EEH MMIO error checking, the current implementation fails to map
the (virtual) MMIO address back to the pci device on radix with hugepage
mappings for I/O. This results into failure to dispatch EEH event with no
recovery even when EEH capability has been enabled on the device.

eeh_check_failure(token)		# token = virtual MMIO address
  addr = eeh_token_to_phys(token);
  edev = eeh_addr_cache_get_dev(addr);
  if (!edev)
	return 0;
  eeh_dev_check_failure(edev);	<= Dispatch the EEH event

In case of hugepage mappings, eeh_token_to_phys() has a bug in virt -> phys
translation that results in wrong physical address, which is then passed to
eeh_addr_cache_get_dev() to match it against cached pci I/O address ranges
to get to a PCI device. Hence, it fails to find a match and the EEH event
never gets dispatched leaving the device in failed state.

The commit 33439620680be ("powerpc/eeh: Handle hugepages in ioremap space")
introduced following logic to translate virt to phys for hugepage mappings:

eeh_token_to_phys():
+	pa = pte_pfn(*ptep);
+
+	/* On radix we can do hugepage mappings for io, so handle that */
+       if (hugepage_shift) {
+               pa <<= hugepage_shift;			<= This is wrong
+               pa |= token & ((1ul << hugepage_shift) - 1);
+       }

This patch fixes the virt -> phys translation in eeh_token_to_phys()
function.

  $ cat /sys/kernel/debug/powerpc/eeh_address_cache
  mem addr range [0x0000040080000000-0x00000400807fffff]: 0030:01:00.1
  mem addr range [0x0000040080800000-0x0000040080ffffff]: 0030:01:00.1
  mem addr range [0x0000040081000000-0x00000400817fffff]: 0030:01:00.0
  mem addr range [0x0000040081800000-0x0000040081ffffff]: 0030:01:00.0
  mem addr range [0x0000040082000000-0x000004008207ffff]: 0030:01:00.1
  mem addr range [0x0000040082080000-0x00000400820fffff]: 0030:01:00.0
  mem addr range [0x0000040082100000-0x000004008210ffff]: 0030:01:00.1
  mem addr range [0x0000040082110000-0x000004008211ffff]: 0030:01:00.0

Above is the list of cached io address ranges of pci 0030:01:00.<fn>.

Before this patch:

Tracing 'arg1' of function eeh_addr_cache_get_dev() during error injection
clearly shows that 'addr=' contains wrong physical address:

   kworker/u16:0-7       [001] ....   108.883775: eeh_addr_cache_get_dev:
	   (eeh_addr_cache_get_dev+0xc/0xf0) addr=0x80103000a510

dmesg shows no EEH recovery messages:

  [  108.563768] bnx2x: [bnx2x_timer:5801(eth2)]MFW seems hanged: drv_pulse (0x9ae) != mcp_pulse (0x7fff)
  [  108.563788] bnx2x: [bnx2x_hw_stats_update:870(eth2)]NIG timer max (4294967295)
  [  108.883788] bnx2x: [bnx2x_acquire_hw_lock:2013(eth1)]lock_status 0xffffffff  resource_bit 0x1
  [  108.884407] bnx2x 0030:01:00.0 eth1: MDC/MDIO access timeout
  [  108.884976] bnx2x 0030:01:00.0 eth1: MDC/MDIO access timeout
  <..>

After this patch:

eeh_addr_cache_get_dev() trace shows correct physical address:

  <idle>-0       [001] ..s.  1043.123828: eeh_addr_cache_get_dev:
	  (eeh_addr_cache_get_dev+0xc/0xf0) addr=0x40080bc7cd8

dmesg logs shows EEH recovery getting triggerred:

  [  964.323980] bnx2x: [bnx2x_timer:5801(eth2)]MFW seems hanged: drv_pulse (0x746f) != mcp_pulse (0x7fff)
  [  964.323991] EEH: Recovering PHB#30-PE#10000
  [  964.324002] EEH: PE location: N/A, PHB location: N/A
  [  964.324006] EEH: Frozen PHB#30-PE#10000 detected
  <..>

Fixes: 33439620680b ("powerpc/eeh: Handle hugepages in ioremap space")
Cc: stable@vger.kernel.org # v5.3+
Reported-by: Dominic DeMarco <ddemarc@us.ibm.com>
Signed-off-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/161821396263.48361.2796709239866588652.stgit@jupiter
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kernel/eeh.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
index 16193d7b0635..3c7fe1158020 100644
--- a/arch/powerpc/kernel/eeh.c
+++ b/arch/powerpc/kernel/eeh.c
@@ -367,14 +367,11 @@ static inline unsigned long eeh_token_to_phys(unsigned long token)
 	pa = pte_pfn(*ptep);
 
 	/* On radix we can do hugepage mappings for io, so handle that */
-	if (hugepage_shift) {
-		pa <<= hugepage_shift;
-		pa |= token & ((1ul << hugepage_shift) - 1);
-	} else {
-		pa <<= PAGE_SHIFT;
-		pa |= token & (PAGE_SIZE - 1);
-	}
+	if (!hugepage_shift)
+		hugepage_shift = PAGE_SHIFT;
 
+	pa <<= PAGE_SHIFT;
+	pa |= token & ((1ul << hugepage_shift) - 1);
 	return pa;
 }
 

From cf4e34334ecc3328a52ea9bcfecefb6d2ee7e1f5 Mon Sep 17 00:00:00 2001
From: Tony Ambardar <tony.ambardar@gmail.com>
Date: Thu, 17 Sep 2020 06:54:37 -0700
Subject: [PATCH 1944/2658] powerpc: fix EDEADLOCK redefinition error in
 uapi/asm/errno.h

commit 7de21e679e6a789f3729e8402bc440b623a28eae upstream.

A few archs like powerpc have different errno.h values for macros
EDEADLOCK and EDEADLK. In code including both libc and linux versions of
errno.h, this can result in multiple definitions of EDEADLOCK in the
include chain. Definitions to the same value (e.g. seen with mips) do
not raise warnings, but on powerpc there are redefinitions changing the
value, which raise warnings and errors (if using "-Werror").

Guard against these redefinitions to avoid build errors like the following,
first seen cross-compiling libbpf v5.8.9 for powerpc using GCC 8.4.0 with
musl 1.1.24:

  In file included from ../../arch/powerpc/include/uapi/asm/errno.h:5,
                   from ../../include/linux/err.h:8,
                   from libbpf.c:29:
  ../../include/uapi/asm-generic/errno.h:40: error: "EDEADLOCK" redefined [-Werror]
   #define EDEADLOCK EDEADLK

  In file included from toolchain-powerpc_8540_gcc-8.4.0_musl/include/errno.h:10,
                   from libbpf.c:26:
  toolchain-powerpc_8540_gcc-8.4.0_musl/include/bits/errno.h:58: note: this is the location of the previous definition
   #define EDEADLOCK       58

  cc1: all warnings being treated as errors

Cc: Stable <stable@vger.kernel.org>
Reported-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Tony Ambardar <Tony.Ambardar@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200917135437.1238787-1-Tony.Ambardar@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/include/uapi/asm/errno.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/powerpc/include/uapi/asm/errno.h b/arch/powerpc/include/uapi/asm/errno.h
index e8b6b5f7de7c..5e8f42ff797f 100644
--- a/arch/powerpc/include/uapi/asm/errno.h
+++ b/arch/powerpc/include/uapi/asm/errno.h
@@ -1,6 +1,7 @@
 #ifndef _ASM_POWERPC_ERRNO_H
 #define _ASM_POWERPC_ERRNO_H
 
+#undef	EDEADLOCK
 #include <asm-generic/errno.h>
 
 #undef	EDEADLOCK

From ffd9e901061d78ebd71efab9e6a2dd5b11090ac5 Mon Sep 17 00:00:00 2001
From: Yang Yang <yang.yang29@zte.com.cn>
Date: Thu, 28 Jan 2021 02:55:35 -0800
Subject: [PATCH 1945/2658] jffs2: check the validity of dstlen in
 jffs2_zlib_compress()

commit 90ada91f4610c5ef11bc52576516d96c496fc3f1 upstream.

KASAN reports a BUG when download file in jffs2 filesystem.It is
because when dstlen == 1, cpage_out will write array out of bounds.
Actually, data will not be compressed in jffs2_zlib_compress() if
data's length less than 4.

[  393.799778] BUG: KASAN: slab-out-of-bounds in jffs2_rtime_compress+0x214/0x2f0 at addr ffff800062e3b281
[  393.809166] Write of size 1 by task tftp/2918
[  393.813526] CPU: 3 PID: 2918 Comm: tftp Tainted: G    B           4.9.115-rt93-EMBSYS-CGEL-6.1.R6-dirty #1
[  393.823173] Hardware name: LS1043A RDB Board (DT)
[  393.827870] Call trace:
[  393.830322] [<ffff20000808c700>] dump_backtrace+0x0/0x2f0
[  393.835721] [<ffff20000808ca04>] show_stack+0x14/0x20
[  393.840774] [<ffff2000086ef700>] dump_stack+0x90/0xb0
[  393.845829] [<ffff20000827b19c>] kasan_object_err+0x24/0x80
[  393.851402] [<ffff20000827b404>] kasan_report_error+0x1b4/0x4d8
[  393.857323] [<ffff20000827bae8>] kasan_report+0x38/0x40
[  393.862548] [<ffff200008279d44>] __asan_store1+0x4c/0x58
[  393.867859] [<ffff2000084ce2ec>] jffs2_rtime_compress+0x214/0x2f0
[  393.873955] [<ffff2000084bb3b0>] jffs2_selected_compress+0x178/0x2a0
[  393.880308] [<ffff2000084bb530>] jffs2_compress+0x58/0x478
[  393.885796] [<ffff2000084c5b34>] jffs2_write_inode_range+0x13c/0x450
[  393.892150] [<ffff2000084be0b8>] jffs2_write_end+0x2a8/0x4a0
[  393.897811] [<ffff2000081f3008>] generic_perform_write+0x1c0/0x280
[  393.903990] [<ffff2000081f5074>] __generic_file_write_iter+0x1c4/0x228
[  393.910517] [<ffff2000081f5210>] generic_file_write_iter+0x138/0x288
[  393.916870] [<ffff20000829ec1c>] __vfs_write+0x1b4/0x238
[  393.922181] [<ffff20000829ff00>] vfs_write+0xd0/0x238
[  393.927232] [<ffff2000082a1ba8>] SyS_write+0xa0/0x110
[  393.932283] [<ffff20000808429c>] __sys_trace_return+0x0/0x4
[  393.937851] Object at ffff800062e3b280, in cache kmalloc-64 size: 64
[  393.944197] Allocated:
[  393.946552] PID = 2918
[  393.948913]  save_stack_trace_tsk+0x0/0x220
[  393.953096]  save_stack_trace+0x18/0x20
[  393.956932]  kasan_kmalloc+0xd8/0x188
[  393.960594]  __kmalloc+0x144/0x238
[  393.963994]  jffs2_selected_compress+0x48/0x2a0
[  393.968524]  jffs2_compress+0x58/0x478
[  393.972273]  jffs2_write_inode_range+0x13c/0x450
[  393.976889]  jffs2_write_end+0x2a8/0x4a0
[  393.980810]  generic_perform_write+0x1c0/0x280
[  393.985251]  __generic_file_write_iter+0x1c4/0x228
[  393.990040]  generic_file_write_iter+0x138/0x288
[  393.994655]  __vfs_write+0x1b4/0x238
[  393.998228]  vfs_write+0xd0/0x238
[  394.001543]  SyS_write+0xa0/0x110
[  394.004856]  __sys_trace_return+0x0/0x4
[  394.008684] Freed:
[  394.010691] PID = 2918
[  394.013051]  save_stack_trace_tsk+0x0/0x220
[  394.017233]  save_stack_trace+0x18/0x20
[  394.021069]  kasan_slab_free+0x88/0x188
[  394.024902]  kfree+0x6c/0x1d8
[  394.027868]  jffs2_sum_write_sumnode+0x2c4/0x880
[  394.032486]  jffs2_do_reserve_space+0x198/0x598
[  394.037016]  jffs2_reserve_space+0x3f8/0x4d8
[  394.041286]  jffs2_write_inode_range+0xf0/0x450
[  394.045816]  jffs2_write_end+0x2a8/0x4a0
[  394.049737]  generic_perform_write+0x1c0/0x280
[  394.054179]  __generic_file_write_iter+0x1c4/0x228
[  394.058968]  generic_file_write_iter+0x138/0x288
[  394.063583]  __vfs_write+0x1b4/0x238
[  394.067157]  vfs_write+0xd0/0x238
[  394.070470]  SyS_write+0xa0/0x110
[  394.073783]  __sys_trace_return+0x0/0x4
[  394.077612] Memory state around the buggy address:
[  394.082404]  ffff800062e3b180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[  394.089623]  ffff800062e3b200: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[  394.096842] >ffff800062e3b280: 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  394.104056]                    ^
[  394.107283]  ffff800062e3b300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[  394.114502]  ffff800062e3b380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[  394.121718] ==================================================================

Signed-off-by: Yang Yang <yang.yang29@zte.com.cn>
Cc: Joel Stanley <joel@jms.id.au>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/jffs2/compr_rtime.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c
index 406d9cc84ba8..79e771ab624f 100644
--- a/fs/jffs2/compr_rtime.c
+++ b/fs/jffs2/compr_rtime.c
@@ -37,6 +37,9 @@ static int jffs2_rtime_compress(unsigned char *data_in,
 	int outpos = 0;
 	int pos=0;
 
+	if (*dstlen <= 3)
+		return -1;
+
 	memset(positions,0,sizeof(positions));
 
 	while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {

From 7a651a9d70934417f342d5844aa598c3846c6ed5 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Wed, 5 May 2021 10:38:24 -0400
Subject: [PATCH 1946/2658] ftrace: Handle commands when closing
 set_ftrace_filter file

commit 8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 upstream.

 # echo switch_mm:traceoff > /sys/kernel/tracing/set_ftrace_filter

will cause switch_mm to stop tracing by the traceoff command.

 # echo -n switch_mm:traceoff > /sys/kernel/tracing/set_ftrace_filter

does nothing.

The reason is that the parsing in the write function only processes
commands if it finished parsing (there is white space written after the
command). That's to handle:

 write(fd, "switch_mm:", 10);
 write(fd, "traceoff", 8);

cases, where the command is broken over multiple writes.

The problem is if the file descriptor is closed, then the write call is
not processed, and the command needs to be processed in the release code.
The release code can handle matching of functions, but does not handle
commands.

Cc: stable@vger.kernel.org
Fixes: eda1e32855656 ("tracing: handle broken names in ftrace filter")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/ftrace.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index b56b1daa0a59..93c2abe27871 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -4401,8 +4401,11 @@ int ftrace_regex_release(struct inode *inode, struct file *file)
 
 	parser = &iter->parser;
 	if (trace_parser_loaded(parser)) {
+		int enable = !(iter->flags & FTRACE_ITER_NOTRACE);
+
 		parser->buffer[parser->idx] = 0;
-		ftrace_match_records(iter->hash, parser->buffer, parser->idx);
+		ftrace_process_regex(iter->hash, parser->buffer,
+				     parser->idx, enable);
 	}
 
 	trace_parser_put(parser);

From bbde908d9c07c227df86ad96a22ad3f81a43e46b Mon Sep 17 00:00:00 2001
From: Zhang Yi <yi.zhang@huawei.com>
Date: Wed, 31 Mar 2021 20:15:16 +0800
Subject: [PATCH 1947/2658] ext4: fix check to prevent false positive report of
 incorrect used inodes

commit a149d2a5cabbf6507a7832a1c4fd2593c55fd450 upstream.

Commit <50122847007> ("ext4: fix check to prevent initializing reserved
inodes") check the block group zero and prevent initializing reserved
inodes. But in some special cases, the reserved inode may not all belong
to the group zero, it may exist into the second group if we format
filesystem below.

  mkfs.ext4 -b 4096 -g 8192 -N 1024 -I 4096 /dev/sda

So, it will end up triggering a false positive report of a corrupted
file system. This patch fix it by avoid check reserved inodes if no free
inode blocks will be zeroed.

Cc: stable@kernel.org
Fixes: 50122847007 ("ext4: fix check to prevent initializing reserved inodes")
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Suggested-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20210331121516.2243099-1-yi.zhang@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/ialloc.c | 48 ++++++++++++++++++++++++++++++++----------------
 1 file changed, 32 insertions(+), 16 deletions(-)

diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index ceae64d28646..39e8f0a1512d 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -1273,6 +1273,7 @@ int ext4_init_inode_table(struct super_block *sb, ext4_group_t group,
 	handle_t *handle;
 	ext4_fsblk_t blk;
 	int num, ret = 0, used_blks = 0;
+	unsigned long used_inos = 0;
 
 	/* This should not happen, but just to be sure check this */
 	if (sb->s_flags & MS_RDONLY) {
@@ -1303,22 +1304,37 @@ int ext4_init_inode_table(struct super_block *sb, ext4_group_t group,
 	 * used inodes so we need to skip blocks with used inodes in
 	 * inode table.
 	 */
-	if (!(gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT)))
-		used_blks = DIV_ROUND_UP((EXT4_INODES_PER_GROUP(sb) -
-			    ext4_itable_unused_count(sb, gdp)),
-			    sbi->s_inodes_per_block);
-
-	if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group) ||
-	    ((group == 0) && ((EXT4_INODES_PER_GROUP(sb) -
-			       ext4_itable_unused_count(sb, gdp)) <
-			      EXT4_FIRST_INO(sb)))) {
-		ext4_error(sb, "Something is wrong with group %u: "
-			   "used itable blocks: %d; "
-			   "itable unused count: %u",
-			   group, used_blks,
-			   ext4_itable_unused_count(sb, gdp));
-		ret = 1;
-		goto err_out;
+	if (!(gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT))) {
+		used_inos = EXT4_INODES_PER_GROUP(sb) -
+			    ext4_itable_unused_count(sb, gdp);
+		used_blks = DIV_ROUND_UP(used_inos, sbi->s_inodes_per_block);
+
+		/* Bogus inode unused count? */
+		if (used_blks < 0 || used_blks > sbi->s_itb_per_group) {
+			ext4_error(sb, "Something is wrong with group %u: "
+				   "used itable blocks: %d; "
+				   "itable unused count: %u",
+				   group, used_blks,
+				   ext4_itable_unused_count(sb, gdp));
+			ret = 1;
+			goto err_out;
+		}
+
+		used_inos += group * EXT4_INODES_PER_GROUP(sb);
+		/*
+		 * Are there some uninitialized inodes in the inode table
+		 * before the first normal inode?
+		 */
+		if ((used_blks != sbi->s_itb_per_group) &&
+		     (used_inos < EXT4_FIRST_INO(sb))) {
+			ext4_error(sb, "Something is wrong with group %u: "
+				   "itable unused count: %u; "
+				   "itables initialized count: %ld",
+				   group, ext4_itable_unused_count(sb, gdp),
+				   used_inos);
+			ret = 1;
+			goto err_out;
+		}
 	}
 
 	blk = ext4_inode_table(sb, gdp) + used_blks;

From 7f9d863ade190d6376ced8eec747d0011d968bd2 Mon Sep 17 00:00:00 2001
From: Fengnan Chang <changfengnan@vivo.com>
Date: Fri, 2 Apr 2021 18:16:31 +0800
Subject: [PATCH 1948/2658] ext4: fix error code in ext4_commit_super

commit f88f1466e2a2e5ca17dfada436d3efa1b03a3972 upstream.

We should set the error code when ext4_commit_super check argument failed.
Found in code review.
Fixes: c4be0c1dc4cdc ("filesystem freeze: add error handling of write_super_lockfs/unlockfs").

Cc: stable@kernel.org
Signed-off-by: Fengnan Chang <changfengnan@vivo.com>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Link: https://lore.kernel.org/r/20210402101631.561-1-changfengnan@vivo.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/super.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 69425c02bbb6..9929e362cb5f 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -4471,8 +4471,10 @@ static int ext4_commit_super(struct super_block *sb, int sync)
 	struct buffer_head *sbh = EXT4_SB(sb)->s_sbh;
 	int error = 0;
 
-	if (!sbh || block_device_ejected(sb))
-		return error;
+	if (!sbh)
+		return -EINVAL;
+	if (block_device_ejected(sb))
+		return -ENODEV;
 
 	/*
 	 * The superblock bh should be mapped, but it might not be if the

From c138f0ffec4c4a2c099b4e450331dfeb92e9476b Mon Sep 17 00:00:00 2001
From: Anirudh Rayabharam <mail@anirudhrb.com>
Date: Mon, 19 Apr 2021 09:07:08 +0530
Subject: [PATCH 1949/2658] usb: gadget: dummy_hcd: fix gpf in gadget_setup

commit 4a5d797a9f9c4f18585544237216d7812686a71f upstream.

Fix a general protection fault reported by syzbot due to a race between
gadget_setup() and gadget_unbind() in raw_gadget.

The gadget core is supposed to guarantee that there won't be any more
callbacks to the gadget driver once the driver's unbind routine is
called. That guarantee is enforced in usb_gadget_remove_driver as
follows:

        usb_gadget_disconnect(udc->gadget);
        if (udc->gadget->irq)
                synchronize_irq(udc->gadget->irq);
        udc->driver->unbind(udc->gadget);
        usb_gadget_udc_stop(udc);

usb_gadget_disconnect turns off the pullup resistor, telling the host
that the gadget is no longer connected and preventing the transmission
of any more USB packets. Any packets that have already been received
are sure to processed by the UDC driver's interrupt handler by the time
synchronize_irq returns.

But this doesn't work with dummy_hcd, because dummy_hcd doesn't use
interrupts; it uses a timer instead. It does have code to emulate the
effect of synchronize_irq, but that code doesn't get invoked at the
right time -- it currently runs in usb_gadget_udc_stop, after the unbind
callback instead of before. Indeed, there's no way for
usb_gadget_remove_driver to invoke this code before the unbind callback.

To fix this, move the synchronize_irq() emulation code to dummy_pullup
so that it runs before unbind. Also, add a comment explaining why it is
necessary to have it there.

Reported-by: syzbot+eb4674092e6cc8d9e0bd@syzkaller.appspotmail.com
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com>
Link: https://lore.kernel.org/r/20210419033713.3021-1-mail@anirudhrb.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/udc/dummy_hcd.c | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index cbd4ef2c74b8..c468c64bc3a0 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -920,6 +920,21 @@ static int dummy_pullup(struct usb_gadget *_gadget, int value)
 	spin_lock_irqsave(&dum->lock, flags);
 	dum->pullup = (value != 0);
 	set_link_state(dum_hcd);
+	if (value == 0) {
+		/*
+		 * Emulate synchronize_irq(): wait for callbacks to finish.
+		 * This seems to be the best place to emulate the call to
+		 * synchronize_irq() that's in usb_gadget_remove_driver().
+		 * Doing it in dummy_udc_stop() would be too late since it
+		 * is called after the unbind callback and unbind shouldn't
+		 * be invoked until all the other callbacks are finished.
+		 */
+		while (dum->callback_usage > 0) {
+			spin_unlock_irqrestore(&dum->lock, flags);
+			usleep_range(1000, 2000);
+			spin_lock_irqsave(&dum->lock, flags);
+		}
+	}
 	spin_unlock_irqrestore(&dum->lock, flags);
 
 	usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd));
@@ -1000,14 +1015,6 @@ static int dummy_udc_stop(struct usb_gadget *g)
 	spin_lock_irq(&dum->lock);
 	dum->ints_enabled = 0;
 	stop_activity(dum);
-
-	/* emulate synchronize_irq(): wait for callbacks to finish */
-	while (dum->callback_usage > 0) {
-		spin_unlock_irq(&dum->lock);
-		usleep_range(1000, 2000);
-		spin_lock_irq(&dum->lock);
-	}
-
 	dum->driver = NULL;
 	spin_unlock_irq(&dum->lock);
 

From 197d1733516fc852c2cfc7b3acce73962e91dedd Mon Sep 17 00:00:00 2001
From: Dean Anderson <dean@sensoray.com>
Date: Wed, 17 Mar 2021 15:41:09 -0700
Subject: [PATCH 1950/2658] usb: gadget/function/f_fs string table fix for
 multiple languages

commit 55b74ce7d2ce0b0058f3e08cab185a0afacfe39e upstream.

Fixes bug with the handling of more than one language in
the string table in f_fs.c.
str_count was not reset for subsequent language codes.
str_count-- "rolls under" and processes u32 max strings on
the processing of the second language entry.
The existing bug can be reproduced by adding a second language table
to the structure "strings" in tools/usb/ffs-test.c.

Signed-off-by: Dean Anderson <dean@sensoray.com>
Link: https://lore.kernel.org/r/20210317224109.21534-1-dean@sensoray.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/function/f_fs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 2dd7623b10fd..ac0230c65fa6 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -2730,6 +2730,7 @@ static int __ffs_data_got_strings(struct ffs_data *ffs,
 
 	do { /* lang_count > 0 so we can use do-while */
 		unsigned needed = needed_count;
+		u32 str_per_lang = str_count;
 
 		if (unlikely(len < 3))
 			goto error_free;
@@ -2765,7 +2766,7 @@ static int __ffs_data_got_strings(struct ffs_data *ffs,
 
 			data += length + 1;
 			len -= length + 1;
-		} while (--str_count);
+		} while (--str_per_lang);
 
 		s->id = 0;   /* terminator */
 		s->s = NULL;

From 41e594b1627b46e0756a3051cafd94208b7b5e52 Mon Sep 17 00:00:00 2001
From: Joe Thornber <ejt@redhat.com>
Date: Mon, 29 Mar 2021 16:34:57 +0100
Subject: [PATCH 1951/2658] dm persistent data: packed struct should have an
 aligned() attribute too

commit a88b2358f1da2c9f9fcc432f2e0a79617fea397c upstream.

Otherwise most non-x86 architectures (e.g. riscv, arm) will resort to
byte-by-byte access.

Cc: stable@vger.kernel.org
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/persistent-data/dm-btree-internal.h   | 4 ++--
 drivers/md/persistent-data/dm-space-map-common.h | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/md/persistent-data/dm-btree-internal.h b/drivers/md/persistent-data/dm-btree-internal.h
index a240990a7f33..5673f8eb5f88 100644
--- a/drivers/md/persistent-data/dm-btree-internal.h
+++ b/drivers/md/persistent-data/dm-btree-internal.h
@@ -34,12 +34,12 @@ struct node_header {
 	__le32 max_entries;
 	__le32 value_size;
 	__le32 padding;
-} __packed;
+} __attribute__((packed, aligned(8)));
 
 struct btree_node {
 	struct node_header header;
 	__le64 keys[0];
-} __packed;
+} __attribute__((packed, aligned(8)));
 
 
 /*
diff --git a/drivers/md/persistent-data/dm-space-map-common.h b/drivers/md/persistent-data/dm-space-map-common.h
index 8de63ce39bdd..87e17909ef52 100644
--- a/drivers/md/persistent-data/dm-space-map-common.h
+++ b/drivers/md/persistent-data/dm-space-map-common.h
@@ -33,7 +33,7 @@ struct disk_index_entry {
 	__le64 blocknr;
 	__le32 nr_free;
 	__le32 none_free_before;
-} __packed;
+} __attribute__ ((packed, aligned(8)));
 
 
 #define MAX_METADATA_BITMAPS 255
@@ -43,7 +43,7 @@ struct disk_metadata_index {
 	__le64 blocknr;
 
 	struct disk_index_entry index[MAX_METADATA_BITMAPS];
-} __packed;
+} __attribute__ ((packed, aligned(8)));
 
 struct ll_disk;
 
@@ -86,7 +86,7 @@ struct disk_sm_root {
 	__le64 nr_allocated;
 	__le64 bitmap_root;
 	__le64 ref_count_root;
-} __packed;
+} __attribute__ ((packed, aligned(8)));
 
 #define ENTRIES_PER_BYTE 4
 
@@ -94,7 +94,7 @@ struct disk_bitmap_header {
 	__le32 csum;
 	__le32 not_used;
 	__le64 blocknr;
-} __packed;
+} __attribute__ ((packed, aligned(8)));
 
 enum allocation_event {
 	SM_NONE,

From 4d4ca83a362f4e0bcb065a1f18172d226239a107 Mon Sep 17 00:00:00 2001
From: Joe Thornber <ejt@redhat.com>
Date: Tue, 13 Apr 2021 09:11:53 +0100
Subject: [PATCH 1952/2658] dm space map common: fix division bug in
 sm_ll_find_free_block()

commit 5208692e80a1f3c8ce2063a22b675dd5589d1d80 upstream.

This division bug meant the search for free metadata space could skip
the final allocation bitmap's worth of entries. Fix affects DM thinp,
cache and era targets.

Cc: stable@vger.kernel.org
Signed-off-by: Joe Thornber <ejt@redhat.com>
Tested-by: Ming-Hung Tsai <mtsai@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/persistent-data/dm-space-map-common.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/persistent-data/dm-space-map-common.c
index 22729fd92a1b..ca09ad2a639c 100644
--- a/drivers/md/persistent-data/dm-space-map-common.c
+++ b/drivers/md/persistent-data/dm-space-map-common.c
@@ -337,6 +337,8 @@ int sm_ll_find_free_block(struct ll_disk *ll, dm_block_t begin,
 	 */
 	begin = do_div(index_begin, ll->entries_per_block);
 	end = do_div(end, ll->entries_per_block);
+	if (end == 0)
+		end = ll->entries_per_block;
 
 	for (i = index_begin; i < index_end; i++, begin = 0) {
 		struct dm_block *blk;

From 1b903bf77d0aef16acff990fb03e14690c62d9d0 Mon Sep 17 00:00:00 2001
From: Archie Pusaka <apusaka@chromium.org>
Date: Mon, 22 Mar 2021 14:03:11 +0800
Subject: [PATCH 1953/2658] Bluetooth: verify AMP hci_chan before amp_destroy

commit 5c4c8c9544099bb9043a10a5318130a943e32fc3 upstream.

hci_chan can be created in 2 places: hci_loglink_complete_evt() if
it is an AMP hci_chan, or l2cap_conn_add() otherwise. In theory,
Only AMP hci_chan should be removed by a call to
hci_disconn_loglink_complete_evt(). However, the controller might mess
up, call that function, and destroy an hci_chan which is not initiated
by hci_loglink_complete_evt().

This patch adds a verification that the destroyed hci_chan must have
been init'd by hci_loglink_complete_evt().

Example crash call trace:
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xe3/0x144 lib/dump_stack.c:118
 print_address_description+0x67/0x22a mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report mm/kasan/report.c:412 [inline]
 kasan_report+0x251/0x28f mm/kasan/report.c:396
 hci_send_acl+0x3b/0x56e net/bluetooth/hci_core.c:4072
 l2cap_send_cmd+0x5af/0x5c2 net/bluetooth/l2cap_core.c:877
 l2cap_send_move_chan_cfm_icid+0x8e/0xb1 net/bluetooth/l2cap_core.c:4661
 l2cap_move_fail net/bluetooth/l2cap_core.c:5146 [inline]
 l2cap_move_channel_rsp net/bluetooth/l2cap_core.c:5185 [inline]
 l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:5464 [inline]
 l2cap_sig_channel net/bluetooth/l2cap_core.c:5799 [inline]
 l2cap_recv_frame+0x1d12/0x51aa net/bluetooth/l2cap_core.c:7023
 l2cap_recv_acldata+0x2ea/0x693 net/bluetooth/l2cap_core.c:7596
 hci_acldata_packet net/bluetooth/hci_core.c:4606 [inline]
 hci_rx_work+0x2bd/0x45e net/bluetooth/hci_core.c:4796
 process_one_work+0x6f8/0xb50 kernel/workqueue.c:2175
 worker_thread+0x4fc/0x670 kernel/workqueue.c:2321
 kthread+0x2f0/0x304 kernel/kthread.c:253
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415

Allocated by task 38:
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0x8d/0x9a mm/kasan/kasan.c:553
 kmem_cache_alloc_trace+0x102/0x129 mm/slub.c:2787
 kmalloc include/linux/slab.h:515 [inline]
 kzalloc include/linux/slab.h:709 [inline]
 hci_chan_create+0x86/0x26d net/bluetooth/hci_conn.c:1674
 l2cap_conn_add.part.0+0x1c/0x814 net/bluetooth/l2cap_core.c:7062
 l2cap_conn_add net/bluetooth/l2cap_core.c:7059 [inline]
 l2cap_connect_cfm+0x134/0x852 net/bluetooth/l2cap_core.c:7381
 hci_connect_cfm+0x9d/0x122 include/net/bluetooth/hci_core.h:1404
 hci_remote_ext_features_evt net/bluetooth/hci_event.c:4161 [inline]
 hci_event_packet+0x463f/0x72fa net/bluetooth/hci_event.c:5981
 hci_rx_work+0x197/0x45e net/bluetooth/hci_core.c:4791
 process_one_work+0x6f8/0xb50 kernel/workqueue.c:2175
 worker_thread+0x4fc/0x670 kernel/workqueue.c:2321
 kthread+0x2f0/0x304 kernel/kthread.c:253
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415

Freed by task 1732:
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free mm/kasan/kasan.c:521 [inline]
 __kasan_slab_free+0x106/0x128 mm/kasan/kasan.c:493
 slab_free_hook mm/slub.c:1409 [inline]
 slab_free_freelist_hook+0xaa/0xf6 mm/slub.c:1436
 slab_free mm/slub.c:3009 [inline]
 kfree+0x182/0x21e mm/slub.c:3972
 hci_disconn_loglink_complete_evt net/bluetooth/hci_event.c:4891 [inline]
 hci_event_packet+0x6a1c/0x72fa net/bluetooth/hci_event.c:6050
 hci_rx_work+0x197/0x45e net/bluetooth/hci_core.c:4791
 process_one_work+0x6f8/0xb50 kernel/workqueue.c:2175
 worker_thread+0x4fc/0x670 kernel/workqueue.c:2321
 kthread+0x2f0/0x304 kernel/kthread.c:253
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415

The buggy address belongs to the object at ffff8881d7af9180
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 24 bytes inside of
 128-byte region [ffff8881d7af9180, ffff8881d7af9200)
The buggy address belongs to the page:
page:ffffea00075ebe40 count:1 mapcount:0 mapping:ffff8881da403200 index:0x0
flags: 0x8000000000000200(slab)
raw: 8000000000000200 dead000000000100 dead000000000200 ffff8881da403200
raw: 0000000000000000 0000000080150015 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8881d7af9080: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
 ffff8881d7af9100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8881d7af9180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff8881d7af9200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8881d7af9280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

Signed-off-by: Archie Pusaka <apusaka@chromium.org>
Reported-by: syzbot+98228e7407314d2d4ba2@syzkaller.appspotmail.com
Reviewed-by: Alain Michaud <alainm@chromium.org>
Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: George Kennedy <george.kennedy@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/bluetooth/hci_core.h | 1 +
 net/bluetooth/hci_event.c        | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 5aaf6cdb121a..f042188c8099 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -498,6 +498,7 @@ struct hci_chan {
 	struct sk_buff_head data_q;
 	unsigned int	sent;
 	__u8		state;
+	bool		amp;
 };
 
 struct hci_conn_params {
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 011f05cdca38..024950688c09 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4385,6 +4385,7 @@ static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 		return;
 
 	hchan->handle = le16_to_cpu(ev->handle);
+	hchan->amp = true;
 
 	BT_DBG("hcon %pK mgr %pK hchan %pK", hcon, hcon->amp_mgr, hchan);
 
@@ -4417,7 +4418,7 @@ static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
 	hci_dev_lock(hdev);
 
 	hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
-	if (!hchan)
+	if (!hchan || !hchan->amp)
 		goto unlock;
 
 	amp_destroy_logical_link(hchan, ev->reason);

From 94545f8b112175511b6645563e031b019146e861 Mon Sep 17 00:00:00 2001
From: Taehee Yoo <ap420073@gmail.com>
Date: Fri, 28 Feb 2020 18:01:46 +0000
Subject: [PATCH 1954/2658] hsr: use netdev_err() instead of WARN_ONCE()

commit 4b793acdca0050739b99ace6a8b9e7f717f57c6b upstream.

When HSR interface is sending a frame, it finds a node with
the destination ethernet address from the list.
If there is no node, it calls WARN_ONCE().
But, using WARN_ONCE() for this situation is a little bit overdoing.
So, in this patch, the netdev_err() is used instead.

Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: George Kennedy <george.kennedy@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/hsr/hsr_framereg.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index b3d32cb71801..afcde16a94e2 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -297,7 +297,8 @@ void hsr_addr_subst_dest(struct hsr_node *node_src, struct sk_buff *skb,
 
 	node_dst = find_node_by_AddrA(&port->hsr->node_db, eth_hdr(skb)->h_dest);
 	if (!node_dst) {
-		WARN_ONCE(1, "%s: Unknown node\n", __func__);
+		if (net_ratelimit())
+			netdev_err(skb->dev, "%s: Unknown node\n", __func__);
 		return;
 	}
 	if (port->type != node_dst->AddrB_port)

From 0f4e8e2f6d3e76e21da4b9d410ada9ef019f7940 Mon Sep 17 00:00:00 2001
From: Or Cohen <orcohen@paloaltonetworks.com>
Date: Tue, 4 May 2021 10:16:46 +0300
Subject: [PATCH 1955/2658] net/nfc: fix use-after-free llcp_sock_bind/connect

commit c61760e6940dd4039a7f5e84a6afc9cdbf4d82b6 upstream.

Commits 8a4cd82d ("nfc: fix refcount leak in llcp_sock_connect()")
and c33b1cc62 ("nfc: fix refcount leak in llcp_sock_bind()")
fixed a refcount leak bug in bind/connect but introduced a
use-after-free if the same local is assigned to 2 different sockets.

This can be triggered by the following simple program:
    int sock1 = socket( AF_NFC, SOCK_STREAM, NFC_SOCKPROTO_LLCP );
    int sock2 = socket( AF_NFC, SOCK_STREAM, NFC_SOCKPROTO_LLCP );
    memset( &addr, 0, sizeof(struct sockaddr_nfc_llcp) );
    addr.sa_family = AF_NFC;
    addr.nfc_protocol = NFC_PROTO_NFC_DEP;
    bind( sock1, (struct sockaddr*) &addr, sizeof(struct sockaddr_nfc_llcp) )
    bind( sock2, (struct sockaddr*) &addr, sizeof(struct sockaddr_nfc_llcp) )
    close(sock1);
    close(sock2);

Fix this by assigning NULL to llcp_sock->local after calling
nfc_llcp_local_put.

This addresses CVE-2021-23134.

Reported-by: Or Cohen <orcohen@paloaltonetworks.com>
Reported-by: Nadav Markus <nmarkus@paloaltonetworks.com>
Fixes: c33b1cc62 ("nfc: fix refcount leak in llcp_sock_bind()")
Signed-off-by: Or Cohen <orcohen@paloaltonetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/nfc/llcp_sock.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index 2f8d38d0802a..09a49531fa27 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -120,12 +120,14 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
 					  GFP_KERNEL);
 	if (!llcp_sock->service_name) {
 		nfc_llcp_local_put(llcp_sock->local);
+		llcp_sock->local = NULL;
 		ret = -ENOMEM;
 		goto put_dev;
 	}
 	llcp_sock->ssap = nfc_llcp_get_sdp_ssap(local, llcp_sock);
 	if (llcp_sock->ssap == LLCP_SAP_MAX) {
 		nfc_llcp_local_put(llcp_sock->local);
+		llcp_sock->local = NULL;
 		kfree(llcp_sock->service_name);
 		llcp_sock->service_name = NULL;
 		ret = -EADDRINUSE;
@@ -715,6 +717,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
 	llcp_sock->ssap = nfc_llcp_get_local_ssap(local);
 	if (llcp_sock->ssap == LLCP_SAP_MAX) {
 		nfc_llcp_local_put(llcp_sock->local);
+		llcp_sock->local = NULL;
 		ret = -ENOMEM;
 		goto put_dev;
 	}
@@ -753,6 +756,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
 sock_unlink:
 	nfc_llcp_put_ssap(local, llcp_sock->ssap);
 	nfc_llcp_local_put(llcp_sock->local);
+	llcp_sock->local = NULL;
 
 	nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
 	kfree(llcp_sock->service_name);

From 4e51175dfb9bc8519f07256a6310421385d46430 Mon Sep 17 00:00:00 2001
From: "Maciej W. Rozycki" <macro@orcam.me.uk>
Date: Wed, 10 Mar 2021 13:03:09 +0100
Subject: [PATCH 1956/2658] FDDI: defxx: Bail out gracefully with unassigned
 PCI resource for CSR

commit f626ca682912fab55dff15469ce893ae16b65c7e upstream.

Recent versions of the PCI Express specification have deprecated support
for I/O transactions and actually some PCIe host bridges, such as Power
Systems Host Bridge 4 (PHB4), do not implement them.

For those systems the PCI BARs that request a mapping in the I/O space
have the length recorded in the corresponding PCI resource set to zero,
which makes it unassigned:

# lspci -s 0031:02:04.0 -v
0031:02:04.0 FDDI network controller: Digital Equipment Corporation PCI-to-PDQ Interface Chip [PFI] FDDI (DEFPA) (rev 02)
	Subsystem: Digital Equipment Corporation FDDIcontroller/PCI (DEFPA)
	Flags: bus master, medium devsel, latency 136, IRQ 57, NUMA node 8
	Memory at 620c080020000 (32-bit, non-prefetchable) [size=128]
	I/O ports at <unassigned> [disabled]
	Memory at 620c080030000 (32-bit, non-prefetchable) [size=64K]
	Capabilities: [50] Power Management version 2
	Kernel driver in use: defxx
	Kernel modules: defxx

#

Regardless the driver goes ahead and requests it (here observed with a
Raptor Talos II POWER9 system), resulting in an odd /proc/ioport entry:

# cat /proc/ioports
00000000-ffffffffffffffff : 0031:02:04.0
#

Furthermore, the system gets confused as the driver actually continues
and pokes at those locations, causing a flood of messages being output
to the system console by the underlying system firmware, like:

defxx: v1.11 2014/07/01  Lawrence V. Stefani and others
defxx 0031:02:04.0: enabling device (0140 -> 0142)
LPC[000]: Got SYNC no-response error. Error address reg: 0xd0010000
IPMI: dropping non severe PEL event
LPC[000]: Got SYNC no-response error. Error address reg: 0xd0010014
IPMI: dropping non severe PEL event
LPC[000]: Got SYNC no-response error. Error address reg: 0xd0010014
IPMI: dropping non severe PEL event

and so on and so on (possibly intermixed actually, as there's no locking
between the kernel and the firmware in console port access with this
particular system, but cleaned up above for clarity), and once some 10k
of such pairs of the latter two messages have been produced an interace
eventually shows up in a useless state:

0031:02:04.0: DEFPA at I/O addr = 0x0, IRQ = 57, Hardware addr = 00-00-00-00-00-00

This was not expected to happen as resource handling was added to the
driver a while ago, because it was not known at that time that a PCI
system would be possible that cannot assign port I/O resources, and
oddly enough `request_region' does not fail, which would have caught it.

Correct the problem then by checking for the length of zero for the CSR
resource and bail out gracefully refusing to register an interface if
that turns out to be the case, producing messages like:

defxx: v1.11 2014/07/01  Lawrence V. Stefani and others
0031:02:04.0: Cannot use I/O, no address set, aborting
0031:02:04.0: Recompile driver with "CONFIG_DEFXX_MMIO=y"

Keep the original check for the EISA MMIO resource as implemented,
because in that case the length is hardwired to 0x400 as a consequence
of how the compare/mask address decoding works in the ESIC chip and it
is only the base address that is set to zero if MMIO has been disabled
for the adapter in EISA configuration, which in turn could be a valid
bus address in a legacy-free system implementing PCI, especially for
port I/O.

Where the EISA MMIO resource has been disabled for the adapter in EISA
configuration this arrangement keeps producing messages like:

eisa 00:05: EISA: slot 5: DEC3002 detected
defxx: v1.11 2014/07/01  Lawrence V. Stefani and others
00:05: Cannot use MMIO, no address set, aborting
00:05: Recompile driver with "CONFIG_DEFXX_MMIO=n"
00:05: Or run ECU and set adapter's MMIO location

with the last two lines now swapped for easier handling in the driver.

There is no need to check for and catch the case of a port I/O resource
not having been assigned for EISA as the adapter uses the slot-specific
I/O space, which gets assigned by how EISA has been specified and maps
directly to the particular slot an option card has been placed in.  And
the EISA variant of the adapter has additional registers that are only
accessible via the port I/O space anyway.

While at it factor out the error message calls into helpers and fix an
argument order bug with the `pr_err' call now in `dfx_register_res_err'.

Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 4d0438e56a8f ("defxx: Clean up DEFEA resource management")
Cc: stable@vger.kernel.org # v3.19+
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/fddi/defxx.c | 47 +++++++++++++++++++++++++---------------
 1 file changed, 30 insertions(+), 17 deletions(-)

diff --git a/drivers/net/fddi/defxx.c b/drivers/net/fddi/defxx.c
index 7f975a2c8990..ebba57988f0a 100644
--- a/drivers/net/fddi/defxx.c
+++ b/drivers/net/fddi/defxx.c
@@ -495,6 +495,25 @@ static const struct net_device_ops dfx_netdev_ops = {
 	.ndo_set_mac_address	= dfx_ctl_set_mac_address,
 };
 
+static void dfx_register_res_alloc_err(const char *print_name, bool mmio,
+				       bool eisa)
+{
+	pr_err("%s: Cannot use %s, no address set, aborting\n",
+	       print_name, mmio ? "MMIO" : "I/O");
+	pr_err("%s: Recompile driver with \"CONFIG_DEFXX_MMIO=%c\"\n",
+	       print_name, mmio ? 'n' : 'y');
+	if (eisa && mmio)
+		pr_err("%s: Or run ECU and set adapter's MMIO location\n",
+		       print_name);
+}
+
+static void dfx_register_res_err(const char *print_name, bool mmio,
+				 unsigned long start, unsigned long len)
+{
+	pr_err("%s: Cannot reserve %s resource 0x%lx @ 0x%lx, aborting\n",
+	       print_name, mmio ? "MMIO" : "I/O", len, start);
+}
+
 /*
  * ================
  * = dfx_register =
@@ -568,15 +587,12 @@ static int dfx_register(struct device *bdev)
 	dev_set_drvdata(bdev, dev);
 
 	dfx_get_bars(bdev, bar_start, bar_len);
-	if (dfx_bus_eisa && dfx_use_mmio && bar_start[0] == 0) {
-		pr_err("%s: Cannot use MMIO, no address set, aborting\n",
-		       print_name);
-		pr_err("%s: Run ECU and set adapter's MMIO location\n",
-		       print_name);
-		pr_err("%s: Or recompile driver with \"CONFIG_DEFXX_MMIO=n\""
-		       "\n", print_name);
+	if (bar_len[0] == 0 ||
+	    (dfx_bus_eisa && dfx_use_mmio && bar_start[0] == 0)) {
+		dfx_register_res_alloc_err(print_name, dfx_use_mmio,
+					   dfx_bus_eisa);
 		err = -ENXIO;
-		goto err_out;
+		goto err_out_disable;
 	}
 
 	if (dfx_use_mmio)
@@ -585,18 +601,16 @@ static int dfx_register(struct device *bdev)
 	else
 		region = request_region(bar_start[0], bar_len[0], print_name);
 	if (!region) {
-		pr_err("%s: Cannot reserve %s resource 0x%lx @ 0x%lx, "
-		       "aborting\n", dfx_use_mmio ? "MMIO" : "I/O", print_name,
-		       (long)bar_len[0], (long)bar_start[0]);
+		dfx_register_res_err(print_name, dfx_use_mmio,
+				     bar_start[0], bar_len[0]);
 		err = -EBUSY;
 		goto err_out_disable;
 	}
 	if (bar_start[1] != 0) {
 		region = request_region(bar_start[1], bar_len[1], print_name);
 		if (!region) {
-			pr_err("%s: Cannot reserve I/O resource "
-			       "0x%lx @ 0x%lx, aborting\n", print_name,
-			       (long)bar_len[1], (long)bar_start[1]);
+			dfx_register_res_err(print_name, 0,
+					     bar_start[1], bar_len[1]);
 			err = -EBUSY;
 			goto err_out_csr_region;
 		}
@@ -604,9 +618,8 @@ static int dfx_register(struct device *bdev)
 	if (bar_start[2] != 0) {
 		region = request_region(bar_start[2], bar_len[2], print_name);
 		if (!region) {
-			pr_err("%s: Cannot reserve I/O resource "
-			       "0x%lx @ 0x%lx, aborting\n", print_name,
-			       (long)bar_len[2], (long)bar_start[2]);
+			dfx_register_res_err(print_name, 0,
+					     bar_start[2], bar_len[2]);
 			err = -EBUSY;
 			goto err_out_bh_region;
 		}

From 5931843f32c03e3c2b0f27901696d7418cd390ca Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Wed, 17 Feb 2021 11:24:59 +0100
Subject: [PATCH 1957/2658] misc: lis3lv02d: Fix false-positive WARN on various
 HP models

commit 3641762c1c9c7cfd84a7061a0a73054f09b412e3 upstream.

Before this commit lis3lv02d_get_pwron_wait() had a WARN_ONCE() to catch
a potential divide by 0. WARN macros should only be used to catch internal
kernel bugs and that is not the case here. We have been receiving a lot of
bug reports about kernel backtraces caused by this WARN.

The div value being checked comes from the lis3->odrs[] array. Which
is sized to be a power-of-2 matching the number of bits in lis3->odr_mask.

The only lis3 model where this array is not entirely filled with non zero
values. IOW the only model where we can hit the div == 0 check is the
3dc ("8 bits 3DC sensor") model:

int lis3_3dc_rates[16] = {0, 1, 10, 25, 50, 100, 200, 400, 1600, 5000};

Note the 0 value at index 0, according to the datasheet an odr index of 0
means "Power-down mode". HP typically uses a lis3 accelerometer for HDD
fall protection. What I believe is happening here is that on newer
HP devices, which only contain a SDD, the BIOS is leaving the lis3 device
powered-down since it is not used for HDD fall protection.

Note that the lis3_3dc_rates array initializer only specifies 10 values,
which matches the datasheet. So it also contains 6 zero values at the end.

Replace the WARN with a normal check, which treats an odr index of 0
as power-down and uses a normal dev_err() to report the error in case
odr index point past the initialized part of the array.

Fixes: 1510dd5954be ("lis3lv02d: avoid divide by zero due to unchecked")
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=785814
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1817027
BugLink: https://bugs.centos.org/view.php?id=10720
Link: https://lore.kernel.org/r/20210217102501.31758-1-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/lis3lv02d/lis3lv02d.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/drivers/misc/lis3lv02d/lis3lv02d.c b/drivers/misc/lis3lv02d/lis3lv02d.c
index fb8705fc3aca..205dc5d40ce6 100644
--- a/drivers/misc/lis3lv02d/lis3lv02d.c
+++ b/drivers/misc/lis3lv02d/lis3lv02d.c
@@ -220,7 +220,7 @@ static int lis3_3dc_rates[16] = {0, 1, 10, 25, 50, 100, 200, 400, 1600, 5000};
 static int lis3_3dlh_rates[4] = {50, 100, 400, 1000};
 
 /* ODR is Output Data Rate */
-static int lis3lv02d_get_odr(struct lis3lv02d *lis3)
+static int lis3lv02d_get_odr_index(struct lis3lv02d *lis3)
 {
 	u8 ctrl;
 	int shift;
@@ -228,15 +228,23 @@ static int lis3lv02d_get_odr(struct lis3lv02d *lis3)
 	lis3->read(lis3, CTRL_REG1, &ctrl);
 	ctrl &= lis3->odr_mask;
 	shift = ffs(lis3->odr_mask) - 1;
-	return lis3->odrs[(ctrl >> shift)];
+	return (ctrl >> shift);
 }
 
 static int lis3lv02d_get_pwron_wait(struct lis3lv02d *lis3)
 {
-	int div = lis3lv02d_get_odr(lis3);
+	int odr_idx = lis3lv02d_get_odr_index(lis3);
+	int div = lis3->odrs[odr_idx];
 
-	if (WARN_ONCE(div == 0, "device returned spurious data"))
+	if (div == 0) {
+		if (odr_idx == 0) {
+			/* Power-down mode, not sampling no need to sleep */
+			return 0;
+		}
+
+		dev_err(&lis3->pdev->dev, "Error unknown odrs-index: %d\n", odr_idx);
 		return -ENXIO;
+	}
 
 	/* LIS3 power on delay is quite long */
 	msleep(lis3->pwron_delay / div);
@@ -819,9 +827,12 @@ static ssize_t lis3lv02d_rate_show(struct device *dev,
 			struct device_attribute *attr, char *buf)
 {
 	struct lis3lv02d *lis3 = dev_get_drvdata(dev);
+	int odr_idx;
 
 	lis3lv02d_sysfs_poweron(lis3);
-	return sprintf(buf, "%d\n", lis3lv02d_get_odr(lis3));
+
+	odr_idx = lis3lv02d_get_odr_index(lis3);
+	return sprintf(buf, "%d\n", lis3->odrs[odr_idx]);
 }
 
 static ssize_t lis3lv02d_rate_set(struct device *dev,

From 69774b9bcfb97dc07ceb55ae470c87b44ba3c421 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date: Fri, 2 Apr 2021 21:17:41 +0900
Subject: [PATCH 1958/2658] misc: vmw_vmci: explicitly initialize
 vmci_notify_bm_set_msg struct

commit 376565b9717c30cd58ad33860fa42697615fa2e4 upstream.

KMSAN complains that the vmci_use_ppn64() == false path in
vmci_dbell_register_notification_bitmap() left upper 32bits of
bitmap_set_msg.bitmap_ppn64 member uninitialized.

  =====================================================
  BUG: KMSAN: uninit-value in kmsan_check_memory+0xd/0x10
  CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.11.0-rc7+ #4
  Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020
  Call Trace:
   dump_stack+0x21c/0x280
   kmsan_report+0xfb/0x1e0
   kmsan_internal_check_memory+0x484/0x520
   kmsan_check_memory+0xd/0x10
   iowrite8_rep+0x86/0x380
   vmci_send_datagram+0x150/0x280
   vmci_dbell_register_notification_bitmap+0x133/0x1e0
   vmci_guest_probe_device+0xcab/0x1e70
   pci_device_probe+0xab3/0xe70
   really_probe+0xd16/0x24d0
   driver_probe_device+0x29d/0x3a0
   device_driver_attach+0x25a/0x490
   __driver_attach+0x78c/0x840
   bus_for_each_dev+0x210/0x340
   driver_attach+0x89/0xb0
   bus_add_driver+0x677/0xc40
   driver_register+0x485/0x8e0
   __pci_register_driver+0x1ff/0x350
   vmci_guest_init+0x3e/0x41
   vmci_drv_init+0x1d6/0x43f
   do_one_initcall+0x39c/0x9a0
   do_initcall_level+0x1d7/0x259
   do_initcalls+0x127/0x1cb
   do_basic_setup+0x33/0x36
   kernel_init_freeable+0x29a/0x3ed
   kernel_init+0x1f/0x840
   ret_from_fork+0x1f/0x30

  Local variable ----bitmap_set_msg@vmci_dbell_register_notification_bitmap created at:
   vmci_dbell_register_notification_bitmap+0x50/0x1e0
   vmci_dbell_register_notification_bitmap+0x50/0x1e0

  Bytes 28-31 of 32 are uninitialized
  Memory access of size 32 starts at ffff88810098f570
  =====================================================

Fixes: 83e2ec765be03e8a ("VMCI: doorbell implementation.")
Cc: <stable@vger.kernel.org>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Link: https://lore.kernel.org/r/20210402121742.3917-1-penguin-kernel@I-love.SAKURA.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/vmw_vmci/vmci_doorbell.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/vmw_vmci/vmci_doorbell.c b/drivers/misc/vmw_vmci/vmci_doorbell.c
index 305a3449e946..c372f6a59bf7 100644
--- a/drivers/misc/vmw_vmci/vmci_doorbell.c
+++ b/drivers/misc/vmw_vmci/vmci_doorbell.c
@@ -334,7 +334,7 @@ int vmci_dbell_host_context_notify(u32 src_cid, struct vmci_handle handle)
 bool vmci_dbell_register_notification_bitmap(u32 bitmap_ppn)
 {
 	int result;
-	struct vmci_notify_bm_set_msg bitmap_set_msg;
+	struct vmci_notify_bm_set_msg bitmap_set_msg = { };
 
 	bitmap_set_msg.hdr.dst = vmci_make_handle(VMCI_HYPERVISOR_CONTEXT_ID,
 						  VMCI_SET_NOTIFY_BITMAP);

From c8d5f33b3e25b998f34deecce2b9c07d385625cd Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date: Fri, 2 Apr 2021 21:17:42 +0900
Subject: [PATCH 1959/2658] misc: vmw_vmci: explicitly initialize vmci_datagram
 payload

commit b2192cfeba8481224da0a4ec3b4a7ccd80b1623b upstream.

KMSAN complains that vmci_check_host_caps() left the payload part of
check_msg uninitialized.

  =====================================================
  BUG: KMSAN: uninit-value in kmsan_check_memory+0xd/0x10
  CPU: 1 PID: 1 Comm: swapper/0 Tainted: G    B             5.11.0-rc7+ #4
  Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020
  Call Trace:
   dump_stack+0x21c/0x280
   kmsan_report+0xfb/0x1e0
   kmsan_internal_check_memory+0x202/0x520
   kmsan_check_memory+0xd/0x10
   iowrite8_rep+0x86/0x380
   vmci_guest_probe_device+0xf0b/0x1e70
   pci_device_probe+0xab3/0xe70
   really_probe+0xd16/0x24d0
   driver_probe_device+0x29d/0x3a0
   device_driver_attach+0x25a/0x490
   __driver_attach+0x78c/0x840
   bus_for_each_dev+0x210/0x340
   driver_attach+0x89/0xb0
   bus_add_driver+0x677/0xc40
   driver_register+0x485/0x8e0
   __pci_register_driver+0x1ff/0x350
   vmci_guest_init+0x3e/0x41
   vmci_drv_init+0x1d6/0x43f
   do_one_initcall+0x39c/0x9a0
   do_initcall_level+0x1d7/0x259
   do_initcalls+0x127/0x1cb
   do_basic_setup+0x33/0x36
   kernel_init_freeable+0x29a/0x3ed
   kernel_init+0x1f/0x840
   ret_from_fork+0x1f/0x30

  Uninit was created at:
   kmsan_internal_poison_shadow+0x5c/0xf0
   kmsan_slab_alloc+0x8d/0xe0
   kmem_cache_alloc+0x84f/0xe30
   vmci_guest_probe_device+0xd11/0x1e70
   pci_device_probe+0xab3/0xe70
   really_probe+0xd16/0x24d0
   driver_probe_device+0x29d/0x3a0
   device_driver_attach+0x25a/0x490
   __driver_attach+0x78c/0x840
   bus_for_each_dev+0x210/0x340
   driver_attach+0x89/0xb0
   bus_add_driver+0x677/0xc40
   driver_register+0x485/0x8e0
   __pci_register_driver+0x1ff/0x350
   vmci_guest_init+0x3e/0x41
   vmci_drv_init+0x1d6/0x43f
   do_one_initcall+0x39c/0x9a0
   do_initcall_level+0x1d7/0x259
   do_initcalls+0x127/0x1cb
   do_basic_setup+0x33/0x36
   kernel_init_freeable+0x29a/0x3ed
   kernel_init+0x1f/0x840
   ret_from_fork+0x1f/0x30

  Bytes 28-31 of 36 are uninitialized
  Memory access of size 36 starts at ffff8881675e5f00
  =====================================================

Fixes: 1f166439917b69d3 ("VMCI: guest side driver implementation.")
Cc: <stable@vger.kernel.org>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Link: https://lore.kernel.org/r/20210402121742.3917-2-penguin-kernel@I-love.SAKURA.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/vmw_vmci/vmci_guest.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/vmw_vmci/vmci_guest.c b/drivers/misc/vmw_vmci/vmci_guest.c
index 189b32519748..9ac3659a5537 100644
--- a/drivers/misc/vmw_vmci/vmci_guest.c
+++ b/drivers/misc/vmw_vmci/vmci_guest.c
@@ -172,7 +172,7 @@ static int vmci_check_host_caps(struct pci_dev *pdev)
 				VMCI_UTIL_NUM_RESOURCES * sizeof(u32);
 	struct vmci_datagram *check_msg;
 
-	check_msg = kmalloc(msg_size, GFP_KERNEL);
+	check_msg = kzalloc(msg_size, GFP_KERNEL);
 	if (!check_msg) {
 		dev_err(&pdev->dev, "%s: Insufficient memory\n", __func__);
 		return -ENOMEM;

From 352fc2ce5a56ea6aa4a259fa42f26c4d4b2da014 Mon Sep 17 00:00:00 2001
From: Amey Telawane <ameyt@codeaurora.org>
Date: Wed, 3 May 2017 15:41:14 +0530
Subject: [PATCH 1960/2658] tracing: Use strlcpy() instead of strcpy() in
 __trace_find_cmdline()

commit e09e28671cda63e6308b31798b997639120e2a21 upstream.

Strcpy is inherently not safe, and strlcpy() should be used instead.
__trace_find_cmdline() uses strcpy() because the comms saved must have a
terminating nul character, but it doesn't hurt to add the extra protection
of using strlcpy() instead of strcpy().

Link: http://lkml.kernel.org/r/1493806274-13936-1-git-send-email-amit.pundir@linaro.org

Signed-off-by: Amey Telawane <ameyt@codeaurora.org>
[AmitP: Cherry-picked this commit from CodeAurora kernel/msm-3.10
https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=2161ae9a70b12cf18ac8e5952a20161ffbccb477]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
[ Updated change log and removed the "- 1" from len parameter ]
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 62e1befbad7f..cb73a1131f1f 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1646,7 +1646,7 @@ static void __trace_find_cmdline(int pid, char comm[])
 
 	map = savedcmd->map_pid_to_cmdline[pid];
 	if (map != NO_CMDLINE_MAP)
-		strlcpy(comm, get_saved_cmdlines(map), TASK_COMM_LEN - 1);
+		strlcpy(comm, get_saved_cmdlines(map), TASK_COMM_LEN);
 	else
 		strcpy(comm, "<...>");
 }

From 4067a54851f787dc52c515ec505cb83e80669846 Mon Sep 17 00:00:00 2001
From: Joel Fernandes <joelaf@google.com>
Date: Thu, 6 Jul 2017 16:00:21 -0700
Subject: [PATCH 1961/2658] tracing: Treat recording comm for idle task as a
 success

commit eaf260ac04d9b4cf9f458d5c97555bfff2da526e upstream.

Currently we stop recording comm for non-idle tasks when switching from/to idle
task since we treat that as a record failure. Fix that by treat recording of
comm for idle task as a success.

Link: http://lkml.kernel.org/r/20170706230023.17942-1-joelaf@google.com

Cc: kernel-team@android.com
Cc: Ingo Molnar <mingo@redhat.com>
Reported-by: Michael Sartain <mikesart@gmail.com>
Signed-off-by: Joel Fernandes <joelaf@google.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index cb73a1131f1f..fe40c95dfd6d 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1582,7 +1582,11 @@ static int trace_save_cmdline(struct task_struct *tsk)
 {
 	unsigned pid, idx;
 
-	if (!tsk->pid || unlikely(tsk->pid > PID_MAX_DEFAULT))
+	/* treat recording of idle task as a success */
+	if (!tsk->pid)
+		return 1;
+
+	if (unlikely(tsk->pid > PID_MAX_DEFAULT))
 		return 0;
 
 	preempt_disable();

From 1138c67423a972087f7f85698900667a07f8fc07 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Tue, 27 Apr 2021 11:32:07 -0400
Subject: [PATCH 1962/2658] tracing: Map all PIDs to command lines

commit 785e3c0a3a870e72dc530856136ab4c8dd207128 upstream.

The default max PID is set by PID_MAX_DEFAULT, and the tracing
infrastructure uses this number to map PIDs to the comm names of the
tasks, such output of the trace can show names from the recorded PIDs in
the ring buffer. This mapping is also exported to user space via the
"saved_cmdlines" file in the tracefs directory.

But currently the mapping expects the PIDs to be less than
PID_MAX_DEFAULT, which is the default maximum and not the real maximum.
Recently, systemd will increases the maximum value of a PID on the system,
and when tasks are traced that have a PID higher than PID_MAX_DEFAULT, its
comm is not recorded. This leads to the entire trace to have "<...>" as
the comm name, which is pretty useless.

Instead, keep the array mapping the size of PID_MAX_DEFAULT, but instead
of just mapping the index to the comm, map a mask of the PID
(PID_MAX_DEFAULT - 1) to the comm, and find the full PID from the
map_cmdline_to_pid array (that already exists).

This bug goes back to the beginning of ftrace, but hasn't been an issue
until user space started increasing the maximum value of PIDs.

Link: https://lkml.kernel.org/r/20210427113207.3c601884@gandalf.local.home

Cc: stable@vger.kernel.org
Fixes: bc0c38d139ec7 ("ftrace: latency tracer infrastructure")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace.c | 41 +++++++++++++++--------------------------
 1 file changed, 15 insertions(+), 26 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index fe40c95dfd6d..4fa248746dd8 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1580,14 +1580,13 @@ void trace_stop_cmdline_recording(void);
 
 static int trace_save_cmdline(struct task_struct *tsk)
 {
-	unsigned pid, idx;
+	unsigned tpid, idx;
 
 	/* treat recording of idle task as a success */
 	if (!tsk->pid)
 		return 1;
 
-	if (unlikely(tsk->pid > PID_MAX_DEFAULT))
-		return 0;
+	tpid = tsk->pid & (PID_MAX_DEFAULT - 1);
 
 	preempt_disable();
 	/*
@@ -1601,26 +1600,15 @@ static int trace_save_cmdline(struct task_struct *tsk)
 		return 0;
 	}
 
-	idx = savedcmd->map_pid_to_cmdline[tsk->pid];
+	idx = savedcmd->map_pid_to_cmdline[tpid];
 	if (idx == NO_CMDLINE_MAP) {
 		idx = (savedcmd->cmdline_idx + 1) % savedcmd->cmdline_num;
 
-		/*
-		 * Check whether the cmdline buffer at idx has a pid
-		 * mapped. We are going to overwrite that entry so we
-		 * need to clear the map_pid_to_cmdline. Otherwise we
-		 * would read the new comm for the old pid.
-		 */
-		pid = savedcmd->map_cmdline_to_pid[idx];
-		if (pid != NO_CMDLINE_MAP)
-			savedcmd->map_pid_to_cmdline[pid] = NO_CMDLINE_MAP;
-
-		savedcmd->map_cmdline_to_pid[idx] = tsk->pid;
-		savedcmd->map_pid_to_cmdline[tsk->pid] = idx;
-
+		savedcmd->map_pid_to_cmdline[tpid] = idx;
 		savedcmd->cmdline_idx = idx;
 	}
 
+	savedcmd->map_cmdline_to_pid[idx] = tsk->pid;
 	set_cmdline(idx, tsk->comm);
 	savedcmd->map_cmdline_to_tgid[idx] = tsk->tgid;
 	arch_spin_unlock(&trace_cmdline_lock);
@@ -1632,6 +1620,7 @@ static int trace_save_cmdline(struct task_struct *tsk)
 static void __trace_find_cmdline(int pid, char comm[])
 {
 	unsigned map;
+	int tpid;
 
 	if (!pid) {
 		strcpy(comm, "<idle>");
@@ -1643,16 +1632,16 @@ static void __trace_find_cmdline(int pid, char comm[])
 		return;
 	}
 
-	if (pid > PID_MAX_DEFAULT) {
-		strcpy(comm, "<...>");
-		return;
+	tpid = pid & (PID_MAX_DEFAULT - 1);
+	map = savedcmd->map_pid_to_cmdline[tpid];
+	if (map != NO_CMDLINE_MAP) {
+		tpid = savedcmd->map_cmdline_to_pid[map];
+		if (tpid == pid) {
+			strlcpy(comm, get_saved_cmdlines(map), TASK_COMM_LEN);
+			return;
+		}
 	}
-
-	map = savedcmd->map_pid_to_cmdline[pid];
-	if (map != NO_CMDLINE_MAP)
-		strlcpy(comm, get_saved_cmdlines(map), TASK_COMM_LEN);
-	else
-		strcpy(comm, "<...>");
+	strcpy(comm, "<...>");
 }
 
 void trace_find_cmdline(int pid, char comm[])

From 1a42de8f8e6e5848bc2035ceceee91c65a41b20e Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Fri, 30 Apr 2021 12:17:58 -0400
Subject: [PATCH 1963/2658] tracing: Restructure trace_clock_global() to never
 block

commit aafe104aa9096827a429bc1358f8260ee565b7cc upstream.

It was reported that a fix to the ring buffer recursion detection would
cause a hung machine when performing suspend / resume testing. The
following backtrace was extracted from debugging that case:

Call Trace:
 trace_clock_global+0x91/0xa0
 __rb_reserve_next+0x237/0x460
 ring_buffer_lock_reserve+0x12a/0x3f0
 trace_buffer_lock_reserve+0x10/0x50
 __trace_graph_return+0x1f/0x80
 trace_graph_return+0xb7/0xf0
 ? trace_clock_global+0x91/0xa0
 ftrace_return_to_handler+0x8b/0xf0
 ? pv_hash+0xa0/0xa0
 return_to_handler+0x15/0x30
 ? ftrace_graph_caller+0xa0/0xa0
 ? trace_clock_global+0x91/0xa0
 ? __rb_reserve_next+0x237/0x460
 ? ring_buffer_lock_reserve+0x12a/0x3f0
 ? trace_event_buffer_lock_reserve+0x3c/0x120
 ? trace_event_buffer_reserve+0x6b/0xc0
 ? trace_event_raw_event_device_pm_callback_start+0x125/0x2d0
 ? dpm_run_callback+0x3b/0xc0
 ? pm_ops_is_empty+0x50/0x50
 ? platform_get_irq_byname_optional+0x90/0x90
 ? trace_device_pm_callback_start+0x82/0xd0
 ? dpm_run_callback+0x49/0xc0

With the following RIP:

RIP: 0010:native_queued_spin_lock_slowpath+0x69/0x200

Since the fix to the recursion detection would allow a single recursion to
happen while tracing, this lead to the trace_clock_global() taking a spin
lock and then trying to take it again:

ring_buffer_lock_reserve() {
  trace_clock_global() {
    arch_spin_lock() {
      queued_spin_lock_slowpath() {
        /* lock taken */
        (something else gets traced by function graph tracer)
          ring_buffer_lock_reserve() {
            trace_clock_global() {
              arch_spin_lock() {
                queued_spin_lock_slowpath() {
                /* DEAD LOCK! */

Tracing should *never* block, as it can lead to strange lockups like the
above.

Restructure the trace_clock_global() code to instead of simply taking a
lock to update the recorded "prev_time" simply use it, as two events
happening on two different CPUs that calls this at the same time, really
doesn't matter which one goes first. Use a trylock to grab the lock for
updating the prev_time, and if it fails, simply try again the next time.
If it failed to be taken, that means something else is already updating
it.

Link: https://lkml.kernel.org/r/20210430121758.650b6e8a@gandalf.local.home

Cc: stable@vger.kernel.org
Tested-by: Konstantin Kharlamov <hi-angel@yandex.ru>
Tested-by: Todd Brandt <todd.e.brandt@linux.intel.com>
Fixes: b02414c8f045 ("ring-buffer: Fix recursion protection transitions between interrupt context") # started showing the problem
Fixes: 14131f2f98ac3 ("tracing: implement trace_clock_*() APIs") # where the bug happened
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=212761
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace_clock.c | 44 ++++++++++++++++++++++++++------------
 1 file changed, 30 insertions(+), 14 deletions(-)

diff --git a/kernel/trace/trace_clock.c b/kernel/trace/trace_clock.c
index 0f06532a755b..b67ea5eed2a8 100644
--- a/kernel/trace/trace_clock.c
+++ b/kernel/trace/trace_clock.c
@@ -93,33 +93,49 @@ u64 notrace trace_clock_global(void)
 {
 	unsigned long flags;
 	int this_cpu;
-	u64 now;
+	u64 now, prev_time;
 
 	local_irq_save(flags);
 
 	this_cpu = raw_smp_processor_id();
-	now = sched_clock_cpu(this_cpu);
+
 	/*
-	 * If in an NMI context then dont risk lockups and return the
-	 * cpu_clock() time:
+	 * The global clock "guarantees" that the events are ordered
+	 * between CPUs. But if two events on two different CPUS call
+	 * trace_clock_global at roughly the same time, it really does
+	 * not matter which one gets the earlier time. Just make sure
+	 * that the same CPU will always show a monotonic clock.
+	 *
+	 * Use a read memory barrier to get the latest written
+	 * time that was recorded.
 	 */
-	if (unlikely(in_nmi()))
-		goto out;
+	smp_rmb();
+	prev_time = READ_ONCE(trace_clock_struct.prev_time);
+	now = sched_clock_cpu(this_cpu);
 
-	arch_spin_lock(&trace_clock_struct.lock);
+	/* Make sure that now is always greater than prev_time */
+	if ((s64)(now - prev_time) < 0)
+		now = prev_time + 1;
 
 	/*
-	 * TODO: if this happens often then maybe we should reset
-	 * my_scd->clock to prev_time+1, to make sure
-	 * we start ticking with the local clock from now on?
+	 * If in an NMI context then dont risk lockups and simply return
+	 * the current time.
 	 */
-	if ((s64)(now - trace_clock_struct.prev_time) < 0)
-		now = trace_clock_struct.prev_time + 1;
+	if (unlikely(in_nmi()))
+		goto out;
 
-	trace_clock_struct.prev_time = now;
+	/* Tracing can cause strange recursion, always use a try lock */
+	if (arch_spin_trylock(&trace_clock_struct.lock)) {
+		/* Reread prev_time in case it was already updated */
+		prev_time = READ_ONCE(trace_clock_struct.prev_time);
+		if ((s64)(now - prev_time) < 0)
+			now = prev_time + 1;
 
-	arch_spin_unlock(&trace_clock_struct.lock);
+		trace_clock_struct.prev_time = now;
 
+		/* The unlock acts as the wmb for the above rmb */
+		arch_spin_unlock(&trace_clock_struct.lock);
+	}
  out:
 	local_irq_restore(flags);
 

From c94627fdc24b4611d55e4504448f0fcbaab994d9 Mon Sep 17 00:00:00 2001
From: Christoph Hellwig <hch@lst.de>
Date: Sat, 3 Apr 2021 18:15:28 +0200
Subject: [PATCH 1964/2658] md: factor out a mddev_find_locked helper from
 mddev_find

commit 8b57251f9a91f5e5a599de7549915d2d226cc3af upstream.

Factor out a self-contained helper to just lookup a mddev by the dev_t
"unit".

Cc: stable@vger.kernel.org
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/md.c | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 60161690e226..d07f38e0d158 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -515,6 +515,17 @@ void mddev_init(struct mddev *mddev)
 }
 EXPORT_SYMBOL_GPL(mddev_init);
 
+static struct mddev *mddev_find_locked(dev_t unit)
+{
+	struct mddev *mddev;
+
+	list_for_each_entry(mddev, &all_mddevs, all_mddevs)
+		if (mddev->unit == unit)
+			return mddev;
+
+	return NULL;
+}
+
 static struct mddev *mddev_find(dev_t unit)
 {
 	struct mddev *mddev, *new = NULL;
@@ -526,13 +537,13 @@ static struct mddev *mddev_find(dev_t unit)
 	spin_lock(&all_mddevs_lock);
 
 	if (unit) {
-		list_for_each_entry(mddev, &all_mddevs, all_mddevs)
-			if (mddev->unit == unit) {
-				mddev_get(mddev);
-				spin_unlock(&all_mddevs_lock);
-				kfree(new);
-				return mddev;
-			}
+		mddev = mddev_find_locked(unit);
+		if (mddev) {
+			mddev_get(mddev);
+			spin_unlock(&all_mddevs_lock);
+			kfree(new);
+			return mddev;
+		}
 
 		if (new) {
 			list_add(&new->all_mddevs, &all_mddevs);
@@ -558,12 +569,7 @@ static struct mddev *mddev_find(dev_t unit)
 				return NULL;
 			}
 
-			is_free = 1;
-			list_for_each_entry(mddev, &all_mddevs, all_mddevs)
-				if (mddev->unit == dev) {
-					is_free = 0;
-					break;
-				}
+			is_free = !mddev_find_locked(dev);
 		}
 		new->unit = dev;
 		new->md_minor = MINOR(dev);

From 48fd17189123253bfe27a9f7ef8213cf192d1534 Mon Sep 17 00:00:00 2001
From: Zhao Heming <heming.zhao@suse.com>
Date: Sat, 3 Apr 2021 11:01:25 +0800
Subject: [PATCH 1965/2658] md: md_open returns -EBUSY when entering racing
 area

commit 6a4db2a60306eb65bfb14ccc9fde035b74a4b4e7 upstream.

commit d3374825ce57 ("md: make devices disappear when they are no longer
needed.") introduced protection between mddev creating & removing. The
md_open shouldn't create mddev when all_mddevs list doesn't contain
mddev. With currently code logic, there will be very easy to trigger
soft lockup in non-preempt env.

This patch changes md_open returning from -ERESTARTSYS to -EBUSY, which
will break the infinitely retry when md_open enter racing area.

This patch is partly fix soft lockup issue, full fix needs mddev_find
is split into two functions: mddev_find & mddev_find_or_alloc. And
md_open should call new mddev_find (it only does searching job).

For more detail, please refer with Christoph's "split mddev_find" patch
in later commits.

*** env ***
kvm-qemu VM 2C1G with 2 iscsi luns
kernel should be non-preempt

*** script ***

about trigger every time with below script

```
1  node1="mdcluster1"
2  node2="mdcluster2"
3
4  mdadm -Ss
5  ssh ${node2} "mdadm -Ss"
6  wipefs -a /dev/sda /dev/sdb
7  mdadm -CR /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sda \
   /dev/sdb --assume-clean
8
9  for i in {1..10}; do
10    echo ==== $i ====;
11
12    echo "test  ...."
13    ssh ${node2} "mdadm -A /dev/md0 /dev/sda /dev/sdb"
14    sleep 1
15
16    echo "clean  ....."
17    ssh ${node2} "mdadm -Ss"
18 done
```

I use mdcluster env to trigger soft lockup, but it isn't mdcluster
speical bug. To stop md array in mdcluster env will do more jobs than
non-cluster array, which will leave enough time/gap to allow kernel to
run md_open.

*** stack ***

```
[  884.226509]  mddev_put+0x1c/0xe0 [md_mod]
[  884.226515]  md_open+0x3c/0xe0 [md_mod]
[  884.226518]  __blkdev_get+0x30d/0x710
[  884.226520]  ? bd_acquire+0xd0/0xd0
[  884.226522]  blkdev_get+0x14/0x30
[  884.226524]  do_dentry_open+0x204/0x3a0
[  884.226531]  path_openat+0x2fc/0x1520
[  884.226534]  ? seq_printf+0x4e/0x70
[  884.226536]  do_filp_open+0x9b/0x110
[  884.226542]  ? md_release+0x20/0x20 [md_mod]
[  884.226543]  ? seq_read+0x1d8/0x3e0
[  884.226545]  ? kmem_cache_alloc+0x18a/0x270
[  884.226547]  ? do_sys_open+0x1bd/0x260
[  884.226548]  do_sys_open+0x1bd/0x260
[  884.226551]  do_syscall_64+0x5b/0x1e0
[  884.226554]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
```

*** rootcause ***

"mdadm -A" (or other array assemble commands) will start a daemon "mdadm
--monitor" by default. When "mdadm -Ss" is running, the stop action will
wakeup "mdadm --monitor". The "--monitor" daemon will immediately get
info from /proc/mdstat. This time mddev in kernel still exist, so
/proc/mdstat still show md device, which makes "mdadm --monitor" to open
/dev/md0.

The previously "mdadm -Ss" is removing action, the "mdadm --monitor"
open action will trigger md_open which is creating action. Racing is
happening.

```
<thread 1>: "mdadm -Ss"
md_release
  mddev_put deletes mddev from all_mddevs
  queue_work for mddev_delayed_delete
  at this time, "/dev/md0" is still available for opening

<thread 2>: "mdadm --monitor ..."
md_open
 + mddev_find can't find mddev of /dev/md0, and create a new mddev and
 |    return.
 + trigger "if (mddev->gendisk != bdev->bd_disk)" and return
      -ERESTARTSYS.
```

In non-preempt kernel, <thread 2> is occupying on current CPU. and
mddev_delayed_delete which was created in <thread 1> also can't be
schedule.

In preempt kernel, it can also trigger above racing. But kernel doesn't
allow one thread running on a CPU all the time. after <thread 2> running
some time, the later "mdadm -A" (refer above script line 13) will call
md_alloc to alloc a new gendisk for mddev. it will break md_open
statement "if (mddev->gendisk != bdev->bd_disk)" and return 0 to caller,
the soft lockup is broken.

Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Zhao Heming <heming.zhao@suse.com>
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/md.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index d07f38e0d158..11e21415bf7e 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7046,8 +7046,7 @@ static int md_open(struct block_device *bdev, fmode_t mode)
 		/* Wait until bdev->bd_disk is definitely gone */
 		if (work_pending(&mddev->del_work))
 			flush_workqueue(md_misc_wq);
-		/* Then retry the open from the top */
-		return -ERESTARTSYS;
+		return -EBUSY;
 	}
 	BUG_ON(mddev != bdev->bd_disk->private_data);
 

From 258fd7346ff71762c5f942527fe3c80428314e16 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 14 Apr 2021 11:29:55 +0300
Subject: [PATCH 1966/2658] ipw2x00: potential buffer overflow in
 libipw_wx_set_encodeext()

commit 260a9ad9446723d4063ed802989758852809714d upstream.

The "ext->key_len" is a u16 that comes from the user.  If it's over
SCM_KEY_LEN (32) that could lead to memory corruption.

Fixes: e0d369d1d969 ("[PATCH] ieee82011: Added WE-18 support to default wireless extension handler")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Stanislav Yakovlev <stas.yakovlev@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/YHaoA1i+8uT4ir4h@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ipw2x00/libipw_wx.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ipw2x00/libipw_wx.c b/drivers/net/wireless/ipw2x00/libipw_wx.c
index dd29f46d086b..028b37ba9425 100644
--- a/drivers/net/wireless/ipw2x00/libipw_wx.c
+++ b/drivers/net/wireless/ipw2x00/libipw_wx.c
@@ -649,8 +649,10 @@ int libipw_wx_set_encodeext(struct libipw_device *ieee,
 	}
 
 	if (ext->alg != IW_ENCODE_ALG_NONE) {
-		memcpy(sec.keys[idx], ext->key, ext->key_len);
-		sec.key_sizes[idx] = ext->key_len;
+		int key_len = clamp_val(ext->key_len, 0, SCM_KEY_LEN);
+
+		memcpy(sec.keys[idx], ext->key, key_len);
+		sec.key_sizes[idx] = key_len;
 		sec.flags |= (1 << idx);
 		if (ext->alg == IW_ENCODE_ALG_WEP) {
 			sec.encode_alg[idx] = SEC_ALG_WEP;

From 780bd26b7387baf837f76043cc217e82684e15cf Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Fri, 16 Apr 2021 09:42:14 +0200
Subject: [PATCH 1967/2658] cfg80211: scan: drop entry from hidden_list on
 overflow

commit 010bfbe768f7ecc876ffba92db30432de4997e2a upstream.

If we overflow the maximum number of BSS entries and free the
new entry, drop it from any hidden_list that it may have been
added to in the code above or in cfg80211_combine_bsses().

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20210416094212.5de7d1676ad7.Ied283b0bc5f504845e7d6ab90626bdfa68bb3dc0@changeid
Cc: stable@vger.kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/wireless/scan.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index a6451bf9a717..79ff22d3b225 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -954,6 +954,8 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev,
 
 		if (rdev->bss_entries >= bss_entries_limit &&
 		    !cfg80211_bss_expire_oldest(rdev)) {
+			if (!list_empty(&new->hidden_list))
+				list_del(&new->hidden_list);
 			kfree(new);
 			goto drop;
 		}

From 7d1804bf289b6f83ce8015c7a8ea17f7bf5a413a Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Wed, 3 Mar 2021 00:27:59 +0000
Subject: [PATCH 1968/2658] drm/radeon: fix copy of uninitialized variable back
 to userspace
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 8dbc2ccac5a65c5b57e3070e36a3dc97c7970d96 upstream.

Currently the ioctl command RADEON_INFO_SI_BACKEND_ENABLED_MASK can
copy back uninitialised data in value_tmp that pointer *value points
to. This can occur when rdev->family is less than CHIP_BONAIRE and
less than CHIP_TAHITI.  Fix this by adding in a missing -EINVAL
so that no invalid value is copied back to userspace.

Addresses-Coverity: ("Uninitialized scalar variable)
Cc: stable@vger.kernel.org # 3.13+
Fixes: 439a1cfffe2c ("drm/radeon: expose render backend mask to the userspace")
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/radeon/radeon_kms.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 41caf7da9054..6168ada4e3ad 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -503,6 +503,7 @@ static int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file
 			*value = rdev->config.si.backend_enable_mask;
 		} else {
 			DRM_DEBUG_KMS("BACKEND_ENABLED_MASK is si+ only!\n");
+			return -EINVAL;
 		}
 		break;
 	case RADEON_INFO_MAX_SCLK:

From 6a159c7d3c5007428d6be3c0dbddc7a4faced11f Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 28 Apr 2021 13:26:52 +0200
Subject: [PATCH 1969/2658] ALSA: hda/realtek: Re-order ALC882 Acer quirk table
 entries

commit b265047ac56bad8c4f3d0c8bf9cb4e828ee0d28e upstream.

Just re-order the alc882_fixup_tbl[] entries for Acer devices for
avoiding the oversight of the duplicated or unapplied item in future.
No functional changes.

Also Cc-to-stable for the further patch applications.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210428112704.23967-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 51163309c875..e7ceff391542 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2226,13 +2226,13 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
 		      ALC882_FIXUP_ACER_ASPIRE_8930G),
 	SND_PCI_QUIRK(0x1025, 0x0146, "Acer Aspire 6935G",
 		      ALC882_FIXUP_ACER_ASPIRE_8930G),
+	SND_PCI_QUIRK(0x1025, 0x0142, "Acer Aspire 7730G",
+		      ALC882_FIXUP_ACER_ASPIRE_4930G),
+	SND_PCI_QUIRK(0x1025, 0x0155, "Packard-Bell M5120", ALC882_FIXUP_PB_M5210),
 	SND_PCI_QUIRK(0x1025, 0x015e, "Acer Aspire 6930G",
 		      ALC882_FIXUP_ACER_ASPIRE_4930G),
 	SND_PCI_QUIRK(0x1025, 0x0166, "Acer Aspire 6530G",
 		      ALC882_FIXUP_ACER_ASPIRE_4930G),
-	SND_PCI_QUIRK(0x1025, 0x0142, "Acer Aspire 7730G",
-		      ALC882_FIXUP_ACER_ASPIRE_4930G),
-	SND_PCI_QUIRK(0x1025, 0x0155, "Packard-Bell M5120", ALC882_FIXUP_PB_M5210),
 	SND_PCI_QUIRK(0x1025, 0x021e, "Acer Aspire 5739G",
 		      ALC882_FIXUP_ACER_ASPIRE_4930G),
 	SND_PCI_QUIRK(0x1025, 0x0259, "Acer Aspire 5935", ALC889_FIXUP_DAC_ROUTE),

From 70a864540a96ab7d902aa471969365dfef4e41ff Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 28 Apr 2021 13:26:53 +0200
Subject: [PATCH 1970/2658] ALSA: hda/realtek: Re-order ALC882 Sony quirk table
 entries

commit b7529c18feecb1af92f9db08c8e7fe446a82d96d upstream.

Just re-order the alc882_fixup_tbl[] entries for Sony devices for
avoiding the oversight of the duplicated or unapplied item in future.
No functional changes.

Also Cc-to-stable for the further patch applications.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210428112704.23967-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index e7ceff391542..d18d20e345d7 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2244,11 +2244,11 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
 	SND_PCI_QUIRK(0x1043, 0x84bc, "ASUS ET2700", ALC887_FIXUP_ASUS_BASS),
 	SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3),
+	SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
+	SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP),
 	SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
 	SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
 	SND_PCI_QUIRK(0x104d, 0x9060, "Sony Vaio VPCL14M1R", ALC882_FIXUP_NO_PRIMARY_HP),
-	SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
-	SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP),
 
 	/* All Apple entries are in codec SSIDs */
 	SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF),

From a0e15433bb8d241c82dcf4a9b3dbe89b00ab1088 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 28 Apr 2021 13:26:59 +0200
Subject: [PATCH 1971/2658] ALSA: hda/realtek: Re-order ALC269 Sony quirk table
 entries

commit cab561f8d4bc9b196ae20c960aa5da89fd786ab5 upstream.

Just re-order the alc269_fixup_tbl[] entries for Sony devices for
avoiding the oversight of the duplicated or unapplied item in future.
No functional changes.

Also Cc-to-stable for the further patch applications.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210428112704.23967-9-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index d18d20e345d7..cca7bbe605f6 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5764,12 +5764,12 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
 	SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
 	SND_PCI_QUIRK(0x1043, 0x8516, "ASUS X101CH", ALC269_FIXUP_ASUS_X101),
-	SND_PCI_QUIRK(0x104d, 0x90b5, "Sony VAIO Pro 11", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
-	SND_PCI_QUIRK(0x104d, 0x90b6, "Sony VAIO Pro 13", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x104d, 0x9073, "Sony VAIO", ALC275_FIXUP_SONY_VAIO_GPIO2),
 	SND_PCI_QUIRK(0x104d, 0x907b, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
 	SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
 	SND_PCI_QUIRK(0x104d, 0x9099, "Sony VAIO S13", ALC275_FIXUP_SONY_DISABLE_AAMIX),
+	SND_PCI_QUIRK(0x104d, 0x90b5, "Sony VAIO Pro 11", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x104d, 0x90b6, "Sony VAIO Pro 13", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
 	SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT),
 	SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),

From 09aecb700092e41327125e57316cd81b1385c203 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 28 Apr 2021 13:27:03 +0200
Subject: [PATCH 1972/2658] ALSA: hda/realtek: Remove redundant entry for
 ALC861 Haier/Uniwill devices

commit defce244b01ee12534910a4544e11be5eb927d25 upstream.

The quirk entry for Uniwill ECS M31EI is with the PCI SSID device 0,
which means matching with all.  That is, it's essentially equivalent
with SND_PCI_QUIRK_VENDOR(0x1584), which also matches with the
previous entry for Haier W18 applying the very same quirk.

Let's unify them with the single vendor-quirk entry.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210428112704.23967-13-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index cca7bbe605f6..583c7dd9aa39 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6491,8 +6491,7 @@ static const struct snd_pci_quirk alc861_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1043, 0x1393, "ASUS A6Rp", ALC861_FIXUP_ASUS_A6RP),
 	SND_PCI_QUIRK_VENDOR(0x1043, "ASUS laptop", ALC861_FIXUP_AMP_VREF_0F),
 	SND_PCI_QUIRK(0x1462, 0x7254, "HP DX2200", ALC861_FIXUP_NO_JACK_DETECT),
-	SND_PCI_QUIRK(0x1584, 0x2b01, "Haier W18", ALC861_FIXUP_AMP_VREF_0F),
-	SND_PCI_QUIRK(0x1584, 0x0000, "Uniwill ECS M31EI", ALC861_FIXUP_AMP_VREF_0F),
+	SND_PCI_QUIRK_VENDOR(0x1584, "Haier/Uniwill", ALC861_FIXUP_AMP_VREF_0F),
 	SND_PCI_QUIRK(0x1734, 0x10c7, "FSC Amilo Pi1505", ALC861_FIXUP_FSC_AMILO_PI1505),
 	{}
 };

From beb30c4be0ce47abad8df4a56fce789c89a3c8ff Mon Sep 17 00:00:00 2001
From: Claudio Imbrenda <imbrenda@linux.ibm.com>
Date: Mon, 22 Mar 2021 15:05:58 +0100
Subject: [PATCH 1973/2658] KVM: s390: split kvm_s390_real_to_abs

commit c5d1f6b531e68888cbe6718b3f77a60115d58b9c upstream.

A new function _kvm_s390_real_to_abs will apply prefixing to a real address
with a given prefix value.

The old kvm_s390_real_to_abs becomes now a wrapper around the new function.

This is needed to avoid code duplication in vSIE.

Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210322140559.500716-2-imbrenda@linux.ibm.com
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/kvm/gaccess.h | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/arch/s390/kvm/gaccess.h b/arch/s390/kvm/gaccess.h
index ef03726cc661..1593133c8c88 100644
--- a/arch/s390/kvm/gaccess.h
+++ b/arch/s390/kvm/gaccess.h
@@ -21,17 +21,14 @@
 
 /**
  * kvm_s390_real_to_abs - convert guest real address to guest absolute address
- * @vcpu - guest virtual cpu
+ * @prefix - guest prefix
  * @gra - guest real address
  *
  * Returns the guest absolute address that corresponds to the passed guest real
- * address @gra of a virtual guest cpu by applying its prefix.
+ * address @gra of by applying the given prefix.
  */
-static inline unsigned long kvm_s390_real_to_abs(struct kvm_vcpu *vcpu,
-						 unsigned long gra)
+static inline unsigned long _kvm_s390_real_to_abs(u32 prefix, unsigned long gra)
 {
-	unsigned long prefix  = kvm_s390_get_prefix(vcpu);
-
 	if (gra < 2 * PAGE_SIZE)
 		gra += prefix;
 	else if (gra >= prefix && gra < prefix + 2 * PAGE_SIZE)
@@ -39,6 +36,20 @@ static inline unsigned long kvm_s390_real_to_abs(struct kvm_vcpu *vcpu,
 	return gra;
 }
 
+/**
+ * kvm_s390_real_to_abs - convert guest real address to guest absolute address
+ * @vcpu - guest virtual cpu
+ * @gra - guest real address
+ *
+ * Returns the guest absolute address that corresponds to the passed guest real
+ * address @gra of a virtual guest cpu by applying its prefix.
+ */
+static inline unsigned long kvm_s390_real_to_abs(struct kvm_vcpu *vcpu,
+						 unsigned long gra)
+{
+	return _kvm_s390_real_to_abs(kvm_s390_get_prefix(vcpu), gra);
+}
+
 /**
  * kvm_s390_logical_to_effective - convert guest logical to effective address
  * @vcpu: guest virtual cpu

From 5bbc2711319ee3af703454755b688534a346c436 Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Tue, 23 Mar 2021 17:36:24 +0200
Subject: [PATCH 1974/2658] usb: gadget: pch_udc: Revert d3cb25a12138
 completely

commit 50a318cc9b54a36f00beadf77e578a50f3620477 upstream.

The commit d3cb25a12138 ("usb: gadget: udc: fix spin_lock in pch_udc")
obviously was not thought through and had made the situation even worse
than it was before. Two changes after almost reverted it. but a few
leftovers have been left as it. With this revert d3cb25a12138 completely.

While at it, narrow down the scope of unlocked section to prevent
potential race when prot_stall is assigned.

Fixes: d3cb25a12138 ("usb: gadget: udc: fix spin_lock in pch_udc")
Fixes: 9903b6bedd38 ("usb: gadget: pch-udc: fix lock")
Fixes: 1d23d16a88e6 ("usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock")
Cc: Iago Abal <mail@iagoabal.eu>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20210323153626.54908-5-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/udc/pch_udc.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
index 3fd603494e86..f4b81e8f2272 100644
--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -615,18 +615,22 @@ static void pch_udc_reconnect(struct pch_udc_dev *dev)
 static inline void pch_udc_vbus_session(struct pch_udc_dev *dev,
 					  int is_active)
 {
+	unsigned long		iflags;
+
+	spin_lock_irqsave(&dev->lock, iflags);
 	if (is_active) {
 		pch_udc_reconnect(dev);
 		dev->vbus_session = 1;
 	} else {
 		if (dev->driver && dev->driver->disconnect) {
-			spin_lock(&dev->lock);
+			spin_unlock_irqrestore(&dev->lock, iflags);
 			dev->driver->disconnect(&dev->gadget);
-			spin_unlock(&dev->lock);
+			spin_lock_irqsave(&dev->lock, iflags);
 		}
 		pch_udc_set_disconnect(dev);
 		dev->vbus_session = 0;
 	}
+	spin_unlock_irqrestore(&dev->lock, iflags);
 }
 
 /**
@@ -1183,20 +1187,25 @@ static int pch_udc_pcd_selfpowered(struct usb_gadget *gadget, int value)
 static int pch_udc_pcd_pullup(struct usb_gadget *gadget, int is_on)
 {
 	struct pch_udc_dev	*dev;
+	unsigned long		iflags;
 
 	if (!gadget)
 		return -EINVAL;
+
 	dev = container_of(gadget, struct pch_udc_dev, gadget);
+
+	spin_lock_irqsave(&dev->lock, iflags);
 	if (is_on) {
 		pch_udc_reconnect(dev);
 	} else {
 		if (dev->driver && dev->driver->disconnect) {
-			spin_lock(&dev->lock);
+			spin_unlock_irqrestore(&dev->lock, iflags);
 			dev->driver->disconnect(&dev->gadget);
-			spin_unlock(&dev->lock);
+			spin_lock_irqsave(&dev->lock, iflags);
 		}
 		pch_udc_set_disconnect(dev);
 	}
+	spin_unlock_irqrestore(&dev->lock, iflags);
 
 	return 0;
 }

From 20ec8192f20f93ba81b30e7f6b92db38793164af Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Tue, 23 Feb 2021 19:38:21 +0000
Subject: [PATCH 1975/2658] memory: gpmc: fix out of bounds read and
 dereference on gpmc_cs[]

[ Upstream commit e004c3e67b6459c99285b18366a71af467d869f5 ]

Currently the array gpmc_cs is indexed by cs before it cs is range checked
and the pointer read from this out-of-index read is dereferenced. Fix this
by performing the range check on cs before the read and the following
pointer dereference.

Addresses-Coverity: ("Negative array index read")
Fixes: 9ed7a776eb50 ("ARM: OMAP2+: Fix support for multiple devices on a GPMC chip select")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20210223193821.17232-1-colin.king@canonical.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/omap-gpmc.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index af187c91fc33..f6d06d894538 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -1005,8 +1005,8 @@ EXPORT_SYMBOL(gpmc_cs_request);
 
 void gpmc_cs_free(int cs)
 {
-	struct gpmc_cs_data *gpmc = &gpmc_cs[cs];
-	struct resource *res = &gpmc->mem;
+	struct gpmc_cs_data *gpmc;
+	struct resource *res;
 
 	spin_lock(&gpmc_mem_lock);
 	if (cs >= gpmc_cs_num || cs < 0 || !gpmc_cs_reserved(cs)) {
@@ -1015,6 +1015,9 @@ void gpmc_cs_free(int cs)
 		spin_unlock(&gpmc_mem_lock);
 		return;
 	}
+	gpmc = &gpmc_cs[cs];
+	res = &gpmc->mem;
+
 	gpmc_cs_disable_mem(cs);
 	if (res->flags)
 		release_resource(res);

From a8d38eabc03eb03a78f62fa34dcdb4ceff3aa5f8 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Thu, 10 Dec 2020 22:25:24 +0100
Subject: [PATCH 1976/2658] ARM: dts: exynos: correct PMIC interrupt trigger
 level on SMDK5250

[ Upstream commit f6368c60561370e4a92fac22982a3bd656172170 ]

The Maxim PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU.  Without specifying the
interrupt type in Devicetree, kernel might apply some fixed
configuration, not necessarily working for this hardware.

Additionally, the interrupt line is shared so using level sensitive
interrupt is here especially important to avoid races.

Fixes: 47580e8d94c2 ("ARM: dts: Specify MAX77686 pmic interrupt for exynos5250-smdk5250")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201210212534.216197-8-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos5250-smdk5250.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts
index 0f5dcd418af8..97b152e43f9c 100644
--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts
+++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts
@@ -134,7 +134,7 @@
 		compatible = "maxim,max77686";
 		reg = <0x09>;
 		interrupt-parent = <&gpx3>;
-		interrupts = <2 IRQ_TYPE_NONE>;
+		interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&max77686_irq>;
 		wakeup-source;

From 74baf4144d666791f01e5ce5d6085ac7f1dc2313 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzk@kernel.org>
Date: Thu, 10 Dec 2020 22:25:25 +0100
Subject: [PATCH 1977/2658] ARM: dts: exynos: correct PMIC interrupt trigger
 level on Snow

[ Upstream commit 8987efbb17c2522be8615085df9a14da2ab53d34 ]

The Maxim PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU.  Without specifying the
interrupt type in Devicetree, kernel might apply some fixed
configuration, not necessarily working for this hardware.

Additionally, the interrupt line is shared so using level sensitive
interrupt is here especially important to avoid races.

Fixes: c61248afa819 ("ARM: dts: Add max77686 RTC interrupt to cros5250-common")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201210212534.216197-9-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos5250-snow-common.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos5250-snow-common.dtsi b/arch/arm/boot/dts/exynos5250-snow-common.dtsi
index 0a7f408824d8..b45ad99da8c5 100644
--- a/arch/arm/boot/dts/exynos5250-snow-common.dtsi
+++ b/arch/arm/boot/dts/exynos5250-snow-common.dtsi
@@ -281,7 +281,7 @@
 	max77686: max77686@09 {
 		compatible = "maxim,max77686";
 		interrupt-parent = <&gpx3>;
-		interrupts = <2 IRQ_TYPE_NONE>;
+		interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&max77686_irq>;
 		wakeup-source;

From 0353cdc0b309b1931af02a9c86774f88666d08f9 Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Tue, 23 Mar 2021 17:36:20 +0200
Subject: [PATCH 1978/2658] usb: gadget: pch_udc: Replace cpu_to_le32() by
 lower_32_bits()

[ Upstream commit 91356fed6afd1c83bf0d3df1fc336d54e38f0458 ]

Either way ~0 will be in the correct byte order, hence
replace cpu_to_le32() by lower_32_bits(). Moreover,
it makes sparse happy, otherwise it complains:

.../pch_udc.c:1813:27: warning: incorrect type in assignment (different base types)
.../pch_udc.c:1813:27:    expected unsigned int [usertype] dataptr
.../pch_udc.c:1813:27:    got restricted __le32 [usertype]

Fixes: f646cf94520e ("USB device driver of Topcliff PCH")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20210323153626.54908-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/pch_udc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
index f4b81e8f2272..6e84b27c14dd 100644
--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -1797,7 +1797,7 @@ static struct usb_request *pch_udc_alloc_request(struct usb_ep *usbep,
 	}
 	/* prevent from using desc. - set HOST BUSY */
 	dma_desc->status |= PCH_UDC_BS_HST_BSY;
-	dma_desc->dataptr = cpu_to_le32(DMA_ADDR_INVALID);
+	dma_desc->dataptr = lower_32_bits(DMA_ADDR_INVALID);
 	req->td_data = dma_desc;
 	req->td_data_last = dma_desc;
 	req->chain_len = 1;

From 4f1240d595cd04cc3b7fd0d9f948b8dcf79911bd Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Tue, 23 Mar 2021 17:36:21 +0200
Subject: [PATCH 1979/2658] usb: gadget: pch_udc: Check if driver is present
 before calling ->setup()

[ Upstream commit fbdbbe6d3ee502b3bdeb4f255196bb45003614be ]

Since we have a separate routine for VBUS sense, the interrupt may occur
before gadget driver is present. Hence, ->setup() call may oops the kernel:

[   55.245843] BUG: kernel NULL pointer dereference, address: 00000010
...
[   55.245843] EIP: pch_udc_isr.cold+0x162/0x33f
...
[   55.245843]  <IRQ>
[   55.245843]  ? pch_udc_svc_data_out+0x160/0x160

Check if driver is present before calling ->setup().

Fixes: f646cf94520e ("USB device driver of Topcliff PCH")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20210323153626.54908-2-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/pch_udc.c | 28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
index 6e84b27c14dd..152c2ee0ca50 100644
--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -2341,6 +2341,21 @@ static void pch_udc_svc_data_out(struct pch_udc_dev *dev, int ep_num)
 		pch_udc_set_dma(dev, DMA_DIR_RX);
 }
 
+static int pch_udc_gadget_setup(struct pch_udc_dev *dev)
+	__must_hold(&dev->lock)
+{
+	int rc;
+
+	/* In some cases we can get an interrupt before driver gets setup */
+	if (!dev->driver)
+		return -ESHUTDOWN;
+
+	spin_unlock(&dev->lock);
+	rc = dev->driver->setup(&dev->gadget, &dev->setup_data);
+	spin_lock(&dev->lock);
+	return rc;
+}
+
 /**
  * pch_udc_svc_control_in() - Handle Control IN endpoint interrupts
  * @dev:	Reference to the device structure
@@ -2412,15 +2427,12 @@ static void pch_udc_svc_control_out(struct pch_udc_dev *dev)
 			dev->gadget.ep0 = &dev->ep[UDC_EP0IN_IDX].ep;
 		else /* OUT */
 			dev->gadget.ep0 = &ep->ep;
-		spin_lock(&dev->lock);
 		/* If Mass storage Reset */
 		if ((dev->setup_data.bRequestType == 0x21) &&
 		    (dev->setup_data.bRequest == 0xFF))
 			dev->prot_stall = 0;
 		/* call gadget with setup data received */
-		setup_supported = dev->driver->setup(&dev->gadget,
-						     &dev->setup_data);
-		spin_unlock(&dev->lock);
+		setup_supported = pch_udc_gadget_setup(dev);
 
 		if (dev->setup_data.bRequestType & USB_DIR_IN) {
 			ep->td_data->status = (ep->td_data->status &
@@ -2673,9 +2685,7 @@ static void pch_udc_svc_intf_interrupt(struct pch_udc_dev *dev)
 		dev->ep[i].halted = 0;
 	}
 	dev->stall = 0;
-	spin_unlock(&dev->lock);
-	dev->driver->setup(&dev->gadget, &dev->setup_data);
-	spin_lock(&dev->lock);
+	pch_udc_gadget_setup(dev);
 }
 
 /**
@@ -2710,9 +2720,7 @@ static void pch_udc_svc_cfg_interrupt(struct pch_udc_dev *dev)
 	dev->stall = 0;
 
 	/* call gadget zero with setup data received */
-	spin_unlock(&dev->lock);
-	dev->driver->setup(&dev->gadget, &dev->setup_data);
-	spin_lock(&dev->lock);
+	pch_udc_gadget_setup(dev);
 }
 
 /**

From 88e5d2e8a69cca11990a8a5b154bbfe3e77a6d26 Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Tue, 23 Mar 2021 17:36:22 +0200
Subject: [PATCH 1980/2658] usb: gadget: pch_udc: Check for DMA mapping error

[ Upstream commit 4a28d77e359009b846951b06f7c0d8eec8dce298 ]

DMA mapping might fail, we have to check it with dma_mapping_error().
Otherwise DMA-API is not happy:

  DMA-API: pch_udc 0000:02:02.4: device driver failed to check map error[device address=0x00000000027ee678] [size=64 bytes] [mapped as single]

Fixes: abab0c67c061 ("usb: pch_udc: Fixed issue which does not work with g_serial")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20210323153626.54908-3-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/pch_udc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
index 152c2ee0ca50..5301de1c5d31 100644
--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -3003,7 +3003,7 @@ static int init_dma_pools(struct pch_udc_dev *dev)
 	dev->dma_addr = dma_map_single(&dev->pdev->dev, dev->ep0out_buf,
 				       UDC_EP0OUT_BUFF_SIZE * 4,
 				       DMA_FROM_DEVICE);
-	return 0;
+	return dma_mapping_error(&dev->pdev->dev, dev->dma_addr);
 }
 
 static int pch_udc_start(struct usb_gadget *g,

From 9849175549635d5c592edaacebdf552043ce2090 Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Thu, 18 Mar 2021 23:39:59 -0400
Subject: [PATCH 1981/2658] crypto: qat - don't release uninitialized resources

[ Upstream commit b66accaab3791e15ac99c92f236d0d3a6d5bd64e ]

adf_vf_isr_resource_alloc() is not unwinding correctly when error
happens and it want to release uninitialized resources.
To fix this, only release initialized resources.

[    1.792845] Trying to free already-free IRQ 11
[    1.793091] WARNING: CPU: 0 PID: 182 at kernel/irq/manage.c:1821 free_irq+0x202/0x380
[    1.801340] Call Trace:
[    1.801477]  adf_vf_isr_resource_free+0x32/0xb0 [intel_qat]
[    1.801785]  adf_vf_isr_resource_alloc+0x14d/0x150 [intel_qat]
[    1.802105]  adf_dev_init+0xba/0x140 [intel_qat]

Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Fixes: dd0f368398ea ("crypto: qat - Add qat dh895xcc VF driver")
Acked-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/qat/qat_dh895xccvf/adf_isr.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_isr.c b/drivers/crypto/qat/qat_dh895xccvf/adf_isr.c
index 87c5d8adb125..32f9c2b79681 100644
--- a/drivers/crypto/qat/qat_dh895xccvf/adf_isr.c
+++ b/drivers/crypto/qat/qat_dh895xccvf/adf_isr.c
@@ -243,16 +243,25 @@ int adf_vf_isr_resource_alloc(struct adf_accel_dev *accel_dev)
 		goto err_out;
 
 	if (adf_setup_pf2vf_bh(accel_dev))
-		goto err_out;
+		goto err_disable_msi;
 
 	if (adf_setup_bh(accel_dev))
-		goto err_out;
+		goto err_cleanup_pf2vf_bh;
 
 	if (adf_request_msi_irq(accel_dev))
-		goto err_out;
+		goto err_cleanup_bh;
 
 	return 0;
+
+err_cleanup_bh:
+	adf_cleanup_bh(accel_dev);
+
+err_cleanup_pf2vf_bh:
+	adf_cleanup_pf2vf_bh(accel_dev);
+
+err_disable_msi:
+	adf_disable_msi(accel_dev);
+
 err_out:
-	adf_vf_isr_resource_free(accel_dev);
 	return -EFAULT;
 }

From ec281076699855eb523554d9fc8d0416d5901d77 Mon Sep 17 00:00:00 2001
From: Fabian Vogt <fabian@ritter-vogt.de>
Date: Wed, 24 Mar 2021 15:11:09 +0100
Subject: [PATCH 1982/2658] fotg210-udc: Fix DMA on EP0 for length > max packet
 size

[ Upstream commit 755915fc28edfc608fa89a163014acb2f31c1e19 ]

For a 75 Byte request, it would send the first 64 separately, then detect
that the remaining 11 Byte fit into a single DMA, but due to this bug set
the length to the original 75 Bytes. This leads to a DMA failure (which is
ignored...) and the request completes without the remaining bytes having
been sent.

Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
Link: https://lore.kernel.org/r/20210324141115.9384-2-fabian@ritter-vogt.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/fotg210-udc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
index 76e991557116..7831c556a40b 100644
--- a/drivers/usb/gadget/udc/fotg210-udc.c
+++ b/drivers/usb/gadget/udc/fotg210-udc.c
@@ -348,7 +348,7 @@ static void fotg210_start_dma(struct fotg210_ep *ep,
 		if (req->req.length - req->req.actual > ep->ep.maxpacket)
 			length = ep->ep.maxpacket;
 		else
-			length = req->req.length;
+			length = req->req.length - req->req.actual;
 	}
 
 	d = dma_map_single(NULL, buffer, length,

From 8bcd460319325dfea744cfa3e7a579fb31a380f7 Mon Sep 17 00:00:00 2001
From: Fabian Vogt <fabian@ritter-vogt.de>
Date: Wed, 24 Mar 2021 15:11:10 +0100
Subject: [PATCH 1983/2658] fotg210-udc: Fix EP0 IN requests bigger than two
 packets

[ Upstream commit 078ba935651e149c92c41161e0322e3372cc2705 ]

For a 134 Byte packet, it sends the first two 64 Byte packets just fine,
but then notice that less than a packet is remaining and call fotg210_done
without actually sending the rest.

Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
Link: https://lore.kernel.org/r/20210324141115.9384-3-fabian@ritter-vogt.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/fotg210-udc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
index 7831c556a40b..1eda6fc750c1 100644
--- a/drivers/usb/gadget/udc/fotg210-udc.c
+++ b/drivers/usb/gadget/udc/fotg210-udc.c
@@ -827,7 +827,7 @@ static void fotg210_ep0in(struct fotg210_udc *fotg210)
 		if (req->req.length)
 			fotg210_start_dma(ep, req);
 
-		if ((req->req.length - req->req.actual) < ep->ep.maxpacket)
+		if (req->req.actual == req->req.length)
 			fotg210_done(ep, req, 0);
 	} else {
 		fotg210_set_cxdone(fotg210);

From 75228ccaaafbe069ab9d938950d68a37127a8aca Mon Sep 17 00:00:00 2001
From: Fabian Vogt <fabian@ritter-vogt.de>
Date: Wed, 24 Mar 2021 15:11:11 +0100
Subject: [PATCH 1984/2658] fotg210-udc: Remove a dubious condition leading to
 fotg210_done

[ Upstream commit c7f755b243494d6043aadcd9a2989cb157958b95 ]

When the EP0 IN request was not completed but less than a packet sent,
it would complete the request successfully. That doesn't make sense
and can't really happen as fotg210_start_dma always sends
min(length, maxpkt) bytes.

Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
Link: https://lore.kernel.org/r/20210324141115.9384-4-fabian@ritter-vogt.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/fotg210-udc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
index 1eda6fc750c1..d0a9ce7d0635 100644
--- a/drivers/usb/gadget/udc/fotg210-udc.c
+++ b/drivers/usb/gadget/udc/fotg210-udc.c
@@ -385,8 +385,7 @@ static void fotg210_ep0_queue(struct fotg210_ep *ep,
 	}
 	if (ep->dir_in) { /* if IN */
 		fotg210_start_dma(ep, req);
-		if ((req->req.length == req->req.actual) ||
-		    (req->req.actual < ep->ep.maxpacket))
+		if (req->req.length == req->req.actual)
 			fotg210_done(ep, req, 0);
 	} else { /* OUT */
 		u32 value = ioread32(ep->fotg210->reg + FOTG210_DMISGR0);

From 0598a877892d93f3fdd84390108ca08758b17943 Mon Sep 17 00:00:00 2001
From: Fabian Vogt <fabian@ritter-vogt.de>
Date: Wed, 24 Mar 2021 15:11:12 +0100
Subject: [PATCH 1985/2658] fotg210-udc: Mask GRP2 interrupts we don't handle

[ Upstream commit 9aee3a23d6455200702f3a57e731fa11e8408667 ]

Currently it leaves unhandled interrupts unmasked, but those are never
acked. In the case of a "device idle" interrupt, this leads to an
effectively frozen system until plugging it in.

Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
Link: https://lore.kernel.org/r/20210324141115.9384-5-fabian@ritter-vogt.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/fotg210-udc.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
index d0a9ce7d0635..491b04dd6db7 100644
--- a/drivers/usb/gadget/udc/fotg210-udc.c
+++ b/drivers/usb/gadget/udc/fotg210-udc.c
@@ -1033,6 +1033,12 @@ static void fotg210_init(struct fotg210_udc *fotg210)
 	value &= ~DMCR_GLINT_EN;
 	iowrite32(value, fotg210->reg + FOTG210_DMCR);
 
+	/* enable only grp2 irqs we handle */
+	iowrite32(~(DISGR2_DMA_ERROR | DISGR2_RX0BYTE_INT | DISGR2_TX0BYTE_INT
+		    | DISGR2_ISO_SEQ_ABORT_INT | DISGR2_ISO_SEQ_ERR_INT
+		    | DISGR2_RESM_INT | DISGR2_SUSP_INT | DISGR2_USBRST_INT),
+		  fotg210->reg + FOTG210_DMISGR2);
+
 	/* disable all fifo interrupt */
 	iowrite32(~(u32)0, fotg210->reg + FOTG210_DMISGR1);
 

From ce51e739ce829b6ab28f77c165aa47c42b291034 Mon Sep 17 00:00:00 2001
From: Fabian Vogt <fabian@ritter-vogt.de>
Date: Wed, 24 Mar 2021 15:11:14 +0100
Subject: [PATCH 1986/2658] fotg210-udc: Don't DMA more than the buffer can
 take

[ Upstream commit 3e7c2510bdfe89a9ec223dd7acd6bfc8bb1cbeb6 ]

Before this, it wrote as much as available into the buffer, even if it
didn't fit.

Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
Link: https://lore.kernel.org/r/20210324141115.9384-7-fabian@ritter-vogt.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/fotg210-udc.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
index 491b04dd6db7..b2910bc65e51 100644
--- a/drivers/usb/gadget/udc/fotg210-udc.c
+++ b/drivers/usb/gadget/udc/fotg210-udc.c
@@ -340,8 +340,9 @@ static void fotg210_start_dma(struct fotg210_ep *ep,
 		} else {
 			buffer = req->req.buf + req->req.actual;
 			length = ioread32(ep->fotg210->reg +
-					FOTG210_FIBCR(ep->epnum - 1));
-			length &= FIBCR_BCFX;
+					FOTG210_FIBCR(ep->epnum - 1)) & FIBCR_BCFX;
+			if (length > req->req.length - req->req.actual)
+				length = req->req.length - req->req.actual;
 		}
 	} else {
 		buffer = req->req.buf + req->req.actual;

From b7837ec77c8702901e684cb510f9af3645af9397 Mon Sep 17 00:00:00 2001
From: Fabian Vogt <fabian@ritter-vogt.de>
Date: Wed, 24 Mar 2021 15:11:15 +0100
Subject: [PATCH 1987/2658] fotg210-udc: Complete OUT requests on short packets

[ Upstream commit 75bb93be0027123b5db6cbcce89eb62f0f6b3c5b ]

A short packet indicates the end of a transfer and marks the request as
complete.

Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
Link: https://lore.kernel.org/r/20210324141115.9384-8-fabian@ritter-vogt.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/fotg210-udc.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
index b2910bc65e51..9e102ba9cf66 100644
--- a/drivers/usb/gadget/udc/fotg210-udc.c
+++ b/drivers/usb/gadget/udc/fotg210-udc.c
@@ -856,12 +856,16 @@ static void fotg210_out_fifo_handler(struct fotg210_ep *ep)
 {
 	struct fotg210_request *req = list_entry(ep->queue.next,
 						 struct fotg210_request, queue);
+	int disgr1 = ioread32(ep->fotg210->reg + FOTG210_DISGR1);
 
 	fotg210_start_dma(ep, req);
 
-	/* finish out transfer */
+	/* Complete the request when it's full or a short packet arrived.
+	 * Like other drivers, short_not_ok isn't handled.
+	 */
+
 	if (req->req.length == req->req.actual ||
-	    req->req.actual < ep->ep.maxpacket)
+	    (disgr1 & DISGR1_SPK_INT(ep->epnum - 1)))
 		fotg210_done(ep, req, 0);
 }
 

From dc60f30423c0fd18e58f7fce54f61450996f6492 Mon Sep 17 00:00:00 2001
From: Michael Walle <michael@walle.cc>
Date: Wed, 3 Mar 2021 16:57:35 +0100
Subject: [PATCH 1988/2658] mtd: require write permissions for locking and
 badblock ioctls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 1e97743fd180981bef5f01402342bb54bf1c6366 ]

MEMLOCK, MEMUNLOCK and OTPLOCK modify protection bits. Thus require
write permission. Depending on the hardware MEMLOCK might even be
write-once, e.g. for SPI-NOR flashes with their WP# tied to GND. OTPLOCK
is always write-once.

MEMSETBADBLOCK modifies the bad block table.

Fixes: f7e6b19bc764 ("mtd: properly check all write ioctls for permissions")
Signed-off-by: Michael Walle <michael@walle.cc>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Rafał Miłecki <rafal@milecki.pl>
Acked-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210303155735.25887-1-michael@walle.cc
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/mtdchar.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index ce87d9506f6a..0a2832782807 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -616,16 +616,12 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
 	case MEMGETINFO:
 	case MEMREADOOB:
 	case MEMREADOOB64:
-	case MEMLOCK:
-	case MEMUNLOCK:
 	case MEMISLOCKED:
 	case MEMGETOOBSEL:
 	case MEMGETBADBLOCK:
-	case MEMSETBADBLOCK:
 	case OTPSELECT:
 	case OTPGETREGIONCOUNT:
 	case OTPGETREGIONINFO:
-	case OTPLOCK:
 	case ECCGETLAYOUT:
 	case ECCGETSTATS:
 	case MTDFILEMODE:
@@ -636,9 +632,13 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
 	/* "dangerous" commands */
 	case MEMERASE:
 	case MEMERASE64:
+	case MEMLOCK:
+	case MEMUNLOCK:
+	case MEMSETBADBLOCK:
 	case MEMWRITEOOB:
 	case MEMWRITEOOB64:
 	case MEMWRITE:
+	case OTPLOCK:
 		if (!(file->f_mode & FMODE_WRITE))
 			return -EPERM;
 		break;

From 3861f2682b0a6e4a4a73ebcd67f7ddb3930fae9c Mon Sep 17 00:00:00 2001
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Date: Thu, 25 Mar 2021 08:34:18 +0000
Subject: [PATCH 1989/2658] crypto: qat - fix error path in
 adf_isr_resource_alloc()

[ Upstream commit 83dc1173d73f80cbce2fee4d308f51f87b2f26ae ]

The function adf_isr_resource_alloc() is not unwinding correctly in case
of error.
This patch fixes the error paths and propagate the errors to the caller.

Fixes: 7afa232e76ce ("crypto: qat - Intel(R) QAT DH895xcc accelerator")
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Marco Chiappero <marco.chiappero@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/qat/qat_dh895xcc/adf_isr.c | 29 ++++++++++++++++-------
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_isr.c b/drivers/crypto/qat/qat_dh895xcc/adf_isr.c
index 5570f78795c1..ddbb43da1a13 100644
--- a/drivers/crypto/qat/qat_dh895xcc/adf_isr.c
+++ b/drivers/crypto/qat/qat_dh895xcc/adf_isr.c
@@ -315,18 +315,31 @@ int adf_isr_resource_alloc(struct adf_accel_dev *accel_dev)
 
 	ret = adf_isr_alloc_msix_entry_table(accel_dev);
 	if (ret)
-		return ret;
-	if (adf_enable_msix(accel_dev))
 		goto err_out;
 
-	if (adf_setup_bh(accel_dev))
-		goto err_out;
+	ret = adf_enable_msix(accel_dev);
+	if (ret)
+		goto err_free_msix_table;
 
-	if (adf_request_irqs(accel_dev))
-		goto err_out;
+	ret = adf_setup_bh(accel_dev);
+	if (ret)
+		goto err_disable_msix;
+
+	ret = adf_request_irqs(accel_dev);
+	if (ret)
+		goto err_cleanup_bh;
 
 	return 0;
+
+err_cleanup_bh:
+	adf_cleanup_bh(accel_dev);
+
+err_disable_msix:
+	adf_disable_msix(&accel_dev->accel_pci_dev);
+
+err_free_msix_table:
+	adf_isr_free_msix_entry_table(accel_dev);
+
 err_out:
-	adf_isr_resource_free(accel_dev);
-	return -EFAULT;
+	return ret;
 }

From 1adcd3d3970bfa9cca058c6e43be104daec29a29 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Wed, 7 Apr 2021 16:03:08 +0100
Subject: [PATCH 1990/2658] staging: rtl8192u: Fix potential infinite loop

[ Upstream commit f9b9263a25dc3d2eaaa829e207434db6951ca7bc ]

The for-loop iterates with a u8 loop counter i and compares this
with the loop upper limit of riv->ieee80211->LinkDetectInfo.SlotNum
that is a u16 type. There is a potential infinite loop if SlotNum
is larger than the u8 loop counter. Fix this by making the loop
counter the same type as SlotNum.

Addresses-Coverity: ("Infinite loop")
Fixes: 8fc8598e61f6 ("Staging: Added Realtek rtl8192u driver to staging")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20210407150308.496623-1-colin.king@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/rtl8192u/r8192U_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
index 1e0d2a33787e..72dabbf19bc7 100644
--- a/drivers/staging/rtl8192u/r8192U_core.c
+++ b/drivers/staging/rtl8192u/r8192U_core.c
@@ -3418,7 +3418,7 @@ static void rtl819x_update_rxcounts(struct r8192_priv *priv, u32 *TotalRxBcnNum,
 			     u32 *TotalRxDataNum)
 {
 	u16			SlotIndex;
-	u8			i;
+	u16			i;
 
 	*TotalRxBcnNum = 0;
 	*TotalRxDataNum = 0;

From c58ac27101fe4dfdffa20b00e2ecfb6d58f75921 Mon Sep 17 00:00:00 2001
From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Date: Fri, 2 Apr 2021 10:13:48 -0700
Subject: [PATCH 1991/2658] crypto: qat - Fix a double free in adf_create_ring

[ Upstream commit f7cae626cabb3350b23722b78fe34dd7a615ca04 ]

In adf_create_ring, if the callee adf_init_ring() failed, the callee will
free the ring->base_addr by dma_free_coherent() and return -EFAULT. Then
adf_create_ring will goto err and the ring->base_addr will be freed again
in adf_cleanup_ring().

My patch sets ring->base_addr to NULL after the first freed to avoid the
double free.

Fixes: a672a9dc872ec ("crypto: qat - Intel(R) QAT transport code")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/qat/qat_common/adf_transport.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/crypto/qat/qat_common/adf_transport.c b/drivers/crypto/qat/qat_common/adf_transport.c
index 3865ae8d96d9..78f0942a3270 100644
--- a/drivers/crypto/qat/qat_common/adf_transport.c
+++ b/drivers/crypto/qat/qat_common/adf_transport.c
@@ -198,6 +198,7 @@ static int adf_init_ring(struct adf_etr_ring_data *ring)
 		dev_err(&GET_DEV(accel_dev), "Ring address not aligned\n");
 		dma_free_coherent(&GET_DEV(accel_dev), ring_size_bytes,
 				  ring->base_addr, ring->dma_addr);
+		ring->base_addr = NULL;
 		return -EFAULT;
 	}
 

From 888e38ac59dc3a6b87ee24b91925775707b7161c Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Tue, 6 Apr 2021 19:45:10 +0100
Subject: [PATCH 1992/2658] usb: gadget: r8a66597: Add missing null check on
 return from platform_get_resource

[ Upstream commit 9c2076090c2815fe7c49676df68dde7e60a9b9fc ]

The call to platform_get_resource can potentially return a NULL pointer
on failure, so add this check and return -EINVAL if it fails.

Fixes: c41442474a26 ("usb: gadget: R8A66597 peripheral controller support.")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Addresses-Coverity: ("Dereference null return")
Link: https://lore.kernel.org/r/20210406184510.433497-1-colin.king@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/r8a66597-udc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c
index e34094647603..4eb8e181763d 100644
--- a/drivers/usb/gadget/udc/r8a66597-udc.c
+++ b/drivers/usb/gadget/udc/r8a66597-udc.c
@@ -1867,6 +1867,8 @@ static int r8a66597_probe(struct platform_device *pdev)
 		return PTR_ERR(reg);
 
 	ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+	if (!ires)
+		return -EINVAL;
 	irq = ires->start;
 	irq_trigger = ires->flags & IRQF_TRIGGER_MASK;
 

From 9c9fb4134ce57f92d1834fba8daeda709fcfa123 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Thu, 8 Apr 2021 15:16:01 +0200
Subject: [PATCH 1993/2658] USB: cdc-acm: fix unprivileged TIOCCSERIAL

[ Upstream commit dd5619582d60007139f0447382d2839f4f9e339b ]

TIOCSSERIAL is a horrid, underspecified, legacy interface which for most
serial devices is only useful for setting the close_delay and
closing_wait parameters.

A non-privileged user has only ever been able to set the since long
deprecated ASYNC_SPD flags and trying to change any other *supported*
feature should result in -EPERM being returned. Setting the current
values for any supported features should return success.

Fix the cdc-acm implementation which instead indicated that the
TIOCSSERIAL ioctl was not even implemented when a non-privileged user
set the current values.

Fixes: ba2d8ce9db0a ("cdc-acm: implement TIOCSSERIAL to avoid blocking close(2)")
Acked-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210408131602.27956-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/class/cdc-acm.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 8c476a785360..0478d55bd283 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -883,8 +883,6 @@ static int set_serial_info(struct acm *acm,
 		if ((new_serial.close_delay != old_close_delay) ||
 	            (new_serial.closing_wait != old_closing_wait))
 			retval = -EPERM;
-		else
-			retval = -EOPNOTSUPP;
 	} else {
 		acm->port.close_delay  = close_delay;
 		acm->port.closing_wait = closing_wait;

From 2342f044ebb5542ca85623066b50353ea156ed9a Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 7 Apr 2021 11:52:02 +0200
Subject: [PATCH 1994/2658] tty: fix return value for unsupported ioctls

[ Upstream commit 1b8b20868a6d64cfe8174a21b25b74367bdf0560 ]

Drivers should return -ENOTTY ("Inappropriate I/O control operation")
when an ioctl isn't supported, while -EINVAL is used for invalid
arguments.

Fix up the TIOCMGET, TIOCMSET and TIOCGICOUNT helpers which returned
-EINVAL when a tty driver did not implement the corresponding
operations.

Note that the TIOCMGET and TIOCMSET helpers predate git and do not get a
corresponding Fixes tag below.

Fixes: d281da7ff6f7 ("tty: Make tiocgicount a handler")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210407095208.31838-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/tty_io.c       | 8 ++++----
 include/linux/tty_driver.h | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index dff507cd0250..bdb25b23e8d3 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2762,14 +2762,14 @@ static int send_break(struct tty_struct *tty, unsigned int duration)
  *	@p: pointer to result
  *
  *	Obtain the modem status bits from the tty driver if the feature
- *	is supported. Return -EINVAL if it is not available.
+ *	is supported. Return -ENOTTY if it is not available.
  *
  *	Locking: none (up to the driver)
  */
 
 static int tty_tiocmget(struct tty_struct *tty, int __user *p)
 {
-	int retval = -EINVAL;
+	int retval = -ENOTTY;
 
 	if (tty->ops->tiocmget) {
 		retval = tty->ops->tiocmget(tty);
@@ -2787,7 +2787,7 @@ static int tty_tiocmget(struct tty_struct *tty, int __user *p)
  *	@p: pointer to desired bits
  *
  *	Set the modem status bits from the tty driver if the feature
- *	is supported. Return -EINVAL if it is not available.
+ *	is supported. Return -ENOTTY if it is not available.
  *
  *	Locking: none (up to the driver)
  */
@@ -2799,7 +2799,7 @@ static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
 	unsigned int set, clear, val;
 
 	if (tty->ops->tiocmset == NULL)
-		return -EINVAL;
+		return -ENOTTY;
 
 	retval = get_user(val, p);
 	if (retval)
diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
index 161052477f77..6d8db1555260 100644
--- a/include/linux/tty_driver.h
+++ b/include/linux/tty_driver.h
@@ -235,7 +235,7 @@
  *
  *	Called when the device receives a TIOCGICOUNT ioctl. Passed a kernel
  *	structure to complete. This method is optional and will only be called
- *	if provided (otherwise EINVAL will be returned).
+ *	if provided (otherwise ENOTTY will be returned).
  */
 
 #include <linux/export.h>

From fd64d201dd14a4ab9600a662a138b49088742e09 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Date: Thu, 15 Apr 2021 09:22:22 +0900
Subject: [PATCH 1995/2658] ttyprintk: Add TTY hangup callback.

[ Upstream commit c0070e1e60270f6a1e09442a9ab2335f3eaeaad2 ]

syzbot is reporting hung task due to flood of

  tty_warn(tty, "%s: tty->count = 1 port count = %d\n", __func__,
           port->count);

message [1], for ioctl(TIOCVHANGUP) prevents tty_port_close() from
decrementing port->count due to tty_hung_up_p() == true.

----------
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <unistd.h>

int main(int argc, char *argv[])
{
	int i;
	int fd[10];

	for (i = 0; i < 10; i++)
		fd[i] = open("/dev/ttyprintk", O_WRONLY);
	ioctl(fd[0], TIOCVHANGUP);
	for (i = 0; i < 10; i++)
		close(fd[i]);
	close(open("/dev/ttyprintk", O_WRONLY));
	return 0;
}
----------

When TTY hangup happens, port->count needs to be reset via
"struct tty_operations"->hangup callback.

[1] https://syzkaller.appspot.com/bug?id=39ea6caa479af471183997376dc7e90bc7d64a6a

Reported-by: syzbot <syzbot+43e93968b964e369db0b@syzkaller.appspotmail.com>
Reported-by: syzbot <syzbot+3ed715090790806d8b18@syzkaller.appspotmail.com>
Tested-by: syzbot <syzbot+43e93968b964e369db0b@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 24b4b67d17c308aa ("add ttyprintk driver")
Link: https://lore.kernel.org/r/17e0652d-89b7-c8c0-fb53-e7566ac9add4@i-love.sakura.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/ttyprintk.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
index e265bace57d7..50031a215a66 100644
--- a/drivers/char/ttyprintk.c
+++ b/drivers/char/ttyprintk.c
@@ -166,12 +166,23 @@ static int tpk_ioctl(struct tty_struct *tty,
 	return 0;
 }
 
+/*
+ * TTY operations hangup function.
+ */
+static void tpk_hangup(struct tty_struct *tty)
+{
+	struct ttyprintk_port *tpkp = tty->driver_data;
+
+	tty_port_hangup(&tpkp->port);
+}
+
 static const struct tty_operations ttyprintk_ops = {
 	.open = tpk_open,
 	.close = tpk_close,
 	.write = tpk_write,
 	.write_room = tpk_write_room,
 	.ioctl = tpk_ioctl,
+	.hangup = tpk_hangup,
 };
 
 static struct tty_port_operations null_ops = { };

From ef7ac1964329800a0d7ba56ae78f652e250b32f0 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Thu, 25 Feb 2021 16:43:27 +0100
Subject: [PATCH 1996/2658] media: vivid: fix assignment of dev->fbuf_out_flags

[ Upstream commit 5cde22fcc7271812a7944c47b40100df15908358 ]

Currently the chroma_flags and alpha_flags are being zero'd with a bit-wise
mask and the following statement should be bit-wise or'ing in the new flag
bits but instead is making a direct assignment.  Fix this by using the |=
operator rather than an assignment.

Addresses-Coverity: ("Unused value")

Fixes: ef834f7836ec ("[media] vivid: add the video capture and output parts")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/vivid/vivid-vid-out.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/vivid/vivid-vid-out.c b/drivers/media/platform/vivid/vivid-vid-out.c
index ffe5531dfc81..7f6fa77e4775 100644
--- a/drivers/media/platform/vivid/vivid-vid-out.c
+++ b/drivers/media/platform/vivid/vivid-vid-out.c
@@ -1011,7 +1011,7 @@ int vivid_vid_out_s_fbuf(struct file *file, void *fh,
 		return -EINVAL;
 	}
 	dev->fbuf_out_flags &= ~(chroma_flags | alpha_flags);
-	dev->fbuf_out_flags = a->flags & (chroma_flags | alpha_flags);
+	dev->fbuf_out_flags |= a->flags & (chroma_flags | alpha_flags);
 	return 0;
 }
 

From 68ad4c061a22b835a93e2072ccf40f91b2588162 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Tue, 17 Nov 2020 03:50:41 +0100
Subject: [PATCH 1997/2658] media: omap4iss: return error code when
 omap4iss_get() failed

[ Upstream commit 8938c48fa25b491842ece9eb38f0bea0fcbaca44 ]

If omap4iss_get() failed, it need return error code in iss_probe().

Fixes: 59f0ad807681 ("[media] v4l: omap4iss: Add support for OMAP4...")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/omap4iss/iss.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/media/omap4iss/iss.c b/drivers/staging/media/omap4iss/iss.c
index aa76ccda5b42..130d09d28e1d 100644
--- a/drivers/staging/media/omap4iss/iss.c
+++ b/drivers/staging/media/omap4iss/iss.c
@@ -1406,8 +1406,10 @@ static int iss_probe(struct platform_device *pdev)
 	if (ret < 0)
 		goto error;
 
-	if (!omap4iss_get(iss))
+	if (!omap4iss_get(iss)) {
+		ret = -EINVAL;
 		goto error;
+	}
 
 	ret = iss_reset(iss);
 	if (ret < 0)

From 45efb6e65c541399da9b0e363de27509aca0e1db Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Wed, 7 Oct 2020 14:16:28 +0200
Subject: [PATCH 1998/2658] media: m88rs6000t: avoid potential out-of-bounds
 reads on arrays

[ Upstream commit 9baa3d64e8e2373ddd11c346439e5dfccb2cbb0d ]

There a 3 array for-loops that don't check the upper bounds of the
index into arrays and this may lead to potential out-of-bounds
reads.  Fix this by adding array size upper bounds checks to be
full safe.

Addresses-Coverity: ("Out-of-bounds read")

Link: https://lore.kernel.org/linux-media/20201007121628.20676-1-colin.king@canonical.com
Fixes: 333829110f1d ("[media] m88rs6000t: add new dvb-s/s2 tuner for integrated chip M88RS6000")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/tuners/m88rs6000t.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/media/tuners/m88rs6000t.c b/drivers/media/tuners/m88rs6000t.c
index 504bfbc4027a..f78caf3c2bbd 100644
--- a/drivers/media/tuners/m88rs6000t.c
+++ b/drivers/media/tuners/m88rs6000t.c
@@ -535,7 +535,7 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength)
 	PGA2_cri = PGA2_GC >> 2;
 	PGA2_crf = PGA2_GC & 0x03;
 
-	for (i = 0; i <= RF_GC; i++)
+	for (i = 0; i <= RF_GC && i < ARRAY_SIZE(RFGS); i++)
 		RFG += RFGS[i];
 
 	if (RF_GC == 0)
@@ -547,12 +547,12 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength)
 	if (RF_GC == 3)
 		RFG += 100;
 
-	for (i = 0; i <= IF_GC; i++)
+	for (i = 0; i <= IF_GC && i < ARRAY_SIZE(IFGS); i++)
 		IFG += IFGS[i];
 
 	TIAG = TIA_GC * TIA_GS;
 
-	for (i = 0; i <= BB_GC; i++)
+	for (i = 0; i <= BB_GC && i < ARRAY_SIZE(BBGS); i++)
 		BBG += BBGS[i];
 
 	PGA2G = PGA2_cri * PGA2_cri_GS + PGA2_crf * PGA2_crf_GS;

From 385981027dc828b79d60729a08a20d02456b4904 Mon Sep 17 00:00:00 2001
From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Date: Thu, 25 Mar 2021 23:50:24 +0300
Subject: [PATCH 1999/2658] pata_arasan_cf: fix IRQ check

[ Upstream commit c7e8f404d56b99c80990b19a402c3f640d74be05 ]

The driver's probe() method is written as if platform_get_irq() returns 0
on error, while actually it returns a negative error code (with all the
other values considered valid IRQs). Rewrite the driver's IRQ checking code
to pass the positive IRQ #s to ata_host_activate(), propagate upstream
-EPROBE_DEFER, and set up the driver to polling mode on (negative) errors
and IRQ0 (libata treats IRQ #0 as a polling mode anyway)...

Fixes: a480167b23ef ("pata_arasan_cf: Adding support for arasan compact flash host controller")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/pata_arasan_cf.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
index 80fe0f6fed29..a6b1a7556d37 100644
--- a/drivers/ata/pata_arasan_cf.c
+++ b/drivers/ata/pata_arasan_cf.c
@@ -819,12 +819,19 @@ static int arasan_cf_probe(struct platform_device *pdev)
 	else
 		quirk = CF_BROKEN_UDMA; /* as it is on spear1340 */
 
-	/* if irq is 0, support only PIO */
-	acdev->irq = platform_get_irq(pdev, 0);
-	if (acdev->irq)
+	/*
+	 * If there's an error getting IRQ (or we do get IRQ0),
+	 * support only PIO
+	 */
+	ret = platform_get_irq(pdev, 0);
+	if (ret > 0) {
+		acdev->irq = ret;
 		irq_handler = arasan_cf_interrupt;
-	else
+	} else	if (ret == -EPROBE_DEFER) {
+		return ret;
+	} else	{
 		quirk |= CF_BROKEN_MWDMA | CF_BROKEN_UDMA;
+	}
 
 	acdev->pbase = res->start;
 	acdev->vbase = devm_ioremap_nocache(&pdev->dev, res->start,

From 2a1f6ba5a31749cfec4fed690428512c0fd6b63d Mon Sep 17 00:00:00 2001
From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Date: Thu, 25 Mar 2021 23:51:10 +0300
Subject: [PATCH 2000/2658] pata_ipx4xx_cf: fix IRQ check

[ Upstream commit e379b40cc0f179403ce0b82b7e539f635a568da5 ]

The driver's probe() method is written as if platform_get_irq() returns 0
on error, while actually it returns a negative error code (with all the
other values considered valid IRQs).  Rewrite the driver's IRQ checking
code to pass the positive IRQ #s to ata_host_activate(), propagate errors
upstream, and treat IRQ0 as error, returning -EINVAL, as the libata code
treats 0  as  an indication that polling should be used anyway...

Fixes: 0df0d0a0ea9f ("[libata] ARM: add ixp4xx PATA driver")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/pata_ixp4xx_cf.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/ata/pata_ixp4xx_cf.c b/drivers/ata/pata_ixp4xx_cf.c
index abda44183512..fb8d1f68f36f 100644
--- a/drivers/ata/pata_ixp4xx_cf.c
+++ b/drivers/ata/pata_ixp4xx_cf.c
@@ -169,8 +169,12 @@ static int ixp4xx_pata_probe(struct platform_device *pdev)
 		return -ENOMEM;
 
 	irq = platform_get_irq(pdev, 0);
-	if (irq)
+	if (irq > 0)
 		irq_set_irq_type(irq, IRQ_TYPE_EDGE_RISING);
+	else if (irq < 0)
+		return irq;
+	else
+		return -EINVAL;
 
 	/* Setup expansion bus chip selects */
 	*data->cs0_cfg = data->cs0_bits;

From 8372e7db12c6249ac8affdf8df476b16f58c6cdf Mon Sep 17 00:00:00 2001
From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Date: Sun, 28 Mar 2021 00:13:49 +0300
Subject: [PATCH 2001/2658] sata_mv: add IRQ checks

[ Upstream commit e6471a65fdd5efbb8dd2732dd0f063f960685ceb ]

The function mv_platform_probe() neglects to check the results of the
calls to platform_get_irq() and irq_of_parse_and_map() and blithely
passes them to ata_host_activate() -- while the latter only checks
for IRQ0 (treating it as a polling mode indicattion) and passes the
negative values to devm_request_irq() causing it to fail as it takes
unsigned values for the IRQ #...

Add to mv_platform_probe() the proper IRQ checks to pass the positive IRQ
#s to ata_host_activate(), propagate upstream the negative error codes,
and override the IRQ0 with -EINVAL (as we don't want the polling mode).

Fixes: f351b2d638c3 ("sata_mv: Support SoC controllers")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Link: https://lore.kernel.org/r/51436f00-27a1-e20b-c21b-0e817e0a7c86@omprussia.ru
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/sata_mv.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 5718dc94c90c..601ea2e9fcf9 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -4101,6 +4101,10 @@ static int mv_platform_probe(struct platform_device *pdev)
 		n_ports = mv_platform_data->n_ports;
 		irq = platform_get_irq(pdev, 0);
 	}
+	if (irq < 0)
+		return irq;
+	if (!irq)
+		return -EINVAL;
 
 	host = ata_host_alloc_pinfo(&pdev->dev, ppi, n_ports);
 	hpriv = devm_kzalloc(&pdev->dev, sizeof(*hpriv), GFP_KERNEL);

From 2c0f4deff61ca56f2b94e503c030be91e8060594 Mon Sep 17 00:00:00 2001
From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Date: Mon, 15 Mar 2021 23:15:06 +0300
Subject: [PATCH 2002/2658] ata: libahci_platform: fix IRQ check

[ Upstream commit b30d0040f06159de97ad9c0b1536f47250719d7d ]

Iff platform_get_irq() returns 0, ahci_platform_init_host() would return 0
early (as if the call was successful). Override IRQ0 with -EINVAL instead
as the 'libata' regards 0 as "no IRQ" (thus polling) anyway...

Fixes: c034640a32f8 ("ata: libahci: properly propagate return value of platform_get_irq()")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Link: https://lore.kernel.org/r/4448c8cc-331f-2915-0e17-38ea34e251c8@omprussia.ru
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/libahci_platform.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index 65371e1befe8..8839ad6b73e3 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -516,11 +516,13 @@ int ahci_platform_init_host(struct platform_device *pdev,
 	int i, irq, n_ports, rc;
 
 	irq = platform_get_irq(pdev, 0);
-	if (irq <= 0) {
+	if (irq < 0) {
 		if (irq != -EPROBE_DEFER)
 			dev_err(dev, "no irq\n");
 		return irq;
 	}
+	if (!irq)
+		return -EINVAL;
 
 	hpriv->irq = irq;
 

From ccbdfe216d4f8c7d394c185d8940fb523797acd4 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 22 Mar 2021 17:46:59 +0100
Subject: [PATCH 2003/2658] scsi: fcoe: Fix mismatched fcoe_wwn_from_mac
 declaration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 5b11c9d80bde81f6896cc85b23aeaa9502a704ed ]

An old cleanup changed the array size from MAX_ADDR_LEN to unspecified in
the declaration, but now gcc-11 warns about this:

drivers/scsi/fcoe/fcoe_ctlr.c:1972:37: error: argument 1 of type ‘unsigned char[32]’ with mismatched bound [-Werror=array-parameter=]
 1972 | u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN],
      |                       ~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~
In file included from /git/arm-soc/drivers/scsi/fcoe/fcoe_ctlr.c:33:
include/scsi/libfcoe.h:252:37: note: previously declared as ‘unsigned char[]’
  252 | u64 fcoe_wwn_from_mac(unsigned char mac[], unsigned int, unsigned int);
      |                       ~~~~~~~~~~~~~~^~~~~

Change the type back to what the function definition uses.

Link: https://lore.kernel.org/r/20210322164702.957810-1-arnd@kernel.org
Fixes: fdd78027fd47 ("[SCSI] fcoe: cleans up libfcoe.h and adds fcoe.h for fcoe module")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/scsi/libfcoe.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/scsi/libfcoe.h b/include/scsi/libfcoe.h
index e59180264591..004bf0ca8884 100644
--- a/include/scsi/libfcoe.h
+++ b/include/scsi/libfcoe.h
@@ -256,7 +256,7 @@ int fcoe_ctlr_recv_flogi(struct fcoe_ctlr *, struct fc_lport *,
 			 struct fc_frame *);
 
 /* libfcoe funcs */
-u64 fcoe_wwn_from_mac(unsigned char mac[], unsigned int, unsigned int);
+u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN], unsigned int, unsigned int);
 int fcoe_libfc_config(struct fc_lport *, struct fcoe_ctlr *,
 		      const struct libfc_function_template *, int init_fcp);
 u32 fcoe_fc_crc(struct fc_frame *fp);

From 0743d1561e3d703604e86f63d4e66df0fd0b4d30 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 22 Mar 2021 17:46:00 +0100
Subject: [PATCH 2004/2658] media: dvb-usb-remote: fix
 dvb_usb_nec_rc_key_to_event type mismatch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 0fa430e96d3c3561a78701f51fd8593da68b8474 ]

gcc-11 warns about the prototype not exactly matching the function
definition:

drivers/media/usb/dvb-usb/dvb-usb-remote.c:363:20: error: argument 2 of type ‘u8[5]’ {aka ‘unsigned char[5]’} with mismatched bound [-Werror=array-parameter=]
  363 |                 u8 keybuf[5], u32 *event, int *state)
      |                 ~~~^~~~~~~~~
In file included from drivers/media/usb/dvb-usb/dvb-usb-common.h:13,
                 from drivers/media/usb/dvb-usb/dvb-usb-remote.c:9:
drivers/media/usb/dvb-usb/dvb-usb.h:490:65: note: previously declared as ‘u8[]’ {aka ‘unsigned char[]’}
  490 | extern int dvb_usb_nec_rc_key_to_event(struct dvb_usb_device *, u8[], u32 *, int *);
      |                                                                 ^~~~

Fixes: 776338e121b9 ("[PATCH] dvb: Add generalized dvb-usb driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/dvb-usb/dvb-usb.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb/dvb-usb.h b/drivers/media/usb/dvb-usb/dvb-usb.h
index ce4c4e3b58bb..dd80b737d4da 100644
--- a/drivers/media/usb/dvb-usb/dvb-usb.h
+++ b/drivers/media/usb/dvb-usb/dvb-usb.h
@@ -466,7 +466,8 @@ extern int dvb_usb_generic_rw(struct dvb_usb_device *, u8 *, u16, u8 *, u16,int)
 extern int dvb_usb_generic_write(struct dvb_usb_device *, u8 *, u16);
 
 /* commonly used remote control parsing */
-extern int dvb_usb_nec_rc_key_to_event(struct dvb_usb_device *, u8[], u32 *, int *);
+int dvb_usb_nec_rc_key_to_event(struct dvb_usb_device *d, u8 keybuf[5],
+				u32 *event, int *state);
 
 /* commonly used firmware download types and function */
 struct hexline {

From 5891568eab86a72244520e5d4c8d78c3b8986d36 Mon Sep 17 00:00:00 2001
From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Date: Tue, 30 Mar 2021 20:43:23 +0300
Subject: [PATCH 2005/2658] scsi: jazz_esp: Add IRQ check

[ Upstream commit 38fca15c29db6ed06e894ac194502633e2a7d1fb ]

The driver neglects to check the result of platform_get_irq()'s call and
blithely passes the negative error codes to request_irq() (which takes
*unsigned* IRQ #), causing it to fail with -EINVAL, overriding the real
error code.  Stop calling request_irq() with the invalid IRQ #s.

Link: https://lore.kernel.org/r/594aa9ae-2215-49f6-f73c-33bd38989912@omprussia.ru
Fixes: 352e921f0dd4 ("[SCSI] jazz_esp: converted to use esp_core")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/jazz_esp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/jazz_esp.c b/drivers/scsi/jazz_esp.c
index 9aaa74e349cc..65f0dbfc3a45 100644
--- a/drivers/scsi/jazz_esp.c
+++ b/drivers/scsi/jazz_esp.c
@@ -170,7 +170,9 @@ static int esp_jazz_probe(struct platform_device *dev)
 	if (!esp->command_block)
 		goto fail_unmap_regs;
 
-	host->irq = platform_get_irq(dev, 0);
+	host->irq = err = platform_get_irq(dev, 0);
+	if (err < 0)
+		goto fail_unmap_command_block;
 	err = request_irq(host->irq, scsi_esp_intr, IRQF_SHARED, "ESP", esp);
 	if (err < 0)
 		goto fail_unmap_command_block;

From d47315c382b3b60a3f6a42f6cf5aa61aff2ca27a Mon Sep 17 00:00:00 2001
From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Date: Tue, 30 Mar 2021 20:44:08 +0300
Subject: [PATCH 2006/2658] scsi: sun3x_esp: Add IRQ check

[ Upstream commit 14b321380eb333c82853d7d612d0995f05f88fdc ]

The driver neglects to check the result of platform_get_irq()'s call and
blithely passes the negative error codes to request_irq() (which takes
*unsigned* IRQ #), causing it to fail with -EINVAL, overriding the real
error code.  Stop calling request_irq() with the invalid IRQ #s.

Link: https://lore.kernel.org/r/363eb4c8-a3bf-4dc9-2a9e-90f349030a15@omprussia.ru
Fixes: 0bb67f181834 ("[SCSI] sun3x_esp: convert to esp_scsi")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/sun3x_esp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/sun3x_esp.c b/drivers/scsi/sun3x_esp.c
index d50c5ed8f428..167ae2d29e47 100644
--- a/drivers/scsi/sun3x_esp.c
+++ b/drivers/scsi/sun3x_esp.c
@@ -233,7 +233,9 @@ static int esp_sun3x_probe(struct platform_device *dev)
 	if (!esp->command_block)
 		goto fail_unmap_regs_dma;
 
-	host->irq = platform_get_irq(dev, 0);
+	host->irq = err = platform_get_irq(dev, 0);
+	if (err < 0)
+		goto fail_unmap_command_block;
 	err = request_irq(host->irq, scsi_esp_intr, IRQF_SHARED,
 			  "SUN3X ESP", esp);
 	if (err < 0)

From 0ee46d20153c0112fb8fcf1e86129e5768297ceb Mon Sep 17 00:00:00 2001
From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Date: Tue, 30 Mar 2021 20:45:12 +0300
Subject: [PATCH 2007/2658] scsi: sni_53c710: Add IRQ check

[ Upstream commit 1160d61bc51e87e509cfaf9da50a0060f67b6de4 ]

The driver neglects to check the result of platform_get_irq()'s call and
blithely passes the negative error codes to request_irq() (which takes
*unsigned* IRQ #s), causing it to fail with -EINVAL (overridden by -ENODEV
further below).  Stop calling request_irq() with the invalid IRQ #s.

Link: https://lore.kernel.org/r/8f4b8fa5-8251-b977-70a1-9099bcb4bb17@omprussia.ru
Fixes: c27d85f3f3c5 ("[SCSI] SNI RM 53c710 driver")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/sni_53c710.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/sni_53c710.c b/drivers/scsi/sni_53c710.c
index b0f5220ae23a..fad68cb028d6 100644
--- a/drivers/scsi/sni_53c710.c
+++ b/drivers/scsi/sni_53c710.c
@@ -71,6 +71,7 @@ static int snirm710_probe(struct platform_device *dev)
 	struct NCR_700_Host_Parameters *hostdata;
 	struct Scsi_Host *host;
 	struct  resource *res;
+	int rc;
 
 	res = platform_get_resource(dev, IORESOURCE_MEM, 0);
 	if (!res)
@@ -96,7 +97,9 @@ static int snirm710_probe(struct platform_device *dev)
 		goto out_kfree;
 	host->this_id = 7;
 	host->base = base;
-	host->irq = platform_get_irq(dev, 0);
+	host->irq = rc = platform_get_irq(dev, 0);
+	if (rc < 0)
+		goto out_put_host;
 	if(request_irq(host->irq, NCR_700_intr, IRQF_SHARED, "snirm710", host)) {
 		printk(KERN_ERR "snirm710: request_irq failed!\n");
 		goto out_put_host;

From 96cc013d560e3010a590877913836caa8ef4949c Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 9 Apr 2021 14:08:17 +0300
Subject: [PATCH 2008/2658] HSI: core: fix resource leaks in
 hsi_add_client_from_dt()

[ Upstream commit 5c08b0f75575648032f309a6f58294453423ed93 ]

If some of the allocations fail between the dev_set_name() and the
device_register() then the name will not be freed.  Fix this by
moving dev_set_name() directly in front of the call to device_register().

Fixes: a2aa24734d9d ("HSI: Add common DT binding for HSI client devices")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hsi/hsi.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/hsi/hsi.c b/drivers/hsi/hsi.c
index df380d55c58f..55e36fcd7ff3 100644
--- a/drivers/hsi/hsi.c
+++ b/drivers/hsi/hsi.c
@@ -223,8 +223,6 @@ static void hsi_add_client_from_dt(struct hsi_port *port,
 	if (err)
 		goto err;
 
-	dev_set_name(&cl->device, "%s", name);
-
 	err = hsi_of_property_parse_mode(client, "hsi-mode", &mode);
 	if (err) {
 		err = hsi_of_property_parse_mode(client, "hsi-rx-mode",
@@ -307,6 +305,7 @@ static void hsi_add_client_from_dt(struct hsi_port *port,
 	cl->device.release = hsi_client_release;
 	cl->device.of_node = client;
 
+	dev_set_name(&cl->device, "%s", name);
 	if (device_register(&cl->device) < 0) {
 		pr_err("hsi: failed to register client: %s\n", name);
 		put_device(&cl->device);

From ea574fcb99294150eb794866a2a669d1c4f6cd0d Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <nathan@kernel.org>
Date: Wed, 14 Apr 2021 17:11:11 -0700
Subject: [PATCH 2009/2658] x86/events/amd/iommu: Fix sysfs type mismatch

[ Upstream commit de5bc7b425d4c27ae5faa00ea7eb6b9780b9a355 ]

dev_attr_show() calls _iommu_event_show() via an indirect call but
_iommu_event_show()'s type does not currently match the type of the
show() member in 'struct device_attribute', resulting in a Control Flow
Integrity violation.

$ cat /sys/devices/amd_iommu_1/events/mem_dte_hit
csource=0x0a

$ dmesg | grep "CFI failure"
[ 3526.735140] CFI failure (target: _iommu_event_show...):

Change _iommu_event_show() and 'struct amd_iommu_event_desc' to
'struct device_attribute' so that there is no more CFI violation.

Fixes: 7be6296fdd75 ("perf/x86/amd: AMD IOMMU Performance Counter PERF uncore PMU implementation")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20210415001112.3024673-1-nathan@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/cpu/perf_event_amd_iommu.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kernel/cpu/perf_event_amd_iommu.c b/arch/x86/kernel/cpu/perf_event_amd_iommu.c
index 97242a9242bd..ec0bfbab7265 100644
--- a/arch/x86/kernel/cpu/perf_event_amd_iommu.c
+++ b/arch/x86/kernel/cpu/perf_event_amd_iommu.c
@@ -80,12 +80,12 @@ static struct attribute_group amd_iommu_format_group = {
  * sysfs events attributes
  *---------------------------------------------*/
 struct amd_iommu_event_desc {
-	struct kobj_attribute attr;
+	struct device_attribute attr;
 	const char *event;
 };
 
-static ssize_t _iommu_event_show(struct kobject *kobj,
-				struct kobj_attribute *attr, char *buf)
+static ssize_t _iommu_event_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
 {
 	struct amd_iommu_event_desc *event =
 		container_of(attr, struct amd_iommu_event_desc, attr);

From 590e8b45c2e3392002543a30894cbf066d2e090c Mon Sep 17 00:00:00 2001
From: Maxim Mikityanskiy <maxtram95@gmail.com>
Date: Sun, 7 Feb 2021 16:47:40 +0200
Subject: [PATCH 2010/2658] HID: plantronics: Workaround for double volume key
 presses

[ Upstream commit f567d6ef8606fb427636e824c867229ecb5aefab ]

Plantronics Blackwire 3220 Series (047f:c056) sends HID reports twice
for each volume key press. This patch adds a quirk to hid-plantronics
for this product ID, which will ignore the second volume key press if
it happens within 5 ms from the last one that was handled.

The patch was tested on the mentioned model only, it shouldn't affect
other models, however, this quirk might be needed for them too.
Auto-repeat (when a key is held pressed) is not affected, because the
rate is about 3 times per second, which is far less frequent than once
in 5 ms.

Fixes: 81bb773faed7 ("HID: plantronics: Update to map volume up/down controls")
Signed-off-by: Maxim Mikityanskiy <maxtram95@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-ids.h         |  1 +
 drivers/hid/hid-plantronics.c | 60 +++++++++++++++++++++++++++++++++--
 include/linux/hid.h           |  2 ++
 3 files changed, 61 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index a473c965e797..7b4d5d0da344 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -772,6 +772,7 @@
 #define USB_DEVICE_ID_ORTEK_WKB2000	0x2000
 
 #define USB_VENDOR_ID_PLANTRONICS	0x047f
+#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES	0xc056
 
 #define USB_VENDOR_ID_PANASONIC		0x04da
 #define USB_DEVICE_ID_PANABOARD_UBT780	0x1044
diff --git a/drivers/hid/hid-plantronics.c b/drivers/hid/hid-plantronics.c
index 584b10d3fc3d..460711c1124a 100644
--- a/drivers/hid/hid-plantronics.c
+++ b/drivers/hid/hid-plantronics.c
@@ -16,6 +16,7 @@
 
 #include <linux/hid.h>
 #include <linux/module.h>
+#include <linux/jiffies.h>
 
 #define PLT_HID_1_0_PAGE	0xffa00000
 #define PLT_HID_2_0_PAGE	0xffa20000
@@ -39,6 +40,16 @@
 #define PLT_ALLOW_CONSUMER (field->application == HID_CP_CONSUMERCONTROL && \
 			    (usage->hid & HID_USAGE_PAGE) == HID_UP_CONSUMER)
 
+#define PLT_QUIRK_DOUBLE_VOLUME_KEYS BIT(0)
+
+#define PLT_DOUBLE_KEY_TIMEOUT 5 /* ms */
+
+struct plt_drv_data {
+	unsigned long device_type;
+	unsigned long last_volume_key_ts;
+	u32 quirks;
+};
+
 static int plantronics_input_mapping(struct hid_device *hdev,
 				     struct hid_input *hi,
 				     struct hid_field *field,
@@ -46,7 +57,8 @@ static int plantronics_input_mapping(struct hid_device *hdev,
 				     unsigned long **bit, int *max)
 {
 	unsigned short mapped_key;
-	unsigned long plt_type = (unsigned long)hid_get_drvdata(hdev);
+	struct plt_drv_data *drv_data = hid_get_drvdata(hdev);
+	unsigned long plt_type = drv_data->device_type;
 
 	/* special case for PTT products */
 	if (field->application == HID_GD_JOYSTICK)
@@ -108,6 +120,30 @@ static int plantronics_input_mapping(struct hid_device *hdev,
 	return 1;
 }
 
+static int plantronics_event(struct hid_device *hdev, struct hid_field *field,
+			     struct hid_usage *usage, __s32 value)
+{
+	struct plt_drv_data *drv_data = hid_get_drvdata(hdev);
+
+	if (drv_data->quirks & PLT_QUIRK_DOUBLE_VOLUME_KEYS) {
+		unsigned long prev_ts, cur_ts;
+
+		/* Usages are filtered in plantronics_usages. */
+
+		if (!value) /* Handle key presses only. */
+			return 0;
+
+		prev_ts = drv_data->last_volume_key_ts;
+		cur_ts = jiffies;
+		if (jiffies_to_msecs(cur_ts - prev_ts) <= PLT_DOUBLE_KEY_TIMEOUT)
+			return 1; /* Ignore the repeated key. */
+
+		drv_data->last_volume_key_ts = cur_ts;
+	}
+
+	return 0;
+}
+
 static unsigned long plantronics_device_type(struct hid_device *hdev)
 {
 	unsigned i, col_page;
@@ -136,15 +172,24 @@ static unsigned long plantronics_device_type(struct hid_device *hdev)
 static int plantronics_probe(struct hid_device *hdev,
 			     const struct hid_device_id *id)
 {
+	struct plt_drv_data *drv_data;
 	int ret;
 
+	drv_data = devm_kzalloc(&hdev->dev, sizeof(*drv_data), GFP_KERNEL);
+	if (!drv_data)
+		return -ENOMEM;
+
 	ret = hid_parse(hdev);
 	if (ret) {
 		hid_err(hdev, "parse failed\n");
 		goto err;
 	}
 
-	hid_set_drvdata(hdev, (void *)plantronics_device_type(hdev));
+	drv_data->device_type = plantronics_device_type(hdev);
+	drv_data->quirks = id->driver_data;
+	drv_data->last_volume_key_ts = jiffies - msecs_to_jiffies(PLT_DOUBLE_KEY_TIMEOUT);
+
+	hid_set_drvdata(hdev, drv_data);
 
 	ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT |
 		HID_CONNECT_HIDINPUT_FORCE | HID_CONNECT_HIDDEV_FORCE);
@@ -156,15 +201,26 @@ static int plantronics_probe(struct hid_device *hdev,
 }
 
 static const struct hid_device_id plantronics_devices[] = {
+	{ HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS,
+					 USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES),
+		.driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) },
 	{ }
 };
 MODULE_DEVICE_TABLE(hid, plantronics_devices);
 
+static const struct hid_usage_id plantronics_usages[] = {
+	{ HID_CP_VOLUMEUP, EV_KEY, HID_ANY_ID },
+	{ HID_CP_VOLUMEDOWN, EV_KEY, HID_ANY_ID },
+	{ HID_TERMINATOR, HID_TERMINATOR, HID_TERMINATOR }
+};
+
 static struct hid_driver plantronics_driver = {
 	.name = "plantronics",
 	.id_table = plantronics_devices,
+	.usage_table = plantronics_usages,
 	.input_mapping = plantronics_input_mapping,
+	.event = plantronics_event,
 	.probe = plantronics_probe,
 };
 module_hid_driver(plantronics_driver);
diff --git a/include/linux/hid.h b/include/linux/hid.h
index d93ba6014e3c..19c53b64e07a 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -246,6 +246,8 @@ struct hid_item {
 #define HID_CP_SELECTION	0x000c0080
 #define HID_CP_MEDIASELECTION	0x000c0087
 #define HID_CP_SELECTDISC	0x000c00ba
+#define HID_CP_VOLUMEUP		0x000c00e9
+#define HID_CP_VOLUMEDOWN	0x000c00ea
 #define HID_CP_PLAYBACKSPEED	0x000c00f1
 #define HID_CP_PROXIMITY	0x000c0109
 #define HID_CP_SPEAKERSYSTEM	0x000c0160

From f634ccf30be1f0592c9651bae6f8ad85db50689e Mon Sep 17 00:00:00 2001
From: Xie He <xie.he.0141@gmail.com>
Date: Wed, 10 Mar 2021 23:23:09 -0800
Subject: [PATCH 2011/2658] net: lapbether: Prevent racing when checking
 whether the netif is running

[ Upstream commit 5acd0cfbfbb5a688da1bfb1a2152b0c855115a35 ]

There are two "netif_running" checks in this driver. One is in
"lapbeth_xmit" and the other is in "lapbeth_rcv". They serve to make
sure that the LAPB APIs called in these functions are called before
"lapb_unregister" is called by the "ndo_stop" function.

However, these "netif_running" checks are unreliable, because it's
possible that immediately after "netif_running" returns true, "ndo_stop"
is called (which causes "lapb_unregister" to be called).

This patch adds locking to make sure "lapbeth_xmit" and "lapbeth_rcv" can
reliably check and ensure the netif is running while doing their work.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Acked-by: Martin Schiller <ms@dev.tdt.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wan/lapbether.c | 32 +++++++++++++++++++++++++-------
 1 file changed, 25 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index 666bbacb8cb4..24daa1d0e9c5 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -56,6 +56,8 @@ struct lapbethdev {
 	struct list_head	node;
 	struct net_device	*ethdev;	/* link to ethernet device */
 	struct net_device	*axdev;		/* lapbeth device (lapb#) */
+	bool			up;
+	spinlock_t		up_lock;	/* Protects "up" */
 };
 
 static LIST_HEAD(lapbeth_devices);
@@ -103,8 +105,9 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
 	rcu_read_lock();
 	lapbeth = lapbeth_get_x25_dev(dev);
 	if (!lapbeth)
-		goto drop_unlock;
-	if (!netif_running(lapbeth->axdev))
+		goto drop_unlock_rcu;
+	spin_lock_bh(&lapbeth->up_lock);
+	if (!lapbeth->up)
 		goto drop_unlock;
 
 	len = skb->data[0] + skb->data[1] * 256;
@@ -119,11 +122,14 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
 		goto drop_unlock;
 	}
 out:
+	spin_unlock_bh(&lapbeth->up_lock);
 	rcu_read_unlock();
 	return 0;
 drop_unlock:
 	kfree_skb(skb);
 	goto out;
+drop_unlock_rcu:
+	rcu_read_unlock();
 drop:
 	kfree_skb(skb);
 	return 0;
@@ -151,13 +157,11 @@ static int lapbeth_data_indication(struct net_device *dev, struct sk_buff *skb)
 static netdev_tx_t lapbeth_xmit(struct sk_buff *skb,
 				      struct net_device *dev)
 {
+	struct lapbethdev *lapbeth = netdev_priv(dev);
 	int err;
 
-	/*
-	 * Just to be *really* sure not to send anything if the interface
-	 * is down, the ethernet device may have gone.
-	 */
-	if (!netif_running(dev))
+	spin_lock_bh(&lapbeth->up_lock);
+	if (!lapbeth->up)
 		goto drop;
 
 	/* There should be a pseudo header of 1 byte added by upper layers.
@@ -188,6 +192,7 @@ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb,
 		goto drop;
 	}
 out:
+	spin_unlock_bh(&lapbeth->up_lock);
 	return NETDEV_TX_OK;
 drop:
 	kfree_skb(skb);
@@ -279,6 +284,7 @@ static const struct lapb_register_struct lapbeth_callbacks = {
  */
 static int lapbeth_open(struct net_device *dev)
 {
+	struct lapbethdev *lapbeth = netdev_priv(dev);
 	int err;
 
 	if ((err = lapb_register(dev, &lapbeth_callbacks)) != LAPB_OK) {
@@ -286,13 +292,22 @@ static int lapbeth_open(struct net_device *dev)
 		return -ENODEV;
 	}
 
+	spin_lock_bh(&lapbeth->up_lock);
+	lapbeth->up = true;
+	spin_unlock_bh(&lapbeth->up_lock);
+
 	return 0;
 }
 
 static int lapbeth_close(struct net_device *dev)
 {
+	struct lapbethdev *lapbeth = netdev_priv(dev);
 	int err;
 
+	spin_lock_bh(&lapbeth->up_lock);
+	lapbeth->up = false;
+	spin_unlock_bh(&lapbeth->up_lock);
+
 	if ((err = lapb_unregister(dev)) != LAPB_OK)
 		pr_err("lapb_unregister error: %d\n", err);
 
@@ -350,6 +365,9 @@ static int lapbeth_new_device(struct net_device *dev)
 	dev_hold(dev);
 	lapbeth->ethdev = dev;
 
+	lapbeth->up = false;
+	spin_lock_init(&lapbeth->up_lock);
+
 	rc = -EIO;
 	if (register_netdevice(ndev))
 		goto fail;

From d060ce404269463f36ba4bdca58358cde654a0ca Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <nathan@kernel.org>
Date: Tue, 2 Mar 2021 13:08:29 -0700
Subject: [PATCH 2012/2658] powerpc/prom: Mark identical_pvr_fixup as __init

[ Upstream commit 1ef1dd9c7ed27b080445e1576e8a05957e0e4dfc ]

If identical_pvr_fixup() is not inlined, there are two modpost warnings:

WARNING: modpost: vmlinux.o(.text+0x54e8): Section mismatch in reference
from the function identical_pvr_fixup() to the function
.init.text:of_get_flat_dt_prop()
The function identical_pvr_fixup() references
the function __init of_get_flat_dt_prop().
This is often because identical_pvr_fixup lacks a __init
annotation or the annotation of of_get_flat_dt_prop is wrong.

WARNING: modpost: vmlinux.o(.text+0x551c): Section mismatch in reference
from the function identical_pvr_fixup() to the function
.init.text:identify_cpu()
The function identical_pvr_fixup() references
the function __init identify_cpu().
This is often because identical_pvr_fixup lacks a __init
annotation or the annotation of identify_cpu is wrong.

identical_pvr_fixup() calls two functions marked as __init and is only
called by a function marked as __init so it should be marked as __init
as well. At the same time, remove the inline keywork as it is not
necessary to inline this function. The compiler is still free to do so
if it feels it is worthwhile since commit 889b3c1245de ("compiler:
remove CONFIG_OPTIMIZE_INLINING entirely").

Fixes: 14b3d926a22b ("[POWERPC] 4xx: update 440EP(x)/440GR(x) identical PVR issue workaround")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://github.com/ClangBuiltLinux/linux/issues/1316
Link: https://lore.kernel.org/r/20210302200829.2680663-1-nathan@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/prom.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
index 04a27307a2c4..77690c7f2671 100644
--- a/arch/powerpc/kernel/prom.c
+++ b/arch/powerpc/kernel/prom.c
@@ -258,7 +258,7 @@ static struct feature_property {
 };
 
 #if defined(CONFIG_44x) && defined(CONFIG_PPC_FPU)
-static inline void identical_pvr_fixup(unsigned long node)
+static __init void identical_pvr_fixup(unsigned long node)
 {
 	unsigned int pvr;
 	const char *model = of_get_flat_dt_prop(node, "model", NULL);

From 85c90da4bf27ab8618c5fbd1ea4b5db8c083eae7 Mon Sep 17 00:00:00 2001
From: Jia Zhou <zhou.jia2@zte.com.cn>
Date: Tue, 30 Mar 2021 13:19:23 +0200
Subject: [PATCH 2013/2658] ALSA: core: remove redundant spin_lock pair in
 snd_card_disconnect

[ Upstream commit abc21649b3e5c34b143bf86f0c78e33d5815e250 ]

modification in commit 2a3f7221acdd ("ALSA: core: Fix card races between
register and disconnect") resulting in this problem.

Fixes: 2a3f7221acdd ("ALSA: core: Fix card races between register and disconnect")
Signed-off-by: Jia Zhou <zhou.jia2@zte.com.cn>
Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
Link: https://lore.kernel.org/r/1616989007-34429-1-git-send-email-wang.yi59@zte.com.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/core/init.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/sound/core/init.c b/sound/core/init.c
index 969ab45bc85e..f2b2102c0a72 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -447,10 +447,8 @@ int snd_card_disconnect(struct snd_card *card)
 		return 0;
 	}
 	card->shutdown = 1;
-	spin_unlock(&card->files_lock);
 
 	/* replace file->f_op with special dummy operations */
-	spin_lock(&card->files_lock);
 	list_for_each_entry(mfile, &card->files_list, list) {
 		/* it's critical part, use endless loop */
 		/* we have no room to fail */

From 6883a77f3caa50b371e89213cf69a03d0c84f4d0 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 2 Apr 2021 14:44:42 +0300
Subject: [PATCH 2014/2658] nfc: pn533: prevent potential memory corruption

[ Upstream commit ca4d4c34ae9aa5c3c0da76662c5e549d2fc0cc86 ]

If the "type_a->nfcid_len" is too large then it would lead to memory
corruption in pn533_target_found_type_a() when we do:

	memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);

Fixes: c3b1e1e8a76f ("NFC: Export NFCID1 from pn533")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nfc/pn533.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/nfc/pn533.c b/drivers/nfc/pn533.c
index bb3d5ea9869c..001c12867e43 100644
--- a/drivers/nfc/pn533.c
+++ b/drivers/nfc/pn533.c
@@ -1250,6 +1250,9 @@ static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
 	if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0)
 		return false;
 
+	if (type_a->nfcid_len > NFC_NFCID1_MAXSIZE)
+		return false;
+
 	return true;
 }
 

From 54c3881d39018a37b49786b76b1cdba786770b1a Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 6 Apr 2021 13:35:34 +0200
Subject: [PATCH 2015/2658] ALSA: usb-audio: Add error checks for
 usb_driver_claim_interface() calls

[ Upstream commit 5fb45414ae03421255593fd5556aa2d1d82303aa ]

There are a few calls of usb_driver_claim_interface() but all of those
miss the proper error checks, as reported by Coverity.  This patch
adds those missing checks.

Along with it, replace the magic pointer with -1 with a constant
USB_AUDIO_IFACE_UNUSED for better readability.

Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1475943 ("Error handling issues")
Addresses-Coverity-ID: 1475944 ("Error handling issues")
Addresses-Coverity-ID: 1475945 ("Error handling issues")
Fixes: b1ce7ba619d9 ("ALSA: usb-audio: claim autodetected PCM interfaces all at once")
Fixes: e5779998bf8b ("ALSA: usb-audio: refactor code")
Link: https://lore.kernel.org/r/202104051059.FB7F3016@keescook
Link: https://lore.kernel.org/r/20210406113534.30455-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/card.c     | 14 +++++++-------
 sound/usb/quirks.c   | 16 ++++++++++++----
 sound/usb/usbaudio.h |  2 ++
 3 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/sound/usb/card.c b/sound/usb/card.c
index d72e596e4db8..7d1542c7cb4e 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -245,9 +245,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int
 				ctrlif, interface);
 			return -EINVAL;
 		}
-		usb_driver_claim_interface(&usb_audio_driver, iface, (void *)-1L);
-
-		return 0;
+		return usb_driver_claim_interface(&usb_audio_driver, iface,
+						  USB_AUDIO_IFACE_UNUSED);
 	}
 
 	if ((altsd->bInterfaceClass != USB_CLASS_AUDIO &&
@@ -267,7 +266,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int
 
 	if (! snd_usb_parse_audio_interface(chip, interface)) {
 		usb_set_interface(dev, interface, 0); /* reset the current interface */
-		usb_driver_claim_interface(&usb_audio_driver, iface, (void *)-1L);
+		return usb_driver_claim_interface(&usb_audio_driver, iface,
+						  USB_AUDIO_IFACE_UNUSED);
 	}
 
 	return 0;
@@ -710,7 +710,7 @@ static void usb_audio_disconnect(struct usb_interface *intf)
 	struct snd_card *card;
 	struct list_head *p;
 
-	if (chip == (void *)-1L)
+	if (chip == USB_AUDIO_IFACE_UNUSED)
 		return;
 
 	card = chip->card;
@@ -813,7 +813,7 @@ static int usb_audio_suspend(struct usb_interface *intf, pm_message_t message)
 	struct usb_mixer_interface *mixer;
 	struct list_head *p;
 
-	if (chip == (void *)-1L)
+	if (chip == USB_AUDIO_IFACE_UNUSED)
 		return 0;
 
 	if (!chip->num_suspended_intf++) {
@@ -843,7 +843,7 @@ static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume)
 	struct list_head *p;
 	int err = 0;
 
-	if (chip == (void *)-1L)
+	if (chip == USB_AUDIO_IFACE_UNUSED)
 		return 0;
 
 	atomic_inc(&chip->active); /* avoid autopm */
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index cd615514a5ff..7979a9e19c53 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -66,8 +66,12 @@ static int create_composite_quirk(struct snd_usb_audio *chip,
 		if (!iface)
 			continue;
 		if (quirk->ifnum != probed_ifnum &&
-		    !usb_interface_claimed(iface))
-			usb_driver_claim_interface(driver, iface, (void *)-1L);
+		    !usb_interface_claimed(iface)) {
+			err = usb_driver_claim_interface(driver, iface,
+							 USB_AUDIO_IFACE_UNUSED);
+			if (err < 0)
+				return err;
+		}
 	}
 
 	return 0;
@@ -399,8 +403,12 @@ static int create_autodetect_quirks(struct snd_usb_audio *chip,
 			continue;
 
 		err = create_autodetect_quirk(chip, iface, driver);
-		if (err >= 0)
-			usb_driver_claim_interface(driver, iface, (void *)-1L);
+		if (err >= 0) {
+			err = usb_driver_claim_interface(driver, iface,
+							 USB_AUDIO_IFACE_UNUSED);
+			if (err < 0)
+				return err;
+		}
 	}
 
 	return 0;
diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h
index ad8e09825866..2c70e0961e3d 100644
--- a/sound/usb/usbaudio.h
+++ b/sound/usb/usbaudio.h
@@ -66,6 +66,8 @@ struct snd_usb_audio {
 	void (*disconnect_cb)(struct snd_usb_audio *chip);
 };
 
+#define USB_AUDIO_IFACE_UNUSED	((void *)-1L)
+
 #define usb_audio_err(chip, fmt, args...) \
 	dev_err(&(chip)->dev->dev, fmt, ##args)
 #define usb_audio_warn(chip, fmt, args...) \

From 86e76c43a5e5b255da4b83f6b247e65ba2fc20da Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Sun, 4 Apr 2021 12:26:23 -0700
Subject: [PATCH 2016/2658] powerpc: iommu: fix build when neither PCI or
 IBMVIO is set

[ Upstream commit b27dadecdf9102838331b9a0b41ffc1cfe288154 ]

When neither CONFIG_PCI nor CONFIG_IBMVIO is set/enabled, iommu.c has a
build error. The fault injection code is not useful in that kernel config,
so make the FAIL_IOMMU option depend on PCI || IBMVIO.

Prevents this build error (warning escalated to error):
../arch/powerpc/kernel/iommu.c:178:30: error: 'fail_iommu_bus_notifier' defined but not used [-Werror=unused-variable]
  178 | static struct notifier_block fail_iommu_bus_notifier = {

Fixes: d6b9a81b2a45 ("powerpc: IOMMU fault injection")
Reported-by: kernel test robot <lkp@intel.com>
Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210404192623.10697-1-rdunlap@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/Kconfig.debug | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug
index 3a510f4a6b68..7e62572215ce 100644
--- a/arch/powerpc/Kconfig.debug
+++ b/arch/powerpc/Kconfig.debug
@@ -350,6 +350,7 @@ config STRICT_DEVMEM
 config FAIL_IOMMU
 	bool "Fault-injection capability for IOMMU"
 	depends on FAULT_INJECTION
+	depends on PCI || IBMVIO
 	help
 	  Provide fault-injection capability for IOMMU. Each device can
 	  be selectively enabled via the fail_iommu property.

From cbda7ba8e70085aa6f80f6ee3bc4d55b9518d230 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Thu, 8 Apr 2021 14:31:50 +0200
Subject: [PATCH 2017/2658] mac80211: bail out if cipher schemes are invalid

[ Upstream commit db878e27a98106a70315d264cc92230d84009e72 ]

If any of the cipher schemes specified by the driver are invalid, bail
out and fail the registration rather than just warning.  Otherwise, we
might later crash when we try to use the invalid cipher scheme, e.g.
if the hdr_len is (significantly) less than the pn_offs + pn_len, we'd
have an out-of-bounds access in RX validation.

Fixes: 2475b1cc0d52 ("mac80211: add generic cipher scheme support")
Link: https://lore.kernel.org/r/20210408143149.38a3a13a1b19.I6b7f5790fa0958ed8049cf02ac2a535c61e9bc96@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/main.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 2357b17254e7..871931577ef4 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1019,8 +1019,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 	if (local->hw.wiphy->max_scan_ie_len)
 		local->hw.wiphy->max_scan_ie_len -= local->scan_ies_len;
 
-	WARN_ON(!ieee80211_cs_list_valid(local->hw.cipher_schemes,
-					 local->hw.n_cipher_schemes));
+	if (WARN_ON(!ieee80211_cs_list_valid(local->hw.cipher_schemes,
+					     local->hw.n_cipher_schemes))) {
+		result = -EINVAL;
+		goto fail_workqueue;
+	}
 
 	result = ieee80211_init_cipher_suites(local);
 	if (result < 0)

From 9de13f3e6436847edfb163180c94ac39c0476e2c Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Thu, 25 Feb 2021 18:32:41 +0000
Subject: [PATCH 2018/2658] mt7601u: fix always true expression

[ Upstream commit 87fce88658ba047ae62e83497d3f3c5dc22fa6f9 ]

Currently the expression ~nic_conf1 is always true because nic_conf1
is a u16 and according to 6.5.3.3 of the C standard the ~ operator
promotes the u16 to an integer before flipping all the bits. Thus
the top 16 bits of the integer result are all set so the expression
is always true.  If the intention was to flip all the bits of nic_conf1
then casting the integer result back to a u16 is a suitabel fix.

Interestingly static analyzers seem to thing a bitwise ! should be
used instead of ~ for this scenario, so I think the original intent
of the expression may need some extra consideration.

Addresses-Coverity: ("Logical vs. bitwise operator")
Fixes: c869f77d6abb ("add mt7601u driver")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Jakub Kicinski <kubakici@wp.pl>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210225183241.1002129-1-colin.king@canonical.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt7601u/eeprom.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt7601u/eeprom.c b/drivers/net/wireless/mediatek/mt7601u/eeprom.c
index 8d8ee0344f7b..7b917c4613ad 100644
--- a/drivers/net/wireless/mediatek/mt7601u/eeprom.c
+++ b/drivers/net/wireless/mediatek/mt7601u/eeprom.c
@@ -106,7 +106,7 @@ mt7601u_has_tssi(struct mt7601u_dev *dev, u8 *eeprom)
 {
 	u16 nic_conf1 = get_unaligned_le16(eeprom + MT_EE_NIC_CONF_1);
 
-	return ~nic_conf1 && (nic_conf1 & MT_EE_NIC_CONF_1_TX_ALC_EN);
+	return (u16)~nic_conf1 && (nic_conf1 & MT_EE_NIC_CONF_1_TX_ALC_EN);
 }
 
 static void

From aebf0e18b5ba327a62426231b58038d5ef03b0ea Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Fri, 9 Apr 2021 14:07:26 +0100
Subject: [PATCH 2019/2658] net: thunderx: Fix unintentional sign extension
 issue

[ Upstream commit e701a25840360706fe4cf5de0015913ca19c274b ]

The shifting of the u8 integers rq->caching by 26 bits to
the left will be promoted to a 32 bit signed int and then
sign-extended to a u64. In the event that rq->caching is
greater than 0x1f then all then all the upper 32 bits of
the u64 end up as also being set because of the int
sign-extension. Fix this by casting the u8 values to a
u64 before the 26 bit left shift.

Addresses-Coverity: ("Unintended sign extension")
Fixes: 4863dea3fab0 ("net: Adding support for Cavium ThunderX network controller")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index 912ee28ab58b..5da49e8b533b 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -528,7 +528,7 @@ static void nicvf_rcv_queue_config(struct nicvf *nic, struct queue_set *qs,
 	mbx.rq.msg = NIC_MBOX_MSG_RQ_CFG;
 	mbx.rq.qs_num = qs->vnic_id;
 	mbx.rq.rq_num = qidx;
-	mbx.rq.cfg = (rq->caching << 26) | (rq->cq_qs << 19) |
+	mbx.rq.cfg = ((u64)rq->caching << 26) | (rq->cq_qs << 19) |
 			  (rq->cq_idx << 16) | (rq->cont_rbdr_qs << 9) |
 			  (rq->cont_qs_rbdr_idx << 8) |
 			  (rq->start_rbdr_qs << 1) | (rq->start_qs_rbdr_idx);

From 6be039aad03e3605843a03e805e51eaf6266eb6f Mon Sep 17 00:00:00 2001
From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Date: Sat, 10 Apr 2021 23:14:35 +0300
Subject: [PATCH 2020/2658] i2c: cadence: add IRQ check

[ Upstream commit 5581c2c5d02bc63a0edb53e061c8e97cd490646e ]

The driver neglects to check the result of platform_get_irq()'s call and
blithely passes the negative error codes to devm_request_irq() (which
takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding
an original error code.  Stop calling devm_request_irq() with invalid
IRQ #s.

Fixes: df8eb5691c48 ("i2c: Add driver for Cadence I2C controller")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-cadence.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
index 84deed6571bd..7d15c9143d16 100644
--- a/drivers/i2c/busses/i2c-cadence.c
+++ b/drivers/i2c/busses/i2c-cadence.c
@@ -894,7 +894,10 @@ static int cdns_i2c_probe(struct platform_device *pdev)
 	if (IS_ERR(id->membase))
 		return PTR_ERR(id->membase);
 
-	id->irq = platform_get_irq(pdev, 0);
+	ret = platform_get_irq(pdev, 0);
+	if (ret < 0)
+		return ret;
+	id->irq = ret;
 
 	id->adap.owner = THIS_MODULE;
 	id->adap.dev.of_node = pdev->dev.of_node;

From 289d8d30ff6934048d32c44154115d5df685f322 Mon Sep 17 00:00:00 2001
From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Date: Sat, 10 Apr 2021 23:18:31 +0300
Subject: [PATCH 2021/2658] i2c: jz4780: add IRQ check

[ Upstream commit c5e5f7a8d931fb4beba245bdbc94734175fda9de ]

The driver neglects to check the result of platform_get_irq()'s call and
blithely passes the negative error codes to devm_request_irq() (which
takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding
an original error code.  Stop calling devm_request_irq() with invalid
IRQ #s.

Fixes: ba92222ed63a ("i2c: jz4780: Add i2c bus controller driver for Ingenic JZ4780")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-jz4780.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-jz4780.c b/drivers/i2c/busses/i2c-jz4780.c
index ba3b94505c14..d80cee068bea 100644
--- a/drivers/i2c/busses/i2c-jz4780.c
+++ b/drivers/i2c/busses/i2c-jz4780.c
@@ -754,7 +754,10 @@ static int jz4780_i2c_probe(struct platform_device *pdev)
 
 	jz4780_i2c_writew(i2c, JZ4780_I2C_INTM, 0x0);
 
-	i2c->irq = platform_get_irq(pdev, 0);
+	ret = platform_get_irq(pdev, 0);
+	if (ret < 0)
+		goto err;
+	i2c->irq = ret;
 	ret = devm_request_irq(&pdev->dev, i2c->irq, jz4780_i2c_irq, 0,
 			       dev_name(&pdev->dev), i2c);
 	if (ret)

From 853fb4a9d4112b1537f906d0014638f704d5bd0d Mon Sep 17 00:00:00 2001
From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Date: Sat, 10 Apr 2021 23:25:10 +0300
Subject: [PATCH 2022/2658] i2c: sh7760: add IRQ check

[ Upstream commit e5b2e3e742015dd2aa6bc7bcef2cb59b2de1221c ]

The driver neglects to check the result of platform_get_irq()'s call and
blithely passes the negative error codes to devm_request_irq() (which
takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding
an original error code.  Stop calling devm_request_irq() with invalid
IRQ #s.

Fixes: a26c20b1fa6d ("i2c: Renesas SH7760 I2C master driver")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-sh7760.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-sh7760.c b/drivers/i2c/busses/i2c-sh7760.c
index 24968384b401..70e4437060d5 100644
--- a/drivers/i2c/busses/i2c-sh7760.c
+++ b/drivers/i2c/busses/i2c-sh7760.c
@@ -471,7 +471,10 @@ static int sh7760_i2c_probe(struct platform_device *pdev)
 		goto out2;
 	}
 
-	id->irq = platform_get_irq(pdev, 0);
+	ret = platform_get_irq(pdev, 0);
+	if (ret < 0)
+		return ret;
+	id->irq = ret;
 
 	id->adap.nr = pdev->id;
 	id->adap.algo = &sh7760_i2c_algo;

From 29343849ad0055bb941cacf2c09081601fbeb3c6 Mon Sep 17 00:00:00 2001
From: Tyrel Datwyler <tyreld@linux.ibm.com>
Date: Thu, 11 Feb 2021 12:24:35 -0600
Subject: [PATCH 2023/2658] powerpc/pseries: extract host bridge from pci_bus
 prior to bus removal

[ Upstream commit 38d0b1c9cec71e6d0f3bddef0bbce41d05a3e796 ]

The pci_bus->bridge reference may no longer be valid after
pci_bus_remove() resulting in passing a bad value to device_unregister()
for the associated bridge device.

Store the host_bridge reference in a separate variable prior to
pci_bus_remove().

Fixes: 7340056567e3 ("powerpc/pci: Reorder pci bus/bridge unregistration during PHB removal")
Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210211182435.47968-1-tyreld@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/pci_dlpar.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c
index 5d4a3df59d0c..baaeb753fa79 100644
--- a/arch/powerpc/platforms/pseries/pci_dlpar.c
+++ b/arch/powerpc/platforms/pseries/pci_dlpar.c
@@ -98,6 +98,7 @@ EXPORT_SYMBOL_GPL(init_phb_dynamic);
 int remove_phb_dynamic(struct pci_controller *phb)
 {
 	struct pci_bus *b = phb->bus;
+	struct pci_host_bridge *host_bridge = to_pci_host_bridge(b->bridge);
 	struct resource *res;
 	int rc, i;
 
@@ -124,7 +125,8 @@ int remove_phb_dynamic(struct pci_controller *phb)
 	/* Remove the PCI bus and unregister the bridge device from sysfs */
 	phb->bus = NULL;
 	pci_remove_bus(b);
-	device_unregister(b->bridge);
+	host_bridge->bus = NULL;
+	device_unregister(&host_bridge->dev);
 
 	/* Now release the IO resource */
 	if (res->flags & IORESOURCE_IO)

From 12b056ec56b6e0c43e27b0fa271aa3c95463f229 Mon Sep 17 00:00:00 2001
From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Date: Sat, 17 Apr 2021 22:05:05 +0300
Subject: [PATCH 2024/2658] i2c: sh7760: fix IRQ error path

[ Upstream commit 92dfb27240fea2776f61c5422472cb6defca7767 ]

While adding the invalid IRQ check after calling platform_get_irq(),
I managed to overlook that the driver has a complex error path in its
probe() method, thus a simple *return* couldn't be used.  Use a proper
*goto* instead!

Fixes: e5b2e3e74201 ("i2c: sh7760: add IRQ check")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-sh7760.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-sh7760.c b/drivers/i2c/busses/i2c-sh7760.c
index 70e4437060d5..c836c53caa3f 100644
--- a/drivers/i2c/busses/i2c-sh7760.c
+++ b/drivers/i2c/busses/i2c-sh7760.c
@@ -473,7 +473,7 @@ static int sh7760_i2c_probe(struct platform_device *pdev)
 
 	ret = platform_get_irq(pdev, 0);
 	if (ret < 0)
-		return ret;
+		goto out3;
 	id->irq = ret;
 
 	id->adap.nr = pdev->id;

From ccca96dd57da862b77b46b048b84fed22b2a3037 Mon Sep 17 00:00:00 2001
From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Date: Fri, 2 Apr 2021 11:26:27 -0700
Subject: [PATCH 2025/2658] mwl8k: Fix a double Free in mwl8k_probe_hw

[ Upstream commit a8e083ee8e2a6c94c29733835adae8bf5b832748 ]

In mwl8k_probe_hw, hw->priv->txq is freed at the first time by
dma_free_coherent() in the call chain:
if(!priv->ap_fw)->mwl8k_init_txqs(hw)->mwl8k_txq_init(hw, i).

Then in err_free_queues of mwl8k_probe_hw, hw->priv->txq is freed
at the second time by mwl8k_txq_deinit(hw, i)->dma_free_coherent().

My patch set txq->txd to NULL after the first free to avoid the
double free.

Fixes: a66098daacee2 ("mwl8k: Marvell TOPDOG wireless driver")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210402182627.4256-1-lyl2019@mail.ustc.edu.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mwl8k.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 088429d0a634..d448480b8406 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -1459,6 +1459,7 @@ static int mwl8k_txq_init(struct ieee80211_hw *hw, int index)
 	txq->skb = kcalloc(MWL8K_TX_DESCS, sizeof(*txq->skb), GFP_KERNEL);
 	if (txq->skb == NULL) {
 		pci_free_consistent(priv->pdev, size, txq->txd, txq->txd_dma);
+		txq->txd = NULL;
 		return -ENOMEM;
 	}
 

From 2ea22bbca96fcd4dc27305ec4b1dbdf58ccd8ab0 Mon Sep 17 00:00:00 2001
From: Stefano Garzarella <sgarzare@redhat.com>
Date: Fri, 16 Apr 2021 12:44:16 +0200
Subject: [PATCH 2026/2658] vsock/vmci: log once the failed queue pair
 allocation

[ Upstream commit e16edc99d658cd41c60a44cc14d170697aa3271f ]

VMCI feature is not supported in conjunction with the vSphere Fault
Tolerance (FT) feature.

VMware Tools can repeatedly try to create a vsock connection. If FT is
enabled the kernel logs is flooded with the following messages:

    qp_alloc_hypercall result = -20
    Could not attach to queue pair with -20

"qp_alloc_hypercall result = -20" was hidden by commit e8266c4c3307
("VMCI: Stop log spew when qp allocation isn't possible"), but "Could
not attach to queue pair with -20" is still there flooding the log.

Since the error message can be useful in some cases, print it only once.

Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/vmw_vsock/vmci_transport.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
index 217810674c35..1f3f34b56840 100644
--- a/net/vmw_vsock/vmci_transport.c
+++ b/net/vmw_vsock/vmci_transport.c
@@ -593,8 +593,7 @@ vmci_transport_queue_pair_alloc(struct vmci_qp **qpair,
 			       peer, flags, VMCI_NO_PRIVILEGE_FLAGS);
 out:
 	if (err < 0) {
-		pr_err("Could not attach to queue pair with %d\n",
-		       err);
+		pr_err_once("Could not attach to queue pair with %d\n", err);
 		err = vmci_transport_error_to_vsock_error(err);
 	}
 

From f23bba04a0a3da9964c81e903d5bc7164b4ca23b Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Tue, 20 Apr 2021 18:16:14 +0100
Subject: [PATCH 2027/2658] net: davinci_emac: Fix incorrect masking of tx and
 rx error channel

[ Upstream commit d83b8aa5207d81f9f6daec9888390f079cc5db3f ]

The bit-masks used for the TXERRCH and RXERRCH (tx and rx error channels)
are incorrect and always lead to a zero result. The mask values are
currently the incorrect post-right shifted values, fix this by setting
them to the currect values.

(I double checked these against the TMS320TCI6482 data sheet, section
5.30, page 127 to ensure I had the correct mask values for the TXERRCH
and RXERRCH fields in the MACSTATUS register).

Addresses-Coverity: ("Operands don't affect result")
Fixes: a6286ee630f6 ("net: Add TI DaVinci EMAC driver")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/ti/davinci_emac.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index e4c4747bdf32..e11f436b0726 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -183,11 +183,11 @@ static const char emac_version_string[] = "TI DaVinci EMAC Linux v6.1";
 /* EMAC mac_status register */
 #define EMAC_MACSTATUS_TXERRCODE_MASK	(0xF00000)
 #define EMAC_MACSTATUS_TXERRCODE_SHIFT	(20)
-#define EMAC_MACSTATUS_TXERRCH_MASK	(0x7)
+#define EMAC_MACSTATUS_TXERRCH_MASK	(0x70000)
 #define EMAC_MACSTATUS_TXERRCH_SHIFT	(16)
 #define EMAC_MACSTATUS_RXERRCODE_MASK	(0xF000)
 #define EMAC_MACSTATUS_RXERRCODE_SHIFT	(12)
-#define EMAC_MACSTATUS_RXERRCH_MASK	(0x7)
+#define EMAC_MACSTATUS_RXERRCH_MASK	(0x700)
 #define EMAC_MACSTATUS_RXERRCH_SHIFT	(8)
 
 /* EMAC RX register masks */

From 47717caa70d2fddbdaf6761716d9dfa6afb4bacd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@redhat.com>
Date: Fri, 26 Mar 2021 19:08:19 +0100
Subject: [PATCH 2028/2658] ath9k: Fix error check in ath9k_hw_read_revisions()
 for PCI devices
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 7dd9a40fd6e0d0f1fd8e1931c007e080801dfdce ]

When the error check in ath9k_hw_read_revisions() was added, it checked for
-EIO which is what ath9k_regread() in the ath9k_htc driver uses. However,
for plain ath9k, the register read function uses ioread32(), which just
returns -1 on error. So if such a read fails, it still gets passed through
and ends up as a weird mac revision in the log output.

Fix this by changing ath9k_regread() to return -1 on error like ioread32()
does, and fix the error check to look for that instead of -EIO.

Fixes: 2f90c7e5d094 ("ath9k: Check for errors when reading SREV register")
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Reviewed-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210326180819.142480-1-toke@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 +-
 drivers/net/wireless/ath/ath9k/hw.c           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 3932e3d14f3d..379e843fbe0d 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -246,7 +246,7 @@ static unsigned int ath9k_regread(void *hw_priv, u32 reg_offset)
 	if (unlikely(r)) {
 		ath_dbg(common, WMI, "REGISTER READ FAILED: (0x%04x, %d)\n",
 			reg_offset, r);
-		return -EIO;
+		return -1;
 	}
 
 	return be32_to_cpu(val);
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index d50e2e8bd998..25c3e5d3fe62 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -285,7 +285,7 @@ static bool ath9k_hw_read_revisions(struct ath_hw *ah)
 
 	srev = REG_READ(ah, AR_SREV);
 
-	if (srev == -EIO) {
+	if (srev == -1) {
 		ath_err(ath9k_hw_common(ah),
 			"Failed to read SREV register");
 		return false;

From c132a1af42de84140acd853fd62b1002aaa64e8c Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@csgroup.eu>
Date: Wed, 21 Apr 2021 17:24:03 +0000
Subject: [PATCH 2029/2658] powerpc/52xx: Fix an invalid ASM expression ('addi'
 used instead of 'add')

[ Upstream commit 8a87a507714386efc39c3ae6fa24d4f79846b522 ]

  AS      arch/powerpc/platforms/52xx/lite5200_sleep.o
arch/powerpc/platforms/52xx/lite5200_sleep.S: Assembler messages:
arch/powerpc/platforms/52xx/lite5200_sleep.S:184: Warning: invalid register expression

In the following code, 'addi' is wrong, has to be 'add'

	/* local udelay in sram is needed */
  udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */
	mullw	r12, r12, r11
	mftb	r13	/* start */
	addi	r12, r13, r12 /* end */

Fixes: ee983079ce04 ("[POWERPC] MPC5200 low power mode")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/cb4cec9131c8577803367f1699209a7e104cec2a.1619025821.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/52xx/lite5200_sleep.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/platforms/52xx/lite5200_sleep.S b/arch/powerpc/platforms/52xx/lite5200_sleep.S
index 08ab6fefcf7a..5f44e9223413 100644
--- a/arch/powerpc/platforms/52xx/lite5200_sleep.S
+++ b/arch/powerpc/platforms/52xx/lite5200_sleep.S
@@ -180,7 +180,7 @@ sram_code:
   udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */
 	mullw	r12, r12, r11
 	mftb	r13	/* start */
-	addi	r12, r13, r12 /* end */
+	add	r12, r13, r12 /* end */
     1:
 	mftb	r13	/* current */
 	cmp	cr0, r13, r12

From 6eaeedf950b5518dbb0ff474f144c884a1f8d51f Mon Sep 17 00:00:00 2001
From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Date: Tue, 27 Apr 2021 09:22:58 -0700
Subject: [PATCH 2030/2658] net:nfc:digital: Fix a double free in
 digital_tg_recv_dep_req

[ Upstream commit 75258586793efc521e5dd52a5bf6c7a4cf7002be ]

In digital_tg_recv_dep_req, it calls nfc_tm_data_received(..,resp).
If nfc_tm_data_received() failed, the callee will free the resp via
kfree_skb() and return error. But in the exit branch, the resp
will be freed again.

My patch sets resp to NULL if nfc_tm_data_received() failed, to
avoid the double free.

Fixes: 1c7a4c24fbfd9 ("NFC Digital: Add target NFC-DEP support")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/nfc/digital_dep.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c
index f72be7433df3..46375ff214c0 100644
--- a/net/nfc/digital_dep.c
+++ b/net/nfc/digital_dep.c
@@ -1187,6 +1187,8 @@ static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,
 	}
 
 	rc = nfc_tm_data_received(ddev->nfc_dev, resp);
+	if (rc)
+		resp = NULL;
 
 exit:
 	kfree_skb(ddev->chaining_skb);

From 7588c654b6403169596d0296a248d66b9d519850 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 29 Apr 2021 22:54:15 -0700
Subject: [PATCH 2031/2658] kfifo: fix ternary sign extension bugs

[ Upstream commit 926ee00ea24320052b46745ef4b00d91c05bd03d ]

The intent with this code was to return negative error codes but instead
it returns positives.

The problem is how type promotion works with ternary operations.  These
functions return long, "ret" is an int and "copied" is a u32.  The
negative error code is first cast to u32 so it becomes a high positive and
then cast to long where it's still a positive.

We could fix this by declaring "ret" as a ssize_t but let's just get rid
of the ternaries instead.

Link: https://lkml.kernel.org/r/YIE+/cK1tBzSuQPU@mwanda
Fixes: 5bf2b19320ec ("kfifo: add example files to the kernel sample directory")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Stefani Seibold <stefani@seibold.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 samples/kfifo/bytestream-example.c | 8 ++++++--
 samples/kfifo/inttype-example.c    | 8 ++++++--
 samples/kfifo/record-example.c     | 8 ++++++--
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/samples/kfifo/bytestream-example.c b/samples/kfifo/bytestream-example.c
index 2fca916d9edf..a7f5ee8b6edc 100644
--- a/samples/kfifo/bytestream-example.c
+++ b/samples/kfifo/bytestream-example.c
@@ -124,8 +124,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf,
 	ret = kfifo_from_user(&test, buf, count, &copied);
 
 	mutex_unlock(&write_lock);
+	if (ret)
+		return ret;
 
-	return ret ? ret : copied;
+	return copied;
 }
 
 static ssize_t fifo_read(struct file *file, char __user *buf,
@@ -140,8 +142,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf,
 	ret = kfifo_to_user(&test, buf, count, &copied);
 
 	mutex_unlock(&read_lock);
+	if (ret)
+		return ret;
 
-	return ret ? ret : copied;
+	return copied;
 }
 
 static const struct file_operations fifo_fops = {
diff --git a/samples/kfifo/inttype-example.c b/samples/kfifo/inttype-example.c
index 8dc3c2e7105a..a326a37e9163 100644
--- a/samples/kfifo/inttype-example.c
+++ b/samples/kfifo/inttype-example.c
@@ -117,8 +117,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf,
 	ret = kfifo_from_user(&test, buf, count, &copied);
 
 	mutex_unlock(&write_lock);
+	if (ret)
+		return ret;
 
-	return ret ? ret : copied;
+	return copied;
 }
 
 static ssize_t fifo_read(struct file *file, char __user *buf,
@@ -133,8 +135,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf,
 	ret = kfifo_to_user(&test, buf, count, &copied);
 
 	mutex_unlock(&read_lock);
+	if (ret)
+		return ret;
 
-	return ret ? ret : copied;
+	return copied;
 }
 
 static const struct file_operations fifo_fops = {
diff --git a/samples/kfifo/record-example.c b/samples/kfifo/record-example.c
index 2d7529eeb294..deb87a2e4e6b 100644
--- a/samples/kfifo/record-example.c
+++ b/samples/kfifo/record-example.c
@@ -131,8 +131,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf,
 	ret = kfifo_from_user(&test, buf, count, &copied);
 
 	mutex_unlock(&write_lock);
+	if (ret)
+		return ret;
 
-	return ret ? ret : copied;
+	return copied;
 }
 
 static ssize_t fifo_read(struct file *file, char __user *buf,
@@ -147,8 +149,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf,
 	ret = kfifo_to_user(&test, buf, count, &copied);
 
 	mutex_unlock(&read_lock);
+	if (ret)
+		return ret;
 
-	return ret ? ret : copied;
+	return copied;
 }
 
 static const struct file_operations fifo_fops = {

From dfbd2122ee0c53e2f07ecc87c148a92504020799 Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Mon, 3 May 2021 05:11:41 +0800
Subject: [PATCH 2032/2658] Revert "net/sctp: fix race condition in
 sctp_destroy_sock"

commit 01bfe5e8e428b475982a98a46cca5755726f3f7f upstream.

This reverts commit b166a20b07382b8bc1dcee2a448715c9c2c81b5b.

This one has to be reverted as it introduced a dead lock, as
syzbot reported:

       CPU0                    CPU1
       ----                    ----
  lock(&net->sctp.addr_wq_lock);
                               lock(slock-AF_INET6);
                               lock(&net->sctp.addr_wq_lock);
  lock(slock-AF_INET6);

CPU0 is the thread of sctp_addr_wq_timeout_handler(), and CPU1
is that of sctp_close().

The original issue this commit fixed will be fixed in the next
patch.

Reported-by: syzbot+959223586843e69a2674@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/socket.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 405dc1863b30..62ba9a49c126 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1567,9 +1567,11 @@ static void sctp_close(struct sock *sk, long timeout)
 
 	/* Supposedly, no process has access to the socket, but
 	 * the net layers still may.
+	 * Also, sctp_destroy_sock() needs to be called with addr_wq_lock
+	 * held and that should be grabbed before socket lock.
 	 */
-	local_bh_disable();
-	bh_lock_sock(sk);
+	spin_lock_bh(&net->sctp.addr_wq_lock);
+	bh_lock_sock_nested(sk);
 
 	/* Hold the sock, since sk_common_release() will put sock_put()
 	 * and we have just a little more cleanup.
@@ -1578,7 +1580,7 @@ static void sctp_close(struct sock *sk, long timeout)
 	sk_common_release(sk);
 
 	bh_unlock_sock(sk);
-	local_bh_enable();
+	spin_unlock_bh(&net->sctp.addr_wq_lock);
 
 	sock_put(sk);
 
@@ -4159,6 +4161,9 @@ static int sctp_init_sock(struct sock *sk)
 	sk_sockets_allocated_inc(sk);
 	sock_prot_inuse_add(net, sk->sk_prot, 1);
 
+	/* Nothing can fail after this block, otherwise
+	 * sctp_destroy_sock() will be called without addr_wq_lock held
+	 */
 	if (net->sctp.default_auto_asconf) {
 		spin_lock(&sock_net(sk)->sctp.addr_wq_lock);
 		list_add_tail(&sp->auto_asconf_list,
@@ -4193,9 +4198,7 @@ static void sctp_destroy_sock(struct sock *sk)
 
 	if (sp->do_auto_asconf) {
 		sp->do_auto_asconf = 0;
-		spin_lock_bh(&sock_net(sk)->sctp.addr_wq_lock);
 		list_del(&sp->auto_asconf_list);
-		spin_unlock_bh(&sock_net(sk)->sctp.addr_wq_lock);
 	}
 	sctp_endpoint_free(sp->ep);
 	local_bh_disable();

From f980954e1d1b40befbb6814997a0feecea9ba427 Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Mon, 3 May 2021 05:11:42 +0800
Subject: [PATCH 2033/2658] sctp: delay auto_asconf init until binding the
 first addr

commit 34e5b01186858b36c4d7c87e1a025071e8e2401f upstream.

As Or Cohen described:

  If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock
  held and sp->do_auto_asconf is true, then an element is removed
  from the auto_asconf_splist without any proper locking.

  This can happen in the following functions:
  1. In sctp_accept, if sctp_sock_migrate fails.
  2. In inet_create or inet6_create, if there is a bpf program
     attached to BPF_CGROUP_INET_SOCK_CREATE which denies
     creation of the sctp socket.

This patch is to fix it by moving the auto_asconf init out of
sctp_init_sock(), by which inet_create()/inet6_create() won't
need to operate it in sctp_destroy_sock() when calling
sk_common_release().

It also makes more sense to do auto_asconf init while binding the
first addr, as auto_asconf actually requires an ANY addr bind,
see it in sctp_addr_wq_timeout_handler().

This addresses CVE-2021-23133.

Fixes: 610236587600 ("bpf: Add new cgroup attach type to enable sock modifications")
Reported-by: Or Cohen <orcohen@paloaltonetworks.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/socket.c | 31 +++++++++++++++++--------------
 1 file changed, 17 insertions(+), 14 deletions(-)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 62ba9a49c126..fcac88f1774b 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -352,6 +352,18 @@ static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
 	return af;
 }
 
+static void sctp_auto_asconf_init(struct sctp_sock *sp)
+{
+	struct net *net = sock_net(&sp->inet.sk);
+
+	if (net->sctp.default_auto_asconf) {
+		spin_lock(&net->sctp.addr_wq_lock);
+		list_add_tail(&sp->auto_asconf_list, &net->sctp.auto_asconf_splist);
+		spin_unlock(&net->sctp.addr_wq_lock);
+		sp->do_auto_asconf = 1;
+	}
+}
+
 /* Bind a local address either to an endpoint or to an association.  */
 static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
 {
@@ -414,8 +426,10 @@ static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
 	}
 
 	/* Refresh ephemeral port.  */
-	if (!bp->port)
+	if (!bp->port) {
 		bp->port = inet_sk(sk)->inet_num;
+		sctp_auto_asconf_init(sp);
+	}
 
 	/* Add the address to the bind address list.
 	 * Use GFP_ATOMIC since BHs will be disabled.
@@ -4161,19 +4175,6 @@ static int sctp_init_sock(struct sock *sk)
 	sk_sockets_allocated_inc(sk);
 	sock_prot_inuse_add(net, sk->sk_prot, 1);
 
-	/* Nothing can fail after this block, otherwise
-	 * sctp_destroy_sock() will be called without addr_wq_lock held
-	 */
-	if (net->sctp.default_auto_asconf) {
-		spin_lock(&sock_net(sk)->sctp.addr_wq_lock);
-		list_add_tail(&sp->auto_asconf_list,
-		    &net->sctp.auto_asconf_splist);
-		sp->do_auto_asconf = 1;
-		spin_unlock(&sock_net(sk)->sctp.addr_wq_lock);
-	} else {
-		sp->do_auto_asconf = 0;
-	}
-
 	local_bh_enable();
 
 	return 0;
@@ -7337,6 +7338,8 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
 	sctp_bind_addr_dup(&newsp->ep->base.bind_addr,
 				&oldsp->ep->base.bind_addr, GFP_KERNEL);
 
+	sctp_auto_asconf_init(newsp);
+
 	/* Move any messages in the old socket's receive queue that are for the
 	 * peeled off association to the new socket's receive queue.
 	 */

From 8b631c779225921177cd8fb4c68a1e4bbd991fad Mon Sep 17 00:00:00 2001
From: Alexander Aring <aahringo@redhat.com>
Date: Mon, 1 Mar 2021 17:05:08 -0500
Subject: [PATCH 2034/2658] fs: dlm: fix debugfs dump

[ Upstream commit 92c48950b43f4a767388cf87709d8687151a641f ]

This patch fixes the following message which randomly pops up during
glocktop call:

seq_file: buggy .next function table_seq_next did not update position index

The issue is that seq_read_iter() in fs/seq_file.c also needs an
increment of the index in an non next record case as well which this
patch fixes otherwise seq_read_iter() will print out the above message.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/dlm/debug_fs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/dlm/debug_fs.c b/fs/dlm/debug_fs.c
index eea64912c9c0..3b79c0284a30 100644
--- a/fs/dlm/debug_fs.c
+++ b/fs/dlm/debug_fs.c
@@ -545,6 +545,7 @@ static void *table_seq_next(struct seq_file *seq, void *iter_ptr, loff_t *pos)
 
 		if (bucket >= ls->ls_rsbtbl_size) {
 			kfree(ri);
+			++*pos;
 			return NULL;
 		}
 		tree = toss ? &ls->ls_rsbtbl[bucket].toss : &ls->ls_rsbtbl[bucket].keep;

From 5f66aeede59231dc8e27a9fec1e200fcaae8c404 Mon Sep 17 00:00:00 2001
From: Hoang Le <hoang.h.le@dektech.com.au>
Date: Thu, 11 Mar 2021 10:33:22 +0700
Subject: [PATCH 2035/2658] tipc: convert dest node's address to network order

[ Upstream commit 1980d37565061ab44bdc2f9e4da477d3b9752e81 ]

(struct tipc_link_info)->dest is in network order (__be32), so we must
convert the value to network order before assigning. The problem detected
by sparse:

net/tipc/netlink_compat.c:699:24: warning: incorrect type in assignment (different base types)
net/tipc/netlink_compat.c:699:24:    expected restricted __be32 [usertype] dest
net/tipc/netlink_compat.c:699:24:    got int

Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tipc/netlink_compat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 0975a28f8686..fb1b5dcf0142 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -632,7 +632,7 @@ static int tipc_nl_compat_link_dump(struct tipc_nl_compat_msg *msg,
 
 	nla_parse_nested(link, TIPC_NLA_LINK_MAX, attrs[TIPC_NLA_LINK], NULL);
 
-	link_info.dest = nla_get_flag(link[TIPC_NLA_LINK_DEST]);
+	link_info.dest = htonl(nla_get_flag(link[TIPC_NLA_LINK_DEST]));
 	link_info.up = htonl(nla_get_flag(link[TIPC_NLA_LINK_UP]));
 	nla_strlcpy(link_info.str, link[TIPC_NLA_LINK_NAME],
 		    TIPC_MAX_LINK_NAME);

From 4d40dccddf1d9421465a5c121982d5406646b69b Mon Sep 17 00:00:00 2001
From: Jonathan McDowell <noodles@earth.li>
Date: Sat, 13 Mar 2021 13:18:26 +0000
Subject: [PATCH 2036/2658] net: stmmac: Set FIFO sizes for ipq806x

[ Upstream commit e127906b68b49ddb3ecba39ffa36a329c48197d3 ]

Commit eaf4fac47807 ("net: stmmac: Do not accept invalid MTU values")
started using the TX FIFO size to verify what counts as a valid MTU
request for the stmmac driver.  This is unset for the ipq806x variant.
Looking at older patches for this it seems the RX + TXs buffers can be
up to 8k, so set appropriately.

(I sent this as an RFC patch in June last year, but received no replies.
I've been running with this on my hardware (a MikroTik RB3011) since
then with larger MTUs to support both the internal qca8k switch and
VLANs with no problems. Without the patch it's impossible to set the
larger MTU required to support this.)

Signed-off-by: Jonathan McDowell <noodles@earth.li>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
index ee5a7c05a0e6..f1eb9f99076a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
@@ -361,6 +361,8 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
 	plat_dat->bsp_priv = gmac;
 	plat_dat->fix_mac_speed = ipq806x_gmac_fix_mac_speed;
 	plat_dat->multicast_filter_bins = 0;
+	plat_dat->tx_fifo_size = 8192;
+	plat_dat->rx_fifo_size = 8192;
 
 	return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
 }

From 5703e3b9c8a536e85ce769f39c8745ee1dafcf15 Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Sun, 21 Mar 2021 11:38:38 -0400
Subject: [PATCH 2037/2658] ALSA: hdsp: don't disable if not enabled

[ Upstream commit 507cdb9adba006a7798c358456426e1aea3d9c4f ]

hdsp wants to disable a not enabled pci device, which makes kernel
throw a warning. Make sure the device is enabled before calling disable.

[    1.758292] snd_hdsp 0000:00:03.0: disabling already-disabled device
[    1.758327] WARNING: CPU: 0 PID: 180 at drivers/pci/pci.c:2146 pci_disable_device+0x91/0xb0
[    1.766985] Call Trace:
[    1.767121]  snd_hdsp_card_free+0x94/0xf0 [snd_hdsp]
[    1.767388]  release_card_device+0x4b/0x80 [snd]
[    1.767639]  device_release+0x3b/0xa0
[    1.767838]  kobject_put+0x94/0x1b0
[    1.768027]  put_device+0x13/0x20
[    1.768207]  snd_card_free+0x61/0x90 [snd]
[    1.768430]  snd_hdsp_probe+0x524/0x5e0 [snd_hdsp]

Suggested-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Link: https://lore.kernel.org/r/20210321153840.378226-2-ztong0001@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/rme9652/hdsp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c
index dd6c9e6a1d53..4128c04fbfde 100644
--- a/sound/pci/rme9652/hdsp.c
+++ b/sound/pci/rme9652/hdsp.c
@@ -5314,7 +5314,8 @@ static int snd_hdsp_free(struct hdsp *hdsp)
 	if (hdsp->port)
 		pci_release_regions(hdsp->pci);
 
-	pci_disable_device(hdsp->pci);
+	if (pci_is_enabled(hdsp->pci))
+		pci_disable_device(hdsp->pci);
 	return 0;
 }
 

From 22c01c2be5a3adbdaa348ac8ffd5683acd20048f Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Sun, 21 Mar 2021 11:38:39 -0400
Subject: [PATCH 2038/2658] ALSA: hdspm: don't disable if not enabled

[ Upstream commit 790f5719b85e12e10c41753b864e74249585ed08 ]

hdspm wants to disable a not enabled pci device, which makes kernel
throw a warning. Make sure the device is enabled before calling disable.

[    1.786391] snd_hdspm 0000:00:03.0: disabling already-disabled device
[    1.786400] WARNING: CPU: 0 PID: 182 at drivers/pci/pci.c:2146 pci_disable_device+0x91/0xb0
[    1.795181] Call Trace:
[    1.795320]  snd_hdspm_card_free+0x58/0xa0 [snd_hdspm]
[    1.795595]  release_card_device+0x4b/0x80 [snd]
[    1.795860]  device_release+0x3b/0xa0
[    1.796072]  kobject_put+0x94/0x1b0
[    1.796260]  put_device+0x13/0x20
[    1.796438]  snd_card_free+0x61/0x90 [snd]
[    1.796659]  snd_hdspm_probe+0x97b/0x1440 [snd_hdspm]

Suggested-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Link: https://lore.kernel.org/r/20210321153840.378226-3-ztong0001@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/rme9652/hdspm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
index 1a0c0d16a279..f4b164f19d30 100644
--- a/sound/pci/rme9652/hdspm.c
+++ b/sound/pci/rme9652/hdspm.c
@@ -6912,7 +6912,8 @@ static int snd_hdspm_free(struct hdspm * hdspm)
 	if (hdspm->port)
 		pci_release_regions(hdspm->pci);
 
-	pci_disable_device(hdspm->pci);
+	if (pci_is_enabled(hdspm->pci))
+		pci_disable_device(hdspm->pci);
 	return 0;
 }
 

From 50bbde7e75ac3c0cfd42024c3dce37244bab0a8c Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Sun, 21 Mar 2021 11:38:40 -0400
Subject: [PATCH 2039/2658] ALSA: rme9652: don't disable if not enabled

[ Upstream commit f57a741874bb6995089020e97a1dcdf9b165dcbe ]

rme9652 wants to disable a not enabled pci device, which makes kernel
throw a warning. Make sure the device is enabled before calling disable.

[    1.751595] snd_rme9652 0000:00:03.0: disabling already-disabled device
[    1.751605] WARNING: CPU: 0 PID: 174 at drivers/pci/pci.c:2146 pci_disable_device+0x91/0xb0
[    1.759968] Call Trace:
[    1.760145]  snd_rme9652_card_free+0x76/0xa0 [snd_rme9652]
[    1.760434]  release_card_device+0x4b/0x80 [snd]
[    1.760679]  device_release+0x3b/0xa0
[    1.760874]  kobject_put+0x94/0x1b0
[    1.761059]  put_device+0x13/0x20
[    1.761235]  snd_card_free+0x61/0x90 [snd]
[    1.761454]  snd_rme9652_probe+0x3be/0x700 [snd_rme9652]

Suggested-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Link: https://lore.kernel.org/r/20210321153840.378226-4-ztong0001@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/rme9652/rme9652.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/pci/rme9652/rme9652.c b/sound/pci/rme9652/rme9652.c
index c253bdf92e36..e5611ee9f2ae 100644
--- a/sound/pci/rme9652/rme9652.c
+++ b/sound/pci/rme9652/rme9652.c
@@ -1761,7 +1761,8 @@ static int snd_rme9652_free(struct snd_rme9652 *rme9652)
 	if (rme9652->port)
 		pci_release_regions(rme9652->pci);
 
-	pci_disable_device(rme9652->pci);
+	if (pci_is_enabled(rme9652->pci))
+		pci_disable_device(rme9652->pci);
 	return 0;
 }
 

From c965bc3748ae0a4c1fded0c428ff034622f58e3c Mon Sep 17 00:00:00 2001
From: Archie Pusaka <apusaka@chromium.org>
Date: Mon, 22 Mar 2021 14:02:15 +0800
Subject: [PATCH 2040/2658] Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan
 default

[ Upstream commit 3a9d54b1947ecea8eea9a902c0b7eb58a98add8a ]

Currently l2cap_chan_set_defaults() reset chan->conf_state to zero.
However, there is a flag CONF_NOT_COMPLETE which is set when
creating the l2cap_chan. It is suggested that the flag should be
cleared when l2cap_chan is ready, but when l2cap_chan_set_defaults()
is called, l2cap_chan is not yet ready. Therefore, we must set this
flag as the default.

Example crash call trace:
__dump_stack lib/dump_stack.c:15 [inline]
dump_stack+0xc4/0x118 lib/dump_stack.c:56
panic+0x1c6/0x38b kernel/panic.c:117
__warn+0x170/0x1b9 kernel/panic.c:471
warn_slowpath_fmt+0xc7/0xf8 kernel/panic.c:494
debug_print_object+0x175/0x193 lib/debugobjects.c:260
debug_object_assert_init+0x171/0x1bf lib/debugobjects.c:614
debug_timer_assert_init kernel/time/timer.c:629 [inline]
debug_assert_init kernel/time/timer.c:677 [inline]
del_timer+0x7c/0x179 kernel/time/timer.c:1034
try_to_grab_pending+0x81/0x2e5 kernel/workqueue.c:1230
cancel_delayed_work+0x7c/0x1c4 kernel/workqueue.c:2929
l2cap_clear_timer+0x1e/0x41 include/net/bluetooth/l2cap.h:834
l2cap_chan_del+0x2d8/0x37e net/bluetooth/l2cap_core.c:640
l2cap_chan_close+0x532/0x5d8 net/bluetooth/l2cap_core.c:756
l2cap_sock_shutdown+0x806/0x969 net/bluetooth/l2cap_sock.c:1174
l2cap_sock_release+0x64/0x14d net/bluetooth/l2cap_sock.c:1217
__sock_release+0xda/0x217 net/socket.c:580
sock_close+0x1b/0x1f net/socket.c:1039
__fput+0x322/0x55c fs/file_table.c:208
____fput+0x17/0x19 fs/file_table.c:244
task_work_run+0x19b/0x1d3 kernel/task_work.c:115
exit_task_work include/linux/task_work.h:21 [inline]
do_exit+0xe4c/0x204a kernel/exit.c:766
do_group_exit+0x291/0x291 kernel/exit.c:891
get_signal+0x749/0x1093 kernel/signal.c:2396
do_signal+0xa5/0xcdb arch/x86/kernel/signal.c:737
exit_to_usermode_loop arch/x86/entry/common.c:243 [inline]
prepare_exit_to_usermode+0xed/0x235 arch/x86/entry/common.c:277
syscall_return_slowpath+0x3a7/0x3b3 arch/x86/entry/common.c:348
int_ret_from_sys_call+0x25/0xa3

Signed-off-by: Archie Pusaka <apusaka@chromium.org>
Reported-by: syzbot+338f014a98367a08a114@syzkaller.appspotmail.com
Reviewed-by: Alain Michaud <alainm@chromium.org>
Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/l2cap_core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 27bf8e591e28..fe468901d3d5 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -499,7 +499,9 @@ void l2cap_chan_set_defaults(struct l2cap_chan *chan)
 	chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
 	chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
 	chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
+
 	chan->conf_state = 0;
+	set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
 
 	set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 }

From 6d094de6a61afeb241711a2c171c4b05d21fe0a1 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date: Mon, 22 Mar 2021 07:52:07 +0900
Subject: [PATCH 2041/2658] Bluetooth: initialize skb_queue_head at
 l2cap_chan_create()

[ Upstream commit be8597239379f0f53c9710dd6ab551bbf535bec6 ]

syzbot is hitting "INFO: trying to register non-static key." message [1],
for "struct l2cap_chan"->tx_q.lock spinlock is not yet initialized when
l2cap_chan_del() is called due to e.g. timeout.

Since "struct l2cap_chan"->lock mutex is initialized at l2cap_chan_create()
immediately after "struct l2cap_chan" is allocated using kzalloc(), let's
as well initialize "struct l2cap_chan"->{tx_q,srej_q}.lock spinlocks there.

[1] https://syzkaller.appspot.com/bug?extid=fadfba6a911f6bf71842

Reported-and-tested-by: syzbot <syzbot+fadfba6a911f6bf71842@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/l2cap_core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index fe468901d3d5..820c78945e16 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -434,6 +434,8 @@ struct l2cap_chan *l2cap_chan_create(void)
 	if (!chan)
 		return NULL;
 
+	skb_queue_head_init(&chan->tx_q);
+	skb_queue_head_init(&chan->srej_q);
 	mutex_init(&chan->lock);
 
 	/* Set default lock nesting level */

From 02824332eae4c049e6e5987edb3b49ed93548d57 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Mon, 29 Mar 2021 12:12:54 -0700
Subject: [PATCH 2042/2658] ip6_vti: proper dev_{hold|put} in ndo_[un]init
 methods

[ Upstream commit 40cb881b5aaa0b69a7d93dec8440d5c62dae299f ]

After adopting CONFIG_PCPU_DEV_REFCNT=n option, syzbot was able to trigger
a warning [1]

Issue here is that:

- all dev_put() should be paired with a corresponding prior dev_hold().

- A driver doing a dev_put() in its ndo_uninit() MUST also
  do a dev_hold() in its ndo_init(), only when ndo_init()
  is returning 0.

Otherwise, register_netdevice() would call ndo_uninit()
in its error path and release a refcount too soon.

Therefore, we need to move dev_hold() call from
vti6_tnl_create2() to vti6_dev_init_gen()

[1]
WARNING: CPU: 0 PID: 15951 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31
Modules linked in:
CPU: 0 PID: 15951 Comm: syz-executor.3 Not tainted 5.12.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31
Code: 1d 6a 5a e8 09 31 ff 89 de e8 8d 1a ab fd 84 db 75 e0 e8 d4 13 ab fd 48 c7 c7 a0 e1 c1 89 c6 05 4a 5a e8 09 01 e8 2e 36 fb 04 <0f> 0b eb c4 e8 b8 13 ab fd 0f b6 1d 39 5a e8 09 31 ff 89 de e8 58
RSP: 0018:ffffc90001eaef28 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000040000 RSI: ffffffff815c51f5 RDI: fffff520003d5dd7
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff815bdf8e R11: 0000000000000000 R12: ffff88801bb1c568
R13: ffff88801f69e800 R14: 00000000ffffffff R15: ffff888050889d40
FS:  00007fc79314e700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1c1ff47108 CR3: 0000000020fd5000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __refcount_dec include/linux/refcount.h:344 [inline]
 refcount_dec include/linux/refcount.h:359 [inline]
 dev_put include/linux/netdevice.h:4135 [inline]
 vti6_dev_uninit+0x31a/0x360 net/ipv6/ip6_vti.c:297
 register_netdevice+0xadf/0x1500 net/core/dev.c:10308
 vti6_tnl_create2+0x1b5/0x400 net/ipv6/ip6_vti.c:190
 vti6_newlink+0x9d/0xd0 net/ipv6/ip6_vti.c:1020
 __rtnl_newlink+0x1062/0x1710 net/core/rtnetlink.c:3443
 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3491
 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5553
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502
 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:674
 ____sys_sendmsg+0x331/0x810 net/socket.c:2350
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404
 __sys_sendmmsg+0x195/0x470 net/socket.c:2490
 __do_sys_sendmmsg net/socket.c:2519 [inline]
 __se_sys_sendmmsg net/socket.c:2516 [inline]
 __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2516

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/ip6_vti.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 8151c7b9659b..f5bfdb912d7a 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -196,7 +196,6 @@ static int vti6_tnl_create2(struct net_device *dev)
 
 	strcpy(t->parms.name, dev->name);
 
-	dev_hold(dev);
 	vti6_tnl_link(ip6n, t);
 
 	return 0;
@@ -901,6 +900,7 @@ static inline int vti6_dev_init_gen(struct net_device *dev)
 	dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
 	if (!dev->tstats)
 		return -ENOMEM;
+	dev_hold(dev);
 	return 0;
 }
 

From 4b3df7154e28a1914da5acd4ee8391eee4cd5ff2 Mon Sep 17 00:00:00 2001
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date: Thu, 8 Apr 2021 14:31:25 +0200
Subject: [PATCH 2043/2658] mac80211: clear the beacon's CRC after channel
 switch

[ Upstream commit d6843d1ee283137723b4a8c76244607ce6db1951 ]

After channel switch, we should consider any beacon with a
CSA IE as a new switch. If the CSA IE is a leftover from
before the switch that the AP forgot to remove, we'll get
a CSA-to-Self.

This caused issues in iwlwifi where the firmware saw a beacon
with a CSA-to-Self with mode = 1 on the new channel after a
switch. The firmware considered this a new switch and closed
its queues. Since the beacon didn't change between before and
after the switch, we wouldn't handle it (the CRC is the same)
and we wouldn't let the firmware open its queues again or
disconnect if the CSA IE stays for too long.

Clear the CRC valid state after we switch to make sure that
we handle the beacon and handle the CSA IE as required.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://lore.kernel.org/r/20210408143124.b9e68aa98304.I465afb55ca2c7d59f7bf610c6046a1fd732b4c28@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/mlme.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 3ab1415ce154..67a80d87aaa1 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1133,6 +1133,11 @@ static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
 
 	sdata->vif.csa_active = false;
 	ifmgd->csa_waiting_bcn = false;
+	/*
+	 * If the CSA IE is still present on the beacon after the switch,
+	 * we need to consider it as a new CSA (possibly to self).
+	 */
+	ifmgd->beacon_crc_valid = false;
 
 	ret = drv_post_channel_switch(sdata);
 	if (ret) {

From 61824348676b61bd13e7d4ed17d23d0864a31b6e Mon Sep 17 00:00:00 2001
From: Miklos Szeredi <mszeredi@redhat.com>
Date: Wed, 14 Apr 2021 10:40:58 +0200
Subject: [PATCH 2044/2658] cuse: prevent clone

[ Upstream commit 8217673d07256b22881127bf50dce874d0e51653 ]

For cloned connections cuse_channel_release() will be called more than
once, resulting in use after free.

Prevent device cloning for CUSE, which does not make sense at this point,
and highly unlikely to be used in real life.

Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fuse/cuse.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
index d9aba9700726..b83367300f48 100644
--- a/fs/fuse/cuse.c
+++ b/fs/fuse/cuse.c
@@ -616,6 +616,8 @@ static int __init cuse_init(void)
 	cuse_channel_fops.owner		= THIS_MODULE;
 	cuse_channel_fops.open		= cuse_channel_open;
 	cuse_channel_fops.release	= cuse_channel_release;
+	/* CUSE is not prepared for FUSE_DEV_IOC_CLONE */
+	cuse_channel_fops.unlocked_ioctl	= NULL;
 
 	cuse_class = class_create(THIS_MODULE, "cuse");
 	if (IS_ERR(cuse_class))

From e1c8b8464f5497eb48923e7082f134ddce58c104 Mon Sep 17 00:00:00 2001
From: Yonghong Song <yhs@fb.com>
Date: Tue, 13 Apr 2021 08:34:13 -0700
Subject: [PATCH 2045/2658] selftests: Set CC to clang in lib.mk if LLVM is set

[ Upstream commit 26e6dd1072763cd5696b75994c03982dde952ad9 ]

selftests/bpf/Makefile includes lib.mk. With the following command
  make -j60 LLVM=1 LLVM_IAS=1  <=== compile kernel
  make -j60 -C tools/testing/selftests/bpf LLVM=1 LLVM_IAS=1 V=1
some files are still compiled with gcc. This patch
fixed lib.mk issue which sets CC to gcc in all cases.

Signed-off-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20210413153413.3027426-1-yhs@fb.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/lib.mk | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
index 50a93f5f13d6..d8fa6c72b7ca 100644
--- a/tools/testing/selftests/lib.mk
+++ b/tools/testing/selftests/lib.mk
@@ -1,6 +1,10 @@
 # This mimics the top-level Makefile. We do it explicitly here so that this
 # Makefile can operate with or without the kbuild infrastructure.
+ifneq ($(LLVM),)
+CC := clang
+else
 CC := $(CROSS_COMPILE)gcc
+endif
 
 define RUN_TESTS
 	@for TEST in $(TEST_PROGS); do \

From df30b2f91021e90cc0bfffa8036bd02132fde909 Mon Sep 17 00:00:00 2001
From: Mihai Moldovan <ionic@ionic.de>
Date: Thu, 15 Apr 2021 09:28:03 +0200
Subject: [PATCH 2046/2658] kconfig: nconf: stop endless search loops

[ Upstream commit 8c94b430b9f6213dec84e309bb480a71778c4213 ]

If the user selects the very first entry in a page and performs a
search-up operation, or selects the very last entry in a page and
performs a search-down operation that will not succeed (e.g., via
[/]asdfzzz[Up Arrow]), nconf will never terminate searching the page.

The reason is that in this case, the starting point will be set to -1
or n, which is then translated into (n - 1) (i.e., the last entry of
the page) or 0 (i.e., the first entry of the page) and finally the
search begins. This continues to work fine until the index reaches 0 or
(n - 1), at which point it will be decremented to -1 or incremented to
n, but not checked against the starting point right away. Instead, it's
wrapped around to the bottom or top again, after which the starting
point check occurs... and naturally fails.

My original implementation added another check for -1 before wrapping
the running index variable around, but Masahiro Yamada pointed out that
the actual issue is that the comparison point (starting point) exceeds
bounds (i.e., the [0,n-1] interval) in the first place and that,
instead, the starting point should be fixed.

This has the welcome side-effect of also fixing the case where the
starting point was n while searching down, which also lead to an
infinite loop.

OTOH, this code is now essentially all his work.

Amazingly, nobody seems to have been hit by this for 11 years - or at
the very least nobody bothered to debug and fix this.

Signed-off-by: Mihai Moldovan <ionic@ionic.de>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/kconfig/nconf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/kconfig/nconf.c b/scripts/kconfig/nconf.c
index f7049e288e93..c58a46904861 100644
--- a/scripts/kconfig/nconf.c
+++ b/scripts/kconfig/nconf.c
@@ -502,8 +502,8 @@ static int get_mext_match(const char *match_str, match_f flag)
 	else if (flag == FIND_NEXT_MATCH_UP)
 		--match_start;
 
+	match_start = (match_start + items_num) % items_num;
 	index = match_start;
-	index = (index + items_num) % items_num;
 	while (true) {
 		char *str = k_menu_items[index].str;
 		if (strcasestr(str, match_str) != 0)

From 70f5439aa8c16e9564f17d7460d5b90dedd84aa3 Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Date: Fri, 16 Apr 2021 14:12:36 -0500
Subject: [PATCH 2047/2658] sctp: Fix out-of-bounds warning in
 sctp_process_asconf_param()

[ Upstream commit e5272ad4aab347dde5610c0aedb786219e3ff793 ]

Fix the following out-of-bounds warning:

net/sctp/sm_make_chunk.c:3150:4: warning: 'memcpy' offset [17, 28] from the object at 'addr' is out of the bounds of referenced subobject 'v4' with type 'struct sockaddr_in' at offset 0 [-Warray-bounds]

This helps with the ongoing efforts to globally enable -Warray-bounds
and get us closer to being able to tighten the FORTIFY_SOURCE routines
on memcpy().

Link: https://github.com/KSPP/linux/issues/109
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sctp/sm_make_chunk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index e3e44237de1c..9de03d2e5da9 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -3119,7 +3119,7 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
 		 * primary.
 		 */
 		if (af->is_any(&addr))
-			memcpy(&addr.v4, sctp_source(asconf), sizeof(addr));
+			memcpy(&addr, sctp_source(asconf), sizeof(addr));
 
 		peer = sctp_assoc_lookup_paddr(asoc, &addr);
 		if (!peer)

From 93dbbb7c8a649e689b6e7784d04e75c044f969be Mon Sep 17 00:00:00 2001
From: David Ward <david.ward@gatech.edu>
Date: Sun, 18 Apr 2021 09:46:58 -0400
Subject: [PATCH 2048/2658] ASoC: rt286: Generalize support for ALC3263 codec

[ Upstream commit aa2f9c12821e6a4ba1df4fb34a3dbc6a2a1ee7fe ]

The ALC3263 codec on the XPS 13 9343 is also found on the Latitude 13 7350
and Venue 11 Pro 7140. They require the same handling for the combo jack to
work with a headset: GPIO pin 6 must be set.

The HDA driver always sets this pin on the ALC3263, which it distinguishes
by the codec vendor/device ID 0x10ec0288 and PCI subsystem vendor ID 0x1028
(Dell). The ASoC driver does not use PCI, so adapt this check to use DMI to
determine if Dell is the system vendor.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=150601
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=205961
Signed-off-by: David Ward <david.ward@gatech.edu>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20210418134658.4333-6-david.ward@gatech.edu
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/rt286.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/sound/soc/codecs/rt286.c b/sound/soc/codecs/rt286.c
index af2ed774b552..63ed5b38b11f 100644
--- a/sound/soc/codecs/rt286.c
+++ b/sound/soc/codecs/rt286.c
@@ -1117,12 +1117,11 @@ static const struct dmi_system_id force_combo_jack_table[] = {
 	{ }
 };
 
-static const struct dmi_system_id dmi_dell_dino[] = {
+static const struct dmi_system_id dmi_dell[] = {
 	{
-		.ident = "Dell Dino",
+		.ident = "Dell",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-			DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9343")
 		}
 	},
 	{ }
@@ -1133,7 +1132,7 @@ static int rt286_i2c_probe(struct i2c_client *i2c,
 {
 	struct rt286_platform_data *pdata = dev_get_platdata(&i2c->dev);
 	struct rt286_priv *rt286;
-	int i, ret, val;
+	int i, ret, vendor_id;
 
 	rt286 = devm_kzalloc(&i2c->dev,	sizeof(*rt286),
 				GFP_KERNEL);
@@ -1149,14 +1148,15 @@ static int rt286_i2c_probe(struct i2c_client *i2c,
 	}
 
 	ret = regmap_read(rt286->regmap,
-		RT286_GET_PARAM(AC_NODE_ROOT, AC_PAR_VENDOR_ID), &val);
+		RT286_GET_PARAM(AC_NODE_ROOT, AC_PAR_VENDOR_ID), &vendor_id);
 	if (ret != 0) {
 		dev_err(&i2c->dev, "I2C error %d\n", ret);
 		return ret;
 	}
-	if (val != RT286_VENDOR_ID && val != RT288_VENDOR_ID) {
+	if (vendor_id != RT286_VENDOR_ID && vendor_id != RT288_VENDOR_ID) {
 		dev_err(&i2c->dev,
-			"Device with ID register %#x is not rt286\n", val);
+			"Device with ID register %#x is not rt286\n",
+			vendor_id);
 		return -ENODEV;
 	}
 
@@ -1180,8 +1180,8 @@ static int rt286_i2c_probe(struct i2c_client *i2c,
 	if (pdata)
 		rt286->pdata = *pdata;
 
-	if (dmi_check_system(force_combo_jack_table) ||
-		dmi_check_system(dmi_dell_dino))
+	if ((vendor_id == RT288_VENDOR_ID && dmi_check_system(dmi_dell)) ||
+		dmi_check_system(force_combo_jack_table))
 		rt286->pdata.cbj_en = true;
 
 	regmap_write(rt286->regmap, RT286_SET_AUDIO_POWER, AC_PWRST_D3);
@@ -1220,7 +1220,7 @@ static int rt286_i2c_probe(struct i2c_client *i2c,
 	regmap_update_bits(rt286->regmap, RT286_DEPOP_CTRL3, 0xf777, 0x4737);
 	regmap_update_bits(rt286->regmap, RT286_DEPOP_CTRL4, 0x00ff, 0x003f);
 
-	if (dmi_check_system(dmi_dell_dino)) {
+	if (vendor_id == RT288_VENDOR_ID && dmi_check_system(dmi_dell)) {
 		regmap_update_bits(rt286->regmap,
 			RT286_SET_GPIO_MASK, 0x40, 0x40);
 		regmap_update_bits(rt286->regmap,

From 66a41b699176a757d16b6310d0d2b7a8a8b524a8 Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Date: Wed, 14 Apr 2021 18:43:19 -0500
Subject: [PATCH 2049/2658] wl3501_cs: Fix out-of-bounds warnings in
 wl3501_send_pkt

[ Upstream commit 820aa37638a252b57967bdf4038a514b1ab85d45 ]

Fix the following out-of-bounds warnings by enclosing structure members
daddr and saddr into new struct addr, in structures wl3501_md_req and
wl3501_md_ind:

arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [18, 23] from the object at 'sig' is out of the bounds of referenced subobject 'daddr' with type 'u8[6]' {aka 'unsigned char[6]'} at offset 11 [-Warray-bounds]
arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [18, 23] from the object at 'sig' is out of the bounds of referenced subobject 'daddr' with type 'u8[6]' {aka 'unsigned char[6]'} at offset 11 [-Warray-bounds]

Refactor the code, accordingly:

$ pahole -C wl3501_md_req drivers/net/wireless/wl3501_cs.o
struct wl3501_md_req {
	u16                        next_blk;             /*     0     2 */
	u8                         sig_id;               /*     2     1 */
	u8                         routing;              /*     3     1 */
	u16                        data;                 /*     4     2 */
	u16                        size;                 /*     6     2 */
	u8                         pri;                  /*     8     1 */
	u8                         service_class;        /*     9     1 */
	struct {
		u8                 daddr[6];             /*    10     6 */
		u8                 saddr[6];             /*    16     6 */
	} addr;                                          /*    10    12 */

	/* size: 22, cachelines: 1, members: 8 */
	/* last cacheline: 22 bytes */
};

$ pahole -C wl3501_md_ind drivers/net/wireless/wl3501_cs.o
struct wl3501_md_ind {
	u16                        next_blk;             /*     0     2 */
	u8                         sig_id;               /*     2     1 */
	u8                         routing;              /*     3     1 */
	u16                        data;                 /*     4     2 */
	u16                        size;                 /*     6     2 */
	u8                         reception;            /*     8     1 */
	u8                         pri;                  /*     9     1 */
	u8                         service_class;        /*    10     1 */
	struct {
		u8                 daddr[6];             /*    11     6 */
		u8                 saddr[6];             /*    17     6 */
	} addr;                                          /*    11    12 */

	/* size: 24, cachelines: 1, members: 9 */
	/* padding: 1 */
	/* last cacheline: 24 bytes */
};

The problem is that the original code is trying to copy data into a
couple of arrays adjacent to each other in a single call to memcpy().
Now that a new struct _addr_ enclosing those two adjacent arrays
is introduced, memcpy() doesn't overrun the length of &sig.daddr[0]
and &sig.daddr, because the address of the new struct object _addr_
is used, instead.

This helps with the ongoing efforts to globally enable -Warray-bounds
and get us closer to being able to tighten the FORTIFY_SOURCE routines
on memcpy().

Link: https://github.com/KSPP/linux/issues/109
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/d260fe56aed7112bff2be5b4d152d03ad7b78e78.1618442265.git.gustavoars@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/wl3501.h    | 12 ++++++++----
 drivers/net/wireless/wl3501_cs.c | 10 ++++++----
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/drivers/net/wireless/wl3501.h b/drivers/net/wireless/wl3501.h
index 3fbfd19818f1..ba2a36cfb1c8 100644
--- a/drivers/net/wireless/wl3501.h
+++ b/drivers/net/wireless/wl3501.h
@@ -470,8 +470,10 @@ struct wl3501_md_req {
 	u16	size;
 	u8	pri;
 	u8	service_class;
-	u8	daddr[ETH_ALEN];
-	u8	saddr[ETH_ALEN];
+	struct {
+		u8	daddr[ETH_ALEN];
+		u8	saddr[ETH_ALEN];
+	} addr;
 };
 
 struct wl3501_md_ind {
@@ -483,8 +485,10 @@ struct wl3501_md_ind {
 	u8	reception;
 	u8	pri;
 	u8	service_class;
-	u8	daddr[ETH_ALEN];
-	u8	saddr[ETH_ALEN];
+	struct {
+		u8	daddr[ETH_ALEN];
+		u8	saddr[ETH_ALEN];
+	} addr;
 };
 
 struct wl3501_md_confirm {
diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
index d5c371d77ddf..15613f4761f4 100644
--- a/drivers/net/wireless/wl3501_cs.c
+++ b/drivers/net/wireless/wl3501_cs.c
@@ -457,6 +457,7 @@ static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len)
 	struct wl3501_md_req sig = {
 		.sig_id = WL3501_SIG_MD_REQ,
 	};
+	size_t sig_addr_len = sizeof(sig.addr);
 	u8 *pdata = (char *)data;
 	int rc = -EIO;
 
@@ -472,9 +473,9 @@ static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len)
 			goto out;
 		}
 		rc = 0;
-		memcpy(&sig.daddr[0], pdata, 12);
-		pktlen = len - 12;
-		pdata += 12;
+		memcpy(&sig.addr, pdata, sig_addr_len);
+		pktlen = len - sig_addr_len;
+		pdata += sig_addr_len;
 		sig.data = bf;
 		if (((*pdata) * 256 + (*(pdata + 1))) > 1500) {
 			u8 addr4[ETH_ALEN] = {
@@ -968,7 +969,8 @@ static inline void wl3501_md_ind_interrupt(struct net_device *dev,
 	} else {
 		skb->dev = dev;
 		skb_reserve(skb, 2); /* IP headers on 16 bytes boundaries */
-		skb_copy_to_linear_data(skb, (unsigned char *)&sig.daddr, 12);
+		skb_copy_to_linear_data(skb, (unsigned char *)&sig.addr,
+					sizeof(sig.addr));
 		wl3501_receive(this, skb->data, pkt_len);
 		skb_put(skb, pkt_len);
 		skb->protocol	= eth_type_trans(skb, dev);

From b4ced7f6c5d1ffd5231624eaeaf89cf416fa83e0 Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Date: Wed, 14 Apr 2021 18:45:15 -0500
Subject: [PATCH 2050/2658] wl3501_cs: Fix out-of-bounds warnings in
 wl3501_mgmt_join

[ Upstream commit bb43e5718d8f1b46e7a77e7b39be3c691f293050 ]

Fix the following out-of-bounds warnings by adding a new structure
wl3501_req instead of duplicating the same members in structure
wl3501_join_req and wl3501_scan_confirm:

arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [39, 108] from the object at 'sig' is out of the bounds of referenced subobject 'beacon_period' with type 'short unsigned int' at offset 36 [-Warray-bounds]
arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [25, 95] from the object at 'sig' is out of the bounds of referenced subobject 'beacon_period' with type 'short unsigned int' at offset 22 [-Warray-bounds]

Refactor the code, accordingly:

$ pahole -C wl3501_req drivers/net/wireless/wl3501_cs.o
struct wl3501_req {
        u16                        beacon_period;        /*     0     2 */
        u16                        dtim_period;          /*     2     2 */
        u16                        cap_info;             /*     4     2 */
        u8                         bss_type;             /*     6     1 */
        u8                         bssid[6];             /*     7     6 */
        struct iw_mgmt_essid_pset  ssid;                 /*    13    34 */
        struct iw_mgmt_ds_pset     ds_pset;              /*    47     3 */
        struct iw_mgmt_cf_pset     cf_pset;              /*    50     8 */
        struct iw_mgmt_ibss_pset   ibss_pset;            /*    58     4 */
        struct iw_mgmt_data_rset   bss_basic_rset;       /*    62    10 */

        /* size: 72, cachelines: 2, members: 10 */
        /* last cacheline: 8 bytes */
};

$ pahole -C wl3501_join_req drivers/net/wireless/wl3501_cs.o
struct wl3501_join_req {
        u16                        next_blk;             /*     0     2 */
        u8                         sig_id;               /*     2     1 */
        u8                         reserved;             /*     3     1 */
        struct iw_mgmt_data_rset   operational_rset;     /*     4    10 */
        u16                        reserved2;            /*    14     2 */
        u16                        timeout;              /*    16     2 */
        u16                        probe_delay;          /*    18     2 */
        u8                         timestamp[8];         /*    20     8 */
        u8                         local_time[8];        /*    28     8 */
        struct wl3501_req          req;                  /*    36    72 */

        /* size: 108, cachelines: 2, members: 10 */
        /* last cacheline: 44 bytes */
};

$ pahole -C wl3501_scan_confirm drivers/net/wireless/wl3501_cs.o
struct wl3501_scan_confirm {
        u16                        next_blk;             /*     0     2 */
        u8                         sig_id;               /*     2     1 */
        u8                         reserved;             /*     3     1 */
        u16                        status;               /*     4     2 */
        char                       timestamp[8];         /*     6     8 */
        char                       localtime[8];         /*    14     8 */
        struct wl3501_req          req;                  /*    22    72 */
        /* --- cacheline 1 boundary (64 bytes) was 30 bytes ago --- */
        u8                         rssi;                 /*    94     1 */

        /* size: 96, cachelines: 2, members: 8 */
        /* padding: 1 */
        /* last cacheline: 32 bytes */
};

The problem is that the original code is trying to copy data into a
bunch of struct members adjacent to each other in a single call to
memcpy(). Now that a new struct wl3501_req enclosing all those adjacent
members is introduced, memcpy() doesn't overrun the length of
&sig.beacon_period and &this->bss_set[i].beacon_period, because the
address of the new struct object _req_ is used as the destination,
instead.

This helps with the ongoing efforts to globally enable -Warray-bounds
and get us closer to being able to tighten the FORTIFY_SOURCE routines
on memcpy().

Link: https://github.com/KSPP/linux/issues/109
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1fbaf516da763b50edac47d792a9145aa4482e29.1618442265.git.gustavoars@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/wl3501.h    | 35 +++++++++++--------------
 drivers/net/wireless/wl3501_cs.c | 44 +++++++++++++++++---------------
 2 files changed, 38 insertions(+), 41 deletions(-)

diff --git a/drivers/net/wireless/wl3501.h b/drivers/net/wireless/wl3501.h
index ba2a36cfb1c8..ca2021bcac14 100644
--- a/drivers/net/wireless/wl3501.h
+++ b/drivers/net/wireless/wl3501.h
@@ -378,16 +378,7 @@ struct wl3501_get_confirm {
 	u8	mib_value[100];
 };
 
-struct wl3501_join_req {
-	u16			    next_blk;
-	u8			    sig_id;
-	u8			    reserved;
-	struct iw_mgmt_data_rset    operational_rset;
-	u16			    reserved2;
-	u16			    timeout;
-	u16			    probe_delay;
-	u8			    timestamp[8];
-	u8			    local_time[8];
+struct wl3501_req {
 	u16			    beacon_period;
 	u16			    dtim_period;
 	u16			    cap_info;
@@ -400,6 +391,19 @@ struct wl3501_join_req {
 	struct iw_mgmt_data_rset    bss_basic_rset;
 };
 
+struct wl3501_join_req {
+	u16			    next_blk;
+	u8			    sig_id;
+	u8			    reserved;
+	struct iw_mgmt_data_rset    operational_rset;
+	u16			    reserved2;
+	u16			    timeout;
+	u16			    probe_delay;
+	u8			    timestamp[8];
+	u8			    local_time[8];
+	struct wl3501_req	    req;
+};
+
 struct wl3501_join_confirm {
 	u16	next_blk;
 	u8	sig_id;
@@ -442,16 +446,7 @@ struct wl3501_scan_confirm {
 	u16			    status;
 	char			    timestamp[8];
 	char			    localtime[8];
-	u16			    beacon_period;
-	u16			    dtim_period;
-	u16			    cap_info;
-	u8			    bss_type;
-	u8			    bssid[ETH_ALEN];
-	struct iw_mgmt_essid_pset   ssid;
-	struct iw_mgmt_ds_pset	    ds_pset;
-	struct iw_mgmt_cf_pset	    cf_pset;
-	struct iw_mgmt_ibss_pset    ibss_pset;
-	struct iw_mgmt_data_rset    bss_basic_rset;
+	struct wl3501_req	    req;
 	u8			    rssi;
 };
 
diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
index 15613f4761f4..f91f7bd90b85 100644
--- a/drivers/net/wireless/wl3501_cs.c
+++ b/drivers/net/wireless/wl3501_cs.c
@@ -578,7 +578,7 @@ static int wl3501_mgmt_join(struct wl3501_card *this, u16 stas)
 	struct wl3501_join_req sig = {
 		.sig_id		  = WL3501_SIG_JOIN_REQ,
 		.timeout	  = 10,
-		.ds_pset = {
+		.req.ds_pset = {
 			.el = {
 				.id  = IW_MGMT_INFO_ELEMENT_DS_PARAMETER_SET,
 				.len = 1,
@@ -587,7 +587,7 @@ static int wl3501_mgmt_join(struct wl3501_card *this, u16 stas)
 		},
 	};
 
-	memcpy(&sig.beacon_period, &this->bss_set[stas].beacon_period, 72);
+	memcpy(&sig.req, &this->bss_set[stas].req, sizeof(sig.req));
 	return wl3501_esbq_exec(this, &sig, sizeof(sig));
 }
 
@@ -655,35 +655,37 @@ static void wl3501_mgmt_scan_confirm(struct wl3501_card *this, u16 addr)
 	if (sig.status == WL3501_STATUS_SUCCESS) {
 		pr_debug("success");
 		if ((this->net_type == IW_MODE_INFRA &&
-		     (sig.cap_info & WL3501_MGMT_CAPABILITY_ESS)) ||
+		     (sig.req.cap_info & WL3501_MGMT_CAPABILITY_ESS)) ||
 		    (this->net_type == IW_MODE_ADHOC &&
-		     (sig.cap_info & WL3501_MGMT_CAPABILITY_IBSS)) ||
+		     (sig.req.cap_info & WL3501_MGMT_CAPABILITY_IBSS)) ||
 		    this->net_type == IW_MODE_AUTO) {
 			if (!this->essid.el.len)
 				matchflag = 1;
 			else if (this->essid.el.len == 3 &&
 				 !memcmp(this->essid.essid, "ANY", 3))
 				matchflag = 1;
-			else if (this->essid.el.len != sig.ssid.el.len)
+			else if (this->essid.el.len != sig.req.ssid.el.len)
 				matchflag = 0;
-			else if (memcmp(this->essid.essid, sig.ssid.essid,
+			else if (memcmp(this->essid.essid, sig.req.ssid.essid,
 					this->essid.el.len))
 				matchflag = 0;
 			else
 				matchflag = 1;
 			if (matchflag) {
 				for (i = 0; i < this->bss_cnt; i++) {
-					if (ether_addr_equal_unaligned(this->bss_set[i].bssid, sig.bssid)) {
+					if (ether_addr_equal_unaligned(this->bss_set[i].req.bssid,
+								       sig.req.bssid)) {
 						matchflag = 0;
 						break;
 					}
 				}
 			}
 			if (matchflag && (i < 20)) {
-				memcpy(&this->bss_set[i].beacon_period,
-				       &sig.beacon_period, 73);
+				memcpy(&this->bss_set[i].req,
+				       &sig.req, sizeof(sig.req));
 				this->bss_cnt++;
 				this->rssi = sig.rssi;
+				this->bss_set[i].rssi = sig.rssi;
 			}
 		}
 	} else if (sig.status == WL3501_STATUS_TIMEOUT) {
@@ -875,19 +877,19 @@ static void wl3501_mgmt_join_confirm(struct net_device *dev, u16 addr)
 			if (this->join_sta_bss < this->bss_cnt) {
 				const int i = this->join_sta_bss;
 				memcpy(this->bssid,
-				       this->bss_set[i].bssid, ETH_ALEN);
-				this->chan = this->bss_set[i].ds_pset.chan;
+				       this->bss_set[i].req.bssid, ETH_ALEN);
+				this->chan = this->bss_set[i].req.ds_pset.chan;
 				iw_copy_mgmt_info_element(&this->keep_essid.el,
-						     &this->bss_set[i].ssid.el);
+						     &this->bss_set[i].req.ssid.el);
 				wl3501_mgmt_auth(this);
 			}
 		} else {
 			const int i = this->join_sta_bss;
 
-			memcpy(&this->bssid, &this->bss_set[i].bssid, ETH_ALEN);
-			this->chan = this->bss_set[i].ds_pset.chan;
+			memcpy(&this->bssid, &this->bss_set[i].req.bssid, ETH_ALEN);
+			this->chan = this->bss_set[i].req.ds_pset.chan;
 			iw_copy_mgmt_info_element(&this->keep_essid.el,
-						  &this->bss_set[i].ssid.el);
+						  &this->bss_set[i].req.ssid.el);
 			wl3501_online(dev);
 		}
 	} else {
@@ -1566,30 +1568,30 @@ static int wl3501_get_scan(struct net_device *dev, struct iw_request_info *info,
 	for (i = 0; i < this->bss_cnt; ++i) {
 		iwe.cmd			= SIOCGIWAP;
 		iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
-		memcpy(iwe.u.ap_addr.sa_data, this->bss_set[i].bssid, ETH_ALEN);
+		memcpy(iwe.u.ap_addr.sa_data, this->bss_set[i].req.bssid, ETH_ALEN);
 		current_ev = iwe_stream_add_event(info, current_ev,
 						  extra + IW_SCAN_MAX_DATA,
 						  &iwe, IW_EV_ADDR_LEN);
 		iwe.cmd		  = SIOCGIWESSID;
 		iwe.u.data.flags  = 1;
-		iwe.u.data.length = this->bss_set[i].ssid.el.len;
+		iwe.u.data.length = this->bss_set[i].req.ssid.el.len;
 		current_ev = iwe_stream_add_point(info, current_ev,
 						  extra + IW_SCAN_MAX_DATA,
 						  &iwe,
-						  this->bss_set[i].ssid.essid);
+						  this->bss_set[i].req.ssid.essid);
 		iwe.cmd	   = SIOCGIWMODE;
-		iwe.u.mode = this->bss_set[i].bss_type;
+		iwe.u.mode = this->bss_set[i].req.bss_type;
 		current_ev = iwe_stream_add_event(info, current_ev,
 						  extra + IW_SCAN_MAX_DATA,
 						  &iwe, IW_EV_UINT_LEN);
 		iwe.cmd = SIOCGIWFREQ;
-		iwe.u.freq.m = this->bss_set[i].ds_pset.chan;
+		iwe.u.freq.m = this->bss_set[i].req.ds_pset.chan;
 		iwe.u.freq.e = 0;
 		current_ev = iwe_stream_add_event(info, current_ev,
 						  extra + IW_SCAN_MAX_DATA,
 						  &iwe, IW_EV_FREQ_LEN);
 		iwe.cmd = SIOCGIWENCODE;
-		if (this->bss_set[i].cap_info & WL3501_MGMT_CAPABILITY_PRIVACY)
+		if (this->bss_set[i].req.cap_info & WL3501_MGMT_CAPABILITY_PRIVACY)
 			iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
 		else
 			iwe.u.data.flags = IW_ENCODE_DISABLED;

From 03f07cf5589ef24b8925db0acbbfaf36cb1d7fef Mon Sep 17 00:00:00 2001
From: Alexey Kardashevskiy <aik@ozlabs.ru>
Date: Mon, 1 Mar 2021 17:36:53 +1100
Subject: [PATCH 2051/2658] powerpc/iommu: Annotate nested lock for lockdep

[ Upstream commit cc7130bf119add37f36238343a593b71ef6ecc1e ]

The IOMMU table is divided into pools for concurrent mappings and each
pool has a separate spinlock. When taking the ownership of an IOMMU group
to pass through a device to a VM, we lock these spinlocks which triggers
a false negative warning in lockdep (below).

This fixes it by annotating the large pool's spinlock as a nest lock
which makes lockdep not complaining when locking nested locks if
the nest lock is locked already.

===
WARNING: possible recursive locking detected
5.11.0-le_syzkaller_a+fstn1 #100 Not tainted
--------------------------------------------
qemu-system-ppc/4129 is trying to acquire lock:
c0000000119bddb0 (&(p->lock)/1){....}-{2:2}, at: iommu_take_ownership+0xac/0x1e0

but task is already holding lock:
c0000000119bdd30 (&(p->lock)/1){....}-{2:2}, at: iommu_take_ownership+0xac/0x1e0

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&(p->lock)/1);
  lock(&(p->lock)/1);
===

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210301063653.51003-1-aik@ozlabs.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/iommu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
index 4c9b5970af37..282ad1930593 100644
--- a/arch/powerpc/kernel/iommu.c
+++ b/arch/powerpc/kernel/iommu.c
@@ -1019,7 +1019,7 @@ int iommu_take_ownership(struct iommu_table *tbl)
 
 	spin_lock_irqsave(&tbl->large_pool.lock, flags);
 	for (i = 0; i < tbl->nr_pools; i++)
-		spin_lock(&tbl->pools[i].lock);
+		spin_lock_nest_lock(&tbl->pools[i].lock, &tbl->large_pool.lock);
 
 	if (tbl->it_offset == 0)
 		clear_bit(0, tbl->it_map);
@@ -1048,7 +1048,7 @@ void iommu_release_ownership(struct iommu_table *tbl)
 
 	spin_lock_irqsave(&tbl->large_pool.lock, flags);
 	for (i = 0; i < tbl->nr_pools; i++)
-		spin_lock(&tbl->pools[i].lock);
+		spin_lock_nest_lock(&tbl->pools[i].lock, &tbl->large_pool.lock);
 
 	memset(tbl->it_map, 0, sz);
 

From f2e2b2059091429e09bda0813ed7a62088b565f3 Mon Sep 17 00:00:00 2001
From: David Ward <david.ward@gatech.edu>
Date: Sun, 18 Apr 2021 09:46:57 -0400
Subject: [PATCH 2052/2658] ASoC: rt286: Make RT286_SET_GPIO_* readable and
 writable

[ Upstream commit cd8499d5c03ba260e3191e90236d0e5f6b147563 ]

The GPIO configuration cannot be applied if the registers are inaccessible.
This prevented the headset mic from working on the Dell XPS 13 9343.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=114171
Signed-off-by: David Ward <david.ward@gatech.edu>
Link: https://lore.kernel.org/r/20210418134658.4333-5-david.ward@gatech.edu
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/rt286.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sound/soc/codecs/rt286.c b/sound/soc/codecs/rt286.c
index 63ed5b38b11f..146099ec8570 100644
--- a/sound/soc/codecs/rt286.c
+++ b/sound/soc/codecs/rt286.c
@@ -174,6 +174,9 @@ static bool rt286_readable_register(struct device *dev, unsigned int reg)
 	case RT286_PROC_COEF:
 	case RT286_SET_AMP_GAIN_ADC_IN1:
 	case RT286_SET_AMP_GAIN_ADC_IN2:
+	case RT286_SET_GPIO_MASK:
+	case RT286_SET_GPIO_DIRECTION:
+	case RT286_SET_GPIO_DATA:
 	case RT286_SET_POWER(RT286_DAC_OUT1):
 	case RT286_SET_POWER(RT286_DAC_OUT2):
 	case RT286_SET_POWER(RT286_ADC_IN1):

From ea15b22d36ad2a0767163896b989524e8b24efdd Mon Sep 17 00:00:00 2001
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Date: Mon, 25 Jan 2021 02:28:26 +0300
Subject: [PATCH 2053/2658] PCI: Release OF node in pci_scan_device()'s error
 path

[ Upstream commit c99e755a4a4c165cad6effb39faffd0f3377c02d ]

In pci_scan_device(), if pci_setup_device() fails for any reason, the code
will not release device's of_node by calling pci_release_of_node().  Fix
that by calling the release function.

Fixes: 98d9f30c820d ("pci/of: Match PCI devices to OF nodes dynamically")
Link: https://lore.kernel.org/r/20210124232826.1879-1-dmitry.baryshkov@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/probe.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index becedabff141..63c62e2c8c0d 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1668,6 +1668,7 @@ static struct pci_dev *pci_scan_device(struct pci_bus *bus, int devfn)
 	pci_set_of_node(dev);
 
 	if (pci_setup_device(dev)) {
+		pci_release_of_node(dev);
 		pci_bus_put(dev->bus);
 		kfree(dev);
 		return NULL;

From a5eb02ba55e3586016a26213d06862e3a4136502 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Mon, 29 Mar 2021 16:46:05 -0400
Subject: [PATCH 2054/2658] NFS: Deal correctly with attribute generation
 counter overflow

[ Upstream commit 9fdbfad1777cb4638f489eeb62d85432010c0031 ]

We need to use unsigned long subtraction and then convert to signed in
order to deal correcly with C overflow rules.

Fixes: f5062003465c ("NFS: Set an attribute barrier on all updates")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/inode.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index b15236641191..0d7b8c6e1de8 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -1430,10 +1430,10 @@ EXPORT_SYMBOL_GPL(_nfs_display_fhandle);
  */
 static int nfs_inode_attrs_need_update(const struct inode *inode, const struct nfs_fattr *fattr)
 {
-	const struct nfs_inode *nfsi = NFS_I(inode);
+	unsigned long attr_gencount = NFS_I(inode)->attr_gencount;
 
-	return ((long)fattr->gencount - (long)nfsi->attr_gencount) > 0 ||
-		((long)nfsi->attr_gencount - (long)nfs_read_attr_generation_counter() > 0);
+	return (long)(fattr->gencount - attr_gencount) > 0 ||
+	       (long)(attr_gencount - nfs_read_attr_generation_counter()) > 0;
 }
 
 /*
@@ -1849,7 +1849,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
 			nfsi->attrtimeo_timestamp = now;
 		}
 		/* Set the barrier to be more recent than this fattr */
-		if ((long)fattr->gencount - (long)nfsi->attr_gencount > 0)
+		if ((long)(fattr->gencount - nfsi->attr_gencount) > 0)
 			nfsi->attr_gencount = fattr->gencount;
 	}
 

From f5c7e5bed3dda9afbe558b484772171271db115d Mon Sep 17 00:00:00 2001
From: Nikola Livic <nlivic@gmail.com>
Date: Mon, 29 Mar 2021 11:56:49 +0300
Subject: [PATCH 2055/2658] pNFS/flexfiles: fix incorrect size check in
 decode_nfs_fh()

[ Upstream commit ed34695e15aba74f45247f1ee2cf7e09d449f925 ]

We (adam zabrocki, alexander matrosov, alexander tereshkin, maksym
bazalii) observed the check:

	if (fh->size > sizeof(struct nfs_fh))

should not use the size of the nfs_fh struct which includes an extra two
bytes from the size field.

struct nfs_fh {
	unsigned short         size;
	unsigned char          data[NFS_MAXFHSIZE];
}

but should determine the size from data[NFS_MAXFHSIZE] so the memcpy
will not write 2 bytes beyond destination.  The proposed fix is to
compare against the NFS_MAXFHSIZE directly, as is done elsewhere in fs
code base.

Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver")
Signed-off-by: Nikola Livic <nlivic@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/flexfilelayout/flexfilelayout.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index 17771e157e92..e7f8732895b7 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -86,7 +86,7 @@ static int decode_nfs_fh(struct xdr_stream *xdr, struct nfs_fh *fh)
 	if (unlikely(!p))
 		return -ENOBUFS;
 	fh->size = be32_to_cpup(p++);
-	if (fh->size > sizeof(struct nfs_fh)) {
+	if (fh->size > NFS_MAXFHSIZE) {
 		printk(KERN_ERR "NFS flexfiles: Too big fh received %d\n",
 		       fh->size);
 		return -EOVERFLOW;

From 62c353ed5cba8e25bfefeae22a2d323970bf539f Mon Sep 17 00:00:00 2001
From: Olga Kornievskaia <kolga@netapp.com>
Date: Wed, 31 Mar 2021 15:30:25 -0400
Subject: [PATCH 2056/2658] NFSv4.2 fix handling of sr_eof in SEEK's reply

[ Upstream commit 73f5c88f521a630ea1628beb9c2d48a2e777a419 ]

Currently the client ignores the value of the sr_eof of the SEEK
operation. According to the spec, if the server didn't find the
requested extent and reached the end of the file, the server
would return sr_eof=true. In case the request for DATA and no
data was found (ie in the middle of the hole), then the lseek
expects that ENXIO would be returned.

Fixes: 1c6dcbe5ceff8 ("NFS: Implement SEEK")
Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs42proc.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index 7f1a0fb8c493..31cc6f3d992d 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -168,7 +168,10 @@ static loff_t _nfs42_proc_llseek(struct file *filep, loff_t offset, int whence)
 	if (status)
 		return status;
 
-	return vfs_setpos(filep, res.sr_offset, inode->i_sb->s_maxbytes);
+	if (whence == SEEK_DATA && res.sr_eof)
+		return -NFS4ERR_NXIO;
+	else
+		return vfs_setpos(filep, res.sr_offset, inode->i_sb->s_maxbytes);
 }
 
 loff_t nfs42_proc_llseek(struct file *filep, loff_t offset, int whence)

From 8cfb23a76ae7de32e5a208575ce17c988d5179ab Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Mon, 3 May 2021 04:41:20 +0800
Subject: [PATCH 2057/2658] sctp: fix a SCTP_MIB_CURRESTAB leak in
 sctp_sf_do_dupcook_b

[ Upstream commit f282df0391267fb2b263da1cc3233aa6fb81defc ]

Normally SCTP_MIB_CURRESTAB is always incremented once asoc enter into
ESTABLISHED from the state < ESTABLISHED and decremented when the asoc
is being deleted.

However, in sctp_sf_do_dupcook_b(), the asoc's state can be changed to
ESTABLISHED from the state >= ESTABLISHED where it shouldn't increment
SCTP_MIB_CURRESTAB. Otherwise, one asoc may increment MIB_CURRESTAB
multiple times but only decrement once at the end.

I was able to reproduce it by using scapy to do the 4-way shakehands,
after that I replayed the COOKIE-ECHO chunk with 'peer_vtag' field
changed to different values, and SCTP_MIB_CURRESTAB was incremented
multiple times and never went back to 0 even when the asoc was freed.

This patch is to fix it by only incrementing SCTP_MIB_CURRESTAB when
the state < ESTABLISHED in sctp_sf_do_dupcook_b().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sctp/sm_statefuns.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index a9a72f7e0cd7..a9ba6f2bb8c8 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -1851,7 +1851,8 @@ static sctp_disposition_t sctp_sf_do_dupcook_b(struct net *net,
 	sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
 	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
 			SCTP_STATE(SCTP_STATE_ESTABLISHED));
-	SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
+	if (asoc->state < SCTP_STATE_ESTABLISHED)
+		SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
 	sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
 
 	repl = sctp_make_cookie_ack(new_asoc, chunk);

From ff766403a64424743903e764f8f5c357b18bcbd8 Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Sun, 2 May 2021 22:06:07 -0700
Subject: [PATCH 2058/2658] drm/radeon: Fix off-by-one power_state index heap
 overwrite

[ Upstream commit 5bbf219328849e83878bddb7c226d8d42e84affc ]

An out of bounds write happens when setting the default power state.
KASAN sees this as:

[drm] radeon: 512M of GTT memory ready.
[drm] GART: num cpu pages 131072, num gpu pages 131072
==================================================================
BUG: KASAN: slab-out-of-bounds in
radeon_atombios_parse_power_table_1_3+0x1837/0x1998 [radeon]
Write of size 4 at addr ffff88810178d858 by task systemd-udevd/157

CPU: 0 PID: 157 Comm: systemd-udevd Not tainted 5.12.0-E620 #50
Hardware name: eMachines        eMachines E620  /Nile       , BIOS V1.03 09/30/2008
Call Trace:
 dump_stack+0xa5/0xe6
 print_address_description.constprop.0+0x18/0x239
 kasan_report+0x170/0x1a8
 radeon_atombios_parse_power_table_1_3+0x1837/0x1998 [radeon]
 radeon_atombios_get_power_modes+0x144/0x1888 [radeon]
 radeon_pm_init+0x1019/0x1904 [radeon]
 rs690_init+0x76e/0x84a [radeon]
 radeon_device_init+0x1c1a/0x21e5 [radeon]
 radeon_driver_load_kms+0xf5/0x30b [radeon]
 drm_dev_register+0x255/0x4a0 [drm]
 radeon_pci_probe+0x246/0x2f6 [radeon]
 pci_device_probe+0x1aa/0x294
 really_probe+0x30e/0x850
 driver_probe_device+0xe6/0x135
 device_driver_attach+0xc1/0xf8
 __driver_attach+0x13f/0x146
 bus_for_each_dev+0xfa/0x146
 bus_add_driver+0x2b3/0x447
 driver_register+0x242/0x2c1
 do_one_initcall+0x149/0x2fd
 do_init_module+0x1ae/0x573
 load_module+0x4dee/0x5cca
 __do_sys_finit_module+0xf1/0x140
 do_syscall_64+0x33/0x40
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Without KASAN, this will manifest later when the kernel attempts to
allocate memory that was stomped, since it collides with the inline slab
freelist pointer:

invalid opcode: 0000 [#1] SMP NOPTI
CPU: 0 PID: 781 Comm: openrc-run.sh Tainted: G        W 5.10.12-gentoo-E620 #2
Hardware name: eMachines        eMachines E620  /Nile , BIOS V1.03       09/30/2008
RIP: 0010:kfree+0x115/0x230
Code: 89 c5 e8 75 ea ff ff 48 8b 00 0f ba e0 09 72 63 e8 1f f4 ff ff 41 89 c4 48 8b 45 00 0f ba e0 10 72 0a 48 8b 45 08 a8 01 75 02 <0f> 0b 44 89 e1 48 c7 c2 00 f0 ff ff be 06 00 00 00 48 d3 e2 48 c7
RSP: 0018:ffffb42f40267e10 EFLAGS: 00010246
RAX: ffffd61280ee8d88 RBX: 0000000000000004 RCX: 000000008010000d
RDX: 4000000000000000 RSI: ffffffffba1360b0 RDI: ffffd61280ee8d80
RBP: ffffd61280ee8d80 R08: ffffffffb91bebdf R09: 0000000000000000
R10: ffff8fe2c1047ac8 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000100
FS:  00007fe80eff6b68(0000) GS:ffff8fe339c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe80eec7bc0 CR3: 0000000038012000 CR4: 00000000000006f0
Call Trace:
 __free_fdtable+0x16/0x1f
 put_files_struct+0x81/0x9b
 do_exit+0x433/0x94d
 do_group_exit+0xa6/0xa6
 __x64_sys_exit_group+0xf/0xf
 do_syscall_64+0x33/0x40
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fe80ef64bea
Code: Unable to access opcode bytes at RIP 0x7fe80ef64bc0.
RSP: 002b:00007ffdb1c47528 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fe80ef64bea
RDX: 00007fe80ef64f60 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 00007fe80ee2c620 R11: 0000000000000246 R12: 00007fe80eff41e0
R13: 00000000ffffffff R14: 0000000000000024 R15: 00007fe80edf9cd0
Modules linked in: radeon(+) ath5k(+) snd_hda_codec_realtek ...

Use a valid power_state index when initializing the "flags" and "misc"
and "misc2" fields.

Bug: https://bugzilla.kernel.org/show_bug.cgi?id=211537
Reported-by: Erhard F. <erhard_f@mailbox.org>
Fixes: a48b9b4edb8b ("drm/radeon/kms/pm: add asic specific callbacks for getting power state (v2)")
Fixes: 79daedc94281 ("drm/radeon/kms: minor pm cleanups")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/radeon/radeon_atombios.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 0c5b3eeff82d..230e2dcdf053 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -2259,10 +2259,10 @@ static int radeon_atombios_parse_power_table_1_3(struct radeon_device *rdev)
 		rdev->pm.default_power_state_index = state_index - 1;
 		rdev->pm.power_state[state_index - 1].default_clock_mode =
 			&rdev->pm.power_state[state_index - 1].clock_info[0];
-		rdev->pm.power_state[state_index].flags &=
+		rdev->pm.power_state[state_index - 1].flags &=
 			~RADEON_PM_STATE_SINGLE_DISPLAY_ONLY;
-		rdev->pm.power_state[state_index].misc = 0;
-		rdev->pm.power_state[state_index].misc2 = 0;
+		rdev->pm.power_state[state_index - 1].misc = 0;
+		rdev->pm.power_state[state_index - 1].misc2 = 0;
 	}
 	return state_index;
 }

From fff27dacd9a3d6ec9f329efafe27bc625e701987 Mon Sep 17 00:00:00 2001
From: Miaohe Lin <linmiaohe@huawei.com>
Date: Tue, 4 May 2021 18:37:45 -0700
Subject: [PATCH 2059/2658] ksm: fix potential missing rmap_item for
 stable_node

[ Upstream commit c89a384e2551c692a9fe60d093fd7080f50afc51 ]

When removing rmap_item from stable tree, STABLE_FLAG of rmap_item is
cleared with head reserved.  So the following scenario might happen: For
ksm page with rmap_item1:

cmp_and_merge_page
  stable_node->head = &migrate_nodes;
  remove_rmap_item_from_tree, but head still equal to stable_node;
  try_to_merge_with_ksm_page failed;
  return;

For the same ksm page with rmap_item2, stable node migration succeed this
time.  The stable_node->head does not equal to migrate_nodes now.  For ksm
page with rmap_item1 again:

cmp_and_merge_page
 stable_node->head != &migrate_nodes && rmap_item->head == stable_node
 return;

We would miss the rmap_item for stable_node and might result in failed
rmap_walk_ksm().  Fix this by set rmap_item->head to NULL when rmap_item
is removed from stable tree.

Link: https://lkml.kernel.org/r/20210330140228.45635-5-linmiaohe@huawei.com
Fixes: 4146d2d673e8 ("ksm: make !merge_across_nodes migration safe")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Cc: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/ksm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mm/ksm.c b/mm/ksm.c
index 8c270ac7d5f8..6281e4eaaff8 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -651,6 +651,7 @@ static void remove_rmap_item_from_tree(struct rmap_item *rmap_item)
 			ksm_pages_shared--;
 
 		put_anon_vma(rmap_item->anon_vma);
+		rmap_item->head = NULL;
 		rmap_item->address &= PAGE_MASK;
 
 	} else if (rmap_item->address & UNSTABLE_FLAG) {

From e8d6d46f976de6d4324a85143ecd07f9a8f6fa65 Mon Sep 17 00:00:00 2001
From: Jia-Ju Bai <baijiaju1990@gmail.com>
Date: Thu, 6 May 2021 18:04:38 -0700
Subject: [PATCH 2060/2658] kernel: kexec_file: fix error return code of
 kexec_calculate_store_digests()

[ Upstream commit 31d82c2c787d5cf65fedd35ebbc0c1bd95c1a679 ]

When vzalloc() returns NULL to sha_regions, no error return code of
kexec_calculate_store_digests() is assigned.  To fix this bug, ret is
assigned with -ENOMEM in this case.

Link: https://lkml.kernel.org/r/20210309083904.24321-1-baijiaju1990@gmail.com
Fixes: a43cac0d9dc2 ("kexec: split kexec_file syscall code to kexec_file.c")
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Acked-by: Baoquan He <bhe@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/kexec_file.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 6030efd4a188..1210cd6bcaa6 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -575,8 +575,10 @@ static int kexec_calculate_store_digests(struct kimage *image)
 
 	sha_region_sz = KEXEC_SEGMENT_MAX * sizeof(struct kexec_sha_region);
 	sha_regions = vzalloc(sha_region_sz);
-	if (!sha_regions)
+	if (!sha_regions) {
+		ret = -ENOMEM;
 		goto out_free_desc;
+	}
 
 	desc->tfm   = tfm;
 	desc->flags = 0;

From afc4afe8749a6887c5e3aa4c05770ce29e3053c5 Mon Sep 17 00:00:00 2001
From: Vineet Gupta <vgupta@synopsys.com>
Date: Fri, 23 Apr 2021 12:16:25 -0700
Subject: [PATCH 2061/2658] ARC: entry: fix off-by-one error in syscall number
 validation

commit 3433adc8bd09fc9f29b8baddf33b4ecd1ecd2cdc upstream.

We have NR_syscall syscalls from [0 .. NR_syscall-1].
However the check for invalid syscall number is "> NR_syscall" as
opposed to >=. This off-by-one error erronesously allows "NR_syscall"
to be treated as valid syscall causeing out-of-bounds access into
syscall-call table ensuing a crash (holes within syscall table have a
invalid-entry handler but this is beyond the array implementing the
table).

This problem showed up on v5.6 kernel when testing glibc 2.33 (v5.10
kernel capable, includng faccessat2 syscall 439). The v5.6 kernel has
NR_syscalls=439 (0 to 438). Due to the bug, 439 passed by glibc was
not handled as -ENOSYS but processed leading to a crash.

Link: https://github.com/foss-for-synopsys-dwc-arc-processors/linux/issues/48
Reported-by: Shahab Vahedi <shahab@synopsys.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arc/kernel/entry.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S
index db1eee5fe502..6da48c1e3475 100644
--- a/arch/arc/kernel/entry.S
+++ b/arch/arc/kernel/entry.S
@@ -181,7 +181,7 @@ tracesys:
 
 	; Do the Sys Call as we normally would.
 	; Validate the Sys Call number
-	cmp     r8,  NR_syscalls
+	cmp     r8,  NR_syscalls - 1
 	mov.hi  r0, -ENOSYS
 	bhi     tracesys_exit
 
@@ -264,7 +264,7 @@ ENTRY(EV_Trap)
 	;============ Normal syscall case
 
 	; syscall num shd not exceed the total system calls avail
-	cmp     r8,  NR_syscalls
+	cmp     r8,  NR_syscalls - 1
 	mov.hi  r0, -ENOSYS
 	bhi     ret_from_system_call
 

From 718d7fff8000cbf39010070a7292ae36f2841d87 Mon Sep 17 00:00:00 2001
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Thu, 6 May 2021 14:49:59 +1000
Subject: [PATCH 2062/2658] powerpc/64s: Fix crashes when toggling entry flush
 barrier

commit aec86b052df6541cc97c5fca44e5934cbea4963b upstream.

The entry flush mitigation can be enabled/disabled at runtime via a
debugfs file (entry_flush), which causes the kernel to patch itself to
enable/disable the relevant mitigations.

However depending on which mitigation we're using, it may not be safe to
do that patching while other CPUs are active. For example the following
crash:

  sleeper[15639]: segfault (11) at c000000000004c20 nip c000000000004c20 lr c000000000004c20

Shows that we returned to userspace with a corrupted LR that points into
the kernel, due to executing the partially patched call to the fallback
entry flush (ie. we missed the LR restore).

Fix it by doing the patching under stop machine. The CPUs that aren't
doing the patching will be spinning in the core of the stop machine
logic. That is currently sufficient for our purposes, because none of
the patching we do is to that code or anywhere in the vicinity.

Fixes: f79643787e0a ("powerpc/64s: flush L1D on kernel entry")
Cc: stable@vger.kernel.org # v5.10+
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210506044959.1298123-2-mpe@ellerman.id.au
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/lib/feature-fixups.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c
index 40b134bf5a68..b5dc2a03ea93 100644
--- a/arch/powerpc/lib/feature-fixups.c
+++ b/arch/powerpc/lib/feature-fixups.c
@@ -16,6 +16,7 @@
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/init.h>
+#include <linux/stop_machine.h>
 #include <asm/cputable.h>
 #include <asm/code-patching.h>
 #include <asm/page.h>
@@ -279,8 +280,9 @@ void do_uaccess_flush_fixups(enum l1d_flush_type types)
 						: "unknown");
 }
 
-void do_entry_flush_fixups(enum l1d_flush_type types)
+static int __do_entry_flush_fixups(void *data)
 {
+	enum l1d_flush_type types = *(enum l1d_flush_type *)data;
 	unsigned int instrs[3], *dest;
 	long *start, *end;
 	int i;
@@ -331,6 +333,19 @@ void do_entry_flush_fixups(enum l1d_flush_type types)
 							: "ori type" :
 		(types &  L1D_FLUSH_MTTRIG)     ? "mttrig type"
 						: "unknown");
+
+	return 0;
+}
+
+void do_entry_flush_fixups(enum l1d_flush_type types)
+{
+	/*
+	 * The call to the fallback flush can not be safely patched in/out while
+	 * other CPUs are executing it. So call __do_entry_flush_fixups() on one
+	 * CPU while all other CPUs spin in the stop machine core with interrupts
+	 * hard disabled.
+	 */
+	stop_machine(__do_entry_flush_fixups, &types, NULL);
 }
 
 void do_rfi_flush_fixups(enum l1d_flush_type types)

From cecccebd6c6770a7b411a750ea74a0895999fe0c Mon Sep 17 00:00:00 2001
From: Phillip Lougher <phillip@squashfs.org.uk>
Date: Fri, 14 May 2021 17:27:16 -0700
Subject: [PATCH 2063/2658] squashfs: fix divide error in calculate_skip()

commit d6e621de1fceb3b098ebf435ef7ea91ec4838a1a upstream.

Sysbot has reported a "divide error" which has been identified as being
caused by a corrupted file_size value within the file inode.  This value
has been corrupted to a much larger value than expected.

Calculate_skip() is passed i_size_read(inode) >> msblk->block_log.  Due to
the file_size value corruption this overflows the int argument/variable in
that function, leading to the divide error.

This patch changes the function to use u64.  This will accommodate any
unexpectedly large values due to corruption.

The value returned from calculate_skip() is clamped to be never more than
SQUASHFS_CACHED_BLKS - 1, or 7.  So file_size corruption does not lead to
an unexpectedly large return result here.

Link: https://lkml.kernel.org/r/20210507152618.9447-1-phillip@squashfs.org.uk
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Reported-by: <syzbot+e8f781243ce16ac2f962@syzkaller.appspotmail.com>
Reported-by: <syzbot+7b98870d4fec9447b951@syzkaller.appspotmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/squashfs/file.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c
index 43d946617d2d..377be131d23b 100644
--- a/fs/squashfs/file.c
+++ b/fs/squashfs/file.c
@@ -228,11 +228,11 @@ static long long read_indexes(struct super_block *sb, int n,
  * If the skip factor is limited in this way then the file will use multiple
  * slots.
  */
-static inline int calculate_skip(int blocks)
+static inline int calculate_skip(u64 blocks)
 {
-	int skip = blocks / ((SQUASHFS_META_ENTRIES + 1)
+	u64 skip = blocks / ((SQUASHFS_META_ENTRIES + 1)
 		 * SQUASHFS_META_INDEXES);
-	return min(SQUASHFS_CACHED_BLKS - 1, skip + 1);
+	return min((u64) SQUASHFS_CACHED_BLKS - 1, skip + 1);
 }
 
 

From 35d83869857473c5e523735af79077552f104e42 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Thu, 6 May 2021 22:39:10 +0200
Subject: [PATCH 2064/2658] usb: fotg210-hcd: Fix an error message

[ Upstream commit a60a34366e0d09ca002c966dd7c43a68c28b1f82 ]

'retval' is known to be -ENODEV here.
This is a hard-coded default error code which is not useful in the error
message. Moreover, another error message is printed at the end of the
error handling path. The corresponding error code (-ENOMEM) is more
informative.

So remove simplify the first error message.

While at it, also remove the useless initialization of 'retval'.

Fixes: 7d50195f6c50 ("usb: host: Faraday fotg210-hcd driver")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/94531bcff98e46d4f9c20183a90b7f47f699126c.1620333419.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/fotg210-hcd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
index 11b3a8c57eab..5dacc3076efd 100644
--- a/drivers/usb/host/fotg210-hcd.c
+++ b/drivers/usb/host/fotg210-hcd.c
@@ -5610,7 +5610,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev)
 	struct usb_hcd *hcd;
 	struct resource *res;
 	int irq;
-	int retval = -ENODEV;
+	int retval;
 	struct fotg210_hcd *fotg210;
 
 	if (usb_disabled())
@@ -5630,7 +5630,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev)
 	hcd = usb_create_hcd(&fotg210_fotg210_hc_driver, dev,
 			dev_name(dev));
 	if (!hcd) {
-		dev_err(dev, "failed to create hcd with err %d\n", retval);
+		dev_err(dev, "failed to create hcd\n");
 		retval = -ENOMEM;
 		goto fail_create_hcd;
 	}

From 60a7732f22ee9b27cb510b0bcbabd6aaf6f29b40 Mon Sep 17 00:00:00 2001
From: Maximilian Luz <luzmaximilian@gmail.com>
Date: Wed, 12 May 2021 11:08:15 +0300
Subject: [PATCH 2065/2658] usb: xhci: Increase timeout for HC halt

commit ca09b1bea63ab83f4cca3a2ae8bc4f597ec28851 upstream.

On some devices (specifically the SC8180x based Surface Pro X with
QCOM04A6) HC halt / xhci_halt() times out during boot. Manually binding
the xhci-hcd driver at some point later does not exhibit this behavior.
To work around this, double XHCI_MAX_HALT_USEC, which also resolves this
issue.

Cc: <stable@vger.kernel.org>
Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20210512080816.866037-5-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-ext-caps.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/host/xhci-ext-caps.h b/drivers/usb/host/xhci-ext-caps.h
index 9fe3225e6c61..35ac83e86c94 100644
--- a/drivers/usb/host/xhci-ext-caps.h
+++ b/drivers/usb/host/xhci-ext-caps.h
@@ -19,8 +19,9 @@
  * along with this program; if not, write to the Free Software Foundation,
  * Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* Up to 16 ms to halt an HC */
-#define XHCI_MAX_HALT_USEC	(16*1000)
+
+/* HC should halt within 16 ms, but use 32 ms as some hosts take longer */
+#define XHCI_MAX_HALT_USEC	(32 * 1000)
 /* HC not running - set to 1 when run/stop bit is cleared. */
 #define XHCI_STS_HALT		(1<<0)
 

From 401930469fc745d56405103f29e7de0969189f02 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.com>
Date: Thu, 6 May 2021 12:22:00 +0100
Subject: [PATCH 2066/2658] usb: dwc2: Fix gadget DMA unmap direction

commit 75a41ce46bae6cbe7d3bb2584eb844291d642874 upstream.

The dwc2 gadget support maps and unmaps DMA buffers as necessary. When
mapping and unmapping it uses the direction of the endpoint to select
the direction of the DMA transfer, but this fails for Control OUT
transfers because the unmap occurs after the endpoint direction has
been reversed for the status phase.

A possible solution would be to unmap the buffer before the direction
is changed, but a safer, less invasive fix is to remember the buffer
direction independently of the endpoint direction.

Fixes: fe0b94abcdf6 ("usb: dwc2: gadget: manage ep0 state in software")
Acked-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Link: https://lore.kernel.org/r/20210506112200.2893922-1-phil@raspberrypi.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc2/core.h   | 2 ++
 drivers/usb/dwc2/gadget.c | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index a899d47c2a7c..ecc4d09ea704 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -144,6 +144,7 @@ struct dwc2_hsotg_req;
  * @lock: State lock to protect contents of endpoint.
  * @dir_in: Set to true if this endpoint is of the IN direction, which
  *          means that it is sending data to the Host.
+ * @map_dir: Set to the value of dir_in when the DMA buffer is mapped.
  * @index: The index for the endpoint registers.
  * @mc: Multi Count - number of transactions per microframe
  * @interval - Interval for periodic endpoints
@@ -185,6 +186,7 @@ struct dwc2_hsotg_ep {
 	unsigned short		fifo_index;
 
 	unsigned char           dir_in;
+	unsigned char           map_dir;
 	unsigned char           index;
 	unsigned char           mc;
 	u16                     interval;
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 135e97310f11..ab5cde515b1d 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -289,7 +289,7 @@ static void dwc2_hsotg_unmap_dma(struct dwc2_hsotg *hsotg,
 	if (hs_req->req.length == 0)
 		return;
 
-	usb_gadget_unmap_request(&hsotg->gadget, req, hs_ep->dir_in);
+	usb_gadget_unmap_request(&hsotg->gadget, req, hs_ep->map_dir);
 }
 
 /**
@@ -707,6 +707,7 @@ static int dwc2_hsotg_map_dma(struct dwc2_hsotg *hsotg,
 	if (hs_req->req.length == 0)
 		return 0;
 
+	hs_ep->map_dir = hs_ep->dir_in;
 	ret = usb_gadget_map_request(&hsotg->gadget, req, hs_ep->dir_in);
 	if (ret)
 		goto dma_error;

From 136a3b5c6f72cc439d7e14e48b15f0119a48852b Mon Sep 17 00:00:00 2001
From: Chunfeng Yun <chunfeng.yun@mediatek.com>
Date: Wed, 12 May 2021 10:07:38 +0800
Subject: [PATCH 2067/2658] usb: core: hub: fix race condition about TRSMRCY of
 resume

commit 975f94c7d6c306b833628baa9aec3f79db1eb3a1 upstream.

This may happen if the port becomes resume status exactly
when usb_port_resume() gets port status, it still need provide
a TRSMCRY time before access the device.

CC: <stable@vger.kernel.org>
Reported-by: Tianping Fang <tianping.fang@mediatek.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Link: https://lore.kernel.org/r/20210512020738.52961-1-chunfeng.yun@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/hub.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 8fdd55d13f32..5fa874c75a82 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -3460,6 +3460,9 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)
 				usb_clear_port_feature(hub->hdev, port1,
 						USB_PORT_FEAT_C_SUSPEND);
 		}
+
+		/* TRSMRCY = 10 msec */
+		msleep(10);
 	}
 
 	if (udev->persist_enabled && hub_is_superspeed(hub->hdev))

From 21fc8bded5f1e37a659aacbcc8e2d6e7a1cb8985 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Wed, 5 May 2021 23:48:17 +0200
Subject: [PATCH 2068/2658] KVM: x86: Cancel pvclock_gtod_work on module
 removal

commit 594b27e677b35f9734b1969d175ebc6146741109 upstream.

Nothing prevents the following:

  pvclock_gtod_notify()
    queue_work(system_long_wq, &pvclock_gtod_work);
  ...
  remove_module(kvm);
  ...
  work_queue_run()
    pvclock_gtod_work()	<- UAF

Ditto for any other operation on that workqueue list head which touches
pvclock_gtod_work after module removal.

Cancel the work in kvm_arch_exit() to prevent that.

Fixes: 16e8d74d2da9 ("KVM: x86: notifier for clocksource changes")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Message-Id: <87czu4onry.ffs@nanos.tec.linutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/x86.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 07461699953b..7c8aa75e4737 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -6025,6 +6025,7 @@ void kvm_arch_exit(void)
 	unregister_hotcpu_notifier(&kvmclock_cpu_notifier_block);
 #ifdef CONFIG_X86_64
 	pvclock_gtod_unregister_notifier(&pvclock_gtod_notifier);
+	cancel_work_sync(&pvclock_gtod_work);
 #endif
 	kvm_x86_ops = NULL;
 	kvm_mmu_module_exit();

From 6ddc5bd1566d31f04454ef4c47eb164f47ed70f6 Mon Sep 17 00:00:00 2001
From: "Maciej W. Rozycki" <macro@orcam.me.uk>
Date: Wed, 10 Mar 2021 13:03:14 +0100
Subject: [PATCH 2069/2658] FDDI: defxx: Make MMIO the configuration default
 except for EISA

commit 193ced4a79599352d63cb8c9e2f0c6043106eb6a upstream.

Recent versions of the PCI Express specification have deprecated support
for I/O transactions and actually some PCIe host bridges, such as Power
Systems Host Bridge 4 (PHB4), do not implement them.

The default kernel configuration choice for the defxx driver is the use
of I/O ports rather than MMIO for PCI and EISA systems.  It may have
made sense as a conservative backwards compatible choice back when MMIO
operation support was added to the driver as a part of TURBOchannel bus
support.  However nowadays this configuration choice makes the driver
unusable with systems that do not implement I/O transactions for PCIe.

Make DEFXX_MMIO the configuration default then, except where configured
for EISA.  This exception is because an EISA adapter can have its MMIO
decoding disabled with ECU (EISA Configuration Utility) and therefore
not available with the resource allocation infrastructure we implement,
while port I/O is always readily available as it uses slot-specific
addressing, directly mapped to the slot an option card has been placed
in and handled with our EISA bus support core.  Conversely a kernel that
supports modern systems which may not have I/O transactions implemented
for PCIe will usually not be expected to handle legacy EISA systems.

The change of the default will make it easier for people, including but
not limited to distribution packagers, to make a working choice for the
driver.

Update the option description accordingly and while at it replace the
potentially ambiguous PIO acronym with IOP for "port I/O" vs "I/O ports"
according to our nomenclature used elsewhere.

Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: e89a2cfb7d7b ("[TC] defxx: TURBOchannel support")
Cc: stable@vger.kernel.org # v2.6.21+
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/fddi/Kconfig | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/net/fddi/Kconfig b/drivers/net/fddi/Kconfig
index 3a424c864f4d..ecebeeb9b2a0 100644
--- a/drivers/net/fddi/Kconfig
+++ b/drivers/net/fddi/Kconfig
@@ -28,17 +28,20 @@ config DEFXX
 
 config DEFXX_MMIO
 	bool
-	prompt "Use MMIO instead of PIO" if PCI || EISA
+	prompt "Use MMIO instead of IOP" if PCI || EISA
 	depends on DEFXX
-	default n if PCI || EISA
+	default n if EISA
 	default y
 	---help---
 	  This instructs the driver to use EISA or PCI memory-mapped I/O
-	  (MMIO) as appropriate instead of programmed I/O ports (PIO).
+	  (MMIO) as appropriate instead of programmed I/O ports (IOP).
 	  Enabling this gives an improvement in processing time in parts
-	  of the driver, but it may cause problems with EISA (DEFEA)
-	  adapters.  TURBOchannel does not have the concept of I/O ports,
-	  so MMIO is always used for these (DEFTA) adapters.
+	  of the driver, but it requires a memory window to be configured
+	  for EISA (DEFEA) adapters that may not always be available.
+	  Conversely some PCIe host bridges do not support IOP, so MMIO
+	  may be required to access PCI (DEFPA) adapters on downstream PCI
+	  buses with some systems.  TURBOchannel does not have the concept
+	  of I/O ports, so MMIO is always used for these (DEFTA) adapters.
 
 	  If unsure, say N.
 

From d385c357ce9f64b08ffb8b735b5d4c8c1961dea3 Mon Sep 17 00:00:00 2001
From: Lukasz Luba <lukasz.luba@arm.com>
Date: Thu, 22 Apr 2021 16:36:22 +0100
Subject: [PATCH 2070/2658] thermal/core/fair share: Lock the thermal zone
 while looping over instances

commit fef05776eb02238dcad8d5514e666a42572c3f32 upstream.

The tz->lock must be hold during the looping over the instances in that
thermal zone. This lock was missing in the governor code since the
beginning, so it's hard to point into a particular commit.

CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Lukasz Luba <lukasz.luba@arm.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20210422153624.6074-2-lukasz.luba@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/thermal/fair_share.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/thermal/fair_share.c b/drivers/thermal/fair_share.c
index 34fe36504a55..e701356441a9 100644
--- a/drivers/thermal/fair_share.c
+++ b/drivers/thermal/fair_share.c
@@ -93,6 +93,8 @@ static int fair_share_throttle(struct thermal_zone_device *tz, int trip)
 	int total_instance = 0;
 	int cur_trip_level = get_trip_level(tz);
 
+	mutex_lock(&tz->lock);
+
 	list_for_each_entry(instance, &tz->thermal_instances, tz_node) {
 		if (instance->trip != trip)
 			continue;
@@ -119,6 +121,8 @@ static int fair_share_throttle(struct thermal_zone_device *tz, int trip)
 		instance->cdev->updated = false;
 		thermal_cdev_update(cdev);
 	}
+
+	mutex_unlock(&tz->lock);
 	return 0;
 }
 

From 26afbaa8b74f90d332d31b0412301dbb5cd24e17 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Fri, 26 Mar 2021 14:32:32 -0400
Subject: [PATCH 2071/2658] dm ioctl: fix out of bounds array access when no
 devices

commit 4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a upstream.

If there are not any dm devices, we need to zero the "dev" argument in
the first structure dm_name_list. However, this can cause out of
bounds write, because the "needed" variable is zero and len may be
less than eight.

Fix this bug by reporting DM_BUFFER_FULL_FLAG if the result buffer is
too small to hold the "nl->dev" value.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
[iwamatsu: Adjust context]
Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-ioctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index bbc71bc52c0d..2071c889d34b 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -524,7 +524,7 @@ static int list_devices(struct dm_ioctl *param, size_t param_size)
 	 * Grab our output buffer.
 	 */
 	nl = get_result_buffer(param, param_size, &len);
-	if (len < needed) {
+	if (len < needed || len < sizeof(nl->dev)) {
 		param->flags |= DM_BUFFER_FULL_FLAG;
 		goto out;
 	}

From b72f8f4f1d9c7c097801444c4c1c3baad7da4bcf Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 5 Apr 2021 11:48:52 +0200
Subject: [PATCH 2072/2658] kobject_uevent: remove warning in
 init_uevent_argv()

commit b4104180a2efb85f55e1ba1407885c9421970338 upstream.

syzbot can trigger the WARN() in init_uevent_argv() which isn't the
nicest as the code does properly recover and handle the error.  So
change the WARN() call to pr_warn() and provide some more information on
what the buffer size that was needed.

Link: https://lore.kernel.org/r/20201107082206.GA19079@kroah.com
Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: linux-kernel@vger.kernel.org
Reported-by: syzbot+92340f7b2b4789907fdb@syzkaller.appspotmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20210405094852.1348499-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/kobject_uevent.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index f6c2c1e7779c..6104daf98ad9 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -128,12 +128,13 @@ static int kobj_usermode_filter(struct kobject *kobj)
 
 static int init_uevent_argv(struct kobj_uevent_env *env, const char *subsystem)
 {
+	int buffer_size = sizeof(env->buf) - env->buflen;
 	int len;
 
-	len = strlcpy(&env->buf[env->buflen], subsystem,
-		      sizeof(env->buf) - env->buflen);
-	if (len >= (sizeof(env->buf) - env->buflen)) {
-		WARN(1, KERN_ERR "init_uevent_argv: buffer size too small\n");
+	len = strlcpy(&env->buf[env->buflen], subsystem, buffer_size);
+	if (len >= buffer_size) {
+		pr_warn("init_uevent_argv: buffer size of %d too small, needed %d\n",
+			buffer_size, len);
 		return -ENOMEM;
 	}
 

From f6226c9e24d10a5cf81eaff164bddeb33e262ebe Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 22 Mar 2021 17:45:36 +0100
Subject: [PATCH 2073/2658] x86/msr: Fix wr/rdmsr_safe_regs_on_cpu() prototypes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 396a66aa1172ef2b78c21651f59b40b87b2e5e1e upstream.

gcc-11 warns about mismatched prototypes here:

  arch/x86/lib/msr-smp.c:255:51: error: argument 2 of type ‘u32 *’ {aka ‘unsigned int *’} declared as a pointer [-Werror=array-parameter=]
    255 | int rdmsr_safe_regs_on_cpu(unsigned int cpu, u32 *regs)
        |                                              ~~~~~^~~~
  arch/x86/include/asm/msr.h:347:50: note: previously declared as an array ‘u32[8]’ {aka ‘unsigned int[8]’}

GCC is right here - fix up the types.

[ mingo: Twiddled the changelog. ]

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/20210322164541.912261-1-arnd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/lib/msr-smp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/lib/msr-smp.c b/arch/x86/lib/msr-smp.c
index 518532e6a3fa..8a3bc242c5e9 100644
--- a/arch/x86/lib/msr-smp.c
+++ b/arch/x86/lib/msr-smp.c
@@ -239,7 +239,7 @@ static void __wrmsr_safe_regs_on_cpu(void *info)
 	rv->err = wrmsr_safe_regs(rv->regs);
 }
 
-int rdmsr_safe_regs_on_cpu(unsigned int cpu, u32 *regs)
+int rdmsr_safe_regs_on_cpu(unsigned int cpu, u32 regs[8])
 {
 	int err;
 	struct msr_regs_info rv;
@@ -252,7 +252,7 @@ int rdmsr_safe_regs_on_cpu(unsigned int cpu, u32 *regs)
 }
 EXPORT_SYMBOL(rdmsr_safe_regs_on_cpu);
 
-int wrmsr_safe_regs_on_cpu(unsigned int cpu, u32 *regs)
+int wrmsr_safe_regs_on_cpu(unsigned int cpu, u32 regs[8])
 {
 	int err;
 	struct msr_regs_info rv;

From 7a0fa14a255386ae1f5e70dd9065c877ecaf0ba5 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 22 Mar 2021 17:43:03 +0100
Subject: [PATCH 2074/2658] kgdb: fix gcc-11 warning on indentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 40cc3a80bb42587db1e6ae21d6f3090582d33e89 upstream.

gcc-11 starts warning about misleading indentation inside of macros:

drivers/misc/kgdbts.c: In function ‘kgdbts_break_test’:
drivers/misc/kgdbts.c:103:9: error: this ‘if’ clause does not guard... [-Werror=misleading-indentation]
  103 |         if (verbose > 1) \
      |         ^~
drivers/misc/kgdbts.c:200:9: note: in expansion of macro ‘v2printk’
  200 |         v2printk("kgdbts: breakpoint complete\n");
      |         ^~~~~~~~
drivers/misc/kgdbts.c:105:17: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the ‘if’
  105 |                 touch_nmi_watchdog();   \
      |                 ^~~~~~~~~~~~~~~~~~

The code looks correct to me, so just reindent it for readability.

Fixes: e8d31c204e36 ("kgdb: add kgdb internal test suite")
Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20210322164308.827846-1-arnd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/kgdbts.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
index fc8cb855c6e6..e4249ce2c42f 100644
--- a/drivers/misc/kgdbts.c
+++ b/drivers/misc/kgdbts.c
@@ -105,19 +105,19 @@
 #include <linux/module.h>
 #include <asm/sections.h>
 
-#define v1printk(a...) do { \
-	if (verbose) \
-		printk(KERN_INFO a); \
-	} while (0)
-#define v2printk(a...) do { \
-	if (verbose > 1) \
-		printk(KERN_INFO a); \
-		touch_nmi_watchdog();	\
-	} while (0)
-#define eprintk(a...) do { \
-		printk(KERN_ERR a); \
-		WARN_ON(1); \
-	} while (0)
+#define v1printk(a...) do {		\
+	if (verbose)			\
+		printk(KERN_INFO a);	\
+} while (0)
+#define v2printk(a...) do {		\
+	if (verbose > 1)		\
+		printk(KERN_INFO a);	\
+	touch_nmi_watchdog();		\
+} while (0)
+#define eprintk(a...) do {		\
+	printk(KERN_ERR a);		\
+	WARN_ON(1);			\
+} while (0)
 #define MAX_CONFIG_LEN		40
 
 static struct kgdb_io kgdbts_io_ops;

From 669f6e8d9aa41832ecd28b36967ccf1e4657f52c Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 22 Mar 2021 17:42:26 +0100
Subject: [PATCH 2075/2658] usb: sl811-hcd: improve misleading indentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 8460f6003a1d2633737b89c4f69d6f4c0c7c65a3 upstream.

gcc-11 now warns about a confusingly indented code block:

drivers/usb/host/sl811-hcd.c: In function ‘sl811h_hub_control’:
drivers/usb/host/sl811-hcd.c:1291:9: error: this ‘if’ clause does not guard... [-Werror=misleading-indentation]
 1291 |         if (*(u16*)(buf+2))     /* only if wPortChange is interesting */
      |         ^~
drivers/usb/host/sl811-hcd.c:1295:17: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the ‘if’
 1295 |                 break;

Rewrite this to use a single if() block with the __is_defined() macro.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20210322164244.827589-1-arnd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/sl811-hcd.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
index fd2a11473be7..455c59fe32fa 100644
--- a/drivers/usb/host/sl811-hcd.c
+++ b/drivers/usb/host/sl811-hcd.c
@@ -1286,11 +1286,10 @@ sl811h_hub_control(
 			goto error;
 		put_unaligned_le32(sl811->port1, buf);
 
-#ifndef	VERBOSE
-	if (*(u16*)(buf+2))	/* only if wPortChange is interesting */
-#endif
-		dev_dbg(hcd->self.controller, "GetPortStatus %08x\n",
-			sl811->port1);
+		if (__is_defined(VERBOSE) ||
+		    *(u16*)(buf+2)) /* only if wPortChange is interesting */
+			dev_dbg(hcd->self.controller, "GetPortStatus %08x\n",
+				sl811->port1);
 		break;
 	case SetPortFeature:
 		if (wIndex != 1 || wLength != 0)

From cc724eb317358c32905141a371cb58226c816896 Mon Sep 17 00:00:00 2001
From: Kaixu Xia <kaixuxia@tencent.com>
Date: Wed, 4 Nov 2020 13:24:04 +0800
Subject: [PATCH 2076/2658] cxgb4: Fix the -Wmisleading-indentation warning

commit ea8146c6845799142aa4ee2660741c215e340cdf upstream.

Fix the gcc warning:

drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c:2673:9: warning: this 'for' clause does not guard... [-Wmisleading-indentation]
 2673 |         for (i = 0; i < n; ++i) \

Reported-by: Tosk Robot <tencent_os_robot@tencent.com>
Signed-off-by: Kaixu Xia <kaixuxia@tencent.com>
Link: https://lore.kernel.org/r/1604467444-23043-1-git-send-email-kaixuxia@tencent.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
index fa62015220d7..7104cd75491c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
@@ -2263,7 +2263,7 @@ do { \
 	seq_printf(seq, "%-12s", s); \
 	for (i = 0; i < n; ++i) \
 		seq_printf(seq, " %16" fmt_spec, v); \
-		seq_putc(seq, '\n'); \
+	seq_putc(seq, '\n'); \
 } while (0)
 #define S(s, v) S3("s", s, v)
 #define T3(fmt_spec, s, v) S3(fmt_spec, s, tx[i].v)

From 097eae45c8542b207e906226be9d9a559f8e2466 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 22 Mar 2021 17:44:29 +0100
Subject: [PATCH 2077/2658] isdn: capi: fix mismatched prototypes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 5ee7d4c7fbc9d3119a20b1c77d34003d1f82ac26 upstream.

gcc-11 complains about a prototype declaration that is different
from the function definition:

drivers/isdn/capi/kcapi.c:724:44: error: argument 2 of type ‘u8 *’ {aka ‘unsigned char *’} declared as a pointer [-Werror=array-parameter=]
  724 | u16 capi20_get_manufacturer(u32 contr, u8 *buf)
      |                                        ~~~~^~~
In file included from drivers/isdn/capi/kcapi.c:13:
drivers/isdn/capi/kcapi.h:62:43: note: previously declared as an array ‘u8[64]’ {aka ‘unsigned char[64]’}
   62 | u16 capi20_get_manufacturer(u32 contr, u8 buf[CAPI_MANUFACTURER_LEN]);
      |                                        ~~~^~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/isdn/capi/kcapi.c:790:38: error: argument 2 of type ‘u8 *’ {aka ‘unsigned char *’} declared as a pointer [-Werror=array-parameter=]
  790 | u16 capi20_get_serial(u32 contr, u8 *serial)
      |                                  ~~~~^~~~~~
In file included from drivers/isdn/capi/kcapi.c:13:
drivers/isdn/capi/kcapi.h:64:37: note: previously declared as an array ‘u8[8]’ {aka ‘unsigned char[8]’}
   64 | u16 capi20_get_serial(u32 contr, u8 serial[CAPI_SERIAL_LEN]);
      |                                  ~~~^~~~~~~~~~~~~~~~~~~~~~~

Change the definition to make them match.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/isdn/capi/kcapi.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
index d15347de415a..9de62c3b8bf9 100644
--- a/drivers/isdn/capi/kcapi.c
+++ b/drivers/isdn/capi/kcapi.c
@@ -845,7 +845,7 @@ EXPORT_SYMBOL(capi20_put_message);
  * Return value: CAPI result code
  */
 
-u16 capi20_get_manufacturer(u32 contr, u8 *buf)
+u16 capi20_get_manufacturer(u32 contr, u8 buf[CAPI_MANUFACTURER_LEN])
 {
 	struct capi_ctr *ctr;
 	u16 ret;
@@ -915,7 +915,7 @@ EXPORT_SYMBOL(capi20_get_version);
  * Return value: CAPI result code
  */
 
-u16 capi20_get_serial(u32 contr, u8 *serial)
+u16 capi20_get_serial(u32 contr, u8 serial[CAPI_SERIAL_LEN])
 {
 	struct capi_ctr *ctr;
 	u16 ret;

From 3c8618082ab2d06e1875a6221cba769288c09f74 Mon Sep 17 00:00:00 2001
From: Feilong Lin <linfeilong@huawei.com>
Date: Thu, 25 Mar 2021 15:26:00 +0800
Subject: [PATCH 2078/2658] ACPI / hotplug / PCI: Fix reference count leak in
 enable_slot()

[ Upstream commit 3bbfd319034ddce59e023837a4aa11439460509b ]

In enable_slot(), if pci_get_slot() returns NULL, we clear the SLOT_ENABLED
flag. When pci_get_slot() finds a device, it increments the device's
reference count.  In this case, we did not call pci_dev_put() to decrement
the reference count, so the memory of the device (struct pci_dev type) will
eventually leak.

Call pci_dev_put() to decrement its reference count when pci_get_slot()
returns a PCI device.

Link: https://lore.kernel.org/r/b411af88-5049-a1c6-83ac-d104a1f429be@huawei.com
Signed-off-by: Feilong Lin <linfeilong@huawei.com>
Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/hotplug/acpiphp_glue.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index 6727471ea5b4..d0f5c526c8e6 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -538,6 +538,7 @@ static void enable_slot(struct acpiphp_slot *slot)
 			slot->flags &= (~SLOT_ENABLED);
 			continue;
 		}
+		pci_dev_put(dev);
 	}
 }
 

From 0aff3450bb9479cfa5b93f5c7ab6271df94c09e5 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Fri, 5 Mar 2021 21:43:15 +0100
Subject: [PATCH 2079/2658] um: Mark all kernel symbols as local

[ Upstream commit d5027ca63e0e778b641cf23e3f5c6d6212cf412b ]

Ritesh reported a bug [1] against UML, noting that it crashed on
startup. The backtrace shows the following (heavily redacted):

(gdb) bt
...
 #26 0x0000000060015b5d in sem_init () at ipc/sem.c:268
 #27 0x00007f89906d92f7 in ?? () from /lib/x86_64-linux-gnu/libcom_err.so.2
 #28 0x00007f8990ab8fb2 in call_init (...) at dl-init.c:72
...
 #40 0x00007f89909bf3a6 in nss_load_library (...) at nsswitch.c:359
...
 #44 0x00007f8990895e35 in _nss_compat_getgrnam_r (...) at nss_compat/compat-grp.c:486
 #45 0x00007f8990968b85 in __getgrnam_r [...]
 #46 0x00007f89909d6b77 in grantpt [...]
 #47 0x00007f8990a9394e in __GI_openpty [...]
 #48 0x00000000604a1f65 in openpty_cb (...) at arch/um/os-Linux/sigio.c:407
 #49 0x00000000604a58d0 in start_idle_thread (...) at arch/um/os-Linux/skas/process.c:598
 #50 0x0000000060004a3d in start_uml () at arch/um/kernel/skas/process.c:45
 #51 0x00000000600047b2 in linux_main (...) at arch/um/kernel/um_arch.c:334
 #52 0x000000006000574f in main (...) at arch/um/os-Linux/main.c:144

indicating that the UML function openpty_cb() calls openpty(),
which internally calls __getgrnam_r(), which causes the nsswitch
machinery to get started.

This loads, through lots of indirection that I snipped, the
libcom_err.so.2 library, which (in an unknown function, "??")
calls sem_init().

Now, of course it wants to get libpthread's sem_init(), since
it's linked against libpthread. However, the dynamic linker
looks up that symbol against the binary first, and gets the
kernel's sem_init().

Hajime Tazaki noted that "objcopy -L" can localize a symbol,
so the dynamic linker wouldn't do the lookup this way. I tried,
but for some reason that didn't seem to work.

Doing the same thing in the linker script instead does seem to
work, though I cannot entirely explain - it *also* works if I
just add "VERSION { { global: *; }; }" instead, indicating that
something else is happening that I don't really understand. It
may be that explicitly doing that marks them with some kind of
empty version, and that's different from the default.

Explicitly marking them with a version breaks kallsyms, so that
doesn't seem to be possible.

Marking all the symbols as local seems correct, and does seem
to address the issue, so do that. Also do it for static link,
nsswitch libraries could still be loaded there.

[1] https://bugs.debian.org/983379

Reported-by: Ritesh Raj Sarraf <rrs@debian.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Acked-By: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Tested-By: Ritesh Raj Sarraf <rrs@debian.org>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/um/kernel/dyn.lds.S | 6 ++++++
 arch/um/kernel/uml.lds.S | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/arch/um/kernel/dyn.lds.S b/arch/um/kernel/dyn.lds.S
index adde088aeeff..d837636ec823 100644
--- a/arch/um/kernel/dyn.lds.S
+++ b/arch/um/kernel/dyn.lds.S
@@ -6,6 +6,12 @@ OUTPUT_ARCH(ELF_ARCH)
 ENTRY(_start)
 jiffies = jiffies_64;
 
+VERSION {
+  {
+    local: *;
+  };
+}
+
 SECTIONS
 {
   PROVIDE (__executable_start = START);
diff --git a/arch/um/kernel/uml.lds.S b/arch/um/kernel/uml.lds.S
index 6899195602b7..09620aa953ca 100644
--- a/arch/um/kernel/uml.lds.S
+++ b/arch/um/kernel/uml.lds.S
@@ -6,6 +6,12 @@ OUTPUT_ARCH(ELF_ARCH)
 ENTRY(_start)
 jiffies = jiffies_64;
 
+VERSION {
+  {
+    local: *;
+  };
+}
+
 SECTIONS
 {
   /* This must contain the right address - not quite the default ELF one.*/

From dca95dd076c38340c2fa86538336058b5fa44456 Mon Sep 17 00:00:00 2001
From: Hui Wang <hui.wang@canonical.com>
Date: Tue, 4 May 2021 15:39:17 +0800
Subject: [PATCH 2080/2658] ALSA: hda: generic: change the DAC ctl name for
 LO+SPK or LO+HP

[ Upstream commit f48652bbe3ae62ba2835a396b7e01f063e51c4cd ]

Without this change, the DAC ctl's name could be changed only when
the machine has both Speaker and Headphone, but we met some machines
which only has Lineout and Headhpone, and the Lineout and Headphone
share the Audio Mixer0 and DAC0, the ctl's name is set to "Front".

On most of machines, the "Front" is used for Speaker only or Lineout
only, but on this machine it is shared by Lineout and Headphone,
This introduces an issue in the pipewire and pulseaudio, suppose users
want the Headphone to be on and the Speaker/Lineout to be off, they
could turn off the "Front", this works on most of the machines, but on
this machine, the "Front" couldn't be turned off otherwise the
headphone will be off too. Here we do some change to let the ctl's
name change to "Headphone+LO" on this machine, and pipewire and
pulseaudio already could handle "Headphone+LO" and "Speaker+LO".
(https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/747)

BugLink: http://bugs.launchpad.net/bugs/804178
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Link: https://lore.kernel.org/r/20210504073917.22406-1-hui.wang@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/hda/hda_generic.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index dcefb12557f1..7fed8d1bb79c 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -1182,11 +1182,17 @@ static const char *get_line_out_pfx(struct hda_codec *codec, int ch,
 		*index = ch;
 		return "Headphone";
 	case AUTO_PIN_LINE_OUT:
-		/* This deals with the case where we have two DACs and
-		 * one LO, one HP and one Speaker */
-		if (!ch && cfg->speaker_outs && cfg->hp_outs) {
-			bool hp_lo_shared = !path_has_mixer(codec, spec->hp_paths[0], ctl_type);
-			bool spk_lo_shared = !path_has_mixer(codec, spec->speaker_paths[0], ctl_type);
+		/* This deals with the case where one HP or one Speaker or
+		 * one HP + one Speaker need to share the DAC with LO
+		 */
+		if (!ch) {
+			bool hp_lo_shared = false, spk_lo_shared = false;
+
+			if (cfg->speaker_outs)
+				spk_lo_shared = !path_has_mixer(codec,
+								spec->speaker_paths[0],	ctl_type);
+			if (cfg->hp_outs)
+				hp_lo_shared = !path_has_mixer(codec, spec->hp_paths[0], ctl_type);
 			if (hp_lo_shared && spk_lo_shared)
 				return spec->vmaster_mute.hook ? "PCM" : "Master";
 			if (hp_lo_shared)

From c4e1dc2469bdf1a46d90e957dea2c30a7c8cd88b Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Mon, 29 Mar 2021 12:25:22 -0700
Subject: [PATCH 2081/2658] sit: proper dev_{hold|put} in ndo_[un]init methods

commit 6289a98f0817a4a457750d6345e754838eae9439 upstream.

After adopting CONFIG_PCPU_DEV_REFCNT=n option, syzbot was able to trigger
a warning [1]

Issue here is that:

- all dev_put() should be paired with a corresponding prior dev_hold().

- A driver doing a dev_put() in its ndo_uninit() MUST also
  do a dev_hold() in its ndo_init(), only when ndo_init()
  is returning 0.

Otherwise, register_netdevice() would call ndo_uninit()
in its error path and release a refcount too soon.

Fixes: 919067cc845f ("net: add CONFIG_PCPU_DEV_REFCNT")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/sit.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 1ee190137da4..b1913993b321 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -209,8 +209,6 @@ static int ipip6_tunnel_create(struct net_device *dev)
 
 	dev->rtnl_link_ops = &sit_link_ops;
 
-	dev_hold(dev);
-
 	ipip6_tunnel_link(sitn, t);
 	return 0;
 
@@ -1399,7 +1397,7 @@ static int ipip6_tunnel_init(struct net_device *dev)
 		dev->tstats = NULL;
 		return err;
 	}
-
+	dev_hold(dev);
 	return 0;
 }
 

From dfc7860479204d9fb220ec54df9190bd8610657b Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Mon, 29 Mar 2021 23:45:51 -0700
Subject: [PATCH 2082/2658] ip6_tunnel: sit: proper dev_{hold|put} in
 ndo_[un]init methods

commit 48bb5697269a7cbe5194dbb044dc38c517e34c58 upstream.

Same reasons than for the previous commits :
6289a98f0817 ("sit: proper dev_{hold|put} in ndo_[un]init methods")
40cb881b5aaa ("ip6_vti: proper dev_{hold|put} in ndo_[un]init methods")
7f700334be9a ("ip6_gre: proper dev_{hold|put} in ndo_[un]init methods")

After adopting CONFIG_PCPU_DEV_REFCNT=n option, syzbot was able to trigger
a warning [1]

Issue here is that:

- all dev_put() should be paired with a corresponding prior dev_hold().

- A driver doing a dev_put() in its ndo_uninit() MUST also
  do a dev_hold() in its ndo_init(), only when ndo_init()
  is returning 0.

Otherwise, register_netdevice() would call ndo_uninit()
in its error path and release a refcount too soon.

[1]
WARNING: CPU: 1 PID: 21059 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31
Modules linked in:
CPU: 1 PID: 21059 Comm: syz-executor.4 Not tainted 5.12.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31
Code: 1d 6a 5a e8 09 31 ff 89 de e8 8d 1a ab fd 84 db 75 e0 e8 d4 13 ab fd 48 c7 c7 a0 e1 c1 89 c6 05 4a 5a e8 09 01 e8 2e 36 fb 04 <0f> 0b eb c4 e8 b8 13 ab fd 0f b6 1d 39 5a e8 09 31 ff 89 de e8 58
RSP: 0018:ffffc900025aefe8 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000040000 RSI: ffffffff815c51f5 RDI: fffff520004b5def
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff815bdf8e R11: 0000000000000000 R12: ffff888023488568
R13: ffff8880254e9000 R14: 00000000dfd82cfd R15: ffff88802ee2d7c0
FS:  00007f13bc590700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0943e74000 CR3: 0000000025273000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __refcount_dec include/linux/refcount.h:344 [inline]
 refcount_dec include/linux/refcount.h:359 [inline]
 dev_put include/linux/netdevice.h:4135 [inline]
 ip6_tnl_dev_uninit+0x370/0x3d0 net/ipv6/ip6_tunnel.c:387
 register_netdevice+0xadf/0x1500 net/core/dev.c:10308
 ip6_tnl_create2+0x1b5/0x400 net/ipv6/ip6_tunnel.c:263
 ip6_tnl_newlink+0x312/0x580 net/ipv6/ip6_tunnel.c:2052
 __rtnl_newlink+0x1062/0x1710 net/core/rtnetlink.c:3443
 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3491
 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5553
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502
 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:674
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Fixes: 919067cc845f ("net: add CONFIG_PCPU_DEV_REFCNT")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/ip6_tunnel.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 48a2605bed28..3fcb29d7fd41 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -261,7 +261,6 @@ static int ip6_tnl_create2(struct net_device *dev)
 
 	strcpy(t->parms.name, dev->name);
 
-	dev_hold(dev);
 	ip6_tnl_link(ip6n, t);
 	return 0;
 
@@ -1584,6 +1583,7 @@ ip6_tnl_dev_init_gen(struct net_device *dev)
 		return ret;
 	}
 
+	dev_hold(dev);
 	return 0;
 }
 

From 48f2d15ede7c3264cde6c2fdd201fb45bb967056 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 31 Mar 2021 14:38:11 -0700
Subject: [PATCH 2083/2658] ipv6: remove extra dev_hold() for fallback tunnels

commit 0d7a7b2014b1a499a0fe24c9f3063d7856b5aaaf upstream.

My previous commits added a dev_hold() in tunnels ndo_init(),
but forgot to remove it from special functions setting up fallback tunnels.

Fallback tunnels do call their respective ndo_init()

This leads to various reports like :

unregister_netdevice: waiting for ip6gre0 to become free. Usage count = 2

Fixes: 48bb5697269a ("ip6_tunnel: sit: proper dev_{hold|put} in ndo_[un]init methods")
Fixes: 6289a98f0817 ("sit: proper dev_{hold|put} in ndo_[un]init methods")
Fixes: 40cb881b5aaa ("ip6_vti: proper dev_{hold|put} in ndo_[un]init methods")
Fixes: 7f700334be9a ("ip6_gre: proper dev_{hold|put} in ndo_[un]init methods")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/ip6_gre.c    | 3 ---
 net/ipv6/ip6_tunnel.c | 1 -
 net/ipv6/ip6_vti.c    | 1 -
 net/ipv6/sit.c        | 1 -
 4 files changed, 6 deletions(-)

diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 80e03a50d92d..17eee5083548 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -350,7 +350,6 @@ static struct ip6_tnl *ip6gre_tunnel_locate(struct net *net,
 	if (!(nt->parms.o_flags & GRE_SEQ))
 		dev->features |= NETIF_F_LLTX;
 
-	dev_hold(dev);
 	ip6gre_tunnel_link(ign, nt);
 	return nt;
 
@@ -1314,8 +1313,6 @@ static void ip6gre_fb_tunnel_init(struct net_device *dev)
 	strcpy(tunnel->parms.name, dev->name);
 
 	tunnel->hlen		= sizeof(struct ipv6hdr) + 4;
-
-	dev_hold(dev);
 }
 
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 3fcb29d7fd41..f6f3c64b146a 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1617,7 +1617,6 @@ static int __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
 	t->parms.proto = IPPROTO_IPV6;
-	dev_hold(dev);
 
 	rcu_assign_pointer(ip6n->tnls_wc[0], t);
 	return 0;
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index f5bfdb912d7a..15f6b1ea8cce 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -932,7 +932,6 @@ static int __net_init vti6_fb_tnl_dev_init(struct net_device *dev)
 	struct vti6_net *ip6n = net_generic(net, vti6_net_id);
 
 	t->parms.proto = IPPROTO_IPV6;
-	dev_hold(dev);
 
 	rcu_assign_pointer(ip6n->tnls_wc[0], t);
 	return 0;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index b1913993b321..6a5442fdbd51 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1413,7 +1413,6 @@ static void __net_init ipip6_fb_tunnel_init(struct net_device *dev)
 	iph->ihl		= 5;
 	iph->ttl		= 64;
 
-	dev_hold(dev);
 	rcu_assign_pointer(sitn->tunnels_wc[0], tunnel);
 }
 

From da11544e1f211922376fa08a6dd7897a07ddecc3 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Wed, 12 May 2021 11:08:14 +0300
Subject: [PATCH 2084/2658] xhci: Do not use GFP_KERNEL in (potentially) atomic
 context

commit dda32c00c9a0fa103b5d54ef72c477b7aa993679 upstream.

'xhci_urb_enqueue()' is passed a 'mem_flags' argument, because "URBs may be
submitted in interrupt context" (see comment related to 'usb_submit_urb()'
in 'drivers/usb/core/urb.c')

So this flag should be used in all the calling chain.
Up to now, 'xhci_check_maxpacket()' which is only called from
'xhci_urb_enqueue()', uses GFP_KERNEL.

Be safe and pass the mem_flags to this function as well.

Fixes: ddba5cd0aeff ("xhci: Use command structures when queuing commands on the command ring")
Cc: <stable@vger.kernel.org>
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20210512080816.866037-4-mathias.nyman@linux.intel.com
[iwamatsu: Adjust context]
Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 5ad7e004f861..cada27eb61ce 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1320,7 +1320,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci,
  * we need to issue an evaluate context command and wait on it.
  */
 static int xhci_check_maxpacket(struct xhci_hcd *xhci, unsigned int slot_id,
-		unsigned int ep_index, struct urb *urb)
+		unsigned int ep_index, struct urb *urb, gfp_t mem_flags)
 {
 	struct xhci_container_ctx *out_ctx;
 	struct xhci_input_control_ctx *ctrl_ctx;
@@ -1351,7 +1351,7 @@ static int xhci_check_maxpacket(struct xhci_hcd *xhci, unsigned int slot_id,
 		 * changes max packet sizes.
 		 */
 
-		command = xhci_alloc_command(xhci, false, true, GFP_KERNEL);
+		command = xhci_alloc_command(xhci, false, true, mem_flags);
 		if (!command)
 			return -ENOMEM;
 
@@ -1458,7 +1458,7 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
 		 */
 		if (urb->dev->speed == USB_SPEED_FULL) {
 			ret = xhci_check_maxpacket(xhci, slot_id,
-					ep_index, urb);
+					ep_index, urb, mem_flags);
 			if (ret < 0) {
 				xhci_urb_free_priv(urb_priv);
 				urb->hcpriv = NULL;

From be1fb449a44dbb1cac638e4c7c551c8a09064049 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Fri, 7 May 2021 19:30:41 +0100
Subject: [PATCH 2085/2658] iio: tsl2583: Fix division by a zero lux_val

commit af0e1871d79cfbb91f732d2c6fa7558e45c31038 upstream.

The lux_val returned from tsl2583_get_lux can potentially be zero,
so check for this to avoid a division by zero and an overflowed
gain_trim_val.

Fixes clang scan-build warning:

drivers/iio/light/tsl2583.c:345:40: warning: Either the
condition 'lux_val<0' is redundant or there is division
by zero at line 345. [zerodivcond]

Fixes: ac4f6eee8fe8 ("staging: iio: TAOS tsl258x: Device driver")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
[iwamatsu: Change file path.]
Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/iio/light/tsl2583.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/staging/iio/light/tsl2583.c b/drivers/staging/iio/light/tsl2583.c
index 3100d960fe2c..da2a2ff4cdb9 100644
--- a/drivers/staging/iio/light/tsl2583.c
+++ b/drivers/staging/iio/light/tsl2583.c
@@ -378,6 +378,15 @@ static int taos_als_calibrate(struct iio_dev *indio_dev)
 		dev_err(&chip->client->dev, "taos_als_calibrate failed to get lux\n");
 		return lux_val;
 	}
+
+	/* Avoid division by zero of lux_value later on */
+	if (lux_val == 0) {
+		dev_err(&chip->client->dev,
+			"%s: lux_val of 0 will produce out of range trim_value\n",
+			__func__);
+		return -ENODATA;
+	}
+
 	gain_trim_val = (unsigned int) (((chip->taos_settings.als_cal_target)
 			* chip->taos_settings.als_gain_trim) / lux_val);
 

From 95bb2ae54e779871bbf5edc964067899ac897155 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sat, 22 May 2021 10:38:30 +0200
Subject: [PATCH 2086/2658] Linux 4.4.269

Link: https://lore.kernel.org/r/20210520092102.149300807@linuxfoundation.org
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/20210520152221.547672231@linuxfoundation.org
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 16e023ca3eca..71f55a67e979 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 268
+SUBLEVEL = 269
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From a217356d61b8f97e5d717750614e5895f3b63957 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Fri, 23 Apr 2021 17:09:28 +0200
Subject: [PATCH 2087/2658] openrisc: Fix a memory leak

[ Upstream commit c019d92457826bb7b2091c86f36adb5de08405f9 ]

'setup_find_cpu_node()' take a reference on the node it returns.
This reference must be decremented when not needed anymore, or there will
be a leak.

Add the missing 'of_node_put(cpu)'.

Note that 'setup_cpuinfo()' that also calls this function already has a
correct 'of_node_put(cpu)' at its end.

Fixes: 9d02a4283e9c ("OpenRISC: Boot code")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Stafford Horne <shorne@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/openrisc/kernel/setup.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/openrisc/kernel/setup.c b/arch/openrisc/kernel/setup.c
index b4ed8b36e078..e5f5b69a7b7b 100644
--- a/arch/openrisc/kernel/setup.c
+++ b/arch/openrisc/kernel/setup.c
@@ -278,6 +278,8 @@ void calibrate_delay(void)
 	pr_cont("%lu.%02lu BogoMIPS (lpj=%lu)\n",
 		loops_per_jiffy / (500000 / HZ),
 		(loops_per_jiffy / (5000 / HZ)) % 100, loops_per_jiffy);
+
+	of_node_put(cpu);
 }
 
 void __init setup_arch(char **cmdline_p)

From 3677da7143656bdad82bb166f341080e747c03f6 Mon Sep 17 00:00:00 2001
From: Zhen Lei <thunder.leizhen@huawei.com>
Date: Fri, 14 May 2021 17:09:52 +0800
Subject: [PATCH 2088/2658] scsi: qla2xxx: Fix error return code in
 qla82xx_write_flash_dword()

[ Upstream commit 5cb289bf2d7c34ca1abd794ce116c4f19185a1d4 ]

Fix to return a negative error code from the error handling case instead of
0 as done elsewhere in this function.

Link: https://lore.kernel.org/r/20210514090952.6715-1-thunder.leizhen@huawei.com
Fixes: a9083016a531 ("[SCSI] qla2xxx: Add ISP82XX support.")
Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_nx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c
index 65f8d2d94159..46f7e3988009 100644
--- a/drivers/scsi/qla2xxx/qla_nx.c
+++ b/drivers/scsi/qla2xxx/qla_nx.c
@@ -1103,7 +1103,8 @@ qla82xx_write_flash_dword(struct qla_hw_data *ha, uint32_t flashaddr,
 		return ret;
 	}
 
-	if (qla82xx_flash_set_write_enable(ha))
+	ret = qla82xx_flash_set_write_enable(ha);
+	if (ret < 0)
 		goto done_write;
 
 	qla82xx_wr_32(ha, QLA82XX_ROMUSB_ROM_WDATA, data);

From f843ddd13c2144227474d818c958fff2300ff98a Mon Sep 17 00:00:00 2001
From: Oleg Nesterov <oleg@redhat.com>
Date: Wed, 12 May 2021 15:33:08 +0200
Subject: [PATCH 2089/2658] ptrace: make ptrace() fail if the tracee changed
 its pid unexpectedly

[ Upstream commit dbb5afad100a828c97e012c6106566d99f041db6 ]

Suppose we have 2 threads, the group-leader L and a sub-theread T,
both parked in ptrace_stop(). Debugger tries to resume both threads
and does

	ptrace(PTRACE_CONT, T);
	ptrace(PTRACE_CONT, L);

If the sub-thread T execs in between, the 2nd PTRACE_CONT doesn not
resume the old leader L, it resumes the post-exec thread T which was
actually now stopped in PTHREAD_EVENT_EXEC. In this case the
PTHREAD_EVENT_EXEC event is lost, and the tracer can't know that the
tracee changed its pid.

This patch makes ptrace() fail in this case until debugger does wait()
and consumes PTHREAD_EVENT_EXEC which reports old_pid. This affects all
ptrace requests except the "asynchronous" PTRACE_INTERRUPT/KILL.

The patch doesn't add the new PTRACE_ option to not complicate the API,
and I _hope_ this won't cause any noticeable regression:

	- If debugger uses PTRACE_O_TRACEEXEC and the thread did an exec
	  and the tracer does a ptrace request without having consumed
	  the exec event, it's 100% sure that the thread the ptracer
	  thinks it is targeting does not exist anymore, or isn't the
	  same as the one it thinks it is targeting.

	- To some degree this patch adds nothing new. In the scenario
	  above ptrace(L) can fail with -ESRCH if it is called after the
	  execing sub-thread wakes the leader up and before it "steals"
	  the leader's pid.

Test-case:

	#include <stdio.h>
	#include <unistd.h>
	#include <signal.h>
	#include <sys/ptrace.h>
	#include <sys/wait.h>
	#include <errno.h>
	#include <pthread.h>
	#include <assert.h>

	void *tf(void *arg)
	{
		execve("/usr/bin/true", NULL, NULL);
		assert(0);

		return NULL;
	}

	int main(void)
	{
		int leader = fork();
		if (!leader) {
			kill(getpid(), SIGSTOP);

			pthread_t th;
			pthread_create(&th, NULL, tf, NULL);
			for (;;)
				pause();

			return 0;
		}

		waitpid(leader, NULL, WSTOPPED);

		ptrace(PTRACE_SEIZE, leader, 0,
				PTRACE_O_TRACECLONE | PTRACE_O_TRACEEXEC);
		waitpid(leader, NULL, 0);

		ptrace(PTRACE_CONT, leader, 0,0);
		waitpid(leader, NULL, 0);

		int status, thread = waitpid(-1, &status, 0);
		assert(thread > 0 && thread != leader);
		assert(status == 0x80137f);

		ptrace(PTRACE_CONT, thread, 0,0);
		/*
		 * waitid() because waitpid(leader, &status, WNOWAIT) does not
		 * report status. Why ????
		 *
		 * Why WEXITED? because we have another kernel problem connected
		 * to mt-exec.
		 */
		siginfo_t info;
		assert(waitid(P_PID, leader, &info, WSTOPPED|WEXITED|WNOWAIT) == 0);
		assert(info.si_pid == leader && info.si_status == 0x0405);

		/* OK, it sleeps in ptrace(PTRACE_EVENT_EXEC == 0x04) */
		assert(ptrace(PTRACE_CONT, leader, 0,0) == -1);
		assert(errno == ESRCH);

		assert(leader == waitpid(leader, &status, WNOHANG));
		assert(status == 0x04057f);

		assert(ptrace(PTRACE_CONT, leader, 0,0) == 0);

		return 0;
	}

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reported-by: Simon Marchi <simon.marchi@efficios.com>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Acked-by: Pedro Alves <palves@redhat.com>
Acked-by: Simon Marchi <simon.marchi@efficios.com>
Acked-by: Jan Kratochvil <jan.kratochvil@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/ptrace.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index da8c358930fb..5a1d8cc7ef4e 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -129,6 +129,21 @@ void __ptrace_unlink(struct task_struct *child)
 	spin_unlock(&child->sighand->siglock);
 }
 
+static bool looks_like_a_spurious_pid(struct task_struct *task)
+{
+	if (task->exit_code != ((PTRACE_EVENT_EXEC << 8) | SIGTRAP))
+		return false;
+
+	if (task_pid_vnr(task) == task->ptrace_message)
+		return false;
+	/*
+	 * The tracee changed its pid but the PTRACE_EVENT_EXEC event
+	 * was not wait()'ed, most probably debugger targets the old
+	 * leader which was destroyed in de_thread().
+	 */
+	return true;
+}
+
 /* Ensure that nothing can wake it up, even SIGKILL */
 static bool ptrace_freeze_traced(struct task_struct *task)
 {
@@ -139,7 +154,8 @@ static bool ptrace_freeze_traced(struct task_struct *task)
 		return ret;
 
 	spin_lock_irq(&task->sighand->siglock);
-	if (task_is_traced(task) && !__fatal_signal_pending(task)) {
+	if (task_is_traced(task) && !looks_like_a_spurious_pid(task) &&
+	    !__fatal_signal_pending(task)) {
 		task->state = __TASK_TRACED;
 		ret = true;
 	}

From b6b43054e646dac8f8c652dabd9008e53f5d662f Mon Sep 17 00:00:00 2001
From: Ronnie Sahlberg <lsahlber@redhat.com>
Date: Wed, 19 May 2021 08:40:11 +1000
Subject: [PATCH 2090/2658] cifs: fix memory leak in smb2_copychunk_range

commit d201d7631ca170b038e7f8921120d05eec70d7c5 upstream.

When using smb2_copychunk_range() for large ranges we will
run through several iterations of a loop calling SMB2_ioctl()
but never actually free the returned buffer except for the final
iteration.
This leads to memory leaks everytime a large copychunk is requested.

Fixes: 9bf0c9cd4314 ("CIFS: Fix SMB2/SMB3 Copy offload support (refcopy) for large files")
Cc: <stable@vger.kernel.org>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/smb2ops.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 087261ca6d46..c173d047b44b 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -619,6 +619,8 @@ smb2_clone_range(const unsigned int xid,
 			cpu_to_le32(min_t(u32, len, tcon->max_bytes_chunk));
 
 		/* Request server copy to target from src identified by key */
+		kfree(retbuf);
+		retbuf = NULL;
 		rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid,
 			trgtfile->fid.volatile_fid, FSCTL_SRV_COPYCHUNK_WRITE,
 			true /* is_fsctl */, (char *)pcchunk,

From 73a9cb6cd3becaddcb3b3c205e86ee0f65fdfdb0 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Mon, 10 May 2021 17:06:59 +0200
Subject: [PATCH 2091/2658] ALSA: usb-audio: Validate MS endpoint descriptors

commit e84749a78dc82bc545f12ce009e3dbcc2c5a8a91 upstream.

snd_usbmidi_get_ms_info() may access beyond the border when a
malformed descriptor is passed.  This patch adds the sanity checks of
the given MS endpoint descriptors, and skips invalid ones.

Reported-by: syzbot+6bb23a5d5548b93c94aa@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210510150659.17710-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/midi.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/usb/midi.c b/sound/usb/midi.c
index df6fde6fd2b6..2b8c56c6f2b7 100644
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -1865,8 +1865,12 @@ static int snd_usbmidi_get_ms_info(struct snd_usb_midi *umidi,
 		ms_ep = find_usb_ms_endpoint_descriptor(hostep);
 		if (!ms_ep)
 			continue;
+		if (ms_ep->bLength <= sizeof(*ms_ep))
+			continue;
 		if (ms_ep->bNumEmbMIDIJack > 0x10)
 			continue;
+		if (ms_ep->bLength < sizeof(*ms_ep) + ms_ep->bNumEmbMIDIJack)
+			continue;
 		if (usb_endpoint_dir_out(ep)) {
 			if (endpoints[epidx].out_ep) {
 				if (++epidx >= MIDI_MAX_ENDPOINTS) {

From ac65e3fd2855cd0bad28806e3144313f8b3fec90 Mon Sep 17 00:00:00 2001
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Date: Thu, 13 May 2021 21:56:49 +0900
Subject: [PATCH 2092/2658] ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2
 Pro

commit 0edabdfe89581669609eaac5f6a8d0ae6fe95e7f upstream.

Mackie d.2 has an extension card for IEEE 1394 communication, which uses
BridgeCo DM1000 ASIC. On the other hand, Mackie d.4 Pro has built-in
function for IEEE 1394 communication by Oxford Semiconductor OXFW971,
according to schematic diagram available in Mackie website. Although I
misunderstood that Mackie d.2 Pro would be also a model with OXFW971,
it's wrong. Mackie d.2 Pro is a model which includes the extension card
as factory settings.

This commit fixes entries in Kconfig and comment in ALSA OXFW driver.

Cc: <stable@vger.kernel.org>
Fixes: fd6f4b0dc167 ("ALSA: bebob: Add skelton for BeBoB based devices")
Fixes: ec4dba5053e1 ("ALSA: oxfw: Add support for Behringer/Mackie devices")
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20210513125652.110249-3-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/firewire/Kconfig       | 4 ++--
 sound/firewire/bebob/bebob.c | 2 +-
 sound/firewire/oxfw/oxfw.c   | 1 -
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig
index e92a6d949847..fdc01466d143 100644
--- a/sound/firewire/Kconfig
+++ b/sound/firewire/Kconfig
@@ -36,7 +36,7 @@ config SND_OXFW
 	   * Mackie(Loud) Onyx-i series (former models)
 	   * Mackie(Loud) Onyx Satellite
 	   * Mackie(Loud) Tapco Link.Firewire
-	   * Mackie(Loud) d.2 pro/d.4 pro
+	   * Mackie(Loud) d.4 pro
 	   * Mackie(Loud) U.420/U.420d
 	   * TASCAM FireOne
 
@@ -91,7 +91,7 @@ config SND_BEBOB
 	  * PreSonus FIREBOX/FIREPOD/FP10/Inspire1394
 	  * BridgeCo RDAudio1/Audio5
 	  * Mackie Onyx 1220/1620/1640 (FireWire I/O Card)
-	  * Mackie d.2 (FireWire Option)
+	  * Mackie d.2 (FireWire Option) and d.2 Pro
 	  * Stanton FinalScratch 2 (ScratchAmp)
 	  * Tascam IF-FW/DM
 	  * Behringer XENIX UFX 1204/1604
diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c
index 3a0361458597..088250ff2429 100644
--- a/sound/firewire/bebob/bebob.c
+++ b/sound/firewire/bebob/bebob.c
@@ -362,7 +362,7 @@ static const struct ieee1394_device_id bebob_id_table[] = {
 	SND_BEBOB_DEV_ENTRY(VEN_BRIDGECO, 0x00010049, &spec_normal),
 	/* Mackie, Onyx 1220/1620/1640 (Firewire I/O Card) */
 	SND_BEBOB_DEV_ENTRY(VEN_MACKIE2, 0x00010065, &spec_normal),
-	/* Mackie, d.2 (Firewire Option) */
+	// Mackie, d.2 (Firewire option card) and d.2 Pro (the card is built-in).
 	SND_BEBOB_DEV_ENTRY(VEN_MACKIE1, 0x00010067, &spec_normal),
 	/* Stanton, ScratchAmp */
 	SND_BEBOB_DEV_ENTRY(VEN_STANTON, 0x00000001, &spec_normal),
diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c
index 588b93f20c2e..2d310bf2f2b2 100644
--- a/sound/firewire/oxfw/oxfw.c
+++ b/sound/firewire/oxfw/oxfw.c
@@ -320,7 +320,6 @@ static const struct ieee1394_device_id oxfw_id_table[] = {
 	 *  Onyx-i series (former models):	0x081216
 	 *  Mackie Onyx Satellite:		0x00200f
 	 *  Tapco LINK.firewire 4x6:		0x000460
-	 *  d.2 pro:				Unknown
 	 *  d.4 pro:				Unknown
 	 *  U.420:				Unknown
 	 *  U.420d:				Unknown

From e11633a66d6d24fdc158060b95bd2cbd727e70d6 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 3 May 2021 13:57:01 +0200
Subject: [PATCH 2093/2658] Revert "ALSA: sb8: add a check for request_region"

commit 94f88309f201821073f57ae6005caefa61bf7b7e upstream.

This reverts commit dcd0feac9bab901d5739de51b3f69840851f8919.

Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.

Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted.  It will be fixed up "correctly" in a
later kernel change.

The original commit message for this change was incorrect as the code
path can never result in a NULL dereference, alluding to the fact that
whatever tool was used to "find this" is broken.  It's just an optional
resource reservation, so removing this check is fine.

Cc: Kangjie Lu <kjlu@umn.edu>
Acked-by: Takashi Iwai <tiwai@suse.de>
Fixes: dcd0feac9bab ("ALSA: sb8: add a check for request_region")
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210503115736.2104747-35-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/isa/sb/sb8.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c
index 0c7fe1418447..b8e2391c33ff 100644
--- a/sound/isa/sb/sb8.c
+++ b/sound/isa/sb/sb8.c
@@ -111,10 +111,6 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev)
 
 	/* block the 0x388 port to avoid PnP conflicts */
 	acard->fm_res = request_region(0x388, 4, "SoundBlaster FM");
-	if (!acard->fm_res) {
-		err = -EBUSY;
-		goto _err;
-	}
 
 	if (port[dev] != SNDRV_AUTO_PORT) {
 		if ((err = snd_sbdsp_create(card, port[dev], irq[dev],

From 20fc253ecf697b8793a0ac642827d0f83b0f7c81 Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Tue, 18 May 2021 18:14:07 +0200
Subject: [PATCH 2094/2658] xen-pciback: reconfigure also from backend watch
 handler

commit c81d3d24602540f65256f98831d0a25599ea6b87 upstream.

When multiple PCI devices get assigned to a guest right at boot, libxl
incrementally populates the backend tree. The writes for the first of
the devices trigger the backend watch. In turn xen_pcibk_setup_backend()
will set the XenBus state to Initialised, at which point no further
reconfigures would happen unless a device got hotplugged. Arrange for
reconfigure to also get triggered from the backend watch handler.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Cc: stable@vger.kernel.org
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Link: https://lore.kernel.org/r/2337cbd6-94b9-4187-9862-c03ea12e0c61@suse.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/xen-pciback/xenbus.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c
index 12497a2140c2..c784a01aa8cb 100644
--- a/drivers/xen/xen-pciback/xenbus.c
+++ b/drivers/xen/xen-pciback/xenbus.c
@@ -359,7 +359,8 @@ static int xen_pcibk_publish_pci_root(struct xen_pcibk_device *pdev,
 	return err;
 }
 
-static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev)
+static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev,
+				 enum xenbus_state state)
 {
 	int err = 0;
 	int num_devs;
@@ -373,9 +374,7 @@ static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev)
 	dev_dbg(&pdev->xdev->dev, "Reconfiguring device ...\n");
 
 	mutex_lock(&pdev->dev_lock);
-	/* Make sure we only reconfigure once */
-	if (xenbus_read_driver_state(pdev->xdev->nodename) !=
-	    XenbusStateReconfiguring)
+	if (xenbus_read_driver_state(pdev->xdev->nodename) != state)
 		goto out;
 
 	err = xenbus_scanf(XBT_NIL, pdev->xdev->nodename, "num_devs", "%d",
@@ -502,6 +501,10 @@ static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev)
 		}
 	}
 
+	if (state != XenbusStateReconfiguring)
+		/* Make sure we only reconfigure once. */
+		goto out;
+
 	err = xenbus_switch_state(pdev->xdev, XenbusStateReconfigured);
 	if (err) {
 		xenbus_dev_fatal(pdev->xdev, err,
@@ -527,7 +530,7 @@ static void xen_pcibk_frontend_changed(struct xenbus_device *xdev,
 		break;
 
 	case XenbusStateReconfiguring:
-		xen_pcibk_reconfigure(pdev);
+		xen_pcibk_reconfigure(pdev, XenbusStateReconfiguring);
 		break;
 
 	case XenbusStateConnected:
@@ -666,6 +669,15 @@ static void xen_pcibk_be_watch(struct xenbus_watch *watch,
 		xen_pcibk_setup_backend(pdev);
 		break;
 
+	case XenbusStateInitialised:
+		/*
+		 * We typically move to Initialised when the first device was
+		 * added. Hence subsequent devices getting added may need
+		 * reconfiguring.
+		 */
+		xen_pcibk_reconfigure(pdev, XenbusStateInitialised);
+		break;
+
 	default:
 		break;
 	}

From 84631a03382757afc66b5323122bbc711d7f4802 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Mon, 10 May 2021 14:49:05 -0400
Subject: [PATCH 2095/2658] dm snapshot: fix crash with transient storage and
 zero chunk size

commit c699a0db2d62e3bbb7f0bf35c87edbc8d23e3062 upstream.

The following commands will crash the kernel:

modprobe brd rd_size=1048576
dmsetup create o --table "0 `blockdev --getsize /dev/ram0` snapshot-origin /dev/ram0"
dmsetup create s --table "0 `blockdev --getsize /dev/ram0` snapshot /dev/ram0 /dev/ram1 N 0"

The reason is that when we test for zero chunk size, we jump to the label
bad_read_metadata without setting the "r" variable. The function
snapshot_ctr destroys all the structures and then exits with "r == 0". The
kernel then crashes because it falsely believes that snapshot_ctr
succeeded.

In order to fix the bug, we set the variable "r" to -EINVAL.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-snap.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index 55e158553700..e6f4a0d972a5 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -1264,6 +1264,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 
 	if (!s->store->chunk_size) {
 		ti->error = "Chunk size not set";
+		r = -EINVAL;
 		goto bad_read_metadata;
 	}
 

From c5bf5aa0fd2554ce093308487ef7f259c8989d1a Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 3 May 2021 13:57:05 +0200
Subject: [PATCH 2096/2658] Revert "video: hgafb: fix potential NULL pointer
 dereference"

commit 58c0cc2d90f1e37c4eb63ae7f164c83830833f78 upstream.

This reverts commit ec7f6aad57ad29e4e66cc2e18e1e1599ddb02542.

Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.

Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted.  It will be fixed up "correctly" in a
later kernel change.

This patch "looks" correct, but the driver keeps on running and will
fail horribly right afterward if this error condition ever trips.

So points for trying to resolve an issue, but a huge NEGATIVE value for
providing a "fake" fix for the problem as nothing actually got resolved
at all.  I'll go fix this up properly...

Cc: Kangjie Lu <kjlu@umn.edu>
Cc: Aditya Pakki <pakki001@umn.edu>
Cc: Ferenc Bakonyi <fero@drama.obuda.kando.hu>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Fixes: ec7f6aad57ad ("video: hgafb: fix potential NULL pointer dereference")
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210503115736.2104747-39-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/fbdev/hgafb.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/video/fbdev/hgafb.c b/drivers/video/fbdev/hgafb.c
index 4a397c7c1b56..15d3ccff2965 100644
--- a/drivers/video/fbdev/hgafb.c
+++ b/drivers/video/fbdev/hgafb.c
@@ -285,8 +285,6 @@ static int hga_card_detect(void)
 	hga_vram_len  = 0x08000;
 
 	hga_vram = ioremap(0xb0000, hga_vram_len);
-	if (!hga_vram)
-		goto error;
 
 	if (request_region(0x3b0, 12, "hgafb"))
 		release_io_ports = 1;

From 036422047b5ef409be47a9ec2008ef5acd7046ab Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 3 May 2021 13:56:47 +0200
Subject: [PATCH 2097/2658] Revert "net: stmicro: fix a missing check of
 clk_prepare"

commit bee1b0511844c8c79fccf1f2b13472393b6b91f7 upstream.

This reverts commit f86a3b83833e7cfe558ca4d70b64ebc48903efec.

Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.

Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted.  It will be fixed up "correctly" in a
later kernel change.

The original commit causes a memory leak when it is trying to claim it
is properly handling errors.  Revert this change and fix it up properly
in a follow-on commit.

Cc: Kangjie Lu <kjlu@umn.edu>
Cc: David S. Miller <davem@davemloft.net>
Fixes: f86a3b83833e ("net: stmicro: fix a missing check of clk_prepare")
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210503115736.2104747-21-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
index 31ab5e749e66..92e9d8c74e02 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
@@ -59,9 +59,7 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv)
 		gmac->clk_enabled = 1;
 	} else {
 		clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE);
-		ret = clk_prepare(gmac->tx_clk);
-		if (ret)
-			return ret;
+		clk_prepare(gmac->tx_clk);
 	}
 
 	return 0;

From 4db22add8643c82acf9b4ab2a7e559da4997e1c0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 3 May 2021 13:56:35 +0200
Subject: [PATCH 2098/2658] Revert "leds: lp5523: fix a missing check of return
 value of lp55xx_read"

commit 8d1beda5f11953ffe135a5213287f0b25b4da41b upstream.

This reverts commit 248b57015f35c94d4eae2fdd8c6febf5cd703900.

Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.

Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted.  It will be fixed up "correctly" in a
later kernel change.

The original commit does not properly unwind if there is an error
condition so it needs to be reverted at this point in time.

Cc: Kangjie Lu <kjlu@umn.edu>
Cc: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Cc: stable <stable@vger.kernel.org>
Fixes: 248b57015f35 ("leds: lp5523: fix a missing check of return value of lp55xx_read")
Link: https://lore.kernel.org/r/20210503115736.2104747-9-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/leds/leds-lp5523.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c
index d12370352ae3..1d0187f42941 100644
--- a/drivers/leds/leds-lp5523.c
+++ b/drivers/leds/leds-lp5523.c
@@ -318,9 +318,7 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip)
 
 	/* Let the programs run for couple of ms and check the engine status */
 	usleep_range(3000, 6000);
-	ret = lp55xx_read(chip, LP5523_REG_STATUS, &status);
-	if (ret)
-		return ret;
+	lp55xx_read(chip, LP5523_REG_STATUS, &status);
 	status &= LP5523_ENG_STATUS_MASK;
 
 	if (status != LP5523_ENG_STATUS_MASK) {

From 13e94857bbf18e0bd141322fa6ebd562f8b5b045 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 3 May 2021 13:56:31 +0200
Subject: [PATCH 2099/2658] Revert "hwmon: (lm80) fix a missing check of bus
 read in lm80 probe"

commit 99ae3417672a6d4a3bf68d4fc43d7c6ca074d477 upstream.

This reverts commit 9aa3aa15f4c2f74f47afd6c5db4b420fadf3f315.

Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.

Upon review, it was determined that this commit is not needed at all so
just revert it.  Also, the call to lm80_init_client() was not properly
handled, so if error handling is needed in the lm80_probe() function,
then it should be done properly, not half-baked like the commit being
reverted here did.

Cc: Kangjie Lu <kjlu@umn.edu>
Fixes: 9aa3aa15f4c2 ("hwmon: (lm80) fix a missing check of bus read in lm80 probe")
Cc: stable <stable@vger.kernel.org>
Acked-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20210503115736.2104747-5-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hwmon/lm80.c | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c
index be60bd5bab78..ee6d499edc1b 100644
--- a/drivers/hwmon/lm80.c
+++ b/drivers/hwmon/lm80.c
@@ -630,7 +630,6 @@ static int lm80_probe(struct i2c_client *client,
 	struct device *dev = &client->dev;
 	struct device *hwmon_dev;
 	struct lm80_data *data;
-	int rv;
 
 	data = devm_kzalloc(dev, sizeof(struct lm80_data), GFP_KERNEL);
 	if (!data)
@@ -643,14 +642,8 @@ static int lm80_probe(struct i2c_client *client,
 	lm80_init_client(client);
 
 	/* A few vars need to be filled upon startup */
-	rv = lm80_read_value(client, LM80_REG_FAN_MIN(1));
-	if (rv < 0)
-		return rv;
-	data->fan[f_min][0] = rv;
-	rv = lm80_read_value(client, LM80_REG_FAN_MIN(2));
-	if (rv < 0)
-		return rv;
-	data->fan[f_min][1] = rv;
+	data->fan[f_min][0] = lm80_read_value(client, LM80_REG_FAN_MIN(1));
+	data->fan[f_min][1] = lm80_read_value(client, LM80_REG_FAN_MIN(2));
 
 	hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name,
 							   data, lm80_groups);

From 2fcff3ea4ded5b7873ced08490a6756ef9498afc Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 3 May 2021 13:57:33 +0200
Subject: [PATCH 2100/2658] Revert "video: imsttfb: fix potential NULL pointer
 dereferences"

commit ed04fe8a0e87d7b5ea17d47f4ac9ec962b24814a upstream.

This reverts commit 1d84353d205a953e2381044953b7fa31c8c9702d.

Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.

Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted.  It will be fixed up "correctly" in a
later kernel change.

The original commit here, while technically correct, did not fully
handle all of the reported issues that the commit stated it was fixing,
so revert it until it can be "fixed" fully.

Note, ioremap() probably will never fail for old hardware like this, and
if anyone actually used this hardware (a PowerMac era PCI display card),
they would not be using fbdev anymore.

Cc: Kangjie Lu <kjlu@umn.edu>
Cc: Aditya Pakki <pakki001@umn.edu>
Cc: Finn Thain <fthain@telegraphics.com.au>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Fixes: 1d84353d205a ("video: imsttfb: fix potential NULL pointer dereferences")
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210503115736.2104747-67-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/fbdev/imsttfb.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c
index 4994a540f680..9b167f7ef6c6 100644
--- a/drivers/video/fbdev/imsttfb.c
+++ b/drivers/video/fbdev/imsttfb.c
@@ -1517,11 +1517,6 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	info->fix.smem_start = addr;
 	info->screen_base = (__u8 *)ioremap(addr, par->ramdac == IBM ?
 					    0x400000 : 0x800000);
-	if (!info->screen_base) {
-		release_mem_region(addr, size);
-		framebuffer_release(info);
-		return -ENOMEM;
-	}
 	info->fix.mmio_start = addr + 0x800000;
 	par->dc_regs = ioremap(addr + 0x800000, 0x1000);
 	par->cmap_regs_phys = addr + 0x840000;

From c7d9b2ae6218cdb8bbcd0780ddf143dc27fa99d7 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 3 May 2021 13:57:15 +0200
Subject: [PATCH 2101/2658] Revert "ecryptfs: replace BUG_ON with error
 handling code"

commit e1436df2f2550bc89d832ffd456373fdf5d5b5d7 upstream.

This reverts commit 2c2a7552dd6465e8fde6bc9cccf8d66ed1c1eb72.

Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.

Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted.  It will be fixed up "correctly" in a
later kernel change.

The original commit log for this change was incorrect, no "error
handling code" was added, things will blow up just as badly as before if
any of these cases ever were true.  As this BUG_ON() never fired, and
most of these checks are "obviously" never going to be true, let's just
revert to the original code for now until this gets unwound to be done
correctly in the future.

Cc: Aditya Pakki <pakki001@umn.edu>
Fixes: 2c2a7552dd64 ("ecryptfs: replace BUG_ON with error handling code")
Cc: stable <stable@vger.kernel.org>
Acked-by: Tyler Hicks <code@tyhicks.com>
Link: https://lore.kernel.org/r/20210503115736.2104747-49-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ecryptfs/crypto.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index b57f4e0f918f..2187f9928f72 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -347,10 +347,8 @@ static int crypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat,
 	struct extent_crypt_result ecr;
 	int rc = 0;
 
-	if (!crypt_stat || !crypt_stat->tfm
-	       || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED))
-		return -EINVAL;
-
+	BUG_ON(!crypt_stat || !crypt_stat->tfm
+	       || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED));
 	if (unlikely(ecryptfs_verbosity > 0)) {
 		ecryptfs_printk(KERN_DEBUG, "Key size [%zd]; key:\n",
 				ecryptfs_get_key_size_to_enc_data(crypt_stat));

From 101584b8dcfa15ed38ce5d9f5f9867f597f5ad2a Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 3 May 2021 13:56:53 +0200
Subject: [PATCH 2102/2658] Revert "gdrom: fix a memory leak bug"

commit 257343d3ed557f11d580d0b7c515dc154f64a42b upstream.

This reverts commit 093c48213ee37c3c3ff1cf5ac1aa2a9d8bc66017.

Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.

Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted.  It will be fixed up "correctly" in a
later kernel change.

Because of this, all submissions from this group must be reverted from
the kernel tree and will need to be re-reviewed again to determine if
they actually are a valid fix.  Until that work is complete, remove this
change to ensure that no problems are being introduced into the
codebase.

Cc: Wenwen Wang <wang6495@umn.edu>
Cc: Peter Rosin <peda@axentia.se>
Cc: Jens Axboe <axboe@kernel.dk>
Fixes: 093c48213ee3 ("gdrom: fix a memory leak bug")
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210503115736.2104747-27-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/cdrom/gdrom.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c
index 1852d19d0d7b..e2808fefbb78 100644
--- a/drivers/cdrom/gdrom.c
+++ b/drivers/cdrom/gdrom.c
@@ -882,7 +882,6 @@ static void __exit exit_gdrom(void)
 	platform_device_unregister(pd);
 	platform_driver_unregister(&gdrom_driver);
 	kfree(gd.toc);
-	kfree(gd.cd_info);
 }
 
 module_init(init_gdrom);

From 8eafe6d37773b53281f3d296ec5552b815771d51 Mon Sep 17 00:00:00 2001
From: Atul Gopinathan <atulgopinathan@gmail.com>
Date: Mon, 3 May 2021 13:56:54 +0200
Subject: [PATCH 2103/2658] cdrom: gdrom: deallocate struct gdrom_unit fields
 in remove_gdrom

commit d03d1021da6fe7f46efe9f2a7335564e7c9db5ab upstream.

The fields, "toc" and "cd_info", of "struct gdrom_unit gd" are allocated
in "probe_gdrom()". Prevent a memory leak by making sure "gd.cd_info" is
deallocated in the "remove_gdrom()" function.

Also prevent double free of the field "gd.toc" by moving it from the
module's exit function to "remove_gdrom()". This is because, in
"probe_gdrom()", the function makes sure to deallocate "gd.toc" in case
of any errors, so the exit function invoked later would again free
"gd.toc".

The patch also maintains consistency by deallocating the above mentioned
fields in "remove_gdrom()" along with another memory allocated field
"gd.disk".

Suggested-by: Jens Axboe <axboe@kernel.dk>
Cc: Peter Rosin <peda@axentia.se>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Atul Gopinathan <atulgopinathan@gmail.com>
Link: https://lore.kernel.org/r/20210503115736.2104747-28-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/cdrom/gdrom.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c
index e2808fefbb78..9951b644cc77 100644
--- a/drivers/cdrom/gdrom.c
+++ b/drivers/cdrom/gdrom.c
@@ -850,6 +850,8 @@ static int remove_gdrom(struct platform_device *devptr)
 	if (gdrom_major)
 		unregister_blkdev(gdrom_major, GDROM_DEV_NAME);
 	unregister_cdrom(gd.cd_info);
+	kfree(gd.cd_info);
+	kfree(gd.toc);
 
 	return 0;
 }
@@ -881,7 +883,6 @@ static void __exit exit_gdrom(void)
 {
 	platform_device_unregister(pd);
 	platform_driver_unregister(&gdrom_driver);
-	kfree(gd.toc);
 }
 
 module_init(init_gdrom);

From 69485ce1cde417ecbbb7a9e464259a3b4495e4ac Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 6 May 2021 16:00:47 +0200
Subject: [PATCH 2104/2658] cdrom: gdrom: initialize global variable at init
 time

commit 9183f01b5e6e32eb3f17b5f3f8d5ad5ac9786c49 upstream.

As Peter points out, if we were to disconnect and then reconnect this
driver from a device, the "global" state of the device would contain odd
values and could cause problems.  Fix this up by just initializing the
whole thing to 0 at probe() time.

Ideally this would be a per-device variable, but given the age and the
total lack of users of it, that would require a lot of s/./->/g changes
for really no good reason.

Reported-by: Peter Rosin <peda@axentia.se>
Cc: Jens Axboe <axboe@kernel.dk>
Reviewed-by: Peter Rosin <peda@axentia.se>
Link: https://lore.kernel.org/r/YJP2j6AU82MqEY2M@kroah.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/cdrom/gdrom.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c
index 9951b644cc77..86110a2abf0f 100644
--- a/drivers/cdrom/gdrom.c
+++ b/drivers/cdrom/gdrom.c
@@ -773,6 +773,13 @@ static int probe_gdrom_setupqueue(void)
 static int probe_gdrom(struct platform_device *devptr)
 {
 	int err;
+
+	/*
+	 * Ensure our "one" device is initialized properly in case of previous
+	 * usages of it
+	 */
+	memset(&gd, 0, sizeof(gd));
+
 	/* Start the device */
 	if (gdrom_execute_diagnostic() != 1) {
 		pr_warning("ATA Probe for GDROM failed\n");
@@ -867,7 +874,7 @@ static struct platform_driver gdrom_driver = {
 static int __init init_gdrom(void)
 {
 	int rc;
-	gd.toc = NULL;
+
 	rc = platform_driver_register(&gdrom_driver);
 	if (rc)
 		return rc;

From fbee8429f4f74523aa2fe0085b45619e335c4451 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 3 May 2021 13:56:39 +0200
Subject: [PATCH 2105/2658] Revert "rtlwifi: fix a potential NULL pointer
 dereference"

commit 68c5634c4a7278672a3bed00eb5646884257c413 upstream.

This reverts commit 765976285a8c8db3f0eb7f033829a899d0c2786e.

Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.

Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted.  It will be fixed up "correctly" in a
later kernel change.

This commit is not correct, it should not have used unlikely() and is
not propagating the error properly to the calling function, so it should
be reverted at this point in time.  Also, if the check failed, the
work queue was still assumed to be allocated, so further accesses would
have continued to fail, meaning this patch does nothing to solve the
root issues at all.

Cc: Kangjie Lu <kjlu@umn.edu>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: Bryan Brattlof <hello@bryanbrattlof.com>
Fixes: 765976285a8c ("rtlwifi: fix a potential NULL pointer dereference")
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210503115736.2104747-13-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/realtek/rtlwifi/base.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
index 5013d8c1d4a6..aab752328c26 100644
--- a/drivers/net/wireless/realtek/rtlwifi/base.c
+++ b/drivers/net/wireless/realtek/rtlwifi/base.c
@@ -466,11 +466,6 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
 	/* <2> work queue */
 	rtlpriv->works.hw = hw;
 	rtlpriv->works.rtl_wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name);
-	if (unlikely(!rtlpriv->works.rtl_wq)) {
-		pr_err("Failed to allocate work queue\n");
-		return;
-	}
-
 	INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq,
 			  (void *)rtl_watchdog_wq_callback);
 	INIT_DELAYED_WORK(&rtlpriv->works.ips_nic_off_wq,

From 069c7f4d36c02715cbda96674b9eb9266575cccd Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 3 May 2021 13:56:51 +0200
Subject: [PATCH 2106/2658] Revert "qlcnic: Avoid potential NULL pointer
 dereference"

commit b95b57dfe7a142bf2446548eb7f49340fd73e78b upstream.

This reverts commit 5bf7295fe34a5251b1d241b9736af4697b590670.

Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.

Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted.  It will be fixed up "correctly" in a
later kernel change.

This commit does not properly detect if an error happens because the
logic after this loop will not detect that there was a failed
allocation.

Cc: Aditya Pakki <pakki001@umn.edu>
Cc: David S. Miller <davem@davemloft.net>
Fixes: 5bf7295fe34a ("qlcnic: Avoid potential NULL pointer dereference")
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210503115736.2104747-25-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index 63ebc491057b..0a2318cad34d 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -1038,8 +1038,6 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode)
 
 	for (i = 0; i < QLCNIC_NUM_ILB_PKT; i++) {
 		skb = netdev_alloc_skb(adapter->netdev, QLCNIC_ILB_PKT_SIZE);
-		if (!skb)
-			break;
 		qlcnic_create_loopback_buff(skb->data, adapter->mac_addr);
 		skb_put(skb, QLCNIC_ILB_PKT_SIZE);
 		adapter->ahw->diag_cnt = 0;

From 9b18da453438475662b1636efa562caa97e16085 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 3 May 2021 13:56:49 +0200
Subject: [PATCH 2107/2658] Revert "niu: fix missing checks of
 niu_pci_eeprom_read"

commit 7930742d6a0ff091c85b92ef4e076432d8d8cb79 upstream.

This reverts commit 26fd962bde0b15e54234fe762d86bc0349df1de4.

Because of recent interactions with developers from @umn.edu, all
commits from them have been recently re-reviewed to ensure if they were
correct or not.

Upon review, this commit was found to be incorrect for the reasons
below, so it must be reverted.  It will be fixed up "correctly" in a
later kernel change.

The change here was incorrect.  While it is nice to check if
niu_pci_eeprom_read() succeeded or not when using the data, any error
that might have happened was not propagated upwards properly, causing
the kernel to assume that these reads were successful, which results in
invalid data in the buffer that was to contain the successfully read
data.

Cc: Kangjie Lu <kjlu@umn.edu>
Cc: Shannon Nelson <shannon.lee.nelson@gmail.com>
Cc: David S. Miller <davem@davemloft.net>
Fixes: 26fd962bde0b ("niu: fix missing checks of niu_pci_eeprom_read")
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210503115736.2104747-23-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/sun/niu.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index cc3b025ab7a7..bd3c047c9fa7 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -8119,8 +8119,6 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end)
 		start += 3;
 
 		prop_len = niu_pci_eeprom_read(np, start + 4);
-		if (prop_len < 0)
-			return prop_len;
 		err = niu_pci_vpd_get_propname(np, start + 5, namebuf, 64);
 		if (err < 0)
 			return err;
@@ -8165,12 +8163,8 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end)
 			netif_printk(np, probe, KERN_DEBUG, np->dev,
 				     "VPD_SCAN: Reading in property [%s] len[%d]\n",
 				     namebuf, prop_len);
-			for (i = 0; i < prop_len; i++) {
-				err = niu_pci_eeprom_read(np, off + i);
-				if (err >= 0)
-					*prop_buf = err;
-				++prop_buf;
-			}
+			for (i = 0; i < prop_len; i++)
+				*prop_buf++ = niu_pci_eeprom_read(np, off + i);
 		}
 
 		start += len;

From e180d06f2c31b6d8b541d39d98a93897068d1c2a Mon Sep 17 00:00:00 2001
From: Du Cheng <ducheng2@gmail.com>
Date: Mon, 3 May 2021 13:56:50 +0200
Subject: [PATCH 2108/2658] ethernet: sun: niu: fix missing checks of
 niu_pci_eeprom_read()

commit e6e337708c22f80824b82d4af645f20715730ad0 upstream.

niu_pci_eeprom_read() may fail, so add checks to its return value and
propagate the error up the callstack.

An examination of the callstack up to niu_pci_eeprom_read shows that:

niu_pci_eeprom_read() // returns int
    niu_pci_vpd_scan_props() // returns int
        niu_pci_vpd_fetch() // returns *void*
            niu_get_invariants() // returns int

since niu_pci_vpd_fetch() returns void which breaks the bubbling up,
change its return type to int so that error is propagated upwards.

Signed-off-by: Du Cheng <ducheng2@gmail.com>
Cc: Shannon Nelson <shannon.lee.nelson@gmail.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210503115736.2104747-24-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/sun/niu.c | 34 ++++++++++++++++++++++++----------
 1 file changed, 24 insertions(+), 10 deletions(-)

diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index bd3c047c9fa7..3fb6f57dbbb3 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -8119,6 +8119,8 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end)
 		start += 3;
 
 		prop_len = niu_pci_eeprom_read(np, start + 4);
+		if (prop_len < 0)
+			return prop_len;
 		err = niu_pci_vpd_get_propname(np, start + 5, namebuf, 64);
 		if (err < 0)
 			return err;
@@ -8163,8 +8165,12 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end)
 			netif_printk(np, probe, KERN_DEBUG, np->dev,
 				     "VPD_SCAN: Reading in property [%s] len[%d]\n",
 				     namebuf, prop_len);
-			for (i = 0; i < prop_len; i++)
-				*prop_buf++ = niu_pci_eeprom_read(np, off + i);
+			for (i = 0; i < prop_len; i++) {
+				err =  niu_pci_eeprom_read(np, off + i);
+				if (err < 0)
+					return err;
+				*prop_buf++ = err;
+			}
 		}
 
 		start += len;
@@ -8174,14 +8180,14 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end)
 }
 
 /* ESPC_PIO_EN_ENABLE must be set */
-static void niu_pci_vpd_fetch(struct niu *np, u32 start)
+static int niu_pci_vpd_fetch(struct niu *np, u32 start)
 {
 	u32 offset;
 	int err;
 
 	err = niu_pci_eeprom_read16_swp(np, start + 1);
 	if (err < 0)
-		return;
+		return err;
 
 	offset = err + 3;
 
@@ -8190,12 +8196,14 @@ static void niu_pci_vpd_fetch(struct niu *np, u32 start)
 		u32 end;
 
 		err = niu_pci_eeprom_read(np, here);
+		if (err < 0)
+			return err;
 		if (err != 0x90)
-			return;
+			return -EINVAL;
 
 		err = niu_pci_eeprom_read16_swp(np, here + 1);
 		if (err < 0)
-			return;
+			return err;
 
 		here = start + offset + 3;
 		end = start + offset + err;
@@ -8203,9 +8211,12 @@ static void niu_pci_vpd_fetch(struct niu *np, u32 start)
 		offset += err;
 
 		err = niu_pci_vpd_scan_props(np, here, end);
-		if (err < 0 || err == 1)
-			return;
+		if (err < 0)
+			return err;
+		if (err == 1)
+			return -EINVAL;
 	}
+	return 0;
 }
 
 /* ESPC_PIO_EN_ENABLE must be set */
@@ -9298,8 +9309,11 @@ static int niu_get_invariants(struct niu *np)
 		offset = niu_pci_vpd_offset(np);
 		netif_printk(np, probe, KERN_DEBUG, np->dev,
 			     "%s() VPD offset [%08x]\n", __func__, offset);
-		if (offset)
-			niu_pci_vpd_fetch(np, offset);
+		if (offset) {
+			err = niu_pci_vpd_fetch(np, offset);
+			if (err < 0)
+				return err;
+		}
 		nw64(ESPC_PIO_EN, 0);
 
 		if (np->flags & NIU_FLAGS_VPD_VALID) {

From a6a653cc3a542ba98993cb53517477c373487e6f Mon Sep 17 00:00:00 2001
From: Anirudh Rayabharam <mail@anirudhrb.com>
Date: Mon, 3 May 2021 13:56:48 +0200
Subject: [PATCH 2109/2658] net: stmicro: handle clk_prepare() failure during
 init

commit 0c32a96d000f260b5ebfabb4145a86ae1cd71847 upstream.

In case clk_prepare() fails, capture and propagate the error code up the
stack. If regulator_enable() was called earlier, properly unwind it by
calling regulator_disable().

Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210503115736.2104747-22-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
index 92e9d8c74e02..d9cbc5dcf3ec 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
@@ -39,7 +39,7 @@ struct sunxi_priv_data {
 static int sun7i_gmac_init(struct platform_device *pdev, void *priv)
 {
 	struct sunxi_priv_data *gmac = priv;
-	int ret;
+	int ret = 0;
 
 	if (gmac->regulator) {
 		ret = regulator_enable(gmac->regulator);
@@ -59,10 +59,12 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv)
 		gmac->clk_enabled = 1;
 	} else {
 		clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE);
-		clk_prepare(gmac->tx_clk);
+		ret = clk_prepare(gmac->tx_clk);
+		if (ret && gmac->regulator)
+			regulator_disable(gmac->regulator);
 	}
 
-	return 0;
+	return ret;
 }
 
 static void sun7i_gmac_exit(struct platform_device *pdev, void *priv)

From aafda642c3dd2eeb91166621ef77a532a7fce918 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 3 May 2021 13:56:40 +0200
Subject: [PATCH 2110/2658] net: rtlwifi: properly check for alloc_workqueue()
 failure

commit 30b0e0ee9d02b97b68705c46b41444786effc40c upstream.

If alloc_workqueue() fails, properly catch this and propagate the error
to the calling functions, so that the devuce initialization will
properly error out.

Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: Bryan Brattlof <hello@bryanbrattlof.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210503115736.2104747-14-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/realtek/rtlwifi/base.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
index aab752328c26..57a0c1f24f53 100644
--- a/drivers/net/wireless/realtek/rtlwifi/base.c
+++ b/drivers/net/wireless/realtek/rtlwifi/base.c
@@ -454,9 +454,14 @@ static void _rtl_init_mac80211(struct ieee80211_hw *hw)
 	}
 }
 
-static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
+static int _rtl_init_deferred_work(struct ieee80211_hw *hw)
 {
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+	struct workqueue_struct *wq;
+
+	wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name);
+	if (!wq)
+		return -ENOMEM;
 
 	/* <1> timer */
 	setup_timer(&rtlpriv->works.watchdog_timer,
@@ -465,7 +470,8 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
 		    rtl_easy_concurrent_retrytimer_callback, (unsigned long)hw);
 	/* <2> work queue */
 	rtlpriv->works.hw = hw;
-	rtlpriv->works.rtl_wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name);
+	rtlpriv->works.rtl_wq = wq;
+
 	INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq,
 			  (void *)rtl_watchdog_wq_callback);
 	INIT_DELAYED_WORK(&rtlpriv->works.ips_nic_off_wq,
@@ -476,7 +482,7 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
 			  (void *)rtl_swlps_rfon_wq_callback);
 	INIT_DELAYED_WORK(&rtlpriv->works.fwevt_wq,
 			  (void *)rtl_fwevt_wq_callback);
-
+	return 0;
 }
 
 void rtl_deinit_deferred_work(struct ieee80211_hw *hw)
@@ -568,9 +574,7 @@ int rtl_init_core(struct ieee80211_hw *hw)
 	rtlmac->link_state = MAC80211_NOLINK;
 
 	/* <6> init deferred work */
-	_rtl_init_deferred_work(hw);
-
-	return 0;
+	return _rtl_init_deferred_work(hw);
 }
 EXPORT_SYMBOL_GPL(rtl_init_core);
 

From 81174c6bde0d3e681b95992cd2ccc83d281acd9b Mon Sep 17 00:00:00 2001
From: Phillip Potter <phil@philpotter.co.uk>
Date: Mon, 3 May 2021 13:56:36 +0200
Subject: [PATCH 2111/2658] leds: lp5523: check return value of lp5xx_read and
 jump to cleanup code

commit 6647f7a06eb030a2384ec71f0bb2e78854afabfe upstream.

Check return value of lp5xx_read and if non-zero, jump to code at end of
the function, causing lp5523_stop_all_engines to be executed before
returning the error value up the call chain. This fixes the original
commit (248b57015f35) which was reverted due to the University of Minnesota
problems.

Cc: stable <stable@vger.kernel.org>
Acked-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
Link: https://lore.kernel.org/r/20210503115736.2104747-10-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/leds/leds-lp5523.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c
index 1d0187f42941..01165b04a6b7 100644
--- a/drivers/leds/leds-lp5523.c
+++ b/drivers/leds/leds-lp5523.c
@@ -318,7 +318,9 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip)
 
 	/* Let the programs run for couple of ms and check the engine status */
 	usleep_range(3000, 6000);
-	lp55xx_read(chip, LP5523_REG_STATUS, &status);
+	ret = lp55xx_read(chip, LP5523_REG_STATUS, &status);
+	if (ret)
+		goto out;
 	status &= LP5523_ENG_STATUS_MASK;
 
 	if (status != LP5523_ENG_STATUS_MASK) {

From 456ec0067b332900ba13161ecb6371f808ba59db Mon Sep 17 00:00:00 2001
From: Tom Seewald <tseewald@gmail.com>
Date: Mon, 3 May 2021 13:56:52 +0200
Subject: [PATCH 2112/2658] qlcnic: Add null check after calling
 netdev_alloc_skb

commit 84460f01cba382553199bc1361f69a872d5abed4 upstream.

The function qlcnic_dl_lb_test() currently calls netdev_alloc_skb()
without checking afterwards that the allocation succeeded. Fix this by
checking if the skb is NULL and returning an error in such a case.
Breaking out of the loop if the skb is NULL is not correct as no error
would be reported to the caller and no message would be printed for the
user.

Cc: David S. Miller <davem@davemloft.net>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Tom Seewald <tseewald@gmail.com>
Link: https://lore.kernel.org/r/20210503115736.2104747-26-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index 0a2318cad34d..99fc0121da93 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -1038,6 +1038,8 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode)
 
 	for (i = 0; i < QLCNIC_NUM_ILB_PKT; i++) {
 		skb = netdev_alloc_skb(adapter->netdev, QLCNIC_ILB_PKT_SIZE);
+		if (!skb)
+			goto error;
 		qlcnic_create_loopback_buff(skb->data, adapter->mac_addr);
 		skb_put(skb, QLCNIC_ILB_PKT_SIZE);
 		adapter->ahw->diag_cnt = 0;
@@ -1061,6 +1063,7 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode)
 			cnt++;
 	}
 	if (cnt != i) {
+error:
 		dev_err(&adapter->pdev->dev,
 			"LB Test: failed, TX[%d], RX[%d]\n", i, cnt);
 		if (mode != QLCNIC_ILB_MODE)

From 7e856cab2b4f9335037c690229c4de94caf6bc31 Mon Sep 17 00:00:00 2001
From: Igor Matheus Andrade Torrente <igormtorrente@gmail.com>
Date: Mon, 3 May 2021 13:57:06 +0200
Subject: [PATCH 2113/2658] video: hgafb: fix potential NULL pointer
 dereference

commit dc13cac4862cc68ec74348a80b6942532b7735fa upstream.

The return of ioremap if not checked, and can lead to a NULL to be
assigned to hga_vram. Potentially leading to a NULL pointer
dereference.

The fix adds code to deal with this case in the error label and
changes how the hgafb_probe handles the return of hga_card_detect.

Cc: Ferenc Bakonyi <fero@drama.obuda.kando.hu>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Igor Matheus Andrade Torrente <igormtorrente@gmail.com>
Link: https://lore.kernel.org/r/20210503115736.2104747-40-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/fbdev/hgafb.c | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/drivers/video/fbdev/hgafb.c b/drivers/video/fbdev/hgafb.c
index 15d3ccff2965..9d15abd7893d 100644
--- a/drivers/video/fbdev/hgafb.c
+++ b/drivers/video/fbdev/hgafb.c
@@ -285,6 +285,8 @@ static int hga_card_detect(void)
 	hga_vram_len  = 0x08000;
 
 	hga_vram = ioremap(0xb0000, hga_vram_len);
+	if (!hga_vram)
+		return -ENOMEM;
 
 	if (request_region(0x3b0, 12, "hgafb"))
 		release_io_ports = 1;
@@ -344,13 +346,18 @@ static int hga_card_detect(void)
 			hga_type_name = "Hercules";
 			break;
 	}
-	return 1;
+	return 0;
 error:
 	if (release_io_ports)
 		release_region(0x3b0, 12);
 	if (release_io_port)
 		release_region(0x3bf, 1);
-	return 0;
+
+	iounmap(hga_vram);
+
+	pr_err("hgafb: HGA card not detected.\n");
+
+	return -EINVAL;
 }
 
 /**
@@ -548,13 +555,11 @@ static struct fb_ops hgafb_ops = {
 static int hgafb_probe(struct platform_device *pdev)
 {
 	struct fb_info *info;
+	int ret;
 
-	if (! hga_card_detect()) {
-		printk(KERN_INFO "hgafb: HGA card not detected.\n");
-		if (hga_vram)
-			iounmap(hga_vram);
-		return -EINVAL;
-	}
+	ret = hga_card_detect();
+	if (!ret)
+		return ret;
 
 	printk(KERN_INFO "hgafb: %s with %ldK of memory detected.\n",
 		hga_type_name, hga_vram_len/1024);

From 57705d25daeefb605ac32515fefd90f62e7c71e9 Mon Sep 17 00:00:00 2001
From: "Maciej W. Rozycki" <macro@orcam.me.uk>
Date: Thu, 13 May 2021 11:51:41 +0200
Subject: [PATCH 2114/2658] vgacon: Record video mode changes with VT_RESIZEX

commit d4d0ad57b3865795c4cde2fb5094c594c2e8f469 upstream.

Fix an issue with VGA console font size changes made after the initial
video text mode has been changed with a user tool like `svgatextmode'
calling the VT_RESIZEX ioctl.  As it stands in that case the original
screen geometry continues being used to validate further VT resizing.

Consequently when the video adapter is firstly reprogrammed from the
original say 80x25 text mode using a 9x16 character cell (720x400 pixel
resolution) to say 80x37 text mode and the same character cell (720x592
pixel resolution), and secondly the CRTC character cell updated to 9x8
(by loading a suitable font with the KD_FONT_OP_SET request of the
KDFONTOP ioctl), the VT geometry does not get further updated from 80x37
and only upper half of the screen is used for the VT, with the lower
half showing rubbish corresponding to whatever happens to be there in
the video memory that maps to that part of the screen.  Of course the
proportions change according to text mode geometries and font sizes
chosen.

Address the problem then, by updating the text mode geometry defaults
rather than checking against them whenever the VT is resized via a user
ioctl.

Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: e400b6ec4ede ("vt/vgacon: Check if screen resize request comes from userspace")
Cc: stable@vger.kernel.org # v2.6.24+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/console/vgacon.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index c35ae8c732f6..319d2760dac8 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -1179,12 +1179,20 @@ static int vgacon_resize(struct vc_data *c, unsigned int width,
 	if ((width << 1) * height > vga_vram_size)
 		return -EINVAL;
 
+	if (user) {
+		/*
+		 * Ho ho!  Someone (svgatextmode, eh?) may have reprogrammed
+		 * the video mode!  Set the new defaults then and go away.
+		 */
+		screen_info.orig_video_cols = width;
+		screen_info.orig_video_lines = height;
+		vga_default_font_height = c->vc_font.height;
+		return 0;
+	}
 	if (width % 2 || width > screen_info.orig_video_cols ||
 	    height > (screen_info.orig_video_lines * vga_default_font_height)/
 	    c->vc_font.height)
-		/* let svgatextmode tinker with video timings and
-		   return success */
-		return (user) ? 0 : -EINVAL;
+		return -EINVAL;
 
 	if (CON_IS_VISIBLE(c) && !vga_is_gfx) /* who knows */
 		vgacon_doresize(c, width, height);

From 3a69ca8c7ed1c0206d2cc606795be8457cf65eba Mon Sep 17 00:00:00 2001
From: "Maciej W. Rozycki" <macro@orcam.me.uk>
Date: Thu, 13 May 2021 11:51:50 +0200
Subject: [PATCH 2115/2658] vt: Fix character height handling with VT_RESIZEX

commit 860dafa902595fb5f1d23bbcce1215188c3341e6 upstream.

Restore the original intent of the VT_RESIZEX ioctl's `v_clin' parameter
which is the number of pixel rows per character (cell) rather than the
height of the font used.

For framebuffer devices the two values are always the same, because the
former is inferred from the latter one.  For VGA used as a true text
mode device these two parameters are independent from each other: the
number of pixel rows per character is set in the CRT controller, while
font height is in fact hardwired to 32 pixel rows and fonts of heights
below that value are handled by padding their data with blanks when
loaded to hardware for use by the character generator.  One can change
the setting in the CRT controller and it will update the screen contents
accordingly regardless of the font loaded.

The `v_clin' parameter is used by the `vgacon' driver to set the height
of the character cell and then the cursor position within.  Make the
parameter explicit then, by defining a new `vc_cell_height' struct
member of `vc_data', set it instead of `vc_font.height' from `v_clin' in
the VT_RESIZEX ioctl, and then use it throughout the `vgacon' driver
except where actual font data is accessed which as noted above is
independent from the CRTC setting.

This way the framebuffer console driver is free to ignore the `v_clin'
parameter as irrelevant, as it always should have, avoiding any issues
attempts to give the parameter a meaning there could have caused, such
as one that has led to commit 988d0763361b ("vt_ioctl: make VT_RESIZEX
behave like VT_RESIZE"):

 "syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2],
  for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height
  larger than actual font height calculated by con_font_set() from
  ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates
  minimal amount of memory based on actual font height calculated by
  con_font_set(), use of vt_resizex() can cause UAF/OOB read for font
  data."

The problem first appeared around Linux 2.5.66 which predates our repo
history, but the origin could be identified with the old MIPS/Linux repo
also at: <git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git>
as commit 9736a3546de7 ("Merge with Linux 2.5.66."), where VT_RESIZEX
code in `vt_ioctl' was updated as follows:

 		if (clin)
-			video_font_height = clin;
+			vc->vc_font.height = clin;

making the parameter apply to framebuffer devices as well, perhaps due
to the use of "font" in the name of the original `video_font_height'
variable.  Use "cell" in the new struct member then to avoid ambiguity.

References:

[1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837
[2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3

Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org # v2.6.12+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/vt/vt_ioctl.c      |  6 ++---
 drivers/video/console/vgacon.c | 44 +++++++++++++++++-----------------
 include/linux/console_struct.h |  1 +
 3 files changed, 26 insertions(+), 25 deletions(-)

diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
index b111071d19b5..e1a8f4121206 100644
--- a/drivers/tty/vt/vt_ioctl.c
+++ b/drivers/tty/vt/vt_ioctl.c
@@ -898,17 +898,17 @@ int vt_ioctl(struct tty_struct *tty,
 			if (vcp) {
 				int ret;
 				int save_scan_lines = vcp->vc_scan_lines;
-				int save_font_height = vcp->vc_font.height;
+				int save_cell_height = vcp->vc_cell_height;
 
 				if (v.v_vlin)
 					vcp->vc_scan_lines = v.v_vlin;
 				if (v.v_clin)
-					vcp->vc_font.height = v.v_clin;
+					vcp->vc_cell_height = v.v_clin;
 				vcp->vc_resize_user = 1;
 				ret = vc_resize(vcp, v.v_cols, v.v_rows);
 				if (ret) {
 					vcp->vc_scan_lines = save_scan_lines;
-					vcp->vc_font.height = save_font_height;
+					vcp->vc_cell_height = save_cell_height;
 					console_unlock();
 					return ret;
 				}
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 319d2760dac8..850fe1789382 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -436,7 +436,7 @@ static void vgacon_init(struct vc_data *c, int init)
 		vc_resize(c, vga_video_num_columns, vga_video_num_lines);
 
 	c->vc_scan_lines = vga_scan_lines;
-	c->vc_font.height = vga_video_font_height;
+	c->vc_font.height = c->vc_cell_height = vga_video_font_height;
 	c->vc_complement_mask = 0x7700;
 	if (vga_512_chars)
 		c->vc_hi_font_mask = 0x0800;
@@ -574,32 +574,32 @@ static void vgacon_cursor(struct vc_data *c, int mode)
 		switch (c->vc_cursor_type & 0x0f) {
 		case CUR_UNDERLINE:
 			vgacon_set_cursor_size(c->vc_x,
-					       c->vc_font.height -
-					       (c->vc_font.height <
+					       c->vc_cell_height -
+					       (c->vc_cell_height <
 						10 ? 2 : 3),
-					       c->vc_font.height -
-					       (c->vc_font.height <
+					       c->vc_cell_height -
+					       (c->vc_cell_height <
 						10 ? 1 : 2));
 			break;
 		case CUR_TWO_THIRDS:
 			vgacon_set_cursor_size(c->vc_x,
-					       c->vc_font.height / 3,
-					       c->vc_font.height -
-					       (c->vc_font.height <
+					       c->vc_cell_height / 3,
+					       c->vc_cell_height -
+					       (c->vc_cell_height <
 						10 ? 1 : 2));
 			break;
 		case CUR_LOWER_THIRD:
 			vgacon_set_cursor_size(c->vc_x,
-					       (c->vc_font.height * 2) / 3,
-					       c->vc_font.height -
-					       (c->vc_font.height <
+					       (c->vc_cell_height * 2) / 3,
+					       c->vc_cell_height -
+					       (c->vc_cell_height <
 						10 ? 1 : 2));
 			break;
 		case CUR_LOWER_HALF:
 			vgacon_set_cursor_size(c->vc_x,
-					       c->vc_font.height / 2,
-					       c->vc_font.height -
-					       (c->vc_font.height <
+					       c->vc_cell_height / 2,
+					       c->vc_cell_height -
+					       (c->vc_cell_height <
 						10 ? 1 : 2));
 			break;
 		case CUR_NONE:
@@ -610,7 +610,7 @@ static void vgacon_cursor(struct vc_data *c, int mode)
 			break;
 		default:
 			vgacon_set_cursor_size(c->vc_x, 1,
-					       c->vc_font.height);
+					       c->vc_cell_height);
 			break;
 		}
 		break;
@@ -621,13 +621,13 @@ static int vgacon_doresize(struct vc_data *c,
 		unsigned int width, unsigned int height)
 {
 	unsigned long flags;
-	unsigned int scanlines = height * c->vc_font.height;
+	unsigned int scanlines = height * c->vc_cell_height;
 	u8 scanlines_lo = 0, r7 = 0, vsync_end = 0, mode, max_scan;
 
 	raw_spin_lock_irqsave(&vga_lock, flags);
 
 	vgacon_xres = width * VGA_FONTWIDTH;
-	vgacon_yres = height * c->vc_font.height;
+	vgacon_yres = height * c->vc_cell_height;
 	if (vga_video_type >= VIDEO_TYPE_VGAC) {
 		outb_p(VGA_CRTC_MAX_SCAN, vga_video_port_reg);
 		max_scan = inb_p(vga_video_port_val);
@@ -682,9 +682,9 @@ static int vgacon_doresize(struct vc_data *c,
 static int vgacon_switch(struct vc_data *c)
 {
 	int x = c->vc_cols * VGA_FONTWIDTH;
-	int y = c->vc_rows * c->vc_font.height;
+	int y = c->vc_rows * c->vc_cell_height;
 	int rows = screen_info.orig_video_lines * vga_default_font_height/
-		c->vc_font.height;
+		c->vc_cell_height;
 	/*
 	 * We need to save screen size here as it's the only way
 	 * we can spot the screen has been resized and we need to
@@ -1125,7 +1125,7 @@ static int vgacon_adjust_height(struct vc_data *vc, unsigned fontheight)
 				cursor_size_lastto = 0;
 				c->vc_sw->con_cursor(c, CM_DRAW);
 			}
-			c->vc_font.height = fontheight;
+			c->vc_font.height = c->vc_cell_height = fontheight;
 			vc_resize(c, 0, rows);	/* Adjust console size */
 		}
 	}
@@ -1186,12 +1186,12 @@ static int vgacon_resize(struct vc_data *c, unsigned int width,
 		 */
 		screen_info.orig_video_cols = width;
 		screen_info.orig_video_lines = height;
-		vga_default_font_height = c->vc_font.height;
+		vga_default_font_height = c->vc_cell_height;
 		return 0;
 	}
 	if (width % 2 || width > screen_info.orig_video_cols ||
 	    height > (screen_info.orig_video_lines * vga_default_font_height)/
-	    c->vc_font.height)
+	    c->vc_cell_height)
 		return -EINVAL;
 
 	if (CON_IS_VISIBLE(c) && !vga_is_gfx) /* who knows */
diff --git a/include/linux/console_struct.h b/include/linux/console_struct.h
index e329ee2667e1..3a7fd222845e 100644
--- a/include/linux/console_struct.h
+++ b/include/linux/console_struct.h
@@ -29,6 +29,7 @@ struct vc_data {
 	unsigned int	vc_rows;
 	unsigned int	vc_size_row;		/* Bytes per row */
 	unsigned int	vc_scan_lines;		/* # of scan lines */
+	unsigned int	vc_cell_height;		/* CRTC character cell height */
 	unsigned long	vc_origin;		/* [!] Start of real screen */
 	unsigned long	vc_scr_end;		/* [!] End of real screen */
 	unsigned long	vc_visible_origin;	/* [!] Top of visible window */

From 7d1558d46012175a6844e9d5bd90ff270ee5a24c Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date: Sat, 15 May 2021 03:00:37 +0000
Subject: [PATCH 2116/2658] tty: vt: always invoke vc->vc_sw->con_resize
 callback

commit ffb324e6f874121f7dce5bdae5e05d02baae7269 upstream.

syzbot is reporting OOB write at vga16fb_imageblit() [1], for
resize_screen() from ioctl(VT_RESIZE) returns 0 without checking whether
requested rows/columns fit the amount of memory reserved for the graphical
screen if current mode is KD_GRAPHICS.

----------
  #include <sys/types.h>
  #include <sys/stat.h>
  #include <fcntl.h>
  #include <sys/ioctl.h>
  #include <linux/kd.h>
  #include <linux/vt.h>

  int main(int argc, char *argv[])
  {
        const int fd = open("/dev/char/4:1", O_RDWR);
        struct vt_sizes vt = { 0x4100, 2 };

        ioctl(fd, KDSETMODE, KD_GRAPHICS);
        ioctl(fd, VT_RESIZE, &vt);
        ioctl(fd, KDSETMODE, KD_TEXT);
        return 0;
  }
----------

Allow framebuffer drivers to return -EINVAL, by moving vc->vc_mode !=
KD_GRAPHICS check from resize_screen() to fbcon_resize().

Link: https://syzkaller.appspot.com/bug?extid=1f29e126cf461c4de3b3 [1]
Reported-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/vt/vt.c           | 2 +-
 drivers/video/console/fbcon.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 7ec5e6dd60e5..9f479b4c6491 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -826,7 +826,7 @@ static inline int resize_screen(struct vc_data *vc, int width, int height,
 	/* Resizes the resolution of the display adapater */
 	int err = 0;
 
-	if (vc->vc_mode != KD_GRAPHICS && vc->vc_sw->con_resize)
+	if (vc->vc_sw->con_resize)
 		err = vc->vc_sw->con_resize(vc, width, height, user);
 
 	return err;
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 29bb67921639..ceae076dc96b 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -1986,7 +1986,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,
 			return -EINVAL;
 
 		DPRINTK("resize now %ix%i\n", var.xres, var.yres);
-		if (CON_IS_VISIBLE(vc)) {
+		if (CON_IS_VISIBLE(vc) && vc->vc_mode == KD_TEXT) {
 			var.activate = FB_ACTIVATE_NOW |
 				FB_ACTIVATE_FORCE;
 			fb_set_var(info, &var);

From d82741bc5132ac9821e60c83e118153239b6c5d1 Mon Sep 17 00:00:00 2001
From: Anirudh Rayabharam <mail@anirudhrb.com>
Date: Mon, 17 May 2021 00:57:14 +0530
Subject: [PATCH 2117/2658] video: hgafb: correctly handle card detect failure
 during probe

commit 02625c965239b71869326dd0461615f27307ecb3 upstream.

The return value of hga_card_detect() is not properly handled causing
the probe to succeed even though hga_card_detect() failed. Since probe
succeeds, hgafb_open() can be called which will end up operating on an
unmapped hga_vram. This results in an out-of-bounds access as reported
by kernel test robot [1].

To fix this, correctly detect failure of hga_card_detect() by checking
for a non-zero error code.

[1]: https://lore.kernel.org/lkml/20210516150019.GB25903@xsang-OptiPlex-9020/

Fixes: dc13cac4862c ("video: hgafb: fix potential NULL pointer dereference")
Cc: stable <stable@vger.kernel.org>
Reported-by: kernel test robot <oliver.sang@intel.com>
Reviewed-by: Igor Matheus Andrade Torrente <igormtorrente@gmail.com>
Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20210516192714.25823-1-mail@anirudhrb.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/fbdev/hgafb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/hgafb.c b/drivers/video/fbdev/hgafb.c
index 9d15abd7893d..46ac8bbb376d 100644
--- a/drivers/video/fbdev/hgafb.c
+++ b/drivers/video/fbdev/hgafb.c
@@ -558,7 +558,7 @@ static int hgafb_probe(struct platform_device *pdev)
 	int ret;
 
 	ret = hga_card_detect();
-	if (!ret)
+	if (ret)
 		return ret;
 
 	printk(KERN_INFO "hgafb: %s with %ldK of memory detected.\n",

From e6a67743178bd6e983d429a6b106bc80fe0beda8 Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Wed, 10 Mar 2021 14:13:08 -0800
Subject: [PATCH 2118/2658] Bluetooth: SMP: Fail if remote and local public
 keys are identical

commit 6d19628f539fccf899298ff02ee4c73e4bf6df3f upstream.

This fails the pairing procedure when both remote and local non-debug
public keys are identical.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/smp.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index d3114dfd8adf..1d9c517dd3d3 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2654,6 +2654,15 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb)
 	if (skb->len < sizeof(*key))
 		return SMP_INVALID_PARAMS;
 
+	/* Check if remote and local public keys are the same and debug key is
+	 * not in use.
+	 */
+	if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) &&
+	    !crypto_memneq(key, smp->local_pk, 64)) {
+		bt_dev_err(hdev, "Remote and local public keys are identical");
+		return SMP_UNSPECIFIED;
+	}
+
 	memcpy(smp->remote_pk, key, 64);
 
 	if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) {

From a50a23452049016e653d7c69eb25a25e2c2fd5bf Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 26 May 2021 11:27:34 +0200
Subject: [PATCH 2119/2658] Linux 4.4.270

Link: https://lore.kernel.org/r/20210524152322.919918360@linuxfoundation.org
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 71f55a67e979..8ce8b8386082 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 269
+SUBLEVEL = 270
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 2aeda0f44e2689dac54f4c6f5029d0a81ebc3c37 Mon Sep 17 00:00:00 2001
From: Stephen Brennan <stephen.s.brennan@oracle.com>
Date: Wed, 26 May 2021 10:46:13 -0700
Subject: [PATCH 2120/2658] mm, vmstat: drop zone->lock in /proc/pagetypeinfo

Commit 93b3a674485f6a4b8ffff85d1682d5e8b7c51560 upstream

Commit 93b3a674485f ("mm,vmstat: reduce zone->lock holding time by
/proc/pagetypeinfo") upstream caps the number of iterations over each
free_list at 100,000, and also drops the zone->lock in between each
migrate type. Capping the iteration count alters the file contents in
some cases, which means this approach may not be suitable for stable
backports.

However, dropping zone->lock in between migrate types (and, as a result,
page orders) will not change the /proc/pagetypeinfo file contents. It
can significantly reduce the length of time spent with IRQs disabled,
which can prevent missed interrupts or soft lockups which we have
observed on systems with particularly large memory.

Thus, this commit is a modified version of the upstream one which only
drops the lock in between migrate types.

Fixes: 467c996c1e19 ("Print out statistics in relation to fragmentation avoidance to /proc/pagetypeinfo")
Signed-off-by: Stephen Brennan <stephen.s.brennan@oracle.com>
Reviewed-by: Aruna Ramakrishna <aruna.ramakrishna@oracle.com>
Reviewed-by: Khalid Aziz <khalid.aziz@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/vmstat.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/mm/vmstat.c b/mm/vmstat.c
index bf12a4cb8f60..4eb4fb051a11 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -966,6 +966,9 @@ static void pagetypeinfo_showfree_print(struct seq_file *m,
 			list_for_each(curr, &area->free_list[mtype])
 				freecount++;
 			seq_printf(m, "%6lu ", freecount);
+			spin_unlock_irq(&zone->lock);
+			cond_resched();
+			spin_lock_irq(&zone->lock);
 		}
 		seq_putc(m, '\n');
 	}

From 9e91ba2afc1ee060eb1d49997136119c71a39025 Mon Sep 17 00:00:00 2001
From: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
Date: Mon, 8 Mar 2021 14:24:13 +1300
Subject: [PATCH 2121/2658] netfilter: x_tables: Use correct memory barriers.

commit 175e476b8cdf2a4de7432583b49c871345e4f8a1 upstream.

When a new table value was assigned, it was followed by a write memory
barrier. This ensured that all writes before this point would complete
before any writes after this point. However, to determine whether the
rules are unused, the sequence counter is read. To ensure that all
writes have been done before these reads, a full memory barrier is
needed, not just a write memory barrier. The same argument applies when
incrementing the counter, before the rules are read.

Changing to using smp_mb() instead of smp_wmb() fixes the kernel panic
reported in cc00bcaa5899 (which is still present), while still
maintaining the same speed of replacing tables.

The smb_mb() barriers potentially slow the packet path, however testing
has shown no measurable change in performance on a 4-core MIPS64
platform.

Fixes: 7f5c6d4f665b ("netfilter: get rid of atomic ops in fast path")
Signed-off-by: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
[Ported to stable, affected barrier is added by d3d40f237480abf3268956daf18cdc56edd32834 in mainline]
Signed-off-by: Pavel Machek (CIP) <pavel@denx.de>
Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/netfilter/x_tables.h | 2 +-
 net/netfilter/x_tables.c           | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 882aa2dad63c..b6d887e3dee2 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -328,7 +328,7 @@ static inline unsigned int xt_write_recseq_begin(void)
 	 * since addend is most likely 1
 	 */
 	__this_cpu_add(xt_recseq.sequence, addend);
-	smp_wmb();
+	smp_mb();
 
 	return addend;
 }
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index dfce6a8f0a38..fae4fd98f7ac 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1166,6 +1166,9 @@ xt_replace_table(struct xt_table *table,
 	smp_wmb();
 	table->private = newinfo;
 
+	/* make sure all cpus see new ->private value */
+	smp_mb();
+
 	/*
 	 * Even though table entries have now been swapped, other CPU's
 	 * may still be using the old entries. This is okay, because

From 5cd0211e24de0b34410de23c3d4d157209c1ae30 Mon Sep 17 00:00:00 2001
From: Dongliang Mu <mudongliangabcd@gmail.com>
Date: Sat, 15 May 2021 07:29:06 +0800
Subject: [PATCH 2122/2658] NFC: nci: fix memory leak in nci_allocate_device

commit e0652f8bb44d6294eeeac06d703185357f25d50b upstream.

nfcmrvl_disconnect fails to free the hci_dev field in struct nci_dev.
Fix this by freeing hci_dev in nci_free_device.

BUG: memory leak
unreferenced object 0xffff888111ea6800 (size 1024):
  comm "kworker/1:0", pid 19, jiffies 4294942308 (age 13.580s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 60 fd 0c 81 88 ff ff  .........`......
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<000000004bc25d43>] kmalloc include/linux/slab.h:552 [inline]
    [<000000004bc25d43>] kzalloc include/linux/slab.h:682 [inline]
    [<000000004bc25d43>] nci_hci_allocate+0x21/0xd0 net/nfc/nci/hci.c:784
    [<00000000c59cff92>] nci_allocate_device net/nfc/nci/core.c:1170 [inline]
    [<00000000c59cff92>] nci_allocate_device+0x10b/0x160 net/nfc/nci/core.c:1132
    [<00000000006e0a8e>] nfcmrvl_nci_register_dev+0x10a/0x1c0 drivers/nfc/nfcmrvl/main.c:153
    [<000000004da1b57e>] nfcmrvl_probe+0x223/0x290 drivers/nfc/nfcmrvl/usb.c:345
    [<00000000d506aed9>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554
    [<00000000f5009125>] driver_probe_device+0x84/0x100 drivers/base/dd.c:740
    [<000000000ce658ca>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:846
    [<000000007067d05f>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
    [<00000000f8e13372>] __device_attach+0x122/0x250 drivers/base/dd.c:914
    [<000000009cf68860>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
    [<00000000359c965a>] device_add+0x5be/0xc30 drivers/base/core.c:3109
    [<00000000086e4bd3>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164
    [<00000000ca036872>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
    [<00000000d40d36f6>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
    [<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554

Reported-by: syzbot+19bcfc64a8df1318d1c3@syzkaller.appspotmail.com
Fixes: 11f54f228643 ("NFC: nci: Add HCI over NCI protocol support")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/nfc/nci_core.h | 1 +
 net/nfc/nci/core.c         | 1 +
 net/nfc/nci/hci.c          | 5 +++++
 3 files changed, 7 insertions(+)

diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
index 57ce24fb0047..f0e951292de8 100644
--- a/include/net/nfc/nci_core.h
+++ b/include/net/nfc/nci_core.h
@@ -300,6 +300,7 @@ int nci_core_conn_create(struct nci_dev *ndev, u8 destination_type,
 int nci_core_conn_close(struct nci_dev *ndev, u8 conn_id);
 
 struct nci_hci_dev *nci_hci_allocate(struct nci_dev *ndev);
+void nci_hci_deallocate(struct nci_dev *ndev);
 int nci_hci_send_event(struct nci_dev *ndev, u8 gate, u8 event,
 		       const u8 *param, size_t param_len);
 int nci_hci_send_cmd(struct nci_dev *ndev, u8 gate,
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 6ac1a8d19b88..35cc290389c8 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -1099,6 +1099,7 @@ EXPORT_SYMBOL(nci_allocate_device);
 void nci_free_device(struct nci_dev *ndev)
 {
 	nfc_free_device(ndev->nfc_dev);
+	nci_hci_deallocate(ndev);
 	kfree(ndev);
 }
 EXPORT_SYMBOL(nci_free_device);
diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c
index 2aedac15cb59..309e8cebed55 100644
--- a/net/nfc/nci/hci.c
+++ b/net/nfc/nci/hci.c
@@ -798,3 +798,8 @@ struct nci_hci_dev *nci_hci_allocate(struct nci_dev *ndev)
 
 	return hdev;
 }
+
+void nci_hci_deallocate(struct nci_dev *ndev)
+{
+	kfree(ndev->hci_dev);
+}

From 13681dcabb21729f38a969cc3631febfe3ef8eaf Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Tue, 25 May 2021 12:37:35 -0700
Subject: [PATCH 2123/2658] proc: Check /proc/$pid/attr/ writes against file
 opener

commit bfb819ea20ce8bbeeba17e1a6418bf8bda91fc28 upstream.

Fix another "confused deputy" weakness[1]. Writes to /proc/$pid/attr/
files need to check the opener credentials, since these fds do not
transition state across execve(). Without this, it is possible to
trick another process (which may have different credentials) to write
to its own /proc/$pid/attr/ files, leading to unexpected and possibly
exploitable behaviors.

[1] https://www.kernel.org/doc/html/latest/security/credentials.html?highlight=confused#open-file-credentials

Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/proc/base.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index bdb39a5597df..9d1fd461b6f0 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2746,6 +2746,10 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
 	ssize_t length;
 	struct task_struct *task = get_proc_task(inode);
 
+	/* A task may only write when it was the opener. */
+	if (file->f_cred != current_real_cred())
+		return -EPERM;
+
 	length = -ESRCH;
 	if (!task)
 		goto out_no_task;

From ebecea40ec31b9bfb9fafa97612be70cf95da7fe Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 24 May 2021 11:25:11 +0200
Subject: [PATCH 2124/2658] net: hso: fix control-request directions

commit 1a6e9a9c68c1f183872e4bcc947382111c2e04eb upstream.

The direction of the pipe argument must match the request-type direction
bit or control requests may fail depending on the host-controller-driver
implementation.

Fix the tiocmset and rfkill requests which erroneously used
usb_rcvctrlpipe().

Fixes: 72dc1c096c70 ("HSO: add option hso driver")
Cc: stable@vger.kernel.org      # 2.6.27
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/hso.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 559c9b6290e1..5d988829f7d5 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1710,7 +1710,7 @@ static int hso_serial_tiocmset(struct tty_struct *tty,
 	spin_unlock_irqrestore(&serial->serial_lock, flags);
 
 	return usb_control_msg(serial->parent->usb,
-			       usb_rcvctrlpipe(serial->parent->usb, 0), 0x22,
+			       usb_sndctrlpipe(serial->parent->usb, 0), 0x22,
 			       0x21, val, if_num, NULL, 0,
 			       USB_CTRL_SET_TIMEOUT);
 }
@@ -2461,7 +2461,7 @@ static int hso_rfkill_set_block(void *data, bool blocked)
 	if (hso_dev->usb_gone)
 		rv = 0;
 	else
-		rv = usb_control_msg(hso_dev->usb, usb_rcvctrlpipe(hso_dev->usb, 0),
+		rv = usb_control_msg(hso_dev->usb, usb_sndctrlpipe(hso_dev->usb, 0),
 				       enabled ? 0x82 : 0x81, 0x40, 0, 0, NULL, 0,
 				       USB_CTRL_SET_TIMEOUT);
 	mutex_unlock(&hso_dev->mutex);

From 6006c33488f860208791a53b6dc0393fcebda8d1 Mon Sep 17 00:00:00 2001
From: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
Date: Mon, 31 May 2021 22:28:25 +0200
Subject: [PATCH 2125/2658] mac80211: assure all fragments are encrypted

commit 965a7d72e798eb7af0aa67210e37cf7ecd1c9cad upstream.

Do not mix plaintext and encrypted fragments in protected Wi-Fi
networks. This fixes CVE-2020-26147.

Previously, an attacker was able to first forward a legitimate encrypted
fragment towards a victim, followed by a plaintext fragment. The
encrypted and plaintext fragment would then be reassembled. For further
details see Section 6.3 and Appendix D in the paper "Fragment and Forge:
Breaking Wi-Fi Through Frame Aggregation and Fragmentation".

Because of this change there are now two equivalent conditions in the
code to determine if a received fragment requires sequential PNs, so we
also move this test to a separate function to make the code easier to
maintain.

Cc: stable@vger.kernel.org
Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
Link: https://lore.kernel.org/r/20210511200110.30c4394bb835.I5acfdb552cc1d20c339c262315950b3eac491397@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/rx.c | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 50c3e1d5b981..1e0eb7d35485 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1808,6 +1808,16 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
 	return NULL;
 }
 
+static bool requires_sequential_pn(struct ieee80211_rx_data *rx, __le16 fc)
+{
+	return rx->key &&
+		(rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
+		 rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
+		 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
+		 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
+		ieee80211_has_protected(fc);
+}
+
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 {
@@ -1853,12 +1863,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 		/* This is the first fragment of a new frame. */
 		entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
 						 rx->seqno_idx, &(rx->skb));
-		if (rx->key &&
-		    (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
-		     rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
-		     rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
-		     rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
-		    ieee80211_has_protected(fc)) {
+		if (requires_sequential_pn(rx, fc)) {
 			int queue = rx->security_idx;
 
 			/* Store CCMP/GCMP PN so that we can verify that the
@@ -1900,11 +1905,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 		u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
 		int queue;
 
-		if (!rx->key ||
-		    (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP &&
-		     rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256 &&
-		     rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP &&
-		     rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP_256))
+		if (!requires_sequential_pn(rx, fc))
 			return RX_DROP_UNUSABLE;
 		memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
 		for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {

From 0ba1b0a344124f17619aaedb9ce7dafa9a4bf9c5 Mon Sep 17 00:00:00 2001
From: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
Date: Mon, 31 May 2021 22:28:26 +0200
Subject: [PATCH 2126/2658] mac80211: prevent mixed key and fragment cache
 attacks

commit 94034c40ab4a3fcf581fbc7f8fdf4e29943c4a24 upstream.

Simultaneously prevent mixed key attacks (CVE-2020-24587) and fragment
cache attacks (CVE-2020-24586). This is accomplished by assigning a
unique color to every key (per interface) and using this to track which
key was used to decrypt a fragment. When reassembling frames, it is
now checked whether all fragments were decrypted using the same key.

To assure that fragment cache attacks are also prevented, the ID that is
assigned to keys is unique even over (re)associations and (re)connects.
This means fragments separated by a (re)association or (re)connect will
not be reassembled. Because mac80211 now also prevents the reassembly of
mixed encrypted and plaintext fragments, all cache attacks are prevented.

Cc: stable@vger.kernel.org
Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
Link: https://lore.kernel.org/r/20210511200110.3f8290e59823.I622a67769ed39257327a362cfc09c812320eb979@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/ieee80211_i.h | 1 +
 net/mac80211/key.c         | 7 +++++++
 net/mac80211/key.h         | 2 ++
 net/mac80211/rx.c          | 6 ++++++
 4 files changed, 16 insertions(+)

diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 660e9eceaea9..04561b8b81ff 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -94,6 +94,7 @@ struct ieee80211_fragment_entry {
 	u8 rx_queue;
 	bool check_sequential_pn; /* needed for CCMP/GCMP */
 	u8 last_pn[6]; /* PN of the last fragment if CCMP was used */
+	unsigned int key_color;
 };
 
 
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 91a4e606edcd..a2050d5776ce 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -646,6 +646,7 @@ int ieee80211_key_link(struct ieee80211_key *key,
 		       struct sta_info *sta)
 {
 	struct ieee80211_local *local = sdata->local;
+	static atomic_t key_color = ATOMIC_INIT(0);
 	struct ieee80211_key *old_key;
 	int idx = key->conf.keyidx;
 	bool pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
@@ -680,6 +681,12 @@ int ieee80211_key_link(struct ieee80211_key *key,
 	key->sdata = sdata;
 	key->sta = sta;
 
+	/*
+	 * Assign a unique ID to every key so we can easily prevent mixed
+	 * key and fragment cache attacks.
+	 */
+	key->color = atomic_inc_return(&key_color);
+
 	increment_tailroom_need_count(sdata);
 
 	ieee80211_key_replace(sdata, sta, pairwise, old_key, key);
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index 9951ef06323e..9ac5c00dbe80 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -123,6 +123,8 @@ struct ieee80211_key {
 	} debugfs;
 #endif
 
+	unsigned int color;
+
 	/*
 	 * key config, must be last because it contains key
 	 * material as variable length member
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 1e0eb7d35485..ba231bc27d23 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1870,6 +1870,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 			 * next fragment has a sequential PN value.
 			 */
 			entry->check_sequential_pn = true;
+			entry->key_color = rx->key->color;
 			memcpy(entry->last_pn,
 			       rx->key->u.ccmp.rx_pn[queue],
 			       IEEE80211_CCMP_PN_LEN);
@@ -1907,6 +1908,11 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 
 		if (!requires_sequential_pn(rx, fc))
 			return RX_DROP_UNUSABLE;
+
+		/* Prevent mixed key and fragment cache attacks */
+		if (entry->key_color != rx->key->color)
+			return RX_DROP_UNUSABLE;
+
 		memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
 		for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
 			pn[i]++;

From bdff13284d0fd191d4b23e778daf1354b576621e Mon Sep 17 00:00:00 2001
From: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
Date: Mon, 31 May 2021 22:28:27 +0200
Subject: [PATCH 2127/2658] mac80211: properly handle A-MSDUs that start with
 an RFC 1042 header

commit a1d5ff5651ea592c67054233b14b30bf4452999c upstream.

Properly parse A-MSDUs whose first 6 bytes happen to equal a rfc1042
header. This can occur in practice when the destination MAC address
equals AA:AA:03:00:00:00. More importantly, this simplifies the next
patch to mitigate A-MSDU injection attacks.

Cc: stable@vger.kernel.org
Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
Link: https://lore.kernel.org/r/20210511200110.0b2b886492f0.I23dd5d685fe16d3b0ec8106e8f01b59f499dffed@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/wireless/util.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/net/wireless/util.c b/net/wireless/util.c
index c09dae0a0b62..f995f6b4caf2 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -410,8 +410,8 @@ unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
 }
 EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
 
-int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
-			   enum nl80211_iftype iftype)
+static int __ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
+				    enum nl80211_iftype iftype, bool is_amsdu)
 {
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 	u16 hdrlen, ethertype;
@@ -505,7 +505,7 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
 	payload = skb->data + hdrlen;
 	ethertype = (payload[6] << 8) | payload[7];
 
-	if (likely((ether_addr_equal(payload, rfc1042_header) &&
+	if (likely((!is_amsdu && ether_addr_equal(payload, rfc1042_header) &&
 		    ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
 		   ether_addr_equal(payload, bridge_tunnel_header))) {
 		/* remove RFC1042 or Bridge-Tunnel encapsulation and
@@ -526,6 +526,12 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
 	}
 	return 0;
 }
+
+int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
+			   enum nl80211_iftype iftype)
+{
+	return __ieee80211_data_to_8023(skb, addr, iftype, false);
+}
 EXPORT_SYMBOL(ieee80211_data_to_8023);
 
 int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,

From 1f98bf6e0d92fba14fcad9ca213df488765737d5 Mon Sep 17 00:00:00 2001
From: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
Date: Mon, 31 May 2021 22:28:28 +0200
Subject: [PATCH 2128/2658] cfg80211: mitigate A-MSDU aggregation attacks

commit 2b8a1fee3488c602aca8bea004a087e60806a5cf upstream.

Mitigate A-MSDU injection attacks (CVE-2020-24588) by detecting if the
destination address of a subframe equals an RFC1042 (i.e., LLC/SNAP)
header, and if so dropping the complete A-MSDU frame. This mitigates
known attacks, although new (unknown) aggregation-based attacks may
remain possible.

This defense works because in A-MSDU aggregation injection attacks, a
normal encrypted Wi-Fi frame is turned into an A-MSDU frame. This means
the first 6 bytes of the first A-MSDU subframe correspond to an RFC1042
header. In other words, the destination MAC address of the first A-MSDU
subframe contains the start of an RFC1042 header during an aggregation
attack. We can detect this and thereby prevent this specific attack.
For details, see Section 7.2 of "Fragment and Forge: Breaking Wi-Fi
Through Frame Aggregation and Fragmentation".

Note that for kernel 4.9 and above this patch depends on "mac80211:
properly handle A-MSDUs that start with a rfc1042 header". Otherwise
this patch has no impact and attacks will remain possible.

Cc: stable@vger.kernel.org
Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
Link: https://lore.kernel.org/r/20210511200110.25d93176ddaf.I9e265b597f2cd23eb44573f35b625947b386a9de@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/wireless/util.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/wireless/util.c b/net/wireless/util.c
index f995f6b4caf2..279787ff6693 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -690,6 +690,9 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
 		/* the last MSDU has no padding */
 		if (subframe_len > remaining)
 			goto purge;
+		/* mitigate A-MSDU aggregation injection attacks */
+		if (ether_addr_equal(eth->h_dest, rfc1042_header))
+			goto purge;
 
 		skb_pull(skb, sizeof(struct ethhdr));
 		/* reuse skb for the last subframe */

From 004eaaa252ee0dba41390c090aaf6024093854f2 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 31 May 2021 22:28:29 +0200
Subject: [PATCH 2129/2658] mac80211: drop A-MSDUs on old ciphers

commit 270032a2a9c4535799736142e1e7c413ca7b836e upstream.

With old ciphers (WEP and TKIP) we shouldn't be using A-MSDUs
since A-MSDUs are only supported if we know that they are, and
the only practical way for that is HT support which doesn't
support old ciphers.

However, we would normally accept them anyway. Since we check
the MMIC before deaggregating A-MSDUs, and the A-MSDU bit in
the QoS header is not protected in TKIP (or WEP), this enables
attacks similar to CVE-2020-24588. To prevent that, drop A-MSDUs
completely with old ciphers.

Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210511200110.076543300172.I548e6e71f1ee9cad4b9a37bf212ae7db723587aa@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/rx.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index ba231bc27d23..2efffd660d46 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2265,6 +2265,23 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
 	if (skb_linearize(skb))
 		return RX_DROP_UNUSABLE;
 
+	if (rx->key) {
+		/*
+		 * We should not receive A-MSDUs on pre-HT connections,
+		 * and HT connections cannot use old ciphers. Thus drop
+		 * them, as in those cases we couldn't even have SPP
+		 * A-MSDUs or such.
+		 */
+		switch (rx->key->conf.cipher) {
+		case WLAN_CIPHER_SUITE_WEP40:
+		case WLAN_CIPHER_SUITE_WEP104:
+		case WLAN_CIPHER_SUITE_TKIP:
+			return RX_DROP_UNUSABLE;
+		default:
+			break;
+		}
+	}
+
 	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
 				 rx->sdata->vif.type,
 				 rx->local->hw.extra_tx_headroom, true);

From df2fdc3535ca9f430c99f2318ae6fc43aab8d184 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 31 May 2021 22:28:30 +0200
Subject: [PATCH 2130/2658] mac80211: add fragment cache to sta_info

commit 3a11ce08c45b50d69c891d71760b7c5b92074709 upstream.

Prior patches protected against fragmentation cache attacks
by coloring keys, but this shows that it can lead to issues
when multiple stations use the same sequence number. Add a
fragment cache to struct sta_info (in addition to the one in
the interface) to separate fragments for different stations
properly.

This then automatically clear most of the fragment cache when a
station disconnects (or reassociates) from an AP, or when client
interfaces disconnect from the network, etc.

On the way, also fix the comment there since this brings us in line
with the recommendation in 802.11-2016 ("An AP should support ...").
Additionally, remove a useless condition (since there's no problem
purging an already empty list).

Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210511200110.fc35046b0d52.I1ef101e3784d13e8f6600d83de7ec9a3a45bcd52@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/ieee80211_i.h | 26 ++++--------------------
 net/mac80211/iface.c       |  9 ++-------
 net/mac80211/rx.c          | 41 ++++++++++++++++++++++++++++----------
 net/mac80211/sta_info.c    |  4 ++++
 net/mac80211/sta_info.h    | 30 ++++++++++++++++++++++++++++
 5 files changed, 70 insertions(+), 40 deletions(-)

diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 04561b8b81ff..110e721b0a9e 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -51,12 +51,6 @@ struct ieee80211_local;
 #define IEEE80211_ENCRYPT_HEADROOM 8
 #define IEEE80211_ENCRYPT_TAILROOM 18
 
-/* IEEE 802.11 (Ch. 9.5 Defragmentation) requires support for concurrent
- * reception of at least three fragmented frames. This limit can be increased
- * by changing this define, at the cost of slower frame reassembly and
- * increased memory use (about 2 kB of RAM per entry). */
-#define IEEE80211_FRAGMENT_MAX 4
-
 /* power level hasn't been configured (or set to automatic) */
 #define IEEE80211_UNSET_POWER_LEVEL	INT_MIN
 
@@ -85,19 +79,6 @@ struct ieee80211_local;
 
 #define IEEE80211_DEAUTH_FRAME_LEN	(24 /* hdr */ + 2 /* reason */)
 
-struct ieee80211_fragment_entry {
-	struct sk_buff_head skb_list;
-	unsigned long first_frag_time;
-	u16 seq;
-	u16 extra_len;
-	u16 last_frag;
-	u8 rx_queue;
-	bool check_sequential_pn; /* needed for CCMP/GCMP */
-	u8 last_pn[6]; /* PN of the last fragment if CCMP was used */
-	unsigned int key_color;
-};
-
-
 struct ieee80211_bss {
 	u32 device_ts_beacon, device_ts_presp;
 
@@ -836,9 +817,7 @@ struct ieee80211_sub_if_data {
 
 	char name[IFNAMSIZ];
 
-	/* Fragment table for host-based reassembly */
-	struct ieee80211_fragment_entry	fragments[IEEE80211_FRAGMENT_MAX];
-	unsigned int fragment_next;
+	struct ieee80211_fragment_cache frags;
 
 	/* TID bitmap for NoAck policy */
 	u16 noack_map;
@@ -2078,4 +2057,7 @@ extern const struct ethtool_ops ieee80211_ethtool_ops;
 #define debug_noinline
 #endif
 
+void ieee80211_init_frag_cache(struct ieee80211_fragment_cache *cache);
+void ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache *cache);
+
 #endif /* IEEE80211_I_H */
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index acaa00910ccf..1396c67cc1fa 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1083,16 +1083,12 @@ static void ieee80211_set_multicast_list(struct net_device *dev)
  */
 static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata)
 {
-	int i;
-
 	/* free extra data */
 	ieee80211_free_keys(sdata, false);
 
 	ieee80211_debugfs_remove_netdev(sdata);
 
-	for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++)
-		__skb_queue_purge(&sdata->fragments[i].skb_list);
-	sdata->fragment_next = 0;
+	ieee80211_destroy_frag_cache(&sdata->frags);
 
 	if (ieee80211_vif_is_mesh(&sdata->vif))
 		mesh_rmc_free(sdata);
@@ -1788,8 +1784,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
 	sdata->wdev.wiphy = local->hw.wiphy;
 	sdata->local = local;
 
-	for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++)
-		skb_queue_head_init(&sdata->fragments[i].skb_list);
+	ieee80211_init_frag_cache(&sdata->frags);
 
 	INIT_LIST_HEAD(&sdata->key_list);
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 2efffd660d46..80788091d034 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1739,19 +1739,34 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
 	return result;
 }
 
+void ieee80211_init_frag_cache(struct ieee80211_fragment_cache *cache)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
+		skb_queue_head_init(&cache->entries[i].skb_list);
+}
+
+void ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache *cache)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
+		__skb_queue_purge(&cache->entries[i].skb_list);
+}
+
 static inline struct ieee80211_fragment_entry *
-ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
+ieee80211_reassemble_add(struct ieee80211_fragment_cache *cache,
 			 unsigned int frag, unsigned int seq, int rx_queue,
 			 struct sk_buff **skb)
 {
 	struct ieee80211_fragment_entry *entry;
 
-	entry = &sdata->fragments[sdata->fragment_next++];
-	if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
-		sdata->fragment_next = 0;
+	entry = &cache->entries[cache->next++];
+	if (cache->next >= IEEE80211_FRAGMENT_MAX)
+		cache->next = 0;
 
-	if (!skb_queue_empty(&entry->skb_list))
-		__skb_queue_purge(&entry->skb_list);
+	__skb_queue_purge(&entry->skb_list);
 
 	__skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
 	*skb = NULL;
@@ -1766,14 +1781,14 @@ ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
 }
 
 static inline struct ieee80211_fragment_entry *
-ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
+ieee80211_reassemble_find(struct ieee80211_fragment_cache *cache,
 			  unsigned int frag, unsigned int seq,
 			  int rx_queue, struct ieee80211_hdr *hdr)
 {
 	struct ieee80211_fragment_entry *entry;
 	int i, idx;
 
-	idx = sdata->fragment_next;
+	idx = cache->next;
 	for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
 		struct ieee80211_hdr *f_hdr;
 
@@ -1781,7 +1796,7 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
 		if (idx < 0)
 			idx = IEEE80211_FRAGMENT_MAX - 1;
 
-		entry = &sdata->fragments[idx];
+		entry = &cache->entries[idx];
 		if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
 		    entry->rx_queue != rx_queue ||
 		    entry->last_frag + 1 != frag)
@@ -1821,6 +1836,7 @@ static bool requires_sequential_pn(struct ieee80211_rx_data *rx, __le16 fc)
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 {
+	struct ieee80211_fragment_cache *cache = &rx->sdata->frags;
 	struct ieee80211_hdr *hdr;
 	u16 sc;
 	__le16 fc;
@@ -1843,6 +1859,9 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 		goto out_no_led;
 	}
 
+	if (rx->sta)
+		cache = &rx->sta->frags;
+
 	if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
 		goto out;
 
@@ -1861,7 +1880,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 
 	if (frag == 0) {
 		/* This is the first fragment of a new frame. */
-		entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
+		entry = ieee80211_reassemble_add(cache, frag, seq,
 						 rx->seqno_idx, &(rx->skb));
 		if (requires_sequential_pn(rx, fc)) {
 			int queue = rx->security_idx;
@@ -1889,7 +1908,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 	/* This is a fragment for a frame that should already be pending in
 	 * fragment cache. Add this fragment to the end of the pending entry.
 	 */
-	entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
+	entry = ieee80211_reassemble_find(cache, frag, seq,
 					  rx->seqno_idx, hdr);
 	if (!entry) {
 		I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index c4b192e7f48f..5f2c8aeb9bd3 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -356,6 +356,8 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
 	sta->sdata = sdata;
 	sta->rx_stats.last_rx = jiffies;
 
+	ieee80211_init_frag_cache(&sta->frags);
+
 	sta->sta_state = IEEE80211_STA_NONE;
 
 	/* Mark TID as unreserved */
@@ -975,6 +977,8 @@ static void __sta_info_destroy_part2(struct sta_info *sta)
 	ieee80211_sta_debugfs_remove(sta);
 	ieee80211_recalc_min_chandef(sdata);
 
+	ieee80211_destroy_frag_cache(&sta->frags);
+
 	cleanup_single_sta(sta);
 }
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 15b0150283b6..1b178cc42d3a 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -324,6 +324,33 @@ struct mesh_sta {
 
 DECLARE_EWMA(signal, 1024, 8)
 
+/*
+ * IEEE 802.11-2016 (10.6 "Defragmentation") recommends support for "concurrent
+ * reception of at least one MSDU per access category per associated STA"
+ * on APs, or "at least one MSDU per access category" on other interface types.
+ *
+ * This limit can be increased by changing this define, at the cost of slower
+ * frame reassembly and increased memory use while fragments are pending.
+ */
+#define IEEE80211_FRAGMENT_MAX 4
+
+struct ieee80211_fragment_entry {
+	struct sk_buff_head skb_list;
+	unsigned long first_frag_time;
+	u16 seq;
+	u16 extra_len;
+	u16 last_frag;
+	u8 rx_queue;
+	bool check_sequential_pn; /* needed for CCMP/GCMP */
+	u8 last_pn[6]; /* PN of the last fragment if CCMP was used */
+	unsigned int key_color;
+};
+
+struct ieee80211_fragment_cache {
+	struct ieee80211_fragment_entry	entries[IEEE80211_FRAGMENT_MAX];
+	unsigned int next;
+};
+
 /**
  * struct sta_info - STA information
  *
@@ -384,6 +411,7 @@ DECLARE_EWMA(signal, 1024, 8)
  * @tx_stats: TX statistics
  * @rx_stats: RX statistics
  * @status_stats: TX status statistics
+ * @frags: fragment cache
  */
 struct sta_info {
 	/* General information, mostly static */
@@ -493,6 +521,8 @@ struct sta_info {
 
 	struct cfg80211_chan_def tdls_chandef;
 
+	struct ieee80211_fragment_cache frags;
+
 	/* keep last! */
 	struct ieee80211_sta sta;
 };

From d04fadfb18382a88bd9cbaf98d8344a67914bb69 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 31 May 2021 22:28:31 +0200
Subject: [PATCH 2131/2658] mac80211: check defrag PN against current frame

commit bf30ca922a0c0176007e074b0acc77ed345e9990 upstream.

As pointed out by Mathy Vanhoef, we implement the RX PN check
on fragmented frames incorrectly - we check against the last
received PN prior to the new frame, rather than to the one in
this frame itself.

Prior patches addressed the security issue here, but in order
to be able to reason better about the code, fix it to really
compare against the current frame's PN, not the last stored
one.

Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210511200110.bfbc340ff071.Id0b690e581da7d03d76df90bb0e3fd55930bc8a0@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/ieee80211.h  | 10 ++++++++++
 net/mac80211/ieee80211_i.h | 11 +++++++++--
 net/mac80211/rx.c          |  5 ++---
 net/mac80211/wpa.c         | 12 ++++++++----
 4 files changed, 29 insertions(+), 9 deletions(-)

diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 99b7ed47fc11..450ea5e38564 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -638,6 +638,16 @@ static inline bool ieee80211_is_first_frag(__le16 seq_ctrl)
 	return (seq_ctrl & cpu_to_le16(IEEE80211_SCTL_FRAG)) == 0;
 }
 
+/**
+ * ieee80211_is_frag - check if a frame is a fragment
+ * @hdr: 802.11 header of the frame
+ */
+static inline bool ieee80211_is_frag(struct ieee80211_hdr *hdr)
+{
+	return ieee80211_has_morefrags(hdr->frame_control) ||
+	       hdr->seq_ctrl & cpu_to_le16(IEEE80211_SCTL_FRAG);
+}
+
 struct ieee80211s_hdr {
 	u8 flags;
 	u8 ttl;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 110e721b0a9e..e9b34f1ec9f3 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -218,8 +218,15 @@ struct ieee80211_rx_data {
 	 */
 	int security_idx;
 
-	u32 tkip_iv32;
-	u16 tkip_iv16;
+	union {
+		struct {
+			u32 iv32;
+			u16 iv16;
+		} tkip;
+		struct {
+			u8 pn[IEEE80211_CCMP_PN_LEN];
+		} ccm_gcm;
+	};
 };
 
 struct ieee80211_csa_settings {
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 80788091d034..9cba383a5518 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1923,7 +1923,6 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 	if (entry->check_sequential_pn) {
 		int i;
 		u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
-		int queue;
 
 		if (!requires_sequential_pn(rx, fc))
 			return RX_DROP_UNUSABLE;
@@ -1938,8 +1937,8 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 			if (pn[i])
 				break;
 		}
-		queue = rx->security_idx;
-		rpn = rx->key->u.ccmp.rx_pn[queue];
+
+		rpn = rx->ccm_gcm.pn;
 		if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
 			return RX_DROP_UNUSABLE;
 		memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index cb439e06919f..921115327ec8 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -161,8 +161,8 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
 
 update_iv:
 	/* update IV in key information to be able to detect replays */
-	rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip_iv32;
-	rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip_iv16;
+	rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip.iv32;
+	rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip.iv16;
 
 	return RX_CONTINUE;
 
@@ -292,8 +292,8 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
 					  key, skb->data + hdrlen,
 					  skb->len - hdrlen, rx->sta->sta.addr,
 					  hdr->addr1, hwaccel, rx->security_idx,
-					  &rx->tkip_iv32,
-					  &rx->tkip_iv16);
+					  &rx->tkip.iv32,
+					  &rx->tkip.iv16);
 	if (res != TKIP_DECRYPT_OK)
 		return RX_DROP_UNUSABLE;
 
@@ -553,6 +553,8 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
 		}
 
 		memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN);
+		if (unlikely(ieee80211_is_frag(hdr)))
+			memcpy(rx->ccm_gcm.pn, pn, IEEE80211_CCMP_PN_LEN);
 	}
 
 	/* Remove CCMP header and MIC */
@@ -784,6 +786,8 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx)
 		}
 
 		memcpy(key->u.gcmp.rx_pn[queue], pn, IEEE80211_GCMP_PN_LEN);
+		if (unlikely(ieee80211_is_frag(hdr)))
+			memcpy(rx->ccm_gcm.pn, pn, IEEE80211_CCMP_PN_LEN);
 	}
 
 	/* Remove GCMP header and MIC */

From 38f2384975480cfead1b76c1ed9bae06ff9edd9f Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 31 May 2021 22:28:32 +0200
Subject: [PATCH 2132/2658] mac80211: prevent attacks on TKIP/WEP as well

commit 7e44a0b597f04e67eee8cdcbe7ee706c6f5de38b upstream.

Similar to the issues fixed in previous patches, TKIP and WEP
should be protected even if for TKIP we have the Michael MIC
protecting it, and WEP is broken anyway.

However, this also somewhat protects potential other algorithms
that drivers might implement.

Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210511200110.430e8c202313.Ia37e4e5b6b3eaab1a5ae050e015f6c92859dbe27@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/rx.c       | 12 ++++++++++++
 net/mac80211/sta_info.h |  3 ++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 9cba383a5518..41c52b5fba2a 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1889,6 +1889,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 			 * next fragment has a sequential PN value.
 			 */
 			entry->check_sequential_pn = true;
+			entry->is_protected = true;
 			entry->key_color = rx->key->color;
 			memcpy(entry->last_pn,
 			       rx->key->u.ccmp.rx_pn[queue],
@@ -1901,6 +1902,9 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 				     sizeof(rx->key->u.gcmp.rx_pn[queue]));
 			BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
 				     IEEE80211_GCMP_PN_LEN);
+		} else if (rx->key && ieee80211_has_protected(fc)) {
+			entry->is_protected = true;
+			entry->key_color = rx->key->color;
 		}
 		return RX_QUEUED;
 	}
@@ -1942,6 +1946,14 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 		if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
 			return RX_DROP_UNUSABLE;
 		memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
+	} else if (entry->is_protected &&
+		   (!rx->key || !ieee80211_has_protected(fc) ||
+		    rx->key->color != entry->key_color)) {
+		/* Drop this as a mixed key or fragment cache attack, even
+		 * if for TKIP Michael MIC should protect us, and WEP is a
+		 * lost cause anyway.
+		 */
+		return RX_DROP_UNUSABLE;
 	}
 
 	skb_pull(rx->skb, ieee80211_hdrlen(fc));
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 1b178cc42d3a..b2e5928b1f7b 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -341,7 +341,8 @@ struct ieee80211_fragment_entry {
 	u16 extra_len;
 	u16 last_frag;
 	u8 rx_queue;
-	bool check_sequential_pn; /* needed for CCMP/GCMP */
+	u8 check_sequential_pn:1, /* needed for CCMP/GCMP */
+	   is_protected:1;
 	u8 last_pn[6]; /* PN of the last fragment if CCMP was used */
 	unsigned int key_color;
 };

From 5ebfbac70d3779301ef70539ad003e49f815fceb Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 31 May 2021 22:28:33 +0200
Subject: [PATCH 2133/2658] mac80211: do not accept/forward invalid EAPOL
 frames

commit a8c4d76a8dd4fb9666fc8919a703d85fb8f44ed8 upstream.

EAPOL frames are used for authentication and key management between the
AP and each individual STA associated in the BSS. Those frames are not
supposed to be sent by one associated STA to another associated STA
(either unicast for broadcast/multicast).

Similarly, in 802.11 they're supposed to be sent to the authenticator
(AP) address.

Since it is possible for unexpected EAPOL frames to result in misbehavior
in supplicant implementations, it is better for the AP to not allow such
cases to be forwarded to other clients either directly, or indirectly if
the AP interface is part of a bridge.

Accept EAPOL (control port) frames only if they're transmitted to the
own address, or, due to interoperability concerns, to the PAE group
address.

Disable forwarding of EAPOL (or well, the configured control port
protocol) frames back to wireless medium in all cases. Previously, these
frames were accepted from fully authenticated and authorized stations
and also from unauthenticated stations for one of the cases.

Additionally, to avoid forwarding by the bridge, rewrite the PAE group
address case to the local MAC address.

Cc: stable@vger.kernel.org
Co-developed-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Link: https://lore.kernel.org/r/20210511200110.cb327ed0cabe.Ib7dcffa2a31f0913d660de65ba3c8aca75b1d10f@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/rx.c | 34 ++++++++++++++++++++++++++++------
 1 file changed, 28 insertions(+), 6 deletions(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 41c52b5fba2a..d1fb601910d6 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2142,13 +2142,13 @@ static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
 	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
 
 	/*
-	 * Allow EAPOL frames to us/the PAE group address regardless
-	 * of whether the frame was encrypted or not.
+	 * Allow EAPOL frames to us/the PAE group address regardless of
+	 * whether the frame was encrypted or not, and always disallow
+	 * all other destination addresses for them.
 	 */
-	if (ehdr->h_proto == rx->sdata->control_port_protocol &&
-	    (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
-	     ether_addr_equal(ehdr->h_dest, pae_group_addr)))
-		return true;
+	if (unlikely(ehdr->h_proto == rx->sdata->control_port_protocol))
+		return ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
+		       ether_addr_equal(ehdr->h_dest, pae_group_addr);
 
 	if (ieee80211_802_1x_port_control(rx) ||
 	    ieee80211_drop_unencrypted(rx, fc))
@@ -2177,6 +2177,7 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
 	if ((sdata->vif.type == NL80211_IFTYPE_AP ||
 	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
 	    !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
+	    ehdr->h_proto != rx->sdata->control_port_protocol &&
 	    (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
 		if (is_multicast_ether_addr(ehdr->h_dest)) {
 			/*
@@ -2229,9 +2230,30 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
 #endif
 
 	if (skb) {
+		struct ethhdr *ehdr = (void *)skb_mac_header(skb);
+
 		/* deliver to local stack */
 		skb->protocol = eth_type_trans(skb, dev);
 		memset(skb->cb, 0, sizeof(skb->cb));
+
+		/*
+		 * 802.1X over 802.11 requires that the authenticator address
+		 * be used for EAPOL frames. However, 802.1X allows the use of
+		 * the PAE group address instead. If the interface is part of
+		 * a bridge and we pass the frame with the PAE group address,
+		 * then the bridge will forward it to the network (even if the
+		 * client was not associated yet), which isn't supposed to
+		 * happen.
+		 * To avoid that, rewrite the destination address to our own
+		 * address, so that the authenticator (e.g. hostapd) will see
+		 * the frame, but bridge won't forward it anywhere else. Note
+		 * that due to earlier filtering, the only other address can
+		 * be the PAE group address.
+		 */
+		if (unlikely(skb->protocol == sdata->control_port_protocol &&
+			     !ether_addr_equal(ehdr->h_dest, sdata->vif.addr)))
+			ether_addr_copy(ehdr->h_dest, sdata->vif.addr);
+
 		if (rx->napi)
 			napi_gro_receive(rx->napi, skb);
 		else

From 64686273a2e4a11eb90e24d568dbeda6a15a65da Mon Sep 17 00:00:00 2001
From: Wen Gong <wgong@codeaurora.org>
Date: Mon, 31 May 2021 22:28:34 +0200
Subject: [PATCH 2134/2658] mac80211: extend protection against mixed key and
 fragment cache attacks

commit 3edc6b0d6c061a70d8ca3c3c72eb1f58ce29bfb1 upstream.

For some chips/drivers, e.g., QCA6174 with ath10k, the decryption is
done by the hardware, and the Protected bit in the Frame Control field
is cleared in the lower level driver before the frame is passed to
mac80211. In such cases, the condition for ieee80211_has_protected() is
not met in ieee80211_rx_h_defragment() of mac80211 and the new security
validation steps are not executed.

Extend mac80211 to cover the case where the Protected bit has been
cleared, but the frame is indicated as having been decrypted by the
hardware. This extends protection against mixed key and fragment cache
attack for additional drivers/chips. This fixes CVE-2020-24586 and
CVE-2020-24587 for such cases.

Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00110-QCARMSWP-1

Cc: stable@vger.kernel.org
Signed-off-by: Wen Gong <wgong@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Link: https://lore.kernel.org/r/20210511200110.037aa5ca0390.I7bb888e2965a0db02a67075fcb5deb50eb7408aa@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/rx.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index d1fb601910d6..2ffbeb041886 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1843,7 +1843,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 	unsigned int frag, seq;
 	struct ieee80211_fragment_entry *entry;
 	struct sk_buff *skb;
-	struct ieee80211_rx_status *status;
+	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
 
 	hdr = (struct ieee80211_hdr *)rx->skb->data;
 	fc = hdr->frame_control;
@@ -1902,7 +1902,9 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 				     sizeof(rx->key->u.gcmp.rx_pn[queue]));
 			BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
 				     IEEE80211_GCMP_PN_LEN);
-		} else if (rx->key && ieee80211_has_protected(fc)) {
+		} else if (rx->key &&
+			   (ieee80211_has_protected(fc) ||
+			    (status->flag & RX_FLAG_DECRYPTED))) {
 			entry->is_protected = true;
 			entry->key_color = rx->key->color;
 		}
@@ -1947,13 +1949,19 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 			return RX_DROP_UNUSABLE;
 		memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
 	} else if (entry->is_protected &&
-		   (!rx->key || !ieee80211_has_protected(fc) ||
+		   (!rx->key ||
+		    (!ieee80211_has_protected(fc) &&
+		     !(status->flag & RX_FLAG_DECRYPTED)) ||
 		    rx->key->color != entry->key_color)) {
 		/* Drop this as a mixed key or fragment cache attack, even
 		 * if for TKIP Michael MIC should protect us, and WEP is a
 		 * lost cause anyway.
 		 */
 		return RX_DROP_UNUSABLE;
+	} else if (entry->is_protected && rx->key &&
+		   entry->key_color != rx->key->color &&
+		   (status->flag & RX_FLAG_DECRYPTED)) {
+		return RX_DROP_UNUSABLE;
 	}
 
 	skb_pull(rx->skb, ieee80211_hdrlen(fc));

From 83789ed3b5f522aa8f87b89a0c7f37894888119c Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Tue, 25 May 2021 13:17:19 -0400
Subject: [PATCH 2135/2658] dm snapshot: properly fix a crash when an origin
 has no snapshots

commit 7e768532b2396bcb7fbf6f82384b85c0f1d2f197 upstream.

If an origin target has no snapshots, o->split_boundary is set to 0.
This causes BUG_ON(sectors <= 0) in block/bio.c:bio_split().

Fix this by initializing chunk_size, and in turn split_boundary, to
rounddown_pow_of_two(UINT_MAX) -- the largest power of two that fits
into "unsigned" type.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-snap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index e6f4a0d972a5..277af895d7c9 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -788,7 +788,7 @@ static int dm_add_exception(void *context, chunk_t old, chunk_t new)
 static uint32_t __minimum_chunk_size(struct origin *o)
 {
 	struct dm_snapshot *snap;
-	unsigned chunk_size = 0;
+	unsigned chunk_size = rounddown_pow_of_two(UINT_MAX);
 
 	if (o)
 		list_for_each_entry(snap, &o->snapshots, list)

From 820c94469802d34c9f7e64e7cad85b3061bba513 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 20 May 2021 15:08:39 +0200
Subject: [PATCH 2136/2658] kgdb: fix gcc-11 warnings harder

commit bda7d3ab06f19c02dcef61fefcb9dd954dfd5e4f upstream.

40cc3a80bb42 ("kgdb: fix gcc-11 warning on indentation") tried to fix up
the gcc-11 complaints in this file by just reformatting the #defines.
That worked for gcc 11.1.0, but in gcc 11.1.1 as shipped by Fedora 34,
the warning came back for one of the #defines.

Fix this up again by putting { } around the if statement, now it is
quiet again.

Fixes: 40cc3a80bb42 ("kgdb: fix gcc-11 warning on indentation")
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Daniel Thompson <daniel.thompson@linaro.org>
Cc: Jason Wessel <jason.wessel@windriver.com>
Link: https://lore.kernel.org/r/20210520130839.51987-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/kgdbts.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
index e4249ce2c42f..ab2184003c29 100644
--- a/drivers/misc/kgdbts.c
+++ b/drivers/misc/kgdbts.c
@@ -110,8 +110,9 @@
 		printk(KERN_INFO a);	\
 } while (0)
 #define v2printk(a...) do {		\
-	if (verbose > 1)		\
+	if (verbose > 1) {		\
 		printk(KERN_INFO a);	\
+	}				\
 	touch_nmi_watchdog();		\
 } while (0)
 #define eprintk(a...) do {		\

From 2eacd4b3c0619e29ecec53790333c88319767751 Mon Sep 17 00:00:00 2001
From: Dongliang Mu <mudongliangabcd@gmail.com>
Date: Fri, 14 May 2021 20:43:48 +0800
Subject: [PATCH 2137/2658] misc/uss720: fix memory leak in uss720_probe

commit dcb4b8ad6a448532d8b681b5d1a7036210b622de upstream.

uss720_probe forgets to decrease the refcount of usbdev in uss720_probe.
Fix this by decreasing the refcount of usbdev by usb_put_dev.

BUG: memory leak
unreferenced object 0xffff888101113800 (size 2048):
  comm "kworker/0:1", pid 7, jiffies 4294956777 (age 28.870s)
  hex dump (first 32 bytes):
    ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00  ....1...........
    00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00  ................
  backtrace:
    [<ffffffff82b8e822>] kmalloc include/linux/slab.h:554 [inline]
    [<ffffffff82b8e822>] kzalloc include/linux/slab.h:684 [inline]
    [<ffffffff82b8e822>] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582
    [<ffffffff82b98441>] hub_port_connect drivers/usb/core/hub.c:5129 [inline]
    [<ffffffff82b98441>] hub_port_connect_change drivers/usb/core/hub.c:5363 [inline]
    [<ffffffff82b98441>] port_event drivers/usb/core/hub.c:5509 [inline]
    [<ffffffff82b98441>] hub_event+0x1171/0x20c0 drivers/usb/core/hub.c:5591
    [<ffffffff81259229>] process_one_work+0x2c9/0x600 kernel/workqueue.c:2275
    [<ffffffff81259b19>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2421
    [<ffffffff81261228>] kthread+0x178/0x1b0 kernel/kthread.c:292
    [<ffffffff8100227f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Fixes: 0f36163d3abe ("[PATCH] usb: fix uss720 schedule with interrupts off")
Cc: stable <stable@vger.kernel.org>
Reported-by: syzbot+636c58f40a86b4a879e7@syzkaller.appspotmail.com
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Link: https://lore.kernel.org/r/20210514124348.6587-1-mudongliangabcd@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/misc/uss720.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
index 3d750671b85a..9a4138da3b88 100644
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -753,6 +753,7 @@ static int uss720_probe(struct usb_interface *intf,
 	parport_announce_port(pp);
 
 	usb_set_intfdata(intf, pp);
+	usb_put_dev(usbdev);
 	return 0;
 
 probe_abort:

From e6c372aee92a1f81a4f423c7d93cf6f6055be744 Mon Sep 17 00:00:00 2001
From: Alexander Usyskin <alexander.usyskin@intel.com>
Date: Wed, 26 May 2021 22:33:34 +0300
Subject: [PATCH 2138/2658] mei: request autosuspend after sending rx flow
 control

commit bbf0a94744edfeee298e4a9ab6fd694d639a5cdf upstream.

A rx flow control waiting in the control queue may block autosuspend.
Re-request autosuspend after flow control been sent to unblock
the transition to the low power state.

Cc: <stable@vger.kernel.org>
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20210526193334.445759-1-tomas.winkler@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/mei/interrupt.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c
index d1df797c7568..85bf730c7c91 100644
--- a/drivers/misc/mei/interrupt.c
+++ b/drivers/misc/mei/interrupt.c
@@ -220,6 +220,9 @@ static int mei_cl_irq_read(struct mei_cl *cl, struct mei_cl_cb *cb,
 		return ret;
 	}
 
+	pm_runtime_mark_last_busy(dev->dev);
+	pm_request_autosuspend(dev->dev);
+
 	list_move_tail(&cb->list, &cl->rd_pending);
 
 	return 0;

From 8bb2001fe836d69afd6cef390b334d0626f374d4 Mon Sep 17 00:00:00 2001
From: Lucas Stankus <lucas.p.stankus@gmail.com>
Date: Tue, 11 May 2021 17:54:18 -0300
Subject: [PATCH 2139/2658] staging: iio: cdc: ad7746: avoid overwrite of
 num_channels

commit 04f5b9f539ce314f758d919a14dc7a669f3b7838 upstream.

AD7745 devices don't have the CIN2 pins and therefore can't handle related
channels. Forcing the number of AD7746 channels may lead to enabling more
channels than what the hardware actually supports.
Avoid num_channels being overwritten after first assignment.

Signed-off-by: Lucas Stankus <lucas.p.stankus@gmail.com>
Fixes: 83e416f458d53 ("staging: iio: adc: Replace, rewrite ad7745 from scratch.")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/iio/cdc/ad7746.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/staging/iio/cdc/ad7746.c b/drivers/staging/iio/cdc/ad7746.c
index 2c5d27784ed3..6604c0508290 100644
--- a/drivers/staging/iio/cdc/ad7746.c
+++ b/drivers/staging/iio/cdc/ad7746.c
@@ -714,7 +714,6 @@ static int ad7746_probe(struct i2c_client *client,
 		indio_dev->num_channels = ARRAY_SIZE(ad7746_channels);
 	else
 		indio_dev->num_channels =  ARRAY_SIZE(ad7746_channels) - 2;
-	indio_dev->num_channels = ARRAY_SIZE(ad7746_channels);
 	indio_dev->modes = INDIO_DIRECT_MODE;
 
 	if (pdata) {

From 1f972ca19cf5c02728d4371f9bfbbb93e14e5764 Mon Sep 17 00:00:00 2001
From: YueHaibing <yuehaibing@huawei.com>
Date: Fri, 14 May 2021 16:02:54 +0800
Subject: [PATCH 2140/2658] iio: adc: ad7793: Add missing error code in
 ad7793_setup()

commit 4ed243b1da169bcbc1ec5507867e56250c5f1ff9 upstream.

Set error code while device ID query failed.

Fixes: 88bc30548aae ("IIO: ADC: New driver for AD7792/AD7793 3 Channel SPI ADC")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/ad7793.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c
index fe0c5a155e21..2e89937b5629 100644
--- a/drivers/iio/adc/ad7793.c
+++ b/drivers/iio/adc/ad7793.c
@@ -279,6 +279,7 @@ static int ad7793_setup(struct iio_dev *indio_dev,
 	id &= AD7793_ID_MASK;
 
 	if (id != st->chip_info->id) {
+		ret = -ENODEV;
 		dev_err(&st->sd.spi->dev, "device ID query failed\n");
 		goto out;
 	}

From fd31faf5b1fdc5c9d6cbd269e19f917bcc8ad9e3 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Fri, 21 May 2021 15:31:09 +0200
Subject: [PATCH 2141/2658] USB: trancevibrator: fix control-request direction

commit 746e4acf87bcacf1406e05ef24a0b7139147c63e upstream.

The direction of the pipe argument must match the request-type direction
bit or control requests may fail depending on the host-controller-driver
implementation.

Fix the set-speed request which erroneously used USB_DIR_IN and update
the default timeout argument to match (same value).

Fixes: 5638e4d92e77 ("USB: add PlayStation 2 Trance Vibrator driver")
Cc: stable@vger.kernel.org      # 2.6.19
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210521133109.17396-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/misc/trancevibrator.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/misc/trancevibrator.c b/drivers/usb/misc/trancevibrator.c
index 4145314a515b..bd256ede6149 100644
--- a/drivers/usb/misc/trancevibrator.c
+++ b/drivers/usb/misc/trancevibrator.c
@@ -74,9 +74,9 @@ static ssize_t set_speed(struct device *dev, struct device_attribute *attr,
 	/* Set speed */
 	retval = usb_control_msg(tv->udev, usb_sndctrlpipe(tv->udev, 0),
 				 0x01, /* vendor request: set speed */
-				 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_OTHER,
+				 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER,
 				 tv->speed, /* speed value */
-				 0, NULL, 0, USB_CTRL_GET_TIMEOUT);
+				 0, NULL, 0, USB_CTRL_SET_TIMEOUT);
 	if (retval) {
 		tv->speed = old;
 		dev_dbg(&tv->udev->dev, "retval = %d\n", retval);

From b5a612622201cf3f1768902b88e29923f6218df6 Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Fri, 21 May 2021 06:08:43 +0000
Subject: [PATCH 2142/2658] serial: rp2: use 'request_firmware' instead of
 'request_firmware_nowait'

commit 016002848c82eeb5d460489ce392d91fe18c475c upstream.

In 'rp2_probe', the driver registers 'rp2_uart_interrupt' then calls
'rp2_fw_cb' through 'request_firmware_nowait'. In 'rp2_fw_cb', if the
firmware don't exists, function just return without initializing ports
of 'rp2_card'. But now the interrupt handler function has been
registered, and when an interrupt comes, 'rp2_uart_interrupt' may access
those ports then causing NULL pointer dereference or other bugs.

Because the driver does some initialization work in 'rp2_fw_cb', in
order to make the driver ready to handle interrupts, 'request_firmware'
should be used instead of asynchronous 'request_firmware_nowait'.

This report reveals it:

INFO: trying to register non-static key.
the code is fine but needs lockdep annotation.
turning off the locking correctness validator.
CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.19.177-gdba4159c14ef-dirty #45
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-
gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xec/0x156 lib/dump_stack.c:118
 assign_lock_key kernel/locking/lockdep.c:727 [inline]
 register_lock_class+0x14e5/0x1ba0 kernel/locking/lockdep.c:753
 __lock_acquire+0x187/0x3750 kernel/locking/lockdep.c:3303
 lock_acquire+0x124/0x340 kernel/locking/lockdep.c:3907
 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
 _raw_spin_lock+0x32/0x50 kernel/locking/spinlock.c:144
 spin_lock include/linux/spinlock.h:329 [inline]
 rp2_ch_interrupt drivers/tty/serial/rp2.c:466 [inline]
 rp2_asic_interrupt.isra.9+0x15d/0x990 drivers/tty/serial/rp2.c:493
 rp2_uart_interrupt+0x49/0xe0 drivers/tty/serial/rp2.c:504
 __handle_irq_event_percpu+0xfb/0x770 kernel/irq/handle.c:149
 handle_irq_event_percpu+0x79/0x150 kernel/irq/handle.c:189
 handle_irq_event+0xac/0x140 kernel/irq/handle.c:206
 handle_fasteoi_irq+0x232/0x5c0 kernel/irq/chip.c:725
 generic_handle_irq_desc include/linux/irqdesc.h:155 [inline]
 handle_irq+0x230/0x3a0 arch/x86/kernel/irq_64.c:87
 do_IRQ+0xa7/0x1e0 arch/x86/kernel/irq.c:247
 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670
 </IRQ>
RIP: 0010:native_safe_halt+0x28/0x30 arch/x86/include/asm/irqflags.h:61
Code: 00 00 55 be 04 00 00 00 48 c7 c7 00 c2 2f 8c 48 89 e5 e8 fb 31 e7 f8
8b 05 75 af 8d 03 85 c0 7e 07 0f 00 2d 8a 61 65 00 fb f4 <5d> c3 90 90 90
90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41
RSP: 0018:ffff88806b71fcc8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffde
RAX: 0000000000000000 RBX: ffffffff8bde7e48 RCX: ffffffff88a21285
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff8c2fc200
RBP: ffff88806b71fcc8 R08: fffffbfff185f840 R09: fffffbfff185f840
R10: 0000000000000001 R11: fffffbfff185f840 R12: 0000000000000002
R13: ffffffff8bea18a0 R14: 0000000000000000 R15: 0000000000000000
 arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline]
 default_idle+0x6f/0x360 arch/x86/kernel/process.c:557
 arch_cpu_idle+0xf/0x20 arch/x86/kernel/process.c:548
 default_idle_call+0x3b/0x60 kernel/sched/idle.c:93
 cpuidle_idle_call kernel/sched/idle.c:153 [inline]
 do_idle+0x2ab/0x3c0 kernel/sched/idle.c:263
 cpu_startup_entry+0xcb/0xe0 kernel/sched/idle.c:369
 start_secondary+0x3b8/0x4e0 arch/x86/kernel/smpboot.c:271
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243
BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
PGD 8000000056d27067 P4D 8000000056d27067 PUD 56d28067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.19.177-gdba4159c14ef-dirty #45
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-
gc9ba5276e321-prebuilt.qemu.org 04/01/2014
RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]
RIP: 0010:rp2_ch_interrupt drivers/tty/serial/rp2.c:472 [inline]
RIP: 0010:rp2_asic_interrupt.isra.9+0x181/0x990 drivers/tty/serial/rp2.c:
493
Code: df e8 43 5d c2 05 48 8d 83 e8 01 00 00 48 89 85 60 ff ff ff 48 c1 e8
03 42 80 3c 30 00 0f 85 aa 07 00 00 48 8b 83 e8 01 00 00 <8b> 40 10 89 c1
89 85 68 ff ff ff 48 8b 83 e8 01 00 00 89 48 10 83
RSP: 0018:ffff88806c287cd0 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88806ade6820 RCX: ffffffff814300b1
RDX: 1ffff1100d5bcd06 RSI: 0000000000000004 RDI: ffff88806ade6820
RBP: ffff88806c287db8 R08: ffffed100d5bcd05 R09: ffffed100d5bcd05
R10: 0000000000000001 R11: ffffed100d5bcd04 R12: ffffc90001e00000
R13: ffff888069654e10 R14: dffffc0000000000 R15: ffff888069654df0
FS:  0000000000000000(0000) GS:ffff88806c280000(0000) knlGS:
0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 000000006892c000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 rp2_uart_interrupt+0x49/0xe0 drivers/tty/serial/rp2.c:504
 __handle_irq_event_percpu+0xfb/0x770 kernel/irq/handle.c:149
 handle_irq_event_percpu+0x79/0x150 kernel/irq/handle.c:189
 handle_irq_event+0xac/0x140 kernel/irq/handle.c:206
 handle_fasteoi_irq+0x232/0x5c0 kernel/irq/chip.c:725
 generic_handle_irq_desc include/linux/irqdesc.h:155 [inline]
 handle_irq+0x230/0x3a0 arch/x86/kernel/irq_64.c:87
 do_IRQ+0xa7/0x1e0 arch/x86/kernel/irq.c:247
 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670
 </IRQ>
RIP: 0010:native_safe_halt+0x28/0x30 arch/x86/include/asm/irqflags.h:61
Code: 00 00 55 be 04 00 00 00 48 c7 c7 00 c2 2f 8c 48 89 e5 e8 fb 31 e7
f8 8b 05 75 af 8d 03 85 c0 7e 07 0f 00 2d 8a 61 65 00 fb f4 <5d> c3 90
90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41
RSP: 0018:ffff88806b71fcc8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffde
RAX: 0000000000000000 RBX: ffffffff8bde7e48 RCX: ffffffff88a21285
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff8c2fc200
RBP: ffff88806b71fcc8 R08: fffffbfff185f840 R09: fffffbfff185f840
R10: 0000000000000001 R11: fffffbfff185f840 R12: 0000000000000002
R13: ffffffff8bea18a0 R14: 0000000000000000 R15: 0000000000000000
 arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline]
 default_idle+0x6f/0x360 arch/x86/kernel/process.c:557
 arch_cpu_idle+0xf/0x20 arch/x86/kernel/process.c:548
 default_idle_call+0x3b/0x60 kernel/sched/idle.c:93
 cpuidle_idle_call kernel/sched/idle.c:153 [inline]
 do_idle+0x2ab/0x3c0 kernel/sched/idle.c:263
 cpu_startup_entry+0xcb/0xe0 kernel/sched/idle.c:369
 start_secondary+0x3b8/0x4e0 arch/x86/kernel/smpboot.c:271
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
CR2: 0000000000000010
---[ end trace 11804dbb55cb1a64 ]---
RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]
RIP: 0010:rp2_ch_interrupt drivers/tty/serial/rp2.c:472 [inline]
RIP: 0010:rp2_asic_interrupt.isra.9+0x181/0x990 drivers/tty/serial/rp2.c:
493
Code: df e8 43 5d c2 05 48 8d 83 e8 01 00 00 48 89 85 60 ff ff ff 48 c1
e8 03 42 80 3c 30 00 0f 85 aa 07 00 00 48 8b 83 e8 01 00 00 <8b> 40 10 89
c1 89 85 68 ff ff ff 48 8b 83 e8 01 00 00 89 48 10 83
RSP: 0018:ffff88806c287cd0 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88806ade6820 RCX: ffffffff814300b1
RDX: 1ffff1100d5bcd06 RSI: 0000000000000004 RDI: ffff88806ade6820
RBP: ffff88806c287db8 R08: ffffed100d5bcd05 R09: ffffed100d5bcd05
R10: 0000000000000001 R11: ffffed100d5bcd04 R12: ffffc90001e00000
R13: ffff888069654e10 R14: dffffc0000000000 R15: ffff888069654df0
FS:  0000000000000000(0000) GS:ffff88806c280000(0000) knlGS:
0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 000000006892c000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Reported-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Link: https://lore.kernel.org/r/1621577323-1541-1-git-send-email-zheyuma97@gmail.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/rp2.c | 52 +++++++++++++---------------------------
 1 file changed, 17 insertions(+), 35 deletions(-)

diff --git a/drivers/tty/serial/rp2.c b/drivers/tty/serial/rp2.c
index 056f91b3a4ca..b7d1b1645c84 100644
--- a/drivers/tty/serial/rp2.c
+++ b/drivers/tty/serial/rp2.c
@@ -198,7 +198,6 @@ struct rp2_card {
 	void __iomem			*bar0;
 	void __iomem			*bar1;
 	spinlock_t			card_lock;
-	struct completion		fw_loaded;
 };
 
 #define RP_ID(prod) PCI_VDEVICE(RP, (prod))
@@ -667,17 +666,10 @@ static void rp2_remove_ports(struct rp2_card *card)
 	card->initialized_ports = 0;
 }
 
-static void rp2_fw_cb(const struct firmware *fw, void *context)
+static int rp2_load_firmware(struct rp2_card *card, const struct firmware *fw)
 {
-	struct rp2_card *card = context;
 	resource_size_t phys_base;
-	int i, rc = -ENOENT;
-
-	if (!fw) {
-		dev_err(&card->pdev->dev, "cannot find '%s' firmware image\n",
-			RP2_FW_NAME);
-		goto no_fw;
-	}
+	int i, rc = 0;
 
 	phys_base = pci_resource_start(card->pdev, 1);
 
@@ -723,23 +715,13 @@ static void rp2_fw_cb(const struct firmware *fw, void *context)
 		card->initialized_ports++;
 	}
 
-	release_firmware(fw);
-no_fw:
-	/*
-	 * rp2_fw_cb() is called from a workqueue long after rp2_probe()
-	 * has already returned success.  So if something failed here,
-	 * we'll just leave the now-dormant device in place until somebody
-	 * unbinds it.
-	 */
-	if (rc)
-		dev_warn(&card->pdev->dev, "driver initialization failed\n");
-
-	complete(&card->fw_loaded);
+	return rc;
 }
 
 static int rp2_probe(struct pci_dev *pdev,
 				   const struct pci_device_id *id)
 {
+	const struct firmware *fw;
 	struct rp2_card *card;
 	struct rp2_uart_port *ports;
 	void __iomem * const *bars;
@@ -750,7 +732,6 @@ static int rp2_probe(struct pci_dev *pdev,
 		return -ENOMEM;
 	pci_set_drvdata(pdev, card);
 	spin_lock_init(&card->card_lock);
-	init_completion(&card->fw_loaded);
 
 	rc = pcim_enable_device(pdev);
 	if (rc)
@@ -783,21 +764,23 @@ static int rp2_probe(struct pci_dev *pdev,
 		return -ENOMEM;
 	card->ports = ports;
 
-	rc = devm_request_irq(&pdev->dev, pdev->irq, rp2_uart_interrupt,
-			      IRQF_SHARED, DRV_NAME, card);
-	if (rc)
+	rc = request_firmware(&fw, RP2_FW_NAME, &pdev->dev);
+	if (rc < 0) {
+		dev_err(&pdev->dev, "cannot find '%s' firmware image\n",
+			RP2_FW_NAME);
 		return rc;
+	}
 
-	/*
-	 * Only catastrophic errors (e.g. ENOMEM) are reported here.
-	 * If the FW image is missing, we'll find out in rp2_fw_cb()
-	 * and print an error message.
-	 */
-	rc = request_firmware_nowait(THIS_MODULE, 1, RP2_FW_NAME, &pdev->dev,
-				     GFP_KERNEL, card, rp2_fw_cb);
+	rc = rp2_load_firmware(card, fw);
+
+	release_firmware(fw);
+	if (rc < 0)
+		return rc;
+
+	rc = devm_request_irq(&pdev->dev, pdev->irq, rp2_uart_interrupt,
+			      IRQF_SHARED, DRV_NAME, card);
 	if (rc)
 		return rc;
-	dev_dbg(&pdev->dev, "waiting for firmware blob...\n");
 
 	return 0;
 }
@@ -806,7 +789,6 @@ static void rp2_remove(struct pci_dev *pdev)
 {
 	struct rp2_card *card = pci_get_drvdata(pdev);
 
-	wait_for_completion(&card->fw_loaded);
 	rp2_remove_ports(card);
 }
 

From 8552c217fc2cd767a5c853869e0f5a89dd930138 Mon Sep 17 00:00:00 2001
From: Daniele Palmas <dnlplm@gmail.com>
Date: Wed, 28 Apr 2021 09:26:34 +0200
Subject: [PATCH 2143/2658] USB: serial: option: add Telit LE910-S1
 compositions 0x7010, 0x7011

commit e467714f822b5d167a7fb03d34af91b5b6af1827 upstream.

Add support for the following Telit LE910-S1 compositions:

0x7010: rndis, tty, tty, tty
0x7011: ecm, tty, tty, tty

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Link: https://lore.kernel.org/r/20210428072634.5091-1-dnlplm@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 351be7386280..6faa9ac53887 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1222,6 +1222,10 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = NCTRL(0) | RSVD(1) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff),	/* Telit LN940 (MBIM) */
 	  .driver_info = NCTRL(0) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7010, 0xff),	/* Telit LE910-S1 (RNDIS) */
+	  .driver_info = NCTRL(2) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7011, 0xff),	/* Telit LE910-S1 (ECM) */
+	  .driver_info = NCTRL(2) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, 0x9010),				/* Telit SBL FN980 flashing device */
 	  .driver_info = NCTRL(0) | ZLP },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */

From 10edb183dc2ab722fc6610eb1d69d000a5254f9b Mon Sep 17 00:00:00 2001
From: Dominik Andreas Schorpp <dominik.a.schorpp@ids.de>
Date: Thu, 22 Apr 2021 09:58:52 +0200
Subject: [PATCH 2144/2658] USB: serial: ftdi_sio: add IDs for IDS GmbH
 Products

commit c5a80540e425a5f9a82b0f3163e3b6a4331f33bc upstream.

Add the IDS GmbH Vendor ID and the Product IDs for SI31A (2xRS232)
and CM31A (LoRaWAN Modem).

Signed-off-by: Dominik Andreas Schorpp <dominik.a.schorpp@ids.de>
Signed-off-by: Juergen Borleis <jbe@pengutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/ftdi_sio.c     | 3 +++
 drivers/usb/serial/ftdi_sio_ids.h | 7 +++++++
 2 files changed, 10 insertions(+)

diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 5b42b8d760cb..3d02399ad49e 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1029,6 +1029,9 @@ static const struct usb_device_id id_table_combined[] = {
 	/* Sienna devices */
 	{ USB_DEVICE(FTDI_VID, FTDI_SIENNA_PID) },
 	{ USB_DEVICE(ECHELON_VID, ECHELON_U20_PID) },
+	/* IDS GmbH devices */
+	{ USB_DEVICE(IDS_VID, IDS_SI31A_PID) },
+	{ USB_DEVICE(IDS_VID, IDS_CM31A_PID) },
 	/* U-Blox devices */
 	{ USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) },
 	{ USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index f3302516a1e4..b5f28a795228 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1566,6 +1566,13 @@
 #define UNJO_VID			0x22B7
 #define UNJO_ISODEBUG_V1_PID		0x150D
 
+/*
+ * IDS GmbH
+ */
+#define IDS_VID				0x2CAF
+#define IDS_SI31A_PID			0x13A2
+#define IDS_CM31A_PID			0x13A3
+
 /*
  * U-Blox products (http://www.u-blox.com).
  */

From 9d4922dbf217cb816298314f2d16aa05ec9c2371 Mon Sep 17 00:00:00 2001
From: Zolton Jheng <s6668c2t@gmail.com>
Date: Mon, 10 May 2021 10:32:00 +0800
Subject: [PATCH 2145/2658] USB: serial: pl2303: add device id for ADLINK
 ND-6530 GC

commit f8e8c1b2f782e7391e8a1c25648ce756e2a7d481 upstream.

This adds the device id for the ADLINK ND-6530 which is a PL2303GC based
device.

Signed-off-by: Zolton Jheng <s6668c2t@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/pl2303.c | 1 +
 drivers/usb/serial/pl2303.h | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index bf5533d6d83b..3dd0bbb36dd2 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -102,6 +102,7 @@ static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
 	{ USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) },
 	{ USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) },
+	{ USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530GC_PRODUCT_ID) },
 	{ USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) },
 	{ USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) },
 	{ }					/* Terminating entry */
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 9d27c076f477..62b8cd673aa1 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -156,6 +156,7 @@
 /* ADLINK ND-6530 RS232,RS485 and RS422 adapter */
 #define ADLINK_VENDOR_ID		0x0b63
 #define ADLINK_ND6530_PRODUCT_ID	0x6530
+#define ADLINK_ND6530GC_PRODUCT_ID	0x653a
 
 /* SMART USB Serial Adapter */
 #define SMART_VENDOR_ID	0x0b8c

From d44e7a3f95f8faedd87237f94531135d3b5ce8c8 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Mon, 24 May 2021 23:02:08 +0300
Subject: [PATCH 2146/2658] net: usb: fix memory leak in smsc75xx_bind

commit 46a8b29c6306d8bbfd92b614ef65a47c900d8e70 upstream.

Syzbot reported memory leak in smsc75xx_bind().
The problem was is non-freed memory in case of
errors after memory allocation.

backtrace:
  [<ffffffff84245b62>] kmalloc include/linux/slab.h:556 [inline]
  [<ffffffff84245b62>] kzalloc include/linux/slab.h:686 [inline]
  [<ffffffff84245b62>] smsc75xx_bind+0x7a/0x334 drivers/net/usb/smsc75xx.c:1460
  [<ffffffff82b5b2e6>] usbnet_probe+0x3b6/0xc30 drivers/net/usb/usbnet.c:1728

Fixes: d0cad871703b ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver")
Cc: stable@kernel.vger.org
Reported-and-tested-by: syzbot+b558506ba8165425fee2@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/smsc75xx.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index 234febc6e1d9..850bb147f4b0 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -1485,7 +1485,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
 	ret = smsc75xx_wait_ready(dev, 0);
 	if (ret < 0) {
 		netdev_warn(dev->net, "device not ready in smsc75xx_bind\n");
-		return ret;
+		goto err;
 	}
 
 	smsc75xx_init_mac_address(dev);
@@ -1494,7 +1494,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
 	ret = smsc75xx_reset(dev);
 	if (ret < 0) {
 		netdev_warn(dev->net, "smsc75xx_reset error %d\n", ret);
-		return ret;
+		goto err;
 	}
 
 	dev->net->netdev_ops = &smsc75xx_netdev_ops;
@@ -1503,6 +1503,10 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
 	dev->net->hard_header_len += SMSC75XX_TX_OVERHEAD;
 	dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
 	return 0;
+
+err:
+	kfree(pdata);
+	return ret;
 }
 
 static void smsc75xx_unbind(struct usbnet *dev, struct usb_interface *intf)

From ff7ab060535a5a9ccd625762d1d5f1ce5cb1e840 Mon Sep 17 00:00:00 2001
From: "William A. Kennington III" <wak@google.com>
Date: Wed, 7 Apr 2021 02:55:27 -0700
Subject: [PATCH 2147/2658] spi: Fix use-after-free with devm_spi_alloc_*

commit 794aaf01444d4e765e2b067cba01cc69c1c68ed9 upstream.

We can't rely on the contents of the devres list during
spi_unregister_controller(), as the list is already torn down at the
time we perform devres_find() for devm_spi_release_controller. This
causes devices registered with devm_spi_alloc_{master,slave}() to be
mistakenly identified as legacy, non-devm managed devices and have their
reference counters decremented below 0.

------------[ cut here ]------------
WARNING: CPU: 1 PID: 660 at lib/refcount.c:28 refcount_warn_saturate+0x108/0x174
[<b0396f04>] (refcount_warn_saturate) from [<b03c56a4>] (kobject_put+0x90/0x98)
[<b03c5614>] (kobject_put) from [<b0447b4c>] (put_device+0x20/0x24)
 r4:b6700140
[<b0447b2c>] (put_device) from [<b07515e8>] (devm_spi_release_controller+0x3c/0x40)
[<b07515ac>] (devm_spi_release_controller) from [<b045343c>] (release_nodes+0x84/0xc4)
 r5:b6700180 r4:b6700100
[<b04533b8>] (release_nodes) from [<b0454160>] (devres_release_all+0x5c/0x60)
 r8:b1638c54 r7:b117ad94 r6:b1638c10 r5:b117ad94 r4:b163dc10
[<b0454104>] (devres_release_all) from [<b044e41c>] (__device_release_driver+0x144/0x1ec)
 r5:b117ad94 r4:b163dc10
[<b044e2d8>] (__device_release_driver) from [<b044f70c>] (device_driver_detach+0x84/0xa0)
 r9:00000000 r8:00000000 r7:b117ad94 r6:b163dc54 r5:b1638c10 r4:b163dc10
[<b044f688>] (device_driver_detach) from [<b044d274>] (unbind_store+0xe4/0xf8)

Instead, determine the devm allocation state as a flag on the
controller which is guaranteed to be stable during cleanup.

Fixes: 5e844cc37a5c ("spi: Introduce device-managed SPI controller allocation")
Signed-off-by: William A. Kennington III <wak@google.com>
Link: https://lore.kernel.org/r/20210407095527.2771582-1-wak@google.com
Signed-off-by: Mark Brown <broonie@kernel.org>
[lukas: backport to v4.4.270]
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi.c       | 9 ++-------
 include/linux/spi/spi.h | 3 +++
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index e85feee750e3..f743b95d5171 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1762,6 +1762,7 @@ struct spi_master *devm_spi_alloc_master(struct device *dev, unsigned int size)
 
 	master = spi_alloc_master(dev, size);
 	if (master) {
+		master->devm_allocated = true;
 		*ptr = master;
 		devres_add(dev, ptr);
 	} else {
@@ -1951,11 +1952,6 @@ int devm_spi_register_master(struct device *dev, struct spi_master *master)
 }
 EXPORT_SYMBOL_GPL(devm_spi_register_master);
 
-static int devm_spi_match_master(struct device *dev, void *res, void *master)
-{
-	return *(struct spi_master **)res == master;
-}
-
 static int __unregister(struct device *dev, void *null)
 {
 	spi_unregister_device(to_spi_device(dev));
@@ -1994,8 +1990,7 @@ void spi_unregister_master(struct spi_master *master)
 	/* Release the last reference on the master if its driver
 	 * has not yet been converted to devm_spi_alloc_master().
 	 */
-	if (!devres_find(master->dev.parent, devm_spi_release_master,
-			 devm_spi_match_master, master))
+	if (!master->devm_allocated)
 		put_device(&master->dev);
 
 	if (IS_ENABLED(CONFIG_SPI_DYNAMIC))
diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
index f5d387140c46..da487e905337 100644
--- a/include/linux/spi/spi.h
+++ b/include/linux/spi/spi.h
@@ -425,6 +425,9 @@ struct spi_master {
 #define SPI_MASTER_MUST_RX      BIT(3)		/* requires rx */
 #define SPI_MASTER_MUST_TX      BIT(4)		/* requires tx */
 
+	/* flag indicating this is a non-devres managed controller */
+	bool			devm_allocated;
+
 	/* lock and mutex for SPI bus locking */
 	spinlock_t		bus_lock_spinlock;
 	struct mutex		bus_lock_mutex;

From 01e835ca5370294b3373e09ee913a129a06a8d8b Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@wunner.de>
Date: Mon, 7 Dec 2020 09:17:04 +0100
Subject: [PATCH 2148/2658] spi: spi-sh: Fix use-after-free on unbind

commit e77df3eca12be4b17f13cf9f215cff248c57d98f upstream.

spi_sh_remove() accesses the driver's private data after calling
spi_unregister_master() even though that function releases the last
reference on the spi_master and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.

Fixes: 680c1305e259 ("spi/spi_sh: use spi_unregister_master instead of spi_master_put in remove path")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v3.0+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v3.0+
Cc: Axel Lin <axel.lin@ingics.com>
Link: https://lore.kernel.org/r/6d97628b536baf01d5e3e39db61108f84d44c8b2.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
[lukas: backport to v4.4.270]
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi-sh.c | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/drivers/spi/spi-sh.c b/drivers/spi/spi-sh.c
index 502501187c9e..f062ebb46e0e 100644
--- a/drivers/spi/spi-sh.c
+++ b/drivers/spi/spi-sh.c
@@ -451,7 +451,7 @@ static int spi_sh_probe(struct platform_device *pdev)
 		return -ENODEV;
 	}
 
-	master = spi_alloc_master(&pdev->dev, sizeof(struct spi_sh_data));
+	master = devm_spi_alloc_master(&pdev->dev, sizeof(struct spi_sh_data));
 	if (master == NULL) {
 		dev_err(&pdev->dev, "spi_alloc_master error.\n");
 		return -ENOMEM;
@@ -469,16 +469,14 @@ static int spi_sh_probe(struct platform_device *pdev)
 		break;
 	default:
 		dev_err(&pdev->dev, "No support width\n");
-		ret = -ENODEV;
-		goto error1;
+		return -ENODEV;
 	}
 	ss->irq = irq;
 	ss->master = master;
 	ss->addr = devm_ioremap(&pdev->dev, res->start, resource_size(res));
 	if (ss->addr == NULL) {
 		dev_err(&pdev->dev, "ioremap error.\n");
-		ret = -ENOMEM;
-		goto error1;
+		return -ENOMEM;
 	}
 	INIT_LIST_HEAD(&ss->queue);
 	spin_lock_init(&ss->lock);
@@ -488,8 +486,7 @@ static int spi_sh_probe(struct platform_device *pdev)
 					dev_name(master->dev.parent));
 	if (ss->workqueue == NULL) {
 		dev_err(&pdev->dev, "create workqueue error\n");
-		ret = -EBUSY;
-		goto error1;
+		return -EBUSY;
 	}
 
 	ret = request_irq(irq, spi_sh_irq, 0, "spi_sh", ss);
@@ -516,9 +513,6 @@ static int spi_sh_probe(struct platform_device *pdev)
 	free_irq(irq, ss);
  error2:
 	destroy_workqueue(ss->workqueue);
- error1:
-	spi_master_put(master);
-
 	return ret;
 }
 

From 353e86e300a33427a4cbf36001ba11f6026924b2 Mon Sep 17 00:00:00 2001
From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Date: Tue, 13 Apr 2021 13:21:03 -0300
Subject: [PATCH 2149/2658] Bluetooth: cmtp: fix file refcount when
 cmtp_attach_device fails

commit 8da3a0b87f4f1c3a3bbc4bfb78cf68476e97d183 upstream.

When cmtp_attach_device fails, cmtp_add_connection returns the error value
which leads to the caller to doing fput through sockfd_put. But
cmtp_session kthread, which is stopped in this path will also call fput,
leading to a potential refcount underflow or a use-after-free.

Add a refcount before we signal the kthread to stop. The kthread will try
to grab the cmtp_session_sem mutex before doing the fput, which is held
when get_file is called, so there should be no races there.

Reported-by: Ryota Shiga
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/cmtp/core.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 77f73bfa840b..38e2d82d86b9 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -392,6 +392,11 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
 	if (!(session->flags & BIT(CMTP_LOOPBACK))) {
 		err = cmtp_attach_device(session);
 		if (err < 0) {
+			/* Caller will call fput in case of failure, and so
+			 * will cmtp_session kthread.
+			 */
+			get_file(session->sock->file);
+
 			atomic_inc(&session->terminate);
 			wake_up_interruptible(sk_sleep(session->sock->sk));
 			up_write(&cmtp_session_sem);

From 5e21f16ab5a83005c17006b165f11b4898b132d4 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 11 May 2021 11:49:42 +0300
Subject: [PATCH 2150/2658] NFS: fix an incorrect limit in
 filelayout_decode_layout()

commit 769b01ea68b6c49dc3cde6adf7e53927dacbd3a8 upstream.

The "sizeof(struct nfs_fh)" is two bytes too large and could lead to
memory corruption.  It should be NFS_MAXFHSIZE because that's the size
of the ->data[] buffer.

I reversed the size of the arguments to put the variable on the left.

Fixes: 16b374ca439f ("NFSv4.1: pnfs: filelayout: add driver's LAYOUTGET and GETDEVICEINFO infrastructure")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/filelayout/filelayout.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
index 8e268965c96d..3f1ea498ecab 100644
--- a/fs/nfs/filelayout/filelayout.c
+++ b/fs/nfs/filelayout/filelayout.c
@@ -716,7 +716,7 @@ filelayout_decode_layout(struct pnfs_layout_hdr *flo,
 		if (unlikely(!p))
 			goto out_err;
 		fl->fh_array[i]->size = be32_to_cpup(p++);
-		if (sizeof(struct nfs_fh) < fl->fh_array[i]->size) {
+		if (fl->fh_array[i]->size > NFS_MAXFHSIZE) {
 			printk(KERN_ERR "NFS: Too big fh %d received %d\n",
 			       i, fl->fh_array[i]->size);
 			goto out_err;

From b495589cf043ea62aa3ed38569ffdd98dbc5d7b2 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Tue, 25 May 2021 10:40:12 -0400
Subject: [PATCH 2151/2658] NFS: Don't corrupt the value of pg_bytes_written in
 nfs_do_recoalesce()

commit 0d0ea309357dea0d85a82815f02157eb7fcda39f upstream.

The value of mirror->pg_bytes_written should only be updated after a
successful attempt to flush out the requests on the list.

Fixes: a7d42ddb3099 ("nfs: add mirroring support to pgio layer")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/pagelist.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index f5de58c5773f..18868e318b03 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -993,17 +993,16 @@ static void nfs_pageio_doio(struct nfs_pageio_descriptor *desc)
 {
 	struct nfs_pgio_mirror *mirror = nfs_pgio_current_mirror(desc);
 
-
 	if (!list_empty(&mirror->pg_list)) {
 		int error = desc->pg_ops->pg_doio(desc);
 		if (error < 0)
 			desc->pg_error = error;
-		else
+		if (list_empty(&mirror->pg_list)) {
 			mirror->pg_bytes_written += mirror->pg_count;
-	}
-	if (list_empty(&mirror->pg_list)) {
-		mirror->pg_count = 0;
-		mirror->pg_base = 0;
+			mirror->pg_count = 0;
+			mirror->pg_base = 0;
+			mirror->pg_recoalesce = 0;
+		}
 	}
 }
 
@@ -1089,7 +1088,6 @@ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc)
 
 	do {
 		list_splice_init(&mirror->pg_list, &head);
-		mirror->pg_bytes_written -= mirror->pg_count;
 		mirror->pg_count = 0;
 		mirror->pg_base = 0;
 		mirror->pg_recoalesce = 0;

From 08508dd40e4c0caeccac8bc525d1c6c57b18371a Mon Sep 17 00:00:00 2001
From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Date: Tue, 25 May 2021 23:32:35 -0400
Subject: [PATCH 2152/2658] NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP
 when set NFS_V4_2 config

commit e67afa7ee4a59584d7253e45d7f63b9528819a13 upstream.

Since commit bdcc2cd14e4e ("NFSv4.2: handle NFS-specific llseek errors"),
nfs42_proc_llseek would return -EOPNOTSUPP rather than -ENOTSUPP when
SEEK_DATA on NFSv4.0/v4.1.

This will lead xfstests generic/285 not run on NFSv4.0/v4.1 when set the
CONFIG_NFS_V4_2, rather than run failed.

Fixes: bdcc2cd14e4e ("NFSv4.2: handle NFS-specific llseek errors")
Cc: <stable.vger.kernel.org> # 4.2
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/nfs4file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
index c5e884585c23..9b9c8e598436 100644
--- a/fs/nfs/nfs4file.c
+++ b/fs/nfs/nfs4file.c
@@ -168,7 +168,7 @@ static loff_t nfs4_file_llseek(struct file *filep, loff_t offset, int whence)
 	case SEEK_HOLE:
 	case SEEK_DATA:
 		ret = nfs42_proc_llseek(filep, offset, whence);
-		if (ret != -ENOTSUPP)
+		if (ret != -EOPNOTSUPP)
 			return ret;
 	default:
 		return nfs_file_llseek(filep, offset, whence);

From d83d3a917ecca35c8bdf23e82d4be4b84c53808e Mon Sep 17 00:00:00 2001
From: Vladyslav Tarasiuk <vladyslavt@nvidia.com>
Date: Sun, 9 May 2021 09:43:18 +0300
Subject: [PATCH 2153/2658] net/mlx4: Fix EEPROM dump support

commit db825feefc6868896fed5e361787ba3bee2fd906 upstream.

Fix SFP and QSFP* EEPROM queries by setting i2c_address, offset and page
number correctly. For SFP set the following params:
- I2C address for offsets 0-255 is 0x50. For 256-511 - 0x51.
- Page number is zero.
- Offset is 0-255.

At the same time, QSFP* parameters are different:
- I2C address is always 0x50.
- Page number is not limited to zero.
- Offset is 0-255 for page zero and 128-255 for others.

To set parameters accordingly to cable used, implement function to query
module ID and implement respective helper functions to set parameters
correctly.

Fixes: 135dd9594f12 ("net/mlx4_en: ethtool, Remove unsupported SFP EEPROM high pages query")
Signed-off-by: Vladyslav Tarasiuk <vladyslavt@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../net/ethernet/mellanox/mlx4/en_ethtool.c   |   4 +-
 drivers/net/ethernet/mellanox/mlx4/port.c     | 107 +++++++++++++++++-
 2 files changed, 104 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index 14a3e9e601e8..b3232a9ec311 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -1907,8 +1907,6 @@ static int mlx4_en_set_tunable(struct net_device *dev,
 	return ret;
 }
 
-#define MLX4_EEPROM_PAGE_LEN 256
-
 static int mlx4_en_get_module_info(struct net_device *dev,
 				   struct ethtool_modinfo *modinfo)
 {
@@ -1943,7 +1941,7 @@ static int mlx4_en_get_module_info(struct net_device *dev,
 		break;
 	case MLX4_MODULE_ID_SFP:
 		modinfo->type = ETH_MODULE_SFF_8472;
-		modinfo->eeprom_len = MLX4_EEPROM_PAGE_LEN;
+		modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
 		break;
 	default:
 		return -ENOSYS;
diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c
index d764081ef675..519dafeb5b0b 100644
--- a/drivers/net/ethernet/mellanox/mlx4/port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/port.c
@@ -1283,6 +1283,7 @@ EXPORT_SYMBOL(mlx4_get_roce_gid_from_slave);
 #define I2C_ADDR_LOW  0x50
 #define I2C_ADDR_HIGH 0x51
 #define I2C_PAGE_SIZE 256
+#define I2C_HIGH_PAGE_SIZE 128
 
 /* Module Info Data */
 struct mlx4_cable_info {
@@ -1336,6 +1337,88 @@ static inline const char *cable_info_mad_err_str(u16 mad_status)
 	return "Unknown Error";
 }
 
+static int mlx4_get_module_id(struct mlx4_dev *dev, u8 port, u8 *module_id)
+{
+	struct mlx4_cmd_mailbox *inbox, *outbox;
+	struct mlx4_mad_ifc *inmad, *outmad;
+	struct mlx4_cable_info *cable_info;
+	int ret;
+
+	inbox = mlx4_alloc_cmd_mailbox(dev);
+	if (IS_ERR(inbox))
+		return PTR_ERR(inbox);
+
+	outbox = mlx4_alloc_cmd_mailbox(dev);
+	if (IS_ERR(outbox)) {
+		mlx4_free_cmd_mailbox(dev, inbox);
+		return PTR_ERR(outbox);
+	}
+
+	inmad = (struct mlx4_mad_ifc *)(inbox->buf);
+	outmad = (struct mlx4_mad_ifc *)(outbox->buf);
+
+	inmad->method = 0x1; /* Get */
+	inmad->class_version = 0x1;
+	inmad->mgmt_class = 0x1;
+	inmad->base_version = 0x1;
+	inmad->attr_id = cpu_to_be16(0xFF60); /* Module Info */
+
+	cable_info = (struct mlx4_cable_info *)inmad->data;
+	cable_info->dev_mem_address = 0;
+	cable_info->page_num = 0;
+	cable_info->i2c_addr = I2C_ADDR_LOW;
+	cable_info->size = cpu_to_be16(1);
+
+	ret = mlx4_cmd_box(dev, inbox->dma, outbox->dma, port, 3,
+			   MLX4_CMD_MAD_IFC, MLX4_CMD_TIME_CLASS_C,
+			   MLX4_CMD_NATIVE);
+	if (ret)
+		goto out;
+
+	if (be16_to_cpu(outmad->status)) {
+		/* Mad returned with bad status */
+		ret = be16_to_cpu(outmad->status);
+		mlx4_warn(dev,
+			  "MLX4_CMD_MAD_IFC Get Module ID attr(%x) port(%d) i2c_addr(%x) offset(%d) size(%d): Response Mad Status(%x) - %s\n",
+			  0xFF60, port, I2C_ADDR_LOW, 0, 1, ret,
+			  cable_info_mad_err_str(ret));
+		ret = -ret;
+		goto out;
+	}
+	cable_info = (struct mlx4_cable_info *)outmad->data;
+	*module_id = cable_info->data[0];
+out:
+	mlx4_free_cmd_mailbox(dev, inbox);
+	mlx4_free_cmd_mailbox(dev, outbox);
+	return ret;
+}
+
+static void mlx4_sfp_eeprom_params_set(u8 *i2c_addr, u8 *page_num, u16 *offset)
+{
+	*i2c_addr = I2C_ADDR_LOW;
+	*page_num = 0;
+
+	if (*offset < I2C_PAGE_SIZE)
+		return;
+
+	*i2c_addr = I2C_ADDR_HIGH;
+	*offset -= I2C_PAGE_SIZE;
+}
+
+static void mlx4_qsfp_eeprom_params_set(u8 *i2c_addr, u8 *page_num, u16 *offset)
+{
+	/* Offsets 0-255 belong to page 0.
+	 * Offsets 256-639 belong to pages 01, 02, 03.
+	 * For example, offset 400 is page 02: 1 + (400 - 256) / 128 = 2
+	 */
+	if (*offset < I2C_PAGE_SIZE)
+		*page_num = 0;
+	else
+		*page_num = 1 + (*offset - I2C_PAGE_SIZE) / I2C_HIGH_PAGE_SIZE;
+	*i2c_addr = I2C_ADDR_LOW;
+	*offset -= *page_num * I2C_HIGH_PAGE_SIZE;
+}
+
 /**
  * mlx4_get_module_info - Read cable module eeprom data
  * @dev: mlx4_dev.
@@ -1355,12 +1438,30 @@ int mlx4_get_module_info(struct mlx4_dev *dev, u8 port,
 	struct mlx4_cmd_mailbox *inbox, *outbox;
 	struct mlx4_mad_ifc *inmad, *outmad;
 	struct mlx4_cable_info *cable_info;
-	u16 i2c_addr;
+	u8 module_id, i2c_addr, page_num;
 	int ret;
 
 	if (size > MODULE_INFO_MAX_READ)
 		size = MODULE_INFO_MAX_READ;
 
+	ret = mlx4_get_module_id(dev, port, &module_id);
+	if (ret)
+		return ret;
+
+	switch (module_id) {
+	case MLX4_MODULE_ID_SFP:
+		mlx4_sfp_eeprom_params_set(&i2c_addr, &page_num, &offset);
+		break;
+	case MLX4_MODULE_ID_QSFP:
+	case MLX4_MODULE_ID_QSFP_PLUS:
+	case MLX4_MODULE_ID_QSFP28:
+		mlx4_qsfp_eeprom_params_set(&i2c_addr, &page_num, &offset);
+		break;
+	default:
+		mlx4_err(dev, "Module ID not recognized: %#x\n", module_id);
+		return -EINVAL;
+	}
+
 	inbox = mlx4_alloc_cmd_mailbox(dev);
 	if (IS_ERR(inbox))
 		return PTR_ERR(inbox);
@@ -1386,11 +1487,9 @@ int mlx4_get_module_info(struct mlx4_dev *dev, u8 port,
 		 */
 		size -= offset + size - I2C_PAGE_SIZE;
 
-	i2c_addr = I2C_ADDR_LOW;
-
 	cable_info = (struct mlx4_cable_info *)inmad->data;
 	cable_info->dev_mem_address = cpu_to_be16(offset);
-	cable_info->page_num = 0;
+	cable_info->page_num = page_num;
 	cable_info->i2c_addr = i2c_addr;
 	cable_info->size = cpu_to_be16(size);
 

From 1b7361ea23bf218f0bfa7a842991369055492c4f Mon Sep 17 00:00:00 2001
From: Hoang Le <hoang.h.le@dektech.com.au>
Date: Fri, 14 May 2021 08:23:03 +0700
Subject: [PATCH 2154/2658] Revert "net:tipc: Fix a double free in
 tipc_sk_mcast_rcv"

commit 75016891357a628d2b8acc09e2b9b2576c18d318 upstream.

This reverts commit 6bf24dc0cc0cc43b29ba344b66d78590e687e046.
Above fix is not correct and caused memory leak issue.

Fixes: 6bf24dc0cc0c ("net:tipc: Fix a double free in tipc_sk_mcast_rcv")
Acked-by: Jon Maloy <jmaloy@redhat.com>
Acked-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tipc/socket.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 0e5bb03c6425..3ad9158ecf30 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -763,7 +763,10 @@ void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq,
 		spin_lock_bh(&inputq->lock);
 		if (skb_peek(arrvq) == skb) {
 			skb_queue_splice_tail_init(&tmpq, inputq);
-			__skb_dequeue(arrvq);
+			/* Decrease the skb's refcnt as increasing in the
+			 * function tipc_skb_peek
+			 */
+			kfree_skb(__skb_dequeue(arrvq));
 		}
 		spin_unlock_bh(&inputq->lock);
 		__skb_queue_purge(&tmpq);

From 248f0bd11e97aa9f9d29fa994c21421023aa6c79 Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Sat, 8 May 2021 03:57:03 +0800
Subject: [PATCH 2155/2658] tipc: skb_linearize the head skb when reassembling
 msgs

commit b7df21cf1b79ab7026f545e7bf837bd5750ac026 upstream.

It's not a good idea to append the frag skb to a skb's frag_list if
the frag_list already has skbs from elsewhere, such as this skb was
created by pskb_copy() where the frag_list was cloned (all the skbs
in it were skb_get'ed) and shared by multiple skbs.

However, the new appended frag skb should have been only seen by the
current skb. Otherwise, it will cause use after free crashes as this
appended frag skb are seen by multiple skbs but it only got skb_get
called once.

The same thing happens with a skb updated by pskb_may_pull() with a
skb_cloned skb. Li Shuang has reported quite a few crashes caused
by this when doing testing over macvlan devices:

  [] kernel BUG at net/core/skbuff.c:1970!
  [] Call Trace:
  []  skb_clone+0x4d/0xb0
  []  macvlan_broadcast+0xd8/0x160 [macvlan]
  []  macvlan_process_broadcast+0x148/0x150 [macvlan]
  []  process_one_work+0x1a7/0x360
  []  worker_thread+0x30/0x390

  [] kernel BUG at mm/usercopy.c:102!
  [] Call Trace:
  []  __check_heap_object+0xd3/0x100
  []  __check_object_size+0xff/0x16b
  []  simple_copy_to_iter+0x1c/0x30
  []  __skb_datagram_iter+0x7d/0x310
  []  __skb_datagram_iter+0x2a5/0x310
  []  skb_copy_datagram_iter+0x3b/0x90
  []  tipc_recvmsg+0x14a/0x3a0 [tipc]
  []  ____sys_recvmsg+0x91/0x150
  []  ___sys_recvmsg+0x7b/0xc0

  [] kernel BUG at mm/slub.c:305!
  [] Call Trace:
  []  <IRQ>
  []  kmem_cache_free+0x3ff/0x400
  []  __netif_receive_skb_core+0x12c/0xc40
  []  ? kmem_cache_alloc+0x12e/0x270
  []  netif_receive_skb_internal+0x3d/0xb0
  []  ? get_rx_page_info+0x8e/0xa0 [be2net]
  []  be_poll+0x6ef/0xd00 [be2net]
  []  ? irq_exit+0x4f/0x100
  []  net_rx_action+0x149/0x3b0

  ...

This patch is to fix it by linearizing the head skb if it has frag_list
set in tipc_buf_append(). Note that we choose to do this before calling
skb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can
not just drop the frag_list either as the early time.

Fixes: 45c8b7b175ce ("tipc: allow non-linear first fragment buffer")
Reported-by: Li Shuang <shuali@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tipc/msg.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index f3c7e5d1fc57..6bac0e6e4643 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -139,18 +139,13 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
 		if (unlikely(head))
 			goto err;
 		*buf = NULL;
+		if (skb_has_frag_list(frag) && __skb_linearize(frag))
+			goto err;
 		frag = skb_unshare(frag, GFP_ATOMIC);
 		if (unlikely(!frag))
 			goto err;
 		head = *headbuf = frag;
 		TIPC_SKB_CB(head)->tail = NULL;
-		if (skb_is_nonlinear(head)) {
-			skb_walk_frags(head, tail) {
-				TIPC_SKB_CB(head)->tail = tail;
-			}
-		} else {
-			skb_frag_list_init(head);
-		}
 		return 0;
 	}
 

From ef4b3b0a20e293a132ad9e7bf8581835072cb627 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Date: Wed, 26 May 2021 08:39:37 -0400
Subject: [PATCH 2156/2658] i2c: s3c2410: fix possible NULL pointer deref on
 read message after write

commit 24990423267ec283b9d86f07f362b753eb9b0ed5 upstream.

Interrupt handler processes multiple message write requests one after
another, till the driver message queue is drained.  However if driver
encounters a read message without preceding START, it stops the I2C
transfer as it is an invalid condition for the controller.  At least the
comment describes a requirement "the controller forces us to send a new
START when we change direction".  This stop results in clearing the
message queue (i2c->msg = NULL).

The code however immediately jumped back to label "retry_write" which
dereferenced the "i2c->msg" making it a possible NULL pointer
dereference.

The Coverity analysis:
1. Condition !is_msgend(i2c), taking false branch.
   if (!is_msgend(i2c)) {

2. Condition !is_lastmsg(i2c), taking true branch.
   } else if (!is_lastmsg(i2c)) {

3. Condition i2c->msg->flags & 1, taking true branch.
   if (i2c->msg->flags & I2C_M_RD) {

4. write_zero_model: Passing i2c to s3c24xx_i2c_stop, which sets i2c->msg to NULL.
   s3c24xx_i2c_stop(i2c, -EINVAL);

5. Jumping to label retry_write.
   goto retry_write;

6. var_deref_model: Passing i2c to is_msgend, which dereferences null i2c->msg.
   if (!is_msgend(i2c)) {"

All previous calls to s3c24xx_i2c_stop() in this interrupt service
routine are followed by jumping to end of function (acknowledging
the interrupt and returning).  This seems a reasonable choice also here
since message buffer was entirely emptied.

Addresses-Coverity: Explicit null dereferenced
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/i2c/busses/i2c-s3c2410.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index 5df819610d52..bea74aa3f56c 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -499,8 +499,10 @@ static int i2c_s3c_irq_nextbyte(struct s3c24xx_i2c *i2c, unsigned long iicstat)
 					/* cannot do this, the controller
 					 * forces us to send a new START
 					 * when we change direction */
-
+					dev_dbg(i2c->dev,
+						"missing START before write->read\n");
 					s3c24xx_i2c_stop(i2c, -EINVAL);
+					break;
 				}
 
 				goto retry_write;

From 58961fd402e9989cdb52f4a978f3af7a664fe238 Mon Sep 17 00:00:00 2001
From: Jean Delvare <jdelvare@suse.de>
Date: Tue, 25 May 2021 17:03:36 +0200
Subject: [PATCH 2157/2658] i2c: i801: Don't generate an interrupt on bus reset

commit e4d8716c3dcec47f1557024add24e1f3c09eb24b upstream.

Now that the i2c-i801 driver supports interrupts, setting the KILL bit
in a attempt to recover from a timed out transaction triggers an
interrupt. Unfortunately, the interrupt handler (i801_isr) is not
prepared for this situation and will try to process the interrupt as
if it was signaling the end of a successful transaction. In the case
of a block transaction, this can result in an out-of-range memory
access.

This condition was reproduced several times by syzbot:
https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e
https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e
https://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e
https://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb
https://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a
https://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79

So disable interrupts while trying to reset the bus. Interrupts will
be enabled again for the following transaction.

Fixes: 636752bcb517 ("i2c-i801: Enable IRQ for SMBus transactions")
Reported-by: syzbot+b4d3fd1dfd53e90afd79@syzkaller.appspotmail.com
Signed-off-by: Jean Delvare <jdelvare@suse.de>
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Tested-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/i2c/busses/i2c-i801.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index f78069cd8d53..4399016a6cab 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -327,11 +327,9 @@ static int i801_check_post(struct i801_priv *priv, int status)
 		dev_err(&priv->pci_dev->dev, "Transaction timeout\n");
 		/* try to stop the current command */
 		dev_dbg(&priv->pci_dev->dev, "Terminating the current operation\n");
-		outb_p(inb_p(SMBHSTCNT(priv)) | SMBHSTCNT_KILL,
-		       SMBHSTCNT(priv));
+		outb_p(SMBHSTCNT_KILL, SMBHSTCNT(priv));
 		usleep_range(1000, 2000);
-		outb_p(inb_p(SMBHSTCNT(priv)) & (~SMBHSTCNT_KILL),
-		       SMBHSTCNT(priv));
+		outb_p(0, SMBHSTCNT(priv));
 
 		/* Check if it worked */
 		status = inb_p(SMBHSTSTS(priv));

From f84030301fc70eae8d71ef27183cee2b6869049a Mon Sep 17 00:00:00 2001
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date: Fri, 30 Apr 2021 14:07:35 +0800
Subject: [PATCH 2158/2658] platform/x86: hp_accel: Avoid invoking _INI to
 speed up resume
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 79d341e26ebcdbc622348aaaab6f8f89b6fdb25f ]

hp_accel can take almost two seconds to resume on some HP laptops.

The bottleneck is on evaluating _INI, which is only needed to run once.

Resolve the issue by only invoking _INI when it's necessary. Namely, on
probe and on hibernation restore.

Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Acked-by: Éric Piel <eric.piel@trempplin-utc.net>
Link: https://lore.kernel.org/r/20210430060736.590321-1-kai.heng.feng@canonical.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/lis3lv02d/lis3lv02d.h |  1 +
 drivers/platform/x86/hp_accel.c    | 22 +++++++++++++++++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/drivers/misc/lis3lv02d/lis3lv02d.h b/drivers/misc/lis3lv02d/lis3lv02d.h
index c439c827eea8..0ef759671b54 100644
--- a/drivers/misc/lis3lv02d/lis3lv02d.h
+++ b/drivers/misc/lis3lv02d/lis3lv02d.h
@@ -284,6 +284,7 @@ struct lis3lv02d {
 	int			regs_size;
 	u8                      *reg_cache;
 	bool			regs_stored;
+	bool			init_required;
 	u8                      odr_mask;  /* ODR bit mask */
 	u8			whoami;    /* indicates measurement precision */
 	s16 (*read_data) (struct lis3lv02d *lis3, int reg);
diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
index 10ce6cba4455..a06262e91a93 100644
--- a/drivers/platform/x86/hp_accel.c
+++ b/drivers/platform/x86/hp_accel.c
@@ -101,6 +101,9 @@ MODULE_DEVICE_TABLE(acpi, lis3lv02d_device_ids);
 static int lis3lv02d_acpi_init(struct lis3lv02d *lis3)
 {
 	struct acpi_device *dev = lis3->bus_priv;
+	if (!lis3->init_required)
+		return 0;
+
 	if (acpi_evaluate_object(dev->handle, METHOD_NAME__INI,
 				 NULL, NULL) != AE_OK)
 		return -EINVAL;
@@ -361,6 +364,7 @@ static int lis3lv02d_add(struct acpi_device *device)
 	}
 
 	/* call the core layer do its init */
+	lis3_dev.init_required = true;
 	ret = lis3lv02d_init_device(&lis3_dev);
 	if (ret)
 		return ret;
@@ -408,11 +412,27 @@ static int lis3lv02d_suspend(struct device *dev)
 
 static int lis3lv02d_resume(struct device *dev)
 {
+	lis3_dev.init_required = false;
+	lis3lv02d_poweron(&lis3_dev);
+	return 0;
+}
+
+static int lis3lv02d_restore(struct device *dev)
+{
+	lis3_dev.init_required = true;
 	lis3lv02d_poweron(&lis3_dev);
 	return 0;
 }
 
-static SIMPLE_DEV_PM_OPS(hp_accel_pm, lis3lv02d_suspend, lis3lv02d_resume);
+static const struct dev_pm_ops hp_accel_pm = {
+	.suspend = lis3lv02d_suspend,
+	.resume = lis3lv02d_resume,
+	.freeze = lis3lv02d_suspend,
+	.thaw = lis3lv02d_resume,
+	.poweroff = lis3lv02d_suspend,
+	.restore = lis3lv02d_restore,
+};
+
 #define HP_ACCEL_PM (&hp_accel_pm)
 #else
 #define HP_ACCEL_PM NULL

From 54214832ee2c10d49f6a4800bd79aafd10a0cf3b Mon Sep 17 00:00:00 2001
From: Anirudh Rayabharam <mail@anirudhrb.com>
Date: Mon, 3 May 2021 13:56:42 +0200
Subject: [PATCH 2159/2658] net: fujitsu: fix potential null-ptr-deref

[ Upstream commit 52202be1cd996cde6e8969a128dc27ee45a7cb5e ]

In fmvj18x_get_hwinfo(), if ioremap fails there will be NULL pointer
deref. To fix this, check the return value of ioremap and return -1
to the caller in case of failure.

Cc: "David S. Miller" <davem@davemloft.net>
Acked-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com>
Link: https://lore.kernel.org/r/20210503115736.2104747-16-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/fujitsu/fmvj18x_cs.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c
index a7139f588ad2..fb1a9bd24660 100644
--- a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c
+++ b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c
@@ -548,6 +548,11 @@ static int fmvj18x_get_hwinfo(struct pcmcia_device *link, u_char *node_id)
 	return -1;
 
     base = ioremap(link->resource[2]->start, resource_size(link->resource[2]));
+    if (!base) {
+	pcmcia_release_window(link, link->resource[2]);
+	return -1;
+    }
+
     pcmcia_map_mem_page(link, link->resource[2], 0);
 
     /*

From c7321d079fae8323f00293820a5d8f84dabf2000 Mon Sep 17 00:00:00 2001
From: Du Cheng <ducheng2@gmail.com>
Date: Mon, 3 May 2021 13:56:46 +0200
Subject: [PATCH 2160/2658] net: caif: remove BUG_ON(dev == NULL) in caif_xmit

[ Upstream commit 65a67792e3416f7c5d7daa47d99334cbb19a7449 ]

The condition of dev == NULL is impossible in caif_xmit(), hence it is
for the removal.

Explanation:
The static caif_xmit() is only called upon via a function pointer
`ndo_start_xmit` defined in include/linux/netdevice.h:
```
struct net_device_ops {
    ...
    netdev_tx_t     (*ndo_start_xmit)(struct sk_buff *skb, struct net_device *dev);
    ...
}
```

The exhausive list of call points are:
```
drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
    dev->netdev_ops->ndo_start_xmit(skb, dev);
    ^                                    ^

drivers/infiniband/ulp/opa_vnic/opa_vnic_netdev.c
    struct opa_vnic_adapter *adapter = opa_vnic_priv(netdev);
			     ^                       ^
    return adapter->rn_ops->ndo_start_xmit(skb, netdev); // adapter would crash first
	   ^                                    ^

drivers/usb/gadget/function/f_ncm.c
    ncm->netdev->netdev_ops->ndo_start_xmit(NULL, ncm->netdev);
	      ^                                   ^

include/linux/netdevice.h
static inline netdev_tx_t __netdev_start_xmit(...
{
    return ops->ndo_start_xmit(skb, dev);
				    ^
}

    const struct net_device_ops *ops = dev->netdev_ops;
				       ^
    rc = __netdev_start_xmit(ops, skb, dev, more);
				       ^
```

In each of the enumerated scenarios, it is impossible for the NULL-valued dev to
reach the caif_xmit() without crashing the kernel earlier, therefore `BUG_ON(dev ==
NULL)` is rather useless, hence the removal.

Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Du Cheng <ducheng2@gmail.com>
Link: https://lore.kernel.org/r/20210503115736.2104747-20-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/caif/caif_serial.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
index c2dea4916e5d..32834dad0b83 100644
--- a/drivers/net/caif/caif_serial.c
+++ b/drivers/net/caif/caif_serial.c
@@ -281,7 +281,6 @@ static int caif_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	struct ser_device *ser;
 
-	BUG_ON(dev == NULL);
 	ser = netdev_priv(dev);
 
 	/* Send flow off once, on high water mark */

From 582ceee7b584d8a3ebd4ad82102ca81e83c1f43e Mon Sep 17 00:00:00 2001
From: Tom Seewald <tseewald@gmail.com>
Date: Mon, 3 May 2021 13:56:56 +0200
Subject: [PATCH 2161/2658] char: hpet: add checks after calling ioremap

[ Upstream commit b11701c933112d49b808dee01cb7ff854ba6a77a ]

The function hpet_resources() calls ioremap() two times, but in both
cases it does not check if ioremap() returned a null pointer. Fix this
by adding null pointer checks and returning an appropriate error.

Signed-off-by: Tom Seewald <tseewald@gmail.com>
Link: https://lore.kernel.org/r/20210503115736.2104747-30-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/hpet.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index 5b38d7a8202a..eb205f9173f4 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -976,6 +976,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data)
 	if (ACPI_SUCCESS(status)) {
 		hdp->hd_phys_address = addr.address.minimum;
 		hdp->hd_address = ioremap(addr.address.minimum, addr.address.address_length);
+		if (!hdp->hd_address)
+			return AE_ERROR;
 
 		if (hpet_is_known(hdp)) {
 			iounmap(hdp->hd_address);
@@ -989,6 +991,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data)
 		hdp->hd_phys_address = fixmem32->address;
 		hdp->hd_address = ioremap(fixmem32->address,
 						HPET_RANGE_SIZE);
+		if (!hdp->hd_address)
+			return AE_ERROR;
 
 		if (hpet_is_known(hdp)) {
 			iounmap(hdp->hd_address);

From 570a2fb7b67dce4239df54c68a8743d0ac210b9b Mon Sep 17 00:00:00 2001
From: Phillip Potter <phil@philpotter.co.uk>
Date: Mon, 3 May 2021 13:57:08 +0200
Subject: [PATCH 2162/2658] isdn: mISDNinfineon: check/cleanup ioremap failure
 correctly in setup_io

[ Upstream commit c446f0d4702d316e1c6bf621f70e79678d28830a ]

Move hw->cfg.mode and hw->addr.mode assignments from hw->ci->cfg_mode
and hw->ci->addr_mode respectively, to be before the subsequent checks
for memory IO mode (and possible ioremap calls in this case).

Also introduce ioremap error checks at both locations. This allows
resources to be properly freed on ioremap failure, as when the caller
of setup_io then subsequently calls release_io via its error path,
release_io can now correctly determine the mode as it has been set
before the ioremap call.

Finally, refactor release_io function so that it will call
release_mem_region in the memory IO case, regardless of whether or not
hw->cfg.p/hw->addr.p are NULL. This means resources are then properly
released on failure.

This properly implements the original reverted commit (d721fe99f6ad)
from the University of Minnesota, whilst also implementing the ioremap
check for the hw->ci->cfg_mode if block as well.

Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
Link: https://lore.kernel.org/r/20210503115736.2104747-42-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/isdn/hardware/mISDN/mISDNinfineon.c | 24 ++++++++++++++-------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/drivers/isdn/hardware/mISDN/mISDNinfineon.c b/drivers/isdn/hardware/mISDN/mISDNinfineon.c
index d5bdbaf93a1a..d0b6377b9834 100644
--- a/drivers/isdn/hardware/mISDN/mISDNinfineon.c
+++ b/drivers/isdn/hardware/mISDN/mISDNinfineon.c
@@ -645,17 +645,19 @@ static void
 release_io(struct inf_hw *hw)
 {
 	if (hw->cfg.mode) {
-		if (hw->cfg.p) {
+		if (hw->cfg.mode == AM_MEMIO) {
 			release_mem_region(hw->cfg.start, hw->cfg.size);
-			iounmap(hw->cfg.p);
+			if (hw->cfg.p)
+				iounmap(hw->cfg.p);
 		} else
 			release_region(hw->cfg.start, hw->cfg.size);
 		hw->cfg.mode = AM_NONE;
 	}
 	if (hw->addr.mode) {
-		if (hw->addr.p) {
+		if (hw->addr.mode == AM_MEMIO) {
 			release_mem_region(hw->addr.start, hw->addr.size);
-			iounmap(hw->addr.p);
+			if (hw->addr.p)
+				iounmap(hw->addr.p);
 		} else
 			release_region(hw->addr.start, hw->addr.size);
 		hw->addr.mode = AM_NONE;
@@ -685,9 +687,12 @@ setup_io(struct inf_hw *hw)
 				(ulong)hw->cfg.start, (ulong)hw->cfg.size);
 			return err;
 		}
-		if (hw->ci->cfg_mode == AM_MEMIO)
-			hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size);
 		hw->cfg.mode = hw->ci->cfg_mode;
+		if (hw->ci->cfg_mode == AM_MEMIO) {
+			hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size);
+			if (!hw->cfg.p)
+				return -ENOMEM;
+		}
 		if (debug & DEBUG_HW)
 			pr_notice("%s: IO cfg %lx (%lu bytes) mode%d\n",
 				  hw->name, (ulong)hw->cfg.start,
@@ -712,9 +717,12 @@ setup_io(struct inf_hw *hw)
 				(ulong)hw->addr.start, (ulong)hw->addr.size);
 			return err;
 		}
-		if (hw->ci->addr_mode == AM_MEMIO)
-			hw->addr.p = ioremap(hw->addr.start, hw->addr.size);
 		hw->addr.mode = hw->ci->addr_mode;
+		if (hw->ci->addr_mode == AM_MEMIO) {
+			hw->addr.p = ioremap(hw->addr.start, hw->addr.size);
+			if (!hw->addr.p)
+				return -ENOMEM;
+		}
 		if (debug & DEBUG_HW)
 			pr_notice("%s: IO addr %lx (%lu bytes) mode%d\n",
 				  hw->name, (ulong)hw->addr.start,

From c57cb151c0d1d4dd734e0ac8e060ddd2b449e7d5 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 3 May 2021 13:57:20 +0200
Subject: [PATCH 2163/2658] libertas: register sysfs groups properly

[ Upstream commit 7e79b38fe9a403b065ac5915465f620a8fb3de84 ]

The libertas driver was trying to register sysfs groups "by hand" which
causes them to be created _after_ the device is initialized and
announced to userspace, which causes races and can prevent userspace
tools from seeing the sysfs files correctly.

Fix this up by using the built-in sysfs_groups pointers in struct
net_device which were created for this very reason, fixing the race
condition, and properly allowing for any error that might have occured
to be handled properly.

Cc: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210503115736.2104747-54-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/libertas/mesh.c | 28 ++++------------------------
 1 file changed, 4 insertions(+), 24 deletions(-)

diff --git a/drivers/net/wireless/libertas/mesh.c b/drivers/net/wireless/libertas/mesh.c
index d0c881dd5846..f1e9cbcfdc16 100644
--- a/drivers/net/wireless/libertas/mesh.c
+++ b/drivers/net/wireless/libertas/mesh.c
@@ -797,19 +797,6 @@ static const struct attribute_group mesh_ie_group = {
 	.attrs = mesh_ie_attrs,
 };
 
-static void lbs_persist_config_init(struct net_device *dev)
-{
-	int ret;
-	ret = sysfs_create_group(&(dev->dev.kobj), &boot_opts_group);
-	ret = sysfs_create_group(&(dev->dev.kobj), &mesh_ie_group);
-}
-
-static void lbs_persist_config_remove(struct net_device *dev)
-{
-	sysfs_remove_group(&(dev->dev.kobj), &boot_opts_group);
-	sysfs_remove_group(&(dev->dev.kobj), &mesh_ie_group);
-}
-
 
 /***************************************************************************
  * Initializing and starting, stopping mesh
@@ -1021,6 +1008,10 @@ static int lbs_add_mesh(struct lbs_private *priv)
 	SET_NETDEV_DEV(priv->mesh_dev, priv->dev->dev.parent);
 
 	mesh_dev->flags |= IFF_BROADCAST | IFF_MULTICAST;
+	mesh_dev->sysfs_groups[0] = &lbs_mesh_attr_group;
+	mesh_dev->sysfs_groups[1] = &boot_opts_group;
+	mesh_dev->sysfs_groups[2] = &mesh_ie_group;
+
 	/* Register virtual mesh interface */
 	ret = register_netdev(mesh_dev);
 	if (ret) {
@@ -1028,19 +1019,10 @@ static int lbs_add_mesh(struct lbs_private *priv)
 		goto err_free_netdev;
 	}
 
-	ret = sysfs_create_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group);
-	if (ret)
-		goto err_unregister;
-
-	lbs_persist_config_init(mesh_dev);
-
 	/* Everything successful */
 	ret = 0;
 	goto done;
 
-err_unregister:
-	unregister_netdev(mesh_dev);
-
 err_free_netdev:
 	free_netdev(mesh_dev);
 
@@ -1063,8 +1045,6 @@ void lbs_remove_mesh(struct lbs_private *priv)
 	lbs_deb_enter(LBS_DEB_MESH);
 	netif_stop_queue(mesh_dev);
 	netif_carrier_off(mesh_dev);
-	sysfs_remove_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group);
-	lbs_persist_config_remove(mesh_dev);
 	unregister_netdev(mesh_dev);
 	priv->mesh_dev = NULL;
 	kfree(mesh_dev->ieee80211_ptr);

From f2685c6d3fe5e2fb5777793fc5587a8bd9cbb751 Mon Sep 17 00:00:00 2001
From: Alaa Emad <alaaemadhossney.ae@gmail.com>
Date: Mon, 3 May 2021 13:57:26 +0200
Subject: [PATCH 2164/2658] media: dvb: Add check on sp8870_readreg return

[ Upstream commit c6d822c56e7fd29e6fa1b1bb91b98f6a1e942b3c ]

The function sp8870_readreg returns a negative value when i2c_transfer
fails so properly check for this and return the error if it happens.

Cc: Sean Young <sean@mess.org>
Cc: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Alaa Emad <alaaemadhossney.ae@gmail.com>
Link: https://lore.kernel.org/r/20210503115736.2104747-60-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/dvb-frontends/sp8870.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/dvb-frontends/sp8870.c b/drivers/media/dvb-frontends/sp8870.c
index e87ac30d7fb8..b43135c5a960 100644
--- a/drivers/media/dvb-frontends/sp8870.c
+++ b/drivers/media/dvb-frontends/sp8870.c
@@ -293,7 +293,9 @@ static int sp8870_set_frontend_parameters(struct dvb_frontend *fe)
 	sp8870_writereg(state, 0xc05, reg0xc05);
 
 	// read status reg in order to clear pending irqs
-	sp8870_readreg(state, 0x200);
+	err = sp8870_readreg(state, 0x200);
+	if (err < 0)
+		return err;
 
 	// system controller start
 	sp8870_microcontroller_start(state);

From 12e30f8172c3f1c625b7b9bdd438c088f6def2c2 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 3 May 2021 13:57:30 +0200
Subject: [PATCH 2165/2658] media: gspca: properly check for errors in
 po1030_probe()

[ Upstream commit dacb408ca6f0e34df22b40d8dd5fae7f8e777d84 ]

If m5602_write_sensor() or m5602_write_bridge() fail, do not continue to
initialize the device but return the error to the calling funtion.

Cc: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Link: https://lore.kernel.org/r/20210503115736.2104747-64-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/gspca/m5602/m5602_po1030.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/media/usb/gspca/m5602/m5602_po1030.c b/drivers/media/usb/gspca/m5602/m5602_po1030.c
index 4bf5c43424b7..971253dafb57 100644
--- a/drivers/media/usb/gspca/m5602/m5602_po1030.c
+++ b/drivers/media/usb/gspca/m5602/m5602_po1030.c
@@ -55,6 +55,7 @@ static const struct v4l2_ctrl_config po1030_greenbal_cfg = {
 int po1030_probe(struct sd *sd)
 {
 	u8 dev_id_h = 0, i;
+	int err;
 	struct gspca_dev *gspca_dev = (struct gspca_dev *)sd;
 
 	if (force_sensor) {
@@ -73,10 +74,13 @@ int po1030_probe(struct sd *sd)
 	for (i = 0; i < ARRAY_SIZE(preinit_po1030); i++) {
 		u8 data = preinit_po1030[i][2];
 		if (preinit_po1030[i][0] == SENSOR)
-			m5602_write_sensor(sd,
-				preinit_po1030[i][1], &data, 1);
+			err = m5602_write_sensor(sd, preinit_po1030[i][1],
+						 &data, 1);
 		else
-			m5602_write_bridge(sd, preinit_po1030[i][1], data);
+			err = m5602_write_bridge(sd, preinit_po1030[i][1],
+						 data);
+		if (err < 0)
+			return err;
 	}
 
 	if (m5602_read_sensor(sd, PO1030_DEVID_H, &dev_id_h, 1))

From 790e1b343d776ff8e8d500aa8bd8a81b092c7bee Mon Sep 17 00:00:00 2001
From: Matt Wang <wwentao@vmware.com>
Date: Tue, 11 May 2021 03:04:37 +0000
Subject: [PATCH 2166/2658] scsi: BusLogic: Fix 64-bit system enumeration error
 for Buslogic

[ Upstream commit 56f396146af278135c0ff958c79b5ee1bd22453d ]

Commit 391e2f25601e ("[SCSI] BusLogic: Port driver to 64-bit")
introduced a serious issue for 64-bit systems.  With this commit,
64-bit kernel will enumerate 8*15 non-existing disks.  This is caused
by the broken CCB structure.  The change from u32 data to void *data
increased CCB length on 64-bit system, which introduced an extra 4
byte offset of the CDB.  This leads to incorrect response to INQUIRY
commands during enumeration.

Fix disk enumeration failure by reverting the portion of the commit
above which switched the data pointer from u32 to void.

Link: https://lore.kernel.org/r/C325637F-1166-4340-8F0F-3BCCD59D4D54@vmware.com
Acked-by: Khalid Aziz <khalid@gonehiking.org>
Signed-off-by: Matt Wang <wwentao@vmware.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/BusLogic.c | 6 +++---
 drivers/scsi/BusLogic.h | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
index c7be7bb37209..b9b4491d732a 100644
--- a/drivers/scsi/BusLogic.c
+++ b/drivers/scsi/BusLogic.c
@@ -3081,11 +3081,11 @@ static int blogic_qcmd_lck(struct scsi_cmnd *command,
 		ccb->opcode = BLOGIC_INITIATOR_CCB_SG;
 		ccb->datalen = count * sizeof(struct blogic_sg_seg);
 		if (blogic_multimaster_type(adapter))
-			ccb->data = (void *)((unsigned int) ccb->dma_handle +
+			ccb->data = (unsigned int) ccb->dma_handle +
 					((unsigned long) &ccb->sglist -
-					(unsigned long) ccb));
+					(unsigned long) ccb);
 		else
-			ccb->data = ccb->sglist;
+			ccb->data = virt_to_32bit_virt(ccb->sglist);
 
 		scsi_for_each_sg(command, sg, count, i) {
 			ccb->sglist[i].segbytes = sg_dma_len(sg);
diff --git a/drivers/scsi/BusLogic.h b/drivers/scsi/BusLogic.h
index b53ec2f1e8cd..5c950a7a1b1c 100644
--- a/drivers/scsi/BusLogic.h
+++ b/drivers/scsi/BusLogic.h
@@ -821,7 +821,7 @@ struct blogic_ccb {
 	unsigned char cdblen;				/* Byte 2 */
 	unsigned char sense_datalen;			/* Byte 3 */
 	u32 datalen;					/* Bytes 4-7 */
-	void *data;					/* Bytes 8-11 */
+	u32 data;					/* Bytes 8-11 */
 	unsigned char:8;				/* Byte 12 */
 	unsigned char:8;				/* Byte 13 */
 	enum blogic_adapter_status adapter_status;	/* Byte 14 */

From 5271048d2c3532a2bbb98632c1b3d5618811550a Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Wed, 14 Apr 2021 14:45:43 +0200
Subject: [PATCH 2167/2658] openrisc: Define memory barrier mb

[ Upstream commit 8b549c18ae81dbc36fb11e4aa08b8378c599ca95 ]

This came up in the discussion of the requirements of qspinlock on an
architecture.  OpenRISC uses qspinlock, but it was noticed that the
memmory barrier was not defined.

Peter defined it in the mail thread writing:

    As near as I can tell this should do. The arch spec only lists
    this one instruction and the text makes it sound like a completion
    barrier.

This is correct so applying this patch.

Signed-off-by: Peter Zijlstra <peterz@infradead.org>
[shorne@gmail.com:Turned the mail into a patch]
Signed-off-by: Stafford Horne <shorne@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/openrisc/include/asm/barrier.h | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 arch/openrisc/include/asm/barrier.h

diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h
new file mode 100644
index 000000000000..7538294721be
--- /dev/null
+++ b/arch/openrisc/include/asm/barrier.h
@@ -0,0 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef __ASM_BARRIER_H
+#define __ASM_BARRIER_H
+
+#define mb() asm volatile ("l.msync" ::: "memory")
+
+#include <asm-generic/barrier.h>
+
+#endif /* __ASM_BARRIER_H */

From a9181779f3fca8709899c31c89f3dab415f97c66 Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Fri, 14 May 2021 10:56:16 -0400
Subject: [PATCH 2168/2658] btrfs: do not BUG_ON in link_to_fixup_dir

[ Upstream commit 91df99a6eb50d5a1bc70fff4a09a0b7ae6aab96d ]

While doing error injection testing I got the following panic

  kernel BUG at fs/btrfs/tree-log.c:1862!
  invalid opcode: 0000 [#1] SMP NOPTI
  CPU: 1 PID: 7836 Comm: mount Not tainted 5.13.0-rc1+ #305
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014
  RIP: 0010:link_to_fixup_dir+0xd5/0xe0
  RSP: 0018:ffffb5800180fa30 EFLAGS: 00010216
  RAX: fffffffffffffffb RBX: 00000000fffffffb RCX: ffff8f595287faf0
  RDX: ffffb5800180fa37 RSI: ffff8f5954978800 RDI: 0000000000000000
  RBP: ffff8f5953af9450 R08: 0000000000000019 R09: 0000000000000001
  R10: 000151f408682970 R11: 0000000120021001 R12: ffff8f5954978800
  R13: ffff8f595287faf0 R14: ffff8f5953c77dd0 R15: 0000000000000065
  FS:  00007fc5284c8c40(0000) GS:ffff8f59bbd00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00007fc5287f47c0 CR3: 000000011275e002 CR4: 0000000000370ee0
  Call Trace:
   replay_one_buffer+0x409/0x470
   ? btree_read_extent_buffer_pages+0xd0/0x110
   walk_up_log_tree+0x157/0x1e0
   walk_log_tree+0xa6/0x1d0
   btrfs_recover_log_trees+0x1da/0x360
   ? replay_one_extent+0x7b0/0x7b0
   open_ctree+0x1486/0x1720
   btrfs_mount_root.cold+0x12/0xea
   ? __kmalloc_track_caller+0x12f/0x240
   legacy_get_tree+0x24/0x40
   vfs_get_tree+0x22/0xb0
   vfs_kern_mount.part.0+0x71/0xb0
   btrfs_mount+0x10d/0x380
   ? vfs_parse_fs_string+0x4d/0x90
   legacy_get_tree+0x24/0x40
   vfs_get_tree+0x22/0xb0
   path_mount+0x433/0xa10
   __x64_sys_mount+0xe3/0x120
   do_syscall_64+0x3d/0x80
   entry_SYSCALL_64_after_hwframe+0x44/0xae

We can get -EIO or any number of legitimate errors from
btrfs_search_slot(), panicing here is not the appropriate response.  The
error path for this code handles errors properly, simply return the
error.

Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/tree-log.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index ee26ccd12da8..4cab553c347a 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -1582,8 +1582,6 @@ static noinline int link_to_fixup_dir(struct btrfs_trans_handle *trans,
 		ret = btrfs_update_inode(trans, root, inode);
 	} else if (ret == -EEXIST) {
 		ret = 0;
-	} else {
-		BUG(); /* Logic Error */
 	}
 	iput(inode);
 

From dddca25687fdafe033dde0667c96b20bec5f7a3a Mon Sep 17 00:00:00 2001
From: xinhui pan <xinhui.pan@amd.com>
Date: Tue, 18 May 2021 10:56:07 +0800
Subject: [PATCH 2169/2658] drm/amdgpu: Fix a use-after-free
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 1e5c37385097c35911b0f8a0c67ffd10ee1af9a2 ]

looks like we forget to set ttm->sg to NULL.
Hit panic below

[ 1235.844104] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b7b4b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI
[ 1235.989074] Call Trace:
[ 1235.991751]  sg_free_table+0x17/0x20
[ 1235.995667]  amdgpu_ttm_backend_unbind.cold+0x4d/0xf7 [amdgpu]
[ 1236.002288]  amdgpu_ttm_backend_destroy+0x29/0x130 [amdgpu]
[ 1236.008464]  ttm_tt_destroy+0x1e/0x30 [ttm]
[ 1236.013066]  ttm_bo_cleanup_memtype_use+0x51/0xa0 [ttm]
[ 1236.018783]  ttm_bo_release+0x262/0xa50 [ttm]
[ 1236.023547]  ttm_bo_put+0x82/0xd0 [ttm]
[ 1236.027766]  amdgpu_bo_unref+0x26/0x50 [amdgpu]
[ 1236.032809]  amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x7aa/0xd90 [amdgpu]
[ 1236.040400]  kfd_ioctl_alloc_memory_of_gpu+0xe2/0x330 [amdgpu]
[ 1236.046912]  kfd_ioctl+0x463/0x690 [amdgpu]

Signed-off-by: xinhui pan <xinhui.pan@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index 6beb3e76e1c9..014b87143837 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -737,6 +737,7 @@ static void amdgpu_ttm_tt_unpopulate(struct ttm_tt *ttm)
 
 	if (gtt && gtt->userptr) {
 		kfree(ttm->sg);
+		ttm->sg = NULL;
 		ttm->page_flags &= ~TTM_PAGE_FLAG_SG;
 		return;
 	}

From ba8fcd5fc54fd117a060bf1807a044cdf59bdd56 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 8 May 2021 07:38:22 +0200
Subject: [PATCH 2170/2658] net: netcp: Fix an error message

[ Upstream commit ddb6e00f8413e885ff826e32521cff7924661de0 ]

'ret' is known to be 0 here.
The expected error code is stored in 'tx_pipe->dma_queue', so use it
instead.

While at it, switch from %d to %pe which is more user friendly.

Fixes: 84640e27f230 ("net: netcp: Add Keystone NetCP core ethernet driver")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/ti/netcp_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c
index 37b9b39192ec..463c6db67146 100644
--- a/drivers/net/ethernet/ti/netcp_core.c
+++ b/drivers/net/ethernet/ti/netcp_core.c
@@ -1284,9 +1284,9 @@ int netcp_txpipe_open(struct netcp_tx_pipe *tx_pipe)
 	tx_pipe->dma_queue = knav_queue_open(name, tx_pipe->dma_queue_id,
 					     KNAV_QUEUE_SHARED);
 	if (IS_ERR(tx_pipe->dma_queue)) {
+		ret = PTR_ERR(tx_pipe->dma_queue);
 		dev_err(dev, "Could not open DMA queue for channel \"%s\": %d\n",
 			name, ret);
-		ret = PTR_ERR(tx_pipe->dma_queue);
 		goto err;
 	}
 

From 71354161df6963a024dc63c8a828bd3b7620e219 Mon Sep 17 00:00:00 2001
From: Zhen Lei <thunder.leizhen@huawei.com>
Date: Sat, 15 May 2021 15:16:05 +0800
Subject: [PATCH 2171/2658] net: bnx2: Fix error return code in
 bnx2_init_board()

[ Upstream commit 28c66b6da4087b8cfe81c2ec0a46eb6116dafda9 ]

Fix to return -EPERM from the error handling case instead of 0, as done
elsewhere in this function.

Fixes: b6016b767397 ("[BNX2]: New Broadcom gigabit network driver.")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnx2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index 8fc3f3c137f8..1616647719ba 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -8234,9 +8234,9 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
 		BNX2_WR(bp, PCI_COMMAND, reg);
 	} else if ((BNX2_CHIP_ID(bp) == BNX2_CHIP_ID_5706_A1) &&
 		!(bp->flags & BNX2_FLAG_PCIX)) {
-
 		dev_err(&pdev->dev,
 			"5706 A1 can only be used in a PCIX bus, aborting\n");
+		rc = -EPERM;
 		goto err_out_unmap;
 	}
 

From 031eb87c52d76132eb5f0c1e63311dd519cb8216 Mon Sep 17 00:00:00 2001
From: Taehee Yoo <ap420073@gmail.com>
Date: Sun, 16 May 2021 14:44:42 +0000
Subject: [PATCH 2172/2658] mld: fix panic in mld_newpack()

[ Upstream commit 020ef930b826d21c5446fdc9db80fd72a791bc21 ]

mld_newpack() doesn't allow to allocate high order page,
only order-0 allocation is allowed.
If headroom size is too large, a kernel panic could occur in skb_put().

Test commands:
    ip netns del A
    ip netns del B
    ip netns add A
    ip netns add B
    ip link add veth0 type veth peer name veth1
    ip link set veth0 netns A
    ip link set veth1 netns B

    ip netns exec A ip link set lo up
    ip netns exec A ip link set veth0 up
    ip netns exec A ip -6 a a 2001:db8:0::1/64 dev veth0
    ip netns exec B ip link set lo up
    ip netns exec B ip link set veth1 up
    ip netns exec B ip -6 a a 2001:db8:0::2/64 dev veth1
    for i in {1..99}
    do
        let A=$i-1
        ip netns exec A ip link add ip6gre$i type ip6gre \
	local 2001:db8:$A::1 remote 2001:db8:$A::2 encaplimit 100
        ip netns exec A ip -6 a a 2001:db8:$i::1/64 dev ip6gre$i
        ip netns exec A ip link set ip6gre$i up

        ip netns exec B ip link add ip6gre$i type ip6gre \
	local 2001:db8:$A::2 remote 2001:db8:$A::1 encaplimit 100
        ip netns exec B ip -6 a a 2001:db8:$i::2/64 dev ip6gre$i
        ip netns exec B ip link set ip6gre$i up
    done

Splat looks like:
kernel BUG at net/core/skbuff.c:110!
invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.12.0+ #891
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:skb_panic+0x15d/0x15f
Code: 92 fe 4c 8b 4c 24 10 53 8b 4d 70 45 89 e0 48 c7 c7 00 ae 79 83
41 57 41 56 41 55 48 8b 54 24 a6 26 f9 ff <0f> 0b 48 8b 6c 24 20 89
34 24 e8 4a 4e 92 fe 8b 34 24 48 c7 c1 20
RSP: 0018:ffff88810091f820 EFLAGS: 00010282
RAX: 0000000000000089 RBX: ffff8881086e9000 RCX: 0000000000000000
RDX: 0000000000000089 RSI: 0000000000000008 RDI: ffffed1020123efb
RBP: ffff888005f6eac0 R08: ffffed1022fc0031 R09: ffffed1022fc0031
R10: ffff888117e00187 R11: ffffed1022fc0030 R12: 0000000000000028
R13: ffff888008284eb0 R14: 0000000000000ed8 R15: 0000000000000ec0
FS:  0000000000000000(0000) GS:ffff888117c00000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8b801c5640 CR3: 0000000033c2c006 CR4: 00000000003706f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ? ip6_mc_hdr.isra.26.constprop.46+0x12a/0x600
 ? ip6_mc_hdr.isra.26.constprop.46+0x12a/0x600
 skb_put.cold.104+0x22/0x22
 ip6_mc_hdr.isra.26.constprop.46+0x12a/0x600
 ? rcu_read_lock_sched_held+0x91/0xc0
 mld_newpack+0x398/0x8f0
 ? ip6_mc_hdr.isra.26.constprop.46+0x600/0x600
 ? lock_contended+0xc40/0xc40
 add_grhead.isra.33+0x280/0x380
 add_grec+0x5ca/0xff0
 ? mld_sendpack+0xf40/0xf40
 ? lock_downgrade+0x690/0x690
 mld_send_initial_cr.part.34+0xb9/0x180
 ipv6_mc_dad_complete+0x15d/0x1b0
 addrconf_dad_completed+0x8d2/0xbb0
 ? lock_downgrade+0x690/0x690
 ? addrconf_rs_timer+0x660/0x660
 ? addrconf_dad_work+0x73c/0x10e0
 addrconf_dad_work+0x73c/0x10e0

Allowing high order page allocation could fix this problem.

Fixes: 72e09ad107e7 ("ipv6: avoid high order allocations")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/mcast.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 2d28f0b54494..636425999aac 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1573,10 +1573,7 @@ static struct sk_buff *mld_newpack(struct inet6_dev *idev, unsigned int mtu)
 		     IPV6_TLV_PADN, 0 };
 
 	/* we assume size > sizeof(ra) here */
-	/* limit our allocations to order-0 page */
-	size = min_t(int, size, SKB_MAX_ORDER(0, 0));
 	skb = sock_alloc_send_skb(sk, size, 1, &err);
-
 	if (!skb)
 		return NULL;
 

From 0ec42eb476af86de79e4f2df18e0374f5d9f5109 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 19 May 2021 17:16:50 +0300
Subject: [PATCH 2173/2658] staging: emxx_udc: fix loop in _nbu2ss_nuke()

[ Upstream commit e0112a7c9e847ada15a631b88e279d547e8f26a7 ]

The _nbu2ss_ep_done() function calls:

	list_del_init(&req->queue);

which means that the loop will never exit.

Fixes: ca3d253eb967 ("Staging: emxx_udc: Iterate list using list_for_each_entry")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YKUd0sDyjm/lkJfJ@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/emxx_udc/emxx_udc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/emxx_udc/emxx_udc.c b/drivers/staging/emxx_udc/emxx_udc.c
index 91ff8fb0cc3a..102eee7d2e4f 100644
--- a/drivers/staging/emxx_udc/emxx_udc.c
+++ b/drivers/staging/emxx_udc/emxx_udc.c
@@ -2193,7 +2193,7 @@ static int _nbu2ss_nuke(struct nbu2ss_udc *udc,
 			struct nbu2ss_ep *ep,
 			int status)
 {
-	struct nbu2ss_req *req;
+	struct nbu2ss_req *req, *n;
 
 	/* Endpoint Disable */
 	_nbu2ss_epn_exit(udc, ep);
@@ -2205,7 +2205,7 @@ static int _nbu2ss_nuke(struct nbu2ss_udc *udc,
 		return 0;
 
 	/* called with irqs blocked */
-	list_for_each_entry(req, &ep->queue, queue) {
+	list_for_each_entry_safe(req, n, &ep->queue, queue) {
 		_nbu2ss_ep_done(ep, req, status);
 	}
 

From fd9dc33f2744de4986cc4e820a1433073f204262 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 19 May 2021 17:20:27 +0300
Subject: [PATCH 2174/2658] scsi: libsas: Use _safe() loop in sas_resume_port()

[ Upstream commit 8c7e7b8486cda21269d393245883c5e4737d5ee7 ]

If sas_notify_lldd_dev_found() fails then this code calls:

	sas_unregister_dev(port, dev);

which removes "dev", our list iterator, from the list.  This could lead to
an endless loop.  We need to use list_for_each_entry_safe().

Link: https://lore.kernel.org/r/YKUeq6gwfGcvvhty@mwanda
Fixes: 303694eeee5e ("[SCSI] libsas: suspend / resume support")
Reviewed-by: John Garry <john.garry@huawei.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/libsas/sas_port.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/libsas/sas_port.c b/drivers/scsi/libsas/sas_port.c
index d3c5297c6c89..30e0730f613e 100644
--- a/drivers/scsi/libsas/sas_port.c
+++ b/drivers/scsi/libsas/sas_port.c
@@ -41,7 +41,7 @@ static bool phy_is_wideport_member(struct asd_sas_port *port, struct asd_sas_phy
 
 static void sas_resume_port(struct asd_sas_phy *phy)
 {
-	struct domain_device *dev;
+	struct domain_device *dev, *n;
 	struct asd_sas_port *port = phy->port;
 	struct sas_ha_struct *sas_ha = phy->ha;
 	struct sas_internal *si = to_sas_internal(sas_ha->core.shost->transportt);
@@ -60,7 +60,7 @@ static void sas_resume_port(struct asd_sas_phy *phy)
 	 * 1/ presume every device came back
 	 * 2/ force the next revalidation to check all expander phys
 	 */
-	list_for_each_entry(dev, &port->dev_list, dev_list_node) {
+	list_for_each_entry_safe(dev, n, &port->dev_list, dev_list_node) {
 		int i, rc;
 
 		rc = sas_notify_lldd_dev_found(dev);

From 7ddf79aaf341d3397d214891a220b925da7d83bc Mon Sep 17 00:00:00 2001
From: Taehee Yoo <ap420073@gmail.com>
Date: Sun, 23 May 2021 14:38:53 +0000
Subject: [PATCH 2175/2658] sch_dsmark: fix a NULL deref in qdisc_reset()

[ Upstream commit 9b76eade16423ef06829cccfe3e100cfce31afcd ]

If Qdisc_ops->init() is failed, Qdisc_ops->reset() would be called.
When dsmark_init(Qdisc_ops->init()) is failed, it possibly doesn't
initialize dsmark_qdisc_data->q. But dsmark_reset(Qdisc_ops->reset())
uses dsmark_qdisc_data->q pointer wihtout any null checking.
So, panic would occur.

Test commands:
    sysctl net.core.default_qdisc=dsmark -w
    ip link add dummy0 type dummy
    ip link add vw0 link dummy0 type virt_wifi
    ip link set vw0 up

Splat looks like:
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 3 PID: 684 Comm: ip Not tainted 5.12.0+ #910
RIP: 0010:qdisc_reset+0x2b/0x680
Code: 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 41 57 41 56 41 55 41 54
55 48 89 fd 48 83 c7 18 53 48 89 fa 48 c1 ea 03 48 83 ec 20 <80> 3c 02
00 0f 85 09 06 00 00 4c 8b 65 18 0f 1f 44 00 00 65 8b 1d
RSP: 0018:ffff88800fda6bf8 EFLAGS: 00010282
RAX: dffffc0000000000 RBX: ffff8880050ed800 RCX: 0000000000000000
RDX: 0000000000000003 RSI: ffffffff99e34100 RDI: 0000000000000018
RBP: 0000000000000000 R08: fffffbfff346b553 R09: fffffbfff346b553
R10: 0000000000000001 R11: fffffbfff346b552 R12: ffffffffc0824940
R13: ffff888109e83800 R14: 00000000ffffffff R15: ffffffffc08249e0
FS:  00007f5042287680(0000) GS:ffff888119800000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ae1f4dbd90 CR3: 0000000006760002 CR4: 00000000003706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ? rcu_read_lock_bh_held+0xa0/0xa0
 dsmark_reset+0x3d/0xf0 [sch_dsmark]
 qdisc_reset+0xa9/0x680
 qdisc_destroy+0x84/0x370
 qdisc_create_dflt+0x1fe/0x380
 attach_one_default_qdisc.constprop.41+0xa4/0x180
 dev_activate+0x4d5/0x8c0
 ? __dev_open+0x268/0x390
 __dev_open+0x270/0x390

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/sch_dsmark.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 5f8f6d94336c..f5d2c32dae24 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -404,7 +404,8 @@ static void dsmark_reset(struct Qdisc *sch)
 	struct dsmark_qdisc_data *p = qdisc_priv(sch);
 
 	pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
-	qdisc_reset(p->q);
+	if (p->q)
+		qdisc_reset(p->q);
 	sch->qstats.backlog = 0;
 	sch->q.qlen = 0;
 }

From 304637069f56f61a5954b35004cc5b8d5e8ebabb Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Sun, 16 May 2021 17:01:08 -0700
Subject: [PATCH 2176/2658] MIPS: alchemy: xxs1500: add gpio-au1000.h header
 file

[ Upstream commit ff4cff962a7eedc73e54b5096693da7f86c61346 ]

board-xxs1500.c references 2 functions without declaring them, so add
the header file to placate the build.

../arch/mips/alchemy/board-xxs1500.c: In function 'board_setup':
../arch/mips/alchemy/board-xxs1500.c:56:2: error: implicit declaration of function 'alchemy_gpio1_input_enable' [-Werror=implicit-function-declaration]
   56 |  alchemy_gpio1_input_enable();
../arch/mips/alchemy/board-xxs1500.c:57:2: error: implicit declaration of function 'alchemy_gpio2_enable'; did you mean 'alchemy_uart_enable'? [-Werror=implicit-function-declaration]
   57 |  alchemy_gpio2_enable();

Fixes: 8e026910fcd4 ("MIPS: Alchemy: merge GPR/MTX-1/XXS1500 board code into single files")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: linux-mips@vger.kernel.org
Cc: Manuel Lauss <manuel.lauss@googlemail.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Acked-by: Manuel Lauss <manuel.lauss@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/alchemy/board-xxs1500.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/alchemy/board-xxs1500.c b/arch/mips/alchemy/board-xxs1500.c
index 0fc53e08a894..c05f7376148a 100644
--- a/arch/mips/alchemy/board-xxs1500.c
+++ b/arch/mips/alchemy/board-xxs1500.c
@@ -30,6 +30,7 @@
 #include <asm/bootinfo.h>
 #include <asm/reboot.h>
 #include <asm/mach-au1x00/au1000.h>
+#include <asm/mach-au1x00/gpio-au1000.h>
 #include <prom.h>
 
 const char *get_system_type(void)

From d8a688714549c0157a8369ef4a1aaa91d66c62ef Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Sun, 16 May 2021 17:54:17 -0700
Subject: [PATCH 2177/2658] MIPS: ralink: export rt_sysc_membase for
 rt2880_wdt.c

[ Upstream commit fef532ea0cd871afab7d9a7b6e9da99ac2c24371 ]

rt2880_wdt.c uses (well, attempts to use) rt_sysc_membase. However,
when this watchdog driver is built as a loadable module, there is a
build error since the rt_sysc_membase symbol is not exported.
Export it to quell the build error.

ERROR: modpost: "rt_sysc_membase" [drivers/watchdog/rt2880_wdt.ko] undefined!

Fixes: 473cf939ff34 ("watchdog: add ralink watchdog driver")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Wim Van Sebroeck <wim@iguana.be>
Cc: John Crispin <john@phrozen.org>
Cc: linux-mips@vger.kernel.org
Cc: linux-watchdog@vger.kernel.org
Acked-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/ralink/of.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/mips/ralink/of.c b/arch/mips/ralink/of.c
index f9eda5d8f82c..df2e7e3b2a5a 100644
--- a/arch/mips/ralink/of.c
+++ b/arch/mips/ralink/of.c
@@ -10,6 +10,7 @@
 
 #include <linux/io.h>
 #include <linux/clk.h>
+#include <linux/export.h>
 #include <linux/init.h>
 #include <linux/sizes.h>
 #include <linux/of_fdt.h>
@@ -27,6 +28,7 @@
 
 __iomem void *rt_sysc_membase;
 __iomem void *rt_memc_membase;
+EXPORT_SYMBOL_GPL(rt_sysc_membase);
 
 __iomem void *plat_of_remap_node(const char *node)
 {

From 337ad1cece2d6a65d53fae92f57366dbcc7e9721 Mon Sep 17 00:00:00 2001
From: Mike Kravetz <mike.kravetz@oracle.com>
Date: Sat, 30 Nov 2019 17:56:30 -0800
Subject: [PATCH 2178/2658] hugetlbfs: hugetlb_fault_mutex_hash() cleanup

commit 552546366a30d88bd1d6f5efe848b2ab50fd57e5 upstream.

A new clang diagnostic (-Wsizeof-array-div) warns about the calculation
to determine the number of u32's in an array of unsigned longs.
Suppress warning by adding parentheses.

While looking at the above issue, noticed that the 'address' parameter
to hugetlb_fault_mutex_hash is no longer used.  So, remove it from the
definition and all callers.

No functional change.

Link: http://lkml.kernel.org/r/20190919011847.18400-1-mike.kravetz@oracle.com
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
Reported-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Davidlohr Bueso <dbueso@suse.de>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Ilie Halip <ilie.halip@gmail.com>
Cc: David Bolvansky <david.bolvansky@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/hugetlbfs/inode.c    | 4 ++--
 include/linux/hugetlb.h | 2 +-
 mm/hugetlb.c            | 8 ++++----
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index b743aa5bce0d..1d5e3b0a3b1a 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -414,7 +414,7 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
 			if (next >= end)
 				break;
 
-			hash = hugetlb_fault_mutex_hash(h, mapping, next, 0);
+			hash = hugetlb_fault_mutex_hash(h, mapping, next);
 			mutex_lock(&hugetlb_fault_mutex_table[hash]);
 
 			lock_page(page);
@@ -630,7 +630,7 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
 		addr = index * hpage_size;
 
 		/* mutex taken here, fault path and hole punch */
-		hash = hugetlb_fault_mutex_hash(h, mapping, index, addr);
+		hash = hugetlb_fault_mutex_hash(h, mapping, index);
 		mutex_lock(&hugetlb_fault_mutex_table[hash]);
 
 		/* See if already present in mapping to avoid alloc/free */
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index d03194174a88..151ff61419dd 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -92,7 +92,7 @@ void free_huge_page(struct page *page);
 void hugetlb_fix_reserve_counts(struct inode *inode, bool restore_reserve);
 extern struct mutex *hugetlb_fault_mutex_table;
 u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping,
-				pgoff_t idx, unsigned long address);
+				pgoff_t idx);
 
 pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud);
 
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index e933cae307bf..86a5c9852acf 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3771,7 +3771,7 @@ static int hugetlb_no_page(struct mm_struct *mm, struct vm_area_struct *vma,
 
 #ifdef CONFIG_SMP
 u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping,
-			    pgoff_t idx, unsigned long address)
+			    pgoff_t idx)
 {
 	unsigned long key[2];
 	u32 hash;
@@ -3779,7 +3779,7 @@ u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping,
 	key[0] = (unsigned long) mapping;
 	key[1] = idx;
 
-	hash = jhash2((u32 *)&key, sizeof(key)/sizeof(u32), 0);
+	hash = jhash2((u32 *)&key, sizeof(key)/(sizeof(u32)), 0);
 
 	return hash & (num_fault_mutexes - 1);
 }
@@ -3789,7 +3789,7 @@ u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping,
  * return 0 and avoid the hashing overhead.
  */
 u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping,
-			    pgoff_t idx, unsigned long address)
+			    pgoff_t idx)
 {
 	return 0;
 }
@@ -3834,7 +3834,7 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
 	 * get spurious allocation failures if two CPUs race to instantiate
 	 * the same page in the page cache.
 	 */
-	hash = hugetlb_fault_mutex_hash(h, mapping, idx, address);
+	hash = hugetlb_fault_mutex_hash(h, mapping, idx);
 	mutex_lock(&hugetlb_fault_mutex_table[hash]);
 
 	entry = huge_ptep_get(ptep);

From ec4014de71e0b63ddac67551ea9b54adf99b6a2b Mon Sep 17 00:00:00 2001
From: Lin Ma <linma@zju.edu.cn>
Date: Mon, 12 Apr 2021 19:17:57 +0800
Subject: [PATCH 2179/2658] bluetooth: eliminate the potential race condition
 when removing the HCI controller

commit e2cb6b891ad2b8caa9131e3be70f45243df82a80 upstream.

There is a possible race condition vulnerability between issuing a HCI
command and removing the cont.  Specifically, functions hci_req_sync()
and hci_dev_do_close() can race each other like below:

thread-A in hci_req_sync()      |   thread-B in hci_dev_do_close()
                                |   hci_req_sync_lock(hdev);
test_bit(HCI_UP, &hdev->flags); |
...                             |   test_and_clear_bit(HCI_UP, &hdev->flags)
hci_req_sync_lock(hdev);        |
                                |
In this commit we alter the sequence in function hci_req_sync(). Hence,
the thread-A cannot issue th.

Signed-off-by: Lin Ma <linma@zju.edu.cn>
Cc: Marcel Holtmann <marcel@holtmann.org>
Fixes: 7c6a329e4447 ("[Bluetooth] Fix regression from using default link policy")
[iwamatsu: adjust filename, arguments of __hci_req_sync(). CVE-2021-32399]
Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_core.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 462483c98955..d8d107316a3a 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -371,12 +371,17 @@ static int hci_req_sync(struct hci_dev *hdev,
 {
 	int ret;
 
-	if (!test_bit(HCI_UP, &hdev->flags))
-		return -ENETDOWN;
-
 	/* Serialize all requests */
 	hci_req_lock(hdev);
-	ret = __hci_req_sync(hdev, req, opt, timeout);
+	/* check the state after obtaing the lock to protect the HCI_UP
+	 * against any races from hci_dev_do_close when the controller
+	 * gets removed.
+	 */
+	if (test_bit(HCI_UP, &hdev->flags))
+		ret = __hci_req_sync(hdev, req, opt, timeout);
+	else
+		ret = -ENETDOWN;
+
 	hci_req_unlock(hdev);
 
 	return ret;

From f74c9f5be0fdd3944da8cef325aaf3a9e83f2752 Mon Sep 17 00:00:00 2001
From: Chunfeng Yun <chunfeng.yun@mediatek.com>
Date: Sat, 10 Apr 2021 09:20:45 +0800
Subject: [PATCH 2180/2658] usb: core: reduce power-on-good delay time of root
 hub

commit 90d28fb53d4a51299ff324dede015d5cb11b88a2 upstream.

Return the exactly delay time given by root hub descriptor,
this helps to reduce resume time etc.

Due to the root hub descriptor is usually provided by the host
controller driver, if there is compatibility for a root hub,
we can fix it easily without affect other root hub

Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Link: https://lore.kernel.org/r/1618017645-12259-1-git-send-email-chunfeng.yun@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/hub.h | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/core/hub.h b/drivers/usb/core/hub.h
index 688817fb3246..f824c7f78ae5 100644
--- a/drivers/usb/core/hub.h
+++ b/drivers/usb/core/hub.h
@@ -140,8 +140,10 @@ static inline unsigned hub_power_on_good_delay(struct usb_hub *hub)
 {
 	unsigned delay = hub->descriptor->bPwrOn2PwrGood * 2;
 
-	/* Wait at least 100 msec for power to become stable */
-	return max(delay, 100U);
+	if (!hub->hdev->parent)	/* root hub */
+		return delay;
+	else /* Wait at least 100 msec for power to become stable */
+		return max(delay, 100U);
 }
 
 static inline int hub_port_debounce_be_connected(struct usb_hub *hub,

From 0b0934eb72a2a8b894b18632e8c61857f092fb55 Mon Sep 17 00:00:00 2001
From: "H. Peter Anvin" <hpa@zytor.com>
Date: Wed, 8 Jun 2016 12:38:39 -0700
Subject: [PATCH 2181/2658] x86, asm: change the GEN_*_RMWcc() macros to not
 quote the condition

commit 18fe58229d80c7f4f138a07e84ba608e1ebd232b upstream.

Change the lexical defintion of the GEN_*_RMWcc() macros to not take
the condition code as a quoted string.  This will help support
changing them to use the new __GCC_ASM_FLAG_OUTPUTS__ feature in a
subsequent patch.

Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Link: http://lkml.kernel.org/r/1465414726-197858-4-git-send-email-hpa@linux.intel.com
Reviewed-by: Andy Lutomirski <luto@kernel.org>
Reviewed-by: Borislav Petkov <bp@suse.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/atomic.h      | 8 ++++----
 arch/x86/include/asm/atomic64_64.h | 8 ++++----
 arch/x86/include/asm/bitops.h      | 6 +++---
 arch/x86/include/asm/local.h       | 8 ++++----
 arch/x86/include/asm/preempt.h     | 2 +-
 arch/x86/include/asm/rmwcc.h       | 4 ++--
 6 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
index afc2387323c9..47cb64dd319a 100644
--- a/arch/x86/include/asm/atomic.h
+++ b/arch/x86/include/asm/atomic.h
@@ -77,7 +77,7 @@ static __always_inline void atomic_sub(int i, atomic_t *v)
  */
 static __always_inline int atomic_sub_and_test(int i, atomic_t *v)
 {
-	GEN_BINARY_RMWcc(LOCK_PREFIX "subl", v->counter, "er", i, "%0", "e");
+	GEN_BINARY_RMWcc(LOCK_PREFIX "subl", v->counter, "er", i, "%0", e);
 }
 
 /**
@@ -114,7 +114,7 @@ static __always_inline void atomic_dec(atomic_t *v)
  */
 static __always_inline int atomic_dec_and_test(atomic_t *v)
 {
-	GEN_UNARY_RMWcc(LOCK_PREFIX "decl", v->counter, "%0", "e");
+	GEN_UNARY_RMWcc(LOCK_PREFIX "decl", v->counter, "%0", e);
 }
 
 /**
@@ -127,7 +127,7 @@ static __always_inline int atomic_dec_and_test(atomic_t *v)
  */
 static __always_inline int atomic_inc_and_test(atomic_t *v)
 {
-	GEN_UNARY_RMWcc(LOCK_PREFIX "incl", v->counter, "%0", "e");
+	GEN_UNARY_RMWcc(LOCK_PREFIX "incl", v->counter, "%0", e);
 }
 
 /**
@@ -141,7 +141,7 @@ static __always_inline int atomic_inc_and_test(atomic_t *v)
  */
 static __always_inline int atomic_add_negative(int i, atomic_t *v)
 {
-	GEN_BINARY_RMWcc(LOCK_PREFIX "addl", v->counter, "er", i, "%0", "s");
+	GEN_BINARY_RMWcc(LOCK_PREFIX "addl", v->counter, "er", i, "%0", s);
 }
 
 /**
diff --git a/arch/x86/include/asm/atomic64_64.h b/arch/x86/include/asm/atomic64_64.h
index 377fa50cc271..fbb9a82599ab 100644
--- a/arch/x86/include/asm/atomic64_64.h
+++ b/arch/x86/include/asm/atomic64_64.h
@@ -72,7 +72,7 @@ static inline void atomic64_sub(long i, atomic64_t *v)
  */
 static inline int atomic64_sub_and_test(long i, atomic64_t *v)
 {
-	GEN_BINARY_RMWcc(LOCK_PREFIX "subq", v->counter, "er", i, "%0", "e");
+	GEN_BINARY_RMWcc(LOCK_PREFIX "subq", v->counter, "er", i, "%0", e);
 }
 
 /**
@@ -111,7 +111,7 @@ static __always_inline void atomic64_dec(atomic64_t *v)
  */
 static inline int atomic64_dec_and_test(atomic64_t *v)
 {
-	GEN_UNARY_RMWcc(LOCK_PREFIX "decq", v->counter, "%0", "e");
+	GEN_UNARY_RMWcc(LOCK_PREFIX "decq", v->counter, "%0", e);
 }
 
 /**
@@ -124,7 +124,7 @@ static inline int atomic64_dec_and_test(atomic64_t *v)
  */
 static inline int atomic64_inc_and_test(atomic64_t *v)
 {
-	GEN_UNARY_RMWcc(LOCK_PREFIX "incq", v->counter, "%0", "e");
+	GEN_UNARY_RMWcc(LOCK_PREFIX "incq", v->counter, "%0", e);
 }
 
 /**
@@ -138,7 +138,7 @@ static inline int atomic64_inc_and_test(atomic64_t *v)
  */
 static inline int atomic64_add_negative(long i, atomic64_t *v)
 {
-	GEN_BINARY_RMWcc(LOCK_PREFIX "addq", v->counter, "er", i, "%0", "s");
+	GEN_BINARY_RMWcc(LOCK_PREFIX "addq", v->counter, "er", i, "%0", s);
 }
 
 /**
diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
index cfe3b954d5e4..a32545e638cb 100644
--- a/arch/x86/include/asm/bitops.h
+++ b/arch/x86/include/asm/bitops.h
@@ -203,7 +203,7 @@ static inline void change_bit(long nr, volatile unsigned long *addr)
  */
 static inline int test_and_set_bit(long nr, volatile unsigned long *addr)
 {
-	GEN_BINARY_RMWcc(LOCK_PREFIX "bts", *addr, "Ir", nr, "%0", "c");
+	GEN_BINARY_RMWcc(LOCK_PREFIX "bts", *addr, "Ir", nr, "%0", c);
 }
 
 /**
@@ -249,7 +249,7 @@ static inline int __test_and_set_bit(long nr, volatile unsigned long *addr)
  */
 static inline int test_and_clear_bit(long nr, volatile unsigned long *addr)
 {
-	GEN_BINARY_RMWcc(LOCK_PREFIX "btr", *addr, "Ir", nr, "%0", "c");
+	GEN_BINARY_RMWcc(LOCK_PREFIX "btr", *addr, "Ir", nr, "%0", c);
 }
 
 /**
@@ -302,7 +302,7 @@ static inline int __test_and_change_bit(long nr, volatile unsigned long *addr)
  */
 static inline int test_and_change_bit(long nr, volatile unsigned long *addr)
 {
-	GEN_BINARY_RMWcc(LOCK_PREFIX "btc", *addr, "Ir", nr, "%0", "c");
+	GEN_BINARY_RMWcc(LOCK_PREFIX "btc", *addr, "Ir", nr, "%0", c);
 }
 
 static __always_inline int constant_test_bit(long nr, const volatile unsigned long *addr)
diff --git a/arch/x86/include/asm/local.h b/arch/x86/include/asm/local.h
index 4ad6560847b1..53238f0da79e 100644
--- a/arch/x86/include/asm/local.h
+++ b/arch/x86/include/asm/local.h
@@ -52,7 +52,7 @@ static inline void local_sub(long i, local_t *l)
  */
 static inline int local_sub_and_test(long i, local_t *l)
 {
-	GEN_BINARY_RMWcc(_ASM_SUB, l->a.counter, "er", i, "%0", "e");
+	GEN_BINARY_RMWcc(_ASM_SUB, l->a.counter, "er", i, "%0", e);
 }
 
 /**
@@ -65,7 +65,7 @@ static inline int local_sub_and_test(long i, local_t *l)
  */
 static inline int local_dec_and_test(local_t *l)
 {
-	GEN_UNARY_RMWcc(_ASM_DEC, l->a.counter, "%0", "e");
+	GEN_UNARY_RMWcc(_ASM_DEC, l->a.counter, "%0", e);
 }
 
 /**
@@ -78,7 +78,7 @@ static inline int local_dec_and_test(local_t *l)
  */
 static inline int local_inc_and_test(local_t *l)
 {
-	GEN_UNARY_RMWcc(_ASM_INC, l->a.counter, "%0", "e");
+	GEN_UNARY_RMWcc(_ASM_INC, l->a.counter, "%0", e);
 }
 
 /**
@@ -92,7 +92,7 @@ static inline int local_inc_and_test(local_t *l)
  */
 static inline int local_add_negative(long i, local_t *l)
 {
-	GEN_BINARY_RMWcc(_ASM_ADD, l->a.counter, "er", i, "%0", "s");
+	GEN_BINARY_RMWcc(_ASM_ADD, l->a.counter, "er", i, "%0", s);
 }
 
 /**
diff --git a/arch/x86/include/asm/preempt.h b/arch/x86/include/asm/preempt.h
index 01bcde84d3e4..ad6661ca315d 100644
--- a/arch/x86/include/asm/preempt.h
+++ b/arch/x86/include/asm/preempt.h
@@ -81,7 +81,7 @@ static __always_inline void __preempt_count_sub(int val)
  */
 static __always_inline bool __preempt_count_dec_and_test(void)
 {
-	GEN_UNARY_RMWcc("decl", __preempt_count, __percpu_arg(0), "e");
+	GEN_UNARY_RMWcc("decl", __preempt_count, __percpu_arg(0), e);
 }
 
 /*
diff --git a/arch/x86/include/asm/rmwcc.h b/arch/x86/include/asm/rmwcc.h
index 8f7866a5b9a4..cb0dce0273c8 100644
--- a/arch/x86/include/asm/rmwcc.h
+++ b/arch/x86/include/asm/rmwcc.h
@@ -5,7 +5,7 @@
 
 #define __GEN_RMWcc(fullop, var, cc, ...)				\
 do {									\
-	asm_volatile_goto (fullop "; j" cc " %l[cc_label]"		\
+	asm_volatile_goto (fullop "; j" #cc " %l[cc_label]"		\
 			: : "m" (var), ## __VA_ARGS__ 			\
 			: "memory" : cc_label);				\
 	return 0;							\
@@ -24,7 +24,7 @@ cc_label:								\
 #define __GEN_RMWcc(fullop, var, cc, ...)				\
 do {									\
 	char c;								\
-	asm volatile (fullop "; set" cc " %1"				\
+	asm volatile (fullop "; set" #cc " %1"				\
 			: "+m" (var), "=qm" (c)				\
 			: __VA_ARGS__ : "memory");			\
 	return c != 0;							\

From 96c53c321f689ecc6ffd647966f0af5853b23fb9 Mon Sep 17 00:00:00 2001
From: Jan Beulich <JBeulich@suse.com>
Date: Mon, 26 Feb 2018 04:11:51 -0700
Subject: [PATCH 2182/2658] x86/asm: Add instruction suffixes to bitops

commit 22636f8c9511245cb3c8412039f1dd95afb3aa59 upstream.

Omitting suffixes from instructions in AT&T mode is bad practice when
operand size cannot be determined by the assembler from register
operands, and is likely going to be warned about by upstream gas in the
future (mine does already). Add the missing suffixes here. Note that for
64-bit this means some operations change from being 32-bit to 64-bit.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/5A93F98702000078001ABACC@prv-mh.provo.novell.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/bitops.h | 29 ++++++++++++++++-------------
 arch/x86/include/asm/percpu.h |  2 +-
 2 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
index a32545e638cb..390e323a4de9 100644
--- a/arch/x86/include/asm/bitops.h
+++ b/arch/x86/include/asm/bitops.h
@@ -77,7 +77,7 @@ set_bit(long nr, volatile unsigned long *addr)
 			: "iq" ((u8)CONST_MASK(nr))
 			: "memory");
 	} else {
-		asm volatile(LOCK_PREFIX "bts %1,%0"
+		asm volatile(LOCK_PREFIX __ASM_SIZE(bts) " %1,%0"
 			: BITOP_ADDR(addr) : "Ir" (nr) : "memory");
 	}
 }
@@ -93,7 +93,7 @@ set_bit(long nr, volatile unsigned long *addr)
  */
 static inline void __set_bit(long nr, volatile unsigned long *addr)
 {
-	asm volatile("bts %1,%0" : ADDR : "Ir" (nr) : "memory");
+	asm volatile(__ASM_SIZE(bts) " %1,%0" : ADDR : "Ir" (nr) : "memory");
 }
 
 /**
@@ -114,7 +114,7 @@ clear_bit(long nr, volatile unsigned long *addr)
 			: CONST_MASK_ADDR(nr, addr)
 			: "iq" ((u8)~CONST_MASK(nr)));
 	} else {
-		asm volatile(LOCK_PREFIX "btr %1,%0"
+		asm volatile(LOCK_PREFIX __ASM_SIZE(btr) " %1,%0"
 			: BITOP_ADDR(addr)
 			: "Ir" (nr));
 	}
@@ -136,7 +136,7 @@ static inline void clear_bit_unlock(long nr, volatile unsigned long *addr)
 
 static inline void __clear_bit(long nr, volatile unsigned long *addr)
 {
-	asm volatile("btr %1,%0" : ADDR : "Ir" (nr));
+	asm volatile(__ASM_SIZE(btr) " %1,%0" : ADDR : "Ir" (nr));
 }
 
 /*
@@ -168,7 +168,7 @@ static inline void __clear_bit_unlock(long nr, volatile unsigned long *addr)
  */
 static inline void __change_bit(long nr, volatile unsigned long *addr)
 {
-	asm volatile("btc %1,%0" : ADDR : "Ir" (nr));
+	asm volatile(__ASM_SIZE(btc) " %1,%0" : ADDR : "Ir" (nr));
 }
 
 /**
@@ -187,7 +187,7 @@ static inline void change_bit(long nr, volatile unsigned long *addr)
 			: CONST_MASK_ADDR(nr, addr)
 			: "iq" ((u8)CONST_MASK(nr)));
 	} else {
-		asm volatile(LOCK_PREFIX "btc %1,%0"
+		asm volatile(LOCK_PREFIX __ASM_SIZE(btc) " %1,%0"
 			: BITOP_ADDR(addr)
 			: "Ir" (nr));
 	}
@@ -203,7 +203,8 @@ static inline void change_bit(long nr, volatile unsigned long *addr)
  */
 static inline int test_and_set_bit(long nr, volatile unsigned long *addr)
 {
-	GEN_BINARY_RMWcc(LOCK_PREFIX "bts", *addr, "Ir", nr, "%0", c);
+	GEN_BINARY_RMWcc(LOCK_PREFIX __ASM_SIZE(bts),
+	                 *addr, "Ir", nr, "%0", c);
 }
 
 /**
@@ -232,7 +233,7 @@ static inline int __test_and_set_bit(long nr, volatile unsigned long *addr)
 {
 	int oldbit;
 
-	asm("bts %2,%1\n\t"
+	asm(__ASM_SIZE(bts) " %2,%1\n\t"
 	    "sbb %0,%0"
 	    : "=r" (oldbit), ADDR
 	    : "Ir" (nr));
@@ -249,7 +250,8 @@ static inline int __test_and_set_bit(long nr, volatile unsigned long *addr)
  */
 static inline int test_and_clear_bit(long nr, volatile unsigned long *addr)
 {
-	GEN_BINARY_RMWcc(LOCK_PREFIX "btr", *addr, "Ir", nr, "%0", c);
+	GEN_BINARY_RMWcc(LOCK_PREFIX __ASM_SIZE(btr),
+	                 *addr, "Ir", nr, "%0", c);
 }
 
 /**
@@ -272,7 +274,7 @@ static inline int __test_and_clear_bit(long nr, volatile unsigned long *addr)
 {
 	int oldbit;
 
-	asm volatile("btr %2,%1\n\t"
+	asm volatile(__ASM_SIZE(btr) " %2,%1\n\t"
 		     "sbb %0,%0"
 		     : "=r" (oldbit), ADDR
 		     : "Ir" (nr));
@@ -284,7 +286,7 @@ static inline int __test_and_change_bit(long nr, volatile unsigned long *addr)
 {
 	int oldbit;
 
-	asm volatile("btc %2,%1\n\t"
+	asm volatile(__ASM_SIZE(btc) " %2,%1\n\t"
 		     "sbb %0,%0"
 		     : "=r" (oldbit), ADDR
 		     : "Ir" (nr) : "memory");
@@ -302,7 +304,8 @@ static inline int __test_and_change_bit(long nr, volatile unsigned long *addr)
  */
 static inline int test_and_change_bit(long nr, volatile unsigned long *addr)
 {
-	GEN_BINARY_RMWcc(LOCK_PREFIX "btc", *addr, "Ir", nr, "%0", c);
+	GEN_BINARY_RMWcc(LOCK_PREFIX __ASM_SIZE(btc),
+	                 *addr, "Ir", nr, "%0", c);
 }
 
 static __always_inline int constant_test_bit(long nr, const volatile unsigned long *addr)
@@ -315,7 +318,7 @@ static inline int variable_test_bit(long nr, volatile const unsigned long *addr)
 {
 	int oldbit;
 
-	asm volatile("bt %2,%1\n\t"
+	asm volatile(__ASM_SIZE(bt) " %2,%1\n\t"
 		     "sbb %0,%0"
 		     : "=r" (oldbit)
 		     : "m" (*(unsigned long *)addr), "Ir" (nr));
diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
index f5e780bfa2b3..66cd0c862a80 100644
--- a/arch/x86/include/asm/percpu.h
+++ b/arch/x86/include/asm/percpu.h
@@ -534,7 +534,7 @@ static inline int x86_this_cpu_variable_test_bit(int nr,
 {
 	int oldbit;
 
-	asm volatile("bt "__percpu_arg(2)",%1\n\t"
+	asm volatile("btl "__percpu_arg(2)",%1\n\t"
 			"sbb %0,%0"
 			: "=r" (oldbit)
 			: "m" (*(unsigned long *)addr), "Ir" (nr));

From 3abafaaeb8cbbdd26fbedb99f0d519881fd667dd Mon Sep 17 00:00:00 2001
From: Jan Beulich <JBeulich@suse.com>
Date: Mon, 26 Feb 2018 04:11:21 -0700
Subject: [PATCH 2183/2658] x86/entry/64: Add instruction suffix

commit a368d7fd2a3c6babb852fe974018dd97916bcd3b upstream.

Omitting suffixes from instructions in AT&T mode is bad practice when
operand size cannot be determined by the assembler from register
operands, and is likely going to be warned about by upstream gas in the
future (mine does already). Add the single missing suffix here.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/5A93F96902000078001ABAC8@prv-mh.provo.novell.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/entry/entry_64.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index ea732853b4e4..350fb7442dea 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -57,7 +57,7 @@ ENDPROC(native_usergs_sysret64)
 
 .macro TRACE_IRQS_IRETQ
 #ifdef CONFIG_TRACE_IRQFLAGS
-	bt	$9, EFLAGS(%rsp)		/* interrupts off? */
+	btl	$9, EFLAGS(%rsp)		/* interrupts off? */
 	jnc	1f
 	TRACE_IRQS_ON
 1:

From 4aecfa46551fe58f31e0cf5bfda7c5bb9e62c70a Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 3 Jun 2021 08:22:09 +0200
Subject: [PATCH 2184/2658] Linux 4.4.271

Link: https://lore.kernel.org/r/20210531130635.070310929@linuxfoundation.org
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jason Self <jason@bluehome.net>
Link: https://lore.kernel.org/r/20210601103052.063407107@linuxfoundation.org
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 8ce8b8386082..eb5df1531c1b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 270
+SUBLEVEL = 271
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From fdb20fbdb53863f9386aa96e781088a541bc0f42 Mon Sep 17 00:00:00 2001
From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Date: Wed, 21 Apr 2021 21:46:36 +0200
Subject: [PATCH 2185/2658] efi: cper: fix snprintf() use in
 cper_dimm_err_location()

[ Upstream commit 942859d969de7f6f7f2659a79237a758b42782da ]

snprintf() should be given the full buffer size, not one less. And it
guarantees nul-termination, so doing it manually afterwards is
pointless.

It's even potentially harmful (though probably not in practice because
CPER_REC_LEN is 256), due to the "return how much would have been
written had the buffer been big enough" semantics. I.e., if the bank
and/or device strings are long enough that the "DIMM location ..."
output gets truncated, writing to msg[n] is a buffer overflow.

Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Fixes: 3760cd20402d4 ("CPER: Adjust code flow of some functions")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/efi/cper.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
index c0e54396f250..dc8d2603612e 100644
--- a/drivers/firmware/efi/cper.c
+++ b/drivers/firmware/efi/cper.c
@@ -257,8 +257,7 @@ static int cper_dimm_err_location(struct cper_mem_err_compact *mem, char *msg)
 	if (!msg || !(mem->validation_bits & CPER_MEM_VALID_MODULE_HANDLE))
 		return 0;
 
-	n = 0;
-	len = CPER_REC_LEN - 1;
+	len = CPER_REC_LEN;
 	dmi_memdev_name(mem->mem_dev_handle, &bank, &device);
 	if (bank && device)
 		n = snprintf(msg, len, "DIMM location: %s %s ", bank, device);
@@ -267,7 +266,6 @@ static int cper_dimm_err_location(struct cper_mem_err_compact *mem, char *msg)
 			     "DIMM location: not present. DMI handle: 0x%.4x ",
 			     mem->mem_dev_handle);
 
-	msg[n] = '\0';
 	return n;
 }
 

From 2cc2fbd3df78625d69ab902440fea43cea6d774a Mon Sep 17 00:00:00 2001
From: Zhen Lei <thunder.leizhen@huawei.com>
Date: Sat, 15 May 2021 10:04:58 +0800
Subject: [PATCH 2186/2658] vfio/pci: Fix error return code in vfio_ecap_init()

[ Upstream commit d1ce2c79156d3baf0830990ab06d296477b93c26 ]

The error code returned from vfio_ext_cap_len() is stored in 'len', not
in 'ret'.

Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Message-Id: <20210515020458.6771-1-thunder.leizhen@huawei.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/pci/vfio_pci_config.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
index 666b234acca0..9891001244ea 100644
--- a/drivers/vfio/pci/vfio_pci_config.c
+++ b/drivers/vfio/pci/vfio_pci_config.c
@@ -1488,7 +1488,7 @@ static int vfio_ecap_init(struct vfio_pci_device *vdev)
 			if (len == 0xFF) {
 				len = vfio_ext_cap_len(vdev, ecap, epos);
 				if (len < 0)
-					return ret;
+					return len;
 			}
 		}
 

From 56c33223ad294d52542e4b6f7714dbe7f1d62a85 Mon Sep 17 00:00:00 2001
From: Max Gurtovoy <mgurtovoy@nvidia.com>
Date: Tue, 18 May 2021 22:21:31 +0300
Subject: [PATCH 2187/2658] vfio/platform: fix module_put call in error flow

[ Upstream commit dc51ff91cf2d1e9a2d941da483602f71d4a51472 ]

The ->parent_module is the one that use in try_module_get. It should
also be the one the we use in module_put during vfio_platform_open().

Fixes: 32a2d71c4e80 ("vfio: platform: introduce vfio-platform-base module")
Signed-off-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Message-Id: <20210518192133.59195-1-mgurtovoy@nvidia.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/platform/vfio_platform_common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c
index e65b142d3422..9b170ce16011 100644
--- a/drivers/vfio/platform/vfio_platform_common.c
+++ b/drivers/vfio/platform/vfio_platform_common.c
@@ -192,7 +192,7 @@ static int vfio_platform_open(void *device_data)
 	vfio_platform_regions_cleanup(vdev);
 err_reg:
 	mutex_unlock(&driver_lock);
-	module_put(THIS_MODULE);
+	module_put(vdev->parent_module);
 	return ret;
 }
 

From e59983da08b16d092df6140ba598cdc8e74af48d Mon Sep 17 00:00:00 2001
From: Julian Anastasov <ja@ssi.bg>
Date: Mon, 24 May 2021 22:54:57 +0300
Subject: [PATCH 2188/2658] ipvs: ignore IP_VS_SVC_F_HASHED flag when adding
 service

[ Upstream commit 56e4ee82e850026d71223262c07df7d6af3bd872 ]

syzbot reported memory leak [1] when adding service with
HASHED flag. We should ignore this flag both from sockopt
and netlink provided data, otherwise the service is not
hashed and not visible while releasing resources.

[1]
BUG: memory leak
unreferenced object 0xffff888115227800 (size 512):
  comm "syz-executor263", pid 8658, jiffies 4294951882 (age 12.560s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff83977188>] kmalloc include/linux/slab.h:556 [inline]
    [<ffffffff83977188>] kzalloc include/linux/slab.h:686 [inline]
    [<ffffffff83977188>] ip_vs_add_service+0x598/0x7c0 net/netfilter/ipvs/ip_vs_ctl.c:1343
    [<ffffffff8397d770>] do_ip_vs_set_ctl+0x810/0xa40 net/netfilter/ipvs/ip_vs_ctl.c:2570
    [<ffffffff838449a8>] nf_setsockopt+0x68/0xa0 net/netfilter/nf_sockopt.c:101
    [<ffffffff839ae4e9>] ip_setsockopt+0x259/0x1ff0 net/ipv4/ip_sockglue.c:1435
    [<ffffffff839fa03c>] raw_setsockopt+0x18c/0x1b0 net/ipv4/raw.c:857
    [<ffffffff83691f20>] __sys_setsockopt+0x1b0/0x360 net/socket.c:2117
    [<ffffffff836920f2>] __do_sys_setsockopt net/socket.c:2128 [inline]
    [<ffffffff836920f2>] __se_sys_setsockopt net/socket.c:2125 [inline]
    [<ffffffff836920f2>] __x64_sys_setsockopt+0x22/0x30 net/socket.c:2125
    [<ffffffff84350efa>] do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
    [<ffffffff84400068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

Reported-and-tested-by: syzbot+e562383183e4b1766930@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Reviewed-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/ipvs/ip_vs_ctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index c7ee962a547b..1adbcdda2158 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -1226,7 +1226,7 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
 	ip_vs_addr_copy(svc->af, &svc->addr, &u->addr);
 	svc->port = u->port;
 	svc->fwmark = u->fwmark;
-	svc->flags = u->flags;
+	svc->flags = u->flags & ~IP_VS_SVC_F_HASHED;
 	svc->timeout = u->timeout * HZ;
 	svc->netmask = u->netmask;
 	svc->ipvs = ipvs;

From 8d92b292273e5e6cc2b111c1a50417ee3e51d658 Mon Sep 17 00:00:00 2001
From: Zhen Lei <thunder.leizhen@huawei.com>
Date: Sat, 8 May 2021 10:47:37 +0800
Subject: [PATCH 2189/2658] HID: pidff: fix error return code in
 hid_pidff_init()

[ Upstream commit 3dd653c077efda8152f4dd395359617d577a54cd ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 224ee88fe395 ("Input: add force feedback driver for PID devices")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/usbhid/hid-pidff.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c
index 08174d341f4a..bc75f1efa0f4 100644
--- a/drivers/hid/usbhid/hid-pidff.c
+++ b/drivers/hid/usbhid/hid-pidff.c
@@ -1304,6 +1304,7 @@ int hid_pidff_init(struct hid_device *hid)
 
 	if (pidff->pool[PID_DEVICE_MANAGED_POOL].value &&
 	    pidff->pool[PID_DEVICE_MANAGED_POOL].value[0] == 0) {
+		error = -EPERM;
 		hid_notice(hid,
 			   "device does not support device managed pool\n");
 		goto fail;

From 7fdf3c3775c1f00f413f3cebbfd25324654cca96 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 28 May 2021 13:45:16 +0200
Subject: [PATCH 2190/2658] netfilter: nfnetlink_cthelper: hit EBUSY on updates
 if size mismatches

[ Upstream commit 8971ee8b087750a23f3cd4dc55bff2d0303fd267 ]

The private helper data size cannot be updated. However, updates that
contain NFCTH_PRIV_DATA_LEN might bogusly hit EBUSY even if the size is
the same.

Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nfnetlink_cthelper.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index 8c1733869343..63a9d5fd00c0 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -355,10 +355,14 @@ static int
 nfnl_cthelper_update(const struct nlattr * const tb[],
 		     struct nf_conntrack_helper *helper)
 {
+	u32 size;
 	int ret;
 
-	if (tb[NFCTH_PRIV_DATA_LEN])
-		return -EBUSY;
+	if (tb[NFCTH_PRIV_DATA_LEN]) {
+		size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN]));
+		if (size != helper->data_len)
+			return -EBUSY;
+	}
 
 	if (tb[NFCTH_POLICY]) {
 		ret = nfnl_cthelper_update_policy(helper, tb[NFCTH_POLICY]);

From 6545e6b38e3b997af5a1dafe93001536ce9016ad Mon Sep 17 00:00:00 2001
From: Zhen Lei <thunder.leizhen@huawei.com>
Date: Sat, 8 May 2021 14:25:17 +0800
Subject: [PATCH 2191/2658] ieee802154: fix error return code in
 ieee802154_add_iface()

[ Upstream commit 79c6b8ed30e54b401c873dbad2511f2a1c525fd5 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: be51da0f3e34 ("ieee802154: Stop using NLA_PUT*().")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Link: https://lore.kernel.org/r/20210508062517.2574-1-thunder.leizhen@huawei.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl-phy.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/ieee802154/nl-phy.c b/net/ieee802154/nl-phy.c
index 77d73014bde3..11f53dc0c1c0 100644
--- a/net/ieee802154/nl-phy.c
+++ b/net/ieee802154/nl-phy.c
@@ -249,8 +249,10 @@ int ieee802154_add_iface(struct sk_buff *skb, struct genl_info *info)
 	}
 
 	if (nla_put_string(msg, IEEE802154_ATTR_PHY_NAME, wpan_phy_name(phy)) ||
-	    nla_put_string(msg, IEEE802154_ATTR_DEV_NAME, dev->name))
+	    nla_put_string(msg, IEEE802154_ATTR_DEV_NAME, dev->name)) {
+		rc = -EMSGSIZE;
 		goto nla_put_failure;
+	}
 	dev_put(dev);
 
 	wpan_phy_put(phy);

From cbcc0593b88e02ce7a8c468057c23d5dbfbb3ed4 Mon Sep 17 00:00:00 2001
From: Wei Yongjun <weiyongjun1@huawei.com>
Date: Wed, 19 May 2021 14:16:14 +0000
Subject: [PATCH 2192/2658] ieee802154: fix error return code in
 ieee802154_llsec_getparams()

[ Upstream commit 373e864cf52403b0974c2f23ca8faf9104234555 ]

Fix to return negative error code -ENOBUFS from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 3e9c156e2c21 ("ieee802154: add netlink interfaces for llsec")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Link: https://lore.kernel.org/r/20210519141614.3040055-1-weiyongjun1@huawei.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl-mac.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/ieee802154/nl-mac.c b/net/ieee802154/nl-mac.c
index 76691a07a2e0..fe31df8dc804 100644
--- a/net/ieee802154/nl-mac.c
+++ b/net/ieee802154/nl-mac.c
@@ -685,8 +685,10 @@ int ieee802154_llsec_getparams(struct sk_buff *skb, struct genl_info *info)
 	    nla_put_u8(msg, IEEE802154_ATTR_LLSEC_SECLEVEL, params.out_level) ||
 	    nla_put_u32(msg, IEEE802154_ATTR_LLSEC_FRAME_COUNTER,
 			be32_to_cpu(params.frame_counter)) ||
-	    ieee802154_llsec_fill_key_id(msg, &params.out_key))
+	    ieee802154_llsec_fill_key_id(msg, &params.out_key)) {
+		rc = -ENOBUFS;
 		goto out_free;
+	}
 
 	dev_put(dev);
 

From 9fc1fe28c4476a20d61bfec23533c980ddae67bf Mon Sep 17 00:00:00 2001
From: Lin Ma <linma@zju.edu.cn>
Date: Tue, 25 May 2021 14:39:02 +0200
Subject: [PATCH 2193/2658] Bluetooth: fix the erroneous flush_work() order

commit 6a137caec23aeb9e036cdfd8a46dd8a366460e5d upstream.

In the cleanup routine for failed initialization of HCI device,
the flush_work(&hdev->rx_work) need to be finished before the
flush_work(&hdev->cmd_work). Otherwise, the hci_rx_work() can
possibly invoke new cmd_work and cause a bug, like double free,
in late processings.

This was assigned CVE-2021-3564.

This patch reorder the flush_work() to fix this bug.

Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Cc: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: linux-bluetooth@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: Hao Xiong <mart1n@zju.edu.cn>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_core.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d8d107316a3a..e6965064e491 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1555,8 +1555,13 @@ static int hci_dev_do_open(struct hci_dev *hdev)
 	} else {
 		/* Init failed, cleanup */
 		flush_work(&hdev->tx_work);
-		flush_work(&hdev->cmd_work);
+
+		/* Since hci_rx_work() is possible to awake new cmd_work
+		 * it should be flushed first to avoid unexpected call of
+		 * hci_cmd_work()
+		 */
 		flush_work(&hdev->rx_work);
+		flush_work(&hdev->cmd_work);
 
 		skb_queue_purge(&hdev->cmd_q);
 		skb_queue_purge(&hdev->rx_q);

From c934e11e943d3781ad51603594a84821f80da992 Mon Sep 17 00:00:00 2001
From: Lin Ma <linma@zju.edu.cn>
Date: Sun, 30 May 2021 21:37:43 +0800
Subject: [PATCH 2194/2658] Bluetooth: use correct lock to prevent UAF of hdev
 object

commit e305509e678b3a4af2b3cfd410f409f7cdaabb52 upstream.

The hci_sock_dev_event() function will cleanup the hdev object for
sockets even if this object may still be in used within the
hci_sock_bound_ioctl() function, result in UAF vulnerability.

This patch replace the BH context lock to serialize these affairs
and prevent the race condition.

Signed-off-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_sock.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 4f6f5d89278b..fbdf3ac7ef2a 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -483,7 +483,7 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event)
 		/* Detach sockets from device */
 		read_lock(&hci_sk_list.lock);
 		sk_for_each(sk, &hci_sk_list.head) {
-			bh_lock_sock_nested(sk);
+			lock_sock(sk);
 			if (hci_pi(sk)->hdev == hdev) {
 				hci_pi(sk)->hdev = NULL;
 				sk->sk_err = EPIPE;
@@ -492,7 +492,7 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event)
 
 				hci_dev_put(hdev);
 			}
-			bh_unlock_sock(sk);
+			release_sock(sk);
 		}
 		read_unlock(&hci_sk_list.lock);
 	}

From 38781e586f32101e3febb289388f9a5f62e65448 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Thu, 3 Jun 2021 19:38:12 +0300
Subject: [PATCH 2195/2658] net: caif: added cfserl_release function

commit bce130e7f392ddde8cfcb09927808ebd5f9c8669 upstream.

Added cfserl_release() function.

Cc: stable@vger.kernel.org
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/caif/cfserl.h | 1 +
 net/caif/cfserl.c         | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/include/net/caif/cfserl.h b/include/net/caif/cfserl.h
index b5b020f3c72e..bc3fae07a25f 100644
--- a/include/net/caif/cfserl.h
+++ b/include/net/caif/cfserl.h
@@ -9,4 +9,5 @@
 #include <net/caif/caif_layer.h>
 
 struct cflayer *cfserl_create(int instance, bool use_stx);
+void cfserl_release(struct cflayer *layer);
 #endif
diff --git a/net/caif/cfserl.c b/net/caif/cfserl.c
index ce60f06d76de..af1e1e36dc90 100644
--- a/net/caif/cfserl.c
+++ b/net/caif/cfserl.c
@@ -31,6 +31,11 @@ static int cfserl_transmit(struct cflayer *layr, struct cfpkt *pkt);
 static void cfserl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
 			   int phyid);
 
+void cfserl_release(struct cflayer *layer)
+{
+	kfree(layer);
+}
+
 struct cflayer *cfserl_create(int instance, bool use_stx)
 {
 	struct cfserl *this = kzalloc(sizeof(struct cfserl), GFP_ATOMIC);

From b4eeb0077034d55a7c0943ca7bf46a8b59b29d0f Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Thu, 3 Jun 2021 19:38:51 +0300
Subject: [PATCH 2196/2658] net: caif: add proper error handling

commit a2805dca5107d5603f4bbc027e81e20d93476e96 upstream.

caif_enroll_dev() can fail in some cases. Ingnoring
these cases can lead to memory leak due to not assigning
link_support pointer to anywhere.

Fixes: 7c18d2205ea7 ("caif: Restructure how link caif link layer enroll")
Cc: stable@vger.kernel.org
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/caif/caif_dev.h |  2 +-
 include/net/caif/cfcnfg.h   |  2 +-
 net/caif/caif_dev.c         |  8 +++++---
 net/caif/cfcnfg.c           | 16 +++++++++++-----
 4 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/include/net/caif/caif_dev.h b/include/net/caif/caif_dev.h
index 028b754ae9b1..0baf2e21a533 100644
--- a/include/net/caif/caif_dev.h
+++ b/include/net/caif/caif_dev.h
@@ -119,7 +119,7 @@ void caif_free_client(struct cflayer *adap_layer);
  * The link_support layer is used to add any Link Layer specific
  * framing.
  */
-void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,
+int caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,
 			struct cflayer *link_support, int head_room,
 			struct cflayer **layer, int (**rcv_func)(
 				struct sk_buff *, struct net_device *,
diff --git a/include/net/caif/cfcnfg.h b/include/net/caif/cfcnfg.h
index 70bfd017581f..219094ace893 100644
--- a/include/net/caif/cfcnfg.h
+++ b/include/net/caif/cfcnfg.h
@@ -62,7 +62,7 @@ void cfcnfg_remove(struct cfcnfg *cfg);
  * @fcs:	Specify if checksum is used in CAIF Framing Layer.
  * @head_room:	Head space needed by link specific protocol.
  */
-void
+int
 cfcnfg_add_phy_layer(struct cfcnfg *cnfg,
 		     struct net_device *dev, struct cflayer *phy_layer,
 		     enum cfcnfg_phy_preference pref,
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index a0443d40d677..b80584b32b65 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -303,7 +303,7 @@ static void dev_flowctrl(struct net_device *dev, int on)
 	caifd_put(caifd);
 }
 
-void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,
+int caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,
 		     struct cflayer *link_support, int head_room,
 		     struct cflayer **layer,
 		     int (**rcv_func)(struct sk_buff *, struct net_device *,
@@ -314,11 +314,12 @@ void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,
 	enum cfcnfg_phy_preference pref;
 	struct cfcnfg *cfg = get_cfcnfg(dev_net(dev));
 	struct caif_device_entry_list *caifdevs;
+	int res;
 
 	caifdevs = caif_device_list(dev_net(dev));
 	caifd = caif_device_alloc(dev);
 	if (!caifd)
-		return;
+		return -ENOMEM;
 	*layer = &caifd->layer;
 	spin_lock_init(&caifd->flow_lock);
 
@@ -340,7 +341,7 @@ void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,
 		sizeof(caifd->layer.name) - 1);
 	caifd->layer.name[sizeof(caifd->layer.name) - 1] = 0;
 	caifd->layer.transmit = transmit;
-	cfcnfg_add_phy_layer(cfg,
+	res = cfcnfg_add_phy_layer(cfg,
 				dev,
 				&caifd->layer,
 				pref,
@@ -350,6 +351,7 @@ void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,
 	mutex_unlock(&caifdevs->lock);
 	if (rcv_func)
 		*rcv_func = receive;
+	return res;
 }
 EXPORT_SYMBOL(caif_enroll_dev);
 
diff --git a/net/caif/cfcnfg.c b/net/caif/cfcnfg.c
index fa39fc298708..c45b531a6cd5 100644
--- a/net/caif/cfcnfg.c
+++ b/net/caif/cfcnfg.c
@@ -455,7 +455,7 @@ cfcnfg_linkup_rsp(struct cflayer *layer, u8 channel_id, enum cfctrl_srv serv,
 	rcu_read_unlock();
 }
 
-void
+int
 cfcnfg_add_phy_layer(struct cfcnfg *cnfg,
 		     struct net_device *dev, struct cflayer *phy_layer,
 		     enum cfcnfg_phy_preference pref,
@@ -464,7 +464,7 @@ cfcnfg_add_phy_layer(struct cfcnfg *cnfg,
 {
 	struct cflayer *frml;
 	struct cfcnfg_phyinfo *phyinfo = NULL;
-	int i;
+	int i, res = 0;
 	u8 phyid;
 
 	mutex_lock(&cnfg->lock);
@@ -478,12 +478,15 @@ cfcnfg_add_phy_layer(struct cfcnfg *cnfg,
 			goto got_phyid;
 	}
 	pr_warn("Too many CAIF Link Layers (max 6)\n");
+	res = -EEXIST;
 	goto out;
 
 got_phyid:
 	phyinfo = kzalloc(sizeof(struct cfcnfg_phyinfo), GFP_ATOMIC);
-	if (!phyinfo)
+	if (!phyinfo) {
+		res = -ENOMEM;
 		goto out_err;
+	}
 
 	phy_layer->id = phyid;
 	phyinfo->pref = pref;
@@ -497,8 +500,10 @@ cfcnfg_add_phy_layer(struct cfcnfg *cnfg,
 
 	frml = cffrml_create(phyid, fcs);
 
-	if (!frml)
+	if (!frml) {
+		res = -ENOMEM;
 		goto out_err;
+	}
 	phyinfo->frm_layer = frml;
 	layer_set_up(frml, cnfg->mux);
 
@@ -516,11 +521,12 @@ cfcnfg_add_phy_layer(struct cfcnfg *cnfg,
 	list_add_rcu(&phyinfo->node, &cnfg->phys);
 out:
 	mutex_unlock(&cnfg->lock);
-	return;
+	return res;
 
 out_err:
 	kfree(phyinfo);
 	mutex_unlock(&cnfg->lock);
+	return res;
 }
 EXPORT_SYMBOL(cfcnfg_add_phy_layer);
 

From 0645767325dd027283f4d56acfce10f36ae79d3a Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Thu, 3 Jun 2021 19:39:11 +0300
Subject: [PATCH 2197/2658] net: caif: fix memory leak in caif_device_notify

commit b53558a950a89824938e9811eddfc8efcd94e1bb upstream.

In case of caif_enroll_dev() fail, allocated
link_support won't be assigned to the corresponding
structure. So simply free allocated pointer in case
of error

Fixes: 7c18d2205ea7 ("caif: Restructure how link caif link layer enroll")
Cc: stable@vger.kernel.org
Reported-and-tested-by: syzbot+7ec324747ce876a29db6@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/caif/caif_dev.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index b80584b32b65..a28ffbbf7450 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -366,6 +366,7 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
 	struct cflayer *layer, *link_support;
 	int head_room = 0;
 	struct caif_device_entry_list *caifdevs;
+	int res;
 
 	cfg = get_cfcnfg(dev_net(dev));
 	caifdevs = caif_device_list(dev_net(dev));
@@ -391,8 +392,10 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
 				break;
 			}
 		}
-		caif_enroll_dev(dev, caifdev, link_support, head_room,
+		res = caif_enroll_dev(dev, caifdev, link_support, head_room,
 				&layer, NULL);
+		if (res)
+			cfserl_release(link_support);
 		caifdev->flowctrl = dev_flowctrl;
 		break;
 

From 1ab36473653e0ef16f08c1e615242c7b2dae676a Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Thu, 3 Jun 2021 19:39:35 +0300
Subject: [PATCH 2198/2658] net: caif: fix memory leak in cfusbl_device_notify

commit 7f5d86669fa4d485523ddb1d212e0a2d90bd62bb upstream.

In case of caif_enroll_dev() fail, allocated
link_support won't be assigned to the corresponding
structure. So simply free allocated pointer in case
of error.

Fixes: 7ad65bf68d70 ("caif: Add support for CAIF over CDC NCM USB interface")
Cc: stable@vger.kernel.org
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/caif/caif_usb.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/net/caif/caif_usb.c b/net/caif/caif_usb.c
index 5cd44f001f64..485dde566c1a 100644
--- a/net/caif/caif_usb.c
+++ b/net/caif/caif_usb.c
@@ -116,6 +116,11 @@ static struct cflayer *cfusbl_create(int phyid, u8 ethaddr[ETH_ALEN],
 	return (struct cflayer *) this;
 }
 
+static void cfusbl_release(struct cflayer *layer)
+{
+	kfree(layer);
+}
+
 static struct packet_type caif_usb_type __read_mostly = {
 	.type = cpu_to_be16(ETH_P_802_EX1),
 };
@@ -128,6 +133,7 @@ static int cfusbl_device_notify(struct notifier_block *me, unsigned long what,
 	struct cflayer *layer, *link_support;
 	struct usbnet *usbnet;
 	struct usb_device *usbdev;
+	int res;
 
 	/* Check whether we have a NCM device, and find its VID/PID. */
 	if (!(dev->dev.parent && dev->dev.parent->driver &&
@@ -170,8 +176,11 @@ static int cfusbl_device_notify(struct notifier_block *me, unsigned long what,
 	if (dev->num_tx_queues > 1)
 		pr_warn("USB device uses more than one tx queue\n");
 
-	caif_enroll_dev(dev, &common, link_support, CFUSB_MAX_HEADLEN,
+	res = caif_enroll_dev(dev, &common, link_support, CFUSB_MAX_HEADLEN,
 			&layer, &caif_usb_type.func);
+	if (res)
+		goto err;
+
 	if (!pack_added)
 		dev_add_pack(&caif_usb_type);
 	pack_added = true;
@@ -181,6 +190,9 @@ static int cfusbl_device_notify(struct notifier_block *me, unsigned long what,
 	layer->name[sizeof(layer->name) - 1] = 0;
 
 	return 0;
+err:
+	cfusbl_release(link_support);
+	return res;
 }
 
 static struct notifier_block caif_device_notifier = {

From 3aeae1d78996629fb8006e375a5c7e013d90fc5a Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 2 Jun 2021 13:38:23 +0200
Subject: [PATCH 2199/2658] ALSA: timer: Fix master timer notification

commit 9c1fe96bded935369f8340c2ac2e9e189f697d5d upstream.

snd_timer_notify1() calls the notification to each slave for a master
event, but it passes a wrong event number.  It should be +10 offset,
corresponding to SNDRV_TIMER_EVENT_MXXX, but it's incorrectly with
+100 offset.  Casually this was spotted by UBSAN check via syzkaller.

Reported-by: syzbot+d102fa5b35335a7e544e@syzkaller.appspotmail.com
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/000000000000e5560e05c3bd1d63@google.com
Link: https://lore.kernel.org/r/20210602113823.23777-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/timer.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/core/timer.c b/sound/core/timer.c
index 94c563c2c1dc..ce18099f95de 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -432,9 +432,10 @@ static void snd_timer_notify1(struct snd_timer_instance *ti, int event)
 		return;
 	if (timer->hw.flags & SNDRV_TIMER_HW_SLAVE)
 		return;
+	event += 10; /* convert to SNDRV_TIMER_EVENT_MXXX */
 	list_for_each_entry(ts, &ti->slave_active_head, active_list)
 		if (ts->ccallback)
-			ts->ccallback(ts, event + 100, &tstamp, resolution);
+			ts->ccallback(ts, event, &tstamp, resolution);
 }
 
 /* start/continue a master timer */

From 2684f4df8a92d8a065977e817679c75358d1849d Mon Sep 17 00:00:00 2001
From: Ye Bin <yebin10@huawei.com>
Date: Thu, 6 May 2021 22:10:42 +0800
Subject: [PATCH 2200/2658] ext4: fix bug on in ext4_es_cache_extent as
 ext4_split_extent_at failed

commit 082cd4ec240b8734a82a89ffb890216ac98fec68 upstream.

We got follow bug_on when run fsstress with injecting IO fault:
[130747.323114] kernel BUG at fs/ext4/extents_status.c:762!
[130747.323117] Internal error: Oops - BUG: 0 [#1] SMP
......
[130747.334329] Call trace:
[130747.334553]  ext4_es_cache_extent+0x150/0x168 [ext4]
[130747.334975]  ext4_cache_extents+0x64/0xe8 [ext4]
[130747.335368]  ext4_find_extent+0x300/0x330 [ext4]
[130747.335759]  ext4_ext_map_blocks+0x74/0x1178 [ext4]
[130747.336179]  ext4_map_blocks+0x2f4/0x5f0 [ext4]
[130747.336567]  ext4_mpage_readpages+0x4a8/0x7a8 [ext4]
[130747.336995]  ext4_readpage+0x54/0x100 [ext4]
[130747.337359]  generic_file_buffered_read+0x410/0xae8
[130747.337767]  generic_file_read_iter+0x114/0x190
[130747.338152]  ext4_file_read_iter+0x5c/0x140 [ext4]
[130747.338556]  __vfs_read+0x11c/0x188
[130747.338851]  vfs_read+0x94/0x150
[130747.339110]  ksys_read+0x74/0xf0

This patch's modification is according to Jan Kara's suggestion in:
https://patchwork.ozlabs.org/project/linux-ext4/patch/20210428085158.3728201-1-yebin10@huawei.com/
"I see. Now I understand your patch. Honestly, seeing how fragile is trying
to fix extent tree after split has failed in the middle, I would probably
go even further and make sure we fix the tree properly in case of ENOSPC
and EDQUOT (those are easily user triggerable).  Anything else indicates a
HW problem or fs corruption so I'd rather leave the extent tree as is and
don't try to fix it (which also means we will not create overlapping
extents)."

Cc: stable@kernel.org
Signed-off-by: Ye Bin <yebin10@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20210506141042.3298679-1-yebin10@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/extents.c | 43 +++++++++++++++++++++++--------------------
 1 file changed, 23 insertions(+), 20 deletions(-)

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 71005a944151..50f98d6a4416 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3268,7 +3268,10 @@ static int ext4_split_extent_at(handle_t *handle,
 		ext4_ext_mark_unwritten(ex2);
 
 	err = ext4_ext_insert_extent(handle, inode, ppath, &newex, flags);
-	if (err == -ENOSPC && (EXT4_EXT_MAY_ZEROOUT & split_flag)) {
+	if (err != -ENOSPC && err != -EDQUOT)
+		goto out;
+
+	if (EXT4_EXT_MAY_ZEROOUT & split_flag) {
 		if (split_flag & (EXT4_EXT_DATA_VALID1|EXT4_EXT_DATA_VALID2)) {
 			if (split_flag & EXT4_EXT_DATA_VALID1) {
 				err = ext4_ext_zeroout(inode, ex2);
@@ -3294,30 +3297,30 @@ static int ext4_split_extent_at(handle_t *handle,
 					      ext4_ext_pblock(&orig_ex));
 		}
 
-		if (err)
-			goto fix_extent_len;
-		/* update the extent length and mark as initialized */
-		ex->ee_len = cpu_to_le16(ee_len);
-		ext4_ext_try_to_merge(handle, inode, path, ex);
-		err = ext4_ext_dirty(handle, inode, path + path->p_depth);
-		if (err)
-			goto fix_extent_len;
-
-		/* update extent status tree */
-		err = ext4_zeroout_es(inode, &zero_ex);
-
-		goto out;
-	} else if (err)
-		goto fix_extent_len;
-
-out:
-	ext4_ext_show_leaf(inode, path);
-	return err;
+		if (!err) {
+			/* update the extent length and mark as initialized */
+			ex->ee_len = cpu_to_le16(ee_len);
+			ext4_ext_try_to_merge(handle, inode, path, ex);
+			err = ext4_ext_dirty(handle, inode, path + path->p_depth);
+			if (!err)
+				/* update extent status tree */
+				err = ext4_zeroout_es(inode, &zero_ex);
+			/* If we failed at this point, we don't know in which
+			 * state the extent tree exactly is so don't try to fix
+			 * length of the original extent as it may do even more
+			 * damage.
+			 */
+			goto out;
+		}
+	}
 
 fix_extent_len:
 	ex->ee_len = orig_ex.ee_len;
 	ext4_ext_dirty(handle, inode, path + path->p_depth);
 	return err;
+out:
+	ext4_ext_show_leaf(inode, path);
+	return err;
 }
 
 /*

From 166c59510617c5744b037b3173a410d2a852bfaa Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Fri, 4 Jun 2021 20:01:14 -0700
Subject: [PATCH 2201/2658] pid: take a reference when initializing `cad_pid`

commit 0711f0d7050b9e07c44bc159bbc64ac0a1022c7f upstream.

During boot, kernel_init_freeable() initializes `cad_pid` to the init
task's struct pid.  Later on, we may change `cad_pid` via a sysctl, and
when this happens proc_do_cad_pid() will increment the refcount on the
new pid via get_pid(), and will decrement the refcount on the old pid
via put_pid().  As we never called get_pid() when we initialized
`cad_pid`, we decrement a reference we never incremented, can therefore
free the init task's struct pid early.  As there can be dangling
references to the struct pid, we can later encounter a use-after-free
(e.g.  when delivering signals).

This was spotted when fuzzing v5.13-rc3 with Syzkaller, but seems to
have been around since the conversion of `cad_pid` to struct pid in
commit 9ec52099e4b8 ("[PATCH] replace cad_pid by a struct pid") from the
pre-KASAN stone age of v2.6.19.

Fix this by getting a reference to the init task's struct pid when we
assign it to `cad_pid`.

Full KASAN splat below.

   ==================================================================
   BUG: KASAN: use-after-free in ns_of_pid include/linux/pid.h:153 [inline]
   BUG: KASAN: use-after-free in task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509
   Read of size 4 at addr ffff23794dda0004 by task syz-executor.0/273

   CPU: 1 PID: 273 Comm: syz-executor.0 Not tainted 5.12.0-00001-g9aef892b2d15 #1
   Hardware name: linux,dummy-virt (DT)
   Call trace:
    ns_of_pid include/linux/pid.h:153 [inline]
    task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509
    do_notify_parent+0x308/0xe60 kernel/signal.c:1950
    exit_notify kernel/exit.c:682 [inline]
    do_exit+0x2334/0x2bd0 kernel/exit.c:845
    do_group_exit+0x108/0x2c8 kernel/exit.c:922
    get_signal+0x4e4/0x2a88 kernel/signal.c:2781
    do_signal arch/arm64/kernel/signal.c:882 [inline]
    do_notify_resume+0x300/0x970 arch/arm64/kernel/signal.c:936
    work_pending+0xc/0x2dc

   Allocated by task 0:
    slab_post_alloc_hook+0x50/0x5c0 mm/slab.h:516
    slab_alloc_node mm/slub.c:2907 [inline]
    slab_alloc mm/slub.c:2915 [inline]
    kmem_cache_alloc+0x1f4/0x4c0 mm/slub.c:2920
    alloc_pid+0xdc/0xc00 kernel/pid.c:180
    copy_process+0x2794/0x5e18 kernel/fork.c:2129
    kernel_clone+0x194/0x13c8 kernel/fork.c:2500
    kernel_thread+0xd4/0x110 kernel/fork.c:2552
    rest_init+0x44/0x4a0 init/main.c:687
    arch_call_rest_init+0x1c/0x28
    start_kernel+0x520/0x554 init/main.c:1064
    0x0

   Freed by task 270:
    slab_free_hook mm/slub.c:1562 [inline]
    slab_free_freelist_hook+0x98/0x260 mm/slub.c:1600
    slab_free mm/slub.c:3161 [inline]
    kmem_cache_free+0x224/0x8e0 mm/slub.c:3177
    put_pid.part.4+0xe0/0x1a8 kernel/pid.c:114
    put_pid+0x30/0x48 kernel/pid.c:109
    proc_do_cad_pid+0x190/0x1b0 kernel/sysctl.c:1401
    proc_sys_call_handler+0x338/0x4b0 fs/proc/proc_sysctl.c:591
    proc_sys_write+0x34/0x48 fs/proc/proc_sysctl.c:617
    call_write_iter include/linux/fs.h:1977 [inline]
    new_sync_write+0x3ac/0x510 fs/read_write.c:518
    vfs_write fs/read_write.c:605 [inline]
    vfs_write+0x9c4/0x1018 fs/read_write.c:585
    ksys_write+0x124/0x240 fs/read_write.c:658
    __do_sys_write fs/read_write.c:670 [inline]
    __se_sys_write fs/read_write.c:667 [inline]
    __arm64_sys_write+0x78/0xb0 fs/read_write.c:667
    __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
    invoke_syscall arch/arm64/kernel/syscall.c:49 [inline]
    el0_svc_common.constprop.1+0x16c/0x388 arch/arm64/kernel/syscall.c:129
    do_el0_svc+0xf8/0x150 arch/arm64/kernel/syscall.c:168
    el0_svc+0x28/0x38 arch/arm64/kernel/entry-common.c:416
    el0_sync_handler+0x134/0x180 arch/arm64/kernel/entry-common.c:432
    el0_sync+0x154/0x180 arch/arm64/kernel/entry.S:701

   The buggy address belongs to the object at ffff23794dda0000
    which belongs to the cache pid of size 224
   The buggy address is located 4 bytes inside of
    224-byte region [ffff23794dda0000, ffff23794dda00e0)
   The buggy address belongs to the page:
   page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4dda0
   head:(____ptrval____) order:1 compound_mapcount:0
   flags: 0x3fffc0000010200(slab|head)
   raw: 03fffc0000010200 dead000000000100 dead000000000122 ffff23794d40d080
   raw: 0000000000000000 0000000000190019 00000001ffffffff 0000000000000000
   page dumped because: kasan: bad access detected

   Memory state around the buggy address:
    ffff23794dd9ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    ffff23794dd9ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
   >ffff23794dda0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
    ffff23794dda0080: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
    ffff23794dda0100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
   ==================================================================

Link: https://lkml.kernel.org/r/20210524172230.38715-1-mark.rutland@arm.com
Fixes: 9ec52099e4b8678a ("[PATCH] replace cad_pid by a struct pid")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Cedric Le Goater <clg@fr.ibm.com>
Cc: Christian Brauner <christian@brauner.io>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Kees Cook <keescook@chromium.org
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 init/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/init/main.c b/init/main.c
index c789a9c1f92d..8d5c18c19f59 100644
--- a/init/main.c
+++ b/init/main.c
@@ -1015,7 +1015,7 @@ static noinline void __init kernel_init_freeable(void)
 	 */
 	set_cpus_allowed_ptr(current, cpu_all_mask);
 
-	cad_pid = task_pid(current);
+	cad_pid = get_pid(task_pid(current));
 
 	smp_prepare_cpus(setup_max_cpus);
 

From f21c6b1fcbd0f6a93ff66ed50e84a3e8a5b2aa1e Mon Sep 17 00:00:00 2001
From: Junxiao Bi <junxiao.bi@oracle.com>
Date: Fri, 4 Jun 2021 20:01:42 -0700
Subject: [PATCH 2202/2658] ocfs2: fix data corruption by fallocate

commit 6bba4471f0cc1296fe3c2089b9e52442d3074b2e upstream.

When fallocate punches holes out of inode size, if original isize is in
the middle of last cluster, then the part from isize to the end of the
cluster will be zeroed with buffer write, at that time isize is not yet
updated to match the new size, if writeback is kicked in, it will invoke
ocfs2_writepage()->block_write_full_page() where the pages out of inode
size will be dropped.  That will cause file corruption.  Fix this by
zero out eof blocks when extending the inode size.

Running the following command with qemu-image 4.2.1 can get a corrupted
coverted image file easily.

    qemu-img convert -p -t none -T none -f qcow2 $qcow_image \
             -O qcow2 -o compat=1.1 $qcow_image.conv

The usage of fallocate in qemu is like this, it first punches holes out
of inode size, then extend the inode size.

    fallocate(11, FALLOC_FL_KEEP_SIZE|FALLOC_FL_PUNCH_HOLE, 2276196352, 65536) = 0
    fallocate(11, 0, 2276196352, 65536) = 0

v1: https://www.spinics.net/lists/linux-fsdevel/msg193999.html
v2: https://lore.kernel.org/linux-fsdevel/20210525093034.GB4112@quack2.suse.cz/T/

Link: https://lkml.kernel.org/r/20210528210648.9124-1-junxiao.bi@oracle.com
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/file.c | 55 ++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 50 insertions(+), 5 deletions(-)

diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 1d738723a41a..5b0f2c806f03 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1859,6 +1859,45 @@ static int ocfs2_remove_inode_range(struct inode *inode,
 	return ret;
 }
 
+/*
+ * zero out partial blocks of one cluster.
+ *
+ * start: file offset where zero starts, will be made upper block aligned.
+ * len: it will be trimmed to the end of current cluster if "start + len"
+ *      is bigger than it.
+ */
+static int ocfs2_zeroout_partial_cluster(struct inode *inode,
+					u64 start, u64 len)
+{
+	int ret;
+	u64 start_block, end_block, nr_blocks;
+	u64 p_block, offset;
+	u32 cluster, p_cluster, nr_clusters;
+	struct super_block *sb = inode->i_sb;
+	u64 end = ocfs2_align_bytes_to_clusters(sb, start);
+
+	if (start + len < end)
+		end = start + len;
+
+	start_block = ocfs2_blocks_for_bytes(sb, start);
+	end_block = ocfs2_blocks_for_bytes(sb, end);
+	nr_blocks = end_block - start_block;
+	if (!nr_blocks)
+		return 0;
+
+	cluster = ocfs2_bytes_to_clusters(sb, start);
+	ret = ocfs2_get_clusters(inode, cluster, &p_cluster,
+				&nr_clusters, NULL);
+	if (ret)
+		return ret;
+	if (!p_cluster)
+		return 0;
+
+	offset = start_block - ocfs2_clusters_to_blocks(sb, cluster);
+	p_block = ocfs2_clusters_to_blocks(sb, p_cluster) + offset;
+	return sb_issue_zeroout(sb, p_block, nr_blocks, GFP_NOFS);
+}
+
 /*
  * Parts of this function taken from xfs_change_file_space()
  */
@@ -1869,7 +1908,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
 {
 	int ret;
 	s64 llen;
-	loff_t size;
+	loff_t size, orig_isize;
 	struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
 	struct buffer_head *di_bh = NULL;
 	handle_t *handle;
@@ -1900,6 +1939,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
 		goto out_inode_unlock;
 	}
 
+	orig_isize = i_size_read(inode);
 	switch (sr->l_whence) {
 	case 0: /*SEEK_SET*/
 		break;
@@ -1907,7 +1947,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
 		sr->l_start += f_pos;
 		break;
 	case 2: /*SEEK_END*/
-		sr->l_start += i_size_read(inode);
+		sr->l_start += orig_isize;
 		break;
 	default:
 		ret = -EINVAL;
@@ -1961,6 +2001,14 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
 	default:
 		ret = -EINVAL;
 	}
+
+	/* zeroout eof blocks in the cluster. */
+	if (!ret && change_size && orig_isize < size) {
+		ret = ocfs2_zeroout_partial_cluster(inode, orig_isize,
+					size - orig_isize);
+		if (!ret)
+			i_size_write(inode, size);
+	}
 	up_write(&OCFS2_I(inode)->ip_alloc_sem);
 	if (ret) {
 		mlog_errno(ret);
@@ -1977,9 +2025,6 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
 		goto out_inode_unlock;
 	}
 
-	if (change_size && i_size_read(inode) < size)
-		i_size_write(inode, size);
-
 	inode->i_ctime = inode->i_mtime = CURRENT_TIME;
 	ret = ocfs2_mark_inode_dirty(handle, inode, di_bh);
 	if (ret < 0)

From 44a3ca49d379754ca643d5dd8923aacd53f80317 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Date: Mon, 31 May 2021 09:21:38 +0200
Subject: [PATCH 2203/2658] nfc: fix NULL ptr dereference in
 llcp_sock_getname() after failed connect

commit 4ac06a1e013cf5fdd963317ffd3b968560f33bba upstream.

It's possible to trigger NULL pointer dereference by local unprivileged
user, when calling getsockname() after failed bind() (e.g. the bind
fails because LLCP_SAP_MAX used as SAP):

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  CPU: 1 PID: 426 Comm: llcp_sock_getna Not tainted 5.13.0-rc2-next-20210521+ #9
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1 04/01/2014
  Call Trace:
   llcp_sock_getname+0xb1/0xe0
   __sys_getpeername+0x95/0xc0
   ? lockdep_hardirqs_on_prepare+0xd5/0x180
   ? syscall_enter_from_user_mode+0x1c/0x40
   __x64_sys_getpeername+0x11/0x20
   do_syscall_64+0x36/0x70
   entry_SYSCALL_64_after_hwframe+0x44/0xae

This can be reproduced with Syzkaller C repro (bind followed by
getpeername):
https://syzkaller.appspot.com/x/repro.c?x=14def446e00000

Cc: <stable@vger.kernel.org>
Fixes: d646960f7986 ("NFC: Initial LLCP support")
Reported-by: syzbot+80fb126e7f7d8b1a5914@syzkaller.appspotmail.com
Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Link: https://lore.kernel.org/r/20210531072138.5219-1-krzysztof.kozlowski@canonical.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/nfc/llcp_sock.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index 09a49531fa27..ece7a5d59a61 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -121,6 +121,7 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
 	if (!llcp_sock->service_name) {
 		nfc_llcp_local_put(llcp_sock->local);
 		llcp_sock->local = NULL;
+		llcp_sock->dev = NULL;
 		ret = -ENOMEM;
 		goto put_dev;
 	}
@@ -130,6 +131,7 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
 		llcp_sock->local = NULL;
 		kfree(llcp_sock->service_name);
 		llcp_sock->service_name = NULL;
+		llcp_sock->dev = NULL;
 		ret = -EADDRINUSE;
 		goto put_dev;
 	}

From e47eb2c67487dd3ff759e9a3abad97f159aec686 Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Wed, 19 May 2021 13:13:15 -0400
Subject: [PATCH 2204/2658] btrfs: fixup error handling in
 fixup_inode_link_counts

commit 011b28acf940eb61c000059dd9e2cfcbf52ed96b upstream.

This function has the following pattern

	while (1) {
		ret = whatever();
		if (ret)
			goto out;
	}
	ret = 0
out:
	return ret;

However several places in this while loop we simply break; when there's
a problem, thus clearing the return value, and in one case we do a
return -EIO, and leak the memory for the path.

Fix this by re-arranging the loop to deal with ret == 1 coming from
btrfs_search_slot, and then simply delete the

	ret = 0;
out:

bit so everybody can break if there is an error, which will allow for
proper error handling to occur.

CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/tree-log.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 4cab553c347a..ff4df1783219 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -1511,6 +1511,7 @@ static noinline int fixup_inode_link_counts(struct btrfs_trans_handle *trans,
 			break;
 
 		if (ret == 1) {
+			ret = 0;
 			if (path->slots[0] == 0)
 				break;
 			path->slots[0]--;
@@ -1523,17 +1524,19 @@ static noinline int fixup_inode_link_counts(struct btrfs_trans_handle *trans,
 
 		ret = btrfs_del_item(trans, root, path);
 		if (ret)
-			goto out;
+			break;
 
 		btrfs_release_path(path);
 		inode = read_one_inode(root, key.offset);
-		if (!inode)
-			return -EIO;
+		if (!inode) {
+			ret = -EIO;
+			break;
+		}
 
 		ret = fixup_inode_link_count(trans, root, inode);
 		iput(inode);
 		if (ret)
-			goto out;
+			break;
 
 		/*
 		 * fixup on a directory may create new entries,
@@ -1542,8 +1545,6 @@ static noinline int fixup_inode_link_counts(struct btrfs_trans_handle *trans,
 		 */
 		key.offset = (u64)-1;
 	}
-	ret = 0;
-out:
 	btrfs_release_path(path);
 	return ret;
 }

From f8133c73480d661e61eb31dce4fd0d3ebb0fa57a Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Wed, 21 Apr 2021 19:21:22 -0700
Subject: [PATCH 2205/2658] KVM: SVM: Truncate GPR value for DR and CR accesses
 in !64-bit mode

commit 0884335a2e653b8a045083aa1d57ce74269ac81d upstream.

Drop bits 63:32 on loads/stores to/from DRs and CRs when the vCPU is not
in 64-bit mode.  The APM states bits 63:32 are dropped for both DRs and
CRs:

  In 64-bit mode, the operand size is fixed at 64 bits without the need
  for a REX prefix. In non-64-bit mode, the operand size is fixed at 32
  bits and the upper 32 bits of the destination are forced to 0.

Fixes: 7ff76d58a9dc ("KVM: SVM: enhance MOV CR intercept handler")
Fixes: cae3797a4639 ("KVM: SVM: enhance mov DR intercept handler")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210422022128.3464144-4-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[sudip: manual backport to old file]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/svm.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 6938a62a3df4..931acac69703 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -2927,7 +2927,7 @@ static int cr_interception(struct vcpu_svm *svm)
 	err = 0;
 	if (cr >= 16) { /* mov to cr */
 		cr -= 16;
-		val = kvm_register_read(&svm->vcpu, reg);
+		val = kvm_register_readl(&svm->vcpu, reg);
 		switch (cr) {
 		case 0:
 			if (!check_selective_cr0_intercepted(svm, val))
@@ -2972,7 +2972,7 @@ static int cr_interception(struct vcpu_svm *svm)
 			kvm_queue_exception(&svm->vcpu, UD_VECTOR);
 			return 1;
 		}
-		kvm_register_write(&svm->vcpu, reg, val);
+		kvm_register_writel(&svm->vcpu, reg, val);
 	}
 	kvm_complete_insn_gp(&svm->vcpu, err);
 
@@ -3004,13 +3004,13 @@ static int dr_interception(struct vcpu_svm *svm)
 	if (dr >= 16) { /* mov to DRn */
 		if (!kvm_require_dr(&svm->vcpu, dr - 16))
 			return 1;
-		val = kvm_register_read(&svm->vcpu, reg);
+		val = kvm_register_readl(&svm->vcpu, reg);
 		kvm_set_dr(&svm->vcpu, dr - 16, val);
 	} else {
 		if (!kvm_require_dr(&svm->vcpu, dr))
 			return 1;
 		kvm_get_dr(&svm->vcpu, dr, &val);
-		kvm_register_write(&svm->vcpu, reg, val);
+		kvm_register_writel(&svm->vcpu, reg, val);
 	}
 
 	skip_emulated_instruction(&svm->vcpu);

From 99ebc24eb9be2a908c5ccb57ba850808c4216feb Mon Sep 17 00:00:00 2001
From: Michael Weiser <michael.weiser@gmx.de>
Date: Thu, 1 Feb 2018 23:13:36 +0100
Subject: [PATCH 2206/2658] arm64: Remove unimplemented syscall log message

commit 1962682d2b2fbe6cfa995a85c53c069fadda473e upstream.

Stop printing a (ratelimited) kernel message for each instance of an
unimplemented syscall being called. Userland making an unimplemented
syscall is not necessarily misbehaviour and to be expected with a
current userland running on an older kernel. Also, the current message
looks scary to users but does not actually indicate a real problem nor
help them narrow down the cause. Just rely on sys_ni_syscall() to return
-ENOSYS.

Cc: <stable@vger.kernel.org>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kernel/traps.c | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index ef1a20a30dfe..286f8ab615c0 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -485,14 +485,6 @@ asmlinkage long do_ni_syscall(struct pt_regs *regs)
 	}
 #endif
 
-	if (show_unhandled_signals_ratelimited()) {
-		pr_info("%s[%d]: syscall %d\n", current->comm,
-			task_pid_nr(current), (int)regs->syscallno);
-		dump_instr("", regs);
-		if (user_mode(regs))
-			__show_regs(regs);
-	}
-
 	return sys_ni_syscall();
 }
 

From 5440d770641c491e8333692caa93dca7e3217804 Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Tue, 18 May 2021 18:13:42 +0200
Subject: [PATCH 2207/2658] xen-pciback: redo VF placement in the virtual
 topology

The commit referenced below was incomplete: It merely affected what
would get written to the vdev-<N> xenstore node. The guest would still
find the function at the original function number as long as
__xen_pcibk_get_pci_dev() wouldn't be in sync. The same goes for AER wrt
__xen_pcibk_get_pcifront_dev().

Undo overriding the function to zero and instead make sure that VFs at
function zero remain alone in their slot. This has the added benefit of
improving overall capacity, considering that there's only a total of 32
slots available right now (PCI segment and bus can both only ever be
zero at present).

This is upstream commit 4ba50e7c423c29639878c00573288869aa627068.

Fixes: 8a5248fe10b1 ("xen PV passthru: assign SR-IOV virtual functions to
separate virtual slots")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Link: https://lore.kernel.org/r/8def783b-404c-3452-196d-3f3fd4d72c9e@suse.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/xen-pciback/vpci.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/xen/xen-pciback/vpci.c b/drivers/xen/xen-pciback/vpci.c
index c99f8bb1c56c..e6c7509a3d87 100644
--- a/drivers/xen/xen-pciback/vpci.c
+++ b/drivers/xen/xen-pciback/vpci.c
@@ -68,7 +68,7 @@ static int __xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev,
 				   struct pci_dev *dev, int devid,
 				   publish_pci_dev_cb publish_cb)
 {
-	int err = 0, slot, func = -1;
+	int err = 0, slot, func = PCI_FUNC(dev->devfn);
 	struct pci_dev_entry *t, *dev_entry;
 	struct vpci_dev_data *vpci_dev = pdev->pci_dev_data;
 
@@ -93,23 +93,26 @@ static int __xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev,
 
 	/*
 	 * Keep multi-function devices together on the virtual PCI bus, except
-	 * virtual functions.
+	 * that we want to keep virtual functions at func 0 on their own. They
+	 * aren't multi-function devices and hence their presence at func 0
+	 * may cause guests to not scan the other functions.
 	 */
-	if (!dev->is_virtfn) {
+	if (!dev->is_virtfn || func) {
 		for (slot = 0; slot < PCI_SLOT_MAX; slot++) {
 			if (list_empty(&vpci_dev->dev_list[slot]))
 				continue;
 
 			t = list_entry(list_first(&vpci_dev->dev_list[slot]),
 				       struct pci_dev_entry, list);
+			if (t->dev->is_virtfn && !PCI_FUNC(t->dev->devfn))
+				continue;
 
 			if (match_slot(dev, t->dev)) {
 				pr_info("vpci: %s: assign to virtual slot %d func %d\n",
 					pci_name(dev), slot,
-					PCI_FUNC(dev->devfn));
+					func);
 				list_add_tail(&dev_entry->list,
 					      &vpci_dev->dev_list[slot]);
-				func = PCI_FUNC(dev->devfn);
 				goto unlock;
 			}
 		}
@@ -122,7 +125,6 @@ static int __xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev,
 				pci_name(dev), slot);
 			list_add_tail(&dev_entry->list,
 				      &vpci_dev->dev_list[slot]);
-			func = dev->is_virtfn ? 0 : PCI_FUNC(dev->devfn);
 			goto unlock;
 		}
 	}

From 2b6e44a70bbdb6fb215d81e590051ccd2221f494 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 10 Jun 2021 12:41:36 +0200
Subject: [PATCH 2208/2658] Linux 4.4.272

Link: https://lore.kernel.org/r/20210608175926.524658689@linuxfoundation.org
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Jason Self <jason@bluehome.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index eb5df1531c1b..236c27b90378 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 271
+SUBLEVEL = 272
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 794d62aec0cfe1dc07e79b6f2bc272148df9a6aa Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Tue, 8 Jun 2021 10:12:21 -0700
Subject: [PATCH 2209/2658] proc: Track /proc/$pid/attr/ opener mm_struct

commit 591a22c14d3f45cc38bd1931c593c221df2f1881 upstream.

Commit bfb819ea20ce ("proc: Check /proc/$pid/attr/ writes against file opener")
tried to make sure that there could not be a confusion between the opener of
a /proc/$pid/attr/ file and the writer. It used struct cred to make sure
the privileges didn't change. However, there were existing cases where a more
privileged thread was passing the opened fd to a differently privileged thread
(during container setup). Instead, use mm_struct to track whether the opener
and writer are still the same process. (This is what several other proc files
already do, though for different reasons.)

Reported-by: Christian Brauner <christian.brauner@ubuntu.com>
Reported-by: Andrea Righi <andrea.righi@canonical.com>
Tested-by: Andrea Righi <andrea.righi@canonical.com>
Fixes: bfb819ea20ce ("proc: Check /proc/$pid/attr/ writes against file opener")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/proc/base.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 9d1fd461b6f0..e880414cc5a2 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2717,6 +2717,11 @@ static int proc_pident_readdir(struct file *file, struct dir_context *ctx,
 }
 
 #ifdef CONFIG_SECURITY
+static int proc_pid_attr_open(struct inode *inode, struct file *file)
+{
+	return __mem_open(inode, file, PTRACE_MODE_READ_FSCREDS);
+}
+
 static ssize_t proc_pid_attr_read(struct file * file, char __user * buf,
 				  size_t count, loff_t *ppos)
 {
@@ -2747,7 +2752,7 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
 	struct task_struct *task = get_proc_task(inode);
 
 	/* A task may only write when it was the opener. */
-	if (file->f_cred != current_real_cred())
+	if (file->private_data != current->mm)
 		return -EPERM;
 
 	length = -ESRCH;
@@ -2788,9 +2793,11 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
 }
 
 static const struct file_operations proc_pid_attr_operations = {
+	.open		= proc_pid_attr_open,
 	.read		= proc_pid_attr_read,
 	.write		= proc_pid_attr_write,
 	.llseek		= generic_file_llseek,
+	.release	= mem_release,
 };
 
 static const struct pid_entry attr_dir_stuff[] = {

From e2e499ac37f56dddc5e254457872e8e15b0f9881 Mon Sep 17 00:00:00 2001
From: Jeimon <jjjinmeng.zhou@gmail.com>
Date: Sat, 8 May 2021 11:52:30 +0800
Subject: [PATCH 2210/2658] net/nfc/rawsock.c: fix a permission check bug

[ Upstream commit 8ab78863e9eff11910e1ac8bcf478060c29b379e ]

The function rawsock_create() calls a privileged function sk_alloc(), which requires a ns-aware check to check net->user_ns, i.e., ns_capable(). However, the original code checks the init_user_ns using capable(). So we replace the capable() with ns_capable().

Signed-off-by: Jeimon <jjjinmeng.zhou@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/nfc/rawsock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
index 92a3cfae4de8..2fba626a0125 100644
--- a/net/nfc/rawsock.c
+++ b/net/nfc/rawsock.c
@@ -345,7 +345,7 @@ static int rawsock_create(struct net *net, struct socket *sock,
 		return -ESOCKTNOSUPPORT;
 
 	if (sock->type == SOCK_RAW) {
-		if (!capable(CAP_NET_RAW))
+		if (!ns_capable(net->user_ns, CAP_NET_RAW))
 			return -EPERM;
 		sock->ops = &rawsock_raw_ops;
 	} else {

From 875bf439bc455609dfa368236b0b773a5df0616b Mon Sep 17 00:00:00 2001
From: Zou Wei <zou_wei@huawei.com>
Date: Wed, 12 May 2021 11:12:25 +0800
Subject: [PATCH 2211/2658] ASoC: sti-sas: add missing MODULE_DEVICE_TABLE

[ Upstream commit e072b2671606c77538d6a4dd5dda80b508cb4816 ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this driver when it is built
as an external module.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Link: https://lore.kernel.org/r/1620789145-14936-1-git-send-email-zou_wei@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/sti-sas.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/codecs/sti-sas.c b/sound/soc/codecs/sti-sas.c
index 160d61a66204..71a1fde5a7ef 100644
--- a/sound/soc/codecs/sti-sas.c
+++ b/sound/soc/codecs/sti-sas.c
@@ -542,6 +542,7 @@ static const struct of_device_id sti_sas_dev_match[] = {
 	},
 	{},
 };
+MODULE_DEVICE_TABLE(of, sti_sas_dev_match);
 
 static int sti_sas_driver_probe(struct platform_device *pdev)
 {

From ac5bb2ced68161ed61cb6f480396fd0b836a752c Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Sun, 16 May 2021 07:11:40 +0000
Subject: [PATCH 2212/2658] isdn: mISDN: netjet: Fix crash in nj_probe:

[ Upstream commit 9f6f852550d0e1b7735651228116ae9d300f69b3 ]

'nj_setup' in netjet.c might fail with -EIO and in this case
'card->irq' is initialized and is bigger than zero. A subsequent call to
'nj_release' will free the irq that has not been requested.

Fix this bug by deleting the previous assignment to 'card->irq' and just
keep the assignment before 'request_irq'.

The KASAN's log reveals it:

[    3.354615 ] WARNING: CPU: 0 PID: 1 at kernel/irq/manage.c:1826
free_irq+0x100/0x480
[    3.355112 ] Modules linked in:
[    3.355310 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted
5.13.0-rc1-00144-g25a1298726e #13
[    3.355816 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[    3.356552 ] RIP: 0010:free_irq+0x100/0x480
[    3.356820 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18
4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5
ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80
[    3.358012 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082
[    3.358357 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX:
0000000000000000
[    3.358814 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI:
00000000ffffffff
[    3.359272 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09:
0000000000000000
[    3.359732 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12:
0000000000000000
[    3.360195 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15:
ffff888104dc80a8
[    3.360652 ] FS:  0000000000000000(0000) GS:ffff88817bc00000(0000)
knlGS:0000000000000000
[    3.361170 ] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    3.361538 ] CR2: 0000000000000000 CR3: 000000000582e000 CR4:
00000000000006f0
[    3.362003 ] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[    3.362175 ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400
[    3.362175 ] Call Trace:
[    3.362175 ]  nj_release+0x51/0x1e0
[    3.362175 ]  nj_probe+0x450/0x950
[    3.362175 ]  ? pci_device_remove+0x110/0x110
[    3.362175 ]  local_pci_probe+0x45/0xa0
[    3.362175 ]  pci_device_probe+0x12b/0x1d0
[    3.362175 ]  really_probe+0x2a9/0x610
[    3.362175 ]  driver_probe_device+0x90/0x1d0
[    3.362175 ]  ? mutex_lock_nested+0x1b/0x20
[    3.362175 ]  device_driver_attach+0x68/0x70
[    3.362175 ]  __driver_attach+0x124/0x1b0
[    3.362175 ]  ? device_driver_attach+0x70/0x70
[    3.362175 ]  bus_for_each_dev+0xbb/0x110
[    3.362175 ]  ? rdinit_setup+0x45/0x45
[    3.362175 ]  driver_attach+0x27/0x30
[    3.362175 ]  bus_add_driver+0x1eb/0x2a0
[    3.362175 ]  driver_register+0xa9/0x180
[    3.362175 ]  __pci_register_driver+0x82/0x90
[    3.362175 ]  ? w6692_init+0x38/0x38
[    3.362175 ]  nj_init+0x36/0x38
[    3.362175 ]  do_one_initcall+0x7f/0x3d0
[    3.362175 ]  ? rdinit_setup+0x45/0x45
[    3.362175 ]  ? rcu_read_lock_sched_held+0x4f/0x80
[    3.362175 ]  kernel_init_freeable+0x2aa/0x301
[    3.362175 ]  ? rest_init+0x2c0/0x2c0
[    3.362175 ]  kernel_init+0x18/0x190
[    3.362175 ]  ? rest_init+0x2c0/0x2c0
[    3.362175 ]  ? rest_init+0x2c0/0x2c0
[    3.362175 ]  ret_from_fork+0x1f/0x30
[    3.362175 ] Kernel panic - not syncing: panic_on_warn set ...
[    3.362175 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted
5.13.0-rc1-00144-g25a1298726e #13
[    3.362175 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[    3.362175 ] Call Trace:
[    3.362175 ]  dump_stack+0xba/0xf5
[    3.362175 ]  ? free_irq+0x100/0x480
[    3.362175 ]  panic+0x15a/0x3f2
[    3.362175 ]  ? __warn+0xf2/0x150
[    3.362175 ]  ? free_irq+0x100/0x480
[    3.362175 ]  __warn+0x108/0x150
[    3.362175 ]  ? free_irq+0x100/0x480
[    3.362175 ]  report_bug+0x119/0x1c0
[    3.362175 ]  handle_bug+0x3b/0x80
[    3.362175 ]  exc_invalid_op+0x18/0x70
[    3.362175 ]  asm_exc_invalid_op+0x12/0x20
[    3.362175 ] RIP: 0010:free_irq+0x100/0x480
[    3.362175 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18
4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5
ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80
[    3.362175 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082
[    3.362175 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX:
0000000000000000
[    3.362175 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI:
00000000ffffffff
[    3.362175 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09:
0000000000000000
[    3.362175 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12:
0000000000000000
[    3.362175 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15:
ffff888104dc80a8
[    3.362175 ]  ? vprintk+0x76/0x150
[    3.362175 ]  ? free_irq+0x100/0x480
[    3.362175 ]  nj_release+0x51/0x1e0
[    3.362175 ]  nj_probe+0x450/0x950
[    3.362175 ]  ? pci_device_remove+0x110/0x110
[    3.362175 ]  local_pci_probe+0x45/0xa0
[    3.362175 ]  pci_device_probe+0x12b/0x1d0
[    3.362175 ]  really_probe+0x2a9/0x610
[    3.362175 ]  driver_probe_device+0x90/0x1d0
[    3.362175 ]  ? mutex_lock_nested+0x1b/0x20
[    3.362175 ]  device_driver_attach+0x68/0x70
[    3.362175 ]  __driver_attach+0x124/0x1b0
[    3.362175 ]  ? device_driver_attach+0x70/0x70
[    3.362175 ]  bus_for_each_dev+0xbb/0x110
[    3.362175 ]  ? rdinit_setup+0x45/0x45
[    3.362175 ]  driver_attach+0x27/0x30
[    3.362175 ]  bus_add_driver+0x1eb/0x2a0
[    3.362175 ]  driver_register+0xa9/0x180
[    3.362175 ]  __pci_register_driver+0x82/0x90
[    3.362175 ]  ? w6692_init+0x38/0x38
[    3.362175 ]  nj_init+0x36/0x38
[    3.362175 ]  do_one_initcall+0x7f/0x3d0
[    3.362175 ]  ? rdinit_setup+0x45/0x45
[    3.362175 ]  ? rcu_read_lock_sched_held+0x4f/0x80
[    3.362175 ]  kernel_init_freeable+0x2aa/0x301
[    3.362175 ]  ? rest_init+0x2c0/0x2c0
[    3.362175 ]  kernel_init+0x18/0x190
[    3.362175 ]  ? rest_init+0x2c0/0x2c0
[    3.362175 ]  ? rest_init+0x2c0/0x2c0
[    3.362175 ]  ret_from_fork+0x1f/0x30
[    3.362175 ] Dumping ftrace buffer:
[    3.362175 ]    (ftrace buffer empty)
[    3.362175 ] Kernel Offset: disabled
[    3.362175 ] Rebooting in 1 seconds..

Reported-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/isdn/hardware/mISDN/netjet.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c
index 8e2944784e00..59eec2014b82 100644
--- a/drivers/isdn/hardware/mISDN/netjet.c
+++ b/drivers/isdn/hardware/mISDN/netjet.c
@@ -1114,7 +1114,6 @@ nj_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 		card->typ = NETJET_S_TJ300;
 
 	card->base = pci_resource_start(pdev, 0);
-	card->irq = pdev->irq;
 	pci_set_drvdata(pdev, card);
 	err = setup_instance(card);
 	if (err)

From 15bed3140b616344e535bdce39a9713a7e25fb3a Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 17 May 2021 16:13:35 +0200
Subject: [PATCH 2213/2658] bonding: init notify_work earlier to avoid
 uninitialized use

[ Upstream commit 35d96e631860226d5dc4de0fad0a415362ec2457 ]

If bond_kobj_init() or later kzalloc() in bond_alloc_slave() fail,
then we call kobject_put() on the slave->kobj. This in turn calls
the release function slave_kobj_release() which will always try to
cancel_delayed_work_sync(&slave->notify_work), which shouldn't be
done on an uninitialized work struct.

Always initialize the work struct earlier to avoid problems here.

Syzbot bisected this down to a completely pointless commit, some
fault injection may have been at work here that caused the alloc
failure in the first place, which may interact badly with bisect.

Reported-by: syzbot+bfda097c12a00c8cae67@syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/bonding/bond_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index a33e8a3b5f0a..d6363ae22052 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1267,6 +1267,7 @@ static struct slave *bond_alloc_slave(struct bonding *bond,
 
 	slave->bond = bond;
 	slave->dev = slave_dev;
+	INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work);
 
 	if (bond_kobj_init(slave))
 		return NULL;
@@ -1279,7 +1280,6 @@ static struct slave *bond_alloc_slave(struct bonding *bond,
 			return NULL;
 		}
 	}
-	INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work);
 
 	return slave;
 }

From 31a712569bda833b1f09434c729f006c4e41e9dd Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 17 May 2021 16:38:09 +0200
Subject: [PATCH 2214/2658] netlink: disable IRQs for netlink_lock_table()

[ Upstream commit 1d482e666b8e74c7555dbdfbfb77205eeed3ff2d ]

Syzbot reports that in mac80211 we have a potential deadlock
between our "local->stop_queue_reasons_lock" (spinlock) and
netlink's nl_table_lock (rwlock). This is because there's at
least one situation in which we might try to send a netlink
message with this spinlock held while it is also possible to
take the spinlock from a hardirq context, resulting in the
following deadlock scenario reported by lockdep:

       CPU0                    CPU1
       ----                    ----
  lock(nl_table_lock);
                               local_irq_disable();
                               lock(&local->queue_stop_reason_lock);
                               lock(nl_table_lock);
  <Interrupt>
    lock(&local->queue_stop_reason_lock);

This seems valid, we can take the queue_stop_reason_lock in
any kind of context ("CPU0"), and call ieee80211_report_ack_skb()
with the spinlock held and IRQs disabled ("CPU1") in some
code path (ieee80211_do_stop() via ieee80211_free_txskb()).

Short of disallowing netlink use in scenarios like these
(which would be rather complex in mac80211's case due to
the deep callchain), it seems the only fix for this is to
disable IRQs while nl_table_lock is held to avoid hitting
this scenario, this disallows the "CPU0" portion of the
reported deadlock.

Note that the writer side (netlink_table_grab()) already
disables IRQs for this lock.

Unfortunately though, this seems like a huge hammer, and
maybe the whole netlink table locking should be reworked.

Reported-by: syzbot+69ff9dff50dcfe14ddd4@syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netlink/af_netlink.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index f4c33b2858e4..1d79550f8024 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -419,11 +419,13 @@ void netlink_table_ungrab(void)
 static inline void
 netlink_lock_table(void)
 {
+	unsigned long flags;
+
 	/* read_lock() synchronizes us to netlink_table_grab */
 
-	read_lock(&nl_table_lock);
+	read_lock_irqsave(&nl_table_lock, flags);
 	atomic_inc(&nl_table_users);
-	read_unlock(&nl_table_lock);
+	read_unlock_irqrestore(&nl_table_lock, flags);
 }
 
 static inline void

From b5af59bc63fad26e0953cd3b7f1d72e5963a621b Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Mon, 17 May 2021 12:04:13 +0300
Subject: [PATCH 2215/2658] net: mdiobus: get rid of a BUG_ON()

[ Upstream commit 1dde47a66d4fb181830d6fa000e5ea86907b639e ]

We spotted a bug recently during a review where a driver was
unregistering a bus that wasn't registered, which would trigger this
BUG_ON().  Let's handle that situation more gracefully, and just print
a warning and return.

Reported-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/mdio_bus.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index ccefba7af960..5ea86fd57ae6 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -308,7 +308,8 @@ void mdiobus_unregister(struct mii_bus *bus)
 {
 	int i;
 
-	BUG_ON(bus->state != MDIOBUS_REGISTERED);
+	if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED))
+		return;
 	bus->state = MDIOBUS_UNREGISTERED;
 
 	for (i = 0; i < PHY_MAX_ADDR; i++) {

From d4d52a108bd47b27d2f21e364ee661cada06d2d8 Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Thu, 20 May 2021 12:32:36 +0000
Subject: [PATCH 2216/2658] net/qla3xxx: fix schedule while atomic in
 ql_sem_spinlock

[ Upstream commit 13a6f3153922391e90036ba2267d34eed63196fc ]

When calling the 'ql_sem_spinlock', the driver has already acquired the
spin lock, so the driver should not call 'ssleep' in atomic context.

This bug can be fixed by using 'mdelay' instead of 'ssleep'.

The KASAN's log reveals it:

[    3.238124 ] BUG: scheduling while atomic: swapper/0/1/0x00000002
[    3.238748 ] 2 locks held by swapper/0/1:
[    3.239151 ]  #0: ffff88810177b240 (&dev->mutex){....}-{3:3}, at:
__device_driver_lock+0x41/0x60
[    3.240026 ]  #1: ffff888107c60e28 (&qdev->hw_lock){....}-{2:2}, at:
ql3xxx_probe+0x2aa/0xea0
[    3.240873 ] Modules linked in:
[    3.241187 ] irq event stamp: 460854
[    3.241541 ] hardirqs last  enabled at (460853): [<ffffffff843051bf>]
_raw_spin_unlock_irqrestore+0x4f/0x70
[    3.242245 ] hardirqs last disabled at (460854): [<ffffffff843058ca>]
_raw_spin_lock_irqsave+0x2a/0x70
[    3.242245 ] softirqs last  enabled at (446076): [<ffffffff846002e4>]
__do_softirq+0x2e4/0x4b1
[    3.242245 ] softirqs last disabled at (446069): [<ffffffff811ba5e0>]
irq_exit_rcu+0x100/0x110
[    3.242245 ] Preemption disabled at:
[    3.242245 ] [<ffffffff828ca5ba>] ql3xxx_probe+0x2aa/0xea0
[    3.242245 ] Kernel panic - not syncing: scheduling while atomic
[    3.242245 ] CPU: 2 PID: 1 Comm: swapper/0 Not tainted
5.13.0-rc1-00145
-gee7dc339169-dirty #16
[    3.242245 ] Call Trace:
[    3.242245 ]  dump_stack+0xba/0xf5
[    3.242245 ]  ? ql3xxx_probe+0x1f0/0xea0
[    3.242245 ]  panic+0x15a/0x3f2
[    3.242245 ]  ? vprintk+0x76/0x150
[    3.242245 ]  ? ql3xxx_probe+0x2aa/0xea0
[    3.242245 ]  __schedule_bug+0xae/0xe0
[    3.242245 ]  __schedule+0x72e/0xa00
[    3.242245 ]  schedule+0x43/0xf0
[    3.242245 ]  schedule_timeout+0x28b/0x500
[    3.242245 ]  ? del_timer_sync+0xf0/0xf0
[    3.242245 ]  ? msleep+0x2f/0x70
[    3.242245 ]  msleep+0x59/0x70
[    3.242245 ]  ql3xxx_probe+0x307/0xea0
[    3.242245 ]  ? _raw_spin_unlock_irqrestore+0x3a/0x70
[    3.242245 ]  ? pci_device_remove+0x110/0x110
[    3.242245 ]  local_pci_probe+0x45/0xa0
[    3.242245 ]  pci_device_probe+0x12b/0x1d0
[    3.242245 ]  really_probe+0x2a9/0x610
[    3.242245 ]  driver_probe_device+0x90/0x1d0
[    3.242245 ]  ? mutex_lock_nested+0x1b/0x20
[    3.242245 ]  device_driver_attach+0x68/0x70
[    3.242245 ]  __driver_attach+0x124/0x1b0
[    3.242245 ]  ? device_driver_attach+0x70/0x70
[    3.242245 ]  bus_for_each_dev+0xbb/0x110
[    3.242245 ]  ? rdinit_setup+0x45/0x45
[    3.242245 ]  driver_attach+0x27/0x30
[    3.242245 ]  bus_add_driver+0x1eb/0x2a0
[    3.242245 ]  driver_register+0xa9/0x180
[    3.242245 ]  __pci_register_driver+0x82/0x90
[    3.242245 ]  ? yellowfin_init+0x25/0x25
[    3.242245 ]  ql3xxx_driver_init+0x23/0x25
[    3.242245 ]  do_one_initcall+0x7f/0x3d0
[    3.242245 ]  ? rdinit_setup+0x45/0x45
[    3.242245 ]  ? rcu_read_lock_sched_held+0x4f/0x80
[    3.242245 ]  kernel_init_freeable+0x2aa/0x301
[    3.242245 ]  ? rest_init+0x2c0/0x2c0
[    3.242245 ]  kernel_init+0x18/0x190
[    3.242245 ]  ? rest_init+0x2c0/0x2c0
[    3.242245 ]  ? rest_init+0x2c0/0x2c0
[    3.242245 ]  ret_from_fork+0x1f/0x30
[    3.242245 ] Dumping ftrace buffer:
[    3.242245 ]    (ftrace buffer empty)
[    3.242245 ] Kernel Offset: disabled
[    3.242245 ] Rebooting in 1 seconds.

Reported-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qla3xxx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
index f2cb77c3b199..192950a112c9 100644
--- a/drivers/net/ethernet/qlogic/qla3xxx.c
+++ b/drivers/net/ethernet/qlogic/qla3xxx.c
@@ -115,7 +115,7 @@ static int ql_sem_spinlock(struct ql3_adapter *qdev,
 		value = readl(&port_regs->CommonRegs.semaphoreReg);
 		if ((value & (sem_mask >> 16)) == sem_bits)
 			return 0;
-		ssleep(1);
+		mdelay(1000);
 	} while (--seconds);
 	return -1;
 }

From 4285f1b399bc72544cd92812b43fd2400f2cc07b Mon Sep 17 00:00:00 2001
From: Matt Wang <wwentao@vmware.com>
Date: Wed, 19 May 2021 09:49:32 +0000
Subject: [PATCH 2217/2658] scsi: vmw_pvscsi: Set correct residual data length

[ Upstream commit e662502b3a782d479e67736a5a1c169a703d853a ]

Some commands (such as INQUIRY) may return less data than the initiator
requested. To avoid conducting useless information, set the right residual
count to make upper layer aware of this.

Before (INQUIRY PAGE 0xB0 with 128B buffer):

$ sg_raw -r 128 /dev/sda 12 01 B0 00 80 00
SCSI Status: Good

Received 128 bytes of data:
 00 00 b0 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 ...<............
 10 00 00 00 00 00 01 00 00 00 00 00 40 00 00 08 00 ...........@....
 20 80 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 .......... .....
 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

After:

$ sg_raw -r 128 /dev/sda 12 01 B0 00 80 00
SCSI Status: Good

Received 64 bytes of data:
00 00 b0 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 ...<............
10 00 00 00 00 00 01 00 00 00 00 00 40 00 00 08 00 ...........@....
20 80 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 .......... .....
30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

[mkp: clarified description]

Link: https://lore.kernel.org/r/03C41093-B62E-43A2-913E-CFC92F1C70C3@vmware.com
Signed-off-by: Matt Wang <wwentao@vmware.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/vmw_pvscsi.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
index 3f2a5d6c437b..d25cf084afe7 100644
--- a/drivers/scsi/vmw_pvscsi.c
+++ b/drivers/scsi/vmw_pvscsi.c
@@ -558,7 +558,13 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter,
 		case BTSTAT_SUCCESS:
 		case BTSTAT_LINKED_COMMAND_COMPLETED:
 		case BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG:
-			/* If everything went fine, let's move on..  */
+			/*
+			 * Commands like INQUIRY may transfer less data than
+			 * requested by the initiator via bufflen. Set residual
+			 * count to make upper layer aware of the actual amount
+			 * of data returned.
+			 */
+			scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen);
 			cmd->result = (DID_OK << 16);
 			break;
 

From e3c8069ab77706b8d145c5526aca9f6c970b040e Mon Sep 17 00:00:00 2001
From: Dmitry Bogdanov <d.bogdanov@yadro.com>
Date: Thu, 15 Apr 2021 23:35:54 +0300
Subject: [PATCH 2218/2658] scsi: target: qla2xxx: Wait for stop_phase1 at WWN
 removal

[ Upstream commit 2ef7665dfd88830f15415ba007c7c9a46be7acd8 ]

Target de-configuration panics at high CPU load because TPGT and WWPN can
be removed on separate threads.

TPGT removal requests a reset HBA on a separate thread and waits for reset
complete (phase1). Due to high CPU load that HBA reset can be delayed for
some time.

WWPN removal does qlt_stop_phase2(). There it is believed that phase1 has
already completed and thus tgt.tgt_ops is subsequently cleared. However,
tgt.tgt_ops is needed to process incoming traffic and therefore this will
cause one of the following panics:

NIP qlt_reset+0x7c/0x220 [qla2xxx]
LR  qlt_reset+0x68/0x220 [qla2xxx]
Call Trace:
0xc000003ffff63a78 (unreliable)
qlt_handle_imm_notify+0x800/0x10c0 [qla2xxx]
qlt_24xx_atio_pkt+0x208/0x590 [qla2xxx]
qlt_24xx_process_atio_queue+0x33c/0x7a0 [qla2xxx]
qla83xx_msix_atio_q+0x54/0x90 [qla2xxx]

or

NIP qlt_24xx_handle_abts+0xd0/0x2a0 [qla2xxx]
LR  qlt_24xx_handle_abts+0xb4/0x2a0 [qla2xxx]
Call Trace:
qlt_24xx_handle_abts+0x90/0x2a0 [qla2xxx] (unreliable)
qlt_24xx_process_atio_queue+0x500/0x7a0 [qla2xxx]
qla83xx_msix_atio_q+0x54/0x90 [qla2xxx]

or

NIP qlt_create_sess+0x90/0x4e0 [qla2xxx]
LR  qla24xx_do_nack_work+0xa8/0x180 [qla2xxx]
Call Trace:
0xc0000000348fba30 (unreliable)
qla24xx_do_nack_work+0xa8/0x180 [qla2xxx]
qla2x00_do_work+0x674/0xbf0 [qla2xxx]
qla2x00_iocb_work_fn

The patch fixes the issue by serializing qlt_stop_phase1() and
qlt_stop_phase2() functions to make WWPN removal wait for phase1
completion.

Link: https://lore.kernel.org/r/20210415203554.27890-1-d.bogdanov@yadro.com
Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com>
Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_target.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 1d9f19e5e0f8..0a8a5841e1b8 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -1042,6 +1042,7 @@ void qlt_stop_phase2(struct qla_tgt *tgt)
 	    "Waiting for %d IRQ commands to complete (tgt %p)",
 	    tgt->irq_cmd_count, tgt);
 
+	mutex_lock(&tgt->ha->optrom_mutex);
 	mutex_lock(&vha->vha_tgt.tgt_mutex);
 	spin_lock_irqsave(&ha->hardware_lock, flags);
 	while (tgt->irq_cmd_count != 0) {
@@ -1053,6 +1054,7 @@ void qlt_stop_phase2(struct qla_tgt *tgt)
 	tgt->tgt_stopped = 1;
 	spin_unlock_irqrestore(&ha->hardware_lock, flags);
 	mutex_unlock(&vha->vha_tgt.tgt_mutex);
+	mutex_unlock(&tgt->ha->optrom_mutex);
 
 	ql_dbg(ql_dbg_tgt_mgt, vha, 0xf00c, "Stop of tgt %p finished",
 	    tgt);

From 4925a62841cb73d4bc6f28f975a055954148711d Mon Sep 17 00:00:00 2001
From: Zong Li <zong.li@sifive.com>
Date: Sat, 22 May 2021 17:16:11 +0800
Subject: [PATCH 2219/2658] net: macb: ensure the device is available before
 accessing GEMGXL control registers

[ Upstream commit 5eff1461a6dec84f04fafa9128548bad51d96147 ]

If runtime power menagement is enabled, the gigabit ethernet PLL would
be disabled after macb_probe(). During this period of time, the system
would hang up if we try to access GEMGXL control registers.

We can't put runtime_pm_get/runtime_pm_put/ there due to the issue of
sleep inside atomic section (7fa2955ff70ce453 ("sh_eth: Fix sleeping
function called from invalid context"). Add netif_running checking to
ensure the device is available before accessing GEMGXL device.

Changed in v2:
 - Use netif_running instead of its own flag

Signed-off-by: Zong Li <zong.li@sifive.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/cadence/macb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index 78803e7de360..d1cdb8540e12 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -1955,6 +1955,9 @@ static struct net_device_stats *gem_get_stats(struct macb *bp)
 	struct gem_stats *hwstat = &bp->hw_stats.gem;
 	struct net_device_stats *nstat = &bp->stats;
 
+	if (!netif_running(bp->dev))
+		return nstat;
+
 	gem_update_stats(bp);
 
 	nstat->rx_errors = (hwstat->rx_frame_check_sequence_errors +

From 39c85be22d332c11b4c146b407ef4c0321bc8495 Mon Sep 17 00:00:00 2001
From: Saubhik Mukherjee <saubhik.mukherjee@gmail.com>
Date: Mon, 24 May 2021 19:07:12 +0530
Subject: [PATCH 2220/2658] net: appletalk: cops: Fix data race in cops_probe1

[ Upstream commit a4dd4fc6105e54393d637450a11d4cddb5fabc4f ]

In cops_probe1(), there is a write to dev->base_addr after requesting an
interrupt line and registering the interrupt handler cops_interrupt().
The handler might be called in parallel to handle an interrupt.
cops_interrupt() tries to read dev->base_addr leading to a potential
data race. So write to dev->base_addr before calling request_irq().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Saubhik Mukherjee <saubhik.mukherjee@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/appletalk/cops.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/appletalk/cops.c b/drivers/net/appletalk/cops.c
index 7f2a032c354c..841a5de58c7c 100644
--- a/drivers/net/appletalk/cops.c
+++ b/drivers/net/appletalk/cops.c
@@ -324,6 +324,8 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr)
 			break;
 	}
 
+	dev->base_addr = ioaddr;
+
 	/* Reserve any actual interrupt. */
 	if (dev->irq) {
 		retval = request_irq(dev->irq, cops_interrupt, 0, dev->name, dev);
@@ -331,8 +333,6 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr)
 			goto err_out;
 	}
 
-	dev->base_addr = ioaddr;
-
         lp = netdev_priv(dev);
         spin_lock_init(&lp->lock);
 

From a03dfeca290dbf0683f171ddd6dbd0159bc9e069 Mon Sep 17 00:00:00 2001
From: Tiezhu Yang <yangtiezhu@loongson.cn>
Date: Sat, 15 May 2021 19:02:01 +0800
Subject: [PATCH 2221/2658] MIPS: Fix kernel hang under FUNCTION_GRAPH_TRACER
 and PREEMPT_TRACER

[ Upstream commit 78cf0eb926cb1abeff2106bae67752e032fe5f3e ]

When update the latest mainline kernel with the following three configs,
the kernel hangs during startup:

(1) CONFIG_FUNCTION_GRAPH_TRACER=y
(2) CONFIG_PREEMPT_TRACER=y
(3) CONFIG_FTRACE_STARTUP_TEST=y

When update the latest mainline kernel with the above two configs (1)
and (2), the kernel starts normally, but it still hangs when execute
the following command:

echo "function_graph" > /sys/kernel/debug/tracing/current_tracer

Without CONFIG_PREEMPT_TRACER=y, the above two kinds of kernel hangs
disappeared, so it seems that CONFIG_PREEMPT_TRACER has some influences
with function_graph tracer at the first glance.

I use ejtag to find out the epc address is related with preempt_enable()
in the file arch/mips/lib/mips-atomic.c, because function tracing can
trace the preempt_{enable,disable} calls that are traced, replace them
with preempt_{enable,disable}_notrace to prevent function tracing from
going into an infinite loop, and then it can fix the kernel hang issue.

By the way, it seems that this commit is a complement and improvement of
commit f93a1a00f2bd ("MIPS: Fix crash that occurs when function tracing
is enabled").

Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Cc: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/lib/mips-atomic.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/arch/mips/lib/mips-atomic.c b/arch/mips/lib/mips-atomic.c
index 272af8ac2425..fd50aa7b178a 100644
--- a/arch/mips/lib/mips-atomic.c
+++ b/arch/mips/lib/mips-atomic.c
@@ -37,7 +37,7 @@
  */
 notrace void arch_local_irq_disable(void)
 {
-	preempt_disable();
+	preempt_disable_notrace();
 
 	__asm__ __volatile__(
 	"	.set	push						\n"
@@ -53,7 +53,7 @@ notrace void arch_local_irq_disable(void)
 	: /* no inputs */
 	: "memory");
 
-	preempt_enable();
+	preempt_enable_notrace();
 }
 EXPORT_SYMBOL(arch_local_irq_disable);
 
@@ -62,7 +62,7 @@ notrace unsigned long arch_local_irq_save(void)
 {
 	unsigned long flags;
 
-	preempt_disable();
+	preempt_disable_notrace();
 
 	__asm__ __volatile__(
 	"	.set	push						\n"
@@ -79,7 +79,7 @@ notrace unsigned long arch_local_irq_save(void)
 	: /* no inputs */
 	: "memory");
 
-	preempt_enable();
+	preempt_enable_notrace();
 
 	return flags;
 }
@@ -89,7 +89,7 @@ notrace void arch_local_irq_restore(unsigned long flags)
 {
 	unsigned long __tmp1;
 
-	preempt_disable();
+	preempt_disable_notrace();
 
 	__asm__ __volatile__(
 	"	.set	push						\n"
@@ -107,7 +107,7 @@ notrace void arch_local_irq_restore(unsigned long flags)
 	: "0" (flags)
 	: "memory");
 
-	preempt_enable();
+	preempt_enable_notrace();
 }
 EXPORT_SYMBOL(arch_local_irq_restore);
 

From 2b63ed0d78105b48f5ddf85018faa6f67b55866f Mon Sep 17 00:00:00 2001
From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Date: Tue, 25 May 2021 19:00:12 +0800
Subject: [PATCH 2222/2658] bnx2x: Fix missing error code in
 bnx2x_iov_init_one()

[ Upstream commit 65161c35554f7135e6656b3df1ce2c500ca0bdcf ]

Eliminate the follow smatch warning:

drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c:1227
bnx2x_iov_init_one() warn: missing error code 'err'.

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 55a7774e8ef5..92c965cb3633 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -1245,8 +1245,10 @@ int bnx2x_iov_init_one(struct bnx2x *bp, int int_mode_param,
 		goto failed;
 
 	/* SR-IOV capability was enabled but there are no VFs*/
-	if (iov->total == 0)
+	if (iov->total == 0) {
+		err = -EINVAL;
 		goto failed;
+	}
 
 	iov->nr_virtfn = min_t(u16, iov->total, num_vfs_param);
 

From 9223cb2a3d01f9f8f6fc412726ddb0a17b1c019e Mon Sep 17 00:00:00 2001
From: Chris Packham <chris.packham@alliedtelesis.co.nz>
Date: Wed, 12 May 2021 09:20:50 +1200
Subject: [PATCH 2223/2658] powerpc/fsl: set fsl,i2c-erratum-a004447 flag for
 P2041 i2c controllers

[ Upstream commit 7adc7b225cddcfd0f346d10144fd7a3d3d9f9ea7 ]

The i2c controllers on the P2040/P2041 have an erratum where the
documented scheme for i2c bus recovery will not work (A-004447). A
different mechanism is needed which is documented in the P2040 Chip
Errata Rev Q (latest available at the time of writing).

Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/boot/dts/fsl/p2041si-post.dtsi | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi b/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi
index 51e975d7631a..8921f17fca42 100644
--- a/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi
+++ b/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi
@@ -389,7 +389,23 @@
 	};
 
 /include/ "qoriq-i2c-0.dtsi"
+	i2c@118000 {
+		fsl,i2c-erratum-a004447;
+	};
+
+	i2c@118100 {
+		fsl,i2c-erratum-a004447;
+	};
+
 /include/ "qoriq-i2c-1.dtsi"
+	i2c@119000 {
+		fsl,i2c-erratum-a004447;
+	};
+
+	i2c@119100 {
+		fsl,i2c-erratum-a004447;
+	};
+
 /include/ "qoriq-duart-0.dtsi"
 /include/ "qoriq-duart-1.dtsi"
 /include/ "qoriq-gpio-0.dtsi"

From 4cee2b85c709a2d59816c8d5e3848503da30aaca Mon Sep 17 00:00:00 2001
From: Chris Packham <chris.packham@alliedtelesis.co.nz>
Date: Wed, 12 May 2021 09:20:51 +1200
Subject: [PATCH 2224/2658] powerpc/fsl: set fsl,i2c-erratum-a004447 flag for
 P1010 i2c controllers

[ Upstream commit 19ae697a1e4edf1d755b413e3aa38da65e2db23b ]

The i2c controllers on the P1010 have an erratum where the documented
scheme for i2c bus recovery will not work (A-004447). A different
mechanism is needed which is documented in the P1010 Chip Errata Rev L.

Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/boot/dts/fsl/p1010si-post.dtsi | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi b/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi
index af12ead88c5f..404f570ebe23 100644
--- a/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi
+++ b/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi
@@ -122,7 +122,15 @@
 	};
 
 /include/ "pq3-i2c-0.dtsi"
+	i2c@3000 {
+		fsl,i2c-erratum-a004447;
+	};
+
 /include/ "pq3-i2c-1.dtsi"
+	i2c@3100 {
+		fsl,i2c-erratum-a004447;
+	};
+
 /include/ "pq3-duart-0.dtsi"
 /include/ "pq3-espi-0.dtsi"
 	spi0: spi@7000 {

From 4d92b8f83c3162f937c2954686e7ac52de5e0a8d Mon Sep 17 00:00:00 2001
From: Chris Packham <chris.packham@alliedtelesis.co.nz>
Date: Mon, 29 Mar 2021 14:52:03 +1300
Subject: [PATCH 2225/2658] i2c: mpc: Make use of i2c_recover_bus()

[ Upstream commit 65171b2df15eb7545431d75c2729b5062da89b43 ]

Move the existing calls of mpc_i2c_fixup() to a recovery function
registered via bus_recovery_info. This makes it more obvious that
recovery is supported and allows for a future where recovery is
triggered by the i2c core.

Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-mpc.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
index 48ecffecc0ed..f2e8b9a159a7 100644
--- a/drivers/i2c/busses/i2c-mpc.c
+++ b/drivers/i2c/busses/i2c-mpc.c
@@ -581,7 +581,7 @@ static int mpc_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
 			if ((status & (CSR_MCF | CSR_MBB | CSR_RXAK)) != 0) {
 				writeb(status & ~CSR_MAL,
 				       i2c->base + MPC_I2C_SR);
-				mpc_i2c_fixup(i2c);
+				i2c_recover_bus(&i2c->adap);
 			}
 			return -EIO;
 		}
@@ -617,7 +617,7 @@ static int mpc_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
 			if ((status & (CSR_MCF | CSR_MBB | CSR_RXAK)) != 0) {
 				writeb(status & ~CSR_MAL,
 				       i2c->base + MPC_I2C_SR);
-				mpc_i2c_fixup(i2c);
+				i2c_recover_bus(&i2c->adap);
 			}
 			return -EIO;
 		}
@@ -632,6 +632,15 @@ static u32 mpc_functionality(struct i2c_adapter *adap)
 	  | I2C_FUNC_SMBUS_READ_BLOCK_DATA | I2C_FUNC_SMBUS_BLOCK_PROC_CALL;
 }
 
+static int fsl_i2c_bus_recovery(struct i2c_adapter *adap)
+{
+	struct mpc_i2c *i2c = i2c_get_adapdata(adap);
+
+	mpc_i2c_fixup(i2c);
+
+	return 0;
+}
+
 static const struct i2c_algorithm mpc_algo = {
 	.master_xfer = mpc_xfer,
 	.functionality = mpc_functionality,
@@ -643,6 +652,10 @@ static struct i2c_adapter mpc_ops = {
 	.timeout = HZ,
 };
 
+static struct i2c_bus_recovery_info fsl_i2c_recovery_info = {
+	.recover_bus = fsl_i2c_bus_recovery,
+};
+
 static const struct of_device_id mpc_i2c_of_match[];
 static int fsl_i2c_probe(struct platform_device *op)
 {
@@ -735,6 +748,7 @@ static int fsl_i2c_probe(struct platform_device *op)
 	i2c_set_adapdata(&i2c->adap, i2c);
 	i2c->adap.dev.parent = &op->dev;
 	i2c->adap.dev.of_node = of_node_get(op->dev.of_node);
+	i2c->adap.bus_recovery_info = &fsl_i2c_recovery_info;
 
 	result = i2c_add_adapter(&i2c->adap);
 	if (result < 0) {

From ac3d865c7bfd8f96a8fabb496f5f17caf4bcd690 Mon Sep 17 00:00:00 2001
From: Chris Packham <chris.packham@alliedtelesis.co.nz>
Date: Wed, 12 May 2021 09:20:52 +1200
Subject: [PATCH 2226/2658] i2c: mpc: implement erratum A-004447 workaround

[ Upstream commit 8f0cdec8b5fd94135d643662506ee94ae9e98785 ]

The P2040/P2041 has an erratum where the normal i2c recovery mechanism
does not work. Implement the alternative recovery mechanism documented
in the P2040 Chip Errata Rev Q.

Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-mpc.c | 79 +++++++++++++++++++++++++++++++++++-
 1 file changed, 78 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
index f2e8b9a159a7..2e083a71c221 100644
--- a/drivers/i2c/busses/i2c-mpc.c
+++ b/drivers/i2c/busses/i2c-mpc.c
@@ -23,6 +23,7 @@
 
 #include <linux/clk.h>
 #include <linux/io.h>
+#include <linux/iopoll.h>
 #include <linux/fsl_devices.h>
 #include <linux/i2c.h>
 #include <linux/interrupt.h>
@@ -49,6 +50,7 @@
 #define CCR_MTX  0x10
 #define CCR_TXAK 0x08
 #define CCR_RSTA 0x04
+#define CCR_RSVD 0x02
 
 #define CSR_MCF  0x80
 #define CSR_MAAS 0x40
@@ -70,6 +72,7 @@ struct mpc_i2c {
 	u8 fdr, dfsrr;
 #endif
 	struct clk *clk_per;
+	bool has_errata_A004447;
 };
 
 struct mpc_i2c_divider {
@@ -178,6 +181,75 @@ static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing)
 	return 0;
 }
 
+static int i2c_mpc_wait_sr(struct mpc_i2c *i2c, int mask)
+{
+	void __iomem *addr = i2c->base + MPC_I2C_SR;
+	u8 val;
+
+	return readb_poll_timeout(addr, val, val & mask, 0, 100);
+}
+
+/*
+ * Workaround for Erratum A004447. From the P2040CE Rev Q
+ *
+ * 1.  Set up the frequency divider and sampling rate.
+ * 2.  I2CCR - a0h
+ * 3.  Poll for I2CSR[MBB] to get set.
+ * 4.  If I2CSR[MAL] is set (an indication that SDA is stuck low), then go to
+ *     step 5. If MAL is not set, then go to step 13.
+ * 5.  I2CCR - 00h
+ * 6.  I2CCR - 22h
+ * 7.  I2CCR - a2h
+ * 8.  Poll for I2CSR[MBB] to get set.
+ * 9.  Issue read to I2CDR.
+ * 10. Poll for I2CSR[MIF] to be set.
+ * 11. I2CCR - 82h
+ * 12. Workaround complete. Skip the next steps.
+ * 13. Issue read to I2CDR.
+ * 14. Poll for I2CSR[MIF] to be set.
+ * 15. I2CCR - 80h
+ */
+static void mpc_i2c_fixup_A004447(struct mpc_i2c *i2c)
+{
+	int ret;
+	u32 val;
+
+	writeccr(i2c, CCR_MEN | CCR_MSTA);
+	ret = i2c_mpc_wait_sr(i2c, CSR_MBB);
+	if (ret) {
+		dev_err(i2c->dev, "timeout waiting for CSR_MBB\n");
+		return;
+	}
+
+	val = readb(i2c->base + MPC_I2C_SR);
+
+	if (val & CSR_MAL) {
+		writeccr(i2c, 0x00);
+		writeccr(i2c, CCR_MSTA | CCR_RSVD);
+		writeccr(i2c, CCR_MEN | CCR_MSTA | CCR_RSVD);
+		ret = i2c_mpc_wait_sr(i2c, CSR_MBB);
+		if (ret) {
+			dev_err(i2c->dev, "timeout waiting for CSR_MBB\n");
+			return;
+		}
+		val = readb(i2c->base + MPC_I2C_DR);
+		ret = i2c_mpc_wait_sr(i2c, CSR_MIF);
+		if (ret) {
+			dev_err(i2c->dev, "timeout waiting for CSR_MIF\n");
+			return;
+		}
+		writeccr(i2c, CCR_MEN | CCR_RSVD);
+	} else {
+		val = readb(i2c->base + MPC_I2C_DR);
+		ret = i2c_mpc_wait_sr(i2c, CSR_MIF);
+		if (ret) {
+			dev_err(i2c->dev, "timeout waiting for CSR_MIF\n");
+			return;
+		}
+		writeccr(i2c, CCR_MEN);
+	}
+}
+
 #if defined(CONFIG_PPC_MPC52xx) || defined(CONFIG_PPC_MPC512x)
 static const struct mpc_i2c_divider mpc_i2c_dividers_52xx[] = {
 	{20, 0x20}, {22, 0x21}, {24, 0x22}, {26, 0x23},
@@ -636,7 +708,10 @@ static int fsl_i2c_bus_recovery(struct i2c_adapter *adap)
 {
 	struct mpc_i2c *i2c = i2c_get_adapdata(adap);
 
-	mpc_i2c_fixup(i2c);
+	if (i2c->has_errata_A004447)
+		mpc_i2c_fixup_A004447(i2c);
+	else
+		mpc_i2c_fixup(i2c);
 
 	return 0;
 }
@@ -740,6 +815,8 @@ static int fsl_i2c_probe(struct platform_device *op)
 	dev_info(i2c->dev, "timeout %u us\n", mpc_ops.timeout * 1000000 / HZ);
 
 	platform_set_drvdata(op, i2c);
+	if (of_property_read_bool(op->dev.of_node, "fsl,i2c-erratum-a004447"))
+		i2c->has_errata_A004447 = true;
 
 	i2c->adap = mpc_ops;
 	of_address_to_resource(op->dev.of_node, 0, &res);

From 9d1c78676223c40bda065ee99e21d1889d2c96c6 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 8 Jun 2021 15:31:42 -0400
Subject: [PATCH 2227/2658] kvm: avoid speculation-based attacks from
 out-of-range memslot accesses

commit da27a83fd6cc7780fea190e1f5c19e87019da65c upstream.

KVM's mechanism for accessing guest memory translates a guest physical
address (gpa) to a host virtual address using the right-shifted gpa
(also known as gfn) and a struct kvm_memory_slot.  The translation is
performed in __gfn_to_hva_memslot using the following formula:

      hva = slot->userspace_addr + (gfn - slot->base_gfn) * PAGE_SIZE

It is expected that gfn falls within the boundaries of the guest's
physical memory.  However, a guest can access invalid physical addresses
in such a way that the gfn is invalid.

__gfn_to_hva_memslot is called from kvm_vcpu_gfn_to_hva_prot, which first
retrieves a memslot through __gfn_to_memslot.  While __gfn_to_memslot
does check that the gfn falls within the boundaries of the guest's
physical memory or not, a CPU can speculate the result of the check and
continue execution speculatively using an illegal gfn. The speculation
can result in calculating an out-of-bounds hva.  If the resulting host
virtual address is used to load another guest physical address, this
is effectively a Spectre gadget consisting of two consecutive reads,
the second of which is data dependent on the first.

Right now it's not clear if there are any cases in which this is
exploitable.  One interesting case was reported by the original author
of this patch, and involves visiting guest page tables on x86.  Right
now these are not vulnerable because the hva read goes through get_user(),
which contains an LFENCE speculation barrier.  However, there are
patches in progress for x86 uaccess.h to mask kernel addresses instead of
using LFENCE; once these land, a guest could use speculation to read
from the VMM's ring 3 address space.  Other architectures such as ARM
already use the address masking method, and would be susceptible to
this same kind of data-dependent access gadgets.  Therefore, this patch
proactively protects from these attacks by masking out-of-bounds gfns
in __gfn_to_hva_memslot, which blocks speculation of invalid hvas.

Sean Christopherson noted that this patch does not cover
kvm_read_guest_offset_cached.  This however is limited to a few bytes
past the end of the cache, and therefore it is unlikely to be useful in
the context of building a chain of data dependent accesses.

Reported-by: Artemiy Margaritov <artemiy.margaritov@gmail.com>
Co-developed-by: Artemiy Margaritov <artemiy.margaritov@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/kvm_host.h | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index c53adc5ade41..0f16b6cbbf55 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -25,6 +25,7 @@
 #include <linux/irqflags.h>
 #include <linux/context_tracking.h>
 #include <linux/irqbypass.h>
+#include <linux/nospec.h>
 #include <asm/signal.h>
 
 #include <linux/kvm.h>
@@ -950,7 +951,15 @@ __gfn_to_memslot(struct kvm_memslots *slots, gfn_t gfn)
 static inline unsigned long
 __gfn_to_hva_memslot(struct kvm_memory_slot *slot, gfn_t gfn)
 {
-	return slot->userspace_addr + (gfn - slot->base_gfn) * PAGE_SIZE;
+	/*
+	 * The index was checked originally in search_memslots.  To avoid
+	 * that a malicious guest builds a Spectre gadget out of e.g. page
+	 * table walks, do not let the processor speculate loads outside
+	 * the guest's registered memslots.
+	 */
+	unsigned long offset = array_index_nospec(gfn - slot->base_gfn,
+						  slot->npages);
+	return slot->userspace_addr + offset * PAGE_SIZE;
 }
 
 static inline int memslot_id(struct kvm *kvm, gfn_t gfn)

From 5087fffc76125ce43364211d5588a091db980028 Mon Sep 17 00:00:00 2001
From: Ritesh Harjani <riteshh@linux.ibm.com>
Date: Sun, 30 May 2021 20:24:05 +0530
Subject: [PATCH 2228/2658] btrfs: return value from
 btrfs_mark_extent_written() in case of error

commit e7b2ec3d3d4ebeb4cff7ae45cf430182fa6a49fb upstream.

We always return 0 even in case of an error in btrfs_mark_extent_written().
Fix it to return proper error value in case of a failure. All callers
handle it.

CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/file.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 73b547f88bfc..2426dc56426f 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1089,7 +1089,7 @@ int btrfs_mark_extent_written(struct btrfs_trans_handle *trans,
 	int del_nr = 0;
 	int del_slot = 0;
 	int recow;
-	int ret;
+	int ret = 0;
 	u64 ino = btrfs_ino(inode);
 
 	path = btrfs_alloc_path();
@@ -1284,7 +1284,7 @@ int btrfs_mark_extent_written(struct btrfs_trans_handle *trans,
 	}
 out:
 	btrfs_free_path(path);
-	return 0;
+	return ret;
 }
 
 /*

From eeebb525cc659849e2b8f42f16e36ff8acd96d0b Mon Sep 17 00:00:00 2001
From: Alexander Kuznetsov <wwfq@yandex-team.ru>
Date: Wed, 9 Jun 2021 10:17:19 +0300
Subject: [PATCH 2229/2658] cgroup1: don't allow '\n' in renaming

commit b7e24eb1caa5f8da20d405d262dba67943aedc42 upstream.

cgroup_mkdir() have restriction on newline usage in names:
$ mkdir $'/sys/fs/cgroup/cpu/test\ntest2'
mkdir: cannot create directory
'/sys/fs/cgroup/cpu/test\ntest2': Invalid argument

But in cgroup1_rename() such check is missed.
This allows us to make /proc/<pid>/cgroup unparsable:
$ mkdir /sys/fs/cgroup/cpu/test
$ mv /sys/fs/cgroup/cpu/test $'/sys/fs/cgroup/cpu/test\ntest2'
$ echo $$ > $'/sys/fs/cgroup/cpu/test\ntest2'
$ cat /proc/self/cgroup
11:pids:/
10:freezer:/
9:hugetlb:/
8:cpuset:/
7:blkio:/user.slice
6:memory:/user.slice
5:net_cls,net_prio:/
4:perf_event:/
3:devices:/user.slice
2:cpu,cpuacct:/test
test2
1:name=systemd:/
0::/

Signed-off-by: Alexander Kuznetsov <wwfq@yandex-team.ru>
Reported-by: Andrey Krasichkov <buglloc@yandex-team.ru>
Acked-by: Dmitry Yakunin <zeil@yandex-team.ru>
Cc: stable@vger.kernel.org
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/cgroup.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index cd3d81961cc2..fe08e12683fe 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -3311,6 +3311,10 @@ static int cgroup_rename(struct kernfs_node *kn, struct kernfs_node *new_parent,
 	struct cgroup *cgrp = kn->priv;
 	int ret;
 
+	/* do not accept '\n' to prevent making /proc/<pid>/cgroup unparsable */
+	if (strchr(new_name_str, '\n'))
+		return -EINVAL;
+
 	if (kernfs_type(kn) != KERNFS_DIR)
 		return -ENOTDIR;
 	if (kn->parent != new_parent)

From 02cc9a692ce046f6787800ac1b3f4e1058f0cea6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Mon, 7 Jun 2021 17:53:44 -0700
Subject: [PATCH 2230/2658] USB: f_ncm: ncm_bitrate (speed) is unsigned
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 3370139745853f7826895293e8ac3aec1430508e upstream.

[  190.544755] configfs-gadget gadget: notify speed -44967296

This is because 4250000000 - 2**32 is -44967296.

Fixes: 9f6ce4240a2b ("usb: gadget: f_ncm.c added")
Cc: Brooke Basile <brookebasile@gmail.com>
Cc: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Cc: Felipe Balbi <balbi@kernel.org>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Yauheni Kaliuta <yauheni.kaliuta@nokia.com>
Cc: Linux USB Mailing List <linux-usb@vger.kernel.org>
Acked-By: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210608005344.3762668-1-zenczykowski@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/function/f_ncm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
index 267fcac028f5..5b875d91ce61 100644
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -585,7 +585,7 @@ static void ncm_do_notify(struct f_ncm *ncm)
 		data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));
 		data[1] = data[0];
 
-		DBG(cdev, "notify speed %d\n", ncm_bitrate(cdev->gadget));
+		DBG(cdev, "notify speed %u\n", ncm_bitrate(cdev->gadget));
 		ncm->notify_state = NCM_NOTIFY_CONNECT;
 		break;
 	}

From 30e093b67c449380dc0b7aad69b52fd20868ccae Mon Sep 17 00:00:00 2001
From: Marian-Cristian Rotariu <marian.c.rotariu@gmail.com>
Date: Tue, 8 Jun 2021 19:26:50 +0300
Subject: [PATCH 2231/2658] usb: dwc3: ep0: fix NULL pointer exception

commit d00889080ab60051627dab1d85831cd9db750e2a upstream.

There is no validation of the index from dwc3_wIndex_to_dep() and we might
be referring a non-existing ep and trigger a NULL pointer exception. In
certain configurations we might use fewer eps and the index might wrongly
indicate a larger ep index than existing.

By adding this validation from the patch we can actually report a wrong
index back to the caller.

In our usecase we are using a composite device on an older kernel, but
upstream might use this fix also. Unfortunately, I cannot describe the
hardware for others to reproduce the issue as it is a proprietary
implementation.

[   82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4
[   82.966891] Mem abort info:
[   82.969663]   ESR = 0x96000006
[   82.972703]   Exception class = DABT (current EL), IL = 32 bits
[   82.978603]   SET = 0, FnV = 0
[   82.981642]   EA = 0, S1PTW = 0
[   82.984765] Data abort info:
[   82.987631]   ISV = 0, ISS = 0x00000006
[   82.991449]   CM = 0, WnR = 0
[   82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc
[   83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000
[   83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP
[   83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c)
[   83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1
[   83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO)
[   83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c
[   83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94

...

[   83.141788] Call trace:
[   83.144227]  dwc3_ep0_handle_feature+0x414/0x43c
[   83.148823]  dwc3_ep0_interrupt+0x3b4/0xc94
[   83.181546] ---[ end trace aac6b5267d84c32f ]---

Signed-off-by: Marian-Cristian Rotariu <marian.c.rotariu@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210608162650.58426-1-marian.c.rotariu@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc3/ep0.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index c244d908fa4f..a3fd9ac8bfbf 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -354,6 +354,9 @@ static struct dwc3_ep *dwc3_wIndex_to_dep(struct dwc3 *dwc, __le16 wIndex_le)
 		epnum |= 1;
 
 	dep = dwc->eps[epnum];
+	if (dep == NULL)
+		return NULL;
+
 	if (dep->flags & DWC3_EP_ENABLED)
 		return dep;
 

From 0c979c403a348f8b618f6b25c5e8773db7a55156 Mon Sep 17 00:00:00 2001
From: George McCollister <george.mccollister@gmail.com>
Date: Thu, 3 Jun 2021 19:32:08 -0500
Subject: [PATCH 2232/2658] USB: serial: ftdi_sio: add NovaTech OrionMX product
 ID

commit bc96c72df33ee81b24d87eab953c73f7bcc04f29 upstream.

Add PID for the NovaTech OrionMX so it can be automatically detected.

Signed-off-by: George McCollister <george.mccollister@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/ftdi_sio.c     | 1 +
 drivers/usb/serial/ftdi_sio_ids.h | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 3d02399ad49e..f8b8bdc0dc6f 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -606,6 +606,7 @@ static const struct usb_device_id id_table_combined[] = {
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
 	{ USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) },
+	{ USB_DEVICE(FTDI_VID, FTDI_NT_ORIONMX_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index b5f28a795228..54ded2bc9eb6 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -580,6 +580,7 @@
 #define FTDI_NT_ORIONLXM_PID		0x7c90	/* OrionLXm Substation Automation Platform */
 #define FTDI_NT_ORIONLX_PLUS_PID	0x7c91	/* OrionLX+ Substation Automation Platform */
 #define FTDI_NT_ORION_IO_PID		0x7c92	/* Orion I/O */
+#define FTDI_NT_ORIONMX_PID		0x7c93	/* OrionMX */
 
 /*
  * Synapse Wireless product ids (FTDI_VID)

From 6d31ef4e870df5e27952186d357347944795ec07 Mon Sep 17 00:00:00 2001
From: Alexandre GRIVEAUX <agriveaux@deutnet.info>
Date: Sun, 23 May 2021 18:35:21 +0200
Subject: [PATCH 2233/2658] USB: serial: omninet: add device id for Zyxel Omni
 56K Plus

commit fc0b3dc9a11771c3919eaaaf9d649138b095aa0f upstream.

Add device id for Zyxel Omni 56K Plus modem, this modem include:

USB chip:
NetChip
NET2888

Main chip:
901041A
F721501APGF

Another modem using the same chips is the Zyxel Omni 56K DUO/NEO,
could be added with the right USB ID.

Signed-off-by: Alexandre GRIVEAUX <agriveaux@deutnet.info>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/omninet.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
index 76564b3bebb9..cc0bf59bd08d 100644
--- a/drivers/usb/serial/omninet.c
+++ b/drivers/usb/serial/omninet.c
@@ -27,6 +27,7 @@
 
 #define ZYXEL_VENDOR_ID		0x0586
 #define ZYXEL_OMNINET_ID	0x1000
+#define ZYXEL_OMNI_56K_PLUS_ID	0x1500
 /* This one seems to be a re-branded ZyXEL device */
 #define BT_IGNITIONPRO_ID	0x2000
 
@@ -44,6 +45,7 @@ static int omninet_port_remove(struct usb_serial_port *port);
 
 static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(ZYXEL_VENDOR_ID, ZYXEL_OMNINET_ID) },
+	{ USB_DEVICE(ZYXEL_VENDOR_ID, ZYXEL_OMNI_56K_PLUS_ID) },
 	{ USB_DEVICE(ZYXEL_VENDOR_ID, BT_IGNITIONPRO_ID) },
 	{ }						/* Terminating entry */
 };

From df40d9e6b5a0cb9f4a06953d936ef35dd003ddbf Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 24 May 2021 11:17:05 +0200
Subject: [PATCH 2234/2658] USB: serial: quatech2: fix control-request
 directions

commit eb8dbe80326c3d44c1e38ee4f40e0d8d3e06f2d0 upstream.

The direction of the pipe argument must match the request-type direction
bit or control requests may fail depending on the host-controller-driver
implementation.

Fix the three requests which erroneously used usb_rcvctrlpipe().

Fixes: f7a33e608d9a ("USB: serial: add quatech2 usb to serial driver")
Cc: stable@vger.kernel.org      # 3.5
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/quatech2.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c
index 82f28192694f..e548a6094d22 100644
--- a/drivers/usb/serial/quatech2.c
+++ b/drivers/usb/serial/quatech2.c
@@ -419,7 +419,7 @@ static void qt2_close(struct usb_serial_port *port)
 
 	/* flush the port transmit buffer */
 	i = usb_control_msg(serial->dev,
-			    usb_rcvctrlpipe(serial->dev, 0),
+			    usb_sndctrlpipe(serial->dev, 0),
 			    QT2_FLUSH_DEVICE, 0x40, 1,
 			    port_priv->device_port, NULL, 0, QT2_USB_TIMEOUT);
 
@@ -429,7 +429,7 @@ static void qt2_close(struct usb_serial_port *port)
 
 	/* flush the port receive buffer */
 	i = usb_control_msg(serial->dev,
-			    usb_rcvctrlpipe(serial->dev, 0),
+			    usb_sndctrlpipe(serial->dev, 0),
 			    QT2_FLUSH_DEVICE, 0x40, 0,
 			    port_priv->device_port, NULL, 0, QT2_USB_TIMEOUT);
 
@@ -701,7 +701,7 @@ static int qt2_attach(struct usb_serial *serial)
 	int status;
 
 	/* power on unit */
-	status = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
+	status = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
 				 0xc2, 0x40, 0x8000, 0, NULL, 0,
 				 QT2_USB_TIMEOUT);
 	if (status < 0) {

From cf6bfaaa10248473d1cdb03a6d5efe182d38c5e3 Mon Sep 17 00:00:00 2001
From: Linyu Yuan <linyyuan@codeaurora.com>
Date: Wed, 9 Jun 2021 07:35:47 +0800
Subject: [PATCH 2235/2658] usb: gadget: eem: fix wrong eem header operation

commit 305f670846a31a261462577dd0b967c4fa796871 upstream.

when skb_clone() or skb_copy_expand() fail,
it should pull skb with lengh indicated by header,
or not it will read network data and check it as header.

Cc: <stable@vger.kernel.org>
Signed-off-by: Linyu Yuan <linyyuan@codeaurora.com>
Link: https://lore.kernel.org/r/20210608233547.3767-1-linyyuan@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/function/f_eem.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/f_eem.c b/drivers/usb/gadget/function/f_eem.c
index cad35a502d3f..9411c5f953da 100644
--- a/drivers/usb/gadget/function/f_eem.c
+++ b/drivers/usb/gadget/function/f_eem.c
@@ -498,7 +498,7 @@ static int eem_unwrap(struct gether *port,
 			skb2 = skb_clone(skb, GFP_ATOMIC);
 			if (unlikely(!skb2)) {
 				DBG(cdev, "unable to unframe EEM packet\n");
-				continue;
+				goto next;
 			}
 			skb_trim(skb2, len - ETH_FCS_LEN);
 
@@ -509,7 +509,7 @@ static int eem_unwrap(struct gether *port,
 			if (unlikely(!skb3)) {
 				DBG(cdev, "unable to realign EEM packet\n");
 				dev_kfree_skb_any(skb2);
-				continue;
+				goto next;
 			}
 			dev_kfree_skb_any(skb2);
 			skb_queue_tail(list, skb3);

From 74d0443ad75390d7e72a73c34bebfc642d723385 Mon Sep 17 00:00:00 2001
From: Marco Elver <elver@google.com>
Date: Thu, 27 May 2021 12:47:11 +0200
Subject: [PATCH 2236/2658] perf: Fix data race between pin_count
 increment/decrement

commit 6c605f8371159432ec61cbb1488dcf7ad24ad19a upstream.

KCSAN reports a data race between increment and decrement of pin_count:

  write to 0xffff888237c2d4e0 of 4 bytes by task 15740 on cpu 1:
   find_get_context		kernel/events/core.c:4617
   __do_sys_perf_event_open	kernel/events/core.c:12097 [inline]
   __se_sys_perf_event_open	kernel/events/core.c:11933
   ...
  read to 0xffff888237c2d4e0 of 4 bytes by task 15743 on cpu 0:
   perf_unpin_context		kernel/events/core.c:1525 [inline]
   __do_sys_perf_event_open	kernel/events/core.c:12328 [inline]
   __se_sys_perf_event_open	kernel/events/core.c:11933
   ...

Because neither read-modify-write here is atomic, this can lead to one
of the operations being lost, resulting in an inconsistent pin_count.
Fix it by adding the missing locking in the CPU-event case.

Fixes: fe4b04fa31a6 ("perf: Cure task_oncpu_function_call() races")
Reported-by: syzbot+142c9018f5962db69c7e@syzkaller.appspotmail.com
Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20210527104711.2671610-1-elver@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/events/core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 8214073f9eb8..f228afe1cd4b 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3581,7 +3581,9 @@ find_get_context(struct pmu *pmu, struct task_struct *task,
 		cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu);
 		ctx = &cpuctx->ctx;
 		get_ctx(ctx);
+		raw_spin_lock_irqsave(&ctx->lock, flags);
 		++ctx->pin_count;
+		raw_spin_unlock_irqrestore(&ctx->lock, flags);
 
 		return ctx;
 	}

From 99acc9bcf33c2d87ca56512cb021c2125146a54e Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 3 Jun 2021 15:37:53 +0300
Subject: [PATCH 2237/2658] NFS: Fix a potential NULL dereference in
 nfs_get_client()

[ Upstream commit 09226e8303beeec10f2ff844d2e46d1371dc58e0 ]

None of the callers are expecting NULL returns from nfs_get_client() so
this code will lead to an Oops.  It's better to return an error
pointer.  I expect that this is dead code so hopefully no one is
affected.

Fixes: 31434f496abb ("nfs: check hostname in nfs_get_client")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/client.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index d6d5d2a48e83..ba2cd0bd3894 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -377,7 +377,7 @@ nfs_get_client(const struct nfs_client_initdata *cl_init,
 
 	if (cl_init->hostname == NULL) {
 		WARN_ON(1);
-		return NULL;
+		return ERR_PTR(-EINVAL);
 	}
 
 	dprintk("--> nfs_get_client(%s,v%u)\n",

From 11c9cec6a195db0691fa3c5fe307b569aaff3b0f Mon Sep 17 00:00:00 2001
From: Leo Yan <leo.yan@linaro.org>
Date: Sat, 5 Jun 2021 13:29:57 +0800
Subject: [PATCH 2238/2658] perf session: Correct buffer copying when peeking
 events

[ Upstream commit 197eecb6ecae0b04bd694432f640ff75597fed9c ]

When peeking an event, it has a short path and a long path.  The short
path uses the session pointer "one_mmap_addr" to directly fetch the
event; and the long path needs to read out the event header and the
following event data from file and fill into the buffer pointer passed
through the argument "buf".

The issue is in the long path that it copies the event header and event
data into the same destination address which pointer "buf", this means
the event header is overwritten.  We are just lucky to run into the
short path in most cases, so we don't hit the issue in the long path.

This patch adds the offset "hdr_sz" to the pointer "buf" when copying
the event data, so that it can reserve the event header which can be
used properly by its caller.

Fixes: 5a52f33adf02 ("perf session: Add perf_session__peek_event()")
Signed-off-by: Leo Yan <leo.yan@linaro.org>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Acked-by: Jiri Olsa <jolsa@redhat.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lore.kernel.org/lkml/20210605052957.1070720-1-leo.yan@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/session.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index 24bb782886eb..4e6db9c08339 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -1229,6 +1229,7 @@ int perf_session__peek_event(struct perf_session *session, off_t file_offset,
 	if (event->header.size < hdr_sz || event->header.size > buf_sz)
 		return -1;
 
+	buf += hdr_sz;
 	rest = event->header.size - hdr_sz;
 
 	if (readn(fd, buf, rest) != (ssize_t)rest)

From 430859f54c87ae228fc2f9c8ffe4c3aa7bf9af3e Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 9 Jun 2021 01:49:13 -0400
Subject: [PATCH 2239/2658] kvm: fix previous commit for 32-bit builds

commit 4422829e8053068e0225e4d0ef42dc41ea7c9ef5 upstream.

array_index_nospec does not work for uint64_t on 32-bit builds.
However, the size of a memory slot must be less than 20 bits wide
on those system, since the memory slot must fit in the user
address space.  So just store it in an unsigned long.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/kvm_host.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 0f16b6cbbf55..a55457c198dd 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -957,8 +957,8 @@ __gfn_to_hva_memslot(struct kvm_memory_slot *slot, gfn_t gfn)
 	 * table walks, do not let the processor speculate loads outside
 	 * the guest's registered memslots.
 	 */
-	unsigned long offset = array_index_nospec(gfn - slot->base_gfn,
-						  slot->npages);
+	unsigned long offset = gfn - slot->base_gfn;
+	offset = array_index_nospec(offset, slot->npages);
 	return slot->userspace_addr + offset * PAGE_SIZE;
 }
 

From ba8f2964bb20d596d690eb932a0841bc794edd75 Mon Sep 17 00:00:00 2001
From: Dai Ngo <dai.ngo@oracle.com>
Date: Wed, 19 May 2021 17:15:10 -0400
Subject: [PATCH 2240/2658] NFSv4: nfs4_proc_set_acl needs to restore
 NFS_CAP_UIDGID_NOMAP on error.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit f8849e206ef52b584cd9227255f4724f0cc900bb upstream.

Currently if __nfs4_proc_set_acl fails with NFS4ERR_BADOWNER it
re-enables the idmapper by clearing NFS_CAP_UIDGID_NOMAP before
retrying again. The NFS_CAP_UIDGID_NOMAP remains cleared even if
the retry fails. This causes problem for subsequent setattr
requests for v4 server that does not have idmapping configured.

This patch modifies nfs4_proc_set_acl to detect NFS4ERR_BADOWNER
and NFS4ERR_BADNAME and skips the retry, since the kernel isn't
involved in encoding the ACEs, and return -EINVAL.

Steps to reproduce the problem:

 # mount -o vers=4.1,sec=sys server:/export/test /tmp/mnt
 # touch /tmp/mnt/file1
 # chown 99 /tmp/mnt/file1
 # nfs4_setfacl -a A::unknown.user@xyz.com:wrtncy /tmp/mnt/file1
 Failed setxattr operation: Invalid argument
 # chown 99 /tmp/mnt/file1
 chown: changing ownership of ‘/tmp/mnt/file1’: Invalid argument
 # umount /tmp/mnt
 # mount -o vers=4.1,sec=sys server:/export/test /tmp/mnt
 # chown 99 /tmp/mnt/file1
 #

v2: detect NFS4ERR_BADOWNER and NFS4ERR_BADNAME and skip retry
       in nfs4_proc_set_acl.
Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/nfs4proc.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 92ca753723b5..e10bada12361 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -4887,6 +4887,14 @@ static int nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflen
 	do {
 		err = __nfs4_proc_set_acl(inode, buf, buflen);
 		trace_nfs4_set_acl(inode, err);
+		if (err == -NFS4ERR_BADOWNER || err == -NFS4ERR_BADNAME) {
+			/*
+			 * no need to retry since the kernel
+			 * isn't involved in encoding the ACEs.
+			 */
+			err = -EINVAL;
+			break;
+		}
 		err = nfs4_handle_exception(NFS_SERVER(inode), err,
 				&exception);
 	} while (exception.retry);

From 9ceee001ce2b341fc6376b3fb841bcbe6acd1529 Mon Sep 17 00:00:00 2001
From: Ming Lei <ming.lei@redhat.com>
Date: Wed, 2 Jun 2021 21:30:29 +0800
Subject: [PATCH 2241/2658] scsi: core: Only put parent device if host state
 differs from SHOST_CREATED

commit 1e0d4e6225996f05271de1ebcb1a7c9381af0b27 upstream.

get_device(shost->shost_gendev.parent) is called after host state has
switched to SHOST_RUNNING. scsi_host_dev_release() shouldn't release the
parent device if host state is still SHOST_CREATED.

Link: https://lore.kernel.org/r/20210602133029.2864069-5-ming.lei@redhat.com
Cc: Bart Van Assche <bvanassche@acm.org>
Cc: John Garry <john.garry@huawei.com>
Cc: Hannes Reinecke <hare@suse.de>
Tested-by: John Garry <john.garry@huawei.com>
Reviewed-by: John Garry <john.garry@huawei.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/hosts.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index 82ac1cd818ac..fb4b6034f644 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -355,7 +355,7 @@ static void scsi_host_dev_release(struct device *dev)
 
 	kfree(shost->shost_data);
 
-	if (parent)
+	if (shost->shost_state != SHOST_CREATED)
 		put_device(parent);
 	kfree(shost);
 }

From fd2a588ac1b1f6fcc7435537add885829809d9a2 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Mon, 7 Jun 2021 21:39:08 -0400
Subject: [PATCH 2242/2658] ftrace: Do not blindly read the ip address in
 ftrace_bug()

commit 6c14133d2d3f768e0a35128faac8aa6ed4815051 upstream.

It was reported that a bug on arm64 caused a bad ip address to be used for
updating into a nop in ftrace_init(), but the error path (rightfully)
returned -EINVAL and not -EFAULT, as the bug caused more than one error to
occur. But because -EINVAL was returned, the ftrace_bug() tried to report
what was at the location of the ip address, and read it directly. This
caused the machine to panic, as the ip was not pointing to a valid memory
address.

Instead, read the ip address with copy_from_kernel_nofault() to safely
access the memory, and if it faults, report that the address faulted,
otherwise report what was in that location.

Link: https://lore.kernel.org/lkml/20210607032329.28671-1-mark-pk.tsai@mediatek.com/

Cc: stable@vger.kernel.org
Fixes: 05736a427f7e1 ("ftrace: warn on failure to disable mcount callers")
Reported-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/ftrace.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 93c2abe27871..e591da4449f0 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -1943,12 +1943,18 @@ static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops,
 
 static void print_ip_ins(const char *fmt, unsigned char *p)
 {
+	char ins[MCOUNT_INSN_SIZE];
 	int i;
 
+	if (probe_kernel_read(ins, p, MCOUNT_INSN_SIZE)) {
+		printk(KERN_CONT "%s[FAULT] %px\n", fmt, p);
+		return;
+	}
+
 	printk(KERN_CONT "%s", fmt);
 
 	for (i = 0; i < MCOUNT_INSN_SIZE; i++)
-		printk(KERN_CONT "%s%02x", i ? ":" : "", p[i]);
+		printk(KERN_CONT "%s%02x", i ? ":" : "", ins[i]);
 }
 
 static struct ftrace_ops *

From 2d5568de7b4c18e3d9f2f90b94eee4c1cc28b621 Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Tue, 15 Jun 2021 09:26:19 -0700
Subject: [PATCH 2243/2658] proc: only require mm_struct for writing

commit 94f0b2d4a1d0c52035aef425da5e022bd2cb1c71 upstream.

Commit 591a22c14d3f ("proc: Track /proc/$pid/attr/ opener mm_struct") we
started using __mem_open() to track the mm_struct at open-time, so that
we could then check it for writes.

But that also ended up making the permission checks at open time much
stricter - and not just for writes, but for reads too.  And that in turn
caused a regression for at least Fedora 29, where NIC interfaces fail to
start when using NetworkManager.

Since only the write side wanted the mm_struct test, ignore any failures
by __mem_open() at open time, leaving reads unaffected.  The write()
time verification of the mm_struct pointer will then catch the failure
case because a NULL pointer will not match a valid 'current->mm'.

Link: https://lore.kernel.org/netdev/YMjTlp2FSJYvoyFa@unreal/
Fixes: 591a22c14d3f ("proc: Track /proc/$pid/attr/ opener mm_struct")
Reported-and-tested-by: Leon Romanovsky <leon@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Andrea Righi <andrea.righi@canonical.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/proc/base.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index e880414cc5a2..c19d6fec6451 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2719,7 +2719,9 @@ static int proc_pident_readdir(struct file *file, struct dir_context *ctx,
 #ifdef CONFIG_SECURITY
 static int proc_pid_attr_open(struct inode *inode, struct file *file)
 {
-	return __mem_open(inode, file, PTRACE_MODE_READ_FSCREDS);
+	file->private_data = NULL;
+	__mem_open(inode, file, PTRACE_MODE_READ_FSCREDS);
+	return 0;
 }
 
 static ssize_t proc_pid_attr_read(struct file * file, char __user * buf,

From ac991db51f118eb352c39e32ff40bf74787d6559 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 16 Jun 2021 11:34:54 +0200
Subject: [PATCH 2244/2658] Linux 4.4.273

Link: https://lore.kernel.org/r/20210614102641.582612289@linuxfoundation.org
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Jason Self <jason@bluehome.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 236c27b90378..0c6069da5a7f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 272
+SUBLEVEL = 273
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 3d73d2e390d5381db7d392e01bddb0f86c58dd49 Mon Sep 17 00:00:00 2001
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Date: Thu, 15 Apr 2021 11:52:31 -0700
Subject: [PATCH 2245/2658] HID: hid-sensor-hub: Return error for
 hid_set_field() failure

[ Upstream commit edb032033da0dc850f6e7740fa1023c73195bc89 ]

In the function sensor_hub_set_feature(), return error when hid_set_field()
fails.

Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-sensor-hub.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index 83e45d5801a9..ce4e9b34af98 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -222,16 +222,21 @@ int sensor_hub_set_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
 	buffer_size = buffer_size / sizeof(__s32);
 	if (buffer_size) {
 		for (i = 0; i < buffer_size; ++i) {
-			hid_set_field(report->field[field_index], i,
-				      (__force __s32)cpu_to_le32(*buf32));
+			ret = hid_set_field(report->field[field_index], i,
+					    (__force __s32)cpu_to_le32(*buf32));
+			if (ret)
+				goto done_proc;
+
 			++buf32;
 		}
 	}
 	if (remaining_bytes) {
 		value = 0;
 		memcpy(&value, (u8 *)buf32, remaining_bytes);
-		hid_set_field(report->field[field_index], i,
-			      (__force __s32)cpu_to_le32(value));
+		ret = hid_set_field(report->field[field_index], i,
+				    (__force __s32)cpu_to_le32(value));
+		if (ret)
+			goto done_proc;
 	}
 	hid_hw_request(hsdev->hdev, report, HID_REQ_SET_REPORT);
 	hid_hw_wait(hsdev->hdev);

From 0bd60774b4bc64d918fdbcce4771b96937e336f8 Mon Sep 17 00:00:00 2001
From: Mark Bolhuis <mark@bolhuis.dev>
Date: Mon, 3 May 2021 17:39:38 +0100
Subject: [PATCH 2246/2658] HID: Add BUS_VIRTUAL to hid_connect logging

[ Upstream commit 48e33befe61a7d407753c53d1a06fc8d6b5dab80 ]

Add BUS_VIRTUAL to hid_connect logging since it's a valid hid bus type and it
should not print <UNKNOWN>

Signed-off-by: Mark Bolhuis <mark@bolhuis.dev>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 4add5a9440a5..099344a0ed9c 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1765,6 +1765,9 @@ int hid_connect(struct hid_device *hdev, unsigned int connect_mask)
 	case BUS_I2C:
 		bus = "I2C";
 		break;
+	case BUS_VIRTUAL:
+		bus = "VIRTUAL";
+		break;
 	default:
 		bus = "<UNKNOWN>";
 	}

From 8e83457e3dd18313ca3da7ef935e864d5d541c4d Mon Sep 17 00:00:00 2001
From: Anirudh Rayabharam <mail@anirudhrb.com>
Date: Sun, 25 Apr 2021 23:03:53 +0530
Subject: [PATCH 2247/2658] HID: usbhid: fix info leak in hid_submit_ctrl

[ Upstream commit 6be388f4a35d2ce5ef7dbf635a8964a5da7f799f ]

In hid_submit_ctrl(), the way of calculating the report length doesn't
take into account that report->size can be zero. When running the
syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to
calculate transfer_buffer_length as 16384. When this urb is passed to
the usb core layer, KMSAN reports an info leak of 16384 bytes.

To fix this, first modify hid_report_len() to account for the zero
report size case by using DIV_ROUND_UP for the division. Then, call it
from hid_submit_ctrl().

Reported-by: syzbot+7c2bb71996f95a82524c@syzkaller.appspotmail.com
Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com>
Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/usbhid/hid-core.c | 2 +-
 include/linux/hid.h           | 3 +--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index b0eeb5090c91..d51fc2be0e10 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -372,7 +372,7 @@ static int hid_submit_ctrl(struct hid_device *hid)
 	raw_report = usbhid->ctrl[usbhid->ctrltail].raw_report;
 	dir = usbhid->ctrl[usbhid->ctrltail].dir;
 
-	len = ((report->size - 1) >> 3) + 1 + (report->id > 0);
+	len = hid_report_len(report);
 	if (dir == USB_DIR_OUT) {
 		usbhid->urbctrl->pipe = usb_sndctrlpipe(hid_to_usb_dev(hid), 0);
 		usbhid->urbctrl->transfer_buffer_length = len;
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 19c53b64e07a..6adea5a39724 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -1119,8 +1119,7 @@ static inline void hid_hw_wait(struct hid_device *hdev)
  */
 static inline u32 hid_report_len(struct hid_report *report)
 {
-	/* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */
-	return ((report->size - 1) >> 3) + 1 + (report->id > 0);
+	return DIV_ROUND_UP(report->size, 8) + (report->id > 0);
 }
 
 int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,

From 93c377a2bc87f4f1f4e39b71ad82e19b28b2d72f Mon Sep 17 00:00:00 2001
From: Yongqiang Liu <liuyongqiang13@huawei.com>
Date: Thu, 1 Apr 2021 13:15:33 +0000
Subject: [PATCH 2248/2658] ARM: OMAP2+: Fix build warning when mmc_omap is not
 built

[ Upstream commit 040ab72ee10ea88e1883ad143b3e2b77596abc31 ]

GCC reports the following warning with W=1:

arch/arm/mach-omap2/board-n8x0.c:325:19: warning:
variable 'index' set but not used [-Wunused-but-set-variable]
325 |  int bit, *openp, index;
    |                   ^~~~~

Fix this by moving CONFIG_MMC_OMAP to cover the rest codes
in the n8x0_mmc_callback().

Signed-off-by: Yongqiang Liu <liuyongqiang13@huawei.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-omap2/board-n8x0.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/mach-omap2/board-n8x0.c b/arch/arm/mach-omap2/board-n8x0.c
index b6443a4e0c78..68af9d9566cb 100644
--- a/arch/arm/mach-omap2/board-n8x0.c
+++ b/arch/arm/mach-omap2/board-n8x0.c
@@ -328,6 +328,7 @@ static int n8x0_mmc_get_cover_state(struct device *dev, int slot)
 
 static void n8x0_mmc_callback(void *data, u8 card_mask)
 {
+#ifdef CONFIG_MMC_OMAP
 	int bit, *openp, index;
 
 	if (board_is_n800()) {
@@ -345,7 +346,6 @@ static void n8x0_mmc_callback(void *data, u8 card_mask)
 	else
 		*openp = 0;
 
-#ifdef CONFIG_MMC_OMAP
 	omap_mmc_notify_cover_event(mmc_device, index, *openp);
 #else
 	pr_warn("MMC: notify cover event not available\n");

From 3363305bba14aeb89b6f29014d98c39f09028cb0 Mon Sep 17 00:00:00 2001
From: Bixuan Cui <cuibixuan@huawei.com>
Date: Sat, 8 May 2021 11:14:48 +0800
Subject: [PATCH 2249/2658] HID: gt683r: add missing MODULE_DEVICE_TABLE

[ Upstream commit a4b494099ad657f1cb85436d333cf38870ee95bc ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this driver when it is built
as an external module.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Bixuan Cui <cuibixuan@huawei.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-gt683r.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hid/hid-gt683r.c b/drivers/hid/hid-gt683r.c
index 0d6f135e266c..2991957bbb7f 100644
--- a/drivers/hid/hid-gt683r.c
+++ b/drivers/hid/hid-gt683r.c
@@ -64,6 +64,7 @@ static const struct hid_device_id gt683r_led_id[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GT683R_LED_PANEL) },
 	{ }
 };
+MODULE_DEVICE_TABLE(hid, gt683r_led_id);
 
 static void gt683r_brightness_set(struct led_classdev *led_cdev,
 				enum led_brightness brightness)

From fed96cbd3a6b45f84966770d8488bf45f7214985 Mon Sep 17 00:00:00 2001
From: Hillf Danton <hdanton@sina.com>
Date: Tue, 18 May 2021 16:46:25 +0800
Subject: [PATCH 2250/2658] gfs2: Fix use-after-free in gfs2_glock_shrink_scan

[ Upstream commit 1ab19c5de4c537ec0d9b21020395a5b5a6c059b2 ]

The GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to
remove the glock from the lru list in __gfs2_glock_put().

On the shrink scan path, the same flag is cleared under lru_lock but because
of cond_resched_lock(&lru_lock) in gfs2_dispose_glock_lru(), progress on the
put side can be made without deleting the glock from the lru list.

Keep GLF_LRU across the race window opened by cond_resched_lock(&lru_lock) to
ensure correct behavior on both sides - clear GLF_LRU after list_del under
lru_lock.

Reported-by: syzbot <syzbot+34ba7ddbf3021981a228@syzkaller.appspotmail.com>
Signed-off-by: Hillf Danton <hdanton@sina.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/glock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 8e8695eb652a..f115ce93dfb4 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1342,6 +1342,7 @@ __acquires(&lru_lock)
 	while(!list_empty(list)) {
 		gl = list_entry(list->next, struct gfs2_glock, gl_lru);
 		list_del_init(&gl->gl_lru);
+		clear_bit(GLF_LRU, &gl->gl_flags);
 		if (!spin_trylock(&gl->gl_lockref.lock)) {
 add_back_to_lru:
 			list_add(&gl->gl_lru, &lru_list);
@@ -1388,7 +1389,6 @@ static long gfs2_scan_glock_lru(int nr)
 		if (!test_bit(GLF_LOCK, &gl->gl_flags)) {
 			list_move(&gl->gl_lru, &dispose);
 			atomic_dec(&lru_count);
-			clear_bit(GLF_LRU, &gl->gl_flags);
 			freed++;
 			continue;
 		}

From bcfcb807eb3eebb0c4867c6b04570418bd0f7219 Mon Sep 17 00:00:00 2001
From: Maurizio Lombardi <mlombard@redhat.com>
Date: Mon, 31 May 2021 14:13:26 +0200
Subject: [PATCH 2251/2658] scsi: target: core: Fix warning on realtime kernels

[ Upstream commit 515da6f4295c2c42b8c54572cce3d2dd1167c41e ]

On realtime kernels, spin_lock_irq*(spinlock_t) do not disable the
interrupts, a call to irqs_disabled() will return false thus firing a
warning in __transport_wait_for_tasks().

Remove the warning and also replace assert_spin_locked() with
lockdep_assert_held()

Link: https://lore.kernel.org/r/20210531121326.3649-1-mlombard@redhat.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/target/target_core_transport.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 96cf2448a1f4..6c6aa23ced45 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2757,9 +2757,7 @@ __transport_wait_for_tasks(struct se_cmd *cmd, bool fabric_stop,
 	__releases(&cmd->t_state_lock)
 	__acquires(&cmd->t_state_lock)
 {
-
-	assert_spin_locked(&cmd->t_state_lock);
-	WARN_ON_ONCE(!irqs_disabled());
+	lockdep_assert_held(&cmd->t_state_lock);
 
 	if (fabric_stop)
 		cmd->transport_state |= CMD_T_FABRIC_STOP;

From 44bc1575ca7ca11885962973b481eab1adeac6e1 Mon Sep 17 00:00:00 2001
From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Date: Tue, 1 Jun 2021 19:04:51 +0800
Subject: [PATCH 2252/2658] ethernet: myri10ge: Fix missing error code in
 myri10ge_probe()

[ Upstream commit f336d0b93ae978f12c5e27199f828da89b91e56a ]

The error code is missing in this code scenario, add the error code
'-EINVAL' to the return value 'status'.

Eliminate the follow smatch warning:

drivers/net/ethernet/myricom/myri10ge/myri10ge.c:3818 myri10ge_probe()
warn: missing error code 'status'.

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/myricom/myri10ge/myri10ge.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
index 8ebf3611aba3..9ecb99a1de35 100644
--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
@@ -4051,6 +4051,7 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 		dev_err(&pdev->dev,
 			"invalid sram_size %dB or board span %ldB\n",
 			mgp->sram_size, mgp->board_span);
+		status = -EINVAL;
 		goto abort_with_ioremap;
 	}
 	memcpy_fromio(mgp->eeprom_strings,

From 630832d05d86765ca6ee458435d98e8ff2356be6 Mon Sep 17 00:00:00 2001
From: Josh Triplett <josh@joshtriplett.org>
Date: Tue, 1 Jun 2021 18:38:41 -0700
Subject: [PATCH 2253/2658] net: ipconfig: Don't override command-line
 hostnames or domains

[ Upstream commit b508d5fb69c2211a1b860fc058aafbefc3b3c3cd ]

If the user specifies a hostname or domain name as part of the ip=
command-line option, preserve it and don't overwrite it with one
supplied by DHCP/BOOTP.

For instance, ip=::::myhostname::dhcp will use "myhostname" rather than
ignoring and overwriting it.

Fix the comment on ic_bootp_string that suggests it only copies a string
"if not already set"; it doesn't have any such logic.

Signed-off-by: Josh Triplett <josh@joshtriplett.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/ipconfig.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 60f564db25a3..173777aa5add 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -890,7 +890,7 @@ static void __init ic_bootp_send_if(struct ic_device *d, unsigned long jiffies_d
 
 
 /*
- *  Copy BOOTP-supplied string if not already set.
+ *  Copy BOOTP-supplied string
  */
 static int __init ic_bootp_string(char *dest, char *src, int len, int max)
 {
@@ -941,12 +941,15 @@ static void __init ic_do_bootp_ext(u8 *ext)
 		}
 		break;
 	case 12:	/* Host name */
-		ic_bootp_string(utsname()->nodename, ext+1, *ext,
-				__NEW_UTS_LEN);
-		ic_host_name_set = 1;
+		if (!ic_host_name_set) {
+			ic_bootp_string(utsname()->nodename, ext+1, *ext,
+					__NEW_UTS_LEN);
+			ic_host_name_set = 1;
+		}
 		break;
 	case 15:	/* Domain name (DNS) */
-		ic_bootp_string(ic_domain, ext+1, *ext, sizeof(ic_domain));
+		if (!ic_domain[0])
+			ic_bootp_string(ic_domain, ext+1, *ext, sizeof(ic_domain));
 		break;
 	case 17:	/* Root path */
 		if (!root_server_path[0])

From c80cabad1eea0e4370120c1a4f106b3105c22e0d Mon Sep 17 00:00:00 2001
From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Date: Wed, 2 Jun 2021 18:15:04 +0800
Subject: [PATCH 2254/2658] rtnetlink: Fix missing error code in
 rtnl_bridge_notify()

[ Upstream commit a8db57c1d285c758adc7fb43d6e2bad2554106e1 ]

The error code is missing in this code scenario, add the error code
'-EINVAL' to the return value 'err'.

Eliminate the follow smatch warning:

net/core/rtnetlink.c:4834 rtnl_bridge_notify() warn: missing error code
'err'.

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/rtnetlink.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index e2a0aed52983..11d2da8abd73 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -3240,8 +3240,10 @@ static int rtnl_bridge_notify(struct net_device *dev)
 	if (err < 0)
 		goto errout;
 
-	if (!skb->len)
+	if (!skb->len) {
+		err = -EINVAL;
 		goto errout;
+	}
 
 	rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC);
 	return 0;

From cea70312db6751fb0f064e5568090f36b700425a Mon Sep 17 00:00:00 2001
From: Zheng Yongjun <zhengyongjun3@huawei.com>
Date: Wed, 2 Jun 2021 22:06:30 +0800
Subject: [PATCH 2255/2658] net/x25: Return the correct errno code

[ Upstream commit d7736958668c4facc15f421e622ffd718f5be80a ]

When kalloc or kmemdup failed, should return ENOMEM rather than ENOBUF.

Signed-off-by: Zheng Yongjun <zhengyongjun3@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/x25/af_x25.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index a9fd95d10e84..156639be7ed0 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -550,7 +550,7 @@ static int x25_create(struct net *net, struct socket *sock, int protocol,
 	if (protocol)
 		goto out;
 
-	rc = -ENOBUFS;
+	rc = -ENOMEM;
 	if ((sk = x25_alloc_socket(net, kern)) == NULL)
 		goto out;
 

From fef19e7a83f0c5ea9e260af33e3e266fc5dfba82 Mon Sep 17 00:00:00 2001
From: Zheng Yongjun <zhengyongjun3@huawei.com>
Date: Wed, 2 Jun 2021 22:06:40 +0800
Subject: [PATCH 2256/2658] net: Return the correct errno code

[ Upstream commit 49251cd00228a3c983651f6bb2f33f6a0b8f152e ]

When kalloc or kmemdup failed, should return ENOMEM rather than ENOBUF.

Signed-off-by: Zheng Yongjun <zhengyongjun3@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/compat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/compat.c b/net/compat.c
index 20c5e5f215f2..14459a87fdbc 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -159,7 +159,7 @@ int cmsghdr_from_user_compat_to_kern(struct msghdr *kmsg, struct sock *sk,
 	if (kcmlen > stackbuf_size)
 		kcmsg_base = kcmsg = sock_kmalloc(sk, kcmlen, GFP_KERNEL);
 	if (kcmsg == NULL)
-		return -ENOBUFS;
+		return -ENOMEM;
 
 	/* Now copy them over neatly. */
 	memset(kcmsg, 0, kcmlen);

From 5b8e11dba992cc4a5922d9c49f7d1f1636cdf31c Mon Sep 17 00:00:00 2001
From: Zheng Yongjun <zhengyongjun3@huawei.com>
Date: Wed, 2 Jun 2021 22:06:58 +0800
Subject: [PATCH 2257/2658] fib: Return the correct errno code

[ Upstream commit 59607863c54e9eb3f69afc5257dfe71c38bb751e ]

When kalloc or kmemdup failed, should return ENOMEM rather than ENOBUF.

Signed-off-by: Zheng Yongjun <zhengyongjun3@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/fib_rules.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index ae577e820c39..dcd40a44b93d 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -765,7 +765,7 @@ static void notify_rule_change(int event, struct fib_rule *rule,
 {
 	struct net *net;
 	struct sk_buff *skb;
-	int err = -ENOBUFS;
+	int err = -ENOMEM;
 
 	net = ops->fro_net;
 	skb = nlmsg_new(fib_rule_nlmsg_size(ops, rule), GFP_KERNEL);

From e573e7f0e63f685b0c34ad78aaa9d3a5a2dc6601 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Tue, 18 May 2021 22:11:08 +0800
Subject: [PATCH 2258/2658] dmaengine: stedma40: add missing iounmap() on error
 in d40_probe()

[ Upstream commit fffdaba402cea79b8d219355487d342ec23f91c6 ]

Add the missing iounmap() before return from d40_probe()
in the error handling case.

Fixes: 8d318a50b3d7 ("DMAENGINE: Support for ST-Ericssons DMA40 block v3")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20210518141108.1324127-1-yangyingliang@huawei.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/ste_dma40.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index 0fede051f4e1..e6d3ed1de374 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -3715,6 +3715,9 @@ static int __init d40_probe(struct platform_device *pdev)
 
 		kfree(base->lcla_pool.base_unaligned);
 
+		if (base->lcpa_base)
+			iounmap(base->lcpa_base);
+
 		if (base->phy_lcpa)
 			release_mem_region(base->phy_lcpa,
 					   base->lcpa_size);

From 3551c0281df08d7ba842bbf5e8076b53c632b0bb Mon Sep 17 00:00:00 2001
From: Nanyong Sun <sunnanyong@huawei.com>
Date: Tue, 8 Jun 2021 09:51:58 +0800
Subject: [PATCH 2259/2658] net: ipv4: fix memory leak in
 netlbl_cipsov4_add_std

[ Upstream commit d612c3f3fae221e7ea736d196581c2217304bbbc ]

Reported by syzkaller:
BUG: memory leak
unreferenced object 0xffff888105df7000 (size 64):
comm "syz-executor842", pid 360, jiffies 4294824824 (age 22.546s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000e67ed558>] kmalloc include/linux/slab.h:590 [inline]
[<00000000e67ed558>] kzalloc include/linux/slab.h:720 [inline]
[<00000000e67ed558>] netlbl_cipsov4_add_std net/netlabel/netlabel_cipso_v4.c:145 [inline]
[<00000000e67ed558>] netlbl_cipsov4_add+0x390/0x2340 net/netlabel/netlabel_cipso_v4.c:416
[<0000000006040154>] genl_family_rcv_msg_doit.isra.0+0x20e/0x320 net/netlink/genetlink.c:739
[<00000000204d7a1c>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
[<00000000204d7a1c>] genl_rcv_msg+0x2bf/0x4f0 net/netlink/genetlink.c:800
[<00000000c0d6a995>] netlink_rcv_skb+0x134/0x3d0 net/netlink/af_netlink.c:2504
[<00000000d78b9d2c>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
[<000000009733081b>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
[<000000009733081b>] netlink_unicast+0x4a0/0x6a0 net/netlink/af_netlink.c:1340
[<00000000d5fd43b8>] netlink_sendmsg+0x789/0xc70 net/netlink/af_netlink.c:1929
[<000000000a2d1e40>] sock_sendmsg_nosec net/socket.c:654 [inline]
[<000000000a2d1e40>] sock_sendmsg+0x139/0x170 net/socket.c:674
[<00000000321d1969>] ____sys_sendmsg+0x658/0x7d0 net/socket.c:2350
[<00000000964e16bc>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2404
[<000000001615e288>] __sys_sendmsg+0xd3/0x190 net/socket.c:2433
[<000000004ee8b6a5>] do_syscall_64+0x37/0x90 arch/x86/entry/common.c:47
[<00000000171c7cee>] entry_SYSCALL_64_after_hwframe+0x44/0xae

The memory of doi_def->map.std pointing is allocated in
netlbl_cipsov4_add_std, but no place has freed it. It should be
freed in cipso_v4_doi_free which frees the cipso DOI resource.

Fixes: 96cb8e3313c7a ("[NetLabel]: CIPSOv4 and Unlabeled packet integration")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Nanyong Sun <sunnanyong@huawei.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/cipso_ipv4.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 0e83c5b08e0e..e798e27b3c7d 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -557,6 +557,7 @@ void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
 		kfree(doi_def->map.std->lvl.local);
 		kfree(doi_def->map.std->cat.cipso);
 		kfree(doi_def->map.std->cat.local);
+		kfree(doi_def->map.std);
 		break;
 	}
 	kfree(doi_def);

From 7f3a185bd2a60499aa1dc57be384ec1de1fe54ce Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Tue, 8 Jun 2021 11:06:41 +0300
Subject: [PATCH 2260/2658] net: rds: fix memory leak in rds_recvmsg
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 49bfcbfd989a8f1f23e705759a6bb099de2cff9f ]

Syzbot reported memory leak in rds. The problem
was in unputted refcount in case of error.

int rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
		int msg_flags)
{
...

	if (!rds_next_incoming(rs, &inc)) {
		...
	}

After this "if" inc refcount incremented and

	if (rds_cmsg_recv(inc, msg, rs)) {
		ret = -EFAULT;
		goto out;
	}
...
out:
	return ret;
}

in case of rds_cmsg_recv() fail the refcount won't be
decremented. And it's easy to see from ftrace log, that
rds_inc_addref() don't have rds_inc_put() pair in
rds_recvmsg() after rds_cmsg_recv()

 1)               |  rds_recvmsg() {
 1)   3.721 us    |    rds_inc_addref();
 1)   3.853 us    |    rds_message_inc_copy_to_user();
 1) + 10.395 us   |    rds_cmsg_recv();
 1) + 34.260 us   |  }

Fixes: bdbe6fbc6a2f ("RDS: recv.c")
Reported-and-tested-by: syzbot+5134cdf021c4ed5aaa5f@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rds/recv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/rds/recv.c b/net/rds/recv.c
index 9bf812509e0e..1ff4bc3237f0 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -482,7 +482,7 @@ int rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
 
 		if (rds_cmsg_recv(inc, msg)) {
 			ret = -EFAULT;
-			goto out;
+			break;
 		}
 
 		rds_stats_inc(s_recv_delivered);

From 2771cce406f624c90d7313fc5a15427c66b98126 Mon Sep 17 00:00:00 2001
From: Ido Schimmel <idosch@nvidia.com>
Date: Wed, 9 Jun 2021 14:17:53 +0300
Subject: [PATCH 2261/2658] rtnetlink: Fix regression in bridge VLAN
 configuration

[ Upstream commit d2e381c4963663bca6f30c3b996fa4dbafe8fcb5 ]

Cited commit started returning errors when notification info is not
filled by the bridge driver, resulting in the following regression:

 # ip link add name br1 type bridge vlan_filtering 1
 # bridge vlan add dev br1 vid 555 self pvid untagged
 RTNETLINK answers: Invalid argument

As long as the bridge driver does not fill notification info for the
bridge device itself, an empty notification should not be considered as
an error. This is explained in commit 59ccaaaa49b5 ("bridge: dont send
notification when skb->len == 0 in rtnl_bridge_notify").

Fix by removing the error and add a comment to avoid future bugs.

Fixes: a8db57c1d285 ("rtnetlink: Fix missing error code in rtnl_bridge_notify()")
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/rtnetlink.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 11d2da8abd73..7d6fe9ba9a24 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -3240,10 +3240,12 @@ static int rtnl_bridge_notify(struct net_device *dev)
 	if (err < 0)
 		goto errout;
 
-	if (!skb->len) {
-		err = -EINVAL;
+	/* Notification info is only filled for bridge ports, not the bridge
+	 * device itself. Therefore, a zero notification length is valid and
+	 * should not result in an error.
+	 */
+	if (!skb->len)
 		goto errout;
-	}
 
 	rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC);
 	return 0;

From 684a8657f45bdfa3de0d14de0ad9213bf148e6eb Mon Sep 17 00:00:00 2001
From: Maxim Mikityanskiy <maximmi@nvidia.com>
Date: Thu, 10 Jun 2021 19:40:29 +0300
Subject: [PATCH 2262/2658] netfilter: synproxy: Fix out of bounds when parsing
 TCP options

[ Upstream commit 5fc177ab759418c9537433e63301096e733fb915 ]

The TCP option parser in synproxy (synproxy_parse_options) could read
one byte out of bounds. When the length is 1, the execution flow gets
into the loop, reads one byte of the opcode, and if the opcode is
neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds
the length of 1.

This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack
out of bounds when parsing TCP options.").

v2 changes:

Added an early return when length < 0 to avoid calling
skb_header_pointer with negative length.

Cc: Young Xiao <92siuyang@gmail.com>
Fixes: 48b1de4c110a ("netfilter: add SYNPROXY core/target")
Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nf_synproxy_core.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
index c8a4a48bced9..8be604eb6961 100644
--- a/net/netfilter/nf_synproxy_core.c
+++ b/net/netfilter/nf_synproxy_core.c
@@ -34,6 +34,9 @@ synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
 	int length = (th->doff * 4) - sizeof(*th);
 	u8 buf[40], *ptr;
 
+	if (unlikely(length < 0))
+		return false;
+
 	ptr = skb_header_pointer(skb, doff + sizeof(*th), length, buf);
 	if (ptr == NULL)
 		return false;
@@ -50,6 +53,8 @@ synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
 			length--;
 			continue;
 		default:
+			if (length < 2)
+				return true;
 			opsize = *ptr++;
 			if (opsize < 2)
 				return true;

From 078836da32fd90399816412d0d15cb5fe5d1f495 Mon Sep 17 00:00:00 2001
From: Jisheng Zhang <Jisheng.Zhang@synaptics.com>
Date: Fri, 11 Jun 2021 15:16:11 +0800
Subject: [PATCH 2263/2658] net: stmmac: dwmac1000: Fix extended MAC address
 registers definition

[ Upstream commit 1adb20f0d496b2c61e9aa1f4761b8d71f93d258e ]

The register starts from 0x800 is the 16th MAC address register rather
than the first one.

Fixes: cffb13f4d6fb ("stmmac: extend mac addr reg and fix perfect filering")
Signed-off-by: Jisheng Zhang <Jisheng.Zhang@synaptics.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac1000.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h b/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h
index b3fe0575ff6b..db2a341ae4b3 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h
@@ -83,10 +83,10 @@ enum power_event {
 #define LPI_CTRL_STATUS_TLPIEN	0x00000001	/* Transmit LPI Entry */
 
 /* GMAC HW ADDR regs */
-#define GMAC_ADDR_HIGH(reg)	(((reg > 15) ? 0x00000800 : 0x00000040) + \
-				(reg * 8))
-#define GMAC_ADDR_LOW(reg)	(((reg > 15) ? 0x00000804 : 0x00000044) + \
-				(reg * 8))
+#define GMAC_ADDR_HIGH(reg)	((reg > 15) ? 0x00000800 + (reg - 16) * 8 : \
+				 0x00000040 + (reg * 8))
+#define GMAC_ADDR_LOW(reg)	((reg > 15) ? 0x00000804 + (reg - 16) * 8 : \
+				 0x00000044 + (reg * 8))
 #define GMAC_MAX_PERFECT_ADDRESSES	1
 
 /* PCS registers (AN/TBI/SGMII/RGMII) offset */

From 31064c1525fa68d1cecde05a06dde4d2e6f980b4 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 12 Jun 2021 14:37:46 +0200
Subject: [PATCH 2264/2658] qlcnic: Fix an error handling path in
 'qlcnic_probe()'

[ Upstream commit cb3376604a676e0302258b01893911bdd7aa5278 ]

If an error occurs after a 'pci_enable_pcie_error_reporting()' call, it
must be undone by a corresponding 'pci_disable_pcie_error_reporting()'
call, as already done in the remove function.

Fixes: 451724c821c1 ("qlcnic: aer support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index a4b10776f834..11274b7ea36c 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -2706,6 +2706,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	kfree(ahw);
 
 err_out_free_res:
+	pci_disable_pcie_error_reporting(pdev);
 	pci_release_regions(pdev);
 
 err_out_disable_pdev:

From 7e07c8761257145a46eea69fe040faf422bd3de2 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 12 Jun 2021 14:53:12 +0200
Subject: [PATCH 2265/2658] netxen_nic: Fix an error handling path in
 'netxen_nic_probe()'

[ Upstream commit 49a10c7b176295f8fafb338911cf028e97f65f4d ]

If an error occurs after a 'pci_enable_pcie_error_reporting()' call, it
must be undone by a corresponding 'pci_disable_pcie_error_reporting()'
call, as already done in the remove function.

Fixes: e87ad5539343 ("netxen: support pci error handlers")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index f5fc0c416e51..f89441f9bd8d 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -1616,6 +1616,8 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	free_netdev(netdev);
 
 err_out_free_res:
+	if (NX_IS_REVISION_P3(pdev->revision))
+		pci_disable_pcie_error_reporting(pdev);
 	pci_release_regions(pdev);
 
 err_out_disable_pdev:

From 095044a6ce4de5cd90bceb226782132432f330e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Tue, 15 Jun 2021 01:05:49 -0700
Subject: [PATCH 2266/2658] net: cdc_ncm: switch to eth%d interface naming
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c1a3d4067309451e68c33dbd356032549cc0bd8e ]

This is meant to make the host side cdc_ncm interface consistently
named just like the older CDC protocols: cdc_ether & cdc_ecm
(and even rndis_host), which all use 'FLAG_ETHER | FLAG_POINTTOPOINT'.

include/linux/usb/usbnet.h:
  #define FLAG_ETHER	0x0020		/* maybe use "eth%d" names */
  #define FLAG_WLAN	0x0080		/* use "wlan%d" names */
  #define FLAG_WWAN	0x0400		/* use "wwan%d" names */
  #define FLAG_POINTTOPOINT 0x1000	/* possibly use "usb%d" names */

drivers/net/usb/usbnet.c @ line 1711:
  strcpy (net->name, "usb%d");
  ...
  // heuristic:  "usb%d" for links we know are two-host,
  // else "eth%d" when there's reasonable doubt.  userspace
  // can rename the link if it knows better.
  if ((dev->driver_info->flags & FLAG_ETHER) != 0 &&
      ((dev->driver_info->flags & FLAG_POINTTOPOINT) == 0 ||
       (net->dev_addr [0] & 0x02) == 0))
          strcpy (net->name, "eth%d");
  /* WLAN devices should always be named "wlan%d" */
  if ((dev->driver_info->flags & FLAG_WLAN) != 0)
          strcpy(net->name, "wlan%d");
  /* WWAN devices should always be named "wwan%d" */
  if ((dev->driver_info->flags & FLAG_WWAN) != 0)
          strcpy(net->name, "wwan%d");

So by using ETHER | POINTTOPOINT the interface naming is
either usb%d or eth%d based on the global uniqueness of the
mac address of the device.

Without this 2.5gbps ethernet dongles which all seem to use the cdc_ncm
driver end up being called usb%d instead of eth%d even though they're
definitely not two-host.  (All 1gbps & 5gbps ethernet usb dongles I've
tested don't hit this problem due to use of different drivers, primarily
r8152 and aqc111)

Fixes tag is based purely on git blame, and is really just here to make
sure this hits LTS branches newer than v4.5.

Cc: Lorenzo Colitti <lorenzo@google.com>
Fixes: 4d06dd537f95 ("cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind")
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/cdc_ncm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 8de7797ea7e7..8bef8c3dd2a3 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1580,7 +1580,7 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb)
 static const struct driver_info cdc_ncm_info = {
 	.description = "CDC NCM",
 	.flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
-			| FLAG_LINK_INTR,
+			| FLAG_LINK_INTR | FLAG_ETHER,
 	.bind = cdc_ncm_bind,
 	.unbind = cdc_ncm_unbind,
 	.manage_power = usbnet_manage_power,

From f799f51790d1dd30807b1141b713f69125cc4c1a Mon Sep 17 00:00:00 2001
From: Dongliang Mu <mudongliangabcd@gmail.com>
Date: Wed, 16 Jun 2021 10:48:33 +0800
Subject: [PATCH 2267/2658] net: usb: fix possible use-after-free in
 smsc75xx_bind

[ Upstream commit 56b786d86694e079d8aad9b314e015cd4ac02a3d ]

The commit 46a8b29c6306 ("net: usb: fix memory leak in smsc75xx_bind")
fails to clean up the work scheduled in smsc75xx_reset->
smsc75xx_set_multicast, which leads to use-after-free if the work is
scheduled to start after the deallocation. In addition, this patch
also removes a dangling pointer - dev->data[0].

This patch calls cancel_work_sync to cancel the scheduled work and set
the dangling pointer to NULL.

Fixes: 46a8b29c6306 ("net: usb: fix memory leak in smsc75xx_bind")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/smsc75xx.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index 850bb147f4b0..9fe6a8d899b0 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -1485,7 +1485,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
 	ret = smsc75xx_wait_ready(dev, 0);
 	if (ret < 0) {
 		netdev_warn(dev->net, "device not ready in smsc75xx_bind\n");
-		goto err;
+		goto free_pdata;
 	}
 
 	smsc75xx_init_mac_address(dev);
@@ -1494,7 +1494,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
 	ret = smsc75xx_reset(dev);
 	if (ret < 0) {
 		netdev_warn(dev->net, "smsc75xx_reset error %d\n", ret);
-		goto err;
+		goto cancel_work;
 	}
 
 	dev->net->netdev_ops = &smsc75xx_netdev_ops;
@@ -1504,8 +1504,11 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
 	dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
 	return 0;
 
-err:
+cancel_work:
+	cancel_work_sync(&pdata->set_multicast);
+free_pdata:
 	kfree(pdata);
+	dev->data[0] = 0;
 	return ret;
 }
 
@@ -1516,7 +1519,6 @@ static void smsc75xx_unbind(struct usbnet *dev, struct usb_interface *intf)
 		cancel_work_sync(&pdata->set_multicast);
 		netif_dbg(dev, ifdown, dev->net, "free pdata\n");
 		kfree(pdata);
-		pdata = NULL;
 		dev->data[0] = 0;
 	}
 }

From fecba5159d60b612850a2f4226d88005c3ba0edc Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 16 Jun 2021 07:47:15 -0700
Subject: [PATCH 2268/2658] net/af_unix: fix a data-race in unix_dgram_sendmsg
 / unix_release_sock

[ Upstream commit a494bd642d9120648b06bb7d28ce6d05f55a7819 ]

While unix_may_send(sk, osk) is called while osk is locked, it appears
unix_release_sock() can overwrite unix_peer() after this lock has been
released, making KCSAN unhappy.

Changing unix_release_sock() to access/change unix_peer()
before lock is released should fix this issue.

BUG: KCSAN: data-race in unix_dgram_sendmsg / unix_release_sock

write to 0xffff88810465a338 of 8 bytes by task 20852 on cpu 1:
 unix_release_sock+0x4ed/0x6e0 net/unix/af_unix.c:558
 unix_release+0x2f/0x50 net/unix/af_unix.c:859
 __sock_release net/socket.c:599 [inline]
 sock_close+0x6c/0x150 net/socket.c:1258
 __fput+0x25b/0x4e0 fs/file_table.c:280
 ____fput+0x11/0x20 fs/file_table.c:313
 task_work_run+0xae/0x130 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
 exit_to_user_mode_prepare+0x156/0x190 kernel/entry/common.c:209
 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
 syscall_exit_to_user_mode+0x20/0x40 kernel/entry/common.c:302
 do_syscall_64+0x56/0x90 arch/x86/entry/common.c:57
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff88810465a338 of 8 bytes by task 20888 on cpu 0:
 unix_may_send net/unix/af_unix.c:189 [inline]
 unix_dgram_sendmsg+0x923/0x1610 net/unix/af_unix.c:1712
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg net/socket.c:674 [inline]
 ____sys_sendmsg+0x360/0x4d0 net/socket.c:2350
 ___sys_sendmsg net/socket.c:2404 [inline]
 __sys_sendmmsg+0x315/0x4b0 net/socket.c:2490
 __do_sys_sendmmsg net/socket.c:2519 [inline]
 __se_sys_sendmmsg net/socket.c:2516 [inline]
 __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2516
 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0xffff888167905400 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 20888 Comm: syz-executor.0 Not tainted 5.13.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/unix/af_unix.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 014e35c2723a..a0e8cb24af35 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -534,12 +534,14 @@ static void unix_release_sock(struct sock *sk, int embrion)
 	u->path.mnt = NULL;
 	state = sk->sk_state;
 	sk->sk_state = TCP_CLOSE;
+
+	skpair = unix_peer(sk);
+	unix_peer(sk) = NULL;
+
 	unix_state_unlock(sk);
 
 	wake_up_interruptible_all(&u->peer_wait);
 
-	skpair = unix_peer(sk);
-
 	if (skpair != NULL) {
 		if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) {
 			unix_state_lock(skpair);
@@ -554,7 +556,6 @@ static void unix_release_sock(struct sock *sk, int embrion)
 
 		unix_dgram_peer_wake_disconnect(sk, skpair);
 		sock_put(skpair); /* It may now die */
-		unix_peer(sk) = NULL;
 	}
 
 	/* Try to flush out this socket. Throw out buffers at least */

From 4f3a74c3340ebebd5227208a15e48b969d813744 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Wed, 16 Jun 2021 20:43:37 +0200
Subject: [PATCH 2269/2658] be2net: Fix an error handling path in 'be_probe()'

[ Upstream commit c19c8c0e666f9259e2fc4d2fa4b9ff8e3b40ee5d ]

If an error occurs after a 'pci_enable_pcie_error_reporting()' call, it
must be undone by a corresponding 'pci_disable_pcie_error_reporting()'
call, as already done in the remove function.

Fixes: d6b6d9877878 ("be2net: use PCIe AER capability")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Acked-by: Somnath Kotur <somnath.kotur@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/emulex/benet/be_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 7cd39324106d..398b9bd09400 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -5878,6 +5878,7 @@ static int be_probe(struct pci_dev *pdev, const struct pci_device_id *pdev_id)
 unmap_bars:
 	be_unmap_pci_bars(adapter);
 free_netdev:
+	pci_disable_pcie_error_reporting(pdev);
 	free_netdev(netdev);
 rel_reg:
 	pci_release_regions(pdev);

From ecd3c52398e2efdc2fb5fd8e406479779b4d2071 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Wed, 16 Jun 2021 22:09:06 +0300
Subject: [PATCH 2270/2658] net: hamradio: fix memory leak in mkiss_close

[ Upstream commit 7edcc682301492380fbdd604b4516af5ae667a13 ]

My local syzbot instance hit memory leak in
mkiss_open()[1]. The problem was in missing
free_netdev() in mkiss_close().

In mkiss_open() netdevice is allocated and then
registered, but in mkiss_close() netdevice was
only unregistered, but not freed.

Fail log:

BUG: memory leak
unreferenced object 0xffff8880281ba000 (size 4096):
  comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
  hex dump (first 32 bytes):
    61 78 30 00 00 00 00 00 00 00 00 00 00 00 00 00  ax0.............
    00 27 fa 2a 80 88 ff ff 00 00 00 00 00 00 00 00  .'.*............
  backtrace:
    [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0
    [<ffffffff8706e7e8>] alloc_netdev_mqs+0x98/0xe80
    [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1]
    [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110
    [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670
    [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440
    [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200
    [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0
    [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff8880141a9a00 (size 96):
  comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
  hex dump (first 32 bytes):
    e8 a2 1b 28 80 88 ff ff e8 a2 1b 28 80 88 ff ff  ...(.......(....
    98 92 9c aa b0 40 02 00 00 00 00 00 00 00 00 00  .....@..........
  backtrace:
    [<ffffffff8709f68b>] __hw_addr_create_ex+0x5b/0x310
    [<ffffffff8709fb38>] __hw_addr_add_ex+0x1f8/0x2b0
    [<ffffffff870a0c7b>] dev_addr_init+0x10b/0x1f0
    [<ffffffff8706e88b>] alloc_netdev_mqs+0x13b/0xe80
    [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1]
    [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110
    [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670
    [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440
    [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200
    [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0
    [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff8880219bfc00 (size 512):
  comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
  hex dump (first 32 bytes):
    00 a0 1b 28 80 88 ff ff 80 8f b1 8d ff ff ff ff  ...(............
    80 8f b1 8d ff ff ff ff 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0
    [<ffffffff8706eec7>] alloc_netdev_mqs+0x777/0xe80
    [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1]
    [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110
    [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670
    [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440
    [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200
    [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0
    [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff888029b2b200 (size 256):
  comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0
    [<ffffffff8706f062>] alloc_netdev_mqs+0x912/0xe80
    [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1]
    [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110
    [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670
    [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440
    [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200
    [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0
    [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

Fixes: 815f62bf7427 ("[PATCH] SMP rewrite of mkiss")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/hamradio/mkiss.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
index 470d416f2b86..078eb110381c 100644
--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -810,6 +810,7 @@ static void mkiss_close(struct tty_struct *tty)
 	ax->tty = NULL;
 
 	unregister_netdev(ax->dev);
+	free_netdev(ax->dev);
 }
 
 /* Perform I/O control on an active ax25 channel. */

From 4d84c8627f3fbe7a9612aa2f3ca3fbcebbfc1a41 Mon Sep 17 00:00:00 2001
From: Linyu Yuan <linyyuan@codeaurora.org>
Date: Thu, 17 Jun 2021 07:32:32 +0800
Subject: [PATCH 2271/2658] net: cdc_eem: fix tx fixup skb leak

[ Upstream commit c3b26fdf1b32f91c7a3bc743384b4a298ab53ad7 ]

when usbnet transmit a skb, eem fixup it in eem_tx_fixup(),
if skb_copy_expand() failed, it return NULL,
usbnet_start_xmit() will have no chance to free original skb.

fix it by free orginal skb in eem_tx_fixup() first,
then check skb clone status, if failed, return NULL to usbnet.

Fixes: 9f722c0978b0 ("usbnet: CDC EEM support (v5)")
Signed-off-by: Linyu Yuan <linyyuan@codeaurora.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/cdc_eem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/usb/cdc_eem.c b/drivers/net/usb/cdc_eem.c
index f7180f8db39e..9c15e1a1261b 100644
--- a/drivers/net/usb/cdc_eem.c
+++ b/drivers/net/usb/cdc_eem.c
@@ -138,10 +138,10 @@ static struct sk_buff *eem_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
 	}
 
 	skb2 = skb_copy_expand(skb, EEM_HEAD, ETH_FCS_LEN + padlen, flags);
+	dev_kfree_skb_any(skb);
 	if (!skb2)
 		return NULL;
 
-	dev_kfree_skb_any(skb);
 	skb = skb2;
 
 done:

From b64226479edce39696b1c0b6e7952e1b54e97536 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Fri, 18 Jun 2021 16:49:02 +0300
Subject: [PATCH 2272/2658] net: ethernet: fix potential use-after-free in
 ec_bhf_remove

[ Upstream commit 9cca0c2d70149160407bda9a9446ce0c29b6e6c6 ]

static void ec_bhf_remove(struct pci_dev *dev)
{
...
	struct ec_bhf_priv *priv = netdev_priv(net_dev);

	unregister_netdev(net_dev);
	free_netdev(net_dev);

	pci_iounmap(dev, priv->dma_io);
	pci_iounmap(dev, priv->io);
...
}

priv is netdev private data, but it is used
after free_netdev(). It can cause use-after-free when accessing priv
pointer. So, fix it by moving free_netdev() after pci_iounmap()
calls.

Fixes: 6af55ff52b02 ("Driver for Beckhoff CX5020 EtherCAT master module.")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/ec_bhf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/ec_bhf.c b/drivers/net/ethernet/ec_bhf.c
index f7b42483921c..0ade0c6d81ee 100644
--- a/drivers/net/ethernet/ec_bhf.c
+++ b/drivers/net/ethernet/ec_bhf.c
@@ -589,10 +589,12 @@ static void ec_bhf_remove(struct pci_dev *dev)
 	struct ec_bhf_priv *priv = netdev_priv(net_dev);
 
 	unregister_netdev(net_dev);
-	free_netdev(net_dev);
 
 	pci_iounmap(dev, priv->dma_io);
 	pci_iounmap(dev, priv->io);
+
+	free_netdev(net_dev);
+
 	pci_release_regions(dev);
 	pci_clear_master(dev);
 	pci_disable_device(dev);

From 7181cdb4bbcb886eaa8928d0cbbf3cfa83059a8b Mon Sep 17 00:00:00 2001
From: Ming Lei <ming.lei@redhat.com>
Date: Wed, 2 Jun 2021 21:30:28 +0800
Subject: [PATCH 2273/2658] scsi: core: Put .shost_dev in failure path if host
 state changes to RUNNING

[ Upstream commit 11714026c02d613c30a149c3f4c4a15047744529 ]

scsi_host_dev_release() only frees dev_name when host state is
SHOST_CREATED. After host state has changed to SHOST_RUNNING,
scsi_host_dev_release() no longer cleans up.

Fix this by doing a put_device(&shost->shost_dev) in the failure path when
host state is SHOST_RUNNING. Move get_device(&shost->shost_gendev) before
device_add(&shost->shost_dev) so that scsi_host_cls_release() can do a put
on this reference.

Link: https://lore.kernel.org/r/20210602133029.2864069-4-ming.lei@redhat.com
Cc: Bart Van Assche <bvanassche@acm.org>
Cc: Hannes Reinecke <hare@suse.de>
Reported-by: John Garry <john.garry@huawei.com>
Tested-by: John Garry <john.garry@huawei.com>
Reviewed-by: John Garry <john.garry@huawei.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/hosts.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index fb4b6034f644..636548030046 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -259,12 +259,11 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev,
 
 	device_enable_async_suspend(&shost->shost_dev);
 
+	get_device(&shost->shost_gendev);
 	error = device_add(&shost->shost_dev);
 	if (error)
 		goto out_del_gendev;
 
-	get_device(&shost->shost_gendev);
-
 	if (shost->transportt->host_size) {
 		shost->shost_data = kzalloc(shost->transportt->host_size,
 					 GFP_KERNEL);
@@ -300,6 +299,11 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev,
  out_del_dev:
 	device_del(&shost->shost_dev);
  out_del_gendev:
+	/*
+	 * Host state is SHOST_RUNNING so we have to explicitly release
+	 * ->shost_dev.
+	 */
+	put_device(&shost->shost_dev);
 	device_del(&shost->shost_gendev);
  out_destroy_freelist:
 	scsi_destroy_command_freelist(shost);

From f3e7eeb8599cf599f15186377bd25204c97081d7 Mon Sep 17 00:00:00 2001
From: Chen Li <chenli@uniontech.com>
Date: Fri, 4 Jun 2021 16:43:02 +0800
Subject: [PATCH 2274/2658] radeon: use memcpy_to/fromio for UVD fw upload
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit ab8363d3875a83f4901eb1cc00ce8afd24de6c85 ]

I met a gpu addr bug recently and the kernel log
tells me the pc is memcpy/memset and link register is
radeon_uvd_resume.

As we know, in some architectures, optimized memcpy/memset
may not work well on device memory. Trival memcpy_toio/memset_io
can fix this problem.

BTW, amdgpu has already done it in:
commit ba0b2275a678 ("drm/amdgpu: use memcpy_to/fromio for UVD fw upload"),
that's why it has no this issue on the same gpu and platform.

Signed-off-by: Chen Li <chenli@uniontech.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/radeon/radeon_uvd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index b35ebabd6a9f..eab985fdcfbd 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -242,7 +242,7 @@ int radeon_uvd_resume(struct radeon_device *rdev)
 	if (rdev->uvd.vcpu_bo == NULL)
 		return -EINVAL;
 
-	memcpy(rdev->uvd.cpu_addr, rdev->uvd_fw->data, rdev->uvd_fw->size);
+	memcpy_toio((void __iomem *)rdev->uvd.cpu_addr, rdev->uvd_fw->data, rdev->uvd_fw->size);
 
 	size = radeon_bo_size(rdev->uvd.vcpu_bo);
 	size -= rdev->uvd_fw->size;
@@ -250,7 +250,7 @@ int radeon_uvd_resume(struct radeon_device *rdev)
 	ptr = rdev->uvd.cpu_addr;
 	ptr += rdev->uvd_fw->size;
 
-	memset(ptr, 0, size);
+	memset_io((void __iomem *)ptr, 0, size);
 
 	return 0;
 }

From 032609a866935a0aaaa4fbc69d9c495261c7a023 Mon Sep 17 00:00:00 2001
From: Norbert Slusarek <nslusarek@gmx.net>
Date: Sat, 12 Jun 2021 22:18:54 +0200
Subject: [PATCH 2275/2658] can: bcm: fix infoleak in struct bcm_msg_head

commit 5e87ddbe3942e27e939bdc02deb8579b0cbd8ecc upstream.

On 64-bit systems, struct bcm_msg_head has an added padding of 4 bytes between
struct members count and ival1. Even though all struct members are initialized,
the 4-byte hole will contain data from the kernel stack. This patch zeroes out
struct bcm_msg_head before usage, preventing infoleaks to userspace.

Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
Link: https://lore.kernel.org/r/trinity-7c1b2e82-e34f-4885-8060-2cd7a13769ce-1623532166177@3c-app-gmx-bs52
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Norbert Slusarek <nslusarek@gmx.net>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/bcm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/can/bcm.c b/net/can/bcm.c
index 1f15622d3c65..bd9e10db6cd7 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -392,6 +392,7 @@ static void bcm_tx_timeout_tsklet(unsigned long data)
 		if (!op->count && (op->flags & TX_COUNTEVT)) {
 
 			/* create notification to user */
+			memset(&msg_head, 0, sizeof(msg_head));
 			msg_head.opcode  = TX_EXPIRED;
 			msg_head.flags   = op->flags;
 			msg_head.count   = op->count;
@@ -439,6 +440,7 @@ static void bcm_rx_changed(struct bcm_op *op, struct can_frame *data)
 	/* this element is not throttled anymore */
 	data->can_dlc &= (BCM_CAN_DLC_MASK|RX_RECV);
 
+	memset(&head, 0, sizeof(head));
 	head.opcode  = RX_CHANGED;
 	head.flags   = op->flags;
 	head.count   = op->count;
@@ -550,6 +552,7 @@ static void bcm_rx_timeout_tsklet(unsigned long data)
 	struct bcm_msg_head msg_head;
 
 	/* create notification to user */
+	memset(&msg_head, 0, sizeof(msg_head));
 	msg_head.opcode  = RX_TIMEOUT;
 	msg_head.flags   = op->flags;
 	msg_head.count   = op->count;

From 79b74f67315a5106853b2d4d47a3cf62cc85ab7e Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Thu, 17 Jun 2021 17:12:35 -0400
Subject: [PATCH 2276/2658] tracing: Do no increment trace_clock_global() by
 one

commit 89529d8b8f8daf92d9979382b8d2eb39966846ea upstream.

The trace_clock_global() tries to make sure the events between CPUs is
somewhat in order. A global value is used and updated by the latest read
of a clock. If one CPU is ahead by a little, and is read by another CPU, a
lock is taken, and if the timestamp of the other CPU is behind, it will
simply use the other CPUs timestamp.

The lock is also only taken with a "trylock" due to tracing, and strange
recursions can happen. The lock is not taken at all in NMI context.

In the case where the lock is not able to be taken, the non synced
timestamp is returned. But it will not be less than the saved global
timestamp.

The problem arises because when the time goes "backwards" the time
returned is the saved timestamp plus 1. If the lock is not taken, and the
plus one to the timestamp is returned, there's a small race that can cause
the time to go backwards!

	CPU0				CPU1
	----				----
				trace_clock_global() {
				    ts = clock() [ 1000 ]
				    trylock(clock_lock) [ success ]
				    global_ts = ts; [ 1000 ]

				    <interrupted by NMI>
 trace_clock_global() {
    ts = clock() [ 999 ]
    if (ts < global_ts)
	ts = global_ts + 1 [ 1001 ]

    trylock(clock_lock) [ fail ]

    return ts [ 1001]
 }
				    unlock(clock_lock);
				    return ts; [ 1000 ]
				}

 trace_clock_global() {
    ts = clock() [ 1000 ]
    if (ts < global_ts) [ false 1000 == 1000 ]

    trylock(clock_lock) [ success ]
    global_ts = ts; [ 1000 ]
    unlock(clock_lock)

    return ts; [ 1000 ]
 }

The above case shows to reads of trace_clock_global() on the same CPU, but
the second read returns one less than the first read. That is, time when
backwards, and this is not what is allowed by trace_clock_global().

This was triggered by heavy tracing and the ring buffer checker that tests
for the clock going backwards:

 Ring buffer clock went backwards: 20613921464 -> 20613921463
 ------------[ cut here ]------------
 WARNING: CPU: 2 PID: 0 at kernel/trace/ring_buffer.c:3412 check_buffer+0x1b9/0x1c0
 Modules linked in:
 [..]
 [CPU: 2]TIME DOES NOT MATCH expected:20620711698 actual:20620711697 delta:6790234 before:20613921463 after:20613921463
   [20613915818] PAGE TIME STAMP
   [20613915818] delta:0
   [20613915819] delta:1
   [20613916035] delta:216
   [20613916465] delta:430
   [20613916575] delta:110
   [20613916749] delta:174
   [20613917248] delta:499
   [20613917333] delta:85
   [20613917775] delta:442
   [20613917921] delta:146
   [20613918321] delta:400
   [20613918568] delta:247
   [20613918768] delta:200
   [20613919306] delta:538
   [20613919353] delta:47
   [20613919980] delta:627
   [20613920296] delta:316
   [20613920571] delta:275
   [20613920862] delta:291
   [20613921152] delta:290
   [20613921464] delta:312
   [20613921464] delta:0 TIME EXTEND
   [20613921464] delta:0

This happened more than once, and always for an off by one result. It also
started happening after commit aafe104aa9096 was added.

Cc: stable@vger.kernel.org
Fixes: aafe104aa9096 ("tracing: Restructure trace_clock_global() to never block")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace_clock.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kernel/trace/trace_clock.c b/kernel/trace/trace_clock.c
index b67ea5eed2a8..b70233a9563f 100644
--- a/kernel/trace/trace_clock.c
+++ b/kernel/trace/trace_clock.c
@@ -113,9 +113,9 @@ u64 notrace trace_clock_global(void)
 	prev_time = READ_ONCE(trace_clock_struct.prev_time);
 	now = sched_clock_cpu(this_cpu);
 
-	/* Make sure that now is always greater than prev_time */
+	/* Make sure that now is always greater than or equal to prev_time */
 	if ((s64)(now - prev_time) < 0)
-		now = prev_time + 1;
+		now = prev_time;
 
 	/*
 	 * If in an NMI context then dont risk lockups and simply return
@@ -129,7 +129,7 @@ u64 notrace trace_clock_global(void)
 		/* Reread prev_time in case it was already updated */
 		prev_time = READ_ONCE(trace_clock_struct.prev_time);
 		if ((s64)(now - prev_time) < 0)
-			now = prev_time + 1;
+			now = prev_time;
 
 		trace_clock_struct.prev_time = now;
 

From 7de5b6fb273e059499fe10d327ed9435a5752bbb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Antti=20J=C3=A4rvinen?= <antti.jarvinen@gmail.com>
Date: Mon, 15 Mar 2021 10:26:06 +0000
Subject: [PATCH 2277/2658] PCI: Mark TI C667X to avoid bus reset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit b5cf198e74a91073d12839a3e2db99994a39995d upstream.

Some TI KeyStone C667X devices do not support bus/hot reset.  The PCIESS
automatically disables LTSSM when Secondary Bus Reset is received and
device stops working.  Prevent bus reset for these devices.  With this
change, the device can be assigned to VMs with VFIO, but it will leak state
between VMs.

Reference: https://e2e.ti.com/support/processors/f/791/t/954382
Link: https://lore.kernel.org/r/20210315102606.17153-1-antti.jarvinen@gmail.com
Signed-off-by: Antti Järvinen <antti.jarvinen@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Kishon Vijay Abraham I <kishon@ti.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/quirks.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index bc0aa0849e72..d6199776c0f6 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3157,6 +3157,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0034, quirk_no_bus_reset);
 
+/*
+ * Some TI KeyStone C667X devices do not support bus/hot reset.  The PCIESS
+ * automatically disables LTSSM when Secondary Bus Reset is received and
+ * the device stops working.  Prevent bus reset for these devices.  With
+ * this change, the device can be assigned to VMs with VFIO, but it will
+ * leak state between VMs.  Reference
+ * https://e2e.ti.com/support/processors/f/791/t/954382
+ */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset);
+
 static void quirk_no_pm_reset(struct pci_dev *dev)
 {
 	/*

From 96d7a32872d0e5f9e363031c2b8527de3398177f Mon Sep 17 00:00:00 2001
From: Shanker Donthineni <sdonthineni@nvidia.com>
Date: Tue, 8 Jun 2021 11:18:56 +0530
Subject: [PATCH 2278/2658] PCI: Mark some NVIDIA GPUs to avoid bus reset

commit 4c207e7121fa92b66bf1896bf8ccb9edfb0f9731 upstream.

Some NVIDIA GPU devices do not work with SBR.  Triggering SBR leaves the
device inoperable for the current system boot. It requires a system
hard-reboot to get the GPU device back to normal operating condition
post-SBR. For the affected devices, enable NO_BUS_RESET quirk to avoid the
issue.

This issue will be fixed in the next generation of hardware.

Link: https://lore.kernel.org/r/20210608054857.18963-8-ameynarkhede03@gmail.com
Signed-off-by: Shanker Donthineni <sdonthineni@nvidia.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Sinan Kaya <okaya@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/quirks.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index d6199776c0f6..e65eec0644a7 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3144,6 +3144,18 @@ static void quirk_no_bus_reset(struct pci_dev *dev)
 	dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET;
 }
 
+/*
+ * Some NVIDIA GPU devices do not work with bus reset, SBR needs to be
+ * prevented for those affected devices.
+ */
+static void quirk_nvidia_no_bus_reset(struct pci_dev *dev)
+{
+	if ((dev->device & 0xffc0) == 0x2340)
+		quirk_no_bus_reset(dev);
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
+			 quirk_nvidia_no_bus_reset);
+
 /*
  * Some Atheros AR9xxx and QCA988x chips do not behave after a bus reset.
  * The device will throw a Link Down error on AER-capable systems and

From 3dd31b2c5f77d2b2f04076f5c80c7e1b5621b651 Mon Sep 17 00:00:00 2001
From: Bumyong Lee <bumyong.lee@samsung.com>
Date: Fri, 7 May 2021 15:36:47 +0900
Subject: [PATCH 2279/2658] dmaengine: pl330: fix wrong usage of spinlock flags
 in dma_cyclc

commit 4ad5dd2d7876d79507a20f026507d1a93b8fff10 upstream.

flags varible which is the input parameter of pl330_prep_dma_cyclic()
should not be used by spinlock_irq[save/restore] function.

Signed-off-by: Jongho Park <jongho7.park@samsung.com>
Signed-off-by: Bumyong Lee <bumyong.lee@samsung.com>
Signed-off-by: Chanho Park <chanho61.park@samsung.com>
Link: https://lore.kernel.org/r/20210507063647.111209-1-chanho61.park@samsung.com
Fixes: f6f2421c0a1c ("dmaengine: pl330: Merge dma_pl330_dmac and pl330_dmac structs")
Cc: stable@vger.kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/dma/pl330.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 7f66ae1945b2..6ea993478ddd 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2531,13 +2531,15 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic(
 	for (i = 0; i < len / period_len; i++) {
 		desc = pl330_get_desc(pch);
 		if (!desc) {
+			unsigned long iflags;
+
 			dev_err(pch->dmac->ddma.dev, "%s:%d Unable to fetch desc\n",
 				__func__, __LINE__);
 
 			if (!first)
 				return NULL;
 
-			spin_lock_irqsave(&pl330->pool_lock, flags);
+			spin_lock_irqsave(&pl330->pool_lock, iflags);
 
 			while (!list_empty(&first->node)) {
 				desc = list_entry(first->node.next,
@@ -2547,7 +2549,7 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic(
 
 			list_move_tail(&first->node, &pl330->desc_pool);
 
-			spin_unlock_irqrestore(&pl330->pool_lock, flags);
+			spin_unlock_irqrestore(&pl330->pool_lock, iflags);
 
 			return NULL;
 		}

From 1b5567d3e0595804b642a8a4e7fda6cca5ff2eec Mon Sep 17 00:00:00 2001
From: Fugang Duan <fugang.duan@nxp.com>
Date: Wed, 16 Jun 2021 17:14:25 +0800
Subject: [PATCH 2280/2658] net: fec_ptp: add clock rate zero check

commit cb3cefe3f3f8af27c6076ef7d1f00350f502055d upstream.

Add clock rate zero check to fix coverity issue of "divide by 0".

Fixes: commit 85bd1798b24a ("net: fec: fix spin_lock dead lock")
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/freescale/fec_ptp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
index 123181612595..031d4b3a544c 100644
--- a/drivers/net/ethernet/freescale/fec_ptp.c
+++ b/drivers/net/ethernet/freescale/fec_ptp.c
@@ -586,6 +586,10 @@ void fec_ptp_init(struct platform_device *pdev)
 	fep->ptp_caps.enable = fec_ptp_enable;
 
 	fep->cycle_speed = clk_get_rate(fep->clk_ptp);
+	if (!fep->cycle_speed) {
+		fep->cycle_speed = NSEC_PER_SEC;
+		dev_err(&fep->pdev->dev, "clk_ptp clock rate is zero\n");
+	}
 	fep->ptp_inc = NSEC_PER_SEC / fep->cycle_speed;
 
 	spin_lock_init(&fep->tmreg_lock);

From 1b9dc79bfae940e77f52d5a393c932d5776ec8ba Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Date: Sat, 5 Jun 2021 19:26:35 +0900
Subject: [PATCH 2281/2658] can: bcm/raw/isotp: use per module netdevice
 notifier

commit 8d0caedb759683041d9db82069937525999ada53 upstream.

syzbot is reporting hung task at register_netdevice_notifier() [1] and
unregister_netdevice_notifier() [2], for cleanup_net() might perform
time consuming operations while CAN driver's raw/bcm/isotp modules are
calling {register,unregister}_netdevice_notifier() on each socket.

Change raw/bcm/isotp modules to call register_netdevice_notifier() from
module's __init function and call unregister_netdevice_notifier() from
module's __exit function, as with gw/j1939 modules are doing.

Link: https://syzkaller.appspot.com/bug?id=391b9498827788b3cc6830226d4ff5be87107c30 [1]
Link: https://syzkaller.appspot.com/bug?id=1724d278c83ca6e6df100a2e320c10d991cf2bce [2]
Link: https://lore.kernel.org/r/54a5f451-05ed-f977-8534-79e7aa2bcc8f@i-love.sakura.ne.jp
Cc: linux-stable <stable@vger.kernel.org>
Reported-by: syzbot <syzbot+355f8edb2ff45d5f95fa@syzkaller.appspotmail.com>
Reported-by: syzbot <syzbot+0f1827363a305f74996f@syzkaller.appspotmail.com>
Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Tested-by: syzbot <syzbot+355f8edb2ff45d5f95fa@syzkaller.appspotmail.com>
Tested-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/bcm.c | 61 +++++++++++++++++++++++++++++++++++++++-----------
 net/can/raw.c | 62 +++++++++++++++++++++++++++++++++++++++------------
 2 files changed, 96 insertions(+), 27 deletions(-)

diff --git a/net/can/bcm.c b/net/can/bcm.c
index bd9e10db6cd7..c6fee58baac4 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -121,7 +121,7 @@ struct bcm_sock {
 	struct sock sk;
 	int bound;
 	int ifindex;
-	struct notifier_block notifier;
+	struct list_head notifier;
 	struct list_head rx_ops;
 	struct list_head tx_ops;
 	unsigned long dropped_usr_msgs;
@@ -129,6 +129,10 @@ struct bcm_sock {
 	char procname [32]; /* inode number in decimal with \0 */
 };
 
+static LIST_HEAD(bcm_notifier_list);
+static DEFINE_SPINLOCK(bcm_notifier_lock);
+static struct bcm_sock *bcm_busy_notifier;
+
 static inline struct bcm_sock *bcm_sk(const struct sock *sk)
 {
 	return (struct bcm_sock *)sk;
@@ -1388,20 +1392,15 @@ static int bcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 /*
  * notification handler for netdevice status changes
  */
-static int bcm_notifier(struct notifier_block *nb, unsigned long msg,
-			void *ptr)
+static void bcm_notify(struct bcm_sock *bo, unsigned long msg,
+		       struct net_device *dev)
 {
-	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
-	struct bcm_sock *bo = container_of(nb, struct bcm_sock, notifier);
 	struct sock *sk = &bo->sk;
 	struct bcm_op *op;
 	int notify_enodev = 0;
 
 	if (!net_eq(dev_net(dev), &init_net))
-		return NOTIFY_DONE;
-
-	if (dev->type != ARPHRD_CAN)
-		return NOTIFY_DONE;
+		return;
 
 	switch (msg) {
 
@@ -1436,7 +1435,28 @@ static int bcm_notifier(struct notifier_block *nb, unsigned long msg,
 				sk->sk_error_report(sk);
 		}
 	}
+}
 
+static int bcm_notifier(struct notifier_block *nb, unsigned long msg,
+			void *ptr)
+{
+	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+
+	if (dev->type != ARPHRD_CAN)
+		return NOTIFY_DONE;
+	if (msg != NETDEV_UNREGISTER && msg != NETDEV_DOWN)
+		return NOTIFY_DONE;
+	if (unlikely(bcm_busy_notifier)) /* Check for reentrant bug. */
+		return NOTIFY_DONE;
+
+	spin_lock(&bcm_notifier_lock);
+	list_for_each_entry(bcm_busy_notifier, &bcm_notifier_list, notifier) {
+		spin_unlock(&bcm_notifier_lock);
+		bcm_notify(bcm_busy_notifier, msg, dev);
+		spin_lock(&bcm_notifier_lock);
+	}
+	bcm_busy_notifier = NULL;
+	spin_unlock(&bcm_notifier_lock);
 	return NOTIFY_DONE;
 }
 
@@ -1456,9 +1476,9 @@ static int bcm_init(struct sock *sk)
 	INIT_LIST_HEAD(&bo->rx_ops);
 
 	/* set notifier */
-	bo->notifier.notifier_call = bcm_notifier;
-
-	register_netdevice_notifier(&bo->notifier);
+	spin_lock(&bcm_notifier_lock);
+	list_add_tail(&bo->notifier, &bcm_notifier_list);
+	spin_unlock(&bcm_notifier_lock);
 
 	return 0;
 }
@@ -1479,7 +1499,14 @@ static int bcm_release(struct socket *sock)
 
 	/* remove bcm_ops, timer, rx_unregister(), etc. */
 
-	unregister_netdevice_notifier(&bo->notifier);
+	spin_lock(&bcm_notifier_lock);
+	while (bcm_busy_notifier == bo) {
+		spin_unlock(&bcm_notifier_lock);
+		schedule_timeout_uninterruptible(1);
+		spin_lock(&bcm_notifier_lock);
+	}
+	list_del(&bo->notifier);
+	spin_unlock(&bcm_notifier_lock);
 
 	lock_sock(sk);
 
@@ -1665,6 +1692,10 @@ static const struct can_proto bcm_can_proto = {
 	.prot       = &bcm_proto,
 };
 
+static struct notifier_block canbcm_notifier = {
+	.notifier_call = bcm_notifier
+};
+
 static int __init bcm_module_init(void)
 {
 	int err;
@@ -1679,6 +1710,8 @@ static int __init bcm_module_init(void)
 
 	/* create /proc/net/can-bcm directory */
 	proc_dir = proc_mkdir("can-bcm", init_net.proc_net);
+	register_netdevice_notifier(&canbcm_notifier);
+
 	return 0;
 }
 
@@ -1688,6 +1721,8 @@ static void __exit bcm_module_exit(void)
 
 	if (proc_dir)
 		remove_proc_entry("can-bcm", init_net.proc_net);
+
+	unregister_netdevice_notifier(&canbcm_notifier);
 }
 
 module_init(bcm_module_init);
diff --git a/net/can/raw.c b/net/can/raw.c
index e9403a26a1d5..2e1d850a7f2a 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -84,7 +84,7 @@ struct raw_sock {
 	struct sock sk;
 	int bound;
 	int ifindex;
-	struct notifier_block notifier;
+	struct list_head notifier;
 	int loopback;
 	int recv_own_msgs;
 	int fd_frames;
@@ -96,6 +96,10 @@ struct raw_sock {
 	struct uniqframe __percpu *uniq;
 };
 
+static LIST_HEAD(raw_notifier_list);
+static DEFINE_SPINLOCK(raw_notifier_lock);
+static struct raw_sock *raw_busy_notifier;
+
 /*
  * Return pointer to store the extra msg flags for raw_recvmsg().
  * We use the space of one unsigned int beyond the 'struct sockaddr_can'
@@ -260,21 +264,16 @@ static int raw_enable_allfilters(struct net_device *dev, struct sock *sk)
 	return err;
 }
 
-static int raw_notifier(struct notifier_block *nb,
-			unsigned long msg, void *ptr)
+static void raw_notify(struct raw_sock *ro, unsigned long msg,
+		       struct net_device *dev)
 {
-	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
-	struct raw_sock *ro = container_of(nb, struct raw_sock, notifier);
 	struct sock *sk = &ro->sk;
 
 	if (!net_eq(dev_net(dev), &init_net))
-		return NOTIFY_DONE;
-
-	if (dev->type != ARPHRD_CAN)
-		return NOTIFY_DONE;
+		return;
 
 	if (ro->ifindex != dev->ifindex)
-		return NOTIFY_DONE;
+		return;
 
 	switch (msg) {
 
@@ -303,7 +302,28 @@ static int raw_notifier(struct notifier_block *nb,
 			sk->sk_error_report(sk);
 		break;
 	}
+}
+
+static int raw_notifier(struct notifier_block *nb, unsigned long msg,
+			void *ptr)
+{
+	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+
+	if (dev->type != ARPHRD_CAN)
+		return NOTIFY_DONE;
+	if (msg != NETDEV_UNREGISTER && msg != NETDEV_DOWN)
+		return NOTIFY_DONE;
+	if (unlikely(raw_busy_notifier)) /* Check for reentrant bug. */
+		return NOTIFY_DONE;
 
+	spin_lock(&raw_notifier_lock);
+	list_for_each_entry(raw_busy_notifier, &raw_notifier_list, notifier) {
+		spin_unlock(&raw_notifier_lock);
+		raw_notify(raw_busy_notifier, msg, dev);
+		spin_lock(&raw_notifier_lock);
+	}
+	raw_busy_notifier = NULL;
+	spin_unlock(&raw_notifier_lock);
 	return NOTIFY_DONE;
 }
 
@@ -332,9 +352,9 @@ static int raw_init(struct sock *sk)
 		return -ENOMEM;
 
 	/* set notifier */
-	ro->notifier.notifier_call = raw_notifier;
-
-	register_netdevice_notifier(&ro->notifier);
+	spin_lock(&raw_notifier_lock);
+	list_add_tail(&ro->notifier, &raw_notifier_list);
+	spin_unlock(&raw_notifier_lock);
 
 	return 0;
 }
@@ -349,7 +369,14 @@ static int raw_release(struct socket *sock)
 
 	ro = raw_sk(sk);
 
-	unregister_netdevice_notifier(&ro->notifier);
+	spin_lock(&raw_notifier_lock);
+	while (raw_busy_notifier == ro) {
+		spin_unlock(&raw_notifier_lock);
+		schedule_timeout_uninterruptible(1);
+		spin_lock(&raw_notifier_lock);
+	}
+	list_del(&ro->notifier);
+	spin_unlock(&raw_notifier_lock);
 
 	lock_sock(sk);
 
@@ -857,6 +884,10 @@ static const struct can_proto raw_can_proto = {
 	.prot       = &raw_proto,
 };
 
+static struct notifier_block canraw_notifier = {
+	.notifier_call = raw_notifier
+};
+
 static __init int raw_module_init(void)
 {
 	int err;
@@ -866,6 +897,8 @@ static __init int raw_module_init(void)
 	err = can_proto_register(&raw_can_proto);
 	if (err < 0)
 		printk(KERN_ERR "can: registration of raw protocol failed\n");
+	else
+		register_netdevice_notifier(&canraw_notifier);
 
 	return err;
 }
@@ -873,6 +906,7 @@ static __init int raw_module_init(void)
 static __exit void raw_module_exit(void)
 {
 	can_proto_unregister(&raw_can_proto);
+	unregister_netdevice_notifier(&canraw_notifier);
 }
 
 module_init(raw_module_init);

From 84d4ba001a60622a3801141814a16e1ea0cd2296 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Thu, 17 Jun 2021 13:47:25 -0400
Subject: [PATCH 2282/2658] tracing: Do not stop recording cmdlines when
 tracing is off

commit 85550c83da421fb12dc1816c45012e1e638d2b38 upstream.

The saved_cmdlines is used to map pids to the task name, such that the
output of the tracing does not just show pids, but also gives a human
readable name for the task.

If the name is not mapped, the output looks like this:

    <...>-1316          [005] ...2   132.044039: ...

Instead of this:

    gnome-shell-1316    [005] ...2   132.044039: ...

The names are updated when tracing is running, but are skipped if tracing
is stopped. Unfortunately, this stops the recording of the names if the
top level tracer is stopped, and not if there's other tracers active.

The recording of a name only happens when a new event is written into a
ring buffer, so there is no need to test if tracing is on or not. If
tracing is off, then no event is written and no need to test if tracing is
off or not.

Remove the check, as it hides the names of tasks for events in the
instance buffers.

Cc: stable@vger.kernel.org
Fixes: 7ffbd48d5cab2 ("tracing: Cache comms only after an event occurred")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 4fa248746dd8..b3d3f2d8a902 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1686,9 +1686,6 @@ int trace_find_tgid(int pid)
 
 void tracing_record_cmdline(struct task_struct *tsk)
 {
-	if (atomic_read(&trace_record_cmdline_disabled) || !tracing_is_on())
-		return;
-
 	if (!__this_cpu_read(trace_cmdline_save))
 		return;
 

From af2cff105fd40667b457f8ccda4e1a070c1b336a Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Thu, 17 Jun 2021 14:32:34 -0400
Subject: [PATCH 2283/2658] tracing: Do not stop recording comms if the trace
 file is being read

commit 4fdd595e4f9a1ff6d93ec702eaecae451cfc6591 upstream.

A while ago, when the "trace" file was opened, tracing was stopped, and
code was added to stop recording the comms to saved_cmdlines, for mapping
of the pids to the task name.

Code has been added that only records the comm if a trace event occurred,
and there's no reason to not trace it if the trace file is opened.

Cc: stable@vger.kernel.org
Fixes: 7ffbd48d5cab2 ("tracing: Cache comms only after an event occurred")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index b3d3f2d8a902..a67f792fb950 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1376,9 +1376,6 @@ struct saved_cmdlines_buffer {
 };
 static struct saved_cmdlines_buffer *savedcmd;
 
-/* temporary disable recording */
-static atomic_t trace_record_cmdline_disabled __read_mostly;
-
 static inline char *get_saved_cmdlines(int idx)
 {
 	return &savedcmd->saved_cmdlines[idx * TASK_COMM_LEN];
@@ -2549,9 +2546,6 @@ static void *s_start(struct seq_file *m, loff_t *pos)
 		return ERR_PTR(-EBUSY);
 #endif
 
-	if (!iter->snapshot)
-		atomic_inc(&trace_record_cmdline_disabled);
-
 	if (*pos != iter->pos) {
 		iter->ent = NULL;
 		iter->cpu = 0;
@@ -2594,9 +2588,6 @@ static void s_stop(struct seq_file *m, void *p)
 		return;
 #endif
 
-	if (!iter->snapshot)
-		atomic_dec(&trace_record_cmdline_disabled);
-
 	trace_access_unlock(iter->cpu_file);
 	trace_event_read_unlock();
 }

From 3878c7fab2ae335b6581d8a6c914bc85b7d59dd8 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Wed, 9 Jun 2021 21:18:00 +0200
Subject: [PATCH 2284/2658] x86/fpu: Reset state for all signal restore
 failures

commit efa165504943f2128d50f63de0c02faf6dcceb0d upstream.

If access_ok() or fpregs_soft_set() fails in __fpu__restore_sig() then the
function just returns but does not clear the FPU state as it does for all
other fatal failures.

Clear the FPU state for these failures as well.

Fixes: 72a671ced66d ("x86, fpu: Unify signal handling code paths for x86 and x86_64 kernels")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/87mtryyhhz.ffs@nanos.tec.linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/fpu/signal.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
index 8fc842dae3b3..9a1489b92782 100644
--- a/arch/x86/kernel/fpu/signal.c
+++ b/arch/x86/kernel/fpu/signal.c
@@ -262,15 +262,23 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
 		return 0;
 	}
 
-	if (!access_ok(VERIFY_READ, buf, size))
+	if (!access_ok(VERIFY_READ, buf, size)) {
+		fpu__clear(fpu);
 		return -EACCES;
+	}
 
 	fpu__activate_curr(fpu);
 
-	if (!static_cpu_has(X86_FEATURE_FPU))
-		return fpregs_soft_set(current, NULL,
-				       0, sizeof(struct user_i387_ia32_struct),
-				       NULL, buf) != 0;
+	if (!static_cpu_has(X86_FEATURE_FPU)) {
+		int ret = fpregs_soft_set(current, NULL, 0,
+					  sizeof(struct user_i387_ia32_struct),
+					  NULL, buf);
+
+		if (ret)
+			fpu__clear(fpu);
+
+		return ret != 0;
+	}
 
 	if (use_xsave()) {
 		struct _fpx_sw_bytes fx_sw_user;

From 77281f6d5c45564406f78acc69799b9454bc29a3 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 24 Mar 2021 14:53:37 -0700
Subject: [PATCH 2285/2658] inet: use bigger hash table for IP ID generation

commit aa6dd211e4b1dde9d5dc25d699d35f789ae7eeba upstream.

In commit 73f156a6e8c1 ("inetpeer: get rid of ip_id_count")
I used a very small hash table that could be abused
by patient attackers to reveal sensitive information.

Switch to a dynamic sizing, depending on RAM size.

Typical big hosts will now use 128x more storage (2 MB)
to get a similar increase in security and reduction
of hash collisions.

As a bonus, use of alloc_large_system_hash() spreads
allocated memory among all NUMA nodes.

Fixes: 73f156a6e8c1 ("inetpeer: get rid of ip_id_count")
Reported-by: Amit Klein <aksecurity@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/route.c | 42 +++++++++++++++++++++++++++++-------------
 1 file changed, 29 insertions(+), 13 deletions(-)

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index a9df7487c929..83e1914693f3 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -70,6 +70,7 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
+#include <linux/bootmem.h>
 #include <linux/string.h>
 #include <linux/socket.h>
 #include <linux/sockios.h>
@@ -463,8 +464,10 @@ static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
 	return neigh_create(&arp_tbl, pkey, dev);
 }
 
-#define IP_IDENTS_SZ 2048u
-
+/* Hash tables of size 2048..262144 depending on RAM size.
+ * Each bucket uses 8 bytes.
+ */
+static u32 ip_idents_mask __read_mostly;
 static atomic_t *ip_idents __read_mostly;
 static u32 *ip_tstamps __read_mostly;
 
@@ -474,12 +477,16 @@ static u32 *ip_tstamps __read_mostly;
  */
 u32 ip_idents_reserve(u32 hash, int segs)
 {
-	u32 *p_tstamp = ip_tstamps + hash % IP_IDENTS_SZ;
-	atomic_t *p_id = ip_idents + hash % IP_IDENTS_SZ;
-	u32 old = ACCESS_ONCE(*p_tstamp);
-	u32 now = (u32)jiffies;
+	u32 bucket, old, now = (u32)jiffies;
+	atomic_t *p_id;
+	u32 *p_tstamp;
 	u32 delta = 0;
 
+	bucket = hash & ip_idents_mask;
+	p_tstamp = ip_tstamps + bucket;
+	p_id = ip_idents + bucket;
+	old = ACCESS_ONCE(*p_tstamp);
+
 	if (old != now && cmpxchg(p_tstamp, old, now) == old)
 		delta = prandom_u32_max(now - old);
 
@@ -2953,18 +2960,27 @@ struct ip_rt_acct __percpu *ip_rt_acct __read_mostly;
 
 int __init ip_rt_init(void)
 {
+	void *idents_hash;
 	int rc = 0;
 	int cpu;
 
-	ip_idents = kmalloc(IP_IDENTS_SZ * sizeof(*ip_idents), GFP_KERNEL);
-	if (!ip_idents)
-		panic("IP: failed to allocate ip_idents\n");
+	/* For modern hosts, this will use 2 MB of memory */
+	idents_hash = alloc_large_system_hash("IP idents",
+					      sizeof(*ip_idents) + sizeof(*ip_tstamps),
+					      0,
+					      16, /* one bucket per 64 KB */
+					      0,
+					      NULL,
+					      &ip_idents_mask,
+					      2048,
+					      256*1024);
+
+	ip_idents = idents_hash;
 
-	prandom_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents));
+	prandom_bytes(ip_idents, (ip_idents_mask + 1) * sizeof(*ip_idents));
 
-	ip_tstamps = kcalloc(IP_IDENTS_SZ, sizeof(*ip_tstamps), GFP_KERNEL);
-	if (!ip_tstamps)
-		panic("IP: failed to allocate ip_tstamps\n");
+	ip_tstamps = idents_hash + (ip_idents_mask + 1) * sizeof(*ip_idents);
+	memset(ip_tstamps, 0, (ip_idents_mask + 1) * sizeof(*ip_tstamps));
 
 	for_each_possible_cpu(cpu) {
 		struct uncached_list *ul = &per_cpu(rt_uncached_list, cpu);

From bb9d4e3e46d11b66d47d7d0c6bf89ffcc45efa8c Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Fri, 14 May 2021 11:26:37 +0100
Subject: [PATCH 2286/2658] ARM: 9081/1: fix gcc-10 thumb2-kernel regression

commit dad7b9896a5dbac5da8275d5a6147c65c81fb5f2 upstream.

When building the kernel wtih gcc-10 or higher using the
CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y flag, the compiler picks a slightly
different set of registers for the inline assembly in cpu_init() that
subsequently results in a corrupt kernel stack as well as remaining in
FIQ mode. If a banked register is used for the last argument, the wrong
version of that register gets loaded into CPSR_c.  When building in Arm
mode, the arguments are passed as immediate values and the bug cannot
happen.

This got introduced when Daniel reworked the FIQ handling and was
technically always broken, but happened to work with both clang and gcc
before gcc-10 as long as they picked one of the lower registers.
This is probably an indication that still very few people build the
kernel in Thumb2 mode.

Marek pointed out the problem on IRC, Arnd narrowed it down to this
inline assembly and Russell pinpointed the exact bug.

Change the constraints to force the final mode switch to use a non-banked
register for the argument to ensure that the correct constant gets loaded.
Another alternative would be to always use registers for the constant
arguments to avoid the #ifdef that has now become more complex.

Cc: <stable@vger.kernel.org> # v3.18+
Cc: Daniel Thompson <daniel.thompson@linaro.org>
Reported-by: Marek Vasut <marek.vasut@gmail.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Fixes: c0e7f7ee717e ("ARM: 8150/3: fiq: Replace default FIQ handler")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/kernel/setup.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 1ad40fc316b2..18013f7e2b31 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -488,9 +488,11 @@ void notrace cpu_init(void)
 	 * In Thumb-2, msr with an immediate value is not allowed.
 	 */
 #ifdef CONFIG_THUMB2_KERNEL
-#define PLC	"r"
+#define PLC_l	"l"
+#define PLC_r	"r"
 #else
-#define PLC	"I"
+#define PLC_l	"I"
+#define PLC_r	"I"
 #endif
 
 	/*
@@ -512,15 +514,15 @@ void notrace cpu_init(void)
 	"msr	cpsr_c, %9"
 	    :
 	    : "r" (stk),
-	      PLC (PSR_F_BIT | PSR_I_BIT | IRQ_MODE),
+	      PLC_r (PSR_F_BIT | PSR_I_BIT | IRQ_MODE),
 	      "I" (offsetof(struct stack, irq[0])),
-	      PLC (PSR_F_BIT | PSR_I_BIT | ABT_MODE),
+	      PLC_r (PSR_F_BIT | PSR_I_BIT | ABT_MODE),
 	      "I" (offsetof(struct stack, abt[0])),
-	      PLC (PSR_F_BIT | PSR_I_BIT | UND_MODE),
+	      PLC_r (PSR_F_BIT | PSR_I_BIT | UND_MODE),
 	      "I" (offsetof(struct stack, und[0])),
-	      PLC (PSR_F_BIT | PSR_I_BIT | FIQ_MODE),
+	      PLC_r (PSR_F_BIT | PSR_I_BIT | FIQ_MODE),
 	      "I" (offsetof(struct stack, fiq[0])),
-	      PLC (PSR_F_BIT | PSR_I_BIT | SVC_MODE)
+	      PLC_l (PSR_F_BIT | PSR_I_BIT | SVC_MODE)
 	    : "r14");
 #endif
 }

From a0f7a179826021aa9687966df20a61854ee75a19 Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <nathan@kernel.org>
Date: Wed, 28 Apr 2021 18:23:50 -0700
Subject: [PATCH 2287/2658] Makefile: Move -Wno-unused-but-set-variable out of
 GCC only block

commit 885480b084696331bea61a4f7eba10652999a9c1 upstream.

Currently, -Wunused-but-set-variable is only supported by GCC so it is
disabled unconditionally in a GCC only block (it is enabled with W=1).
clang currently has its implementation for this warning in review so
preemptively move this statement out of the GCC only block and wrap it
with cc-disable-warning so that both compilers function the same.

Cc: stable@vger.kernel.org
Link: https://reviews.llvm.org/D100581
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
[nc: Backport, workaround lack of e2079e93f562 in older branches]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

From d5803cae6436e29d7de0b12dfadb8c6d99b4917a Mon Sep 17 00:00:00 2001
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Date: Tue, 22 Jun 2021 17:35:18 +0200
Subject: [PATCH 2288/2658] Revert "PCI: PM: Do not read power state in
 pci_enable_device_flags()"

[ Upstream commit 4d6035f9bf4ea12776322746a216e856dfe46698 ]

Revert commit 4514d991d992 ("PCI: PM: Do not read power state in
pci_enable_device_flags()") that is reported to cause PCI device
initialization issues on some systems.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=213481
Link: https://lore.kernel.org/linux-acpi/YNDoGICcg0V8HhpQ@eldamar.lan
Reported-by: Michael <phyre@rogers.com>
Reported-by: Salvatore Bonaccorso <carnil@debian.org>
Fixes: 4514d991d992 ("PCI: PM: Do not read power state in pci_enable_device_flags()")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 22e8172f373d..b7f65fc54dc2 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1328,11 +1328,21 @@ static int pci_enable_device_flags(struct pci_dev *dev, unsigned long flags)
 	int err;
 	int i, bars = 0;
 
-	if (atomic_inc_return(&dev->enable_cnt) > 1) {
-		pci_update_current_state(dev, dev->current_state);
-		return 0;		/* already enabled */
+	/*
+	 * Power state could be unknown at this point, either due to a fresh
+	 * boot or a device removal call.  So get the current power state
+	 * so that things like MSI message writing will behave as expected
+	 * (e.g. if the device really is in D0 at enable time).
+	 */
+	if (dev->pm_cap) {
+		u16 pmcsr;
+		pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr);
+		dev->current_state = (pmcsr & PCI_PM_CTRL_STATE_MASK);
 	}
 
+	if (atomic_inc_return(&dev->enable_cnt) > 1)
+		return 0;		/* already enabled */
+
 	bridge = pci_upstream_bridge(dev);
 	if (bridge)
 		pci_enable_bridge(bridge);

From 7614797dc33f7f08ead894942efe9c90eeb83877 Mon Sep 17 00:00:00 2001
From: Du Cheng <ducheng2@gmail.com>
Date: Wed, 28 Apr 2021 14:39:41 +0800
Subject: [PATCH 2289/2658] cfg80211: call cfg80211_leave_ocb when switching
 away from OCB

[ Upstream commit a64b6a25dd9f984ed05fade603a00e2eae787d2f ]

If the userland switches back-and-forth between NL80211_IFTYPE_OCB and
NL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), there is a
chance where the cleanup cfg80211_leave_ocb() is not called. This leads
to initialization of in-use memory (e.g. init u.ibss while in-use by
u.ocb) due to a shared struct/union within ieee80211_sub_if_data:

struct ieee80211_sub_if_data {
    ...
    union {
        struct ieee80211_if_ap ap;
        struct ieee80211_if_vlan vlan;
        struct ieee80211_if_managed mgd;
        struct ieee80211_if_ibss ibss; // <- shares address
        struct ieee80211_if_mesh mesh;
        struct ieee80211_if_ocb ocb; // <- shares address
        struct ieee80211_if_mntr mntr;
        struct ieee80211_if_nan nan;
    } u;
    ...
}

Therefore add handling of otype == NL80211_IFTYPE_OCB, during
cfg80211_change_iface() to perform cleanup when leaving OCB mode.

link to syzkaller bug:
https://syzkaller.appspot.com/bug?id=0612dbfa595bf4b9b680ff7b4948257b8e3732d5

Reported-by: syzbot+105896fac213f26056f9@syzkaller.appspotmail.com
Signed-off-by: Du Cheng <ducheng2@gmail.com>
Link: https://lore.kernel.org/r/20210428063941.105161-1-ducheng2@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/wireless/util.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/wireless/util.c b/net/wireless/util.c
index 279787ff6693..0f4e6de4c0b8 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -973,6 +973,9 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
 		case NL80211_IFTYPE_MESH_POINT:
 			/* mesh should be handled? */
 			break;
+		case NL80211_IFTYPE_OCB:
+			cfg80211_leave_ocb(rdev, dev);
+			break;
 		default:
 			break;
 		}

From e7ccd8f931b344ab2bef2bef48b69baec5cb18c4 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Wed, 9 Jun 2021 16:13:06 +0200
Subject: [PATCH 2290/2658] mac80211: drop multicast fragments

[ Upstream commit a9799541ca34652d9996e45f80e8e03144c12949 ]

These are not permitted by the spec, just drop them.

Link: https://lore.kernel.org/r/20210609161305.23def022b750.Ibd6dd3cdce573dae262fcdc47f8ac52b883a9c50@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/rx.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 2ffbeb041886..2d3cbeda225f 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1854,17 +1854,15 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 	sc = le16_to_cpu(hdr->seq_ctrl);
 	frag = sc & IEEE80211_SCTL_FRAG;
 
-	if (is_multicast_ether_addr(hdr->addr1)) {
-		I802_DEBUG_INC(rx->local->dot11MulticastReceivedFrameCount);
-		goto out_no_led;
-	}
-
 	if (rx->sta)
 		cache = &rx->sta->frags;
 
 	if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
 		goto out;
 
+	if (is_multicast_ether_addr(hdr->addr1))
+		return RX_DROP_MONITOR;
+
 	I802_DEBUG_INC(rx->local->rx_handlers_fragments);
 
 	if (skb_linearize(rx->skb))
@@ -1993,7 +1991,6 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 
  out:
 	ieee80211_led_rx(rx->local);
- out_no_led:
 	if (rx->sta)
 		rx->sta->rx_stats.packets++;
 	return RX_CONTINUE;

From 6ca9b0c6fce989a22e74a812b8283f6654aee99e Mon Sep 17 00:00:00 2001
From: Zheng Yongjun <zhengyongjun3@huawei.com>
Date: Thu, 10 Jun 2021 09:41:36 +0800
Subject: [PATCH 2291/2658] ping: Check return value of function
 'ping_queue_rcv_skb'

[ Upstream commit 9d44fa3e50cc91691896934d106c86e4027e61ca ]

Function 'ping_queue_rcv_skb' not always return success, which will
also return fail. If not check the wrong return value of it, lead to function
`ping_rcv` return success.

Signed-off-by: Zheng Yongjun <zhengyongjun3@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/ping.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 3c698f575eb3..c3f808602b65 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -979,6 +979,7 @@ bool ping_rcv(struct sk_buff *skb)
 	struct sock *sk;
 	struct net *net = dev_net(skb->dev);
 	struct icmphdr *icmph = icmp_hdr(skb);
+	bool rc = false;
 
 	/* We assume the packet has already been checked by icmp_rcv */
 
@@ -993,14 +994,15 @@ bool ping_rcv(struct sk_buff *skb)
 		struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
 
 		pr_debug("rcv on socket %p\n", sk);
-		if (skb2)
-			ping_queue_rcv_skb(sk, skb2);
+		if (skb2 && !ping_queue_rcv_skb(sk, skb2))
+			rc = true;
 		sock_put(sk);
-		return true;
 	}
-	pr_debug("no socket, dropping\n");
 
-	return false;
+	if (!rc)
+		pr_debug("no socket, dropping\n");
+
+	return rc;
 }
 EXPORT_SYMBOL_GPL(ping_rcv);
 

From de80171b99cce628cb27c7be32566fc4cb3db044 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 10 Jun 2021 07:44:11 -0700
Subject: [PATCH 2292/2658] inet: annotate date races around sk->sk_txhash

[ Upstream commit b71eaed8c04f72a919a9c44e83e4ee254e69e7f3 ]

UDP sendmsg() path can be lockless, it is possible for another
thread to re-connect an change sk->sk_txhash under us.

There is no serious impact, but we can use READ_ONCE()/WRITE_ONCE()
pair to document the race.

BUG: KCSAN: data-race in __ip4_datagram_connect / skb_set_owner_w

write to 0xffff88813397920c of 4 bytes by task 30997 on cpu 1:
 sk_set_txhash include/net/sock.h:1937 [inline]
 __ip4_datagram_connect+0x69e/0x710 net/ipv4/datagram.c:75
 __ip6_datagram_connect+0x551/0x840 net/ipv6/datagram.c:189
 ip6_datagram_connect+0x2a/0x40 net/ipv6/datagram.c:272
 inet_dgram_connect+0xfd/0x180 net/ipv4/af_inet.c:580
 __sys_connect_file net/socket.c:1837 [inline]
 __sys_connect+0x245/0x280 net/socket.c:1854
 __do_sys_connect net/socket.c:1864 [inline]
 __se_sys_connect net/socket.c:1861 [inline]
 __x64_sys_connect+0x3d/0x50 net/socket.c:1861
 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff88813397920c of 4 bytes by task 31039 on cpu 0:
 skb_set_hash_from_sk include/net/sock.h:2211 [inline]
 skb_set_owner_w+0x118/0x220 net/core/sock.c:2101
 sock_alloc_send_pskb+0x452/0x4e0 net/core/sock.c:2359
 sock_alloc_send_skb+0x2d/0x40 net/core/sock.c:2373
 __ip6_append_data+0x1743/0x21a0 net/ipv6/ip6_output.c:1621
 ip6_make_skb+0x258/0x420 net/ipv6/ip6_output.c:1983
 udpv6_sendmsg+0x160a/0x16b0 net/ipv6/udp.c:1527
 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:642
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg net/socket.c:674 [inline]
 ____sys_sendmsg+0x360/0x4d0 net/socket.c:2350
 ___sys_sendmsg net/socket.c:2404 [inline]
 __sys_sendmmsg+0x315/0x4b0 net/socket.c:2490
 __do_sys_sendmmsg net/socket.c:2519 [inline]
 __se_sys_sendmmsg net/socket.c:2516 [inline]
 __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2516
 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0xbca3c43d -> 0xfdb309e0

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 31039 Comm: syz-executor.2 Not tainted 5.13.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/sock.h | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/include/net/sock.h b/include/net/sock.h
index c3abc39a2fd6..ac74a2aaa0d6 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1738,7 +1738,8 @@ static inline u32 net_tx_rndhash(void)
 
 static inline void sk_set_txhash(struct sock *sk)
 {
-	sk->sk_txhash = net_tx_rndhash();
+	/* This pairs with READ_ONCE() in skb_set_hash_from_sk() */
+	WRITE_ONCE(sk->sk_txhash, net_tx_rndhash());
 }
 
 static inline void sk_rethink_txhash(struct sock *sk)
@@ -1990,9 +1991,12 @@ static inline void sock_poll_wait(struct file *filp,
 
 static inline void skb_set_hash_from_sk(struct sk_buff *skb, struct sock *sk)
 {
-	if (sk->sk_txhash) {
+	/* This pairs with WRITE_ONCE() in sk_set_txhash() */
+	u32 txhash = READ_ONCE(sk->sk_txhash);
+
+	if (txhash) {
 		skb->l4_hash = 1;
-		skb->hash = sk->sk_txhash;
+		skb->hash = txhash;
 	}
 }
 

From 9ae1430fa57736fb433f147591d400537683ab8f Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Sat, 12 Jun 2021 17:51:22 +0300
Subject: [PATCH 2293/2658] net: caif: fix memory leak in ldisc_open

[ Upstream commit 58af3d3d54e87bfc1f936e16c04ade3369d34011 ]

Syzbot reported memory leak in tty_init_dev().
The problem was in unputted tty in ldisc_open()

static int ldisc_open(struct tty_struct *tty)
{
...
	ser->tty = tty_kref_get(tty);
...
	result = register_netdevice(dev);
	if (result) {
		rtnl_unlock();
		free_netdev(dev);
		return -ENODEV;
	}
...
}

Ser pointer is netdev private_data, so after free_netdev()
this pointer goes away with unputted tty reference. So, fix
it by adding tty_kref_put() before freeing netdev.

Reported-and-tested-by: syzbot+f303e045423e617d2cad@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/caif/caif_serial.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
index 32834dad0b83..1243c2e5a86a 100644
--- a/drivers/net/caif/caif_serial.c
+++ b/drivers/net/caif/caif_serial.c
@@ -362,6 +362,7 @@ static int ldisc_open(struct tty_struct *tty)
 	rtnl_lock();
 	result = register_netdevice(dev);
 	if (result) {
+		tty_kref_put(tty);
 		rtnl_unlock();
 		free_netdev(dev);
 		return -ENODEV;

From 472ef40e53e6f3d85fdd37fbaaf951b753549baa Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Wed, 16 Jun 2021 12:53:03 -0700
Subject: [PATCH 2294/2658] r8152: Avoid memcpy() over-reading of ETH_SS_STATS

[ Upstream commit 99718abdc00e86e4f286dd836408e2834886c16e ]

In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally reading across neighboring array fields.

The memcpy() is copying the entire structure, not just the first array.
Adjust the source argument so the compiler can do appropriate bounds
checking.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/r8152.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 27e9c089b2fc..5baaa8291624 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -3820,7 +3820,7 @@ static void rtl8152_get_strings(struct net_device *dev, u32 stringset, u8 *data)
 {
 	switch (stringset) {
 	case ETH_SS_STATS:
-		memcpy(data, *rtl8152_gstrings, sizeof(rtl8152_gstrings));
+		memcpy(data, rtl8152_gstrings, sizeof(rtl8152_gstrings));
 		break;
 	}
 }

From c1a2c6edfaaccfc7632758500b7796039ca0a379 Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Wed, 16 Jun 2021 12:53:33 -0700
Subject: [PATCH 2295/2658] sh_eth: Avoid memcpy() over-reading of ETH_SS_STATS

[ Upstream commit 224004fbb033600715dbd626bceec10bfd9c58bc ]

In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally reading across neighboring array fields.

The memcpy() is copying the entire structure, not just the first array.
Adjust the source argument so the compiler can do appropriate bounds
checking.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/renesas/sh_eth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 614b83c7ce81..1942264b621b 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -2210,7 +2210,7 @@ static void sh_eth_get_strings(struct net_device *ndev, u32 stringset, u8 *data)
 {
 	switch (stringset) {
 	case ETH_SS_STATS:
-		memcpy(data, *sh_eth_gstrings_stats,
+		memcpy(data, sh_eth_gstrings_stats,
 		       sizeof(sh_eth_gstrings_stats));
 		break;
 	}

From b8b7dbaa28fbb9086831f0440d7cc6c2dd73e84e Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Wed, 16 Jun 2021 12:53:59 -0700
Subject: [PATCH 2296/2658] r8169: Avoid memcpy() over-reading of ETH_SS_STATS

[ Upstream commit da5ac772cfe2a03058b0accfac03fad60c46c24d ]

In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally reading across neighboring array fields.

The memcpy() is copying the entire structure, not just the first array.
Adjust the source argument so the compiler can do appropriate bounds
checking.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/realtek/r8169.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index f3a685d3f649..55b0f11bf2a0 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -2314,7 +2314,7 @@ static void rtl8169_get_strings(struct net_device *dev, u32 stringset, u8 *data)
 {
 	switch(stringset) {
 	case ETH_SS_STATS:
-		memcpy(data, *rtl8169_gstrings, sizeof(rtl8169_gstrings));
+		memcpy(data, rtl8169_gstrings, sizeof(rtl8169_gstrings));
 		break;
 	}
 }

From 50682031cbf0cc5f09aa6289493356760f03b2d3 Mon Sep 17 00:00:00 2001
From: Esben Haabendal <esben@geanix.com>
Date: Fri, 18 Jun 2021 12:52:38 +0200
Subject: [PATCH 2297/2658] net: ll_temac: Avoid ndo_start_xmit returning
 NETDEV_TX_BUSY

[ Upstream commit f6396341194234e9b01cd7538bc2c6ac4501ab14 ]

As documented in Documentation/networking/driver.rst, the ndo_start_xmit
method must not return NETDEV_TX_BUSY under any normal circumstances, and
as recommended, we simply stop the tx queue in advance, when there is a
risk that the next xmit would cause a NETDEV_TX_BUSY return.

Signed-off-by: Esben Haabendal <esben@geanix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/xilinx/ll_temac_main.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
index ed6a88cf3281..98a1c712b62a 100644
--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -735,6 +735,11 @@ temac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 	/* Kick off the transfer */
 	lp->dma_out(lp, TX_TAILDESC_PTR, tail_p); /* DMA start */
 
+	if (temac_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1)) {
+		netdev_info(ndev, "%s -> netif_stop_queue\n", __func__);
+		netif_stop_queue(ndev);
+	}
+
 	return NETDEV_TX_OK;
 }
 

From 08b732631a0a36b5553af42af004b121b8184373 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Thu, 24 Jun 2021 18:39:33 -0700
Subject: [PATCH 2298/2658] nilfs2: fix memory leak in
 nilfs_sysfs_delete_device_group

[ Upstream commit 8fd0c1b0647a6bda4067ee0cd61e8395954b6f28 ]

My local syzbot instance hit memory leak in nilfs2.  The problem was in
missing kobject_put() in nilfs_sysfs_delete_device_group().

kobject_del() does not call kobject_cleanup() for passed kobject and it
leads to leaking duped kobject name if kobject_put() was not called.

Fail log:

  BUG: memory leak
  unreferenced object 0xffff8880596171e0 (size 8):
  comm "syz-executor379", pid 8381, jiffies 4294980258 (age 21.100s)
  hex dump (first 8 bytes):
    6c 6f 6f 70 30 00 00 00                          loop0...
  backtrace:
     kstrdup+0x36/0x70 mm/util.c:60
     kstrdup_const+0x53/0x80 mm/util.c:83
     kvasprintf_const+0x108/0x190 lib/kasprintf.c:48
     kobject_set_name_vargs+0x56/0x150 lib/kobject.c:289
     kobject_add_varg lib/kobject.c:384 [inline]
     kobject_init_and_add+0xc9/0x160 lib/kobject.c:473
     nilfs_sysfs_create_device_group+0x150/0x800 fs/nilfs2/sysfs.c:999
     init_nilfs+0xe26/0x12b0 fs/nilfs2/the_nilfs.c:637

Link: https://lkml.kernel.org/r/20210612140559.20022-1-paskripkin@gmail.com
Fixes: da7141fb78db ("nilfs2: add /sys/fs/nilfs2/<device> group")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Acked-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: Michael L. Semon <mlsemon35@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nilfs2/sysfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index bbb0dcc35905..c3b629eec294 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -1062,6 +1062,7 @@ void nilfs_sysfs_delete_device_group(struct the_nilfs *nilfs)
 	nilfs_sysfs_delete_superblock_group(nilfs);
 	nilfs_sysfs_delete_segctor_group(nilfs);
 	kobject_del(&nilfs->ns_dev_kobj);
+	kobject_put(&nilfs->ns_dev_kobj);
 	kfree(nilfs->ns_dev_subgroups);
 }
 

From 9be6013db2869bdcd7ada0474990ded610c9980e Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 24 May 2021 11:09:12 +0200
Subject: [PATCH 2299/2658] i2c: robotfuzz-osif: fix control-request directions

commit 4ca070ef0dd885616ef294d269a9bf8e3b258e1a upstream.

The direction of the pipe argument must match the request-type direction
bit or control requests may fail depending on the host-controller-driver
implementation.

Control transfers without a data stage are treated as OUT requests by
the USB stack and should be using usb_sndctrlpipe(). Failing to do so
will now trigger a warning.

Fix the OSIFI2C_SET_BIT_RATE and OSIFI2C_STOP requests which erroneously
used the osif_usb_read() helper and set the IN direction bit.

Reported-by: syzbot+9d7dadd15b8819d73f41@syzkaller.appspotmail.com
Fixes: 83e53a8f120f ("i2c: Add bus driver for for OSIF USB i2c device.")
Cc: stable@vger.kernel.org      # 3.14
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/i2c/busses/i2c-robotfuzz-osif.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/i2c/busses/i2c-robotfuzz-osif.c b/drivers/i2c/busses/i2c-robotfuzz-osif.c
index ced9c6a308d1..09f27060feca 100644
--- a/drivers/i2c/busses/i2c-robotfuzz-osif.c
+++ b/drivers/i2c/busses/i2c-robotfuzz-osif.c
@@ -89,7 +89,7 @@ static int osif_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs,
 			}
 		}
 
-		ret = osif_usb_read(adapter, OSIFI2C_STOP, 0, 0, NULL, 0);
+		ret = osif_usb_write(adapter, OSIFI2C_STOP, 0, 0, NULL, 0);
 		if (ret) {
 			dev_err(&adapter->dev, "failure sending STOP\n");
 			return -EREMOTEIO;
@@ -159,7 +159,7 @@ static int osif_probe(struct usb_interface *interface,
 	 * Set bus frequency. The frequency is:
 	 * 120,000,000 / ( 16 + 2 * div * 4^prescale).
 	 * Using dev = 52, prescale = 0 give 100KHz */
-	ret = osif_usb_read(&priv->adapter, OSIFI2C_SET_BIT_RATE, 52, 0,
+	ret = osif_usb_write(&priv->adapter, OSIFI2C_SET_BIT_RATE, 52, 0,
 			    NULL, 0);
 	if (ret) {
 		dev_err(&interface->dev, "failure sending bit rate");

From 473fe3f6b108a3af2a2254b7e63cbd7b096ccf3a Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Wed, 30 Jun 2021 09:24:34 -0400
Subject: [PATCH 2300/2658] Linux 4.4.274

Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 0c6069da5a7f..e4ad9067e3aa 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 273
+SUBLEVEL = 274
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 16ea96bc0b45854a7cb082b5d3c17579ab02168c Mon Sep 17 00:00:00 2001
From: ManYi Li <limanyi@uniontech.com>
Date: Fri, 11 Jun 2021 17:44:02 +0800
Subject: [PATCH 2301/2658] scsi: sr: Return appropriate error code when disk
 is ejected

[ Upstream commit 7dd753ca59d6c8cc09aa1ed24f7657524803c7f3 ]

Handle a reported media event code of 3. This indicates that the media has
been removed from the drive and user intervention is required to proceed.
Return DISK_EVENT_EJECT_REQUEST in that case.

Link: https://lore.kernel.org/r/20210611094402.23884-1-limanyi@uniontech.com
Signed-off-by: ManYi Li <limanyi@uniontech.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/sr.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index 7dd4d9ded249..6e31cedf0b6c 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -216,6 +216,8 @@ static unsigned int sr_get_events(struct scsi_device *sdev)
 		return DISK_EVENT_EJECT_REQUEST;
 	else if (med->media_event_code == 2)
 		return DISK_EVENT_MEDIA_CHANGE;
+	else if (med->media_event_code == 3)
+		return DISK_EVENT_EJECT_REQUEST;
 	return 0;
 }
 

From 9e7275038a4122afcada091b900b0f352b7cd97f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
Date: Fri, 11 Jun 2021 14:34:50 +0200
Subject: [PATCH 2302/2658] drm/nouveau: fix dma_address check for CPU/GPU sync
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit d330099115597bbc238d6758a4930e72b49ea9ba ]

AGP for example doesn't have a dma_address array.

Signed-off-by: Christian König <christian.koenig@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210614110517.1624-1-christian.koenig@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nouveau_bo.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 78f520d05de9..58c310930bf2 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -458,7 +458,7 @@ nouveau_bo_sync_for_device(struct nouveau_bo *nvbo)
 	struct ttm_dma_tt *ttm_dma = (struct ttm_dma_tt *)nvbo->bo.ttm;
 	int i;
 
-	if (!ttm_dma)
+	if (!ttm_dma || !ttm_dma->dma_address)
 		return;
 
 	/* Don't waste time looping if the object is coherent */
@@ -478,7 +478,7 @@ nouveau_bo_sync_for_cpu(struct nouveau_bo *nvbo)
 	struct ttm_dma_tt *ttm_dma = (struct ttm_dma_tt *)nvbo->bo.ttm;
 	int i;
 
-	if (!ttm_dma)
+	if (!ttm_dma || !ttm_dma->dma_address)
 		return;
 
 	/* Don't waste time looping if the object is coherent */

From e62aa971d7a1abc56552076b966518f579f50587 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Wed, 23 Jun 2021 15:09:13 +0200
Subject: [PATCH 2303/2658] xen/events: reset active flag for lateeoi events
 later

commit 3de218ff39b9e3f0d453fe3154f12a174de44b25 upstream.

In order to avoid a race condition for user events when changing
cpu affinity reset the active flag only when EOI-ing the event.

This is working fine as all user events are lateeoi events. Note that
lateeoi_ack_mask_dynirq() is not modified as there is no explicit call
to xen_irq_lateeoi() expected later.

Cc: stable@vger.kernel.org
Reported-by: Julien Grall <julien@xen.org>
Fixes: b6622798bc50b62 ("xen/events: avoid handling the same event on two cpus at the same time")
Tested-by: Julien Grall <julien@xen.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrvsky@oracle.com>
Link: https://lore.kernel.org/r/20210623130913.9405-1-jgross@suse.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/events/events_base.c | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 56bf952de411..f27118923390 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -533,6 +533,9 @@ static void xen_irq_lateeoi_locked(struct irq_info *info, bool spurious)
 	}
 
 	info->eoi_time = 0;
+
+	/* is_active hasn't been reset yet, do it now. */
+	smp_store_release(&info->is_active, 0);
 	do_unmask(info, EVT_MASK_REASON_EOI_PENDING);
 }
 
@@ -1777,10 +1780,22 @@ static void lateeoi_ack_dynirq(struct irq_data *data)
 	struct irq_info *info = info_for_irq(data->irq);
 	evtchn_port_t evtchn = info ? info->evtchn : 0;
 
-	if (VALID_EVTCHN(evtchn)) {
-		do_mask(info, EVT_MASK_REASON_EOI_PENDING);
-		ack_dynirq(data);
-	}
+	if (!VALID_EVTCHN(evtchn))
+		return;
+
+	do_mask(info, EVT_MASK_REASON_EOI_PENDING);
+
+	if (unlikely(irqd_is_setaffinity_pending(data)) &&
+	    likely(!irqd_irq_disabled(data))) {
+		do_mask(info, EVT_MASK_REASON_TEMPORARY);
+
+		clear_evtchn(evtchn);
+
+		irq_move_masked_irq(data);
+
+		do_unmask(info, EVT_MASK_REASON_TEMPORARY);
+	} else
+		clear_evtchn(evtchn);
 }
 
 static void lateeoi_mask_ack_dynirq(struct irq_data *data)

From 2e200f9cb4fced3c2ef113d1c1d181d84ba408d7 Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: Tue, 14 Feb 2017 00:03:38 +0900
Subject: [PATCH 2304/2658] arm: kprobes: Allow to handle reentered kprobe on
 single-stepping

commit f3fbd7ec62dec1528fb8044034e2885f2b257941 upstream.

This is arm port of commit 6a5022a56ac3 ("kprobes/x86: Allow to
handle reentered kprobe on single-stepping")

Since the FIQ handlers can interrupt in the single stepping
(or preparing the single stepping, do_debug etc.), we should
consider a kprobe is hit in the NMI handler. Even in that
case, the kprobe is allowed to be reentered as same as the
kprobes hit in kprobe handlers
(KPROBE_HIT_ACTIVE or KPROBE_HIT_SSDONE).

The real issue will happen when a kprobe hit while another
reentered kprobe is processing (KPROBE_REENTER), because
we already consumed a saved-area for the previous kprobe.

Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Jon Medhurst <tixy@linaro.org>
Fixes: 24ba613c9d6c ("ARM kprobes: core code")
Cc: stable@vger.kernel.org #v2.6.25~v4.11
Signed-off-by: huangshaobo <huangshaobo6@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/probes/kprobes/core.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/arm/probes/kprobes/core.c b/arch/arm/probes/kprobes/core.c
index 3eb018fa1a1f..c3362ddd6c4c 100644
--- a/arch/arm/probes/kprobes/core.c
+++ b/arch/arm/probes/kprobes/core.c
@@ -270,6 +270,7 @@ void __kprobes kprobe_handler(struct pt_regs *regs)
 			switch (kcb->kprobe_status) {
 			case KPROBE_HIT_ACTIVE:
 			case KPROBE_HIT_SSDONE:
+			case KPROBE_HIT_SS:
 				/* A pre- or post-handler probe got us here. */
 				kprobes_inc_nmissed_count(p);
 				save_previous_kprobe(kcb);
@@ -278,6 +279,11 @@ void __kprobes kprobe_handler(struct pt_regs *regs)
 				singlestep(p, regs, kcb);
 				restore_previous_kprobe(kcb);
 				break;
+			case KPROBE_REENTER:
+				/* A nested probe was hit in FIQ, it is a BUG */
+				pr_warn("Unrecoverable kprobe detected at %p.\n",
+					p->addr);
+				/* fall through */
 			default:
 				/* impossible cases */
 				BUG();

From f94cb563dcc8899c4d8c4168fd071860662bac68 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sun, 11 Jul 2021 12:45:27 +0200
Subject: [PATCH 2305/2658] Linux 4.4.275

Link: https://lore.kernel.org/r/20210709131529.395072769@linuxfoundation.org
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index e4ad9067e3aa..875ed3d30ef7 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 274
+SUBLEVEL = 275
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 9b3505ef7c1a465aef7ee4119c1b2690a6898459 Mon Sep 17 00:00:00 2001
From: Daehwan Jung <dh10.jung@samsung.com>
Date: Wed, 16 Jun 2021 18:34:55 +0900
Subject: [PATCH 2306/2658] ALSA: usb-audio: fix rate on Ozone Z90 USB headset

commit aecc19ec404bdc745c781058ac97a373731c3089 upstream.

It mislabels its 96 kHz altsetting and that's why it causes some noise

Signed-off-by: Daehwan Jung <dh10.jung@samsung.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1623836097-61918-1-git-send-email-dh10.jung@samsung.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/format.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/usb/format.c b/sound/usb/format.c
index 5af1fd34e8bd..6e5d33dec07d 100644
--- a/sound/usb/format.c
+++ b/sound/usb/format.c
@@ -221,9 +221,11 @@ static int parse_audio_format_rates_v1(struct snd_usb_audio *chip, struct audiof
 				continue;
 			/* C-Media CM6501 mislabels its 96 kHz altsetting */
 			/* Terratec Aureon 7.1 USB C-Media 6206, too */
+			/* Ozone Z90 USB C-Media, too */
 			if (rate == 48000 && nr_rates == 1 &&
 			    (chip->usb_id == USB_ID(0x0d8c, 0x0201) ||
 			     chip->usb_id == USB_ID(0x0d8c, 0x0102) ||
+			     chip->usb_id == USB_ID(0x0d8c, 0x0078) ||
 			     chip->usb_id == USB_ID(0x0ccd, 0x00b1)) &&
 			    fp->altsetting == 5 && fp->maxpacksize == 392)
 				rate = 96000;

From 92919323e8171767d0caf783b920ff559d305bd8 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Fri, 7 May 2021 14:50:43 +0200
Subject: [PATCH 2307/2658] media: dvb-usb: fix wrong definition

commit c680ed46e418e9c785d76cf44eb33bfd1e8cf3f6 upstream.

syzbot reported WARNING in vmalloc. The problem
was in zero size passed to vmalloc.

The root case was in wrong cxusb_bluebird_lgz201_properties
definition. adapter array has only 1 entry, but num_adapters was
2.

Call Trace:
 __vmalloc_node mm/vmalloc.c:2963 [inline]
 vmalloc+0x67/0x80 mm/vmalloc.c:2996
 dvb_dmx_init+0xe4/0xb90 drivers/media/dvb-core/dvb_demux.c:1251
 dvb_usb_adapter_dvb_init+0x564/0x860 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:184
 dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:86 [inline]
 dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:184 [inline]
 dvb_usb_device_init.cold+0xc94/0x146e drivers/media/usb/dvb-usb/dvb-usb-init.c:308
 cxusb_probe+0x159/0x5e0 drivers/media/usb/dvb-usb/cxusb.c:1634

Fixes: 4d43e13f723e ("V4L/DVB (4643): Multi-input patch for DVB-USB device")
Cc: stable@vger.kernel.org
Reported-by: syzbot+7336195c02c1bd2f64e1@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/dvb-usb/cxusb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
index 72bde33211b2..d2e1c126ad99 100644
--- a/drivers/media/usb/dvb-usb/cxusb.c
+++ b/drivers/media/usb/dvb-usb/cxusb.c
@@ -1789,7 +1789,7 @@ static struct dvb_usb_device_properties cxusb_bluebird_lgz201_properties = {
 
 	.size_of_priv     = sizeof(struct cxusb_state),
 
-	.num_adapters = 2,
+	.num_adapters = 1,
 	.adapter = {
 		{
 		.num_frontends = 1,

From 754cbae64781f59a898d0ac1bbb8a17e2f0163cd Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 24 May 2021 10:02:59 -0700
Subject: [PATCH 2308/2658] Input: usbtouchscreen - fix control-request
 directions

commit 41e81022a04a0294c55cfa7e366bc14b9634c66e upstream.

The direction of the pipe argument must match the request-type direction
bit or control requests may fail depending on the host-controller-driver
implementation.

Fix the four control requests which erroneously used usb_rcvctrlpipe().

Fixes: 1d3e20236d7a ("[PATCH] USB: usbtouchscreen: unified USB touchscreen driver")
Fixes: 24ced062a296 ("usbtouchscreen: add support for DMC TSC-10/25 devices")
Fixes: 9e3b25837a20 ("Input: usbtouchscreen - add support for e2i touchscreen controller")
Signed-off-by: Johan Hovold <johan@kernel.org>
Cc: stable@vger.kernel.org      # 2.6.17
Link: https://lore.kernel.org/r/20210524092048.4443-1-johan@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/touchscreen/usbtouchscreen.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index 499402a975b3..c5d34a782372 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -266,7 +266,7 @@ static int e2i_init(struct usbtouch_usb *usbtouch)
 	int ret;
 	struct usb_device *udev = interface_to_usbdev(usbtouch->interface);
 
-	ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+	ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
 	                      0x01, 0x02, 0x0000, 0x0081,
 	                      NULL, 0, USB_CTRL_SET_TIMEOUT);
 
@@ -462,7 +462,7 @@ static int mtouch_init(struct usbtouch_usb *usbtouch)
 	int ret, i;
 	struct usb_device *udev = interface_to_usbdev(usbtouch->interface);
 
-	ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+	ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
 	                      MTOUCHUSB_RESET,
 	                      USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 	                      1, 0, NULL, 0, USB_CTRL_SET_TIMEOUT);
@@ -474,7 +474,7 @@ static int mtouch_init(struct usbtouch_usb *usbtouch)
 	msleep(150);
 
 	for (i = 0; i < 3; i++) {
-		ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+		ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
 				      MTOUCHUSB_ASYNC_REPORT,
 				      USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 				      1, 1, NULL, 0, USB_CTRL_SET_TIMEOUT);
@@ -645,7 +645,7 @@ static int dmc_tsc10_init(struct usbtouch_usb *usbtouch)
 	}
 
 	/* start sending data */
-	ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0),
+	ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
 	                      TSC10_CMD_DATA1,
 	                      USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 	                      0, 0, NULL, 0, USB_CTRL_SET_TIMEOUT);

From 84eebe1d3d33442148f2d9546a92021987263713 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Thu, 17 Jun 2021 21:51:30 +0300
Subject: [PATCH 2309/2658] net: can: ems_usb: fix use-after-free in
 ems_usb_disconnect()

commit ab4a0b8fcb9a95c02909b62049811bd2e586aaa4 upstream.

In ems_usb_disconnect() dev pointer, which is netdev private data, is
used after free_candev() call:
| 	if (dev) {
| 		unregister_netdev(dev->netdev);
| 		free_candev(dev->netdev);
|
| 		unlink_all_urbs(dev);
|
| 		usb_free_urb(dev->intr_urb);
|
| 		kfree(dev->intr_in_buffer);
| 		kfree(dev->tx_msg_buffer);
| 	}

Fix it by simply moving free_candev() at the end of the block.

Fail log:
| BUG: KASAN: use-after-free in ems_usb_disconnect
| Read of size 8 at addr ffff88804e041008 by task kworker/1:2/2895
|
| CPU: 1 PID: 2895 Comm: kworker/1:2 Not tainted 5.13.0-rc5+ #164
| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a-rebuilt.opensuse.4
| Workqueue: usb_hub_wq hub_event
| Call Trace:
|     dump_stack (lib/dump_stack.c:122)
|     print_address_description.constprop.0.cold (mm/kasan/report.c:234)
|     kasan_report.cold (mm/kasan/report.c:420 mm/kasan/report.c:436)
|     ems_usb_disconnect (drivers/net/can/usb/ems_usb.c:683 drivers/net/can/usb/ems_usb.c:1058)

Fixes: 702171adeed3 ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB interface")
Link: https://lore.kernel.org/r/20210617185130.5834-1-paskripkin@gmail.com
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/usb/ems_usb.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 047348033e27..a6da322e4cdc 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -1071,7 +1071,6 @@ static void ems_usb_disconnect(struct usb_interface *intf)
 
 	if (dev) {
 		unregister_netdev(dev->netdev);
-		free_candev(dev->netdev);
 
 		unlink_all_urbs(dev);
 
@@ -1079,6 +1078,8 @@ static void ems_usb_disconnect(struct usb_interface *intf)
 
 		kfree(dev->intr_in_buffer);
 		kfree(dev->tx_msg_buffer);
+
+		free_candev(dev->netdev);
 	}
 }
 

From c2d611fd1604e2664cf5acc243b927d0ec9c9883 Mon Sep 17 00:00:00 2001
From: Linyu Yuan <linyyuan@codeaurora.com>
Date: Wed, 16 Jun 2021 19:51:42 +0800
Subject: [PATCH 2310/2658] usb: gadget: eem: fix echo command packet response
 issue

commit 4249d6fbc10fd997abdf8a1ea49c0389a0edf706 upstream.

when receive eem echo command, it will send a response,
but queue this response to the usb request which allocate
from gadget device endpoint zero,
and transmit the request to IN endpoint of eem interface.

on dwc3 gadget, it will trigger following warning in function
__dwc3_gadget_ep_queue(),

	if (WARN(req->dep != dep, "request %pK belongs to '%s'\n",
				&req->request, req->dep->name))
		return -EINVAL;

fix it by allocating a usb request from IN endpoint of eem interface,
and transmit the usb request to same IN endpoint of eem interface.

Signed-off-by: Linyu Yuan <linyyuan@codeaurora.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210616115142.34075-1-linyyuan@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/function/f_eem.c | 43 ++++++++++++++++++++++++++---
 1 file changed, 39 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/function/f_eem.c b/drivers/usb/gadget/function/f_eem.c
index 9411c5f953da..536e3f72e355 100644
--- a/drivers/usb/gadget/function/f_eem.c
+++ b/drivers/usb/gadget/function/f_eem.c
@@ -34,6 +34,11 @@ struct f_eem {
 	u8				ctrl_id;
 };
 
+struct in_context {
+	struct sk_buff	*skb;
+	struct usb_ep	*ep;
+};
+
 static inline struct f_eem *func_to_eem(struct usb_function *f)
 {
 	return container_of(f, struct f_eem, port.func);
@@ -327,9 +332,12 @@ static int eem_bind(struct usb_configuration *c, struct usb_function *f)
 
 static void eem_cmd_complete(struct usb_ep *ep, struct usb_request *req)
 {
-	struct sk_buff *skb = (struct sk_buff *)req->context;
+	struct in_context *ctx = req->context;
 
-	dev_kfree_skb_any(skb);
+	dev_kfree_skb_any(ctx->skb);
+	kfree(req->buf);
+	usb_ep_free_request(ctx->ep, req);
+	kfree(ctx);
 }
 
 /*
@@ -413,7 +421,9 @@ static int eem_unwrap(struct gether *port,
 		 * b15:		bmType (0 == data, 1 == command)
 		 */
 		if (header & BIT(15)) {
-			struct usb_request	*req = cdev->req;
+			struct usb_request	*req;
+			struct in_context	*ctx;
+			struct usb_ep		*ep;
 			u16			bmEEMCmd;
 
 			/* EEM command packet format:
@@ -442,11 +452,36 @@ static int eem_unwrap(struct gether *port,
 				skb_trim(skb2, len);
 				put_unaligned_le16(BIT(15) | BIT(11) | len,
 							skb_push(skb2, 2));
+
+				ep = port->in_ep;
+				req = usb_ep_alloc_request(ep, GFP_ATOMIC);
+				if (!req) {
+					dev_kfree_skb_any(skb2);
+					goto next;
+				}
+
+				req->buf = kmalloc(skb2->len, GFP_KERNEL);
+				if (!req->buf) {
+					usb_ep_free_request(ep, req);
+					dev_kfree_skb_any(skb2);
+					goto next;
+				}
+
+				ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
+				if (!ctx) {
+					kfree(req->buf);
+					usb_ep_free_request(ep, req);
+					dev_kfree_skb_any(skb2);
+					goto next;
+				}
+				ctx->skb = skb2;
+				ctx->ep = ep;
+
 				skb_copy_bits(skb2, 0, req->buf, skb2->len);
 				req->length = skb2->len;
 				req->complete = eem_cmd_complete;
 				req->zero = 1;
-				req->context = skb2;
+				req->context = ctx;
 				if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC))
 					DBG(cdev, "echo response queue fail\n");
 				break;

From a522f8844b17f2136a8ca2c4ee22f10454d97fe0 Mon Sep 17 00:00:00 2001
From: Hannu Hartikainen <hannu@hrtk.in>
Date: Tue, 22 Jun 2021 17:14:54 +0300
Subject: [PATCH 2311/2658] USB: cdc-acm: blacklist Heimann USB Appset device

commit 4897807753e078655a78de39ed76044d784f3e63 upstream.

The device (32a7:0000 Heimann Sensor GmbH USB appset demo) claims to be
a CDC-ACM device in its descriptors but in fact is not. If it is run
with echo disabled it returns garbled data, probably due to something
that happens in the TTY layer. And when run with echo enabled (the
default), it will mess up the calibration data of the sensor the first
time any data is sent to the device.

In short, I had a bad time after connecting the sensor and trying to get
it to work. I hope blacklisting it in the cdc-acm driver will save
someone else a bit of trouble.

Signed-off-by: Hannu Hartikainen <hannu@hrtk.in>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210622141454.337948-1-hannu@hrtk.in
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/cdc-acm.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 0478d55bd283..44184cc6585e 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1939,6 +1939,11 @@ static const struct usb_device_id acm_ids[] = {
 	.driver_info = IGNORE_DEVICE,
 	},
 
+	/* Exclude Heimann Sensor GmbH USB appset demo */
+	{ USB_DEVICE(0x32a7, 0x0000),
+	.driver_info = IGNORE_DEVICE,
+	},
+
 	/* control interfaces without any protocol set */
 	{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
 		USB_CDC_PROTO_NONE) },

From 745453a9a4b8882e17e31c4f6e1fd9ab87e005dc Mon Sep 17 00:00:00 2001
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Date: Mon, 28 Jun 2021 19:33:52 -0700
Subject: [PATCH 2312/2658] ntfs: fix validity check for file name attribute

commit d98e4d95411bbde2220a7afa38dcc9c14d71acbe upstream.

When checking the file name attribute, we want to ensure that it fits
within the bounds of ATTR_RECORD.  To do this, we should check that (attr
record + file name offset + file name length) < (attr record + attr record
length).

However, the original check did not include the file name offset in the
calculation.  This means that corrupted on-disk metadata might not caught
by the incorrect file name check, and lead to an invalid memory access.

An example can be seen in the crash report of a memory corruption error
found by Syzbot:
https://syzkaller.appspot.com/bug?id=a1a1e379b225812688566745c3e2f7242bffc246

Adding the file name offset to the validity check fixes this error and
passes the Syzbot reproducer test.

Link: https://lkml.kernel.org/r/20210614050540.289494-1-desmondcheongzx@gmail.com
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reported-by: syzbot+213ac8bb98f7f4420840@syzkaller.appspotmail.com
Tested-by: syzbot+213ac8bb98f7f4420840@syzkaller.appspotmail.com
Acked-by: Anton Altaparmakov <anton@tuxera.com>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ntfs/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index 3af6fa324afa..8d4d58b12972 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -502,7 +502,7 @@ static int ntfs_is_extended_system_file(ntfs_attr_search_ctx *ctx)
 		}
 		file_name_attr = (FILE_NAME_ATTR*)((u8*)attr +
 				le16_to_cpu(attr->data.resident.value_offset));
-		p2 = (u8*)attr + le32_to_cpu(attr->data.resident.value_length);
+		p2 = (u8 *)file_name_attr + le32_to_cpu(attr->data.resident.value_length);
 		if (p2 < (u8*)attr || p2 > p)
 			goto err_corrupt_attr;
 		/* This attribute is ok, but is it in the $Extend directory? */

From cb828a6a004757fa8fa7115d81cd128460bc017f Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Wed, 2 Jun 2021 14:48:21 -0400
Subject: [PATCH 2313/2658] iov_iter_fault_in_readable() should do nothing in
 xarray case

commit 0e8f0d67401589a141950856902c7d0ec8d9c985 upstream.

... and actually should just check it's given an iovec-backed iterator
in the first place.

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/iov_iter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 6d5b9015850d..a7d33a7f956c 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -311,7 +311,7 @@ int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes)
 	int err;
 	struct iovec v;
 
-	if (!(i->type & (ITER_BVEC|ITER_KVEC))) {
+	if (iter_is_iovec(i)) {
 		iterate_iovec(i, bytes, v, iov, skip, ({
 			err = fault_in_multipages_readable(v.iov_base,
 					v.iov_len);

From 5e5faebae8db753f9ba48118bb1e26725224e8ba Mon Sep 17 00:00:00 2001
From: Alexander Larkin <avlarkin82@gmail.com>
Date: Sun, 4 Jul 2021 22:39:36 -0700
Subject: [PATCH 2314/2658] Input: joydev - prevent use of not validated data
 in JSIOCSBTNMAP ioctl

commit f8f84af5da9ee04ef1d271528656dac42a090d00 upstream.

Even though we validate user-provided inputs we then traverse past
validated data when applying the new map. The issue was originally
discovered by Murray McAllister with this simple POC (if the following
is executed by an unprivileged user it will instantly panic the system):

int main(void) {
	int fd, ret;
	unsigned int buffer[10000];

	fd = open("/dev/input/js0", O_RDONLY);
	if (fd == -1)
		printf("Error opening file\n");

	ret = ioctl(fd, JSIOCSBTNMAP & ~IOCSIZE_MASK, &buffer);
	printf("%d\n", ret);
}

The solution is to traverse internal buffer which is guaranteed to only
contain valid date when constructing the map.

Fixes: 182d679b2298 ("Input: joydev - prevent potential read overflow in ioctl")
Fixes: 999b874f4aa3 ("Input: joydev - validate axis/button maps before clobbering current ones")
Reported-by: Murray McAllister <murray.mcallister@gmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Alexander Larkin <avlarkin82@gmail.com>
Link: https://lore.kernel.org/r/20210620120030.1513655-1-avlarkin82@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/joydev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 83dfe19c1b67..1b773ea66772 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -492,7 +492,7 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev,
 	memcpy(joydev->keypam, keypam, len);
 
 	for (i = 0; i < joydev->nkey; i++)
-		joydev->keymap[keypam[i] - BTN_MISC] = i;
+		joydev->keymap[joydev->keypam[i] - BTN_MISC] = i;
 
  out:
 	kfree(keypam);

From 517470fa66d74f6a1cdc590edb1c68709954245f Mon Sep 17 00:00:00 2001
From: Ludovic Desroches <ludovic.desroches@microchip.com>
Date: Fri, 25 Oct 2019 10:42:10 +0200
Subject: [PATCH 2315/2658] ARM: dts: at91: sama5d4: fix pinctrl muxing

commit 253adffb0e98eaf6da2e7cf73ae68695e21f2f3c upstream.

Fix pinctrl muxing, PD28, PD29 and PD31 can be muxed to peripheral A. It
allows to use SCK0, SCK1 and SPI0_NPCS2 signals.

Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Fixes: 679f8d92bb01 ("ARM: at91/dt: sama5d4: add pioD pin mux mask and enable pioD")
Cc: stable@vger.kernel.org # v4.4+
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/20191025084210.14726-1-ludovic.desroches@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/boot/dts/sama5d4.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi
index fb0d1b252dc8..92df0fcf2bf4 100644
--- a/arch/arm/boot/dts/sama5d4.dtsi
+++ b/arch/arm/boot/dts/sama5d4.dtsi
@@ -1363,7 +1363,7 @@
 					0xffffffff 0x3ffcfe7c 0x1c010101	/* pioA */
 					0x7fffffff 0xfffccc3a 0x3f00cc3a	/* pioB */
 					0xffffffff 0x3ff83fff 0xff00ffff	/* pioC */
-					0x0003ff00 0x8002a800 0x00000000	/* pioD */
+					0xb003ff00 0x8002a800 0x00000000	/* pioD */
 					0xffffffff 0x7fffffff 0x76fff1bf	/* pioE */
 					>;
 

From 48e6fec95f1708561ade6cc73724f3a482c2bc0b Mon Sep 17 00:00:00 2001
From: David Sterba <dsterba@suse.com>
Date: Tue, 7 Jul 2020 18:30:06 +0200
Subject: [PATCH 2316/2658] btrfs: clear defrag status of a root if starting
 transaction fails

commit 6819703f5a365c95488b07066a8744841bf14231 upstream.

The defrag loop processes leaves in batches and starting transaction for
each. The whole defragmentation on a given root is protected by a bit
but in case the transaction fails, the bit is not cleared

In case the transaction fails the bit would prevent starting
defragmentation again, so make sure it's cleared.

CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/transaction.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 64e449eb2ecd..f0675b7c95ec 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1264,8 +1264,10 @@ int btrfs_defrag_root(struct btrfs_root *root)
 
 	while (1) {
 		trans = btrfs_start_transaction(root, 0);
-		if (IS_ERR(trans))
-			return PTR_ERR(trans);
+		if (IS_ERR(trans)) {
+			ret = PTR_ERR(trans);
+			break;
+		}
 
 		ret = btrfs_defrag_leaves(trans, root);
 

From 53cead27e403f997a5e3e3387e72823b404b1484 Mon Sep 17 00:00:00 2001
From: Anirudh Rayabharam <mail@anirudhrb.com>
Date: Fri, 7 May 2021 00:26:54 +0530
Subject: [PATCH 2317/2658] ext4: fix kernel infoleak via ext4_extent_header

commit ce3aba43599f0b50adbebff133df8d08a3d5fffe upstream.

Initialize eh_generation of struct ext4_extent_header to prevent leaking
info to userspace. Fixes KMSAN kernel-infoleak bug reported by syzbot at:
http://syzkaller.appspot.com/bug?id=78e9ad0e6952a3ca16e8234724b2fa92d041b9b8

Cc: stable@kernel.org
Reported-by: syzbot+2dcfeaf8cb49b05e8f1a@syzkaller.appspotmail.com
Fixes: a86c61812637 ("[PATCH] ext3: add extent map support")
Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com>
Link: https://lore.kernel.org/r/20210506185655.7118-1-mail@anirudhrb.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/extents.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 50f98d6a4416..07ae78ba27a1 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -865,6 +865,7 @@ int ext4_ext_tree_init(handle_t *handle, struct inode *inode)
 	eh->eh_entries = 0;
 	eh->eh_magic = EXT4_EXT_MAGIC;
 	eh->eh_max = cpu_to_le16(ext4_ext_space_root(inode, 0));
+	eh->eh_generation = 0;
 	ext4_mark_inode_dirty(handle, inode);
 	return 0;
 }
@@ -1128,6 +1129,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
 	neh->eh_max = cpu_to_le16(ext4_ext_space_block(inode, 0));
 	neh->eh_magic = EXT4_EXT_MAGIC;
 	neh->eh_depth = 0;
+	neh->eh_generation = 0;
 
 	/* move remainder of path[depth] to the new leaf */
 	if (unlikely(path[depth].p_hdr->eh_entries !=
@@ -1205,6 +1207,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
 		neh->eh_magic = EXT4_EXT_MAGIC;
 		neh->eh_max = cpu_to_le16(ext4_ext_space_block_idx(inode, 0));
 		neh->eh_depth = cpu_to_le16(depth - i);
+		neh->eh_generation = 0;
 		fidx = EXT_FIRST_INDEX(neh);
 		fidx->ei_block = border;
 		ext4_idx_store_pblock(fidx, oldblock);

From 3958ac9d440300a4967bb69a856446f78d5a93cc Mon Sep 17 00:00:00 2001
From: Zhang Yi <yi.zhang@huawei.com>
Date: Sat, 22 May 2021 18:30:45 +0800
Subject: [PATCH 2318/2658] ext4: correct the cache_nr in tracepoint
 ext4_es_shrink_exit

commit 4fb7c70a889ead2e91e184895ac6e5354b759135 upstream.

The cache_cnt parameter of tracepoint ext4_es_shrink_exit means the
remaining cache count after shrink, but now it is the cache count before
shrink, fix it by read sbi->s_extent_cache_cnt again.

Fixes: 1ab6c4997e04 ("fs: convert fs shrinkers to new scan/count API")
Cc: stable@vger.kernel.org # 3.12+
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20210522103045.690103-3-yi.zhang@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/extents_status.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
index ac748b3af1c1..4989d8653193 100644
--- a/fs/ext4/extents_status.c
+++ b/fs/ext4/extents_status.c
@@ -1085,6 +1085,7 @@ static unsigned long ext4_es_scan(struct shrinker *shrink,
 
 	nr_shrunk = __es_shrink(sbi, nr_to_scan, NULL);
 
+	ret = percpu_counter_read_positive(&sbi->s_es_stats.es_stats_shk_cnt);
 	trace_ext4_es_shrink_scan_exit(sbi->s_sb, nr_shrunk, ret);
 	return nr_shrunk;
 }

From 712c2d0de831949c51224f027f78b6b498930546 Mon Sep 17 00:00:00 2001
From: Zhang Yi <yi.zhang@huawei.com>
Date: Sat, 22 May 2021 18:30:44 +0800
Subject: [PATCH 2319/2658] ext4: remove check for zero nr_to_scan in
 ext4_es_scan()

commit e5e7010e5444d923e4091cafff61d05f2d19cada upstream.

After converting fs shrinkers to new scan/count API, we are no longer
pass zero nr_to_scan parameter to detect the number of objects to free,
just remove this check.

Fixes: 1ab6c4997e04 ("fs: convert fs shrinkers to new scan/count API")
Cc: stable@vger.kernel.org # 3.12+
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20210522103045.690103-2-yi.zhang@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/extents_status.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
index 4989d8653193..665cf30c95e9 100644
--- a/fs/ext4/extents_status.c
+++ b/fs/ext4/extents_status.c
@@ -1080,9 +1080,6 @@ static unsigned long ext4_es_scan(struct shrinker *shrink,
 	ret = percpu_counter_read_positive(&sbi->s_es_stats.es_stats_shk_cnt);
 	trace_ext4_es_shrink_scan_enter(sbi->s_sb, nr_to_scan, ret);
 
-	if (!nr_to_scan)
-		return ret;
-
 	nr_shrunk = __es_shrink(sbi, nr_to_scan, NULL);
 
 	ret = percpu_counter_read_positive(&sbi->s_es_stats.es_stats_shk_cnt);

From 7480c2e95ff8033120d244a3faae311ac38de638 Mon Sep 17 00:00:00 2001
From: Pan Dong <pandong.peter@bytedance.com>
Date: Tue, 25 May 2021 15:36:56 +0800
Subject: [PATCH 2320/2658] ext4: fix avefreec in find_group_orlov

commit c89849cc0259f3d33624cc3bd127685c3c0fa25d upstream.

The avefreec should be average free clusters instead
of average free blocks, otherwize Orlov's allocator
will not work properly when bigalloc enabled.

Cc: stable@kernel.org
Signed-off-by: Pan Dong <pandong.peter@bytedance.com>
Link: https://lore.kernel.org/r/20210525073656.31594-1-pandong.peter@bytedance.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/ialloc.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index 39e8f0a1512d..de4d8e88024a 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -402,7 +402,7 @@ static void get_orlov_stats(struct super_block *sb, ext4_group_t g,
  *
  * We always try to spread first-level directories.
  *
- * If there are blockgroups with both free inodes and free blocks counts
+ * If there are blockgroups with both free inodes and free clusters counts
  * not worse than average we return one with smallest directory count.
  * Otherwise we simply return a random group.
  *
@@ -411,7 +411,7 @@ static void get_orlov_stats(struct super_block *sb, ext4_group_t g,
  * It's OK to put directory into a group unless
  * it has too many directories already (max_dirs) or
  * it has too few free inodes left (min_inodes) or
- * it has too few free blocks left (min_blocks) or
+ * it has too few free clusters left (min_clusters) or
  * Parent's group is preferred, if it doesn't satisfy these
  * conditions we search cyclically through the rest. If none
  * of the groups look good we just look for a group with more
@@ -427,7 +427,7 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent,
 	ext4_group_t real_ngroups = ext4_get_groups_count(sb);
 	int inodes_per_group = EXT4_INODES_PER_GROUP(sb);
 	unsigned int freei, avefreei, grp_free;
-	ext4_fsblk_t freeb, avefreec;
+	ext4_fsblk_t freec, avefreec;
 	unsigned int ndirs;
 	int max_dirs, min_inodes;
 	ext4_grpblk_t min_clusters;
@@ -446,9 +446,8 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent,
 
 	freei = percpu_counter_read_positive(&sbi->s_freeinodes_counter);
 	avefreei = freei / ngroups;
-	freeb = EXT4_C2B(sbi,
-		percpu_counter_read_positive(&sbi->s_freeclusters_counter));
-	avefreec = freeb;
+	freec = percpu_counter_read_positive(&sbi->s_freeclusters_counter);
+	avefreec = freec;
 	do_div(avefreec, ngroups);
 	ndirs = percpu_counter_read_positive(&sbi->s_dirs_counter);
 

From c055dad21a0fe5b3021a8ff8dfcb0bfe476ea0cb Mon Sep 17 00:00:00 2001
From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Date: Sat, 26 Jun 2021 15:50:41 +0800
Subject: [PATCH 2321/2658] SUNRPC: Fix the batch tasks count wraparound.

commit fcb170a9d825d7db4a3fb870b0300f5a40a8d096 upstream.

The 'queue->nr' will wraparound from 0 to 255 when only current
priority queue has tasks. This maybe lead a deadlock same as commit
dfe1fe75e00e ("NFSv4: Fix deadlock between nfs4_evict_inode()
and nfs4_opendata_get_inode()"):

Privileged delegreturn task is queued to privileged list because all
the slots are assigned. When non-privileged task complete and release
the slot, a non-privileged maybe picked out. It maybe allocate slot
failed when the session on draining.

If the 'queue->nr' has wraparound to 255, and no enough slot to
service it, then the privileged delegreturn will lost to wake up.

So we should avoid the wraparound on 'queue->nr'.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 5fcdfacc01f3 ("NFSv4: Return delegations synchronously in evict_inode")
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/sched.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 3eed71a2ff2b..2e61bc3c65f0 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -476,7 +476,8 @@ static struct rpc_task *__rpc_find_next_queued_priority(struct rpc_wait_queue *q
 	 * Service a batch of tasks from a single owner.
 	 */
 	q = &queue->tasks[queue->priority];
-	if (!list_empty(q) && --queue->nr) {
+	if (!list_empty(q) && queue->nr) {
+		queue->nr--;
 		task = list_first_entry(q, struct rpc_task, u.tk_wait.list);
 		goto out;
 	}

From 42d4a64a3bf7592deca1fe81aad1df9e64368441 Mon Sep 17 00:00:00 2001
From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Date: Sat, 26 Jun 2021 15:50:42 +0800
Subject: [PATCH 2322/2658] SUNRPC: Should wake up the privileged task firstly.

commit 5483b904bf336948826594610af4c9bbb0d9e3aa upstream.

When find a task from wait queue to wake up, a non-privileged task may
be found out, rather than the privileged. This maybe lead a deadlock
same as commit dfe1fe75e00e ("NFSv4: Fix deadlock between nfs4_evict_inode()
and nfs4_opendata_get_inode()"):

Privileged delegreturn task is queued to privileged list because all
the slots are assigned. If there has no enough slot to wake up the
non-privileged batch tasks(session less than 8 slot), then the privileged
delegreturn task maybe lost waked up because the found out task can't
get slot since the session is on draining.

So we should treate the privileged task as the emergency task, and
execute it as for as we can.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 5fcdfacc01f3 ("NFSv4: Return delegations synchronously in evict_inode")
Cc: stable@vger.kernel.org
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/sched.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 2e61bc3c65f0..737556204566 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -472,6 +472,15 @@ static struct rpc_task *__rpc_find_next_queued_priority(struct rpc_wait_queue *q
 	struct list_head *q;
 	struct rpc_task *task;
 
+	/*
+	 * Service the privileged queue.
+	 */
+	q = &queue->tasks[RPC_NR_PRIORITY - 1];
+	if (queue->maxpriority > RPC_PRIORITY_PRIVILEGED && !list_empty(q)) {
+		task = list_first_entry(q, struct rpc_task, u.tk_wait.list);
+		goto out;
+	}
+
 	/*
 	 * Service a batch of tasks from a single owner.
 	 */

From 714c105ca34f808f6ae4d6535b1f268bdd817192 Mon Sep 17 00:00:00 2001
From: Vineeth Vijayan <vneethv@linux.ibm.com>
Date: Wed, 9 Jun 2021 09:21:08 +0200
Subject: [PATCH 2323/2658] s390/cio: dont call css_wait_for_slow_path() inside
 a lock

commit c749d8c018daf5fba6dfac7b6c5c78b27efd7d65 upstream.

Currently css_wait_for_slow_path() gets called inside the chp->lock.
The path-verification-loop of slowpath inside this lock could lead to
deadlock as reported by the lockdep validator.

The ccw_device_get_chp_desc() during the instance of a device-set-online
would try to acquire the same 'chp->lock' to read the chp->desc.
The instance of this function can get called from multiple scenario,
like probing or setting-device online manually. This could, in some
corner-cases lead to the deadlock.

lockdep validator reported this as,

        CPU0                    CPU1
        ----                    ----
   lock(&chp->lock);
                                lock(kn->active#43);
                                lock(&chp->lock);
   lock((wq_completion)cio);

The chp->lock was introduced to serialize the access of struct
channel_path. This lock is not needed for the css_wait_for_slow_path()
function, so invoke the slow-path function outside this lock.

Fixes: b730f3a93395 ("[S390] cio: add lock to struct channel_path")
Cc: <stable@vger.kernel.org>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/s390/cio/chp.c  | 3 +++
 drivers/s390/cio/chsc.c | 2 --
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/s390/cio/chp.c b/drivers/s390/cio/chp.c
index 50597f9522fe..151c8df394a8 100644
--- a/drivers/s390/cio/chp.c
+++ b/drivers/s390/cio/chp.c
@@ -257,6 +257,9 @@ static ssize_t chp_status_write(struct device *dev,
 	if (!num_args)
 		return count;
 
+	/* Wait until previous actions have settled. */
+	css_wait_for_slow_path();
+
 	if (!strncasecmp(cmd, "on", 2) || !strcmp(cmd, "1")) {
 		mutex_lock(&cp->lock);
 		error = s390_vary_chpid(cp->chpid, 1);
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index f9d6a9f00640..276b2034cbda 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -769,8 +769,6 @@ int chsc_chp_vary(struct chp_id chpid, int on)
 {
 	struct channel_path *chp = chpid_to_chp(chpid);
 
-	/* Wait until previous actions have settled. */
-	css_wait_for_slow_path();
 	/*
 	 * Redo PathVerification on the devices the chpid connects to
 	 */

From b951c4cf3e2adf96d08af2f1dcaf4069e4ef93b9 Mon Sep 17 00:00:00 2001
From: Marc Kleine-Budde <mkl@pengutronix.de>
Date: Thu, 10 Jun 2021 15:46:16 +0200
Subject: [PATCH 2324/2658] iio: ltr501: mark register holding upper 8 bits of
 ALS_DATA{0,1} and PS_DATA as volatile, too

commit 2ac0b029a04b673ce83b5089368f467c5dca720c upstream.

The regmap is configured for 8 bit registers, uses a RB-Tree cache and
marks several registers as volatile (i.e. do not cache).

The ALS and PS data registers in the chip are 16 bit wide and spans
two regmap registers. In the current driver only the base register is
marked as volatile, resulting in the upper register only read once.

Further the data sheet notes:

| When the I2C read operation starts, all four ALS data registers are
| locked until the I2C read operation of register 0x8B is completed.

Which results in the registers never update after the 2nd read.

This patch fixes the problem by marking the upper 8 bits of the ALS
and PS registers as volatile, too.

Fixes: 2f2c96338afc ("iio: ltr501: Add regmap support.")
Reported-by: Oliver Lang <Oliver.Lang@gossenmetrawatt.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Tested-by: Nikita Travkin <nikita@trvn.ru> # ltr559
Link: https://lore.kernel.org/r/20210610134619.2101372-2-mkl@pengutronix.de
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/light/ltr501.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
index 9f5825f4fc0e..2129a2b0b870 100644
--- a/drivers/iio/light/ltr501.c
+++ b/drivers/iio/light/ltr501.c
@@ -35,9 +35,12 @@
 #define LTR501_PART_ID 0x86
 #define LTR501_MANUFAC_ID 0x87
 #define LTR501_ALS_DATA1 0x88 /* 16-bit, little endian */
+#define LTR501_ALS_DATA1_UPPER 0x89 /* upper 8 bits of LTR501_ALS_DATA1 */
 #define LTR501_ALS_DATA0 0x8a /* 16-bit, little endian */
+#define LTR501_ALS_DATA0_UPPER 0x8b /* upper 8 bits of LTR501_ALS_DATA0 */
 #define LTR501_ALS_PS_STATUS 0x8c
 #define LTR501_PS_DATA 0x8d /* 16-bit, little endian */
+#define LTR501_PS_DATA_UPPER 0x8e /* upper 8 bits of LTR501_PS_DATA */
 #define LTR501_INTR 0x8f /* output mode, polarity, mode */
 #define LTR501_PS_THRESH_UP 0x90 /* 11 bit, ps upper threshold */
 #define LTR501_PS_THRESH_LOW 0x92 /* 11 bit, ps lower threshold */
@@ -1328,9 +1331,12 @@ static bool ltr501_is_volatile_reg(struct device *dev, unsigned int reg)
 {
 	switch (reg) {
 	case LTR501_ALS_DATA1:
+	case LTR501_ALS_DATA1_UPPER:
 	case LTR501_ALS_DATA0:
+	case LTR501_ALS_DATA0_UPPER:
 	case LTR501_ALS_PS_STATUS:
 	case LTR501_PS_DATA:
+	case LTR501_PS_DATA_UPPER:
 		return true;
 	default:
 		return false;

From 1e46bea8ce47834b31140d035f36169aa0e235a4 Mon Sep 17 00:00:00 2001
From: Oliver Lang <Oliver.Lang@gossenmetrawatt.com>
Date: Thu, 10 Jun 2021 15:46:17 +0200
Subject: [PATCH 2325/2658] iio: ltr501: ltr559: fix initialization of
 LTR501_ALS_CONTR

commit 421a26f3d7a7c3ca43f3a9dc0f3cb0f562d5bd95 upstream.

The ltr559 chip uses only the lowest bit of the ALS_CONTR register to
configure between active and stand-by mode. In the original driver
BIT(1) is used, which does a software reset instead.

This patch fixes the problem by using BIT(0) as als_mode_active for
the ltr559 chip.

Fixes: 8592a7eefa54 ("iio: ltr501: Add support for ltr559 chip")
Signed-off-by: Oliver Lang <Oliver.Lang@gossenmetrawatt.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Tested-by: Nikita Travkin <nikita@trvn.ru> # ltr559
Link: https://lore.kernel.org/r/20210610134619.2101372-3-mkl@pengutronix.de
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/light/ltr501.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
index 2129a2b0b870..da9c7cbca89f 100644
--- a/drivers/iio/light/ltr501.c
+++ b/drivers/iio/light/ltr501.c
@@ -1183,7 +1183,7 @@ static struct ltr501_chip_info ltr501_chip_info_tbl[] = {
 		.als_gain_tbl_size = ARRAY_SIZE(ltr559_als_gain_tbl),
 		.ps_gain = ltr559_ps_gain_tbl,
 		.ps_gain_tbl_size = ARRAY_SIZE(ltr559_ps_gain_tbl),
-		.als_mode_active = BIT(1),
+		.als_mode_active = BIT(0),
 		.als_gain_mask = BIT(2) | BIT(3) | BIT(4),
 		.als_gain_shift = 2,
 		.info = &ltr501_info,

From 3db1d4918a8763b50b1ad29a4e59a294276b37e4 Mon Sep 17 00:00:00 2001
From: Oliver Lang <Oliver.Lang@gossenmetrawatt.com>
Date: Thu, 10 Jun 2021 15:46:18 +0200
Subject: [PATCH 2326/2658] iio: ltr501: ltr501_read_ps(): add missing
 endianness conversion

commit 71b33f6f93ef9462c84560e2236ed22209d26a58 upstream.

The PS ADC Channel data is spread over 2 registers in little-endian
form. This patch adds the missing endianness conversion.

Fixes: 2690be905123 ("iio: Add Lite-On ltr501 ambient light / proximity sensor driver")
Signed-off-by: Oliver Lang <Oliver.Lang@gossenmetrawatt.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Tested-by: Nikita Travkin <nikita@trvn.ru> # ltr559
Link: https://lore.kernel.org/r/20210610134619.2101372-4-mkl@pengutronix.de
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/light/ltr501.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
index da9c7cbca89f..111552b336fe 100644
--- a/drivers/iio/light/ltr501.c
+++ b/drivers/iio/light/ltr501.c
@@ -411,18 +411,19 @@ static int ltr501_read_als(struct ltr501_data *data, __le16 buf[2])
 
 static int ltr501_read_ps(struct ltr501_data *data)
 {
-	int ret, status;
+	__le16 status;
+	int ret;
 
 	ret = ltr501_drdy(data, LTR501_STATUS_PS_RDY);
 	if (ret < 0)
 		return ret;
 
 	ret = regmap_bulk_read(data->regmap, LTR501_PS_DATA,
-			       &status, 2);
+			       &status, sizeof(status));
 	if (ret < 0)
 		return ret;
 
-	return status;
+	return le16_to_cpu(status);
 }
 
 static int ltr501_read_intr_prst(struct ltr501_data *data,

From cefa7e790b0814dfb5fdb2dbe71d21ef4d52718d Mon Sep 17 00:00:00 2001
From: Ondrej Zary <linux@zary.sk>
Date: Fri, 11 Jun 2021 22:19:40 +0200
Subject: [PATCH 2327/2658] serial_cs: Add Option International GSM-Ready
 56K/ISDN modem

commit d495dd743d5ecd47288156e25c4d9163294a0992 upstream.

Add support for Option International GSM-Ready 56K/ISDN PCMCIA modem
card.

Signed-off-by: Ondrej Zary <linux@zary.sk>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210611201940.23898-2-linux@zary.sk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/serial_cs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/tty/serial/8250/serial_cs.c b/drivers/tty/serial/8250/serial_cs.c
index 1a14948c86d6..bf5feb2ea35a 100644
--- a/drivers/tty/serial/8250/serial_cs.c
+++ b/drivers/tty/serial/8250/serial_cs.c
@@ -771,6 +771,7 @@ static const struct pcmcia_device_id serial_ids[] = {
 	PCMCIA_DEVICE_PROD_ID12("Multi-Tech", "MT2834LT", 0x5f73be51, 0x4cd7c09e),
 	PCMCIA_DEVICE_PROD_ID12("OEM      ", "C288MX     ", 0xb572d360, 0xd2385b7a),
 	PCMCIA_DEVICE_PROD_ID12("Option International", "V34bis GSM/PSTN Data/Fax Modem", 0x9d7cd6f5, 0x5cb8bf41),
+	PCMCIA_DEVICE_PROD_ID12("Option International", "GSM-Ready 56K/ISDN", 0x9d7cd6f5, 0xb23844aa),
 	PCMCIA_DEVICE_PROD_ID12("PCMCIA   ", "C336MX     ", 0x99bcafe9, 0xaa25bcab),
 	PCMCIA_DEVICE_PROD_ID12("Quatech Inc", "PCMCIA Dual RS-232 Serial Port Card", 0xc4420b35, 0x92abc92f),
 	PCMCIA_DEVICE_PROD_ID12("Quatech Inc", "Dual RS-232 Serial Port PC Card", 0xc4420b35, 0x031a380d),

From dd4c89122390f0045b87ba63d35da629133390c5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Mon, 31 May 2021 17:41:27 +0300
Subject: [PATCH 2328/2658] ath9k: Fix kernel NULL pointer dereference during
 ath_reset_internal()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit fb312ac5ccb007e843f982b38d4d6886ba4b32f2 upstream.

I got this crash more times during debugging of PCIe controller and crash
happens somehow at the time when PCIe kernel code started link retraining (as
part of ASPM code) when at the same time PCIe link went down and ath9k probably
executed hw reset procedure.

Currently I'm not able to reproduce this issue as it looks like to be
some race condition between link training, ASPM, link down and reset
path. And as always, race conditions which depends on more input
parameters are hard to reproduce as it depends on precise timings.

But it is clear that pointers are zero in this case and should be
properly filled as same code pattern is used in ath9k_stop() function.
Anyway I was able to reproduce this crash by manually triggering ath
reset worker prior putting card up. I created simple patch to export
reset functionality via debugfs and use it to "simulate" of triggering
reset.    s proved that NULL-pointer dereference issue is there.

Function ath9k_hw_reset() is dereferencing chan structure pointer, so it
needs to be non-NULL pointer.

Function ath9k_stop() already contains code which sets ah->curchan to valid
non-NULL pointer prior calling ath9k_hw_reset() function.

Add same code pattern also into ath_reset_internal() function to prevent
kernel NULL pointer dereference in ath9k_hw_reset() function.

This change fixes kernel NULL pointer dereference in ath9k_hw_reset() which
is caused by calling ath9k_hw_reset() from ath_reset_internal() with NULL
chan structure.

    [   45.334305] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
    [   45.344417] Mem abort info:
    [   45.347301]   ESR = 0x96000005
    [   45.350448]   EC = 0x25: DABT (current EL), IL = 32 bits
    [   45.356166]   SET = 0, FnV = 0
    [   45.359350]   EA = 0, S1PTW = 0
    [   45.362596] Data abort info:
    [   45.365756]   ISV = 0, ISS = 0x00000005
    [   45.369735]   CM = 0, WnR = 0
    [   45.372814] user pgtable: 4k pages, 39-bit VAs, pgdp=000000000685d000
    [   45.379663] [0000000000000008] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
    [   45.388856] Internal error: Oops: 96000005 [#1] SMP
    [   45.393897] Modules linked in: ath9k ath9k_common ath9k_hw
    [   45.399574] CPU: 1 PID: 309 Comm: kworker/u4:2 Not tainted 5.12.0-rc2-dirty #785
    [   45.414746] Workqueue: phy0 ath_reset_work [ath9k]
    [   45.419713] pstate: 40000005 (nZcv daif -PAN -UAO -TCO BTYPE=--)
    [   45.425910] pc : ath9k_hw_reset+0xc4/0x1c48 [ath9k_hw]
    [   45.431234] lr : ath9k_hw_reset+0xc0/0x1c48 [ath9k_hw]
    [   45.436548] sp : ffffffc0118dbca0
    [   45.439961] x29: ffffffc0118dbca0 x28: 0000000000000000
    [   45.445442] x27: ffffff800dee4080 x26: 0000000000000000
    [   45.450923] x25: ffffff800df9b9d8 x24: 0000000000000000
    [   45.456404] x23: ffffffc0115f6000 x22: ffffffc008d0d408
    [   45.461885] x21: ffffff800dee5080 x20: ffffff800df9b9d8
    [   45.467366] x19: 0000000000000000 x18: 0000000000000000
    [   45.472846] x17: 0000000000000000 x16: 0000000000000000
    [   45.478326] x15: 0000000000000010 x14: ffffffffffffffff
    [   45.483807] x13: ffffffc0918db94f x12: ffffffc011498720
    [   45.489289] x11: 0000000000000003 x10: ffffffc0114806e0
    [   45.494770] x9 : ffffffc01014b2ec x8 : 0000000000017fe8
    [   45.500251] x7 : c0000000ffffefff x6 : 0000000000000001
    [   45.505733] x5 : 0000000000000000 x4 : 0000000000000000
    [   45.511213] x3 : 0000000000000000 x2 : ffffff801fece870
    [   45.516693] x1 : ffffffc00eded000 x0 : 000000000000003f
    [   45.522174] Call trace:
    [   45.524695]  ath9k_hw_reset+0xc4/0x1c48 [ath9k_hw]
    [   45.529653]  ath_reset_internal+0x1a8/0x2b8 [ath9k]
    [   45.534696]  ath_reset_work+0x2c/0x40 [ath9k]
    [   45.539198]  process_one_work+0x210/0x480
    [   45.543339]  worker_thread+0x5c/0x510
    [   45.547115]  kthread+0x12c/0x130
    [   45.550445]  ret_from_fork+0x10/0x1c
    [   45.554138] Code: 910922c2 9117e021 95ff0398 b4000294 (b9400a61)
    [   45.560430] ---[ end trace 566410ba90b50e8b ]---
    [   45.565193] Kernel panic - not syncing: Oops: Fatal exception in interrupt
    [   45.572282] SMP: stopping secondary CPUs
    [   45.576331] Kernel Offset: disabled
    [   45.579924] CPU features: 0x00040002,0000200c
    [   45.584416] Memory Limit: none
    [   45.587564] Rebooting in 3 seconds..

Signed-off-by: Pali Rohár <pali@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210402122653.24014-1-pali@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath9k/main.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index e153a94d0057..f09168a885a5 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -302,6 +302,11 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
 		hchan = ah->curchan;
 	}
 
+	if (!hchan) {
+		fastcc = false;
+		hchan = ath9k_cmn_get_channel(sc->hw, ah, &sc->cur_chan->chandef);
+	}
+
 	if (!ath_prepare_reset(sc))
 		fastcc = false;
 

From eb418bebefcc7a7f73cbd8587e8939db14b1f447 Mon Sep 17 00:00:00 2001
From: Michael Buesch <m@bues.ch>
Date: Sat, 15 May 2021 21:02:52 +0200
Subject: [PATCH 2329/2658] ssb: sdio: Don't overwrite const buffer if
 block_write fails
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 47ec636f7a25aa2549e198c48ecb6b1c25d05456 upstream.

It doesn't make sense to clobber the const driver-side buffer, if a
write-to-device attempt failed. All other SSB variants (PCI, PCMCIA and SoC)
also don't corrupt the buffer on any failure in block_write.
Therefore, remove this memset from the SDIO variant.

Signed-off-by: Michael Büsch <m@bues.ch>
Cc: stable@vger.kernel.org
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210515210252.318be2ba@wiggum
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ssb/sdio.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/ssb/sdio.c b/drivers/ssb/sdio.c
index 2278e43614bd..5e10514ef80c 100644
--- a/drivers/ssb/sdio.c
+++ b/drivers/ssb/sdio.c
@@ -411,7 +411,6 @@ static void ssb_sdio_block_write(struct ssb_device *dev, const void *buffer,
 	sdio_claim_host(bus->host_sdio);
 	if (unlikely(ssb_sdio_switch_core(bus, dev))) {
 		error = -EIO;
-		memset((void *)buffer, 0xff, count);
 		goto err_out;
 	}
 	offset |= bus->sdio_sbaddr & 0xffff;

From d4f56ab0e9b51aa049a0591fef70b30079be18fa Mon Sep 17 00:00:00 2001
From: Yun Zhou <yun.zhou@windriver.com>
Date: Sat, 26 Jun 2021 11:21:56 +0800
Subject: [PATCH 2330/2658] seq_buf: Make trace_seq_putmem_hex() support data
 longer than 8

commit 6a2cbc58d6c9d90cd74288cc497c2b45815bc064 upstream.

Since the raw memory 'data' does not go forward, it will dump repeated
data if the data length is more than 8. If we want to dump longer data
blocks, we need to repeatedly call macro SEQ_PUT_HEX_FIELD. I think it
is a bit redundant, and multiple function calls also affect the performance.

Link: https://lore.kernel.org/lkml/20210625122453.5e2fe304@oasis.local.home/
Link: https://lkml.kernel.org/r/20210626032156.47889-2-yun.zhou@windriver.com

Cc: stable@vger.kernel.org
Fixes: 6d2289f3faa7 ("tracing: Make trace_seq_putmem_hex() more robust")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/seq_buf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/seq_buf.c b/lib/seq_buf.c
index cbef5ee4c459..24b2823b8f2b 100644
--- a/lib/seq_buf.c
+++ b/lib/seq_buf.c
@@ -241,12 +241,14 @@ int seq_buf_putmem_hex(struct seq_buf *s, const void *mem,
 			break;
 
 		/* j increments twice per loop */
-		len -= j / 2;
 		hex[j++] = ' ';
 
 		seq_buf_putmem(s, hex, j);
 		if (seq_buf_has_overflowed(s))
 			return -1;
+
+		len -= start_len;
+		data += start_len;
 	}
 	return 0;
 }

From dd4a6c3d24732064d504b7ca5c4a792487299ec2 Mon Sep 17 00:00:00 2001
From: Miklos Szeredi <mszeredi@redhat.com>
Date: Tue, 22 Jun 2021 09:15:35 +0200
Subject: [PATCH 2331/2658] fuse: check connected before queueing on fpq->io

commit 80ef08670d4c28a06a3de954bd350368780bcfef upstream.

A request could end up on the fpq->io list after fuse_abort_conn() has
reset fpq->connected and aborted requests on that list:

Thread-1			  Thread-2
========			  ========
->fuse_simple_request()           ->shutdown
  ->__fuse_request_send()
    ->queue_request()		->fuse_abort_conn()
->fuse_dev_do_read()                ->acquire(fpq->lock)
  ->wait_for(fpq->lock) 	  ->set err to all req's in fpq->io
				  ->release(fpq->lock)
  ->acquire(fpq->lock)
  ->add req to fpq->io

After the userspace copy is done the request will be ended, but
req->out.h.error will remain uninitialized.  Also the copy might block
despite being already aborted.

Fix both issues by not allowing the request to be queued on the fpq->io
list after fuse_abort_conn() has processed this list.

Reported-by: Pradeep P V K <pragalla@codeaurora.org>
Fixes: fd22d62ed0c3 ("fuse: no fc->lock for iqueue parts")
Cc: <stable@vger.kernel.org> # v4.2
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/fuse/dev.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index f78179db7256..9e8d0efbe6e8 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1325,6 +1325,15 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
 		goto restart;
 	}
 	spin_lock(&fpq->lock);
+	/*
+	 *  Must not put request on fpq->io queue after having been shut down by
+	 *  fuse_abort_conn()
+	 */
+	if (!fpq->connected) {
+		req->out.h.error = err = -ECONNABORTED;
+		goto out_end;
+
+	}
 	list_add(&req->list, &fpq->io);
 	spin_unlock(&fpq->lock);
 	cs->req = req;

From a92344910de48df6d6baffe0c334223f17652570 Mon Sep 17 00:00:00 2001
From: Jay Fang <f.fangjian@huawei.com>
Date: Thu, 6 May 2021 15:08:08 +0800
Subject: [PATCH 2332/2658] spi: spi-topcliff-pch: Fix potential double free in
 pch_spi_process_messages()

[ Upstream commit 026a1dc1af52742c5897e64a3431445371a71871 ]

pch_spi_set_tx() frees data->pkt_tx_buff on failure of kzalloc() for
data->pkt_rx_buff, but its caller, pch_spi_process_messages(), will
free data->pkt_tx_buff again. Set data->pkt_tx_buff to NULL after
kfree() to avoid double free.

Signed-off-by: Jay Fang <f.fangjian@huawei.com>
Link: https://lore.kernel.org/r/1620284888-65215-1-git-send-email-f.fangjian@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-topcliff-pch.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index 9f30a4ab2004..66c170e799fc 100644
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -589,8 +589,10 @@ static void pch_spi_set_tx(struct pch_spi_data *data, int *bpw)
 	data->pkt_tx_buff = kzalloc(size, GFP_KERNEL);
 	if (data->pkt_tx_buff != NULL) {
 		data->pkt_rx_buff = kzalloc(size, GFP_KERNEL);
-		if (!data->pkt_rx_buff)
+		if (!data->pkt_rx_buff) {
 			kfree(data->pkt_tx_buff);
+			data->pkt_tx_buff = NULL;
+		}
 	}
 
 	if (!data->pkt_rx_buff) {

From bf735f02379f2fec10f17ae257d3a9c61db77a9e Mon Sep 17 00:00:00 2001
From: Tian Tao <tiantao6@hisilicon.com>
Date: Thu, 29 Apr 2021 19:20:48 +0800
Subject: [PATCH 2333/2658] spi: omap-100k: Fix the length judgment problem

[ Upstream commit e7a1a3abea373e41ba7dfe0fbc93cb79b6a3a529 ]

word_len should be checked in the omap1_spi100k_setup_transfer
function to see if it exceeds 32.

Signed-off-by: Tian Tao <tiantao6@hisilicon.com>
Link: https://lore.kernel.org/r/1619695248-39045-1-git-send-email-tiantao6@hisilicon.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-omap-100k.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/spi/spi-omap-100k.c b/drivers/spi/spi-omap-100k.c
index 1eccdc4a4581..2eeb0fe2eed2 100644
--- a/drivers/spi/spi-omap-100k.c
+++ b/drivers/spi/spi-omap-100k.c
@@ -251,7 +251,7 @@ static int omap1_spi100k_setup_transfer(struct spi_device *spi,
 	else
 		word_len = spi->bits_per_word;
 
-	if (spi->bits_per_word > 32)
+	if (word_len > 32)
 		return -EINVAL;
 	cs->word_len = word_len;
 

From cd66de3937c2932e72b2cfcc458adfa8cf9b42d3 Mon Sep 17 00:00:00 2001
From: Bixuan Cui <cuibixuan@huawei.com>
Date: Sat, 8 May 2021 11:14:55 +0800
Subject: [PATCH 2334/2658] crypto: nx - add missing MODULE_DEVICE_TABLE

[ Upstream commit 06676aa1f455c74e3ad1624cea3acb9ed2ef71ae ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this driver when it is built
as an external module.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Bixuan Cui <cuibixuan@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/nx/nx-842-pseries.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/crypto/nx/nx-842-pseries.c b/drivers/crypto/nx/nx-842-pseries.c
index cddc6d8b55d9..2e5b4004f0ee 100644
--- a/drivers/crypto/nx/nx-842-pseries.c
+++ b/drivers/crypto/nx/nx-842-pseries.c
@@ -1086,6 +1086,7 @@ static struct vio_device_id nx842_vio_driver_ids[] = {
 	{"ibm,compression-v1", "ibm,compression"},
 	{"", ""},
 };
+MODULE_DEVICE_TABLE(vio, nx842_vio_driver_ids);
 
 static struct vio_driver nx842_vio_driver = {
 	.name = KBUILD_MODNAME,

From aa9e432d93cbe10618cd2eb854bd39bbd1f0d608 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Wed, 21 Apr 2021 21:43:45 +0200
Subject: [PATCH 2335/2658] media: cpia2: fix memory leak in cpia2_usb_probe

[ Upstream commit be8656e62e9e791837b606a027802b504a945c97 ]

syzbot reported leak in cpia2 usb driver. The problem was
in invalid error handling.

v4l2_device_register() is called in cpia2_init_camera_struct(), but
all error cases after cpia2_init_camera_struct() did not call the
v4l2_device_unregister()

Reported-by: syzbot+d1e69c888f0d3866ead4@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/cpia2/cpia2.h      |  1 +
 drivers/media/usb/cpia2/cpia2_core.c | 12 ++++++++++++
 drivers/media/usb/cpia2/cpia2_usb.c  | 13 +++++++------
 3 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/drivers/media/usb/cpia2/cpia2.h b/drivers/media/usb/cpia2/cpia2.h
index cdef677d57ec..80a7af6482ae 100644
--- a/drivers/media/usb/cpia2/cpia2.h
+++ b/drivers/media/usb/cpia2/cpia2.h
@@ -442,6 +442,7 @@ int cpia2_send_command(struct camera_data *cam, struct cpia2_command *cmd);
 int cpia2_do_command(struct camera_data *cam,
 		     unsigned int command,
 		     unsigned char direction, unsigned char param);
+void cpia2_deinit_camera_struct(struct camera_data *cam, struct usb_interface *intf);
 struct camera_data *cpia2_init_camera_struct(struct usb_interface *intf);
 int cpia2_init_camera(struct camera_data *cam);
 int cpia2_allocate_buffers(struct camera_data *cam);
diff --git a/drivers/media/usb/cpia2/cpia2_core.c b/drivers/media/usb/cpia2/cpia2_core.c
index 187012ce444b..35c9e00267d5 100644
--- a/drivers/media/usb/cpia2/cpia2_core.c
+++ b/drivers/media/usb/cpia2/cpia2_core.c
@@ -2158,6 +2158,18 @@ static void reset_camera_struct(struct camera_data *cam)
 	cam->height = cam->params.roi.height;
 }
 
+/******************************************************************************
+ *
+ *  cpia2_init_camera_struct
+ *
+ *  Deinitialize camera struct
+ *****************************************************************************/
+void cpia2_deinit_camera_struct(struct camera_data *cam, struct usb_interface *intf)
+{
+	v4l2_device_unregister(&cam->v4l2_dev);
+	kfree(cam);
+}
+
 /******************************************************************************
  *
  *  cpia2_init_camera_struct
diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c
index 76b9cb940b87..7bd50feadfe4 100644
--- a/drivers/media/usb/cpia2/cpia2_usb.c
+++ b/drivers/media/usb/cpia2/cpia2_usb.c
@@ -835,15 +835,13 @@ static int cpia2_usb_probe(struct usb_interface *intf,
 	ret = set_alternate(cam, USBIF_CMDONLY);
 	if (ret < 0) {
 		ERR("%s: usb_set_interface error (ret = %d)\n", __func__, ret);
-		kfree(cam);
-		return ret;
+		goto alt_err;
 	}
 
 
 	if((ret = cpia2_init_camera(cam)) < 0) {
 		ERR("%s: failed to initialize cpia2 camera (ret = %d)\n", __func__, ret);
-		kfree(cam);
-		return ret;
+		goto alt_err;
 	}
 	LOG("  CPiA Version: %d.%02d (%d.%d)\n",
 	       cam->params.version.firmware_revision_hi,
@@ -863,11 +861,14 @@ static int cpia2_usb_probe(struct usb_interface *intf,
 	ret = cpia2_register_camera(cam);
 	if (ret < 0) {
 		ERR("%s: Failed to register cpia2 camera (ret = %d)\n", __func__, ret);
-		kfree(cam);
-		return ret;
+		goto alt_err;
 	}
 
 	return 0;
+
+alt_err:
+	cpia2_deinit_camera_struct(cam, intf);
+	return ret;
 }
 
 /******************************************************************************

From 6cd98dc3c1a1d89564c9c9da7b18d2cc58c5ae86 Mon Sep 17 00:00:00 2001
From: Anirudh Rayabharam <mail@anirudhrb.com>
Date: Tue, 4 May 2021 19:08:58 +0200
Subject: [PATCH 2336/2658] media: pvrusb2: fix warning in pvr2_i2c_core_done

[ Upstream commit f8194e5e63fdcb349e8da9eef9e574d5b1d687cb ]

syzbot has reported the following warning in pvr2_i2c_done:

	sysfs group 'power' not found for kobject '1-0043'

When the device is disconnected (pvr_hdw_disconnect), the i2c adapter is
not unregistered along with the USB and v4l2 teardown. As part of the USB
device disconnect, the sysfs files of the subdevices are also deleted.
So, by the time pvr_i2c_core_done is called by pvr_context_destroy, the
sysfs files have been deleted.

To fix this, unregister the i2c adapter too in pvr_hdw_disconnect. Make
the device deregistration code shared by calling pvr_hdw_disconnect from
pvr2_hdw_destroy.

Reported-by: syzbot+e74a998ca8f1df9cc332@syzkaller.appspotmail.com
Tested-by: syzbot+e74a998ca8f1df9cc332@syzkaller.appspotmail.com
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
index 232b0fd3e478..ba3b0141538d 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
@@ -2731,9 +2731,8 @@ void pvr2_hdw_destroy(struct pvr2_hdw *hdw)
 		pvr2_stream_destroy(hdw->vid_stream);
 		hdw->vid_stream = NULL;
 	}
-	pvr2_i2c_core_done(hdw);
 	v4l2_device_unregister(&hdw->v4l2_dev);
-	pvr2_hdw_remove_usb_stuff(hdw);
+	pvr2_hdw_disconnect(hdw);
 	mutex_lock(&pvr2_unit_mtx);
 	do {
 		if ((hdw->unit_number >= 0) &&
@@ -2760,6 +2759,7 @@ void pvr2_hdw_disconnect(struct pvr2_hdw *hdw)
 {
 	pvr2_trace(PVR2_TRACE_INIT,"pvr2_hdw_disconnect(hdw=%p)",hdw);
 	LOCK_TAKE(hdw->big_lock);
+	pvr2_i2c_core_done(hdw);
 	LOCK_TAKE(hdw->ctl_lock);
 	pvr2_hdw_remove_usb_stuff(hdw);
 	LOCK_GIVE(hdw->ctl_lock);

From 09d8ee523ccbf0905be388a4c5e2861282828a46 Mon Sep 17 00:00:00 2001
From: Jack Xu <jack.xu@intel.com>
Date: Mon, 17 May 2021 05:13:15 -0400
Subject: [PATCH 2337/2658] crypto: qat - check return code of
 qat_hal_rd_rel_reg()

[ Upstream commit 96b57229209490c8bca4335b01a426a96173dc56 ]

Check the return code of the function qat_hal_rd_rel_reg() and return it
to the caller.

This is to fix the following warning when compiling the driver with
clang scan-build:

    drivers/crypto/qat/qat_common/qat_hal.c:1436:2: warning: 6th function call argument is an uninitialized value

Signed-off-by: Jack Xu <jack.xu@intel.com>
Co-developed-by: Zhehui Xiang <zhehui.xiang@intel.com>
Signed-off-by: Zhehui Xiang <zhehui.xiang@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/qat/qat_common/qat_hal.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c
index 380e761801a7..5e5003379281 100644
--- a/drivers/crypto/qat/qat_common/qat_hal.c
+++ b/drivers/crypto/qat/qat_common/qat_hal.c
@@ -1210,7 +1210,11 @@ static int qat_hal_put_rel_wr_xfer(struct icp_qat_fw_loader_handle *handle,
 		pr_err("QAT: bad xfrAddr=0x%x\n", xfr_addr);
 		return -EINVAL;
 	}
-	qat_hal_rd_rel_reg(handle, ae, ctx, ICP_GPB_REL, gprnum, &gprval);
+	status = qat_hal_rd_rel_reg(handle, ae, ctx, ICP_GPB_REL, gprnum, &gprval);
+	if (status) {
+		pr_err("QAT: failed to read register");
+		return status;
+	}
 	gpr_addr = qat_hal_get_reg_addr(ICP_GPB_REL, gprnum);
 	data16low = 0xffff & data;
 	data16hi = 0xffff & (data >> 0x10);

From 59f22f6ac3e5ab44de8384070367fcdc3e66831b Mon Sep 17 00:00:00 2001
From: Jack Xu <jack.xu@intel.com>
Date: Mon, 17 May 2021 05:13:16 -0400
Subject: [PATCH 2338/2658] crypto: qat - remove unused macro in FW loader

[ Upstream commit 9afe77cf25d9670e61b489fd52cc6f75fd7f6803 ]

Remove the unused macro ICP_DH895XCC_PESRAM_BAR_SIZE in the firmware
loader.

This is to fix the following warning when compiling the driver using the
clang compiler with CC=clang W=2:

    drivers/crypto/qat/qat_common/qat_uclo.c:345:9: warning: macro is not used [-Wunused-macros]

Signed-off-by: Jack Xu <jack.xu@intel.com>
Co-developed-by: Zhehui Xiang <zhehui.xiang@intel.com>
Signed-off-by: Zhehui Xiang <zhehui.xiang@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/qat/qat_common/qat_uclo.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/crypto/qat/qat_common/qat_uclo.c b/drivers/crypto/qat/qat_common/qat_uclo.c
index 923bb1988973..28e642959a9a 100644
--- a/drivers/crypto/qat/qat_common/qat_uclo.c
+++ b/drivers/crypto/qat/qat_common/qat_uclo.c
@@ -360,7 +360,6 @@ static int qat_uclo_init_umem_seg(struct icp_qat_fw_loader_handle *handle,
 	return 0;
 }
 
-#define ICP_DH895XCC_PESRAM_BAR_SIZE 0x80000
 static int qat_uclo_init_ae_memory(struct icp_qat_fw_loader_handle *handle,
 				   struct icp_qat_uof_initmem *init_mem)
 {

From 63ee4131989d11174cd15d27d1639c7748f35adc Mon Sep 17 00:00:00 2001
From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Date: Sun, 9 May 2021 10:24:02 +0200
Subject: [PATCH 2339/2658] media: v4l2-core: Avoid the dangling pointer in
 v4l2_fh_release

[ Upstream commit 7dd0c9e547b6924e18712b6b51aa3cba1896ee2c ]

A use after free bug caused by the dangling pointer
filp->privitate_data in v4l2_fh_release.
See https://lore.kernel.org/patchwork/patch/1419058/.

My patch sets the dangling pointer to NULL to provide
robust.

Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/v4l2-core/v4l2-fh.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/v4l2-core/v4l2-fh.c b/drivers/media/v4l2-core/v4l2-fh.c
index 1d076deb05a9..ce844ecc3340 100644
--- a/drivers/media/v4l2-core/v4l2-fh.c
+++ b/drivers/media/v4l2-core/v4l2-fh.c
@@ -107,6 +107,7 @@ int v4l2_fh_release(struct file *filp)
 		v4l2_fh_del(fh);
 		v4l2_fh_exit(fh);
 		kfree(fh);
+		filp->private_data = NULL;
 	}
 	return 0;
 }

From d33bb2009e8ac1b8dae10d79a36ae4930f75e8e2 Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Wed, 12 May 2021 17:18:36 +0200
Subject: [PATCH 2340/2658] media: bt8xx: Fix a missing check bug in
 bt878_probe

[ Upstream commit 1a4520090681853e6b850cbe54b27247a013e0e5 ]

In 'bt878_irq', the driver calls 'tasklet_schedule', but this tasklet is
set in 'dvb_bt8xx_load_card' of another driver 'dvb-bt8xx'.
However, this two drivers are separate. The user may not load the
'dvb-bt8xx' driver when loading the 'bt8xx' driver, that is, the tasklet
has not been initialized when 'tasklet_schedule' is called, so it is
necessary to check whether the tasklet is initialized in 'bt878_probe'.

Fix this by adding a check at the end of bt878_probe.

The KASAN's report reveals it:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
PGD 800000006aab2067 P4D 800000006aab2067 PUD 6b2ea067 PMD 0
Oops: 0010 [#1] PREEMPT SMP KASAN PTI
CPU: 2 PID: 8724 Comm: syz-executor.0 Not tainted 4.19.177-
gdba4159c14ef-dirty #40
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-
gc9ba5276e321-prebuilt.qemu.org 04/01/2014
RIP: 0010:          (null)
Code: Bad RIP value.
RSP: 0018:ffff88806c287ea0 EFLAGS: 00010246
RAX: fffffbfff1b01774 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 1ffffffff1b01775 RDI: 0000000000000000
RBP: ffff88806c287f00 R08: fffffbfff1b01774 R09: fffffbfff1b01774
R10: 0000000000000001 R11: fffffbfff1b01773 R12: 0000000000000000
R13: ffff88806c29f530 R14: ffffffff8d80bb88 R15: ffffffff8d80bb90
FS:  00007f6b550e6700(0000) GS:ffff88806c280000(0000) knlGS:
0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000005ec98000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 tasklet_action_common.isra.17+0x141/0x420 kernel/softirq.c:522
 tasklet_action+0x50/0x70 kernel/softirq.c:540
 __do_softirq+0x224/0x92c kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x15a/0x180 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:535 [inline]
 do_IRQ+0x123/0x1e0 arch/x86/kernel/irq.c:260
 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670
 </IRQ>
RIP: 0010:__do_sys_interrupt kernel/sys.c:2593 [inline]
RIP: 0010:__se_sys_interrupt kernel/sys.c:2584 [inline]
RIP: 0010:__x64_sys_interrupt+0x5b/0x80 kernel/sys.c:2584
Code: ba 00 04 00 00 48 c7 c7 c0 99 31 8c e8 ae 76 5e 01 48 85 c0 75 21 e8
14 ae 24 00 48 c7 c3 c0 99 31 8c b8 0c 00 00 00 0f 01 c1 <31> db e8 fe ad
24 00 48 89 d8 5b 5d c3 48 c7 c3 ea ff ff ff eb ec
RSP: 0018:ffff888054167f10 EFLAGS: 00000212 ORIG_RAX: ffffffffffffffde
RAX: 000000000000000c RBX: ffffffff8c3199c0 RCX: ffffc90001ca6000
RDX: 000000000000001a RSI: ffffffff813478fc RDI: ffffffff8c319dc0
RBP: ffff888054167f18 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000080 R11: fffffbfff18633b7 R12: ffff888054167f58
R13: ffff88805f638000 R14: 0000000000000000 R15: 0000000000000000
 do_syscall_64+0xb0/0x4e0 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4692a9
Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6b550e5c48 EFLAGS: 00000246 ORIG_RAX: 000000000000014f
RAX: ffffffffffffffda RBX: 000000000077bf60 RCX: 00000000004692a9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140
RBP: 00000000004cf7eb R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000077bf60
R13: 0000000000000000 R14: 000000000077bf60 R15: 00007fff55a1dca0
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
CR2: 0000000000000000
---[ end trace 68e5849c3f77cbb6 ]---
RIP: 0010:          (null)
Code: Bad RIP value.
RSP: 0018:ffff88806c287ea0 EFLAGS: 00010246
RAX: fffffbfff1b01774 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 1ffffffff1b01775 RDI: 0000000000000000
RBP: ffff88806c287f00 R08: fffffbfff1b01774 R09: fffffbfff1b01774
R10: 0000000000000001 R11: fffffbfff1b01773 R12: 0000000000000000
R13: ffff88806c29f530 R14: ffffffff8d80bb88 R15: ffffffff8d80bb90
FS:  00007f6b550e6700(0000) GS:ffff88806c280000(0000) knlGS:
0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000005ec98000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Reported-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/bt8xx/bt878.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/pci/bt8xx/bt878.c b/drivers/media/pci/bt8xx/bt878.c
index 90fcccc05b56..c678d7120727 100644
--- a/drivers/media/pci/bt8xx/bt878.c
+++ b/drivers/media/pci/bt8xx/bt878.c
@@ -494,6 +494,9 @@ static int bt878_probe(struct pci_dev *dev, const struct pci_device_id *pci_id)
 	btwrite(0, BT878_AINT_MASK);
 	bt878_num++;
 
+	if (!bt->tasklet.func)
+		tasklet_disable(&bt->tasklet);
+
 	return 0;
 
       fail2:

From 0e34aa597305f2d34c421b8b762e98fe56a10e7a Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Thu, 3 Jun 2021 13:33:20 +0000
Subject: [PATCH 2341/2658] mmc: via-sdmmc: add a check against NULL pointer
 dereference

[ Upstream commit 45c8ddd06c4b729c56a6083ab311bfbd9643f4a6 ]

Before referencing 'host->data', the driver needs to check whether it is
null pointer, otherwise it will cause a null pointer reference.

This log reveals it:

[   29.355199] BUG: kernel NULL pointer dereference, address:
0000000000000014
[   29.357323] #PF: supervisor write access in kernel mode
[   29.357706] #PF: error_code(0x0002) - not-present page
[   29.358088] PGD 0 P4D 0
[   29.358280] Oops: 0002 [#1] PREEMPT SMP PTI
[   29.358595] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 5.12.4-
g70e7f0549188-dirty #102
[   29.359164] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),
BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[   29.359978] RIP: 0010:via_sdc_isr+0x21f/0x410
[   29.360314] Code: ff ff e8 84 aa d0 fd 66 45 89 7e 28 66 41 f7 c4 00
10 75 56 e8 72 aa d0 fd 66 41 f7 c4 00 c0 74 10 e8 65 aa d0 fd 48 8b 43
18 <c7> 40 14 ac ff ff ff e8 55 aa d0 fd 48 89 df e8 ad fb ff ff e9 77
[   29.361661] RSP: 0018:ffffc90000118e98 EFLAGS: 00010046
[   29.362042] RAX: 0000000000000000 RBX: ffff888107d77880
RCX: 0000000000000000
[   29.362564] RDX: 0000000000000000 RSI: ffffffff835d20bb
RDI: 00000000ffffffff
[   29.363085] RBP: ffffc90000118ed8 R08: 0000000000000001
R09: 0000000000000001
[   29.363604] R10: 0000000000000000 R11: 0000000000000001
R12: 0000000000008600
[   29.364128] R13: ffff888107d779c8 R14: ffffc90009c00200
R15: 0000000000008000
[   29.364651] FS:  0000000000000000(0000) GS:ffff88817bc80000(0000)
knlGS:0000000000000000
[   29.365235] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   29.365655] CR2: 0000000000000014 CR3: 0000000005a2e000
CR4: 00000000000006e0
[   29.366170] DR0: 0000000000000000 DR1: 0000000000000000
DR2: 0000000000000000
[   29.366683] DR3: 0000000000000000 DR6: 00000000fffe0ff0
DR7: 0000000000000400
[   29.367197] Call Trace:
[   29.367381]  <IRQ>
[   29.367537]  __handle_irq_event_percpu+0x53/0x3e0
[   29.367916]  handle_irq_event_percpu+0x35/0x90
[   29.368247]  handle_irq_event+0x39/0x60
[   29.368632]  handle_fasteoi_irq+0xc2/0x1d0
[   29.368950]  __common_interrupt+0x7f/0x150
[   29.369254]  common_interrupt+0xb4/0xd0
[   29.369547]  </IRQ>
[   29.369708]  asm_common_interrupt+0x1e/0x40
[   29.370016] RIP: 0010:native_safe_halt+0x17/0x20
[   29.370360] Code: 07 0f 00 2d db 80 43 00 f4 5d c3 0f 1f 84 00 00 00
00 00 8b 05 c2 37 e5 01 55 48 89 e5 85 c0 7e 07 0f 00 2d bb 80 43 00 fb
f4 <5d> c3 cc cc cc cc cc cc cc 55 48 89 e5 e8 67 53 ff ff 8b 0d f9 91
[   29.371696] RSP: 0018:ffffc9000008fe90 EFLAGS: 00000246
[   29.372079] RAX: 0000000000000000 RBX: 0000000000000002
RCX: 0000000000000000
[   29.372595] RDX: 0000000000000000 RSI: ffffffff854f67a4
RDI: ffffffff85403406
[   29.373122] RBP: ffffc9000008fe90 R08: 0000000000000001
R09: 0000000000000001
[   29.373646] R10: 0000000000000000 R11: 0000000000000001
R12: ffffffff86009188
[   29.374160] R13: 0000000000000000 R14: 0000000000000000
R15: ffff888100258000
[   29.374690]  default_idle+0x9/0x10
[   29.374944]  arch_cpu_idle+0xa/0x10
[   29.375198]  default_idle_call+0x6e/0x250
[   29.375491]  do_idle+0x1f0/0x2d0
[   29.375740]  cpu_startup_entry+0x18/0x20
[   29.376034]  start_secondary+0x11f/0x160
[   29.376328]  secondary_startup_64_no_verify+0xb0/0xbb
[   29.376705] Modules linked in:
[   29.376939] Dumping ftrace buffer:
[   29.377187]    (ftrace buffer empty)
[   29.377460] CR2: 0000000000000014
[   29.377712] ---[ end trace 51a473dffb618c47 ]---
[   29.378056] RIP: 0010:via_sdc_isr+0x21f/0x410
[   29.378380] Code: ff ff e8 84 aa d0 fd 66 45 89 7e 28 66 41 f7 c4 00
10 75 56 e8 72 aa d0 fd 66 41 f7 c4 00 c0 74 10 e8 65 aa d0 fd 48 8b 43
18 <c7> 40 14 ac ff ff ff e8 55 aa d0 fd 48 89 df e8 ad fb ff ff e9 77
[   29.379714] RSP: 0018:ffffc90000118e98 EFLAGS: 00010046
[   29.380098] RAX: 0000000000000000 RBX: ffff888107d77880
RCX: 0000000000000000
[   29.380614] RDX: 0000000000000000 RSI: ffffffff835d20bb
RDI: 00000000ffffffff
[   29.381134] RBP: ffffc90000118ed8 R08: 0000000000000001
R09: 0000000000000001
[   29.381653] R10: 0000000000000000 R11: 0000000000000001
R12: 0000000000008600
[   29.382176] R13: ffff888107d779c8 R14: ffffc90009c00200
R15: 0000000000008000
[   29.382697] FS:  0000000000000000(0000) GS:ffff88817bc80000(0000)
knlGS:0000000000000000
[   29.383277] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   29.383697] CR2: 0000000000000014 CR3: 0000000005a2e000
CR4: 00000000000006e0
[   29.384223] DR0: 0000000000000000 DR1: 0000000000000000
DR2: 0000000000000000
[   29.384736] DR3: 0000000000000000 DR6: 00000000fffe0ff0
DR7: 0000000000000400
[   29.385260] Kernel panic - not syncing: Fatal exception in interrupt
[   29.385882] Dumping ftrace buffer:
[   29.386135]    (ftrace buffer empty)
[   29.386401] Kernel Offset: disabled
[   29.386656] Rebooting in 1 seconds..

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Link: https://lore.kernel.org/r/1622727200-15808-1-git-send-email-zheyuma97@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/via-sdmmc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/mmc/host/via-sdmmc.c b/drivers/mmc/host/via-sdmmc.c
index b455e9cf95af..a3472127bea3 100644
--- a/drivers/mmc/host/via-sdmmc.c
+++ b/drivers/mmc/host/via-sdmmc.c
@@ -859,6 +859,9 @@ static void via_sdc_data_isr(struct via_crdr_mmc_host *host, u16 intmask)
 {
 	BUG_ON(intmask == 0);
 
+	if (!host->data)
+		return;
+
 	if (intmask & VIA_CRDR_SDSTS_DT)
 		host->data->error = -ETIMEDOUT;
 	else if (intmask & (VIA_CRDR_SDSTS_RC | VIA_CRDR_SDSTS_WC))

From 0b44a5d8cc54d5503ef4a9ddd04abe069f940940 Mon Sep 17 00:00:00 2001
From: Ard Biesheuvel <ardb@kernel.org>
Date: Thu, 10 Jun 2021 08:21:50 +0200
Subject: [PATCH 2342/2658] crypto: shash - avoid comparing pointers to
 exported functions under CFI

[ Upstream commit 22ca9f4aaf431a9413dcc115dd590123307f274f ]

crypto_shash_alg_has_setkey() is implemented by testing whether the
.setkey() member of a struct shash_alg points to the default version,
called shash_no_setkey(). As crypto_shash_alg_has_setkey() is a static
inline, this requires shash_no_setkey() to be exported to modules.

Unfortunately, when building with CFI, function pointers are routed
via CFI stubs which are private to each module (or to the kernel proper)
and so this function pointer comparison may fail spuriously.

Let's fix this by turning crypto_shash_alg_has_setkey() into an out of
line function.

Cc: Sami Tolvanen <samitolvanen@google.com>
Cc: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/shash.c                 | 18 +++++++++++++++---
 include/crypto/internal/hash.h |  8 +-------
 2 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/crypto/shash.c b/crypto/shash.c
index b086b0174b82..4490269eafc3 100644
--- a/crypto/shash.c
+++ b/crypto/shash.c
@@ -24,12 +24,24 @@
 
 static const struct crypto_type crypto_shash_type;
 
-int shash_no_setkey(struct crypto_shash *tfm, const u8 *key,
-		    unsigned int keylen)
+static int shash_no_setkey(struct crypto_shash *tfm, const u8 *key,
+			   unsigned int keylen)
 {
 	return -ENOSYS;
 }
-EXPORT_SYMBOL_GPL(shash_no_setkey);
+
+/*
+ * Check whether an shash algorithm has a setkey function.
+ *
+ * For CFI compatibility, this must not be an inline function.  This is because
+ * when CFI is enabled, modules won't get the same address for shash_no_setkey
+ * (if it were exported, which inlining would require) as the core kernel will.
+ */
+bool crypto_shash_alg_has_setkey(struct shash_alg *alg)
+{
+	return alg->setkey != shash_no_setkey;
+}
+EXPORT_SYMBOL_GPL(crypto_shash_alg_has_setkey);
 
 static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key,
 				  unsigned int keylen)
diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h
index 90aa5cb7ea82..b6a979fae948 100644
--- a/include/crypto/internal/hash.h
+++ b/include/crypto/internal/hash.h
@@ -83,13 +83,7 @@ int ahash_register_instance(struct crypto_template *tmpl,
 			    struct ahash_instance *inst);
 void ahash_free_instance(struct crypto_instance *inst);
 
-int shash_no_setkey(struct crypto_shash *tfm, const u8 *key,
-		    unsigned int keylen);
-
-static inline bool crypto_shash_alg_has_setkey(struct shash_alg *alg)
-{
-	return alg->setkey != shash_no_setkey;
-}
+bool crypto_shash_alg_has_setkey(struct shash_alg *alg);
 
 bool crypto_hash_alg_has_setkey(struct hash_alg_common *halg);
 

From a4fb206517d92821d6d949bcbb1706aec14cd95f Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Wed, 16 Jun 2021 13:13:54 +0200
Subject: [PATCH 2343/2658] media: dvb_net: avoid speculation from net slot

[ Upstream commit abc0226df64dc137b48b911c1fe4319aec5891bb ]

The risk of especulation is actually almost-non-existing here,
as there are very few users of TCP/IP using the DVB stack,
as, this is mainly used with DVB-S/S2 cards, and only by people
that receives TCP/IP from satellite connections, which limits
a lot the number of users of such feature(*).

(*) In thesis, DVB-C cards could also benefit from it, but I'm
yet to see a hardware that supports it.

Yet, fixing it is trivial.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/dvb-core/dvb_net.c | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c
index ce4332e80a91..735baa74043c 100644
--- a/drivers/media/dvb-core/dvb_net.c
+++ b/drivers/media/dvb-core/dvb_net.c
@@ -57,6 +57,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
+#include <linux/nospec.h>
 #include <linux/etherdevice.h>
 #include <linux/dvb/net.h>
 #include <linux/uio.h>
@@ -1350,14 +1351,20 @@ static int dvb_net_do_ioctl(struct file *file,
 		struct net_device *netdev;
 		struct dvb_net_priv *priv_data;
 		struct dvb_net_if *dvbnetif = parg;
+		int if_num = dvbnetif->if_num;
 
-		if (dvbnetif->if_num >= DVB_NET_DEVICES_MAX ||
-		    !dvbnet->state[dvbnetif->if_num]) {
+		if (if_num >= DVB_NET_DEVICES_MAX) {
 			ret = -EINVAL;
 			goto ioctl_error;
 		}
+		if_num = array_index_nospec(if_num, DVB_NET_DEVICES_MAX);
 
-		netdev = dvbnet->device[dvbnetif->if_num];
+		if (!dvbnet->state[if_num]) {
+			ret = -EINVAL;
+			goto ioctl_error;
+		}
+
+		netdev = dvbnet->device[if_num];
 
 		priv_data = netdev_priv(netdev);
 		dvbnetif->pid=priv_data->pid;
@@ -1410,14 +1417,20 @@ static int dvb_net_do_ioctl(struct file *file,
 		struct net_device *netdev;
 		struct dvb_net_priv *priv_data;
 		struct __dvb_net_if_old *dvbnetif = parg;
+		int if_num = dvbnetif->if_num;
+
+		if (if_num >= DVB_NET_DEVICES_MAX) {
+			ret = -EINVAL;
+			goto ioctl_error;
+		}
+		if_num = array_index_nospec(if_num, DVB_NET_DEVICES_MAX);
 
-		if (dvbnetif->if_num >= DVB_NET_DEVICES_MAX ||
-		    !dvbnet->state[dvbnetif->if_num]) {
+		if (!dvbnet->state[if_num]) {
 			ret = -EINVAL;
 			goto ioctl_error;
 		}
 
-		netdev = dvbnet->device[dvbnetif->if_num];
+		netdev = dvbnet->device[if_num];
 
 		priv_data = netdev_priv(netdev);
 		dvbnetif->pid=priv_data->pid;

From 16aa0e543738a008c6cc11bb98796d97ebfdef0d Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@csgroup.eu>
Date: Thu, 10 Jun 2021 05:23:02 +0000
Subject: [PATCH 2344/2658] btrfs: disable build on platforms having page size
 256K

[ Upstream commit b05fbcc36be1f8597a1febef4892053a0b2f3f60 ]

With a config having PAGE_SIZE set to 256K, BTRFS build fails
with the following message

  include/linux/compiler_types.h:326:38: error: call to
  '__compiletime_assert_791' declared with attribute error:
  BUILD_BUG_ON failed: (BTRFS_MAX_COMPRESSED % PAGE_SIZE) != 0

BTRFS_MAX_COMPRESSED being 128K, BTRFS cannot support platforms with
256K pages at the time being.

There are two platforms that can select 256K pages:
 - hexagon
 - powerpc

Disable BTRFS when 256K page size is selected. Supporting this would
require changes to the subpage mode that's currently being developed.
Given that 256K is many times larger than page sizes commonly used and
for what the algorithms and structures have been tuned, it's out of
scope and disabling build is a reasonable option.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
[ update changelog ]
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/Kconfig | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/btrfs/Kconfig b/fs/btrfs/Kconfig
index 80e9c18ea64f..fd6b67c40d9d 100644
--- a/fs/btrfs/Kconfig
+++ b/fs/btrfs/Kconfig
@@ -9,6 +9,8 @@ config BTRFS_FS
 	select RAID6_PQ
 	select XOR_BLOCKS
 	select SRCU
+	depends on !PPC_256K_PAGES	# powerpc
+	depends on !PAGE_SIZE_256KB	# hexagon
 
 	help
 	  Btrfs is a general purpose copy-on-write filesystem with extents,

From 118a87254a26ee005b9a90487f4accd27145beb6 Mon Sep 17 00:00:00 2001
From: Axel Lin <axel.lin@ingics.com>
Date: Fri, 18 Jun 2021 22:14:11 +0800
Subject: [PATCH 2345/2658] regulator: da9052: Ensure enough delay time for
 .set_voltage_time_sel

[ Upstream commit a336dc8f683e5be794186b5643cd34cb28dd2c53 ]

Use DIV_ROUND_UP to prevent truncation by integer division issue.
This ensures we return enough delay time.

Also fix returning negative value when new_sel < old_sel.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Link: https://lore.kernel.org/r/20210618141412.4014912-1-axel.lin@ingics.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/da9052-regulator.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/regulator/da9052-regulator.c b/drivers/regulator/da9052-regulator.c
index 12a25b40e473..fa9cb7df79de 100644
--- a/drivers/regulator/da9052-regulator.c
+++ b/drivers/regulator/da9052-regulator.c
@@ -258,7 +258,8 @@ static int da9052_regulator_set_voltage_time_sel(struct regulator_dev *rdev,
 	case DA9052_ID_BUCK3:
 	case DA9052_ID_LDO2:
 	case DA9052_ID_LDO3:
-		ret = (new_sel - old_sel) * info->step_uV / 6250;
+		ret = DIV_ROUND_UP(abs(new_sel - old_sel) * info->step_uV,
+				   6250);
 		break;
 	}
 

From fc52d46bf06a35c3735bcee30626ee86f006a6d8 Mon Sep 17 00:00:00 2001
From: Mario Limonciello <mario.limonciello@amd.com>
Date: Wed, 12 May 2021 17:15:14 -0500
Subject: [PATCH 2346/2658] ACPI: processor idle: Fix up C-state latency if not
 ordered

[ Upstream commit 65ea8f2c6e230bdf71fed0137cf9e9d1b307db32 ]

Generally, the C-state latency is provided by the _CST method or
FADT, but some OEM platforms using AMD Picasso, Renoir, Van Gogh,
and Cezanne set the C2 latency greater than C3's which causes the
C2 state to be skipped.

That will block the core entering PC6, which prevents S0ix working
properly on Linux systems.

In other operating systems, the latency values are not validated and
this does not cause problems by skipping states.

To avoid this issue on Linux, detect when latencies are not an
arithmetic progression and sort them.

Link: https://gitlab.freedesktop.org/agd5f/linux/-/commit/026d186e4592c1ee9c1cb44295912d0294508725
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/1230#note_712174
Suggested-by: Prike Liang <Prike.Liang@amd.com>
Suggested-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/processor_idle.c | 40 +++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 175c86bee3a9..69fec2d3a1f5 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -28,6 +28,7 @@
 #include <linux/acpi.h>
 #include <linux/dmi.h>
 #include <linux/sched.h>       /* need_resched() */
+#include <linux/sort.h>
 #include <linux/tick.h>
 #include <linux/cpuidle.h>
 #include <linux/syscore_ops.h>
@@ -572,10 +573,37 @@ static void acpi_processor_power_verify_c3(struct acpi_processor *pr,
 	return;
 }
 
+static int acpi_cst_latency_cmp(const void *a, const void *b)
+{
+	const struct acpi_processor_cx *x = a, *y = b;
+
+	if (!(x->valid && y->valid))
+		return 0;
+	if (x->latency > y->latency)
+		return 1;
+	if (x->latency < y->latency)
+		return -1;
+	return 0;
+}
+static void acpi_cst_latency_swap(void *a, void *b, int n)
+{
+	struct acpi_processor_cx *x = a, *y = b;
+	u32 tmp;
+
+	if (!(x->valid && y->valid))
+		return;
+	tmp = x->latency;
+	x->latency = y->latency;
+	y->latency = tmp;
+}
+
 static int acpi_processor_power_verify(struct acpi_processor *pr)
 {
 	unsigned int i;
 	unsigned int working = 0;
+	unsigned int last_latency = 0;
+	unsigned int last_type = 0;
+	bool buggy_latency = false;
 
 	pr->power.timer_broadcast_on_state = INT_MAX;
 
@@ -599,12 +627,24 @@ static int acpi_processor_power_verify(struct acpi_processor *pr)
 		}
 		if (!cx->valid)
 			continue;
+		if (cx->type >= last_type && cx->latency < last_latency)
+			buggy_latency = true;
+		last_latency = cx->latency;
+		last_type = cx->type;
 
 		lapic_timer_check_state(i, pr, cx);
 		tsc_check_state(cx->type);
 		working++;
 	}
 
+	if (buggy_latency) {
+		pr_notice("FW issue: working around C-state latencies out of order\n");
+		sort(&pr->power.states[1], max_cstate,
+		     sizeof(struct acpi_processor_cx),
+		     acpi_cst_latency_cmp,
+		     acpi_cst_latency_swap);
+	}
+
 	lapic_timer_propagate_broadcast(pr);
 
 	return (working);

From 14e65892f2ed42b276a13c47249d3b060f5a8358 Mon Sep 17 00:00:00 2001
From: "zhangyi (F)" <yi.zhang@huawei.com>
Date: Sat, 13 Mar 2021 11:01:44 +0800
Subject: [PATCH 2347/2658] block_dump: remove block_dump feature in
 mark_inode_dirty()

[ Upstream commit 12e0613715e1cf305fffafaf0e89d810d9a85cc0 ]

block_dump is an old debugging interface, one of it's functions is used
to print the information about who write which file on disk. If we
enable block_dump through /proc/sys/vm/block_dump and turn on debug log
level, we can gather information about write process name, target file
name and disk from kernel message. This feature is realized in
block_dump___mark_inode_dirty(), it print above information into kernel
message directly when marking inode dirty, so it is noisy and can easily
trigger log storm. At the same time, get the dentry refcount is also not
safe, we found it will lead to deadlock on ext4 file system with
data=journal mode.

After tracepoints has been introduced into the kernel, we got a
tracepoint in __mark_inode_dirty(), which is a better replacement of
block_dump___mark_inode_dirty(). The only downside is that it only trace
the inode number and not a file name, but it probably doesn't matter
because the original printed file name in block_dump is not accurate in
some cases, and we can still find it through the inode number and device
id. So this patch delete the dirting inode part of block_dump feature.

Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20210313030146.2882027-2-yi.zhang@huawei.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fs-writeback.c | 25 -------------------------
 1 file changed, 25 deletions(-)

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 631b484d09a8..958a1bd0b5fc 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -2040,28 +2040,6 @@ int dirtytime_interval_handler(struct ctl_table *table, int write,
 	return ret;
 }
 
-static noinline void block_dump___mark_inode_dirty(struct inode *inode)
-{
-	if (inode->i_ino || strcmp(inode->i_sb->s_id, "bdev")) {
-		struct dentry *dentry;
-		const char *name = "?";
-
-		dentry = d_find_alias(inode);
-		if (dentry) {
-			spin_lock(&dentry->d_lock);
-			name = (const char *) dentry->d_name.name;
-		}
-		printk(KERN_DEBUG
-		       "%s(%d): dirtied inode %lu (%s) on %s\n",
-		       current->comm, task_pid_nr(current), inode->i_ino,
-		       name, inode->i_sb->s_id);
-		if (dentry) {
-			spin_unlock(&dentry->d_lock);
-			dput(dentry);
-		}
-	}
-}
-
 /**
  *	__mark_inode_dirty -	internal function
  *	@inode: inode to mark
@@ -2120,9 +2098,6 @@ void __mark_inode_dirty(struct inode *inode, int flags)
 	    (dirtytime && (inode->i_state & I_DIRTY_INODE)))
 		return;
 
-	if (unlikely(block_dump > 1))
-		block_dump___mark_inode_dirty(inode);
-
 	spin_lock(&inode->i_lock);
 	if (dirtytime && (inode->i_state & I_DIRTY_INODE))
 		goto out_unlock_inode;

From 6be00039ba26544458c13d7516e373efce375ade Mon Sep 17 00:00:00 2001
From: Alexander Aring <aahringo@redhat.com>
Date: Fri, 21 May 2021 15:08:38 -0400
Subject: [PATCH 2348/2658] fs: dlm: cancel work sync othercon

[ Upstream commit c6aa00e3d20c2767ba3f57b64eb862572b9744b3 ]

These rx tx flags arguments are for signaling close_connection() from
which worker they are called. Obviously the receive worker cannot cancel
itself and vice versa for swork. For the othercon the receive worker
should only be used, however to avoid deadlocks we should pass the same
flags as the original close_connection() was called.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/dlm/lowcomms.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 9d7a4a714907..99f4cd91910f 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -554,7 +554,7 @@ static void close_connection(struct connection *con, bool and_other,
 	}
 	if (con->othercon && and_other) {
 		/* Will only re-enter once. */
-		close_connection(con->othercon, false, true, true);
+		close_connection(con->othercon, false, tx, rx);
 	}
 	if (con->rx_page) {
 		__free_page(con->rx_page);

From 72cfbcb913ccaf4e5ff9ca8243070a8d01f6265c Mon Sep 17 00:00:00 2001
From: Richard Fitzgerald <rf@opensource.cirrus.com>
Date: Tue, 25 May 2021 13:20:12 +0100
Subject: [PATCH 2349/2658] random32: Fix implicit truncation warning in
 prandom_seed_state()

[ Upstream commit d327ea15a305024ef0085252fa3657bbb1ce25f5 ]

sparse generates the following warning:

 include/linux/prandom.h:114:45: sparse: sparse: cast truncates bits from
 constant value

This is because the 64-bit seed value is manipulated and then placed in a
u32, causing an implicit cast and truncation. A forced cast to u32 doesn't
prevent this warning, which is reasonable because a typecast doesn't prove
that truncation was expected.

Logical-AND the value with 0xffffffff to make explicit that truncation to
32-bit is intended.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20210525122012.6336-3-rf@opensource.cirrus.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/prandom.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/prandom.h b/include/linux/prandom.h
index cc1e71334e53..e20339c78a84 100644
--- a/include/linux/prandom.h
+++ b/include/linux/prandom.h
@@ -93,7 +93,7 @@ static inline u32 __seed(u32 x, u32 m)
  */
 static inline void prandom_seed_state(struct rnd_state *state, u64 seed)
 {
-	u32 i = (seed >> 32) ^ (seed << 10) ^ seed;
+	u32 i = ((seed >> 32) ^ (seed << 10) ^ seed) & 0xffffffffUL;
 
 	state->s1 = __seed(i,   2U);
 	state->s2 = __seed(i,   8U);

From 7870bb7c0d264c142a744d11407aff67d0b1ec14 Mon Sep 17 00:00:00 2001
From: Hanjun Guo <guohanjun@huawei.com>
Date: Wed, 2 Jun 2021 17:36:50 +0800
Subject: [PATCH 2350/2658] ACPI: bus: Call kobject_put() in acpi_init() error
 path

[ Upstream commit 4ac7a817f1992103d4e68e9837304f860b5e7300 ]

Although the system will not be in a good condition or it will not
boot if acpi_bus_init() fails, it is still necessary to put the
kobject in the error path before returning to avoid leaking memory.

Signed-off-by: Hanjun Guo <guohanjun@huawei.com>
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/bus.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 521d1b28760c..d016eba51a95 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -1087,6 +1087,7 @@ static int __init acpi_init(void)
 	init_acpi_device_notify();
 	result = acpi_bus_init();
 	if (result) {
+		kobject_put(acpi_kobj);
 		disable_acpi();
 		return result;
 	}

From 2b144fe7907c5c441a5bca6681e90e8e9393e0c1 Mon Sep 17 00:00:00 2001
From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Date: Wed, 2 Jun 2021 18:05:48 +0800
Subject: [PATCH 2351/2658] platform/x86: toshiba_acpi: Fix missing error code
 in toshiba_acpi_setup_keyboard()

[ Upstream commit 28e367127718a9cb85d615a71e152f7acee41bfc ]

The error code is missing in this code scenario, add the error code
'-EINVAL' to the return value 'error'.

Eliminate the follow smatch warning:

drivers/platform/x86/toshiba_acpi.c:2834 toshiba_acpi_setup_keyboard()
warn: missing error code 'error'.

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Link: https://lore.kernel.org/r/1622628348-87035-1-git-send-email-jiapeng.chong@linux.alibaba.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/toshiba_acpi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
index 1ff95b5a429d..974d4ac78d10 100644
--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -2448,6 +2448,7 @@ static int toshiba_acpi_setup_keyboard(struct toshiba_acpi_dev *dev)
 
 	if (!dev->info_supported && !dev->system_event_supported) {
 		pr_warn("No hotkey query interface found\n");
+		error = -EINVAL;
 		goto err_remove_filter;
 	}
 

From 4fa1fa3b8fff85ec5728a0e4d4031d542ef15ccb Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 28 Jun 2021 19:33:41 -0700
Subject: [PATCH 2352/2658] ia64: mca_drv: fix incorrect array size calculation

[ Upstream commit c5f320ff8a79501bb59338278336ec43acb9d7e2 ]

gcc points out a mistake in the mca driver that goes back to before the
git history:

arch/ia64/kernel/mca_drv.c: In function 'init_record_index_pools':
arch/ia64/kernel/mca_drv.c:346:54: error: expression does not compute the number of elements in this array; element typ
e is 'int', not 'size_t' {aka 'long unsigned int'} [-Werror=sizeof-array-div]
  346 |         for (i = 1; i < sizeof sal_log_sect_min_sizes/sizeof(size_t); i++)
      |                                                      ^

This is the same as sizeof(size_t), which is two shorter than the actual
array.  Use the ARRAY_SIZE() macro to get the correct calculation instead.

Link: https://lkml.kernel.org/r/20210514214123.875971-1-arnd@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: Masahiro Yamada <masahiroy@kernel.org>
Cc: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/ia64/kernel/mca_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/ia64/kernel/mca_drv.c b/arch/ia64/kernel/mca_drv.c
index 94f8bf777afa..3503d488e9b3 100644
--- a/arch/ia64/kernel/mca_drv.c
+++ b/arch/ia64/kernel/mca_drv.c
@@ -343,7 +343,7 @@ init_record_index_pools(void)
 
 	/* - 2 - */
 	sect_min_size = sal_log_sect_min_sizes[0];
-	for (i = 1; i < sizeof sal_log_sect_min_sizes/sizeof(size_t); i++)
+	for (i = 1; i < ARRAY_SIZE(sal_log_sect_min_sizes); i++)
 		if (sect_min_size > sal_log_sect_min_sizes[i])
 			sect_min_size = sal_log_sect_min_sizes[i];
 

From c8cfcaa424b1a33f7decd515a22fb9aaba172efe Mon Sep 17 00:00:00 2001
From: Corentin Labbe <clabbe@baylibre.com>
Date: Wed, 5 May 2021 20:26:08 +0000
Subject: [PATCH 2353/2658] crypto: ixp4xx - dma_unmap the correct address

[ Upstream commit 9395c58fdddd79cdd3882132cdd04e8ac7ad525f ]

Testing ixp4xx_crypto with CONFIG_DMA_API_DEBUG lead to the following error:
DMA-API: platform ixp4xx_crypto.0: device driver tries to free DMA memory it has not allocated [device address=0x0000000000000000] [size=24 bytes]

This is due to dma_unmap using the wrong address.

Fixes: 0d44dc59b2b4 ("crypto: ixp4xx - Fix handling of chained sg buffers")
Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/ixp4xx_crypto.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index 13657105cfb9..8d0613170d57 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -334,7 +334,7 @@ static void free_buf_chain(struct device *dev, struct buffer_desc *buf,u32 phys)
 
 		buf1 = buf->next;
 		phys1 = buf->phys_next;
-		dma_unmap_single(dev, buf->phys_next, buf->buf_len, buf->dir);
+		dma_unmap_single(dev, buf->phys_addr, buf->buf_len, buf->dir);
 		dma_pool_free(buffer_pool, buf, phys);
 		buf = buf1;
 		phys = phys1;

From 38a2c50a775c4d47e00b5e3e82a3258604649b7b Mon Sep 17 00:00:00 2001
From: Zhen Lei <thunder.leizhen@huawei.com>
Date: Sat, 8 May 2021 15:00:49 +0800
Subject: [PATCH 2354/2658] crypto: ux500 - Fix error return code in
 hash_hw_final()

[ Upstream commit b01360384009ab066940b45f34880991ea7ccbfb ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 8a63b1994c50 ("crypto: ux500 - Add driver for HASH hardware")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/ux500/hash/hash_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c
index bca6b701c067..7021b5b49c03 100644
--- a/drivers/crypto/ux500/hash/hash_core.c
+++ b/drivers/crypto/ux500/hash/hash_core.c
@@ -1022,6 +1022,7 @@ static int hash_hw_final(struct ahash_request *req)
 			goto out;
 		}
 	} else if (req->nbytes == 0 && ctx->keylen > 0) {
+		ret = -EPERM;
 		dev_err(device_data->dev, "%s: Empty message with keylength > 0, NOT supported\n",
 			__func__);
 		goto out;

From c8832b1cf8381ccbbc111fb1f1b72813921cc682 Mon Sep 17 00:00:00 2001
From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Date: Sun, 14 Mar 2021 23:34:27 +0300
Subject: [PATCH 2355/2658] sata_highbank: fix deferred probing

[ Upstream commit 4a24efa16e7db02306fb5db84518bb0a7ada5a46 ]

The driver overrides the error codes returned by platform_get_irq() to
-EINVAL, so if it returns -EPROBE_DEFER, the driver would fail the probe
permanently instead of the deferred probing. Switch to propagating the
error code upstream, still checking/overriding IRQ0 as libata regards it
as "no IRQ" (thus polling) anyway...

Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Link: https://lore.kernel.org/r/105b456d-1199-f6e9-ceb7-ffc5ba551d1a@omprussia.ru
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/sata_highbank.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/ata/sata_highbank.c b/drivers/ata/sata_highbank.c
index 8638d575b2b9..77691154d2f1 100644
--- a/drivers/ata/sata_highbank.c
+++ b/drivers/ata/sata_highbank.c
@@ -483,10 +483,12 @@ static int ahci_highbank_probe(struct platform_device *pdev)
 	}
 
 	irq = platform_get_irq(pdev, 0);
-	if (irq <= 0) {
+	if (irq < 0) {
 		dev_err(dev, "no irq\n");
-		return -EINVAL;
+		return irq;
 	}
+	if (!irq)
+		return -EINVAL;
 
 	hpriv = devm_kzalloc(dev, sizeof(*hpriv), GFP_KERNEL);
 	if (!hpriv) {

From addc11ba27b3fad44850cf692cd5d1dae0de7f1c Mon Sep 17 00:00:00 2001
From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Date: Mon, 15 Mar 2021 14:46:53 +0300
Subject: [PATCH 2356/2658] pata_rb532_cf: fix deferred probing

[ Upstream commit 2d3a62fbae8e5badc2342388f65ab2191c209cc0 ]

The driver overrides the error codes returned by platform_get_irq() to
-ENOENT, so if it returns -EPROBE_DEFER, the driver would fail the probe
permanently instead of the deferred probing. Switch to propagating the
error code upstream, still checking/overriding IRQ0 as libata regards it
as "no IRQ" (thus polling) anyway...

Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Link: https://lore.kernel.org/r/771ced55-3efb-21f5-f21c-b99920aae611@omprussia.ru
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/pata_rb532_cf.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/ata/pata_rb532_cf.c b/drivers/ata/pata_rb532_cf.c
index c8b6a780a290..76c550e160f6 100644
--- a/drivers/ata/pata_rb532_cf.c
+++ b/drivers/ata/pata_rb532_cf.c
@@ -120,10 +120,12 @@ static int rb532_pata_driver_probe(struct platform_device *pdev)
 	}
 
 	irq = platform_get_irq(pdev, 0);
-	if (irq <= 0) {
+	if (irq < 0) {
 		dev_err(&pdev->dev, "no IRQ resource found\n");
-		return -ENOENT;
+		return irq;
 	}
+	if (!irq)
+		return -EINVAL;
 
 	pdata = dev_get_platdata(&pdev->dev);
 	if (!pdata) {

From 67a3ecf80d72172e03af34acaea774e943670e3d Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Fri, 30 Apr 2021 22:19:55 +0200
Subject: [PATCH 2357/2658] media: I2C: change 'RST' to "RSET" to fix multiple
 build errors

[ Upstream commit 8edcb5049ac29aa3c8acc5ef15dd4036543d747e ]

The use of an enum named 'RST' conflicts with a #define macro
named 'RST' in arch/mips/include/asm/mach-rc32434/rb.h.

The MIPS use of RST was there first (AFAICT), so change the
media/i2c/ uses of RST to be named 'RSET'.
'git grep -w RSET' does not report any naming conflicts with the
new name.

This fixes multiple build errors:

arch/mips/include/asm/mach-rc32434/rb.h:15:14: error: expected identifier before '(' token
   15 | #define RST  (1 << 15)
      |              ^
drivers/media/i2c/s5c73m3/s5c73m3.h:356:2: note: in expansion of macro 'RST'
  356 |  RST,
      |  ^~~

../arch/mips/include/asm/mach-rc32434/rb.h:15:14: error: expected identifier before '(' token
   15 | #define RST  (1 << 15)
      |              ^
../drivers/media/i2c/s5k6aa.c:180:2: note: in expansion of macro 'RST'
  180 |  RST,
      |  ^~~

../arch/mips/include/asm/mach-rc32434/rb.h:15:14: error: expected identifier before '(' token
   15 | #define RST  (1 << 15)
      |              ^
../drivers/media/i2c/s5k5baf.c:238:2: note: in expansion of macro 'RST'
  238 |  RST,
      |  ^~~

and some others that I have trimmed.

Fixes: cac47f1822fc ("[media] V4L: Add S5C73M3 camera driver")
Fixes: 8b99312b7214 ("[media] Add v4l2 subdev driver for S5K4ECGX sensor")
Fixes: 7d459937dc09 ("[media] Add driver for Samsung S5K5BAF camera sensor")
Fixes: bfa8dd3a0524 ("[media] v4l: Add v4l2 subdev driver for S5K6AAFX sensor")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: kernel test robot <lkp@intel.com>
Cc: Shawn Guo <shawnguo@kernel.org>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
Cc: Fabio Estevam <festevam@gmail.com>
Cc: NXP Linux Team <linux-imx@nxp.com>
Cc: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
Cc: Andrzej Hajda <a.hajda@samsung.com>
Cc: Sylwester Nawrocki <s.nawrocki@samsung.com>
Cc: Sangwook Lee <sangwook.lee@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/s5c73m3/s5c73m3-core.c |  6 +++---
 drivers/media/i2c/s5c73m3/s5c73m3.h      |  2 +-
 drivers/media/i2c/s5k4ecgx.c             | 10 +++++-----
 drivers/media/i2c/s5k5baf.c              |  6 +++---
 drivers/media/i2c/s5k6aa.c               | 10 +++++-----
 5 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/drivers/media/i2c/s5c73m3/s5c73m3-core.c b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
index 51b26010403c..376ffa19555d 100644
--- a/drivers/media/i2c/s5c73m3/s5c73m3-core.c
+++ b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
@@ -1393,7 +1393,7 @@ static int __s5c73m3_power_on(struct s5c73m3 *state)
 	s5c73m3_gpio_deassert(state, STBY);
 	usleep_range(100, 200);
 
-	s5c73m3_gpio_deassert(state, RST);
+	s5c73m3_gpio_deassert(state, RSET);
 	usleep_range(50, 100);
 
 	return 0;
@@ -1408,7 +1408,7 @@ static int __s5c73m3_power_off(struct s5c73m3 *state)
 {
 	int i, ret;
 
-	if (s5c73m3_gpio_assert(state, RST))
+	if (s5c73m3_gpio_assert(state, RSET))
 		usleep_range(10, 50);
 
 	if (s5c73m3_gpio_assert(state, STBY))
@@ -1613,7 +1613,7 @@ static int s5c73m3_get_platform_data(struct s5c73m3 *state)
 
 		state->mclk_frequency = pdata->mclk_frequency;
 		state->gpio[STBY] = pdata->gpio_stby;
-		state->gpio[RST] = pdata->gpio_reset;
+		state->gpio[RSET] = pdata->gpio_reset;
 		return 0;
 	}
 
diff --git a/drivers/media/i2c/s5c73m3/s5c73m3.h b/drivers/media/i2c/s5c73m3/s5c73m3.h
index 13aed59f0f5d..01f57055e20f 100644
--- a/drivers/media/i2c/s5c73m3/s5c73m3.h
+++ b/drivers/media/i2c/s5c73m3/s5c73m3.h
@@ -361,7 +361,7 @@ struct s5c73m3_ctrls {
 
 enum s5c73m3_gpio_id {
 	STBY,
-	RST,
+	RSET,
 	GPIO_NUM,
 };
 
diff --git a/drivers/media/i2c/s5k4ecgx.c b/drivers/media/i2c/s5k4ecgx.c
index 97084237275d..4959edcb76cd 100644
--- a/drivers/media/i2c/s5k4ecgx.c
+++ b/drivers/media/i2c/s5k4ecgx.c
@@ -177,7 +177,7 @@ static const char * const s5k4ecgx_supply_names[] = {
 
 enum s5k4ecgx_gpio_id {
 	STBY,
-	RST,
+	RSET,
 	GPIO_NUM,
 };
 
@@ -482,7 +482,7 @@ static int __s5k4ecgx_power_on(struct s5k4ecgx *priv)
 	if (s5k4ecgx_gpio_set_value(priv, STBY, priv->gpio[STBY].level))
 		usleep_range(30, 50);
 
-	if (s5k4ecgx_gpio_set_value(priv, RST, priv->gpio[RST].level))
+	if (s5k4ecgx_gpio_set_value(priv, RSET, priv->gpio[RSET].level))
 		usleep_range(30, 50);
 
 	return 0;
@@ -490,7 +490,7 @@ static int __s5k4ecgx_power_on(struct s5k4ecgx *priv)
 
 static int __s5k4ecgx_power_off(struct s5k4ecgx *priv)
 {
-	if (s5k4ecgx_gpio_set_value(priv, RST, !priv->gpio[RST].level))
+	if (s5k4ecgx_gpio_set_value(priv, RSET, !priv->gpio[RSET].level))
 		usleep_range(30, 50);
 
 	if (s5k4ecgx_gpio_set_value(priv, STBY, !priv->gpio[STBY].level))
@@ -878,7 +878,7 @@ static int s5k4ecgx_config_gpios(struct s5k4ecgx *priv,
 	int ret;
 
 	priv->gpio[STBY].gpio = -EINVAL;
-	priv->gpio[RST].gpio  = -EINVAL;
+	priv->gpio[RSET].gpio  = -EINVAL;
 
 	ret = s5k4ecgx_config_gpio(gpio->gpio, gpio->level, "S5K4ECGX_STBY");
 
@@ -897,7 +897,7 @@ static int s5k4ecgx_config_gpios(struct s5k4ecgx *priv,
 		s5k4ecgx_free_gpios(priv);
 		return ret;
 	}
-	priv->gpio[RST] = *gpio;
+	priv->gpio[RSET] = *gpio;
 	if (gpio_is_valid(gpio->gpio))
 		gpio_set_value(gpio->gpio, 0);
 
diff --git a/drivers/media/i2c/s5k5baf.c b/drivers/media/i2c/s5k5baf.c
index 774e0d0c94cb..a9052219a278 100644
--- a/drivers/media/i2c/s5k5baf.c
+++ b/drivers/media/i2c/s5k5baf.c
@@ -238,7 +238,7 @@ struct s5k5baf_gpio {
 
 enum s5k5baf_gpio_id {
 	STBY,
-	RST,
+	RSET,
 	NUM_GPIOS,
 };
 
@@ -973,7 +973,7 @@ static int s5k5baf_power_on(struct s5k5baf *state)
 
 	s5k5baf_gpio_deassert(state, STBY);
 	usleep_range(50, 100);
-	s5k5baf_gpio_deassert(state, RST);
+	s5k5baf_gpio_deassert(state, RSET);
 	return 0;
 
 err_reg_dis:
@@ -991,7 +991,7 @@ static int s5k5baf_power_off(struct s5k5baf *state)
 	state->apply_cfg = 0;
 	state->apply_crop = 0;
 
-	s5k5baf_gpio_assert(state, RST);
+	s5k5baf_gpio_assert(state, RSET);
 	s5k5baf_gpio_assert(state, STBY);
 
 	if (!IS_ERR(state->clock))
diff --git a/drivers/media/i2c/s5k6aa.c b/drivers/media/i2c/s5k6aa.c
index 5ac2babe123b..ca1c0568a561 100644
--- a/drivers/media/i2c/s5k6aa.c
+++ b/drivers/media/i2c/s5k6aa.c
@@ -181,7 +181,7 @@ static const char * const s5k6aa_supply_names[] = {
 
 enum s5k6aa_gpio_id {
 	STBY,
-	RST,
+	RSET,
 	GPIO_NUM,
 };
 
@@ -845,7 +845,7 @@ static int __s5k6aa_power_on(struct s5k6aa *s5k6aa)
 		ret = s5k6aa->s_power(1);
 	usleep_range(4000, 4000);
 
-	if (s5k6aa_gpio_deassert(s5k6aa, RST))
+	if (s5k6aa_gpio_deassert(s5k6aa, RSET))
 		msleep(20);
 
 	return ret;
@@ -855,7 +855,7 @@ static int __s5k6aa_power_off(struct s5k6aa *s5k6aa)
 {
 	int ret;
 
-	if (s5k6aa_gpio_assert(s5k6aa, RST))
+	if (s5k6aa_gpio_assert(s5k6aa, RSET))
 		usleep_range(100, 150);
 
 	if (s5k6aa->s_power) {
@@ -1514,7 +1514,7 @@ static int s5k6aa_configure_gpios(struct s5k6aa *s5k6aa,
 	int ret;
 
 	s5k6aa->gpio[STBY].gpio = -EINVAL;
-	s5k6aa->gpio[RST].gpio  = -EINVAL;
+	s5k6aa->gpio[RSET].gpio  = -EINVAL;
 
 	gpio = &pdata->gpio_stby;
 	if (gpio_is_valid(gpio->gpio)) {
@@ -1537,7 +1537,7 @@ static int s5k6aa_configure_gpios(struct s5k6aa *s5k6aa,
 		if (ret < 0)
 			return ret;
 
-		s5k6aa->gpio[RST] = *gpio;
+		s5k6aa->gpio[RSET] = *gpio;
 	}
 
 	return 0;

From 0154fc35dde97ab69fee9745e01bfd03b7625b19 Mon Sep 17 00:00:00 2001
From: Sergey Shtylyov <s.shtylyov@omp.ru>
Date: Tue, 18 May 2021 23:38:54 +0300
Subject: [PATCH 2358/2658] pata_octeon_cf: avoid WARN_ON() in
 ata_host_activate()

[ Upstream commit bfc1f378c8953e68ccdbfe0a8c20748427488b80 ]

Iff platform_get_irq() fails (or returns IRQ0) and thus the polling mode
has to be used, ata_host_activate() hits the WARN_ON() due to 'irq_handler'
parameter being non-NULL if the polling mode is selected.  Let's only set
the pointer to the driver's IRQ handler if platform_get_irq() returns a
valid IRQ # -- this should avoid the unnecessary WARN_ON()...

Fixes: 43f01da0f279 ("MIPS/OCTEON/ata: Convert pata_octeon_cf.c to use device tree.")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/3a241167-f84d-1d25-5b9b-be910afbe666@omp.ru
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/pata_octeon_cf.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/ata/pata_octeon_cf.c b/drivers/ata/pata_octeon_cf.c
index 27245957eee3..909de33f9158 100644
--- a/drivers/ata/pata_octeon_cf.c
+++ b/drivers/ata/pata_octeon_cf.c
@@ -909,10 +909,11 @@ static int octeon_cf_probe(struct platform_device *pdev)
 					return -EINVAL;
 				}
 
-				irq_handler = octeon_cf_interrupt;
 				i = platform_get_irq(dma_dev, 0);
-				if (i > 0)
+				if (i > 0) {
 					irq = i;
+					irq_handler = octeon_cf_interrupt;
+				}
 			}
 			of_node_put(dma_node);
 		}

From 0b4978669bb9eb67d0a632b096fa17895001b71c Mon Sep 17 00:00:00 2001
From: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Date: Sat, 20 Mar 2021 23:32:38 +0300
Subject: [PATCH 2359/2658] pata_ep93xx: fix deferred probing

[ Upstream commit 5c8121262484d99bffb598f39a0df445cecd8efb ]

The driver overrides the error codes returned by platform_get_irq() to
-ENXIO, so if it returns -EPROBE_DEFER, the driver would fail the probe
permanently instead of the deferred probing.  Propagate the error code
upstream, as it should have been done from the start...

Fixes: 2fff27512600 ("PATA host controller driver for ep93xx")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Link: https://lore.kernel.org/r/509fda88-2e0d-2cc7-f411-695d7e94b136@omprussia.ru
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/pata_ep93xx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c
index 634c814cbeda..ebdd2dfabbeb 100644
--- a/drivers/ata/pata_ep93xx.c
+++ b/drivers/ata/pata_ep93xx.c
@@ -927,7 +927,7 @@ static int ep93xx_pata_probe(struct platform_device *pdev)
 	/* INT[3] (IRQ_EP93XX_EXT3) line connected as pull down */
 	irq = platform_get_irq(pdev, 0);
 	if (irq < 0) {
-		err = -ENXIO;
+		err = irq;
 		goto err_rel_gpio;
 	}
 

From 6c56a915b883909542144d06ed2e397ae44683a2 Mon Sep 17 00:00:00 2001
From: Zhen Lei <thunder.leizhen@huawei.com>
Date: Sat, 15 May 2021 08:58:30 +0200
Subject: [PATCH 2360/2658] media: tc358743: Fix error return code in
 tc358743_probe_of()

[ Upstream commit a6b1e7093f0a099571fc8836ab4a589633f956a8 ]

When the CSI bps per lane is not in the valid range, an appropriate error
code -EINVAL should be returned. However, we currently do not explicitly
assign this error code to 'ret'. As a result, 0 was incorrectly returned.

Fixes: 256148246852 ("[media] tc358743: support probe from device tree")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/tc358743.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index 1e95fdb61041..c3befb3f5dcd 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -1761,6 +1761,7 @@ static int tc358743_probe_of(struct tc358743_state *state)
 	bps_pr_lane = 2 * endpoint->link_frequencies[0];
 	if (bps_pr_lane < 62500000U || bps_pr_lane > 1000000000U) {
 		dev_err(dev, "unsupported bps per lane: %u bps\n", bps_pr_lane);
+		ret = -EINVAL;
 		goto disable_clk;
 	}
 

From 21b1f16423621b9b71fc520a1c5602bd2a247bdd Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Date: Wed, 10 Mar 2021 19:40:43 -0600
Subject: [PATCH 2361/2658] media: siano: Fix out-of-bounds warnings in
 smscore_load_firmware_family2()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 13dfead49db07225335d4f587a560a2210391a1a ]

Rename struct sms_msg_data4 to sms_msg_data5 and increase the size of
its msg_data array from 4 to 5 elements. Notice that at some point
the 5th element of msg_data is being accessed in function
smscore_load_firmware_family2():

1006                 trigger_msg->msg_data[4] = 4; /* Task ID */

Also, there is no need for the object _trigger_msg_ of type struct
sms_msg_data *, when _msg_ can be used, directly. Notice that msg_data
in struct sms_msg_data is a one-element array, which causes multiple
out-of-bounds warnings when accessing beyond its first element
in function smscore_load_firmware_family2():

 992                 struct sms_msg_data *trigger_msg =
 993                         (struct sms_msg_data *) msg;
 994
 995                 pr_debug("sending MSG_SMS_SWDOWNLOAD_TRIGGER_REQ\n");
 996                 SMS_INIT_MSG(&msg->x_msg_header,
 997                                 MSG_SMS_SWDOWNLOAD_TRIGGER_REQ,
 998                                 sizeof(struct sms_msg_hdr) +
 999                                 sizeof(u32) * 5);
1000
1001                 trigger_msg->msg_data[0] = firmware->start_address;
1002                                         /* Entry point */
1003                 trigger_msg->msg_data[1] = 6; /* Priority */
1004                 trigger_msg->msg_data[2] = 0x200; /* Stack size */
1005                 trigger_msg->msg_data[3] = 0; /* Parameter */
1006                 trigger_msg->msg_data[4] = 4; /* Task ID */

even when enough dynamic memory is allocated for _msg_:

 929         /* PAGE_SIZE buffer shall be enough and dma aligned */
 930         msg = kmalloc(PAGE_SIZE, GFP_KERNEL | coredev->gfp_buf_flags);

but as _msg_ is casted to (struct sms_msg_data *):

 992                 struct sms_msg_data *trigger_msg =
 993                         (struct sms_msg_data *) msg;

the out-of-bounds warnings are actually valid and should be addressed.

Fix this by declaring object _msg_ of type struct sms_msg_data5 *,
which contains a 5-elements array, instead of just 4. And use
_msg_ directly, instead of creating object trigger_msg.

This helps with the ongoing efforts to enable -Warray-bounds by fixing
the following warnings:

  CC [M]  drivers/media/common/siano/smscoreapi.o
drivers/media/common/siano/smscoreapi.c: In function ‘smscore_load_firmware_family2’:
drivers/media/common/siano/smscoreapi.c:1003:24: warning: array subscript 1 is above array bounds of ‘u32[1]’ {aka ‘unsigned int[1]’} [-Warray-bounds]
 1003 |   trigger_msg->msg_data[1] = 6; /* Priority */
      |   ~~~~~~~~~~~~~~~~~~~~~^~~
In file included from drivers/media/common/siano/smscoreapi.c:12:
drivers/media/common/siano/smscoreapi.h:619:6: note: while referencing ‘msg_data’
  619 |  u32 msg_data[1];
      |      ^~~~~~~~
drivers/media/common/siano/smscoreapi.c:1004:24: warning: array subscript 2 is above array bounds of ‘u32[1]’ {aka ‘unsigned int[1]’} [-Warray-bounds]
 1004 |   trigger_msg->msg_data[2] = 0x200; /* Stack size */
      |   ~~~~~~~~~~~~~~~~~~~~~^~~
In file included from drivers/media/common/siano/smscoreapi.c:12:
drivers/media/common/siano/smscoreapi.h:619:6: note: while referencing ‘msg_data’
  619 |  u32 msg_data[1];
      |      ^~~~~~~~
drivers/media/common/siano/smscoreapi.c:1005:24: warning: array subscript 3 is above array bounds of ‘u32[1]’ {aka ‘unsigned int[1]’} [-Warray-bounds]
 1005 |   trigger_msg->msg_data[3] = 0; /* Parameter */
      |   ~~~~~~~~~~~~~~~~~~~~~^~~
In file included from drivers/media/common/siano/smscoreapi.c:12:
drivers/media/common/siano/smscoreapi.h:619:6: note: while referencing ‘msg_data’
  619 |  u32 msg_data[1];
      |      ^~~~~~~~
drivers/media/common/siano/smscoreapi.c:1006:24: warning: array subscript 4 is above array bounds of ‘u32[1]’ {aka ‘unsigned int[1]’} [-Warray-bounds]
 1006 |   trigger_msg->msg_data[4] = 4; /* Task ID */
      |   ~~~~~~~~~~~~~~~~~~~~~^~~
In file included from drivers/media/common/siano/smscoreapi.c:12:
drivers/media/common/siano/smscoreapi.h:619:6: note: while referencing ‘msg_data’
  619 |  u32 msg_data[1];
      |      ^~~~~~~~

Fixes: 018b0c6f8acb ("[media] siano: make load firmware logic to work with newer firmwares")
Co-developed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/common/siano/smscoreapi.c | 22 +++++++++-------------
 drivers/media/common/siano/smscoreapi.h |  4 ++--
 2 files changed, 11 insertions(+), 15 deletions(-)

diff --git a/drivers/media/common/siano/smscoreapi.c b/drivers/media/common/siano/smscoreapi.c
index 2a8d9a36d6f0..5cc68144771c 100644
--- a/drivers/media/common/siano/smscoreapi.c
+++ b/drivers/media/common/siano/smscoreapi.c
@@ -914,7 +914,7 @@ static int smscore_load_firmware_family2(struct smscore_device_t *coredev,
 					 void *buffer, size_t size)
 {
 	struct sms_firmware *firmware = (struct sms_firmware *) buffer;
-	struct sms_msg_data4 *msg;
+	struct sms_msg_data5 *msg;
 	u32 mem_address,  calc_checksum = 0;
 	u32 i, *ptr;
 	u8 *payload = firmware->payload;
@@ -995,24 +995,20 @@ static int smscore_load_firmware_family2(struct smscore_device_t *coredev,
 		goto exit_fw_download;
 
 	if (coredev->mode == DEVICE_MODE_NONE) {
-		struct sms_msg_data *trigger_msg =
-			(struct sms_msg_data *) msg;
-
 		pr_debug("sending MSG_SMS_SWDOWNLOAD_TRIGGER_REQ\n");
 		SMS_INIT_MSG(&msg->x_msg_header,
 				MSG_SMS_SWDOWNLOAD_TRIGGER_REQ,
-				sizeof(struct sms_msg_hdr) +
-				sizeof(u32) * 5);
+				sizeof(*msg));
 
-		trigger_msg->msg_data[0] = firmware->start_address;
+		msg->msg_data[0] = firmware->start_address;
 					/* Entry point */
-		trigger_msg->msg_data[1] = 6; /* Priority */
-		trigger_msg->msg_data[2] = 0x200; /* Stack size */
-		trigger_msg->msg_data[3] = 0; /* Parameter */
-		trigger_msg->msg_data[4] = 4; /* Task ID */
+		msg->msg_data[1] = 6; /* Priority */
+		msg->msg_data[2] = 0x200; /* Stack size */
+		msg->msg_data[3] = 0; /* Parameter */
+		msg->msg_data[4] = 4; /* Task ID */
 
-		rc = smscore_sendrequest_and_wait(coredev, trigger_msg,
-					trigger_msg->x_msg_header.msg_length,
+		rc = smscore_sendrequest_and_wait(coredev, msg,
+					msg->x_msg_header.msg_length,
 					&coredev->trigger_done);
 	} else {
 		SMS_INIT_MSG(&msg->x_msg_header, MSG_SW_RELOAD_EXEC_REQ,
diff --git a/drivers/media/common/siano/smscoreapi.h b/drivers/media/common/siano/smscoreapi.h
index 4cc39e4a8318..55d02c27f124 100644
--- a/drivers/media/common/siano/smscoreapi.h
+++ b/drivers/media/common/siano/smscoreapi.h
@@ -636,9 +636,9 @@ struct sms_msg_data2 {
 	u32 msg_data[2];
 };
 
-struct sms_msg_data4 {
+struct sms_msg_data5 {
 	struct sms_msg_hdr x_msg_header;
-	u32 msg_data[4];
+	u32 msg_data[5];
 };
 
 struct sms_data_download {

From 081eceba8a3e2dd415b6a1dea05d715f9159334f Mon Sep 17 00:00:00 2001
From: Zhen Lei <thunder.leizhen@huawei.com>
Date: Sat, 8 May 2021 10:03:21 +0800
Subject: [PATCH 2362/2658] mmc: usdhi6rol0: fix error return code in
 usdhi6_probe()

[ Upstream commit 2f9ae69e5267f53e89e296fccee291975a85f0eb ]

Fix to return a negative error code from the error handling case instead
of 0, as done elsewhere in this function.

Fixes: 75fa9ea6e3c0 ("mmc: add a driver for the Renesas usdhi6rol0 SD/SDIO host controller")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Link: https://lore.kernel.org/r/20210508020321.1677-1-thunder.leizhen@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/usdhi6rol0.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mmc/host/usdhi6rol0.c b/drivers/mmc/host/usdhi6rol0.c
index 2b6a9c6a6e96..49798a68299e 100644
--- a/drivers/mmc/host/usdhi6rol0.c
+++ b/drivers/mmc/host/usdhi6rol0.c
@@ -1751,6 +1751,7 @@ static int usdhi6_probe(struct platform_device *pdev)
 
 	version = usdhi6_read(host, USDHI6_VERSION);
 	if ((version & 0xfff) != 0xa0d) {
+		ret = -EPERM;
 		dev_err(dev, "Version not recognized %x\n", version);
 		goto e_clk_off;
 	}

From 871e8648361af9464ff237786d0650abeee1cd67 Mon Sep 17 00:00:00 2001
From: Dillon Min <dillon.minfei@gmail.com>
Date: Wed, 26 May 2021 17:18:32 +0200
Subject: [PATCH 2363/2658] media: s5p-g2d: Fix a memory leak on
 ctx->fh.m2m_ctx

[ Upstream commit 5d11e6aad1811ea293ee2996cec9124f7fccb661 ]

The m2m_ctx resources was allocated by v4l2_m2m_ctx_init() in g2d_open()
should be freed from g2d_release() when it's not used.

Fix it

Fixes: 918847341af0 ("[media] v4l: add G2D driver for s5p device family")
Signed-off-by: Dillon Min <dillon.minfei@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/s5p-g2d/g2d.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/platform/s5p-g2d/g2d.c b/drivers/media/platform/s5p-g2d/g2d.c
index 2b939555cccb..21968ef9dc45 100644
--- a/drivers/media/platform/s5p-g2d/g2d.c
+++ b/drivers/media/platform/s5p-g2d/g2d.c
@@ -282,6 +282,9 @@ static int g2d_release(struct file *file)
 	struct g2d_dev *dev = video_drvdata(file);
 	struct g2d_ctx *ctx = fh2ctx(file->private_data);
 
+	mutex_lock(&dev->mutex);
+	v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
+	mutex_unlock(&dev->mutex);
 	v4l2_ctrl_handler_free(&ctx->ctrl_handler);
 	v4l2_fh_del(&ctx->fh);
 	v4l2_fh_exit(&ctx->fh);

From e1148eafc4cadc5e0aac9210cd71f98e54c1d69f Mon Sep 17 00:00:00 2001
From: Mirko Vogt <mirko-dev|linux@nanl.de>
Date: Mon, 14 Jun 2021 16:45:07 +0200
Subject: [PATCH 2364/2658] spi: spi-sun6i: Fix chipselect/clock bug

[ Upstream commit 0d7993b234c9fad8cb6bec6adfaa74694ba85ecb ]

The current sun6i SPI implementation initializes the transfer too early,
resulting in SCK going high before the transfer. When using an additional
(gpio) chipselect with sun6i, the chipselect is asserted at a time when
clock is high, making the SPI transfer fail.

This is due to SUN6I_GBL_CTL_BUS_ENABLE being written into
SUN6I_GBL_CTL_REG at an early stage. Moving that to the transfer
function, hence, right before the transfer starts, mitigates that
problem.

Fixes: 3558fe900e8af (spi: sunxi: Add Allwinner A31 SPI controller driver)
Signed-off-by: Mirko Vogt <mirko-dev|linux@nanl.de>
Signed-off-by: Ralf Schlatterbeck <rsc@runtux.com>
Link: https://lore.kernel.org/r/20210614144507.y3udezjfbko7eavv@runtux.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-sun6i.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c
index 48888ab630c2..079bdc4e65ff 100644
--- a/drivers/spi/spi-sun6i.c
+++ b/drivers/spi/spi-sun6i.c
@@ -249,6 +249,10 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
 	}
 
 	sun6i_spi_write(sspi, SUN6I_CLK_CTL_REG, reg);
+	/* Finally enable the bus - doing so before might raise SCK to HIGH */
+	reg = sun6i_spi_read(sspi, SUN6I_GBL_CTL_REG);
+	reg |= SUN6I_GBL_CTL_BUS_ENABLE;
+	sun6i_spi_write(sspi, SUN6I_GBL_CTL_REG, reg);
 
 	/* Setup the transfer now... */
 	if (sspi->tx_buf)
@@ -332,7 +336,7 @@ static int sun6i_spi_runtime_resume(struct device *dev)
 	}
 
 	sun6i_spi_write(sspi, SUN6I_GBL_CTL_REG,
-			SUN6I_GBL_CTL_BUS_ENABLE | SUN6I_GBL_CTL_MASTER | SUN6I_GBL_CTL_TP);
+			SUN6I_GBL_CTL_MASTER | SUN6I_GBL_CTL_TP);
 
 	return 0;
 

From 4f9555c8942fc28190cf6f1ffa478d2da3694444 Mon Sep 17 00:00:00 2001
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Thu, 17 Jun 2021 15:57:12 +0800
Subject: [PATCH 2365/2658] crypto: nx - Fix RCU warning in nx842_OF_upd_status

[ Upstream commit 2a96726bd0ccde4f12b9b9a9f61f7b1ac5af7e10 ]

The function nx842_OF_upd_status triggers a sparse RCU warning when
it directly dereferences the RCU-protected devdata.  This appears
to be an accident as there was another variable of the same name
that was passed in from the caller.

After it was removed (because the main purpose of using it, to
update the status member was itself removed) the global variable
unintenionally stood in as its replacement.

This patch restores the devdata parameter.

Fixes: 90fd73f912f0 ("crypto: nx - remove pSeries NX 'status' field")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/nx/nx-842-pseries.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/nx/nx-842-pseries.c b/drivers/crypto/nx/nx-842-pseries.c
index 2e5b4004f0ee..1b8c87770645 100644
--- a/drivers/crypto/nx/nx-842-pseries.c
+++ b/drivers/crypto/nx/nx-842-pseries.c
@@ -553,13 +553,15 @@ static int nx842_OF_set_defaults(struct nx842_devdata *devdata)
  * The status field indicates if the device is enabled when the status
  * is 'okay'.  Otherwise the device driver will be disabled.
  *
- * @prop - struct property point containing the maxsyncop for the update
+ * @devdata: struct nx842_devdata to use for dev_info
+ * @prop: struct property point containing the maxsyncop for the update
  *
  * Returns:
  *  0 - Device is available
  *  -ENODEV - Device is not available
  */
-static int nx842_OF_upd_status(struct property *prop)
+static int nx842_OF_upd_status(struct nx842_devdata *devdata,
+			       struct property *prop)
 {
 	const char *status = (const char *)prop->value;
 
@@ -773,7 +775,7 @@ static int nx842_OF_upd(struct property *new_prop)
 		goto out;
 
 	/* Perform property updates */
-	ret = nx842_OF_upd_status(status);
+	ret = nx842_OF_upd_status(new_devdata, status);
 	if (ret)
 		goto error_out;
 

From 33a53349d5c1e94d44981771851915417ff4c20c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= <kw@linux.com>
Date: Thu, 3 Jun 2021 17:12:01 +0000
Subject: [PATCH 2366/2658] ACPI: sysfs: Fix a buffer overrun problem with
 description_show()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 888be6067b97132c3992866bbcf647572253ab3f ]

Currently, a device description can be obtained using ACPI, if the _STR
method exists for a particular device, and then exposed to the userspace
via a sysfs object as a string value.

If the _STR method is available for a given device then the data
(usually a Unicode string) is read and stored in a buffer (of the
ACPI_TYPE_BUFFER type) with a pointer to said buffer cached in the
struct acpi_device_pnp for later access.

The description_show() function is responsible for exposing the device
description to the userspace via a corresponding sysfs object and
internally calls the utf16s_to_utf8s() function with a pointer to the
buffer that contains the Unicode string so that it can be converted from
UTF16 encoding to UTF8 and thus allowing for the value to be safely
stored and later displayed.

When invoking the utf16s_to_utf8s() function, the description_show()
function also sets a limit of the data that can be saved into a provided
buffer as a result of the character conversion to be a total of
PAGE_SIZE, and upon completion, the utf16s_to_utf8s() function returns
an integer value denoting the number of bytes that have been written
into the provided buffer.

Following the execution of the utf16s_to_utf8s() a newline character
will be added at the end of the resulting buffer so that when the value
is read in the userspace through the sysfs object then it would include
newline making it more accessible when working with the sysfs file
system in the shell, etc.  Normally, this wouldn't be a problem, but if
the function utf16s_to_utf8s() happens to return the number of bytes
written to be precisely PAGE_SIZE, then we would overrun the buffer and
write the newline character outside the allotted space which can have
undefined consequences or result in a failure.

To fix this buffer overrun, ensure that there always is enough space
left for the newline character to be safely appended.

Fixes: d1efe3c324ea ("ACPI: Add new sysfs interface to export device description")
Signed-off-by: Krzysztof Wilczyński <kw@linux.com>
Reviewed-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/device_sysfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c
index 139ee989b0d0..c201aaf287dc 100644
--- a/drivers/acpi/device_sysfs.c
+++ b/drivers/acpi/device_sysfs.c
@@ -450,7 +450,7 @@ static ssize_t description_show(struct device *dev,
 		(wchar_t *)acpi_dev->pnp.str_obj->buffer.pointer,
 		acpi_dev->pnp.str_obj->buffer.length,
 		UTF16_LITTLE_ENDIAN, buf,
-		PAGE_SIZE);
+		PAGE_SIZE - 1);
 
 	buf[result++] = '\n';
 

From 5083ef26c848ec6c68faee4662dc64189ab74644 Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Mon, 10 May 2021 19:39:27 +0300
Subject: [PATCH 2367/2658] net: pch_gbe: Propagate error from
 devm_gpio_request_one()

[ Upstream commit 9e3617a7b84512bf96c04f9cf82d1a7257d33794 ]

If GPIO controller is not available yet we need to defer
the probe of GBE until provider will become available.

While here, drop GPIOF_EXPORT because it's deprecated and
may not be available.

Fixes: f1a26fdf5944 ("pch_gbe: Add MinnowBoard support")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Tested-by: Flavio Suligoi <f.suligoi@asem.it>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
index 3b98b263bad0..a7ec9492d126 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
@@ -2625,9 +2625,13 @@ static int pch_gbe_probe(struct pci_dev *pdev,
 	adapter->pdev = pdev;
 	adapter->hw.back = adapter;
 	adapter->hw.reg = pcim_iomap_table(pdev)[PCH_GBE_PCI_BAR];
+
 	adapter->pdata = (struct pch_gbe_privdata *)pci_id->driver_data;
-	if (adapter->pdata && adapter->pdata->platform_init)
-		adapter->pdata->platform_init(pdev);
+	if (adapter->pdata && adapter->pdata->platform_init) {
+		ret = adapter->pdata->platform_init(pdev);
+		if (ret)
+			goto err_free_netdev;
+	}
 
 	adapter->ptp_pdev = pci_get_bus_and_slot(adapter->pdev->bus->number,
 					       PCI_DEVFN(12, 4));
@@ -2717,7 +2721,7 @@ static int pch_gbe_probe(struct pci_dev *pdev,
  */
 static int pch_gbe_minnow_platform_init(struct pci_dev *pdev)
 {
-	unsigned long flags = GPIOF_DIR_OUT | GPIOF_INIT_HIGH | GPIOF_EXPORT;
+	unsigned long flags = GPIOF_OUT_INIT_HIGH;
 	unsigned gpio = MINNOW_PHY_RESET_GPIO;
 	int ret;
 

From 1e35333432fe0f6b3eee009fcab2ecb5a15dbdc7 Mon Sep 17 00:00:00 2001
From: Zhen Lei <thunder.leizhen@huawei.com>
Date: Fri, 28 May 2021 16:55:55 +0800
Subject: [PATCH 2368/2658] ehea: fix error return code in ehea_restart_qps()

[ Upstream commit 015dbf5662fd689d581c0bc980711b073ca09a1a ]

Fix to return -EFAULT from the error handling case instead of 0, as done
elsewhere in this function.

By the way, when get_zeroed_page() fails, directly return -ENOMEM to
simplify code.

Fixes: 2c69448bbced ("ehea: DLPAR memory add fix")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Link: https://lore.kernel.org/r/20210528085555.9390-1-thunder.leizhen@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/ibm/ehea/ehea_main.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index efe84ca20da7..43fc6d370457 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -2654,10 +2654,8 @@ static int ehea_restart_qps(struct net_device *dev)
 	u16 dummy16 = 0;
 
 	cb0 = (void *)get_zeroed_page(GFP_KERNEL);
-	if (!cb0) {
-		ret = -ENOMEM;
-		goto out;
-	}
+	if (!cb0)
+		return -ENOMEM;
 
 	for (i = 0; i < (port->num_def_qps); i++) {
 		struct ehea_port_res *pr =  &port->port_res[i];
@@ -2677,6 +2675,7 @@ static int ehea_restart_qps(struct net_device *dev)
 					    cb0);
 		if (hret != H_SUCCESS) {
 			netdev_err(dev, "query_ehea_qp failed (1)\n");
+			ret = -EFAULT;
 			goto out;
 		}
 
@@ -2689,6 +2688,7 @@ static int ehea_restart_qps(struct net_device *dev)
 					     &dummy64, &dummy16, &dummy16);
 		if (hret != H_SUCCESS) {
 			netdev_err(dev, "modify_ehea_qp failed (1)\n");
+			ret = -EFAULT;
 			goto out;
 		}
 
@@ -2697,6 +2697,7 @@ static int ehea_restart_qps(struct net_device *dev)
 					    cb0);
 		if (hret != H_SUCCESS) {
 			netdev_err(dev, "query_ehea_qp failed (2)\n");
+			ret = -EFAULT;
 			goto out;
 		}
 

From e7ca6a7179fbe7b82db11cf94ec610f3b3b7574d Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Tue, 8 Jun 2021 17:13:13 +0100
Subject: [PATCH 2369/2658] drm: qxl: ensure surf.data is ininitialized

[ Upstream commit fbbf23ddb2a1cc0c12c9f78237d1561c24006f50 ]

The object surf is not fully initialized and the uninitialized
field surf.data is being copied by the call to qxl_bo_create
via the call to qxl_gem_object_create. Set surf.data to zero
to ensure garbage data from the stack is not being copied.

Addresses-Coverity: ("Uninitialized scalar variable")
Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20210608161313.161922-1-colin.king@canonical.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/qxl/qxl_dumb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/qxl/qxl_dumb.c b/drivers/gpu/drm/qxl/qxl_dumb.c
index d34bb4130ff0..5f757328fced 100644
--- a/drivers/gpu/drm/qxl/qxl_dumb.c
+++ b/drivers/gpu/drm/qxl/qxl_dumb.c
@@ -57,6 +57,8 @@ int qxl_mode_dumb_create(struct drm_file *file_priv,
 	surf.height = args->height;
 	surf.stride = pitch;
 	surf.format = format;
+	surf.data = 0;
+
 	r = qxl_gem_object_create_with_handle(qdev, file_priv,
 					      QXL_GEM_DOMAIN_VRAM,
 					      args->size, &surf, &qobj,

From cd9d8b1f4c636368a88940007d2e210931e9ad40 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Mon, 31 May 2021 17:41:28 +0300
Subject: [PATCH 2370/2658] wireless: carl9170: fix LEDS build errors &
 warnings

[ Upstream commit 272fdc0c4542fad173b44965be02a16d6db95499 ]

kernel test robot reports over 200 build errors and warnings
that are due to this Kconfig problem when CARL9170=m,
MAC80211=y, and LEDS_CLASS=m.

WARNING: unmet direct dependencies detected for MAC80211_LEDS
  Depends on [n]: NET [=y] && WIRELESS [=y] && MAC80211 [=y] && (LEDS_CLASS [=m]=y || LEDS_CLASS [=m]=MAC80211 [=y])
  Selected by [m]:
  - CARL9170_LEDS [=y] && NETDEVICES [=y] && WLAN [=y] && WLAN_VENDOR_ATH [=y] && CARL9170 [=m]

CARL9170_LEDS selects MAC80211_LEDS even though its kconfig
dependencies are not met. This happens because 'select' does not follow
any Kconfig dependency chains.

Fix this by making CARL9170_LEDS depend on MAC80211_LEDS, where
the latter supplies any needed dependencies on LEDS_CLASS.

Fixes: 1d7e1e6b1b8ed ("carl9170: Makefile, Kconfig files and MAINTAINERS")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: kernel test robot <lkp@intel.com>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: Christian Lamparter <chunkeey@googlemail.com>
Cc: linux-wireless@vger.kernel.org
Cc: Arnd Bergmann <arnd@arndb.de>
Suggested-by: Christian Lamparter <chunkeey@googlemail.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210530031134.23274-1-rdunlap@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/carl9170/Kconfig | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/ath/carl9170/Kconfig b/drivers/net/wireless/ath/carl9170/Kconfig
index 1a796e5f69ec..3fc87997fcb3 100644
--- a/drivers/net/wireless/ath/carl9170/Kconfig
+++ b/drivers/net/wireless/ath/carl9170/Kconfig
@@ -17,13 +17,11 @@ config CARL9170
 
 config CARL9170_LEDS
 	bool "SoftLED Support"
-	depends on CARL9170
-	select MAC80211_LEDS
-	select LEDS_CLASS
-	select NEW_LEDS
 	default y
+	depends on CARL9170
+	depends on MAC80211_LEDS
 	help
-	  This option is necessary, if you want your device' LEDs to blink
+	  This option is necessary, if you want your device's LEDs to blink.
 
 	  Say Y, unless you need the LEDs for firmware debugging.
 

From 1e1a34bf7df39172ad5c80ad27a8cce6911b1b21 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Wed, 12 May 2021 22:58:30 +0200
Subject: [PATCH 2371/2658] brcmsmac: mac80211_if: Fix a resource leak in an
 error handling path

[ Upstream commit 9a25344d5177c2b9285532236dc3d10a091f39a8 ]

If 'brcms_attach()' fails, we must undo the previous 'ieee80211_alloc_hw()'
as already done in the remove function.

Fixes: 5b435de0d786 ("net: wireless: add brcm80211 drivers")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/8fbc171a1a493b38db5a6f0873c6021fca026a6c.1620852921.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index a4e1eec96c60..e3a500fb4e3c 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -1221,6 +1221,7 @@ static int brcms_bcma_probe(struct bcma_device *pdev)
 {
 	struct brcms_info *wl;
 	struct ieee80211_hw *hw;
+	int ret;
 
 	dev_info(&pdev->dev, "mfg %x core %x rev %d class %d irq %d\n",
 		 pdev->id.manuf, pdev->id.id, pdev->id.rev, pdev->id.class,
@@ -1245,11 +1246,16 @@ static int brcms_bcma_probe(struct bcma_device *pdev)
 	wl = brcms_attach(pdev);
 	if (!wl) {
 		pr_err("%s: brcms_attach failed!\n", __func__);
-		return -ENODEV;
+		ret = -ENODEV;
+		goto err_free_ieee80211;
 	}
 	brcms_led_register(wl);
 
 	return 0;
+
+err_free_ieee80211:
+	ieee80211_free_hw(hw);
+	return ret;
 }
 
 static int brcms_suspend(struct bcma_device *pdev)

From bc2200eda9f456b7ebf801c15632370db6fd89b5 Mon Sep 17 00:00:00 2001
From: Yang Li <yang.lee@linux.alibaba.com>
Date: Tue, 25 May 2021 18:46:17 +0800
Subject: [PATCH 2372/2658] ath10k: Fix an error code in ath10k_add_interface()

[ Upstream commit e9ca70c735ce66fc6a0e02c8b6958434f74ef8de ]

When the code execute this if statement, the value of ret is 0.
However, we can see from the ath10k_warn() log that the value of
ret should be -EINVAL.

Clean up smatch warning:

drivers/net/wireless/ath/ath10k/mac.c:5596 ath10k_add_interface() warn:
missing error code 'ret'

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Fixes: ccec9038c721 ("ath10k: enable raw encap mode and software crypto engine")
Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1621939577-62218-1-git-send-email-yang.lee@linux.alibaba.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/mac.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index a362832a5f13..52ede0eda371 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -4965,6 +4965,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
 
 	if (arvif->nohwcrypt &&
 	    !test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags)) {
+		ret = -EINVAL;
 		ath10k_warn(ar, "cryptmode module param needed for sw crypto\n");
 		goto err;
 	}

From bc39ad74b86ecb9350d2ff840050c859dadadcab Mon Sep 17 00:00:00 2001
From: Liu Shixin <liushixin2@huawei.com>
Date: Tue, 15 Jun 2021 10:14:44 +0800
Subject: [PATCH 2373/2658] netlabel: Fix memory leak in netlbl_mgmt_add_common

[ Upstream commit b8f6b0522c298ae9267bd6584e19b942a0636910 ]

Hulk Robot reported memory leak in netlbl_mgmt_add_common.
The problem is non-freed map in case of netlbl_domhsh_add() failed.

BUG: memory leak
unreferenced object 0xffff888100ab7080 (size 96):
  comm "syz-executor537", pid 360, jiffies 4294862456 (age 22.678s)
  hex dump (first 32 bytes):
    05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01  ................
  backtrace:
    [<0000000008b40026>] netlbl_mgmt_add_common.isra.0+0xb2a/0x1b40
    [<000000003be10950>] netlbl_mgmt_add+0x271/0x3c0
    [<00000000c70487ed>] genl_family_rcv_msg_doit.isra.0+0x20e/0x320
    [<000000001f2ff614>] genl_rcv_msg+0x2bf/0x4f0
    [<0000000089045792>] netlink_rcv_skb+0x134/0x3d0
    [<0000000020e96fdd>] genl_rcv+0x24/0x40
    [<0000000042810c66>] netlink_unicast+0x4a0/0x6a0
    [<000000002e1659f0>] netlink_sendmsg+0x789/0xc70
    [<000000006e43415f>] sock_sendmsg+0x139/0x170
    [<00000000680a73d7>] ____sys_sendmsg+0x658/0x7d0
    [<0000000065cbb8af>] ___sys_sendmsg+0xf8/0x170
    [<0000000019932b6c>] __sys_sendmsg+0xd3/0x190
    [<00000000643ac172>] do_syscall_64+0x37/0x90
    [<000000009b79d6dc>] entry_SYSCALL_64_after_hwframe+0x44/0xae

Fixes: 63c416887437 ("netlabel: Add network address selectors to the NetLabel/LSM domain mapping")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Liu Shixin <liushixin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netlabel/netlabel_mgmt.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index 13f777f20995..5f1218dc9162 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -92,6 +92,7 @@ static const struct nla_policy netlbl_mgmt_genl_policy[NLBL_MGMT_A_MAX + 1] = {
 static int netlbl_mgmt_add_common(struct genl_info *info,
 				  struct netlbl_audit *audit_info)
 {
+	void *pmap = NULL;
 	int ret_val = -EINVAL;
 	struct netlbl_domaddr_map *addrmap = NULL;
 	struct cipso_v4_doi *cipsov4 = NULL;
@@ -165,6 +166,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
 			ret_val = -ENOMEM;
 			goto add_free_addrmap;
 		}
+		pmap = map;
 		map->list.addr = addr->s_addr & mask->s_addr;
 		map->list.mask = mask->s_addr;
 		map->list.valid = 1;
@@ -173,10 +175,8 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
 			map->def.cipso = cipsov4;
 
 		ret_val = netlbl_af4list_add(&map->list, &addrmap->list4);
-		if (ret_val != 0) {
-			kfree(map);
-			goto add_free_addrmap;
-		}
+		if (ret_val != 0)
+			goto add_free_map;
 
 		entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
 		entry->def.addrsel = addrmap;
@@ -212,6 +212,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
 			ret_val = -ENOMEM;
 			goto add_free_addrmap;
 		}
+		pmap = map;
 		map->list.addr = *addr;
 		map->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
 		map->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
@@ -222,10 +223,8 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
 		map->def.type = entry->def.type;
 
 		ret_val = netlbl_af6list_add(&map->list, &addrmap->list6);
-		if (ret_val != 0) {
-			kfree(map);
-			goto add_free_addrmap;
-		}
+		if (ret_val != 0)
+			goto add_free_map;
 
 		entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
 		entry->def.addrsel = addrmap;
@@ -234,10 +233,12 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
 
 	ret_val = netlbl_domhsh_add(entry, audit_info);
 	if (ret_val != 0)
-		goto add_free_addrmap;
+		goto add_free_map;
 
 	return 0;
 
+add_free_map:
+	kfree(pmap);
 add_free_addrmap:
 	kfree(addrmap);
 add_doi_put_def:

From 62464827d443b4210045de18890b1a918db7a885 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 10 Jun 2021 20:20:30 +0200
Subject: [PATCH 2374/2658] netfilter: nft_exthdr: check for IPv6 packet before
 further processing

[ Upstream commit cdd73cc545c0fb9b1a1f7b209f4f536e7990cff4 ]

ipv6_find_hdr() does not validate that this is an IPv6 packet. Add a
sanity check for calling ipv6_find_hdr() to make sure an IPv6 packet
is passed for parsing.

Fixes: 96518518cc41 ("netfilter: add nftables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nft_exthdr.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index ba7aed13e174..a81f6bf42d1f 100644
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -34,6 +34,9 @@ static void nft_exthdr_eval(const struct nft_expr *expr,
 	unsigned int offset = 0;
 	int err;
 
+	if (pkt->skb->protocol != htons(ETH_P_IPV6))
+		goto err;
+
 	err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
 	if (err < 0)
 		goto err;

From 85b664fd303bc7ad81203a35c80b70d027d27244 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Fri, 18 Jun 2021 17:57:31 +0300
Subject: [PATCH 2375/2658] net: ethernet: aeroflex: fix UAF in greth_of_remove

[ Upstream commit e3a5de6d81d8b2199935c7eb3f7d17a50a7075b7 ]

static int greth_of_remove(struct platform_device *of_dev)
{
...
	struct greth_private *greth = netdev_priv(ndev);
...
	unregister_netdev(ndev);
	free_netdev(ndev);

	of_iounmap(&of_dev->resource[0], greth->regs, resource_size(&of_dev->resource[0]));
...
}

greth is netdev private data, but it is used
after free_netdev(). It can cause use-after-free when accessing greth
pointer. So, fix it by moving free_netdev() after of_iounmap()
call.

Fixes: d4c41139df6e ("net: Add Aeroflex Gaisler 10/100/1G Ethernet MAC driver")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/aeroflex/greth.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/aeroflex/greth.c b/drivers/net/ethernet/aeroflex/greth.c
index 20bf55dbd76f..e3ca8abb14f4 100644
--- a/drivers/net/ethernet/aeroflex/greth.c
+++ b/drivers/net/ethernet/aeroflex/greth.c
@@ -1579,10 +1579,11 @@ static int greth_of_remove(struct platform_device *of_dev)
 	mdiobus_unregister(greth->mdio);
 
 	unregister_netdev(ndev);
-	free_netdev(ndev);
 
 	of_iounmap(&of_dev->resource[0], greth->regs, resource_size(&of_dev->resource[0]));
 
+	free_netdev(ndev);
+
 	return 0;
 }
 

From da015c34f6d89130b7518121dfcd57cde3d54b9d Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Fri, 18 Jun 2021 19:14:31 +0300
Subject: [PATCH 2376/2658] net: ethernet: ezchip: fix UAF in nps_enet_remove

[ Upstream commit e4b8700e07a86e8eab6916aa5c5ba99042c34089 ]

priv is netdev private data, but it is used
after free_netdev(). It can cause use-after-free when accessing priv
pointer. So, fix it by moving free_netdev() after netif_napi_del()
call.

Fixes: 0dd077093636 ("NET: Add ezchip ethernet driver")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/ezchip/nps_enet.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/ezchip/nps_enet.c b/drivers/net/ethernet/ezchip/nps_enet.c
index b1026689b78f..73d2bc349b2f 100644
--- a/drivers/net/ethernet/ezchip/nps_enet.c
+++ b/drivers/net/ethernet/ezchip/nps_enet.c
@@ -621,8 +621,8 @@ static s32 nps_enet_remove(struct platform_device *pdev)
 	struct nps_enet_priv *priv = netdev_priv(ndev);
 
 	unregister_netdev(ndev);
-	free_netdev(ndev);
 	netif_napi_del(&priv->napi);
+	free_netdev(ndev);
 
 	return 0;
 }

From a0441b0144c47fce9fba4b27d543b60dfd158cdb Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Fri, 18 Jun 2021 19:14:47 +0300
Subject: [PATCH 2377/2658] net: ethernet: ezchip: fix error handling

[ Upstream commit 0de449d599594f5472e00267d651615c7f2c6c1d ]

As documented at drivers/base/platform.c for platform_get_irq:

 * Gets an IRQ for a platform device and prints an error message if finding the
 * IRQ fails. Device drivers should check the return value for errors so as to
 * not pass a negative integer value to the request_irq() APIs.

So, the driver should check that platform_get_irq() return value
is _negative_, not that it's equal to zero, because -ENXIO (return
value from request_irq() if irq was not found) will
pass this check and it leads to passing negative irq to request_irq()

Fixes: 0dd077093636 ("NET: Add ezchip ethernet driver")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/ezchip/nps_enet.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/ezchip/nps_enet.c b/drivers/net/ethernet/ezchip/nps_enet.c
index 73d2bc349b2f..2cb20d8e6bdf 100644
--- a/drivers/net/ethernet/ezchip/nps_enet.c
+++ b/drivers/net/ethernet/ezchip/nps_enet.c
@@ -586,7 +586,7 @@ static s32 nps_enet_probe(struct platform_device *pdev)
 
 	/* Get IRQ number */
 	priv->irq = platform_get_irq(pdev, 0);
-	if (!priv->irq) {
+	if (priv->irq < 0) {
 		dev_err(dev, "failed to retrieve <irq Rx-Tx> value from device tree\n");
 		err = -ENODEV;
 		goto out_netdev;

From 2721937e2a7d94e29c0391e19d21c2696ff6df2d Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Mon, 21 Jun 2021 07:44:17 -0700
Subject: [PATCH 2378/2658] vxlan: add missing rcu_read_lock() in
 neigh_reduce()

[ Upstream commit 85e8b032d6ebb0f698a34dd22c2f13443d905888 ]

syzbot complained in neigh_reduce(), because rcu_read_lock_bh()
is treated differently than rcu_read_lock()

WARNING: suspicious RCU usage
5.13.0-rc6-syzkaller #0 Not tainted
-----------------------------
include/net/addrconf.h:313 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
3 locks held by kworker/0:0/5:
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:617 [inline]
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
 #0: ffff888011064d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x871/0x1600 kernel/workqueue.c:2247
 #1: ffffc90000ca7da8 ((work_completion)(&port->wq)){+.+.}-{0:0}, at: process_one_work+0x8a5/0x1600 kernel/workqueue.c:2251
 #2: ffffffff8bf795c0 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x1da/0x3130 net/core/dev.c:4180

stack backtrace:
CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.13.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events ipvlan_process_multicast
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x141/0x1d7 lib/dump_stack.c:120
 __in6_dev_get include/net/addrconf.h:313 [inline]
 __in6_dev_get include/net/addrconf.h:311 [inline]
 neigh_reduce drivers/net/vxlan.c:2167 [inline]
 vxlan_xmit+0x34d5/0x4c30 drivers/net/vxlan.c:2919
 __netdev_start_xmit include/linux/netdevice.h:4944 [inline]
 netdev_start_xmit include/linux/netdevice.h:4958 [inline]
 xmit_one net/core/dev.c:3654 [inline]
 dev_hard_start_xmit+0x1eb/0x920 net/core/dev.c:3670
 __dev_queue_xmit+0x2133/0x3130 net/core/dev.c:4246
 ipvlan_process_multicast+0xa99/0xd70 drivers/net/ipvlan/ipvlan_core.c:287
 process_one_work+0x98d/0x1600 kernel/workqueue.c:2276
 worker_thread+0x64c/0x1120 kernel/workqueue.c:2422
 kthread+0x3b1/0x4a0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Fixes: f564f45c4518 ("vxlan: add ipv6 proxy support")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/vxlan.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 84c4ce77c8f0..f297f473c511 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1549,6 +1549,7 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb)
 	struct neighbour *n;
 	struct inet6_dev *in6_dev;
 
+	rcu_read_lock();
 	in6_dev = __in6_dev_get(dev);
 	if (!in6_dev)
 		goto out;
@@ -1605,6 +1606,7 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb)
 	}
 
 out:
+	rcu_read_unlock();
 	consume_skb(skb);
 	return NETDEV_TX_OK;
 }

From d1fa126e245eef6a4a62c626e6f485659d7391f3 Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Sun, 28 Feb 2021 19:50:58 +0800
Subject: [PATCH 2379/2658] i40e: Fix error handling in i40e_vsi_open

[ Upstream commit 9c04cfcd4aad232e36306cdc5c74cd9fc9148a7e ]

When vsi->type == I40E_VSI_FDIR, we have caught the return value of
i40e_vsi_request_irq() but without further handling. Check and execute
memory clean on failure just like the other i40e_vsi_request_irq().

Fixes: 8a9eb7d3cbcab ("i40e: rework fdir setup and teardown")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40e/i40e_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 8bdc17658f3f..d6d4faa5c542 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -5409,6 +5409,8 @@ int i40e_vsi_open(struct i40e_vsi *vsi)
 			 dev_driver_string(&pf->pdev->dev),
 			 dev_name(&pf->pdev->dev));
 		err = i40e_vsi_request_irq(vsi, int_name);
+		if (err)
+			goto err_setup_rx;
 
 	} else {
 		err = -EINVAL;

From 77534f77c613abb0438c6f3cf3aa3604f2605bab Mon Sep 17 00:00:00 2001
From: Muchun Song <songmuchun@bytedance.com>
Date: Fri, 2 Apr 2021 17:11:45 +0800
Subject: [PATCH 2380/2658] writeback: fix obtain a reference to a freeing
 memcg css

[ Upstream commit 8b0ed8443ae6458786580d36b7d5f8125535c5d4 ]

The caller of wb_get_create() should pin the memcg, because
wb_get_create() relies on this guarantee. The rcu read lock
only can guarantee that the memcg css returned by css_from_id()
cannot be released, but the reference of the memcg can be zero.

  rcu_read_lock()
  memcg_css = css_from_id()
  wb_get_create(memcg_css)
      cgwb_create(memcg_css)
          // css_get can change the ref counter from 0 back to 1
          css_get(memcg_css)
  rcu_read_unlock()

Fix it by holding a reference to the css before calling
wb_get_create(). This is not a problem I encountered in the
real world. Just the result of a code review.

Fixes: 682aa8e1a6a1 ("writeback: implement unlocked_inode_to_wb transaction and use it for stat updates")
Link: https://lore.kernel.org/r/20210402091145.80635-1-songmuchun@bytedance.com
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fs-writeback.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 958a1bd0b5fc..0ce7ff7a2ce8 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -512,9 +512,14 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
 	/* find and pin the new wb */
 	rcu_read_lock();
 	memcg_css = css_from_id(new_wb_id, &memory_cgrp_subsys);
-	if (memcg_css)
-		isw->new_wb = wb_get_create(bdi, memcg_css, GFP_ATOMIC);
+	if (memcg_css && !css_tryget(memcg_css))
+		memcg_css = NULL;
 	rcu_read_unlock();
+	if (!memcg_css)
+		goto out_free;
+
+	isw->new_wb = wb_get_create(bdi, memcg_css, GFP_ATOMIC);
+	css_put(memcg_css);
 	if (!isw->new_wb)
 		goto out_free;
 

From 7de45451793e7e0dc8902cafb1de3ddf33475fb3 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sun, 9 May 2021 19:22:33 +0200
Subject: [PATCH 2381/2658] tty: nozomi: Fix a resource leak in an error
 handling function

[ Upstream commit 31a9a318255960d32ae183e95d0999daf2418608 ]

A 'request_irq()' call is not balanced by a corresponding 'free_irq()' in
the error handling path, as already done in the remove function.

Add it.

Fixes: 9842c38e9176 ("kfifo: fix warn_unused_result")
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/4f0d2b3038e82f081d370ccb0cade3ad88463fe7.1620580838.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/nozomi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/tty/nozomi.c b/drivers/tty/nozomi.c
index 5cc80b80c82b..880cfc780e67 100644
--- a/drivers/tty/nozomi.c
+++ b/drivers/tty/nozomi.c
@@ -1479,6 +1479,7 @@ static int nozomi_card_init(struct pci_dev *pdev,
 		tty_unregister_device(ntty_driver, dc->index_start + i);
 		tty_port_destroy(&dc->port[i].port);
 	}
+	free_irq(pdev->irq, dc);
 err_free_kfifo:
 	for (i = 0; i < MAX_PORT; i++)
 		kfifo_free(&dc->port[i].fifo_ul);

From 0ac5321cccf1f28e82d34070e59f50a964023101 Mon Sep 17 00:00:00 2001
From: Nuno Sa <nuno.sa@analog.com>
Date: Thu, 22 Apr 2021 12:19:03 +0200
Subject: [PATCH 2382/2658] iio: adis_buffer: do not return ints in irq
 handlers

[ Upstream commit d877539ad8e8fdde9af69887055fec6402be1a13 ]

On an IRQ handler we should not return normal error codes as 'irqreturn_t'
is expected.

Not necessarily stable material as the old check cannot fail, so it's a bug
we can not hit.

Fixes: ccd2b52f4ac69 ("staging:iio: Add common ADIS library")
Reviewed-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Signed-off-by: Nuno Sa <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20210422101911.135630-2-nuno.sa@analog.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/imu/adis_buffer.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/iio/imu/adis_buffer.c b/drivers/iio/imu/adis_buffer.c
index 9de553e8c214..625f54d9e382 100644
--- a/drivers/iio/imu/adis_buffer.c
+++ b/drivers/iio/imu/adis_buffer.c
@@ -83,9 +83,6 @@ static irqreturn_t adis_trigger_handler(int irq, void *p)
 	struct adis *adis = iio_device_get_drvdata(indio_dev);
 	int ret;
 
-	if (!adis->buffer)
-		return -ENOMEM;
-
 	if (adis->data->has_paging) {
 		mutex_lock(&adis->txrx_lock);
 		if (adis->current_page != 0) {

From 1498e45fc7d213690f468a4370e76d60765f5a6a Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Sat, 1 May 2021 18:01:03 +0100
Subject: [PATCH 2383/2658] iio: accel: bma180: Fix buffer alignment in
 iio_push_to_buffers_with_timestamp()

[ Upstream commit fc36da3131a747a9367a05caf06de19be1bcc972 ]

To make code more readable, use a structure to express the channel
layout and ensure the timestamp is 8 byte aligned.

Found during an audit of all calls of this function.

Fixes: b9a6a237ffc9 ("iio:bma180: Drop _update_scan_mode()")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Cc: Peter Meerwald <pmeerw@pmeerw.net>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/r/20210501170121.512209-2-jic23@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/accel/bma180.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
index f04b88406995..68c9e5478fec 100644
--- a/drivers/iio/accel/bma180.c
+++ b/drivers/iio/accel/bma180.c
@@ -120,7 +120,11 @@ struct bma180_data {
 	int scale;
 	int bw;
 	bool pmode;
-	u8 buff[16]; /* 3x 16-bit + 8-bit + padding + timestamp */
+	/* Ensure timestamp is naturally aligned */
+	struct {
+		s16 chan[4];
+		s64 timestamp __aligned(8);
+	} scan;
 };
 
 enum bma180_chan {
@@ -666,12 +670,12 @@ static irqreturn_t bma180_trigger_handler(int irq, void *p)
 			mutex_unlock(&data->mutex);
 			goto err;
 		}
-		((s16 *)data->buff)[i++] = ret;
+		data->scan.chan[i++] = ret;
 	}
 
 	mutex_unlock(&data->mutex);
 
-	iio_push_to_buffers_with_timestamp(indio_dev, data->buff, time_ns);
+	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, time_ns);
 err:
 	iio_trigger_notify_done(indio_dev->trig);
 

From 339f185450df6dc013bb04891d7d31692a7e4dd4 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Sat, 1 May 2021 18:01:08 +0100
Subject: [PATCH 2384/2658] iio: accel: stk8312: Fix buffer alignment in
 iio_push_to_buffers_with_timestamp()

[ Upstream commit f40a71ffec808e7e51848f63f0c0d3c32d65081b ]

To make code more readable, use a structure to express the channel
layout and ensure the timestamp is 8 byte aligned.

Found during an audit of all calls of this function.

Fixes: 95c12bba51c3 ("iio: accel: Add buffer mode for Sensortek STK8312")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/r/20210501170121.512209-7-jic23@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/accel/stk8312.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/iio/accel/stk8312.c b/drivers/iio/accel/stk8312.c
index 85fe7f7247c1..945c80183f35 100644
--- a/drivers/iio/accel/stk8312.c
+++ b/drivers/iio/accel/stk8312.c
@@ -107,7 +107,11 @@ struct stk8312_data {
 	u8 mode;
 	struct iio_trigger *dready_trig;
 	bool dready_trigger_on;
-	s8 buffer[16]; /* 3x8-bit channels + 5x8 padding + 64-bit timestamp */
+	/* Ensure timestamp is naturally aligned */
+	struct {
+		s8 chans[3];
+		s64 timestamp __aligned(8);
+	} scan;
 };
 
 static IIO_CONST_ATTR(in_accel_scale_available, STK8312_SCALE_AVAIL);
@@ -444,7 +448,7 @@ static irqreturn_t stk8312_trigger_handler(int irq, void *p)
 		ret = i2c_smbus_read_i2c_block_data(data->client,
 						    STK8312_REG_XOUT,
 						    STK8312_ALL_CHANNEL_SIZE,
-						    data->buffer);
+						    data->scan.chans);
 		if (ret < STK8312_ALL_CHANNEL_SIZE) {
 			dev_err(&data->client->dev, "register read failed\n");
 			mutex_unlock(&data->lock);
@@ -458,12 +462,12 @@ static irqreturn_t stk8312_trigger_handler(int irq, void *p)
 				mutex_unlock(&data->lock);
 				goto err;
 			}
-			data->buffer[i++] = ret;
+			data->scan.chans[i++] = ret;
 		}
 	}
 	mutex_unlock(&data->lock);
 
-	iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
+	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
 					   pf->timestamp);
 err:
 	iio_trigger_notify_done(indio_dev->trig);

From 7bd0d6ccfc0d4e6a500927cef0597c3b6bc42af4 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Sat, 1 May 2021 18:01:09 +0100
Subject: [PATCH 2385/2658] iio: accel: stk8ba50: Fix buffer alignment in
 iio_push_to_buffers_with_timestamp()

[ Upstream commit 334883894bc1e145a1e0f5de1b0d1b6a1133f0e6 ]

To make code more readable, use a structure to express the channel
layout and ensure the timestamp is 8 byte aligned.

Found during an audit of all calls of this function.

Fixes: db6a19b8251f ("iio: accel: Add trigger support for STK8BA50")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/r/20210501170121.512209-8-jic23@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/accel/stk8ba50.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/drivers/iio/accel/stk8ba50.c b/drivers/iio/accel/stk8ba50.c
index 5709d9eb8f34..b6e2d15024c8 100644
--- a/drivers/iio/accel/stk8ba50.c
+++ b/drivers/iio/accel/stk8ba50.c
@@ -95,12 +95,11 @@ struct stk8ba50_data {
 	u8 sample_rate_idx;
 	struct iio_trigger *dready_trig;
 	bool dready_trigger_on;
-	/*
-	 * 3 x 16-bit channels (10-bit data, 6-bit padding) +
-	 * 1 x 16 padding +
-	 * 4 x 16 64-bit timestamp
-	 */
-	s16 buffer[8];
+	/* Ensure timestamp is naturally aligned */
+	struct {
+		s16 chans[3];
+		s64 timetamp __aligned(8);
+	} scan;
 };
 
 #define STK8BA50_ACCEL_CHANNEL(index, reg, axis) {			\
@@ -330,7 +329,7 @@ static irqreturn_t stk8ba50_trigger_handler(int irq, void *p)
 		ret = i2c_smbus_read_i2c_block_data(data->client,
 						    STK8BA50_REG_XOUT,
 						    STK8BA50_ALL_CHANNEL_SIZE,
-						    (u8 *)data->buffer);
+						    (u8 *)data->scan.chans);
 		if (ret < STK8BA50_ALL_CHANNEL_SIZE) {
 			dev_err(&data->client->dev, "register read failed\n");
 			goto err;
@@ -343,10 +342,10 @@ static irqreturn_t stk8ba50_trigger_handler(int irq, void *p)
 			if (ret < 0)
 				goto err;
 
-			data->buffer[i++] = ret;
+			data->scan.chans[i++] = ret;
 		}
 	}
-	iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
+	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
 					   pf->timestamp);
 err:
 	mutex_unlock(&data->lock);

From 2bbff81c07361b09b88426a3937b74678ec94681 Mon Sep 17 00:00:00 2001
From: Zhen Lei <thunder.leizhen@huawei.com>
Date: Mon, 24 May 2021 11:52:42 -0700
Subject: [PATCH 2386/2658] Input: hil_kbd - fix error return code in
 hil_dev_connect()

[ Upstream commit d9b576917a1d0efa293801a264150a1b37691617 ]

Return error code -EINVAL rather than '0' when the combo devices are not
supported.

Fixes: fa71c605c2bb ("Input: combine hil_kbd and hil_ptr drivers")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Link: https://lore.kernel.org/r/20210515030053.6824-1-thunder.leizhen@huawei.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/keyboard/hil_kbd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/input/keyboard/hil_kbd.c b/drivers/input/keyboard/hil_kbd.c
index 5b152f25a8e1..da07742fd9a4 100644
--- a/drivers/input/keyboard/hil_kbd.c
+++ b/drivers/input/keyboard/hil_kbd.c
@@ -512,6 +512,7 @@ static int hil_dev_connect(struct serio *serio, struct serio_driver *drv)
 		    HIL_IDD_NUM_AXES_PER_SET(*idd)) {
 			printk(KERN_INFO PREFIX
 				"combo devices are not supported.\n");
+			error = -EINVAL;
 			goto bail1;
 		}
 

From fad4f5ea5bca56762b4cc7cc6ddc873034350434 Mon Sep 17 00:00:00 2001
From: Yu Kuai <yukuai3@huawei.com>
Date: Fri, 21 May 2021 20:06:17 +0800
Subject: [PATCH 2387/2658] char: pcmcia: error out if 'num_bytes_read' is
 greater than 4 in set_protocol()

[ Upstream commit 37188559c610f1b7eec83c8e448936c361c578de ]

Theoretically, it will cause index out of bounds error if
'num_bytes_read' is greater than 4. As we expect it(and was tested)
never to be greater than 4, error out if it happens.

Fixes: c1986ee9bea3 ("[PATCH] New Omnikey Cardman 4000 driver")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20210521120617.138396-1-yukuai3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/pcmcia/cm4000_cs.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index c115217c79ae..f8d98f7e6fb7 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -544,6 +544,10 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq)
 		io_read_num_rec_bytes(iobase, &num_bytes_read);
 		if (num_bytes_read >= 4) {
 			DEBUGP(2, dev, "NumRecBytes = %i\n", num_bytes_read);
+			if (num_bytes_read > 4) {
+				rc = -EIO;
+				goto exit_setprotocol;
+			}
 			break;
 		}
 		mdelay(10);

From b17b3988cb9cb774a3191dedbe203300694e19cc Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Tue, 25 May 2021 20:51:57 +0200
Subject: [PATCH 2388/2658] tty: nozomi: Fix the error handling path of
 'nozomi_card_init()'

[ Upstream commit 6ae7d0f5a92b9619f6e3c307ce56b2cefff3f0e9 ]

The error handling path is broken and we may un-register things that have
never been registered.

Update the loops index accordingly.

Fixes: 9842c38e9176 ("kfifo: fix warn_unused_result")
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/e28c2e92c7475da25b03d022ea2d6dcf1ba807a2.1621968629.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/nozomi.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/nozomi.c b/drivers/tty/nozomi.c
index 880cfc780e67..1a3cc6ef4331 100644
--- a/drivers/tty/nozomi.c
+++ b/drivers/tty/nozomi.c
@@ -1437,7 +1437,7 @@ static int nozomi_card_init(struct pci_dev *pdev,
 			NOZOMI_NAME, dc);
 	if (unlikely(ret)) {
 		dev_err(&pdev->dev, "can't request irq %d\n", pdev->irq);
-		goto err_free_kfifo;
+		goto err_free_all_kfifo;
 	}
 
 	DBG1("base_addr: %p", dc->base_addr);
@@ -1475,13 +1475,15 @@ static int nozomi_card_init(struct pci_dev *pdev,
 	return 0;
 
 err_free_tty:
-	for (i = 0; i < MAX_PORT; ++i) {
+	for (i--; i >= 0; i--) {
 		tty_unregister_device(ntty_driver, dc->index_start + i);
 		tty_port_destroy(&dc->port[i].port);
 	}
 	free_irq(pdev->irq, dc);
+err_free_all_kfifo:
+	i = MAX_PORT;
 err_free_kfifo:
-	for (i = 0; i < MAX_PORT; i++)
+	for (i--; i >= PORT_MDM; i--)
 		kfifo_free(&dc->port[i].fifo_ul);
 err_free_sbuf:
 	kfree(dc->send_buf);

From 790d5139ff6e6b1c718d02c28e20a40f3438acbf Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Sat, 29 May 2021 16:48:57 -0700
Subject: [PATCH 2389/2658] scsi: FlashPoint: Rename si_flags field

[ Upstream commit 4d431153e751caa93f3b7e6f6313446974e92253 ]

The BusLogic driver has build errors on ia64 due to a name collision (in
the #included FlashPoint.c file). Rename the struct field in struct
sccb_mgr_info from si_flags to si_mflags (manager flags) to mend the build.

This is the first problem. There are 50+ others after this one:

In file included from ../include/uapi/linux/signal.h:6,
                 from ../include/linux/signal_types.h:10,
                 from ../include/linux/sched.h:29,
                 from ../include/linux/hardirq.h:9,
                 from ../include/linux/interrupt.h:11,
                 from ../drivers/scsi/BusLogic.c:27:
../arch/ia64/include/uapi/asm/siginfo.h:15:27: error: expected ':', ',', ';', '}' or '__attribute__' before '.' token
   15 | #define si_flags _sifields._sigfault._flags
      |                           ^
../drivers/scsi/FlashPoint.c:43:6: note: in expansion of macro 'si_flags'
   43 |  u16 si_flags;
      |      ^~~~~~~~
In file included from ../drivers/scsi/BusLogic.c:51:
../drivers/scsi/FlashPoint.c: In function 'FlashPoint_ProbeHostAdapter':
../drivers/scsi/FlashPoint.c:1076:11: error: 'struct sccb_mgr_info' has no member named '_sifields'
 1076 |  pCardInfo->si_flags = 0x0000;
      |           ^~
../drivers/scsi/FlashPoint.c:1079:12: error: 'struct sccb_mgr_info' has no member named '_sifields'

Link: https://lore.kernel.org/r/20210529234857.6870-1-rdunlap@infradead.org
Fixes: 391e2f25601e ("[SCSI] BusLogic: Port driver to 64-bit.")
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Hannes Reinecke <hare@suse.de>
Cc: Khalid Aziz <khalid.aziz@oracle.com>
Cc: Khalid Aziz <khalid@gonehiking.org>
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/FlashPoint.c | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/drivers/scsi/FlashPoint.c b/drivers/scsi/FlashPoint.c
index 867b864f5047..4bca37d52bad 100644
--- a/drivers/scsi/FlashPoint.c
+++ b/drivers/scsi/FlashPoint.c
@@ -40,7 +40,7 @@ struct sccb_mgr_info {
 	u16 si_per_targ_ultra_nego;
 	u16 si_per_targ_no_disc;
 	u16 si_per_targ_wide_nego;
-	u16 si_flags;
+	u16 si_mflags;
 	unsigned char si_card_family;
 	unsigned char si_bustype;
 	unsigned char si_card_model[3];
@@ -1070,22 +1070,22 @@ static int FlashPoint_ProbeHostAdapter(struct sccb_mgr_info *pCardInfo)
 		ScamFlg =
 		    (unsigned char)FPT_utilEERead(ioport, SCAM_CONFIG / 2);
 
-	pCardInfo->si_flags = 0x0000;
+	pCardInfo->si_mflags = 0x0000;
 
 	if (i & 0x01)
-		pCardInfo->si_flags |= SCSI_PARITY_ENA;
+		pCardInfo->si_mflags |= SCSI_PARITY_ENA;
 
 	if (!(i & 0x02))
-		pCardInfo->si_flags |= SOFT_RESET;
+		pCardInfo->si_mflags |= SOFT_RESET;
 
 	if (i & 0x10)
-		pCardInfo->si_flags |= EXTENDED_TRANSLATION;
+		pCardInfo->si_mflags |= EXTENDED_TRANSLATION;
 
 	if (ScamFlg & SCAM_ENABLED)
-		pCardInfo->si_flags |= FLAG_SCAM_ENABLED;
+		pCardInfo->si_mflags |= FLAG_SCAM_ENABLED;
 
 	if (ScamFlg & SCAM_LEVEL2)
-		pCardInfo->si_flags |= FLAG_SCAM_LEVEL2;
+		pCardInfo->si_mflags |= FLAG_SCAM_LEVEL2;
 
 	j = (RD_HARPOON(ioport + hp_bm_ctrl) & ~SCSI_TERM_ENA_L);
 	if (i & 0x04) {
@@ -1101,7 +1101,7 @@ static int FlashPoint_ProbeHostAdapter(struct sccb_mgr_info *pCardInfo)
 
 	if (!(RD_HARPOON(ioport + hp_page_ctrl) & NARROW_SCSI_CARD))
 
-		pCardInfo->si_flags |= SUPPORT_16TAR_32LUN;
+		pCardInfo->si_mflags |= SUPPORT_16TAR_32LUN;
 
 	pCardInfo->si_card_family = HARPOON_FAMILY;
 	pCardInfo->si_bustype = BUSTYPE_PCI;
@@ -1137,15 +1137,15 @@ static int FlashPoint_ProbeHostAdapter(struct sccb_mgr_info *pCardInfo)
 
 	if (pCardInfo->si_card_model[1] == '3') {
 		if (RD_HARPOON(ioport + hp_ee_ctrl) & BIT(7))
-			pCardInfo->si_flags |= LOW_BYTE_TERM;
+			pCardInfo->si_mflags |= LOW_BYTE_TERM;
 	} else if (pCardInfo->si_card_model[2] == '0') {
 		temp = RD_HARPOON(ioport + hp_xfer_pad);
 		WR_HARPOON(ioport + hp_xfer_pad, (temp & ~BIT(4)));
 		if (RD_HARPOON(ioport + hp_ee_ctrl) & BIT(7))
-			pCardInfo->si_flags |= LOW_BYTE_TERM;
+			pCardInfo->si_mflags |= LOW_BYTE_TERM;
 		WR_HARPOON(ioport + hp_xfer_pad, (temp | BIT(4)));
 		if (RD_HARPOON(ioport + hp_ee_ctrl) & BIT(7))
-			pCardInfo->si_flags |= HIGH_BYTE_TERM;
+			pCardInfo->si_mflags |= HIGH_BYTE_TERM;
 		WR_HARPOON(ioport + hp_xfer_pad, temp);
 	} else {
 		temp = RD_HARPOON(ioport + hp_ee_ctrl);
@@ -1163,9 +1163,9 @@ static int FlashPoint_ProbeHostAdapter(struct sccb_mgr_info *pCardInfo)
 		WR_HARPOON(ioport + hp_ee_ctrl, temp);
 		WR_HARPOON(ioport + hp_xfer_pad, temp2);
 		if (!(temp3 & BIT(7)))
-			pCardInfo->si_flags |= LOW_BYTE_TERM;
+			pCardInfo->si_mflags |= LOW_BYTE_TERM;
 		if (!(temp3 & BIT(6)))
-			pCardInfo->si_flags |= HIGH_BYTE_TERM;
+			pCardInfo->si_mflags |= HIGH_BYTE_TERM;
 	}
 
 	ARAM_ACCESS(ioport);
@@ -1272,7 +1272,7 @@ static void *FlashPoint_HardwareResetHostAdapter(struct sccb_mgr_info
 	WR_HARPOON(ioport + hp_arb_id, pCardInfo->si_id);
 	CurrCard->ourId = pCardInfo->si_id;
 
-	i = (unsigned char)pCardInfo->si_flags;
+	i = (unsigned char)pCardInfo->si_mflags;
 	if (i & SCSI_PARITY_ENA)
 		WR_HARPOON(ioport + hp_portctrl_1, (HOST_MODE8 | CHK_SCSI_P));
 
@@ -1286,14 +1286,14 @@ static void *FlashPoint_HardwareResetHostAdapter(struct sccb_mgr_info
 		j |= SCSI_TERM_ENA_H;
 	WR_HARPOON(ioport + hp_ee_ctrl, j);
 
-	if (!(pCardInfo->si_flags & SOFT_RESET)) {
+	if (!(pCardInfo->si_mflags & SOFT_RESET)) {
 
 		FPT_sresb(ioport, thisCard);
 
 		FPT_scini(thisCard, pCardInfo->si_id, 0);
 	}
 
-	if (pCardInfo->si_flags & POST_ALL_UNDERRRUNS)
+	if (pCardInfo->si_mflags & POST_ALL_UNDERRRUNS)
 		CurrCard->globalFlags |= F_NO_FILTER;
 
 	if (pCurrNvRam) {

From 933f306584a04a5eb033028dfe712b39a7b63227 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Thu, 27 May 2021 17:24:20 -0700
Subject: [PATCH 2390/2658] s390: appldata depends on PROC_SYSCTL

[ Upstream commit 5d3516b3647621d5a1180672ea9e0817fb718ada ]

APPLDATA_BASE should depend on PROC_SYSCTL instead of PROC_FS.
Building with PROC_FS but not PROC_SYSCTL causes a build error,
since appldata_base.c uses data and APIs from fs/proc/proc_sysctl.c.

arch/s390/appldata/appldata_base.o: in function `appldata_generic_handler':
appldata_base.c:(.text+0x192): undefined reference to `sysctl_vals'

Fixes: c185b783b099 ("[S390] Remove config options.")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: linux-s390@vger.kernel.org
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Link: https://lore.kernel.org/r/20210528002420.17634-1-rdunlap@infradead.org
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index e92a684e855d..73a301873fbf 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -835,7 +835,7 @@ config CMM_IUCV
 config APPLDATA_BASE
 	def_bool n
 	prompt "Linux - VM Monitor Stream, base infrastructure"
-	depends on PROC_FS
+	depends on PROC_SYSCTL
 	help
 	  This provides a kernel interface for creating and updating z/VM APPLDATA
 	  monitor records. The monitor records are updated at certain time

From 7b8a8f090817221f5c02bf9dc154b9872d8fff73 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Mon, 14 Jun 2021 12:55:35 +0300
Subject: [PATCH 2391/2658] staging: gdm724x: check for buffer overflow in
 gdm_lte_multi_sdu_pkt()

[ Upstream commit 4a36e160856db8a8ddd6a3d2e5db5a850ab87f82 ]

There needs to be a check to verify that we don't read beyond the end
of "buf".  This function is called from do_rx().  The "buf" is the USB
transfer_buffer and "len" is "urb->actual_length".

Fixes: 61e121047645 ("staging: gdm7240: adding LTE USB driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YMcnl4zCwGWGDVMG@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/gdm724x/gdm_lte.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/gdm724x/gdm_lte.c b/drivers/staging/gdm724x/gdm_lte.c
index 79de678807cc..1eacf82d1bd0 100644
--- a/drivers/staging/gdm724x/gdm_lte.c
+++ b/drivers/staging/gdm724x/gdm_lte.c
@@ -689,6 +689,7 @@ static void gdm_lte_multi_sdu_pkt(struct phy_dev *phy_dev, char *buf, int len)
 	struct multi_sdu *multi_sdu = (struct multi_sdu *)buf;
 	struct sdu *sdu = NULL;
 	u8 *data = (u8 *)multi_sdu->data;
+	int copied;
 	u16 i = 0;
 	u16 num_packet;
 	u16 hci_len;
@@ -702,6 +703,12 @@ static void gdm_lte_multi_sdu_pkt(struct phy_dev *phy_dev, char *buf, int len)
 				      multi_sdu->num_packet);
 
 	for (i = 0; i < num_packet; i++) {
+		copied = data - multi_sdu->data;
+		if (len < copied + sizeof(*sdu)) {
+			pr_err("rx prevent buffer overflow");
+			return;
+		}
+
 		sdu = (struct sdu *)data;
 
 		cmd_evt = gdm_dev16_to_cpu(phy_dev->
@@ -715,7 +722,8 @@ static void gdm_lte_multi_sdu_pkt(struct phy_dev *phy_dev, char *buf, int len)
 			pr_err("rx sdu wrong hci %04x\n", cmd_evt);
 			return;
 		}
-		if (hci_len < 12) {
+		if (hci_len < 12 ||
+		    len < copied + sizeof(*sdu) + (hci_len - 12)) {
 			pr_err("rx sdu invalid len %d\n", hci_len);
 			return;
 		}

From 3afce44d4bb72aa6f78b2492a17f39abbaa7b639 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Mon, 14 Jun 2021 12:58:36 +0300
Subject: [PATCH 2392/2658] staging: gdm724x: check for overflow in
 gdm_lte_netif_rx()

[ Upstream commit 7002b526f4ff1f6da34356e67085caafa6be383a ]

This code assumes that "len" is at least 62 bytes, but we need a check
to prevent a read overflow.

Fixes: 61e121047645 ("staging: gdm7240: adding LTE USB driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YMcoTPsCYlhh2TQo@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/gdm724x/gdm_lte.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/gdm724x/gdm_lte.c b/drivers/staging/gdm724x/gdm_lte.c
index 1eacf82d1bd0..8561f7fb53e9 100644
--- a/drivers/staging/gdm724x/gdm_lte.c
+++ b/drivers/staging/gdm724x/gdm_lte.c
@@ -624,10 +624,12 @@ static void gdm_lte_netif_rx(struct net_device *dev, char *buf,
 						  * bytes (99,130,83,99 dec)
 						  */
 			} __packed;
-			void *addr = buf + sizeof(struct iphdr) +
-				sizeof(struct udphdr) +
-				offsetof(struct dhcp_packet, chaddr);
-			ether_addr_copy(nic->dest_mac_addr, addr);
+			int offset = sizeof(struct iphdr) +
+				     sizeof(struct udphdr) +
+				     offsetof(struct dhcp_packet, chaddr);
+			if (offset + ETH_ALEN > len)
+				return;
+			ether_addr_copy(nic->dest_mac_addr, buf + offset);
 		}
 	}
 

From a83f523f598c1aac4a374c0a30abab6d130703a6 Mon Sep 17 00:00:00 2001
From: Zhen Lei <thunder.leizhen@huawei.com>
Date: Fri, 14 May 2021 16:13:00 +0800
Subject: [PATCH 2393/2658] scsi: mpt3sas: Fix error return value in
 _scsih_expander_add()

[ Upstream commit d6c2ce435ffe23ef7f395ae76ec747414589db46 ]

When an expander does not contain any 'phys', an appropriate error code -1
should be returned, as done elsewhere in this function. However, we
currently do not explicitly assign this error code to 'rc'. As a result, 0
was incorrectly returned.

Link: https://lore.kernel.org/r/20210514081300.6650-1-thunder.leizhen@huawei.com
Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 8735e4257028..49b751a8f5f3 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -5014,8 +5014,10 @@ _scsih_expander_add(struct MPT3SAS_ADAPTER *ioc, u16 handle)
 	    handle, parent_handle, (unsigned long long)
 	    sas_expander->sas_address, sas_expander->num_phys);
 
-	if (!sas_expander->num_phys)
+	if (!sas_expander->num_phys) {
+		rc = -1;
 		goto out_fail;
+	}
 	sas_expander->phy = kcalloc(sas_expander->num_phys,
 	    sizeof(struct _sas_phy), GFP_KERNEL);
 	if (!sas_expander->phy) {

From 8a16a99bca9d8f843dcd53a1be57ca1bda438d57 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 5 Jun 2021 15:17:43 +0200
Subject: [PATCH 2394/2658] phy: ti: dm816x: Fix the error handling path in
 'dm816x_usb_phy_probe()

[ Upstream commit f7eedcb8539ddcbb6fe7791f1b4ccf43f905c72f ]

Add an error handling path in the probe to release some resources, as
already done in the remove function.

Fixes: 609adde838f4 ("phy: Add a driver for dm816x USB PHY")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/ac5136881f6bdec50be19b3bf73b3bc1b15ef1f1.1622898974.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/phy-dm816x-usb.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/phy/phy-dm816x-usb.c b/drivers/phy/phy-dm816x-usb.c
index b4bbef664d20..908b5ff0e888 100644
--- a/drivers/phy/phy-dm816x-usb.c
+++ b/drivers/phy/phy-dm816x-usb.c
@@ -246,19 +246,28 @@ static int dm816x_usb_phy_probe(struct platform_device *pdev)
 
 	pm_runtime_enable(phy->dev);
 	generic_phy = devm_phy_create(phy->dev, NULL, &ops);
-	if (IS_ERR(generic_phy))
-		return PTR_ERR(generic_phy);
+	if (IS_ERR(generic_phy)) {
+		error = PTR_ERR(generic_phy);
+		goto clk_unprepare;
+	}
 
 	phy_set_drvdata(generic_phy, phy);
 
 	phy_provider = devm_of_phy_provider_register(phy->dev,
 						     of_phy_simple_xlate);
-	if (IS_ERR(phy_provider))
-		return PTR_ERR(phy_provider);
+	if (IS_ERR(phy_provider)) {
+		error = PTR_ERR(phy_provider);
+		goto clk_unprepare;
+	}
 
 	usb_add_phy_dev(&phy->phy);
 
 	return 0;
+
+clk_unprepare:
+	pm_runtime_disable(phy->dev);
+	clk_unprepare(phy->refclk);
+	return error;
 }
 
 static int dm816x_usb_phy_remove(struct platform_device *pdev)

From 4226bac1c3a1405d6e4acfb04cf045abf00f4a60 Mon Sep 17 00:00:00 2001
From: Stephan Gerhold <stephan@gerhold.net>
Date: Mon, 31 May 2021 15:34:35 +0200
Subject: [PATCH 2395/2658] extcon: sm5502: Drop invalid register write in
 sm5502_reg_data

[ Upstream commit d25b224f8e5507879b36a769a6d1324cf163466c ]

When sm5502_init_dev_type() iterates over sm5502_reg_data to
initialize the registers it is limited by ARRAY_SIZE(sm5502_reg_data).
There is no need to add another empty element to sm5502_reg_data.

Having the additional empty element in sm5502_reg_data will just
result in writing 0xff to register 0x00, which does not really
make sense.

Fixes: 914b881f9452 ("extcon: sm5502: Add support new SM5502 extcon device driver")
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/extcon/extcon-sm5502.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/extcon/extcon-sm5502.c b/drivers/extcon/extcon-sm5502.c
index f63f9961ac12..9b8c79bc3acd 100644
--- a/drivers/extcon/extcon-sm5502.c
+++ b/drivers/extcon/extcon-sm5502.c
@@ -92,7 +92,6 @@ static struct reg_data sm5502_reg_data[] = {
 			| SM5502_REG_INTM2_MHL_MASK,
 		.invert = true,
 	},
-	{ }
 };
 
 /* List of detectable cables */

From 29ce83a8abe507e1af85c0f239130b0605916493 Mon Sep 17 00:00:00 2001
From: Marek Szyprowski <m.szyprowski@samsung.com>
Date: Fri, 23 Apr 2021 22:46:24 +0200
Subject: [PATCH 2396/2658] extcon: max8997: Add missing modalias string

[ Upstream commit dc11fc2991e9efbceef93912b83e333d2835fb19 ]

The platform device driver name is "max8997-muic", so advertise it
properly in the modalias string. This fixes automated module loading when
this driver is compiled as a module.

Fixes: b76668ba8a77 ("Extcon: add MAX8997 extcon driver")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/extcon/extcon-max8997.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c
index 3d6b42f61f56..a37c7257ccc7 100644
--- a/drivers/extcon/extcon-max8997.c
+++ b/drivers/extcon/extcon-max8997.c
@@ -780,3 +780,4 @@ module_platform_driver(max8997_muic_driver);
 MODULE_DESCRIPTION("Maxim MAX8997 Extcon driver");
 MODULE_AUTHOR("Donggeun Kim <dg77.kim@samsung.com>");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:max8997-muic");

From 12a219490c388e27309d921f76750856e13e3069 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Fri, 21 May 2021 15:30:26 +0200
Subject: [PATCH 2397/2658] mmc: vub3000: fix control-request direction

commit 3c0bb3107703d2c58f7a0a7a2060bb57bc120326 upstream.

The direction of the pipe argument must match the request-type direction
bit or control requests may fail depending on the host-controller-driver
implementation.

Fix the SET_ROM_WAIT_STATES request which erroneously used
usb_rcvctrlpipe().

Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
Cc: stable@vger.kernel.org      # 3.0
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210521133026.17296-1-johan@kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/vub300.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
index 1e819f98b94f..c9ea34e34415 100644
--- a/drivers/mmc/host/vub300.c
+++ b/drivers/mmc/host/vub300.c
@@ -2294,7 +2294,7 @@ static int vub300_probe(struct usb_interface *interface,
 	if (retval < 0)
 		goto error5;
 	retval =
-		usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
+		usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
 				SET_ROM_WAIT_STATES,
 				USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 				firmware_rom_wait_states, 0x0000, NULL, 0, HZ);

From 17a2e883c7e1d23b2f534f5b8e33ce826dde46e0 Mon Sep 17 00:00:00 2001
From: Quat Le <quat.le@oracle.com>
Date: Tue, 29 Jun 2021 08:58:26 -0700
Subject: [PATCH 2398/2658] scsi: core: Retry I/O for Notify (Enable Spinup)
 Required error

commit 104739aca4488909175e9e31d5cd7d75b82a2046 upstream.

If the device is power-cycled, it takes time for the initiator to transmit
the periodic NOTIFY (ENABLE SPINUP) SAS primitive, and for the device to
respond to the primitive to become ACTIVE. Retry the I/O request to allow
the device time to become ACTIVE.

Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210629155826.48441-1-quat.le@oracle.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Quat Le <quat.le@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/scsi_lib.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 269198b46adb..455cdd2c3fed 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1004,6 +1004,7 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
 				case 0x07: /* operation in progress */
 				case 0x08: /* Long write in progress */
 				case 0x09: /* self test in progress */
+				case 0x11: /* notify (enable spinup) required */
 				case 0x14: /* space allocation in progress */
 					action = ACTION_DELAYED_RETRY;
 					break;

From bcad9d03aeba34588001af60e17f68ef700c1012 Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Mon, 10 May 2021 19:39:30 +0300
Subject: [PATCH 2399/2658] net: pch_gbe: Use proper accessors to BE data in
 pch_ptp_match()

[ Upstream commit 443ef39b499cc9c6635f83238101f1bb923e9326 ]

Sparse is not happy about handling of strict types in pch_ptp_match():

  .../pch_gbe_main.c:158:33: warning: incorrect type in argument 2 (different base types)
  .../pch_gbe_main.c:158:33:    expected unsigned short [usertype] uid_hi
  .../pch_gbe_main.c:158:33:    got restricted __be16 [usertype]
  .../pch_gbe_main.c:158:45: warning: incorrect type in argument 3 (different base types)
  .../pch_gbe_main.c:158:45:    expected unsigned int [usertype] uid_lo
  .../pch_gbe_main.c:158:45:    got restricted __be32 [usertype]
  .../pch_gbe_main.c:158:56: warning: incorrect type in argument 4 (different base types)
  .../pch_gbe_main.c:158:56:    expected unsigned short [usertype] seqid
  .../pch_gbe_main.c:158:56:    got restricted __be16 [usertype]

Fix that by switching to use proper accessors to BE data.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Tested-by: Flavio Suligoi <f.suligoi@asem.it>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../ethernet/oki-semi/pch_gbe/pch_gbe_main.c  | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
index a7ec9492d126..45cfb1a0933d 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
@@ -124,7 +124,7 @@ static int pch_ptp_match(struct sk_buff *skb, u16 uid_hi, u32 uid_lo, u16 seqid)
 {
 	u8 *data = skb->data;
 	unsigned int offset;
-	u16 *hi, *id;
+	u16 hi, id;
 	u32 lo;
 
 	if (ptp_classify_raw(skb) == PTP_CLASS_NONE)
@@ -135,14 +135,11 @@ static int pch_ptp_match(struct sk_buff *skb, u16 uid_hi, u32 uid_lo, u16 seqid)
 	if (skb->len < offset + OFF_PTP_SEQUENCE_ID + sizeof(seqid))
 		return 0;
 
-	hi = (u16 *)(data + offset + OFF_PTP_SOURCE_UUID);
-	id = (u16 *)(data + offset + OFF_PTP_SEQUENCE_ID);
+	hi = get_unaligned_be16(data + offset + OFF_PTP_SOURCE_UUID + 0);
+	lo = get_unaligned_be32(data + offset + OFF_PTP_SOURCE_UUID + 2);
+	id = get_unaligned_be16(data + offset + OFF_PTP_SEQUENCE_ID);
 
-	memcpy(&lo, &hi[1], sizeof(lo));
-
-	return (uid_hi == *hi &&
-		uid_lo == lo &&
-		seqid  == *id);
+	return (uid_hi == hi && uid_lo == lo && seqid == id);
 }
 
 static void
@@ -152,7 +149,6 @@ pch_rx_timestamp(struct pch_gbe_adapter *adapter, struct sk_buff *skb)
 	struct pci_dev *pdev;
 	u64 ns;
 	u32 hi, lo, val;
-	u16 uid, seq;
 
 	if (!adapter->hwts_rx_en)
 		return;
@@ -168,10 +164,7 @@ pch_rx_timestamp(struct pch_gbe_adapter *adapter, struct sk_buff *skb)
 	lo = pch_src_uuid_lo_read(pdev);
 	hi = pch_src_uuid_hi_read(pdev);
 
-	uid = hi & 0xffff;
-	seq = (hi >> 16) & 0xffff;
-
-	if (!pch_ptp_match(skb, htons(uid), htonl(lo), htons(seq)))
+	if (!pch_ptp_match(skb, hi, lo, hi >> 16))
 		goto out;
 
 	ns = pch_rx_snap_read(pdev);

From 727d00e8269c84b1ae2c4cfae546d4f322779c2b Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Mon, 29 Jun 2020 21:15:32 +0800
Subject: [PATCH 2400/2658] hugetlb: clear huge pte during flush function on
 mips platform

[ Upstream commit 33ae8f801ad8bec48e886d368739feb2816478f2 ]

If multiple threads are accessing the same huge page at the same
time, hugetlb_cow will be called if one thread write the COW huge
page. And function huge_ptep_clear_flush is called to notify other
threads to clear the huge pte tlb entry. The other threads clear
the huge pte tlb entry and reload it from page table, the reload
huge pte entry may be old.

This patch fixes this issue on mips platform, and it clears huge
pte entry before notifying other threads to flush current huge
page entry, it is similar with other architectures.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/include/asm/hugetlb.h | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/arch/mips/include/asm/hugetlb.h b/arch/mips/include/asm/hugetlb.h
index 982bc0685330..4747a4694669 100644
--- a/arch/mips/include/asm/hugetlb.h
+++ b/arch/mips/include/asm/hugetlb.h
@@ -67,7 +67,13 @@ static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
 static inline void huge_ptep_clear_flush(struct vm_area_struct *vma,
 					 unsigned long addr, pte_t *ptep)
 {
-	flush_tlb_page(vma, addr & huge_page_mask(hstate_vma(vma)));
+	/*
+	 * clear the huge pte entry firstly, so that the other smp threads will
+	 * not get old pte entry after finishing flush_tlb_page and before
+	 * setting new huge pte entry
+	 */
+	huge_ptep_get_and_clear(vma->vm_mm, addr, ptep);
+	flush_tlb_page(vma, addr);
 }
 
 static inline int huge_pte_none(pte_t pte)

From 3841e178807cc7bb826951092e0f10d5738a8806 Mon Sep 17 00:00:00 2001
From: Zou Wei <zou_wei@huawei.com>
Date: Tue, 11 May 2021 14:53:36 +0800
Subject: [PATCH 2401/2658] atm: iphase: fix possible use-after-free in
 ia_module_exit()

[ Upstream commit 1c72e6ab66b9598cac741ed397438a52065a8f1f ]

This module's remove path calls del_timer(). However, that function
does not wait until the timer handler finishes. This means that the
timer handler may still be running after the driver's remove function
has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler
has finished, and unable to re-schedule itself.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/atm/iphase.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index 860a33a90ebf..dc1b7f11e6af 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -3296,7 +3296,7 @@ static void __exit ia_module_exit(void)
 {
 	pci_unregister_driver(&ia_driver);
 
-        del_timer(&ia_timer);
+	del_timer_sync(&ia_timer);
 }
 
 module_init(ia_module_init);

From d05ac354062f1c2dc19b1f7ee0c147bf9a24c820 Mon Sep 17 00:00:00 2001
From: Zou Wei <zou_wei@huawei.com>
Date: Tue, 11 May 2021 14:58:53 +0800
Subject: [PATCH 2402/2658] mISDN: fix possible use-after-free in HFC_cleanup()

[ Upstream commit 009fc857c5f6fda81f2f7dd851b2d54193a8e733 ]

This module's remove path calls del_timer(). However, that function
does not wait until the timer handler finishes. This means that the
timer handler may still be running after the driver's remove function
has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler
has finished, and unable to re-schedule itself.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/isdn/hardware/mISDN/hfcpci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
index ff48da61c94c..89cf1d695a01 100644
--- a/drivers/isdn/hardware/mISDN/hfcpci.c
+++ b/drivers/isdn/hardware/mISDN/hfcpci.c
@@ -2352,7 +2352,7 @@ static void __exit
 HFC_cleanup(void)
 {
 	if (timer_pending(&hfc_tl))
-		del_timer(&hfc_tl);
+		del_timer_sync(&hfc_tl);
 
 	pci_unregister_driver(&hfc_driver);
 }

From b2bdfdb178c44ca3b51c6134f781d40c13708344 Mon Sep 17 00:00:00 2001
From: Zou Wei <zou_wei@huawei.com>
Date: Wed, 12 May 2021 15:00:24 +0800
Subject: [PATCH 2403/2658] atm: nicstar: Fix possible use-after-free in
 nicstar_cleanup()

[ Upstream commit 34e7434ba4e97f4b85c1423a59b2922ba7dff2ea ]

This module's remove path calls del_timer(). However, that function
does not wait until the timer handler finishes. This means that the
timer handler may still be running after the driver's remove function
has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler
has finished, and unable to re-schedule itself.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/atm/nicstar.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
index 49da83f87170..486d7a114031 100644
--- a/drivers/atm/nicstar.c
+++ b/drivers/atm/nicstar.c
@@ -298,7 +298,7 @@ static void __exit nicstar_cleanup(void)
 {
 	XPRINTK("nicstar: nicstar_cleanup() called.\n");
 
-	del_timer(&ns_timer);
+	del_timer_sync(&ns_timer);
 
 	pci_unregister_driver(&nicstar_driver);
 

From 1ced9531f74e1418c114161a070751e209a0e6ac Mon Sep 17 00:00:00 2001
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date: Wed, 12 May 2021 23:43:24 +0200
Subject: [PATCH 2404/2658] net: Treat __napi_schedule_irqoff() as
 __napi_schedule() on PREEMPT_RT

[ Upstream commit 8380c81d5c4fced6f4397795a5ae65758272bbfd ]

__napi_schedule_irqoff() is an optimized version of __napi_schedule()
which can be used where it is known that interrupts are disabled,
e.g. in interrupt-handlers, spin_lock_irq() sections or hrtimer
callbacks.

On PREEMPT_RT enabled kernels this assumptions is not true. Force-
threaded interrupt handlers and spinlocks are not disabling interrupts
and the NAPI hrtimer callback is forced into softirq context which runs
with interrupts enabled as well.

Chasing all usage sites of __napi_schedule_irqoff() is a whack-a-mole
game so make __napi_schedule_irqoff() invoke __napi_schedule() for
PREEMPT_RT kernels.

The callers of ____napi_schedule() in the networking core have been
audited and are correct on PREEMPT_RT kernels as well.

Reported-by: Juri Lelli <juri.lelli@redhat.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Juri Lelli <juri.lelli@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/dev.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index 6e58278eb63b..cf8823c5f01c 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4744,11 +4744,18 @@ EXPORT_SYMBOL(__napi_schedule);
  * __napi_schedule_irqoff - schedule for receive
  * @n: entry to schedule
  *
- * Variant of __napi_schedule() assuming hard irqs are masked
+ * Variant of __napi_schedule() assuming hard irqs are masked.
+ *
+ * On PREEMPT_RT enabled kernels this maps to __napi_schedule()
+ * because the interrupt disabled assumption might not be true
+ * due to force-threaded interrupts and spinlock substitution.
  */
 void __napi_schedule_irqoff(struct napi_struct *n)
 {
-	____napi_schedule(this_cpu_ptr(&softnet_data), n);
+	if (!IS_ENABLED(CONFIG_PREEMPT_RT))
+		____napi_schedule(this_cpu_ptr(&softnet_data), n);
+	else
+		__napi_schedule(n);
 }
 EXPORT_SYMBOL(__napi_schedule_irqoff);
 

From ae162e25f4c6e5352974ed20449f4ee60e24b2de Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Mon, 17 May 2021 15:15:45 +0300
Subject: [PATCH 2405/2658] reiserfs: add check for invalid 1st journal block

[ Upstream commit a149127be52fa7eaf5b3681a0317a2bbb772d5a9 ]

syzbot reported divide error in reiserfs.
The problem was in incorrect journal 1st block.

Syzbot's reproducer manualy generated wrong superblock
with incorrect 1st block. In journal_init() wasn't
any checks about this particular case.

For example, if 1st journal block is before superblock
1st block, it can cause zeroing important superblock members
in do_journal_end().

Link: https://lore.kernel.org/r/20210517121545.29645-1-paskripkin@gmail.com
Reported-by: syzbot+0ba9909df31c6a36974d@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/reiserfs/journal.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 00985f9db9f7..6a0fa0cdc1ed 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -2770,6 +2770,20 @@ int journal_init(struct super_block *sb, const char *j_dev_name,
 		goto free_and_return;
 	}
 
+	/*
+	 * Sanity check to see if journal first block is correct.
+	 * If journal first block is invalid it can cause
+	 * zeroing important superblock members.
+	 */
+	if (!SB_ONDISK_JOURNAL_DEVICE(sb) &&
+	    SB_ONDISK_JOURNAL_1st_BLOCK(sb) < SB_JOURNAL_1st_RESERVED_BLOCK(sb)) {
+		reiserfs_warning(sb, "journal-1393",
+				 "journal 1st super block is invalid: 1st reserved block %d, but actual 1st block is %d",
+				 SB_JOURNAL_1st_RESERVED_BLOCK(sb),
+				 SB_ONDISK_JOURNAL_1st_BLOCK(sb));
+		goto free_and_return;
+	}
+
 	if (journal_init_dev(sb, journal, j_dev_name) != 0) {
 		reiserfs_warning(sb, "sh-462",
 				 "unable to initialize journal device");

From 00926886aedec1c0646a07aa1cf14af2cf494c74 Mon Sep 17 00:00:00 2001
From: Xie Yongji <xieyongji@bytedance.com>
Date: Mon, 17 May 2021 16:49:12 +0800
Subject: [PATCH 2406/2658] drm/virtio: Fix double free on probe failure

[ Upstream commit cec7f1774605a5ef47c134af62afe7c75c30b0ee ]

The virtio_gpu_init() will free vgdev and vgdev->vbufs on failure.
But such failure will be caught by virtio_gpu_probe() and then
virtio_gpu_release() will be called to do some cleanup which
will free vgdev and vgdev->vbufs again. So let's set dev->dev_private
to NULL to avoid double free.

Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20210517084913.403-2-xieyongji@bytedance.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/virtio/virtgpu_kms.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c
index 476b9993b068..44f9762e86e8 100644
--- a/drivers/gpu/drm/virtio/virtgpu_kms.c
+++ b/drivers/gpu/drm/virtio/virtgpu_kms.c
@@ -233,6 +233,7 @@ int virtio_gpu_driver_load(struct drm_device *dev, unsigned long flags)
 err_vbufs:
 	vgdev->vdev->config->del_vqs(vgdev->vdev);
 err_vqs:
+	dev->dev_private = NULL;
 	kfree(vgdev);
 	return ret;
 }

From 90a4b8769e84b8d24e68d0c609314b2e9c70e458 Mon Sep 17 00:00:00 2001
From: Arturo Giusti <koredump@protonmail.com>
Date: Tue, 18 May 2021 12:34:57 +0200
Subject: [PATCH 2407/2658] udf: Fix NULL pointer dereference in udf_symlink
 function

[ Upstream commit fa236c2b2d4436d9f19ee4e5d5924e90ffd7bb43 ]

In function udf_symlink, epos.bh is assigned with the value returned
by udf_tgetblk. The function udf_tgetblk is defined in udf/misc.c
and returns the value of sb_getblk function that could be NULL.
Then, epos.bh is used without any check, causing a possible
NULL pointer dereference when sb_getblk fails.

This fix adds a check to validate the value of epos.bh.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=213083
Signed-off-by: Arturo Giusti <koredump@protonmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/udf/namei.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/udf/namei.c b/fs/udf/namei.c
index f34c545f4e54..074560ad190e 100644
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -945,6 +945,10 @@ static int udf_symlink(struct inode *dir, struct dentry *dentry,
 				iinfo->i_location.partitionReferenceNum,
 				0);
 		epos.bh = udf_tgetblk(sb, block);
+		if (unlikely(!epos.bh)) {
+			err = -ENOMEM;
+			goto out_no_entry;
+		}
 		lock_buffer(epos.bh);
 		memset(epos.bh->b_data, 0x00, bsize);
 		set_buffer_uptodate(epos.bh);

From 935707faf7ffa8808e7ad87f3481576f73512fd5 Mon Sep 17 00:00:00 2001
From: Jesse Brandeburg <jesse.brandeburg@intel.com>
Date: Thu, 25 Mar 2021 17:38:24 -0700
Subject: [PATCH 2408/2658] e100: handle eeprom as little endian

[ Upstream commit d4ef55288aa2e1b76033717242728ac98ddc4721 ]

Sparse tool was warning on some implicit conversions from
little endian data read from the EEPROM on the e100 cards.

Fix these by being explicit about the conversions using
le16_to_cpu().

Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/e100.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index 93c29094ceff..9035cb5fc70d 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -1423,7 +1423,7 @@ static int e100_phy_check_without_mii(struct nic *nic)
 	u8 phy_type;
 	int without_mii;
 
-	phy_type = (nic->eeprom[eeprom_phy_iface] >> 8) & 0x0f;
+	phy_type = (le16_to_cpu(nic->eeprom[eeprom_phy_iface]) >> 8) & 0x0f;
 
 	switch (phy_type) {
 	case NoSuchPhy: /* Non-MII PHY; UNTESTED! */
@@ -1543,7 +1543,7 @@ static int e100_phy_init(struct nic *nic)
 		mdio_write(netdev, nic->mii.phy_id, MII_BMCR, bmcr);
 	} else if ((nic->mac >= mac_82550_D102) || ((nic->flags & ich) &&
 	   (mdio_read(netdev, nic->mii.phy_id, MII_TPISTATUS) & 0x8000) &&
-		(nic->eeprom[eeprom_cnfg_mdix] & eeprom_mdix_enabled))) {
+	   (le16_to_cpu(nic->eeprom[eeprom_cnfg_mdix]) & eeprom_mdix_enabled))) {
 		/* enable/disable MDI/MDI-X auto-switching. */
 		mdio_write(netdev, nic->mii.phy_id, MII_NCONFIG,
 				nic->mii.force_media ? 0 : NCONFIG_AUTO_SWITCH);
@@ -2298,9 +2298,9 @@ static int e100_asf(struct nic *nic)
 {
 	/* ASF can be enabled from eeprom */
 	return (nic->pdev->device >= 0x1050) && (nic->pdev->device <= 0x1057) &&
-	   (nic->eeprom[eeprom_config_asf] & eeprom_asf) &&
-	   !(nic->eeprom[eeprom_config_asf] & eeprom_gcl) &&
-	   ((nic->eeprom[eeprom_smbus_addr] & 0xFF) != 0xFE);
+	   (le16_to_cpu(nic->eeprom[eeprom_config_asf]) & eeprom_asf) &&
+	   !(le16_to_cpu(nic->eeprom[eeprom_config_asf]) & eeprom_gcl) &&
+	   ((le16_to_cpu(nic->eeprom[eeprom_smbus_addr]) & 0xFF) != 0xFE);
 }
 
 static int e100_up(struct nic *nic)
@@ -2952,7 +2952,7 @@ static int e100_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
 	/* Wol magic packet can be enabled from eeprom */
 	if ((nic->mac >= mac_82558_D101_A4) &&
-	   (nic->eeprom[eeprom_id] & eeprom_id_wol)) {
+	   (le16_to_cpu(nic->eeprom[eeprom_id]) & eeprom_id_wol)) {
 		nic->flags |= wol_magic;
 		device_set_wakeup_enable(&pdev->dev, true);
 	}

From 60aeda319d84b525322da43136a2fec59f623332 Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Sat, 29 May 2021 13:07:46 +0200
Subject: [PATCH 2409/2658] ipv6: use prandom_u32() for ID generation

[ Upstream commit 62f20e068ccc50d6ab66fdb72ba90da2b9418c99 ]

This is a complement to commit aa6dd211e4b1 ("inet: use bigger hash
table for IP ID generation"), but focusing on some specific aspects
of IPv6.

Contary to IPv4, IPv6 only uses packet IDs with fragments, and with a
minimum MTU of 1280, it's much less easy to force a remote peer to
produce many fragments to explore its ID sequence. In addition packet
IDs are 32-bit in IPv6, which further complicates their analysis. On
the other hand, it is often easier to choose among plenty of possible
source addresses and partially work around the bigger hash table the
commit above permits, which leaves IPv6 partially exposed to some
possibilities of remote analysis at the risk of weakening some
protocols like DNS if some IDs can be predicted with a good enough
probability.

Given the wide range of permitted IDs, the risk of collision is extremely
low so there's no need to rely on the positive increment algorithm that
is shared with the IPv4 code via ip_idents_reserve(). We have a fast
PRNG, so let's simply call prandom_u32() and be done with it.

Performance measurements at 10 Gbps couldn't show any difference with
the previous code, even when using a single core, because due to the
large fragments, we're limited to only ~930 kpps at 10 Gbps and the cost
of the random generation is completely offset by other operations and by
the network transfer time. In addition, this change removes the need to
update a shared entry in the idents table so it may even end up being
slightly faster on large scale systems where this matters.

The risk of at least one collision here is about 1/80 million among
10 IDs, 1/850k among 100 IDs, and still only 1/8.5k among 1000 IDs,
which remains very low compared to IPv4 where all IDs are reused
every 4 to 80ms on a 10 Gbps flow depending on packet sizes.

Reported-by: Amit Klein <aksecurity@gmail.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20210529110746.6796-1-w@1wt.eu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/output_core.c | 28 +++++-----------------------
 1 file changed, 5 insertions(+), 23 deletions(-)

diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index 6b896cc9604e..e2de4b0479f6 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -14,29 +14,11 @@ static u32 __ipv6_select_ident(struct net *net,
 			       const struct in6_addr *dst,
 			       const struct in6_addr *src)
 {
-	const struct {
-		struct in6_addr dst;
-		struct in6_addr src;
-	} __aligned(SIPHASH_ALIGNMENT) combined = {
-		.dst = *dst,
-		.src = *src,
-	};
-	u32 hash, id;
-
-	/* Note the following code is not safe, but this is okay. */
-	if (unlikely(siphash_key_is_zero(&net->ipv4.ip_id_key)))
-		get_random_bytes(&net->ipv4.ip_id_key,
-				 sizeof(net->ipv4.ip_id_key));
-
-	hash = siphash(&combined, sizeof(combined), &net->ipv4.ip_id_key);
-
-	/* Treat id of 0 as unset and if we get 0 back from ip_idents_reserve,
-	 * set the hight order instead thus minimizing possible future
-	 * collisions.
-	 */
-	id = ip_idents_reserve(hash, 1);
-	if (unlikely(!id))
-		id = 1 << 31;
+	u32 id;
+
+	do {
+		id = prandom_u32();
+	} while (!id);
 
 	return id;
 }

From bf7ac44244460e720802d6fccc585256affd76a7 Mon Sep 17 00:00:00 2001
From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Date: Tue, 1 Jun 2021 19:07:49 +0800
Subject: [PATCH 2410/2658] RDMA/cxgb4: Fix missing error code in create_qp()

[ Upstream commit aeb27bb76ad8197eb47890b1ff470d5faf8ec9a5 ]

The error code is missing in this code scenario so 0 will be returned. Add
the error code '-EINVAL' to the return value 'ret'.

Eliminates the follow smatch warning:

drivers/infiniband/hw/cxgb4/qp.c:298 create_qp() warn: missing error code 'ret'.

Link: https://lore.kernel.org/r/1622545669-20625-1-git-send-email-jiapeng.chong@linux.alibaba.com
Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/cxgb4/qp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 07579e31168c..67e4002bd776 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -277,6 +277,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
 	if (user && (!wq->sq.bar2_pa || !wq->rq.bar2_pa)) {
 		pr_warn(MOD "%s: sqid %u or rqid %u not in BAR2 range.\n",
 			pci_name(rdev->lldi.pdev), wq->sq.qid, wq->rq.qid);
+		ret = -EINVAL;
 		goto free_dma;
 	}
 

From 4016222e820fa8c244be6ab2fa5ab45d39b4981d Mon Sep 17 00:00:00 2001
From: Joe Thornber <ejt@redhat.com>
Date: Tue, 13 Apr 2021 09:03:49 +0100
Subject: [PATCH 2411/2658] dm space maps: don't reset space map allocation
 cursor when committing

[ Upstream commit 5faafc77f7de69147d1e818026b9a0cbf036a7b2 ]

Current commit code resets the place where the search for free blocks
will begin back to the start of the metadata device.  There are a couple
of repercussions to this:

- The first allocation after the commit is likely to take longer than
  normal as it searches for a free block in an area that is likely to
  have very few free blocks (if any).

- Any free blocks it finds will have been recently freed.  Reusing them
  means we have fewer old copies of the metadata to aid recovery from
  hardware error.

Fix these issues by leaving the cursor alone, only resetting when the
search hits the end of the metadata device.

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/persistent-data/dm-space-map-disk.c     | 9 ++++++++-
 drivers/md/persistent-data/dm-space-map-metadata.c | 9 ++++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c
index bf4c5e2ccb6f..e0acae7a3815 100644
--- a/drivers/md/persistent-data/dm-space-map-disk.c
+++ b/drivers/md/persistent-data/dm-space-map-disk.c
@@ -171,6 +171,14 @@ static int sm_disk_new_block(struct dm_space_map *sm, dm_block_t *b)
 	 * Any block we allocate has to be free in both the old and current ll.
 	 */
 	r = sm_ll_find_common_free_block(&smd->old_ll, &smd->ll, smd->begin, smd->ll.nr_blocks, b);
+	if (r == -ENOSPC) {
+		/*
+		 * There's no free block between smd->begin and the end of the metadata device.
+		 * We search before smd->begin in case something has been freed.
+		 */
+		r = sm_ll_find_common_free_block(&smd->old_ll, &smd->ll, 0, smd->begin, b);
+	}
+
 	if (r)
 		return r;
 
@@ -199,7 +207,6 @@ static int sm_disk_commit(struct dm_space_map *sm)
 		return r;
 
 	memcpy(&smd->old_ll, &smd->ll, sizeof(smd->old_ll));
-	smd->begin = 0;
 	smd->nr_allocated_this_transaction = 0;
 
 	r = sm_disk_get_nr_free(sm, &nr_free);
diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
index 967d8f2a731f..62a4d7da9bd9 100644
--- a/drivers/md/persistent-data/dm-space-map-metadata.c
+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
@@ -451,6 +451,14 @@ static int sm_metadata_new_block_(struct dm_space_map *sm, dm_block_t *b)
 	 * Any block we allocate has to be free in both the old and current ll.
 	 */
 	r = sm_ll_find_common_free_block(&smm->old_ll, &smm->ll, smm->begin, smm->ll.nr_blocks, b);
+	if (r == -ENOSPC) {
+		/*
+		 * There's no free block between smm->begin and the end of the metadata device.
+		 * We search before smm->begin in case something has been freed.
+		 */
+		r = sm_ll_find_common_free_block(&smm->old_ll, &smm->ll, 0, smm->begin, b);
+	}
+
 	if (r)
 		return r;
 
@@ -502,7 +510,6 @@ static int sm_metadata_commit(struct dm_space_map *sm)
 		return r;
 
 	memcpy(&smm->old_ll, &smm->ll, sizeof(smm->old_ll));
-	smm->begin = 0;
 	smm->allocated_this_transaction = 0;
 
 	return 0;

From 3092792518ed66991d65fd1dbf31446111cd84bd Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Mon, 7 Jun 2021 22:55:21 +0800
Subject: [PATCH 2412/2658] net: micrel: check return value after calling
 platform_get_resource()

[ Upstream commit 20f1932e2282c58cb5ac59517585206cf5b385ae ]

It will cause null-ptr-deref if platform_get_resource() returns NULL,
we need check the return value.

Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/micrel/ks8842.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/micrel/ks8842.c b/drivers/net/ethernet/micrel/ks8842.c
index cb0102dd7f70..d691c33dffc6 100644
--- a/drivers/net/ethernet/micrel/ks8842.c
+++ b/drivers/net/ethernet/micrel/ks8842.c
@@ -1150,6 +1150,10 @@ static int ks8842_probe(struct platform_device *pdev)
 	unsigned i;
 
 	iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!iomem) {
+		dev_err(&pdev->dev, "Invalid resource\n");
+		return -EINVAL;
+	}
 	if (!request_mem_region(iomem->start, resource_size(iomem), DRV_NAME))
 		goto err_mem_region;
 

From 8206fcc7ec2c32c2ccf156b0c6a4d386978c41a8 Mon Sep 17 00:00:00 2001
From: Minchan Kim <minchan@kernel.org>
Date: Wed, 9 Jun 2021 09:37:17 -0700
Subject: [PATCH 2413/2658] selinux: use __GFP_NOWARN with GFP_NOWAIT in the
 AVC

[ Upstream commit 648f2c6100cfa18e7dfe43bc0b9c3b73560d623c ]

In the field, we have seen lots of allocation failure from the call
path below.

06-03 13:29:12.999 1010315 31557 31557 W Binder  : 31542_2: page allocation failure: order:0, mode:0x800(GFP_NOWAIT), nodemask=(null),cpuset=background,mems_allowed=0
...
...
06-03 13:29:12.999 1010315 31557 31557 W Call trace:
06-03 13:29:12.999 1010315 31557 31557 W         : dump_backtrace.cfi_jt+0x0/0x8
06-03 13:29:12.999 1010315 31557 31557 W         : dump_stack+0xc8/0x14c
06-03 13:29:12.999 1010315 31557 31557 W         : warn_alloc+0x158/0x1c8
06-03 13:29:12.999 1010315 31557 31557 W         : __alloc_pages_slowpath+0x9d8/0xb80
06-03 13:29:12.999 1010315 31557 31557 W         : __alloc_pages_nodemask+0x1c4/0x430
06-03 13:29:12.999 1010315 31557 31557 W         : allocate_slab+0xb4/0x390
06-03 13:29:12.999 1010315 31557 31557 W         : ___slab_alloc+0x12c/0x3a4
06-03 13:29:12.999 1010315 31557 31557 W         : kmem_cache_alloc+0x358/0x5e4
06-03 13:29:12.999 1010315 31557 31557 W         : avc_alloc_node+0x30/0x184
06-03 13:29:12.999 1010315 31557 31557 W         : avc_update_node+0x54/0x4f0
06-03 13:29:12.999 1010315 31557 31557 W         : avc_has_extended_perms+0x1a4/0x460
06-03 13:29:12.999 1010315 31557 31557 W         : selinux_file_ioctl+0x320/0x3d0
06-03 13:29:12.999 1010315 31557 31557 W         : __arm64_sys_ioctl+0xec/0x1fc
06-03 13:29:12.999 1010315 31557 31557 W         : el0_svc_common+0xc0/0x24c
06-03 13:29:12.999 1010315 31557 31557 W         : el0_svc+0x28/0x88
06-03 13:29:12.999 1010315 31557 31557 W         : el0_sync_handler+0x8c/0xf0
06-03 13:29:12.999 1010315 31557 31557 W         : el0_sync+0x1a4/0x1c0
..
..
06-03 13:29:12.999 1010315 31557 31557 W SLUB    : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO)
06-03 13:29:12.999 1010315 31557 31557 W cache   : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0
06-03 13:29:12.999 1010315 31557 31557 W node 0  : slabs: 57, objs: 2907, free: 0
06-03 13:29:12.999 1010161 10686 10686 W SLUB    : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO)
06-03 13:29:12.999 1010161 10686 10686 W cache   : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0
06-03 13:29:12.999 1010161 10686 10686 W node 0  : slabs: 57, objs: 2907, free: 0
06-03 13:29:12.999 1010161 10686 10686 W SLUB    : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO)
06-03 13:29:12.999 1010161 10686 10686 W cache   : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0
06-03 13:29:12.999 1010161 10686 10686 W node 0  : slabs: 57, objs: 2907, free: 0
06-03 13:29:12.999 1010161 10686 10686 W SLUB    : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO)
06-03 13:29:12.999 1010161 10686 10686 W cache   : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0
06-03 13:29:12.999 1010161 10686 10686 W node 0  : slabs: 57, objs: 2907, free: 0
06-03 13:29:13.000 1010161 10686 10686 W SLUB    : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO)
06-03 13:29:13.000 1010161 10686 10686 W cache   : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0
06-03 13:29:13.000 1010161 10686 10686 W node 0  : slabs: 57, objs: 2907, free: 0
06-03 13:29:13.000 1010161 10686 10686 W SLUB    : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO)
06-03 13:29:13.000 1010161 10686 10686 W cache   : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0
06-03 13:29:13.000 1010161 10686 10686 W node 0  : slabs: 57, objs: 2907, free: 0
06-03 13:29:13.000 1010161 10686 10686 W SLUB    : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO)
06-03 13:29:13.000 1010161 10686 10686 W cache   : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0
06-03 13:29:13.000 1010161 10686 10686 W node 0  : slabs: 57, objs: 2907, free: 0
06-03 13:29:13.000 10230 30892 30892 W SLUB    : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO)
06-03 13:29:13.000 10230 30892 30892 W cache   : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0
06-03 13:29:13.000 10230 30892 30892 W node 0  : slabs: 57, objs: 2907, free: 0
06-03 13:29:13.000 10230 30892 30892 W SLUB    : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO)
06-03 13:29:13.000 10230 30892 30892 W cache   : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0

Based on [1], selinux is tolerate for failure of memory allocation.
Then, use __GFP_NOWARN together.

[1] 476accbe2f6e ("selinux: use GFP_NOWAIT in the AVC kmem_caches")

Signed-off-by: Minchan Kim <minchan@kernel.org>
[PM: subj fix, line wraps, normalized commit refs]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/selinux/avc.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index f3c473791b69..a16c72c2a967 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -348,26 +348,27 @@ static struct avc_xperms_decision_node
 	struct avc_xperms_decision_node *xpd_node;
 	struct extended_perms_decision *xpd;
 
-	xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, GFP_NOWAIT);
+	xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep,
+				     GFP_NOWAIT | __GFP_NOWARN);
 	if (!xpd_node)
 		return NULL;
 
 	xpd = &xpd_node->xpd;
 	if (which & XPERMS_ALLOWED) {
 		xpd->allowed = kmem_cache_zalloc(avc_xperms_data_cachep,
-						GFP_NOWAIT);
+						GFP_NOWAIT | __GFP_NOWARN);
 		if (!xpd->allowed)
 			goto error;
 	}
 	if (which & XPERMS_AUDITALLOW) {
 		xpd->auditallow = kmem_cache_zalloc(avc_xperms_data_cachep,
-						GFP_NOWAIT);
+						GFP_NOWAIT | __GFP_NOWARN);
 		if (!xpd->auditallow)
 			goto error;
 	}
 	if (which & XPERMS_DONTAUDIT) {
 		xpd->dontaudit = kmem_cache_zalloc(avc_xperms_data_cachep,
-						GFP_NOWAIT);
+						GFP_NOWAIT | __GFP_NOWARN);
 		if (!xpd->dontaudit)
 			goto error;
 	}
@@ -395,7 +396,7 @@ static struct avc_xperms_node *avc_xperms_alloc(void)
 {
 	struct avc_xperms_node *xp_node;
 
-	xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT);
+	xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT | __GFP_NOWARN);
 	if (!xp_node)
 		return xp_node;
 	INIT_LIST_HEAD(&xp_node->xpd_head);
@@ -548,7 +549,7 @@ static struct avc_node *avc_alloc_node(void)
 {
 	struct avc_node *node;
 
-	node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT);
+	node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT | __GFP_NOWARN);
 	if (!node)
 		goto out;
 

From a0c62f0fff51fa7fbc09cb5a2a8fda63274477b2 Mon Sep 17 00:00:00 2001
From: Steffen Klassert <steffen.klassert@secunet.com>
Date: Mon, 7 Jun 2021 15:21:49 +0200
Subject: [PATCH 2414/2658] xfrm: Fix error reporting in xfrm_state_construct.

[ Upstream commit 6fd06963fa74197103cdbb4b494763127b3f2f34 ]

When memory allocation for XFRMA_ENCAP or XFRMA_COADDR fails,
the error will not be reported because the -ENOMEM assignment
to the err variable is overwritten before. Fix this by moving
these two in front of the function so that memory allocation
failures will be reported.

Reported-by: Tobias Brunner <tobias@strongswan.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xfrm/xfrm_user.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index d967674c24e8..2e779831389e 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -566,6 +566,20 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
 
 	copy_from_user_state(x, p);
 
+	if (attrs[XFRMA_ENCAP]) {
+		x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
+				   sizeof(*x->encap), GFP_KERNEL);
+		if (x->encap == NULL)
+			goto error;
+	}
+
+	if (attrs[XFRMA_COADDR]) {
+		x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
+				    sizeof(*x->coaddr), GFP_KERNEL);
+		if (x->coaddr == NULL)
+			goto error;
+	}
+
 	if (attrs[XFRMA_SA_EXTRA_FLAGS])
 		x->props.extra_flags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]);
 
@@ -586,23 +600,9 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
 				   attrs[XFRMA_ALG_COMP])))
 		goto error;
 
-	if (attrs[XFRMA_ENCAP]) {
-		x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
-				   sizeof(*x->encap), GFP_KERNEL);
-		if (x->encap == NULL)
-			goto error;
-	}
-
 	if (attrs[XFRMA_TFCPAD])
 		x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]);
 
-	if (attrs[XFRMA_COADDR]) {
-		x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
-				    sizeof(*x->coaddr), GFP_KERNEL);
-		if (x->coaddr == NULL)
-			goto error;
-	}
-
 	xfrm_mark_get(attrs, &x->mark);
 
 	err = __xfrm_init_state(x, false);

From 52d8f7232c91f1d4b2df476544c847872c4324b9 Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Thu, 3 Jun 2021 09:28:14 +0300
Subject: [PATCH 2415/2658] wlcore/wl12xx: Fix wl12xx get_mac error if device
 is in ELP

[ Upstream commit 11ef6bc846dcdce838f0b00c5f6a562c57e5d43b ]

At least on wl12xx, reading the MAC after boot can fail with a warning
at drivers/net/wireless/ti/wlcore/sdio.c:78 wl12xx_sdio_raw_read.
The failed call comes from wl12xx_get_mac() that wlcore_nvs_cb() calls
after request_firmware_work_func().

After the error, no wireless interface is created. Reloading the wl12xx
module makes the interface work.

Turns out the wlan controller can be in a low-power ELP state after the
boot from the bootloader or kexec, and needs to be woken up first.

Let's wake the hardware and add a sleep after that similar to
wl12xx_pre_boot() is already doing.

Note that a similar issue could exist for wl18xx, but I have not seen it
so far. And a search for wl18xx_get_mac and wl12xx_sdio_raw_read did not
produce similar errors.

Cc: Carl Philipp Klemm <philipp@uvos.xyz>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210603062814.19464-1-tony@atomide.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ti/wl12xx/main.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
index e4b28d37046a..c453a634d769 100644
--- a/drivers/net/wireless/ti/wl12xx/main.c
+++ b/drivers/net/wireless/ti/wl12xx/main.c
@@ -1515,6 +1515,13 @@ static int wl12xx_get_fuse_mac(struct wl1271 *wl)
 	u32 mac1, mac2;
 	int ret;
 
+	/* Device may be in ELP from the bootloader or kexec */
+	ret = wlcore_write32(wl, WL12XX_WELP_ARM_COMMAND, WELP_ARM_COMMAND_VAL);
+	if (ret < 0)
+		goto out;
+
+	usleep_range(500000, 700000);
+
 	ret = wlcore_set_partition(wl, &wl->ptable[PART_DRPW]);
 	if (ret < 0)
 		goto out;

From c384ba70674111247956a2986a9f6c1d84a55601 Mon Sep 17 00:00:00 2001
From: Lee Gibson <leegib@gmail.com>
Date: Wed, 28 Apr 2021 12:55:08 +0100
Subject: [PATCH 2416/2658] wl1251: Fix possible buffer overflow in
 wl1251_cmd_scan

[ Upstream commit d10a87a3535cce2b890897914f5d0d83df669c63 ]

Function wl1251_cmd_scan calls memcpy without checking the length.
Harden by checking the length is within the maximum allowed size.

Signed-off-by: Lee Gibson <leegib@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210428115508.25624-1-leegib@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ti/wl1251/cmd.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ti/wl1251/cmd.c b/drivers/net/wireless/ti/wl1251/cmd.c
index ede31f048ef9..247f4310a38f 100644
--- a/drivers/net/wireless/ti/wl1251/cmd.c
+++ b/drivers/net/wireless/ti/wl1251/cmd.c
@@ -465,9 +465,12 @@ int wl1251_cmd_scan(struct wl1251 *wl, u8 *ssid, size_t ssid_len,
 		cmd->channels[i].channel = channels[i]->hw_value;
 	}
 
-	cmd->params.ssid_len = ssid_len;
-	if (ssid)
-		memcpy(cmd->params.ssid, ssid, ssid_len);
+	if (ssid) {
+		int len = clamp_val(ssid_len, 0, IEEE80211_MAX_SSID_LEN);
+
+		cmd->params.ssid_len = len;
+		memcpy(cmd->params.ssid, ssid, len);
+	}
 
 	ret = wl1251_cmd_send(wl, CMD_SCAN, cmd, sizeof(*cmd));
 	if (ret < 0) {

From 253a7c6aabdb06814bdbc522b45cabc855f1a61c Mon Sep 17 00:00:00 2001
From: Zou Wei <zou_wei@huawei.com>
Date: Wed, 12 May 2021 11:05:14 +0800
Subject: [PATCH 2417/2658] cw1200: add missing MODULE_DEVICE_TABLE

[ Upstream commit dd778f89225cd258e8f0fed2b7256124982c8bb5 ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this driver when it is built
as an external module.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1620788714-14300-1-git-send-email-zou_wei@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/cw1200/cw1200_sdio.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/cw1200/cw1200_sdio.c b/drivers/net/wireless/cw1200/cw1200_sdio.c
index d3acc85932a5..de92107549ee 100644
--- a/drivers/net/wireless/cw1200/cw1200_sdio.c
+++ b/drivers/net/wireless/cw1200/cw1200_sdio.c
@@ -62,6 +62,7 @@ static const struct sdio_device_id cw1200_sdio_ids[] = {
 	{ SDIO_DEVICE(SDIO_VENDOR_ID_STE, SDIO_DEVICE_ID_STE_CW1200) },
 	{ /* end: all zeroes */			},
 };
+MODULE_DEVICE_TABLE(sdio, cw1200_sdio_ids);
 
 /* hwbus_ops implemetation */
 

From b981d34f120b48ab2d208f70121da51a8f7bdf0d Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Sun, 20 Jun 2021 15:24:14 +0000
Subject: [PATCH 2418/2658] atm: nicstar: use 'dma_free_coherent' instead of
 'kfree'

[ Upstream commit 6a1e5a4af17e440dd82a58a2c5f40ff17a82b722 ]

When 'nicstar_init_one' fails, 'ns_init_card_error' will be executed for
error handling, but the correct memory free function should be used,
otherwise it will cause an error. Since 'card->rsq.org' and
'card->tsq.org' are allocated using 'dma_alloc_coherent' function, they
should be freed using 'dma_free_coherent'.

Fix this by using 'dma_free_coherent' instead of 'kfree'

This log reveals it:

[    3.440294] kernel BUG at mm/slub.c:4206!
[    3.441059] invalid opcode: 0000 [#1] PREEMPT SMP PTI
[    3.441430] CPU: 2 PID: 1 Comm: swapper/0 Not tainted 5.12.4-g70e7f0549188-dirty #141
[    3.441986] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[    3.442780] RIP: 0010:kfree+0x26a/0x300
[    3.443065] Code: e8 3a c3 b9 ff e9 d6 fd ff ff 49 8b 45 00 31 db a9 00 00 01 00 75 4d 49 8b 45 00 a9 00 00 01 00 75 0a 49 8b 45 08 a8 01 75 02 <0f> 0b 89 d9 b8 00 10 00 00 be 06 00 00 00 48 d3 e0 f7 d8 48 63 d0
[    3.443396] RSP: 0000:ffffc90000017b70 EFLAGS: 00010246
[    3.443396] RAX: dead000000000100 RBX: 0000000000000000 RCX: 0000000000000000
[    3.443396] RDX: 0000000000000000 RSI: ffffffff85d3df94 RDI: ffffffff85df38e6
[    3.443396] RBP: ffffc90000017b90 R08: 0000000000000001 R09: 0000000000000001
[    3.443396] R10: 0000000000000000 R11: 0000000000000001 R12: ffff888107dc0000
[    3.443396] R13: ffffea00001f0100 R14: ffff888101a8bf00 R15: ffff888107dc0160
[    3.443396] FS:  0000000000000000(0000) GS:ffff88817bc80000(0000) knlGS:0000000000000000
[    3.443396] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    3.443396] CR2: 0000000000000000 CR3: 000000000642e000 CR4: 00000000000006e0
[    3.443396] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    3.443396] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[    3.443396] Call Trace:
[    3.443396]  ns_init_card_error+0x12c/0x220
[    3.443396]  nicstar_init_one+0x10d2/0x1130
[    3.443396]  local_pci_probe+0x4a/0xb0
[    3.443396]  pci_device_probe+0x126/0x1d0
[    3.443396]  ? pci_device_remove+0x100/0x100
[    3.443396]  really_probe+0x27e/0x650
[    3.443396]  driver_probe_device+0x84/0x1d0
[    3.443396]  ? mutex_lock_nested+0x16/0x20
[    3.443396]  device_driver_attach+0x63/0x70
[    3.443396]  __driver_attach+0x117/0x1a0
[    3.443396]  ? device_driver_attach+0x70/0x70
[    3.443396]  bus_for_each_dev+0xb6/0x110
[    3.443396]  ? rdinit_setup+0x40/0x40
[    3.443396]  driver_attach+0x22/0x30
[    3.443396]  bus_add_driver+0x1e6/0x2a0
[    3.443396]  driver_register+0xa4/0x180
[    3.443396]  __pci_register_driver+0x77/0x80
[    3.443396]  ? uPD98402_module_init+0xd/0xd
[    3.443396]  nicstar_init+0x1f/0x75
[    3.443396]  do_one_initcall+0x7a/0x3d0
[    3.443396]  ? rdinit_setup+0x40/0x40
[    3.443396]  ? rcu_read_lock_sched_held+0x4a/0x70
[    3.443396]  kernel_init_freeable+0x2a7/0x2f9
[    3.443396]  ? rest_init+0x2c0/0x2c0
[    3.443396]  kernel_init+0x13/0x180
[    3.443396]  ? rest_init+0x2c0/0x2c0
[    3.443396]  ? rest_init+0x2c0/0x2c0
[    3.443396]  ret_from_fork+0x1f/0x30
[    3.443396] Modules linked in:
[    3.443396] Dumping ftrace buffer:
[    3.443396]    (ftrace buffer empty)
[    3.458593] ---[ end trace 3c6f8f0d8ef59bcd ]---
[    3.458922] RIP: 0010:kfree+0x26a/0x300
[    3.459198] Code: e8 3a c3 b9 ff e9 d6 fd ff ff 49 8b 45 00 31 db a9 00 00 01 00 75 4d 49 8b 45 00 a9 00 00 01 00 75 0a 49 8b 45 08 a8 01 75 02 <0f> 0b 89 d9 b8 00 10 00 00 be 06 00 00 00 48 d3 e0 f7 d8 48 63 d0
[    3.460499] RSP: 0000:ffffc90000017b70 EFLAGS: 00010246
[    3.460870] RAX: dead000000000100 RBX: 0000000000000000 RCX: 0000000000000000
[    3.461371] RDX: 0000000000000000 RSI: ffffffff85d3df94 RDI: ffffffff85df38e6
[    3.461873] RBP: ffffc90000017b90 R08: 0000000000000001 R09: 0000000000000001
[    3.462372] R10: 0000000000000000 R11: 0000000000000001 R12: ffff888107dc0000
[    3.462871] R13: ffffea00001f0100 R14: ffff888101a8bf00 R15: ffff888107dc0160
[    3.463368] FS:  0000000000000000(0000) GS:ffff88817bc80000(0000) knlGS:0000000000000000
[    3.463949] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    3.464356] CR2: 0000000000000000 CR3: 000000000642e000 CR4: 00000000000006e0
[    3.464856] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    3.465356] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[    3.465860] Kernel panic - not syncing: Fatal exception
[    3.466370] Dumping ftrace buffer:
[    3.466616]    (ftrace buffer empty)
[    3.466871] Kernel Offset: disabled
[    3.467122] Rebooting in 1 seconds..

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/atm/nicstar.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
index 486d7a114031..86f3e72e686f 100644
--- a/drivers/atm/nicstar.c
+++ b/drivers/atm/nicstar.c
@@ -837,10 +837,12 @@ static void ns_init_card_error(ns_dev *card, int error)
 			dev_kfree_skb_any(hb);
 	}
 	if (error >= 12) {
-		kfree(card->rsq.org);
+		dma_free_coherent(&card->pcidev->dev, NS_RSQSIZE + NS_RSQ_ALIGNMENT,
+				card->rsq.org, card->rsq.dma);
 	}
 	if (error >= 11) {
-		kfree(card->tsq.org);
+		dma_free_coherent(&card->pcidev->dev, NS_TSQSIZE + NS_TSQ_ALIGNMENT,
+				card->tsq.org, card->tsq.dma);
 	}
 	if (error >= 10) {
 		free_irq(card->pcidev->irq, card);

From 9fac5a3740c675b07bb5a3338742c3570bb5fe7f Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Sun, 20 Jun 2021 15:24:15 +0000
Subject: [PATCH 2419/2658] atm: nicstar: register the interrupt handler in the
 right place

[ Upstream commit 70b639dc41ad499384e41e106fce72e36805c9f2 ]

Because the error handling is sequential, the application of resources
should be carried out in the order of error handling, so the operation
of registering the interrupt handler should be put in front, so as not
to free the unregistered interrupt handler during error handling.

This log reveals it:

[    3.438724] Trying to free already-free IRQ 23
[    3.439060] WARNING: CPU: 5 PID: 1 at kernel/irq/manage.c:1825 free_irq+0xfb/0x480
[    3.440039] Modules linked in:
[    3.440257] CPU: 5 PID: 1 Comm: swapper/0 Not tainted 5.12.4-g70e7f0549188-dirty #142
[    3.440793] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[    3.441561] RIP: 0010:free_irq+0xfb/0x480
[    3.441845] Code: 6e 08 74 6f 4d 89 f4 e8 c3 78 09 00 4d 8b 74 24 18 4d 85 f6 75 e3 e8 b4 78 09 00 8b 75 c8 48 c7 c7 a0 ac d5 85 e8 95 d7 f5 ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 87 c5 90 03 48 8b 43 40 4c 8b a0 80
[    3.443121] RSP: 0000:ffffc90000017b50 EFLAGS: 00010086
[    3.443483] RAX: 0000000000000000 RBX: ffff888107c6f000 RCX: 0000000000000000
[    3.443972] RDX: 0000000000000000 RSI: ffffffff8123f301 RDI: 00000000ffffffff
[    3.444462] RBP: ffffc90000017b90 R08: 0000000000000001 R09: 0000000000000003
[    3.444950] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
[    3.444994] R13: ffff888107dc0000 R14: ffff888104f6bf00 R15: ffff888107c6f0a8
[    3.444994] FS:  0000000000000000(0000) GS:ffff88817bd40000(0000) knlGS:0000000000000000
[    3.444994] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    3.444994] CR2: 0000000000000000 CR3: 000000000642e000 CR4: 00000000000006e0
[    3.444994] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    3.444994] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[    3.444994] Call Trace:
[    3.444994]  ns_init_card_error+0x18e/0x250
[    3.444994]  nicstar_init_one+0x10d2/0x1130
[    3.444994]  local_pci_probe+0x4a/0xb0
[    3.444994]  pci_device_probe+0x126/0x1d0
[    3.444994]  ? pci_device_remove+0x100/0x100
[    3.444994]  really_probe+0x27e/0x650
[    3.444994]  driver_probe_device+0x84/0x1d0
[    3.444994]  ? mutex_lock_nested+0x16/0x20
[    3.444994]  device_driver_attach+0x63/0x70
[    3.444994]  __driver_attach+0x117/0x1a0
[    3.444994]  ? device_driver_attach+0x70/0x70
[    3.444994]  bus_for_each_dev+0xb6/0x110
[    3.444994]  ? rdinit_setup+0x40/0x40
[    3.444994]  driver_attach+0x22/0x30
[    3.444994]  bus_add_driver+0x1e6/0x2a0
[    3.444994]  driver_register+0xa4/0x180
[    3.444994]  __pci_register_driver+0x77/0x80
[    3.444994]  ? uPD98402_module_init+0xd/0xd
[    3.444994]  nicstar_init+0x1f/0x75
[    3.444994]  do_one_initcall+0x7a/0x3d0
[    3.444994]  ? rdinit_setup+0x40/0x40
[    3.444994]  ? rcu_read_lock_sched_held+0x4a/0x70
[    3.444994]  kernel_init_freeable+0x2a7/0x2f9
[    3.444994]  ? rest_init+0x2c0/0x2c0
[    3.444994]  kernel_init+0x13/0x180
[    3.444994]  ? rest_init+0x2c0/0x2c0
[    3.444994]  ? rest_init+0x2c0/0x2c0
[    3.444994]  ret_from_fork+0x1f/0x30
[    3.444994] Kernel panic - not syncing: panic_on_warn set ...
[    3.444994] CPU: 5 PID: 1 Comm: swapper/0 Not tainted 5.12.4-g70e7f0549188-dirty #142
[    3.444994] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[    3.444994] Call Trace:
[    3.444994]  dump_stack+0xba/0xf5
[    3.444994]  ? free_irq+0xfb/0x480
[    3.444994]  panic+0x155/0x3ed
[    3.444994]  ? __warn+0xed/0x150
[    3.444994]  ? free_irq+0xfb/0x480
[    3.444994]  __warn+0x103/0x150
[    3.444994]  ? free_irq+0xfb/0x480
[    3.444994]  report_bug+0x119/0x1c0
[    3.444994]  handle_bug+0x3b/0x80
[    3.444994]  exc_invalid_op+0x18/0x70
[    3.444994]  asm_exc_invalid_op+0x12/0x20
[    3.444994] RIP: 0010:free_irq+0xfb/0x480
[    3.444994] Code: 6e 08 74 6f 4d 89 f4 e8 c3 78 09 00 4d 8b 74 24 18 4d 85 f6 75 e3 e8 b4 78 09 00 8b 75 c8 48 c7 c7 a0 ac d5 85 e8 95 d7 f5 ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 87 c5 90 03 48 8b 43 40 4c 8b a0 80
[    3.444994] RSP: 0000:ffffc90000017b50 EFLAGS: 00010086
[    3.444994] RAX: 0000000000000000 RBX: ffff888107c6f000 RCX: 0000000000000000
[    3.444994] RDX: 0000000000000000 RSI: ffffffff8123f301 RDI: 00000000ffffffff
[    3.444994] RBP: ffffc90000017b90 R08: 0000000000000001 R09: 0000000000000003
[    3.444994] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
[    3.444994] R13: ffff888107dc0000 R14: ffff888104f6bf00 R15: ffff888107c6f0a8
[    3.444994]  ? vprintk_func+0x71/0x110
[    3.444994]  ns_init_card_error+0x18e/0x250
[    3.444994]  nicstar_init_one+0x10d2/0x1130
[    3.444994]  local_pci_probe+0x4a/0xb0
[    3.444994]  pci_device_probe+0x126/0x1d0
[    3.444994]  ? pci_device_remove+0x100/0x100
[    3.444994]  really_probe+0x27e/0x650
[    3.444994]  driver_probe_device+0x84/0x1d0
[    3.444994]  ? mutex_lock_nested+0x16/0x20
[    3.444994]  device_driver_attach+0x63/0x70
[    3.444994]  __driver_attach+0x117/0x1a0
[    3.444994]  ? device_driver_attach+0x70/0x70
[    3.444994]  bus_for_each_dev+0xb6/0x110
[    3.444994]  ? rdinit_setup+0x40/0x40
[    3.444994]  driver_attach+0x22/0x30
[    3.444994]  bus_add_driver+0x1e6/0x2a0
[    3.444994]  driver_register+0xa4/0x180
[    3.444994]  __pci_register_driver+0x77/0x80
[    3.444994]  ? uPD98402_module_init+0xd/0xd
[    3.444994]  nicstar_init+0x1f/0x75
[    3.444994]  do_one_initcall+0x7a/0x3d0
[    3.444994]  ? rdinit_setup+0x40/0x40
[    3.444994]  ? rcu_read_lock_sched_held+0x4a/0x70
[    3.444994]  kernel_init_freeable+0x2a7/0x2f9
[    3.444994]  ? rest_init+0x2c0/0x2c0
[    3.444994]  kernel_init+0x13/0x180
[    3.444994]  ? rest_init+0x2c0/0x2c0
[    3.444994]  ? rest_init+0x2c0/0x2c0
[    3.444994]  ret_from_fork+0x1f/0x30
[    3.444994] Dumping ftrace buffer:
[    3.444994]    (ftrace buffer empty)
[    3.444994] Kernel Offset: disabled
[    3.444994] Rebooting in 1 seconds..

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/atm/nicstar.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
index 86f3e72e686f..56d464b58768 100644
--- a/drivers/atm/nicstar.c
+++ b/drivers/atm/nicstar.c
@@ -525,6 +525,15 @@ static int ns_init_card(int i, struct pci_dev *pcidev)
 	/* Set the VPI/VCI MSb mask to zero so we can receive OAM cells */
 	writel(0x00000000, card->membase + VPM);
 
+	card->intcnt = 0;
+	if (request_irq
+	    (pcidev->irq, &ns_irq_handler, IRQF_SHARED, "nicstar", card) != 0) {
+		pr_err("nicstar%d: can't allocate IRQ %d.\n", i, pcidev->irq);
+		error = 9;
+		ns_init_card_error(card, error);
+		return error;
+	}
+
 	/* Initialize TSQ */
 	card->tsq.org = dma_alloc_coherent(&card->pcidev->dev,
 					   NS_TSQSIZE + NS_TSQ_ALIGNMENT,
@@ -751,15 +760,6 @@ static int ns_init_card(int i, struct pci_dev *pcidev)
 
 	card->efbie = 1;
 
-	card->intcnt = 0;
-	if (request_irq
-	    (pcidev->irq, &ns_irq_handler, IRQF_SHARED, "nicstar", card) != 0) {
-		printk("nicstar%d: can't allocate IRQ %d.\n", i, pcidev->irq);
-		error = 9;
-		ns_init_card_error(card, error);
-		return error;
-	}
-
 	/* Register device */
 	card->atmdev = atm_dev_register("nicstar", &card->pcidev->dev, &atm_ops,
 					-1, NULL);

From 0df0262d5e1507a74cc62c05f576fcf81b64b3b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=8D=C3=B1igo=20Huguet?= <ihuguet@redhat.com>
Date: Mon, 21 Jun 2021 17:32:35 +0200
Subject: [PATCH 2420/2658] sfc: avoid double pci_remove of VFs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 45423cff1db66cf0993e8a9bd0ac93e740149e49 ]

If pci_remove was called for a PF with VFs, the removal of the VFs was
called twice from efx_ef10_sriov_fini: one directly with pci_driver->remove
and another implicit by calling pci_disable_sriov, which also perform
the VFs remove. This was leading to crashing the kernel on the second
attempt.

Given that pci_disable_sriov already calls to pci remove function, get
rid of the direct call to pci_driver->remove from the driver.

2 different ways to trigger the bug:
- Create one or more VFs, then attach the PF to a virtual machine (at
  least with qemu/KVM)
- Create one or more VFs, then remove the PF with:
  echo 1 > /sys/bus/pci/devices/PF_PCI_ID/remove

Removing sfc module does not trigger the error, at least for me, because
it removes the VF first, and then the PF.

Example of a log with the error:
    list_del corruption, ffff967fd20a8ad0->next is LIST_POISON1 (dead000000000100)
    ------------[ cut here ]------------
    kernel BUG at lib/list_debug.c:47!
    [...trimmed...]
    RIP: 0010:__list_del_entry_valid.cold.1+0x12/0x4c
    [...trimmed...]
    Call Trace:
    efx_dissociate+0x1f/0x140 [sfc]
    efx_pci_remove+0x27/0x150 [sfc]
    pci_device_remove+0x3b/0xc0
    device_release_driver_internal+0x103/0x1f0
    pci_stop_bus_device+0x69/0x90
    pci_stop_and_remove_bus_device+0xe/0x20
    pci_iov_remove_virtfn+0xba/0x120
    sriov_disable+0x2f/0xe0
    efx_ef10_pci_sriov_disable+0x52/0x80 [sfc]
    ? pcie_aer_is_native+0x12/0x40
    efx_ef10_sriov_fini+0x72/0x110 [sfc]
    efx_pci_remove+0x62/0x150 [sfc]
    pci_device_remove+0x3b/0xc0
    device_release_driver_internal+0x103/0x1f0
    unbind_store+0xf6/0x130
    kernfs_fop_write+0x116/0x190
    vfs_write+0xa5/0x1a0
    ksys_write+0x4f/0xb0
    do_syscall_64+0x5b/0x1a0
    entry_SYSCALL_64_after_hwframe+0x65/0xca

Signed-off-by: Íñigo Huguet <ihuguet@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/sfc/ef10_sriov.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/drivers/net/ethernet/sfc/ef10_sriov.c b/drivers/net/ethernet/sfc/ef10_sriov.c
index 3c17f274e802..b3c27331b374 100644
--- a/drivers/net/ethernet/sfc/ef10_sriov.c
+++ b/drivers/net/ethernet/sfc/ef10_sriov.c
@@ -415,7 +415,6 @@ int efx_ef10_sriov_init(struct efx_nic *efx)
 void efx_ef10_sriov_fini(struct efx_nic *efx)
 {
 	struct efx_ef10_nic_data *nic_data = efx->nic_data;
-	unsigned int i;
 	int rc;
 
 	if (!nic_data->vf) {
@@ -425,14 +424,7 @@ void efx_ef10_sriov_fini(struct efx_nic *efx)
 		return;
 	}
 
-	/* Remove any VFs in the host */
-	for (i = 0; i < efx->vf_count; ++i) {
-		struct efx_nic *vf_efx = nic_data->vf[i].efx;
-
-		if (vf_efx)
-			vf_efx->pci_dev->driver->remove(vf_efx->pci_dev);
-	}
-
+	/* Disable SRIOV and remove any VFs in the host */
 	rc = efx_ef10_pci_sriov_disable(efx, true);
 	if (rc)
 		netif_dbg(efx, drv, efx->net_dev,

From 20a00c5b7fade7c098fa9e40263d2e5db4e39c68 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=8D=C3=B1igo=20Huguet?= <ihuguet@redhat.com>
Date: Mon, 21 Jun 2021 17:32:36 +0200
Subject: [PATCH 2421/2658] sfc: error code if SRIOV cannot be disabled
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 1ebe4feb8b442884f5a28d2437040096723dd1ea ]

If SRIOV cannot be disabled during device removal or module unloading,
return error code so it can be logged properly in the calling function.

Note that this can only happen if any VF is currently attached to a
guest using Xen, but not with vfio/KVM. Despite that in that case the
VFs won't work properly with PF removed and/or the module unloaded, I
have let it as is because I don't know what side effects may have
changing it, and also it seems to be the same that other drivers are
doing in this situation.

In the case of being called during SRIOV reconfiguration, the behavior
hasn't changed because the function is called with force=false.

Signed-off-by: Íñigo Huguet <ihuguet@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/sfc/ef10_sriov.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/sfc/ef10_sriov.c b/drivers/net/ethernet/sfc/ef10_sriov.c
index b3c27331b374..8fce0c819a4b 100644
--- a/drivers/net/ethernet/sfc/ef10_sriov.c
+++ b/drivers/net/ethernet/sfc/ef10_sriov.c
@@ -378,12 +378,17 @@ static int efx_ef10_pci_sriov_enable(struct efx_nic *efx, int num_vfs)
 	return rc;
 }
 
+/* Disable SRIOV and remove VFs
+ * If some VFs are attached to a guest (using Xen, only) nothing is
+ * done if force=false, and vports are freed if force=true (for the non
+ * attachedc ones, only) but SRIOV is not disabled and VFs are not
+ * removed in either case.
+ */
 static int efx_ef10_pci_sriov_disable(struct efx_nic *efx, bool force)
 {
 	struct pci_dev *dev = efx->pci_dev;
-	unsigned int vfs_assigned = 0;
-
-	vfs_assigned = pci_vfs_assigned(dev);
+	unsigned int vfs_assigned = pci_vfs_assigned(dev);
+	int rc = 0;
 
 	if (vfs_assigned && !force) {
 		netif_info(efx, drv, efx->net_dev, "VFs are assigned to guests; "
@@ -393,10 +398,12 @@ static int efx_ef10_pci_sriov_disable(struct efx_nic *efx, bool force)
 
 	if (!vfs_assigned)
 		pci_disable_sriov(dev);
+	else
+		rc = -EBUSY;
 
 	efx_ef10_sriov_free_vf_vswitching(efx);
 	efx->vf_count = 0;
-	return 0;
+	return rc;
 }
 
 int efx_ef10_sriov_configure(struct efx_nic *efx, int num_vfs)

From cf6af00483256fb5e298713c2adc860a19827802 Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Date: Thu, 22 Apr 2021 15:00:32 -0500
Subject: [PATCH 2422/2658] wireless: wext-spy: Fix out-of-bounds warning

[ Upstream commit e93bdd78406da9ed01554c51e38b2a02c8ef8025 ]

Fix the following out-of-bounds warning:

net/wireless/wext-spy.c:178:2: warning: 'memcpy' offset [25, 28] from the object at 'threshold' is out of the bounds of referenced subobject 'low' with type 'struct iw_quality' at offset 20 [-Warray-bounds]

The problem is that the original code is trying to copy data into a
couple of struct members adjacent to each other in a single call to
memcpy(). This causes a legitimate compiler warning because memcpy()
overruns the length of &threshold.low and &spydata->spy_thr_low. As
these are just a couple of struct members, fix this by using direct
assignments, instead of memcpy().

This helps with the ongoing efforts to globally enable -Warray-bounds
and get us closer to being able to tighten the FORTIFY_SOURCE routines
on memcpy().

Link: https://github.com/KSPP/linux/issues/109
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210422200032.GA168995@embeddedor
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/wireless/wext-spy.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/net/wireless/wext-spy.c b/net/wireless/wext-spy.c
index 33bef22e44e9..b379a0371653 100644
--- a/net/wireless/wext-spy.c
+++ b/net/wireless/wext-spy.c
@@ -120,8 +120,8 @@ int iw_handler_set_thrspy(struct net_device *	dev,
 		return -EOPNOTSUPP;
 
 	/* Just do it */
-	memcpy(&(spydata->spy_thr_low), &(threshold->low),
-	       2 * sizeof(struct iw_quality));
+	spydata->spy_thr_low = threshold->low;
+	spydata->spy_thr_high = threshold->high;
 
 	/* Clear flag */
 	memset(spydata->spy_thr_under, '\0', sizeof(spydata->spy_thr_under));
@@ -147,8 +147,8 @@ int iw_handler_get_thrspy(struct net_device *	dev,
 		return -EOPNOTSUPP;
 
 	/* Just do it */
-	memcpy(&(threshold->low), &(spydata->spy_thr_low),
-	       2 * sizeof(struct iw_quality));
+	threshold->low = spydata->spy_thr_low;
+	threshold->high = spydata->spy_thr_high;
 
 	return 0;
 }
@@ -173,10 +173,10 @@ static void iw_send_thrspy_event(struct net_device *	dev,
 	memcpy(threshold.addr.sa_data, address, ETH_ALEN);
 	threshold.addr.sa_family = ARPHRD_ETHER;
 	/* Copy stats */
-	memcpy(&(threshold.qual), wstats, sizeof(struct iw_quality));
+	threshold.qual = *wstats;
 	/* Copy also thresholds */
-	memcpy(&(threshold.low), &(spydata->spy_thr_low),
-	       2 * sizeof(struct iw_quality));
+	threshold.low = spydata->spy_thr_low;
+	threshold.high = spydata->spy_thr_high;
 
 	/* Send event to user space */
 	wireless_send_event(dev, SIOCGIWTHRSPY, &wrqu, (char *) &threshold);

From bbc771f17e8cf6243f892a439813b42aa28c77fd Mon Sep 17 00:00:00 2001
From: Gerd Rausch <gerd.rausch@oracle.com>
Date: Thu, 24 Jun 2021 11:55:31 -0700
Subject: [PATCH 2423/2658] RDMA/cma: Fix rdma_resolve_route() memory leak

[ Upstream commit 74f160ead74bfe5f2b38afb4fcf86189f9ff40c9 ]

Fix a memory leak when "mda_resolve_route() is called more than once on
the same "rdma_cm_id".

This is possible if cma_query_handler() triggers the
RDMA_CM_EVENT_ROUTE_ERROR flow which puts the state machine back and
allows rdma_resolve_route() to be called again.

Link: https://lore.kernel.org/r/f6662b7b-bdb7-2706-1e12-47c61d3474b6@oracle.com
Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/cma.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index b59a4a819aaa..b5e7bd23857e 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2227,7 +2227,8 @@ static int cma_resolve_ib_route(struct rdma_id_private *id_priv, int timeout_ms)
 	work->new_state = RDMA_CM_ROUTE_RESOLVED;
 	work->event.event = RDMA_CM_EVENT_ROUTE_RESOLVED;
 
-	route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL);
+	if (!route->path_rec)
+		route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL);
 	if (!route->path_rec) {
 		ret = -ENOMEM;
 		goto err1;

From 5d5b237d04d04801ecb9dc3bdcfb3dee8245db94 Mon Sep 17 00:00:00 2001
From: Yu Liu <yudiliu@google.com>
Date: Mon, 19 Apr 2021 16:53:30 -0700
Subject: [PATCH 2424/2658] Bluetooth: Fix the HCI to MGMT status conversion
 table

[ Upstream commit 4ef36a52b0e47c80bbfd69c0cce61c7ae9f541ed ]

0x2B, 0x31 and 0x33 are reserved for future use but were not present in
the HCI to MGMT conversion table, this caused the conversion to be
incorrect for the HCI status code greater than 0x2A.

Reviewed-by: Miao-chen Chou <mcchou@chromium.org>
Signed-off-by: Yu Liu <yudiliu@google.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/mgmt.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 9f2f850f5841..d6062e4d6367 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -212,12 +212,15 @@ static u8 mgmt_status_table[] = {
 	MGMT_STATUS_TIMEOUT,		/* Instant Passed */
 	MGMT_STATUS_NOT_SUPPORTED,	/* Pairing Not Supported */
 	MGMT_STATUS_FAILED,		/* Transaction Collision */
+	MGMT_STATUS_FAILED,		/* Reserved for future use */
 	MGMT_STATUS_INVALID_PARAMS,	/* Unacceptable Parameter */
 	MGMT_STATUS_REJECTED,		/* QoS Rejected */
 	MGMT_STATUS_NOT_SUPPORTED,	/* Classification Not Supported */
 	MGMT_STATUS_REJECTED,		/* Insufficient Security */
 	MGMT_STATUS_INVALID_PARAMS,	/* Parameter Out Of Range */
+	MGMT_STATUS_FAILED,		/* Reserved for future use */
 	MGMT_STATUS_BUSY,		/* Role Switch Pending */
+	MGMT_STATUS_FAILED,		/* Reserved for future use */
 	MGMT_STATUS_FAILED,		/* Slot Violation */
 	MGMT_STATUS_FAILED,		/* Role Switch Failed */
 	MGMT_STATUS_INVALID_PARAMS,	/* EIR Too Large */

From bfeded3380b31581de4934f610ac092ac219f9b7 Mon Sep 17 00:00:00 2001
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date: Fri, 14 May 2021 15:14:52 +0800
Subject: [PATCH 2425/2658] Bluetooth: Shutdown controller after workqueues are
 flushed or cancelled

[ Upstream commit 0ea9fd001a14ebc294f112b0361a4e601551d508 ]

Rfkill block and unblock Intel USB Bluetooth [8087:0026] may make it
stops working:
[  509.691509] Bluetooth: hci0: HCI reset during shutdown failed
[  514.897584] Bluetooth: hci0: MSFT filter_enable is already on
[  530.044751] usb 3-10: reset full-speed USB device number 5 using xhci_hcd
[  545.660350] usb 3-10: device descriptor read/64, error -110
[  561.283530] usb 3-10: device descriptor read/64, error -110
[  561.519682] usb 3-10: reset full-speed USB device number 5 using xhci_hcd
[  566.686650] Bluetooth: hci0: unexpected event for opcode 0x0500
[  568.752452] Bluetooth: hci0: urb 0000000096cd309b failed to resubmit (113)
[  578.797955] Bluetooth: hci0: Failed to read MSFT supported features (-110)
[  586.286565] Bluetooth: hci0: urb 00000000c522f633 failed to resubmit (113)
[  596.215302] Bluetooth: hci0: Failed to read MSFT supported features (-110)

Or kernel panics because other workqueues already freed skb:
[ 2048.663763] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 2048.663775] #PF: supervisor read access in kernel mode
[ 2048.663779] #PF: error_code(0x0000) - not-present page
[ 2048.663782] PGD 0 P4D 0
[ 2048.663787] Oops: 0000 [#1] SMP NOPTI
[ 2048.663793] CPU: 3 PID: 4491 Comm: rfkill Tainted: G        W         5.13.0-rc1-next-20210510+ #20
[ 2048.663799] Hardware name: HP HP EliteBook 850 G8 Notebook PC/8846, BIOS T76 Ver. 01.01.04 12/02/2020
[ 2048.663801] RIP: 0010:__skb_ext_put+0x6/0x50
[ 2048.663814] Code: 8b 1b 48 85 db 75 db 5b 41 5c 5d c3 be 01 00 00 00 e8 de 13 c0 ff eb e7 be 02 00 00 00 e8 d2 13 c0 ff eb db 0f 1f 44 00 00 55 <8b> 07 48 89 e5 83 f8 01 74 14 b8 ff ff ff ff f0 0f c1
07 83 f8 01
[ 2048.663819] RSP: 0018:ffffc1d105b6fd80 EFLAGS: 00010286
[ 2048.663824] RAX: 0000000000000000 RBX: ffff9d9ac5649000 RCX: 0000000000000000
[ 2048.663827] RDX: ffffffffc0d1daf6 RSI: 0000000000000206 RDI: 0000000000000000
[ 2048.663830] RBP: ffffc1d105b6fd98 R08: 0000000000000001 R09: ffff9d9ace8ceac0
[ 2048.663834] R10: ffff9d9ace8ceac0 R11: 0000000000000001 R12: ffff9d9ac5649000
[ 2048.663838] R13: 0000000000000000 R14: 00007ffe0354d650 R15: 0000000000000000
[ 2048.663843] FS:  00007fe02ab19740(0000) GS:ffff9d9e5f8c0000(0000) knlGS:0000000000000000
[ 2048.663849] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2048.663853] CR2: 0000000000000000 CR3: 0000000111a52004 CR4: 0000000000770ee0
[ 2048.663856] PKRU: 55555554
[ 2048.663859] Call Trace:
[ 2048.663865]  ? skb_release_head_state+0x5e/0x80
[ 2048.663873]  kfree_skb+0x2f/0xb0
[ 2048.663881]  btusb_shutdown_intel_new+0x36/0x60 [btusb]
[ 2048.663905]  hci_dev_do_close+0x48c/0x5e0 [bluetooth]
[ 2048.663954]  ? __cond_resched+0x1a/0x50
[ 2048.663962]  hci_rfkill_set_block+0x56/0xa0 [bluetooth]
[ 2048.664007]  rfkill_set_block+0x98/0x170
[ 2048.664016]  rfkill_fop_write+0x136/0x1e0
[ 2048.664022]  vfs_write+0xc7/0x260
[ 2048.664030]  ksys_write+0xb1/0xe0
[ 2048.664035]  ? exit_to_user_mode_prepare+0x37/0x1c0
[ 2048.664042]  __x64_sys_write+0x1a/0x20
[ 2048.664048]  do_syscall_64+0x40/0xb0
[ 2048.664055]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 2048.664060] RIP: 0033:0x7fe02ac23c27
[ 2048.664066] Code: 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24
[ 2048.664070] RSP: 002b:00007ffe0354d638 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 2048.664075] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fe02ac23c27
[ 2048.664078] RDX: 0000000000000008 RSI: 00007ffe0354d650 RDI: 0000000000000003
[ 2048.664081] RBP: 0000000000000000 R08: 0000559b05998440 R09: 0000559b05998440
[ 2048.664084] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
[ 2048.664086] R13: 0000000000000000 R14: ffffffff00000000 R15: 00000000ffffffff

So move the shutdown callback to a place where workqueues are either
flushed or cancelled to resolve the issue.

Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_core.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index e6965064e491..73808a164506 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1666,14 +1666,6 @@ int hci_dev_do_close(struct hci_dev *hdev)
 
 	BT_DBG("%s %pK", hdev->name, hdev);
 
-	if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
-	    !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
-	    test_bit(HCI_UP, &hdev->flags)) {
-		/* Execute vendor specific shutdown routine */
-		if (hdev->shutdown)
-			hdev->shutdown(hdev);
-	}
-
 	cancel_delayed_work(&hdev->power_off);
 
 	hci_req_cancel(hdev, ENODEV);
@@ -1746,6 +1738,14 @@ int hci_dev_do_close(struct hci_dev *hdev)
 		clear_bit(HCI_INIT, &hdev->flags);
 	}
 
+	if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
+	    !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
+	    test_bit(HCI_UP, &hdev->flags)) {
+		/* Execute vendor specific shutdown routine */
+		if (hdev->shutdown)
+			hdev->shutdown(hdev);
+	}
+
 	/* flush cmd  work */
 	flush_work(&hdev->cmd_work);
 

From 7b77494e56770c812f8adec07463882a241e4d76 Mon Sep 17 00:00:00 2001
From: Tim Jiang <tjiang@codeaurora.org>
Date: Tue, 1 Jun 2021 17:57:10 +0800
Subject: [PATCH 2426/2658] Bluetooth: btusb: fix bt fiwmare downloading
 failure issue for qca btsoc.

[ Upstream commit 4f00bfb372674d586c4a261bfc595cbce101fbb6 ]

This is btsoc timing issue, after host start to downloading bt firmware,
ep2 need time to switch from function acl to function dfu, so host add
20ms delay as workaround.

Signed-off-by: Tim Jiang <tjiang@codeaurora.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 7039a58a6a4e..3d62f17111cb 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2555,6 +2555,11 @@ static int btusb_setup_qca_download_fw(struct hci_dev *hdev,
 	sent += size;
 	count -= size;
 
+	/* ep2 need time to switch from function acl to function dfu,
+	 * so we add 20ms delay here.
+	 */
+	msleep(20);
+
 	while (count) {
 		size = min_t(size_t, count, QCA_DFU_PACKET_LEN);
 

From 9fe6ebdc05ad81629ac17e9d4abe9e239a935fb8 Mon Sep 17 00:00:00 2001
From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Date: Mon, 28 Jun 2021 16:13:42 -0300
Subject: [PATCH 2427/2658] sctp: add size validation when walking chunks

[ Upstream commit 50619dbf8db77e98d821d615af4f634d08e22698 ]

The first chunk in a packet is ensured to be present at the beginning of
sctp_rcv(), as a packet needs to have at least 1 chunk. But the second
one, may not be completely available and ch->length can be over
uninitialized memory.

Fix here is by only trying to walk on the next chunk if there is enough to
hold at least the header, and then proceed with the ch->length validation
that is already there.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sctp/input.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sctp/input.c b/net/sctp/input.c
index 9fa89a35afcd..9dcc18db9918 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -1086,7 +1086,7 @@ static struct sctp_association *__sctp_rcv_walk_lookup(struct net *net,
 
 		ch = (sctp_chunkhdr_t *) ch_end;
 		chunk_num++;
-	} while (ch_end < skb_tail_pointer(skb));
+	} while (ch_end + sizeof(*ch) < skb_tail_pointer(skb));
 
 	return asoc;
 }

From 0a463fefb06de6d3f7a18e785d384c012f08d4b5 Mon Sep 17 00:00:00 2001
From: Miklos Szeredi <mszeredi@redhat.com>
Date: Tue, 22 Jun 2021 09:15:35 +0200
Subject: [PATCH 2428/2658] fuse: reject internal errno

commit 49221cf86d18bb66fe95d3338cb33bd4b9880ca5 upstream.

Don't allow userspace to report errors that could be kernel-internal.

Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Fixes: 334f485df85a ("[PATCH] FUSE - device functions")
Cc: <stable@vger.kernel.org> # v2.6.14
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/fuse/dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 9e8d0efbe6e8..7cd7e9923e2d 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1941,7 +1941,7 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud,
 	}
 
 	err = -EINVAL;
-	if (oh.error <= -1000 || oh.error > 0)
+	if (oh.error <= -512 || oh.error > 0)
 		goto err_finish;
 
 	spin_lock(&fpq->lock);

From ded4b162a7aaa0492e5ff4dc88fd2b3b24518e04 Mon Sep 17 00:00:00 2001
From: Oliver Hartkopp <socketcan@hartkopp.net>
Date: Fri, 18 Jun 2021 19:36:45 +0200
Subject: [PATCH 2429/2658] can: gw: synchronize rcu operations before removing
 gw job entry

commit fb8696ab14adadb2e3f6c17c18ed26b3ecd96691 upstream.

can_can_gw_rcv() is called under RCU protection, so after calling
can_rx_unregister(), we have to call synchronize_rcu in order to wait
for any RCU read-side critical sections to finish before removing the
kmem_cache entry with the referenced gw job entry.

Link: https://lore.kernel.org/r/20210618173645.2238-1-socketcan@hartkopp.net
Fixes: c1aabdf379bc ("can-gw: add netlink based CAN routing")
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/gw.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/can/gw.c b/net/can/gw.c
index 81650affa3fa..1867000f8a65 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -497,6 +497,7 @@ static int cgw_notifier(struct notifier_block *nb,
 			if (gwj->src.dev == dev || gwj->dst.dev == dev) {
 				hlist_del(&gwj->list);
 				cgw_unregister_filter(gwj);
+				synchronize_rcu();
 				kmem_cache_free(cgw_cache, gwj);
 			}
 		}
@@ -941,6 +942,7 @@ static void cgw_remove_all_jobs(void)
 	hlist_for_each_entry_safe(gwj, nx, &cgw_list, list) {
 		hlist_del(&gwj->list);
 		cgw_unregister_filter(gwj);
+		synchronize_rcu();
 		kmem_cache_free(cgw_cache, gwj);
 	}
 }
@@ -1008,6 +1010,7 @@ static int cgw_remove_job(struct sk_buff *skb, struct nlmsghdr *nlh)
 
 		hlist_del(&gwj->list);
 		cgw_unregister_filter(gwj);
+		synchronize_rcu();
 		kmem_cache_free(cgw_cache, gwj);
 		err = 0;
 		break;

From 79d54d3f7f10d00a73506d32f33ab797bc6d6133 Mon Sep 17 00:00:00 2001
From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Date: Sat, 19 Jun 2021 13:18:13 -0300
Subject: [PATCH 2430/2658] can: bcm: delay release of struct bcm_op after
 synchronize_rcu()

commit d5f9023fa61ee8b94f37a93f08e94b136cf1e463 upstream.

can_rx_register() callbacks may be called concurrently to the call to
can_rx_unregister(). The callbacks and callback data, though, are
protected by RCU and the struct sock reference count.

So the callback data is really attached to the life of sk, meaning
that it should be released on sk_destruct. However, bcm_remove_op()
calls tasklet_kill(), and RCU callbacks may be called under RCU
softirq, so that cannot be used on kernels before the introduction of
HRTIMER_MODE_SOFT.

However, bcm_rx_handler() is called under RCU protection, so after
calling can_rx_unregister(), we may call synchronize_rcu() in order to
wait for any RCU read-side critical sections to finish. That is,
bcm_rx_handler() won't be called anymore for those ops. So, we only
free them, after we do that synchronize_rcu().

Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
Link: https://lore.kernel.org/r/20210619161813.2098382-1-cascardo@canonical.com
Cc: linux-stable <stable@vger.kernel.org>
Reported-by: syzbot+0f7e7e5e2f4f40fa89c0@syzkaller.appspotmail.com
Reported-by: Norbert Slusarek <nslusarek@gmx.net>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/bcm.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/can/bcm.c b/net/can/bcm.c
index c6fee58baac4..3e131dc5f0e5 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -813,6 +813,7 @@ static int bcm_delete_rx_op(struct list_head *ops, canid_t can_id, int ifindex)
 						  bcm_rx_handler, op);
 
 			list_del(&op->list);
+			synchronize_rcu();
 			bcm_remove_op(op);
 			return 1; /* done */
 		}
@@ -1538,9 +1539,13 @@ static int bcm_release(struct socket *sock)
 					  REGMASK(op->can_id),
 					  bcm_rx_handler, op);
 
-		bcm_remove_op(op);
 	}
 
+	synchronize_rcu();
+
+	list_for_each_entry_safe(op, next, &bo->rx_ops, list)
+		bcm_remove_op(op);
+
 	/* remove procfs entry */
 	if (proc_dir && bo->bcm_proc_read)
 		remove_proc_entry(bo->procname, proc_dir);

From 94998fdaaa2155b959d81b68f388f583b8735a68 Mon Sep 17 00:00:00 2001
From: Davis Mosenkovs <davis@mosenkovs.lv>
Date: Sat, 10 Jul 2021 21:37:10 +0300
Subject: [PATCH 2431/2658] mac80211: fix memory corruption in EAPOL handling

Commit e3d4030498c3 ("mac80211: do not accept/forward invalid EAPOL
frames") uses skb_mac_header() before eth_type_trans() is called
leading to incorrect pointer, the pointer gets written to. This issue
has appeared during backporting to 4.4, 4.9 and 4.14.

Fixes: e3d4030498c3 ("mac80211: do not accept/forward invalid EAPOL frames")
Link: https://lore.kernel.org/r/CAHQn7pKcyC_jYmGyTcPCdk9xxATwW5QPNph=bsZV8d-HPwNsyA@mail.gmail.com
Cc: <stable@vger.kernel.org> # 4.4.x
Signed-off-by: Davis Mosenkovs <davis@mosenkovs.lv>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/rx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 2d3cbeda225f..5ce6c97ee53c 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2235,7 +2235,7 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
 #endif
 
 	if (skb) {
-		struct ethhdr *ehdr = (void *)skb_mac_header(skb);
+		struct ethhdr *ehdr = (struct ethhdr *)skb->data;
 
 		/* deliver to local stack */
 		skb->protocol = eth_type_trans(skb, dev);

From 62ba4adad0cf801c0ebcbec0e384977bc24be7eb Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <nathan@kernel.org>
Date: Fri, 28 May 2021 11:27:52 -0700
Subject: [PATCH 2432/2658] powerpc/barrier: Avoid collision with clang's
 __lwsync macro

commit 015d98149b326e0f1f02e44413112ca8b4330543 upstream.

A change in clang 13 results in the __lwsync macro being defined as
__builtin_ppc_lwsync, which emits 'lwsync' or 'msync' depending on what
the target supports. This breaks the build because of -Werror in
arch/powerpc, along with thousands of warnings:

 In file included from arch/powerpc/kernel/pmc.c:12:
 In file included from include/linux/bug.h:5:
 In file included from arch/powerpc/include/asm/bug.h:109:
 In file included from include/asm-generic/bug.h:20:
 In file included from include/linux/kernel.h:12:
 In file included from include/linux/bitops.h:32:
 In file included from arch/powerpc/include/asm/bitops.h:62:
 arch/powerpc/include/asm/barrier.h:49:9: error: '__lwsync' macro redefined [-Werror,-Wmacro-redefined]
 #define __lwsync()      __asm__ __volatile__ (stringify_in_c(LWSYNC) : : :"memory")
        ^
 <built-in>:308:9: note: previous definition is here
 #define __lwsync __builtin_ppc_lwsync
        ^
 1 error generated.

Undefine this macro so that the runtime patching introduced by
commit 2d1b2027626d ("powerpc: Fixup lwsync at runtime") continues to
work properly with clang and the build no longer breaks.

Cc: stable@vger.kernel.org
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://github.com/ClangBuiltLinux/linux/issues/1386
Link: https://github.com/llvm/llvm-project/commit/62b5df7fe2b3fda1772befeda15598fbef96a614
Link: https://lore.kernel.org/r/20210528182752.1852002-1-nathan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/include/asm/barrier.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/powerpc/include/asm/barrier.h b/arch/powerpc/include/asm/barrier.h
index e7cb72cdb2ba..4dc7c8f9d9e1 100644
--- a/arch/powerpc/include/asm/barrier.h
+++ b/arch/powerpc/include/asm/barrier.h
@@ -43,6 +43,8 @@
 #    define SMPWMB      eieio
 #endif
 
+/* clang defines this macro for a builtin, which will not work with runtime patching */
+#undef __lwsync
 #define __lwsync()	__asm__ __volatile__ (stringify_in_c(LWSYNC) : : :"memory")
 #define dma_rmb()	__lwsync()
 #define dma_wmb()	__asm__ __volatile__ (stringify_in_c(SMPWMB) : : :"memory")

From 7213116eab12cf318569fba9a94b8a279501ad12 Mon Sep 17 00:00:00 2001
From: Al Cooper <alcooperx@gmail.com>
Date: Thu, 24 Jun 2021 12:30:45 -0400
Subject: [PATCH 2433/2658] mmc: sdhci: Fix warning message when accessing RPMB
 in HS400 mode

commit d0244847f9fc5e20df8b7483c8a4717fe0432d38 upstream.

When an eMMC device is being run in HS400 mode, any access to the
RPMB device will cause the error message "mmc1: Invalid UHS-I mode
selected". This happens as a result of tuning being disabled before
RPMB access and then re-enabled after the RPMB access is complete.
When tuning is re-enabled, the system has to switch from HS400
to HS200 to do the tuning and then back to HS400. As part of
sequence to switch from HS400 to HS200 the system is temporarily
put into HS mode. When switching to HS mode, sdhci_get_preset_value()
is called and does not have support for HS mode and prints the warning
message and returns the preset for SDR12. The fix is to add support
for MMC and SD HS modes to sdhci_get_preset_value().

This can be reproduced on any system running eMMC in HS400 mode
(not HS400ES) by using the "mmc" utility to run the following
command: "mmc rpmb read-counter /dev/mmcblk0rpmb".

Signed-off-by: Al Cooper <alcooperx@gmail.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Fixes: 52983382c74f ("mmc: sdhci: enhance preset value function")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210624163045.33651-1-alcooperx@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/sdhci.c | 4 ++++
 drivers/mmc/host/sdhci.h | 1 +
 2 files changed, 5 insertions(+)

diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index f0c930a97252..3d06e187f5b8 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1298,6 +1298,10 @@ static u16 sdhci_get_preset_value(struct sdhci_host *host)
 	u16 preset = 0;
 
 	switch (host->timing) {
+	case MMC_TIMING_MMC_HS:
+	case MMC_TIMING_SD_HS:
+		preset = sdhci_readw(host, SDHCI_PRESET_FOR_HIGH_SPEED);
+		break;
 	case MMC_TIMING_UHS_SDR12:
 		preset = sdhci_readw(host, SDHCI_PRESET_FOR_SDR12);
 		break;
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index 300be7fd0f24..4d961e686da1 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -244,6 +244,7 @@
 
 /* 60-FB reserved */
 
+#define SDHCI_PRESET_FOR_HIGH_SPEED	0x64
 #define SDHCI_PRESET_FOR_SDR12 0x66
 #define SDHCI_PRESET_FOR_SDR25 0x68
 #define SDHCI_PRESET_FOR_SDR50 0x6A

From 2fdaee94f5b983fb6a160960a4fe19fd47cc47ee Mon Sep 17 00:00:00 2001
From: Timo Sigurdsson <public_timo.s@silentcreek.de>
Date: Mon, 14 Jun 2021 09:25:39 +0200
Subject: [PATCH 2434/2658] ata: ahci_sunxi: Disable DIPM

commit f6bca4d91b2ea052e917cca3f9d866b5cc1d500a upstream.

DIPM is unsupported or broken on sunxi. Trying to enable the power
management policy med_power_with_dipm on an Allwinner A20 SoC based board
leads to immediate I/O errors and the attached SATA disk disappears from
the /dev filesystem. A reset (power cycle) is required to make the SATA
controller or disk work again. The A10 and A20 SoC data sheets and manuals
don't mention DIPM at all [1], so it's fair to assume that it's simply not
supported. But even if it was, it should be considered broken and best be
disabled in the ahci_sunxi driver.

[1] https://github.com/allwinner-zh/documents/tree/master/

Fixes: c5754b5220f0 ("ARM: sunxi: Add support for Allwinner SUNXi SoCs sata to ahci_platform")
Cc: stable@vger.kernel.org
Signed-off-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
Tested-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
Link: https://lore.kernel.org/r/20210614072539.3307-1-public_timo.s@silentcreek.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ata/ahci_sunxi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ata/ahci_sunxi.c b/drivers/ata/ahci_sunxi.c
index b26437430163..98b4f0d898d6 100644
--- a/drivers/ata/ahci_sunxi.c
+++ b/drivers/ata/ahci_sunxi.c
@@ -165,7 +165,7 @@ static void ahci_sunxi_start_engine(struct ata_port *ap)
 }
 
 static const struct ata_port_info ahci_sunxi_port_info = {
-	.flags		= AHCI_FLAG_COMMON | ATA_FLAG_NCQ,
+	.flags		= AHCI_FLAG_COMMON | ATA_FLAG_NCQ | ATA_FLAG_NO_DIPM,
 	.pio_mask	= ATA_PIO4,
 	.udma_mask	= ATA_UDMA6,
 	.port_ops	= &ahci_platform_ops,

From 475389eff949b428c2a441dfddec36972dd25a9e Mon Sep 17 00:00:00 2001
From: Dmitry Osipenko <digetx@gmail.com>
Date: Sat, 29 May 2021 18:46:46 +0300
Subject: [PATCH 2435/2658] ASoC: tegra: Set driver_name=tegra for all machine
 drivers

commit f6eb84fa596abf28959fc7e0b626f925eb1196c7 upstream.

The driver_name="tegra" is now required by the newer ALSA UCMs, otherwise
Tegra UCMs don't match by the path/name.

All Tegra machine drivers are specifying the card's name, but it has no
effect if model name is specified in the device-tree since it overrides
the card's name. We need to set the driver_name to "tegra" in order to
get a usable lookup path for the updated ALSA UCMs. The new UCM lookup
path has a form of driver_name/card_name.

The old lookup paths that are based on driver module name continue to
work as before. Note that UCM matching never worked for Tegra ASoC drivers
if they were compiled as built-in, this is fixed by supporting the new
naming scheme.

Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Link: https://lore.kernel.org/r/20210529154649.25936-2-digetx@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/soc/tegra/tegra_alc5632.c  | 1 +
 sound/soc/tegra/tegra_max98090.c | 1 +
 sound/soc/tegra/tegra_rt5640.c   | 1 +
 sound/soc/tegra/tegra_rt5677.c   | 1 +
 sound/soc/tegra/tegra_wm8753.c   | 1 +
 sound/soc/tegra/tegra_wm8903.c   | 1 +
 sound/soc/tegra/tegra_wm9712.c   | 1 +
 sound/soc/tegra/trimslice.c      | 1 +
 8 files changed, 8 insertions(+)

diff --git a/sound/soc/tegra/tegra_alc5632.c b/sound/soc/tegra/tegra_alc5632.c
index deb597f7c302..f40657da4db2 100644
--- a/sound/soc/tegra/tegra_alc5632.c
+++ b/sound/soc/tegra/tegra_alc5632.c
@@ -149,6 +149,7 @@ static struct snd_soc_dai_link tegra_alc5632_dai = {
 
 static struct snd_soc_card snd_soc_tegra_alc5632 = {
 	.name = "tegra-alc5632",
+	.driver_name = "tegra",
 	.owner = THIS_MODULE,
 	.remove = tegra_alc5632_card_remove,
 	.dai_link = &tegra_alc5632_dai,
diff --git a/sound/soc/tegra/tegra_max98090.c b/sound/soc/tegra/tegra_max98090.c
index 902da36581d1..f4f238924c76 100644
--- a/sound/soc/tegra/tegra_max98090.c
+++ b/sound/soc/tegra/tegra_max98090.c
@@ -205,6 +205,7 @@ static struct snd_soc_dai_link tegra_max98090_dai = {
 
 static struct snd_soc_card snd_soc_tegra_max98090 = {
 	.name = "tegra-max98090",
+	.driver_name = "tegra",
 	.owner = THIS_MODULE,
 	.remove = tegra_max98090_card_remove,
 	.dai_link = &tegra_max98090_dai,
diff --git a/sound/soc/tegra/tegra_rt5640.c b/sound/soc/tegra/tegra_rt5640.c
index 773daecaa5e8..1ff83d5835a3 100644
--- a/sound/soc/tegra/tegra_rt5640.c
+++ b/sound/soc/tegra/tegra_rt5640.c
@@ -150,6 +150,7 @@ static struct snd_soc_dai_link tegra_rt5640_dai = {
 
 static struct snd_soc_card snd_soc_tegra_rt5640 = {
 	.name = "tegra-rt5640",
+	.driver_name = "tegra",
 	.owner = THIS_MODULE,
 	.remove = tegra_rt5640_card_remove,
 	.dai_link = &tegra_rt5640_dai,
diff --git a/sound/soc/tegra/tegra_rt5677.c b/sound/soc/tegra/tegra_rt5677.c
index 1470873ecde6..451e7254e87b 100644
--- a/sound/soc/tegra/tegra_rt5677.c
+++ b/sound/soc/tegra/tegra_rt5677.c
@@ -198,6 +198,7 @@ static struct snd_soc_dai_link tegra_rt5677_dai = {
 
 static struct snd_soc_card snd_soc_tegra_rt5677 = {
 	.name = "tegra-rt5677",
+	.driver_name = "tegra",
 	.owner = THIS_MODULE,
 	.remove = tegra_rt5677_card_remove,
 	.dai_link = &tegra_rt5677_dai,
diff --git a/sound/soc/tegra/tegra_wm8753.c b/sound/soc/tegra/tegra_wm8753.c
index f0cd01dbfc38..633d26c4811b 100644
--- a/sound/soc/tegra/tegra_wm8753.c
+++ b/sound/soc/tegra/tegra_wm8753.c
@@ -110,6 +110,7 @@ static struct snd_soc_dai_link tegra_wm8753_dai = {
 
 static struct snd_soc_card snd_soc_tegra_wm8753 = {
 	.name = "tegra-wm8753",
+	.driver_name = "tegra",
 	.owner = THIS_MODULE,
 	.dai_link = &tegra_wm8753_dai,
 	.num_links = 1,
diff --git a/sound/soc/tegra/tegra_wm8903.c b/sound/soc/tegra/tegra_wm8903.c
index 21604009bc1a..09e07b321e9e 100644
--- a/sound/soc/tegra/tegra_wm8903.c
+++ b/sound/soc/tegra/tegra_wm8903.c
@@ -227,6 +227,7 @@ static struct snd_soc_dai_link tegra_wm8903_dai = {
 
 static struct snd_soc_card snd_soc_tegra_wm8903 = {
 	.name = "tegra-wm8903",
+	.driver_name = "tegra",
 	.owner = THIS_MODULE,
 	.dai_link = &tegra_wm8903_dai,
 	.num_links = 1,
diff --git a/sound/soc/tegra/tegra_wm9712.c b/sound/soc/tegra/tegra_wm9712.c
index 6492f8143ff1..e5bebb473d95 100644
--- a/sound/soc/tegra/tegra_wm9712.c
+++ b/sound/soc/tegra/tegra_wm9712.c
@@ -59,6 +59,7 @@ static struct snd_soc_dai_link tegra_wm9712_dai = {
 
 static struct snd_soc_card snd_soc_tegra_wm9712 = {
 	.name = "tegra-wm9712",
+	.driver_name = "tegra",
 	.owner = THIS_MODULE,
 	.dai_link = &tegra_wm9712_dai,
 	.num_links = 1,
diff --git a/sound/soc/tegra/trimslice.c b/sound/soc/tegra/trimslice.c
index 2cea203c4f5f..90a770968f34 100644
--- a/sound/soc/tegra/trimslice.c
+++ b/sound/soc/tegra/trimslice.c
@@ -103,6 +103,7 @@ static struct snd_soc_dai_link trimslice_tlv320aic23_dai = {
 
 static struct snd_soc_card snd_soc_trimslice = {
 	.name = "tegra-trimslice",
+	.driver_name = "tegra",
 	.owner = THIS_MODULE,
 	.dai_link = &trimslice_tlv320aic23_dai,
 	.num_links = 1,

From d83c50df115e5ede0cde2bc99ada80f76647f6cb Mon Sep 17 00:00:00 2001
From: Petr Pavlu <petr.pavlu@suse.com>
Date: Thu, 13 May 2021 14:26:36 +0200
Subject: [PATCH 2436/2658] ipmi/watchdog: Stop watchdog timer when the current
 action is 'none'

commit 2253042d86f57d90a621ac2513a7a7a13afcf809 upstream.

When an IPMI watchdog timer is being stopped in ipmi_close() or
ipmi_ioctl(WDIOS_DISABLECARD), the current watchdog action is updated to
WDOG_TIMEOUT_NONE and _ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB) is called
to install this action. The latter function ends up invoking
__ipmi_set_timeout() which makes the actual 'Set Watchdog Timer' IPMI
request.

For IPMI 1.0, this operation results in fully stopping the watchdog timer.
For IPMI >= 1.5, function __ipmi_set_timeout() always specifies the "don't
stop" flag in the prepared 'Set Watchdog Timer' IPMI request. This causes
that the watchdog timer has its action correctly updated to 'none' but the
timer continues to run. A problem is that IPMI firmware can then still log
an expiration event when the configured timeout is reached, which is
unexpected because the watchdog timer was requested to be stopped.

The patch fixes this problem by not setting the "don't stop" flag in
__ipmi_set_timeout() when the current action is WDOG_TIMEOUT_NONE which
results in stopping the watchdog timer. This makes the behaviour for
IPMI >= 1.5 consistent with IPMI 1.0. It also matches the logic in
__ipmi_heartbeat() which does not allow to reset the watchdog if the
current action is WDOG_TIMEOUT_NONE as that would start the timer.

Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Message-Id: <10a41bdc-9c99-089c-8d89-fa98ce5ea080@suse.com>
Cc: stable@vger.kernel.org
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/char/ipmi/ipmi_watchdog.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c
index 4ada103945f0..e409de5a0cb4 100644
--- a/drivers/char/ipmi/ipmi_watchdog.c
+++ b/drivers/char/ipmi/ipmi_watchdog.c
@@ -393,16 +393,18 @@ static int i_ipmi_set_timeout(struct ipmi_smi_msg  *smi_msg,
 	data[0] = 0;
 	WDOG_SET_TIMER_USE(data[0], WDOG_TIMER_USE_SMS_OS);
 
-	if ((ipmi_version_major > 1)
-	    || ((ipmi_version_major == 1) && (ipmi_version_minor >= 5))) {
-		/* This is an IPMI 1.5-only feature. */
-		data[0] |= WDOG_DONT_STOP_ON_SET;
-	} else if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) {
-		/*
-		 * In ipmi 1.0, setting the timer stops the watchdog, we
-		 * need to start it back up again.
-		 */
-		hbnow = 1;
+	if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) {
+		if ((ipmi_version_major > 1) ||
+		    ((ipmi_version_major == 1) && (ipmi_version_minor >= 5))) {
+			/* This is an IPMI 1.5-only feature. */
+			data[0] |= WDOG_DONT_STOP_ON_SET;
+		} else {
+			/*
+			 * In ipmi 1.0, setting the timer stops the watchdog, we
+			 * need to start it back up again.
+			 */
+			hbnow = 1;
+		}
 	}
 
 	data[1] = 0;

From 7da40474ea154afcd59d538523043631f67917ee Mon Sep 17 00:00:00 2001
From: Linus Walleij <linus.walleij@linaro.org>
Date: Sun, 27 Jun 2021 01:47:49 +0200
Subject: [PATCH 2437/2658] power: supply: ab8500: Fix an old bug

commit f1c74a6c07e76fcb31a4bcc1f437c4361a2674ce upstream.

Trying to get the AB8500 charging driver working I ran into a bit
of bitrot: we haven't used the driver for a while so errors in
refactorings won't be noticed.

This one is pretty self evident: use argument to the macro or we
end up with a random pointer to something else.

Cc: stable@vger.kernel.org
Cc: Krzysztof Kozlowski <krzk@kernel.org>
Cc: Marcus Cooper <codekipper@gmail.com>
Fixes: 297d716f6260 ("power_supply: Change ownership from driver to core")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/mfd/abx500/ux500_chargalg.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/mfd/abx500/ux500_chargalg.h b/include/linux/mfd/abx500/ux500_chargalg.h
index 67703f23e7ba..821a3b9bc16e 100644
--- a/include/linux/mfd/abx500/ux500_chargalg.h
+++ b/include/linux/mfd/abx500/ux500_chargalg.h
@@ -15,7 +15,7 @@
  * - POWER_SUPPLY_TYPE_USB,
  * because only them store as drv_data pointer to struct ux500_charger.
  */
-#define psy_to_ux500_charger(x) power_supply_get_drvdata(psy)
+#define psy_to_ux500_charger(x) power_supply_get_drvdata(x)
 
 /* Forward declaration */
 struct ux500_charger;

From d4c62b14c7921423525a640039fe4d9dbf2b1780 Mon Sep 17 00:00:00 2001
From: Yun Zhou <yun.zhou@windriver.com>
Date: Sat, 26 Jun 2021 11:21:55 +0800
Subject: [PATCH 2438/2658] seq_buf: Fix overflow in seq_buf_putmem_hex()

commit d3b16034a24a112bb83aeb669ac5b9b01f744bb7 upstream.

There's two variables being increased in that loop (i and j), and i
follows the raw data, and j follows what is being written into the buffer.
We should compare 'i' to MAX_MEMHEX_BYTES or compare 'j' to HEX_CHARS.
Otherwise, if 'j' goes bigger than HEX_CHARS, it will overflow the
destination buffer.

Link: https://lore.kernel.org/lkml/20210625122453.5e2fe304@oasis.local.home/
Link: https://lkml.kernel.org/r/20210626032156.47889-1-yun.zhou@windriver.com

Cc: stable@vger.kernel.org
Fixes: 5e3ca0ec76fce ("ftrace: introduce the "hex" output method")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/seq_buf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/seq_buf.c b/lib/seq_buf.c
index 24b2823b8f2b..a139298ad6ca 100644
--- a/lib/seq_buf.c
+++ b/lib/seq_buf.c
@@ -227,8 +227,10 @@ int seq_buf_putmem_hex(struct seq_buf *s, const void *mem,
 
 	WARN_ON(s->size == 0);
 
+	BUILD_BUG_ON(MAX_MEMHEX_BYTES * 2 >= HEX_CHARS);
+
 	while (len) {
-		start_len = min(len, HEX_CHARS - 1);
+		start_len = min(len, MAX_MEMHEX_BYTES);
 #ifdef __BIG_ENDIAN
 		for (i = 0, j = 0; i < start_len; i++) {
 #else

From 441a47d3d216dcd6599b0fce3a1573d03078424d Mon Sep 17 00:00:00 2001
From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Date: Mon, 24 May 2021 02:32:05 -0700
Subject: [PATCH 2439/2658] ipack/carriers/tpci200: Fix a double free in
 tpci200_pci_probe

commit 9272e5d0028d45a3b45b58c9255e6e0df53f7ad9 upstream.

In the out_err_bus_register error branch of tpci200_pci_probe,
tpci200->info->cfg_regs is freed by tpci200_uninstall()->
tpci200_unregister()->pci_iounmap(..,tpci200->info->cfg_regs)
in the first time.

But later, iounmap() is called to free tpci200->info->cfg_regs
again.

My patch sets tpci200->info->cfg_regs to NULL after tpci200_uninstall()
to avoid the double free.

Fixes: cea2f7cdff2af ("Staging: ipack/bridges/tpci200: Use the TPCI200 in big endian mode")
Cc: stable <stable@vger.kernel.org>
Acked-by: Samuel Iglesias Gonsalvez <siglesias@igalia.com>
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Link: https://lore.kernel.org/r/20210524093205.8333-1-lyl2019@mail.ustc.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ipack/carriers/tpci200.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/ipack/carriers/tpci200.c b/drivers/ipack/carriers/tpci200.c
index 9b23843dcad4..7ba1a94497f5 100644
--- a/drivers/ipack/carriers/tpci200.c
+++ b/drivers/ipack/carriers/tpci200.c
@@ -591,8 +591,11 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
 
 out_err_bus_register:
 	tpci200_uninstall(tpci200);
+	/* tpci200->info->cfg_regs is unmapped in tpci200_uninstall */
+	tpci200->info->cfg_regs = NULL;
 out_err_install:
-	iounmap(tpci200->info->cfg_regs);
+	if (tpci200->info->cfg_regs)
+		iounmap(tpci200->info->cfg_regs);
 out_err_ioremap:
 	pci_release_region(pdev, TPCI200_CFG_MEM_BAR);
 out_err_pci_request:

From a2c19a15b2e1a5b473d7595dd1b42a4b7df5e1f3 Mon Sep 17 00:00:00 2001
From: Hou Tao <houtao1@huawei.com>
Date: Thu, 17 Jun 2021 15:45:47 +0800
Subject: [PATCH 2440/2658] dm btree remove: assign new_root only when removal
 succeeds

commit b6e58b5466b2959f83034bead2e2e1395cca8aeb upstream.

remove_raw() in dm_btree_remove() may fail due to IO read error
(e.g. read the content of origin block fails during shadowing),
and the value of shadow_spine::root is uninitialized, but
the uninitialized value is still assign to new_root in the
end of dm_btree_remove().

For dm-thin, the value of pmd->details_root or pmd->root will become
an uninitialized value, so if trying to read details_info tree again
out-of-bound memory may occur as showed below:

  general protection fault, probably for non-canonical address 0x3fdcb14c8d7520
  CPU: 4 PID: 515 Comm: dmsetup Not tainted 5.13.0-rc6
  Hardware name: QEMU Standard PC
  RIP: 0010:metadata_ll_load_ie+0x14/0x30
  Call Trace:
   sm_metadata_count_is_more_than_one+0xb9/0xe0
   dm_tm_shadow_block+0x52/0x1c0
   shadow_step+0x59/0xf0
   remove_raw+0xb2/0x170
   dm_btree_remove+0xf4/0x1c0
   dm_pool_delete_thin_device+0xc3/0x140
   pool_message+0x218/0x2b0
   target_message+0x251/0x290
   ctl_ioctl+0x1c4/0x4d0
   dm_ctl_ioctl+0xe/0x20
   __x64_sys_ioctl+0x7b/0xb0
   do_syscall_64+0x40/0xb0
   entry_SYSCALL_64_after_hwframe+0x44/0xae

Fixing it by only assign new_root when removal succeeds

Signed-off-by: Hou Tao <houtao1@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/persistent-data/dm-btree-remove.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
index eff04fa23dfa..9e4d1212f4c1 100644
--- a/drivers/md/persistent-data/dm-btree-remove.c
+++ b/drivers/md/persistent-data/dm-btree-remove.c
@@ -549,7 +549,8 @@ int dm_btree_remove(struct dm_btree_info *info, dm_block_t root,
 		delete_at(n, index);
 	}
 
-	*new_root = shadow_root(&spine);
+	if (!r)
+		*new_root = shadow_root(&spine);
 	exit_shadow_spine(&spine);
 
 	return r;

From 19ef020981847f083a9a9859064f735fb00c6b8d Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Mon, 17 May 2021 21:18:14 +0200
Subject: [PATCH 2441/2658] media: zr364xx: fix memory leak in
 zr364xx_start_readpipe

commit 0a045eac8d0427b64577a24d74bb8347c905ac65 upstream.

syzbot reported memory leak in zr364xx driver.
The problem was in non-freed urb in case of
usb_submit_urb() fail.

backtrace:
  [<ffffffff82baedf6>] kmalloc include/linux/slab.h:561 [inline]
  [<ffffffff82baedf6>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74
  [<ffffffff82f7cce8>] zr364xx_start_readpipe+0x78/0x130 drivers/media/usb/zr364xx/zr364xx.c:1022
  [<ffffffff84251dfc>] zr364xx_board_init drivers/media/usb/zr364xx/zr364xx.c:1383 [inline]
  [<ffffffff84251dfc>] zr364xx_probe+0x6a3/0x851 drivers/media/usb/zr364xx/zr364xx.c:1516
  [<ffffffff82bb6507>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
  [<ffffffff826018a9>] really_probe+0x159/0x500 drivers/base/dd.c:576

Fixes: ccbf035ae5de ("V4L/DVB (12278): zr364xx: implement V4L2_CAP_STREAMING")
Cc: stable@vger.kernel.org
Reported-by: syzbot+af4fa391ef18efdd5f69@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/zr364xx/zr364xx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/usb/zr364xx/zr364xx.c b/drivers/media/usb/zr364xx/zr364xx.c
index 2d56cccaa474..72f839e0116a 100644
--- a/drivers/media/usb/zr364xx/zr364xx.c
+++ b/drivers/media/usb/zr364xx/zr364xx.c
@@ -1068,6 +1068,7 @@ static int zr364xx_start_readpipe(struct zr364xx_camera *cam)
 	DBG("submitting URB %p\n", pipe_info->stream_urb);
 	retval = usb_submit_urb(pipe_info->stream_urb, GFP_KERNEL);
 	if (retval) {
+		usb_free_urb(pipe_info->stream_urb);
 		printk(KERN_ERR KBUILD_MODNAME ": start read pipe failed\n");
 		return retval;
 	}

From f83142d00d9e94c0de72587c70bdce3786c72e05 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Fri, 21 May 2021 15:28:39 +0200
Subject: [PATCH 2442/2658] media: gspca/sq905: fix control-request direction

commit 53ae298fde7adcc4b1432bce2dbdf8dac54dfa72 upstream.

The direction of the pipe argument must match the request-type direction
bit or control requests may fail depending on the host-controller-driver
implementation.

Fix the USB_REQ_SYNCH_FRAME request which erroneously used
usb_sndctrlpipe().

Fixes: 27d35fc3fb06 ("V4L/DVB (10639): gspca - sq905: New subdriver.")
Cc: stable@vger.kernel.org      # 2.6.30
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/gspca/sq905.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/gspca/sq905.c b/drivers/media/usb/gspca/sq905.c
index 03322d2b2e82..efb5e553b772 100644
--- a/drivers/media/usb/gspca/sq905.c
+++ b/drivers/media/usb/gspca/sq905.c
@@ -130,7 +130,7 @@ static int sq905_command(struct gspca_dev *gspca_dev, u16 index)
 	}
 
 	ret = usb_control_msg(gspca_dev->dev,
-			      usb_sndctrlpipe(gspca_dev->dev, 0),
+			      usb_rcvctrlpipe(gspca_dev->dev, 0),
 			      USB_REQ_SYNCH_FRAME,                /* request */
 			      USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			      SQ905_PING, 0, gspca_dev->usb_buf, 1,

From 1048daef511c26bb47a46c0b4498240b7e9a48f7 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 24 May 2021 13:09:19 +0200
Subject: [PATCH 2443/2658] media: gspca/sunplus: fix zero-length control
 requests

commit b4bb4d425b7b02424afea2dfdcd77b3b4794175e upstream.

The direction of the pipe argument must match the request-type direction
bit or control requests may fail depending on the host-controller-driver
implementation.

Control transfers without a data stage are treated as OUT requests by
the USB stack and should be using usb_sndctrlpipe(). Failing to do so
will now trigger a warning.

Fix the single zero-length control request which was using the
read-register helper, and update the helper so that zero-length reads
fail with an error message instead.

Fixes: 6a7eba24e4f0 ("V4L/DVB (8157): gspca: all subdrivers")
Cc: stable@vger.kernel.org      # 2.6.27
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/gspca/sunplus.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/gspca/sunplus.c b/drivers/media/usb/gspca/sunplus.c
index cc3e1478c5a0..949915734d57 100644
--- a/drivers/media/usb/gspca/sunplus.c
+++ b/drivers/media/usb/gspca/sunplus.c
@@ -255,6 +255,10 @@ static void reg_r(struct gspca_dev *gspca_dev,
 		PERR("reg_r: buffer overflow\n");
 		return;
 	}
+	if (len == 0) {
+		PERR("reg_r: zero-length read\n");
+		return;
+	}
 	if (gspca_dev->usb_err < 0)
 		return;
 	ret = usb_control_msg(gspca_dev->dev,
@@ -263,7 +267,7 @@ static void reg_r(struct gspca_dev *gspca_dev,
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			0,		/* value */
 			index,
-			len ? gspca_dev->usb_buf : NULL, len,
+			gspca_dev->usb_buf, len,
 			500);
 	if (ret < 0) {
 		pr_err("reg_r err %d\n", ret);
@@ -739,7 +743,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
 		case MegaImageVI:
 			reg_w_riv(gspca_dev, 0xf0, 0, 0);
 			spca504B_WaitCmdStatus(gspca_dev);
-			reg_r(gspca_dev, 0xf0, 4, 0);
+			reg_w_riv(gspca_dev, 0xf0, 4, 0);
 			spca504B_WaitCmdStatus(gspca_dev);
 			break;
 		default:

From 435c19af86a252e8cf50480eabf97ac2de1abb77 Mon Sep 17 00:00:00 2001
From: Benjamin Drung <bdrung@posteo.de>
Date: Sat, 5 Jun 2021 22:15:36 +0200
Subject: [PATCH 2444/2658] media: uvcvideo: Fix pixel format change for Elgato
 Cam Link 4K

commit 4c6e0976295add7f0ed94d276c04a3d6f1ea8f83 upstream.

The Elgato Cam Link 4K HDMI video capture card reports to support three
different pixel formats, where the first format depends on the connected
HDMI device.

```
$ v4l2-ctl -d /dev/video0 --list-formats-ext
ioctl: VIDIOC_ENUM_FMT
	Type: Video Capture

	[0]: 'NV12' (Y/CbCr 4:2:0)
		Size: Discrete 3840x2160
			Interval: Discrete 0.033s (29.970 fps)
	[1]: 'NV12' (Y/CbCr 4:2:0)
		Size: Discrete 3840x2160
			Interval: Discrete 0.033s (29.970 fps)
	[2]: 'YU12' (Planar YUV 4:2:0)
		Size: Discrete 3840x2160
			Interval: Discrete 0.033s (29.970 fps)
```

Changing the pixel format to anything besides the first pixel format
does not work:

```
$ v4l2-ctl -d /dev/video0 --try-fmt-video pixelformat=YU12
Format Video Capture:
	Width/Height      : 3840/2160
	Pixel Format      : 'NV12' (Y/CbCr 4:2:0)
	Field             : None
	Bytes per Line    : 3840
	Size Image        : 12441600
	Colorspace        : sRGB
	Transfer Function : Rec. 709
	YCbCr/HSV Encoding: Rec. 709
	Quantization      : Default (maps to Limited Range)
	Flags             :
```

User space applications like VLC might show an error message on the
terminal in that case:

```
libv4l2: error set_fmt gave us a different result than try_fmt!
```

Depending on the error handling of the user space applications, they
might display a distorted video, because they use the wrong pixel format
for decoding the stream.

The Elgato Cam Link 4K responds to the USB video probe
VS_PROBE_CONTROL/VS_COMMIT_CONTROL with a malformed data structure: The
second byte contains bFormatIndex (instead of being the second byte of
bmHint). The first byte is always zero. The third byte is always 1.

The firmware bug was reported to Elgato on 2020-12-01 and it was
forwarded by the support team to the developers as feature request.
There is no firmware update available since then. The latest firmware
for Elgato Cam Link 4K as of 2021-03-23 has MCU 20.02.19 and FPGA 67.

Therefore correct the malformed data structure for this device. The
change was successfully tested with VLC, OBS, and Chromium using
different pixel formats (YUYV, NV12, YU12), resolutions (3840x2160,
1920x1080), and frame rates (29.970 and 59.940 fps).

Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Drung <bdrung@posteo.de>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/uvc/uvc_video.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index a550dbe36dc5..3fae3bfb2bdd 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -89,10 +89,37 @@ int uvc_query_ctrl(struct uvc_device *dev, __u8 query, __u8 unit,
 static void uvc_fixup_video_ctrl(struct uvc_streaming *stream,
 	struct uvc_streaming_control *ctrl)
 {
+	static const struct usb_device_id elgato_cam_link_4k = {
+		USB_DEVICE(0x0fd9, 0x0066)
+	};
 	struct uvc_format *format = NULL;
 	struct uvc_frame *frame = NULL;
 	unsigned int i;
 
+	/*
+	 * The response of the Elgato Cam Link 4K is incorrect: The second byte
+	 * contains bFormatIndex (instead of being the second byte of bmHint).
+	 * The first byte is always zero. The third byte is always 1.
+	 *
+	 * The UVC 1.5 class specification defines the first five bits in the
+	 * bmHint bitfield. The remaining bits are reserved and should be zero.
+	 * Therefore a valid bmHint will be less than 32.
+	 *
+	 * Latest Elgato Cam Link 4K firmware as of 2021-03-23 needs this fix.
+	 * MCU: 20.02.19, FPGA: 67
+	 */
+	if (usb_match_one_id(stream->dev->intf, &elgato_cam_link_4k) &&
+	    ctrl->bmHint > 255) {
+		u8 corrected_format_index = ctrl->bmHint >> 8;
+
+		/* uvc_dbg(stream->dev, VIDEO,
+			"Correct USB video probe response from {bmHint: 0x%04x, bFormatIndex: %u} to {bmHint: 0x%04x, bFormatIndex: %u}\n",
+			ctrl->bmHint, ctrl->bFormatIndex,
+			1, corrected_format_index); */
+		ctrl->bmHint = 1;
+		ctrl->bFormatIndex = corrected_format_index;
+	}
+
 	for (i = 0; i < stream->nformats; ++i) {
 		if (stream->format[i].index == ctrl->bFormatIndex) {
 			format = &stream->format[i];

From cf8fb999042a5fdb29866d390ac4670843965da0 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Sun, 6 Jun 2021 17:24:05 +0300
Subject: [PATCH 2445/2658] jfs: fix GPF in diFree

commit 9d574f985fe33efd6911f4d752de6f485a1ea732 upstream.

Avoid passing inode with
JFS_SBI(inode->i_sb)->ipimap == NULL to
diFree()[1]. GFP will appear:

	struct inode *ipimap = JFS_SBI(ip->i_sb)->ipimap;
	struct inomap *imap = JFS_IP(ipimap)->i_imap;

JFS_IP() will return invalid pointer when ipimap == NULL

Call Trace:
 diFree+0x13d/0x2dc0 fs/jfs/jfs_imap.c:853 [1]
 jfs_evict_inode+0x2c9/0x370 fs/jfs/inode.c:154
 evict+0x2ed/0x750 fs/inode.c:578
 iput_final fs/inode.c:1654 [inline]
 iput.part.0+0x3fe/0x820 fs/inode.c:1680
 iput+0x58/0x70 fs/inode.c:1670

Reported-and-tested-by: syzbot+0a89a7b56db04c21a656@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/jfs/inode.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index 41aa3ca6a6a4..b318732a8562 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -160,7 +160,8 @@ void jfs_evict_inode(struct inode *inode)
 			if (test_cflag(COMMIT_Freewmap, inode))
 				jfs_free_zero_link(inode);
 
-			diFree(inode);
+			if (JFS_SBI(inode->i_sb)->ipimap)
+				diFree(inode);
 
 			/*
 			 * Free the inode from the quota allocation.

From 1356d762f6dd2bf72863cc88812a008cd366a863 Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Wed, 23 Jun 2021 16:05:46 -0700
Subject: [PATCH 2446/2658] KVM: x86: Use guest MAXPHYADDR from
 CPUID.0x8000_0008 iff TDP is enabled

commit 4bf48e3c0aafd32b960d341c4925b48f416f14a5 upstream.

Ignore the guest MAXPHYADDR reported by CPUID.0x8000_0008 if TDP, i.e.
NPT, is disabled, and instead use the host's MAXPHYADDR.  Per AMD'S APM:

  Maximum guest physical address size in bits. This number applies only
  to guests using nested paging. When this field is zero, refer to the
  PhysAddrSize field for the maximum guest physical address size.

Fixes: 24c82e576b78 ("KVM: Sanitize cpuid")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210623230552.4027702-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/cpuid.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index 13bda3fcf42b..b60ffd1b3ae2 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -611,8 +611,14 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
 		unsigned virt_as = max((entry->eax >> 8) & 0xff, 48U);
 		unsigned phys_as = entry->eax & 0xff;
 
-		if (!g_phys_as)
+		/*
+		 * Use bare metal's MAXPHADDR if the CPU doesn't report guest
+		 * MAXPHYADDR separately, or if TDP (NPT) is disabled, as the
+		 * guest version "applies only to guests using nested paging".
+		 */
+		if (!g_phys_as || !tdp_enabled)
 			g_phys_as = phys_as;
+
 		entry->eax = g_phys_as | (virt_as << 8);
 		entry->edx = 0;
 		/*

From 8ab99f0f197422a3ac652b6161df9d965d5ff293 Mon Sep 17 00:00:00 2001
From: Lai Jiangshan <laijs@linux.alibaba.com>
Date: Tue, 29 Jun 2021 01:26:32 +0800
Subject: [PATCH 2447/2658] KVM: X86: Disable hardware breakpoints
 unconditionally before kvm_x86->run()

commit f85d40160691881a17a397c448d799dfc90987ba upstream.

When the host is using debug registers but the guest is not using them
nor is the guest in guest-debug state, the kvm code does not reset
the host debug registers before kvm_x86->run().  Rather, it relies on
the hardware vmentry instruction to automatically reset the dr7 registers
which ensures that the host breakpoints do not affect the guest.

This however violates the non-instrumentable nature around VM entry
and exit; for example, when a host breakpoint is set on vcpu->arch.cr2,

Another issue is consistency.  When the guest debug registers are active,
the host breakpoints are reset before kvm_x86->run(). But when the
guest debug registers are inactive, the host breakpoints are delayed to
be disabled.  The host tracing tools may see different results depending
on what the guest is doing.

To fix the problems, we clear %db7 unconditionally before kvm_x86->run()
if the host has set any breakpoints, no matter if the guest is using
them or not.

Signed-off-by: Lai Jiangshan <laijs@linux.alibaba.com>
Message-Id: <20210628172632.81029-1-jiangshanlai@gmail.com>
Cc: stable@vger.kernel.org
[Only clear %db7 instead of reloading all debug registers. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/x86.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 7c8aa75e4737..6d624de4ce15 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -6733,6 +6733,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
 		set_debugreg(vcpu->arch.eff_db[3], 3);
 		set_debugreg(vcpu->arch.dr6, 6);
 		vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_RELOAD;
+	} else if (unlikely(hw_breakpoint_active())) {
+		set_debugreg(0, 7);
 	}
 
 	kvm_x86_ops->run(vcpu);

From c873e9f901bb92cdff1236c8e609a3581445eaf4 Mon Sep 17 00:00:00 2001
From: Sherry Sun <sherry.sun@nxp.com>
Date: Tue, 27 Apr 2021 10:12:26 +0800
Subject: [PATCH 2448/2658] tty: serial: fsl_lpuart: fix the potential risk of
 division or modulo by zero

[ Upstream commit fcb10ee27fb91b25b68d7745db9817ecea9f1038 ]

We should be very careful about the register values that will be used
for division or modulo operations, althrough the possibility that the
UARTBAUD register value is zero is very low, but we had better to deal
with the "bad data" of hardware in advance to avoid division or modulo
by zero leading to undefined kernel behavior.

Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Link: https://lore.kernel.org/r/20210427021226.27468-1-sherry.sun@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/fsl_lpuart.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 1544a7cc76ff..1319f3dd5b70 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1681,6 +1681,9 @@ lpuart32_console_get_options(struct lpuart_port *sport, int *baud,
 
 	bd = lpuart32_read(sport->port.membase + UARTBAUD);
 	bd &= UARTBAUD_SBR_MASK;
+	if (!bd)
+		return;
+
 	sbr = bd;
 	uartclk = clk_get_rate(sport->clk);
 	/*

From 3cb1b7eea8cd42e08b7f04a66b504f7bd62f5037 Mon Sep 17 00:00:00 2001
From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Date: Mon, 26 Apr 2021 10:06:20 -0700
Subject: [PATCH 2449/2658] misc/libmasm/module: Fix two use after free in
 ibmasm_init_one

[ Upstream commit 7272b591c4cb9327c43443f67b8fbae7657dd9ae ]

In ibmasm_init_one, it calls ibmasm_init_remote_input_dev().
Inside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are
allocated by input_allocate_device(), and assigned to
sp->remote.mouse_dev and sp->remote.keybd_dev respectively.

In the err_free_devices error branch of ibmasm_init_one,
mouse_dev and keybd_dev are freed by input_free_device(), and return
error. Then the execution runs into error_send_message error branch
of ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called
to unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev.

My patch add a "error_init_remote" label to handle the error of
ibmasm_init_remote_input_dev(), to avoid the uaf bugs.

Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Link: https://lore.kernel.org/r/20210426170620.10546-1-lyl2019@mail.ustc.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/ibmasm/module.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/misc/ibmasm/module.c b/drivers/misc/ibmasm/module.c
index 6b3bf9ab051d..706decef68a0 100644
--- a/drivers/misc/ibmasm/module.c
+++ b/drivers/misc/ibmasm/module.c
@@ -123,7 +123,7 @@ static int ibmasm_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
 	result = ibmasm_init_remote_input_dev(sp);
 	if (result) {
 		dev_err(sp->dev, "Failed to initialize remote queue\n");
-		goto error_send_message;
+		goto error_init_remote;
 	}
 
 	result = ibmasm_send_driver_vpd(sp);
@@ -143,8 +143,9 @@ static int ibmasm_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
 	return 0;
 
 error_send_message:
-	disable_sp_interrupts(sp->base_address);
 	ibmasm_free_remote_input_dev(sp);
+error_init_remote:
+	disable_sp_interrupts(sp->base_address);
 	free_irq(sp->irq, (void *)sp);
 error_request_irq:
 	iounmap(sp->base_address);

From 491fae972650a489f743a818a797a237093a8a15 Mon Sep 17 00:00:00 2001
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Date: Tue, 18 May 2021 17:45:47 +0900
Subject: [PATCH 2450/2658] Revert "ALSA: bebob/oxfw: fix Kconfig entry for
 Mackie d.2 Pro"

[ Upstream commit 5d6fb80a142b5994355ce675c517baba6089d199 ]

This reverts commit 0edabdfe89581669609eaac5f6a8d0ae6fe95e7f.

I've explained that optional FireWire card for d.2 is also built-in to
d.2 Pro, however it's wrong. The optional card uses DM1000 ASIC and has
'Mackie DJ Mixer' in its model name of configuration ROM. On the other
hand, built-in FireWire card for d.2 Pro and d.4 Pro uses OXFW971 ASIC
and has 'd.Pro' in its model name according to manuals and user
experiences. The former card is not the card for d.2 Pro. They are similar
in appearance but different internally.

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20210518084557.102681-2-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/firewire/Kconfig       | 4 ++--
 sound/firewire/bebob/bebob.c | 2 +-
 sound/firewire/oxfw/oxfw.c   | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig
index fdc01466d143..4199cfc4a96a 100644
--- a/sound/firewire/Kconfig
+++ b/sound/firewire/Kconfig
@@ -36,7 +36,7 @@ config SND_OXFW
 	   * Mackie(Loud) Onyx-i series (former models)
 	   * Mackie(Loud) Onyx Satellite
 	   * Mackie(Loud) Tapco Link.Firewire
-	   * Mackie(Loud) d.4 pro
+	   * Mackie(Loud) d.2 pro/d.4 pro (built-in FireWire card with OXFW971 ASIC)
 	   * Mackie(Loud) U.420/U.420d
 	   * TASCAM FireOne
 
@@ -91,7 +91,7 @@ config SND_BEBOB
 	  * PreSonus FIREBOX/FIREPOD/FP10/Inspire1394
 	  * BridgeCo RDAudio1/Audio5
 	  * Mackie Onyx 1220/1620/1640 (FireWire I/O Card)
-	  * Mackie d.2 (FireWire Option) and d.2 Pro
+	  * Mackie d.2 (optional FireWire card with DM1000 ASIC)
 	  * Stanton FinalScratch 2 (ScratchAmp)
 	  * Tascam IF-FW/DM
 	  * Behringer XENIX UFX 1204/1604
diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c
index 088250ff2429..64dca7931272 100644
--- a/sound/firewire/bebob/bebob.c
+++ b/sound/firewire/bebob/bebob.c
@@ -362,7 +362,7 @@ static const struct ieee1394_device_id bebob_id_table[] = {
 	SND_BEBOB_DEV_ENTRY(VEN_BRIDGECO, 0x00010049, &spec_normal),
 	/* Mackie, Onyx 1220/1620/1640 (Firewire I/O Card) */
 	SND_BEBOB_DEV_ENTRY(VEN_MACKIE2, 0x00010065, &spec_normal),
-	// Mackie, d.2 (Firewire option card) and d.2 Pro (the card is built-in).
+	// Mackie, d.2 (optional Firewire card with DM1000).
 	SND_BEBOB_DEV_ENTRY(VEN_MACKIE1, 0x00010067, &spec_normal),
 	/* Stanton, ScratchAmp */
 	SND_BEBOB_DEV_ENTRY(VEN_STANTON, 0x00000001, &spec_normal),
diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c
index 2d310bf2f2b2..c700e11ab327 100644
--- a/sound/firewire/oxfw/oxfw.c
+++ b/sound/firewire/oxfw/oxfw.c
@@ -320,7 +320,7 @@ static const struct ieee1394_device_id oxfw_id_table[] = {
 	 *  Onyx-i series (former models):	0x081216
 	 *  Mackie Onyx Satellite:		0x00200f
 	 *  Tapco LINK.firewire 4x6:		0x000460
-	 *  d.4 pro:				Unknown
+	 *  d.2 pro/d.4 pro (built-in card):	Unknown
 	 *  U.420:				Unknown
 	 *  U.420d:				Unknown
 	 */

From e7bb38ea882d8d319150aa553a94719c2c46bebb Mon Sep 17 00:00:00 2001
From: James Smart <jsmart2021@gmail.com>
Date: Fri, 14 May 2021 12:55:51 -0700
Subject: [PATCH 2451/2658] scsi: lpfc: Fix "Unexpected timeout" error in
 direct attach topology

[ Upstream commit e30d55137edef47434c40d7570276a0846fe922c ]

An 'unexpected timeout' message may be seen in a point-2-point topology.
The message occurs when a PLOGI is received before the driver is notified
of FLOGI completion. The FLOGI completion failure causes discovery to be
triggered for a second time. The discovery timer is restarted but no new
discovery activity is initiated, thus the timeout message eventually
appears.

In point-2-point, when discovery has progressed before the FLOGI completion
is processed, it is not a failure. Add code to FLOGI completion to detect
that discovery has progressed and exit the FLOGI handling (noop'ing it).

Link: https://lore.kernel.org/r/20210514195559.119853-4-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/lpfc/lpfc_els.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 5be938b47f48..b66b1ed6d2af 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -1142,6 +1142,15 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 			phba->fcf.fcf_redisc_attempted = 0; /* reset */
 			goto out;
 		}
+	} else if (vport->port_state > LPFC_FLOGI &&
+		   vport->fc_flag & FC_PT2PT) {
+		/*
+		 * In a p2p topology, it is possible that discovery has
+		 * already progressed, and this completion can be ignored.
+		 * Recheck the indicated topology.
+		 */
+		if (!sp->cmn.fPort)
+			goto out;
 	}
 
 flogifail:

From 97929daf4eb08083179bddfcde073c89f99180e8 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Tue, 25 May 2021 21:44:04 +0200
Subject: [PATCH 2452/2658] tty: serial: 8250: serial_cs: Fix a memory leak in
 error handling path

[ Upstream commit fad92b11047a748c996ebd6cfb164a63814eeb2e ]

In the probe function, if the final 'serial_config()' fails, 'info' is
leaking.

Add a resource handling path to free this memory.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/dc25f96b7faebf42e60fe8d02963c941cf4d8124.1621971720.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/8250/serial_cs.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/8250/serial_cs.c b/drivers/tty/serial/8250/serial_cs.c
index bf5feb2ea35a..92c64ed12295 100644
--- a/drivers/tty/serial/8250/serial_cs.c
+++ b/drivers/tty/serial/8250/serial_cs.c
@@ -305,6 +305,7 @@ static int serial_resume(struct pcmcia_device *link)
 static int serial_probe(struct pcmcia_device *link)
 {
 	struct serial_info *info;
+	int ret;
 
 	dev_dbg(&link->dev, "serial_attach()\n");
 
@@ -319,7 +320,15 @@ static int serial_probe(struct pcmcia_device *link)
 	if (do_sound)
 		link->config_flags |= CONF_ENABLE_SPKR;
 
-	return serial_config(link);
+	ret = serial_config(link);
+	if (ret)
+		goto free_info;
+
+	return 0;
+
+free_info:
+	kfree(info);
+	return ret;
 }
 
 static void serial_detach(struct pcmcia_device *link)

From cafec7b95b3b81c3a323075d0620c4a614866d35 Mon Sep 17 00:00:00 2001
From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Date: Tue, 1 Jun 2021 19:07:10 +0800
Subject: [PATCH 2453/2658] fs/jfs: Fix missing error code in lmLogInit()

[ Upstream commit 492109333c29e1bb16d8732e1d597b02e8e0bf2e ]

The error code is missing in this code scenario, add the error code
'-EINVAL' to the return value 'rc.

Eliminate the follow smatch warning:

fs/jfs/jfs_logmgr.c:1327 lmLogInit() warn: missing error code 'rc'.

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/jfs/jfs_logmgr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index a69bdf2a1085..d19542a88c2c 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -1339,6 +1339,7 @@ int lmLogInit(struct jfs_log * log)
 		} else {
 			if (memcmp(logsuper->uuid, log->uuid, 16)) {
 				jfs_warn("wrong uuid on JFS log device");
+				rc = -EINVAL;
 				goto errout20;
 			}
 			log->size = le32_to_cpu(logsuper->size);

From 1a5d6b78d7a37035d5191bf20f1c68724bed6d31 Mon Sep 17 00:00:00 2001
From: Mike Christie <michael.christie@oracle.com>
Date: Tue, 25 May 2021 13:18:03 -0500
Subject: [PATCH 2454/2658] scsi: iscsi: Add iscsi_cls_conn refcount helpers

[ Upstream commit b1d19e8c92cfb0ded180ef3376c20e130414e067 ]

There are a couple places where we could free the iscsi_cls_conn while it's
still in use. This adds some helpers to get/put a refcount on the struct
and converts an exiting user. Subsequent commits will then use the helpers
to fix 2 bugs in the eh code.

Link: https://lore.kernel.org/r/20210525181821.7617-11-michael.christie@oracle.com
Reviewed-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/libiscsi.c             |  7 ++-----
 drivers/scsi/scsi_transport_iscsi.c | 12 ++++++++++++
 include/scsi/scsi_transport_iscsi.h |  2 ++
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 18b8d86ef74b..0713d02cf112 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -1384,7 +1384,6 @@ void iscsi_session_failure(struct iscsi_session *session,
 			   enum iscsi_err err)
 {
 	struct iscsi_conn *conn;
-	struct device *dev;
 
 	spin_lock_bh(&session->frwd_lock);
 	conn = session->leadconn;
@@ -1393,10 +1392,8 @@ void iscsi_session_failure(struct iscsi_session *session,
 		return;
 	}
 
-	dev = get_device(&conn->cls_conn->dev);
+	iscsi_get_conn(conn->cls_conn);
 	spin_unlock_bh(&session->frwd_lock);
-	if (!dev)
-	        return;
 	/*
 	 * if the host is being removed bypass the connection
 	 * recovery initialization because we are going to kill
@@ -1406,7 +1403,7 @@ void iscsi_session_failure(struct iscsi_session *session,
 		iscsi_conn_error_event(conn->cls_conn, err);
 	else
 		iscsi_conn_failure(conn, err);
-	put_device(dev);
+	iscsi_put_conn(conn->cls_conn);
 }
 EXPORT_SYMBOL_GPL(iscsi_session_failure);
 
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 42bc4b71b0ba..e0159e6a1065 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2328,6 +2328,18 @@ int iscsi_destroy_conn(struct iscsi_cls_conn *conn)
 }
 EXPORT_SYMBOL_GPL(iscsi_destroy_conn);
 
+void iscsi_put_conn(struct iscsi_cls_conn *conn)
+{
+	put_device(&conn->dev);
+}
+EXPORT_SYMBOL_GPL(iscsi_put_conn);
+
+void iscsi_get_conn(struct iscsi_cls_conn *conn)
+{
+	get_device(&conn->dev);
+}
+EXPORT_SYMBOL_GPL(iscsi_get_conn);
+
 /*
  * iscsi interface functions
  */
diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h
index 6183d20a01fb..e673c7c9c5fb 100644
--- a/include/scsi/scsi_transport_iscsi.h
+++ b/include/scsi/scsi_transport_iscsi.h
@@ -437,6 +437,8 @@ extern void iscsi_free_session(struct iscsi_cls_session *session);
 extern int iscsi_destroy_session(struct iscsi_cls_session *session);
 extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess,
 						int dd_size, uint32_t cid);
+extern void iscsi_put_conn(struct iscsi_cls_conn *conn);
+extern void iscsi_get_conn(struct iscsi_cls_conn *conn);
 extern int iscsi_destroy_conn(struct iscsi_cls_conn *conn);
 extern void iscsi_unblock_session(struct iscsi_cls_session *session);
 extern void iscsi_block_session(struct iscsi_cls_session *session);

From 081b269949a35726f0982c456a6907062514b846 Mon Sep 17 00:00:00 2001
From: Zou Wei <zou_wei@huawei.com>
Date: Wed, 12 May 2021 14:33:46 +0800
Subject: [PATCH 2455/2658] mfd: da9052/stmpe: Add and modify
 MODULE_DEVICE_TABLE

[ Upstream commit 4700ef326556ed74aba188f12396740a8c1c21dd ]

This patch adds/modifies MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this driver when it is built
as an external module.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/da9052-i2c.c | 1 +
 drivers/mfd/stmpe-i2c.c  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/mfd/da9052-i2c.c b/drivers/mfd/da9052-i2c.c
index 2697ffb08009..2992fd94bc0c 100644
--- a/drivers/mfd/da9052-i2c.c
+++ b/drivers/mfd/da9052-i2c.c
@@ -118,6 +118,7 @@ static const struct i2c_device_id da9052_i2c_id[] = {
 	{"da9053-bc", DA9053_BC},
 	{}
 };
+MODULE_DEVICE_TABLE(i2c, da9052_i2c_id);
 
 #ifdef CONFIG_OF
 static const struct of_device_id dialog_dt_ids[] = {
diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
index c3f4aab53b07..663a6c1c3d0d 100644
--- a/drivers/mfd/stmpe-i2c.c
+++ b/drivers/mfd/stmpe-i2c.c
@@ -107,7 +107,7 @@ static const struct i2c_device_id stmpe_i2c_id[] = {
 	{ "stmpe2403", STMPE2403 },
 	{ }
 };
-MODULE_DEVICE_TABLE(i2c, stmpe_id);
+MODULE_DEVICE_TABLE(i2c, stmpe_i2c_id);
 
 static struct i2c_driver stmpe_i2c_driver = {
 	.driver = {

From 7efe427bd9196777fd1115c4f8b38651397104ec Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 8 Jun 2021 16:04:37 +0200
Subject: [PATCH 2456/2658] ALSA: sb: Fix potential double-free of CSP mixer
 elements

[ Upstream commit c305366a37441c2ac90b08711cb6f032b43672f2 ]

snd_sb_qsound_destroy() contains the calls of removing the previously
created mixer controls, but it doesn't clear the pointers.  As
snd_sb_qsound_destroy() itself may be repeatedly called via ioctl,
this could lead to double-free potentially.

Fix it by clearing the struct fields properly afterwards.

Link: https://lore.kernel.org/r/20210608140540.17885-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/isa/sb/sb16_csp.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c
index 2cc068be7d3b..90fa57ad14c0 100644
--- a/sound/isa/sb/sb16_csp.c
+++ b/sound/isa/sb/sb16_csp.c
@@ -1086,10 +1086,14 @@ static void snd_sb_qsound_destroy(struct snd_sb_csp * p)
 	card = p->chip->card;	
 	
 	down_write(&card->controls_rwsem);
-	if (p->qsound_switch)
+	if (p->qsound_switch) {
 		snd_ctl_remove(card, p->qsound_switch);
-	if (p->qsound_space)
+		p->qsound_switch = NULL;
+	}
+	if (p->qsound_space) {
 		snd_ctl_remove(card, p->qsound_space);
+		p->qsound_space = NULL;
+	}
 	up_write(&card->controls_rwsem);
 
 	/* cancel pending transfer of QSound parameters */

From f85f32928f2928d31c5efda4d974a2da467374d7 Mon Sep 17 00:00:00 2001
From: Geoff Levand <geoff@infradead.org>
Date: Thu, 3 Jun 2021 19:17:02 +0000
Subject: [PATCH 2457/2658] powerpc/ps3: Add dma_mask to ps3_dma_region

[ Upstream commit 9733862e50fdba55e7f1554e4286fcc5302ff28e ]

Commit f959dcd6ddfd29235030e8026471ac1b022ad2b0 (dma-direct: Fix
potential NULL pointer dereference) added a null check on the
dma_mask pointer of the kernel's device structure.

Add a dma_mask variable to the ps3_dma_region structure and set
the device structure's dma_mask pointer to point to this new variable.

Fixes runtime errors like these:
# WARNING: Fixes tag on line 10 doesn't match correct format
# WARNING: Fixes tag on line 10 doesn't match correct format

  ps3_system_bus_match:349: dev=8.0(sb_01), drv=8.0(ps3flash): match
  WARNING: CPU: 0 PID: 1 at kernel/dma/mapping.c:151 .dma_map_page_attrs+0x34/0x1e0
  ps3flash sb_01: ps3stor_setup:193: map DMA region failed

Signed-off-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/562d0c9ea0100a30c3b186bcc7adb34b0bbd2cd7.1622746428.git.geoff@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/ps3.h  |  2 ++
 arch/powerpc/platforms/ps3/mm.c | 12 ++++++++++++
 2 files changed, 14 insertions(+)

diff --git a/arch/powerpc/include/asm/ps3.h b/arch/powerpc/include/asm/ps3.h
index a1bc7e758422..2d729b53a556 100644
--- a/arch/powerpc/include/asm/ps3.h
+++ b/arch/powerpc/include/asm/ps3.h
@@ -83,6 +83,7 @@ struct ps3_dma_region_ops;
  * @bus_addr: The 'translated' bus address of the region.
  * @len: The length in bytes of the region.
  * @offset: The offset from the start of memory of the region.
+ * @dma_mask: Device dma_mask.
  * @ioid: The IOID of the device who owns this region
  * @chunk_list: Opaque variable used by the ioc page manager.
  * @region_ops: struct ps3_dma_region_ops - dma region operations
@@ -97,6 +98,7 @@ struct ps3_dma_region {
 	enum ps3_dma_region_type region_type;
 	unsigned long len;
 	unsigned long offset;
+	u64 dma_mask;
 
 	/* driver variables  (set by ps3_dma_region_create) */
 	unsigned long bus_addr;
diff --git a/arch/powerpc/platforms/ps3/mm.c b/arch/powerpc/platforms/ps3/mm.c
index 19bae78b1f25..76cbf1be9962 100644
--- a/arch/powerpc/platforms/ps3/mm.c
+++ b/arch/powerpc/platforms/ps3/mm.c
@@ -18,6 +18,7 @@
  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
+#include <linux/dma-mapping.h>
 #include <linux/kernel.h>
 #include <linux/export.h>
 #include <linux/memblock.h>
@@ -1132,6 +1133,7 @@ int ps3_dma_region_init(struct ps3_system_bus_device *dev,
 	enum ps3_dma_region_type region_type, void *addr, unsigned long len)
 {
 	unsigned long lpar_addr;
+	int result;
 
 	lpar_addr = addr ? ps3_mm_phys_to_lpar(__pa(addr)) : 0;
 
@@ -1143,6 +1145,16 @@ int ps3_dma_region_init(struct ps3_system_bus_device *dev,
 		r->offset -= map.r1.offset;
 	r->len = len ? len : _ALIGN_UP(map.total, 1 << r->page_size);
 
+	dev->core.dma_mask = &r->dma_mask;
+
+	result = dma_set_mask_and_coherent(&dev->core, DMA_BIT_MASK(32));
+
+	if (result < 0) {
+		dev_err(&dev->core, "%s:%d: dma_set_mask_and_coherent failed: %d\n",
+			__func__, __LINE__, result);
+		return result;
+	}
+
 	switch (dev->dev_type) {
 	case PS3_DEVICE_TYPE_SB:
 		r->region_ops =  (USE_DYNAMIC_DMA)

From 438fd8e39ba9b34e77826f797655f8270566e843 Mon Sep 17 00:00:00 2001
From: Srinivas Neeli <srinivas.neeli@xilinx.com>
Date: Fri, 9 Apr 2021 19:38:05 +0530
Subject: [PATCH 2458/2658] gpio: zynq: Check return value of
 pm_runtime_get_sync

[ Upstream commit a51b2fb94b04ab71e53a71b9fad03fa826941254 ]

Return value of "pm_runtime_get_sync" API was neither captured nor checked.
Fixed it by capturing the return value and then checking for any warning.

Addresses-Coverity: "check_return"
Signed-off-by: Srinivas Neeli <srinivas.neeli@xilinx.com>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-zynq.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpio/gpio-zynq.c b/drivers/gpio/gpio-zynq.c
index 8abeacac5885..ccfdf5a45998 100644
--- a/drivers/gpio/gpio-zynq.c
+++ b/drivers/gpio/gpio-zynq.c
@@ -764,8 +764,11 @@ static int zynq_gpio_probe(struct platform_device *pdev)
 static int zynq_gpio_remove(struct platform_device *pdev)
 {
 	struct zynq_gpio *gpio = platform_get_drvdata(pdev);
+	int ret;
 
-	pm_runtime_get_sync(&pdev->dev);
+	ret = pm_runtime_get_sync(&pdev->dev);
+	if (ret < 0)
+		dev_warn(&pdev->dev, "pm_runtime_get_sync() Failed\n");
 	gpiochip_remove(&gpio->chip);
 	clk_disable_unprepare(gpio->clk);
 	device_set_wakeup_capable(&pdev->dev, 0);

From ec355a40023440a24e8bd249c3aed091ed33efa3 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Wed, 16 Jun 2021 10:11:21 +0800
Subject: [PATCH 2459/2658] ALSA: ppc: fix error return code in
 snd_pmac_probe()

[ Upstream commit 80b9c1be567c3c6bbe0d4b290af578e630485b5d ]

If snd_pmac_tumbler_init() or snd_pmac_tumbler_post_init() fails,
snd_pmac_probe() need return error code.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20210616021121.1991502-1-yangyingliang@huawei.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/ppc/powermac.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/sound/ppc/powermac.c b/sound/ppc/powermac.c
index 33c6be9fb388..7c70ba5e2540 100644
--- a/sound/ppc/powermac.c
+++ b/sound/ppc/powermac.c
@@ -90,7 +90,11 @@ static int snd_pmac_probe(struct platform_device *devptr)
 		sprintf(card->shortname, "PowerMac %s", name_ext);
 		sprintf(card->longname, "%s (Dev %d) Sub-frame %d",
 			card->shortname, chip->device_id, chip->subframe);
-		if ( snd_pmac_tumbler_init(chip) < 0 || snd_pmac_tumbler_post_init() < 0)
+		err = snd_pmac_tumbler_init(chip);
+		if (err < 0)
+			goto __error;
+		err = snd_pmac_tumbler_post_init();
+		if (err < 0)
 			goto __error;
 		break;
 	case PMAC_AWACS:

From 1ee5cb553ee5cedf8de29bcae6c8deb9900d6929 Mon Sep 17 00:00:00 2001
From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Date: Tue, 25 May 2021 09:51:42 -0400
Subject: [PATCH 2460/2658] selftests/powerpc: Fix "no_handler" EBB selftest

[ Upstream commit 45677c9aebe926192e59475b35a1ff35ff2d4217 ]

The "no_handler_test" in ebb selftests attempts to read the PMU
registers twice via helper function "dump_ebb_state". First dump is
just before closing of event and the second invocation is done after
closing of the event. The original intention of second
dump_ebb_state was to dump the state of registers at the end of
the test when the counters are frozen. But this will be achieved
with the first call itself since sample period is set to low value
and PMU will be frozen by then. Hence patch removes the
dump which was done before closing of the event.

Reported-by: Shirisha Ganta <shirisha.ganta1@ibm.com>
Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Tested-by: Nageswara R Sastry <rnsastry@linux.ibm.com <mailto:rnsastry@linux.ibm.com>>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1621950703-1532-2-git-send-email-atrajeev@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c b/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c
index 8341d7778d5e..87630d44fb4c 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c
@@ -50,8 +50,6 @@ static int no_handler_test(void)
 
 	event_close(&event);
 
-	dump_ebb_state();
-
 	/* The real test is that we never took an EBB at 0x0 */
 
 	return 0;

From 7fa337c0b714247f540dd559332ddf79e7e88561 Mon Sep 17 00:00:00 2001
From: Zhen Lei <thunder.leizhen@huawei.com>
Date: Thu, 17 Jun 2021 18:37:29 +0800
Subject: [PATCH 2461/2658] ASoC: soc-core: Fix the error return code in
 snd_soc_of_parse_audio_routing()

[ Upstream commit 7d3865a10b9ff2669c531d5ddd60bf46b3d48f1e ]

When devm_kcalloc() fails, the error code -ENOMEM should be returned
instead of -EINVAL.

Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Link: https://lore.kernel.org/r/20210617103729.1918-1-thunder.leizhen@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/soc-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index d401079511bf..3984efa188ac 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -3422,7 +3422,7 @@ int snd_soc_of_parse_audio_routing(struct snd_soc_card *card,
 	if (!routes) {
 		dev_err(card->dev,
 			"ASoC: Could not allocate DAPM route table\n");
-		return -EINVAL;
+		return -ENOMEM;
 	}
 
 	for (i = 0; i < num_routes; i++) {

From 4c79eb414d2f5873c18cc2a6b411d9fb60bbf38e Mon Sep 17 00:00:00 2001
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Date: Sat, 19 Jun 2021 17:39:22 +0900
Subject: [PATCH 2462/2658] ALSA: bebob: add support for ToneWeal FW66

[ Upstream commit 50ebe56222bfa0911a932930f9229ee5995508d9 ]

A user of FFADO project reported the issue of ToneWeal FW66. As a result,
the device is identified as one of applications of BeBoB solution.

I note that in the report the device returns contradictory result in plug
discovery process for audio subunit. Fortunately ALSA BeBoB driver doesn't
perform it thus it's likely to handle the device without issues.

I receive no reaction to test request for this patch yet, however it would
be worth to add support for it.

daniel@gibbonmoon:/sys/bus/firewire/devices/fw1$ grep -r . *
Binary file config_rom matches
dev:244:1
guid:0x0023270002000000
hardware_version:0x000002
is_local:0
model:0x020002
model_name:FW66
power/runtime_active_time:0
power/runtime_active_kids:0
power/runtime_usage:0
power/runtime_status:unsupported
power/async:disabled
power/runtime_suspended_time:0
power/runtime_enabled:disabled
power/control:auto
subsystem/drivers_autoprobe:1
uevent:MAJOR=244
uevent:MINOR=1
uevent:DEVNAME=fw1
units:0x00a02d:0x010001
vendor:0x002327
vendor_name:ToneWeal
fw1.0/uevent:MODALIAS=ieee1394:ven00002327mo00020002sp0000A02Dver00010001
fw1.0/power/runtime_active_time:0
fw1.0/power/runtime_active_kids:0
fw1.0/power/runtime_usage:0
fw1.0/power/runtime_status:unsupported
fw1.0/power/async:disabled
fw1.0/power/runtime_suspended_time:0
fw1.0/power/runtime_enabled:disabled
fw1.0/power/control:auto
fw1.0/model:0x020002
fw1.0/rom_index:15
fw1.0/specifier_id:0x00a02d
fw1.0/model_name:FW66
fw1.0/version:0x010001
fw1.0/modalias:ieee1394:ven00002327mo00020002sp0000A02Dver00010001

Cc: Daniel Jozsef <daniel.jozsef@gmail.com>
Reference: https://lore.kernel.org/alsa-devel/20200119164335.GA11974@workstation/
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20210619083922.16060-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/firewire/Kconfig       | 1 +
 sound/firewire/bebob/bebob.c | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig
index 4199cfc4a96a..850315d1abca 100644
--- a/sound/firewire/Kconfig
+++ b/sound/firewire/Kconfig
@@ -117,6 +117,7 @@ config SND_BEBOB
 	  * M-Audio Ozonic/NRV10/ProfireLightBridge
 	  * M-Audio FireWire 1814/ProjectMix IO
 	  * Digidesign Mbox 2 Pro
+	  * ToneWeal FW66
 
           To compile this driver as a module, choose M here: the module
           will be called snd-bebob.
diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c
index 64dca7931272..c3c14e383e73 100644
--- a/sound/firewire/bebob/bebob.c
+++ b/sound/firewire/bebob/bebob.c
@@ -60,6 +60,7 @@ static DECLARE_BITMAP(devices_used, SNDRV_CARDS);
 #define VEN_MAUDIO1	0x00000d6c
 #define VEN_MAUDIO2	0x000007f5
 #define VEN_DIGIDESIGN	0x00a07e
+#define OUI_SHOUYO	0x002327
 
 #define MODEL_FOCUSRITE_SAFFIRE_BOTH	0x00000000
 #define MODEL_MAUDIO_AUDIOPHILE_BOTH	0x00010060
@@ -461,6 +462,8 @@ static const struct ieee1394_device_id bebob_id_table[] = {
 			    &maudio_special_spec),
 	/* Digidesign Mbox 2 Pro */
 	SND_BEBOB_DEV_ENTRY(VEN_DIGIDESIGN, 0x0000a9, &spec_normal),
+	// Toneweal FW66.
+	SND_BEBOB_DEV_ENTRY(OUI_SHOUYO, 0x020002, &spec_normal),
 	/* IDs are unknown but able to be supported */
 	/*  Apogee, Mini-ME Firewire */
 	/*  Apogee, Mini-DAC Firewire */

From 773a3412f0a7c8b296f81013458c5a0d1869739c Mon Sep 17 00:00:00 2001
From: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Date: Thu, 17 Jun 2021 19:27:55 +0300
Subject: [PATCH 2463/2658] usb: gadget: f_hid: fix endianness issue with
 descriptors

[ Upstream commit 33cb46c4676d01956811b68a29157ea969a5df70 ]

Running sparse checker it shows warning message about
incorrect endianness used for descriptor initialization:

| f_hid.c:91:43: warning: incorrect type in initializer (different base types)
| f_hid.c:91:43:    expected restricted __le16 [usertype] bcdHID
| f_hid.c:91:43:    got int

Fixing issue with cpu_to_le16() macro, however this is not a real issue
as the value is the same both endians.

Cc: Fabien Chouteau <fabien.chouteau@barco.com>
Cc: Segiy Stetsyuk <serg_stetsuk@ukr.net>
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Link: https://lore.kernel.org/r/20210617162755.29676-1-ruslan.bilovol@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/function/f_hid.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index a5dae5bb62ab..590e056d3618 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -91,7 +91,7 @@ static struct usb_interface_descriptor hidg_interface_desc = {
 static struct hid_descriptor hidg_desc = {
 	.bLength			= sizeof hidg_desc,
 	.bDescriptorType		= HID_DT_HID,
-	.bcdHID				= 0x0101,
+	.bcdHID				= cpu_to_le16(0x0101),
 	.bCountryCode			= 0x00,
 	.bNumDescriptors		= 0x1,
 	/*.desc[0].bDescriptorType	= DYNAMIC */

From 00b558b30e23abc61695a18b8a39c5cac186ef8a Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Fri, 18 Jun 2021 12:38:35 +0800
Subject: [PATCH 2464/2658] usb: gadget: hid: fix error return code in
 hid_bind()

[ Upstream commit 88693f770bb09c196b1eb5f06a484a254ecb9924 ]

Fix to return a negative error code from the error handling
case instead of 0.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20210618043835.2641360-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/legacy/hid.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/legacy/hid.c b/drivers/usb/gadget/legacy/hid.c
index 7e5d2c48476e..97329ba5d382 100644
--- a/drivers/usb/gadget/legacy/hid.c
+++ b/drivers/usb/gadget/legacy/hid.c
@@ -175,8 +175,10 @@ static int hid_bind(struct usb_composite_dev *cdev)
 		struct usb_descriptor_header *usb_desc;
 
 		usb_desc = usb_otg_descriptor_alloc(gadget);
-		if (!usb_desc)
+		if (!usb_desc) {
+			status = -ENOMEM;
 			goto put;
+		}
 		usb_otg_descriptor_init(gadget, usb_desc);
 		otg_desc[0] = usb_desc;
 		otg_desc[1] = NULL;

From 511813add30af1472e1cc786913f82cc2b3f0370 Mon Sep 17 00:00:00 2001
From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Date: Fri, 18 Jun 2021 13:49:00 +1000
Subject: [PATCH 2465/2658] powerpc/boot: Fixup device-tree on little endian

[ Upstream commit c93f80849bdd9b45d834053ae1336e28f0026c84 ]

This fixes the core devtree.c functions and the ns16550 UART backend.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
Reviewed-by: Segher Boessenkool <segher@kernel.crashing.org>
Acked-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/YMwXrPT8nc4YUdJ9@thinks.paulus.ozlabs.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/boot/devtree.c | 59 +++++++++++++++++++++----------------
 arch/powerpc/boot/ns16550.c |  9 ++++--
 2 files changed, 41 insertions(+), 27 deletions(-)

diff --git a/arch/powerpc/boot/devtree.c b/arch/powerpc/boot/devtree.c
index a7e21a35c03a..27c84b82b588 100644
--- a/arch/powerpc/boot/devtree.c
+++ b/arch/powerpc/boot/devtree.c
@@ -17,6 +17,7 @@
 #include "string.h"
 #include "stdio.h"
 #include "ops.h"
+#include "of.h"
 
 void dt_fixup_memory(u64 start, u64 size)
 {
@@ -27,21 +28,25 @@ void dt_fixup_memory(u64 start, u64 size)
 	root = finddevice("/");
 	if (getprop(root, "#address-cells", &naddr, sizeof(naddr)) < 0)
 		naddr = 2;
+	else
+		naddr = be32_to_cpu(naddr);
 	if (naddr < 1 || naddr > 2)
 		fatal("Can't cope with #address-cells == %d in /\n\r", naddr);
 
 	if (getprop(root, "#size-cells", &nsize, sizeof(nsize)) < 0)
 		nsize = 1;
+	else
+		nsize = be32_to_cpu(nsize);
 	if (nsize < 1 || nsize > 2)
 		fatal("Can't cope with #size-cells == %d in /\n\r", nsize);
 
 	i = 0;
 	if (naddr == 2)
-		memreg[i++] = start >> 32;
-	memreg[i++] = start & 0xffffffff;
+		memreg[i++] = cpu_to_be32(start >> 32);
+	memreg[i++] = cpu_to_be32(start & 0xffffffff);
 	if (nsize == 2)
-		memreg[i++] = size >> 32;
-	memreg[i++] = size & 0xffffffff;
+		memreg[i++] = cpu_to_be32(size >> 32);
+	memreg[i++] = cpu_to_be32(size & 0xffffffff);
 
 	memory = finddevice("/memory");
 	if (! memory) {
@@ -49,9 +54,9 @@ void dt_fixup_memory(u64 start, u64 size)
 		setprop_str(memory, "device_type", "memory");
 	}
 
-	printf("Memory <- <0x%x", memreg[0]);
+	printf("Memory <- <0x%x", be32_to_cpu(memreg[0]));
 	for (i = 1; i < (naddr + nsize); i++)
-		printf(" 0x%x", memreg[i]);
+		printf(" 0x%x", be32_to_cpu(memreg[i]));
 	printf("> (%ldMB)\n\r", (unsigned long)(size >> 20));
 
 	setprop(memory, "reg", memreg, (naddr + nsize)*sizeof(u32));
@@ -69,10 +74,10 @@ void dt_fixup_cpu_clocks(u32 cpu, u32 tb, u32 bus)
 		printf("CPU bus-frequency <- 0x%x (%dMHz)\n\r", bus, MHZ(bus));
 
 	while ((devp = find_node_by_devtype(devp, "cpu"))) {
-		setprop_val(devp, "clock-frequency", cpu);
-		setprop_val(devp, "timebase-frequency", tb);
+		setprop_val(devp, "clock-frequency", cpu_to_be32(cpu));
+		setprop_val(devp, "timebase-frequency", cpu_to_be32(tb));
 		if (bus > 0)
-			setprop_val(devp, "bus-frequency", bus);
+			setprop_val(devp, "bus-frequency", cpu_to_be32(bus));
 	}
 
 	timebase_period_ns = 1000000000 / tb;
@@ -84,7 +89,7 @@ void dt_fixup_clock(const char *path, u32 freq)
 
 	if (devp) {
 		printf("%s: clock-frequency <- %x (%dMHz)\n\r", path, freq, MHZ(freq));
-		setprop_val(devp, "clock-frequency", freq);
+		setprop_val(devp, "clock-frequency", cpu_to_be32(freq));
 	}
 }
 
@@ -137,8 +142,12 @@ void dt_get_reg_format(void *node, u32 *naddr, u32 *nsize)
 {
 	if (getprop(node, "#address-cells", naddr, 4) != 4)
 		*naddr = 2;
+	else
+		*naddr = be32_to_cpu(*naddr);
 	if (getprop(node, "#size-cells", nsize, 4) != 4)
 		*nsize = 1;
+	else
+		*nsize = be32_to_cpu(*nsize);
 }
 
 static void copy_val(u32 *dest, u32 *src, int naddr)
@@ -167,9 +176,9 @@ static int add_reg(u32 *reg, u32 *add, int naddr)
 	int i, carry = 0;
 
 	for (i = MAX_ADDR_CELLS - 1; i >= MAX_ADDR_CELLS - naddr; i--) {
-		u64 tmp = (u64)reg[i] + add[i] + carry;
+		u64 tmp = (u64)be32_to_cpu(reg[i]) + be32_to_cpu(add[i]) + carry;
 		carry = tmp >> 32;
-		reg[i] = (u32)tmp;
+		reg[i] = cpu_to_be32((u32)tmp);
 	}
 
 	return !carry;
@@ -184,18 +193,18 @@ static int compare_reg(u32 *reg, u32 *range, u32 *rangesize)
 	u32 end;
 
 	for (i = 0; i < MAX_ADDR_CELLS; i++) {
-		if (reg[i] < range[i])
+		if (be32_to_cpu(reg[i]) < be32_to_cpu(range[i]))
 			return 0;
-		if (reg[i] > range[i])
+		if (be32_to_cpu(reg[i]) > be32_to_cpu(range[i]))
 			break;
 	}
 
 	for (i = 0; i < MAX_ADDR_CELLS; i++) {
-		end = range[i] + rangesize[i];
+		end = be32_to_cpu(range[i]) + be32_to_cpu(rangesize[i]);
 
-		if (reg[i] < end)
+		if (be32_to_cpu(reg[i]) < end)
 			break;
-		if (reg[i] > end)
+		if (be32_to_cpu(reg[i]) > end)
 			return 0;
 	}
 
@@ -244,7 +253,6 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr,
 		return 0;
 
 	dt_get_reg_format(parent, &naddr, &nsize);
-
 	if (nsize > 2)
 		return 0;
 
@@ -256,10 +264,10 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr,
 
 	copy_val(last_addr, prop_buf + offset, naddr);
 
-	ret_size = prop_buf[offset + naddr];
+	ret_size = be32_to_cpu(prop_buf[offset + naddr]);
 	if (nsize == 2) {
 		ret_size <<= 32;
-		ret_size |= prop_buf[offset + naddr + 1];
+		ret_size |= be32_to_cpu(prop_buf[offset + naddr + 1]);
 	}
 
 	for (;;) {
@@ -282,7 +290,6 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr,
 
 		offset = find_range(last_addr, prop_buf, prev_naddr,
 		                    naddr, prev_nsize, buflen / 4);
-
 		if (offset < 0)
 			return 0;
 
@@ -300,8 +307,7 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr,
 	if (naddr > 2)
 		return 0;
 
-	ret_addr = ((u64)last_addr[2] << 32) | last_addr[3];
-
+	ret_addr = ((u64)be32_to_cpu(last_addr[2]) << 32) | be32_to_cpu(last_addr[3]);
 	if (sizeof(void *) == 4 &&
 	    (ret_addr >= 0x100000000ULL || ret_size > 0x100000000ULL ||
 	     ret_addr + ret_size > 0x100000000ULL))
@@ -354,11 +360,14 @@ int dt_is_compatible(void *node, const char *compat)
 int dt_get_virtual_reg(void *node, void **addr, int nres)
 {
 	unsigned long xaddr;
-	int n;
+	int n, i;
 
 	n = getprop(node, "virtual-reg", addr, nres * 4);
-	if (n > 0)
+	if (n > 0) {
+		for (i = 0; i < n/4; i ++)
+			((u32 *)addr)[i] = be32_to_cpu(((u32 *)addr)[i]);
 		return n / 4;
+	}
 
 	for (n = 0; n < nres; n++) {
 		if (!dt_xlate_reg(node, n, &xaddr, NULL))
diff --git a/arch/powerpc/boot/ns16550.c b/arch/powerpc/boot/ns16550.c
index 8c9ead94be06..cea34a20085c 100644
--- a/arch/powerpc/boot/ns16550.c
+++ b/arch/powerpc/boot/ns16550.c
@@ -14,6 +14,7 @@
 #include "stdio.h"
 #include "io.h"
 #include "ops.h"
+#include "of.h"
 
 #define UART_DLL	0	/* Out: Divisor Latch Low */
 #define UART_DLM	1	/* Out: Divisor Latch High */
@@ -57,16 +58,20 @@ int ns16550_console_init(void *devp, struct serial_console_data *scdp)
 	int n;
 	u32 reg_offset;
 
-	if (dt_get_virtual_reg(devp, (void **)&reg_base, 1) < 1)
+	if (dt_get_virtual_reg(devp, (void **)&reg_base, 1) < 1) {
+		printf("virt reg parse fail...\r\n");
 		return -1;
+	}
 
 	n = getprop(devp, "reg-offset", &reg_offset, sizeof(reg_offset));
 	if (n == sizeof(reg_offset))
-		reg_base += reg_offset;
+		reg_base += be32_to_cpu(reg_offset);
 
 	n = getprop(devp, "reg-shift", &reg_shift, sizeof(reg_shift));
 	if (n != sizeof(reg_shift))
 		reg_shift = 0;
+	else
+		reg_shift = be32_to_cpu(reg_shift);
 
 	scdp->open = ns16550_open;
 	scdp->putc = ns16550_putc;

From 57ea78fdc79aba8c7f1a435d15392dd424920f2b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
Date: Mon, 21 Jun 2021 14:21:47 +0200
Subject: [PATCH 2466/2658] backlight: lm3630a: Fix return code of
 .update_status() callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit b9481a667a90ec739995e85f91f3672ca44d6ffa ]

According to <linux/backlight.h> .update_status() is supposed to
return 0 on success and a negative error code otherwise. Adapt
lm3630a_bank_a_update_status() and lm3630a_bank_b_update_status() to
actually do it.

While touching that also add the error code to the failure message.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/backlight/lm3630a_bl.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
index 5ef6f9d420a2..ab882c04f975 100644
--- a/drivers/video/backlight/lm3630a_bl.c
+++ b/drivers/video/backlight/lm3630a_bl.c
@@ -183,7 +183,7 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl)
 	if ((pwm_ctrl & LM3630A_PWM_BANK_A) != 0) {
 		lm3630a_pwm_ctrl(pchip, bl->props.brightness,
 				 bl->props.max_brightness);
-		return bl->props.brightness;
+		return 0;
 	}
 
 	/* disable sleep */
@@ -203,8 +203,8 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl)
 	return 0;
 
 out_i2c_err:
-	dev_err(pchip->dev, "i2c failed to access\n");
-	return bl->props.brightness;
+	dev_err(pchip->dev, "i2c failed to access (%pe)\n", ERR_PTR(ret));
+	return ret;
 }
 
 static int lm3630a_bank_a_get_brightness(struct backlight_device *bl)
@@ -260,7 +260,7 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl)
 	if ((pwm_ctrl & LM3630A_PWM_BANK_B) != 0) {
 		lm3630a_pwm_ctrl(pchip, bl->props.brightness,
 				 bl->props.max_brightness);
-		return bl->props.brightness;
+		return 0;
 	}
 
 	/* disable sleep */
@@ -280,8 +280,8 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl)
 	return 0;
 
 out_i2c_err:
-	dev_err(pchip->dev, "i2c failed to access REG_CTRL\n");
-	return bl->props.brightness;
+	dev_err(pchip->dev, "i2c failed to access (%pe)\n", ERR_PTR(ret));
+	return ret;
 }
 
 static int lm3630a_bank_b_get_brightness(struct backlight_device *bl)

From 0888f66360f9b483e213d8f9b6ff52104807f780 Mon Sep 17 00:00:00 2001
From: Jiajun Cao <jjcao20@fudan.edu.cn>
Date: Tue, 22 Jun 2021 21:19:42 +0800
Subject: [PATCH 2467/2658] ALSA: hda: Add IRQ check for platform_get_irq()

[ Upstream commit 8c13212443230d03ff25014514ec0d53498c0912 ]

The function hda_tegra_first_init() neglects to check the return
value after executing platform_get_irq().

hda_tegra_first_init() should check the return value (if negative
error number) for errors so as to not pass a negative value to
the devm_request_irq().

Fix it by adding a check for the return value irq_id.

Signed-off-by: Jiajun Cao <jjcao20@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Reviewed-by: Thierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20210622131947.94346-1-jjcao20@fudan.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/hda/hda_tegra.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c
index 039fbbb1e53c..89359a962e47 100644
--- a/sound/pci/hda/hda_tegra.c
+++ b/sound/pci/hda/hda_tegra.c
@@ -363,6 +363,9 @@ static int hda_tegra_first_init(struct azx *chip, struct platform_device *pdev)
 	unsigned short gcap;
 	int irq_id = platform_get_irq(pdev, 0);
 
+	if (irq_id < 0)
+		return irq_id;
+
 	err = hda_tegra_init_chip(chip, pdev);
 	if (err)
 		return err;

From 7508e376ceff51e817b983a221b04a19f5c7eea8 Mon Sep 17 00:00:00 2001
From: Dimitri John Ledkov <dimitri.ledkov@canonical.com>
Date: Wed, 30 Jun 2021 18:56:16 -0700
Subject: [PATCH 2468/2658] lib/decompress_unlz4.c: correctly handle
 zero-padding around initrds.

[ Upstream commit 2c484419efc09e7234c667aa72698cb79ba8d8ed ]

lz4 compatible decompressor is simple.  The format is underspecified and
relies on EOF notification to determine when to stop.  Initramfs buffer
format[1] explicitly states that it can have arbitrary number of zero
padding.  Thus when operating without a fill function, be extra careful to
ensure that sizes less than 4, or apperantly empty chunksizes are treated
as EOF.

To test this I have created two cpio initrds, first a normal one,
main.cpio.  And second one with just a single /test-file with content
"second" second.cpio.  Then i compressed both of them with gzip, and with
lz4 -l.  Then I created a padding of 4 bytes (dd if=/dev/zero of=pad4 bs=1
count=4).  To create four testcase initrds:

 1) main.cpio.gzip + extra.cpio.gzip = pad0.gzip
 2) main.cpio.lz4  + extra.cpio.lz4 = pad0.lz4
 3) main.cpio.gzip + pad4 + extra.cpio.gzip = pad4.gzip
 4) main.cpio.lz4  + pad4 + extra.cpio.lz4 = pad4.lz4

The pad4 test-cases replicate the initrd load by grub, as it pads and
aligns every initrd it loads.

All of the above boot, however /test-file was not accessible in the initrd
for the testcase #4, as decoding in lz4 decompressor failed.  Also an
error message printed which usually is harmless.

Whith a patched kernel, all of the above testcases now pass, and
/test-file is accessible.

This fixes lz4 initrd decompress warning on every boot with grub.  And
more importantly this fixes inability to load multiple lz4 compressed
initrds with grub.  This patch has been shipping in Ubuntu kernels since
January 2021.

[1] ./Documentation/driver-api/early-userspace/buffer-format.rst

BugLink: https://bugs.launchpad.net/bugs/1835660
Link: https://lore.kernel.org/lkml/20210114200256.196589-1-xnox@ubuntu.com/ # v0
Link: https://lkml.kernel.org/r/20210513104831.432975-1-dimitri.ledkov@canonical.com
Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@canonical.com>
Cc: Kyungsik Lee <kyungsik.lee@lge.com>
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: Bongkyu Kim <bongkyu.kim@lge.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Sven Schmidt <4sschmid@informatik.uni-hamburg.de>
Cc: Rajat Asthana <thisisrast7@gmail.com>
Cc: Nick Terrell <terrelln@fb.com>
Cc: Gao Xiang <hsiangkao@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/decompress_unlz4.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/decompress_unlz4.c b/lib/decompress_unlz4.c
index 036fc882cd72..f1449244fdd4 100644
--- a/lib/decompress_unlz4.c
+++ b/lib/decompress_unlz4.c
@@ -115,6 +115,9 @@ STATIC inline int INIT unlz4(u8 *input, long in_len,
 				error("data corrupted");
 				goto exit_2;
 			}
+		} else if (size < 4) {
+			/* empty or end-of-file */
+			goto exit_3;
 		}
 
 		chunksize = get_unaligned_le32(inp);
@@ -128,6 +131,10 @@ STATIC inline int INIT unlz4(u8 *input, long in_len,
 			continue;
 		}
 
+		if (!fill && chunksize == 0) {
+			/* empty or end-of-file */
+			goto exit_3;
+		}
 
 		if (posp)
 			*posp += 4;
@@ -184,6 +191,7 @@ STATIC inline int INIT unlz4(u8 *input, long in_len,
 		}
 	}
 
+exit_3:
 	ret = 0;
 exit_2:
 	if (!input)

From f0698a04bdda5758294c77f47613d8b8b85cef47 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
Date: Wed, 28 Apr 2021 11:05:24 +0200
Subject: [PATCH 2469/2658] pwm: spear: Don't modify HW state in .remove
 callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit b601a18f12383001e7a8da238de7ca1559ebc450 ]

A consumer is expected to disable a PWM before calling pwm_put(). And if
they didn't there is hopefully a good reason (or the consumer needs
fixing). Also if disabling an enabled PWM was the right thing to do,
this should better be done in the framework instead of in each low level
driver.

So drop the hardware modification from the .remove() callback.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-spear.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/pwm/pwm-spear.c b/drivers/pwm/pwm-spear.c
index 6c6b44fd3f43..2d11ac277de8 100644
--- a/drivers/pwm/pwm-spear.c
+++ b/drivers/pwm/pwm-spear.c
@@ -231,10 +231,6 @@ static int spear_pwm_probe(struct platform_device *pdev)
 static int spear_pwm_remove(struct platform_device *pdev)
 {
 	struct spear_pwm_chip *pc = platform_get_drvdata(pdev);
-	int i;
-
-	for (i = 0; i < NUM_PWM; i++)
-		pwm_disable(&pc->chip.pwms[i]);
 
 	/* clk was prepared in probe, hence unprepare it here */
 	clk_unprepare(pc->clk);

From 62d620c9f52f581cc40b78357d57817d50efe27b Mon Sep 17 00:00:00 2001
From: Linus Walleij <linus.walleij@linaro.org>
Date: Sun, 23 May 2021 00:50:41 +0200
Subject: [PATCH 2470/2658] power: supply: ab8500: Avoid NULL pointers

[ Upstream commit 5bcb5087c9dd3dca1ff0ebd8002c5313c9332b56 ]

Sometimes the code will crash because we haven't enabled
AC or USB charging and thus not created the corresponding
psy device. Fix it by checking that it is there before
notifying.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/ab8500_charger.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/drivers/power/ab8500_charger.c b/drivers/power/ab8500_charger.c
index e388171f4e58..98724c3a28e5 100644
--- a/drivers/power/ab8500_charger.c
+++ b/drivers/power/ab8500_charger.c
@@ -409,6 +409,14 @@ static void ab8500_enable_disable_sw_fallback(struct ab8500_charger *di,
 static void ab8500_power_supply_changed(struct ab8500_charger *di,
 					struct power_supply *psy)
 {
+	/*
+	 * This happens if we get notifications or interrupts and
+	 * the platform has been configured not to support one or
+	 * other type of charging.
+	 */
+	if (!psy)
+		return;
+
 	if (di->autopower_cfg) {
 		if (!di->usb.charger_connected &&
 		    !di->ac.charger_connected &&
@@ -435,7 +443,15 @@ static void ab8500_charger_set_usb_connected(struct ab8500_charger *di,
 		if (!connected)
 			di->flags.vbus_drop_end = false;
 
-		sysfs_notify(&di->usb_chg.psy->dev.kobj, NULL, "present");
+		/*
+		 * Sometimes the platform is configured not to support
+		 * USB charging and no psy has been created, but we still
+		 * will get these notifications.
+		 */
+		if (di->usb_chg.psy) {
+			sysfs_notify(&di->usb_chg.psy->dev.kobj, NULL,
+				     "present");
+		}
 
 		if (connected) {
 			mutex_lock(&di->charger_attached_mutex);

From f208dd38ed29d67edec35c44d49de5854fc91af0 Mon Sep 17 00:00:00 2001
From: Bixuan Cui <cuibixuan@huawei.com>
Date: Sat, 8 May 2021 11:14:59 +0800
Subject: [PATCH 2471/2658] power: reset: gpio-poweroff: add missing
 MODULE_DEVICE_TABLE

[ Upstream commit ed3443fb4df4e140a22f65144546c8a8e1e27f4e ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this driver when it is built
as an external module.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Bixuan Cui <cuibixuan@huawei.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/reset/gpio-poweroff.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/power/reset/gpio-poweroff.c b/drivers/power/reset/gpio-poweroff.c
index be3d81ff51cc..a44e3427fdeb 100644
--- a/drivers/power/reset/gpio-poweroff.c
+++ b/drivers/power/reset/gpio-poweroff.c
@@ -84,6 +84,7 @@ static const struct of_device_id of_gpio_poweroff_match[] = {
 	{ .compatible = "gpio-poweroff", },
 	{},
 };
+MODULE_DEVICE_TABLE(of, of_gpio_poweroff_match);
 
 static struct platform_driver gpio_poweroff_driver = {
 	.probe = gpio_poweroff_probe,

From a9c399d68b30a37e4cfd0ff777bd7baa312a7d5b Mon Sep 17 00:00:00 2001
From: Nick Desaulniers <ndesaulniers@google.com>
Date: Tue, 1 Jun 2021 20:29:26 +0100
Subject: [PATCH 2472/2658] ARM: 9087/1: kprobes: test-thumb: fix for
 LLVM_IAS=1

[ Upstream commit 8b95a7d90ce8160ac5cffd5bace6e2eba01a871e ]

There's a few instructions that GAS infers operands but Clang doesn't;
from what I can tell the Arm ARM doesn't say these are optional.

F5.1.257 TBB, TBH T1 Halfword variant
F5.1.238 STREXD T1 variant
F5.1.84 LDREXD T1 variant

Link: https://github.com/ClangBuiltLinux/linux/issues/1309

Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Jian Cai <jiancai@google.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/probes/kprobes/test-thumb.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/arch/arm/probes/kprobes/test-thumb.c b/arch/arm/probes/kprobes/test-thumb.c
index b683b4517458..4254391f3906 100644
--- a/arch/arm/probes/kprobes/test-thumb.c
+++ b/arch/arm/probes/kprobes/test-thumb.c
@@ -444,21 +444,21 @@ void kprobe_thumb32_test_cases(void)
 		"3:	mvn	r0, r0	\n\t"
 		"2:	nop		\n\t")
 
-	TEST_RX("tbh	[pc, r",7, (9f-(1f+4))>>1,"]",
+	TEST_RX("tbh	[pc, r",7, (9f-(1f+4))>>1,", lsl #1]",
 		"9:			\n\t"
 		".short	(2f-1b-4)>>1	\n\t"
 		".short	(3f-1b-4)>>1	\n\t"
 		"3:	mvn	r0, r0	\n\t"
 		"2:	nop		\n\t")
 
-	TEST_RX("tbh	[pc, r",12, ((9f-(1f+4))>>1)+1,"]",
+	TEST_RX("tbh	[pc, r",12, ((9f-(1f+4))>>1)+1,", lsl #1]",
 		"9:			\n\t"
 		".short	(2f-1b-4)>>1	\n\t"
 		".short	(3f-1b-4)>>1	\n\t"
 		"3:	mvn	r0, r0	\n\t"
 		"2:	nop		\n\t")
 
-	TEST_RRX("tbh	[r",1,9f, ", r",14,1,"]",
+	TEST_RRX("tbh	[r",1,9f, ", r",14,1,", lsl #1]",
 		"9:			\n\t"
 		".short	(2f-1b-4)>>1	\n\t"
 		".short	(3f-1b-4)>>1	\n\t"
@@ -471,10 +471,10 @@ void kprobe_thumb32_test_cases(void)
 
 	TEST_UNSUPPORTED("strexb	r0, r1, [r2]")
 	TEST_UNSUPPORTED("strexh	r0, r1, [r2]")
-	TEST_UNSUPPORTED("strexd	r0, r1, [r2]")
+	TEST_UNSUPPORTED("strexd	r0, r1, r2, [r2]")
 	TEST_UNSUPPORTED("ldrexb	r0, [r1]")
 	TEST_UNSUPPORTED("ldrexh	r0, [r1]")
-	TEST_UNSUPPORTED("ldrexd	r0, [r1]")
+	TEST_UNSUPPORTED("ldrexd	r0, r1, [r1]")
 
 	TEST_GROUP("Data-processing (shifted register) and (modified immediate)")
 

From 9c1d7e35fda9e7efdd3e62a42a35b53363ef8f73 Mon Sep 17 00:00:00 2001
From: Zou Wei <zou_wei@huawei.com>
Date: Tue, 11 May 2021 15:01:35 +0800
Subject: [PATCH 2473/2658] watchdog: Fix possible use-after-free in
 wdt_startup()

[ Upstream commit c08a6b31e4917034f0ed0cb457c3bb209576f542 ]

This module's remove path calls del_timer(). However, that function
does not wait until the timer handler finishes. This means that the
timer handler may still be running after the driver's remove function
has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler
has finished, and unable to re-schedule itself.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/1620716495-108352-1-git-send-email-zou_wei@huawei.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/sbc60xxwdt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/watchdog/sbc60xxwdt.c b/drivers/watchdog/sbc60xxwdt.c
index 2eef58a0cf05..152db059d5aa 100644
--- a/drivers/watchdog/sbc60xxwdt.c
+++ b/drivers/watchdog/sbc60xxwdt.c
@@ -152,7 +152,7 @@ static void wdt_startup(void)
 static void wdt_turnoff(void)
 {
 	/* Stop the timer */
-	del_timer(&timer);
+	del_timer_sync(&timer);
 	inb_p(wdt_stop);
 	pr_info("Watchdog timer is now disabled...\n");
 }

From e86af033b62b78e10eead3ea93c105535d04511d Mon Sep 17 00:00:00 2001
From: Zou Wei <zou_wei@huawei.com>
Date: Tue, 11 May 2021 15:04:51 +0800
Subject: [PATCH 2474/2658] watchdog: sc520_wdt: Fix possible use-after-free in
 wdt_turnoff()

[ Upstream commit 90b7c141132244e8e49a34a4c1e445cce33e07f4 ]

This module's remove path calls del_timer(). However, that function
does not wait until the timer handler finishes. This means that the
timer handler may still be running after the driver's remove function
has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler
has finished, and unable to re-schedule itself.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/1620716691-108460-1-git-send-email-zou_wei@huawei.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/sc520_wdt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/watchdog/sc520_wdt.c b/drivers/watchdog/sc520_wdt.c
index 1cfd3f6a13d5..08500db8324f 100644
--- a/drivers/watchdog/sc520_wdt.c
+++ b/drivers/watchdog/sc520_wdt.c
@@ -190,7 +190,7 @@ static int wdt_startup(void)
 static int wdt_turnoff(void)
 {
 	/* Stop the timer */
-	del_timer(&timer);
+	del_timer_sync(&timer);
 
 	/* Stop the watchdog */
 	wdt_config(0);

From 3ff8c702094abc7903e21a0a252aed33b48b78f7 Mon Sep 17 00:00:00 2001
From: Zou Wei <zou_wei@huawei.com>
Date: Wed, 12 May 2021 14:57:56 +0800
Subject: [PATCH 2475/2658] watchdog: Fix possible use-after-free by calling
 del_timer_sync()

[ Upstream commit d0212f095ab56672f6f36aabc605bda205e1e0bf ]

This driver's remove path calls del_timer(). However, that function
does not wait until the timer handler finishes. This means that the
timer handler may still be running after the driver's remove function
has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler
has finished, and unable to re-schedule itself.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Vladimir Zapolskiy <vz@mleia.com>
Link: https://lore.kernel.org/r/1620802676-19701-1-git-send-email-zou_wei@huawei.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/lpc18xx_wdt.c | 2 +-
 drivers/watchdog/w83877f_wdt.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/watchdog/lpc18xx_wdt.c b/drivers/watchdog/lpc18xx_wdt.c
index ab7b8b185d99..fbdc0f32e666 100644
--- a/drivers/watchdog/lpc18xx_wdt.c
+++ b/drivers/watchdog/lpc18xx_wdt.c
@@ -309,7 +309,7 @@ static int lpc18xx_wdt_remove(struct platform_device *pdev)
 	unregister_restart_handler(&lpc18xx_wdt->restart_handler);
 
 	dev_warn(&pdev->dev, "I quit now, hardware will probably reboot!\n");
-	del_timer(&lpc18xx_wdt->timer);
+	del_timer_sync(&lpc18xx_wdt->timer);
 
 	watchdog_unregister_device(&lpc18xx_wdt->wdt_dev);
 	clk_disable_unprepare(lpc18xx_wdt->wdt_clk);
diff --git a/drivers/watchdog/w83877f_wdt.c b/drivers/watchdog/w83877f_wdt.c
index f0483c75ed32..4b52cf321747 100644
--- a/drivers/watchdog/w83877f_wdt.c
+++ b/drivers/watchdog/w83877f_wdt.c
@@ -170,7 +170,7 @@ static void wdt_startup(void)
 static void wdt_turnoff(void)
 {
 	/* Stop the timer */
-	del_timer(&timer);
+	del_timer_sync(&timer);
 
 	wdt_change(WDT_DISABLE);
 

From 53fceebdae9377f7540bf4b5c577470bddc21756 Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@kernel.org>
Date: Tue, 4 May 2021 10:08:30 -0400
Subject: [PATCH 2476/2658] ceph: remove bogus checks and WARN_ONs from
 ceph_set_page_dirty

[ Upstream commit 22d41cdcd3cfd467a4af074165357fcbea1c37f5 ]

The checks for page->mapping are odd, as set_page_dirty is an
address_space operation, and I don't see where it would be called on a
non-pagecache page.

The warning about the page lock also seems bogus.  The comment over
set_page_dirty() says that it can be called without the page lock in
some rare cases. I don't think we want to warn if that's the case.

Reported-by: Matthew Wilcox <willy@infradead.org>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/addr.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index fbf383048409..26de74684c17 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -72,10 +72,6 @@ static int ceph_set_page_dirty(struct page *page)
 	struct inode *inode;
 	struct ceph_inode_info *ci;
 	struct ceph_snap_context *snapc;
-	int ret;
-
-	if (unlikely(!mapping))
-		return !TestSetPageDirty(page);
 
 	if (PageDirty(page)) {
 		dout("%p set_page_dirty %p idx %lu -- already dirty\n",
@@ -121,11 +117,7 @@ static int ceph_set_page_dirty(struct page *page)
 	page->private = (unsigned long)snapc;
 	SetPagePrivate(page);
 
-	ret = __set_page_dirty_nobuffers(page);
-	WARN_ON(!PageLocked(page));
-	WARN_ON(!page->mapping);
-
-	return ret;
+	return __set_page_dirty_nobuffers(page);
 }
 
 /*

From c0f3cd1838baf762f9801bc3072911fa617ed84d Mon Sep 17 00:00:00 2001
From: Zou Wei <zou_wei@huawei.com>
Date: Sat, 5 Jun 2021 09:21:54 +0800
Subject: [PATCH 2477/2658] power: supply: charger-manager: add missing
 MODULE_DEVICE_TABLE

[ Upstream commit 073b5d5b1f9cc94a3eea25279fbafee3f4f5f097 ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this driver when it is built
as an external module.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/charger-manager.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/power/charger-manager.c b/drivers/power/charger-manager.c
index 1ea5d1aa268b..6656f847ed93 100644
--- a/drivers/power/charger-manager.c
+++ b/drivers/power/charger-manager.c
@@ -1490,6 +1490,7 @@ static const struct of_device_id charger_manager_match[] = {
 	},
 	{},
 };
+MODULE_DEVICE_TABLE(of, charger_manager_match);
 
 static struct charger_desc *of_cm_parse_desc(struct device *dev)
 {

From 0e49b86bc89df3f8e87676b2ffbbcb0d5fa34595 Mon Sep 17 00:00:00 2001
From: Zou Wei <zou_wei@huawei.com>
Date: Sat, 5 Jun 2021 09:21:41 +0800
Subject: [PATCH 2478/2658] power: supply: ab8500: add missing
 MODULE_DEVICE_TABLE

[ Upstream commit dfe52db13ab8d24857a9840ec7ca75eef800c26c ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this driver when it is built
as an external module.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/ab8500_btemp.c   | 1 +
 drivers/power/ab8500_charger.c | 1 +
 drivers/power/ab8500_fg.c      | 1 +
 3 files changed, 3 insertions(+)

diff --git a/drivers/power/ab8500_btemp.c b/drivers/power/ab8500_btemp.c
index 8f8044e1acf3..24732df01cf9 100644
--- a/drivers/power/ab8500_btemp.c
+++ b/drivers/power/ab8500_btemp.c
@@ -1186,6 +1186,7 @@ static const struct of_device_id ab8500_btemp_match[] = {
 	{ .compatible = "stericsson,ab8500-btemp", },
 	{ },
 };
+MODULE_DEVICE_TABLE(of, ab8500_btemp_match);
 
 static struct platform_driver ab8500_btemp_driver = {
 	.probe = ab8500_btemp_probe,
diff --git a/drivers/power/ab8500_charger.c b/drivers/power/ab8500_charger.c
index 98724c3a28e5..1a7013ec0caf 100644
--- a/drivers/power/ab8500_charger.c
+++ b/drivers/power/ab8500_charger.c
@@ -3756,6 +3756,7 @@ static const struct of_device_id ab8500_charger_match[] = {
 	{ .compatible = "stericsson,ab8500-charger", },
 	{ },
 };
+MODULE_DEVICE_TABLE(of, ab8500_charger_match);
 
 static struct platform_driver ab8500_charger_driver = {
 	.probe = ab8500_charger_probe,
diff --git a/drivers/power/ab8500_fg.c b/drivers/power/ab8500_fg.c
index d91111200dde..c58b496ca05a 100644
--- a/drivers/power/ab8500_fg.c
+++ b/drivers/power/ab8500_fg.c
@@ -3239,6 +3239,7 @@ static const struct of_device_id ab8500_fg_match[] = {
 	{ .compatible = "stericsson,ab8500-fg", },
 	{ },
 };
+MODULE_DEVICE_TABLE(of, ab8500_fg_match);
 
 static struct platform_driver ab8500_fg_driver = {
 	.probe = ab8500_fg_probe,

From 38398105467797e1c9b5d1bb4086a60b6b8b8ccc Mon Sep 17 00:00:00 2001
From: Xie Yongji <xieyongji@bytedance.com>
Date: Mon, 17 May 2021 16:43:32 +0800
Subject: [PATCH 2479/2658] virtio-blk: Fix memory leak among suspend/resume
 procedure

[ Upstream commit b71ba22e7c6c6b279c66f53ee7818709774efa1f ]

The vblk->vqs should be freed before we call init_vqs()
in virtblk_restore().

Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
Link: https://lore.kernel.org/r/20210517084332.280-1-xieyongji@bytedance.com
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/virtio_blk.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index bdc3efacd0d2..2bcc2bc64149 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -808,6 +808,8 @@ static int virtblk_freeze(struct virtio_device *vdev)
 	blk_mq_stop_hw_queues(vblk->disk->queue);
 
 	vdev->config->del_vqs(vdev);
+	kfree(vblk->vqs);
+
 	return 0;
 }
 

From 71422225e3506160950ed9758475aae87c3ec6f7 Mon Sep 17 00:00:00 2001
From: Xie Yongji <xieyongji@bytedance.com>
Date: Tue, 25 May 2021 20:56:22 +0800
Subject: [PATCH 2480/2658] virtio_console: Assure used length from device is
 limited

[ Upstream commit d00d8da5869a2608e97cfede094dfc5e11462a46 ]

The buf->len might come from an untrusted device. This
ensures the value would not exceed the size of the buffer
to avoid data corruption or loss.

Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/20210525125622.1203-1-xieyongji@bytedance.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/virtio_console.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 226ccb7891d4..c2f1c921cb2c 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -487,7 +487,7 @@ static struct port_buffer *get_inbuf(struct port *port)
 
 	buf = virtqueue_get_buf(port->in_vq, &len);
 	if (buf) {
-		buf->len = len;
+		buf->len = min_t(size_t, len, buf->size);
 		buf->offset = 0;
 		port->stats.bytes_received += len;
 	}
@@ -1752,7 +1752,7 @@ static void control_work_handler(struct work_struct *work)
 	while ((buf = virtqueue_get_buf(vq, &len))) {
 		spin_unlock(&portdev->c_ivq_lock);
 
-		buf->len = len;
+		buf->len = min_t(size_t, len, buf->size);
 		buf->offset = 0;
 
 		handle_control_message(vq->vdev, portdev, buf);

From b34927083f90db0a58a5d1ad0956b63e4fdf9305 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= <kw@linux.com>
Date: Thu, 3 Jun 2021 00:01:12 +0000
Subject: [PATCH 2481/2658] PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer
 overrun
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit bdcdaa13ad96f1a530711c29e6d4b8311eff767c ]

"utf16s_to_utf8s(..., buf, PAGE_SIZE)" puts up to PAGE_SIZE bytes into
"buf" and returns the number of bytes it actually put there.  If it wrote
PAGE_SIZE bytes, the newline added by dsm_label_utf16s_to_utf8s() would
overrun "buf".

Reduce the size available for utf16s_to_utf8s() to use so there is always
space for the newline.

[bhelgaas: reorder patch in series, commit log]
Fixes: 6058989bad05 ("PCI: Export ACPI _DSM provided firmware instance number and string name to sysfs")
Link: https://lore.kernel.org/r/20210603000112.703037-7-kw@linux.com
Reported-by: Joe Perches <joe@perches.com>
Signed-off-by: Krzysztof Wilczyński <kw@linux.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci-label.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/pci-label.c b/drivers/pci/pci-label.c
index 024b5c179348..7d200a88cd74 100644
--- a/drivers/pci/pci-label.c
+++ b/drivers/pci/pci-label.c
@@ -157,7 +157,7 @@ static void dsm_label_utf16s_to_utf8s(union acpi_object *obj, char *buf)
 	len = utf16s_to_utf8s((const wchar_t *)obj->buffer.pointer,
 			      obj->buffer.length,
 			      UTF16_LITTLE_ENDIAN,
-			      buf, PAGE_SIZE);
+			      buf, PAGE_SIZE - 1);
 	buf[len] = '\n';
 }
 

From c9fd13d70e2af813bb6c3bf403ffbecad38c9019 Mon Sep 17 00:00:00 2001
From: Zhen Lei <thunder.leizhen@huawei.com>
Date: Sat, 8 May 2021 11:13:54 +0800
Subject: [PATCH 2482/2658] um: fix error return code in slip_open()

[ Upstream commit b77e81fbe5f5fb4ad9a61ec80f6d1e30b6da093a ]

Fix to return a negative error code from the error handling case instead
of 0, as done elsewhere in this function.

Fixes: a3c77c67a443 ("[PATCH] uml: slirp and slip driver cleanups and fixes")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Acked-By: anton.ivanov@cambridgegreys.com
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/um/drivers/slip_user.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/um/drivers/slip_user.c b/arch/um/drivers/slip_user.c
index 0d6b66c64a81..76d155631c5d 100644
--- a/arch/um/drivers/slip_user.c
+++ b/arch/um/drivers/slip_user.c
@@ -145,7 +145,8 @@ static int slip_open(void *data)
 	}
 	sfd = err;
 
-	if (set_up_tty(sfd))
+	err = set_up_tty(sfd);
+	if (err)
 		goto out_close2;
 
 	pri->slave = sfd;

From 552e2ac214a462414602adc1e4bcd415af0a67fa Mon Sep 17 00:00:00 2001
From: Zhen Lei <thunder.leizhen@huawei.com>
Date: Sat, 8 May 2021 11:22:39 +0800
Subject: [PATCH 2483/2658] um: fix error return code in winch_tramp()

[ Upstream commit ccf1236ecac476d9d2704866d9a476c86e387971 ]

Fix to return a negative error code from the error handling case instead
of 0, as done elsewhere in this function.

Fixes: 89df6bfc0405 ("uml: DEBUG_SHIRQ fixes")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Acked-By: anton.ivanov@cambridgegreys.com
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/um/drivers/chan_user.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/um/drivers/chan_user.c b/arch/um/drivers/chan_user.c
index 3fd7c3efdb18..feb7f5ab4084 100644
--- a/arch/um/drivers/chan_user.c
+++ b/arch/um/drivers/chan_user.c
@@ -256,7 +256,8 @@ static int winch_tramp(int fd, struct tty_port *port, int *fd_out,
 		goto out_close;
 	}
 
-	if (os_set_fd_block(*fd_out, 0)) {
+	err = os_set_fd_block(*fd_out, 0);
+	if (err) {
 		printk(UM_KERN_ERR "winch_tramp: failed to set thread_fd "
 		       "non-blocking.\n");
 		goto out_close;

From 9a8cd3ee7e07111d3b4d8a62a3d60ce9f28e3d77 Mon Sep 17 00:00:00 2001
From: Gao Xiang <hsiangkao@linux.alibaba.com>
Date: Fri, 18 Jun 2021 12:20:55 +0800
Subject: [PATCH 2484/2658] nfs: fix acl memory leak of posix_acl_create()

[ Upstream commit 1fcb6fcd74a222d9ead54d405842fc763bb86262 ]

When looking into another nfs xfstests report, I found acl and
default_acl in nfs3_proc_create() and nfs3_proc_mknod() error
paths are possibly leaked. Fix them in advance.

Fixes: 013cdf1088d7 ("nfs: use generic posix ACL infrastructure for v3 Posix ACLs")
Cc: Trond Myklebust <trond.myklebust@hammerspace.com>
Cc: Anna Schumaker <anna.schumaker@netapp.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs3proc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index cb28cceefebe..9f365b004453 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -363,7 +363,7 @@ nfs3_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
 				break;
 
 			case NFS3_CREATE_UNCHECKED:
-				goto out;
+				goto out_release_acls;
 		}
 		nfs_fattr_init(data->res.dir_attr);
 		nfs_fattr_init(data->res.fattr);
@@ -708,7 +708,7 @@ nfs3_proc_mknod(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
 		break;
 	default:
 		status = -EINVAL;
-		goto out;
+		goto out_release_acls;
 	}
 
 	status = nfs3_do_create(dir, dentry, data);

From 7a21a547972542d5eaba753e898ab7b013da4baa Mon Sep 17 00:00:00 2001
From: Zhen Lei <thunder.leizhen@huawei.com>
Date: Wed, 7 Jul 2021 15:40:51 +0800
Subject: [PATCH 2485/2658] ALSA: isa: Fix error return code in
 snd_cmi8330_probe()

[ Upstream commit 31028cbed26a8afa25533a10425ffa2ab794c76c ]

When 'SB_HW_16' check fails, the error code -ENODEV instead of 0 should be
returned, which is the same as that returned when 'WSS_HW_CMI8330' check
fails.

Fixes: 43bcd973d6d0 ("[ALSA] Add snd_card_set_generic_dev() call to ISA drivers")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Link: https://lore.kernel.org/r/20210707074051.2663-1-thunder.leizhen@huawei.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/isa/cmi8330.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/isa/cmi8330.c b/sound/isa/cmi8330.c
index dfedfd85f205..463906882b95 100644
--- a/sound/isa/cmi8330.c
+++ b/sound/isa/cmi8330.c
@@ -564,7 +564,7 @@ static int snd_cmi8330_probe(struct snd_card *card, int dev)
 	}
 	if (acard->sb->hardware != SB_HW_16) {
 		snd_printk(KERN_ERR PFX "SB16 not found during probe\n");
-		return err;
+		return -ENODEV;
 	}
 
 	snd_wss_out(acard->wss, CS4231_MISC_INFO, 0x40); /* switch on MODE2 */

From 28f2230a790a1346c3ce6c7730ff85c636c7edc9 Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <nathan@kernel.org>
Date: Wed, 7 Jul 2021 18:07:41 -0700
Subject: [PATCH 2486/2658] hexagon: use common DISCARDS macro

[ Upstream commit 681ba73c72302214686401e707e2087ed11a6556 ]

ld.lld warns that the '.modinfo' section is not currently handled:

ld.lld: warning: kernel/built-in.a(workqueue.o):(.modinfo) is being placed in '.modinfo'
ld.lld: warning: kernel/built-in.a(printk/printk.o):(.modinfo) is being placed in '.modinfo'
ld.lld: warning: kernel/built-in.a(irq/spurious.o):(.modinfo) is being placed in '.modinfo'
ld.lld: warning: kernel/built-in.a(rcu/update.o):(.modinfo) is being placed in '.modinfo'

The '.modinfo' section was added in commit 898490c010b5 ("moduleparam:
Save information about built-in modules in separate file") to the DISCARDS
macro but Hexagon has never used that macro.  The unification of DISCARDS
happened in commit 023bf6f1b8bf ("linker script: unify usage of discard
definition") in 2009, prior to Hexagon being added in 2011.

Switch Hexagon over to the DISCARDS macro so that anything that is
expected to be discarded gets discarded.

Link: https://lkml.kernel.org/r/20210521011239.1332345-3-nathan@kernel.org
Fixes: e95bf452a9e2 ("Hexagon: Add configuration and makefiles for the Hexagon architecture.")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Acked-by: Brian Cain <bcain@codeaurora.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Oliver Glitta <glittao@gmail.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/hexagon/kernel/vmlinux.lds.S | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/arch/hexagon/kernel/vmlinux.lds.S b/arch/hexagon/kernel/vmlinux.lds.S
index 5f268c1071b3..b5c050fe23a5 100644
--- a/arch/hexagon/kernel/vmlinux.lds.S
+++ b/arch/hexagon/kernel/vmlinux.lds.S
@@ -70,13 +70,8 @@ SECTIONS
 
 	_end = .;
 
-	/DISCARD/ : {
-		EXIT_TEXT
-		EXIT_DATA
-		EXIT_CALL
-	}
-
 	STABS_DEBUG
 	DWARF_DEBUG
 
+	DISCARDS
 }

From b125a8d9a46bfaf644c7c10cb459eda9d0071fda Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Date: Wed, 5 May 2021 09:59:41 -0400
Subject: [PATCH 2487/2658] ARM: dts: exynos: fix PWM LED max brightness on
 Odroid XU4

[ Upstream commit fd2f1717966535b7d0b6fe45cf0d79e94330da5f ]

There is no "max_brightness" property as pointed out by dtschema:

  arch/arm/boot/dts/exynos5422-odroidxu4.dt.yaml: led-controller: led-1: 'max-brightness' is a required property

Fixes: 6658356014cb ("ARM: dts: Add support Odroid XU4 board for exynos5422-odroidxu4")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Link: https://lore.kernel.org/r/20210505135941.59898-5-krzysztof.kozlowski@canonical.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/exynos5422-odroidxu4.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/exynos5422-odroidxu4.dts b/arch/arm/boot/dts/exynos5422-odroidxu4.dts
index 2faf88627a48..b45e2a0c3908 100644
--- a/arch/arm/boot/dts/exynos5422-odroidxu4.dts
+++ b/arch/arm/boot/dts/exynos5422-odroidxu4.dts
@@ -26,7 +26,7 @@
 			label = "blue:heartbeat";
 			pwms = <&pwm 2 2000000 0>;
 			pwm-names = "pwm2";
-			max_brightness = <255>;
+			max-brightness = <255>;
 			linux,default-trigger = "heartbeat";
 		};
 	};

From 993a3f051f30ebaf6f87d7405e51f934b9265a57 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 11 May 2021 10:19:26 +0300
Subject: [PATCH 2488/2658] rtc: fix snprintf() checking in is_rtc_hctosys()

[ Upstream commit 54b909436ede47e0ee07f1765da27ec2efa41e84 ]

The scnprintf() function silently truncates the printf() and returns
the number bytes that it was able to copy (not counting the NUL
terminator).  Thus, the highest value it can return here is
"NAME_SIZE - 1" and the overflow check is dead code.  Fix this by
using the snprintf() function which returns the number of bytes that
would have been copied if there was enough space and changing the
condition from "> NAME_SIZE" to ">= NAME_SIZE".

Fixes: 92589c986b33 ("rtc-proc: permit the /proc/driver/rtc device to use other devices")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/YJov/pcGmhLi2pEl@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-proc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/rtc/rtc-proc.c b/drivers/rtc/rtc-proc.c
index ffa69e1c9245..4f10cb1561cc 100644
--- a/drivers/rtc/rtc-proc.c
+++ b/drivers/rtc/rtc-proc.c
@@ -26,8 +26,8 @@ static bool is_rtc_hctosys(struct rtc_device *rtc)
 	int size;
 	char name[NAME_SIZE];
 
-	size = scnprintf(name, NAME_SIZE, "rtc%d", rtc->id);
-	if (size > NAME_SIZE)
+	size = snprintf(name, NAME_SIZE, "rtc%d", rtc->id);
+	if (size >= NAME_SIZE)
 		return false;
 
 	return !strncmp(name, CONFIG_RTC_HCTOSYS_DEVICE, NAME_SIZE);

From 33208df29730d1608c281a1e72e173da591cfbf5 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Date: Thu, 27 May 2021 11:43:21 -0400
Subject: [PATCH 2489/2658] memory: fsl_ifc: fix leak of IO mapping on probe
 failure

[ Upstream commit 3b132ab67fc7a358fff35e808fa65d4bea452521 ]

On probe error the driver should unmap the IO memory.  Smatch reports:

  drivers/memory/fsl_ifc.c:298 fsl_ifc_ctrl_probe() warn: 'fsl_ifc_ctrl_dev->gregs' not released on lines: 298.

Fixes: a20cbdeffce2 ("powerpc/fsl: Add support for Integrated Flash Controller")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Link: https://lore.kernel.org/r/20210527154322.81253-1-krzysztof.kozlowski@canonical.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/fsl_ifc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c
index acd1460cf787..040be4638140 100644
--- a/drivers/memory/fsl_ifc.c
+++ b/drivers/memory/fsl_ifc.c
@@ -228,8 +228,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
 	fsl_ifc_ctrl_dev->regs = of_iomap(dev->dev.of_node, 0);
 	if (!fsl_ifc_ctrl_dev->regs) {
 		dev_err(&dev->dev, "failed to get memory region\n");
-		ret = -ENODEV;
-		goto err;
+		return -ENODEV;
 	}
 
 	version = ifc_in32(&fsl_ifc_ctrl_dev->regs->ifc_rev) &
@@ -306,6 +305,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
 	free_irq(fsl_ifc_ctrl_dev->irq, fsl_ifc_ctrl_dev);
 	irq_dispose_mapping(fsl_ifc_ctrl_dev->irq);
 err:
+	iounmap(fsl_ifc_ctrl_dev->gregs);
 	return ret;
 }
 

From 1a011c8e5bb54c63c5e9ccad99f01e0d8e42a198 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Date: Thu, 27 May 2021 11:43:22 -0400
Subject: [PATCH 2490/2658] memory: fsl_ifc: fix leak of private memory on
 probe failure

[ Upstream commit 8e0d09b1232d0538066c40ed4c13086faccbdff6 ]

On probe error the driver should free the memory allocated for private
structure.  Fix this by using resource-managed allocation.

Fixes: a20cbdeffce2 ("powerpc/fsl: Add support for Integrated Flash Controller")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Link: https://lore.kernel.org/r/20210527154322.81253-2-krzysztof.kozlowski@canonical.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/fsl_ifc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c
index 040be4638140..65b984d64350 100644
--- a/drivers/memory/fsl_ifc.c
+++ b/drivers/memory/fsl_ifc.c
@@ -107,7 +107,6 @@ static int fsl_ifc_ctrl_remove(struct platform_device *dev)
 	iounmap(ctrl->regs);
 
 	dev_set_drvdata(&dev->dev, NULL);
-	kfree(ctrl);
 
 	return 0;
 }
@@ -218,7 +217,8 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
 
 	dev_info(&dev->dev, "Freescale Integrated Flash Controller\n");
 
-	fsl_ifc_ctrl_dev = kzalloc(sizeof(*fsl_ifc_ctrl_dev), GFP_KERNEL);
+	fsl_ifc_ctrl_dev = devm_kzalloc(&dev->dev, sizeof(*fsl_ifc_ctrl_dev),
+					GFP_KERNEL);
 	if (!fsl_ifc_ctrl_dev)
 		return -ENOMEM;
 

From e77c9bd9c70e2451d493da69d6566b2f8597d991 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 12 Jun 2021 09:18:34 +0200
Subject: [PATCH 2491/2658] scsi: be2iscsi: Fix an error handling path in
 beiscsi_dev_probe()

[ Upstream commit 030e4138d11fced3b831c2761e4cecf347bae99c ]

If an error occurs after a pci_enable_pcie_error_reporting() call, it must
be undone by a corresponding pci_disable_pcie_error_reporting() call, as
already done in the remove function.

Link: https://lore.kernel.org/r/77adb02cfea7f1364e5603ecf3930d8597ae356e.1623482155.git.christophe.jaillet@wanadoo.fr
Fixes: 3567f36a09d1 ("[SCSI] be2iscsi: Fix AER handling in driver")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/be2iscsi/be_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index 758f76e88704..c89aab5e0ef8 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -5812,6 +5812,7 @@ static int beiscsi_dev_probe(struct pci_dev *pcidev,
 		pci_disable_msix(phba->pcidev);
 	pci_dev_put(phba->pcidev);
 	iscsi_host_free(phba->shost);
+	pci_disable_pcie_error_reporting(pcidev);
 	pci_set_drvdata(pcidev, NULL);
 disable_pci:
 	pci_release_regions(pcidev);

From 709bc4d58734640ec8654d8e06ddfe5c438b1571 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Sun, 4 Jul 2021 16:02:11 -0700
Subject: [PATCH 2492/2658] mips: disable branch profiling in boot/decompress.o

[ Upstream commit 97e488073cfca0eea84450169ca4cbfcc64e33e3 ]

Use DISABLE_BRANCH_PROFILING for arch/mips/boot/compressed/decompress.o
to prevent linkage errors.

mips64-linux-ld: arch/mips/boot/compressed/decompress.o: in function `LZ4_decompress_fast_extDict':
decompress.c:(.text+0x8c): undefined reference to `ftrace_likely_update'
mips64-linux-ld: decompress.c:(.text+0xf4): undefined reference to `ftrace_likely_update'
mips64-linux-ld: decompress.c:(.text+0x200): undefined reference to `ftrace_likely_update'
mips64-linux-ld: decompress.c:(.text+0x230): undefined reference to `ftrace_likely_update'
mips64-linux-ld: decompress.c:(.text+0x320): undefined reference to `ftrace_likely_update'
mips64-linux-ld: arch/mips/boot/compressed/decompress.o:decompress.c:(.text+0x3f4): more undefined references to `ftrace_likely_update' follow

Fixes: e76e1fdfa8f8 ("lib: add support for LZ4-compressed kernel")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: linux-mips@vger.kernel.org
Cc: Kyungsik Lee <kyungsik.lee@lge.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/boot/compressed/decompress.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c
index 080cd53bac36..a1a54a3af03b 100644
--- a/arch/mips/boot/compressed/decompress.c
+++ b/arch/mips/boot/compressed/decompress.c
@@ -11,6 +11,8 @@
  * option) any later version.
  */
 
+#define DISABLE_BRANCH_PROFILING
+
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/string.h>

From e896dcc269fcd2131a096b3fd0056828df1e908c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20F=C3=A4cknitz?= <faecknitz@hotsplots.de>
Date: Mon, 5 Jul 2021 02:03:54 +0200
Subject: [PATCH 2493/2658] MIPS: vdso: Invalid GIC access through VDSO
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 47ce8527fbba145a7723685bc9a27d9855e06491 ]

Accessing raw timers (currently only CLOCK_MONOTONIC_RAW) through VDSO
doesn't return the correct time when using the GIC as clock source.
The address of the GIC mapped page is in this case not calculated
correctly. The GIC mapped page is calculated from the VDSO data by
subtracting PAGE_SIZE:

  void *get_gic(const struct vdso_data *data) {
    return (void __iomem *)data - PAGE_SIZE;
  }

However, the data pointer is not page aligned for raw clock sources.
This is because the VDSO data for raw clock sources (CS_RAW = 1) is
stored after the VDSO data for coarse clock sources (CS_HRES_COARSE = 0).
Therefore, only the VDSO data for CS_HRES_COARSE is page aligned:

  +--------------------+
  |                    |
  | vd[CS_RAW]         | ---+
  | vd[CS_HRES_COARSE] |    |
  +--------------------+    | -PAGE_SIZE
  |                    |    |
  |  GIC mapped page   | <--+
  |                    |
  +--------------------+

When __arch_get_hw_counter() is called with &vd[CS_RAW], get_gic returns
the wrong address (somewhere inside the GIC mapped page). The GIC counter
values are not returned which results in an invalid time.

Fixes: a7f4df4e21dd ("MIPS: VDSO: Add implementations of gettimeofday() and clock_gettime()")
Signed-off-by: Martin Fäcknitz <faecknitz@hotsplots.de>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/vdso/vdso.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/vdso/vdso.h b/arch/mips/vdso/vdso.h
index cfb1be441dec..921589b45bc2 100644
--- a/arch/mips/vdso/vdso.h
+++ b/arch/mips/vdso/vdso.h
@@ -81,7 +81,7 @@ static inline const union mips_vdso_data *get_vdso_data(void)
 
 static inline void __iomem *get_gic(const union mips_vdso_data *data)
 {
-	return (void __iomem *)data - PAGE_SIZE;
+	return (void __iomem *)((unsigned long)data & PAGE_MASK) - PAGE_SIZE;
 }
 
 #endif /* CONFIG_CLKSRC_MIPS_GIC */

From 90be60b3f88675a7617dd61290f37eacc41a5cf8 Mon Sep 17 00:00:00 2001
From: Eric Sandeen <sandeen@redhat.com>
Date: Tue, 13 Jul 2021 17:49:23 +0200
Subject: [PATCH 2494/2658] seq_file: disallow extremely large seq buffer
 allocations

commit 8cae8cd89f05f6de223d63e6d15e31c8ba9cf53b upstream.

There is no reasonable need for a buffer larger than this, and it avoids
int overflow pitfalls.

Fixes: 058504edd026 ("fs/seq_file: fallback to vmalloc allocation")
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/seq_file.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/fs/seq_file.c b/fs/seq_file.c
index a4c95c633db3..95e730506ad2 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -14,6 +14,7 @@
 #include <linux/mm.h>
 #include <linux/printk.h>
 #include <linux/string_helpers.h>
+#include <linux/pagemap.h>
 
 #include <asm/uaccess.h>
 #include <asm/page.h>
@@ -25,7 +26,24 @@ static void seq_set_overflow(struct seq_file *m)
 
 static void *seq_buf_alloc(unsigned long size)
 {
-	return kvmalloc(size, GFP_KERNEL);
+	void *buf;
+	gfp_t gfp = GFP_KERNEL;
+
+	if (unlikely(size > MAX_RW_COUNT))
+		return NULL;
+
+	/*
+	 * For high order allocations, use __GFP_NORETRY to avoid oom-killing -
+	 * it's better to fall back to vmalloc() than to kill things.  For small
+	 * allocations, just use GFP_KERNEL which will oom kill, thus no need
+	 * for vmalloc fallback.
+	 */
+	if (size > PAGE_SIZE)
+		gfp |= __GFP_NORETRY | __GFP_NOWARN;
+	buf = kmalloc(size, gfp);
+	if (!buf && size > PAGE_SIZE)
+		buf = vmalloc(size);
+	return buf;
 }
 
 /**

From d5ee0ea5f2f4eacc7e57ec1b2ccfb1d93b44277f Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 20 Jul 2021 16:22:44 +0200
Subject: [PATCH 2495/2658] Linux 4.4.276

Link: https://lore.kernel.org/r/20210719144913.076563739@linuxfoundation.org
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 875ed3d30ef7..e601862e5fbb 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 275
+SUBLEVEL = 276
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 9b68b4ecc9269b53819271a0a389cd59cc655ef5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
Date: Fri, 16 Apr 2021 15:37:49 +0200
Subject: [PATCH 2496/2658] ARM: brcmstb: dts: fix NAND nodes names
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 9a800ce1aada6e0f56b78e4713f4858c8990c1f7 ]

This matches nand-controller.yaml requirements.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/bcm7445-bcm97445svmb.dts | 4 ++--
 arch/arm/boot/dts/bcm7445.dtsi             | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/bcm7445-bcm97445svmb.dts b/arch/arm/boot/dts/bcm7445-bcm97445svmb.dts
index 0bb8d17e4c2d..e51c9b079432 100644
--- a/arch/arm/boot/dts/bcm7445-bcm97445svmb.dts
+++ b/arch/arm/boot/dts/bcm7445-bcm97445svmb.dts
@@ -13,10 +13,10 @@
 	};
 };
 
-&nand {
+&nand_controller {
 	status = "okay";
 
-	nandcs@1 {
+	nand@1 {
 		compatible = "brcm,nandcs";
 		reg = <1>;
 		nand-ecc-step-size = <512>;
diff --git a/arch/arm/boot/dts/bcm7445.dtsi b/arch/arm/boot/dts/bcm7445.dtsi
index 4791321969b3..3f002f2047f1 100644
--- a/arch/arm/boot/dts/bcm7445.dtsi
+++ b/arch/arm/boot/dts/bcm7445.dtsi
@@ -149,7 +149,7 @@
 			reg-names = "aon-ctrl", "aon-sram";
 		};
 
-		nand: nand@3e2800 {
+		nand_controller: nand-controller@3e2800 {
 			status = "disabled";
 			#address-cells = <1>;
 			#size-cells = <0>;

From 049172eb77bb0f086da86b58ca398e92b71929e7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
Date: Fri, 16 Apr 2021 15:37:52 +0200
Subject: [PATCH 2497/2658] ARM: dts: BCM63xx: Fix NAND nodes names
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 75e2f012f6e34b93124d1d86eaa8f27df48e9ea0 ]

This matches nand-controller.yaml requirements.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/bcm63138.dtsi    | 2 +-
 arch/arm/boot/dts/bcm963138dvt.dts | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/bcm63138.dtsi b/arch/arm/boot/dts/bcm63138.dtsi
index 34cd64051250..84efc3d16f58 100644
--- a/arch/arm/boot/dts/bcm63138.dtsi
+++ b/arch/arm/boot/dts/bcm63138.dtsi
@@ -152,7 +152,7 @@
 			status = "disabled";
 		};
 
-		nand: nand@2000 {
+		nand_controller: nand-controller@2000 {
 			#address-cells = <1>;
 			#size-cells = <0>;
 			compatible = "brcm,nand-bcm63138", "brcm,brcmnand-v7.0", "brcm,brcmnand";
diff --git a/arch/arm/boot/dts/bcm963138dvt.dts b/arch/arm/boot/dts/bcm963138dvt.dts
index 370aa2cfddf2..439cff69e948 100644
--- a/arch/arm/boot/dts/bcm963138dvt.dts
+++ b/arch/arm/boot/dts/bcm963138dvt.dts
@@ -29,10 +29,10 @@
 	status = "okay";
 };
 
-&nand {
+&nand_controller {
 	status = "okay";
 
-	nandcs@0 {
+	nand@0 {
 		compatible = "brcm,nandcs";
 		reg = <0>;
 		nand-ecc-strength = <4>;

From 597c923f8e0762d472730e5bdcc314950b076d96 Mon Sep 17 00:00:00 2001
From: Primoz Fiser <primoz.fiser@norik.com>
Date: Mon, 12 Apr 2021 08:24:50 +0200
Subject: [PATCH 2498/2658] ARM: dts: imx6: phyFLEX: Fix UART hardware flow
 control

[ Upstream commit 14cdc1f243d79e0b46be150502b7dba9c5a6bdfd ]

Serial interface uart3 on phyFLEX board is capable of 5-wire connection
including signals RTS and CTS for hardware flow control.

Fix signals UART3_CTS_B and UART3_RTS_B padmux assignments and add
missing property "uart-has-rtscts" to allow serial interface to be
configured and used with the hardware flow control.

Signed-off-by: Primoz Fiser <primoz.fiser@norik.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
index cae04e806036..e3e3a7a08d08 100644
--- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
@@ -307,8 +307,8 @@
 			fsl,pins = <
 				MX6QDL_PAD_EIM_D24__UART3_TX_DATA	0x1b0b1
 				MX6QDL_PAD_EIM_D25__UART3_RX_DATA	0x1b0b1
-				MX6QDL_PAD_EIM_D30__UART3_RTS_B		0x1b0b1
-				MX6QDL_PAD_EIM_D31__UART3_CTS_B		0x1b0b1
+				MX6QDL_PAD_EIM_D31__UART3_RTS_B		0x1b0b1
+				MX6QDL_PAD_EIM_D30__UART3_CTS_B		0x1b0b1
 			>;
 		};
 
@@ -383,6 +383,7 @@
 &uart3 {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_uart3>;
+	uart-has-rtscts;
 	status = "disabled";
 };
 

From b3212040872bc8a8b7f81fff9a45b20bef875505 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jonathan=20Neusch=C3=A4fer?= <j.neuschaefer@gmx.net>
Date: Sat, 24 Apr 2021 14:37:28 +0200
Subject: [PATCH 2499/2658] ARM: imx: pm-imx5: Fix references to
 imx5_cpu_suspend_info
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 89b759469d525f4d5f9c29cd3b1f490311c67f85 ]

The name of the struct, as defined in arch/arm/mach-imx/pm-imx5.c,
is imx5_cpu_suspend_info.

Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-imx/suspend-imx53.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-imx/suspend-imx53.S b/arch/arm/mach-imx/suspend-imx53.S
index 5ed078ad110a..f12d24104075 100644
--- a/arch/arm/mach-imx/suspend-imx53.S
+++ b/arch/arm/mach-imx/suspend-imx53.S
@@ -33,11 +33,11 @@
  *                              ^
  *                              ^
  *                      imx53_suspend code
- *              PM_INFO structure(imx53_suspend_info)
+ *              PM_INFO structure(imx5_cpu_suspend_info)
  * ======================== low address =======================
  */
 
-/* Offsets of members of struct imx53_suspend_info */
+/* Offsets of members of struct imx5_cpu_suspend_info */
 #define SUSPEND_INFO_MX53_M4IF_V_OFFSET		0x0
 #define SUSPEND_INFO_MX53_IOMUXC_V_OFFSET	0x4
 #define SUSPEND_INFO_MX53_IO_COUNT_OFFSET	0x8

From e19ff1d8b7786253d2bd9e2bcbbe1f45339076e8 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Mon, 17 May 2021 13:10:20 +0800
Subject: [PATCH 2500/2658] thermal/core: Correct function name
 thermal_zone_device_unregister()

[ Upstream commit a052b5118f13febac1bd901fe0b7a807b9d6b51c ]

Fix the following make W=1 kernel build warning:

  drivers/thermal/thermal_core.c:1376: warning: expecting prototype for thermal_device_unregister(). Prototype was for thermal_zone_device_unregister() instead

Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20210517051020.3463536-1-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thermal/thermal_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index f51bedc538b5..ba86dc7125e3 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -2414,7 +2414,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
 EXPORT_SYMBOL_GPL(thermal_zone_device_register);
 
 /**
- * thermal_device_unregister - removes the registered thermal zone device
+ * thermal_zone_device_unregister - removes the registered thermal zone device
  * @tz: the thermal zone device to remove
  */
 void thermal_zone_device_unregister(struct thermal_zone_device *tz)

From 9dbc1f72a640528678778a3807157a1551d31ae7 Mon Sep 17 00:00:00 2001
From: Matthias Maennich <maennich@google.com>
Date: Sat, 12 Jun 2021 15:18:38 +0100
Subject: [PATCH 2501/2658] kbuild: mkcompile_h: consider timestamp if
 KBUILD_BUILD_TIMESTAMP is set

[ Upstream commit a979522a1a88556e42a22ce61bccc58e304cb361 ]

To avoid unnecessary recompilations, mkcompile_h does not regenerate
compile.h if just the timestamp changed.
Though, if KBUILD_BUILD_TIMESTAMP is set, an explicit timestamp for the
build was requested, in which case we should not ignore it.

If a user follows the documentation for reproducible builds [1] and
defines KBUILD_BUILD_TIMESTAMP as the git commit timestamp, a clean
build will have the correct timestamp. A subsequent cherry-pick (or
amend) changes the commit timestamp and if an incremental build is done
with a different KBUILD_BUILD_TIMESTAMP now, that new value is not taken
into consideration. But it should for reproducibility.

Hence, whenever KBUILD_BUILD_TIMESTAMP is explicitly set, do not ignore
UTS_VERSION when making a decision about whether the regenerated version
of compile.h should be moved into place.

[1] https://www.kernel.org/doc/html/latest/kbuild/reproducible-builds.html

Signed-off-by: Matthias Maennich <maennich@google.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/mkcompile_h | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/scripts/mkcompile_h b/scripts/mkcompile_h
index 6fdc97ef6023..cb73747002ed 100755
--- a/scripts/mkcompile_h
+++ b/scripts/mkcompile_h
@@ -82,15 +82,23 @@ UTS_TRUNCATE="cut -b -$UTS_LEN"
 # Only replace the real compile.h if the new one is different,
 # in order to preserve the timestamp and avoid unnecessary
 # recompilations.
-# We don't consider the file changed if only the date/time changed.
+# We don't consider the file changed if only the date/time changed,
+# unless KBUILD_BUILD_TIMESTAMP was explicitly set (e.g. for
+# reproducible builds with that value referring to a commit timestamp).
 # A kernel config change will increase the generation number, thus
 # causing compile.h to be updated (including date/time) due to the
 # changed comment in the
 # first line.
 
+if [ -z "$KBUILD_BUILD_TIMESTAMP" ]; then
+   IGNORE_PATTERN="UTS_VERSION"
+else
+   IGNORE_PATTERN="NOT_A_PATTERN_TO_BE_MATCHED"
+fi
+
 if [ -r $TARGET ] && \
-      grep -v 'UTS_VERSION' $TARGET > .tmpver.1 && \
-      grep -v 'UTS_VERSION' .tmpcompile > .tmpver.2 && \
+      grep -v $IGNORE_PATTERN $TARGET > .tmpver.1 && \
+      grep -v $IGNORE_PATTERN .tmpcompile > .tmpver.2 && \
       cmp -s .tmpver.1 .tmpver.2; then
    rm -f .tmpcompile
 else

From 85a030d0d0b82083cc92fbfe9a77dc5ef33fca55 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Mon, 21 Jun 2021 16:17:27 +0100
Subject: [PATCH 2502/2658] scsi: aic7xxx: Fix unintentional sign extension
 issue on left shift of u8

[ Upstream commit 332a9dd1d86f1e7203fc7f0fd7e82f0b304200fe ]

The shifting of the u8 integer returned fom ahc_inb(ahc, port+3) by 24 bits
to the left will be promoted to a 32 bit signed int and then sign-extended
to a u64. In the event that the top bit of the u8 is set then all then all
the upper 32 bits of the u64 end up as also being set because of the
sign-extension. Fix this by casting the u8 values to a u64 before the 24
bit left shift.

[ This dates back to 2002, I found the offending commit from the git
history git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git,
commit f58eb66c0b0a ("Update aic7xxx driver to 6.2.10...") ]

Link: https://lore.kernel.org/r/20210621151727.20667-1-colin.king@canonical.com
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Addresses-Coverity: ("Unintended sign extension")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/aic7xxx/aic7xxx_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/aic7xxx/aic7xxx_core.c b/drivers/scsi/aic7xxx/aic7xxx_core.c
index def3208dd290..9b5832b46dec 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_core.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_core.c
@@ -500,7 +500,7 @@ ahc_inq(struct ahc_softc *ahc, u_int port)
 	return ((ahc_inb(ahc, port))
 	      | (ahc_inb(ahc, port+1) << 8)
 	      | (ahc_inb(ahc, port+2) << 16)
-	      | (ahc_inb(ahc, port+3) << 24)
+	      | (((uint64_t)ahc_inb(ahc, port+3)) << 24)
 	      | (((uint64_t)ahc_inb(ahc, port+4)) << 32)
 	      | (((uint64_t)ahc_inb(ahc, port+5)) << 40)
 	      | (((uint64_t)ahc_inb(ahc, port+6)) << 48)

From e596f637929e14232124cbeba546308979ba4854 Mon Sep 17 00:00:00 2001
From: Odin Ugedal <odin@uged.al>
Date: Tue, 29 Jun 2021 14:14:52 +0200
Subject: [PATCH 2503/2658] sched/fair: Fix CFS bandwidth hrtimer expiry type

[ Upstream commit 72d0ad7cb5bad265adb2014dbe46c4ccb11afaba ]

The time remaining until expiry of the refresh_timer can be negative.
Casting the type to an unsigned 64-bit value will cause integer
underflow, making the runtime_refresh_within return false instead of
true. These situations are rare, but they do happen.

This does not cause user-facing issues or errors; other than
possibly unthrottling cfs_rq's using runtime from the previous period(s),
making the CFS bandwidth enforcement less strict in those (special)
situations.

Signed-off-by: Odin Ugedal <odin@uged.al>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Ben Segall <bsegall@google.com>
Link: https://lore.kernel.org/r/20210629121452.18429-1-odin@uged.al
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/fair.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 3e4b6a4c1594..c4434ce4dcf6 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -5471,7 +5471,7 @@ static const u64 cfs_bandwidth_slack_period = 5 * NSEC_PER_MSEC;
 static int runtime_refresh_within(struct cfs_bandwidth *cfs_b, u64 min_expire)
 {
 	struct hrtimer *refresh_timer = &cfs_b->period_timer;
-	u64 remaining;
+	s64 remaining;
 
 	/* if the call-back is running a quota refresh is already occurring */
 	if (hrtimer_callback_running(refresh_timer))
@@ -5479,7 +5479,7 @@ static int runtime_refresh_within(struct cfs_bandwidth *cfs_b, u64 min_expire)
 
 	/* is a quota refresh about to occur? */
 	remaining = ktime_to_ns(hrtimer_expires_remaining(refresh_timer));
-	if (remaining < min_expire)
+	if (remaining < (s64)min_expire)
 		return 1;
 
 	return 0;

From 8da7cd89ffe845d458294b016f370cb67281618a Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 22 Jul 2021 15:35:47 +0200
Subject: [PATCH 2504/2658] Revert "memory: fsl_ifc: fix leak of IO mapping on
 probe failure"

This reverts commit b7a2bcb4a3731d68f938207f75ed3e1d41774510 which is
commit 3b132ab67fc7a358fff35e808fa65d4bea452521 upstream.

As reported, it breaks the build, the 'gregs' field is not in the 4.4.y
kernel tree.

Reported-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20210721144845.GA3445926@roeck-us.net
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Cc: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/memory/fsl_ifc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c
index 65b984d64350..26b37ba4feda 100644
--- a/drivers/memory/fsl_ifc.c
+++ b/drivers/memory/fsl_ifc.c
@@ -228,7 +228,8 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
 	fsl_ifc_ctrl_dev->regs = of_iomap(dev->dev.of_node, 0);
 	if (!fsl_ifc_ctrl_dev->regs) {
 		dev_err(&dev->dev, "failed to get memory region\n");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto err;
 	}
 
 	version = ifc_in32(&fsl_ifc_ctrl_dev->regs->ifc_rev) &
@@ -305,7 +306,6 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
 	free_irq(fsl_ifc_ctrl_dev->irq, fsl_ifc_ctrl_dev);
 	irq_dispose_mapping(fsl_ifc_ctrl_dev->irq);
 err:
-	iounmap(fsl_ifc_ctrl_dev->gregs);
 	return ret;
 }
 

From c7a7a1e293f90afeb0834f5577dfbffd748550e7 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Fri, 18 Jun 2021 16:18:25 +0200
Subject: [PATCH 2505/2658] x86/fpu: Make init_fpstate correct with optimized
 XSAVE

commit f9dfb5e390fab2df9f7944bb91e7705aba14cd26 upstream.

The XSAVE init code initializes all enabled and supported components with
XRSTOR(S) to init state. Then it XSAVEs the state of the components back
into init_fpstate which is used in several places to fill in the init state
of components.

This works correctly with XSAVE, but not with XSAVEOPT and XSAVES because
those use the init optimization and skip writing state of components which
are in init state. So init_fpstate.xsave still contains all zeroes after
this operation.

There are two ways to solve that:

   1) Use XSAVE unconditionally, but that requires to reshuffle the buffer when
      XSAVES is enabled because XSAVES uses compacted format.

   2) Save the components which are known to have a non-zero init state by other
      means.

Looking deeper, #2 is the right thing to do because all components the
kernel supports have all-zeroes init state except the legacy features (FP,
SSE). Those cannot be hard coded because the states are not identical on all
CPUs, but they can be saved with FXSAVE which avoids all conditionals.

Use FXSAVE to save the legacy FP/SSE components in init_fpstate along with
a BUILD_BUG_ON() which reminds developers to validate that a newly added
component has all zeroes init state. As a bonus remove the now unused
copy_xregs_to_kernel_booting() crutch.

The XSAVE and reshuffle method can still be implemented in the unlikely
case that components are added which have a non-zero init state and no
other means to save them. For now, FXSAVE is just simple and good enough.

  [ bp: Fix a typo or two in the text. ]

Fixes: 6bad06b76892 ("x86, xsave: Use xsaveopt in context-switch path when supported")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Cc: stable@vger.kernel.org
[ bp: 4.4 backport: Drop XFEATURE_MASK_{PKRU,PASID} which are not there yet. ]
Link: https://lkml.kernel.org/r/20210618143444.587311343@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/fpu/internal.h | 30 +++++++----------------
 arch/x86/kernel/fpu/xstate.c        | 37 ++++++++++++++++++++++++++---
 2 files changed, 42 insertions(+), 25 deletions(-)

diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h
index 66a5e60f60c4..4fb38927128c 100644
--- a/arch/x86/include/asm/fpu/internal.h
+++ b/arch/x86/include/asm/fpu/internal.h
@@ -217,6 +217,14 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu)
 	}
 }
 
+static inline void fxsave(struct fxregs_state *fx)
+{
+	if (IS_ENABLED(CONFIG_X86_32))
+		asm volatile( "fxsave %[fx]" : [fx] "=m" (*fx));
+	else
+		asm volatile("fxsaveq %[fx]" : [fx] "=m" (*fx));
+}
+
 /* These macros all use (%edi)/(%rdi) as the single memory argument. */
 #define XSAVE		".byte " REX_PREFIX "0x0f,0xae,0x27"
 #define XSAVEOPT	".byte " REX_PREFIX "0x0f,0xae,0x37"
@@ -286,28 +294,6 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu)
 		     : "D" (st), "m" (*st), "a" (lmask), "d" (hmask)	\
 		     : "memory")
 
-/*
- * This function is called only during boot time when x86 caps are not set
- * up and alternative can not be used yet.
- */
-static inline void copy_xregs_to_kernel_booting(struct xregs_state *xstate)
-{
-	u64 mask = -1;
-	u32 lmask = mask;
-	u32 hmask = mask >> 32;
-	int err;
-
-	WARN_ON(system_state != SYSTEM_BOOTING);
-
-	if (static_cpu_has(X86_FEATURE_XSAVES))
-		XSTATE_OP(XSAVES, xstate, lmask, hmask, err);
-	else
-		XSTATE_OP(XSAVE, xstate, lmask, hmask, err);
-
-	/* We should never fault when copying to a kernel buffer: */
-	WARN_ON_FPU(err);
-}
-
 /*
  * This function is called only during boot time when x86 caps are not set
  * up and alternative can not be used yet.
diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index 3fa200ecca62..1ff1adbc843b 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -292,6 +292,23 @@ static void __init setup_xstate_comp(void)
 	}
 }
 
+/*
+ * All supported features have either init state all zeros or are
+ * handled in setup_init_fpu() individually. This is an explicit
+ * feature list and does not use XFEATURE_MASK*SUPPORTED to catch
+ * newly added supported features at build time and make people
+ * actually look at the init state for the new feature.
+ */
+#define XFEATURES_INIT_FPSTATE_HANDLED		\
+	(XFEATURE_MASK_FP |			\
+	 XFEATURE_MASK_SSE |			\
+	 XFEATURE_MASK_YMM |			\
+	 XFEATURE_MASK_OPMASK |			\
+	 XFEATURE_MASK_ZMM_Hi256 |		\
+	 XFEATURE_MASK_Hi16_ZMM	 |		\
+	 XFEATURE_MASK_BNDREGS |		\
+	 XFEATURE_MASK_BNDCSR)
+
 /*
  * setup the xstate image representing the init state
  */
@@ -299,6 +316,8 @@ static void __init setup_init_fpu_buf(void)
 {
 	static int on_boot_cpu = 1;
 
+	BUILD_BUG_ON(XCNTXT_MASK != XFEATURES_INIT_FPSTATE_HANDLED);
+
 	WARN_ON_FPU(!on_boot_cpu);
 	on_boot_cpu = 0;
 
@@ -319,10 +338,22 @@ static void __init setup_init_fpu_buf(void)
 	copy_kernel_to_xregs_booting(&init_fpstate.xsave);
 
 	/*
-	 * Dump the init state again. This is to identify the init state
-	 * of any feature which is not represented by all zero's.
+	 * All components are now in init state. Read the state back so
+	 * that init_fpstate contains all non-zero init state. This only
+	 * works with XSAVE, but not with XSAVEOPT and XSAVES because
+	 * those use the init optimization which skips writing data for
+	 * components in init state.
+	 *
+	 * XSAVE could be used, but that would require to reshuffle the
+	 * data when XSAVES is available because XSAVES uses xstate
+	 * compaction. But doing so is a pointless exercise because most
+	 * components have an all zeros init state except for the legacy
+	 * ones (FP and SSE). Those can be saved with FXSAVE into the
+	 * legacy area. Adding new features requires to ensure that init
+	 * state is all zeroes or if not to add the necessary handling
+	 * here.
 	 */
-	copy_xregs_to_kernel_booting(&init_fpstate.xsave);
+	fxsave(&init_fpstate.fxsave);
 }
 
 static int xfeature_is_supervisor(int xfeature_nr)

From 902eaa3c71e8a1d9c8c4a8a7f662313b04f462b7 Mon Sep 17 00:00:00 2001
From: Vadim Fedorenko <vfedorenko@novek.ru>
Date: Fri, 2 Jul 2021 02:47:00 +0300
Subject: [PATCH 2506/2658] net: ipv6: fix return value of ip6_skb_dst_mtu

commit 40fc3054b45820c28ea3c65e2c86d041dc244a8a upstream.

Commit 628a5c561890 ("[INET]: Add IP(V6)_PMTUDISC_RPOBE") introduced
ip6_skb_dst_mtu with return value of signed int which is inconsistent
with actually returned values. Also 2 users of this function actually
assign its value to unsigned int variable and only __xfrm6_output
assigns result of this function to signed variable but actually uses
as unsigned in further comparisons and calls. Change this function
to return unsigned int value.

Fixes: 628a5c561890 ("[INET]: Add IP(V6)_PMTUDISC_RPOBE")
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Vadim Fedorenko <vfedorenko@novek.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/ip6_route.h | 2 +-
 net/ipv6/xfrm6_output.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 33f28e62b790..a53853dbd226 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -182,7 +182,7 @@ static inline bool ipv6_anycast_destination(const struct dst_entry *dst,
 int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
 		 int (*output)(struct net *, struct sock *, struct sk_buff *));
 
-static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
+static inline unsigned int ip6_skb_dst_mtu(struct sk_buff *skb)
 {
 	struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
 				inet6_sk(skb->sk) : NULL;
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index b2dc9a820c6a..ef6cc9eb0e45 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -141,7 +141,7 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
 	struct dst_entry *dst = skb_dst(skb);
 	struct xfrm_state *x = dst->xfrm;
-	int mtu;
+	unsigned int mtu;
 	bool toobig;
 
 #ifdef CONFIG_NETFILTER

From c1c00f4a5473476dc17ba9deece4d26507a1f3af Mon Sep 17 00:00:00 2001
From: Florian Fainelli <f.fainelli@gmail.com>
Date: Thu, 8 Jul 2021 18:55:32 -0700
Subject: [PATCH 2507/2658] net: bcmgenet: Ensure all TX/RX queues DMAs are
 disabled

commit 2b452550a203d88112eaf0ba9fc4b750a000b496 upstream.

Make sure that we disable each of the TX and RX queues in the TDMA and
RDMA control registers. This is a correctness change to be symmetrical
with the code that enables the TX and RX queues.

Tested-by: Maxime Ripard <maxime@cerno.tech>
Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/genet/bcmgenet.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 3a6cebff9f42..f8c4460b23f2 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -2663,15 +2663,21 @@ static void bcmgenet_set_hw_addr(struct bcmgenet_priv *priv,
 /* Returns a reusable dma control register value */
 static u32 bcmgenet_dma_disable(struct bcmgenet_priv *priv)
 {
+	unsigned int i;
 	u32 reg;
 	u32 dma_ctrl;
 
 	/* disable DMA */
 	dma_ctrl = 1 << (DESC_INDEX + DMA_RING_BUF_EN_SHIFT) | DMA_EN;
+	for (i = 0; i < priv->hw_params->tx_queues; i++)
+		dma_ctrl |= (1 << (i + DMA_RING_BUF_EN_SHIFT));
 	reg = bcmgenet_tdma_readl(priv, DMA_CTRL);
 	reg &= ~dma_ctrl;
 	bcmgenet_tdma_writel(priv, reg, DMA_CTRL);
 
+	dma_ctrl = 1 << (DESC_INDEX + DMA_RING_BUF_EN_SHIFT) | DMA_EN;
+	for (i = 0; i < priv->hw_params->rx_queues; i++)
+		dma_ctrl |= (1 << (i + DMA_RING_BUF_EN_SHIFT));
 	reg = bcmgenet_rdma_readl(priv, DMA_CTRL);
 	reg &= ~dma_ctrl;
 	bcmgenet_rdma_writel(priv, reg, DMA_CTRL);

From 05752ac151b4fd3fd9879bf28f6b77625d60930d Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Fri, 9 Jul 2021 17:09:53 +0300
Subject: [PATCH 2508/2658] net: moxa: fix UAF in moxart_mac_probe

commit c78eaeebe855fd93f2e77142ffd0404a54070d84 upstream.

In case of netdev registration failure the code path will
jump to init_fail label:

init_fail:
	netdev_err(ndev, "init failed\n");
	moxart_mac_free_memory(ndev);
irq_map_fail:
	free_netdev(ndev);
	return ret;

So, there is no need to call free_netdev() before jumping
to error handling path, since it can cause UAF or double-free
bug.

Fixes: 6c821bd9edc9 ("net: Add MOXA ART SoCs ethernet driver")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/moxa/moxart_ether.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
index 374e691b11da..295b5176bcf1 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -518,10 +518,8 @@ static int moxart_mac_probe(struct platform_device *pdev)
 	SET_NETDEV_DEV(ndev, &pdev->dev);
 
 	ret = register_netdev(ndev);
-	if (ret) {
-		free_netdev(ndev);
+	if (ret)
 		goto init_fail;
-	}
 
 	netdev_dbg(ndev, "%s: IRQ=%d address=%pM\n",
 		   __func__, ndev->irq, ndev->dev_addr);

From bba5d32d236724af8550db1cb33d0611069907c0 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Fri, 9 Jul 2021 17:58:29 +0300
Subject: [PATCH 2509/2658] net: ti: fix UAF in tlan_remove_one

commit 0336f8ffece62f882ab3012820965a786a983f70 upstream.

priv is netdev private data and it cannot be
used after free_netdev() call. Using priv after free_netdev()
can cause UAF bug. Fix it by moving free_netdev() at the end of the
function.

Fixes: 1e0a8b13d355 ("tlan: cancel work at remove path")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/ti/tlan.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/ti/tlan.c b/drivers/net/ethernet/ti/tlan.c
index 399a89f30826..bc1638b0073f 100644
--- a/drivers/net/ethernet/ti/tlan.c
+++ b/drivers/net/ethernet/ti/tlan.c
@@ -313,9 +313,8 @@ static void tlan_remove_one(struct pci_dev *pdev)
 	pci_release_regions(pdev);
 #endif
 
-	free_netdev(dev);
-
 	cancel_work_sync(&priv->tlan_tqueue);
+	free_netdev(dev);
 }
 
 static void tlan_start(struct net_device *dev)

From b5994fd0268486cc140e69d07339793cad87fb42 Mon Sep 17 00:00:00 2001
From: Taehee Yoo <ap420073@gmail.com>
Date: Fri, 9 Jul 2021 17:35:18 +0000
Subject: [PATCH 2510/2658] net: validate lwtstate->data before returning from
 skb_tunnel_info()

commit 67a9c94317402b826fc3db32afc8f39336803d97 upstream.

skb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info
type without validation. lwtstate->data can have various types such as
mpls_iptunnel_encap, etc and these are not compatible.
So skb_tunnel_info() should validate before returning that pointer.

Splat looks like:
BUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan]
Read of size 2 at addr ffff888106ec2698 by task ping/811

CPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195
Call Trace:
 dump_stack_lvl+0x56/0x7b
 print_address_description.constprop.8.cold.13+0x13/0x2ee
 ? vxlan_get_route+0x418/0x4b0 [vxlan]
 ? vxlan_get_route+0x418/0x4b0 [vxlan]
 kasan_report.cold.14+0x83/0xdf
 ? vxlan_get_route+0x418/0x4b0 [vxlan]
 vxlan_get_route+0x418/0x4b0 [vxlan]
 [ ... ]
 vxlan_xmit_one+0x148b/0x32b0 [vxlan]
 [ ... ]
 vxlan_xmit+0x25c5/0x4780 [vxlan]
 [ ... ]
 dev_hard_start_xmit+0x1ae/0x6e0
 __dev_queue_xmit+0x1f39/0x31a0
 [ ... ]
 neigh_xmit+0x2f9/0x940
 mpls_xmit+0x911/0x1600 [mpls_iptunnel]
 lwtunnel_xmit+0x18f/0x450
 ip_finish_output2+0x867/0x2040
 [ ... ]

Fixes: 61adedf3e3f1 ("route: move lwtunnel state to dst_entry")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/dst_metadata.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h
index 30a56ab2ccfb..4cee368cb91c 100644
--- a/include/net/dst_metadata.h
+++ b/include/net/dst_metadata.h
@@ -31,7 +31,9 @@ static inline struct ip_tunnel_info *skb_tunnel_info(struct sk_buff *skb)
 		return &md_dst->u.tun_info;
 
 	dst = skb_dst(skb);
-	if (dst && dst->lwtstate)
+	if (dst && dst->lwtstate &&
+	    (dst->lwtstate->type == LWTUNNEL_ENCAP_IP ||
+	     dst->lwtstate->type == LWTUNNEL_ENCAP_IP6))
 		return lwt_tun_info(dst->lwtstate);
 
 	return NULL;

From 3788bfdb2e481df995f0144793e890ad5c5cdf5c Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Fri, 2 Jul 2021 13:09:03 -0700
Subject: [PATCH 2511/2658] tcp: annotate data races around tp->mtu_info

commit 561022acb1ce62e50f7a8258687a21b84282a4cb upstream.

While tp->mtu_info is read while socket is owned, the write
sides happen from err handlers (tcp_v[46]_mtu_reduced)
which only own the socket spinlock.

Fixes: 563d34d05786 ("tcp: dont drop MTU reduction indications")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_ipv4.c | 4 ++--
 net/ipv6/tcp_ipv6.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 161896d6dabb..ae5e978724b2 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -277,7 +277,7 @@ void tcp_v4_mtu_reduced(struct sock *sk)
 
 	if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 		return;
-	mtu = tcp_sk(sk)->mtu_info;
+	mtu = READ_ONCE(tcp_sk(sk)->mtu_info);
 	dst = inet_csk_update_pmtu(sk, mtu);
 	if (!dst)
 		return;
@@ -444,7 +444,7 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
 			if (sk->sk_state == TCP_LISTEN)
 				goto out;
 
-			tp->mtu_info = info;
+			WRITE_ONCE(tp->mtu_info, info);
 			if (!sock_owned_by_user(sk)) {
 				tcp_v4_mtu_reduced(sk);
 			} else {
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f6a4a7ab0fab..46a1fd1a4279 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -313,7 +313,7 @@ static void tcp_v6_mtu_reduced(struct sock *sk)
 	if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 		return;
 
-	dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
+	dst = inet6_csk_update_pmtu(sk, READ_ONCE(tcp_sk(sk)->mtu_info));
 	if (!dst)
 		return;
 
@@ -402,7 +402,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 		if (!ip6_sk_accept_pmtu(sk))
 			goto out;
 
-		tp->mtu_info = ntohl(info);
+		WRITE_ONCE(tp->mtu_info, ntohl(info));
 		if (!sock_owned_by_user(sk))
 			tcp_v6_mtu_reduced(sk);
 		else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,

From 1f15e2d4d30d67cff0fa6f14fd5005f37d08f6bf Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 8 Jul 2021 00:21:09 -0700
Subject: [PATCH 2512/2658] ipv6: tcp: drop silly ICMPv6 packet too big
 messages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit c7bb4b89033b764eb07db4e060548a6311d801ee upstream.

While TCP stack scales reasonably well, there is still one part that
can be used to DDOS it.

IPv6 Packet too big messages have to lookup/insert a new route,
and if abused by attackers, can easily put hosts under high stress,
with many cpus contending on a spinlock while one is stuck in fib6_run_gc()

ip6_protocol_deliver_rcu()
 icmpv6_rcv()
  icmpv6_notify()
   tcp_v6_err()
    tcp_v6_mtu_reduced()
     inet6_csk_update_pmtu()
      ip6_rt_update_pmtu()
       __ip6_rt_update_pmtu()
        ip6_rt_cache_alloc()
         ip6_dst_alloc()
          dst_alloc()
           ip6_dst_gc()
            fib6_run_gc()
             spin_lock_bh() ...

Some of our servers have been hit by malicious ICMPv6 packets
trying to _increase_ the MTU/MSS of TCP flows.

We believe these ICMPv6 packets are a result of a bug in one ISP stack,
since they were blindly sent back for _every_ (small) packet sent to them.

These packets are for one TCP flow:
09:24:36.266491 IP6 Addr1 > Victim ICMP6, packet too big, mtu 1460, length 1240
09:24:36.266509 IP6 Addr1 > Victim ICMP6, packet too big, mtu 1460, length 1240
09:24:36.316688 IP6 Addr1 > Victim ICMP6, packet too big, mtu 1460, length 1240
09:24:36.316704 IP6 Addr1 > Victim ICMP6, packet too big, mtu 1460, length 1240
09:24:36.608151 IP6 Addr1 > Victim ICMP6, packet too big, mtu 1460, length 1240

TCP stack can filter some silly requests :

1) MTU below IPV6_MIN_MTU can be filtered early in tcp_v6_err()
2) tcp_v6_mtu_reduced() can drop requests trying to increase current MSS.

This tests happen before the IPv6 routing stack is entered, thus
removing the potential contention and route exhaustion.

Note that IPv6 stack was performing these checks, but too late
(ie : after the route has been added, and after the potential
garbage collect war)

v2: fix typo caught by Martin, thanks !
v3: exports tcp_mtu_to_mss(), caught by David, thanks !

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Maciej Żenczykowski <maze@google.com>
Cc: Martin KaFai Lau <kafai@fb.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_output.c |  1 +
 net/ipv6/tcp_ipv6.c   | 19 +++++++++++++++++--
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 5a56b2356dde..17388adedc7d 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1353,6 +1353,7 @@ int tcp_mtu_to_mss(struct sock *sk, int pmtu)
 	return __tcp_mtu_to_mss(sk, pmtu) -
 	       (tcp_sk(sk)->tcp_header_len - sizeof(struct tcphdr));
 }
+EXPORT_SYMBOL(tcp_mtu_to_mss);
 
 /* Inverse of above */
 int tcp_mss_to_mtu(struct sock *sk, int mss)
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 46a1fd1a4279..8891722b1d6c 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -309,11 +309,20 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 static void tcp_v6_mtu_reduced(struct sock *sk)
 {
 	struct dst_entry *dst;
+	u32 mtu;
 
 	if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 		return;
 
-	dst = inet6_csk_update_pmtu(sk, READ_ONCE(tcp_sk(sk)->mtu_info));
+	mtu = READ_ONCE(tcp_sk(sk)->mtu_info);
+
+	/* Drop requests trying to increase our current mss.
+	 * Check done in __ip6_rt_update_pmtu() is too late.
+	 */
+	if (tcp_mtu_to_mss(sk, mtu) >= tcp_sk(sk)->mss_cache)
+		return;
+
+	dst = inet6_csk_update_pmtu(sk, mtu);
 	if (!dst)
 		return;
 
@@ -392,6 +401,8 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	}
 
 	if (type == ICMPV6_PKT_TOOBIG) {
+		u32 mtu = ntohl(info);
+
 		/* We are not interested in TCP_LISTEN and open_requests
 		 * (SYN-ACKs send out by Linux are always <576bytes so
 		 * they should go through unfragmented).
@@ -402,7 +413,11 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 		if (!ip6_sk_accept_pmtu(sk))
 			goto out;
 
-		WRITE_ONCE(tp->mtu_info, ntohl(info));
+		if (mtu < IPV6_MIN_MTU)
+			goto out;
+
+		WRITE_ONCE(tp->mtu_info, mtu);
+
 		if (!sock_owned_by_user(sk))
 			tcp_v6_mtu_reduced(sk);
 		else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,

From 67d76de41f4a190eb9a03d414aaa7e1293c9a624 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Wed, 16 Jun 2021 07:53:02 +0200
Subject: [PATCH 2513/2658] iavf: Fix an error handling path in 'iavf_probe()'

[ Upstream commit af30cbd2f4d6d66a9b6094e0aa32420bc8b20e08 ]

If an error occurs after a 'pci_enable_pcie_error_reporting()' call, it
must be undone by a corresponding 'pci_disable_pcie_error_reporting()'
call, as already done in the remove function.

Fixes: 5eae00c57f5e ("i40evf: main driver core")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40evf/i40evf_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
index 5f03ab3dfa19..8fdbc24b3cba 100644
--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
@@ -2503,6 +2503,7 @@ static int i40evf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 err_ioremap:
 	free_netdev(netdev);
 err_alloc_etherdev:
+	pci_disable_pcie_error_reporting(pdev);
 	pci_release_regions(pdev);
 err_pci_reg:
 err_dma:

From 664571c86ce523e03daf582ce27b7c4e81c4de44 Mon Sep 17 00:00:00 2001
From: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Date: Thu, 22 Apr 2021 10:19:23 +0000
Subject: [PATCH 2514/2658] igb: Check if num of q_vectors is smaller than max
 before array access

[ Upstream commit 6c19d772618fea40d9681f259368f284a330fd90 ]

Ensure that the adapter->q_vector[MAX_Q_VECTORS] array isn't accessed
beyond its size. It was fixed by using a local variable num_q_vectors
as a limit for loop index, and ensure that num_q_vectors is not bigger
than MAX_Q_VECTORS.

Fixes: 047e0030f1e6 ("igb: add new data structure for handling interrupts and NAPI")
Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Grzegorz Siwik <grzegorz.siwik@intel.com>
Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
Reviewed-by: Slawomir Laba <slawomirx.laba@intel.com>
Reviewed-by: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
Reviewed-by: Mateusz Palczewski <mateusz.placzewski@intel.com>
Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/igb/igb_main.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 682f52760898..6ccbf21547d0 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -945,6 +945,7 @@ static void igb_configure_msix(struct igb_adapter *adapter)
  **/
 static int igb_request_msix(struct igb_adapter *adapter)
 {
+	unsigned int num_q_vectors = adapter->num_q_vectors;
 	struct net_device *netdev = adapter->netdev;
 	int i, err = 0, vector = 0, free_vector = 0;
 
@@ -953,7 +954,13 @@ static int igb_request_msix(struct igb_adapter *adapter)
 	if (err)
 		goto err_out;
 
-	for (i = 0; i < adapter->num_q_vectors; i++) {
+	if (num_q_vectors > MAX_Q_VECTORS) {
+		num_q_vectors = MAX_Q_VECTORS;
+		dev_warn(&adapter->pdev->dev,
+			 "The number of queue vectors (%d) is higher than max allowed (%d)\n",
+			 adapter->num_q_vectors, MAX_Q_VECTORS);
+	}
+	for (i = 0; i < num_q_vectors; i++) {
 		struct igb_q_vector *q_vector = adapter->q_vector[i];
 
 		vector++;

From 2c9261af2581317812e26f9190bf26c6da91d65c Mon Sep 17 00:00:00 2001
From: Riccardo Mancini <rickyman7@gmail.com>
Date: Thu, 15 Jul 2021 18:07:24 +0200
Subject: [PATCH 2515/2658] perf test bpf: Free obj_buf

[ Upstream commit 937654ce497fb6e977a8c52baee5f7d9616302d9 ]

ASan reports some memory leaks when running:

  # perf test "42: BPF filter"

The first of these leaks is caused by obj_buf never being deallocated in
__test__bpf.

This patch adds the missing free.

Signed-off-by: Riccardo Mancini <rickyman7@gmail.com>
Fixes: ba1fae431e74bb42 ("perf test: Add 'perf test BPF'")
Cc: Ian Rogers <irogers@google.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Wang Nan <wangnan0@huawei.com>
Link: http://lore.kernel.org/lkml/60f3ca935fe6672e7e866276ce6264c9e26e4c87.1626343282.git.rickyman7@gmail.com
[ Added missing stdlib.h include ]
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/tests/bpf.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/perf/tests/bpf.c b/tools/perf/tests/bpf.c
index 6ebfdee3e2c6..661cca25ae5d 100644
--- a/tools/perf/tests/bpf.c
+++ b/tools/perf/tests/bpf.c
@@ -1,4 +1,5 @@
 #include <stdio.h>
+#include <stdlib.h>
 #include <sys/epoll.h>
 #include <util/bpf-loader.h>
 #include <util/evlist.h>
@@ -176,6 +177,7 @@ static int __test__bpf(int idx)
 		      bpf_testcase_table[idx].target_func,
 		      bpf_testcase_table[idx].expect_result);
 out:
+	free(obj_buf);
 	bpf__clear();
 	return ret;
 }

From 63d9be666408a5f3dfe21eca1cff9705eb51d103 Mon Sep 17 00:00:00 2001
From: Riccardo Mancini <rickyman7@gmail.com>
Date: Thu, 15 Jul 2021 18:07:25 +0200
Subject: [PATCH 2516/2658] perf probe-file: Delete namelist in del_events() on
 the error path

[ Upstream commit e0fa7ab42232e742dcb3de9f3c1f6127b5adc019 ]

ASan reports some memory leaks when running:

  # perf test "42: BPF filter"

This second leak is caused by a strlist not being dellocated on error
inside probe_file__del_events.

This patch adds a goto label before the deallocation and makes the error
path jump to it.

Signed-off-by: Riccardo Mancini <rickyman7@gmail.com>
Fixes: e7895e422e4da63d ("perf probe: Split del_perf_probe_events()")
Cc: Ian Rogers <irogers@google.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lore.kernel.org/lkml/174963c587ae77fa108af794669998e4ae558338.1626343282.git.rickyman7@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/probe-file.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/perf/util/probe-file.c b/tools/perf/util/probe-file.c
index e3b3b92e4458..7476757680ed 100644
--- a/tools/perf/util/probe-file.c
+++ b/tools/perf/util/probe-file.c
@@ -318,10 +318,10 @@ int probe_file__del_events(int fd, struct strfilter *filter)
 
 	ret = probe_file__get_events(fd, filter, namelist);
 	if (ret < 0)
-		return ret;
+		goto out;
 
 	ret = probe_file__del_strlist(fd, namelist);
+out:
 	strlist__delete(namelist);
-
 	return ret;
 }

From 03cf55d99e30f32cb8197fa7075b61b68baa6f68 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Thu, 15 Jul 2021 13:57:12 +0100
Subject: [PATCH 2517/2658] s390/bpf: Perform r1 range checking before
 accessing jit->seen_reg[r1]

[ Upstream commit 91091656252f5d6d8c476e0c92776ce9fae7b445 ]

Currently array jit->seen_reg[r1] is being accessed before the range
checking of index r1. The range changing on r1 should be performed
first since it will avoid any potential out-of-range accesses on the
array seen_reg[] and also it is more optimal to perform checks on r1
before fetching data from the array. Fix this by swapping the order
of the checks before the array access.

Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Link: https://lore.kernel.org/bpf/20210715125712.24690-1-colin.king@canonical.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/net/bpf_jit_comp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index bcf409997d6d..c5c3056f4c4a 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -115,7 +115,7 @@ static inline void reg_set_seen(struct bpf_jit *jit, u32 b1)
 {
 	u32 r1 = reg2hex[b1];
 
-	if (!jit->seen_reg[r1] && r1 >= 6 && r1 <= 15)
+	if (r1 >= 6 && r1 <= 15 && !jit->seen_reg[r1])
 		jit->seen_reg[r1] = 1;
 }
 

From 52f3ed5f2b279e2f1a34f16d96603cc658ead928 Mon Sep 17 00:00:00 2001
From: Ziyang Xuan <william.xuanziyang@huawei.com>
Date: Thu, 15 Jul 2021 20:22:04 +0800
Subject: [PATCH 2518/2658] net: fix uninit-value in caif_seqpkt_sendmsg

[ Upstream commit 991e634360f2622a683b48dfe44fe6d9cb765a09 ]

When nr_segs equal to zero in iovec_from_user, the object
msg->msg_iter.iov is uninit stack memory in caif_seqpkt_sendmsg
which is defined in ___sys_sendmsg. So we cann't just judge
msg->msg_iter.iov->base directlly. We can use nr_segs to judge
msg in caif_seqpkt_sendmsg whether has data buffers.

=====================================================
BUG: KMSAN: uninit-value in caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x220 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
 caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2343
 ___sys_sendmsg net/socket.c:2397 [inline]
 __sys_sendmmsg+0x808/0xc90 net/socket.c:2480
 __compat_sys_sendmmsg net/compat.c:656 [inline]

Reported-by: syzbot+09a5d591c1f98cf5efcb@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=1ace85e8fc9b0d5a45c08c2656c3e91762daa9b8
Fixes: bece7b2398d0 ("caif: Rewritten socket implementation")
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/caif/caif_socket.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index aa209b1066c9..3cfd413aa2c8 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -539,7 +539,8 @@ static int caif_seqpkt_sendmsg(struct socket *sock, struct msghdr *msg,
 		goto err;
 
 	ret = -EINVAL;
-	if (unlikely(msg->msg_iter.iov->iov_base == NULL))
+	if (unlikely(msg->msg_iter.nr_segs == 0) ||
+	    unlikely(msg->msg_iter.iov->iov_base == NULL))
 		goto err;
 	noblock = msg->msg_flags & MSG_DONTWAIT;
 

From 161646d8e5daa2f5fe20617c5caa540f645619af Mon Sep 17 00:00:00 2001
From: Yajun Deng <yajun.deng@linux.dev>
Date: Wed, 14 Jul 2021 17:13:20 +0800
Subject: [PATCH 2519/2658] net: decnet: Fix sleeping inside in af_decnet

[ Upstream commit 5f119ba1d5771bbf46d57cff7417dcd84d3084ba ]

The release_sock() is blocking function, it would change the state
after sleeping. use wait_woken() instead.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Yajun Deng <yajun.deng@linux.dev>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/decnet/af_decnet.c | 27 ++++++++++++---------------
 1 file changed, 12 insertions(+), 15 deletions(-)

diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 9d8fcdefefc0..ee297964fcd2 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -823,7 +823,7 @@ static int dn_auto_bind(struct socket *sock)
 static int dn_confirm_accept(struct sock *sk, long *timeo, gfp_t allocation)
 {
 	struct dn_scp *scp = DN_SK(sk);
-	DEFINE_WAIT(wait);
+	DEFINE_WAIT_FUNC(wait, woken_wake_function);
 	int err;
 
 	if (scp->state != DN_CR)
@@ -833,11 +833,11 @@ static int dn_confirm_accept(struct sock *sk, long *timeo, gfp_t allocation)
 	scp->segsize_loc = dst_metric_advmss(__sk_dst_get(sk));
 	dn_send_conn_conf(sk, allocation);
 
-	prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+	add_wait_queue(sk_sleep(sk), &wait);
 	for(;;) {
 		release_sock(sk);
 		if (scp->state == DN_CC)
-			*timeo = schedule_timeout(*timeo);
+			*timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, *timeo);
 		lock_sock(sk);
 		err = 0;
 		if (scp->state == DN_RUN)
@@ -851,9 +851,8 @@ static int dn_confirm_accept(struct sock *sk, long *timeo, gfp_t allocation)
 		err = -EAGAIN;
 		if (!*timeo)
 			break;
-		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
 	}
-	finish_wait(sk_sleep(sk), &wait);
+	remove_wait_queue(sk_sleep(sk), &wait);
 	if (err == 0) {
 		sk->sk_socket->state = SS_CONNECTED;
 	} else if (scp->state != DN_CC) {
@@ -865,7 +864,7 @@ static int dn_confirm_accept(struct sock *sk, long *timeo, gfp_t allocation)
 static int dn_wait_run(struct sock *sk, long *timeo)
 {
 	struct dn_scp *scp = DN_SK(sk);
-	DEFINE_WAIT(wait);
+	DEFINE_WAIT_FUNC(wait, woken_wake_function);
 	int err = 0;
 
 	if (scp->state == DN_RUN)
@@ -874,11 +873,11 @@ static int dn_wait_run(struct sock *sk, long *timeo)
 	if (!*timeo)
 		return -EALREADY;
 
-	prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+	add_wait_queue(sk_sleep(sk), &wait);
 	for(;;) {
 		release_sock(sk);
 		if (scp->state == DN_CI || scp->state == DN_CC)
-			*timeo = schedule_timeout(*timeo);
+			*timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, *timeo);
 		lock_sock(sk);
 		err = 0;
 		if (scp->state == DN_RUN)
@@ -892,9 +891,8 @@ static int dn_wait_run(struct sock *sk, long *timeo)
 		err = -ETIMEDOUT;
 		if (!*timeo)
 			break;
-		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
 	}
-	finish_wait(sk_sleep(sk), &wait);
+	remove_wait_queue(sk_sleep(sk), &wait);
 out:
 	if (err == 0) {
 		sk->sk_socket->state = SS_CONNECTED;
@@ -1039,16 +1037,16 @@ static void dn_user_copy(struct sk_buff *skb, struct optdata_dn *opt)
 
 static struct sk_buff *dn_wait_for_connect(struct sock *sk, long *timeo)
 {
-	DEFINE_WAIT(wait);
+	DEFINE_WAIT_FUNC(wait, woken_wake_function);
 	struct sk_buff *skb = NULL;
 	int err = 0;
 
-	prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+	add_wait_queue(sk_sleep(sk), &wait);
 	for(;;) {
 		release_sock(sk);
 		skb = skb_dequeue(&sk->sk_receive_queue);
 		if (skb == NULL) {
-			*timeo = schedule_timeout(*timeo);
+			*timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, *timeo);
 			skb = skb_dequeue(&sk->sk_receive_queue);
 		}
 		lock_sock(sk);
@@ -1063,9 +1061,8 @@ static struct sk_buff *dn_wait_for_connect(struct sock *sk, long *timeo)
 		err = -EAGAIN;
 		if (!*timeo)
 			break;
-		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
 	}
-	finish_wait(sk_sleep(sk), &wait);
+	remove_wait_queue(sk_sleep(sk), &wait);
 
 	return skb == NULL ? ERR_PTR(err) : skb;
 }

From 65a999a9a2d526dc1374eb9893f2f3adfdb3f450 Mon Sep 17 00:00:00 2001
From: Nguyen Dinh Phi <phind.uet@gmail.com>
Date: Sun, 18 Jul 2021 22:40:13 +0800
Subject: [PATCH 2520/2658] netrom: Decrease sock refcount when sock timers
 expire

[ Upstream commit 517a16b1a88bdb6b530f48d5d153478b2552d9a8 ]

Commit 63346650c1a9 ("netrom: switch to sock timer API") switched to use
sock timer API. It replaces mod_timer() by sk_reset_timer(), and
del_timer() by sk_stop_timer().

Function sk_reset_timer() will increase the refcount of sock if it is
called on an inactive timer, hence, in case the timer expires, we need to
decrease the refcount ourselves in the handler, otherwise, the sock
refcount will be unbalanced and the sock will never be freed.

Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com>
Reported-by: syzbot+10f1194569953b72f1ae@syzkaller.appspotmail.com
Fixes: 63346650c1a9 ("netrom: switch to sock timer API")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netrom/nr_timer.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/net/netrom/nr_timer.c b/net/netrom/nr_timer.c
index f0ecaec1ff3d..d1a0b7056743 100644
--- a/net/netrom/nr_timer.c
+++ b/net/netrom/nr_timer.c
@@ -125,11 +125,9 @@ static void nr_heartbeat_expiry(unsigned long param)
 		   is accepted() it isn't 'dead' so doesn't get removed. */
 		if (sock_flag(sk, SOCK_DESTROY) ||
 		    (sk->sk_state == TCP_LISTEN && sock_flag(sk, SOCK_DEAD))) {
-			sock_hold(sk);
 			bh_unlock_sock(sk);
 			nr_destroy_socket(sk);
-			sock_put(sk);
-			return;
+			goto out;
 		}
 		break;
 
@@ -150,6 +148,8 @@ static void nr_heartbeat_expiry(unsigned long param)
 
 	nr_start_heartbeat(sk);
 	bh_unlock_sock(sk);
+out:
+	sock_put(sk);
 }
 
 static void nr_t2timer_expiry(unsigned long param)
@@ -163,6 +163,7 @@ static void nr_t2timer_expiry(unsigned long param)
 		nr_enquiry_response(sk);
 	}
 	bh_unlock_sock(sk);
+	sock_put(sk);
 }
 
 static void nr_t4timer_expiry(unsigned long param)
@@ -172,6 +173,7 @@ static void nr_t4timer_expiry(unsigned long param)
 	bh_lock_sock(sk);
 	nr_sk(sk)->condition &= ~NR_COND_PEER_RX_BUSY;
 	bh_unlock_sock(sk);
+	sock_put(sk);
 }
 
 static void nr_idletimer_expiry(unsigned long param)
@@ -200,6 +202,7 @@ static void nr_idletimer_expiry(unsigned long param)
 		sock_set_flag(sk, SOCK_DEAD);
 	}
 	bh_unlock_sock(sk);
+	sock_put(sk);
 }
 
 static void nr_t1timer_expiry(unsigned long param)
@@ -212,8 +215,7 @@ static void nr_t1timer_expiry(unsigned long param)
 	case NR_STATE_1:
 		if (nr->n2count == nr->n2) {
 			nr_disconnect(sk, ETIMEDOUT);
-			bh_unlock_sock(sk);
-			return;
+			goto out;
 		} else {
 			nr->n2count++;
 			nr_write_internal(sk, NR_CONNREQ);
@@ -223,8 +225,7 @@ static void nr_t1timer_expiry(unsigned long param)
 	case NR_STATE_2:
 		if (nr->n2count == nr->n2) {
 			nr_disconnect(sk, ETIMEDOUT);
-			bh_unlock_sock(sk);
-			return;
+			goto out;
 		} else {
 			nr->n2count++;
 			nr_write_internal(sk, NR_DISCREQ);
@@ -234,8 +235,7 @@ static void nr_t1timer_expiry(unsigned long param)
 	case NR_STATE_3:
 		if (nr->n2count == nr->n2) {
 			nr_disconnect(sk, ETIMEDOUT);
-			bh_unlock_sock(sk);
-			return;
+			goto out;
 		} else {
 			nr->n2count++;
 			nr_requeue_frames(sk);
@@ -244,5 +244,7 @@ static void nr_t1timer_expiry(unsigned long param)
 	}
 
 	nr_start_t1timer(sk);
+out:
 	bh_unlock_sock(sk);
+	sock_put(sk);
 }

From 0fbf91880c383718ef63add319835165118b0c61 Mon Sep 17 00:00:00 2001
From: Mike Christie <michael.christie@oracle.com>
Date: Wed, 30 Jun 2021 19:25:59 -0500
Subject: [PATCH 2521/2658] scsi: iscsi: Fix iface sysfs attr detection

[ Upstream commit e746f3451ec7f91dcc9fd67a631239c715850a34 ]

A ISCSI_IFACE_PARAM can have the same value as a ISCSI_NET_PARAM so when
iscsi_iface_attr_is_visible tries to figure out the type by just checking
the value, we can collide and return the wrong type. When we call into the
driver we might not match and return that we don't want attr visible in
sysfs. The patch fixes this by setting the type when we figure out what the
param is.

Link: https://lore.kernel.org/r/20210701002559.89533-1-michael.christie@oracle.com
Fixes: 3e0f65b34cc9 ("[SCSI] iscsi_transport: Additional parameters for network settings")
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/scsi_transport_iscsi.c | 90 +++++++++++------------------
 1 file changed, 34 insertions(+), 56 deletions(-)

diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index e0159e6a1065..39d03300d3d9 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -427,39 +427,10 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj,
 	struct device *dev = container_of(kobj, struct device, kobj);
 	struct iscsi_iface *iface = iscsi_dev_to_iface(dev);
 	struct iscsi_transport *t = iface->transport;
-	int param;
-	int param_type;
+	int param = -1;
 
 	if (attr == &dev_attr_iface_enabled.attr)
 		param = ISCSI_NET_PARAM_IFACE_ENABLE;
-	else if (attr == &dev_attr_iface_vlan_id.attr)
-		param = ISCSI_NET_PARAM_VLAN_ID;
-	else if (attr == &dev_attr_iface_vlan_priority.attr)
-		param = ISCSI_NET_PARAM_VLAN_PRIORITY;
-	else if (attr == &dev_attr_iface_vlan_enabled.attr)
-		param = ISCSI_NET_PARAM_VLAN_ENABLED;
-	else if (attr == &dev_attr_iface_mtu.attr)
-		param = ISCSI_NET_PARAM_MTU;
-	else if (attr == &dev_attr_iface_port.attr)
-		param = ISCSI_NET_PARAM_PORT;
-	else if (attr == &dev_attr_iface_ipaddress_state.attr)
-		param = ISCSI_NET_PARAM_IPADDR_STATE;
-	else if (attr == &dev_attr_iface_delayed_ack_en.attr)
-		param = ISCSI_NET_PARAM_DELAYED_ACK_EN;
-	else if (attr == &dev_attr_iface_tcp_nagle_disable.attr)
-		param = ISCSI_NET_PARAM_TCP_NAGLE_DISABLE;
-	else if (attr == &dev_attr_iface_tcp_wsf_disable.attr)
-		param = ISCSI_NET_PARAM_TCP_WSF_DISABLE;
-	else if (attr == &dev_attr_iface_tcp_wsf.attr)
-		param = ISCSI_NET_PARAM_TCP_WSF;
-	else if (attr == &dev_attr_iface_tcp_timer_scale.attr)
-		param = ISCSI_NET_PARAM_TCP_TIMER_SCALE;
-	else if (attr == &dev_attr_iface_tcp_timestamp_en.attr)
-		param = ISCSI_NET_PARAM_TCP_TIMESTAMP_EN;
-	else if (attr == &dev_attr_iface_cache_id.attr)
-		param = ISCSI_NET_PARAM_CACHE_ID;
-	else if (attr == &dev_attr_iface_redirect_en.attr)
-		param = ISCSI_NET_PARAM_REDIRECT_EN;
 	else if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr)
 		param = ISCSI_IFACE_PARAM_DEF_TASKMGMT_TMO;
 	else if (attr == &dev_attr_iface_header_digest.attr)
@@ -496,6 +467,38 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj,
 		param = ISCSI_IFACE_PARAM_STRICT_LOGIN_COMP_EN;
 	else if (attr == &dev_attr_iface_initiator_name.attr)
 		param = ISCSI_IFACE_PARAM_INITIATOR_NAME;
+
+	if (param != -1)
+		return t->attr_is_visible(ISCSI_IFACE_PARAM, param);
+
+	if (attr == &dev_attr_iface_vlan_id.attr)
+		param = ISCSI_NET_PARAM_VLAN_ID;
+	else if (attr == &dev_attr_iface_vlan_priority.attr)
+		param = ISCSI_NET_PARAM_VLAN_PRIORITY;
+	else if (attr == &dev_attr_iface_vlan_enabled.attr)
+		param = ISCSI_NET_PARAM_VLAN_ENABLED;
+	else if (attr == &dev_attr_iface_mtu.attr)
+		param = ISCSI_NET_PARAM_MTU;
+	else if (attr == &dev_attr_iface_port.attr)
+		param = ISCSI_NET_PARAM_PORT;
+	else if (attr == &dev_attr_iface_ipaddress_state.attr)
+		param = ISCSI_NET_PARAM_IPADDR_STATE;
+	else if (attr == &dev_attr_iface_delayed_ack_en.attr)
+		param = ISCSI_NET_PARAM_DELAYED_ACK_EN;
+	else if (attr == &dev_attr_iface_tcp_nagle_disable.attr)
+		param = ISCSI_NET_PARAM_TCP_NAGLE_DISABLE;
+	else if (attr == &dev_attr_iface_tcp_wsf_disable.attr)
+		param = ISCSI_NET_PARAM_TCP_WSF_DISABLE;
+	else if (attr == &dev_attr_iface_tcp_wsf.attr)
+		param = ISCSI_NET_PARAM_TCP_WSF;
+	else if (attr == &dev_attr_iface_tcp_timer_scale.attr)
+		param = ISCSI_NET_PARAM_TCP_TIMER_SCALE;
+	else if (attr == &dev_attr_iface_tcp_timestamp_en.attr)
+		param = ISCSI_NET_PARAM_TCP_TIMESTAMP_EN;
+	else if (attr == &dev_attr_iface_cache_id.attr)
+		param = ISCSI_NET_PARAM_CACHE_ID;
+	else if (attr == &dev_attr_iface_redirect_en.attr)
+		param = ISCSI_NET_PARAM_REDIRECT_EN;
 	else if (iface->iface_type == ISCSI_IFACE_TYPE_IPV4) {
 		if (attr == &dev_attr_ipv4_iface_ipaddress.attr)
 			param = ISCSI_NET_PARAM_IPV4_ADDR;
@@ -586,32 +589,7 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj,
 		return 0;
 	}
 
-	switch (param) {
-	case ISCSI_IFACE_PARAM_DEF_TASKMGMT_TMO:
-	case ISCSI_IFACE_PARAM_HDRDGST_EN:
-	case ISCSI_IFACE_PARAM_DATADGST_EN:
-	case ISCSI_IFACE_PARAM_IMM_DATA_EN:
-	case ISCSI_IFACE_PARAM_INITIAL_R2T_EN:
-	case ISCSI_IFACE_PARAM_DATASEQ_INORDER_EN:
-	case ISCSI_IFACE_PARAM_PDU_INORDER_EN:
-	case ISCSI_IFACE_PARAM_ERL:
-	case ISCSI_IFACE_PARAM_MAX_RECV_DLENGTH:
-	case ISCSI_IFACE_PARAM_FIRST_BURST:
-	case ISCSI_IFACE_PARAM_MAX_R2T:
-	case ISCSI_IFACE_PARAM_MAX_BURST:
-	case ISCSI_IFACE_PARAM_CHAP_AUTH_EN:
-	case ISCSI_IFACE_PARAM_BIDI_CHAP_EN:
-	case ISCSI_IFACE_PARAM_DISCOVERY_AUTH_OPTIONAL:
-	case ISCSI_IFACE_PARAM_DISCOVERY_LOGOUT_EN:
-	case ISCSI_IFACE_PARAM_STRICT_LOGIN_COMP_EN:
-	case ISCSI_IFACE_PARAM_INITIATOR_NAME:
-		param_type = ISCSI_IFACE_PARAM;
-		break;
-	default:
-		param_type = ISCSI_NET_PARAM;
-	}
-
-	return t->attr_is_visible(param_type, param);
+	return t->attr_is_visible(ISCSI_NET_PARAM, param);
 }
 
 static struct attribute *iscsi_iface_attrs[] = {

From ab8ff565c1d72bc8b147dfd0af76980ea31a8a3c Mon Sep 17 00:00:00 2001
From: Dmitry Bogdanov <d.bogdanov@yadro.com>
Date: Fri, 2 Jul 2021 12:16:55 +0300
Subject: [PATCH 2522/2658] scsi: target: Fix protect handling in WRITE
 SAME(32)

[ Upstream commit 6d8e7e7c932162bccd06872362751b0e1d76f5af ]

WRITE SAME(32) command handling reads WRPROTECT at the wrong offset in 1st
byte instead of 10th byte.

Link: https://lore.kernel.org/r/20210702091655.22818-1-d.bogdanov@yadro.com
Fixes: afd73f1b60fc ("target: Perform PROTECT sanity checks for WRITE_SAME")
Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/target/target_core_sbc.c | 35 ++++++++++++++++----------------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 608117819366..a2ffa10e5a41 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -37,7 +37,7 @@
 #include "target_core_alua.h"
 
 static sense_reason_t
-sbc_check_prot(struct se_device *, struct se_cmd *, unsigned char *, u32, bool);
+sbc_check_prot(struct se_device *, struct se_cmd *, unsigned char, u32, bool);
 static sense_reason_t sbc_execute_unmap(struct se_cmd *cmd);
 
 static sense_reason_t
@@ -311,14 +311,14 @@ static inline unsigned long long transport_lba_64_ext(unsigned char *cdb)
 }
 
 static sense_reason_t
-sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *ops)
+sbc_setup_write_same(struct se_cmd *cmd, unsigned char flags, struct sbc_ops *ops)
 {
 	struct se_device *dev = cmd->se_dev;
 	sector_t end_lba = dev->transport->get_blocks(dev) + 1;
 	unsigned int sectors = sbc_get_write_same_sectors(cmd);
 	sense_reason_t ret;
 
-	if ((flags[0] & 0x04) || (flags[0] & 0x02)) {
+	if ((flags & 0x04) || (flags & 0x02)) {
 		pr_err("WRITE_SAME PBDATA and LBDATA"
 			" bits not supported for Block Discard"
 			" Emulation\n");
@@ -340,7 +340,7 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o
 	}
 
 	/* We always have ANC_SUP == 0 so setting ANCHOR is always an error */
-	if (flags[0] & 0x10) {
+	if (flags & 0x10) {
 		pr_warn("WRITE SAME with ANCHOR not supported\n");
 		return TCM_INVALID_CDB_FIELD;
 	}
@@ -348,7 +348,7 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o
 	 * Special case for WRITE_SAME w/ UNMAP=1 that ends up getting
 	 * translated into block discard requests within backend code.
 	 */
-	if (flags[0] & 0x08) {
+	if (flags & 0x08) {
 		if (!ops->execute_unmap)
 			return TCM_UNSUPPORTED_SCSI_OPCODE;
 
@@ -363,7 +363,7 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o
 	if (!ops->execute_write_same)
 		return TCM_UNSUPPORTED_SCSI_OPCODE;
 
-	ret = sbc_check_prot(dev, cmd, &cmd->t_task_cdb[0], sectors, true);
+	ret = sbc_check_prot(dev, cmd, flags >> 5, sectors, true);
 	if (ret)
 		return ret;
 
@@ -721,10 +721,9 @@ sbc_set_prot_op_checks(u8 protect, bool fabric_prot, enum target_prot_type prot_
 }
 
 static sense_reason_t
-sbc_check_prot(struct se_device *dev, struct se_cmd *cmd, unsigned char *cdb,
+sbc_check_prot(struct se_device *dev, struct se_cmd *cmd, unsigned char protect,
 	       u32 sectors, bool is_write)
 {
-	u8 protect = cdb[1] >> 5;
 	int sp_ops = cmd->se_sess->sup_prot_ops;
 	int pi_prot_type = dev->dev_attrib.pi_prot_type;
 	bool fabric_prot = false;
@@ -772,7 +771,7 @@ sbc_check_prot(struct se_device *dev, struct se_cmd *cmd, unsigned char *cdb,
 		/* Fallthrough */
 	default:
 		pr_err("Unable to determine pi_prot_type for CDB: 0x%02x "
-		       "PROTECT: 0x%02x\n", cdb[0], protect);
+		       "PROTECT: 0x%02x\n", cmd->t_task_cdb[0], protect);
 		return TCM_INVALID_CDB_FIELD;
 	}
 
@@ -847,7 +846,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
 		if (sbc_check_dpofua(dev, cmd, cdb))
 			return TCM_INVALID_CDB_FIELD;
 
-		ret = sbc_check_prot(dev, cmd, cdb, sectors, false);
+		ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, false);
 		if (ret)
 			return ret;
 
@@ -861,7 +860,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
 		if (sbc_check_dpofua(dev, cmd, cdb))
 			return TCM_INVALID_CDB_FIELD;
 
-		ret = sbc_check_prot(dev, cmd, cdb, sectors, false);
+		ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, false);
 		if (ret)
 			return ret;
 
@@ -875,7 +874,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
 		if (sbc_check_dpofua(dev, cmd, cdb))
 			return TCM_INVALID_CDB_FIELD;
 
-		ret = sbc_check_prot(dev, cmd, cdb, sectors, false);
+		ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, false);
 		if (ret)
 			return ret;
 
@@ -896,7 +895,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
 		if (sbc_check_dpofua(dev, cmd, cdb))
 			return TCM_INVALID_CDB_FIELD;
 
-		ret = sbc_check_prot(dev, cmd, cdb, sectors, true);
+		ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, true);
 		if (ret)
 			return ret;
 
@@ -910,7 +909,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
 		if (sbc_check_dpofua(dev, cmd, cdb))
 			return TCM_INVALID_CDB_FIELD;
 
-		ret = sbc_check_prot(dev, cmd, cdb, sectors, true);
+		ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, true);
 		if (ret)
 			return ret;
 
@@ -924,7 +923,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
 		if (sbc_check_dpofua(dev, cmd, cdb))
 			return TCM_INVALID_CDB_FIELD;
 
-		ret = sbc_check_prot(dev, cmd, cdb, sectors, true);
+		ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, true);
 		if (ret)
 			return ret;
 
@@ -983,7 +982,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
 			size = sbc_get_size(cmd, 1);
 			cmd->t_task_lba = get_unaligned_be64(&cdb[12]);
 
-			ret = sbc_setup_write_same(cmd, &cdb[10], ops);
+			ret = sbc_setup_write_same(cmd, cdb[10], ops);
 			if (ret)
 				return ret;
 			break;
@@ -1076,7 +1075,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
 		size = sbc_get_size(cmd, 1);
 		cmd->t_task_lba = get_unaligned_be64(&cdb[2]);
 
-		ret = sbc_setup_write_same(cmd, &cdb[1], ops);
+		ret = sbc_setup_write_same(cmd, cdb[1], ops);
 		if (ret)
 			return ret;
 		break;
@@ -1094,7 +1093,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
 		 * Follow sbcr26 with WRITE_SAME (10) and check for the existence
 		 * of byte 1 bit 3 UNMAP instead of original reserved field
 		 */
-		ret = sbc_setup_write_same(cmd, &cdb[1], ops);
+		ret = sbc_setup_write_same(cmd, cdb[1], ops);
 		if (ret)
 			return ret;
 		break;

From 99c4347531444d85572d0d1e4939e4452b165167 Mon Sep 17 00:00:00 2001
From: Vincent Palatin <vpalatin@chromium.org>
Date: Wed, 21 Jul 2021 11:25:16 +0200
Subject: [PATCH 2523/2658] Revert "USB: quirks: ignore remote wake-up on
 Fibocom L850-GL LTE modem"

[ Upstream commit f3a1a937f7b240be623d989c8553a6d01465d04f ]

This reverts commit 0bd860493f81eb2a46173f6f5e44cc38331c8dbd.

While the patch was working as stated,ie preventing the L850-GL LTE modem
from crashing on some U3 wake-ups due to a race condition between the
host wake-up and the modem-side wake-up, when using the MBIM interface,
this would force disabling the USB runtime PM on the device.

The increased power consumption is significant for LTE laptops,
and given that with decently recent modem firmwares, when the modem hits
the bug, it automatically recovers (ie it drops from the bus, but
automatically re-enumerates after less than half a second, rather than being
stuck until a power cycle as it was doing with ancient firmware), for
most people, the trade-off now seems in favor of re-enabling it by
default.

For people with access to the platform code, the bug can also be worked-around
successfully by changing the USB3 LFPM polling off-time for the XHCI
controller in the BIOS code.

Signed-off-by: Vincent Palatin <vpalatin@chromium.org>
Link: https://lore.kernel.org/r/20210721092516.2775971-1-vpalatin@chromium.org
Fixes: 0bd860493f81 ("USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/core/quirks.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 3dfd584a1ef3..2ca6ed207e26 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -325,10 +325,6 @@ static const struct usb_device_id usb_quirk_list[] = {
 	/* DJI CineSSD */
 	{ USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
 
-	/* Fibocom L850-GL LTE Modem */
-	{ USB_DEVICE(0x2cb7, 0x0007), .driver_info =
-			USB_QUIRK_IGNORE_REMOTE_WAKEUP },
-
 	/* INTEL VALUE SSD */
 	{ USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
 

From 9f6bbb127ed59cb12c11c159b9ba2da48beec5c8 Mon Sep 17 00:00:00 2001
From: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>
Date: Wed, 30 Jun 2021 18:54:38 -0700
Subject: [PATCH 2524/2658] proc: Avoid mixing integer types in mem_rw()

[ Upstream commit d238692b4b9f2c36e35af4c6e6f6da36184aeb3e ]

Use size_t when capping the count argument received by mem_rw(). Since
count is size_t, using min_t(int, ...) can lead to a negative value
that will later be passed to access_remote_vm(), which can cause
unexpected behavior.

Since we are capping the value to at maximum PAGE_SIZE, the conversion
from size_t to int when passing it to access_remote_vm() as "len"
shouldn't be a problem.

Link: https://lkml.kernel.org/r/20210512125215.3348316-1-marcelo.cerri@canonical.com
Reviewed-by: David Disseldorp <ddiss@suse.de>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Souza Cascardo <cascardo@canonical.com>
Cc: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Helge Deller <deller@gmx.de>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/proc/base.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index c19d6fec6451..b99e77e36f3d 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -888,7 +888,7 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
 		flags |= FOLL_WRITE;
 
 	while (count > 0) {
-		int this_len = min_t(int, count, PAGE_SIZE);
+		size_t this_len = min_t(size_t, count, PAGE_SIZE);
 
 		if (write && copy_from_user(page, buf, this_len)) {
 			copied = -EFAULT;

From f0db122d17416b57bc2af334b8f72c1b0c59e210 Mon Sep 17 00:00:00 2001
From: Vasily Gorbik <gor@linux.ibm.com>
Date: Fri, 25 Jun 2021 23:50:07 +0200
Subject: [PATCH 2525/2658] s390/ftrace: fix ftrace_update_ftrace_func
 implementation

commit f8c2602733c953ed7a16e060640b8e96f9d94b9b upstream.

s390 enforces DYNAMIC_FTRACE if FUNCTION_TRACER is selected.
At the same time implementation of ftrace_caller is not compliant with
HAVE_DYNAMIC_FTRACE since it doesn't provide implementation of
ftrace_update_ftrace_func() and calls ftrace_trace_function() directly.

The subtle difference is that during ftrace code patching ftrace
replaces function tracer via ftrace_update_ftrace_func() and activates
it back afterwards. Unexpected direct calls to ftrace_trace_function()
during ftrace code patching leads to nullptr-dereferences when tracing
is activated for one of functions which are used during code patching.
Those function currently are:
copy_from_kernel_nofault()
copy_from_kernel_nofault_allowed()
preempt_count_sub() [with debug_defconfig]
preempt_count_add() [with debug_defconfig]

Corresponding KASAN report:
 BUG: KASAN: nullptr-dereference in function_trace_call+0x316/0x3b0
 Read of size 4 at addr 0000000000001e08 by task migration/0/15

 CPU: 0 PID: 15 Comm: migration/0 Tainted: G B 5.13.0-41423-g08316af3644d
 Hardware name: IBM 3906 M04 704 (LPAR)
 Stopper: multi_cpu_stop+0x0/0x3e0 <- stop_machine_cpuslocked+0x1e4/0x218
 Call Trace:
  [<0000000001f77caa>] show_stack+0x16a/0x1d0
  [<0000000001f8de42>] dump_stack+0x15a/0x1b0
  [<0000000001f81d56>] print_address_description.constprop.0+0x66/0x2e0
  [<000000000082b0ca>] kasan_report+0x152/0x1c0
  [<00000000004cfd8e>] function_trace_call+0x316/0x3b0
  [<0000000001fb7082>] ftrace_caller+0x7a/0x7e
  [<00000000006bb3e6>] copy_from_kernel_nofault_allowed+0x6/0x10
  [<00000000006bb42e>] copy_from_kernel_nofault+0x3e/0xd0
  [<000000000014605c>] ftrace_make_call+0xb4/0x1f8
  [<000000000047a1b4>] ftrace_replace_code+0x134/0x1d8
  [<000000000047a6e0>] ftrace_modify_all_code+0x120/0x1d0
  [<000000000047a7ec>] __ftrace_modify_code+0x5c/0x78
  [<000000000042395c>] multi_cpu_stop+0x224/0x3e0
  [<0000000000423212>] cpu_stopper_thread+0x33a/0x5a0
  [<0000000000243ff2>] smpboot_thread_fn+0x302/0x708
  [<00000000002329ea>] kthread+0x342/0x408
  [<00000000001066b2>] __ret_from_fork+0x92/0xf0
  [<0000000001fb57fa>] ret_from_fork+0xa/0x30

 The buggy address belongs to the page:
 page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1
 flags: 0x1ffff00000001000(reserved|node=0|zone=0|lastcpupid=0x1ffff)
 raw: 1ffff00000001000 0000040000000048 0000040000000048 0000000000000000
 raw: 0000000000000000 0000000000000000 ffffffff00000001 0000000000000000
 page dumped because: kasan: bad access detected

 Memory state around the buggy address:
  0000000000001d00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0000000000001d80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 >0000000000001e00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
                       ^
  0000000000001e80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0000000000001f00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
 ==================================================================

To fix that introduce ftrace_func callback to be called from
ftrace_caller and update it in ftrace_update_ftrace_func().

Fixes: 4cc9bed034d1 ("[S390] cleanup ftrace backend functions")
Cc: stable@vger.kernel.org
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/include/asm/ftrace.h | 1 +
 arch/s390/kernel/ftrace.c      | 2 ++
 arch/s390/kernel/mcount.S      | 4 ++--
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/arch/s390/include/asm/ftrace.h b/arch/s390/include/asm/ftrace.h
index 836c56290499..6dd874d5ba7b 100644
--- a/arch/s390/include/asm/ftrace.h
+++ b/arch/s390/include/asm/ftrace.h
@@ -19,6 +19,7 @@ void ftrace_caller(void);
 
 extern char ftrace_graph_caller_end;
 extern unsigned long ftrace_plt;
+extern void *ftrace_func;
 
 struct dyn_arch_ftrace { };
 
diff --git a/arch/s390/kernel/ftrace.c b/arch/s390/kernel/ftrace.c
index e0eaf11134b4..6617fae13bd3 100644
--- a/arch/s390/kernel/ftrace.c
+++ b/arch/s390/kernel/ftrace.c
@@ -55,6 +55,7 @@
  * >	brasl	%r0,ftrace_caller	# offset 0
  */
 
+void *ftrace_func __read_mostly = ftrace_stub;
 unsigned long ftrace_plt;
 
 static inline void ftrace_generate_orig_insn(struct ftrace_insn *insn)
@@ -164,6 +165,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
 
 int ftrace_update_ftrace_func(ftrace_func_t func)
 {
+	ftrace_func = func;
 	return 0;
 }
 
diff --git a/arch/s390/kernel/mcount.S b/arch/s390/kernel/mcount.S
index 68425e68e65a..9eb55077896c 100644
--- a/arch/s390/kernel/mcount.S
+++ b/arch/s390/kernel/mcount.S
@@ -56,13 +56,13 @@ ENTRY(ftrace_caller)
 #ifdef CONFIG_HAVE_MARCH_Z196_FEATURES
 	aghik	%r2,%r0,-MCOUNT_INSN_SIZE
 	lgrl	%r4,function_trace_op
-	lgrl	%r1,ftrace_trace_function
+	lgrl	%r1,ftrace_func
 #else
 	lgr	%r2,%r0
 	aghi	%r2,-MCOUNT_INSN_SIZE
 	larl	%r4,function_trace_op
 	lg	%r4,0(%r4)
-	larl	%r1,ftrace_trace_function
+	larl	%r1,ftrace_func
 	lg	%r1,0(%r1)
 #endif
 	lgr	%r3,%r14

From 0a3e8549113ef87b7ab92c76220af47830d19002 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Fri, 16 Jul 2021 15:27:23 +0200
Subject: [PATCH 2526/2658] ALSA: sb: Fix potential ABBA deadlock in CSP driver

commit 1c2b9519159b470ef24b2638f4794e86e2952ab7 upstream.

SB16 CSP driver may hit potentially a typical ABBA deadlock in two
code paths:

 In snd_sb_csp_stop():
     spin_lock_irqsave(&p->chip->mixer_lock, flags);
     spin_lock(&p->chip->reg_lock);

 In snd_sb_csp_load():
     spin_lock_irqsave(&p->chip->reg_lock, flags);
     spin_lock(&p->chip->mixer_lock);

Also the similar pattern is seen in snd_sb_csp_start().

Although the practical impact is very small (those states aren't
triggered in the same running state and this happens only on a real
hardware, decades old ISA sound boards -- which must be very difficult
to find nowadays), it's a real scenario and has to be fixed.

This patch addresses those deadlocks by splitting the locks in
snd_sb_csp_start() and snd_sb_csp_stop() for avoiding the nested
locks.

Reported-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/7b0fcdaf-cd4f-4728-2eae-48c151a92e10@gmail.com
Link: https://lore.kernel.org/r/20210716132723.13216-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/isa/sb/sb16_csp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c
index 90fa57ad14c0..23834691f4d3 100644
--- a/sound/isa/sb/sb16_csp.c
+++ b/sound/isa/sb/sb16_csp.c
@@ -828,6 +828,7 @@ static int snd_sb_csp_start(struct snd_sb_csp * p, int sample_width, int channel
 	mixR = snd_sbmixer_read(p->chip, SB_DSP4_PCM_DEV + 1);
 	snd_sbmixer_write(p->chip, SB_DSP4_PCM_DEV, mixL & 0x7);
 	snd_sbmixer_write(p->chip, SB_DSP4_PCM_DEV + 1, mixR & 0x7);
+	spin_unlock_irqrestore(&p->chip->mixer_lock, flags);
 
 	spin_lock(&p->chip->reg_lock);
 	set_mode_register(p->chip, 0xc0);	/* c0 = STOP */
@@ -867,6 +868,7 @@ static int snd_sb_csp_start(struct snd_sb_csp * p, int sample_width, int channel
 	spin_unlock(&p->chip->reg_lock);
 
 	/* restore PCM volume */
+	spin_lock_irqsave(&p->chip->mixer_lock, flags);
 	snd_sbmixer_write(p->chip, SB_DSP4_PCM_DEV, mixL);
 	snd_sbmixer_write(p->chip, SB_DSP4_PCM_DEV + 1, mixR);
 	spin_unlock_irqrestore(&p->chip->mixer_lock, flags);
@@ -892,6 +894,7 @@ static int snd_sb_csp_stop(struct snd_sb_csp * p)
 	mixR = snd_sbmixer_read(p->chip, SB_DSP4_PCM_DEV + 1);
 	snd_sbmixer_write(p->chip, SB_DSP4_PCM_DEV, mixL & 0x7);
 	snd_sbmixer_write(p->chip, SB_DSP4_PCM_DEV + 1, mixR & 0x7);
+	spin_unlock_irqrestore(&p->chip->mixer_lock, flags);
 
 	spin_lock(&p->chip->reg_lock);
 	if (p->running & SNDRV_SB_CSP_ST_QSOUND) {
@@ -906,6 +909,7 @@ static int snd_sb_csp_stop(struct snd_sb_csp * p)
 	spin_unlock(&p->chip->reg_lock);
 
 	/* restore PCM volume */
+	spin_lock_irqsave(&p->chip->mixer_lock, flags);
 	snd_sbmixer_write(p->chip, SB_DSP4_PCM_DEV, mixL);
 	snd_sbmixer_write(p->chip, SB_DSP4_PCM_DEV + 1, mixR);
 	spin_unlock_irqrestore(&p->chip->mixer_lock, flags);

From 85e8ef0029a2e9b23653833a9a78c3c5c63321eb Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Thu, 15 Jul 2021 18:06:51 +0300
Subject: [PATCH 2527/2658] xhci: Fix lost USB 2 remote wake

commit 72f68bf5c756f5ce1139b31daae2684501383ad5 upstream.

There's a small window where a USB 2 remote wake may be left unhandled
due to a race between hub thread and xhci port event interrupt handler.

When the resume event is detected in the xhci interrupt handler it kicks
the hub timer, which should move the port from resume to U0 once resume
has been signalled for long enough.

To keep the hub "thread" running we set a bus_state->resuming_ports flag.
This flag makes sure hub timer function kicks itself.

checking this flag was not properly protected by the spinlock. Flag was
copied to a local variable before lock was taken. The local variable was
then checked later with spinlock held.

If interrupt is handled right after copying the flag to the local variable
we end up stopping the hub thread before it can handle the USB 2 resume.

CPU0					CPU1
(hub thread)				(xhci event handler)

xhci_hub_status_data()
status = bus_state->resuming_ports;
					<Interrupt>
					handle_port_status()
					spin_lock()
					bus_state->resuming_ports = 1
					set_flag(HCD_FLAG_POLL_RH)
					spin_unlock()
spin_lock()
if (!status)
  clear_flag(HCD_FLAG_POLL_RH)
spin_unlock()

Fix this by taking the lock a bit earlier so that it covers
the resuming_ports flag copy in the hub thread

Cc: <stable@vger.kernel.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20210715150651.1996099-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-hub.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index d57c6cfb7412..353a6f1f5109 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1443,11 +1443,12 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
 	 * Inform the usbcore about resume-in-progress by returning
 	 * a non-zero value even if there are no status changes.
 	 */
+	spin_lock_irqsave(&xhci->lock, flags);
+
 	status = bus_state->resuming_ports;
 
 	mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC;
 
-	spin_lock_irqsave(&xhci->lock, flags);
 	/* For each port, did anything change?  If so, set that bit in buf. */
 	for (i = 0; i < max_ports; i++) {
 		temp = readl(port_array[i]);

From 63ddfa6806545d3820d3eccc703efd7326d74e7b Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Tue, 20 Jul 2021 20:43:09 +1000
Subject: [PATCH 2528/2658] KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow

commit f62f3c20647ebd5fb6ecb8f0b477b9281c44c10a upstream.

The kvmppc_rtas_hcall() sets the host rtas_args.rets pointer based on
the rtas_args.nargs that was provided by the guest. That guest nargs
value is not range checked, so the guest can cause the host rets pointer
to be pointed outside the args array. The individual rtas function
handlers check the nargs and nrets values to ensure they are correct,
but if they are not, the handlers store a -3 (0xfffffffd) failure
indication in rets[0] which corrupts host memory.

Fix this by testing up front whether the guest supplied nargs and nret
would exceed the array size, and fail the hcall directly without storing
a failure indication to rets[0].

Also expand on a comment about why we kill the guest and try not to
return errors directly if we have a valid rets[0] pointer.

Fixes: 8e591cb72047 ("KVM: PPC: Book3S: Add infrastructure to implement kernel-side RTAS calls")
Cc: stable@vger.kernel.org # v3.10+
Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kvm/book3s_rtas.c | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/kvm/book3s_rtas.c b/arch/powerpc/kvm/book3s_rtas.c
index b1b2273d1f6d..308744830f55 100644
--- a/arch/powerpc/kvm/book3s_rtas.c
+++ b/arch/powerpc/kvm/book3s_rtas.c
@@ -230,6 +230,17 @@ int kvmppc_rtas_hcall(struct kvm_vcpu *vcpu)
 	 * value so we can restore it on the way out.
 	 */
 	orig_rets = args.rets;
+	if (be32_to_cpu(args.nargs) >= ARRAY_SIZE(args.args)) {
+		/*
+		 * Don't overflow our args array: ensure there is room for
+		 * at least rets[0] (even if the call specifies 0 nret).
+		 *
+		 * Each handler must then check for the correct nargs and nret
+		 * values, but they may always return failure in rets[0].
+		 */
+		rc = -EINVAL;
+		goto fail;
+	}
 	args.rets = &args.args[be32_to_cpu(args.nargs)];
 
 	mutex_lock(&vcpu->kvm->arch.rtas_token_lock);
@@ -257,9 +268,17 @@ int kvmppc_rtas_hcall(struct kvm_vcpu *vcpu)
 fail:
 	/*
 	 * We only get here if the guest has called RTAS with a bogus
-	 * args pointer. That means we can't get to the args, and so we
-	 * can't fail the RTAS call. So fail right out to userspace,
-	 * which should kill the guest.
+	 * args pointer or nargs/nret values that would overflow the
+	 * array. That means we can't get to the args, and so we can't
+	 * fail the RTAS call. So fail right out to userspace, which
+	 * should kill the guest.
+	 *
+	 * SLOF should actually pass the hcall return value from the
+	 * rtas handler call in r3, so enter_rtas could be modified to
+	 * return a failure indication in r3 and we could return such
+	 * errors to the guest rather than failing to host userspace.
+	 * However old guests that don't test for failure could then
+	 * continue silently after errors, so for now we won't do this.
 	 */
 	return rc;
 }

From c34494745fe431f28b0578ab2827009b63b98bbc Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Thu, 15 Jul 2021 18:01:22 +0300
Subject: [PATCH 2529/2658] usb: hub: Disable USB 3 device initiated lpm if
 exit latency is too high

commit 1b7f56fbc7a1b66967b6114d1b5f5a257c3abae6 upstream.

The device initiated link power management U1/U2 states should not be
enabled in case the system exit latency plus one bus interval (125us) is
greater than the shortest service interval of any periodic endpoint.

This is the case for both U1 and U2 sytstem exit latencies and link states.

See USB 3.2 section 9.4.9 "Set Feature" for more details

Note, before this patch the host and device initiated U1/U2 lpm states
were both enabled with lpm. After this patch it's possible to end up with
only host inititated U1/U2 lpm in case the exit latencies won't allow
device initiated lpm.

If this case we still want to set the udev->usb3_lpm_ux_enabled flag so
that sysfs users can see the link may go to U1/U2.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210715150122.1995966-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/hub.c | 68 ++++++++++++++++++++++++++++++++++--------
 1 file changed, 56 insertions(+), 12 deletions(-)

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 5fa874c75a82..e8427077c0e2 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -3852,6 +3852,47 @@ static int usb_set_lpm_timeout(struct usb_device *udev,
 	return 0;
 }
 
+/*
+ * Don't allow device intiated U1/U2 if the system exit latency + one bus
+ * interval is greater than the minimum service interval of any active
+ * periodic endpoint. See USB 3.2 section 9.4.9
+ */
+static bool usb_device_may_initiate_lpm(struct usb_device *udev,
+					enum usb3_link_state state)
+{
+	unsigned int sel;		/* us */
+	int i, j;
+
+	if (state == USB3_LPM_U1)
+		sel = DIV_ROUND_UP(udev->u1_params.sel, 1000);
+	else if (state == USB3_LPM_U2)
+		sel = DIV_ROUND_UP(udev->u2_params.sel, 1000);
+	else
+		return false;
+
+	for (i = 0; i < udev->actconfig->desc.bNumInterfaces; i++) {
+		struct usb_interface *intf;
+		struct usb_endpoint_descriptor *desc;
+		unsigned int interval;
+
+		intf = udev->actconfig->interface[i];
+		if (!intf)
+			continue;
+
+		for (j = 0; j < intf->cur_altsetting->desc.bNumEndpoints; j++) {
+			desc = &intf->cur_altsetting->endpoint[j].desc;
+
+			if (usb_endpoint_xfer_int(desc) ||
+			    usb_endpoint_xfer_isoc(desc)) {
+				interval = (1 << (desc->bInterval - 1)) * 125;
+				if (sel + 125 > interval)
+					return false;
+			}
+		}
+	}
+	return true;
+}
+
 /*
  * Enable the hub-initiated U1/U2 idle timeouts, and enable device-initiated
  * U1/U2 entry.
@@ -3924,20 +3965,23 @@ static void usb_enable_link_state(struct usb_hcd *hcd, struct usb_device *udev,
 	 * U1/U2_ENABLE
 	 */
 	if (udev->actconfig &&
-	    usb_set_device_initiated_lpm(udev, state, true) == 0) {
-		if (state == USB3_LPM_U1)
-			udev->usb3_lpm_u1_enabled = 1;
-		else if (state == USB3_LPM_U2)
-			udev->usb3_lpm_u2_enabled = 1;
-	} else {
-		/* Don't request U1/U2 entry if the device
-		 * cannot transition to U1/U2.
-		 */
-		usb_set_lpm_timeout(udev, state, 0);
-		hcd->driver->disable_usb3_lpm_timeout(hcd, udev, state);
+	    usb_device_may_initiate_lpm(udev, state)) {
+		if (usb_set_device_initiated_lpm(udev, state, true)) {
+			/*
+			 * Request to enable device initiated U1/U2 failed,
+			 * better to turn off lpm in this case.
+			 */
+			usb_set_lpm_timeout(udev, state, 0);
+			hcd->driver->disable_usb3_lpm_timeout(hcd, udev, state);
+			return;
+		}
 	}
-}
 
+	if (state == USB3_LPM_U1)
+		udev->usb3_lpm_u1_enabled = 1;
+	else if (state == USB3_LPM_U2)
+		udev->usb3_lpm_u2_enabled = 1;
+}
 /*
  * Disable the hub-initiated U1/U2 idle timeouts, and disable device-initiated
  * U1/U2 entry.

From ce3b9d10a3a2a3cc8d5aeb3df4e63195b5ea9d2c Mon Sep 17 00:00:00 2001
From: Julian Sikorski <belegdol@gmail.com>
Date: Tue, 20 Jul 2021 19:19:10 +0200
Subject: [PATCH 2530/2658] USB: usb-storage: Add LaCie Rugged USB3-FW to
 IGNORE_UAS

commit 6abf2fe6b4bf6e5256b80c5817908151d2d33e9f upstream.

LaCie Rugged USB3-FW appears to be incompatible with UAS. It generates
errors like:
[ 1151.582598] sd 14:0:0:0: tag#16 uas_eh_abort_handler 0 uas-tag 1 inflight: IN
[ 1151.582602] sd 14:0:0:0: tag#16 CDB: Report supported operation codes a3 0c 01 12 00 00 00 00 02 00 00 00
[ 1151.588594] scsi host14: uas_eh_device_reset_handler start
[ 1151.710482] usb 2-4: reset SuperSpeed Gen 1 USB device number 2 using xhci_hcd
[ 1151.741398] scsi host14: uas_eh_device_reset_handler success
[ 1181.785534] scsi host14: uas_eh_device_reset_handler start

Signed-off-by: Julian Sikorski <belegdol+github@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210720171910.36497-1-belegdol+github@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/unusual_uas.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index 7f4245b01bae..648130903b03 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -54,6 +54,13 @@ UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x9999,
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_NO_REPORT_OPCODES),
 
+/* Reported-by: Julian Sikorski <belegdol@gmail.com> */
+UNUSUAL_DEV(0x059f, 0x1061, 0x0000, 0x9999,
+		"LaCie",
+		"Rugged USB3-FW",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_IGNORE_UAS),
+
 /*
  * Apricorn USB3 dongle sometimes returns "USBSUSBSUSBS" in response to SCSI
  * commands in UAS mode.  Observed with the 1.28 firmware; are there others?

From 6352467521af35a15e72cc3851490a3238d55f39 Mon Sep 17 00:00:00 2001
From: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
Date: Fri, 25 Jun 2021 15:14:56 +1200
Subject: [PATCH 2531/2658] usb: max-3421: Prevent corruption of freed memory

commit b5fdf5c6e6bee35837e160c00ac89327bdad031b upstream.

The MAX-3421 USB driver remembers the state of the USB toggles for a
device/endpoint. To save SPI writes, this was only done when a new
device/endpoint was being used. Unfortunately, if the old device was
removed, this would cause writes to freed memory.

To fix this, a simpler scheme is used. The toggles are read from
hardware when a URB is completed, and the toggles are always written to
hardware when any URB transaction is started. This will cause a few more
SPI transactions, but no causes kernel panics.

Fixes: 2d53139f3162 ("Add support for using a MAX3421E chip as a host driver.")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
Link: https://lore.kernel.org/r/20210625031456.8632-1-mark.tomlinson@alliedtelesis.co.nz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/max3421-hcd.c | 44 +++++++++++-----------------------
 1 file changed, 14 insertions(+), 30 deletions(-)

diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index bd98706d1ce9..2f8a5fa28a80 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -149,8 +149,6 @@ struct max3421_hcd {
 	 */
 	struct urb *curr_urb;
 	enum scheduling_pass sched_pass;
-	struct usb_device *loaded_dev;	/* dev that's loaded into the chip */
-	int loaded_epnum;		/* epnum whose toggles are loaded */
 	int urb_done;			/* > 0 -> no errors, < 0: errno */
 	size_t curr_len;
 	u8 hien;
@@ -488,39 +486,17 @@ max3421_set_speed(struct usb_hcd *hcd, struct usb_device *dev)
  * Caller must NOT hold HCD spinlock.
  */
 static void
-max3421_set_address(struct usb_hcd *hcd, struct usb_device *dev, int epnum,
-		    int force_toggles)
+max3421_set_address(struct usb_hcd *hcd, struct usb_device *dev, int epnum)
 {
-	struct max3421_hcd *max3421_hcd = hcd_to_max3421(hcd);
-	int old_epnum, same_ep, rcvtog, sndtog;
-	struct usb_device *old_dev;
+	int rcvtog, sndtog;
 	u8 hctl;
 
-	old_dev = max3421_hcd->loaded_dev;
-	old_epnum = max3421_hcd->loaded_epnum;
-
-	same_ep = (dev == old_dev && epnum == old_epnum);
-	if (same_ep && !force_toggles)
-		return;
-
-	if (old_dev && !same_ep) {
-		/* save the old end-points toggles: */
-		u8 hrsl = spi_rd8(hcd, MAX3421_REG_HRSL);
-
-		rcvtog = (hrsl >> MAX3421_HRSL_RCVTOGRD_BIT) & 1;
-		sndtog = (hrsl >> MAX3421_HRSL_SNDTOGRD_BIT) & 1;
-
-		/* no locking: HCD (i.e., we) own toggles, don't we? */
-		usb_settoggle(old_dev, old_epnum, 0, rcvtog);
-		usb_settoggle(old_dev, old_epnum, 1, sndtog);
-	}
 	/* setup new endpoint's toggle bits: */
 	rcvtog = usb_gettoggle(dev, epnum, 0);
 	sndtog = usb_gettoggle(dev, epnum, 1);
 	hctl = (BIT(rcvtog + MAX3421_HCTL_RCVTOG0_BIT) |
 		BIT(sndtog + MAX3421_HCTL_SNDTOG0_BIT));
 
-	max3421_hcd->loaded_epnum = epnum;
 	spi_wr8(hcd, MAX3421_REG_HCTL, hctl);
 
 	/*
@@ -528,7 +504,6 @@ max3421_set_address(struct usb_hcd *hcd, struct usb_device *dev, int epnum,
 	 * address-assignment so it's best to just always load the
 	 * address whenever the end-point changed/was forced.
 	 */
-	max3421_hcd->loaded_dev = dev;
 	spi_wr8(hcd, MAX3421_REG_PERADDR, dev->devnum);
 }
 
@@ -663,7 +638,7 @@ max3421_select_and_start_urb(struct usb_hcd *hcd)
 	struct max3421_hcd *max3421_hcd = hcd_to_max3421(hcd);
 	struct urb *urb, *curr_urb = NULL;
 	struct max3421_ep *max3421_ep;
-	int epnum, force_toggles = 0;
+	int epnum;
 	struct usb_host_endpoint *ep;
 	struct list_head *pos;
 	unsigned long flags;
@@ -773,7 +748,6 @@ max3421_select_and_start_urb(struct usb_hcd *hcd)
 			usb_settoggle(urb->dev, epnum, 0, 1);
 			usb_settoggle(urb->dev, epnum, 1, 1);
 			max3421_ep->pkt_state = PKT_STATE_SETUP;
-			force_toggles = 1;
 		} else
 			max3421_ep->pkt_state = PKT_STATE_TRANSFER;
 	}
@@ -781,7 +755,7 @@ max3421_select_and_start_urb(struct usb_hcd *hcd)
 	spin_unlock_irqrestore(&max3421_hcd->lock, flags);
 
 	max3421_ep->last_active = max3421_hcd->frame_number;
-	max3421_set_address(hcd, urb->dev, epnum, force_toggles);
+	max3421_set_address(hcd, urb->dev, epnum);
 	max3421_set_speed(hcd, urb->dev);
 	max3421_next_transfer(hcd, 0);
 	return 1;
@@ -1382,6 +1356,16 @@ max3421_urb_done(struct usb_hcd *hcd)
 		status = 0;
 	urb = max3421_hcd->curr_urb;
 	if (urb) {
+		/* save the old end-points toggles: */
+		u8 hrsl = spi_rd8(hcd, MAX3421_REG_HRSL);
+		int rcvtog = (hrsl >> MAX3421_HRSL_RCVTOGRD_BIT) & 1;
+		int sndtog = (hrsl >> MAX3421_HRSL_SNDTOGRD_BIT) & 1;
+		int epnum = usb_endpoint_num(&urb->ep->desc);
+
+		/* no locking: HCD (i.e., we) own toggles, don't we? */
+		usb_settoggle(urb->dev, epnum, 0, rcvtog);
+		usb_settoggle(urb->dev, epnum, 1, sndtog);
+
 		max3421_hcd->curr_urb = NULL;
 		spin_lock_irqsave(&max3421_hcd->lock, flags);
 		usb_hcd_unlink_urb_from_ep(hcd, urb);

From 5a8d8c6b985a7a0a46fd25266393d116f7bcf9c1 Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Date: Thu, 24 Jun 2021 21:20:39 +0900
Subject: [PATCH 2532/2658] usb: renesas_usbhs: Fix superfluous irqs happen
 after usb_pkt_pop()

commit 5719df243e118fb343725e8b2afb1637e1af1373 upstream.

This driver has a potential issue which this driver is possible to
cause superfluous irqs after usb_pkt_pop() is called. So, after
the commit 3af32605289e ("usb: renesas_usbhs: fix error return
code of usbhsf_pkt_handler()") had been applied, we could observe
the following error happened when we used g_audio.

    renesas_usbhs e6590000.usb: irq_ready run_error 1 : -22

To fix the issue, disable the tx or rx interrupt in usb_pkt_pop().

Fixes: 2743e7f90dc0 ("usb: renesas_usbhs: fix the usb_pkt_pop()")
Cc: <stable@vger.kernel.org> # v4.4+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/20210624122039.596528-1-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/renesas_usbhs/fifo.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index 7d329c6bc65f..793bd764385a 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -115,6 +115,8 @@ static struct dma_chan *usbhsf_dma_chan_get(struct usbhs_fifo *fifo,
 #define usbhsf_dma_map(p)	__usbhsf_dma_map_ctrl(p, 1)
 #define usbhsf_dma_unmap(p)	__usbhsf_dma_map_ctrl(p, 0)
 static int __usbhsf_dma_map_ctrl(struct usbhs_pkt *pkt, int map);
+static void usbhsf_tx_irq_ctrl(struct usbhs_pipe *pipe, int enable);
+static void usbhsf_rx_irq_ctrl(struct usbhs_pipe *pipe, int enable);
 struct usbhs_pkt *usbhs_pkt_pop(struct usbhs_pipe *pipe, struct usbhs_pkt *pkt)
 {
 	struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe);
@@ -138,6 +140,11 @@ struct usbhs_pkt *usbhs_pkt_pop(struct usbhs_pipe *pipe, struct usbhs_pkt *pkt)
 			dmaengine_terminate_all(chan);
 			usbhsf_fifo_clear(pipe, fifo);
 			usbhsf_dma_unmap(pkt);
+		} else {
+			if (usbhs_pipe_is_dir_in(pipe))
+				usbhsf_rx_irq_ctrl(pipe, 0);
+			else
+				usbhsf_tx_irq_ctrl(pipe, 0);
 		}
 
 		usbhs_pipe_running(pipe, 0);

From aee1a0942459b99cac1055111942b77ca838043d Mon Sep 17 00:00:00 2001
From: Marco De Marco <marco.demarco@posteo.net>
Date: Mon, 5 Jul 2021 19:44:21 +0000
Subject: [PATCH 2533/2658] USB: serial: option: add support for u-blox LARA-R6
 family

commit 94b619a07655805a1622484967754f5848640456 upstream.

The patch is meant to support LARA-R6 Cat 1 module family.

Module USB ID:
Vendor  ID: 0x05c6
Product ID: 0x90fA

Interface layout:
If 0: Diagnostic
If 1: AT parser
If 2: AT parser
If 3: QMI wwan (not available in all versions)

Signed-off-by: Marco De Marco <marco.demarco@posteo.net>
Link: https://lore.kernel.org/r/49260184.kfMIbaSn9k@mars
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 6faa9ac53887..b9017e85cc1a 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -241,6 +241,7 @@ static void option_instat_callback(struct urb *urb);
 #define QUECTEL_PRODUCT_UC15			0x9090
 /* These u-blox products use Qualcomm's vendor ID */
 #define UBLOX_PRODUCT_R410M			0x90b2
+#define UBLOX_PRODUCT_R6XX			0x90fa
 /* These Yuga products use Qualcomm's vendor ID */
 #define YUGA_PRODUCT_CLM920_NC5			0x9625
 
@@ -1098,6 +1099,8 @@ static const struct usb_device_id option_ids[] = {
 	/* u-blox products using Qualcomm vendor ID */
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R410M),
 	  .driver_info = RSVD(1) | RSVD(3) },
+	{ USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R6XX),
+	  .driver_info = RSVD(3) },
 	/* Quectel products using Quectel vendor ID */
 	{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21),
 	  .driver_info = RSVD(4) },

From 7fbce43cb695ce2b272e0debb1746e7efbd44339 Mon Sep 17 00:00:00 2001
From: Ian Ray <ian.ray@ge.com>
Date: Mon, 19 Jul 2021 18:43:49 +0200
Subject: [PATCH 2534/2658] USB: serial: cp210x: fix comments for GE CS1000

commit e9db418d4b828dd049caaf5ed65dc86f93bb1a0c upstream.

Fix comments for GE CS1000 CP210x USB ID assignments.

Fixes: 42213a0190b5 ("USB: serial: cp210x: add some more GE USB IDs")
Signed-off-by: Ian Ray <ian.ray@ge.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/cp210x.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 91462ff9a99d..dd1a37900edc 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -199,8 +199,8 @@ static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(0x1901, 0x0194) },	/* GE Healthcare Remote Alarm Box */
 	{ USB_DEVICE(0x1901, 0x0195) },	/* GE B850/B650/B450 CP2104 DP UART interface */
 	{ USB_DEVICE(0x1901, 0x0196) },	/* GE B850 CP2105 DP UART interface */
-	{ USB_DEVICE(0x1901, 0x0197) }, /* GE CS1000 Display serial interface */
-	{ USB_DEVICE(0x1901, 0x0198) }, /* GE CS1000 M.2 Key E serial interface */
+	{ USB_DEVICE(0x1901, 0x0197) }, /* GE CS1000 M.2 Key E serial interface */
+	{ USB_DEVICE(0x1901, 0x0198) }, /* GE CS1000 Display serial interface */
 	{ USB_DEVICE(0x199B, 0xBA30) }, /* LORD WSDA-200-USB */
 	{ USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */
 	{ USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */

From 396ce38f2a0e7f6c802e830e457b0e89d3e155d5 Mon Sep 17 00:00:00 2001
From: John Keeping <john@metanate.com>
Date: Wed, 21 Jul 2021 17:17:45 +0100
Subject: [PATCH 2535/2658] USB: serial: cp210x: add ID for CEL EM3588 USB
 ZigBee stick

commit d6a206e60124a9759dd7f6dfb86b0e1d3b1df82e upstream.

Add the USB serial device ID for the CEL ZigBee EM3588 radio stick.

Signed-off-by: John Keeping <john@metanate.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/cp210x.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index dd1a37900edc..f039b85d5f57 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -152,6 +152,7 @@ static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(0x10C4, 0x89A4) }, /* CESINEL FTBC Flexible Thyristor Bridge Controller */
 	{ USB_DEVICE(0x10C4, 0x89FB) }, /* Qivicon ZigBee USB Radio Stick */
 	{ USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
+	{ USB_DEVICE(0x10C4, 0x8A5B) }, /* CEL EM3588 ZigBee USB Stick */
 	{ USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */
 	{ USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */
 	{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */

From 877f11080489b127b97b57f27811bd7f30685523 Mon Sep 17 00:00:00 2001
From: Haoran Luo <www@aegistudio.net>
Date: Wed, 21 Jul 2021 14:12:07 +0000
Subject: [PATCH 2536/2658] tracing: Fix bug in rb_per_cpu_empty() that might
 cause deadloop.

commit 67f0d6d9883c13174669f88adac4f0ee656cc16a upstream.

The "rb_per_cpu_empty()" misinterpret the condition (as not-empty) when
"head_page" and "commit_page" of "struct ring_buffer_per_cpu" points to
the same buffer page, whose "buffer_data_page" is empty and "read" field
is non-zero.

An error scenario could be constructed as followed (kernel perspective):

1. All pages in the buffer has been accessed by reader(s) so that all of
them will have non-zero "read" field.

2. Read and clear all buffer pages so that "rb_num_of_entries()" will
return 0 rendering there's no more data to read. It is also required
that the "read_page", "commit_page" and "tail_page" points to the same
page, while "head_page" is the next page of them.

3. Invoke "ring_buffer_lock_reserve()" with large enough "length"
so that it shot pass the end of current tail buffer page. Now the
"head_page", "commit_page" and "tail_page" points to the same page.

4. Discard current event with "ring_buffer_discard_commit()", so that
"head_page", "commit_page" and "tail_page" points to a page whose buffer
data page is now empty.

When the error scenario has been constructed, "tracing_read_pipe" will
be trapped inside a deadloop: "trace_empty()" returns 0 since
"rb_per_cpu_empty()" returns 0 when it hits the CPU containing such
constructed ring buffer. Then "trace_find_next_entry_inc()" always
return NULL since "rb_num_of_entries()" reports there's no more entry
to read. Finally "trace_seq_to_user()" returns "-EBUSY" spanking
"tracing_read_pipe" back to the start of the "waitagain" loop.

I've also written a proof-of-concept script to construct the scenario
and trigger the bug automatically, you can use it to trace and validate
my reasoning above:

  https://github.com/aegistudio/RingBufferDetonator.git

Tests has been carried out on linux kernel 5.14-rc2
(2734d6c1b1a089fb593ef6a23d4b70903526fe0c), my fixed version
of kernel (for testing whether my update fixes the bug) and
some older kernels (for range of affected kernels). Test result is
also attached to the proof-of-concept repository.

Link: https://lore.kernel.org/linux-trace-devel/YPaNxsIlb2yjSi5Y@aegistudio/
Link: https://lore.kernel.org/linux-trace-devel/YPgrN85WL9VyrZ55@aegistudio

Cc: stable@vger.kernel.org
Fixes: bf41a158cacba ("ring-buffer: make reentrant")
Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org>
Signed-off-by: Haoran Luo <www@aegistudio.net>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/ring_buffer.c | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 1ec760f6bf58..19b30ff90cc4 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -3086,10 +3086,30 @@ static bool rb_per_cpu_empty(struct ring_buffer_per_cpu *cpu_buffer)
 	if (unlikely(!head))
 		return true;
 
-	return reader->read == rb_page_commit(reader) &&
-		(commit == reader ||
-		 (commit == head &&
-		  head->read == rb_page_commit(commit)));
+	/* Reader should exhaust content in reader page */
+	if (reader->read != rb_page_commit(reader))
+		return false;
+
+	/*
+	 * If writers are committing on the reader page, knowing all
+	 * committed content has been read, the ring buffer is empty.
+	 */
+	if (commit == reader)
+		return true;
+
+	/*
+	 * If writers are committing on a page other than reader page
+	 * and head page, there should always be content to read.
+	 */
+	if (commit != head)
+		return false;
+
+	/*
+	 * Writers are committing on the head page, we just need
+	 * to care about there're committed data, and the reader will
+	 * swap reader page with head page when it is to read data.
+	 */
+	return rb_page_commit(commit) == 0;
 }
 
 /**

From e92424b6715f2999c6a4d628ed0e09d1ad977f9b Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Date: Mon, 19 Apr 2021 18:43:32 -0500
Subject: [PATCH 2537/2658] media: ngene: Fix out-of-bounds bug in
 ngene_command_config_free_buf()

commit 8d4abca95ecc82fc8c41912fa0085281f19cc29f upstream.

Fix an 11-year old bug in ngene_command_config_free_buf() while
addressing the following warnings caught with -Warray-bounds:

arch/alpha/include/asm/string.h:22:16: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds]
arch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds]

The problem is that the original code is trying to copy 6 bytes of
data into a one-byte size member _config_ of the wrong structue
FW_CONFIGURE_BUFFERS, in a single call to memcpy(). This causes a
legitimate compiler warning because memcpy() overruns the length
of &com.cmd.ConfigureBuffers.config. It seems that the right
structure is FW_CONFIGURE_FREE_BUFFERS, instead, because it contains
6 more members apart from the header _hdr_. Also, the name of
the function ngene_command_config_free_buf() suggests that the actual
intention is to ConfigureFreeBuffers, instead of ConfigureBuffers
(which takes place in the function ngene_command_config_buf(), above).

Fix this by enclosing those 6 members of struct FW_CONFIGURE_FREE_BUFFERS
into new struct config, and use &com.cmd.ConfigureFreeBuffers.config as
the destination address, instead of &com.cmd.ConfigureBuffers.config,
when calling memcpy().

This also helps with the ongoing efforts to globally enable
-Warray-bounds and get us closer to being able to tighten the
FORTIFY_SOURCE routines on memcpy().

Link: https://github.com/KSPP/linux/issues/109
Fixes: dae52d009fc9 ("V4L/DVB: ngene: Initial check-in")
Cc: stable@vger.kernel.org
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/linux-hardening/20210420001631.GA45456@embeddedor/
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/pci/ngene/ngene-core.c |  2 +-
 drivers/media/pci/ngene/ngene.h      | 14 ++++++++------
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/media/pci/ngene/ngene-core.c b/drivers/media/pci/ngene/ngene-core.c
index 1b92d836a564..f0b989900877 100644
--- a/drivers/media/pci/ngene/ngene-core.c
+++ b/drivers/media/pci/ngene/ngene-core.c
@@ -402,7 +402,7 @@ static int ngene_command_config_free_buf(struct ngene *dev, u8 *config)
 
 	com.cmd.hdr.Opcode = CMD_CONFIGURE_FREE_BUFFER;
 	com.cmd.hdr.Length = 6;
-	memcpy(&com.cmd.ConfigureBuffers.config, config, 6);
+	memcpy(&com.cmd.ConfigureFreeBuffers.config, config, 6);
 	com.in_len = 6;
 	com.out_len = 0;
 
diff --git a/drivers/media/pci/ngene/ngene.h b/drivers/media/pci/ngene/ngene.h
index fa30930d7047..da154c406545 100644
--- a/drivers/media/pci/ngene/ngene.h
+++ b/drivers/media/pci/ngene/ngene.h
@@ -407,12 +407,14 @@ enum _BUFFER_CONFIGS {
 
 struct FW_CONFIGURE_FREE_BUFFERS {
 	struct FW_HEADER hdr;
-	u8   UVI1_BufferLength;
-	u8   UVI2_BufferLength;
-	u8   TVO_BufferLength;
-	u8   AUD1_BufferLength;
-	u8   AUD2_BufferLength;
-	u8   TVA_BufferLength;
+	struct {
+		u8   UVI1_BufferLength;
+		u8   UVI2_BufferLength;
+		u8   TVO_BufferLength;
+		u8   AUD1_BufferLength;
+		u8   AUD2_BufferLength;
+		u8   TVA_BufferLength;
+	} __packed config;
 } __attribute__ ((__packed__));
 
 struct FW_CONFIGURE_UART {

From d9e44a3659a6924b5ac1121cb8a0e2497d1bec38 Mon Sep 17 00:00:00 2001
From: Doug Berger <opendmb@gmail.com>
Date: Tue, 29 Jun 2021 17:14:19 -0700
Subject: [PATCH 2538/2658] net: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear

commit 5a3c680aa2c12c90c44af383fe6882a39875ab81 upstream.

Setting the EXT_ENERGY_DET_MASK bit allows the port energy detection
logic of the internal PHY to prevent the system from sleeping. Some
internal PHYs will report that energy is detected when the network
interface is closed which can prevent the system from going to sleep
if WoL is enabled when the interface is brought down.

Since the driver does not support waking the system on this logic,
this commit clears the bit whenever the internal PHY is powered up
and the other logic for manipulating the bit is removed since it
serves no useful function.

Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
Signed-off-by: Doug Berger <opendmb@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/genet/bcmgenet.c    | 15 +--------------
 .../net/ethernet/broadcom/genet/bcmgenet_wol.c    |  6 ------
 2 files changed, 1 insertion(+), 20 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index f8c4460b23f2..a1f9f68575f4 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1094,7 +1094,7 @@ static void bcmgenet_power_up(struct bcmgenet_priv *priv,
 	switch (mode) {
 	case GENET_POWER_PASSIVE:
 		reg &= ~(EXT_PWR_DOWN_DLL | EXT_PWR_DOWN_PHY |
-				EXT_PWR_DOWN_BIAS);
+			 EXT_PWR_DOWN_BIAS | EXT_ENERGY_DET_MASK);
 		/* fallthrough */
 	case GENET_POWER_CABLE_SENSE:
 		/* enable APD */
@@ -2908,12 +2908,6 @@ static int bcmgenet_open(struct net_device *dev)
 
 	bcmgenet_set_hw_addr(priv, dev->dev_addr);
 
-	if (priv->internal_phy) {
-		reg = bcmgenet_ext_readl(priv, EXT_EXT_PWR_MGMT);
-		reg |= EXT_ENERGY_DET_MASK;
-		bcmgenet_ext_writel(priv, reg, EXT_EXT_PWR_MGMT);
-	}
-
 	/* Disable RX/TX DMA and flush TX queues */
 	dma_ctrl = bcmgenet_dma_disable(priv);
 
@@ -3601,7 +3595,6 @@ static int bcmgenet_resume(struct device *d)
 	struct bcmgenet_priv *priv = netdev_priv(dev);
 	unsigned long dma_ctrl;
 	int ret;
-	u32 reg;
 
 	if (!netif_running(dev))
 		return 0;
@@ -3636,12 +3629,6 @@ static int bcmgenet_resume(struct device *d)
 
 	bcmgenet_set_hw_addr(priv, dev->dev_addr);
 
-	if (priv->internal_phy) {
-		reg = bcmgenet_ext_readl(priv, EXT_EXT_PWR_MGMT);
-		reg |= EXT_ENERGY_DET_MASK;
-		bcmgenet_ext_writel(priv, reg, EXT_EXT_PWR_MGMT);
-	}
-
 	if (priv->wolopts)
 		bcmgenet_power_up(priv, GENET_POWER_WOL_MAGIC);
 
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
index b97122926d3a..df107ed67220 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
@@ -167,12 +167,6 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv,
 	reg |= CMD_RX_EN;
 	bcmgenet_umac_writel(priv, reg, UMAC_CMD);
 
-	if (priv->hw_params->flags & GENET_HAS_EXT) {
-		reg = bcmgenet_ext_readl(priv, EXT_EXT_PWR_MGMT);
-		reg &= ~EXT_ENERGY_DET_MASK;
-		bcmgenet_ext_writel(priv, reg, EXT_EXT_PWR_MGMT);
-	}
-
 	/* Enable the MPD interrupt */
 	cpu_mask_clear = UMAC_IRQ_MPD_R;
 

From eef97b5d35bd8f7535989a7d3a9bfaea71952f93 Mon Sep 17 00:00:00 2001
From: Linus Walleij <linus.walleij@linaro.org>
Date: Wed, 11 Dec 2019 22:38:18 +0100
Subject: [PATCH 2539/2658] iio: accel: bma180: Use explicit member assignment

commit 9436abc40139503a7cea22a96437697d048f31c0 upstream

This uses the C99 explicit .member assignment for the
variant data in struct bma180_part_info. This makes it
easier to understand and add new variants.

Cc: Peter Meerwald <pmeerw@pmeerw.net>
Cc: Oleksandr Kravchenko <o.v.kravchenko@globallogic.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/accel/bma180.c | 68 ++++++++++++++++++++++++--------------
 1 file changed, 44 insertions(+), 24 deletions(-)

diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
index 68c9e5478fec..85de3c38ede1 100644
--- a/drivers/iio/accel/bma180.c
+++ b/drivers/iio/accel/bma180.c
@@ -624,32 +624,52 @@ static const struct iio_chan_spec bma250_channels[] = {
 
 static const struct bma180_part_info bma180_part_info[] = {
 	[BMA180] = {
-		bma180_channels, ARRAY_SIZE(bma180_channels),
-		bma180_scale_table, ARRAY_SIZE(bma180_scale_table),
-		bma180_bw_table, ARRAY_SIZE(bma180_bw_table),
-		BMA180_CTRL_REG0, BMA180_RESET_INT,
-		BMA180_CTRL_REG0, BMA180_SLEEP,
-		BMA180_BW_TCS, BMA180_BW,
-		BMA180_OFFSET_LSB1, BMA180_RANGE,
-		BMA180_TCO_Z, BMA180_MODE_CONFIG, BMA180_LOW_POWER,
-		BMA180_CTRL_REG3, BMA180_NEW_DATA_INT,
-		BMA180_RESET,
-		bma180_chip_config,
-		bma180_chip_disable,
+		.channels = bma180_channels,
+		.num_channels = ARRAY_SIZE(bma180_channels),
+		.scale_table = bma180_scale_table,
+		.num_scales = ARRAY_SIZE(bma180_scale_table),
+		.bw_table = bma180_bw_table,
+		.num_bw = ARRAY_SIZE(bma180_bw_table),
+		.int_reset_reg = BMA180_CTRL_REG0,
+		.int_reset_mask = BMA180_RESET_INT,
+		.sleep_reg = BMA180_CTRL_REG0,
+		.sleep_mask = BMA180_SLEEP,
+		.bw_reg = BMA180_BW_TCS,
+		.bw_mask = BMA180_BW,
+		.scale_reg = BMA180_OFFSET_LSB1,
+		.scale_mask = BMA180_RANGE,
+		.power_reg = BMA180_TCO_Z,
+		.power_mask = BMA180_MODE_CONFIG,
+		.lowpower_val = BMA180_LOW_POWER,
+		.int_enable_reg = BMA180_CTRL_REG3,
+		.int_enable_mask = BMA180_NEW_DATA_INT,
+		.softreset_reg = BMA180_RESET,
+		.chip_config = bma180_chip_config,
+		.chip_disable = bma180_chip_disable,
 	},
 	[BMA250] = {
-		bma250_channels, ARRAY_SIZE(bma250_channels),
-		bma250_scale_table, ARRAY_SIZE(bma250_scale_table),
-		bma250_bw_table, ARRAY_SIZE(bma250_bw_table),
-		BMA250_INT_RESET_REG, BMA250_INT_RESET_MASK,
-		BMA250_POWER_REG, BMA250_SUSPEND_MASK,
-		BMA250_BW_REG, BMA250_BW_MASK,
-		BMA250_RANGE_REG, BMA250_RANGE_MASK,
-		BMA250_POWER_REG, BMA250_LOWPOWER_MASK, 1,
-		BMA250_INT_ENABLE_REG, BMA250_DATA_INTEN_MASK,
-		BMA250_RESET_REG,
-		bma250_chip_config,
-		bma250_chip_disable,
+		.channels = bma250_channels,
+		.num_channels = ARRAY_SIZE(bma250_channels),
+		.scale_table = bma250_scale_table,
+		.num_scales = ARRAY_SIZE(bma250_scale_table),
+		.bw_table = bma250_bw_table,
+		.num_bw = ARRAY_SIZE(bma250_bw_table),
+		.int_reset_reg = BMA250_INT_RESET_REG,
+		.int_reset_mask = BMA250_INT_RESET_MASK,
+		.sleep_reg = BMA250_POWER_REG,
+		.sleep_mask = BMA250_SUSPEND_MASK,
+		.bw_reg = BMA250_BW_REG,
+		.bw_mask = BMA250_BW_MASK,
+		.scale_reg = BMA250_RANGE_REG,
+		.scale_mask = BMA250_RANGE_MASK,
+		.power_reg = BMA250_POWER_REG,
+		.power_mask = BMA250_LOWPOWER_MASK,
+		.lowpower_val = 1,
+		.int_enable_reg = BMA250_INT_ENABLE_REG,
+		.int_enable_mask = BMA250_DATA_INTEN_MASK,
+		.softreset_reg = BMA250_RESET_REG,
+		.chip_config = bma250_chip_config,
+		.chip_disable = bma250_chip_disable,
 	},
 };
 

From 3d09dc85228db961f5d0ea0db944f289b61aab8e Mon Sep 17 00:00:00 2001
From: Stephan Gerhold <stephan@gerhold.net>
Date: Wed, 26 May 2021 11:44:07 +0200
Subject: [PATCH 2540/2658] iio: accel: bma180: Fix BMA25x bandwidth register
 values
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 8090d67421ddab0ae932abab5a60200598bf0bbb upstream

According to the BMA253 datasheet [1] and BMA250 datasheet [2] the
bandwidth value for BMA25x should be set as 01xxx:

  "Settings 00xxx result in a bandwidth of 7.81 Hz; [...]
   It is recommended [...] to use the range from ´01000b´ to ´01111b´
   only in order to be compatible with future products."

However, at the moment the drivers sets bandwidth values from 0 to 6,
which is not recommended and always results into 7.81 Hz bandwidth
according to the datasheet.

Fix this by introducing a bw_offset = 8 = 01000b for BMA25x,
so the additional bit is always set for BMA25x.

[1]: https://www.bosch-sensortec.com/media/boschsensortec/downloads/datasheets/bst-bma253-ds000.pdf
[2]: https://datasheet.octopart.com/BMA250-Bosch-datasheet-15540103.pdf

Cc: Peter Meerwald <pmeerw@pmeerw.net>
Fixes: 2017cff24cc0 ("iio:bma180: Add BMA250 chip support")
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20210526094408.34298-2-stephan@gerhold.net
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/accel/bma180.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
index 85de3c38ede1..057c9df500d3 100644
--- a/drivers/iio/accel/bma180.c
+++ b/drivers/iio/accel/bma180.c
@@ -49,7 +49,7 @@ struct bma180_part_info {
 
 	u8 int_reset_reg, int_reset_mask;
 	u8 sleep_reg, sleep_mask;
-	u8 bw_reg, bw_mask;
+	u8 bw_reg, bw_mask, bw_offset;
 	u8 scale_reg, scale_mask;
 	u8 power_reg, power_mask, lowpower_val;
 	u8 int_enable_reg, int_enable_mask;
@@ -105,6 +105,7 @@ struct bma180_part_info {
 
 #define BMA250_RANGE_MASK	GENMASK(3, 0) /* Range of accel values */
 #define BMA250_BW_MASK		GENMASK(4, 0) /* Accel bandwidth */
+#define BMA250_BW_OFFSET	8
 #define BMA250_SUSPEND_MASK	BIT(7) /* chip will sleep */
 #define BMA250_LOWPOWER_MASK	BIT(6)
 #define BMA250_DATA_INTEN_MASK	BIT(4)
@@ -242,7 +243,8 @@ static int bma180_set_bw(struct bma180_data *data, int val)
 	for (i = 0; i < data->part_info->num_bw; ++i) {
 		if (data->part_info->bw_table[i] == val) {
 			ret = bma180_set_bits(data, data->part_info->bw_reg,
-				data->part_info->bw_mask, i);
+				data->part_info->bw_mask,
+				i + data->part_info->bw_offset);
 			if (ret) {
 				dev_err(&data->client->dev,
 					"failed to set bandwidth\n");
@@ -660,6 +662,7 @@ static const struct bma180_part_info bma180_part_info[] = {
 		.sleep_mask = BMA250_SUSPEND_MASK,
 		.bw_reg = BMA250_BW_REG,
 		.bw_mask = BMA250_BW_MASK,
+		.bw_offset = BMA250_BW_OFFSET,
 		.scale_reg = BMA250_RANGE_REG,
 		.scale_mask = BMA250_RANGE_MASK,
 		.power_reg = BMA250_POWER_REG,

From 2c3b10ae2a43890942c41467633344d841a76c9a Mon Sep 17 00:00:00 2001
From: David Sterba <dsterba@suse.com>
Date: Mon, 14 Jun 2021 12:45:18 +0200
Subject: [PATCH 2541/2658] btrfs: compression: don't try to compress if we
 don't have enough pages

commit f2165627319ffd33a6217275e5690b1ab5c45763 upstream

The early check if we should attempt compression does not take into
account the number of input pages. It can happen that there's only one
page, eg. a tail page after some ranges of the BTRFS_MAX_UNCOMPRESSED
have been processed, or an isolated page that won't be converted to an
inline extent.

The single page would be compressed but a later check would drop it
again because the result size must be at least one block shorter than
the input. That can never work with just one page.

CC: stable@vger.kernel.org # 4.4+
Signed-off-by: David Sterba <dsterba@suse.com>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 6d846ff696fb..da4ad006739d 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -476,7 +476,7 @@ static noinline void compress_file_range(struct inode *inode,
 	 * inode has not been flagged as nocompress.  This flag can
 	 * change at any time if we discover bad compression ratios.
 	 */
-	if (inode_need_compress(inode)) {
+	if (nr_pages > 1 && inode_need_compress(inode)) {
 		WARN_ON(pages);
 		pages = kcalloc(nr_pages, sizeof(struct page *), GFP_NOFS);
 		if (!pages) {

From 0625d696212dc9459555309928f784f952a4145e Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 28 Jul 2021 09:12:37 +0200
Subject: [PATCH 2542/2658] Linux 4.4.277

Link: https://lore.kernel.org/r/20210726153822.980271128@linuxfoundation.org
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/20210727061334.372078412@linuxfoundation.org
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index e601862e5fbb..13244d7dc70e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 276
+SUBLEVEL = 277
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 8d7fbd74966d172ce9c5599c6e9c282ee41befb6 Mon Sep 17 00:00:00 2001
From: Jens Axboe <axboe@kernel.dk>
Date: Fri, 8 Feb 2019 09:01:44 -0700
Subject: [PATCH 2543/2658] net: split out functions related to registering
 inflight socket files

commit f4e65870e5cede5ca1ec0006b6c9803994e5f7b8 upstream.

We need this functionality for the io_uring file registration, but
we cannot rely on it since CONFIG_UNIX can be modular. Move the helpers
to a separate file, that's always builtin to the kernel if CONFIG_UNIX is
m/y.

No functional changes in this patch, just moving code around.

Reviewed-by: Hannes Reinecke <hare@suse.com>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[ backported to older kernels to get access to unix_gc_lock - gregkh ]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/af_unix.h |   1 +
 net/Makefile          |   2 +-
 net/unix/Kconfig      |   5 ++
 net/unix/Makefile     |   2 +
 net/unix/af_unix.c    |  76 +-------------------
 net/unix/garbage.c    |  68 +-----------------
 net/unix/scm.c        | 161 ++++++++++++++++++++++++++++++++++++++++++
 net/unix/scm.h        |  10 +++
 8 files changed, 184 insertions(+), 141 deletions(-)
 create mode 100644 net/unix/scm.c
 create mode 100644 net/unix/scm.h

diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index fd60eccb59a6..79f2e1ccfcfb 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -8,6 +8,7 @@
 
 void unix_inflight(struct user_struct *user, struct file *fp);
 void unix_notinflight(struct user_struct *user, struct file *fp);
+void unix_destruct_scm(struct sk_buff *skb);
 void unix_gc(void);
 void wait_for_unix_gc(void);
 struct sock *unix_get_socket(struct file *filp);
diff --git a/net/Makefile b/net/Makefile
index e700aa62b1af..8b139678bb0b 100644
--- a/net/Makefile
+++ b/net/Makefile
@@ -16,7 +16,7 @@ obj-$(CONFIG_NET)		+= ethernet/ 802/ sched/ netlink/
 obj-$(CONFIG_NETFILTER)		+= netfilter/
 obj-$(CONFIG_INET)		+= ipv4/
 obj-$(CONFIG_XFRM)		+= xfrm/
-obj-$(CONFIG_UNIX)		+= unix/
+obj-$(CONFIG_UNIX_SCM)		+= unix/
 obj-$(CONFIG_NET)		+= ipv6/
 obj-$(CONFIG_PACKET)		+= packet/
 obj-$(CONFIG_NET_KEY)		+= key/
diff --git a/net/unix/Kconfig b/net/unix/Kconfig
index 8b31ab85d050..3b9e450656a4 100644
--- a/net/unix/Kconfig
+++ b/net/unix/Kconfig
@@ -19,6 +19,11 @@ config UNIX
 
 	  Say Y unless you know what you are doing.
 
+config UNIX_SCM
+	bool
+	depends on UNIX
+	default y
+
 config UNIX_DIAG
 	tristate "UNIX: socket monitoring interface"
 	depends on UNIX
diff --git a/net/unix/Makefile b/net/unix/Makefile
index b663c607b1c6..dc686c6757fb 100644
--- a/net/unix/Makefile
+++ b/net/unix/Makefile
@@ -9,3 +9,5 @@ unix-$(CONFIG_SYSCTL)	+= sysctl_net_unix.o
 
 obj-$(CONFIG_UNIX_DIAG)	+= unix_diag.o
 unix_diag-y		:= diag.o
+
+obj-$(CONFIG_UNIX_SCM)	+= scm.o
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index a0e8cb24af35..516d1144889b 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -118,6 +118,8 @@
 #include <linux/security.h>
 #include <linux/freezer.h>
 
+#include "scm.h"
+
 struct hlist_head unix_socket_table[2 * UNIX_HASH_SIZE];
 EXPORT_SYMBOL_GPL(unix_socket_table);
 DEFINE_SPINLOCK(unix_table_lock);
@@ -1504,80 +1506,6 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_
 	return err;
 }
 
-static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb)
-{
-	int i;
-
-	scm->fp = UNIXCB(skb).fp;
-	UNIXCB(skb).fp = NULL;
-
-	for (i = scm->fp->count-1; i >= 0; i--)
-		unix_notinflight(scm->fp->user, scm->fp->fp[i]);
-}
-
-static void unix_destruct_scm(struct sk_buff *skb)
-{
-	struct scm_cookie scm;
-	memset(&scm, 0, sizeof(scm));
-	scm.pid  = UNIXCB(skb).pid;
-	if (UNIXCB(skb).fp)
-		unix_detach_fds(&scm, skb);
-
-	/* Alas, it calls VFS */
-	/* So fscking what? fput() had been SMP-safe since the last Summer */
-	scm_destroy(&scm);
-	sock_wfree(skb);
-}
-
-/*
- * The "user->unix_inflight" variable is protected by the garbage
- * collection lock, and we just read it locklessly here. If you go
- * over the limit, there might be a tiny race in actually noticing
- * it across threads. Tough.
- */
-static inline bool too_many_unix_fds(struct task_struct *p)
-{
-	struct user_struct *user = current_user();
-
-	if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
-		return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
-	return false;
-}
-
-#define MAX_RECURSION_LEVEL 4
-
-static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
-{
-	int i;
-	unsigned char max_level = 0;
-
-	if (too_many_unix_fds(current))
-		return -ETOOMANYREFS;
-
-	for (i = scm->fp->count - 1; i >= 0; i--) {
-		struct sock *sk = unix_get_socket(scm->fp->fp[i]);
-
-		if (sk)
-			max_level = max(max_level,
-					unix_sk(sk)->recursion_level);
-	}
-	if (unlikely(max_level > MAX_RECURSION_LEVEL))
-		return -ETOOMANYREFS;
-
-	/*
-	 * Need to duplicate file references for the sake of garbage
-	 * collection.  Otherwise a socket in the fps might become a
-	 * candidate for GC while the skb is not yet queued.
-	 */
-	UNIXCB(skb).fp = scm_fp_dup(scm->fp);
-	if (!UNIXCB(skb).fp)
-		return -ENOMEM;
-
-	for (i = scm->fp->count - 1; i >= 0; i--)
-		unix_inflight(scm->fp->user, scm->fp->fp[i]);
-	return max_level;
-}
-
 static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds)
 {
 	int err = 0;
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index c36757e72844..8bbe1b8e4ff7 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -86,77 +86,13 @@
 #include <net/scm.h>
 #include <net/tcp_states.h>
 
+#include "scm.h"
+
 /* Internal data structures and random procedures: */
 
-static LIST_HEAD(gc_inflight_list);
 static LIST_HEAD(gc_candidates);
-static DEFINE_SPINLOCK(unix_gc_lock);
 static DECLARE_WAIT_QUEUE_HEAD(unix_gc_wait);
 
-unsigned int unix_tot_inflight;
-
-struct sock *unix_get_socket(struct file *filp)
-{
-	struct sock *u_sock = NULL;
-	struct inode *inode = file_inode(filp);
-
-	/* Socket ? */
-	if (S_ISSOCK(inode->i_mode) && !(filp->f_mode & FMODE_PATH)) {
-		struct socket *sock = SOCKET_I(inode);
-		struct sock *s = sock->sk;
-
-		/* PF_UNIX ? */
-		if (s && sock->ops && sock->ops->family == PF_UNIX)
-			u_sock = s;
-	}
-	return u_sock;
-}
-
-/* Keep the number of times in flight count for the file
- * descriptor if it is for an AF_UNIX socket.
- */
-
-void unix_inflight(struct user_struct *user, struct file *fp)
-{
-	struct sock *s = unix_get_socket(fp);
-
-	spin_lock(&unix_gc_lock);
-
-	if (s) {
-		struct unix_sock *u = unix_sk(s);
-
-		if (atomic_long_inc_return(&u->inflight) == 1) {
-			BUG_ON(!list_empty(&u->link));
-			list_add_tail(&u->link, &gc_inflight_list);
-		} else {
-			BUG_ON(list_empty(&u->link));
-		}
-		unix_tot_inflight++;
-	}
-	user->unix_inflight++;
-	spin_unlock(&unix_gc_lock);
-}
-
-void unix_notinflight(struct user_struct *user, struct file *fp)
-{
-	struct sock *s = unix_get_socket(fp);
-
-	spin_lock(&unix_gc_lock);
-
-	if (s) {
-		struct unix_sock *u = unix_sk(s);
-
-		BUG_ON(!atomic_long_read(&u->inflight));
-		BUG_ON(list_empty(&u->link));
-
-		if (atomic_long_dec_and_test(&u->inflight))
-			list_del_init(&u->link);
-		unix_tot_inflight--;
-	}
-	user->unix_inflight--;
-	spin_unlock(&unix_gc_lock);
-}
-
 static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
 			  struct sk_buff_head *hitlist)
 {
diff --git a/net/unix/scm.c b/net/unix/scm.c
new file mode 100644
index 000000000000..df8f636ab1d8
--- /dev/null
+++ b/net/unix/scm.c
@@ -0,0 +1,161 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/socket.h>
+#include <linux/net.h>
+#include <linux/fs.h>
+#include <net/af_unix.h>
+#include <net/scm.h>
+#include <linux/init.h>
+
+#include "scm.h"
+
+unsigned int unix_tot_inflight;
+EXPORT_SYMBOL(unix_tot_inflight);
+
+LIST_HEAD(gc_inflight_list);
+EXPORT_SYMBOL(gc_inflight_list);
+
+DEFINE_SPINLOCK(unix_gc_lock);
+EXPORT_SYMBOL(unix_gc_lock);
+
+struct sock *unix_get_socket(struct file *filp)
+{
+	struct sock *u_sock = NULL;
+	struct inode *inode = file_inode(filp);
+
+	/* Socket ? */
+	if (S_ISSOCK(inode->i_mode) && !(filp->f_mode & FMODE_PATH)) {
+		struct socket *sock = SOCKET_I(inode);
+		struct sock *s = sock->sk;
+
+		/* PF_UNIX ? */
+		if (s && sock->ops && sock->ops->family == PF_UNIX)
+			u_sock = s;
+	}
+	return u_sock;
+}
+EXPORT_SYMBOL(unix_get_socket);
+
+/* Keep the number of times in flight count for the file
+ * descriptor if it is for an AF_UNIX socket.
+ */
+void unix_inflight(struct user_struct *user, struct file *fp)
+{
+	struct sock *s = unix_get_socket(fp);
+
+	spin_lock(&unix_gc_lock);
+
+	if (s) {
+		struct unix_sock *u = unix_sk(s);
+
+		if (atomic_long_inc_return(&u->inflight) == 1) {
+			BUG_ON(!list_empty(&u->link));
+			list_add_tail(&u->link, &gc_inflight_list);
+		} else {
+			BUG_ON(list_empty(&u->link));
+		}
+		unix_tot_inflight++;
+	}
+	user->unix_inflight++;
+	spin_unlock(&unix_gc_lock);
+}
+
+void unix_notinflight(struct user_struct *user, struct file *fp)
+{
+	struct sock *s = unix_get_socket(fp);
+
+	spin_lock(&unix_gc_lock);
+
+	if (s) {
+		struct unix_sock *u = unix_sk(s);
+
+		BUG_ON(!atomic_long_read(&u->inflight));
+		BUG_ON(list_empty(&u->link));
+
+		if (atomic_long_dec_and_test(&u->inflight))
+			list_del_init(&u->link);
+		unix_tot_inflight--;
+	}
+	user->unix_inflight--;
+	spin_unlock(&unix_gc_lock);
+}
+
+/*
+ * The "user->unix_inflight" variable is protected by the garbage
+ * collection lock, and we just read it locklessly here. If you go
+ * over the limit, there might be a tiny race in actually noticing
+ * it across threads. Tough.
+ */
+static inline bool too_many_unix_fds(struct task_struct *p)
+{
+	struct user_struct *user = current_user();
+
+	if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
+		return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
+	return false;
+}
+
+#define MAX_RECURSION_LEVEL 4
+
+int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+{
+	int i;
+	unsigned char max_level = 0;
+
+	if (too_many_unix_fds(current))
+		return -ETOOMANYREFS;
+
+	for (i = scm->fp->count - 1; i >= 0; i--) {
+		struct sock *sk = unix_get_socket(scm->fp->fp[i]);
+
+		if (sk)
+			max_level = max(max_level,
+					unix_sk(sk)->recursion_level);
+	}
+	if (unlikely(max_level > MAX_RECURSION_LEVEL))
+		return -ETOOMANYREFS;
+
+	/*
+	 * Need to duplicate file references for the sake of garbage
+	 * collection.  Otherwise a socket in the fps might become a
+	 * candidate for GC while the skb is not yet queued.
+	 */
+	UNIXCB(skb).fp = scm_fp_dup(scm->fp);
+	if (!UNIXCB(skb).fp)
+		return -ENOMEM;
+
+	for (i = scm->fp->count - 1; i >= 0; i--)
+		unix_inflight(scm->fp->user, scm->fp->fp[i]);
+	return max_level;
+}
+EXPORT_SYMBOL(unix_attach_fds);
+
+void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+{
+	int i;
+
+	scm->fp = UNIXCB(skb).fp;
+	UNIXCB(skb).fp = NULL;
+
+	for (i = scm->fp->count-1; i >= 0; i--)
+		unix_notinflight(scm->fp->user, scm->fp->fp[i]);
+}
+EXPORT_SYMBOL(unix_detach_fds);
+
+void unix_destruct_scm(struct sk_buff *skb)
+{
+	struct scm_cookie scm;
+
+	memset(&scm, 0, sizeof(scm));
+	scm.pid  = UNIXCB(skb).pid;
+	if (UNIXCB(skb).fp)
+		unix_detach_fds(&scm, skb);
+
+	/* Alas, it calls VFS */
+	/* So fscking what? fput() had been SMP-safe since the last Summer */
+	scm_destroy(&scm);
+	sock_wfree(skb);
+}
+EXPORT_SYMBOL(unix_destruct_scm);
diff --git a/net/unix/scm.h b/net/unix/scm.h
new file mode 100644
index 000000000000..5a255a477f16
--- /dev/null
+++ b/net/unix/scm.h
@@ -0,0 +1,10 @@
+#ifndef NET_UNIX_SCM_H
+#define NET_UNIX_SCM_H
+
+extern struct list_head gc_inflight_list;
+extern spinlock_t unix_gc_lock;
+
+int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb);
+void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb);
+
+#endif

From a43184ad25baa8f0e0dd5ca3781580d5a290cb2f Mon Sep 17 00:00:00 2001
From: Miklos Szeredi <mszeredi@redhat.com>
Date: Wed, 28 Jul 2021 14:47:20 +0200
Subject: [PATCH 2544/2658] af_unix: fix garbage collect vs MSG_PEEK

commit cbcf01128d0a92e131bd09f1688fe032480b65ca upstream.

unix_gc() assumes that candidate sockets can never gain an external
reference (i.e.  be installed into an fd) while the unix_gc_lock is
held.  Except for MSG_PEEK this is guaranteed by modifying inflight
count under the unix_gc_lock.

MSG_PEEK does not touch any variable protected by unix_gc_lock (file
count is not), yet it needs to be serialized with garbage collection.
Do this by locking/unlocking unix_gc_lock:

 1) increment file count

 2) lock/unlock barrier to make sure incremented file count is visible
    to garbage collection

 3) install file into fd

This is a lock barrier (unlike smp_mb()) that ensures that garbage
collection is run completely before or completely after the barrier.

Cc: <stable@vger.kernel.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/unix/af_unix.c | 51 ++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 49 insertions(+), 2 deletions(-)

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 516d1144889b..79687d5a95ac 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1506,6 +1506,53 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_
 	return err;
 }
 
+static void unix_peek_fds(struct scm_cookie *scm, struct sk_buff *skb)
+{
+	scm->fp = scm_fp_dup(UNIXCB(skb).fp);
+
+	/*
+	 * Garbage collection of unix sockets starts by selecting a set of
+	 * candidate sockets which have reference only from being in flight
+	 * (total_refs == inflight_refs).  This condition is checked once during
+	 * the candidate collection phase, and candidates are marked as such, so
+	 * that non-candidates can later be ignored.  While inflight_refs is
+	 * protected by unix_gc_lock, total_refs (file count) is not, hence this
+	 * is an instantaneous decision.
+	 *
+	 * Once a candidate, however, the socket must not be reinstalled into a
+	 * file descriptor while the garbage collection is in progress.
+	 *
+	 * If the above conditions are met, then the directed graph of
+	 * candidates (*) does not change while unix_gc_lock is held.
+	 *
+	 * Any operations that changes the file count through file descriptors
+	 * (dup, close, sendmsg) does not change the graph since candidates are
+	 * not installed in fds.
+	 *
+	 * Dequeing a candidate via recvmsg would install it into an fd, but
+	 * that takes unix_gc_lock to decrement the inflight count, so it's
+	 * serialized with garbage collection.
+	 *
+	 * MSG_PEEK is special in that it does not change the inflight count,
+	 * yet does install the socket into an fd.  The following lock/unlock
+	 * pair is to ensure serialization with garbage collection.  It must be
+	 * done between incrementing the file count and installing the file into
+	 * an fd.
+	 *
+	 * If garbage collection starts after the barrier provided by the
+	 * lock/unlock, then it will see the elevated refcount and not mark this
+	 * as a candidate.  If a garbage collection is already in progress
+	 * before the file count was incremented, then the lock/unlock pair will
+	 * ensure that garbage collection is finished before progressing to
+	 * installing the fd.
+	 *
+	 * (*) A -> B where B is on the queue of A or B is on the queue of C
+	 * which is on the queue of listening socket A.
+	 */
+	spin_lock(&unix_gc_lock);
+	spin_unlock(&unix_gc_lock);
+}
+
 static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds)
 {
 	int err = 0;
@@ -2131,7 +2178,7 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
 		sk_peek_offset_fwd(sk, size);
 
 		if (UNIXCB(skb).fp)
-			scm.fp = scm_fp_dup(UNIXCB(skb).fp);
+			unix_peek_fds(&scm, skb);
 	}
 	err = (flags & MSG_TRUNC) ? skb->len - skip : size;
 
@@ -2376,7 +2423,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state,
 			/* It is questionable, see note in unix_dgram_recvmsg.
 			 */
 			if (UNIXCB(skb).fp)
-				scm.fp = scm_fp_dup(UNIXCB(skb).fp);
+				unix_peek_fds(&scm, skb);
 
 			sk_peek_offset_fwd(sk, chunk);
 

From 17d4ed5a21c378bed4b564cebc56fef88189ab68 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Wed, 14 Jul 2021 17:19:33 +0800
Subject: [PATCH 2545/2658] workqueue: fix UAF in pwq_unbound_release_workfn()

commit b42b0bddcbc87b4c66f6497f66fc72d52b712aa7 upstream.

I got a UAF report when doing fuzz test:

[  152.880091][ T8030] ==================================================================
[  152.881240][ T8030] BUG: KASAN: use-after-free in pwq_unbound_release_workfn+0x50/0x190
[  152.882442][ T8030] Read of size 4 at addr ffff88810d31bd00 by task kworker/3:2/8030
[  152.883578][ T8030]
[  152.883932][ T8030] CPU: 3 PID: 8030 Comm: kworker/3:2 Not tainted 5.13.0+ #249
[  152.885014][ T8030] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
[  152.886442][ T8030] Workqueue: events pwq_unbound_release_workfn
[  152.887358][ T8030] Call Trace:
[  152.887837][ T8030]  dump_stack_lvl+0x75/0x9b
[  152.888525][ T8030]  ? pwq_unbound_release_workfn+0x50/0x190
[  152.889371][ T8030]  print_address_description.constprop.10+0x48/0x70
[  152.890326][ T8030]  ? pwq_unbound_release_workfn+0x50/0x190
[  152.891163][ T8030]  ? pwq_unbound_release_workfn+0x50/0x190
[  152.891999][ T8030]  kasan_report.cold.15+0x82/0xdb
[  152.892740][ T8030]  ? pwq_unbound_release_workfn+0x50/0x190
[  152.893594][ T8030]  __asan_load4+0x69/0x90
[  152.894243][ T8030]  pwq_unbound_release_workfn+0x50/0x190
[  152.895057][ T8030]  process_one_work+0x47b/0x890
[  152.895778][ T8030]  worker_thread+0x5c/0x790
[  152.896439][ T8030]  ? process_one_work+0x890/0x890
[  152.897163][ T8030]  kthread+0x223/0x250
[  152.897747][ T8030]  ? set_kthread_struct+0xb0/0xb0
[  152.898471][ T8030]  ret_from_fork+0x1f/0x30
[  152.899114][ T8030]
[  152.899446][ T8030] Allocated by task 8884:
[  152.900084][ T8030]  kasan_save_stack+0x21/0x50
[  152.900769][ T8030]  __kasan_kmalloc+0x88/0xb0
[  152.901416][ T8030]  __kmalloc+0x29c/0x460
[  152.902014][ T8030]  alloc_workqueue+0x111/0x8e0
[  152.902690][ T8030]  __btrfs_alloc_workqueue+0x11e/0x2a0
[  152.903459][ T8030]  btrfs_alloc_workqueue+0x6d/0x1d0
[  152.904198][ T8030]  scrub_workers_get+0x1e8/0x490
[  152.904929][ T8030]  btrfs_scrub_dev+0x1b9/0x9c0
[  152.905599][ T8030]  btrfs_ioctl+0x122c/0x4e50
[  152.906247][ T8030]  __x64_sys_ioctl+0x137/0x190
[  152.906916][ T8030]  do_syscall_64+0x34/0xb0
[  152.907535][ T8030]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  152.908365][ T8030]
[  152.908688][ T8030] Freed by task 8884:
[  152.909243][ T8030]  kasan_save_stack+0x21/0x50
[  152.909893][ T8030]  kasan_set_track+0x20/0x30
[  152.910541][ T8030]  kasan_set_free_info+0x24/0x40
[  152.911265][ T8030]  __kasan_slab_free+0xf7/0x140
[  152.911964][ T8030]  kfree+0x9e/0x3d0
[  152.912501][ T8030]  alloc_workqueue+0x7d7/0x8e0
[  152.913182][ T8030]  __btrfs_alloc_workqueue+0x11e/0x2a0
[  152.913949][ T8030]  btrfs_alloc_workqueue+0x6d/0x1d0
[  152.914703][ T8030]  scrub_workers_get+0x1e8/0x490
[  152.915402][ T8030]  btrfs_scrub_dev+0x1b9/0x9c0
[  152.916077][ T8030]  btrfs_ioctl+0x122c/0x4e50
[  152.916729][ T8030]  __x64_sys_ioctl+0x137/0x190
[  152.917414][ T8030]  do_syscall_64+0x34/0xb0
[  152.918034][ T8030]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  152.918872][ T8030]
[  152.919203][ T8030] The buggy address belongs to the object at ffff88810d31bc00
[  152.919203][ T8030]  which belongs to the cache kmalloc-512 of size 512
[  152.921155][ T8030] The buggy address is located 256 bytes inside of
[  152.921155][ T8030]  512-byte region [ffff88810d31bc00, ffff88810d31be00)
[  152.922993][ T8030] The buggy address belongs to the page:
[  152.923800][ T8030] page:ffffea000434c600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10d318
[  152.925249][ T8030] head:ffffea000434c600 order:2 compound_mapcount:0 compound_pincount:0
[  152.926399][ T8030] flags: 0x57ff00000010200(slab|head|node=1|zone=2|lastcpupid=0x7ff)
[  152.927515][ T8030] raw: 057ff00000010200 dead000000000100 dead000000000122 ffff888009c42c80
[  152.928716][ T8030] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[  152.929890][ T8030] page dumped because: kasan: bad access detected
[  152.930759][ T8030]
[  152.931076][ T8030] Memory state around the buggy address:
[  152.931851][ T8030]  ffff88810d31bc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  152.932967][ T8030]  ffff88810d31bc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  152.934068][ T8030] >ffff88810d31bd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  152.935189][ T8030]                    ^
[  152.935763][ T8030]  ffff88810d31bd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  152.936847][ T8030]  ffff88810d31be00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  152.937940][ T8030] ==================================================================

If apply_wqattrs_prepare() fails in alloc_workqueue(), it will call put_pwq()
which invoke a work queue to call pwq_unbound_release_workfn() and use the 'wq'.
The 'wq' allocated in alloc_workqueue() will be freed in error path when
apply_wqattrs_prepare() fails. So it will lead a UAF.

CPU0                                          CPU1
alloc_workqueue()
alloc_and_link_pwqs()
apply_wqattrs_prepare() fails
apply_wqattrs_cleanup()
schedule_work(&pwq->unbound_release_work)
kfree(wq)
                                              worker_thread()
                                              pwq_unbound_release_workfn() <- trigger uaf here

If apply_wqattrs_prepare() fails, the new pwq are not linked, it doesn't
hold any reference to the 'wq', 'wq' is invalid to access in the worker,
so add check pwq if linked to fix this.

Fixes: 2d5f0764b526 ("workqueue: split apply_workqueue_attrs() into 3 stages")
Cc: stable@vger.kernel.org # v4.2+
Reported-by: Hulk Robot <hulkci@huawei.com>
Suggested-by: Lai Jiangshan <jiangshanlai@gmail.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
Tested-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/workqueue.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 1c970232ea8b..cd9f947d83bc 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -3331,15 +3331,21 @@ static void pwq_unbound_release_workfn(struct work_struct *work)
 						  unbound_release_work);
 	struct workqueue_struct *wq = pwq->wq;
 	struct worker_pool *pool = pwq->pool;
-	bool is_last;
+	bool is_last = false;
 
-	if (WARN_ON_ONCE(!(wq->flags & WQ_UNBOUND)))
-		return;
+	/*
+	 * when @pwq is not linked, it doesn't hold any reference to the
+	 * @wq, and @wq is invalid to access.
+	 */
+	if (!list_empty(&pwq->pwqs_node)) {
+		if (WARN_ON_ONCE(!(wq->flags & WQ_UNBOUND)))
+			return;
 
-	mutex_lock(&wq->mutex);
-	list_del_rcu(&pwq->pwqs_node);
-	is_last = list_empty(&wq->pwqs);
-	mutex_unlock(&wq->mutex);
+		mutex_lock(&wq->mutex);
+		list_del_rcu(&pwq->pwqs_node);
+		is_last = list_empty(&wq->pwqs);
+		mutex_unlock(&wq->mutex);
+	}
 
 	mutex_lock(&wq_pool_mutex);
 	put_unbound_pool(pool);

From a8901f205b198e1acd8ed7aba9fede9fd2c4472e Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Tue, 29 Jun 2021 15:22:37 +0800
Subject: [PATCH 2546/2658] net/802/mrp: fix memleak in mrp_request_join()

[ Upstream commit 996af62167d0e0ec69b938a3561e96f84ffff1aa ]

I got kmemleak report when doing fuzz test:

BUG: memory leak
unreferenced object 0xffff88810c239500 (size 64):
comm "syz-executor940", pid 882, jiffies 4294712870 (age 14.631s)
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 01 00 00 00 01 02 00 04 ................
backtrace:
[<00000000a323afa4>] slab_alloc_node mm/slub.c:2972 [inline]
[<00000000a323afa4>] slab_alloc mm/slub.c:2980 [inline]
[<00000000a323afa4>] __kmalloc+0x167/0x340 mm/slub.c:4130
[<000000005034ca11>] kmalloc include/linux/slab.h:595 [inline]
[<000000005034ca11>] mrp_attr_create net/802/mrp.c:276 [inline]
[<000000005034ca11>] mrp_request_join+0x265/0x550 net/802/mrp.c:530
[<00000000fcfd81f3>] vlan_mvrp_request_join+0x145/0x170 net/8021q/vlan_mvrp.c:40
[<000000009258546e>] vlan_dev_open+0x477/0x890 net/8021q/vlan_dev.c:292
[<0000000059acd82b>] __dev_open+0x281/0x410 net/core/dev.c:1609
[<000000004e6dc695>] __dev_change_flags+0x424/0x560 net/core/dev.c:8767
[<00000000471a09af>] rtnl_configure_link+0xd9/0x210 net/core/rtnetlink.c:3122
[<0000000037a4672b>] __rtnl_newlink+0xe08/0x13e0 net/core/rtnetlink.c:3448
[<000000008d5d0fda>] rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3488
[<000000004882fe39>] rtnetlink_rcv_msg+0x369/0xa10 net/core/rtnetlink.c:5552
[<00000000907e6c54>] netlink_rcv_skb+0x134/0x3d0 net/netlink/af_netlink.c:2504
[<00000000e7d7a8c4>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
[<00000000e7d7a8c4>] netlink_unicast+0x4a0/0x6a0 net/netlink/af_netlink.c:1340
[<00000000e0645d50>] netlink_sendmsg+0x78e/0xc90 net/netlink/af_netlink.c:1929
[<00000000c24559b7>] sock_sendmsg_nosec net/socket.c:654 [inline]
[<00000000c24559b7>] sock_sendmsg+0x139/0x170 net/socket.c:674
[<00000000fc210bc2>] ____sys_sendmsg+0x658/0x7d0 net/socket.c:2350
[<00000000be4577b5>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2404

Calling mrp_request_leave() after mrp_request_join(), the attr->state
is set to MRP_APPLICANT_VO, mrp_attr_destroy() won't be called in last
TX event in mrp_uninit_applicant(), the attr of applicant will be leaked.
To fix this leak, iterate and free each attr of applicant before rerturning
from mrp_uninit_applicant().

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/802/mrp.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/net/802/mrp.c b/net/802/mrp.c
index 72db2785ef2c..4ee3af3d400b 100644
--- a/net/802/mrp.c
+++ b/net/802/mrp.c
@@ -295,6 +295,19 @@ static void mrp_attr_destroy(struct mrp_applicant *app, struct mrp_attr *attr)
 	kfree(attr);
 }
 
+static void mrp_attr_destroy_all(struct mrp_applicant *app)
+{
+	struct rb_node *node, *next;
+	struct mrp_attr *attr;
+
+	for (node = rb_first(&app->mad);
+	     next = node ? rb_next(node) : NULL, node != NULL;
+	     node = next) {
+		attr = rb_entry(node, struct mrp_attr, node);
+		mrp_attr_destroy(app, attr);
+	}
+}
+
 static int mrp_pdu_init(struct mrp_applicant *app)
 {
 	struct sk_buff *skb;
@@ -900,6 +913,7 @@ void mrp_uninit_applicant(struct net_device *dev, struct mrp_application *appl)
 
 	spin_lock_bh(&app->lock);
 	mrp_mad_event(app, MRP_EVENT_TX);
+	mrp_attr_destroy_all(app);
 	mrp_pdu_queue(app);
 	spin_unlock_bh(&app->lock);
 

From 5de49b4b06ed800474c46ded7187cd46a3f82fd8 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Tue, 29 Jun 2021 19:53:28 +0800
Subject: [PATCH 2547/2658] net/802/garp: fix memleak in garp_request_join()

[ Upstream commit 42ca63f980842918560b25f0244307fd83b4777c ]

I got kmemleak report when doing fuzz test:

BUG: memory leak
unreferenced object 0xffff88810c909b80 (size 64):
  comm "syz", pid 957, jiffies 4295220394 (age 399.090s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 08 00 00 00 01 02 00 04  ................
  backtrace:
    [<00000000ca1f2e2e>] garp_request_join+0x285/0x3d0
    [<00000000bf153351>] vlan_gvrp_request_join+0x15b/0x190
    [<0000000024005e72>] vlan_dev_open+0x706/0x980
    [<00000000dc20c4d4>] __dev_open+0x2bb/0x460
    [<0000000066573004>] __dev_change_flags+0x501/0x650
    [<0000000035b42f83>] rtnl_configure_link+0xee/0x280
    [<00000000a5e69de0>] __rtnl_newlink+0xed5/0x1550
    [<00000000a5258f4a>] rtnl_newlink+0x66/0x90
    [<00000000506568ee>] rtnetlink_rcv_msg+0x439/0xbd0
    [<00000000b7eaeae1>] netlink_rcv_skb+0x14d/0x420
    [<00000000c373ce66>] netlink_unicast+0x550/0x750
    [<00000000ec74ce74>] netlink_sendmsg+0x88b/0xda0
    [<00000000381ff246>] sock_sendmsg+0xc9/0x120
    [<000000008f6a2db3>] ____sys_sendmsg+0x6e8/0x820
    [<000000008d9c1735>] ___sys_sendmsg+0x145/0x1c0
    [<00000000aa39dd8b>] __sys_sendmsg+0xfe/0x1d0

Calling garp_request_leave() after garp_request_join(), the attr->state
is set to GARP_APPLICANT_VO, garp_attr_destroy() won't be called in last
transmit event in garp_uninit_applicant(), the attr of applicant will be
leaked. To fix this leak, iterate and free each attr of applicant before
rerturning from garp_uninit_applicant().

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/802/garp.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/net/802/garp.c b/net/802/garp.c
index b38ee6dcba45..5239b8f244e7 100644
--- a/net/802/garp.c
+++ b/net/802/garp.c
@@ -206,6 +206,19 @@ static void garp_attr_destroy(struct garp_applicant *app, struct garp_attr *attr
 	kfree(attr);
 }
 
+static void garp_attr_destroy_all(struct garp_applicant *app)
+{
+	struct rb_node *node, *next;
+	struct garp_attr *attr;
+
+	for (node = rb_first(&app->gid);
+	     next = node ? rb_next(node) : NULL, node != NULL;
+	     node = next) {
+		attr = rb_entry(node, struct garp_attr, node);
+		garp_attr_destroy(app, attr);
+	}
+}
+
 static int garp_pdu_init(struct garp_applicant *app)
 {
 	struct sk_buff *skb;
@@ -612,6 +625,7 @@ void garp_uninit_applicant(struct net_device *dev, struct garp_application *appl
 
 	spin_lock_bh(&app->lock);
 	garp_gid_event(app, GARP_EVENT_TRANSMIT_PDU);
+	garp_attr_destroy_all(app);
 	garp_pdu_queue(app);
 	spin_unlock_bh(&app->lock);
 

From a64d6f4794a2fe6646ae4764e378376155403a10 Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Tue, 29 Jun 2021 23:34:08 -0400
Subject: [PATCH 2548/2658] sctp: move 198 addresses from unusable to private
 scope
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 1d11fa231cabeae09a95cb3e4cf1d9dd34e00f08 ]

The doc draft-stewart-tsvwg-sctp-ipv4-00 that restricts 198 addresses
was never published. These addresses as private addresses should be
allowed to use in SCTP.

As Michael Tuexen suggested, this patch is to move 198 addresses from
unusable to private scope.

Reported-by: Sérgio <surkamp@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/sctp/constants.h | 4 +---
 net/sctp/protocol.c          | 3 ++-
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
index bf03bab93d9e..15cfec311500 100644
--- a/include/net/sctp/constants.h
+++ b/include/net/sctp/constants.h
@@ -344,8 +344,7 @@ typedef enum {
 } sctp_scope_policy_t;
 
 /* Based on IPv4 scoping <draft-stewart-tsvwg-sctp-ipv4-00.txt>,
- * SCTP IPv4 unusable addresses: 0.0.0.0/8, 224.0.0.0/4, 198.18.0.0/24,
- * 192.88.99.0/24.
+ * SCTP IPv4 unusable addresses: 0.0.0.0/8, 224.0.0.0/4, 192.88.99.0/24.
  * Also, RFC 8.4, non-unicast addresses are not considered valid SCTP
  * addresses.
  */
@@ -353,7 +352,6 @@ typedef enum {
 	((htonl(INADDR_BROADCAST) == a) ||  \
 	 ipv4_is_multicast(a) ||	    \
 	 ipv4_is_zeronet(a) ||		    \
-	 ipv4_is_test_198(a) ||		    \
 	 ipv4_is_anycast_6to4(a))
 
 /* Flags used for the bind address copy functions.  */
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index b0e401dfe160..8c62792658b6 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -411,7 +411,8 @@ static sctp_scope_t sctp_v4_scope(union sctp_addr *addr)
 		retval = SCTP_SCOPE_LINK;
 	} else if (ipv4_is_private_10(addr->v4.sin_addr.s_addr) ||
 		   ipv4_is_private_172(addr->v4.sin_addr.s_addr) ||
-		   ipv4_is_private_192(addr->v4.sin_addr.s_addr)) {
+		   ipv4_is_private_192(addr->v4.sin_addr.s_addr) ||
+		   ipv4_is_test_198(addr->v4.sin_addr.s_addr)) {
 		retval = SCTP_SCOPE_PRIVATE;
 	} else {
 		retval = SCTP_SCOPE_GLOBAL;

From 922aa12acdad43c50fb6c8055c603f2df6f27981 Mon Sep 17 00:00:00 2001
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Date: Wed, 14 Jul 2021 21:27:01 -0700
Subject: [PATCH 2549/2658] hfs: add missing clean-up in hfs_fill_super

[ Upstream commit 16ee572eaf0d09daa4c8a755fdb71e40dbf8562d ]

Patch series "hfs: fix various errors", v2.

This series ultimately aims to address a lockdep warning in
hfs_find_init reported by Syzbot [1].

The work done for this led to the discovery of another bug, and the
Syzkaller repro test also reveals an invalid memory access error after
clearing the lockdep warning.  Hence, this series is broken up into
three patches:

1. Add a missing call to hfs_find_exit for an error path in
   hfs_fill_super

2. Fix memory mapping in hfs_bnode_read by fixing calls to kmap

3. Add lock nesting notation to tell lockdep that the observed locking
   hierarchy is safe

This patch (of 3):

Before exiting hfs_fill_super, the struct hfs_find_data used in
hfs_find_init should be passed to hfs_find_exit to be cleaned up, and to
release the lock held on the btree.

The call to hfs_find_exit is missing from an error path.  We add it back
in by consolidating calls to hfs_find_exit for error paths.

Link: https://syzkaller.appspot.com/bug?id=f007ef1d7a31a469e3be7aeb0fde0769b18585db [1]
Link: https://lkml.kernel.org/r/20210701030756.58760-1-desmondcheongzx@gmail.com
Link: https://lkml.kernel.org/r/20210701030756.58760-2-desmondcheongzx@gmail.com
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/hfs/super.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index 4574fdd3d421..3eb815bb2c78 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -426,14 +426,12 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent)
 	if (!res) {
 		if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) {
 			res =  -EIO;
-			goto bail;
+			goto bail_hfs_find;
 		}
 		hfs_bnode_read(fd.bnode, &rec, fd.entryoffset, fd.entrylength);
 	}
-	if (res) {
-		hfs_find_exit(&fd);
-		goto bail_no_root;
-	}
+	if (res)
+		goto bail_hfs_find;
 	res = -EINVAL;
 	root_inode = hfs_iget(sb, &fd.search_key->cat, &rec);
 	hfs_find_exit(&fd);
@@ -449,6 +447,8 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent)
 	/* everything's okay */
 	return 0;
 
+bail_hfs_find:
+	hfs_find_exit(&fd);
 bail_no_root:
 	pr_err("get root inode failed\n");
 bail:

From 9f0ac2fae27fcc01e419672d50a319cd5091ad71 Mon Sep 17 00:00:00 2001
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Date: Wed, 14 Jul 2021 21:27:05 -0700
Subject: [PATCH 2550/2658] hfs: fix high memory mapping in hfs_bnode_read

[ Upstream commit 54a5ead6f5e2b47131a7385d0c0af18e7b89cb02 ]

Pages that we read in hfs_bnode_read need to be kmapped into kernel
address space.  However, currently only the 0th page is kmapped.  If the
given offset + length exceeds this 0th page, then we have an invalid
memory access.

To fix this, we kmap relevant pages one by one and copy their relevant
portions of data.

An example of invalid memory access occurring without this fix can be seen
in the following crash report:

  ==================================================================
  BUG: KASAN: use-after-free in memcpy include/linux/fortify-string.h:191 [inline]
  BUG: KASAN: use-after-free in hfs_bnode_read+0xc4/0xe0 fs/hfs/bnode.c:26
  Read of size 2 at addr ffff888125fdcffe by task syz-executor5/4634

  CPU: 0 PID: 4634 Comm: syz-executor5 Not tainted 5.13.0-syzkaller #0
  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
  Call Trace:
   __dump_stack lib/dump_stack.c:79 [inline]
   dump_stack+0x195/0x1f8 lib/dump_stack.c:120
   print_address_description.constprop.0+0x1d/0x110 mm/kasan/report.c:233
   __kasan_report mm/kasan/report.c:419 [inline]
   kasan_report.cold+0x7b/0xd4 mm/kasan/report.c:436
   check_region_inline mm/kasan/generic.c:180 [inline]
   kasan_check_range+0x154/0x1b0 mm/kasan/generic.c:186
   memcpy+0x24/0x60 mm/kasan/shadow.c:65
   memcpy include/linux/fortify-string.h:191 [inline]
   hfs_bnode_read+0xc4/0xe0 fs/hfs/bnode.c:26
   hfs_bnode_read_u16 fs/hfs/bnode.c:34 [inline]
   hfs_bnode_find+0x880/0xcc0 fs/hfs/bnode.c:365
   hfs_brec_find+0x2d8/0x540 fs/hfs/bfind.c:126
   hfs_brec_read+0x27/0x120 fs/hfs/bfind.c:165
   hfs_cat_find_brec+0x19a/0x3b0 fs/hfs/catalog.c:194
   hfs_fill_super+0xc13/0x1460 fs/hfs/super.c:419
   mount_bdev+0x331/0x3f0 fs/super.c:1368
   hfs_mount+0x35/0x40 fs/hfs/super.c:457
   legacy_get_tree+0x10c/0x220 fs/fs_context.c:592
   vfs_get_tree+0x93/0x300 fs/super.c:1498
   do_new_mount fs/namespace.c:2905 [inline]
   path_mount+0x13f5/0x20e0 fs/namespace.c:3235
   do_mount fs/namespace.c:3248 [inline]
   __do_sys_mount fs/namespace.c:3456 [inline]
   __se_sys_mount fs/namespace.c:3433 [inline]
   __x64_sys_mount+0x2b8/0x340 fs/namespace.c:3433
   do_syscall_64+0x37/0xc0 arch/x86/entry/common.c:47
   entry_SYSCALL_64_after_hwframe+0x44/0xae
  RIP: 0033:0x45e63a
  Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 88 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
  RSP: 002b:00007f9404d410d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
  RAX: ffffffffffffffda RBX: 0000000020000248 RCX: 000000000045e63a
  RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9404d41120
  RBP: 00007f9404d41120 R08: 00000000200002c0 R09: 0000000020000000
  R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
  R13: 0000000000000003 R14: 00000000004ad5d8 R15: 0000000000000000

  The buggy address belongs to the page:
  page:00000000dadbcf3e refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x125fdc
  flags: 0x2fffc0000000000(node=0|zone=2|lastcpupid=0x3fff)
  raw: 02fffc0000000000 ffffea000497f748 ffffea000497f6c8 0000000000000000
  raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
  page dumped because: kasan: bad access detected

  Memory state around the buggy address:
   ffff888125fdce80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
   ffff888125fdcf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
  >ffff888125fdcf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                  ^
   ffff888125fdd000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
   ffff888125fdd080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
  ==================================================================

Link: https://lkml.kernel.org/r/20210701030756.58760-3-desmondcheongzx@gmail.com
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/hfs/bnode.c | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
index 221719eac5de..2cda99e61cae 100644
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -14,16 +14,31 @@
 
 #include "btree.h"
 
-void hfs_bnode_read(struct hfs_bnode *node, void *buf,
-		int off, int len)
+void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len)
 {
 	struct page *page;
+	int pagenum;
+	int bytes_read;
+	int bytes_to_read;
+	void *vaddr;
 
 	off += node->page_offset;
-	page = node->page[0];
+	pagenum = off >> PAGE_SHIFT;
+	off &= ~PAGE_MASK; /* compute page offset for the first page */
 
-	memcpy(buf, kmap(page) + off, len);
-	kunmap(page);
+	for (bytes_read = 0; bytes_read < len; bytes_read += bytes_to_read) {
+		if (pagenum >= node->tree->pages_per_bnode)
+			break;
+		page = node->page[pagenum];
+		bytes_to_read = min_t(int, len - bytes_read, PAGE_SIZE - off);
+
+		vaddr = kmap_atomic(page);
+		memcpy(buf + bytes_read, vaddr + off, bytes_to_read);
+		kunmap_atomic(vaddr);
+
+		pagenum++;
+		off = 0; /* page offset only applies to the first page */
+	}
 }
 
 u16 hfs_bnode_read_u16(struct hfs_bnode *node, int off)

From 02f078e3f9165351db2d6f86d308233c7bd797da Mon Sep 17 00:00:00 2001
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Date: Wed, 14 Jul 2021 21:27:08 -0700
Subject: [PATCH 2551/2658] hfs: add lock nesting notation to hfs_find_init

[ Upstream commit b3b2177a2d795e35dc11597b2609eb1e7e57e570 ]

Syzbot reports a possible recursive lock in [1].

This happens due to missing lock nesting information.  From the logs, we
see that a call to hfs_fill_super is made to mount the hfs filesystem.
While searching for the root inode, the lock on the catalog btree is
grabbed.  Then, when the parent of the root isn't found, a call to
__hfs_bnode_create is made to create the parent of the root.  This
eventually leads to a call to hfs_ext_read_extent which grabs a lock on
the extents btree.

Since the order of locking is catalog btree -> extents btree, this lock
hierarchy does not lead to a deadlock.

To tell lockdep that this locking is safe, we add nesting notation to
distinguish between catalog btrees, extents btrees, and attributes
btrees (for HFS+).  This has already been done in hfsplus.

Link: https://syzkaller.appspot.com/bug?id=f007ef1d7a31a469e3be7aeb0fde0769b18585db [1]
Link: https://lkml.kernel.org/r/20210701030756.58760-4-desmondcheongzx@gmail.com
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reported-by: syzbot+b718ec84a87b7e73ade4@syzkaller.appspotmail.com
Tested-by: syzbot+b718ec84a87b7e73ade4@syzkaller.appspotmail.com
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/hfs/bfind.c | 14 +++++++++++++-
 fs/hfs/btree.h |  7 +++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/fs/hfs/bfind.c b/fs/hfs/bfind.c
index de69d8a24f6d..7f2ef95dcd05 100644
--- a/fs/hfs/bfind.c
+++ b/fs/hfs/bfind.c
@@ -24,7 +24,19 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd)
 	fd->key = ptr + tree->max_key_len + 2;
 	hfs_dbg(BNODE_REFS, "find_init: %d (%p)\n",
 		tree->cnid, __builtin_return_address(0));
-	mutex_lock(&tree->tree_lock);
+	switch (tree->cnid) {
+	case HFS_CAT_CNID:
+		mutex_lock_nested(&tree->tree_lock, CATALOG_BTREE_MUTEX);
+		break;
+	case HFS_EXT_CNID:
+		mutex_lock_nested(&tree->tree_lock, EXTENTS_BTREE_MUTEX);
+		break;
+	case HFS_ATTR_CNID:
+		mutex_lock_nested(&tree->tree_lock, ATTR_BTREE_MUTEX);
+		break;
+	default:
+		return -EINVAL;
+	}
 	return 0;
 }
 
diff --git a/fs/hfs/btree.h b/fs/hfs/btree.h
index 2715f416b5a8..308b5f1af65b 100644
--- a/fs/hfs/btree.h
+++ b/fs/hfs/btree.h
@@ -12,6 +12,13 @@ typedef int (*btree_keycmp)(const btree_key *, const btree_key *);
 
 #define NODE_HASH_SIZE  256
 
+/* B-tree mutex nested subclasses */
+enum hfs_btree_mutex_classes {
+	CATALOG_BTREE_MUTEX,
+	EXTENTS_BTREE_MUTEX,
+	ATTR_BTREE_MUTEX,
+};
+
 /* A HFS BTree held in memory */
 struct hfs_btree {
 	struct super_block *sb;

From a2cd556b7dccd30c6dc0e3d5adacd92b416ee599 Mon Sep 17 00:00:00 2001
From: Sudeep Holla <sudeep.holla@arm.com>
Date: Thu, 1 Jul 2021 14:21:18 +0100
Subject: [PATCH 2552/2658] ARM: dts: versatile: Fix up interrupt controller
 node names

[ Upstream commit 82a1c67554dff610d6be4e1982c425717b3c6a23 ]

Once the new schema interrupt-controller/arm,vic.yaml is added, we get
the below warnings:

        arch/arm/boot/dts/versatile-ab.dt.yaml:
        intc@10140000: $nodename:0: 'intc@10140000' does not match
        '^interrupt-controller(@[0-9a-f,]+)*$'

	arch/arm/boot/dts/versatile-ab.dt.yaml:
	intc@10140000: 'clear-mask' does not match any of the regexes

Fix the node names for the interrupt controller to conform
to the standard node name interrupt-controller@.. Also drop invalid
clear-mask property.

Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20210701132118.759454-1-sudeep.holla@arm.com'
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/versatile-ab.dts | 5 ++---
 arch/arm/boot/dts/versatile-pb.dts | 2 +-
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/arch/arm/boot/dts/versatile-ab.dts b/arch/arm/boot/dts/versatile-ab.dts
index 3279bf1a17a1..9bedd2478787 100644
--- a/arch/arm/boot/dts/versatile-ab.dts
+++ b/arch/arm/boot/dts/versatile-ab.dts
@@ -93,16 +93,15 @@
 		#size-cells = <1>;
 		ranges;
 
-		vic: intc@10140000 {
+		vic: interrupt-controller@10140000 {
 			compatible = "arm,versatile-vic";
 			interrupt-controller;
 			#interrupt-cells = <1>;
 			reg = <0x10140000 0x1000>;
-			clear-mask = <0xffffffff>;
 			valid-mask = <0xffffffff>;
 		};
 
-		sic: intc@10003000 {
+		sic: interrupt-controller@10003000 {
 			compatible = "arm,versatile-sic";
 			interrupt-controller;
 			#interrupt-cells = <1>;
diff --git a/arch/arm/boot/dts/versatile-pb.dts b/arch/arm/boot/dts/versatile-pb.dts
index 33a8eb28374e..3a23164c2c2d 100644
--- a/arch/arm/boot/dts/versatile-pb.dts
+++ b/arch/arm/boot/dts/versatile-pb.dts
@@ -6,7 +6,7 @@
 
 	amba {
 		/* The Versatile PB is using more SIC IRQ lines than the AB */
-		sic: intc@10003000 {
+		sic: interrupt-controller@10003000 {
 			clear-mask = <0xffffffff>;
 			/*
 			 * Valid interrupt lines mask according to

From 393063a8307f7da8537f698c12a87b43c8a5fc3f Mon Sep 17 00:00:00 2001
From: Matthew Wilcox <mawilcox@microsoft.com>
Date: Fri, 8 Sep 2017 16:13:48 -0700
Subject: [PATCH 2553/2658] lib/string.c: add multibyte memset functions

commit 3b3c4babd898715926d24ae10aa64778ace33aae upstream.

Patch series "Multibyte memset variations", v4.

A relatively common idiom we're missing is a function to fill an area of
memory with a pattern which is larger than a single byte.  I first
noticed this with a zram patch which wanted to fill a page with an
'unsigned long' value.  There turn out to be quite a few places in the
kernel which can benefit from using an optimised function rather than a
loop; sometimes text size, sometimes speed, and sometimes both.  The
optimised PowerPC version (not included here) improves performance by
about 30% on POWER8 on just the raw memset_l().

Most of the extra lines of code come from the three testcases I added.

This patch (of 8):

memset16(), memset32() and memset64() are like memset(), but allow the
caller to fill the destination with a value larger than a single byte.
memset_l() and memset_p() allow the caller to use unsigned long and
pointer values respectively.

Link: http://lkml.kernel.org/r/20170720184539.31609-2-willy@infradead.org
Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: "James E.J. Bottomley" <jejb@linux.vnet.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: David Miller <davem@davemloft.net>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Matt Turner <mattst88@gmail.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Russell King <rmk+kernel@armlinux.org.uk>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/string.h | 30 +++++++++++++++++++
 lib/string.c           | 66 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 96 insertions(+)

diff --git a/include/linux/string.h b/include/linux/string.h
index 7da409760cf1..1a9589a5ace6 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -102,6 +102,36 @@ extern __kernel_size_t strcspn(const char *,const char *);
 #ifndef __HAVE_ARCH_MEMSET
 extern void * memset(void *,int,__kernel_size_t);
 #endif
+
+#ifndef __HAVE_ARCH_MEMSET16
+extern void *memset16(uint16_t *, uint16_t, __kernel_size_t);
+#endif
+
+#ifndef __HAVE_ARCH_MEMSET32
+extern void *memset32(uint32_t *, uint32_t, __kernel_size_t);
+#endif
+
+#ifndef __HAVE_ARCH_MEMSET64
+extern void *memset64(uint64_t *, uint64_t, __kernel_size_t);
+#endif
+
+static inline void *memset_l(unsigned long *p, unsigned long v,
+		__kernel_size_t n)
+{
+	if (BITS_PER_LONG == 32)
+		return memset32((uint32_t *)p, v, n);
+	else
+		return memset64((uint64_t *)p, v, n);
+}
+
+static inline void *memset_p(void **p, void *v, __kernel_size_t n)
+{
+	if (BITS_PER_LONG == 32)
+		return memset32((uint32_t *)p, (uintptr_t)v, n);
+	else
+		return memset64((uint64_t *)p, (uintptr_t)v, n);
+}
+
 #ifndef __HAVE_ARCH_MEMCPY
 extern void * memcpy(void *,const void *,__kernel_size_t);
 #endif
diff --git a/lib/string.c b/lib/string.c
index 4351ec43cd6b..2c6826fbe77a 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -728,6 +728,72 @@ void memzero_explicit(void *s, size_t count)
 }
 EXPORT_SYMBOL(memzero_explicit);
 
+#ifndef __HAVE_ARCH_MEMSET16
+/**
+ * memset16() - Fill a memory area with a uint16_t
+ * @s: Pointer to the start of the area.
+ * @v: The value to fill the area with
+ * @count: The number of values to store
+ *
+ * Differs from memset() in that it fills with a uint16_t instead
+ * of a byte.  Remember that @count is the number of uint16_ts to
+ * store, not the number of bytes.
+ */
+void *memset16(uint16_t *s, uint16_t v, size_t count)
+{
+	uint16_t *xs = s;
+
+	while (count--)
+		*xs++ = v;
+	return s;
+}
+EXPORT_SYMBOL(memset16);
+#endif
+
+#ifndef __HAVE_ARCH_MEMSET32
+/**
+ * memset32() - Fill a memory area with a uint32_t
+ * @s: Pointer to the start of the area.
+ * @v: The value to fill the area with
+ * @count: The number of values to store
+ *
+ * Differs from memset() in that it fills with a uint32_t instead
+ * of a byte.  Remember that @count is the number of uint32_ts to
+ * store, not the number of bytes.
+ */
+void *memset32(uint32_t *s, uint32_t v, size_t count)
+{
+	uint32_t *xs = s;
+
+	while (count--)
+		*xs++ = v;
+	return s;
+}
+EXPORT_SYMBOL(memset32);
+#endif
+
+#ifndef __HAVE_ARCH_MEMSET64
+/**
+ * memset64() - Fill a memory area with a uint64_t
+ * @s: Pointer to the start of the area.
+ * @v: The value to fill the area with
+ * @count: The number of values to store
+ *
+ * Differs from memset() in that it fills with a uint64_t instead
+ * of a byte.  Remember that @count is the number of uint64_ts to
+ * store, not the number of bytes.
+ */
+void *memset64(uint64_t *s, uint64_t v, size_t count)
+{
+	uint64_t *xs = s;
+
+	while (count--)
+		*xs++ = v;
+	return s;
+}
+EXPORT_SYMBOL(memset64);
+#endif
+
 #ifndef __HAVE_ARCH_MEMCPY
 /**
  * memcpy - Copy one area of memory to another

From f07ea7cc36bdde6e9ddb8854dbb3b23ba05db78f Mon Sep 17 00:00:00 2001
From: Russell King <rmk+kernel@armlinux.org.uk>
Date: Fri, 29 Jan 2021 10:19:07 +0000
Subject: [PATCH 2554/2658] ARM: ensure the signal page contains defined
 contents

commit 9c698bff66ab4914bb3d71da7dc6112519bde23e upstream.

Ensure that the signal page contains our poison instruction to increase
the protection against ROP attacks and also contains well defined
contents.

Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/kernel/signal.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index 0a066f03b5ec..180c1782ad63 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -625,18 +625,20 @@ struct page *get_signal_page(void)
 
 	addr = page_address(page);
 
+	/* Poison the entire page */
+	memset32(addr, __opcode_to_mem_arm(0xe7fddef1),
+		 PAGE_SIZE / sizeof(u32));
+
 	/* Give the signal return code some randomness */
 	offset = 0x200 + (get_random_int() & 0x7fc);
 	signal_return_offset = offset;
 
-	/*
-	 * Copy signal return handlers into the vector page, and
-	 * set sigreturn to be a pointer to these.
-	 */
+	/* Copy signal return handlers into the page */
 	memcpy(addr + offset, sigreturn_codes, sizeof(sigreturn_codes));
 
-	ptr = (unsigned long)addr + offset;
-	flush_icache_range(ptr, ptr + sizeof(sigreturn_codes));
+	/* Flush out all instructions in this page */
+	ptr = (unsigned long)addr;
+	flush_icache_range(ptr, ptr + PAGE_SIZE);
 
 	return page;
 }

From cd23212e772b1f87cd3b87461721f2a4e5811916 Mon Sep 17 00:00:00 2001
From: Junxiao Bi <junxiao.bi@oracle.com>
Date: Thu, 29 Jul 2021 14:53:38 -0700
Subject: [PATCH 2555/2658] ocfs2: fix zero out valid data

commit f267aeb6dea5e468793e5b8eb6a9c72c0020d418 upstream.

If append-dio feature is enabled, direct-io write and fallocate could
run in parallel to extend file size, fallocate used "orig_isize" to
record i_size before taking "ip_alloc_sem", when
ocfs2_zeroout_partial_cluster() zeroout EOF blocks, i_size maybe already
extended by ocfs2_dio_end_io_write(), that will cause valid data zeroed
out.

Link: https://lkml.kernel.org/r/20210722054923.24389-1-junxiao.bi@oracle.com
Fixes: 6bba4471f0cc ("ocfs2: fix data corruption by fallocate")
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/file.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 5b0f2c806f03..ff3d8afe7f00 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1939,7 +1939,6 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
 		goto out_inode_unlock;
 	}
 
-	orig_isize = i_size_read(inode);
 	switch (sr->l_whence) {
 	case 0: /*SEEK_SET*/
 		break;
@@ -1947,7 +1946,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
 		sr->l_start += f_pos;
 		break;
 	case 2: /*SEEK_END*/
-		sr->l_start += orig_isize;
+		sr->l_start += i_size_read(inode);
 		break;
 	default:
 		ret = -EINVAL;
@@ -2002,6 +2001,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
 		ret = -EINVAL;
 	}
 
+	orig_isize = i_size_read(inode);
 	/* zeroout eof blocks in the cluster. */
 	if (!ret && change_size && orig_isize < size) {
 		ret = ocfs2_zeroout_partial_cluster(inode, orig_isize,

From e6bf5f589f475f6b8aec9c24668e7dbef6dcd785 Mon Sep 17 00:00:00 2001
From: Junxiao Bi <junxiao.bi@oracle.com>
Date: Thu, 29 Jul 2021 14:53:41 -0700
Subject: [PATCH 2556/2658] ocfs2: issue zeroout to EOF blocks

commit 9449ad33be8480f538b11a593e2dda2fb33ca06d upstream.

For punch holes in EOF blocks, fallocate used buffer write to zero the
EOF blocks in last cluster.  But since ->writepage will ignore EOF
pages, those zeros will not be flushed.

This "looks" ok as commit 6bba4471f0cc ("ocfs2: fix data corruption by
fallocate") will zero the EOF blocks when extend the file size, but it
isn't.  The problem happened on those EOF pages, before writeback, those
pages had DIRTY flag set and all buffer_head in them also had DIRTY flag
set, when writeback run by write_cache_pages(), DIRTY flag on the page
was cleared, but DIRTY flag on the buffer_head not.

When next write happened to those EOF pages, since buffer_head already
had DIRTY flag set, it would not mark page DIRTY again.  That made
writeback ignore them forever.  That will cause data corruption.  Even
directio write can't work because it will fail when trying to drop pages
caches before direct io, as it found the buffer_head for those pages
still had DIRTY flag set, then it will fall back to buffer io mode.

To make a summary of the issue, as writeback ingores EOF pages, once any
EOF page is generated, any write to it will only go to the page cache,
it will never be flushed to disk even file size extends and that page is
not EOF page any more.  The fix is to avoid zero EOF blocks with buffer
write.

The following code snippet from qemu-img could trigger the corruption.

  656   open("6b3711ae-3306-4bdd-823c-cf1c0060a095.conv.2", O_RDWR|O_DIRECT|O_CLOEXEC) = 11
  ...
  660   fallocate(11, FALLOC_FL_KEEP_SIZE|FALLOC_FL_PUNCH_HOLE, 2275868672, 327680 <unfinished ...>
  660   fallocate(11, 0, 2275868672, 327680) = 0
  658   pwrite64(11, "

Link: https://lkml.kernel.org/r/20210722054923.24389-2-junxiao.bi@oracle.com
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/file.c | 99 ++++++++++++++++++++++++++++++-------------------
 1 file changed, 60 insertions(+), 39 deletions(-)

diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index ff3d8afe7f00..0de92ad0ba79 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1532,6 +1532,45 @@ static void ocfs2_truncate_cluster_pages(struct inode *inode, u64 byte_start,
 	}
 }
 
+/*
+ * zero out partial blocks of one cluster.
+ *
+ * start: file offset where zero starts, will be made upper block aligned.
+ * len: it will be trimmed to the end of current cluster if "start + len"
+ *      is bigger than it.
+ */
+static int ocfs2_zeroout_partial_cluster(struct inode *inode,
+					u64 start, u64 len)
+{
+	int ret;
+	u64 start_block, end_block, nr_blocks;
+	u64 p_block, offset;
+	u32 cluster, p_cluster, nr_clusters;
+	struct super_block *sb = inode->i_sb;
+	u64 end = ocfs2_align_bytes_to_clusters(sb, start);
+
+	if (start + len < end)
+		end = start + len;
+
+	start_block = ocfs2_blocks_for_bytes(sb, start);
+	end_block = ocfs2_blocks_for_bytes(sb, end);
+	nr_blocks = end_block - start_block;
+	if (!nr_blocks)
+		return 0;
+
+	cluster = ocfs2_bytes_to_clusters(sb, start);
+	ret = ocfs2_get_clusters(inode, cluster, &p_cluster,
+				&nr_clusters, NULL);
+	if (ret)
+		return ret;
+	if (!p_cluster)
+		return 0;
+
+	offset = start_block - ocfs2_clusters_to_blocks(sb, cluster);
+	p_block = ocfs2_clusters_to_blocks(sb, p_cluster) + offset;
+	return sb_issue_zeroout(sb, p_block, nr_blocks, GFP_NOFS);
+}
+
 static int ocfs2_zero_partial_clusters(struct inode *inode,
 				       u64 start, u64 len)
 {
@@ -1541,6 +1580,7 @@ static int ocfs2_zero_partial_clusters(struct inode *inode,
 	struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
 	unsigned int csize = osb->s_clustersize;
 	handle_t *handle;
+	loff_t isize = i_size_read(inode);
 
 	/*
 	 * The "start" and "end" values are NOT necessarily part of
@@ -1561,6 +1601,26 @@ static int ocfs2_zero_partial_clusters(struct inode *inode,
 	if ((start & (csize - 1)) == 0 && (end & (csize - 1)) == 0)
 		goto out;
 
+	/* No page cache for EOF blocks, issue zero out to disk. */
+	if (end > isize) {
+		/*
+		 * zeroout eof blocks in last cluster starting from
+		 * "isize" even "start" > "isize" because it is
+		 * complicated to zeroout just at "start" as "start"
+		 * may be not aligned with block size, buffer write
+		 * would be required to do that, but out of eof buffer
+		 * write is not supported.
+		 */
+		ret = ocfs2_zeroout_partial_cluster(inode, isize,
+					end - isize);
+		if (ret) {
+			mlog_errno(ret);
+			goto out;
+		}
+		if (start >= isize)
+			goto out;
+		end = isize;
+	}
 	handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS);
 	if (IS_ERR(handle)) {
 		ret = PTR_ERR(handle);
@@ -1859,45 +1919,6 @@ static int ocfs2_remove_inode_range(struct inode *inode,
 	return ret;
 }
 
-/*
- * zero out partial blocks of one cluster.
- *
- * start: file offset where zero starts, will be made upper block aligned.
- * len: it will be trimmed to the end of current cluster if "start + len"
- *      is bigger than it.
- */
-static int ocfs2_zeroout_partial_cluster(struct inode *inode,
-					u64 start, u64 len)
-{
-	int ret;
-	u64 start_block, end_block, nr_blocks;
-	u64 p_block, offset;
-	u32 cluster, p_cluster, nr_clusters;
-	struct super_block *sb = inode->i_sb;
-	u64 end = ocfs2_align_bytes_to_clusters(sb, start);
-
-	if (start + len < end)
-		end = start + len;
-
-	start_block = ocfs2_blocks_for_bytes(sb, start);
-	end_block = ocfs2_blocks_for_bytes(sb, end);
-	nr_blocks = end_block - start_block;
-	if (!nr_blocks)
-		return 0;
-
-	cluster = ocfs2_bytes_to_clusters(sb, start);
-	ret = ocfs2_get_clusters(inode, cluster, &p_cluster,
-				&nr_clusters, NULL);
-	if (ret)
-		return ret;
-	if (!p_cluster)
-		return 0;
-
-	offset = start_block - ocfs2_clusters_to_blocks(sb, cluster);
-	p_block = ocfs2_clusters_to_blocks(sb, p_cluster) + offset;
-	return sb_issue_zeroout(sb, p_block, nr_blocks, GFP_NOFS);
-}
-
 /*
  * Parts of this function taken from xfs_change_file_space()
  */

From 26a4552a5314482cbac43070d28c376611532576 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Tue, 27 Jul 2021 19:59:57 +0300
Subject: [PATCH 2557/2658] can: usb_8dev: fix memory leak

commit 0e865f0c31928d6a313269ef624907eec55287c4 upstream.

In usb_8dev_start() MAX_RX_URBS coherent buffers are allocated and
there is nothing, that frees them:

1) In callback function the urb is resubmitted and that's all
2) In disconnect function urbs are simply killed, but URB_FREE_BUFFER
   is not set (see usb_8dev_start) and this flag cannot be used with
   coherent buffers.

So, all allocated buffers should be freed with usb_free_coherent()
explicitly.

Side note: This code looks like a copy-paste of other can drivers. The
same patch was applied to mcba_usb driver and it works nice with real
hardware. There is no change in functionality, only clean-up code for
coherent buffers.

Fixes: 0024d8ad1639 ("can: usb_8dev: Add support for USB2CAN interface from 8 devices")
Link: https://lore.kernel.org/r/d39b458cd425a1cf7f512f340224e6e9563b07bd.1627404470.git.paskripkin@gmail.com
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/usb/usb_8dev.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
index 50d9b945089e..11d045699344 100644
--- a/drivers/net/can/usb/usb_8dev.c
+++ b/drivers/net/can/usb/usb_8dev.c
@@ -148,7 +148,8 @@ struct usb_8dev_priv {
 	u8 *cmd_msg_buffer;
 
 	struct mutex usb_8dev_cmd_lock;
-
+	void *rxbuf[MAX_RX_URBS];
+	dma_addr_t rxbuf_dma[MAX_RX_URBS];
 };
 
 /* tx frame */
@@ -746,6 +747,7 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
 	for (i = 0; i < MAX_RX_URBS; i++) {
 		struct urb *urb = NULL;
 		u8 *buf;
+		dma_addr_t buf_dma;
 
 		/* create a URB, and a buffer for it */
 		urb = usb_alloc_urb(0, GFP_KERNEL);
@@ -756,7 +758,7 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
 		}
 
 		buf = usb_alloc_coherent(priv->udev, RX_BUFFER_SIZE, GFP_KERNEL,
-					 &urb->transfer_dma);
+					 &buf_dma);
 		if (!buf) {
 			netdev_err(netdev, "No memory left for USB buffer\n");
 			usb_free_urb(urb);
@@ -764,6 +766,8 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
 			break;
 		}
 
+		urb->transfer_dma = buf_dma;
+
 		usb_fill_bulk_urb(urb, priv->udev,
 				  usb_rcvbulkpipe(priv->udev,
 						  USB_8DEV_ENDP_DATA_RX),
@@ -781,6 +785,9 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
 			break;
 		}
 
+		priv->rxbuf[i] = buf;
+		priv->rxbuf_dma[i] = buf_dma;
+
 		/* Drop reference, USB core will take care of freeing it */
 		usb_free_urb(urb);
 	}
@@ -850,6 +857,10 @@ static void unlink_all_urbs(struct usb_8dev_priv *priv)
 
 	usb_kill_anchored_urbs(&priv->rx_submitted);
 
+	for (i = 0; i < MAX_RX_URBS; ++i)
+		usb_free_coherent(priv->udev, RX_BUFFER_SIZE,
+				  priv->rxbuf[i], priv->rxbuf_dma[i]);
+
 	usb_kill_anchored_urbs(&priv->tx_submitted);
 	atomic_set(&priv->active_tx_urbs, 0);
 

From 0fcef42ccc1fe710e7c982fa7fcd8744a3f59da2 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Tue, 27 Jul 2021 20:00:33 +0300
Subject: [PATCH 2558/2658] can: ems_usb: fix memory leak

commit 9969e3c5f40c166e3396acc36c34f9de502929f6 upstream.

In ems_usb_start() MAX_RX_URBS coherent buffers are allocated and
there is nothing, that frees them:

1) In callback function the urb is resubmitted and that's all
2) In disconnect function urbs are simply killed, but URB_FREE_BUFFER
   is not set (see ems_usb_start) and this flag cannot be used with
   coherent buffers.

So, all allocated buffers should be freed with usb_free_coherent()
explicitly.

Side note: This code looks like a copy-paste of other can drivers. The
same patch was applied to mcba_usb driver and it works nice with real
hardware. There is no change in functionality, only clean-up code for
coherent buffers.

Fixes: 702171adeed3 ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB interface")
Link: https://lore.kernel.org/r/59aa9fbc9a8cbf9af2bbd2f61a659c480b415800.1627404470.git.paskripkin@gmail.com
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/usb/ems_usb.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index a6da322e4cdc..f0f60e1fde66 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -267,6 +267,8 @@ struct ems_usb {
 	unsigned int free_slots; /* remember number of available slots */
 
 	struct ems_cpc_msg active_params; /* active controller parameters */
+	void *rxbuf[MAX_RX_URBS];
+	dma_addr_t rxbuf_dma[MAX_RX_URBS];
 };
 
 static void ems_usb_read_interrupt_callback(struct urb *urb)
@@ -600,6 +602,7 @@ static int ems_usb_start(struct ems_usb *dev)
 	for (i = 0; i < MAX_RX_URBS; i++) {
 		struct urb *urb = NULL;
 		u8 *buf = NULL;
+		dma_addr_t buf_dma;
 
 		/* create a URB, and a buffer for it */
 		urb = usb_alloc_urb(0, GFP_KERNEL);
@@ -610,7 +613,7 @@ static int ems_usb_start(struct ems_usb *dev)
 		}
 
 		buf = usb_alloc_coherent(dev->udev, RX_BUFFER_SIZE, GFP_KERNEL,
-					 &urb->transfer_dma);
+					 &buf_dma);
 		if (!buf) {
 			netdev_err(netdev, "No memory left for USB buffer\n");
 			usb_free_urb(urb);
@@ -618,6 +621,8 @@ static int ems_usb_start(struct ems_usb *dev)
 			break;
 		}
 
+		urb->transfer_dma = buf_dma;
+
 		usb_fill_bulk_urb(urb, dev->udev, usb_rcvbulkpipe(dev->udev, 2),
 				  buf, RX_BUFFER_SIZE,
 				  ems_usb_read_bulk_callback, dev);
@@ -633,6 +638,9 @@ static int ems_usb_start(struct ems_usb *dev)
 			break;
 		}
 
+		dev->rxbuf[i] = buf;
+		dev->rxbuf_dma[i] = buf_dma;
+
 		/* Drop reference, USB core will take care of freeing it */
 		usb_free_urb(urb);
 	}
@@ -698,6 +706,10 @@ static void unlink_all_urbs(struct ems_usb *dev)
 
 	usb_kill_anchored_urbs(&dev->rx_submitted);
 
+	for (i = 0; i < MAX_RX_URBS; ++i)
+		usb_free_coherent(dev->udev, RX_BUFFER_SIZE,
+				  dev->rxbuf[i], dev->rxbuf_dma[i]);
+
 	usb_kill_anchored_urbs(&dev->tx_submitted);
 	atomic_set(&dev->active_tx_urbs, 0);
 

From f3891116c7966222ae0c09ea80817a7adf7f0de6 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Tue, 27 Jul 2021 20:00:46 +0300
Subject: [PATCH 2559/2658] can: esd_usb2: fix memory leak

commit 928150fad41ba16df7fcc9f7f945747d0f56cbb6 upstream.

In esd_usb2_setup_rx_urbs() MAX_RX_URBS coherent buffers are allocated
and there is nothing, that frees them:

1) In callback function the urb is resubmitted and that's all
2) In disconnect function urbs are simply killed, but URB_FREE_BUFFER
   is not set (see esd_usb2_setup_rx_urbs) and this flag cannot be used
   with coherent buffers.

So, all allocated buffers should be freed with usb_free_coherent()
explicitly.

Side note: This code looks like a copy-paste of other can drivers. The
same patch was applied to mcba_usb driver and it works nice with real
hardware. There is no change in functionality, only clean-up code for
coherent buffers.

Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device")
Link: https://lore.kernel.org/r/b31b096926dcb35998ad0271aac4b51770ca7cc8.1627404470.git.paskripkin@gmail.com
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/usb/esd_usb2.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index afa5b4a7a4a2..a8ebdcbc8935 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -207,6 +207,8 @@ struct esd_usb2 {
 	int net_count;
 	u32 version;
 	int rxinitdone;
+	void *rxbuf[MAX_RX_URBS];
+	dma_addr_t rxbuf_dma[MAX_RX_URBS];
 };
 
 struct esd_usb2_net_priv {
@@ -556,6 +558,7 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev)
 	for (i = 0; i < MAX_RX_URBS; i++) {
 		struct urb *urb = NULL;
 		u8 *buf = NULL;
+		dma_addr_t buf_dma;
 
 		/* create a URB, and a buffer for it */
 		urb = usb_alloc_urb(0, GFP_KERNEL);
@@ -567,7 +570,7 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev)
 		}
 
 		buf = usb_alloc_coherent(dev->udev, RX_BUFFER_SIZE, GFP_KERNEL,
-					 &urb->transfer_dma);
+					 &buf_dma);
 		if (!buf) {
 			dev_warn(dev->udev->dev.parent,
 				 "No memory left for USB buffer\n");
@@ -575,6 +578,8 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev)
 			goto freeurb;
 		}
 
+		urb->transfer_dma = buf_dma;
+
 		usb_fill_bulk_urb(urb, dev->udev,
 				  usb_rcvbulkpipe(dev->udev, 1),
 				  buf, RX_BUFFER_SIZE,
@@ -587,8 +592,12 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev)
 			usb_unanchor_urb(urb);
 			usb_free_coherent(dev->udev, RX_BUFFER_SIZE, buf,
 					  urb->transfer_dma);
+			goto freeurb;
 		}
 
+		dev->rxbuf[i] = buf;
+		dev->rxbuf_dma[i] = buf_dma;
+
 freeurb:
 		/* Drop reference, USB core will take care of freeing it */
 		usb_free_urb(urb);
@@ -676,6 +685,11 @@ static void unlink_all_urbs(struct esd_usb2 *dev)
 	int i, j;
 
 	usb_kill_anchored_urbs(&dev->rx_submitted);
+
+	for (i = 0; i < MAX_RX_URBS; ++i)
+		usb_free_coherent(dev->udev, RX_BUFFER_SIZE,
+				  dev->rxbuf[i], dev->rxbuf_dma[i]);
+
 	for (i = 0; i < dev->net_count; i++) {
 		priv = dev->nets[i];
 		if (priv) {

From c886d9f97f85bea243fdcd1bec682682195411c6 Mon Sep 17 00:00:00 2001
From: Paul Jakma <paul@jakma.org>
Date: Fri, 23 Jul 2021 16:13:04 +0100
Subject: [PATCH 2560/2658] NIU: fix incorrect error return, missed in previous
 revert

commit 15bbf8bb4d4ab87108ecf5f4155ec8ffa3c141d6 upstream.

Commit 7930742d6, reverting 26fd962, missed out on reverting an incorrect
change to a return value.  The niu_pci_vpd_scan_props(..) == 1 case appears
to be a normal path - treating it as an error and return -EINVAL was
breaking VPD_SCAN and causing the driver to fail to load.

Fix, so my Neptune card works again.

Cc: Kangjie Lu <kjlu@umn.edu>
Cc: Shannon Nelson <shannon.lee.nelson@gmail.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: stable <stable@vger.kernel.org>
Fixes: 7930742d ('Revert "niu: fix missing checks of niu_pci_eeprom_read"')
Signed-off-by: Paul Jakma <paul@jakma.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/sun/niu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index 3fb6f57dbbb3..7354ad25252d 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -8213,8 +8213,9 @@ static int niu_pci_vpd_fetch(struct niu *np, u32 start)
 		err = niu_pci_vpd_scan_props(np, here, end);
 		if (err < 0)
 			return err;
+		/* ret == 1 is not an error */
 		if (err == 1)
-			return -EINVAL;
+			return 0;
 	}
 	return 0;
 }

From 67b3ae5c33299cd6df5a080b4cf0b8d0275dd424 Mon Sep 17 00:00:00 2001
From: Jan Kiszka <jan.kiszka@siemens.com>
Date: Sun, 11 Apr 2021 10:12:16 +0200
Subject: [PATCH 2561/2658] x86/asm: Ensure asm/proto.h can be included
 stand-alone
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit f7b21a0e41171d22296b897dac6e4c41d2a3643c ]

Fix:

  ../arch/x86/include/asm/proto.h:14:30: warning: ‘struct task_struct’ declared \
    inside parameter list will not be visible outside of this definition or declaration
  long do_arch_prctl_64(struct task_struct *task, int option, unsigned long arg2);
                               ^~~~~~~~~~~

  .../arch/x86/include/asm/proto.h:40:34: warning: ‘struct task_struct’ declared \
    inside parameter list will not be visible outside of this definition or declaration
   long do_arch_prctl_common(struct task_struct *task, int option,
                                    ^~~~~~~~~~~

if linux/sched.h hasn't be included previously. This fixes a build error
when this header is used outside of the kernel tree.

 [ bp: Massage commit message. ]

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/b76b4be3-cf66-f6b2-9a6c-3e7ef54f9845@web.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/proto.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/include/asm/proto.h b/arch/x86/include/asm/proto.h
index a4a77286cb1d..ae6f1592530b 100644
--- a/arch/x86/include/asm/proto.h
+++ b/arch/x86/include/asm/proto.h
@@ -3,6 +3,8 @@
 
 #include <asm/ldt.h>
 
+struct task_struct;
+
 /* misc architecture specific prototypes */
 
 void syscall_init(void);

From 2ed54702547a60a33b152b415f01f6273f82e285 Mon Sep 17 00:00:00 2001
From: Nguyen Dinh Phi <phind.uet@gmail.com>
Date: Mon, 28 Jun 2021 21:23:34 +0800
Subject: [PATCH 2562/2658] cfg80211: Fix possible memory leak in function
 cfg80211_bss_update

commit f9a5c358c8d26fed0cc45f2afc64633d4ba21dff upstream.

When we exceed the limit of BSS entries, this function will free the
new entry, however, at this time, it is the last door to access the
inputed ies, so these ies will be unreferenced objects and cause memory
leak.
Therefore we should free its ies before deallocating the new entry, beside
of dropping it from hidden_list.

Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com>
Link: https://lore.kernel.org/r/20210628132334.851095-1-phind.uet@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/wireless/scan.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 79ff22d3b225..c420f2eb43a2 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -947,16 +947,14 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev,
 			 * be grouped with this beacon for updates ...
 			 */
 			if (!cfg80211_combine_bsses(rdev, new)) {
-				kfree(new);
+				bss_ref_put(rdev, new);
 				goto drop;
 			}
 		}
 
 		if (rdev->bss_entries >= bss_entries_limit &&
 		    !cfg80211_bss_expire_oldest(rdev)) {
-			if (!list_empty(&new->hidden_list))
-				list_del(&new->hidden_list);
-			kfree(new);
+			bss_ref_put(rdev, new);
 			goto drop;
 		}
 

From e6196fd800bad17049791ca22792858e94fa98da Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 20 Jul 2021 18:22:50 +0200
Subject: [PATCH 2563/2658] netfilter: nft_nat: allow to specify layer 4
 protocol NAT only

[ Upstream commit a33f387ecd5aafae514095c2c4a8c24f7aea7e8b ]

nft_nat reports a bogus EAFNOSUPPORT if no layer 3 information is specified.

Fixes: d07db9884a5f ("netfilter: nf_tables: introduce nft_validate_register_load()")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nft_nat.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index 868480b83649..182704b980d1 100644
--- a/net/netfilter/nft_nat.c
+++ b/net/netfilter/nft_nat.c
@@ -157,7 +157,9 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
 		alen = FIELD_SIZEOF(struct nf_nat_range, min_addr.ip6);
 		break;
 	default:
-		return -EAFNOSUPPORT;
+		if (tb[NFTA_NAT_REG_ADDR_MIN])
+			return -EAFNOSUPPORT;
+		break;
 	}
 	priv->family = family;
 

From 9349174ab107ab07c880d1f3bb1950cbe671bdef Mon Sep 17 00:00:00 2001
From: Hoang Le <hoang.h.le@dektech.com.au>
Date: Fri, 23 Jul 2021 09:25:34 +0700
Subject: [PATCH 2564/2658] tipc: fix sleeping in tipc accept routine

[ Upstream commit d237a7f11719ff9320721be5818352e48071aab6 ]

The release_sock() is blocking function, it would change the state
after sleeping. In order to evaluate the stated condition outside
the socket lock context, switch to use wait_woken() instead.

Fixes: 6398e23cdb1d8 ("tipc: standardize accept routine")
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tipc/socket.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 3ad9158ecf30..9d15bb865eea 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1987,7 +1987,7 @@ static int tipc_listen(struct socket *sock, int len)
 static int tipc_wait_for_accept(struct socket *sock, long timeo)
 {
 	struct sock *sk = sock->sk;
-	DEFINE_WAIT(wait);
+	DEFINE_WAIT_FUNC(wait, woken_wake_function);
 	int err;
 
 	/* True wake-one mechanism for incoming connections: only
@@ -1996,12 +1996,12 @@ static int tipc_wait_for_accept(struct socket *sock, long timeo)
 	 * anymore, the common case will execute the loop only once.
 	*/
 	for (;;) {
-		prepare_to_wait_exclusive(sk_sleep(sk), &wait,
-					  TASK_INTERRUPTIBLE);
 		if (timeo && skb_queue_empty(&sk->sk_receive_queue)) {
+			add_wait_queue(sk_sleep(sk), &wait);
 			release_sock(sk);
-			timeo = schedule_timeout(timeo);
+			timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
 			lock_sock(sk);
+			remove_wait_queue(sk_sleep(sk), &wait);
 		}
 		err = 0;
 		if (!skb_queue_empty(&sk->sk_receive_queue))
@@ -2016,7 +2016,6 @@ static int tipc_wait_for_accept(struct socket *sock, long timeo)
 		if (signal_pending(current))
 			break;
 	}
-	finish_wait(sk_sleep(sk), &wait);
 	return err;
 }
 

From 1a3b1054d6fbe9f0ed626a0a492db1c30f94021b Mon Sep 17 00:00:00 2001
From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Date: Fri, 23 Jul 2021 18:36:09 +0800
Subject: [PATCH 2565/2658] mlx4: Fix missing error code in mlx4_load_one()

[ Upstream commit 7e4960b3d66d7248b23de3251118147812b42da2 ]

The error code is missing in this code scenario, add the error code
'-EINVAL' to the return value 'err'.

Eliminate the follow smatch warning:

drivers/net/ethernet/mellanox/mlx4/main.c:3538 mlx4_load_one() warn:
missing error code 'err'.

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Fixes: 7ae0e400cd93 ("net/mlx4_core: Flexible (asymmetric) allocation of EQs and MSI-X vectors for PF/VFs")
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx4/main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index b774ba64bd4b..913e0fd10fde 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -3222,6 +3222,7 @@ static int mlx4_load_one(struct pci_dev *pdev, int pci_dev_data,
 
 		if (!SRIOV_VALID_STATE(dev->flags)) {
 			mlx4_err(dev, "Invalid SRIOV state\n");
+			err = -EINVAL;
 			goto err_close;
 		}
 	}

From c7655d8ab226f3c11709f0e9e034023f7f2d2b4d Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Sun, 25 Jul 2021 00:11:59 +0300
Subject: [PATCH 2566/2658] net: llc: fix skb_over_panic

[ Upstream commit c7c9d2102c9c098916ab9e0ab248006107d00d6c ]

Syzbot reported skb_over_panic() in llc_pdu_init_as_xid_cmd(). The
problem was in wrong LCC header manipulations.

Syzbot's reproducer tries to send XID packet. llc_ui_sendmsg() is
doing following steps:

	1. skb allocation with size = len + header size
		len is passed from userpace and header size
		is 3 since addr->sllc_xid is set.

	2. skb_reserve() for header_len = 3
	3. filling all other space with memcpy_from_msg()

Ok, at this moment we have fully loaded skb, only headers needs to be
filled.

Then code comes to llc_sap_action_send_xid_c(). This function pushes 3
bytes for LLC PDU header and initializes it. Then comes
llc_pdu_init_as_xid_cmd(). It initalizes next 3 bytes *AFTER* LLC PDU
header and call skb_push(skb, 3). This looks wrong for 2 reasons:

	1. Bytes rigth after LLC header are user data, so this function
	   was overwriting payload.

	2. skb_push(skb, 3) call can cause skb_over_panic() since
	   all free space was filled in llc_ui_sendmsg(). (This can
	   happen is user passed 686 len: 686 + 14 (eth header) + 3 (LLC
	   header) = 703. SKB_DATA_ALIGN(703) = 704)

So, in this patch I added 2 new private constansts: LLC_PDU_TYPE_U_XID
and LLC_PDU_LEN_U_XID. LLC_PDU_LEN_U_XID is used to correctly reserve
header size to handle LLC + XID case. LLC_PDU_TYPE_U_XID is used by
llc_pdu_header_init() function to push 6 bytes instead of 3. And finally
I removed skb_push() call from llc_pdu_init_as_xid_cmd().

This changes should not affect other parts of LLC, since after
all steps we just transmit buffer.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+5e5a981ad7cc54c4b2b4@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/llc_pdu.h | 31 +++++++++++++++++++++++--------
 net/llc/af_llc.c      | 10 +++++++++-
 net/llc/llc_s_ac.c    |  2 +-
 3 files changed, 33 insertions(+), 10 deletions(-)

diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h
index c0f0a13ed818..49aa79c7b278 100644
--- a/include/net/llc_pdu.h
+++ b/include/net/llc_pdu.h
@@ -15,9 +15,11 @@
 #include <linux/if_ether.h>
 
 /* Lengths of frame formats */
-#define LLC_PDU_LEN_I	4       /* header and 2 control bytes */
-#define LLC_PDU_LEN_S	4
-#define LLC_PDU_LEN_U	3       /* header and 1 control byte */
+#define LLC_PDU_LEN_I		4       /* header and 2 control bytes */
+#define LLC_PDU_LEN_S		4
+#define LLC_PDU_LEN_U		3       /* header and 1 control byte */
+/* header and 1 control byte and XID info */
+#define LLC_PDU_LEN_U_XID	(LLC_PDU_LEN_U + sizeof(struct llc_xid_info))
 /* Known SAP addresses */
 #define LLC_GLOBAL_SAP	0xFF
 #define LLC_NULL_SAP	0x00	/* not network-layer visible */
@@ -50,9 +52,10 @@
 #define LLC_PDU_TYPE_U_MASK    0x03	/* 8-bit control field */
 #define LLC_PDU_TYPE_MASK      0x03
 
-#define LLC_PDU_TYPE_I	0	/* first bit */
-#define LLC_PDU_TYPE_S	1	/* first two bits */
-#define LLC_PDU_TYPE_U	3	/* first two bits */
+#define LLC_PDU_TYPE_I		0	/* first bit */
+#define LLC_PDU_TYPE_S		1	/* first two bits */
+#define LLC_PDU_TYPE_U		3	/* first two bits */
+#define LLC_PDU_TYPE_U_XID	4	/* private type for detecting XID commands */
 
 #define LLC_PDU_TYPE_IS_I(pdu) \
 	((!(pdu->ctrl_1 & LLC_PDU_TYPE_I_MASK)) ? 1 : 0)
@@ -230,9 +233,18 @@ static inline struct llc_pdu_un *llc_pdu_un_hdr(struct sk_buff *skb)
 static inline void llc_pdu_header_init(struct sk_buff *skb, u8 type,
 				       u8 ssap, u8 dsap, u8 cr)
 {
-	const int hlen = type == LLC_PDU_TYPE_U ? 3 : 4;
+	int hlen = 4; /* default value for I and S types */
 	struct llc_pdu_un *pdu;
 
+	switch (type) {
+	case LLC_PDU_TYPE_U:
+		hlen = 3;
+		break;
+	case LLC_PDU_TYPE_U_XID:
+		hlen = 6;
+		break;
+	}
+
 	skb_push(skb, hlen);
 	skb_reset_network_header(skb);
 	pdu = llc_pdu_un_hdr(skb);
@@ -374,7 +386,10 @@ static inline void llc_pdu_init_as_xid_cmd(struct sk_buff *skb,
 	xid_info->fmt_id = LLC_XID_FMT_ID;	/* 0x81 */
 	xid_info->type	 = svcs_supported;
 	xid_info->rw	 = rx_window << 1;	/* size of receive window */
-	skb_put(skb, sizeof(struct llc_xid_info));
+
+	/* no need to push/put since llc_pdu_header_init() has already
+	 * pushed 3 + 3 bytes
+	 */
 }
 
 /**
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index f613a1007107..82b07bc43071 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -96,8 +96,16 @@ static inline u8 llc_ui_header_len(struct sock *sk, struct sockaddr_llc *addr)
 {
 	u8 rc = LLC_PDU_LEN_U;
 
-	if (addr->sllc_test || addr->sllc_xid)
+	if (addr->sllc_test)
 		rc = LLC_PDU_LEN_U;
+	else if (addr->sllc_xid)
+		/* We need to expand header to sizeof(struct llc_xid_info)
+		 * since llc_pdu_init_as_xid_cmd() sets 4,5,6 bytes of LLC header
+		 * as XID PDU. In llc_ui_sendmsg() we reserved header size and then
+		 * filled all other space with user data. If we won't reserve this
+		 * bytes, llc_pdu_init_as_xid_cmd() will overwrite user data
+		 */
+		rc = LLC_PDU_LEN_U_XID;
 	else if (sk->sk_type == SOCK_STREAM)
 		rc = LLC_PDU_LEN_I;
 	return rc;
diff --git a/net/llc/llc_s_ac.c b/net/llc/llc_s_ac.c
index 7ae4cc684d3a..9fa3342c7a82 100644
--- a/net/llc/llc_s_ac.c
+++ b/net/llc/llc_s_ac.c
@@ -79,7 +79,7 @@ int llc_sap_action_send_xid_c(struct llc_sap *sap, struct sk_buff *skb)
 	struct llc_sap_state_ev *ev = llc_sap_ev(skb);
 	int rc;
 
-	llc_pdu_header_init(skb, LLC_PDU_TYPE_U, ev->saddr.lsap,
+	llc_pdu_header_init(skb, LLC_PDU_TYPE_U_XID, ev->saddr.lsap,
 			    ev->daddr.lsap, LLC_PDU_CMD);
 	llc_pdu_init_as_xid_cmd(skb, LLC_XID_NULL_CLASS_2, 0);
 	rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac);

From cb36e1b7887fd314e931311138d77257851aee79 Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38@huawei.com>
Date: Wed, 28 Jul 2021 15:43:13 +0800
Subject: [PATCH 2567/2658] tulip: windbond-840: Fix missing
 pci_disable_device() in probe and remove

[ Upstream commit 76a16be07b209a3f507c72abe823bd3af1c8661a ]

Replace pci_enable_device() with pcim_enable_device(),
pci_disable_device() and pci_release_regions() will be
called in release automatically.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/dec/tulip/winbond-840.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/dec/tulip/winbond-840.c b/drivers/net/ethernet/dec/tulip/winbond-840.c
index 3c0e4d5c5fef..abc66eb13c35 100644
--- a/drivers/net/ethernet/dec/tulip/winbond-840.c
+++ b/drivers/net/ethernet/dec/tulip/winbond-840.c
@@ -368,7 +368,7 @@ static int w840_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
 	int i, option = find_cnt < MAX_UNITS ? options[find_cnt] : 0;
 	void __iomem *ioaddr;
 
-	i = pci_enable_device(pdev);
+	i = pcim_enable_device(pdev);
 	if (i) return i;
 
 	pci_set_master(pdev);
@@ -390,7 +390,7 @@ static int w840_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
 
 	ioaddr = pci_iomap(pdev, TULIP_BAR, netdev_res_size);
 	if (!ioaddr)
-		goto err_out_free_res;
+		goto err_out_netdev;
 
 	for (i = 0; i < 3; i++)
 		((__le16 *)dev->dev_addr)[i] = cpu_to_le16(eeprom_read(ioaddr, i));
@@ -469,8 +469,6 @@ static int w840_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
 
 err_out_cleardev:
 	pci_iounmap(pdev, ioaddr);
-err_out_free_res:
-	pci_release_regions(pdev);
 err_out_netdev:
 	free_netdev (dev);
 	return -ENODEV;
@@ -1537,7 +1535,6 @@ static void w840_remove1(struct pci_dev *pdev)
 	if (dev) {
 		struct netdev_private *np = netdev_priv(dev);
 		unregister_netdev(dev);
-		pci_release_regions(pdev);
 		pci_iounmap(pdev, np->base_addr);
 		free_netdev(dev);
 	}

From ac7d84c71294201e40c90f25e775e5df63ed7666 Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38@huawei.com>
Date: Wed, 28 Jul 2021 20:11:07 +0800
Subject: [PATCH 2568/2658] sis900: Fix missing pci_disable_device() in probe
 and remove

[ Upstream commit 89fb62fde3b226f99b7015280cf132e2a7438edf ]

Replace pci_enable_device() with pcim_enable_device(),
pci_disable_device() and pci_release_regions() will be
called in release automatically.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/sis/sis900.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/sis/sis900.c b/drivers/net/ethernet/sis/sis900.c
index dff5b56738d3..9fe5d13402e0 100644
--- a/drivers/net/ethernet/sis/sis900.c
+++ b/drivers/net/ethernet/sis/sis900.c
@@ -442,7 +442,7 @@ static int sis900_probe(struct pci_dev *pci_dev,
 #endif
 
 	/* setup various bits in PCI command register */
-	ret = pci_enable_device(pci_dev);
+	ret = pcim_enable_device(pci_dev);
 	if(ret) return ret;
 
 	i = pci_set_dma_mask(pci_dev, DMA_BIT_MASK(32));
@@ -468,7 +468,7 @@ static int sis900_probe(struct pci_dev *pci_dev,
 	ioaddr = pci_iomap(pci_dev, 0, 0);
 	if (!ioaddr) {
 		ret = -ENOMEM;
-		goto err_out_cleardev;
+		goto err_out;
 	}
 
 	sis_priv = netdev_priv(net_dev);
@@ -576,8 +576,6 @@ static int sis900_probe(struct pci_dev *pci_dev,
 		sis_priv->tx_ring_dma);
 err_out_unmap:
 	pci_iounmap(pci_dev, ioaddr);
-err_out_cleardev:
-	pci_release_regions(pci_dev);
  err_out:
 	free_netdev(net_dev);
 	return ret;
@@ -2425,7 +2423,6 @@ static void sis900_remove(struct pci_dev *pci_dev)
 		sis_priv->tx_ring_dma);
 	pci_iounmap(pci_dev, sis_priv->ioaddr);
 	free_netdev(net_dev);
-	pci_release_regions(pci_dev);
 }
 
 #ifdef CONFIG_PM

From 586c40e1aca2dfec9a23f35a36a9506947efce01 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 4 Aug 2021 11:56:46 +0200
Subject: [PATCH 2569/2658] Linux 4.4.278

Link: https://lore.kernel.org/r/20210802134332.033552261@linuxfoundation.org
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 13244d7dc70e..ed39fb8fcdc3 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 277
+SUBLEVEL = 278
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From aed7ce67f6ac72adf3af127ccc1da2411d9492b8 Mon Sep 17 00:00:00 2001
From: Goldwyn Rodrigues <rgoldwyn@suse.com>
Date: Mon, 2 Aug 2021 09:31:07 -0500
Subject: [PATCH 2570/2658] btrfs: mark compressed range uptodate only if all
 bio succeed

[ Upstream commit 240246f6b913b0c23733cfd2def1d283f8cc9bbe ]

In compression write endio sequence, the range which the compressed_bio
writes is marked as uptodate if the last bio of the compressed (sub)bios
is completed successfully. There could be previous bio which may
have failed which is recorded in cb->errors.

Set the writeback range as uptodate only if cb->errors is zero, as opposed
to checking only the last bio's status.

Backporting notes: in all versions up to 4.4 the last argument is always
replaced by "!cb->errors".

CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/compression.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index bae05c5c75ba..92601775ec5e 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -290,7 +290,7 @@ static void end_compressed_bio_write(struct bio *bio)
 					 cb->start,
 					 cb->start + cb->len - 1,
 					 NULL,
-					 bio->bi_error ? 0 : 1);
+					 !cb->errors);
 	cb->compressed_pages[0]->mapping = NULL;
 
 	end_compressed_writeback(inode, cb);

From 76a29d509652caff0dd9b303b8f70b81331f6598 Mon Sep 17 00:00:00 2001
From: Axel Lin <axel.lin@ingics.com>
Date: Sun, 27 Jun 2021 16:04:18 +0800
Subject: [PATCH 2571/2658] regulator: rt5033: Fix n_voltages settings for BUCK
 and LDO

[ Upstream commit 6549c46af8551b346bcc0b9043f93848319acd5c ]

For linear regulators, the n_voltages should be (max - min) / step + 1.

Buck voltage from 1v to 3V, per step 100mV, and vout mask is 0x1f.
If value is from 20 to 31, the voltage will all be fixed to 3V.
And LDO also, just vout range is different from 1.2v to 3v, step is the
same. If value is from 18 to 31, the voltage will also be fixed to 3v.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Reviewed-by: ChiYuan Huang <cy_huang@richtek.com>
Link: https://lore.kernel.org/r/20210627080418.1718127-1-axel.lin@ingics.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/mfd/rt5033-private.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/mfd/rt5033-private.h b/include/linux/mfd/rt5033-private.h
index 1b63fc2f42d1..52d53d134f72 100644
--- a/include/linux/mfd/rt5033-private.h
+++ b/include/linux/mfd/rt5033-private.h
@@ -203,13 +203,13 @@ enum rt5033_reg {
 #define RT5033_REGULATOR_BUCK_VOLTAGE_MIN		1000000U
 #define RT5033_REGULATOR_BUCK_VOLTAGE_MAX		3000000U
 #define RT5033_REGULATOR_BUCK_VOLTAGE_STEP		100000U
-#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP_NUM		32
+#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP_NUM		21
 
 /* RT5033 regulator LDO output voltage uV */
 #define RT5033_REGULATOR_LDO_VOLTAGE_MIN		1200000U
 #define RT5033_REGULATOR_LDO_VOLTAGE_MAX		3000000U
 #define RT5033_REGULATOR_LDO_VOLTAGE_STEP		100000U
-#define RT5033_REGULATOR_LDO_VOLTAGE_STEP_NUM		32
+#define RT5033_REGULATOR_LDO_VOLTAGE_STEP_NUM		19
 
 /* RT5033 regulator SAFE LDO output voltage uV */
 #define RT5033_REGULATOR_SAFE_LDO_VOLTAGE		4900000U

From 5c733d3132016c3fe1288f8dfeb279ff4495e2a8 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 14 Jul 2021 19:00:21 +0200
Subject: [PATCH 2572/2658] r8152: Fix potential PM refcount imbalance

[ Upstream commit 9c23aa51477a37f8b56c3c40192248db0663c196 ]

rtl8152_close() takes the refcount via usb_autopm_get_interface() but
it doesn't release when RTL8152_UNPLUG test hits.  This may lead to
the imbalance of PM refcount.  This patch addresses it.

Link: https://bugzilla.suse.com/show_bug.cgi?id=1186194
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/r8152.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 5baaa8291624..ebf6d4cf09ea 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -3159,9 +3159,10 @@ static int rtl8152_close(struct net_device *netdev)
 		tp->rtl_ops.down(tp);
 
 		mutex_unlock(&tp->control);
+	}
 
+	if (!res)
 		usb_autopm_put_interface(tp->intf);
-	}
 
 	free_all_mem(tp);
 

From ecf9c56040713a4d42f26ce5ae2b6dc747507772 Mon Sep 17 00:00:00 2001
From: Pravin B Shelar <pshelar@ovn.org>
Date: Thu, 15 Jul 2021 16:59:00 -0700
Subject: [PATCH 2573/2658] net: Fix zero-copy head len calculation.

[ Upstream commit a17ad0961706244dce48ec941f7e476a38c0e727 ]

In some cases skb head could be locked and entire header
data is pulled from skb. When skb_zerocopy() called in such cases,
following BUG is triggered. This patch fixes it by copying entire
skb in such cases.
This could be optimized incase this is performance bottleneck.

---8<---
kernel BUG at net/core/skbuff.c:2961!
invalid opcode: 0000 [#1] SMP PTI
CPU: 2 PID: 0 Comm: swapper/2 Tainted: G           OE     5.4.0-77-generic #86-Ubuntu
Hardware name: OpenStack Foundation OpenStack Nova, BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:skb_zerocopy+0x37a/0x3a0
RSP: 0018:ffffbcc70013ca38 EFLAGS: 00010246
Call Trace:
 <IRQ>
 queue_userspace_packet+0x2af/0x5e0 [openvswitch]
 ovs_dp_upcall+0x3d/0x60 [openvswitch]
 ovs_dp_process_packet+0x125/0x150 [openvswitch]
 ovs_vport_receive+0x77/0xd0 [openvswitch]
 netdev_port_receive+0x87/0x130 [openvswitch]
 netdev_frame_hook+0x4b/0x60 [openvswitch]
 __netif_receive_skb_core+0x2b4/0xc90
 __netif_receive_skb_one_core+0x3f/0xa0
 __netif_receive_skb+0x18/0x60
 process_backlog+0xa9/0x160
 net_rx_action+0x142/0x390
 __do_softirq+0xe1/0x2d6
 irq_exit+0xae/0xb0
 do_IRQ+0x5a/0xf0
 common_interrupt+0xf/0xf

Code that triggered BUG:
int
skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
{
        int i, j = 0;
        int plen = 0; /* length of skb->head fragment */
        int ret;
        struct page *page;
        unsigned int offset;

        BUG_ON(!from->head_frag && !hlen);

Signed-off-by: Pravin B Shelar <pshelar@ovn.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/skbuff.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 9b2eb90e0c7f..3ccb0fad0e97 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2266,8 +2266,11 @@ skb_zerocopy_headlen(const struct sk_buff *from)
 
 	if (!from->head_frag ||
 	    skb_headlen(from) < L1_CACHE_BYTES ||
-	    skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS)
+	    skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS) {
 		hlen = skb_headlen(from);
+		if (!hlen)
+			hlen = from->len;
+	}
 
 	if (skb_has_frag_list(from))
 		hlen = from->len;

From 39ae292ae5b12cfa277e6bfcce6674478971c351 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 5 Aug 2021 20:58:57 +0200
Subject: [PATCH 2574/2658] Revert "Bluetooth: Shutdown controller after
 workqueues are flushed or cancelled"

This reverts commit 5d16a8280078701fc03d6a0367c3251809743274 which is
commit 0ea9fd001a14ebc294f112b0361a4e601551d508 upstream.

It has been reported to have problems:
	https://lore.kernel.org/linux-bluetooth/8735ryk0o7.fsf@baylibre.com/

Reported-by: Guenter Roeck <linux@roeck-us.net>
Cc: Kai-Heng Feng <kai.heng.feng@canonical.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Sasha Levin <sashal@kernel.org>
Link: https://lore.kernel.org/r/efee3a58-a4d2-af22-0931-e81b877ab539@roeck-us.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_core.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 73808a164506..e6965064e491 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1666,6 +1666,14 @@ int hci_dev_do_close(struct hci_dev *hdev)
 
 	BT_DBG("%s %pK", hdev->name, hdev);
 
+	if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
+	    !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
+	    test_bit(HCI_UP, &hdev->flags)) {
+		/* Execute vendor specific shutdown routine */
+		if (hdev->shutdown)
+			hdev->shutdown(hdev);
+	}
+
 	cancel_delayed_work(&hdev->power_off);
 
 	hci_req_cancel(hdev, ENODEV);
@@ -1738,14 +1746,6 @@ int hci_dev_do_close(struct hci_dev *hdev)
 		clear_bit(HCI_INIT, &hdev->flags);
 	}
 
-	if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
-	    !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
-	    test_bit(HCI_UP, &hdev->flags)) {
-		/* Execute vendor specific shutdown routine */
-		if (hdev->shutdown)
-			hdev->shutdown(hdev);
-	}
-
 	/* flush cmd  work */
 	flush_work(&hdev->cmd_work);
 

From 6d8c972d5ecd8a96646512db3d24d15c546988f3 Mon Sep 17 00:00:00 2001
From: Ziyang Xuan <william.xuanziyang@huawei.com>
Date: Thu, 22 Jul 2021 15:08:19 +0800
Subject: [PATCH 2575/2658] can: raw: raw_setsockopt(): fix raw_rcv panic for
 sock UAF

commit 54f93336d000229f72c26d8a3f69dd256b744528 upstream.

We get a bug during ltp can_filter test as following.

===========================================
[60919.264984] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
[60919.265223] PGD 8000003dda726067 P4D 8000003dda726067 PUD 3dda727067 PMD 0
[60919.265443] Oops: 0000 [#1] SMP PTI
[60919.265550] CPU: 30 PID: 3638365 Comm: can_filter Kdump: loaded Tainted: G        W         4.19.90+ #1
[60919.266068] RIP: 0010:selinux_socket_sock_rcv_skb+0x3e/0x200
[60919.293289] RSP: 0018:ffff8d53bfc03cf8 EFLAGS: 00010246
[60919.307140] RAX: 0000000000000000 RBX: 000000000000001d RCX: 0000000000000007
[60919.320756] RDX: 0000000000000001 RSI: ffff8d5104a8ed00 RDI: ffff8d53bfc03d30
[60919.334319] RBP: ffff8d9338056800 R08: ffff8d53bfc29d80 R09: 0000000000000001
[60919.347969] R10: ffff8d53bfc03ec0 R11: ffffb8526ef47c98 R12: ffff8d53bfc03d30
[60919.350320] perf: interrupt took too long (3063 > 2500), lowering kernel.perf_event_max_sample_rate to 65000
[60919.361148] R13: 0000000000000001 R14: ffff8d53bcf90000 R15: 0000000000000000
[60919.361151] FS:  00007fb78b6b3600(0000) GS:ffff8d53bfc00000(0000) knlGS:0000000000000000
[60919.400812] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[60919.413730] CR2: 0000000000000010 CR3: 0000003e3f784006 CR4: 00000000007606e0
[60919.426479] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[60919.439339] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[60919.451608] PKRU: 55555554
[60919.463622] Call Trace:
[60919.475617]  <IRQ>
[60919.487122]  ? update_load_avg+0x89/0x5d0
[60919.498478]  ? update_load_avg+0x89/0x5d0
[60919.509822]  ? account_entity_enqueue+0xc5/0xf0
[60919.520709]  security_sock_rcv_skb+0x2a/0x40
[60919.531413]  sk_filter_trim_cap+0x47/0x1b0
[60919.542178]  ? kmem_cache_alloc+0x38/0x1b0
[60919.552444]  sock_queue_rcv_skb+0x17/0x30
[60919.562477]  raw_rcv+0x110/0x190 [can_raw]
[60919.572539]  can_rcv_filter+0xbc/0x1b0 [can]
[60919.582173]  can_receive+0x6b/0xb0 [can]
[60919.591595]  can_rcv+0x31/0x70 [can]
[60919.600783]  __netif_receive_skb_one_core+0x5a/0x80
[60919.609864]  process_backlog+0x9b/0x150
[60919.618691]  net_rx_action+0x156/0x400
[60919.627310]  ? sched_clock_cpu+0xc/0xa0
[60919.635714]  __do_softirq+0xe8/0x2e9
[60919.644161]  do_softirq_own_stack+0x2a/0x40
[60919.652154]  </IRQ>
[60919.659899]  do_softirq.part.17+0x4f/0x60
[60919.667475]  __local_bh_enable_ip+0x60/0x70
[60919.675089]  __dev_queue_xmit+0x539/0x920
[60919.682267]  ? finish_wait+0x80/0x80
[60919.689218]  ? finish_wait+0x80/0x80
[60919.695886]  ? sock_alloc_send_pskb+0x211/0x230
[60919.702395]  ? can_send+0xe5/0x1f0 [can]
[60919.708882]  can_send+0xe5/0x1f0 [can]
[60919.715037]  raw_sendmsg+0x16d/0x268 [can_raw]

It's because raw_setsockopt() concurrently with
unregister_netdevice_many(). Concurrent scenario as following.

	cpu0						cpu1
raw_bind
raw_setsockopt					unregister_netdevice_many
						unlist_netdevice
dev_get_by_index				raw_notifier
raw_enable_filters				......
can_rx_register
can_rcv_list_find(..., net->can.rx_alldev_list)

......

sock_close
raw_release(sock_a)

......

can_receive
can_rcv_filter(net->can.rx_alldev_list, ...)
raw_rcv(skb, sock_a)
BUG

After unlist_netdevice(), dev_get_by_index() return NULL in
raw_setsockopt(). Function raw_enable_filters() will add sock
and can_filter to net->can.rx_alldev_list. Then the sock is closed.
Followed by, we sock_sendmsg() to a new vcan device use the same
can_filter. Protocol stack match the old receiver whose sock has
been released on net->can.rx_alldev_list in can_rcv_filter().
Function raw_rcv() uses the freed sock. UAF BUG is triggered.

We can find that the key issue is that net_device has not been
protected in raw_setsockopt(). Use rtnl_lock to protect net_device
in raw_setsockopt().

Fixes: c18ce101f2e4 ("[CAN]: Add raw protocol")
Link: https://lore.kernel.org/r/20210722070819.1048263-1-william.xuanziyang@huawei.com
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/raw.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/net/can/raw.c b/net/can/raw.c
index 2e1d850a7f2a..1c2bf97ca168 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -541,10 +541,18 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
 				return -EFAULT;
 		}
 
+		rtnl_lock();
 		lock_sock(sk);
 
-		if (ro->bound && ro->ifindex)
+		if (ro->bound && ro->ifindex) {
 			dev = dev_get_by_index(&init_net, ro->ifindex);
+			if (!dev) {
+				if (count > 1)
+					kfree(filter);
+				err = -ENODEV;
+				goto out_fil;
+			}
+		}
 
 		if (ro->bound) {
 			/* (try to) register the new filters */
@@ -581,6 +589,7 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
 			dev_put(dev);
 
 		release_sock(sk);
+		rtnl_unlock();
 
 		break;
 
@@ -593,10 +602,16 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
 
 		err_mask &= CAN_ERR_MASK;
 
+		rtnl_lock();
 		lock_sock(sk);
 
-		if (ro->bound && ro->ifindex)
+		if (ro->bound && ro->ifindex) {
 			dev = dev_get_by_index(&init_net, ro->ifindex);
+			if (!dev) {
+				err = -ENODEV;
+				goto out_err;
+			}
+		}
 
 		/* remove current error mask */
 		if (ro->bound) {
@@ -618,6 +633,7 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
 			dev_put(dev);
 
 		release_sock(sk);
+		rtnl_unlock();
 
 		break;
 

From 2bf3dfa6fadfccb15386925ba7f8c19e853a00ec Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sun, 8 Aug 2021 08:37:47 +0200
Subject: [PATCH 2576/2658] Linux 4.4.279

Link: https://lore.kernel.org/r/20210806081108.939164003@linuxfoundation.org
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index ed39fb8fcdc3..c00ebef7f117 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 278
+SUBLEVEL = 279
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 2b1192eef41acd25b3e026e1bbd949cd33289ce4 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 2 Aug 2021 21:46:14 +0800
Subject: [PATCH 2577/2658] futex: Rename free_pi_state() to put_pi_state()

[ Upstream commit 29e9ee5d48c35d6cf8afe09bdf03f77125c9ac11 ]

free_pi_state() is confusing as it is in fact only freeing/caching the
pi state when the last reference is gone. Rename it to put_pi_state()
which reflects better what it is doing.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Darren Hart <darren@dvhart.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Bhuvanesh_Surachari@mentor.com
Cc: Andy Lowe <Andy_Lowe@mentor.com>
Link: http://lkml.kernel.org/r/20151219200607.259636467@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Acked-by: Joe Korty <joe.korty@concurrent-rt.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index f26ed0debddd..9016af263d98 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -859,9 +859,12 @@ static void pi_state_update_owner(struct futex_pi_state *pi_state,
 }
 
 /*
+ * Drops a reference to the pi_state object and frees or caches it
+ * when the last reference is gone.
+ *
  * Must be called with the hb lock held.
  */
-static void free_pi_state(struct futex_pi_state *pi_state)
+static void put_pi_state(struct futex_pi_state *pi_state)
 {
 	if (!pi_state)
 		return;
@@ -2121,7 +2124,7 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
 		case 0:
 			break;
 		case -EFAULT:
-			free_pi_state(pi_state);
+			put_pi_state(pi_state);
 			pi_state = NULL;
 			double_unlock_hb(hb1, hb2);
 			hb_waiters_dec(hb2);
@@ -2139,7 +2142,7 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
 			 *   exit to complete.
 			 * - EAGAIN: The user space value changed.
 			 */
-			free_pi_state(pi_state);
+			put_pi_state(pi_state);
 			pi_state = NULL;
 			double_unlock_hb(hb1, hb2);
 			hb_waiters_dec(hb2);
@@ -2214,7 +2217,7 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
 			} else if (ret) {
 				/* -EDEADLK */
 				this->pi_state = NULL;
-				free_pi_state(pi_state);
+				put_pi_state(pi_state);
 				goto out_unlock;
 			}
 		}
@@ -2223,7 +2226,7 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
 	}
 
 out_unlock:
-	free_pi_state(pi_state);
+	put_pi_state(pi_state);
 	double_unlock_hb(hb1, hb2);
 	wake_up_q(&wake_q);
 	hb_waiters_dec(hb2);
@@ -2376,7 +2379,7 @@ static void unqueue_me_pi(struct futex_q *q)
 	__unqueue_futex(q);
 
 	BUG_ON(!q->pi_state);
-	free_pi_state(q->pi_state);
+	put_pi_state(q->pi_state);
 	q->pi_state = NULL;
 
 	spin_unlock(q->lock_ptr);
@@ -3210,7 +3213,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
 			 * Drop the reference to the pi state which
 			 * the requeue_pi() code acquired for us.
 			 */
-			free_pi_state(q.pi_state);
+			put_pi_state(q.pi_state);
 			spin_unlock(q.lock_ptr);
 			/*
 			 * Adjust the return value. It's either -EFAULT or

From c40a3c2f6d9ed02067a3d6fe5ce0bae16ec01969 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Mon, 2 Aug 2021 21:46:15 +0800
Subject: [PATCH 2578/2658] futex: Cleanup refcounting

[ Upstream commit bf92cf3a5100f5a0d5f9834787b130159397cb22 ]

Add a put_pit_state() as counterpart for get_pi_state() so the refcounting
becomes consistent.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: juri.lelli@arm.com
Cc: bigeasy@linutronix.de
Cc: xlpang@redhat.com
Cc: rostedt@goodmis.org
Cc: mathieu.desnoyers@efficios.com
Cc: jdesfossez@efficios.com
Cc: dvhart@infradead.org
Cc: bristot@redhat.com
Link: http://lkml.kernel.org/r/20170322104151.801778516@infradead.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Acked-by: Joe Korty <joe.korty@concurrent-rt.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 9016af263d98..4e238f7e47f6 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -825,7 +825,7 @@ static int refill_pi_state_cache(void)
 	return 0;
 }
 
-static struct futex_pi_state * alloc_pi_state(void)
+static struct futex_pi_state *alloc_pi_state(void)
 {
 	struct futex_pi_state *pi_state = current->pi_state_cache;
 
@@ -858,6 +858,11 @@ static void pi_state_update_owner(struct futex_pi_state *pi_state,
 	}
 }
 
+static void get_pi_state(struct futex_pi_state *pi_state)
+{
+	WARN_ON_ONCE(!atomic_inc_not_zero(&pi_state->refcount));
+}
+
 /*
  * Drops a reference to the pi_state object and frees or caches it
  * when the last reference is gone.
@@ -901,7 +906,7 @@ static void put_pi_state(struct futex_pi_state *pi_state)
  * Look up the task based on what TID userspace gave us.
  * We dont trust it.
  */
-static struct task_struct * futex_find_get_task(pid_t pid)
+static struct task_struct *futex_find_get_task(pid_t pid)
 {
 	struct task_struct *p;
 
@@ -1149,7 +1154,7 @@ static int attach_to_pi_state(u32 __user *uaddr, u32 uval,
 		goto out_einval;
 
 out_attach:
-	atomic_inc(&pi_state->refcount);
+	get_pi_state(pi_state);
 	raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
 	*ps = pi_state;
 	return 0;
@@ -2204,7 +2209,7 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
 		 */
 		if (requeue_pi) {
 			/* Prepare the waiter to take the rt_mutex. */
-			atomic_inc(&pi_state->refcount);
+			get_pi_state(pi_state);
 			this->pi_state = pi_state;
 			ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex,
 							this->rt_waiter,

From f8e9b6a767913b45964715e69205ab0c5b82a460 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Mon, 2 Aug 2021 21:46:16 +0800
Subject: [PATCH 2579/2658] futex,rt_mutex: Introduce rt_mutex_init_waiter()

[ Upstream commit 50809358dd7199aa7ce232f6877dd09ec30ef374 ]

Since there's already two copies of this code, introduce a helper now
before adding a third one.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: juri.lelli@arm.com
Cc: bigeasy@linutronix.de
Cc: xlpang@redhat.com
Cc: rostedt@goodmis.org
Cc: mathieu.desnoyers@efficios.com
Cc: jdesfossez@efficios.com
Cc: dvhart@infradead.org
Cc: bristot@redhat.com
Link: http://lkml.kernel.org/r/20170322104151.950039479@infradead.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Acked-by: Joe Korty <joe.korty@concurrent-rt.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c                  |  5 +----
 kernel/locking/rtmutex.c        | 12 +++++++++---
 kernel/locking/rtmutex_common.h |  1 +
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 4e238f7e47f6..754649a30e29 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -3156,10 +3156,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
 	 * The waiter is allocated on our stack, manipulated by the requeue
 	 * code while we sleep on uaddr.
 	 */
-	debug_rt_mutex_init_waiter(&rt_waiter);
-	RB_CLEAR_NODE(&rt_waiter.pi_tree_entry);
-	RB_CLEAR_NODE(&rt_waiter.tree_entry);
-	rt_waiter.task = NULL;
+	rt_mutex_init_waiter(&rt_waiter);
 
 	ret = get_futex_key(uaddr2, flags & FLAGS_SHARED, &key2, VERIFY_WRITE);
 	if (unlikely(ret != 0))
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index 1c0cb5c3c6ad..fa24df4bc7a8 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1155,6 +1155,14 @@ void rt_mutex_adjust_pi(struct task_struct *task)
 				   next_lock, NULL, task);
 }
 
+void rt_mutex_init_waiter(struct rt_mutex_waiter *waiter)
+{
+	debug_rt_mutex_init_waiter(waiter);
+	RB_CLEAR_NODE(&waiter->pi_tree_entry);
+	RB_CLEAR_NODE(&waiter->tree_entry);
+	waiter->task = NULL;
+}
+
 /**
  * __rt_mutex_slowlock() - Perform the wait-wake-try-to-take loop
  * @lock:		 the rt_mutex to take
@@ -1236,9 +1244,7 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state,
 	struct rt_mutex_waiter waiter;
 	int ret = 0;
 
-	debug_rt_mutex_init_waiter(&waiter);
-	RB_CLEAR_NODE(&waiter.pi_tree_entry);
-	RB_CLEAR_NODE(&waiter.tree_entry);
+	rt_mutex_init_waiter(&waiter);
 
 	raw_spin_lock(&lock->wait_lock);
 
diff --git a/kernel/locking/rtmutex_common.h b/kernel/locking/rtmutex_common.h
index 4584db96265d..0424ff97bb69 100644
--- a/kernel/locking/rtmutex_common.h
+++ b/kernel/locking/rtmutex_common.h
@@ -102,6 +102,7 @@ extern struct task_struct *rt_mutex_next_owner(struct rt_mutex *lock);
 extern void rt_mutex_init_proxy_locked(struct rt_mutex *lock,
 				       struct task_struct *proxy_owner);
 extern void rt_mutex_proxy_unlock(struct rt_mutex *lock);
+extern void rt_mutex_init_waiter(struct rt_mutex_waiter *waiter);
 extern int rt_mutex_start_proxy_lock(struct rt_mutex *lock,
 				     struct rt_mutex_waiter *waiter,
 				     struct task_struct *task);

From 7ce6b31d3d6ba2c69ec72158814cfe5cfaa6ec6a Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Mon, 2 Aug 2021 21:46:17 +0800
Subject: [PATCH 2580/2658] futex: Pull rt_mutex_futex_unlock() out from under
 hb->lock

[ Upstream commit 16ffa12d742534d4ff73e8b3a4e81c1de39196f0 ]

There's a number of 'interesting' problems, all caused by holding
hb->lock while doing the rt_mutex_unlock() equivalient.

Notably:

 - a PI inversion on hb->lock; and,

 - a SCHED_DEADLINE crash because of pointer instability.

The previous changes:

 - changed the locking rules to cover {uval,pi_state} with wait_lock.

 - allow to do rt_mutex_futex_unlock() without dropping wait_lock; which in
   turn allows to rely on wait_lock atomicity completely.

 - simplified the waiter conundrum.

It's now sufficient to hold rtmutex::wait_lock and a reference on the
pi_state to protect the state consistency, so hb->lock can be dropped
before calling rt_mutex_futex_unlock().

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: juri.lelli@arm.com
Cc: bigeasy@linutronix.de
Cc: xlpang@redhat.com
Cc: rostedt@goodmis.org
Cc: mathieu.desnoyers@efficios.com
Cc: jdesfossez@efficios.com
Cc: dvhart@infradead.org
Cc: bristot@redhat.com
Link: http://lkml.kernel.org/r/20170322104151.900002056@infradead.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Acked-by: Joe Korty <joe.korty@concurrent-rt.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 111 ++++++++++++++++++++++++++++++-------------------
 1 file changed, 68 insertions(+), 43 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 754649a30e29..56ed73d14afc 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -966,10 +966,12 @@ static void exit_pi_state_list(struct task_struct *curr)
 		pi_state->owner = NULL;
 		raw_spin_unlock_irq(&curr->pi_lock);
 
-		rt_mutex_futex_unlock(&pi_state->pi_mutex);
-
+		get_pi_state(pi_state);
 		spin_unlock(&hb->lock);
 
+		rt_mutex_futex_unlock(&pi_state->pi_mutex);
+		put_pi_state(pi_state);
+
 		raw_spin_lock_irq(&curr->pi_lock);
 	}
 	raw_spin_unlock_irq(&curr->pi_lock);
@@ -1083,6 +1085,11 @@ static int attach_to_pi_state(u32 __user *uaddr, u32 uval,
 	 * has dropped the hb->lock in between queue_me() and unqueue_me_pi(),
 	 * which in turn means that futex_lock_pi() still has a reference on
 	 * our pi_state.
+	 *
+	 * The waiter holding a reference on @pi_state also protects against
+	 * the unlocked put_pi_state() in futex_unlock_pi(), futex_lock_pi()
+	 * and futex_wait_requeue_pi() as it cannot go to 0 and consequently
+	 * free pi_state before we can take a reference ourselves.
 	 */
 	WARN_ON(!atomic_read(&pi_state->refcount));
 
@@ -1537,48 +1544,40 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q)
 	q->lock_ptr = NULL;
 }
 
-static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this,
-			 struct futex_hash_bucket *hb)
+/*
+ * Caller must hold a reference on @pi_state.
+ */
+static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_pi_state *pi_state)
 {
-	struct task_struct *new_owner;
-	struct futex_pi_state *pi_state = this->pi_state;
 	u32 uninitialized_var(curval), newval;
+	struct task_struct *new_owner;
+	bool deboost = false;
 	WAKE_Q(wake_q);
-	bool deboost;
 	int ret = 0;
 
-	if (!pi_state)
-		return -EINVAL;
-
-	/*
-	 * If current does not own the pi_state then the futex is
-	 * inconsistent and user space fiddled with the futex value.
-	 */
-	if (pi_state->owner != current)
-		return -EINVAL;
-
 	raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
 	new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
-
-	/*
-	 * When we interleave with futex_lock_pi() where it does
-	 * rt_mutex_timed_futex_lock(), we might observe @this futex_q waiter,
-	 * but the rt_mutex's wait_list can be empty (either still, or again,
-	 * depending on which side we land).
-	 *
-	 * When this happens, give up our locks and try again, giving the
-	 * futex_lock_pi() instance time to complete, either by waiting on the
-	 * rtmutex or removing itself from the futex queue.
-	 */
 	if (!new_owner) {
-		raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
-		return -EAGAIN;
+		/*
+		 * Since we held neither hb->lock nor wait_lock when coming
+		 * into this function, we could have raced with futex_lock_pi()
+		 * such that we might observe @this futex_q waiter, but the
+		 * rt_mutex's wait_list can be empty (either still, or again,
+		 * depending on which side we land).
+		 *
+		 * When this happens, give up our locks and try again, giving
+		 * the futex_lock_pi() instance time to complete, either by
+		 * waiting on the rtmutex or removing itself from the futex
+		 * queue.
+		 */
+		ret = -EAGAIN;
+		goto out_unlock;
 	}
 
 	/*
-	 * We pass it to the next owner. The WAITERS bit is always
-	 * kept enabled while there is PI state around. We cleanup the
-	 * owner died bit, because we are the owner.
+	 * We pass it to the next owner. The WAITERS bit is always kept
+	 * enabled while there is PI state around. We cleanup the owner
+	 * died bit, because we are the owner.
 	 */
 	newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
 
@@ -1611,15 +1610,15 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this,
 		deboost = __rt_mutex_futex_unlock(&pi_state->pi_mutex, &wake_q);
 	}
 
+out_unlock:
 	raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
-	spin_unlock(&hb->lock);
 
 	if (deboost) {
 		wake_up_q(&wake_q);
 		rt_mutex_adjust_prio(current);
 	}
 
-	return 0;
+	return ret;
 }
 
 /*
@@ -2462,7 +2461,7 @@ static int __fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 	if (get_futex_value_locked(&uval, uaddr))
 		goto handle_fault;
 
-	while (1) {
+	for (;;) {
 		newval = (uval & FUTEX_OWNER_DIED) | newtid;
 
 		if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
@@ -2975,10 +2974,36 @@ static int futex_unlock_pi(u32 __user *uaddr, unsigned int flags)
 	 */
 	match = futex_top_waiter(hb, &key);
 	if (match) {
-		ret = wake_futex_pi(uaddr, uval, match, hb);
+		struct futex_pi_state *pi_state = match->pi_state;
+
+		ret = -EINVAL;
+		if (!pi_state)
+			goto out_unlock;
+
 		/*
-		 * In case of success wake_futex_pi dropped the hash
-		 * bucket lock.
+		 * If current does not own the pi_state then the futex is
+		 * inconsistent and user space fiddled with the futex value.
+		 */
+		if (pi_state->owner != current)
+			goto out_unlock;
+
+		/*
+		 * Grab a reference on the pi_state and drop hb->lock.
+		 *
+		 * The reference ensures pi_state lives, dropping the hb->lock
+		 * is tricky.. wake_futex_pi() will take rt_mutex::wait_lock to
+		 * close the races against futex_lock_pi(), but in case of
+		 * _any_ fail we'll abort and retry the whole deal.
+		 */
+		get_pi_state(pi_state);
+		spin_unlock(&hb->lock);
+
+		ret = wake_futex_pi(uaddr, uval, pi_state);
+
+		put_pi_state(pi_state);
+
+		/*
+		 * Success, we're done! No tricky corner cases.
 		 */
 		if (!ret)
 			goto out_putkey;
@@ -2993,7 +3018,6 @@ static int futex_unlock_pi(u32 __user *uaddr, unsigned int flags)
 		 * setting the FUTEX_WAITERS bit. Try again.
 		 */
 		if (ret == -EAGAIN) {
-			spin_unlock(&hb->lock);
 			put_futex_key(&key);
 			goto retry;
 		}
@@ -3001,7 +3025,7 @@ static int futex_unlock_pi(u32 __user *uaddr, unsigned int flags)
 		 * wake_futex_pi has detected invalid state. Tell user
 		 * space.
 		 */
-		goto out_unlock;
+		goto out_putkey;
 	}
 
 	/*
@@ -3011,8 +3035,10 @@ static int futex_unlock_pi(u32 __user *uaddr, unsigned int flags)
 	 * preserve the WAITERS bit not the OWNER_DIED one. We are the
 	 * owner.
 	 */
-	if (cmpxchg_futex_value_locked(&curval, uaddr, uval, 0))
+	if (cmpxchg_futex_value_locked(&curval, uaddr, uval, 0)) {
+		spin_unlock(&hb->lock);
 		goto pi_faulted;
+	}
 
 	/*
 	 * If uval has changed, let user space handle it.
@@ -3026,7 +3052,6 @@ static int futex_unlock_pi(u32 __user *uaddr, unsigned int flags)
 	return ret;
 
 pi_faulted:
-	spin_unlock(&hb->lock);
 	put_futex_key(&key);
 
 	ret = fault_in_user_writeable(uaddr);

From 50baa2be9a3f75e63d314a16007a9ce3898575fd Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Mon, 2 Aug 2021 21:46:18 +0800
Subject: [PATCH 2581/2658] futex: Rework futex_lock_pi() to use
 rt_mutex_*_proxy_lock()

[ Upstream commit cfafcd117da0216520568c195cb2f6cd1980c4bb ]

By changing futex_lock_pi() to use rt_mutex_*_proxy_lock() all wait_list
modifications are done under both hb->lock and wait_lock.

This closes the obvious interleave pattern between futex_lock_pi() and
futex_unlock_pi(), but not entirely so. See below:

Before:

futex_lock_pi()			futex_unlock_pi()
  unlock hb->lock

				  lock hb->lock
				  unlock hb->lock

				  lock rt_mutex->wait_lock
				  unlock rt_mutex_wait_lock
				    -EAGAIN

  lock rt_mutex->wait_lock
  list_add
  unlock rt_mutex->wait_lock

  schedule()

  lock rt_mutex->wait_lock
  list_del
  unlock rt_mutex->wait_lock

				  <idem>
				    -EAGAIN

  lock hb->lock

After:

futex_lock_pi()			futex_unlock_pi()

  lock hb->lock
  lock rt_mutex->wait_lock
  list_add
  unlock rt_mutex->wait_lock
  unlock hb->lock

  schedule()
				  lock hb->lock
				  unlock hb->lock
  lock hb->lock
  lock rt_mutex->wait_lock
  list_del
  unlock rt_mutex->wait_lock

				  lock rt_mutex->wait_lock
				  unlock rt_mutex_wait_lock
				    -EAGAIN

  unlock hb->lock

It does however solve the earlier starvation/live-lock scenario which got
introduced with the -EAGAIN since unlike the before scenario; where the
-EAGAIN happens while futex_unlock_pi() doesn't hold any locks; in the
after scenario it happens while futex_unlock_pi() actually holds a lock,
and then it is serialized on that lock.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: juri.lelli@arm.com
Cc: bigeasy@linutronix.de
Cc: xlpang@redhat.com
Cc: rostedt@goodmis.org
Cc: mathieu.desnoyers@efficios.com
Cc: jdesfossez@efficios.com
Cc: dvhart@infradead.org
Cc: bristot@redhat.com
Link: http://lkml.kernel.org/r/20170322104152.062785528@infradead.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Acked-by: Joe Korty <joe.korty@concurrent-rt.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c                  | 77 +++++++++++++++++++++++----------
 kernel/locking/rtmutex.c        | 26 +++--------
 kernel/locking/rtmutex_common.h |  1 -
 3 files changed, 62 insertions(+), 42 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 56ed73d14afc..fb3bf0f3e4ed 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2284,20 +2284,7 @@ queue_unlock(struct futex_hash_bucket *hb)
 	hb_waiters_dec(hb);
 }
 
-/**
- * queue_me() - Enqueue the futex_q on the futex_hash_bucket
- * @q:	The futex_q to enqueue
- * @hb:	The destination hash bucket
- *
- * The hb->lock must be held by the caller, and is released here. A call to
- * queue_me() is typically paired with exactly one call to unqueue_me().  The
- * exceptions involve the PI related operations, which may use unqueue_me_pi()
- * or nothing if the unqueue is done as part of the wake process and the unqueue
- * state is implicit in the state of woken task (see futex_wait_requeue_pi() for
- * an example).
- */
-static inline void queue_me(struct futex_q *q, struct futex_hash_bucket *hb)
-	__releases(&hb->lock)
+static inline void __queue_me(struct futex_q *q, struct futex_hash_bucket *hb)
 {
 	int prio;
 
@@ -2314,6 +2301,24 @@ static inline void queue_me(struct futex_q *q, struct futex_hash_bucket *hb)
 	plist_node_init(&q->list, prio);
 	plist_add(&q->list, &hb->chain);
 	q->task = current;
+}
+
+/**
+ * queue_me() - Enqueue the futex_q on the futex_hash_bucket
+ * @q:	The futex_q to enqueue
+ * @hb:	The destination hash bucket
+ *
+ * The hb->lock must be held by the caller, and is released here. A call to
+ * queue_me() is typically paired with exactly one call to unqueue_me().  The
+ * exceptions involve the PI related operations, which may use unqueue_me_pi()
+ * or nothing if the unqueue is done as part of the wake process and the unqueue
+ * state is implicit in the state of woken task (see futex_wait_requeue_pi() for
+ * an example).
+ */
+static inline void queue_me(struct futex_q *q, struct futex_hash_bucket *hb)
+	__releases(&hb->lock)
+{
+	__queue_me(q, hb);
 	spin_unlock(&hb->lock);
 }
 
@@ -2819,6 +2824,7 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags,
 {
 	struct hrtimer_sleeper timeout, *to = NULL;
 	struct task_struct *exiting = NULL;
+	struct rt_mutex_waiter rt_waiter;
 	struct futex_hash_bucket *hb;
 	struct futex_q q = futex_q_init;
 	int res, ret;
@@ -2879,24 +2885,51 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags,
 		}
 	}
 
+	WARN_ON(!q.pi_state);
+
 	/*
 	 * Only actually queue now that the atomic ops are done:
 	 */
-	queue_me(&q, hb);
+	__queue_me(&q, hb);
 
-	WARN_ON(!q.pi_state);
-	/*
-	 * Block on the PI mutex:
-	 */
-	if (!trylock) {
-		ret = rt_mutex_timed_futex_lock(&q.pi_state->pi_mutex, to);
-	} else {
+	if (trylock) {
 		ret = rt_mutex_futex_trylock(&q.pi_state->pi_mutex);
 		/* Fixup the trylock return value: */
 		ret = ret ? 0 : -EWOULDBLOCK;
+		goto no_block;
+	}
+
+	/*
+	 * We must add ourselves to the rt_mutex waitlist while holding hb->lock
+	 * such that the hb and rt_mutex wait lists match.
+	 */
+	rt_mutex_init_waiter(&rt_waiter);
+	ret = rt_mutex_start_proxy_lock(&q.pi_state->pi_mutex, &rt_waiter, current);
+	if (ret) {
+		if (ret == 1)
+			ret = 0;
+
+		goto no_block;
 	}
 
+	spin_unlock(q.lock_ptr);
+
+	if (unlikely(to))
+		hrtimer_start_expires(&to->timer, HRTIMER_MODE_ABS);
+
+	ret = rt_mutex_wait_proxy_lock(&q.pi_state->pi_mutex, to, &rt_waiter);
+
 	spin_lock(q.lock_ptr);
+	/*
+	 * If we failed to acquire the lock (signal/timeout), we must
+	 * first acquire the hb->lock before removing the lock from the
+	 * rt_mutex waitqueue, such that we can keep the hb and rt_mutex
+	 * wait lists consistent.
+	 */
+	if (ret && !rt_mutex_cleanup_proxy_lock(&q.pi_state->pi_mutex, &rt_waiter))
+		ret = 0;
+
+no_block:
 	/*
 	 * Fixup the pi_state owner and possibly acquire the lock if we
 	 * haven't already.
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index fa24df4bc7a8..98e45a2e1236 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1488,19 +1488,6 @@ int __sched rt_mutex_lock_interruptible(struct rt_mutex *lock)
 }
 EXPORT_SYMBOL_GPL(rt_mutex_lock_interruptible);
 
-/*
- * Futex variant with full deadlock detection.
- * Futex variants must not use the fast-path, see __rt_mutex_futex_unlock().
- */
-int __sched rt_mutex_timed_futex_lock(struct rt_mutex *lock,
-			      struct hrtimer_sleeper *timeout)
-{
-	might_sleep();
-
-	return rt_mutex_slowlock(lock, TASK_INTERRUPTIBLE,
-				 timeout, RT_MUTEX_FULL_CHAINWALK);
-}
-
 /*
  * Futex variant, must not use fastpath.
  */
@@ -1774,12 +1761,6 @@ int rt_mutex_wait_proxy_lock(struct rt_mutex *lock,
 	/* sleep on the mutex */
 	ret = __rt_mutex_slowlock(lock, TASK_INTERRUPTIBLE, to, waiter);
 
-	/*
-	 * try_to_take_rt_mutex() sets the waiter bit unconditionally. We might
-	 * have to fix that up.
-	 */
-	fixup_rt_mutex_waiters(lock);
-
 	raw_spin_unlock(&lock->wait_lock);
 
 	return ret;
@@ -1819,6 +1800,13 @@ bool rt_mutex_cleanup_proxy_lock(struct rt_mutex *lock,
 		fixup_rt_mutex_waiters(lock);
 		cleanup = true;
 	}
+
+	/*
+	 * try_to_take_rt_mutex() sets the waiter bit unconditionally. We might
+	 * have to fix that up.
+	 */
+	fixup_rt_mutex_waiters(lock);
+
 	raw_spin_unlock_irq(&lock->wait_lock);
 
 	return cleanup;
diff --git a/kernel/locking/rtmutex_common.h b/kernel/locking/rtmutex_common.h
index 0424ff97bb69..97c048c494f0 100644
--- a/kernel/locking/rtmutex_common.h
+++ b/kernel/locking/rtmutex_common.h
@@ -111,7 +111,6 @@ extern int rt_mutex_wait_proxy_lock(struct rt_mutex *lock,
 			       struct rt_mutex_waiter *waiter);
 extern bool rt_mutex_cleanup_proxy_lock(struct rt_mutex *lock,
 				 struct rt_mutex_waiter *waiter);
-extern int rt_mutex_timed_futex_lock(struct rt_mutex *l, struct hrtimer_sleeper *to);
 extern int rt_mutex_futex_trylock(struct rt_mutex *l);
 extern int __rt_mutex_futex_trylock(struct rt_mutex *l);
 

From ca16e97897e432395261c26586f480d8dd0ee052 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Mon, 2 Aug 2021 21:46:19 +0800
Subject: [PATCH 2582/2658] futex: Futex_unlock_pi() determinism

[ Upstream commit bebe5b514345f09be2c15e414d076b02ecb9cce8 ]

The problem with returning -EAGAIN when the waiter state mismatches is that
it becomes very hard to proof a bounded execution time on the
operation. And seeing that this is a RT operation, this is somewhat
important.

While in practise; given the previous patch; it will be very unlikely to
ever really take more than one or two rounds, proving so becomes rather
hard.

However, now that modifying wait_list is done while holding both hb->lock
and wait_lock, the scenario can be avoided entirely by acquiring wait_lock
while still holding hb-lock. Doing a hand-over, without leaving a hole.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: juri.lelli@arm.com
Cc: bigeasy@linutronix.de
Cc: xlpang@redhat.com
Cc: rostedt@goodmis.org
Cc: mathieu.desnoyers@efficios.com
Cc: jdesfossez@efficios.com
Cc: dvhart@infradead.org
Cc: bristot@redhat.com
Link: http://lkml.kernel.org/r/20170322104152.112378812@infradead.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Acked-by: Joe Korty <joe.korty@concurrent-rt.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index fb3bf0f3e4ed..f6079795b315 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1555,15 +1555,10 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_pi_state *pi_
 	WAKE_Q(wake_q);
 	int ret = 0;
 
-	raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
 	new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
-	if (!new_owner) {
+	if (WARN_ON_ONCE(!new_owner)) {
 		/*
-		 * Since we held neither hb->lock nor wait_lock when coming
-		 * into this function, we could have raced with futex_lock_pi()
-		 * such that we might observe @this futex_q waiter, but the
-		 * rt_mutex's wait_list can be empty (either still, or again,
-		 * depending on which side we land).
+		 * As per the comment in futex_unlock_pi() this should not happen.
 		 *
 		 * When this happens, give up our locks and try again, giving
 		 * the futex_lock_pi() instance time to complete, either by
@@ -3020,15 +3015,18 @@ static int futex_unlock_pi(u32 __user *uaddr, unsigned int flags)
 		if (pi_state->owner != current)
 			goto out_unlock;
 
+		get_pi_state(pi_state);
 		/*
-		 * Grab a reference on the pi_state and drop hb->lock.
+		 * Since modifying the wait_list is done while holding both
+		 * hb->lock and wait_lock, holding either is sufficient to
+		 * observe it.
 		 *
-		 * The reference ensures pi_state lives, dropping the hb->lock
-		 * is tricky.. wake_futex_pi() will take rt_mutex::wait_lock to
-		 * close the races against futex_lock_pi(), but in case of
-		 * _any_ fail we'll abort and retry the whole deal.
+		 * By taking wait_lock while still holding hb->lock, we ensure
+		 * there is no point where we hold neither; and therefore
+		 * wake_futex_pi() must observe a state consistent with what we
+		 * observed.
 		 */
-		get_pi_state(pi_state);
+		raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
 		spin_unlock(&hb->lock);
 
 		ret = wake_futex_pi(uaddr, uval, pi_state);

From 11731a66f5b7ddce2cb18712c838dfb0d72d4af6 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 2 Aug 2021 21:46:20 +0800
Subject: [PATCH 2583/2658] rtmutex: Make wait_lock irq safe

[ Upstream commit b4abf91047cf054f203dcfac97e1038388826937 ]

Sasha reported a lockdep splat about a potential deadlock between RCU boosting
rtmutex and the posix timer it_lock.

CPU0					CPU1

rtmutex_lock(&rcu->rt_mutex)
  spin_lock(&rcu->rt_mutex.wait_lock)
					local_irq_disable()
					spin_lock(&timer->it_lock)
					spin_lock(&rcu->mutex.wait_lock)
--> Interrupt
    spin_lock(&timer->it_lock)

This is caused by the following code sequence on CPU1

     rcu_read_lock()
     x = lookup();
     if (x)
     	spin_lock_irqsave(&x->it_lock);
     rcu_read_unlock();
     return x;

We could fix that in the posix timer code by keeping rcu read locked across
the spinlocked and irq disabled section, but the above sequence is common and
there is no reason not to support it.

Taking rt_mutex.wait_lock irq safe prevents the deadlock.

Reported-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Acked-by: Joe Korty <joe.korty@concurrent-rt.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/locking/rtmutex.c | 135 +++++++++++++++++++++------------------
 1 file changed, 72 insertions(+), 63 deletions(-)

diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index 98e45a2e1236..18154e10d63a 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -163,13 +163,14 @@ static inline void mark_rt_mutex_waiters(struct rt_mutex *lock)
  * 2) Drop lock->wait_lock
  * 3) Try to unlock the lock with cmpxchg
  */
-static inline bool unlock_rt_mutex_safe(struct rt_mutex *lock)
+static inline bool unlock_rt_mutex_safe(struct rt_mutex *lock,
+					unsigned long flags)
 	__releases(lock->wait_lock)
 {
 	struct task_struct *owner = rt_mutex_owner(lock);
 
 	clear_rt_mutex_waiters(lock);
-	raw_spin_unlock(&lock->wait_lock);
+	raw_spin_unlock_irqrestore(&lock->wait_lock, flags);
 	/*
 	 * If a new waiter comes in between the unlock and the cmpxchg
 	 * we have two situations:
@@ -211,11 +212,12 @@ static inline void mark_rt_mutex_waiters(struct rt_mutex *lock)
 /*
  * Simple slow path only version: lock->owner is protected by lock->wait_lock.
  */
-static inline bool unlock_rt_mutex_safe(struct rt_mutex *lock)
+static inline bool unlock_rt_mutex_safe(struct rt_mutex *lock,
+					unsigned long flags)
 	__releases(lock->wait_lock)
 {
 	lock->owner = NULL;
-	raw_spin_unlock(&lock->wait_lock);
+	raw_spin_unlock_irqrestore(&lock->wait_lock, flags);
 	return true;
 }
 #endif
@@ -497,7 +499,6 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
 	int ret = 0, depth = 0;
 	struct rt_mutex *lock;
 	bool detect_deadlock;
-	unsigned long flags;
 	bool requeue = true;
 
 	detect_deadlock = rt_mutex_cond_detect_deadlock(orig_waiter, chwalk);
@@ -540,7 +541,7 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
 	/*
 	 * [1] Task cannot go away as we did a get_task() before !
 	 */
-	raw_spin_lock_irqsave(&task->pi_lock, flags);
+	raw_spin_lock_irq(&task->pi_lock);
 
 	/*
 	 * [2] Get the waiter on which @task is blocked on.
@@ -624,7 +625,7 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
 	 * operations.
 	 */
 	if (!raw_spin_trylock(&lock->wait_lock)) {
-		raw_spin_unlock_irqrestore(&task->pi_lock, flags);
+		raw_spin_unlock_irq(&task->pi_lock);
 		cpu_relax();
 		goto retry;
 	}
@@ -655,7 +656,7 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
 		/*
 		 * No requeue[7] here. Just release @task [8]
 		 */
-		raw_spin_unlock_irqrestore(&task->pi_lock, flags);
+		raw_spin_unlock(&task->pi_lock);
 		put_task_struct(task);
 
 		/*
@@ -663,14 +664,14 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
 		 * If there is no owner of the lock, end of chain.
 		 */
 		if (!rt_mutex_owner(lock)) {
-			raw_spin_unlock(&lock->wait_lock);
+			raw_spin_unlock_irq(&lock->wait_lock);
 			return 0;
 		}
 
 		/* [10] Grab the next task, i.e. owner of @lock */
 		task = rt_mutex_owner(lock);
 		get_task_struct(task);
-		raw_spin_lock_irqsave(&task->pi_lock, flags);
+		raw_spin_lock(&task->pi_lock);
 
 		/*
 		 * No requeue [11] here. We just do deadlock detection.
@@ -685,8 +686,8 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
 		top_waiter = rt_mutex_top_waiter(lock);
 
 		/* [13] Drop locks */
-		raw_spin_unlock_irqrestore(&task->pi_lock, flags);
-		raw_spin_unlock(&lock->wait_lock);
+		raw_spin_unlock(&task->pi_lock);
+		raw_spin_unlock_irq(&lock->wait_lock);
 
 		/* If owner is not blocked, end of chain. */
 		if (!next_lock)
@@ -707,7 +708,7 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
 	rt_mutex_enqueue(lock, waiter);
 
 	/* [8] Release the task */
-	raw_spin_unlock_irqrestore(&task->pi_lock, flags);
+	raw_spin_unlock(&task->pi_lock);
 	put_task_struct(task);
 
 	/*
@@ -725,14 +726,14 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
 		 */
 		if (prerequeue_top_waiter != rt_mutex_top_waiter(lock))
 			wake_up_process(rt_mutex_top_waiter(lock)->task);
-		raw_spin_unlock(&lock->wait_lock);
+		raw_spin_unlock_irq(&lock->wait_lock);
 		return 0;
 	}
 
 	/* [10] Grab the next task, i.e. the owner of @lock */
 	task = rt_mutex_owner(lock);
 	get_task_struct(task);
-	raw_spin_lock_irqsave(&task->pi_lock, flags);
+	raw_spin_lock(&task->pi_lock);
 
 	/* [11] requeue the pi waiters if necessary */
 	if (waiter == rt_mutex_top_waiter(lock)) {
@@ -786,8 +787,8 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
 	top_waiter = rt_mutex_top_waiter(lock);
 
 	/* [13] Drop the locks */
-	raw_spin_unlock_irqrestore(&task->pi_lock, flags);
-	raw_spin_unlock(&lock->wait_lock);
+	raw_spin_unlock(&task->pi_lock);
+	raw_spin_unlock_irq(&lock->wait_lock);
 
 	/*
 	 * Make the actual exit decisions [12], based on the stored
@@ -810,7 +811,7 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
 	goto again;
 
  out_unlock_pi:
-	raw_spin_unlock_irqrestore(&task->pi_lock, flags);
+	raw_spin_unlock_irq(&task->pi_lock);
  out_put_task:
 	put_task_struct(task);
 
@@ -820,7 +821,7 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
 /*
  * Try to take an rt-mutex
  *
- * Must be called with lock->wait_lock held.
+ * Must be called with lock->wait_lock held and interrupts disabled
  *
  * @lock:   The lock to be acquired.
  * @task:   The task which wants to acquire the lock
@@ -830,8 +831,6 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
 static int try_to_take_rt_mutex(struct rt_mutex *lock, struct task_struct *task,
 				struct rt_mutex_waiter *waiter)
 {
-	unsigned long flags;
-
 	/*
 	 * Before testing whether we can acquire @lock, we set the
 	 * RT_MUTEX_HAS_WAITERS bit in @lock->owner. This forces all
@@ -916,7 +915,7 @@ static int try_to_take_rt_mutex(struct rt_mutex *lock, struct task_struct *task,
 	 * case, but conditionals are more expensive than a redundant
 	 * store.
 	 */
-	raw_spin_lock_irqsave(&task->pi_lock, flags);
+	raw_spin_lock(&task->pi_lock);
 	task->pi_blocked_on = NULL;
 	/*
 	 * Finish the lock acquisition. @task is the new owner. If
@@ -925,7 +924,7 @@ static int try_to_take_rt_mutex(struct rt_mutex *lock, struct task_struct *task,
 	 */
 	if (rt_mutex_has_waiters(lock))
 		rt_mutex_enqueue_pi(task, rt_mutex_top_waiter(lock));
-	raw_spin_unlock_irqrestore(&task->pi_lock, flags);
+	raw_spin_unlock(&task->pi_lock);
 
 takeit:
 	/* We got the lock. */
@@ -945,7 +944,7 @@ static int try_to_take_rt_mutex(struct rt_mutex *lock, struct task_struct *task,
  *
  * Prepare waiter and propagate pi chain
  *
- * This must be called with lock->wait_lock held.
+ * This must be called with lock->wait_lock held and interrupts disabled
  */
 static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
 				   struct rt_mutex_waiter *waiter,
@@ -956,7 +955,6 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
 	struct rt_mutex_waiter *top_waiter = waiter;
 	struct rt_mutex *next_lock;
 	int chain_walk = 0, res;
-	unsigned long flags;
 
 	/*
 	 * Early deadlock detection. We really don't want the task to
@@ -970,7 +968,7 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
 	if (owner == task)
 		return -EDEADLK;
 
-	raw_spin_lock_irqsave(&task->pi_lock, flags);
+	raw_spin_lock(&task->pi_lock);
 	__rt_mutex_adjust_prio(task);
 	waiter->task = task;
 	waiter->lock = lock;
@@ -983,12 +981,12 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
 
 	task->pi_blocked_on = waiter;
 
-	raw_spin_unlock_irqrestore(&task->pi_lock, flags);
+	raw_spin_unlock(&task->pi_lock);
 
 	if (!owner)
 		return 0;
 
-	raw_spin_lock_irqsave(&owner->pi_lock, flags);
+	raw_spin_lock(&owner->pi_lock);
 	if (waiter == rt_mutex_top_waiter(lock)) {
 		rt_mutex_dequeue_pi(owner, top_waiter);
 		rt_mutex_enqueue_pi(owner, waiter);
@@ -1003,7 +1001,7 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
 	/* Store the lock on which owner is blocked or NULL */
 	next_lock = task_blocked_on_lock(owner);
 
-	raw_spin_unlock_irqrestore(&owner->pi_lock, flags);
+	raw_spin_unlock(&owner->pi_lock);
 	/*
 	 * Even if full deadlock detection is on, if the owner is not
 	 * blocked itself, we can avoid finding this out in the chain
@@ -1019,12 +1017,12 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
 	 */
 	get_task_struct(owner);
 
-	raw_spin_unlock(&lock->wait_lock);
+	raw_spin_unlock_irq(&lock->wait_lock);
 
 	res = rt_mutex_adjust_prio_chain(owner, chwalk, lock,
 					 next_lock, waiter, task);
 
-	raw_spin_lock(&lock->wait_lock);
+	raw_spin_lock_irq(&lock->wait_lock);
 
 	return res;
 }
@@ -1033,15 +1031,14 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
  * Remove the top waiter from the current tasks pi waiter tree and
  * queue it up.
  *
- * Called with lock->wait_lock held.
+ * Called with lock->wait_lock held and interrupts disabled.
  */
 static void mark_wakeup_next_waiter(struct wake_q_head *wake_q,
 				    struct rt_mutex *lock)
 {
 	struct rt_mutex_waiter *waiter;
-	unsigned long flags;
 
-	raw_spin_lock_irqsave(&current->pi_lock, flags);
+	raw_spin_lock(&current->pi_lock);
 
 	waiter = rt_mutex_top_waiter(lock);
 
@@ -1063,7 +1060,7 @@ static void mark_wakeup_next_waiter(struct wake_q_head *wake_q,
 	 */
 	lock->owner = (void *) RT_MUTEX_HAS_WAITERS;
 
-	raw_spin_unlock_irqrestore(&current->pi_lock, flags);
+	raw_spin_unlock(&current->pi_lock);
 
 	wake_q_add(wake_q, waiter->task);
 }
@@ -1071,7 +1068,7 @@ static void mark_wakeup_next_waiter(struct wake_q_head *wake_q,
 /*
  * Remove a waiter from a lock and give up
  *
- * Must be called with lock->wait_lock held and
+ * Must be called with lock->wait_lock held and interrupts disabled. I must
  * have just failed to try_to_take_rt_mutex().
  */
 static void remove_waiter(struct rt_mutex *lock,
@@ -1080,12 +1077,11 @@ static void remove_waiter(struct rt_mutex *lock,
 	bool is_top_waiter = (waiter == rt_mutex_top_waiter(lock));
 	struct task_struct *owner = rt_mutex_owner(lock);
 	struct rt_mutex *next_lock;
-	unsigned long flags;
 
-	raw_spin_lock_irqsave(&current->pi_lock, flags);
+	raw_spin_lock(&current->pi_lock);
 	rt_mutex_dequeue(lock, waiter);
 	current->pi_blocked_on = NULL;
-	raw_spin_unlock_irqrestore(&current->pi_lock, flags);
+	raw_spin_unlock(&current->pi_lock);
 
 	/*
 	 * Only update priority if the waiter was the highest priority
@@ -1094,7 +1090,7 @@ static void remove_waiter(struct rt_mutex *lock,
 	if (!owner || !is_top_waiter)
 		return;
 
-	raw_spin_lock_irqsave(&owner->pi_lock, flags);
+	raw_spin_lock(&owner->pi_lock);
 
 	rt_mutex_dequeue_pi(owner, waiter);
 
@@ -1106,7 +1102,7 @@ static void remove_waiter(struct rt_mutex *lock,
 	/* Store the lock on which owner is blocked or NULL */
 	next_lock = task_blocked_on_lock(owner);
 
-	raw_spin_unlock_irqrestore(&owner->pi_lock, flags);
+	raw_spin_unlock(&owner->pi_lock);
 
 	/*
 	 * Don't walk the chain, if the owner task is not blocked
@@ -1118,12 +1114,12 @@ static void remove_waiter(struct rt_mutex *lock,
 	/* gets dropped in rt_mutex_adjust_prio_chain()! */
 	get_task_struct(owner);
 
-	raw_spin_unlock(&lock->wait_lock);
+	raw_spin_unlock_irq(&lock->wait_lock);
 
 	rt_mutex_adjust_prio_chain(owner, RT_MUTEX_MIN_CHAINWALK, lock,
 				   next_lock, NULL, current);
 
-	raw_spin_lock(&lock->wait_lock);
+	raw_spin_lock_irq(&lock->wait_lock);
 }
 
 /*
@@ -1167,11 +1163,11 @@ void rt_mutex_init_waiter(struct rt_mutex_waiter *waiter)
  * __rt_mutex_slowlock() - Perform the wait-wake-try-to-take loop
  * @lock:		 the rt_mutex to take
  * @state:		 the state the task should block in (TASK_INTERRUPTIBLE
- * 			 or TASK_UNINTERRUPTIBLE)
+ *			 or TASK_UNINTERRUPTIBLE)
  * @timeout:		 the pre-initialized and started timer, or NULL for none
  * @waiter:		 the pre-initialized rt_mutex_waiter
  *
- * lock->wait_lock must be held by the caller.
+ * Must be called with lock->wait_lock held and interrupts disabled
  */
 static int __sched
 __rt_mutex_slowlock(struct rt_mutex *lock, int state,
@@ -1199,13 +1195,13 @@ __rt_mutex_slowlock(struct rt_mutex *lock, int state,
 				break;
 		}
 
-		raw_spin_unlock(&lock->wait_lock);
+		raw_spin_unlock_irq(&lock->wait_lock);
 
 		debug_rt_mutex_print_deadlock(waiter);
 
 		schedule();
 
-		raw_spin_lock(&lock->wait_lock);
+		raw_spin_lock_irq(&lock->wait_lock);
 		set_current_state(state);
 	}
 
@@ -1242,15 +1238,24 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state,
 		  enum rtmutex_chainwalk chwalk)
 {
 	struct rt_mutex_waiter waiter;
+	unsigned long flags;
 	int ret = 0;
 
 	rt_mutex_init_waiter(&waiter);
 
-	raw_spin_lock(&lock->wait_lock);
+	/*
+	 * Technically we could use raw_spin_[un]lock_irq() here, but this can
+	 * be called in early boot if the cmpxchg() fast path is disabled
+	 * (debug, no architecture support). In this case we will acquire the
+	 * rtmutex with lock->wait_lock held. But we cannot unconditionally
+	 * enable interrupts in that early boot case. So we need to use the
+	 * irqsave/restore variants.
+	 */
+	raw_spin_lock_irqsave(&lock->wait_lock, flags);
 
 	/* Try to acquire the lock again: */
 	if (try_to_take_rt_mutex(lock, current, NULL)) {
-		raw_spin_unlock(&lock->wait_lock);
+		raw_spin_unlock_irqrestore(&lock->wait_lock, flags);
 		return 0;
 	}
 
@@ -1279,7 +1284,7 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state,
 	 */
 	fixup_rt_mutex_waiters(lock);
 
-	raw_spin_unlock(&lock->wait_lock);
+	raw_spin_unlock_irqrestore(&lock->wait_lock, flags);
 
 	/* Remove pending timer: */
 	if (unlikely(timeout))
@@ -1308,6 +1313,7 @@ static inline int __rt_mutex_slowtrylock(struct rt_mutex *lock)
  */
 static inline int rt_mutex_slowtrylock(struct rt_mutex *lock)
 {
+	unsigned long flags;
 	int ret;
 
 	/*
@@ -1319,14 +1325,14 @@ static inline int rt_mutex_slowtrylock(struct rt_mutex *lock)
 		return 0;
 
 	/*
-	 * The mutex has currently no owner. Lock the wait lock and
-	 * try to acquire the lock.
+	 * The mutex has currently no owner. Lock the wait lock and try to
+	 * acquire the lock. We use irqsave here to support early boot calls.
 	 */
-	raw_spin_lock(&lock->wait_lock);
+	raw_spin_lock_irqsave(&lock->wait_lock, flags);
 
 	ret = __rt_mutex_slowtrylock(lock);
 
-	raw_spin_unlock(&lock->wait_lock);
+	raw_spin_unlock_irqrestore(&lock->wait_lock, flags);
 
 	return ret;
 }
@@ -1338,7 +1344,10 @@ static inline int rt_mutex_slowtrylock(struct rt_mutex *lock)
 static bool __sched rt_mutex_slowunlock(struct rt_mutex *lock,
 					struct wake_q_head *wake_q)
 {
-	raw_spin_lock(&lock->wait_lock);
+	unsigned long flags;
+
+	/* irqsave required to support early boot calls */
+	raw_spin_lock_irqsave(&lock->wait_lock, flags);
 
 	debug_rt_mutex_unlock(lock);
 
@@ -1375,10 +1384,10 @@ static bool __sched rt_mutex_slowunlock(struct rt_mutex *lock,
 	 */
 	while (!rt_mutex_has_waiters(lock)) {
 		/* Drops lock->wait_lock ! */
-		if (unlock_rt_mutex_safe(lock) == true)
+		if (unlock_rt_mutex_safe(lock, flags) == true)
 			return false;
 		/* Relock the rtmutex and try again */
-		raw_spin_lock(&lock->wait_lock);
+		raw_spin_lock_irqsave(&lock->wait_lock, flags);
 	}
 
 	/*
@@ -1389,7 +1398,7 @@ static bool __sched rt_mutex_slowunlock(struct rt_mutex *lock,
 	 */
 	mark_wakeup_next_waiter(wake_q, lock);
 
-	raw_spin_unlock(&lock->wait_lock);
+	raw_spin_unlock_irqrestore(&lock->wait_lock, flags);
 
 	/* check PI boosting */
 	return true;
@@ -1680,10 +1689,10 @@ int rt_mutex_start_proxy_lock(struct rt_mutex *lock,
 {
 	int ret;
 
-	raw_spin_lock(&lock->wait_lock);
+	raw_spin_lock_irq(&lock->wait_lock);
 
 	if (try_to_take_rt_mutex(lock, task, NULL)) {
-		raw_spin_unlock(&lock->wait_lock);
+		raw_spin_unlock_irq(&lock->wait_lock);
 		return 1;
 	}
 
@@ -1704,7 +1713,7 @@ int rt_mutex_start_proxy_lock(struct rt_mutex *lock,
 	if (unlikely(ret))
 		remove_waiter(lock, waiter);
 
-	raw_spin_unlock(&lock->wait_lock);
+	raw_spin_unlock_irq(&lock->wait_lock);
 
 	debug_rt_mutex_print_deadlock(waiter);
 
@@ -1754,14 +1763,14 @@ int rt_mutex_wait_proxy_lock(struct rt_mutex *lock,
 {
 	int ret;
 
-	raw_spin_lock(&lock->wait_lock);
+	raw_spin_lock_irq(&lock->wait_lock);
 
 	set_current_state(TASK_INTERRUPTIBLE);
 
 	/* sleep on the mutex */
 	ret = __rt_mutex_slowlock(lock, TASK_INTERRUPTIBLE, to, waiter);
 
-	raw_spin_unlock(&lock->wait_lock);
+	raw_spin_unlock_irq(&lock->wait_lock);
 
 	return ret;
 }

From 2ec15889f2e447ce0b1b22f2643ee8da41f1de98 Mon Sep 17 00:00:00 2001
From: Mike Galbraith <efault@gmx.de>
Date: Mon, 2 Aug 2021 21:46:21 +0800
Subject: [PATCH 2584/2658] futex: Handle transient "ownerless" rtmutex state
 correctly

[ Upstream commit 9f5d1c336a10c0d24e83e40b4c1b9539f7dba627 ]

Gratian managed to trigger the BUG_ON(!newowner) in fixup_pi_state_owner().
This is one possible chain of events leading to this:

Task Prio       Operation
T1   120	lock(F)
T2   120	lock(F)   -> blocks (top waiter)
T3   50 (RT)	lock(F)   -> boosts T1 and blocks (new top waiter)
XX   		timeout/  -> wakes T2
		signal
T1   50		unlock(F) -> wakes T3 (rtmutex->owner == NULL, waiter bit is set)
T2   120	cleanup   -> try_to_take_mutex() fails because T3 is the top waiter
     			     and the lower priority T2 cannot steal the lock.
     			  -> fixup_pi_state_owner() sees newowner == NULL -> BUG_ON()

The comment states that this is invalid and rt_mutex_real_owner() must
return a non NULL owner when the trylock failed, but in case of a queued
and woken up waiter rt_mutex_real_owner() == NULL is a valid transient
state. The higher priority waiter has simply not yet managed to take over
the rtmutex.

The BUG_ON() is therefore wrong and this is just another retry condition in
fixup_pi_state_owner().

Drop the locks, so that T3 can make progress, and then try the fixup again.

Gratian provided a great analysis, traces and a reproducer. The analysis is
to the point, but it confused the hell out of that tglx dude who had to
page in all the futex horrors again. Condensed version is above.

[ tglx: Wrote comment and changelog ]

Fixes: c1e2f0eaf015 ("futex: Avoid violating the 10th rule of futex")
Reported-by: Gratian Crisan <gratian.crisan@ni.com>
Signed-off-by: Mike Galbraith <efault@gmx.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/87a6w6x7bb.fsf@ni.com
Link: https://lore.kernel.org/r/87sg9pkvf7.fsf@nanos.tec.linutronix.de
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Acked-by: Joe Korty <joe.korty@concurrent-rt.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index f6079795b315..19fdd3e3c23b 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2437,10 +2437,22 @@ static int __fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 		}
 
 		/*
-		 * Since we just failed the trylock; there must be an owner.
+		 * The trylock just failed, so either there is an owner or
+		 * there is a higher priority waiter than this one.
 		 */
 		newowner = rt_mutex_owner(&pi_state->pi_mutex);
-		BUG_ON(!newowner);
+		/*
+		 * If the higher priority waiter has not yet taken over the
+		 * rtmutex then newowner is NULL. We can't return here with
+		 * that state because it's inconsistent vs. the user space
+		 * state. So drop the locks and try again. It's a valid
+		 * situation and not any different from the other retry
+		 * conditions.
+		 */
+		if (unlikely(!newowner)) {
+			err = -EAGAIN;
+			goto handle_fault;
+		}
 	} else {
 		WARN_ON_ONCE(argowner != current);
 		if (oldowner == current) {

From 0d0c4f3a97359320fc57a534a5b80133ab1e9f84 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 2 Aug 2021 21:46:22 +0800
Subject: [PATCH 2585/2658] futex: Avoid freeing an active timer

[ Upstream commit 97181f9bd57405b879403763284537e27d46963d ]

Alexander reported a hrtimer debug_object splat:

  ODEBUG: free active (active state 0) object type: hrtimer hint: hrtimer_wakeup (kernel/time/hrtimer.c:1423)

  debug_object_free (lib/debugobjects.c:603)
  destroy_hrtimer_on_stack (kernel/time/hrtimer.c:427)
  futex_lock_pi (kernel/futex.c:2740)
  do_futex (kernel/futex.c:3399)
  SyS_futex (kernel/futex.c:3447 kernel/futex.c:3415)
  do_syscall_64 (arch/x86/entry/common.c:284)
  entry_SYSCALL64_slow_path (arch/x86/entry/entry_64.S:249)

Which was caused by commit:

  cfafcd117da0 ("futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock()")

... losing the hrtimer_cancel() in the shuffle. Where previously the
hrtimer_cancel() was done by rt_mutex_slowlock() we now need to do it
manually.

Reported-by: Alexander Levin <alexander.levin@verizon.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Fixes: cfafcd117da0 ("futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock()")
Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1704101802370.2906@nanos
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Acked-by: Joe Korty <joe.korty@concurrent-rt.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/futex.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 19fdd3e3c23b..12b424a5c5d7 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2960,8 +2960,10 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags,
 out_put_key:
 	put_futex_key(&q.key);
 out:
-	if (to)
+	if (to) {
+		hrtimer_cancel(&to->timer);
 		destroy_hrtimer_on_stack(&to->timer);
+	}
 	return ret != -EINTR ? ret : -ERESTARTNOINTR;
 
 uaddr_faulted:

From d2d12478bfb14b031e1b80fa21d5b50db3144662 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Mon, 2 Aug 2021 21:46:23 +0800
Subject: [PATCH 2586/2658] futex,rt_mutex: Fix rt_mutex_cleanup_proxy_lock()

[ Upstream commit 04dc1b2fff4e96cb4142227fbdc63c8871ad4ed9 ]

Markus reported that the glibc/nptl/tst-robustpi8 test was failing after
commit:

  cfafcd117da0 ("futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock()")

The following trace shows the problem:

 ld-linux-x86-64-2161  [019] ....   410.760971: SyS_futex: 00007ffbeb76b028: 80000875  op=FUTEX_LOCK_PI
 ld-linux-x86-64-2161  [019] ...1   410.760972: lock_pi_update_atomic: 00007ffbeb76b028: curval=80000875 uval=80000875 newval=80000875 ret=0
 ld-linux-x86-64-2165  [011] ....   410.760978: SyS_futex: 00007ffbeb76b028: 80000875  op=FUTEX_UNLOCK_PI
 ld-linux-x86-64-2165  [011] d..1   410.760979: do_futex: 00007ffbeb76b028: curval=80000875 uval=80000875 newval=80000871 ret=0
 ld-linux-x86-64-2165  [011] ....   410.760980: SyS_futex: 00007ffbeb76b028: 80000871 ret=0000
 ld-linux-x86-64-2161  [019] ....   410.760980: SyS_futex: 00007ffbeb76b028: 80000871 ret=ETIMEDOUT

Task 2165 does an UNLOCK_PI, assigning the lock to the waiter task 2161
which then returns with -ETIMEDOUT. That wrecks the lock state, because now
the owner isn't aware it acquired the lock and removes the pending robust
list entry.

If 2161 is killed, the robust list will not clear out this futex and the
subsequent acquire on this futex will then (correctly) result in -ESRCH
which is unexpected by glibc, triggers an internal assertion and dies.

Task 2161			Task 2165

rt_mutex_wait_proxy_lock()
   timeout();
   /* T2161 is still queued in  the waiter list */
   return -ETIMEDOUT;

				futex_unlock_pi()
				spin_lock(hb->lock);
				rtmutex_unlock()
				  remove_rtmutex_waiter(T2161);
				   mark_lock_available();
				/* Make the next waiter owner of the user space side */
				futex_uval = 2161;
				spin_unlock(hb->lock);
spin_lock(hb->lock);
rt_mutex_cleanup_proxy_lock()
  if (rtmutex_owner() !== current)
     ...
     return FAIL;
....
return -ETIMEOUT;

This means that rt_mutex_cleanup_proxy_lock() needs to call
try_to_take_rt_mutex() so it can take over the rtmutex correctly which was
assigned by the waker. If the rtmutex is owned by some other task then this
call is harmless and just confirmes that the waiter is not able to acquire
it.

While there, fix what looks like a merge error which resulted in
rt_mutex_cleanup_proxy_lock() having two calls to
fixup_rt_mutex_waiters() and rt_mutex_wait_proxy_lock() not having any.
Both should have one, since both potentially touch the waiter list.

Fixes: 38d589f2fd08 ("futex,rt_mutex: Restructure rt_mutex_finish_proxy_lock()")
Reported-by: Markus Trippelsdorf <markus@trippelsdorf.de>
Bug-Spotted-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Florian Weimer <fweimer@redhat.com>
Cc: Darren Hart <dvhart@infradead.org>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Markus Trippelsdorf <markus@trippelsdorf.de>
Link: http://lkml.kernel.org/r/20170519154850.mlomgdsd26drq5j6@hirez.programming.kicks-ass.net
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Acked-by: Joe Korty <joe.korty@concurrent-rt.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/locking/rtmutex.c | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index 18154e10d63a..532986d82179 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1764,12 +1764,14 @@ int rt_mutex_wait_proxy_lock(struct rt_mutex *lock,
 	int ret;
 
 	raw_spin_lock_irq(&lock->wait_lock);
-
-	set_current_state(TASK_INTERRUPTIBLE);
-
 	/* sleep on the mutex */
+	set_current_state(TASK_INTERRUPTIBLE);
 	ret = __rt_mutex_slowlock(lock, TASK_INTERRUPTIBLE, to, waiter);
-
+	/*
+	 * try_to_take_rt_mutex() sets the waiter bit unconditionally. We might
+	 * have to fix that up.
+	 */
+	fixup_rt_mutex_waiters(lock);
 	raw_spin_unlock_irq(&lock->wait_lock);
 
 	return ret;
@@ -1800,16 +1802,26 @@ bool rt_mutex_cleanup_proxy_lock(struct rt_mutex *lock,
 	bool cleanup = false;
 
 	raw_spin_lock_irq(&lock->wait_lock);
+	/*
+	 * Do an unconditional try-lock, this deals with the lock stealing
+	 * state where __rt_mutex_futex_unlock() -> mark_wakeup_next_waiter()
+	 * sets a NULL owner.
+	 *
+	 * We're not interested in the return value, because the subsequent
+	 * test on rt_mutex_owner() will infer that. If the trylock succeeded,
+	 * we will own the lock and it will have removed the waiter. If we
+	 * failed the trylock, we're still not owner and we need to remove
+	 * ourselves.
+	 */
+	try_to_take_rt_mutex(lock, current, waiter);
 	/*
 	 * Unless we're the owner; we're still enqueued on the wait_list.
 	 * So check if we became owner, if not, take us off the wait_list.
 	 */
 	if (rt_mutex_owner(lock) != current) {
 		remove_waiter(lock, waiter);
-		fixup_rt_mutex_waiters(lock);
 		cleanup = true;
 	}
-
 	/*
 	 * try_to_take_rt_mutex() sets the waiter bit unconditionally. We might
 	 * have to fix that up.

From 43e8b71984113d8eb71207d80a105e2fa5e8cf15 Mon Sep 17 00:00:00 2001
From: Anna-Maria Gleixner <anna-maria@linutronix.de>
Date: Mon, 2 Aug 2021 21:46:24 +0800
Subject: [PATCH 2587/2658] rcu: Update documentation of rcu_read_unlock()

[ Upstream commit ec84b27f9b3b569f9235413d1945a2006b97b0aa ]

Since commit b4abf91047cf ("rtmutex: Make wait_lock irq safe") the
explanation in rcu_read_unlock() documentation about irq unsafe rtmutex
wait_lock is no longer valid.

Remove it to prevent kernel developers reading the documentation to rely on
it.

Suggested-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Anna-Maria Gleixner <anna-maria@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: bigeasy@linutronix.de
Link: https://lkml.kernel.org/r/20180525090507.22248-2-anna-maria@linutronix.de
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Acked-by: Joe Korty <joe.korty@concurrent-rt.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/rcupdate.h | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 0a93e9d1708e..3072e9c93ae6 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -880,9 +880,7 @@ static __always_inline void rcu_read_lock(void)
  * Unfortunately, this function acquires the scheduler's runqueue and
  * priority-inheritance spinlocks.  This means that deadlock could result
  * if the caller of rcu_read_unlock() already holds one of these locks or
- * any lock that is ever acquired while holding them; or any lock which
- * can be taken from interrupt context because rcu_boost()->rt_mutex_lock()
- * does not disable irqs while taking ->wait_lock.
+ * any lock that is ever acquired while holding them.
  *
  * That said, RCU readers are never priority boosted unless they were
  * preempted.  Therefore, one way to avoid deadlock is to make sure

From ae736fe1ac0621d1b6b38ca8363c49acf6e611db Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 10 Aug 2021 17:39:42 +0200
Subject: [PATCH 2588/2658] Linux 4.4.280

Link: https://lore.kernel.org/r/20210808072217.322468704@linuxfoundation.org
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index c00ebef7f117..b4e913e8f25d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 279
+SUBLEVEL = 280
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From c133fad502e44eaa96b6b3e7aa88b7f35d8c30db Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 3 Aug 2021 13:43:12 +0200
Subject: [PATCH 2589/2658] ALSA: seq: Fix racy deletion of subscriber

commit 97367c97226aab8b298ada954ce12659ee3ad2a4 upstream.

It turned out that the current implementation of the port subscription
is racy.  The subscription contains two linked lists, and we have to
add to or delete from both lists.  Since both connection and
disconnection procedures perform the same order for those two lists
(i.e. src list, then dest list), when a deletion happens during a
connection procedure, the src list may be deleted before the dest list
addition completes, and this may lead to a use-after-free or an Oops,
even though the access to both lists are protected via mutex.

The simple workaround for this race is to change the access order for
the disconnection, namely, dest list, then src list.  This assures
that the connection has been established when disconnecting, and also
the concurrent deletion can be avoided.

Reported-and-tested-by: folkert <folkert@vanheusden.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210801182754.GP890690@belle.intranet.vanheusden.com
Link: https://lore.kernel.org/r/20210803114312.2536-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/seq/seq_ports.c | 39 ++++++++++++++++++++++++++------------
 1 file changed, 27 insertions(+), 12 deletions(-)

diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
index a42e2ce4a726..8f694438ecdd 100644
--- a/sound/core/seq/seq_ports.c
+++ b/sound/core/seq/seq_ports.c
@@ -532,10 +532,11 @@ static int check_and_subscribe_port(struct snd_seq_client *client,
 	return err;
 }
 
-static void delete_and_unsubscribe_port(struct snd_seq_client *client,
-					struct snd_seq_client_port *port,
-					struct snd_seq_subscribers *subs,
-					bool is_src, bool ack)
+/* called with grp->list_mutex held */
+static void __delete_and_unsubscribe_port(struct snd_seq_client *client,
+					  struct snd_seq_client_port *port,
+					  struct snd_seq_subscribers *subs,
+					  bool is_src, bool ack)
 {
 	struct snd_seq_port_subs_info *grp;
 	struct list_head *list;
@@ -543,7 +544,6 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client,
 
 	grp = is_src ? &port->c_src : &port->c_dest;
 	list = is_src ? &subs->src_list : &subs->dest_list;
-	down_write(&grp->list_mutex);
 	write_lock_irq(&grp->list_lock);
 	empty = list_empty(list);
 	if (!empty)
@@ -553,6 +553,18 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client,
 
 	if (!empty)
 		unsubscribe_port(client, port, grp, &subs->info, ack);
+}
+
+static void delete_and_unsubscribe_port(struct snd_seq_client *client,
+					struct snd_seq_client_port *port,
+					struct snd_seq_subscribers *subs,
+					bool is_src, bool ack)
+{
+	struct snd_seq_port_subs_info *grp;
+
+	grp = is_src ? &port->c_src : &port->c_dest;
+	down_write(&grp->list_mutex);
+	__delete_and_unsubscribe_port(client, port, subs, is_src, ack);
 	up_write(&grp->list_mutex);
 }
 
@@ -608,27 +620,30 @@ int snd_seq_port_disconnect(struct snd_seq_client *connector,
 			    struct snd_seq_client_port *dest_port,
 			    struct snd_seq_port_subscribe *info)
 {
-	struct snd_seq_port_subs_info *src = &src_port->c_src;
+	struct snd_seq_port_subs_info *dest = &dest_port->c_dest;
 	struct snd_seq_subscribers *subs;
 	int err = -ENOENT;
 
-	down_write(&src->list_mutex);
+	/* always start from deleting the dest port for avoiding concurrent
+	 * deletions
+	 */
+	down_write(&dest->list_mutex);
 	/* look for the connection */
-	list_for_each_entry(subs, &src->list_head, src_list) {
+	list_for_each_entry(subs, &dest->list_head, dest_list) {
 		if (match_subs_info(info, &subs->info)) {
-			atomic_dec(&subs->ref_count); /* mark as not ready */
+			__delete_and_unsubscribe_port(dest_client, dest_port,
+						      subs, false,
+						      connector->number != dest_client->number);
 			err = 0;
 			break;
 		}
 	}
-	up_write(&src->list_mutex);
+	up_write(&dest->list_mutex);
 	if (err < 0)
 		return err;
 
 	delete_and_unsubscribe_port(src_client, src_port, subs, true,
 				    connector->number != src_client->number);
-	delete_and_unsubscribe_port(dest_client, dest_port, subs, false,
-				    connector->number != dest_client->number);
 	kfree(subs);
 	return 0;
 }

From 1942922ee01cb66e1c4c0b6cfc6f8d8e620c42e5 Mon Sep 17 00:00:00 2001
From: Li Manyi <limanyi@uniontech.com>
Date: Mon, 26 Jul 2021 19:49:13 +0800
Subject: [PATCH 2590/2658] scsi: sr: Return correct event when media event
 code is 3

[ Upstream commit 5c04243a56a7977185b00400e59ca7e108004faf ]

Media event code 3 is defined in the MMC-6 spec as follows:

  "MediaRemoval: The media has been removed from the specified slot, and
   the Drive is unable to access the media without user intervention. This
   applies to media changers only."

This indicated that treating the condition as an EJECT_REQUEST was
appropriate. However, doing so had the unfortunate side-effect of causing
the drive tray to be physically ejected on resume. Instead treat the event
as a MEDIA_CHANGE request.

Fixes: 7dd753ca59d6 ("scsi: sr: Return appropriate error code when disk is ejected")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=213759
Link: https://lore.kernel.org/r/20210726114913.6760-1-limanyi@uniontech.com
Signed-off-by: Li Manyi <limanyi@uniontech.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/sr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index 6e31cedf0b6c..df019b78d9f7 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -217,7 +217,7 @@ static unsigned int sr_get_events(struct scsi_device *sdev)
 	else if (med->media_event_code == 2)
 		return DISK_EVENT_MEDIA_CHANGE;
 	else if (med->media_event_code == 3)
-		return DISK_EVENT_EJECT_REQUEST;
+		return DISK_EVENT_MEDIA_CHANGE;
 	return 0;
 }
 

From c5df7b0088b85b10c6aee7e0f4a1a0625f9650dd Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Date: Wed, 30 Jun 2021 09:58:23 +0200
Subject: [PATCH 2591/2658] media: videobuf2-core: dequeue if start_streaming
 fails

[ Upstream commit c592b46907adbeb81243f7eb7a468c36692658b8 ]

If a vb2_queue sets q->min_buffers_needed then when the number of
queued buffers reaches q->min_buffers_needed, vb2_core_qbuf() will call
the start_streaming() callback. If start_streaming() returns an error,
then that error was just returned by vb2_core_qbuf(), but the buffer
was still queued. However, userspace expects that if VIDIOC_QBUF fails,
the buffer is returned dequeued.

So if start_streaming() fails, then remove the buffer from the queue,
thus avoiding this unwanted side-effect.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Fixes: b3379c6201bb ("[media] vb2: only call start_streaming if sufficient buffers are queued")
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/v4l2-core/videobuf2-core.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index e0041fcfa783..c1faa1332e32 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -1361,6 +1361,7 @@ static int vb2_start_streaming(struct vb2_queue *q)
 int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb)
 {
 	struct vb2_buffer *vb;
+	enum vb2_buffer_state orig_state;
 	int ret;
 
 	if (q->error) {
@@ -1390,6 +1391,7 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb)
 	 * Add to the queued buffers list, a buffer will stay on it until
 	 * dequeued in dqbuf.
 	 */
+	orig_state = vb->state;
 	list_add_tail(&vb->queued_entry, &q->queued_list);
 	q->queued_count++;
 	q->waiting_for_buffers = false;
@@ -1420,8 +1422,17 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb)
 	if (q->streaming && !q->start_streaming_called &&
 	    q->queued_count >= q->min_buffers_needed) {
 		ret = vb2_start_streaming(q);
-		if (ret)
+		if (ret) {
+			/*
+			 * Since vb2_core_qbuf will return with an error,
+			 * we should return it to state DEQUEUED since
+			 * the error indicates that the buffer wasn't queued.
+			 */
+			list_del(&vb->queued_entry);
+			q->queued_count--;
+			vb->state = orig_state;
 			return ret;
+		}
 	}
 
 	dprintk(1, "qbuf of buffer %d succeeded\n", vb->index);

From 9f6af169fcb78ced748276cea4713e505fc0068d Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38@huawei.com>
Date: Sat, 31 Jul 2021 14:38:01 +0800
Subject: [PATCH 2592/2658] net: natsemi: Fix missing pci_disable_device() in
 probe and remove

[ Upstream commit 7fe74dfd41c428afb24e2e615470832fa997ff14 ]

Replace pci_enable_device() with pcim_enable_device(),
pci_disable_device() and pci_release_regions() will be
called in release automatically.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/natsemi/natsemi.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/natsemi/natsemi.c b/drivers/net/ethernet/natsemi/natsemi.c
index 122c2ee3dfe2..58527a2ec455 100644
--- a/drivers/net/ethernet/natsemi/natsemi.c
+++ b/drivers/net/ethernet/natsemi/natsemi.c
@@ -817,7 +817,7 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
 		printk(version);
 #endif
 
-	i = pci_enable_device(pdev);
+	i = pcim_enable_device(pdev);
 	if (i) return i;
 
 	/* natsemi has a non-standard PM control register
@@ -850,7 +850,7 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
 	ioaddr = ioremap(iostart, iosize);
 	if (!ioaddr) {
 		i = -ENOMEM;
-		goto err_ioremap;
+		goto err_pci_request_regions;
 	}
 
 	/* Work around the dropped serial bit. */
@@ -968,9 +968,6 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
  err_register_netdev:
 	iounmap(ioaddr);
 
- err_ioremap:
-	pci_release_regions(pdev);
-
  err_pci_request_regions:
 	free_netdev(dev);
 	return i;
@@ -3228,7 +3225,6 @@ static void natsemi_remove1(struct pci_dev *pdev)
 
 	NATSEMI_REMOVE_FILE(pdev, dspcfg_workaround);
 	unregister_netdev (dev);
-	pci_release_regions (pdev);
 	iounmap(ioaddr);
 	free_netdev (dev);
 }

From 46065e3fe9eb44650ffbe593b4db397be98d6772 Mon Sep 17 00:00:00 2001
From: "H. Nikolaus Schaller" <hns@goldelico.com>
Date: Thu, 8 Jul 2021 10:57:10 +0200
Subject: [PATCH 2593/2658] mips: Fix non-POSIX regexp

[ Upstream commit 28bbbb9875a35975904e46f9b06fa689d051b290 ]

When cross compiling a MIPS kernel on a BSD based HOSTCC leads
to errors like

  SYNC    include/config/auto.conf.cmd - due to: .config
egrep: empty (sub)expression
  UPD     include/config/kernel.release
  HOSTCC  scripts/dtc/dtc.o - due to target missing

It turns out that egrep uses this egrep pattern:

		(|MINOR_|PATCHLEVEL_)

This is not valid syntax or gives undefined results according
to POSIX 9.5.3 ERE Grammar

	https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap09.html

It seems to be silently accepted by the Linux egrep implementation
while a BSD host complains.

Such patterns can be replaced by a transformation like

	"(|p1|p2)" -> "(p1|p2)?"

Fixes: 48c35b2d245f ("[MIPS] There is no __GNUC_MAJOR__")
Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index 252e347958f3..ca010bce5d65 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -269,7 +269,7 @@ LDFLAGS			+= -m $(ld-emul)
 
 ifdef CONFIG_MIPS
 CHECKFLAGS += $(shell $(CC) $(KBUILD_CFLAGS) -dM -E -x c /dev/null | \
-	egrep -vw '__GNUC_(|MINOR_|PATCHLEVEL_)_' | \
+	egrep -vw '__GNUC_(MINOR_|PATCHLEVEL_)?_' | \
 	sed -e "s/^\#define /-D'/" -e "s/ /'='/" -e "s/$$/'/" -e 's/\$$/&&/g')
 ifdef CONFIG_64BIT
 CHECKFLAGS		+= -m64

From de947535353b70dee7da5702375eaf548b91d619 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 5 Aug 2021 13:38:26 +0300
Subject: [PATCH 2594/2658] bnx2x: fix an error code in bnx2x_nic_load()

[ Upstream commit fb653827c758725b149b5c924a5eb50ab4812750 ]

Set the error code if bnx2x_alloc_fw_stats_mem() fails.  The current
code returns success.

Fixes: ad5afc89365e ("bnx2x: Separate VF and PF logic")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 13de5ce3facf..dad830ee9d5b 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -2690,7 +2690,8 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
 	}
 
 	/* Allocated memory for FW statistics  */
-	if (bnx2x_alloc_fw_stats_mem(bp))
+	rc = bnx2x_alloc_fw_stats_mem(bp);
+	if (rc)
 		LOAD_ERROR_EXIT(bp, load_error0);
 
 	/* request pf to initialize status blocks */

From 8bb16d867f65c58a282e12f977c358fecd1ff76e Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Wed, 4 Aug 2021 17:30:05 +0300
Subject: [PATCH 2595/2658] net: pegasus: fix uninit-value in
 get_interrupt_interval

[ Upstream commit af35fc37354cda3c9c8cc4961b1d24bdc9d27903 ]

Syzbot reported uninit value pegasus_probe(). The problem was in missing
error handling.

get_interrupt_interval() internally calls read_eprom_word() which can
fail in some cases. For example: failed to receive usb control message.
These cases should be handled to prevent uninit value bug, since
read_eprom_word() will not initialize passed stack variable in case of
internal failure.

Fail log:

BUG: KMSAN: uninit-value in get_interrupt_interval drivers/net/usb/pegasus.c:746 [inline]
BUG: KMSAN: uninit-value in pegasus_probe+0x10e7/0x4080 drivers/net/usb/pegasus.c:1152
CPU: 1 PID: 825 Comm: kworker/1:1 Not tainted 5.12.0-rc6-syzkaller #0
...
Workqueue: usb_hub_wq hub_event
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x24c/0x2e0 lib/dump_stack.c:120
 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197
 get_interrupt_interval drivers/net/usb/pegasus.c:746 [inline]
 pegasus_probe+0x10e7/0x4080 drivers/net/usb/pegasus.c:1152
....

Local variable ----data.i@pegasus_probe created at:
 get_interrupt_interval drivers/net/usb/pegasus.c:1151 [inline]
 pegasus_probe+0xe57/0x4080 drivers/net/usb/pegasus.c:1152
 get_interrupt_interval drivers/net/usb/pegasus.c:1151 [inline]
 pegasus_probe+0xe57/0x4080 drivers/net/usb/pegasus.c:1152

Reported-and-tested-by: syzbot+02c9f70f3afae308464a@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: https://lore.kernel.org/r/20210804143005.439-1-paskripkin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/pegasus.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
index 4f505eb4f422..a7b1df01e0f7 100644
--- a/drivers/net/usb/pegasus.c
+++ b/drivers/net/usb/pegasus.c
@@ -755,12 +755,16 @@ static inline void disable_net_traffic(pegasus_t *pegasus)
 	set_registers(pegasus, EthCtrl0, sizeof(tmp), &tmp);
 }
 
-static inline void get_interrupt_interval(pegasus_t *pegasus)
+static inline int get_interrupt_interval(pegasus_t *pegasus)
 {
 	u16 data;
 	u8 interval;
+	int ret;
+
+	ret = read_eprom_word(pegasus, 4, &data);
+	if (ret < 0)
+		return ret;
 
-	read_eprom_word(pegasus, 4, &data);
 	interval = data >> 8;
 	if (pegasus->usb->speed != USB_SPEED_HIGH) {
 		if (interval < 0x80) {
@@ -775,6 +779,8 @@ static inline void get_interrupt_interval(pegasus_t *pegasus)
 		}
 	}
 	pegasus->intr_interval = interval;
+
+	return 0;
 }
 
 static void set_carrier(struct net_device *net)
@@ -1190,7 +1196,9 @@ static int pegasus_probe(struct usb_interface *intf,
 				| NETIF_MSG_PROBE | NETIF_MSG_LINK);
 
 	pegasus->features = usb_dev_id[dev_index].private;
-	get_interrupt_interval(pegasus);
+	res = get_interrupt_interval(pegasus);
+	if (res)
+		goto out2;
 	if (reset_mac(pegasus)) {
 		dev_err(&intf->dev, "can't reset MAC\n");
 		res = -EIO;

From 60c0919333634260984dec78bfb536fe4eb751ae Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Wed, 4 Aug 2021 18:52:20 +0300
Subject: [PATCH 2596/2658] net: vxge: fix use-after-free in
 vxge_device_unregister

[ Upstream commit 942e560a3d3862dd5dee1411dbdd7097d29b8416 ]

Smatch says:
drivers/net/ethernet/neterion/vxge/vxge-main.c:3518 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev);
drivers/net/ethernet/neterion/vxge/vxge-main.c:3518 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev);
drivers/net/ethernet/neterion/vxge/vxge-main.c:3520 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev);
drivers/net/ethernet/neterion/vxge/vxge-main.c:3520 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev);

Since vdev pointer is netdev private data accessing it after free_netdev()
call can cause use-after-free bug. Fix it by moving free_netdev() call at
the end of the function

Fixes: 6cca200362b4 ("vxge: cleanup probe error paths")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/neterion/vxge/vxge-main.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/neterion/vxge/vxge-main.c b/drivers/net/ethernet/neterion/vxge/vxge-main.c
index e0993eba5df3..c6950e580883 100644
--- a/drivers/net/ethernet/neterion/vxge/vxge-main.c
+++ b/drivers/net/ethernet/neterion/vxge/vxge-main.c
@@ -3539,13 +3539,13 @@ static void vxge_device_unregister(struct __vxge_hw_device *hldev)
 
 	kfree(vdev->vpaths);
 
-	/* we are safe to free it now */
-	free_netdev(dev);
-
 	vxge_debug_init(vdev->level_trace, "%s: ethernet device unregistered",
 			buf);
 	vxge_debug_entryexit(vdev->level_trace,	"%s: %s:%d  Exiting...", buf,
 			     __func__, __LINE__);
+
+	/* we are safe to free it now */
+	free_netdev(dev);
 }
 
 /*

From 06990d8cce5ca671cd71221b0d0642ab5828d776 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Date: Wed, 4 Aug 2021 19:26:56 +0900
Subject: [PATCH 2597/2658] Bluetooth: defer cleanup of resources in
 hci_unregister_dev()

[ Upstream commit e04480920d1eec9c061841399aa6f35b6f987d8b ]

syzbot is hitting might_sleep() warning at hci_sock_dev_event() due to
calling lock_sock() with rw spinlock held [1].

It seems that history of this locking problem is a trial and error.

Commit b40df5743ee8 ("[PATCH] bluetooth: fix socket locking in
hci_sock_dev_event()") in 2.6.21-rc4 changed bh_lock_sock() to
lock_sock() as an attempt to fix lockdep warning.

Then, commit 4ce61d1c7a8e ("[BLUETOOTH]: Fix locking in
hci_sock_dev_event().") in 2.6.22-rc2 changed lock_sock() to
local_bh_disable() + bh_lock_sock_nested() as an attempt to fix the
sleep in atomic context warning.

Then, commit 4b5dd696f81b ("Bluetooth: Remove local_bh_disable() from
hci_sock.c") in 3.3-rc1 removed local_bh_disable().

Then, commit e305509e678b ("Bluetooth: use correct lock to prevent UAF
of hdev object") in 5.13-rc5 again changed bh_lock_sock_nested() to
lock_sock() as an attempt to fix CVE-2021-3573.

This difficulty comes from current implementation that
hci_sock_dev_event(HCI_DEV_UNREG) is responsible for dropping all
references from sockets because hci_unregister_dev() immediately
reclaims resources as soon as returning from
hci_sock_dev_event(HCI_DEV_UNREG).

But the history suggests that hci_sock_dev_event(HCI_DEV_UNREG) was not
doing what it should do.

Therefore, instead of trying to detach sockets from device, let's accept
not detaching sockets from device at hci_sock_dev_event(HCI_DEV_UNREG),
by moving actual cleanup of resources from hci_unregister_dev() to
hci_cleanup_dev() which is called by bt_host_release() when all
references to this unregistered device (which is a kobject) are gone.

Since hci_sock_dev_event(HCI_DEV_UNREG) no longer resets
hci_pi(sk)->hdev, we need to check whether this device was unregistered
and return an error based on HCI_UNREGISTER flag.  There might be subtle
behavioral difference in "monitor the hdev" functionality; please report
if you found something went wrong due to this patch.

Link: https://syzkaller.appspot.com/bug?extid=a5df189917e79d5e59c9 [1]
Reported-by: syzbot <syzbot+a5df189917e79d5e59c9@syzkaller.appspotmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: e305509e678b ("Bluetooth: use correct lock to prevent UAF of hdev object")
Acked-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/bluetooth/hci_core.h |  1 +
 net/bluetooth/hci_core.c         | 14 +++++----
 net/bluetooth/hci_sock.c         | 49 +++++++++++++++++++++-----------
 net/bluetooth/hci_sysfs.c        |  3 ++
 4 files changed, 45 insertions(+), 22 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index f042188c8099..e1e181059324 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -1013,6 +1013,7 @@ struct hci_dev *hci_alloc_dev(void);
 void hci_free_dev(struct hci_dev *hdev);
 int hci_register_dev(struct hci_dev *hdev);
 void hci_unregister_dev(struct hci_dev *hdev);
+void hci_cleanup_dev(struct hci_dev *hdev);
 int hci_suspend_dev(struct hci_dev *hdev);
 int hci_resume_dev(struct hci_dev *hdev);
 int hci_reset_dev(struct hci_dev *hdev);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index e6965064e491..edf31dbbe0ce 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3463,8 +3463,6 @@ void hci_unregister_dev(struct hci_dev *hdev)
 
 	hci_dev_set_flag(hdev, HCI_UNREGISTER);
 
-	id = hdev->id;
-
 	write_lock(&hci_dev_list_lock);
 	list_del(&hdev->list);
 	write_unlock(&hci_dev_list_lock);
@@ -3493,7 +3491,14 @@ void hci_unregister_dev(struct hci_dev *hdev)
 	}
 
 	device_del(&hdev->dev);
+	/* Actual cleanup is deferred until hci_cleanup_dev(). */
+	hci_dev_put(hdev);
+}
+EXPORT_SYMBOL(hci_unregister_dev);
 
+/* Cleanup HCI device */
+void hci_cleanup_dev(struct hci_dev *hdev)
+{
 	debugfs_remove_recursive(hdev->debugfs);
 
 	destroy_workqueue(hdev->workqueue);
@@ -3513,11 +3518,8 @@ void hci_unregister_dev(struct hci_dev *hdev)
 	hci_discovery_filter_clear(hdev);
 	hci_dev_unlock(hdev);
 
-	hci_dev_put(hdev);
-
-	ida_simple_remove(&hci_index_ida, id);
+	ida_simple_remove(&hci_index_ida, hdev->id);
 }
-EXPORT_SYMBOL(hci_unregister_dev);
 
 /* Suspend HCI device */
 int hci_suspend_dev(struct hci_dev *hdev)
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index fbdf3ac7ef2a..f84cfd0d4c65 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -53,6 +53,17 @@ struct hci_pinfo {
 	unsigned long     flags;
 };
 
+static struct hci_dev *hci_hdev_from_sock(struct sock *sk)
+{
+	struct hci_dev *hdev = hci_pi(sk)->hdev;
+
+	if (!hdev)
+		return ERR_PTR(-EBADFD);
+	if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
+		return ERR_PTR(-EPIPE);
+	return hdev;
+}
+
 void hci_sock_set_flag(struct sock *sk, int nr)
 {
 	set_bit(nr, &hci_pi(sk)->flags);
@@ -480,19 +491,13 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event)
 	if (event == HCI_DEV_UNREG) {
 		struct sock *sk;
 
-		/* Detach sockets from device */
+		/* Wake up sockets using this dead device */
 		read_lock(&hci_sk_list.lock);
 		sk_for_each(sk, &hci_sk_list.head) {
-			lock_sock(sk);
 			if (hci_pi(sk)->hdev == hdev) {
-				hci_pi(sk)->hdev = NULL;
 				sk->sk_err = EPIPE;
-				sk->sk_state = BT_OPEN;
 				sk->sk_state_change(sk);
-
-				hci_dev_put(hdev);
 			}
-			release_sock(sk);
 		}
 		read_unlock(&hci_sk_list.lock);
 	}
@@ -631,10 +636,10 @@ static int hci_sock_blacklist_del(struct hci_dev *hdev, void __user *arg)
 static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,
 				unsigned long arg)
 {
-	struct hci_dev *hdev = hci_pi(sk)->hdev;
+	struct hci_dev *hdev = hci_hdev_from_sock(sk);
 
-	if (!hdev)
-		return -EBADFD;
+	if (IS_ERR(hdev))
+		return PTR_ERR(hdev);
 
 	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
 		return -EBUSY;
@@ -766,6 +771,18 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
 
 	lock_sock(sk);
 
+	/* Allow detaching from dead device and attaching to alive device, if
+	 * the caller wants to re-bind (instead of close) this socket in
+	 * response to hci_sock_dev_event(HCI_DEV_UNREG) notification.
+	 */
+	hdev = hci_pi(sk)->hdev;
+	if (hdev && hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
+		hci_pi(sk)->hdev = NULL;
+		sk->sk_state = BT_OPEN;
+		hci_dev_put(hdev);
+	}
+	hdev = NULL;
+
 	if (sk->sk_state == BT_BOUND) {
 		err = -EALREADY;
 		goto done;
@@ -937,9 +954,9 @@ static int hci_sock_getname(struct socket *sock, struct sockaddr *addr,
 
 	lock_sock(sk);
 
-	hdev = hci_pi(sk)->hdev;
-	if (!hdev) {
-		err = -EBADFD;
+	hdev = hci_hdev_from_sock(sk);
+	if (IS_ERR(hdev)) {
+		err = PTR_ERR(hdev);
 		goto done;
 	}
 
@@ -1191,9 +1208,9 @@ static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg,
 		goto done;
 	}
 
-	hdev = hci_pi(sk)->hdev;
-	if (!hdev) {
-		err = -EBADFD;
+	hdev = hci_hdev_from_sock(sk);
+	if (IS_ERR(hdev)) {
+		err = PTR_ERR(hdev);
 		goto done;
 	}
 
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 4f78b28686ff..a76b1371a7fc 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -180,6 +180,9 @@ ATTRIBUTE_GROUPS(bt_host);
 static void bt_host_release(struct device *dev)
 {
 	struct hci_dev *hdev = to_hci_dev(dev);
+
+	if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
+		hci_cleanup_dev(hdev);
 	kfree(hdev);
 	module_put(THIS_MODULE);
 }

From e8fc8e947defa28017ca56072a92d87af945bfdc Mon Sep 17 00:00:00 2001
From: Daniele Palmas <dnlplm@gmail.com>
Date: Tue, 3 Aug 2021 21:47:11 +0200
Subject: [PATCH 2598/2658] USB: serial: option: add Telit FD980 composition
 0x1056

commit 5648c073c33d33a0a19d0cb1194a4eb88efe2b71 upstream.

Add the following Telit FD980 composition 0x1056:

Cfg #1: mass storage
Cfg #2: rndis, tty, adb, tty, tty, tty, tty

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Link: https://lore.kernel.org/r/20210803194711.3036-1-dnlplm@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index b9017e85cc1a..b3336a7c09e0 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1185,6 +1185,8 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = NCTRL(2) | RSVD(3) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1055, 0xff),	/* Telit FN980 (PCIe) */
 	  .driver_info = NCTRL(0) | RSVD(1) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff),	/* Telit FD980 */
+	  .driver_info = NCTRL(2) | RSVD(3) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),

From d5d1f1e174b1bebc3b470bbb16fad75ec9fb344f Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Sat, 24 Jul 2021 17:27:39 +0200
Subject: [PATCH 2599/2658] USB: serial: ch341: fix character loss at high
 transfer rates

commit 3c18e9baee0ef97510dcda78c82285f52626764b upstream.

The chip supports high transfer rates, but with the small default buffers
(64 bytes read), some entire blocks are regularly lost. This typically
happens at 1.5 Mbps (which is the default speed on Rockchip devices) when
used as a console to access U-Boot where the output of the "help" command
misses many lines and where "printenv" mangles the environment.

The FTDI driver doesn't suffer at all from this. One difference is that
it uses 512 bytes rx buffers and 256 bytes tx buffers. Adopting these
values completely resolved the issue, even the output of "dmesg" is
reliable. I preferred to leave the Tx value unchanged as it is not
involved in this issue, while a change could increase the risk of
triggering the same issue with other devices having too small buffers.

I verified that it backports well (and works) at least to 5.4. It's of
low importance enough to be dropped where it doesn't trivially apply
anymore.

Cc: stable@vger.kernel.org
Signed-off-by: Willy Tarreau <w@1wt.eu>
Link: https://lore.kernel.org/r/20210724152739.18726-1-w@1wt.eu
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/ch341.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index 2cff9c40f28a..3f3535d3c99e 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -585,6 +585,7 @@ static struct usb_serial_driver ch341_device = {
 		.owner	= THIS_MODULE,
 		.name	= "ch341-uart",
 	},
+	.bulk_in_size      = 512,
 	.id_table          = id_table,
 	.num_ports         = 1,
 	.open              = ch341_open,

From aff92a6374ac53d8052a76aa9a4c3d7029369954 Mon Sep 17 00:00:00 2001
From: David Bauer <mail@david-bauer.net>
Date: Thu, 5 Aug 2021 01:25:22 +0200
Subject: [PATCH 2600/2658] USB: serial: ftdi_sio: add device ID for Auto-M3
 OP-COM v2

commit 8da0e55c7988ef9f08a708c38e5c75ecd8862cf8 upstream.

The Auto-M3 OP-COM v2 is a OBD diagnostic device using a FTD232 for the
USB connection.

Signed-off-by: David Bauer <mail@david-bauer.net>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/ftdi_sio.c     | 1 +
 drivers/usb/serial/ftdi_sio_ids.h | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index f8b8bdc0dc6f..c31cb9a97165 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -214,6 +214,7 @@ static const struct usb_device_id id_table_combined[] = {
 	{ USB_DEVICE(FTDI_VID, FTDI_MTXORB_6_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_R2000KU_TRUE_RNG) },
 	{ USB_DEVICE(FTDI_VID, FTDI_VARDAAN_PID) },
+	{ USB_DEVICE(FTDI_VID, FTDI_AUTO_M3_OP_COM_V2_PID) },
 	{ USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0100_PID) },
 	{ USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0101_PID) },
 	{ USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0102_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 54ded2bc9eb6..3b7cea8df446 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -158,6 +158,9 @@
 /* Vardaan Enterprises Serial Interface VEUSB422R3 */
 #define FTDI_VARDAAN_PID	0xF070
 
+/* Auto-M3 Ltd. - OP-COM USB V2 - OBD interface Adapter */
+#define FTDI_AUTO_M3_OP_COM_V2_PID	0x4f50
+
 /*
  * Xsens Technologies BV products (http://www.xsens.com).
  */

From eb4ba30f45ae2c7637b4aaeff8fc66f7d7b019f4 Mon Sep 17 00:00:00 2001
From: Hui Su <suhui@zeku.com>
Date: Fri, 11 Jun 2021 10:21:07 +0800
Subject: [PATCH 2601/2658] scripts/tracing: fix the bug that can't parse
 raw_trace_func

commit 1c0cec64a7cc545eb49f374a43e9f7190a14defa upstream.

Since commit 77271ce4b2c0 ("tracing: Add irq, preempt-count and need resched info
to default trace output"), the default trace output format has been changed to:
          <idle>-0       [009] d.h. 22420.068695: _raw_spin_lock_irqsave <-hrtimer_interrupt
          <idle>-0       [000] ..s. 22420.068695: _nohz_idle_balance <-run_rebalance_domains
          <idle>-0       [011] d.h. 22420.068695: account_process_tick <-update_process_times

origin trace output format:(before v3.2.0)
     # tracer: nop
     #
     #           TASK-PID    CPU#    TIMESTAMP  FUNCTION
     #              | |       |          |         |
          migration/0-6     [000]    50.025810: rcu_note_context_switch <-__schedule
          migration/0-6     [000]    50.025812: trace_rcu_utilization <-rcu_note_context_switch
          migration/0-6     [000]    50.025813: rcu_sched_qs <-rcu_note_context_switch
          migration/0-6     [000]    50.025815: rcu_preempt_qs <-rcu_note_context_switch
          migration/0-6     [000]    50.025817: trace_rcu_utilization <-rcu_note_context_switch
          migration/0-6     [000]    50.025818: debug_lockdep_rcu_enabled <-__schedule
          migration/0-6     [000]    50.025820: debug_lockdep_rcu_enabled <-__schedule

The draw_functrace.py(introduced in v2.6.28) can't parse the new version format trace_func,
So we need modify draw_functrace.py to adapt the new version trace output format.

Link: https://lkml.kernel.org/r/20210611022107.608787-1-suhui@zeku.com

Cc: stable@vger.kernel.org
Fixes: 77271ce4b2c0 tracing: Add irq, preempt-count and need resched info to default trace output
Signed-off-by: Hui Su <suhui@zeku.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 scripts/tracing/draw_functrace.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/scripts/tracing/draw_functrace.py b/scripts/tracing/draw_functrace.py
index db40fa04cd51..8754b8fbe943 100755
--- a/scripts/tracing/draw_functrace.py
+++ b/scripts/tracing/draw_functrace.py
@@ -17,7 +17,7 @@
 	$ cat /sys/kernel/debug/tracing/trace_pipe > ~/raw_trace_func
 	Wait some times but not too much, the script is a bit slow.
 	Break the pipe (Ctrl + Z)
-	$ scripts/draw_functrace.py < raw_trace_func > draw_functrace
+	$ scripts/tracing/draw_functrace.py < ~/raw_trace_func > draw_functrace
 	Then you have your drawn trace in draw_functrace
 """
 
@@ -103,10 +103,10 @@ def parseLine(line):
 	line = line.strip()
 	if line.startswith("#"):
 		raise CommentLineException
-	m = re.match("[^]]+?\\] +([0-9.]+): (\\w+) <-(\\w+)", line)
+	m = re.match("[^]]+?\\] +([a-z.]+) +([0-9.]+): (\\w+) <-(\\w+)", line)
 	if m is None:
 		raise BrokenLineException
-	return (m.group(1), m.group(2), m.group(3))
+	return (m.group(2), m.group(3), m.group(4))
 
 
 def main():

From d6ac914673352c5675c75b536044c87ea670504e Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 23 Jun 2021 10:45:21 +0200
Subject: [PATCH 2602/2658] media: rtl28xxu: fix zero-length control request

commit 76f22c93b209c811bd489950f17f8839adb31901 upstream.

The direction of the pipe argument must match the request-type direction
bit or control requests may fail depending on the host-controller-driver
implementation.

Control transfers without a data stage are treated as OUT requests by
the USB stack and should be using usb_sndctrlpipe(). Failing to do so
will now trigger a warning.

The driver uses a zero-length i2c-read request for type detection so
update the control-request code to use usb_sndctrlpipe() in this case.

Note that actually trying to read the i2c register in question does not
work as the register might not exist (e.g. depending on the demodulator)
as reported by Eero Lehtinen <debiangamer2@gmail.com>.

Reported-by: syzbot+faf11bbadc5a372564da@syzkaller.appspotmail.com
Reported-by: Eero Lehtinen <debiangamer2@gmail.com>
Tested-by: Eero Lehtinen <debiangamer2@gmail.com>
Fixes: d0f232e823af ("[media] rtl28xxu: add heuristic to detect chip type")
Cc: stable@vger.kernel.org      # 4.0
Cc: Antti Palosaari <crope@iki.fi>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
index 5a503a6bb8c5..89d474998e3e 100644
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -50,7 +50,16 @@ static int rtl28xxu_ctrl_msg(struct dvb_usb_device *d, struct rtl28xxu_req *req)
 	} else {
 		/* read */
 		requesttype = (USB_TYPE_VENDOR | USB_DIR_IN);
-		pipe = usb_rcvctrlpipe(d->udev, 0);
+
+		/*
+		 * Zero-length transfers must use usb_sndctrlpipe() and
+		 * rtl28xxu_identify_state() uses a zero-length i2c read
+		 * command to determine the chip type.
+		 */
+		if (req->size)
+			pipe = usb_rcvctrlpipe(d->udev, 0);
+		else
+			pipe = usb_sndctrlpipe(d->udev, 0);
 	}
 
 	ret = usb_control_msg(d->udev, pipe, 0, requesttype, req->value,

From 4d691d9d094852029fa62380e23580848ea30f3b Mon Sep 17 00:00:00 2001
From: "Maciej W. Rozycki" <macro@orcam.me.uk>
Date: Sat, 26 Jun 2021 06:11:05 +0200
Subject: [PATCH 2603/2658] serial: 8250: Mask out floating 16/32-bit bus bits
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit e5227c51090e165db4b48dcaa300605bfced7014 upstream.

Make sure only actual 8 bits of the IIR register are used in determining
the port type in `autoconfig'.

The `serial_in' port accessor returns the `unsigned int' type, meaning
that with UPIO_AU, UPIO_MEM16, UPIO_MEM32, and UPIO_MEM32BE access types
more than 8 bits of data are returned, of which the high order bits will
often come from bus lines that are left floating in the data phase.  For
example with the MIPS Malta board's CBUS UART, where the registers are
aligned on 8-byte boundaries and which uses 32-bit accesses, data as
follows is returned:

YAMON> dump -32 0xbf000900 0x40

BF000900: 1F000942 1F000942 1F000900 1F000900  ...B...B........
BF000910: 1F000901 1F000901 1F000900 1F000900  ................
BF000920: 1F000900 1F000900 1F000960 1F000960  ...........`...`
BF000930: 1F000900 1F000900 1F0009FF 1F0009FF  ................

YAMON>

Evidently high-order 24 bits return values previously driven in the
address phase (the 3 highest order address bits used with the command
above are masked out in the simple virtual address mapping used here and
come out at zeros on the external bus), a common scenario with bus lines
left floating, due to bus capacitance.

Consequently when the value of IIR, mapped at 0x1f000910, is retrieved
in `autoconfig', it comes out at 0x1f0009c1 and when it is right-shifted
by 6 and then assigned to 8-bit `scratch' variable, the value calculated
is 0x27, not one of 0, 1, 2, 3 expected in port type determination.

Fix the issue then, by assigning the value returned from `serial_in' to
`scratch' first, which masks out 24 high-order bits retrieved, and only
then right-shift the resulting 8-bit data quantity, producing the value
of 3 in this case, as expected.  Fix the same issue in `serial_dl_read'.

The problem first appeared with Linux 2.6.9-rc3 which predates our repo
history, but the origin could be identified with the old MIPS/Linux repo
also at: <git://git.kernel.org/pub/scm/linux/kernel/git/ralf/linux.git>
as commit e0d2356c0777 ("Merge with Linux 2.6.9-rc3."), where code in
`serial_in' was updated with this case:

+	case UPIO_MEM32:
+		return readl(up->port.membase + offset);
+

which made it produce results outside the unsigned 8-bit range for the
first time, though obviously it is system dependent what actual values
appear in the high order bits retrieved and it may well have been zeros
in the relevant positions with the system the change originally was
intended for.  It is at that point that code in `autoconf' should have
been updated accordingly, but clearly it was overlooked.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org # v2.6.12+
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Link: https://lore.kernel.org/r/alpine.DEB.2.21.2106260516220.37803@angie.orcam.me.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_port.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index fef1b9335f60..041bfe1d4191 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -274,7 +274,11 @@ configured less than Maximum supported fifo bytes */
 /* Uart divisor latch read */
 static int default_serial_dl_read(struct uart_8250_port *up)
 {
-	return serial_in(up, UART_DLL) | serial_in(up, UART_DLM) << 8;
+	/* Assign these in pieces to truncate any bits above 7.  */
+	unsigned char dll = serial_in(up, UART_DLL);
+	unsigned char dlm = serial_in(up, UART_DLM);
+
+	return dll | dlm << 8;
 }
 
 /* Uart divisor latch write */
@@ -1160,9 +1164,11 @@ static void autoconfig(struct uart_8250_port *up)
 	serial_out(up, UART_LCR, 0);
 
 	serial_out(up, UART_FCR, UART_FCR_ENABLE_FIFO);
-	scratch = serial_in(up, UART_IIR) >> 6;
 
-	switch (scratch) {
+	/* Assign this as it is to truncate any bits above 7.  */
+	scratch = serial_in(up, UART_IIR);
+
+	switch (scratch >> 6) {
 	case 0:
 		autoconfig_8250(up);
 		break;

From a4bf36e8219ab8c85adc21854dd0bdf28c7a064a Mon Sep 17 00:00:00 2001
From: "Maciej W. Rozycki" <macro@orcam.me.uk>
Date: Sat, 26 Jun 2021 06:11:13 +0200
Subject: [PATCH 2604/2658] MIPS: Malta: Do not byte-swap accesses to the CBUS
 UART
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 9a936d6c3d3d6c33ecbadf72dccdb567b5cd3c72 upstream.

Correct big-endian accesses to the CBUS UART, a Malta on-board discrete
TI16C550C part wired directly to the system controller's device bus, and
do not use byte swapping with the 32-bit accesses to the device.

The CBUS is used for devices such as the boot flash memory needed early
on in system bootstrap even before PCI has been initialised.  Therefore
it uses the system controller's device bus, which follows the endianness
set with the CPU, which means no byte-swapping is ever required for data
accesses to CBUS, unlike with PCI.

The CBUS UART uses the UPIO_MEM32 access method, that is the `readl' and
`writel' MMIO accessors, which on the MIPS platform imply byte-swapping
with PCI systems.  Consequently the wrong byte lane is accessed with the
big-endian configuration and the UART is not correctly accessed.

As it happens the UPIO_MEM32BE access method makes use of the `ioread32'
and `iowrite32' MMIO accessors, which still use `readl' and `writel'
respectively, however they byte-swap data passed, effectively cancelling
swapping done with the accessors themselves and making it suitable for
the CBUS UART.

Make the CBUS UART switch between UPIO_MEM32 and UPIO_MEM32BE then,
based on the endianness selected.  With this change in place the device
is correctly recognised with big-endian Malta at boot, along with the
Super I/O devices behind PCI:

Serial: 8250/16550 driver, 5 ports, IRQ sharing enabled
printk: console [ttyS0] disabled
serial8250.0: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
printk: console [ttyS0] enabled
printk: bootconsole [uart8250] disabled
serial8250.0: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A
serial8250.0: ttyS2 at MMIO 0x1f000900 (irq = 20, base_baud = 230400) is a 16550A

Fixes: e7c4782f92fc ("[MIPS] Put an end to <asm/serial.h>'s long and annyoing existence")
Cc: stable@vger.kernel.org # v2.6.23+
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Link: https://lore.kernel.org/r/alpine.DEB.2.21.2106260524430.37803@angie.orcam.me.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/mti-malta/malta-platform.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/mips/mti-malta/malta-platform.c b/arch/mips/mti-malta/malta-platform.c
index e1dd1c1d3fde..5d2e857f96b5 100644
--- a/arch/mips/mti-malta/malta-platform.c
+++ b/arch/mips/mti-malta/malta-platform.c
@@ -52,7 +52,8 @@ static struct plat_serial8250_port uart8250_data[] = {
 		.mapbase	= 0x1f000900,	/* The CBUS UART */
 		.irq		= MIPS_CPU_IRQ_BASE + MIPSCPU_INT_MB2,
 		.uartclk	= 3686400,	/* Twice the usual clk! */
-		.iotype		= UPIO_MEM32,
+		.iotype		= IS_ENABLED(CONFIG_CPU_BIG_ENDIAN) ?
+				  UPIO_MEM32BE : UPIO_MEM32,
 		.flags		= CBUS_UART_FLAGS,
 		.regshift	= 3,
 	},

From d5281953e9d61c672292cac3486796976a212ae0 Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Tue, 22 Jun 2021 07:11:31 +0000
Subject: [PATCH 2605/2658] pcmcia: i82092: fix a null pointer dereference bug

commit e39cdacf2f664b09029e7c1eb354c91a20c367af upstream.

During the driver loading process, the 'dev' field was not assigned, but
the 'dev' field was referenced in the subsequent 'i82092aa_set_mem_map'
function.

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
CC: <stable@vger.kernel.org>
[linux@dominikbrodowski.net: shorten commit message, add Cc to stable]
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pcmcia/i82092.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pcmcia/i82092.c b/drivers/pcmcia/i82092.c
index aae7e6df99cd..ba13e3c3d6b8 100644
--- a/drivers/pcmcia/i82092.c
+++ b/drivers/pcmcia/i82092.c
@@ -105,6 +105,7 @@ static int i82092aa_pci_probe(struct pci_dev *dev, const struct pci_device_id *i
 	for (i = 0;i<socket_count;i++) {
 		sockets[i].card_state = 1; /* 1 = present but empty */
 		sockets[i].io_base = pci_resource_start(dev, 0);
+		sockets[i].dev = dev;
 		sockets[i].socket.features |= SS_CAP_PCCARD;
 		sockets[i].socket.map_size = 0x1000;
 		sockets[i].socket.irq_mask = 0;

From 73bdfda4eecc916964e8385f1b12f48861376cf2 Mon Sep 17 00:00:00 2001
From: Yu Kuai <yukuai3@huawei.com>
Date: Fri, 2 Jul 2021 12:07:43 +0800
Subject: [PATCH 2606/2658] reiserfs: add check for root_inode in
 reiserfs_fill_super

[ Upstream commit 2acf15b94d5b8ea8392c4b6753a6ffac3135cd78 ]

Our syzcaller report a NULL pointer dereference:

BUG: kernel NULL pointer dereference, address: 0000000000000000
PGD 116e95067 P4D 116e95067 PUD 1080b5067 PMD 0
Oops: 0010 [#1] SMP KASAN
CPU: 7 PID: 592 Comm: a.out Not tainted 5.13.0-next-20210629-dirty #67
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-p4
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffff888114e779b8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 1ffff110229cef39 RCX: ffffffffaa67e1aa
RDX: 0000000000000000 RSI: ffff88810a58ee00 RDI: ffff8881233180b0
RBP: ffffffffac38e9c0 R08: ffffffffaa67e17e R09: 0000000000000001
R10: ffffffffb91c5557 R11: fffffbfff7238aaa R12: ffff88810a58ee00
R13: ffff888114e77aa0 R14: 0000000000000000 R15: ffff8881233180b0
FS:  00007f946163c480(0000) GS:ffff88839f1c0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001099c1000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __lookup_slow+0x116/0x2d0
 ? page_put_link+0x120/0x120
 ? __d_lookup+0xfc/0x320
 ? d_lookup+0x49/0x90
 lookup_one_len+0x13c/0x170
 ? __lookup_slow+0x2d0/0x2d0
 ? reiserfs_schedule_old_flush+0x31/0x130
 reiserfs_lookup_privroot+0x64/0x150
 reiserfs_fill_super+0x158c/0x1b90
 ? finish_unfinished+0xb10/0xb10
 ? bprintf+0xe0/0xe0
 ? __mutex_lock_slowpath+0x30/0x30
 ? __kasan_check_write+0x20/0x30
 ? up_write+0x51/0xb0
 ? set_blocksize+0x9f/0x1f0
 mount_bdev+0x27c/0x2d0
 ? finish_unfinished+0xb10/0xb10
 ? reiserfs_kill_sb+0x120/0x120
 get_super_block+0x19/0x30
 legacy_get_tree+0x76/0xf0
 vfs_get_tree+0x49/0x160
 ? capable+0x1d/0x30
 path_mount+0xacc/0x1380
 ? putname+0x97/0xd0
 ? finish_automount+0x450/0x450
 ? kmem_cache_free+0xf8/0x5a0
 ? putname+0x97/0xd0
 do_mount+0xe2/0x110
 ? path_mount+0x1380/0x1380
 ? copy_mount_options+0x69/0x140
 __x64_sys_mount+0xf0/0x190
 do_syscall_64+0x35/0x80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

This is because 'root_inode' is initialized with wrong mode, and
it's i_op is set to 'reiserfs_special_inode_operations'. Thus add
check for 'root_inode' to fix the problem.

Link: https://lore.kernel.org/r/20210702040743.1918552-1-yukuai3@huawei.com
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/reiserfs/super.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index 503d8c06e0d9..2ffcbe451202 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -2050,6 +2050,14 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent)
 		unlock_new_inode(root_inode);
 	}
 
+	if (!S_ISDIR(root_inode->i_mode) || !inode_get_bytes(root_inode) ||
+	    !root_inode->i_size) {
+		SWARN(silent, s, "", "corrupt root inode, run fsck");
+		iput(root_inode);
+		errval = -EUCLEAN;
+		goto error;
+	}
+
 	s->s_root = d_make_root(root_inode);
 	if (!s->s_root)
 		goto error;

From 3ac3be8409ca063eb6da0ac95f2f6a16b7a2649b Mon Sep 17 00:00:00 2001
From: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
Date: Fri, 9 Jul 2021 20:59:29 +0530
Subject: [PATCH 2607/2658] reiserfs: check directory items on read from disk

[ Upstream commit 13d257503c0930010ef9eed78b689cec417ab741 ]

While verifying the leaf item that we read from the disk, reiserfs
doesn't check the directory items, this could cause a crash when we
read a directory item from the disk that has an invalid deh_location.

This patch adds a check to the directory items read from the disk that
does a bounds check on deh_location for the directory entries. Any
directory entry header with a directory entry offset greater than the
item length is considered invalid.

Link: https://lore.kernel.org/r/20210709152929.766363-1-chouhan.shreyansh630@gmail.com
Reported-by: syzbot+c31a48e6702ccb3d64c9@syzkaller.appspotmail.com
Signed-off-by: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/reiserfs/stree.c | 31 ++++++++++++++++++++++++++-----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
index 33b78ee9fb9e..13322c39e6cc 100644
--- a/fs/reiserfs/stree.c
+++ b/fs/reiserfs/stree.c
@@ -386,6 +386,24 @@ void pathrelse(struct treepath *search_path)
 	search_path->path_length = ILLEGAL_PATH_ELEMENT_OFFSET;
 }
 
+static int has_valid_deh_location(struct buffer_head *bh, struct item_head *ih)
+{
+	struct reiserfs_de_head *deh;
+	int i;
+
+	deh = B_I_DEH(bh, ih);
+	for (i = 0; i < ih_entry_count(ih); i++) {
+		if (deh_location(&deh[i]) > ih_item_len(ih)) {
+			reiserfs_warning(NULL, "reiserfs-5094",
+					 "directory entry location seems wrong %h",
+					 &deh[i]);
+			return 0;
+		}
+	}
+
+	return 1;
+}
+
 static int is_leaf(char *buf, int blocksize, struct buffer_head *bh)
 {
 	struct block_head *blkh;
@@ -453,11 +471,14 @@ static int is_leaf(char *buf, int blocksize, struct buffer_head *bh)
 					 "(second one): %h", ih);
 			return 0;
 		}
-		if (is_direntry_le_ih(ih) && (ih_item_len(ih) < (ih_entry_count(ih) * IH_SIZE))) {
-			reiserfs_warning(NULL, "reiserfs-5093",
-					 "item entry count seems wrong %h",
-					 ih);
-			return 0;
+		if (is_direntry_le_ih(ih)) {
+			if (ih_item_len(ih) < (ih_entry_count(ih) * IH_SIZE)) {
+				reiserfs_warning(NULL, "reiserfs-5093",
+						 "item entry count seems wrong %h",
+						 ih);
+				return 0;
+			}
+			return has_valid_deh_location(bh, ih);
 		}
 		prev_location = ih_location(ih);
 	}

From 3dfd9c66ebcd2c7cbbe6f2eb01c081dfb362582a Mon Sep 17 00:00:00 2001
From: Prarit Bhargava <prarit@redhat.com>
Date: Tue, 5 Jan 2021 10:16:27 -0500
Subject: [PATCH 2608/2658] alpha: Send stop IPI to send to online CPUs

[ Upstream commit caace6ca4e06f09413fb8f8a63319594cfb7d47d ]

This issue was noticed while debugging a shutdown issue where some
secondary CPUs are not being shutdown correctly.  A fix for that [1] requires
that secondary cpus be offlined using the cpu_online_mask so that the
stop operation is a no-op if CPU HOTPLUG is disabled.  I, like the author in
[1] looked at the architectures and found that alpha is one of two
architectures that executes smp_send_stop() on all possible CPUs.

On alpha, smp_send_stop() sends an IPI to all possible CPUs but only needs
to send them to online CPUs.

Send the stop IPI to only the online CPUs.

[1] https://lkml.org/lkml/2020/1/10/250

Signed-off-by: Prarit Bhargava <prarit@redhat.com>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/alpha/kernel/smp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index 2f24447fef92..1543b571bd99 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -584,7 +584,7 @@ void
 smp_send_stop(void)
 {
 	cpumask_t to_whom;
-	cpumask_copy(&to_whom, cpu_possible_mask);
+	cpumask_copy(&to_whom, cpu_online_mask);
 	cpumask_clear_cpu(smp_processor_id(), &to_whom);
 #ifdef DEBUG_IPI_MSG
 	if (hard_smp_processor_id() != boot_cpu_id)

From a933864bc8e3fd2d5692b386691f022bc93efff8 Mon Sep 17 00:00:00 2001
From: Letu Ren <fantasquex@gmail.com>
Date: Sun, 25 Jul 2021 21:45:12 +0800
Subject: [PATCH 2609/2658] net/qla3xxx: fix schedule while atomic in
 ql_wait_for_drvr_lock and ql_adapter_reset

[ Upstream commit 92766c4628ea349c8ddab0cd7bd0488f36e5c4ce ]

When calling the 'ql_wait_for_drvr_lock' and 'ql_adapter_reset', the driver
has already acquired the spin lock, so the driver should not call 'ssleep'
in atomic context.

This bug can be fixed by using 'mdelay' instead of 'ssleep'.

Reported-by: Letu Ren <fantasquex@gmail.com>
Signed-off-by: Letu Ren <fantasquex@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qla3xxx.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
index 192950a112c9..cb9d43c871c4 100644
--- a/drivers/net/ethernet/qlogic/qla3xxx.c
+++ b/drivers/net/ethernet/qlogic/qla3xxx.c
@@ -155,7 +155,7 @@ static int ql_wait_for_drvr_lock(struct ql3_adapter *qdev)
 				      "driver lock acquired\n");
 			return 1;
 		}
-		ssleep(1);
+		mdelay(1000);
 	} while (++i < 10);
 
 	netdev_err(qdev->ndev, "Timed out waiting for driver lock...\n");
@@ -3287,7 +3287,7 @@ static int ql_adapter_reset(struct ql3_adapter *qdev)
 		if ((value & ISP_CONTROL_SR) == 0)
 			break;
 
-		ssleep(1);
+		mdelay(1000);
 	} while ((--max_wait_time));
 
 	/*
@@ -3323,7 +3323,7 @@ static int ql_adapter_reset(struct ql3_adapter *qdev)
 						   ispControlStatus);
 			if ((value & ISP_CONTROL_FSR) == 0)
 				break;
-			ssleep(1);
+			mdelay(1000);
 		} while ((--max_wait_time));
 	}
 	if (max_wait_time == 0)

From 39bc7f39842baa5ad06d2285df7c02cdc6764660 Mon Sep 17 00:00:00 2001
From: "Alex Xu (Hello71)" <alex_y_xu@yahoo.ca>
Date: Thu, 5 Aug 2021 10:40:47 -0400
Subject: [PATCH 2610/2658] pipe: increase minimum default pipe size to 2 pages

commit 46c4c9d1beb7f5b4cec4dd90e7728720583ee348 upstream.

This program always prints 4096 and hangs before the patch, and always
prints 8192 and exits successfully after:

  int main()
  {
      int pipefd[2];
      for (int i = 0; i < 1025; i++)
          if (pipe(pipefd) == -1)
              return 1;
      size_t bufsz = fcntl(pipefd[1], F_GETPIPE_SZ);
      printf("%zd\n", bufsz);
      char *buf = calloc(bufsz, 1);
      write(pipefd[1], buf, bufsz);
      read(pipefd[0], buf, bufsz-1);
      write(pipefd[1], buf, 1);
  }

Note that you may need to increase your RLIMIT_NOFILE before running the
program.

Fixes: 759c01142a ("pipe: limit the per-user amount of pages allocated in pipes")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/lkml/1628086770.5rn8p04n6j.none@localhost/
Link: https://lore.kernel.org/lkml/1628127094.lxxn016tj7.none@localhost/
Signed-off-by: Alex Xu (Hello71) <alex_y_xu@yahoo.ca>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/pipe.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/fs/pipe.c b/fs/pipe.c
index 6534470a6c19..37a003b645ef 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -27,6 +27,21 @@
 
 #include "internal.h"
 
+/*
+ * New pipe buffers will be restricted to this size while the user is exceeding
+ * their pipe buffer quota. The general pipe use case needs at least two
+ * buffers: one for data yet to be read, and one for new data. If this is less
+ * than two, then a write to a non-empty pipe may block even if the pipe is not
+ * full. This can occur with GNU make jobserver or similar uses of pipes as
+ * semaphores: multiple processes may be waiting to write tokens back to the
+ * pipe before reading tokens: https://lore.kernel.org/lkml/1628086770.5rn8p04n6j.none@localhost/.
+ *
+ * Users can reduce their pipe buffers with F_SETPIPE_SZ below this at their
+ * own risk, namely: pipe writes to non-full pipes may block until the pipe is
+ * emptied.
+ */
+#define PIPE_MIN_DEF_BUFFERS 2
+
 /*
  * The max size that a non-root user is allowed to grow the pipe. Can
  * be set by root in /proc/sys/fs/pipe-max-size
@@ -621,7 +636,7 @@ struct pipe_inode_info *alloc_pipe_info(void)
 
 		if (!too_many_pipe_buffers_hard(user)) {
 			if (too_many_pipe_buffers_soft(user))
-				pipe_bufs = 1;
+				pipe_bufs = PIPE_MIN_DEF_BUFFERS;
 			pipe->bufs = kzalloc(sizeof(struct pipe_buffer) * pipe_bufs, GFP_KERNEL);
 		}
 

From 42de9afe77977aca22d8f9683f12bd41108ac4cf Mon Sep 17 00:00:00 2001
From: Longfang Liu <liulongfang@huawei.com>
Date: Fri, 9 Apr 2021 16:48:01 +0800
Subject: [PATCH 2611/2658] USB:ehci:fix Kunpeng920 ehci hardware problem

commit 26b75952ca0b8b4b3050adb9582c8e2f44d49687 upstream.

Kunpeng920's EHCI controller does not have SBRN register.
Reading the SBRN register when the controller driver is
initialized will get 0.

When rebooting the EHCI driver, ehci_shutdown() will be called.
if the sbrn flag is 0, ehci_shutdown() will return directly.
The sbrn flag being 0 will cause the EHCI interrupt signal to
not be turned off after reboot. this interrupt that is not closed
will cause an exception to the device sharing the interrupt.

Therefore, the EHCI controller of Kunpeng920 needs to skip
the read operation of the SBRN register.

Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Longfang Liu <liulongfang@huawei.com>
Link: https://lore.kernel.org/r/1617958081-17999-1-git-send-email-liulongfang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/ehci-pci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index 33e9ed7fe026..d1e2667918e1 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -312,6 +312,9 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
 	if (pdev->vendor == PCI_VENDOR_ID_STMICRO
 	    && pdev->device == PCI_DEVICE_ID_STMICRO_USB_HOST)
 		;	/* ConneXT has no sbrn register */
+	else if (pdev->vendor == PCI_VENDOR_ID_HUAWEI
+			 && pdev->device == 0xa239)
+		;	/* HUAWEI Kunpeng920 USB EHCI has no sbrn register */
 	else
 		pci_read_config_byte(pdev, 0x60, &ehci->sbrn);
 

From 5112eabb2f2c20103513c015f183792723cae9a6 Mon Sep 17 00:00:00 2001
From: YueHaibing <yuehaibing@huawei.com>
Date: Wed, 19 May 2021 10:47:04 +0800
Subject: [PATCH 2612/2658] net: xilinx_emaclite: Do not print real IOMEM
 pointer

commit d0d62baa7f505bd4c59cd169692ff07ec49dde37 upstream.

Printing kernel pointers is discouraged because they might leak kernel
memory layout.  This fixes smatch warning:

drivers/net/ethernet/xilinx/xilinx_emaclite.c:1191 xemaclite_of_probe() warn:
 argument 4 to %08lX specifier is cast from pointer

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Pavel Machek (CIP) <pavel@denx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/xilinx/xilinx_emaclite.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 909a008f9927..26cd42bfef0c 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -1180,9 +1180,8 @@ static int xemaclite_of_probe(struct platform_device *ofdev)
 	}
 
 	dev_info(dev,
-		 "Xilinx EmacLite at 0x%08X mapped to 0x%08X, irq=%d\n",
-		 (unsigned int __force)ndev->mem_start,
-		 (unsigned int __force)lp->base_addr, ndev->irq);
+		 "Xilinx EmacLite at 0x%08X mapped to 0x%p, irq=%d\n",
+		 (unsigned int __force)ndev->mem_start, lp->base_addr, ndev->irq);
 	return 0;
 
 error:

From 5913bab655623e78c8b90f16cba3b98b4b06a2ac Mon Sep 17 00:00:00 2001
From: Miklos Szeredi <mszeredi@redhat.com>
Date: Mon, 9 Aug 2021 10:19:47 +0200
Subject: [PATCH 2613/2658] ovl: prevent private clone if bind mount is not
 allowed

commit 427215d85e8d1476da1a86b8d67aceb485eb3631 upstream.

Add the following checks from __do_loopback() to clone_private_mount() as
well:

 - verify that the mount is in the current namespace

 - verify that there are no locked children

Reported-by: Alois Wohlschlager <alois1@gmx-topmail.de>
Fixes: c771d683a62e ("vfs: introduce clone_private_mount()")
Cc: <stable@vger.kernel.org> # v3.18
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/namespace.c | 42 +++++++++++++++++++++++++++---------------
 1 file changed, 27 insertions(+), 15 deletions(-)

diff --git a/fs/namespace.c b/fs/namespace.c
index d93f16c70566..ebbea3ece236 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1882,6 +1882,20 @@ void drop_collected_mounts(struct vfsmount *mnt)
 	namespace_unlock();
 }
 
+static bool has_locked_children(struct mount *mnt, struct dentry *dentry)
+{
+	struct mount *child;
+
+	list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
+		if (!is_subdir(child->mnt_mountpoint, dentry))
+			continue;
+
+		if (child->mnt.mnt_flags & MNT_LOCKED)
+			return true;
+	}
+	return false;
+}
+
 /**
  * clone_private_mount - create a private clone of a path
  *
@@ -1896,16 +1910,27 @@ struct vfsmount *clone_private_mount(struct path *path)
 	struct mount *old_mnt = real_mount(path->mnt);
 	struct mount *new_mnt;
 
+	down_read(&namespace_sem);
 	if (IS_MNT_UNBINDABLE(old_mnt))
-		return ERR_PTR(-EINVAL);
+		goto invalid;
+
+	if (!check_mnt(old_mnt))
+		goto invalid;
+
+	if (has_locked_children(old_mnt, path->dentry))
+		goto invalid;
 
-	down_read(&namespace_sem);
 	new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE);
 	up_read(&namespace_sem);
+
 	if (IS_ERR(new_mnt))
 		return ERR_CAST(new_mnt);
 
 	return &new_mnt->mnt;
+
+invalid:
+	up_read(&namespace_sem);
+	return ERR_PTR(-EINVAL);
 }
 EXPORT_SYMBOL_GPL(clone_private_mount);
 
@@ -2221,19 +2246,6 @@ static int do_change_type(struct path *path, int flag)
 	return err;
 }
 
-static bool has_locked_children(struct mount *mnt, struct dentry *dentry)
-{
-	struct mount *child;
-	list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
-		if (!is_subdir(child->mnt_mountpoint, dentry))
-			continue;
-
-		if (child->mnt.mnt_flags & MNT_LOCKED)
-			return true;
-	}
-	return false;
-}
-
 /*
  * do loopback mount.
  */

From 4105ebbd841d45e9ab5ac8bb241ff8c8dcd01289 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sun, 15 Aug 2021 12:59:57 +0200
Subject: [PATCH 2614/2658] Linux 4.4.281

Link: https://lore.kernel.org/r/20210813150520.718161915@linuxfoundation.org
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index b4e913e8f25d..bc6d27a1c8d9 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 280
+SUBLEVEL = 281
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 15439df223455196dd6c052ca6d218fadc74c275 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 28 Jul 2021 13:23:50 +0200
Subject: [PATCH 2615/2658] ASoC: intel: atom: Fix reference to PCM buffer
 address

commit 2e6b836312a477d647a7920b56810a5a25f6c856 upstream.

PCM buffers might be allocated dynamically when the buffer
preallocation failed or a larger buffer is requested, and it's not
guaranteed that substream->dma_buffer points to the actually used
buffer.  The address should be retrieved from runtime->dma_addr,
instead of substream->dma_buffer (and shouldn't use virt_to_phys).

Also, remove the line overriding runtime->dma_area superfluously,
which was already set up at the PCM buffer allocation.

Cc: Cezary Rojewski <cezary.rojewski@intel.com>
Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20210728112353.6675-3-tiwai@suse.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/soc/intel/atom/sst-mfld-platform-pcm.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
index edb244331e6e..64079423b298 100644
--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
@@ -134,7 +134,7 @@ static void sst_fill_alloc_params(struct snd_pcm_substream *substream,
 	snd_pcm_uframes_t period_size;
 	ssize_t periodbytes;
 	ssize_t buffer_bytes = snd_pcm_lib_buffer_bytes(substream);
-	u32 buffer_addr = virt_to_phys(substream->dma_buffer.area);
+	u32 buffer_addr = substream->runtime->dma_addr;
 
 	channels = substream->runtime->channels;
 	period_size = substream->runtime->period_size;
@@ -240,7 +240,6 @@ static int sst_platform_alloc_stream(struct snd_pcm_substream *substream,
 	/* set codec params and inform SST driver the same */
 	sst_fill_pcm_params(substream, &param);
 	sst_fill_alloc_params(substream, &alloc_params);
-	substream->runtime->dma_area = substream->dma_buffer.area;
 	str_params.sparams = param;
 	str_params.aparams = alloc_params;
 	str_params.codec = SST_CODEC_TYPE_PCM;

From bf8939e9012b11ab30bcc2755bfea6cd6f1a1413 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 29 Jul 2021 16:35:32 +0200
Subject: [PATCH 2616/2658] i2c: dev: zero out array used for i2c reads from
 userspace

commit 86ff25ed6cd8240d18df58930bd8848b19fce308 upstream.

If an i2c driver happens to not provide the full amount of data that a
user asks for, it is possible that some uninitialized data could be sent
to userspace.  While all in-kernel drivers look to be safe, just be sure
by initializing the buffer to zero before it is passed to the i2c driver
so that any future drivers will not have this issue.

Also properly copy the amount of data recvieved to the userspace buffer,
as pointed out by Dan Carpenter.

Reported-by: Eric Dumazet <edumazet@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/i2c/i2c-dev.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index 7584f292e2fd..d0340b134e72 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -148,7 +148,7 @@ static ssize_t i2cdev_read(struct file *file, char __user *buf, size_t count,
 	if (count > 8192)
 		count = 8192;
 
-	tmp = kmalloc(count, GFP_KERNEL);
+	tmp = kzalloc(count, GFP_KERNEL);
 	if (tmp == NULL)
 		return -ENOMEM;
 
@@ -157,7 +157,8 @@ static ssize_t i2cdev_read(struct file *file, char __user *buf, size_t count,
 
 	ret = i2c_master_recv(client, tmp, count);
 	if (ret >= 0)
-		ret = copy_to_user(buf, tmp, count) ? -EFAULT : ret;
+		if (copy_to_user(buf, tmp, ret))
+			ret = -EFAULT;
 	kfree(tmp);
 	return ret;
 }

From 6c8c267d495811d74eb4641c900d61babefea477 Mon Sep 17 00:00:00 2001
From: Takeshi Misawa <jeliantsurux@gmail.com>
Date: Thu, 5 Aug 2021 16:54:14 +0900
Subject: [PATCH 2617/2658] net: Fix memory leak in ieee802154_raw_deliver

[ Upstream commit 1090340f7ee53e824fd4eef66a4855d548110c5b ]

If IEEE-802.15.4-RAW is closed before receive skb, skb is leaked.
Fix this, by freeing sk_receive_queue in sk->sk_destruct().

syzbot report:
BUG: memory leak
unreferenced object 0xffff88810f644600 (size 232):
  comm "softirq", pid 0, jiffies 4294967032 (age 81.270s)
  hex dump (first 32 bytes):
    10 7d 4b 12 81 88 ff ff 10 7d 4b 12 81 88 ff ff  .}K......}K.....
    00 00 00 00 00 00 00 00 40 7c 4b 12 81 88 ff ff  ........@|K.....
  backtrace:
    [<ffffffff83651d4a>] skb_clone+0xaa/0x2b0 net/core/skbuff.c:1496
    [<ffffffff83fe1b80>] ieee802154_raw_deliver net/ieee802154/socket.c:369 [inline]
    [<ffffffff83fe1b80>] ieee802154_rcv+0x100/0x340 net/ieee802154/socket.c:1070
    [<ffffffff8367cc7a>] __netif_receive_skb_one_core+0x6a/0xa0 net/core/dev.c:5384
    [<ffffffff8367cd07>] __netif_receive_skb+0x27/0xa0 net/core/dev.c:5498
    [<ffffffff8367cdd9>] netif_receive_skb_internal net/core/dev.c:5603 [inline]
    [<ffffffff8367cdd9>] netif_receive_skb+0x59/0x260 net/core/dev.c:5662
    [<ffffffff83fe6302>] ieee802154_deliver_skb net/mac802154/rx.c:29 [inline]
    [<ffffffff83fe6302>] ieee802154_subif_frame net/mac802154/rx.c:102 [inline]
    [<ffffffff83fe6302>] __ieee802154_rx_handle_packet net/mac802154/rx.c:212 [inline]
    [<ffffffff83fe6302>] ieee802154_rx+0x612/0x620 net/mac802154/rx.c:284
    [<ffffffff83fe59a6>] ieee802154_tasklet_handler+0x86/0xa0 net/mac802154/main.c:35
    [<ffffffff81232aab>] tasklet_action_common.constprop.0+0x5b/0x100 kernel/softirq.c:557
    [<ffffffff846000bf>] __do_softirq+0xbf/0x2ab kernel/softirq.c:345
    [<ffffffff81232f4c>] do_softirq kernel/softirq.c:248 [inline]
    [<ffffffff81232f4c>] do_softirq+0x5c/0x80 kernel/softirq.c:235
    [<ffffffff81232fc1>] __local_bh_enable_ip+0x51/0x60 kernel/softirq.c:198
    [<ffffffff8367a9a4>] local_bh_enable include/linux/bottom_half.h:32 [inline]
    [<ffffffff8367a9a4>] rcu_read_unlock_bh include/linux/rcupdate.h:745 [inline]
    [<ffffffff8367a9a4>] __dev_queue_xmit+0x7f4/0xf60 net/core/dev.c:4221
    [<ffffffff83fe2db4>] raw_sendmsg+0x1f4/0x2b0 net/ieee802154/socket.c:295
    [<ffffffff8363af16>] sock_sendmsg_nosec net/socket.c:654 [inline]
    [<ffffffff8363af16>] sock_sendmsg+0x56/0x80 net/socket.c:674
    [<ffffffff8363deec>] __sys_sendto+0x15c/0x200 net/socket.c:1977
    [<ffffffff8363dfb6>] __do_sys_sendto net/socket.c:1989 [inline]
    [<ffffffff8363dfb6>] __se_sys_sendto net/socket.c:1985 [inline]
    [<ffffffff8363dfb6>] __x64_sys_sendto+0x26/0x30 net/socket.c:1985

Fixes: 9ec767160357 ("net: add IEEE 802.15.4 socket family implementation")
Reported-and-tested-by: syzbot+1f68113fa907bf0695a8@syzkaller.appspotmail.com
Signed-off-by: Takeshi Misawa <jeliantsurux@gmail.com>
Acked-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210805075414.GA15796@DESKTOP
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/socket.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
index cb6c0772ea36..42ab1b61b513 100644
--- a/net/ieee802154/socket.c
+++ b/net/ieee802154/socket.c
@@ -983,6 +983,11 @@ static const struct proto_ops ieee802154_dgram_ops = {
 #endif
 };
 
+static void ieee802154_sock_destruct(struct sock *sk)
+{
+	skb_queue_purge(&sk->sk_receive_queue);
+}
+
 /* Create a socket. Initialise the socket, blank the addresses
  * set the state.
  */
@@ -1023,7 +1028,7 @@ static int ieee802154_create(struct net *net, struct socket *sock,
 	sock->ops = ops;
 
 	sock_init_data(sock, sk);
-	/* FIXME: sk->sk_destruct */
+	sk->sk_destruct = ieee802154_sock_destruct;
 	sk->sk_family = PF_IEEE802154;
 
 	/* Checksums on by default */

From 4214c4a212712227a0aa1e47f3deedf409b27ff6 Mon Sep 17 00:00:00 2001
From: Maximilian Heyne <mheyne@amazon.de>
Date: Thu, 12 Aug 2021 13:09:27 +0000
Subject: [PATCH 2618/2658] xen/events: Fix race in set_evtchn_to_irq

[ Upstream commit 88ca2521bd5b4e8b83743c01a2d4cb09325b51e9 ]

There is a TOCTOU issue in set_evtchn_to_irq. Rows in the evtchn_to_irq
mapping are lazily allocated in this function. The check whether the row
is already present and the row initialization is not synchronized. Two
threads can at the same time allocate a new row for evtchn_to_irq and
add the irq mapping to the their newly allocated row. One thread will
overwrite what the other has set for evtchn_to_irq[row] and therefore
the irq mapping is lost. This will trigger a BUG_ON later in
bind_evtchn_to_cpu:

  INFO: pci 0000:1a:15.4: [1d0f:8061] type 00 class 0x010802
  INFO: nvme 0000:1a:12.1: enabling device (0000 -> 0002)
  INFO: nvme nvme77: 1/0/0 default/read/poll queues
  CRIT: kernel BUG at drivers/xen/events/events_base.c:427!
  WARN: invalid opcode: 0000 [#1] SMP NOPTI
  WARN: Workqueue: nvme-reset-wq nvme_reset_work [nvme]
  WARN: RIP: e030:bind_evtchn_to_cpu+0xc2/0xd0
  WARN: Call Trace:
  WARN:  set_affinity_irq+0x121/0x150
  WARN:  irq_do_set_affinity+0x37/0xe0
  WARN:  irq_setup_affinity+0xf6/0x170
  WARN:  irq_startup+0x64/0xe0
  WARN:  __setup_irq+0x69e/0x740
  WARN:  ? request_threaded_irq+0xad/0x160
  WARN:  request_threaded_irq+0xf5/0x160
  WARN:  ? nvme_timeout+0x2f0/0x2f0 [nvme]
  WARN:  pci_request_irq+0xa9/0xf0
  WARN:  ? pci_alloc_irq_vectors_affinity+0xbb/0x130
  WARN:  queue_request_irq+0x4c/0x70 [nvme]
  WARN:  nvme_reset_work+0x82d/0x1550 [nvme]
  WARN:  ? check_preempt_wakeup+0x14f/0x230
  WARN:  ? check_preempt_curr+0x29/0x80
  WARN:  ? nvme_irq_check+0x30/0x30 [nvme]
  WARN:  process_one_work+0x18e/0x3c0
  WARN:  worker_thread+0x30/0x3a0
  WARN:  ? process_one_work+0x3c0/0x3c0
  WARN:  kthread+0x113/0x130
  WARN:  ? kthread_park+0x90/0x90
  WARN:  ret_from_fork+0x3a/0x50

This patch sets evtchn_to_irq rows via a cmpxchg operation so that they
will be set only once. The row is now cleared before writing it to
evtchn_to_irq in order to not create a race once the row is visible for
other threads.

While at it, do not require the page to be zeroed, because it will be
overwritten with -1's in clear_evtchn_to_irq_row anyway.

Signed-off-by: Maximilian Heyne <mheyne@amazon.de>
Fixes: d0b075ffeede ("xen/events: Refactor evtchn_to_irq array to be dynamically allocated")
Link: https://lore.kernel.org/r/20210812130930.127134-1-mheyne@amazon.de
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/xen/events/events_base.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index f27118923390..0c5b187dc7a0 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -134,12 +134,12 @@ static void disable_dynirq(struct irq_data *data);
 
 static DEFINE_PER_CPU(unsigned int, irq_epoch);
 
-static void clear_evtchn_to_irq_row(unsigned row)
+static void clear_evtchn_to_irq_row(int *evtchn_row)
 {
 	unsigned col;
 
 	for (col = 0; col < EVTCHN_PER_ROW; col++)
-		WRITE_ONCE(evtchn_to_irq[row][col], -1);
+		WRITE_ONCE(evtchn_row[col], -1);
 }
 
 static void clear_evtchn_to_irq_all(void)
@@ -149,7 +149,7 @@ static void clear_evtchn_to_irq_all(void)
 	for (row = 0; row < EVTCHN_ROW(xen_evtchn_max_channels()); row++) {
 		if (evtchn_to_irq[row] == NULL)
 			continue;
-		clear_evtchn_to_irq_row(row);
+		clear_evtchn_to_irq_row(evtchn_to_irq[row]);
 	}
 }
 
@@ -157,6 +157,7 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq)
 {
 	unsigned row;
 	unsigned col;
+	int *evtchn_row;
 
 	if (evtchn >= xen_evtchn_max_channels())
 		return -EINVAL;
@@ -169,11 +170,18 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq)
 		if (irq == -1)
 			return 0;
 
-		evtchn_to_irq[row] = (int *)get_zeroed_page(GFP_KERNEL);
-		if (evtchn_to_irq[row] == NULL)
+		evtchn_row = (int *) __get_free_pages(GFP_KERNEL, 0);
+		if (evtchn_row == NULL)
 			return -ENOMEM;
 
-		clear_evtchn_to_irq_row(row);
+		clear_evtchn_to_irq_row(evtchn_row);
+
+		/*
+		 * We've prepared an empty row for the mapping. If a different
+		 * thread was faster inserting it, we can drop ours.
+		 */
+		if (cmpxchg(&evtchn_to_irq[row], NULL, evtchn_row) != NULL)
+			free_page((unsigned long) evtchn_row);
 	}
 
 	WRITE_ONCE(evtchn_to_irq[row][col], irq);

From 9ad8ee47b5f5a84a538e55c54db4576c87465398 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Fri, 30 Jul 2021 17:01:46 -0700
Subject: [PATCH 2619/2658] x86/tools: Fix objdump version check again

[ Upstream commit 839ad22f755132838f406751439363c07272ad87 ]

Skip (omit) any version string info that is parenthesized.

Warning: objdump version 15) is older than 2.19
Warning: Skipping posttest.

where 'objdump -v' says:
GNU objdump (GNU Binutils; SUSE Linux Enterprise 15) 2.35.1.20201123-7.18

Fixes: 8bee738bb1979 ("x86: Fix objdump version check in chkobjdump.awk for different formats.")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
Link: https://lore.kernel.org/r/20210731000146.2720-1-rdunlap@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/tools/chkobjdump.awk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/tools/chkobjdump.awk b/arch/x86/tools/chkobjdump.awk
index fd1ab80be0de..a4cf678cf5c8 100644
--- a/arch/x86/tools/chkobjdump.awk
+++ b/arch/x86/tools/chkobjdump.awk
@@ -10,6 +10,7 @@ BEGIN {
 
 /^GNU objdump/ {
 	verstr = ""
+	gsub(/\(.*\)/, "");
 	for (i = 3; i <= NF; i++)
 		if (match($(i), "^[0-9]")) {
 			verstr = $(i);

From 1f0d25bd5b2c38b6f7ff018631258996ea764494 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Thu, 29 Jul 2021 23:51:40 +0200
Subject: [PATCH 2620/2658] PCI/MSI: Enable and mask MSI-X early

commit 438553958ba19296663c6d6583d208dfb6792830 upstream.

The ordering of MSI-X enable in hardware is dysfunctional:

 1) MSI-X is disabled in the control register
 2) Various setup functions
 3) pci_msi_setup_msi_irqs() is invoked which ends up accessing
    the MSI-X table entries
 4) MSI-X is enabled and masked in the control register with the
    comment that enabling is required for some hardware to access
    the MSI-X table

Step #4 obviously contradicts #3. The history of this is an issue with the
NIU hardware. When #4 was introduced the table access actually happened in
msix_program_entries() which was invoked after enabling and masking MSI-X.

This was changed in commit d71d6432e105 ("PCI/MSI: Kill redundant call of
irq_set_msi_desc() for MSI-X interrupts") which removed the table write
from msix_program_entries().

Interestingly enough nobody noticed and either NIU still works or it did
not get any testing with a kernel 3.19 or later.

Nevertheless this is inconsistent and there is no reason why MSI-X can't be
enabled and masked in the control register early on, i.e. move step #4
above to step #1. This preserves the NIU workaround and has no side effects
on other hardware.

Fixes: d71d6432e105 ("PCI/MSI: Kill redundant call of irq_set_msi_desc() for MSI-X interrupts")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Ashok Raj <ashok.raj@intel.com>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210729222542.344136412@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/msi.c | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 5d5e61d6c548..58bef2f6126b 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -737,18 +737,25 @@ static int msix_capability_init(struct pci_dev *dev,
 	u16 control;
 	void __iomem *base;
 
-	/* Ensure MSI-X is disabled while it is set up */
-	pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_ENABLE, 0);
+	/*
+	 * Some devices require MSI-X to be enabled before the MSI-X
+	 * registers can be accessed.  Mask all the vectors to prevent
+	 * interrupts coming in before they're fully set up.
+	 */
+	pci_msix_clear_and_set_ctrl(dev, 0, PCI_MSIX_FLAGS_MASKALL |
+				    PCI_MSIX_FLAGS_ENABLE);
 
 	pci_read_config_word(dev, dev->msix_cap + PCI_MSIX_FLAGS, &control);
 	/* Request & Map MSI-X table region */
 	base = msix_map_region(dev, msix_table_size(control));
-	if (!base)
-		return -ENOMEM;
+	if (!base) {
+		ret = -ENOMEM;
+		goto out_disable;
+	}
 
 	ret = msix_setup_entries(dev, base, entries, nvec);
 	if (ret)
-		return ret;
+		goto out_disable;
 
 	ret = pci_msi_setup_msi_irqs(dev, nvec, PCI_CAP_ID_MSIX);
 	if (ret)
@@ -759,14 +766,6 @@ static int msix_capability_init(struct pci_dev *dev,
 	if (ret)
 		goto out_free;
 
-	/*
-	 * Some devices require MSI-X to be enabled before we can touch the
-	 * MSI-X registers.  We need to mask all the vectors to prevent
-	 * interrupts coming in before they're fully set up.
-	 */
-	pci_msix_clear_and_set_ctrl(dev, 0,
-				PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE);
-
 	msix_program_entries(dev, entries);
 
 	ret = populate_msi_sysfs(dev);
@@ -801,6 +800,9 @@ static int msix_capability_init(struct pci_dev *dev,
 out_free:
 	free_msi_irqs(dev);
 
+out_disable:
+	pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_ENABLE, 0);
+
 	return ret;
 }
 

From f3f642005d17f692e0ae61ae86903d7b4b7b3236 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Thu, 29 Jul 2021 23:51:44 +0200
Subject: [PATCH 2621/2658] PCI/MSI: Do not set invalid bits in MSI mask

commit 361fd37397f77578735907341579397d5bed0a2d upstream.

msi_mask_irq() takes a mask and a flags argument. The mask argument is used
to mask out bits from the cached mask and the flags argument to set bits.

Some places invoke it with a flags argument which sets bits which are not
used by the device, i.e. when the device supports up to 8 vectors a full
unmask in some places sets the mask to 0xFFFFFF00. While devices probably
do not care, it's still bad practice.

Fixes: 7ba1930db02f ("PCI MSI: Unmask MSI if setup failed")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210729222542.568173099@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/msi.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 58bef2f6126b..4680632b9e65 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -624,21 +624,21 @@ static int msi_capability_init(struct pci_dev *dev, int nvec)
 	/* Configure MSI capability structure */
 	ret = pci_msi_setup_msi_irqs(dev, nvec, PCI_CAP_ID_MSI);
 	if (ret) {
-		msi_mask_irq(entry, mask, ~mask);
+		msi_mask_irq(entry, mask, 0);
 		free_msi_irqs(dev);
 		return ret;
 	}
 
 	ret = msi_verify_entries(dev);
 	if (ret) {
-		msi_mask_irq(entry, mask, ~mask);
+		msi_mask_irq(entry, mask, 0);
 		free_msi_irqs(dev);
 		return ret;
 	}
 
 	ret = populate_msi_sysfs(dev);
 	if (ret) {
-		msi_mask_irq(entry, mask, ~mask);
+		msi_mask_irq(entry, mask, 0);
 		free_msi_irqs(dev);
 		return ret;
 	}
@@ -891,7 +891,7 @@ void pci_msi_shutdown(struct pci_dev *dev)
 	/* Return the device with MSI unmasked as initial states */
 	mask = msi_mask(desc->msi_attrib.multi_cap);
 	/* Keep cached state to be restored */
-	__pci_msi_desc_mask_irq(desc, mask, ~mask);
+	__pci_msi_desc_mask_irq(desc, mask, 0);
 
 	/* Restore dev->irq to its default pin-assertion irq */
 	dev->irq = desc->msi_attrib.default_irq;

From fb526bb37d12102743d266a0b205abcea45c3be4 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Thu, 29 Jul 2021 23:51:45 +0200
Subject: [PATCH 2622/2658] PCI/MSI: Correct misleading comments

commit 689e6b5351573c38ccf92a0dd8b3e2c2241e4aff upstream.

The comments about preserving the cached state in pci_msi[x]_shutdown() are
misleading as the MSI descriptors are freed right after those functions
return. So there is nothing to restore. Preparatory change.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210729222542.621609423@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/msi.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 4680632b9e65..84ccff0f4b1b 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -890,7 +890,6 @@ void pci_msi_shutdown(struct pci_dev *dev)
 
 	/* Return the device with MSI unmasked as initial states */
 	mask = msi_mask(desc->msi_attrib.multi_cap);
-	/* Keep cached state to be restored */
 	__pci_msi_desc_mask_irq(desc, mask, 0);
 
 	/* Restore dev->irq to its default pin-assertion irq */
@@ -988,10 +987,8 @@ void pci_msix_shutdown(struct pci_dev *dev)
 		return;
 
 	/* Return the device with MSI-X masked as initial states */
-	for_each_pci_msi_entry(entry, dev) {
-		/* Keep cached states to be restored */
+	for_each_pci_msi_entry(entry, dev)
 		__pci_msix_desc_mask_irq(entry, 1);
-	}
 
 	pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_ENABLE, 0);
 	pci_intx_for_msi(dev, 1);

From 51c8fc64ee5d6cadb8fb287721e887050f8bb0ff Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Thu, 29 Jul 2021 23:51:46 +0200
Subject: [PATCH 2623/2658] PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown()

commit d28d4ad2a1aef27458b3383725bb179beb8d015c upstream.

No point in using the raw write function from shutdown. Preparatory change
to introduce proper serialization for the msi_desc::masked cache.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210729222542.674391354@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/msi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 84ccff0f4b1b..e3865e274389 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -890,7 +890,7 @@ void pci_msi_shutdown(struct pci_dev *dev)
 
 	/* Return the device with MSI unmasked as initial states */
 	mask = msi_mask(desc->msi_attrib.multi_cap);
-	__pci_msi_desc_mask_irq(desc, mask, 0);
+	msi_mask_irq(desc, mask, 0);
 
 	/* Restore dev->irq to its default pin-assertion irq */
 	dev->irq = desc->msi_attrib.default_irq;

From 1c4da19ccb63f283066e1db621e075c7e8b97bcd Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Thu, 29 Jul 2021 23:51:47 +0200
Subject: [PATCH 2624/2658] PCI/MSI: Protect msi_desc::masked for multi-MSI

commit 77e89afc25f30abd56e76a809ee2884d7c1b63ce upstream.

Multi-MSI uses a single MSI descriptor and there is a single mask register
when the device supports per vector masking. To avoid reading back the mask
register the value is cached in the MSI descriptor and updates are done by
clearing and setting bits in the cache and writing it to the device.

But nothing protects msi_desc::masked and the mask register from being
modified concurrently on two different CPUs for two different Linux
interrupts which belong to the same multi-MSI descriptor.

Add a lock to struct device and protect any operation on the mask and the
mask register with it.

This makes the update of msi_desc::masked unconditional, but there is no
place which requires a modification of the hardware register without
updating the masked cache.

msi_mask_irq() is now an empty wrapper which will be cleaned up in follow
up changes.

The problem goes way back to the initial support of multi-MSI, but picking
the commit which introduced the mask cache is a valid cut off point
(2.6.30).

Fixes: f2440d9acbe8 ("PCI MSI: Refactor interrupt masking code")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210729222542.726833414@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/core.c    |  1 +
 drivers/pci/msi.c      | 19 ++++++++++---------
 include/linux/device.h |  1 +
 include/linux/msi.h    |  2 +-
 4 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index a51b0d010d44..014b892263c5 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -715,6 +715,7 @@ void device_initialize(struct device *dev)
 	device_pm_init(dev);
 	set_dev_node(dev, -1);
 #ifdef CONFIG_GENERIC_MSI_IRQ
+	raw_spin_lock_init(&dev->msi_lock);
 	INIT_LIST_HEAD(&dev->msi_list);
 #endif
 }
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index e3865e274389..dffa5c5bcc76 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -187,24 +187,25 @@ static inline __attribute_const__ u32 msi_mask(unsigned x)
  * reliably as devices without an INTx disable bit will then generate a
  * level IRQ which will never be cleared.
  */
-u32 __pci_msi_desc_mask_irq(struct msi_desc *desc, u32 mask, u32 flag)
+void __pci_msi_desc_mask_irq(struct msi_desc *desc, u32 mask, u32 flag)
 {
-	u32 mask_bits = desc->masked;
+	raw_spinlock_t *lock = &desc->dev->msi_lock;
+	unsigned long flags;
 
 	if (pci_msi_ignore_mask || !desc->msi_attrib.maskbit)
-		return 0;
+		return;
 
-	mask_bits &= ~mask;
-	mask_bits |= flag;
+	raw_spin_lock_irqsave(lock, flags);
+	desc->masked &= ~mask;
+	desc->masked |= flag;
 	pci_write_config_dword(msi_desc_to_pci_dev(desc), desc->mask_pos,
-			       mask_bits);
-
-	return mask_bits;
+			       desc->masked);
+	raw_spin_unlock_irqrestore(lock, flags);
 }
 
 static void msi_mask_irq(struct msi_desc *desc, u32 mask, u32 flag)
 {
-	desc->masked = __pci_msi_desc_mask_irq(desc, mask, flag);
+	__pci_msi_desc_mask_irq(desc, mask, flag);
 }
 
 /*
diff --git a/include/linux/device.h b/include/linux/device.h
index 21722b8509ce..9bb803cf54fc 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -806,6 +806,7 @@ struct device {
 	struct dev_pin_info	*pins;
 #endif
 #ifdef CONFIG_GENERIC_MSI_IRQ
+	raw_spinlock_t		msi_lock;
 	struct list_head	msi_list;
 #endif
 
diff --git a/include/linux/msi.h b/include/linux/msi.h
index d0d50cf00b4d..037f47fe76e6 100644
--- a/include/linux/msi.h
+++ b/include/linux/msi.h
@@ -128,7 +128,7 @@ void __pci_read_msi_msg(struct msi_desc *entry, struct msi_msg *msg);
 void __pci_write_msi_msg(struct msi_desc *entry, struct msi_msg *msg);
 
 u32 __pci_msix_desc_mask_irq(struct msi_desc *desc, u32 flag);
-u32 __pci_msi_desc_mask_irq(struct msi_desc *desc, u32 mask, u32 flag);
+void __pci_msi_desc_mask_irq(struct msi_desc *desc, u32 mask, u32 flag);
 void pci_msi_mask_irq(struct irq_data *data);
 void pci_msi_unmask_irq(struct irq_data *data);
 

From 022ac80972f193706eea03d8996c22424fc953e8 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Thu, 29 Jul 2021 23:51:41 +0200
Subject: [PATCH 2625/2658] PCI/MSI: Mask all unused MSI-X entries

commit 7d5ec3d3612396dc6d4b76366d20ab9fc06f399f upstream.

When MSI-X is enabled the ordering of calls is:

  msix_map_region();
  msix_setup_entries();
  pci_msi_setup_msi_irqs();
  msix_program_entries();

This has a few interesting issues:

 1) msix_setup_entries() allocates the MSI descriptors and initializes them
    except for the msi_desc:masked member which is left zero initialized.

 2) pci_msi_setup_msi_irqs() allocates the interrupt descriptors and sets
    up the MSI interrupts which ends up in pci_write_msi_msg() unless the
    interrupt chip provides its own irq_write_msi_msg() function.

 3) msix_program_entries() does not do what the name suggests. It solely
    updates the entries array (if not NULL) and initializes the masked
    member for each MSI descriptor by reading the hardware state and then
    masks the entry.

Obviously this has some issues:

 1) The uninitialized masked member of msi_desc prevents the enforcement
    of masking the entry in pci_write_msi_msg() depending on the cached
    masked bit. Aside of that half initialized data is a NONO in general

 2) msix_program_entries() only ensures that the actually allocated entries
    are masked. This is wrong as experimentation with crash testing and
    crash kernel kexec has shown.

    This limited testing unearthed that when the production kernel had more
    entries in use and unmasked when it crashed and the crash kernel
    allocated a smaller amount of entries, then a full scan of all entries
    found unmasked entries which were in use in the production kernel.

    This is obviously a device or emulation issue as the device reset
    should mask all MSI-X table entries, but obviously that's just part
    of the paper specification.

Cure this by:

 1) Masking all table entries in hardware
 2) Initializing msi_desc::masked in msix_setup_entries()
 3) Removing the mask dance in msix_program_entries()
 4) Renaming msix_program_entries() to msix_update_entries() to
    reflect the purpose of that function.

As the masking of unused entries has never been done the Fixes tag refers
to a commit in:
   git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git

Fixes: f036d4ea5fa7 ("[PATCH] ia32 Message Signalled Interrupt support")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210729222542.403833459@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/msi.c | 45 +++++++++++++++++++++++++++++++--------------
 1 file changed, 31 insertions(+), 14 deletions(-)

diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index dffa5c5bcc76..9cc4a598c652 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -208,6 +208,12 @@ static void msi_mask_irq(struct msi_desc *desc, u32 mask, u32 flag)
 	__pci_msi_desc_mask_irq(desc, mask, flag);
 }
 
+static void __iomem *pci_msix_desc_addr(struct msi_desc *desc)
+{
+	return desc->mask_base +
+		desc->msi_attrib.entry_nr * PCI_MSIX_ENTRY_SIZE;
+}
+
 /*
  * This internal function does not flush PCI writes to the device.
  * All users must ensure that they read from the device before either
@@ -678,6 +684,7 @@ static int msix_setup_entries(struct pci_dev *dev, void __iomem *base,
 			      struct msix_entry *entries, int nvec)
 {
 	struct msi_desc *entry;
+	void __iomem *addr;
 	int i;
 
 	for (i = 0; i < nvec; i++) {
@@ -698,29 +705,35 @@ static int msix_setup_entries(struct pci_dev *dev, void __iomem *base,
 		entry->mask_base		= base;
 		entry->nvec_used		= 1;
 
+		addr = pci_msix_desc_addr(entry);
+		entry->masked = readl(addr + PCI_MSIX_ENTRY_VECTOR_CTRL);
 		list_add_tail(&entry->list, dev_to_msi_list(&dev->dev));
 	}
 
 	return 0;
 }
 
-static void msix_program_entries(struct pci_dev *dev,
-				 struct msix_entry *entries)
+static void msix_update_entries(struct pci_dev *dev, struct msix_entry *entries)
 {
 	struct msi_desc *entry;
-	int i = 0;
 
 	for_each_pci_msi_entry(entry, dev) {
-		int offset = entries[i].entry * PCI_MSIX_ENTRY_SIZE +
-						PCI_MSIX_ENTRY_VECTOR_CTRL;
-
-		entries[i].vector = entry->irq;
-		entry->masked = readl(entry->mask_base + offset);
-		msix_mask_irq(entry, 1);
-		i++;
+		if (entries) {
+			entries->vector = entry->irq;
+			entries++;
+		}
 	}
 }
 
+static void msix_mask_all(void __iomem *base, int tsize)
+{
+	u32 ctrl = PCI_MSIX_ENTRY_CTRL_MASKBIT;
+	int i;
+
+	for (i = 0; i < tsize; i++, base += PCI_MSIX_ENTRY_SIZE)
+		writel(ctrl, base + PCI_MSIX_ENTRY_VECTOR_CTRL);
+}
+
 /**
  * msix_capability_init - configure device's MSI-X capability
  * @dev: pointer to the pci_dev data structure of MSI-X device function
@@ -734,9 +747,9 @@ static void msix_program_entries(struct pci_dev *dev,
 static int msix_capability_init(struct pci_dev *dev,
 				struct msix_entry *entries, int nvec)
 {
-	int ret;
-	u16 control;
 	void __iomem *base;
+	int ret, tsize;
+	u16 control;
 
 	/*
 	 * Some devices require MSI-X to be enabled before the MSI-X
@@ -748,12 +761,16 @@ static int msix_capability_init(struct pci_dev *dev,
 
 	pci_read_config_word(dev, dev->msix_cap + PCI_MSIX_FLAGS, &control);
 	/* Request & Map MSI-X table region */
-	base = msix_map_region(dev, msix_table_size(control));
+	tsize = msix_table_size(control);
+	base = msix_map_region(dev, tsize);
 	if (!base) {
 		ret = -ENOMEM;
 		goto out_disable;
 	}
 
+	/* Ensure that all table entries are masked. */
+	msix_mask_all(base, tsize);
+
 	ret = msix_setup_entries(dev, base, entries, nvec);
 	if (ret)
 		goto out_disable;
@@ -767,7 +784,7 @@ static int msix_capability_init(struct pci_dev *dev,
 	if (ret)
 		goto out_free;
 
-	msix_program_entries(dev, entries);
+	msix_update_entries(dev, entries);
 
 	ret = populate_msi_sysfs(dev);
 	if (ret)

From 011cedc16b715cc1655c10331180c45215b46b3e Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Thu, 29 Jul 2021 23:51:42 +0200
Subject: [PATCH 2626/2658] PCI/MSI: Enforce that MSI-X table entry is masked
 for update

commit da181dc974ad667579baece33c2c8d2d1e4558d5 upstream.

The specification (PCIe r5.0, sec 6.1.4.5) states:

    For MSI-X, a function is permitted to cache Address and Data values
    from unmasked MSI-X Table entries. However, anytime software unmasks a
    currently masked MSI-X Table entry either by clearing its Mask bit or
    by clearing the Function Mask bit, the function must update any Address
    or Data values that it cached from that entry. If software changes the
    Address or Data value of an entry while the entry is unmasked, the
    result is undefined.

The Linux kernel's MSI-X support never enforced that the entry is masked
before the entry is modified hence the Fixes tag refers to a commit in:
      git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git

Enforce the entry to be masked across the update.

There is no point in enforcing this to be handled at all possible call
sites as this is just pointless code duplication and the common update
function is the obvious place to enforce this.

Fixes: f036d4ea5fa7 ("[PATCH] ia32 Message Signalled Interrupt support")
Reported-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210729222542.462096385@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/msi.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 9cc4a598c652..208d7b179914 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -320,13 +320,26 @@ void __pci_write_msi_msg(struct msi_desc *entry, struct msi_msg *msg)
 	if (dev->current_state != PCI_D0) {
 		/* Don't touch the hardware now */
 	} else if (entry->msi_attrib.is_msix) {
-		void __iomem *base;
-		base = entry->mask_base +
-			entry->msi_attrib.entry_nr * PCI_MSIX_ENTRY_SIZE;
+		void __iomem *base = pci_msix_desc_addr(entry);
+		bool unmasked = !(entry->masked & PCI_MSIX_ENTRY_CTRL_MASKBIT);
+
+		/*
+		 * The specification mandates that the entry is masked
+		 * when the message is modified:
+		 *
+		 * "If software changes the Address or Data value of an
+		 * entry while the entry is unmasked, the result is
+		 * undefined."
+		 */
+		if (unmasked)
+			__pci_msix_desc_mask_irq(entry, PCI_MSIX_ENTRY_CTRL_MASKBIT);
 
 		writel(msg->address_lo, base + PCI_MSIX_ENTRY_LOWER_ADDR);
 		writel(msg->address_hi, base + PCI_MSIX_ENTRY_UPPER_ADDR);
 		writel(msg->data, base + PCI_MSIX_ENTRY_DATA);
+
+		if (unmasked)
+			__pci_msix_desc_mask_irq(entry, 0);
 	} else {
 		int pos = dev->msi_cap;
 		u16 msgctl;

From c63a9aac77836b54aba8e527e8e049ccc06ccf42 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Thu, 29 Jul 2021 23:51:43 +0200
Subject: [PATCH 2627/2658] PCI/MSI: Enforce MSI[X] entry updates to be visible

commit b9255a7cb51754e8d2645b65dd31805e282b4f3e upstream.

Nothing enforces the posted writes to be visible when the function
returns. Flush them even if the flush might be redundant when the entry is
masked already as the unmask will flush as well. This is either setup or a
rare affinity change event so the extra flush is not the end of the world.

While this is more a theoretical issue especially the logic in the X86
specific msi_set_affinity() function relies on the assumption that the
update has reached the hardware when the function returns.

Again, as this never has been enforced the Fixes tag refers to a commit in:
   git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git

Fixes: f036d4ea5fa7 ("[PATCH] ia32 Message Signalled Interrupt support")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210729222542.515188147@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/msi.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 208d7b179914..e9c98f1576dd 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -340,6 +340,9 @@ void __pci_write_msi_msg(struct msi_desc *entry, struct msi_msg *msg)
 
 		if (unmasked)
 			__pci_msix_desc_mask_irq(entry, 0);
+
+		/* Ensure that the writes are visible in the device */
+		readl(base + PCI_MSIX_ENTRY_DATA);
 	} else {
 		int pos = dev->msi_cap;
 		u16 msgctl;
@@ -360,6 +363,8 @@ void __pci_write_msi_msg(struct msi_desc *entry, struct msi_msg *msg)
 			pci_write_config_word(dev, pos + PCI_MSI_DATA_32,
 					      msg->data);
 		}
+		/* Ensure that the writes are visible in the device */
+		pci_read_config_word(dev, pos + PCI_MSI_FLAGS, &msgctl);
 	}
 	entry->msg = *msg;
 }

From 693351700c2acfa33c0539c19c1267a0702da5d0 Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <nathan@kernel.org>
Date: Fri, 30 Jul 2021 19:31:08 -0700
Subject: [PATCH 2628/2658] vmlinux.lds.h: Handle clang's module.{c,d}tor
 sections

commit 848378812e40152abe9b9baf58ce2004f76fb988 upstream.

A recent change in LLVM causes module_{c,d}tor sections to appear when
CONFIG_K{A,C}SAN are enabled, which results in orphan section warnings
because these are not handled anywhere:

ld.lld: warning: arch/x86/pci/built-in.a(legacy.o):(.text.asan.module_ctor) is being placed in '.text.asan.module_ctor'
ld.lld: warning: arch/x86/pci/built-in.a(legacy.o):(.text.asan.module_dtor) is being placed in '.text.asan.module_dtor'
ld.lld: warning: arch/x86/pci/built-in.a(legacy.o):(.text.tsan.module_ctor) is being placed in '.text.tsan.module_ctor'

Fangrui explains: "the function asan.module_ctor has the SHF_GNU_RETAIN
flag, so it is in a separate section even with -fno-function-sections
(default)".

Place them in the TEXT_TEXT section so that these technologies continue
to work with the newer compiler versions. All of the KASAN and KCSAN
KUnit tests continue to pass after this change.

Cc: stable@vger.kernel.org
Link: https://github.com/ClangBuiltLinux/linux/issues/1432
Link: https://github.com/llvm/llvm-project/commit/7b789562244ee941b7bf2cefeb3fc08a59a01865
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Fangrui Song <maskray@google.com>
Acked-by: Marco Elver <elver@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210731023107.1932981-1-nathan@kernel.org
[nc: Fix conflicts due to lack of cf68fffb66d60 and 266ff2a8f51f0]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/asm-generic/vmlinux.lds.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 05fee19d5571..b156a881a785 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -435,6 +435,7 @@
 		*(.text.unlikely .text.unlikely.*)			\
 		*(.text.unknown .text.unknown.*)			\
 		*(.ref.text)						\
+		*(.text.asan.* .text.tsan.*)				\
 	MEM_KEEP(init.text)						\
 	MEM_KEEP(exit.text)						\
 

From bf84a9729e08379dcf1012f93680f0eb86b2903b Mon Sep 17 00:00:00 2001
From: Maxim Levitsky <mlevitsk@redhat.com>
Date: Mon, 16 Aug 2021 16:02:31 +0200
Subject: [PATCH 2629/2658] KVM: nSVM: avoid picking up unsupported bits from
 L2 in int_ctl (CVE-2021-3653)

[ upstream commit 0f923e07124df069ba68d8bb12324398f4b6b709 ]

* Invert the mask of bits that we pick from L2 in
  nested_vmcb02_prepare_control

* Invert and explicitly use VIRQ related bits bitmask in svm_clear_vintr

This fixes a security issue that allowed a malicious L1 to run L2 with
AVIC enabled, which allowed the L2 to exploit the uninitialized and enabled
AVIC to read/write the host physical memory at some offsets.

Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler")
Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/svm.h | 2 ++
 arch/x86/kvm/svm.c         | 6 +++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h
index 6136d99f537b..c1adb2ed6d41 100644
--- a/arch/x86/include/asm/svm.h
+++ b/arch/x86/include/asm/svm.h
@@ -108,6 +108,8 @@ struct __attribute__ ((__packed__)) vmcb_control_area {
 #define V_IGN_TPR_SHIFT 20
 #define V_IGN_TPR_MASK (1 << V_IGN_TPR_SHIFT)
 
+#define V_IRQ_INJECTION_BITS_MASK (V_IRQ_MASK | V_INTR_PRIO_MASK | V_IGN_TPR_MASK)
+
 #define V_INTR_MASKING_SHIFT 24
 #define V_INTR_MASKING_MASK (1 << V_INTR_MASKING_SHIFT)
 
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 931acac69703..77bee73faebc 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -2564,7 +2564,11 @@ static bool nested_svm_vmrun(struct vcpu_svm *svm)
 	svm->nested.intercept            = nested_vmcb->control.intercept;
 
 	svm_flush_tlb(&svm->vcpu);
-	svm->vmcb->control.int_ctl = nested_vmcb->control.int_ctl | V_INTR_MASKING_MASK;
+	svm->vmcb->control.int_ctl = nested_vmcb->control.int_ctl &
+			(V_TPR_MASK | V_IRQ_INJECTION_BITS_MASK);
+
+	svm->vmcb->control.int_ctl |= V_INTR_MASKING_MASK;
+
 	if (nested_vmcb->control.int_ctl & V_INTR_MASKING_MASK)
 		svm->vcpu.arch.hflags |= HF_VINTR_MASK;
 	else

From 4bf11b14c4fc2699c33e3934495281a726351f95 Mon Sep 17 00:00:00 2001
From: Yu Kuai <yukuai3@huawei.com>
Date: Tue, 6 Jul 2021 20:45:21 +0800
Subject: [PATCH 2630/2658] dmaengine: usb-dmac: Fix PM reference leak in
 usb_dmac_probe()

[ Upstream commit 1da569fa7ec8cb0591c74aa3050d4ea1397778b4 ]

pm_runtime_get_sync will increment pm usage counter even it failed.
Forgetting to putting operation will result in reference leak here.
Fix it by moving the error_pm label above the pm_runtime_put() in
the error path.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20210706124521.1371901-1-yukuai3@huawei.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/sh/usb-dmac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
index cc8fc601ed47..416057d9f0b6 100644
--- a/drivers/dma/sh/usb-dmac.c
+++ b/drivers/dma/sh/usb-dmac.c
@@ -863,8 +863,8 @@ static int usb_dmac_probe(struct platform_device *pdev)
 
 error:
 	of_dma_controller_free(pdev->dev.of_node);
-	pm_runtime_put(&pdev->dev);
 error_pm:
+	pm_runtime_put(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
 	return ret;
 }

From 4d86c9d07f47dcf15dc62b05dc40faffd15f346f Mon Sep 17 00:00:00 2001
From: Dave Gerlach <d-gerlach@ti.com>
Date: Fri, 16 Jul 2021 09:07:30 -0700
Subject: [PATCH 2631/2658] ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for
 tps65218

[ Upstream commit 20a6b3fd8e2e2c063b25fbf2ee74d86b898e5087 ]

Based on the latest timing specifications for the TPS65218 from the data
sheet, http://www.ti.com/lit/ds/symlink/tps65218.pdf, document SLDS206
from November 2014, we must change the i2c bus speed to better fit within
the minimum high SCL time required for proper i2c transfer.

When running at 400khz, measurements show that SCL spends
0.8125 uS/1.666 uS high/low which violates the requirement for minimum
high period of SCL provided in datasheet Table 7.6 which is 1 uS.
Switching to 100khz gives us 5 uS/5 uS high/low which both fall above
the minimum given values for 100 khz, 4.0 uS/4.7 uS high/low.

Without this patch occasionally a voltage set operation from the kernel
will appear to have worked but the actual voltage reflected on the PMIC
will not have updated, causing problems especially with cpufreq that may
update to a higher OPP without actually raising the voltage on DCDC2,
leading to a hang.

Signed-off-by: Dave Gerlach <d-gerlach@ti.com>
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/am43x-epos-evm.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts
index a74b09f17a1a..e7cd99793bc6 100644
--- a/arch/arm/boot/dts/am43x-epos-evm.dts
+++ b/arch/arm/boot/dts/am43x-epos-evm.dts
@@ -411,7 +411,7 @@
 	status = "okay";
 	pinctrl-names = "default";
 	pinctrl-0 = <&i2c0_pins>;
-	clock-frequency = <400000>;
+	clock-frequency = <100000>;
 
 	tps65218: tps65218@24 {
 		reg = <0x24>;

From 5ac89e1b019b43094ca0f463f9e9a4381067e49a Mon Sep 17 00:00:00 2001
From: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Date: Sat, 17 Jul 2021 22:00:21 +0300
Subject: [PATCH 2632/2658] dmaengine: of-dma: router_xlate to return
 -EPROBE_DEFER if controller is not yet available

[ Upstream commit eda97cb095f2958bbad55684a6ca3e7d7af0176a ]

If the router_xlate can not find the controller in the available DMA
devices then it should return with -EPORBE_DEFER in a same way as the
of_dma_request_slave_channel() does.

The issue can be reproduced if the event router is registered before the
DMA controller itself and a driver would request for a channel before the
controller is registered.
In of_dma_request_slave_channel():
1. of_dma_find_controller() would find the dma_router
2. ofdma->of_dma_xlate() would fail and returned NULL
3. -ENODEV is returned as error code

with this patch we would return in this case the correct -EPROBE_DEFER and
the client can try to request the channel later.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Link: https://lore.kernel.org/r/20210717190021.21897-1-peter.ujfalusi@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/of-dma.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/of-dma.c b/drivers/dma/of-dma.c
index 86c591481dfe..4a5dbf30605a 100644
--- a/drivers/dma/of-dma.c
+++ b/drivers/dma/of-dma.c
@@ -68,8 +68,12 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec,
 		return NULL;
 
 	ofdma_target = of_dma_find_controller(&dma_spec_target);
-	if (!ofdma_target)
-		return NULL;
+	if (!ofdma_target) {
+		ofdma->dma_router->route_free(ofdma->dma_router->dev,
+					      route_data);
+		chan = ERR_PTR(-EPROBE_DEFER);
+		goto err;
+	}
 
 	chan = ofdma_target->of_dma_xlate(&dma_spec_target, ofdma_target);
 	if (IS_ERR_OR_NULL(chan)) {
@@ -80,6 +84,7 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec,
 		chan->route_data = route_data;
 	}
 
+err:
 	/*
 	 * Need to put the node back since the ofdma->of_dma_route_allocate
 	 * has taken it for generating the new, translated dma_spec

From ac3f036ddfaff10d05207ca127d4ed6a5fb3a306 Mon Sep 17 00:00:00 2001
From: Harshvardhan Jha <harshvardhan.jha@oracle.com>
Date: Thu, 8 Jul 2021 13:16:42 +0530
Subject: [PATCH 2633/2658] scsi: megaraid_mm: Fix end of loop tests for
 list_for_each_entry()

[ Upstream commit 77541f78eadfe9fdb018a7b8b69f0f2af2cf4b82 ]

The list_for_each_entry() iterator, "adapter" in this code, can never be
NULL.  If we exit the loop without finding the correct adapter then
"adapter" points invalid memory that is an offset from the list head.  This
will eventually lead to memory corruption and presumably a kernel crash.

Link: https://lore.kernel.org/r/20210708074642.23599-1-harshvardhan.jha@oracle.com
Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: Harshvardhan Jha <harshvardhan.jha@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/megaraid/megaraid_mm.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c
index a70692779a16..34067dfd2841 100644
--- a/drivers/scsi/megaraid/megaraid_mm.c
+++ b/drivers/scsi/megaraid/megaraid_mm.c
@@ -246,7 +246,7 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval)
 	mimd_t		mimd;
 	uint32_t	adapno;
 	int		iterator;
-
+	bool		is_found;
 
 	if (copy_from_user(&mimd, umimd, sizeof(mimd_t))) {
 		*rval = -EFAULT;
@@ -262,12 +262,16 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval)
 
 	adapter = NULL;
 	iterator = 0;
+	is_found = false;
 
 	list_for_each_entry(adapter, &adapters_list_g, list) {
-		if (iterator++ == adapno) break;
+		if (iterator++ == adapno) {
+			is_found = true;
+			break;
+		}
 	}
 
-	if (!adapter) {
+	if (!is_found) {
 		*rval = -ENODEV;
 		return NULL;
 	}
@@ -735,6 +739,7 @@ ioctl_done(uioc_t *kioc)
 	uint32_t	adapno;
 	int		iterator;
 	mraid_mmadp_t*	adapter;
+	bool		is_found;
 
 	/*
 	 * When the kioc returns from driver, make sure it still doesn't
@@ -757,19 +762,23 @@ ioctl_done(uioc_t *kioc)
 		iterator	= 0;
 		adapter		= NULL;
 		adapno		= kioc->adapno;
+		is_found	= false;
 
 		con_log(CL_ANN, ( KERN_WARNING "megaraid cmm: completed "
 					"ioctl that was timedout before\n"));
 
 		list_for_each_entry(adapter, &adapters_list_g, list) {
-			if (iterator++ == adapno) break;
+			if (iterator++ == adapno) {
+				is_found = true;
+				break;
+			}
 		}
 
 		kioc->timedout = 0;
 
-		if (adapter) {
+		if (is_found)
 			mraid_mm_dealloc_kioc( adapter, kioc );
-		}
+
 	}
 	else {
 		wake_up(&wait_q);

From 874c26b003017b471e9ab4fc7889d8725b576a0c Mon Sep 17 00:00:00 2001
From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Date: Mon, 26 Jul 2021 17:24:02 +0530
Subject: [PATCH 2634/2658] scsi: core: Avoid printing an error if
 target_alloc() returns -ENXIO

[ Upstream commit 70edd2e6f652f67d854981fd67f9ad0f1deaea92 ]

Avoid printing a 'target allocation failed' error if the driver
target_alloc() callback function returns -ENXIO. This return value
indicates that the corresponding H:C:T:L entry is empty.

Removing this error reduces the scan time if the user issues SCAN_WILD_CARD
scan operation through sysfs parameter on a host with a lot of empty
H:C:T:L entries.

Avoiding the printk on -ENXIO matches the behavior of the other callback
functions during scanning.

Link: https://lore.kernel.org/r/20210726115402.1936-1-sreekanth.reddy@broadcom.com
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/scsi_scan.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 271e8035f5fb..fd8ebb9e66e6 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -457,7 +457,8 @@ static struct scsi_target *scsi_alloc_target(struct device *parent,
 		error = shost->hostt->target_alloc(starget);
 
 		if(error) {
-			dev_printk(KERN_ERR, dev, "target allocation failed, error %d\n", error);
+			if (error != -ENXIO)
+				dev_err(dev, "target allocation failed, error %d\n", error);
 			/* don't want scsi_target_reap to do the final
 			 * put because it will be under the host lock */
 			scsi_target_destroy(starget);

From 87cf6a08d8efd1b3b8f8bc89edc0b6b6d9002021 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ole=20Bj=C3=B8rn=20Midtb=C3=B8?= <omidtbo@cisco.com>
Date: Sat, 17 Oct 2020 13:15:44 +0200
Subject: [PATCH 2635/2658] Bluetooth: hidp: use correct wait queue when
 removing ctrl_wait
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit cca342d98bef68151a80b024f7bf5f388d1fbdea ]

A different wait queue was used when removing ctrl_wait than when adding
it. This effectively made the remove operation without locking compared
to other operations on the wait queue ctrl_wait was part of. This caused
issues like below where dead000000000100 is LIST_POISON1 and
dead000000000200 is LIST_POISON2.

 list_add corruption. next->prev should be prev (ffffffc1b0a33a08), \
	but was dead000000000200. (next=ffffffc03ac77de0).
 ------------[ cut here ]------------
 CPU: 3 PID: 2138 Comm: bluetoothd Tainted: G           O    4.4.238+ #9
 ...
 ---[ end trace 0adc2158f0646eac ]---
 Call trace:
 [<ffffffc000443f78>] __list_add+0x38/0xb0
 [<ffffffc0000f0d04>] add_wait_queue+0x4c/0x68
 [<ffffffc00020eecc>] __pollwait+0xec/0x100
 [<ffffffc000d1556c>] bt_sock_poll+0x74/0x200
 [<ffffffc000bdb8a8>] sock_poll+0x110/0x128
 [<ffffffc000210378>] do_sys_poll+0x220/0x480
 [<ffffffc0002106f0>] SyS_poll+0x80/0x138
 [<ffffffc00008510c>] __sys_trace_return+0x0/0x4

 Unable to handle kernel paging request at virtual address dead000000000100
 ...
 CPU: 4 PID: 5387 Comm: kworker/u15:3 Tainted: G        W  O    4.4.238+ #9
 ...
 Call trace:
  [<ffffffc0000f079c>] __wake_up_common+0x7c/0xa8
  [<ffffffc0000f0818>] __wake_up+0x50/0x70
  [<ffffffc000be11b0>] sock_def_wakeup+0x58/0x60
  [<ffffffc000de5e10>] l2cap_sock_teardown_cb+0x200/0x224
  [<ffffffc000d3f2ac>] l2cap_chan_del+0xa4/0x298
  [<ffffffc000d45ea0>] l2cap_conn_del+0x118/0x198
  [<ffffffc000d45f8c>] l2cap_disconn_cfm+0x6c/0x78
  [<ffffffc000d29934>] hci_event_packet+0x564/0x2e30
  [<ffffffc000d19b0c>] hci_rx_work+0x10c/0x360
  [<ffffffc0000c2218>] process_one_work+0x268/0x460
  [<ffffffc0000c2678>] worker_thread+0x268/0x480
  [<ffffffc0000c94e0>] kthread+0x118/0x128
  [<ffffffc000085070>] ret_from_fork+0x10/0x20
  ---[ end trace 0adc2158f0646ead ]---

Signed-off-by: Ole Bjørn Midtbø <omidtbo@cisco.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hidp/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index e614940c4e98..960d4b718fd7 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -1283,7 +1283,7 @@ static int hidp_session_thread(void *arg)
 
 	/* cleanup runtime environment */
 	remove_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait);
-	remove_wait_queue(sk_sleep(session->intr_sock->sk), &ctrl_wait);
+	remove_wait_queue(sk_sleep(session->ctrl_sock->sk), &ctrl_wait);
 	wake_up_interruptible(&session->report_queue);
 	hidp_del_timer(session);
 

From 22d53c1ce74eed879c7110ff5a7d35512c6fffed Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Sun, 8 Aug 2021 16:04:40 -0700
Subject: [PATCH 2636/2658] dccp: add do-while-0 stubs for dccp_pr_debug macros

[ Upstream commit 86aab09a4870bb8346c9579864588c3d7f555299 ]

GCC complains about empty macros in an 'if' statement, so convert
them to 'do {} while (0)' macros.

Fixes these build warnings:

net/dccp/output.c: In function 'dccp_xmit_packet':
../net/dccp/output.c:283:71: warning: suggest braces around empty body in an 'if' statement [-Wempty-body]
  283 |                 dccp_pr_debug("transmit_skb() returned err=%d\n", err);
net/dccp/ackvec.c: In function 'dccp_ackvec_update_old':
../net/dccp/ackvec.c:163:80: warning: suggest braces around empty body in an 'else' statement [-Wempty-body]
  163 |                                               (unsigned long long)seqno, state);

Fixes: dc841e30eaea ("dccp: Extend CCID packet dequeueing interface")
Fixes: 380240864451 ("dccp ccid-2: Update code for the Ack Vector input/registration routine")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: dccp@vger.kernel.org
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/dccp/dccp.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index b0e28d24e1a7..e50fc19690c8 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -44,9 +44,9 @@ extern bool dccp_debug;
 #define dccp_pr_debug_cat(format, a...)   DCCP_PRINTK(dccp_debug, format, ##a)
 #define dccp_debug(fmt, a...)		  dccp_pr_debug_cat(KERN_DEBUG fmt, ##a)
 #else
-#define dccp_pr_debug(format, a...)
-#define dccp_pr_debug_cat(format, a...)
-#define dccp_debug(format, a...)
+#define dccp_pr_debug(format, a...)	  do {} while (0)
+#define dccp_pr_debug_cat(format, a...)	  do {} while (0)
+#define dccp_debug(format, a...)	  do {} while (0)
 #endif
 
 extern struct inet_hashinfo dccp_hashinfo;

From 54781fae4cd28433792f1194d78a13998bef58b2 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Fri, 13 Aug 2021 18:14:33 +0300
Subject: [PATCH 2637/2658] net: 6pack: fix slab-out-of-bounds in decode_data

[ Upstream commit 19d1532a187669ce86d5a2696eb7275310070793 ]

Syzbot reported slab-out-of bounds write in decode_data().
The problem was in missing validation checks.

Syzbot's reproducer generated malicious input, which caused
decode_data() to be called a lot in sixpack_decode(). Since
rx_count_cooked is only 400 bytes and noone reported before,
that 400 bytes is not enough, let's just check if input is malicious
and complain about buffer overrun.

Fail log:
==================================================================
BUG: KASAN: slab-out-of-bounds in drivers/net/hamradio/6pack.c:843
Write of size 1 at addr ffff888087c5544e by task kworker/u4:0/7

CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted 5.6.0-rc3-syzkaller #0
...
Workqueue: events_unbound flush_to_ldisc
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
 __kasan_report.cold+0x1b/0x32 mm/kasan/report.c:506
 kasan_report+0x12/0x20 mm/kasan/common.c:641
 __asan_report_store1_noabort+0x17/0x20 mm/kasan/generic_report.c:137
 decode_data.part.0+0x23b/0x270 drivers/net/hamradio/6pack.c:843
 decode_data drivers/net/hamradio/6pack.c:965 [inline]
 sixpack_decode drivers/net/hamradio/6pack.c:968 [inline]

Reported-and-tested-by: syzbot+fc8cd9a673d4577fb2e4@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/hamradio/6pack.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 732c68ed166a..cce901add654 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -874,6 +874,12 @@ static void decode_data(struct sixpack *sp, unsigned char inbyte)
 		return;
 	}
 
+	if (sp->rx_count_cooked + 2 >= sizeof(sp->cooked_buf)) {
+		pr_err("6pack: cooked buffer overrun, data loss\n");
+		sp->rx_count = 0;
+		return;
+	}
+
 	buf = sp->raw_buf;
 	sp->cooked_buf[sp->rx_count_cooked++] =
 		buf[0] | ((buf[1] << 2) & 0xc0);

From cc22428e9c51d5ee2be1dc28e3141160550eb83b Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Mon, 16 Aug 2021 21:14:04 +0800
Subject: [PATCH 2638/2658] net: qlcnic: add missed unlock in
 qlcnic_83xx_flash_read32

[ Upstream commit 0a298d133893c72c96e2156ed7cb0f0c4a306a3e ]

qlcnic_83xx_unlock_flash() is called on all paths after we call
qlcnic_83xx_lock_flash(), except for one error path on failure
of QLCRD32(), which may cause a deadlock. This bug is suggested
by a static analysis tool, please advise.

Fixes: 81d0aeb0a4fff ("qlcnic: flash template based firmware reset recovery")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Link: https://lore.kernel.org/r/20210816131405.24024-1-dinghao.liu@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 75ac5cc2fc23..fc9c1e6f0ff5 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -3156,8 +3156,10 @@ int qlcnic_83xx_flash_read32(struct qlcnic_adapter *adapter, u32 flash_addr,
 
 		indirect_addr = QLC_83XX_FLASH_DIRECT_DATA(addr);
 		ret = QLCRD32(adapter, indirect_addr, &err);
-		if (err == -EIO)
+		if (err == -EIO) {
+			qlcnic_83xx_unlock_flash(adapter);
 			return err;
+		}
 
 		word = ret;
 		*(u32 *)p_data  = word;

From 65e28c07bdb1552d16308b4e418a916433a753de Mon Sep 17 00:00:00 2001
From: Doug Anderson <dianders@chromium.org>
Date: Tue, 26 Apr 2016 10:03:58 +0200
Subject: [PATCH 2639/2658] mmc: dw_mmc: Wait for data transfer after response
 errors.

[ Upstream commit 46d179525a1f6d16957dcb4624517bc04142b3e7 ]

According to the DesignWare state machine description, after we get a
"response error" or "response CRC error" we move into data transfer
mode. That means that we don't necessarily need to special case
trying to deal with the failure right away. We can wait until we are
notified that the data transfer is complete (with or without errors)
and then we can deal with the failure.

It may sound strange to defer dealing with a command that we know will
fail anyway, but this appears to fix a bug. During tuning (CMD19) on
a specific card on an rk3288-based system, we found that we could get
a "response CRC error". Sending the stop command after the "response
CRC error" would then throw the system into a confused state causing
all future tuning phases to report failure.

When in the confused state, the controller would show these (hex codes
are interrupt status register):
 CMD ERR: 0x00000046 (cmd=19)
 CMD ERR: 0x0000004e (cmd=12)
 DATA ERR: 0x00000208
 DATA ERR: 0x0000020c
 CMD ERR: 0x00000104 (cmd=19)
 CMD ERR: 0x00000104 (cmd=12)
 DATA ERR: 0x00000208
 DATA ERR: 0x0000020c
 ...
 ...

It is inherently difficult to deal with the complexity of trying to
correctly send a stop command while a data transfer is taking place
since you need to deal with different corner cases caused by the fact
that the data transfer could complete (with errors or without errors)
during various places in sending the stop command (dw_mci_stop_dma,
send_stop_abort, etc)

Instead of adding a bunch of extra complexity to deal with this, it
seems much simpler to just use the more straightforward (and less
error-prone) path of letting the data transfer finish. There
shouldn't be any huge benefit to sending the stop command slightly
earlier, anyway.

Signed-off-by: Doug Anderson <dianders@chromium.org>
Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
Cc: Alim Akhtar <alim.akhtar@gmail.com>
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/dw_mmc.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 581f5d0271f4..afdf539e06e9 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -1744,6 +1744,33 @@ static void dw_mci_tasklet_func(unsigned long priv)
 			}
 
 			if (cmd->data && err) {
+				/*
+				 * During UHS tuning sequence, sending the stop
+				 * command after the response CRC error would
+				 * throw the system into a confused state
+				 * causing all future tuning phases to report
+				 * failure.
+				 *
+				 * In such case controller will move into a data
+				 * transfer state after a response error or
+				 * response CRC error. Let's let that finish
+				 * before trying to send a stop, so we'll go to
+				 * STATE_SENDING_DATA.
+				 *
+				 * Although letting the data transfer take place
+				 * will waste a bit of time (we already know
+				 * the command was bad), it can't cause any
+				 * errors since it's possible it would have
+				 * taken place anyway if this tasklet got
+				 * delayed. Allowing the transfer to take place
+				 * avoids races and keeps things simple.
+				 */
+				if ((err != -ETIMEDOUT) &&
+				    (cmd->opcode == MMC_SEND_TUNING_BLOCK)) {
+					state = STATE_SENDING_DATA;
+					continue;
+				}
+
 				dw_mci_stop_dma(host);
 				send_stop_abort(host, data);
 				state = STATE_SENDING_STOP;

From c5748de95f60dbbd846c8473a0be6dd5e47129b4 Mon Sep 17 00:00:00 2001
From: Jaehoon Chung <jh80.chung@samsung.com>
Date: Thu, 17 Nov 2016 16:40:37 +0900
Subject: [PATCH 2640/2658] mmc: dw_mmc: call the dw_mci_prep_stop_abort() by
 default

[ Upstream commit e13c3c081845b51e8ba71a90e91c52679cfdbf89 ]

stop_cmdr should be set to values relevant to stop command.
It migth be assigned to values whatever there is mrq->stop or not.
Then it doesn't need to use dw_mci_prepare_command().
It's enough to use the prep_stop_abort for preparing stop command.

Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/dw_mmc.c | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index afdf539e06e9..72ab0623293c 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -380,7 +380,7 @@ static void dw_mci_start_command(struct dw_mci *host,
 
 static inline void send_stop_abort(struct dw_mci *host, struct mmc_data *data)
 {
-	struct mmc_command *stop = data->stop ? data->stop : &host->stop_abort;
+	struct mmc_command *stop = &host->stop_abort;
 
 	dw_mci_start_command(host, stop, host->stop_cmdr);
 }
@@ -1202,10 +1202,7 @@ static void __dw_mci_start_request(struct dw_mci *host,
 		spin_unlock_irqrestore(&host->irq_lock, irqflags);
 	}
 
-	if (mrq->stop)
-		host->stop_cmdr = dw_mci_prepare_command(slot->mmc, mrq->stop);
-	else
-		host->stop_cmdr = dw_mci_prep_stop_abort(host, cmd);
+	host->stop_cmdr = dw_mci_prep_stop_abort(host, cmd);
 }
 
 static void dw_mci_start_request(struct dw_mci *host,
@@ -1797,8 +1794,7 @@ static void dw_mci_tasklet_func(unsigned long priv)
 			if (test_and_clear_bit(EVENT_DATA_ERROR,
 					       &host->pending_events)) {
 				dw_mci_stop_dma(host);
-				if (data->stop ||
-				    !(host->data_status & (SDMMC_INT_DRTO |
+				if (!(host->data_status & (SDMMC_INT_DRTO |
 							   SDMMC_INT_EBE)))
 					send_stop_abort(host, data);
 				state = STATE_DATA_ERROR;
@@ -1835,8 +1831,7 @@ static void dw_mci_tasklet_func(unsigned long priv)
 			if (test_and_clear_bit(EVENT_DATA_ERROR,
 					       &host->pending_events)) {
 				dw_mci_stop_dma(host);
-				if (data->stop ||
-				    !(host->data_status & (SDMMC_INT_DRTO |
+				if (!(host->data_status & (SDMMC_INT_DRTO |
 							   SDMMC_INT_EBE)))
 					send_stop_abort(host, data);
 				state = STATE_DATA_ERROR;
@@ -1913,7 +1908,7 @@ static void dw_mci_tasklet_func(unsigned long priv)
 			host->cmd = NULL;
 			host->data = NULL;
 
-			if (mrq->stop)
+			if (!mrq->sbc && mrq->stop)
 				dw_mci_command_complete(host, mrq->stop);
 			else
 				host->cmd_status = 0;

From 7f5b2058dd98496e4649ba9286aaa4db24963738 Mon Sep 17 00:00:00 2001
From: Vincent Whitchurch <vincent.whitchurch@axis.com>
Date: Wed, 30 Jun 2021 12:22:32 +0200
Subject: [PATCH 2641/2658] mmc: dw_mmc: Fix hang on data CRC error

[ Upstream commit 25f8203b4be1937c4939bb98623e67dcfd7da4d1 ]

When a Data CRC interrupt is received, the driver disables the DMA, then
sends the stop/abort command and then waits for Data Transfer Over.

However, sometimes, when a data CRC error is received in the middle of a
multi-block write transfer, the Data Transfer Over interrupt is never
received, and the driver hangs and never completes the request.

The driver sets the BMOD.SWR bit (SDMMC_IDMAC_SWRESET) when stopping the
DMA, but according to the manual CMD.STOP_ABORT_CMD should be programmed
"before assertion of SWR".  Do these operations in the recommended
order.  With this change the Data Transfer Over is always received
correctly in my tests.

Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
Reviewed-by: Jaehoon Chung <jh80.chung@samsung.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210630102232.16011-1-vincent.whitchurch@axis.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/dw_mmc.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 72ab0623293c..7bfe9ce03944 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -1768,8 +1768,8 @@ static void dw_mci_tasklet_func(unsigned long priv)
 					continue;
 				}
 
-				dw_mci_stop_dma(host);
 				send_stop_abort(host, data);
+				dw_mci_stop_dma(host);
 				state = STATE_SENDING_STOP;
 				break;
 			}
@@ -1793,10 +1793,10 @@ static void dw_mci_tasklet_func(unsigned long priv)
 			 */
 			if (test_and_clear_bit(EVENT_DATA_ERROR,
 					       &host->pending_events)) {
-				dw_mci_stop_dma(host);
 				if (!(host->data_status & (SDMMC_INT_DRTO |
 							   SDMMC_INT_EBE)))
 					send_stop_abort(host, data);
+				dw_mci_stop_dma(host);
 				state = STATE_DATA_ERROR;
 				break;
 			}
@@ -1830,10 +1830,10 @@ static void dw_mci_tasklet_func(unsigned long priv)
 			 */
 			if (test_and_clear_bit(EVENT_DATA_ERROR,
 					       &host->pending_events)) {
-				dw_mci_stop_dma(host);
 				if (!(host->data_status & (SDMMC_INT_DRTO |
 							   SDMMC_INT_EBE)))
 					send_stop_abort(host, data);
+				dw_mci_stop_dma(host);
 				state = STATE_DATA_ERROR;
 				break;
 			}

From 5d8ff2ad11de0e6b11c519bb8755d94e4a1cf78b Mon Sep 17 00:00:00 2001
From: Jaroslav Kysela <perex@perex.cz>
Date: Wed, 11 Aug 2021 18:14:41 +0200
Subject: [PATCH 2642/2658] ALSA: hda - fix the 'Capture Switch' value change
 notifications

[ Upstream commit a2befe9380dd04ee76c871568deca00eedf89134 ]

The original code in the cap_put_caller() function does not
handle correctly the positive values returned from the passed
function for multiple iterations. It means that the change
notifications may be lost.

Fixes: 352f7f914ebb ("ALSA: hda - Merge Realtek parser code to generic parser")
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=213851
Cc: <stable@kernel.org>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20210811161441.1325250-1-perex@perex.cz
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/hda/hda_generic.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 7fed8d1bb79c..5c708d9851b8 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -3442,7 +3442,7 @@ static int cap_put_caller(struct snd_kcontrol *kcontrol,
 	struct hda_gen_spec *spec = codec->spec;
 	const struct hda_input_mux *imux;
 	struct nid_path *path;
-	int i, adc_idx, err = 0;
+	int i, adc_idx, ret, err = 0;
 
 	imux = &spec->input_mux;
 	adc_idx = kcontrol->id.index;
@@ -3452,9 +3452,13 @@ static int cap_put_caller(struct snd_kcontrol *kcontrol,
 		if (!path || !path->ctls[type])
 			continue;
 		kcontrol->private_value = path->ctls[type];
-		err = func(kcontrol, ucontrol);
-		if (err < 0)
+		ret = func(kcontrol, ucontrol);
+		if (ret < 0) {
+			err = ret;
 			break;
+		}
+		if (ret > 0)
+			err = 1;
 	}
 	mutex_unlock(&codec->control_mutex);
 	if (err >= 0 && spec->cap_sync_hook)

From e16d525d39e905329cc1e90e9ba9425fce9c4cce Mon Sep 17 00:00:00 2001
From: Dongliang Mu <mudongliangabcd@gmail.com>
Date: Tue, 10 Aug 2021 18:03:18 +0800
Subject: [PATCH 2643/2658] ipack: tpci200: fix many double free issues in
 tpci200_pci_probe

[ Upstream commit 57a1681095f912239c7fb4d66683ab0425973838 ]

The function tpci200_register called by tpci200_install and
tpci200_unregister called by tpci200_uninstall are in pair. However,
tpci200_unregister has some cleanup operations not in the
tpci200_register. So the error handling code of tpci200_pci_probe has
many different double free issues.

Fix this problem by moving those cleanup operations out of
tpci200_unregister, into tpci200_pci_remove and reverting
the previous commit 9272e5d0028d ("ipack/carriers/tpci200:
Fix a double free in tpci200_pci_probe").

Fixes: 9272e5d0028d ("ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe")
Cc: stable@vger.kernel.org
Reported-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Link: https://lore.kernel.org/r/20210810100323.3938492-1-mudongliangabcd@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ipack/carriers/tpci200.c | 36 ++++++++++++++++----------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/drivers/ipack/carriers/tpci200.c b/drivers/ipack/carriers/tpci200.c
index 7ba1a94497f5..4294523bede5 100644
--- a/drivers/ipack/carriers/tpci200.c
+++ b/drivers/ipack/carriers/tpci200.c
@@ -94,16 +94,13 @@ static void tpci200_unregister(struct tpci200_board *tpci200)
 	free_irq(tpci200->info->pdev->irq, (void *) tpci200);
 
 	pci_iounmap(tpci200->info->pdev, tpci200->info->interface_regs);
-	pci_iounmap(tpci200->info->pdev, tpci200->info->cfg_regs);
 
 	pci_release_region(tpci200->info->pdev, TPCI200_IP_INTERFACE_BAR);
 	pci_release_region(tpci200->info->pdev, TPCI200_IO_ID_INT_SPACES_BAR);
 	pci_release_region(tpci200->info->pdev, TPCI200_MEM16_SPACE_BAR);
 	pci_release_region(tpci200->info->pdev, TPCI200_MEM8_SPACE_BAR);
-	pci_release_region(tpci200->info->pdev, TPCI200_CFG_MEM_BAR);
 
 	pci_disable_device(tpci200->info->pdev);
-	pci_dev_put(tpci200->info->pdev);
 }
 
 static void tpci200_enable_irq(struct tpci200_board *tpci200,
@@ -524,7 +521,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
 	tpci200->info = kzalloc(sizeof(struct tpci200_infos), GFP_KERNEL);
 	if (!tpci200->info) {
 		ret = -ENOMEM;
-		goto out_err_info;
+		goto err_tpci200;
 	}
 
 	pci_dev_get(pdev);
@@ -535,7 +532,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to allocate PCI Configuration Memory");
 		ret = -EBUSY;
-		goto out_err_pci_request;
+		goto err_tpci200_info;
 	}
 	tpci200->info->cfg_regs = ioremap_nocache(
 			pci_resource_start(pdev, TPCI200_CFG_MEM_BAR),
@@ -543,7 +540,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
 	if (!tpci200->info->cfg_regs) {
 		dev_err(&pdev->dev, "Failed to map PCI Configuration Memory");
 		ret = -EFAULT;
-		goto out_err_ioremap;
+		goto err_request_region;
 	}
 
 	/* Disable byte swapping for 16 bit IP module access. This will ensure
@@ -566,7 +563,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
 	if (ret) {
 		dev_err(&pdev->dev, "error during tpci200 install\n");
 		ret = -ENODEV;
-		goto out_err_install;
+		goto err_cfg_regs;
 	}
 
 	/* Register the carrier in the industry pack bus driver */
@@ -578,7 +575,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
 		dev_err(&pdev->dev,
 			"error registering the carrier on ipack driver\n");
 		ret = -EFAULT;
-		goto out_err_bus_register;
+		goto err_tpci200_install;
 	}
 
 	/* save the bus number given by ipack to logging purpose */
@@ -589,19 +586,16 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
 		tpci200_create_device(tpci200, i);
 	return 0;
 
-out_err_bus_register:
+err_tpci200_install:
 	tpci200_uninstall(tpci200);
-	/* tpci200->info->cfg_regs is unmapped in tpci200_uninstall */
-	tpci200->info->cfg_regs = NULL;
-out_err_install:
-	if (tpci200->info->cfg_regs)
-		iounmap(tpci200->info->cfg_regs);
-out_err_ioremap:
+err_cfg_regs:
+	pci_iounmap(tpci200->info->pdev, tpci200->info->cfg_regs);
+err_request_region:
 	pci_release_region(pdev, TPCI200_CFG_MEM_BAR);
-out_err_pci_request:
-	pci_dev_put(pdev);
+err_tpci200_info:
 	kfree(tpci200->info);
-out_err_info:
+	pci_dev_put(pdev);
+err_tpci200:
 	kfree(tpci200);
 	return ret;
 }
@@ -611,6 +605,12 @@ static void __tpci200_pci_remove(struct tpci200_board *tpci200)
 	ipack_bus_unregister(tpci200->info->ipack_bus);
 	tpci200_uninstall(tpci200);
 
+	pci_iounmap(tpci200->info->pdev, tpci200->info->cfg_regs);
+
+	pci_release_region(tpci200->info->pdev, TPCI200_CFG_MEM_BAR);
+
+	pci_dev_put(tpci200->info->pdev);
+
 	kfree(tpci200->info);
 	kfree(tpci200);
 }

From d95bdf952963e6228e998ef13880583f0cec7e70 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Thu, 19 Aug 2021 17:29:45 +0200
Subject: [PATCH 2644/2658] ASoC: intel: atom: Fix breakage for PCM buffer
 address setup

[ Upstream commit 65ca89c2b12cca0d473f3dd54267568ad3af55cc ]

The commit 2e6b836312a4 ("ASoC: intel: atom: Fix reference to PCM
buffer address") changed the reference of PCM buffer address to
substream->runtime->dma_addr as the buffer address may change
dynamically.  However, I forgot that the dma_addr field is still not
set up for the CONTINUOUS buffer type (that this driver uses) yet in
5.14 and earlier kernels, and it resulted in garbage I/O.  The problem
will be fixed in 5.15, but we need to address it quickly for now.

The fix is to deduce the address again from the DMA pointer with
virt_to_phys(), but from the right one, substream->runtime->dma_area.

Fixes: 2e6b836312a4 ("ASoC: intel: atom: Fix reference to PCM buffer address")
Reported-and-tested-by: Hans de Goede <hdegoede@redhat.com>
Cc: <stable@vger.kernel.org>
Acked-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/2048c6aa-2187-46bd-6772-36a4fb3c5aeb@redhat.com
Link: https://lore.kernel.org/r/20210819152945.8510-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/intel/atom/sst-mfld-platform-pcm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
index 64079423b298..d0d338533eb6 100644
--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
@@ -134,7 +134,7 @@ static void sst_fill_alloc_params(struct snd_pcm_substream *substream,
 	snd_pcm_uframes_t period_size;
 	ssize_t periodbytes;
 	ssize_t buffer_bytes = snd_pcm_lib_buffer_bytes(substream);
-	u32 buffer_addr = substream->runtime->dma_addr;
+	u32 buffer_addr = virt_to_phys(substream->runtime->dma_area);
 
 	channels = substream->runtime->channels;
 	period_size = substream->runtime->period_size;

From 69028693a8ea9ecbff6273f85693953294d86e98 Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Mon, 8 Jul 2019 12:56:13 -0700
Subject: [PATCH 2645/2658] mmc: dw_mmc: Fix occasional hang after tuning on
 eMMC

[ Upstream commit ba2d139b02ba684c6c101de42fed782d6cd2b997 ]

In commit 46d179525a1f ("mmc: dw_mmc: Wait for data transfer after
response errors.") we fixed a tuning-induced hang that I saw when
stress testing tuning on certain SD cards.  I won't re-hash that whole
commit, but the summary is that as a normal part of tuning you need to
deal with transfer errors and there were cases where these transfer
errors was putting my system into a bad state causing all future
transfers to fail.  That commit fixed handling of the transfer errors
for me.

In downstream Chrome OS my fix landed and had the same behavior for
all SD/MMC commands.  However, it looks like when the commit landed
upstream we limited it to only SD tuning commands.  Presumably this
was to try to get around problems that Alim Akhtar reported on exynos
[1].

Unfortunately while stress testing reboots (and suspend/resume) on
some rk3288-based Chromebooks I found the same problem on the eMMC on
some of my Chromebooks (the ones with Hynix eMMC).  Since the eMMC
tuning command is different (MMC_SEND_TUNING_BLOCK_HS200
vs. MMC_SEND_TUNING_BLOCK) we were basically getting back into the
same situation.

I'm hoping that whatever problems exynos was having in the past are
somehow magically fixed now and we can make the behavior the same for
all commands.

[1] https://lkml.kernel.org/r/CAGOxZ53WfNbaMe0_AM0qBqU47kAfgmPBVZC8K8Y-_J3mDMqW4A@mail.gmail.com

Fixes: 46d179525a1f ("mmc: dw_mmc: Wait for data transfer after response errors.")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: Alim Akhtar <alim.akhtar@gmail.com>
Cc: Enric Balletbo i Serra <enric.balletbo@collabora.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/dw_mmc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 7bfe9ce03944..9eff3b41a086 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -1762,8 +1762,7 @@ static void dw_mci_tasklet_func(unsigned long priv)
 				 * delayed. Allowing the transfer to take place
 				 * avoids races and keeps things simple.
 				 */
-				if ((err != -ETIMEDOUT) &&
-				    (cmd->opcode == MMC_SEND_TUNING_BLOCK)) {
+				if (err != -ETIMEDOUT) {
 					state = STATE_SENDING_DATA;
 					continue;
 				}

From cebd7883b3d1641ea3ec307adae9f87674a77368 Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Thu, 26 Aug 2021 09:19:05 -0400
Subject: [PATCH 2646/2658] Linux 4.4.282

Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index bc6d27a1c8d9..42835519d5bc 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 281
+SUBLEVEL = 282
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From f869545c9cc2f55e6ad3d31a807a85a9b7b81ec2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Stefan=20M=C3=A4tje?= <stefan.maetje@esd.eu>
Date: Wed, 25 Aug 2021 23:52:27 +0200
Subject: [PATCH 2647/2658] can: usb: esd_usb2: esd_usb2_rx_event(): fix the
 interchange of the CAN RX and TX error counters
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 044012b52029204900af9e4230263418427f4ba4 upstream.

This patch fixes the interchanged fetch of the CAN RX and TX error
counters from the ESD_EV_CAN_ERROR_EXT message. The RX error counter
is really in struct rx_msg::data[2] and the TX error counter is in
struct rx_msg::data[3].

Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device")
Link: https://lore.kernel.org/r/20210825215227.4947-2-stefan.maetje@esd.eu
Cc: stable@vger.kernel.org
Signed-off-by: Stefan Mätje <stefan.maetje@esd.eu>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/usb/esd_usb2.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index a8ebdcbc8935..c1b1062bbc37 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -236,8 +236,8 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv,
 	if (id == ESD_EV_CAN_ERROR_EXT) {
 		u8 state = msg->msg.rx.data[0];
 		u8 ecc = msg->msg.rx.data[1];
-		u8 txerr = msg->msg.rx.data[2];
-		u8 rxerr = msg->msg.rx.data[3];
+		u8 rxerr = msg->msg.rx.data[2];
+		u8 txerr = msg->msg.rx.data[3];
 
 		skb = alloc_can_err_skb(priv->netdev, &cf);
 		if (skb == NULL) {

From 84eaa27471cb2675e11965330f9aceb287396d0f Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Tue, 24 Aug 2021 14:19:26 +0200
Subject: [PATCH 2648/2658] Revert "USB: serial: ch341: fix character loss at
 high transfer rates"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit df7b16d1c00ecb3da3a30c999cdb39f273c99a2f upstream.

This reverts commit 3c18e9baee0ef97510dcda78c82285f52626764b.

These devices do not appear to send a zero-length packet when the
transfer size is a multiple of the bulk-endpoint max-packet size. This
means that incoming data may not be processed by the driver until a
short packet is received or the receive buffer is full.

Revert back to using endpoint-sized receive buffers to avoid stalled
reads.

Reported-by: Paul Größel <pb.g@gmx.de>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=214131
Fixes: 3c18e9baee0e ("USB: serial: ch341: fix character loss at high transfer rates")
Cc: stable@vger.kernel.org
Cc: Willy Tarreau <w@1wt.eu>
Link: https://lore.kernel.org/r/20210824121926.19311-1-johan@kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/ch341.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index 3f3535d3c99e..2cff9c40f28a 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -585,7 +585,6 @@ static struct usb_serial_driver ch341_device = {
 		.owner	= THIS_MODULE,
 		.name	= "ch341-uart",
 	},
-	.bulk_in_size      = 512,
 	.id_table          = id_table,
 	.num_ports         = 1,
 	.open              = ch341_open,

From 9a8eeaa0d9e9feec4747fb22e229845d3346f95d Mon Sep 17 00:00:00 2001
From: Zhengjun Zhang <zhangzhengjun@aicrobo.com>
Date: Mon, 9 Aug 2021 21:35:53 +0800
Subject: [PATCH 2649/2658] USB: serial: option: add new VID/PID to support
 Fibocom FG150

commit 2829a4e3cf3a6ac2fa3cdb681b37574630fb9c1a upstream.

Fibocom FG150 is a 5G module based on Qualcomm SDX55 platform,
support Sub-6G band.

Here are the outputs of lsusb -v and usb-devices:

> T:  Bus=02 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#=  2 Spd=5000 MxCh= 0
> D:  Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs=  1
> P:  Vendor=2cb7 ProdID=010b Rev=04.14
> S:  Manufacturer=Fibocom
> S:  Product=Fibocom Modem_SN:XXXXXXXX
> S:  SerialNumber=XXXXXXXX
> C:  #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=896mA
> I:  If#=0x0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host
> I:  If#=0x1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
> I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
> I:  If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none)
> I:  If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)

> Bus 002 Device 002: ID 2cb7:010b Fibocom Fibocom Modem_SN:XXXXXXXX
> Device Descriptor:
>   bLength                18
>   bDescriptorType         1
>   bcdUSB               3.20
>   bDeviceClass            0
>   bDeviceSubClass         0
>   bDeviceProtocol         0
>   bMaxPacketSize0         9
>   idVendor           0x2cb7 Fibocom
>   idProduct          0x010b
>   bcdDevice            4.14
>   iManufacturer           1 Fibocom
>   iProduct                2 Fibocom Modem_SN:XXXXXXXX
>   iSerial                 3 XXXXXXXX
>   bNumConfigurations      1
>   Configuration Descriptor:
>     bLength                 9
>     bDescriptorType         2
>     wTotalLength       0x00e6
>     bNumInterfaces          5
>     bConfigurationValue     1
>     iConfiguration          4 RNDIS_DUN_DIAG_ADB
>     bmAttributes         0xa0
>       (Bus Powered)
>       Remote Wakeup
>     MaxPower              896mA
>     Interface Association:
>       bLength                 8
>       bDescriptorType        11
>       bFirstInterface         0
>       bInterfaceCount         2
>       bFunctionClass        239 Miscellaneous Device
>       bFunctionSubClass       4
>       bFunctionProtocol       1
>       iFunction               7 RNDIS
>     Interface Descriptor:
>       bLength                 9
>       bDescriptorType         4
>       bInterfaceNumber        0
>       bAlternateSetting       0
>       bNumEndpoints           1
>       bInterfaceClass       239 Miscellaneous Device
>       bInterfaceSubClass      4
>       bInterfaceProtocol      1
>       iInterface              0
>       ** UNRECOGNIZED:  05 24 00 10 01
>       ** UNRECOGNIZED:  05 24 01 00 01
>       ** UNRECOGNIZED:  04 24 02 00
>       ** UNRECOGNIZED:  05 24 06 00 01
>       Endpoint Descriptor:
>         bLength                 7
>         bDescriptorType         5
>         bEndpointAddress     0x81  EP 1 IN
>         bmAttributes            3
>           Transfer Type            Interrupt
>           Synch Type               None
>           Usage Type               Data
>         wMaxPacketSize     0x0008  1x 8 bytes
>         bInterval               9
>         bMaxBurst               0
>     Interface Descriptor:
>       bLength                 9
>       bDescriptorType         4
>       bInterfaceNumber        1
>       bAlternateSetting       0
>       bNumEndpoints           2
>       bInterfaceClass        10 CDC Data
>       bInterfaceSubClass      0
>       bInterfaceProtocol      0
>       iInterface              0
>       Endpoint Descriptor:
>         bLength                 7
>         bDescriptorType         5
>         bEndpointAddress     0x8e  EP 14 IN
>         bmAttributes            2
>           Transfer Type            Bulk
>           Synch Type               None
>           Usage Type               Data
>         wMaxPacketSize     0x0400  1x 1024 bytes
>         bInterval               0
>         bMaxBurst               6
>       Endpoint Descriptor:
>         bLength                 7
>         bDescriptorType         5
>         bEndpointAddress     0x0f  EP 15 OUT
>         bmAttributes            2
>           Transfer Type            Bulk
>           Synch Type               None
>           Usage Type               Data
>         wMaxPacketSize     0x0400  1x 1024 bytes
>         bInterval               0
>         bMaxBurst               6
>     Interface Descriptor:
>       bLength                 9
>       bDescriptorType         4
>       bInterfaceNumber        2
>       bAlternateSetting       0
>       bNumEndpoints           3
>       bInterfaceClass       255 Vendor Specific Class
>       bInterfaceSubClass      0
>       bInterfaceProtocol      0
>       iInterface              0
>       ** UNRECOGNIZED:  05 24 00 10 01
>       ** UNRECOGNIZED:  05 24 01 00 00
>       ** UNRECOGNIZED:  04 24 02 02
>       ** UNRECOGNIZED:  05 24 06 00 00
>       Endpoint Descriptor:
>         bLength                 7
>         bDescriptorType         5
>         bEndpointAddress     0x83  EP 3 IN
>         bmAttributes            3
>           Transfer Type            Interrupt
>           Synch Type               None
>           Usage Type               Data
>         wMaxPacketSize     0x000a  1x 10 bytes
>         bInterval               9
>         bMaxBurst               0
>       Endpoint Descriptor:
>         bLength                 7
>         bDescriptorType         5
>         bEndpointAddress     0x82  EP 2 IN
>         bmAttributes            2
>           Transfer Type            Bulk
>           Synch Type               None
>           Usage Type               Data
>         wMaxPacketSize     0x0400  1x 1024 bytes
>         bInterval               0
>         bMaxBurst               0
>       Endpoint Descriptor:
>         bLength                 7
>         bDescriptorType         5
>         bEndpointAddress     0x01  EP 1 OUT
>         bmAttributes            2
>           Transfer Type            Bulk
>           Synch Type               None
>           Usage Type               Data
>         wMaxPacketSize     0x0400  1x 1024 bytes
>         bInterval               0
>         bMaxBurst               0
>     Interface Descriptor:
>       bLength                 9
>       bDescriptorType         4
>       bInterfaceNumber        3
>       bAlternateSetting       0
>       bNumEndpoints           2
>       bInterfaceClass       255 Vendor Specific Class
>       bInterfaceSubClass    255 Vendor Specific Subclass
>       bInterfaceProtocol     48
>       iInterface              0
>       Endpoint Descriptor:
>         bLength                 7
>         bDescriptorType         5
>         bEndpointAddress     0x84  EP 4 IN
>         bmAttributes            2
>           Transfer Type            Bulk
>           Synch Type               None
>           Usage Type               Data
>         wMaxPacketSize     0x0400  1x 1024 bytes
>         bInterval               0
>         bMaxBurst               0
>       Endpoint Descriptor:
>         bLength                 7
>         bDescriptorType         5
>         bEndpointAddress     0x02  EP 2 OUT
>         bmAttributes            2
>           Transfer Type            Bulk
>           Synch Type               None
>           Usage Type               Data
>         wMaxPacketSize     0x0400  1x 1024 bytes
>         bInterval               0
>         bMaxBurst               0
>     Interface Descriptor:
>       bLength                 9
>       bDescriptorType         4
>       bInterfaceNumber        4
>       bAlternateSetting       0
>       bNumEndpoints           2
>       bInterfaceClass       255 Vendor Specific Class
>       bInterfaceSubClass     66
>       bInterfaceProtocol      1
>       iInterface              0
>       Endpoint Descriptor:
>         bLength                 7
>         bDescriptorType         5
>         bEndpointAddress     0x03  EP 3 OUT
>         bmAttributes            2
>           Transfer Type            Bulk
>           Synch Type               None
>           Usage Type               Data
>         wMaxPacketSize     0x0400  1x 1024 bytes
>         bInterval               0
>         bMaxBurst               0
>       Endpoint Descriptor:
>         bLength                 7
>         bDescriptorType         5
>         bEndpointAddress     0x85  EP 5 IN
>         bmAttributes            2
>           Transfer Type            Bulk
>           Synch Type               None
>           Usage Type               Data
>         wMaxPacketSize     0x0400  1x 1024 bytes
>         bInterval               0
>         bMaxBurst               0
> Binary Object Store Descriptor:
>   bLength                 5
>   bDescriptorType        15
>   wTotalLength       0x0016
>   bNumDeviceCaps          2
>   USB 2.0 Extension Device Capability:
>     bLength                 7
>     bDescriptorType        16
>     bDevCapabilityType      2
>     bmAttributes   0x00000006
>       BESL Link Power Management (LPM) Supported
>   SuperSpeed USB Device Capability:
>     bLength                10
>     bDescriptorType        16
>     bDevCapabilityType      3
>     bmAttributes         0x00
>     wSpeedsSupported   0x000f
>       Device can operate at Low Speed (1Mbps)
>       Device can operate at Full Speed (12Mbps)
>       Device can operate at High Speed (480Mbps)
>       Device can operate at SuperSpeed (5Gbps)
>     bFunctionalitySupport   1
>       Lowest fully-functional device speed is Full Speed (12Mbps)
>     bU1DevExitLat           1 micro seconds
>     bU2DevExitLat         500 micro seconds
> Device Status:     0x0000
>   (Bus Powered)

Signed-off-by: Zhengjun Zhang <zhangzhengjun@aicrobo.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index b3336a7c09e0..02ded56bcbc6 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2058,6 +2058,8 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = RSVD(4) | RSVD(5) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff),			/* Fibocom NL678 series */
 	  .driver_info = RSVD(6) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) },	/* Fibocom FG150 Diag */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) },		/* Fibocom FG150 AT */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) },			/* Fibocom NL668-AM/NL652-EU (laptop MBIM) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) },			/* LongSung M5710 */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) },			/* GosunCn GM500 RNDIS */

From 27e52dbf7df5d221eb851e53dade6d3b11c85eaf Mon Sep 17 00:00:00 2001
From: Sasha Neftin <sasha.neftin@intel.com>
Date: Sun, 4 Jul 2021 10:11:41 +0300
Subject: [PATCH 2650/2658] e1000e: Fix the max snoop/no-snoop latency for 10M

[ Upstream commit 44a13a5d99c71bf9e1676d9e51679daf4d7b3d73 ]

We should decode the latency and the max_latency before directly compare.
The latency should be presented as lat_enc = scale x value:
lat_enc_d = (lat_enc & 0x0x3ff) x (1U << (5*((max_ltr_enc & 0x1c00)
>> 10)))

Fixes: cf8fb73c23aa ("e1000e: add support for LTR on I217/I218")
Suggested-by: Yee Li <seven.yi.lee@gmail.com>
Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
Tested-by: Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/e1000e/ich8lan.c | 14 +++++++++++++-
 drivers/net/ethernet/intel/e1000e/ich8lan.h |  3 +++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 485b9cc53f8b..cd7403d09c3d 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -1010,6 +1010,8 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link)
 {
 	u32 reg = link << (E1000_LTRV_REQ_SHIFT + E1000_LTRV_NOSNOOP_SHIFT) |
 	    link << E1000_LTRV_REQ_SHIFT | E1000_LTRV_SEND;
+	u16 max_ltr_enc_d = 0;	/* maximum LTR decoded by platform */
+	u16 lat_enc_d = 0;	/* latency decoded */
 	u16 lat_enc = 0;	/* latency encoded */
 
 	if (link) {
@@ -1063,7 +1065,17 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link)
 				     E1000_PCI_LTR_CAP_LPT + 2, &max_nosnoop);
 		max_ltr_enc = max_t(u16, max_snoop, max_nosnoop);
 
-		if (lat_enc > max_ltr_enc)
+		lat_enc_d = (lat_enc & E1000_LTRV_VALUE_MASK) *
+			     (1U << (E1000_LTRV_SCALE_FACTOR *
+			     ((lat_enc & E1000_LTRV_SCALE_MASK)
+			     >> E1000_LTRV_SCALE_SHIFT)));
+
+		max_ltr_enc_d = (max_ltr_enc & E1000_LTRV_VALUE_MASK) *
+				 (1U << (E1000_LTRV_SCALE_FACTOR *
+				 ((max_ltr_enc & E1000_LTRV_SCALE_MASK)
+				 >> E1000_LTRV_SCALE_SHIFT)));
+
+		if (lat_enc_d > max_ltr_enc_d)
 			lat_enc = max_ltr_enc;
 	}
 
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
index 34c551e322eb..3a16c457c8dd 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
@@ -284,8 +284,11 @@
 
 /* Latency Tolerance Reporting */
 #define E1000_LTRV			0x000F8
+#define E1000_LTRV_VALUE_MASK		0x000003FF
 #define E1000_LTRV_SCALE_MAX		5
 #define E1000_LTRV_SCALE_FACTOR		5
+#define E1000_LTRV_SCALE_SHIFT		10
+#define E1000_LTRV_SCALE_MASK		0x00001C00
 #define E1000_LTRV_REQ_SHIFT		15
 #define E1000_LTRV_NOSNOOP_SHIFT	16
 #define E1000_LTRV_SEND			(1 << 30)

From da05a595958f6759e4d53cd8977cf6b34d2b6fe9 Mon Sep 17 00:00:00 2001
From: Maxim Kiselev <bigunclemax@gmail.com>
Date: Fri, 20 Aug 2021 18:39:51 +0300
Subject: [PATCH 2651/2658] net: marvell: fix MVNETA_TX_IN_PRGRS bit number

[ Upstream commit 359f4cdd7d78fdf8c098713b05fee950a730f131 ]

According to Armada XP datasheet bit at 0 position is corresponding for
TxInProg indication.

Fixes: c5aff18204da ("net: mvneta: driver for Marvell Armada 370/XP network unit")
Signed-off-by: Maxim Kiselev <bigunclemax@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/mvneta.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 575da945f151..d6b25aba4004 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -90,7 +90,7 @@
 #define      MVNETA_DESC_SWAP                    BIT(6)
 #define      MVNETA_TX_BRST_SZ_MASK(burst)       ((burst) << 22)
 #define MVNETA_PORT_STATUS                       0x2444
-#define      MVNETA_TX_IN_PRGRS                  BIT(1)
+#define      MVNETA_TX_IN_PRGRS                  BIT(0)
 #define      MVNETA_TX_FIFO_EMPTY                BIT(8)
 #define MVNETA_RX_MIN_FRAME_SIZE                 0x247c
 #define MVNETA_SERDES_CFG			 0x24A0

From 711a7c4422a243893c07782f37cd7937d5fdb17e Mon Sep 17 00:00:00 2001
From: Parav Pandit <parav@nvidia.com>
Date: Wed, 21 Jul 2021 17:26:45 +0300
Subject: [PATCH 2652/2658] virtio: Improve vq->broken access to avoid any
 compiler optimization

[ Upstream commit 60f0779862e4ab943810187752c462e85f5fa371 ]

Currently vq->broken field is read by virtqueue_is_broken() in busy
loop in one context by virtnet_send_command().

vq->broken is set to true in other process context by
virtio_break_device(). Reader and writer are accessing it without any
synchronization. This may lead to a compiler optimization which may
result to optimize reading vq->broken only once.

Hence, force reading vq->broken on each invocation of
virtqueue_is_broken() and also force writing it so that such
update is visible to the readers.

It is a theoretical fix that isn't yet encountered in the field.

Signed-off-by: Parav Pandit <parav@nvidia.com>
Link: https://lore.kernel.org/r/20210721142648.1525924-2-parav@nvidia.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/virtio/virtio_ring.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 6b3565feddb2..b15c24c4d91f 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -840,7 +840,7 @@ bool virtqueue_is_broken(struct virtqueue *_vq)
 {
 	struct vring_virtqueue *vq = to_vvq(_vq);
 
-	return vq->broken;
+	return READ_ONCE(vq->broken);
 }
 EXPORT_SYMBOL_GPL(virtqueue_is_broken);
 
@@ -854,7 +854,9 @@ void virtio_break_device(struct virtio_device *dev)
 
 	list_for_each_entry(_vq, &dev->vqs, list) {
 		struct vring_virtqueue *vq = to_vvq(_vq);
-		vq->broken = true;
+
+		/* Pairs with READ_ONCE() in virtqueue_is_broken(). */
+		WRITE_ONCE(vq->broken, true);
 	}
 }
 EXPORT_SYMBOL_GPL(virtio_break_device);

From 98e8ea2e7ca4620a6014472ce7cbf3eeef6bfec5 Mon Sep 17 00:00:00 2001
From: Neeraj Upadhyay <neeraju@codeaurora.org>
Date: Fri, 25 Jun 2021 08:55:02 +0530
Subject: [PATCH 2653/2658] vringh: Use wiov->used to check for read/write desc
 order

[ Upstream commit e74cfa91f42c50f7f649b0eca46aa049754ccdbd ]

As __vringh_iov() traverses a descriptor chain, it populates
each descriptor entry into either read or write vring iov
and increments that iov's ->used member. So, as we iterate
over a descriptor chain, at any point, (riov/wriov)->used
value gives the number of descriptor enteries available,
which are to be read or written by the device. As all read
iovs must precede the write iovs, wiov->used should be zero
when we are traversing a read descriptor. Current code checks
for wiov->i, to figure out whether any previous entry in the
current descriptor chain was a write descriptor. However,
iov->i is only incremented, when these vring iovs are consumed,
at a later point, and remain 0 in __vringh_iov(). So, correct
the check for read and write descriptor order, to use
wiov->used.

Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>
Link: https://lore.kernel.org/r/1624591502-4827-1-git-send-email-neeraju@codeaurora.org
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vhost/vringh.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index d56736655dec..da47542496cc 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -329,7 +329,7 @@ __vringh_iov(struct vringh *vrh, u16 i,
 			iov = wiov;
 		else {
 			iov = riov;
-			if (unlikely(wiov && wiov->i)) {
+			if (unlikely(wiov && wiov->used)) {
 				vringh_bad("Readable desc %p after writable",
 					   &descs[i]);
 				err = -EINVAL;

From eb7b74a55d2f9ed68ab4c43eddda8d27bef9e110 Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Mon, 30 Aug 2021 08:55:18 -0700
Subject: [PATCH 2654/2658] vt_kdsetmode: extend console locking

commit 2287a51ba822384834dafc1c798453375d1107c7 upstream.

As per the long-suffering comment.

Reported-by: Minh Yuan <yuanmingbuaa@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jiri Slaby <jirislaby@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/vt/vt_ioctl.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
index e1a8f4121206..97475bb46f84 100644
--- a/drivers/tty/vt/vt_ioctl.c
+++ b/drivers/tty/vt/vt_ioctl.c
@@ -487,16 +487,19 @@ int vt_ioctl(struct tty_struct *tty,
 			ret = -EINVAL;
 			goto out;
 		}
-		/* FIXME: this needs the console lock extending */
-		if (vc->vc_mode == (unsigned char) arg)
+		console_lock();
+		if (vc->vc_mode == (unsigned char) arg) {
+			console_unlock();
 			break;
+		}
 		vc->vc_mode = (unsigned char) arg;
-		if (console != fg_console)
+		if (console != fg_console) {
+			console_unlock();
 			break;
+		}
 		/*
 		 * explicitly blank/unblank the screen if switching modes
 		 */
-		console_lock();
 		if (arg == KD_TEXT)
 			do_unblank_screen(1);
 		else

From 66ae58c28c2e1efb41d9800f74a68d412145e8da Mon Sep 17 00:00:00 2001
From: George Kennedy <george.kennedy@oracle.com>
Date: Tue, 7 Jul 2020 15:26:03 -0400
Subject: [PATCH 2655/2658] fbmem: add margin check to fb_check_caps()

commit a49145acfb975d921464b84fe00279f99827d816 upstream.

A fb_ioctl() FBIOPUT_VSCREENINFO call with invalid xres setting
or yres setting in struct fb_var_screeninfo will result in a
KASAN: vmalloc-out-of-bounds failure in bitfill_aligned() as
the margins are being cleared. The margins are cleared in
chunks and if the xres setting or yres setting is a value of
zero upto the chunk size, the failure will occur.

Add a margin check to validate xres and yres settings.

Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Reported-by: syzbot+e5fd3e65515b48c02a30@syzkaller.appspotmail.com
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Dhaval Giani <dhaval.giani@oracle.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1594149963-13801-1-git-send-email-george.kennedy@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/fbdev/core/fbmem.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index cce75a2af919..0a934b84e809 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -1001,6 +1001,10 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
 			goto done;
 		}
 
+		/* bitfill_aligned() assumes that it's at least 8x8 */
+		if (var->xres < 8 || var->yres < 8)
+			return -EINVAL;
+
 		ret = info->fbops->fb_check_var(var, info);
 
 		if (ret)

From f102751c71e23c979f9793df73d958e9e17e6900 Mon Sep 17 00:00:00 2001
From: Denis Efremov <efremov@linux.com>
Date: Sat, 7 Aug 2021 10:37:02 +0300
Subject: [PATCH 2656/2658] Revert "floppy: reintroduce O_NDELAY fix"

commit c7e9d0020361f4308a70cdfd6d5335e273eb8717 upstream.

The patch breaks userspace implementations (e.g. fdutils) and introduces
regressions in behaviour. Previously, it was possible to O_NDELAY open a
floppy device with no media inserted or with write protected media without
an error. Some userspace tools use this particular behavior for probing.

It's not the first time when we revert this patch. Previous revert is in
commit f2791e7eadf4 (Revert "floppy: refactor open() flags handling").

This reverts commit 8a0c014cd20516ade9654fc13b51345ec58e7be8.

Link: https://lore.kernel.org/linux-block/de10cb47-34d1-5a88-7751-225ca380f735@compro.net/
Reported-by: Mark Hounschell <markh@compro.net>
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: Wim Osterholt <wim@djo.tudelft.nl>
Cc: Kurt Garloff <kurt@garloff.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Denis Efremov <efremov@linux.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/block/floppy.c | 27 +++++++++++++--------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index ae6b798b76bb..40c251ef175d 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4066,22 +4066,21 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
 	if (UFDCS->rawcmd == 1)
 		UFDCS->rawcmd = 2;
 
-	if (mode & (FMODE_READ|FMODE_WRITE)) {
-		UDRS->last_checked = 0;
-		clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
-		check_disk_change(bdev);
-		if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
-			goto out;
-		if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
+	if (!(mode & FMODE_NDELAY)) {
+		if (mode & (FMODE_READ|FMODE_WRITE)) {
+			UDRS->last_checked = 0;
+			clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
+			check_disk_change(bdev);
+			if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
+				goto out;
+			if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
+				goto out;
+		}
+		res = -EROFS;
+		if ((mode & FMODE_WRITE) &&
+		    !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
 			goto out;
 	}
-
-	res = -EROFS;
-
-	if ((mode & FMODE_WRITE) &&
-			!test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
-		goto out;
-
 	mutex_unlock(&open_lock);
 	mutex_unlock(&floppy_mutex);
 	return 0;

From 30e6d9340103f69551e24e72154a77dcdaf184c7 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 3 Sep 2021 09:43:08 +0200
Subject: [PATCH 2657/2658] Linux 4.4.283

Link: https://lore.kernel.org/r/20210901122248.051808371@linuxfoundation.org
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 42835519d5bc..101bfd6604f0 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 282
+SUBLEVEL = 283
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

From 660da3fb4481c0760a344e708c33a59b88e63649 Mon Sep 17 00:00:00 2001
From: Nguyen Quang Duc <nguyenquangduc2000@gmail.com>
Date: Fri, 17 Sep 2021 15:36:51 +0700
Subject: [PATCH 2658/2658] Add file

---
 drivers/platform/msm/ipa/ipa_common | Bin 877632 -> 877680 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/drivers/platform/msm/ipa/ipa_common b/drivers/platform/msm/ipa/ipa_common
index 6a243aa0fdc5ba32fba7eee6c98d52914475e671..5ad71c30680509f159142a84a25d2fbb55a18623 100644
GIT binary patch
literal 877680
zcmeFa3w)Ht)j$3`yV++q0YV@l2?UZ&LNq}x2{!{?*d(AqL2f}&Yd2R&BsX&5Qmh2<
z5=AXkY^|*&1hoWvu@&B$R^?V(Z2Puqt+jn?4WNCow(o1bhPIa9_net$clMSi(S3ja
zx4%F8A-i*C&dfP;=FFKhXXbg>vS85_HeJ`ukFI@R^FwB?roHpa;Xc5_DUY_?w#4@F
z=EFT7+qGSLHSM7LHm$$Ut{?b#^U?iB?A}*^wiAE5@VEP<J>$UHbLUb5@aJn!4GDju
zwsA=KNm`*b{<A&rFVVRV@7c8jZE;#lxvrJD^p52=J!vh3QPyWqJOKVDQ9n9cCQNrZ
zw1QSc+jachIWBvDNm0+on~!myKi(YFo*~-n)FQOEKHZ`{Azv3{>C!!CPe9J}TdQja
zHGSSIs;n_?EbmOny!gV7<-~8SrX^8bo9^iayi>)Ya!t#8S<^a3o9&q66F|>lP0uzd
ziu6WU(<`1FMS8K;^tMfnBE3=8^p536k=__<dfhXkNN=n)J=^Rk(wksSud*<T^fImK
zothg(dO6ngiZ6>Iy*z7r-SeVIZ;Ca&tl}urE3l@wZGIH#%^C!~E2Btnjx{~oRZ*mO
znKixcMNy<zWKD0|k|@$!U`?-kSrq9lw5De(iz2<n*7Pc`jUv5e*7UZmiXy$0*7T0u
z5Jh^|Thpt&DT?%NvZmMVjUv4YYkI|%QKVO6O|QE;iuCHN>1C~nBE1G{dfV!vNN=4r
zy;EzWNUz<RUU6d->20#6*WDaNdY`wZm(?0YdRwjORklZw-tE@(x;I3T-d)!8PHl=J
zy?d?cW!(}*db_OYRo)s!dJkCB>+Xmmy{}l)vu%$ey@##oRo)&&dV8(u9lJA%^d7aQ
zXS+L!^m?r672gv@df&39x9z?t()+G8y<@wgNbis}y=}XrNUztLp6$y~r1#7q=sgrg
zdPlA4RX!X=de2$YJGCc@^q#k-XX}n4y??i+ckGeq&^tr%>lZy|J1KsxX`=^<VV`;|
zIy5<E{%h+#c0V3PdcU=%SNWYN(tAzHbbvE~$|nRpGuCf)E@0w?Jrg)Ni2gkp#s0lH
z2zrO2LyvXzEg{d_EOa#M`_ZAvI{KGE^zo@E()+75y;HqWr1ya}y~?MfNbjsQz3ykD
zNbh57dZ&&=k)B>;c@CI$Jc{%j*7Pc$iz2;PYkJ*3i6Xrb*7R&YjUv5K*7Q#OZ1D8@
z&h1$~pv@j*O|SSDgQsVCZamhS-mw>=NN<8Qz2aX*kzVE?=>0m1^m44}RlXWUdU@9L
zY`=>ly(!l8Dt{jxdc4LL6rJ4<KeX6tjsJt7Y0j-r<u}c;?&GP~qtnOz<ZI6<I$J95
zij2Ztkl;HYr%n!@mK%3i$Y(d@5Y{ie%({QwZw#KMrHv`Frg!R(QKYxPnqK!?QKYwU
z5cK{WMS6>^>1DkWMS9Du>79Bviu6_%iM{6l`=o8}3woxWf2#RjXWhSTA4IW#4c7FI
z^+%E3I%|5T{vI8AY|q*Uwr5!%51v+^xYIYVJ^QY8|BC-Pc$x#*Gw$E*1NX1;+~8>q
zs(+ui?q9dIHF|dmw_4LXrALw8P1f{m_9)V;u%?$46GeJ=S<@?aM3LUT*7PckDAL<y
zZLf=+g5IaK*JsFIsu4b+Wo$A^G*1xC2drg!$`wVK9<ruqi;E(?UTb>A!=givZRqtD
zHgx#lX<6A&7kq2iSA@>s-t}m!y@V}(@U#b7D_C##4nnRYqe$;zYkHLlQKa{%HNEap
zQKZ*nZELoT7W6)?t>N+emUaIs6QkI_X9huUOcd!IwWhZ%IXd*tkR5$ajGxsU>>e8(
znmmTjTlcX$EsFI1-J0I92~ni?qV=4p%n<aVGADj*-M_5N==5(t>CA6I55IH{X+wO(
z%HH#szh*6yZ4;v?lato;PUU<udM<iq2+s!5^IF029G1_UpFlouS&w1&r09$xkH=rE
z>Di`4haSu1ub)6BA6WCaEk8OuvP>MsmS;ni(+5uv^TPLBU$CAqy;y5{+hz`)o~7?I
z!kS*??7`Es?B6JBdbT-(r)Sx}G1m0DFNq?(vBhUQr5!ZwxTQ>VYaWZ|eKH<hG1{_>
z0&N}UTN$2V+?l6qyWGF6?N^^G4QI1h7bjTrRk`ew@fBA0Ga)+}V>e|N9B1!dA?TUq
zE{kU}O}w!5at1+fWfbY<S<5qPRTSkp#hTu>8=^?Bz?xq7XQD`NmNh+_H;VM;SkvpS
zh$6kqtmze34W6E*9V)V>cdGi+(WCi{KYo^7JTt8&g`JxVta+)d9Xv0V>%>B9Tab0L
zpl8~YPi1=+TleqO+9>vKnKixchA7foX-#ii)8Od^>h3c=9}LsZzQ4rA?;98co!W2n
zoTc{;oS`@pU>&}AZZ6ioQQEqFF<M#faHL0Q>v9dPY%g%JN7;$}?JjyJ0rYV<Vov;g
zKYaMJdg{*QdTCdS?Mvc}pv$J6b;oE2%jXuI#lbH>`@h?!?LwVh**MERWl!QZ$~A4)
zR-31{=pW~1se0Z8dPL(e+F4=i7>zcP!tnt9CuJnL3OewvgjQXfskY%nomRbLv;)6t
zej?sEfIdume@QW9;yL^A=Hv4H31QxMaMs#)K6TCD$Ha0@eQZt7w)B(HJ7?El{CKn8
z^Fbo%fxYMB5^WcaJH69^^x=$CJ4-sznWi0lA9~>-zXD@W?hwD77^jQ{+PdfMT3HP6
zaX)cax|FRB7`QyXr{aVTP+h#kg4>{S(w|J=kPe+zaX^o7BjFsx_`d);rY|;eQ*D1R
zZpkn|O}8zO-@D+)nf&5+Q0;6tJiS|nV;-Qd;4R?Y6{l2MvVXS$KbWV}3SM8L;AtQ{
z>gSihAB}-lB<ww<w?ghTPfy`pCp1=lb{Ef`KD##aB=Y*?T<S8knHV>ES4aTA$42;N
z6KOn-D>&t@@Z(|PToP`~hg;J)Jp`O2$Rbn9;-nq&K)*>xsDI_?cW@so<E`me4FRW*
zXo4Qe|0LNvIUbbfj-b=oBRiJAVNW9Y@20<U*gyIW)(aJHTo_pvt8*g)t&&0F<m0_J
zq*pX|&Nw}1^B~80y6f$em=n+&*uWCl1G0fdJ+KeE<Q`{t#(ZrZ%^UE~^P2KqNaM_5
zmv((Q?}bcz^5JzhyvHWco+L9p?d%E2&oxFn_<_*N-I|=6hp!OrtMk%qKj!-OkojFT
zS{dI@*#_}sjwhwfxpmS$W|BI;!s(eUQQ;%P*w_`EBN24K#G$dd3_4)yTL*MI>>O6w
zj5vo?9BH$Ib?-QE+@MEvGw@6Or+%yR%N=HZZA-H5_x2&+2)cuuS7QR_RmAzH;05b@
zCj1#w-#@&r81GC9(Dwj)d1{n(Ur!GKhh+VG%tNvTrr&-F_do0mi}zK1y!q*#kKmvA
z<`V2WD(pN%^Jh4%$F@oD+4V{0JnEBkzy%zdOEfRvQr5XG$U6bpaeZsQfpMleMR|AO
zy;1Ooc0P(VI9NBfr}+B~9bnr<Z6p5STR*9dQhG-f+8~<LKGN(55^U0m9R!^-$~>g>
zhgjpb+qBW<JUj&-&0OoKoP52L_T)j?;_a!VGl@Q197$(XJmC|T^pJjh#D3wAeD4w?
zSz-Kyf0OK&Q>3|gdI&gALO)I_?<dQGe|*cib6+<1Op$cvT#4}KK7v2@;dOS{;FtiP
zj`asV9m%dUi)^saA!%QBn`69Z$Yb2bx-{SzXZU6Ge}hgqUE0UGl*BeYSeIxXsk(Id
z7ka_gky;tGLw*+4e4kCEdHX-vhmy?yJF+tAoPlq%^@pIjSNNEHSjQj_)2HNlPdf2@
z(7ZnrH19`X-jh9eK2|G(E!$az`EgBvEf9KA_s_^S$DZA>{EzlAOq=BFk#^^QLMK&P
zAINv=MY0Q3;Oh-q7r_&ce}uJO#S2+;;%Lno10QQXY)VPbN2Z@uBK$0uw4rv`P|yfi
zgNn2KI$`=uBx~}?!uw3EAwE+{6x%rD>=;dQ==$*7p{K=K7QpYRbcNptvN}BkoI|jQ
z-wawa$u1uMr?p-D->{ZuU*wmEX*&)N+0KeJdmuY&(g|n(qP3Q0PafP_s^SfHE!{TB
zFQ-Ur>GmPuSgobzp2aE#QX0!KkVzT2+PZG|j^=)0zwkqNFMbmHCw0F-`|sd+d~Bw5
z|Bep<Cke5uurZez)^tuQIGzam0~3dQ)-2faKDiGjpMm<W?uEndT@@OU#<OIQIDf$W
zCq9Dhs@2|gpfRSs9>uv_<(^(w9^#vs+PY&HUo#%6j&nt&rx*PWiMy1C8|Ol6`5#ws
zBJB%JoN!}&?BYStP;ksRSg@aeT;f2kJiZmHJ-wCPMRUl$i!nxQwn+L0GS(YB21l_D
zMT#8^B>z~%m*+v|GzQxoez~(xDrpWh$K1})IaVp(KS}&Y(z&W3;Lsck*7YkPtKhj^
zd8zeyR4F*H5A0h7kB5mvx;{mY3B}0iy}z_iq<&@mTrVgmnPVRIIkZ_W+K(WXqsJib
zUWB;2jBRxwc1Ql*FqFTwdGq(;+#ECPU5mXL>2gMwJ_lpa6E|7!aosXJPwT)wFs2Lf
z_>2Rm@kg|%ZQ9FqzGUyAG|mMOf9qJjJ;xune;<5(Kf?UntL(MI#Fhg5hT_XRmY-H)
zX6^{SLkaNI*jnGa=fcWT#k&vuwITk0uk<4Z(n~e|9WC46E#KowGL58{`-XrM$@U*B
zvDU-m3Qi>3Z{mDX+n=S-h}7TgLE?N`+wY5`ltBMkpDBKzAE5a|wui?=#!zUl5!tV9
z3-PPBmn!o9lx^&pq^&!J`9ks16IfqOyGv=>lZn0PApDGl3QrN{(D5PQ&>5LKjLkcx
z_B{ff(?h@^e~s3<KG>`*wt3=gkzze01H^)SYY~lEB>P~$dT>6fiWj`5orHZ={nnru
z;cnA@{7>rE>BY)8enQ<c+lZEKWy$y14rIr&hk!%6MX_hJ7q}K&qx3z3Zj}rHhjeR#
z)GhW~p+7^_tCFRI(<>D(ntG+4qm(9T2g!y}?25-i>IdyBBipagvy|g26ghv&HlCFA
z&3Rdkv&vxq#$M*9HyFHNJ4k+uu!Di;GhJbP!D9+7ErJdm9|8{Ps<1<TpLifUv>op%
z9#q^}!3)-xB3EQP)CW7M>azRq=Vk`aqwbaDQ(4Ep_W@7k^+<nspGw7hM)*>J^H$ZT
z2r@4j0uIgFA4;E1{XZ>Savkr)c?g|_&|1!8A$8D<kD2Eih?DuwCFq<YST9dsPyP3w
z*P8pKPt#8AB(bL~My%8$)-(9<Nt57PGq3N--!8j$Xkr)}m?hr@&GS2gEVGAzL$Vx5
zU#o5m)B$sT2Fpst6KkaZ{~Za|zhcOh`5(aVEg1q1_2D%1;p5HEAdafzoI~7UGWFqo
z=mPD7-oyC@*+$+E86C^%?C3+go#kE*9ictZ37iR-`y$#CjaeF#mzb;d`u0RmXmiYV
zVRH`9zDIY!FQdNT8N0ACkETKNcL+G;*t5{xqz|tn8H>9~rtc9hZe_+ah{p~&7iupM
zcXfi-1+q1CpPBB^)MR;jS5NZvuKAv4PVji|yGit^7C0HP+B)nR%4*}aS=?@(wyqK}
z|FAI=&^7I~8XM~v7P@b@d9CGUS8)0elcPQc^J?PI9(^c0g^S~4Rao<st>8c|VR<rf
zD24`}1MFqiX9qz;!ReA?8r<(}i9_cwv@TR&EJ;3e-_3+8F}9SqpM7cn8iqN1fbxUa
zo}&ZAb!h&ncL>dSGSK`Z8e~`FAcHfAN5mo?ag{RfTobjP*j&USP)_<X*g0owv6i8I
z2sq_(&V8WV2OR92qyAApd9L7o++C0%)}EcW;XDk#1Ku~Y%Xh1nW1hL_?j>Slm6&VP
zURYfQUby+y7bYfId9$^Qs)m3QtV0vS=ys*-5Am->Sih<iobm{|ZQ{UY3tfg?q5UDX
z8_dTi)#d+<YsslL>oGe$1RPVZ1J;t`bZ@}k^HDb48*pGfHF`ciuEt5U1N*mU(3vF9
zUHbhbx?NQ*`a*SM5o@QoZ?{vd8;5Wgc>m{W`)Pl(u%_cBJOH_Cp?2imzHDvRhZpKS
zW{k$X17pTT&cKdU$T`qmqP?iDF@0h71E*>RA<rS;5Ph8c_+k>Jt2<sQ1>YZL>piB7
z-a<Ub#r90wl@n%;9FuY(xkj2J#}yp&{4m)5n>h4ttuDK_zvAxsdDXD@6g#H2gL$QO
zfn-iHHs!0%o&DRr{p$U|_m^A&A7laagzg8H^qf2HzaJRvmvb!IyaO)pzF^_o*@64p
zN5mSrll<}`_*39**Q59=(z{w{PE*|Z4H<jxgnTuJcDCH99W?L$bi`>hY2S`|0qbbx
zM(eSy8Ul`>EquM1VaDy$dTV;8hk!$O)2D}_WBz{zG=`D%W8VgAUQ8UK(?N1Ydzf!Y
z)KA>;XI~*w`=<vXHxq~UG{Jj<bKAw;q_eo2)bF)Jk78hF90B)}eq-xcPI`FGuAS}R
z^HzOQQEdOksWf-s&rtl+ocHA8o&}u`@ke@m);4z7D~2}eb;M7P(7hDkix@$&|K85I
zbF=!8zxUXj9ouYUucrQg1U+*9^W5yoXoKq5K&uPo#n8vtyhVA#3YO(9)MJP3(1#6+
zD_G3w5qZn=?n2(<$h!)E!>3%s@Q8vHd3DG?pvMin8-K$JmM}bGN*R|^{)o(_dDZys
z0iGRyo!~?Nyyt%6h3F@1V}}VIX78}y<mrv+@$`1uk{O41BD@qWc^KiUXRoo~TfNVl
z2^sX+Q*hU00c1VDr{7!BbJo0XvfV##%{ycLUK{X2?~KtrGi`$=*Jg7+tok%A8YB2|
zF=6)AC3g$mH2oJbF8=#eT`{41fm5;$^*5qU4hbjo<zN}<*>q+p?&9=&<sDFY7iT}_
z#Fh)Rb;%fm6dD8gaIp(#?3lS#-$nN)Nd~SIt*j3F``CqfJ7#9ucD;o$$sXhBt;6%8
z^RP!cjXJmkHItqjIGU=Jy#-y}W7B$J2k{Sgo1{N<2K7{19`is^9*y<BdxhMnJa%tU
z9`0$c%`NC0*NHYbFV@pbe7e9_>=-eB%at~7v-x9h4&Y{@O=|b_7eu>Mci4A}^GMG}
z%vqMVM<2G9bUp5}#d-g(j~KRN>yB~p1<P6I-$MRRkvF2ZB#(6aFmNA7`S4lS<h_pc
z&yc<gI3qC!NVoq)y8g_3#vMLqNuG&MIKvMu$UBERZ==rhfcGFxw1z)(g%8h{cj!tV
zt}pMI(lB@nL+}opJRZ6#Z`e&*uUVh+2`2vOci60@dBZcyc&<|4o&--x_*KV99Uqcm
z_7_E*<V_hbVtuhCt!<sYdt54XCb371#}-@4+O3$28TRD0MKmYh4j)rHj`oP&b%<-2
zV@PePbYsx21G-4`x8Ls{L(*$E_DU4<NMhO;cRB-h2%IjQ0SE85%zakUqL@6Q6THuw
z6(+9NeUE5wpgFlu!RdG-d|yqR@nL8bOWjmuA2L5M$4CYxp9nYe<$wN@?_LM^4mSCJ
zqzu$IyMoj8TKK-1IByCXxZnM3&wIGXP5&?PKy7C~U@cn{ClTXai!mb~i`wM0j7gPK
zKJvD}&l-r{@j=itao*!SaQOdIm}t1A&8beFk5E$Jb6r)piGGzE^YaMzNQCDZY_|{Y
z+}{p7HAWk0zo_Ct_u1ZR5%!<k(I)X``o6*chq5_-E?(m>&*0aR|H02Ujuvr6st;by
zmgBtzc+PTCxVT`JoR5SXiI?ml;Lu(!cx+5wHQX&B9yLwqL%AV;<K%C={2eWSljZL?
z`I|0(v*hmu@^_N_ohpB)%ir1Zcdq=sT>ciz-z&uLmRnstTW)pY&%mDpe=+#8<Ijda
z9e-NSSTSA!^K+ZidVXvl0#2~p%>Q@03qB6w#&j>>z`Tjtx=yU&_<y@;ufcJ&d3X-0
zlYJ|ZcLx4ZMvPX_g_v|7a65lj+n=Fpf7P@-<7%M~HuQzcf_2KIM|7yXjOpqJbo`cM
z-Od2*TC_)WDP}~^U%5b+V3TGC^OiB`{@>;HhojR4T?Fm{(#MSJGx-@Uq9xu{5&C>d
z7w%e9?2h_fisu|l5r3i>I^T)2X=U_020b(LfsCP3zukyU{pNS&{U71ECi3}-Kg!n-
z4?c?gqgZ>o5o3oh3SAWEt@Nvn&<-_)8RyC|*5h2I;FQOOkGGmQaPpIgXQFu;{Np!3
zuPWu<l*+rLeV}<`)-mnb8_3JVnnUYO73!F_g6etXJ+8sl%VC~`titk?;+KKR6X}U5
z->^KP4tQo6t9=<tJ*%^!lGMSS4XJp<Gu;aeeugI8o$P4pA7VeOe|r%(2&aEX;<Q6I
zh0(ubX@1#9veCyC9CxH=V<pZUL1WOmb$WcDZee~Mr17-UEwkSEAbM8gZ%_YZdZX5}
z(i=OT{ZY@A-4WJd6)&>hJd3!2&hIQR*JHW^LB22gD$e>4M=)bWv?lj~9u9tcYvCK2
z_aj}g9lhFLZuu3-mhv&yXX)1kpQ;mfkZk6xF#2J0S?h;g!6}dQyr;xT3qvC-)|y84
z5OB(=f9NOq3+g&l4!NlQsp>D7_Dx+UyP%7~XFg-#U(lLCb?4!3d={^b!rr=Wx#j-D
zH|O@ZgT84`;fN*exe9mOR6IK8z?$J2wdV%c=R@o8IS8#OD5tgXuq}hz)aYLBOYR+5
zpXSuYdwS`t#^unK;aswp&P&a+(%^Gq4gCPm2aaNFi0=-px9h><N}T7a>n`?HyzZWm
z>#)iPt+zy<`uH;XNNu#CjiJ`>1pi|s|KNR;$-5e#@4`Cn8V;Ypp{?ut#-4Gse!CGT
zrQZ&<EJc)sv#k^-(_jnn+~|R0>>I`$xDCG_VC)bBJFo?7ekc1A;(R;~{o4Yc<BXCQ
zuK#Dy=UB)fwyv(f4*C>(i|2mVsMsB@OwXLz;1NF1oWqEth<3#DQ*=H_{7`-!o(nyU
zSc+O6j!vgS=Xvxw9GyOUa@e&7KF}n3_lZmIzc|n3>7_Wz<LFl&boY$iHOU1#;I0$z
z^OCreauwX4N!;9Jx!f=KckB9`Le?7Eqj8|;LbUunH&B}S$JvGn2kYO5@Ttr>qhVgc
z_OOjN*LBm+u*>&F)RNDQcS4%?yxbA+>75tmGivnw;s^Ez#?fyV&L4h__o`eQqs`95
zn3!`r?43Kjli~Cro^vY!o=J=P5RoSZuPs^Y<=7d1%e%#XxE%9_>Wk;%0`E9{y!i(`
zf5+bWZ)<FbUn((U?4>&}cLQW7W0SRLkK)9z|LpVCB>Q7v0Y2OolEat-f0VvqE%4~w
zHhqv4&9kj|$ITuC_Z;v`JeHC!gKy&1<k{?lTyq2b%I;gOZTLO~#~mMD2TYtg%$fJ`
zKASBhJGpm*&0M#3xVS4!=VBBmr{@^y?Cc}_-3XpjAuIXp$Zl<zpg}Sce!;*pD#6~}
z^eGpDzT1wulOkjw^k^*Z;fZ@p#M2?f-$_1rN6*>=@V_dMN8?I)+PQNF&thCC-6!=o
z7w!E`8LONWPw#~@JiRnd+i`BvXCHUqq&*chQhei-3mhINtRFm1*q5}~v{|{R2m84W
z!Sk}*8CvgAloP*~NPhe5W6@T|q?ZwMqH#TnIh}j4sI!*S=-1hEWyD|CSrOX_#~<-l
zb&JVcGV?}tj-XvN*8aCO#n4?kC;PE{m(bJDVI6+3d^ZNh<pX;RY_A<>7`93Mat&o!
zMVQ~)M+%*)rM)=p0r@+GA8GC#2fi6A*+X^!vUwSH;QP8Zn`{8dgX)jO*w&7QEcE27
zYb$Me?I^F!V%aRK&C+_EC@+sN2WVY4{ri3|-A@wF$cyuypn1F9f2Q1ze$zV)X#Jrz
z*gRi0b%S(N>^BG2QF?y`>^|#N?Pn3o*2fGx7msyiwAR~+x$EMXjkc>t(-Pw9HWcQ?
z#_hN^zGJjo&v+#kWpQIVUdqKhp*v7l;oNr1B>0J#V{bjK^-!NlKGa?xok>AY@XK+$
z4hNrE>^>sLDwto>ma8^rJNB(6uhh199y0~^0mU34zFxNbWIu{zPxQ-iH!zpSNb608
z&p~-dY}%o0<UOTnvv0%xx=7k}^ohrcaA=J^__6b1$|D>x=7OGi{}3{swEG{<iwR$q
z{b1~aeH``2zvqmkhuOe;18XzUAepP@$~yajv~K&)sXpFZ+ynjby?Z9y`f2LTC*qs;
zSc31`<;8h-8QL<JKIUpVv#EvNlz^w1h*R#txF5xwNp|_hWZmPiYcwwO&ZF8a++%>v
z*#W&+k8wC-kDXM9vRvrKo;Yn?1@g<K4$<>b#A}zP9l`)6CCPDAWj>g7D?5{9?teZ$
zlFaGZesk`NIU2aO)<R#%4w9~SD14&5nZz?a%WCRn8T68PKk~P8hv?p=&?71reS)rV
z-;SI;cj!M*KG3>N@g!Qe`79T0YI5D)51Q(HSLe@a=x(Nry<|@mbI3e*`5R<$<H%yT
z2WfA+5sRYxBj#FYu7k7&Cc>uCIq_zkr4jBC#J5^8X0_YBg|+AS&a`ijPQ1`sW%>{_
zhwV8;m(~!m9+~vZ_ubkfWQAwtV3SEseg6>a$9B}AcS_LuMfvnj4^_`Y*NDLTtQ!1t
zmqu$f-|;_?k%M>8qK_{0QIqFAe9j}|o^Gt~t`2S2-YjhwjSb1u<+k+@?T&;9cP4VJ
z{gkR9;F$Jp31m%if#>i`?}&3j-XVNT|JFT9JGdXdLLPL|9Cw^go!yVvv^nnZsn2#`
zFCQDD^}^Tg)s6@|?7{t!rJ#X62KZmaGp+koqTqPs``AqSCS4PU?)`r;44teCt?6VB
z0f+8p1ox$Tx;2e`D$a-qzNEw{r+z?gUxGYeH?U4(Z>3iVd15V|)Dh-=PsOvWc_<kI
zP6ueBpSv#uFEroo0-URBz55NBjum`m;9PrV7`Ycu83aE=!wJxzV>7JVKRyH;8dr)L
zkRHK)V!aEr$H8kH#gxe}A{m)Bz8Z20*3aW}{Co}uuNLwpzqtdx(f(oDEb`mk@*Xwq
zCw_)!O~{_pK7wK`<kRo5jajQ9U-job@aG8@He2{F=pXeBHd6Rwe}%mR{{eE%Qux&(
z__^5%P8VVpB!l37n>bytG5O$=`ypec+z;&I!uA9CgX>2!`XTN_Q$MI*#K-&i?TjzR
z8BfyNUGNjexI11t^y|OBo1Ek6(JHhT57=UMJ#T1dXCt0CCQoDA`?@XZ?K6<cNxb*Q
z+`F0WQJgVY7pPBv2Tk*CPNera(Y+iG#*X8kd|ygCK<{+YhKqMZR$_drpfhhIin-kv
zr_KH_(KF}!SWl@huj6jQ$$0p*avWd>0`|_gN7y?b$1@_T5Atd1*CB3qcUCdoF}a%d
zb$7x4+MnQm&pL#ja8X@t;Z?YTMgFV@etYM1;djx#jeM@Vrfa=*;FaP{^Pt;Bqp`Oe
zt<54GE=ArQVeH4YRsMMsNe{QHI1%EwgoAx|$okVgi04`M4FQMN(pb!;Gs-&~_a@SQ
zgltLp_X*KG0Wh|+6|n$%*KWBS=QGd&bv{u%>o(i{4;915I;}iQG*o<#Y#;mo7PI~8
z(YqhYG<`Sd4e1^I4HlQ~5+1``@SQQlYKLgO?|`mSJ2d9>+lT$oMC5nQ4$_U;LO13?
zxAx*pl60t4*JjN^J!+#9{x8+viZsnd@_Eg@5w|<UxnZyTbaO+k-+}pCA^S;ogLovK
z{tb7^wqoAUU0KtPn9q^9CBHhx9roDwe%-1n+7E~`M{1+%FX8X6sCd<oJIRaX@X@(L
zKL<={TC3FOJ`i7I8&rYcB>0~cM?Zsop$k4L*-1C{OtHGR|7L^UH5&JJ5n{e*CtzKu
zobT5SEm9v898ZM#SOuJL^U*el_YBw-98*7o<><%h7+t{gzGL(>{D%0p@*YPY`cenq
z265#BaqzK7$6~QI)Ik<winKX#J$euJkY~yN!9~`yu`lX9cf&6WcYkEt0&5v<9|BG}
zp9h71=QZZjLF|1G#ttv;pQmeYmt)^C31fIs4D}`U0No4s>cig7#8}4R?$I!;gO6h!
zq&2W!kJ&|iS%`iPD-dfS_1k=ZVer@=TWH;{p}ebr)=!hxK+o*Z`dJP?i}qKU(%&-I
z&kD@7ZJ2Z0@oTQ19>f92b_Uy3vY%$3w!@Ahy(<%c-AnxaDwjGvknP>~3GtKA--E1+
zL33&l&&F3NI35`v4%T@Shu#B%&atnB=QZ$N&Lr$@h3`kUiu@%Lh71DYNrQ=P9LKZu
z;rxnPjKNUrcfvl_U0a-&tGkBvAiiV9cB<Gf%$W25o{u_=_>KpDusL?-xK)<<$4!f5
zi-v$>#(La{<6QvxksM3$TMIu1zGyG)d&!m~em#ofX|(>-VO^?)Uqf;vKbGG2(+7Wt
z>Xbts?I;KSG82dJ$kx#BVC9v)^3%yXxV}4rtV%$~j71TDgTV{-bxxx1W~@2PJA|+%
zh2CdMOcLiDTQJVGGH&8RoVSN#!L1w%CLfVv!KA;r7z6SL_DH$YKH?(i3$1}4;g90r
z*C7^0xb&<6_2qS(b>PLlWmu1K)*)h?bk;#Ws<}qfc+%K*n(bmNk9>TtjBudWRJM%D
zJRhH%c_C=fyAIKK(n`>x*gVk|xG9rr;k$HT{K>CXeHVJhNBA#dy{3M3!YAHhbFK9t
zhDp3?GS=3K`f9B0jtGAKzItji`M{gfZ=karGuE%Z4>x%4YRbJ9^NyYsK8>;a0B!sV
zaZwtJ3XBEy4UR<;$+Fgz`)r}_ynh4F)CW2*Bpmf@=}*{q33&_K!}5mTXUdypE!!f0
zkmU>bzu><Rj5q_!a1X|s<gyj=p!sLYkn)H&?bpX(zy4|Ec)Bf|97Fg2s!xS6<8_Jd
z1JZcK;{2cD0U3Ji+P%<8;_-;ww};s4JB9sP0RDj&;Ab7X!`ikT9|8`owe;*vt&A%i
z!C1Ru@LV`_isVkQhEB|na*QGIOk+C?usODruZ}H*9<V>Bv8B5mvAJx^uXZJ96f5fW
zLa)fS6MPbLNkg2J+W#}gm}nCY>0TY~f>eN~a==thbA<NW>T|smul`4q-V^SenbsZZ
z<5Ao*q}cVgxc-Z~&=&a&AIf<_cjw7&n{khQ;1~02QZ1g_As@Wsn0p63<3sx^;$eSs
z2cKcO$S+1YojqmY`TJx%*F$wWj?HF#!rcq`j7NSh?ir9QAIIFG_%`kh?PR-zecfin
zw`rabF4-l*eI4`uD(H!6liZMFKlmg$)!N2i{gq>v?ieSZI}-d;Y<nEawcYlSp5C$A
zc<?e7yv$)<%ow&SMevR}R93mUwm%imE7jUkfmi6`dAyc7>^0si;C>A02IvVnTpAz;
z4K#w|;s0o&Geq;uG;p6mGN<??@#v9j4Yf=9PqNL#Uv@mLH8!8k+Jd`A`=D=xgL=Fl
z!tbtb;GIT$)E51jYf^A~`(%42-VqsN8VHZ>chb0?fqu}~&YIxbvESyI(~0Mtg88V#
z87=Xl?#&|gt%}cc{e2^z28&BN9IW@Wo<8|cEsxrvXYt>|Sqkx88?WQJPs9sm<4zpT
z63Vv)z7ufEF>TY9yY)G>7vLFJ#JZ?H#(5{rEm~j6pQ-(Yy{89vf5N?|!;EX1yw?<a
zp9+>|3GTPiI8xiSC?A9N`5EDK*A6XH%p=N&Z**Wk@?xJWn)8-ToXJKS%hN$^QeQK%
zkD*vNwUO~0`h+$qZNCi90u~866EL31N5%Uv*W-Nbh+Id5dEOW2=b7#}4b;DEzN;hp
zR}PwHKbeo`1s~*J6KwW3I8LZOb89s(N^nj-n0avwc!QZ2bnb4B5Ap7iaoS*+sCWfI
z^I|6E1=hAX`ytbgVj*kNp*?s8U=N-J*n?*R_TbroJ$Oc751tj+gJ%Zz;MoB;+6kUV
z+mZ%9kLdrUP-VgVN3bWsxMCiWjWVBy3A9mG<50zSsQq)8>{C@3`*aF;gBgd@vOVep
z_anl6WWt*RxsgpGy^lM&=~pzzC)M3tcooij$VMH+T&H!6+Bu1NmCHUQbnuvts<d{B
z_z~?#m|i4X$mji{kLLX<nnNLDHg<4*+zvcd*Ub4%?UBA^!k!o7PsO7>me?-@ul3>X
z;S9W{oStCni|{uOM;Nn8+@&7Om{kE!?N51xF(bS}$n8V;-L&SPIJN0lbg%2o&9#NO
z7_<KL<Q<9GG-l##;tbBFW2anMNH#I!WJcjz@{WpWhl1y(-5uDkGiZ-&cP#AS%rN6+
z!#(c7^iSO57PgJ_q&&jDP{pHpMR%d;cPxIH4_%v+@e`qY=9q`{f$up8TC@heg+A!8
z>DjQ~S!BOq+okTpzY)4Ed_eI`f_i7k{C_ooPrd^F&j<1TTQin~yz`%bB?;sdXb)*y
z@6>W;MV0Hhx(*X6K1-E!rIKz_(swB7hn4gbO8U5x{*99Ulal^eNsqGmd6=lAFICb@
zm2{1gzC}sjtE9V>^pi^ZM@sq?CH=ON{#Z$m#)}P1`Q#|+IZAqwlJ+X;7A1YVlKzU4
zeq2dEqojYSq)#eooR9kWam4u3sY?1HC4IS)UaF)km2{huzE4R%qNJZv(l03Kx0Uoc
zC7s~#^LBxfzF0}$q@*`1>FrATt4jKDCEcr}k1Oe4D(TZo`U55HH2l1cRniwJ>C2S#
zQYGzG(k)8*4ki7Nl0KlMk1OdHl=NvO{Z}P@PDzh+`gzV#(ibb~#Y(zHNpDrsUslqO
zDCuu1=^rcU*Ol~JO8Q+T{dXnpaQXQhsiaetbf%KVCd;SKGnDjPB|T3`U#X;*D(M@P
zbd{2BR??qS(%Y5vy-IqwlK!faeq2c(RMP*hq+e6g|D~k=uB2mQ{r#P&q^BwAl}fr+
zN#CZV?^n`~DCsAa^a&;Xnv(vTlHL*L=jUN1{VgSZR7t<Aq~BE1{YrYoFn^oll=Ov4
zdd4u*s%lz^lD|wzdzEy9lD<VrZ&2uVDCt#-E!vE9bxYm)nwHjS&Gi*+tD9OHrZu!S
zOsi|Ipg(U#bKTS`?L5kPxtv#q^ONMfWjJpR&o2|_*T(Y>!FfmNymxrsYd*hKIKMwS
zzi&LhSw0^jI3GDVA1?ZTCydt8U={RZjD<^!yd{ekF1V)5Te@OlNr89i@+I>%CHJ~T
zMc0Jp67KX6+?6YeLo*3=MmW^aOhTO*4mC8BP-lfh4aqB-<)uD&ixw}PzcRFRx_80i
z;sx{PFPI;$tZYG9>4N3q%9bu&;iYDS<yAxl*F`EQSsY4cNf@>kmo5xxdD-l+1d$z%
z9J0d^TfAU#$<ph+^A{I+S6qKhNeB_8yeKRJ+MU0kWXa;CAys`Pp*pa##0%XBsZq9I
zMOoO)P=zDZ&~_;|RE;P%yv7uGOO{--B2>MDbA@^b=dyYSXOeDB4{25?eK0N>m=S_X
z4TR>3sSu`tnPD3U%@q?QOameHX=LUvT@;dEq)d(Ac2MS<8X;w~SWihQLyF8<6Sg2+
z4VoO7pdl?$K5-CIKr<(}b!a9{)iBxNNRl3}48>Mv22YIO)|7HFbAl0k^CKK1VorrB
z60u&kz<b@oD;9c-uDo)2NL`*o!K5fNRM#mtlmg|3>L2AwrP60moM1ysU0aQJ_RP8N
zYgR5=<gTc$ZmDT)&5YC3;u+HiEH0QmU~yrX(wx@0In{2gNAA+=+;y$)#-=uRYkPBZ
zQ%hS-b(}_=RW&s>)>O5DksMK8*U(&F(@@h03^#&2TpJsGcaE%3UDs;X;rjJ86)oPH
z#_Hy#y2dtdbxnQ6CT<uVtZDNVa2BdoRMyu7W>&3U<E?2Hyl~RnSkb0}wbd;_ptojY
z07gSob&ZNrv1Uy`mFk+{oR+5cwty<NP4$&(6W~e(8*17rsw>(mybTqtYt;g(=dIl2
zt*Wns$kdXmww8K^G1y+S4-k(pUDedkP}k-Ig}h9}HISW|Zf^IdtD2fO`3hvq-sYC3
zDsNTWMkXgo1ZEOuOPjZ)y<YU1kW^Um(js~wSdjp60@Suj(Hmk$0oS$Hv}~e`y2k1n
z!9YXxYR>TyBjT&;gQy2&aFu`@$q@3mQ-ULcD(dT-swyy<pe4|@^>tOEM+DY2LY`F(
z)m(+k8=&ASjBcB7D|FV|&?<(xrDjcCYg<i=x4FH(-j`cl6F%RU3yohb`IGf2$ETi3
zeIF)G3erZePiZM<T~%XMgBO#?+gc|$qTJTH#x<BOl-&&88Y=4=m|ELLZ?%{)oboob
zi?LbVQd8q?T`LqB4YZ@VO|9PMx@IAxHcZv(rVWjOxrD;V+%`cbo-d=l8OmSdUDH|z
z-K%fqd}#!{8>;L46#T{^Fu$geCw?$)XeI`_y`d(sa%+2QGYwWiZBk3hXl<)#6AV#K
zYeP+g7j3k)U{bc#h=R(Nri$vSidIo!U3(MeaZ61_RV^tk_ocmx+oBe#E1N6KJdCrq
zrFv6Iv6;aGDzn;Z+G@R(Ep^pvYFP0!HN!85fNa%p(f}(~gJ_2Zz3t8Qb&bO4R70Oh
z$(bJlgj{`~G_XFnbyH)N7b2-@7B-oxRD{cf0D{n}Nr+9NT0?D}m|HcCYw8-M-4yGF
zm&$w!=I?f3J|VTXH8ryaRn=Bt$q^b$bWtXzw_3n8np?dx&s)>b+$NY=*H9<B?Zxs`
zRRgKf3PjeqxdKB%^O^-fh*BUHm}_bpYg$Ob+bY(u-Nf1~WGEM`R&e6$WC+8M4NOO4
zh3Jy#YXwZA$$LOCjk9mDAstX?dMj(tCCsymHq3nHfLaqameqB26X!~?nG-`5oLNND
zu33*Y3Hrm6S4FC=X!SN>P6<o2x}~B)465uJ%|MCX8rV6rb()UV_1^Y+m=dU1U87`-
z8jzY}wxBZX(_PsP4P9fqFl92Uxdq}<W;L>DiW5UMRbmzhXKGzTMYFd~3^lDVEajH=
zW{9_<vAVuScmORm4NdE5f?|Zi6hbK>Z&QwH#mWjYBx}6Y?G1uI8n~KfH~`Jf=HOu6
z-AGISTJQQM=}!2w+8ceD{<$4cow8flTs5_mBCl>~YA{_PDr;-0Xlx~4&D*v~T5!s4
zZD?rsRyQ?N)HMbuDHv<@Zm4J^m#!6~;PZK?63u+9mRzBw24Zg&Mpo@k6^tSTO;%OS
z4w<+GQ}eZgsRi0}{7&cJS<|LZosIPDMcNEx&Oqjjsk7)0sfCT}E9&d2-E>-1*CcrM
zub^;2LADxV6w6i})JfPubCyHCayHiZip+WKD+^!E+t}o-gufv4#vEo?8zJz3Qn~V&
zg)FI%8l>%_gvPFBU3*<iO*JjftI2Mxu9NN+NxZJP%3I&Grm|gl2!UBB*#MUtp7~sN
zdt*yY6_m7vRzo+`6izoLsJp4Es=WoxPj*+dw$`+eNf0i3%SLZ=Q@yY@sJaQWh{ru}
z<;TQnY-?n*CB#RoI`jt1KZ=@Gudc_cs1y@}%~D11tWHzIWVrWJYBx*)XJVT&*9{!E
zDIoXi3UpWO5&W3umWI0J+i93X&wB{o@yvD8-hpmXc&l61lk6&MWP_rQnA=kLEN*~e
zeB_3yrNQmr+bmz~-T-;g=7tPR9klIp=Jp2jORBZWH@7#a`eJY9L#>l~T+y<oRSty7
z#Q;S)z>Uz*`lfmq{~F)UDuj}X5Y&d*8+S!LPak*9MmVs+d_}|xYK;a%wM0T>xp@IY
z;%CnaJACWau%2sLDw=D(FxM7s4+?j|s)c3l4Rvj`iUeWg>T6)c%$^6!-pqGbH`NH0
zVZjBBXGE;<Ju}fIaf`l1#tz@QUlw99vuNHDo$VI9yNEKXs%Ug$I#yw;h56mo=%y$w
ze(N^{iD@9jpuU)$4w8FBg$*2@&^Z)Bnu0izN2ox>CYWX4I@i>)*1Ni0T5g{j57dNj
zLcsS@B;_S-^S0GBm?jakMj9eobm2F(z&>&v{I<2XG(v#FqMPB9Pf)?v5mSiLgdtz-
zI!)NW-!yZ`!3<fQd@K}SH`i~H{ax{OUM`ctjhL1{q)S7uhy}W>4&eeUH;6j5`P>6j
zs_emnN7BMDmb9_SjctpmmEH~O*!%Zw@qHbQfM+i6W=H@g&};&tW-nL<4^ZM?TC^Oo
zpfY-}ff1(Dy#YE0J!lVH)qD&^#0r`=5)X449(PS+)h0Jv(C~J7NXRQzmXs`5u_8_@
zs;_rr{jGLa!foDASKU@iN-^0@`J~i=`ElB{7_r7RbKU;MX|f-M)oI~1*A^{WIN!Z|
z!HOj-mzOLsl~Gkh-W{x|36`GeE1H^)C{II;IlktSFW2FLa2hH$dMh`$FXNsx*3?wP
z97s51Ic{%U+X%17&D#v_fY4(}&Z5}l!Y>07pD7(NzXIBWRShF=tmEOu9Z<Iw(m>OS
zD`-xX#+nVXKph!BQ=$FBq2+?*rf3nel2HYpiqh&Dr@@V7*MN3del3(EDkYTD>Yj2r
z(vh%vj~G&ALq%O%D@T~GTwZidnY(E<nwT0gI%NwNFIch?>pak*cU%DkMIAN|Qv;hG
zas{+Tjl)t?xZBruPJO$ZEIn8<g&=*40ptKnav4US`J#k0Z>FJ!7Sb|`5})8<aLjFI
z(A@WFmJHm}Dr{Dhk{<+$v~g^Zu&v;oF|<;#V5XxzSUzZ_wcsN>3JmH%Y@jn_a!qLr
z_{fd#^nLkauW4qyIPLMBC#(4Zho`{>bapp?<>JNHhp$Tqf#FM5l+E`pC|Ml7aQQX!
z7p@3jbRC_V<wqzBI1^V{r4zfN`9({W6JNDB;KW-kfJ}VHTWUVZBw|6pd8S&6r4hCo
zUlIsg!bkdHOZ<HbTkJcFlqM)(`H&N<t%>GlpaCGil`KVD6Q5lPJ(_A-WHQdal}@pW
z0dA7%mWbxPw3r94RKyfHMqz^h1A0h9uSExVq8q}X)Y0xX$XW!sIR0IL@CpJ&WFiN(
zVQyoaD-aQcIhTU>w<Qc<U|W`zf|iaTny|NlzP?FTnmDWS2%A82s~KvtgXo*0@F^Lh
zRNi{*rDfb8u(N^Kl0{SD<Pen<n_Yl%NEh1N9r#>%Rw+SKw&JVp-#Pg9wn03HL5;A<
z7zAcmCdIZVlu3*RyGg2F6S;wbpOR1l4!CR;APYXDph%N%$q-AkDOkU5klz!+kt`0Y
z8WD#ikOOp-7jbsx!mr}tWk9ZUdlgRW%$*G%44ccX<m?*W^^lQL=>+wzvZ89On_|Ll
z5f62fVg+e})LLJseAMM$K*Z?GhLw@xP;X$D2isOK3+#@=dor0YsmZ<y`w&nb+=6g1
zn`?rmUie*(WHT~$aO-lr5M<O$Ze`3SNEBh~m>miVe+d)gW`A0Qqs+F|<;BdSSf@}B
z(<uxdQ!}DxmXom$oE<Xcry>M(I;@=v%=9aRkE77|fsgBfjkw<<4vI%2c3q9Vm%DNk
zgcql^BaYqLT!AC|wKy=7XMnyP$6#9t>Z`c`u^9*wRoF6r&n;I6g{1*ksZW4MA?pC)
z1dMUrnns*VVNQu)5_}n{W(p-K)PQ=Xfp*jR-5N+fr+Uie%67vypuRzuB&3S@WuqYQ
zaZw0@Z%q>(yLo`)8%~oIHlaRaY7UT}P;huDP}zCQ3ts4KB~H7MA`{wjae!5Q6YV<z
z2^lR!pt7ZD4SLur3a-TY8MbvM7Wcv(g5_(B8xCy>*=9q2(gDpNJG56m@k#$HSZRZd
zh!5SI)D}_RaN{U~fgu(BlJ<?5<mrNqQ!b~iZ=l4(kDHq!P*}0h8q3IH^^2$zbA9WC
zY8~quE2`S+*4MRd646zTwgnqTocKWQ;xLh|IRgDHrsSn@j(`&+eZn#&2sV61i(-5s
z=5}z%;5euY>J18x9|o06LHdR#TzBCpggetxI%|!gbd-8cQEB!(e9KBG>t^KKtQxE!
zbKPYW1NX@dQ+P7AChk@o(nFeSD(Vof^|h~X3q+3Mz?e~pp2GoQMvx=yIMQmS<5dpJ
zn4F+l95G5CAVlP$L4F!Mcw&5*LA{neGn-IYGrjoWzEkKqkh=MH65;|=imy*n+JF0n
z85H+YFl)}=j68ock~QM|%}Dd&uHVyy@sW2Z$qzVxGg2Co^EV@X_o?Y(%Kx)BBmdXj
zWvgq2BZ7NaY^dOk4*FtS?FRq#G&CabZb|=-oi%RKKZ*gD%P3n31clszqg&Fr!b1-R
zG*t3!CAv!PYw>@{6*=k!U5>^L7vELLkZW@^vk6h&gTu8(Ty+e(eoi?5f4vUJeYd#U
zM)ET+sgd4@jf~%g<~ABaE&<8xpdd!rT=lThY{$RnX2oND<xNls;b7;{kN*j8YWTv4
z!51V#op#^l+HjkVA#X;ca6(+{kRF=e@cG~K5;!k`^Ab2Of%6hLFM;zCI4^<o5;!k`
z^Ab2Of%6hLFM()Cz<ek#8g2c5*@oGVDfA@kl#1plc=YpM@e|mO4fPd`|C&7s>_>am
zzh*Bq@z82(L-X|JHO+NRQ}7J)6hyJ66imT`(*H^y9*=PSz)NfXmHKg>*H0;dqQ>f$
zCOkQxJA20LnbQmMadEvB_aW#)!i<YAzPNCDbsp}9;+~i90qcVNsrgf9yK`&X+L~ME
zPMe13J*b7LYnqzyCK+)Vc`6>Zo7UFURF5lSb&b>N>(@6-!GX`scng#}zpApJVs&+8
z{_Onf*|Q7gRLm)yadAcE?84czt5(mfs9rsN23RSWou_H%nL95zdY^;)yw352c;!l6
zi{S~6{~H(|{t9aV@P9j^_`XZ=Z7;!BjOL&mM~qR5ALn99Q-({&|MaM7wg>DL^lPlf
zS8N<5?YHP$dpo6FU&hz7zedvN#25ePNvZaj<lz7`Za+oiG*yX7b#XcY?8S^7&gm>l
zk4qRq_&v!;r=77eaPgM_jDJS}-ytBqUjWa7!I%uq&S-B@NtR0h?-7ubVAtZ)qy!vp
z?u|_!Nd#WC8N=)el)BUoj)&Vd28sxXx8uJ#$LDGS66^^KP!Ehz_N5GbxDCK)`zi)L
z2kwm|dpQH+?*Nc$?_}WXcLEq|-^suUCxA5jgMMIwy^DeUccCQ1zJC-EExiwb+kQf4
zsE43z`wIeklAsIhuL@{bI-opzpMdZ`;cCVt`xya^`U0SQd%u8ciNgZBX5%(fh>_WL
zmw=K9v(TO(AZ}%@Jyk&SsO(aEu7DO2G|!$dpcMoa+Y1GB6G8Ls9swoZ59kVexq!yu
zf66tkwATvgqv?Pa+M5ML<7`}IZxhgGpt!~&`$hpVFN^IR0@_NgEV1tt(6<R%YJWmN
ztF{ALW`9aRM{fhP!hS?RQ=kY&nf-)qG)b5A&A8UC>&_RHjO&nLykOG|Qb91TX^DiK
zL|-1~Jl0Mcf2T)iFmdKA5*j=fJUfe187H06C2mfihPFB9=W;q06UezBpVKFyI?gK!
z@gHn!+P5$g&Z}bdj7$CC)iHXy0xpWtCn(_J7=63~UK69IT`KrYa6HZJCxHjYGlEZ%
zc4-ESlGQmI#oVuQ=MNd5`|`BFC;2;{N#K0Kc0Mcm^*hQxyh@8-g9Lrz7I7Ofah~K2
z$cih{QextYxZYg^7XwFPB&AY?J(N2JU-1X<MW5L0u`#h}F<j>a@?zbB2To_&wD@01
zL{}ouTc^!<9XZZ7@WoB1I={@7N0Fc(6qPTc^jE~dETHs537Rt*2_p?(<JefyAlYfu
zG-p1Q%%Tz+UAt0p6_qRrtz)l7o@UhHn+=>h&iMuA;(N$(?i5`7l+wFW*(ec7=ND6j
zxq5{P?jJ7zF4;XkPD>*zHvTxi?3%F{`1sG8VRfDUe2<n!`RRnCVK~p=mt~OaypyR<
zG0<?QpgxDvcL^D!lY-qX1~i+}JH&vVrSv^+&6p143?U8Ua;jK@FK#+v_;0xBYGe$5
zRW$t@O8*uN)FCnMR(x?)`(u=%UTE=mAxR&{<?*{^a#(5n9y1wFNSecCJdPYmX9Clq
z5g48>==>ao!!uld9dL{>eviChl00f3Qrq!5dPE<`ocQ4~Iqb@KGIjJBHj?Q&T?Vmg
z<RW|A41CF+7b5Ar3}4Jq{s=K^??c9jJi*aHN>36(eU{P}386ku>B&N<rzt(f&As^x
zrKjd<Zkposi5ZcW$qD|}`P(MeS7(gT3#=@*O~)xkOGUQv3w)2OKqdQck<yGm;G6A|
zaR#X@Dly(gD#K3rn(<G33w+jYBOX?VJG3$WW@ZW_r^T-o9pZGon0{oQ;@6ALkx1h=
zB=DsDfbuuFMDK`P{AOXps8jK`6ehP4!sk6H?)c9$fn5AQnen#@0`0JK@moatZc2Ax
zOwoo$%*Jmo=QPdn_}gnaO@khPhv1Y6+*!~0zoE*V&072$phh3Z!HF@B?{OK;A;*)N
zmP7feBPWVJ(5R2h5!AB5(#Q)$KBq5C&<yGrOC~k`DsG2r#9u9HtfWpX7Bz0B^oj(5
z>>7CyBXcv8A@C-Yax=~G4|53%a*t?+yU-<?IYQ0slhY7(BmNN&<CE=;|3)dN7vjGj
zkMCI}8q804h%-;3V!~HNgMWp~mGHG(fsmUpi4iWR%!>p9rzZ=FB$$LLf+DA<CNVx)
z_=IU<L^(fyyuY0Sw`P=}LAGr9u7q?hVzdlFg41rHHIEYMOqb8fC1kl=7u-Ra*$J)`
zcS1JT{vKuIXsl1qQu+cK#Wdnom@{2VBk8mKixC5v;5a3E(FZKYX+io;N<#$<YQ^{y
zzB24ot{ETVn}?wz;Q^*e)+XUgqFM?%lkjDiLS!W7KQg&SZu}RyMgtAX{i4P_l-?~E
zC?MVYk`Uw7lzvc%?nX*~1>$M}vRGC~RqS^H6o$|sQ5m~@#e1oQa5UpFB$;~WsF6&a
zEa#{ML7lAGs8NDCr$-CwoK6(fIi2L@x>w_S)R<g<Iys-ywUnPy$Z2v=N2Pi={l-?L
z$5JUgU;K?4*Uae)(W6mm8#zrgbkz6`E&f^tA@}_F3Yi>sowVTbtun_oR@zn}(b3a6
zpX|%%nW9gmbfaepts#{kJzMneFfd0KiasTlB7F%Y`XgkHB<`LVk+{TQ|9CsRqr~eB
z;h__AiK`6Zp%azF>kZ+d(~L{J!ARmd4BTj>GSEp4eAaL?K)p`%8o7S7Dq}JOq=$*s
zMm__?Tw;w;=&!TJ@c4l`W4<3)Ym}<MA{7uD24<(;DC3fDVyD3nyNB-*&}fviYrbzR
zfF`3;xUQFv1GEl~sn`m@RZd)Qc<c<(2qtbYN)>1$9AbajCS#R=rlbM$b4Iy<NdAeN
zjamis7GtA;E+)(^Mu&ik2-<3N3Wz&!kC7k46j+A$8Z!mdiH%6&eMX^Dw#)Dc=pdDS
z(U>nFrhdOsDxlFBDBEqU63}>pzHXE&n0t*50o_1l`;4727m{X>`A&Sqa6Kgo@1(+S
z7%v1suL_98)MNAsX#QGY9x%=bXemM8G+YjUm%d}9D$o<g_yEYQK;Jbc3W$~Fdq%E+
zSWJhEd<X9~7<$TpgFjQr=tV}ln(+f<Oi(kPr7DF=mBUm;&G;ErDO5Q4h2arU2leU&
zqf|g|)B}3S*r-6iGHy}o{l@4J5bOINj7|l5-PkE09=6lQg9`M9v0uS_(|AfL`?GOG
zf&OB=AfUeyFYg$AO4(nHT!W?06y7xo1(c1oF!6n(R6t}@6F)GPD$s|<Dgj;CfU<t0
zJOHW<fSLoKjS6(u=n&9!YUOW6r+|3W{%-6P(8W~t592`r@n{>)Cjy|S1jM@LbRJP4
zm-B>z8RvW<0D4to5{2Q;J^_7&pb^e~0WB^El;F&DvXmGa<;+*0L}#IZ9;JF?oE`yv
zm!NUZr2_gPK{?J<0(y?13!UWx`Xxbm&RPNemY|EA%>vR}0Zn#p6wv&2fTlV-0-#O>
zn&#Xoplrg-cRnZ}mf3XY69S^eD{+SNDFM+6o;b^SL_lv6y^EbE1oYnoUFv*6KrG#P
z&OQb5IL`=(7MR2m=Q{$TxJcp^&i4g0t_@JBvtK~u+$An@YA%*1d2)%1oh|{*Cd?(y
z1Of3n)8b4OkcZ0Joo)eLMbIW^u7Ju2`n)q=Kwn!3Xp6H@K%b?utxk`CSQ6Wvr2?v@
zvfG?X1+=II(CyAuvTQh@JDm?IP^Ys?K&<n3Irj_bN9%!kkMjuuB~#z;bv`8^Hq-Yx
zpH`qRIFAUZkLum;JRu;Se-Aic5K#FRls)L|6VS~BJ>)#2V1CW{j)2;z>|v)C%km^g
zBk}7_mw<R4?Q!M{=vKn)b`~m_`<$f$V(O1Ln`7C$lY^J|d#9^I6y9(Hz?06M0@_W@
zoOV7aAnxEh&ixAXSLZhc#KL~p`GkO2eg5HmN`XFh9#Jq8T_+T1jOzsfF@+hfR|Uj|
zVy3H4fo8eR2<RwrcCqW7SS^<v&?H)^TuCA*@-P<pq+<Af<cS#Hz?buzwC)oQJ3G0y
z#2-7@Ik=sc`JXtnJSyXr?u5f792^$Y^A5#x`Kd$rC)~TAJA{A2z`r|$OTxe}9Ks7>
z;Fk{JcrfsyqnxQ8B&shvYIzvB&#yXUVDVD&Nq*~)fyE+%{=@N(2rM%6nnQ*eucoq7
z4$Y=bBIXkkFB4tjk+|HUF(r!lCC+nTb5Hs~A6GJqV56RRoxo?#R!MvYu7?N+m4O=^
zLL3a-=t%XKe8%DS12;)QF`Czr?=LBrQY#>SD^#gfsZy&}rB<U#ZMBpdH(l$f^*3GT
zX!Zj)J2v`(wT=!yQ19sU1C5TIexS+mpdV;<boqgGj{Sb1#qoq6Xmvd02ihD*{6M?o
zgdbS%c)<^Ba=hvXKIiE31DhRZ{J<@acl^NT9sR5y-0fQ(nm@RlxYglOplyx>1={XN
zRiN7(ZUwsCk*h#=IPw+fPDh~v-R<xw&<;nb0^Q?SszCQTRw>YZj&cS1qN7%U?sqin
zns004N;SwCH?APHAZ=qU&P`mZXyr0hE0;;FWR+enwNe6N7s8sqLaL|)+@jsm#6OC5
zc~<|YY?pD)$fg*0OV(y<`X{O26gNqH+cA;HhJimjE?{69?HT?{sy+knNY$T7CGSer
zXW)H@M>A;4Va%a2UzeK`zp8Zkhw8+ATJ7@Fj^Rx6pH%x9$#fiT8=jR6NFbllSTctt
z0}{BDOIV?fs1xysIuVb^iAbU0#G`T|as$U4pWy~Z64B$1axIOrIhNqi3`(b^p@=i$
zwD=2<rjILux2!JRm`)Wb%ed4`@u=@l?05Jr@L8BEKchI`@dLWy_5(J#tK|OJ<wlZ$
z7`c&TlQT?iB)Md`QOXVQ_>M4^GQbu%Q*IX}uu3fv-IgWgTw)uKu3Tu;ij~KcB6jR6
zkegB|_TlZ6t`c#B2Pj>giv?TLj#Iiu#0^MXDXT@?fYWQ{hz8wbT&aXiOVStwy0|8_
zI3_L?!967Clbm-E{kW2IxSYD1d;z5U5X#3riZA=Kgy|29rcBPH3L1awnnArVPT(tt
zay=<`c(|c)h>54%DTrQ*f|O1d=NH4@Nx4g$AFiUb40hj2=^di0-0gdEam0p3CUdiT
z%J)RO<SV8;DcU99DdnIDQxKOahXf58nUsGMVHi$-U&PWl{gen_Q0z9PSH#jd{euZG
zCE|o9<>?rG<aj^$OpG3{fX~M0BSb}J^sr!>88{-whY1}O<HPA=Gr9AeJ}$<J(?7bD
z^Jh~>e(XUo9utN>aqjp`<k2T}COalEsndK-q~>FqkjP~WE`G7ZbxepSS<`3Oja)5Z
z%m}VVZuFRVA+}Ax9y1bwIZ`!aJD@D;Nc{b>m9Zm*D>POFyY?e{EEar!)KAx@5Q&(?
zNg~|yQ(z?K8`{*E#EV1@DPrPe831BnilMX8GceV#`GIMMJj!JQQ2<ZONXd|soTs)s
z@dx7Im(A<b5}Tq~iO<M`Uj~lIgI@-Y+Ec|e$Q`$mB|w51cdd{BS@3b!31#8*s#MLm
z2SnMg$+xHN7R=7iLbo5#g()EsrhQ3wG3T{tGwsWI0t2=i0DMIkMuwP7dsr7nhJml^
zxs1lZ9$na02D<b@E}3^T>g?4$3{Z$Hty>pHhJk&$2vD6_gpx;eVR0CEO!pg^wEeoU
zE3~;vJD^u{YrnV>z~g!?1Ju{FZ|OT3U=E(tyZpdGeZL?0H~k4e@O}L$Kk$@(#1Hi9
zC;Y$<^cVcV5A|35z|(r4A9zMTqXO@!fN)rtw`X+eurTzjE*%yLNry#3(qUofur3`I
z2}y@VLegQ8kaSpXpaD3lONV7OK|j&EL>TWbf}YpqS@rz{{Y;l<)sGYO3;l$^<ThW>
zUlq`=sO%-ZPe42<FY9LnG#xRYv|sD*2<W8>KyT>%0(y4|p#Ri05ym6il;*Ix1av9Y
z8)l0Y(6+^Zl5My%VJw8EPNGTqMA}rLyUa|1)LjOqOWkFyo-K7(0;#^WGp$f}x&0&J
zkt#|tyR`XIMH{mLERZV7ZC{};o%SNlmZkctd^f(ih0~N%rfXB(Y0Gp!h2^-P;-|1e
zPZdxJ*iT!D{&E@X>Sy(h4BSQp%k@qM?jxW|)#BCqgIvO*tCcEE@qn~CsnWA)FxKf$
z;CKwR=`(&sJWXOwjy3K=u5c^vN6PsizF3^ACJYx{DVT_3-Vsuq48%)uUPdJ&r8pN8
zkRVM#cO8IH(iHrjfJA8u7%fGb0tUuOIsb*wGNhbGf$Ir5QqGwKl;}%w6$C^w>@;$?
z(1El#&k*qP0N7p$P&3xxn{9gGgb%pSwD?T;P#D9PP&nZuv5L}IPUshgk>oewtXM@~
zBb>jBm6Ox|@T<rKo9xsViS-yg-@j3GbQz~mQ+Nhx@^p*!Wtx_J4kc*?t`t{V0rT`I
z+>W&Af+rrkIdDZLqHfw{2@@02E=$g*^yL~VT+S7^p?OLL4=SuAq!Mbi#E*2PmfS%3
z%e0BEv}MVgD7^wVAktPa4jb8OEqNE^uhu5Uq^<TX{%LDs5)w2&SQ|4^SHQX$=&N9X
z7ML{5Pk)mQF#;fIr!}EC`8}fWId@7z8bw|-jg@?}mOPC5-l3tJ9h^@xPTQ)qyIqV4
z)3|N8|8y>Ghf7OdNVUH}wZ+v27L2^wz_cF{wK@G&5J=ukHNKq>DSeyiagFZ?dY_3w
z*$+gz6GNKz3>Y;Iphf|){9t;oRQ$CU;z;lZa!NGS0QjLSp(fIwma~AQoBoVGo@Xd6
zqUq1dDM4#f`e9{tOg}0YH{vJ#m|WZ#I4&2r1*=i=Be|Y&$#Z%$H_b$UEDZ(;HvK1h
z2bYjGrJvAuYDP0y<~2UomVTY^LFg1aeU(iZonH~-*V{zN0$70b8*DM$#s&gzw7D1{
zL8gDkCN@(&RN}QkOYmW!+?L9~lT=b=6I11ad;rz9TrMG9Pp`4%Gr;WC+6o!qF4fyS
z(=u{_(q=2okHI$=O&}4sOHP@E^)_iN>5f+VMw@UG=!7wSlWi$idJ(Hh`sZw`{J>^g
ztsl6>wvhoA-sf$?z_Ju>wcW!dOlXU3Cj$qsL~9+k2N_^i@3eI>K>D2CY1{8Fx!d-F
zAJ}1gm4Uxr2DE!^eGKp*-Di7;V-yU0*(R5Kh90yf=+kraP~$5$H;g5IxZZE5k%w#|
z;zq&8^sm~WWWG>G`olK4%D=Y=g<rSHRh~6*k4>)f40YM&i|_(Ndu=jE0ZXB!KWdXf
ziYyZRW42W~v`5ouCZvDE<|-EznbZBYetr5&#A%PsWy^QrhdHHCX!-#;WXnncJT8G6
zYV(^Cc-8^nTNq64!iX7wp0FhdcYvWMZAk*+t{=3e3Wzo5`!+W&UoC~M(I+E$VoZkE
z?o=Qv1C}ekUY0qsd?CDH`SIJ#8fmC87Q?4$_frkT2I9YN*2wnPC@{W_T(L+#g_QFd
ze1TPb^z?7Y9rCQn;C;Vz{C@`jB)vzT{Ju%R0eSNKHv%4)+w!Dq0DMz!%kv2Mw%nGN
z5bzzjEiWVByK-CJO2GFd(R&GaQf|w;2{<UX<xdlE$Pn7kX#ZxE^T@nHCEqv1RQP~^
zr;KJUNun9^14GP<LIR#PI=JMkl>nYG#3VUHz_W&!7n`a895%$fc$k1AhL{&m6L8cJ
z^Wqf(ju}sIYi|>9+<1zCA65f+&N#xr?+Ey@ae@Kv!t;ihOLo$lpBk@f##{(`+!B1*
z$qd^$MN<`5Cy~jE{Smjgk3-q+Mq$ut%j|9vi~S{2kZu-B1J!r06AS!m%5QNGr;(+`
z-K}CLdz|vy#qRZ&l-{_Cak8c&y{VkjWaZqStK~G=2lwV?PLrm(Z`sIcnlbKMJN)S_
zJN@a7E>4f9_V0WmCBco=4j-}`?%VzAp8F0=c+t&-OcA>H460;apfP#{r?JJQJ{nXa
zcEj$;$?E~Qr@)JFPf6ZJ>8WrE+*7$4?LghrL=z${S8(c(yFjk(y;N%kU2H+ZNg=8<
z`r^&FTM%+(rzXFS((JJyls%T?FewmIb{dxJekzy%s@dWq9ogP&d6AA5`0Na1Xuj(j
zS?R`wsOp@IuN)L;9quoAnB6~+;J+-`<@AGMFyEv6uL#dAWg5~CiGf`}>94uD?n+8O
zoa;}2T?}#s<?j)L+(PLtLF*n$?=5BgpHsSfDW^|TdY@2)4=MdfIp+@}MR>GUGfsmU
z;h-uy+V9JBp^kktzBFS5zMZ7K25F!%9-yemIQ&Jb%vay-mv9viRblL_0<bmX2EZ9S
zEzq1V&67nlHV`ryT`_MsMUuz;A1e78zU+_TOEdQ3TbR7ZkrGNY(aAj|tcfzLMqQhT
z7@P4TGL_!a?oBiPNSVRY^zW3(BH=G8#@%&DEyF$@-;#bNl1?IRT!hp};AkEreU3j6
zoj%v0B~UiI0GG&^F6m?Xr4D~gJN+^lm1gJQa)+Diq|!<=&ymZ(<jVng9Qh3FEdfv@
zL%(;=2T<(raLM5-0hBmO8DJM+zKr%Vus}w88Ms0oyHF3)uaw6w?Ddt(V;7Qo`a*{=
zoV*5K<@g#m&1>5tM;8ORv~*tM5LWb30+u?273Jl3nL}7nUSXFzgyE!f-Sia>VK^Tn
zpv>_qx5iG$N=F|9?B84~Pfea6wCm)l$;zt%T<=&V*4l-O0Nv=w6<1MK67(5|ycff~
ze%2xH#c+#WhrAb4L73%^YEh4@N_w@URzU1D-Rx)<5PJd5jt3QJy`xJ&WMk7eIQ9#O
zrFM(s2?5m;g<Bo+at+0W(ziPL70lZlnz+I-axu#8bhre>zC@=Z!9l90jis{t93GDX
ze!=1C5FmS5I~^{0+k_$y>AM{AehGKueuunK!puGB=o1y$vHYsTqlxPgJX~MHbz&{v
zCVU6YF*=@n9Qrs$`rM7IamEDXvL8~K{*sf&3QDP^|H`Q`z;s@Ax)}I~H2L?=1O}34
z0{DY7l>xf^o8ISiGccD*PC9cLxPpLFPNDET6;3+~xr8P2hSS493eAf@I!pb)f2zP4
z3AhREEw$ur75K9X{KZ+S8UFyw!T=C$J9S5xHqs{Ce+PG>n9WgGoO!^>u+y5W8CN5X
zcJQ(1TrA@U-4|oYD3m)i5`E4ka))+;N-mc>w3i7el3TBKT;<6r*2U~1f#;OS;2#6?
z^&>0@y0M(IKo?VOHn!?Hr84+eLBK*8{G+*$bCnGKk)GsSqn}|fcP*hIP9(f&##^S#
zFdjo?`gl>st*<nLdffcAx(w=(fz4U1OLw24I=w)tSFcOwpX)W4AwH(is7rUBp>_Hq
zQSaPbwArFd=RfBXK<&D8{%LG-w&<P?fy&@Ey;DHk%<cNl0BE-Yb?OfWKwlHkG$OH6
z?^2*$`l|}&1G?M{Fog$nxfy7qdJpPyGr(mJ>AAvOG4yqPvVeH(5qcKTXQ693UAjj=
zUnA&Iy;MMZ33^OlDxigMyK;K;S^=#f=$m@8fXH0sd{^HnAeO`-y+c4u{onLX1^R)0
zkAQBXR(`1O6wo??p4A^zFb|uNS8nB){)j01Henvu_Y3Grf_|(&q15|{8KXT$WhcxS
zEw}Q#8KY%MyrRD#>M``H8KZrX>ivfqm8I1v=QTuSwVBieePVL5^-NCjw@BMKZ5K~`
zuoGA)9EI|nJSe<)DlKP{aMQ@<<Xj|NDxN}<g-bP-X5AFwQqg6)oT;lcBOQrEYQe}w
zDv46=3&c*1IJ#h*Xp=6YUjWB4z6=TaTzC=Vre1g<(<c*rVXnZX4quoDN9A*7i-kEN
z{6^1r<jC;b&rp~%LpYFsqVz1`K*rLXz1YpIj-zy;a3Cj9dQQG(yZ~hJ%m<kf`<wJd
zdZHO*V~qa}Q%qLHPIt`k7$2I+u#<?`5aRp~8N!>QOwE|)Lx5+Gw9|tx?rTEsIOdAn
zj@<F0uheqx1oU+^p;C#_Y~ttU&1ZbV$y*@siALTPF3x`!h<R5E3Dm(J<dq5uG*Wt@
zphZVnc~_++pCH_;-6^g-a<0Vl5_yY6n;nF|Sfn4P^ff>*J|c$xVe;b6%jbGDrg?G%
zW)bd8!AlvXXA55bLO6vut(uEWAsQCoRRHn)6TY3)N8@^5F*~<h?4;xP_)Ua~k4rpZ
zW9Y{1RO@bh2}$OO^D^c}o|jP@dDlUbPY~)M6V;t}qo47cL?^l0XT=8dZ$QlRDgrGR
zogiD0SAk9tvJnF-#*|%?=5TYg5>C2AG$+zAcu*2pSqu^Lg*lT&Sf1z86uH8!AbU6!
zhYQ?X{zVsXbG695=t6AL=pdZur%m>BikM4#fiOkRC897TO|Z;q9P}EG0f8M6&*VZu
zb~?%?&yi#qn5&C8;bl}}uCk>BTq=(SRuFKRTyh!ha$R^O+`v2;2W7ycPv%vY(TWiI
zqE0hVtQTrNe`#`3Jnbs!GkJ_ZIntjTZB&6Q%VYS|(LV7`P4<g->Uc3)6!n{$F1pTX
zcO3RVsLfqZ%_$IFe+fA`(`DCb0CQ$YpMn>JnZPoB1DyC%_+rj}%;Zxi(}iVC<Nh5H
z<Y}8S`KTbz>0=JYnE^vQ`MAMpmf?>CTP%U+614csfk2<h3BIQevr>#}kSpxvDqpG+
zDd!q|8TG!r^+*Yxrd`4`_90{1rGh6;Unb~r`f|{#Wi%koF=)COPf>%<_!|5Pfj{?w
zuOKyx3Ah|bxaOac<2VW=+InzFg5yX2lIH~J(QqLh&taMo`fToC{-b&tIiRe!IOi)s
z+Bq9vJSgv^|A#nl|M5IHpLpPo_2d--UXx+BQv|#&!*1^p&?m!gqdfpl%CH;PIVHnx
z>?NO;VYe(odqalZE+*hj8Fpjfk237Wz<<iH8v|!#*zHQH^Og*|ttQ}4MlCbiLBQKG
z?6!x1Kg+P&cL?~447)Kq|0Tn2N2uh#W!UXS0{$w)Zhs`;T^V-clJ{iTje+-N*o}b?
zWY|qBLY<Ff*li*K{W9!UO2AnecAJDjPyf3ic8~K3_=nNQU0~p!#u?4{8DuLq`NALn
z55O5R-teEkG`snl(ND-UKScD-1=bP&z;_}Nxc`8ZzgROa^ug4&Y~#{^Ogx6|gE^q^
z8GxEmfp5{~T3<1@p*;9>yRU?I8o|YnP%)Wo`PAY;z~Tu;neiNFD4f0GYmgtJB6c+6
zZC@r+QA!*TwQw4IZLrh8UV)w0R3k484$VXrXEEWd!k3i#O-LG*_!4uaV1h7UGzAON
zr2!*<s31dHXa?NUC^L{LO)u?S3bN#`iX6j&Y<UDl&R4-iy_vOv_%F!OI~i~l1GqpQ
zQ&TSrE|kaA<cbvJ>RpVso6z#~{lYA`3g#!LQqBS#PZlg-6G7)t1y=|YLB~)9SBmsC
zgojuNBefH7Rg4yYJreYpo-#3J`WP;|8Cla2c<>zrOi%RR=PH<;$@u&&JzBv_X~A)>
z9t%Mi{78`D^mD>Ga{9+&N$2!Wq?bteC*1zJ&*%EnKNY@C65;%;kn=hHbC3UCXF+j%
z2FmH<DD^*;yvmq{Trn?LQ(l{hv3?0(xc@*Ubc>sJ!}jZ`y75_jv$1v07{-(ccgAqh
z6B>jWiJ~Vo6K5ogo_raVW*}l~d<_XPbsj^?`8d8<kxC1s6EJB$`d~T%a|xI$SHdL(
zTq3oK(JqziJ_DCY6=UFXx$b9qP-mXhw;QPeEcL7*%><O_9{9gViT;yr<J}GfQ&RMr
z7hIzZnHhG0P)-PI@g=7O4U^GMnSSGQJ3!4KWiq~iq;ogExT8x89uYIfy#Ne6DrXGy
z`IzkJJSzEy>?i~KWk(sUM|QM~&<@CszDdC2vZD-qQ+D(ZSD@rua+Yyx-_}btBL@|f
zQD@HiON40W2Nsh{0{=HKlhGTIrx~sI=I*%*aDNLq{8VMZgR*;6z2Ga-nPcD~*;fX>
zri(*g1|F6jXW;9)|2f8jJyHr>(xs2rj6Vf3M8?5>jv0zUubH8Z1q&61u96Iq>rrsE
z<bi=jk}Ly@B_#%~k@99>iIg`3OQpQ&erLflDQ^Z=NO_Zp3d(d5=3-!_ymrP7Tr0yv
z3|yzLV#zVEN-t-CTf1JGMQ-2*y&3U;bWa(*_W)x3GyD8R!4A=9mef76&*QHIFZaWd
zPs>G0`aUe9!h+8$__wNqwnZJZt?Hm{QwMFkI%v14gLb<VCEXt^xI>DPPP_~5l%iyy
zQ^yS#vL5tt+-3X-7|!SM#m0i|P43Jzwl`#uX3E_tttT@lxHz9KvCd2v){>s1o%w&b
z`x5x5isb)y%)CqvLP7!w1d;(!!yyC_2zLk~K@oz0B!CbO5fCSU;qVT40bY25iwC+M
zcyTByx*mArjf%T?<GQZ5cpt0o{;R&#Gu<<J%<qTe{y(4pe?HKus;;i8uC6{_zxVou
z<#|$GAs=>NSO%>?uWT^$bkmDudxsFGcPJ%keJIh|Lhajw5jVg(5YMrc4R3u_{EB!B
zHwRu--r}|?eoc9c?>iLlQr_ZGwfJ@AAfEGz|Ehe#)))Uxg$geQig&Ak0P=<k2#9`D
z1qAQL6~CpPLxg~LRCHjU{yp`m2Dg0i9=j1ibS7`WzprLc<b0rJP>BAAeFfN7Fx!V}
zI=zgMf2!#edOlK5eQ_%lf2p=FA>eDZeTm9_Yww`vU#YYV^B2XSH8JRh7<5Mz!cCYu
zyT{K)ApT3a7VCsxlsAF=sybfAkrYS2DL1uZ<lpvuY=n-W+YCMaLtByb^bj?MiuR%o
z#G_!uR8@~%Xyr9r_H~)VxJo_#Dlx?s@3C9vFf1_MkQo>q>&;S>1^iZ5z?iY$mf0Ba
zJ2D${d-iy@g62O`)R|*E++&MW73%I*Reh7~xJOl$FT;CmRe=Kw@1>{uy!VJF?H^G&
z<vk7&IUOp9yPJ{&q`Q&>q)f>H(nAFx=E_6OiL<Bbl*l=ZI%N@?q+EtZ+G!W}lsjc;
z`@__oGG4M3_X>s(N$2xTp5DQ*RdhK)ro&hFkwwF9qW4jY2Hw%=)2spx<oj5Cva0~I
z$Ue>I17=-)a#lzuuIMeTz(iVT#Ta^bkgHxU*!uu!LGT<HE+kfq@3-_mC?w6+c_bmU
z1*jKoz1v~ArXIov>=+x6R2$x$LT%{km7AS^!5a`s6+LCg?^zPtQ|&haR{KqCN6$VI
zNj!q}RB!xa#ne~o!_n4rfSC6I%NbN|c`p&rhPm8#2~vwNzB}ddO{r{t7>9r51=;^r
zVDN#Cq2T>lOl3{MZN!^T_m+&ot*;zU(2b~lds22!0uJN?6@3qqhT#3pzG{DS8ndZm
zUsz(_?rJnG>?=bu8{St9$zUi}hlPau&4e9nYQN*9rI@+jENPuhB)Q)S^yb8a1n{q4
zp7$t$CGOKq@c5RPx04b%nh4imdyvCD%KMaa*t2rQ$B^ayCq~3I5qE!eao2hjvGc=Z
zCVMv~LI$K`XHNuGQI1?}s%x^^7%PN=pPzJd<&N~yST=HEJeGG^EXN?;+LWkvXdm;*
zVLg`j);@Avo{KE+Uq0D}#@3^wRgDqF6R;Nn?G23afOs^amUj%L<TlHyE_U?*T}+Q@
zqPyd1zo44?@PMDEh8{fNm!?(<M^PvghtxQPN9fYkI0Pg^4Lv|I)oO|#J}z!S3s!Wp
zoc`$uC%%yBpCRGI@zy_+_IG|HR*Gf%*~N=o**I)oO~p@fEqcstvApiUubvh!agE2^
zmbxKJ>cNi$6rbwmpi=Cj;?vwP5Inkex?2hacVCygvVVv>!)Lp4QNb=OKF6&98}3n`
z>mCjSQ{#EAECk_*^If^Ty=W?xS>Y}P+tGD|taR4`89JSiRqlEqv)OqUy4!(Zd2q42
zLnD{EJArWLD!$U)t&ywTkAdLn$hGcIbgbSOnm`Vu1WmfT_*~iU;_0UNJhk0*@iBy)
zueQ53FtS2zcfG*KO10hf86&IIb{CKf)OOeOag;+RWkC0vj9jF)yMAWmVzu1`<Px>r
zl{cPpR;%r<QbsOS+g$@0xlC<$A?I>$HbhV1oGa9J*BOjlskXZ=W8^Be-E}7;YrGXG
z^F}QpYt?oazh_c>wc74Fh><^e;&PN(r?$I#bIvttyQ?L)*|loBt1lzhdD1e+F><{p
zEps{}H+VZO?{e}}8*X-&0~*^eYD~I|b8v<jaxnbxjT`qF%Agz2RK|NHo`-^8ZP5tN
zSFvnsEal9i#PWiaqJ2w?)q4ZzN@G-)MF`R>1Mo*R@fMF&9TTxNPIXKk2#d$tVapp&
zJS8p^aF262vAh$BnoodLIzSfNTwp*u>6u)O0c!6Xa7j+9>#4wiaA84cKo~vwb;i{c
zZc$(i=pbdgFnoa8hT++70IlG?H;Fs#y{OKdfij)4#RFSNIX(bwU>=PIK@yObK}kNF
zmop$2>X>zaVueY}TE?usVyuG-z{>j|g9=3|_v=BeWy%8FhHhY-KqX}2K+7#5)bdWJ
z6mHKco-W;LJyD8hsBQ(f&-6l8+Ra4nvxUphuXw8G-AAy9V@dMR0;VN|4R?Q6M(FpL
zkwJ;2y)47~j?z39<^7wp(L^u{jO;*qUz7TPVX(Z~a7c`ZIf2X2`wuZ9WE?}N)rWn@
zzv35NZ$>-=Ohh6x=ki!K0!D~yVnkF6k|k$LEGI^EpC+2+Jx?jzxwAMZBRbQIy?}+l
z#b}onkSOLY$l_3-Q0JrvN`bKb#TkKeAncIh%s>SYJkpgFkTDuL%>q@(VatlM1M=|q
zK@$jR9;ikRR=PQX8X#<Nac)3{a<p!Xz*6J@$qO_B+0Fu5237#!)+jCrtky_jU@eg1
z8p>%CSPx_lBSnD?Kz1KX$N_=PW#Qts;)t_(5NoF#@gO5~a3gpFtgJ)8>Q-1>BE0ZZ
zSY@MT?UCViA=Z3u)at=<(}u5$2M^RyKX{NVsTUCA;EGUe89jJND2#4$24_^#bpk)$
zqgMJwD~Sl$7U|)^@~S4Q9^6}`-^T^}NT1@S8%)jP{e_4U#!nH1mM<&*MJj=5_gAwL
zzXc=*HTt&-1GxG>fgHF3&0_`SMJzmSWd}oHI!l&(n^sDR>Z`BF;$S4Z{8d-ncpM|I
z(c-`xLlCV<DT-8BPLB~RFG6tI$&^4;Rq<a%)Hg&a{+kk&#?7<a4Z)@YM&3}XjDs0@
z(=9{}G`^*l96dSbZMEd6V&omQ<fvifUA5#`$jEzc1+9NbqjYb>(k#lBs|V>&Z5ikO
z;G$D|T?sEya5?9(FQuvs(Mg<4<n^tp`f*K}Ts~lxp8td>=*AKqaTTtR6&pXISD{vH
zn~AX^Q(B%Qvx0X2ynBg=mPfHrg$(U4Gb>%td%L39-n#@D6DAMSm`dfQ1<#0TW=*3R
zTdIyx1(#6q2|fSGJgBnNwm;*Tjrk=58DJq2Q!)<_mN%7hVC3o{^7b&V?S_;|RP*34
zq(>>b2D1-2w8DT7H{dD__Z+F=!>TphYn+CA*J!xUWDS?s0cJN0={p-R_kbb&=4-hB
zQoyB?h(4eZaA-2Y16R=g7ZFjL(jocCfuxpF8`Pkcw3NVE;5m~e6-X0-UMSmc?A{@*
z!?gcH3~4L0=+P*~J{~e&M8C))rikdjGdxqofgTZY-!lDV689<r(oAR;u88G*L}`g@
z5Po7VgsMSoMioWRoSnBydL|EXc^9aj3FJa`wE*NI)lGq1;>yl6kkzWs@{&LAD%EGX
z%6ZqQJ`3bp)n~zWo$9kMk{Nk7s6GqiMs=CMV_)7a>dJsGp7L&WYcL!@!0m1w)t^eE
zk+xS}3{SE>m6wPo2TdV(b)eP1h^g|@P(fkkrQqSNRe70JNWQ{x1(lamA>{BTOXZbe
zz*D*ORT7Lm!&k1UZgu!^^mlDdL8x*qc=%pY<<(La@Sl_*AlKA^iA}G(Rw9ru`zo)S
z2l^aVaJ@t$KLJs>z5#T=H!KEx7W3RJQOZ87ysNR*vuwnpE2uj1h{Jizv)yX-KGPqw
zI_6Y9hO+lC{c$mlSI?DCP&HenG4=WN1>wr)!SyiXFIcTg`0tBW$8hC~pu<ToOX*KJ
zZzsDxdjx^}t1QVLr@-Kx*f9VdT6;5zis34|A<Ehz_5?|=p6sBF7YA)tSSbfc!q5q#
ziX3WH)=2d8&{A1TL*TZk%r0CyTq(UAjiR0ddY3pV>3<OuF~J5TE^>y_ij;ntbj2~W
zNOZ6xhqk5ZD~E_OskR}=7&|etp|2Rj+aTr{K(b`?!%DJ-Xs+zL@c8acXCA%A1UHs{
zoLJs6$}VwnGn$89>3`wkW2OInNV&xmRR6=usz!CW4t11Mt9lvs5hl8F|3@J*O|rV;
zNp4#!`zsQ~zr*Ra?BSX4fL%u@LD^XZ@Gren$3VI~v)8VU&{Dcs;W10^`wjN6*B7_%
z2a1c7o|8I;3Z_k<1P!`j*b=DXPB?6-IGYU|)+lQwj{afGq;WxCE~6&sXUi}L`Z+S<
zf_|<Hd7z&s*HWOLABHZrc-V@LfNz;b@XAsRuPW2<1?3vPutLKZRRQJ&@32d%0rN04
z?9v(yUsk8#%V%r&3hBKZbi>w2FXj1T*wu~T;WzDv{b>c@w;5iyy4Cso_u91uIm6^k
zU~aQv*U4bS>#$+hlk=?XEyTvZBU;0=p(Etl>uDk%K?7G2Kf{hVr&H<wMnnnY_Xz_3
z>S5v?w1lw{JWOo_L#x^dK8SWxhIN#dIF#W7S6fBwV#ue>-9bbIOcBg<`bSYxJWZmO
zdsFdr6}8+N#WPgY0-32M3Lqz_5C$?^g)n!G;yHAHhPR#+Ne{yYrLoWUpij=rM6<kI
zl%mSBhs)y!+&sh8182PXH@qN(2H?H8;e}F7)<3+p4!GfMbifTSl7K_mwi0k`;_!Cj
zQr?9dUR(;9fJ-E>0EeqUXP*pjF9F2&_l9?<v%E8BL~DnN@kr-Vd#N1@ZV}77k$JGp
z(mWhp>XFsQ;<ICWBDDY6RJi4R6(iyjHe)6UV)r1iyyk?XEeneW$|X74Wstfg2Qt``
zD+wSKYTN5*Dp)*(ig?Em1n-wui8uKH!Kz$Kyuh$}<^lAU!t-Y;RMkqn%yC>*Al}@>
z^un%m^a~YK!L0+G9!J|w3=$ux&+CM$B`rJOdoMm49>fZljd!sh&CelOUg-EZIoSAy
z|I?V$JD9TJm-6C+j4P~z)fE=cjK!tuq6$bS^V+&|pw#l_k_dE3I45VsiEs!@A2Cmy
z!w-jyI7!CEYlwS9geIgL2w)4X3TMOwU8F{epm=Sd)pN`~F;tK<Vq&YmGCYYU{SlME
z4^e7T<iHs*HKfOu5z}dG0UMh=;&^F-gJ%&utF#&G?aA;7rF3^EHj!2sNAb956*`9L
zNa9NyO$q$8p;+A}pL+tiCVHFvEJn^!J84%ivRv(?-Ns1t{`UinoNtG*vfItbDz)F8
zIh&A+)E&*fj9jKRziSz}+^#^GdPc6WWq0BnMy|B0k+YhStJGc4+ZkDB*CFR)My|DI
z13{VV?D;@o+x7NRAn9|6ZN0i#d;lXi+AEMVh><_5o5f=pxkcR{KAn*b_If)1ohl>Y
zifge@1v%I|Cq_hQa*pL)9V7B)v@4t&V?<$kB!;6TIQaro?S8%Elg;B6vL&IzzoM%Z
z7U|^>Zmeh^F`)=7=UA}3LCighMSzhZ<H>{--V`E~xG2Dps?2KOQrx*Dhr{0TR>oK@
z?@DICkQdveRZrn<iWP-INJjE3Wf;qpBQx3)9z7!rFwKfzaA{ohpv-SvrVks&zoQ)6
z%ch1hEaNfT<%HgUpd3|`z683Qkhg3~hQ<oTY_hzX81W=#NAoN}nT3?f)XeVkmJwQl
ze9OBimbHc;eNfC`?^eRaFy4uTP3~hvQyzVq*<YcAe{BzsJuTd}jrTrL<){{Q6w5b6
zNEC(n1T7+SPOG`ZGn8bhGhPm296pPwSC0o59cX)pQ*QQXO8D1ywAS8MpV-w^O)Ev0
z$UU($h`nevxvz+?+%SgFXnrwK;hR3!D{-wKb&B{{Fg40#->2v!i#q0vl);Mc>W*wJ
zgBVw2WE&bbcN1S{wx_)46w%1*o}yFLmVWw)gq)@ZB7V1}=yZBq00nZ28l(VUN);_q
z1rFf?i|K(NkBfSJD1o6=lzvCAEn>&O$Us!gN)f{zEn20-G_aTp?0`kz;E7cm6GGW2
zS<bDTXIY~Ptyb3%=cv}9g3?j)j=-Iacd$B^j*{ERd`{vhbsL#Cj7F&^djJ>9ng(!*
z%&<Jkj|z*&P_}(oToz=7UFa%rl&qNfe7sQyN*+(AqtvG`u4BGZLs)0E;eP~Y^ke~t
zkPgdwlksjMfNMFbdkA#EWnvk3s!=`E`hej>`O@3Fn2O4^($xf69-mC^{h2_xC^Y(T
z2zrtTqtz=jFEe}uJ$1?e|3-I=U3!LEdhZbx?UcP&<p&F6`I$vU-bwMTP&jya7E8e<
z>j<d>Uv>>XlAdC~NI;p@0gq!2(NdVVP!8I_5z7sZg{c6@B1iTx`B|&H#l)owTxb-y
z$SiQND!|Lbyi16yi05S0H}E+hz_iA?kIa@aWP1#HE(Yz2LGKdOoa?j4&3jMOayQ7^
zqtpU<-_bk6d4E?nu;#oE9N8J>jk>%K9hr~0TjYK0l%t|Jw)-<jW?gRJye}QukOA_Y
zBd1QH%=eB=w8;6%k%^W^-@Kold41VRAOV+7vY)T<AmPO_5u;?tZGdW6n6B;xJ8el!
zmMar6H&|XXb;p+v7R<|5cYNy>5Yp1!O}nIYj0z(~Zb)8poXt)vcGX**I8r_AR!ANM
zc5vql1}hG9mkO4(kjfqGHVW2?vCgh~9W%_>p{{xz6G73_RWD#FY`v6I*oHW4vw<Dv
zZZoi6?sma&)O_#gr{6e0^ZG<T@20Sig;QZ)#bG}gSh@MJx4iP`$KFsb_OUmGsTV$h
z^>xGYDx<<m<FK+gtlYr*ML+$9a{b&Y$-|-M{oQK8&=rP8KjC&S`*W15Ue)|NW8>Vl
zaugk6XM(%lz-ru^1pAyhYuyck{lM5{ce7x;otAf;yVby^xc3Rho7H*K+-<ImKZRpt
z<A@_~jM_LloPuZ!oh+3-ngISCGpS?fm|7}mS$uBgF|+|*G>`Job=5J~g?ZDBF<^!{
z2Fz6bkB9EO<5m9yGK+S|FoJ~hUY62taRAdd=+GT_DU$b!BfCC8UUgbWhnyRw0FPRE
ze^v#6+!XEZoO3gAdAaNzw%#j>LVdat#J|FIcDGRBTAA1Qc+kSD)x0*D7M+EEqInGi
zb;a0BIDqGzvFglEz&SD#09IeA0h}-M65v*0T~=LFgWj=B(+?@9!xG6TH6F?p)ws@J
z$f8a#PJQ19a95hNKZ@4H`#K8ghth8JypyA+a)t87imxy<j#IuGPWgG`9XY_B>za40
z6A}z#Bc0?$j|z_^E?88d8fr{?an)SP7}J3oNZM~qo{%>%xux<T_kuC4)QaRe&S|SI
zjSynRv^>eahsgXJ-@@BQVD=MHJhwzHdb3}TQd)X%G6%m1h7$SSr-bJ*EZ#a+VwnfC
zV^u8YG!V?2pe+diE9?#Bb&v_72a^w=+I#$k1h0RT%NrJhM#rGq7&IdWokURfQcCzY
zVL?9sX`CSK%7#qnp;rwP4wVaG(0hi^w415ug!wrI^C$EIK6f$U>K5q>oHu~ZLz&PQ
zc|6}w=qK{{_^Ao~)k!+vGvhF;W8s9sU|h^XDh$O#MDa4FSBm0`7#=Dx3_3hV3REtl
zjFEJ$J)uf#RqF<5JyL{0z)|X~mL*(hJS~_e$gLijT5Xs*#;E!+qV)l`V5}^d0FP6v
zuP0g9bQV?v3wQ-Qp;m<P*f!xf5%4+lO`~%RCrr_NQ-u#@>S$qroK~!AHrMHR;JkM|
zVV2~f@+YWz3}(i9W|X}Qh*5hPU_41w^UypY!m{+Lmo}uCg@2h7_1cEwV=YPL--L`V
z{3kRa4OT#)QVd1u#2fowU~Trxs#wj`j-i^VD8l0}@5Xx{QeGwt3){6<Ba3@??K-Iw
zuk~tg5L0<*uf1JeS1^1>DfmI(QV#f*B}Cs^1-R-gg8x#jc^+G;;m22K{^!>M=1*wU
zzOWwfI4=A82F<_wr)F#<58kzJh3tNe@cwV@yCI@^caUDx;$yq^eU!RvDP^jUo$>fl
z`{6dw*;loDw`=&vCjry>KvwO~I{^1&?f=@T;a_%R9^uBS4cdD&;@STIg1V-w!!rh*
zMr@hU!!zKX-00yMs92lm0U5{(+iJPQQ)+Gd=y?@9c-D5b)k23KV68pa-k~0Z*j76W
z*1_MirLDT2LM$hSK!5y9f+Nx;o;sD_1y!I!VS~{oi|Rm!SJY`>sO1@Qb8R-|)}AZv
zhPb$(kuOHX^%sX$pfGH^WG%h_N)}*AZP~ROWE{VjmEWeu@#h%1U5(>!GIEC+$AR3b
z9u@;~m)hb2vQceu0okOsxc<okwx}&Gi+z5#+TsFokJ{pTg+q9&+TzM$wtLkUS9?b8
zvt{KC<bGRL-iLC|HnqhC<N>wC1q&WjTU_wkLu!i)q4}JBVQj@w`@DS-5U{<ZHot~)
z{JpF;zks}IuLm2#=5>1mkoTzz*Y37A13|03YfBLBW!wH?e~cU;AKG65LBoA%)03GG
zl55&<yStpwbHmgbyqB5CwkYCzgqJAzvsm5_DDVrVnB}}6sVi}XnoF=q;ENV@Bkv$E
zfWTu9UH``jwEsgeBBHTHZFe={bIr<BM8M?eE9&r5Z}pHb_vqTbc1|vdv=Dj&Y_%kZ
zI|kd9EQ2AUGI|CJ{5C9l>dIe9eQj0rER_!!JIbzTVSfLWt|X~zMb{?Ycf^C4eS7VA
zu@|K#87q<6$tukFW@qhm6=pEwcok+qPO`_LS<o*}Rxu|XP{rI^r;~t1D$Hhbmpx5|
z*(r>irNV6d8HCU|Hjp-#5jw^O$XSe>r-JEfM$T8kbTJFKSOwDtMlM&ubUU+MV{fy(
zJ)|D%jH>L1(UDnE_OmjYu%7JaWi(+m*)Paw!dkLlECfG`%6>Tvn4OXRMk!$K3fX(g
zG|&6xfJc)Z+5f1Z^WUhT1QKrUO5D^lkwLlRE6=2!6Hi38<XlHN>gKSN-^8rg8GV+Z
zCNC+!L`2kfY4)A4hDZGDjZ$0QgUsF}wPk79o29lqBxm0vwdL^4-dcgO+>F`xRsrVQ
zO4;|-0EQQ~)d7YV9+(Z7PsPrDa6X;?NG_0?!${s4qwoJRkr~k&UGCI$|BH$I+MY?g
zJXRdNn>p3psk?k~xU|%{eBxNx!5fMb$4Q-eR-9NXbuOS8Z{kF$GvG;uEvYQ#+liCu
z``+Q$us`v*P$`}NM+LGEri6bJ`;@rd81{JHfs;eE6QK~(>SS8ou)Vkd2pU^A^i`4L
zsho^7^)cv_C{(nHAa!-<T@s~2K~B-<P{2E{MPEpb`0iNIUa1k_ud-xSu-%<B4%{6Y
zEo+i`a)|3c=~!tWz%}#1^9=J$Y{Ys4^hxU-jZEGk$ckmeb=+okTFLB5hoda`)%F`;
zbz%)*bz%)*bz%+R5n)~S$Wjd-Ri@#Q(u2T%bcLpms?zZ2Y7JLQJc55rom$~JQ%YLx
zrrJ#jTm5sKDWbM3Rb)zgtJT+>(ZL!(866;J4rd%-q3V2<J*A^1RR?llz@cw4TlC|>
zZc3*dN0j6^$Bm2?KkjH@;l?;_lqwEnbU<YB9s1*{Lv#mi5vfB{hpj%#2<G494e8Xm
z=-ycl7I!)JB)Nd$t~jZ`G&<mc`l?{kAPIn%NX8`f_#faQbf5mss1mxGe~(~^yiW*9
z`;rnwRyel=72pvtS8W9IsF&Mb1oLQ^+aU)$JYwb^K=<OiE+-NE=7`suAnD;8`||uX
z-%Pc<>bM-stBb?k7`y60>U*(F&Zb>Eu`OG=)e}@Sdy+WdMTRGfZG1Z_`#7-;1*ed0
zJBT5T2Yc^Tf~3lCM<Iv}OqC&y=h>+=Xn4PH5$kL<7nXVS9RsR?HI%DSpf3DtDBCMk
zn<QtSLr812C$pB3Hfq1+F-F>|4bm4GDRyW8IgU$DrzGtJN?=84mJCuuNlTU*r0%55
ztnpI0rx~6gl`E#8%c>Qt&m^H)6T_Cbg&5l4#x<YbCEro!@UXn+<8$^9s&0jUNFcPA
zXWf7%<)gN;ZWPz@aGs^UG|kgO)=i?ZH*36E`VZh+OHp<z({C%I>wf}_2c%#Ql;Rl#
z+%#m_mN%0b*+#hyrWs{s;4<Ed7|#Hg7-w>q@UCSdq=9%pq3%PR@Z%?z$6oOGAt3K*
zBGMKJm8AA3IPGtgV2QJ>?qFHsWSwVOb){;F!|heqNiEWm(^)Ojfpk%ebRb>TA|1#f
zYLO14n_8p;>8=*(K+4qW2}lpMdIEB2bdk>H^i&Hb<Q%3JOh9_6MLLk)YV`!9k6Jwe
zDOal}Abr*92}nP+dIHj4t)74kP^%{(1J&vY$RK+&?f;Qs(pcio_JkvL)_QZ${zKWx
zb0u~FtIIKF_vT6DwmF~RlO&F6&L%h_aRj(t;t25kGRR!X{0qwgqnDjr0hrD58mctB
zs2VW(+u|BcUs|W(Q)UCMUP)!u<sRgy!=KST)#1;VFi+zO@L$L9^3{O(z$5SMwRHX)
z8HP9tdmUtW;I88xpoWKPw!5Pm5#};-kVAvfc!H#7uv1+2hB}0<-Y18hs2=9In6uGS
zQ1CiJ>HZg`uwkjEUMS=e^fg}#<5gSsQBcJ)znA8vsaOVENX0U*)VvH8%V(@0B-8E)
z0oO3nOa=C5jAR>uP4~FV!3H1Zs=!7A(5r^Xfv59~!1nT0V55y&s=$Wh3shjA%ieBn
z&o}PbdvCX=dL`bozkv)&yM+=2;f`sapn*n=w5(~LN)Q76OakmZVx0E51kW^*HSLS-
z#<fo)J^#ewzK@CvPm_y+Ze-20M?~B(h98wU=4pJ|c8O!akF~Xm`Vj*r@pS!pxDIp<
zS{kgkrZw}%6Nk}^#}jI0&*zkWbrq;dpiaIa!mV95n4GbS@@3w-f}pgkW9Xlw5H2#q
zc3n4#L>61u-Ld+zR9>Lel{s|lETHiogcl3W&0lw@W7|Ok?@4&Tzz-wbHSk`9I|kmH
zaNEH95N;WGIpJyYzB_M{*Y#BsCtpd_^;g}5@3z+sP;=!m7ZNhi;Zqc4Azn9#WmIW=
zFyWqoR}dbQxU0H|3J-It5rpjix+9!MAj^*?WVj<&lf21PSLJL#&LA!`!r2almjZQ1
zIy*FSl=Fgi-$*Cmw%e)kqsg6Z4SW>gMFu{a@HPfsO?YbqA47PdfgeM7fq{=Dyp@5E
zBfO=7k0(6ez>g(7ZzqhunX5Iy*#+bkMrs_{N<n<pI&UKf$V6uk5O{2o^RY%IJF>}w
zoZ}q*C9JwB(a&Q1$g=C4klZ*t<YL06(MK|{gE5G)=}sZ-RZgIGMVN1!-Wwg3$D-+d
zq=#`hOfL_C&T%rmuk<i(o9X?eBXiqM?_UZYHfQ<(8SVLY?(~6mpaUKxqdnlk^EJI<
zsfLF%YB`lM+C%10HQKZM!`Et_Ve2(~#D>^K;`HGZnwvFRMUhD}=1?*f9TycYn~{aW
zysJDT`qU#Sn4#`>T}|9G@}$CS#Eg8YFkf)YXekxuW}4BetL0rs%q8*!l0E{qu0Rfa
z-S;!t2CuzOUd#KHq+?<!tUEx46!hATYI4Jna-e!R0A2WC`pAiQD7CVzwcMBIk)hsD
zBFMmXG(ix!yY6HW$m_7W1|@JU$HyXP8v+h1j>W1YVm-D*bwnUbot?D))2ev<vb>Ek
zRoe)Hze{JzmCSEMm>IU<`?O04R#!5B)s+n3j^ca32ZrhMk;E+KXT>0nDUUvAB(=%$
z{vx$uk9gZvZMgBg$Jir>$I6Y0K{ZhbMuz9)!LX}{IwxO@<hAx3^}Z0-Zcd@hIq8=Z
z+=f;W>xemRJtYvadX^lXxoov%&B_xIFEgw}>}6Ozzg&1J!EL3U4>MdMF_w85!3Ri;
zbz!)38O$2Z@FC@Z>lyA*q2a@-0Iy<tpK1;Fs{wp7(^ZFjkYUv!0jm!AGSgLu{FdR$
zMwI0^pEZ1i<()^y%eENSJ$%{V-b^%{t>)fK5PkoN(%7SA!FAq)gu^qT<2ync-|jj7
zK;qm*IVwUSi9PLdaV6<H0*&bzkF;qX6cLr}$ae<g5JGXfg$OekkDwgbl5>I_`Fb)D
zPB>UviKFI((hzI}+=*U@UK%YCJ|P1+98M>wd*$G2Zj{K8F@@`JLau}fc=9Mr9w$j{
zP&@eUosMKA3zK*J{z<t~ZT$|%?6mge(D;QGDD(tg4mFSR9b}@CT8LLh`G!llp18<#
z4W4mYhHrj@&X3nY=fCN!_@dPQ@tV1$<vkitoXxKEb}<nR3Xk|U?N3?}^0}V0@TI;d
zV?iN7XweOGd!T)I0-LMOssXI-Nk2@Ca}Sd?0bQL`y@ToM?46P;2riet2Dq>EwLIqO
zCw&cYf9Y$02S{H#iYCjs1EsHVv(6o~7WS~!a|f@tvU%d*-`uc7;E9FE|Ab_psGf>!
zL;6pory_L-oY;I{Apm*+DeYWxExe9Y9I|K6Jpi)#l6-DQiEi%0a}ShQg-r*EFHp~e
z#TM9I8b(=;+qs=e0rS4Z+|FepJUmZcJYpg9N<}!&I`cY-@b_uEW*$9r=-or+V3uk0
z8s*xa{q8MO*F(4jTCT2#F1nI(&QaGxHKfjqK4Z?i5Z-y}dI;B?E7T>>uUuxOx&+F-
zijWJ`B@nK9E>xF5xazssxVHB$F)x8ut4pAsR2}a!bqUmtrCqKrfp9%^rMkAq)#n;}
zDe;neR4?p3A=Ser=aZ^>Pq1}QsT#e*$TRe4h_{0vx#ZkP?s2)^>XP&CJ~`|#b;)Uy
zNeO!_me-1iB`!;{ybjDTjSFyZqWPcjJOb$Z*90Lh%1@HH>1raJq~<2T`O<W(?j-f5
z2gkxm>P?S6%wHgJA+W@Sz;wvnO~k;z;O%<kzuDVL)U*dE5jRa!-|~HjDAUr^?2N0p
z5M7MxJ74*h_a(8wc9<QSQ;aa2P3fExs!+2v>JIznfGcnRJbfM2TfN|$cMHLVQX{}^
zB+>z^*%olI)aU@_4@-?I8SWq>z%+&rEQjhwhD$2|U(axtD!`90+)YM+cNp$b1NyHF
zA65sr=vIRJu<^7v&2Yc@fX`rf;8MWXFkI0HcniZrR{;Kw;UiW9Zgv~NRcitBw<g>p
z*K2s>2Eb=C&#29SQOD|SfFEM|G1~$6zMbH4I{^R0@Uc4qNA4iFW;fuq8wsAc2XN6Q
zf+v5h;VEAM?!xpsc@_e?rdxJ1uH*vFm>Ck}enw{H2r_&#A+rkwIbtgzbHjo>%gDS^
zL7*{GW+3y+1(|#=u`R3+WE&$5Re}t@kC4UHf;`U1(i%a2VdT_0K~B1#kTYfrvVoDt
z`GRa?WcgA-UfM>;d5wZR@BkqftPtc`MlM<{$Ty5!vQ`l1K|(HFFGveUF5e)?sO^MY
zwONo`7`b|zAa60UZo43G;&nR&X?Tos*6%cOZrUx#wVZRy9zpJB<hG9uwmZKvkc~eX
z$YyoZ1A6Wb$xRO+TXO`dc#@>uS18ErrwQ2>7GxnK50(mY86yvu3GzH6kCqF9xO}Wa
zkao{d&J$IF%xC1OYC#$qd8S5?Zy9;6PLNJJ2zha~AblBmdA=YJ{mN1Ud9BevUSA=|
z2rl!t)q>1m<c+n0oX^PH>jmK_G2C}I2yz4G?Aa^`^!$CBAh7x$+XdOeZ2#OL$is|$
zyi<_e=Lq?9w;=H77kdPO=)E5sIbVMzNVk`$%(p)YvW$@*EEoL;Wqu9`0t<f0F_7O1
z1-XmM{3k4rz&^o<ZI=pG`Z8ewyG$^Mpu@)mdweJ5HM1)OdzG;qyGk&4g?0!9`-t;e
z+BJglF;Z@UU1wme?b!xaWX~529&BeX73^1*Qerm>*6S6*=(!@noL32>ldp|(rM7xd
z7`Ak_*GnGi(AC}`*w!>E*UjE67&y!9Z3cFzy<M;ttl=<whhQBT>uv88>`=za?cIVw
zW<Pt6U@vjr0Q+OX_#)UHWPfE~74}bpp}8w*e=XOd-`8C3a62Se@HN7YuyX`!!`KMB
zP_T}S9c70NY?NIp*y)@%#x4`=ZN|ph<$`_9*s*qnfz{eog3a1Rd6VsG!4@+%)vhtH
z>2{rg&9r9=b{=!ivgZr-2zz&qz0|-?v>OF`hB;5NR|s~=qlDGls|9<T^A^}^1-tEa
z!WP-<1w-AJ+8gM_^XF-<mP?a8JZtZ~nG$}}g`WQ-Jnd6TnzJi&>`0zm&#%AUvLg9v
z#qi<{gtT<7$YCB{r9@geYk}|zJ5u1R2g1wKNMUq0k#s~_JDW9I8@0WGGDXfq$l=TT
zNL#hnaW0o>r}jF46g%=kDzKGA_tt=gopf84IafsJlxsHai1k!{gIW!q%E)bY067~N
zi9UMPj;nKr`ijT-jNGXfu4n$4kh|2vwdYNQY_w-Wzyd}#*$qHeFtS<QZTg&%E%rIc
zak&O}tGi8Y7`ey3P*#G0$QhW!C$TAK(gT;g+~;2)(y=`Nq&8CZTtOhR3S}-?Ph~EM
zD|3ihMl^Jc`~}=_@I#h{AC}wWpg$7Q^hf2|8T9Qrn*Nxq@IZgOP}84~_q#!VGAv5-
zBX4Skw+y9ki&C`JJEAml16AW)Q40Edq7?9+T+<~Bn^rFr`5c-yuoU&k2O{&!fLXGi
zSrTycBT(Ao_1g@leQp+lCx}#zc96}15Gd(L<z325z*$I}A<Z^Yxt`1cB^PN6q<Kj5
zk+wwI3TXk-LZq#cwn18iv@KFOVzwA?iIIi@w@2Cm=>bS3!VUy{5YmH@mLlzhv@_B!
zNV_7H80!YOJJK?wJ&+!Xv?tQTkoH0<-z?|@xEyI;q|z|`0n=H1^c#qD5YoX&E07LB
zS}DD|ZKP0o_XpfLTdUsfaIb5ldN%^HNL|+gX{#P11VZ1IK<5NftWFh2%$3mfp^l2k
zFzAho2QzzA(`-;&q_Q#KiP1R`nu55B&^cTg4V_h{(IZTwkF>L-bRa_a++(G?*y?gF
zE3#0?kaMyU`ZRl@K?&uPg(HiUP#}x#bmJRok!l%V;_4`sh^kf_2QYkDRCOStUfBeB
zRg@fxTy9u&g|dkEJt9}q8!vs1q!EyRk!NggG{NfABy|MJ*1h5U<6*`=4GYizL{#xC
zGyhYiim!s_f2QioGt>OfjmDn;g}TGbR?q*EkNSU|RCi{Rsv})wro(*JRn2s$-XZGV
z9A+T8qll&e(%qqlI|^@!PNvLF??1=kZaJZrH;~dao<zOj@!1oQJ(;t4y7FelXD>$f
zX`Ib-mUnJ^_La!~6KC@*=G_#Zy%pIHa5m3t-V^cJuOWLkXY)+w{XIVW8)W~;**y1o
z_N`_`-CROx|AW#ro(;Wle0CYKdvSI@O5o&Bq?c;600lvB)o5^XABqoeM!blVAz~?u
z;3?Ky9-n;~ve$4nPrBX>v230OTruFj7?IVuPovE9TxKUFu*!)%Vnpqu$|`iK?Ka(^
z`#B~euz{<bPALio>Zi*oF8zp7Kf|>U89-*L=MRQ)&hak2b<6j{`4>E?Xbcf?TU^Om
zT0ctU@csGv(MrxvE?Vt|wa_tc9gw#<=NMO3B2YKhosAqmHL8A`I}Zr=yZZ6&d@bNu
z^+KpadlB^$+{JW<K59yZF)Gw&$q?q(`C^~*3P!vZBu18z?Fgd%FG`hT9y1*CxapWD
zlw-!S2~Uz^il!1|dLvYSuM|dQ?o)+Pnfr;~TS5Gy^>TtNZ!M+J+Ohst!;KqMK}fmH
z4bvT{Siu)i@Rex6dG%Kr1=pDVUu*jRYSaIJGX1|!`5%pOjXMV}hnKH)=hE|Ew?|Dr
zf*?A6mr|G<s9$C{YPspCvz4PxC*JyV*ikD8G98suzfcN4%`7LI^=(i`&!O^*+>nlk
z#cr0_(nb4hX$-%y-R<8<g*ZJ#dsMXlM`>pQtU&$SMh)IEYw)hB!64$Te~)W$Btd2k
zLiI08Vc5A-6-HCP!cBcL@r%|o38LqWD23Lp_5U%nS^?>KFHv?qJ*I)$qAxiCsXE%l
z4U{71OJ)lMx|)7C-e(@PivC5MroA`Se<5ni?<5glnw8z_$`uf5@|Amy_W0NCdNF!!
zeJ?4^!&7~4v%UJ5?L{vXqx7|`q^~*w3N`5G$~6~|{_d4v12Vw9N|daqKSJg)7&2VV
zV+h46b%Pqn2uBVr0&=99;eZ_FWN5h~9XY8GN{)7#>6}qcwnj!f&4EB^wVEO!ZH$wT
z93aOytu)(M^+YJjjC1JCVEQ#~q&kmxWY7b0taFggnc#HQNR4wS5QwgI%7NT|7YUf>
z3@95}KT#a<5L2c*R=526NkTzoCM(wfInI$80Jcm~egZO8xdup`@&*ukm_x#@9ou{&
zDHvHl!%#3&DFE~FN+z_;QZg^(f+r}MKxQj90GXpI3uLat-9nGoo>jzx5uMait|d{@
zQ#KG}d3RBYo|096n)C-~KHcmoXQ-ZnoHJEV`HXEki>}p*ek8~Y{!snlA_)~5rX-=W
z9uXiD!nDmSCU8Hb^RHuge}XKpf>M}NTAw3NKB2$n2E~i$uPxMZ%utaR>}Yw5V^Wqu
z%6VGKN-+mgRw;8J<pNbPNVzaTQXYy)c?MEmh)T(-?`62Bx9OffrhCejdonhYd-}3_
zS`lQrXMO#_A_-$dsgeW}It65GfUi0SuA%S$QDO1b1cEGYGNtfMPW@emJsVAXHYs~B
zdTcfawk-jplinSWPP&yu*55<IinbG^ENxE8teJNGpG1kXg?QElEbN;h46X^($P-F1
z{Mx`|!C?7yfjV3Eg=*~jAB;%<(d<e;sjl=e%l_HyO8-(}k8$l674{!6+po?QFab(`
zbJVxJVbH&wYB2%Wf1EJ}M)y+$!w6uz<BU9qHt2M<Tz7(P4)<sJ4ELDuTxo`F_18-M
zAo+T;em6Kq&HwBe)6mUkAHUU+7>C)ntHJibd#JJ-l^c+=Sq+a%Ip-cVA|mHrr!0qC
z3&{OW4~;ya#yxoJFV0~)=Mgms-pkUqJN<Od6ApbEm40t<&Qnf>&e`Eq0f7b2J0o?@
zOU_Inzj2vYoa1%QF6UMt=Wxzn)eavF-R*3(ih2+k0jCae@anG;pG{}}HOiZC?ONqc
zAXhuIPCkiv_!m4r_W9!uc}1+r6q!}er@qh+B3GM3?WJbST}DqGp<@N=Pd5sjVcKw}
zqwEaTFE@D3Hie!;rWK`cjW?ow{R)GBrQ+{LT=lC|F933ZlWUCJIkf&G7U}-S5@dOk
zC{?4iWrU5bhDMBVjv5-_W;ZBHgsWLsAV|Z}%><dlQK<e~>Eno!@6<qoe*8U;)-Msi
znD7QcmiI2D%7hQ3AQb(>9DzPGN5p@s5vVQQ0<8atN5oQs%yFj9u7BMaXa1_j85s1p
z=r{w5cGEaR-#?}DV$wW<EN=m&FsZEmLh%Yl_luNQe(*@~#X(sr+(^9jmjp}c14>+$
ze!&9$&ik?6!$cL?J2>Baky6NRTYsD3@!OSb*m#FI8QrNoj+~7_8E}DY3d)WELU>Ei
zSnk{%G?qK}1nJp>!|#ilF`6KH|Bq6b5vbp5nDLb|V<~0Ve;uUIJBJ{%d9&)@H~9aq
z_|aq^1dX-KhpG-R?w>(=1n(J=B%XMcAUgk)QkW2`f58y>qUnj3$OO-#yR%ZTCEusz
zeHZsAg6Q2IN>weo$*K~DbXP}V0x9#vDj3qkbF4lSxGeo57dhT!g4JdaF4JWvWg$@w
zjmx<}pNpf#);ZqgF$P#;6um2!!^YD0pJVt?Lfuyhb&sPv%v65@)83{8HOPtdkuJ@$
zBIT+}Tf`ZmN3`kf0fNA|t^P3a7CL7y<t<EYy_L@~QTGX6h;a%?d2lrl#BtxCEaq`F
z-!Hh8-hU$DX(vQA<V1!Trc^3ZE?`rJvMH;hj91hzG)y_!G^N2bWsx!k3Ks`gTi$CV
zLL40L7559uu)J?5P5UvbrZ94}*n^#sQOX{!SA-ttM!n#)YBj(0qC4}EF;v9sM-ZI0
zyMC-;={RL6mH^|GrC2r`8<e|2=wB0p+aVlbR1<s>2y$wJJ9N&(;0rouQgElvnH=0@
zd5@3{x~eq(#qc)>GPiXnVj-aRJ}mFY7$ZN+MX!v|V+A6J{Xp-(#c+0o+m)X>_&42@
zqw^04M78%UIKb&Xl&}T#z;Ib1rQOFcb|76d6jBOPx!{6>l~;k3I-%~TFtxLjQx@Ws
zq+0y=_JS^ouQMrHK%148)rs@I4-wj(g2U>5Hy1qADWrmjO2Id%!!GEl3i7bK;4mr(
znWwOrK28`y&Sqq=6Dma(Z-*`z;?w})n~e)9ojM@v7&+XT4diA<hCB0t@SUs$Bb}uh
zIodfL2!9KH!6^0W0g%zoa-B2YIj1kzgZIi7980e+q@Abn350tFUgOXk7Y1HS`L2Oa
zB-}CZNrc-5KACXqJScyZt)HP@f_R>hh_ga#u6JxVXyEgyWWc}|P`+*83t6&(H;|>?
zN-b{@<p&LXG0QXXC4{>MzLapsz)vCEHt<skw+#FY!qZl1eP<Hx8TeU*2MxTD@PL6Y
zBYPbKUrzb9fuF<mxj@T5kL4No3YKT!D+zZm(9L|2BV!^0;1cKJ?o%HomtXFzE(=f!
zzQ1uJT;W*VPvxvDsiOoa)grD^aSRb_XaOgI%x@ko_>;ObjTm32?o1=+8b|hJ{?5{`
zRkx`j;yUNX?jN$M_0COX#d=YNK)yk#0&*j1>Yn`wG2ZNKAVxk2jDC=QE9Z6Qyp7JC
zl(*5y+oXhmkzNzGx{qbXdz{T>4y6zRtF|gebb))L^@5GtoV&FH9&om5<U!{?E#V<`
zUmay0b{^DhkEomM$a&Ox1UZQP#~m4CzhK8aZ6eP&GT{EqIXfH~aDhDQ$QTR1Jg45F
z;rE0VJny_M17B#tEq3<-T=G`iqLE15m!D1dZ5M2?t?m;zi;jco7NQi^@C>rxcH_pt
zf;;HO01c*R5^Em2T0f;o_g=0bY6-?%%Ud7i@NOq4pLqidZX#83V8{Zx)1%MB=B*SO
zWYm%>_KAgsrLq0(h3#YK-7dJs_V|Q*&)u#@^uoxg(q_1)cA9E4OpK?il|PU()a4C7
zf*m<iO^nDni^_XrNuJClm^)?=YI(DxN=hSb<?523?Txfk`-OO_qS(!WyMUCqg@W)+
zm9QJ8^N&bGiF-H1-5(W~6X_)4cyft!R^nh;7yca49%2+@z9L9H5AuDq^tQ+xsWF}e
znX77y+5be<-!S{nQ~eE=ofPe2<oifOT_>XY_3B9wAoHCqr~r@!D$0Q@bndadQyz;m
zY%QU%P7>y$S(v6A@5UG-n<9_)a|Z4I#ByHX(gja4@f8BGAyQ~Z%4Gq=)s6I3*F4`-
zeq?Z9TUm9apJb1GoG5fU8mxVUkpT*6^#maU6|#bnLDU-9fIvkm0_r`mJ)Bn=AR?9q
z6_HP+QTWbf<TKSM@Z{%e8yGpX?+m3tzElkkWUm`W4$6Gx%B;-~^F+RO%a8-)8@F6E
zmPT4gWl%a#nT*o;>XHsQEdz$eR_cs)uoVOhjfJ$mhMH7IewCUWaVhEk&8*44P2>Ng
zj0c;gL_wn+5PPA-36yK&-9Uv#0)Z;gSROf0Y64LQnKhxUI21rmsWKi)I;oogP}14d
z*d=h7)#r0+9{xpsvc0bfE^&XOR6f+I-xZ6z8n=H$2O3a7!3#N&F@|@KF>M+fpiVZ7
z7^Ra{BL>Gu3*Hn_U-&wOD3QM@_r3fSA-mlg5ndCyL0k;uZ!}%}XLSPsIX9`u>C2^W
zRyPpNVdNGwSZ;M?>j-5wxZ-ahx48r0J|MTd;(Q=?xQFYUJKZXc+~tnc$VRtXBb(fD
zVt;<*T*LnJO#9C_?O&nnhsKr4ejxm<CHOf%vcM3v&=hsDDXPH~wa65;I4Wvn<Z(mP
z6Q(G-KdGznl<C!{O|L#<dUc2C)n`qwK4*IMdDE*em|lI+t)deFp0=zGI|4LHEg?uE
zhOc?t^9iN%mAfHIt>8j$O)URL&hl=hRE6SXu^xl;aViwi38ru;?u-?D3kCN?3l>IZ
zOF@iWb5ubL=yTNwk^2k<(}~2@=L;TR=@&U6;B_FXn0g37^!@{-Fr_eJiHisEL|`iy
zL!zU+3L{-LP(U%gSYUaJVj`J=o_~nptD)k`sEV9Ow$X~s%~s4&t@s-8MsiJkE#hv5
zM!xoW1Jv?<qGI%(7io9XcTmE{nS06C%EMqXB1E4p^STjh8}M^UI{%+>E~*Y18O1n+
z@@hyvEFzq<_mShWtJNo?FO2bUd%8%Z^er(x;;{P&FHv8Temqv{MS|%34@%KKWet`r
zzkVP}16@oY>VJKf5XUZ+wNz=tH&{!JW$L&3!M=v?^b>>)-|Hs`8-CDF5H|d%pCD}b
zNuD6Ql;!*!rt|*^z-le$WH}X`d-}=Uw1$(r)9xbuKrhqUPNvt*ysM~m7tRed>;%{S
zEcdUvbi?1Gi@}ChT1Le*yc!4<S{i+g<65J;0-=zBzE0gGCgj(cEe*es4_iGKZO4NM
zQmdve1j4b64PkNYSKG;|_R6umXl&@9o>H1jybT8s7YfX8D3St=Om3?Re8NaOI#M4z
zp@x>ivxUj6OrZtFb6*XGw12E0sA_n)J=fks8W*gfs5||D|DzTsvm4Y_A{2Q_5dt7h
zS%1y*WJ2`g+Z@Ra(T{KEyg*2XElUODWU9BuuHl?4_10MP7YS*m-WuZ(p&{Fr`Gz}7
zLvvfEn1#%iW6P|<E5L?ay9QCp+d>U3>^ge>hipM0b#3@ax8=vY6wv4=JhbU1{8Wcl
z!)Fp&u=R5ZWWZlY@B;o)9(e`4mu@V!q`D}b^4u%h_AOBe_-(pYwxJ*BJGN)hbA9yV
z(Y@haN89qAVauKn=+N`NVawkQTRt#s`3Ko@1KCpIZlILz|5A!z$yt;x!NR^>l%d-2
zUCLgRsoIdYWEW+TQ94)_{e(dHAA-g5@~K%$+#*Wp{x7A{j~6v&p@OV&nK=7s%3QQu
zDg}LK$EjPeFLgBkQAt&ky;2jN0vCN{%V{1wDK7fjrqet^*pLAJ4dKNG{;eGdwl?tZ
zD8JCazbCxFz<(hA76$&K9iU^YwfvvBn;H1egy&@G{C{yi4Ng5@iVhBg2%`7@DMekf
z7XK!*6`Q*_`uqxzG~*`A;v6;Ka*!`>5lE-^Fk>Pwg~+R-A_I#%acEOavB<8xbhw-H
z)Xen=nE63GZwG-g^Y9Ge?ncf#l)|#oMGbPD2QM#D*Lgq|8`rOkmZ*n3kh4_XxCC;F
z6Q=Kfz8t3n6CaY1l;Ltuunu8ka~5?Kbx#s~(IHA5xA~%O3Mtx22p!&n%B^I!UbG#Q
zv#3l8qQQHpY#@gkHvkv)R7NA`Fz#(CnEqk}(?e!3J<N@1H0~n_js0jsV{eznR$_}B
z9R_X5kQ^gS+c^R1;yS<B38V!Lyu=9v)kYS~4XYDnfV8J)nar5&z|S@rW*)$`Ht>$D
z+=xjWPeC#H47pR9pJ!mY{}IFS5)UVq_j!ycXNqxCdG;&Ol34`N`B#*p)}i{fa@&Uk
zs{U&8w$GnDx^vVoR&X3a?jBAM3_K<oOR30V|Es6bFjmN-Yk!}>-`BJE>Ir<h{v+G?
z7n$aIUlUy7!elm7Expp{^&;^f=g`gr<ERa<Pw4w+jH74Cf~*hYm6XWBPhUjVe_>uk
z{trX#|Dw*x-#zfDIo<yuvpVdiM34Ltd7(g=V|hO?%P*98)@y19&dVT3T)>g(azf{S
z5wQcm_w03wWwS@zzJ${Hmr?{vII={>DO`yxRaY0hO%pjqjdpxzH*zZX9s02sBc}!E
z=IJt)dm$xi34Li)WPap)5eeQEN+gh#YBUA1O34RufqG~L$c0qid!OYqYOb_@AR=u7
zP)g^Y>{2saVZ)i2;f4~m;VhZqxT7>Q$_&Rs8kWiWw?7qXSe|dVxM49`bDu44c_&gC
zu|yP~7Q;D^=q>vgzK$Rlfu{p2vfjLo@lj)WFT@0(iP&DMe~f6oPEz?=P44pYaP6K=
zG`jyuX+Cq;EvbhK4kE&m`Qie=3)CS6WlP3^fxE&Ib;c?;`I2MBN33{>I=&Hfb$lb}
z6T>JAcv45e;5n|8p8t)SkhA18opZXF0IoCW>UJY>i3`!9Qo~zTSXKsG@1Adid^W?O
zHIzI;{F3L)u+iOD%po#wZp*6)DCb-#c^s~i#|%<#ZU>QB{#VN5$Z-GFFIw0eNW?Tg
zDT9YsYXV`DXQfkTkzWzBV=ubW8pNboG)YVzWNVJWOzodY)x6_;c}=S3o#o4GQZ?^V
zUtW`{c~|-JnpDkugD<a1)x2AMc}=S3ea4s9q-x%`e0fc(=Ka!_*Q9D*+wp5Rld5@J
z`tq7o&0FfrYf?3Dg)gs3)x6_;c}=S3o#V@EQZ;X*FRw|}yqEg&npDkulP|AH)x7un
z@|sl5yTg~)q-x$beR)l)=H2VdYf?3@?fS-!LDjsi45}U<OseMX<jZSPHSa)QUX!YM
zt9^M*s^*>H%WG0K?_ytGld5@F`tq7o&3mmcuSwOsn|ygqs^)#nm)E3f-q(D2O{(Vo
z(3jVwYTh4xc}=S3O%M3RnMu{WZGCx7s^;zP%WG0KZ>2A<N!7gLe0fc(=AGrsYf?4u
zQeR$^s(CN-<u$3AcY`mlN!7d$`SO}n&AZE&*Q9FRy}rCARr9(*zj!dInm6B<*Q9FR
z&c3`RRrB`u<u$3AcbYG+N!7e(`SO}n&3mpduSwOs*ZcCCRL#4|m)E3f-iLj8O{(U7
z#+TQmYTnm;c}=S3{m7Tsq-x%ueR)l)=FRl{;>@IK-gdscCROux_vJOIns<mVuSwOs
z<9vBds^*>H%WG0K?_ytGld5@F`SO}n&3m0MuSwOs8-00As^)#hm)E3f-d(=DCROu(
z<jZSPHSf2+ye3uix@mrKW>Ph8o-eOS)x4d2c}=S3?eEKLQZ?@wUtW`{dFS}@npDku
zt}m}i)x7I`c}=S3y~UT;q-x&HzPu(?^FHUxYf?4u2fn-}Rr78O`Ne}t)x59x@|sl5
z`@S!)N!7gH`0|=m&HI}#uSwOs&C>nqW>Ph8kuR@F)w~D!@|sl5+ryXFq-x#)zPu(?
z^N#T4HL04n)|c0$YTkLiye3uip5n`EQZ?@iUtW`{dDr;znpDlZ!I#&hYTo;Oc}=S3
zeZiO4q-x&xeR)l)=H2VdYf?4uzkPX4s^%@r@QZbms(CN*<u$3A_j+Gmld5?)`SO}n
z&HI!uuSwOsyM1|0s^<N~m)E3f-d}xrO{(V2&GhrHN!7f?zPu(?^LFv&HL03+xG%3s
z)x2YUc}=S3ZS>_eso?$oGunGyYw%|CX?pxydUgf>Y56%Z%+P+)JMZ<a%$@h-4_O3_
zTRQu^bz?yxZ%|L3sTB@kE3RcL2HD2GWKk87v5TB#fn__hjPqw{E-W7~%PfDE*23a_
zK`cxCS@MLX6SJ)HXK5)cBbns}f0j&Pfw@~v7F~;Hnvh}ETTRGYS<jayS-T}i^nk^7
z49`K&mt3-?N!BG>NXgtUiKWz^CD#yMVY28-jB7%M`{y(vpTc_Rtqk4d+LShio=Z&@
z=s{H6<WIi82^k*W(S-aHtAEoZYxUWp9(wkgELuIi45JMPdBk24*vcepfz3o9La39;
zf|4K)Y(hp8R{N7@G$Erti<^*P)ygJhIOSS@@}?$agyCaN$cU8J{K+5slYeYNMnt9u
z61@on+cqJimff3>pZbb?UulxH@AJj?Fm{~D0^h^Qv;4_Rn~>qn%bJi6|C-cqFv(hd
zD^Y&}vpnR_QYb9&#4eKs7DD*mCS+9E4JP^xLh_rCA*6E?@^5Taf0L{YZ!1=Xzaf@s
z{wx{7f<`&ZWYHbs+$LlM)Adcruy9ioGGss8gpAgFrU@Bdeys@^9qgkfWN`o7gbdGS
zdWoKekakVT;O^dp4DKOK$Y`E%O~@D`XEY&S^DX&)u}Rj=(?NU>^{Y%4_#Xbbt_c~w
z-`IpK-fTiH`i|7^GRazffua5*lLhM0d%yK3yJ?A@MbqasA)~W(YC?wW{!Pf}$YYw2
z;h#B8$Y`E(n~>2w>za@u`<5nT$llz94B5{$AtTy8XhMd{ZJ|V;V0L_^33=o9)Fkhl
zWZfj~q)E`HzcE>KMEur-jEHEKo~RzaFKR*t_d!j_sBw=bWVmfW6Y|0zs174cvaUms
z)B%xKYqFpYsM@?H<R@6*DJEG9EHMPGFj*iFEx4u$IsZozxWOcAf$c>g>UO`$0)c4c
z7n+b!pZA-Pp?+@@GTiy^CS(XH%Sdc0M9L*i$nf&@O~`QJrY2<XC#vyNCRx|Gqtv()
zv+VX~DHayg=M$3!PJxBLHX%b`Zf0VA5M#wn$f$jnCS<J9hBqO@lCe$52<t|ZjH@B{
zXR6xy#?=s>{@EPZl*Jbz^C&m4SsuLsyhR@FIi2Zu%L7m=7*-$62G3S`xQ9R17`V3-
zayDH>@O|q6^Rsk;`!~?}A5>5t;o--0==m?gOI(33ipz74Ur7wG_a4fae5i57Tf`6j
z;HoH1I9@%6IF=hVs^n*Q0;i<6XD!hO-}s3f{K_b`PhxQLeY@!7*26&sI-Be@P|oFV
ztm>bikeB0yyv)xyX(7n{pN0G*UdTWAS#m7|x&O0}ALE7m$d7qxA;^svazwOd)dVP?
zglv{FJeo6EaJ~}7Z*m46iqd!{aLZ3rn*>pU>!NKFM72v0HJ>ypt9l_zTh+_vgU(Hy
z&pg+7Z<}9|)T+u+euSz7J)do6_7lBF+BMPqI5)*1x}t`4BNMC}X>$;0?W2-uuTE9_
zlmzWl613MP(>^^_?ei0~&ri_4Fq!s-RJAWp(7rrD`#H(9pO>oks}r<e4edG#ueSNH
zU>yhRl38<Ys@B|@V9lKg*4%0H*~HqKjmfOpoT@dCCRp=mf;ErYd=#>_=CNefJdvt3
zuO?XYYJxSd*?jV{w&wL@*8DA1YyO#F%|8>Y`KQeXJ!@+|PG-%gsao@Mf;B%USo5>Z
z=Spj9eo1D{Z>d_7g>x}=AIfrgEY)~3hmWz=)-(tIK1TLjWLm#}WDh4;6Hc%u?C`1C
z+L{i@tm&AlHRTD`lqXnI?(iAe+M0gJtQnB1H6s(O8JS?sNQck+*4B(lW=(af)=W*X
zW@>^pb<SmR)=W=k&CFD-S(0GQ5{Dm~A0Ay_OkSGMQl}=f=JZspS(#wX$^_r6bodx`
z-BK4Mv*w~yt+^(_nrj?BhFxpFE}8cAscPSppna3WXPs;9TaszNCspm+AwX+;Jejs9
zQ`Porg0@}BwEZ<zZ685^j`5EiKF?j(^^;`UKTB2n&k5RpMvQCiza-QCTdLZ#@d}f!
zd$!9*(rfKG$lu2-)k5BX`u($1`vmRnT|SmxYd;{F_5)MZ-YY?SFPD#$*V_9e)802#
z?Ntfdt6V->UTZ%xnf8&XYM+##eUi(^b!+X%CDT4NRqc@k?Gcv`uhiP-C)2(#Rqe|X
zv@c80es(hL=ccOt$^`9Kx_m0RuKSu~+OJMk`>hGuZ^b)%T00%MLv#H;`uiQJYJVU>
z`vWeYrLMLAC7JezQ`P=_g7)WKK7(Cre=(W%ms8dLPJ;G#Tt0DKYkx19_V-iOzBfVp
zUY8Gi*4n>Lrv2Mgwc7!XDm}~Cfj8o`yU5>1)CG~5!nII-g7*AC{AklEnfAg|wI7_I
z{on-coswzqlB)K83EKMw_(*Hr?gNr(AC#*0kqO#I2Kdlxt$kE7?bWGjpOT<`N`TM0
z*4pcmX`h~|_W23g=Lh(hYps1@GVKkiYG0Y4ePw`;pVmEaWq@BT*7&LbpP;R+yD*t`
z7pH37`ULCNCs?;Wz(;IrYi>+t%}uFVvo*n*t*}OGzb~2gZK-O1K0*8Q0lrzITju!y
zpAoL{7Xo}-xVG-4WY+CW)w&N8toty*x(^eq`zNf^)_xS=6TG#xpCq&PvsA79CBfQX
zV6E2vTQcqcNmYARFn*TH3i65GT6;F~_c6=mATxzou0w+M4naN$LTm4sO#4B<OM3$a
zs=CkBGeLXLAm2UJ+IuC_-sg8|H|}HABxtV*#_w9y1o^009hJ2~J{VnFHz}EQ$E9lB
z;som!Cs?;6IAgnM%_+&OIc<NeIf@zxKf_ncg4z$uf_HCESnZFbW}`dIXYY@iBcOv4
zL(Q6mO0NliwcTujHNp5BomVHT^tx27xi!I>TZ8d8I&Vv+{f^(I-RK-!60~ng@WtIh
zK1fbC%RTT-GCaO>-IvVzZNJNUqa`0ru>R2m-#wO0`xB{Ze>Oq;v(T=6^K6ihK+*Vf
zz;)MtA(?eArE1-~3D&(E<YS$+HSY!aglBEd`^l{NAXRI=PO#?dgqHd?nfC8f)$V%n
z)1T|b_pu=I_c8sYAv1;PuVsSvmI>Mml4)<9s`i5uv>%+Hy;CynT~gKFH$i*f1nvEk
zX&;!X_K^wNM|ymsw2t{v$+TCes(q5jj~pG%GtlJYl4+Wns-}4mp!@bbkIx&^_(>k0
zI;iVipUj#Csamrv!J6eBpSrBIpOZ}cd8ul@GC})Q9v|JTwXaR4{ZFZCzXbxcwhhU&
z-JYtpM<GDB^P?UgDy_9YmQ4E-scL^ALHi3HFKxB<my&7UnX2~p612bP@oCpu`}@hX
zf3QE=V@p+I-L%)!Uf-Kw$zG4ov^Mj3O%yk~sHN=J`(uXRQudbwRlh)>cEWGK<5cU+
z|D>utGmR^zE1H?c)2s}5%>eI1b8}>-Fr~JK09};>l4(0IRc$>JwDn4+txu}jMkHuE
zDw(#UQ`I&N0(2WrOXDYYli}RP+VeA#S$BM@)}5AM-DwHdHO1o>dZ(xHf$+LEr>F7W
zqPG6bWY#yPYW?L2)?c2+M=xq?n&R=ky)v0~Yxc*w*bru1Jl&WU*E`jabkqKb^&65l
zBvg7s8Xu&uU4DDAO5K^N_Qw*mKbFQv&TE%Ho)&*?|70?2o=(-8w-T&*D=q%I<DF#M
z-%C~dhY7>;hiUQi^GC>!3j*CtpQNh&%Y?cMt`&ThtnS~Ws{O}=y8oC^_n(v1{g+g=
zTcP-2$PV$@=DO}K^7rBSATm>!95WKMXNLF~bgjKvGVRS%)t(OlT3f4R+6q(E)(!%6
z|85tGkMWXZ+S{k9{h$Qx2PJ4PO{Tqbs@l6JXz!k&y+<<bJ@-eu-}F%)(q1o5u%tZ1
zXX(eqx0+u1{Vuh}!h4{hc3@~<3+uuAqsDI*t4yd-C48%EJT$aBu1^gEe_V}q7Z{$Z
zH6s(O5nL-6l}vkes@lgVXct^-pO8#@ZK~R*qLH=drzS-Cw5CCzO`Gw%v@fL<uDW?N
zJE88g6XIY_f^~wAA_3Oqxgq|LgSLEbh~FO5#?4FSx5)3Z+*sZ%O0axUh`(i^wJ%Ag
z{ghO-pOv8ftb|rumQ4HEscK)5pnXM%KiQyLVkL0xiwlxjbJ6}-<2O=X7K$4e)JS;6
z{)qJ(qSho-a!rWus_IHgzOLle$tt-nRcmgA0Ilt|WZLdXRoi9=&~@D$;?Hep?RO{B
zzV&x$H|C(H60|=R;?G=YYn~4A=Q}k1Ou`_sBNTrX`dl(=U-(_t8Uw)_3D&*=YqhW5
zN~ZmtRJDH!0b1MV$+UgBKid4d+RwgS?U(%#>(|wS>GA9NV0!#2GY$E1y<FEg9hv*P
zo<B^_K`qmHnPWW4ZuwQcLwcNkHOh3{ALV{x5AhY-eSgG`=Gl;c{OY=0&(P%ZbUq<0
z=4+$2Ls47Zd4{I*HM3d!SScgO$Dl=YsWC86H^NxpaURl{<M*dFe%fcI^EXGd_L&LV
zXC>1<`*&$KJa%%E`0%r_F`YkRqbt2UnN8>XE}M+@xFnswhoiM!3Va{_zdTiK*F%8z
z|Mltd_rC<!*4&V+?tf0znoa5ai65<P3-Eo^{hm~{J(*DVC(&QDFP=>2j|*vQo=#Tx
z9jRLLMuIhOBv|uCf;Dd?v*w-OWsT7@K1t_KA!%QH0)hY2Sn@+c9ezL^v<H7mX7j&(
zm(8VmWb`uPAF}i^c%;<YL&(=dr_t%o&4{0-&drG5{XQ=ve%-MG{QC&ZRme04-nc^>
z;t<~nX<deP{JISONK>39H9=jQs+v0tHFxY&&0YJW#&7t12m*AC9)>F2ERP~Tu7*1E
zu~fD1OwhhFgC`uV;MHW>ccrTR{RHjrCusj5nf4D;)&5<A_U{t3|By`kPpN88%Z%?+
zX_@>vF&zh?%=j(+4DjzG4ziH>zwA?fQP?Uoz6Tcq--os~scJhQLEC}Jv>m)Z+F~os
zwmk63$w6hA@nec#{Rcyd_Woda-^97KbiWt^{(bmo=<l-F7;i^sYR#iF`8nP=O=^T2
zvp;J5DqWLM>6%Rb_MBE-o5`P{GjR?Q6X$&=jZe(v@6>50O-|;dDXCh2LW1>)_-y2B
zYvv}iW?rh+EX|Bxo1F?guGzFHr|*xpY6?93!j!6zz7zt+FxlCOuj1L*8YG0j-x!5o
z?PyuY;IRouor7XYnYj+Pq$)Gl(Pid3Tt>L&PQyEJ!bJ#wTMv@wPRA$q1fC(E-5$%f
z@UJ6XQYtG4Bn+?vGR`Ij?S?_fA2)0m6;Z!J`a8KQqs4f}kD&|zQwSKBo51GGbJCGp
z9A)cFK+NMT=~$N1N6L*m(J0TO!{nngvQU0$wEQ_yU^TN2JAq59->~;ykAjp_K%R*H
z;>MO?<Dz8xJM0OwjCnR$Tp26oI%5PlIl*;=$1VLAAwO1GdK}R3>k?%CFJ}Wk?WZSb
zCp=F3naQ*_?vHklM-Z!IB%J{V&xH^QIvzk&Nyk1E?F`!&^I(h^3|O=^X<5O5$6=Mm
zu?|9rzSmAa=WzNqxn-rJn0qFQF+r6To?+ktOW+b-BfD2pVr8^fW(0y?*qKbRj8rHN
zC@#_f(jZa~X&TZH(sZO5Mw$sY3u!Z?*+`os%|V)rw1w0uEdU$64t>cmw}P!hUDHAy
z$187wSb_BXX8d;&5z<?dPqSw+AN@iHG!KM|<WsHZ5G@pzk2(Wx?^xNFD8{rrk?KHO
zMj@QGg)-q5w}c|W^6n!X3Rh?3=dk$aiICCKvU2}MK#M|RYGHYAN4dh81Hi?O%^WC-
z`;z?3L1NG`3=a;0=S+qxvNSwIzD2u|>6M~wBf~=rt-M$pWwwW_q={^!@v_!SBki;C
ztn8?ev{r_^0#hDf)!3GI4{1l`bD9;y%soVCRwC76cQp%3RRFiA?>>L1OSC`<_ENJv
zDdCZ`n&pSA>|Ay&{j$So0msf~ER^OkH%Xv6&p~VSBSzH_g9#+JTUKe-8xHMfSr+>^
z>rKZ3!j8>)%LxEkMZ8&WJ0T#SGV+d7sF8P_u!zdZdR#=+v8X4MsEu6UNhf3#JV+4#
zvhH@gM+q);>j-mq66kVln%=+5^uBF*dx@zvR|56PXpj0Jy10_6mM4L#2^k$V8&^-U
zNq?^7k;5BKDcYnwb2>cCv6neRJlsf`nKQ$nv!u-9%QQUeFx8mZ4}o|C_nL>LpuqG+
zTb9s<H8;P~y@z1S+eT@TG|Ks~ZWj?;4kZ`u=)FNWEUL*It1TKQf?>sYv8b3@JM-95
z@NlbSPN>pwO|=LK=d=cq738!LA%m%4P7wvpk%$-Sd|jZhF!x~ao=D`}QsLza<aQ$7
z#fmq5BzObq6>ZNWQu+|9T_Al3%JFEDUP+ad>Mi%Fp41T@X)(^-MFOPiL#dQIjg}ym
z_XZK6qO65<=FUWJkt^nKn6zji9eX^}^9rFF^nCFP4+Je*ieK1-7OlEQTk1(LA4LVT
zpAv!9fT^Wei^n<ML`n)JAiY@x7n2P7iuTR6RI3ryLi7lsK1OiY5xZ(e?lh8ra(up`
zUH~e`s`~<!vb<L)MUM<*eI(t8E0XmwC6E(110_PV0Fx0F{RT0kho8Whro)dE&uE9@
z<y74AxZ{*?t@3ZR-J?LNrZmhXG5RWP-h9@`sO9lI*`A@6a?GKNJj^THf&q#3j1rd>
z2;v=rDM$PX*%=2zww@ZeYl_#9pEDH#KVr2ESsq8a6z#gtqA;uZ47-knmC_6?fh7VC
zAv{bOVtn%pg$ruX^Ei>b{4F-S6!nE?+<KNJVj2iUXx8N~KqTEog#3jPNgTKNCrb#j
zOY;|3gNH57Us9vGWByDK-{gYFOF`~p`Lkr?52X`)LZOxYAu;f;RYCSw3e0|>Ln!-x
z6t{^jdz+fagQ4s^!ugk<=M@rI=$0_SWAo70GB0&GU}dO9$O!pj7o!hHlB)iu#Ogy5
zoa+q1xqq_CL33o@faZV<o@S*H5m-)t+r0@!+(xMkFV2}To+HIMOX|+?<1|X$S(dX*
z`u5+ckV79}*OBckZW`I3s8y82vok=c75mmD*oVeO`@#uQtxBmDPkD$L>i{yunwMc&
z1!w4QVx(~hbmW}#5_2vf0&193*akIZ*21<@L#}OMyO1IDE-h5cGl*LKZa+?gcp#et
zLwgygP9MZn7->>9?;>Abld5^|_T@FHnzx7X$z*MVN!7fQeR)l)<~`4s*Q9FRZN9uF
zRr9{*%WG265{sy53;O7m@J=NHntO9W4>UKAWCe#xb92ux=qUls^Ju|g643XslwSE#
zaBV>+6#R*aouwd$UqP2D&;zs<FX%cFa1O(VGyvuap`hCpRxUHE#d0pDJ6<?vSQ-vl
z2Xho0%7xD`+Az0@s3=)raNK2Zpxj(8x7(oVa;>aVmV6O&^fEu$qgjfCWizuZ@@Hu+
zEUz)k-To|v21^g~qczaqESpMBHpyClj+888mh=2sS{TB&nJf?v%ilA}h=j9PV7`uo
z+@Votwy-+!&=P1Zmuu0hiB3FDhw|IXH9S%qse{x-8Zc5bSLh++T1cB4sn8`gCFFod
z<OBitM_PjPKlDozNLU)r1h$7WgkqXdXmvrg@>`mht#ZLCm#1>M8OA_dfwWOr8ykhK
zu~8Ts8-+=cRi<NkJDRKBG(T_zf}AJWz;NjlyfO$>)y0B8FhZtJzVrzkIa^<XWv};g
zi3{DbEHDEFc=ij-6hXXd3LGB>9YSYy1k5vE;Dl1Z5IVc7<xL_~Ns@jCNsA1V7K<dF
z^8!mm5_iMEQbW=yB<bd;q|$=E(7}=l`iUg;`2HdZJ$pb$t1I`df;^nXVIQIpHrVRM
zNt^bzmrENN$RVT^A(od(X*Msu`IjE{c--mEaGTk-Vx0|EDK^{Y`Khc2IOYN|VH!0!
zhkspZ%^-Vn1xN8r+7nbt3XbASNxrd(U%}D5j@9TWR-n<*T(%c;7AyfjCB0vTKZrEZ
zq5T=ldXMq)D3vK;`X8VBxhliCWSUhlL(2Y)vPJ9+_2cF%SSq<4i4GNI%+PmSl&1-T
zuAp+0uuU@sEZrv(#}<eDFU$NF%_+6D*?q4vk&e`^(O=*Hq6Pm&(ck@FszL^bp!)T_
zo(7oc?+=chKh#xLzo?bG_O$D{!|DDP>-mR~4^_`!5#RGy@Mxs__66}>eO3HGaG~z`
zw?_3g?c<jx9RcEUn~VTgBpm@Z?B@vZd%Eeq`_doUaDC%!i;KNKR!@-`)_<(%xGMa=
z(qrNrujj@>?mj1RP#3%w-$P#G9-^npU5xhK#{AJ=|0uva^Ge93cp;nOg=~&TxA0m;
zcfxz(JK<Iqr6<_G7~Ly%YI&0`_;AuL_{9J1F1W=UiU0ozvXA29<D>Y1__%41F+YAr
zq;|(v2fcbAzk=>Im(zF|@V>|M&9&$+7OWrBz@UQli+E$ch&SfTcyw=kuznXGtY5Pz
z9m?OtPaxkivkux{d_(#7Qk#bIZ$>B&YO<bmZNFF^99^>(gltz&rGGHFr5*5-{fCfq
zP1%E@)#3IJ)Bl3~$^L_vK5=vFzB_i@3U=S?`?%@nf4K;M#T-rkSkZs1wEyBv9cSo&
zPmkp{VjZ3^Vhu|ev5xQ=vHax7C#>{HH$Oqn0+BP7BR=}8hyunmEuR6?az-Y|IXVF!
zW%KAaBr2((8rRzzAA|bo!J<ZuF}NK5L&$@gOxP2Z4qP@j9p>tMhq?b|&;H!(WdCnY
z*?uu6A12eWa!x{Qoa+;FF**ORW3%n$34P#ll+!VERYFW%Y4aqi^Vgt!CC6aFU6dog
zrg3rOKI4M-R|+=z$3@&29XAsH_lAo9=FUV9^ZF+)82`}vSVN-?(MV0A)>T_=9W7gJ
zzV)VCahv@FZIx>L{{O??mjK3fR_ETCJ9ji%EXlHL*^ZZy_jr-K#fcNINu0z^Vh1My
zL(>kU(Tp_KNHd<rmP1HF2ul}A3S?mmp)Itp4e+4vv81Ier7cTK)Akief!9zdOA9Tu
zukC9~%lp1_{{Jqck?lBfLi;kd?)~@w{O3RC{O6qizxOuH@&|<qbe2DVhFSjPtg|dm
zvp@R(W0pTM>ny)Jl%rnPp2uS^#bl`~6_E$9yCtqvgkxY0b*1*$qmte4l-)1*WOsHy
zYJy9y?WQKn-;y42<@OwpzZ5ak=<#^a=<zrk)vtP9v?z7}VdtVnJW`_I^xqKYnxZuk
z;RdyU(|==JI+6DKzbPw^DfP`5H>R}Iw_-t!Zwt``EAK;rLHgw;sq^I~sq@t)sq?>^
z=<!LZAJFSx2>mL3y68rKGo{eCW~EP&LWy`QC4A3^45Ha84W5C2j?EQ?`BTV{z~cz)
z8EGokgTtVbTeihsCMEWKHB^w8ANY|0>#vxx=Lex|>CQ1={Rc9n!H%^kHh_!$5&Hfk
zrn^<hkYbx{V3!o#`J7183n%3w&Xb)FVPnGnc6Nbm?QiFY!#Rh;InSujjerwSeQ2%i
zldnVtQn)WpV>Y1Teqpg7J|8Ef!}$xOzEb(dGf?@Up_iFDm{9qqmQ?=SP{)Ovft}@~
zr2x3dE*upGGkqJT#H_Wun`U~q%ycmGd*VFJ70mShrkTI8Y3BEZX8wi2%+D~VuQpRF
z8vaacJDNR1cRw^M-N@?wqSka1vEU++Y%l@N&U3VhpA#8%0jcorS*b9Bsz~HK@D@<v
zv49H4o2YQSi3*ENR9I@F!pSBooCs0j-DjY}@|meHnmvOG8)v4%S3FOJ0b89bS3UA<
zQ{fUSk-CHNh9)X}LlYIgG0ropfh>HWi3%TVqQd(_RQQ22P~pR8row3U3@ZG^GgIMj
zJR4LP5ekvWc}R%oW_^#WyOAM8BIh%n4~A*_0!r`;*K{DXy8@xDA8id(g-^wKjwp!#
zZj;jZ`yqC~6Bgz-bM629nb{$d{S5o#iaRV=%|~P|9B!ZCAzU~>10wh#uw-OrQO<}5
zlU{Ur$SjB-mxIzld_qoN2l0{{^$hEWJ_8wBcDrB-L=0P=4jU-DtHpAh-LPe`b2n_O
zuI^fiVY~O+(l)v|<#tK%A90mH>@qYPwc2ikgUbFcpi9oUJ-!rnXnZN;(0D>TWx*RL
z?hQEgYw-Z#UyIYBCP&={{whx72FU(K(*pK&S>UeZ;06|exAixZW4{yO*cmI-|A{MZ
z)ykWZ?HSZd_POc_&x!W^oOF8O7<%UwVai<<jzm_&h%eB0&3_-%V1&TkO+w)ACZ>Od
z%QK<@4c_DOq-Q{P_e%XB{wnu{%}l=zy$!s|-7ZWxJJYk+xikH1TQmLZevFv@8s$01
z;S+fV-Fw{tm3!qO7iH(G1Z@EtuXLkcnf>wr&rJ5c)}TRc@frMi#GUOt04B*9xW&|t
z9x$D`q4pD|nP|Cl<@aKkI-e6hjIhK7WXhL?M;ht0H6Ml+;|H4f@PQ^ie6WcR9}+$c
zi0REui}72V`0{Nt`BE0+x1E(QpW0&lj@Eqn%Ri2Md3CVNE)MbK;t*dhYvRkLO?<gT
z_)?cyo+#JfOg>!^=F@9!IimKu`0K@6JaDng2hAc?yO57`<zZoQXXbXphFN*MpVc?F
z<ne<9!S8yDbRBHgZwW)|MC5_Ujh#<R9y}1{lK;~3;GzzqS$|RQ@SJc?YvGU%sPp|z
z%={Y?SE~E0Pjwpq13!L<9S?lojcDMq*YiK!p6ma6j7#zLAAiN&eY0*Xp%Ax~Q0SgM
z-ByaK&ud{X*xv<IpLgzlmioDXOG9{$pINgpu<afS^o*}GEhk@*2c3iELh}QC<1d@k
zy010GpKOwQ`T_f({@LRHJ0vID{r%~g!t7hK3Nw*~9f?+Zr)Tgw-5REx#;lR>TCGnW
z4Qxs1&NBjh&PjHj2eu}t{i@2gJ@E*I;Z>FaUWy$+qvc(f2rzwJBD()}lQa=v?nqPo
z#za)}J0#r)<!@*ze|=)<4Pk{`KeHZLM$!Or;HW{JEF;%ipg9#m+sE{)$bK%z7vxSg
z^{nyWHCSB6g3>Q*YAc%ihNiYO?(Dr^4hsO>hYh$7BS8#@Uqb)`b({|(u-ERE59~<j
z_IJdt*lTym&)uHbW%_G!BJ4HEQ76JVZ!|qyr-{yS-|M+AmgNkZUvw>bmRvCxa+$ht
z%SRw(9tZM_l=+p!GrN%Nd_!11M%LU5xO(|k^7n(0T@;d^7bT*n$d-!O4dhH(<c#V*
zoBWmKTy4{RVLj}^&EL6#6UMWX<XYqW44&E6VWnbZ9Jw$M`Q3-9W9bX?iZDS^;(qrR
z*hBIGTsoyQPv08$t4!|NZXin}zZaXs6eo1ml(?k0a^))m@cs|ECgs{D*OXk_<=PRt
zc1pNQu5;wtE!Q5o@+AX!&yQTAZw+fZNw=5#LO`dN`v`iH?+F8D@q|FzE}Tkq91fyw
zw<F;XBeQK!Lc)K{@ZOY!|DEA|T|sz%uY^-*vhB)#32$N;Z|Lgv@zFLYU@1CcAw;Df
zQH0EjC}*y1q<ulCy@7Ch5;ll+l3UTc46C<enShf)LdS9)77@{r)}ct4Z|E8gYV=7B
zVya`F)_4_b;|*PN1!<_>Y2VO=42<*kR=DkBR>Hi<=JP1%aun{DSS9(VxXxn%kC(QT
z7B=s*VG%7X<7NfNyF&U98q<VbL4uE;&PQnMItg>oalVP%24l#Emm<7iKr-w>$GKz1
zSnAw4w`ziOuAM88qTrk!ZPXle)P|17gGP_X*{B@XW4q3y_*3EBwUR(CVj_QCD_@IQ
zkyqA8bTxD38KtgGOyF<H%MApKr196awr45Bd=Zlb9zbB(x~5VI8~~KuOKh?I2*@jJ
zSUGL}oWojgFxbt;8*{=EZ!o-B8jWPxlKBmWm5690T+CTvD_j=yk#cE(kV`wD5C#a@
zNrVjEYwP@%k6b{+uOt$?<`SW?RT?Jqtd`(BCOfd{^;f|yHu*6u9zsH&vw<(zz}FB+
zvn-!*kib79uof@F^M6aWB>k|wl%(q=^Q5)iNS7+tvB2QJ3HNHz!7imnjnO9|zj0g*
z|5ONQKrR)MOAtLlAr(-Myr3+I)>&7%>u!YP7lAU3q^{e~7s@55tsmX!l6Rm5VErti
zTo-!*d+hqTU*+v$2_GgzW;TwnkWS1^ETX{|T#8hkqgz;5gEuoMw9=J#l07IQ!u`H(
zU29e`0b*$b(XnweVts0;;?;>v@)65}R0gr{V3PsJ?}#GykzbAEzB3yAMXm<{p5GOn
zg<p<F-_4G67CwQH{Fac^>~9GIUGGcIq`WjsoFl=}Ezp|aoJeOxMc0R(W@kX~Y@N+c
z-h)?QChRXNS1+6t7<|z7i2J#U`AD5?xPjSaexyz$a*l(G)H$C{BXyqHHO%Lq%L4xS
zlPLfENtA#7G|DjlD;oW?DF1vZ$}nGyMxO}y=b!CdL`Yir=j%_Cq@NQ1eD`T~c7FWx
zV0ht(Oz=69ScF1mC*?@7NI#Lt(<azRYmvy)Zu%UD5Gi(U2yv1mbY}v4HwmG}Gg+e#
zp@>Y{1$kk02m6m&qoiWr<oFGQ-H-C}DJCaBjEh)FYH}p>meM-L@?c4=!-@*Lu{{1S
z6YySK{n5G=Gf533y=qEa(p|Z#?dVB3Dc3f+s`1q>;f~O?Q^IOl&XI7pTzllIR_0s@
z_Zi^S3KHOYec;*#rHp|p1T{>}P)-Y|olqkKp`wwYIdj=lqFv#)z4Y1cJ020s&KhC;
z#26wsgA{DIAL04(=4H6KDd3>8{FLGEj-7o)6YRRSPv#EUT|L^UF~YQ=<ME);<8e0X
z46rT!_>l<JbvnhWSg6UcU7MnpkAj$eO{h~4D#}ggO}2`tFP%r1)D2urUxmNUJ-tgA
zeg)Dc@HzyREpIC2n`V5DMv8GAfpKP=>%3;s%x2QInc1qJ*V=v_EPt+Q!}&CQFY#c1
zD{Nph0%q!N3#RS1F3i*HwxPb5v~w}3NmcC5i^vwDL3heag9Bsq!$A)dK@TPN5JV?g
zefgUbxZ>AY?UzY<1aUE(ew`UXcD+^h;J2i%UZN4cci#R6!;t{Wk0amU;qCyeS45$_
z=N%BpLGCMGhv*UuG&|Uczs}dTf^KH9pJ`R>3~)z=7a4@lhg470OzM1)umzw#$bkfm
z_h#lQ<2`~p`tzG1!<%LvjW+Y1Xfy8%n)#q@C6EgI;G;q5??s#W{U};L&B+g7{Y*6X
zv(eno@oZBtl0Rh2LG<$^$q25uBcbz8)$okcQ>55F7W?y7#h%`jkRl8&zZ<2V?-JCt
zYPoiPFN)Z|V^N)-e?%$$t+N5)*)n6Du^7jHvCTo8t*$q%#$#-DgP)s_(gexr><D<m
zZx~HkVCPFiLBsQ<DW~rtmcg&XdL@&;j1=*x!L2*QEY4TkZasi|KYD>%SJL0h@ZOY!
z`I1w(b%XH!UJ3s>%UsznVZu(guD{sLS&*EIH0i9jdzlp4gM{wo+8Kx5oz@N{OlRv=
zL5)7CLDY87(;7rxH=M0W_LXGJ*#iw%#n745ty>1Ix^*DNQ}C`-iQjn`VUG#kt+*r|
zvAw-S>LrM^XK;~(R7{GyKQG0#q%2dhtEDwnw|?GxfDOHmew)-=agleW9!uOTYSfcR
zNZg|D9Az_!Tho&MKhRL(h3h2zE>umt=(-?`H~dQ@*ujy+-9R@sekA-j!+R1E{tm-?
zRbQLW2KRMIx`g-lN;u8*EBhsUfMHD4oX?;lfBcR~w}e7hO^Hj2E7ycvJ-H_3+9ubO
zT-)W^5xRCtxJ#~ln=fWhu03+?mFrx&_9>>@5<Nahi9yLxe@-j}Yw{6=NpnoTlr^wA
zy|$6I1)=r^!tF)Mrw#!jg6ZDWGQrR(B&3!H)0Ijqb`N6=DbQ)^j-W=L)Ob5<%+ngb
z$S~+M^(2b-z6UY>+S5W!aeaGkx?_>lBd8sVwcekhWCy<5(EFsRGG~K8wQ$Z_DH{WU
z%vq;p?_wBVZRoX*!mb;nY@%!5Tt4>IwcqJWbnTaVLyTVu5KM`FQ5dggDnA6%djui=
zI#>25IxkY1nnYS>TKkglVBG1QHU-<}$xzz#3m(1gza`x~g536xY84Fw1%xy8Yq-oO
z?gENSz9&43_$&(n=$P=nz%Ei`3rXqz1&>s(pDc;(lP^wbituFj>&cGcBD=N7Qf8-C
z;Hnsm-6<flbnGq#@h6ZOyE~ZI*ejG%UdnX5m_9`T5YSKT<ZSdK=?N7>-S=>q0+2_R
z^EkhrkiY_DII+DmhVYseHMFtRD#?<|-^zf5bJ<Q}Qc_8ErtD>szyc;=J2SoJ)E$JS
zIW=*+-<l`21Yntf)EZCPlt|D0o_r)E^)i@<1BA#)4M~G6qoWQ&@1z}>Vz#!lURnxu
zAPscCT>Abh3Tp$Dpo*~o`Q0z*W@iy*H?6MKRs$;OeXF9F^XqMZXFV+3+w>DR_=<#x
z{lm<bDPln<bu+G_+Q?+#D-u#l8j(`GIE!Sd|5+66xFL8|xO#G(x$lZCVW~u)%0mOP
zlX@@83oWioY!X`hG7_-VN|+KOF|71Qj!A4@sP<5A@{@7-Itc+u;)6R9`4Orn`N5s#
zox+HSeITCdML4a?ncz@|v<9it?`4S*>FY_fl*nnn(${EO(m4%@{N^Bx&)@ixwEdA(
z84dN`Zu*<oF9Cc^>(vMhGB3p~c3(uy8%RCE944lIjX8ol^f7O7>M`apG4(0t{1Gnv
z&08jcwp8lN2n;fBh2}s~A)uOB|6)SA(q{B8=G3o>iAmbOgn2=&UPMf-E26co2-n&j
ztrcv@^}irm>*xb$FzEVbvUm`^h0`cj6@ln~A?vP@V1-xy)~?rki^!#+oOQ8dHg=9R
z*8UuHBKuogup!*nPR|+%cX_V;d<Nuce`~)SiUfM?9{>$%O7#D&z5$;V5GM9~1oZ!%
zOETSH8|(jpON0gSzjrB%HZs3|xyT9zH+@{F8EFd>s;Pbk2}8{KGX#deX0n-ZCUpO6
z2=uiPM1%*m_S@lNk+EMu9IFRTM(_*_;qOBjSsQ73J|(pIonijZ5mo-oqQz)yvo_$+
zICA<Qbz^d5wEsQsAedgm?-lZp_f_{l>FWI(Za`%rE**&ZefKYnv56qQC`Kv^;)`SC
z(hX+RPXChFe}goQ!t0mjNM;58eCj-P#twwp_W_Mzt9n!{)uUpm5fw`(X$P$I2Yia-
z52Djip(UEY8AcZ7l&3zJsFa$O(e&NQ9WRX09pH4lP?W+Ib_6#7euIZMMDg&(C?4Jv
z9r*pxfj_|Ls`%@r+5WdsR}5tLLu@#RzL^+RQT~S(j7z>KK68yyJoUfJ6*2S|Og{q(
zXD6sgPNy&O&a<_jJ+}rTv+#9U{&h^}HG~N3L?U6z35fc?WAQeV`Gx3Yela?kUy4rV
z6H&7La&*4F!uisbBT1D_e&;ow2zDalnLQGj#_+Ju070afI8ZIrADwj?Z=eUn77K&p
z>|iS1UB|nMRz$9!YeXx;8OX>>FOyPV6m=PD*b9-*U;ED9tO+i-wpX-Bq%P>uMvuos
zjUJB&jUJD)QSG{avova?`sUboZP)!<Vn6W1TVwy^hquM9!AUoPsQ(hFtP=nFnBH%U
zIVq|GDN6U$zoDM^oYy6vQ2m(dToP|y5dHW&jNsdr5}}@*#J4RaLLW;K-?j`Q{I+F^
z)UyqL&iq9xbLKCi1#1SA4G$(88q7%S{Q!CkEB5C?gBcACrVtuT1A}+~g{7;GgGRg^
z6!Er`t?>6lbZj`{6;juq+5UT^k0Aa^fhAbWUMuB;_-iDtNPSg|J!|;YF=A2q;{!f_
zX#9Wp@l9_4mig<yFQ&e~cOXGT+=mdjoLPT_!0?w%IVKE$Jrud36pAcFZvUmRZfW2&
zG9>US1g;opD#oW0B$v<AN<cpB;#_e(&~1Mra`(jIl7F*gY|5DY{x=(lOGuCc_aYz=
zzYT%mUp3{})=VJBpB9jtK4=>6uNmNeTN2i81tHqs+EW8I2<cu3!q2q2UJR>v5eP0|
zr~f&d{!&=bUce!I!QTM6uv35GhT!<ZDtL0gzbAeeWE=>mo_JId?~SLCxrL<OKR3?h
zI}lX!q;3$OAE)>Y;{9<d=_;Uhpr-z2a_;*09O3q7O1x~3hs4Vj|2}AY#t;zfzr<vF
zD~y!sMc|SpxY!>Z5cBtHBdctwVH>zyN<PEvf8nM*D#0#XKLL65$NjbNW3rY7<n^%_
z)d6lCVIn>ynE}20PE-7Mo8q64%0c<xYcdKyDfw5NULwuQ<vRBB&6ukA_aI~U&*LIX
z%3EyU-3aWlRVYm)`!|s4T=6+x&5u;kf17FRPmyuSUxae0)y<!X3n70C=@R&R1ZFn<
zAFR7uG$C!8oz8!W*1ZPldynEG4g8cX^$h!iW_KuT2roS+Z1({087BCM>U=)n{GYTU
zkJq)41@pG>5W+deaq)tfQE`vPDC|_bx-~}OH8XsRcp6me?tgLY6Efwg-@~n)epuB%
zi$?z}ivFo-FEVK_Vw#x5^CfucK0-YIC0&BsMSUp*nZjc8U!oq~^~ggQ51w*6<H{X~
z#`IyiRGT<o1`=ir2uvVX1T@0b@@@Dq!cMA!+^c=b&m(L`P5nrd<o`&VtQoNCV@>hj
zY?A(;Xo`QVDgN6{@sBpG79Wq(#iOgkVubX!_Kxu6P1|JLqa1KP*4pfKo>{5*%(fO`
zln6p1IsU{ERgp-fSfqhSBvLHWKqL|=7HJ@2bkCmi(dS}<e;DpG68W&63KT+%l2~L2
zkzq#=5{X2Lg&PP~$E#tg85TU@l1Kdp`cH@>HCW(Ix%7wx@w$``;<cuDLwxU-aV-5O
zB~RJw7X$W+NZLpw;#Q7eB{H#*>GMHHk5QtVmDh~K+-;=e?m#+9&}6SM*=vIAwLx$l
zg8@b#N5o+CnkJ!kO_Mr%t*EmB1`jp~rR$qi*yi{lQE9iLL#O|z;+w2`(0?qhyBg23
zS`c0LE}Yy6aLt_+gX`l>xIW&rU`#Z{OHB(xr71quG#6!wD+T`w_&|TYI&}l$!9?B{
zC#yKo<>SI3<U%S#?+(kVNF*#!qOxjMc8hXlgkNW`a{=)d8N%O$eDRT8$>`uBb!LY;
zGPp=&_BxTKBaw(CkF*wvgo_1Saz`NJ*EGraHBB;pW0Q=(xJjn3Yl^QI86Ob-hLD_p
zsW0c1YYKimx`Q~o+@F0$p0?cgb<hxUh7-{Ra5xdwK{qE>1KYu1w@UdSzD>%XfyTqr
zb0K*)g3(AMvaCi{(r_dooreO_$v0uA(1e|_1W(KO<k&yngq>1Te4;6SyeU4Z*o<&X
zchbmR3fI{qkx`yc1L3Bf6utkc^%xn97o2ZNeoMCtxS5pvHs$<VyOGR1=S(L^D=^As
z;fP(h6Qs9zj{pj9FQ!e7EP2-;<fPt(ODF!E%?Ul$`A-NZ=Bjx&h$4wTJvg+E;du+Y
zSXR>e^<WQQ6_A*}PSVLFi3J<A!CvoEk~n|@-tTIIOC*egd+a5}9B%61Jp`#u2+#4@
zu+vQ#`AaU)+(hbnq^SPe_AdFjk(2sltbjysl4Ye>JeH~=B7=Ep>V)+D>qtmdwQr6z
zRa2m^1GZBqZ}NdoojRr!)2UHO{1PkXwPKQm3wo4~kCLRu7CPNuXTSKh4|M;n33?xy
zoAN#+)qjK}@52T#FC{SbdU}v?Et>GmK}HP&AMB(1Qe5~;%}eb<aE^Bs6H+pW8xa&o
zzfe=h3S!F3N&Yyl(nF$4&tCGyC35z%n=g;$FMRfrDoUq0dnw_;xYKQ4OOUi@FX=>b
z=1l8ZzR$6l`F2_o-QSBXV73#wYD!#ET)8IX>d7@J*EYH88M$@|cZ9B;67G`g9JzMO
zwMVYKa-A#JK1ZRuJp^3`;px~UC{Z$!GO70~nUFF)&bknc78qca_hael`MKbrT{{uG
zkU5`g&fz=SbtZck%Pg~K?-C^vp8f1yn$jm8q|x^UjRx(75`*raXjL+lC?0)jvo{tL
zUF-uHPL)<)4I=5;8Wg?g4M<qB4f<N2j^OSdJ@fl-ENIUBa*}&4*7LbZ6zy5BBu}R5
z*`Pu|%5SX5=q0>K`Aot?RUa!o!_!VT`IA2{-8~oW@fRE;UOI>*93x(4j}eoK<ruNN
zJ0sPWX8D^4$IpcZeG#2aGLof^l&G@A`&yPrYl%0p#1kz`T<i?87b(#j3l&*GT2IVX
zB2_YvIV;H3snn8{tfOaKViJza)s<@^bPeZfdP;J&ZjXfZs_A+Sx6mtPv>i{vSIBj_
zTz`aLn})Q=-FHgtNoHtD7=(pRigX|+k5_RBec2dEIJVkEKEO4!okL&4lzEF{YxPbs
zCGVDC)cG{)Ofu9nMZUV2LH>HCNJBxi%+}XG#8#R6icK4Me;4B$KV(vw0-&6pSH~sy
zV@%)V>k2a>VMS?E0onGqDXbMoBau4Kebe_^ka?Gh=pT$-0Tn<e0+H+Kq)+X`wVQ0g
zUspOsrj+8TZ^p=QS{xC|HJQWIw_;omHT-RvTxW>2`^RIZ@o{NfN+6LFG`v|#9G6Hq
zY&^8gJr+#){$PIhbA1vY1IzSW{qvZ+AbKqu-#Eyjm>(r_&kgZyLrhzLlga6Mfh#lr
zlZZ>8XafzF*m#dA$3~=upNwz&SzF{mW}Yj#@I{jLcdm6_=Gq$P-cN+YBE<KiaBIa-
zB;YPS&1bkvj)?{6eu&(4u5e#K*0==_+TR6a!2l(}DXyN6Mg`7q6D0x3eS#zxL_f~L
z5eg)=^gM1U&{9^<pPVm6J+oMj&}W!BHhttgDEFC#ElkG2%q#(1hFJePIx~M0otf{=
z5C$?8KQvRZ-3kNJmE^R?bUm0wDm*uA5SgF|mq#LDTwOp0IaeG+L|B-tFn4oftGnlU
zZg=m%Mcs2_w+_G#9g4Z#mv>&#xpvXPdAk<vh4Sfo&cS(Drm4nys~op`PiJQ*%(EUz
zZd)U_R8UWAwXZ?(4wLEyt#!^r2b~_fz_K<6%^jS_$YqG)&4PXus~rr0gYy&`@U34D
zIe6iqDd@2t-aP0>k=qwUJ3Hrec6DBc#Ch{jW*3IjFAa4n0Q3E#7?Tu5a|`C6UklT~
zK&;agUKkX9ZLEhKFPdjE5yw-y^J53+twk3X#Snm^I*4{IMX{yCT4(1T1eZw~;8{LD
z#-iy2iZWB-8C-{wOVHMe`KZeRD{1(yvi)Fn55SjB*Z9Dq(X~E=9w9`^x=YXww6bUh
z09o(1gHjs?I4K5(jXtJ3rH4&^CQ1$&NDv%0J<AkqHfTcnmY`*+ztt~?%x!+-gb+K<
zq46X8lKBn?y@Qh_@F49{p9~PW%+J9Xb_SygX76%8k>C>tR{%CcaJvA$3GUvGJ`T>?
zyNH;NgShu-0-_$Hdqeq>u+Ptz;`{w5N5UFcax4~$R}F!?`jYz=K6vG#fTPGyS9?x;
zK$AE%2Y&jV7;rWhYu7c+b%bwN=UTsx$2!+-w@pa&V5juuIEUEQ8?Ri*#;$MC7@N9b
zyR&4DbT4&p<S;m9wtLtMMUD(P(GmF2+|)A1ab6H+_cSKxXeR)<xdkBX?3Sf54!bXT
ztn<a*i%|Mj4sr`}UdZ7w&@7?)l21oMnXv`3NZzE<5v9OR%Yj`!83VMCWFk=^rCB)X
zybDbS(n+M+T$KiWRvOF;b%=)g1K}{=?-EoCDdY<^6dMS0!9o=ti>#1X+$?=BqV!$j
ziw4wR8pyF_J`bUr<-we(;7(gXIT+;FrC>!MhgSOJFWj(7qX9Rq_Va~#)`apUVXdD}
zHYNM4^HVHCT^wep^)fNoirL_&0{o3(AongJ(QOJ7@lZIQxx+yMqnk;gTiCPZfvwHt
zDoY_b2Og9#<8Jqvu#@C`NryJlN#@%@+P-xFl-)_nzSL6oWg(iEoSgypUmoh1#D7I7
zuHu4}i(_fc={{fX_5l=b-V^Ff7;LW(l|=WoYzU`${DDa`SDJx&9M}x8hR#K(8MFdf
zMC$=F2ZEVaVhtkA3M~q=g#rE{%&3SQvb{o*dHCu*F#^%`EXsvoM9LVQ<f*O@^Md^F
z#JsN8-9GDL^mr?>VO<dby`ehDg%>kWYx)9mv`iLgD&ah0726j9o)(aD2f~!Quz5ax
z%3b6WhD^v}e}W~752Yx5ae|kGh(;)Msioazp&X%~<#q<sc3uVpYF^O-7!u0L0Idh-
zaZszmq#{y-3o;3PO{fV@|Jn|-PObw;N-<LI;&78H1J>IiL0qW#-Dt({ra<04E6Ym&
zT$qf)Q>*E7tlaGmkqbx+4q7F#W-{`{AduJ>rm1=1#);zoFx|{2-7E;x%|HmxfuP}J
zEsWC5qA1-gwn!%3_(b&7NXVB+LThP1Dg^cnlar;=wNdg}*F1b*o?h$^Uj*TLzn(-l
z_}Gx>Mk}z0jZI;3FccLBt*Op%cA%WdtLzd1^;q%XsX3O!is`fk<`~{>N1lP%#hW#}
zAOQ^3g#l_dyP^cwZ3(U?lnyGw9!wy&U~&aEQeU83%nQb96eZYOA>C-cRaq8<iBw@6
zpnzRy*<jHS@CZp|B`H;ei^7`Ak}v}-^~VR6S>^*Fw#jlIaO9;`bsAK=sFjqWO#nIN
z&%MYP=r>`J1348|1=fT)VQnA;*M;<PNU0g>G&>?ysX1_Vs*1A55NlE}4qL&vIY27;
zeoL6|w_5syA`?&*i){}};7dYMUU+gx(54FPODRAu3k#5)ErzC8yxj8K6`^K@w|7O&
z5Ljaz$sW6;?DZrrHkVxw_Nyen(n|8H0!e=LB_N$2KgLp8Ycdr;(blx>4dYgsV6J5s
z2zAQ}XJx7oqk_a2SOymDK-rYsvrw5S(9t2!t%<>W!)%f-I{FMhMwscB1x&v@m<Xr>
zmSK%rKj^1ewSGmIaaRhkQ0rHPaY3?N9j0FB0(NO)9z?iCDePtla9{5U1h_EqdY^xU
zvhfUo^3TQ)aZ1jnfQ3T_1Unuk@o(mkti7<MnfTE=+|W@00n>rxy*<>CaDlUlJ~!vx
zaC#<U|AudB#PA~}<Nxq@c``qIqLG~%8*Su<C-T*)d}-5Uww@g>6{i~0!^NpwsWF<@
zm~+<Rqt)Wce6==QDP`-0a&>ZevNkzftYpt#({_}tO>P>?Pvxt{+}SG)4QH#laa<;M
zZ1+J$3+GbPcG$>Pio;K-*Jr4vAowXmdd{_4V8#yh?48;nDiKr=tyfEqQ>hlG>Jvlb
zq@7wRJE9@XZw5$21ipGZ^O@27$zm?ACF-Xu`I-j9$rI&~<M~|Ov@%uSR4VP*ju>{W
zYUs06&P`-&RqRI2NCOm=a;-S+7lL4_ovsy3SEl*Ql#PSBZC-VxUd<cmilbEpp_V_9
zDHKa4d9qQ@Pn(R~cz#rarBbnGAg&iD^VJiLe8W_jV1kw!uS%xhEQg|zT%|FYt(izA
zXl!!Q9|easR?m)<@|!}VpPbYN><Ajg(XpZdYBZMxgqqJLGb1I9V7e?);npG))qFv-
zD%twDh9=9S4Lj&ud9qT<*Nf#T%{!GXn$hN`E9I&QYmG{_nl(T*vbkKoMm%Gl6t@|O
zfSl<eUt*^?L*;jcVk3<)Bx0_QHzq46J(4HT$RL=b`3fSy#EC|^p4DKbT0U+^TpI@|
zLR@K1^;9iyASu^QWCCngbB#>x^i<9?kgo#$n?j|t_3~sfx2aT~GO!5tO4Wu|I90Ar
zgeKU`FUHX*mbHWikTOyVXq6La0R_cn@Sofv$(4L4I*~uE>DgMXoXcdZ)vQUVp5h?F
zB$2CH63k^Q*^y$YST|*B^{knfLNPy?CE_6KtJ%@w^rnEyCyQg%Y(1aB6j%bEyuCc-
zhdE>*zX2?dSZ1w{SM%A?OmV7UhD-90&QKDlBtkOBiv{${xhLNi$ELD|`1~+PuMV2e
z6w4XVNx3mqFABbakZQhGZd6510Et>-(`a6ZoZOs8`AI_x$Tg6l!6^(QV5HnwwcM!K
zibS-T>U=@^Q!Ha>q|!2}1_Q8iD<^WRUd;*^?T%BZ)QXd2EffkdjG-_f&<Ho-QPcEf
z=2Uhf-!PztxSs+~@z>!vqm$W9*?PTdBod>TFvvQRAHc5VkejatVu2+_i&aQTpCx?>
z3h2s)nG2_g4{c*2s9h`vJd4q4K9=N+MnENqY^qfZIJJq9M!~dbB@bqWc$yqH6wC;w
zWU@RZG!2Q*_Qq<V>=Tp4Of6rf_|Kf&yam0YBi3u=GUY;{RL&Z)Rh+WIrB)xsq$_+*
z;x?z<-;H)Z7>jwyj$yCE#iyxaD?Qh(?Sf`Da7<IzYT7BL%`<7MHSILh=9;usnsz(W
zdX9M=9oKuwmEMA3&rPPiuH>NSUg6C}u${r>UL3ZW+i~dJ%Jm=e;vHL(L+Nxnxng6o
zUQcdj&qJ+J=REDyzLqU?KZVqur%<+ayHBNsc`bWu-9k8Z<pyGs_GRl4ceQM{HN34;
zTer}9hI(7}_EgHYh9NxSfOcA!efp`bduu(4XE*ifkL~HhJHO=|x8~#4m~2h!3tG0@
zx`oy>*&2p$+0DM(8Eo0xqE@NfAfbjuZh0}tz4#_CHim1mE>XwrZ&k_dY?Znr5O!NE
z<Fff?vA8`*3mCjLDxUs?K9v?)6JSTHvAW@Q&o+wIV{3`S*7y!#_G|(|TJ<M%c;<w*
z9!?0DA-j0(3g#*3H9YPhwKZ{`ofQJiwQfOx^+z+4Jh!$2u{963B;<fR&8YXaXfWu+
z6x!dSP|#Aa{s$GGxwJDNV++9YvuDoyc|hY&Pf*vO;K~36`_^-j-s(9)p=67S0SabA
zl@I&OdFIfX#Yk%*6ape3&oCkSqN#O#H!M+u7S2Y9?yPLp2F0~MIpnQLd!k#e@M73N
zciYKbXBe^DPO)>A0_`31yg1r+k}f`vFiTGzE%|s>SvN~70`H6|n03_tborDp3x--N
zRjpGYq*_2Xn1n)~RD8_<P~_TtcU2uIf5Hi2B7jSz^O+DWs5(=D*3h=baBK2vT{gUK
z`0%z`3ua3j-VKriZsw$C<)1T+OGwb5v{nCp+AMSXv6pkgXhS72M;%GG4{(57*Cr=m
zZ>1A)Z$;AmkEvr`XL2ZUo7bCkzuSArYa8@7tx6pC+TDk$X(qdWJ*SRZ38*I>yKzgy
zN*nanx$}0h6>m=RrJlPx>&1?G&QG)$=S+zZkHY~TH8Fo-Am+7qplI@t<bI%!4s#Fg
zj2~l%`H=7M7Psy>`h~4y_bEBNFNm8x;!K|DRVY?+@Z*ia<6~SSEK-H%0!{+sbU+Fs
zVP`SC(3zTb7lnME@RZDO9@D$j>|}-q#&iS!V}5EhKb1S3f!nM?KPGxLnIWf@CaUAY
z<W}<70m&FA4Dzifh3*~SXFj{1HRL*qI6|9zk-Al*9Y?*G#<NwO91_P?*l!zlv)I9F
z6M@et>QRTM%}ES|{V|_&=#M#_+?B*qzABkcdkd59Z?+A=G4sjkW644~T}N7b()~o+
zeO?@CyO?GRwS!5S=FK06Tu8(FvYFZUphP_RONqr`_>afZi2;=Q_?>BQ)u1;3g<zQn
zp5Kh($@CE9#ab`9$8(2GUrG1$JtpX-u@>IvU5b($(;oaq$s`;+gEn_@vLWuC#mQCZ
zDenF~dvafY=Przb5V%SA#rN65v822H(^xnjYO8w-vDC&6d+p10`TqViS|$nr^ETAw
z;O=R|pgFjI3kDoc8<VlU-i+-BI=1+79oUe^fw{?*w(}LqH({KFAKoZCP;X`OjgmTS
z#<n>!wrLsDCuK|@^T!lRehxE}E7+E?ApD;5FvJ~nL{%PcL+>58AskO0;b1UzUq#mo
zmwN3ham6UxlUN5Z$fX$GyH6itQylW2C)3G8l6eTxotil=<NPKLopTP~au+m{6`a7%
zL2ur$*SXwVyx+q&T8REf1=K$ef%+<dS_y-?^}aBqzwZo%qrZI@A%Cq*gFp_L-ZBHG
zZw3Ij%v6BaD7-H@1GwLnF`<jQc6o#9H{66tOJmj)AFpfb+jajT=(}a6x8}IlvE1`k
zcpb~Uw$)z3Qq$eGDR1GmB&&rxy@Y%B?T3=&EezAo#{>}dlIg`?3rI-Fob-10U%fgq
z{^hjKfcIir(b%kMn3Ik=%771U8wwH3<57ZHADM*~<nwWFR`U5BjKPr4N5QR8@<FD~
z#zCEpOThq^c>0=%r-!V2%5rWjc^1-v<*FRpmfR*3`l`EzghGGhh?JR)6CqrDiLf&1
zcHJi=yjAG;x9%dCuDe-=#F>H27=X-}hT`*(7e68$eeF)|=p8ZXXil>@3%EY%PWyrk
zy3w3_Jdgu4C#kV`we<N`=`-ej8&d)YbpbuyZhQKzJ9o*DKBYa)HY9Ix(p_|qwD!$A
zbp-$7_(NdFGRVFglDiT;RMI9OZlI$LKpMGA4teQS9=zl0!S5@*^d>Jpn7GKB<G%e4
zHnq%s(uE{nndtYHxQ{#cfC}F#h>p2S9|Ni;3Z!6?DCE%KV@-4NYJ;l(IP(C)bF!vs
zPCjZz^uCxsA~Pv&PaXQ<FBx9_V}L2*`q4Xl_6VnWZR1{?)7<Mm@p7HOUx}XwrH}^V
z?i&e}`?s-O$)S6Oggdbb5eDbo7Mw2z;Dpmc;Jnv>^C#y6&OQO>J1-|V55=3nu}j*1
zgQI^&4}zmtzud=BIL%9raRIWc_q~FxSFmji`A264k3={}iSR=L&1V5kAiOrZwSrjy
zce4*Anxs4BGb89{<HMkzy|QpwkbmET{6T<hWMw$bYdh)1_m@D4CuK-15{J%kkKZ@t
zNXe%i^zuuw`^W|z?%&;U2q5hukAV^HcaIUUT`*jRy`B}GyHwcV*G_ZzX|9dXT)+nH
z?l<mWm6h(>+_Z_aNEhRtyTyvxI3$?k{?(n_N_x;tz@u?UTIv*k{PJDi!2N(U?WLgl
zw26#X>U`fFq)yi*@va{9`k^miDH-&(piCQ-ibSAPK&%VOd)<dkrN2CDrKCIV%cNCF
zcj-M|pY*WGtqdWEFqMLfj(M>L!2cVkptyP>f~#M54*^%+zzyC!AZm#q>P>>E0rv+m
z1&O848!UamVCnNBPr6*hXJF|)ccDEWOP`MkmR$FJckc4qieCKipitufdYSU=qY2^L
zd9w>%@1kTw7~=uy)OEk+`V;`64?#RvWw6Tq*Rz!S5AH4<^e!{zPe#W4NlPCCpbrjP
z>Eqw0Ir)p+*Faq~^zk7x^3Rx&f5?m+@fjok0qDc+c$cA%f3PF}86A1M`wubDkNXRE
z?owv_zXk=bJ$Dp5W>E0^fPbO;4fNomJzuW}I(mr?;A5$`Sn=_GsnYJg*8_0wo1xl5
zk1)vjC#S9y@oRVNGONg(r27O20%%#h8YKO&w@~%m&eco{wB7#X9ncWam?$JAtB@og
zuq=}jSilrm5QcE2C?Z2c;J4ocYMgV(Tio$JuXB}%h?PPVzjeD=BcY<C+^%EZMz=u`
zkoG)m+IB7X<_`1Pw#rMb@D?DMTf=jpzH-xe5#lf^`jQu|^m>-A^!k>1JxJ=qMzTaV
zoH2^RE0=n!x5=Q;j7vLaiPyP;?Iu?YdaIY(tRy_Di`7PX@^%tT%>5;gL)rzCs>5x6
z*bu-~MnGS_%UeZzYRKCRJqIWVxE>}?%>ArWz!Lq~T?OuW0|-nX6stLdyS;gvy*bOh
zj!WRBB&I3h+^$`i##6v3-79ZE3fwX%&fRf0iLG(B2Mb5?omA}m)~)o~h{2w9Km%@Q
zU*dh-t?ya7#pE)k={s<T`P8$+>r<?0brt|RZ65E^oEFCx)gk#;7&?T0c1TT3Kzs!N
zc>{Emw6_G)mtN*=g-!GlFaBzztV;eONzeW5+pYd`dD8tP=6&%X(mUOc3TBh;mlLq#
zR*O)2^3*YK_B&JQ6(W<~ChW7w{YFA%)Z1Rhxp3W|@qA)*=Zko}4?F+A;C}Qjn@;uS
z`wk}yPB<Y-+Ma7jh-sjD&=Piv${k>x!+Su#l%?MTPsclM;w)^#+K@u2BxV8pp^G8v
zy$PAglU{5%?($G441av%5*~-=y;eNB+T<V$d%T{i?<w%x7#~k7FVtC_L%~Tr-$9c(
zgR982Hp364hn1R7J<e8IyjBk0xD+~2voe-QP@nlQ7BK4dU7$Yqb9X>CU^U-ug=;+d
z8W17GI8-dJ{St6KWDNwsg}=rLhkN>A3rP&?0M0@al6~&SV0`z(6x_{g()}HH^}F{$
zNYfQ_6^cQ2%@JqD*5oSW!(5W$*o9&7ufu_`Zl4$5qa~AY>#W`5#a4nZ!LYsH!;YUs
zxIgLs?VWX$|6Mk})$4aZLRSNN8)CH6eG-BAjlc+0s-orj<WDCd1|9=Te$oU0)8k-K
zm^;aP(PJNkux<Z0&)EJ0Saxmu1;72DL0fFzZGTKdXy0xBwCy3Dgb?6&2IJ1Zz}NU+
zP6(WVpU-+Oy_MVhIS>M2|7*xCY`8Zh4O(zHrA8n_;Juz%%W!*VnA<Nm-2P7C_Faii
zuRH1frE>d4YrGYM5C$;Pp?h|Eo87;<W5~N48adLyJd)@l5xOebAIlH#O84sK#9Bmc
z%kpXpyvp?~Cg--WZAccI|6)oHaCPhk@*NsLV)svgq243h?EWd(X(?)TqfEd1D0o)*
z8_L5n#2=63zW1)Qq%TD}m=hI-W&K~o_Q%jZw!8W|t_K%)C%3}A>OKh8rNp2JfO4|T
zo9}+pIpi%ve{(RPZkD+}BqpRxKO8KFf_AxQ+X<DmV?MPOR^>_#T?gGkFa*hvA`5qU
z3p$P`hmf9h{|JjXJEyo3uot-Rhl;*YTSx#)eOI9W&p>CUfI8@PZnh;Cx*tYKXkqNj
zl#KCtl`cqX?uWx_*#ZHc_O?)g<%vTKJ;<Q}7*7)8P_5<z<CvFt3?kxIyhAVUeD}Qc
zgs1;}$2sm(H8J}+)@sG(XO#`-zq@6-v(HsLl?PX5tt)&TI$<k&QsKQYOq~B52Es-R
zg!ZIRBRJ!W?J<-v+gE}7m_-LcRV$a!bYznXal2*YA4_kwhlX<Ip@9H6b2!+jQAqc9
zuMiG)xe)OsBr6BtVjHS?oH?GC4tCk1+g3QWOyKb>2hVz=Eho_*mWqpG(5>h5h^}xA
z!#y}iuokJOu%5!2Xox)%PYyGhgfg^fv)6W|m!NK<et3E@mn2{5E#2WQhL;-bwi)sS
zcU&F!M@b$$p7!GV*uc`{ccerc7;?)NZ^<V5L)N1$)VhfJ4r;k4>`D)F%k8_zTe1Qc
zIF5GAh0V3x?Rk_9ElRo{xa%9<vZdHGVD`r$rXU38E<+J-;Wmo1w#_in-V9Sj`u&RE
z@7xvQI9duLJ2mJnT4ft)<8hR^7#(0SnQ?a>%rCK|Kk0B2><iQMR=$&IGf?wNuMHdX
zFlpTOLmU~*!bOALR`>KFZ|NpxY#5Y%dnzmN`%a;uKV(D8lVA4Y!`^a?4hVQnq60^~
z-+$LJSYAuq&pXhqu;qtszGdF#6>OyqZLMIvEy>SHdl0Y7;G=-yv<Hv_f2SdnFF_F4
zn;e35>uotA2u491Rq2AJ22neJfviL`$tQUEtmphR;F(r<{+y5~JbGP4&ld5r2uK@n
zi@?(!ZxK*D=ykh2X>aSW9oZb9dzWqXUT=&0(t@{ixwmDIw2?w<i&uFbZRdrD&>R%*
zGJwV5bVRUb$ni8{H<^MD{gqz)3UAr4tP*e&af1NEzBKt;LMD3|i6zH5D-M*@j+<6n
zNBtjSrKCpR&!y)pa22K3c=K0a$09Kw=KojVIPQn?`pYmuv2+EF7EVkZ1^&P}CI<7T
z!p*!6zP2rEFgbDetI|N){Ux|1w+u?sSKzzt$ISmSlDHN#wF4e=EIo97y6zX^)|1AS
z*!SKh0H5P)4bVtFaMykGUA95BPJ8o!l}>mXu&4!_x1fALNj6)ZbZ_TwDb~z17D(ly
zr9{-AHy^1`%6~Jk#L?CEy46oG)B$dsbdoubdU5Wzk&k<!pmRHVZgRKGcQ2YstnhkY
z;w6@ObGLcD%e;21)i5bGZo#M~e1F*7q?^7kTxG6Q>9bYlYL&SA<ekTcz3xV0zWXLD
z_H*14T?xyf4WuzS-R@svhk*F{0k%Hk7kR7QUy0GA5v_^V%44yD*9({DkheX#pQ!GI
z52tM@fF6Q_l0roEgm`jCGW`V%Xm#=labH1zc?*QYdfbKgcx}tQ^j;6H&`Z%0@N}Ks
zY$b9nlHfo4V{pCee)z6>@=*F=kmV!56O0=`1S1I6hqo^29@05L(t2tsJxTW`aN;NE
zAiaxeU{UOF#<@RBxYj4X1kfq0HbVE30K{d_N^XEkAsS0=9S$z?#Vesc^>!QqtnuWU
zB%}-cVgMeUBsN=UF^Yx-o#dNzuYNS(f<J<M9A4us+2Rdu@P<JjgTf2nh9{@r8+0Fp
zXJ<ZktzHKecMdnYy5Q}j^T&06<oe<mL+qsYZSEmJgHsRNye0btjw?{P-@PA7bN3Ci
z&1u5@9*pJ~ENFMiZxJYlfEVqtx8pS!-?m^@lS^f8RwqB57Tmk19<yUzn{>P3R047?
z#zI2!fase!-`teb`CW`%j-fiy_Zn0JW=n^N?D-qL^m5?Bo43JBuVA2Us|UUMVz4lr
zkdU`H9RR&i8&7@-cXA20l^yqAA$68^WGK5Ax_$RSTAvuAR*&_CYtVR$^$4$GUWkWn
zmT^JABR46mJyc+E=Bxcak}zcY3bQB<U@v^Rw<06#=<4zt$La~5g+%Rm0lEbtU<<tO
z7<#S^$pWc8-*CpBm$T=ktGwRB(zNurT(%{&$J=N2_}bVpO!#5I*OOfB?F0q|t5gY+
zFSm0734lRdj7$m--up0@;5j@+)Q269L5>^Yo^9MZPHpxESBSH<8yh)Thx?Z?ZOtJ3
z&lE%3yk(Gkm>9XPQ`x506i&x=iUb&hYXcjvSRXq#d3*PIo$xBJ6iZ+c=2%?R{V)wk
zCQGo@`!JXl6o3del)<^+VmgSi;BWC(ZuZtL7vZsj9&ix<Ca-6oms;kn9kj`iE(^eS
z2{Z@EyZEtaPds50TN!VIVet|1Jsg3y_0)Y2&zfOj_3p4c@B*3$E$tZ5WuJnIZ;yll
zvmxy~q#i@bk7&{1vtp<eJs;Nkz#NLrQ13CHGtyAbw<iKCBXCC)r?Plf@gyEj%_!KS
zr~8M{*o}SG58>e1QA7e|-u7yB_nxrs{&x<Q_c1Ub#K0Roce8bfuf?G$F5+v!r`W>4
zeh`EfS1m}}xeq7$pqYF%b_i?47WW}6w~T)q%Wn@v-NSbdc^eL38vxaJB(L$dL!zum
z%!5paYd}i;jgv;B8^E+!jNwv<cVs9A-iWoL*Zrbt=D$Jbg4T}XP8(JL6fTf->O*~e
zrMF-(k%Fh?&F&D|TjzcgE6!!;?IK9N^|)UQ=3Bp9iaZ3rOAi$2zs9;U$2O9DBML3&
zcyV8xJdA$h?$5<pGUoo{%MSsp%ei-a{Y<>9174`ag7Yzi-N`kwazMA@*_HrBom7nG
zLhFG4bOvtQlG6|)Xy6bBoOHj0!%#%rdvLm=-+haqb%*;c(PChI2tHEoceoeG9T4go
z(~sJT!hGN$4IVE#hR%v-?`)&?^<o?zhHbOa+kx#XNJc^JDxhS$Ac<R6W@}_S*2zzM
z+n`=ZnfXBfMy&nIIV~F%$xjN1G51|}7UCX+7feL{_<aF+x4n~?Ue>kTk#Af|j$Y*L
z<p^HcwY2wPd}Q@P=dTL&&EQQYepT1f^c!Puia+eW9b9VO+HUfAo2^_kycJVtw(&fl
zuLyb`KdtHgdHQ&sK8S(m`Qv&1Xtf@mO+M6>eg4zZ&wqCK&o)2L=U-U){yhC$So}Uu
zzt1gxf86PN`ak*l^K|L^$9;abKg09WZ`!jr+WY)9+r`gxzt492PnRy9ZvCf<zvg*a
zr_(ZHUY;&o|G(F_boiguUP~Lgu<$qg$5t6f-ql@8H`70Mf8t^9?KnMR$8D-RPn8au
z{esQ?ZWJ#ZK1$KlZ!=xndiHMN*$%Hfe|~-U0fD?3ZoEQSes=sDP2AoR@T2pGcJ|5m
z(awX(huhwcSMc$7w)W1J-`wA~&A6|5mil|T<7>wIHw?Y_csKOYT<-33EcZ}={|Nmx
zw|B1n-qzfnp^N7Bj-6w<C9}|3b9-H;y|ek5f2d^T`202teD^lPHw&J>-`w6T<-T%`
z^D!HI&2)UVfp0cCZpKe~7W_1~%Wv58cWu|wn|yxs9!kDB^>F*!@j}q%@-M|s8h;Tu
zP~LKIGaQd=aYyFK-wl|#A7Js?JfB^tAKve1ZvWA9Z2vMd&a=T`<!&<^&Havt`wi`L
zG|N*fubT0AcR+6~<zRF9%g$2%Y<RjMJpK^8&Ewi^#sz*!zwr$7^<h))Y;x)2L3=81
z4FAoBr{;7UZ^lP&z+Wx#XX}~neL8MVx8rS2H_OqC{kG<E#5;e@>Ajk)Un@3Y-Ygw9
z%cJd~G7SEKnQ!prOCx;Q_LkIJJ09+QyXm+YFW)!qMAp|3e>RuD!Sr*k{LBy0@^?1)
z?KsZ{e>464(8&Mh_M6M~8@QXxHIMJ1gu)vcpD(Ru${{Pa{dSFfw|uOvInLuIVD+44
z_`cn|j+u6v;k)B3bllwT)wAHgxtwjcc^u7j7Lxxn>8$;2KBaYGyl0Zb{31Gk&HXjQ
zb*#DEZ0oTpcQ!dZgC1wWGe6VI-)wxbe`>T^E{>+x?bx<s`_?U+(<9khel%U4N>{gC
zdg-N?Z5_Qhoh#up6ls1x0`Iy`Z`nMwd1yy^-FUrTsa-xioYfYF#>(Zfl6`A94$%zP
z%jHsTJX@R^E|pGBZsJ?w@w)8v=G@4ZY+-a{^N!7<J9cc@ncaEWwo9`kJ1*O?BUjj-
z9W89#22i%_xY(KP>=8d)As;q4`<E!piF_VecK}P(nJD1%0&>oWA4JHER!?T+#p=#f
zb`t5M_@Bu(>SZT$CBSz^c)^Rk9lTRNk2Wfd6!HFSob*45x3)X{mVtwu>S<>xKaB!a
z6y|}M%sAfA?o8D3b%|;k4+A+>y=G6z`|zFeDSTAJX-x4Q>%e?%9B=b?8e4Wa{7^*3
zp18@>@#6SXe$+qz;|EZnkv|DYGUZCm!PgS-x^k0(mc~vxnauv9NB6%tbMwKM9LU`A
z;+qa+G64K!MJ}1*=rmsZU*KOUKPAJ;nD$Ue#$n@Ze}d<o@RIma9^|6mc94Dn{V5!I
z0=W?5nT$S9fPqep0YE=qs}*n0Bf;MJ?t7=fD-!u0_TmUW@_-Xb<!WA=^YIgDw=tt(
z)2`m|>hf%(RL{tp-7){g(kMPUAx}xjfvo`RZ1wshS02h7zFBc|_{iY{O(_R%i6q>t
zNV4ta8dXwAW-@ykuky#M^c}pPY$Rior)r>&Iv$sq00a&`Dlh?>EY^$J664^(3h$&Q
z3nB2C$A<yHa;OU8tW~l(r8gZwZ4{4EuphZ%vh_3>5y*pHn4J+IygHIm(#6Z+OXVsO
zGu7hQIH+kPQ_2_Q&R5hs=w&=x8+Y(hd#BbI!L6nk!>FWIxs1ZROiVe2Qg*C{0hB>E
zS+Gpi87Bro{DtDQQ_7wuIADp9VjZv1cXHWMX(Wr!CJ0Xy8dEve!KWoyu3oNa4fNNj
z%6U05A^9|uL!&0_NP=l_s+t*T)J`KWn=wfQ1m758S3-%^yvzbV>fn$lk*265<)N+e
zBv^Vh!%rTRFp$waz$V$YqTNCPNG;(F`MAk<7w}ArW5i*oR)j<wJGRT?Hp=6C@J8M|
z2a=}Lz!e10sAb3UPDMU&fWi~`j0zI@lu1Tr1#k1m=Nu#x-=`=Q!FnvHVSMc%2WqR=
zfIkQv$<TIK2UV*lDF4dRX)#BcRmS%js*@l(30LcKui{W3zHop~sbnDPYd{#84$|vX
zUPz@lbuwdujcr>c%f_pXDFsx%^Ps`}bUv5C2qDI5jmeBeQI4k$os%{|IhmP}jd|72
zVF=X|SCFK|90v^qYMT<A%uZ{XvVdkcCY@qgf|_a~=mjtM%jYW=C<(I#_OCe>tQw|m
zg!0*x)iBG-Fr-q6@}HpywB)Z*CKa-Hx@j~tj!YKc;g|x4waP=sQ+SnP>&$U*8*7#E
zA&zj1Oyq1gKn_7rKBy9on=gxmlQ6VwDV#ty0YQdZ37|Dy82Bkg^OF@&Tc~ga<U&~!
zN-B<)BJo<W*0L(oTa}eh=7ex&p<wwMK7*0LXI8@f*>;3cLU1r$=^&h#&yBQ(h8g@K
zO{8fi62{DkOoR`Lq))YkhFOq{Q`NCdEqiiCYqO=#fV40o>(&g6Gac=d!$adTsaO-5
z5-E~rpqZs-bePMwo+qYjVHFV}uEa|a>f=rhpV5J&nLM32;bc#asW56(M)^@2VS36E
z^16fX(v&2Cm92=cwdBfBoQfkVQCL+9FrZxpAqYkaDTov>j7m~AU2fDN2Jktf(K66o
z&rVhxCWEQLqm+Qu#2hX?s7fHUU4(6e>|!!owfs&f`Td%yQ4tQ~s9wf8##KCX3d;l*
z5@KGYS12CJ59evUkwz6jpd+kVHl$KVu%oNBX}!kk{EUr&z%>q)aua!Qoxi+@9^1G~
z^am_2z-=Xm^~o*){(4Y5RRm@-z>%K>*zpCJ64Y>Xf;Pvh6)JI<DMa;~LL$hSp}1p>
z-02(?dxJaqV2~CH1xKMJmoiq0A~*`|7ursq$vWE%jhx~YuWzl%Y??(OTozE2>vafF
z7M#jUc_`sEK**HS#e8X0gG63cJ~sr}T*0S!YEJzm#J7CyORre3rIdUsN*AY0tz5w8
z!?Zj#5o!g_bw_VGc;kVinZrkp9=Q3I{YP){Q*7LPI4py1WM!k7#4jynBoJ23(J8)H
z#=iz$Q;W4ef5Nbj2~dkLQlGSB=AZ3A1Cq7p6j%<11OC8P@_8r#36kZf$H3v`@!Rpe
zCeiVVQyD@A%Es)0e>HU+_8PEUmwC3>0XAWu@S+a@P*RA&AOgLb2PXmmB(io5OffAX
zWnqO&#%eL)4_@+MIr-YXNx(RRkZ69P$&mOM#wa`h-HL{i-?U&sdV>%Lf!Z8HgCGRM
zzm+mL9i~^6Y>DxgO65~PQ6vHd5s1~#yV*PE0G}WeZB9Cy!n|@F_EQ`BnY&sgpM#R_
zjHp^b^yk4WCu&41P^w|5l1@$P+VX6N8k|w-7!_Rt<wdcx`DR4?5|vX?I-!Ic1yi0@
zp2o+=U}}~$B9uHTU+sdZXw=3@5*acgB?rFaB?3=6mXLhNPJ8rA1AAIwa?+WkdVUgG
zkPtNjc)2p;LMyma&@m2M0tN%@0)DqFGp3bLpGBa=q8wC}N<9xif!fL#;|L&IO$7i7
zxfX7N^2*6hfv&~!me9#be8Y+!1I<8`EzsVCEi^@H0@F=GWkLU9**Rl{3RJP$gap_z
zD9JfltkxR<Bs)3^roh}oY7<J(w0zRb8HYS^it@!Z+{zVW&SdcEK8L9GDH#ddwqhK(
z<2s?YVg}#$3(6oOWpHO1y%o*4i(tu;`4}QYMa-<RNhL<xr(B+Bz^`CxV5J1tkAnAL
zj8z2x<Kj;kfjp$4263;x2v8Dz7Btsc80OrRbD~zSq6926DT#-EP-0Y!5GVrZ3!1G`
zStdghg$c|U1r~6@Y-dZbq@WRwLdDNcL{s?aKKe!;=o8{aYN!hUP=RilQpD%ySi*Eo
zXNuaxCkr(VOv0+e8bF^3KX!=1SnW7J96J{$AAayB78YoHppzmrR}7uyr7j@$?PF9N
zarE8ZxY1vO;lWh#ClX1R9KF_*6U7A~vLTd!+7Nsrr|Vqr)XwI20>#`lz|-d5>QK_;
zG8jn)*vdK+MVOs{;l?9Z-+IG=4Azia4rFdP_`(Cxl&g;1c<}JG(X?xi%t*TR@HIz{
z-gw|@^I1l6Cy+fUz9u+HtYa)gTOBG7lJK2Kl0|mX_&UUq!0FO&MmnSTpr9B``oTYu
z4H?)Fu&Q)%6nWef2gX88m|oa2rih(VXqo=#VZlmQ2O$G>burd0Tp@o>HD}G{aac=y
z9lN+2PEW#~&XyW*Z^(ykp@>h8!10!=!t|S>k;W1_K2oeRQGrCDoeD1t{!A?`zzk5v
zBpBl)Ru1D<6Q!wk8C_v8hk>^2H2DQVO8p6~YGRPM%y&SGlj1G_2oka7<a>~jUIj`(
zMPSD&AO!*(3CLIgOr|{HWNBznW{%{+V3+_=Z&<w0s5h$6Uu|_0_Yu)thW)`Zr5X*2
z#oEsG0GeS9KAPe*W+OkHgOX15L9)zpMAws@o^Uuve;X4rGHymSBx%r_!WltyvJN+e
zxaz2jXJm~K2?Qbu$52dqlh&%`P$xD*pC>+53l(ZyrQ3m0VaN8&i^^3juxOcHN8FVm
zHSZW6s+3HMdq>muGl+6Vuh7IJSQ?NfBg37(IL2k^#huk5{Kh~O<3y8`%S-pQaWn_0
zGJ<Y{Y{sc1S>$u9#$^kYp@7dM*Rhh(T*e&Xo2oT_Sk)LL2<S{Pi5-IvYFN|YIna=(
z&dd~1=S)D{2u<LEiXdCX4(<v*yuS5usKZF8jZeXs3;72ZvJU*ZYzZT;XOzWQgg!7c
zw9}KO)XfMHRKJTVd*Z14-i03g7`_2&U8^WX2^311f>%N8Nw^VBZa4{SC|nA)%zP45
zfg%9n537^~ccE|wjxwnD{2Hia>gQ=K_H$hDf)Cb0bU~w0*>E~22~80lNHJT{?=dq1
z1qxqL&J-q5ncaj_jE1D?Mr{s7utb&MSFzAr#oClWx`7<?i89n*LS-deKewv%p`dFx
zKMhvJ5=~dABGSQ%RBJ%Q(aleTQuPC2I1P$0$8yNk9-p!`%RXIu60K$6YR4*OB3PFp
zg}7Xsgi~+`QZ}<{F=zz}6TiG{k~IwREpee-xL@HRGE7Q^LKjJ+j6ld$%ct$q4i(LY
zr8|=@VR03UZ-ARGbd75h+<CFO0hA0y0-U~(rSS67Ka5QU!HkU{xjxQq6QT<iv?)WM
zFqTx@Cd@tX7H_4RIRyuwUD|Wy3OxEYW-vFB#|KcjV?i`hXAb+Aw`vU9hUh?&C5nrL
z*kesUpA59aaF8!4XJq7D%`&4*z@ESf)d6wG7vG`yB0%_g2ioBcK|oeR+*PMTK$h?Z
z%R@~#L6rnosH;?MskUO#!MB>tjryu4Aav`^M_+L3kz4jV*B-q|12-K#qydFcgzv-&
z)JBukvvE^FjKJs#_B4_ifuaw?e-cD{f?@^@OES%FO=cAS65Y;Vq*^-}M2bOu<`rku
z6H*{{(3jYbzK+Kj`Ce~QTMA5qCJ`%5pb{|ajEEXoh2y-ey9{C*(1hg2x}gb+f+MCd
zN?=D}%9+BT(M%4$A~dESHO3_KQ`hRm0-?(OL{k$&cM(Mun5#HS@d}Odh=xZEkC>d?
zi3Z#nN)L9g&BVlIrBq<q2L>dm2Nn-L@rz+7PMKupTv`nSQ_H|JQ8DxfFNjVvXI4Y%
za4-=pP@-FCmUv3(qLAeW)(-tLVu;~GKlnlr5wFu-B=bh%@V+${Vf<9KIu))Gj+-h$
z(uth*to$N#8-js@&w+a^C2BlGN&-_jpD>2=4M9pd!(0A1Xkgg^7-LI-2T@8op=8(q
z9qz^?g?o}D?(F#$h&#3$8Z_iZ&d@NCuGGx2t7QO3`V`mZQMe_rHi)%gAv7qB%z<e+
zn4~8Bqi}%g5Ey=2>I{KKQ<}iK1g4|E04u7%NjYJF0MrT%J`go6l%v#?tLr9R4azIO
zgiWUKL%vmK4KEB&<qVCpF(_78uecFu*D(j*mZ!2+f>D4m$(9jj0=_Y^ZJa6=0QwBD
zvkvXi$V%T?Mpql;k?etGrp1tvE4^QE{X?h9(EK#3EUa*|x{B;4z9~;2RK)DWjjjr=
z%?RqUg@CR<2*|4GXGtM!xdCPvA;?y%C<sXbW$@-K>WOgrpb}R~Xqpl>dso!&kOQj*
z+5x(+R~s<dOo~AOV%XR-=Kd%%*&<}fl-v<F*i!?=#E>k;BkoX_<Ol?Ug_>Del~=+k
zX2hb408#YI6J<s5%466>8vudy!tB-|X6uAYq8L*>3l}PptYU|x#h4M7C*bhX_D4^Y
zry#gYjM@mdr_svj2?!@{d15^(P_^S?h!CwrNP8$q+A^!?=B}tRQdbcl#6`jfQE?tB
zE5c01if8!JoQg0p)4YHny|QyT@_~T3*&-!mkrkj7R0c)PE7~PTyb%nI;D`Yw2ZHnx
zn;?x6GPH6lGnqmO7o>3RWGzEB(WEdKyvw+$T~^Dt!$vkLg^4LMIaT=8#$-noo(TkW
z;t^nJhkI!vg%D6rZ$;I@qgUOUx%tJ1uW}@C)pZB14x(3Hr(wEAMX3{9*qBa^cB24F
z3iVVWdTT~RnSDg{Dh!63jkq+Z2tlw=WGc-8H#7xV0{S)12Ji}z2KNs&3E&kLVJ4&`
zE5%U<9}x&^m{xPPAR~S>?3RFRsZ3-lI6ovEs<NPGHGB<&x<wGl=gH5spy|(spD>RT
zC8Oq82aI5zj44lIAKx5$(I!PeQGGp$;}UWngxY)-4xiF#1k`CoKTA17Cs5|p3CDj6
zkrfQJ41}fdm6)5EQnlgm4`9F&fbAj<NTg)wM)D(Kao8AeB;rmgW76PkQ-z<sIpQQ^
z2p$fo>)5qp*vKWIk~+NTva)=ED|KtpZxb@z=1VUCmMXoOdN>&{Rai0$HR%X43eZC`
z^287B_B;#DdmsjpmzDJyKo-i}F%SX}r%@5x*^u@0A8Bx_C{=Xb5~<=dpy?rj9Fjo&
z62^9c_!CY~%6)PIOzTu9d7Yd9qEKCo0lmRO$b&!Nhbm@imV-nP5c0#FB#Il=b=<^Q
z#~o)OFvdDgP2}NPIEiCIyd#ZU4pLnTpd>bdP!a(VY6T3s(8$Q45(Y3g!jc7breb$k
z=8+=NftLYPC__~xRe~e}oSdVUSE}&N^Dnp==OB)-*u!wv?LAQ}=SFZC<D~V#AShAY
z(?L3&Z%72>6TFP*1t7r<JfhjSL8Q~iHv-~i0nlSD&x1#3Kwwe{EkRy58`uKFF(*J;
z0`5U*gq0z#l2B3*hoR1kaflfj)a@Rq&49cP&m%qESSut_C}E=oXP#7Uqs@Y-zga+~
zp@KN{SV9Ck?y^S89Zn|PRYW16q8|a(Xb=z?f_nwijT^~F_Lvc#f)axbr^e(66^beN
zps>e4GE()FG2Jd{upIwTNdz$NI{9!#%GM4NXr?mV0Gm~YQjMwrVnJ@!48W2OzU)aR
zQGcbu6q*<T;ZG>fA%;!yDM(2QP0}4wxVYjbma}j*B6d}@v_kL%0+jYOK9nm>vUUkp
zmToo}j3Gf#C*B4`sQfA}5g|wV5xAL(1^7Hr2BI4q<M6%_UTKqio8VY@xx`m3T8VBx
zRGZ*{^b^m&GlkMDryVd+YRU3}*mle$i*DCsUG{>w6wA^*VaE&BpBfc9=NKAO+>`>{
zVP7R{G!jc1^mNy-g9lHP5W1r)&r}tMG@-pTc;|slEEL#$gm~iJF5V;qs#i8n4uG=)
zjEo};CRCrSD94!@wr!ZGtt#CK#9XgnoB)MjCpe#Qu&T~2no1EWKZ=EMXwv{4PP*Ze
z(SGTBfKJEVZn(qwHCHOX5JH?bP%qX$QQkBT?GS!#;a8hQ^wYi_$AOZmA~hQvjN_3;
z+au0OfHUB|65l?$<_2yiQ^ST39DK4_hfI(FGr-QElau+=uohLUn{<(iup8j#Kb?^Q
z_;!MvAHZpp{K+yQfo>_MFX(h(q!I3gO9}cA1&czD3zY0U$T?p*c_=i^UR3$Z*K*aO
zXcSySu`Z&P84SjXlZsNll07YF^r#=P&CLR*O%-pRtVF0;!-fM+oPxxvI4%e`Dg`NY
zl#}q#a$|r_rBDeFsH}oM27yi4VAS<qv40ZC2cql}E~wY_U-c>_TM`tPI^82Ih_8b}
zS{z{o*+5dp2+IIrBnRibM4N%qF8VHXd(qCg_}CJZ?N*x>*L(Gp@FpClHb5CEXuav+
z)pF<=cgGK38;aZ<3g5W@7zoA|yM@K_qBvrE0DD0N$O1cZz)3BwCfQuF;TeP^m3X1X
zu#in&Pa$OK%Y>u8sP2CrWiy*s2-+q?DNv=6F6szQ-{D{bVtFvUp7UUAgbO4C*~yV2
z)Hl4kQ5?HM`-av0nKWm73^jp(W$%gEJoG-UQwmK`rZ!k;^l+z2JPBhlk`)asjKidM
zdE;h2*9$>NAydVHTv>a}@<F4tniYYAJpqV4oRNeTA!n&%CMh9NKt*T)E51B%fEo4~
z&nzCg=UT|%NGEBWL{L}xDkKk5F&q7|1{Uq+B=4fnNrEbDRT}TAT20FGrOFc=8=`lK
zf0z`kjsZw)4RC$ekgDDqh8GMygQ6|X7UACzzlcDD`9oHaG98YZWtwXuTpSQs1y~Q`
zr)xG0DKLf^LaO!fVf!92!yQ2~8YL8_pJ<G-vh0M<<{6WMP74RifglXSm17Ia&mq=?
zZx33Xk6lEq=R~}G$Wo+cGB#Aq2!c_Pvyamds+z*m7Zug2s>;wXXl3Ia_tJ#$3qz1M
z(D)2hm^}z;boC;n?Wu8!R1;yFno?BPIiNBpVz7+?i-7Q}YQ}RIasUAUf?|t4v2jdb
z3Le~|f{PUscN$MNEQ_Lz6reM6vU7FJWyzQ@3={~qB!RMVBwjM*SqWbcK#Qu8qJ17A
zAV_qNaIh4oxQS;8V30=Tf??3gzzG!kn1D>!D(Jsv7Ej}V4aKX1JF9c4rq7jJh5opn
z@2-kqx4b2)YpujBh&oUCL$kvo8|>+Z;^Kvq92qVqhlEEA={B^)0iYyTPjNAws<L}3
zvp5n2&Cw_<vgM=4@Ux;m3Ytad;2I(UKM7I?6e`2u)N>)$BBrs7?#@Vg(RxS7m7rBv
z23U#%ua{|GRwoJ5!y^H-%iYa`N6h&<O}+8pwMTidW52jCY>W|{^|<!BTbyu`t!d1<
zTA9ZzRo%j_hD3~~0qU!aUwSTO8(8D3wjl1HbjVofAeDL<lmfz#V-wgvlM%}4R=5f<
zHsc16c50`%CUBjQ1(z{0zg=S_8wW3K0d7KL*@xqZ8=oPb_sN0;9VtbJ31*Zy6PgjG
zpbAO>VK_uKuIz>iv^5Zw;UoeH;cxS(?StFk0;S5}$3|()`7vztLyxS$KI0clbic-#
zkS!T{Tjb259s$EqG#*F8Z1V^j9|CeJlkgAN5NvMbF$ue>K#hThoH02eXmu(D=(;AH
z%~4~8ECqn(gr82398a_6i^VMx%|SHuO}`=&)I?TRN1Q9HKvRGX2kC(%S^&0*NjY+d
z190j_f=r^`A$%kzw1i6ev1|?pgn1NI&f<!Y9fvLq*GmR1(&DR($)6eUm<(9E=OSz-
z1NtDaC0ky=2@ii-j~)?YEM?(w>6nZ>2}cL_o{Lb+L9X-%+Aws(dKp?SK!8p@g{RsW
z(j$Nj$)glZ;Zrb7fUnD}W3mbYDEQ$3yaqH)WF*rhplKuUEb&icxROM9@Ltspgopt=
zzh+VxVhRrCQ&VqDpQIm?nV<q-+=fTMDL4cGS=*S#^F<QDNd<rk(yjqyJV<B`lrjt&
zva<Z-XsxVh71=I1JVPVSP+(aVFnA;ylThkp)=(EEG($&%V>@&_z%NOj)1XRJ`c;sw
z5uj1Yt6mxb`rxC0qNvtX1B%}Ww0rGW^)DL9;)}ybjVZ6kg(03neoASMJ=(xw`uN}(
z1k;uTb$%of3Nh_JNRm2_)=2Dld4xU`46s&4Zt!#wH5XXwQ}oDV*1)oyVxFhr<9=|s
zVzuUTN19_EUx5=0XP@y*5gs!^NFVCKA!xG=8$4)Z-J_}zp)XQ_^}OIb6b~;r4T>;6
zmj+10d!{K{@rd12Sx)7{Ygfl3Yw7@!Fbzi&7ZrokE$$)4#QWALfN5x?!ih4)FzhAq
zhVTIee}h_V5xQwW7Im=<gaKew^I17?KhHP9K?vV-aRkIS2FtYEfQ}21C~}W3esHrr
zRU!u{i|iRqieg~&dviQr5A@68ev%j$2e7Q2`Y2=_#tD7Za1F?#k&NRB4ES(B+-9UW
z6^*#W_-q|59T~NT$0S#ZVrrDyWcxwrT{L^slrwcQS38A`bh+u&NM#vzD2}Z#5HqFn
zak*Pi#O8*G5<zDh#a+;hMMtrMp~yL7;!;AGDJUIqnekL>7IvAOp3(g<%4YJ2Y>vU#
zRxMBCIXI<Z+<4-q#D|*<R%K<9&5+zU4lnXtjy(4PGJ{=U<(p+eG{Ck<@boZn9s}Mn
z`kF41p-c|W6vl%mRtEDyCYd1kv4JiM4$@b1nrNDe4(@e?qT(IGf`_TZ1C~Nf;%)?2
z3;MBp3{NyQBiu!mkYGlGL^6CytZVS@2cXY$M<OyQHVxdJo1h0utA<IF{!Nn#Ee0n+
zv0may6hr5AXmt3q6T<_<O3<V)WBX%4q;RBsH599anp29*DYfMcx#cWT<t$Yd)qZu#
z4fV|CYyzf4Q$WUC(@;b1#d0=>1OC{|cTVY9Qao#ly<uEW$rY3ZT#gzOMs-g$XTaaN
ze2LElhEs)(VOK!4pp`*xm&XxBDB1^Us@So^^WsIU(|9yi0)R&Xm@dJG;9f)7#wcc#
z=<`FgCLvU6wNrR#065hQ`VGrvdp6$>0h<ihWI@V~9*@Q#XmJD|+?5$?&{t-*!GvAx
zT!G-ZYc9{Uz%;4B1CaIi(cyuU!qBTI6ir#|up^3MDz*`z<i?UnhoK1uHB5rm5OW93
za2Z2y*iZ7q2+87!J60g*Sf@^mlN|}21y)F3CYw@CR05QcMtvscgE;sP>%oL*#>&)j
zDTQNAP;OU$m>66cXln4z)tL@g73#8v$tEODUiuL|{v)tf^sF8BTk#|?cIo71p4}*l
zTc64`N>K(Oh;^Y*pX8$qNHgQW;>su8WNu73=XkkM1rpTu=T?d+Zk194M-EC8841AJ
z;V}fDMhpy^yJovY7aOc|^02b_Ie{hdBh+Ztk4<6c9$t+qtVjk#H$b|a2!giHM`JQP
z9*-cTl5B1nk$_w1ISLU7qzvo|Rlxub8;9D8Myb5Qr)olUVES1s!Af96t7AJjIU|)R
zrV+r98URG)gufWeqe)Ve9ZPw&4&*$pqo;C9@ONlv1XK-XIz_T<z+sOYV35ruDB#S*
z($6FS0uzT$G0`*#7-MLLN1IW=pib`SAN&s~3?hRWvqfW6GyMpmo36<5v*7tAuIZwQ
zVx7ePtbOi@z6;7|E;_V|u%uBW;aMD7QJOB6Q#3=QE5%nq7bH1E>P+&CGLM+xxSRE}
zjdE9qq8iU>6qtc!4KHzUa)4hbSwh%)=97O+#0H)pHakGjIgmlCQ3Bv-Ixvxh{cBty
zT(Lz%Pv;a?5-3P`z*JXAfkvF2l&3b+l)-8zhmoZ`s)~lGl2^l$09_vTK(-2NS`MO*
zRN=tKBXmWWaG0LcV7e;Jl^N;A)S@DRSBRM7M~x9uod^uS1v0o`2+BV1Kr4<aDa)C0
z@O24xHw@Ml&QHnVP?IY@6(WMgas?g)CDIFYV$(32HmeAC1;m$R_DBI0H_ku-*crh~
zI3yr;5JR#rsY!5I(HK=tpWas$L0l7zGf<Z)c0g+nn^WSW#>N-DglclwYC(=!{`gRl
z5FMYS*M{U(2s~1pVVaHvYrWX6c3k>7b#6!4*@mt|RsyGia3NKA(3YHU5<sl>C;>zj
zx1uuoyepjZcv{{nAwg*%M7Dddi>mY~FPAV#*UpUetCTAZeI%9|AYJGnSDNvru!Pl4
z(sa}oCzzNrd~C%kYd(3H!Q{x8RMfGh1!Ct@y^x6%$9}*ptA=kxgr8`l7B%9qtb>U7
z^sgxR;8uIDRddRuNE-!Lup`r-mQmG%O9(7)dRstk!i47W1lW!Zp0}WV9|{Mq8SIRQ
z(ycWVO46cOmSjCK3yzJ6OGC{uEC~kbVx6gmtcryu=z4@%#EK~|w}JT!`VGbHIu#^o
z{ZJVhh}lRL&#EAxP|c2EX@+}4Lf}{9N9OLBbtzY}5T@c_#>N@L#^tPw6=W%NP#*R)
z5A`)A%i3w4CBO=cL(g)!1bxa<gI?rJEoPuRMN@*Zz}V!nD20--(%?Z?SvZY7LV@lt
z)6-jaI@4P><8KT8w&HIa{<h=q68!DJ-=+Aw%qc)z1AoxiE9P;KdS$B#6)LqN9Ab)c
z`lm9Qf|qvi(1ri}IlTK*^(|-&&zNWk%NUB{)I|j<v1n~_1X;I{BF*Z!jT=#);Z%)b
zG>@lUpaH|2hWnFH<SWidg`Q4>qf_C?_y~5sAZI2*wBRsNHi<DGe0D}wT4Q$@D^F(L
zgdqrNWQn8<J3M(dM2Jmtgxk3z2l;2#auu}t1V-ROHN0wyiWoOxK1W81g5pR^F@qQA
zgmdt~jTrAHO@yrQvau3Hc84p-_LWJH%`Ke9Q2?cyJkY6($3+g#V<@e(+o9S4CmaQg
z6^&vh>}#EHEI~~QZY9ZaGV}f?$*^JQK3K8!O-1mK!%l?BA<LrCB4DhZEYg1=erhbZ
zew1N?uJ3kY2*=$_8Z>E}gJT=iDzN7vqp84$ScUr?M|Y`H%VVd8OduCwGVyIbeDXt{
z^nle16%Eppd9)%dN#SKfa0zRLjA#I+nr6sTBARSl@N2LcQ^j-)G0I2oO=}uaAWV)l
zr|EukejRDg#Ax|p)5;%^iJO5LGZ3l(unB}@D*80EZWQUhHbk{#$sDkZP#yz{VN=#e
zFAj{<6vbN4OdDT>W`Z~?3#AKt6XqE+Gv#!I@^}NMP27uSU;XHjD-UF@K5)(cTW`1p
z5597P<k}ZIH%anMM-N<s*DA<<$#qAM96oaE%_avAxL$?lWU+N()63kpmB$BV^N5p;
z4KC6Va?B{8TxD}uGr|QSg)TEs#Hw$Yya4^sz8fr8f__?po(9*7R1VsbVPG0b?eO0;
z>O9JXT>&W1YVHI<h&X*6oo{8BW;E646aZEA-6GshI4wzqOtnPg|JO&cu-`7zpyxfH
zjL}F0fkJhGprD^hs79|wAX6XK_s^KeM=i~O;S7VoQwkYnMJOXeWzi(rcnTGQ{RZ+D
zl?Ce$mpX2I`K)HT<c%aRMkxcb(s3IG9%^0nWR=yR@2itt0H%rJDgm(|B?JisQx&kw
z!Y)ZR5_&y~S@vZo)~t<cr9k_EGOS_k&_onu6QTD=TeGjvFxmRNoeT)BIek0}rW!>C
ze9M@4T5a50;}puOWUN+Ezr+ow=i}uqUZywI{1hg$aG8^=@)jWx=-AK~cZEHCVSNqu
zz%QL1lxkppnQ#V(9DOYz{oX!cm<YUNr~v<LO|vacuzXc2m=stJFc{^Tb<ji^G%qJV
zoTE40m^pgj1$glZUUz3B2d};%h}?YZ%{Lu5e6^ps|JGZMG^gPuDYxEuz^MXjwqXl2
zml;SXHogC<Tlhe{_JRt0?41$Q8Xk8K#hA(VOnuv&dL(61&7_3hl)=~KfW`S@l#Ka+
zshvA$6gDMrxXFZ~1A1(fONIB;Ga%$l075yUzGEGkq9#^`=Zc;^=LAofs&EbkMfpJe
z(efl;Xo0t}&@>h3xDv?;QjmxofibmBQ9N^QYjJ{2s+`cqC0GA{?7a<)R#|!;_|eqN
z)XXsBnlT>Z39-v#GA`SAx|*(OmuFdT(Nr;ory9Pms+g{sC9Z<{po^ITYM{Ei#zHai
zvJuLX1Z7c#A~uCA6rl)NC_)yBP*k!|7DXsR5sKI>ijajOltmF6u@Q=pv+sM(^PKnG
zd+y<0#*QOPT~dALz0Y~y=ltGt&pm(lgq}$0J5riEGSTT#G!*WM>^*$N_p+;iUUb39
zgV#k-LvzDVPS7sD?Bnt;we!birIPkZ1EPY?i{hQrT^=|g3&i!kRF>u*Rc$v5$%}(J
zsVmbPo{?>)(&%Xga)yMygy^L#l=qTURELDn6_8<AtdNv5L41QPBaq@jS-Pm&x7N3K
zSBT1~&9AHTj!!$C+KMZadx&XQ?BoZ2F74z8GGC?d0<I^9wKh)G&x<=Vz%rgAYq4Z7
zR`TkYBv?)-ks}r56<fuV+}X`p<<{tXJ7(YAJ-T~xOzQvMJv$~GGQC%xncv;LbIe`s
zn%w(deC=*W4PMitT}Nq?HF<8esAQciz*PQ|a$=UQA63CEp+70Z$g+q^o+EAvaT)X3
z57iG!YW^B3`rfZ&_x^s<n8<p2-KnJ=Ny#@w+`xzAzpSnJ@R)b?StM(gTyAN+v;^Fv
z&><{Qcj2Fq2*=$&q3q;&@4J3FS}V{0!yihI-1Tn`f9yPVy}xJg=-BM;J>T6iAxrac
zxpx<(9Xs2*V|jLThwN*GT06ejJ=xhgzPsJ>#J)!(qqoOhoh6EBNN+)2DrMP`4Dk8E
zYFW@A&8QCfz)$w%$_uq#NT0)RKJdrIx@b$@O8q+|uTz-Cfb1rgbd!KQhjo*7>)7lM
zeeLr3Agk)+h!zKVz-zf*)Mb->?^>8=-Eko*_`bVzf`nVBWST|aX~lyw&oK36;``qm
zfe7zkVxXJ1WF3Oo`KPCj`QSOK#qLK+b+<Y;vujHrx13J7%M7L5A9~_T=;!#Hk<3HK
z%8mOTk(vLax+X$qOmtdVy0N^aOP2Upw=6Hv*AO`oSXKkhAC{98Wins>CAik^w%mH(
zYwwtvn%%Qw+Fedf?hNwi)U=b;*jxAtU}OsG%egL+)t-)tCHmd%@4mCshcLEh$Ga0!
zIX$9WN0vT%NBUGUcIG;K5xw!rHa(fulNL&c-PApPScYJvfjr=v02$?$j7o5aNW&&?
zc{<ZBy%5<lSEN|_p>L7(B|oMh?kT=0<4!A1^bM*OB}g3_A|mZ9n4)Ab?z+E1<ESUA
z%3Qt#_`xxKBskD736bQ@O6#N=c!+odx0qRDE>9&n8byPb88P)M+qq&KADx_S?-&j8
zv}|0Tn4K8gQ)%M!y^1W#6<Mbs>y)LGx<_QkS21-mFtzM!(~ha#JDr4L-Zi;HJ2JE5
zqZ0*OUWm#*@*r@ue$|(rWFn(;j%(+{?y)`7v+~a5Q-ter3G1x{eSc!do)lHxZHex_
zsdrOQRo|{sO+i&1s!~lsRsCj_YJ%<f=B%b+cE@||(S51!w%M`w-W?kqm92s04B4@5
zc6w}jd~CAHuic)SRocWzJ>JiGs72Ou=X+@!<bbCni1)^KCs^m5%Gd~86`a6TfxS2O
z-p=;-X0;39RvDJl7Wun(?5bFdj>)N0?YvJ~LH6yOm5P&COv}-Tm0(&MRW;>RG_7Nb
zrqyZZ-aS+Cy`k0Xt=Tf_?}aj|y4w<6cQ2Gxl^|7Bg14&(Qcwv}R0)Qv2vSf9Qd9}P
zSw&EZjkYHeT<(={AC*%b-$#kxH(kBeN}71_7OV8Ave27FVv#T@u6J_cp?6Z59d}X%
zTot5fkM2w39^EPKPAaoS{{BuXD=4qOld?W(MbfCtdg1qX@7g`P<J;e!Ow#7=sWPF0
zX<b(|4MEYg{wbPPD&5th&$anQ-6)cDM%@0I10Q@KN4LvQse_}jkDq(x>(McXC_St_
zzjndidw2JHvvL}h%HcUVJ<)c+<et&p{!ah)*q*UTJY73G-`ml4k#%gY-{d4+QX?;E
zdcKVJ(UFnpTDvvTr5?WFmgIO)6XncKemr|fUNih)LHw{+U+u)3Gpqdu?Ul*OXgP=%
z-4=8likQ4d`>`E;9fp@$Mx6;z%MiB?M@u2-ff90hZlvP<v@5F<QyQL|<`W*7h>Wf@
zJ0<U2Z*%9=?A~3wCibFBgwBbfv->9E(u+Jsy@w!^Q{NqR@vvYt#L)HAd_bQ~X02y`
zbo8LU0?M1Py!jUrpivK2?kzD&UC~3YT0hcPMd_PXX!)1TAIr<19{V8^+2tOzVDe()
zHa?+RACyB7HAitNZw2~o3qP0QYuwn*F&&7~{Cj_Lx7?qjI{KxT=y<s!fM?r#Cy+P3
zd*&Xadv?gHrAD+X>-j#4ZXzz}lVgx{)864Dy4L=8-FCll;daT%sD%!CVt2nPx7^DU
zw?-e3jRP`CqYI5r%9NL?%iO%~qCEM-BNC{8%aLyYNW%1P)A3ASZ1SF>W4CT(Mc%u`
zlX-!h)r?S4c_S@(#nTrNzDLRHn^be@2m52z)WEM2B_u<ddOEFoaFCN;J|c%@;6T<e
ztDzI!YgBY8H7WMhilrUwNW-;7(Y3oDqifto5#sNf2#^C)4$7;i>}oopH>+d!nWx9B
z$UY{Eo>tiCvRFkU54Drl1Py3x;zs3EQ$pY%EG{jx5PHy+mmF<ebY4r_Go4Hwme*x{
z!xs3YtC9MmGqKH&&-(V$UAtcJp0VlK-MeG8;lXXQZ^r<ee9hv;ZMb_};p@Dhds)(Z
zMaKnYlvajs4lOTile=8rBK`YfxOUNd>m7-orc3!G`c9TL=_<RVsGlU*$vz!2s>k+C
zjl?q;QBjS29s~|w2gSfC>qs4C4K2RbW$pBH8_s#5iUk01l$%d|WY2|0kQZ)F%frlO
z>1@kb0h<Q*#;J&8{qEhfGJfZTkl9W<_!SGn`8g<K7yK&h;v#ghbxk1SEot`|D#;Fs
zsVbV_>2efVUjz#j6$Mq)*6frA*a<oKQ7BzL>~7C~G!!KNz!!`ukk-q^9gjUXqUVN_
zghGar!mq2Ag#`N9OUx1bfk$2C;*O45lx2sM7mnyVb-;rxxJ(0Sm6kJRRdP=yIb9)`
z20QoU@{@4d4)_sRuP&j;HVMsKX^W!^&!&L|@A$%d%Z(&YN|*i*Tarr>3mr9FJ}%!4
zacqHB1*3GZ(i!~GJFVq;*;1$nmmD}KH<Ydr2seS|qZ<{J4=cESh<^1&){DEN!ewku
z&x$f-6rir?k?C*ul?1hCtwI4O70L?U-|z7?ZOSz$*1_#A3pMrT_jfxk^yU^-=@>ab
z-tQ5lw|sOdL$ETxAb{UL$cJ3fP(A&_?`T(!84zt$TnXLFv+5CoOtd8Xbw7ePlc$@k
zFFq(Os0?#`IPa>w8)lSdVRG-jX`Q{&W`tNg>PU>EkFnm^%+9g4&JwtIXmHv?m4Sch
z`QRRK#VePxg+)i+wKB_<bST_14SyLbR_w*fCYWpajx5MQ9qxP;*>o*SF13eVg~>{7
z{nmtgG<ij-c(N;0O?0oB&oVhfeOY#aIaJ~!TzY4N|EM6cho*QHI)+EQtzK(<MR9pP
zj<~y$>K<e6DvquTGh{=Q4j&n<We5j=rQU^^G1Vg@3Z?>R!lD3>xD+X6fUcN|azHO5
zYNlRc>wg^jk(^e+vMs`5{E?hJqHhS20O}Z{Y;4vWSqj_VDy|nSn!XyLAyy6Pcx!);
z>@w&sW3aeaLWQRg8ioMKec{uAUI0BDsE?Tfz>B0GKo4i;ZoYuHbg)4pT5-41%Tb_#
z5zJls7Dlh!grLltx)FcOX@o`LQa;kb@xLxBB~dyv;AhTtzEM#{+$`(-QQ1`?FK}ph
zv_Len?k!F7RF5>2xtkbqntY4$7f#7n3|SzipL5WO5`Ubxm=_^=gt`X;BPSs;HX&*{
zH>WWpja-A+$5UT4iY!W@R(iS@nTaVA6RpLm*GsZTM$RG2M279Yo^vCsZsc81Cq;F<
zTTXhFh3s<0mtvK*;<*s?LRV4E9`<j{I;HDgFJ(FIq9f9HsFnkuB|GCP^#UqQ*I{<`
zWLi#|L0Md;odn%ue?XepaH0Jl*C|mU^p^GZmueu}E|p2{G_lu+0PsBsw_hKcC(4=t
zoK+!O?yW~oXqWXTdVmgk+`N|KeuPQSjL=;q{?0o&yCU;v{vjm2b$@H{+0LTV-as*~
zL|hc29CLZ2X4(R{ff4uOrH>>xXcI<xIy?95locF02&C$!O5-2RADfrYhR9p7Y;kZp
zN{RVsg=Ok=R!%7KcaY>=SDsz++M#PNekcP8UexdRI7#+LL*TNF69?TKsx0D?YA5R-
zFf^jKnS5AL5H~w1r;g1kpS)j7vFfY1+ubMIA7oZn-g)H&jbn#pzED^79@8Ucj>)~I
zGkb29O{=AL;na1Dd!!rYzZl}qgm$0ak-pzycO@%N56S62EuFpfONdwW49KIpf@tZm
zv=x5ofqLs^9Z8mMOPSRHD!m!l2=Kb4J85JkR#z&k#L%tHkQn+U#FAuL6LeHUJAVAQ
zd_h3J4Kw7=xR8-7?cB9KmK`_JThQ}}d_6Ki7c?D~FDb~nl><vBb#1%rQs|X-1Z9D^
z>@C+HSUOP}P`B7pmeqSd|2YNccTg6M>nWkqILf58yS3$Mr0dY!47v28WHiCOj=1hE
zZhkpGS;LT~&TaCQ$GUHiM34n=x(r>SAs?j(vGG|(BQ0rJMJH=5WP_WQ@sT6)sTcV)
ztp=+fY?Wglq}$<;<@qBr2P_K(-NVhDry#4PwGQaP$x_DhqmKl4P_mvJD~l$jW)@<N
z%OkSjRq4H_6o+gS)e~!dxdN6NsLR5Npw=X4C1xdqNR{<P8c#{38~X9@AhKupgnTJN
z$Axrpw%i}yx1}}6J&v>?lb&hm8iiU$b)Hv-Ahp@oCyFe1greTja({+q+1;x$JuK7l
zKbD=E7>jZ;n{icf3srP5OYL1VE@h<U6oPO*(iW;JTL@Wtr<){PTkHyqtMp{Wi+*)X
zo`w2I^p7Cb#6VR%d?hE4ozR7w#^f3$QI;yBd+D`(lPl^40O#O*AS<Axd*MgS$p3K{
zr?7}+OVWO#D=!VYBE~&Emt+wV0aqg7O14VDQ*WTu#L$l`G!w3md_V;&!8A!4!w=n#
z@dL5|%QP54LmaE@i7CWiuDi!&CSKkjm83;~r>tF9DO6w9K4UaE`EnG74JF`{vcfgw
zf)hfBY5csl*gGpzM5w_agy0obJ5&LUK{Sl}Z5jP~e{}ck)Q-0M-j1I{m{L@yTl~rO
z%qXeN(jXNEY?aQ#ep#mY>zS3vS$RihQsw0BLPjmh+zGp*N}?aws~k;rMdYfsvih1_
z#5jDaG(l1BMOpt@ROAxWf}*}DD<JKptUQxDOTQQGWPR_KXvu{;4?-V0vZ_c5RRwJ?
z-2r@ZDCvr?6jE#b*of<@$heNybkK^pOFCdJ#m40OpK?-xNc(g<=(xWAg{uj9Eu2&@
z`O4!?w_bPm(t+`h6`ImmNzYoxqdl!iyJU#mF+=v`xG?@0&>-Zx6vDd)jxqpEqbO+i
z2m6lQ`I)obgD&~<g{l=fEmc2v2*hQG6t<LvoW&Teom3|6;~x9L>_@r`$?r?_FMl3B
z{IT>p<QW+G=$uF#G@mhVg{RH7mdg|uU#Y#5E4$@To>6T)rG1Y|(2ZQmkzcZr(p5iq
zoBA@+n04jE4_Or`uOGSunhlN5+Bgp+W$siq`QD&@X4YlCU&B?(B{?@sk6-&(zX+wv
z2gSP>)9E;-g)~Gd(0Z=5@}$mMNaAHk07rU>his}m(3P)=`bz6hoR&c+skG7$aKp>)
zkYnZeP(BAB6<evg2c>aROaV!Dbf<}ybf@Knu^;bzSI4eD+$q-wx_%JHdCEn6QwOX_
z;yT2jS(b4+iRqE9jBaRckY}xa&()nxDa}LKo6(7J?HFM?C5DN)^a-i!@@qSyAt)FC
zwUW(>Qe3V#?k39px))t(B%c@?o1J`52LD@CKH6`u_K?|M7oQS+JR4jQU#3uFs9kzY
zw#h4kybxf%OqN#YaF+qPsG*2p3|QU~I4>vF)Rn6iGDtNHyOe#_ZZ)o=+D&oA!3*D-
zIs)}WLmIB#%2%m`^Gleg(r!)_C{?1Q=H3~Odo$@-%Nkah>~t?Y^3Eaa@_i)T@oRcA
zlJ3KF&8ZLD?^g3OY<wxyY>O1-kt=tYenrup`k;JA7xVx<x%K=V-}-Q;ye1!U$8G7R
zb1%psHg$EawqLz{RF9C*0criFq0DNWz`k>L={jZ3*L^5RpAR~+<1gfS$6+3PwL~7i
z`drtuxE(p~l9Qv0`xd7J9z$nr-{Ow>`J>;J;m;2j-#d9^OgC^$>jy~nBL(uA))d>V
zPlERrj*w~R(QaE8fa^m+KA!sawu8R4DXO4dWU5^bNr54gq~8`Y#Cd5)4t{FFuAFAB
zd$?*ttviF{r9j_s$KRiI%T302?AbFmfp7L<LOrkGr`GfSllxrFuV&}QiEQvw(|i50
zh|0)~O-}Cht1v3PxgJ^*zwoiER7|oy8Dx${9C>w-ECeo_z;z}}CPd|BSsq-{-be@D
zxiWesN9)NDiPSYcd;5f&pFW{oe%b&3vF}!E)_MxRom}(WeHPADI;n1fe15@2L5}M>
zsiDX#vTU=|dDr;`7mBuba;8owP;V=~zR1eFvMya4cJ+2gsri=*?cYh^etSw55lN|X
zf%xq7<k+m_oq5Qt-t3NviM=~zv)btF*mtL8bIQ&!SteZ2l7W0#RWbYSzFo43t=dm^
zzU<v6JK0LU`}R!jYq$4KD*Ns|(_@pfV`H;>+eP~E_xH}e<shxNE-8{MJ%7jbD_Swi
zj;~}klCJN7KGm9BO+qHRkyjd9^{k7m>gfNZK7GdCYfpbKL|QXk<LvG{FEggBVY232
zDw0lD3=OuVzUaTJZ?p0O<f@5|3cls)gFf=4qz@nY;6og4>Asll9)svV>$yg9ls%t~
z$B)a{k$z+_v_8@bebn9NX1?Mcux!xRKG;Xyx8=+q>lmAzCPAad8YidwxP6dl8<|4)
zSk|ZZp^s#NzuQ$Ssbf(|>w<eMqOv;edj)u+N*gQhB(iGT`CF&K#Ui{6D33b|Dh@(#
z@E;wO?hu|f@;H$fDYr<&k*ObEHzF@rTXYCap5r>WAjiUpmFso5$s`$C<DN80nB<K6
z5Vw35$?5q)r4s5wdsRq6=tgWm8hk6ntRmK>sA>9Msa2+Rxg?8PSa^rrdy3MikCeOi
zG1&UY+3vGf8^ua*?Tm!QBC6}>8eNxF4${@?@AE|^X%p3v){$l9AEQw;^t}!N>8CAF
z{vXIZw5ywMIZL^ulAOilYvD>)Mzs9aN%;=5yKPo<1<}cQeTK_DBM*Q7w(eIB$$1(w
zP_KOluZ(L+fwR>JDrFLmjAF^XsK49X@7wNoD5OXqpNtdJg$@(BTsdpEN^7o80hGHH
zY6t(&rNgyW;bR!G0VG3y@-FA!Y$D4-nHGY?zCdJi!Ap-+^ZQ9L^ixuDk0?op99-t?
z{P`vE@-&?ZFjQ_6jgn-kFU%8iL~A(iN}uuX?vU@>?2$zyc)ZAVBiC~n+dC~wL1o7R
zfqgqwoE>z&xOgkRkoQL6gO6Y0qZfN-b?>IM&#qaH*d}M(f^zS>Yu`j6sOeXF?$t%!
z8s+bRykPG9WSUz-H;rQO61F@?L)!e(&;le8h&86B$7Gd=+tP&$@~deg60tz%Deww3
zzIWo?+0jXPvNGxK?s#uj_pcTJeL@yM&Fio#MfO-?2wUDU<U-mB{qC3aOto;aAI9CR
zh4S^D?vMd4`J$;a)E8`hJ=LQ=9iWYgECJ(`g4*j8PIzOL_lOl;TPEj=>d3768}#9^
z0E!Xbp?plEaogzSDGo+q*;y|4jBm^3Q%-U?tY5P;sT+WOC&m`{$DpiXmeTMWQ)0ZZ
zMWF1VE7C{zz4zYts%>?7d$rHhwDia1MY1wTw^q2?>wR4dKA7>7x6x`JU5CD7bVobd
z*AS<qu&*Qb(Ac>Oq&H>kA(<6cbH})5R@S4id_T5w*;Hw!FWA+DJ9LqLrHv)F(z~$q
zK8^)%l(+`DX;Q7BTD7!4FYoob)KkX4T!(`5?&@umAMQ5OER$0r_DpI2c-DQBVXEy1
zZ%eS;w(c${5ooZw=hZj#PD3uGa_g>n^{nhKX-wR3GWJvZy^g#PD|R?!#_yzzgXtHo
zWnW~p&{P@RSc9C#uEAjUq#Kyx-KJyz5)rIA&><^4mE8-qTFD8Dy81x9Xr!=`>r+`8
zh@dKR7$o5v0)ZnkHMr>GA>sj9OeW{4IU-NuyU~az=FxqmqcJhvY8QrM+|mPSePp=b
z9g!$~?ABPjHMRS_wjKw7Hlih`0qoo@o0#L5P3*Y`l^!`68q~x~Ml^9Uk4C2}v$8N_
z{`)A1Uv=!{{Q_tDsy)ZWL(^99^>re&d%kj@e-JEmyu<rQ5oiZk$5nN@+RgR5<A1cu
zes}N0^p0<j>D!X#z^>hLUO|jceb?7v>h0Mp`vNteBHQVGlke^=AiTFeI=(0)M6#1X
zx+ngHKr6%%{fgi552OnDqAfsfV8|7z>@|>gB9yhCHq-j6b8jw>bQVl|T*u`5>w0&}
zT!9t>CyEqyfSdZ!`s#M$o4<~!<10gMM9Hc6c_KBHXPl>!(O!(zDy5rzv&yWHR7&07
z$st7<Y?4^HF<lunGFc-X)JwA~I*BI(;xgMOrkF}bqSQ=tO?M5ugzE&b1Sy}LmeW_=
zO5(TWv`by<B8T0`qxGPi<);JH{)~0M#z)#3+2s5~oR#4YoW~rzY!?w5-2txO)ss2@
z4`pqZ`=pKw%-3R_=hwWHE#k93oIf!yt9RVkuBKeq*9+>uuU<wYUAYme)r%gHMdkAR
zQc%*f);&FbQNP@Gx`MwLN4X;;_oz~eYU&w<&s#TRTjd>D`#l1s@C-~eb;VPqHa$`c
zS>;e|0gp-xw>qbki+($UE}GB{3&s5NQTAi@m1b_-tJ218Z>Y4PPZ~o!nJTT!FSYX<
zB`VE=S8C<nf-8;aliEmzROdQ8QVU&l;F=h>IJ7djL?va>7)9GODrr)kl*et<sI;a}
zWTP*EX*G+`NLSa<rMeLs>B{V$E-Omaiyo1Mzg1I%0v_pWo0)1yXr#;C7R6kN&`39I
zz9=fkaHNf#a<eIJcSg~w$~&?~-sP;Tyd!HRmmwfsO;@V0C7;MfDXVQtK9LQI%&h|}
zJ_lSGdpy$jC6=hiaHOpzCNa{5^ToU?dPEk{Li(ab(Ic`bt+g*&rJj*xVL^S-uIv?A
zY5s?Gy+y0CS7fCnkg+OzMOMXC$Hl-BzsL@ys;@jnqoPM-;R`S|DB#e~tXD=aBI6r{
zrR#Xz?3gaxEyl0xRkG4|oob`Vr)(oRpRqBY$R?~2F2*c|BkizwHmnFPnpOHo_R-4M
z3`0gE;s{~Lh|u9uh9-VFJN6!;zF@(Y{*iqYvx<-_d?Q=!*V&TYVxA>_CA;Fn-qben
zFWFZu0Zv&mS`nAbQp%FyqGiC!dTzO5g)Z?(KP*)&s>g7o?O$rblEtD;>KR#b^`Wg&
zEE-q(NA?<~3!sz-1-ztB&I*&*t7KJP7Fmp^hF75xap2{}4RN@6tRg{`cVulZIXQxi
zM#O;`DIH^}h(LvJWXqS8jB%BBWGyXtVeMWq=@q__Eypr4Ay;`v*7}fFOFvUm3^(yB
z*(J-hQu8X6h~?F5yNYzRx)HCu<ZGfd0d65!k*UJBXe*5>)^#O@1+Su&YfN)?B~Mt!
z3#Z(qmW5a4RbgedI=Wk9+oD1RLpo>>n@7G;YPI$EBNtJq7&MAJA`2~wN{gaLr3F`X
zS>|xe24jF&@g@F|z4kUrd8%eHT+;S;cqv7yZyqHJ+}0H)kx$7cUQSj_kp@-rE!h^<
zqNT=V?~=9Ddn{T@O$&Y{J1%WYts<YuMyGIH-w~^-igp#gku95f)v9QOtGpv?tL(NM
zq8NHcBjT`mT3r-Wv`+jYJAJW8r~8WbS)GU{J9Aj1dX-v%t$M1lOqSJ(xC&E~MS`+d
zWTiKFG=EvNOFbjYFwI%CiQ!1wCOzGhXVE70thB^*Y0lQXBWq29ESqyv7e&L8Ph^vs
zi!GYxl_Dk$1FazEg^DcI3MGbkj*hduDNRPJ#Fd%WOX>28CC1W3Udogzlo;X}ywtqp
z8`+{2mwCgA$-N>`ood9YMWSuJPB;`vN<NWI)vRIBHlq=7RLmh3DXJAB28~}l-B>iQ
z@QrMf>D8ifm3L&V-1xFP=1MBEE>(ya>`hsE0dDz(E(I+{BC8YeRL?J#i1JDiQ*IWs
z7^hcgMO@VZ+N@`hvw?QR%~uF{5Ah2@!fa`g^_6-NAKqt3SIW8y-^exz!_C9i#Dh99
zkJP8?S=$oVtMnp1t)J1nYmp@N%v!qX*;iRpA!3l-S8gV^XcnQdE;dMVrnh91`bM^z
z3^z+!G>TyD^|_DOX-`|)cXv>PU_-Jx96o+|l+Lm8p{Y~dvM_y*9wPwxqqnf8O>mL@
zk~WpMMfkP?{>@;!Z5C$+I{kP2T)G;+9T~qJ8NWSi#v(^PLt>#xVN_Li)5Ch2zUIR6
ziK?kuL#?}6R?keVMvQVJNQM_CM+?L_^a1Csm15)1QmX<v-5G_1DM-%dSSaSfp~cjS
z)03$WCm~ZGn`lh^!fayd#W};&hjWHW)RTF?)Ha>dOLaJN7x`#kKFu+mC`i%bq+3Md
z%Q!XAdn!ev3A2bJo*9c^#IHEFW%+}M=DgK9o~J4rR{Ip^sm#JB67x|8YZ{}8C-W#y
zBSlF{XNn@v@^nz-rHLs_>{wXkiJizQnY@YoigPrPhfgc#XnZ)C*_OzvJf%|d(#|5M
zM=a`Uq|r}(;(3sWD)ep&vlvDg%?4yN0z;TfFzbR}MRO6cS6FLPSDb4wX7x+v3!-$X
ze`Y2i(h8&gWsIZy5grfYN3aAGpFB`(T{$#f9I1~|Q5cCY;<PP2Br=2MQH(eqQW*R-
zZhQO`N5xH}VpKb#=Sxk7UMhPsY;Dx+s%4Dz_E#?(c{Wq^s~S3vqE<T`9O+gJ_!fPo
z?nVQ*77sBj4cx*m9wH5cjNUHxviy%qHdcs+SECqdg^mVGEk2qrH6HO`sTpbuQi>-B
zLv3&~ih+AQ_1lD^nA4;*NLjKgk3yEb3nPsszi2!$@~IdxjC^?u6h;iAl!s+;#UVk{
zNCx#Ha(!}C59*oyt487?D!EzQC;WI@V81{qd&>i95rGzdX&}ua5f6$*HtD!mrKb&S
zMcx`7JHExHE<Z9=GOrk!vM4KmW=N?-lOHK6DW(HKC56&ZPvpy{E<4myjCeeLV?LQN
zm?)U)A(lu%bEQ1QVgXc*l9Y_oL6Atn9@6DO5DTMvaG+FAUok2X1y@Z~9F?$ud1uI-
zQZde8dU)(mtrW9_g>U~+ytIMMzx`WCS{S9b`kW`<%cD@DH}Duu-?1ZK4Kb`l=Bi^|
zTJH|@las9cMzrwNKe@qWJ+gh{$bS`58)_QMegXY3r-S@=Ko1{Slyl7VSSYSoZvF6g
zT_;t}Fw_@<;%epAG5z%S@g=u;L)TUN^F)-;H=T0&nqA=NOYfs+g9bH!a3wzS0~=hy
zNE6Q%NA2{wRGk&}dxITwG{)er<%D_J5-vx!71wKj?2dG6EqvTM()xjnMd%Ufvg1Nm
zUdgX)+c+Vg7n0*rW#@z}5*A0_y}aXkvfAwG?sIY7ORczgg%!!au!`VbPsMdFi^AZJ
zu+}q{<TMG%K-sdeyyCv7D6v_TFL}!6X8BP@Igmw8)sd4Q^|M#{Vz1`|`qSm)nJ8!2
zOXpFdt*O^1gq*aZZ3K@K(up#+=R=O1(C(C+f~VfH-&8eRYx0p3rS#+&2Y<GWKViik
z)*v~eK75km00+#fI&$4E>b8!{kg0RM9X3La`wy<k9i=&>x-KiY-*uurt>>S)4?|5J
z`hh!0C+z6Q<f@$GCL4^od0N(-g%MhOcvEjzd4lSgZTFyT9njo!k#PB<dt!B)ot#+g
zcHv15`;+qJy-&W^ErsScxT@g4vnln;WoHOSj+c{c#f}O&F6dbI<0D<!^?X!5CoP2~
zC%eedmD~!FQ+{KfPpX`K;dpQ*`RzVGw$$2jtb5}4k#7IMJ8!=;wC%0Ie%<ZR?LU63
z|HRwB@f*J}ysi5y{qk+KV;}URiub=Y_>IADywg9hu)Mr<@>_4dDN#^{Z+vk4xO|?^
zw~617H_tbh<*SF1^+%4qxw!bz(O;LkrJ344IDhc11Bbf@2j3a&zVpsozj@#{hu{8<
z0|(z3e&?O}!$SwUhqt{gQF-f~U%{u-PQJ-@<ISTdkG?6DOaJAW{Ehk6n+wN}9(waf
zA4>eXAI`t&KaTtB(v%!{Q?}8|N59+#TiNd_pXrjQ_`KBnHEJ#)a=c!-iyF2UCE8^u
zjiG%sT<LX8Fy2^JxySF5?S|=A%TKl&>cKm5y7b3#u#W5>((je(R^5{a<h#v_$K}oo
zAE(!Prh4v^rm{^)8i(K~$J5Bz)rWdEwYJatVL`{|=)9TIJ5zuE$irbtK8t-|X~9+a
z&{3g)hq-&8hRuyq#kIip?Hu!GwaB$@xRfvC`omM>uCg;KHdyh7vA>ATW_niK!H-+A
zn@O_eP*?W8$(7p)Z#V43*p4aecXKyzXP<mvNOzx0Lcc9r1O3)F@%pxG?36=KN|psp
z<ZQ@7ACw%XDu<-{kM63d+bCV%(LJS3%Exr%95mUoJo~ORnXQBRQzlXhf8xC(@QnT$
z0o5pwlCkt3c1%w0_}=W)?(dKJO{udCAk+Z@j2iZGN>t?#D0iBXf28UT7JP6<pK|49
zFUce9zMdRIHY0AXgUB%L2(l1!o{sE8=3|wSlUTVAeM-Lw83{wYxFEs+LmKrk1BOXU
z$@oP%KasHM`WI&6L0ukW@~Dv=^oSGA2GYXSUY(x7EEDE>>CQ)$gLM5Vg;cj|mx4<E
z)(>@PFY%I|kB($%(BAe#J*N;o1!hrD(yfRmj(;E#mrvH}td$;r=RVQiI^kM@&>T?E
zQ~LCrdRI~9tXe%TPr5Vm5m-I9)!9eaqAgE(Jw{g#+zkbXmm-ZuC5QyLZjwBgB?$jL
zZ~bh%9_lTfP?v)XE(_hU$o>Q9C*@PQ@_}d#%+*2vmD=PZ?XJD^UxQW3a=fDA%jZAJ
z*Vn;3g^d*_I{NBX*k!8?QTWQR^o|StHbk;u0PJJ=2)fiDH++tJ?R|Id#qM3j;|C0l
zH^2+Z&CRoVj-cx}%?haw$K%SXyuW+=!P3WnJgcYvy7Jd^QoN+Sqz~~)+PJ9?*=i@6
zv`)?+b60+UuV`C9xaaJl_n~_*>0?jos}4Y=k<&pgVUWzwPn7%GsE0XPC3H1OUlEdo
z`S4=%?A};zndM8Tyv0a4W1FnM8-(q^kL6LKxuP#*>dL(!U$U1r+C8!LL49EPxO~^k
zo%-lSd2GwZWO=obYV2%gRT9AQAY<Ll(E3=u`z1#@#{n@>X+y-;(|suH6*nCY)R0Eo
zCxg+~+^QaqKt6^bL)*gU*QH#ws)tab&Gv4qx%9~o{rBB=AJ^F^HLf*s<>|8dl>;x)
zQUhVb1BY4UMtOdGl+*1M3Vv9^zp2P1%+Z7Lu$OVmA}i`^p0z@u$WXdlbY!#;t<?Wj
z_HMy%nzkZIP%1JZs?n{RM5a=u$il~4K1-@J${eLmLlP0z>o}A$2c8NQw&qi`iJlXQ
zRnf0#mpnug>ne>R2O9@_QYR#-3hsOTj96&1+5Sk=1aH@gkcR)TKhj6XBwF(y$^m~)
zI{2}6Ke{p~@v)v$AOlS5CB1K0tDzpstIJ^RL=C-RaLQs>s%m4I6}OY7rl3%9XA~8R
zmDW}20zuI~RO%v0WsNPWRMp3_Mn!!r#DxRlX)KHNrpQ}WD~cLvk+a6j(4rjUCLewh
zgH|*I`~Kd^@5m{lllykcaYAGASyMSK@!j3itr#C2o7nNavC#x?OE09XJF$DucPdnO
z?w!~>IXgAJdsmU#<3ci32oW(UV2DKllNc1Pedq;9K8ram-)D8{*`wdGm53m)J$wD7
z_uSduC+DQRyLaE7(E`D)i5)IWU?g8G?aX>iUN5Bp9kWAs?%1<)Orr2@Z=c1g7~6aI
z%4x2aKhAh!jM?QbosQ*|VRAC)SQ_W|c1(SzfJ$+V?wFRZq?A1*Bb3`Kzq@ZrdZ4~4
zM2H*_yN5}Wqd`Z<rgpkd*9&RLHOZLCv9a&#$6Z^3%jb!um%4LehaB!Km*cy?J>H(&
zt)k|&9x=LSO226;z|{Aqc1Z?zBp&bU!K1r&?cS-Mm)HE2SWoWQ?E-gKdnZTrW9r@u
z7qeqC?FliF+T{*OlVjedK`p1%Fou#WsR8YMsx-Q5f=Y#ZL|VpqIi1yBz|gKq%iubP
ze3ZCemTSvCI4qwCl&+oYd;9la+=sl)rB8YM*kX8T5mmF+mm)W8E?r~kHCBYIuL^el
zk6ZGf9aI-~^$Q1r*O*&C;cd_#707WZ_g=LuQxfuCnfBIa^(45XdgzLCx3Tx!awq9X
zBQ1x4$|9f-(FG2GdP}Cj@u%c+mPd+mdUj&BjKz$P$)|taTj@!Olv}UKY<4}+uK#t%
zzNB6BsJj~;KG6Y4IMY?zJjn<fQm1aYhiBz1!v@I!MDgj-Qc9gZF2R+kd{{(Iu9HI;
zm&5Q+(G1U`YGXHlnD?q6uXu*RKK03YRL~~RJr-5rj&LtQU@cqBetbk`H2j-TP$@ks
z173Vdj~<KANFIj3(?=jY<Tm2;j3MqFoOf6B?i}5786#;l^j0j|04$m4Xo!5cRzHHn
z$jdYt<#=?!9Y^{>P&>3DBReoDs3DQQYWw$_;s}{WM7nJU<tstj)svTNITKz!tDr;D
zI)f%NkQ|)k>rzV#rgg&Ia&eLB<e_`ZW3K62v0I|%RQ2FAclethads2AvxhZY#7MHz
zUCNwUOR`M5ioV|nSv!-hd3mosB8^Nu9V(}?`yQtX(!bP>r}SNB<wMhNxnCLj^`AIE
zlu!O;p7e^wF#Op4U+64Y^|+*V6~jElCv#yt<uvq9j@}Hzjz8JaoAS&I-L2wNP`-U8
z?T_o#U_kVf2`SD!yE&G>1QSwtM1&GfI~?`nv+2}m)xm~*D$3JC9zXmDgCAzl#VU&U
zjybGfugB^qA&UK01nEXjbg6+0BP7+;-f&fjQW$F~&d0h3W|%U>tZbtxJqac}-Q!rf
zIbZ+SWw*h?_GOXcau=pxagxkPO1Eqhcv|4WHtC0m4+s4zF8`%|gxgH*e}{*6{f$+4
zl>el6S$SSq+vsGn_><)@X`X0CeRBFX8Vr5sKm+;{J?qtoXBPiOEH??Y{=fa2l4xx9
zzs>W@TB*Y0=rx{a5kv7|6L}P$HjxMRD=5OpPUNf4myDMz`}bc+NmtWE1p4ta_sNkA
ziyQokUbZUYpsNJ=Adfnw#RX5VSb$`)(XTD%R|Vl-U{F5Y%ImE>P1B`7AhWPt;rds7
zzUf!%xRE^cDBRkN=oQ|L9~2@eYffx9!ACR#Tqo!+@zT>!?oA%xnw^y^O5OSAVcn?=
zZMY?>T(X*2u?mKK=7<c&t8_UQ{d|2aJjp}b^vU-yDmx>ed=EoD^%g!H6Tg3d^1{uY
zYqGlWCw}2Bwz%n|iZ}9~t+kJ5i8#t0T8-KTf`1-MjX9g-CXO(NWQz<-Yb9TE%^_37
zyvnW$rGg(&E;ocpp}um-Dwdlanw7^NTjau+yY4pO(7Ye}XYf?#wVPwtr$hDXDcgW%
z-z@nHTt+1=fX;5{;zNmWJcq$~kdTgW(hhnKw4-7)`4M$IihaUBmhBPhGt_lLs{1D-
zU@k`?sb%qo0|jlQqo<32U)|qB#0q2JQ6LR^jOAV{^GWjuwNhrB<&$TBev3P!2*y2X
zTbo(+g3mROTE}HWnCw?|pA8|*$=$-zNS)ICv0Gj&d%tDxo4br&Qfk(bqd+(-=RfY^
z9zuSCk899nE%4%zd0ohS<e2}CohUi0BlGgfVVS#flT3d9p>|WTC|jzreijBzMzktB
zzX}-Rf}s=TdS|n<9}dd|l<u>TU)fgR@-NLq@x<oA_(`ghSZ;B#pZU`s8zH}rT;@?+
zBPr{HWs$H<j-hAm7E0Sn*VYQl;LmNiGTaJ`5H|o|dak&nz6gq~jx%x@gP+H%n!YdJ
zcHvoswt&}uVR)3@vSElMZpt6Yms53H1?CuMXXP82vKCiY;fn?qme0DC?GBLQk@AzZ
znDRR>|LOh+c@~{GB2B{aW3oBJH9Je%yY`$q7JBT^$1S%m9<+)fni@O2Cj-%h6_JqN
zOtaKYKgaE+Da#3tv`ULr<N8(BVuZ4RB?=*9c_-#p70Zr9+cgpRgE{L$K7e$pKCoyz
z$)R3Z>Rrx@C=izyuTrSKy>p8KLJUF>(R%ja>H5RbdK_kzt+DL74bJYlDffkMgZ)sy
z63^OJq-cY>G+p|&;V@5LUge`ZOnIzEdF_$z6~p2nM27j#B}G0C(JQ;VH(b58_j3Id
zyJoz8UnV>+L$8XJ%kQ7U5`?aP7FPG<Y7aqornr_sQt5gsuf6L*qp5q2-Aw;6zxnsb
zU+TgBBgfoV;*Q9NwcLu9zt|Cjs{J)?e_(c#P5LOS+IABjiaOn|kHNZqIP(Xj9bMG6
z*S1dhBM;o3H`nGh-$GG(Z)mooLc{Q@!(_pNZemHcSlE6P_YmeL%=-7BCc7<@x0UjH
zNad)+CsQP!OpzqdH}?PvPsP&8IIG0zGR<^xr0!pmu6uFQK)KD5o{RLjMXk7pq*~2y
zaB)$r+2xYh#|JAFcB{NfvnJ}vZC9U+DwEn!%B4`7S?unyTftJ+@1aTeUyf36z2GB<
zx_(D6_59*IZJ=JUk25GEEkYs?7tgxZR)3^mZIkE^jvPLGL__sURwW+N`T0nDdDZ>n
z(#DIVj6$U;Y-vc;;zED5W>vWq_cbKsNhU{cr192;Pqs9K#re@jkE#s_pKNIeTN;j@
zJT!k&*NyYeIVv9xu2{2<V;7{yd`NFv9Q5G27|U3k9`}n{@pAU2>+N~dmU^4M<<5D=
zi?EYhhxcX9IJq11ilw&E<y%V^5zApU{}q3&(qA90*R|T4A@&;tDLC~k9kL7rmQFB-
zP-YnfJ_1+bG6At|5TxMLvvkNZ6Ig2FG6&VAVA4JX@w7pZf>Vym9DIzWLzc7fTGy(L
z%Xz3?4kqnu5U(2qDLCc0q%0k>+zc$Waan`vy<pO&_$Wa0&ms1%^TN8;Jdog&qjx_s
z=>}a0Ws?WM8QS{Rms+cJMtz7<e~4O};$VR0M<LD_R7boeF{w?!08AKKqXf*s=yZr$
z`z*wB23>)8-JrSzq{JN(pARe@65lZB^@%4*d?~O@lK7fIb;Qg9vPpw+2iErjOS_I`
z4XU@{N-3<Xtw!X3X5qYm_|l+_Z}`Cb;YtMSVnaf*iODdmN1C$?LUjmkqco9!&ca!M
zxM<KBi02KeOA`snCTY3~>+8)~E<^PS+(v04|2+%m0mO#}J%`v@?~~G?oJdGEG1&y`
z{^l%wP~8Z(QJTm<V&RNKoG_>hamk>%av~wwBu!^weZD!%X{ero+bB)szi#2&gm}xK
z`w$-)RF|fdxI^N#z|tY{V}t658B?-JX1#!QtEX`_dIpo{a2sV7`TH%L0f<`-8im+4
zs4h(@afif%fu%#@X@lyB8B?-JW-Y*aDX`SGjdM`#!fljU<UeoWT!eVZpc@d^45~|0
zO57pw<-pP*@oj_Zh#6C|NoGBO^`pR2n_2gudLM41%p!m5Q$CUsbT7mW25o^jXi#06
zQsNGY`vOac#6t$v5i_P_lNgV~x*b?*GiwB@qi`E#7WtPfoE3<t47vdEvO#reN{Krp
zJ{?#(B)(!$9Wi4{Hp#4;uwDx+wV8DtsyE;^$}I9fvT&Y2d}>h7r+pIo;7SDR(v%W+
zNc=1icSyW35ZAuyFs5XaxD3F0FtF4{uOF&g;5N!E^0zIV8HoE0T84Pqpt{UTi8~~o
z3oIQHpE0P8m@y@rWY$GkUk)s_nROnj7vMI^Eb^~eICmi4HRv(KX9m@!DJAZZ_+DV?
zkodVlb;OJ**(9@iKjV%1;5MlEEvWXuZIoH$AGC0WA#OKl8seNmb!ke8J0u<nEFBVe
z4XPt%OvxrWvjXeWfu*))EkSh|Zlla1|78p3D#U9B-G+G2pt>}r#2pe}4=f!L-#4g^
zm@y@rWY!Z{KMO3ine_;&kKs1TEb{mD`bbL9n;>pBXb9qnL3L?Li900j4=f!Lj~Y}*
z%$Sl*Vmt%uxxiAJS#79J!)=sV<UeiUoP~JKpeqos8&sF3l(<9U^MR#9;u{9l5i_P_
zlgzpU>wAHvHnY~CdK+$|%p(6Y3+DyImj-S8tWQEeT!~;^no{BpiCclCL*gw4)e$qM
zWRtiI!+IpJ)JAU*szY!aWfuA8ESv?1iw2#6c;2A8G?9>OlBTP$zTTYWGE}d?ZImYR
z-?MNYKzwM>bBL|a`J^<d05Bn&m~4V|e{+^TsBVPYC`}_!9=CALLOgF!U7?(Y>KV9=
zg1!#rn-<Osh^@~z&bwzYc@DQx(B$v8a0Vc5HE0xK+n~CPAR*bLBo|=4)SP7ws$IB^
z(nS9A7S2V8mkhcAam}E*G?9>OlBNf+e$<@h9#rqcZImYRw>E_O&<k;cL0cdW8dR4i
z5|T~QG!E-_bCwaPj>2t}Ch{*?I4clO8FT^SWrOO{L_)Gjnr^~+tvSnesNR6vC{5&l
zWZ^u4_|%}DFZd+%!IcQsrHO=O6O#d04>o7%hw2u%jnYK^wuLhTalb*!5KkLamnIUD
zP11A`)|Z>JoQLWKxQ)_8{xu8d4#c|#J%;$qpt>}XkZh8s-Y=rG;WjAk7F2uSHcC?;
zlm{)GVTjuenua)MP+gixNH$5p3an2zXIX;kGTcUKBL8Iz=PJZ&2Hl2u&!D<Ak&tYX
zrYEp|)|}-LR3F1_lqT}`{gjWS1icC3W`l+xju=#zCK8fOh-Y9u*PNvd)oHkm(nS8#
z7S36S=M1_6@w!2EX(A!nBu#f<eXlvo8dPt?ZImYRKeKRNKzwP?#y+2fez+3Bx-^lH
zY+^DD>yhRxgHRoU+bB)spR;flATAno2I6^x>e56)vPqh*!uoo1mdjAR0=H3`$bZkm
zc>wXDLC+z|niTifpqxlZHZj=*>;C2}eNf#9w^5qNKVspGL!2<E3vtPyx^f~R*(6P8
zVST<i%W0^df!ioe<iBp=+=O_`p!*OX8B~`h5|T~Q^a9qcFE=jjXE1pVw^5qN-*4dz
zK-_B3D8#lwb!j3Y*(6O1uwH7;G6&Tz+(v04|9K1NBE(Au-GI1eP+gixNH$5+16V(5
z&T<c`_u)256Zu;|9qL0b#0>^*fjDSTU7AQpHc8VstlQ05MxZ(hw^5qNzhvR8Ks;s8
z1&Egos!J0I$tG#K3G21yEZ3oW18$=<k^hl}^915kgL*dlB=o_R2-c;Egk%$w0ay<<
zXX%IP7PyVlME<sgGXrtILCX+N8&sDj5|T~QbP?8<o3osU>IJxs(nS6>3+E2Ry9Pam
z_{^ZXG^NBH65k6f9TGn`==F&wN&GOdOp^GiL3PB;0<uXd^!|)D>Vw;$ezu_61GiBr
zkbls^8HTvsplOJ62Gyl0CGL=TB(QWy+%>3<m@y@r<je}JPY0ITn|TSU%WxZI7Wpq*
zI9DNFGw3$Ndj{2|iG*a6G(Ca!v*s+1p!yhYqcoAf?<+o%67(jBn++O*IATy;no{Bp
ziTeXfhs2`>y*}|IiMIxpNfK{2sE(LfKsL#W8CcH+mfD)thUzrjMx{Xh(-zKIi02Ht
z0`a;*b!ke8J0w0ISUM!WVbJRnPm=gjV3{QGHG^KCc#6cA1IrYN*9@v7X5NxbiuVqz
z?**3H;$?uhVbZ90$^Xp4c>(dIK^uS8C!rs%M6fPRBqW=d48wY)Im;kahu}6!6Zz*X
zoCS!B2AzR;-k`cPk&tYXrmL{N-kjw!RIk8olqT}uvv3|jd}z>fh^<XNDGkbrgk%$w
zO|b57&e8|fjc^;KiTooL&IH7^K?@L<4XP`rQK*tl(sT~ch2|`0pn4W=qcoBKhJ|wr
z;+jDZAU-yzE=?(Mhs3u7ONYcy40?UyNfO@+ER!UDWKbP3vw&<;3NK;Z^K;&~LH&FV
zlNWFsl>+&<SU6iD4jMELaoV7|G^NBH5)TEI4vA+Bsv~Ah$tF3o2<zp*QrqZup}GLK
zQD%|<f`xMl;$?$wLA+y7U78+4wdbp$v^PNPGiU(fkU_6c+#&JCz|tY{ut9aij49cq
z6eeIj9aw5hVHB$4a2u5Z`Ijx6QxH!ZbP?hegX+>mLb6GkZo&F?bCw%Wy$QEbn#lje
z!g&Vqxj`HLici8OxD6VGl(<9U7lF7#;?04$Q<qsO@g#|R0?Q<cHyZT%#8V{h4J=b6
z9x$jW@#B#0>6CanC7!M$W}%Tyie(Vd8V=E`y%(60tuSd+Z^%Dm;mkqo8gvTcS%d1*
zL_)Gjnl8ioYIBy0P`w1VQJTnq$HKV>@xDP%A-*uEE=?(Mhr|y8ONYcS4SIdzNfJK}
zER!UDZcrUDvw&<;3VqnYzX@)GHlP=(8{jr71@aGDI3o~84cZTJ!JxV{rNkW)j|Y|x
zi5Cs3BW6s=COLB&)@K7t?QOUM)l+aAWfu9bS~%As-Z1Dc#0Lh|rHO=OlQcbp^^4{#
zPoVk~Zlg4jf74&}k(8kOA#O2fJH&B=>e56)vI+4VtQVTI%s_QN+(v04|5*#?Jj4qI
zU4wYjpt>}XkZh8sd$4}coaGKw@4{`ACi1_C!ufe0-yXOUo6Qgh45~{L30r0|0&(1+
zI+kImZim|_P2^v&aF!r08*~ohMT6>MLqf7i&RmD}&E_mup?VE&qcoBKfrax3;$wqe
zLhStopA?B;U7AQpHZkdk^+0o$O;Ftow^5qTLiyb57+r+&O}G-@HHfzjdI<4}L3J6C
z5_d>^C$Mx#{M4X2V#btgS}6VAs26U7a(aOPU&3va!{i^Za0Vd`88iWL#-LW|uY5`i
z3CSi2Sc3IRbCw0DF2Ze;Ch}jja4ti<V$dy!cMNKk{>o`0A=xBNk6`_zIm-j6K7`vS
zO})R^a({hrCFnN98H2oz{gx9j4%G>`je;isiiL9;;u(W3LA+{^#luVG*pQHHlBP9S
z-)YWr6RNl1HcAuupIA80AU-!}!`FPoH^G$%)}@JrWD}D?SPwU68G!0mxQ)_8{uv8r
z4r14!QxMM@RF@_al1<Wd8P->uvs{GgCAf{!ME<)L&V7gv40;Z+^-De}4azAc?vVIl
zAnuU3ClJ?;TafrpV3{QG6N5<n(xAFh*o-)A4{>RaLL4_}4&tIgb;Kkjo8;aZSf6Xo
zatf-a;WjE>@?W!Xu0y<G&|QcR45~}h6R19g+bA}hw|Lqua3v$U5El)q3wl3P=ioL9
z`W%!mSUC3~J~XH<=(|w82e(nsFQMG?*F3$XdKBV>L3KfIhw2F2MnRK*(ZX4VxMI+G
zh?fkii%m-0A@Qle(joC>gI=F_lEh~N%Or^}8dOKjEFhbd!VOs83M{oxpKDOP4!2P$
zkpH2D^BCe2gIZtrN!S2aB3PHEl(<9Ur-8Ub;=Vv!+s3BElO%o-h$l(h8;B=gKgLre
zei?|TNW3`^PrW|zbV@v(64#Cmv(U&U#j*v_+8Ux)TT)C(KTI0c8}d(BIMWbk3|fMC
z%AmT;N{Krp-XB;xBtC7>>l06scp<P%l6b|SI$~x4*`yRM!1_{PsV#+bP(2T~Q7LTr
zWgoe%a3$y=h{Fc8A?`P*E=?pPn-DL<`c!k4MW`;pZImYRU$StnK)h<u8pOK>)ukyV
z?vVIeVCj(fo<ViQj49b9vmV3xX<(_X01u)12yUayBL9W~A4v&%Bg9Px4MN;*P+gix
zNH!s!hV}mDEE7;|!)=r%@}IJBPD4Cn&?Sgh4XR7iMX1vBjn?4mEnsVK6|3X930>MY
zO4VH$J%uY7`W)g5gZh5O2fi7uXw}7rgk%$wAy{v3&axG%gK!(AiTwL5oH>YHgHAy_
zYfxR9R-j5#EtN~aF2ik7QWv31+eWFn2BW)hB}4B+d|=Qsh%XJQOBD&pCd3<m73B@L
zL3wY0Y9HK2Y1$0s?H0}`#Bqb>ATAnImnIUDO%iYh*5{hDoPz3UxQ)_u4azqxoaYc<
z8dR5nr%-(cw^7jK-~4NyUQ)dU;($RT5GM?(iwz0MCd6G>FE(e{57jxijnYK^a~948
zh!+jI4)K;jb!j3Y*(6Q(Vg0Z<%U!76gWD)g<bP@5^lbI<?S(6`>4&)0pt>}XkZi&-
z3hRmHEZd<v0=H3`$iHaeEJIu|=mNyc2Gyl0CGL>;RAA|l_=-Vw#J8aOFqpKTKzwRY
z@2`8Fjc_GP>xc)T+BTCJi2Ds%hIrbb*C+0fcrLJXNPNbiI%39@Y?8=}u)Z8vYSVol
zsu$oksyF0cvvBS}ylc>7h|dhFOA`snCTZ&ZhBxYi+n_94Q0;-+C{5%av~Y$YZZ~Ke
z;+#QsX(A!nBmpb1KHZ#U398F*8>NZ-mo1zt5U(1v2Jx;zb!oZ<RhnuC>JhNVaGP|h
z9zvJ4jZ*atMw{OB(Uc7Bhq%R{?GVQes!J7#`+`Y_!~+JAc*3Bj#2bUjB#DO%BJrp}
zO^Gcl_K|ovu<Rr8j6rq8BqW>U@f@rd0!wY<!T|Tfq*3vb|Ez^`9^wUqu0gzMP+gix
zNH$5+Jy<_z&T<E;ci}cl6Zv06;SBot_P~|cY=$^sP+gix*fNt5h~oy;u?$0XJKRQT
zBL9MgvjlP3pmPu}8dMjXl(<9UmB7*=@g;-mh#6C|NtR!S_07Q2u4B0h)oXAYW!Au3
zo^~9r1l@)>ZO|gb6@%(xlM;7GJQG+tBtB(O9Wi4{Hi_|hSYHe*wV8Dms^{P~%B-7E
zUW>xn=HuH7S7K9_fETcS`8q+9f55^Sgg9i-1jHGG>S9AevPlA#V7=0uWdW*-a2sVO
z`7c>GS0G+BXbs|BgX+?h5_d>^EwFS*e9xe!#216fB#CbtMB+OJH6^yJm?H75z%oVR
zhX&OVlaOpuypLi1G_cfGSqAtBCXI@h{2Si(k(8h}LfmA~AjItk)uoAqWE0|PSnqGn
zG6B^#+(v0S1?4jq&TWWy4XR7PEvT-+Z4~tOAy2y>uB5sPalxR|5YHJ@7aJ0iO^C0+
z`dV|AOHjQGw^5qze$z+pDO?Hq8N}xX)g_?yj@RgiD=Y&Lw;D7Gv29QtF$u{g#0#)q
zYR)nT)h^sdIYa*Q7S2V8mkhcAam}E*G?9>OlBNf+e$<@h9#rqcZIq^=-|&&!4p)Lc
z1@VkQbqQF8>I&ROL0^ILH4Eo9#5-{HweSh#rx8Z^IWUQJT@)Wfm2{1wNdAq(o?gP)
z46)y!VThv!)x{<y?vQv(VCj%}+@LyQ#*}Ol<NdJi2A0~)nuh8O+(wyo2Fm9woGTEo
z!qxJ;1Nm-*QN9nXL3!SWD(M<Uk^IjsoR<(=zZr^n6T~eB)n$81+#zvKVCj%}z@R!}
z#*}Q5GuvT38dz$}a|o)#a2sV7`MVa*BE%(w&O*FkP+gi*;tq+I151a*7Y(W-W=zQ@
znRN};Hv&s-W?g~mRk)2Zi~RR3oQDt}8B~{mCs6JEme-U7^g-Nc&{l}U2GtRhkZeNS
zhV@KymT{;~z-^Q><X^IImLaYfRF{BLP(9t;gsPX#<SN8#2Hl2u&!D=vq{JN(Uk@xD
z65ltdj+ikeo0QTMSU(Fawe|NAR3F1_R7&LU`yYHHCFo5MHybnzanzu?G|fTvw3(cR
zc+Q}!5N{Y%M|=;e&&=cn#Fqwb-0pe$;Yzydh)GB`F&T#SNOP7!s1CtxR0`yuvv3w5
zE*f+O;(3GW(nLbCNt&+0`g(Jg%TT=nw^5qNf6u~s0P&$g&mp${N1v1i<wQcViOD8d
z_cv$hgX%`OjnYK^5esJ=;)Fq6h)V|5l@kfcCTThg>+{W7PDAw!+(v04|8)!JCd69?
z-G}(dpt>}r#2pf^1(ptp9~)Fh%$Sl*GV2AbTffz~8a;!_bGVH%s~`LW7S0I7QMlUI
z?LuCNFv?578r1YTsFJQx6wkxxqJ?uE;tjYO#ru#SL>T2qz#2sH9#l!!D2gv(wE2Gu
zrL_g(fI%Y=Ck(2q87Xmx#9ISPhs14z>WCRrvPsT#VZ9hwYM(Isp*jb*QD%|<oP~1%
z;zfgQKwLAZE=>=i`qE5#M!ZokTuEj>#H|K-9s4bBwM&URB;F8MIwT%6$SA#3PdrKD
zO@U>S!~+JsKJgTZHwTs}5^p!?^@*ob;^~xlx{jEIMm8y_QABGZM6b3&G9@E0X;dM}
zzi8nsLtHWFJj6=|wMu{G;!TM=Bt8{bIwZbqP>HuyCT2{@CYf~u*0%ynZDw7A>UFq{
zGV39fA6qytA+~n3+@H3_{gAgr80D?NB-Y-*e#;5n3{}!KiX!>PEgXtZ12q2(V(+^?
z_;s!MEf5C`+6r;IK^9vtmE(K{#8=?<wEC`pc9q;D^yuqyeY(}R_BT&|IbkFIx_p1`
zar^yD+ysB!xJg-mK1rwp>zJ-0=WoMpP|<Ec^-eJ9)`fC238hnK!U)|Dp|n~3SU;p1
z*0Hov7neevY_C8(WzYqPmkp{TCL!4*-)_QstvSnesNR6v=$<A2BMavV#HR-J?DR?K
zgWI5BNk}#^8G!X*bC!OnZh>2wCT8y-1PO}bjR1AmAYNJLg>|j&Rftavns~$eUWY4M
zHz3|I=;C^>bqQ`oevBfx8My0OGiwm<8U!gg&mnCLF`|7?xdyKraM!n1`jUJ67Cdhu
z&Tq8-UW@YWkdDqE;y;v6#~PTJ<cj-*D)*sUp~4(y_DZ%gJB>KG^M?_wQMi>!-P+@`
zW*DxN#R$X+gF^N}Xv6EYsZf0SX|J=cb!gLPyto-|MLC}b!L>kis2tXPcs<LjZ1|Kn
z+6cEYrJLbt5u7gvMU^3_Rushmye`AlszLcmFl%o>E^LIWYURIcP^YexDnB}JaqO0@
z_}%nNV6IH-8RYnde9osT$#dWmtnU~L#s1Iwcu6VqYq#42l=P2C#IIbhYlRP9^XtHp
z)g&4TMA;avg&0jzv>0_sG!cj<%elz!Z1c0%l8%?)?ClLnD_cE<3RSg!K)WwkCADf8
zUfYApq5Tk-3@V2;3NNZkSPOtwf>jdM1$bS8TUk5!NodQm!{yNV@n(KDxsr!U4?=tr
z9u}_!l|=b6N{L_ot!O1um853e1k0UJ=1DC~RT36{b$G+)SO?k^=e|Iw%g;hid@(>2
z+W|^~CwFh)?oc%D`ILK}-2A+v+&$&uB6m;Vo}}3Kc}DUOiRMBillx*b2<(%{U4FfI
zI&dd#(g3`uDs^=N(EebR6g)p<%x@uUmjc?if>jb0znDx_3F`*5ZwIR+tVi&A0=Ke0
z^E1a*9Ea25NUHb-WbkIVmDE()5=tZCVL@%$5DJW9AL^d;-&(7@uvi{qEJskVPLCHX
zb!p<t)n*8>;dg$ko>Jq`nFulOE<!wQP?>oeUR0G*S^;!6SS6)&9bWu^veXEE%J@mJ
zN@~O{cu`ft;x~<-1*;^ieq{5sW%mL^=5R%h4MJroSaoS-9~MqxxE<OS*8DP{Gl3|H
zA+;HRq>BZ8DKtijRr%Y(nuiF(KJc5w@D^04s(A?LSw4oh5sgRr=<o}*TSA+Y#P}w>
z?gW*j?MzkDCJ@&AZfeD2gx_#Am4t;KYTfu#yb0SB?IV_l_z}yqeL<^y1CXdM5OpZ_
z1*>@yoeNMlMjHarBt?r+mqZr>QPQ;cgJ3Wa9U6zo@3B@?_+h9}RVu~=p#6a;Dbh3W
zvQMiXx(eu4uu7Vv^YEgogmnYZ?O>IJ^$1>1;8wQ3&){iUmbAYckae5kR`O73OUUPh
zhsA3_B~g9~>z9G0U9LZ=N>Vd=zT}OD;7X0Bcqc&JyAbVbkKLg!d&3d9(nL%{oC#18
zqpctsgj<<E{DLS$l_F$l3__rCVrj*Xj#jA5AXF0Tql(PKh;-HCi)pmbleVw?3C+rc
zJwX`JCmktHZ}jPrSa%^V7*tN{PiDo>M{fOT&sQ18A$aohh?*Z85tB`DtMX{LWGD53
zW<wz%Nw(2y0@h+xPU`@y$x<0><`qBBC)JqZz|SyeyCV=s1Jve6(e4B&iNGa9;40k8
z2waCJgOGA0HNVv*(3!9JxY&1@l4?w%J0Ps6#<$?blxcA=Fn%gdv8PDW%aFEYBx@_Y
zEZSY>#NA-koj|mi64y0kTAstRqUZ)e!H@k_<{ZO$0_F9szNJ-?GNT+=t{G)ZnF+Xj
z`f^`lOuWwi&lvI_WI`6a9C8oxtewxh4e%NWD&H@&48e=VA~PD--blit)+@r=-iU}=
ztPK^fkW_g^SgoJ+$rywycPho(0qWj?xMh>qmdZ5<al1kM#ME?vk_XNJh_=G5tb*h4
zWT<k_F*F8IaU0T#pA@T5nJy9QT}kF4M7pXmWg0E?q*dY<xA=jq%7pRbRJ}jPY;05H
z*E}R=xBnIII|8@jP9_mQo+M>Yaqz3;o*#n9Puxh3Tmp36w7k0gZbsyWLnM>L&cW+c
zUgZkBuEDL$j~no0M5V9F2=;}<CtXTf-3_59Dr+TTEmSgJM$)San%QEZCl3UEwr34A
zl?h|fMc-DTc;>INe7gLUz(s?s7`#NHxsV+lisv?yX#PCJ=LYes484InNy!R0F9hzS
zpl`v;K6{d=v=C-5+{*mugC`>@1<eR9ga{_3NUMR6tVCsViC7Dj%rD_rRnW{93q8r6
z4T#t#xRnWG(eX<R(tJ|nDf5z69#=o!&mucSaUwuTTS@LaA%{8?hkt=Y^W?s75V_ld
zyW`dE_aQi61nwkj`+wf6^Mec(FOvMO!40TZX3;HpT7GmHXGXN5g`?GdSXZdrffqAF
z%bCnP$6qnZ_d*UOSxpLy<2>`z;+WKs?I0Y7TbcYDD1`fPrG`)(|C-NXNgI#m-XEYO
zjwHGlh&mL{{vwIyFF<@@5V`Hx@1#0B24~BxJfr<?h1Ymqg{R0fI<8;J3r0*HLX4ZG
zKgrrP<bxfx-KJ;<N+(s8R?*4d6nPwVMLkNbCTaCJ6h}6OR9)AaqWB_M9q#=lpMzWB
z%AB`lsh5~89(wM&#}%E_vYvF02Ui=BNgupU@0DacP+ZD$d6gH@S>+UY`nS{L#jTL?
zq(=9{Yb2<AzZ}n@L}jw9!eh^kC8^%2O2WcuJ`8bbQ{*wWQggR|-G@E`x1x{v3<P~!
zylO>>&%n!07Oz;ZumGjUaJ41l5#KyiTQMFS{OGUw@D$^z%+DgMoNYV_o&0)ZK%Mjg
zk$po*aJNkK6cKz5x3U#vhS~AFZHfcG%#2FzXIe$41ykG-tda<&R+F^qhGfi_lfmem
zf=cc-EbCR?Ic25XD{oovm1H*&Gk1IO;#Npen_@q*#_925FyvQq8(sv(jX?Fia^_r3
zRFWI$dZLothN()z!f3WFx)kkb)%o6E@e$krx8gSJg5XRbN*dmq@ZvGSl@<36lz3vU
z-d^QHV-+j^@i1fB$-P9gM+08D;!#8^9vs|Er2+9M!nD(SE1DdhYx@Aol^Mc3=fSkn
zpP|_LRVFOClW8>&N~}ZCPF+pz<kV`CRy^FcqUckrDO!z&;15qj<oUD}?KIOh0o7cS
zP}Zxwi_1#6CZVkNO0x5anY-0_aUmqKP4Pvn$BW)jTuGC#2>o+`DtR)WPE?Yc`D~(+
zGzqCn!op~7wdhhD+R6$yKMs*6UslwM5fJcb+=>$C;k6e+SV^mK3tqS3R^B9c;koi_
zK7wzw{>~B)FnttZJacp-Vy}AM!hY|Sxb&$Eip?SY$*n`H$FQzwNh(xG%y?B;jU()7
zxRvSWLAOg#lB_1B9oCv;?Q>|ikgQ7THFysGdMNvs5P4K(McFTY!)xDwE3Fnq9wb-s
zeoHGJ+9<<p6wNBh`U?nS;7uQ<ZbG0u4s2cPf2MdUK;Nf$CP32^c}$&>S>5mw1LWz8
zszaIf>ssHVXy@-um6<Lg>O6{4nVtfB0au@PlzT!%lP080B~8><R>^x0T<cmN@X$w6
zO3CzswJ)%Lz&KwHQ2QptTLw|I!ug;sg%Yh+h}OkGb%Y`**R>9psjedtJdCrtx<ZL5
zFN9|aJWP@0=Ja^674Z^q-6}7J4SZvj7b6C)U*$#Hz@AlJ%ozBoRbDI@_~}(%EE)Kj
zRbHGnuy>UgtYH$*&#v-<Ip|VU&O;txY9*F*%!5j(GpPz9Lzc>t;2ktD=p!K&jpDNa
z&2N6o`)+=lTJ!xwUVI6+qIua00ut$cL#DoM-dr)tc9z{=r)U9wpJG4apq7*$gm`t!
z@lrJ(l>NRcVjH4}QSJ@&-=oOm$CREjV<@c(#hGB4WLQ<ic+};LWxd7POJ|Zy{d+BD
zDi3Yc#)$HM6rDth#~oe`(9AW6*A3$NhIb5l1hIv@kp~yE`3#C*gXDo>cS4nzc>wXb
zLFEKJEhWg^&Sj+m#9;25-lwAB*_x;%&D=0lw!@VNIS-O#O%jMnvYMSd%$Qxb15xsF
zNEIF%S<$cRL3Xm5xwe28o8alPgBM#3d}Eatg9ff&<;AFhJ*&KE8@PUz7t;pztny;N
zfuCCC#j=5)UggD#fuCCC#Tf%Xv&xIJ27Y>#7v~M^UF8MOEtIr>W|bFLVohFLH}JEo
zytrxL=T>=f+rZDS^5U+68&-Moz`!r8@*+C?@QbUwcxIYEwaSYYZh48kj4<MY&4z$q
zTIB`X4FOxB5#i~G0)BRt7i>-h{LCsZSY@3#FL+-H*t^Oa%)7>c<y(t%1J+cPRY-0s
z$sO?!)=%N)-U`cl@*+2ow9jRw+*@H;@0DcC8F^5Z^QGe1MQXF^rdCNVw9w3L4$WQC
zF7zcTljZE*l&Ey-RT369xs0|H{<<Wmhu-nbJReaW{}ea>hWDz-oROc%>J+S=!mW6X
zVlpvD*^=l`yaK<9=ul-lRH~~vJgFpgYVB`U?0PMe$$FLZX}*=U9GmR>Wdi7y^<K?(
z8D^4z)+#Tq0hGLe6dZc3nF_^~bsm%KqIfDm2@$RCfXGFF7xxTYx5|qL2EMV%i$?~o
zU**LU1AA6^@yx(at@7f9fuCOGh13D}CsF#$Dld8s>|NzWpMjrU<;5lgKex(@egi+h
z%8LO5H>~nv(7-RO@?zM)FRt=p#K50g<;A#xeXG1^8~CMFUaT0H)}qJod<j>o0>#lc
zeD+k_Otjh%R62bS`wb$&xIrj};E?D=2!4_xtt;+I#_-j_hd?0EY73$x#r}J%yci5|
zoGIH;Whk%06ix?~cA14<T~ndR-MtkVO{=9~)uDJjK*{Ub0=%f=?m1p?4{pUxzXH39
za9s}Z;&KQt$syXE2`cTg5HA>1&Jhw{3n~dQ<9a)&v?<;T&<w@<0ZMZJ0lfOw`&dZg
zDb5AxFvV_w+P5J-?V({ZEJ5z)A@~kO5=zOE=v*L59`PjV3BgZNoDR@DiC!2q1I{Ob
zd%m36<lYplrYKq@4^dn(Ee2;9kjynaMZ!m5rLUiq+kvS=a>lmmEtOOQ5fx?H%NQ0#
zMoy_nYnhO|q_N1ihe#bJ!!v`*S(jRc!ZfR-Fln_V5NB03L&e>0yfC|@GE-$RP={)I
z$DndDw!({vca1_h`3}rkGS}q|nVEei)VSofV0cm0O|9m0VKJ5!tv`u*Vt~swUYK2y
zZB&`CJYt0Qhh!vHqtIsJT@KNX$*;^dCY+X%6mGvC|CCR6Me1hYbv~%HDLx9&VTz9f
z)E@n`=iKrcawkPX?&V<Bp-4h$sYrAigcXk^5}gS|lN9d<Xr4sVfoT2)#QqS;qy~`t
zVj!BLXpuZb@r7wIILm-T<=V9f?KQaCZcx4#m^vh9Y^z!-QeBOxDAQhADvFGpQjyj&
zA!(^t<hMek4wGRb<mTaW@=~i%m}ZqUL$taQ!pf>#f{MH4cwu(Q%|n&zfjU&v@sNzf
zif1}7@$T*_C%^KRqa|})S}JDttq@+4ZM2H2Zfcd(Q(7^W756e#Zp7Kf3$sfyfGT$_
z+ZdsnAsLC)ZD=#`E{ABx<X2`J6HZG>$^dTA)A<{fwXYw7^r<M0hVFb)m1wmoSam3x
zRg&2x9)?wJ45+O4Mr$N_aW3oRhJea?Ra_H@4-4Z{t(Df$mQ`L(!@Hud{gYdgd<o>a
zyr|TxSeiJ5!rBg3s>pJZX%q0A3nkm8xE!FQ*iOOgQc!7A+!}hzS*we|szcGNl8SW!
z+B}>{lJR@1ytoyp+P5L{s351ui)W^X+zk%-8I_91;!Rku!FANUV7O8jp2GimtjCL1
z$QTx2hywYIs!OV#V3lOd5WJ>?N}J;2040S$tBIh}p=fV{*|6q<RWf+EA6|=aT_*8j
zDcH3so{IH&!PiU4%yaNRAM1rIgHR4s?8^KVR05TWnD%RNXuP-%Q0yq)iuHJL$Mo((
zycg@$1zN!`P?@SC_RkSY&w3w(sPsbIU{E=DT2b|l)>}#Yz}KDrJWW}ps#nFgo*AQ|
zxVeXMPI^nUVvk#vjZieJL*-=AYBYp3Nzts58cwT)U^TS}@svU5Af7iU7recWOjESr
z=gU@nzqtZp%|yyK0`}G_Uj*+4Y;bi0a**^@<;dLrGbgW1<Zg4aE+SS^|0pu^oE|UE
zn%+5x%u%OT&K-KLnH@9YkwMQPG9M~#6lNu@Wvvo(@<kv@Y80(*L&e3B7e>`4)#F%?
z7taEJn-OJ@m1!PAscsMVN1NhwfRd3ls_ch~)+5Su!7OS1=(S)f6nS=C#cVWHIQCU_
z=kpM|3&vb7U0(M>s3^A$@M4#;LWT1t>`ICXMGm7^bmeJ<`LmWZF%-?J%NWw7)nJJ6
zB*h6l`zw|kEI`{-lA1ORYj&_C5frWeFi+7s2kkDO03n;_8CkmIUI{VmP$Z%DeL&O;
zS2Bd$Hv-gU2csthm*mkRv@gSzO5R#c?UF2@N-Nwi-2sTN2racbl3E>MR?z*)too7Y
z@sRj7#nz`hbwy31)o8HlQ0xs>tRjqHi&i7SYLa44uu9&1X~ot+_Eb@{u#(3ut%gHb
z(-bYNq`X$3ZAtHj*hA<;Oh-bD+Z0FbJ#+@*euHvE+XGRD;&`w+loBP8W{idd(ImzD
z;Y~c7j-g;RMR6hozmNu>l<Fu5I9THD4PJCZ1P)VN1myI1v0{1@FUESjxNLe93!?_S
zupB&`CgE_oD9$1YmhcZ!s}IUn907R(>-DYwC0)zG3a}FLv`vwxGs^vS9gm9*pY?%M
z+;SvZ4n!S_<FJ+vKuUC|9BmRU1)@ocR|C=ElqktHreh1NT!HdpFi>?V4#j%BuuSMO
z$VagrFP<77#TGKlh06=e!KB9DLV_7Zc|eq-CQvyR0+j>QCrjy%!48E2Y*QTk9LqE*
z3R(>Ys}9Aj!73Zp)?hVB(X5gu=4ohOg}c7>zb&j@!^L)l=D<?YTBGpnhA6cuZv1>m
z8%3UuC{KHeTfZ2za@=!)yF-zLlG_wXD9>?<#+~F7&#}CV4wtJZys$$R=P8oP>G5JH
z#68K;MZ}r0lZf*0!bJor5Rd8O!Fv^zCnY+R5*<p3lKMm<9+~M<!V8P$JlQAWoGJ7B
z+p1Jx4B;%&E=$gallSbhQf~0Ftk;~ZVkh)D#OQLUNy+;J&*Y4bvt-%Z!G=jSO05p1
zR!LEmtz2%F?JBdFmLs^gBv)pVEG{eMvbe0*oU9^?w<AW&A!bYI1CRCmPPhe<7c?GN
zIuq`#HpNXp#inAO;^qLgPea_^7qm+CvvnJs58%2i<^?I`L3s{Tm*F}+Uht&Birqgv
zTGFVx7eQfGNgaBL*qBxFH0=Qk&wP~j^DdzKa0N<|n}nSZGg<@rOyi-6JwauLVs!o?
zMI%b?Fk10w#ftar1}eRXhOs2+=JAZClB_hP3ZpGAu@qmC0v_u43Sz2|MXFA3a)VNd
zK{gA08Yw>;3ZhN%@|RfWyA-bksNMRq_uUUyo-!98UNUIzr@hvbje*Mx_RAQY4l(FZ
zWU$&fO@f<ea2G>x^9-(wV8w6=;+YVG`3Dd!QpuB+kvbP5HA(SqfDSQ!H$t{drtv()
zcrtPo_xK7pufdhg9X*s60{LNvcOEHLHL_n1xp0``y#UQTg4hZfGsEaGgQUJNL!Kgo
zl-~-<ON{CwqNSr&lo>xALZ#ddaUEP`Tu&huYD@WSz}{M=d?R3ktK~wg8ZBeos={3R
zGjh4+nh9Y2av(1(Ba=$!^jHI#5~-XNnek4qoa4-e`$$1W{b7L({fsx3cKbZU3kJ2m
z;(dGJR<!OU>IqgIiX_yV5d=2_QE~&lL=~cnOBpZj1iN-Qv6~R^c!<CZL*wy?6;1pG
zXm1Qw$pf*0$`(Y6Cnr_}#JFsRs`PHs4oO)l*HtR(H7Bd+Dh(%*Pxi`>)T@jpD#=qW
zRY?M3`91`jR5YHn$Wt9F>K?87aXg~DbJ1$ZpmK$|hcIX*73~MByr8|SeZ05`GN)Ol
zdtRcGU3_JgXNgMED`}w8AfOG1C{t6BXMKrEQWzVXt1yQoXVU%!c{YJha)zQsFv$sK
zwjH9`ruZxn&7axiGx;oBN$FFFTfgePq}k#5jO}nzVAAX`xV6CDq4+#NU2<RlIdXT&
zJr{yYS`c#I4MdX^8GmV-DP9aonPhO!1C+eH-2~@TxccO!yg8W7Y=t;s(0+)g3}O^`
zvZ9imLY|$5TlHvXB>IsD?ylj5l|z@}=~#~!Ryb(}BD;AQr{os1oz@l4wmF1iDhV+Y
zbtzPgHpQoyY^oRpxd?4jNvacBo<P;*2rniA^#>HWdCKYWVj6k^{$Q0CGX}O+d9fd0
zPwPv6=l525H5aS$VgaBmrlfd2K!+$^h)sF%%=F4l+dZU{NzA18aAnlWWE&99)(~Fu
zwBHUd=3hnezl6%ha71LA;!yrj#y)79N>a9g1*$HsL%0}*>q~-HJg(BI@?to|BDt%_
z!LmONf)`f-R;2k9ym<6xMZ-UWP!~ezZHgBIG*9tTfZDBJ@a1$3u6E~2f8?GCRvn5Y
z)Y~Z`O76>ksPJ4%mv6i{7b1}4+YG$U1eK)b+=ACbQ=vHWi#|OS8B43@!Ky=XI9Mgg
zpw*LLHA&H|l3aWQ?T!6DIxg|Nm;)#;T@>#JXp!Q}03D&YF+_7=GenESq7TV_8Qf4H
zI!v)0p!Qve4-I+-u_pxAX2_ci8cJf2l+zrD&cJoKzzb4JF0@L2SE0{zuWK!oG{Pkw
ze6sj}2V=Lm$xkZx+&Ztg47Z}blL@aZx{84!XZ@wVlju$$N-D|%yk4Pl1uEA9%M633
zOY4V0rA=|;daqQGhzHQ7>iX8w(kd@#CliKCs|<(k0G1d~sp3&d6)u0QP&osZvvAk7
zCK&+TRAq`@bW@cMz36f+-C)RzHpNRlUa2B`uE6VNP-#=-%yEU)=}&n=ZU&H=!D!Gu
zSFdsjD)-=4<lgkBJs)SMr7lzKhIz<C43qA5%rDw<^zKVQ_HDnUmX3mOA`mAfm8v8q
zm8v9J!)X4b?kEf=;I6^F3%Bg>%Zm??2M^&sf?NK^Vhb6-&oY+zay<O9BlDU(WqZyz
zZ$~&R6Mk&5tj{bh>n*{)tiK5pPyKL5;7-6T>knk~IBi+hKMj3Oy>VWTAH^%{m%pD!
zJ$`bptUrob9e)3fUv%T=+{*gX&@bz8cCD;`4f;3W-iOOixRv#9W%M|CS=Qf*38x{r
z{F>S_uFLx6Z?#eHR7U?A@EdUN!{z7G%KV%NE9>#&Y-Rmv@a>0N{sdfEzaLXSTi_1B
z-3oUY?l{~DxcmlKnJ>q~&xn<I%J!$he-`dlxcstLS-<=dFzWHUVP$=u`aJwg-lu$i
zb6KCq(_Z_!_bDGVTh`~<m1lm%`;<?iEbH?)!^L0oKIO9v%liAFSJvk-k7fNkZ+qlE
z-13nuJlKS%+cdR*0=_@1K2LJlIOLglYzvQ!Df5p27>CQw>2z5U*CTM7>R&4L<+uUm
z5%6*_<&7%kT`Fb$^7_j1lFYI`S2t`#JH~cv9QQZd5w;U$drsZ6J>}wowJ(%4{q;D)
zX~Ug?I|rBTH2KObFENnXi$Sjqa5uv(>$3;mMgFq8y_CuC1$0HZmX@8%bHK~|XV5?6
z;=FR#uB=~wy<XlWs{Yn<d2Y#bJ(qzdIJz(ij^$JdUfl&)-$KzO`qf3ezJ+B3iGE)R
z@t5m4{aNx|-{K2Z(PKTQK#H*B4qxhu9_w2e3@pN;k5Qro#}Gz>_m>cVxxV$a48A3U
zqp2_Xu5S&L5P!LzXH%Da*Ym8|1ph_}A<tk2-<HAAWR`r_x85ls{&Ib5ID>yHgKy8^
zzm>s9GWfe0obLif@Aa)+MF3apTWrIN-s@YxT?B&uL<ZlJ!TBsHdaqAkdY!`hR`oMy
zee1hL0$i<6zs~`l?`QP)XYk+2;By)LU<Oa#BAwp)bl?W~LWbuD8GJE=AIsoN8T>>B
zU(VnkW$={@{<|6cR0jVW8T@nx|NRVpCWHU241P9)|LqKZE`$Hw41PX?|NRVpA%p*e
z41O_#|HBM^DTDu`41PI-|3L=7lEMFR2EUrY|49bFmcjopgI~|!|1^W&$l!mJ!Ea{p
zf0n^-W$=HV!PheQA7}8}8T?;l@H-j&UuN*T8T?;m@Ov5jUuW?98T{X5@CO<E-)8WK
z8T{X6@JAW^Pcr!94F2yk_>&C&A2RsU4E`T8__GZDpECIK4E~=p_=^nwUo!a14F0DX
zy!ypped~?N7l!q%o(%r!4Bnf;KbOHbWbiL$@V*TG<qW<tgMTH1Z_40b&ET6e_|IqX
z{tW)L48A3Ue?5Z_Wbj|j;9E2JH!}EO2H%#!hcfs(8GJZ{e=CD;&)~n6!ACOqyBT~m
zgYU}V;~D(7Gx$UX-;=>P!&tn%rT?GN=R{&z|GOFenGF8@48A{u|4s&<%isqyILBPd
z@jsl==h#eH{|6cU#SDHdgIACFtZ$vj=r3pRk23g52LIg*ekz0ijSPM|ga3X8Ka;`#
zRt7(t!T)v!KbOJ(ZU#S}!T){+zmUQIK?c8=!T(_fzm&oMQ3k)9!T%tGU&-MAID=o!
z;Qu6pU(4Wsn8B}S@PC@YZ)EU4%HTIM_&>|ww=(!Y&){nr{EsvE?F{}eGWeYg{x385
z-3<P(GWfj={;xCm{S5wZGWdfG{%<q*!wmlKGWeqm{wEpyaR&eQ8T?5G{|_1bX$Jp~
z8T?rW|4$kGc?SQ_8T>^C|1TN*Wd{G#49<f>%Fo9)-Y6peO8Wm9{L>k{H-mpJgKx;-
zU(Dcr8T`u`d}9XxN(SGQ!M~cpH)rsl&*1$T{A(F}O9uaX2Iq>YVrk0we@1_62LDC|
zAI#v}GB{UmmE-eHMt?Yie=CD;&)~n6!ACOqjtu^82H%;%$1?b?3_hO0e>;PJCxgG2
z;MxH6wEo}!TFm(tX5!N3;ftcUu4Vbt3qxI+tvIiHfd86v)A>O^(}zWJ&{gLf^8ZFO
z|Jbjf{QZ{vuWN08<1DB+!uTD*-w>azJ5;OH+JYz_7FqS#60BhM^v8m$e*0b3Znc)Y
z(>g1z;%g<`$3Lw<9v?~aQ%8)~Me~@<53m1ugl3M8tgdU>{N@IDd40|8;@=<3<+@g1
z0E_&FQ{n%1`d?^~7mH9@p8v~K3$Bhtt&8SEi~Jjd9)+Kk{MPtmX?_cvD8T;}ss;C3
zPJdIlF7g{rh4;Zf1mLIP`uKm9YQbH0`kTXbk>7AC{O{oZHh`aj>-m44YQfbW?7CKe
zxGwS=PKEyy{QCiX9<JyA8r6cUJ*9Q6E#bPzZ#WhHKk$D5pjf_Nr&@6JiMcMC|1I(l
z1U(AB?DW6T`UpUg|5vFNT)iXYZVcB&e#5Eo*TMh40w|WRwg$z&-*x(f0W9(xPK68L
zzX*VLh|m9RR15AOI(^o*R#-gg^$n-N9q?bR<bQ{1!Tl4bKOC-$@i&|be+vGa0C>mx
z_<W0M!TqW<snYI+>mtA5RQRUT|3Zs14_|_Z=hs%Z_}6y&BLOV(8%~8EfM44o{VV4G
zyB>^w&p7?jfE4)+r^5dM{{II+v3~BNT5$i!>5qr&BER8O_`kr<k@aHx_S;ko?n|dX
z5w45;hEqY$Wz+War{zA@KelK-|Mz$>`qg9Q;te-N{&uA4#oqz{uY<ps|C5Qnp7^#d
zS`Sd<pHB4uf5y%~psu?<|F@M^T1h2}%37>cX+^~dDQ&5uixri1=rWC!Zx>4lkU~om
z3Z$hKyHsNrl_{&yp<=(WqOy*4vBrLxqGE@Rb*NFJLl?WOM!)EorY>`tWA^*`@jU0e
z&vWlhzxNOBy|43}=kq?#`JB)BanHTHAO5d|e;E|9{_FDe{!VxM&E>3rd!GIa@c+Gn
z{@3T}j|4qOTit$B&KZ9O|F^(D+kbALEO|cL9Y>s%+m^h~)}L|;E)4p0xo-G#j~?^c
zPFeE2G3dLK_gVjxQ_u?k!GihtqoC~LhM@0FVAen76b!@v&Vv3oQI<TvH|YD5_gVjx
zQ}7A+^U5EOgknCsC`+DagMJ`+pY=~U1^)>DKS%x9{rezg$@8y+emHrb^-nnk&pOxl
zhjlq#A<O!6uSs<-*BJC83CQ}VoPsyP|Es7!yZzolS@PT)^rOl9tbfWWcqjb7UC{qd
z%97{Fpx>Lk&-$mF0{_1Zd_MmI|7`z%CuPa=Qqb>9-e>(&PQj1i|4aC1`_J8!CC|SJ
z`u)lKtbfWWc&0nw@b&WwN_KpBFJ;MdUC@su@3a0Xr{J~lf12CR`$yLQ{SlhKHw687
zLbCoTr{L}I=aq@<@zp()CC?K<e;|3E^-nnkpM(EPQGfRM;lq?A&)*FCiR69OKjjqs
z4E{V*&-#CqvgEnM8J?A!Ox|bxQ%=G2f_`1@4+_?QFJ;N|%Y*)4@;>XIatf}4|2Ft%
zkKgX2EO{Ob`l;l7)<5MGybu0^@Xz+2Pg9mWPX+yS@;>XIath{xeqHV^_-D7@`zcGF
zj|Tlr@;>XIateM0{|~^w0u$o+{{UslbGf^v_^jNa<bBpZ<rKUm=-1^w3IA;Wd62T?
z`E@~mIC-D-PdNqK;C~qY<(Lrbe~7Z=`HrBUP2OkyQ%=DF_%9Un{{m&n^8-OYm%PvV
zr<{VX!T%`yv*YKNDNCM@1^s;TKI@-y3fAENFYtdhCd7OmrYw1`I^VC~h2(wKKjjp>
zD(Khc{uBO{m=OKHPFeE2E$A1M_gVjxQ!onur@P~N|Hy8?k3?wxP6Yi@LbCoTr(hQT
zm%u-p&o?Pco|l9ENb)}GpK=O*4gag)pWVK`Ls|0dznyVb?r8Ep>z{H8>Vtk=?)MAk
z^L@&a=eD3<PTptzQ%-^ZmWJQ|zO7(BKcp;q9t-+o$@{E-$|-md{zLGu!i1NE=SL|^
zo|l9Ec=A5$pK=OT;r{{nyVVgM(f={Z(&sY2yeE?PS^tz%P#N^=avy<zc6|ORWyy1W
z(61!#v;HZk;PvqT4E(d>!_O&8o^J^H)#QEFKjjp>9sY;mpFKYL1!c+eM9`m1-e>(&
zPQfhv{|^4y?dw;RCC|%2e=2#O^-nnkC*l92g8BcNvgEnc1$b8Obow5zVt+_E1uqEt
zb-90qe|G=%8_JUBR|WlA@;+OC$|=|ee}CP=KPuxBuHXI^@6xAt2EAJZJhJ{N=k!m&
zzoI0P?D^5zi4XPjL0^*atbfX>e+>RFf`7LDa}yuxOWX!>R<1PRS^tz%|NNj|mwPq*
zD=;Chuk#Zh>iuuIo|P+0c-BAV)OW!DEd}$rAn~F8&Y&+(c-BAV)K9|yrh@f9Bk`gB
z3qfCz@T`Bzss91|?<`pVvlAccPX~Qv!n6J<r@q1+(E9QJgYeJpe=kgYsQ2H_Ju6q0
z@T`Bzsed#4KL!8n^}UM|AL?%n`s##d{Zmf;eenM>{GX2rvHv_j@uB{kLC;UI^!ioG
zsb7WvarkHZ=Vf{R=a>6@Y7?HVKjrklH0ammPQgDr{=7Kxp?*`)*CjmbpK|Ko2LE&1
zbr=80j{h4HpExy_yCdl96Q1=?IrSfce<l30^>0jks6Q0+jS0{Cr=0q4!~aF_=a)m{
z`n@voq5fAv-<0sIf6A#ZcLn?Y&;O~BUBCX*wCrO;&^ISM>z{JY^?LYkLH({fg-5La
zRf!Mv+k$>m!n6J<r~Y>McNO%%Ch?*Eo}h0@c-BAV)ISLSLHK9)@2^XIsQ*sTw<bL6
zpK|Jd27i9**6nV>Bj$5$;zPYZK{zYdmhh~9%BlaIpkJ5!P{DlOnD|h?G3YlZJnNrw
z>f7Ky1%KE5!XwuIro@N(9YMb(;aUHbQ@;=X{O2Fp{&`*EL;Zb0-=6TSf6A%<D*P8w
zfA;v{`oxEN|5L(e<+dg~>z{J!*Wmvn_`A2^5%akr@u9xb4N&g-f5Nl=DW`s8(67t=
zvS9w(6Cdi^g1$T9S^tz%e-r$lfPXgs9f=S1{>O{muT>>H>z{J!KLh_~y6dL?k<I_6
z#3xS8<-Q*D{Rz+dr=0o~_}9Wed;GR5@uB{Fw}5Bm1`?k2PdW9M1-%<T;h$Z<{M3Z%
zT<)5nA1>mba?Y^>{%?Z+g_scg&#j3M_3sV(k%VXKPdW9Ug+G69>A4yII}#u2{ckp(
zl^acX)<5Oc{}%r5LH*hDUw-OCwY$H@b%3*SdyDv|oOAqc(67sV3jS_54Ud@5I};!3
zuMhft3D4G_a_Vn`|3mP1-6=ex|J{iX_5KH^&&usjc-BAV)c+;?{~rF?@&CPv5A_cR
z{aC`Y{wb&apW*-gg7v>Y@u7Y#=*JVD^-nqV7r7mxKYsWb{N3!~5%akx@uB|ZL4P3O
zS^tz%?|+Tj`~MdH+5O9h6Cdh#1^q<Av;HZk{)6zpz<mzjAH2^f*8kDOCr-`f{Ev9M
z>;DPQ`lp=wAHe@b@XsE<-JAGO|C^vcnDDHB%BlB1J{*qU;Gf;T?n`{Ae_hZ|B|Ph&
za_V=(e=Gd)vyM1_|8(L*z5kiuvvSi3&-$mF`oDp{{~XCb+}rSo`QM-T0Ox)f^fL+1
z`lp=w)9}9s{%$x5kLdqE;zRwj-44QC|4(?<KjqZFI_THsJ`Mj%Fd_OsnD|iNAM}S4
zp7l>T^>@Sn@8F;9{|_ZT)E^A`*@S2PQ%?QE@c&2nySL#H>;FRHL;Z=MpG$bwKjqY)
z<4$;e|NJHVv+MWEi4XOc1^s-&v;HZkz6Jj0LYQ5@4<|m<Zx8x~glGLzPW@f*zYxOg
z`1bY0hx&s-znJi>f6A%<D*RstVK$#f5+CXx3;LymXZ=%7{kiUd!RP-v2(!lz-%Na{
ze{s+sNqE*j<<$QH{I@}v9Y4R5_)tF_^hXn(^-nqVABF$hA<T|%-%os~pAY)wglGLz
zPW><7|K||aU_$KwKTLe6uW}1`R_<8Bv;HZkz9s0_<-Q2v#Toxc6CdjPgZ_BJv;HZk
z{=M-30fgE9|5)Nf{dCZuNO;yi<<u|1|KA{VafL_B=ckDe^(TXVCE;2Blv7{nR;cfv
zPj#Q;`A0UNpC>+XYA&}a=vNb-^-nqVZ-f7(@XsE<{UY(9{*ItOneeQC%BlYt{F~sP
z-F|<S_)tF=^rsS@^-nqV-+})hz~6lw5FRoAUnf4)uLS++glGLzPW`#=fZyl;NAS<~
zpWh@t)Yk<4TEesbDX0Dw@ZSyp?D6ey6Cdi|6!g3sL$6P!ocdiskCRgeXE7n>lXB`K
zZ#|p)QS#fJPmcf8lF&W>G58A%^Do~G{yO3B1Md_5XW(PP{~Y|Ug?}9UJHkH+{vX2s
z0=!ZZ{cG@72!9Ct2H{@<zf1T6_>}N}0QdKy+sAjnbqoFh_&R)^&Uuc5>o<G;FZi29
z{|oS2h5rZmM})6|&k27@7;w(Z{j>1%!OzC$R;+V9_@%-t!CQqt5Bz4~mw~@u_)Eb*
zD?I*`|9QEi!e0UXe+s__{6bt;XZ^ni{z~DS!M6#2EBL#F-vIt;;XUAgFT5XoRrnD2
z(`8e=1Ki)QY9DujzeV_daDESm^LzmOW1{~s_?Lx$9Q<E|Pl1=<Je2-_3I0Oi4}xDS
z{BOW_3ZDlb7yftPpA-H~aGuw*p6`MGm*|gySK&CE`X7V;uJE6OZx{YJ_`8Ll2A>xG
z1o%G)KR296o|pTD@O9wpxnn`072y0;Y1V%c_*+H)eDFJjzX<%}!t253g<l2!W8tp?
zKNtHo*7I8M7YT0zZxjAzaPA-Jb3OPyqVEL%yzpM|W#PNQ|6BO2;1~0T5j6Y`@K+0u
z|BT|i9RCwB>wF*de<J#O!0#9S5%6yaKL~zO_-DYM`82i|pC16fQuyb=|CjLiUo6hc
zjSBx;=>NCyN5CHz{%!D|2ww&-<pCPX{b%r(2>&Vg8-@QH_$|WYKk7IycR=`mL;rt-
zpIz+>I4}1@;pc(>kMMHvY965Z+1=wg)&B2!xz`B47<`BDOTphG{H5SC!mj}Tmhe}C
z|4R64!Jp+m=eLhHfHw($3-})ie;c^J-@!h5z&{~;CpiD#E$7(-{(nXP4)F8&fhT5o
zH~341|0(!p;U5AY68>@U4-5Yk_}>WsEAV5&KM($d@GpTsUk;SN2L4*%-vI9w{yp&b
z3I7rJ1Hyj-?mzdokADL{CHz0YpTi6PnCXAOUoQNdOT6H`+}nh&1K%tBS>T@({#@{{
z3%?ZHf39mEF9k2-2Sk{71^CN^zY_dS!e0x%NBA4S`R`!a_FKTeDEha7KPtQj{4Aa*
z!)PaXjqp9-uNVFfaR2$CeY_j|Plf*}_#xpR0{^b?k2`**@0HiT#<rTvecI{$_s7|N
zxI6!B;OFG3&x-nS%=VS%$M0(|T^j*^f#M19+#4caDT&X&_kyUed{b8cb?5KD_r1C!
z@_jhZSO(vAQ{>0c{;$BBc1GR;{Y%2zr{<RBxbA7Fr~CG(KN+8JeLh`Y;M_*1cTK@n
z&#zNX{hNb+U2YV|583M*XD2??4+lNdQvZ}w{~`E)u%Lhb?|VEH^y%+=a6QI+QcnNx
z!~cHxyN_4GBkJ>i59HTDpZ*?5)<5O+zsRk3fBj@0{_gUZ@z4MLkWE3)Uk%WFQcnLa
z`2Q39-Q{27|BSP#<MZ7?Uy<-^{VAt@8vdu?pS}K{|NA751bzDZBw7EI(|;BIWjL<O
z`tw^uROfOR)c8Ep-!sYjr<`-t2K~BR4g9%%$Mt)0k^}YE1bubFv;HZk{s#Cr!k@!s
z^nZThL;W2=Uz6~xf6A$!g#YUb=9B;XDqjxz+9Libr~kje{|5MH`%nJwvBc#{$3yy*
zT<X`$`MIs(cr%xKJ|;wc>)EvxRK{msPy4lu+q|AuDf$bX|Cz?~Eq7%7*>3WK5SU#1
zBt9qZD(q9s3)`67{3Jf3cV~Ux81mV4Hv2b*^IUh}=jW>3vwy_8`Fu`pj>0$@(_7Ex
zKlKDo#&i0U?|hOvk9>y8`1~iRvzi#&{YM=4`>Bb)h!fgTSFCr_*@+(WJrsP>-|flv
z^OUoh9|iro+->NG;c}dt82$5q=cnW{-`~=!fm#2Q(|<$Iuge{Pe>EmV|BcD^LVbJC
zHzqvmpK|Ko2Y>!orx#`X^M6O^%R!(1j!@P=<@A3X{y#$fS^xas9g54<dUm|-MHhGf
z%nSW*AUyuWGaq{ZPI20WZaqK4CAt~g;{axPwbOfk{8bTDfw#e@_vNccfx?sjuR~rx
zfpLI7+ns)WE*%d!4&Mo%r@sFm-fn#+!N2>p-49y+VDR}(g6Pxi1{~imkL&76qU0Mv
ze`}t8HSisI{OsD8&sXQyotsQ_FP`i8diQ%iWZV-sK!4(ii<&vjKfgBU?@JKtTy*Qv
z*IDyGoWwm=XV9mg*Hiy?$Gv{$kE5PF<6iKJdm~?YN__s3<9_}2e(dh+BZ+_iG5DwZ
zQ~KYD-1fdc>KftmU+}s3$MY|>J~@|)uV=n2(g93-y6cd>-TOcJ+_zYLt>f!+>3tw<
z_YVW#m`KTQ4*a@g)FXe7<G$UtO>q{sJ9}Q_2eH2(f3!66<JcjSPdguaCXKrn3xPlW
z#07_cz%CvpKZ<snJ{{E)sBGLFxA=M*w?uvde9`SsJwMSEIgbd>esSazcSqg?eXZj@
zx2x`aMVx@Y7oeY<yg!0{(6<JCMjGDyk>l%g>HQ>J#=8Sg@8cr>m0L<*XaDa;FXr<}
zr}w<{-I150-LHc$xqjgv)UUcN!t3i@zp(tDp^r3|tH+DgP|w$ilXY={8?e03ws*xz
zvryE5Pme~>3;t@y*XJI?yL6qt#c`kKeQ*3?cQVnvxG8W;;_DIUKliR1m+aK{7ST^S
zzCL#@Qc2tWGJN{)9=Y85{BzK!<3IC%MqRA)*PnV9mMqRy=lJ^E`x6W5UmJKj&XbP>
z{?k1DIQ%bI{P>Y%qI)szcvxS^xgHY-+;-x5o7)fj$3T3_4Z8K}`9WM~BmXLVwn0aq
zZ-#o(&z;LL{RH%LQxS|J!E@Z`;@8(VcHDjrq~Ylz$9=n#w?xYA?uF2Qui<wx`d2!>
zK6ho_dO6qa2fPpOKVkhh1pTdf`di%zn%5s{j_p$a&Y-_PDUr)HkMZ;HwQ&-Uzdjo3
zOytRnslXq9;(IM$<f&$uw&ec$c8{PUw)^GK?uB`E{?Ku+-zwYVzr+9G7oR_pH0oZI
zZHW5HyCZe0BRnp{@@|sleF^l(T>teC)^n}netmuSjSHWRQ{vw)@Q>WJ_idKn<M{gI
zu8nki`7HcT?Tcz2?tdFTO}||EuJ!pz@Od;r%>QXGi}gHy=(#UXCb}0J9QXMgbb0s(
z>;FB+*XOX)beuj1-D|JkCi!;<{r0^4?}Y!1+dudR{XgTl&u8N2C-=lD@$Z*|&-W9=
zc7GW32~J)d5Bl`}I_l4^k9Cf@anwK9?nRFKb`M_vHC}=V(<|JJez``f!`noEHGG=;
zBVUV8xi`b-BR_e;n}EVo3-+huxNbRsiMK&N{+xY(V)gF_e@FeRt1SO($9+A^e;Vl_
zBzwg1^|@ap(sI1|H|XckVTZw=-Vm3!a>K(|193vH8x_3&z|-RU0qC1Cz8$N{^6Q+=
z>klC{>R$r??~kvxz#=@o-f^#YWrYWyw}4m4dU?d1H+uaM?B3~rC-k#0ApbMR*PH)?
zR*rV=hraT<2=*ek1#tcsOZxmc_*|3MZ`T4(@4KUaiyMu6o%2^j|1z|D$;QZ+v7K^d
zHaqV7Tir|l^;3|Br#CsiKKT_fuZfSJBmcU~;(OM4#GP;WcKz|Ve~|AEK6ggw{?g|?
zfnSryFFQZ_?0r_8M4uCGy?XzBS7rGpgU=iD@|knoFV~kYeZ!ZMM%;_#r$?XC>a5QX
zgWf9R>&M}9_ZM${tDX8(cXZ(W%eQXG94A~1e)qk{*IE7f&xq~zOTXO|^i~;Pzt!>e
zISld+F}GcTr}yKL-xIjoiQz&1nZVN_mE8Z=XP>A4o}zyY#HZZfI=x@6j!%7QH&A%;
z|J~H<d);{EAJmsNM!ps29ay|v6?kiXRzLrgs6Xl2_YeBiIsN)vdY4jpoSfV4`k8Nc
zcqRglGu^I#c;4*h^AGy82A}kPGx~I(p84^p=l9fabvt_R)7=y~eQpgtk3{JH(&rw>
zeLjEq_V&zvc`E34<n_ac(eB)VXvHhDKM4Bt)Q<kY4E)1+?Vj(pXJ6;o`{Jawv*Yti
z9QXB{`)Bv3J5@L7)8|Hg`2|tO<to8?KPmi9jBndye0z29j~@2#TO41X`)Gn#|3Kis
z%H!jx^ZvhBkC87*zU~Ghzg%mtitkzHUqb(j=lnX|nK;Scga73}z54@6Bkn~-Mf53k
z+pB-jr)hoU)7UhI<K)}}*bn;SW&fbQ8vWsvj5Cji<+?U+{gz%C^S|J0E%!&K__qf9
zD{na7VfodLyYssQF}E#_`y5W(6(_Z!rL!?!&0ZWi>)aXq6Px74o$xt;-gyL5-djX}
z(DC)=|GBW9es=-c*RyhUw%sqle-xtwucR*ppZ6wp(C0q%w@m;8P&|h9wbhL){z3ke
z;Pc_UoS$&q_w&iV+b)T7#J|sU>&f%SuQ~gG<+b29z345O{r)S!f9J-_uw-$rKXTml
z=e&0JI_`5gCg<1t-S*@8GA?kk{yz^s&(8CC2<<-aE$_O~*17q-=rjM!Na=Gl_`EaE
z=a+$}_w$#->;lwt8asCSJkyP9KA(U4>nD!db~iY_-uz!$`ut(wyAmmRFMKXoee}c0
zMEBx{C9(c$x8L>;w)=Lc_xVh`HS!6JSNDP+X^XrvKIOjRxI4edTi(YU_w`r(s`&?y
z#-|rV{}u5$9elo=NLl~W-P&HC8_eSy0#C0?Q{Ra3@Z`(mEL^U)1pPgEKK}Z?U*2)I
zfAbIO2ZKJnKcD{Nfqy58-Cy!nchum0{Qdj>L7xYL-faYUP`~K7&!^&+OJ2-r{@HK0
zo=-pYa5|IY{|$b{1ONVYtH1YIvE7-*Nb!_=wp)Jh^T_93;d)s5crExp-1=t=Db3~H
z2L6-(^P~4$KJ2((u6j9-doT2F>c8;2R{sg;TW|<ekBQGfK24I(*Pvhd!zg6G+UE{P
ze7lR=BCo>w`B$f3pL-atY5q@h`#-<DQ~y48Lo(65crp09F1dssX@tpb;J^Lp+ND<C
z>9}vV)*Yw&2iM~}vAt|^+r8!UZf>vV=Q#WZ(TMX|Z~mVz*ZarN?!(pZJRP0lUw@yd
z_t}fJ#dZ$`pY!v!uW!QV^h1xQVK}SD!7u!5$zNIjlIEDt4Fi3d{`PWrqT$;e{++01
zy9X*FU)`AHmGC)d<9C;>{|3js&&i%h*D&$bj;{~D-X8&T*cy2H`8)Xr^yeknzue{Y
ze*GTrd({hVyZ3_EjQ@4!Jm@hj*TRKSJ&c*Y7}`z0SHgCe15ZECB`-TCF4wq>lMkRj
z9FqR<8|UM5*pH(eUT1#(D`Wki`1OaJB7Hmz|IMym{}_l*x!;3+&z9f+zd+&XddJu2
z()$Wn=NH@y-|pfiQB9vw951<v;X(cm_~%~p=?!s8{QIHc|K+^?_E6AUWqiFD^xsS-
zu$~q8|NNiU-H}XmFG}3;;`-d{^8D|^`r3l^#X4)EKCz(xD;@XCJJ1&=orI#@ao<mR
z|LpJoIho157y$ptHJ|#t<!jE+`!wM=lkL6{>-UJu&p*iD7wY+Kgzm4KJv{!(aqm<9
zj`+R`e8%PO`P`)u(C1=Y_t^BDEca)KUhh6^4-e|U7TW!OUT*)&b}?mhoGtfXLI2`B
zeT6$7^8Ra|h(cZmzQXbK;lFQ0&gFWO<37&^?;638PMm&A(0>7~r8&G0`Y(NU`;U@|
z?!{*v_w7!|xVjL0zMfa-j{{HdUt&Ean|z(`&C_4xxUX~k?>_S`+ip|P-;}3+EA%t(
zo%@E>4}l+iSKCW0zsYU?zW$SLeDV*jmp|PU+kNrV&wh89fIpvc++9b)(NmhwKDQv=
zr~Q&Bq|YNx@A>k}vivddHH_NS|EJ?_T+LgqG3;mk_xAjQ`tnz&HN+|L?{ggY?ecyJ
z3`4mW1^wes-1*ZF-e>hKMSQkF|BRM5eZ}fW;NSeBNLkN4(BJ*`pWI;eGmfv%J#rRV
zIbM7NK2=*H;Bms^LI0aP{k3jC>X)ncxlzw{?{_nLezYme_qlQ0^Ln@6^AGBuevPl^
z&OHAs9QXS9pw8ts<M}m?`+hj}wQnr|g(vUe_0@8mc|G(O+<yM5)%S;Xf0!WVFa~|@
zx!<ZyCb}1&aoqdo-X1CUJ6{QUtBkL|9{kh$ujqd~@Mq*L?{9<8<4=t2`$(g8t9*^m
z=Z-x6?>g>t`17gv{M_o>!LR(o@`o&cz8hV9{ganP%KYzu{*7NdvSjs-VS7CC?5zI7
zPVaq&?~WY9ckZ+BdB@t*{@D8bE%@vDFTTn0e**vPFK_Cy{C^zx{*6PCZgcx@|EO$<
zd_US{o-cOX=kWEv8%NKL`d2%?K8J%nhp2yR&_|8^yAwXk&pKzn<?jN&{Ewc!-SP?W
zrp3!2wfw;%{`b4%Kfhe<FOO<=uCKu7508BKGuG!@j=S^Fv&mTh<IsQL7gyj2E-Ef~
zZS-%ei|@I9FLIpo(#t<@aNOOmlGm@UFQUKp1<^nErs%@)VHL}@7t6(V`-0EoPdxGP
z)VOW;F7VGj_of||f7o%K55@JE*j5wy07kKPByu10BcF`I7A(o%I=<fgAMJAZJa|#`
zsdmRr{xJ}ra*u_2@Wwpd=Z+hEJr(Y{f`3r|Kf(X9yxcB&UDP*?X7yJ)?)&G1U;PwD
z$~e6pyrKWAX(x4)ZgzZqF5OgE|6PG2e5WJ74%>AZj@nsgn;U0+{UaM=d&BW5_c65l
zzpB=~A1FK>a@_0pZitjVi_o|K?+>h4{buBI9B0uSv}WD<@jmnCWPK{J9xJv+z7^~7
zXYl{V-%s3c{m*whO7Bx5=S@$2ea!RZ+7%zQ`Uc0>=XT|-mp2Fg^F+$rZVLR-JpDcJ
z|DCnN*n`DcKLdX8!JY3)%-jp#?|hwyusqD|Z-U+`<Lg(Q8};?>IKn@u|BlmpAKvFV
z6DQ|>j&`p)@sa-k3QtdIP5Xf5&v4xP9Qkmh6D9GvG3XzE;=&L9!{@F3TF2Mt-kBig
zvmN?B{?RM$PA0k+cLn`@dAVJS^?n@fak)MNpT2?7zqdXQgZF>*b2}~nQScwk^ZzgC
zzqzRoTUeZHpF0lo%j?fS{DbXY>lVcGmFj>K{_NlL%ey^7_m|7N!EwKxPX1!z<H<z#
z;=?$P@YlcngWJ(HK_8j@TY~Lk0NVxYIkrC5v*yN8{~&+)(<85aUY5TN^?Y=G*DvCf
z`1daGcfas+Ke2p+8(sYJ&TWd6{s*1j^SXCLz8C#;-f?%I58kCY{7dk+&hhns20aF0
zhnQRWwch7}WCrpLj{7`+(Dkv0l8Nrc>%sSz{N||T2i$n!>pbrA_7B#755~9A7iPKt
z-niHAeQK895bMe7KMy}U>T|MQMuR^69t7)u1jqUNUH|eA)-xIO*G1_5QvYD!7v#13
z?Z7{sr@!y~SkE?Bmw(XzTJ&dL(jota>wkWETdvOPFDQ+?+VwC0puQ5@<A7|BKX>)`
z^>Xb`HYe-e&sXyMk^jM;|JmF8dp>^aUifx5K~4WlpnvKG&wL5B{`o4$*XQoZ%i+49
zx61hXCTtf~vR(9I{68V%e{b-=H_!h)f&V&bpd7D0;kd8=B=&0~;17p-9)Du&TW|Qg
zWG46GDD>sBAN()y-j7A~F;s9-n_pgc5dsgk+Zg!E^Xhz)<39g8zV}-!ah!25=zo}}
zUvlTezW(Fb!7~3|*Y7<);>HjEAU_EI2QK>k%sBZu@JHS_6KBBR5!e5`&(akUa6kUo
z(;`2BagYArhELz#WB+K4ei^tW@%1@xh|BwhYu@ROz|zNs;NN}tw_8){@^`8Ddg`x_
zl=q!piRIlU%Uh4*&%@X*SpQY<AAf1jHtWCH@%6c1<>h=!;CJWo_XqxP9^Z%UYqK2Z
z%%I(ce|^ITZMzG>=Zy(sKUoR<=Xw6+P8!zlpTt>~u>D=`xH})r^LYdGlkbg_PC_x{
zxbJV@`Tno|BALm(7z4lif6h<M9RD=<qtEL`(s8aYIlex3e_ox}V;nAb>&HLXPaX~W
z4SD+i4*a1gc7K_}x#)+R(GThKtUrkLpZDgipGanMFKW>4L3cdmAJo@E|BT%~`=2-^
z{(Yt6>vJ3P>iG@M3&vj=b@XY6&!Ohp^q|{G{P&;zdTG5ls~?R1$(YLJnsnUjTRtB3
zN8(d%KKSE}d3vM>{{eg|_eJqM<~il~`rP$-%k|97X|~2b*Npuv|Aj7>_owH@I?LU7
z;~(VD4L*-QG5_vYzBx{bf14a%pSvtU<#;uT@q7%U8+~$p1Dze61AQC1ay27-)6q3N
z*q^-Vy{%*T_JN*UO?N;$cX#jU@9F5<)i)g85A=5qcXSWl8s6O4v#V#Yud9QwV_<Oi
z_MVKcV`t}ZS8qU_106$qh6Z|eMQ8VRuxDt`&YoOH$IV@XUBjK*JA8RvyLavC=^FNQ
zXn3#yHQMgJp~CX)1T#lhe^2LNhpS;=ci%3zBt89|w`)^HB*w)R-ZPxI$o%;e&77{V
z&h0KxRv_~hnr!Co+Hqq?&w$L6!aQZiuFkw5g9Rt#&(YgGSkS)%6AI4J(KAw{9XA&z
z=FjOmS6KUYJ;(AmC4ZjI8*eO9AgAQd)7`^q`7Nc>^5+}ey=S;cfyt!&xq5f^Z!Z!d
zrsU7#)?wjUFd=`Aojt>y-JQdoZUY;-x$wMsl6)6mYsdE6JG%P&dUh3Cg?XBMpD={T
z78}<jr<i#<ySv$&%=$3YXx#={Kx?SccJ1D|vv0V7JUhY65jWNRE}!8>f1}&#^VNnL
z?ZBQwT0@PtYxltI1&l2=Y9!@H+b%bFkI33DG}+9J?264@XtJ5xn-30m47!~{fo9DV
zGmp14Q_MP-DP|t5vcbGQ8P{>-MjzK$p4?)i_G`>lG`ziE79u;r%;DEt!8x)M%pAAu
z=^4D;&(pW7yGPei{zNn9&h8yy#sVShBr}&^Gduc=t{OYZ%;ndBog^#APBL?aGVC-n
zTi!G?AJ(dyQ*zHvFmuEem_I{?L*Loozq_k*xX16@+@Af`zAoEGi%d0b`Puw|PDj_y
zZmCZv$z0t#-Em97namWO$0c86o^*<tXUH8gbnG0`{e;CvJ=k+&-_UT+V8_6o{{8~9
z6`XG7@9rt6FzdO9!gwSO?nrBg1e!Ok*nB*CFfC{1<#aQ@sjNWD1*V#L{c)W?Sm@vp
zh-o)(n#^}g*RHOe9q!PwW2i5GH4S&<O_%wH`gYyu4h_A*fLn7rxA*Oo)O-a+RK{y~
zq@!C85)-Dnj-7jS5DZ#!qu(*u)6+3@vmV@7Y}BsSJuZpchdKuO-1$WI;2?jZnRD13
zqId7UZCA0G3r;ul`!+)Z+NkBCr)Pm#>?E0M&wx7w>*=_0sL$=a`-ck5TtHzwaPrb|
zTX$cflnPBYbEhXc#SDrlj7QI|a5_??fC5v^ygXScGIOEHW^OlvyOY0Sl^2+5=EZqr
zv6%}^Hgo%(ysvp^xN}(7S>806Z)j)FPJiAyJm?OahkFXmUPxkGwh!*^?C$CuiZ$G_
zXSX|sAMEMu>h%W-(u1B<Ykc=~g@y79(7k=2Q=AG+&Ccrv)sDgL+ufZV*)7%0n3<HF
zD-5Q^=97t-bGT=?w`2QYU-yl;tdO=>Xi|Z>(q3(9wew~L1sw7(8ra#*RI{{x>@9ej
zl$~Ja@T;QW9N7s4=jhlo(BHR9Pwdhe&2%%rKiUYFYSK*oB^8TB9k+0kBlYP7nFE`3
zfmzHHnP=$sU0oe+%jp`>i!Hu1nJV*k%4D-c_A~2bncH>WqU~m;$$Z^@6W?8^S~JDW
zv$MA^9y|8zy0LGU?(PaqHS=<q_o@Q>%0iRP+-Ya;C}L1VVLWad>~p)ZTXwo@a(y}m
z<xMm5`Ew3;h}APVxM#qf?RM_!?(fm7GetGVXRv4I?pytEaAvDB$ue$3!@CFFp-Q~k
zSfnmLh!;^AukD?FxWBQZd(Tciq|!-dF29}j47f`(0|V}uPBxYNiDu5eA-^+lzoVDk
zf-N>`cLiX?U%a`w<JR4ISE}+S7Myd>t~1V?PBwG<Mc{?vY@ss6%;Odz4u)7C9k+J&
z=XJK?BID%SfK~B?^9ABC82014_Y8LRbnF=1y)*y9s&A)=O1%8Z!p@FxA$I5Xunqf@
zYFUTguDDPfhX*@%4Grw}mmK`n`23Lb1>!KYbLXCp?%g{(`*szWU8b6OF^ap72?mBb
zZtL9TFUSwM)9C`2P@ha{T>ZlP;o6;+7pTTeG4l-exGV8P@er}_iY}rs9$jv0azmRx
z+$(HRSYRA{<^BNQZO?tXcI+-ty-YRpx)Ej|%-rS1#$7#nqE%?JncKH~YtP_N-)?s*
zG(1>%B*_;ThxAO@9R-AOrK3wv-->FCPoLX;V}rsefg5x5*tfXIICb|VPV7Aetj?e^
zUWFU%*tNT3ySosi$4>trYU9m)hucfUA)<)u8Fj`F=QFgEUQ}SJnK!Que?%k>MK#vP
z^{2s}TlVw~_H_Fz3_JWa;2nK=S91LUZBd=^^Zm1LpsS;Q_l?{4=mnnqiACph2Di!L
zWap;9I1G+-4D9aL4a!if?diJReeM?qv;4~!gZWd<yuOfu!h;sDKi=+g7Z<~amu`IL
z$EA(&bI_d~y9b7H8`?IW-4On641X^Ve;dQ!E5hF^!{4jI-=^^Q>hQOrK0d{{8{+H@
zasGyA&=4IOqD4dWXow~a(Pd+F*@zmV%f{%kF}iGwE*qoE#^|y!x@?Rtmq(Y&qs!%3
zl<0DKbh$jbTpnF6k1m%-m&>C|V{~bZE{)Np5s5^X#^}-*T^gfHV{~bZE>}dCE27I4
z(Z$`3?UTMDx?B-mu81yIM3*a~%N5b(%II=sbh$FRTp3-ij4oG3mn);omC@zO=yGLr
zxhlF`6<w~1E>}gDtD?(Q(dDY>a#eJ>D!N=1U7DgxQ*>#HE=|#;DY`U8m!{~_6kVF4
zOH*`lKe^*0xH`IA9bK-DE>}mFtD}qivVTxUm#d@8)zPJ)KH4<YN1ulJXw*<2of_(+
zRYQIBYN(H94fWBjp+4F*)Wa|7#_(fDW>02UW?yD!W^ZP9Mt^QVhi*WRZrF(W(5D;F
zsT<I%8_=yA(61ZNu^Z5{8_=~I(6<}Vxf?FW@}he;pno@@gEyduH=v6*ppQ48lQ*E3
zH=vt0pr1E1B0u!>2G`a7nfKsMcWXv`5kA@D{=$8v;jWbp@Ak(5oPOIa$(ar2aD@8-
zo{ObZu#b@mb~oVmoWp(YqbJvlpY68YgJB<PMniWrjN>I1CgXNtLDs>2<kaI1$%;D^
z5M&+vDP?z$zmueASC^hDxf1fHpK1PZ{ULujvL=Zr>x5FzR7^oh*2V8^-P!0FA}OR$
zk9e?LJXRhoTZMYW4~_D};6b9FlAS00I3<6s?6mBB{vgA4zWlihDY72uukORc0oSG6
zVRF7nzGOq&2DcGya05BEjdbO8+&I`d(3@_713m8OyQANIkd`v0=SldiFll^)%ckdc
zH>L*vD`?-htFvpk@7BIyw_)||>={h0{Jjd{lF3jpZO4v1yTXxPcDdCuTzSf0_M);U
zaWhxATvEIP%WYSAhDP}$o`pK_lb9Ep<w;w4vW*~b5ejS-u8}YR7B~p?U8Zwrs3+WL
zKwZ26EB(aq_MIlP%r?L|*l6~&lvClyJ7<PcKmW;={W!`@a>I<jgCu)fM>?lpmU!n1
zTS+eu;S!Huws?}~K0XVloBj-sa@X$@i<?cmc^~(iX}(dO+NT>^+{)Yl9(Dui*2j&2
zTUh=u?rSM>q29FWIx6#}m01p3lP+E6ro3!+#V_2LmWy`;pMt%P?bGlp(p{i&pL4nk
z(Ytr-=y#tBg=<Gcx!XG3*sx>wpu6_Mp)Cv^?tU~`6npIf5p$t^SLoi;<?jJ-*ACnV
z$L`~<yo~+D9rrQZU=kVj`dsZ;q`dpYb`JG)xxTo&<EFkHJNocBSQ;76?TcPSN~LK(
z4A&vC5b4m{(be12b+g^ydx^hx?=F|eUdgK~enPxl?T+33C9|}ZbTdrvh{$gW7nptH
zOv?37bXa#lAg26KJqatl0nP2u_qa1ocL>!Hc1x6CGj&F8b-2aq>b<$+#y#%yZn1U&
z^18qIc$F^2FO!-@E;L{l7*pw~T{N3t_BN*{ZKc34oURLde*s(P0fzq!U<b1|ogj`D
zVM1KP?gSxQA<zA>R+Fuuz+nU%^@n)w3TwE}3bTcc#Ec8!>VLSC#x!TgpmaqUfj9H!
zg+I_plZf5dUn(Bz+7-4^e;I}4xvBmWaxRJZ`++R|6x+AxH;4k46lv#YFds@_flbC<
zkTjMWcDjhLg~bKh)#<OhSli51AWkUU|IXMmIBX;Xaek4#o$iRte|jD^(zFcRL54d3
z(}?}*FMP{PQfILbpM2vOXLwr0ktW;q{6_6oVtQ9(+I-yox!tMzEYbVjveR8jj`v)+
z@!fs&5N}BLck&K&x(~+v?OY~Y{fx<Mcz(gsJC$zsci~76;a<=lW%wGxZTtSJ_;BZq
z;dr5E$nNRW9-V%mi1px4FkOMZm-wC;Z(n1Mz92uo6uP`fjoe2^?7B*!(=D{hJ{dlV
zusbVRURQv<<H*nLYcfmOvAxHo?rzxW9FAAhS%BB+?OB|b3{A<cbly3RLhdqwf8*CG
z`)={o>XqnEey#7?6F*T*I}3NV?iPI4r8;kSmuZuA==UVyY{0wZ?fUG7X?J^mla9x9
zl2zfW;ROa>x2x&dIWX+cvKdIYz0w`f@b1NQ0o<B$4JKP}{#L@#HamsO%^T-aL%;bX
zcOtO;aDb<0%!8e`bqu*rTivx{w_EKSyk)5KR=+`TCc7b~6fN^^{zP2lQ;M7Y-9KIK
zUY(wfa64&-`xFj0nWi<z5b_5id>Wnf=Hx1VI%_OPRuyVYK7nJAe%%&1EHynXY_Hw@
z9eeuY0ciLP%TEs};=>I$K800}-kID&l2+#9^HbA%IMQjpkZ>_vZR52fS)62Z3VZr=
zRhT>D%_!%4dN|L<eHGdSjtjE=$&bgpO+PI&bMLhJnB(BkvrNwk-5s~&y4fz*uRCSi
z_TyNQeF4wh+=@tUisZ`l`O2*<oD^16-fojqpY#?n6Q*wj>z1=;)&}mS<uor(Ha<J5
zWJYl$X^tb3)t(;W?&$1`UomqF(=+0}OBRohIm)HS$+j8aK1NjzOuqU)ci+Grx~~hz
zF6kZp>00*_(pwd{XmJ~jpV5<HJ97(XR=yklcs~YpJQg_9hFs(T-Def|Qf^z?HM|R_
zd)XdD{{qMTX4h<{+RV;yz>uzLzxDf@OyY;Z$#NC?usRL0=r`w#B>fsoV(JeU{9WtG
z2A3VUJ8tW9M?K-f7$tHf5bn+B+ub!BKkQ3e^J})iy_Re_yW(v|_Lh0Gb@+DAa0SKn
z+`NlN1qMpDc>1-Ev}D(1&TvF;&QUQo+N#k#aT^Ag(idImEQ8YvZ1M$`lj=gtc!pC(
zz4k+!yph(A;xU+Tn`^j>f?~HNxSol7Nb?61zZ&<r3vNRLZcpp40u<>c;p$4!zLNC)
z<QOj9@wkPKdl7q$A)V|CaFS$ePwy4t5}0#iUq5!D=|z`#qeR*ZuqO5Ed9+J6a@lj@
zyuobwoTboulY!oRmyB~2IuG}|P9CITW$>Us|8Nfr!lNhKTU|x69pi9^jr&;h?qT9Y
zH+P}WnbHXT+?kV3Y1<!$W<Fg=h94a9B-h6H0YUfzq?`tYTjPsd!eXg016fn9{xfwc
z<dz)K+2XO>_M8n@*~8VOu;0|y_+1}AYREp^2ZcL#%pJwqAkQ=%rMf3>ckB+_O=V94
zeS5xke;p;0W;`S-c6r(#5$RVYu*%X4aPjJ#EPSzBh5XzD?t-ejMCne_vU}J<Lr$`N
zCp`lLpUjIu{Ei}i>6snDt#kIJ<f5(2YmX$;0mjXkw`1W4D}E_lwLVREy6rE7ie-W8
zJ+?PJ>4qf7H~(K(ws>LEkLtKz*@TeY>|ME>R($w!OX&NI?>os?7t$_TFjyaqZ=c%+
zFU)w(Gw~sJ17mVOb?WEG2AmUzG5TiqY`^B+s)*m#WYsiFN8RL1bI&fGYr4+k?<F=1
z>-W2UM-b1KSgo&!m(uK6b&>BTnu8Ocjoj+zO<gv515Lb}wa^h$fm@wS6Ih6Xw-8`U
z3YXQBWZWig&UA=zc%l8&)nDua3nNah8zf7{OYd<Rb1qG{^2FIiz`eUp$@_*8Yjlh1
zkHgY+n)$5Y47ZunAnz!T6N-hHZU*^hfmmE~2IbfGP&~<@F*Z8W#e6?bF94<ucwXp=
zXVOf1<6r2EH^yJ=@I!^a(^ofuGkoTl*5nU1-2HWZ!(so_(d*7GOr;z%<Mo|niSPpf
z;inG>^%xi*fQ9QV#*v@A$XIuVV^tq1c67WE*azZq_`wGMMt;X6yVE%Hi8c;K+(?c4
zbh$wK^$Buj;;!}irlYKhLy_x7@wQX5Hwu>kq>FPXHa*!dgu4dm28O{tH)0gqICRWK
z?@0HyJ{gu_k}q-^$i=c>1~p?#;fp)S03USIA~YON<$Y29g8y!JuTSjjI|kj2P^O$B
z*D=$r!E~qs$Nq(9&)!0u?m5yU^YqGiwv!ZDd>$(?Pul<&8y{d~uStaN>AFZ)=dLa{
z+`4fvTon%2OTqzl-fBxOz9hbJGvfhE*iys!cDP#w^CyMn?M+P9_IgZqvF(R1Y}c1w
z;Pl*Xv0+W0@zjdJnf^`x0$tyF7u)XAJtmh~HYtbwm=Jyjhi&;W&{226es{QO+MQas
z+j;yol#V@@Z|vwC91OoAl*si`ueo`g8ub0_NnqaE%sZH}i&$V$G94tY<sI>^sI(Vj
zWyK|=U*RJV7V8F!upK4e^z;+#v0{M>A#wd@zk`w%;c7qQvK2mx;E{sq4qN~qUC~V_
z`)wC4m9J2asnT%+>nHivOIo@clJTW0+&JTU$FTccV9&1YyZ5-OUANsLJ<7KuyPoXk
zlXfq^6#lT*b;9rgTm0IH-zmFq#$`WuwV!wUBTY9~I2q`<)%}tWPp0f)v5TBtKD{-h
z$e~j@(wSwkD?HuxGfg^$Tc^zBMZ1EYe7H^B{8pH`&B~{w=ZNY0a!cpu$ei?d;8Pku
zT*d<ve}i5+kDmc&0x2wT0-jC`gMht$Z<o%m=k%fkzqDZXf?i-gfzNgVKhfUJlQtT*
zbH;1dN9ghx-Sd8<$ut|1Ecn4J#+#&DxV7s0-5|fBhc64Iecx}Ea(O6!W*&w4*iG8$
zc7rb*rt4b2pTQ}<Idh7kVdq^xvVy!Z%T5eu;_ehJ|KbI{)xiqVZPx^EHw3xN<~PHz
zi#6W^PUCZH@{FhY1vk<32*#JNGmO+ZJjV|sllw=_DTI#>w@BCp_xte7=S&#9!l1>4
z=C0K*Oo0<<42}MS5<Kwpyt!w(UqJLf1^EK}9%MD9KTCKG_(hK2jNk6`$o+h2c+lq>
z__&`r3=jH{Zvj^y{^%-wI^nYydis##=NxnD!(VBo&tCW(5+CxzMe12Ke6LyFX8dBL
zZ`bl(aNlnF-vM&De(;Nh?>Bm1;=QPIO!!y8$HAEc^#_DgKMAh+Oc{S)r~4V?@R$aF
zu6wq8#^`-1|A2b<e^Z$=+dT|D>!f~GIQ4VjTIaH9*XGIJ57s<S8@(@)`K$>)iTZQ+
z#ZlHteTi`D%fPix{{L03cjoDTN7_F$&nj@{#(b)Uv)vkS)=7P>aO&&8wa!-KZ}a5;
zebqdBjo#+jFZ>DQIRMT&ndh)@>PNw~PXGJB{-Js92iH8ujNX^Re8z>d-2>pPlllqa
z)K7wIo&Ntd_y_BZ?{c|0aLses=xv_IgjeGCfRBT-PUd++IQ6UGTIVU_Z@25y;F{-}
z(c3(8?stRzgZ-B6mVmQP=2<G7`Z92>v)1_A{#ggEdA1t8&9hDTOOWSgaMsB@w+N?x
zE4bF#ZTxMXz2KT>ztP(~2ZXcTVQ|*TJV%66KMJmOP8ffi=Ono1IcxMb&pF|nkf;B@
z+y22indgFV>X*Q^&ZEZP=D7^6c^)%*o9A)iZ1)5>>tvoQ!l_>c*E&n_{{VD*F9X*+
zYmMIKSttDWk!L+P>tvpd!l`ct*E(B_zs<81T=Q%*dYk8F;cRycIO}Ad?ZT<w3a)jI
z7=PP8N5M5u{y!FuKg?&+`1ty-N1g}4Sts>V!l|DD*E$ayf1BqlxaK)$^fu3V;cRyS
zoOLqKMd8#hfoq*B#^2_-3a)vU;+R(R^#51XKgj!#XE`|QWS$kmsjmXpI%|x-&9fF<
z^Q<#^n`ganw%Z8KI+<saaO(Z<y8DOL*>3!8o?F2+&k>{dbuyn(;iJft=MJos`hC!o
zQ$Gf-b^8DR;vXEBc>Fm5u6a%xz0LEWaJD-I&U%>Vv~cQYz_rdr<8Sj^0@plOjNazC
zDtruio&;x|%=46R>es-v&Jy2PfjmpWHP14m_b-`Gxp1~y0nR$9uM|#w6}Z;fWc+QO
z&ET46yV3iX%xA0cN#wZ=oOM#)Eu8v(aIJIL_}lG$1YGkRHG2P&`S5(5;}YB52R-Yg
ze!p<)$H2ADX>e{wuIccY0oObijo!axK1;$MK%PgySts>Jg;ReFT<bhx{B52q;F{;E
z(fgOohv$pTlkJ{@o^?`xS~&G<;94h-_chNd<e_;sfwLaw(=7Zec+cZC)=7N}rjt|O
z2Cj8(G5$8sc5uyetI^v$w+Uyv-QcW;dHVlD<R9eJ_k(Ml`;EWd-Z@Tap3_F}>tsGN
z!oP+0hw#jLs6Q;6`Z;i|a{-*|o%^FjaLsec=xv@ygtOhF;H;B*E(@pr7`WDX+W6Z%
z*T6N;N-T)>&nn@MV*YAy*2z3;gi~J!u5~sVf7?Hsz%|ciqqli(63%v8z*#5rY!yy@
z8@SflYy54V{otDCextYjb4>VuBF}Mf*2z2%2&aA$T<e@N{x;8PaLseZ=xv^dgtOhl
z;H;B*&I+e~4qWS8HvTrxW8j+SX`{D!t_fd{_c`}}i~NIiGS3p>)R%#4ofY7^y;p*3
zo>fL~^Q;!mc5A>{C-bZoPJJD?*4b+OZJur5nrE-k+dTV)UxGXbz*#5r92QRfD7e<?
z|KGQNXrBAQHP11lw|R~WXS)Z$Sts+H5KjFhxYjvq{B53d;F{;M(c3(a34bZ_JPyt}
zndb@N)USeTou`by-QG`wYo2RHZ}ZH#|2xU`;yK$b0cV}evs5_sW#C$8t?{>c)`4rD
ztwwM2Y!iMp^4tv0I+^Dd;nZ&h*E+k6zs<83T=VQVdYk8faJD-P&N`Xrh;Zsh!L`l_
z<8Skv1lK%gjo#)tC!G7md2rUrJQsvhzXYyz9yR_p&t-7U^O(`wJdX=!yC=X|C-Ynp
zPW>vl)>-QQuO<7x&9e+#^Q<*`n`fQy>(D>z!C5EsY!ps?Gq~2-V*G8Mt>Btxo6*}m
zHw$OGTfkW-^K2JR{Z??TbHw=DJV(Jb&k3Wqc}@!7jyw;7vrgtYC7k*haIN#O@wa)-
zf@_|0MsM?+7tVGUz*#5rTog|I61dj6V*G8MtKgbvX<6EzZJuSqcOlPmaMsB@D}+;D
z1+I107=N2*Ex6`cXY@ADdf{xh5u9~0&nDs2H-l@P?Z)5cxfNXV95H&E=cw?vBhS6y
ztdn`}6HfgYxYl{V_}e@uz%|cFqqlh;6wY?1z*#5roEA>~47k?0X#8!SOW>O4iqYFV
zSB3Mu=p;DnWS*ylQ@;kTb(XA4w+owRDY)iYX7o1Ca^Y;Z0-SX+&r0FcSAlDtO~&8m
z*$l3Ewi~_8bF1)Ap?_`zXPwNmTR8Ro;9BRf@wa)7fNP$kMsM@nE1d1_181GgbH8xv
z$H2ADY2$D6oB`K77meQLxg`Aa$nyv|>tvosg;ReFT<bhx{B52q;F{;E(c3&v3TL~g
zz*#5rJT091HE^x7(*3_<|KNFCe3#2rfoq;kMsM?M7XCHlxe1(gGS3#_)VG0aom-5*
z&9fa`^W19mHqULs*={#D>tvq2!l~~E*E;tbf7?IDz%|clqqlj^2>&kfJOs`<ndf2Q
z)X#xyo&Nt^`v=!M>~o9Yn&*<y+dPj5XS+wiSts*c7Eb*!aIN#S@wa)dfoq<XPfwT2
z=2<2DI2O1XoOLqK8sXH}foq+O#^3hOCUDKO+30Pan}oC77I4<dJX?iR-v+LA_8Nbi
zXFs^+x!>q*o@2s)i9E-_Sts*6Ae{P1aIJI7_}e_E!8Okrqqlh;63%uHgR@TNIV+s{
zIdH9W+4$Q$kAZ8Rr;Xm`xhDL#+#vCf*I6g?ED=t98MxM20j}G7CAj8UW%M@BYT<0R
z2Ap*=&syQs*MV!Dt;XNx*#@q8_8Ps-vtRgnTrV2{XPwM*SUB~g;9BQC<8S-tesIlm
z%;;^N<HFhQ0dUsIJST)xKMAgN&KiH4=N!1^xoq?{&tt-$k35fqvrguDLOAuS;9BP?
z<8Sjk4X$~v8NJOjw>~@mv)vMK*2z3eg;QS!u65QLf176=xaQev^fu2n;g=)N&ETw)
zd2SI-{Z??Tv)lOFJbS@4&wit~c@79?yTjnDlX;E^r+yS%>zpwDHqS|L&2!f1ZJu+&
zTaf2GIO}Ad3&N>i0@pf^8h@MTGPve>%;;^N$Az=q6X2|qd9DbjeidBnEPY1W|81US
z;F@Qx(c3)hgkOg|>%mzk^K2AOeKWY$*<$={o~_`TXPeR6JU0txyIa6nC-ZC<PW@JJ
zt#icq+dN0XHO~p7w|Pzq??Iji!C5EsoDxp`47k>L*!bH#XTdekIit6E&I@O|3*fAi
zc`gd4ehFObTrvJO&sA{Ev-Fv1f3|s+2_Hh9<>0K7c~%Igz6xCHtTFyJ&suQJv(D&k
zp7p}nZX-DBWS&jJsc#0?I@^uE&2uZb<~d^YHqTMve}X*sg0oKMxlcItW8hln0poA;
zoB-E6Cyn0bc~CgpodRc_%yU{e^)ujF=c4hqc`ku#o-0Og^IR3q&#g~_vrguDN;vgv
z;96%%MY>(sJWIhf&oZO8d6o-jyA|N9lX+GOr@jhY>ufUqHqT~o&9mL;ZJt|&PosZs
z181Ggvs*az{oq>Xu<^Hfj(}^PqegG@+$)^z?gM9?%yYkR>c_yf&S~Rs^PB<KJQt1L
z=D8$%7I_{4XPwORsBr3!foq*7jK9ru1zhu7HF}%pN#Shw6gcZ-o~MOVzXq;#Rz54c
z9mRL<`X{*N*<|!K&t~CYL!O(!Sts*s5l(#@xYoJF_}e_&!8OmVMsM@nCY<edgR@TN
z*(;p-esHaGzwx*Ia|~SboHlx!=Zx@wLY{}fSts*6ES&l|aIJH}_}e@e!8Ok%qqlh;
z5zcmxg0oKMxh$OeW8hlnY2$D6Tm#oUE1#YAXPal0@P9|1)!?j?dDaN0z7AaLY&8Bh
z&n9rqv)Slvo|}ZT-4<}x$vj(yQ{M)zb@m#6n`b|`=DFYKZJuMo&%ymD<KV25c^(i>
z{Uo^7Ic5B9p3~r(=Zw+YJP!$HyNAJ9C-a;YPW>FX*12r_ZJx)#HP6#VZ}VIeei8D_
zJty{O*2z3egi~Jzu60&`=Ux8<*F39?-sV{?obA?tvrgt&E1dc|aILe|_}e_&z%|ca
zqqlkX3x65%8~|sX%yU>c^`qcg=RV_a`{#ae&2!A?ZJy)8+3o>w*2z34gi}8Wu652D
zf1BqVxaPTR^fu39!e5O%kAt&L=6OOm^{e1o=PBcF^E?f%d9E3~%`;b-9sk*G2{`Ly
zo~6R6F9X*)YmL9nvkqMIY%_YB=Vsw=MV?#0Sts*s7f$^)aILe~_}e`D!8OkTqqlhu
z3un6{;H;B*jtZxKFSyn@Y5Z-T2f;PZIit6E&I=zxo(tftlX)%*r~U}I*12r_ZJx)#
zHP7QlZ}U7Mob9fFvrgu@DxCV0;96(d@1*_T=2;G|dDa=d&9h$kJCJ81IO}AdO~R?)
z1g>?q8h@K-8@T4V+30PaTZFUSc5v3oJhuv`ejB*fIcofEo_oPH&q<@Vc^(x0KIAzC
z&N`Xrv~cPVfoq*}#^2^S53YGG7`@GNQ8?RO0%x7f^N4WjkAiERtH$5vc@kXnEW0r6
z&o<9;;k=K$0-SX+&r0FcSA%PvwZ`A(SqH9p)*HRevr#zPZ31VV%(GcI^_#%8&aKAZ
z=D7`A^BgsLo9ABPe~JFN51e%}&;7!w9|zYuCyc+%a}r$hJZSVb&ne+-cN&~^GS3;|
z)E@%ZI+u*U&GQJj=6TZSZJwuue-(M224|hjb4@t)B^Sm1uXUDz>+yU!xaL`5^fu2*
z;cT}GoOLqKYT?w^fNPzbjK9sZ1zhvoX7o1CZsFfTp1t6#lX><Fr+ye*>l`)ywtwyg
z*F5(bz0GsKaJD-J&N`XrxNzzZfNPzHjK9tEFu3M<#OQ6FM}_lyDa+ujlX)H!PW=gR
zt#j4*+dNN#Yo4c!-sX8)INMzVXPwM5haXHNr@jPS>#PRnb`-a^T&@OO^W0?gHqRE}
zr_n!K!C4RUY!goX7I3X|tMRvaZUfgmyN%xF*(;pw_Jgxd<~bmo`eAUbbKLmb{&@gg
z^E_nqHqXPt*Wvpiv*4_gdCm!^egRzTTr&PP&m-WP=TW1#c`gfQyT`y;C-Xcmoca^s
zT4(OL>G6-vvjkl8tTuX^XN~Ynk!LM9>tvpF!l`cr*E*Yxzs++KxaQen^fu2{;cT}J
zoOLqK&BCeQ0<Luq7=N4RFu3M9ZuB<K1H!LHo)h4#lX*@Gr+x}t>zpzEHqS%gn&)Ao
zw|UMAXS;LYtdn`p3#WboT<bh;{B52mz%|d@#c6-Gd6o!&Bl0W-XPwNmOgQxw;96&u
z@wa(agKM5OMsM@170!0+z*#5rtQSswBe>SN+4$Q$w}5M&14eK292UMEd5(ayPUbl(
zocev>TIZPYw|S0(Yn}&;-sU+Wob676vrguDP&oBd;9BRr@wa&{fNP$|jo#*YLilaS
za|N7rGS5}v)Sm*^I@gT9%`^ABxV>neCE)(J#pYQmob8r@vrgt&E}Z%baILf6_}e@i
z!8Om#MsM@nBK$qbvmKmuGS98TsqY5YI{S^k&2s=;^BgvMo9BpdwmS;WI+^EQ;neQ~
z*E$axf1BqNxaK);^fu20;rAiWMR3;1JeP!1e-vEnJZAiDp2xv8&l5&(^IQ?mc2~h!
zC-XchocdGXT4#B6x__~GR)A}s^+s>=Y!uG#KR1E1PUhJxocb1Ut+UPe+dMaeYo1$-
z-sagZob7G}XPwM*n{ev8!L`o4#^2_-4_xy+X!JJEDdEfLpVQ#1lX=bvr~WXw);VYV
zZJzVsn&*Pi+dLPAv)v_d*2z4N2&euixYl{n_}e^Bfoq=Sm*m2O<2>`J5dJgdSqaWM
zsjm`FeGRzQS!euhp7r3GXQR>EJe!2G-DYss$vig+r@jST>)dAiZJyoWn&)1lxBYXU
z@HOPQADneE&oSZD9{|@nCyl?&^B}n9Ic4-V&uQUocLtnwGS5T8sXq*^bsjPPHqWEr
zn&(NQw|Sltz7F4GKMl@0ndh2t>Pwy<`@hy%2F~j?$=AieHO~s8w|Q0yXS-G4tdn_G
z3#YyYT<hFq{B52s;F{+)qqli>3+L}s^n$Za=GiZt`eAUbbJY0T{<#-i^W10jHqZUS
z+3pxP>tvqe!l^$1u5}(V{x;9U;F{-Aqqli33+L}{90O;a%=5T#>Q}(E&Qr$U=6M=i
z^IS7}n`iC?+3}z4mVmQP=2<G7`Z92>v&Q(_JZr%<&laP%dA16FJ+}8YaMsB@Hw&k}
z9bD_&X8diQ-Qb#MuhH8)`-QXJ0dUsIJcor-KLW0G9x(nk&k1nN^N`WoJP!-M4tdUk
zvrgtYC!G2PaIJI6_}e^>fNP#djo#+DES&8g181Gg^SE&8Pk?KkB{gaPw|SO=Yo0Ym
zZ}Y4b-j6)%z*#5rtQSsw6S&s7$@tqmTfjBXR-?Chwh3puo55Kp^V}kw`gU-wbJ+OX
zJV(Ga&jUtp^PCWVJMx?aXPwORpm6G^!L`mq#^2_77+mw5HF}%poN%@~56(K7=YnwR
z7s0j86UN`>xdN_vmRy?lXPalK@cqcM44ic`&vN0^SAuJu)yCiESp%+l)*8LdvrahM
ztp{hF%(GEA^-bVf=N98{^K1v#Jco_m<~bsK0(p*tvrgu@S2*?i!L`nD<8Sjk0IqpX
z7`@GNQaIZ^2+lg0=ag{jr@^((1><k?Tm;uVPZ+(;b4B<J@>~UHoy_y3aOzKkYn{2v
z((S_LSpu$kmKwdUllhbhXS?O#tdsf*;nY`xYn_e8-{#o_u6b@T`g2{K%%@%WSCQvd
zaMnrvHsRFwf@_@v#^2^S46b>O82z~>&r#uQcP}{WWS;wkQ@<Zv>zp$FHqU8r&2z!%
z&oy~23jZ$hTmomE%=3tF>X*T_&J)Jp=D7l{d9E7$xhBt(!rAUAaMsB@PYb7h4P5K2
zc%f^|J$POm-{o?Z;F@Qn(Vy$Y%%@5CkCA6HIP0W-lW^)=!L`oK#^2_-1zhuNH+o+u
z^Vuq#?QR2Soz!;=r@j|l>)dDjZU5X4u6a%wz0Gr4_<thL8F1FgJP!${eimHooHzb9
z&joPJbJ6H+o=d{n?h$a-$vlq=r+yh+>pW%rZJwvWHP4FL*n{=@XQl8m{JvWiIO}Ad
z)xxQ-1=l+3jla#a5nS_ZGJ2b5vv9V%37mB@&lcg-w}NY(-NxVM*$b|D?lpSbKlcf*
zL7w};Sts)x6HfgBaIJIF_}e@Wf@_{rMsM?+7S48Oz*#5rJS3d@!{A!yQR8p(Tn5)X
zPZ_<<^R)0+BF{B&*2z3`FN*z~ocdC5t+O1Q<9unHJy!v)c~%;|&9h24+pPv?J<PL4
zIQ6yQT4#&#w|TaLYo6PT-sagY{5s^>3(h*3XTNajhrzYZQR8p>=U#BlbDz=MJogJ{
zyJO(2lX;E{r~UxA)_K_Y+dOB%HP53)Z}VIhK7c%rfwNBLd0aU4E8tq^N#k$xJO!?K
zo;G@$=bCV~n|pC~dtsg>!l^F>*E(y!xgB9M%GH8vo-Iai^K2FV5#-qhu6b@2PJKJL
z*1662+dR9$HP2q7w|VvpXS)O7tdn^T3#WbrT<bhw{B8f70M|SZ8@<hQR`}l{&pB|`
z$^JPnoccv@t@DWSw|O1~*F2Yv-sX8sINLoA&N`Xr3E|YQfNPy4FNr-;`)4V*=2>I(
zHqTn&{N3I<aMsB@>xEO_1g>>%GX6Ht7I4k8)#z=WZNk~^W^mTYJhup^z8zfa95(*8
ze~y4_o(GKH<~bq!arDngaMsB@4+^J#8eHo<Wc+QOhru<^S);dk&IxC`^WdzLc`gX2
zei2;jJYoE8o-5#*XGvY!pKYF{!prgdwq@X~lX;d4r@j(g>#R2ZHqRPx&9m0%ZJu?)
z*={{J>tvpd!l`cp*E+Wtf177JxaK)*^fu2C;V(m;qu{KQdF~ZX{eEz*^MLWUc}{?9
zo|8sz^E@b=?M{KSPUbl+ocbAXt#iTn+dLP+HP02Jw|TA#Z$_Rc!C5EsJSCj^HE^x7
z^rh)`Ve>2l*F4LO-sV{$ob6VEvrgt&C7k+daILe+_}e_2!8Olzqqli(6@CNq+y>4%
znP<0f>ifa9&SB$k^Be)!JV%Y*=DAlm+uaAwI+^Ew;na_TYn{`^-{v_3u6ZsRz0Gq;
z_%QN30?s;_=TYI*9|PAqPZ)oj=L)#yxoY$_&y&L0?kRBA$vjUBr+y7w>#W?6-Hzfr
z_j^|0nrD;I+dP|vf8c`Xv<aMbGS3#_)VG0aom;?pT*veGc5uyetI^v$w+Uyv-QcW~
zdG-pYz8_rc+;9AC{~QC?Jg1D_<~c3=@C7l?8F1FgJP!${eimHooCnuD7r-^oMWeTQ
zE(vG5N5EMp^E@h?`eksf^R)4|d9HzLp4Bf)`?JlnMmYaJK`l7zWS(`xsc!_=I-8BZ
z-QG8WYo0AeZ}V&w&UV|tSts+{ES&l+;9BQ^@wa&ngKM7SMsM>xApGAhh`CRIvrgtY
zDV+K#aIJI3_}e@Wfoq<Jjo#)tE1d1lfwNBLIWL_01#qqNxbe4no&eW8bM=M$XNmB2
zPmj7%aMsB@%Y;*30j_mc8GoB+HMr(kWArx9TH$QB4xDu|&wAn1H-c-On~lHCa|^iU
zIbig*e+~=36nTz-vrgtYDxCU#;9BRH@wa)7gKM4#jNaxsA)M__g0oKMc~Cg@Q{Y<X
zyz#erE`V#E$Bo|Rc|!OV$a4jpbu!OY;nbf3*E(|z>2_iBECJU%OO4*<StgwAmV>iS
z=2;<}`bu!Ev)=gIJR89^&&@_}^V}kw|Cgm5oOLqKt-`7A2G=_Kjla!v09^ANHhP=q
zh;X($3eGy2=U(B|?*rF54;p`)=M=c+IdAkf&jsNf=%0(=tdn^z38(%jxYl{h_}e^>
zgKM5AjNazCBAo56g0oKMc~Us_r@*z&@{QT;D89?(D!?_*dZV{_HVPj^o=xDalX*4^
zr@jST>ufXrHqXuAn&%dyw|TY;XS-X$Sts+{CY<_iaIJH%@wfeRAGqc@W%M@BY2o{j
z=L|UOWS)nFQ$Gu?b<P`qo96<!=DBF}HqRyDZ1)H_>tvosg;T!_u63R={x;9k;F@Q}
z<!OJmc~&Y%o>kzilX+GvhrSkE>#R5aHqS<I&9lkqZJy1-??t<tz*#5rY!Oa<E4bF#
zZTxMXz2KVXKBKpJ?ic<=)Hw#uI+^FVaOx+(wa$aa-{v_5u6a%yz0Gq*INLo0&N`Xr
zVd2!zf@_^ejla!v8C>%`W%M@B)58A|d9H!8PUe|wjQyOP`ciPMvjSYt-z&j2&nlz0
zc~%Q&yEWjfhk4ctr@jtc>ufRpHqTaY&9mF+ZJxctSCD5vIO}Ad1H!2v0oOYB8h_hA
z_knAk`;Fe_IVPO#j)SvK=6OIk^%LM)=V9Y-^PC0OJXeb7SBvONuP8j;mI?oF<X;ZX
z<zoI7!l|zU*X61;{x<(QaLvEo=xzRu!r5*UIO}Bo&BCeQ1g>?q8-JVsR&dRK#OQ5*
z9u<B;dCYw;IO}Ad`-D?J2Cj8Z7=N4RB)H~z(CBTRQ^MKqG&t*Io-@L!KLoCI&KrMQ
z=K{Fac~tZ<wOno)T=OrzGVRZHeU*W$zSijN`l=KD0<5okaOS}E)hL|$W^m1+#rWGC
zTER7kHlw%eYqM~+y9Jzea(%T6r+zEA);VJQZJwjxn&*Vk+dL<QzZ`iU1ZSPhb4ob%
zGvHe1VdHP}oCViB=ZxOwIWL^;E`YO6=D8@G`Xz9!bH(`EJXgUr&#J2m_vdPG)i)cx
z&3}{d>yUp7IG2n0w+g3zGq^5SyYaXAZw1%<w;8?7zgsxl?FDC@%)eha^#kBq=a})g
z`HzEZo-;;o^E@PcC-OWD&N`XrtZ?e*!L`ms<8Sj^0@pl`7`@H&sBpHs49+^4=P}{b
z9|zYu*Nnf-GuIURt>#$;?vG<_p4GzdLY_6?tdn`x3a7pvT<dHy{x;8MaLsd*(c3&*
zgtOgNaMsB@+k{iU8C>h^H~u!y0dUQ8%;;^N<HGMlo(I5LC-a;TPW?e}t#jJ=+dOB$
zHP1svZ}U7XobAqnvrgtYC!G3uaIN#0@wa&%2iH8;jNay%yE+|*J%12+mVmQP=2<G7
z`f_lsv(ot6JgdMp&uXK$dDaMLyS3n~lX=z&r@kIs>ufXrHqXuAnrFY!+dKz^KY~1m
z!C5Es91%|aUU02*zwx(uj)7~Q<3?}uJRqFyPJpvc<~b>x`h(zF=bZ7kdCr4to+pdw
zPZiOZzdYM-nP-LYe?k70;9M^1tAtZu1Fp+eXZ&sc_28O+qtV;^n}oC7W^mTY{5J`w
zz6D(C>^A;SaZ%02xN^P5$MRvL_jO*nKF%;=^p@{8db@tdz;*pj8@=~o{xia_K)Z*)
znFIBQg;PHVt~o3if4jaG!F7Et8NFR!M})K8qu{KQ>uXs!^~b=q&eO)<=D7y0c~-t6
zt{*+#s1p7M$g>)pbu!Ny;ndfGYn@HT-{#p2u6b@UdYfm9aJJhD&N`WAn{etkgKM3=
z#^2`I53YIcH+tJY$AsU6JjcOVC-XcYocc*{t#jJ=+dOB$HP1svZ}U7XobAqnvrgtY
zC!G3uaIJIM_}e^>foq<pjo#+DCj4&XnQM;ynRPPH65-UBfoq)=;Ca`R!8Ok+qqlih
z3un7E;H;B*)(WS-4qWSOHU2iwHgL_e*XV7Y{lf1@o&(^llX(scr+yS%>)dDjZU5X4
zu6d3bz0Gr6INLn{&N`XrgmCI7!L`m=<8Skv1J^v4jo#*YO!y-5JPyt}ndb@N)USeT
zou`by&GR(4=DB9{HqYEEv*SP8Edghp%(GND^=05%XRYzKdDekzo~=f2^K27-40&z_
zXPwM*i*V|<f@_`K#^2`I3$A(g8@<hQKsehS24|hjb3{1xqu^TSgz>j|PJ(Nmvqo?8
zoD=?Q<T(${I+^E!aO#)9wa%l)-{!dtu6Z6adYk8Q;cWK=IO}AdE5fN?1=l)DUzPTM
zn`arg=2>g>HqScY70-yi_28_Nc{U2Cz8PHWY%%^e&sK2Fv(4yjo|}cU-7Vm(lX<oa
zr+zEA);VJQZJwjxn&*Vk+dL<QzYuvI1ZSPhb4ob%GvHe1VdHP}oCViB=ZxOwIWL^;
zE`YO6=D8@G`Xz9!b4C1Lg&bDJhx}v_pOW7#+|NtFb-mOWy<IQ0!Us`L9XOYl>!n^e
z^-bWqyqk=_T`w)*x?Wn1-maH6;cRy^IP2tk*&>|!c5tn8*!bIiJ_4?J9x!^F=Y;S(
zk>?~h>tvn>g;PHbu5}(Z{x;89aLseh=xv_!!rATuIO}Adi^8d20@pfE7=N4R3b^K3
zvMKG)HqTPw_aM(QaMsB@%Y{>439fZk8-JT;4Y=l6YxFkHI^k@$9-MVD&qm?YH-T%N
zTa3TWvmIRX95#BJ=ZNsXK%S%Etdn`}6;AzraIJIP_}e@WfNP!;MsM?+6wY=Jg0oKM
zIVGI>X>hG`!T8%e7r`~p6GrdrWIijx7m?>GIP0YTq;Tp_gKM3+SLeb*&s$5tHP2F`
z_jNL#GU05u9GrDhUm=|ON^q^S+4$Q$H-T%OZKCJ*-8O^ka`hMS88AN8XXSF`XUDvT
z!ToYsJ__#ZpFAgO{oj4yKIaWCxOPn15AN%?d;;A2{7p&fGimfThiPzKk28k*_4Nbv
zpF`lje(%G44jXRu^WeUo@0sN~0`A-O`k%r7C^*+U`7*e!-(%oD2fJLyjegAJaH5F*
zWD$M}+}CN>*J*HFkGX4N=3#kFyA|ME-o|G}T_re|m%PgO+-!2I6Q5_nr(S%>8;kg~
z8y}n7R&dR8#OVF{;<zy?{5sUL7o5vQ{XXH;kAds@Jz)HOo$PND;JQ6d8ojTR<HkYZ
zY<CKrby7bqocbAXt#i@%+dP-RHP02Jw|TA#??Ij?!C5EsJSCj^HE^x7<TbJ1>Goa<
zu6dRjz0I>+INPlNXPwNmQaJTh;96&k@qe4yj#|Neo|d;6z0V&Xqvf_3z2)8DzTID#
z?W?~CA2t3yhi6|DbKDEg<t5)Q`bV)I$AsStJ}y4g9}rIcB)H~w&~Uq4(?$3UILD>`
zMm>jwv)#ksTwdyDg;PHd?(4kQ<h)?`5yO{?@FU<_=TYHocNtvkJSLp_6X06sN#p+%
zx61uKz&}nIAIsN_KJ=4{sL!>;XV%YlOTby@v!O2)PJKDJ)>&b=&9kZquLEa2?6>vc
zNj>Q2O-65*x7p||Z!vnCL#uEuSDW#%`pv?rZwJ>Ldd2^R$g^KKeFnsz`eEVJkAnMl
z?S6T$;dZ;*Uxbf?GyiK*=K<ktcLJR2h5AY1)K7tHKGTNVesZV?p9R-C=Y+G}d2p?B
zK{)kG;9BQ0IQN?z&yO4Z;Sy|H?&(Ak{hHDLr5R_+UK{82?JgRhN^mak-(bB|31|J)
z;9OqnYlKr@2d@36-f-K0nu_pdaMt-V)VWDG+id}7oz%Aqr+zcIu9q!_+y1k)2;T;-
zb#@D9yS?CAXTNajhrzYZQSrYS`Ro-=pMBy_{eI!pkAv%aJYcw8kCR3CL2%~tLDV@V
zob677Gau?_gj0VQT=SVV+^)y@B76Z{>s%Dhc9+1l&LhI9Uk2AYPk`$<aMI}8&Gx$n
z&N`p-EQ}Gai_he2w*;JZQeP^Z`f_kx?-hpI^<GtkSA(;j*P_lE;cT}SoOM!PC!G35
zaLu#HaJ$|&72z%5T4$?pw%Z1-b#4|;eLJ|;xy|rznDyHYuKi)a=y#oib?%;q4Y%uM
zv<Tk|&gH!Y>t&yC*1sQ|%S-*3aOx+(b$KTZx9er92%iSmI%kBl-9zA7=V9U0&x327
zi{d|o^Mxhh^f@B_)E^a2{V{Ogu06gwZn#~KD@FJ!IP>{D>O3i&?VbW>KGdHUPJQn6
zv5#p!C5GGeSXP9WgKM1?!r5*mxYk)EoccQBW6zfx!Sy`4{r~ZG2XM7jb@sq-iiS#t
ziHeGbiHeGfN=k-_hKh<xhDJt)MM{NAO2#A^8WtKVDk>Hg873+!6($u^SZFv>l0!yG
zMM)DH6%{HL=AZq}TE6wx|8Drq_#R)@`|aP^d*5@;y%z``j_d#QaVK@QT|aa_UucB0
zA9}Oo^?5;y<kfp5uYLByz0W?$>+|{n$*T{;!*S{U8IAaa)Ys#kg!}PMOJ0v_M)K-&
zlHXJx*Zq0(E}VZBq>knn&6!_@`~F-J*ZsK`@yyC(pL2h5eY4;`4>^+8<IR=4dcNfK
zxC+d9T!m6c^F`*&m%x1<O5uJTDVMxHzo>}h>m;wwFB;&Sx36Oz8_n5g6P)wOe6u<8
zt?+PMdY)_(*L~g*@lH7Vd;)!TnRDE3IQwM2$DH{-xX*vTxbDNjh!4TN&tY?pI|BDU
zN6ncZhkKvX;(8x42WLNj$Gpv(v;G2{{V>01&ipdm*LOu+*LN-AsZ+Lm{O+@B@_B|i
z$IXPZPv*1Cna_dyyyc4P`sPQx0M7a3xP|5%w+QZi7Mn9)0r$syH9YixrrbBy!P(E5
zn74X!)^C8bALbj)nQw;s`nHJc`nE;99nL=6(PxJ_$L)l(Pv*PKneT!7`u2+J`u0bB
z0PcMbnseMCxc511&ip9c`y7M&x=%{}Vp;boah?B}h|j`#T)h9EGiRUka2^-)3+Bu(
z!~M8c#C87HBAz;R%ku!o%`oS<nQ-qj%bfXKxc8YS_4U540Pgp7m68wFcRpXJGUvF}
zaQ4Z3jXCpm@X)7TH|xc9-5Vp`1n0W*`9iZf$8CYLPv%?AnQw>te0GTIx_3pq8}5Df
zm~-4-xcAv-&inw}`y3Y6=MnSp(2w4qFTnkAx+-;aT~end`#FrOo&gW_^*%ET9*#>r
zNAjEQC-HtquH@BABl)sOzTEOJ=OuktnEwG@X?2*dGH1R9?(<(OuKT1u;!SYw6W-@H
z!?_>mZIajdY?r)xS0vvZ$@fcM=YK%*>VuZ&ybYOi-iECX^CRZWkHLMO$Kk$jCnc}X
zBc>wxMaj>}^=K)QUz7aBl228oe_UinJPXcs=XD|5ob!+a=YC*5*PQtRxX)XmxbDy5
zh?l^<&r)-aTL$+&%gvduf_tBhR-f0GCUe$lw))Jsm^0r7598|fs9jvoZ=DhEf^&X&
zed#vmxIJ*r5A(g|%=g26eg?#K9fu-54EH`q%sK8T-1{6eXMO_iedeB?JTAhxdLNPp
z_xq51$?J8hQ1a?!@G!2fS4G6DrM{lWYT!Ixo^R_VujkbU$*VU<@-2~khvc=NPRXlx
zS)S+5Zu9KDl6mj3I?VT)Gv5#QbsP}iV!uUv6wdv|`5c4$JWonq=W|N(>a&sjTqM6F
zd7aN?$*Zqep7XY9&Ust2I?SieNY;VJ%X}u>=Q#`R*R>qU>vb(Rk}r|GUe`(^`AW&_
zb*(0nZ;-sc{?;h2kH_YSx50g%w8J@X+&^8C*Zt5fdG)?XzCV&5mb~tV5y`8MTD}O6
zyD@XF`?%F%e!`sjDY);GX>ol#&PIFz?(@6|_jz8Cyw2yU<kd6I+<cx_&xD8i>ba8F
z`OK5NdcNg3Zw2O@w?eDKe33cxC2*hT3h|TVeVJ-;-RHFtZ-D#!H^P1XTO_aZ)+%}R
zF3Ib>bxU5oSMpk?Px9(RlGi%Jl2;$G{3sq5qvo9dF{{J;xH<Dva9^)!@hu(~5nq7&
zx-7zdT~;Ko^Rp^>^^EGs;{yKwJuW1#^O+}k^?b{7-U`e)Z-rKe`66@XOW{7x<>I>k
zD<fV7=REWIOSL)2t$}m?nXffxz5(uiHj3+hXpVRb-1}@b=eTWf@3Y;U`7XHk*)8?;
zKDig}_sQdu*ZnpD_kA@b`LKU#@OYdyXP+}tNAt7h%+JHaaq07^1##UcOA%j%bN+eV
zUxRa==^5{eJig#Q5809r$Mt#4LykF*D_81hKF^%_0=Tblp}6kD;)s{QeICl;J`a_W
z*Zoi>dG#8}>v7eZ^SJ7yj^^vlnQw&qJT!~zerSX9c=`Oj-JJD1;G75MJI$HzhWq~P
z5!ZhDBHj;YpM3s4V9s#|;p~(7A#>(O;687o;<|svBR&E5J}1pN?iAenoHl2E7Vdp6
zi0kXmMQ3e(oa*!UVz@uwsep(2x-L}_ua^3{&uih~xYX+<ANDiPCk>KU?}+3(Bl#}N
z^Z8)6`JZt9>9IP@_nI@`5BK>W5Z8S&6!B3w_X+1=49@*PpOn1L=al5tXCwK!NPbE3
zI{(X(S6{I_=WW%T^R{Mnm`}Ys*`GXK<}=|w&slKaw>gsE;(2-`Un2QZd45qE$yZAL
zVtM_!N?ac=H4(3cbKQA=RcFq5sE2cYm~Sv=z8UWG)*`O^vn}H7aPPCjoa1)Fz0WRl
z=6m7Z=ZMwk^<~tYb;hhd^W)~sPr}2vdcQO!uIo4x@mV<Mhu4=mbB;R?=ln3gV9xv!
z+~;RmT-R|m;%jj4GgY(sx)2`M95(~*eP)_7pAGjuE2X~PS69LPzPeiSdY!73ym~V{
zjH{3LmPo!!^7^`251jL}=WfZo^qN12?=$IxbAFibH)nnj?)z;>T=&~Z#7E)mvjTmN
znRDE6IQwLN!kqajxUb{1xbC;vh|j^j&v|o>y8!n-7tNVphI^lDR{tkhuhiLF?sL}3
zfOA~tGtHULhWk3^i0eA$MLZwQ`S}O>EHLM|g>d%Ce33cxC2*ggQgL0!@`zW!z0XQ>
zj#~xyKC8`{uZ4S`jpFCXb+#Gq*ZnrhUo80!IQ!>yq0^lGbivs_^WEmm_riTY^oi?!
z7>M{FoPF}TFl5eghvDp#`4MyG$KXEC<Kns>CL=xt_dci1IqnSH`<yjreo^Y^^<o+B
z*NdEUlE-y8t}UMLz(b!}rx@;aswA)1muktY*TTcNdflmu<Xa@K*PS*v=abiwcJteC
zp6`HjKAG<{XTBTm`?E(}_h(<k`{C@9*O38pjynivpUe-LGd}|N{W&VG`*S?v6L9Zy
z(wyT?!M)FEbLMB^-sim4{}|S5!JKs#tv>Th=FG3aeH~ZDbsbah+5EUr&wz7&hS6uH
zImgX{bAFi5HfKH;?(>r;uIpG3@j|%wS!B*}i{aj9i8=FSaPPBP{5E+$SOfR#PQBzW
zmg`QVxc(lVCU`h5JukILef1uxqvyAwNS)zGoe9b7d2CYh>ND^#KYD(fjpUalujjW_
zIM<Qqt2Ogq?Uw9U{-P(YBl8*f1yFS6v*7-?$QIZApBwQ!IQ!)JD&L&r7QopL^M&Tj
z7sGwOm5A%(qAcR&aPPCioa0u)z0WFh=4;^IXC2)4f1~7e|2M<gC(my!<{Y;b&OVuM
zGiSa7?(5zuuIt_%@g6w)<oT`Foa6Sv*(dY;=FAVmeLjc8b=^lIJ_`3f$ILnIINbZ3
zFlT-W?tLzbPs{mm4IcVAbp3^cQapT9?@j&^_KA8nJk;0U&z1)db-ph3i{PPu^%|-3
zsGM(WrOt1~>!gl)gX9knFMQym5gz(iZ-s~c7p2cmsiWuZZmFX_BKa`v8qRy8=3JLC
zIM<Q+adYOU;Gs`_U29rg9~ZL`pM!J19hRF+(7ZXvU4XMs<`>PGUxE96TNT&GMe5vS
z{E%1AfP0^r<{UQ*?tNyPGoJ_dK8wWlx?BMd{ph+^!o$8&uadl8e`_SK-UJW*=yka{
zlJAtfUYEP!oHt%)d(7*x?!9o%8}ohU%n!grpSlkR#dRMJM|=d%K6#xTHRrfvaQ4ak
zxH<Eaa9`gkaouk-5ub&7pL6CMcOLG2E|@dF1ou8ytv+ABS~F*z)ccah5yxdd!<_jn
zxUXZjxUOSv#Pi^spMUI{^pS7QaSPz=llek(=8NGzKPBS2j%5)qhkKtD<{Y;Y?tNC7
zGhYMuJ{!dElIvF!-0!<uC4aHx+u`h=uU~bTv!6~l`)9t(ocSKO?}uJ--4Fc{AAqw@
zzJ4`m&T)s}?34LnbLL0kKF?#~x*sMYJ_+|er_4F-G~D}~F=u{3>gaW03GUa6?7Gd@
zLA~x2!b6{0rwHzK%A}62S4G6DrGB_?*>%sPj~Y0SmtH4%eLuQh^6HI}-&8**so!MY
zitACc)X{v4IrD9B-w*BLx*s|t-UH`;;PLjteIEKHug5zedG#U5>v0X6^SDN&j^;<r
znIDJyJWNS_z2BII`}t>9>gavQTqM6DdA$!=gL6K4Uy*u$vi@}Tp8@AQGoNYBd^X(A
zS2^Ok|MMcA4`)BTuP89*xP@@`$$XJH^CfU!mr`-vpXCv+fP0^n<{Y;Q?tNC9GhYk$
zJ{zn)?<*S3S*OYBGv92^d@J17u}xgpu_NN0aLy0!E4s`%Za19s!+ei9^L=oipMG&&
z$H9mX!M)F6bB;R#_dZ9>nIDIHpR?kx%6-K=+|L6`lD}B;%i_8&s}Wy=^LY9FEvfS&
z=K(m6m-$R{9&ZlZk2hCb*CjvV1#s`P(46BI!M)F7bLPw7-e<Yg*Xw&F+^_FVQb+F-
zIwEyCBXxSEj;>>W#D}E*rt1;z6NcfO2VOTvC9l`PG0Ce>NM5gZljfbcPneQAnx8gj
zeirWYKPRsHWFg|qaPAWx?+V=KVNLRSyr~Z)`#<E>GvTk*$Nf^4Igcw_>gYV=m@}UT
z_jxFk`g)&G1o!hpiPX{igwja9TJn0IPz&er^15GV&i?D+oM+}6%$aY3hvU`PE1Jc1
z|F=fG4bDD!-ETMNxE*lz$$Y0d^WAV?mmYE5pM4SUhkKs`<{Wnr?tKoKGd}|NKF6&-
zulp0`tTSo#nV&Leeg^LAI4iE}I3Mu^IOm7g{Y7(*y9DR_Fu!ch{3_h%XH8t!F{3^?
z4}`pWCfxhXGUvG2aPKq6ocTPs_gO4n6iz7kD6LQa;^%=1c&Kx++$U6u>$+4&yavwW
z<#oT-oc-6qdA!Wmn={`8_v39A*ZFUacpKdNY&Yk)9dPfn)13JpxcAvB_4PiXAMW=F
z6H-U-6Xqgy<|B0$B(K+nCCRI=!9)ML?iuH&Hhs8f!#SV4p60+gZ}dFLZ@pfT|N8~`
zl2<R3yj~xR%)f~Hiejmw`4V&H%iz9V<>I=pDkEM4_j#y=`#jW3UXQmy^6E{J*W+q7
z=W(@29nH6zGv5yPdFT|^{m>opUO4CBTUeJqbB@~&=ln1~V9xvy-1{6B*Yz5W_&D7A
zoG|COlW^~I%AENbxc4~=_w(?)<n?}RA(CH{yxxyxd@y;O^0;_^m1)jCv*0`~=CjS2
z&xMEM()+PIaor~c5if+ZPu^b@nRDD?IQwM2#GLsuxX*vNxbBn6h*!bA&uVjyTLbq#
zYt5OjhkKumaNj2_lD}B4*RA3@|Lqa)fb+O`{p~bopIvYs7xUfb%=f|lxcbF){s$vI
z1ou9N%{lG}-1{6gXMO_ieNIY!y<Shl{d&D7bv`EFhmiT9Egz3R!TB)Doc(0O*+26+
z=FI2AL;w1CED+cIP!#cEIOln*-IKmc%sFl;oP9E1X3l&i+~>JUT=zpw#B1T+XPr66
zt%rM`4d%=@!@bW|tIzl2+RRy}-Rd*nVa|LP+}E*NT-UKT;(c(=58sdLH|MwmaLy0&
zgXYW+!+m~6#C09VB0diHJ}1mM?j+p%oHA#A2JU^%i|c*$GCcI7_roi2KM!X#B#)0!
zU)Loo;<<1h?`!wNa2^-EK=NC!55@cBLdmNaOFrE1)$s9a{&sk&)X{vIIrEippU*0B
zUH6)Z*Ta1t8sI(;O_JB+ZI--xtK{{#+RS-e?NUec9p=n;!+jox#SfF~@~F7(lL<KI
zf!|j-Y0hz{;G7@kr_Gt4g@-=%x-ciM{VYU$5zapOeU(e*9CsPcKAB%JXMPRt^O^ea
z=Es-rtIUXJ!M)FHbB>z>_davYna_uNpM~N&pT!X`fwNEEN0pj$+%h=(WWL;-`6{^g
zSuL*fSsU>>xc6Ca&T$*y-e;pZ^DS`iv(xJHy4hvUI^9;E`5trT``}^Rk8P9evGCu1
zab3s3h!4RzKfG=Zn{(U|IOm7?QFG?U;XXeT;<}Dg5ub*8pEKqhcNXq_&Y3g60QWvq
z7bJ5V#?|jP&VYyOsd^zi)Y0!lE|xm$UrH_E^K$$d`c$u#yk5ua;C>x%f`@V6myz@w
z{@W^bwq5`H<G60NnRmk5;hZ<-JItByf`@T+A9joDKJ1NnADrv^CG^v8&T$9e?34LH
zbLNNPzP=;kx(~-9J`VRjC(JqSB;5O)GG~4U?tP{%Ox84vtIy*y;Ql-=8y@QDapgw5
zQ0i~HJ{0fYis0;@ULtwDZz+|$dX?lu{nzcC98a}*8N5d7Xuj5*`Fgm|Tf5ZP$598|
zA4gqMM_<3{j^qa=f8RFAF@^sQ!?{oRden$H`yYjKo|zvrXMO@6j#nRdlj8cgn~wMl
zoPF~3s9AH4I|pZ<%+H%MzX<nrSrXU%xf1bJxc9kc&T&(X$y#`y8RpDq!M)EMco<jr
zPcGc|PrlUA{ZkOhmq}jtPX(OE%l%Mk&i<?5JYMFj&6%%-`~ImD*ZtEF@kTiN<bG%}
z=eW&q_Q`yUIrD9BUzc`q-9McX?}B@u-R2y(2kw3Lnls-I_dW-${uwyG4Vkmfu+?XN
z#GLstxUb{5xUS=5#HZk#pUcqav^mF}fpdPCpEYNG9`5tAAg=4U6!B%a_qk%uaaZBq
z=bAb586Qc`8{TJ*`0n9?gpWe;W90l_1o!hpspKz~e7U&(JZ}X&9IsyYtE9eqlho1I
zh1#W#-mi8@9rXdJqxZ2xQfIxTRQ*Sji5P{4c~+m2yq-U&;XXg}@G$>+AG;)V!u0dL
zblH3u_l+xXt~>Lq=FF#X9R4`U5ZA|1R>ZU6+@HKJ%`xY=xp4N$e4aV;1#sV=h2r`+
zDvo#w-1{sw=eT8X@3Y*T`AWF=*&_9I-?qZTeo*g_I(l4P5$}`wVW04RwI9y@>4TEj
z`_&=ItB*)N)V~eq$x-t$_?Xnu{J1&ulW?E6Iq|#YyfF_C>!^>f1-L)HmZXl}pDai6
znIB6Y-=QD9Kgou3|L}ez$DGHN3+MbZpJ&c|0X&SW_qT=O`gkmkcnO?+@_wV#oa2_k
z*(dYm=FC^ZeZ8v0b>G%RycX_#)|qqMdbs!5V9tCK-1}^X`#x!tyk4g|;Oz5h?DI}@
zj@t!ipUiigGv5pMb?+0`bsvcMAe?>v8+{I$bKGG#`(%E^ocS@h&*!+fuKQ%fr{Lb_
zv^mF}fqS2`=FHE-z0Vc#)8zG{Rk-hmjHb=!0o@N-;(Fhb4G+hq=kr{+pXW=Zj^4La
zNgcgEsg^qGEmBACTiT?~dP}L&i<0B%f`|E3ACSDBR|nxfKcnz4&wAf7A$9b=Wzzf!
z+_y}@xxTz_nKoyB7VeLiIdOfwEJS<}&V9)HkR@}Dy9{Ta%&(X;zXtbxn8G>)*T+j{
z#IxYuXSO-V&4GKLx#rC0!@bXHsjvIF2JZX0Uh3#^HAcKu>g#<=8=U>~zNJI*dVkU>
zdG&6|hx&WJIoba`=I?~}N*&GjnKM5C_jwzY`r6N!)KQ<1{HyC<z{4UnC3*FEco=tk
zxi4CfI{Nrsg!|)nS?cJ0(Mlwrb#XF(VO+g0%7Jr#@;)cmob#3k=lU|AZ_a!nJdCUN
zMMdKJcrS@~DV%-sKBvr_<CeqOC-W8N%vZsEKU9nB<Dxd=b#U*q-kjq$z`f5#bLN}j
z-e(Kk_es0t^*Y!GXP<nW_QTl^ebDl}FB&pupTky%`4MyG$KbwC#>I7?Oh$YP&g0^J
z(X=_ooq_XsnV&Uheje`gzaXyrWGUjyaPM=)oa3&-z0Wms<})tY{CNM0oM-aH_Y5aW
zeB{G@{}f4H_fNU_jNFe^itGJV6+9g87S|)VUyoX)j^1B&N}X^YRgV6<q>g%@)Y1E^
zeyOA9+X1PgJ|y`tZ7<<OKWzRl_$Zv~#r&8#^V9IKuXd1inSuMdEJ*&xvcAi3?yIx*
zNG52-{Ez5!70y1HUo&SuqdBSPkJC(XeVk@TJO|D`uR@=><{UQ<&OVvXH)p;O?vK+V
zaebVYM7$L4eU_PX+;X`0Sz*q672Nx*hWonLO8%X)?)7l?$@}mIbB@~xXP?YBnKR!4
z_jPX-*L81?cn6$)@;<!Noa1)E*(dYe=FIoPeLnldb=?OdJ_z?dhs-(dFx>kbF=u`Z
z?tM;L{R})Vrp#Gq+UheuW6t~>+}CklT-R|i;!AMOPZ9cDHs`o2aLy0&tLDt7KEC-p
zqt~wtab3r(h-bsS&m41(n+x|o^URqqfcrWY!Ts@DEP1^?mPYdBlGk;qjCd8C$NK=*
zrP`eR*T8wa%-5PTUk~@=Z4lRWX^MC=-1}@X=eVtK@3YOE`3|`EIV$z_K4c8;_aU>A
z*ZYAv$*V8I!?^mqEbG!_Kl^^jgNM96FDn+Wl>4jlNSz8e=W_z<UIpj8(Z{6zC#3#(
zr2eGUUqStOt508u)L)9!UzPmDa$Q@4hvU-q%D8Ove5x12!+h#}V-?)%R7dL6NgdtK
z4H0ja`r-DC&zoA{oPT<o<n{H0cFC)EN`6y){C<Nj^8@xw=A~QeXuijs`98QmUiziJ
z?(+e-@8=Pzqx*SG>V$syy1}?P`<Z}q-k6^>XMP$U`q$SPX2kXUIT!JHI3GuR-C)6-
z<1WJ4C-Y0@%&)+Go>#?nzolA|^$dCS47m51Y0h!8;NEApIrF)2?=xTO>*KBv?&r@c
zaos;dQeTg2B;sRm9&Z=+`M5dzpMdjtnV&Leeg^Kxy8`!pp87=kb;*o)4xIhJi2ifU
z*-t*4{WD)+&U_Kv`!9xj|J9eL@4q(Ub#V57Kwk3i>)ml&4RH3)e4{(^t#I$Z4etGS
zOJ4WSV8n;u?EgdPf7qP!IRa<@%#WHgKMwc)r^L0-X}BNP44i#_8hy^1bKE&N`(%F6
zocU$A_qhW1epcb3AAR3yP4enFpWM8!^!1iJc&M}ff2oH5N^*tp(7$>q-217N`ue_A
zwbT#SmlLqBYRowgwQ$ZG^L6ITH^9TZ>Gh>iT(2+95pRKWeH*#|%{guxoP9FiZq9rs
z+}F2DT=!v5#Czf1XP-I8?T34x1Ln*R!M)EBtN$I$&!{=;j9Go=$IY3ag!?*9iR(Jf
zM0^g;`S~UKoHysV3vkX4^GoK;ufTnNR>gH4Q>~jHcj}pN?=#Ds<7UIX&s=ln^WolS
zk=5txOU33F?346eV)dCXHD|sY?(0|~uIpG8@oG5dhp#Wym~-4(IOm7?I&<b5;66W%
z;<{eV5pRKepRMK`w+-%nwwp8G3HLs`#r64AzqroxV8n;u?EgVtf6adkAAz%f=10w$
zABTJY6XH70QxTtrd!IAr9CsG(ea@LPzX10>7p1=5CojSMI=CWrJ|oYUS0nipuD4-a
zecd<%?)5Vzudh>OMe^B_*Zq(i@jN)^`AMvMzB%Wu0M2=4zR;ZcVz|$9iMZ~EvWS<%
zz0V4Bj#~-$KC8@`uYr4?E#lf|Tf{ry?6VW+)lTzA;aza{$$Ymt^SyBIvtPV0+<4(*
z2+n?%Fz&E9>yN<M5A&nu%um2WKYBklDX#l)I^r{M_F3?j<N#*PIqn>seKJ39&ioSG
z=WSVB*LOAIYjE!~^{J#^I>*g`d!L!+%;&(p&pdJMvmoMyaQ1U9=CjD0;}*l&C-Wud
z%$LEv&kAupU)94yKl;9K13aAf)Z3(vK7Z+!I$@i);kbItZ-Mv1d0fo*nKM5C_x(I5
zuKRg7;v;a*|9$9Z)STmv!PzJC<L1my!hQay#C4y{M0^(Rea@M4+<Cb7xnR!x65RXD
zy&`$M1lN6%AMwJ77e~A_;^h&qjCgg#Ya?DC@y3WZN4z!S?Gf*ccz48mBi<kJDLD7Z
zIQH|j`S0K}aPAZ4XU&<Phx_AhL0lhqOA%j&v(J~%&x$$6U4^qx=GV-b&uH7cZ}t7q
zOmThOWk);*?tSK(bKE?*_nB|bd?DN)cXi@Ta=+Rvexvw|xaJqcHQ)5<&GV!A4sp%*
zi@#0Y{~8q6bsvFq-ng$u&2#om`WS<A-k2XZXMPgy`*2EJ`<aROES!CEU(K0w+<7?r
zWPZV%`6alo@3Oe=!_|nd!M)GamC5|kIc^5r`^+?FJ{#_R=7~Qd>s|ooxFuM}LUYzH
zg0mmyi_MuYh5P!JiR=1SM7&yD`>%ns|8vlPtvUOthqHg?8_bz+hWmWBi0ityMZ8m7
z`|pB#|J~;7rx))1_n9+43=jS5xT99TgpXfy))}|@%ukpzKLz)7pBC43pN;r}xc0vY
z_jy|~XFn@&pSM+W<}*IC`MkQtbw^y+Jv-ug;@W>c-1{#uXFo-7@4wib`7*fg+X``=
z|Eh>r!`bKM*e5mS9JdzEKAEpGXTA~ceKv{fJhw!=74ChunRDEBxcAv%&U`oA`&<&&
z>u*N;=KZ7B-+b}M<hoxduIo|)=W+3RT55h1)};*2<6^$tocT()KTfN}wV#@Z*TUH+
zucvk99Je0MKACSYXTAyU^WQA4`=mAEZE)|i-JIigz`f5-bLP9@-e<44&S!tbhs5=~
zF$`z_ync<Cv!5|I`)7XKocSrZ_dhMJ^E?~z1##_v5$^pjnX{i2xc9$m&V1%osZAfD
zf1T&-i06rGpZRd_v%s9=7QwyGVsqxp;6Bgg;yTZj5w8)~{%hghf1Nq|X@GnGjpod^
zz`g%Aah?B;h<C!-C$AS><{Y;h&OVv%F=xIX?tKo3>pTxdd>HP1j+k@YQMmUxX3qR1
z-1}UX`uhC_D{#J!SDI}5RQA=I_rJc5S0a9hyk1=c=W&hj{@MHqcpaR_#eBUv^NsLu
zT>5%-leq4amWa2)+2;cKX*1`z?Qr(Ve1|#nU2vcOZgJfwy%Fz&d!PO09CrZjeGZy4
zKMeOiN3A~BWz3v)#;rc{6XwiM!F?U4#dRHLBR&WB`I$H8xC?NfpG9-#m*GA?E8@D2
zYY|U<HhCO*pBd&HHxurCW|=de1NT1j#PxOB%7|A-yh~i~OZy`}BChwVGZC-q*nFPR
z`gP)3r%PP(ed3z0ye3j#T=N6sT7N=Z^CO?zTwnLYSj5NS+z&7BoBaC;^W6&)pM-Ni
zFh6C^{0!Xp!-BZ>xfJnbIQu*f{j8XC+*LUHWPZ(@`OMF6o;Q77TqLf)cdG=>ej3qF
zsX6PH!PyV<<>t&+!Tr2cEw1OK+KAV|*=G;>tT*Sl4RH3!e4{z@EpT7oR&ib5_K0`D
zz0Xc_j@t$IKD*7C?}K}v!{WDXlk9=;-%;@!#8<`jxKf>)_m6tExZcO+!g;*e2PgkN
z&-^b3C0+pM@iJd%&U`7{kGDZwkE==i(u`!x@ZT13ou4*1`@i*o<lnTLv!4z)`)9t>
zocV6J@Bbcg-T!?N?}xL`C(!4BImaD@vrp!S%$Xm7`#g_|>wXxI_ypYhoHXaSQ*iHd
z+MM}Wxc9jvex2@fIQzMDzhr&a%wKm%;;CzsKbfB_N<PnovrpE^GH0C}bJod&hyHaw
z3nE@3u8+GiIQwKj<>s8XO1Sr5WzKvp+~>JbTpxF>;`;j=JH&Nedd07h$LWB$&d*T9
z$HaAh=Ee0on0sBap5eH({|a#(w<_Xw;yP}txQ;s^uJxxPJ`Lyk^8RGT{0F!W&ceCA
z%+HxKzX133T@lwl*CL+!!j_L0-k)TcbKFcg`(!@LocUb1_gNyY_cM*+y1vcgdR-WR
zhk4eY8ybX%=kMy{Qb*@!GUBu1x=-feT;Bz(<AV9C@Fh6sjrnDB=GWjpZ#i9?*K6zb
zzYeb-U--y{hx+QplFwRyobH~)Q)QA@uYreg^>`b_``7F6qgh<%vo+$K;#$88&iOnI
z=lO1P&QC9#^T~XlIrD>XpU*Mzo8-7=#PzrqBc64AG9#hB?%QH<{k<q<;#$8V;x*zr
zZ*_3a8?Phv=A4H{IOmP|CUfRn;XZF|;@W>l#5>{a^CqlsmpRAnhO<xRd(4^dhkKs`
zQeV#lLvTMo%t#&mzVsDwJ>Ip5XWg)QKj?bpz&Q^*59FE;VSe)AoCoF$%$YBS`#kiD
z>;CK)*W((F_-Mo@#r1fn;XGdMw;6NxKL_XWGCyz5{1V)ccUfGIYc=9)aQ4almbx)n
zM>@yNfU{5LGtHULfqS3j;%##NsS!VA8=h@bsXB2zt`>3qJ(g|anjen%Xv8PQb$zGc
zoS&a!-%guvy?=5Hb8yZZ^YiA+FT;J_GP<{1mul3{G-sVG^MjGkhO-~m$uVc0Tyxeb
zgNHtKo+~0=Bd+t=EUx#T9pYNQE8>0PT4xa+)=S^-Sc3ce9cxlY-|xu1DVhIpysygs
zEP!)A99)#-3e9(b7r{CI%om$8UkVT7>iZpK;(wKXDk5G9XP+0KpDJ^XTMcKQ%-5JR
zUkCSnTQ9Eb*ckC9xcAv?&T(7d-e;>h^X+i&vr}AOC+~;*{uzM#{uz-vx_>65&bI4Y
z<cFC5N%8RWO1a7QNzK4{T+GjkYknCXj_YRG4{K6CjQax41F4&nfjH0iz%$?+m-$R{
z=Ck3xKXb%&f96FzAI^Su!|O!_<{Y;W&OVthGH1R7?(1GEuKTk*;uUc3v(lX7R>8f`
zYIEjm;ofJ1)xWMVS-(be?(-(A&wR5v^Q~}S$2M_Y$Bu}1!Z|-*L!Vvd9Jd?J`C-1t
zocTVu&riR&uH#_Dhv44lusO#afqS2$=FE@7z0XOje<>b!Q|8<c(^jAP8FS|6;J%LY
z;<}ED5nqCHe#X(~vN^|HfpdPCUo~ewbxX2;eSR{;bse)Jo(=atbIdtzF5LUfGiSa4
z?tPYvFUWmt6`cJXjq_NwIqTQJ*$?xz=FHc_eSI6mb$y#6-VA4-7oyJ=bB@~zXP?Zs
znKR!3_j&6S*Y)j=cn{qB>^0}OeQ@uy-<<hDxc50M{!>}sIXL^_d3E0WtGK=|z}XM;
zi{{KP!+m{M#C3hwBA)8m^7_v6YKA$-&4ja0=CjP1&w=~A<%;Y2=105$&iUlHh2|W$
z2=09rn=@Yu_dd(4KF_P==G-S0R-gGwbLOkzzK%8Gx{h@buZMGfcwTKV=eUh<&JXiV
z=FGRieSTWSbsgIy-U0VMJIy(67u@^oHfO#U?tRXP>wL~dd;!ir7jfQOG#`O4!PzJC
z%jV3l!oANmah=bMTQ^?^)wAH<XSO-V&4GKLx#rC0!@bWkaee=*QC#2uY7^f>o_BPK
z>-VMiz<FGJKf2ePefGh5T+H{IGd~Cq$EDAghs1TCj6{4C&OZ5m^q4uv9fz||<|oXV
zpMv}RPmAk*n2q=x-20q2=eP@S?{m?d`DM8GnQ`0ZeXIMVSX}o>g}CmM8gbnx_2PHQ
zzUmRz=jnsu7s&N`SX}dq@Gx)sI{6aZUnkGIee?02CH0HMbzhZ5yh>bO2djZ|9r?O<
zt@-eQNgwrat|Rje=FB(4eH~lGb-%Smyh~jB?}2;&z2@wvAMX7Rm@_{N_x`7(es~{n
zWPLru$F$T@&+ART&OUiQ$v5Y?1#tGse4#n>#qiLlo_|Wjx7a5UFNd>Fo=+;wIc_DK
zeKKEV&U_8r=d)H^_d|We8{pn&qdCWIf_tCM=FGQQou{z>+s&EpusY0lnls-G_x0)#
z*Y)a)ct4!;u!cSd%sK8Lob$l^kU8@sa9^)cab2(Rh)=-1&q;HRI|cVXr_Gt4g?pd#
zQeV%vi*P^RX5X>p<Fpv_nPYwoJQvPBna?w4z5pKj)b%a0`UM9ieH5GXcuTB4^X2Bu
zSHgXMs>F32Ya(6;=Q?uSdUKB30O$NL-)zo&E8P2R6W4j`h<F#AeV&f_>^A4Py>Rx)
ze4jb<190ziP+aG8IO3yl?{mzY<4(Z6&q;IUr{Uh`ytvNiviJ>h|FbHt`O+^Y`!v+o
ze3kfNQm0y6>(oZPQCzS4&2Y{e-@k4#=RCB*Id9Cjn={`9_j&6U*Y)j<_@KD<KMeQ&
zN6gvJ7~K0GH)nnd?)}e-zenyT7b3nYew*Y|U)sFxx{jF<&w}%KZ`v>U_u1y`KL^g^
zWj@!O`2x5fZ=txZS8>Ek;NEAcIma!7d!Oaz%vZs^&suSv&jxY*KA9mn`#cHncMO{s
zz(?Thllf6|=EvcoPraX<5Z6AZB0ddgpC3U#Gv*w37S2AIpEGBE0q*m;D6Z?i9Pt&n
z_ql4$ao6D9XR0sR*L3Ey;H=O4`D}CMbF2>Yx#rC0!+pI9#C5%jB3=w<pS+(hG3U6Y
za2_x7W#-IRz<s?c#dW=^BVGgdK5NZ6ZXMkFtT$)A5$=7qNqzmkj&``eFW)V7^nLkh
zsk80+mf`F3Gv@4P7S8^epEGBE0q*-@QC#=Ka>Q5QoM*mHzG}{K*Wm1v`P7%wKQ1!i
zKF?X=x*u{Po(uOr^UT?2KHU2(FlW99?tS)(>+3v&aQ4H;?~wU-c;1GyALd8QnID7u
z`i_h1`c6iC3eG<H_?<TAxHE9}$^5K2^Yd_@w*_%s-=&Bz!@bWHbB?<T_deImna}u2
zvOm4gLU<TgpFbAC{rO{^)X~@L8l_Hnycgs7W0N_bCpN>`Kl3f-%(q#cm$9$f&3_H=
zv^vapnKR!5_x;u@uKTS&;)8Im<MEh>A#;v94Cg#BKW5JS1l-qgQe5}jbi`-j-shY-
z$DN0JpG)S<ufV;})K`;z$Z>fd$S`M}OgP77KFgf>9JsGzuDGsae#8sl?33q#LUWE=
z1ZSVj7n?I*3itUb6W4XDh<GL3`>ZnOxYcm)v&NkHI=J`QDt=gaz~iGc;$7l8|2+{O
z5ZC9GLvS81U!NZ~XaA#c9xwA_=FCsR{dlLubzNp6z96psFTuV4Wpnnk3itlk%$d*Z
zPZq-aFNJg5%W+;RGiRN0ILBqa!kqakco<ioPgRTSy4Oa$4$eM%&}Y3l$8CVKPv#rV
znQw;s{IrPc`nE;99qxU0m~-4txcAv*&U_Et`|K0f`J54-me(;>#c$Xq_1edpxYo(|
zS`rE4s^^I7e$In)9{9RbzB!Mp5YBmEzQ~;UQn=4UnYgZ3MZ{~wwf{P}_g`<$ej4H4
zf0H@$t#I$ZO<d=>BjTNK_IcBO$vSnJbKGt?`((byocVsZ_c<W0^E?#sVYv4>V$N|#
z;oj$%IrEcn?{iA(>wWAD-0x#orH;Ptlz(S3uc80&{^scVpW&kb9{N<Tf`@+e{rcvJ
zcZloz_ygkl_+1g#$8YA>lfJ^Z`ucO8xUN@0#7o5WaZv{6I$neK7s}1=gIB`2j?7n?
zGhYYyb(|2_`J9jVinz{a_Q2-((bsiL#C1L^#dSU##C1NKBHkvh^VtFS`Rp{G;`=yo
zpU)n1<_F+DpG)G}|4PJH;q3FAgOhn&Gk+^QbyxCr_Q`yPIrCX??=uI^ae1GgYtA}(
zR-gHNbLI=-VO+gGDH7N7a7n~V;p~(5`DNxDw;ay-VZOqg`6{^2PqnzNV{OFi;NEAw
zImc~)d!LQw%s0cm&wg=z{EkI@T3jE$sc&q4{OaR0KjJOoTRiT>^?ygW2hREVIQDZt
zobx~*h}0R8I$N)|Jifla!pEr8QJ;>~S(G~4uK#<EyCfd!%%lDa-1}S=*L?2Xp{w=(
zUEB44uk&0YuJcwQuJcwO@s5c1!8y;{;rq7-;q0G26sfZ)uKRyE;wx~Dd%_{f@voW}
zz}MjHhxycC^6%)(XTyE}=fQp4eDe=r+ybl5aSP3vFM)?~^*mN8uII7xh*!Y9&r0)a
z&}S8#^T0l<&6%%*`~1|4>pC_@yb11oHk)(Y7P$A>YR-HI-23d3`r+pR^OJ3m>XAC?
z1CkGqU(U~<`8}A=A*rMJVRPok;lAz@;=1lr5ub+pe9oB9qR&~l&*z*u^Gk4_&t-94
z_tl86!M)GaJ;_4QIc^5r`^+?FJ{RtNmWrQ|fkj{cqXHhrUH`vSFFvorpJ80}R;lyo
zHk<3TNuA${cSs%eA*rMDHWKkMsUP-L>tV^*<K`#BC*Yhn<|oaWpMm?l%}ITIT+B-y
z^(Cn@BJ-SaZ_;n5ug9Ae@oYHv1N+Z0&&ToR!u@#j%$YBQ`|%b_{g-4NOW@)8rh1Lk
zS(M|g7uVx$ig+{JkGIAARvd3D+>f`-ocT_;A8(Ji_Spybe)`S7kA4Q=-p`;p^CNKY
zXH0y@u+i}`Cw{T4OX|KP;QJ~w;#qJW*EWYH|32HC_X9a_9vAbu=FAtu{kTf3KI@d4
z^M0Vr>N8(%&U_U-jH~w#)#7>`sf~CY+~=p>oY&a~xX(|cIrA-WpPyE7-G}WF?|^%s
zo#q_33+{b(n={`B_dW-tzMl7nq>lQy)Okeq?UK|9+nnpWY|i_H6{)ZJRdePuhc-Vh
zbU$Q?>wd_IcrM)MInSKe-+Z{wbAdVYC2*hTQgPi6<q@xdd!Lo&9JdPYeO8+@Uk~>_
zJH@rn?uhrm+2?*Z|MZ&ke9{MJpUn50Gd~RXKF6#+>x`T8d@^D6nV&Rgeg+=K)%`Xr
zuKR61;tOz}pG9*%PM6?5Kg;IKufctOQul9uyy!Y+Mm!77K3PB8ob#3gXP?aHnloQ0
zb@Y5vEP3@xcsMS-@2V5m>t=)aDRSS^B(C$&67g0z=YjpVnfG9yx5GIP%y*bG-wXHk
z>bLr=GhluO#vQc!%nz9}KMME#JSMLDc_QMIaG#$k^Gng^G~DNB#+><ixX;gmxUS<;
z#Fydhll523Id7|Q_R0L3IrEthY<_&{@0%(U*FGyEUI}NP<A)}7tIP`yNxT})KAEpE
zXTAaM^Vw|mS*OLE=fhU3&wQIX^PO<tZ(ZWL-+Ch63-|fyGw1oIAMW!rV9xw7+~;RR
zT-R|d;^T1k$@&xKoVQ6h`(%E~ocTGaqvy#5$*Zry!*S{PGv~q0`&N%DFXH)d9vAy5
zFn{jQq;4Uc$Hjb+IrC+3pZ{vB&pI{cJipaiedg=TnQw&q{%jK0{n--nR=Cekn>o)X
z?Qox;4s+(a;XXe-;<}D~5$}hyPu3qW=e!NV*(dWu=FE@6z0X;3?Q=fj3vl+y`itiI
zhb8-M3C=#5Up8lc4eouWhLd_>Tzx$x6Yj5*<ibN8eVwF0T<=dZlk%xhKY#uIJ71qb
z7CiK?o&yi{2jzKIGyHYyzW#ry>Jt)ZH6MqMiihV}FJ>n&ZvHR$r1^i~)8<?4l)$X{
zw(xoL9pQ`S`@xqZz8djO2fzNcFc0Clc1E4dFe&RF^xfdu=6k|(&EE_UYoT?nd~@=7
zq4{m_V)F;#rRGn;%gvYImFC;!C*xL|7r<-H%i;Cr=fWG!{|nx1elxt){9bsw`H$h9
z=JW7w^MAp6&2#oiZTjdpKNLP_emZ>I{F4VKbtcWPflr%%1wLzjAAH_?0={TI4PQ3@
z6MWVDAMm8x_18_-zaAny9zK-`e&qTarTm=d4d#otN-E&tx~Wcy<a03q^Zm%@iN96y
z1>&Kf?C>V-`bS~%$ENy6NxoP-<lB)i5kFe;W#S>fjC{FxspKogL%tppQ6>I1$=8U7
zJik||R{R*r*NcaIInKEa;%}FHlX%DvBi}4uCizzJkk1b%t@V$#<d04Bd936+#6!Lt
z`A+e7NWNP<<Wso5;MWdqs(+m1@#8_8Jmi~^?+^cW{Uhv?a>)-S{91k<`62P+B|jn_
z>Q`qbFe-k6<j2KBejND;@pnpoN<8F?w@YAJyh8G`;vwIU{G9lSl3x%H`RwfzSQI}=
z^2_2O-;Vr>_{oxA6A$@i<TpL|*FO*QUn%*_5Q2xl*6*<C(^QuDDU#0-4}YCTK3Duy
z$>)oQzm{hu^$WyLlYEhQ`0Ft8#o|?xFBK1e&3{8uzfAme$ybPnzjh;EDSn3JtHn3{
zb;qQBjrf_8uM-b{ZAQLcyjt>&;^D9J$Tx|<OY$w^;jh(iO!{dRKTGoM;^D93$ajdp
zTk>7v;jhKnN&Rl|8p-#HhrjkC-zR>y<OjsVU$b#vG$?+K<cGz>U)z!A@8b#k`8|>!
zv-~ph<KnfFpA-*&t$)+{f7U;y#NR9V8S(JfY2;_c&z1bVc=&7i&Y^lLwIKdJ$uEhA
zzYZh6EM6!1Rq^oG{G3odm0A;jzvMG;edhJL8~IG}^CX`wzNzFcN&Ou04@f>wJmi~^
z&lj(ke4%*A&m&(Xe!k>O#6!M%*QB3P@efMATs-8*k*^T{kmRexL%w*oq<*z{gXC+)
zL%tvRI`I!nzCk?XvvZUBjp7$bzF9ovJCJV?zfkgR;vv6+e7ks~<U7SfzG3&IpDyu_
zNWMor<Y$rZ75}K@`^7`PVvnT$fcVEGKO`RVBghYnH%Wd}Jmd@aOzMw`UnKbn@sRID
zep38m$xn-id}dx!e@6Tg$<K+0d@J(v;?0s@6c71D<d?)hF8LMlkgwe<>1S2^Qpu;*
z{~kX0c%MW*L;NzyXNiaUrF(Ds=dazThdM2i&$av@@_FK)kbHr7sGp1Hr-kB|OTJh<
z<U5fM&q2aR=;xD?5BJ9OkYDBVV)0hVhkGH-H|8gwhkK0h5$gY!<ioX(9_r8LZ~8P9
zt|{Ro<Ub|(aIT|=eC0mL=iwX@K0^Kq$%nm75BX8#!=9nHNj@A4J>(1Dl6)RA;Um=l
zwB$R)L%tXJPVp-x-z^^U+53j7sZ@{nXC&Vz9`bF-_lvhneo#E*7m*(lze@5W;vrvG
zu>PO*k5TcfB|k16@>9r9h<{e{Q{o|CwqK~eew`N&bC{8EYF0et`M*;$Cw`6O7sNw8
zZ~vswqWI?|zbqc|UC6J9e_rxy;vt_pAgRxW!+r>B&Hgj-m*64agnX9xwUW;f5BWLd
zbH%Tde7<<dR~07x6o`L8@<rkyKZ<;@c$ef$#Y4X6z@&be`1O*n5D)oY<SWH*kbJdx
z$Y&jt)UOf0QSx=-A>W34y?A&`;nP&3c*rjy-z0vM<Xgl;z7DVRw2I#>`F8P;pF+Mv
z{1(accU*8klohT2qxFw&$%n^2K27zChx)_F_le&s`2q2e=lh9+;<rhDSUlvr@qQ)W
zdkTHtF8MLbr||yKxOlJRC&fekX5^>D?~weAc*xHoKP&!4$<K?2eC=WD|5^W75dV_o
zm&8MU68UBEaE`^Nsa5fiFD(w$*YE$uzbyF-yq?7M9Yj7;{40{r77z9F4&PKhl_UOD
z$>)iOd?)hx;^A7r{tLxJeiiv5@vlj~L_Fjhk4X9{6~9yR<>DbfhkS+j*Ck&i9`aR3
zCiSbu2P9uB9`a+z*NNXH`3CWjFD^;yH;R8l^3CEQ--mpQ_}!9k6A$@{w<h)5#ltn1
z^WP~R@*~K1iQgmn9`TT`KPsu;D}Jx!`^7_k8u<b7`y@Xk9`Y?mC-wO{XxO*m-hlm&
zT7CifG4cB)KOr9K*OVspC&eF-{Iqz;Par=d{-EUN#6!O1ZAtxk@nOj?iii9F@=N01
zl>CZ#$X6bd)L#|<mgG}-eV32-dE_(1zb*MJ@le0!?MeM?@o*2u`Og&(`3dCn#2=D;
zfq2LlmnHQJ#lIu@V)2mgN4`Y-Vab<?hkW+2N&Ry1aIeVzE5$>;9r-Hp?@GQ#Jmi;=
zuND8E<m<&lzWyCaKMmsFmwc0W$WJ5REIuarR`HNuLB37=za`%x9`bd^CH-`Y|3LD5
ze}MaE8u=c{|4{OM;-P+7c~ZY$JlvCW{s+ZFehB#?@kb;-A|CR2$0zki#eXFEaq*BJ
zJ|W3Zi2qpfQ{o|?|IQ>oEgqgbu>V={P5rba`8oCVF!KxQ>(PSNB)=%WmE@DJCht3c
z0grK7_%pm8{dpE&{~T{`Y;ykH^ZQ5Yd~$<2cp3h+Qej-4t6#(QzXazwDmZ%x9{!G(
zTf&z%eFQ&F##JAeKD`bugN$z)_e#n03!(lM;$G)u2JvUeA1ir&Ie3=1*QsMr>ij)&
zTxV@i=fX5~?vy;g9QygYxc758gVGPLefp(P=ZOvKT%+OjzlZ#Rk>lD0dpP_P@259S
zofl+WemT_tj=0wuWDtLb{PB|KmxJ>;S}?CO${_ySG;ZX$_S@jN{wGbHTO$4BZ&2r%
zG<A5drC$nt{!!}tas64t>wgdVUrU}}4*p{~Ua#{n2JvUeS4o~<4&E&8b;9>0=|{*P
zB6)r-`03K8*Eu9j9p3A*M))(-*>{6F$EK;n=j>kRZ5z}%B~6`kBggf+4eFeorcOzu
zPU!}98q(DHq2zgNVSbL-U>{zZrp^<Qe!eK~>vd(CItNAic~;!(T$iTK&XU*TDiilQ
zx2LIdn&h?4J2p73p)_@xB(HUTB=x<YN7B?eRPtJfuMq|FIzLZS=jup5Pl<b-->0dw
zt?U!+=K$%`>-;TEoo`8A>-_Hq{qX%u&F>Sb^G4~@``H2Si)fu|B6YUepw1p?>g*P&
z^Op^d>yR{c_LgzA&mU}1=N)P4d@9n<vbfLBnQ7|mDtYbamJRx;PgCaykviq#-p{3J
z>hQHM_7eUK=ds^z(9czA>U><rWvx)>#0~1)n5IsT<h9NL;(lCTPgCa}$!ndL#l6l*
znmRw1yw>@o9Iw~m`=FXnNnV|=nFsSad>>TvUyk&1r0jFA^ZPW%#n*ONJNy~e>p`jS
zbzVwS=fjd`tx)Gfa=c#WjqA_x^dsbdAF1<~4eIQZrp~RB=NO^>wc_5-(P`>*NnY!`
zOWf;(@3qp8Fzy|Z<Kk=hA@6nGpQg_BGA_pm_4!&^x;o*#XZ;BI-bkJ8HrPMmJsAB6
zbq<cy`L4JhS9q;oKSG`RCC{$~FB11U;Wb(P2>G3)e||0a%Nx|;`<<HSYqqrTXQ*@X
z26cXtrl0?nJZptIZx#3B`c0ZT-ICWjdy0FVKc}hl`pEpeaf3R1zf;HkspQo^D(?N{
z*kd5f1K(R=jqqpi=QgP0&y7R=gOX>h;CzoJnD=vhntm>d)cJ(C*Eu^)ozF^M`*~5a
zUgx9oweW93|5K4V2gy2moh#GSIW<z}kCOE|dN0C$9*@+S756%K$r!Bjj2ZnPaj&EI
zYRvP!p71$8!n}QZgF5r_weW93es}3#>vT)j`&p5%vCi)!b$%}Hb+(bOvCbdN=og54
zom}}E^B*vyA1Cg04wSDke~cX~y-KoPNAE$I&ysx`EPRCd|Bcl5IyEu|^ZQ5YtV-7F
z=)DN*oGAHV;Un~Ol+^b+m)gGx`8S!d&M(Eij$dO!oj=GtY-$GmjEZ|5zt;(Mej?*)
zoiA-rhwm3^{(Q-+UnuVVjM&(rAHH|b8sX32)spo(e7}(YCgd-Xy!w3`^z$40H=)i$
zlGi$)m#p{mH~CulH=)jfvQM<muw=c?tMWD0;d^bYL0^!p*V);|4*lF1Ij$jbuTz+&
z&evpI_7v*RZBVB?O`V-0b-pR?{hXDi4!@U%y>NaG*`N;J=i|Q#{eMpK>VMtfxUNmp
z&vla5I!8!-Kd!sd)cI7T&ST<U=R0ZY{6q5EPtFGYJf5abo>{0B<}E|q`*~Wv#{3bH
ze)g5D*LhC9#yWm&q~9&|z0QBq)cJtqLyhnejw@5LUT4SGCprE%<i9BMss1N%uXA9U
zI{A{<I!}vxo$@qwei%8fhc>8Fm!{5<lGlFj5%+$sNK@w@lGi%J(x=zCIZd6nN9z1;
zgF4?xQ|DO8Yd?>Rdp|!(Q>RGsTIX`<)9d^)O`SK$e$zU7ZSgvPOH=3MNI%(9-|K8k
zz`$WYzY?kQyg2{arpL?rzuki%b^a;ypvQH)IR6>z97d2jTS@;~r+<SwC#9+5_aLEG
z7<c;(>eQ#H^RUc=_A?{Sf5zjwf`ESz{ChI4*6H7%&h2UH{3=qXZG$@BPgCb|$!kBC
ziu0fGxPC>D<NBxMwa(qrC;u7i{DmNOZjRK^dlUXM)_FaC4phhW=f2@<A+Ns=#Ov&r
zrq2G6ex^4#uF^DhUXi@^`75dK{hXPm&R&tn#k)4B^S(573L<r$kv_ejOVZRSk-Q$)
zVH@<*mZr{=kve4?)VU>1o%17gS~jS2Z<;!{N?wm^TdD8!GoGf-n<cMxzAEl@o=H>Z
zTakWF5%)SPY3lr1^4gF7UQ@4=wLO!`pW$(Iaiq?}8yr_bnmW5i_Mtup^?pjy)Y(2#
zXRi(VIVnw@TFLXM!||Rf$Lsx^m!^)tb`olZIt5bS>wGdzopU9x{hYo*KRs#c>=LQ-
z=mvF0($x8k<h7rp#QnH_lctU?m*#`x$3|25@#anQ792nBkjlltVLpSOfY0;I--FK!
z%`d{|_;&o)>R$~nwLHI{s@(j3d|qk(V|-q1{!4sbYyJX0uQ%Um{rJL1WAevqee(Nr
zn$1r_zSaB#@OE?l9DAoZe=fb-ydQNqADsV(;r*8X8GO+EkMLphZSa2LsQLczar1Kc
zr1|^c)8>4?d)EB($j_U98NO)#ZTPbJ<M37U-@!Ni(AWCcIBze&Gch0Z9q@ilwmIM5
z%r!p>`F!&#c%k_R;l<|RXFJ13sd@OBuJBQA9)6Z1d{mnA=L4(Fe};UmIe$*C-h37L
zM)Pc(YnsjZ+>HC0^I3^}yX8Lw?=<H<bhkP033|=%N1c9izIHQc&TH_nIlqT>)I1aC
z?s0S8TTGfChy1j8J$%-j-^(&@&exL{&G|i}%jW#v)>ZS@-V4Eg=eoRvelpGZ+?c;#
zE#yPVqT@Ghx70A62eZyE_<JG5^Vk1DHtObPCjTzvv858ge}f~sNqBAAYTfr=|9^h)
z`?7-{D30M%^gjFpUdMtTAbI?l{cHIjBELWW4Ecj4j~^p^EkBPOejMU8{}cQSsT2C-
z_o<$3&huBJ`HT4cTJ!sA6S&!YJM{V$^Bv*$n)AB$9rFU@e`J0*#(mQKIQX1-Bm6n@
z4mgjG>(v9_8spQStVs%l-|H7X=x@g7dFH$0^L@<^LVaGhS*H-WV=R9dK0n#K9G~;|
z;jm75Rnp)2mVX(W`eO6@v7xRof8_L}PN(_RXC{8D`L*yn&3}Ro_@Mdi$n*Ecu>bSk
zoz(vy%ijX$`HJ~_;Qwd&*I~U@%(sVch52Beo#8xB(DUGXTmDdZk@>OkW6V3?mF73V
z&oRFn&fi<Yen#NDf1z`Kwp*Q^bCUVI!TbSupLr8*l<zg?<CnkpgX4Z2`Nu5(X*j=6
zjrnWgf3W;R@MZH;v7i5Aek?xE!bzO<-+;&09_G8l4>ms&`|xD*!?AC8-^BW*=%>c=
zJnz+;pNKk5=6t-jn)Cj=!~AF*Z}=JZ@WFn<&%A|?@UzL`gZ{s#C7<*6JkV$1;b-^4
z2mN{YW9Bcze_{Sc%meS&Sf>!aVtIbQJ-=^=`O`2znYeGFSHla;IX}F=W1ioKUuyY}
zpbo#6l6js#t1ZvpKgIXBnSTUz_&wot-k<S4k$xHSd{2;mADpjk(*FxSVEudv&i6`~
zzZyPfdCuog&G~)!e2toQcz);i{Ll};e&hF4(|?I^`Mt7q?ti{FNB=GI{2nm+Zm545
z?)&I`KKL2)|Detn%(q6JUh^#YUFJN$PnbWC`p=n%pBWAxe>dm(hp*+b{}VCpcDQk*
z{|3&V)uR6yzK`X@&!UHq3Uk)4GUxY`^XFk%pU+!AYxyfN?hWP_!S67CKfK?(20mnd
z3!FbU%6_;{#x4Ij<bQ7d1^B<spN4OX`+U~tb!aE^hmg-T=l6%d!#w;hlJIeoIq##+
zGCu|R^UTBVm<t~tHUAj=a`W&ziNeR#=HYkKgpXUy%iv!!=j#SvGv5pOyUh=UKVZ)5
z?(fXQ?}`c^Z^ZK{&i_wvz1Yn>{48|%*w=gp&iDOThu6oqTb}#pWb<cGr^b9coCo<n
z9_wepTP?p6yu<v=1Csu`%}>rr{LAJqoS67M=6r4RA#?8kN6e4RPwM>C{Mq8fe{22(
z=HWT>@Uzz8<3;n=;doy)|1I)6;C%zm+cJDN^OxZVn!g|W;c)X^Fz&JDd%;gJKNNnB
zIp32z&z#5AZ2m6v(`tSs>UWrPy}Hf$UR0ksue*chZ^O7F=H>85%=x_tkDK#8<`?Go
zqW?dbGyl9fUk7{9oIk_16<(+3x_=J!cQn5qzK8iu@cqqigCAjjC%nSE6@I$;>G1cO
z*T6q)elGmu<~%Qb!TdbrZ#Vxi{D%>rH0S-;jQM4#^O8BgpZQhu?;yX!4$0$~>%u+{
zG~XZl>Tq+u$9$~$0_vY){vMq7&NhEP{Cx9|!0$HS>$Ifr2hDk(_I-1{{`nL07t!bc
znsXh0XZ~;G|7_0t)R)YQai6z!)|T`9HuxLOxzG1B|M#iMzdykIO{XP(r1@`gK0nU<
z#KI(BZO-=;-)GM6S^uE<4(R_PbH2yfVtzdGSD5qlqR*Oh{%<s|L!B>~^Ly6sHoqG8
z;omlYG(VY#N6r6+d4AHo8RO2G^Lw+NGw08=zi7_$|JH9v#^>YiYShm*zZSliIp5<y
z$ow0~A8r0Ec!l|6@OPQ>X9><T|26U-GoOdIn*R}gjX9tH+-%P0KVLQH^PeGeKL7cy
z`2#rL{luK-!C#p3eDSRL<9Iy(-TZ0ztLD$a->~DB>-!)0p60t@e;jC@4?o)cVEBpV
zC&S-u{zH6zzWHPL{1Wr0@%g9C|Ao)LV4nTP<T&pzuZ7=jej)rJ^Q+)LHvbO%=jLPZ
z-<dxT|Eu{Le9in7{GP7u@pV2PzkGCZT)F12$M4<R-#mpnCFc7fe}Z{2oWJ*-;~oP)
z&+;e1o6KwApE7?Rywm(b_#Ng~!0$D`75;tm0r-^p1MuINkHY_IJ_YCca2|dI-#&ZG
z$I%l9VqMHz@%zg5H~%!e#QZw=3FdsBSZ&Vd5$BoThB{5=Ux9zh{62W6`M2S>nUBK<
z%zp;|miaUAaq~aHe`fv<_?&qPzn|@S^KAI4c|M%~`%YZP{oy(I{r&VK;BPU12fWz4
z0{#y3v*1<cb?|e|KLT$wzXX1{`Q`8q^Q+)Do8JWQH@^e^fce+pW9C1A|Bw0O@LBVx
z;s0k|Q=B|rR?O#--wJOqb6x%j&o=)Xd~fq#yd|k$WWF8VKt9HNCwQg#8RbcxbIcFI
z`J%!6-^gETo_Tyyr`>#4_zmWJ!~4t&;rE)Cz(>uGgFj||I(){w0saT`%izoA?ePDY
ze*vDgb8_5V$6Mfgn12IaX#P$3QRa`rE6ksTpJl!buQz`gezE!MPe}T1GyfF!)ph2(
zAm3}A5C4YwVek?2Lj3;2ADLhE&ZM7d^Bdv6HSdEjncoBdm-!>`OuWv=^?C}vtNHWr
z0`sjal0J_x&#Fwk+&l+<hWX*}I`caCN6kM9Z#D0Pf6n|4c#rvA@H@>X;lt*?g8#t$
zoc)vI{i*qL$UkHL0{l7i?M_MRykwpO-)5KO>s+t>;5(Zi4d2K7B=}+G?}s02{vr5j
z=9j_WYyLU-h2~#|f5LnOeyw>Ap0C|x&exspH|O)RZ<&7$&%egZbMd~*<L1Y~e`#I`
zUohwM(7&6%8~Oj3p9kMz*Dcra5_qn8D||n5zQ1*ZIe%a3apuQj9!@vsedhbj---N3
z%uj`X()>*L=gj##dTuo5&v^8i^Jg|5Fh30Q@Q`^C#{HrB-N;Xwe+&LA^Y6p|&-^j?
zKh2+nr*_+N9r=4&-(dbH<o7WDC;R~OSKuY)JHI{|?|Ab!!_P41&ttyN{0QV5&CB4Q
zFh3K1wfV>3H=6VN8vD%ozTG|M-$9-4m_GvlvH8#8)8-5C-<ZDuf8PA{naO;<WWGB*
zBX`U7ErIW3&iC#1Hh&ND2b*64FE#%x{6zDw!p|~)82$nCC*c>FFTk%be+7Q6`J1*&
zj{kP^gWz|Wp9uf9c|H6QbG~2or1=fV|Hk|q@IRZ6!CyB2IsEmzZ@G?q-)I-}SCQY>
zd^enDjxv8E_SMPeJbzZ1^L>}I&EJjsA2e@(Ut)d{yv_V___gNOz;83Z0X|^<H~9VL
z--Lh9{Cn`9nEwbqWBzma@6CBV{j2#L^8YqpfM@Qp<@)lvwu||5$iKy$*R^BJnLo~)
zuisXhXW;eKv(4WK|DgHK@Jr11fVY|N55Ly@DEMvWC&9mNeinS#{5<%7n|}oUKjxRg
ze`$U-e8K!C_}|UH4A0+l%XJ)uA7Fkj{7Cby@cQ$y=4J2`%pb(-u&0^xefIa7pNcvc
zn4b;5%=~<KyZOi9*PDMF{zdaP_}%6m@DX#qzw?Os^~nFs{EP5s%)bU-G#`S$VE!<C
z>%1-3k*~k+U_OrgZsyDIea&BiA7);P_dnil&iBhsHt)x}*O<?vew{h{{D?W<xBHa&
zEb3fk{uKOL^Pj@+H7~?*ean1X_^5d<{BiT^alB8NAB+5N&G|m^^XBhFofpmd{Z3o$
zwdK0={hJ-lKZiQ`=10H}GUxlzN130E{!cK!9DauRmGE=TuZCY>ek1%+^RL0LH2*gI
zI`bdG?=XKHK4{MO1s^u&`+`3<Uq+oL&HoL5#(W#h^PkMK;r}$>9sa8M0r2d-w_Nv=
zFz%k_e82WB<{w1<AoKUaPc}af<DO-H8vMQH7s1arZ-ifD&es{PH(y4+$9xgqXZ|ew
zA@eG{p8NyzLin^fUw{6M`4PxJZ+;B?CG(Tu+q`+p^*R;K|NTt9zSIie%kq4mbbs?M
z<c~DJ1zv9cW%%jleE;u#=D$P!L*{(n{}S^jkiWwG7x3%N|M|9LUT!yk75M@4+mBB2
z-!$j@wm&d$J2=TdVSYdA%$h$8|D*XN{2%5|!Cy81Jv=Kv8K3LB0^i;I75M(<+m<H(
z{z&s3;pOJL!cRBPho5U+48PF)ZSWTJa`;u|Rqz|k-vj@W`QeAAHhm15*CYRs`A6YD
zGH-!DY2F5(GrtD@ocWFL7tOy2-+G_arVp;;*Wuab55V^}e;8h5{s{aS^GD&8=0As@
zWBv@h!TeeHrRINux0}BJzrmc}=g?=q3m(7snjZ+~|NbrK?PU04mgoKRjQRP<|H1rr
z__Fz(@c)?ai1$OY@ct6}`9AV{m`}j@zsJk`)9|A#zW_hgyc3V>cbjM6ee`<sH^474
z&w=y(G4_)O|Gec3;J2C|1i#b#ZSV)pkAshy^ZOxwX?`K{&zbZ4>R&Ry82N4X-SY8u
zC46Ude*Z+i`R&LbV%`rw#=HjWa<cjR;Wg$ThM#Z#3HW8^XJgze&8y(onX~^p%#TC;
zJI(J#od?Z_;A7_eev!w`zl;3S=FcCMtjDwFTce+4^Ebd>G2a8eeZiLNyFYw4bN*aL
zf%zfGH=6$*eKwo(e9~tALmY3XIln)q$9x9)e)9$Rkokc{$#IUF{}g>bYW_?3FU==W
z|5<a^Uoz+MX6(1+JpToCvdzmd?pw|IJoI?;6OcdG{51HL<~8u!%+G`0W!?ZEG0($s
zPM9|#|8w(8;lDNK^W|0Z-S<!CD;t0EyvpYz{NMMc{}<{PTK+Tex0>_&{Le7&ME+d!
z+u#?N55U{a`F-8|-xX({-$uUI@(;uBGd~pmkogPPKR+`6=aI?0J!yVIN#b+nRq*G`
z>)<b%e+a(y0bB0pW_Y%FD||2WtKkQk-wZ$6oR6al^L;Qs?=s&Wb<Q(?pg8IK<K}<C
zyj@}bFU)hN`RnlgTeq6;0Ke1xNce;1?}3k*e*pft`6ckD%|8u)*8GqolH*-AKLY-W
zc^Q2B!Y$YLWcYsOr^AmhKO0_d{sH*u<`=-vHNOacq4_7^E#{wwUuAv`{08$b_?OIk
z;DhF0fj?w^H~dHD55k``e;7VzJ^_Eu{Au`$=D&e&ec+bs^(XjF=6``7YW@=Z?dB;w
zE>1Py7G7(f4ZpyAPk4*@zVNHf4}*7`m%+bcegb^R{Il@yn_mZ?HSdA{(fmvBf0*A1
zf7Sc}_!|z|a$O#R?`i%c_<`n6!H+h77JjOE5zYf=o9_g_z<huB$IW+vx0zSNKX1<Z
zz2>JP|8?`X!5=jLF#HGRdDx$in_rFm)8?<@y7jF24mjT}o9_yL#r!Ss?eTgQuj9OK
z?Ph)?@&)E)@WajD34e!qCHypV{+x2HIe(7t!{+=szDvzNg!-Q`=g;?bnKvVUhj}af
z8|Kg9I{R(&f56Ah_d7g!ocz@MQ24LSkB0xr{CN0^`RVZ2;dubpaRt7kc?$b&PxCBz
zp?MDcZ1dJPCCBxC^J{lX{3GT!!9QVsJNzp1Z^5rO|33T<^BMSE=5z3GnlHfr+x+!7
zuE)*!{no!Qe-w|$-<wat|6=|N_{-+cz_&SM%k%29@SV*60^i5{@9;y+Uxt^N4`3cD
z%=vtz+WafXUuga${PX7geFe9e{|Nbh^T*)#oAY`4wE3&ZFPQ%o{)#!@XWS022lMg5
zp99S^e;IWSF(1J`Im$c>euDY#@H5Q0|Ial)82Jm#-wMCf{2lNs&H3{W*O^x%f1CMx
z;CGsT0RDh^2mE{H*TWw(=g&VpW&U-Jd)Suy|6}kW^UuIX%v<2&<~&~&;XKWC|1KUE
zN0~o?I`1@p3SMpgPx$-IGj>jn=cDG?@K2iW3GXnk#rM<PWPS<Wul<Vo8vH)<EAx|n
zM$P-+kD3p_pEAE6{yX!B;7jIX@R!a14&V0h)TR%v%ggYc&9}nq?D^(zfFEMMFZ>wu
zQuxW{$HQyPTktya`Q~5ve_Y)Myw3IC$MIu_jO@K7BqA$>Y*}T`6d56VC$qA*kdY8s
zAuGv@kgQ~H{z$TC=I!VA{@gy->pbrJ?mkbi^SQp)_xC&3Ip;d(x-R)A@UP{);dA7J
z;mhR{;7N3U)GYW#`BL~5`Fi+m`A+x~`B8X$-EVafo<@Eb{<1t){>bB4RGt)GMxGg7
zRh}1KOI`xrLjDfi?!T)K->1GM{Jh+L{<iZlmTn&gqJL377G7EYE!-YIvIK7T$E|}8
z(wslwqvc27)8!Z8OXLsXmy?9YDUN>Lvg><7o&<hKo&jD#w@W$T_VxM=c$TE$<(7u$
zmREznE^i1gB5wt+Anytv5G}mi0dV_1XB2#S>ad>*KO&z8za?J@kEZ?k6`n-C2cAiO
z9G+YL54^D4?(ekYXn)sRSN9j1+uzGIhuiZIc7)q;{0zPzX}CYb;6;;#K8YSH^zY#9
z)c**#$9=7b4^saJe46|)+#dIJ9=<^RP54TAw1VM!ZQm;DaXyLQ)#d5ojpVuEAIXct
zKap2}+vBNf!-uJF2A?AD2wx!Y3tulE0pBT~0>2}l2Y(>{2_7d!xR1ZVlgj^sr<b3B
z=a6567m`1Qmy^F(DDpVAm8XGsmA?WXATI>B$2*mUH%b{^-h1$7@}}^%@=xIQ_?%DS
zbJP!o=SdY_?j(3I`5bsX`Eq!7`6l?M@;&f@@)Ph;@_*sq$nV3~$X_TNdAzR4Q^2F?
z_BI<lr93}8ue=nzs=OM!iM$cKr~G5MJszV6e1iHf;NQx}!{^B7!l&!@b_u+?d?ow?
z`7iLU@=fr;^8N5!x;;D&x96d~2w$o>x8W<~(TYSK-;MGF@PqP<@Xhj^@QhmL>+lQe
zOTg`M)Yae#G^aNFf#x)Z+x-cx;n&sohTG$x2g2?7813)E?CXv_Kk5|p_WY=G;Z?N$
zW$^dp>*00frHe)$mr?Rc@FDWraQi-?BfMDhaBfey^`FD-{22pZt;?MTKOmn6x5s0z
zfZOj|cfzk}&SCg1`8jwpT`zlHA3I)K)W>==azE{IUxKeypB}zZo)d1zt26wv`d;wU
z@?r4UTK_osJ@wzfpU79jU(=j*@Ko~O;pyZD;MwJ8;C9@vz;mjPRV;F!PstO&_sdhm
zkI3`Eo1_Tm7KPjSSsreWAE^bera6t^)^~+hP8nXVJ)e-BSK~Ej2>M*=C&1s7&xL1{
zFM&_e{I&1}^55ah<Oku~<o|;om0yQnl|P2xmB%k0d3>M9Q^DitdS!<vlNW~1(44p7
zzsRe?_sHwP&&iv^r|NRs!u!g5z(>dj!6(W`!|nEDCOlKBaK9G77i-Q>@Pz8Oz*EbQ
z!R_(VXW{oX{}S9D?|m1(PJN6Lk;nHpc_R33d0O~Ic@Fpuc@g*tc^UX2d3AVs?L&Qd
zb9p=X5_xy{IeB0BHu*645&1;;Y5Di?o$__?;;F;^-3k9#eh9u>ehR)$egnQ)ejjf4
ztHgdQ^7z{Ck5a+UX-;8yll0-omx4D=6M9v6Yk32BcX><rKzSGVxAOk*h4PW`pX5{E
zo8;fa?Qym%;0M)jf}fV}hW{%+2EQl22)F0ay#tSvHr&q`B_oelQh8!{7I}JjK6x&<
zJzlpk+@8O;EWD!TybG@*Zvt;7Zv$^9?*Z>2{~SJ0J{CSo{tf(Qx^TZ1!sF_^T@9}+
zPgp8)pGWC<eF%RdZ&o_8zpTq`3%AD=_k_>X`oDlLklXWk+4mdE<TKF!B3}gGEdLq4
zQ@#~`O#T=AjQljbpsw!~cyajycsY68w<Gs0pFBO>9{-#Z{;$?k5PnVmHr!rkp(Z>^
zm)itxe_zxdepmB*!Lw`50C+t4V0cpbNO(H=1o&C`G<X&HJa{wt3V0{^MtEQOPWW*7
zVfYmJIrx0}b+|oV`VsuF`h;a7&xeNc)Np$obvF1W_3y)r>GQfJ-2VQ*Gd!*OzVMgj
z!{GLK>1ptM>KDQ<$ydO;$~VFL%Xh;^$dAFN$S=a@$?w4JanAO9a&|kjNqyq7k;i4H
zJU#rBd;+{<rtssZ!((I!eF6MM`A_f^@-6VJ@;~9P%TL0K%m0P1m;VR1$Ct(~7r75>
zGKTLbg}2NUdKdUA&F=#*Cm#y8ztf%we^>o%xIMmlDZHclb?`y*9dLVm^&$9d^|8uF
z?!))mhlKF$>eIsa%U^+?lNW^FmcI?R$5B^@C)au!!R>L>t>HP<cY_y{4}_PNkA~ah
zsHef}tDg^VD_;fgE8h$sD&GsAEdLMQMCW1j3X#Wai~2<Hz4Dy!8k&<IZa?Rigdf(N
zD)0;P`taNG7Vy}*+|KZ1@_z6v@)7U?@~`2A<#XW`<g4Lt$$y6rmG6fCPks<?f6sOn
zZm(Z(6>hJ0@BqF=^W#*EdiG|w+XJG7@7wczn(tDd4*hm{5qR><;hYliT=H^o`#H2O
zyk(YfPE&YA&1na(F7E|zApa8HOg<joR{kx#tNaIeU-=sNFu6T1sqN<k`F`{><Y(YZ
z<X7Pv<PYJ0$nAMa?Q)OEQ&bA~)%;(1R``8+K6qRmmlE*Q^2+dh^1ARM^5*a|@{aJ@
z@<DKWT=z)$OX?@Vv&d({?Qziy;bYV<g~!Pj?&BJ`-M(#u+vA`2!?$Yw8Mr+^_Eq>%
z^$+28zk1fnk;nI8*6{t@@Kc&o7(PLL8Tbr&b+|o#xFLMC`j+s`^3L$x^1krX@?r3s
z@@epa@;UHJy1vWcx8)n)oit}Bytn)u+#c6`1^!U;?R9wU^Dcqryzoxs@k%F84u4gi
z1zt>^7hYao99~mi2Yy25b5poIezqMvtNLE>*X85kzssk>i^#u+&zCQU+x!ji73%+h
z{~|vO|5kn)UR-_|UQYfWyqY{#mB`~*NB$E0eR&3WOL<=SIC)`sdwB_X4|y5*m+}_y
zB-z7tw}Y>dcZIi?_lNh9kAM%APlk_{e+ReQ&!uqtd$zT3dwlq1_#(}}2cIdAQ8n^-
z+3OM}hu>14244E*@Z+<<?e~Chzze7^0k^+5s06pimDh%+*PIXGFUvoM+rD*!+nj;$
z9-1=@-cmjhZm%mn3vRC~w;bM9b81$P+<$u=$wu&gIl`_re2Baoe2jb`e3E=L{2Tc+
z_+0sX_%`_}_+I&D_!0S^@b&T|@Fnu|@Ky4A@Duv``xrGM_w$VU<nZ(IEby!H*Wvf&
zZ^5Iz5?<ar@VN4N@UeP)$Vc$W@=ow?<$dAv<ip`h<dflR<a6K~<;&ou^M==J1H68|
z(09To%a6ck$uGd|as9X8Yt%=3H}W|CCQk_eOa3x^fUZ|wdbDtEad<)<uS)Rb@;dM|
z@@DW%@(%EI@;>nG@}cnS@`>;la)#@l4Noaw3b*HfTL-u2z1acJra6b;C8CFydk$Vu
z{SCN1F8v9-ocb5vi#)z|`=1)#Id|B-47cZ_D*zv<z7+gxc~$rfc>{P|oj)z%&E#F+
zZRP#p-Q=-rMqb}KI=+eEx#a2K_IwRF;YHOKg4^?%l!4pxIJAY^^CNVD+wXn)!5isv
zhr{junb~lAK8Pjo0h;p*{7d<E_#*i!_^0x};ceu%;PyNe@oPmM7h6wKxXsB3w>gF2
z-|2GSf)AHhhL4xmf!p(3^nssK{{?)nd>s6=d_Mf3{5IU4x1w(C$o<Ks&)+}bt@U}d
zA6`ZM8F(%ERd^%$LwIv}+&Yo#X(vws?<UU*?<>y-|59E8K2ly8{<XX=e7C$g{Ghxe
z{G|Ld_}}tj@T>Ak@cg;LefbVvO8z7KJ^6b0NckV|6gs{q;A!QT;P(6o_u%$?2l47g
z9!Gm#g_Ll6T+gd;dmY0!;CA~{3T}TlTLo^fk690Hk8Aq~K1=&Q6#kohEPR1{Iy`R7
z@cPe(|DygE_z&{m;MsJ%cEkTue+(W?{Y7{j`5m}DA4-gRk;f~!`o!?`@|^IV^8E1n
z@{(|S-jgoy$LjmQC(4Jyzn4#huaM7%Z;~&C@0PEFAC~WcpOGJeUy`4L-<A)mAGy!@
z^!YU$Zl4#E-~;si?QFRH{JRpKMf2Cd>&SnF+x-3T^6Hy5h+KaKegD%6Zm(P21#XXD
z=m)pwB^eI?S(iHrzEM6KzFocqzE}PW-0pwg20yI+FZf0IDfmtKzwk%$d+^w=hWi+^
zVdQ=$mnVj2lc$5XkiQ0RATI>B=S6%QZqIvP4Q|hO(Ex7u!?%Fj{aT&i_WkM*czLaJ
z4E#0uG<XsDJh=V*vI1U8{YJPwP9b5V$o(&-^EoBFjpk&7cb2~n?<0Q;K3M(^e3HB#
z+@2TaBlt4)o#5-_ec^w|hr<uZC&QCzALhWb$(O<H@6a~D?fI+s!R_yXkHYPB;V;0?
zXq`{sG4q7SFMi|5<Cs*Q8lF*}9d4gTuftzeUkP4NUK?)DQ}ZFbg8EP3wr{=Q_V;^V
z!0mBEW8tkde>%LQd_LU1zO01X=kG3fU(GoWx1S$xz{je8u}S1{SuM{7KPb-!KP@i<
zzpL}18vLrfKK!EmBY0NL{{-Gx-V<I+-VfeW{v~{_d=%XFZ3^7>Z7zJe=B$Pfk*|aA
zkpBkXDE|{~_j_N0zo5_eoAB54{p}O@9nF8~{mA2fUOp0DQ1?Slgxmc^v*Gr0!BY4s
zt#cjRKEHOrbLw&r!C#aA13#$wx8XhY{aEa#k=J*-`j_B#y>h^9{dwURHK!o_w!9cT
zy4GJBo={!^o<?2|Zm)~o6mGZAZQ-`hJ>YgbHV9r(mpd9>RX!DN$Lo9ed+L|N>&iF4
z8_WNIH<KTNe<J@M{9E}o_+t4(_*(f3A4ENSv)_;ZCQk<cQ=SQKUzcBnpHN=}ennmu
z{zzT}ZeQ;j!R_l~E4aO0Ko@v+-ETh}UPV3$Za<GNfREQYe}oT^{|x_3eh8jImwN_o
z>--09=lLCYKFx{#VdQZvB2Ne}B~Jq{oGJYHvhZQ*tHPVe8^EvYcDN<Hx%w{f_VWJl
z9`cd!0rLIujIW35KMpUT>va*HEn3*$hJO(~^k~h(|JvupeO+z>xZTdAhTH8-c6gN5
z`8wS8tpq%l`bzNl^4jp1<R8FO%G<&1xF>ENd3{f-PYt){^LiQHSbYI_dwD7NXY!ix
zee#CzQSz4XujQTLbL4&DOXS1g>*N#RTjj5O6uCbg3xw~#4zDbK3tm(H4!p6v9=xTz
z4cwkDsRKO!8{v9-z#nPOAh<oAVl+Ia=FEg=kuQMT^9Qbi+x?<P;r4o?7vTT@`&qa>
z4}bI)k^67Y-<}YjQtM0uPcN?lf1yw~w?2H5`WEn+^3L!D@_z7@@)7VY@~`2$<#XXj
z<;&sc<Qw7kd`!FG(F=yx_b5D}{BL+l`E7V+dGwZ%$EB4#5qyw59ej*DCw#iR5PZ43
z41BA+2K=zRG5nsqW~<2c|D*lf1#hVS06dTU7`&ML47{2=dh5u`?JDmKzaSq8x91g_
z3O}mzc?bNF`~duxyzs|ZPvP+WO7JW4TJUr7mhiYm!#N$`cKa|2o=*KFcv1NhcrE!F
zctU-B-wLm;{xJOiU#|+@R{d3Yclks3D0#d#k^4DNo)rF>JQLg=_gw`3gZdJ1dwr{S
z;VIt?*U<o;Sl$wD$E82~u=*kJ3-WK_|HzlZugTZK?eUx2;dcMee)t{DISqd#zYLFF
zEZm3t@VN4LZ6l9YnS|l{Dd0)fXMv}ZzXrG0y)6c}zqfe@ZqJ8O7yh2+H-p!ew};!`
zv-O7C-?Pnz7t)-CaGUcJ+~#bDzoI#R!L!Lv!QYWzgm;qPf;W@LX%~6Cw#XB~?e9X<
z!tH*WSK%p&hjWX-8_7$<6U(c?Gszpm?f#b5@TKZI!EJtDxXm99ZxTCP|0?)7&EE*W
zA>RRiDBll{TOyo)5?-oQ=ojIs)Zc+;l*jla{5bnL%WiKI!?USR56>sh1%FFk7+zUk
z7T!YsF1(w(34EZu4Sbxu2i$JQK8Md%KLNf<{vCXW{73i^`Fi*T`5$n5{*lA*N9xbR
z<GmFgr<?HC<k8wk9>;HW{v?90lc$IG)tub$;qs#Jaq<fAney83h4N-_`~2z%x6iM>
z@Qs=?0=`W?1^$+<?>x9Y|Hvx1-Og-*x7M6}@b>c4@B>=URrqoFBlsB2iQggeI8K(Q
zhM&`%9Plghg7CZYGVmwzcj0kLhU<7AZqJ|64xU<lZ+Is85cn(diSXg_@8Hwr%izDr
zH^Tpr?}i_cABSI(UxNQ9{|}z1RJcEJIz}F^^z!8Jyz*>t`@Qh1aQpj>BJh`V`%nqq
zSY8Wm&-c_0o>j-a8{EEM8VFCIel$FZd>Y)I7ij^!wfg07d%mQN@NNmh{oMt(=S4aO
zFR%IM;C4H618%o7PvG`-JV~d><2zCF)4}a_FFSmd`uuQv9r==Q`~IXVyr<5?+VDK`
z58wsl?chb_J>ezgpTo<^$H1$|r@`yW=fRuFH^EoPe}~VKAAm2E{|(<HzX7+;>j&@{
z`h1MjIr8}aD}M=YKbK{I*HNDveo$T%eo|fwzC+#^-dNrSzER!<-c;Tn{-t~*e6)ND
ze6@TLyoY=(yp4P}e7^i7e5(8sykzO9XK&ZwRps~K_WOdEUBZvE?_&?@{)ZIs+M1IV
z{<S<C-0lY`4&SG~Jp7ux2K=$S0X)vz;kui{lgm57yO#<3p78ea{_x_OGXh>tJ{ew3
z{vEuId<DFzd?WlL`CfP%`Ehs$`9JWk^84^l<*~a)9`~{GByd}22KW^9x!_ynh2ek6
zE5Pk~)r8yidLM3=+ZKLE^FM{#{K0UWKOTNsb7sIV$``_;>HJv@e?h(-o<zPMo=Sci
zo<)8g{;K>DynsA@x5(rBraUdYj64UtlKc&LRe4!>ZFvoNQ+XqJYk6;Yf9>;F_&WJy
z_$v9g@LBRj@I~@<@N4qz@ReHUU+}XD!~H!Ek6AJFtMK?`Lw^8ICXdrS@_5<b+b4ym
zQJ)c>Rh}FEn!GUFo(HE4{HF@xI;z9B$s5A=$XmjX$veaUmiL9<k`IGFkxzo#@7ET>
zi|hKXfESi;gxmcaJK=Ue{9$-ft>+xPK+JI8uER5{e*`ZgkJ}^ixR;fufY*{|h1+q=
z2e-c~dkfx9bE?35$Q!`z`Hxz`hp6ucpC}&$|4u#*{-k_({ind~IL?Ka(Q#Y`x7STr
z54Ydj?tp)#`&|#h)9W~%h1>aX6>jIx1Nc9>UU7Ox9^YH?q;NZ*Gr{fkq4LAWYEE%@
zdF@Xncnx_Sctd$JcuRQ)co%secpv#t_?PmD@X7Mo@MZF)@Qw0y@NM!P@W14T;K$|X
z;1}gL;PyHlPvG`E{4e&3Jib>nCpG-0{AKuKc>#E$a^c)ka61pH!tM1G8o+aCPD{Am
zK6HV9rM^FWx_l&jmV64lhtALM;a|!h!e?tA%Jz=jPkX+?YVZQO+=lRC@>cK)@~-e&
z@&WMr^3m`Q<<sGIJFpPmR{hWL?(%JLJC3*E9kp+d;nv6hG;-hUaU!YUi*>o#;kN$#
z@U`ko!tHjr3fz8gRUf`xb6UXP(e>&KuO;sX-=jGr;D_a3!_Ug+!vB>ohd0*cZiKg#
z?}FR&8=QuhQhyO{>%R@R^+)Ryc^qy13E;N=)Np$qhV1YJTF>k7!txSuyIz&x_B;u@
z;V)~>LAZTibQW&ULvj^<TgT-A+#UxP=d;NDxvxGc-0la?2#?Y_bHi<a3d1v~F9V;E
zI9$iC@RRCy!0mppgYX&Z&%*6-SXbe{s(%3gQy#Bx<o?*-180UWRsRP3RehgU9B#+4
z1w4~}-su1@EAIvGDIX1AA)f$$BA*7g$KTC^+vD$6z^}&)_hl3Obmh=@!0mbZ4#MwM
z3j4G0Xqs~s9$)?d-d_Gfzi^)2|JFyI96nf{6>jUy4d1GD7KZPTmx1q=SBLMDH-sOQ
zw}c;+cZQ#o_l2L84})KjPlR8R&w|_Y9xjI8P`?I#TfPl$$Lj<<mG=KGJexd5|EOng
zb{s3p6T_>@Gr~X9?`!hF8>=q_x66GSZkJmfZkO8#{+{Odf)|$$faj7Afgg~Mg^!d^
zhfkBwhtHR<gs+lsg8v~u1>Y#Y3Xkzlc%1IS?QsDy21Fjm$C{G}Zuf7eh1=`3b%S@;
z<$eaY=Sds}x92w;2e-!ye*?GYDOv!x+r3qAdtSwT@L^i#arkQa8TdZ=KXALhE84)w
z{ajHsd_NxCzK=}_uUsYUv%yb93;lJtJ#XM!aQk}t4*XlqZv`JB?*O-TehPnA{a|<_
z`FMCw`3!hp`FVI7`4zamZs2{m9rxISBKO~ZE=U5m?;A6~?fbx7aQi;+5PZIl?`imK
zTR(iE`~iH0{DsdW*Kg0~m>j-YeHQo*d0zM)d2#q*c_sL1c^&u_c{BI}c?WnL?N1+g
z68TVgCiz78Yx3Ff;_{_%d%nnZ@H*;uz(0^5f_IRggMTK!0Us%U0-q+&@<rtF?O8p1
zKNs9S?+U@UXwKX4UGi%1gYpLO8}b(LNAgba7pjHp{0yE{J``@ZS6{&&sh<gtp?&xP
z9#8%=yrTR!cy;-oaQpl^0k_Yuf8cgIc?Vus^P_(mc^vcV_BkQEgZfPH)7s~paJzjg
z1h=oVW#H4IhwGRPe^Zyc2yW-q&+v^}&sO*VU9Z33sdXGr!?Vb*zzfMAz=z6T7#z8u
zOXbPocK&36+xe3hZs$*NxSbD`;C4RLf!o*RW^g-CI>7CG7y!3@7z!_~>pL1=PyQ9W
zlYB0GwtO+%j{6$;e>#7*!Y6CaKDa&J{|@|$`p0m)|2E!`$m6?JeG2#)c^3G2c}e&t
zd1d%M`N!}K`n>1}Pb%*TxBFX$!E>ws8g91_v*918p9g=hX1FiQ;M3G^fX|cffiIVz
zf^U*vgYS|@4UIf5N9Bp(SLB)CQ8mJk&j+{r|4YFWtFHkc6EmFC7;ev>{4v~K|GGOo
zljaYCN4*=)9}j;~J{z7)z8s!Sz7bwsm%9s|U;R;dVfo+i9GY_*{<iw)!y=DYHF+X<
z19?VxD|udcFL_D0J^yTV_}A*+htHC?hcA)$g|C&5g8wG}27W-k7=BT{9)4H;2fW^U
z;XWRQ&y}BtuaMt_Z<R+4k324W<q6=Y<Z0kH<gdWv==PxyJdeCA+@9C99{h&RtEO=K
zy3iJGpLadr_IWx8Zs+Z2coALhRJeV<d=GD|emT6Ad;`3r{113<`62j7`TyYG%CEr}
z$sfXhmcK9}^0@ydPX^y7&jkM~M)>i0;iuG>h3A!5f|r%Q3%BFg7;b;R-5UPr#c(}c
z;r4aEKiqzgHUe(Xhdv)(Md$f4xIG{AYPdZg^m@2GAM_S@PR-u|FCjkwpDI5Ix94|0
z2k)f*61=bcI(&ru5j=xFe`Ak~Jb&!-D=FOWU&;heYPSRM3i4|3&*gRDc0XHlcq{cC
z;qB$0!F$Mu!TZP;!>7wv!|i#QH^S}v>YebFnsXTbr~DlJxcoZ&qCCc^$m8;ZJOO;O
zJRSU#TH(iMhgXp2hu4#rgMTHj4qqa#58ohf0{^m3xSkg9L+U%hKUDu2yp?<?{Bq)O
z{<rWt>gT~v>2g=V?e9!B!tMUIo$v>ma~NK~cDSB%@E_#Y;j873;2Y#|M~Cz5_Z{2i
z$>GQ4nc=tOdEha%KSkjw<>lbn<?q4^$Q#2;$y>wA%e%s>$rr=VYoFJ^ugiah+t-B(
zV<PvhhW4R4JdV5}yrjG(yqvrzynwtvJidGc+<t#L8J=AIckp!brSMnem*7+6H{l=3
z|ATjtKY<UB#~K^CpJU~T#zlHp9mmx0rgg(EGu*xp%mcUk2a3X{YJNHRZ27zJALNbU
zxwW3w@EY>2aQpkl{_qCsN5Jjx9w);~>3*&6;Dt12DcrvQ*#x(J*bYyxIeX!@pU2@z
z)n9?fk>7!@(0)FIZ<a?NA9+6PlD_~yB2Ngn=WS00x94ro4zHkf=7HOJRTOTYU*+IK
zl7;Jj7jD0QYz(*K)f!$x>*)%&`&S3R?fKS+!Y63XSMX`_nef^2<?t2qwQ$>?-{E$@
z>p}P$&G{eP?zg`VKdAmO{FFTYgvj&6exH~Meo1|H_<!>JaJzrCB;4*_tpd0EY3svd
z)eG0x0zOASH+6>F{jvSv_I=|x_*SidD%{SKd2qWQekI)QhcEC|<bEd5`b)s=dF{)=
z?f3HU!kcSOW4N6^t>O0dw=4YrZ$II7J2?Vwx2x0PwX~jj@QU)E;T`3_!fpL~;CBD;
zRrq+#xdople+akNYe_gU^0*w*=R->P8qLWHk7^Nqd|r4Wc`<kvc?Ebec}=)I-`V@{
zhU(kEKbCig_mmHW50{UEPnA!BFO<)Puahr>@0PEJ-<R)z$88zz=RtTD`B`{z`Biui
z`2%?MR^j|OlOm7%AbC>wIC)0+xANTZwerI7?ea443-aplo2|q3HG~)XIP{kAl5Iop
z4DT%O3-2!<1|KP(2wx(f4PP%`3cn&>2hZLvT;~pWgASn|f{&4(ga0MJ0Y58$0>3VQ
zadLP$_VZf4j^X>M;XC9n!|n0;1>ki%g>y>5C(5hB*UB5f_sd(t+jb7;cY$A(_lL*m
z680nErQ}oKb>!c}?eW7a;2C;^^EbiYlkbN2kROBF<CHGK_p84Hx5p#J_&U6NJC3*1
zCx*Y+GwjmC?Qs;j;4SpHg2M1#^0M$z@^|60<W1l|$=krI>F=0(z+1{chmVzyh5sb~
z2L4FC5T00nkGmRPLH--OiF_YCXTNZtPr*NvUxts6--pkV$C(n&v*Wu&o(#TTo*BMd
z{u=zOycqnRydpea|EOngwc%;xAHws?+r!_He+q9Z9|E_(H~k8JP=8-I3qI(}aGguw
zQ{`*nE9Ae!_sS2#+YAop{|~-NejR>H{uus19)D^$&yH^z{T@0MJcs;ccr*DM@M8M?
z=-cp`@*42Y@+R<s^0x4=<h|gF<b&bA$-jc1md}RA*6$I2gr}BofR~c*f~VK-6^_B*
zl>Y;-Bfkf4DUUrZ@_6-<Cxd?}&jSBio)5lQ{ucaqc@_9+c>{Ry(c$`9!5hlE!I#Mg
z!8ggr!uQB$z|YBlfXCMTbicrJ$bW|ymLGz*lb?qVlHY=#lt-T)dA#iY#KiF4W5X^3
ze4_kS_!{|}@Wb+o@XPW#@Ho1EsyTduyc7I;c|Z7i`AGN<`BeBx`F!}o@!>xF1m7XQ
z1mF5m*x#nt)4qSB|3-_7%K7wvH#ZO8PXyl~PX|9D&k483g%yJTt-cJrrq)>l-c;Tg
z-cJ58yq~-~-0uGz1Yf9rEc_?=xA3jnxB2it<*VRX>xcWf89qe57hb7B*q?yg^Z#6e
zC;l+(@4=Hd3q971@W1x;tGhf2e6l<vyq=ENt8jb1`=apL38J38Re&ec^{oy+pnYo!
zkEy;D{J8p0;Qz|I!0*X>!#ivKK=^C&@$jbdsqo_Rneb}zdGI%Ne3!yUs9y`8Am0vO
zB;OBTFFy@GB)<&5CjSo}UF(eXZPc?jJAV?$UxH_qXMm?_7=HZA@ORbchqsWw1s@=<
z44*Eq1HUBy5FT6W=?veizBhcCygz)sd@wvppO2&A_W3&%-bd?M1aB{20naU811~7w
z2(K#N3U4X@6MpT3@OT}8_g8-kK1O~XK3D!Pe69Qje4qRt{BQYV_+xp@nUUvb(njI?
z@!&b-iQ)D-g(={*)Te{Dl4pT`A%6uvQ~nx!o%{{>LHV2TYw}X?1dYS%TOR(hybAnH
z`Frqc@_O)(<W1n8%A3Q-$v=iKlXrmsCGQ5mBL5T~w@G+?2f#DQ2g3`>N5bEckB5IC
z{~F$1J_9~NJ_kNcz7W1l{v&+5{3rNH`8xP5`DS>$_rv}99iB<P2VPKq0RE2r82khI
z8F)AO-|*q`EAW}}Tkw_g`|w@zs9E9lv#&??dUdhkv73h7i}1|yB=9%oso*u`8Q^W?
z+2DiZx!{xJ`QVG?h2X!*i^Gr0--bVuSA=KyAnMs$HFyzuEqG0N19%sCQ}_^h3-~wk
zw(u45PVgP_9`MuhzVKMh!s|5{p8UhmC&2Cd<eBgV>KDV;$bW(FkZ*?{kspBHkpB&@
zF24p(FTVrNBYy}lA&)aVyx#VCF-@Kb-c+6(-d3I#-c_C%-bbDT{-rz*e4P9Z_(#pc
zb(esrlUIi4me+-slsAXhk#~X*miLDDkq?1aY96k0EPR^!Z{UmM3*i|xXEnT#d<WcK
zFYPb*8qGff|5JVneo1~F9<zCPy)MIB$nU`I=fRlYMV@cN)hB=tlBb2QkY|I>kiQOJ
zC@%vq_ffcxkKhI6?ci56r!)M4yeB-K=JbVUl79i8CLaYaqMwVW!ar9(4?ar15`H~q
zczu6`k5_*HeqDYNenkE+{Ji`>xZST3drstWxBFF!&5iVb^n3HN@RRa);b-J~;jLPR
zbC1BQ$S=Sf%Hw?>xt@}(!uONH2dU2lA1BWPxBG2M!iTAU4_=^Ec)1PX_ID$#;5NT2
z-0mM30RJy~IDZuUrq(kR{#ZT_9=laIXC*v={8xA;`DyrB&Ho2JRelY=P<{vgtNbDS
zFL|7K;d<@sU9MK)`&r>#<gdc*xEF;tR9_z6T;3GkO5Pf7eK)x6^JMrU&6x?e^JFpH
z=Kl$|*Nr<0w>f{q?R>ipxAQIf{K$Q_^DPnF&bM@MJAZP*?fj_%Khiq9yxMR(ULV3A
zYTw$!<7v(i_!jwCxLvPr;P&~l5dM?qtcKh1-2tDY{x5h^`4M<_`6+m5`FVI_`M>a<
z@*D68@`MW_k8k>q!}n9dZU3{u?epbzxSgNxz+ce(T5#(>fZKi!g6G!X?TmoiI=_aO
z*X7QIcablL_mgjg50&qOw~`-&SCXHB*OdPaZ!CWRPpj)2b7AE18m;~%cpUW^;ECk9
z;kM63;Sbt`m-jZ@?zgNCx6hYG@CjOHYxo>_H~0x%?m+kj`Dpkx`E>X$`CRxSUG8%D
zYWYU^7WpptUine@arxhHyPdfW-<C?pby4K;y{I{f;5X&z;1A_F;ZfR$Lh!iqGVmnw
z8t`=T#_-(okKsk+-QktxgWz@LW8kgj)8Sp@OW@t)o8Ud=yWxH0$KYScFTzL3@4%<Y
zWBd?#9OuYif-je6g|Cw5ga0fq0pB9847c^yh1>d@!)^T?;kN!C;P1B$ujeYb-41Vt
z+wJgPxP2Wt0k^LU_u$oaxzQF!?z8m?;dc908a_>PD#LA^b>a4XRCBmp?w9Zbnm-zD
z^QXaW{(ShKnzIw0xLtVt55R5z&%*6;ufgr>-6Obty-T?ya-W}QJ(=M4^(YVAzV5sU
zx8u?nUamuUc`e{}y*k6~di8@B(*BHq7nOevw|$rkw|&?Mf1^XV&K+>uheL4tx_lmP
zuWxq?Zu=8sY2^N==@7o30B&Cg)4)sV`sRSwDHYCn18(<&m4?sJ*OzMWxtiY)eztu$
zzcu`dygS^!?tc!qulwWR_WFX~!eeQF7Q>UsH^C=q{X5|0<$K``<OkuO$dAJZ$o~i5
zt$nx*U#k8-e1kmBkKw-B&%e9n$>0a%nc@G)UxVL~7lSAKB)q(e@CNeQ@V4>~;r9BY
z?cuZ3e+r)`9|B(`{|dfVJ_~+8z65?xz83zHj?3@x0`i0KO7j1~8_KW4KaoF%kC(?^
z7I}OZ$Wy_8mgk3;(e)|@x5o=tgukY~HoS<uB|L|`6FiIjb9i6*NVu(M3cQ#4@8S0N
z%9Zd7>es_<{vU9ga|E76`*{{_bFRT{PQ2xj$E%O#B!%0YOmMrtdEhp`5&To#j(r5T
zuaBMJ_VuwZ+`jJ`4!7@T=D^$7?JC^*U*Puj>m+=g=KKw}_1}iu`lGLi+-LiGod|AU
zuXDl|>T(Of?dx?Z_$>9+;C8(_!P9gM*Vh|v&wDu-ZujR;fZKU87oJS>e}u=9?}D$A
zAB2~d{}29-{5rg`{4u<}JpRha<MOFI6?~*TJAA4<KYX#gHvFYd;pH`fA64H5epdcD
z{E>Vl{DOQ6{HFYSxE-$*aQpqpA$VD>|1{h#_X@nA`n0Pe_qmrm8@##vb-2Aw>Ra$m
z>TAHilz$0dBtH%>)Hz(=dH4nOH{sXiv44uZUYRu~5!`ME(!uTf(wy)+nqLV1L|z8|
zqAs@vJh{9Tys5k++^+9uaJ#-^;O}V8*KoVObK!P<m&4!IoQ-f>|2_B__0d*G?*9OJ
zLikvDTDV=`SKxMii^2cUoU(AczVE{A=ZhxrI;FyOw}IQw9X;Svb-ACzXUWIHe~^Cz
zx1T!}!q=!j0ngthT<3Xsa{0gTtn&OnM;@0o-NX0m!tMDbn!{^E3;VwCPc?rye4u;^
ze4hL#_!9XR_%iuEcs8x)6nwY(EAT(%58x-{FRY2&AA9|X<aG5};G13wKRz$~g|49&
zhrcAR1h?Op)q$s0-wd8Z-WmRyd?5S{`8aqn`7HR`@@4QU@?YU~<on<s$WOuB%P+(G
z%OAmq$`kw&dA!EU)5E99^T6lGOTd@NtHSMdUK_(Vs&5Ck*MIE;KcapF{G5Cm{9pMZ
z_<i|Wc-(H`zU+i2lOKm?mtThGlRttNl_yvmx&IaA>EU(cdEg(*OTc@{E5irMKY|aF
z_k&NAkATmVPlf*=p9fzhUkQKF{(c6&Ui}{UUil^X5&1p%8F{jGk^6jEo)3OoUIKn!
zULXFVZvR`r)5^QRbISX}OUXyVYs;s=?e`<!!&|6d0q-u~1ph+58$L#U48A>6xQ`d%
z_IxsT;H?sdeT?;y`)}WeCx+YW(WZyn>(S<h+t<gp;Uo3+r7?W0{A2hOd0+Tu`M2<k
z@&)h*@@4S5@?-GPI<GFkf0y5YPt$RUxgl~tlk^DRPXPZ_eH!>ac@FqR`5SP1p1RWT
zC|z!Acxibjc$pkg&))jN?eU4j;je1WWOxzzPw=+#jqvy7yWq{_ci`X4pTO<$hA(c6
zdiG}b_uAt$Q^W0XlrO{W`WArO<1tIY?QxM+;r6)52Jm58e@plz`JeE_y~FEs44%1X
z=ojJkd)^1|?CM|G6uCbYUJTz)4lmp*^epgp@_g{=^0(j%<W=D-wVpcgSLDs$Mdcmf
z736*3_IkiW;ceAVg!hxrhL4jkh0m0)hiBLI-3H&Len0$({0#h}{3`rE`9pYIU2fc8
zBad$ic}jR4c_w&Cc^<g!|C?~z{|fMmno|pI`~Lyl_Wu*O?SF5$?f($?m%7}s@UHT2
z;I{t@;eFMwhTH!C2Dkm+2e<t{2fw5F(KkmPuaoll@RjnH;D5-|!;9&5<7Idjc>#ES
zc^!D6&%*V+5C2_#TlnxkVc!ehNj?yMKyyaJFUhCD?RA3Z!xMcPUhXRRC-Tkk-SWNg
zv+@)0f8>|o59RmZ_WHH4wnQG^eA<U3@XGRx@FwzC;jQFv!W(NnW#F0RHQ>4Ajp1*|
zKZd_8?+&jn{~W$vJ`&zTJ_SBV{ylt*d<A@_d=vaf`5t&WozI8icD|j5Ptrc$gfEjv
z{T6wAH^>vf?L15axAQFr+|IW*;C9}YhVRqmR)gDl)ewGL{c!jY?a%k{Ir61&`~GSj
z+-_%1!_R5XKk)7HyKwt{Eauk8eYWq%Qo#3XP62q{zTw9ghuiB1SAzeLFYN2U?fN!@
z+xLNA!4vii=X?Y2r1dO>50tNlkC*=jkFNQL;8)b2hR>2;fUlKbh98h8+!kIB`@XuZ
zE;l8-h&(;Kk~}NCp?n|Qo-gYd{Hy*^&)zP=*9-{#E_}B934F5V#NQr%oL#T=@|5uH
z@~rSf^1Sd1@?!8?@(S>1T4#Ou59&XFPm{NU&yn|p+t2l%!|nI!6X8R(o^Rmk<O|>f
z<v+n&$~VBX%6G#H%1^*c$}huf${)ek%VYf>d3^1-yb5prW!M#j+s|2V!~fO%>hLDI
z-DnJdPxD*A?R@SGxAVC_++HVjD7-_gaQzeEvE;Mi_IhnA;eQPb=d6R@)%D#BPo@5M
zcoF#?cy0LscsKbmxV^sY8Tc~w|G-OWpKro#f1-9oo)30AkO2Nf^V7g94GKR#2fUH|
z4fr?m((vW-YVgIMhw~f4>wgh?EBFWUuJBLf1K^ppKcnD9<ul=LYMt}p@#U-GN#)z%
zY2|;xv&c`ubISjP=at`szafwLN96G>EKdO+EzbaNCC>%#ATJ8<DX$2(zaOXt@2|co
ze6YMN-1ead-1cD*-1cEK-1gxI_!OOQtKjRjp3U%`^1bk}nsXNZx%?9RFU`3QzbwBC
zPpUbO;P(2*F?L2C_p0jS!aK<`!^`XQB`18f`hsxVhthD{hxg!bYJLOwubST!enQ>?
z{y^Rqo>B9Az~k!kx<A}r_je?Gpyo`6+wIH`@FD8g!M~C3g8wK#0beh_0^cit3_m1K
zxGVCw|0~Y`zbP*ZFF82;_^R;x+P4Pqgz8(uQ_H)+?R9D=!Y8Po0k`=l;I)T@>%0KB
z&+A)oyB&zOJ92+YXih?S1$kO{HF;Hdj-lb)I`Bd2o5AhtQ3v>3^?l&>{pu)qB3<rO
zcyjqXcv|^NcxL$)_$aMs7kse%DBRA^OK>|sAHePWjK3%HxY+rb4t__Mn;pJTUJ!2U
zEC>HteQo#_`A6`B@=ovz@&Rz$hp}+mhnaBOhacg#4@ve$?oaMv;rnUf_Vf5F@IlSP
zzCQf%@X$YmH_-f6@J{ki-~;7d;G^Ze;M3&&;Pd5Qz*otK!}rR^!mr3D!Q<=tPKW1_
z&xY5K&xgM+UjpwWUkUFo{{=oyz6m~Cz74)gz6)-z1Ns;IxcVdT8}f7T_#?vep~9cx
zf9-yN9HYbcYrr3=uLDmqGVB|{bICu1myx%Ew~&7V?<em9pC<1G|4H5t{+Ij<_!aqZ
zxV;YISoq7M!s|N;UQ#|CURORF-a$SeK0>|(K3BdHZm%Qw3;d}1P4N5jZSbTz?#JOX
z<mcd><d@(><k9v;o>%|LOTz1q3A>7Ld;PrHaC_dH58?KA^6la8Y5rLFPWcr0B>DI7
zS@IR|<?>DN_43{D-{mp>irk+@W5f63!;{HV!cXK2`>gPZDMQZ-x5t&2f|u6(itr5b
zYVgeRTJTro4dAcKo5G9AXTS%J3)epno?X5eUP8VCURAyZ{(*cWyt6#^{_yhc_VA<e
z;rj{U_ICwo;P!U~IpFVUPF}cu9WMsA*Tbs-kD)m=;V;SGhi8?yf#;QXhrcBs0v|6Q
z1OHS$4L(@D8GcEA3jRd?5T0T}xc{jRL>`x1@-pyp^6K(v(W0UX#0)<+_`l83+v~A)
zbbXxXc~md-?KS^P*N=(y`~ya#|6Khv*T;LFN6kS$UHvlGN5y{r0l%PMrGC5XUwocN
z{fYjF`jf7I?Dpqx^pDivc6~xO|1tVBUxoh||6usvVE^a4`N`z=`BhkbX4fZn^K+rE
zqrR}~`?>k0(A(?7Rdsz5H@^=0p_<>!^}o3JZP9<DzNhPxx%mUo|D=AD>kGQ$I|=<>
z_20QZg`58a`hV1~as5oU{>|uPObmzZb$u!~{|Nd_>Myvyt~>v)p)aBSk?YgA`LPd$
z@7VcJSA9}>aQ>8b>raQiqxzh#Pv_?6M?Xw`N!KTK>#vCZJN30)pTW&<f_|g=Hm+am
z*53vFarOOOpUKT1ivFJZiLTG*);|Niy$;+W*Jp9_SEA1|Dg4J@UH^ky{~zcps6Xub
zY;OJ;^i9=Yb$vy*{(I<qs*iOz92%StFT42(<#zr|RiD=N+1>nX=+~=%-Sw}y`EQ~>
ztG<HkQ@YRJ8tCIp4u>^%eJ(e@1^UeDJG*|dTmPr%i>V*t`d8ijvFP7b|BdVaar3`N
z-%|Yw*T3fGuS4HQ{SMdfa_7%q=*Ou)?RtG{`|MKwLBCM_UDuy<>yJ7TF3!$}E$S1<
zgYzf9TYn1l$JJ+b{hx0BtLSg5FY5X?-2AuE$NxI~$Lg+s-R)03^qJLv<oZHx{wL_|
z_1=2B{s*`ILFlV~9S$4g`XX-r*XWz8pX>T3Zv9Kp_g25w^>4cQzoGwH{XW;f;MRW(
z{c80WU0>YIzk&Xc`X{c>=hpwi(eQ)q{JE<>xjZ<3-g5IZpnqvf_>Z|=pT^xjyn#Nq
z`qHj1<>psLUrv2p*DrGGZ;JkX_3d2$wwvD#eRuT(UBAuk|8Vr9)K7MOSvP+s`Z?+s
zyZ&dl{-4m>>%DDpeR(&37y1KJ!hbyK`hVU0|DnIC{<`Zcy7~9fzc4lY$2iBr{|4v7
zhi-mixt%|m)u(rTWjFt2^lzyz;QIJ(|BIt<sJ@cxtGM~^q3@>teb?`H>u-gAjQXyw
zujb}|hJK;?VXi;m=8s3eRsFZFui@s;M}J2BD%XGE=5Ij%Nc~RNzvt#3K%aVA_>X5@
zU(n6}7kxqX|GB=Fn;-pn_>P?q)zl}F2j|bf?)auc-%@>c*Vl3LUqjzleKFT}cIz*T
zexmw!U0=`5Z-9P<`j)Og<<{Q;{XX@5T;IUW{{sCL_2XQB)~$ak`nc1>Ve?$y$j$!|
zeOC4BU7y9>K5s)`Lj8W%H*xb%ps%a`lI!cc{kes{qxxtk!lA+W(A3S3C%5xwu=<p)
zkK^WNLjR5WJg)!H%`b$0z4|h)&*0`)L4Q(xeb+a4^FKr%?VIo)+q=GwJH9>8XI1~X
z>sz?_Bhi;sKgIRGyZN)xH&nmW^{w3epV9YLzt#0+-Tv%BKSlj<*MIEhpGUu1{Y}>=
zbn_pgKd3(L$#7_J{<L-TlgRD-xv4&*>xa4hc?Er<8R4*kuK&c%e+zwH_3ya8k6V8&
z^wrgW;Q9`3{>SLMs_*Xlfo}c%&`(i6!u6fp{IAe2RzJ)2_1*l1=zmqe+Vx%B{7vYO
zs^9JU=5GEW^f%R?bA2~A{|fqe--iGA!1cel{f~Jn{C7JaGOK?{9-Kct!sOZiO(VD7
zUUw~rJm@F7_2)z1Q1eT;zE{-qxAN%i_0?*+{-B%R2>lezZ|(X|qn^KYLcdIXU)Miy
z`!g8*4)qgU|5?=Yx9RBZb<P&J{x!G$<>;f$3}<b0eZP>N{omi^w*OhxACw3CU(K!m
z6#8=NFS~v~)bqDH=<W5oVw?_}VE!C8|3$g2XQ1Y%cKx8|<D;^m|4w~g*EezdQw051
z_2pdug_~au{W<jwUH^((e{=LPW`)B#x?X>x^z0vcq0gfJOV?j=^GBmEt$v#8hr0F8
zLI1w`Wv(CK=Kq4ekNWMdAMWP=iGHg3ldiw(_Wy76Yt-L%{YW?eG5Uk*<DUtm;QZ;~
z<|mWe`Eyf!X4j8)^K+q3F+2Rn!mf|$_NNs3qUx)<eyp2c2mMFto4J0Po8K1w81+3}
zKi<tBfPS(1QLdlw=1)SuQ~h_Y|H{q(0sY_V*SNm6o4*--jPJr>dtE=t%|C)Zlllv;
z&m8;t2V6s6Lj5Dx>n@dN9~Ap+__20A)Ki~S9-Kcp-28OtJFCy>`l-*C6O|wRc=aV+
z-#+H^52%QKh5FjApZ+|LYJz^B`ZlhQ=GNZ@{dM*IT|dLkABsNSobVqfy1sR+=N~Ww
zeOC30TtD-99<>sEarM8t{yVonf1t0e{;=zH3O>7(Gw8djzv}w(ZvFSrPf#E0f8nB^
zeLZsPPbjzZXQBGEu0Iv?`3Gb}|Ev1fUH|>_JnBvK$JAGF{nD7vKcEKs+v*#;e*W`3
zss;K)bHjh^?D~r_pMSuo=yR$c;`)Wp^Qf`tE2#g*^>4>~{sG^k|497`*Z=T5k6MR*
zkoq02&lmgo2mFP8mip7KU-CSU`Um}b^><yrIi~x7bK(DQ=fhF;3FN`~^P|gCpuep?
ztLq25`LCi+q?4tn>zBLvZ=<)@i>mJWKivF!=-<)&k6gdf&Hn`b$Lf2#zG<xIA2100
z5cOkR|I_n4>TC21)X#POnpn?2U<vx2>essd=jVCUZ|E<o-{<;Wv7UdxG4!$Kh5vTZ
z^}jsNqi&$jss4%UJG%XU;e7bPcK%dVpIjcCKkMB54CuS4&+Ym_v7Udx8|bH~FYWpb
z&-19t=r^jb>-rvUepB=p)VFi}CO5wudV4*mfv&&r_GdWy^tv&d?E1}a{!H|5s$cB-
zq_LlWz)$Gws^8-J-=61DyU>54{;2Dlxc&Jb`p?y0cl|au|33Pe>f>Apqu_j~;r1u7
z+|Hl%>eIXacQ^lK^e5C8aQz*({^IB#sjuYvKivHH(A(=az3=*~ZvCy$+v_%Ub^R_k
z|1<P;7KHye%=Ne2{PE~}tN+&Zd))l_=%=b*<@)<>e>R|BtA3~J|8(;Ypg*hrtm}Vw
z^Z!L3S6^)ZbNyd#e)PY?ckFz~uRf7HIDbmH{Yizsq5ABuKj7xShW=Ca#ay2;_VW)Y
zi+-B=cU^zzc^=gO{TlTxU4P!~PY3je)%S7z5jXz}^f4EO|2WR|)!qI~MW0vwJl7v{
z^M6ENN&R})7k2Zvp>L*szw1x9`6tkSuKtqiN4WX7(9cyL?P54II3G^A`SIj-{%lj9
z()Dk<{m+EnUY973>-D49vr8$2K90V*E93fP?)<5OKD+w*uK%A~|A*+ys&DW5MsEE*
z&^J^6x$AY4{OnRjq93Gwit9VM`Loe~r+%sHb%>tL{~7&u^;=#4z#ZQ`=r5~3?)rb+
z{+vgjWO4Y9H(fu+&3}l#u==<f8k|4>y7@`ucK$S0pV9R--Tu6SexUk-uD{~uzlDCO
z`gdF(!<|31(4SQQf$Oii`5&W?qaO~syMC=(e?Rnj)sJxf4LAQQ^i|c*a(x0fe<Aud
z>Q}q|mYcr`{V4UjUBAX1-$Uq^sXyoXJ8u3J^heb{aD6Jb|1mFxA8hA?y>8G;^5Fcr
z=jNwDpJ{3Mk2zdl$n8%)^d;1naQ%HZzdZUT>T9|_iCcdo^nKO0cKt&)zZ3ci>ifF>
zW4Hf<(JxRx!S#>b{ORbot6$*yE^dF8qraejqwAxd9s_&(9sOhV2VK9_t^XAI<oaRv
zvg<Ru`S;Pku0EP>MC?2%E>9p2&XX)p|MvwgG!6Po>a)VD$aBK$$@9XS%L~Fg$cw@4
z^?^#m2dl3DA1|*8pCPXaUnH*&UoC$hzD52Ke6PF>{G_}S{I2{nx$VE5CtsqExh(vb
z39h$e75vM5^l8-pg#JZcz)ti9)E`BkR{b^fb<{sb|AzXcm&5<Z&bQ9$Gs}bP8?3*A
z`a<Z(sxOPak^1`R=c;dszNPvO=r^eU41G8CU!p&(eggW>)lWx%NBu(dc3=EP^oeyR
z({A+NYyKhhxzwLWZ};^)Kwn;cTz#>({r_F_Gsx|DeW3nT^!oF;sDkKwt1p9IH%C!b
z(2rN&0KI)JX@-84`i|(6>bCC-^hec?N1sRiH1ziRLkrNCP`?~~{1xHGZ9-p3{SNe*
z)gMM*Tm2dIZ>qnBzPb8XSHsJ<<Mp2Uq;fmHoz$m8-%5Qh^q;9Ofc`V}rO^*nUkAOt
zzEN}Z6V<mvzg+WsqhF|g5c+-U$D-e;ehT`_>gS=~tNusyadfBb2K1-ZZ%3a|{Xz6s
z)t^FNNc|P`57pmAUtN8yYvFOX;~PJE_<lmUoe!<lr$e7ceRlNrI!Oi4=TToA{S3{o
zjQ%b4HPNq8{{i~y>OV$*Kz$GNP1W~De?$E!^qtgCLLYxsxNmdN_gB9deOC2r(T`I9
zC;HOrPobZs{v!HD>hGdou0HB|<mY=g^$F#6K5SN>68&iP+0p-{{x$S-)fY#9TK&7|
zx2k_1{ay84&|g$P0DYnu;q@GbK9;_)O-7$t{Y>=P)h|I`Sp91B_PS78(Z8d95Bm2t
z{{;HR>Mx-0tNu3n&g$dch&;aEsZS-h<2y=y9`vi#7ehZ;eOdH-)xU>+uKI@P|5o1`
z{c`o4(8pRGUY~yGx2hk4KD+vf=#Q(Pfxd+LAJAV?zY2Xl^;^(CRKE*-FZIXJC)3Yn
z=g?19e-nL9^$*dnQ6KMSxKDO`?Xi(b<#v01Sbb*nwKYE%`g`h&ptqlmOQTPrU*c6q
z|C#33LtjvR3-sgEw@3f3`abCGZxOyg-$ng+^y@T#9{L&TSE0AR71)4&o%&tq?ROgo
z(H~ZS4!u1u<rVaI)IUU@O7|Vax)u5P{?eN8{iJd`A9AXH1$}<?h0vE$UlM%{^;OZ=
zQeOvsYxT|1H&fpZ{Q&j7(c68sgV4`ZKNkI9&7XpPwfcGJC#e4s{h#VLpr5UNJNkds
zA4I=g{VDYE^h@b0=<TspchTomAM1AH=lgNZPbjy~_j2mfp}(p=JNoz47eN0+eR1@C
z)K^Atzq_r8eyaKp(7&Sl@;*ktPJIvbrPTLFe?<K#^zW&kg#NMmIq2J}UxPmT+Hl{u
zqaULFPxSAoKZX7~^%v2%P=6QwO7&59B0t{;s!u4l&-d->Q=<P`eRlK*)W3#)mHOi7
zFRCwx{($<L=pU<Zg#McPkI^TL6JF20=#%S@EJmQuss1bUh1AbRUrPNV^o`W7LElLI
z9`v89KY_lt`U~jisK1SVtoq03H>-c~Zsh0t9QB#y_W6EQeO~li)fYh@cYQdwJo<y`
ztE0EqwQ7w1s`?h_t7v`~^s#lPV;}VPdRN2Hr%^v1{SeKci9WCT1?cCiUyZ)J`c3F}
zso#UXsrtj{Z>qn5zPI{o=u>Y9_x~~aiRzQy3;*4YZw2+4<@Wi$Mtvdl?bVk>e^`B0
z^dr<aM1NU*bM#BqcS0X0Zq&24-slgjAA&x+`myNmsGotpi28ZxQ*I0|cNO~T>NlXz
zqkb3qhUyQZe@Fc}^zGGOLI0up2d>W)Eh=iTK3`(~7p~Wi?<n;z!XH%&yHxNP)kDt)
zk0;LuUr{COi^JE-E5Zk8PAzzQt+Oe-hkQEx8~FlxaNY*{kXS$0Z$ST}`kk)Vk66#H
zzzOtg)&CFvtNfCi^Ymi>|Ls5YF*b$&6!U)g-{839av$)5^PEq8vHGOWgTA~jA*J)6
zx7W>jSsv`e)BlNjMSVVaKKWailUSEq$$4<O!_`-H?$=q*dC>o<zL9gk&NgyeXFc^@
z;Z5ZOF(<v&InsG>xv7FH{q$|D^Wbt<s-NaO=$okj*12Ej61lB&a5z5dXZUFOHq6PT
z%iZTZxZK&g+=I@8%Y7wLIOvS?p#MkxdFOtex8=6ZpR}GQ@D1_=55oV)ZXXJ1ovED%
zmzyto*rj*wFE^+2pdX?>kMp2kt@%Zr2mLSVOE?euHR>zN?Rq7C`ftHoJ@jSOH+LS)
zzpnYMocr~6aUS%Qbz{)OxnKVv=Rw~`{b1*Q{S)N2{-#?0EcW^YSnNEQ|D)zFa~{lJ
ztLwYodC<q#{SUu75Bd%2cRLSydo1Wa=Rt3;Q+CpM(A#rMopm1cn>GKc+^+A2r~ekb
zJ#>9ACx(9Ri+ULTyPb#jdVY!IHm9HFq=V0p=Y-qk7J%<jUs`UL8`UCQM^)#+I*VwX
z?>hJU)7W{?+jH}M;N0&|JGosi`~2$V`e4pMUG8VjgE_W8BQWRM(|-%zzJ@2(`9BwK
zm%9{RO8t7d?N1i%&kpCoI$zY!U%Q?A{W<D9=s!|_(z)NCOLE(v8CuUh*9UVJXwF0D
zet+UW3ire2*zaXh!TV``cDP+`UicFACFHh0iL^hJoCoVXrFB+y?)Rs@^Pn%P@823b
z_xsaYZr3ZZZXde2KA6*2b9y=V`!fV{_UL+j1-~Yr1-Hvx1ka@PtdZOP6x04}bsns9
zxz@SEx!<3I&VxRIeqK20-0#l?x$RFst>>2OgE=)d=bm%FKXD#Mo<F5DCmFn{JTu%b
zH#dB=`l52%pBmbqa?XQw4%Rv=IrsZh+j-ERR$t$F(A(?we&jsp-_*|+t)2V*>?*hY
zyr%UJaD6bRpXPkw-0$ZE%vqv2GvRyWi{W;;tKm`ldbd?>``J+YxzBm9&K36amvg_L
zXPpOq!g%3%aKU-dAJ`Q7P3J-1QvF@$em`S8i9D~GYW<1j!TN(ai!>*hbHATiF(;Ge
z<b#)zmw?;lR)BX<Ut4bb`LXu%1Lwgy&uE<=Irsb7(Rt7piyvP9uFix0xc0NZ^PnHE
z{&VMkKgY=J{M@7UPj`JV=ZNOabnf?aDdvpUoOSRe@*Qxy-2L!V>d(q;KYMCFuR0Ib
zndn8GSI+%@K5-uOt<=Yediu`OH=F-I?PntALBCObQs;g@Gs<m0?e{gWx;~f_CqcN*
ze9rxTmc*PWeLqtLo=ILGZkO8(UPFCHxn1Ak+Rr}DgLM|yI{Q2K`#HjS&`(f5#(B`&
z>qAd-9`sk#f9u@u=OVf7=Mt^|XV(XF-bfhk=Q`(pKX+nI2hBMGA1%KCx68c_-=O}9
z-1c*-_A`F4@TYHq2kUIDbtZD|_cN{Ypx>lEqw}D@tMfCr^Po?wpMUc@_xo8)9{lI&
z|3qbq{cL$r6<r_9`9O23IQRS65OYpxA6mhqG`}m{F1Ih-9(z1OZu_}V`#ITpu+Fcv
z&S}p5e$I0q^jFm{avt<gw4bY;2YtoF;r^_3?)P)MJowMk|A`u{>wCcU!JLtrbHusd
z&x@E-Lv!xHJIG@M8}sxn_-B8)3E(r-r<L1&u50n^!=rLI57zms)|uP6-_OF%gFf9$
z;hbX5gFf!Bp;vGo^j+1z<J|9OUAbMaD1Cq1-1WhnHJa1Px!=$3n6p9qFbIB1J_c@=
zI|ZIt>zOAH{u5m8Ztdp^=fOI!X`QQ`2ff`tu*G@MS4tA@+ji$cpG5n)-+9o_RDalc
z(A)h9=j67Z9kl)%t`Fw?tvPp`2XpM_<ybMEzVr0W=H%0yB=8#YjBvZ$obZ0?3(JFx
z4=(q<_Op!hV4dlchWk^&dC=Q_)^r~9-PG509`uu&g>#xY5BlBeTRIPV+t1E&+lNzH
ze?Qj;bCM?u=MQoo%(49(hdDDeX9j$Od=cC(cNP4a`Ym$X&$una_3U*Xth2J#x!<|p
z&(qF>ewO-k&V#;Q^Kkxk=RyBa{cY!dKcmHb8a;ip{j8y%zY@xW^#^m_P9Dxr;@t0N
zX3R;fIj_O<$&115a?8Q(_lY&-wx3zFpYJ;l*4bU_Z07vg_0|5gcOLY6)OU6s^!EAQ
z*Ll$AOcCzGK<9oxN6BqJH|Y9Kb$u|Wz2?kt?)P&s=JeB?U*I$3+u?S(``~-jpO)Kx
z7T11Wb{?#Aw$^#wd9Y6Ve1GIT=pU(%7VGIdPv2~Q8r^;-a31t^Qil8al5@YG>E*Vc
z`SkN|F4qThrfSY>&i#Itz?^H^hsyB8nqL=gm-_*{l=}8^yS_cNpS_(2>)fk#_H`bt
zGmG|TnDd~|l`7nyQO^DTOp)9E%+PwicYQFYgXS!B?)PU6<}}ruZE(AvWIx<4_auCY
z=3JKB{#0)jUa$Y02kZP!>wM%qSZ5CHPu$o~-+B5L%nAC(>JvEk`;%I3`;%Bd@4xK&
zU{2Z8;d*j8_xn>6bN1+Zm4{!G*M!^UHil=?dfLcse+FrPx;qcn*;DK6?c87AFEPKL
z=8t!MFlW8yOmgn8?_A6&r8&#tP30TmcDXy?qtzdl+w~o%>wC_5u+Cdr=SAoK`rgL;
zYnmTD&eIQe=gFIC!s8p;xxc>2<#wJd(VQ&sJ@UM8yWFDiDBW*UL2lRgTV3Cp&V%dQ
zUhAyuJXq%deIMJ*dC+fD-_p6?pU!f-UQM;0ey$JZBupFb&miZ1f5u@>Ce4`vFC||D
zx654x@1TB*-1cX!_Ghp2V4Y>O&i&4Vbw1YZ?P=#hKUMuX=YD^#%WZ%5Xg!ZzAIv$U
zIniHu`p(lgTc>?L`I6k`jMkhC@FnuxaJ$@s@Kfr`$nA2sYk#Uc57wD7U3eU8IuEYz
ztGfMs-+9n?P~XhC-=Fq!yI!Sq|J$do59X}YoPN%OIkrEeFegfLrouDH=fUlAm%(eO
z-zc~JxuE^o={#8HC9QL>^I)B?Yk!VA5Bjp{!~Hz%-0#n2x$Vyqt>?b$gE>Pr=dp9Y
zKMCSKjh?>QoDQ0k20mJz18$f5I(&orl5*Rho2|p^^^Wsko$IyE>dtdMb^H3;(0S0O
z$`H<Z-+9p6&ueYucD*v`{>C1z59Tz{oKKwxbL{*XhB>Eny(Yn<H2*ueUG8FdKJ{zm
zwm*eF4zJgC=fOJ1X`MTr=X~lz)gN{q^#7_q?mXyie=f>xe@1IPcU&LL$)7P?&wb~?
z9NV9`@t(f(^v&kf(3}+T4)UyUyWBkR8S0D4ZGTF(4cAk_d9J5RXsLC+<2+cWoj-M*
z2mJ>14V?$Q?N3X&U9TwJAKS(C!JOEc!u9lU?)T?Q%-NvpH6DIS{w>@tcL6-H*0Wk}
z`_ozbv&DI?r|T@Hb#8Yath2n%pZ(5*e!Tj_&i($JliU7u(0XpTKA3YvbM83z`x7hv
z)9C4&&B>=ZN#Hf)8R2%hIpO`(7na-p^w<8BaUQHQQRZjMh^pY+?@vwVLElP!UFUv(
zn#t{Yozi+bxIUQkgXVN`?)PUP=FHHX(eMrOX>hyTx$tZ1SIBLDMrwaHIuF))R_om2
zJXoiFf4J9q&==1V?&p5zet%BOZGUR${`o7e59SQeoEy&l{zQB6Y4r5X<|Njfgz$Xw
zv~auJ?C_@Q3&?GMmS}%UIuF*lO6x4+JXmL+X5l_mcOLYKvxZ*Nx!<4n<#xR`XgzIR
zAIzzvIUSt){ppK2{WNDde1?27+%9((e2@C2a@(Kv+Ml(~gLMwmIyX8G)@gr_x6^sh
z|4;p1=YD^V%WZ%1>Gv1^xIUPZD_gkFSDgF(`9Heu2ENC#?F0C*n3`HOH8ooD{vOh>
zm_lBb_jf|b>tYxd%CL~6Vcx}PWz{fIMqWl@m`upZWQCeS;~p(k&viI|$8#V1eLna9
z^W4wP_x?G~<2=smy8i#M^f%SX$G+|@<NadqrS$_)|50*X_et__<m<w9K36fHrpBeu
z0qC>2ap_avzuFs@d>Zl{jobP3g=_zb=x4aeOPzmEC(^i`&lIXN5OwB|$HEtr>$+>m
zQ<2{Q*ZEX_&7IeF<I-n?%FcHgmp=9L&mrTIpNITW<90sZ!*xCZ_&WC&lb1T*qRwx|
z?R@^CI$79P$@{%u?7g&pKKx;FUAH`W2>PiB*ZK5`a&vgrxb#`7iu0z%rBA(nUNkQG
zfylQvZs*ezuKmZNpCKkMbv{C!;l}NJCQ+Sm)QKY>2wy<1>#ih^NB(2D&SwGU^SN>9
z^9=gjZrsl2YvYn{Sk=w*ka0VoQ*fP+{(0ZeCNFg+qs}kJ?R;)fomA|r_ygWA_Fh^)
z3;qDPu3L`W2Y;?t6|VC+iTN}zE`4r7pU)bXKK1kA3&thySIy1mMdNlpUE$jQK=d=v
z<fTpr)EQ#j&SyN;2|=A$@^JXO<ht%s@+jm#gzJ3HV?LXWOP@2*=jX=leD)fbd=Bzo
z8@Ka04%hi)p`Ra3Ug}h=?&kcnaXX)DR3{#F{vl6=--mw?fY&Wco{RibaGlRJ%%`q#
z>9Z&LY+zjaZ2Fb!zqxVAry~D?aXX)maP2c3e?HsK<fYC{)EQ{p&SwnO@j;!b<RS34
z$#vaD<eiXT3)lJ78|(JF!MOBUvxf7{#--1j_;bKr#w8zz{9faBK1bm?pH%eogUL&s
z!>IG4aXX(YR3{2`Zjr~sOFifn^<KR0gXHPRKLOYI9Kn2Q8kau*MW1zzOP}YFZ)#lf
zy=uC7HaBkP(;lvUhTzYmdzrk{S&cgVjNAE)qB^<QR}8ri>c2&<>%K=`5Bc}uI-knp
z+`c|GE`6RrpBs!zpUrW9Z8t9YTD4rAUB>Nv4#9Ok@#yC}lb1T<Q0E8Zc0QM=PAAm4
zNgf3+@sL;4d-1wu$P<x&9Io@}iTPADE`6>?pEZq3pVNl8IXr7z@;<elH#IK#7ckEk
zjZ3~a^6iaFz76s{jZ6MB<og<z{Qv*{5?trtgXciB$xEF=)QK@Jb@cb&W>cMX%q@XD
z7rvHU*Zq_{0R3!->-?8u{$CrHK5N%;^E_l+`qcTKGA{X9$bWC#&hw&i$)7|1l5soF
z8*rUx6#6fYzerH}mpYZ}x;{%9xAQCu*E;o3ry_YLcwKT`w=sDv@-M=5p1Uy5uEwR$
zKIpTjaXZh!#wEW6`C-QGe8$6dU%BWf*5swmU#Jsj+|Fka)k#F1MDld_26A0@8+ktR
zU&D1ir!b%6#--0X_1rn0GA@0V_WmQUpNva>Hu4vZOTIJi-)qJtpNsqr<C5=&e6c|9
zC*Di1tHw{?{i)AA#wD-!`-5<ue<ysuN(Gabb*G_DMdMOO@As#vP5|mOBd-T<Pp<2B
zCm)FXV7Sgda=hEu7~|6CR`faExb#`t`;WY)8JB#S`p#z>m%PsZJ>!xeiu@wulGpjK
zF)sN%$bVp5@;z~0n~Y07sDbNei*d>8dF_Ggd8K1MnI<oF`lC*kajB!{b&l%9qRwUV
zMEGCix^9WGUQzF*{bV8kAY9Mu51dzd<I?9M^!cQ5>9e#e>r>mf<S!%tv~fG1=iu5;
zJ$!#rJCm0>^&7f5cQ9_}^D@=R$G%3A2cZ5Wa$R>ic{uX#!F4_*qFp~LjZ2@y(B~TC
z(&wz=F8`@<$)_W~$+(@*mvEg=BKpZNd8t$K8CO5kxSh`#sxuIE^2lT1H^_C}f5}sk
zFY}1kg!j_<gkwJCj7y(Q(Pw$%(r54IT>sULOFjYl+Q#jC8pCxy0r-BZ)+R4?en6de
z#_fE1Q=KgAYbbd>d_1|X`v!Rk`gsSg^XY;4EHy5DKG4X`VWn~DvoD@M>y1l(IP#ww
zxAWNs*ZIVupZz8;bvB|-hH*Qe(^RJ=>Rccn0>4JC>)s|$K)&>&UK8F+=Q9rTDQjH%
zJdZxh8J9la=<DWI*|_Axo^@W`xa0@KIDf{t<QF5~*tq2N^JgpLlD~?4TjP?~=YMy&
z&c6Wr9c1!Sr(vk;XQ*+hqtE{dRA(#d%pgAre~(<(T~6+c?@wC~*ZEh7as6yDE`5$b
zpWBQ}pM!9Heq~(p`;b3qT=GMaKVe+*k2iMfo;Gghc^<Cw9D@GyO<wA}f;t7p?L151
zFDlVGl~5;uT)(ffJh`r0l{^}Co`LH;yI`Kr8J9knpwAY@rO#pbedd>_em3g&rMzAz
zBPpMN{3P<N@Hld<KcD;p@~hywuNdqr*|_ZMkH+pCQ;f^LqHykM#wFjTiOcUaE_wYv
z?F{3RUyFREamnj_mkrnRZHezQylC=L=U3FZWL)a#JPWCgFY4S=&I@@jtzQZL5V@`!
zOx_Lo8gQNG9?Y|map^O-shdv|<90r+jZ1z4^6iY<`SgHm|69?|V3U_RU!u-1<90q1
zsZKQN%p^~M$CK;2E6DdFpA6UeoWgvz8kauv(Px@*=~J(_{l+EVHq6a4!?@%p;rcvj
zT=MIX&o(akxyWBIF8SNY=NXs0Ue5)_CEpF7e+rFDektnvKIZ+zd&wLmzX5qa<C53w
zKM=0xTkUbT-zQC8>ih?FDjSzNdi^(~I(ayk7UX`Y-+^4$?L{7n{7|@_?|Gc>IOEc1
zwPvpWiN@_bXBe0KbmV6lxAR#D*ZC|%KWj{0>KsI!4~*OSd`5M8q0S!i7<eYRuKOK%
zGV&MTI-df}C*QdAc?W$K7`OBBdE5(mFTH-cH+S>&H7@zJxZVPcOZ|<=2O5`r3i2Vw
zC0{Ds)vsh+@_K#NgX{eL@O`b%nY`3_33XZ+mpXcVcA`2NnA^+bdGL|sx^6Ui5c-(`
z*ZKRu?)Ej`xb!&#eJ(UEed_n6tTrzBGsv$qF8OVk=SJg_Z`i`E`<Zb&&)smHXAJs3
zV)9aFGU^;NZs++U)d@wN-^qKy3(0le;=$fx-b?$LgM0v7=h<P3+gGr0>2nkM3^6W!
z>hrUfamo8V@9NYuZs!vQ*M9QQPg|3hIvr5wCF6EJ{ised>Wm=IfKMdXbz{j3k)IFO
z`3%K;Rv4E)XQI#5#_fDQF)sNW<To0(^VtE{`SdF9=6TTMrB1~coF6f6=ko*A2|}G;
z$wT1<<ht%Z<inBoFYh(sy>vd4F`ppg(q~Wf8Eo9nr<!rery^g=xSdZZT<4R4ep;El
z)VYZ|ZH?Rc^rAX*Q0G<hWcWC8U3V&ZHu7`fI-mD2pC!hn&zddWIj%5n=kt+q$;To8
ziE%rhFW@?#&<d{pS0*oY4x`RN<90sZQJq5U>pZ!B-+n&1u6v8T4f^q`;5FgBbUq(o
zK7q!i&wtTpka0VoO2#GMtCibtHRE<Z4dFVUWc1U*<fYDP)M;hh&ZisI8IC%ykk5gS
zCf9Xi$kULY1=sncVLl6uOP?pu=Mv-6=T3Z1SZ7@FwOYIRd}Q3t=QFs@CkWqHzsKaI
z&N$Th%DA1+w^Sz^`#MKn2)|6O>)s@<hJJjX@S5;mI-d@2x_t$Z>*t(cxbABX>Qpy*
z+1GmPtG02wuQ00926ft!4~O?4*L4SyFGGGbT=z8$`<iTA`piL}ZyJ|Azx>M0VXkq>
zKl7sV`Nk!`2l*AoB|jhe)y5^S^ZW#^^DIRF+e}{SoJ5^3joW!1raEb;bDBIGet}%q
zy-MyE;`Vz7uJc@odHRKT&3P|z>9cejm-ja=eICMmf{aUk5c0vs?R=`ibw0yGT>WQE
zUg{*HPGjSCK5eK@HPq=&-UdF1T-S{xk3oJiT<4R9`OGpdeV#?1bB#-%$1tBI#wFjV
zt=sPk<90qD!F4{_=x2+`OP#5xv(31j&jG5l40TSBr@?c{b=}{{^N=ru>wNyke0-nu
zn)6<I{cJ{`e#Y&71L3;gHc#ID<vvfEyzKW+)TwOT?zbV;@k5;!<kjFE$aURb<h_s|
z3fKJxOmlsXGcJABYUg~Sap^O7hVvQ5CI1%kvy4k#pC=39#XR%=&nN9kS7(jMOPwRA
z^MP@xqhE)9Ms;FPXAk)@cqX~7`yF`(@)zJbpBFKoeB;umPkYyYf$_Wh9pe1%zr@%3
zp<X||k@u}AzxcoJYdW6*crovPmPECRcVj-~O<vYrgE~(dxAUn-b@HBcb)F;lL;ZH-
zx^6e}P~-=}i+jDuy8SVq(Z;3Eljw7tamk;;^W;tAlCK@%`kY~0@;aaSaGlRG^t00B
zrOtTNSz}!4==HOa>hwaLFUe!z8RWX|x8%vl=faD7Ys$LSW8J>;j7y)%=<~91$?Lzz
zs?fOPi@oIP+%bN4KDgfep7KK8tGM@HlJA4Ozj4W5(DysI&NJXCSHBA7b#Bj4J`?+W
zp8PVrBe~Y^O&*MOhry+P>GRE4*Uxz4vac=J*CgYT{~i09X<YLD9bBE+#_!H;pYug<
zox@c0lW6i%rwi&N8J9XbpDk1;40Y1U`@xTr>$<1O=OKR)uJd^p^SNeR`kakEZy2}p
zDOSk~c`vP__g5LX&LI!$K4$V#KNs~Y7`Jn%O?6UGrwMrm{6%tIw=?-2<OjgD{|_*S
zQO2duvK{Yk(`Srvd+t-He!ogCKgZ;yPG8iSXWZ_0CDjQ=on-Pb_~+!h?jG_;<d4F2
zzp2>o_r|5qc=UPJxZUq1s-KDaH%(sZe1|%>jNAQ|uIz=pmtH6HQ0Ecy6!=r*x^8Xq
z9ORqAb-#PC-xrNbpZ9gT+lEhj<95G2seV{xmmgyCQl~TO3^#7~JBjMtL7#Et!KlB0
zT-RMm9)bMFaNX}Q?Duoy(&sGnx!t(*ssBEduZ>Io9P)>ZOJ2W!;FNL6hjw=J`QEtX
z_dV$RqH)PDK>m_($?Nmv23)U`6zsQn6))tyWWQ49H0qQzE_L*|S{AN#B2lLzx&HHm
zb;)(z#^gIu=S8^A|9tG-_I$b;mp=WwIPYm(`qcRkHZJ*BksoGU@;d+V#wEWS`ANnl
zuk)X2T=I{0b^XjXF8PA5oG&si`6%R<8khVX<UcSj`9sLBH!gWS-z{)Gm*6UH-E@<e
zIuCSnzTddi(eph)b#ibnx#V}?SIBkUKgnyMpL?o$i+L|S-@@3tKlORgxb)c)eU>#Y
zed_r>X<YK}BVXCL<n?@?HZJ*_$UkFT@_N24j7z>_ch_et<C53;cZTcy=V8D7O<w9O
zMx8;%rH;;jEY*oXoj1uN;qQ>^x{JwIA^!nf=YQ{Xx35nr?^D(JcFJp?8I<3N`lrZq
z;6IaV{mbP3SoaoO`<#J3OIGuS<-NpZo`*5ddyUIH_3PqCj7$Eh9&TTc8Mo(H1+M29
ziGCWGywn+iI?o!n=h&L+)Iy!E<Pq?J<ht%i@~Ozjz;!;SXSjXE8J9j+qt7|UrBD6y
z*#zT~{}cIT#wD+R{+MK3@|}9Rb(4+Td2WU4Jaf?hUXzzPOHk))<941Wsm?0Y`H6fd
z{3^MwTS$Hx`I54j_tJUB&35~G$hh=*1bseYTz;tYsc2mCm3p~4RgB9I^|?_WuJehg
z=JL%=Uh0fQofnMD5A}ZRLUsI6X8?IEcqF;5JCVE}@^NsT&nnC(-njI+27M+NmmlsQ
z;`WtjT=Ip;CmFw+$Jc|YaGg&Y`q^djQYXB(tH0N{{7~nUMRlg4&ROzh@ZZRF-2(DV
z<cmua-b?4RVXo`ve&h1P3Fz}7<5IHJewVLcTz>cs@)eCsUay}zaGg)B>aI>xlb0U`
z_Ho|axYW`4bf7wyv9G@5{-{5kT-O~(9)^4@T<5cIj_YThart3e^cipb?tXFotTHY?
zT!(z3aXX(BxXx!8`q^&s^26UyXP0q1pG>OL4|TpLkAeR}uIuKLry&0iT<3Ef_t(8O
zz2>}^xI~`l>*jX9ap|)xuAj$@OFjnq3dZexYQS|q{xw|vXH8z}>_(lY#_fFCQJqZe
zt0(zo_z-ekcQko0`k4yX`HaH#Gsn2}`5*K-&$yk>GUJku=;!vk%DA0RGF;~~75#i}
z@=|9Z>TEY|=aWHo!cgZFc|Z8i<ht%<@_ESLg6n+hPj~w&S<7qAd+GIa5PjZj-0t@g
zxbF8d>OW=jvfnZ<yZTj)+x<48Iw`300(mC96S=P2hx`um!{NH$_SkQ<aq07U^ciFP
z?tbw+i8C(wmB`OAZs(H#*ZK6T>E^K3<fYC}sPmz5JD;soCm411l83>+A=h=Y$s>{f
z1+MeS!ToaGxb*o*f7ky_<90s9YkMK@rPt3G<Vza2^LYra^T|X%Pnf){`#I`7W!%oE
zKGm6rI?c&b;1T4yZV&Pt<cGj@KDRNSDC5%SZ|F1HxSda|aml|hz|AwxxSdZtT;~&p
zfA0Q$lb1Sgqt066c0Q?8=MMI@i#!<h50mS<C&?p_{~50HdF*YsuiuPIpS#iLRpZiU
zIlLd;GA{W?2f8}{7?*qq^7q#9e&W4!KB?#@2(JC;=a#CJk3_y9`8;?Fa;@K<d?)g~
z;kxd?>8}4*jLW{F20DM$xa{je{C?e7s$Z$L%TJ@c?rT2fbJ5RAa{YT4lF7CHXXN#;
zZaQ4|RTbx(X<YVo2>Z%1F8k8Y^Et*PU-1>UuUzAjuZ;7(Y+UkFkk2=Mw?01q-+}A(
z5Rd*#*Y$p}_mcjl&R*0hV_fR!JcHp{rxWT_Cy#<RBG+}p$rF+90M~gQnCs@y$GG%)
z6MgnKE`93f|B=Qe-*J$uGupVF&t$mn%cqXZ&o+6fvlw;WF>dFxg6gDWU+c+p;akad
z-QDB?=qD4d^Z5z$$u=&19!8%z#_fFaj7$Eh!EV2ojobMY!gW4T=;xk#-Y@oEdi{(*
zozlkbe1hOwrylB5Chr8VPp<2Rk;fw64zBZgY`WW5596}m)#$U2@w@xQ=b53#CI2V#
zBaPenOoZ#ca?sCAlb1TpQGd2^JD(*~ClPf%Am0g3CD(O#kmn<x0oVBq#`Ef=ap^M}
zeP$cC^SNML@<)-+GcNhs``!Etj7z@CtIi9JOa6J}eV_Jz;=Q!buJ8ckQfC_K1R9q*
z`uzqW#wDMPd?n*|_l4(VJ-D7@uez?!=S*JeR2b^Kg>k8)&&f_yCkS<3CJ%*=B-eGL
z$%i991OET>!E<1~ap|)w`dnyS`s|N+t~M@t{rB9hGj8Xz5w7#eKtEraywtglb@v#z
z^ZADA%t4(q<jL?na$Wa2c{cJs^}Qy%m(Hgt=HqW%`m8$4onwIUyZasDJlMG8W04Or
zZs$`AuJZ}4=jt>zd8u;%b)GYB=MzD73bC)=<Uy!Elw8-1B5#BIn{b`ac+6+6aq06m
z`kZfE`W%GoXN7UecN^~ZyV|(qM<M@-amjB$exq?a&mC}`XEORfX!26$Kd5uWxSi(@
zRA)Hq{7OCtUO=wv{zIOIynh3)3Gb!zoQZh`!nOb4r`>!iQeK}MPg6b{^_!6w!rPN;
z{qE$|u<l^E_PGRojxjFttTw{+Io`O;^9`KiG~<$=j{HpHlE3Eb>bz%M@;@NI$hbZC
zHE^BV9Q2=J@=_;cq^qB5+@AX$s?!E_GRcR-zbDsq&yz1h{u*58S@Ip%&)>$S&+h26
zSVQk8-b?fP`_E<Iy5B<7f6U~i&Pvp&VBGGvHq}W(ohIbj@E6H--Ol8G_<M~8z_tH!
z*zYLg(q|U>9AjMioQ3OWigC$TALZsY&A7cD-hu0UhNGWlCNFiypw24ec0Qj{ooc9)
zM&1VgHMy>Pj64SUvv8eHIOcQ7xb&HXKCc*;KHtN9{xUB4zmfmjxa5~3U-}vEC%CR8
z-y_n^vy5@cuSLF`amjB&zPxeCZ^Uz^x^c<-z2@rIHZFO+o*TpUymBy~)+R4?I-pKF
z<5EYThrOxJD%2TDz7sy4T-SYr{4(<I!1cV!zw7q3)VTCH6Me2UE`92Gtv4?D9OOSW
zZs)TNuJeg#;MU!5@=~YbXy+Nm?R-vC9e>ohKwb-eja=8gP2Lar(v7?(yqC_W3FcGQ
zxb)c*eU>wB_gfjR``wB9^-W&typKAKjNARTqB>JirwjQi_yBTUcLaGR@{{1Y-yYcS
zG|Ja&=+5O`%IkHzit?9H|6_80)cJy3>!*{4A^#0r`y7Toe=sid{1)^4(fHkS8RGi?
z&A8-ij&Xj~xIM>Pa6QLW=%>`P-Y@oE(vQ>`i#qoix99j6T<i2hovP$h;SI@k-Dcz|
z$Vb3+K9ez@K9tWyeh7Ikd>qx8jXIMl-x7a6*c{61^{|xkKFBALhrl<JYyB_DJ0X7v
zuKQhqK95s=EAr<kuYF#nd=&Dx$>ZUEq3+!E9JT&K<mt$Vz_rgV_`16m<uj3QLitVD
zS8L;Py?uo1t(|eX-t_xPdQtt$s6U9@r;)q<qo~edtUJ}Xta};j#u}G(_51ec8JB#k
zC|5t;xV^tt!F8Sk(a*;wFLmBQoejqA{k4<ogrLqL@^JWf<hpJyc@*+j;d+igVLrEv
zOP}fJ^B?1OKKC~ELf%X2NWR=yH=p~B+xa{O*ZE|jpQ<J=bq1hLP2+YxO{h*h>byvv
z3hzd)>-HzlMLrU)^9hT0`<hI7AN>7qapZyUg;b|6>Z~>{`%S=p*BQ5S+er1JQU6Pm
zmpVV7&K~1-Zr@OyhNyFfyc;}^T-Uu$9*4Y76R!#HrE|N8{rVf1J|7t8<{4nz?l%~&
z*U1IcuWs^E=MB`UZQSlRjOrwzPFwQ*@E+v4?m+Sa<VVAGza<yAeN8qleSU^M-!v|L
zZo=pJxyB`b-*{JNzH!N?A-}@7<cA=?+PIzPCvcr-w@_Dqo5@R^Pf+Je<942hsZJp3
zoF>=5&+r1du6vby2<qH{>pZJso_<Ze=De4<^mz__`Wv_V4T9@__oIGglb1R#MY}mv
zH*WVEN_FB;rxke;ybHOm+mHMt@+0B8-)FJkiN>YR8R&Deaq07^1lRv8<B~sv{9NOb
zKU2}=ml&6P!wJq;7`OBM2(I&N*x2Q_n7q`Pj5^zl+j$<KIt7@+3GzVH&n4G&e<N>+
zd?8%t`5NZw8|F3Vz4ZFogg*U@+j#~Wmwow7bo&i5Zs%Faxa40!zM646&xUZFXA=5v
zVe(REJ?gYFZs*yJ>I^}hSIFbwqsevM81k*i&w}eb<1o*K#--03^tr^i^!W?^ye5h2
zpG5tQ<azL&R3{7XBN@hJ-HMakxnvrbb@g*&wsFZ%K|aU0J(oPVo{Rpyls8OX>g+|G
zzl_^+@q5k-c`vQw*TnT%mb@CgBDt<xi@X=|P2hSigYY@LwQ=e5Ci-k=T>9LH_mLjP
zB_9^!`s`y|@&$p;hrxAUvFK+4<<H?dnQmO_k3s#nj7$9k=x2d($!8$H*tq1kzvcQ_
zYh3bAzV7@(<C53k*V+u%{&Ug)Zj+Zf!%%0RajBzUXC0?HiKz1<c{==ea$WZZc|P(b
znt6+PFFoJCFwgspOP{OI=L5#2&->jk_jw$y`|Z}$&8Ir$bzh;B4?w;Zc|CX+a;@Kw
zd?4~8;kvIW3td0sjLW`mU|$oB+kMTT`ukBop7Oe{HI$D<K7~9HzMWj_e?^{!{BgMM
zYbo}1*0}7e!(_MLpN!jmT`?~C^~hf{E_uD4|Ay=N)(dm>?``gdyqEMNb*`Y!{l=w^
z&Zj(F>*Ql!HOK={|5<Wfw*`4P@*UwipD!_=zQ(1`ic?(w1B^?b&3ic?WnA)8kRM~*
z&Swf-_mzl#=9s+H*^4^!jNAFFq&fppCz(7J{yDj>yN5g#`J-^1&-a+m_r|5qo9Oeb
zaXX(&#wFizs+-#t<90rO!F4_X&$)cbaPJp;FTH*iqt3m??R?6?wN4iHRfRks-hf=!
zeU3Z?{j`Vce6C<VJ&ntL52Me%#_fED8JGN1Z@B%AGH&NH39kE!ML%&SFLg$s&K%=*
zK1-=iIO-&k4}@<f*LA-nk4OFxT<242k=xfP<I?A9^!dGU>GK5Me=i!B{GZ5QGA{X_
zkiTJE@}1sv>;7fj&hwrYUdVgtJoC~2LvX#`mY~if#_c>SQ=L@QsZX8-Z%(f3wk7vz
z=KAjm*Lg0+JO>+>{T@M|!;IVgj;HzqQ9st?rA}k~eKm2$?S2<goe<PXBoBvgAlG%b
zkw+o_HC*?bjQt)rE`5$hpQnu5{r*Jtvrzx4$xEFa)VXfl?zh<UUdUW0@u+h@c`E#I
za$UDFc`ot|;KjXVWZl>C`MEje3y^P1u7BThPpY#=uM^|4-v?vwZpUYsaap%Mp6BC@
zOMWEslZ;C~ANSo%<C6ah`Ps%Lub&eZ!Haq3{hv?2=B}Salb1TBr#nwFE_L*C!WOC%
zj5_J$Veq5my6$Q6NaQcVi+gLzx<@e2E5@bIX474t*NjVE|Ggf6!*#z|sDIxJUdVfC
zecjh%aLvy{zAAYNydk;PZ$_Sjd<0zAJ%@euGA{dCihcDnF8lfu=RVxH<nxh_G%oqP
zA#Oe~#wFi&hV!Y$C4Zxp^Et*PzYh6%#wGu5Z<k+YT=KV(Uu9hKx6yyHamja^>FT5y
zm%LuLX>dK4uyB|E+T^9q3e-7dT<YlgW>cLzIG2m$!Ki<oT-Uur9)bM5ExpCOm!5A5
zeqZhp<I?9b^!b=^>C@-yyT9D0igC$Ti*sJXxa99gzL9asPe;CqaXZh}aGhsLxU1jQ
z<fYC*)ahy5&T}Z$iA0_8<n!RM<ht%$@}0;pgX=txV4g|FrO!L)GugP^?^dcG+`{d5
zugOcDk@)?DuZ`RNo}@ZC=<_G?JMgRIx^AKI;;xmu|G#7_uL<v^`;FUo_oqG&k!S36
z{sg&xpI%M!M!qf|O0M5u-I_cL^}CX5{Q=}!KaxBfbzUdG0)LA<AHIP6FZgP>UbnSc
zxP7HiJ^^z}GcM=52IsrexSVe=?xPIjl5dQE4ldKU<h$VaVRGQwPh1Pv&lQuGIu&L)
zzezq4UZS-Z@?Kmg5H8n))Y*Z2dGeC8UHvNmqfP_L_dxyy$|tvQb-GbL5&4(NOJY7l
z$xk33P4#0@e>(Xp_<ZvH@Rj5_@MQ7}@XyJ8pLhG(M;-z{Mji_Pp1c$MSGeA%Tk!kR
z|1mD-H4XFm)3{temAwDRtHg`$2YSBQ$d@uMd3_&z7_QezD*6dA`McK}{&|o}#-)zF
z4>q7WQK%D69uI$sT-WVMo{s#haGlRS%xA1|>9Z^PoM7C}XS#98ry&29aXX&{aGg)c
z3vSM<O<w9;N1b)X?R+*<om}i|H@Oe$A0gLub4~p!-n#4X9R9_)tosz6KbOh(!1Ik)
z_3}?Y>h@J&T<ZLUd?8%tP!E0H)5Z&VFFlvy2V9*;$xFklk(YtjC4UGWMqU}-mAoN*
z0C{_OH2IPY*XJALk;u;^pALVUd^!9*^3ULl$xp#olK%l;OYVQr^|_wBDtrU^3-B%E
zFT=N!PlfLxUkv}6d?Wk_`2qNG@^kRh<agj_$sfVFoF}gbzeL^+{s;L8_zm(I@H^xK
zF#i&5i(b#4A|FV;4<15(-ywHi)yPjG--P@&yfyh*co*`U@WJHQ;Ume<!^e^bq0a^6
z!AD&G%gGxdzm2@`u*>fuZ-x93@^<jk<Z<xx<i%0{5Arhb+vJbJOSLO{j&tBa<YTaI
z2zf_%74iY_r^)l-O~@C*!^uB^w<g~Kk0AdB-i16D{xW%K>~}c%ICvC!dH6)~+VH95
zZQwJ=d&1|F{{mk^z6idKJPW>&{0DeC`Iqnv^5yW8<m=!U$-jVKCQpU`hujbM%fIBc
z;g7X1dL8}_e~Mi1mwM!SUpz<N5_Q^<AA<KJ{{j9g`DgIa<Q?Ht$a}-zC0`5QM4kXo
zBOeUkO+E#FjNB*FJ!dYGmxbRXuLbvyC_4X^@QUO~@EYWL{WKzf75V4M<KP|06X1Qx
zC&LGm>vMh#`2^&rlW&J7kne$SB_DOv&2uNY?l*%x7j;gOUxw$B>vedUT(85w$OodI
zVlNdvuhQ@`<oClXkavJrCJ%$xCVv>-n7lr`9eGuFXYva0SIL9m<H=*;i^$i)w~}9i
z?<7x!XOJI+pCms9&n3@>UnV~bFC;$?zo$dd^V$h7L$23zIr1-%Z$VxFZ%1C@8+YCI
zC9edZLf#s_fP5r8g*+MlIr%&AugG`8e<gqLnCtTo@?*%~AioH|O@13*ykpThKY{u|
z<j=xulDCD|Bku$6ME)lHHS#&|$>fRfdE`6cDdaiugXD$qU&$ZOa`W`-RCEsY;bq95
zgI6c-4DU#u4(~}m3_h5A3w#XucK8(Xo$xv2>*4X_dOxlr*ZV!0d<p7oC!Yh~PyPn{
z7<nW-hddhoEBQ+JzvM^Zk9012UN_*?$b*i%^KD691>S=^96pwOC_Ik*1biO(boesz
zci>6n@$gh~{kmo^c^dME$QQ$pkuQUvB3}bPL!J!(i98jaM}8fCll=Z~-TWW#QuMqU
z!t0ZFfj5K8?+eNA0qHA(^5c>3W%4iIqiG+Xp_E^N{Alt7_+)bZ{5+dH8TmzU>C@Nr
zxr*|KkWV)Gv!>6@l>ZI+T_#`B)IUJ^dr!DMe{1r2rv4eq*FZkc<o!(jYn1PZ{68lD
zw5eaJtNX?J`*qRC2f}4O_nP|UDZdo?8YbV&)Nerf9mt29yuYd6mhw5s_b~b8rv3oR
z|ATy_$=`44PoR9rNjLu)Cf^jlhbsTeJCuJO`DG>_VCt`>d_Uwjn*4Or|2E1`M1H@?
zKV<43rTjwVe=zx)rvLMl--vv^$p@PHe^EXQ`I6mSNUn!xP5%$T_4>Jve6YzsV(M3>
zeA!cO{`F1%Ra3ty<wKEw(c~+7^#fcPpYD|3i2TdsFTh8TzXYE^-V;8Zd@y`I`C|AI
z^4H+&$j8Aql23*2Ab$&ffc#zfpXB@CzTN+Oj(*<Erj~YtD+kweJdb=8$}d8`F6Di{
zb9KTf{|WM)DPIZs0hCWiKAQ4vk)J{NGsrKcd?fN8QoaEB9h9Gsd<NzH?{)h+PWe>i
z&r!Y-@&%MXjC}DPMd#lT`A6Y8|6h==O!?Nx*P*=MY0RJU{gH1)`I^XgHu(}>i4feY
zqbVPbd^CA$_)PNl@VCha!`~yH0$)u29(*PFNAR`eyW#7}Pr)~kUxIHT{~NxYyiB&6
z^B(dL_}AnO;77=xhaV^J1V2sw3j8ejB=~vqci@-E*TVlG{~UgU{1E&$`H%2oJ>3PP
z*X<Q}De_|9ySY6`UKSoiUK9QVc}sW=@?P+I<RjsY$fv?vlh1=kkS~RIAy0z$BHse<
zPre&Ig!~wMBzZP`Ecx&7*UA5aPbV+=gPZ@`<iYTG@*40Z<SpPIkiQ21lw7}F-bUUL
z`LD?J&vA~Czl?k?`F!|g@-%n>x%T7JtLSx`fV@As_8COJ68TExYvGN^e}y+A*M8cO
z>$*M2Gf`&{xz24g`Dx^1$;+K_*TWog?I(d;Ker^3--|jM$o0?JcaZD84w65EIw#5X
z_hWw}Z;AX(@~-fI$+gaXy^Ef^{(fc<`AF2ML_Q8)A1<GVrJ{cSLpbG|<+wSwH(ta0
z1y$!d?`XWb=Yi*(_c1Q{Chs`!Z(Q>F`|~4=OFj<y*NjVE_Zwqe@`sV1YFzRa(a&u1
z>hO2rI)@>xU7ssVzNS|v+_BF(<Ff8f%psNPRBGvdK|1BHBmWKMbCCa$@@28F%ak9E
zKJQT8XP#U4o<3f4-b>!sq|f!J^DtcZI~?El5<(sYuT7o^Z$h2~e~~-|-i>@e{1x&H
z_-OJh_!ROy_#E;;%yTh$5PThZ2z(QHKlo1aSok6GIQVzu^Wf*nli~T~De%9^x5Dr3
z>&{otF$?}E`2~0-a-UZ2I(eEr0N#we9=ttyLwGOpF!-zF-QeTMd%>rX4}{MnkAW{I
zPk?_!z6`#FJQ1Ewo(4Zkz7zff`F{AX<T>yH@&b6VenrnQ5cl={<U#Pq$wT1P$V1`J
zkcYvaCvOSwNZt?Lk6fRVBgmtXpGY19pGh7Ik0)ORf1f-N{t0<9d>i?G_<r(S_;K<J
z@E^%9!+$6DebL=Vh2(zldtNSjz5(zD$os)7!u7db8PD@tl#fNeiOI|RU3a`+w=yoz
z|Gucx*0|*L^GrA6l7HY`x36Bt?fdUw<C5=={4nE^*Z22v#wDMK{6yoD*Z1q`<obR+
z8?Mj2oo!v83GA3plBpx>CSeYrQQoJGtFw>t2a(UBd>Hb%l>ZI+tCUYipZ`$)JItX}
zf3G?3rRQEBUKXzV-Ky6K`A&FU@&b4mc_F+lxz3>nc_{Wfn7k!CihLma4f3h*x#Y3%
zrQ~zqN#u#}&E!e&-Q+3oBjo$x+2kkT7s(6Y*U1av|C0OQ-2Df*^VM?<f|nx?hF2l4
z1aCmz4IWM&4S$I|2HuA}7Cwx889bVN6?{5*5_~?n-lr?cGm%dw&w_tWo(<neUI0Hv
zUI@=2_i5+u_e<o#@SEfV;UxwZJ;x#N0P;w9dGa`T4e~kgXUXH?Ey<JN9mu!B`@!}1
zwIcDpFwD3-4{zf+Gs?JqUzliI@)hR0xlJ}M`8xP|>TS4Q=ljvmBJxc5TB<VxeWn<f
zbz5NFRO7bKFO5rnF7kVf+ddB)m;4FjzcDU({l3cYjZ3~<yqm*W<C52}PxFjRJ`VZI
z#wD-scejnp*PBtUyibW&yq|b4eP8JEp8FpjG%opc$3EqZ%eukHS2ZqqA6M3=u5roF
zLH;@8lCOt+E8~*ijeJ*lG0!BrzrAZ{Fy#x7A4~ZH<fl_!|31mN<gZ|!%c#yBTvs2G
z`=b75<h|f~$os)F$%nwdCr^j}LY@i#5BX)d&mcG0VwjsxgqvF#a$opk<o@ug<kjE}
z$!oz|kT-;PAnye4OCAd!P96uJKt2yXgFFfT9(gi+6?rQBWAY667V<3kUU+eD&T`)^
z$8#prxLnWcab0B@m%M&XK4V<+hmk*LT=M!nyb9Oz%|$<j<azLtgS}tuy^4GPC3SY7
z&xef5x>vC7BgSo?6^%<iV1c`?su;I@HiB!Ph3F@o+~*}%rvueFg+6;5mvtLp-ItBq
zK8G8Z{Cmhp8n=B;GA{Ywk)L8*^3CvmG|RZ;pI+qppKDz5`rKY@T=JWcUv6CT`rJ-3
zF8PWHu70v{$-jhtwiuUug~cwv&A8-yAb-HPJcsc%;q#4gsnc+wtCM3~^6}n(<aNQg
z<VPZZ-MHk_k-ueJ@`=d%4RHavJ|&;;e(DooT=L%`UjeSyRX_*VPaVqpW6oie4@dqb
z$`3=n2l+hs5aZHkNO8CBYsRI|);O;z#wFhg`8eZ}pNjlK<C2d>ex-5Ae}??W#wDMM
z{Ab1`pND+9amnW*f5^DxyW#pdZCvsJCER{<jZ1zm@>h*ZJ{<W!jZ6L}^7p*z{lt6e
zxkn*?zj4XeTH@9XHZJuOk*{oA^69AG0It_bekWI_CFKX9eizC&?CkP`DgPGoV<{hw
z=h&O%ZQ$>aC&8DIC&ND^PlbO*?vLwv4|xzglROmuJ$VHD7xLlo|By$*eTKSo)Hz4P
z%aCWmA0s~ruS%W+Z%7{6(Va^R@;2}e<lW$X$@{^FlV`yvke`IlAkTrnM;?ajZ54S-
z_{ZcC@Gr=R!@nYrglCaQ!_Sh(!+#^c0RNLb5AHjx==th>^dNaP+%FZ#Yr$)h>-`l<
z9*KM_@@RM$@&xz*@@4Qy@<jOS<Z19(<U8Su$oIn&$#dYJkmteE;QD#&8b0UjH!jby
zWISgwjLZADer`NzT=GYd&o(Z3{oI%b*ZZ^({ah#a>EiA$pW)sw_FmfOqi3D_8<%yj
zV%-4aw$EVWl7Dcis}o|}_E`_EeFmVPCgefzHdLn``s`+0)@_J&dl|QV4lyqIH;^B0
z-1Zr5T=EByk1;NJ{dzynxa9qpyE)7;E_wajm|$G;laOC#T=M$4G1<7hKW5?makFu$
z(`uPpcaL$&hxj_rFfREAkpIrO<Od>u&bZ{KAb-WU<l~XQX<YJ~k@p?p{lt6y|G9T{
z{gj2vbtw5?k$;Nv;m9|nd|k}#Ir47s_Ee`0uB%?;o#3yMC&9;&C&Q<ar^4rv`=kHm
z<U#O{$V1^<$RptC<elJ0$$P<nAdiOsN*)6*AdiI?8(H)mSHbTm&xAito&~Q)o(+G7
zJRkl%c>%m5`5kya^1yEHdK*d}43CEE^ROMBGqJ{Ncw1kA>nhH8b<g#=9dBInyO2*X
zE_r=!C&Bf;sD*wuk~f6!q&lO~XNK__Uj1CGn`zwknQdJ1(JS11a*Rt}pI3RtC4Ut8
z%f=<Ie|}eJT=Ms<boK8Tm%KjT{6={{@m@NA{qwsA;5whE?ygQSc_ijj+tiVDJEG5~
zl#fQ82+CJOpWVqnL7l-|2kS<W$HU(sPl3-RPlYcfPlG3sXTdj<pM>uw&w(EyFMwy0
z2Vy=K$%Ek6$wT1(l83_mBi;GxIflW@k++0bA@2uoKpqJXCy#}{M7|2%hddEJj64}0
zO`Z;)PQD*LpF9)3j6A4^yPiLS>-9ei_w`2Oay`F<>+>_?av$mUG43`l`6bBjGcNhQ
z`2C`9j7$C+^4}V__w|p)C0~7&>;GrtlGo?PRdT(rZ@~3>=+@KKDgK)Gi@n$XJLdB+
zTt6pdqR%HO-wSo>Q+@{eY)U==-j?e0!@51lW8j0y6W~$g%iwR2C&K5Fr@@z!?}R6j
z?}u+D&w=kIFN7Z<zXQ)E_r*Lfk_W@DlZU|nC9ekeA6@i(!{Oz~^?Im6J_Pv&<dN{_
z;CdfTIpeOYcH}eRJ;?RC9Za5z`~>ok;j!e);qQ>ofiEQg0=|Y^`}~w#`%EL>jXLS%
zN8y>|-@?Bq&x2nizY4!jUI71>T>p9S`^LC)*K^VOkCJQsN^pG+EW`QMr+gxwlg*6F
zb7?*9>*tNjb4fp^bucdZYVW)2q>FL;9P4jf@(IWfGH#!fqm4`c9P;CgOI|<!ylGtW
zJ=VB>W*C?JD|l|tC)eldVz|z&UoTf@9eEb!xy96xbxWYny_6q_I^R<Mxz(=z8S=5H
zbBXHQL7iKaAA~w3qP!-&mp<oL!2{sBFRk+=<#Uj)LH-El*_i5t^>+QYqx|d0_oDm|
z<VR3`AM)eKSHY)Iok-M)r~G}1uAk-Pb>QpBFQWcts-KPX-A!HqKSCaWbIB$TgkK~N
zhF>Rd2>+Kn6z)IPov)r_IJ_KrFL)L5NO%MCIq-1udGMFW6X1QwQ{cnMQ{mC%Y4GXf
zS@8Mfm*FeP193ehllOvuPCgaBk30*0jQk`#hdc*<iM$Ygll%_6#JHm8=-bC#w*llK
z@W;sO!K=abec`LKu1-Va@?7eS>p#@EJP-AG-qN__FCyQ@xa9SHvzu|rH(Tr0?PXl@
z`t|G(<C33<{BYxv*XMaOxjvt#!1el%?CaK@Lp~hyS#Ijcy6M>0ddf$kP8#KxqtCtM
zkHe2~9ju!}J`aA0JQ;qIJOy52yw|k%(*16Q2aspN%adopYmjHdpC!+Sw<Hh1d^(c{
z!uyj4!$*-fgvXGF!rvkfhc6`W1z$rx9G*fx6~3K(8T<hGD)<TVBzP|QPWTn_boedu
z47hJ}(en-LclWq`9)jzAeFpb+1><r(@5Xgl(YU>@>ll}OsdcV?edChXzYnmPamjy!
z{PV^oug`%F#wB0%16RL`amnj*pucg+4?up9amnj*U^KZt2PVMvzQ}#qtviFf4d%JX
z)RA=uV_$12KM(oOC_fANbjqJZ{y617M*bY-FQCtS%Fn<Y{v!8<mzv-;?Y(rr;aE42
zT=)AVc`WjE$m8Hm$#o8G$oC`PojeCVh`bO!hCC2+m`WZ5f15l6zJxp!{sDOyJe9m9
zd>45?_+j#?@YCe6@C)Q~;Md3#;s1~)!S9<`^n6p`LFD`4mC1A9^~v+$&B+Vk5#)E^
zy~%_6yZdV>c`$rDc_nx(c{qG7c@%sZT%UWtpLOdd8JGKaJ?@KS<MQ0l&of(%OFkd@
zG~<%j=iYwflHZo(*3B?3d42AkG%opo4_!Xnxa9S@cfq*i+aRB3T=M$dD<IeB-fg%(
z2SNwBb^RuJzu0@JCt;rD;QIAo1ol;x@_ERIQhp5bttnq`fLpgG<rgCVD&@lly8J}S
zkHQ?LkzYZbcd5=Q^tpmu_q(1v2l=h!x$wQ@I)`t_L$Kd7<e~69@^0`O<WcbAF-6ZS
z8vX$JRCq9X0=zo;GI%5MMEDEjY4A?u+3=UibKoP%FTf{}-+{-G``~(5K<)=$O&$XO
zl)NE4jl2!~Yw`&Ax8&X6=g6brm&v2yf00jxmwdhG`7VP8kY~Uv!1cNJH=cVnjLUN)
z9`{Qf<MQ0l=Ux-zlD~|6GvksUea`3ZtDSMlZ~4f12ji00=UyM<lJ{Tl^8JlVUY~m-
zjZ3~K@}rGQUY~oD$@RH69j?!};e*_|^U3{QalXdXk#*Z(UmGYNf&6aDk3v3^@;S(#
zrTl#4f2VvT`n*H=cQJ>1CVS0!FMU2=LY;@<x?dlx8$z!8txX<|d=v7P@E6H-4&BJ(
zkbi}I9(*);0(=U2Dtr$4R`_D_o$z(!+3-!|7vMX|eK7w+<iYUo$V1@g$*aNh$;07)
zledK5JEhp&^VM^VfImt;1YU_e2L3epRCqJ;ICy*VM0hXqB>1c3De!UR8SrW3K7;RW
z(`O!eCHQjkYVeQ9>%q5>N5Ip`JHd~V_k#aG9u5DMJRV*^o&Ya4wdgsng5OWR75+GR
z8oU~LI{X>(Y<P3>3-FiV`hHRNM>qf8#^t&98J;sQ8<*#;{(VFvj7$DD@~;_}yuQD@
zZd~&3C%bjuFm9jcZ<FiuJRYw1MYUI5o%hKDhB)77>d3l1vF=XF_d@<C<tHP5hVp*M
z=aK8WH^?K9FaCztg!j_^JHa0y*M5S@6OgY?z7^hxd?)+`@*H?4@?7}K<ofU597*nj
z`A;JEg~yTm!xxZOg0Cj81^<-1Av}$|6Z~uPZt!o(`@zqV$G|U>C&K?CPlA_xv*`Jz
zz#k^x4-X;FfY&C^f;S=0gSRBlhj)SN{jPs+e1GF|U*zFBA7otaNB#TCMjMxWg^%6+
zHO{!b-`_MY`EJP1FfMt0p3FBc`MJn1G%k7ld(T!Im;7s=xPI0dm%M&H+-O|#`N)4}
zT=M$;Jp15!pZW}S^-q|*)M<k{IpiVmOaG(JEy~}<eoIXAih3{oTz3Ng5M2A|gnpi)
z{86m?wDFo=$#h@We-q=<|HGd;e}TLayfa+at%Y^_lSjcvk;lVh$P?gik*|U;B;N{O
zL!JgtAy0>IC(nj|1=stcRF0cN7P)>OMGm=MCzq)HWz_$Z@^$b&`>%1Ce{amWMC^ah
z-Cl<ekWa+dUymD?I=`XL6UL>Eemzywxa8ZVxc$~OE_wZWttt5otouA%uZOS^u1-ht
zkYUaTnmV%XI`lc3@^g@%M)|Lif0y#X!(IK=lwX8>rBFT)^|zA;!w--TfuA6chv$-~
zz^{;Jz;BUf!b?r}hT^?+o+sgf<d@-3lIO$gkQc(6k_TXJZOALZyOW2*2a)%Kk0Boj
zpGrO){x*3md<l6R`~&iN@Ko|7_%8Bv_+j$>@YCd(@C)P@;Md6W;Qx^4!|$6>^nCqr
zzXXv7!7G#3g4ZY4`>r{8OXS;<N5Ol-i+gR!{T`0z(qQ9qpQhnH8fIMb`gwl5amimr
zev)y?>)#_f)41d-ZE*MRY~zyGzh88bamg1Tztp(o_5J+=<C34W(bZpXT=M$d-Uct`
znfHG_v6xSW$xEGMSob*jdian3qs||cpMiWKc^`PGnbO67p92}_CkS5L`=6zsZrE29
z<MRHVkN5Yw#wEW3`B3s*@YZmhLo(LwN`3)8klc6V-L`#RBlm+(CJ%tmCa(rhAg={q
zOWqK^kvsyPMm`XJ050>C>!B~M|8I=T+;TCWZ;jjQ=SOmVU;fRw)ET?U&F89dsiW`9
zw~R~vW90uaE_r=lzCX_UiTBd;O2EFJfa`Tq9d&9`J`ee3l#f6@g7VR$T>mdqJ~Y+&
zQ1WxA6HRsQpw3&Ae;IY=lNX1tqB?WX|HtI<@Gr<S;a`#G!n4Tp;b+PH(f@Dc)!=`U
z*Mj@LRrI_X!XG4$fL9>z1g}Zn3m!@y1#d+j3-3a{3O;~55gtjN41b+G9X^YEKYS5+
zCOnb+0(=8`A$$k9U!=PZ50VGKkCTVN&%yOMFaghj-;K-tI0M(=AI9Z=)c3*L#wDMI
z{J+K}ukVBR&GLTYz4Si4iu?n{C12*S+t=g9rGBN&&Yv(YdHwshYZ{k)sn1-#u5roh
z`({()lAnuwbK{cN_sx!Qef~sXo&!x@>imp8N09G;Py8QsW>bDK^6})a!PiioRp=*`
z^24yN-Nxm8GvppOpM%Dw{|(4zk!QhwgzFq)u<q~VJK=@oIq-XCdy9E5t&<CXh&&Je
z1i8;^uK!x(zVOE6{_xi1mEfJoL*f15dcVAf`(>zcncIIbpOMDx^)r!N-#2F%mpbdW
zxP8qsE_L*MbD{CO>mt9zxa9SHa~-+<e)7j~oqx+QZrv})qcDeqrjD!|hINlqJ`MSw
zOkVn#hp(fr{f~U{IbO(n>GNR#>OTnAJ};wwMas`Wz8>XcM!S8r;QUtS?Z~UcyBU}J
zB^LKfKjU^^k;Wz83Hb@e@18H}$H8@9l`#Lsls}97YVrtp3e_2c`D`bTgdZSJhMyq6
z0M8{afL|dGz?^T9*MgUN+nulOw;nu@JQV&Uc_(-s@^0{^<o)1n$fM!i$>ZRI$kX9t
z$oIpil4ru-Ccgk*LY@czfIJ_bO74g2WEXh|{4jYv_-S&z-!G6yAb*v7D*O&ypNGkK
z9{SBKdjA&x+}&UP#;bb~eg6$2UySF&6L7swIz_oU)hPcF@^vX+YplzMQeK~XEh#?-
z`x@~-Jf1ue`S;25;GdBDq5o~<{_y?ef$-zxwctOJ*Mt8~9ttlc*LmLaPSN|ZAMy{8
z$H1Q;p9-%<9tUqsz6#!&JQ3cNJQ+TaJRSZTc`kf1`33lF^2_i9a$j6OYsvlK8_5IU
zUy@gYXOK69pCWGw|Cu}j{s;LG_#N`$@Y3^&o^KTV5%M|k5b{;<I&i(;ci?_+V!Vd8
zR4DHEX2#`y{~Y&eJL8fcjeG~=lGlI!w2yJgCn4Y8xa7B^{z&7JFZ+di4vaP~`LB_m
zY+UjKkbl#-<n?pcT;r1e1o`>KC9lu76~-msVw>w{wQ<QGM?aq!m;7erHyW4xDdcw;
zmwZ;5tH0a0<n?plVRC&Q9*67m_VPGa=ST7jxE}s6b!6Rn=<{#N=cCU3?|LEcrJw5_
z+3xB;O8y`8Um5=Y{b1et<RPfvoV+1Cf;=7Gn>-Ibl>81n3a;1xL-_Nu*U9zY-}DxF
zL*y5b>(`a5;kw_3<K28xD1QL=-B#l=|E8E{nsGUI{W^WWamg=5KEt@=^*%ajT=MmH
zxPG#YOJ47z3&tgX8TmZplGppFz_{dp{?gSiG%opzxXyj&dq44Bdi~t9)8+k)Oa3bI
zfySkNHROYgOa2D(m5fV%8}ikROJ480P`IAgaGY0Llb1S&Fo&*`4~};I52XAq%wdRe
zS@$&h97}bwQRhvQmvzUY{~5-m&K=a5Z(Q;T$S*W5`Qo{*&oyw}Z>1RLDJCy<%I<ZZ
zYTWj}i|WKqbos+3FLj>V<NO=rw*McDOMW2oKN`3F|6#nQmruplWrfD2PS<p|Zn5{g
zpLj35-pZ%n{i)Br<SFn+jZ6J})DJN(^$XEwb@D8DBjZvhq@-K7xpArUDe`T|XTp2J
z^}Om$a&?AN{%!O>(YUPJ3F}TXF6$mceh&F{_)@s8I}rCp61m<lo5>TA-%XwdKSF*I
zo=u(&zet`7zfN8V|Cjs@+&|viy!X<5`QpASN3QpE74lT%8<3~L!^!o&eu><7!reA}
z`jGp>hmqHVN0WEMeK(!FAACOfRQO8r1b8xe3jA~O{qTL{S@2`z1@Ij5AY9Lv$Rpr4
z$%n&BEGT-8k?;WWXn1+@dGH$K@$hHKm%&?-r@}jvXTtlFXTe92XTxL23*m2(-+?bA
z_r>#k4f+2+=gC_lzn#1d`~Z0;_zCji@Lcjp_!aVK_$~5zaNmVR&o=@75L`dM{e;g^
z6)2yCd`<EccqsXPcq{S@co*_4_yF=ecqDlt{B?5Q*WGhq7P&us5qTgykvtf_fxIDn
z2YD#`AbB|aBzZ6RkK{w(m*ILYS8y%`#^rsd$zHeLLgVuOuAiTM7rArS_v<L+{ftZA
zFW1!xG%oc&LO#g2<O7kfM6O>q)r9N&Lil7?Ka@NM`)x%Y3-3a{3O;~52_8wF0e_u5
z6F!UlBzzHhK0J}U0KS3z4txiB5aw`@JOqA{yc+x`a-HW@@;1nqNbnBHd&#+1@&2>J
z&&|KIaXH7JT;~svZ-qZ>ysDS~wYtkcYFz64iu~hnJ@;<tryAw`esXo1kUs!#PyR5x
z3waQH0C`RLMDix^8RVVei^+S!KOtXt-u1tQJO=sg<nO}wkbemOntV6>2>DO&<K(yD
zr^$nUc72{DZva0}-VuI@d<6Ut@;UGu<ZI!#$#=kuEiQJqF@3&$3ok|fJG>0JALjos
zc|~|R@-X-l<UQb($tS>TlFx_NCm)6RHzwbPd~fo%FS>Jih5S3@Un4&Qf1SMS1y|=S
z@<s3k<g4NDlPAMJCNGCRcaZxazmGf@eP)p7!%vV;N1Yt<r{F)6H-+bsw})RP9{?{P
z9}EANd<Fd8B}K2#5}3n7<QtI>BHs<KK>j_v5_ulH9{D7!8%kaY-je(kcqj5v@ImAe
z@R8&-;1kIkz-N=c2%k^h0=}4hIXsp8OZai}Z{gpOpM{?#{{#LPd5K@#{c`WpqUT!{
z{sehdcop*6@CM}1z?+i~f=7@KhxaG%3m-w=9v)5J1U`j)G<*)Z_L)GgeXfP``}iix
z`~T|Zxx=`8ZalQt`EKL#IUxo4L&hbazR%^48kf8e^4a92;6K8(&jNhj_?>(p{I;nh
z>#o4MzRP5>|Ng$#IQWBbt*><|Qa%Ftn&g$>4gW`-7L@;Y@7*?hI#WIt{r4wNhL0jo
zfya<<g}+6f313K_1z$s+4NoD@hkrrtGsW#|KV0AUE8!fE7?*P?#N3V<m+RpGuIC?&
zOTNWduKth4CBGc`D{wu>VDxi~yb`?Ba_<*=FU{A22a-30KS>@2uS4Dv-jqB7-iEvz
zygPY6_#pBj@G<0(@Tug{@VCjQ!k3W8!9O6M2TvtWfbSw-1wTxl1V2rF0e*oz4}Oh2
zAN~)y-&A*<+_$3W`TE0y$OGY($!o#u!u5Kdi0iE>`8)8|<a&K}q57ey|EkH$b)LK5
z^*@^Yk*}RkA|C*cB`<Nn<=-Z+0$&2x>wgvc`GC9=d<)fCjCFUCAAujHIs;MXG<h`q
zC-P+YAEv(C?_qeJ+%hh6Ym0sTW86MZO0RU+gPfz}ry*a)xa9S7QIK)Te~x^xamnlZ
zS5@PZ?|abAzov1?>-ErxT;K1);Ce2;Z@4;b$ulvZ-lmSMTN&#PBEN$Eqo__c>byao
z2cJzIfPNO6`m(RiIG04@($AadC&{?v^*O(pT<@b@<jKFdIUFL_Iw#4s&N*^D-`~jf
zTyBu-`TDH#n)Y7$9MJPBL;eT)EK8mVuS0$Y-UP1aUJG+>L-`Syb64Xs=YyDYPvdsZ
zgN#f5sSG#Ip~fYza~o@1@{!0-FfREo&`+#!$!8!RXI%37^~HO}C12@~>t~ViyZxj7
zYU7e0gZw(<l0T082IG=%n(69qHZFNR-<{-ozWd;ME-k0II>*R|;JnV6I<oFj^qEIq
z0^jF<jXVK<i~KOW)cex(e?PYbz3KW1B-ef_!S%V<7<Fos_k)K~omlKEg7Usc+`8S#
zo51^%AAt`eFNSl8hU=VDu&?Rl+Rp;26NUOK$QQvsraDpB*B9h-;9rp^!L!Iy;AhD*
z;lGh*!T%)BhWoBAdcOJa2gwWI70B<vYmx_Io}uI+@K)qu@Gj)x@B!p);F09r;IETM
z!)KAlz!#Cn!V}5o!8ed^h3_EGf*&M52|r1m1OJIU4}O*056_3&<o<BKHAT-i5MGu%
z1YVIm9A1~a4Lppz6TB^XB)kWC6nrpw3_OZF0X~^L1wIF^@0)Mq`Mk)uJSWHEIk43D
z-RD2vAJ-Yb`&>o-Bjb|S_pi;yCI84#_q_Vtxa9TyE8V!{$05Jpxa9Ty>zHxLe}nu9
z<9GYVet$GB`EuX5ettGCd42!7VqEeUvt0g~amnlZ*Bx?w|0<p+q5r;LOr3uBr#=sm
zU%+`i0oV77N$9g0`3CsY<jsz``c25A;V;7VIlnB{<-3t<KSQX_d93>yc}ditN_Bit
ze;(yGBEOjY0(>?31k8Uu`KR!$aNU<5=De3&`#DZ^9z&fU$e)8>qB{9Fubbq4*l&ro
zMbEtwJb=6wygYdXyastE__O4_;4R6c;GM~%;r+>{!bg!Oz+=c)!QUcJf-fXbg|8vc
zf~Sz5gl{L$fgd2xgP$Px$Muj)9tgie9s<8b9u6<Hu9%O!ih2JfKWYgNB#(eUN!|-y
zhdc(}lsp#RhI|gZJ9!d(5P33u40$SiDtRV+0lauI_vhWk?z_8vpQXm-d3XlT+xN*Q
z<+=P?<MQX-muox!(74n|LjGg8&iTT0m;ZwDUn8GEo(cb+JPV#nehPktJP+>sf!Cb(
zD(?N4^!X<|fc*YTuFt2)1K};nYr@--H-dK}e*xZ;ygPh6`3U$N@(+J^eJ&uMg8WkQ
zc=-F|$?y-z_rgCWzX0Dv{tx_f^2dL3eSS&a2)>uR3;ZB?B>X7(JMa_aN$~H<cfrq*
zpMqZ`zY71I{65V88hK^-pXANqf0Orymq;plea65`lP`b=knez3Ccg}?O`ZvFK%N6{
zMn2%OJI5Evi@{$aF9+{RULD?>{5kjl@{aJ4<Oks6$j8EC$fv{KBwq!OBmWe>h&%_r
zocw2a68W$2Psy*q)5veY_mfw=;^u#xyc+yG`Qz}b<oCh<BEN-oeLgID9o9j<47v7M
zj$He!0_W#{L(0dXeskmUx&86uZoe-WzxzIQ)p-ZwlJAUs7vqv&jr_~TC4c@~SLYSu
zlJD||^GNdE@Nsb6SI|tCpF;T&$j_pD{&bgLV)D|@ZS=o}`~*DZf7IDU`Ax_lAfF9C
zWn8{*KenXn=d5w*r#I&F3;CDu{}`7#si<?uxYT(9`FlR{e&W64{a1VuJP@w)44mQm
zd6GO5UWYsi-jqBB-iACL-km%FK8So3d<^+k_*C*N_}k<s;Y-MK;2)3|z*ET!;k(Fv
za2*~d*X#2%c?j}9k=KL&0oTt<3vi#_G%n}pcfy_5E#vmSE4|*GyPj_Z>OVr>4ITp5
zbsJ&bTI7A<&ytUTzd-c|qJC$}e}a53<Fc=2*jGQ}c3;DcOFkO;QN|^&eNHwm_e(DB
zml?*T&b=qyJl`Sz1of92mpTEZTz;)_sq-%Cd_rCuo(9)*iN}1tCQpKYOP&TlN1hG8
zL>?69`ur2F=bM4~|6^SG{|bE;PxgM|y)>`S^D@RI{}=KP8khNR!t+1axa8}ea{YuD
zmwX!Xb>TXnmgv8^$xEGssMChL3%m!_i9?;Clz;0x*UuR80QehJrxWVTB_9Z1N*)hS
zB2R>GB+rKLgzNmz<Gc<UmpOccK93l;_se(2CGUIM?e_=clGpd&i{$!#`a4|D<udxb
zL0$ka@v&FbdujiralZE(mwu|DpNEV~KYG2DH!k`1$UkXZ^4fnba_zr9T>JNZ%grH-
z+z;N4>QqPn-Hl5>W6)1;<JCPMjn5%Nj7$DQ<cAxVygskS8<+eU<R=-I{2Qo0!?@%h
z%y#>lWnA*}kzZh3@_mqBY+UksKPDQNd_3|=#wD-w-(+0!8^3q`Y%wl*eZSZT*K-NO
z{J%AMsgsX&&yY7p{YzA58S4B+`9F~_{)t!Ad&%`F^=tp&`V4?;KM|-?o_rv@26;04
zS@H~c3-X{@ZrzS>y<Z}5z4b9(!|QV$`s{DKy5~C2QRI3ZPBbocvQcNUajB!{_!ha|
zNAJLOKH=zpF?mb)2UO=_T!)*C*YMVT;EbEY7UOnbd&zZQM~zFJR;Y8_xZT%Ta^2Sj
zxb7<o{a+=IhTow&&thMGpL$JrFTJitpdWwZ($D`t-^hJ&?v=>@!SlZ!c?ql=N<Ip8
zT9QY>JCRR-_amPPA5K0W9!<Us9!swKT|hn;`S;1M!9OJb7`~bO415>)MffrD1Mt)2
z`nlyixjqklQvQ3sRlFZgD&wx(lE&|zFV4lEyh*;x2N<vF)p?-4^FZTL=T+o`;Cg*d
z#dTPj^0SbyPyRl<EqMyO4|yv574pyF<H>izr;#6nFCi~>)9rUP`E}$!Auo2r<-Z^=
z1K&q}4*m^!KKu;%wE|cFJo#<(^9Omve_Z}H`7C&;4gbAP<Q#ob|6%e6;7^d3gV!XV
z3lAfI7VEYmFLTZH*`B;2yfb+dcu(@K@R!La!UvPb!$**BfR7>1fKMR50G~qs4}3a#
z`Ri`Kv&kF5-zDz|Uqn6(zMMQ3zJ~mL_=n`%;GdEohi@kT9lnkHUYzeP@~7bY$$c=N
zW8`CzKTX~lewO?dcpmw6_%-qb_@Cq{@W07-!b@x{dcS1BOOyW$4<x@&?<4YPcvbQz
z;I+x?!W)pcgEuDc4R1w$4*nAPVt8-zL-1G0PrxUUZ-q}I*XQRu<SUV1OTG!7O#U%^
z6ZuIzKev(BfPY0^7k-j_pFW4lQ{m^y8^Zq}UkdlxRP_3p2QNiF6aF}PV|aD)iSVb%
zo5Noq9}4eC-Ui;6{1td4`OEO}<Q?FX$v=Y6AlLfy$=4#kk^DuxFK;7%1ip*B4tzg(
zH~4qtufWffPlewgkB65`EqcC5@bcu3{pp_nmB}-Zf13PT_;ci^;cdzFeSZM?zsL_G
z&w;;2ehxmK{1^D^<bS}Yk^c#wMcx>5_=vnKJdJ!T`~>+t_*L=`;s28Fga>RcdS0jD
zRmg9`!^j^ibm#bgt(|{-*7N@VFH9E6QZ%F%lc{8gv%|17Tu5gK!??C~tv2@KYFk<i
zqa9ro4PjUelc6$n7=@i<han6dXDB8+TuAmgIxJ1Tuh(9WmtK2b&*yso@x5;6*slBg
z@p?X9kJtP4djGnv>Jq|J!GnZf1U`@O%fTNZ{08u5!tV#)K=>B$F2YxUe@FN~z`F_W
z0RM&XUhu)s^&hu`x0!JmM|dLm(S)A}KArIMz%L{`6FfwCA$TRYzVA3p{XgDx$9D_S
zmqLFZ;WvRVBYYwFlZ1Z>{w(2(!CxW#Bk;Ef-vItG;cLOaApAb?&4fP!zJu_m!N)$|
ze}9et)eO*4gxmA-355TOI#USW8+Fbj{9y1a2|o?InD7h1=MsJf_!7c1!Jj1jO7PbS
zzYhFu!h_(Sfz$ieZ;5_RuNk+k4j-?Eb}^ox^f+AKPfg!p^n0%EKmPgK4Ic(>eZ#n4
z9z*mC;5**o+V>gwPI9>GdotnH_bhPhTMOTdi2fe<W;<N_ehA;7!?o|T$W`KSt&iPc
z@|HPV>$5OEH#l7DPlf(whim<8=x=wp)|W$nr^B^=KJ;~jzmEO>D7YPmwF^x@pCP;%
z<Fl6V7Vx(S?*Ly<cqjOmgh#-)5Z(>Go$w*(XYAipNcFP)PX<4L@C@+72%iCd4B=Ve
zsf1U6pG|lr_{D@*gXa=n4;~_XHTd;}+x@bT@OJ3$0k_Yk?em;v4%hSKKFpIx9PZBB
zl@8bXpP+x%;aa~E^XC<ZYyHfPX8!!$;aa~C^YC4VYkfQPA2?j=8&H2E;db73f!qB)
z>Q>|Xe~x~Fs*|>t;lDau`wsft@I78oZ`8{^2Yvwki37Lw({D5S(S-M6{3j3|6E^x3
z!bgCgL3k?o1%&5=2M7;=7ZP3pKA-TV;I|N73w}4@_2Bh{H-oPvd@cCPgtvmfN%#iv
z^@MkWe@S=(_U{(LlfbtVo&p~GqS?Q8KW2d+KzJeeVT4zLA47N;JeBY|@UsbT1izT@
zCh%OsTfjqvcY$9|_$bWJ+X(lA-$!@`cmv_t;Lj3X3BCs09%pXCI&CG~uHSaT?QvrR
z;m@N^7vXlj{{U|HV|a;KU)zcP@ZSvIqq+aOUhtLSdpX=a&J1_BK0dqz{YZzq$GyWH
zuJu1cf26~;ek+c9$2(l>kLWV}`IE!7z8lvMXMx+itC4pG;cLNj2ww+YO!!vt>j+P)
zG5rY>?gzhz@J#SW2`>j<Nq9B*%Y=u)-z2;Sd_Cdy;GYv-hxxe~+|JK6y(ZT$4%g$K
zisS!whwJgT*KdPfQg77Do)=1?-`n9@Z?E4DaJa5-|NV}G9Io|uV?HE0T<bqa{UnEL
zy}jN$-r-t5;tP}OPY&1mM^XQDhim;g(4XmWt+&^Q7lGUP)`sz%Nq9SW3E>g&YYFcL
zUr2Zl_)@}si%hOZ2p<K$itrThHG~&}w-H_r{vo)XCv7<Xd`kGI;9rwEi&1AQ(SM2g
z_PfLN_!nXP_jp;oQ7`Lj=i5++YyAt*@9%JT{v7IXt^XbRu@2YzS1=zYI$Y~d=<Mr;
z`g`cr8}+jNc^CRq311C<w!?Lu8#?=%`_6N?_O<s}nGV<bDPJ0WmczB)uA|w6+v9%`
zxSgM=x0^cG5}v-;@Y|d^+IJp&Yl*%U`|)wY*MUDr_y+LT2=~Ev9pRbapAcRM{x#v{
z;6D*w3GQ2?!l;)WhsEIg621cbV8UC#k0iVUd@|vi!KV-&hw-0I_+;?Q2~PvhC)^J{
zm+(yRn+dN3UqW~lcpc$k@Fxjx0DqqF4)DK&+jX%!t}E6#T+gdI%&T^X>-lWg^=A&(
z`u{-xg~PSpo)^AzxYkeFWajf0him;OSdZHr-Z#&o|IOiAZ`Wh&TJ=V~bS|ww64xz5
z9Io}>qW(z2?Rp#yZs%bot}7-G-h=T>A>4O|$#n+dao`saJ{defcpZ2l;SJ#P311C<
z3*l?Q?<Ra5cs=3W;42B=3jQ+Tz2I*W9*=QbPk1``mxO16Zy`Jzd^_P4;IXfm{ciVH
z75M((cAjs*`ECs1UEmW4ABOAI6v9V>pF{ZG;1?18E9z$x{w?@y!Vg8Aa>8vts|dIK
zyq)kPQ0D={?Q`JegxmX?=LkOobzUXheqQ`G;dVWKOn3?Ed``GscRv$;A@si!ZodyR
z<W;lZ?f$jjdpU@3``msU;r9DE#}jV9pK~VR*P}nv3119;8R2(=&nDcCe;MKSxOyYu
zcKjC+ZpZ&V!tMA!Mz|g4X9<59{d|dVdwuv%aJ#-*aG&xK(VvU+$QKUR$6@>T&3@%@
zeH^yAess9jufhG}PY&05J8r)_T<b^v#~g3>cul=gFFPOXIPB+et-n2D^uryl>)Y`h
zL%7{969~8K<xhm~^Sh~kD!3iD6?Yqc7SY@NGM(rfmm2-$j$S|a3*ot6(BV3l{d;kX
z2yemoTtoQauTA|0;I^ODcN$(pcnbQzjPMBN!zxn$YSe#`@EY(|q0YaEz8U(@3Ev3*
z1F16t{og_Kdwyeb?c1UTOTF|w(c{^K@jTGsdOVY$A4B++;7Nop1wR4Yj%O<N<LQLg
zqn{U&I`5%Q7U4gE7YKE(CHg}!&leD$27Z^r^*D6yWya@0hwE|3hyE#Wo6Cp(zexBf
z@K(Z8!9O584g7P${ovmdo(<kZco2NgzpGBGm+faE`2K|3c|L~l#n4YAyczt@gpat(
zjN6%n$Ae!;cmjAf;VIxngr|aEOL#i?Lc+7aml9qH{s`e!;HwA^gRddH9=wh42Jn9o
zz5;v`;jQ3565a{kOL!Of;D7Yrznj4iBs>PktHTM81y3eC4*V3tlfcg*JRSTJ!h_&J
z!t=rB5FP@*f$%W+BElDg*Al)I{BgqVdFMI8S400A;akDi5#9s-3E@5*-@Yb19{eZ5
zM}hlZ@4p`t!S^NH9zPEzd<OJK5}pY@nec4zDTG&mPba(*{Bpvp!Se~P11}{!|3Pzn
zr~=<z#n#swGjYAN*x~wkTl1sQ*En43?e#{T!?pes=<6M>_4c}V1>yGlD$Nepbq?z`
zzH1$>>)7k4Hiv8dWzes4xYlpR^<;;`wf<x1H#l7D?dJj!!tHg@kKns0t@@vD@-oxU
zUcxKu4Bxj^t9CvI*aqJN2_OA`Mt?ZCt#9j0Ci*j>KZWqC!KaZrtI?k;i2iQquO|An
z&{q=u3()_S@EYX0i_~dBokxkj7j>Q{{CU(_P539!zfS76Vm`MM-Uhyr@OJR;2#<jO
zLilFzn17o6X!pxj@L_}}BJXIzlfWkso(!HsxF7rs!l!{>K==&s0O5t;g@i8!pHFxM
z{1(DDgWpZ~R`7blhhSZ-Bs>oMWy0gZ-y}R4`~$+*;`sIjxIK>9?_qxLaJ}A}aNYQ$
z!}WT%_i??1+v7~^8~xYskZ;X89pZ3Z$A0f3-r?G}5c*LL*ZNVoFH3T`);|jUM2Bm=
zz3)qLxYqv@`c#K&z5RZ>-{D%n9r|ew*Lr(A&jPpeJnLSQx5&}!I-|cc{5ry?fL9aV
z4t_hSUxoS)5dBK%8;QOe`j?3QHt63V`Y`k#6a7!ne?j<x-<w<!QfD#h{Ez6DLcjZ)
zYEab6j+@o*53c8@9=B=GClFo&ejKUOfq8x!;ho^q2=4{IlyKiYCf6*&W5LS^PXw<b
zJPrJI!VAG4AiN6v3Bqf@R};Ph{O^P}fxkz1Gx%qOw}VFrUl0C2!Z(2L-qwFVZUx_u
z@L0@;QG`zhKZ<Za_=$vPf=?wp2%bTBE%+6LuK>S_@YUeu;PyEA_I5KLt|#0c2W}<&
zJLvBr++JTjLb$z-T1EIa)Omw&U$5!UdxQ@L|CI3kz&8<Y{~X5;gxf#&v5oM9QD>jG
z%zn4yGa7s(;fdhK5}pK}LU=0p6vC&2pGSBG_@#t*;rV<axINCaWB*=D^!CpS+~RP3
z{COM4ncEzGl;ZY0c(23zj#rz_etE#*T0aiwujLNc`Y)k>%HdjX&qpsfT<bG_F!f({
zxYi$w`foT~>$gMyw!^jlOz1y$xYpmd#nk`Q;aYzQ^j|w%>%W5jJBMq%y&m}4;aXpW
z`<-7MuJw7SKj>}sM!oF3viA}Dg4_M*!}a9BgeTl*`hO(h$>5U-PXnJqcn0`%!pp%g
zC%ghYpYSU1xrEn%-%R*w@Fj##t~I&p2u}fjlJGR}7YNS;f1U6w@OHw3;2Q~F3jQ78
zwcx)HUJoAgj@iF<KQ@C8BYZ9RXu?~;ClI~?JcaP2`^~tWLHIQA3kc5u4-lRSUPyQ)
z_<X{vz;7Wu41PD^jo|f!uK-_3_-gQ%311KXCgEM+>j~cq{w3kP;9Ce!eZY+8cEU5j
zW7qZHzcauOAUq5FFv1JLk0HDUJeBaJ;AazF2YxZ(E5LIJZwC(%z5)Dt!Xx0f5#9@a
zAK@`LUNsOt1pHaTlfYjkd?NTegii+VAUp&7KZIw2|44YnV`l&U25yhTk>3m-{O-=<
z^LX{^)jfvq>u`NMx7S4nIb7=>f&Ng3YrXyZ3XXEP*0(}`w8ORDo?rg#aIHUbo9WLf
z4%d2nzj?O9wLSp-c@Ecld;fST;RQHP<q>YrQ-$F6_?FpV`ZJ&KHjMKvgm;18O?VG@
zJ>erze<k55;4c$C4g5{Q^TF2>9s>W8@G9^vgg1isfZO>q1J`N3_tfC3m*rQ0??ZSF
z_(;NMfsY~F))`N@y}mtxaC?0_1>EkhbUZ)#3(;3&{$K8JJ%7gh*X-Yb!}a{J^Z#mx
zYyCygmpEMO?epI29Io|?puf@KT5sq7B8O}Jr_e8PxYpbIkp~^F^}j*?u*0?9-lsh6
zaIK&9lgayx!?oVtzpNqLu8TJvK0)adVojZPhwJ(YsJ{{1?w7^bFFz3dt<e8W_*C%U
zNu3(h8S=g|Q!hOaweMEw4+6KoR(}-H+rN+EPlUgZI(|~84!#!=-U2?8@K*2=!q<UU
z65a)VE8!9FdkOCbe~j?hhs=IiN%#oxHQ;vrHvVSxZ#rC$=lHFLzvFN{Pwaiuza6gi
z_e1}g!?oVtH+|!9t^XhN-#c9E?S0cP4%hng|7ZHM-Qikq@0<2&S8vqI&WDeo-^bxv
zZ`a*OhwJ)<Kb!i8I9%)P`Qk{z?Yfu*Zs%KXy{Ypj!kfU;ojTh0MELq0u6^zImM<lB
zvaug$5nc;kMtB`~72yrww-eq5{s7_Yz@H#|J@{(Ed%*urc>Kd=eBL8`6!>R^CxS-^
zPX+%U;c4Kzf1n0Yz3hJRgYQRpHuxyQE5VN<d@=Zmgx7#iCA=0qgYZW1D+pf)eih;E
z;PVLY0Iw!I0)8jqL+bm6#rF{58Q@P7J_Ed&@GS6u5?&7eA>kF^Ul3jezM1e^@NI<G
zgAe+!|NiX&A5OSkj|qhP9`W_PjwU=7{3OET!OtQ*6?_KaY2Z18`@xF|&ji1Y@JjG7
z;Z@-G5FQ49l<)@dX9#ZuUrTrs_*;ap1OJHdUhpr$?fK<RoL_!$xIXSJ!Ex{Z9IlUh
z_PXmghim;mq2KKz^+vsHeS6=rufw%I0{t+D>-zTif2hN?zT=m^vc9nn*Lr*3akRs=
z{s`RH9P4ncxAz^VI9%)f&`)u=*4y*Td4$_Pw>Sgb9>?NvA8`fI+w)P7=(C}pLwLrc
zChrY|mxC`NJPck-cq91Zg!h0yNB9u*=QY9;z}FF;1pW!(Dd1ldZu52%z83d2JHYMy
z8N9=c!`|!F&QLFV{ctnxD~CE<?=O4(bFjnp{{0;K(GJ)8`M;a`;~lQ`NB(N~B!_Fg
zoo^>OT<ZhSpXzX}e-8DhgWGx1jl7o=-UFUbc--TrKXVD62!1o+$>2)}PXVtZJOlhm
z!e@ZLKzJ7T>x7qsw-ep~zLD@2@b3s;5B>|`G0V+3#QaMQu6o(=OavcFcnbI^a67NY
zV_qdWT<^!5u^%To+?`h`4%hl-=u;i8^)F(-`yH<JTcDrjaILqWr(`-@>l3$|yjc#{
z`ZcJZ?{KYeguc+>TK^jK6%N<>@wnfwbhy^P0e#rvT0ax|#SYhcdt9vpxBI06<NqY#
zVel6SZv=mx@b%#BgpYc{jL$~GQ^3C?+z<W>;X&}2k5w4;vi%Q(4<oz@{0MM6uO7m<
zO(Ogz@Y5YWPFc0bng077uE(<t`ssuR`@ZF+{vK$DAF1^Dr<yt!J6zYf5Bkf%ZLW6o
ze>TxKLtjq#`{0WR{~WxI@J-;45&jMM-w59V{&&K6(;Zf?O@z+@|BmoD@Sh2v2)_Hj
zO+CB6&IBJy_+P*eCVU3?IKr<6Kc4Wh;3pG)Aoy8?9|C?Q;giAV5<VNelJLvG!-Q9Y
z-%0o)@W%*m0Dp$?!}S2F*NcQd1^w%U?+N|;gzp3X8R28VBZO~5{cghT{^}*%&WG5J
z{`)<GItLN{4tOHrE#Sux{tS33;V*(uCH!;na|yTe;S$0>fxd|FAHZ)Td??0k3E|1$
zj}ty0d?n#$fxkw00r)$FXMq2kaGNVacpmgW5`HoG&xGFsKID`B`>`#?ygz{OhoC=%
z@aMtD68;YOk%V`FA5HjPdl=v22_FmoXTnbfKaKE9!OtLkF8H~GF9AQF@KxZK5dJ3k
z6@+(!=MvrnUO@OTjB^R$lfdT^?gzh)@R{H@5nc(tknjh=Zzp^;_)@|*f-fihf8fo8
z58Ko1$4>}968t~ldb!0LY2R`0C!(JY{qK%`@Sc6rzW?m|scEdIlRht3L4N?@bHT?F
zejWHE!tVe-30(K{U}M$iJC*30q5q4cpD<`=KQoDb6ZAnxKgy|JMDzy?G8^YR`s|pU
z^=~G6KlDo+{b;9tEzw^G{o{^4*QvjX=vP7ivZFst)lWc|-Y5DK_cG@HCcFi8z9Rfx
z@E-~P417D`_WZclXU50QhhL!|PWZm)&ltiF1)o6pB=A(i+fe^3!hZyxPWad0GYRhm
z4-xK%?>xe@z^lRa{L~*!&D-1TfcuGl0rbm>ekt^8h<+vXZA8Bs`i(^23H|p(zY+Rg
zq8}cM{j{O~{yGSJ7~!MAM-qM__@RVP2S1$fnczneJ|FxT!tVq>f$&D~lL=o7K85gh
z@UsZ-1V4}PpTI99e9&MsUY8Pn0C<4#!@=_ipA3FA;pc$QA^b}4d4!jPUr%@#d;#Hg
z;I|U~Ecg<_Tfpxjd_DNXgh#-a6TSm{CE+9YHsje$_yq7*2|oqAmGHlS|BLVd_$I<b
z;9ChV1@9&NCh*veroVc<>)-7C=7He$xc5EuV;w$THTWx@GaTXYqZGHt+hm7p{d>?)
zcDUBxw~zXddQEk>{(L+GpO2sGa9w94o`+uwZu?*UWM3Iy0nwiX{XC-IjQi_q!ncCo
zN%)9HQ~x2tQ^21lJQci|@O1Eh5}pnIA>l#rF9<IL-%NNId>i4d;DbIl<88;S4SYD^
z?cfQ7cY_~I_*U?f2=4_yi||p{Uo!}=1iup8&cj<U53eTNp2u$@{2u6UC%ggt0mAKl
z?sCFkg#J0gUjcuO@YliH2)F%QPq=+v@g?D(qRtP5Zvx*AZues?#%=HyX8+o8i^cki
zbNF~AxdQ8Agv0fEwAVjl9Io|uLw~r#wSF1uPja}{zYG0w4%d2{cM7=e{|5B`a!0R^
z168qR-Q_x5*S{3chYJZG4nCLg6TugNTi^DlO#ND-??(TZ6MYl<`8?sx;4OrAfWJ$4
zH~6Q7$D%*q5FQ7<mGFt+yLGBTQ7@Y-6MQJ)LGVKe4}m8Uz8L%j!fU}#C%hT_FNC*%
zXA#~BK8x^f@N#fFpO3(NyV2o#K2+NM>u^2a?D^;}Qa|Qtv)>;kd<ggo!Y6{iM0f`H
z8-&jQ|A_D`@J_-jz<(gT68u-ftHJmBvj2Xs2OmLrEBIK#hpaH;Fp2Ou@RJFT2lo@6
z0)7$Uso*mSPX{j{JP1CY@N)2l;C4Qof%$Nk!}WZ44)ft&hr9FP5r=Di1p3Dv?jEn2
z9Io|~@ce(Z!?nI1{dpaHH^tQde5otVIB#_H`uNs_<J)%**Y)k+!_!0REXFwOxk*>u
zx!#w8?@#z@@G*pUfKMcR1Nff_?*c!Qa36AANO%l*HsM3SiwK_vel6kI;0p=Q2VY8f
z2>cPkE5KI~UI)I0@U`G=gtvhIi|{t^O@w!W|44WQyqEB9@WEg8-@ijvnfWuE@I>&j
z;Jd44dL9;I9!_+)o>%8%-X=TTT^A=iT<aG?f11PHbuk^>&hu{cC!g>UO{V|zojSVy
z9(}7reXdLREAU-JcqjP%q<$KFmlN&>f1dDs@D{=sgTG674fv;o*MfgT_-gR2gg1ll
z)}_L$mmRkj@S%kJo-yNg2;uSINrWeWpFnsT`00cfg8zl^5O@~h72pMgF9pAb@LKQ%
zgx7=D5WW_C8Q~kipCY^q{6)fjm~X9wj{^UI@FeiR;dpHKiy3|OY<Z;lP4nF?R6ox+
zcqi9;G<m9dKWJiqKI2;Re(N#)dDl(m{oW_^=l0(xeIu<uxA*BI4DS2BO_G^PeIy>7
z_J6XVPa*nbyq_WHGl@PM@5=>!1<}{w{Zc_+OY|*xzgE!O?KW>5#-dBmN5HK<8~Pah
z)W=VEJn{JKk9CT#%lZ-py=`mjr(v?B3wl4e)i*&O6!iH-pRk7sR4wSkL|+4agP?CD
zdLN$Mw+i|;q7OmeCFmnW-wAyTaz~9nxE-Gid}fm<=#z-P1^RSB?<e|XeAW^a^!Y?z
z4}G<u4-<XdUS@wa2>M2%uY$f+(6<qNH}qYCK0@@_INrrzUPO&QxE=p?=o1Bf649p(
zHhI$py`SitpbrZAe4<a-8}nb#hl#!h`UXMYNc6saO#N0t-$wKy=(_}cgy=h=kHI>K
z8h>y*{ux6|e-Z_K64AFnpDyVAM4!B`sUH;d`9xn2eYKzu6MfuJQ@=sbHxhjn^sR!v
zjp)0f?-KM8qR-yX^d|<#iKy`hx8vUqeWIXGBKovAQ$JnM`-#2@`k<iCC;Eh8rhc`c
z4-<V2^bLZ(k?4K<oBFMSzK!TZ(02*?2+?;!AA{p))cAwj@y{4;`jaT=lZd_r`gB3>
zC;H?OrhZV+=M#NB^woksO!RRFnEDNZzLDswpl=oQZA9M<eV3q*5PkN6rav(_Z$ynh
zxE=p?=o1Bf649sOx;b6Y`-#2@`k<iCC;EhV)BkEgA13;x&^HMBMxu{7$kcBY^le06
z4t<xPj}Uzq^f5TEMvXtX9se1)-$)enNkrcYeY&9c6Mf1dCT~#C=M#M+^woksO!V=i
zO#KEy-$?Xf=vxJS8`1Yb-zDfHM4x}C=}!!<JEF!P+>U<-^ofE#iRk^KP5pF1?<e|Z
z=!1ejpXigunEKU%K1}qr&^HMBMxu{RF!fsneH+nNK;I?kBSas8J_griQR5G8$3Jtd
z=})4dPa^s@=+gzgpXgH#GxdXlKA-3tp|2M7VWJ;(xT)VD=o^WCG4!p1zK!U6q3;s(
z5uz_lH2sOeb!gQ1gWK`n0DYpMPa^thN0|EQg5FQ`YoQMc`h23FIL_3s7W84FuY<lp
z&^HqOkRwg~RzcrJ^p((e3Hk`pZ-zbw*XdE?4{palE6MaHQP3w5{W|E=1-+l>Q;#zB
zgMvPv=vP2rE$G8UKWe<G-yrB4iGDHkt%AOd=zF2>67&(GFPvcd6NCGhsPPB4<G%s=
zL_wcK^wTDq`ssq+PxNb{4+{ExqE9~B)UOuwVWO{xzCqA85`EkxQ@>Tvw-J36^j(5J
zLiF9x$Kbv#YW%_N_~+yKX`-M{BKi*K(*?bs=>2#A8Wi;TMBfa3wV)3ZebTXJJR1ak
zBhlAF-zw<ah(7i>Q@=~lM~J=x`WW2TMvXtX9skYHCkpx`qR%?s^e0`=`-y%X^g%(N
zPxPsiP5o*?A13-0&^HMBMxyV8zE#k-5q$=p<97-A2+_Ad-z(^ScphNKe;xFr!0G-<
zAbQ`4W_(fwy?s7m>xZDv67<=mekb&mg1(CANBqh3r%uq<6MZ%GYXyA^(Qk!*gP`vu
z`e2IbPp_c&;dzN2pY_m>0*@MhqEG)b#$V8<5&dfDvjlxM(MO=K6!cX@pLvq$&r(5O
zOY~LHuNL&pMBfeldO_bo^w}qy{%jTWJw)FQ{RliaqT?SAZueJOs;NI&(5Dc66ZA6#
zeJ0T-oMP&i3;GJ8uYrE4psyu*->IhlYC+#j^daci3;GVC?}UD<pzk62Ug$^Qxmwit
zgWK^hJPqS7=u?P(1N1WleJ0UQOT+jJ`U;|73;j|-U+d`cQAwY{YC+%Z==Dci6Q`K|
zY!LLFM4xfG(f0~^AD%DT@oa&9BDfv@c)YjIFRk8w9z8?QXOj9^XPN#K3i=SyS3$p2
z(AN_E>T^u})q=j6=+{BtCFmnW-#*RMkHK?LIzF-Bc6=hxCkpx`qW7I=>dz4LnM5Bs
z-{{K)eFf3`E-?C~g1(mM<DqXA^ld~xYKE!bCFmnWKN<QVc<xKbGY;I2XZ*#c{$xR)
zLiDwl7=4zYx6h|-{p8DxzFN?SN&OL7M!!PPHxYg4N~2#d=sSqME!*gO1-);i*>3ya
zm22K7g46L#BKqz;qn{?|Gl+ikETb<M^c6%ODlqywL0?bw*;g5TtDtWq`qV<B-z@06
zi9V&s=tto>JsltWyx)#zWr@+J3wl4e)z{52`f@>ELG+W$jJ`q8Hxm8Q3Zq{q=-Y`t
zIN#{)=L|M)H*~QFneDd!_IpGV!Kpr(=zZ6j_A>;1Cef!<8hxdpuOj+J=o<umBhklQ
zZ|biV^esd`5&F%7zMJS*+-T}gJlOoS;}ehf$@po<(|-TTey&3GnM9ww0OKRnuOj+v
z=o<umBhklKoBHbneLK;2K;I?kBSgOy`d&fr!{<46d}9BK@dT&ilT7sSw-|l8p!XAf
zI`mnBKAY&vp|2+T5Z;H0-hPj+PSDpAeHisu3;JfFuZ4btpzkF5_JwAAMvO8)?ReV$
z+t0`B_}ATr@f7raaI0Uu$mq)jeFf3me^<Ru(AN`vc!{aMUeI?Cz5Vxgdj-AkP*czL
zf9+E9J`tRbPZH7Ff6roupwA?F`|sIR3i>LdPhV#GQzz)_iQfJ_v8{r>jp%zHG4;0!
z`W~XMc+BWWjW$2&_#}Y;F`f-ZmoDh-=aW`%|30q8L|=jTHKe}%KI&>gZ$Hnp_3fWi
z+aTyWNqzh0fMW2urOj*m6ANzZ+dn5VQP3w7z5V_?J{JDtd!A<0e7@=U#n!hR(=<x|
zsi05LH;3v)>&z1P3W5Ju;3>FSrS<O=xcxpM)o&B@7wp0J|E~gnS>VHC_&S9G|EIwB
z*^{r6Ch+?O{)NCt4C3n-3H*71)9>4usy^S8z4-bI1-@3`2axYG*!q_Xyhh;P3jFlJ
zd_U>;3asxdg8sn0`8p*6|C_+S6Zq79`1*AM-z4ynL-;x&fxjj2{mAEBc6`zWzD(dh
z3p|y4j$`Z35%}8zKb(9XVe1qK{2_t=BJd3IyxrEnSK#jmJdr#Hwso!-`0E0v&y#JP
z^T~5g%byZ>x4@4e&-ZMd8wCDufgd`;w4}%93k3eO!0mG|TIU?{oX7U_MuB$-{8;il
z#MYT7aQhsF_GeG>9KhDOQs4~&|3u)&k^632pWg3VzEaQ+BKMnCKTY5_3H(ig_X_-U
zavx`X=LwwNCtCf1<bK5Ra|PZY@b3gZhFt&K`t-iT@>d1@PXeDtu7_=%y9EBG!0C0e
ztuu>Ue_H;az_$wgByyc;>y!w*P2fWlOiQ|6rV6}H;F|<Kax7mzB=8pm{=LA{5990K
zCh*q;9)CDr=SqR!E%40(KQ584KU?4}0v~h)U*}|jFBSNw0^e^OUq4^qs|5a)z*CRp
z>)$N!7X==d#Mil4;EM#_CGhe1-WgpN0f9FQe22h~AJ6ySejkncekkbon!wk|7Wi_3
ze<twB6Z!hr3j7&?#~#hs$r1R=0{2bg>zp9)I|TlXz>hwLuRl}ZYXrVqGGFIJfiDqw
zMBr17<?AmL_*#J<a2#K!Sm198JmGl0&MbjHDDbTUKWQ>wzeM0|0v~z;UuUYo>jb_@
z;3H4u>)Y==(RKZTp#NUr>3`zuFBACB0#8lh>&y}O+X6rQ&wQN%fj=bhUj&|U5?}vG
zf&VD*#FP0t*9-i0f%gdf{8YaFQv%=P6keYt@V^OsyTFrA<?G)n@b?8Ca~fag3W2{M
z@cq*GIu{B2Hi3U7@YE@M{hI~;qQK)$=j&W7@I?ae68QM3eEopHn+3i@;K!%)^%o2L
zLxJyg245#z;L8R6nZPHX$=APD;LixWOW>!R#n-=A;2Q)!%+J@kO5jZb|Bt{=J)5sz
zE%28F{=2{@pTpO`UEm)HJoa3^PL9Bz5cmdxpD>NDf1SXa1U~pYzRpa6uMzl&>3p5b
z1inPz5rH527ruV3z-tBmxxj~K@bxbh_#FcOM&N1Z^Y!l+_!j~naRFbaNZ@Y>e9VP>
zoeF_}An=hh_&U=B{<y$*2>g<Z`1;EP{-MApT+G**Bk<({|6Smjm+<u;68J{~pP0$l
zDHZq=0{30Y*YOMddVzl|@KKlX_0JdhQv(05z>mC~uU{qbHw3<2;4`xL`VR>FeSsfv
z1z+bJfj=hjZv{U3O1}O)fxjZ~{|fxv0AK%3fxjW}G1+{b3W0wh@bNi(odp7aOW->M
ze#uO}{xX4oDDVlne4RN0UoP<91%6hLuU{$fe+hh29$#mnz&iy#ZWdqXa)GZF_^$##
zW;S0xEb#XPzDGV^CrjXe6Zm$4Cl~PbZx#3^fhS$X*SSLAj|sd(;KyFg*Pkcw6$0P0
zkgs#4z+V)2ToGUAVu3Fbc$dJ(7xVQ40)JfKp9=i=62AU?fv*zyR)L=v;_Kfn@HT;u
zox|6eEpYq&Yx<mRlb|12%Gdv^z+V>l@G`zmp}?OL_%{N-sGP5Vo4~&kc<Nlf&dmaU
zQQ&dc@O26V{*1u81U`NqUw?tX-xBx^fu~pS_2&t^UEoK}=j)URyg}f<3H;(~`TEZY
z{C@%;e;r?EfxzDq_zr<zQpwj}Ch!jhKH+-4&K!X+7x?c2&%A-J|B%2x68MxG`8wAK
zyi4E*Rq=I71^$k}huy^2IaA;d3%p0*=ikiNe@ftcEa3H70)JHC{}y<1HDCW$fxj>C
zn7{IMN(KIez{lMp)DieU1U_^jU*}4JHwyeSfe#Jy^`{7Yp};!@KJHe&{^bH+E%09j
zZmLIr&p8$w?0Mh*IoUXY#}jV<9BYEZcgOGgM-t%)c<-B3HovGmXQujDUTS{k+uus_
z3Uelv=T(&ZCiVSVP+U;%zAr5a=9K4{je)?-xw8YRKw+K&eH(N|_xEEb9c#6Lt8+_p
zm3TryC?}9xQe2#uTkZ=4t~PxMsD=f_v&(j>4ezJ!>rz0qaViB1%51SeHaktZ%}(pw
z!n~Z)Kwfb$R8mk}9tf)R^Z70eD0C{8=9T4@|51^xB}tqrs@r;42d*QFoJzT~W(V>@
zY(MCxs8)gE9Lxhf=+3B`mi;$Jx6TjhxuAxWZ{2S*+dA;aJQOSRmqb@7DhcYzDR!d&
z_UQIGvu6(&qW|{j_QAaVis(V4is%}pC3DLM3_%3Z74l08)oPbVq5t;i_G*6*)V$y3
z=+;Gf<vIGO5h%(jyLzBHf-t(G?r&h`{6KDDL0<8IQ&dt$*UT+1EgYzG{kJ>qbArJ@
zzq#z}<EU*;J9V%T+eK}2+U1rM6%~|=O}WiZYjg0C`pax}+Rj!-HmPOQHm6-^uG}ta
zo6|10Bs5<%jNa(9#JC4Sr6sw6-0})`$I2q7686Nvm1L1qN!yi{2TJGmoi3w~NbGi}
zy*3%BJ-gj$kBLz#tQRw@+^tSqGcVkY&LofC=(N=HLiM_QCcn72%}#4QI|gXYZFXAE
znVVNSU$-wP4(9Q5K$19Bih{HHiikUo7dRF4o}E>=i(MZra4P718!d450WWYW^mTH;
z5`x01ff=N#u<ME2?6fx1L~6`zMcbUh!jjya@;rUHp{~%bDaegJ84jp%`k+hbOWHtg
zQIO5R3rK}vk-CB%pg`1i+FtF=0o&8<PWv)-u^K2U<Il&@8=aP=d9w@3%JWJCp}B>H
zVu=A%POV_x0J?tDasZuE?+=x_3ZKR97(pS`=zm@4^r&B*{wk-IlTYlCsB!A(djWj`
z80deU>GVfXkQ#Gxi*t(t>NX`%Rv_*A@_?WswaV0emb$gj#X@Q}6wNFsVn<x}Y(TA3
zx4a?{<Zm*_7TP9IG?zay^tJ21)oDAcG%qhub~S%d8@<tKsZz~Vqd31T5Gn{oA4v4g
zsU&f#l&jmuV9C7VfeQ_wa%$<m^jY$IA$lumYhA?V(E?IoZb)68=LKe$6{xE%_4J>+
zQ_#H>bxu9pj0ffg3*-@&MNXxix9$TM8&K!e%Pa1?r5><jqQ<FXZ@UL9B#WF%>YO*X
zC~x3&qQ<FHHn%LKPYVO~NESJj^yQeYQdXW*&d&ouL28s0<rM`~*UL-QZCZJrTuK%?
z6=#-~<OFkb%1qzp%q>y(lBIb$x%v9Sj-9O@TR0wbbNhnpc)^*WKb~;)d+Z@<`qxpX
zm_TW8{?yaiuBjr7pnrwFQ_H|LSP80>=auINW|kHNXXo`@?L_rM7BCfduCD>>a5AQv
z^svtDQk2FS9eq|B;I^OJ?6lUqcYxO1X129D6c!c~^A9t27Ku_hwe&Tjz7mZZQ+)=C
z-bh-S<CNHzZYHg9a1xtGZ71!^<`?G%)C$iH@efON_gM|8lf#Ofiz8i#7m-S8QSG8X
zjDpk%>cf@#43s<j>5fEgciI=_7nu8syyDpf#r$Q3sB!Ap6QkCO*C(>bskC!B1_mrP
zpw6i`ue3m2BFrhu2?YxHW3HfZYUul5bvd0^S~@qRo(Sa>2MhD~r>nbAIyFo4ib}50
zhdD20cP;K$xvadTR9$A`>^e|?^{H+^ty6bqjy^Tc4g}{G@t4fJz^R~*FnJ;MI5iYf
z*YfOyl_XA;f--#)Re#wYH{qi<IxW>xwF>?4_3FSiCBl<wNy1i{TkN3@6*-l3*!+2c
z^7+CAJ-gj$ufm#>0_J4knw&ymlJ83DRMoC1yQ@7V$w;-*zH6$Ixuv;zfmx*`MbZa5
z+Ic`NsjF{JivoQg>J-iFJMQR*P3*kTrFSJK)yqqBipxSJ`Z3->J4lj|YGp-5a|6MW
zqMU+av4gC}se|)dK&_v$z`UGd{c&WOI=+h^)p%>*IOt(A=ZtH_UPf(q+N+Oh@^Z?|
zt-(N(XF#1(FITN}b@<ko_5+n0Naj@2>GaK_ItCRK&ngiUvKpt3I%bCY3gxO}YjGa`
zAV3y5m2{7;$tx`@C{efMeV-(YoswiuwVlt1)U{aOF*1<LKWf;8(y3XXE}5{*ag(Wz
zpZtB%uB1-YVBQ~9?Hm=$?o#X2<+~6lE(y$34`cc3Ue9eDAA4?9=TCE38_>an+Nq5@
zXIq+`5TeGZ6XmL}TG?v5P`WkMd@aqJGq<2LFQ}iw&C;JQ%_<N+8PYd3yHGo|^;#$h
z<pv5%X3w0<KTMS*Vii?v9viuTrT#LfT4_ZfR8q(<@ThHWyS&`_>N^^J2WjbXU#X;V
z>gaBU)Mp1`hW;C!mg+o;qvF65X#iROYU-1kJas7ERW(u8znZ>K4(92nKY7Ku{H2^q
zAgKnb)prNSj#pGcBJE!lL3Z8A0fhZ4>ZPErw|6;&vX0g>C)-`^5___Z*3o+AgBEG<
z>`7zi_Wtd6ez34p;oKCf;pY_nYv@D9E{`j!lC0}ruehYVKz$6VKH>|h>8nn&Qr89$
z_ODn_oReE#a7{t^{6Kj@k@_G)d>W#<xeM_wDo5S9_aDuu;!*lt)R!mPE{x=cyL9w6
zWuv0;b9mCuFZE5*yCGM7o;tbjH{Yb0W$G$Lf3(~8O&hg)^Cq1&{i37Q6JmQEFe#X)
zzX)h91<mg{GiR3Cqb)Y8=Vf><0x+vIr$`agKwY$%8D-TaIK|?<x`&vp9wYyMdFk&#
z?xy}fh*V3%`?RM18)Evu^&O(#YnDcM<Qh}4{r_}zpD#mw8B_mezvpSczd1oM&c6!2
z32M9hqW<I5M$W%E-#GcvSo`mxey9E?E2jP3?~3Xs^)@%zVB2erex0cP&-wcbjIu+U
zs+acPQ~k8<ZGOLEtp9VmmCx5rb_~rwRcSc?jzZ(qqIZybY5%>{PwKD#n6vgjPW|6~
z)x2choixIwMyrW#qhHzT|6KdG-_=`vzMqdVKka{QJNr}rF&F(i8D?M0Z>ELquWe7?
z>p#B4<*yAJr5$ITe;=i_?JZxV80X&x|3SKu^RoT6=u!0x*S<a0DDC%`t={_E_si5T
zT>qQU|6~Yt|A(sIZF}4QR~6&@JK=BjDDy{q`(E#6&cBlxKb^(av;G?u<NPBY^LGgT
zJxu=n8UJ3vzsF<#Uj+Z8TTN1%Q;)x13N-%_Dm<6pH&|1jZ&&+2LCLuBPlLa^{|{vR
zrwjgZ@VEW#>x|RhzCT;=4>9@mSlD`YT;>S=@gDOR3jSdx|G|v^Qo%pTWBw(Ae>0PR
z6yyJr;GgU<|7yX%oyk9%@&8=#PxF}n6T#niTlD--VEnfU{(g`7w+jC8@OS6`VT}I>
zwJueOsPjjr$Nc-L_T2jOGx-x4|KkP!Y>)XT3I5qketoS&*WU$#f5>D0^927ICVvv+
zKS%Jd@R+|)@NZ=Dk7xXA1plzd{EGzt4krIZ#{YT2zs6(!Rf2yvlYbK9|FPg-?=k-e
zf`7uI==HDHBAtIf3;vBB^Z%dVp8|h({p)K~>VKfRzUJ0{v&a0yRC{jy=QH^yGyW$E
z{w*H!A1nA*G5Phq2F-u5;NR{s|M`M{6O%uM@vjj4J3Qtu6a3ql{3kK~4+#DdkNNKr
z{Ck-Esf_;`!N1#M{uc!QxW#5qyYv54#(#t0@7r6iik<VN?+x?*--3S{{Oxs~zWz;f
z+FRZ$_{YLO&Kl#Voxc|UBKT)A`A=v3N2$fjt^atB`A4eu-1-kQ`O_KylLh|-kNHm&
z{Og(gXEOem3I53*^Is(Rw=?<ujQ;|`KgDDI8wCFdlm8sXe}&-h_n7|)!9V_XGgIw6
z*YkfG<NvYXpW!k82ZDbx{N43Go$=QXmALtz?J@s$!9SbHpTYPi2>$sV^B<zxt1k2%
zThxy~UKLFK3)EJ7{IL5aP4KVqnEzzKzmds5gYnN2{Hr|XzeMnFVe((h_*V%2H6HVq
z3I5$o{!GSyso-DhG5-?5KlTo@r``E~8ROq1_&0jY|Fqzr0)IQt^!m?Y{NES+n>^-!
zTky|d@?XjLZxQ@kJm&va@ULR>XEXjo)bnZX_|xVw|6Zy+xBhFH{4*K<@q&Mc$NWbK
z{%uVDAme|g;NR&n{}jQ$lgU4e@t-O9cYDl#h2S5zB>Mc9&-mXU`1g3sKVR@qg1@`|
z^<OPVkN*z{{;~UbyZ*gL@XuuO>%U5l`oAdn$H6~NwQ*mzy=Bh{{vjs6{;S|@dwX13
zFZd^T%>TaNU(e(ZG5*^G|0Iw3w+jBvO#V{Ff3*5gi#z_Lc+7v0YR?^iB20e$Srr}s
zse*r+$NZ-X{yzLejPCruhVjoA{4+e}&lUWW;cw@eKL1rP{$asC(_{Vxg1?{1um5T^
zI{uA<f4;~3j|u)2O#Vv7zfJHDdCdR1;9tY!zk%_O2>w+b^M57yw=nsu82>?Phj8mJ
z>@ojtsy(;<I+*-7GyaK!f33&-V+8-$JJkmDa_4_F<3C04ulJZgRq#)Mzq|f#Vf?QY
z{F^-Hzf|zgVDg6<|LX<+W{>$R1pj;{|80zao#5Z*G5>vne=U=LG2_2R@Nf5+{{_Ln
ziOGKl<NvAP-{~>`zXbnICVvg%|C`_+@tD6y@b6*r-^KVR4CaqNJs$HPqS|xEpQO7~
z$JEPR|4SMFDT2Rmh`IiZ>#MT!Kc?!=_o;$^8vNb$e=p-dQ}B<2KlP*UuMqr0O#WKN
ze}Uj1?=k-kf`6FF{{Z9PAowSF%>S_9-^}E%WBmUq_$PbJ-y-<8Gx;B4{J$3b(>&(?
zQt<cP9X<c+8UNV5`Ss`bn12t|o?CzM@OS6`qm2J}!9UYu{v!l`Ka;<K@jqMe&-R!<
zUGUFl@-Jun^9BEq$Nag1e+`qrk@3Gp@UQTg|0cn|k;(rQ<KH0ohdt(hSn%&)@~>e0
z+XVj_kNIC0{JWX_s~G>yf`7fo{ND)v2}`5be-q=suljx@cm3b!F@LOT&#nIy_`B=>
zImUmI;NR>q|51W}K9hen<3C;SZ}FJ_Y{9>Z$^Qc5Uo7~yd(2-T_%|{6n;HK*1pf|?
z`EM2c+nD?>Gybat|A@!@PYV7$O#Zcu|2u+zx5xZ%2>x;RnDyt*|5q9Rh~V$r*Ia*^
zDykt~^!-<Ye;WMV>)#et!?w44=n#JW$HG6(8Vmk|ReNszXEOQ!!T3)W{Np|5KSuBm
zGx=K?|17~j!DIeQ1pj&_{~L^dwcwxZG5?K%e>;=EjqzVD_@{Wx|A^opVe-Gt__qoE
zevkQI7yRSzH8b7LbN&2t9pk@6@Xzp=|69R78UF72e~<AWu`j>=vOVVCPqpXPUpAA!
zo$*f*{PR8LKVI;!VDf*+_-6_J6&~|nBKS8l`PVc4HwgY!9`nx^{9Bm(A2a^-f`5(2
z{0|EL-Aw)t#{Uh$zt&^^zYG4c`oWxfx%2;1#(%Tm-{>*_H-di({N44xf$@(Y%CEmB
zkNJnI_T2i*VDf*?_@@j0EgtiqCiqt|`8yf^D+T{HkNGbZ{A-!~n;8EJ!N0>}{xZS8
zjmh7|_}?q|cY4f!r{Leo<o}xSUoH4|d(8ig;2&2Teg2Cu{vQbbJs$I~6a16l@2>yv
z82>GTf9z0i*T3Hi{+Uev&5ZxB{rL4C2md(L#(kMl-ARV1_T2gpG5NQsX12XOE=?Bv
z6FlZWM)0p^@^>@-mkIt!9`j!$_%}28|I7GS3H~V_^Is?UN0|Iu8UKd_|1^*J?-%@i
z_nSTK&i|ho|FwdDhR6Ib3jWFPxARP2|MoEc8wLMNkNG<Ue?OD|SH^#b;Ggd?|2DzD
zg2~^@_>WTyoO}Ki@|b_DYR|3z8Yce^#(%otU*$3X*@AxylV1m=$DcC6KkPAovEbjq
z<lmj~uNC}jJ?6h#@Q;1KBz5P14CCJ-_}6>Pzeey+fPb>u=lZ4B-yp_6BKS9X%>R|(
zpTXqUf25l3{~^Qp`QPj@|6Zy+H~;gQ{Q4_})IVA9Z}XUcg5Y1v<kye%sQ*QRf4j&0
z8G?TklV6vl{?`irogVYg75qDy{Bex`LxO+AWB&UE{~jj){*3=W1pgk7`Ck$IlO8l9
z?XLe3jQ=-+zi&S!Rxh=@`n~M_vv8B(p9X(-{U6Bq580nze{t}qe)Robsy(;<LQMX6
z#($FFAMY{$QG$P%$$v28pCR}sdCY&V;NQ&TAI1337yOew<}Vlg+nM~M8UIHG|1^*J
zmkItp{lzNva_4^n<G)_;_j}C$zTh7Ze|P>L#`q5!&d>i$kNI~~?Ya5yXYwa9{^JGz
zY>)Ym5d5>5{Not^>4JaAWB#)R{~9KL660SY_*Zz$f0f|h$mAc-_}2*jVUPJ23H}{S
z{)vqL^MZek$NZ}V|86G#B*y<^!N1;P{tpEIgk{m|Kbi6WMeuL*nE$_me+vBF^?w}W
zA3uU$|IHrr4_EEE^`Fn=pUn85Ciu5_%&-4`EzZA+$$ui_KTGg$_n1FN@NZ)Br!fAv
z3H}`(^Z!-wZ)5VG#Q3ig{39OoKPmY4F!@s%|91udZjbrf1pl~)%=&ZZ|EY}sX2IX5
zFV@wIUhmQO-w6I`@ORJuX^j6q2k`4J7XER4z1aC5>OV-e=jMMVlmB$af4txy?=k-o
zf`6FFpU(Ja2>uBk^PemD*E9LgWc;rY{F6QApCkCUGx`0D|J{OripTtS2>uZ!|2d3*
zli=_7nEz?PKmK7eQ{DMLjq!h9@Xzp=|82oP8UF72pU(Ji5&W|~=Kogk&t~#xF#bai
z<kx?`$NYm;dv5(#F!?WF{3i+i6&~{+CHOZo`DZZx7YP1U9`m0k__r|mFJ}C&5&UaB
z=AR?@cQg4j8UF_b|5}gv?-l%G>&^Oe=l^Ale~aMX=rR8q!9NB5?)uMS{5J{yO&;@a
z6#O%o{8uvmF(di)*Wxk%?}C37lRumBPZa#yJmw#x+H>o_mdQVp@lO~0J3Qt;P4I7H
z@&_6Je8IodWBy#hzmv&7i}7D9_;-8EzfkaxdnEe&m(Tb=EBN<#%)dhLPlCU@{;y*E
zKNkFBhbggo(d$k6{sX~3lgVGm`0o(><KVxm>)&mHe~8In%=nK}2PmCXeLU3fmEbY|
zSk<0efAviM5aaI`{F6N9pDOq_Gx<vy|EmQ56p#7y1pf$=znt-3D)^^)%)dnN_dObY
z{=0_pe^v0$@R<K4!9N-PYIEPK@6Z1;{@)A!nI7|hE%^JH{MR!6@dxqqKi^~i;i^41
z|0|gMm5hJ7;2-js|1`nBhRJ^e;~x_It32kvTJUdS@>enbcMAStkNFo1{vAyIn;HM-
z1piu(`Bw`5v5!Tc|Ed}Pe+mBe9`m;g{t57R&wsZt{yl<!lgIo&3H}*O{xIWzz`^|b
zYxbBwPPOOOUp|xnHpc%r!N1L8{-Xu|S|<Nu#{VM0zuja048gyN$$tmqUm^H+ddy!Y
z_;)h-YZ(7!f`7zg{#wDmhsl2z<NpuAzsF<#R|Nm0hUoRbl=0sr`1|%(V)fe9_1{Lp
zKMnrw`oEX)-(CIt9@>ds|HZ+dUhmTPzX|>!CVwsCf3)Bq?=gRpYR|3zFq8iQ#y?Z=
zPx6@mLczb8$zR9#-zfMed(3~W;NQ;Ve~9s4F8HT;%>Rhs?|VFY{?{}99}50{kNMvf
z{Nv&8&i_Xl{~dyVrpNr-1b;u1zk%^TdKAC@vOVTcQti3<pUvc7&iH2u{vnU~FA@A}
znEZ{5{{q3k!ejm$1ph`R|5J?rQ-XikWB$hl{|+Yq3da9E!N101{<j4GZYKXK#{a*9
zf4#^2KM4K_%cIwS6XSpQq5S-B^q7CNYR}F86!^RA|2f8ghTz}qG5=o#|9mF@YR11@
z@Ne;$zeMn_V)DPh_%9Xw+dbxABKS8k`I{O4wSs?#$NVn}{%uVDml^*q!9U_L{}+OP
z50if_<G;^ne*SlR%s)uA=jMOh6K4In^Z!-G|2V<lH(ZI;i(c>1_eTr<Y4CTS|Fkgv
z7YqKe@Q>^3#m@gw|MLa^OeX(782@Vp|9Fr2=L-H|CVwmA|FGbn;4%LLf`2`e{|&~!
zRq#*tnEy4wzn#h7#`u3P_@{Wx|Fz&BVe-Gt`0qc4Uw?j&`S(@rx%C&{XlANA|JO18
zse*ro$NYa1{FCADuK)KK|5<{6w#WQAf`2xXzn$^FQ}ECCn18Y0U%}-6knvwD_*Zz$
z|DxdE$mCzo_(uf)Dv$ZU68u}3{2w#^BNF)eU*j?VeyTk;|GSy|9gM$U@UQilf2!ag
z`=nWa?)?9h@vjv88$ITqC-|qp-(CM382_gP|0a+59~b;HnEanJ{vCpUi^u#Q3I0_~
z{!YffSMYE1nEw~Szn00riSbVu%g_G~kNFQ#?Ya5i#^mo}{Lc~mJ3Zz<L-6lp@_)_v
zmka*g9`lz7{&7!5pZ_9^|D%F`kH`GW1pg%XyX*fu#=l+gj~$`J>P4?N>HBvC|4b(T
zX2$;~!9NcEySo0}BKU`x{973R0}tcpe}c#S!&G~2{?{}4yBYse1pg$D`BMb{W+wlC
z8ULW*pW-opK=6++`L{CuRf2z-$Nbj`{=TQ9&woEN{&j+XhR6K(3I56Och7%4jDL&Z
zpXo9G8o}Ss<o}iN?-Km;J?8&H@ULL<_cH#w9nP=6kjMPJf`1K@e+T0~TJW#(nExQv
zo?HJdOn&_#lRbXgd2xo|ANH6(P4Mqv^6$?07YhEh9`nx@{9{*`q&BDi{!0wwf4AUY
z?=k-!f`0=1-Sgid#{Xr(zsY0%zX|>sO#WELzf<sU_L%=O!9SnLzc=GQD3M=(Z65RQ
zrrLA!zm~~Agz-OC@Nf5+f1=>u#N;2!_-6_JogVXFBKUVQ`QsS>zY6{lkNK+v{~jj)
z{*3=B!N132{wD?hq?OU@U;kU<^!WF&;O{#?9jw)BSJ!_Z2>xmCch~=cjQ<Y7KMwx3
zzkQui|Do@<3H~7_e>~$q?g)PU#e2*@R<(~&{YtYP#LqC3|6s;{y5OJWG5^_ue>0PR
z6yskk_$PbJUm*CmGx<j|{&xueX&&?6D){?WMbG~P#=lAM_j}C$wBR2Pe|P>L#`u3I
z_-A^||E}QgXYwa9{=W+T*&g%%Pw>xX@{eQu4;#m?zmUiLhpP76`m15`Co%r#3jP%y
z^PegBH!}IhGydg*f7oOG62ZTN$v=_te?;)F@tD6(@b6~wPh$Mv6a4Ev=6_4@Pk1JJ
z{U<a2I|TnmkNLL={weTx*Z*;h|D+@N`QPj@|52(vH~;gQ{F52~*@AzI$NVz||0*W`
ziHv`};NR{s|AT^m6O%uM@&82d@9>y^z2M)*<Ufh=-#^Lh|2@d{Lj?XQ<bsF1_3f+L
zbNjys{xyS4VSWFX%J?5D_$Q1u*MHQHzK<9D!!H=6d;fVV<A1bjuaz`^68!bQkLA8h
z)t%%x)n511t~0yEwqHdGn^dNa)}D;^ww?X?@mQ<0#QdZ*V;Ai|(+}O9SO0fD-?^$i
zxBu!fel7Q!0DAvTWyUW{@PBrYX}3WA{Uq*-`j-gpCm(FuA2HQ!y>r|wy-MhR_Ic_r
zhF7mf2zCF@Wcptv_-9{X{4>?(i|#AdeWQNAPVkSNZu~PQm<HP4&-mXCe>#7fD~*2x
z{v9@JYsb(2Tqg8CE3Egb&o{1bcG}j_<5w&6KXbn6zyD~{R`>s0rvEDi|C_^m_BHH`
z-RZ4=v;DTTQSh(V|1g4j)j+8I&tv@6U;h@hc6F2FCrtY_s=oW8{`$Qt8}-V+)AT>-
j9<%9uB^sxO)W)&L6@7Rxd#ZnlnsMg9cYa2HPW}HMT9c?I

literal 877632
zcmeFa3w%|@wLiZ1IXU~B1PFnI5C|kE3DE?3Bs_zPoFpJYc|R1j_T&jk$%{M$#7Y1k
zv9uN{R%&aBpe?~ZXoc2TA3U_h+m~%^YkS*k0By0h_itMtP)qrL*P7X9&v|7hdhYLk
z`}=b~<ear;*36n&vu4ejHM2Kc<}JL|q3fFY(Y5bt7G|bu+R>j54j?{;eA;ry632zj
z&v##NYP%lQw8P%Jv~#^q{osYo#||8I`hNwoo%q{@zul*tnFr5byf`w5ey;Y^fau3*
z8wW(6q7~WGKiB=v5}o_-cc*r+EkSE3*R_=%y<@pUPgw_Htn76rA4L1dQ$IRe#!m6L
zw8B<H+jZjNMb3L?Npbgu&BwXV7dD5~XNdYbwJ7!7mSIz$kgo@_^yt3xCn0D0t<|-|
znm*@Os;n_?EblDHyyWtZ<<#DIO-rG&4&B!Se5Xo7`I?sXil%i8H|sISCy1ZRo}XiU
z4EYVQ=T|ZzhWz5~`E8pNLw>{T`5iBaA-@s!{Ps<aA-_@f{2Vi4$ZxDYzsjN*^2@U4
zclyd0^2@d7S28<>{POMj?VA%reiQBaWtYT|U!gs}ZF6JDZ+buY&5t3!S@!%K*Ts<E
zY<qtD7RHcYu|2<SOJc}xo;|;P%VNlHfjvLR${6xnWY4eih8Xf&X3uZi>KO7{WzX;U
z%`xP6lRdx6TVu%YR(pQ?{4wNLVb8CmGKTzW?D_4hjv>D~dw$t#W5}<;p5L~*81h?h
z&+qiQ81iek=U37gLw=j=`R!|tA-_-B^UH3HA-}Em{3_dH$nS1@e)~4Wkl%gw{7!F*
zA-~Vq^UJ;?hWvKf^Q*iwhWsA1=eMsThWx%@&(E<vhWs9}=T~`m4Ea53&+quXG358S
zJwL~%V#u%Co?pqQW61C8_WZWpA47iMvgdbvR}A?bvFEpKcMSRU*z<Ed6hnT`_JiNU
zG30m5o?qo7G3586J-^d?W619%dw!06G357Sdw$0siw(cC6u<tN?|di4uQhFWUoq^{
zUx^J*j+y_`zK{E!h#|k<*z>FWW(@iLUdptOGl9xOf}a`dw>uXw=^~y9oa#sao{VAt
z-slIvBeCJfI{K!N=Up~Bn*H6_@MInROF#PfR1Eq3)t=w!o*43b*PdVHGcn|M-k#sS
z=VHk3f<3>}M`OrOFSb1g%svrAelB}{l`qDSU%WlPeLsjHzajSg9RCqRe#7kfo&I6}
z`So7hySz`EJ;I(}$xr&v&-UDSls&)WFUOGISbKgYzlb5ftbXwOWeoY{+ViV?HHQ51
z?fE%=8$*5*?fF&yE;jsljV~-de*k`HiQO9iUxKGOw?2~JG~K?Br(cUr9}kePJ*)V9
znY=4940l07?|_^>)qh@I++iV~-IPN_zi_sF|MtD!f1b8Brr4g}=|9Af-#mMM``(Np
zzXko^_vaY$TV&5K`|TL=TV~Ji^xtC0Z&k6_d-kzU+V+m%XX^P!n(uY?{oD3#4Ext$
z&+quT81h?h&+qgHvEj$|ti5l0mVKfByn4l*zP|0*x9s~@@~{5$?8}~U|L*R)f0Y;e
z&#Pbk`=ovU_Gw#Vcb9OhJ-^d>4Efz^&(GnEA-@WHe%Wy`<aeJvzY<pr`F+NoU!@U4
ze!J}Lb%|T>`>6K%Ecr_{!Y8ziO~#1lN#gmSy-ZJgVkpxi_WT?PG33`{&#z=qZ1}Ma
zy~)Og4(>lMI~(eOZ|(Vl&>7sj9&Wdna3uDhcVBA->&>J6kn7MG@_WRdUu9AZ`8{sW
zZ{M&O^6R#@HQR;@ejnA=@c4b*zJHa;G3?*7{opquhWw7%^V^mh8-8cWj=m_y&u$Lx
z8x<R#JccjX_i<l(4Eg=op5O7YG356%`#DjWDfq=?PW;lof7w~F>E8j;ncsjPe(4<2
zf%u4>z2`Ciy}eAfjf<g7PTBK2o%`YVdFYuTJR3yMYlX&hSUzuj2>HBeKZg6p$7T$9
zJpN+O&oMDJ{8%P`{SY#F*S?M03S!enmWivx_H3wfO8@y`UId=&3)K_m7jMsR+qC}k
zv-N$3*z>EL(SLrn{TpV_&oQh2{A~L-!k*v0t76D+RLS{HX$MU^ZYvYrzKtbwK3p3;
zaoV!XLTx?f+e$pcxHDhZc6onOdrp0>G?L9?T^wuQuF7Q}u3ZszKMS&xF?LgSp>g(o
zD+E6?-(&Mkrb!o(Uv5A6t%@PPe0zCjua2QSC))Gdc5@8*725OL_puoAn{Lm~;g2D|
zS@!()Rm70rY<qqsRsH8@Yln*M`JJx*X#8kC<By+Z7tc&<DG}%9Jo~m(*7m<Gw(G<K
zds~qG3Bk{_DIdx9EVA$4>2)#e-!glC`x;`%Z<Rg2ZB6~>7p%L_cE3AFJO9oS2fuG%
z1a#_v!*`zEJ8+ibNWgXY;(2*k`-W-j_s3}~^9BPRqOH#}w3Uy77JHPP*x&A=cM?D!
zcO&M+&-cTJKd-0lT&|aOwKzU6&Ir03+IerBcDQ^-@p&Bl^0WWD9ojCG*_DH{+|$k!
zuA^Mjrf+rldW!#fak{GKUEoJNo<}_^938_^M@pnNp#9@BQ#^$ocvnKJu1!<xaHCAC
z-Z9*TUo|}$?;JoM#=o<q1TyiRzp(j)e1AfO_Z^(K_nl8K?*EwB&Z!Ib{2WU^9KVZB
z{bv_8>)r1rlO8y`FO+J#Xx!<Y4x|rf-P(E5iOzKG@H@~8ANds+gL0Sn?Zh}`&ePVv
z<kVKifgbl0cV$S~>cBzE<9j+m=m3?)J1n>k$|wEF0uAZV8I=b7h&CF{VT}LF;A8q?
z<2Kcv3#Ba`WbyPmg4=r^{5Z3{`0ZCc+YMjOmcf_@=quV5^zMq&Dlgf;yFee>rZWm%
zZ?b4pUv$*Z&!c@b23oPO_XKZ++-aVk#=A~vta_auo;$rxZQ3cM^~$-_WoXkdZuG8@
zp!OagV#y}jc$`pZ$~}?C!=$+?(wGmn=W%8LG%1ipmXyUQC**;Cla5gT%F*x8K2|2$
z^RF5JO)v2TKa&3`vUhSkD9sy1r*npOEPvgZLh|2Df90@$^c$)dD&6P^vMf>OMigG9
z{iG?tdv8duXzrYK`_AV>j&pR+Tc<E5pf|9ArLYHN1B<(1A9l$-&hE^)+IpHdXg|+u
zO7{T9nZqvargGj3nfBzp8y$F$O|U&lWq#WElaQZhgm(B{p_jWgIX9obR@AS~OSAsC
zo7%(XchzuZd_Q6x)FyL02{z}}Dd&js>imkNXO3j09Z|-{sn8saq5~!kjm>Q6fT?dC
z(CvtGSgAAW99C(h%?{PQ6QJ>eAMwq^FZG}Lt<EoRg!#2C#lGL$2S6kE_H$m12%c9_
z=bu6ss_$9wXH0#6@5U0mGbu>lgY4z$VfKAJGXNTr_3tnb$rhM?`)S<&a5665S9M|Y
zGu`jQKMTwy*mV@xd6wqSU|NqI<Nxl|$D8x0SIz+sXlO3cynItx=e8j2ByiVFt>+Ak
zGtDVVyASV;f<LtLaje0iy0Lwv)o<tk+b*gb@sGgzNp+ObJE~9z@ud0zvmZ#f$tS)a
ze9kKKkl^>Q#%*_K!_9ek8a|r2)=@tBdZ(PJ{j$Z|(@1BM1GYGt&Zu<4CoJtI{dk}K
z!WRPX5+hk*{Dgm#YRM_uTs$)XnkS(jr<C`TWy3$d<Ko4K%so>yow-;l{JHnx&%Jk}
z6E-+5$fsldflo)W>&zw_EObcPm)+(V?;Y?Mx3MnuImVfmjQ&sXiKI*WS(j4Sribbh
z%_CKpp8ttnxOJ$ulIkHp3u}JBCepn9pX@_v*8dq<nS9Q|x7qqV@O)JGn7vrXAP>{0
z<atjz@lwdVKN~XdhhW~5J$NZzTM1jXvkLQLagZ$#dQ$hV=r+fh)3N*y&JoO;<m{7n
z=YK*cRbKDPcj`s63sq>>>$EPSO+5Zl)_RpLY|TlaHD?5Tthul$rQPqFepadQvpmv<
zI$=Y>BWMjO$+mRD^qEN3<da4AnOehqrqUSJam3v*oaE5;-o+!&h_x)Jy{9vj_C}G_
znE}uofld5c$eKxZ@x;IE?c)E2wKV4nOCF}}cz(ckR;<~5*;$iMB>NYuwKQi!|JG8K
zuD@&Pw(*vnqOGOd2S8)DmYRDOyBJ7WJjX!BXXa_^_rZ5G_X`JvAHsX_Q`kSL`vuy6
zhtA{U)9m|qVgNKLh+RdDxlFa^b4H=@McE&iG~}~p!<P5TeK7e9)OU3+9C7ce@Q5~^
zrTwJ&FU)^xN2p!3+q?EP#<bU?IG3l~*W<}Yd^1a1e;ng$#zWO{uBi0&px<F}m-0yC
zTx2i*6ADeVeW6JcX^fB0><15p#*Bl7`uQg$4dlw>Td~I1Q@O8r7TI?(#)!=pOW#1o
zdPB$H7}lX^v4g(kACLI*9LSu;V4KU5JNu-PXJ2#7>kgk|mGb?Q)c$BXS2X|{nq#55
zJ|D6Qo!gaH+mA<;LIeB2zE$XWm^7s86XlptjGW&4OZ!CXSLToO!g7*1=3%c(o9?0g
z2x2*U9OCZ9h`Y<!RtI8t<lhZK{+pXOe>=g;F~gp9*qf0qXLjkcFb3TT6ZCG+9fR|=
z4(tQtx)6`gJa`6w#Ea^ty<F$do!tcETmbR6j^*2Pt+@R=XxDe6%+E)ay>^7yQjp(J
za!tqbGfK?N8^w1h1)UmO>;2osh_Y1a?nnFD5dZ&-^dtJxOEvx-E8D+MzQ>bf8ci?v
z4}d0`?LS^>uZJfTnrOD)r1`M6KU?7ut-m?_r1_|}KM+SLh5oZXQ~W?bNb`qm508nA
zq0n9<x?kNE=2veoQ{?>->)1P9TYnn!h2o_rvA&vimtfkHiM?n){EP)ko1)C269b^3
zGcs=kn|E66dlWur20%mp8m)D`uvyt`^TgRA#d=5vhy?}KA{w)3_Q835|9n)HE_6*h
z1^cS{tsybO-KPEcpVX~0i<EKvkh*2o5i8xwmhZFe%Z}v?fQEF7V$Y~Acr940^gW7h
zl@5T0bZe~CE%sZXKLgdP(xv^=E0r#mdZnJDl%;5g$%awvipN6g2kk4P+pqAmloKly
zIe)}Do|NUyd0CCK%25Btxzgg-AG%OGNPdg3gTd!BT@if2;|eb=iVmF^01fG?utSzl
z+?O5Nj&~LJEAFh&h3ZSOC%PT#g`HG&+55r8X`%CI-zxH{>|@{iL8rF$=()%~l}h)l
z@TG$1t*TE^WL`P|8k)D?lRlgJe_D9tI^K!%5IPH?wVcO7>Yy1PGtV~=CkvcQ&^bk@
zUY@y$`fr`rn){`XQcvx8v8OCStkfsgGx+c+<KbI#TmLS9yPVpQaS?1_wtN>f&+jO*
z%ozX;$+9nft-2*x2h8~yDl3&vtdZ9LI})mYC6Ft(zYo8+bO1EehcnQJ3!9%s9973T
zhq%LJ>cczG1=<Jw9p@Wl8+kuubS$T{qxYOnmU}sLg!V)yaVB8yi)c?YVrg7{a-P-`
z*b^PnW|{TE<{YGbkM4qBMt#9Eb`fJ9P5tQa0BFjwXQ8`E@7+i;7I%|O-y>4o%8Y4H
z8$0A&sJ%?w)d^h}$kxz(X1YUDlkMwSGv3#;_S?Q$q2s;(R?(+g&}7DI>#=88S(~U$
z=X&$C^_7VEM~s<(uW7H<*jUG)@O`_(Z!b5eLeq<w9Q84@ttJia(Ff9|NO7F(3i~$Y
zC^V2u#5S2U6hlLsgY0GY$NRxUq3M!i8rtt1Nkiu_v@TR&EJ;3e-_67;F}9R;fPHCe
z4Z|EhNa>+#&#^w@IyC>(JA~#u>1+NG53;KXkil8RBjOQ{xK5dOo^e`td>&#E$R~a2
z@0@eA*vrs40Ge_+=iXKB1NL{$QU9o)JXdf(?moy6YtPQRa2|%=KJS}3<-66(G0!}7
z_Y$$OO3XE?FQP7kF4Fw!jS!Qp{Di%Xss=z4szc)<=ys*-54B&5vVK)5H04or+oXZb
z7P<_(Li<CiH?$oeR+s-bt|h12?8ofP0BB6T4q8i2(7gd?_xm|?Z@`81)abr&LXDGX
z2M=t|q%%pLyY%~Ebi1lr^o7dCBi2rF-+gYeZXCf~-~+eUo}>NEf|`z>;{nKB3$&wu
z>&?-2y?43ZZN_NKJ1}Nk<Sgu1g`5NXO0}P<YfNv1{lMv(e#mnGG{hh0K7p7-*_w`@
zm!aM7<>=j}jNU{%$HVqa+m#z(jvSYAA-P7IBPSFZ^ZYQ>{+l%PZmlk-|6IkV=H^$!
z-c#(D>JDuytqUY`lCddYb?zM4?mwsA4}53IweUgaK~Ly@U}^Wo6W0B}P`{jG(dHd+
zdG`ei-_8!)-##kV$erYu7sH=I+jc#Uzhb?sh2}KHonM!+=T691b7|+x-P&RE?oUU8
zHjVb}C>OMjR&KN(+o}Q32;Rcin-*c*PTywF@5}&b=x+Ly2z<={&w$1-nttrxVBZ##
zhWK=lTu~q9TMG3Pcl_B`h*tlZe#p(Fp*>CLp5WqkaX0Ba?k1h{JE2E$urscp`$@lc
zbSx)5yy(=<ckp?uKE62q+{`qZJMd>H{%Ov8@^R0D&wKbIJwERkHRxA{HtaRTPmj{Q
z6wr$pL8^6c=i<fby-0ub_^ch<9HXwM{=W}B^8V}Mj0vcN$~eHQ3;89`$N2n(`GX3V
z<uB0V2kp=Y4N53n#PE>(<@xs^?Fpn^hrhuS7c)Mja7BI{(huqhgFc17L4`{gA2M+z
z=TrKStfl$Y`0WOr6Mvm(hyF?51JoAcpQ?=-B-$`zhx1lnPh7XJr_+(jG}I=d8>yuZ
zB3kwAH6HC&@AGCs2EERaxN9;GvYy+0&R^Pn-n?(J-I}-Now0L%2k64@jL|$ZZG$G)
zW^+HR`ZOLIBlvM~5%$%kpAx!h`Y&Q!tou}5ap8M`)3OZpH>yq!h$icmP#NhtbY>~;
z;+*r#JD~C|&H>DcEthHQQ!xf3X$;`Q#V?q;W7<}I7u}yE8F)r&E9<bok6)0#V_KGD
z*P9rVoDsgBIy^5r2YaM5D1$pt)9AT@V`<vTH=(P09a<0UApYTQlk|tqqMT~W;~p%|
zr?KAu86h{ykAJi{ANRD^<rQ|0?nE7&7Vqn!c6!jR_z`0MmMeAM<*;IJF3@J7POA6J
zXGOhKcF?y<@=4E!%vzSeS0A*FbUk7AqWmB0Lk8{Gx?^-=;d0jbH<A7yNE^~qnoqj@
zJZPUl{^040^Irq}L%{ceW+>(W>Gq#U*Porsw1a0Y$v5eVX7G`D`4>^<EtGi)_+G%o
zYw)wz2IvB5N9G4;18L8eMW9;{M)$ng#v|9|54u(BG0Rgr;naTm9W;Gu{@|>YJXfi2
zPohmJ_*KV99Uqcm&gVp&<P8}wVtsL>tZSXJdvqFfCb?UT#}>!Pbz3nPGo7jHifK;1
z6*;DM0`(EU8xhwq$B^n&`NpAM7j%*MZ-2lVL(*$6_DU4<NMYU>cRB-h37RgP0f+9l
z%zakM!nl0m6S~iu9wDx`@6)2bzUJh9g{I^6$bB_w#zf#zB6U-hec1fK93vT&ekj_k
zSN`=czIz?yJ2>S3k<wS+oC;0X?<4okq<KT|!2Ry$y8n)Q-1Pqv_f>b!gZ8pDX_7JC
zwHPz<v8YalWlXA^(vh|WepX-nPV|GHN%ME!14sTpg^7n(+MMdtxd<f%Ki5@tm*`iy
zF*l!Rk4AZ(!Ety0&i$RBQ)9Hz_KPYVbf4|57G?jr9d%OMOy4*3|4=r^&%<jR<{A82
z@;~_b#^EBaNafL%^W}JN0iLrQA1N-FE$1WAMr%vX0BC407dkd(TQ%G*p*Cuo(1&tE
z{wB!ZMEN^h{-(;`(egJ#{$|VH%jEBP`8!GePLaPe<nNX8_Zs<IB7d(HzgzC~bZ@!S
zjXwi_F8sye&xt<={&f6l-J`^K1<lWGZu|MMeE>9}ax?$m?JoE@h#S+rfP-_!Y3n<&
zhU5S3ro9Ho(dOVes805+MA}*SN11V2VHaZ3y`b&<ZSA>CUHhx1?HyeUeQ=;JlozT~
zCO_gs`74>Peo)76Io9n=@UBID#Ft`5^!$|vd<i#sc5vG=$3O7fymOKGbU_zEdyw=o
z^QJ6*MvHifcU6QxU($uU))c#=ewX1n$1=p9D2C2=;vCvadLDzGnR!>n(5c^E#HN1z
z+wybo<GCjC`Kf)Bt|1<L4C%+P_UuE99lj`ZQJlBZuQo(G(iCBwD@WLmbCp6<o)9_S
zYSO^TPoXvw&ogL0euMO?QtnMDzf0N&nm1+{)1JMKv@EPSwC+@)jA<*VoKN24>TkJR
zZj+Ez#5RqzWMH<5^u&~J#5SP}+RQRm`!bMnc4tGSY5hAJQt7D8bT2UU8Jb9UvSX=#
zi2bnsJ&L$NB>g*@pdGn2g8m&(w`3p9MxRh<ywRSGl{B*ikACacnK8k-h52=u#?wx>
z%yMHw_}PuWGvmYQjatr5Z=87cM?F{eMp=hdy6AfI9O4E#zq7zxkLeBs`M&6@IO{_k
z!HgBrn%oP1IQZ?Ug>PiukMzWM^k{#%;};}bO2=5Ar(X|zs!rHJvYFE(=!e5&uOCi@
zraap7o{}a#0*~x?dmcFhped*Rp`YY0sOwNU<f8hgs=r{`H+7xtf-Z)h`HX;nL2Cw;
zorAma*}OIid+WL5jt8FqMBce}@Hg!#9I=$W*Wr$vN=N4$STj7s_TKFIWOx}q2cb0u
z`Lq^3@5tmjHM*DkbMFqUPqS(heLZwm<8f)ra4y+H=cVRZY3MnzhJK*U2ajQFsNEe{
zZ*M~zSK&NYU3ams;&u0=T!+<m(0WV!sgJLqk5oq+>KJJGPPBi7Y(LsQ%xt?FpYOst
z?imc9z@@G4{p#M)w0?ULC#ByGHE*QIi)33VPNu;Y;<?d-$JsZGJ9rm<-^JJ=26k`@
z*8EQPC&c-90{XWFKF3)lEmHr_qR;V=L3~}^xjN`m{2jgrJj3F5c(Q!6W}uDmfo46A
zIEtu8JU>O}lhhtcufubp&m)$i=11bwsqlFTeU8MZ*O?k|t$`0Tp5A@p(a+7y_xO4!
zj`9Thl@HxL>-3EGzz%rp#QVG??f5)}_J@)-Z&@Dq3;x~uUbm37hWcn6=(!NBVDHTY
zbNg|&VdA0s_a1yIbIxd(m#{r-<IQ#5^fR3DeG#?fbK{+m<~=WO6nc8+h53vcJ-_&_
z^TE;d+lBLoU*f$gH^gZ(vM?s*+>UtX4)0_*(~sxeN<nAxqCP}zlS0>)s`YT}48P_3
z#D2IO^M=Zc=i-9zI9%BLboU3?JO5*?1My2GW{kab2j*^&3}tMx7WGk_81|oizM51k
z1{UPQZ6P^~IQR$Y8`gr3-fhzhS<yV(ig(=XHE_=XztqMu(q*)p+G@7h?1Nl$gZ#>U
zciP+V{R)jYF|rPrG<BFW@8EqlTS#_t?*^N>e%)YkSD4PlC{9k#G1A%D`}n&BZBB!%
z<g+8YwLyXh$w>GGeaom6dw0{PTmb%FC+5ybAp@aDqi_#T++(6P9YOq^<b!wgtUCz*
zs{&~>u9T)-ym<IL#)aTsslR!s?;pxo<&O0ATt3y;L*uj^=O(?*(FadC)4*e7V4U(m
z!{dbYgU1Q`k~W7nJrCtzKi4C8zA|sB)^iN`)ZVLPdwZRuP*>*oR}gceaXp4Poi|gI
zS;sK?b^hW?YG2oR5!;E>K5ARl9cJ57xouSDDC$*X?f+O?0^Ox^vhT}x2|WWH*5L=s
zcVl2&-gU;o_BwHf;TV5TuAwZeDD!*!P@z+`v=@gxAb*GGqs_e&pf_VBd&v$!Hm|@A
zd{@_IkPRStQ2C)4+uGrfg`RqSZKWf>9r?A{ESqJu*;<bq`Q=gO0Iln$e}B$T_mjjk
z^5VQFWZrJK&Xmug-}DXxT7PH_HqVz$-5?zm`^~;}l-^$fyU%)6`*Fmw^$~+ECSqL~
zuJv?c?s_<8qwVU}w4{W(4Mq9!2|I2`>=^FVGk+D2yo3=QKhMKFp*v95;oNr1c=(B!
zV{bm8byJ^7K2%>Xok>AY@XK+$4i}$U>^>^TDzv?(Emv*McI;ctwo={VdCZZx4=Cmc
zwd)mUK=#8(_Qby&cLVcyjI^Fq_#BjW)S(^8LE2NAHsdbruZyK!N1u4Ch=$hK!x!8$
zDUE2vm<xX9{X@uj{O*6cXA-?C`~KJm=V<DWwdahchdH2o9cwf3AepP@$~yajv~FAH
zR2MdvbVGjv@1BXYewupoq1w%REYa@T<t6#|8QL<BKH_>hv#EvNl%h@35U1RWaX*GR
zlj;eK$@(W?*Jxbmokz9VxW@pSvjci@8^+<RGk$y>^75b?dlR(v6-Y0aIz-P$QCqt-
z?Fa@iB}I;-D)auVTRB-IbL;u|Xfmf~`^~v8=4kNRS_^$4J4m|Tp|lhAO`|r`v#h3G
zu7qAv+mHU^;t{%cDfEc)MW3K6+_$6WFCO_%<oC61Q#^^*Z9dCIotj*?4}hmS-_`lE
z2D+OiV=p=5#2hluUH$=C+%mKT?m_xnUc{p4{)o92n(H8~fyuCGbWXe(XK6%x6!EQA
zj9Kk=e^Kp4zB3)zqf=XGtulQGn#0aq;!A6YSdUEp<@@jK7P7*#a<IuHr`~^x^<z8A
z&^sk){i1Ywr-!QN;cG<jeO3+rxksb5n(z1@%*@3*XwgRx`l!kC9zN%haZfMScTb15
z>(Oj&7mW?c)8ln?6Yq|sD0e3E?ERFg0nnKCZ3$#eae)`{OYeyDK;B{Pmj11Gn0EL8
ze1&}Iq&e<5pE`d4v1xPM;ZvXQz+OH+PV0fM-J=~9cG!peBTK;peGKxyN~YQOt5l)!
z$@j6D{7t?l4c+_yTm(MZm)rBn82}C4%?RzwzA5%R_Nz2QqWF@Mrkwf#xqTk;e9gc*
ziM^FxA>@g*czj2M_dS(Nw{Jt~0BAbE6aCyh8*QQab|3IOUF$huNH|`!D--A1(;~>d
zWMV(sGccMU{W(6>zWx&fprLW4m;vb#>?hW{V0#?8#!*a}{34Q(Y2&LQr%?SoG0SRa
zf9Pr<U-Fwf;2Rwnq)jKk-7D`=(|+QIc-DmMIqf4T)<Qo0UdM=a8q!sN-Uol4aAC8B
z|APKe-(Vw!KlWGHJG4JYuGva^wJ3gWjzZIgm<7oowBII87i>%c+R6Qpu~O~__HhyW
zf%N|MBNhD+ccQ5u)GunsJNWHPEWsI1%3EFV6GnJDetzVaAN(yf*VnC8Xg@pXh}-p&
zp`D+Bc;bkBjcxC1j+D2~LMEs1-Wzl8X4Xe>#!y|LK79b5=G~lV?{lJiIX;XX$3OYL
zly;Eb>7)%7?})6#_*6k>UQZTtyEj3b@m{iT)_1X<QeR%f-Goz#@M+~ZzzziMo$rpa
zcRqn<L{uN-qm-{h-0oA^C3MH+dfM0B2mk9plJ%Z-2tDbFy4s@aa0QF}Ss(oN&MCt0
zqJ10rT=z}Udg{<tiZ{)HZWj;7-fp-yopiViY4=31AKO-2^Cp@eZdYld#BqrR`|hyy
zXJ0>_XW2gh8d^)^F_+FN?`(WDnf4=OOCrBdi0%oXVLMw93!r!HmdkNI3ms7B6UDRc
zay;;G34E+G%CkfRrT5ADvHx!|>#rWZ`{69pcZ1%L-qBxwY3VNEam<Cl8AH5wgx32G
z=qlAiV@|)l*bj|EdgqJ~-IyVCV-9rdQJhJV4wdQJ^yw%^b#%i2rSe+=(_AE<*W4R%
zy#t&Z&dQHAH`MYSn7<XWpJX?vjnt;^;7-|A%p1BZYuXX>IWn(oua0qtJr2BIx2lTv
z1LDk)>gf7Q<ohcsT{YxR@?tr>fAPqVfD=q>mHONV;)`s9D)5^E|C8eAXR$Bzz(*xJ
z>BXKYUiY8-ghB5bO?ayqF<;aZv@TT6wRA&^)(3^g7iB(HfhN*?boApr15Sm;)Xz{k
zS~MNQ3whpm44;hOFyB_*<LE_S>fqZTu6!^7J{IX%Jl2Lf$YMmXHY=f9@5UbTJo!Jk
z$a+5hXL|Ri;Fm?ZKeBC}y^OXGfTo<!gCf848uRHe_P&SX2bY|iqib)KW8X0zV|Yaz
z^(Fow-3#~YgWk%*SSH}^(IBjYPhcISHLzZf+eLj@fPM}t6l);$+kAgv=-3}$VBfES
zysLoLPm@<)&+O3pSq?vo_E%Zb-!j+F3e2@_m~-3lYp$O@!~w{5hT2uKpJt!7!;S*p
zm4&~3ORRpCOP%h^_U`|X^eO1?Vb;ZvIn|G6<Es=JpNtQO>byxq?*T#Q*w@1I8h9^f
z3ih_b_aj?H{*sA920`(p{=_y;;Mw{}enl<DV4&qYVIS*mD9O*$J%hRt-!Wr5RqPjL
zj(-r(M?H`Djt_pYId<l_Rj#zgO^arW20&xRdc26^T?YA)9Lw-q3qJ<FXb<gs$(AF2
zJ&fXMwEom#U8;p&LvkcPmfrW%3x9{oltUiv$Orv0lZNQX*3fT%<(0GQqscq8yf=!h
zO2NmBMN#|uLl^4noI>BtSaXDT2w_bMzt5DMBF;IsV4Q1Z+{A-8Z#Tz+TR9d?J|e|}
zNq_S&2ILRym2#(j#1+sNS_9w5AH~6ML@bPG=~)Bn%WF96z>9lVVm-!Lhlp{~SqJ&3
z<{C}oNn_h-){C(`dg0<qqJdsh-ZIMbUAQ>ya`2#c9isA-Rp3RjdEzZ-M~<(B@6v(s
zC%;zpUFaDf;lGIWn)=lVpLmPIv(ASYCbd<Qv9?Z>S7UAWMDg?Y*HfLT2j7r>1D)lV
zv3~V^xS@MjQ|`5xcl50A8I0Y#sN)xii_%zBU@WL_a4b?tmbIqbX9#`g{Ttd$eW3F~
zqEXM5{)By(khicsEN}RIro36!vM%xmS-!yk8~zL7h%>MZ_hPI`E?XfFnt!GYDUEp3
zetiV?>mOB)XWAmkF?|28`cxP*UYF=TAdOc%&i^SMkg3P7dlWiJZ9FRX?P2!%USYrH
zq5Yr>^0SWLV{h9|41k8#T6%V-R>l>MVyr!JcrF||MRKQDLnr1(ImVFMOk+C;xH-0z
zu8u8)9<)EFv8B5m@p){^ulFQr6f5fSL$AoT6MhPFNkg2J>i;vwn0ONn>0TY~f>fYQ
z<-jSQ<_PV#)#rLCUj5G|y*tu5Gp#$+$78r>NU`f}3Fl^Zp)T?n-jnl!?#`3lHsc=q
z(O%52@wIqvhkWpk<K7+gj1TRvs0{~FJNOLKLw+&x>Fg;R&)=uwxgILhaeM~T6YZmr
z&lsfV;hq7>@(Iixif`lI&`!2X*w<}Fe4FM8(UM&v+Sf4euY;bLHpvS)o<loHPPL9P
z*MH&o)jLMZ=Z-}CDYiWt`Py#hP+!j|Z4BBn3T>IiZ82lmo{^&Mm_sWoH`ks^!}ChD
zjx^8}1=>7DOB?ii-YejK4Cw~=2{~LHBnJ&VLgV58Y@#zn^UO4OpFuLG_$0N_C)XOP
zm-L@xn}xreL|SVc0h_f2ca8Q#--rg~ct3>SUHd?H2K7;0^k=R~q4n*T^_g@>WsIpW
zI=bIU<9ZhQL1R08tY^mohi_IVo^uLqM<vc^sU7OxELz{H_&nF@8?~vww4}qKdQa==
zlmF84sUCV3|L-_Up?23M>Ui!G@q!t+6Nj^e@@>KI1l)35+qC6V`mEZ^@Qf>BT~r?9
zyp!e@t*_+I)c(ZT-Hp3Hk>1l`#x>2h*Od653YBLm?zho6Qr)%4AA$P$8Q~1i4lPT}
zBT9#FbnpPu;$JMD^`=9d$wnK?Ga+?SU$d}}p;$Q8k@+I}ggOa!&c?HV#e&aRjA!aG
z@jlGka6WcauA`xC-k)H#neI6C)xR9Rt0VeX4xVN|xg9Twc94HfxY^&(IHCH?t=+sR
z#W{I@=EZT)^=Dqtxw|<&)OMeY(}v1Kr7H}X7t=5=u(r)Q0GW1_2w9U3?Zq<yd+{v5
zUOW@97taRl#WMnX@vOjJJTtHt&klG|Pv|__meT)uME@^^DhqCZ6nhd%E9Mc|DD!!k
zU>jvO4pn@I+M2^;pQ<9*r_-S8&p4cs^-&+VA5rcj6WuJxjcgL>eZr|tzo0ojzU~u6
z*WtW}Y}8@Qby~-$o>Q1tdF)d{2aoG0N^7TxAJKk<`9-sZeBLkmXx^`)ITSW#qx#p!
z?VwY2&79v<AL&~b?0E_PR65#YiTy(8S|8~iPTy<FnX#t62!HeWC}UQMyVU&|vntT3
z{V9(!W<*y6xxEL!o7Vi3r#JnA?sc90L~T(X#_U{1>W<_b8Z&V=aTaIO@e}74kxk4z
zm09$ryrW{;q0qVM^al6qEb1fM9S=J=Ey8#?aF4q`{S)`Ng>54}DUY%*ROx75(Oqcz
z9fe<Rhpx@a{DIItbIil~!1o*kFIt1%L?3k6^c>jlY_i|5?NWE)-w53nKA?CeLA|qN
z{=XWaCtm^o=Yx3vtr<%~+NICGlLT@LwTHE>_iDM*W7_H~bsZ*De3mM3r2@Ap@I4Cr
zhyou{;1de`YX$z30$)(zVGgSe;}rO61zxJaH41!(0)Iw<yA=3I1%5$+f2F{0Dewga
z9*!3qnDWV0;8_a1P=Wml+@ipDEAST-_z4AmR)K%2z^4=#=c9r4xZ*50O@Xga;A<3k
zsRCCjaGL_(ufUHf@KXx>vI4)Qz!w!b$z`?eG6kNgz_%*!W(D4^z+Y70Clt6xflny#
zPZju#0>7)kZo_KZC<VSkfoCi5QU&%aaEk)pqreX<@IeJWp};RI@EHaEs{&tC;Gu4-
z&AAFZQ-K#LaE$_QRp5sd_%Q|kngV}cfnQVLHx>AA3jBcryF6AqhbnNI0%s{OHdz6E
zo~poCD)1Zyp0B`575HWau2SG;1-@N@w=3{x6nM7+e^G&-P~gJ~{9^_Fy#oKY0)L>u
z@$puF$0_h+1zx4VwF-Qf0zaU@k16nz3Vc$5f3Lv*P~aU2R(l>%;IAw2F$I1_f!|Qz
za|%3UkX7es1-@K?rw%f$s-~4H>B|(@ufPooe1`&WQ22Hz@M^^tZ3bN3Qg>TTOY7w3
z`iizSO)U+R8(JGC*ELtrpTDBHZc>$YiR6-8E-AyMNpi_DTr!83mWfMi<0XgSlB0CV
zJG|sIU)m~M+8<roH(uH-Uy2Z1ikw^u7yaK8Mr&!X3;Hp|f~Cd&(uE7=Enev_Td|<D
z(7$x~lDV3adgH?4#o?($J0*;E)rykvL?WFUi8MTsNT)?24NoM}>5)jo(u$}1sSp0*
zMN8+d3eTP5pSP%F-rTwK=0?g}Id5gzyycPdmM&f4r)opxRZJN-M$0H&6wYQzgk~)&
zTM$<BvKbK>A~_N}Bu8SlXx^gIr8oKKE-Ln~xM^`|7!xJGI3fY+ojb2|$)crUMFTnE
zI<TtL58VhWv2xyul@Sxe6^=;5>!s9iHKNqW8dK;mU9xyZxO#`C3iS?6W%UkCB;A@4
zR;^I_P+C+lHH?%h2u~GLAwmVyB32NdDkeyT3c||M$jn{3Ff6@TnHr(>ATKaA!t$oG
zo|00AWtp=kVn(DAG&wLq!)l^*YC%{A&79EMp_w#QBP2&+NqW30oLZR~JTXFRQ}V^k
z2_*>3k4Oy>b1GbssOc-``EOis?E-)C{Q1kn%JLivWkreMx=yL#94Iwh|0q=|l|Gf?
z1RGlF+G_kWrd{b>ylUY>Z$))=OHFHQR)VHxPo2_dcHxXZvx_3+=C)p$TkXYq<So0=
zTi5DsY-;niwl_C7wY1e#Cur2Ns;0)qnyNN5Bv<6uH8j`PG}JVL!iyjem&Qiln=1=c
z*R`5uxO{z0MT@_tvAVgbuCdKuT~lANi7Q42YuW-CoP?qkmGw2jiB)UX`fHj+TNv~=
zR<x;TZFNfs>aW=tMA6VxU89mztX&&aq`D?FrKPF8EvQIsQ+=gc1zM$|4K-~Q)fH_O
z{)URyb!rBc^H*;2SJl@+WNJ=TTT4CT7;L}U2Z$#CS2Z;>)U^drAup3~Eo5iH&FvOk
z)zrKxkRfaKH@7rZ`K#JCGCRp4IFTq@+Wal;^`h5Aq~fwIEusgaDH5TUfV8br^oAOv
zpzGUfS~gKaU1N2PXh1{t8cqo?Bj#)BL%0VeaFL)C*&w8Gr$mbgtEjJUs;a<bf|fwr
zZmX*jJtDNO5%R2RsOBP^-v9+yadg|nTcNZ5hE_4mEj4TFTH9(`{LSt4^?}stn#k#a
zRA~Gf**;mGQUdC!ln+qSq#$kd2b7jl)>k!FHTW@!{H=AOMU>iF*SHqbg_4`mwuZ{O
z2Ikhb(O)fQ3`72gb}=?<T54+it?Ps$qk?u+x2e_NT-PjQ)P|{A-L#=GIF(44nCm9Y
zqzfdpH$(Yr{A*k5pnLVLoGy)ke?xVh#lbQT!Ra-PJn=(m!xJ&k?F}`-g<IQOn`y9u
zN|RbrLTg(^n`jWFv^LZ<_)$k&3npb-jmW5MX{xBMs%RAj*0(od9=Fs~RMnEwa$nl3
zxGt)py0W>#Ov5<)TdFsemY4}Vpfahgrmfar*-}@%wuTi?QxhyX1SPA6lLlC^8pJyy
z>ThqZuWJ-WryBZ9O3v*eM94LON&_3fTQ@aU`5}_3W?_@5NJXSX2q1*4nuORSiZ#^M
ziMdtNxVElQ+D)-;_$e=-U{<$-(}}3Ht*MzcsH(OCOODW3;)^^nz10jZ(cJ2nY5tmq
z<~Gro^$m5h+kPxhRW*<rtw3a*n=3FRG_P3zL?{JfL%Fu5v8II-yscs_+fA&^LWXj|
zYDG%|oeXO*WCPRDSRuM3`dR^#Xtq5lo5ne?*pLn=JpGk5=o02xMH^;5w}5IBHkQ?O
zO%ta|v6&M?6`Ywx(yqA;YZCN_C$CCWThZ!o!kiM8XiZB+gBVoVHJX8vyfwIUX6-Z`
ztLy#k^)Mw+vARatFseXmj#-1+;DGMRdT8hx+l48UNzE+~molr7OjDd1R8u8pfpDhQ
zH&itH>%>sg3d2%vX>W#jD;lfoYlH{TQq$0M8%<D*P=rh<CFE_&Q7u?mL55_lzq-9a
zw2ua^rWp=EbF(=(Sa&zl(!b7sTa$DrtfcnFK%zCbgNjpf3!AH^c2eXuElmxkD@1v1
zEftNe<g5AHHc1Ok$*m0y?f&YfhKjnzASFe^TKyX;8p)+=#V7=P9x6mLAFCx7XsLnN
zTZNHTyHf?D2tkuoRg=ReZsDW?t#DGIHU+;^_;>o`DU)UZp0QAyio~f%oH}Vb{Q+9g
zcw0q%UA31^i|U$0o2?ZTE-2VmLyThCs)ITSJ7~^w$XCwBnn0F0uLF6Ji}@Ry{FU$*
zgx;9L3~M6<9+WFr9y60A6;^_@UF6W%)vRx?YpJQG#d!_cjWu=By&{R%HCOrTo7Psg
z3lAYU2{{|!a>Fyf(%atHQd0#bZK2iB3pIt)jS1>)s;X*lLG=^76|Jo`Eo2ge%igll
z-`rF$tPP58!Ytx(4_^5(aT?ni*=z~%(W(x;!Sau+rZsEou_`Lr)WBw`B6wD(sbK=#
z`-!z1CZc6xn{uTWG+t9c-Zd5IuGk}3l;)O(x)s=Im_yHd2;T8r>7~5`-K6kWx7<du
ztE`a~iaug)OX0J)fr{~w8>W^9ueG;XzR0@)@}kWR8JId~+wJD|2J=g*wb^d2uV3ZG
z-Yh^`C-u0ZWo@e*2(uM^WaWZ3N=3Id)x-GL1a?+ooK%94I?Ud9E9!arcxyJofemd}
zRH~5LXfRYuBt({%A2cLZ^X#Z2*Io_lxwfUExz-PJZBuu@Xy>h7u+qDsuB}#)AdFmn
z4UCxC^HABF>E7z58lf^QxRCLTN)@?hCb?v8)3@l<k!!bPAr>>6>TSu{Zo#{YDx<23
zMlYsg6}DQK-%X8Piqhh@ep85;`XUVJi`nTAxkpvl;Nc0MLt(5bh$Gtw6{y$*vm99G
znp)QR*R)H^9Z=)Gst8O7_+E;n{G@IEwz>w>Bx2S`Lqv-%{H7MzM=pckw)U1r2vAsb
zGko$P3IsZ03Q?Lcq>EjriCg<kGld+?u+=HhgpwPtv`n(ql|bj^G8tNlY5BvtH1L90
zpxf#YF2Hhws8d_OJus!p9xU2OS{T8SHa2;&Z85ddzhOOl|A8%jprcXf%;nt-3BUxJ
zRY2721<T+8a;&9A%M}YMlZP4@VLH7VpmWfJ_TW`5(4eSPA=5_EVNS#2u4$~=<YfyQ
z*)9)=c*UyH(s?UZBxuF;^<J#M)!s_D%^T{f+iFQECU_~GlsY&)LAwDX*0}acueCT$
zut->)7A(G@c;SM%-sSUFELpX@be^e<sv`34U~NsP^h{sT)O1978fwh(HJ5z34);aV
zP_fZpxxqV|d(v1_Qw?(<@v!B%y>VS5ydp1eGq?jnk0m>sY_k=X3`l&Ybj17$st;B*
zg1oVgM;3Qb*;YscRV%KbIZ+yGHpmQhWUNMo_X~%X^Ol>UMaW7<6#^<st80P=H<n!k
z+F@B*C`VLED7V!+@fyI<sCkbVR%Am(U0W+hnCCAqUcA!Vv<6j73LBl33l_~=vI^@w
z$f0*!01QPLHV>16s~&Ix)JB!VQd77)P<L*9yO%6Inq&$=`WAi20hVMoMxWb7fHZHW
zp@tUHGK!pl;9+pgZD+{b4``MQ+|w#-7L$_i2Z^+CY>=?6;GHqFQn6sBqut+j&`N95
zj>sf1sC_j9ogtHJN~6z5ZUU$8%NO}gGvmi;PvAURO%FOe4b7mlySb|tExIXkSvm-e
zoU>x(T>re%MUgX?FP^(#MdYj->C~(sN?y>JxY|@Yu`8Ziyi_^yRkMRmywwcIByhZ?
zrjtyfW(1vQs-;*O5sUF9frvSLq#rTI>Qlt*z*(d;K|#xhoLFs5G&h3{0Qs$CDcYL&
z>`Lg-B-0|3aSp6>id779lT5cnRPU$7Jana^Mv-F_F$mD7hcxg~bbu$iAq+|#?QTP?
zMTm=I?E-{X5G*2-IHV498{1rgh#<_l6uecJFo3~z*%k^}Izo8D-Uj>nCR=IZ?DC^*
z0?n;vxXBLTZ;B$IWQbDv>#>)Xaf9H_22;x>nhGa}sI<iF0+d6#(B|$S;L5W~37)c+
zKxu2|5ZK#>v^fH4lubrIC?hsfY<t2RiP2y;N%d=@SJ3xU5=y`Um#u<i!Dkc{X$mYE
zVre!7Yv~60Jz*`9*%4JE>W~Dt03GE;oSnJIt9WD?kSpC@h0{87XTt}>=5i}rwwQN4
zWTaF+A-$`ts9NWxn6OvGL%pO}A(|kyHqfa6cexi3F*>tiWu!RN8{Fmo))m?WcE{m8
znT;^H$-WBv5R@NUgK#mMYeJ@8<Xw(zW_0S%+U0g3#Hg9Al`)$TQA8|bb|@tLB}|N$
z{b>=7GV4~C7c-4wokBrOr!aI(&4`|vPsToYcF2&QN)XcNh;}MC(Ncy$i^AgvfmZiz
z#4V3FBp!*_bv5>0-pWl7UV_$+ICg7u1&-|3;lNCu0S0y){jDXWujT^8W*|gV5%a8`
z+pZ2ullokxJ_H?wtb>FTG{$vn8*ws)IVFNg@MWZ$DV(HGgUXo(+DqqmYa#jE>WSAV
z+l|101_oWSkSb=$Mj_ziqA-HMnkGDU^8hC>oMuzlga(YMIY1Vp(C|{Qvh$V~ZK1Q3
z1nm}zOlZr+0ao>`wC@BaWV8T*%9f_J=wYkKn2+-_Z0k%a?u9puDo`0$99|WY&5A76
zLDe8RyjKD7N&hQUX+w-ifZUwaHc{S4<0yiGVFfKo2S!Y`>9UOzuc57Pu*4&eo0lR`
zSg}wW%gAQ+i>eb>2G$AHI@UE-RJGOJR@b&kL{~Z57HSxA;sd#h!$h{`2=up@l9$Fg
z3QdUgiOQ59nh`Ks6ypmsxBVkVi$l7g-k{+4VMx9dWMFtAbr+68q%$q0v-T89N2%8o
zm1fT)u&jhP-He=@MMD+jO7BXFfd}M<DLesN6K^XH=^@Rv6?F*L2I^N@3qp?Kz?e~p
zp2GnVMvx=yIMQmS<5dpJm@PrIIAWAOK$ytGgZwmj@Wl8qgL*A{W>%pz&Gh0!`%a<f
zVD9GINvIW=Qha@qVC(h^H&EP5!K}G-GxE~SNY;o;HzUo9yOyU3<0J1-k{@vCW~4ME
zmu^M|?o-pnl>cjQM*gq4%U0J4M+En<*igY6?f1pD+6~tAG*lw*Zb|=-oi(n~8pWW?
zWt6N0g2L{=(Jg6Q;h_fu8Y=m=5?v(^)cC*TiX8QVE=S{rOW-PG*tI#D*+eMs!QomX
zt~!QXKPQ_1zg~yqzS~@FBl($^)JSi{M#gfXxsHagOF%L?B#03)RXwaU>#_FStaz-i
zya@_p9O^t;^dIu3Mj(tBdO;%GX%AekjkMVq@Mc5`C(OkT>!IllU;4cyflCs&B!Np3
zxFmr~61XIROA@#wflCs&B!Np3xFmr~5{QKa%!l$~QP=;Mb(sB_NKdj(tZ1HyM?e1^
zKf(RjP+!sb@7a^!ezaHpd-g&T53RN~G*4+>+g#T)5zjDBL=<ac;Y2(r{qOYQ@rcw9
zytL-usUMfx`Vl2i+*sYxgeT|oW=x$iZAxJQF0QxYJ_KDzm^yRj%%UmP`M4X3dtQMD
ztP2Y!6-=7p&8ux|Yi_-A@?<>kK{ZTT+th?N$%xCylkl+J<hG`!dR!5!Yn)tPe_O*u
z9Qb?!Z-Md_R8<yMtf{Unm{CwYV@BbuidjWdXI50sD4H>&YR$BY>NQiQqA7(l@-^*J
z<1R^#-sj-Gq;otWPR`f0IG*tMzk%`LuZRW!|F<Ku@4p(~&Qg5EX)a1}#TjMzaW5j6
z5<EKor$<e5Jm{>TUt<lv;u8pT-l22p?F9eh^Y}XSOMpfvzW6^+N^-`f4hEue{UbGo
zsYqO!hv6hNFK*OehO-GCoiv2#znBU*z1P7=K5C8|b5<aa5|Z(@Kn|gSahc}?@}HEG
ztvR{O8-(O~oLXYKlz_|2y>aM6iNVVbV~{h6ph-@&c(7ArWGW$vPW(6L_{=6G$(h6m
z^}rbBT*}DVZ9s-QS2I$N)*C6#az+yG0g~qIWMt>PKt?%tGV-(=NV;>6g^YD}G4k+z
z$jNjb7)DI5ydQ|yc~WQWi-hGkUl!Qogk9!*RbX#W^YWd&0&{*A*ktG10=t>oRNy=(
zuy|rU-KjaaP7hJebb18FwajuR39OLvu5x+>b`@dQIP(NHkFa8Afxwm!R_ZJgnCk&x
z^PH;%HW>dmu5qoiTwrfb0aoU$6&Q`IvA|g`u*FbS<9cVaz_=|7of`$#O0_I@b_%SE
zuqDm|0=sTIu%*sJ0(<f<V9T9P2`m#sZ>(@0bqptYl7<<poVxBlsU+Nh1mmPbGf3%-
zB1kfsh*Rjx=bpp*NF(m{37w^uxr>F)4nmvVC235PL~yB>;a@_(+;j67{s0np&nsZ~
z7f=@WwMF<ZwKZ)orC%4PXI^cg*T?A@3c4^(AFH5?;`A{Jx;Rcxzgo02$@L7^Z=emX
zXGJ>&?9mJsB`fd<WOKjD-QQz+?#nZRp5*U-Hi^@T+Wnm9*N-Uu`PEwDO#tYVu#oGB
zOYo)EAt|9)8yS~S%;h!{UIH3Pk&;FQc2O$vPW%$S=o6naDlR@fj>|law0N&*1H)Mk
zE%8N3=t<_8>UJ1ELyG%X_~NS5+z)YKCkc9wC_I+nFNlGeN$|r-n%e`w7=o|SY@TS4
zoHS~hJDYMYryLqxr;>9u<rIgPao&J5&A0{MY|^|5?$2^79z%+Ir)b491n){?%R?;P
zpGy-q=_F-5Fh(GpvwKW}mQHqS%n^J!HDeLz@!vJW&bqC1pO#MP8APLDIDd;@mO-BT
zUgn-@pyE!!{R)EblLnO(>{DVuM-aS24Cq?~f7+`V<3OA#q+t|L!Rh$os*?u)nybD6
z34>o1Rlh{=Z_t2S0E}+N7Z-KzA&7dRC2j^tAJ;XB_egM1S>i4eOe7-B<uM*XisUnv
z`OpXq&JcW_L+0R2kEH{y5ynrD7Rr)G?JU)u_;>oo$2BYQUlJTNKaorweFhC>zHW~}
zO*KX%d2}wmWY5QwI40wZTU0Pa%-Rkl49OQQ`U=70g-{O>e1#C|_XwUKg!)T@CwjRz
zuMs>cPxI0gr%&9F^ehJWTjy_wSW(?^#uK2*X4`axAX*%9jHCD-U4cT*9|F>hm+{SZ
z$@ndxY|1fS2bAd~dd+wn--4dC+kmEs4sA^Q1UKr3NJv~KI>d0jn0{oQ5^ocoBatR<
zNa9KRN21^45xpaJiJOHDqfRB>QIuLk1fTSc^d^3i8H~pNjG1_+V6YZ;E^&*1?;yAX
zV~RR7YHZ^6a)xP+C*EDlFb#U*J))(|;9govHSHxT+}W%p{tDda<2pPp&h>51qdDYy
zQqyuNJ#FYX(FYp!p}B(F2sCNvWg?y7%ab&NI>tktmUtc4LnRWg7bWIXCl-kkA0v20
zk|6dBy@H9knh6ki1#-EX=EO%hhXuJ;RKs2964iX0s@X56A?!xtV?L%Q+ne~+GKR0h
ze>R@jy;@XQkn}Jo{sIM)z9=d@11Br#OL>AIFKIjz6j0(7f`H)(f+GngX`<lB@T3%`
zCkvl6S&S&B7mTs$DfGfGK!t4C3Oq>}oW*3Bf(64~p*0T?>nu;e$|YrcJeO^x#GEA0
zNN-XOmwt>Aay8bcLj+$&qnJ)@73NIW(n<Pk|Kh|zCb>?FUi=(Xt}}x5uL*t~wufpl
zeuuA2C*^C#S$y*_bR<2<JjvQ5eO?rcM`w~A@+eG(V*VqMOXMYfj!XDyP#zE^?j(4(
zXh06>-sgoFXA`_fh;9+VUx2u(K`fRPQWfVWpu!LuBr0QjAo~HzAsWrt1CY6Q4janc
z$#M=$65Pp}4I3u7Gdx^yXE<4KXE?>nWoP4i*oZs}PAy=VT)tr=ix{SPG%U@>@UON4
z9#zXQHF4PJW`;+hN5j%LGE6gc*q9D2v5Zm3y&!Rg1P9$HEqG#$O!178wpB=U_!Lej
z`!al*=o2a3@aaNpNacsm5dHfWD2Eq`KDo*OUj>PN2Z=+`FzwKg<Ru1s#O?5ol5aGG
zPfm?XUTp}UoVX<4WC)*}W?b^kMhcf<<Q5~1k=v<)j~iY_sMpDUBhMnMGA1xWdYD{o
z6fi=KORh1BtTJm2pM}&Jb1h_@QKljbRYYtNxH<L4O3v9$&1o>ieqlc$jYc^;;}4Dk
z(qu>{w_r4|^~TG>ktJ6-`8LDnWJ(&}<PC77Eo>uPU<=!1tQJ^iIw)^9$^}O9Pu^_Q
zDwKB^8wHk6lv|7rflVcBtI;Vi?!c#wf;i^DGW?7&O<=cYfbxE$NXgq}_yqP9%KMx#
zS76Nj0i#S{ahb^5ZLAhpB4J-P$`#5-jShh=q`dvc&bZ4-Gst`=KW2EI5}BJQ^Q*?o
zLD;JTV=;9by#kxD4wMItvjQt2>}!U{Wp(MBMw)^hGR6d9UIqJ>F-~BtG~YJz1jb@I
zVidS|x53y`1|0lpN<t43GSq~pkuX+Gc#et`DMg;AB5J}9sYsF1f}a>Zf#IbPTJp<A
znZSNk5A5g0Mg{wYafedw*G7lHSl|E4=v1)RjGY4GVLM~&QLxvI0}ACE##2h(pN*pm
z_7~%2f&H1<^0v{d<o(siGg$h};crHfz(!y#On%2G6BrrQ<adpw3ih6{T419Zkax}~
z55j7Lu;w6aqk^3`Is`V3YWauJDKH+j4~(4x%cs15!f)hu@@O0GLqXV60%KisyN@cE
z$9+<vOmM#(guN;$iNj!bufTQ?HpG2SU~|fWCAst5%$>1e?g9l%b{7fkAu2b*?GxC3
z!bZE73he8I<+@i3?7M_r?k*SDF~aiQwF3JgVOO}D1@`wAU=!RM1vX<nuu1NYAgoit
zCcAeEYy?pjxc3N*Wj4iqNMN*hB~NufB`{jSlc&3n3hdXdz-GEn3hWeNSG!*p7)y7K
zyH~+{?y~};1tz)F{kFg^VE>eSt@|B;4Q>Ng<~}Dda_*8Bx-}2WlRUZPMQ)G4@`!SY
zJ4s-?&a}AG1U7~8+TC7(T}{{~cb>qmCG3;#0)gGX0N56Hk-(Nx-d49yU@VF4?lOVh
zOnG;?mkR6}lJ(v0)iQ4|uzTHm6s*(TB{0_c``iZv_MO{6`DyndfqBT>e#ZTjz}QUR
z?|w$XKI=Xzu%A=82izwG#`Et%_sarXz6E)E+`R((7-0{)&nlE(a=$IGHI(;=TZ?CT
zlB1FQWw%FQJdgIe3k23ol>6L83gv!xnZTI)WA5g7Ht*!%CI8Ot=@6L<Zw7kGy;ETK
zP&H@Vdj!TEeA|6M!T#$0n!s4te{&xa7^}}e-A^gl1@}>fGTC!d!A5vq78rAw>UmXQ
zY$&FAdKGNC=d8e<q?XO}ydAIQkpr4SE0rfj1VuiJMLwkjz8`ra#uxDA{xYrmM8nQb
zo+J7DE_Mz!&@%r6mzGa?ywaU?d4z+*VtUD?crO3p68;JI?nf@+pD^-cmvBiK`H4$-
zA&mUgB^(b%e&#A?u3sUpuefS?7`e}{x@0JE68R**ah(;x!>NS*r%MJF8T-9U1{P;i
z-f5TS(8g2alagnPF7ZfQ<I<QDyD@WI*xZwT(8rU?BG{-W-zez0WveAUBR4?=M9Rp`
zE+Gy^ZgHhqIUjR*E#y`yC?@l}3ap%RDYYDGZ-pwgDphLLs?=&!sjZPx<Em?2wN}-2
zu4W7QglnUPtaEi(NWH7mLK<B=Eu_h{$3mK2T^6$5b-+SeT!$>A)%BExw7HI2NW1H#
zh1}+P*+MqCUbT?hUA-2v*>%=J?r^<rA)j=eWBuT6-|5n<;BxX-mq)?2xsnuYyDLq>
z?s9n*>~2?{g5BdPP_TPlMGE#QmrucVxXKjl)2^io_8He|1-su>u3(>Y)hgHnu4Wzk
zdsr>{c+w1V#*HFU3rb)u&P!gZXyr0hE0;;FWR+enwNfHt7s8sqLaL}lyrSN+<Ufdd
zc~<{X*2^?!WmSy4DND08{gYI1ikl?A<r>Fh!^odqmobt>dxrm(s?W&VQuQyRoWDuc
zXXG81PcvxCVO&9Zfi5>Ee^Kf3_tc5|jN0XAT!WeC+f@2l+30@~@|<jdL<*RUCG)&&
zfJCn599F2K>O?%MPQ;^fB2s8L`IwxDT)}bI$G8HW_9`b_<ytx=b1cE783d;fK^7+@
zXo+cn>ElV_EvrX2#!*2^GA5Z2kNSb+b1usQpNF}!8j2Gg3(*a)g*fD{lKbP78%aju
z<VKQB&LFvw<eb4q8CSsLJH%MZ2wUJRxm}dVYBfi6TjrE=&O6kB%Z*yG^7uwpuv*U>
zqiG{6#Xfv3!Brw|a4*5tB5rVm;2IG(AaRXcBjN@Oubm|-^p5bPk)UWv8WHcYY8;V}
zrX{wZ3i_nxUqL^f)LiCH-A%m=()~2@M?Zuw=OLoB!lEN5WKjW)zje)^UKme<CYMru
zBk%EXMT6nfjl5Sdy&4%KJ4Fa#8vLD+_YG#6>j;*??q-5_h^}(CKb@x;!%)ctu2vuU
zZBZ}ziX)#C^^)&2@~{X~P%B3s5j<#QMt(<xVHp0dh@~<7ln7r?>~>_2h@~<7^jMe@
zal$k5nK*su7z=$iPES<O=i>Asq98Z)dC_QYz)>+i%;=aHABK-l;|?=?LW~u|FI>&(
zdDM~b`w*_hgrQG@H!&G$^huk>j!9hF<Ukc^1(+rzav6h5oFi#nV-rc%^ci#u7fTv3
zgo}|IJt9$vZ5^mb3`Jm$RLy7ymQ5W=yj#{XYN&99Mu}k8!$=;51>cJL>DokM5tlq(
zgnOO=MKTT}CdDORAyP;YlPAak5F--}ot2)ENruBhCL8kbmJLK9JTW6aQ%-W8+TP@+
z#ZfPt*JmU(MYEEhl}Ejd9F<4Cj2v^OiD{5GdKF861T*>uApx@Bqi+<-!tm-e&A1ax
z*{>;ZrtcPwoso@hKd1{+LLyB6yzb$alO;%hNKazqotuDsK^I1b8kzoxE{qH#U)J-O
zjFG*%u&s=A=|!AV_z9GGRQEALA+q#+x-c?~?AJwr>bDD#^O!Cy4kKUDEhCeDKo@p}
zHdpBf^=hu|=zJhg=(UVcU(>&??_`8q@TA^lA&2z?7V;hakcE6#f679h(vMn5kABiZ
zp4MNsknicQTF5hcuZ29TpH-2!RYW)}+_q<R>98>NoGu*}iAje=V$xw@?0H=}EE1Cr
zi^QbEA~ET(ETjQArb~xqHDN!{yF?goGhr|3@^t!c!hWb96?u;k_7nZ2z_`wr^;ZS<
zBIW&D?-dvi$}9R=fsI4VC;gZD+X8!`0@&;NIf1>t1lS*SO@#5tHl@299)V4wa)TW4
z0&80YEY*>OQ^>2JspDx<9!j4ibe9`bD0P>SDN=V?t7k~vl}K7(?MyGyJzi@>d{RXz
zW|ux!s%Uu*ka<!?x$bNArISz4Y+0(WF7V=;YxpIltkkth-t=X<#bG&aq*xqQ=xG8g
zMf1~Fp}(BRy83Z_BO|vF!*acokq$ztR4rbk@8KL4U9D7UiU*|ENtMo{!C0>!!f_f(
z(`U?zM4H45jxshQRk#&*19E=~Uo6hmV+V__<cz~H?+__YMiQksCsWQ)Db6{BBuP`S
zyAH@OX$pQqNU}5qOg2)Q0!BtlIlo3^nNrS9w0dl=lyfp6rTS9M$ODs1CyktDOam;=
zGXy?22zRaosu?%on{9g0*mt?lwD^pDPZ+}&kU92!v5L}Ijy)#~Bgt><d9jNAlxRK>
zD<{MMv{YoQLw4#eYI>YrU~Lp#UB)XYDLjL8dAh~=GFeOgD{|5cJtIBoh1{lx;C7@>
z5pCkJn*~=S6=l<BCyh%=pPiab@HH9=T*C#pqB%+d9}3JTqEf20)FPU%rTQs-nKsUo
zzASYe!7FeBB3<kx*vM9EsoN=ijW#YWeNABTPhT6Cl%!c`ZQM{@LF?k6uc8UGz@%e-
zGFz^)Ax<D9?er#Or@lcPZugE%O23`SSjjhQsTU}{Lqj(^IGtpizE!DryBHJZao1q$
zbS`~|M@zkmB==b={aLHe@@fO~epr-d_=_M(ZJ-k0D1el{VU_r%;I}vqc~1-Yb_{9y
zvuL^TC6p)xpzX=%k&1uo<v0?2T26_I8X(`3IaEc)GjbM?C^DYa$M6iLMKt3%IVEUq
z%6MK`9W#!}#f^qG<G5Vh7&##qx0!2@^MYK@IOj#ZnX6`|-<Jl11e@^#y@PW|n=(%7
zJ2j&cP3AQ|&yjJX@ImMlJ7cv&7#-S~W!&TtIWu7aGH!OnaUFGp+~V*sLW0crm_ux)
zzDPNK2ebqqM#>#&j66;`RSq##$Z5-{cI0sm>3T+uqks`^Uag~u5$;mG!#8<Y9!T08
zWd(8g=B%M4;&$0mZo+L2X)NiER>nq$a1-c+F=LZsDHl3{)g<F~$7&1N?5MSnI~*Gs
zVc~t!Aq*@_;ZDb=Ifof-aqMK|EAvrXhhq;T+|+v=U5rp9F{9IQz{>fQ<7Erk;dqsi
zGqXYV8AmT8JV^ID-sTtuBM&*`lF!&4N0L5ebUsRa!Qq9m#1EHyi7I*6AtG)Re9ZWw
z14<SMb!0r^kgNO~3z7L{hg{`Z6ZbmgD$iJ#W3C7<F!rcJ1}TOtL%GKtGDwj^g8zzR
zwGQpkG@1z+Uv+rOML}-q0mnIg$_v!eZimNF;K2{KltQ5y2j!5JmH~M}A~#Z<Uy}%(
zCue*egUMaENP~IEktEy!#-4Pf2#mXa*pVhM)|~G;ytsT-0$rm|X6m@OOtIZrfuu}W
zuEdYaJXdxggg2-lvCS-zjuN9Ve42JQl|VQkai>`#$0|{1bRktNk_Q2~zlpD@R7}$|
zzAAUfmrp?34@k%VS@<Uz-SXu3*MuCDC%=Ct<O#VgHx>i=n%tJB6Y>qYEuT)vH|4hc
zT0*`hx8*g2d|NWzLdcVHTfUo+!*W~x4ML6>Li?HQJ4QK=%t^}mt|6wv9|?KNXyzP)
zX3W!um>1&-dB*7AoX=DOdDak<<g0`{XNY;Rt_sNWhL{(hCFH0f=EXM%IcA7?agvbZ
z#v!il_k^4<o?_(d)j(b}jxzEiLcVXDWQ4o$k|E~OyOi@E#;ck!0fHV~j4vmdVJAa0
zRdI0>iM-e!_0psiTUu|UFzB>p_BM&de&R&H&0=Yw^4|4gfnQDOEnY55m3v#oPWA|;
zw-<5xF@iU)W;kUM;7#QWla=${Udu4q2k+))hDlSscWh*sW{mgF4h!D0(}Fv?7*3@6
z?>#g!$&1wvAF><XyRCK4dk-eO=w?!u2wf~jk*v!!CSSoYwz$+sgL1@f*gGM$7KnEu
zya?~a)HZ@A!71=g;$pM|^-dO52w1M*<SBX!<=XxPm6}QyTL8EzM3qioyczcjMxLCs
z)Sn?2;gpe{oKYNyiHDeS(y?6si8985YtC5aO13vgUZkT1J|`0iTHv}yc7`zuMco<r
z%0-6O;r+ai3%*Q(e@HZ!;XPt7-=Op_2+u8kGT?{Bz|JK2OI|KJpWsLGEcnY}kXKOp
zUNOkk1a}EucM|+)8Ph*U@V=!C|AOHCLJ`gq{8%}sUm*DLTFv++8Y3Lk;t5bxp`(8a
zB>n@CGY-U>aS@=KwAUaFG!l_03Nj6UQE6u>h@BI;$P|3LnfmG=YRy;(Jd>vdstdq8
zSu~@Lh{@=RdBYG%9`}DJ=YD)S_uxx29>BLSd5-`RN;J;RJtV4eGOR{j8;2O1aRP}-
zZ)x|Y8Lv`e=rsKcC9+8Pi?TJtf$5X!OvJb3pA67Vtc|gNhJr@(85y&zKy=2HE-i_Y
z*#)>t#&k&^Gp=@7G3|`mGAhl^!8I-~mq~#6&Y0uMV<h7mAU;<CBM(5x8O1X6d&gWL
zB`zQ5d}}_CQdb!x>;lY{(OyR8$!ISl*UDoT>S4xwdF;YoUzt31A*p99a0$c7Yw&fh
zFLBkpwk>pZF*2H#&c!ZaMJExm)FrGaFTcxN!iw?=yWAxVC!OnNtZ)g#xrdOIu2;D>
zc0yLUdKqE=<_39cvX97al&2>1uLp9IYqeNwuUZJ~7FV9QiZY+DkGbT%7;fvwUGiQG
z*XVc2doe4BvfNcI%8^ycsCLx~jGd-WxS9pVUO=;JkAmIi>Jk{)*o+OX0|H~I-QhYU
zu#XdmJ6-Z}&2I_Y>N=-T-sRH76%Kt7^6qtc1jfEZrz^=ts;3R2y!%}~pMrkY<?9eA
zds#bO9(mh@A`cn6T=ISicjEz<yivl9+vDmL1=+FuqRWS1E^*=E`Vy`aYl-i`&7qHL
zcp~{Y3=R#r8`-0cq0mnDL&`FK?&h(gnV<0sx5fzbdByEv<W17#-?@_*@k|5qU+y$U
z=<;tyuiMMW1j;$(&SRvAkkf9V@H`dHxQjT4CG)!5$4ETQi$A!_EaZ<Wa#kY4iR?`^
z=Pecavx@x1U8WiTjV22NK)jvQ9bwu?n{fXftrOX7jv~?&f+o{RYp!O@28?>}apumH
z@q^tnv1Am<9U6%~_bRzVdzx~tkvp{S6H+X<UTblcC$~fwvx@|tTPlNpjLg-KvLNWj
za_&4`Otn00)pN^a@NWen3uN$*=0fguGWbV&lDk+x%bIX2ks(ebylAFdrpquMV=MJB
zB9CidWd`-Q`Wti^)FT6%yGEDpK4W!yp;E41m(D+zYcNB6%%M@2?mlDd^@XC`U#~=+
zExL66M_vW2U6;;3jZN+r-Pa*V8QrFL3XH3{Ti+Rk?N+c(eNPbfC4prTi=BFxg6+~@
zRVW|S<z|36JgCdfz#1yIN0*xc&U;wT6XuGsFY6No#$%7rv%r=@*K)gbpTOt|vfRh@
zGJ!on*jMzW0=o)sS8lgnE3kQleNAr`7@4cwZ|NHa#*#RqcL<ERe@E|Bu&4D;3v3D1
z@;!a0z^Vv)PT!+YK5s@|xt8PlV<NAMC{O4I1ok*#-`5W*<$hqsXb)4~Ni#;vwY+4;
zXju}!(q9(k7<<)>(Vn1k|7k{LX*J6IJ)*MOG^&C=ak)8q7DN0kU<boa@x%u^fknbm
zD9_D@!i(q7a>r{7lg-J!!pAUAp$WpJ8bq^hqHw9`GF|SZ)p&LdKr+=}j0TiKkoPjN
zQ==B)NSN!Pi|CiZu}r)c0DUgMf@#w(znt^Q1Ye#fXsN@O=fhE{H)|})72!8}z9UzL
z-=0Ng?o{DG{*K`3!h!sN;F(^obui7}BH=)eA$V4SW*i5Bc;<u5i1XL<MS7wcWMhm|
z5wgjuIO&d=W@xA;(@7#?Lx?2<3BsGAM9s(w5Wuqs?4E)z?rT!sXl@m`9eHC!U#aH2
zvFPh+BBdOo(xlJJpUd<_lRr<;6Oa6BJ)HhJ2=nI)3ETpEkY6SwP)_gy!HbTv@~=xz
zeVS;m_m1@BU(aP}D&#K|b+!=wA^|@_@M7x6o7ABHHrwLOFW_=CrulLNE+^V)qAk}F
zJVUhQHKHlPY1ITI3em6tuLg?epYZLbJ{s2tvW0U?*={<HPh3YJJ|6LejiDPGsMH<!
z5|Ydp=Vja)d0s|!<lhKM?jzE#nxx+RTdaoPDmux<J}x$xe+FT`UlC}z=mZO>0-YdY
z<2|!F&-htf9j%1puM*V>I8HOhz}96mMvX7Zogl*UJf9}Y6>c8c!$~+?;EohraT!;4
zGg7a(9Gf&c2<Q3fkUgC!=F$Tom?-BGahRAcn#?c`dW}6GU`NC^p-8YDhr9{1BwI$V
z)J2?dGUb@7?3ILEEsqA~5i(mYxlDGAF1!-1V2+G~GUC%G@G8q>#Rz>-rx_{Hi?o2h
zG$AFCc9ry*Fv0?dTHtVF71**o22UCu5bvZ^OT3fDh|!{`-=qxDb%wnO*#Dq3cRek)
zP;~tTq~uPKU8e!eohp3_UJ#~%%6JJhiLc;`TlRfspElunX3zaQD%jIDWx_GRp5fyz
zrpbjNo^Zlom}U5aXckN0#Uw4U00dljQsAk>?2(2Kslr}f7l2j*a^Hk6<Kuy}T0o*r
zldobP4<Z3|TkvebkJGOKKidD(XYwqArkin)D*R@k!X84O3!o<fO=kuk*HJF{Ur2Es
z0}*XKI48;Vf|c{4U>ye+()A*y8IjLmh6Ru7>EwX2-r}4u2e3O2Upy#pXZ)u)Z+~hI
zoX_7G8tchPLVhp9Zm$sXnhd+WK}fF*yT$o{oRVQTE^}Ij-PlV$Bg1YfME1H2yX6z|
zh77wg@&_4qW8{xA?8eAh8FrgRW!{uwx7CFF$*ARqwh;1`47=?j<j*qf_9!8LkzqG(
z&VS3W+qWs_|B+$06NLO#hTUEz<Zm+U#yNkNVK+wJkzqGR-j!juzfqa@W!NpX7|1yp
zcDs_0^D^u<27{jQfgyH}GYI*o(aT+6<X^^F&3G2F6`OqFkN+5Wri?fICIGXWuNi+L
zVwxW!diM{Yh=1T)sBb))Wo6?T^Z-tE%Q_|nCE`Kv0A4%+M2msqIcj{1I&TeRa~;Zq
zPa6U`yweEH{yb%q$(Bzoeg(LAf>9=XmlKqhoeWgS4^dHbG~@SyMCPL8yiYm&Y-*qm
zb{g0#a8kem58h)qLTP9wsx)(m<~n>ysV@O&ti+d?D}`f)0i!8cm>~@q`9p=7(n2%h
zl}4G7ENOaa=Tew0cU9yV7Usw!D003E$LY<i4b=X^T)mT#e}Hr0W%8JsdQo_}Jf<dB
zq%cqKVzPTmfaL23gjw(u&P}C<u?y$nc(QOF^<ATLsKRT7iJ)Vs!ubOB5glS7OthAe
z>*DZGBmnwM896R)$_UQ;7?P$S@DMl%n38PW=PI0$#q|6wJzCM0vceNw`~#}`1;K{l
z7ln0X`1@i>XZQ!wOC<V}UaRa&c^3R1!q*`)TKK~vPG|T>KI>j*VM*dJ8eDu_W!6*4
ztBowAih04B^3!n`>lg5a`wx^ux43yX?7W_e8%y!c#@0J^5OX5hse?sNXb`3*i=NO-
zoSG_navus!Ma0&)AAp!TdjPo~!51r1S)p_S#>_<@OebIhAy>+ku$Yjmq*gK6)pFfu
zWVTc>My`?TKH1sAIa1#iQ3Y7)SwkubDb;=Oe*ua9lWuE9A>jmyUh{%$T#Lj^ryy8P
z1h?W#P6-+&V=X0G#%BXi%^+nmwgPnDgD>vr(!$5Yj2S);4R~D67;fiRWJjT<TH#k^
zM;SRFJIZ9;vZL1$*+JRSUla0#>?k8&lO28eTI76P&N8m;8+w^$j6?xt)VbySB|@|_
zg0smbf&Uwv$mHcn(~KH?bN9T3xW9!IjWP@O$nH_`!Y@c?j**9DUm5w5E)IPec|>-c
zkuU4kbBu+1r4%@)OCO^dzYA^<83*TIxk2xl4cb_^Kxxo*vO(l}6kadez{o<$mXSr0
z6C;bIyct;{<;}=aDQ~*pS-4Efn~@b#-YkWcx(IVIvPxb%;|gw&;UPwD)K|0Q7+I~C
zGs3mqB+VjMaI@Zw_&)|!8ND}vYQ~@N&4X~LaEItKOX}0I&x!NV$_L=cr;i3CeIKST
zD*U8Ef2TTVThu|@st(#Vb<nn}gLaoXXm?9d){w;Sk)r$xHRWC@N=7<$+;Ac5K_AzB
z#&<yB{vN*ASg^gxo0iV@h78g)xf`YRWZGC^Z|D;1v<zV_U9jNOyy8A7J<>Pr|K;vG
z;HxT@xKFt`xhaG|0tp0?3j_&83DQClLJ$E(3<{C}LMS32-UJE79<fm@Siz1R8=#<K
z1+1v3*q+$+*?lUu_mpS*X8yDH?%tcjeGjki`~AM}{$MjRJ3BKwJ6q14bM|x$$)FYJ
zodqF0-Sj5eUJ-G6#gwFWrbKHCwrdAQ+yHA&JR>L@-ukxiW$_kn4!okg#cfmgs`3`!
zcPM;Kd5cHY!q=69u&etw<rB8P@C_9zycj6lr2+!Tn<^k6`Yja@yc<{ewt5Z`0^U{8
zfqnY-)uS5R@`WGR4G5w--hls5&7jEnNX?)S{jq%+*iL4)Pt<gJHY1;^=@fcCQ%`+y
zD;0jDwl5*zJGFg@%Kcz(r{`a(v<&lSM4@F-=+Y>3Z3Mzim>Rps9wQL{tz3(B!Y|63
zKz>yn?^i0`<2U7|;Gu;4Zr5QWbiiSR{6SlhRslDLiuQtB;!!YSYDACM(8|lW?CUaz
zag}=fO=5~G-eZ@{VOU_iDKjuS)>|?I1Ae<3<Y2~rM`mNd@5*e<?b+kKa+?20Q5TN!
zP>*}0s!(^Ys_G85W234nUxxSCqyh&P-bYXMc`p-B>fa)A%6jZCaxga>pyUAQuH*nI
zRdRszPyvX!@<4Oq?5R2>a(YpxEMSwA%g{(W?ZTdNrwnc1OWi5sC0k+dlprGMB=UY?
zpOlbQa1KGH!&ml|MZ<GM@2eIKyra>#NjV(I_p$n_H||+v-==k-v#!3`OQjQ+_mNg$
zA}zF{41L<mRWBFp(?PF7`g9ECv(Nc{OP~FM(rj%;5mHiSJcQq;Z9C>t58(rLj15St
z4R21NHgxsM&Cb7+8xTq5J!Qx5VG`R@?Kc5d`%P?X&%P2#Jc9L9Z~SA$)KBWe(bjXI
znD;u%8B}I@TM1~*T<%VS)FO=UPI+%plJyBC{42}L`c{D{4;BYg9>`=WYf9NnynLdL
zF}U@U;|W4U?bnmCI}*^53zYZUPa1;vH~Xpm&7+u29s9x(`*l~NX?{N$lG*TnYDfk{
zp*k!i)PDx-U{m`aD=o#${bx$++(451A4hLa+(iKY`saA}5Lo1HW`f7J#JtBTk)w%*
zbR!SEf*kHq-aDMbo|P*;hAi*9C=u60xJ4{E8Ka4vA0{)|LrjDWNSB>G2<lHca<Qqd
z$qtLMLMZt8NjF#SNY9C8BPYsZd1ps+4C0lIiE4*-qfZX&vAh@dlH>ARWO-ltWE&bY
zj)+t>N)%7PUIet)J<0>(U_veLU`oktmQ`8k>H)ft9@9j3$J2f(YVN}Wex4e7@PJ>c
zS}EWzc~Ff*c!VxZjYB}v)zAYZL#?Lx;p4*Qv|vRi%N~%1aN-M@0qGWCj<*3Bw7>HO
zu~ID4&n{fx%Elo**h^3CxfVU<woqPo;8#xz7rDk`Zj0TZCH3G(0t!!dvr#E_QQ;|W
z2nZfsJJl@#!d;_qi7Weu9NC3uxpGm#E-XCTEe9L!QJ>=;3<Oi-xvne(;fV8Gxx77N
z3YA&vE(Y7+8bX%2tAX^MM#yq^4G>-x7M|~J1%l<lh3<BZT<q=y!kw$|a(9<Tu5dpG
zf~O-_yFb$zePd_>$)f~Kx~uRU+3w=$rjSmn0(Zlagq)|gyRKqnsoL&(jFDw(yX##>
zmaFY9AS={%*VwU?LnmcG+73o8P}^PqVB|uz-38<#wcV96j&fG2?XK30T&%Xcx-)W#
z+U`QmrQR%vuH>A{)OJ@bBbTe~uCp1rLTz_l$H*#gDat%wO~`7s-No;j6ke&eyYeRx
za+N18N13bDc2^1KT%)$TQn}5pRoh)%8M)4rmN|lv>pf|iFe5j3J1y@V@>6SWc9#Ph
z+b?Rv>3Yt=J`Hj({P2w%_d&{_8_-n7dm@&Hf?sXX2+!Z6+20f7RvpC!e<Bd=TT-ar
z8$eeYqq;0YkX{*pKPsq1;Zdq%BDTh=j>+R<;W#^FdBcgP$b|y#aV{s8cMMT;39w2A
z%3_-f3~VbsldCaM?R^6-%5Hfv6&M)G&kGI=QOzvt8OGHV{yoF(rEFUYl7Su6HVn^x
z18D{C?I4cSmnnhH?1N-FWs47LF6H<Dw1aYJH28^Ge~q#ZYzB4AI#98~BxY?-x>7q)
zB2owCf%T<g%Nmp~Qn_CbY9&(^;MQ~lqnb*{#DSKZO{nFCDTUj!3#Uo9x`Zf&(^a>E
z+h=$|D|Ho-``*N5=vO$!^VSk9;#iVAw18;|VZ+^DJ?8Z?GqM#DOCPcf?^8;1Sd{lI
zXQPQ=78u!qmX}U_z%W=|Z77NoF(+^tdjBCxgp7j;wfeH}_*eLX>y3+LfQd-hVw$$2
z*$5aRE{hUTEl8G}o1!^UqPv-BwEs&f+_|$bMMiX{7t)E22waSIsR4;%-hwO)2J&@I
zTA&07+h3R-C<DR{Da;6z1HmI*nE@H2k<%nF0y%71VOBsM{>~pyNYg+ia<J0P4paeQ
zgA1DlWGF}LHV-UD4v?Hc1CV=JK#RaqAlw>-d4ZK0$q%dsl3hhPtpjU-Ok|`WuolR3
zM-$Q^u%R?m*hU<&fXA)2$`N-lQmBxBF>m{TbwGY$k?_J#A(f4qwL^y2mh8&qCaWAQ
zH*NU3c<@0w>IV;!CG~V-99%B%zVb49@Q`2#-K3T?D(E_aAMa5s{en}72-p_sp~3R1
zCaWIYN2IUif_<e=anlW^=JD<(qJ;4S1fk_i3xAPHVA}oFti*2t$w7^NS788G{}ITB
z+t55#ioA%0$F1y?V94@XkZ)64Q=<Cn%d$8a#4dlumEbypkymMP;0+~+R-_a~DlErF
z36@twaO$y?K-7rBzlo@iiBkB6619hsU2YIIrEy!msa6@S7<tRhM-DW;t(F`eIp-a<
z<mk`HyK2dCC?oHwCC3a#-gnDs{X<HmdmEPi&O}^2NQcTI_SW1VTy$!$knkb}ci}wt
zrBsz6%Nxu@Uf-&!AJLe}<pWmf`A>*~ZY<FeSD|uQvGF5%<!Z%tBQcg|NXv6%mecN^
zcN-DW@+cN8m!W+dv(g2<_jDxN+ewfyVe&97k9kFBO*OObVMbIPqY9wdgr5JTSzW3u
zwcVd_%*OnZfef%b$;urO9w01l4CTPcl|$t1VP4w}DV3<^!C^>`5_An_A97&10UvC@
zBQ)G|l!kj%YPk1U4fm<iaNkK9E~^2|ZWz*U7GUlHL;BZgc)()7ttS$FU<2TPGknle
z+W#T|wJ8}QFE~I_3#koi&{A4T;7pXR<I;K3M4;#AgU;?9(kevzKg5uFvKD;=vf0N&
z#);@HEMl^VevRQ7A`bMhi2H=;^GV#31V}TXS-2vW_a>!9u0i;cxe%%b@ed-RXU@u5
zE<KZnxSSQLX9782T`d5)Ky_0f7rC-C4P>S2vu}+e0avI#%T>;~M)g@B*Q!1Xw(C@%
z-7<;TZcu#|$c^eUfycg_Th)~TUp(d9=2l@ifPg#P8md2)Mk8&lxDcLXdnzsxPnJ$5
zcx9mFSHx6taWF5x;$rY{*Q&V0$|qmpxPppHsSt8_lcnPF5a2Of`U(j~p5ZH2RkrMN
z4E<eQl^3j74IaLiRB@%01$>nf1mv0;FtO<s*GdHPWnaa0+%GI^A}hFFqVXvjC@R*}
zgAVwHg@ETV&n=4qvkxooZfN;18?j|6RYx9iSj;?It(LDceVbLBU9k=Pw=n&2F^*Ty
z6;Dt#Tkc`5=hx(gDxL?|dgj_;wQR<JU$BZp6)%7eC%q)4-{HKS?E0($1oE$<DC-af
zrp%5W1JJ&ecQjEkTxHFSu(pprL6TBScF@L)gEq^rI9eMzUR04ot%@p%ejc|fs%Z$k
zBO<damkw1(FGr)O=YVz+M+N;aU?L{ifW$@iP+F1F?>EXES|B>ukwe?i^yScHh)k-P
z1Q}x|MmF>njGf$*>40?R;hrj^A6Alw5>4&9@c8bHWgfl81b1`|XnFG~yU4}OXdZf{
z|Ah*Vmj3q!<ra=t{SPavD%It3Ybd8$^)l=uOmOA?k3wXcWOaoT-8NR%-$@kz4yN0(
z2g}Cd4@BZ&HtTnlm)5yBkS5RUHLalowoB+@g=?yB)(-X>@B4w`BBke~4yJ;sBPl_H
zt{t`r&gM=yY_T|-4II`WYbB2UVP{I?g1$sXP0-JhVGi`OWyA&joP5Xx{am@00{y%Y
z=xp(@rNw|(PbGL+iH4V#YIsGNhR-k8@C73P=NC}fiz)&0Ff{DqDh*#!qv1<uY4|ef
zy&QDIR!J}A`D56X4dCH7?T1~p6!41-U%j&BN&NTP)p^;&t_7XjY}j=&81Xu6*!AQ*
zIt`fE_;*Mvcs6*5TzhRM@*y;E74S3ch;urX{#hbQ7{5vo_*V`S@1P}&jo@KwBN$rM
zMsPmurVJ~VmMCVp<4Ssyotg^rX>+%fh=3`;nNI&GN(!e+)N*esoTj3dTcdEgidrBu
z)I<T~I2FP`W~mUy^}uX8K*PI)6iE-m2IY`$)VXAz?Jl33ZA7!Yrzu61XAPIf5BP#`
zxO(7>H~)s`1>tDkiyNLV)nxs{Tj_us-dYFT@B#@qlx-sc$0iPMD=y_-xZ#B*kO{a*
z0t;|x1nBIO;q4@V`2ODT_BEDQH$752RE$SDm)c7$p}0jX?=t4WGE4Jtbg4&HH^yd1
z_e5y_v$1f?`+Jm#OW0otb#cASiRIZdR9og39we9KXqQ3ik{rljPp%|@l&fv8!Bntt
z2o>=TCJ5dy8zJ802Lwknv&0Jwt7jfSZy`LFQ=t(p#mgMWBl5(XH!wZF8y)>Z1yykC
zK&Qvi?j;6^57g%wLe-L%o$tLIn+*?Qh0Dgf-2OO#+4BA!%ZQC{_&=37y;jF6zmyg3
zXIx=*Qdd~GW-L(`RX{qM*VbJEC6+gdMCe6(_Q>Pm5SBi2t~iGu4jFlZjEff%_sB3!
zNS6|j!GTcjj2y3vR7nvOuMV_)gxMzq^Rh=yXt|x?i8SetoCto1Qj;PF&d4c2J+_RT
zMq>-u*zA$VN)xo2N$|{)Cakw3!^f4--JR$}T5cT0<DymQ7^Z>5mpX(Jj0I~8)ot=g
z$5CKJZj;Yr<P5cwb}l1J)K1#fj708#-^s{%>Q>uxj4W6C-M=w%fx4sFbrvC)sLk)g
z7`fCg$7*mYBbV8-JF$?F%k4_!EMepdbr<v+My|GNWCh8{we~C^D07`%2L!fVZ!ZS&
z3$v|JH;Y@$CgetYDRN2~xk=qD9>&P6>i%$;k+t?3I{%&QmvF_km^^m3FiJ#da*pM#
zh!S}-+7-?<QKB$yh~g*-PQJiYyI(K)WMk>UVFMobXJS#S6&C3^R6S!w1Br1(U^&ME
zt$&!ioDvs|3>i-*EcGghP~@UOR3&}?hf8tik{k|u%R42?YI)}|1BSflCaro3?}lhm
zD1>Ar4^xJ*OgS{Y9pQ1eC%yN%G%k8jW;d7V%ZBmqFvs>RYAC}p9<yCe==}%EQ8npG
zpvwupA7N9{J6b4eljR*6B~D>>G|z05nL(*c&Fn63KA}a(x4bi=S<4902gMBbt|VLx
z<DE#@<ZdLIYUs_({sblbYjbe)Y2h}ly;q4UN42P<SUx5~yeP~kXc3unf^&#xD9KW1
zyyP<upGDQH$Ab$x+Fl>Z%^E@p|Jod(wYSkHc6F0sA-~`vxhGaj>;)^yeFblgQX@N!
z<_$!JZ~9)W#I@Su6!5WNYLv-ZtLUQ&inB+_V8wTJN41hcj4Lv#H4U535nmU!r>x*4
z(a7tbf|J#j{x6hWaEcm;_}!L*Q|WO56v!^9mjd_DuvoA_6(~BMkcIR>kjF*6&V<5H
zDoVe@R~N8jU}PX7W|@d#j}|OfVrH_K6?VX)Z}3E`joGqvv@GXNnQK|2^R1Q_66fev
z!Mu{u@{YiDjJLOnOGe9WWIiWxw7QMV8%CqmlRbb7WlaOPNM=}`-$#eUV<_7$Brf}j
z1$U*ZywS2^=JWAJca%JyPDiUxVXS1sN(^CL)P{c<XY^zN`;!jK+QIk%B7kc-y1T5l
z0GEno+^I(QQ0oJR59CX4uYronwbBZLERRnn_bw+8E(#uTa3)c$`-yObdSzxC!-vpQ
zrws7#h~ns_XRw9$GEvb^Ss$wWl>BIZMnS>PL`AE)q9T9r@JyD1P1cc82fpkYd?-D|
zfRTVQD+3<K9HJ#Z=R`SZ14k^^I~Jw_APXGX!^Gjz3yDh=INvC6fmz@}Re+a=ITsOE
z0nf?GJbcavFs-rHo}jAb-5Z4-i9%0Dp`8RZ<@$W!=DaUzxf|qspwt5S(9t`?Ie%9+
zu;!eP9N8J>jk=sqoDk~9-6H36rwj;=?f!=&vo1Gq&Nq&1$N>4#ky9s8=AVvCw8;6{
zk%^W^-<&<p+<t5&kbp}k+1F`2h44a|h*2`=)<ZQcOjGxQagt@GD-$s{SWXjl$CnQl
z%*j%Be2<(*NDFrt?UK?lDvT7kL3zz_0z0kHRd03TNcE6gE_o2x-mMc1R&;b13-&up
z>Et#D7Ce!#F0OhVvpHi2y6SaI1Vv9*y@08(HBwGtYh$nt2G+~nY+$|Jt%BjG`96`4
zy>Wo%^o@MbO<|u4r^3FC!G1O{`i7ajk_gVS$miV@mK~F)Uid^_zsSel6jowz_KSS%
zP34stdHr4W`X}=GyCWnIhnf#?D+NPW80xMR>^Ao2Xji?e`5I$m-POj|CdRvK46Mq%
zS+Mt*v)WxN*yoH*ayJOZ+i5w+xSI@YvU|T^b2-$fx|<_|!<g1YkXOjZsEs2&;eHIA
zER{8c0RA00u{d~SHTd}4$|Gq5ykIirq3fz+uJd!I8Dqe7a}1cF`X3M7ImfF02V^Gg
zkYNM~<-8=NU*OQ&sY>%wB<E#Ec71@n;<SnkIX6lH9<_3AQU!qA9O>?ya|>~KE_;V7
z;x&mteG3WVU;fqh0m1y$GOy)O?eecw^V(=ybmm`0^BM-~@}p#biRYZ7)R~`vvt=d#
ztiDnMI9KK+z%4^?9$<A%4Y;^e)Auj43O15aYCMF}?6LBFqu)Kt8mqo<1h^Yb+HXec
z;(Zi>^h0SkdOs5p<77!N=P2<NhQ_hVSN-ObQ^q-RfIZhW=V&J=7{*3A$%`Hp9!6ZS
zs9ZJFn0Df-Nt7{$KNKkKHzr5OS24MT@*wwuF)h`K<Ppwkqb`jQVuiFk$-0He{2SNY
zyMw^2`yzO=BDv_zdL}|?;q71!eh~~Ma=mv5&tX`+b#!aElLxb-RV+L81oI|nDgj`H
zy}_LJGC_1;atErt$6rYB_K$FReWTEjD0Em98W)A85R^5C68?>!m&<<|#!I`hA>(`K
zRm1oL<w6+ro)R}VQql2s*?D#2d&Bri3kg@ZNFU?8fpi|q_<qRa`F?zVk;lhRjUS*+
z()o-Thgrq><K-)jvsg&Ep?HWWp3n3OQG5o&Lj{IG2WLxxUJEE=6kThNAEC9Xbpx~>
zD#9S(Fm+bTY%Vm87EI&iRu4?AG)x_1RQ*WNdM8_Olq{G4k5#L$`&rmD7FGodcm+JZ
zT7>b~HvSk9@E-F`rE?6&Pu6@>gb!tEXkmbyAgh|ib>h)io{JnmQ}R&x<5WF*Fk>w<
z%3cP<sJ#p@o*=4uS|1-~S$fq=8`8|ezl;fbZA0;~oTTz^e0o>@6C9rkD<DuQhN3j$
zr6;iP%c#!UrixWfDGpXmK@lE*t7vE2dxP>am@#BmUx_U4-PKo1op`NReS?_Fi;C(y
zWHbVNX9@TL-%|#7^&;ZgGy-t{GYEdTQuAzEtl`I(YX0X}1LjX?RPR^=_z*7p`dZDu
z>*pqHBoE%zZwKxEjPU+%^?O00dDoI&)Z%ly`a_gDdog9IkDc-OQT@qg(AihjySHli
zrzZjP$L6Z{YzN$twf}pkhJV?GWfeD8b&CCgMm+mtAgF7aIy|HF6k^MW9G(I9G>aUb
zfr_<`9FT#$kgb+WJf&8*i=0=%gJ*TItrj}`0Bdz8d%JoNVsrIOSO<U4lC~;5iCB&g
zg1+f=g2U1!9ypocc_ToF!g`}k7Sw<auc*_&P|MTg<{Hl~)#pgNAud)l@WqI@{=(o=
z6ozdVt)};1$pTCjmR-G8#_`)&`R!^Pe}s`c)HuF_kvr8m4&*NNuo#fL)fN|!b!v+X
z$a=NKwTlJZqqexdXXIYB#RX)e+TwbGLwJ+g;`*K0?o(S_IowY7+p_Wo@_;QX?_$o`
zthTs-JgBy~V8KIbiwj<RL~U^)G@rB2M?3&|-o5|`*j`kdU%Ycr{gT@J0`iKz25bnM
z*X^}H_)~?|yX*}>&}#455`-VJZ6Dj8BL~PQ_P0RLaNpSUWaeE|&DPxRE+_QdFm(oR
z8xz?UMSPj?A_c!2&HEe$zNQqjoc9yBgzA!Nk-!%%YHKW?h(#_4JoeD_f0RJ`KLjHp
z8k$#kR}((htW-q=Opd&w4nOr#5BYMBuI^`NHzSc2LT{k0mgI29VB3;~FGN&C&R~Jx
zhDA<Y*-q-KM?}t2d7ZJt?DFR3_h0EslDbx8ZQ^}OJeb+HR*w^VQEH;G5~-e~!i;Zr
zR!>u51~ZOTVFu&`dn}p-{c^sFIq85Z=3Y3J1T0Wtb~Ja{Q&gB8&&U}n%!Z#v2%TdC
zX_FYCV{CxTW8_>FOe+{UPX$v03%F1P(^ZUIs)FenX1m7TY<aJcdaN@>WIc+G%!;y}
zmC=OtWIZpV39HH4A)^Uv$$B9l{46T#r4V3tM%J4pfI0fJJ}A{ZAC>_gLUv?*Tu$e|
zQ9%hL+}xG8naV^4<&LjBle#dLh-}GONjd7~u#~@nS+O(vFhPx8Qr=2L)OK;!U9bk9
z7hNZ{<vqx(^-^1wmbF1@%R_S3MyV}_XV#{2l;vj3x^DzvzO9sXe-&VOVRH>&c;UfW
zfEzjx&qH-|{v)|SY7Qgi*~y7a<e?V5(dAA}_rI9PukD${bE3u3yO|TWsOYo~pByeN
zbuODAhbg}`ioW_YR_e^N;)H6ca~jQf6DCNV0Z+_tL1i)DPMAdB_YOse{RzheOX&PR
zDv;HR68=r-TjYiq_ITcblY`Y<AIrkDI*C>{Y%eYVQjDz|`l`ryDkme&)F^a(1S&X{
zAa!-<of)A*L3Y7cP{2E{1z$^z`0iN2ZmALAZ!=|8u+^P77TmcF^dO0Pa)|3c@n~ru
zz*TkNd60P~G+?~}`ouNziD@8{)(Ud+nZ$L>26bA=tceGsELha`8(?)}4PbR*4PbR*
z4d9U>UG~rt4Ifsj;Zf3qz<+qTrjH(>;Ug+FTq*Gg{xLObh38BzYWW=1ZgR*PknKzs
zwS`oX$?dF`A8|%|YanH`hn$I=(ZPZr_$qsHu_aXp(lOxBH<>N^@nAQ(bG9Q&vYlf_
zMT;MExUg_z95Y%K2XaI}WbqyPV=9Am2kkggho%l$ediO*ze#J;sB_W1vurHxvh9g-
z0mEH!;s9xMzz6B8f{BA90Jf5hiR$q`z(eRh{f>wdx|)BPV2Ql92}=Ed5=2(0SrID0
zBVaSN5zM1rvvwkwN5f|Av%$k7X0r}-FTQXIiQqR!yb^+>hjZ-9^VfVc)$%H0axCx2
z7~GArs~(gkkNaSlqFp<&P2E7akBVkZ6bEc!c#_!0x1+L-5!+C3GTHVJF{JWf?>$M7
zRQbgS1hIiB`KS)hvr}l$@V@3E-&2CQu+*dP7*Gu?Uaxq0>caofvk1von<NX)CZv_x
zlUdG4Yqj69k&!lPgLDfcg$@lMM{wz}l%!Tu0xL=~Wsn+5S~Arjbsc49j+4r5W_Y|*
zE}MLtSuIxAk<iQuA<Mgo7+T}THJ{!k-%;oApy$71b6z1--3ot$Kxi+^ya7JoqqZ_{
z6xZ@_o~gbx&C^2W&7!e{HQplq2k>nrC_9Gfx0llOKLN%AQZNTf@eBfP8nSH5JDM5U
zM!5~98D(bRGTzBio&#KBJes?NcM%gI4aD0Cb=PsikDt(aHzeKThk(4zL@aWdiQ1pw
z)MqI{vu>{GBukv%&#|nU61BwP_NwWu7U{_8q88~ux~fGwkZx*`4rG6|NC$F&TBHN%
zt`_M)O4aHKNDsAo0&-wvk<RAyR0}5L^im5ZAidQh9Y`OwdIHi{t)76CsnrvZeroju
zq`z7{0U4lHPe2B$)f13|)anVyAbSJt|D79YEOBQJ;fS5p-fXo0P<HYhi5<Y|a*Wx%
zxe~dV=Mj8@#L=N=5ge8{0$eL`1h}pgGEZUt6UzXjm(4E+%w~D@BQ(6A5-|GP!YWN)
zT%+NWW&y5PMrGCI9^|OQpV2+l;m>C>Ps391uVi@1O2B;Jk$2W=I{%FfLmY*?_A)$h
z*YP^2;h}=<E><JLBu4ggXfPU1kn{|8ip$<mhtN&+$zdm|hj|(}8$AUDR}xD1zbJ(b
zi#_#1A(x=9`C1sSvZ#T)6cx+-UYeJxVi{~f70bL*^U_r;*DfU_!!Cw^3mIvm0{dM?
zvW&o{d)#GUgAbdjz(xbmtA@ydr*n+J_HtEVqm5grz=q@VRA4V+Z@04RjC=OpJME}m
z@%QX6C4*8|Q-UDeKJ^PU(11~vHT6pgLcsr!0DGAjr+y{DGnHgb{d%i$?bATdKe4#a
zBH}_*<)R=&)=Yg&#Pwx(i^MTc<5Rav90T6g#wzGW44A~z^ylH)(>Z9Vu-=;5#2Zc=
zMl+5l)XJL1DgA27QIkN8d_#m=yJj#s<5bF*dFxz)QddOL%OemjGDCLF0TPKUwx+wo
zXBNr=rKZ%OTW0}{_aMAbaBlvZ10CB=G4P&*2MoLy;jV%ACfqUbK7`u_-j{I8z{?0v
zmG|9wlf0&%nmGANqGo{VCVaQOW}uoY4?dregPd~M3>ycrj1d|iOt@#@<%Fk5-1WbJ
z3J-HC5rpjinnRohAiP^sGu)A@N#10t8R4u&PAQie>1+kUOM#k0o$VSq%-NycH_8dP
zZFg$?aB^oG10PLzfq@@EcxwZ%B)pY@k0CtYz>g$6&%lo&yrqGUCA@`!k0U(Sz>g+8
zXD5tb#nl?`yawb6MyedyN<n;8JMSO|$OPvDAn@2k=W~rra%7VQImbBqOIS6NBcH|i
zf@Rk@LAh~QbRl6==_47~!6;>Hnv+j^l_RNL5$2nx^+AW_v1nRf>0ulW)5?ONbDT`;
zCq0bYW?KIc=-jr`29yA1bEXZH(VlPTPCKXubijjTv<E!6PSeX5Yj{Y5mQx|4J!B45
zqdm(%c(vvkwnoE;tc_kIP8&|4xj~~NC^Bir>`kVk<D$Z)(=$<+ca^6{o_Zt&)7Aa1
z6~sL~M=H!lOwW}H^99HB7E)nurs*xaS>8%wE|MpZ^bxQ%d2--u%-IVVIwQ|u8@%>j
zdFlLTl8%Wbzovr>Dd@GuYI5Uio|=y8;Q(~uPV|uzub5g{)>`hixn!u<n+P&+4JHTz
zch$@nfxHf@i98jtoa1AGvl#)$(@D)j)e*5CTckQ7kj2hUTK{QPJT_R~ny9Kf2!g*$
zX2_MyZX(PGS@8WHhSik}V09$}xLAA-xMRrjevHceJqq!4z1QR-Rhw+@VW|y!#M`Re
z!;R-{V~_M9MsYxS6go5l!N}0;92mBgsIzm$NM38tR__aO?Pll8ob$^i1h=MD#0A8h
zdI=>Ev2tc}h?u|9vS#Lph;0lj5g#(Fo?lMCnBX>2&-Dx!NsRr*a0iL8wxniemr}?a
z!tnlOfTuFtqg=ziMgTsQ>3u6T+`kI&DyFLrc^AW~LjqPEavRfChx~-$iUySBIG;Iu
zspTyu<7Hb6>mI&ra90rxXREol5oCGSP#S%-EahtNF2doN;IYM!#<zQp?MR$YQ;v#I
zNMcXBTwF=|lt5#8=Bp4KS|L0rA}X7bzYNBng!(g<Q4Va$K2DB&J(dW^b&^)%s5!1A
z2pa)+rWc~;L`sB?OGgfe({buvIk=h{C9-8q;W`}GOu_^_ITR+FNK$Lm4!(P-n2cm$
z@*3VQ%9U#CcQ|IHVzlrXKj`^SY98e~$b>hv5U)Mu8!q8`;v&;Ecn;AreDi1O{8$~9
zcc#vYElTYltC>q$-aWBI?8kXeGZBprkLcz%n)XYr2>F~v=RaQ>>B;E?p+(ou>4Em)
z32cr!s|K*TC%v8+=k$^`0bQL`{SedD**ncHBe+cZ8sL7?*HW0Lzw|Z01EjA39w>e7
zAet=a93*{>n|02h)v$-Ho-=rjmBkYW|K@}w0*}u}{@Wz`c=c3dCh0$(o{H2VaD3Cf
zg#hRQq_lI%weVU}amb!Ervqg3CHb6UiEi%0b2>__!lwPi7pP|^u?2RQgiw~_c24IK
zz`QRpr%R~_56$faA`6*YBEosrncG=}ze+nbbLp8w?-nu#vrL26AlLTnckfJfJ%mf3
zCF*+UjLRwKY;`?^tC7ev=DZ8xovW^gaLu_?T>^c>WtOQ+AomJFR;WuLT=kr<E`e~>
zbD?o<?_FeG0<Bb+Kpm+%-X-c1s3}XkR9yn$dgyX>ZI7$ZRrX@CmeiwqA@2#P9xgeb
zRMoqWt$Rw<=p{y;p+`f!hX|5O&Nbv7m+P%AIbZY1VTY+p&L22Cc8|sKf@Eir%aSZF
zm*Cb@xd8Vjn*RyUA%MPrO%URu>;##cRuJI?H8%mym8N5LC#W|)I2KM&Z+diQ{yd2b
zfh8^krbF(oAO`-W+@VMQTfAF|ntCTC;-;zUTfQ$5WooLLopBWxq>FKV=PTFpJ|Gs@
z4zq)^3lVWVYRoR83jIOZ*o55>aOLfv&DT-ATSzdb+)8l1)Ch2EiFCkfwgp@$HEO~9
zA*oR>hTF>sa1_HG%b@y1hD*u;U(9gV5r8)^e1MDqFEQMs3iNLn?o|W0$!!Gpodvj(
z;r?}iYZ*RhG2jasE^h#Q6T?H70{)cYLskO*V=ciWRs+r(K=7e!G(2i8;03o6ee?#v
zsAJ`3!0VWP<W|5XcMv>wJK!%FK6)qMnmY-u+68#|I)W#B0JzC|f+u~h;mO|uZp-u<
zc@_e?rdf6qj)Li&F(W9*?TpOK7Np+>LT2R)QnrbZIUzwFW@K)OAkY{tHITY8K}O$4
zY$uirat9;zBLwMjKOqY%1=+;N;wnMDX5{1=L8d%F$Z4|#xr&j7IzjGWWXWPdwr(cm
z+y+7Je2|b8O9gqDkqcG|@-ZV9trp}*MlN0>NZ=ttE?p}~`Bp-%*dWMiMy}i}$P0{I
zy;Tr6@w)AT%-lvfYjzqrH}4YUBF?$>13_+Q<o3@Ew!6MHkaa&B$Od)O1A6Wa%1sX-
zo3aHt@JW((f4(3So+e~-NRSzfJX9jc*^E3|D#)XZY$+22ak;HrkfzU2&J!a9na0Rd
zm4cke$TL-fe8R|cHG&juC**}$f^=o%r8+?%`sKw2@@j*DyuMVB0bJ&dm4b|8<jvKB
zoW#gGYXspZG2Hjo3UVpue6T?f==u9*L16XATLrm^**@Ja$a+RT-zkXu93fxs5(FOo
z`U62AdiUo>&UfDm5_*x!{P43N^BMV<<)Z(f%$}eiu;7<$1Nkjqkn6e3A0c@J_C7{z
zyF{?oFA)~7O9g`nI($s9O*<*CiCr$(lZ<8CBLst2Xopa+H#x6`T_qSFBjx7VH3rto
zo@HPKcAa4GU|V~!VBfHmBD+DbPA?Ni&lL&wBV%;(wNb9bRu2lpmM-=h$wM8w*=q&6
zHI>R8U~do%oTc_=13S>(Dp=qZ;_PK_7c7^tKK4$*iWw`jcL@fW{p}9~+sb(Z?au|{
zi(q$<{jGtO+dm72=B}XqwPrN*Ss!t^gYBSTKQVTQoh?}AtAvfT^95_k*kN|az((68
zf`vJ6j9n_&i;Nv*mkIU}V@KQN23Bp45UlDo%9~_Y3O0+eDRz~CO|xqZY=%8cu*J+d
z)2<VYKZNDZwig@N@pgk?4>IQo_EN#l+(KBby;86jId7i5TCl5MCv1VeMljTUvAvdF
zJb#qtYPmFdg=g)@Z=r<WbfM?}2v2>7lBVp+Y&)DI*YlTLZ&~47wPM(E10gM(%d(k=
zS1I9^&T1gM!Vc#-Yk=_bG@KvVO(Y%RR?Y^^)>>_EpiF`D2y*!HKHNs_bu8jCZPi`}
zkU~d3NCmc{$le;TkdtQ1GUu`|opQ~lm93%jYt?FSE+e<w0pwi8NaWG8rd*vn)mJ=D
zV&pEhaIL$Ekh|5wwd2i%tg~l8z;s5|+wy+J$&74Jcbnd0<R1HMu>F&fd)3{hOs>vG
z`+Qjm2EwOd4nLetIh`K3<mEp90^#Cz0Fc^9)pG@b@N$$na}AYQ5mRP=vy5mc4nGWT
zIQS7u!;i}CanK(NYWfzrb_RWGwx(~B6&~o1=WF^C@_skyPliNkZul+D@V24!9Z`z5
zdRLUz+(6ZMPn3fGz9<F!K{L}OCpNBLF#HuXUByz=BOi#&Zvtk?{$@$Qvd`xlOtqU0
zCZCIa<f<z@z;d*MYz_oLNkb~{Qf2_oMA`&tmXXT!WHu<xkTyq}gESXu3#2WP<{`~T
z+6rlFqy<RZAeAF#3jr4yX$WvTr0tP*Kq?W|5%7LUJ0UGW+8JpVq+OAALn<+L0O0OO
zOOf_KdLYuCNP8jeja0r_&=+tS(tb##VFm!Ev-;?F5Yj<N2O}*<Is|Ej^zJs{eCge<
zbLVWOdiRfvv{t<v0a>7~Yk{;;j}Zc)Z%d$a0x49diX-NV==#v;hr^&ZCLYY}(T%e~
zQG3gPJux~vOj8h75juw}qoH$zY4k|b=tJ#HDIEyYJ@;touC}_I%M70=WXPGXgl^^`
zr(Ox=lZC?zlu#fG?KI;XY2iv4Ut;Pgm58WT8wW7_%!ukhSiQ0dGQF}X+`;grhDDbt
zi+JB7d^x@G(sv+@fcy(TV|zmgR-Yz0l0ezIH=KVg%-E}8p}H?b70)ttUn*666<qfZ
zRbQT&>b^1>yY6dshnKCc`-YGDe}+`!+PE^@Rc1QOXWi6HhwAOG?#*EaqC1Lc3LxDb
zdblI~*2rYa-1MYN4DNOz)bhGhn#z-?*Dp4EB(g_yHcwYxRc!VwWS_v<JZE`}VzbXf
z_W7LM^ajelA~yS0WZ%izJg<58#b!T+?B_U}XFBh-*zAvy{RL<9+~@reo9*7l6$?_D
z%Cn)@oFG|Lupiv^$nM11-6(;RgW=w)(E=0%eN>~t$$cq4ym7H2j)jOhEP|(4uRb>W
zY-BIvY@T$zOQYF54JZTFMv1U$Gs-;5Wge#lRypCvjHunBtU{;SYSSIMe?&$63#EUF
z6b#f(a}f;P)>>BWbl1|z4E6j$U(Pw!rMGVRUO4|!PAC{kMBElv1}v@}Epqt&eC-iR
z&f{FP(hX^$W84}bFLKV2uB=3$`zUu7a`@D!+Oh6jAl&b2$GLS{z|rc3&>vaAcy}S)
zp^unSZj1`GnKFd=b-w85yi&qmfVMQG#hVgD`(Kp8qk-COhGQN#9rJ{8%rN4ueUcng
zFoq!08^PN9q%bOTzbcH%JV5;3$;2;O&mqY2mQxC?#kIE?Zd|JhLdxxK$nrKu3qFQ|
zPecmNt-Zo1xXSeZYSaH$n*P7a^#9e$|7eVB+}UtBynL-Yho1ksBVuwHL3I2sr7$^A
zd#2&2C8nd!QjQ7}Z|&LasFMjY9hF^sq7>fDEc4C!)~loEQ27OJP{+eUH`8qCg1xph
zhF`VjvAo@+LY)3@f@uGb(k=v8f!cSB8oX=P;5}7?Qrgw3eV=PEkRY=L!P=LkFzno^
z3ZtoC=B7TD_(f|SL3I8frO?`~_76j=6_B2{m9lH;F%8rfeaQ(()zL0)paeM|Fk2wd
z&Gf^uKJ%be@D*{I_TF6kwW#fK7m4`Btn6-Au7FUJZ{2IO$G>yeh|#NSdrN5^o@)D;
z?bX+8FM6REr7vP7{nQCis6l^MuDO5=a4!cNkb$)O4$myDJw)a)7&2VVV+h3&>IOBC
zk&YZ%1msXP!vQ(WN!M~mIdW1VlpO9f(K(}?ER7uDGz9{sm1>HFv@uRDa)2D^wA5@z
zsV72FW~|c&IVY~8I*)T?&;xR`v!Bix?{w2hm2)5vh^}_ZfLwDo37G2)EFD!lK^(D;
zDbpP5fZW=NLP2FFDc1lw#*rBSwoF!j0y0Ip21t$a1`v9fL&B~p+k8AJ7*#vnP%uL&
z0Q0d*CbZ2|GEe7%$0?aWW+^uSnXM`dWRAn#LXX#;RltG~ozzn<B2m&)t|Ew@|ECo3
zkXd_*^ap4@)$A#!sh)zI(^XG-mu)(OuGI>@Ajk~<VC}&o2^AWqB%!k&5+D<r(>Al1
z!2OWUzmDSj6J&V@QVNqwYP03ZC-m25DdI)+*XHUtW~j(XDYm>>Q7Q8wWwDmBOw56l
z<;omLS)nQhDdz`B%DSkO2O;ILh?LCQ-iCYnnC|Iox~ELJ=T|CN+mGE7+z{)YHMN~Y
z62^uSB?%^U4#?O5Uv&vwL*M_S!s4ru1X<o_O5vOA+Pe*V)|vLKSN34^*kBH9_XLbi
zdT&5F>8&KPb|VQZxR)T+kWERMHN&pGN|gM_JXZ%S?3*DBt_f7xz+m{bfk}eF^6LUM
zw(JX4*|q;NBK;?`EB&mx()xQy_8zk<{ab}S#<gEm*uTzfzdDy`rN24q+uktfcc)TJ
z0QQG7#=z))ieMN4Y<H}Y=g<ZnWTKqwj<?O>{&b(=9uuA`&9J%lTB#o-UvJj$2FIxR
zO^z`Q-D39f+Z>5;sJ}xEws{+=vg?!^kh4Jzk8?O@qZ$#BbDvY1&8-FG0jGyX9#rEV
zn&@Gtm(F=i4T86^w5?8mo%4i4pGKwM^PKaPQ?7HiJ0pO=g6Ex4I_E`a29Vuc=4Izt
zo%5P=8<2&Z^Eb7_2Sax`o2-HkL`J}=Lma%?E5v7GnSYh?CS1E(c@xN$4y}`?5D))S
zj*Wi)xP49mYcfS<*7B(@^n=Ki=1_aF8FQD=Q%C4nf!b4z0;icaobD()gSATxp0iA$
zXOn3Kzr-2Qu6C)xzfAFW+eDRIu6hBG74&MN9=Wq={YNa){YMaFd52S~Mr+Fm8(R&H
z7~vc>G{VhpiYyUUu&zJ~4M(d8iXE+gkUowm`B4od=*R!$(RwTKiwVyYWO+L&RVI8S
z1)=C;a|HUt91%ZNBTyFI0<8UvN5s|ynd3~2UHiH*&iqY{Gcf3l$T$OwcF{OP-#?}D
zV$x)SEN?ocFsZcmeDMlK_Y0I)_&Jo?3sYpNa2fH|UX)ToA5h}5^h?Rp@4O%FttYC;
zeu(qEEtEobo7&qAkKdtW!^S(!$>=WSapbH^kpUOT`V`p_KnUNHVk~#=O)-``8&l}n
zgFg31%osutz5hok%m~!(Hq7`|nK6g5YrjjO&|655*}R#x9~%6BSNv$Qk5Y`a%qOZ2
zFz(Y7dIax5k|dsZk|4`_mQt7ytleRVe8Kd@i)4cLeY9XI->2n$7xy57=!^?WRV@yX
zRV57Ru8zV4QtF9SFr<g)SbaxwS^9-9aJ<n3tIZ%>rgLI>Gl(jtLSsD_=-Ut}cD3W3
z6J>xkM$zk|Ib788)<^N7gt|`>>K;LNn5q5*roKoCYLFf7D_xpph09cz{+_bK^oX|Q
z{S;x`T-!^$h0fVqc?(lpALVmQ)O}OV$2bL~EM+AS#BskAS<K^VzJJOldjE+GO0A|u
znKHyMr9zo<8fAxvvMEa<jF;7(XqYnJG^O4&Wq~pU3KyoVw7jQCgg7|XEAIQ0VR;`@
zn)*dVO@8=ru?IUNqm?~euP{B%je5apm1=(LL^tEZW2lJNjUZHMSM5=TrDK()SOSbw
zmSWj(bc);!LjM|{vK7J+MpY?K0zpo7%66SIA!UconV7Ou=S)g@&GI&o4Z5n9w>64C
zPmsB-I{^y;wf8~aKZr8&qd%6nCyKKlEH8~7GZ4Y-3b&A-I{0=A=X4+t)&5{!2d8^)
z!sgKf!=?F@b|1=EN4jRnrxd1g!FipOSAmo`!S2U1wTqKo8swCuTKxF-ysnC`4Jn#O
zo0XP)c<Qqtq1`DstnN2+!2_LqDtMq2e4aY&yq>Bc54-bvQ9;N&p2hTaLY-N`0!9Wq
z!4hQgcIdnzP8ATo**LGlsR42UBL_RPfUII<xKjs&?_|vz<t*07;m)Z*_*?MvMypp3
zfE?j0(K+Lsv-`0LyjM2wXnK7i^<0gQC)_jeDu>><Fz{;1cMW_3;f{e%B-}ReNrYSH
zLis&x{dDyb#G{OaouyiHtz)|>23|)c0|q{i@@)e@ktG{=Jz454)AANjeu{xFWO)X@
zh;Y}y7ZdIn_(_D@27WT(mVuu}c<OSk?{vaF13!cC6a#M{JYe8wlD&?BFQI(fz|ZFT
ztkCk$WqAg^l;s)tGQ!;zx|uI<WK2W=T;yEXeaxfe@=KkSr2$I8_bfNUWscQ-E@xd%
z9VI}i7IB4&V~AKq3pfd6e)DMFRqD<(V*F}#XBs)zII=JE8cV-c-KK_!>zo_Azrm{3
zI5(3OYeW?S`39v5$c?0_yY(0`-r}q!Mm`9Pevp0}=e6Oyb<SOsx6a60uY`b+UK6*v
z4`arS&W2KlQV4-nn-n9uz<rT=!N$$bz1jf}I-4}|kaNG5@QAvvjxvur4{5f?)J=Be
zY;hh#4r2dtN5<Iq*)dO>$TN-%xc}gs?T!q%K%RAEjD=sGQ}595dqVS`cixeKFF5a3
zyZZrL@;2L|kx1Q_=cfqg(S7;uBRT7K+d3dfDXifcWZoUdje&W0(v1NcOzVg>hh43o
zQlxt?=MuFDV=g^88sYG+At;x51M_YsRdQg+Ji61P&%@@e6dGjIk}CR%g%eAn``ahB
zi=KBo?;6|V6Yjl#l3<MJ`QekL&2Ufc6xC*!7*ACze;}u+%bROf(p-4Dni!FD29@`Q
zZH<{b#t~|H6DWm}l5iWjy5whj!)?`mA)cxzbhF_uAVqGzAbe9L<c2KoS`ty@-VAZK
zN5o}^JBv7;T*6(HI9S%zrS-%s#3&Ql-w9IBgM1b#y*WHvYK$jA=BOHD_CH?rH_ZNX
zReytJCq%j!`92(0*NLcpt$Gp!NS$*JDgb1jigF+)IvXwT_-!$UEhiM#Ny2<I3)7V2
zT^40zQ{>Tp&ak|7(VWM)blQ_le1br1h~(ShGFiZUM%4}XQ`bD7QGR%EU~_3@xW8l%
zdYmW&RQ3i&1}Y@@1R)10<YYz$QEOlW0u?C_sQ18L;k=3f5z)rw;V-38_|9ecAF5H{
z$*<HlFmh<$87>0yjcRZpyWJ3SQ07}#W^I0$C;XjTiX0%{yJeB6YA%&Q=^SM;O6RIe
zI^?tn7#druGupwH7ceyD)Akx_QW^eLYQk@Lgnu(@^1EsLAIf;JSxOW%+5xc_N}NEM
zHr@@CYa|dDAsWlV9i=7^wVzoN+KNK~<di7mp`^3A2>>NsOpRRwy{x|PQS<OG{Il(S
zL~xP2n^O5utA1B3{7TIJ5xoXX0R=B)hsPM+J<_!4r~q}czQib<tO7AOJW}xHu=>K+
z@k9x~q1?CaDMEI+RU*79e1o_c#@}eV_$GA&0Xa9T$mz<ZZ&5c87BX_H87#NCvUP+q
zYhCd-klWpXa37F6TyZ{-JKckI&Ry;Zjoj^y(#SfuQX}i#v0{I2_#DIjb4~ltGwolh
z?1#o>%6=gHttI$5H$2Y}b)qS1zA38S6t%z<wJ;)TRQPd2)DxyCx<9F_@s#P+r%kUu
zV|sPF>D6aVuRdpb^?B2)J4~;>;Eu4oDNkEg`-cKFO3fxnB8IPd+>;2U^OX-klv*h#
zdds5umvNSNC8a79CyDhKq>oXdh)yt>L-Fxw!52{Ql}N$-@GL2ak!!Xphyi_$8X??g
zD432XuD<W{_)5R<aRD!vsA6gnLG=Cur7$HwY>A6Yc_Oftiy_fbUWJja8YrNcUM#S@
z<Dw#&fu4Ve;!B|7yoieIaF)@EP0d!!R;~CH@rIk3`kKew3=Mzh^9HEpeM!aS&`|dm
z0_CgBdMv2DRvreE5h3zynHSnlz5qWjL+Si~#<^bVppkOMIZJ<2MCDA_OODH~mXXLi
zJ<7xF=^_z5tD}0vVQUF5QeTqZ6fL!dAj^A_QnXKLy(P=9&xuk`7ZZs3Z=NN@u}fqv
zRZ{;w)>6Zm`h$M3ul`5<1Y!L@^%I2k|I$wo*8ilRAgupco*+Dn<?IR3`Tqo9wU#|!
zPDSUQKK}r%VSaboU8EoArCQs3dfm)hN~ODUZlHcAxNc{;f77Mw--s**>tAjW5mWz4
zfId2@(N{UHHTqg07&Oq=sk=ml{2H~T{x|Yr@VQ7k<`bk=O>GH;V;ky2;@H1$C9B#g
z$MT}FzP)-%X*BWHcOWhlsH-oK0w*%LjVkaqBW>wOeeeY9TL{lhOm1lk%`=|+s?VqW
zWBou?{iE%;_7>8ZU<F0p=?DCWTAa+PS6hit<S9i6fK+Auh0l`-k&kcly1qX0@oi@Z
zA?da(6_Asm-Wt1*b28OiWA+P#G*NGj@rY2LWy^fSou$61EmO=4X3Mr^R^b(3eKWfX
zQOesw_08=Xdj5xOK_GRj|4g^#=e!iq=odV+=_dSAhgSVRB(z}bR}#p8zn0(y{Ea;F
z3V1i&SWKn5D4lOXD%$pKQ3&`Qx>mNKALzUE=?r?VkA6J5*T3gzTi!Qp`M|K{L&KK8
z8@7C8*zz&iaw*wT<X%N7-T$Q&!IHfoO@f7eyC7Y);ZDk4kfGX;w`3P&l2JNX7W|Ar
z_z%Hic^)-Ok=uk)y8lb5^y38$nW!LZJX4%Km@*eEkxD_|SuyJ7?M)rce^gS{WVh6W
zr@#f@+H#r)Pl^k^v*|RCAT}g`e@}R!f&X9!Qd$}KkCdNp;Qu5%&%pmh{LKygCp$pL
zR%`h`b2l^aJ%ndx>imCmJ`GMCUyKY6r3BIY|CFLGnG1iD*^13w7<qmLNUCv@Wns3O
zZ#l>pHV>rH``=NKXF=rBh{(Xg&K%nGnmCK>#!H8rDNoH@8^FvD;&~4dC^HYw5bkrx
zd5Kb3R<fX8uJhpK1?oBv$U@`#b-^O_kOy)Ws~eX<PI5x@{m++TlwjgRGKex<?g`fZ
zY;5*|ZldmfqA%EAspB?ZaDYOZ>?DK^Z$afwVYc419hAMGR0^WOd#G$62O2j37xYv{
zBc~VlHWf?{8^QF58BC9IV;YV7SX^UoiEHew(%4FDfuqBq4H=ScglStRKwVtt7dnB|
z6az1E0x4=E3+9H@i84Ui(X&iu%(mxen+!8MaIFozn3WqbiQ_3KCLbhsO7rs!O!q&c
zI9}r6#PZ&Y67jyPEG>SB5`QO%&cAwDIWt(hT5kJrK-FGp-uAi5qdQ04h*4A?LXi6k
zCkO@}lZ@N);a>mM(`XngWYM*+PvGzE*?aW_K3)HjZTt&Qb-j-WE^=Wq8>*IGdx)wl
zLpu-jf{`rjczr@AH8GB!C0^^ycrQw1d1ovfzcw!-|HDxGU(`AAy9Yisr~5x-R{Q5D
z(IbCYUMNuJSl;K%@--#i_mp4<&ij=haREoB%L$$T^(ry)d(U10L6XfLak~;q>t9OI
zMMB|4GEU)2WU;!s;BA`lNous?JG<eNx$n@Ay%;_vKsQh4v)t1uQ48g>A|i9c=ZQ%0
zE>$9dEK{Q?kmX7~kQM5o86f9VdGA%0&#1Z5{+x)k2|y{Ge?lo{xcvIlF~bcdYW*29
z!*NHcZ;%;|h18!Z>)-ufBX~)!;o|y*XwAL0xaA!~WyBIud_olGK(f5kqWA>_xd=QR
zSm8D1b&QW1Iu9@^08Pa9QvIXE?^!BetI1tn9<JR5uQSh2l#|QcHH&KDf_x$`suLFg
zo~I5eC|xub4BQnKsWVo&$rl|hK4Qg-)bWj=tK%C%pAbS>z!QrBgXfqMdj6L*!i4Na
zr|6th#RPDjMpw6Mh)Z0E7L^+E;b`e>y?dSw@>vZ3o2+s-aP^SqOt;b9Po7O=-rSZ~
z6D03^$>VU9JZ6w`bJ~l{E`Osujtuv!{*l67cOs_pNf|u6S|bUYG&7Ali~I_h9edFg
z)*vQT(IhcxkgYieGj;!Xs^%T*%WG0K?@V7_ld5?a`|_Gp&AZ%}*Q9FR8+>_9s^;C~
z%WG0K?=!x<CROvk?aOOYHSagRye3ui+KyklnN-c&!k5>iYTgoGUX!YM%YAuGs^%T*
z%WG0K?`&UQld5?ee0fc(=DpaL*Q9FRn|*mrs^)#bm)E3f-tE4;CROvk<;!bQHSca;
zUX!YMZPzz;465dBX;Ag}U{W=2XJ1~Es(BCc<u$3Ax6+r_q-x&jzPu(?^Dgw|HL03+
znJ=$N)x6jG@|sl5yWW@Aq-x%6zPu(?^S<iKYf?4uC%(KURrCJj%WG0KZ(6`F&P=N2
zZR5*pQZ;XPUtW`{c`JN*O{(S{>&t6WHSbJcUX!YM7yI&>RLy&dFRw|}ylZ`VO{(U7
z#Fy8kYTnm;c}=S3-R;Y3QZ=ue;ujAlRrBWh@|sl5+r^jHq-x#)zPu(?^G@~UHL05S
z3}0T8s(H`x<u$3A_j+Gmld5^w`|_Gp&HJb?uSwOs&-n71RL%RUFRw|}yr22<npDlZ
z$CuZnYTgXbFV0M==56cCYf?3DcVAwUs(FX_@|sl5JJy%iq-x&jzPu(?^Dgw|HL03+
zxi7Ct)x6jF@|sl5yUv%_q-x%0e0fc(=6%hV*Q9FR&wP1Js^<N{m)E3fUN_Y*&P=N2
z&GF?mshYR5FRw|}yaRlBO{(S{<I8JOHScU+UX!YM&++9osham{UtW`{d2jXQHL03+
zgD<a1)x6L7@|sl5`;jlNN!7fYgMRT~QZ?_(zPu(?^M2^dYf?4u_rAO)RrCJl%WG0K
zZ<92?x|vkXTj0xUQZ?^>zPu(?^Y-xNHL03+pf9gU)x0Bpc}=S3t@h<LshW4LFRw|}
zyeIkcnpDlZ)R)(!YTi}8ye3uiuJz?LshalzUtW`{d3X5onpDmEp)apV)x5iXc}=S3
z{oR+>q-x&MbiY_Psham9UtW`{d9U~7HL03+y)Umx)x1yn@|sl5yUUl?q-x$Te0fc(
z=Ka-|*Q9FRW*L6|HL04n(3jVwYTmBCye3ui4)^6XshamFUtW`{c^iCrO)7Xl`v>j4
zt~PkH_%uEKEk3K9|D=9J4AZrr^v-*2OLONv@k16V#x0$_-ny}%kT<9&&Cm*muoV}v
z6@zSJU$S5Xk+F-MX@TWlW*O_x(o|SpXO@}%EUkp)XJ%RK&ypi7^u;x6(sF;67Q!-!
zS#I!W$q*KpyUAqHwRolx8D_oRh<q#S`Nkw`w`7YRu-J~_Iq3O-OSUk{x@2=H>3%~j
zCH^eU4B_P_i>}1jMr62ub|doftcTvp&`qvQX>I7a*kpkoM8(bi<Odp&;qmQ_$X~Mh
zw@k8DpC#&{XSd0s)zix`+HjBu>?VONO|ll)L<Ay)I-4vg3GzXW$Y{b!fAaK3WYlM2
zBQmU7)`$$JT<cF>--wJb+}4PUNO{$t{E0vLr$%H%WLhBJn=r6VBQk2)y%G6=Z^`!+
zCRzJFS9}j+$C@ngJ)At#pS-vc8Q#345xLKIq<*bQ*6Le|`f6r*#GfT!Sm24*Ocq!O
z;kz4=QDrwJ-fs|++lUMyT^f;hvsD93vNpVpSk?S{VwvjCk}fQ0lru~g-676tL`E=O
z--rwg*Eb?V_M?r+Xw7FDk>TZ68<Ek$K5Ik<_nt;%cs9d}_bi08ZA1ol_eNxJ4{1b3
z^Nejo#t=EZ5&6O&$oC6PvTmOC;(MrHZnD7l@XvLP$ngETMr843BXW};N&RakS*y=8
z)PH8OKs|cz5B_8~HQuvm`kY2&bhgfo$dEmt5g8qMOd~S<GrJKP&2vs8GMeY=Mr6po
zwGkPzH#8zc_H&KMh_;U!k)d*PFy1Ga9baxlUh_|Ck`GO?Zj!drB<R!Mn=CpaerrTV
zL^Mf@R}bG8G$Mn0zeZ%#xJM&0+%~WgdB(q}4kJynu0w&;0g+d2vY-yA+T2Fu`&i&f
zCRqzCG6XI)Ss)NCxT+D^`-uduHOX3FI}wPwJz%mxAR2i`BQomqVIwls?`}kfJAZFP
zhLF<q_@+XnT-1mRFJIq?3>U6%ME;p;{FF)7H7=GK7yL{tyZl)Sg$4Eb!eoI{VBxQg
z$Pm~pBfdU}vBE}V)V^yYGS+Cr8<AnjQH{t5>jsmItD%2#)y^}nhVbakhQRtvz6hDT
zhaSA&AdlVvz9$HJnCbV*15hV3tUj6zo=x&_4}YvNa9;`dZ=frj!2N3g^OJ#r2iDU0
zA5>5t;o--0==m?gi(G-vh{<#D-9XrT3uR0?(756);D>&2Rg@~v);xJOaV#-vRKd^i
z1Wu9@d?OFO@e?`tl~QV-z~H3&pQe*r4+a$|KLu`}oI4E9xJ6j}guE0h<RyN_Nee;l
ze-`p_tdNiSS#m7|x&K+nPq9LN;>WzS5ah-RIV4iAN&=Kmf;LMT9?6*`IA4k4Hz^$t
zMQJ<(xaB9Rb(|={b<s9)qT0rZsw0ics@}-bR`s^|pmP)FGtV{N$L5zLwW>0dAE_!q
z&u5#N{YCGgc2y)l#!WGZuBc(%s5t9J*&GB~`{+d4E0fheIZpfJIPEowv`<S`dtIFN
zx;X78CemJ?to9{w+Ly#>KRc23bCcD6Wt{dap<PGem3Eg~%{aI^ku}#QYt3D8*4!0m
z&0RL1O{}AGT_S5XBx}u<IBT}VS+m9FqmZ>V+Y(vxM6%Yr5@*dTan`(Q^U2HFn%5Iq
z^G34Pd>UuXr*YPNYV$$Q+M3T3S@UJG*6fM1W>1_odu%>eT3ho=B5Qt2)|yP5i>doi
zro&^Y#+x{NjJ39=Dfss?vNuDf_2)<SP@FZPIBP-<pPH?$X`jfN;$*EUi?gOI&YCiZ
z59!v{^iO2Xz+|l%6=%(;IBP~ZeBQUVW^^KJDwDNlN}M%Q;;gB0_;_(`&9p?;%t+Rn
zMRC?Fa`>_N;gR*lq{VS9b#fwWPEFRDWpUOli}TGghmTR$zFCpTnhTP(=9)Nbu5tJn
zcCG!oMB3LRt9^Z(_Vo^*b*{DFlSuo<WVLUF0IluuMB1KAR@*Ca+Fnbf?Qh9y`wRkf
zjDP0vdG5NdUnJ80k7Tv)iPOFZF|M`$l1Te+$!gESD@?lXSuP(*ueE0*e=oCCb9w*i
z&(Bir;<UGO`B-|by+b1H9h24GJ5GCVmyeX!+WRKb-Y;40BjU7=aQSF?t^LqM+D9d;
zePW#Ui7p@4t+gMMNc)szwTI)hhh09rQfseEr2WKXwVxTM{meM+XC=~pPO{oBkJEm+
z%cqj-y01#4{mNvu-xjC+HoUW^wbOw+G}rH?zu%dx_6Os%Kj`vV>RS85iL^hOtoG;Q
zv_J1Y7^D4#MA~0UR{Ohg+TV3YZZPZqej@E3CaZmSoc7%=ANZ_2|6L;OKP0Q&4scZI
zS;h|VS<hO#i~PMrT?#UjxE9Kd)1DiM9c@}B(w?8J_D*ryJH=`5oJf1uWVQE?)80S8
zM_Oyo4@{(eP_o)b#c3ZE;6tyq_R)#7S0<}{a-8<b0Y2+mYp+S9eOj{G>*BQ61^Ae2
zt^LGA+Ut|mzAR4rvH%}Ht$X0I0KZzS@#O(NL0emQej@8GOxC(Jan`Mgvu;g*kJ#4M
z+?dFko0GL>Q=B!MV2##(e<JOhlhyuwoc8Afe6vQk%<}<0BV6M<0(@M!w(iA5*6mEz
zx=-S)`y|e~PvWfm6xL~LKMU{)-rCwP5?T9?WUc)r&e~sKt=9fqBJF=9t35L%c9zRb
z;S;^J_AKP@WtPiEW)ibp`#A0GQ}`eVt-Uyr_Wk~p_Ie6bb)Tzeoc5k6eD_pq@100{
z-#?|@xQ|s8r@bmAcGs#Zg^!xmQCXeB2cv82CML4(m}IS67-!wWIO`UrjN58jb5bH}
zPT3c04x<Lb&+yfmDcTQbrrf+WZnZy(nvL!-pS3S)4uK9z3^l9bD!nS@?_13#Sd|ic
zqw~r{mA*PzYi^6P=C+jB8=bc&(thWk(r$E)d*Za;6X%P2Q}`e`-7Fj7n?!hQ=ej?U
z^_%~c^+ro>iL-u7obR?J(*8uU+MkWn{w%a>-#nYbN1$l@IpDf$??`0bi^*E|UYvFB
zrSP%N+M4%M_=IO|&4-Ds`6yXyzKgTwySSG6A(8ffCac}`Vy8dXi|u16$luHKmx|0J
zroR?(+FQhF&r77eRkGSU#cA&pr@eC`?Ol`A-Y-sjzc}p!5@|muS?#0Zw2$)mL}?xK
zqZ4VbOji3uj~_WYoM)g($0X7;C0R{#Awc)-xgMW4rtuRzK6OynyEc(E^OCjZ%s6Y7
zczo)z)_!&(?dK+|{qi{NS9pAMv(~;kk@l;S)qX1kXl-i~X}cp?ZCfBfxAPW{50%#1
zw<Xg4M6%j<#A)B*@zPdne=(8voylr{KTiAm9-nrtwSSmM`$zktJ-Spi)=j%T?e*Pp
zmhATUOlvcr*F-V1i(1Nlw=ZV+EoFa+Q}qi3YA5^#JVv$7{3BWI8L3<`UD1qGo@Qmh
zYXW#Lnwugsi7B-m1n8=CNTjV}vf6saY3rRxTi;~0jf~TFSR!qQC#!8L1n4%Ln#xb?
zCc?RmwdbcNvhLVqtve;ox>Mq;YmCP(^iECX1L1XTPEF;#MQ#1*iL7r(*7{51tiLps
zk6zT)G{$3ndwC-3R_%**(IL#Zc)Bq)rgy3#>E?YA>o+8=jjQz9)Ggahm*0`7Qg<b*
zeOsLNZK-_ZymtBHsj=7gPbRYF>13^WJI<Q7Q)90?-c6+a{baR&5;r`5k{UZde}?>+
zAkaPIi)6Kb6IXY^wSsRG)&2Wqwf_`X_n+eGz9&)Le@Rxm6^tE*>>!_QuIuh1e=nX-
zL1q$@V|twSj36I_uC+Hwq`hgf+H)a5YipTETYj?I+CqTt-))1jF<z8Nd%I+{?-!?i
zzc}qBiL`e~R(tn2?cL+F_ei9@=e}t7n?A~d+UsR;mXrngEd7}HR?|!WKc&`Kcpqe_
zJt(-hh4tWlQR6p@Rm9b(0>0HX9vXZurcVt6e@u;a7Z{$bHKXFJ5nL-6ok)9Svf9VR
zX%}2;AD>8jb+X#0ppmubr^H41)W$)eO`HCwv@fO=uDW?NE3WRd;^JU-oOObaCIQx@
zIYIuAgSLE5kl!BD#?4LSxA32`+*sZ%h_ie_kiTW1wJ%Df{iI~IpAo11jJQ@iGm-YQ
zlGVO6PW#dzf3iWh#4_O87b_B3bHTn?<2O=X5{wxa)JS;QzKHc3qE^LKa#fJ;s_IHg
zzOLkzi7I(@vew)N0b1MbiL~9BthNmhpzFFJ$e-KL+V4%Iebb-PZp=YX#c6*k$REJa
z);t~L&v$72nYck>docDY^tnXV?)X#I8Uw+ban`;GYqhW5PNe<aWVL?@0b1KviL`yQ
zFWUUN+8*Do_RGGA_3LUWX|e11l(g7YW-9VydbzG~8Z!5FJ>N^uK`qjFnPWW4ZuwQc
zeOiouHOdt4i*i4)`}>ORzAs{r;MtIW{OY=0%h05<wA8OG{o=1t+o7nf?mR=&_?p?Q
zy<ZEBL5t{8V_=|egrk7Rct~fC+n3t-X`hkC-yG4}XT)irnMnJrKc(I9*!)KE;b&t*
z8h^w_S9(bzo6i1IHW`D?MQQv!9IfqQ;Cu1^rO9f$9s;!guTP7;|0TG#=7vOdzbRR3
z)~E3&ezdlGfbXU58<W-cWL({!M1Rq~cruMYE~Kq_I#J!XCu_}{an`&UXU&^&*1Vm_
zns@({HAc_)B8@+Vq<!%P1pcS7<X>@h_!sJ+J@|7XoB#c%Y%b9wqn950kfoQ-Bc;|J
zM7|z6jZSw?dh9fHPI~O__qpk@>yD-1-%DUFN2WRO#vIxZgZNHJSEp;oU!Be$X^PRL
zCa7zZRdc7I=FYvUxqDyK_zj<rK!C2%qfn)rWef6SYN#`}C98dBoc5jRJmF{suO!m`
zTC&<djMM&Moc50rY5ycy?LWq8|1nPczY=NxIa%$g8L@pTHG@AVrsE)(5xb?I4*tEw
zK_)W)%Rc27g)K8;dvHGRy=ZHlthNqu+BzoE)@fg~MOT__c;J(hgGw`E#}vQ%4~7!$
z{lW0QiF0e|elZ06d-2cEKV`8o-X4*mH6M||&+*1+QX|}$eNp3A>8iL&S7q?G=d|kT
z4E_wAiF1&cIPW`Yd_o3)r%pR*QX(f!PS*P4;;fIyXCYr(GbfQXbCb1ZaYpRg>}23E
z&8AH`bzihqQsChiqEv<S#Sk!t$<9uE70<@jAR+wy#t8gmv1J{J$0i(g4vHmZ<~ZDv
zs>~cmmzm>m8R42U74N_a7a{y@JxHE24WHN(c)EOc`zW@Bf5mi3sjM6rH^2@|KZ_W&
z8wMeNY~Nv2ME&yV@1zmw&Brl*Fl7L!Bw(x?$L7p+(vX`SVQWJ`)Z;AaXqM7h%8fn7
zD9@wAq{GuQQGQOO{K5#Zgjt6j$EDS8*vqd+K*~uYPegt(W6Q9y5i<Q9cAr_sJew@0
zj1_gAF#^nwbKU&(*zj6_{AgwAaX`bbi;($W&IW$kPmR-lYMl1d6KQYQ7wsO8AXd>R
zIs*=#3nCPBJb<W@;=UB^4BHp-V2l_HShO{1St$XJ!zz_y9fTl#ubqC*!Sro%%SuBr
z_jD9vf+{OK!@vWUz(u@9b}y&IN^hsk2&8;%XE4PwQlU7YxJUy?Q;>Q{Q;`OdrXfu?
z(hR_vNSh$dLfRB*HqvHDn@gQi1F+F+-;WG)%h@{AH8tpQyz(Z96-di%!ha_cA*}`Z
zG;1dF(J$DcX&_i2pK3juXu*(t)ERI)$I7}$F{b8-R0rD9^Wn66C=+gRi|7*6^6n=b
z3RkA*X0!O`iICpHvYNd?K=XWJYHoS&M7Tm31Hr|P%{WLD_apfkgT$aC86F%2&*==8
zXKHvzHsEDUuMlnP7#^B$<wV;kqa9o&O=KI5m$^n7X|IiEWkrOfwlw7BneqUu#<skT
zq#c#dZc+%-J|IGqBB>U;t4T<z0=ON0_xTfDqB%;imzv~A36GrBBsXYfHDlM(FDrx=
zaO_;hf~g*JlLV^sY_vvyVpI(=m_Ty7WtC*U>Ck?bWwDPl-*PM<?AXk=odA&K#GCn!
z69n=lBkwx-8hOtNiKy(%$3;{Pi+VzdTE_*Rbb?miLj>_J^Ipf>LU6uYLzughK$m0F
z^#0wZ_ifADO-!x05~xplJJbi!#g$aGJONZqNH5lGTs_4m{keii4sST6Xp^#xY49+|
zUdD9sa06v#%m{(bk}{4h)$q(-sxh-30r3XzHIGU`f$593EP)Oww5+C=yBi6%yv>vr
zNTZww>s}**%c10=9lbXRhecHxM`?@3ieOkVPAn><*3LM(1U%d-8RJK2xT;cwgtA+K
z$O^Jsi;%%oFuQ;P=TO88b-u1pnBS}uc#kJ?vl8Lu3N-6XybBd?+9>b_(#qSMOQf_R
zR@*?@5R~K5B&~ufDb-uzQ$498Jkoru`x*(5st=`7?o?WWSl*jNgo@JU(wVyuxp^}&
zhr^_KbLrUQn4Xgl)u88!Uw9yB-a`DsCNyu^Ez(j?g848inDvwhtOQIg#acYh@g`7`
zF9GSzB)E`d&{wo?v87rKs1~9}2(?jydo{7EX5>yI`SWA*6?Fxu9INgQDrI>uQ;HrL
z$ox#Y5mzMhb4nm5a2iSkX#pl9D*6p#Mh`!MF^z{GDW2XI#mlI;<#ER;;#%e2X1j-h
zR7q)wNn-RB+Ppf}$f)J<JlT$+7IMs?i#*IL+=2m#_4Fc_6$s+(k10p|3EAnLAX`rj
z+%?5($j_bvfuFHjhAfXGU5a+wYf+fhbh=%`!b)g{mcSAL`x73b3^Bgx`N9P?=y{w-
zUhX|MyA<_>XWUwrC1UCcL}=FJ&O;>KO@!PNC6YL9bLUG4vP*LpR)U8u&RtZcx?}DP
z5Z~g0$4Wu&V!1PA<PWA1d|bYj^$9WXuVr4=w+hU9uzfJ=0Tj21Eo-xy$5Vn?IfU~s
zH^<8-FyAd=g2(2euVq~9a=^+^i;xlWg)T-PjwDt6_3_n*BskX@f^+|5m4oKUxB<-p
z89dEOBO<Vz0k(THjJTar8D5;zVLV5QbB5HN<Hu=`y0a|jOzGQyr$P>WfL%wnv#@bw
zgQ8YZ63@;+rB>{_I?g^cHrf|XkZM&(wRp-y%vc@B5NmF_W#yfwzlo8`AyCXY=f>x(
zAOdQbo!=TYWY+vPQbVq7e%qiS^lmLw%QJ{t{VqRFgV>SHfuX&PQ>XW1DvUI#ns<RO
zuSwOs_xkdhRL$GN_++xS!K7;5Nxr-$Rr8+f%WG0K?`B_Kld5^&_vJOIXo&^Xw0V7X
zOL!*}0nNQ3uLqi&N3y&FrMbE1=k=6;=6N))mjv`imeM;{3a-xUjDkNiv5OSs@XPBu
z0`vf_#q+w20-Vk8{`G))LdZMdGOHOgtHp9NOn1C+PPa51v^sGV9LR-FGup7(2%@57
zp22aq!GUsfxZEy-s>`*sN?7s*%+cHYWRGSk5S9(hvcR9Em9V_ZEcg1e<QptK%#YSU
zf0HaKImskz{n=8olv&R8XK8K--)yo#I4pnPBqI{eV1c<h5}FN-IJ3FcnTM7@E4f^Y
zTupT5aXOgWMy}zJ+DILwF4BOJnz=#`BG*FN)JTOcsVN~FJR&Cr@BpMmNdKT;szAch
za5}ILI729=3Her6R4ccIdD$u#ta5oOmzyCB#N|jEgtehT*cuvyv7tej6j^0DmbbmB
z>P>ZlLlERV$p(f?r{I-AU_?zc_yZ$l`s7QWz@fABC0N!PuNiTnTb2f<qX5r-ff*u*
zS51LqL!d+G%woVi^97D80SuwDx>?>tLX{-xcaXHeFlnJk;yEv{NF;GL3@kPzokWsu
ziAXBR>jxbyDX+gsLXRIHlF+jU7F*r8Z{_9SEDn2rg|NZa0i3jMXM4?PBLg{vv?Rpx
zGAPaB#W(-bLLQGh-5G8@%T}zjz$(RN**rg$_5jBmASO(s2Iugv8?6~+PcH8;o=JOx
zN=e>fd@0#0iXP7ESdETm1sXkq%l2mGyhV{BeO`e-h%~{W{Ta)8pYgH?l_??mADjD?
zD#N*Cnw2+Q%I-ng0(OS_ar5OZmfT{ZLq#bw^cx%DX@sCFsN4i>Q%wPj_lm@@#UTG>
zng5|VCAK!Z-xVfOOzj%^_4^-M@IMs&<Nu{9q;m+WUqAjFMdbGv$If5sDyx6QN?v=~
zwcO!!|BLqgUgSg7^Owf<{G~h^>At-pwyQ6X9SF|XJ^!|d-o}0W(u5;GOm3qQ;If1x
zz}kHr0sc%k-Fsj9OB=3VjBPQo_t)wvFvI$<6&+KB|5tiUjN|p(n9tqk1P<!FS7Up~
ztK38MRQVdC{Wddy<ToG!@XovvvOZSG`dA?wV$pket)e^O#@J4{iACuN_F<!YB~LAD
z)CC_+*ae^Xzug7zF-PM6e}e3@*!cJ?HXuH49AwOopAo6uvDHDZ9>_1RyUpb^UJAV5
zv3zqa@{0!R=QJ>=VEsDQn6G1v`6d?K9UH7a#s=$mEJ}y+_puYm56rBC_7~q!{<GA^
zq5PW>%7YrMCtcewmIp`Hta(A()l=zTOm1NZ{AB+n<YuPqL6Pck`-kX%-o9l2#Y>-<
zxpnUyJ7xvD_w{|u^z&aX!e2H=lfPE<Un}i@I8(<M`oGg-`Hffy$BkIS;zq1Pd`2uk
zIr0fBJ<`?1$(bi|rf|eZe&rFsn5N}3U|P<oI5~&M;iGLH{f0y&<yGQ(TjOI;KRsAf
zsWAqZ!+!~RP@@TZg3^J@=ElQZjqfn`zwFsxnVsza%_-Y2=H$a<I#$k(i;Z)9VlFD@
zV>>$AUK-a2E=4&VLs!Jb)a5o$qB?&S%2#j<=G{#>@@pIyH|{kqcz-2toqt@!jL|V8
z@&9h9_+Rc!^f0e~VuJB6t&cS{(hv>QBx+r?$=1=b$>v*cx)nFuPtaDW#{Um{Uji7{
zS)F@l?%dI6u_Vi~WjkI*-s45`7AH=;CUFuwi5;8-3{5+XMl;e_Bh7dgTMi)!AuL@e
zDUgLNgtpMWHo$|v$JSCHr7cTK)Akief!9zdOA9TuukC9~%lp1_{{Jqck?lBfLi;kd
z?)~@w{O3RC{O6qizxRHqX_h}IRG_o``7_M&W3$e(IL-d(|BqSz$gH#c?of_;U3(sn
zy%dwBu2e)G!0wi~QW1`UHPn^bV~<L9zf*R<;FI0i{iq2pxwe~{EPqRS#Fg7~JpNL|
zOryu+L8HgxY}C0Lf6hgVVh8ljBP9w>{|#}jDOwW|Zcqz2{Wr#?6KTKyo3iqlQs0bm
zV@gYXD;CuFwh&FQ@;($8q+f25I$v&*I$v#)I{&+g9-ox@0lof((67>`i*EEcQwn`+
zR{9hvl!&)d!uNd0Aeybx;2HSm*j!PVKZOhlJdVJgk)~ojI1DPeWn1iJQew|nLj{TX
zfgc&L{)!oUeh|u*?i>Twe;`8|>{yFp1Gv~9q3=Ipx?6<|DYn@Lc1h8l&xtg>a8fSf
zJlXjWHYV(EXBWuU{&s#ioO3vw^Nb4J2si=Nht}FY`ASqEh5O<(W&<kj7ZwZR^Kn8t
zoWDToE0u3N1C<XNdYP$%36*bZN#)NCbzHa^*jY|m3V@63!ck!`)3;$t%v!s<X{L9}
zOb0W+C(hGc!A$ROn)xf6W`192=3f}h{0wvYYBRN>;m@?TquDcb_d~PNjjY};YE3s0
z3oa7L1{2`yJV%@OIgwEpkP7dfl?o%MibT!>Zvhn^3#f3si3-P?sIb^Xg{3AcoNS`P
zi4YaueFiElpP34y*)yoHab_xf#q(4cu+_P8)g#X~6)vF?sXG{NXrjV5G*RIj<2<7p
z$ifGjsPMriD!e~Lg&#Nr6+V1sDvV~&pu%4~GZp^Evq6Osp%96jhlF@;*7wM|8yP|*
zaz5kvV3?*apaj2gO$S1|D-hcH(bhm!_*9(dh=Ta<HYtt2A7TeQVPSqV*Z$9+nH?h8
z&#*tPxWj_gd_?BL;r1CG!i57gAc7wPOGaiE<&1bR=|z`^%!2rFIVc^(C*<^X5HGn=
z&#->zGmx=mw+p5~#IWV*uz|9>S}e!e4O<pFcf+>o>aLX-wtK%VZKIo0ZkGiA5myPs
zE<>|XtL;WOsO;|oy5x-8<4a+O#+O14jVHuY7QBJt-hflT77q~qwKyGWa@1|$ui`{*
zfb4HHEnr`l1@1}?ZeRg;TYob-_B#=dov}jwpSa>yt-Kl8o<Y52pR1nmoM_+ANv9W%
zp?6*prrcHGNMtpP_yT>`{P#f(MhM*9Bn0kmV)|FOJR=&=;5{x+dIofNuhb9XuX115
z%=GKf+rX>b?ZSk!Gd+u)JJY|mHPgTD$B5~#QJ!-gK9Oh8z1Iy;xmO-?QFgvc&=#Qa
zN;m42*)I?9%w*qd4I0!IpTVC;+}X|pV3M4HTTJcf0n?cqYCmC`iIzK8elLcp^Eu(e
z2uoZ*rhHj=q>)Zr^I>Q)exQjDA86vk2b=itA>qS-nBLs97{9fNFW)wkFJ&=)+gbVY
zsV&CuXw8?u{Nu=%R|m`N;t*dh4)Nu(Cca$S#FtBiFLjyaiE{nT<kJ;lKE2kKBWkaU
zzh1n>0~fn|&@5853;9S_9u^jNW^OlZn3c!-S$%U$9zRGB{I0i1*TH7}mN2wVL>`FT
z*!i^N!2@9~`7bRGF6tnf^%wOH&k5(W77povI^W;K%)cRVrMl1hRHyMj@Z*Qr@xbTZ
zhz2fuJ^$0~x&FV$xD;RiiC5g+H|xd{3UONrh3@IoZKbICycYI?{arxydFSqDsh<nD
zG=%5)nKc^&+wP%2&-hBya`F{<&^cHxG(XTc{<2A}`&v`{$tJm{AFvPVpDq5sLvpg+
z-=Cf-%)T|NFcVqWk!ZDddIqo4tzpV(%o+)=)%xVoz?OvWJR`v8oMh*DU~7Wfuc~a@
z6OT|BUS%2JrPu*9THbYu0MpkcqWf<*NfQC)jx@z@Ohh%mL(+Xv{)VRV*C&?V5LU?b
zGwYFMBn=P;jvCa-GIFg2no|+9eN4ZK?B{ZPLGDyj&l(S2gT-YmDE+dgwxYRjXlhI2
z&ffdwumHe)*ns;m62x%$H3TqF$N3-vd+l!dz>b7&e@E<!y>^%U-0g{7roSd9!d{ac
zbt0VeM$@x(n&=$&y`KAGS<ayOMc0yN$rW=Um#GW4d<0VFaUjn~nO{jfvkS@2H-zP5
zWX-*RtCw#je?J)6MIrflQ6hSZY^jLdK+dE^&ZzFQ$zNH{)i&K1*26B`{GBT}VLUrY
zt~Jij;F)b5Rw_oukqZNn-+h=mmcB5r2ooeF?stEIJtQB%rBgcd^sQmP%H*!?2C_u*
zd$Bo8aY9#3iA#zrSH2<u@Bff%Qm$=sP06)gt{tIkr-ZxYI!CVEa_x~TUowFA{Kz%>
z*08pdbbGlk1ax}2kDw>{o-kk*PYAT_!l^{Z;UL;}I}-jdGTZhfB>cw=?@dYg-x=Q5
z6@>TqN;rik+pg@F@Fs@whOS;8A8msImZBpTLR9JzMaZm(a^~7b+82b{8wj^2VS`vF
zxfQ+3uzEX|2{;)fbS&3l5fL3}9g2kchOW_|MxWFmraI<njaRWY-q1BykcR4=_6=Rg
zz&LMjh1))6CCrO#K97PfN8x^nRg!;->pT|lcxg*%Ve>v47SX~oZdP!-E2IyhF-_PN
zB>4F0e1yiXlQ0Jz=bOlFFotY+DZ&c|B*PwboI7TWrOusmt0p+-+PMNL3eM@#M$JJ-
zZRmJBX!LlTjmmL7w(C5KKNZehD+%NxCi2&{^0k;1d1Z}6S2I_hQR>>n1pb!1+(5uc
z8h>4DdzLcH7coiT0R)z<Ybuq%0YJ&U#1`9+fV{$nmDA?WIjr>tgWYVrF()kX2E&`B
z(MXmpncrYoiHJtR#hewk!eucZDVGKaxwHccVStdGM9AR1w$6X~$OT0FN+PjqE)g1A
zrC~D9Y6;F`vICo5e-+$flOM<8AtdxU8~B0^d<}s#%kl{a3H&nxYw<EX|F>jI(hti^
zNxEJ#Pg>iJbg6P33k?37aIY2}>{4pf7=04*8^_h~PlbR6<WeEI1kn=|QUUeI3(A6M
zopqJF?nX#{5h&A0>bm`Wp<II6`q7Opc?Vhm*3S~kb+H$)$F86IRo*U^@L@t^X5$D8
z>BQW`A{u<brAXB|x`l-`cr$}SD_waf*@Ge?-0$nwwPqC)AeJ@|9UC_z)~ALlUY*D!
zAF(`0Wf1!gHW`5YjwoUu`PE47JEPHG<a!X``CZXj_~mHy-Rwwb;gbl-ZwX1w{+1xn
z^}ggx%1g7vIT9S*0<8(oiF8I(bbaV)b_N8`*4gajJ$MCX!v3Oi^}<Pk!3S-RxSy+-
zkJQPA8<<_@N9sf(=Qy}Xo%885Qs<dn!+id^Ea0C%iSo~%MEU1WqYU%EqR~H#^3Ru|
z4D-ck^of9f{@Kn&grtRkzWy{x`YG|xcb{fw=f^(}h8K>=1fL^`MJQx;QjQdh^b?6Z
zZGw%o7KuFVrq6K*kz(hD5GP4OcP6lRlMre=lQsGfipZp0kQY{Wu>YtvN-FkEj^9Ao
z{TMHwVsi4sxQLacCPzYVDXn8H50=zAtf;^n%j5qt0q@1tAFW$4lhi=ctER*y-Ic4_
zj-G^*a&42V8ei=a?g(8wC9Ia^90_;JwMVXMWzLmwp8-y-AOWt|2d-^U${46ZP{Y&=
z<+Om>2{kehDjFG@GnYLj+7*7=OP}q&;}Nm!tP$2vj3II}NWq5t5uPt^UWS{S0uCz6
zPZ|F1*x6S!!LDojWbTmN)uW9XBTO4Q9uFEl9%rM@0Ndh^ABj+1r&Fwog_;c8wJCb}
zD2UnDggOPGqTF=eWUGk!(s^`A-N424Rru@N)4P=6S0G&iuR~zj@}^S0X~yShq!`x`
z7-zP*&TAIUY$k1+nXUSHt?lQ*^5?2HoKMsD5)byb!Ui@YV5aW2VA^i$!aU7x8|sTm
zI~S9hRK@PRh-@Jmbf>&DI50*(9P}^|^iX0CL3EPUm%k~2D}J5Tewn045EsMg*O?Jy
z*IQ)|eoN}=B^u#-=k0GW90{QO1o90Y?he3uMHI?=-T{Fe<i7HCh%T`}vxANJ>wIl1
z=w=rCnO4Ql0C!|~kwN%;NcBX`q|OHkTL9{V97w=;Z)UDC-Xo}^Kff6=ylLjqXfyAL
zHuJuqnGf1l0;#|cJ{pw%UbLCtkD~R{ocsXR&qQ-S8_oS3&o%`k`9roGL_bfGjNp1Z
z5<34>4bLb&MT+fXu|IEB?CDJjDZ=3LyHV=-E<s(ZmTTwtqKN%F7S;LrN0idvIvWt4
zEi={`i*fuH+Z@E%>Uz^^JjP}>__+xwO^}?<j({iphS8J-cD^(eG(2CLa{3-(8T>k|
zS2Fp_ND+@3+`2=|;(WF3)&scrqZhb!CH=h&?@dXVFFA!<Hwf?VmGGal%$5BTChT<U
z`itG11<AQclg@g(mr0>LNa$X!opI>hY3)G5bhcg<)aa8ML~ZvxtwH2<!`Yf-UrENC
zJ<xDf44p~cx@FL+TL)r11@B6g_??Fl_L$(^ic8WF+uKW|UV>PA1{X<4#iY3V^HN+(
z$}$zZT3S<e>*u`(*wFjvw@JMf7kO9evBb@yMm>py#4Y;HQ8tsfH7)7?0}Ul!xK6_F
zLe<2Jt_#9=!@o3w9UMvA4RmAUN5YRYyeA>y?=ZYq^|kqIa9@|COL%{;gwssFvR}dn
z7{*l1`3x%Z$M2YQODJ^Jl(?k0a!tt9lWS70ZE{V?wOy_qp=+mvyX4BZ`C|6u+9TIq
zxz3eqpJKW#(c^=Z7?d3K=fpy=CLd9lG{@viSp%!nYa3}>5NdBA++L)7>JShjnC?w2
z6AYa~LTY(1U8%HU_b|qg0-dJr2x|06jkmMLJgxDI41-QnPojA5dl2KVJuTD}*SF`U
zI~GYjg4(fI>-`x@cHpZGy-%7db2bQ63+JqrvM~_IoON3EE{5^dhF<F^?7Bh9Cc5^`
z<zru6`<=c-*M6zT4+M2x2@p()eo+{&W-31f(|ZIV{yJCoCps@unwmsfXIlG`@L=5O
zoi+vA=E+dn^a~!n?Y|}6Jc8Wzk7*SR0|kUL^=r7yC+-4@OTH&Oi})-H0qB_UzQ8V0
zWD7~@{soUzub(W5?UOG~X^QY<_v^`y;Uc@W$WmsfR^X}_jNK_9vUKb&1@R}48M`}}
z*VrqRQ(nq+yqG>k0T9qn?Bs0pBk2hhL*4gqm;#VTmh(8jo{+!-WH_<CGluY*7B#f7
z)GEo6%iqd?gmc+WVp38`b*AiPlE4BcVLLOu=F}a8r8zZmyWg58wFF?9fYcgK+LTDo
z{hoXzB=s_why#SkNexMZETf|iLhqy<nPRrKv|d^Ybs!CNzg+tMDhg`@l%R^S0Quc7
z=w@dTW;d;_)m8&4>3yrBnDgsxfM-1{+}rdMH~5N#i2cLNmMLOECv`KfqT0x0;VTkS
zN*a+;yf}+wssC9N?YJR$Rk(U`ow@IdEn%rdpUOi6vXgo*$_p*7OKcKa{4x@-)Jm8V
zBQdP>M~+EsUa0m^Z}PFYe4T`VB=Nx=iTnsvll<V$@=jqy#6A#D^&*_s<xFs>Lt2AW
z>G!h4i1hU&T1w=!U+HT!E$N(wM1FG+#^-N*N!tEMs*HwuZ#VtT>z4pNruAwB2AP-Q
z7P~JZ<_)ACVGa{hzs4NF9r~EJSiVI+$i&pAnDa-t@HcOn1lm%mFC#F>ycL=QNrixF
zX8nr^=}Mc?znD|MDkdgr{}Sc}wR#aTwXTTPx*}X_ceGZpA=m$cXsx3UpuwQ)o5|uq
z^cGH|SXBg~|Anl(MuHVy`CGeQ?=2#ihH}=$j@j5b)>!*<(24ACZNY|cUpqZ(B;4h>
z_VXE#r~R${awrn$wSNFKs43C^xB3QrRzR58^AXVhcP`0vgKez;2QCp7#Q)x<EZWHY
z{^cSo7~J#;p=P8lOsJ;%86*rb>(3Av{+h{V!kN(huOZOaMi3Dm)Y@-{i$%tM0dcGz
zI2pk+FoeGkVPtKj>G_n<=68nqKSxygGm93Zt<BniL*vNlf7Ff1k<tG5xPxGN4Zl~&
zL*7^2|D>z;Z@2-Kg}8Je=J(ydFvcc=_@Wr8EQl|TkxMt2Q9J!hV*d@&Gzza@nj@JN
z`17gr)EPSvX5R-ihOO#Ru~d(WrAAaNounPG(jV|Cjz5S_M}?MX0%sUmm{XqmV4_lL
zRz}lzD|fswMt6YI@j_7wSJ)BU0Qe0a-VnvZ8>4u5Q*_|>M+g1@qpRYtmuCClLR~SC
z-4C(hAo^xvR7Lq8S}-p8qWH`;O7YbHE?30RUoia)D4d<3A~~JD$UD#0e)ilNh|I#*
zW%<`Jo!1Z|tP_cZDJLN6|Bl7mOy(D&lljHyWPT|+nNLK?_RG=v`U>YuSB@lAHu;^`
zcp}(|jA!;pWE#W6J_7`iV&XuxP=9RJX}p0R5L+w^j<bWQcy}G|Dq0b_ey$O%2xlN8
zFTG4keNoh9s9`TeK7Z{yd$T6E;M!i%B9XeFM;kpJ4>fu`9yEG9&PKKC{>{>;k?Nac
z-?d%$Z;AcD4{weAlONs|y9OuS1fu>+q_Rr<>tlMqG3KPG4x}jEQ~!o~;&Wb?d_whO
zs&h%ac|r8!?=XUITS|m_b`syVln8w+NqpNfi16E%DN@fi{5kU%smz(bh!(6FOg222
zY-lhevG)V$Ev(p|3k_y8G?+qYFbxdi0Th<5Iu07~c2LCIPPW3|57DvVh*wBme`fpd
zkv@X>D+QKdEqkq$58|(pxFYpcG4`zCSI3A&<&O{e{Gsvx;m0?<0a)g*|Gt>|{@#HE
z5pf?v;BsdD5dy<sHszQw{Pj@eic%=D5V`%A#=50})5ws(s}Q(ips5(2N|0PWPb&fW
zu#0oW^+31%iOAg(i%b5^lCddc^84RxATA+63fzl;K>RiYhJV$RV_P$U9DiCsZu+2U
zyuW6E`)x^ByA_0Je``+-*dU~PAqYRy>UuG(;zc01fSvy5Z2C)KL3;s*@CAPZ<ibw<
zg&Tt73#;JC{r;Z#VUTekoO<F>MZ7njM&=fhdjH%wm+wGO&6B!8e14qbH;DJgsidob
z+JTz-o5{KB<8y@DpDFROJsuJ-SN!{+?HNNru>TU1?X56UrWb)rmf&K4bU@7CtBtI(
zrG{<baw+)?v;T#g_NWBAaQy`2)gSlQ!jH>Z7LeD+V^jyYafFHZlw=0<@;goO-))M2
zQYr`Kf3L|Xd`$AMIK4!gm&<kR=bJHA@$W&#?w`j+mXx>Hz`GIHW2;b_NcL|a)w$wx
zyqX`WqW?D2)}JEdlD`P$QmdOk5f?)K7Sbi~_Xx~v`af8Aw`fAzG&`OD60Lg;()S+4
zMH=`iTk0A12hHwK*brWNPT1}N;4@6{5!Ly8!1+IEMINtfBMatj;UR=`jN{@3F{9!h
zjZxUCc6Dov!fR&u7V$Kw*4_W&*e7MmQ@@8>JN>Y#e-@4YSrq+K(_UoKUc@vpiRVl3
z(tU(@{!6+9w~P8x2r`Am=D$Qeyz7yNFdjVRcE*)E5RK`>a;Y|Pz6>PH7!a61t_Wy^
zspZ@7VT7Gj1-V!IlAlM|jGFq9CdvPiI9W4b)sHsCf3r#Yf3hk5@uv81H^o2Jv|4;3
zP8W}^4vP`e-`YFElQ(UXagTDq`B-bS*Lh~8;xpS?gi#_0iRAbbM^r^3kz$bsB9Tb3
zNCS~bq*$bZh|xWJ&c~jM3I1WY(@5mQdMZ!|ElOgMAw-59K}aMLDHd)ZSRJp1sb*O4
zgi9Xv8|XhFj?`d*JLS?N62$9LK8V+v;tlb=U&gWYpOidhuU`z<D<Wwlk%(J4f|ba`
zMyAgP9X&>gZdP715_7kaj=KZtC_$6G#$>MvveyQ|bqod=eH;;k(QBH7+BHq;?6soK
z1{gfpB$TdiQem6pheV~_iVmIrpNem?>OudpxbA8^%W6S%-MesdC%`p#Rt&C>H{tqt
z(}FS46fZR`2$iPzRMT9PC9V|wE8qkD`RddShzApSU!1JsM3;{XhmZ@Y481!nt0IxG
zK#9t#S=lYhl@WfOz0L*1TVx1-6Y|AJb|s^Oi`1DN>d4?Ck=g4+nvO&wl04E{BoZzb
zaLFBkj9=3v<JUCF_>E06{^BN?zOE_0USxbg_!~lU{-wU0SFS1e@#qfX>~eqh8F|`r
z-`7Dy$Qe#V7r@~}R0rLhSPg6kgWW3SgZMTne+C*4PtS$q*$74>k;t+dSxLi@fOH-T
zNGIQfokA0K#u7X&<CA0mcoTL?P4S7Q`0=Lrq+&C|E!{~YcPU(Fk3>d!J`IGMc2e~I
zr`BU+FkW!JCHXDgF5qTT^4pa2Z|z1h^PDrCAg#bCmxUvC;ZBg=;ynT=yuFw<IkMzk
zgOHPY7cQOnb2caRSm!?>oS3WT-5`o2`t;z?I)>*h>|$9-@7IGpd{sbV{yIq~lOz^w
z)CPOKPf6kc3V6S(4K9%|4(_p+6mz(#gZB`mHX%I6W5Z52VdO8lKywqR>ye`RZ`-@%
z<3>*Eu~-3#-XzOPv3M+1MMMVk($op*``3|>s%qaHX{x3`Uk7ZbPTu4LojP?)E2dMU
zlK3T7%xlFY3m5b#A0H)2jV*M#zs`Q~Yai(TTNCs?GB@RYNUHw`N#2JIU|vdK>h<&>
z<61P~nS+cP20qwF_ocY-mztN_h2R|TDkh|45H}(yj((x0jupg|my`T)T&0IZm!7@k
zi%aC}Wj9|Q%U}5HB~_G8bM{iggK?+ZzLp?q&tB4r<jk4YvwWXpGxP1VB)Y#BTfl55
zbk&r&q_}cT$kmf;Qm$=s)iZMK67C3HJ0;vD*Ew?SmTQk(d*wP;u6>R|cY6rB4#Ly1
zNl>C>BxO?XS27`GdYpA37%ecsD(}bA)AMt|LA!P$b|G^<*PO$5wChavE|ytl(cUFW
zBs}}syELUwJV>MO3mOgD3nd2KKhdgWC{aB6(q?ZgD7x4OGMp-{z8XZ*vo$Ds(HoGk
zWE=FgJ{`f`J$mN%-&oL``Q;?{T&(AFlPKD=UP+!z)w4l`fRx`@k<m+dlk%B_hpIkS
zdWNT+Zt^F8Ub=fO+T$-cM!a+oNjOHl%pM~q70WSVd3Q#tEzR;b5sse=4f-NFn`9(Q
z9Vt;|iTAZEk=7D#Vu>eOmblm%WG_;pHx??gg0!BPt3;|~9&=WZt5c~ZD_KX+xWptJ
zm#Zt+MCcmM)%29)YTX_Q>s8bB8g8Li%4j>Dgs+h6a=HEpzcvkNk-P7d*ptlAlrRVj
zofPRnP9Cq~5c;w)l5lLbiF|--Xgi0#hAHzF#n$SbVoKgE!Km|T)|q6eXNr7vF@yZ|
zOp%6yXqm0Ae~7Iz_Z6Eq@cu5wH-5;ZG6g_6J+F>S?#G$F$=4NTM8b;FrUJ6<Z&O$+
zjz%JNp8KZnwIK5@6VX2yy8<eJP6Q&?(@CG&hif<4g1@eGicBfRQ{Rk{;j}m+lxs4F
zsc*%&9%}g8GP%wWYxj@GOylFyxRgL5Cun%HlsGPtaM*ZgnR_gl^8La5?&ta>J_eTQ
zx%%fZcR}=8HokF?Loq)}<enSi+lH97{w9;t^8#09{wEQaK+y&oEV1z(Q;v;D3qKj(
z_OrIggUmcva^Z_4?eARcyv(&V&b^-qiA9L-Md8+pp-8}8e45X2mmCud(ESj(>s;Z!
zfUI!~Ahf>=$btb%f>T^QABzf{-zG`|lKUh{E{J}Dg(DP5YUz30QlO=*o<BKXih5?T
z9HGxJb!_^`c~I^%3tO0sgPB<ZxD2uWb#!L_COR|Un;{HjDt>6DV!IUvq$|m3kLh|a
zi&S`S*dQ`N5iXBJ!nnGC405hGh={N-Sz+$x##VRF^W5&<fs4B5#%>*e9Xb?qyD#s&
zqI2z{gY$MR+6(2=^_+wAuuM~p^;S7<_nywqPMBvslH9gNZmFQ2)@oma;vFW{3tH=(
zhYmVDc7bJW4w^eSkCDp|#hV5FC{{Zd00-wOG~ipm9&+%)K~vCUJ-m6)k0Q4(h<0|)
z>Fnyf42kpRq0BA}r(YWCQ~>7tMKLBRislx~LBAHJfq_`3DZDT!{MuL#J6<%;WFn5I
zbmzwo&RdHvE{Y)lMRgGET#8~#iM7toJqRw7G{CcbevC!a2^3|f!ZWxIC6}PB74uP-
z1y<7VU1j^h>K=eEov!hLMWbtd2t7iGly#S&9cX3I3;?p;ZwI9|3~*8m3>$q+cS;YN
z{7jS_GLRrRY<iX{*lf^*^esWlQh%#o4w>8h#t9*IoI~SB_9gQj4tfVCOW;A;r9K%T
za+#llG3*RR70lk{ej>pq4z2)fhTwJqd=uQg9eo^}w|5aS9|v*o(F8<2M)!vDC1IbR
zFU9x!QI3Q)uH;xO7Oxrtcl9OrEqw6GMFB^VpRV?t_<$yHY7YGLJu%>HF4nGVn(GMP
zu+Fu99glUc+ishX=)q3u%W)2|tv6n|kd0m6qA@mg!**xM9O+)_-pFBa%xw3t7m6Gi
za-t*fp}DDLj^n%_%<gGS(9uo+a&rqn*x4;hV;pv0@>u7Ky%(YMtsLYQ<h+o>W1v|=
z^(CK<gfe3bWRbi{r6Wp#ot6W;d@=@TA<0CdLQ1o6(s>t}4y2PvwYe${`m8jV7wQlV
z^#{UXzTYLN7E;I;YA7}k=7NPPJQi6YvA9|KUPS4;#1{>yzci3z%X}U}H_L-LQ^B3K
zf^sm(u}i^<Kn|_+$zQl(l|}<@TJ7fx^Q;NwOTt<|pKMC@S?8x%hPpV+Q0rx4uobhx
zPX+iJ!$9s`M55aiCgP!RK68hI1V%TLLbtGI%L7}R$yJs@at=HwVaDC=Ghrvm`H~K8
zq?63IgS36?04TeYlzpkC?8`zlFF88{?!P?LF^T_*P+Y|YDHq4mn$vy0-0cG>+`K2$
znK0O1A1aCNYuOM^^Y{akX09{?^Ej{>Vhx>(P%~%+vWV6LW)1{1t;8BcniX0UW(x!S
zLzqz!Ib?f<B=hjqdtwBl>sgcw!HASGI>}RAA?5}7;fZ-&ue*KL#pv-?WW%~50D41p
zkP9znpw{#S<Y<{J&{V>C#45Hg0z54s<qm`?cVY8<`jorKCk&a8#r_0K6dy`a`r-sH
z2@#D@=u%6&%R)IqKg;b5rtQ282GqQw1u!I(l>u50&f}m~g-J!E1{Y)!`kGJ^oc^^P
zW}RFIkd$Ji+{NK0RR*lLLxQ+a@w?HA-%WwMeO8v20Jtz2g{M~2=UBPh9U>Qy7#y@p
zV$Edai$Nf<FHBSO!i^Kf{b9P9Pr6wUrkjBfo&!O{$yyktn?+H&S!|I^y77tVsgaN`
zk%ZRLepCqT873!7rE8<)v#xpgzC69yAHE2}^?p5xZt$@o(T!GM5gVJr;$SE$4q8*4
z;p{*;kyqIz0_w5i!BcZAi51gn3(PUR+m1W~vx_%tctHXfstW_uY<5KnuG<n^PbeK!
zggux*Zo%XVY^1(Gx0n}<)hJ4^w?ewne5<l72otHoI6wir(6YgzA>a{`%1TnI2p5Gl
zmnC5aSn7`tEVIl9LTr=eKH$hptLikUc2O%SMVkO}%Ab3YG0<<qA_sCRtO~3NbHds{
z2(An1<B(D_)M<7^s#0^{>{JzHk0I8iU>vrBadUuF^8J=D-*2__2}LHLDi+%wmcW;U
zq`dItj-X8y*q2g(Tox7}J6jA*v3R-Vxhq1=3UBX<njx^pIFdbfN!ja3Tx>489_&|1
zex;S<R|S&%>PtX6KYom*wAN%QfTFEw+Z)EMGQnKSE)eRL70$|3Aw~s>FR%<O+JUku
zxo4p=Q=p?mo?8=x`G(mfUv%^tevB~FFAJD{c`y-B1uVlFwSLe~v1<K_FypQiV4>Ep
z3gd!gxjIa}&;{($#5{;_jZ)an5a7Pv69{l&;`KiN2xa3L0_C5LA>x#rO#uss3<!2S
zOyb|nAz6E2OEdAKcetUW0s^K3$$NXKBjEyP6Mb&ZyW#Xq#QqK6)QI6nO2+@;@$zJT
z_(UT+H8$GF4Nv5&Q~A=S$!tA4Tq;gAriY7Dxl&^^uQBJW#Yd~fllf|GxKhg23+3wM
z@MLXrxLC=ay{7FbTbtZ8mY>R3i@CE`8XC@4bK|&7?%3{wiWbhLrtPqitrUl!Qm@ZY
zO+oNehV-0kwZM!W>e)NBLsTNDAX=}M9H&w(PSq!d#z{N1Qg%c`nBNSLhzNZ3cIGpq
z`IE(5UQ5(ZSMoIthLb1CBggZ(x@l#qzNu8&u^ln&TGh~Jshpe0*s9o#oRJ17D&<;n
z+AjpbR6AWOn66ConJF6wb=$n^NWGdj&=p6k3PLS^B2y@qO!8!-o}V@ux$*p{21})4
z%|Ki)PUfp88u^B)Fu?>ZHC~lWzgZ4NBe_arGFvl|O3>Kkq(2G{Ypk9fDdjhXMn5^J
z4cHMhilbvi1Jr0P3kWrzO=d<)8o_i~q{6L5D608_W>vEFaSctDM;ms~x$<PCl&=@d
zQ<`@wTQsB1PglxS6V@7)Y&C0uYGiY{e2sX<JSlE75CJ*UL%zgLafZt83dKemV@SkY
zA8$-nP<kX!ppii^NAnd#fQb{0ay_fTO0|64j<_}sQiQnDoa(7s-at~WoyY{(uI3t<
z+UcpBX&_$(`ZtA2XY1w3Vs2BZJY`@J?3Jnwt#GPbod`{^nO}^fQ7mf-4IpKt6woRs
z&;kmI%iuq`Ly{}`P;?@HTGO+&S~-`=R;yW)P(8&#gh?V-wIrC!R<a|-Qn7Bz*6LX^
zFNI=$GE2lk)>pHm#pz7}l}{GOs@ZxzgDJ2CK6!h2$`5nMKz;*Q9<j_?AFt-KqnYAV
z!3>w=A)TQlP)USjju#8)mvc|PEsjlP4e|M5kX{`$pDC6zpp$ZAs$LX)10mIXt=y=J
zoB$HF#-`D{5IMOykMfg-6p(8mL4#8mM!-n9v1++du@#AEGu8Qm^ru+H&`70aQVj-R
z<yKDQR=t`PFxnlbP^lFs$yz8BVi-eVK%fzB!lS0?$;_$jM807_4RJpOp5m{=aYiSz
zo3izK)kq{pF=3E(BtL*%%ON*k4a5RVj25eql0HlN5){yt4Ko)`5g*#dL{Pg}4tN%$
z)qE_;8I6ES5ZP3#7;tJ6BaMP-(Mlf73h^{KZYY=$Ovz+<N@yAqpY4s+LfI!Ki<w%!
zO7WjLxp@nEMMtdH$YsifLaCfJVyif1g-fkIib+@aoWyNTyT2RlelQmEk{!cdhl@{B
z#a4Q*TiXTAY~YxtuGO?tOq*xYR%_a6rp+~Jt2FI)ru7{2Iy$cRk}JIh!=9T=dtJ#v
z&%MH%i(os0%e^>kGq>Z=xs~fb<i$I-B!|-JbaKVUWWAo;%$|o@rOtWUseLV5=za>R
zJx`%*>vo??3-em`*1Cmo>dFnoB<;)ABkpS1Zfkg3r?zgP^$hj4?Cq(PZ4E<s!~yNJ
zF8lOTTldy_6whwz(;wT@hj)I<Id09ztufh}))%yFw{;7xX|gp8;j){3xii?Zw?(Z|
zw?RS;i`?>JkbCh>UTh54WL=_;+uy2^+u160M<DFBSjJ`Z&0=wTkQOj_Yg9b_34JOp
zv?jogR%3O;?VfEEt;g09hpq7)!tB`ugtY2U=<v)5Z9SY2Fhh3n+7--G&}(?yL27H_
zJUc4{m}}jF0PBxtCV6gc1!8L+Zb`@id74r0YtdlPi7B+dMWLXjVEqp&K67bjK*kn;
z<!8^F`SXCrpPrzuLBW*)3ihq%BE8jff<nm_6$2E^hAJQSne)t{HH(qfLMQ}8K%QYj
z^hHza`fgaF1}&V85ZzhXstt;3e{#rMllDZnT;avAf$p}GyUs9Tx1D0=ECt#-=6P|n
z?Ic}%9$}WAI$HAatg>#FRs`M|Q!wkO{ps>4VHOOvR;pU3LP)iMZZHXjKB@Sc0iejW
z`R=MZQ2vAy!bAX<Nar&lT2OVS0<EEKjp5eh)w*nW-SFXUwHC~lHoO}o2i(j_&&oe%
z8kdluL20Z0{j^!;_Tw+-gwcjdVvahJZXe(Pxvou4z}`wH;@*m+`yW%syw2oM;x?~0
z>3+BOkk>ZoZCaH$?zOuQRnts%|9VaxwGvQII(FlhhLtwxt#jw?Vk_R9<V!twch-v?
z^_-t*G0vG1As&YVJZfV8!a&Sx??BPyA<6wfA06f%+!;T{4)Y=3;Vo|6bMy;a$L>>d
zcwZ1Vd&HSM)2mRd<lx5}gU83XMp&c@&jp+W#_50*M8eKuc%d^j>n;lUKH({u;XI~y
zsoBX44~*#s{>S{(XnrbpIs>;^g?>!*YBEDkD@|0#g~_etu>+DZP8j4{PYT^TzR!Gi
zKWoT!6mf($`66|zMmvsrF^y-dIyoect+3xV>}Iip*Cqm=QPiUjPn(k%2>W9`=g=Q>
zI=L%}rF>N~o%R+c-QR2*f@9{f>0`-4I$cLvd(!=6+kIXfX}g$a3$=qundZ$Ohg?X*
z`?8tY_n<^P`Adn#VE9kO(uo0-`ox`SZ`GhT0EJ+g2cF-I;>q+7<i%PqxyN&dO<zg(
z^gSl%rLh*?=Us}D8`B>AMad)_JcBlOak3%qp2f*k=qc|0J$rIrf9EcYf)Kb#_r>?w
z!m*^g{?k}E9%`$53$fJ34twp(b@~4OG+HJK0P{A~<>2mV!=O31e+vd2P8*Z4z21!N
z2RgR+avj)^$AP)YmA3O0$v0t~gdg50J5X<B@{N)@Y{s@ZGPY?M(_=EGkNabaB|nFm
z$rWtNSP*{Cc^KjjI-)8Mx1slr+YpW?k8m)Uy04<^g-gBmmAGP*?MbWy801n6@7<>l
zu_+Gu&y(roA;~<1=uXWXmvMd*ht4^NZ@CMa$qG(j=b$%l*y~*GE#B|p8!bftqXO!m
zhd_N5K&^y9-Fjab(%*N6!qMNpi;%xora>SFOmCS1(>DWvTV^W2YZTs>oB`bL%9zl_
zUAw$N^&4)&q@^)yijUVd_3gU<5cJ(L(_3@g>sao2E4+?nUfXIfVX5hE+myHPT9Vbm
zonFGd`}RXg@)m~a=VJnhddc+SuLUF|WKMd!`>$Rd8UJ$HXTW<gt!Ql4G|Wjy9c91=
zw+)2|=J6=OtdGn>3-bAdH!J!44#r@}=VRd3DES~$XXBvG#-(5YOFVr|#M498J!LsJ
zmOKmTz;acNZA)$w3VqdGLqefHazx6^#)%LvzC>7=bi3{o65cBG`&)MrOxN8kL*mRp
zW(+`POhfT`$crD5j=pxMcJz*zbTp?~oCRE;bf<km2Hj}RJs!vbnv>L6yjuEvtMnOj
zzl|w@gSvp8Znr)C)}6a#NT1T4W*d^XIO#6BM_T*lojQVlar_~$V;N-M4ar@J9x7=Q
z5I4}#1|W^xC5OE9Di7ZA_2BoFUV4)kA52{2&2is;2b)^vKIuY|uT1oNOWenudq9P6
z6-39}r5^>VCJLlrk|^ZR;76P0<kbdM|8eF4gy&>U)0}+FjOcwae?(?d+@3o0!(TGI
z`o{oM#Py?h`0No*^V-I}IH$SSed6Uhfxi+z4@w~o#N9U%D)(<=yOKlq3<-B)6Cw=G
zyDd0h48RGeg}`~Q0q0N72b_HZ&Uao;a2|>`fn%4n{RT(>j2;9>uYS3Yqi~v+9OD9H
zSMPfTTd!c-81j$K3?7MajuPRA1e(tRnm~AMbZZ5(0PbcVN;FA#%4bH<&&G#AKYL~2
zvLOGy1^I&j*~rRpn%8#Hi|;Ri5>LvISR@Xe;U2$l%8`;!JLu(?V)u~^I^4gz;}AgF
zMIHkq-0vPEV7p+r40}B*Ja?(E!LOa>@Y7ryp}Bw!+TCy5!73}=x4CH(XOS+(J$H*0
zvvEi;$Nj52xs~*wnSe**khIh({`lp)yn*`xY1&Ic^=T6st<?FxJ4l_bOX6KU==DQi
zz)~{kZ9$nfC>4o7seo7)l=r$1n@WFq)=Eit+?PqKlJ3%bygun+m0KA?5Me3>7aj9r
z4S@eQPC;??L<CpA?j8cJyn!3Mc|g<>LDZWBQ3LJ|U<wjTpEp?gfWgw|MV@rIh|j>%
zd+tJeK9)Wo6D+yz`|jN3wH3Yi;X$Fq|MfEE+eZ_^xASHfyxv90hA_qh(y8ly&Gjh&
zLLY*7uF7DQ`>$sy_aEF{I_O<y%#TIJ{FtSW0ni7Bt@QEl)13T8?rWef8v6K<8Tn_-
z$UkI8j`)m`{{ZyicD&2b$3NJS|BQ~j-Tj9c=*RtqJ9jBF{$GQF*Pc5HK59_#`+$F;
z`wjHqqCH=)2ReF*4&Y;{w^;G<eyP&#zSjeA?wg_7LXR-W`6s8Y6!B|!>@us!oTU2%
z2m)wXyc#6^u(we4+|JcZ3$)$-<Q>ou(3mJBC99AmAFwQw5?H_#SP+JAr6?jpL*TdH
z18SUe$Xnd;KCg3?h=`R!6u))5StFsMq};A!-bS}U5s>ygY}$4$_vQ}s+P2C|t?(8g
znOnnipuTd`coE_-D*BQat@L`9uJrnrdOb+$!$z`1H=Hqw!Yh}0tGCIZ(2PqvW{KCi
zg6$?(40@}V+N>lzs*BY|dGdA=Ow9cyk3-r8ld8jQf7lSfRYpKxzRO!hduqtr3_S-Z
z2)G_5Pt5(SQ@|4a(Yp%V^9B%@J}6dm26ub&HhXiHdmWd+OG!*q!ns|$FpZ~xQMy;&
zfE2i8P@KEtZW3GLZVwiY<U6U@_pMv$wGo3o>wpH_(7wd`xLe<|bc@MlOw)JZ4)dvJ
zhu5cA)9Ne$blN=Lr8zB*EviHEuP}57{p^sMn1J{S0P+UtC~0pArZ2tB+X|cLC0_j1
zNLiKqMUtNT+qYZ&<?^Ka80LNPAksVCj|paz?w1p=<5r7Mdh*mUaP~V>=@lZA-X`p`
z$o)n_Wz^eV#<_6apYeQRbmxnBybnA7zu<oCE}KsE=KBsO3r;v8O4^=lNQh~mde9Pf
zipm{eox^)Tzm%ol15d|0ZsII#!`hHSsU&6r{Gp2>>b(h>$&+4eIPUULCk%gl;}RZ+
z=e<@uy4vI*3wykts_!ZA+ZZ2DD=*YpoI}A$Jl{c+IfJXnv^K*JrH7T8Pd(07TD(>c
z-nbMxP_r_YNKl{oFcvWC^<AJo_j7kZHefa1ZG~$*`5F)*#5hzeul*8mK4c99z=glY
z35R?7VGBtN>j2I|6Ow)I$6<W;!xY@jYtsE4c=fyYK}gdTa}|m~cFhrI#@6I2<ilK&
z;@E{@@vp;yux_6h-=igyaO<qy<Hc5jFTt?A;KPoeM7Tfc{_UN0l>c2ezt!t^KSEan
zdK+T2(|r<w_>I5_RH~xo`Q%S0AqGAQmVC?v0Mp}OQJ6c)d(mSbgs^S@H_zDq16X!#
z`vt%KpFvw}-fjP=hS0v-{%PAoJP9Gd?+nJBe}S*@znl;_13#bjTzV_F_j4cw!v5Eg
zTi9@KNE)=@a!QRrhQND0vzFoZ&M>!MZn*uO!tJ{fonCj+{Y&Nci`IB61|bY!q(k@Y
z^ftSHb;po*IW%&lfq5j+MIv-nvOks|-j(jv&55;$+Lq<j6nK^ESxnAtVcU=_Hvh$x
z9^mTO4dgpCfW+>f07Jb;xY_+vu+vi1>PDG<_fhby@Hdo)Wr#l>$$jr#X-Qv-bTB6>
z49ohzi0zM|eQbC2bzBcF?oMund)0jqtV@YO5dh_6nK$44rgO+!hW_SYK;0~Je@IM7
znSMA}4h8LU&$bgPYsY+QEv(9w9J&s=gJ1}fAw?GM@)mR)PYxkH>HZNGadu8|C15Xb
z-wzdiqqdL$min$h|DS=*OaXP!>)dQhE_6SPlF-7~mnj+J^D14C)Z7n;)v^TwJne0v
z0?QMJ7<!OH12CQ>#-Uox2gWfk@fbwJt$2rC-1+W#=?PE&`Hpkkr)pyMbF9^h&Ce<u
z&VP5yc4wcfcq$LB%vx9YI&{KT_N2mlVVF4oISho27zpi2p+<1V7u#bfVYaUV`7w(Q
zf~r<7q3Osb72<Zw$Um0eY7Y(N%tHeKaOQBZQKOLV?_MDs>~bOEOGs7@z{NIH^Eh)n
zFCFZ%MYpYRYMH>}Sq`4{Mq5szKP(j&$Dmu!=Mi1u8isptkYFuRPhmZUHPH}zCY~H-
zGzn#B(PpphN-sg(ME&seVlGL((p$R2TMREX*ljc93GTQ$?vIi@cs%XJ_pyPc$?r&s
zHZbItE#8t%^oOiRTc~vr^&Ql5PuP_n=9b%ckGEt6EN~p{m<yY0x!dz78(NffKXBJK
zyk$$VX~67HKukdh&RvEg-okAZXKkBdqP-cWi1hmvzu&nl#BsC~Ms{k@TeQkH(#GQ`
zb1^!=Vlw0IJeXf%Nk8Ur6YLAq^j5x;X){psO0NwY^Dt@L_Cp*Q%)&*3-d6YYA#dp>
zW^5RgeS0b^@cT}op+96p%adRB;=|r@j1CBRO`-!wyx)J<F<4$p+|N7Et+3^XZN6pR
z<`rzE4Q;Jpy)DVlN_!Bm%iyDc;j{;k1AnI>lP^IK*qa=Jb?a?8A_zu7998LprUp?v
zfPt(;Gs!1-`K;&sG~k(5c>bJ_C_H*yMb8%TvIs~UaErjx9&Zs)Jm_`1J!x<2upQYP
zpnI2X^<Hm_`_h89bh)=>khGCPYl~NT9&P7^htM1p?lOSI;dDf>X2|h0VmFzB5B-&1
z{0eW`u&fer6LEt8!@e~6TS6v#8HpvwIV%p7)Q+20TSxsLVx^=;-_NDzD{vL1*Ld?+
zV8<dcALjp8;5hDw^7_j#L9uiNjuuW#9R>ctIVJ}4r^3y=4!*W6YcM%+_p8!C+WjTC
zCASPp(pTWS?Z?djGLpC!GqnRAb1Xe{e!A`#;?|SKmDu;*CIFw~YYosyK5*B4^j)?=
zwN88UfR#>o8nCDZo425RKuI=Ropf*KZYkExG!{tZqNPOCpf?|>P|ANZu*A{T_PW(i
zFw_BVoOF^ok9u+Lw~>!~p`dd+dTw&J%y%!EO04jDU*aW}d2_dUz016Itkp0nHg3VF
zCVYR`+@zbnFI;7=ROz!-=4zF=`{bR+hQ01aV!rz(EcSEU5?u+)p$()lIo<AGVuyhE
z`T@2+;um?V-Cv2(q!F!&*2+g?1+Nz_&mnJnaz9bs3m;C~QUE;!2PK7w=n3)Uj%4}^
z7|`nE6XL#t0P_|IhxND%@A2A}d+EI%T%nhuCE)2gyV*+QS|q`L_Q&9Q*ZuHa_2i-S
z!ywB?fF~F?fCxqqtPgKp(mkYefTZ=*QhJi^PvFE)&_Q|^)4-zG;f!;CmT;|4ehHvc
zSZ##vB>{-bo|W7Hl|nR@+&Uaw<cn8Aed_Hv0$Ah8HAzSp_{9J`I!SD{&|(w~3p&X+
z>0bS4zy*H<`8d4BTe8I)+~5s^J_dysz70=Kzc=VU2+z)Z>{`7JD()O^balboN9T|0
z{>b&kF^1Sl@7vr%fCi@?ws}kT2^?3Ta=&{&l;-XmW}DN5`#l)VF<8*<l;0vy3;{3N
zV{gZ6FurZUtR|Pr+^kN1IxV<&Pkq#mb#2n^hEoa1xflxx$pfNq=6rKgPUm+qb~%RX
zMBi&r379P%BC_Xi^wP_L3vb>AFTH|+wyhrY>Wjg`a6&@f;&cG?Mr}O#CEUp++*Wqn
ze}&Xp+L58`Ug-AS2Wfp`h*~|?7p_6$E!HEvig_U(wpqpn0gv3Iu=Y@a#hI`6`$)o&
z=_|~lIDozI<=%>nu%oNXZyc*9coq`1;|1szgn%vZzGLXQHY5wA_I$$`dtT0-m#*@9
z4@=Y1<8s-S&>nA}+2d<t$1vfC0bfsYwYL)(6s%GuNWR?82_ygpaWOI}Jb3TJT!QED
z6j2{`JO(*#gnPDe>o~R98(bmI)^2R%U>)vX#<Vqq@IO-wZS$5v?qOo&x=v-AT2nY3
z*C`TU5UveuykdRq+~n=u>vh7byizQIMVMo8QTM|%Aek(|R`0`LR!{&U*iZ)Nf{W=O
z#)7}aTe;a=yIh3F3VOgn{F}U<eO_vrw|3AbL%J*g-zCr-B=6#nMtkB3o7l>D8w`t&
zi0|PDw5_M^dwA9i3#)gB-GLX-L}+Qph%WmSRD63R444gR=OOhNN`6F(4xbf6rRe#v
z)(7TLY=(M|`J9o4a=twgSQ&vkqBxbsvx+D2aB4=u7CqfRgvM^{vwjE%&yFGzDD$>g
ztGoAvb@#t>sJxGX2_XjF;JKTvLwqd`O>q%l3qHjb2KIv>w76<P+RlAA(Fe`stFc2^
zBeu8?VYy}e+gN^kAnG2zbI99p0NVhlz9V^!w;d8?MPeRgI$Q%%;%}TZ8r=Y<#bOMX
zLcAkGG4MvL6}|2kO*8)uIv2Ed9CzBV0-$h#q*EX2<14)dgNYP8EpK**(B3-tn^<u!
zLvI&B@~y}HVldzO<x=D!_+5ISK>sz?l{vPN<Qq|FIme6p;^blU8+U&$&XO_rA76e5
zU|r6=<LhVQWgYNBB^I2IA?!}Bk(C3w70<Q=DC(qQG#6S2{HHT;+m@V$7(oMvIN+rF
zB^-t#;@*SP9sTZG1g$&VZ;2KI>qGF7a=*j9K<<E0*O-3PP88+?2Wjwl(J^#ZJbPyw
zwXYZB@GxwfjouDyUqLboYF7az+XYG7vNBsE+p$i5+S>;8Ldwhs`Zr?jU(RXSs7QWN
zK#aNXy0Z}XAiQ8A;>~OLlQ-KtiRoos%N_Z`rR3;E-d&F1m0e4FAI2wEFLeH@P~QyR
zWa3wKEls~M_NMs5?%Tnm=AG>(kGI*%HN#smb!HpS^ZAOP=ke2;-k+zB=jnqOc%DC=
z=Z{wF;o0OvUD@Y9E&cpwhyQHz^L+k=mG95f&xOVB^Yr`N;`hg$zNi0_uRl+hzJJ{3
zXZtfeKmDdXd!xP2U$b5OO!xb2xBqnM;_23Zs`zW3mvuTVGv?*#!u9`qeM^V`S?#s7
zp$iLtvwv)ry78Q=yOwUIf9(Fm!`|C*cEpa`RCk^#9W?s|oBQ1;UO0S`qN(3zy0-P~
z-NLgSK6(E9`tAb)c{AL2fwKJU_&1uky(Qp9=MU}dlkuaS2a^xCy&W&$<L_+koh`q)
zzi*pyU-K;W_jJeCjQ4LCdhzjY=%u;b-RD^Dp#c98`fG0QT>HJPxjjP{&FvjK$8t+%
zp|j@px=ed#^E3ZY$tvKtS>U_38NONY{Qc(kW-0fTbDWRa;A^Jis||d!(Qz|=(zD>F
zxm|w2p1*6mmfqy^qxVqq&8dgm-;URTHkW@X_R;u@z=86XgPY-aT#Gw0PyTMe%>4k1
z*XH@`LjCZ5M|1m+o@4u$nQ@*C4l8$?;b`u6Jlt<+pQBlxT6xus$GZc1Ybght%U^bu
z@@K=-4dL;J;B6k)W-~6VPw6+FVZJ_W%AHLveIjU2<&ELL+3?hyZsX1P=neR*CH`zZ
z)4fl}&FOZ$&FN-2nz7&3T#k6>uQ|O}ll5E0Cd`|qLx24@_}CsQ!{8s7`37IUG{To{
zZ%Mti<KfP?n~t0D@_o}zWPJ_sXLI=*Oh4z!&-@H6e`kZ=j`M8rH`Ct_jr?zJzqwq$
zfxEd}^Y|W0D7=yJ`O<2p9I|rTZ`a6o%g5T9<2-HxR?lgM@7vAmm}#dOzB|rB$Ib0t
zJq!Mu%h`6D$I(n@A^AU(&f4GRQ(70sdnP%|@1gV8++Q<X$C}H{wjP^uXOqJ-=y4W2
z^CP|d&Bhn|r$(#g;%Iu^j%_=(Z{4yvJ(8{EN7Lo0bamUMmtK0=*3pa8xe`7?k>=MU
z@TTkZmd!((hjygbjo0gy+U3K;S#4oxtXv)|*>{HH2+eT4TrTCtv&E_5Qt9O6CcYyc
zFUwAE&W&uz7Dh)l@7O%LW5<@A*`1edyEHqp<FXw)a)s^L(Zbek0A<ULi=Ej{9`Umk
z@>zqke}}@H$LE1{2e4F~i2^<@Ag6rzIfTq;^<+j~tL{u?Cy_pi|Cwx~UUo890(@tL
z7rfTn!5j7SXrsbN5pU1NIscP*XS>5M892zPo_414(<o3yVIG&sjN|?6&O|L=m#C)k
zD3DXtYxb194c{rB!Y4JH#uVSM4$Rla@h*R-v1NzD&qQSGd7DffuZ=(DNBz@3egFj;
z`ICSoQ?Aq;d@BJjD>o@<Y3!tv$?QLRbpMMpHy?b-fy^y0zUe?F1HeyK<dP|lPUE%z
z1^$)tQ!=cKX%B^D95&AOCwSTkuZS<@K`#1b2k95kpTdDBkP9)M$>`Gr80gd(0QBRv
zTJiQg66~FCzIPhDB9U)lFOJ|74>*rhuI9BlA3u?H8#5X<?dlCLF3&bf^^CmN9rIr-
zjpCCN@{EKW*9x%CR<A#D<)O^sn-w>Qj~qVGlycyfNW#sEB->uDQ6+_BCbOsUB7eL{
z-@)6-Mlv>ess{R~<6)TzK;Yn$0u!LgV!fCxF%BNA@J?#75CWfhd=>yKhpHgXS|yuP
zdeZ^aM)4p8`;jXqThEdafjs7g*%<-Ct0NgDUA!8;RIVa1Q!S2-gPKM%rF=o|d_lc~
zUdFSvaR;xocWR9h+-iz3j7n;i%P7pt#FSGgWyfk5KpAwC1<O>Oabgg}UnovHrR-^f
z1C|&m*6|X3CzmaiMzZ*5g78G4F_mK-d{~0z>g9^oK!1&@oR%XKl20=^G-|?*B$x)L
zs+o~S?KJYT8Iwdn@P!d}C6rjr%PioN4i1SDX^Kix9@;8Tf~7|@{NO<e0~yT&Y?5s&
z+AS1-)Dqs0kDGjT0Z+6zMjVD}MM$)<W4k<Tqdd;XZsfglAZbbsTtNVhT6Qe&ROIsp
zC_ItRs34IKnPg;E@GgIR%t12ob&66EtjB^H#<vb~ptgDq_=CWa3~h&XP_=r3@~<qN
z7ITzYWqh5XItikaaJ4S?Dvku=`v&-sN(Q37285C6AiYlIg;a`DCo?A4*tS)&Y`of-
zQb6S^4;su*=W`j15Mr#>n9N8N<#^`MIcWowlbIRWm{<K6hEP3m1xZ@WanL}Zwkg5M
z?6jsS3uty@(kYfDsHrA`UhsOqe7<6Vk}z9f|C(dLs$tqjD4$JP4YRBaLn@Uh{~3xv
zOa2;VQXz|Hn?^(9$Yk*qjwx_ht2}f(g%>Hd&Kw7~u~r$M;Rv_LM9y{t<PZeqb1LDu
z`L0Mf2}8@4!U<#(5M-#809w<9fuB+|KUo2_g$h?dE|fK)q~d5P60a3&EvquURayC9
zP6%ff3YM?oBN!QcWF_36ZATa-1P9ZV4#J7~+(>I^n8EMSM4DzIVa$xkMEIac`czA3
zm<72wRUOOJvL|P>He31(NDCvfZq2|r)6qUTJTxwoiZ!7rks^5pnpt{Ahq-L)d1AU2
zRuK{6O1uK0KJMi35gkaH$<vt=PWI%O3Zq74l%KQ_rl%|+uRHiEO-TY+*^2m9ORfyX
zsW_q%g;k{h1KL#(f?%YOf=B_ws3c|6<whN103S0NEd$;4>}17ZGME}XN(o3!%;D05
zssvKoMc6jTE+(^8%kPAeU$2=O72z<B>Se5BT*Wh|uuNbfA?8JTh2o+7aGus1X;c9O
zI>MS|Ln?IyJGxq%)@!WJkJtzZT;otFH<1U|`OAywv5m__f57qr+*Wc}pX?IguLreL
zMPMca9QjFr9p8T`K@CSIXmhMup%RCgLR7yfB!Zk7iaXZGoz6kAH@K6}1!<vBa1>f{
zDPyH5f}_xWq3z_Eth3F~$SGd&^46NnrdbriWdTLGUWWi>!Ku8IhZ0@`giJYI%$G(r
zNaR)JV?&V56?}-N=G0F@e9O1K^osRbO38<!baBem$_0EpOv_Ufp;q8rcl4HnHy${e
zIeg^kftzpHfAkhV#m3EN!!qbbRyLYR{LWHF0%6r0o#Ja{{A=JPwOH%(Ck*?T0JR7s
z^+`)+{@D&RAX$4(f#qO0;16siABO^vAX$ER3>;n_za3v|5*@ENl_6xHY|I|`S5wDf
zuK~+-nP-a~U=#KUFM9l+l0pmy5$M%CI1vCKk+o}JifIWc3oBeQR*MOL@RA41$=B{p
z0>&AHMDq(xhQ!A(M&SYIRy36SrUeVq8-zFr)aDo(1R)syt(3v(Fukf|ON_r%DxU(1
zA`vKvK&*b;&E7c&_yCz`bJE!q=9TNPpW4um+|?@i9F%ltMAZVKKM!U(Q6pM`QVm0u
zbZS!9mS;QE;EYPgsOS<XFN&SbHzVSAsGN$@2_@VpnDVspG(J5BQ?sNIq2y8dW*0<7
zqc%>G$dC~!Iq(%P5qQ$Egyb`J+M{0@*wYG=lg=d7^OMkmgs2g~tCblSTEU%yj&ax$
zFc@GL@T+B+F|CC9ECMAK<)Erm>UjVP)K<nAM*!JsDgaQ(wQw7hS59^cbS;**gicQ4
z3s&?PXa=Hef%YbBp(#=mm~Ij(3;Gw!&KWCIpo-NdB*2bANzTb)wcY?A+0juj1?C=7
zn^1zL<%3?%IOK^_l<%$KR<0OxCW8<6IYhNj$w=6?7307i*9pB9Gx)k+PzDhxgFDOU
zt!Tzw1WT68rw|z`VrGp^DlytV<?=)Weg#tlD<!yo6ubvxtRnay7k|PC<RJ|;h<o)#
zfRgC5pt;V%Fz2S66SaC3C19CJNj&m{5~E^-KoLM+&}@~;G8vjEOkl<+uz(9@J6nP!
z1&weNDt>k%n!*S7(KqrypAaunLtOxX3UteqB0fIH5~gc9Q`8<lS*U4X5>_470QyY$
zsY4XTYRCEE*tt0Q@Pj|Gut4JjofM(DV(2U{bpf$&AEV-kqi^=cjs6-852lJgkx0Vi
z=(VPtC@u(*4WR_ohTt1HUFUkIb~e8fDCVvKo;LSZhmt0j!ALT|R@Rv)!t4YLHy*kA
z)*B9Fu!h`nAaldP7aoYFTy^BegNLt;rd@kvM$)Z^uQ_t`#sgQIk1~=wf$T}~HNi<@
z9b*~V>QH%*gs()BEV7fv*CCDsPM3Z$(iz3)1jS&|&;5yP$iRkxRi%rg$m6CsFcxaU
z^um@gMeLM9%k)PN3s$;12pOoWi?MFu3i)%YIcqkL!&>6Y*u~v&dJ^_@w$y-oLq2m0
zMSOAuj<;MDrr#8eG?viukz$>R3M2yURCrnNXKHByW`Hs#!5Am8au~OoC{4A?=n8{5
z476pZ$u9^}>Q87@6NAKMz5`mE6n6nYkccfOUxSSFDo_F{0y|a#DG=aDK*j=KGUW*;
zOGAS)b0iN2!vu(W!{UWTy-|h!YO9;LkBH_n><^YH)o4&G)^@H3&<tzv(G;gK8~N!R
zlys^Ol4X`7x}NOxgu^-d+nA7%aWkqRNrT=L&IqEDb+{?SRYzSsBWr|6AP`A7hGNp2
zv{o&LI<XP@Jn^Ags8Hi7-42urJGN(DRIXxyMa%R$;;sy-dB^ZbrDRgvJDRqiL6kFk
zg(e=s(ttD>8SeDOF)m9l?yL^sHwK~@Cz_;OUb?T1qd7p85p)}5GfpMRBA;V5E?cM!
z1$-pAj+Kn&GUf<hRITx|s>UEeKxc|c>==Ad!<q)qfrdnNW~PWbX9D6zXaW~h1lcNf
za98l*^{tOX9Y#WJd<wo?$UnG{b>P=!OBi`Qqb$ZE^nsb7ot`wMZbpcp`dw7n6G!Fu
zF7)8X@C8uoT16>Jpis&byb5AZ!i{Kh!%1L6;Zmq&=7XRL6af%_Sfwnu3xzXqltIPk
zw?HLRKTd10pW}iTe6ALv3mT2ehSNbwXo~1SirI>OkC_oDQ22&&rZ9=h>?WLIG$c(o
zYI7)pC8`9!iiO@P)}{o~4dj?ll%f6-Dl6Igu~nrH1zp4WX|O7mXu3ibkq%a*S_2}E
zZhjh+svii$X;6eYmP4-g_>iqx_UYP_Xe|R*J616h!MY47#O2x~oPtA;vYAzjK`T(0
z_}yibtYL_6i3{bz{R$6}VNxm-x=0#j1VXM_K5dtFsAx7U-I;U=i>p|C1KfO}Yh0V)
z&WqIzpkyc#;Pizog_oE9VQeZ0W^4q>^>J>S5M8jKO&R)xv83WQVeWyqcq`S+DLDA-
z(w-|<;L*1+gSnABK7Ya;3!;%abJ)kcRb$XLL<f>AQCuX%9&7sXWS|{}gM3FhBO~W(
zmKkLN_5@C-4v0Ix_YTDu0m9Ea&<<}10<s$7t~wn8vV=ES9%{k~swB8VU8QPEwH1pF
zzSL}P)K@hDp<8c0`hr`J+_K-f_UKI-xasI24Jd>nd?!wzHkzcKjhhN$1V&G=r;*GE
z6nz-}lOWm?6f<a8l4*8pGNbU9=ynDp)!NA*QVi-duQ;QgkOHxTzQlI)bv(w%_j;4s
zQeYA^iCAd@m4I1iMAX149Oq@-Wf0qdCL}-A4NX`S95IDa0y_#*&J+fXW^(Wqp)viW
zF(#QGx>hF^2vzncnwk*0izuqVT*Xm}S7?++G(2i}#N^~oG~m`yda!$KCMGT`r2@-7
zFd#`iuz2u+UkpQW$|N)A(rOr(S_YnpilIMvL3Elqvl>!|gNa~)65T?x#8XNag)Bd?
zcIcN8Lkyq!!S{iPc%AMdnKu%L_pP}I<EOIKsc@BW+*ApYPUN&_<rkUT5DXlA4%}lY
zQR5*}5}3mIgfX0N2vW)!-txym1IrG;7+V57h*HuCCBp{ja5p9?+><16XV0%d+_Bxz
zpdl}EhK7lBrDl#@Edw~xr?@tc!YzTdL97J}p+RY64ou6zBsJk5g#%QF!0_8rX9zT!
z(gfBeFdh8`SWyK|$_WDmpjK$`d8lcj9HpjQT{r1!P+s{RY%+x(@~t{+cwu-dXK0*_
zL9xPm#f?b2jyd?UJe92yi~@{Fwu~?n@QsOW<5aN#&}V?1b!d-9R{G8|y4oO*WDhJe
zEryI->HUK1A39Zr=BHU@VTGI3Rb)T$O?d*LB4#IUbX9O|Mo^b61a$pDKvqpZOA2Aj
z4KTw9LAF{&K}ZTHgEwbUPlVG4mAFzu)0D8;yP|%F99T8b4$ytQ+JMPsQVaqR!^WO5
z_eYt@79m5X<c_$(o*F17hGa1wafiAjM<5U^)Xd7Nyb?|^BNkl*h@xMfC@YFr9>XTu
z00^WPX15M8TPIu+#hB_@xKN2?6+0v?#*DZ;0f(2iKYF4(1;J%v)JC{HjaEiaKsa&B
z6YEidsvQ?YglHu~+CxFomRUtNcSV(vx{CN9E)qV7it|ue5oR)0Jj0jfRD_9{<^=@l
zm7U9x4+O-`7AYZ%tN^W`GAMFh(JndSjbLa5M+_)A5Tuvb1Zk9zp_N;i$rMVsAcb=$
zYZ<bMCWXP^UB*rAvRb|!HnLGEOiY={slu-|COfL|Ody~Wj{r+M+)EQFgn)W_E2<VA
zz3SG?%`ZNDl_P<xt~+pb5WVs`4bwF$N}b@s#&mMD8wF5OsHY0iTQefc>?5jIVKCfm
z#HB$+2!e$oQ)v#kp()4`(64befLDk#xPPcg0I#qJGa)5eDULe$h(K7ww3@R88S$fG
zw*+KMWg=6-`6200l?6Sk;cFPwErLisPkyEaO@B80gn67O88yc`U<C7IOnDOf_~y`y
zHYoy%>g!1ymyq)y)aJ8r_>@i~piV3LS;`qYfikB~IQ~0`tYD~RAS{Ki#N5o3stt#K
z00Wi)Y!`7rA|*pNk{=O^!^VIk5qDA<lLlv-D*Wut5hoc#@Nhs~$F3d2MlJ!B)Zs;!
zmE{XusauPFn~>=?UwQ$sRO!vs!^wcD!jf62Nk@=TfF6>OCw_3Z=UH&x12KratgO!f
zvQXxZfe?T=jf&XLhODRmNP}BNsiNzaNEM#}O%Dm=kOb<NFt!WCpKy9o?voQ>TBkb6
z>*NFwh3aAq=nWP^9{d46R544l93+B(kRR?OQQWAm<0i&B?l=p9G1hTvA`jQXNgNa6
z9ckQhkm^zZC9w&Fk_d=UD`3!tMn(>mFo3xcmMo|<6}!VSj}(axybPd18LBF&5+o7e
z<Q%oUQiXS(f5FW-2XTbO9)`1S?}=hLH-f_$C#?qtL5b>~4$|p-Ln0ub;AKQF010m3
z5zWR8BAq_I5fCp6fF5gk9y~$=0+UK;3G%|(z!n&eIRVlVa1TNwtPF9Lgpz_d40T?N
zL(I^iZudZK2IO^k9_i`ES|O1_2^%dq^Q3YcZ5BlR%>pV76~v*(5+cxXmo-xEa5CYp
zA_@T&{RpT=gMi2o+$)%F+(<sM$Bgh4lo)I{H6}->P)xxGg*^t6k*cSR>2^tj<@kq6
zB7kw%$%iXawsw#}GnMHE*sL;?YE%Uf3v#n&0G4#{T~9KJ`YR2l(8LG`e?oZ<F>H!Y
zK}u3+lJ1bg#T7TPoQ10qv8$q`6@n)aptP^?p<HQ_wM($FbhE)=3<-id@irhr<yUcu
z2szS^z|B-Fz~_N75Z%}qhxd)}N}Jr<1joY5CBACWN_6v~+5`urpLqVADU@b8?SP3=
zOO_ABwqqt)bh{?&vKPdqSeEVyJ6^E<)Tq!o$IzJKrWEK7`zl$Zkyz58r@Mw7Jb0pn
z&>dZQrm8rk3GJo9I}dDPp}^)N#1rp!@g^Biy|Qs~0Gt(IWE^2Iq55P+InK<mZNo%u
zRq0M3=6VI=1SkYM!TE%PRdsIBREkjfQ7nu@n+E7`(hZl4_DkObbUN;K!yV3Vxl;Ls
z5aP6fda?eA@}_ZUhwy6)zuGLKpZ4uI4wOt4soCIQ9FH{G9&uIzoB{8Z`1a8?H*hnV
z8a9OB;FHZdWP${k0d@wRoXnqwwWwm<q>EI9-2gxT>5L4(w-e<208XRiPnHP@bW1sX
zL8l8Njc_kqO3;TWSQL6(pk(Jk&iTs8L!oK*qRL;sma7&;qu?5fbrH49U@%skRFv|S
z>}ffpNBxLxZWcIgs(ABcB|^;_HXLx`6eL!~aY49IDM+ECoP>v#8v}GIg-U=xWfk->
z2yDs*qptUg{gXgG5M`HeLA|d3s#hu5lAyTM=^kN0d>s_h;s`6q29h#HSOy3qIXLGf
z+6<I-(RZQSi+0Av$CjXMx7xJ0-m9mCH{md~0m?{0>rDr*mP60DJAU}uP~_%N_{ROm
zKrpu0Ei9H7#Sz;B*b6E^7TA#kPHJg2$>x#`&mbhJ#0xcsg>3SA3L#5hCLHxeb^r4y
zo7ucV&^8%Lfhvu3QAcq44hI_$%Y)(doCjkgTp$_9PL33zzTw4<;@B11H>~E*q&eeb
zs0jotdr!>fq4#l}QfPuQwZTH8hdWi`Nf?WftY~0i9458P8#nX0UI;=8nJNzC%GzU=
z4;rP_tOy+J2|(=Oj3lfGIZGuoNePJpDnbib@#TR7%&^aRX7SKH*FpwII!WUsg1X9A
zA$gFB+31%wuxK|Yc^7?75>#QU(s)<ZYEqUjRi5D35WP$M!=zw!3_xOQfa|-4RQ1*{
zykO`V6m4m?2>*uoMFb+uAF_g!>2TC6(_9nb;()*^z<L-zU9(|GficVwQmuy%+xLhW
z?g*06D4{U@L}QedWhZ<#&zKZ+S~yq^1YsDi99vL+4zVVDd(i59>>_GCC*tKpmLfHi
zv7ur{5R8(XeVm3+)fAS#sHj#|RfdK^D;w{)mnMW?7=pZk#%HL)>_JeYs}~_{PmNQg
znh4v}l%l%M0hKusgKZ301cYBzGoHhc0|)>R6kGI(jbj2+@Zc5|T&$S5(|EFBSrl!g
z0G*kWovULmOU8s@pg^!C36zZ^@scUeO89yJT2ze`?eho$L85zvgQYmdO*~5ggET4^
z41-n%PN2}o1Z2WiLH{+gcp3+6C|(uZS)EHYeXisx^vCslcU1(t<t<TNYb9<$)OpGu
znjIF|U{5y`7cZRT$Z#<^Bs^kBx1l8t042G4ii_z~mEBXB#gQOrjz(dTEgwCGpB42{
z&@4I!*ANN#Nsv0AP#FfNo(r)SF^y$(cSg#K);mJ31g*j{z)~D|y-fSEI!Txw9togb
z?rt7DV$R=b>Wv4lJ<5X}`^AM}V~pUe$F<kp;)IiIO=H&8$~<PN>K1l2Bw{=bP+w*I
z(sL=>z#3n*1#t(ZL&ib}snpA$6cC0So522=j8IOu!c~B=88?8mQ#-{qf$M}UxQvnc
z?HVK5ICyCba1$EKJ{(8f_zdy9PZlKTNGUo@Fr&no(2OtzRZt2D!y&S9Wj9oyt%0Zv
zClN>pf15{bAKV5PC{+eOHcDg8k71)9dSnIm8NXMe`!&vlY{}5uB4-x$2pEo{@i-c0
zn@7<25Rg-ugnz(>U~?mnN!V2dY78{wjL8W>t5YdJ*EQj6jv6auDF8Gl{B(lkc$zg|
zEN+o#4x*uN`W2a=CbF_R;#^?`ngVP%NDm~@0<cX?%8@%9fKxXTWD@lb;Uh7jB~;3f
zWpg+n%%iAs7FUGqICNpSUNUHr7GGsd{>*^KWWd@z7hy9Q&<BAn+42HTc=*$L^oST^
zDGQHF$7JM5I6AoZT!dN<a-~1ehM^nQ%g}NG0(9~zJk`dK9sy)X9;ILkpMqfmd|hT8
zlT{Ev!4C)EHK1uCBbg=vO&ft{iGLcyl_bi8_o{XvL=52hHIu>+Q*bb!ntEgUB>kAo
z1Qh_|Har4O!65+1+Qu}VFOmpODgacFb`2ooK|*t&lwr`2mE|W#Yh^{N$acx$85(hh
z0?Vp^!6VU_gi<H7hPo)B89EXi+o9tDeo6A2234ZcuYz=q0F6ps_0kB?2Ok9#MYX0H
zQ2a)q-D|(9f6+)5UmQkiOnE&n4Dk%|Q%ZB}(FP9F#|O_Kn6@OS^CO8+h-v>plGJ&$
zMq<ayBlMwQfVDDmgQttAxxiANqDLOH2A1U%^E?e7_k+U~t2LiH(j4>n3Y=g#`;2Fb
z@R$ig`cMxJL7Q#Z;6WSf9#xG9eUS>R=LP4XczD5SP=xWhG(aNWGfmlwN9?A`aw;EQ
zyE-0OQwNZQX*im=s2H4XaSt&j-nT{pOhY3TPLwHzVK0d{gbyhA8`NTp&`krfsEcJF
z3;?5=&&q-OdA<=2LinDGBOtypSf=F$bX<r;k$ZIUgPZNC5;;IwWY1_)6a%B*o8$R<
zpkEgElf<|<fMxB}M<MGlPUx$KYd{{2WE@Xmz=s3kHY3HUXv8JPXX|L`$fz|uCb?1+
zQ=`--+YdtTqS>3KoT-z!+9_<L%T1?7D$B4#acqTwm?@Qy%iV$^HaA3+2s+y+?t*44
zI*JtxMa~%$mlDEELFs_YjHg<&u*>B1jP8d~Hj_tWa}2(=YIz#Z!6^;n#uGOsKHOxm
zDl3z0hUCU^c#-FF<hc)!8SDZp-z*EF0k%bgr-y;_81RnK*L0B#WpZ$)FdjUyGMEoC
z$ppcV4Rld(kiMGJMAKAsaIYg274HxhJWM4XuoP+%cO$r3(2w0?c%rEp;V!C#1Tz{W
zlHp5YU4wT&0DYc25|K%<Y2fbM1U*n%HB6fHZ<<tSF*pf|^%75_7&@;*qr;z_7#<*2
zf+l?#+aC)eg(Kywp;#r<oKj>?sV!&7EoX@;XQ`^F_N!BFsAo236EG#30y5^Bh8l7&
zma{n=@W*Dpb4t&W;#pJd4dZ%BuAnU7a@3eGs(Y$A1OCqCOME6UoGNq-y8@~OtqgLz
zJdP+r(LP91#f}}G7cXL+#-p(k06Y@FbO}BL_ZrGJMlqvApC6(%387M}ox(!{z^P`?
zZ&)tdv-y4q*krgS3sQFUcr*q<izE2puFP12zB027ChTJ83Ixwxb9tr(rb!JRfULid
z4iB6ZhF(RXXv$)T9Z?ihv5f#FH<m;?3{5boVG^{4m^)~O%NTmYev%(XNET1ru>wKI
zI(1^4>`3S=utNGW*_3Lc5}<@M>N7DP#KC`94<<x2R;G?iDI9Bpa=ZG&#Nf(6Q-gP|
z&UCn{P?t4KHX(8H(vRrzAAz-^XYH`xiYI}wOD8w;>_$=C`c$q_iZTd6tP6$uBp+o!
zni&TcS3c<`b7RUm$IFc>kf63dw^BrLtCSiza!{JcNC4Ijk0AgxVqnnRHQOb+*kGNL
zhn2<82`q^pp+>WQYzjN~@M=_HMKU0|0n+6}5VU<h8k6DicmyGpWOK`i1l&T;QHVew
zWnfpR3I=f4IMh}&O63(kRTH8E)6ZfFRsthh9oxal8L3P$jR1z!03a$S{KZ%vO_G}I
zSjww)Am?!%J(XL6ze7VKplUGFDUxLa4tv}HgKQ>20cR$bekK7Bm^gHbiKaoo7(+8W
z+Kd7Qb#h1l;D1PA5E;yvEgGYm=|>3NbVZJz1<yBeO&3iR>m>GP?Q>7`T~J1I(V<m@
zC5<8p&*IRE(sZ$$q8TDxDZUE2Aju(8XOd@>dBg<A-K?K&l)E|<)p$;$zzi&Fc!`6P
z1N=hC62jIqpZsGYHt_tg*#Uyifec!W5&%cjfr%vSU*ihliY*#?I;XIbKtaL-rn*83
zG~(=}Jhhpo3|2cij4b6*RWwYMyc(7S=<=`!vQ=2qau9u_3I{$Op)10K!}Od6(^YA%
z%t$w;78MD+Lc|<DYK)NTL}2(Wkii8*Q1*ETT5(iKS<Z}uuS>AIVX&@neo799nq2Xz
z5D_evEASvFkzSw^n}*r6Sw*-jAigBCM+&I8aRv&&&In$@Apx<27?OQSO@hmc#;9ug
z^uDSH;+kNbfx1kw16q67oDv^3HooX3RFlJ23v$fz$A^l9==dbPHYBe?;F01C({v<Q
z>&14p<I<0*b34M$Hgp}b5;zTn3#r0`w&Z-10AjUA2_UMt6_wHFUE!R^)ACjc2}%PY
zvfYDSRHaXOxr9Nwc4nksrCe#~BeB!~=|Ts&(u_BSC9HOmrlYnv!Nio|V=Go!^U1>u
zCP&7kqK+*s5Idjhg-oP4_5)^FHGCr?{6rJAs1b){9Yn;Ze?`Fux7vHHno}l4+9<e!
z9hv^LjH(`7LST8*+X8A6CNz&Hz;<l#yanz1P&jbSU}rp(ZmpqEk`~3XB<qP;aBNIm
z8fuPVNiawk>r6FdRV*|?*CWg#R!n)h4a{HAZzyipsUS(~hswx6%toqsRs{itYIY1u
zGu#^z0>2tRGIz(UOSzJTFck+gHqIC}E@xe=AWNZx^023QsIMtm)=u**0ajQXdX~c_
z=u?&&^de_!F$3i(ni7-+#wM3VDU^(r1`oQ*!fEUg3Uq&&p5C(4nclh?e_Qak6@T0C
zw;g|%;BN>1F2&zvP66T?_=Cn?F^_}PD_c#dP^lH+5L1-XKb6rGytIRdF8t@u;oYCA
zZ$V>t#zaF{#!wWeE-FxoMQf8I$hwUbX;#N=+=%)Nr)mtNc|7d`4H)J$+@FLZUvWk%
z^mG~=oeD?BN3in+IWrNW1&4{UNsRg6voo^N8oR?-c{1}R3_(aEOC)93;mNZhLTr*F
z+|C_2$Un1|tDw~<Faj5<;Z;*q#JCCbIWkfd6h~T$8N5IzoP!5$#CSJpB4mY^jg=^}
zJ6u7wuS|k$Zs9bJ0w~qwflg&SE^=@lLusYm4%H4g;V59NXcRMHU+aWp32IVsD@l%%
znfE_Qh7Cja!HTVKDuRa`b|Op;Sr&~J0b})Kk^T$uQ)9vPqYM*teYX=sIPPZBph?>t
z9NVB)fjtiyO$9#0D%|flx=Wo}9y>K;0=Wp2iEs1alOOV=2drMGXpo-FqZMIE3NIUi
zOIRypL<2C@G((;e(PZ0#UxUq<DyCzIQ9g2STGNOEVREE7P4}Dg>qvVhM#~SIR{nrY
z+ziZ^flvj2O&}yw(Wjwxqe%C)A*v-y=742{@)%GIo3cK7abTpTDAsyr+V~<g6U13r
zC|%f_FwdBoDW@Zp#~V0p;$AfS>PL@Uc_4H3fot~Pdc!Sv@Rb`R*S^@fNs@0mdf*zo
zRzdblt~+|<@R3_@HaU2}^(s6ki>(uzUgox~JU%F!N1SYIaFLFXV@3hxDx1Ta5iSTR
zbeVY~R(-?d1?Y$N-C(&A^wSdbG`Loza?q9x1Jg)qhySKg=TRo?3P5>Qb0-Kw#Odqk
zd@I8=qp3!x0H~_(7U6cnX-O(%swEo#zdnkE{dSoKJ?{Z!j7A~|6sijZ1^rY)HF`Ay
znfkE4f5tpMYH0=xXBY&YQphMPLKzV%izdm&Q>YN^H;}ieELeZI)N$j>XEoC$ZzOp!
zN*R!qj@vNsQ0uBEtE>inU!Cj%FijL!35W$LAxI#Ys(@V<c1g04(CbmmvM)QaW^Gg}
z1=<gkVGV1CCZZsl2)#$zntgqS$=2uXWI%Au>El^2)hIIHTgJrGYUAD-r%+ZUW3`I<
zC2l}HA1`n5GQFwhr!bj?%baADw+M+q$A-SRE9~J5>uazFe(Cg}R0H$Ngfl?o=xYh-
z_x1t9MBpVu1^8!cnr&%<<*QP`q`-23!6?tHgC@$Lc{%yv9KGqr%+Uicz>81tx;q;=
zc=ZiI<mOv%zUjc>tNqOVx88E3ISnsKx%I{aP8C?Q4O^hO%s@i1>HSyT!Uy8D7gXS5
z?~It%@VI*@#!R+n>f7ejBPo+=CMEQy48AT0EY26BWX$JF?c715uqlDVO(ql_&|{-q
zD!iwj0U>7s5Xuqt9qY&xHL)^0SM=;TCwRhCg>xt<$_MI?mM8f_3%remrl~;3l}JvI
zf<)v9jHzvk;+b<>ixX^8<%Bjax&O!B+rVg*rRRYkP0dWr3^T47<1wBPyF4c2vW=&!
z>6&(Vmh~1*6;pVs;rptJ>6%&MDyR>-m?@wJs=I3}6caBSp)5&I7DXsxQ^-OQijajO
zWT6N}B@1Oygd!B7h|Qu1StvqT6tNK-p$IwqzUMs8dC$G)9`0rAII`3w)py?eocDds
z?>+b2^LLj|=!ulRBc-_`6P+GKL*bst-osaXFS`opMHiercwH1VG?!M{zUAL#=a0(*
zCGCm^L<OA=#jB>fJa9tRh3o66tjIm8+HUfZ7YB7NS7tRlBb!R4(L)O4=m>rH&`Vh#
z?<J|94hf+vAfvBX7%4}A_;y+b9>s&Q^h~u&tuODc?37bmU02l|pY}Di@m41H?9v|C
z$q)P#+Q|=Ono3^*Tn7wGY@Di}4tHjNWf(`6V96M)ycHdj1k0f$a+0FFS*v)G8@f4}
z+!}pv$LzbiM|V$-Nwwd*XUBv?ruWLD^1Hitj=8H{lY8Hbuiag!!E0Ky$0$v)CeJMr
zm8_F>m&$)q4$9JHqbj(S^CxBWSk_L-<HM~SE@M9Xq545d&0j-BU-xy$-rr^#6Io`j
z8??0lDEX#{8}E?(mn9V+9`mj~f@G<Z%PozUmVkQ#I)o+aF8qTL;ker-l$|{0eUDEE
zY2~qh_(SQ4yKc?lkDbS^_xJ1_9h=>~=es*5WJMk>_wJ&!V`qDJEYFVaknOBcYsVM6
zCp$aGceh)f*mq=P(Dt~ivqTXM=_JUzq^vfQaXmjqE$bMh_0*9b_{mmWd5_i$>1y~r
z2mX{;7j4N~cl3y~>wZR80F~W*lI{(V$FJ_qZXKKbp|4#&A7n9|oXp}N4|py2i@I#G
z?^Fx(tUDz{1>a?tzK?JVmCUZ_tE_lX=Fz3TOnkSS0}tV~OAK_+mMlLIJO9wsp&mRw
zwb=atscuro9(HXB<d)N!cA1!z`$G?U3Edl?Gm?4ePr2dVBQoKCRF^`?M2XHOOYfDp
zbjcE5=$2Il`t~6Q0m~x5`NML6qRipTzXaFX-IiPLd+i-lQ?q+^OuNge$(=zSotk#C
z8hZ<00gOyxeJ9tovD(2gu|&VS{oQwV`VhwU?09!VDyK)3>&Vha??_ilhRj?)FQPX-
z*_|hodD24ZXq&pn56j4lG>`{e6Ci`zl2Hln5NX)t<xVHqrSl;><%$$bKlClKzT3wX
z#686~Ww>d@iM~PAq6Dc!Lqw#V1yhs^#$C5nXdLxGRhhz<06#dUj|2z$l^~M5S!tbA
z0}l~z;MOo}%;jMuC!%QZG7+YJWjj}l<D-+a?H!{*o|gUU6SEUzdn!$QzE_b&xgyIG
zWO=fbQul~#^eU!K#-o;fZQ3!ld#967%)2IcX#Zt)d~~9K%X?7SM;-)@)-U$b159L4
z&T;LW*gdvqdRAVQe2Q>AE@8cupzlxY*ps5FyDib(H}!4`s_NTSswt?dLshCNsH)$r
zQcbWO-<;Jn%<g!vJ-RRT-8MV+-n(O?qp~BgoFO~5%}$R^kB?1O`L)|qvr3y7smJ>{
z54Fg8?tCwegPiM>1o7VZ?gZ<+QyCk9tAZ1_DzNv)-rL#!-mG>Z+~UG=+9H4VYF!nJ
z(J?t}s-5>qE6Bc`vr=&qi)lF#u@X#cqpGI7il%i;(X=}4+`DHgzBjaby)|1#{k>2|
zRd-vW>+XfJsuHBCO7M0SK?*8CiYmcS6+sFrL5eEDH>(ILvC;NKg3G-U?xS+5<NGM_
z`=+b6T1gWx-eQ#=RTg@)NGuX2#q~~3JoHW~v*S*xfUANO?a_T{+@m|i-AQG($lu>d
zWd-H+cT(0Ttw<VmStk7c?p?cQcYOQXlS$g#Jyj-DFs<u~rXeVr);~qlN~N1w^tm>_
zsQW{b&WPJqbKrvy<ivLQDRpo(_VIJCd_6km5T%E;=hrUSd++XkZ&nVWQaL;)rzhGD
znA|hE+u!Nm9@{fEiKlC4=X*QaF0ziz^_!feD{15<O^=oFJ~|*0U2C@{y3{i_+)5k|
zYNDLk$&Y6b$!mrmBZwdN>Z_f2b7r;QpuI9#5H08LqT7OwLlKkJ8-7SfUx(qPmQiN{
z)H1TIqtH?adX9t~nj5KjKkdrue3XXgX7_|g<{zUg%}&WX*W27VHM@7$u8F<q5}|Wq
z=<L3Uxbz~AQSTwh<kWXZT|6up4KZ~6G#}7slgaAYA00iYuYmF<EN}jW1ZdQQm3vE!
zQdjiQtJaV7RZ;q;6<Ypf^T+b?r>A|${B^kpEttI6xcyG3)(7S6L(NfK%3Fbc(!x)n
z_!>91b4<sdH2>b8+%5O#s1ADRB|2X2<lou$-U;N5@1D8G=$;+&YN-+J$}+x>qML{-
z`Q-E?-K%%_h%T}JUAN0GT)53~GHRh?o!Hc`$}RWu#2wKGWWRvS&FK1~lQPq#>M|v-
zn<r2H@Q4KJ-*V*We@U3$Z90tUi%s5Bbja3?tjK$}crq`LvzieqDsQAEuXy?*!uKe7
zeUoY~{a}B(ni}}Up@d{4QxBz84~}ip%SYs}3>?VPWi@o7dyR@Nr6$F`TCuc)9cj3>
zD7tp{V|0z%C_?;Q69IBg%0YScl+8>h^k#MJKJ)Z+71_RI(bEbWT^6fo<e_%bnxFxV
zP26CdYDx$kd&Q+?7D5lY@{*&Ci%w^0d!}=!!}7YUZ`cB#bTv|6bSAd>VOigPx@*@9
z-ZM5myL)%6Haxg(_U#y8ldoC4xD9uYD}0>}bT3PKujp`~49?2%&7tLmZE}~(Tcm$q
z4A(AtZ@nY&({w4HMBmA>6kTPP6!nt?JK3j0M)lafsgZaFBPyzq&x63>>!27oWgV%b
ztf9r%x|*GSZl5_XRIvacj&k#<k8HKj2=c;BWqFv{ES+r`D`3;$-Z&MJtlzzRR>tp~
z5Hj0o2ft!LI6ntv?1Eo~U0j4Nwyp_eyd~{ELnYZEF;ztqJY9|=>x*E4qN1RR+M1p6
z06QV)Jqo4Ehu!VjkA{NeANYbX1=4!CxZ|<sM)cfpl2FJ{QuuY%vXDSOX^E*}Kk%rF
zTil6Ji?Z5~^1=~)rw(|K1((?$t<rL|tV-^wB!?;l(_rVGTz>9N+W|iU>(wO`*&U&o
zD{XOf;n_5>;2mFhZ@H1=N$Jx6VM}sJVxgmk%g5z&A&xE3s$i53Ryu<}dZ)EKFFOhK
zypjV4<%ZIQ0pTXld~~CN@;wFD57Cdk$TD$vLb#00=@C(;i~`h!JTmL;K8~RFtW_xB
zq(WK2`};k<rcJp9#X7j%WqqdJ{Qhpoh2GqvDjg%|$NN2k^p=k<We8U07X<Lz2KkUH
z8mgy%_#N%a=>npSiYuXec~(6_kcpOLzivbDX7Y5CWyJ@j1(jj059eK#cf*X*EKKg*
zH?5Oa+Kdp3M;(cA^fA^Oo7p+m)>#4<4-HOxs50;`Js;cyu6X5AcCP5iyH;kok`9Gi
zo#8J-#frUH*#vVf-;o75pTixiB73c6rKR@Jt1wxht)G~1k0!4u6;C#Us)=qf^I0ZG
zr!ULqFNaEegiG&i@E;XKw$2o<LdWokx7BNnuP83h#}Ri|Qr%<BUB%ILVTNpo(%~bc
zwG80^u++OSGp2e{M8Q-5O;{8F5|<*S4A6yAQ4Z*3M9tJIZ2gZzKaxW#Shhu2j6aei
zNAwLr5<neel>N+lBTHfXTgCN)MblR!G{mYQ9dGULkzEGeWegVgN~rJ@Lc<UMxi5S=
z&<mi41NAXe0C<t~1L)z*+|3sdmku^aL@VxAdN~R-FoL;D-@@pXn-G-AQa9p{IgPLu
zT*^l}IR4jVr6fvc2K<D%&NnKmh?`uUKPsCk<OL25j~0kV*1e@kp6W@4GItXrPLpp@
z{=zBwiXrR5^eYZJQQ}YW7V{z`k5KnOVB{o3#wJ8f=jJqKq>*b7`*`Y$Mv+A+)JhNa
zA~P{%VxqM;^?FIR#>nwwnaHr+*W+zuv5mY7>ZGWScgq2<vVL8z_)@I0Ry-GiUg+Yf
z*~9*gS*LW}>!qy1U35em57lx2v}8kErCva#={n4=o=nS0Gbn4yw3DD)>kmj18!oi}
z<2ofOgx<2={!$HOx1}=4ohJ4g5dgji;kM~R^F&z_fU_z@%f0o;!R)f^M9<AZkDJ$W
z%8xMVQ4zX%#NT-*XIEtY%s+&rx9)EZKHFJz+8Zdwm57T%lw&S$)J$6dH!$K}y!4Ue
z25rJ9PiN<zow9I42Z2=GRB8O9`D63)wGeqLmYoewM=3EMt*}g;&dR|g{tlA7>&mlB
zUORNj#Sdj5!HfFY9w*7RXb4=bapItxLzT5#Qtf2f1BOQQHk0ou3gTub<*>0?<&*bo
zDOP<IcbocT*MrRJ$~&(doN?^1%opln-eY>Q%rUvwbY{=ZvT3!{E}Xh<O^<ZL{D(r^
zQPA#-JJR<%?5<?N=^;7vr=_#Ee&z6r9{qS!7Y;2QmbSt#Jy37mqa(@E-6*p<K&3YW
z8v$OobOVhn!0Jk6l^D7u84^Rka#)fqOM#9`XvdEqmk$T%Ct-&C(H1h2rJcLh$Fk8z
zdJB3Ck*`Mv=sKpu@&N@|u5w`Mq%LW9T?)O@j-adymo4S`14}1L1M1dT%4&M==f9%h
z{0_=maXlPV8b_J5cDJ@Xjdb~$n<1B8l#C|0*Adsf#mz6rCTked)VaOA@>uunkqENx
zO;?{wG~`<pAvQkCXrv`Ai|1smh3sq7GCp!dzVISnq}5>cJFRlsgLFF_vOIr8=742=
zpnJHvV-#eOwAKMVFImc1e)N&x&PUb*V`Z(R)XYMxad|}6xhlQ)l;V*6p?XlQFIT`)
z19df65!9Llt;DQk5UH}hNaHD~bVEP>9YnSYpO6nk=(v!s$(H-W`?j<OxyO+<WYRM&
zU87LTsLu1s5TrKy`b3d+j!@J)TJF!#EW3MEriW!Z{>QRG6Jt?MW;3oTZlQ_}W~sev
z#-)t3oI()JN7_PFWeXuI?sRX2Yl~fhadDokc+roI$+J)&iT)9!ni!~xhp*(|u@kyp
z)0kYNB+61{bPK(<Z*oPw0O0tW4`kt!bT9mf8Tmi%;_wx*Y)RTrbmgT%SH!rd=aMW!
zBH&6ST*(e8c<K$5ni%?Vg=WI_kq@X~C732jWB8%lD1JZ|V3`IZXozE#tuTf7%XRm-
z%*4z4qms1f@07LcDuwFH+GmUgCm)Q$u%QHeQWmy`TyR1NF^!+s7JFx9iU>6rgb=)<
zYKJPIF^Gn7zb&I*?~m@Do!ZfMpV{$~2vdscbc;W*o*5;zSsJ9mfUVMb*ssPEe?6)a
zIV<nTOsX8XUC5|KnLA;3R7v!^dX=N8u83UKR#sn=ix`Jbl_n_4y(r5*i;7%%T2RzC
zWd)?2l$B?4XX$66oviQu5-quK$3W;qM^+U{p{k(mr8{>|&LUm$l|pK*9~*I96&csj
znhshKcS#4VrP!E!_EQch5NV(80v*@azi>4nuZ5H9B_DU(>6Yp4UOF)Tu|iWCE9qJ5
zc(kV#X_pL<J7&n992dqP0~&-}mqK{=z)=REX%q$R{$RVYJ2rE+d(b6cK1{VDhotIP
z4uQA~k;0aekRuqQC6mgeecWR|nEgnXA^Giy{^ifZhd-8Hhdcu#ADt74gXS~lt?;zj
z)^eHR;w!axa%H!i#WSjnr?l@;3A&L>Iq6IGPrB;oZc|@I8ndn(^dYMP<@G~XKC_|m
zSsUkpq|6=0CZ8G9ugkj3_iMOHxg^JB>8WcU>xZCp`Ji|gV>%tjw2+1<1zOLwR-V*Z
z3rV~T3E(6z@sPcg2fFeRQD15OLDMqmB$ZbB0d9ENoo%cfAIet%q+%;o_n<URiYXw;
zj_x$klJ2w|EcWA_@9Nm~hdbr^K-UlAI8V8VZ|Z;*NnD2*G|MthCow(JmC+5Y4f3qj
z&$zlHDW!QRdowyQt{o#xr^GNZmp&nNU4CsxGz0|$pjNU+QHsm;#@$4@U-zObjpWN>
zW3!X*$>4vh%18U{)gChY>*7<Qk7t7`;>#3j47E#-$u@aKkQV~Xm&wu!9quwf7c~?S
zi~-9#0_WwVn!0k;LI$aZVVAPK+O5V_RJ$pzIC$Y(Q%9hFXh_4gTlp%LaDEB%RNBp{
z0;Nin)Z9D6ac?F)Ygxl8lb!B`N8UMPIlhmiJ9SMDMAGe-t~vE#`%P+ohK(<Unr)Gy
zJaXj@(~l>*!yc6H=z^Y`C%2xz<69r@l-J}V?vyRvYwiUZ#HOyU)%J_FkLt-0Iv}l|
zGL%`36WDI<E?uY0`MU1|>GMHHcKn4r?>NkZkCn*7SD)*81h*sSU2<}Cao^&Uz+>o)
z?OWV2KY#SQGW_}B;(I5LjOo6OY5ne~ew#qP&YEJo^-1vF!Vxm<JlbvR0&smO$Tw5p
z-geNpHboV*i%hl4At^9qlJwg`hBz<n$iYud*p<`Fbq`l<sC7e-ycFmg?)dw&Zn??$
zjy-$ECh(~~OsMA-{M35he{!Fz`PJ;)FOdy?YI?6<7Eu|wvB}B3eicTgH`haJ;uk)4
zm5NE$Cxgtfh$F8ql7+x!@3+o`$%Lr9EX#vS+8gP>J6A@p<U~CgB9XeLM{b{R^V27^
z%P-shKla^f&00_4cadwJyRX5yN+;DVkk2o;D99;YCp8p#MV8%_I`2Ba;6l;%PL9$E
z1?p|Z*B4otSJtI#!>-=$1U3Isq5V54+;30GA|feOE)buco*bK%yfY7()tlWhF|l{2
z>`@z?9sBOI>`B=<Cd-5iS~8F?t14#S-M35ju2uWVhL^qjWCL5tci*0=eeL$%NoC)?
zXL@XMc5G~RZ@Wl8{{G(Cw;ZGu*Cj=grN{2Lenl%r+3}UkM$+{i(5G6Ht4YX2H}Xnj
ztDbd{RUQ4G)Thtbd+q7(g-C0LYn<Jk=Viu}HB8o=OGVP@ilM=l)EE7C^=(#OfLt}v
zQNg!deb7gql=R^vAAE>2E!~H*-D42_XFbkHPO#^*@%V8WJJN3phSo<~p^v)T+{{<p
z1D1XH+6Vin`?ehQV;y6&(<ErrSmWeSAGiGxZ6j0Y9?SaFKJ<|+@OPVOC3P$+X<cxS
zMO0R&eXjsdRB2=7okUh`JAdmmxLAaj0p)QgK*d4m4gRB}(jCInMjj{fBIOooI5PFa
z>qg||YKsnm$#Yx>7vwY;v2wi*H<=_uYut(^36q?0-`|$6Avrxis8m8-Xs-%M2;GS7
zM}u#Lm{r8O6g5rXE49kBE|+9c3k&a%drwgs^^tPdJ_cL=INN>pYNJ@`t(}puSVVRG
zT%+r<%K5ok{e8ZuByFNP(mJxN{9`nVhQ8M!ApN2R%KrnIhjw-IEoUj0RFWf@d@Wq*
z%7~WVF)5#4cDK!nt{^%&ug`F~XXN4U-`4%gAvs1v2I{r%;FWPLDR8zLL8VN>kx?wU
z7xj0W`+eK}4uury<CAe>y3k=Fmn&!OR%y-EDS&dfLhaxmx^%eKDtrt>Hh^TvPu}JH
zn@wa{DAPia*baznE_mrlYJM9jhJH#)?hz&Fkn_r%oj<lDUY@2i0fx$LqEV78^@Vvt
zPG$|KT<J6Z-5v5-n?15<1dkWlZsd9nV|%A%DX8pNAh2(zinD{x7Z-2E7xLaHeDLv0
zeDq?^tZvzq_SrSd5!>X9TTt$OckP=f1U3Ci&%L_HTci9PkQdCIpG<R0=%!H&Uc#2=
zXh@r18d`uP0<p%_^q8y?aa+2OL4Gw&L?RaGJOy5X#`jLVJ3BflPgW-V-5u}E>bBJa
zpijsGsCgY$rO4Jw3}MSVhFnNHp`ZJbo~aft_QSZFwNSp^)158AC0{gkhWdi7ucvy#
zrvtPxktJZ9Qc!!H!U=Dz@*c6GYs=(VQ5~68e}g_e7C<q=JCu)UG;SNcJjKB%EE~$@
zp7CwDe8EZ1g!OB7CUxJh@5I>R{uq=s%u*VDV@iw{wg{9xbVd5;zW3hyUbU?*Z?E>5
znwI{Uyhv6C>DCHYd%dq~!3Q&b@-|xSqwCOjjP7Vh`x@eu6!vw*9vVAWf%K+~JtVWj
zYVH`<%*uKcmhZ<_E}JUN^aZ<`aEC6^ue7nmR(cnf-p8@vjS|-&H%+QFRI8Tu=jFX#
zmwL+hm+Me)-d(+I^26O`nq_i0#GWbbAJ4i^F-*1n;B5((+t%F$B?1jr_q_Us-f76C
zRBqiYub!3tC5?$2PR2HBzt@o$V#N-J%=n#@aWMUmwd{+G7Md!98*7k5*fkjJo^%6K
zyxVl_Um}842RdYhr?PvYRx3F;QCA<R7mXBFa(yaG0})h34ud3oLm+TOrUn;%JVZPo
zi^=2|HAm!0d^Z~L#5}r>bTlTWTkXPdj9Ypjt&a@%yOR;6kKGz;x2AT#*Va=2&_=Z6
z5P+S#WfOD!vWczspwg2jLxY-l$%rNn<k9GKWmXnu%zqyR@vDxVykFobU$y7Bcxc)R
zzP?U`cF$K1^bdlCj(2z;DFW>P>$s{;SG&1>cj}K;+3)V1nBMX2F@0Oo9N4v6jwy)o
zsqgwaOuapOWnZA?Q)D~6Z}Q!}1%&t3N5>asgh+NWNcY6Q5NL%sq95-&{()2>U$h0t
z4Gg&=mAwY?PK2`d(`H(Kb?(jOk<Nl?kL#Fxc3tmInJdsj;6#za4scUHT3_96eDl{a
zb$ndNjVL)4KTo8l@{IFTGTMu=TBUT8Z&sNVl1i!jJ2|8%gG~}EH>N9tMkZ^dgL-Lp
zMJMrOKwM_~#1vD>NR*msuIa8}mvEf`mLTP8({kvlTS@%39CE2^UF3`#d9)ssBm8ur
z+8?d%*Z4?VBb%Imh$AxGIrEr<m+c~AqdUO$b9yr8|DmkSa$nMMf%#gj^Zc5ZvPFFM
zhw~@qW%Z65+trlo`g%eAXVuGSq$@W<wR+JbvZ!31UkXZk*1D(1FY1^3PFL_3<0yB8
z<Q`Q@QB6Ig@OkTIY^%H@YrjXJ6rO>JrmlFZ)TT#jA*&p!E#OgU;a2CAa?x*R&_xrv
zVWF6RKFWT~zS7K%dsW)F?G2SS^hslgCsU=B`K5M#qeP`y@Jg-RTX3ZjeNr3Akm_8A
zM{1#q4qOxC7Kc^_m#CyH8lz~NMkP(Elk&KY8kN@ciEQ*GFs)`08tLjfx>PqpBVC!@
z(`7}edeI}Y@V9DeP{1R7Z8KBt2#s{P+oG5&5gO@+%@;-G7>=}&Q*JiJ?anA#Re49&
z$h(|%m3L&V<T3=LtLaJ=w&WApC}p)x$tSWwk-2qX#pi%4V~<DrzQhvs7>=~H#3V+#
zaK4y#MUTiLT1a2CD0)N|rM31&tJE{HEG(!m+LgT`E6x9~uD57a_KK{u1Tt1-ugI#n
z>bMwK;uqPWRP~joXjJrwEPMf`1_d1Ynf1!(MPz)Vuyh@-n;p}IyT$mGy-HU4u2XFk
z`IK!W=QB3u6WN3{!o`@yaHJg;&xRGjMYBr($Ua*6nqkOjL>wUu84)^M%Fx6wXUE<{
z)E6w+(m%3~Vpb7yg>Pi5{W@E+Tg<b>uVhzT*qhoW{w4dWCBP|5Ml0fySxQ+lT(k^W
zS<fw3tk5MM>4&9?MfDhtwEas>Sh85ONj)P=u0FI?ibdl}|Hxj$bODs|pn#Y3$ys3%
zdzGxp%OZ>M)bJ`aA`ZN~xFHTVk5we7@{X+SB_~Ia(TF%OBc)?36%nZLjcoa{k}<CG
zj;y5xFRa}wCcVNpvgKGtCgdvb$XXxrYUyW6is2@HCA(y~R%%|Q60y8`ZC8=5RyX36
zmwZi>CcrHOD>7C17Hy?b#k#J<u;5j+a*b)uuH*^Jc;S?r)UxoZyeh1$R!4VhY+F>Q
zU`PiIV)Mv1O0Bm3e&iww6@x~RM`WQzQE5^1sI=gUF3TK_*<cJ1E55`(ve({5DNofb
zhD+N14lkuh_06MXf!n&mB=RZQ#LLNwDbk=yz9rkjTC~)->|L^!dXGhGscFHlWXGj#
zsa50?+2|Cm>pNmqRne}(H?n0juUZw2aFustZI#`YLli^LXha+~PpgZ9iq?r=WT!6{
z>2zPwKC2V)WM>YGRIgGiuvJermdUbO5m#YqvPe+&imdbokLE9ncByA%8KyalHZdG&
z+oY$P@+{h<o|TrEF3s7RcVw+ekY#gj>Y`{^@`-FRbFoG9yi&xZVW1V{yik#)TA{=c
z&(U#~H>JsFmAEp~dMRCAvBX%K$V-`0g%U$NgO{3@d?Q=5;xcboF}YVHs#A?vwMewB
z*9nIrNy#U&shTw`+GaE&j*2<NB1N@A#GvturyGmr6~2*eGQC<fuJVqol^Y*)$6QH8
z)};y&gS{zBFTgFI(50ZoNMv;)p6dC<5>Z|$V#>{87UT2^t%$2SK%4a}ayHP8xcLep
z?;(C6NSG}xvc6I;;=}t4=}K8w;Tzc|VYqqNns`tr=8^hTJ!@OydX-+pr}Z<McP)~n
zo>@ybJ^LzaDntyj`^wGa7R@3w*2M-%&h(aSQs2l{li_Abi$)Qwy*~HtI_+so`|b{k
z5Nt?Rhr`D&kJ33-J~VZzTNbA8(PIQ4fAkjCv<WV<U(%-Xwg}%=z`q%6x6R_rK&StX
zpG#Ncw<F`XBjdMc%~<5fXGknGDU7PhZhBY`(brs9K2bGQYp8WM%j%hl)re7U1j+Ei
z<Y<8yhd$uEwNh;SS!z`vr#qvNFa^ok91F!fIJB5rae6ZK;Ur}0V-t<3Uzklyy*Ou>
z`f$!LiFz{cm)fRtdZ`X)?jj%U%cnV}69p++oOFvwd>N+(dQYWjG+`ET#4}?NjQADj
zwk&@T(VVwh$MaN0!)l-6Je67aL}EV5U`=B*@njywX{0Dg=}b}NS)LAxyfiU|i5&~8
zJh2m5C6hOiUvZ8m^6+Wp9E}erGuskbm8VonUfNmY^oT`WjWqhHPdpD2QH9=3VHU#(
zquGFrMqmhY31(gJt7tAF_6lol>WXs>#;ktHd_j~h_0P-%L|S3gzl?EoKf>c-{0NqS
z;*$r8tt*GdizD?>Dhea<MVz*!heT%3Jc<#=Lkfex#%+(E;;6W3RE%mz^n9tw&`V`c
zhOLd7UA2s{-u~)kBhO~4epN%qQPgUOgCpIF0pFsp)ZJ*{*5V<CrGZ=6#Y3cFkkQ-4
zUY7q+$;JxN@M;tzt<ce6sl`Y0rN$#3EHy)IK}zxDV5kjlMlo=&r+%AI6my!C1}RH+
z<x$9zcVVQl<QI)6Mm`lIhLJCCfx?Jkl=84Ft~exU8p)tuM6OSc>OnoTf7M7_L?t(i
z`*I&|3+xvtWp8;PEh5muFAbzwB;rA_$R-{4s`Rvht;k!$W5>7H)a6H}O6C<KQx;|A
z&kQM*X!0XPCB<|gsH9LD>WO^W)MbZyiV=^;Z_Fn%1``ESJ;V|zXs(opSS*05QIe8z
zItUUe*h9KJ2x4JW4-S;-=_^JhqTs5jilY)1Fz*bxQ!2(8Ob?G8s+D4vu<-3aikCL9
z`L}-yNeiR&R-g0adwCQ}^adWI={t7ht09J!$Xs=-OY7Z%esYqP--s4I_9r*EtVgzQ
z9QltyYC}z9*)O2q<8+Y!{O92Vi*k;c9t*`4%dH>&uIr@A8HV~oP+YCtI;LOzKEC8O
zZ|J&ef1ZdE`leG(U$YAwed&GlY|x<Q53a;Veqe(u7-{0!;;5Zom#VYEes8d2j>Z_=
zwVW_7Tf*hYw&Hs2kKK`Ot%Z+UM_NCSu?RgPU3OgP$}9PmZ5t=#^Fnf5s_dMQMZ)6f
zyO(!dPga{<-F+^ud#M!{udpKd7giD6>#4ZzWl<R15!QOflAI<X87Ny8mRH<|6eTu`
z@&Qlz$}GRdC<n60sXB7<qki^EU+ndKK!3WNJQL*%d+9t%v^DkmgpiX~w2k0#LON0A
z_I${Z6WX1UQ}EPV_M57PYfV0KqLiK-<KWM>@h7af!x|(<)Q3+}9N>UiRY$JdMcvkM
z88UUQx5GxrasR<JxuZ0PRM%w%_q$HCr}g|Z_hG2XLqBi_>4Y8qm|T@}++>3>H&4r&
zvoJ!7?``VsDo;=yv+W*~tpl2SE)p(ZbWf~qvy&5x-7Y-IVSiG-y!Xjxx~0(k23HmQ
z=QX8Xx$F$#$nkQLt=Lf^#|0hhete`WyPl8ASEQw|<YX5ax{_N#a>{Sa^GTJnFB}i9
zB){F~$Cg?<j&)BQKho_Vc<1eRhPJ&m*sr@Cy8XwG^`ChAH-6(chPQQprC+|ScI<<G
zRPp||2EQ@*jd%J77M7QnPJZjnHzf+n@Qn|SAD7Sb`8M$z^5*&GvV8SWvi``iHy0N_
zI{NEUw=`4x2j>sIb>MLK;NUxh-FM!3>o*Vl=J4CUap2%P!|%K^e|YFX_wcs2B`R;d
z^DFpt+Q~QBZoGN)<k2^!a_PT3lfN<FdUN6U(L-<k=tGHL_rv)&{Wo!cU7C^uZ^|}$
z`RJG1U@QAw<uhFp6`z-Szedd^M2^=hcTvOkqC~q4r7^T`g)6;|3C0`CD);z(vfVJ<
zYWc}_Lp^v$PM7{z4%U(VL-L)KAL>@!lLzE;&5Ot7&I{k9*LtRUs?w5eLee+{KRKR8
z#;!ipv#GUx)(;ChK1b)xl-`;8`$rxQOY$}B14|38!iSCu1w72%12t@Jlq#+Twr}T{
zKdVKqb;G567}p=38h4eQQL({_H;ny7Y&O%g;tqb?lHE*_Er+_Y_f4+cPI$XvC&qS6
zVZWQZfjj%;14Fv|ToU?i*&67#zKPejWn-rtdQ!41Xd-7r7W$y%FjYAu)qiVOMcqc}
z`i|}?by7a2Bj=#WmgU)ZrO9j^)SohuQuq_^9f4=`&j_eSfs~A;|FC0na>w^(r*?mT
z%x_AaWdNZL5Mb1>ms6rDhd{a0jQk^2cd+1tGy0S(H+xAQVfXdq7_u30a~(v6X-ANS
znDcaGA2J`SjGV;EedtsAMaW1P;>86K1{l()hZ!(TT1v(*%K3?eP1nCL6A$Y07?Veh
z?4U=Sa5j(@uJ-Em3}%@y*GvEDQ+)V3sN1zmK_!3dhdQ*EcuCJkN3t|%Z~LL1Q;41d
zvnVL(R>Tv>KahyaCu?=qN{_#DUuJKeaIHXS4k+j;eR@v4tEh5Ttsa*r-5L1^te)HI
z?4xVZmZ!WPqpJt*hJwROkw&8uL;_qlNuJ9Rg#V1Uel1=P^_EVk%fSVgh3;5n|K0PG
z@~K?;F0=;b>Y)EhZSrk)*WUTB!761rUQzMo^B?8w>tLS3#)=aieRV7Bvekwtd}UaA
z$Ax|yB3Up1_OX2XTqf7t@Hy_a_uaV{yLT0jA22lD052#vH_z%hg0AB<E2KIck1MP4
z{_gPyOCSI7te*Po%3se(@sjqEKEx+!<EB1jtDR`lIyryLUHSdJqHO`;p0kJEhwj0o
zk3FfcIslbMP6xS!K{7+XOzvx=9_DD3(A6Y;MMx6n!;8(cdt<p}mM@+179-`1ZL<Du
z5Viw9mPd)^ioTGkEBAtYz+T#D_r%r*^?~K%@?9@?>Z2Fsu`L^u<<&;2v9p;~NdU)#
zjCD6d>tp%ummKLF2gF3B4G~*U_o1*?+;lilLmF+L3`Spbt9m#B`51x>Z3~-UmvYsr
z9zuyW+q<pi(kDOk-*?-6TxX-yxYo#(r_1J74!lH54TKF39A=Rl<@xbZPPbPm_+bhE
zrXrItM-R%wUdAnptf;Sf)(V9pL+NhOk<mi5QvX-ky9K{#+KMDWsmO$=Mz?MfnM#!+
z3m<R!EUD5cbCfy_Nkmw$<50>Rcq&xbnorRtdQK!(MZcn5@(@X^t2BxnY#i)Kosgs|
zxbO8dVxi4u`y)*gyj>?k8veunNFN=OXw82p2mCqd;K$ni=*pnP$9hhI3^1ve^uA%O
zhI%NkE`zlbHS~tTDT`sLs*Pn<+)kRBf<nceQB){aT34wH1V#T)sf#3)HMXcyRUgY5
z74@+Y7Y>A{u`Je`B5zf#C~Bld&KfU6i*k&ceE3NWTG0^f`+Fz9Bd3T??%OHH3605T
zP35@6cXv;>VtjOLV#oK!Miaa(y^yl*#O^)csZiaycVh44?9}+~T}5h-3&~U=M8u?k
zAr=KpVo<pDp%)<eEatR)pVg&jkABNmB7(s7?Dd!4b7y;>oRjkI-hF#U3k16+cDO8o
zk$kbVGwU&Vy_5oU%nseTW6#bpiNd$NeHN=?Z13GGr@31GIOB;iW|zBkI+j<4$;qH&
zX`J8NG4-7SD#bOrV_LqFQudIHP;RgM?!GDMf%>WtA#z0Q9wtqW1|1!n+UY)BFQg&Y
zBx5GW#=fr~cWntSpC^`H>duKBa=5cxj_>~VczbfUikjDY#OR(W{idk^Q{S7~B^lh2
zc)YI%kM7#Fd#8S0Uh`LCJ-K7I3*24pogCGVse3P6%#O{pC&WZ*mpdd)j(M8~wVYPN
z7)r9F2DJC7(&(-UDi!V#X&L9`bXI!-L%Sv|gX<jfQQ~@8t}XlEuzVs=x^}Mb?caZK
zAM!SrKIQRai{Yh3RLxpnirlcdbd9CgSP`<mD%klyZpnjoP+i#7FB}M7V{QS3w?ThY
zAjhTLd)2Z`NyvL;+FPI1li-f(p)1ba#@=(woung;v>XO1i-0~v7dQawEtvwxpOVX2
z9x2M{*@@jU7BfC3pZ;}kr6(m)ZoMY6+4VrX{?{G*l6KLf?rwPaL<b<@Ojm95BqMA{
zox0^7o|Ur<8zch|#ivJ0DRug|1XrT+VG%jGP7YyQ4#Pi1Gdzo`jotiV-m8MV;u!|}
z)F<arL7P1HSX6~O!o386wQMo_@e!HP@NYsvrSzx_c=07YdMrXCc^CpuAA#_Y+lbRM
zhPZcd-d)kVb9B#TjHJ=fTd`;Zuw<g6A@bo`{Rj>tFVkd{<Iw?k9O(x^?a+#h?7*a;
zhD7?R?cZ;TBV-y8>9!q|uLNmVPhPI&OnCXMf(}XR44TY9a&VHbOD!#!)(LmZ#YL)<
zhwd$pxu$Q$Zi$*x)q~UA;ctG#*-hlm9@cOXBgsm4DRX8m$uj9G`hFv1?M$}j<-Pid
zG&1pYsGQ2~dz>mr|57`i(s!Aa4^6-2er4#_f8qd9KKYk<(kmLn@MHIXp|fDs<C5A{
z4D%45%!Tcg)6hRTdNT|={$xjQ$}=-`w~9|e`SzK#Kdx7U0ntw;q&WBN=2-p`Oi1Ao
z5lT4iaMX{_rc<L;2OILKC{GW0{O}_TewaZQt0>|-=CFRf9;=^(DE3<sq#HTWr3NmH
zkW^QD!&M<lVXUP%AL|~NVagD*vW=$nB$)7Yk7MQLeEnmW-3ANWmqm)pU6_K!NiriT
z-LgsGX@LjZq#q(a9Q3ES{FnL>ZZoz29Uk8GH&)?M{*&Hi<#}Okqm#+vPnN@^d7>Hh
z$?4l@F!Y@R4d_qwtXCtRS^O8V+$7Zc|MqK2qOsZkHqS3>r3#Ou*La>q48?~{<WYRu
zL>}0$pa>s3k*_{qGG4Om-+v(`T}=}a=*Q38Cr2_YZtyF5*{X<xt`g*fJnEDd7d*XU
z0g}Z=zqXuT6@+_%LHTqmueb6vO_u_J%))ks>tFTxreCe&M)J_3aBDN7S9mvmP>7(c
zIkDjcAJGVKouI$OOHV_&H+g_-c2=$^b?2Xlb*D14;g+a!$!cQ7Dj4#aBQhAT(&bq6
z^YyXtBoA%VC*Q-U?2LT!Jq-EOTljEH{QmvP3pabN$?C?R_=UUJ;--%(-pGHp);^vk
z;wXD)HEI_K{&_4l=4_IiIKmu~Eix>vm3+-LhfERkD!VF_3VuMj+z=*(`pPA%SZ;P`
zRvv$Bkqcw)y4!?9^M34~!Bd^rZjN1_4%MrtYy+Bov*a&u8I`mEI=i8Z4<*9!90un>
zLOQ}pJLoykj*8LbN7V5s_6Y-7wnwPXP}d2m?w^o=xg3S0mc<(m6tt0!o-P7@b$<^L
zD~y3hfi&nbmV2$tC(R$!N||w%PoDkxE$)mW826}cZD!RAKG#5M9hVJZvR~DGHiR%I
zcMD4+bxQZgZh5in{g%CN?lO8wsaZ#k0^zKj|G0~L2>A&<u0fZzz>7!bbs_VSWBxmK
zqU5ZO%*!W-W$wyNGWq?7+D*lxY^lcjSr{}K(&6THeibmr1w$vw_0DEzKOB|`DBWiv
zzp|~s<zJeK;)%_J@sm_1vE1TfKl7(OHbQ<Kxy+-uMpD)X%OYW!97E6AEtIyEuB{c8
z!Jpf3Ww;d>A#MP`^jvXCeGwE}9cSb+20xEiHGN;c?ZUGNZ2_<S!tf})Wy26j+>}3(
zFQ@9Z3d}Li&dN73Wi76*!WRuJET45N+Z`aqBjqP+G39q&{?q*t@+>-WM4E)-$7FMc
zYj&2jckMZKEcDo+k6UhCJZKd|G&Od3PX?k1D<UDknP#b*evaEsQ<f7PX_XeM#`UYL
z#Rz2sOB6!J@=naHDwZ9Iwre8r2Xoeid;sZGePGdcl0&_+)VrJ)Q6MfaUZqfdd*>Df
zgcyV%qV?>-)Afg=^*GEbTVvUE8=T#9Q|=4j2K%9YC7!jdNYMs$X}a`l!(pDhyvj#+
znDSVS^4cTaD~82Ehz#?eONx9PqE~izZ@7AG@8$X_cFlPGzD#&thF%pbm)}2yB?w*p
zEUfOy)gFTGOmQuNq|)_NUVGPrMpO43yP5uDe)I2<ztn^MM~=C##2t|jYq=FIf3YJ5
zRr_n){=n=eoAgmuwe2Q66m_~^AA@!KaOMw4JG!WCuWg<1M;^F6Z?4U2zJ;Rn-q37E
zg@)l*hslBk-Nce?v9SFp?jg)gnDy^LO?F!*Z!6{ZkjhbsPo_vdnIcJ^Z|(sUo{FWF
zaaM`bWt!>YNZr3AUH9UqfpVKAJs0V5i&}9HNwu2a;NqfKv&$v1j}KNV>{fY|W=+(S
z+paztRVKBeluMyDv)J8Zw}Pdt-$Rq`zZ|9Ddcj8yb^VTD>iNZa+CaTxA7@ZTT7*O(
zE}nI*t^P>C+9uH-965aWh=%HytV%qj^YfAR@~ZpCrHvO!8HGwy*wT=w#fAQA&8l)K
z?rTWMlT41@NaL*wpKNIei}Rz69#tC<KH1U`wlo|)d1(Hmt{dl_b5uSYT(M>y$1X^Z
z`H<eUIOxH3F_y77J?<B^;^pj3*W2@^E%i2i%boL#7hxy24)4pHadJ226-#ZS%eR&;
zB9_By{ww}krN2I0uWPk8L+m#QQgG^7I%F9LES+Euq0BM}d<3q<WddT`AV|TfXX%h-
zCa~1TWe%!K!K8f(;%S2*1*aUBIrtb$hb(8|wXRhgm-A4)98B8RAYL~JQgF&~Nm)8%
zxfxh$<FW?Td%>hl@lk;0pF`|j=Y@5xc_6_lNAG@O(ha&0$|ethGqm-sFSS<djQS9z
z{t&e`#lZm0k3yU=sE&9`Vp5xc0hlnfMhTdM(diJi_F0JM47vjGx<PdbNQpZnJ|9>*
zB)(zL>l06s_)=h*B=I$a>WG;IWRnKt4y^A5mUbP>8dPt?l~Pz&TaC#7%))sA@ufi<
z-|&I=!<7iu#fF4r6O&<Bk2Gf)gz6C7Mrk7doQ1OhanYbN5YHP_mnIUDP11A~*4LY}
zT!!iuxQ)_8{(BbA1Bed|dJeI*-Y2C&IgyZTVzLR={mohWpt=!mqco9!#KIYeIAKs1
z;*vpi<wQcVNt({W`h0Vi(@;GFw^5qNf8D~l3GtRe_aQzqs4h(@afifffu%#@#|G6A
zGp1yd%z6RqR!`$<^b97?;Wo-F^7mUf0}!_wGzzh8P+gi*;tq)i151a*(+1TMGp1yd
z%vyl;QedfV8|R?fh1)2z$ba6#xd`!+K{p_-8B~|1l(<9U%Ymgs;@bw*5i_P_lgxSm
z>qmj5HnZ+Q^*-E2nMMBAr+g$O=w65$4B7&5(4e|BrNkW)_XU;?iH8iTBW6s=CNUm|
zbvv-sX4VK)N8vWgEb=c|I4clO8FT^SWrOO{loEGHd^)gnNPNYhI%39@Y?4_wVZ9bu
zYBTFPRBym-lv(6|WZ^u4_|%}DPx~bF!IcQsr70!ukoZ|3?vQw6Ag+DYVNA&;aT$R1
zU|^|@UO!Z~z-^RS<ZoLzGZ6P1v<&gIL3Npx5_d>E7g#zZK4VZFF=I+L$*ha8z8qL;
zGwVE5FTib-S>#`{aPC07YtUne&kU+dQ%c++@x8#(A@OsA>WCRrvPow3e#RU1!EI3S
zTTtzR+bFZhKWO0$L)>oAG{iZB>e7@FcSt-ESUM!`8dOKjn37F$W(C%#150hqT7v2_
z+(wy2{>v85RfyLNx()H3L3L?Li8~~|9#}dgzHd++F=I+L$*d=^eim42GwTslAH!{w
zS>*5Q^^ugIH$mKN&=ABCgX+?h5_d@4A6Pmh9yO?rm@y@r#CQhQbAhEcv)WLdhTAB!
z$bZ_xIScWeL02GNH>fU6DRGCy=L1WJ#5WA8BW6s=CYf~y*7pKSZDy@O^)}o_nMM9*
z7S0QZFAduGS)YV{xDvs-G^NBH61M_Nhs0Y9sv~Ah$tH0bhV@8bsg2$sREOX;$}IBF
zSvU(27Y#ZC@w`EGX(A!nBu!UgeZ4u$WvE_(+bB)szh~h*fcVg$=MY<;^GRt^0boKl
zG1&y`{^l%wP~8Z(QJO}eJZ|Bfg?Qeex<WY()iZD#1$`aLH!YkO5L=&boOjP)@*HlX
zpvm8F;S50BYS1Xewn23nK|-=gNiM*8sX5CWRJ(8+rHTCKEu4!GFBx<L;+jEqX(A!n
zBux)s{ir$1J*eJ?+bB)sZ*2(mp%>x?gSJ2%G^j33BqW=pX&lz=<}4#n9fjK{P2^v)
za8@9mGUx)t%Ldh@iG*a6G~I;tT631`P`v@SQJTpA$ijI7@u@*QU+_ujgDVlNOA`sn
zCME;09&FCi57jMj8>NZ-Z3|}x;(mjcA)Yp<E=?pPo22O?tS>ibIS<tfa2utG{A(7@
z9f)@gdJOTIL3L>&A=xBNy<bFW!);L7EvWXuZIq@yC=XgV!w|O{G!1dipt>}XkZh8G
z6<D8c&awp6Ww?#fME=Vb&Q*xl47v^Ro<VhKA|cr%O;2F`tU1dgs6K|<C{5(=`zaqu
z33?O6%?1rY95JXaO(Z0n5YNDRt~pB^s?%^ArHTBfEu6Cu&lz+D;&p@S(nLbCNt*7!
z`d)LEHK^W(+bB)se`evlfcVm&jeR}|{ct6Mb!j3Y*~DZR)+5bX2BA6xw^5qNKWE`A
zKwLEF48-#W)uoAqWRo;qh4uC3ESI5r1#Y7>k^i2B^8n&QgPuc_H7V||K{=6-Y+|wr
z*8R;{`k=ZIZlg4jf5gHWhd5zS7vhpZb>&1tvPqiG!uou3meWu@1GiC{$ba3!xe4)>
zLH8j(GN>+1BqW=p=>@D?Uv6C5&tUQ#Zlg4jzu&?cfVkD5QHX7W>e56)vPqg2V7=6w
zWe%!cxQ)_8{__^jMTnOSx&d*`pt>}XkZh8s2e5wBoaG)=@561BCi1s_I@E_=h#L&r
z0&&owx-^lHY?7vNSht(Aj6ii1Zlg4jf62mGfq2TG3lJ|GRF@_al1<Wd6V_|ZS*}C%
z2HZwzBL5=`=Ly882K8+8N$7(s5v)rS3CSiV1F#-!&e9LnEpQv9iTrH~X9nVagO(wl
zHmEL5BqW=p=_0HzH)lBy)eCSNrHTA&7S0`rcMW<B@tHw&X-bJZB)%6|IwXE>(CZUV
zlK5d@nI!R3gX)Nx1!R*_==~XQ)Cadg{cJ(C2X3QMApf9+GYoONLDLZD45~|0O57pw
zNMPxZxNA@yF=I+L$(a>cpAIawH}euym*F<bEb?EraIQkUX3%Yj_YA5_6A8&CX?g<d
zXU$n2LG>}*Mrk5{-&cGjCFo5MHybnram1jyG^NBH688s|4v9w%dVS(a5^oJGlO*15
zP#rO|fNYW#Gq9cuEVVVO4b^G5jY@(1r!Abb5YHKO1>$vs>e7@FcSw9buyja#!=TqE
zo+R<5z%ohVYX-eO@f3+K2bL)kuNhQF%)BL=6z?5a-wQ0Y#mfM1!=zF1lK+{7^8(^a
zgEs!GPeMOjiC|rtNJus@8HV*pbCyA<4#91dCi2f&I13OL4LSqyyg_woA|cr%O;=%k
zy*bNes9u5FC{5(QXW=}6_|Tx|5L=skQW}&K3CSiVn_%7FoTU${8{sxe6ZuChoC%0+
zgBBnz8&p?LqfjNAr0E=>3(Z;1K=mx#Mrk7d4GZTM#5IE+KzwXaU7Awj4vB9EmJW%Z
z81(wYlO(<uSSCsQ$e=o6W&zox6kfu*=jXg}gZlX#CNJPNDh2Xyv2eCR95iSg;<Q0^
zX-bJZBpwPZ9TLwNR7cF1l1*}E5!TCrrMA)SLUjRdqs$`z1q<gA#LEWVf_TTEx->n8
zYR^|gX>WkoXV3t|A%k9@xI^NNfu%#@VT0<38B?-JDNMk6I<VB1!YEY7;WjD-@-JIB
zry!m-=pw``2GymBgk+O6-GcS)<}5d$dJ}G=G?D*_h4T#JbAvYg6`zDna2qrVDRGCy
zF9LCg#G3<gr!KQn;z<(s1eQq>Z#3xjiKj^18(5}DJYY~$;>RJ~(<$+EN<3Xh%t9lZ
z6w4r@H5{T>doM60TVc|u-jILB!kL5EHRu$?vj)|riG*a6G+l=E)#fZ0p?V2!qcoBK
zj)ij%;(ddjLVRIRU7Awj4v8NGmJW$u8ua?alO%o|SSCsQ+@LyQW&zox6#B4(e-qpW
zZ9p$nH^6OF3gjQQa7G}G8nhqcf<bj@N{Krp9uF)X5-%E5N6eU#O>*Wmtj`9P+S_mi
zs;A&K$}I9<wQ#OOykXE?hz|^^OA`snCTV&G>le*go<Q{}+(v04|E9m{BPl`mL)>D}
zc8KE!)uoAqWE0{!ST8hZnSttlxQ)_8{<9X&d59Mbx(4y4L3L>&A=xBN_h9{?Im;cW
z-i6yJP2_(Oh4b@1zCCayHk%<17*v-g61L1_1md_sbu7bB-43@=n#jLk;VeO1Hs~D0
ziw4!jhJ<93oVgC`o6T9SLiHNlMrk7d0}JO7#K#7`gxLEFJ}DBxx-^lHY+}+6>w)Gh
zo1nTGZlg4vh4Q)AF}euln{Xw*YY=Z6^bq0`gX%IOCGL>;PGISf_^Cm4#EdD~v{3rJ
zQ7_yE<@5ppzJ%K-hsi%+;S53?GH3$gj6to^U-^_45|T|4umtOs<}3?PU4+{xP2|65
z;arAz#h_ad?-<l7{gu;1Lb6Gk9>MxabCw5CeF(QvntFe+<^KBMO3-bHGX{Ab`z<G6
z9I6v=8wE}N6$|Gy#4`q6f_T*+i-(uWu^}PZBu#6uzSErLCRA_1ZImYRKe2G0L40n|
zhOhaEZ-OfktV<IK$tEU)upVyCG62=Ba2utG{4*BL9K^0cry!m+s4h(;B%7q^GOVvQ
zXSoQ~OK=;diTrmhocj<T81x)s>z8~|8kAE?+#&J9K-?j5Pav)xw;=JIz%ohVCkB!D
zr9pM2uo-dK9^%p-g*a}|9K=O~>WE25Hp#s+us+wE<rGv;!);W&<iBR&T!(nWpt}$s
z7*v<0Cs2I~w^3|1Z}GHS;7UexAubwJ7xaFp&cSUI^f@SBuyF1}d}vTz(08GF4{oEN
zUqZR(uX%b&^(e#%gX)6b4%HF3je;isqJ^^zamAqX5HA^27n_v0L*i3`r9<M&2E9J<
zB#F-kmPry{G^mc4SwJ=^g&VNG6<BJYKG&dn9d4siApb)P=P|@52DQHKldu7<M6fPR
zDRGCyPXlp>#C?IdwvA1RCrSJw5Kof0HxN(0evGF`{4x+vk$7_;o_c-a>6CanC9WMC
zW}%Tyie(F;wKYVqwxpPnewZ|>H{_qNaHb*77_<cOltFcwl@fPIyg#sXNPOC$*C(DN
z@j_skB=L$tb;Qg9vPmgifc2%oQd<h=pn4u|qf*%L%RX{j;Y!d$5QhzFL)>prU7AQp
zHX&Yy^{M78i%?yH+bB)szhvQDfq2!RHHdc&s!LN!+#&I`z|tY{J%j3q8B?-JW<7@W
z)4)<&0Ukp25!^<ZMg9!~K9UmjMu?jX8icsrpt>}XkZeLc4eR~QStg*`hTAAj<UeKM
zoQ8PDpi2<18dR62i%_NM8?C|BTfo-fDptpH6S}l*l&ZThdJ0!E^f|;A2KD`l4}3FR
z(W;9L3CSiVL$Kc7oMkIi2jMnK6Z!XBICBuY2AzU<)}XpHtw5EgS}K=-U54AFq%K02
zwvAGC4Mun2N`~Ht_`slN5MLTpmnssHO^7%CD#{yfgYw=0)jqh5(zF@M+bx_?h~oy$
zL0mMbE=?pPn<U^2tj{%PIR(|za2uuR8kBEXIL{%zG^j2CPoeq@Zlj>dzxmfZy`*{z
z!~ugwAWj%m7aJ0iO^Ca&UTn^?AF6Y38>NZ-=PaBH5HA{Z9pWv6>e56)vPqim!}?)!
zmb*~B2e(n0$p6y9>DlVz+Y47>(+_d0L3L>&A=!jw6xI{XS++xU1a6}=k$=&`S%$b`
z&;^K>4XR61O57pwsld`9@fCyWh;KplVK8Ywf%w#*-e31T8{tZp))5avwQVLd5ceCj
z4Dqx<uTR_|@myf(kob&2b;OJ**(8w{VSPEU)TaA9R4>47RBy<?X5rj{c-NrE5T6-T
zmnIUDP14l+4R6#3w?SF9pxOhsQJTm<XyFV)+-}e`#5sfN(nLbCNdi`2eY!cz5>%Jr
zHcAuuFIzZQAYL_S4dPvc>e6%zsx;LO)FWVz;Wp`1J%lc88>Q+Qj5fXLqbV8M4{?h@
z+aZn{RF^6e_XU#<i3bcK@q|H5i8lt5NfHkkMB-6{ni5-9>?84TVA)6F8H4JGNk}%y
z<2hI_1eV&yg#qq|Nu%N=|5*#?Jj4qIU4wYjpt>}XkZh8sd$4}coaGKw@4{`ACi1_C
z!Ws1O?SU(?*$i>Opt>}Xuw^DA5XTLwV;P3(cDRkwME(T}X9?o6LFXV|G^j2%DRGCy
zD}kj$;!6hA5i_P_lPtdu>zje4UB_}2s@LE)%B+F6JncAK3Azn&+Mq><D+blYCME8W
zcqXuPNPNnmI%39@Y!c)1u)Y{rYBTFBRL{X}lvy{SycUJC&BwPFuEeG;0WV<v@^ykH
z|A2)v2yw`u35YWW)y0N{WRnCe!Fr`R%K}sv;Wo-n@?WxWu0XtM&>F<M2Gyl0CGL>;
zT43pr_?|&ci7y6|NfO^Qh{SgcYD#QbF-78Afn|!s4-Kj#CL!6Rcpt<1X<(_XvJCJM
zOd1t0`8T}nBPl^|gt*C|L5SN8s!J0I$tJ|pu-@OCWdf>gxQ)_u3d(0JoZArZ8dR5n
zTToqt+bHPmL!Nd&TuF5o;(|e^A)Yg+E;b}2n-E`t^|j_Km!NtXZlg5a{icuHQ@9fJ
zGl<U(s!KrY9k0<3S6BuhZZ&8WV%wlPViJ-~h!<eJ)SP7ws$IB^a)$ipEu4!GFBx<L
z;+jEqX(A!nBux)s{ir$1J*eJ?+bB&#zu_ad9j*j@3gQ`q>JqRF)fKpng1!RfYZlIJ
zh<D)XYvB{fPa}--b6^tdx+p$|D(M<Uk^CEnJ-vjp8DhUd!w^Res*6oZ+#&Inz|tY{
zxIuNqj49b9#`|I24J@^pH4W7nxQ#OF43y7VI9DKEg{$Rx2lCwrqkJD&gYvu$Rnj$z
zBKe<NI4>c#elryDCWu=Ms>}A2xI^Nez|tY{fI)S{j49b9XSTz7G_cf`=MYqf;Wo-F
z@^>wqMTkoVorQS8pt>}r#2peZ2bK<rFB()w%$Sl*GV2<wZv>Xw%(?>At8g1-7Wwa6
zI1eE{GN>*APoUcSEw3pF=!3Y?psf&x4XPt1A=!ku4eOcaEaOm}fZHf%$iHOaEJIu|
zs4fAgpnAHw2~{tf$yJEg47v^Ro<VhSNr^ioz8+XQB))G@9Wi4{HYueiuznU;YU}SK
zs6K|<sFcXx_dobZO3<4iZZ>Eb;;2D&X_|xTX)`$s@ti?dA>J^kj`$u_pP9)Eh%XJ=
zxZU&g!<BT^5tEQ?VloWtk>)IeP#uEXs1(RQXW=YBTr}tm#PbH#rHO=OlQdn0_4Vc~
zm!WzEZlg4j|DJ{O0OCV~o<nT?k3K04%87(z6O&D_?r+Z02i1*m8>NZ-BNom$#0i7C
z5SI+9D<=|?P11B0*5{kEoQCQdxQ)_8{_7UbO^CM)x)1S@L3L?Li8~}-3oIQHKQ^e2
zm@y@rWY!B<w|=W}HF^e<=WrWkRzLU$ESwRDqj0sa+l9OkVU(AEHK^%xP$gZXD4vJW
zMGNOT#2aumiuWNuh%m~JfHjEXJ*bkdQ50XoX!HLRN^1+m0fR;$P8d{IGg9IXiMIxp
z4vE_a)e$qMWRslf!g?{V)IMSMLv;>rqs$`zISc0k#ES;qfVgH*U78+3^`)8gjCiA7
zxRT6%h+7TvI`&)MYL^msNW3AibVxjCkWqT6o_LbPn*z%ui3bdNec~w+Zw@R|B;Ib&
z>l06>#M3G9bR97Zjcig<qlnf-h+b`lWJ*S0(x^g`f6>BOhPYzTd5D(`YL))V#hVg$
zNPH@=bVz*Jpb~GZOw5>)O)~2StZxOD+RVBJ)$4E@W!6I|KeljQLTv45xj$`<`yp?M
zFv?qjNvyqr{gxBD8LFgf6h-onTR0S-259~n#NKy(@atOhTObY?v=!oZgDkdQD#!T@
zh_AryY4u(I>?*lQ=+W2Z`gE&r?Qfp`a>7RZb@~3><M#WRxC#Ecag(zCe3DQH)-hd0
z&fkXHprYM?>YZTHtqbL55=y7egb}(QLTR)5v3^K3tYc}TE-r;S*<OKo%AgAnFB?=x
zOhU3rzTJfNT631`P`v@S(LGE4M;6W#h))gb+3Aze2e(1Nl8|g-G63tr<}CeC-2%5V
zP0Zdw2oe;<8v*LBLA<ig3+r0ls}P?UH1US_y$)BjZa}<a(8cv$>k{0G{1`=WGjP|n
zX4W9yH3(90o<rIgVnq9(at&TL;I412^d<NBEqLBSoZo2uy%y!$AswAT#D6HCjx{hb
z$rbkrRqjKzLWMcZ?3HX~b{cVV=MN)Vqi`#ey0yn=%`jXkixG$u28HZ{(1zD(Q=$0u
z(_Uv?>(HjpcyTk_igG>=f@^{3P&uso@OqY4+3+cEv=MG)N;kvPA~;_TiYh};ttg5C
zcwL68RfF=CVAkG%T-XR#)yjX@piW&WRep5d;@B-)@w@4lz+9QuGsy7^`J7KxlIOrB
zSl=-giv6GU@sd*J*KW55DCr-Oh+ny0*9srJ=GTEGt4TBxh_W$S3o)9cXff)NXd)0z
zmUEHc+2&`jB^@up+1neER<?Qy6{>3efOcQ7N@~?GytW6GL;E2v8B`8y6kb%7uoeKV
z1gj*h3-G!Gx3YHdlhBrBhs&Y!<IVhRawQLy9)$QLJS<)dDv9!CloG%EThU6SDoM?_
z36?vd%#&J}sw6D@>hOlou@1B;&V7MUm!E~4_+o%4wgZ#|Pww8p-JxjQ^C|Z{x%qiT
zxqHgRMed%!JxQ_e^Ni#n63vB3Cilf=5ZEV?yZn0bbl^_fqyczQRqE;lp#8xrDR_R!
znBPLyE(Nr21*;@1eleM<64ni9-wswuSdZZK1a4)0=4XzrI1Z=9kyP;w$l%RzE2*ip
zC6q?O!-CqhAru(JKGZ$wzqM9*VX-{KSdO4zogOb(>e9rOtIZH%!|(i7J*CE>GZA9m
zU4(erpfd9`yr?Rrv;ydCuu4klI=uJ+WvLPTl<|{bmDGq^@S>`O#cvuv3sy;3{mABN
z%kBk;%;Ab08-&VGu<FvvJ}jKXa67autoda?X97_YLuxYsNf!(HQfQ14tMa#nH4hPn
zec(5V;Vr08Rr3(gvwRG1BN~tL(cu?rw}dt)iSbQ%-3cm5+nK7QO(3lK-PDT52*2TK
zDhUfe)VlGfcoViM+D9x8@gtUJ`+`>a1|U&iAnH);3s&<aIv1d9j5Y+KNs1PuE{QG%
zqNHi>2f<(<Iy4TE-(#()@WW7{s#J^#K>GtxQlw|#WuI0(bQRF8V3jmS=ix<F3F`)+
z+rcUc>k+)3z^!b5pTX0zENOo?AnP{6t>mH7mXOa04~y4=N}~J})-MA~yIg-#m853$
ze90RP!Ic_M@lJrccOlx>9=k(d_J$*HrHPn^I1`{GMq5EN2)8nS_ytjhDn-c97=%FO
z#L|i%9j#EAL8v6wM-`ce5$USO7t?5=Cv9K(6PlF?dx9{cPdZYZ-ssaKvF<`#FsPi?
zpUjG%kKFpxp06^FL-6G15j8(HA|{*QR^`!f$xiA6&4xlkl5C^Z1gyoXoYnzYlch4&
z%qxDLPpUD+fuCW{c1IwN2B^)CqTLBl5`jyIz*V@F5x5Rd1|j80YJRIrpfg|bak1|*
zCDoWjcR*NCjc>t=DbwO$VEj~^Vo#B#mmzJ*NY++(S+u*%iMzq7JAr63C9Z48v^<Ar
zMbQm{f*<><%sGbh1j_4MeM_q(Wkxx$Tr<j+G81t5^yR+9n0TH2pE2Y=$b>9-IpiMX
zSv#M18{jn%RK8zk8G;v!MP@Xvy^(}PtyhG#y%7<$SQ{!{A*u3;uv$OslQ9Ta?o^7m
z1Ju0(amyyJEtP8!;&y}hiK*!TB@dhd5N(B9Sp~=8$x!8<V`vPb;x?oeKPgtBGF>9p
zyOPX9h;&tB$~0Q&Nvp&!Zt(+Il?mg=sd|5o+1RGYuX#w$ZvQLZcLZ+5olGKrJW0x)
z;^0@wJwF7IpSY16xdiCCX?b<~-HgZ$he#%gorBk@yvh}LU4vVhA2;C1h)Q3T5$p?z
zPr8(}x*I}IRMtwwTBu~cjHFi;G_%D*PaX*TY|k2KDig+{i@vQw@yuUk`E>ayfr|!N
zF?fkYb0IrA6whrY(foOc&kf>N8F~YEl9Cm0UI^StLEnOxefA_#X(7yBxRv?Q2Tw*+
z3YrmI2oX$5kyZmCS&7Q#60sI4nP0-Ms-T%I7J8CB8xXNga4QqWqT`nsr1_-CQ|2YD
zJg$DcpG9_v;zWRwwvya;LJoB(4*vp)=E;5EAab_@cgL&S??Z6D2;525_W!(B=LZ=o
zUL^TlgBwt-%%WTHwEXBY&Wvb93rDN_u&z+K121NVmNS`oj=y4*?}Z#nvYHeY$9d+b
z#WATN+d()Ew=(%RPzd+oN)4en{xzS&k~SXAy+1%n97%L95OpY?{Y4VZUx4_+AadKW
z-$`|N49=EWc}Dx)3a|0J3Qv(|bX>ob7mS!ZgcvtVf0DIp$Ok)WyG_v!luoKFt)i2^
zDe^e#ih7h<P15RdD2{9lsk*K;Me#+jI^6q9J_onLl{s(AQZF%GJoMakk1IN<Wj*O0
z53V*MlRkKz-Ydy?ptzLh@+vQ)v&t#*^lzufi(4V(NsaD@*GN$LemR~)iOOVIg~y&7
zOH#d4m4t=Sd>G==rpRM#rRHw`x(|H>ZbcvS83_8ec-4v$pMjU1EMBo*VF5~y;c839
zBffd4wqiUu_|aeU;VH&bnV&^iIoo&=I{Ed+fI8^~BKwAr;BJ}dDI)kBZe=UT471~T
z+Y|?WnHiPb&$Nn83#PawSS1lkttM&J4at}<Cxg*B1(n=wSk|k&bIMA&SKhMTE6Hvm
zX72Xl#jTK{HpPBqjnm`BV92lJHoORm8-eP3<;=O7s3bSg^+YAP4O5kbh0$zVbSc`=
zs`I_S;v={LZpCfb1;Lp>lr+3I;l*QuD=Y3DDDlKxy}inZ#wu3+<6*|MlY5C~j|RMQ
z#iNK;JUF<SN(16iglVVuRx~+0*Y*LFD>H<7&Vy;CKSQzgt4vsOC(~*mlvszNow}Ob
z$*I*Ot$4U?MbW2LQ?wcl!5^N6$n$9{+G(b10;;(tp{!SV7nhZCO+s1km1O4;Gk2@=
z;zCGdo8pUDj~Bh6xRNGe5&Gu>Rq|v$ov0)?^VvitX%bSEgoV-EYSE=Qw3QWZejFlC
zzO1MhBOu_>xD_SN!)q^uu##5e7QAl5t-ML@!gJ-<d<5TU{hcKqVEQP+c;@Iv#9sBh
zh5g<uap_YT6q`f(lUs*Yk6~TWl2oXWnDMHx8b{dEa4XZ#gKn3gBw0;LJFGRy+UL-2
zAz78wYw#TW^-%UNA@Zooin3q)hS$CUS6VHKJV>tM{gzfdv{8oHD4JE0^%oGvz?(iy
z-Go4S9N4<n|4i{zfWA-hOn{~-@|Zd$v%29W2FTMFRfjU|*R{S!(aztSDl=U~)Oi%8
zGCc+M0<J#oDEEYjCQV40N}8yztdjR0xYo5k;GvJCl#=NMYhPghfN{PYp!Q9Ow+y0a
zh4VpO3ME>t5Uq=W>Ig+ru4^4GQ(Z?Qco=7Ob%hdBUI@<;c$gx~&FS%CE8->Kx>a5b
z8~Da5FGdVpzsifYfjz6dm@)8EtGrk+@YAcjSTgW4tGqaEVDBm~Si>ZqpIzkzbI_%z
zoQFKX)JiPrm<N?mXHpeJhAfpO!8>SR&__Zl8pUS;n&14E_uc$9wdVVWy!aAsMf0*1
z1SHb?hD?3iyt!hO?JT>$PSFDVKE-~-K`kji2=VHc<E3goDEoa?#5P0`qud+lzekbB
zk10K6#!y-niZj77$*`)3@u<rg%X*8om(C=a`uAGQR36%>jS=PjC_0H0k2|~?pqXnB
zuN%bk4euEA2x1F)BM&ZS^BEMs2FU}%?u05a^8n&=gUShdT1t?+oy$rCh{4=9y-!8M
zvo%pknz>=9Y=<ikavmhfnj{dDWHmc^m@&I<2cqQVkSaVjvZ7zrgY0BAb8P`HHo?<n
z2QRi7_{J(P1`S-l%8OA0dscbTHgNqaFQyIbS>?rk13$IOi)8~py~>Lf13$IOi!%m(
zW|bFb4gB;fFU}j-yUGimTPSJ&%qlOg#G1UgZs2EEd2!Rg&#m&}wt=5t<;7hCH>~pF
zfq`FG<wbP(;TKnV@ys-TYLyo)-0~868DYc)n+*ZKw8{&%8v?dMBf`@W1^nzPFW8(2
z_?cB+u*y1fUhuvYuy>U;n0Ji>%eNNk2CS(ntB~AOk~`udte?Woy%m=A<V9{EX`jnV
zxwpcy-YdzNGxDG+=S#)2i_~V-O|6n#XrY<g9GbhNUFb_xCd=8qDN*Uvt0XLJav5zY
z{B=oA5541=c|M{%{wZ$$4ewQvIU_%j)hSp#g<J6&#bjcRvL(@>cm;kH(V@zAs8m;T
zcv4B~)Y{*y*!5Z_ll3a+(|jvyIX2n%%LLFZ>%E%oGR!0atyNxJ11Na`DLC|6GZl&}
z>pUjeMe$UC5+YjN0g;OUFYXz*Zj~1g418mi7mo~Fzsidz2KKD-;+cV;TIIzH13$gW
z3#kL{PonghRbKQO*t^P$J_A3y%8N|~er}Z){RV!1l@|jBZdm2Tpn+dl<;AdpUtHzI
zh=D(~%8PLW`&N0;Ht<WUyjU?XtwoRF`4X;F1&X6@`0S~;nP{~ksC4=u_8UZkaf46{
z!6DI$5d0)XT36hajNz+;4}n0S)fPlYiv9Oic`+E`I8(Nx%1~Z~DVz=}?J^6!x~4*r
zyL&4#npR7}szdR5fRfj<1$a@#-E+L)9^8tXeg$?H;kq2+#pMuQl0&pR6I9w~Azm=3
zoFgQ@7E}^q#`ShkX;Zuxpc#ty1C-?c19<hV_py+~Q=ALXVT#=VwQoaw+C#%+Sc2To
zL+~AnB$SdR(YZjBJmN{z6M~<lI31vQ61^~J2Aod<_k20C$-OC9O;NN+9-_EnS`5xI
zAen1;iiD5AN?$)Iw*ym$<cw|ATPmprA}Y$XmoY4gjGR)D)-oY^Nn??350N@dhGzzq
zvo5s?g=tnvVbW?#AkM06hKjr0cwu%)Wv0qtpbpjajzQ&QY=svS?;3@2@*SA7WUk8_
zGBf*3sBy_{!SJH0n_A81!eT5dT7MGr!~mCVyfC{Y+o&>OdBh0q56MWZMxo8byBwk&
zlV6!_OgJqiDcpWP{wbgCiqy@(>wHjYQ+yPl!xSF}s6F~=&$;C@<W7o&+{?kLLy?5i
zQjzF32rC{-Bsvp_CMn(z&^(Ez1JV2qi2WgwNev+P#XvMg(IR<>;tSJaaFzjw%C&0|
z+G}vN-JpCgFm*`I*jBYvq`DeWQKr4LR1_IGr6R3mLef&P$Zv&69VWv>$j!s$<fT@j
zFwH7yhG=yqgq2mf1QmD7@xttqn};gb19hmT;~^P|70+~F;@#a<PJZPrM@#0qv{cOO
zTOqt8+h`S4-P9_nr?g@$EAC~g+=#P{7iO1a09Ec<wlP9CLoyPp+t6m>T@KNX$*;^d
zCY+X%lmXnJr}H-|YhOPE=~Gc04c+;qD$#0Fu<B4Wt0c2YJPfPc7*JX7jn+u=;#}6r
z4FQ$)s<<W)9~Q=^S}U!gEvvkohId6@`zN;~`4Y%;c~PlXu{3cAg|!{7RFUN*(<b0K
z7fQBGaXCOqv7Lg~rJ&NLxHa^avsM>_RfnQkB^B!ew0Ss@B;)s1d2uUHwQob@Q9(|R
z7tc%&xf>kvGb$C2#hb8RgX^ey!EmK6Jca-BSdSO2kTER45C!rZRhLvf!79m^A$Uy(
zl{Ur40ZIyiRue&`L($#@vti8zt7PzSKfD&<x=iB5Qm|`NJQeHlg0Gj7ndjhtKGq9a
z2B93N*p>M!s01n#G40pl(0Fkjpx9Bo73=Zhj_KWncrVtg3$%h?pfXiO?4Ki)p7lNm
zQR#)a!Ju;Rw4&-8t+$f)fv-FLd783HRj-O~Ju^l_adQvjob;Ax#U8gT8=+`chsw#K
z)o2K7lA>89HJnxp!D?y|;wgj9K|F6zE_iz#nWkvL&zG(EescxHnu(Ne1njL<z6jn8
z*x>30<RIy*%8|MKXHH(3$lc~-T|}&;{!wJ+IXzySHNA5XnWIjxoICVfGdpI)BZHnp
zWIj~fD9lP)%UUJo<cmO*)F@irhKh?LFN~^9s>iV&FP;VdHY3U)E7LrLQr#Zzk2b~W
z03{=9RM`&|tw)sSf?3l1(QCm}DDv#OirHwYaO|t<&gUU^7mT@Fy1ed%P*H9h;KeRw
zg$n0Q*p(C&iX29-=*rUy^Jgt-VknwbmocPEtHBWCNs1GA_E#)7Sb(;vBsFas*6d(O
zA}Ct_VV<IO4%%Hl0YWy<GqQBay%J*Bp-4jQ`+%qyu4D+gZv?2z4n|K1F3F=sXkUga
zmAti@+9g>)l~%Z4x&shj5n5_>B(*xitf2doS@k2)<00{Fimgw1>WZ31tI=T9q1YR&
zSVb7Y7Oh5t)g;B9V3oZ2(u%Et?5Uz?VI_}SS`CM=rYTxjNqMb6+mhZ5v4_xyn2v-P
zw<(U=d*}?r{RZWTwg;jP#qnTuC?!fF%@_>_qDhMP!<%?E9YeutisD2FejyD$Db-OB
zaInPP8@%X-2pp!k2*~O2V#V|*UX1m4aoO}J7Df$tVL5m>O~T=FQJh5*Ea4xdRv(nD
zI0Etn*6UmUOS+bW6<{UgX`3QXXO#QvIvy7rKI;RixaCN+9Eds;$6+lUfRyM^Ioc#z
z3Ph6>uLh#SDN&MZOve^jxdP?IV4&(!9E$aLVVTfnkdI<LUOY8EiY;W83zrv`gGr6Q
zg#<H-@_;BuO`vit1S$upPnOajgB=P5*rqu6IhJWs6to%)Rvn64gH<-Ht-)%NqFE(R
z%+t`m3U__$e_L3+hKub8&4Hz)wMOCD4N+=S-1zyBHi|qQQJ(e`w|+5b<+$epcZVVg
zCATS(P@dxyjXTLFo@03z9WGZ-cwvVs&Qm0n)8oZZh<lQwi-<F0ClTf0g^LJMARg1l
zgZC;bPfBzsB|4N6CH09!JTlXzgclagd9qK$IaB8Mw^gaY7{XbkU6z~;C-2#1rQG0U
zS+6-+#ZKsRh|%Rxlaludp2-;<XUVd+gAJ2vlv*81t&*ZBTe;jU+f`;UEk|%~Nv_N!
zSzK1iWpP=rIax&(Z%2%lL(G=a2OjJBop1{zFK9flbSB(eZHk+IicQ5l#mxa~pN6=-
zFKCtOXX`dNAHa24%nMS=gYq1xF2i+tyx>WL6}x|Uw4_mWFM`6Xk~;Jfu`#RUY1#u8
zp7|*4=UqVe;R=)_Hwil-X0!(KnZ`pCdxFXg#pwJ)ibj;&VYK4WiWTqK4ODs&4P!~t
z&EpwOC0S`o6-HZLVky2N1w7R86~t5_i&UN7<OZb@gKQT1G*W&x6hxci<u9?$cPU;8
zP`mYI@4FwaJY_CGykyYaPkXH=8v~aY?3Xb(9b(X-$Y8Z|ngln`;4X&X<{4ZU!HVG$
z#4{lV^A8|eq>?8sBXurBYLepJ03BldZiH-^OyhZo@nqyG?(r3HUV|%}J9;QD1oFcS
z?>thhYGl72a^Wz=djXnx1hEw|W`@yW21$KkhCD?EDZdqzml)MWL`z4lC^LRKgi5&^
z;ySp>xSm2R)RywufW5U!`9{D7SIdP~HCo2FRfW0sXXJ9tH50)4<v?CoMkbZc>9Gbf
zB~m#lGUJ_IImej`_mP5%`ojVn`WbI5?e=+y7Yu5B#ryWct!Ujz)Dx^a6iKKzBM5E=
zqT~j8i7G@Dmoi@533lyrVmBe+@eqL-hQ{L&E1LKX(B2rVk_Tb~l`V)CPfn}|h;i8r
zRq5TN9g?zAuB%kmYfe_tRT@qrpX`+%saF|IRFbD$s*(i6@_h(4sc1ZDk*7LV)ID1D
z<9I}Q=c3h+LFEc_4`I+sD%uZLc|m(u`*?8?WKOe8_q;?WyZFi~&k~iSSJFVGK|mW2
zQKqIM&-xOTq%bx%S78oG&ZPYd@@xX1<P1fNV3HHeY&%4=P4QVEnm@D2XYyINlG3LT
zw|>=oNwdTA8QbBcz@*t>aBG3PL-Bcly5zq8bL8%ldoBc*v>@cZ8;B+;GXByuQ@j|G
zGRfec2Pk=Yy9v&xaP`Scd2=wE*$Q#Op#2a}8N?{?WJM)Ag*-bAx9ZW(Nc1BQ++D*9
zD~B${)3F{etZ>o{M0WEqPRT81JFP38ZF304R1#t)>Qbl}ZHiAZ*;FwIauM35l2j+M
zJb|jq5nfCL>JKP#^OV!$#WeH;{J|<OW(;ht@?t;0p4ONC&hM@AYA#mg#R5QCOiA&4
zfDTc-5S#Mindz0AwtGk?lbA{G;mW9$$u=OIts%VRX}=v_%)g4_e+iY1;fTmK#i9J6
zjD65Hm85I~3shZNhj1|r*OvsZcwD7Z<;8G_MRHe<gJpjl1TU@vtVr`Ic=71XiiUp#
zp)Q2b+Y~PbXrAJw0JU4c;LGV6T<y-4{>VKOtU44)sJBx>l-!s7P~o|jF5h@@E<_;7
zw;6by2`Wj=xdpF>rb2P#7kzpvGL}})gH?y(aIi{}L8~XhYLcQ^CAs(r+8g_QbX?+j
zF$Yjyx+vZc&?3c`0Xjl)V~FO$W{4JtMIVy=GPt2YbeLj0K<&E_9~$%wVowOJ&5$=4
zG?c_3DW^FQoq_9effuBdTxga4u0o&bUe{VEX@pBW_+;?`55{hBlb=-XxpiJ~8E!>=
zClg*-bQJ?d&iYGzC()filvI=jc)dd93RJEImKg?5m(~x1N}J-w^<JqW5f7kE)%C5V
zrBz<gP9_YORv8Z60W2|~QpKZ^DqQ|pp>hT+XW_1EO)>zwsmc_+=%y+ideP-ty1|ea
zZHkwAyi!H>T!Gikpwgzund1tp)1UH$+zcQ!gVCUSu3qI5RPMp8$i3-Ldp^!iOI@be
z4fBwP7$)8Am|wKz=-roq?Av}xEgc2nL?BK|Dpg5JDpg6chSB^<-BB1$z+HoT7jD_%
zmlq!(4<5pO1h@Q+#TGJvpJgob<#_mIN9Hwo%J!Ub-i~lsCj8i9S)W;2)?0#oS$`8I
zp8DaAz@30w)*r~|aoV!1e;WFndgHtvKZ;k@FMmIedi>;GS$`C>I{f|{zv#x#xs~;&
zp<mYH>{?m>8uV|#y$_e4a4YNI%II<OvaG)q6HY^L`8Bm=T$lCB-)f`Ysf_+L;5Xpj
zhs)2WmH9alR@URk*~<FU;M)(k{0X?Sem|yuw!j^LyA|#*+;O-QaQO|eGGC5|pAjqb
zl<iN0|18|AaQS7gvVQp^VASJx!^-+R^?CT0yifW3=CVGIr@i)d?^8Z#wye*yE6@Cj
z_bH!3S=Q%qhKs-EeadGUmi6~TudL5w9?SZ7-uB3SxaA{Rc(4giw`pqs1bly1eV*j9
zamX|A*cKicQ|2E5Fb<cU)9JDzu1DZD)xT8g%W(tBBjDv=${SV6yHv{h<@J^2C7ES?
zu5Q?fc8u-TIPPz@BWx$i_MEzBd&<QFYhNg9`s;Co(}p_(cMdMwY4Vj>USc4%7lU3K
z;BJOn)@KjAi~MDGdnuFO3+Re+EiF5j=YW^_&!B(C#d+nfU0J`u^?G@ksQO#a^|>X_
z^;`#<;ON67IM!1ocy%9OeG6ri=vSBV`WDs^B>H_N#9yxG{AbB`eT#2YMUVBI11Z9i
zJAA7vdaQ3@G_VMZK8A@B9Ag*>-d{re<@(mwGWeDZj<&w!yS_D0Lj2`=9!_2IUC+a2
z6Z{(`ggk>8d|L)bn_2Q*-+HHn_{;UJ;SBz*48A>s|5gSc$>8s1aJ~!_z1O#P6#-nW
zZ?O?CdarN&b`c2r6B&F@2Is@1=)FFD>van2Th$Mp^{wv~32?PO{XhqJzMs+GpTU18
zgU@B~gBd(|jdXhJ(~%qC3mKjtWbnldek_A8W$+Ujd^v-El)+ar`0r-$QyKhkWbo4&
z{P#2XnGF87GWgjH{<kyuxeWeyGx+%o{`WKZg$(`=GWf*|{tq+wr40U$GWg{T{s$TS
zN(TSO8T@Jn|0fyzS_c2a41PU>|I-Y9BZL1@2EUoX|5*mVmBIgc24BnIf1JT@XYhZK
z!S7`7f0@DWX7GQN!S7}8f1SbaXYhZM!5?Jsf1AM{X7GQP!5?MtKgr;aGx)#H;7>C6
zf5_lZGx&eZ;LkGnf6Cy`Gx&eb;4d=xf63r4Gx(oo@ah+X^{qE5Ul`W6dNTN@Gk9+X
z|6B&&kioy0!TU1!moxar4E~i2zA1x$HG^-?;6I<i`!o30GWeDZ{`Cw#kima7gKy2?
z-^k#D8GKs?AIjkGWbok({;dqYJ%j&N1|P}b?`H7P48ALak7w}T&fpUnd`|}F6l3xB
zmi~W6pEHSN{qJV<XEONrGx+`t{yQ0bE`uM;;2d-*$Nz9fpMx`H{U2oX7c=;=3|>9x
zv%YmAqraTNKg!@M8T@xM_^Ay3H!}F?4F3BW{7eS_TN(Up2LIa`{9FeAyBYj^2LJmR
z{6Yr*2O0cg2LFc{{89%0M;ZKb2LFQ$ekFtd;|zW^ga4BZel3IlVFtgR!T)InzmdWJ
zD1+b3;QuUx-^$?sJcF-g@ITJrw=?*^$l!M}_`l5HcQg3E%Ha1h_`lBJ_cQpv$>0w%
z_`l8I4>S0`%ixbP_@89(#~J+JXYeN({6A#yry2Y|X7Fbj{6A&z=NbGzXYdyp{J&)I
zml^y|GdNEQDL)_Ic%z8;E9w7d@K0y(-VFY^489?Qe=&piW$-U&@QoS#D;a!K2LEaX
z-<-jJK7;pX@ULa?EgAgl8JtU|ilr&z{~7(Q8T=a=d@zG=%ivtPRgTX)8U5i5{;dqY
zJ%j&N1|P}bJ2LpY8GL63AIspoGWd7~|LqL^oech7f@=fN)B1n^Ycc0rn2Af9hcAla
zx|ZcnFAQ~Uw&J|*0sd>wP3H&wOdnRsL06q`$p0JB{A0g@^7mWvzpl0YjkBQQ2;+AI
ze?xq>?oh2(YYU=$SY*{_OR$3J(;o}2`t5gByVY9qPV20=im#P$AOE!eczh(uPaQE{
z7tLcbKfM0u5t=zVvbwHi^P3ys<@GhUi+_JCm+M-60W9(xPKE#5>3^X`UaUfCdHyd`
zEx0-owJw?uE%I*+dK7+E@>}DNwfQaVq5%I_s21FBIsHxHy2x)h72XH`5P+YC>*N1b
zss(r1>2D6#MSjDn@V|rq+W>wBuIK-Gss&eju<Kg=;kw9gI2Ha+@b3rkdAOecYg7xa
z_LSDOwuI{<zu{E)|G@tNfMWT6ood0=C+50n{<p|K5cDYgveW-U>mvX~{$Hh9aP^Lm
zyD?lB`3<MSUkCsH3ZPiN+8Px9e%I*_2C&F)I2A5{{~`e1AwK`NQ7yQC==53JT4D91
z*EgI7cffzOlK&m51@}*!{&2W1#@}!%{3-Zv0^l9%<MS=51^27cq)NLNu8aJJQ{kIV
z{|hb7JbVcro?lzt;$Pe8j|8yDZ#Wfx0Df(U^skuz?|Lx$J>&F815)HSoC^O3`2QaO
z#rnC6YQg;@r#~L9i~NRD;r{|ZN7jq&+iz1XxG$alM7S>U8%_m1m`&TypO*Vr|Jb7W
z{NLlj=vU8`i+9`<`P-4E7k>x*zYhLl{!b?QdgR->XgxrYfBOGt?EC}jy6f|Q+tErZ
zsYFp(i<MSdQ87YFTdL^N4wZH2GL4mWv4j9Av?QTGT3WG7HFi;%vKk#K_8TiI>sS|S
z?3XDjcIa4#nrY_H#V+fjL&r3Anador-_MWdIp=+zdvE%^e{k=8o##BC_j%6ee9n)1
z?j=wEe)zu{{$)_a`fte7`&-@ZSC_N??Roky!2h=j`rnwRKN9pDZFT!iIcNMa{NDoq
zZ2!55vgG+}cN}q6Zd>v`TYt(axG?C~<+|a|J$lS%J7vl9#-Q&`-e>(&PC+aD2Mgxo
zkAkv~n}WVKfm#2QQ!otwy9@f?LRs?s-k|SK-e>(&PQfSO&ntgC5{mikqAYoy4f=uP
zebzta6#N7H{{;1C_wR$0CC|SI`r+h#)<5MGJojARAJ*k~g)HmOy(ZPUTw~CWBp~ab
zathuE|F5F{?Dl&XWyy1I(2pkXv;HZk;GOXQyMq3AQ<gkW2L0aTebzta6!?E;;Pd%s
z_-Fh7J1I+^mx6v@@;>XIati(h{y&3%w*TBqS@QhLpx>Xo&-$mFg6FvN4PQU6pk&8~
z_fnQT*9HAp@;>XIatdAx|7W`Wynkf<-yfm*dsEPlCnW2iathuKe_ol$9$(!@S@Jv)
z^aqmnS^tz%@HzOu9Q9|9A3jW3^8C%9pGe+k{ZmfCkKxZV^{oF#DNCM9oZ(ry$>e?3
zKjjp>FzDCiey3pl_fwWUzcT0#ChxQUDW~8D_-})M_W11q%97{7pr1<KXZ=%7!TaDp
z2>)#V`7~w8^Hk7JC-1ZVDW_mA=-1`$fq!=UeUP%``DoD3B=58SDW~A)@c#h(D=;CB
z{|`}?JeRv$iqFa&O5SJvQ%=Flf_`1@lkm^>pNA<+o?jRAhm-eN|CCd(4gQDWUycc}
z{zoWFp6?3!+2noJKjjo0fd4{4|1VIMJU<llbIJRxf66KN8vKvKKRbSYnX=^hSkTWW
z@3a0Xr(g~K{|x`<VM5I3QOc6%s`LH&T}a+%{ZmfCYl41V?!Vw)i3!pF>y#zW+k$>E
zd7t%9IR&Hef0jG0_mAxM`&fkL??liqB_!*gatdbQe+m4v`FxYI<as&hk0kH2{wb&6
z7x2Ft{@Ly8+mt2G{_7cM<&Gxrv;HZkpg!o=<$k+hKHsG*d2S2(<>Y<VKjjqouW9)G
z@7oII^L@&a=dqwamb}mUr<{U^;XefbDol7;cz&F+<as&hk0<Z5{wb$m75*Q9zgr#Q
z5&fT_EPXEX%X=bupY=~U1(iX+F82}mXUFFsQI<T{2mMO&KI@-y3SJNY&%i%BKKz8T
z<oTwcUrpX;{ZmfC+u?s0{@LS`pHh}QPXztR<bBpZ<rK`q|F7Yn-M)TKS@OIb^rw>d
zS^tz%a1#DMD472*C`+D8U4UohPN(njD)xtzQ}CjoUzhtg_-FTDzoaaAeofG?CGWHK
zr<{Uq@b}j({G&2H;ri{b@GgCNXVAMvz$5FQa!&sQ{3}W#$(|pbo%m2cAM_;&&-$mF
z`X}K368LB9KR5BAzQk=HXXQ#0p7l>T^_K?yy4<z!ufT-3zRpj4sP{kSdRDG1;aUHb
zQ{Msqw-n6hg2adVyMw+w;aUHbQ$Gp+TME|y?8JxqF9dx>!n6J<r~Z5Jzq?@l&r5u$
zKOOXy3D5ecocaoPK<mf<55hmY|GhBrq27Nz_pDr1!n6J<r~b|G{}lYQ*Y_??e5k)Y
z=&KW+^-nqV55WJ+@V^ujV*j}`@uB{kLC;UI^!ioGsb7WvarkHZ=jD0+=a>6@Y7?HV
zKjrklEa=zePQgDr{=78tp?*`)*CjmbpK|Ko2LE&1br=80j{h4HpExy_yDRAH6Q1=?
zIrSfce<l30^>0jks6Q0+jS0{Cr=0q~ga1q5&u@pu^?Oy~L;cT#zA52Z|CCc-?h5w(
zpZ`=NyMFzrY1zkypl?oi)<5N(>-F&8g8E%|3XfR-YZ4#ow*~#CglGLzPW_$m?<(kj
zUE)LieL>%n@T`Bzsec&$gYeJp-(Q#bQ2*_qZ%ugCKjqZ_82<d)t=rv%N6hE?#D{u+
zf^b%@E#X=JlvDrfLBB5dp@R9mG4Y{(W6*C-c-BAV)VINZ3jVJ9g-5LaO^FZnJA!^o
z!n6J<r+y#&`QJaX{qu&zhx!MCzCGbt|CCezRroKW{_OF?jfoHS{<nnB%56<})<5Oc
zufhKZ@ON*+Bj$5c;zNC<8=&0v|Ac4#Q%?QHpkJ5!S;73bCqC4-1$}qIv;HZk{ucN@
z1^;aRI}#u2{jV3hpQ}oE)<5Oce+K@~ao0`#Bb)y%iBFuG%Y8lQ`xBn^PdW7~@UMk`
z_V{gA;zRxUZUN8A4J174pK|Ii4|+F#!auuy`Kbxjx!iR@KU~B=<(y*&{NDus3o#+~
zpW723>fammBMHyepK|Iy3xEFL(hD;FcO^d5`yXvSD>s_(tbfX>{}ue-gZi`Qzx>pP
zYIlE)>i}ov_7?F^Ip_F|pkJ5!6#U(A8Xhs9cP2j6-x&1!5}vI;<<#E+|3~2Ox>I;W
z|9cZ3>isWHpOxF6@T`BzssA(h{|)@J<NtdTAL<_s`muy({Zmf;Kf(XI1?zu*;zRvf
z(2plP>z{J!FLFCXfBf)c_`BJ|Bj$5o;zRu_gZ@Cmv;HZk-v1o6_x~0Av-_71CqC5g
z3i^qJXZ=%7{RiQHf%_c5KX{)}tpB5lPn?>|`CsvN*Z&iq^-nqV--G{4;GaEyyFc-v
z{+B_2FyUGMlvD42eK;Jy!9TlwJ&^cN|GJ=`N_f^k<<#$n|5o_pcO7y5{^`VrdjC7Y
zXXU07p7l>T^?wO}|2dL>xVPaE^M5e$0nU9t=w}k1^-nqVr{RAe{M~RA9?}1y#E1Il
zxgCVN{-5xyf6A%9Ht5&oJ`Mj%Fd_OsocK`RAM}S4p7l>T_4mU6ui>BV|Boa-)E^A`
z*@S2PQ%?P(@c#$+ySL#H>;FRHL;Z=MpG$bwKjqY)<4$;e|NI&Jv+MWEi4XOc2mO4)
zv;HZkz6Jj0LYQ5@k0w6UZx8x~glGLzPW?UbzYxOg`1bY0hx&s-znJi>f6A%<D*Rso
zVK$$~5+CZH2>PXjXZ=%7{kiUd!RP-v2(!lz-%Na{e`(MkNqE*j<<$QU{I@}v9Y4RF
z_)tF_^hXn(^-nqVABF$hA<T|%-%Wg|pAY)wglGLzPW?~e|0fXEU_$Kw-%os~uW}1`
zR_<8Bv;HZkz9s0_<-Q2v#Toy{6CdjPgZ_BJv;HZk{=M-39)#Kc|3u<L{dCZuNO;yi
z<<u|1|KA~WafL_B=SPVT^(TXVCE;2Blv7{nR;cfv&v2jP`A0UNpCmqUYA&}a=vNb-
z^-nqVZ-f73@XsE<{WS5R{;r@uneeQC%BlYt{F~sP-F|<b_)tF=^rsS@^-nqV--iG1
zz~6lw5FRoAUnD-%uLS++glGLzPW`#=fZyl;`|!{9pI;_E)Yk<4TEesbDX0Eb@ZSyp
z?D6fd5+CZ{6!g3sL$6P!ocdiskCRgeXE7n>lXB`KZ#|p)QSv*TPmcf9lF&W>0r-my
z^Do~G{yO3B1Md_5$KYea{{;Lmgnu0T+rmEy{-47C6ueRr{R{9{34a9qCgEQKzeo52
z_>}O!1^4%%+sC)TbqoF;_&R)^&Uuc5>o<G;75vSj|0($G!v7QeBf{6f=Y;=S7;w(Z
z{gd$X!OzC$R;+V9_+`Q?!CQsD5d2o*mxI4w_{+gRD?I*||9QEi!e0gbe+j=1{6bt;
zXZ^ng{%YZy!M6#2EBL#F-vs_?;XUAgBfKAcRrnD2vt(1f3*6tYY9IH2zeV_daDESm
z^LzmOW1{~s_?Lx$9Q>b!Pl1=<Je2-_2L58<4})JX{4c?G3ZDlb7yj4apA-H~aGuw*
zp1%kGZ_ytEuflOS_5T9?8^V7AzFqi};O`cG8hl##Q{aCq{M>LNd0y_P!q<VX=Z*!1
zR)F(orCI+);BOWErQml7e+l@<h1Y}63%?rtUxdE~{9NqUSkG(0Un0B>yiNF<!MT5=
z&yC>siM|v3^TK<<mxb>J{~zJEgI~-WM$qs(z^@e^{~N`5IsPkR*7-i@|4{Vzfj=nx
zBjDc<eh~bm@Xvrh=b3CVK0gG0mGIAl|DN#pZ!FHsjSBxO=>L!K$G{&I{&(O%6ut~z
z$^$f%`%mC66aFLcHwyoE@Y{sP|I~3_?tt+Bf&TvrKfBr&a9-~F!p{T$U*YB8)jUA+
zv%AOhtNq{ea=$73V(=ZpF9Uy%@Rx(n2)`2iTf$!r{&V541%IyloZmj)0Ny10E#SW|
z{B7X=eh2&L0sn;Xo#6b3x147W_`iz&9pLBl15eEGZt#~2|0D3t!aoE)B>dyx9~S;8
z@V^xP=itYLe;)iP;a>v3R1TEC2L4*%-vI9w{`cVT6aEA6hlKwS+<)$EAO8-1O89?*
zKc5%=G1LEozf$-)mw3T>xwi>l2fkPMbHP6;`~~1&7k(MI|6JETUJhQy4~Q`FO7K?*
ze>M1<gufPikMK8u^Z&uJ?YDq`QS@&Ee_VJE_*pzrhS5&&8sU4uUoZR};QsSN`*=6_
z9|`{>@I%5s1pXc2A9wsr-z%^GP1|ZN_i3m1-ydi9;qLsifuEDBJ}c_SG22%zjo;T^
zx;_H_0>x9{xi>_<QWBqk>qSvt`KGM?>(1YQ?|XGe<oj@*u?)WLmdKBx{hxz3?Towy
z`j>^b&&VyyaosafPxqZse=<Jd`h2>)z`2c1@0x<Eo?oY&`Zovty4)y^AF|gs&Q5%&
z9}aq^rT!_W{zLHpU_t-<-}iVV=+oc#;ChVtq@4cWh5v)_cOS2WN7U#49>_0(KK(tA
ztbfYsf00}7{`$#0{N3d*<DdWgA)A7pzZ#(Vq@4a;@c&2nyUV}E|Ji3#$LD*4z9Qk-
z`cqE*H2hD&KYRT@|My8A3;Oi;NwWSar~fMa%Wzzm_2;*SsLtgssPTEGzh{#5PdVqP
z4f=Jt8u)Yjj_dd0BnRrR3;ODWXZ=%7{Y~(1gg=MN=znSAL;YPrUz6~xf6A$!g#YUb
z=9B;XDqjxz+9Libr~g00|0ein`%nJwvBc#{$3yy*T;|uy`MIs(cr%x~6ceJp_3YXT
zD&sS+r~N|4ZC+2S6#WIx|4ifgmb<e4Y&ZEq2u!Yh8lMyQ6!xj*g>6i3ej1<Ad$T@o
z4Ebz2oBbQZd9FL~^K;ei**{|4d_E^PM`4_d>8)q;zj^{E<2n7wcRo#>M?OPkeEvh!
zSxt=X{v(e2{nW&t#tH4HE7rT|>_m_G9tl3_@AhQ-dCJ+$4}yMO?hf?Ba5>IRjQ;t*
z^HXxU?{DeVz^s4D>AxZ9*X0htzZw&w|Hfo{p}sxn8xx-OPdWAPgFpYR(@Qe``M)Fd
z<)BZ0M=0x`a{50B{~w_KtbhLR4#nkaJv(0aqKmtK=EeRu5T1PMIZr$Ur#S6Gx1OKv
z65WjLaR9Si>-3%<e@z5c;BD~fedX#=pz!4X?U2_`U>u;&cBfyTOUFZw!*|2y8Snqw
zw_Be{@b7$W_rsPy9DIJ6Ao?`B0mrw?<GQ+%DEUUv-=3#m4SYu)Kf5;O^VRuv=Oz=~
zix)V)-u<2r8TZ5u(4TnfqGnF>&#w*o2NJ|O7u|aFb=Eu-CvlI}8T9Gr_0+%Jaj&2G
zgQ#cExF5XY{>WE;Ek1wAald|hKX&hpk;K3M5d72qDgEz8ZhK!Jb&c@(Z}|N7rN8%X
z>yvY-_<H8cA|1fQXSojP+kNnpFL;a9*E+sFm)-}$c7HeUjfs@}*1&H_Mm_TPIPTkR
z+Z1PEyR+v-eh~W$^2bXfKaL$T`Ly$)XVSQPu@Lx^PhD{Md+g$2^5bZ?>C;g?fy&0+
zaf`2~aZBVUz!%;A)bkTvk@JY~?3YG9ac|^J(APTdbG!QPSH%hVdja~%$p<6Y2YqYM
zXQbiH?>oLem)=jpWxO}=^gb@~pSz{>b@u;8^kP1rbb8NAvDVAc?$^PWT)*%S>Q~(s
z;q~>dUs(Q6&_|lf)#Jr#sORg%$-20}4Orf1+q>eVSt#njr$-~`1;5tu^|>eTE?uW@
zaop$mz#G5VolJBuZVB9y_<98T&%NvBB|G)KMf8)7ug{%}RMK|844?jcN3O6w{}lA;
z_|N>GT^H;8#i!ndC5v;_Ileyk{=|a%*9M-B^W-Ce|0qvC4*v@lKYk>c=w3`a9@ZCf
zuE)dyx1D(2=Jvz>F%X|}gKoWgeh}B$$iE7oZP3x@o1vccbLVnQKLP#RR0N|)@SK;&
z9KNyR&T}9QPZv4v+nu~EQf_xIhW_sxem$dqwd3n^SLLmjbKQQx`|$n~)_+sb-=3$x
z-JPI${h{XAF7@vW`UjH|xm@!YKM!9YC-L~}qoK}3p1ha}{K=>OzU7NN)eO^?++W}B
z5mdx>zZ}}VFt5(<JMQ&cWqbS&_&@s6^GA|K-HWmfQD1p)q;7SD$K_bwO|rZ%gZ`N7
zzy85`u6NvTU*CD-!e`@@__quEBlqlmo8|X8zCO8YBi&v;3;$F5qMC>Me+QqYpRIhy
z`us5XJf0xt|IAm!dY(M=f>$OJ-HQ#5`+N?%Jp6<8|CZzHbJ%G*PM?GBwbyTx{JVpG
zdtUx`!+*x@AN+&<pK;vhGx3v?d*YP%_shZOy9r{u-w*l(Cohf%eR_W#^=H?|I>+2N
z>K|<PBFBBZ2XFiuFTsTA6>dhqTqD)tZKA&hKF$4+uf?a_o8j}3AHL{KK;fwc`_pk;
zw;aI4JD?wb{=Pr7`uBssqyE||%m2c0U(fO%MS2Ly9&vnq?x%^g9IyTz`Z;viVen@)
z#O1Br@F><moY3n=1@Axb%=mr)`eux8$7-_t2B-7-Lr9JKm%;zL<Et&O2v4tf-0NLg
z;lbxE;8n6-9&_i7UVj9;clzHA{VWW~|Jd>M=Kr9Tqn!t#ue>3Gy~u3=od3p>KK~MY
zuFLDUYk{Zt-O<0rjYhuC`75J;8QQ&MW8}-&PPsCh9ryjM?&bgXDM-W9n;c)C{EC>@
z#K%vNf8FKrJ?lK;&NqC!{&?I!$ae>yyCZae>GPhzugl|?pC5hpJ~vLH&k46)z5l+e
zv;336=Z$&!%sK9t>r0ot;Y&#)?#1%6qEBgc*5~^{Z<X=&lkmCsi?_ekPJM<uI`IDG
zTQ_8m6D|h7_x|JStp5CG$9DUr-);(etBkMT>iGH`26=~=+pfUV`|-%{3*7C*@F4$8
z;OUS`?*Hwx&(nWT(LV;_Q|_;v-Y-|jr@pisC_MRpZ|e2EZani3>Ps6V--`1NEMBe(
zytO{7pZ~R}Kk3@{5Bk(O{rX&bmr{A0oZIgDnQwP^CIXH#-L8Ll-t6Y{5BjtQpY(n+
z`gEY4`SGad_tbB9J9_Wa-4r=}ZVx_>Md<$0=RU`MKEM0+_RM~HD(H9Q^}|Qe?%aWB
z#VfPl3;Oibj{ZLj{KI+ep6|A2U+38S;-t2-<MYcL_w}6n#}B4ERX6F==SF?`1yRT4
zD#3a`Dg17XZ`)*iyEgbo5Bv8mj<3&sG(oI?An>2(@p07o;GeF?$QLDFcLR}MuC>?1
z_pI~Jp#SOff06D?oaAr7|Lh;%{eh$r_oAXA`joou)j#Odv_A4_Y#PIHa_%AQ2mSG~
ze^6hI{%}ghnJ2??U7xppORtLgU+}e-2cuK`TLb=;HyrP<{2IsI`CWpT+ZM-t4kzx3
zliJYI*%+^8FOHmb?hO8kP4ePy_#8m*Jc23jEuuf@_<HmITv$)PyMXNLS-B?L?ib)c
ziqU~r(wBnIdy_io^8otWCV&Abp1}Ir>c$oSApc?T`EXv&PdV=U`DEW6m&7^Z-{-jX
z<oT1=oqfRaTJT$5@|Mhg|5f0>e)Hv6vN+f8JMQ{(Ub}l8_c<Js^XvU?`|*4k7dTn}
zp9G)h<@r2<c3=3Gcin93+<ad2nSV~C^f?-Q-kIm~v%u5)`O9H;0qQx89XoxV<Hj|g
z&%gi0Q%7yP8ysJ6{x2<kemC%4iIlt-J{PP${^4Yzd-45}Sbw$KZ~F(^eY?~9d?wx+
z`2@zR`@xU2MP3=7a$j-WonPcF?-P#u`m284{5?qH(~F}2iujxkK3`6xtp8bVZLiM_
z=J5@Ir`M&aZ^U?b@|AHGF4tRv{=PgPe|_IC@3`B)`3LobL7(2APyg}2za7QyFL|pw
zYVbb({(b+T&qG1)HUd1TUv%8(Q*qlRFXc4<?6+IbryqGVoyqb40l)I0|M<Gq-~Zg$
z?o4B(c*;G`Ex-49>~pVjJuH2^7W{8-|Ko*}=5lWX|Kb1r!TT*AcHA#ly`0Cr7y38#
zU-%uX{{-|cI0UN4#AhR)Cdub((69V%6tZ9Ka|a~8-NkK@S7H79o71n)Jqp(}|7W`W
zpI_do{}{U|ndn};6#QM6T*8ku!sIsaU;Sw9GOO=&+_zinj??{v>+zk~UN*Vy-tu`j
zx7YJ?9Dajn#QCf@|Ie4}{bOkN(du`ej!yBfzfaWr?8Vw*yN80$`FY#dH{o;oktfqI
zoYj-y7k;+n&#iw+bIj+afxb+Cd!;+k@a+!&dQ`LB0~L|4Zp`vZ_?)xxJImI8gX7-k
zWKX1Pn0T$@>%*`2N5CAm2A+QYPQC&Cc}ey!_c*;@zsLJt^J3fX{opm@e~~#4dIHO}
zaA8yrW2P^LcGK^bu-)ar)6a9s%g%|*H7?`iL+B5Oq(A)9`S=|6<0yyMnJ;~Htp5|g
z_>fbik4NFZ+12YG1Mw;MThQ;>^4tFk6rOH$e0?sxuYh%a!M*V9E?yGV^cltRlA9PF
z<nMrg?l(WZAx?>ZKNS4GoY&tT33{uHuNQ;<o5=*$vjYF0{NuX2l8Np`i923gpL<=N
z{{vWGTd=-ZXHC>67W99$<9>Mu`r@RMP_#Sl`$_K~|II%oGr1Q7;6J?XQ=hkd%^7;1
zCLCw7-8W+W9&!2k2l@L#J->?3{dKd4$Dcdyeahbv-&cXpxZFLTyDS3wT#V};o1UNL
z{tVIU-G}YrLH*Z4yWh>r?cdlgrfiP0<^DV9Uz(?{aK}U5f9(@d$m_sYI=(*q_l?N8
zTyJvR=lSqGBRJBD({Bs<FQBzFhxbAMrO$5vK{C<3_^ji;-3b|27lO~%^XmMUz|;Ge
zSWn3&U*~)C^cOkq>m2{<&%DdF+Z6P-<mulE{mgskzG3x4;0NE;_A<+FaofMI|D+qA
z{DbS|k2b}2U;3=G-yJ64&u1KW*O74al;*R~Er|DNza$Fj^O)0nzWj<Te*%0Bqc-*b
z<+vMH^OkE2`&s|JJ^!G-{MxjJI3@mlzT>`K-Y<b+DEE?}fAXojfAqlztiGj)&o=0v
z-SVcdSp5k6n_m(s>$wm5d*A-Uo2-7u@%6dK&LS(vi*LZEYD)w>PIxltf0?Jh-t9;I
za`nC->e=ptZbr|KHf8xfH;#K=@AiBCLH)C?^Yz@F=YOT+UOykyx!h(v|EA-<A5MMk
zTMIzp$vb#`wH#;O2>k_jp1*4K{h{6OCx|(WL7#iUw`!A#?!{*u_x`!JN6P)qSAyOu
z<Lj>n|MdPV`X3Mc*?G(RtKjqGQzQF6(rDc(f79o4SDyYi9QQf=$<%v(V)gCdSN(4J
zBbHz4Mi*cI<mHhv|GS`n<JXQXS^X2(9*;aPtN*amd!ONZBggQa`z(CkvG&YAus(kU
z{<{8)Z?XIz!9V-6Te>X&U&p<F<4~mA-2U4?DqAAok9L{oOC9$)eEqM-(Q~8zTF2Mt
zaIohP^=}ROsIh-{!e{xp=j^xqUEo*z{`0n5J^|jec*WzEKU~EBL3jM;m#h7iQO(Zv
z75Mz_kq>{y`h3fAcOH5+8S8%%`Vai{N*uvO#Rad8{%v*fJ=gC=j&ojm`R5IeyZcr0
z`qhm^^w+;A`sdyhT{u3hV!8HWx!7)B@Okp7ryiXex9#2o{@EAYvcvKZJMQzLxE>SR
zY9b%NDAtZd9)N!2lTp}$CHX7I*PH*NT@IgzFN!|Z?zqW62I5ohiBJ#Tn5PHaaf7d?
z!d+MJ59<Fn_+Orv+eNR7`livW{u;-9|9tqXpTbBPr?-PQ^nW$&q;Ar!j<3(9n+of{
zCvb%CbmTW+yDq~~JL_z7<E*cLWMgb^I6mb*hIW6iYTf&R!qXwgy?*b8Na?c(ef$6U
zz>3vxMn1=J7R^Cx)~z4!Gk;FjrxNS2Vr%4Eu^xX6|8M-w#DmuVe7B?YJ|%MA^o-ZX
zJWsA&`BAHHaD07kSKfMgbKpNoq|EJ>z#q@k-v|F+UptIFSe*4U;1?g<`L4vwz3~0c
z*Leub!`%Kd=&droe$Ba2U+<11{Db;$JH7YeeV#LMa_%Q+_v#ZL`A?wm^lPnYAF%w{
zj(eXYAC7dQBtAC={gY2!_`$#ZywzXt`1;&C6U2PBL;nXqc-6hhMEByJpno7Qx9hRq
zkE1;<*Jt3<H!%7)*5^_1{*Qicr{zBg{)2h`{|)^&H}zo)i*xOB$6<bX{rQJ~u-)t3
zf_T1C9dN>*_gj8>w@2vya(Op6?zhv)pH6%{ndn}880QiG`nP{@JGw6DBeQ=?uw4vb
zyI?)X*2j9*+&JnV<ga{I<h3u%^0%R$kIwJ<X`B-O-UI&b7k}=DmTz#Qi(lTkO_9?7
zpwoL^_m0T-qMyz??(Xx!yEKP?4*u3TzW%SE#~|zwb1T2z`#hA)K)%6opXc|wKK4j5
z(Y<&*`2Lb#9<}^{8!vpF$6en3!TRsR_%{0DEcf3V_xioh$nu+FJ$e1-(dR{dPS(q4
z(5K&nVEvEbIDfzEU;e>*CWHQl2;E=m9}fJ2ymtRC@K5LIA2>hOv(44zAN0Q-{h60^
z$bahkpI_dVYqI(aN+Yj!{mVb7uf+B^Alu_lTs?lhT>rz($-4LRmHc+(zw;-5{5Jod
zk6*bLzTHhw)Bh6apK-x+UPi5dzS{Bix%={RxFP7RGQPeA+eMXZ7rhw&PssS+8~pFj
z^M6m^zepM=$E!~`?(08^{n`llqoJNBpBnqt8~!?($-OuVeYxxh{~NsbV^Mt!6<pNj
zm)Bi{z=Q2J2L8&tI^X2D&;PE!{}q-v&NvwK-_O%8x$|LP|8eYKnSZbA_nsed<A;Bc
zAB6uy7yWi-octX4V{e>^GvM!t>wn&7>B<PWAAjPRksrXgNB_TrPv72S|6q-N7Puwx
z^*L{d%ln1v-sz6O(#M71-+A;`TT|-tcd7V#>Tisc_nlsa<=rOBTaV+<!`LoZ|JCpx
ze|gU~>%ZCY^|_zt<$PP<_vZ2U2mWXt--qpMvmEElpxuRkd&389y9>eRjR|5uSqc0n
zdH&^28rJV0##xrI{axX>J0HyRc?0y5?~RjALNVmH?{DA!?$7@;naRBv1Hbow&ri)9
z|1|jHFYHFrajq{pzCQP0UY$2$94>e3$3NIl9uN8rdHVke{E;Yjf0@I%=!cup59#yV
z---2~zV@}rJpM%u+CAuwr~HHZTIip>`^Wzqr^LUnc6@zqV_rSK#CgH^tD}xS?eIC&
zT$>(rJBk1PvtKW*7iaZ@(LWhexm=Tudwt8tqy9*I%FPFVyfIIY72)55PvyQSp2s|=
z9ABTiF>kq^vpLPy*yozDpXI;M<?{aMyjW+s8*luB`~|`1$*1Pu{pvTzDe-TU<Lh&m
zC#W2+CNZ9mVRWNUu5X~TqjR8dLszb5gl{^!h6nqTH@$as4Bt7>ldI_tXy@+kJ^ei$
zeY^UG!~22$&f$*k!P~=|n|pTk4EA+(5Oxd<?%v*$(RJ+X9Pa83sB@rWXwT3<&#vg~
z-VXK*?b+Fr>*%<(Yp`p$b9;v`uWR?NT|HgHo(>HU7NADk-8WQNo}FOk=<4t39PDs4
z4D9aP<(8zUzw=IQs))q6xWape6Bn63f1;Vw71p`k1<DF!-a?bj++90v?&ukic~Y3C
z?AX<r7i6&Dg#0;ry9W#UcVI%nIXZeqinQbA;>7$pUFQmG->&Ca9;f8b(|PmFMGEAU
z{CT>2I4!@WbXxv=gS+<(7b!5Als{MR?*8pXBE*#ZdE7cIJPRh|&#|*-xU;)+xYKQ5
zL$?;5H&2r9;%n{LerHEle_zk8VyiGulkXFT5ZPkmn&cESPiJ>Gdy`ooh8nHgKnrLM
zHQKJ-J9qXC7m#Nsm^tF6n&0I!+~{w1TYbLTP@^5#Q%Gy5(RS?~xU+z<#YT;!{Ak<d
z2JaDB`-LW(xshG5xeHA;b9?i_;f_JKQz+1^nPTSgmS&1s=Q732gH<+|*C*pTj@;<u
z8q1SgY}9^@xr&Cj_sc?LCzv_>dMh|bc7mDXwmm(Aclvqyc6ImYI?A7D=G@u6Bg|MJ
zWSwN@@@r;Cf6-NACz-kY8nBaO<=9DPu26=ZW@gKqX6D0Mb#qGY*$HNjxB~NM$Z+U8
z`}=oybq@FVotxXU-`>|{`)HA=rY%34KhWvu+Sx7j=_Hw}d#5{YDL9jvqVu@qi_DWw
zG4l+$Lxzr>L%N@^*r*44Ztfcz?iuVD*wf!%V77wO&HUXx1r=sJ7f~3G#K9eD?T|q8
zrWKoyM-Qgu%)Fd#<~NlUXt}^tGp|3c^9KtZJOVN8=1r6NZtL3BwX?$=T6PTe<*%mU
zj=bqI|4`qqo86(IHyChhZs+#Cosycbpoq$N4Ucqm>p^0|RM)X{j}C%COK$W#277us
zhHlk^8;gzF)w;(eapzFSK%YCG$Q~TzPc(B5yF>Ku-FNINHgm!0W`5shXh0jaT=euT
zFpHfebL|;$hhRM&HxKo>y?6gmftd>^j0a9$I_~K1E0j{9$!6~KB&V1`5ry&S*%eMl
ziWE>_s+pH3D@A55G}+AUMsRoXSFG{^Q_Z|Mk1RHGp~+@$zmxYh4-Iz?>pIJuCi4yL
z?AhthTZaeTVe@cLq1g*bjLY`H-JRWCokOvP+xF~s$MAzaon5{DKtX!Y(`t?Hp02P^
zegV3-4|IxCfvMSf-Jser*nOwFvm?8ux*0Q*vU7#OwAg$y5pxdr4EJ_yAMESC8J88(
z_6kiZFjv~EO|5p`te}8H{zU^jyP0a1){ngfPm{6}%p87I6r3YFq2L@Hdj|UZcIk;-
zI-{9x=J!V%;ZjYSslTLRv8dw~ZgQkPogi~yvo0`;nIiKH-MOo)!)-ZT1A4K=mnKtX
z-cFfpcF2Baoh);^?pw6o%ru#=+i&8#3sq~Tn0a>g_Qhkzo?SQh?b6*{fvIL*4)b1B
zU|(5ivY9*W>>Wi6iYSc79fN&tH+I`jcTKKO$Dq7vW<Gz;;SRBS1_$>HxU=2PUETdX
zdUd9##`p~O?A(339}doJbtYNHZD@G+pgUBFR~w7e<p=R1D&w`i(+~GIcXaRBsfScL
z$;{=q)1Co$X=Y%+9n;CCl0VVR**D~O2JUzCvRkmlM(wTujQEQ;w|3mVJMT(W{=|ZF
z?%8$5dDF>eZode;P@FAPrkHu$BE-QE>!aiL&i=g4R$OG9d>gPTo^ZZE90tRFeD|Kg
zuAYt^gS&U;Us(0+6j6znKUvt>5iZ2;+#a@Je^M>$(AyOkisSHL=dPiF-Tsn;zZ#z(
za=t(uhIa1U)6u<qXJ_B80<+6hGcQJQ_c6i1P{$peyZi<DA$K}m;1cT7NsX&tct2db
z)A9n<m?>tS!5()dekdLy7GBXs6vm^=ZB1@y^M`wdEeZ>agRk5l;JfX)Z`Y391*(^+
zW?nbK41}4x+}OCQM^Cg0O*V7;mT&JF9O~QcPKAaC3y&oE0^^XLDZ8V9Fs^iT>FHZh
zjq&MoyKihzI3;jnjvo6K7a6DSp2Ug0r-0QNRK}}tgB`necWieTg7nzw|3huOx$kg$
zi8w?QaXq8X_~CqpcG8OqOf~c7wc(G5#G$Ch`ndiy*mK*SzQLYue}!R(zXrUcFYijO
zKcFqDGk(5*_6>A(^zXiT`yRc(lRvTOoX+45S)A<L6c~rWk&c1g{klOJYPCIGce>C0
z!eEwv`C>4Cs+rdpGEjKX0`|w-UGCyy`0&z=@BFy5F@6rZvt#$bP;Nup#<Ls3-;Lq#
z72$7V_<LpedsX;*b@<y9{$3OQHq^(bICn#wy&=xu5DgllLqoJ^h#n2mq#?R&j4m5d
zLv+~~T{cFSjnQReblDhPHb$3?(dCNhaz%8x0*ew|u81yIM3*a~%N5b(is*7hbZLw(
zjnSnsx-=q@=+YQn8ly{NbZLw(jnU=G=yGLrxiY%AyRm)JS4NjBqsx`i<;v)CWpueR
zx?B}qu8J;KMVG6h%T>|ks_1f6bh#?JToqleiY`}2m#d@8)zRhZ=yG**xjMRB9bK-D
zE>}mFtD{R(bZLq%P0^((x-><Xrs&cXU7DgxQ*>#HF779Hd<54-musTSHPPjo=yFYT
zabNZi%II=Ubh#$FG}K3%hWhB!P#=vN>Z4ObeY9$*k6sP+(X639x;4~CyM}uBCEXZ)
z?8xlN?8@xR?9A-V?9S-V4d~Df=+O-uQ6Ktr13GmBdUXT3bp!f!13GpCdUgZ4b_4o$
z13GuZ6<A($?*{bm26XTS^za6B@dotq26XZU^zsID^9J<uhDPLvp5EZPx<B(C-05!3
zh%dq?d)!~Rk2Ku1vf<tSIDpgdxGg!e!5ofoKfrUbbPDz{GQsW!+@5o|&wcddn(?#U
zv3oG=L(ORDj)rl(#KL6UE-c78xR0EA+#y+UhXR7EgFmJ0?(uh$^z7==QzchI{`51=
zAFe;-FGtoS5oMiF>Y0iuD9O6`ovk|?Jwqgg6zUNVmW#*AgJr8wkNBZcei%GR^i#6)
zq#vi`&y}5)ozEX+*v^+fcOgaA1O3%~csSs?lsin$H_4Z5Xxrd6q77~!$F`BKypEd(
zI|q8xEpVX69esE7yARS*#`HW1pA{yJZ*bZ4-08;D;D06U`*wA94foyNH|#d7zMVaT
zsg=K1AzU&UDyHq&v1eB}(#tNlT81l6`O98Z_B3wh3YSZYcVM~gD$md;pT@IL2Ywp!
zLbE(=D^Ir(<Sjyht->`D2EYObp}xy>4h{8$8x5$7H(;fo7~Z+lWR}?mI0qZeo|bYd
z{CMZgQ0nJD*|Hx;nMrP#@pq79Z|g|s^ve?OTwyEe<sn?+@yixZ^4!N~;dIlV;Zg4T
zePVH|X*ciVelyKC%2WGvV~bmv8^FVEAl>@75pWC3AI5zxMK08vR$WJBzO*vSVQbQ*
z%iNTg&93-`8`E;}j^I<U*Rg#Xenq+qH12awcOiQBjvf8(bD?nUXef6_ryCn~>>hO2
zUO2Rc!Nc8;CW~UPJs@H(wC@Vtd%FBR0Pfm>`{3Ap+?AKHzqsQ*h8s*G!(N}O9gCEA
zpV-c!o-WrHcX!;<w_`^iJ_k!9<GFp&i%6+7?T6tyBo-nadONy$d%AA5`+G0(*Y4fr
z^4KeRb;VDJm#f{eyT4?Xwvuj!=^YXIP2mEwZ=6ZF{)rCj4hY1QAF3x|r8l6t9r_-3
z#_0~BI>K&=5^Sc<$gK{ySY5rhcHF$jecmnBE<j%QHy^LkrTAr1v&e-8>;hvdJ++Hw
z^UL1m^t7!M7>3hzVec<s>pZ~lp8@P(_NEiW(IQNUYuKG2WGm#kKh|op6%;s(V59yJ
z&s|{+_gP`Ku#uQ?Azb|rchZ>V>==};C?oJ@-n{S!8fg--`}#}8LtVSVR_ZUKusk=_
ze?rbB5r03BrJrK^7X1cM;F2Qk{0!zp2`sS5*b9=zQo~Lc5w@_nK)X8qbr)-!xeCMy
zh5O$bdj^M%WFXEjvbWP6k@-*0!$z8xfjh`>2VfepU;Tw|nMvv__TiIn9ODd6t2okR
zyPn^u-AYXFicFi2yFa%(b)O}AzuR`YE6MSm3pc*Ij~?O;>HbdMfll|qxWAptgsY!1
znGMe`SbC?@t^O_?=^@+;+M^6#L%40<Ulkwjyg3{%^bFZOecGeb4-~N;{0XKj(DxGG
zGvn=R%+VL*$CpBv7pal^=!jicDRjDpR@o=RClPjMCClpyuy-8!xqVG$DLc0JxYXSZ
zJDtPvYB~$>I=wxM(~_Ynxs}d4$5F^#Ch%|kT4moYzFNH!{mHNOU3=muifL!z&eq+6
z@48gyo$fMivJU;8B%BR+m%Lq{-7xKL&u`N4m`<`Pd^Nnl!0UE3Jv#@6{aH2x3Ab0e
z0~+4Fm@a@@Q?9{e>&@RvIND~XaJhNod}`=7pX5#iwjU1g^o)71^Nx-o_i3xUR_u1G
zeS^0Rb>8kb2+m|T#FV0C-p!wgi+oCPtH1lF%iXKf(-Ceb?QoyM;U?3x<`_c$K!i`D
zlir+M#ZPCA<;bc+jmal)EYh#rB8R1>r-kjcyT4;ke>?yUpJDmwAw_(+;l`)1>d`xs
zTS(H%e0+XtdJjiB%@-0bhO2G7RwRp)Y))ZMpRNjXXS^BZd`}PO*|@Jlo4|2Fwm<pt
zn78StWoGW3Rv&X59D0`NIib7bmRvX675a6jY}<YuE3z-(nVVY?$xV@5nLb~+m4%bS
ziptw<a_ZCGB4)z$jbPn!_RQMAy|kR><;lipN0rPdjwH=-M6%k`L);ymeeo-1Zee;x
z+;_?1@i9la^f=iz<J-rm%7MvO-{<ZdxJ&nS;n*d;qd#5ienNVy0v9cAqwzC(GHhpV
z;mpc+!yoU*ppM4^XWEd99H9HG;$F&aOS^`5;dC$CgXmx2xZmuW%~YG&84eiIRqeNa
zf0If4FgRJRLLXMAK^FbyoROqoV@XW?;ex+wJ=x&019!(AeeS3yTo|K7js(KJ8GXCE
zhU15QX={GX7P!}vEoWD}&B)#|Z?+EK?isG2xSpGL@u<K+=@w7F_K}wCy384l=*>AQ
z#ztE;x+iYK;8Oac3!P<fdVx*8z;aSuXc^CN%Ba_VXp=Y6`cXUv6K-=2cTrI6wglHR
zaSv(!VB%Nf9(TcQXu$1h{Z)V>-6ULHDcV<(zMmY!r8^$C&~YzfuQ8;PeF09AZ0+g2
zLR<oKZtUyFPBgvf5^t19djZy@em#$N=|(PlPMkNGEuXU#T5mGYo9~iwu0rSGe%Hx^
zG^`9B^yeS$VL^EGWP7WtNVa1f?yzwmYu-Ifoap8*^f^-+p`SZ*(kX5G!_ds93(4?<
zBc9~i7(XBgUx1X;pm1w^kxN)CHD(}d%GH0SE`{8ZBRX3=mfN1Q;VOH$niTe%+8V#>
z<3|nIhx?##=Z?9fI2+`drlVB%#O;pVfxD^fNuY1f*Y2;QWYUa>WW_E|`y(R#ssvV9
zdI2t8os)$xcB_z|d%#^#b(bjJNm_OfTWH8hw(q28VBnK^5s2SW#4kOwBe-?WzLZ?F
zm3i%vWIDjO8S{25{9wf|g{#)5=}x!(g;239aJ|R&rl;MI<oM?Q>&g}{O!`qB_bZza
zvYWjtm(z+5Uv3F~pYeSs`RYR2MGFS&gYoTi+u(&6&v_<3<ZfV0?x#-u{MdkV;xI<v
z%AW1lyjvCV+nTJJX6dM#oN4aa#dA&9dHlV^W?}t)*Y618`4X%374cG<J*zJA-9&S6
z;<J%k{k*BmCU2mLce55cVk&T}lW77AQScT5Y)Rp=dXkLWq|KQQF%B=ZpSt>sU0`9v
z$#sKd$$05KE@RH6=~kXNy9l^<*C~15Fk+2vQT=gPx=u5n6`bKVa~k9w<#9r>5Yx>d
z|11!TYtEqj+8&B0IW)#bXS$g0$LR&Yv;ofxUGYqsNpJiMo$==QiyeNb@OS#^25^SY
z9MhWo!G^oPu5UQ(pE`Qo*@dZ;V`jX*lPnQ_ARzqo0ihlP;{&j8y~Q~4lNTB5&Ty>i
zBgKx6Hv;=WJPtqD;NQsam}GYvXFk!!!H65Fai1<1NWVTo&P?33KHqedHE}3%-6-C6
zYW7Cq5`c7Z4#lP?`-O1VAl<+)*yl!!VjG8!x#%6~-qt6>GEDMCP6N4E_RFAVY$<$k
z2N~dlZd!zf<Egwa%3tu`?e6u7eSOEEyAjHiQ{*~kx;2;%Rp8ja@a)-Jh|@hsdSsqn
z8P9f-B8$&sCFW@x;9}zgjO;au&^=uj>FV6o<%U}~4u-43;d)6ppw3%u$;Fq%H*RJ;
zU<q4lINuI;t6=`5u)MvA$=Y6z$u742@P+OA(hHoP+buS%=`)^MF*wt|>0hAhTkm4q
zUAo8QGRr3Aupbk`&)~2vKL$GLF4*r5H%+@!3wJw@zlPGW=ZcLTor8nnSA-I|Ug|YB
zk5hxbpFIi8Tbp?YQ+5#xEJ~(>#I?L5-W8ShVyvvVg!C(X1j1t7U=g;X<eQ#;f<0C&
za3LhF|Lk{A(jr{#XI!?zM-e<yFx`O*;G-+L31z?S!lm*R$}v?sZeaZ+-+D<)cSAD1
zbcGvdT<;imp9}2SwSD&<ceU$|+oVVNc4XI+-F(vS<(I-A*1Ap@K46Pq8}U13_szKM
z=dSkiZhxfd<_aeRJ-54G^5MypJuG&Sv&*Nqh7>t;N=G`gEOv#byMCrgr*P|(xx8ps
z(9;jMshi&lGq+j!l=K`iU0-hL{2ZB+{tkRf<A=+5VB&AkOXu-3;7lNe1x~=ziD3}1
z*YEAp`SqM$l;D>Z%wEt7%qQ^KPT(inyLr+^!*<Si&H4yk9;18SZ#0=^Ly`qQn8kRL
zbPKmueZL#zSM=~@p|tP&%~CE8<<HEcFdw@~JKb*Zg~N1R>-RG_#W!b8F*NMF>ql0Q
zH)h$1;Y{3}qUB$_z_&VBLAvdl;O&MWm)ZPg7<RGdd%$UYZcU!?RKMURnjXRU5_X1>
zI)~@@VPtaus5yo3(cu;eyWoBwp81>!gI5@|xX|3S`h_WQ0*#^3e^7!4ex5h?9QO-|
z{-+>cgx`a##`Nb3uK~Zv@mulRogTTLFAWd+Tn8WbGl$_pAM!2W>cbyhrB5e(_Cik|
za{QcQPJQ?*t@POopF`q9ez-_ItA_72%iD}!jP&hV-V5&AP5(PUF4qr!vGDyy?@PQN
zb&d)D3ivoUbD;i!aOx+)HJ>Tt@9T6wgB%{y;4g5`md_ZyFXeAh5C3l}b7s4Tp=X`c
z&kCo04qWS8HtpIx`TN0|=V_z&B{H8i;U`gl4!=0cI;k%aPJJ1;*2(|B%Jt4X{qIQo
zhvr!Y&fJ(!wQ#mu1I{|BuN6*x9k|xnYW!`U{J*c7XRp!QJo|+|g**qqSts)x7Eb*r
zxYp@^AJ{)M&;8(<=a|v^Qkc)UaJG8@oOMz^A)NY2aIMq-zXtzco$*~RHwUhHE*rhg
z^O*2T{2uUeaMsB@PY9=e6<q5)W&G`SeHvWzTr+x`XU_d@uz#@MvfUDJ*2z3eg;QS!
zu65QLf7?Inz%|cSqqljs34a;#+zie-ndcVa)NcjXI=hX(&9fI=^XxZzo9BRVwmS^Y
zI+^E)aOy|Fway9SZ}Xf4*F0y9-sU+cd=v8Y|99IzSSRyb5KjFPxYl{p_}e^}!8Olg
zMsM>xE}ZS20B4=db457ytKeE^DgGaTZtrE_nrE%i+dS)p|2Fch2WOqkvr#zp&EQ&R
zi}AO4wt{P(ZANeN+$@~!ZUJYV%(GoM^;^NU&Jp8p`{yXQ=E?uZ!tsasOd20w|BcA=
zAUNx!eo8p?GvHe1VdHP}oCViB=ZxOwIWL^;E`YO6=D8@G`Xz9!bH(`EJXgUr&r%%I
zYM%c8iuwn6AMz{*XPwNmLOAtR;96&m@wa)_f@_|2MsM@17tVGY!C5EsY!Xhr|6O<g
z&^p_Vzs++ixaK)x^uA8!Gb(%(dGg$WbyB|%dUEQ=z_m{Q|6lxr;}VZQC%`q&Nu#%U
z9u&@Yr@&bc^PCn={S3I)xoG@to=f1G=ZewWJXeK}A<vWGtdn`35>EXZxYk+X8!M1!
zDY)iYX7v6g^C=h3b}PVHC-s%WsjmXpI-88Y&9fO?^K3VI|C0G^6+VePw}G=x>br$g
z-w&>J4jX^Fy^nxvo})(ZUosz_uX9{tyZfMLoz(9aPW>3T);SH%?Z`D99y8#Y=c3X3
zm&|8L_(RC^2srDc{-|*3kAZ8QCyc+%a|K-UTs3<ClKJp_k$JM+Q_!<c>Q4)&ehpmf
z<ng}dS%o|_&n9rz!+e^Be+BP(yv91IZ^3kO>f6Az&Mn5@=GhLed2Tg&o98y+Y_}Vn
z^)OHWe~A2pocexnt#iNex7$0%3C(lb=zX2cXGZw9@cs~<Sr7Gxg;PHVu5~VebG>ta
zv<R+wE*ZVe^N4V^dlZ~?GS6k<)E@)aI!_yao97z1=2?ja(f(N_{Bg`*4bD25XN_>`
z>%g_nM&ob$XA`*Q*=+PS&rQPFZVNc;WS*_Usc!?<I(v=3&9fg|^W1OrwttQZ|1ab@
z4$eB6=K<l=Pl9WmQ^w!sISsCP&KSMT^N?`1dl;N`GS6Az)X#xyoy*4G=6MWU^E_?z
zHqSNT>+wG4{%?_guukS#BAog%aILcfT(|d1aLu#I=xv_W!r5*OIO}AdwZf^d1J^oR
zjla#a4P5i=HF}$8zwk?t=KwhCWS+yqsUHQ`I{p9q_7BZ-Ke*;OX7o1Cap7$D066Pp
zo)f~Up9I%BXN|wja}HedTsC@}=P}_gN1n&QSts*6A)NYEaIN!{@weOiX>iSR&FF2O
zIro1jxn4YHyCvYPlX;d3r@jna>#Q~YHqSb6&9l|$ZJuqyuR)%h!C5Es+#;O%t>9W`
zxAC`m_JV7k{YG!|91zZShrwAV^BfUQ{V2HBIbr;5o|E93=d97&Jm-XSzc>%hI+^E!
zaO#)9wa%l)-{!dtu6Z6adYk8Q;cWK=IO}AdE5fN?1=l)D-T$>@|F?OTfoq<%MsM@1
z6Mh5wXFWLUWS)(}sc#0?I$Mmt&9fC;^K3JEo9AZXY<CMd>tvqo!l~a1u62$Wf1Bqh
zxaK)w^fu2);oFhtL2%Z|Jg0<HKLf6H9yb0q&slKIbI#~(p7X-l?gBXLWS)z{sb2!u
zI#-Op&2tr8^DHe(`?JlnO!zM3Sq{!RnP-J?>Z`!D&Kl!y^Q;BeJnM|!=2<VC?KXn5
zPUhJpocd;Pt+U<u+dQ{|Yn~%UZ}S`#{&wWK7o2r6&wawF9|PAq4;X)&=LERsIcfAZ
z&x69*?i4udWS-N)sh<JYIv0(<&2tG{^IS1{o9C)<o)?`2XPwORlyK_Tz_rejb?J6t
z^DG6|Jj;yU=2<SB?N)%ZPUcxDocbzot+UDa+dP}WHP3dVw|Q<A{weg&ZQ!hvd3Fn@
zz8_rc95((o&k=CVbJXZ<o_mF}-F@J!lX>nJPW>3T);VqbZJsmWn&+a?+dP+qe;#=r
z0cV}e^Qds@kAZ8QCyc+%a|K-UTs3-|=Sksg_Y^qmWS*ymQ@;kTbym9nckCZLkBjee
zxhinYv&rafp3TC)hCDZcvrgvOBAog*aIJHT@wa)lgKM5!jo#+DO*q@_24|hjvsXCv
z{oq>Xe&cWZ=NP!=Ic@Yd&l%z0L7s=eSts*6ES&l|aIMq-pKJf%dWU^(5nS_JGJ2cm
z5#en2C^+k6p3B0iKL)OKo;LnA&oyw(v+`N#a@jnqgdfKOSA(-o=2;`0`Z{o}v(fn5
z{@Dbsc{Urp&2y7*w%Y>EI+<syaO&H@wa#ASZ}aR2*F5(dz0Gq>_|K5%I5_KMo(F_e
zKMAgNP8olj=QOzHIb-xT&qKo5?qP7&$vkI;Q$Gi;buJr!o98ib&GWR;+dS8V|B4$V
z{_#5NWS%9$sV@W9IxE0+d#?o7Jgbb}=2<PA?bd*^PUcxFoccO&t+Unm+dSLAHP2q7
zw|VvpUyti$1K_Nac@7JweiU5m+-Ll4|J)C*d5#&q&2wBh+dTlzI+^E$aOx+)wa!`N
zZ}Xf3*F2Yv-sX8s_@&76I5_KMo+pG;zY4B(o-+P6&(q+V=bF*mJag-_<3HOi0cV}e
zvs5_sW#C$8t?{>c)`4rDtwwM2Y!iM3^4tv0I+^Dd;nZ&h*E+k6zs<83T=VQVdYk8f
zaJD-P&N`Xrh;Zsh!L`l_<8Skv1lK%gjo#)tC%grD&V#c~=D8r8`Xz9!^QiH+c`k!%
zp2v*d=6PH=+dTo!I+^E+aOzjVwa(IKr~TjNSq83o)*8LdvrhO8$g>`tbu!OJ;nX*S
zYn?5|-{#p0u6ec@z0Gs8aJIVzoOLqKcHz`-1=l)9jK9ru6kPM1FnXKkr0^c(c@Ug+
zGS4aD)X#uxorjIT&2tu9^PDq!o9Dc6wz~k%I+^F9aO#)9wayjeZ}VIQ*E~y~llEtu
zXPNLJ<XH~RI+<sMaO$hTwayyjZ}Y4L*F5Wt-sV{^ob5J(vrgvOB%JzYaILf5_}e_U
zf@_{5MsM>R75<0Fb1yjSWS;wkQ$Gf-bsjMOHqQxg&2!S|ZJq~(v)w6h*2z4lg;PHR
zu5~UNf1BqLxaPTH^fu2`;r!hCBslA2o~MLUzXq;#mQ<wMh0U`RT=Oh5dYfmtaJE|k
z&N`WArEu!2z_rdM<8Sk92G=~>jo#+DRroae=QeQG$vnG-Q{NA+bq*VUo976)<~eHg
zHqX7n+3r4Y*2z5g3#WbzT<e@R{x;7UaLsek=xv@$!e^1^5pdSYJdX;e{usE{dBXVH
zJXgRq&sC$hd7c!`c29w`PUd-9IQ47bT4&{Rv)fU8=dOQ(Yo1L;Z}V&x{x#&e37mB@
z&lcg-w}ES&Ta3TWvmIRX+-meT&uzllZZ|mVWS+gksqY8ZI`<oY+ds#^HP30Iw|UM8
z|3~C`2%L2?&%?s0p99xA7mUBna}iwgTrzr_=Mmv-_b52)WS+~ysXqp;b)Gi<HqSM1
z&9m}(X@9nPRtf(P<XH{QI+<sUaO&&8wa!N4Z}V&d*F2kz-sZVUINNOjXPwNmRXFu+
z;96&|@wa*QgKM7qjo#)tCj1=Sk1`I<I+^DI;nYupYn@ZZ-{v_Du6fQFz0LEGaJG9G
zoOLqKS>e>rfoq-1#^2_73|#X(ZS*$JHQ^T_&)oB4e`cM`vqU)cW#C$81$f@|PjJn%
z%IIyL)xz0s4LIv$p0&cMuLIXQTaCZXvkhGH>@|9uXTR`QAkP7C*2z4Fg;PHYu66D+
z{<eSa2iH8ujNaxsE}ZQi0B4=db3!=vli*tCtns&b&Vg&5%SLbWJSO~F<ar#Nbu!Nr
z!l_>c*E&xbf1BrNaLseg=xv_4%Ix^hc1yrnC-W>7PJJ1;)>&)(ZJu@DnrEBQ+dMZ5
ze=G9b0?s;_XS;Cfw}ES&y~f|>*$=LH4j8@7b67ar9RX*Z%yU#Y^?Sj!&Pn5M^E?Qy
zdCnQV&2wJ(5b|6AXPwM*Q8@KSz_re0<8Sjk2CjJ?H+q}r3E^ya1)Oy<&sE{np9I%B
z%YHrW|2EHZaLu#M=xv_$!ry^B8^Kv8^K24M{U&g&v(@<9JlnuE&&@_}^V}kw?Y4un
zPUg8)IQ84Wwa!uFZ}Z#>u6a%xz0LEW@b@9lDR9=wJg0?Ie+XRboHPD5&v|gobHV6s
zo{PfS?h-ibWS&QaQ-2g(>s&SdHqVpbnrGRCX@9nPmJ8>7<Q3qolX+GOr@k6o>#Q~Y
zHqSb6&9mO<ZJv$7*=`d!>tvqI!l~Z`u61rT{x;8T;F{;C(c3)t3jZ_o&wb#mlX>nJ
zPW?Ez);VGPZJv|hn&&~Iw|PzpXS>tjtdn`p2&euKxYoI3{B52`z%|d4MsM>xCH$+%
z^E5c?WS(onsV})G_J6Ij3|x=r%fU6z3Zu7qRtjgkRp6|Xc~%Rjz6M<D++_T1o-N>-
z=Qg9ad3Fo`7V_)`XPwNmUpV!{;9BRX@wfeRFSzEp&**KQ`-QXJF>uz&JjaDoe*j$T
zJY@WBo`=CT&m%@}^E@h?-%D8rXPwORm~iS(fNPzr#^2_75?u2<W%M@B)56*A8aV4@
zo;mzrB02RX;96%jIJcv?wdHa(;F{+qqqljs2tSSf*$U2jm}i@C>bHPvom-8+&2t;L
z=GkrZHqTz+Y_}hrbu!NZ;nWX<Yn|i9-}cV~;F{+lqqlh;7QPPO519pLoy>DiIQ0wQ
zTIZ7Sw|O1`*F29Jz0Gr3INLo2&N`XrapBaT0M|NmFG!DnY@Q|HnrF4q+dON8Uxqwu
z!C5EstP@UsBe>StZ2WDWo4_^C7NfU$whCvvZQ!hvd2SX?{T6VobHMo9Jcq$G&vB!-
zc^(jc4f31-XPwM*QaJTf;9BR5@wa&%0@pkb8@<hQRyf<8181Ggb6z<03*cJkapQ0E
zJOQqG<}ObAv(2+a_#2UDDLCt7o@K(RuK?FNtBk+Rvl?9UtTB3<XRUCyTL;cMnP<Il
z>Knne&dtW(=D7u2^BgdGo9D3b?Z|TkoOLqKQQ_3@1J^pojK9ru99;7}VDvW63E^ya
z5}b81&x69Lp90r9=Z(M3a{*lQJZ|(h&lAG$K%Oh$tdn`J3a9=QxYoI5{B54O7sl;H
z^DF`P$1OI`QsHd344ic`&vN0^SAc7s^~T@k*$A$AZZ>+G=N94bL7wg4tdn_e6;6FO
zxYpTk{B52C;F{;K(c3&ngtOgIaMsB@_X?+eAGp?e(D>Utr@%GOd84;^E(m`Bc`kyp
zPUg8Jocg2STIVt2Z}U73u6dp?dYk8paJIV&&N`XrN#WF=0@pgrtJD39&9eer^Q<>|
zn`fhNe*d`%oOLqKX5rMgfNPy?#^2_-8C>(+V)Qo8cHwMyD>&<9p4)^|-wm#H?lt~4
z&wb#U=Ru>lc}@vmM*o}!XPwM*MmY6{!L`mg<8Skv2iH6ojNazCD4gvsfwNBLc|<t%
zN5Qqulg8iXc?w+fEWacd9vtVHPlfOwBhN~3)=7PpaO!Kowaz-@Z}Y4N*E}1I-sagP
zob5J)vrgu@NjUW_;9BQ4<8Slq2G>0I8olkG`-HC{&;8)6lX;E_r~UxA);VeXZJr0g
zHP0!dw|PzrXS*}ttdn^j5>EYLaIN!*@wa&%1=l=J8okZ)l<;-<9{Xu<*2z5Agi~K~
zY3%=6XBjxJ+azBX1J^t&jNay1DV*(AfwNBLSuLFU8gQ+1lkvBCwt#D%+l=1k*)5#E
zPtgm`I+<s`aO#J_wa!uFZ~Nz7aLsd{(c3)t3un7y;H;B*jti&$0Jzq9$oShl4})u-
zM~&X*xh$N&yKxMhbu!Q6!l_>Y*E&xbf1BrNaLseg=xv_47iGtPwp#+uI+<swaO%sz
zwayyjZ}Y4L*F0N{-sagV{Po!0+rU{T^V}?)`gU-wbDQzEd3J+qp1nqI^XwPSb_c*&
zC-WQ@PW=eD)_K7A+dL=0HP1svZ}U7X{08JX3(h*3=bUir7r?d7CF5`NJOZwH9yNNK
z=dy6Ndkma)GSB0}sXqa(b(Ykm{om$U3a)w97`@H2R(L=1tOIAA%(GrN^-bVf=O*KC
z^K1dvJX?+4=Gi8k?QRBVoy>EKaO&H^wa#JVZ}S`h*E|mxz0Gq%_?^ge5}b81&x69L
zp9a@D4;g=(=V5TobJpl>o^!(4?mRf_WS$Gcsb2)wI!_pXo97C+=2>!C+MjKnrNZ|k
z&oXe<$vn%2Q(p<LbygdHn`aHU=2>g>HqScYY_}eqbu!OJ;nX*QYn@w+zs<89T=N_@
zdYk8n@CoEO3eGy2=U(B|?+4d9$Bn<u^8mQ!IbrlR&q?8I_aHdyWS&#Psh<YdIv0$;
z&2tf4^E_enHqRB|GstrloOLqKlftP#4X$<OE>E`$n`a5Q=2>d=zE0*-CY<e-gR@TR
zD}+;D39fZE8h@K-6S(HN#pus<buyoJ;a^3bTftc;_1lC~-wUpF4j6x%=P<bDIb!tZ
znmk8^v)#Smtdn`}6HfhpaIJI7_}e_E!8OkXqd(W=xhVWQ$a4vtbu!N*!l_>d*E&xa
zf1BqDxaPTP^yiv9PYP$dr@&b!^E@q_`ZaK^v*N|BG56qkaeSA{Rf21tjYfa26EmMC
z;s1g>o55Kp^_zrK-wLjEZZ`fl&n@7ZXS>n+I+@Q_;cRysIP0XoTR8Q-;9BQC<8S-t
zesIlm%IIyL)58A?dCq{dPUd+?IQ6sOTIam+w|OprYo3cnZ}VId&UTN0vrguDR5<m^
z;9BP?<8Sjk4X$}s)W#mH*FP(Tm*Mx_s=!$%^Q;z5eJ!}wS#SJpo{iv|XOq#}Je!5H
z-A&-ElX<oXr@j?j>+ClEHqTyg&2z8O+y1#vcn$L056(K7=a_Kn4}fc(lg8iXc@SLl
zoHBZw=d^IPI|I%-ndc$l)E@@dI*%HEo98mP=6TBKZJwuvzZ!Y2fwNBLnR`j>=j7Cv
zf@_`S;2h^m<LtQ#aLu#Q=xv@=!r5*$IO}1aHNvT{1=l)TjK9sZ6<qV&X7o1CZs9i|
z&t7oW$vpdoQ$Gx@b&eW;+dub$Yo7az-sZVqINKcqXPwM*TsZXyz_rf9#^2^S3$A${
zHF}%pvhV@qc?_I&GSB0}sb2xtI!_vZo98KT&GWR;+dS8Vv)$ZFv)c>vED=t9DY({I
z1J3OTn^CS7T=Q%(dYfmf@Q)zRHgL^zvvBI$!L`n9#^2`I4X%0i8okZ4UpU(x0B4=d
zb67a_Bj8%+0poA`=LERsdD!S}p0mRL3VF_fvrhKUdEwMAf@_^ejK9tED7faiZ1gtI
zW5U_)ad6hjJWmLxeg$0XEO}Y%k=j2?!8Oksqqlk13g_?k)`7E5=2<VC`X+F#bCdD6
zdA5LSo~=f2^K28&b~l5wPUg8qIQ8w|TIaCwxBYVjT=P6&^fu24;ZLG}PJ**e=6O&!
z_0!;5=ON>7^E?c$dCnTW&2vsT+nonzoy>DVIQ5I*TIUJlZ}VIM*E~z=(*A7oEEQgk
z-?uFTXPwNmTsZZW;96(3@wa)_fNP$$MsM@16V7()!C5EsY!ps?6S&s7#rWGi+rc%@
zVWYQsjtGAR@*D+coy>EuaO(GiYn=y-zs++3T=SeXdYk7#;cRyboOLqKY2nn*fNPx#
z#^2_-2(Edq7`@GNRd_S<JPFP^ndd3t)USbSouw~Nw+owR8Mx+IZuB<K3gK+G5}b81
z&nn^6SA%PvO~&8m*$l3Ewi~_8bF1*1kmojV*2z4(g;U=Tu5}I@f1BqBxaK)(^fu4E
z!rAUVaMsB@_Y0?f3|#A+HvTrx8F0;W(dccSOTved=Miw$$vlq=r~VkY)_KDC+dNmm
zHP2O}w|Slv&UR0MvrguDS~&G<;96(phU|6}-?`tj0@pm7jNaziEc^o(M5j&Qtdn`R
z2&cXcT<hEd&f_|szqf;Ho?DIH=DAHc+wBHtoy@aWIQ9MDTIYV_Z~NyMxaK)!^fu3F
z;fF7XdCq{dPUd+?IQ6sOTIW2t=D7f_c`h2g&2vdO+dTr#I+^ED;nXjKYn`W!zs++E
zT=T4cMcSWjo;AYx{|RcrSts+X6Ha|2xYpTh{O$I>30(7RF?yS4t8lj42F^N}=Vsy5
zZvodj2aLbXa~NFn95;HK=K<mWenHHA0-SX+&q?9bPl0QlGsfTMc?ewdJZ$tf&spJY
zcMhC&GS7M8)GvT*oyU#8&GQ7f=9#N6+&@c%uX|S1m4dTQ=2<43`U-HZv&#6}JgdPq
z&l;n*dDaSNyLI5KlX=z)r@j$f>)dSoZJt}eHO~Q~xBYWi_+`j*1e|p;&r#vj?*rF5
z$Be(ta~xdrJYe)T&k5mdcM_a+GS7p;sh<MZI_HhQ&2s@<^E__!HqR5nuSA|J;H;B*
zt_r9A6u8!zYe=^Xn`a5Q=2>d=HqSEQY_}Yobu!Ni;nY`xYn}DR-{#o}u6b@YdYk7K
z;rzcW?cl7Fd2SU>eK)w)*>C)9o&(^T=djV+JV%7H-BEDX$vpQ8r+y!})_KtQ+dQYh
zHP3mYw|OoI??C@t1ZSPhb4fV$N5QquW5(a+c^q8xJYn=U&lTZpcNLs<GS8F3sXqm-
zb(U|;Zb$K5E>{7rdDa`f&9hPXAo6SiXPwNmSvd7A;96&!@wa(y2G=~d7`@H2T{zp_
z3eGy2=QiQgcY|x4dyT*CpZmZy&ncs~c}@%8hdgJ%Sts*6B%JzLaIJIR_}e@ez%|cB
zqqli331_=Uz*#5rJSv>}WpJ(Yl<~KDo(9)EE3QcUv(2+oIr6LmXPwNmS~>K!;96(B
z@wa(4f@_{lMsM?M7Jfh4-2~1$nP-b|>RZ9J&Tivx^XvuJJog#B&2zu-FQU#daMsB@
z$Awcr0j_l(H2yZvDR9km+URYbGs4;KA#m2oJP!+}eimHoJZk)Hp3C5x=P9GNd7c*j
z56E*3oOLqKTx0C#<kXjfYn>I~dj4Jsu6b4&z0I>)INPlOXFbfbRyg%_;96&k@wa)l
zf@_}LMsM@%6~2Nz`@vZ!^BfRP{Rp_$x!3sH{<#la^W1OrHqSBPY<C=-bu!Nb!l|DC
z*E$ayf1BqlxaPT1M88@@UwUQX@wQC({~-Tza4r|~uMkds6}T=}t?{?{*MV#P^+s>=
zZxqgUo4{Eo^KTYT{U&g&v)%aH{I`N@{v$?j`}3&q3(8~ed%;;J^V}z#`Y~{=bHe!B
zJSV|5&x1y9^PCdScBjEvC-a;UPW>Tpt#jV^+d3D(wa%lWkE!Ky%ix-S=~Zcew(F}5
zT=lg^Z`W6y@E2iy)q^t!uCGSn)Hj1`4lTyt=FkeRIkXwQU0<7pv)wJ=tdr}jT{!hy
z!L`m2<8SjE1=l<$jNaxsDg2el^B_3uWS&#Psh<JYIu9Fvo98UJ<~e8dHqUwCY<B^i
zbu!OI;nXjIYn>~`-{!dru6b5nUARA2gR8#T=xzR+gx`StTfn(o%)eDQ^_#(Ux!R4t
z&3`Mn=D*G8ZT{WD*={d5>tz1@!l@qs*E+|Hzs-LfT=SeUdYk7V;X9G%VQ|*TJZFVd
zKM$^TE*gKE=MuQ)dBo^#o=1hV-DPmr$vlq<r~Wv&*12Z<ZJxQN*l#t@DsX=sYxArY
zeh>1j0cV}evsO6u_261(lkvBCHiK)Pn~dJ(*&>|nwt}-x=Gi8k`pw{4XTR~cc@BVU
zo?}LD^Bfoc0P;Kl&N`XrgmCH)f@_`A#^2^S1Fm@<GJ2cmVc~3d7Myi5&pF}L&x327
z$Be(t^EkNXxn}e>&)hZXIPCeu$g>2Tbu!OV;nbIdYn_$G-{x5bu6b4)z0I>mINPlS
zXPwNmPB``T;96&!@wa(y2G>0Mjo#)tAp9}pISkG^ndgXb>i2?co%@Zy&2tP~^BgyN
zo96-HY<B{jbu!OM;nW`l*E;8nzs++VT=P6xM1QJ?zWkNhe#<;7g#R=0uLS3EQC}sT
z`WkRut~%py^REZj{2Ptl=HDco?KXq6PUgQ!IQ1>yT4%TM|1}rYY>X?{YkVvpHhN#@
zW$WV%BSvreextYRcMM$D@3hf-ALc(J{7STY2%I@ke^@y6bKsi8g7LTOYY|-6*OJlO
z^>suz+dT@-I=Q}<g;ReFT<bh-{B53V;F@RUtK$06<Bclezk@uh!C5EstPxIq9k|xn
zWc+QO&ET5nCZo4`wg_jtt>CPadA13selxh%*=zi5p8epO=YFHN{c}wCEy!~moOLqK
z1H!4F1lKyJjla!v23+$zWb`)A!@}9_EI8|Ao^!&fp9j}EmyN&8^BB11dD`f0o@>JI
zMV`6l*q>P^^DGfgeHpmcSplARJsDi{tTK9=XSHy)TLaEInP;tV>g&L@&Q{}Z^K1jx
zJbR7a=Gia&LF73A&N`XruyE=}!L`nP#^3hO{otDCn9<uj$Az=q1K_Nac}@tYeiB^k
zoHhP7&pB|-bJ^%^p2vhQBG2RCtdn`35KjFnxYl{f_}e^BgKM5^MsM@Xy*fMov)vMK
z*2z3eg;QS!u65QLf176=xaQev^fu2n;m45YW^mTYJhup^ek-`v*=_u7p1t6jXTQ<g
zJO_lc-C=On$vj7dQ$Gr>bxs(6o986B<~eKhHqSZXzd)Yz;H;B*E(oW730&(uYW!`U
z%ix;lF{8J69v9AbPk^&d=D8xA`c-hPv-CA-|F?OTfoq<%MsM@16JGJ`=vxoYI+<sq
zaO#`EwaymfZ}V&g*F4*d-sZVkINRL<&N`WAyKw5af@_^4#^2^S3a)uh7`@GNQuvFJ
z=Rt7R$vmfoQ$GW)bsjeUHqTjb&2!G^ZJzVO+3o^3>tvpb!l_>Z*E(0k|24>AReZ=#
z7V#<hjl%uB6kOL!jnUinQY(BA_0)lLdAVNdg;U=IuFJd0_}lf;0<P<&)#&YdX%o(N
zH-ocIu9q#ssc#3@I){zF?dK!ln&$zdw|PzozZ-c@g0oKMc~Cg@)8Ja?VdHP}oCViB
z=ZxOwIWL^;E`YO6=D8@G`Xz9!^MvuYd9HwKo+X>o{%rFs6@DM`ECXkq%(GlL^_AdS
zXSMOSdDehyp0!4A^Q;rjcI&}eC-ZC+PJI)&*15&_+dSLBHP2zAw|R~T|5M~S3eGy2
z=U(B|?+4d9$Bn<u^8mQ!IbrlR&q?8I_aHdyWS&#Psh<YdIv0$;&2tf4^E_enzE0+|
zB76~fu7a~p>Q4%%{xrDOnY%U@9(vwd0<L+M8ojTR`IHG~yXD}lllltb)K`LQoz2GI
z=D7)6^K276zwfpgT$iiAh|hrWsXi;0D?dBtH4N^T%koihU;pGeQS1Ni1NS*^aKW`>
z(tdDXzvUC)-sdk%QlCkqw>eCM>w26q+^?_iq5m8L_w{=p=5yF^tDgt=_58hAt|Q>S
zU9bN!{Evcjy^}A4>-s$g?sKrqb=>I3Ob#cC=uZ~mr@(!kc72@&*Y%jYE@mE<*R)#!
z&gE@<PSjO`b9u?DjL)qmw>t58E_~|6hrF?fPrLE4xorj4JV%V)uP=@pqrz`MJ$u2q
zT-5IqPW>3TuHOU3-`C0hHUX~N<D}91Iyr6}6wY?1z*#5t)558r0oOVgjla!v30(7B
zF?yTls_-7<c@ms;GS5@Osb2%vI!k^t_B-9)OTjhIGNZS7mJ4UQ72vFsc~%Oiz6xCH
zY%%_CGuu%sxX;t_Hlz3X<72ek7NfVk8{D`1Q?q^b7vZDE-{<hWi(-y@!MVKT`$hja
z*5jD)`@zS>hx!A;sh<Sb+zuLUmutERp8@B%^gpQQkZ`tp7@W&X{j6~6=fQoQ_nVv-
z3_oJ{QW1UxT<bh4ob4`yYn{i0Q-1<n>pW@vf6c9OzYp+_Q^v>gHKPyxq$28bE%BN4
zv)vMK*7-c>ONCQk4z6`p7;f{dD#Gi)Sr7YdJ$O<N`gxPl+vROGddpjk-saFMoXgc_
ze5`)6aO&H^HHTjDe=+jx7fzo6@uz-RIQ668zFoUt-fOts?)Deq<KWEydenJ9INO~7
z=X#-jQaJTf;F{00;kKU~D#B;Mwaz)=Y<C`9>s$~{{Svs=xeU(zCdc#RMt`^j+m?Ge
zQAEFH^nYf?nX=c$d40Q!#-|dT%lnsDFIB=>e>FIlm--sv)YpM)|EV|J_MfIAycwKz
z{up&`63%v8z*#5tt-`6_46f^Ci{ZBaY%RjKfoq-J!r5*wxYpS(ocdvKt#efTZ$&<P
zh0|xB_*1`MIQ8S;x*iW0Zr9^v5q=Py`Fs#{P6=nb)8Nd9`WfNW9|qTaW(~LNalQy&
z0M|Mfg|poyaIN!*aO#)AwaydZIu4vP`gXJZu7R`8=RX%?#OvZSIomA(XPwlS3a7pt
zT-SSr;dZ@O72(z3tmn0;vqm`Etp#VD)Yl28z7bsWY%<)g_f1833%J(VDxB@Mfoq+c
zg;U=Su61rR{2ONdc7tnw7%=)>=U|<?r(whGdKoRk_kweIZ^L@oC!F=~2j}uqKPH^|
z32<HBNyF`WnJU7k!L`mA;cWL1xYl`CIQ8@3TIZtp58-@aNjQCuh(Gm5g;ReF+_!6w
zuZ|mT*W*eNz6#EKK94$23TL~gz?l#Ar-f6WdwuL<noo)0c0HCA;pO03XN7RKTM4dp
zRtcxR&iL5#<wkHlk8TJ5e|+5mTxC_gJ@BidqG3{^qLN~wqM?$KqG6Jul46olQjubk
zQsG2OMoCJBhKh!YiiU=TN{UKFNl#v4kzrC%kx^1n(F+R;3lod-&z`fEvu6G8hR=J=
z@SVkP|IXg~o^$TKfZ@3QPak(uXNUDe=ktX|IQyYDOJ1KBv`AjPNAlWdFWmd=le|8!
zACSEIFgzTW?w`?!Pe^?|-buJ0@3iFgxMn1;J}3Fj^>N*wH}AsvXF=*{e$kxyWw`Ip
z6>;64YZ1?^O!hhVC)YO%?(>i%c|G1-$*bo}UXQE5oX1rtbu?dO&U^{n=b;qt*O79`
z>+_3>NWM<;`uw5+&UyPX*0Ir?eKx^4pUgL#Gv5ji$ED}VHgVnO9TD$@v(Kl{XO}t0
z?S`{Y=6lSU?}PjN_lxU39E|u7-1{6h=eQ$q?{n0g`Ej`SIW4aDA#-r{^E~El-kkLp
z;OvL_MRVqt;l92r;<~<T5l_8+>&Nf@dnBJ{m~-4rIQwKi%bfWfxX)XzxUO%0#0%h@
zPmWt?&T)(2-e<8n^A&J^yjR0R|7Xa3V;!9RoPl|(H)s6@IQwC~(VY2axUX-ExUO$o
z#M|NQvmJeQm~-4tIQwM2%bfWhxUX-oxUO%1#0TKs=b$;q9fEtG!{*G7!oANixUc)9
z<TuH>Pl@aN&qRC{&g0_!|C~AdoQLzcm|rkwei`n^wIZ(bzZUV-sau~1IBteH$IXO$
zpIPS2=fb_uJgKkubp>$0ud9@NxW4oGLX|nkt%kEt=4;HEuY-p^^}1OvuIt_y@g_Le
zozEAV%{guhoP9FiYR-H++~>1HT-UuT;@xoXv&Wp{_QJi-K6B;=;NIu3xIT}VhlhUj
z{(J%MkJDADqwA77E!oduT=fiisIT{#S@3XN>N%3%d_RfzJ8~tjUK+`lMe^mAe<?5N
zyTbhU@Jg%0e3d!#HE^H*T5;Vc^$~A^bD!`&zZuT`KyQ=0&S$&i)w?43?nu60@;d(m
zl2;$JJm+o5obxtpb(kM9XMPOs^E?jseLE?6eI79t$uCNNPOe8wk^GwEH%UHKmHu&&
z8SyMQ*PYjeY;(>-4xIae`CN163*bI)h2pwDiz8kF_dZL_Ic^!;`z$wSz6$PrHd=jN
zUz*HWr`hT=-(t>u8$67w*Q0iEJ->BEybI3x;q|54oa6SuIX}$znls-I_xTwR*L56<
z_%Pi295Ls(qj2wY%$)fNxc8ZRdh)mk<LZ4#9^CIk@+Gg=sY1!Cm%+ohx?U9#ua^3H
z9;<=#czM39m%N@=8zisZ9Lcvt@*R@bemW(u-eq~7KfBGdUzf~#kJVwm*PQu&xUb`Y
z_*VNZ;-hfxH_qo6+~;{x@;aYWl2@ON<mV#!CCTf2E=yj0#qylDRddeUn$=-G^^Rm6
zc)ZMK!hN2z;C@}pk-T2lawGW?$?J8kG?K5Byk6I8BKZc%>+5fg;`(@Oj(8i~_endP
z^Tz$tC3)Qs-I7=Di{$$w`C-ZHei)Iw`l#iL@VFZ@=emzu9p)#@nV*9DKA9HR$K!0o
z7vMh6i*TRk70K&-u1a1#<BTomdG$<qsIQ(Yd7aNZ$*bpEp7T~<&Uq`eI?NZDGhYJt
zd9DyYS>Bha7T0}V8}SCX&wnG_=f6erI&ZC#SMQR%&Re(S)q5qcb^0W)J|uaqGc0-a
z5zCL_aWQJn`5&`7%#WKhKLz*onik*caS`zaxUb71+}CAA@;X1Ol2^~Djyx{l|KH<6
z@;aY+l2^~SJm;;zoby&_b(k+QXTB8f^IR^j`@b^cRdCKTpTAU_bKDv@=b!mnbLJc1
z-e;q@?uX`xx4^y6R&$Qq2KPSO&6)3ld!OA>U+<H9;eMYyE_vN=6L8;GQ<4w+rv{J5
zX>;~DBXu-CYtH;UJRFxkpIQ*teX<nsRXFFL*Znm(=b4`I&dB2n?(>i>`EXpH!#w1e
z^SE-Qj^^{snJ<9*`WA}oJ}i!S8QkZg9PaZ_DS6!wRgzb)k-Q#PtvQdYPU>jB-kkYH
zxX(kgxbBBGIFFal-`mYuzXQ&BV7}9w`EI!H&mM8@r!V6DaQ4aP?*rx>cM#4#nIAG|
zegy9GHY%?BXFTE)aPM={oa0Wxz0YZL=4avF=YqJt{#<nCmdB|+e=mmn^PLKKsITi%
z74d4Rulu|f9*#@BUh-i-^L)}EdG(G+zB7{VvOJ#;cANhR=bs*{!+ftf^Zjt2{{eB`
zCqoe*g>#>99>(C@5A;dN>wHd0UVS!_pNr&|B(L+oEP3@6%X8jV%{gytR)_i2S;_w7
z@iLzY_j%5O`@YSQ{8rD?Bl!}^m&)^t(n!8i@|)!K=PGf1ywpUz7S46&{Z*Yg=b;|X
z`C-1nocU(B&s&SQ?$5S}x5K^94s(v%3HLs`%$e_nd!Hj#pVyaBbJiKN`pl1;Gd~Fr
z<Ldp=l(??rOvGp5oF86a=FB<nJe>2x{DL|2OK_i`WpQ1{)rhabz0Xw5mg_=zTyxwE
zxc8Z9&U`l9`>d4udS6`y_xtK<$?J8hR`Tl2@G!1E-diI1F3IcbW<7Au&pvx5^U`bn
zFuu>E56<~vzTcerLAdX?A#vSrBM~2kv(F0jIcCmr$KmXg`3ZC8r{KPh)8e|{W+Ofa
z_de&%Iqm}7`&=|<ei`n4u37!>W4%)E+IpX}P6nLgGM{PAd^X(IF-Kh2F)!lzaL&))
z(Px1<$1Q}jPv(ovnJ<C+{FI98I+jPg0`7fQnseMLxc6CY&U`K0`)m|{w_InN;eOq3
zll&&hcfi>{uM3^#?57LP{+aJKXTBHi`=L)<_rpNM2jT3K*M%W-jynuzpUjV#Gd~9R
zc^((n{V*BvDY*AJZO(CL;NIt~IrEEBN3R#laKB#UygPYZhvVAn`3^kvsdb9sUZ+a(
zdVQ&uym~D>jH}n3x=6l7@_OBAgL6K49ceee73cX5IOmi3PIKnF;l4k6#C3o6MZ6!*
zK6xD(Fz2{~aQ4akkU8@saNnP!;<`V_BR&E5J}1pN?iAenoHl2E7Vdq{Tm6q<y%x+_
zXVL02zhut*3f$LmRb1CGb@rCWg?a{@^D~S-GtD_}7M%0Le6~6Bxp1GKJaJvef`}Kw
zz0V?Zj#~`(K1<A*FN1rZ)#A6x^T8UpUw7&yze%n;jpF)yc$(nhxb(c#BK6gKq>i57
zh9Y%_BXuSuujjEz$*a%6!~E#^Z8nl$mb{+dR^ePnp0C!-f4OI}U-^rkxQ@(c;1@vA
zna_gz<04yJ_kV80^Wf~0=c{~kj#~g{Kg<`JGhYn%{Z=BbkBhR1m&3i!3UiKI3HLs$
z%$cu&d!Kc1-~Wx0*ZtoNXP-R3wU~3<Ryg})zRjHZ4!Ey-r?{?rcf@<(?33rWUUQDy
z2WOwm_nR|62>1CM64!MfiTEho`y4apxZ`l|bHbeYDY*B!C_XLc!!>y5=kWCx4odOx
zO}!`iOV}ss+3-+be?MCuJk<HJ)GvaE{?%)w&iCYeTPt;bBVH$U)EgxK#_+-iJ{sYn
zfAv;)=zmfA?36ls-tLw<>LZd5!>-}HH)_sx8G~~jnIAW2ehMD?)YrA9#r1J98}T_f
z_uCP<$pp=tbKC_u`(%F6ocR^F@3&QPeO#p8n~Wdw>KSnFGt->oX2HGBY;)%G;NEAE
zxL%hl;GrK~_eyx!SL#)g*XwVM<kg$tp&z|2H%IcFlGp2UH=Ogv>uisCJ=VP!&Us_L
z&z$)Ic<592;h?zg!{LaJz}Y9Sv!mu5cMQ%xnIAW2eiH8MJ0-6BZ6@NgaPM=@oa4^J
zz0U=6=9l2!=c?7`>sM>$tdn|Q@;KtS%x9Q0p9S}I%of*m%#C;+ob&VdJ(521%{guX
zoP9E1XwG~w+~=o6T-UKI;^lDfv%;L?R>Hl{Ds$#*;NEA0_&sv{YJ&THSF7YVNxmJ<
z{`vY<hdKM{gtLF<yUdyIf%|^w71#aHAMpV=`{e6agXSD}2+ls4A2w%x6z=mpCa(Ko
zBI1*9?{mtW<4(i9&lz*(7o?6}7nb0Dy~wWHavjv`P9Z$>sdb9rUZ+gz=z3K|yjtpq
z`<6ZSN&2XP^LXiXlGpd6>m{$=DEZCxbCUW^=B>CMHA@}Mx0o~E2KW8YF0T8bGvYmP
z?gt)kFWl#$U-Ejq1Cm!ClDr<*usM%wMCxdM)SUToxX;6s)YtosX}F(%W~Gkahs;It
zE0WjykTp2xllK*=_b2O5Xa5;+&NK6w=FDfq{d|=puKPbP;`wm)!~2Q?bB<dGXP?X$
znKNGk_jM^1*Zo-@@d~*2S!vF3tKi;ewK?;(aPPCh>hr#$(VTUftUmM2=FGRkeI47x
zbsak*-U;XY@V=tUoa1)GIX}$zm^0r8_xb4;*L56>_z>Lt95&~;BXI9?)SUToxc50L
z{<7Rx%)|XWuq63Sl3y0rby<!08l1<=?{7(+6FCpSdA!VLn)7&b;C{Th;<_&R5ifvy
zpM~Zew+QZi7Mn9)2KPS8rM_O@E8%{9Z<0ECpU@Gh(;2DLD|K`o`y)Oi^*3LSaGx*?
z=REMbIVyR*4vtA)eM0hjy_+=e#C^h))Y1I3IrFn{pZ_^=-6snXUxss^@OW3?J`Zb>
z*W*o{o9zFPSI>mMQXltAS>`;hY^kI3kYmn#9^B`lQ0nV_LJ{204<%AZ?-NQR`D)4Q
zeL^jq$II(}ojLojhjX5pZ!l-R2_BADU$1Bu*Ztob@isX7<aNK@oa1)D*(dXz=FE4)
zeO-FQb$|9nydUm;4w!S?LAduhWX}8u-1{82`n>K>n6u8L)n|UnocS5Juj8z^uH$^f
z7vP*9UiTNxIqnji^TYhIIrFP<pPw~xUB`_2<UA1a>X~rwGs~RgX2ZSD9CPOL;NEAk
zcu_c^;G?uY`HP<iD&V2cCb>_j6xVgBj(826$II(}tvUOzgY$TquQzAD3GT<+EUxq4
z8u2!`_t|dFaXaANXQw&yJ#g={SL*A1LO<N^6DFjN-Y3jO>dZ&#EJ$9j3rmt$UxSDK
zb=@=0OKtve&xUh8c|Fa6bKdBAlHYE<BLDjZ`I1*Jl)PRai_Gu9eMPa<(R_(H^JQ>f
zuX1tSSCtX3f%`nv!hIg<C9lWZAbIsB$?I`7oAbC@q>koW&6#h9`#f}t>wf5tcrTpu
z@HMPUpE<|vhjV_IA24Tr2=09ji|cxgMtmIZeNLEj+)23iIc3iL4BY#ih5LDUUh;ZB
zwh+m$NnY>AGCq(zPI+9szsfXcpILAo7xUTX%;&<xaq0b7p1AIlf`}Kw*(dL>ip)7~
zF`RueUt-RD8QkZ;TwM1_WyGuC-e<Kr$E|^TpS9-9*TcQfM!4^j7Rhgt>vgNR&VPHv
zJK#JnUVl5y*=HA=$HjcNIrDvRKdydpo&Ujz55c|9VRMc<0{1>g&6%Hod!Lh1U$58G
zaKB!!Nu7_#_aS7SzxCts`#2wFnX{j4IQwTl$DH|mc<5grj|JkoABrMg4Cg#=yI0b8
zi8;qDg|koQ%gmXtg!?>KiR*r-iFhsC`>ZqPxb<-Fv%#GCX1Mp+YW4YkT$?%Tv|D}V
zJItByg8Mpli|ab}M!XNs`QiI<{pK8Z0M7Yge$brxVYtuFh`6rfSj5NS-sgll$DM?G
zpHt?{&%nLUd2zk3UWSK$^nQ2+?&sl*hUD=P>g&2>MLZYI<9+3R7|!FO7f61)^`Us5
zTqt?<V#$a5y&67#&EE_!l{%U)GiSaM?(<nCuIpYC@p`z=Lj&CBp-J+3yv>qVZ<V|r
zSDQJHt6l17zQdgPZn)3Gu=o*jT^<$JeKG;(Jn;J}C(SwT6rA(J{Iogqv+&TTUKi%X
zwV#EEFT&X;zprx1oZ~LT*(dWW=FG3beLhnk-17L+eU%yUEV%cXZO(CX;NEAhIrI5&
z@3T-`=d(ECC2;o1`>0ZLj#~z2pUjt=GhYSwKC8ubK5HXh2lqbf%{guZ-1}@aXTAmQ
zeRf)XUN^hUS*P3TGv8y*d>=fF`;qOFJr@4AUtHI5FycdS&JVAf!{!`!1kU+ke$<@#
zak$UVgt)HbRK%y@-sg-t$DM_HpL6ESFTlOe)CI}hhH>@#jWgikda7Os4|VkWkc*|x
z`ah+X@Oe4@41KECN?xzyb#T9qH^IZW@5@Mf4*%OKb#_?){A0LowwZUr+u@uy<~z)p
z?}CSMbsu(%>ptv_cpseW`vvsVZ_aTC;Ovw6L38GZ;l92j;<^vVB0diHJ}1mM?j+p%
zoHA#A2JU^PE=<-mjH}P%GT{C^E*l=|=yBynyin@zus#&;--_VupI#z)y>BU%yn2=7
zL;Y>`O^&D9ybN9=bu?dV&U`)G=dE4p>*J^c?vJA`siUu7bw~1pl7C?P<e0+$4#T-m
z_<GccIr|@lbDo(WGiQDR9*$QZca!4!xSNjn44i%P^{82MjynfupUlsjGrtJ;by*VE
z{kanHRk-)LX3lX_jmcVgpBd)NXTiPC9C#R4_fIa|_fNjm(fv~p$(Ko9_fG|!$IJat
zY0mzu;5=UDtIe6Oh5P=g6W9II5b;Jh`{aITGUvF>aQ4Z3i#hXca9@{paos<i5$}R~
zpWWshw+HTh_L?)_5BEL?t^PZ3ej74ponfob{D?X8V{l)`adBP8$%s$EIX{=6&uMdx
zI|JwZFh6U~{5;&}XF*)oaVg@<aPM=)oa3&-z0Wms<}*H&oHxAB9Pz!v1qmO8;>XGP
zzX<N<hf>LJl6<+i{yc95JRGlH_p7A7dXv=A*M-`pj^3|!NFDV7siXI?LsDnGrBwZg
zlZhCGhj~_?lDwWjr{O+7^YAeLdLO$ab;9)XzI54q8261UaIQP^tLDt7a2)<P$`IGb
zQC7sW;oP6RFU>LMxVdol$$XwU^969<pM~Q3I4X{K3EcZEHRrfxaPPC+ocT()_t_%#
zb>Fta!+ucjkUDx?T@mk-`eC2&ezhOY{^^5~*Zb8W$*Ye@KGeSz=gCp?G5DC&(fqhM
z^OJC&w>k0q<h(Ht59_FpuLZb2zLunp-k&T-@|hn=9^auKy+6r@bN}#uBgdS_l?&(m
zGoNS9d;vU+tM|8s;`(?jj(7>2ee!;z)STm%!PzJC<>t&+!hOA}#C6}+M7$R6eb$+C
z+<Lh8*<j9m6Wsf3hWkEgle}K1I^gW{Y3%b(bB@~uXP?Y>n={`F_jT_R*L5F=_#m8p
z{u_M`nRDD>IQwLN#GLstxX<UfxUTzT#HZli=d?M;oq>Cwv*ygt!@bWH@zdn>qE)!>
zhm58z=K<XhS>k%%k_`{XrRVcpxS!`srH<aWR7oAZKdF{F>Mc@7?_1iW&U#C!(u<Pg
z>4Jy(R3DJMo>vFqK0l-IFwc75G9h*JzGc$<DcrYA!MVP?Z<#h{eirVJmpO5Lyevd~
z5zc+c`;aAbj=KzJpUkhAGrtD+eVD>J1lPw)X2i4L-e<Ns$IXFzpSkAD=fl0vYN@aL
zxd!h0xnAn%aWzJ~RqE?~OB<a1^S-4+@_K*LDS7p7$%p#;?w9QU9`m=sd!>%%`^=di
zfcw0SN`38TOzNmlNdD#Zf55{cH6?lVd3YFiXSpw0kUIMKU4;ANcUkJ_ebGuJpS3BO
zzc8-e7v;dYKY5>%YtDJggL8eE&o^hj5FW<W`=TOoeY}@MycEtpd7o2e&T-4(?34Kl
zbLOkyz8|W^^>I-f@jAHoS#Qp98{pn&qdD`<aPPAP?)#)&@_HTYgR@UQPW$2PhdyX|
z-WLs-v(I6x!~BRj^J8$|C*$I}PbMQi1?O?`zG&K<<Icc&yv)y<Gd~aa`Cky%eX<ns
zWw`gbV$N|_;oj$(IrAAG-ST+9OU^TS;`@XXB|h@uzJH1&uluK5d`9laD#i8wstO*C
zcdP3W+^<KiQb+HvI;Bpyk19w1T~bHAPwMFXRln5H^X-7tQ6G|gn6?*jq8~Q@7km`X
z^<sX^ocU>Z*jKNTb(w+tx-3ZkyRyE^aPF%!_f95g#r%)xa}~}$nO`$!KBGCQ=a17&
zaebU-M?444K0kv#bImz!9-MtLpKs25A>1FQMdJE6Es1z3-1{su=eXr?@3X?3`6{^g
zSq=Afua*4UWZmoG?34H54dxuT5zaoDZ!%}T1@7zKDz59^9`O!1`{aFir#Z*%g0oNN
zyUm&Jh5LN=iR-!#M0^nLeGZv(++n!)IbzQI7~K1uwE7u%Tuhm>&a~BMe#V^nIk>Om
zytuC8V#Jr=oS!1}xopmHSKyo<=2y*`Pkn65c}A~a8REK*SrN~Md!ISx95)y4edd`n
zUjX-YEQ0&vw^;IeeJqXS%O$VtQW^0oIFI)stV^{y`>%oXc$u#?XTBcp$J-#T>(UhQ
zX1Mp+V$N|};ofJPIrANG?{ie@>wU-=-0wqXC9n4bbCOqIgoknUd0E!Q$$s|zkOvQW
zeO^{9UMcri<&ioSaL(rh*1ZbOd83a>{f|ri@ksqitG|N!^H!g}5UIZuslO`uO>$jZ
zgNNhN^~$(p%Y3RA!^3>)ePb2e>r_YT)JYxP&kYf8mipoLjnA7};GBPYo8<NNgm%fR
zcS?S9ef)ldF7t!;N#><n>S(^locTVuKVJH!zV7n@xbNo?siXUOOzMPw_`1QkIs2J_
zbKaPrG-rMq9{ShU8D_-w{5co#c{m?OeBEHdoZ~LS*(dW$=FG3aeV$jvb-$%rlJyLE
z^$fW8nQ6{(v*6xmwmI{;aPKo;>g(gK5bo#CDskOELsDOlYb4@ha2{_L_W8Iu`=5aG
zc$uFvXMP6m$GZaeeV+Pw`gO^Scn+NX{}cV^nzNsLIQwV5z?}Iaxc6TS_x`IdP2YcQ
z#OvVf|KPmj>+9WdTn%vc&wQgh@~v?1zYXsFcS~OP&tSxd;Ozf=^gnFQ`5b|>f96Nc
znIDIH|5M`H=QP}pYX;6fKaD<T%{lHIoP9FCXwLjH-1}UCdq1o2(2u@vwI+G>oKI}o
zSNeKO9z4`p|G!kjCzD(uJoK+#3ip00rM|vzRW0?y_2oqDs~U68LoJ;1#(bSQ^9}GY
zZ+d-c6xZuZbHrQVT;E3Se{+u824|nlx0^HH3HSBw64!m$6Y*ZS_t|I8ar@!k=YTo$
zLvZhN#Oi+&^D}DBI%8I!`EhgRC*i)1Q{uXgGZCMIbAEn-KIhFj?gE_i!~Bvt^DA(l
zpH*>P$5iW<$DMj6-22Qj=eXH$?=#n&`FyzdS!DJ3`ckp^1^Xv`msow~OU;=thx<BK
zi0e95MZ6l$`QhtJHRc?*7S8!$zRsNa2Dr~pqqweDbHrQV-e;>h$8CdqpY7(%cf!5T
zZgG7+)i18|JQ(pIIQxH?*I)DR!bjljpZQU9=EvdQ|Ae^C^HjvA;oj$rImexad!KXW
z%rC&b&qb-P_sL6ezYeZQoh#(|@@gcX!u2+ctFIepz`cH^<n?u`tVljv^12^#Bc2E6
zJpUN$o^Q^1D}ZyJnJ+YFz8LQFTq3Ufp)BI%aPPCioa0u)z0WFh=4;^IXN$P@*%t8*
zIQ#6xd9~C0d+;te`((b`ocUh3_t`IA7;e1qF$8BnOBi?9ob^ZG?1%YLbLJ=Dp&z{;
zn-tf5I34jBIQuMkeR2S^<{Wnp&OVu+H)nnc?(?=RuIsxR@in;jnfg@HFP-CNz`f5*
zbLMm4-e;b;_E`||LOA<*FXpqzoZ}Y5*(dWQ=FFGDz0V49Jzv$sLqGbya05J?_te{@
zjy`|smO5dZx8b;Y%x{MG!g*ZG_n9+40QdboD6ac?IN~F4&i@1GXVjeIj=|X{^W)~s
zPr`lvr^I!i%tU+^?tRXgbKH5j_qkxs{1V*z%)Kmmyad;Mk{|KHh!;n^G~(qEuZ(zg
z#A_p7AMwVBH%GiR;_VUdjCgm%dn4W-@hLd>$vF1&wE1u0GjQ$`=4Z{BpNIS7Zb4ih
zcS{jphO^HX(a(xG$6bZ9Pv+Omna^n3vTybM&`fcC++{~R2kw35nseMdxc8ZF&U_)<
zA9r=)O>)25EdF`%8F9@oh-<#-(_7|8^Bv-v?-xH--v1gD*L5F(bKbbGM$K~$NctFq
zbKaOAH)nnl?)z{`T>F`c_$-`#a$n7vbKH42`(%E>ocSfVukW(B?!(oHufe^~)aA+i
z(K&7g-22QlXFeP5eddWjF6&+Z=eQ+U$3k<~FM_il=8MglFNOR1mWk{7Rz$p7T>Gzq
zv;TLa|5|hQQx9kV%r}@b-wgNpY!TOWZ;N=Rxc1)#_x`)h*-tOr`|mSnei$D5*KtR!
zehDAH=BzVr^_ibAXMPIq>pm^6>pmOt1##_v5$^N0WX^t8;687w=FDeYvE{tF)pbW)
z*F8JpdE(lCKHU2+FlRqSaPPm^ocS`i@7oG-o&TzcSHs!orPwDm<{Y;c&OVv1GiSaL
z?tM0i>pZtaycO<!wwZI>cDVQ1Va|Lv-1}S-*XwUa`<DHq*WY~cC*-<cD6Z>L0_Sn@
zdRl6JBi5x1&f{Xf+?@GJxIa#-#I>KAh}Xi|C$Fb<<{Y;k&OVuMFlW9A?(^R)uKT1l
z;%#v6v)!EIcEG*QPIKnF;ofJjxXx#P#D~Q7yfF-C|Ga*Un6sZTIQwUQ+?@F-xc5IT
zuJb$_@da`1e-ZBeFPXES6}b1mYR-J-XHuI#LjO9?*%8kZ*FN*%-e-Y1$1Q?;pT*|P
zm%)9W%f)q`D<fVbuKm}-z5hCM_R|3O{u|AiZ-IONZQ?rr9TD$@vrk?xy39FlH=KPk
z-(${vKivBq5Z8Ggiuf?x`y4UnxTA3IbIhFiNx1j9EcNyK4OZZM9j`Rm_NnYEx9op?
z9j`?EFnPVY2F~Le;r+AuQ}8-CkBj+wbLJc2;kfkm>LzjBCoK_gg|p8E^wVa}aogeS
zllcyF=DXlN|J~xcPkJNX2lqbv%{lG>-1{6fXMPy&eU4gvuFIG?>x^4{<|oXVpMv{3
zPK)b0&PIF=?(;Km&T$vuK0k}*%rC=zepbYF9oHhB`fTzz@;)=nIc_H0`^++DJ_qi7
z=85a;w3QLBj(C^2-k0`Ad_-LDS7#z#)v@I~qxI{=wN96~=KI7oUwKuezPRQG#I^o}
zxaLQ$-cn!p!&t<};oJ`|9guweg!x_tiBH10ADEvqXMP6m`(Z&``&^3nGMs&$fPPlY
zIqoW)eKNmh&V1(Qw#=J8FD??--@8=;XFrYTr_`MF%i!#X`EqmStKfcKsutJtQf<WR
z;Ow&peb$?E+y*%NWWLdy`4+gZZ>zYjZ+pZ$;NEAaImhjSd!OCr%=f{)&tdUfw@>y!
z_}@|S8^l+|^|(@<TlSB7wz%HM=E8Zr*>6a`KF|EQLlZB6^LUvrG-tjP?#J68uE*6R
zesM-JX87M0ah;zwIQzfl;N)xC&Dl=}oc%N3Y0i8%-1mQvxbFYHi1)+U=Tqo&z?|a_
z!r3SDL*~qnz<r)a#dSZ7M|=YAeNLKl+$p&CIc?7TEZqBC62DgWIh_4md|<M^Yv$V=
zmU!x#<WJ@&i;~YX;p~%jvdmd0$DDQY;Gut=&w_}Ti0k9749-5;Pq{hgtrG72SD7<k
z3-@_$6xYXHtGNFD#tv~^mtOJ9<Z(J6uJbb#@iB3opLub;4(48)tY<hb?Y}}?$E}KZ
zow$zMDz4*Bh->|+h)=`0zPvw~G5<EMgR^k1FY|Ne%rC%weOJV_&$WoBuG{+Y!uyj9
zbB>z{XP?YxnKPdY_dZL+^?s&NT-Uc*T(1iQ@G#H%b3=ph@cdnUT<YljOh$ZGT=&U5
zoa?)QbzCri8NLMPyfMFQ&ioqO=Pjpe%X)3M{@3C4;|m|T@K9g9Sn^rxkJG)9c&beD
z>NW5%t{!irc>j7Gel&~ge6~isQ(WtJ!8xC&;XL1M&iUzub3U2xGiQDf?(;b&exn@M
zjJO`xV#KqqPi7?4*L_<ouD=(hOkC?%M7%~^=dBLTdE<4Y-kkH$2<N;p-(=2wE8OR;
zO<eo$h<GQQecp)m?K0=M-Ej8Fe2+Qv{c!JdK<evxU<mH#hZ(7(-<Q53uE)C;@vIxR
z><3-1960BJ=Yd@FA<R!cob$kZfjRTVaG!@>aowN&;(A=e5g(2Cq_`gMG@QrF{WfFH
z{^#I4Ugqb`nO}nY@h*$&ajiyt4bDEf-%_7X){)L}GvMr#`Al=>bKu@*xp<qLe`>_v
zzCF*jsZ^b~9#@OF{vOLVam^1$d^F;d;<~<5aL&&Uv2Ul%w>u~~hB-Lrjrn<V=9l3<
zZyDWNuS+%RXPUE4miZfy&xW%f*2ytvom_L)DT9YTb)G9CUL&sa*(|R2pB>^_zboQ>
z;#y}B9@b0W?^uHS`yFdiN8j(ry)l{paJ(<e{w#oVKfIwR$rYNv3SI=~{4-x{&U`66
zjH~Z=l!^aU`l*O`C7gX;fPSjXIc_zaeKKET&U_u*_ieqnu47}wo8aDOvpL6YfqS2=
z=FGRlz0Xc@eVx1??)zr|?)zs%>gfKNkUBf8Z;{6^|C8e3=aq7k?UR~;^SGFw71#VS
zJRH|evLDu@ei-)!oCi`jB?EDuzXH#Ib6n;#&6&@J`~J)k*Zr9n@q9S@*%Pl96_|6}
zLOA<mzQ~;U61cB>skrXX@`zW!z0XQ>j#~xyKC8`{uZ4S`4Oai!!esp#&AHE;tUmM2
z=FGRkeI47xbsak*-U;XY+>JiF%sFm1ob$tck2&*waG#%kab3s3h!4TN&tY?pI|BDU
zN6ncZhkKusR{vr=?xxJSAEvE7^E2km&%u2i=f!m$7bCs|=lqPL&t-Fty8`F@Fu!Wf
zeCp<8|N8u7i0e9LMLZksedd^R++4W#nP<*?0o?m67hjP3*eW>tIR@vkYID}FfwLdx
zYt5Ojhx__Ai0k?`MZ6i#J}*R{E#@4z70y1HZ!>4U1Mc(IDX#0=9q}Hx_t|UCar@xj
zXTLe~gK+P2Sp0{wzH@N)!}IFA`4@40Ux2e8<`>PGUxxeou88aUu0=f6v-S0z=hX~z
zj++T*pUh{OGoJ(ZdCL{o_05lX0i5&6aSP2kZV}x3EH-Dp6z+YNS$&>Y%gwn@Dy%;9
zmFCP>!+jlV#C09(B3=*Y{P4WmV9s$H;hZ1lo6MPSf&2Wlit9SIN4x{>eRi62+%CBH
z*=^2zFWmc_5!d;gi}(VZeJ<j>w`e{BUxKqw=9kTxUxj<0YvMYe8Mkb?4ytFtz0YiO
zj++DbK6A~P&xd=TW#an&SEIPT|J5eGw><CY64&ob?}78U_<nS+Is5E`^SGGrH)nnj
z9*#?&FAs_9J{gJlD4c!r{pc}sjyn!#pUh8~Gd~6Q`JWco{V*HxIk@*ZZ_aTS;NIt=
zIrGbK?=$1pE&EpYNwK)@lL~R&CpF@_PwK_*k$u%8uFum4#V?TS^{}|+7vW*v^mXzj
zxW7)GciWcZJyYrziR->9i+Gi|z7AFc=Q{Fr?^^TWLy|t~;ao@N8_bz+hWk3Ui0gi9
zi+Go~_TK~d{(H^YPe0uIA24Tr81DT~N&WCX;K=%VhL35fqn_8B{5$*P`6S<*;}*c#
zC-a5o%ooE$pL+f&5#MT`M7$i%K6yT=Fz2|HaQ4Z3l{xb@aG%dwaorE~5pRHdpN-}m
zw+ZfjHk&iwW_5mw{oiiRe23LxzSErfZn&>kkGQT^U&Q<2oQE~^IbhCl2jQFt=7-Fg
zAA$RNjf(4fjYoU}?tM<0bKEJo_c?9O{4Cu2oR|7~zFma-`8NCZtskewn9m&Z<KVe)
z_Q`ynIr9bZ(5J3%k<~9aH0h(*oX1;Y^_ed>XTB2d^HU|R>sS-<Iyl#n<JOyV+y*%3
zhxul6=3C+3XPdarTSvsZ;Oz5s%xAYb$L)o)Pv-l~nIC|ApM&B$pTiL!g?pc4<{Wnd
z?tM<0Gd~UYKIg@CK9|LBko%uiam|<Bk?hk@U-MPsM@XG&ajjDu@kVjI?l;3ZZ+!o{
z#hmld2Issn-)_!)7u@HqTU^(-H{yfh+W#=z`yVl9KVxw3f83n;DY*APD}J`zPcB4!
zRs2@Tr@pXd-E|!^Bc284@!oh~^7Yx~>^}$2<7GbAocRK{A8(<!u2*ryOW@vTsX50j
zgL|Ll=FC^Yz0X>4ozDhw{XUr?IQu*q?{^HF7r;m0?34LXbLPk4p-;V^oDkPOry@QL
zXP+NJKQrbWcNWe*nV&OfegW?DxhSsdz8vutxc9kg&T-e^-e;;W+1GUDv*4`H`}u5h
z=5wqL^SS2C=fi!y3dD82iXvVNXP>;EFEQu1rEnfE^JV7DSHOL}D#dlZsv}+l_daXQ
zIc^=?`>Z!-z7g(ywn=^czK(Xdzc1e{b@YAtX{ocr`j+AA^E2k`XBN)>nV&OfegW?L
zVNqQ7!*aw|;GAc^PQGf+ao6DNllj!0=^q!FaG&QaaorC&5zmEtpLyo&Gav4K7ML?%
z1ou9B#r1WbK{)&2<9EpXn>=sB*$?w0=FE@5eSOEpb$urzJ_To=eEd$EbKDs?`(%FB
zocVdU&)b5yuJ2OBm*L*$iaEz!g?pcC=FDf@mF!RNvk)G})#r~zaDV<-Cw27ox<;uJ
z9`D6?{@7&B=ZVd5_RoBaIrD8+=Oyf`cJp7sJFO1$UFOX9z<s~<itB#skN6;*>-bj8
z!;m@09forrm>)A|egf|6I4Q3CZ93w!aPM=@oa4^Jz0W0c=2zg}XX=Z|KIFJO4`i6L
zP9~h=GM{D6d=A{#F;`sIF+bu3aQ4abK%qIuErPR8=8MglFNOR3l!@y)Rz$oK?tNC7
zbKGjU_gQ1kd>!2TY!yEuJmB%s8SyT0o&TPQ4~XmY${{$9m#@zco3sB>IFFb4F>~f8
z;eNbR;<_#~5nmA3{+Hn1|FSvzS%rK5Yv#;n_9qMB{g=Wy?xi>{m6@|nIh^A%Ut!LC
z6+Dcq&!?)zb=_+tUI%BNJ?OLEoZ~jY*(dXj=FB(4eSTWRb$#0+-VXOZJIpz5C*1q&
zGH1RA?tS)&>wM0LPs{5VtKv6opL*qEO<e0_+?_<ixav9Lx}WploCm({lyA=CDui<$
zm@hJCz7+2BP$sVHRT1$TaqYhj?)}%Bv!6z|_upjBd@J1hZxh#f?ud9NoPFMSV6skK
z<{Y;h&OVv%F=xIX?tKo3>pTxdd>HP1j+k@YQMmUxX3qR1-20r8`g$Kb1NZybRjH$|
zJLP{Vnb**Ncz<(r{m<}G01thtSHVL+`hI<L#5=_Gef$A&ef+M7>*F``%Sm5hTz&mH
zPh8ilAmSzB`nV{Aa~-e3`wQjf55OzoTu0`s%$cu)`#MgD>wL~fd_`R6Gkajm{OIet
zCE_}tmEt;|4dObVO%ZPs*ZJ&#`+RnqPw{;mxX)*gIr9T>pU)+6?SCcWt8n)D?l&a!
zxMuz)c<P?y-`OYg8RpDq!M)EMILGCEey%y|<XL^@^UawrgoknU{-j7;&%-4VFNL#D
z-shK@bKG(`=ZE<UbLOkyK0npsx{kFGuY-G^_2wM60q%V^nls-F_dff@_3=9v@o8~=
z{HE^R^7z%qX@108#J76fiR*tyxChSp`55+dKb-SGABfZ$kviM0w>-YSzrx3;)KQ;~
z)LE1|JFI^_$6XQ+b>>lj1@3*WifcaizR=bBf7f>X>vf(>#C6^(#C6{4Bi<45J~-!j
zCw%|*Ae{Zvhaz<r#dZHLM|=g&aZfxfIsR4i0{9x7{V<;zOumlJd^X(oe;(Y&%{M<6
z;}%$bj$3HXd<i^^tLL#&aXpWfN4x^=eO8)Zg+8m`oCo$<ZO(ih+~=oWT-UKN;!SYx
zv)P>Ew!pp5R&(Y%;NEAK)DJ%on4fHeRFBkAACP=_{BnK<&A)>A9FjVkA2w%x9PaBr
zA+GB_74d1f&*zN!Ec%><`+UxsGrt7)`CJy)bzhD68r=I#eI;24I>*g`d!L!+%;&<r
z&r<PsWMI+P|EPe6ao7JZ)r-%o@MjoTy;bUbZ~HBE+N92J#5<&p`jFJoc^irNnA8vZ
zs`ZFu>~Zr`;1h7p8}pOq%+J7m-sYsfJ}%~^j{1_+8IgI;xIgJP)Ys$9ig-4h`+@!E
znCIhobK!oxdFIR)!u@!QrT&YujwSH$d{ezf>MY9f){E=$HbuM{?#J6=ehZGb74FB|
zX3l&k+>f_MT>I>Udq4f=kD{Lexc4(?&in}6`xz5|b=c_mm=oV5>ymmP3HZLsjCdBD
z$F=?8$=7F_^L`))&f{V}*PQu6xF1)E)n}bjbKVb>S$*cq&6%%)hjI1(p;}z8BefB)
zgZuo{oAWx`0QdQ6G-tjA?(@?suKTb(;vI1Bv(ud8cEP>RZgb}Q;NIte)YtRgkknBh
zmpYHjzFm?!VViS(m(6*fup;#}ziQ5W=FpbMh3<zeaorC&5zmGDJm;D7`kN2;c`h(#
zz69>`Tq>^np*-RhaPPCyoa0u(z0YcM=Ii0!XQ#OK*&Xp7IQu*h=bv74o=^JV?34L^
zbLNNP-shOrXPt3#o=+yMKJ%02%+J8XxVqnF#dW{UM|=V9^RsBq$LSK>=V#fR`8BxD
zPwK%fj~89X%!p^f*(d8~n{(cB;Ovw6Tyy3NrH-CYiY2dJ2@l7m_g!`3dfjXgf4khb
zG>Pjxv_!lW&Us+}ZRS1L=k0LL1M?l`%=f~5z51;_>kOE`1LF=_eddSEnIDDwejXFo
z{X7xzNx09?l=;Qza~kgRGh@#DJlyAJL0s2yDdNj;_R0Dy=A5@xIQwLN&7AqnhqgSv
z^!H7biEEz~5wC=^&+)^Px>e={hb3MOXP?a1m^0r1_xWtL`mEDp&hufb)n~rVocT_;
z@3$^--ETb+?}hvP^qKSg(+~Ig88Byl81C~kBChK=7V&X7`(*tIbI#i&oP9DsWzPJZ
z)Y0?gg5=fL;NiIR{F(FcmVK+ol^5}RIFF0{6qrAIcv80z&f{Xf$ej5yxX*vJ)n}a=
zbDrO7tv>U0=FB(3eSbEI>;7zscq`oJr_G$_lXkezPlq}4-Eg0u9&ugAzKHk3*(d7{
zm~-9+;p~(7A#>(O;oj%0xb`_8@dY^hWc@|+{3DY6wghLN%rBcWzXta{Q^QHUFs{BH
zk_q?MNpj(#j=oM(Ag=c(nMwInsGq<7|D8J~kOdF@tLMN&{Xu!2)ePTe-PivwRefRt
zt>)wKQStCR>z~;PjGO-pK5716__X=9uSsCmd<Xcv`K#fJ<_E%;Bfc8(%?H2!Z($z7
zaqWgWnPF1aKj?eHv(5K`=bG;a4{M=yF5fTtywLnsc(M7z@KW=i!pqH<;Fab(<tO7-
zn-{=q&CB8S=I@0!ntu}BY<?5G)%<>VyZLwFo#ylKZu5V^d(Ct9Pi_9_H$NOcXns0;
z-24-7Na{?QUj?5wzY9KV{s4U5d;-2`J`G<s{}X)G{O|Cj+x6E?*8e?3cszV66a1+4
zH%j?A&l}7aZ<|!W!*z3=63ORc0OtFV&l7)><O{?@KiT0;+VzjZ<d4nukCuF~c*wUS
zUm|{t<jcfEei`|4@lwfGiidnXCZbCGSjpFjhdjSmsaE_r$=8dAd^yg!4dQQ>e3N*{
z4<p|!UMBfg@sQ6CC$065w&ah^^Lf1FJH$i28~IN0w@AKQJmgcjzTnpmZLWWU<niM{
zn?2;4k?#**yZ#aONx9?)6MiK>kNlAMTO~gt9_m+TCNL^~qU6WLLw+3j3Guf{eo8##
zi+4(3TD(H?v*ID&kNlkYNs?a>5Bcn!6Ic{KS@O%`A>WStiufs#UlR}cW#l(M_}4!V
z^Is|X%n*Wyzt+EM^QWmS@wZDpM?Cy>8u?uDQzf4-9{yUMmDDc~KTYyQ;^D8u$QO%O
zNxoD({55}<q<)$B>5{Jy4}a}OzEb=hlCKuu{MT0}^=rh>kbIqZ_-ixr_2Si%Zxj!I
zokzY&{GF0-5f6W@-Zkl`Rs2lJw~L3rjw9b8ewO6B#KT{Uvy=MW;x&@*6%T*yN4`(|
zU6LOV4}Z<ZebJ!!yCpv?9{$>nJbxcg*w1H6e$4XA$d8NHN`6v2{I&kI>;JR<F(v*U
z$<K&~zfL1REB;=|&x?n@mhTp-r&0^z@00wJc=+ou^2_3Nl3x`Mf6dPc)l;c8@%KwU
z1J`F>ue*`Y6hBAu+2Wf^?w-`o5kFV*dEz18jC{U$z2pnULw+9lBJuMiUm_mz)q5oU
zl!|{q^5x<oKaPBb`1z8r5)b*}J(K#?;ti6o6%YA-<m<#gDES8Qkk8Id>NkpCAo*tT
zkncdgMf^g^w~2@R3i9pZjgs#a5BY|@l770xKP34c@sOWIzE}LilJ6G}`HH=h`UB!0
zk^GQ&$d4dDEZ!vfQSp#3+$X6&CVr9RC&WX(7x_u?O_HA$5Bbczr2dTfM<qWe9`dco
z&x<!peo;K+7m;5Q|Cr=g#6!OJbxA*~;ulLkwf^_;!N>a~@)_cnNIpwE)Gyt4^OwJJ
zpC0P8NIuu{gUIKJe_Zkf;-P*no}U(qUn==x@sRICK0F5rAEBR5NIu*f(?foh&x^%d
zB_HmEG~bw?d>-yG!bhn8Ny&$6A3fBc&ENcKDqK^-N63Fl^5I-Z5BbXdlh4CBBz%PY
zWs(njn;!C`$cH^cZ<BmD7JA4RzCQUpWWq<N|7pp0h=+VH@}1(BOTJq?<g*V5Ra2=R
z@hc?XCm!-`$oGr4OMXy1<QI`2690_kN5n(Eu3-It);~tYuax|_c*sv7KOz2E$xn%g
zeA$7a`ucTVJj`K6!l_yDkmrA=W={Mn$uEe9eBMDxp+)hlCBG~l@?FTUh<{G<YvLiF
zIykA%hQodcYt8;M@t5Es--LXY_%)Kx5fAw}<a5QZm3+Q<$X696{S=5_C;1}rkRL_9
zSiDQ}rQ#u9bVyRaO#FJuSBQsvFY=Y*H%Pu(Jmj+uP3qT(e_rx+;vwILe7$&hOySd1
zqj<<KA>Sl^qvTt}L%t5L^R$ZJB>8snke@=nL;PmR^LJcuKa>@%f6@9!x8%cPAD^ar
z#Y6pJ<om>Lk^F#o$n*WgLGfE9KP(>d-FUx}?>&V+Z<G9(<x_b7Xk5Hk@{{7Belzk@
z;<rnFMm*%_ke?O5L-O<DAzypM`v0tdEQo(W@=M|&KZ*RZcsR%6)6}YX$d?v}>g)Ia
z;&)0u1Ft7>eFu@x6u(RI+2Wyo-WxZUPvwYzQSy1>A>WC7zIeD6u>V5wkY7c<Nc?We
zmxzaa<B>@}rQ%<be7ShY&mmtS{$<HmiHCgEQAz!3@d3%#iii9d@^#|(NWMWl<cmv^
z`i<iEO1@b<<ol3s5x-CJZQ>zc@usAHyLh<fa{fETLw*GLF7dBOzDGRd>yJ+A_ln;y
z`F`<`pGJN_`~k@iiHCg4F-d*C4jT4txHn+`qn2MleoXv9$xn!f`Zc9V{YmkMBtI=4
z@)O9<h(9d(Iq{G$IX0<3FFq{!Me&dyKz>R5tCC+45BbXDlKQLSUz2<aukZ5lK978c
z_}3+$B_8V6yg8|#EgtT{IRClgAwPk9p7=K;Umzax#brtTLh)}(zF0iu`;jjZe?;<S
z;vt`Xd{Vz$Jlrd?|4Q+YZ%4jL{9BT*5fAxg<ZH$MNAmUJAz%NNq@M=yM<w4R9`e)3
zH;a!+zEwQrSCDTL|6j>>h=+XL2}wVl;@_4$-yh)qnMS@x@{dWrPdwBwD^Ke8i-&u1
z&i|lz$PXbuB>uSMN5n%u@2yGwQSt9ceq21{hfhrM6XM^M{FHde=f5q<Pm71=4(xwc
zd~-i7Nq$a!J<R-q`g*jWHOViEZ!7uaUz7Kpuft=U7XA$HM}LmR*FVSG8=IYf_xwST
zI-l5}4qk?TrBoP~=jvB*{V&0Jjtb5mf``B3<(BYIn?Hh|Amgf!OP^i`mqErik9)b~
z`46G~W#V4v6bA8U$R96x{&Vmwaj#RypwxLja$IL_Q0Kxlb-pBd{&VQ(d2#ROQU;|T
zUi<W)LY=2JsB@Ku*Z&^!heVERckJQtCEibOnmRAYxcui(|C{1oXOKbs8S-zHJpVa3
zpQ8oyI-?BY&&}gTj_be;j_U_$>f9XZCx3%F&!nltdoBH^(B~hez8}|LG`#-zkpGqB
z`Om?>E63|~{>32v4EZX_^Pht^i+i2$eM$Ne@`p*D{}%jo>C@{RmZlExby*|)8R{Ic
zL7n5%)Zue>uXF4Mb>5z)&U+)rwao@~-j$|KNu*Bc26Y<J)Ok$uJhm`DM{ckWFHTeE
zsYpL}i2Hh7o~F*Bk$(Ol?scwBQ)f5H>v5Hdd!5_T)HzM^TIVer9M@2qI!%(-I^U7{
z-p}J{>Krb4t;5%df_a^vq^Wadq@SOPd!65<sk4LZ6Yb|<>C@}{Elr)TNnY#xY=eII
z{-x&kkJQ;!`t*KYh4)3Y&Q*~*+iy^3?=*GxjMRB<gX20ZO`UyZT<!DQ8`ODAnmV6~
z^s_AP^K(X;I(tZ7`?-08e(KZI`F5mExw!Xpahf`O?TfvHKf`(KHyiZxnKX4iCgZYJ
zsB_W=bv~b_PLJfZ&cWh-TwhL8=PQ!eIxmTPosl$kej<6T^9ea#ufz92HJ_5aI$tvn
z=5_c!sOImC^mCN#bFcHeG{?o)c33<78P@Azsqb}OOjGBBl4q?@=X^O{ue0m=b3FYB
z`QJtAJhwre{nOOBMe-aY)W1gD`#B~}oi531op*|Ro$$R@`Vq#xJ#t)p4L{_)&im8U
zxn9QQ7@<C2D@#`=y!WghA>SLRv(pCqC%gxvAEC}0B6Yqc?#C5g>(`G^=RwKy-+~v3
zd!6u_tbT<2YovevTkw}QsKfU=HP6><Y2nXM=adcVd_PS;Ka)Ibg*tB%_v89?nmXN*
z*E;)%d!4_esk38bes<lU4&U$8aepXz^$&}CKRNao2=l=AR#+qa8T{D|>iBcxkpF<>
zSt~f-qY38yyfsZf7e(rPT-@utD@~oxN?!Z<r)0g(hvnbG*M$D3B6SXxb@V!yr>S#l
zq|P5D>vi;Ag#A1jsWU6?b?%WdSmzlt`k~@pNAJ~`=X*WjbAE(*`}ziT=H=hQ*M$6D
z(!bW}maO-)BLBuZzl+rQiMZF<UjB`Bes4y<K-}x(%D*vxt{MFVaj$cT{2TMf*|E~A
zB<pqb9+dek*|)*MN0|R#OMS0XBV#asP^8YPWWA2wi?Gf~k`ER>LO(}KeXnz|eND)}
z){J$2A?|hj8WZaLUglwQGw5ej-0S$gPN?&J8CUCkVS_q+zfkk%NnZUzaqnlu#t!}P
zy?fROe+I9Xtk>cDh5VY3|ET2EAK0LuU)$G&I^U4I*7=-dy`R6yzlE;}bq<kzqIHHP
z>vdk1e`6iK*Tx$31<87y-E8d8&*vk@H6-qJ3e(iNTgGKiq5j+kb;{G!c}=9wSH-=b
zGt<=J_tLNz&d*^R)ZzPl{F>1J)sk2L>juYlO`3kLmAuwDQtJD0-IJ!yry_Np5cfLY
zOjGCYlGlE6Ht6TcG<EXKLai`w8RFj0)ADc39~tTA0LgltXXW2m$FGg_`=q|t`EQy!
z=Sn`*2p{3NG9~MEUcF<I<Nt>I9WtNle-igPhoq^KFL|x=w7AzPPgCcy$Z>sRgF1C-
z>Kr9`?dL1v-p^%e>ik{uT4z}L^g1`Csq^MYo!@Ry=iW4Rj+eal^Q5@<^Zhh+iX^Xf
zE|osL&M(r`*+ur7*3oN=*ZEtTI;TYX$(H(FX9ofX4*U5(kve}C=a+4MysUri-UO-h
z519u&uG_@<Wvp`qLF#NP{cD~64eFenrjFl(gj!+Toj0gcpQg?uG7s9%j5xoH$8{M2
zUl9C%WL&M&zd@bb($x87q)yugbskMq=TgaQKNpMh%XnPBB*=07L-JbZKIxNR#yZat
zq|Qx|I(l!yFJqk@@pGU$u0Qt;{}%H4`#`+TfobX-6zOMrgX1bqQ|CXD*FJwK^}U}n
z($slf<Z<!N4eGovO`U>BooA#^@8_dw>Xb-ckL!pH`e{p3=f{ycWgFDFIZd7OB6V6e
zsB?dsI=4t(k8201@AEUBrp|tn*E(Mm_d3s{sq?i+KW`WJIxA`F{7UlLkN#d$uamVi
zlgXdqakME?=aCJLs~}CCJtF&1pM!coC28vH9I5lV4f;7bO`TfF^Qgn|o+`)d{hX7g
zj=y#iYK1xlQs3)*B2At5N?!XpeS>~_($v{KQs;Xc)EP-r=L*SdKSzuEas4_?9bGQX
z2gi?%rtss<o98V!e%v9Ii-E&@20sy>=bN96&kM~j!sqyQ{8#E<2`{xgzn`ky{6TzP
zY5rY&UTyvhd|qq*0zR)df6e;wg^$MMk5~HS_vbX5pNxE~`ML0RbN(EAr#XKvz1zGW
zbvPfK|3~2cmj4la(EN|^Ve{?re&VS4LGW?&a`>eA`{2{&e7}3v{By|9o8JjvH2*q$
z+5AcPs`+o>n}6tQ{ogomFTgV~AM{t@{hDlZzQ37kel+s==2h@Q^AEs_&BM=jhL2M7
z@H1WEquf0FEJygLH0RF;R-69_`C4=SoL;^8D)Noy**MoUoAbFD_ciCU68Uz^pAYXe
z=RI_{IqwO2%^yUaesjKdGic6h@US_*hjr9E6X))6bKYA_nxBCDw0S*z)|}tVGH=e;
zlNZhTJ)_I!{NC18^H<&r!G7nuyoi1>&H3Dzzh5onL&>7IZr*OGVLT6JouBjfLWt+D
ze?d0t=4K{e7xLIr3E+Q&Bf435ZQ6F-4_g0!e(?LUgC8P};ZyWJd;zax!4H-^e$4)r
z{A0);gg-<64U)%?5x$b2M-D#@@rwTm{tl@V`sDYizRR5FuSWBK;`3|Fzf_yRP3AkH
z*SpML4Zq)<*R^k&7a;!~^FoaKWAmfobLQv5pEbV>&g0{HT?gL|<I|t0NeYDD>lZ%g
z`{DCE^S$u-0p|OoKCj!XQ;6JgmOlcYpJHB)&-wdsSf{)y>F+$tzl2S_$^1cVsLRYB
zKRv0_X@2DyiQi&=4g5>y-^T`g*!(u+`Fms7|2bzR^?zXbo8dfPG5;0#|5<(;tk;V9
z&hTw9AFQ(*oaYJpf$)7TUji>OzYKny`Bm^r^Sj{hHh%!l-&?|dxDR>%Lci|a$-K2&
zoqOOnn4gau;y&|N9;fDw$n*DpaNHL76P9m>^ZV48AA<kh@~2|oE}I{Z&;M(lfyYr6
zPU5Ve4S${a8Q5>fn!geI<1OZ;=qLP6u<*h9JimqC^`w3h>YQWF$94GKESl$ic=(+g
z>c`+XuQU%o+ZH~;&&Y=l_VcsTlF!4>K8FwbEIj-SsrsMcyf0(^B{;udiM}i5;c2T=
z2>(BGeqa4x%}>Mp{L8!=z6b7`I4<XBUvqxHJ-;V}`46EEpL^1Io;=a&@b^reW&Swo
zyw{xfVSKHF^)Er5_lfie;Czpg{z>?)R{sm|FPUEnf5@Ek$@h9#pWkoK`%OB}<G-*v
z2V=kSJrw4DfpPz0dG7xg&3}V@9q!{;XHV4spgEuSea!s7sPk#_?NH}h^DH>uQ{cEf
zkMsVN{%6$ZYn$}&v%%qmKNCUc`G@bt&`-j+|F(X94d?gNG5;4h-=C+4pE(a7{N55e
z>%RpzpmcuU_^IZ6e)@6q%Q0@d`9<*S%-;{c$-D-Bm-)@`d(F8|zGi+k^4~ST4*s0^
z)9_VuUT?O;eLm;s8_4f$&hG;+Hs|@Y)SUNA73OcpdR3c;-z675_&zH8`3Stx^5J(6
zg^w2VtKnCfm%*<$=j#JEoAdg2yZPa$({Ik}>rc#iecA@kn|NH`$Ms?-^Z!Nt-OXp<
z`<wInc$hi&&#~supbp>PV?R6Ld~~Mev)~^#e+~Rn^D_=k*5yj`Q*sjjy!i_!CH@6-
zUWe{8=l=h?`BC{voyW}oP@MR*`BRvOXUxOTRELj6^KEdv&zt`S`Tv;n_aE(q_YFAD
zFCo8=`TMaS4lv&x;~ruDI{2H-4~JKp^S!rfa~{_R%-@NAK5Tvz>R)Qk^}5oW?>XII
z{zKHc!~9r`d#`yp{OjiYo`Xlt`LiG2H@_d_&X_YlXU^BV7R~vyYJ6Xa>w7ior|>#G
z{dzdx|DoRq&$T@7Z}>hB^Sr+~+VZWabAmbF+c?d<2KlqidEa)vInPU<Ha`b-t}*A&
zu6#A(|6|Vku_w$gLH%dV`F+dJn|~Ae|CqDSeO{G3zB!)<VP73!&i9g!Fke9ZH=Cc0
z^WG`u?}wjd{vr77=C3;~>F;iH-lsii&eu7=W&Tg}`8{*4<4?^0jr_08`MqM#niu1~
z?FI8=;oD?wJ<r_dyO{s`)Fii;`D;&0{6O>H;C%i@^OFjb{E6m#@9=bUes6k>`K!?X
zx#oN?^8)j?B7c!NUl;ngIp_Z~=DhE}-kjf?e!KaVxDUU_{CoMyJUn9lH_Y?n=FRB;
zN9Oz<tY^&mv+IlIJpaF7ekJN}yGzm+A9vTlcQxmG`FZB|B7cba*WgE+KLLN6Ie%uL
z+Wc3@zu$Zw{$cY!!argDJiNo4-?MU~`A)bmzssDzli~sMhj3o|mif!@@0&l0$LG(@
zpM?Lx{Au{}=6w9WZ2n*5cX{>J>$@lR!9M2s@I%bs06)h36!=NzkKyyP%%8yL=b1l^
z&p&GZFMR%K^Xy%d<GIef7Jj?=h4A~#KLh`U`8VO;H6Mfj#Qe{2{+@L{j@ICRwfukZ
z`?%K3?>r_suAT99tg|D2zgDh!3Uv-LKM?s6^J4gk=EuSLd*3<k$?$V5UjuJ4e;@o)
z<`=@RGrtVpXMPL(LGuClx6L1d|JZyKK5sq+|Eu{g;aoS)!&8S~U9z`+9JS*2lI5Cz
z8h()ZweS*iK2JQ+oX;bw&2L4WbIk98H<>>G|CIUH;hpB=@LSD)1RpSe2L3hkKf%Y%
z{|^6=c?!RWZO%L!{%7-i_^SCqaQ^q5xQ<7{bMX87>2HC*-n;@{Y<?#EE#`IbD)SG)
z-)sI+c%%8H@Jr1<1Me`u5q^{T?eKo{yWtO+e;Yn#{v`Yd=1;?C&1;I2$I1Vh&m+HL
z{zv$>c!Qbi@;7+4`OjaU)Zf>9C%jQyWd0iXapvzRPwG^fABywByUqWNe1m!BTa!8$
zo9_W{H{Tb2gLxsm&%6YFzxfI9QS;N`Pnb8rXUs2w|K7YEzHELS{J-Wm!?Siv=7Z~a
zFMMzFufhw>zXw0s{15O7^JVy%<}bnP&38O8>2H(yr?9Wu%y&orTJwB(ulW)1d(8{+
zdk#m;Kl8SvpYND|9zJc}2mg)vSKv$LkHi0E{!@4+UjO5I{TaT8`F0gap9SVwm5Co|
zo&zs8e<S=I=5_Eo^AE#6Y~BfPHNPExwfQ~p9`i}~m&|_&A2xsYLCNtxX8tVlKQw;<
z{*3ufZ%^txYn}st(fmO8_PZxv$Mre}zMJ{U@cqr-4?n{EeE9L^m%vXmzZ(7?^E=@e
znvcLQGw;Fkvd^0Hb*C?y^Lg2T`Q3P)^^kckp2t0EeggbS^Gf*B=6oLd2lKO#Up7An
z{vY#?!gt<d>ve2}?`eJmyuh5l7xj(i$73E&Fz0>d>E>@k{(a`B!arnw2E5grzl-NH
z=KNWX8_fB$8U5x*;CSydFT%KAHNOw}Z=3V|xu?t@MSj-&3HTq)e+>V-Ie#DP%jSPV
zK5Ngd*Y_Xrz0CguKgfKy9h0v=%6va~xjBFC@^tefk$<mw8T>-?GvF=eAAx_yoZr8A
zgZbUaf5H5l@Imv(;omUl`*z<kUqJrH<}bkK%y-O8=JQ$ez2N^eFM)5DyY)Jr0_T5c
ziRa<7;jgp&N8yK>e-?g>`4{08=8wSNY5rsQx#kP-i_H0c*k$Ig-6=WFYs?RY-)4Ri
z{2udq_}9%_;g6g1{ih$B^L?gYn~$N+U(A03f64sM@E!NsdL3Ve?{2;)&NGGPyJBA*
zYtHlMTg-1mom0%ug4dWgz|S+k2)@buQut-&SHU~YZ-C!w{x|p+&H4V&kU8HU`j+{3
zQ0EErpTK`+&g<#C`5f}knJ>WqWzOr`j(cytzI<OQ$DG%-B6H^7XwKJfk2BA}>#L`j
z?+ULm-wl4A`QGqN<_EzqGd~*MX?`;N7V|UVUot-j{;>In;A7^Oz@Id~68^OLjqpF1
z-wA*1K3lKXD10yT`{4(gZ;RKTk1#KTmzY0{*ISP_=lkrZnV*U}wdU`Ff6)9q_{HWQ
zfnQ<%F?g4G8~k?j4*0$1e1GTb=6t_u-24vI`JwsU@L!n^!T)5=_px3u=j-hMF&{^r
zo$|I`_htC*=Kq23Z(fS`ISw=D`(?+P_ha2pHlIiRcbK!!_nChW`6lyO_$B5)g<od=
zLwKKgA&zUnd<Xdb=DF}k&9BGtPM9B${IogWN1ii(8|v`CAISS0e!tU-<@r8M>UCSM
z@71XDTJs~}dFFgSy3qVx=)c7LQh2%f<?t%=E8+a_9P+q64{xyi-SB4fufyBSAA?_K
z{v`YkbH4xg6?4A-_YL!9)Op<e-|!!rZ;yHYrFk~|kLG*9pEo}kzU{tSukXnicNg=I
zz;nz$0M9dj5Bym3b1-g&`DyUe%rAnUW!?xs*PO32Tw%V9{MF`*@Egqk0Kd<?3a=**
zn-{{rW6sx~e{6mv@^j|L!Jjoh8UCXAsqmfm+j<>a;k%mieNz5+HTihyLjFL@-wZ#}
z{7(1@=J&%-H~%gCUFLk>|2*@jkiW?M=kP1c|8Z<`{MVSjjQp+Uw;hw@ziiI;ZHLX<
z-jL+~*Ze`$`GNT(@L!lu!WYbc3V+`Gckut3ufSiGpY+9b{0}_We23B`ccA&J;YXV9
z0YAY!A6{i%41bULvG5Db%i))pSHauO&xT)b{>H;on?LR_uSfnq^AE#E%v<1(o43J#
zWPTO=8S~G>7tQa0zhM4l__q6}Hh*v(AA)C_KLX#^{Bd}Z`S;+*ng0Y{Y5olS-R6IQ
zH<&*Mzu5c*c)K~j&*291-SPPCGd~1=zxgR}{`YS=Z@hng!t&=KKVyCy{P*Txf-jrD
z8t;ex*ZfiBv+%wX`<a06ZT>Wz|2<yj7vN=<@5JN!B=ZcsUw)?fF7R{BbKp(pdGJq~
z7r;Mfeki=h{8;$i<|n`(GUxX_JZXL*^3Ry_`|6)H--P^&=9j~_KVa*}7r#&9wdS`W
zzn^(OyvV!;>vF95`{5^>e-M6_`N!cOG=CSyZ8oohx0$p5>&#C;{T}oCQ0H#*A^1b)
z{JxM!&A)~Gr1_tZPUijR=G&p4-<$6O|C{;V@HO*;;5!v;y}tapj6KW`L;k(yzeArN
zFz5MXllfyf-cOnH`(Um%pF#d6^9A@_=7$s|$8*2=57Fl%=D&bHX+DYiKR0Ln-<b1w
z|7rdl>TG-9*7ID3aSt}<^U$NrPei`T{4{v8c@4bN{2cgg<_++B&GT?P-!yMR{=4QE
z!>7&peEHAjdmV&%;h)<izi)xhM_z6INz~ul{0jKN=KMbYa`R5)tIThO*P0K&FE;1*
zbzg4&b>y!#e*}J~`Qh;U%wNF%88QFIQOUeLZhm4(;y*I4f<I$k2VXQlAO3=QGkn{F
zx8BdK@LkQXgy)&x1V6-_kE5f__s9Ia&3tFnsWyM8IO*?v^XD*c7n%PH^ZY6EZSZ|s
zpEG|IyvO_~_}%7b!yhs~7yhXEN8yv^pN9Y3{IDaF<Ndw)k?_Bnm%-P}Pl4}Qxb^y;
z4lgi&7yL-`bKxhLUjXNSub%gB7s20S`H#adF#k0C67#Fz?dDzZ>&<)McbMM=zt8+W
z_=x$#@W;&`f&a*S0{)Eo)9^*}U&CK8{}X(>L$+S8=ivF~FTxKqPvLP<X1)XbRP$_j
zt@%Fi3(OCIx0oLRztX%6-fey&{4Vp)!XGrh7XAbC9{4ZJzW`q_{}TLp^M~Lsn|}ko
z%b{DZ%Xi@WnEw=hi1{DjW#&aV51eBD8hEYwLGbg<cZY8>uZDlpob|6YKNa~~%#VfN
zZT>;{uz4Q#=cDFVB0p*VGOkZQH-8n*Yri+&1O7Mj*TdJ$4~6f9*RgoMItsprc^Uiw
zb6&TK%`1^V-kd+De5yHrj_+)9{v2O}Ij?^oGw09uU2fitey%fbh4-32i|gz?=6{EO
z&HTVOCXa{5%nyf8nI8lHrTJUo|7U(W{2%5k@D!dOa2-?FZ@ZXh!S^=LfuCaD`r72U
z&M?2`HHp8^{6_eN=C{EwG5;F;3iC(d*O|}2Z!@2Rf7yHi{;>IuIIc&{`F+*jH~$_U
zk3Tb?g8$b1=kULn^FH-O^FJWJ-C<jwSD%CLX8t^UKl7L1hno*z9*#EW^N|zH??V1P
z=0Api(wx7q;41U)Ab*qj6YwvZ^LhGr%wI<SY4g9r|7Onj8UJn0p96h0UMJ?`<t5bF
z&wK>?q|iJIUShr%yxg4ozsmd#$k&>`3Ep7-7I?Ecf6k%Jyc+pV^RwYS=I6ru%{$;j
z=GVhV&G~Z<6Xsv$xJPWg&p!gc%lr!Xz2+_OubK0FwJ*-oT;FfuaZzag6zaUm{HO2}
z&Hn*E!#rcR<ap}Lv*8~y-v@rFc`d%5=CkG>#rw70=4<df%`eYS`nlh{5B`Yx0DQvy
zLHJM1zX9jZg>#<A;D53F^YB&km*CsKF}3-Fb@=|rYt47T>+JiP9{?{hFNGg#{#N+O
z<}G-=_$>45;PvKrz%Met7yc>p5%}lKU;F>Kx(o2Au67N>!QI`ZK#}5J9Ev-|-JRm@
zQrw|Xw79#rxVuBq;!xb3B0rn`em`rTT<4q~?mYQs&DuMYWRjWD{ZYTc@5$%FAIn$6
zU&*(_Kg*B8Bj|psOYr#ed+=29H}Kr@P+0<xV-a}_cv*Qecx8D;cvE>k_#Sy__-T0!
z_`mXI@KCyau%FBAJd7wGguaw~0^A-yG6!B${VMn%`8N1i`4RX``6c)&`D6H_=>G9|
z2frc@sh`8_`kt5D&%x&QcaZVW+t=$<@Z`FE%L-2?F9^>pFAL8luL&<MZw4O_%)h>!
z;P!n^fB3q1em@$1QEops+djOMFG3$ox7+sfvGvjA_VclMQu%SrNhkjYo>QJ*_Y2yb
z<yuckxc$9cRk%G5q1_K^bL=?&|9;Rf`<Uj-|1OQ;?@w>c$sN=8;q*|xPlmTqKM!t?
z?^+EXq<$NGhWs$x9^Z8yzEu5f_y+k4cnLk8Cs=m>df5Jymq&rumM4NYk*9<IBF_!)
zEH4fpA+G|TCT|2^DsK<pF7FFJDjx-ZEuRMePrd{mCbqv{f5KzP_rVj%&%nQz-+<?k
zKZO^Se}cD`N6Zm;96QV7!w1My!^g;Tz-!0x=l%q5B(DT-Ew2ynEdK?*K;8?UKCXYc
z!{K@4zr(A`7r?v9*TH+qcfkkBPr%2>ufYG1KZI|VzlT4Shs_yyyn^ZWEjB!kJOw<X
zJPW+6ydb=;yd1o{yf%E8ye0fMc{liM`C#}0`4sp}-QLcDmzOVsH;}J@cb2b%50&qS
zr`7G@akxDX?IrkX&A9_#FMk2wDgO*VCy$mZ@VM`hCx9o>I=_S8QJ)cRkC(Q;FSFb8
zNSad|{ePNM9&Yz1)Pg@#-v(}vbM6ec=VR;-x93M41-Iu%odPeT_0NY_lCOqWlV{Bx
zxX)wcdEmq3_IFjbZ}xpcBlLM<`Ey&rt?vrA^JgIZFJ0~!_*wZhxIONAA>4l7x*h&h
za}L8_%Fn@L>Uuqa?^XW>ZkHS4$H0Bwsy+&Qr#u1Nj#m@-BlWG}*X6z8p|$>B;cwNC
zgMXGUf@jd2Rq(j-E%1c$1MrmcGjKcZ*WhW?zky$qe}?}pkB}#D|1Zju!|TTOyL50n
zKXbwD@gv3H<us=p-1=tlQgQstZ3~~MIX&TN)enLHD4zmPBA)~QUGrDMm&&)m*UAsV
z56I8LFUfDhpU9uW-^f40?Qz%P^9CNrFuGoG;4$TC;P&|QZ163*+yd|u@>1~I@~ZIZ
zy4<?(zVepvQF418AiG_iEFXa0Zciq{lg9P;Wd?ku<}86nR=*J*Pksy@QvNsmz2;wr
zZ;;=EZ<D`*?~@117kGT_@!pZ(_teLOKbNP4Uy)~rpO+Vc7t{4E4R0*32VW&`0lzJ8
z4?iI94ZkQK2EQ(!3O_1e1<xDL-^cCnmhwaJ<MLDRZSq_2J@SWeyI<uk+<t!)K7Zix
zy{$QE;B^!ET^4wq_`Vl_w~&{Cca_(G50p2B&z5(DFO&C!|0y2@-zA?4KO|oWKPO)Y
zzb@Yie<(i&e=ENPx98El3lEdP-_KX@81mo+0*_a6c@%gic|y27{x%KVp1(H-yoBZy
zfmfARfH#uYfwz&jgm;s7g%6Yuf{&4pgTF}V@5@YhIGwjk;icq31q1hUjE+}j_-A>Q
zLV^7wU2a|YRIRfWe2%;ue5w3bxIM0TJba7#Kj3@h%i#8S<G<klsNV;_AwLbzuIqaZ
zo>%?|UR3@cJd-?1;lTa8tIJIQe<=SR{#2d~Zm+XY6dt6@tpK;bFKPgPqxr4jDK)1P
zJiNRIJchg<JfVCD{HA;iyo`Jrypen%yn}o#ysvyae5Cv^e46|m+#VNw6aJ_AC-4jM
zpdx|C-5&290e(t-Z1^sDMR*>4Ue|!z-~Ts(Cs5xWo=V;uo>p$p4`<&WW|GfD|3JPF
z-dVm5-d}Fd8)x%J$&aC*Ccgx?$1~rBZ&d#ZzDpkbr@-T4k7teozovc&ynRyt<Hy27
zB=&s<JfeIFJhprz{5$y`cxL%YcwYGx_;&dN`06D7I^V)K%R?3Q-*3mISyKPsP2n3g
zzb(9|ycgX5PJ0-<qWVej2J*S^_VQKmLGrEeiSk46dGa^#McRj;VuAZ`P<<r$-}3nI
z+w$+>ujJX_p>(;0;IZW8;ECk5;A!N|;o0S#;f3S_;P!awG4LAdr^8#z7sKsw(Hr2y
z)$fK+kw1Xf)p__5zE^#);(^EOq&xw<g65=v+t0a~;TJR~Km3loH2jskIy|&4w+TF^
zyaPPBye~Yfd?Y-ld<wj{d?`G?d<%TId?);t{2<)^p6zeAy?()UxV_%NBlup;e+M5B
zEa>Z7=o0>a?RM#y`pEEu^0e?+$^4Jc2u~}|3Adj^OTwEa_vciCm(ZMg@bdE3@S5`O
z@J8~%@YeDP@XqpC@V@fp@DcJ&@ZaS7;j`pt;H%`<;XCAy;YZ~E!7s|gmh|`4j_*Tx
zEcknQa(Fl$myGau^1Sd&@{;ge@~ZG6a(f<ATW1w{7xeb{?SAlR>W9OV%O}F^d4p%d
z$ElwS50k>*$K`OlecJ@zqB;BF`{ifg_Wan_;r6)b$8ft}Jyxl}<7<zbO$5KD%S{9S
z?K}VDv%_b}3&B^)%fkPX*MRSlH-R6Qw})Ss_lCcakAV-A{|<kk>pLI*O1=i(L36gl
zd&<wj8_2K0KWP3VcqH}j;R)qoN(UZCd;ED!cpml1;P&|Q3~+n=c?q~Z9=H<R9zR<T
z{+-VM*6_^o!SF-!(ePaIsc?Jz^8&cdUjtvSIose{<cHz2<@Wltb~}?-eieOD`2%=4
z`5Smud5AKB$FZI~D!iFI8GM2~4ZN*9BfOhDJA8<|Iy`zxe|`1fo8`^mZRH)|z2$x3
z!{sC3W95_KcKbOOZhz0V5<W?DuELkg@5ATFU%_{W@b@81*}&uVQhh{tp;Ues6K=l;
zOa;%XJ|o=z-XIU$9#>u*o=9^l!&Av?!)@Q1!);DycsI@I4R0nN2DjIh{ta%gE4KjN
zT62n)58P*a9m#U=e&73DE%-2bbND!UXZY`OdwqEOeE&l}2K_?$bhtg9c`^K?`VH`l
z@;&hF@+0t7^7HVG^80Z6yZl%18|uSU2;Ap?<uT#*`0DTA@6~652TSeG%?A%BF9jd3
z$A?sdPmwo<&z84`FP8U#uab{|Z<hZK-zlFDFO<>0UTferGWot8K1F^6K39GLZjbB#
z7rt5j3-~^HP{qLGct#!<K0wzi89kW)@fqNeb-ePxW64Xv<IAhSlgb;yx5?YW56XMN
zpUH>8!=~}qKM5X3J{NA!|F#Nl&wH~Ko<egD!Se<8FZUcgyZT%3Jo0DoqVi90yZw()
zDe(AqOy~bQF5I4vE+u@l`YiCN@&fQ#@-pyhI)7@w8_Ao(TgyAbyU5?dtLpd$`#JFX
zrj<vA+w(Fcfag}98g9>Lk{w=FeO>r^c~iLk-lqe+w)#GByMJa9yqWqr@B#7_@FDWe
z@a6JT@LuwZ@K*AF;hp3k;kKSol>?89&4~uLIjQ0EH9r%4q&zQtqPzrrn!GLiw!9ns
zr2JR-b@_DoIr$y<YkA2kf%}kFpTFDSE%bS`A6`cN8F*#+b$D(0V|ZivfABW)uvG)s
z*+m`;-dCO+K17}oK3bj^K2=^4eq3G^ZqHBA2!2(4JNR9BZ}=1WaCnxq{`H>>FDRb}
zuOwd$A1&Vox93MV0Z*Xgei@!$ejnaM{sC^!s}QbQ;BmCa^(2Pd>lmhj+wD&lxc%L1
zez?6pW+}KmuB{q;uJ*qde4l&}e5rgaJX}csdQOLLQNIGdLjET_g^t%w_&fE-;K9^i
zf`^gch1>I<yn@G4AG~_t@k%650JrBKNdd2+J~O<jyea&Xye)jPycc|td>DMad=h+@
zd@lUBd=>nHd@J0ZujCN?f%<dsSMn}30{7FNXQU6@J}-vD2k86TNpSo5cM&|fJ|CCE
ztIF5IZT^0EG4+*d2Cl!jzW=ESx7V$13b)5Ebbznb{66qa^5O8E@=5T6@;UI6@)dBq
z|9KPKp2uV#{GR5Vg4^?$T!DX7e;*$D2Y(-5!(+*V*9zR{6!OUMrt+lln)1|edtStB
zaC_eSf^d7ji!yM#AHF)=?$>Gzx9?Yb!i#C01K}CuW8k^u)8O{=%R+cT^=skwIEA3v
zf%}|C=W{rCE6s@wx95NP4&GaRCiqZ!KKSqQQt<imYVfu4#_(<O_V6R}KJc^h5%8GW
zhu`5T<n!V7cW7(i_Wad*;r92yN8$Fm@E71Ww9aSnkm>#7_YrQ-FB73o;PJKRmx%+n
z&!g|)KWKg)cy@VlcwTvBcyW1sxb0hOxc&WJH@H1+Xb`-)=8uK9mrsY=*Ox_b`~2Mj
z@2ffI;r8?6Ex0{D&L{X^niIQj;Bh%8PY%B>&knce8!8BYqVuFQ{GPlT{5#FB53eI{
z1+Ogc0JrB4>JDG1zCYadZ4})0Z3=v*<}8H|ldpmwmj4OgDc=LP`@Jv2!|L<>HavsA
zzkLROt@$D91s>mj<^AB<bwA`VxZPhg32r|Z%!OamI#<E%^J^<SjV|{PJcIln_&LqL
z1MjZy$KJvZst-{=a3Ab?#e>`Wlfmz4&iC+F^7QcFT7On}WO;6Qe0eE&W!>*u32wK~
zb>X(pE#Y=M)&*WdmpcGnRz4bT$7?FQlKKVkYVtMkI`VDsM)E`OU*u=uv*kD7E9H;j
zTjlTJ`{bb;1buz8-`AXyM~B<j<;3tS>eIp>%X7d#$_vBo>s>jxeSNG6x7Q133Qwu?
zrw_c0d^p^G9-jf9sCCYR50Ec|_mLlh$JXVZf!jL&f!le07oJITUcz(9gBk`N$Aa>R
z@SI8gE(d&s`U3E}@-pyex*e_oZ>+v4ysf+=yqmlqe1LpE+@7!MI6SMa*Clw0VE*;J
z10NjR_ZRT@y4=rjyPb*9$p1L|e6ib^IPjp%e)k>R_AMjap0_IxJc8yFhewnD438tP
z2e;!Mym8?Aud9y$uPl!XuOm+hZ!6CN?;|e?KP@i{A0w{;pDJ$xUm$M}UnTDi-zFah
z-!G5fByfM)XVr0pmy&0K|18f3uOlx7x944|17EDZAv{Yqe?2YXAJun(+v6z)z(Z=z
zM0j%f47fdi;9|JlFM1SiuQz%D{{P?4!tHtZU&8JA+k=`09+x;;XGC}+d0}|i9RA0b
zhX1a<I(&}234E!%1AK$LFMO|jB>cF13jC6M0o<N<X)WBIcWDPacy|B#9)(AiUxdez
z-+?ESzl1lJ2Wu91Tn5P_!^g=Jz-P)+!`I2P!}rSz!!O9o!{5q_HV<6qeeLrOcrEn@
z;OXVZ;CbX{;N|2m;hp78S_H1=j=Ue-o<C?b{F2V+t?-ZX1MrvfG%W)!*Ipkd5BzaX
zzbgj6Ew2F&m)q|f!tM5<KRluO;qct@Iq=Hz<?zV*`u-QZy!ylN|G!=pytVr4aC^R$
z$8dXIl@D-x9+pt80{6L(=0}Iy<G$0vSE$bjx7W8S0*~{fe|cr#QROw@c3e8bFR1Sc
zzayUjzb~H)e=1)Ix5sa8hTHu=`{A!O=QRAI{3<+n9)BMm!o$fw!0q*0!?q4QUNO|i
zgvXU9h1=`iria_#+vJ1W^PZH1SJM0{@M`h~aQl0<HgNlUwn^|Dnllq_bC$qu&SrRO
z&DjS}AwLB#Ex!csApaNMNd6AKS01cQ;PJA*3ylP~`)v}#W9RihJ}tbqJS#k^ydXTO
zye!=AZ>a@et-dkb=C_C2{66ryq5btQhTqowweaWit?&=>{qS)4{P`#01q=Fq2_9Gd
zU3e1tE4ba>2LHvMXFpG+P#*=JNuCg%U!DeDN}dDWR9*z$MP30uP+kW<LEaK>w_{!5
z^VAQ4Z<J4lAC}L9UzD$g-;r;FKbIedf0Unx+w+XvhG)p{AEy`a**brMwGBLu+vHK;
zeKjW$e55=be1beTe2%<0e3`ro+&;e=!R_;_J=~r*q%Zt{=8uBs*Y%wSKdyc;+-_$!
z!dqz0UU*yiY4};qzYf1Fe*zz;IUnIu<Pq8h9>?376A%7a{yqGSJUjfeya+r@0srzU
z!lTOT!Q;u>z>~^*!c)tK!AHs`!|i!V=EJwBUkg7X-w8h}KMsE&zYKpTe*lkC(BGeT
z@I>-3?fv)L?Po@LY`FbiI5FJ*ej_bBnr<KR!0X71!E4Ct!N1dSZw|Nbmpa2EsUHB3
zE*}GrE1v;xAzuK`DPIfk63O4k9q^j!kHL${&%y0><`&#;XP&|B>v+fxfyZ&O=0}Fx
z?Oq)CM)fJ+_B!&J;r9JW0eE+vhsELP<v+u-%Im>%%Ui(<$h*Re$_K*B$j88|$)~{^
z$=AWx%eTPi$`8Po$uGip$#22!^ZF4yggzhN!5_*)bPPQ1_H$WOcvba@;OFG&;8*3v
z;D_bq;dSJ7;5+3_;q~Pm;X~y8;A7>Z;D5>gfOnIxgtwCKgfEewgin`Wh8HLl^!4oq
zysZ2_+<ss18h%dqKZNb%&$HWMd;Y0N@Tr;~8*cXlWPscAI^}{t)tticPx3PGFopf~
zRfWfrH->jD;`goKZRH)|c{Qgm+@9BI1iYO3$?&T3h4A|FweTkL-SAfO<M4L!f8d?v
z58=J!Z{g$RAv*^icUxyv_%!ti;rr!j;AiBy;dZ@>!tHuhgxlrTg`d~_U*I;s2i)cl
zhF{m5@$h@{nebpbf0n|-$~VKK%lE_M%1^_S%WuMekUxQEm4Af)D38=7@c0&y$Ag!Y
zr-GN2=YUs{7lzlDmxH&Ew}JQ9J`aL#laGLJluv-qmHz=>E?)(ID&Gv>pmpwp-;C_<
z<9T?<624!DNBGJ2NAQ^PcX0cA`%qm2k5_#4(cs_76Tvgc)4-b+_vdDZ|0yp7KOip)
zKOwIH|3}^geplWe{!-o>{#ia8Zoglf3D2wRyAYmJz7}rxZ)}I#{qTq3F|?j@@T?*I
z{k#cJrv3>$m;68YPx7$c0*`xTc`Udc$K-JPyRuC1Hky+k-c4Qx-cMc=K1|*mK3U!c
zK41PT{Btq?dX9qIahw7#qT@IpZm*lL8g9S0-3p(i`&|#h6X`hq4Y%{*I^52mNAUZ)
zUhm-cJXxW-2OeKLpQFR=^`TP0$7_BDcrooy9(V<L33x4e6?ijwLwF~7TX=7IFZdAo
zF!&VtB=}nST=-7;D)<5UR`?nDA^2taIru&KEx5f-$1}J+5C13lW6g=sBk=gXkjI68
zlBa}6De8ZG7Py^<1>oWIeR~=B_nK1!ZnqCj;r4ug9pN)Iryty&2XGX;o6gUv@FDWY
z@Oj#Y96bZ~ZMZJCAUvzQEIg0ACcL=38N9N*6TF6e0KB1mEZlAfX2M&mUk2|g-vqbg
zcn98I`}P!W{YSVxP9%J<!2MjQ%Z&rK^{0T_^EPIN+wE|Exc%O$H2k10w>rGEu2&Oy
zWqAkq3C-yXzaSq8zbT&re<)u7ucOOd3vVXh0k`KjI1MkT{u12Qe+O>se*w4ke}>!o
zBlHeDzV<u}ap3m+nBT#3YMmM3cD?ez?RgS*!c%F^LAZTi^f%m|hvYi^m5$3JxIGT;
z9sIreP<;aT!R`l+2Dj%AO$4|7Ndr%;>y;foE2@8a>)}_`Z-v|aU<cu|)c*~)$6;NE
z+w*chf}hfy4{-Z?;23=a_h+^GRPZ14eOd;%9mneMr22WMA^azKYq&kH;sE%1^+VvF
z<zwLX_`7Lvd;Hx(__L7y^<M|SUds2a@XaNCKL~#-{~I1mbFRZ9$REMm%HPB7dF#UT
z^Dp1-e;cYk7TngE2yV|Cm<E1W>(359E-wT>EiVf{C$9m&ByR%0DsK<JDen!xBOeBT
zApZ^iL_Qn-T)rIsO1=qh$Lj<<uJ->PJcaxfyo5Y>|DdmLb{y?_52L~R==U{A;B_=7
zHQX*Y8{96p5Zo@e9K4d|w}$7HcY>#t_k^F74}y=DkA=^WPlqp&FM@BBuY(_vpMvj{
zUx$Y%?H`YOaC=<9EBGhP2{s_`INJT&k>K`vZO!3bb-C@}ZREY-i{!t;?eW6n;PyO4
zGvIc+w-`QM^Y_9>$dAMSlAnRw^CA8NxBI(Zz}J`c_wfVVzK;zzFmRtsmGS=_8-692
z@87|vsLuqquc!Iov(?vx50f{9+d6-NS5)5vURypG-d#Q(ZqJ8!9^Oj*HMqTQ;6u0_
z_qTBSxgg}Az<svw8>7PQ`@n>7`#$gxe2I?lY4|)_KYW?|5q!P;J$$P?%&&p#-y@F+
zKP*oMKOxTmzaY;8zb-EUe=M&8|4-f!ZqFCl79L&u)(f6gJ`A2gJ_(*zJ{Mk6z6xGd
zz7^g;ehA)9eh%J8ehWTY{tP}t9&>QuaqM2+|93*Tecq*p@70`a@MH3V@N@Dq@aOXC
z@Q?Dw@UZ3lb+&`YkoSVy?bT5DNA(loA+!&(;Nj)V;3edL!pqC|!0q$v1l&Hq{(;-=
z<Xw0*&3_5csN3hDA%VxYo%-nT>)Pi8aJzj=4Y#ke+2J#S`<FKf{-ZAU54fFI%iue;
zp1<G&biMY$<LNk_h9{R_gXfSxf)AI!hp(2085+2scK*bK+xe3WZs$)1xSbDq;C4Qg
zfZNyQDsVeb8p7>-=mfWY=mjsN>pK8mT|N}vK|TdOPd*!N$9*~coz9=X;8QebFWesQ
ze;58({ZqKzfBONxUwznNfyeiTJSO~Kd1m-7d0zNwd2M)NeO@$z$B?&z+x;!Q;px<m
zgxl@IBzOb$)8LhU_OJhZ_zd-H;P$+_yWs28pMvj_-+&*JKZjqE2Ol1ITpr7#!-FdL
zU2?eH|DOdORefRjxRCyw^6;X%{izMN*S~H7PpbJ{;P(8mgW(Y?`j<Ni9#g&mo<hDB
zUS5~G1D-|wQFu=IMfmrca|d2n{Y!W`d9V?I$E&718oaqY8N7!)Gkmzb5PYh<BHW&5
zwgKFpXSO}uo@cf{e4plzgP)bphToH~hQE<-gIBNQ@7H1YLiu_4diibme))6wN%?2^
zHF?C5fye8)JU%>(ZXZ&^)5~+fi^xmCpX<D;1h=mXb>a4T*Ai}@r(NK7-VT80(&dhZ
z+vm$vcpdc%;LYW0;P(92+u%LbAA*mTpM}qs-+(WdKZb9TzlZOWhaMGpd{4`x!_S29
zyJYZd>T|#|%JaZ~k{5y7aV!tFzu&F}{}|C<PcyiE-R}su-=p<~=hu3s!|nN$=fgki
z^K>aZqCPKH!{f;}!qdpN!t==wz^BVk!kfv@!8^z=!~4o_!bi!Uz!U59^ex;zze0@;
zJb&!|rReY&b~^wsE-wiGRbCQq_p?=nH&@>X-d5fY-c8;c-djE!K2yFF{!+dcZr@jL
zhi_1S7;eu8eGYzE{Z05i`75|R5A|pG9`%vO1Rk#@mHmImf#;W}fR~r&gpZOJf-jVp
zhHsQtfcL5DuctcvxcbKM8tU7@>&bh;A4T=&Pk@(IKMj6Pm%9*de`m55Zuh@!hd<Yx
z!|)1K{PmoJ&zIkXuaZB3Z<PNB-ysh(*1sJ4eTO}tbqx3e^-19Nyw&O8k+p9*;R)qM
z;A!RM;W_2C;Q8du;6>%L;g_|~%i(wB>*4lwA@{hz{VA?}C<OncIc4EF)YpLLmA8VY
zm3M>(m-mI+?@vd-BdVVak0GB6Pa?kzA1}WRuOWW`ZzX>Q?=F7>A0`hrA#k5t>o`V$
z+w)e(fZO+hN#J(>KsxvY&Cdy+CNBb?FE0;IUd>;3EqHNxGr0YIV@G&J^?l*?caJ0B
z1@&{~WO#bbnG3h?f7ZcmA2!2dYR+!B?dNfLc=gxdpR{jx;mhQY;hW_z;d|xp;V0!m
z69dnm8}iWbC-OLOd;at!a67Nk!R_-aCwy2;e;q~O_WQ^3a64YL;MugF&ER(bYA5(?
z^}XOD<wM~U<rCr4<O|@-<SXH}KU?5-zw1Hx8qGNixBKmH!tHt9pTf^+&PTZYJ~8}n
zI3Lu<fj^a}fZP46nc;T-YJRxgPg@%PLG!D_7wG4vCUCnywgcS0Z~PU$P4h>??L3(V
zxBKB2!R>zdl#>GYEo627-x=XK<T>H?d-)>pTI$Qg?fj_)x39m=;Qzn<gxl?8U%1__
zj)j-jdZxh($d|#J%h$tg{k!0H|L}GA2+jEyK2iP{9=@`_|3Q-jkIQkL_u=4cG$$7P
zO%wm)lfgqb^*ud2o;)`^i@YejxV$2~lDrPQfxHF0oxC%Apu9hPf_xNwu6zo7y?j1=
zpL{j^nS3iesF}ZS2jTJLf5WrNufyBQAHj<?_vgQZ_mqeF-G9G*-#%O(4gR}45qzCI
z4cwlOEIa&)`a<ygE&O$qg{N=ndkuJw*1k7^x0JVsca!&q|0*8_Unrjh-yok0zb#({
zPuRv^=T^8qPsAbk&~|=*4t`jE3w}}l41QPs3I2V1e}051{(tSb?~=!bC+y&NDdFYh
zS>U7P1>p8L_A>Az>TAFob@VT{Dg0k~NBDbrKX}eg{+v<pvhu0$7V?E~d;HZpc*$=5
z{GIT&@?-D~@=Nd|^1JYh@>lQ&^59eb%eUhgqPzd^DDa|soIpZ&9eEmfdwCA{V0jVv
zRCxvXN_ic4QT@GgOL$#*SNJgbAoxo8IQUEXOn4am-R)9%e)*s9D)PPXr2YJTJ_YYA
zzX~5De+Zu{e+OSE4?QjD>zf_l4e}W9ee$I6i}LjFC-NWR!TJY%eJc*Pzgw*gPous8
zys-Qicr|%Xcz5|w_%Z#x;BWArL;Q8lflrXHgxlYFY=Iw8e-Lhe$8Z*Ie;;rYetM|C
zo~Q8V@{jOn`h9cw>Hf#r@l7m`3$H0p1-IWTXM>m0??(&6TgofId&uj;N6A~m=gE7(
zx5|gY&&wylKg#F9qw4pCYv4KMJK!<(`-5Zf%<_NWW##wbb>(m2?d73o1Rk$G@|f^(
z^5pOZ@=WlZ^8E1g@-pzOWBqm1gjbR`hcA(Lf&V2R1m7<o5C2C#3;t2Q0-jj+(`|ug
zkRO6KmY;|Bl>ZAqD}M=pDi1z0@OX6?@Bce0e6&0<e2x4E_zC%s@LTc{@K5rp@R7P7
zsxkZzc?b9gc|Z6r`DplA`E>YP{oJ<%zDs@?zD+;(-Jw_a_wyxub7S9w{SmnTyX2AK
zC*=v?_PDUr@T=;x!|i#=3&X2v{pI0}<+b5m<t^ZL|7REYT=j$CE9Dd5+q7@f;Rof5
z;qhzu`?vw#Pre&ou%_RifZOx`T!x2f==b;G5gYmb2L6jY<ShUF_VsJ5JQ}>bj#pxM
z7kN5(l}P^F-0%pxzJ=gNwQrT+|H*5@&&cb;Z_1m(pUB(5TWUR>;VI>V;nn1$;aTMq
z;YH=s;F)!N=fVf6UkM*6-wdB8-w)p)KMg-FzY4!2e*k|ce*+Jx^@o@p^!3fopZM~q
z@F=zXE-t);`V{aw@=WmV^1Sfh<R#!Y<dxwc<xSuR<Za+f<Q?G~<UQbT8u-_D0Ng%*
zN5ea5fBt|sl`n)RmoJC^AYTjrN&XkSu6z&tP6L1aN8sJmpMnpSpNG$sUxBZa-+~{K
z--ln7KZU=NzlMje?XUj>JgGeR9RK}x-e#AFg_o8`hS!tFg!h)mhfk3wg|C;Vf*+Ir
z0KX&80uNcozdpI(iRAg=ndLvhi^@yEYs)LZJIbrVhs$fjm&hB!56hdwZ_9sy2i5hj
zZzp&hc@Ovx@_z8b^1<-x@{#ag<m2Ik<iEow%4fot$mhX#$d|y+%2&Z3$Tz@))${jf
z3p|c|7yJkL0eE5gF?e<P8F(A{MfgDZHTV?yzwqVqhw#1f=kV+DxA2ehPw=?){rw3!
z*Z;5G4rG>xhnJE^g*TMPhWC^wgpZLYhcA$)hHsT;fS-|PgTIvj2#?hu=<8cSct&|K
zcqw@qcq@4&ct3e{_#}B<_%eB8_%3-%_<4DI_=kr6_38nSC?5j1?~^CO=cu0zUn5@u
z-zDD+KPf)|zbC&4FDAbMk14+kPa%H{&nABdpC}JD&)+9I&#TG9z#GXU!CT8?z&pv~
z!TZRQz=z9I!D~12*Ow6<L!K9&TwW5MLtYhLR^AxiSKbERN!}A)u(7|+LGX#{$HC{x
zXToD^&Qf@K`Br!s`9Am>%|8M^C_e?iAwLiQPkt3%r?G#1@51fp!PoGC>OaGK$|KDW
zJP()2W5XxQzk|<}XNTu);?J!H|3O|4{;%dVfj^hGf(O%__V76JZg6`&v;Od0`nh;C
zyqD%ogAbN3f<FuCU*Glc5$X@X@5)cYPs*>rFUudm?S7TFaJye6{ldWGdtJXb&jCLx
zF9N?H-wm(V%%6J%UPOKYUP=A|o<qOC4z(z7ojuh@hYy!0f!qBync)M}{{&Cl+`qiC
zaQnNFnsA%n3~u)ibb{O8<MoH%*Lp_7U&*JzKgt)uLpJx<zaAb(ej0vJbN+!(kl%pM
zmEVPLl0SwYmcN51YwoWz*5bh9+e)4oZpS?xypsA{@LKXp@OtuEaO<1HZJ$TL=V{JF
zxSc1n;WmE{{HW#}h1;Bqa68}b!0mi{3Aght*pk3~w(~7A+|Hi_a65nU!%w#G=N5<C
z@v01eq3hcK9!zt3!neo=!R>mDgWKoJO!!L8Sqit~yA?h|{XTej`4M<R`6+lV`FVI{
z`4xCO`7QWJdC=0p;~2B0|L<^c+yB^b`+WHhZs%t{_-9>iF}U?V!)-siz?19mcKX6?
zog?A-biJm)Tgex|yUN$X`^)#j>&cJ73(C*HOUW<7E6X3jqwD&<h7VC6Vp-sE{M5?-
zcT{+2%}E5eeNG2|t~uG@cE4pIxP88qgOAiYYr$v8o5TOs<#vW&kq?01k&lJ%l}~}s
z)8#IJuad8YZ;|hSACMn~pOIgL+wII9_<^|o@p=irra8fu2Oi)1^2qQP@&xcV^3?Dk
z?N4@iIC)`s40(BYa(QjIy?$g1cp>#&;N|24;q~QX;jQFz;BDmV;O*o);hp5i;JxLS
z;DhCN;S=Sr;4|bQRs<f$rSe$t74qcp)$)w+E%Ll@TYpKot-mVV*53$j>z@U$+S<Q9
zi{W-Vya8^v!@J@3b>sxxzAoH{7t`gwfLkB5GH{>m_AM)XqUPj<+d50a?fa;zaJ$^@
z@S~bP0B-Zgz-|6?_(9Ft4iD4Dzn%x+w*P;_?Q(Cx?d#nWxP83~w<>TyUu!+l;r8_?
z3EaN!`~bJ(QXZbSoqu`N;dZ^6!0mc<fT!2~^o3`VkA&MkOo7`ztc9m*=dW`s-1gxR
z+`cZKhbPvYf8n-2ui(+te}>!F!HBB^k5^7z-+1t<1^q4+-0la<3ZJ2`BL(3zHNPzU
zVq1THE%<GD3%GsV?+UlC`@h0pYR&}s2l;GxIPKdy_!zB!D?FckH@u?!AiRnEIJ~?3
zEPS8Vc@@4${X_Uh`8)VNdFVBP$Ni{02K>4_Dg2Q<Jv`Je{@fqo73Ia@jpUW#BjpX?
zQ{}(FXUTiQSICFL*U5i_AC=F6KasD5ht+Y}0#7SH2rno<3$G-<32!2Q3Lhc=2%jSl
zzc%pru9l~O|ETMg9zHm-jw3v!`r`16@*42O^2YFZ@~-eM@_ukz&nS3%^;6;Y_{v4_
zE9zInZT>d6%{c;(r~UjJZgXzHZO#XHC(Q}9F7SBSoak`7zDeLVzZ|@yZpW&@?dxM>
zxP5(W54Z2T`oQh`ncv|Jb-A<Q)~|ru*RPZC^_p`LZtK4TxAnh-+t=%0>jU@MzFsGQ
z&(-CogxlBaEbyu73&QPsHHJrP@2{f`d~aFbd%*4f{2_2VPo}^lX#PC-2d#4le1-ah
z@Lck<@WS$&@XGS1@TT&Q@Q(8E8v>8ZuktwX3Gx(hd;Qen@UR{HxfS52G^Y;yqP#2o
zrMw^fihLCOzI-a&j@LrC{eI*SJdf6Y8g7?+4gQ1rNE-w9v%Nevyq5escw>1ccnf)9
zcprIp_&oV>c>0e1`p(0zsJ{)rD}M`*t2x2`47|Q}I}jOe-<KwU+v}mGhQHS3W{2DB
zp%#Wm)Ou>dtH~R|?fSNZ+w~m?FRVEu;dXte!0q}jfalhnwQyViefS0SFW}wfL4O7A
z|1fzZxLx1)aJ#<g;kz{_2i&f25xD()Q2}1HpufI4aQnHVC47P|w<~<Ad=PxTd>q_<
z?wAQ*qy7XuO(%by=iw3MSK#sGDK-V}|C+A;ze~dH`6a5tD+KfV_VA9H-v{19J_<fd
zz65Tsle!VUMEzcP3a#f9e4qMj@PqP4@W18n;r99wVKxWu+dcI$;k%;wT{8G*^%>w{
zJNtbexc$DY1l(SSwF*43<}`t)ly`=wlm80OBL59;uiH8wUPS$Rcv<;gcy;+HcvJaR
zcsKbIcz^k4_y~EFErG{tqC5$FhCCyDp}YWmmApLsPkBA~4tZPnNqJxRKk_l~oAN*4
z&*UrNL0$aoza1VyejJ`qeii<`{0Tgh{4>0OJj&L<{Vyv|0&gJC2yZXX3-2MX1|J~r
z03R*y3!fq%4WBQc245jx1dnKcKLg*Oei!_J{4)Hc{674GJoL7}{k$bl4u2@m2!AFo
z4G*E)|LXAQ@}}^l@{aJF@_z6#@=<X6{m4{!9rX+0zsT3Y?e$`J!iTCq20xh8-^WYv
zTGf5O3vV9T_g8THK0Nq#|NZv&kaKmpQQ*tuiQxA2F&q3>eZ43TA11F2A1`kY-z=X1
zzb2mne=eU7e=I)+AENW>0(__Z7JQ=i;Wa#5H-8^L!#AmqxFc|%56R=fugO!v?Ro05
z!r!Q`1<$4RG=>-XKIrRPd$>J5u@C$^%^3mDC|?3^Bwq`!D&GOGDZdN<L;ehIk2m}T
zx5sHl*ctTo&CX|g9A#X%UEh>&dpu?qxIHei0NfrISq45p>#qSHBi{oL)6-w~F?ihW
zzF&gd?|C1=6RLj?FCNjK6K0qHU)!GyJ^X*igg2HahyNze1fL@>0AH^4lz=CZSAl1e
zH-zVxw}qFL_kuT)4}*7=Pl6AZ&xKEsuZAbo_1y&Du6{rKr2Gv0n*2Kasr)fKNSFH`
zJd!-z?!e<)RvsOmL!Ja~`~L&n_CGh=UdOi>-1h%xxb1&^xb1%%xb1&Wcpt5Q5WKZ~
z9NhMQCcKOKrEuH-KjF6jd*QbK=irYt|0Vpa{3Cq1Jj9;B<G5QM1)fE>8*$<B<SF54
z<R#$g`}mhv5x!G>UHHJ>e%~72Lf#pERC5NvZ^*~MU&*J#L-+D8cQM>ve|H0XpZeYK
zi}Dlj>+;KRdtKZ6@Tj`JZ{Xj{L+%Ycj)mmW;8o;_;q~M{z$<H=+2L{Jh2hEM<>Be%
zwc)wtE#SrEUEv$#{orloqu@Q|Q{hA93*l4b>)?y!yWlZ&J|BkL`F0*YM*DmlzC`{U
zzES=eZs%ddeSyc_&bN4QJKs{l?YzwjKcveo2)Fa9Ec~JRKJb3ppQ-Q}^0{#P{%RH6
zZf8!z|IwU(;5+2^;P(C4Yq)(s7IuH&ejd@BlyG}J;0*A%ef^Km17DHJ_Y!cszE$A%
zec(`dsDA#Oaqt$p+?ntm@}=+*@;~A4<cHw5<)`6O<rm=g`oUM>N7V-%@UMq`f7nRZ
zD;zwdJPN#^JQlo?d@tOdFY6e5RR5r_Z<pX}2KastK281%Zm-+=5xzn5!yWYJ+4bEa
zj|D$2PX@mtPY-_}&kcVoFAbkB{~10}UJpJ)-U@C%*LQ{6@6(6D`)l9E!DGm0z<bD-
z!0XD_z~jqz!hevTfaj23g_n{)fp3t%f!lFOd?@hv)*9mf`+K<koRtlJQ}YYK?RkC6
z!%J#@b-10+P2hGucZA;_=&!REyj>{YhrvV1C&BIY+7`hNYyK+uV_n}3@F?oHz%$Bs
z!OO@Gz}v`=!AHo?z?aDXf#=jd--g@%Jcrxuz-Rbt&5w9E@H{Cv$p3dd_|NiG@JaHl
z@TKyC@CCp6^UK034EDVy++NqS8N7-5PVl(epZ@Sn@`>=wTIY0laQRYrc=;xHbooAb
zJozbjQu!5lD*1hQI{9mO26@;cfyZ%(JSx1NJR!W9JRQ89{71O`{Xj8zH}#d^edTrG
zwht}gwhvw4whsf~why!5<8{6*hOgIpHo*7Dcf;*<eE){q>;7JbAJ&|k@LTeG@bFsa
z6L>25EBH_H|KKg;F^&eF5Bc=@k^sI+{r7O&hpcehho9h?HNOmeljc`~|1GZ$e=e^J
zkFEJF;r2SU9pNq1_k;J4kA>Uq%q)06^{e2M<U8Pt<tN}9<k#Q_<WJ$p<w3^+kK;{w
zRQP>)4tS2C{>K-9Khy1D8F(o5HQ-U@P2s8J!{8(3<KZ^{1iZ{Jf1MZL_Idp;+-?V6
zz_V#i(DA^1%P)@vFDfqpPdwcJ_!97*>Z`!*>rq4aO!aNy_Wf#qcxYYjXm~{VG`PKv
z=^}Vs^&8=XwVoaDzVf4RJ3lYO?fiTMxAXHO+|JL)CjyVlBVBGB_+0t-a9d|i_-ggV
z;alX@;K$^R;aB9H;I<Eg;I<DF;kFO+;I<DTPX_Ko@)7>OBf;(G@%Zqbjs3nf{MAU`
zE5j>leoc4_d3|^fc~kfhd29GYc?Y<?zG*l33iW;92jqj`_Ijnm;lXu%$HG&{C&7!$
zr^Bnt=fGRY7s0#9SHOqM*TJXBH^EoPcffbc_rcG|kHGKA&%uL_^3R9dr~Log&-;nT
z`u{Erf2qC%Jltr%F9%O1uMGcDUK3tNULW37-V{Dj-WtAA-T`i}o7fG0TYVpR$T9x)
z8U#-y9}dqU9}6!hp9F6vpAH`+p97yMUj+YCz5;$qz7GCOz6l;)$Ne~bviuyph5RzS
zpZo><sXX)P!1JxbIRD>2!i&j^!|i!*D#PvX<Qu?CYR(||9{DKv82MEARQW>qQu#Xg
z2Ki3-PWdbN&*S}l_y~_64|gVT->zix{~ZfHIgani;P$xkEbv^K|06t>ydXTTycj%*
zybL_Gyb?T<d_26z1b_Y0;0fik;o0O1;Xlcj!>h~J!duGU!fQ|T*Aw)&|6jYEw7)Be
z2)Dm0hzBpJImzJmbv!-%k=BzNZm(}w6dqRdE5hT;>%ddVTfno+d%{P^2f{nb$H4o_
zH^6VmPr+ZyAHyU4=I?v>vw{1cOr9N{S6)aSELc!b){r`eU;a}SeFgQ6oIcFAJg7DL
zrs}&p{kTxyK41X)Uh2m<efV#A(C_GfQ$OG7gF=7%fEDOhsNd}L5x?a@d(fX$f70nc
zIs0=F{Y&+CoIbKM|0()tll*snbowRE{Ltt8_uJ=D2K6!I-tmg+%uk5Etok%g-_Mz!
z1$}Gv1)M&*Grt7-{_3kZ{T63_UG$UGw{rTJ&iqd3SE}#t^x2)`I~@H1^^=`GwljYg
z`s?bKJN+DI{TtA~SHIio<2v(?ppP@zf9D0KujZWpH_&HO|HSFzJM-V7FQ-1#c|Y>b
zheFQ!Bg^glX|6tj(<gN1r$9eIeP*YR>a71q^wZTBclyN6{0iv*RA0yGw>s-@ivEoH
zj!vJ{ncoZj6ZONKK9jTl@#w?<?hpIJ>61J27oks~e!bJLaMr&KeSY<aoj!##{|x$S
z>aRO}31|KH(YI6o#_3Zz^Mfw<|FH96g8E2u@BB&W%#V$JgZl5BKD9Id2lN-!=XUxy
z&gXAo^!7S!<()pQGru}|d!4o>PQTJw|1aq6b=rD5{SVIkLFh|N@!vVl>F+!9r=qW`
zexcK6aOST<-%0&er$6SLKl{)RSAW{+^{wsKOZf-=T=n;y{;IS7=jgYn|LpWxob`vj
z=>NmcpEK%X$-VRElruju`iJV%Iej)~em3;>x^9J>KC`nwrO?Nn>JO{t^f{dQ_0eZg
z-^S@zIP33%{wMVVoj#W{e<b=^>ZdsUXJ`F$(05S3(&>M6=KqP_Uhi$M(}#7|e+>Pq
zss6A_PM_DAe+&I__0OC>le7N!=pU;ObIBj-oe%k)`BCL|{)C<8zcZ23$9HZYQlU?-
zKC9Cgbmr$ppI3cJr(f=@zY_YY>gzduVP}4G^!B=Lot^%Gv;Te251!@^8{zanIrAr?
zpP_!X({FOtzXbg{^&6eOm@|I|`lITPI{iau{#o?@s=w*<C7k&W(SKI|&gmOE^Mn86
zf3Teo_Ihto<lgyH%9$S*efH`8J5xG+1ZV#<ps%DpkJFcN=KqAgjrxjCf81GrP4xD9
zZ_S*(oHM^2`nl8nclLJrv(Eg%=(nk#;Pe%o`P0!~P`}ve2RrlEpns`;yVF;4<{v;G
zb%y`Wznwn2Gye+uAJji^`pVAym*|VC4|ds)yz}9qb9}?g?fj{$K918@b>=5UZ?6NF
z-sw9!>(7CH^bCJk5vQ;2%rAp}nfe+|f6ZBcL-h7KaBZEwrZc}A`r9-7cmC@1H=Xs5
zMjtfO@25F^ZD;;G^zqfNcKYPb?eiw|+0^fM`nt~i6X?sSzwGoioc;M1eRK6MoW8y@
z{{#BI>cd^}Bk%kP<IImPxASL``Xo-@(3zha{RZ{foj$QMKR^1j>PtI)V`qM4^l#NS
zaQdpw@okAd{vZCZu1??7ncok64)vp){*W_&68cK&=Q@3JXZ|wu9n}Bj^glWKvkU!r
z^~asQr8ECL`c>+0JAGtl{$upV)c@!7t)2NHuloP6^TA#RE}Gmse?~a_6CZu(S^md=
z@ASVo^E07Or9Pk2_jcA_41F>6KRbOpXMSz;t<|@1`hm{+JD?x0zOU1FaOMw1zd-$O
zPG7^BKNI~X^-G<;lQVxE`cvw6I(=hj{vq`D)t__vF3$XG=!4Dn-}%Vtw>bO%8oj;l
zT8L}@$9d;NH)noCxt%}RH9wxyPj=Ry9DODA8J)gI(6_f-=sTz{>h$NF`Q^}$S6|EN
zdj)-aYm9!0`u0x$pR+$b(C<<|#OeD4eR~@#xBa=SeumR$aMr&7{af{GoxWetx3?{F
zn;(CU|GtBA?|7AS)_)3pUiDX<et<vX>;JurzLxq|PQSpJ{|S8$^%1Ur9T()SXORE@
ze*M2O<+lFm>XSKrU1xvNqTi-Ir_&F1<`+c&kNUDspW0b}RrK%GH*)%+&ivNs<IVNo
z+1=?MIP(Xf&!v8h(+_v%|Bk+@`uR>jz?r`SeJAysoqnV<e-HWz>Q6fT8)yG7qF<x_
zj?<5J=08P$O#Mfv@8--8eZ&7?J0I?=k0JNYpRvyTgy`+{htfEGNN0btpwBeVA6CHW
z$2;>&ps%gIiqp?<=GR3(RDCO_pXki*gnohg{!YKdnLix;9`%!*ev&hP7J7S~p5;zo
z#hJeW{d>*d?exDp^N*m9Gv9yb1*cEueE)m{eKz$^oL+aSd>!-_eR=hvZu*zwoe$qT
z^CQdc{AsB^fzwZS)}I3X2=$qrzHP{FAMhjkW$KGN{mgH9PzCgd)YozPV9xrRqQ9%Y
zqtnlF=J!G$Y=QsIVNTy7)VB{9k3PQoKb(Hfw>)SO`mE~LJN<lTf3~47qyDhd>y-L>
zDQD2PR)5{;i#hARkA9^3H%>3|uf;9@KXyLM)jK1}z4Paqv;NrVH>v;5=@&Ws^8@<R
z>T^5&>X6?)pfLJ}>dQO*l5crXb@ZVZ`tNMw^!Gx3`+#52Csp6m>6d-Wg9f3`uYR1<
z7Y_OD1E!*{t$v}?ulSY+twP^Z{Z^;X6#Cl->_b0Q{b{FP^(_zj2mJ>1_ndxD$ZsF;
z9Q`TvpPhcqw>&89ZT}y3{ybD4OYWUNL!J4F(TCQ_lFsSZIrFojPoch$(;so>mqK4y
zeKn`w;LNX&zJdBSPG3LNw-4xozMuMmPXFh(JZL2PIqIi4{pL{LK41>|J?d9F{ibhu
z(4Xk9so(4L$3lJkfMe)CsK4a&TfXH%x6mhD?7#Dw)3<l_|2_Jj)Q9=k|2Xe_*yhZS
zD!22emHI?ZKPc3<4@iZ6y!xz8zvEjTlo$P<>PtF(H)nn&^jFl^bNXG*{O0K2sqgIc
z@16bWgFdEi%tko<9%ueU^qJMqcKR5hzkR?G^ySoVbozbY@}M2)o2WnP^mU#6Ig7rR
z`kPLFz?uIL{S@`@oW6pyKf&+#A8hBt2K7<o-uZLLnI9MZ-|AC3{cC6a8PLB}pU3Hs
zIP-r(A9<<&&WcX|#94n$^r_W1bNXY>{C4Qes_*UeFP-^=(RWZk!Rb#p^QWVqpnkE_
zzjyX$4f=KJw>$kQXZ`{7_IgWyJN+SN{uT5=`eOUQ>CZUxU!qT=KG<D9^3I2X&i;g#
z+xb&TeH^Dh>&#DzzN7l|PM;+7w-3mHexmv!PJjMe9#jVX8uc}t{$FQ*8lpd;zOB<=
zbmn(M|DXC_oxZ%YKcms7TJ8^<=JfwK^XH*2sD8E6=XB<8LSIw;ey6|U%s+v?m-@?2
zKgyZ^FZ!A4UpW0WXZ{ED+tr7==SSZ8Q`p)6=yE%MuBlJr^!kzO>wwhgKdH~|^f8_D
zCqMdx`ev}S)8BH|Um1NK^$nc9wzK}0=xeI)>h!wl{dy_=(Dzh7%IP~e^CzL7u70l5
zYs<gRUxt2%`oEn1Kj--FLVrvBai_oU?9X}h;a2+ZyzTT0ocWK@XHfs2(?4|Pht!4H
z`A}JXG`V;F{Os&ceDpokfA92<o%xy2FH)b+=|ec@Pcigo)&K1DPo4R-(SK6k!s)j<
z>+gU*m42A$>-5i^`9snFr2aRjkL1jsiN2xwrB46SnZFMGVD&qlezS9Y520V8{+!dl
zcIID0e@gu$r;qFG|7-N`)rWZC5B1K6x6b^Cayx(GtoGj-&*^hG`;#1fHuV{u{=G9l
z7y2sdi#mODXZ_{ScTr!<=|4F08>1hozP;18boRdo`Z?-{IQ=JQ{#f)o)X#AGPR{-;
zKz~L3TBi^Cat!Qk3;I{;4?6vRXZ@$pN7N6ySDikYGyfs_)aqZrv&ug^bCQ3V6IKh2
zs2d$SPj0A>1ur5`053032CpUm9^Ooz9^O%&72a2#8$Lo_06tk>6h2R08oo+i5pJ&!
zR1JPWeI2;HK2T%$WA*Li-sh>e|Mu1${eS9*IK3S!?_;K;kG9sIv;=)bUBGtqY1JP^
zpFsT$^kvmQMW0Q5s7L<)W9Lsx^)ck$_4U?YTzzWv!_?<MUt4`?^fT4hK;KM#L-ZTf
zw?p4WeRuRH)DJ=btNO9%AE}>--tLQEi$09*WZH>-k>(#lpG^IE^mbp*BlP*y|A+pN
z=10{x0d~Bqt4}Pq<E1~73;G^?2ld&}>*ggWKl%~s%b>TfB~{Sd>kKtQA48ur-O!)X
z{K4qcs~>~@q52u<^Qm8eKKOcn<JO@sseUW^xatq1ucH18`poKYpl_`H4f>MmLp|}=
zWyh<7`p9xSzV*~6MBhh!O7xx8XGK3;eF^j<)mKG7S$#e9OVzhQzf64>^oP_BLcde}
zDD=0~PeXrF{XF!a)UQE*UHxYCv2`czLG(}5pF*Er{WbI-)Zas2O#K`55rXRz_^JQj
z{~urVk>z$i#8)2&eJ}MX(Wh6R0sUn4dC})rUljcs^*^I8uf8_=qv~6tudlu%`g`j8
zqwk=8IQrll{r&nKeSh_{(Z^T668#wUd(h`ne+vCv^_S59to|PQb?Tp^Z=*iwS>WgU
z9`)hmc0LSI9|!#z^-0msRG$I;b@fHiZ&P0p{Tua7(O*;F34N3h{`KjN{)74v=##0R
zh(4jd5Y9oLQ~gr(KdS!=eQEW(&{tJ|0(~9z7tnW6e+PX>^&ikrS0Da);PD-!K8f6p
z?<)1_(N9sI1N{N@KcQc!zAXBy>T982r@k@z59&Lh-><$W`h<V^*K-*9%j(CY&!&DB
z`UmP4qc5+1Bl-{Occ5>t{uuh0`q}Ip`myS7qfev$G5R&?KcKhAMuvLf?}r^<dwr=G
za=SgRqWKBYKhgZO=<R3Ytmq@@mw1KH_tE@P=zmaO9sLCL4bYcR-xj_7EkZZ+t<(=j
zzfJR}p`WaNF?#!3fi>vYtKWg%ez$QD{R#Ew(A)D;UPEuMU-cM$T-|r@27TDg{_zg=
zGVt>~jr#a<J0H@hPmR8y`poEyt1p1QvicI}>#MJdzLENR=)0?LgWm3|?Sg)a`a$T2
zYW^tntJF_J|C{=G=ntx2gMOa+&FF8cKZt&v`cvqG>6g;i(A#6H?x9br{tf!enjiEk
z@bf*d`p9zoe1D=o4*II<Q=<Q@J_Gtr>hq$v-`y5PKSBM^=u_*yyxQp3t8a<Ep!$yJ
zPpa>azLNUk=wGS-9er!{%h4y?>hJGn^uyHeL0?$?DfIKzUqW9;{XO&>)IUexLw(Te
zz|Z%C>ch$H^L?E9IOxx+Pl|qp`V8prsn3c2sQRMlKdCQ={*L<E=p%>muTOjQ5%otF
zebJ{;KNNj>^^?#SRR0J1pVco%Ut9ey^u5%dK;KjS1@tr2-$6fK{ZsUt)qg_2Kz)oi
zfuHaHs!t}j&-eZ6)1nXB?tgqP^ykzULZ4iHdGt@zS4Uq&eN*(Ib*E!n^bOSaMjv1O
zVD$aePeh+l{S5T8)h|U~O#M3ad)4nkUtj%U^!L?YK;KjS4fIiW`1}79{bco_-Uc4u
z{OV)K?f7n1pBjBr^*PXAP+tK3AoXR@KT=;6{UY^^(T52a^!2R``V;DVqED%Q5c)^z
z$D_}sej577JN?UDjJ~}3HRw~Q-+{iC`h(~Tt3QXnt@>-|?RBjlIepSE_stB|=gVvK
zgEjvX{9`%)dWC=I|JQEMLzMUb9UC5Ao*cfujNfN~Z<YTDAD}tK;7zs8O7OPwvG7Uq
z8FKHu_4XmEey(4GezE%PPOl%azFvV7=+~(~3*RKa?9BOcvHyR2fd0Mu*N&%kKH$CM
zX}<V^UH+(0@BROJ$HnW5=@P;@?)8h*$CZ2g@a2DkQmao6&m_-;Ibk#>kK^9uj#OX3
zad(}i9QXQD>dQIquCtEZ)>&PBGkAS@XUvJIb@p@IyWF_mmHzTJ$Z_v-m#ZJ+xYyTJ
zKf!T#opa>2&Y}MJpk?r}@=chNOqaXYaqn{H>2eP`?p<!`DE^=`j(h!m_2(UT*Lg>7
z>-<yec?RDh|BN~5way6t`GK8pnS%TOj^em`xd|Ni);Ual634xMmFA~&-0Qcf&*-?<
zuTh^@Zr3a7m-l&ZrO@Y5U)6DM{xi+5>A1W8rjC1kDcu;fblhEk7stK6xB4EAyXzk!
zxAoW8`hR1uPk`Bud-K<5{(Q&1`RjCjS3B<Y5p@5<ddIzfqxzkWd%Zmtbg$!HZ?98!
z(s8f1=a%~0aj)O3`Pb!keRq6$pZE6I>Ag82^mE^H$Gth*H7D2y|Kn^<Kh22@pCwNK
zx64flKcPOW+`ituY2sgA0mr>{=F&QgIPUIGdB?rpo}2Gy$KCy@C%5ZmpI@z=-kWny
zm)p*9cYpd~&Qo2lk#PGuI0bH(I~QIsxW5mp<+eZZn)<%gac`Xw_4C(G$KCxo>bTc8
zQGe2LcYiL+ZGUEIJ@=j7o3m7N9y{*t&qvI$-^+ymi1SMG<G}55lfhT1&nUP339bFf
z<G8oZYg%Uk$KCxY?YP(H*7tAa9e4MqmfZFys%{^eJH0ojujaIN+})p^m~%qcYbgAw
z{5QB=?jP`^TF-L1?N1i%&tHyv>s+UGZgt$<pM#EjeI)(7aMW>ke=f*vfBI=X|2n-l
z=V#5i@3^}^?=YvJ=7jzfc>dIv$AH`ACW4PupH6Q3Q(XI#({XQ|L$%I4j=TF)+;OkJ
zuD-P6UT?44Tg`E=|4~0*)N<V2&t`Jl&!<{{C#U!3^wXSfj=TFg1anqt&P4bL`E0md
z?oxP=zTW*MxBaZ7{oL!gx6bwU^Oxi9e*W#a*GCTTAMXo}d;QT}zTbA->zk>+=eWC{
zujIC$^|k)spZ$5>`n@^JH7B&=?taFS+nl7DlN?@9o)K=Bn;YIveQ~+%X9Ml$&yIWR
zyrFegbKKp}Mvi-Zo(TT+Z05MvpV5AHblmGFs_*K!yPpH)wht$?{;^K)&AF&K6CHQ=
zb1vqL)tpuERr0NHyWIWoYwG`&+kUpweqMLnTW6GrI<Fje_w$+KUf*2(E62V5lJ+xL
z(3gLFd9(9sr}|KiyZaeUZu@D!uSx9m-sOgg<gYWi<L-WD#+)F1Ka(GxR9+fxms<s1
zL46~+?dL%4XIsa;b>`JNJ38*}XJ5y?{x|gl9ryZwwVz`g_xi``Cphlz=O1$0&sAFg
zGN<?EWQ*+Y=PJkD{oIZ@?KI~Ie60Ke+%ESfe24mHa@)@d+Ru-Ud+ThWbq4dU(3dys
z?dOF^j(hzs_0b&nu9v;8b|S~UK7oGzP3E|}pXue^f4=-rP}0y}ml5=%(|dCoXik2|
z-Tf?!IoGrgHQ_;;-wbY-+a7L@J?<;F{h6!%9O1aP&PiJ57{|SJ+I~)R-0PpH|HE;w
zf35R#spDQ>BC5YXD;;<DbF<w0&zJuR8msGj!0Ej?qc!J<<L-W5!kh}4a~IxD{t9lF
z`x!n<eI#!qzr5Lgu5bGFpF!~)_tv>v>rCXhyPs(s_xgm<{5k0z_xhmSzUOw_>pQE@
z=eWC{CFS1L@Wuq```fBc@6Fk)IW--3_p=4&?9e`RfnSpkgxlqgf=AVQrpdkkc$d3R
z`?=6@Z=FxI&ZUlfy`7&M9ryZ@(fxhf?6}v5(|+!E-0SD4KkT^I+x-dW<hGyfwEkO8
z@6EZZId>iR=GgrSZ!jm5=7bFKCHnGa^DD@s!R>Mr!279BBlj-GyWD5m&+LwS>r52G
z-=Ex$d%f*vQOCW$i~5p|d;Qo({+ud~d;M|sH5~VP+s`I)yS~@7{tiy>&50G$pWnrC
zZ;tKfub4ASbH>AW$p3)b<t~OlRliYg`x(^CU(asGy>*t-I`=#7?&oR8y?(CxbB=p`
z`NsbIn~r<^2laOxclYy!-1f7Ae*Ovy`Q?MZym{;Q<`j<Q&kyOiyPq-SHYcj)B!y>^
zr-$3+=7iht6N}1iKjUdXD?0A2v#Zuw#qqD#SNqezaj!q2zKP>rZ=dh&9ryY)vHgAM
z?6|w1{pGd~J9K?VJH0ojt>%n(+}+RFnA1;lR={V;H^c36_rg!8KP|WY%&Pso>bSSg
zd0OX9$Gvsh=lc`Kz5b*67mj;<G~IrFcHHZ$#_{(vM5r(S`0{4!vCsD?a@)^L`uR7Z
z(|dEKYfe(f-TlmnIZw3@dErqtza-o)_h)!P^$p~<{<hlBHjaDiJgIfIcidZNJnc_!
z$GtvnTz`N1JMQ(iKcnQfKeM!+sZQ_BX{R|e9e4L<Ip);YoK0}MpJYGWF83sSmF8TP
z+x`@5?q9D5j(h8zuXR3g+*@a2?azOXd;KT%pB;DiCqn2i(U&*dpQ!qIKd#(ck2mM1
zc>a14I_~aII?Oqt>y-=sR9+Nrms=j5RO_iDxBcm<{b}L2x6bZbXB)@e>)Rdk`)U4Q
zr}yS;*PP*wyVrLL<`mSN1@QXvwQ#%Kt?;qx56kWP4%hWP=eW1dms;l~$KC6D2lJn5
z{!6F#=KL7nKfZ4rcdu`lFkhlCZ+4!n(wvy^6Y^wmyWDi}Al+}1TW;6)cU|A2j(h8D
zt96!i+*{`WeIHxJaj!q1zJ}xO{xp%>^{TJ+bZ~laPUHms{&aEN-Jf4EC#mL)hZmIp
z0k_Lt3~#4?qulmqo%Uz9<K8-pXr22V_tyDJx3{Mq_xkDT&pGby&rP}Q&k3#PsndIN
zZfMR+$KCx25%x>uoIhhVCn|iEJQ3V3_j~v?_1WdNKRdKPg&g<R87HBC9E&>ct@AtG
zepYnc>)WZX;<&p%4dk{z1$F=1FHY~x*`PTc9C!DpKjs8!&S-d2`82p)?tFL!^=sv}
zKUcIr+a34T`9SO3?YOtj)Y_lpj(h!2iTwRM?YO%?SLL=ptF)enPVdbbt~pN~clYNr
z=CsqCh~d6`@Rv86KUN+OZkPKVe24nXa@(K#E&S`1&v9>^+qKR@j;HzJ_Vu@{<6a*(
zu|KDx<6dvypVX1t`jhJZ#+FX+&8e$7zc}vAv7gs^W6m{Qui@|@&7Tan%bg9+q<*E`
z_9uNy|9Wk9+*{`at#iBMX})-W^@knz`iJU|JMQ(iKbPdTKV!9?yH4-T$&$oh&qK$(
zIkrFlVNM0j2^;=P^ySUwx0A<$+vO&K&r+XWZu^s?wZER+j;H-{QO&f@e2#nTwDYH=
z<6gf*eObr7-u9=4+}0nY`(v9ry*DRxQhz-y9e4MqJLc@r^%@MnCZ7Pe%bfv_s`V_D
z+y1oF{%mwS?U!}t(K<If?yWPQ&Y%5`d;LW9haGqK=bYU3r=8Yw%jvy27d7Xu<L>^v
z!JJH*6Eeb=5B~CI^DD@s!R>Mr!279BBe(tOrv1t8xVO$I$-Z7(P;STF{VD3W*Ed&R
z(s6fxs>p5q*R-C7PVdcGp*c+*clW0==FHNZ0q`C2F>t%wDe$N27s_pae%1c0b=+I$
zO|5gI<K8;$`@`Lidwt&I{(kOv+})qka@(H@x_|zf(|dCUXwEIi-TiriIZ-tyDB_n7
z{_<w?Gsz>t?Q-M5>#I*GxBXeD{mJaOx6X}PXLiTEb#`jx??WNSy*}!9z87`e-Jgnb
zTmKHNr>@g`bE;}iL&x3yX^%PmG^Y=ImV5-<F84S13H5X3wm%!RKPw&g);U7!T<f^E
zPWyYj?T&l>E%mz{clYPG-1aAvet+?g(|dE$rttUqn&a;NJi(l&x?UgPQ8hnYq%T9i
zyzz2lzzeER_CLDr1-|FH?F0B|NvurCAxoo?!-$AsG=<R8Xfzs)97dyIF^6i-htMz*
zVmairm_w4#M2?Gv5Q`NzOG`@*bBO16`F^hZx%PRz?%(U~x$S*_c73n!^*j9ko3#h7
z^Z5_vQ`@-o`6l|TXI%Q!*RN*ACBGT@7RK#-UV&?$spzMx$xEF(sMFoJozDQO6N5S<
z$dlj`$#vZs<mt#Sg6n(&2DtOJ+PL&tzpC@K#-&ev|MQJ;$xlW8TjO><2jDs%e|(*L
z!sMmSVbsYsZs+p{)ycxX3dr-}_do0v^$uRQ6nP-}c>=EU=@9ScP{X+N`9L-2wT(-k
zdi^vuF8LVbn;EzBX$#jrlh99Rlb1T5qfS@jc0T>6P8jM8C69rRCD(PQktZWRAFlJ6
zg!wEtE`6RtpR0}A`Fv$u@(rGL^ZdrRozEV)&PV^g@2JU3oe`*W!nmE!1*(&deO)2X
zf)^>}74;5Yw<Ng_{$8&FT<3ED^QmfF`do`XYZ#Y4_5I;<#wB08x|>g9<90r+;M!*l
z`srx$Ql~xYbT)41)0^r9qRwFQF!%@Ly6$B1c;r8Z>wHdPK1+;CpJUPIa^rSB8;nan
z8~Lw{+xhH->wL1%PnO9`ohmiloR1o}^Epd(l2Iq0JRSZoxvu*F{sjT;CkOe*;5wgN
z%%`$(>GO5;S=G4o`Rq>De?8-pPe=Ya<90qR;Mz|Z{(iQ-$xEGUsMFE7olg&{<AXW_
z$phgd$#vcF<Ppfvg6n*q9_04B$hh=btETfM#--0|_<O*$#w9-v`3=VHe7=S2eA3ZR
zrpZg4{iu^=+|K6=)rm))Jo04t4RT%gzS7=e-l6?uAYU4;^Z5?*dBV8#c^7?FHZFah
zM839h$w$?4^Q>pw&Zik%`w7I~N4GP1sk0Du+8ej?=|**Ou&@5)KBzy8T-O~<UKja~
z;5wgx!ERskjZ2?L(B~rK(q}{5U#pEvJ~-IbS!>+R=Nq`rCmH?hHF>Es7<Dp@+xeWL
zIuWRoOCAruO0MhPB~L~Ep+~$XyhG>H9`mVST>4y&KA$iyeGcvA=1{}9<b7&8uWelN
zO)$^K#wFhc`DVr?|2*<-jZ1z#@~;?|{C~f{1lRfd;5pF8<fTpl>hw1*b@cmh!>LXN
z<~D&m2R@5j*Zq{-AN{O`>-?u<{$ClFK5N%;^ZdrR^r`dTV_fnRkUwDD&hxl&$)7>~
zlyN)H3viuhJo>+4@=~YjGp^49<9418;1>^Sow}$~hCBjZnOxVcMV^FwW4O+9Bj(x4
zxb)c-eYQ1j=h?})<ToJS#kieMZ@BI&2mK5-d8u;)b%q+Z^BGTdQc-6nc?NtDxvsmC
zJRkY5;5wg7%x9-@>9bB<cOLf`mp&i#{*mK|ami0a{<v|;x552;*0|(zkiTGD@-HL*
zk8#O2uIJXhZd~$uzu#BJ`@lPN{t@_j6@R$wSL%F#I%SMY9lhV5qB{PlQ<uChycxN!
z`x1E!@}1y1|F?#?ef2OdeQrdby^Tws4|@N|G03>&A9~jLyT&E2^B-+o@_mpWZ(Q;^
z{~5+5|1I*fjZ3~g&evzgC11Y2>t~s9$?N%A2iNnJf%$AVd8yMKb-pt$b@Y7wNOh7>
z=QMdL{10+n_bPc7^7lRFE#@71zRu%(l`<}U&O)D$8kasFbf50?q;bjTA^((dJD+FZ
zI-k1u`JzyhmpacjaB~hbZs+qV)yc=cqRIVHzaP1-JA^z8`O$El&rQr{nsMo~FZ!He
zT>6|))b;<Vami;O|Cw<+pD*A#pH%d-#pI<<vFBX<?Z)kVexN!rsB@A$34VcG*ZrG3
z9r?R(olm0#*H6i^UUS|dE`2sdpQVgTpIw@{d`07uPeJ}k<90r^;5r|F{5(~N$xEG+
zs1s`3&gW&SlZAank>|sElk2+gkO!il_ux98S1_N+#--0v4c#238J9jg;`#H5ammLb
z|EY01pOtW(&p7n6$>gQZ8r0ch+|Fko)oF=3$H;rZ&ywr9f0Cyle+#bj>4*6|P|j=4
zJM{WFi#|&lmp&8TaC0kXT=o^($azKMlJA`8{AuHopN)Ji<C53+pN))5{u1&{jZ0pi
z|1ZIH{#UTyNRyX34MJQ$QO2c?KL7htosFoIKz<ZHnq1fYklYtPpY{n{=l@uu>t~s9
z>9ZgDTxneT?1Jm_OXHIN4*9Q*OTHWO-y4^F#l~*kea7uPe}d~gd!hf|OkV2rK%Mi(
z?L4niogmaHieF%&_4Vf}OOflk7044%=V`dkvn}TNjB)964*INbT>9*b?=wG7^-rMw
zE0ovkB%1Om$oC`P2p>wW^^?fYAwM0i`+5ianrB@0^;cte9v2$Fw=bOcRmLUXrish1
zF)n%iIqfaRCI1=n+l@<J@4Nl*|DH$uoZ)ekmpT_v=ag}&qw~B-b$n6hI(ZP>w}SV{
z-ofiWOdg4R09@y}3G=LOT>1=X>gE${+|DP&xa8kOKGe9KPaC-Qxe@(zGI^=<4eE3;
zZs!wAbrMkLUGfz87;;^AD)}zt=fQP8nV8S##--1E^tsBo^w}5J+a}|ZZyW07xy88T
z2O_`Qxa1cjzu&mzM<ajCxa4mkf6}<*^?E*UT=J24|8vo}<fo(lHRF>10{NT9C9l_i
zvB$j+yhG1#^@?u4kHTf1Qs*DkDQ8^j==EQX>g3|Q)F&^F`eEd{ZaeZ2<fGtveox~3
z_A)MgR&Vb5k2P-RnP6P<qmfTEZs#)&uJf6TerA}w)Y*eNvyI#NETuY8sI!hd5x$*V
z*WF9L0{LTbozEYb&u_-1&)ewpym339%f=<&>3KKLYsMu%7uQ?Sirxp_q1VY8<ck@X
z{1W6JF)sBV2)p;`K4pzdUa!w8aGif~{9NlZCNFhfL7n=>rH)>oFHoJmnA@x5x$tOm
zUAGT;dGwP2*ZJQ!-0dsLxb!&&eU39Oed^DpBpa9fDdba(OMVUJnQC0}4O+N$mm0V8
zOo!_{6Vd-Rlb1RpP-lm6JI^et6M{OwkVnBUlIyxx$R{CRG{9@ZJ9M6{M!J1HY+U+W
zi#{JQE`93rvyySi7k|OksbbvDrw&}_lZ$?un!MC$k2=pAxASRFbylFx8{~W8vE;h$
zVDbXwli)g^ZkW$h<I?9?^qFkj&S!yf$!8;<YTV8z4X*Qvdcw`~Ym=8cRbF(y&A6RU
zCe<mAIzN+#z|WKGy7}a>$lrnMd<J1YC7$q_^A2(8^L6z3uyH$|$Bj!q9r;Se?R;v&
zbv}F1Pa~6;I@eIAsc}1>c2s8)>by?A0^W;U*BwZH0{KyJozDc!XOeO0vsO!Y9;X_&
z^O<X0^5c+SVBF4U1zhJ7Qpwf-(&VMie$@HexSh{ls#Ab{{Y0)mxBnZtuA4{R2L0TG
z>wM;6KE*0|&3T7jKX=h*3FCG?WsS?eqFTBAK5pF3ry5-6vjY9pH+iYE5Oo?ExASRD
zbz)KHHS$UD7;;^=Klx_l6X80awV2O1<I?95^f}46^tl!96H<&zKDf1;&s^hnK1<;`
zpYr&*`gJBRbq1r(m&WaUc2S)Z*w>Hb1@P14x^6Ccb@X!$uJdX2zS~#PC%xvpLtWqJ
zJPg-;O+uZDCNKM1j(t68-0rIm)oFt|P03^7ZOC=qj^uNZkAZ9d-LbDY<I-m~`iwU&
zeXif><}k{*<ez)Vd6IF-Z$f^mami0dKH0eBb)F00I?n?1ztZHT&Qa9)!nmF1R;sfZ
zb@q{;fFC2*b#usz2fF=Ug6ljdW1csSOP>$6arryOrOyn^r$nIlfp<t9$@fJ5VdHi_
zkHd97v4QtK-REhOmpUs@r<QR$pC(kNI_kVc-Uc2?uIqLuPeeWruJc)o`6L>bK7T=<
zql`<RyD^_h#wFjdt=sQZ<90rC;X0oa=x3S9OPx`uv(mVo&t|GK7j?cT-wZ!YuIpx#
z=OTX*uJgHq`CKzDeXc{FH;vo<7OU)qyhHcfrt-ZHeIAADb#)ze${Dx&twwc<qfUMD
z>hLgfUAG;16!KAU-R}b*xITLsm;DB}a~^A4`h0YZ^919PACG*ZamnlRWE{MRXWoB&
zHdl6aW|+LxIe<E|jY}Q<I&>-3NkpA><a6QM$#vbm<a?1n2G{vC$9#S>E`9pE?D{`%
z{N8?hIlpXN@?DU>X57xFXcZ~?|JP6TDy~i`xb!1+7NO3g#_fEnP@UY$uFf;$#Zf<$
zT-R+)9)f%%yr|cUtlJ6mi7_sH9z~zMj7vTf&y#rLlCK@^`b;n`dA)v;;6*(1{^K(j
z{Y*1?sWSw1W*C<`di|tQoha1#f;<tvg<RL&MZN<0!|<ZsnzC+SlH1ow<I?8}^m*F2
z<n{lL)kWiyFY=13bIJI<`QUoHX<YJMk-uYH@~8Cm?kVpB@6dVbzu#0IUex=aC9iXP
zn(~?0Zv*l?cnfl^|1x>NQ*K{f;JWU+NzQv4mwj!(zWN!LK7Yf$-Zd_HzxJ-qaO3yp
z_MP+baGk>_^fS}srA|lGnPc3}XBpKAMV<BJ(eQ7{b=`gBQ;|Oo*ZGV~a{Zq*E`3f!
zpBIeV`TRq!_t#yx&LJ1;`UQDKy+hWO`Z=iYZ`{t|Nx0TYL!Dsqz3|55y6%hQw~_Av
z*E!5fy4RjhH{;UhW3M{zVceeg0aQOa$mK_vywrIEb>25__dAX11fb45@=*A4a$R>F
zc^vZJ!gasPvEKv6rO#yadC0ik?<uOEiTb%FFLjQgPM&eQ-&<5?D(V!k>V2|z{P(=W
zA0yXwpCr#lzBXL<y9xVkY+U**8F6nppJvAGe%n(0(5f!q+2o~82h{0m-0rs@)wzv6
zhmr@N{#bHdcN%#(^7G-k-`&{na^uqH1oXMuxb&(2|4_a%F8MRae`8$o`tt*Oj7vVG
zgPYF*<C6cbwDaS}B|iiCQ^qB)&yx%A|6UK+?-i4mI>%9`z_`@W*PREdc^`O()`>%%
zGUWR24^}2mL%tUIR(NB$&i`c6z2$sb8J9l&Iy!G_T>8}ccQP*d-pF?`E_t1QZ{w2R
zj(k7klGpjaYh3c>UUU5nH!k@<b~+z#T=MbAPc|<3e~_PTT=M&n|HQcD_53b_>v;*N
z=GI+r@=~W%r1MS2rH-E8@2O5U&dXu)+we2wy6*4f!RY5YT+i=cNv@y!p7xsX4sq$T
zCHj28xb&&#_fg}L{}lOh#wD-k_bKC&zlQwN#wD-kx4v=7zuL+5*~qx$b^b5Hb^cSa
z-w2bJI<rwH(zw*o`M*VV!cixlJP!UIxvo2rd;#*a;X3~!qustfrMwURea6+4*FLvU
zek<zlA<u>%CD;0=$^Ecy9$fnzjy?;F%RKjEp0|z5JoW41;?=zmyhE?6r#id+`Wd(9
zu{>PQV;uUaYVxvfKh&vV+@8k}suPSlt;oaS9m#dwX!23W_lN6z4vumA8fsknT!=nL
z7?(cv?`J0%m;80)rx=&K{{7<|<C2ef-K{&%xSi+caGhs1`rlykQfCh8d}Z9ub2rsl
zfI3IWx59JCb=`~PdB_*Qb)F+9x_$Xd6W*cM&jIvV+_?Nv=TpYG>?<hB)hTaW{;1E5
zAh^yayt>QRGkK}gA9bEHE`QYfu_e{<L!A!f!SL?nx^66aH1b2?I-gmX&luy<=OXku
z!MObKn_g~TGmT5W0Qot_@8$9J;9|JWXEXX)Yw}Vjtc$C^!MOZU=kp!a8HGBB$mhbd
z$#vcH<eA7{f$MyhPI3L*dolC=sMpWC=+jr4hRdhk!Rx-iarxsx<jWYByk0+naGg(Z
zjeBK%YMZ?Lu}oLz^^8j$olh9m$-};0A@@W5uH?FIFY-|22g7wfUr%!Vyl-6o*cN?`
zF@A5qxPGP^mp?8>ex`9dpM`Lp&s_Ag+T`Vr7g1-eaXX*wR3{pB4v;6pPmt@nzmcaQ
zpAXmh?8W_c+qnGk$v52Gd}?_gc!%cwb~*PmF8M^{{f*oC1i*DZel=a48YVAwwxdpM
z<90rwR3{VrYD=C6?@X@i#*hb~pMh}QZ%<r5BaBO*|DezJjZ2?8pDD&AA0F-YJKeaQ
z&pf!!XB7HbZt_xRChDv<Zs)Uw>V%@s9`b1TQF2}PH2GBI^WZw48l&C53XDsid(h`?
z<95HrgT0V<=zjB1|1r4KmpTu1bM-42xBIP5b<$AhIr2>S3*@?PIQeblyTWz9FN}8m
z^f4}dzJNaa8^5<-JWqxim;8L>M;N#BnE==MMAvfb&N6wa^DF9nY~0T0bE*@7IvdDC
z;Thz*?tbz(<WInLK1XoBoHH(cmhJBP&oyr6bH%vi-$A~>xSfx0Z7<{<I-gARQyQ+<
z&zGq4m~lIwAgVJJb?T9)!JCuox^2j_k?#!G`CP_)dK#DgUPPaLjNADPHZJ)W-*odF
zYTV9e3|!|Eihu9^Ba@dplTl}uaXX*IROdGKwU#^p^|zAiy1U84kv|I8`IMgQ_LXg1
z`rM8_bBs%${&+pgGcNgZF|JO&amklM{x)3ala78$)bT>zq5bIlmI`pq$01*hd@8&?
zxz=w+z7_eG;kxeYqh0^68JB&<$2fo8xa_MmzF+qi)epk&B^X3`-B%LjbI{K;a{WCF
z^T@USQu4Z3cRgJ9RSD;JyK&jqKJ4o|<FYS(KY!4;<g4^>b2w~V@&P!%r;ST~B=Wx*
zzgHjc|1ZJy{3fISTP81ccA(B(<5EZG`S3H|2i~D|B2cFyc|5#2xvu*xc`EW@aGmG2
zDQ*to#--0|=rh8&^r`Rvqm4`c)t;_SjBz`kIJoZ1r;f`HH+iWu8+G0@Zs#+V>SSPF
zpOELkKPT69)5-nO&vv-Z=LF`n-?;R-AAKG)Zs&8-xa6OD%kB5HaXX)jaGg&)`nhiM
zQl}s4+%j(GQ=+aH@(!(27j?>!N5F%~b=^ATNyvx7bv~s>yM47WE`2UUpW(*u?HBK7
zqKr%aI`YxR?R;Y4y02{X^RCHDo##=1xN$q5NmM5lb!L-qg)b)8b<@c6k>3K>`E<qe
zYPWIeGXZ_>H*V*1%(&!#K>nn0$p`In^FMD~^3{4fzi3?Yjgh}b-VR>0o)_{C>0j!6
zfI7vDOC9}rgGY=@{si)6jo;fBo|9GJdLE;maeY2x@=~W#ALsRrOC5bqzCd-#qt2`3
zA@FE&UAGT;Eb<9(J&*1197r-QeZGc1#~GJCJ7J#5#wDMIe2Q^9pH#TcXD|Bs!sMmS
zWz<<`+|DP1>P$kNAIMk0Pm=4p=g3bWe;Kaxc^31zV_f=ty01HrMW6LP@D9!E>+-|K
zC7*=+BgXA~D#3L=A$48-S|%@bcB9TS#_fEXQ=J0r>t*uts2@eH>-HpXgM2((_uC)y
z8D(7hyoElKj7y(gaQ#d*F8Rn<x8G#rlJAN90^^eZ0{K+qcAjZ)o#zVl|Fy|Woqteg
zn{hkOOsW%$IzN+7f}bbXb@RzLBYy|3^BjSB7OU?y=N;OAKs`5~GH}i7bK@z>pFsV(
z<OT3%<XZnF^6FT(6I|DwhCX{3mw8t2=lbkzT;`d8^Ek-3<VPd_u5ro#?d$4{HZJ*-
z$d5N}&-)Cx&TSI<Uug1DC$PV(zu34v@9U^e8`RlO9t%G}uIv6pJ{S43aGmGBnCD-{
zrO!_2^B?1OzjvvA0qXlT@IKi)q`uUdk2?Ow?S7wx>)bY@PB8ficw=&1_eJvJ&$>Bx
zfa`w!KXl&Bxb&HYK6@CKKHtOjGr+jyYrO613^H!#^B!FH6^nkRn7q_^2X&?!xAXaw
z>QqOaRpf2pUy<v&JIE7}KLpqLG{SsN8J9knqR%tNrOyeN&mYDm|1a`?8JB!A^0$mj
zzH^+L=UwBHpNo9S=e!TRL$9l~$d@uM`89aXR5UL2iw|)1pENFc{ri+!a6Mnym`{kw
zOP%(p6KY)Q==1Pps<QxfqR6+xdz0(B?~vyq{~lb=SD9&UUz3eXpJUPIG~?2zp07`g
zOFkR<PmSC8tc2@)!t1+rH<`TDsWQ;{7UOn4`>2i|>Kr2vhMy(Zb^j!fM*bFD=Ti^!
zd7z=!oOkH;^E&!0Y25C&99;Li74?HmUiSMb>Qpyw_uGi-j6$83<O|>($aUQ}$TN}e
z2iN_+g8dGneBB1_ynH};y>6#dJ`eThll!603UaN#o;(!!47m2$9erjRmw6t>JhP17
zJ1@Ol|JlYRU+W#`ImYdI%!BKBT!4OVn7q^(ggXBkx98EXkr(m~trLwp705@ytC8!v
zb;;9^Zw}Y_48nZEDW8daXYw3)FRJrC>cmmLC4N8H2+HgAFq!f`$j>1UgfAi2`d^So
zApZ?q_d5f9?xg%i<bR~R_L)QZc;x>iPln$l*ZRI8h0kvW@{ho^&$jrwyAtIykq@T)
z=h#<>ak<_;$MqI!T&_3$d6ITiKM(aI$$c8S>%S+}*@1Nj8kcqRu<l^vvabHz{`<xy
z-zwhKA7k9!U(?}wU&NrF`6e%QK17{G#_j#JhUx^O&Nt*?@V(@^?qTwH<a6M99#3FC
zdB&yB4D^|A+|K8=amiO0<mThk*!#dcw7$Nt@Pq4ovd~Wjlb1SgqRtb>?R<i%PBQ8=
zCQpaACf9W%$a9eI4%hzcC%b*cQQil?|7|FF8TdG=(-C!&jmv&hu-_Ep_PR=?`U$B2
zg~>~ulc=-KxSd-D)oFk_KafYlPm=4p=g7w)e;KZG%f^217?(av4R-S^+Qj?7J2bD?
z$-{8HPR^lzMU$60@1f3<#_fLVP@Scy)0BJ{ybZao+mZYV@-cAj|6jdMj7y*E(PzAI
z>GN~EpC4sh@+F73`6L;a{95Fv8kc-8<dcm{Ugx<0uJeoxarIZ4ywq8RI$s#K^V~{x
z%An3Za{YaV$H;Zv9P(bMa|y2VtTe;*dDFP`c?NynF>d!;qNx}14&CoA)Gr5@`cg-K
z4`)T=cE2^L&N$R*M7|W>l3dqqPkt2nXt?gT4)z;sT>2c7;N}o#T>5-G#d)G}$)7@g
zlyS+Qs^apKj7z@3yUwQ?xAU9}*LgN*?DES@Uh0fMot4JzJU3IFE11Lg<YiF*FuAUq
zP2Ljui*TK1FU<3rap`j{`n+k}&a+sk7xE6hPKpn8`z>MI&a<p>sow+n$Bo;0R)gz2
zm!kjrCNFiCqfR5^cAl-NPA}AXjeHzDhFsU}PrecPM7Yj#B<4BJxb&HgJ|`KMK7YaA
z*UX{%M^QhOJQu!(>g>UDb&GLXx5_YgUbY*Tb@hGYe&doKiTpw1_Pm^g>v_@NOL@WM
zrOpo2`NOz9FE^=9@g}a%2by`G>>XOaI=l?Iu3L#b3i)8To|i6oA0A>{`n-ldLyb$H
zU*mP8jd96`Cb~YujZ6MY8RuQ#+J6%I=}Y-zxK4%`m-_nqLWdcb`rFXYSmTo4i+&~=
zmwfto*Uv2DlCM16`Nzg3udjnk;M#u<`cF4`snZvAHX4^Y`gPV$s*{R3S>ze;U&wXc
z3*`C8Uxn-W&Br|dH7<QFK%YgLdmng*<{x$+`aA^J{YEx*^QlOA-B(S@`y=0oye_;Y
zxz=w_9)o-|T>Bh6)AiHKxa{jH_7!Vf=CAuop!&N|e+=byUo$A5g#1GCRQPIgt^Xx?
z7V<mcy07Wj*CFGwul6I{evcTp`#NJ>^2?DwYusMXf5G+q)(v&_Z=1Z-`4e?~p7%cR
z4((ItQwpwi^0BV~a(~pXL9Xl8Cl5ou1zgu%kNLb}T>7js()HiLxa_xKl=E)JB|j4R
z9>(o_2EcV+spw~f$xEFbsPn#YsiX6mMs;FPXC8SHd^x$UyN)~^`ETJmpDfJhfN|;b
z8u~nB+|K8eaml|r%FXSJaXX(s;5r}wW-eb~@=|9u>fAPN=TkDw3weju$-=(Mljp;$
zlIyz9kO!ilW^kR)In1Z6ap`kE`h3N>olh6zl7H$wx8H8Y?R@&dbze#7XQ;_boqnh@
z!nmE!WU3Q}I&;Wl;7iDL-7m<Kk^cs+^SOih>@hBVE<~RPj7y*U@%nq*xa6-Rf6BPz
zPauE6xa1?=ck}$ixSi*9xXv>l{rk4?KG{2@f2lJEb&4Ce^DGC~I_anrM4kn&N3QEO
zCHHCW`fm%@c}|_>ypwV1^8otnV%+YxH`R|p{lO+LbsFRM)eJRm_dA~I1ftGN@-X-!
za$R>Nc|7u8!F9iju-~1=rO$!rbB}Sm-y>8%3-xnMUg~6{&N<_DzyDC3WYqC_!TV(I
zDB}H>{3#v&5V@{fjywnXs_>#-5m`4L@1N^Y{tEI<$@TXwx1~Cp^g1yv`z@U$U3))w
zV_eqNuTy#(mwf-EdvTwB#wC9N_uae3CBGB-;l?Ge?|a9?b#BqmyZSRtUg|tJ+W8#g
zQb%70mr<Pn)LBm+3jdZ|*WE`Rhx~DPQEyFI_dCq<jB)9+`DoYYS>uxLjIS5|g6n>>
zQ2$@b>%RP6^gh`;G(Q#j3gl_<YUEnKE_pWc&EZA8Wu(tz*jGE_vagRvyM47cF8ND1
z?_G^cJ|Fq+#wCBIm#fp?xa8Z8aX!$v<gd1JKEk-<7bE|^amkPC;__3BOa2z}(~V31
zGWwrqT=J1)U7dx-C9l`*D!87P&@h+(%H*ZaJk<HdxYW_}yPxXZ#(6nT9)SAi$aURI
z<l)HQhU@uVg73=}Z|ODR9pcjGA@u2IT>89@`II*<`Re2DeY#J8amnBRz4PkEB|jSZ
zVB>b4A#j~%T9~WT%H*Za9@J@T+|DzK>cpW=Z}O?|!Q{H`DDthyPl4+^zr#G|7?(b8
zqtAK9?S4O}`T;H6em9uB)aj4!Cwyhx?sqrU$wr??$Zx}Q$aUR|#*4aE?)~2axbAo4
zckX}mZRIuR9qQlia9)~Re@^cS@`k=HUz1#azB+__59+rf*ZLjEwSIT<L#XpM`8oJ7
z@(b{><oWPqxL&uxE!@5qQvO5CZIy93zl(5w*BF=c`zY?CEyg9^82=vJcH@$7i|@l6
zglj+JTDX4Bn7q`fG{Jc;d4KrT|52w{Ywwf2L(aR@*@Ap2@?sNR{qk_`rz+(;BmW%b
zSF~_-T2nq1`B%w{VLnmhN09GB^^;J42>Akd68SFpH1cftJo0n!<>bCExP5IT4}|X^
z4}l*bkAVLS*ZXl5zAybB<8r<}z<ho;F4s?x_m3P`jZ6Ln@;8i2US9|Af60BKp5Juz
z^9Wq86aDws${LqC`Z`#Z>cpeYv*gL}=gD>5w&WSezYf>=e2w|MWnA|A8vebNzQ*l*
zh8UN88uG)8+xd)z>wE%VbaPHNd8u<5byAGm`7EJ2IoMY^xew}ZBiD5goBGwfbr<6~
ze8RY_`#7FIr^z?Le>48Hm#<gO?d!a8sdEDPi*TJoUG#aK@;8uwu#NZ0-l6BqXSb{W
zIJqypGWmn>I^+THR^+wd9mrpR_aUFQ*Y)!b`CG`pOP&ZHNuCTJO}-L7kvtPVjr=@(
z7WsX9T%VtiSAs7hZvtON9tmGfJ_Npwd@B4a@@4RC<lEpo$&bPJk^cifME(%Y%TMG_
z!%va7fd5J!1HV8%9Da$sGv<Gld@=IH+7`Z^zlJ|TUUVO>bMgbo2a{ihhmaqIw<P})
z-iiEocr^J*_*>+q(C1k4M-RCEKP0b>{7Uk__PhK#@=)Zrk+*>FBOeL>iTnoqS8`vh
z`zQIs@EhbGz)Q3%d>;Ft{v+hA;pNFY!=EC*01qag41bpVGk6I3I(T#P@8K=UkHcRj
z_rZR<lJ|r6BrgMxB@coRB!3>BK;9mnME(nW68RK(3i%#*D*2D__2lc}Tga2)yU9O+
zA1D6;ewuta{6FM(;eV3{;Xd+vx$yP&8~ibHy<e)3>wWPIc~jI0CC`AjCI1orI{8X?
z40&t#0P+a<2jp|%pOJqEUq#*(o=!d(zJvTa{5ZK^rhES6l0OB%L*5i#CcN-@nGX*j
z*XyS`c{K73$VbA%$UlU?LOuxIiCmxaJ;>vbA3~lEpFq9|{yBNiAKcv5kn4W8kRL~#
z-Q;KChspIiJWa0G;UDC$qo04sec*S=?}z)pQusW!f|nz&4}X%p1iTh`4R|PdCHRZv
zkHKFjF9q*SJ`6sdd@lTR@*MaY^5yU?<lEu9$#=sKlOKYgCO-<lNPZH2oqPlQF1cRM
zCEFK1Utb_!pZpJaDEUqJE94aqy6brWc{BJ}@*ePo<cr|T$;ZIIB;Nr4nY{QR*Uzuy
zyOF;@o(=z#{4)Fsd0Esi@oM3D)`34k9tN*M-U0ps`MdBp$v=R{k$((-pL_#+A^8#b
z*W`b}e<pt<%gys9c@6ko@&@pV5ryZ|2Ht}FD|lP-?(k0JtKdDz)8PZiH^4`bFNBXF
z*ZXlgx!&*d$fu#sYVr@@o5&O3JILRHA0&Sp{xkVZ_}}Ea;Ke%>o_`+vaq?0>y7SwR
z{0Vp)@<#Bt$h*OZlJAGVPo4;$LOupQhkPP@F}Z$Svw?gq^52k8h3_E$2)>7W4*Uo5
zMerl!%i$-<e~0Ii-+$Q6|DleB&sQyY5P4g8UATN-NWRyjM{~;eN4}lOce`KH-v6IN
z%FjSPhWtZ#9J#)K9!|ap`SEb+)7SJlo$?vT&olX7OrJ|A|10uqO}?0^znStyj<`MV
zGWlFn{|CxfM*gJ97dQ3KQoc3v`6ge_)W1Rbw~;UQnky>vDPiiDg6sG3rXwF<^36^C
zs+3=c{Ie$SXX-bl{1N2anEWTEeh125MZUYqKWysvrF^-gZvF`--xS|NmH*{E$~Q)S
zipl$%`m-qi8uF<oKic%alJWzP-(>QSnEKyRelqfzCSS|+{}bhxA^)4nmofGKp!^=>
z3rxO|>Ay&%`((Wyen<XcxLiMFP5p9|_xs7sKgi^JoBFjW{|xetO}>g(-`|z-d5QAN
zkbjlD3H%N6mhish?cqbnyTX&mr@|+Z_kyR8_k*XB4}qtVkAiO|9|!-P{A>6%xSW^b
z-pocl=muA^lRHUz9#0})9<KRW$XBNPE#&J^eiiaBQoiCbw{8c@XCU8)@?pp)Q2rG1
zlPUie@*h+F3i4@`ACLSN%KMdYeeR_Ea^!!cd=T>IDZc~xE0k}5{DYkf&;J+X%fWU2
zt&tC;{9WYhP`*3zjVNE`xZBr@CV!ttfvydo7|J(7z7Kgb_`BpUz(<mIg^wm544+6o
z0X~iVQ}`_MFX5k%XTlee=fIbdUxBYC_dVg}wvN0U{44UB@NMLc;XBD+g6|`bf*&Fu
z2>*$E4Ez-NT==i#Y48i=8Sp>Je}ex*ehz+vya0aR>xHj#zn|SaOORKAmnLrt4<LUP
zUWL2|ygK<1cnJAecysdU@RsEB;qAy*!6V4Ogm)(24UZ;21b>VCH~8D+`S2m+|H4O-
zKYG&5e++qL_$2ZW_-yiC@K4G0>*bZ?t&#tdT>l<t2YDp&hsnpoPm`~OpC{LTE|Y(V
z{2g-bvqV(k>vkscWy$BltCOFG*Cp3}LdkXAHsm`|Cz4#}7DIjz`N8D=r`&lTL9YEw
zAlLUTGs%mf&LVRCd-gPP-PhOT!KkyFT)!WiP2LpwT=I7Czsa@EzvTM;%o1G+pWhy+
zQ<l6RJP0nY%kr7}^AFEb{<&;7=Vr!hdY|z06z46B*YLdL8Ry}~CEw&j=Mlywuiu}4
z!?@(fA^)av$?Jam8<+fk<Odp;d<FC~oIDWz0bJ+MtF`NMs>#>#>V!G=Nii<#Zp9oH
zQ=Ooe?i1Ei{xb3zl+Q*!i}H_QU#BS_i#{(=-e;;?_d5A<)VaT_*R*%&eq-@-FOQJN
z!=EHig$I)_g*PTogSRH%1%HivFFb}k3qF867e0c#4CXnJygWRGJP`gFc{F?tc@q2^
z@^SFJ<Wu24k*|RNMxF-$i+m&eHhC8O!8Zz@-*fP?<UXz3b@CLsKfEq^U3fF{2Jm*|
zq43wqBjLTsqu_(cW8m+TC&E7@Pl3-Rp9^0`o(f-2z8U^4`Br!)`7Zd+<k|4^<X7PT
zke9)I?Gs)2JeG$)L>>r#oIC{nG<hhz0eMS!3-V}qdvbkFzCoUVd@Ok){9W=S_!#m9
z@Q=t-;S0!Dz*my*f^Q<vf$t<g2hSqUga1PA`;xnlE|M3AUnlp67wJ~`{6@pez~%cG
z^7>L0&+|%@PeMM}<mL4)9Iw}nj7yz2P^YPJ$?N->*2X1YYMR?uJLC5Cx07+ncS634
zamnlJdoSaXPene~xa9TqdI-6`UJr-s>(|z{uFnbVn9m$jN7h}6IV`2TPa9WfBjxuX
z{~hH+kv~lNi^%6tJ_CK`Q~ns{aD)6=_ygU&roBV=yHT$b@~!a7<X7Nz$P3_2$#o8G
z$V0H-PUJ1&J;`I>?~spzk0MWkPbQxPpF^GsUqZeVo=%<y-$uR*zMuRk{5bg)_&M?d
z_}}C{IPZ7J%fm~)S@`@0z{`^d!K;!-!k;BifIm;32oEPuf_EXG3-3d|06v6#DLjc>
z@6&1InaIy0&w?)}KLOuJeg(dRya0ZX+^3zp-%pVTz;nrC;8)3e!HdQeK96zmQsm>{
z0pye5HOQ0U4arx)!^k(n+r#zy;cww}p^I^O9^S%prkip5x)5tz@|C8$xy2cmd{uls
zH4?7Rt6k`4Jb5O37S$P!J{KC7bz5NF#l~%)Ul^DC6y(<#w|#CkF8L$KXBd~f{#@k&
z<C3qC?B;ODxa9Tg)04&}KMwiR#wD+>cYhj}uQ%ged7rDsrB26>-2ZT25AOr-kn=0~
zjC&t>Uw<2yd;szlj7#1}{_&2=#w9-q`DctvzAo~Oj7xqy@~z-SJd^0Im+zJL=|uS}
z$iGGTE65L_d?@BNio6GW3e~xd>*`~2U({bp9tB@V9u414-V1(!JOh4$JQMyO@;vxu
za-VQFx4Y!NaKE1JL=?fC{oobItHZ022gB==H-LwcN5EepPl9(P9|!MCJ{6uoz7#&1
zd<A?uc{+SP`Cj-k@+|lUcu{X|a^EH6IkVlkT+hpKU43U<^7=mc2ji08kNl6uC9luJ
z9JrpZ9Q1RMJQrR-b=ILz-?zM?-ci*1FIo3btXtf;?X!$=$@|Z6*HwArw$JKt?Xv*=
zJWKBLimMYwbu!WC%f@Bh`dIf><F?PP#wGs|^4*QwKKmJ${2#~<FfRG$@OqSJT=Mm1
zx&B8Pm%Ki=CmNUhTI4@8E_r=!&oM6fDk-l1JmZpYiGG$Dmwct!F2B;a<X=I4vvGM2
z<K@67!?@IGFw@mJXk7Bi-am32GcNi5$e%MV`3&Uqj7vTh`J2WipO1XeUhWTieI7&J
zAFkJxe|y(YAm#lq=Q@-RL;iWn_eH)9x&Ho{&c>zBz@l#5H;v1_TH|~TFfREB<cAuU
z{3ztd8JBz#^3#k<em(N@jY~cq`K87spNsr@<C4!o{u|?xkHqz}&$#6M?{oV-Y+UkF
zkk2tL`7q>vH!k^W$X_=u`FP}gdV3#uho1M~Id0vDjY~ci`Etgkeg^7Sh3j>aAK~gW
zq<l}*Z%O$E9bCQ><;Nrc7Uje69E&G!1AmWvDSQg~3i!w5>F}lGez>03k(Y;WCl7%i
zAP<M1AdiLrhdd5`nLGi0mplvZ*T<b-JugS$709#U)yP9$b?2o%c^h~bc_jQ5@@RNh
z@+^2?@}uws@@)8M@=#oF)5%-H=aYxSSCGfTza)=?e@C7GKSZ7k&n7<y|D8M+evMr3
zqx<?6K9ALLzxa~}!=E76`>Q5-9P*9G6W}e$Q{WxQ=fb;_r^4SR-waPA-wGd3z6(B+
zJR81%JQuzSF3&f4UCzb(oK42%Ikp1NnJva8ukRao8<+e6<o6qwyuNQd3D^6s0R5aJ
z_vz^Fugg^D;a{BJF)r&~!n#Fcy$`%Y_oaP4Y+UlCKX!E<F>d>;0@ptM(N8dWd3Y15
z^ECQwZCuuEfOXp$xAW|5T=MTB-_^M7vyXAf??%4Aamnk~`$LUO-tQAPhY`jlukRZt
z7?=Do<fj;yyuNRoXIx$%v+(-3#JJRHHP@}X&bZ_QeVuPHF8NZ(?=>#@803F6F8Ptj
zpD`}^WaM*=OMV^l*Wmv>@2|Oj9_Z(VyhGm)TtNOYxaPx<uSWT2Ft=yOBjL@cP8(cT
z?Z_kGuahr@_aa{bA4HxGf1lhB{eMVa9zK^m1ip+s9KN1B0{$&|6g-nW0sb?2BK$mg
z68s<X1#qAK?mX)G%7i~eo&|rL`~>`I@_cv$@+<Hb<hSAN$;(8#>n(~r0Nw|#&$kwM
z&I~qQ)7#=aTvtPl*YI4QhhvOOejD-=j7wgh+jHPLw_x;>O5OmzhU)Z2pIeOA^y=qe
z-R;J0pZkqVK4G4l&q3po*XPwq<C6aY`P0TFuYZ4c(YWOApYQ5lGA?<2zTG6(zrQQ;
zwiogaolkrxSLb2!ILzlsxIRx_MW3}PpMW~eDPJ9ZzC^wXbvkh!tlN`38U7A=8hjLa
zI(#zuX80WPEcg=gqwsX{Z1^_vEAai~WiX%P<mKV#$OGYjlZU|XkcYxc#uYxlE#c+K
zqv2J_<KWMdC&8a5UjPp$Plb0OUjgq!o&g_1z6+j2o(Z2qUcR%tp69~#`STv`>r~@%
zAH9O>bE$E;kM!pl(~V1h4)Pm~OTHt%UzA~7@_!@0%ecL-vy4l=#sb&>QR9-==SB{>
z-q#o4dS6Gr?&@4&$9(P|;1%@_y{|LT=c90~6NNfKlpljWYm>hTZ%TEdv2GjkM0h9i
z6nIbax$t+$Q{kh?H^V2BZ-vhx-vwVno()eYFMw|&zYX6{?u&UICl7$1BM*fCO<o;-
zhdc~ka-ciEdLH$9C{NxC`Ksh`@Mqw99}Pa`uB%Y;5%4zTdfj#+UygiV@>KX>@?`jX
z<R8Gtk$(Z7L9Ts%O0IpbBL5O~)|2moZztaeKR|v4ew_S2@N?vU!2c%Ke;@o`a;^X1
zJO6)Q%X35Pmxb%~Fc;@Hi1HufIa$}ZJeQW^zHVS#>g)ToFyoT1{;9i8S{k>{u?XXm
zPeDG?xa9TyPmFQNpFzHtamnlZpLpYv@4U$MlVDu(QFv}Ak?V7HB3$Pd9p&nzkY{0@
z%S;_v_dfKwf$}k^vy1Z07P|UBkPkwgQ&i_R>f}+rC+b`!UjQ!}?=|Ngx-YHsC|q9`
zvXKuUFN=BBqB@~nT>qhzAC7!G%J)M44a$Fqd@u3^@Ih234t2&*zGSNF=R@*3@D%d@
zp#Bo7e*)(>o%{-X8@WHu%YO1Q@Z;nG@N?u1;D3{c!0(WU!AlM*e14<g<;mmVRmms8
zpCz9Pf1W%A9!{PH??Rpq??b*BK7>3Ao<yDppGIB=*TX#WDEM;nQSgoAS@0d?N8ty_
zv*D-63*forx8YaGeY?8rw&>u(=P?lOM_w2HI9y+^xBTMjR5LEmr4G3MYZ{m5p+3(W
z8khWkkZ)pK^7^{j+PLJKf9BS0XI%37Jnw8=@<WmDYFzUAJnuuU&*uSfeU8Pw;np2N
z9*g;WXzIwi8Q9k+l#fT9Rh0h(eQqGH2;aeVu<k+fsqj<eE8w~0Y4EG$8{tKVc$@JK
zokJ$P6nPdrfcyl!26;ZbA-O;1^CEc}cm#O>yc>A~cz^N`_%QM?_&D+?_zdz`_(Jkg
z@YUpV;hV`9z`rM73O`J~6@G?11D;2|7k-VrO!U3e>f@W>&ad9rhjCx~8<*>OJFder
z#_fF_Xk79SEOzySj7wgBA7EYMl0S%i1LKm{=RlZo$v?fs)o*EB^7<TzFfREwk&iSk
zd3_GVkn3}xFI=zxoNjL21oAeR=Xg^`)_n{6nnn4k$S<Y*1mxFK{wVT0DZdi=A1Qwh
zef~!IF_^<2<i7A5R3{AU7JJv*jCbf9bia?1Cm|n5J`P@+T<6e)d>8UBk!Qmr$qV2;
z$je|31If$7N0JA^Cy|H1XOoA*7n8SyuO*L$ZzUfE-$$MVKSn+YewI8Ho=?6M{x5kN
zyu{GL=XV#p9C<c8h&&%&kNgU}Ir(k)%jD&|yZbAOJOJLCJP1CRJPbaHJRUv;uFt*S
zesSy0F)sJ-a@-g5jLUOF-_Lw*T=MzIuQD!qeeP{CF8QyPx^=f0m%Kjrb{m(x|1y`~
zZ(Q>F+&gAm@@<emX<YL9+&fRM&%Hn4dcTLnxOH!mFU34d4)cn7hkkt*j(t^tYn@!=
zYf}Cl<U=T5_f5BMTguNw{&mWS#<+Ye<=@5}29f`XIv-G-1?Y1sx$gH9@@(WkC(nUz
zAlEr$kOyMFKahvOPm)K%FObK>uaGCeizK@9rRQZ7{9*DGct!HL@ap8L@aM=k!(Sjj
z0e_V|8y-!54&IOaHhd_#53Yx?<i+91<bm){$s52|k+*?=MIH{{MIH(NkvtxLnmhsi
z2l*&?0r^~b(cy*9?_Rh+T%UVa@Z1Y9F3*i*+%JK~<+-8Hy<p>#&qKbhamn{S<8$u_
zH7@xLpF0mTE_r?Kg&UW=-*T6aFfMt0?nN7y{Oica7?-?0_u|O)xi<u^_eE?^w{8-7
z@gB}+m^!j<8|-Tl<-?Irr~KQ<Z>M}V@`ort9r<4<ABR3KQGOccaGm^j)VY6z*R*%&
zetod+Bjmc@C&|N*4<>I3Z%nRpXiYv2`Pay&!ehu&-~-6h;Uma5!Y7h%g{P38fPY4Q
z4!(xm2lM}iJOI9zJP`g9d3E@2<YDl?$Xmj1lZV3}99g8$`RxTSOP&aSihLBjF8Mfk
zGxAh;JMyLQ*U8i1y~y{%2a)@{b#FU9?~@0?KP0aXpG#gBzKlE^zMeb+{w;YFJd->D
z{xf+p{5*LI{2%fKaGz0y&*Mh;L*$#`kCSJ>pC&&6uSb3k{ybb?FZ@os`M+#jo_p)@
zoO#u_Ja6^)5xrqt^0$zG)41gI_2q5jlK*stTlXE~_IW;%T%YG-;QD;4-rLprh}^%I
z^Hftu)_oo8uAzJs^50T^1oA&nzBuwH$#vZe<l)F)A&-C;dCzOkJ9J;#&%@*?$X6ua
z2(M1Q75*G~Hv9$h9Qdo`x$tOmAI!fWxi5SuxgUHic@R9AJQ)5dc?0+=@(B1><dN`Q
z<k9dS$rItH$y4EfkS~Q7kf*`#f4}hg-35Pyd@uY-@+^2Tc`m#mc|N=)T<>@Nz3~yo
z<-W+pbslM4?nnK7WiiGjUumVgzj_(B_j|l?$wwleU|jP0JV`Px`6<YcGcI}ky=TeB
zB|l)5>nFvy<n{ews&UEZBfr$R<n`xyHp2CO^y%a3e{b?qrw!^HBoBn2`X6=jD1Qt4
zy-I!r?)!nan0IJD5$NYJxPG1f1J-@YcrEW!GkjhD!N#TkM^`(4j=UlKMYygTjCCW(
z<Kf-Nli~fzQ{cnM7r@7nZ-mbv-wa<!o&jG?eggg_T<?oJr`#OABiEm!I7qJ7$tkLz
zhx)%$zA9d4|28i3?}9mBHEyrNB1!JNYo7z~_18njrOrjvDQ#Tp=+{$E7?*szG`HW%
z#wD*`uhk|Wj&&Qr^?C^H=jyZ|5A5r_qp2h7E=Hd*l%ItBAj*G_{0Ec|h;{XoDL)JQ
zT1fdasK1&#0KS>L7yNtjWcXq7H24|vz3@EpO!y7*qwr#*y<vHW&N&bMD0x0Skh}n1
zo7^9BYeF6be~CN{9!VYz??D~|A4nbxA4#4BpF}<mKAU_hd@=b__*(J|_*U{=@O|W&
z@MGlX;AhEm;rZnG@PEmR<9;bIrttYK4=+a^3=bmL`>q~&OXQo9$HUvgi+an;{oV-A
zrB24>KHZG_sEcvQ>-+iM#wC9V`F_SFufIq1UE`7u`oi76!;MQ`f4}H><C4FE{AA;j
z*Vp&i#w9;&jjR8Oamnj*dnLSxXWoB&k}#hwCNFgkVcnhN%i&r7qt36CAA|fw@~-e3
zRA(>xDKS>M`~UC5M`B;)jmztMK3?A|8<+m)Azzbx8$1NAb6A0OTallGcO>`if3H2C
zH_3~`<H-Ht!^x||Cy)ojXOTC6r;>-mSCPlSH^Ym1vytneBd-4p<1)7#%x9Nzd;MgQ
z>+5p1aj7$Ct(#AdajB!P%X!8nzY_U;<C53cWuI~02i~FQD+T*14VQgMof@d~B;|9F
zuS@xG<eO7I;ceIdtCSB(cOFH426g&So!h80jPl)3CyBf$d^**cg#PD~C&O2eXTrZE
z&w+nOo)14n?uY)f$*aSECl7{SBX0n|Z+zkN7!LO*kAOcx9tE#S9uIFso&;}6z5w2V
zJQd!Zd<Fb%@(g$)`7Zc)@=W+l@^kP-<OT3F^5SvsI{cd4AHI`36#gSzp967t4*X(V
z?xQid4u3T+_oKcJ{%KtDo00$9xa9S9@L%JSzl3~|3El_Zq5bIV;6uhGAGFTxx3qDo
zufKo$3FDG~V7<#%HZFO6-K=d~@>7tnXI%37y4eD*&!2G2v!lsNo!`*s8{}KyvHzpa
zaLUg{ehm2l_zbGE0R1ecd|&J<-MGAN2Hx-H^R;p5{|n^5BhP|o!F3LaSoat5t?-NF
z+3@S+IdI>JUK8G-^>g8+$$bX6{wtCD!fTQH!9&P{;4hGez$4&#eNMpr5@lTG_7CP0
zZQNczvE=%?nP6P%EZ^Yvm1tb*=<DV<<M-A@ev)y?>+5C;xqd%+K3wPA@*TJC3i5c&
z;cHVz)(yqFJ1M^z`6DJT{fx!e(P#fh{))*<{WnqnzDeE(-l2Wwp?(>-zV44fz6#|N
z2fBUL=ln+Jq2x8-t&Pk5l7#!Ey>Yv*?#3k_fqY-%_s%cs4~6T#f-wJyl>Y_!Wb$zM
zLaNgX^I1(E2j5J-0{%VuIrw4nEATVq{+M$fc`*D2d0lw1$%W5v2>em<2zVfQB)m3x
zG`tCU0{kWNaqvj;40sRnUGRbAnedV1=irmbbK$ee^Wlrhi{m<3OCAW{N?sSfk6iEf
zW8~q;=a7$rUxMrNa1ow|H;v16Ui3?Mf88-&!*hN8EiuKNcdauO&xg`*y)Po-U7g1%
z|0(j7DIYw@<!e%2pL-1{KMDJK<A3-V@>JwMBF}{{ATN&oSCad|H<6ct?<5a~XOY*1
z|3V%Dzeuk0yiOjCyzhsF@5e-VY4TC<O623<wa6F1L&#I%t;kovJCbL>-z3k0$C00d
z4=2xqPayZj^)rjSI6RfyAN~b-b@&$Y2Jk)PE#XJW!{NV@_kv#{kA>eNkB1kZTKN1<
zf<HpO03Ha}`*a=d_h92Sy^<lg-|HHe`#lZ!X{d3@4@5r9xa9TUKMgl7`K8E57?*rH
z>PH)w{9~Kkb0EgJ<hLRpXI%1cA|G#D^7_7OlyS+gLO#j3<n{SB)wtwaeC7H{HZJ+S
z=x2d($*)5`)wtv{kxw%&`K-;Ze!6kV>-)g1<oZ0^3D@Us-e6ZJi~Jm}hhI${S$8V>
z{EPDWsN*xu3wejWPb>SitN$SRKj^<4{J;HR-5~Nn)UQY00N$KD1O763E<B3-HoPZX
zum1<LUH@;B_xj2CF!EZ+k0sZyE0f{6-v&cmorRR&hWqYw<1+uInCB|va^Cgp^i9Sk
z|1t7gj7whcqus_OUw4b^XTNdD>wR?0xa9MYKWSX@dLNxPF8SZSarG}6mwYy^^J~T>
zfB#mOziC|Z|3SXkbngT2(Ce)_@+FK*J`ee_#-;vO$Ukme@_OIZgzNc=#rbM#@=|9X
z=Fp1r0ST`Ej+EbqIdnEI>mEd(Z&95Ss1tAUvhE=CpI}_-{DV44#wDME{5a#1zk&P=
zxb8P7(e=O3<fYDIJDe{zZu?(Lb&`g<{8p2fI?cXyo?+bfpJ`n3G00~bxBdTWyq1?w
z$Jb>SjZ2-^GTgfVkUs&xO`ZmS@FVY&y+f`ysh^Mfj~JKw1?aOPc^167aj6qn>|R-)
zdd8*BYUG=ckA=5|>-nlX%+={i`N<j1V~xwY5m<MSaas2e@*~JE!zaUa-5A^#bIA36
zSwfzQd^-7N_%`yR@crZ`;K#{x;OEE-;D3|fhTkFg#eG*Y*&B*?=zjISE>E70d{y$z
z@Mp>OzJ8wE_uYHT`Gk}E!Ml*xh4&$k#C<n}JQ|)vJ_<gKJOw_FJPp2_d>4Epc@}&J
z`4#v<^76QzPmzbibID`jSIOhxMQ0Q~j|uQn<Wu1R<jL?F<a6N-$<yI4l4rsr$g|+x
z$WOrglNZ2;k>7@oBlpGgd<OY{pY!A`kzY;T2ELg*0{%UDEc`He9Q+J<0z8j=D*PIG
z3fy<5JHPt=?F8OO`NQ@8U5fk@<Z1Al<h$UF$oIlql4rp?kmtg?lNZ3>Ciflgo&$;G
ze(>?+W#BW(1K^9u8^F`ZL*QSNhrxG~N5Qkmd%;h`^}L+Jc{y)fUU!=8aQnSzTwdSx
z{qr^Bl8;CJrg6#NJ>%*Wo8^7r9s2(8bL2}Hmwd^bdoiD~<ob2f6L7tL!bZ4!P4YzS
zw-I>~ye0Vpcn9*O@b2V$;ct^?!V}4l!pD>6!)KCTfiEJz4NoI4k2!oz9tht}ULAgf
zT<4iX-Uj)ra5<0FynnV7ck{nxT+U-DoW~+5-Ur^H*V}6N{l=g6A{T1hi}^fgT<V-g
z{vo)Y_ek{fIOXpmA532CS69Coc?oz+@>1{)<W=CY<n`bQ<Za*+$=kyhkbiR4^|_4v
z9pqP&kAtrxUjYA#{7d*Y@)Pi#<d@<5$V>g^`aDEl6aEu<YxpVh82GQ`AHXk=&xQX<
zz7GBm`9Am!^55Wh$?wANpIzkM2KBnFfb&w4ygs}%`77{p<Z<vP$j8Hj$a`Y`waC{X
z|1x>ff82R_jr<4X-y}Z_f1BLzoU1d8d<uLl`E2+{<cr|*$^Fr18u@kfvyuEbd<*#n
z`1j<ASoa|L<M5;8&%#fVzW~o6?+iar9t;1Qd<OhB`AxX*oWj@JGI$B{FX8^=S@5#t
zXW&)H2V(v;$t%Jel1IT`Anyr}B!3YeO<oxuOI{N`oV+<ai97^8kvti`n0!5aC;2}3
zUh<>xL*(b-e~{mV-zN7v@9v}09~VBqmEh&cgWy%kgW>hayTF^1zX^{Z?+AZ``~`R)
z@_O(A<h|h|$hFT2<l5&fIKPg6M)~_LxVfbnm-m_bb~sNrF7FeTApebV$!C1$^4}Vl
z{B`udpZpFy3$A@$!TXJ0$YbDtnmV%XJgj?-d@%gJxn9USw7%9U1K0P-;mAKh9t5xU
zKkC${{M{XH4lhzZ3H?WquYh+WPlNX--v}Q@o(UgEo&}#legeLbJRiP-+-IcQ*Cx2W
zURT8Ru+6xfmjcXfhjF<cw&A>I8kc;FovwbCamgnme+I7SF#!GKkq5zVkO#wyec~1M
z4z1Gw{wR4UJdnI4yf%3_ya{<E{3Y^ecqDl*cn|V8_(1Xm_(<|m@JZz3;Iql6!WWaL
zz}J#5fNv#V3g1V54t|V07k-vJAD&NMe3ZLR{w4Q=mzY=h{FZ^2BM*jGhU@h_0M}b>
z@-grba=kuVQvDFrf8FHeI?vhV`i~(m`@Qpi<Zr?Uli#=7<wufNgHM9%b-n=o%qEY3
zFQYoMvF;l31Msa>CkA!)kte{9kgtIMYU<1VULVhsJmWIAw%Av`ar->EWnA(fAb;1m
z<n?_~iTU0K-l5O`FOh%Pxa9TqtAcT<|Hd9S|0j$~UayDh<obG72d?ME_dQpqDS0O5
z^RlTU>sH0Ok>r1(|DIIm1nRs)o(msN?vH*Zn)<S@HaIUcjY~i8qn|m(C9lu<CFFV^
zttDS{-p%0~a;>wQT<iQuuID$KT+hn|ay`G7$@P5QB|ncoA6VdR(mV9Iu@fFhei$AM
z*Yh5XIX9tv4CdU*xXgJE=G@k}opYpd$v?H%%`?il<aKUu8JBz<@_mg<{tNUo*tq2P
zB0to)<n`-|(Z(eow9oZ3-uS)#Q9s$Z<ljL)#kl16BEQJE<eO%?`b&&UUeE6uay`Er
z;d)+Le&FitAn%3q^`ogH>;8Z~Pm<ra-_<!wo&wJ!-w(e5*M7>s@9Gr$)LYCu)U}_o
zaD9$7Mx7_gqv3U^P7?OjobtX0+`2E3H-SfxAAoluFM{*Z2d@36VP8YYwV$z6Cm!{u
zlFx$Ar#kW2*9!7U@Gr@i!oMR=gC8Q#glCgy!G9+|0l!9`55I3=;q!Y1?oWOj{seg$
z%(EtWAiNQID7+<k7`y{{8+do}Nch|23GhVnMEH2}B=}77sqjVQ8{ui>S@5sPkHUA8
zXTy(>=fZQyi{tt5C%GT|CV3h71B(iu-#~a7@-TR1@;2}~<Pq?u<Z<ve<ni!M<caW}
z<SFnt@-+AexV{c1;rTq?xI8BZ;W;qb_`T;pULRA8-+QhiKi9bA_4R9samknc!9A~*
z8<)Jkeyuky`N7C<GA?<2{n}w%@&}Rs-uS)#vEMA?lCN;k^>fs?<n{IIjB&~TC(Gr}
z8kfAjeqAEh*RLyZeXfog?dlXs^*-4<)X(93m4@r<#W3{wIQbXwr^uTha`l7B6X1>E
zy6)U0mv2q3{dA@}XR+>^<i${bAl30f{r4%q2KkBP=itfY?_&O+kgtY+4%dAZ$DB8i
zYd<@w&f}<)N!|>8it6O!eC3iC$9}Jp2f>SeR`|RJ!%LBe!vn}8;5Epj;0?*+;V+UW
zz$3^<!Ml;C!26RgfDa>I3Li(F4xd4u1z$*h6uz1~8@`!57ydoDAFhYP<YnMz$OGYd
z<YDj|<SpUF78mi6qlouk@~3e4qvTQWK=MR*ZSo{|6Y@#$m&ljGBgt35dyuEY2a;#P
z$HI#iaev=kq~yJA`b;)1&%?ub-hM<rFxTa08JEBB&a3VGW8+e1KJxS7I?r>XU48}S
zw<5oVd?)+>`5yRT@=W*{@-y&j<d@(@mv~KkM^W#;r2qSWcYQuaUJ~Aryb8Q2d2RR$
z<W1mh$;08j$z$Ln$QS(K`W#C>82QQM6X73`FM`h|-wdBmehU5>`BnIG@<%SZKEEKZ
z4c|cC7XCH)Tkvnm$H2cQpASDkz7hT-c_#cg`G4TQkQc@L&yokge<yDU|BE~VewF+k
z_$~5D@S;l#U$^Vv<;c&%pCsQ2uS$LdUYERco;#0?$qSHwp4=b#R^);3m&qHzJCL`A
zN0V=Z_acvl_a{$;$CJ;34<%m=A5VS+{vr9#@HynC;h&P9gRdgbgKr|Q@TZ&qPVy(=
zKaoEI&mk`g|AYK*tb3WfD)M*9wa=2v3SWoXXL&e3|Ep2{9n`O9T;8`={L$_AIpg<U
zr!F}UGcNfK$hR~u`Ps<7YFzSX54$?A8JB$9znpg`kAU}r>%Pj5b@>65k3l|>^7*4(
zev-*cKey2T4DuuJh5w_@TFS3Qelz(*_#Wf(bNflfTtA15OFvyOpA+QY!2e@h>ZGI2
zCF4@(N#w7S&w>~G+zWY!&a=!I*UzKmaqvL$czA8{M0gYOWcW+uDey@01@Io^8{q@V
zv*07ikHROBXTxWcUx6<sFMzKl_rZ0zm0YjSedK}2A0e*`{}rz9izeYd%{4CPxA+lv
zzVeLQ`|cLi4@dpt%L||PNcbagUAH#Ytwi1tUV}Ua{v6ehLH!pg{~7Y_jLW{7V_)r!
z+kJI0F8KuHyBU|f_8Dhf?w1_gFA2t_PKl##p6`*bLj4boOCA3QTz-~usWT0A7LeD5
zuY&7+myG#*MZOfii+nTuNAeT!Q{?5xxjuh~>-qf_^UpUf{qIDdSB%^F-!(4z8_3_c
z!u!BGwEpLK{y%J7^3VL_`gz2-)L)ByWw_3#CHk*t@=|9H>NFwm2ya7m#-UCW<;Nd$
z{q!LBhrdI0B2Z@(c?^6qc`|$sc`7`W`~-XrT<3Wb=j&_ZGKYicbDME{zV;fIyzg<h
z-%R6@*Vo_U<obI03tZ1j9{RjMeg%G&>iFRN`mFR8^A6dU^iv)E_!_tUmohH-myv(e
zxa76}O61yq5M2BB9q;B)hrBpEl<EYc|CfwQKkuNQmyOr(yf@y5bT%&eWyp6mE_r=k
z^)@c~Q^@x-F8Ku1PcSa|(kI-$5{*lKJo00WOTH`e6OBt=@5h<OC7+D^9OIJL`G00y
z@@sx}{VX#sd40Xu2-ouxiuvy{d8w0+b$=jljQXdj&Ro>_gYwsrzd~O7r0cWjDsM6G
z(0;;ErxbY%Jb-)!yaxGRczyEn6WqEj;CjEmi0dufculXh#ppA_cnvepZsd9$#u}G8
zCr~HOxYW_}IE-BHqxaxCpD^@4k-Q~*Hq|MC>+mz<HNAC9opN(nX58*;1G(<&TjNrv
z73%CXZufPFT=#VhuKS8d|2gCd@Jm#u4)%4^culXLe(2|pap_0DJ}R}^`@lQ&yx+oe
zzAX7wcop)SxK3)4_k=ej?+br{JPzKTd<48J`FMCA@{izy$#uVD$wwpq5qU2BWAaq^
z67s|FwdC3G9pu~K`^fcu%TMI`JiKhYns@4kJ>;(20^|42FRq6><n{7hzG&M2pZBM|
zKbCsdc`@TsCmQ(@aJ@c9;W{iw`S*|yB2R%gC0_y$CtnVKjXVwBn|uR&5czKSB=Ul*
zZokRozazhZyx@w<uORnDosHzj;2Go>;6IS(qW(|hm(kC!<S+i?`uUUmJ@^gsTk!k8
z`2X`R=eHQvElutZe}a58ybgIC)Ne%Y`?u?}8F>Zxi{$m-ZOPlgUnL&^??gTk{s#F{
zcn|V#;eE+Z!3U6Eg%2SwbJ^{8IC*XO2js2c<H@_jKO`RppFy4i|CoFY{8RG1@FnEG
z!B>(O!TDWF{y2OS`E^{kJIG^^-$&jCeuz8@ev<rm_*wD~;lGnFf&WFm0e+Qy5BwJS
z&+uYv3g1UX^*$nh8(x9DEc{9GYVfM$E#S4tBjAn5kHMcOp9+7OJOlnZ`F?mm^40J`
z<of)4k9;Qbv&cV(&m&KTe@1=)&(D?QmEm8KSA*{+|5~5J<jdhdk=KI%N<JNanS3n#
z2Kfm1Lu(6PKXu_1$p^rnB5w$Pj=USZ1^M&vSIDE_-N_^2y~$g_<H$dSCy;CXB=Wh)
zr;<0n=ANG`$sdBRC9ewKME){-FL@OFC-Nci3*-~w1?2PLrP2$Z$I{nb|K-TPMgA%B
zeeh?<55k+0>+608@@vR<AwL3tll&OGH~BB{x5>}L2a#WbCz9929Oja@gRdfwg?~>z
z7M?@C0RA`m26)kRh0n`DczN<a;dRJM7r67-mb^Z^GkG|?A9+Xktp986{Nwr__y7M!
zwlFjs!c1tBnF-^BA%rkAX9%-u)mCTyc&{3bAq-(>!VrcKCk!2iF!Z5A7{U%=2qBCU
zhA{JeU0sjMt{(5_v%UWKzHi5=_x<&_o{#Hsy{_x^>;2wFd@lI?#OuIcC;mD3JH+n>
zUq$>$@K1@q0sa;7AHjboKKxfZ4vCKp9M7G=cOkwvcslV6@S};J3_gQ+K6n|px$oF5
z_%G3RCsIxNV(70VUJZT?@e9FkCEf{sH}OlsA13|^_|wGS25%?+DEOPi7lD67ydJ!l
z_+8*59v!$}cKyu`&`!kNd3g`w-=og{#5Y2n!-)?E&mw*xcrNkd!DkVl1b#8`lfiE#
zek%B5#4Es;6F&?5HE_Of{ebjEYwfsw;c@f)WFelPeC=^_-*ogktN(>~&hM6Qvdr!m
z=Ua>W<>BD&dCPh59p!Q3`!IZyJnsAMP2Bk&1nzw6;d?CU7sB@xj~m~&;Cq_Kjc*fj
z<$2ub<5$_dg&sHhzhiu&9yj{Kps(_{(NBl|B99w=74(;S+~}jwFCzXF_WNRRHxA3M
zu>HJ~cnikoA>yszPZRG1f01|>_}j#Lz`Ka|f`3bV82b4e@l^1kj|Jg_m&=s}K9cxU
z@Lh>d1D`;=8vGFA^T9KTF91K4cmwzh;>*CxiM#zWk9Y_4SAe_q;-2SR<8d=jZo)jd
z-sAqfy~E>1|0DEwd)(+7F@GNRxY5t}(9WMnJ#O?DVje!{aii~m{soU4{jI3~25~oU
z-vM{~chr^E_cKqwS5PN?sO76YZhVJ)Wcg3TZ$W=HemoEbFIPX~DyvT*z82%ZGx4}u
zs~<;vB>3NmPXf;%UIadccocj(@oMnd#215C6R!uqjCce1b;Mi1?;yS$d@1oZ@F$6{
z0)LTsFZkQUldylgh^K&mOFRwyH{#R4hdwcI|CWG{Bt9Q}SK_tc6NoPXKZJM_cqZ{?
z@KcGmg3ln{4PH)s6z1oA;+f!A63+s^k$5in-NfgEKM3xQGu2q9j}v$6_j%&(xbZsi
z`%&i|;%>cv4DQxr?KO6NeM|Zs|FHZgkDK*=>1USz>T&-#vuTT+4<?t<KMDP29`}!X
z+j`vS{|EgJ9yj`LaNHZ?aibs8ZTqvQ$Bq6=Tt6HH?(!}}-eZU_2md?q72vtV*MOH2
zPp`B6IgfZI_!Y#n!50&+0>6X!0`R58Yr&r+UI+dn@doe?;!7|;KLU62^O3bS*H<1l
z<39<<|8G5R#@}7P^?BUrE1+NNaie$FZ$qC9-UKf<f104*!sAAN73RZs9yj$rf__Jj
z8@;>U8{=`KANjG(wWr68{$|vl=y9Vz9{Mzo8@;<eJQm!|w|0!@RN@`rdBl6bONjS^
z&m-OkemU{T)i&4l#7BWQ5KjYtka!9BQ^c#l+rZsCc@D>)6~x~J@1!~lQRfTNcVfPM
z?{PE!?%$>Q$>V1H-F%BY6}$;vZvH%u{T1hNqj&RXYmb}y?(g9o;c=s1hWRks<3@i#
zSHE3kH;)^A8}zBf9{@kZ<EGAqsB^f-O&xcib-c%o{)kVk?@1mvdbf_wAnuO;IpA)7
zPWq><Q$jprq2=?vI>z^0_+CZ&Htffnh_3)|B)$s#-^3&EeU^AO_^ZTAz&nXofqzbX
zKKKvB7lQvud@1;_r-Sgp%Z*zr_zuK7!N(F`4Zc6|1dM+=@rmFk5>E#|lXxchEaKVV
zRmA6mUrf9Pd=c?l@LP#Dg5N{D6Z}zdcYOF2>-t%bn|ZYa^XhqzoB8b4^=lqC`p=<%
z)8j_(*7Yin8~ub&?R@U?xY2iDJ$~cy{&^1l|2%H=Zax0yaiiY@*DdQjZuDKKzuEHO
zP4IH#;MQXTxSLn=ab2-9@ji^_IO35-HrL;XCxB-Vp9nsM_!98x#2dk96JG{iO?)}{
zWyDv2Uq`$b{0`!4z?TwV3;rbWM2y>u#52I(CY}x6MLZY$TjJH=zY(tik9%g|{(T$g
zyWzw?0N<H-Jg!&A5#I`Y67h||k0t&+>YqZq3;Yb?BT;82ao5iZ;;x?;5g&y*3yHhu
z!1cu4eN7|rNvP9I+<jiWoVZ($?ZjuIP6u(f?s|wH5B>MV-S=VE5qIBv+2YxO``taa
zPbBWXpEHKI`+iOu@hbEuo%p5TlZn@YpF!M>e<5*qT%AMQjsFG2-S}Tg+>QSY#N9aG
zP5j^J=L5vu_2CoX?s(XW`;`BX{z%-PzUgsu9L~Z0;D0@Cj>9h3CmuKYr=kDc<3{hs
z?R$?K{q~>R<Lyr#_s<I(Jr{_Am%IM_XOGoy>T#oY<2jtT+b=s4ck5+O;v4^I>!*Ud
zaa(%5<p+`8?U!`YH!ZgM6Ft3o?ia;#ztcQ!#^GFyLk{s)@FL=yePQd*1$X^iaINK+
z5Klw@uOZ%p`OrZ1XQTdo#NFQ;_PA2#CDON`P6zQ1!9S)tBhmj}(r@~u&Go0p&3HCr
zJmXt~H^IxzlN9KO6Q2&gBk{%Hdw{#~oP_;2k$408c{J5|9d%A3{v-HVN}UqY?}T|i
zmv}n(0*{+<=o)Ir=bs)o^Qs8?CEzYs1pU8{_$ctliBAH5fp|K22k}hs4~gf3e@(mq
z{1@US;Bo(F_pj@}o9DxcFNA(H@fPsCh>yI^j$0b>MDU}DCxM?rJPkaD_$2TW;u+xc
zh))B*ocMh3>xtKZHxRD{e~@?s_*29i!CxZ26nrJ|Ht<h~cY%LLyc_&?;;X^qpC7n?
z<8Zv%mUuk)Zp0J7_aUAFK8bh+_;JJwz)vGy1fEYk3LYh13w{Cdh2U2aUkrW|ad+Nn
zB)$y#e-mE={w(o6@K=dPaD3||o(TRq@loJE5KjjGlejy64trtX{+$Z_4#cy;#}dy4
z-=BCjcslX<;3pDa0DdO%CEx|bi*B{YhYIkGgBa#|;|yFcUFdOhysi76)nDRqqj%RE
zi#%@h??Hc^$Bo`y_ufw2eP88%kDEHX^;+MDJZ|c^>&d4)ZuDnD|E$N2{xe)pzT$DC
ze+T;4J#O^wbAk7XyX&G)z&8rC!T%x?Z?paUj`;i~mjCJ1F}}aTH@?lZUVnZc{k_$1
z3-0Q>I%7$H4D|aDpACK()meuAoJ{)bp+B4S%b_nL{o~M|OS}%b7Eqm5)LBgWwWxC&
zarfsY?j`;n^p8>fHq7VeiMNBlLA(Qe74aVMuZXV(|C#t2@J;?>_oLfi$;g{PJOzAb
z;;G={h-ZTTjre5n4B}J4rw}gzpH6%+_-x`m;MK%egI`8`4fu7$hhbgZK|BF`De*+`
zCyA$mzd(FBj&E;*yW^Pq9_EK0H|wq$*NvZe+^lzZANL(`cbxgn<EGBAuk1Qq=W$cV
zeeYuP7lSv!%k;<SOQ7G%<3>LM_hmbJ-01IuezeDp-re_&^SIIf2l@#fH+uK|_Jcic
z^uI%Yn8%IY9nVh!ck_ALjW%zNr#E#*e{Fdw@gu;`A>ILg5!J6j{e`4|5c*q4zX19N
zNPiXdEu^o7zMb?xLjNZ5?Y^<O-lsYXQRhq2FNS`NqK|ti7_8vs=EG#@w;}HSo~2}P
zH~yWN=lc@x0zZuSTJRHyM{cmWvWdro7ZOhfuOOZdei88!@P)){z;7mA2YxT{rQnYe
zZw7BA-U9v_@ec6!iLV6zlK3j{HN@9|Z`5x0quVd>m=9YKp9sDa@l5a(;@RK_5HA2f
zl6XD%$;6j}Pb0nzd?vU%PX6ETc0QC7cgKPAiGKq96~x{3)%C>PbyNfKUeswJ{tI|3
z@yJ@+&lSXnfUhL({v5~0#ND6!_=fm!)cJ$>w&0t+yng+f<K#}@yA$69d>rxp!S^SA
zH2C4fj|D%0_y>4CKONl7!w&4<64JXrFHr4qbKHIf$DjEg-!tIuJXq^-qo2Imj{icB
z8~x5Wf7N^3=s$seiN}rJosXJ4ZuD8-+WJd9ZuBXr-{NtjcYhvyxyOzEQ0Ut|ZuB>O
zhxy}iqdy7yPLCV?XV9<mxY4`ofgX<=eJSpDR(ss&r=flyad#i_C%D^>ky~v)hrJRs
z4qlEY-DLR=#8bh?5>E%;pLiB{I`Jy-6Ny)YpGmw1d=~LK@G9cVz%M2~vEJrdL_7`r
zR^sX4O~kXoA0s{u{CVO9;BOFL48DqZJ@{9|8^C`i-U7bKs{{Ara_|J=ZQwf-Uj;sn
zc*@Oo-2O&<GI$2@EbuABv%#kmpASBpcnx?p@mlc9h&O>>M|>&x9mJP`FD1Sb{7K^7
z;4czi1O7JgwcuUEC*5Ml^IPIs;J*={3O;nj!2LT7d?fJ_@Lh@5flna582k|8OTaUU
zF9ko9cnA0l;;X>RiT8ldC%zW^O5$-iUfoE182H`9Q^1>vj|YE-_(bqmh-ZPnOMDvm
zC&a7ow)^*g;O_e8<3B9_-Q(keT{^qZ@;^Opj_2;WXp7hEes|aNcS66l$Bo|oeFZyt
z+|+M_eix4$y*t0`<#D6m<5%0CeLQaT?tb$Sj~jgs^oM)g=-vI}3B+@8o;sblJ5Nmq
zcju$*M%$m+#M?2>)x^8OFC*RuejV|VsDB6XH1MUwCxbspya@b7;!*IoiPwO45pM$j
z8r;pF6L6jO1M#Wge-O_G-|Y2ZX9O=-=WOud#9f_H#NGAn9>m@C?f&3ye`VnL$q}SK
zAM^i2kDK|k%MW({PVu;zKW_e??Qx?&75Y4n8@+qpTk3J6zZ&{E9yfY7|1a>k(Z3J<
z#U3|$cR%t^j~o3T&|m9uqj&cyw|U&?XZ~pO-sy3pclR$35_jw3NssRp=#%1Yo##Dn
z>L;Q88{lrgEX02KnDkdd-$UH}IqUDKP95s3BmElG+2W0$6T!>*I{i-I?l`s-`aOxi
z0e&#mSpwf<iMN7JCEf;}M|=f%8S!rL^NII>*AnjqzkzuC?RLN1L3||mgWzsG-tmXk
zKk0F^AIGh+{27m%dE)MyUiP@r-wge09yfY--}Iixjs7R-KlHfKyZffEJZ|(;ezN`f
z*5gL+?wfw~xY4`s7yaRJqj&3WvyR|R@N)B^<Y!xdOOG49J74TT+^vfwa5vx9HrP6Q
z5^n}S(5qwmc_4fb_PFtN-&;O`>f~ZSW)rUmFC@MMyn=Wm_(jCq!50!=0e&;_mEiXh
z?*o67c;X#)d|HW*0)LHoGWh$%CxL%SJRN)u@l5cI-n9GO?XO($t%%PD---A_@D$>8
z;0F+|2S1W{6Zpx*SAb6=-T_`ryc7H!;yvJ(5+8<nSVuey{5IlK!S5$N4g3k>Rp4#J
ztHIwSUIYFS@p|xYh&O=u5$^=w^sRyW*R98Gh)3>>^uKl?9uGdAcp~^g#3z9tLp&Y)
z@5D2~bBSkzmlB^3ejf1}@GFSdf-ffC2!1E=Ch&)dH-kS-d<FP_h_3~I8{C~=p2hj)
zV~?BT-ZePxedcj<+;i7m|MR%f{|EXXJ#O^wzT;1i8+{M-o4g&o30|&0?)bm8$Bn-8
zmws7fgvU*Nci*v#$Bljr?rV1UxY4`&j(t3C^qJ7_?{TAd=a<8YyFa&h47fX9CEz~d
zWYW9y(P^a5g+8Bn)?GGllz0{R1;lH?uOi+AeiQLN@J8ap(4T)3PXd3IcnbKd#M8h#
ziMza?5?_w{nqF`>A0q4QIIQ)!*<Y97zA~~hcoV#w-d+C;^SIG}1bu?X&Hj!4Y3q;j
zxY6(No8?I!_vhPqj~jgs^r;><`uk8n9o)^6UgSNIcpvzg#1rnZ{h394Ja`rHRPc+5
zr-3gbo&|m@@u}cV#HWEjM!X9AdE$-WZxC+<UqyT+_*cZ^?zQ9aGx22b$bW-D4_<DZ
z)4;a^ck^Ud%&Q$e-aoIfA4hxK>_<1R#(CW6TcDrdaif0-`~6^#8~u0CALenRcb}&m
z?{T9~{@vz1$>T=<2<o5daie#~x9J`?`p2RFhsTY69PanaJZ|*QK!2XcjeZ977kb?2
zo$n%WH~!Ta|67UIf;SOw0)LG7O7Q22kNTG#pEro7fv+N-3H}xF0`Q-S*Me{IP7pG9
zxm?ZQ+k?A#bpysNiFh^mM30XRN_HgJ{vYgdGoH^upHBR&{%?6jA{idvBhVKeX6s~n
z+|*eF{bX?0{|@y34AMUg{Y>I7f?q)Vzu=3AzXyH;@sGg&Mf`K{M~U}=uOwb%f&{Ns
z#D{|S5Z@hq4e>+4Bk$UJZa*FaK8*MY;EBX%fR7=b2);M*Ex`{Wz72R5@x8!j5uXlT
zMtlnRdBiKhFC~5n_zlEw1;3N{j%J{O*L}qAg#Iz&Yr+4I_{OO78u9JG-zVOSI-e4E
z`|CU6Za(}*{A1MFqI2MWe;#~0;!l9@O8j2%3B(@)KY;ju!4D<w=EHHsJD|@Y-VHvV
z_@)@Qi;3?6eiQL1_#MO#1OGSiT<~Xz9}E66ahL0T;?to2g!qZzJ;W~nUq}48IJ^Ib
zzBh0`-T?iU#P0_mLHv2}9f*Gbz6<en;A4m<Zeshf7x4qY_a&YM{x{+!;D-{w9Q-Ka
z_kbTq{8{jmiN6beD)Ik;pG7<#<D5r)4EQYKhl7_AKLfmycqRBe;@5#+MEn8p%ZaZ9
zuP445{C?u`o7(;LD)G_a?}D4<mT0B@$Gy)<e>C*pd-}~b?U(ld-=CyE7y6;^+oEPV
zne%lC_z2<^;7P<U10N4=`njVm+3$M*=^uvv2v5J)koEmMp7ifQf10Ns<<-w2{jec+
z<7`i#8@IlG73mL${$fu*+N*yR=_{bW$<yb1^&3ck5A;ht{cb`1By{QjNWb?`YyL9v
zCs60V#M{6>A^sNlx5VA~@mJ#CL%-<<*5A#CIP_;Y@sZ#=6CVRUf%tQ%e-QC6z|)C;
z2tJkgyWlg39}eGQ;(rG}2i(k0^U>6~o7)|5HR;cTzMk}pp?{F{jnF?u`eo3+LHc*0
z|B&<_LjN7<H;=dbV-4{H@J&_?++W**Z$^A?@U4j-4Zbb$Gr)Hu9tGc(crExI#P0y#
zoA{&P`xAc&{2=1*f*(%&Yw)9q{{emi@nM_U@tQ(>NAS~$?*)D~@gu<ViJuByOnf$Y
zIq{3Y=Mujj{Cwg~;1?5r0{jZ%uYzAo{A2KX;y;1kL42#t?YP}fd^hlB;uFCiCw>h0
zOT<qDUrBrx_!q>B!M`J34gMRrS?{Lj?tU}=Lz}}L-#&$YgvZAPlFRU%VSA778E|*J
z-Ob}h|2p(zJ#O@iwg~<&cpczz^Z9rdJ|92S<EGB`cpiQNxa)t_ef?!3XOaG3=!;3e
z8u!=d5MKj+De;j_wtgM)H1OMqPXfQ6cn0_r#B;&hh!=prNxTI7BjUB--w<yD?<3w0
zzUfDHKe+Mi0N;jqFZeFR*MN^Fz83r-;-j#?jv+oDJPX{-!wWDE&nE89<CVl0LVpqQ
zTfr9+clWvV#2<pbk@zz3e-nQS{3+tDpDz-3&nw<0{wC^tO#D6YZ^7OEs>itfPWnHg
z-}qy@f6aJ~3;sJB>tcw<&3bg#Kf^t4^w&ebt;daiG1hOA$Bq6q=#xEe^e*rI;I99x
z(Ek%Xy*Uol#M^aus>e<JGw^(PI`I+UvxpxEJ{R2icHD34Uq$*}^uM0;&FJSn#9P20
zA>Il89PwW86~yDwpZAC-fPX=JJot~qv%w=>!C(b1m$v|XOX5-R9f>al--CEP_(b9@
z;71T|1wV;+7kD=DUhtXV?l>?C^KFjD&3u^e_OHjyd~@fc1yn!o0lVL?B|Z%NcH-l~
zA0VCu-a>pT_<x8`1AmKnHTcKG=Yy{%z5x7J;tk+KJ{h>*+rUQ<AGXwvLlW@>@V$vA
zf*(vg4g6T*lfb7E&j8OOUI0Fucoq0Oa5o<&VLmMIxS0=+U_R7(+@BBEd)(-IpufrE
z{_*NAj~o32JpaGf<3@iI`tun0Mga@{7n$^+9p^VZy*a)$<M_79<EH)=sQ)$9S%`7?
zh4^CdxKEAS`t`mHd^qt=@X^Fqf$v4U8$6A81i6kT9tVC3@nPUO#3zH75YGjlN4yC9
za^g|&>xox`HxOR}{vh$?;7<{61%HWnJNQcC-Qb@P?*adgcrW<x#D_g(=g+2}4cx!U
z;3L2{4mO*4ScrKz+T&(kO~Jg{&Ex*M*xTbqe+BgWdfZ<Z>EIg$+TeeYUi9Zo;v<`F
z|7Ux3O#MyzTLu440&(~G<^{yN(4VWRemZ>XiD!b}L%az55#kHMpCeuezJho?_<O{c
zfqy}~1^h?it>BSvGm7iiZ{%S+Zd(#h1mBT(68Ij()4?YaF9AP-coh63;?>}15nl{m
zM7$n+F7XENONcKAzlQiK@Fm2%!S5p;!F+q1_$crfh^K%*hU2lD&vx{KXUp5$-wfZ_
z!Qki7JFe$u&!rw^-wzo-kWW3&zF)J?K;C_^eZTnu1G)S6NncDK$lZPVNQ?WwSCe9=
zOg~8k=l)Mr^l79|#rvs>KAZHpcweRHt4Uvn_lp&MJ?UHVez~G|+g;uSj77Ji?*VuE
zT<GKQ(;Pqj@x)`YzpkJ0wb)3qqIYdw{d7#03`L&_?)1&j7byB7(kE?V11(VWwWP0u
zzEROPkv@WF_ic*4o%B)YyA^#8>ARqhL++UI2Y2I>h0kn~6@3cnTcOWT^qHhj#b+%A
zioS^S4bU%8^tGf<7;5)dqoQvjeGT+&ioTunz0h|n`X18f;&>N_c@Z=I;BNdopifrx
zDWp%|%;wEd^qHh@hQ2`27m+?`bIgB5UrYKr=o=M%6X_#c*!pdXzMb?@=(`nt59zz0
zkHb2M8Gmp${#nCpf07k_3h7&+&rtN4q)*+_)-O=>MWk<leu1K|C4ItHwtl0cZz6pS
z^lgg1o%FrXcPsiH(&uh%`xA%bM9lbuyYcUUK3UPHkUl-Z*3VG%nWS%qzCh6zkv?g-
zt-nCg*OI;t`bI_HMEb}!wtkzUZzp{e`ff$vL;5c0<8T~}8Gmp${#hezf07k_3h7&+
z&rtN4q)#1b>lY~cBGNZNzd+H~l0IQuTfb4!H<7*u`Zh)1PWoQxyA^#8>2tTU{fWbQ
zBWC=;-S~GvpRDLpNS}`D<_txjN&05!3lx13>5~#|{}(9wTGB6uzEROPkv?t*Tfa@w
zx0AjK`ff$vL;7y$<8WS$8Gmp${!?+kk*w%bNZ$s1hN90TecDboZ-JsOB7GC|3lx1V
z=@UoU`i+XdiS)J5w<-E|()U5%t>}A5U$nFBPaLj0V#XibjejTf$%;OO^qHe={R~B)
zN%|J(3lx13=~H&G^%p4mTGH1;->B%DNFSeM>$fTTcG6cv->v9-NZ$i}9Ine^#vj~`
zfA+4nKgo(dh4k&vXDIqi(x>fa>lY~cBGNZOzd+H~l77_gwtl0cZzBCd=-U*1JL%U#
z->v9-NMDj{`xA%j(3tTDcjLbb`ea3)Li)*LZ2b&HpGo@V&=)BBBGQi^YwIsi^tGg4
z0)3;RZzBD$J#76pMc+>P`OtSO`X17+hCUA0=`rIE?#6#witSIbqE8|H3g|NweJ1HA
z?P=>5DEcDOFNJ=AqOT?WsByM_qoQvj{X*#56n#7C*FxW|=zB<CvX|{o9PVRc#vj~`
z|0?K{6@3cnCy%%FGZcL$>6b%apy-Q8pSriLzd+H~lD+}@Mn&I5`h*F#ew(6iCw&d{
z-HN`4^u5r>;l3?q{K4J$7vcG7vZ7BReJAu8iawL{nRozNpy-Q8-va#tMPEz$lzr`Z
zHY)li($_=Zrs&&AAHSci->v9-NM8+o9PVpl#vj~`|7z%y6@3cnr|ob1lcDG{NxuU6
z0!3d$`biUQ{RN7?mh?-ZZ&dV6r0;^hP0_cLJ`2zByA^#8>06;+tLP(m9^l4*1@xo9
zd4DC5K60QPpGk_|J)dy(qtH)N^tn{O3;OwrzJ~N8|7QEMMA0{pegX8$6@4q|*Fe8Y
z(RY!)AkFq?t)h?Md5IgJmC%m@j~Rc`XB>p_SM=$mUk3d&MW0Lh9_Z&Q`Wn(_A8h-x
zSkc#$z6SbbioS*Pz0j{z^qr*7J;e5BjiT=(eFyX-@!W{VKM~yRuk=Z_{zOHeM*3#x
zrz-kv(kC5i>sKlIYSPz1zgW@NlRk2ot-nmsw~#&x{YpjON%}76*C_fv(yxVnB%Z6q
zj6b*=|B}No{)#@0^sAtss_3&xKRF%aujs2uza09-ioV{{<D-&(gJp`o#nYRQw#FY}
z`?E^Xcac8pNUL9~=p%T(=*F`Z`tjgy{1frsJ->8%_j&YGMW0ReryXniQ=;gjq_2T~
zv7)ah{j%e2{bh>2h4d?+?^g6Zr0<w)>&M|aD34D(xEr4y=#v$F3h5&!+WJ!!eKzTP
zrdWNIqOT@><P@u4tmx}Wp9p=MqHibtsHwJox1#SM{Y2=8;khr5X9Bnz&&1Pg{fUY`
zjr8@WTm3Xe@19S)`l)AH{Q^Z_OZ7)iv-+iqzM1sV=~ll|(RY%*J=f~jD*DLwcDw6;
zcfNg}49?@3Li*l9tDmgsvq-;srqx#|`fAcgi>-c%qHiF5?mw))P0_cLeo~3muU7QE
zq)#ig`cZgJ&*S5s_q*|&UvBjoiarzE>6gs0`YJ_VP5OzIR^O=Tn@GR7+Ui#*`VP_;
z%(Hs;IfKjF3tjvUcDw7p`ySDFaMq`iK61WoKUL9ZlRj;})z4S-HKcEXzEROPkv`!9
zTYtHtZzcVB=vOQHUeYhU$krdfqy6c|ClT*c@zaf``~H>tT!r=7q))vR<D=BCA$>0N
zjf%dB^oa{>{S}J7gY=!ycPsiH(yxJjt)h?M^Bgxm@t0vd!FhaANuPMR)n_RBOwwmS
zKTXl+lD-Q11*DJSeJ$zT_vn@=`UcY1qW&^P-$MF&=vOKFF4A{gVaI3WDErfmr|ZA_
ze9VpilB+PDiarzE=@(vY^;L?#n)L49RbQg$8%SS!jjg{@(RY&G{d>D>6@6r9ThH}>
z`C|J%8Jx!_h4k*<vzV&rvq|s%J-hjezJ~M}x7q$IQS=R@cYjZ8o1$+g{n|Ti{WXfd
zkMz}dTm7if_9u@|68K-^*=Thcir#%b>GbaJ<621iYP_$b`tJLv%M`u)Jk!;8e@<<c
zqVJ;m?#}_m;d4uu*YzhJ+|_q~PGr2IPbIzk{yaVw{_A_5cGQA@_XEGU`i^6o#^~Qy
z^hxICFnDpDnF?R3@E;VOhMQHcf33pZ_X%15tD-+;6S@DFDf}sgkBF1&lqmc^3g2Q=
zxlX#mZ&vun3LiN{u3xI~M-|TBx3N_tkt2r6^{-I)a)ob8-)C_3&r*1u!oO1Zk(<f=
z<nI+Y-)9v4cALv}$`$^Y!oODdQCrCMmni&Gg>OGht`k-G%L?C`KId}dlcDh26#lcq
zC(-9PuKpZ_zoPKn>GKFzr&!^)EBqIQXVLR^SN}$ZzpC(LdJgRBT%hn56wc3+U7acP
zoYV3972d1xG4y=T)wxjN?<#!fk+vltpHETv0}6M~!MM)x^qj}_^CE?JDtuph9^&ep
zt8n)mhWoQAJqK`grYpQr;qNJYKf3RB_4$6^@dp+C5W3%V`pF8vSm7@ze67Ndr29DM
zd#=LyKGEs7qx%uZPf&QH!oODdE_D6x>hpbv<IgJk9~C~Cu7_Qn>lFTy!udMc)tO1x
zpN`+E@HGlQn65KjopOb@D}1XY+mhGIQ3_w8@J|)K{jPHTsKOst_%{mA*iEi~mBOD>
zc;fDIo#_g{Ug4`1zF)Fjf0n{q6+UE)T;~vlFIM>b3g3FHT)#-+4=MaJg-_Z;u78Qb
zpHO&0id^S3g<q}kZiSD-_s)1-<S4vF;p-H>|2Vn-?)zx$`<9{~x|duhSK;?6`~!tg
z952^DPvH+MJbrJvPM*S_Qg~#7T;~9VFH-oI3g3Glx&91=KdtbMQsp`aD*PIS_bB{`
zedYRBD15oXx7|;!Q>O5j6rQxdTxX`jZ&mmjg&#aou3xV3c7<<sfL!M&g)dR~rwZTx
zK)JsA-V?9u#})lI3eWhPT>mzO|E%yyX>y%83V%i6yB{RiDOULH3jamnSqIDY?^F2y
z6rOyDT;~FXzo76wg-@9z*S}xkn;a_Zrz!j~h5xSb)WhWZS1SAsg~uH(*Ew6^k1KrZ
zbh*x{3cpI>pDBFO5pw-Y6#j(56ONSYoTl)r72d7zaYxDZa}?g9@O28`KSQp+P~mSW
zeCW|~om_?AtMCsLKJgg2{&@<2SmE6YKlE6+{*4M>rSRdIa-DxDyjkI&EBvtI<oXK~
z{-nbHRQSZ><@*0r_}dDPKS8dOr|^F%e3ilvm@L;nU*XLP-|R%W&J2Y=t?-d2$#u?D
z_%#aeQTWa$%k}dWUa#<v6h0zLu78HY7b*Npg{M!E>))*Kj}<=h6uC~R!e3PQE`OKn
zR4e>Vg>OGqt}|KT_b7aw!cRX{u78`t-%|Kqr^$8ZDEwZ9|Ecio)8+cNEBtMRkI$Ct
zR4Dvk3Xhy2*U41)1qy#h;iJx!>rYYm{R;m<;d`7V*RN6diwgf;;Zvu{^>0!58w%g{
zY`M<y3cp+7UnzX_bh-Yy3V%l7KPdc!9J&6r3V%`IyX4AssuljG!pG&wbuLx-%L-qo
z@Y83=^>0)7TMFMRU#>Gp;rA;1PlX>_AlIL-@c$}&LZMve3WawmeC$lQ&RGgyrtses
zzRxVVeyze^SNJAHa-C@ke@x-OD?GJWu79P%KUH|jKjb=REBtPScPf0}*>e4J6~0vA
zo0iCRrYrmjg(sBCbxu?G)e7%c__#8;evZQLQTY1`-@jb0KTqKgDSVB>PmId-uUB}x
z!grk`*O{eo_x)>r&i1LI-@Zbwf0@FcQuv5UxlW0~A5r+13O}_<u78!nKU4UmxpJLL
z6#j(56V8$A6f68;g?B4_+_`f7OBMdI!q+K0qgt+iuEIMMzUMr-PPxJx75<09PdiVp
z|FFV;Quw&@<vN!t{AGo&Q~2rg<@&cN{4Is=b%9)Gj>7L%_@4^TzEG}zyTadA_z@S$
zb<R<Ex59U*k?T|_{8fbyzgVtwjKc3wc%Q<jTq4)MU*VfvD(j~y{4RyRtMJqXa{Vh6
z{)WQiE|cq2DEwavAA7k{N8!&ae5)(uI@1;2r0@?EzE!PU{|JR&q3|w+kG)c^f0n|R
zDf~Bu+v>63bB@Obciwk@PBuZ|iNxKXV@>k-#`xX*NFknt_mK&e^Gd7oW&}U0D(uf9
z_gh6_N#2C2!s@EXg#KTP%ZjV~_Z8&@c~yCKV@}SDxwCSD0wsk3=-*%}`oHfxVPB`s
znVnyeABguVj^^d$mzR|l=2t~>a%S7U<OB_i%Vt%sS6e<n-QT60pp93lpt#Z%`)jk;
zRNCyd&Mzs<tH>!VD~OgCmsRBy1nK9=T^Lm8RjeqiEUfygqF76lcvXUKn_(TijxO>l
z<<FdzQy3Nd!JA@Q<&@=N9+*M*M%A_)xH-0UQGuBY!H~+W2W%Ew=lnGf)d~Y8u~kaT
z3(VwHJ27y3Z2P=fvjz<@aC>a~g2I7{*g<4PY>kTYxmAOPAVF+}qVkepwd<oWaC>a~
zV1EzRe8A?|)}@72dFH5*Q<_&fd$2l+Ft(!UZ_bQ)Ir$~Ug=K?IQB4_JGry{$WU$T+
z-0ro{D=5erFqgf39J9@97aVNVb}`$$cKPL{rNvchQ)#o;+8%tg{t8>YwzGmGo7OUB
zo7XNnS8o@y&1;um9-XHe#%}alV%&4073KLk`Bl~8j@3n8CG3g8E9oMylCi6(%Bh&!
zf4Yo4B8l6*_Qqte_TqN0JtjtlvR>@0^0#_z?Y!_edXqeMqu0{Ri=fw4Gvvi3ZT4E5
z*)d3KX|vaQ&fLO^d8U1FSwW#Z2Q-OSrL<sXe-U-Z$pWu}*|RfCHn8hs1zrWSZ({}C
zK9B`oh5k+sT0&8HH86vMD&l&QHhZn@G|?IhThTVJq@+AQud2{oZUk3o=M?A1o(u=o
zczrM>%q4A3erbW2K^9Pjg3{m$c8~%w+qr$PHwSIc+r9Rc!NqD$X{CHVj@{_BtSFpS
zTv=6EkrSO;Qlgd^MCH{gC>%sLU|J5M^XmPj3a-LuiaSP8Xf+027kWJ!P-mdZtL5cW
zd!%Z-I_6%$Tma?_yw3FcqbR7xocyx<(wyKnC8x4j+x1mBii&Dg2KQOPt%WHT4Q4~>
zjN(#p#7)lz)p~WSs&fkDn+)2*ZE{NI$|r{Yb_2J1ZD&>#7UopWmM>~!H+n6DRC9w-
zoL89>Esn+>NX*TtCh@9N1-Fd_<>!_SUT6@NSIhLJ-%{QSv0JIFb5Wbe3aG-|XmEL6
zm@})gIJnvhp8iXB3Z|E;&Z~!;@tkuDiuDoJMP8-#x9)=%8&v1jD=h23r5?0ns>ZA1
zZo3C9q>H>t!8vbkY2o1MRE<}sa&BeRoE8S{kuLHonaeR#rLrooN}dObf@)Nj7MA7&
zU9YMLZqup?^-{Xft2m>gJg*=>uhRBy&fN0gUb3PvFTcoK*om_>WDCz@Zhn7o6R%)K
z^sgse10H**nt^qKQ%p`p!Mvl66uTA_5d;G(^q*P=uOUiMrK+&1C}&1Ralx#@{;Qps
ze&_<B!us_!XdOu=RMQ^T`CW?9c%x&^N`u_?OPjscX7>)#TG}kO4i1GS#bxrtjP*rg
zR9-D}jcBe!W5(2+fnqmOOM9GB+wx{=jf0cgJZ3w!ubfwwpA)R`{HXk})O26eP@Ozc
z<Xs$@Lb8Y|1&e9}{Sg#Yqre=lg3myuv!Cfm%yzGRX;HDguP7{=Ra_=tR;U`Ujyo|L
zt$KZ;i@Zwfmt)SL#Rk=R_0Fv*4lWVql;%ZqisfUjqVQ^%`{3Ymy0D^RZZvozlvh?z
zQYb%N-GI`oSy5P8evUcJg(<sX@qo&eRpk}IWhTz9gZ0;(>IT(%b!X(6Q{$|hg1M#g
zC9^E>DwrcoVKjK08jS|m^5TTmBwm%`N^=qo{<1x3!pCm(S_V(ms?EdK**WKwD^I31
ziCATBS%^9;@+z6IMd#*J%~LMu#qD1EAgnzpU{2<olUJfl@(oG7s>T&%H?*fT8C9$3
zzosgmTajOwGqa++RQq7ZI1j3&y5{DzG^hVVozfZo#~t&qNt_p^^oHbAy{aOwtTI||
z9^(zRgESdct1K;@n^RC;npa$=c2LxKb#Q*m3D!?#&bfJI=Htl9;P|e7R1>a&=U|4(
zo-@u-dl|FcYae`6Q<zt2Zw&^UJcH`IdilXh4-Vhv(tfaVgUP&VCY`xi430s?Wi!jw
zgrdf)6C5+6{e|*_V{2KV{2)LVd6i6$&MB;@EG`dj$@@P^Ry(E1ylU&85e3&`{m00h
zeECts29#dS;^2}A%N#eE!SPeRFWQjQt6EU_S5-Gh)v_DZdUfS4<dl`?%m^OF%GbT2
z+ju_i+!~xe?O|<DhY)J7Htw8VX>mfR8m~@_tGQ|wt8GB(*9_)sMd6&e#TA7G<|*7v
z^ZC-uV&#(|b5pYcwO8A$h2m&_PD%N!8FS@_shUKs5)?aEj6AT?K$%yqqB<v9ULr5>
zm~DQ$!u)x`cQpDB(%R#`3QgnHG2M&?pB<<f25$6P2Io;66$hV4gUAL}3qGkS3=YK`
zs;0^YRx=mM1%>A6PhnZUd?^<s&{Tuf>c4{%$1A2FNe5O%kPUZo5aGazW+?>M+Z!B0
zUB~t8$#z4##GPzobzIMW(4q~VJ87)nKCu1z4;I!dyqn@+_$9@_8s?C(!Q)C$N!Jam
zS5{tC9DEEKe8d+Grf+bX)w(u_aA3vavb_AN;&Y0t=H*lsmj)k1s82(JZf-!lfyyy=
z?gK|Nrg)5g1NHTZwgDr(;RYSUP1%@e@*JM9{!4um%x=gJK2M$4|663jjLP6D#eB5e
z|4o}<_ZCh#_M}ty4xSLZ>wpObh31QZ_EOOPo;PDgg*)0}bMU+j&qV-cR^*ii#5M>n
z+U$&S>T;Z7@jkeRm=!!m{{Qka--FyJ_-_bROUL{4=7AgH2EL8#6udVqop{GNwqnQk
zrg|ij6?_@f{N}#r>At_YSHL9y8u%s!+x-{&j}10T{tZReDHDy2|0coj?0-nWjKBX~
zQPZTs<)#g;z0sK0fx&;0e-HdSjcM>Q{+k9rU3-_`^iTAE#I%Y;dTGaS{-Xko<lkCi
zom$Nf3SP#4Xz-K$%^!0%{`&?0`LDVs?Yo0V`qXL-F>TB%H~3F#|H^A-Yb5gXKK7^k
zf7j0aG=I#+{7%ChY5l{taQ$`d`Mvq$OH%%tTB~&9Z1QgrXkB~9uMU{x-wyvFrjhq@
z{dVZC;1{WVN4!<K?=L&O^LOuW3x1LMUyuH$LTLKGRq(rO@B062z$E`J_&Yty{MFvQ
zH@jK#Zx_bTWO4PJ|AzsS{Ch&??^OJ|g#6nG{%aNgzL5EUQT!9Gv`Jk~GyY~NaQ-nt
zcqxBmGeaYh4ekG=KqifU3jF>3zn$QJlH#8Lf7jps&Uo$J`{NY<Y$3lH3s=vL%N)f&
zF=YM{#Xl<K-%;>itoWyd%zusI-yq~4CHOz7_@{=<zfAFO5%P}~{6A9s(?jNePx0>&
z@+S%YzbgKjA@i?M{3BP{ndZ;`-30%U!MY4e#GF5}L+0N)XfLh5RQS7jZq|RY;J?4(
zpBpm&1jRp7$ZxK7c>SHC_(wzLKT+|o7V@VE{&N)n>X7+M6#qIQ|2V<FPVuh|ng43V
zzg5UTUhscZ@vjS+{~^V{Q^-F-@P9|~ZwQ(HO~pU{YCF^X`ES-D&%d7)|E7@nzgPT|
z;P0=0bB)UW+XdIx()w=+nSXfDURwWILjH+@|AC5sYsmcjD*i=6esizE`A<{)J3{84
zqWISf`O^gdYQ?`ZWd2IUzgftCu;71-;@=Z8{|$<Nmymyw;QzGZ-y1Uj<BETukpD2j
zf0g1N+1#v(_4B3wjqv_m#Xn_X?D|jl+PmYzTE#ye{t3<)Ki&Lw_!q@L9sd6MKT_}?
z6)aw9{U?UZzkSeNTK`cYe}>?Hh~l3VGXH^!f31-J7{UKc#XmJ<{!<nI79oG8;D4#&
zpB6Izg^GWNkpFnWf2rc188ZLB6#vLSW9R>5!T%k_KPzPZHx>Ux`1|w!B*EW2RFdX@
zZpi$<EB={6{w%>iN%1cVnSZCCeb9wSdhnnB$`$gT5(wP!!ySLp760mx`43V2>xBGM
z1^;P^e@)2zrz`$VLjKbP|7yj*E@b{n#lKU?pDp+=R{ZNj=D$Yq?-lZ&Dfl-l{!JnC
zKcM(0Es9<L(**xF6#wRs`Cn1|)8Ox~|LKDNcZz>&$oyX^{zXFmT)}@>@O)Z2{<Me8
zKQw4Bt^XP!{|v!@oZ{aZGXEIGzgfs%Aow4n_;-cOe}v-SF65sn_|H)Mdqd_wTk-D`
z@)rsI7b^aJA@k2u{1dLR>(8J6=C79H<Nqy+fBY8Vu77V({L|s@&NJrukNK<Q*#8N|
zKLP#;K^y<&+B^1$;-4+#H-8nJYw!BCQt?j;ng0#NzgEZ}75sly{8K{aU!(Xp2>B}n
z|IxvRTGH_+EoA;3g7(t!r$fkZKC9yKKT7dW51Ick#lJ_$e~#c^r1)or%%89LC*mK1
zbo0#2|7yX%R`Jgcng3G7KNbG|`Zs?y8jpXI;$IXp|J{mzu8@De;NPzJM?>a+LGiB^
z@?R+U_bC1~A@hHx_%{jpYXtux!48quUv0?z8wKs9_17xozeMm)R{ZNj=HEr}?-lYd
z5d4o&{2M~%pQQN5UmI))UjF>QT=1W+_&0~le}>|p27iD3*9!g@DE=)W^H(eWSwjA+
z1pg(9e|yOMH!1!#LjHw<|I><pN67q-EB^ID{zZcS`-*>8$o&6R{M&{6b%OsNihobY
z{C$dlmyrKD!9Qs;`S{ZpGXG9Nd+GR-a9z-`;N{Q%#e)A4ihpF7z5Yz-ud@FCY}NJe
zCn^3Z@b}mMje`FS#XkZ5?8ooVR{XPt{PlwWrHX%I$ov;7{!t<SErNfe;-3;S{~d~d
zgOGoT;Qt@RKQ(0jR>i+X$bY-w|Ape89y0$Yihqxgzd`Vi-&|gQnIZFU6111rU*vi_
zQ~mjWm*786@y`yKe~jXv3V(n7Hwym8DgL=3^JggjnL_@11^*(&KN>QBzT#gk<ZlxE
zFIW7lL*~C&@vjr|-!J$#D*m-0^WUNPw+i`}3jXbie_hD@FDU+<LjH#Y|J90rL&*GJ
zD*o|{?fUcQf3x7fW$^t->H5DZWd8V|y|n(5;P0>hM+E-~ihoPU{Cg_?SwjA0g8xa1
ze{0D6$0`0rLjK1E|1!nDBV_(!#lK$2-y--gQv5qZ=D$+$Zx-@DCHOz2`1gd&f1l#t
zCFEZ&_`j<7_lC^>qT=5t<bPK1?@|0CTiWYSzTV^apDF$+H^i?0R>6O(Ve<NqhkruQ
z#(%N@W<h&t{inm<U;obsg<N}gT$-r(Cx*<wkK!K{^0x{8(-i-tkoiwn{A-2$FADw(
z6#vwa`7cuZTZH`Wg8#jWe_F`=cPjoJLjG3-|8~VcGi3f36#vMLvGae0;QyWCpA|Cy
zSBifk{Qdd=y5K)@OL_g}hRnZp&|X@9nL_>!!9Pv$FAAA|f5ksn$p4n$KTYwk4w?US
z#lKF-zf$nOQ1Pz`nSY+*-z4OJNAPb@{OdyIzg6+?6!Lcp{x2&2^&#{BpW@#u<bPlA
zU#<8zh0On@;-6$53<fWEo-v<)tP=bax02UibIAN7g7(t-OM}0^{y!4@GZg>UkogZ+
z{ELMAU4s8~#lJmd{xcN+8X^Cuf`7H*-x)H0rQ+W#<nI>zZ&dudLgv3#@oyLMe<AoU
zQ~Y~F=6_i6?-TO(2>x#>{(T|yuTcCG>h1dT=l|D&|96Ui{8r(vf4@@v)8X&0|J8#3
z@U7+bp8)@appE~ssn(NWL3?TaXAAki3!1t1u3r-s|D=%l_fh<7h5WsO|Cx$^O33`D
zD*g>Z{vQPY8pS^?Wd8FN{|+Jl8o~c|#Xmh{{+kv59wGnFg8y>GKPzPZClvq0o9#?<
z^UR$8`UL+E760sz`8yT=RQUVr|2M&Zo#I~<GXJlNf3A>!t>8a4Sm4t0uV~2py9Vv0
z^<ORIUnlsVr1;l_%zvEX-z4NWLHYPosrc81%wMMXw+i_;7X0fK|N4;muUGtgh5T`X
zf2-o(5HkPMihukqcBE5-eQsW6{S6WPdldiXkoiAT{L|p?uYdDLs(Jqp8!pfPmXP^}
z2JNN!pC#lsUnyk&RK>qNWd6Mr{~95`d8Ehwrz-v(A@gS`{`EqBQ<DA9Q~bL^=AWzh
zw+s0b1pnI=|DKTfZ&v)fg#6nG{?9A^eIfHdqxdJ>YDe0i|04zeFBSjD)`2*91<Px|
z%k4i0KUMrw;P0>h?F9c}+sNxL0sidA?}rBMrS+FB<WCg*Cn)}jA@lF4_(z5OI|}|;
zihoMT{3j^>4MP4=g8w|lKQ(0jD#gD=$Uj=}zf18?51Icq#lJ_$pCtINRQxkT=6^%+
zkC-oZ1uuX8?<V*U86nUA?2!343ffEaKNbG|`cD@8$0`1~A@h$>{4<68V+H?{6#r<*
z{KqN&)k6Lh!M|MbuMV02ABumSkbj)uU#IxjhRlDp;@>LdA20Yns`%H1%>R($-znsu
zAo#zd_&0>i|EA&}f16!@{`^lB{C`pWn?mOQLGe$5zrX(X6Z{iL%Im)+Wd0FBdujb=
z3Hc`q{)a36ts(Q9zh6u8FB0+}DEQA*{5wMC&r|&Ch5TuP|5b{AXUP1QDgMnu{(}Yo
zhZO&wkooUZ{JVtwlLY_Q6#w3k`P&u$J|X{Mg8yp8KVmM{gBM@#@%t|o|CHNf*MGX;
zzs0ul`iqDEhOU2y1ns5ypALV2{U0g#k5l{;L*^f&_(z5O8G?V7;-3^U{|SnJt&sm1
z!T%h^KQ(0jIf{RakUvxKzh3cA3z>hB;@=_UKVI-}R{S$V=6^u(kK7SE|0fInZz%p*
zA@jeY_$R{OpZ_Nb{@*G7xgqm^rTAwG`LhK7t+tcbe^JQ%n+5Hq^`9%`KSl7Lp!ipZ
z%)h7NUnk_BD)^tG_}7HYf1={wB;-F$@IOcKuM3%fj^f`b<j)rTZ&m#3L*~Cx@$VJ#
zpDFmaD*jC&^FOWlCpE;b|7n8%r;2}b$owBF{%P>{*Z*|EKW=+@{k4Y7|EJ<#B;?N(
z{F4>`_K^8^3EE5RzedPEL-5Z~{5wPDKV0!|7V;Me{zZy^SIGSNihsM1f2QESQ1R~#
zng0sKzfZ_tB>4YZ@$U<nf2rc1aHm~={`~)k;Qx-|A3r=0hq(TIQ}IuSzkmN*BKWUU
z{1f1x(BF&o|7TOJfB&oEpDpAs6a2>p9W+UUkB0`ll0xR+HE1ubzgi)GRPfJK{8K{a
zKT7d$5b{?D{{K+?(?aGiRQx-H{8fVgV#Pl_Wd3Uu{~jU#IfDPQihowf{7)+WiFd`G
z|EdN5ZxsLRkomt*{8QoYumAG||HK{S`Ck+=|A?TyH2-sj{PP9>48=bhGXLR<f3=YR
zLcu?(_}7HYKU?u{67tsw{?{u0wITB_RQy|o{Fey+k0}22A@e_|`1cC=7YP3URs0)5
z=I>Da<L{0=|6MNl_bL9(A@l#J_@}`?Sf2ea^ZkQb!GGHw<@MJRGJitQURr-yLjJ1+
z|NRvI_K^AaR{U#({0jyDQx*S?komI||9T<+BEi2}@$U+mzf$pU7xLE${<kUqJt6bg
zEB;+V{_6z)=N13Hkolic{1X~u&wq;r|4$YF$TopEcx~wV??c5u1^)i|??%CY<KW--
zFiw2^mjHjh-sJaxDE`?({(8ZGZ^b_`Wd4+(y|n(LLjGF>|7^uSC1n1;EB*~a{w0F{
zMT&oF$o%Ii{w+fO+Xer7760^*`R`QxdxZQAg8y5Je`d)1uPOeKdt%RjcM1OM6#wjy
z`F~aXQ{nHQ{~87Vy+_IGFE?cVl%Tyd|1*XB_X_^g6#r<*{HH7a)k6Lz!T(alzdB_8
z3l;x5A^-h?|NV-8ZOHuhDE_TN{-uKd>xzF}$owxW{+&YphXns06#s^h`M*{C<L`|<
z|1}H#yYDQ||E7@nM+fbt`JV)T|NQre;6GLIZwZ<IWW_&A$iGbRuTuP5L*_46{ELMA
zj|={b75|Qq`L9v@>xKL+g8y>GzcXb1Clvo?A^%f?f4Ab_6EgqDihq}of4Shl#b|l{
z_lC?rBxo<q|2`rAvx5JAihpE8AP!!9y~pqOR{T@`6}$dh1^?3&|9JRs==yhx;-3zG
zfBio%_@AfvCx*;FSMiSu`P&5lI~4z<koj*>{A-2$FADx`ihpXz{Ld-=Ekgcw!T%e@
zKP_bbFBJa{A^$6a|2DhG>n}58{w;&{()x=u#m@f~g8wANKPzPZzbXES@b~Bc>w^DG
z#XmP>{yfD$Q^?;T_+P8|7lq8fQ1Q<d^1mhcFIW7lL*{=%@vjr|uN3@y6#tr#`9D+q
zn}q!D2>v6J<oRD0GXK^=dujf63i&$)|4hZdK4ku*6#rf!|NDafe8s;hWd3s%|D^k3
z*Z(TP|9-{4Ib{BO6#q2%`|JNB!M{`SZw;CMZN<Mx$loRSuT}ipL+1ZQ@vjl`e=7JV
z?JCdz&XD<c3ffEazgfuNE%+a=_;-cOf3)J?F6940@UK$*dqd_gSN!{g{5^vIU5bBS
z$o#h{{t5Tn_2<w3uLb`O#Xo*zAP!!(O8>9o`&SkJbol$ve^v|rKPvtS@K0E8E&6|_
z_-70GzZ3ko+fAPTNg?wO586xfzgEcKEBGI(_@{)-pQiXX2>E{y{0kKSw2=986#ot(
z{~E!+M)6M%ng4vnzemXbv*5o(@y`mG|0cyh@qyU$U!UOLs`zJz%>T6Fp9+6}{r@KT
zcPsuyA@hH%_~#1w*9!g{?JlpsXvq9)75{1>|2n~cwBlbAGXD-idujbQ3Hi;3OzwE<
zj*CYt{<R_Vrz`%gLjH{f{}RQ&K4kt`ihr+=KThz!Uh!`TnSYVuAHOvA{5M4Ke@gLh
z4w?Tk#Xk-HZa<sP|KkP!F2%nkWd08n|12T@=7Rr_WO@Cyhs?iG&|aGVHA4Pjg8#mX
ze@Dpt;}!pUA^%o_|1`zFD`fuD75{c2e}dqDnd09QGJlQY-zDVVM(}?~@$U<n|31Y(
z;lbGRpZT}O`S|ya;vd;II9La-4PF1esraYB-#`CtC-|>Z{1f2s`rF@`;Q#pjuZn-R
zkUvrIA3H`~e~BUU?;5m^3;LDrI*6Z9A^(no|4E8}O33`jDgF&Y{!xN|nc|-sGJmn+
z-y-B6E%+}|{L@3`zf$q<5%MPq{>_SiX2|>xDE^U$>`e9N|89c+TZ(^n$o#J<{;BZy
z&wt5+|8I(aZpi#UDgK#4{;`7pZe!*37Y&(z=b*i`{;GxiDT4nAihp&;{KqK%bwd7e
zf`66bUmG%ix#Hg{<R35i->LZ5h0MQ1@$VG!PZ0cHSNt17=6_l7kAK*%KY#wG3jXU9
z|E7@ne^vaG;P0>h{RICBd&u*@C1n0RgZ9$=&l2)a6#Qo?{;eVN&rtk}g!~5z{tb$M
zN67rQD*p9C{xre=J;lE>Wd4<kf3uMPV8MTz6ubX7q3eep_@~hY550|S8MK%7e;54g
zhS<X9{%4Zlzq8_>G}>POu^+!rRQ#ilTcyAL4io(M4%!<f=TCvZ`S-E>m#w;<>=(2*
zJ$38MZE@`%qQW+nZDX{DpuKD7e!jD-Q#xXQGR@jR``64vckeauT_kcs&|cbqwHUvq
z8*Koy|Be#IZ<^wN_Ym9e(%|nW@n7s;uCyP!qisLtD8KdkadY$^O8-+&4E|#H;MD}7
z>Hjf8|7#Tgth23ucJTS4|BCnD1izoJ_;<oTYcJct_-6|K|Aar!pQicN|5p4vY|hq=
zpZj^6(*L7s&0dW}#`e!n*E)9m>XrVd%(LT{xwma=`hSAZ{|6QS;@VC78+OI7_cp(|
zemmNv_(#n@j1au)AT<6b3jV=g{}!`$`<wjBwtqUP@4wjJybsF8yt1yf{ZF~UZkiH^
e#s)*`;<)3AIXu`sHLyhWSbN}`k~NUC|NjHzCTIWv